From a4782a0a7698875daac6bbb099c3caf7a87a5df3 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 11:38:24 -0400
Subject: [PATCH 01/28] Add files via upload

---
 .../Diagram It - IoT.pdf                      |   Bin 0 -> 1266282 bytes
 .../IoT - Wearable Device.xml                 | 25945 ++++++++++++++++
 2 files changed, 25945 insertions(+)
 create mode 100644 Templates/Diagram_It_Webinar_Series/Diagram It - IoT.pdf
 create mode 100644 Templates/Diagram_It_Webinar_Series/IoT - Wearable Device.xml

diff --git a/Templates/Diagram_It_Webinar_Series/Diagram It - IoT.pdf b/Templates/Diagram_It_Webinar_Series/Diagram It - IoT.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..0ed63616a8b6a84b988f5b064beb2498923179e2
GIT binary patch
literal 1266282
zcmeFa1z22LmNr}jf=fuS!V@64Tj3TwxD@X0?oMzo0we@U(BQ${9fDhMcXx-sxZOQ{
zr>Ezeo`0TaX1=d))pJTt?Q_oFyLK&k*Sl6x$iEY#XJ%kSrXXEe9U4PsMP@>_HLyVD
z<wa&xcDFM|W)#tP(zmiTMP`)Mw>EZs`hcGwnNeQf)cC!=fw9$Zdl+S%tsRjyp~pTQ
zr-aP-4*KYX%>2|;`?vOT&Q4b5Hqhf)pp6v&bi5<9!P6UPBV!w*r>nC4?&=~A#`;dS
z4#-pwj{tFiE%a^*umTuUL;Gd!WM%x@{&xU#fIf7;1N6}vKnjoqI6)uje|u#MP^SLf
zso8&b>OT$aX$VgpaWJ-d>gsRZk})<i*B7>R`)w>t$eb)p$ZSmP&@nKI*xEQj8#*F$
z{Hdj)v7@cCgCTT8oPXLOWMg9s{g~@d@5CK!o$dZI8_Ev)HjZ{r7cz8*p6O|Rj9ttP
zjTOa(pL+P$@jspWFS9RZZsla`fXpanrSD|?&e+h_2-@5C#x|x-X2_u5E&@Hy(Fr<B
z*2r!tm8v|pgq$xH8h6#;5F<$s;)PAsutE-nkY5WK@HnI-F)BW54<emajGR!1JcpCm
z929&A^$`SAQY+W7-LYnH7@O31);EOgjY*>r_1bc^FLTDEdc!Cp`6TX!sYG`bX_qp7
zR7M^a&$XIiZp@M4-9uj0KB5T&&kNJy(#g><S1v6QmA)2p>S<EDE}NO1RyMdbE;GLK
z{o(z3pJ!#7{`eK2Qa;#cj+fWVgXyKF`NQqji;n)H5#zz0iZ4BHABAQo;X*gxjPCfm
zovDRUzWY+z)3ME(Be2-`6&vG=Wi(^{^v9Vm9cipmp4&yQCdEjyMfy$O?b1n@vQ+fR
z?|%ft@d)#vaV0Z*d5c@kNsZ{Ef_|`calgC1fTyUdb-;?DT|BU{5nx~0#qDjo9LdD?
z!x+8p>H|buyDE5o<Wh4cja9;9hjTgMN{(~XMqnHFL-|^vT$cm?nkpRS$Z=i6V(-nk
z;CLJvp1fzbe<N)n<>R`1f{?;CH#tu$P9I{eMkN{=H;vQF(y$k%q2e@3<t+5iZN6<W
zP2wl5Vduw2vg=i#bE!JxmD*TERh9uKM_WQBCj!!K5@`<HS~C$S(bW2ga?SQLtLAeG
zC4AV){g?gKYEKQEww_DHKXe>T8<~sayf$n=W)9WYt`CvxAS+e&QuR`t`}!ys;bUKa
zm3>uwRjI~E7`5AZ+1V}XOG>C~mUq=~<)7x`QLQ@1$YF+1axmf+L++coSPy%whC0>3
z*&Z>2ydY(_)>4bZh}Ln$W%&q5KSZ<77yZbqY#gZ6TmM4d5x!D>LI_JoV@jTE>h<O&
z-Gr^Q$^gE9n#n@uA%6`#J1B-te18k2RX6;rmeHjgE8ch1Nvs_pvQmnJ)b^Q6+kF4}
z?#YHAontb6g6I0SARvn?lYijhpqakPv+-f}p_!Lf4*rb+vcGGp=aB7>^^}yV2~r6N
znon^jc-uxktNyrp1fB8+O}nt*r!zNr?XGohzYmB<%UU^0mySJB(dUru)U%!RUeDfl
z4kU6)eTf*o^)v$yWO8X01z*;2Uwy&poo2NXrsY$U8U?m%Y-%6nO!mF_cxk^=W(%Lk
zHlE1H$;q8llXE-4$(`NrQZL(=xgg%SAh_jWS#|u$9Vq`IXN!T0z$q12uwHP&j>3L3
zrcl{5!Q4X)dF4B2?-4?$#u&4;_pZWRO<-k=L5PE3X`5-s^UmpY?p%kuW<U6|x6}Cq
z9ehvnO8VX)W$L}BH8aTCy<a4f{4oO;bRR%%NA!!v(V<T_H)%zPR&McLZxdpVE!wU&
zFl|A{{wfq}wJ+=KyhV#-Mc?pvW*59Q``XrZzjy}~8v8Wc)mK~^qHhmOzkoA^iF(di
z{38mFDN2)zT1@IglQI|7wk9gNqDbOdQZk;YVvB4>Z%NtR@iYqin3%?WxNKqzWI+h0
zlV|uJV{V-Y&=hSCEt7=-7QN;uU&AD=DJQDF|Em0ccZab=df)scqW>&y{w%DYgwT_)
zVrFJx{fhv9l73J7G@&B%&&`;bekasKgpipTn2;F_^?!T*tK?&T62N~EeSeY9PEY}8
z^CY5wd-2;|7Gy>leJ2O=Ckf5M#K6qL#=-d{HJOm<fBzOLw4s-Qiftt`eIs)lQ)pXg
zli#Zv<|jq;mkUC>^`}lT{Z1G&|6Ug=IU6|rrVb^oe^VQhP;KB~XZs|Zk)0fzp`saV
zZUmLgEKF=5WJU>Nb5k>@Qeoj_e$pIPwhl^m`i9U(f0g@;!sbqn^2QD#w$^sGHcu)D
zdYqDszM~~F%b%6eUo^lw5#_&;|15vfqJLEYkG~$5057D(B*g$Q&j0`z=pFDl3lIUo
z!##(84hIka93BAy9ufHkGBOepG8Q@p>I+;fJUm=192|Ti3KDz*GC~|2QaVzyx0KX0
z)Ibt?CVDC+3My)<r<1@SARr(kBELdLeno|kgHQFJzCE@8FcIM{5dp9;Zvf9QVPG*~
z9y<Ue(0)FL`RxYy^9|-1EVRD}h)BpN&<2$+0MB4xVV}XlK7S4e2W{;Q{Tu*?`TXT;
zW+C`j3i=3d?6Fw<<Gvx13758FD~=qIvl=)AAR*)6;sNm~-cnLg)3C8~aDuqFMc#>u
ziAzXIDJiR{g4NVD42_IUOwG(K9G#q9T;1F~0zU)=hlGZOL*hRsBqn|OoSc!Fm7SCO
zJuknkyrQzIx~8_St-YhOtGlPSZ***YVsh%&^vv?g>e~9o=GOMk@yY4g`Niec_07|`
zV4&mt%k57C`<roLLdW$C4h|L$;b~kj&s?D!EGFFZ*Ua!Qg%l9<?O(lN@khiGj{8>H
zibTe$c!X`>FoKLj&bCZ({4})RM)r>lEa3mw$o^$ue;wBh02LMn`sKl50t5ipis4jW
zpZ&4@6U@QX@Eu>CrRKsQsz!G_{dlesGfY%x%5e*6EQ|dh?e|;pAg?$542hc^_#F;R
zl37ZGFIYCwabxGjg%@34Cq<r(wsRG`H>q9vX3XC;nPPicnfFhR$vW=Uc{FC8UcWVV
zb8Q9BqzG7#YdaN@GHf)|!3gybxa5(>x}p*z=twTj5mSyea9K<)yzqaRYayShY>PSp
zbi~G`1Sy@IZxV?KvJY5lEMynWAysPj+GzW183yS9c$Do}{Zr8G)hB$_g6NrchOW~d
z0St@uUOyjll`xALz`A`+B<bp2dkta52c``*?gyKR?u!Ij3H{71Exo*F&%R}ZuUS{S
zcp#A%282^(F=d2P0sh$j8RlSb&+FBNv|EXnrY}y6$(3<flVz9~m`C0ynjkG(PNmaQ
z>ccK)Pu2XHPRX|+U2JLeqzaG5#QhtJ0xlW;zD<S3@X;>Z<PD`tOa$^rK#11`_7n-m
zHb1V)mrlo`{cS~D$%^<5Mfn%Tc48w#LTMd1K&<{l0&mEICL@wsXXbR3O15tDib7)7
zCT}!BbheyWr+q@>*6@}0wd*bI`qZZJnj_VUJ>%m291mmIO=Xr3*vD+k`4NDlyE80l
zjGJVfWjjw4RYoHg$OTw>Hh1FK<=(PNc#Z|;lPb@@&N&$DW1}99p<p+@_dfhdl@b1P
z9QpwGWBX^Ag9<0@SBjGdsN5<k)eQW{3PCzZ1fPyr10&NcGLd9XI<@1t<8pDi>M15Z
zPmH)Zwk6ednCzHF$c>IYKP-;!InuQ4lS6e(yXt8rdsD@*=f$;*lStdmz0io!XMK@S
z6(Cd{a&W~H%uV=0IC+y-e1%B518m8k$AAABvn$g=3~3O{M=K@XA7Zbq)0c{|%G1<;
z?wfIkjvZPMuDiFJ$hgn`2*~O#DJVNJIdMypI$G0_3$jx6T&mYpX?R}?($gS+faxLQ
ztI_kAqWrEix5HVkz4-oAt8X@SHcw#K1@<epMtEQG8)wCcQQC~zo71_iZy$2SWG&VC
zW+$4{Z7FhN6-2T9N3j${0e@`&9CLupo?UU7g!DY?<q*%NmHlfI5D)~L<~Jpsc_k)R
z7N~lR*0$|IR`zgyov7#Nj}MTQ<&GOZ0Qf7;yVdcr%xGdDXjY|~zA5?QNIBrhj4VV^
zCLHaCGJJyAi#<We60THy4Yny+pB;FhL@kYWa60P$T-<Ez(exm7*ccJDEJNA;2H0Tg
zHN=zOlWZM3x5rYu&<*f?0U`tOsI8Qp58*8=YP?O&p}bIy!ABe&MA%_+we@;7J?DUd
zP(v9%AVU`~b@Fqcytp%UZmpCTBIo!%msce|2)m!8^QL)3-5og*eqXtxKTY~TC*s`I
zM_&{R{CeS!wf)brwtxGcRrU!an<h&{b3WTl;XaqPhWg1nlDshI2ZD#%As4P8ykx}p
z1`?G6)+7(SUt_N^mz$$XdkJKfZ<dPrEw(a)6GR8kVqB~5aMz;Wi?LuC<z=mNUZ_3-
z`1=Q@@q93k60=t<{V$YH_9oh7oE`zrpdr`-LKosp5CZ$yB71Io*d(nCi{`xP#%!LB
zm?GheTudrT5CYuV3(2*>@O3YRl>u-^VW7fioOuEV&5n9QrAX89v_{D;S?1*0Ot;CK
z$sY5%Li2pH1%(eYGC`!yS|9>{1iW4UF+4aI#iHPBx3Rh;$x7e5q}<}d(_=g@V^7(9
zSw6kg<`Zj%yVQ)EOD1+1sY{i5%T%!q&Cjz}SyoF%DKNvR@hwX#+y@MI^f|kOr*6cD
zL(W3vb<VxhbnbjFe!%z*Vo>4{rnc4OWk8V9sN*sd@Cq^`vB?4u_bj6u@jouIoi}Tb
zU8hCkVoDXdn-{QOXq4+R_UGz<R1kGc6%xgghxudsCzu25$*m^DhWattg8U(zge)5O
zbh8v26QvYvq2Asu*2n|A0ZXYUsiDN==JTo2ATJp@UibXI#S(~S^;)zlURIh>IF>nu
z3vy^6Mc5L6CwVWvbuyXl&1#nhWcp=2r0rK2gVF7;b7YoGgt%V`>=Z*0g%zw6B>{zR
zs$ti-KkjbGF<rY81Y^C-jWkSIma%7*CO_pZ=aHl>HFf2plOvCxn|uV+e7nE)T`M^E
z4LIjg>R4&sp7YTfI#syS{WiL*!<cr^VqPa&sKKAe-D=hCR4bVK(}(j2!^UyY4$a|A
zLF?RNuwdg$^Z6B#6Vut2cw%z(`NY8kRFSBfv@a)07)$EAL@Vp{Y}qMC3n7#ix6O9q
zcuX`lrLUssaw!>E<_mTHltQ}g2yAeS^e|fflDtY)lm|{_3^A?S8uYl*aNZxNn=ZmX
z^Bwh;EdU=G4>YCSq{X<xmt@l%xbI)Nbz!A$r{rDNIS2wl#i}J{GnE$+9t>yw!PPa$
zU^_qnhP+S@+3p<dOx<#xn{Q`l=H$0Pk%?4)&0FWUKuO2g?KGtM)Q*c@J$Uqm!6@J5
zCUqB20r9cT%ap-lGL$=&A>wU|MuY0}n1^R}PO68YcZ_*vNT^emSd)&cz4g`J$C3$X
zt-Hg=u}~}6Ke?^g;^VrkR=KLFHO+7lHn+`g57aXX6#T>W|9{o>ug%`Bt}B|EHJ==v
z8}tokAA}d|<pcB*racFB_D<858B?`#Nlw2>wcPR{9<MAqG=--(>`mNJD#P>ZS{Za(
zdLaP>ZDNmbgnV_=#=6Qdw>`J^k5003DKsk3lOz>5I3tY_LtqancFR<l_=c0!X`V}c
zO;_})FUTF?Ai5#)G)=OLwq)lhv&gmNr0Buc_^O#K$ROW<t({)r^Zp~irf9J^V&Kb&
z1u@Z)cke@gnDf1)O32Ix0jYmGQ4V|SoEu!MCt4wkeeW)J<wd23&AD`NO$`mMJph0p
z2xx)bo{L}juAn~A(U-BNAzn87fKgCegi1&)JtN>@>(2KG=w&2_AX8=34*vL?H4f|8
z-b6KCft5@k7Ou%vzNw-0_A09{)`9!%j0^<qS*bD_b7I7zE8mJ|NGPahMPqO!R?ejX
zgue$M^|qyL0-ghlX~MUIDZbxwM<ny5%ZZPj97J>1fNF0w<PyE7bXCglZrQXZ*k<Qx
z_KPYB%&l`t+TW~_ksA?zFd`O*&zsWDx@t7~pzc;SysHX;A&~f$hVco9mU4j$_FxSf
z&jFB5`#x_k60Fuis<#&A>x0b9VTW5fC}Y+@up-xt^gL`@-z)%CrqB=9FPaXT8I#3y
zwVn9pG}a$3r+xX;dE7bdv6ME#CEmK_h(#+K6h|{DM<bGz=75R2Gg8n0(D46{SvYdR
zTyGQJ1mR0+2jo-r8n^+_H|iKMuJ~_N%kU#lX18wyt@zgagLDuP%y#5>o!|mklN%P^
zjGm!52e!G?A5OuXduBcV70~i&c#V|w-p)=;%rYO(1d<Bw$GvP8z1eCQr1><yw!J*X
zn;28}2za%<ReTpP)`oLq9KJ)$QkNtf@ctSnj><CZLF<SMsaN3?y@9CV<p8(~B5rw~
zx-3B=HahVsj$p%F(kj?=2OWTiFm4nH(>Fgi<ZgF5KSX!h#3@OeXz1?`ao>6_BC}Ha
zD(ZP({kgBeh~~ySJDridm2@6${=PG9-7od~dKuxgv1iZzPw|<YirTcnWy*>)HOlw<
z5K5YMG6Xos;pE_O^NNEHqZU6843EW<R;V(nkBcfw9Ma!dBz{uIl!gr!WD>ltZC%Y+
zi&wAP3@ov-ex)!*a;qdB2N&l4%n6Tc;WLGOAjFNRhZo%d3OCs*jxeCksH{~DF1k_o
zHN&Cxxq*7S#DT@lg<Vyjf?V(Vebar@noQHrxt7n{co^4xG5QOAG~9vXV2cws$4((-
zaf}dW>#QV_<85X{cnmpOa^en{ltgkc-wGOv{4k@&tYWoUkHJepj3g?&b%L5T&&boj
zPE#ceD)BVNWWK50*$r!PTztrdqgMIeBS1FF!)woYL==0_IS5NZ@cAFx|GjhY??F2z
zX@sM^>;ywA{XNCDi7ZMIRSs&UDE{OTm&`Tkb}T5~V~upYJGm4Yn$=|w_4Kk<VhpM9
z8RzlS^qLR#Q0(&)KhaTB$qEv}g>_~HPgQ06UFmDQLA7&ICMb5auML;kPW%e}wHdEW
zKF(|PDV$-nl$R{;Lg>dRbC2Q%<w6^Dy$dz&1Mrr{&JwsZX_XPv-Qw!UPltqJ(OI=7
ztoP03N5eOgP6bAMiXTEZl$r5T?J*Js`iYxY5+4B+#`EP$9ry>|N){>yv+YJ-c4X<L
zGmzT1G3vKmf;K6W`=NoUlyxpH$@%i8RM2Sn2W-d|6bF!m8tng=JEqMTbf^E_jOwC;
z;^51hJ;>lvVvISLb@MzW{SLZ2Lion_B5IXXpyQZ}iOQBzhsg8<Sls&&fOrtN;wi_|
zR_$vz!C_<lcKx*0@3ypFFAY1|eTTKIW?o6AakO}5R-r0!#{Q0lfrUj(XiH3J&CVj#
z1>ZMvU^KfVq6k;x2aE!+MSU3%Syt2jQgH26ynoLoAA^(Sois#ys_h;umzXB8qI?X}
z^}m&H@qKybDRApCG?3zr{ma4!O})sd`6&BjmqV)Ei8=4~y<j;^9j{R|0toKJ-amPD
zH?0Ub;*z|0;1jv~Ei5-wX3W#3%5s8F9t!%#)hLK!0sh$jZ<+(AG`u69Z^fBfkVFkD
z%O>gmltNFT)*0W>NY1Z#Ytgh)%DEa^A19_0JkE}eE)ulk2B!4&m)b4zoL6=$M+&71
zGMez+{mE#)Bk2k9LReTpyepS?<Qf>k^r-wemA5u|<>nK`N(7oD9&9$^sO^MKzy;c<
z33l3fjs4<E+RrwoR(GQub}X`hEqKW#J63H5EHf{;H0`9eMqS;+G^-UAW>AU0C&<<J
z)tRRF!$SRuxU~H$b8e@j`7#RDDE(VXuUZy4(pDYy^6CIY*aWWEwZ+`wv}r}=6F#T2
z#$`GYM$W_SO5c1$3+4|N3p}6(I4zmo-&o=QXwdoD<Y!;U9Nkt=eO3`iSX*&C5dYGV
zxB&*7on=W(hlfCzp&PHdDO%B~n6Sk~j|e=Bol%s}gG=1i((~K);Ed|*&{T@P%7}Ts
z<`VY2eq99FdL<7@Yl=)={sr0HI&RySZv2<x)t0yJ`r}RxzochPP_t}EZ2+mc(H?#h
zz_+!@(?^G4&bk<K&F|}sB2yaZPsQ${3l9BQnCyqAM5&LuBd~wc+AgOmGtU%GSEX1j
zz49wfDbYf2?vNw!q)|D~*k>3z^UbXOxv8?dT+zW`_6T6ny;1g6n|GC1rYe$qVWtu6
z?=d-(P%q~C0s`==73`*(?<SiwO(CYWZBK)5oS;jWAGdik%2qKW)A@@=jcNHK;j>yA
z76}BqE_dumy9rZH8F7^>j|*-ZLo=nU0x8Rcz02n8>TALjW=Y<Wb~sz|GNyO$;L4dn
z0GRP9ZPR6GKJKY~AC@L>9#S?{=I555KNh^O9~=}UVcLy#IZomXt!T!W4dtb@Y`V82
z0oMv@htgpr0eb|6x{J{fhuC|y|E}p~Zo$TRx&8=%l$_o*Oh+B#r8c{wKLX4jENG{6
z$wi*<`>j8$lK;(?nbLB&<c7pIF$h@idnk)q8UVI7)6Qn5G{IAB)V8u<#5_l{va?lj
zR@o0gBuVMV-`GR6TV8d<mlI};lf5dvUMc@`aeCy%=pZhhd}|#<%s%BAi<n#gF-hcR
zV+FoW1j&U-7>*+74Ta7-GLi<aO)m17i`qFc%gSYJ?13<shePm#E}vHnyWzs?lcgz^
zUCN^pxs7Y{4Ry#^`vaD`l00>h<uNN&b!2*(a7!^~8cJF%5qBPJk@;1kB_r`YWL0+J
zJ$}YFl4;kNQkW&{up_K;4(^mH@p+W+Qw!=s>x}Ia2Jx}6qRZyuG+}q=b^O6hXY6xN
z%etyw5B2LrX9C((jtfhkEe(QCnwFW)2shD7(TE!bV9o5S=D{$lJFw+_r5;E%p_G?P
zPc19mZF4xy4qkAnX|*-V*Jvgrh+#^(5~Xp!7sV04(*%}Xv+fe7^FVc!KkCbE6gqWx
z)@5ia*oe#M;$}?3s`Yy4zdk$jeLKh>PE{<@@L!`T6mCy~xfAv{T$n1RSUJW;cjV59
zdU;_6*iuqsvnjCFDUHG>^1hjYXXZwWK3c8|f7?t0BN0;HZx{|c^Vc8%R_e&Un)BnL
zFox%9&W`5VB$!juNIgR>Mx5c=V*M4+{-*3se5HQgfTAK8RB=zw^0IH-D&~2$SBqUY
zXg@O2kHxa&msoV=LUUjB^~K#?G)9peW)8Ob-H<J0K{w#klgPR`Y>yW=OEha{&ev8e
zB-$Lt*iu4vf9>6`K@ShVMNR}-dAD!A%X~Efo5B+s8*UQ`PW7X)eV+|{UH!1HfV_}r
zk?}3WwsOJhq@O8*X1Ejr$-cEJa={UIRV3<DcTYn}!1bC#cLxoTWFOm7?i)F8=e1{K
zI4<k98tLx3=V#?i?T)lt>0ae<iql{l_w@Aep0T63BsMXJD2<KD9;a5!Bs8cqX}@bV
zt?si1ZIOVKPKh%qT>$X4OXi6%zRMB*Mdpz#@A1qHDB;McxF}I;Ti_fMv{dC#22-~9
zjc4<(eexdxWNxdCDG9uaYqq8rx|!Qsd$(FETTru>?;llmf3*AWW}{W}GA~;zbtDn6
zT`?mL?uH4eee?s-2M&?>#}9fqYNy{RJ_0Z{9syr3ss!dSTlyXW(cP=}InZZB_Gxhh
znz)O2uOA1G0MYtuVjnW*AnIFu%e35+l8L=06ULwh7~lL>;%|A}<}+f8>^TX3CNU7H
z==SI${{X}Ri}|a5iKB@?H8-3^7Reayn`I=%lcg6J<ZJOg$cP}Nx|&A-=2g1NG3sn3
zZK9cfpI|zj<P@H+jzn*7w?}7@4g;QZe~`u_fOT<w+UG3_j1t!M@o3%l^P{_)-UnjQ
zRN)IKX)F2Q#x!|Db?#tZ@*(gC5g>nDLC4cZcJDkB8!HprDBy_$SitRkKKR8OZ9Q@T
z?I(RLktfLx&kHxQK$Y(~Uu3rw!y)#NI#XAK&<fp`aTt+SqcdB1T}5WuTCunU!>~1}
zS*CEPOV8IL(=pwIZ^bJ)kNV-iWhJ)h%+xsDcA&MFuBLr`2`^b}QOPS%yo3LIXKuS1
z4Ty@;C3&(A%gcR9m~NlO<POD6#GtrI$tnE<)G0&QaDN0S=Y>ompFM!9dk;xE-GNSE
z(?<Z-BOpBM5s;`uJR#+YLM>IYWJrE5hTy`x<Q6DA&W18sHD0v9TJs?u!RV{uN1N5S
z1J*&bC(xujjk~+<-qUMfYh{(oldD+$!Z%l}5w-3KA^!TGwoU68(cKg;)k5b7$TfTt
zKQVecxrhhM`Y5^?rd)Q3Apx;7F`!ly8d>MEr*6d}F?ybdUs-BlZlByT0vC{LEg0ch
zoqn*3QvS8U!{t`pgN`ZodxH(9Ee3b`Dbbx94~x67v*u?6ny>TSx>j##rFyh8KhJ+M
z7L-TlNzwZ;<3{ujcY))UqM=IXWod+XxmSTyGhat0ebk_XI9j)2Zl*ykZT;s%24c_J
z^)%P6Z3>5<c1$dCe1Pv33)D(lHO~E;7wJQ}8F%kj{hf9B8MN*bM|A0J?iPDVp{9D|
zneY?7R&4H(aFF0q&F%cNYOLf~>{m|@i0m5>Hn26{NhvZ#d#wDeLgZLv!Wa}}kNX2v
z{s%#de-zC4FSp~z%Su-M*D=~NIg~rrw2kSK25DCFDzo~#hVQXCbBP9Sf}kCwr8V@*
zk&w2Dj(%v!cdg0vEhCW#0<pztbrN_h`jzyUt+Qrj)mTw>ZOS76)iMRuAL0Q6;o?O;
zv*u~3d+TqA_6UeNoFJNdGoa>&A<VB;9#<<l>xc1uqtLR6ABr|hR-_}ScVx4qo6Gb5
z_yy~6&O-Q%lhY34C+$z?e~;z>wp7z1x#vxPkZK+};r-QMV^C6r?|aRoduzMloW^kF
z@0>rIDj*SY%PEOya1u|D_5KJQp^phL)0Fj6)D9W~#y-Yoe!2PmU<i!zA@f5>c_snl
z(8M`(!IpAA`&$gTjvk}awazB(#`veb?$(Ksq$y|>E<lQDU5?NNZWCDS5<Z%$KI%2>
z!cruh>UJ^?)-7?KzE1s_hC6yEiZw-yRGU!zYBOHCuB|6rEwUg!0HME27D2W5SxtYv
z`Q8CBN)1JTQ`gqIa3Ko|3kDxzjtE`sdq~?p;rG_K;iWvn01QLz)R@TSakkZ*tFDoA
zD!?q-j5RLKDoLBfbr?+p1Vig!TbuKnuCIgcHSIlkr6I1<N)~tdeof%S_;f~>M}Whg
z4Xl~(CNdaS!b|N8wN<%{!|Zvv46xXI-8RQzQeOGdLW(^qOeJS5@6t1OoQFG<ic4hn
z>!wST&vlvpF(*BzqAKlVnY1E6ebZ|{nw+j1mJ;ANjK4>J$CbH7Q|{Jx{xDAPAf#%n
zqxGz2p=DVJF2(32y3i1IB@~(5sgN!hflBwBO?EF8Zk))<CuH*4<#gKFls#iBIkDPK
zf3$GD*8Va)lIBQauG>F_(CAc~uQNUPj(US)E`2t6&C4Abu`)oYVtEMMI^QkQ^IDEw
zx<iM(X?%sl!{cp2R?rOHzFod!>TD=1=>ZoZdWvcCI<2W<6dE;y>HPkQZozHbV4eXp
z_mo%MgYx-x|5?n!fG_4%h~hE!%uv4EhE-2AJAopTtR2F7Z!ZW)i5(}3-OtsRm6CHX
zJumx_T2wf>O#1~Cccb_NW&hvm%c@R=c(E3^1<Ti2XEq2`H5{IFrLrdSbuHPk*v}MW
ztt)E%0Gl{lv_)#|ut9cyYV6!mELnp)!jmv*G|ksTIa$s?q(lW1F_gnbn6Z}iqj#^D
zhY&RAH^UE#Y;3+Hs4IUY1hg8i^#;sKtOf>kS*9K*b@b0GIah^j{F+Y99T=Sc6)n*N
zQb=*yjIJREfB(VuqaYnf@0(zIy65Kbb9dEv@8oKG($*HT^9U$#<_>8(Drr~X#j#|c
zEItm3wV5ZQ?x%8DR&c;2MZF&jY%O6q7LRb&eOVSIW~}LC-D~@DKT4K4ZSBuwvzCn7
zW3CUo;?u1T?Pd3#scyVEiNroLnVa7q#unFSZ=kvv472keEmxegMyX4wdd*bs4Nddz
z->duLAG^t%;jX@I8YQOr*2*%n6G-UTh{RT2o3UI9L$K@5YQkwf)WXKJ>buLK)MSm6
z%A=3F{NCAj{o;=Rw6%kVD5%-yrg7W82kEa`mHpg2a`=X{n~IF|NEV4GMvKr0b@I85
zn_(w+Ztwx;_NmFM)X5Xb2s0@(;ynZ#7udyZuTAKo8^WvC|2EzcJ+Oew&gr^rq;EaA
zEv5xXANAEV8W)z*R$sQMf++o@d1UXNC_QiRSjDc+AYt{c*LPcC-lL#I#4n@5x#$%%
zXa~n#lmZRfIsNEs2Ba2(Ks|#Pz`~uij}!>~6eg~1Sr($Q=-W?Wa^=K-OE=Yq_g|*h
z)c7zbggpC;Cdslt=VTd~)98RtkVdElbQoUew5j^Ex>O33z7cysB;8Z)ojn9T7+K=6
z+rF54o0P%Bc&Pi?7y*R&6>e=cj|hDU5xaz=e0dS^Th-Bd7XDxcQ2QLE12wMa6G<H&
z0&q?Y!}&TLmQXe?PsgI#+VT5bzax(?R#XaVydO6V#ElSn$7x%CvFSQ{+6oHZie9ED
z6oht`%$JxFAFf#TI-UF4kIr4SI`vCd9KyHUIDh=+H5<ln`S}+$Tw*WE_^Pc41j_gA
z8Thws+>F|tsZ`ytttxHY4DRpx=EL;?69<>J69;YKRE5!g|7nZ)zuU3<C%zukor@aG
z_C`yMq-Xy*P>Jc8zQqG^gN@fN`QU@Uqfs7K>6|1}jt6qS-%IB}M0VGKSr4)I6Lp>P
zC<*o<F^@7gdt<p4iSd>fn4{lws)o-0;4mLH1M2js@hVn~sqEmFaP_=PIzQ#5GjT_h
z`=yUtk@vLvl5{&W5!!T-M_H=*DdLP)1&qR=O4$1nZ_Vha!H$b8ymCb#bVfDI%!-#D
z?v*sKg_?NQ?ZL1fU}%41=W0rs4R!e<8Z7hOAj0ti(}nKOCUIU%%*Qp~cIY{dMf!0S
z>s01_R%-8_*2}a#<Xb$ySL;fY)5N9FWJzb;#y%=JeW)}ZP*Q4~D4y9=tWDf-jH?qH
z9D&#&2(rk*`X}d#Vy{Zc%I?pni{N#kB+~Rk!Dxy9jOPdYeGJOcMgL5klsBufQ)i&B
zN|4nrmPxv2-<QG+NZDV-+XfpSb)~Poh4{kFvDO8gm{(i9G;6g&i}X>|EwE#TNOsyQ
zUl~JyifY<WS}qGWAvRg8(4J*JD9yN6-I1}=L*TRyWE!w;<7V2+c$aWfGNFF`VMG#c
z2&-qLFH&Ws3puV8&V{XSzt9V8SkV4FB(hL-8~dGPUUx!msMjw#-$=Cf7y}7I6?Wa{
z^CEgPi4o55rP<%-#x#$PkFpM9xDYnBSfF&ooTFmP<iHK>x)PO}f^XtPy^N+|S}~co
zj3bvPE<U-`zvJ2~&dd(Eatm3a#{aydv(GcJ{Yp3{S#9)o6l|p8`x`90Y@R*)1Pk8^
z0RY?(SpbRBxc~T+jQKK;3}(~Vs%3VCvYwJ`(4^!6JkrCflRPru1sQE?zQ$t2W_>BX
zOPnQ6Om_4SP3C#V9<1w_Rv(!CLH9wJ;^qPx>E!zAB;6|#KCftm$OPB^Ag#p(Unn48
zo0w)c&cRQ3<R?@RH04}r@^)sy_RQ?Z5?~WZ-){6m97F@6Oh3jAJ125C2;a^OA0%|=
zNZc-?I$~ntPs>_`@}pIWu(6pHKe|&Ft6gY&>l~h(FhnCWB~|8MZ_b~cX)-1@&OUL+
zqKE&GbN`F^k^d^|tJ&>)TM1m$Pd8v|mmK@<1NxPzagKHE6mR`*YyG9jhQGKCVn3m2
z3E|li{z2>dd8zH3s`d@BiT;=6A1Ig6CwtY80RL0ov9<@4NnWuS`V`6MKeYS#2G_*7
zy0H9Qi7{m1xw?VpM2u|@1V`)vJNQ3KW$a@7oq3Ix!=4L^u?8@wL{=-sf^c|kSEYTC
zgs>A5A|&mUv!o2ozC{T~zOWC5r9COBA;&+uH&kt!w3S)Nb+~+$fKvMd0Q&>hkNb#E
zuE;}$7?;kgRO=k<opgTB<~E+l!>x7dGZ?W|Z8>$L^ZwvY`&jtk9<9m`@~g!G-?ck=
zshElT!&;gUrJoQH?Vt%nGTYt61p+qsx#yskCP`VFqoBi2h7EqjU{Th*=8cX4EAkv&
z3bT6SUJdHQ{1>P~IwO^q`#5LX+esL<c38#hzww!uVoK~VEHXuvjh4nU_C{DgnBoEp
za$HX>eDIGy1hMm&-3jC~z1I~@3OA+PT=)uLQA>%Bo3GhSJr)S6ltcT8EB}Fw-Y*H$
zIKx29jsP|d0|6mM))Kj@fp0}dMA#f>Vp3CGB~eqd)y)W%$@Q(r5!Y@Pw-H#gM7Akm
z0%~ubYYHT!=WTYQfKeXyX}hm=x9O)c>&}?XO5Rl*L5ba(?j;SpkZsp5vp*|71NX}l
zZXrQ!M~>C;@qPf{_rt-@O9Y+4lLO~6rZ$Hai!CGVNa%Kkk&&g>K1Wt|h`ez!OBC4q
zl;q#;=I?PXPqrsJ3P)cim3`36yQ|ln*tcbyztQR+_Il;%o711a<H(SZB^)4Dn~Fr2
zWv3tz`cl~$IL92{Y1Y5W$0{}!R1$F3RZ(MQJI;_m>;RgpS<~AWnKHZn@ik@Yb^gvx
za1rO{yahRj*3Ta$);`crnQdkIw?H#L@O9Orpn2a5w!TTWiA~15sHGTRaITXiN`gEd
z0h~i}Z!G_e{AK?c`TK<jq)ZEdrhTtIrF~QXk@gMv-!0Sk?#PaAm5-mHgvI=#lVzss
zk(NMS!_r~lc8uj(1-+@v6wY>cPy(CsQ(}vwV3=#Dij$x!%CU$dvq9>gzY~IV907<1
zJWK<daEF{PJQrUG#M#(A0u1H7x(JUpqf%>tAabvqdP_9Ub`p&J$P?Mb6Dbbh0fAQ;
z+Wa&B6x3pu5<R*1Q>j<gD<<Fa3uet}Zk%%t&%-wd^^m%M@^A4Pp}Xw}m6(8dIi5SN
zEV4Bx_%u&6%B3b6Mh+0<`o++34?LtFv7hlFXdIJ-G@u#K6)r~%5z+0J*1L=Z$6oZz
zo)VT0+Syt5dg-oeD|Hkrf^XSFdvJzJXWCtad=D}G_qzmv?ENEJZVjWwuN}naLySB?
zsE}aHTS?DzfzJ=A%>t|?!(JxC)8g4~;S=oEK*4v>g1kKlWK{DGurFBLmY!u~H5^&&
z;Djg~1r1#!d=ebh<biR9Y3(s4B&oBHmeUibjLa)yFfFf<+^0-L8sjkv>-*8u+Ddr#
z_D3{r8V&Xoiza`;=8Zth4)oLbydbZlgX)NLZIa~cIitU4jzu?TyM3kOrwy_y5l*cu
z%JM2j1ibu;V7L0cTaP0$x#t)o=&&Nl^3%n_wrFVh!>^FA7E+^F*|GRY;w3*>RwX60
z%v8z&l1`7}w0idhY2YD^$`twH+&zh|%w6Pv(GE$+vSrJ|q8gRh!&VTJel-j;H>GX7
zEG@$i<Gf0{F{a>WR+s@(Z2Vjjfp8CqcO4=xG}~JAeK^(BY=3?$slbEq{FrTv(R=4Y
zTJ`?r_(nw|2Q(#3)0%rm^YhSAS8YoVkn$^#EWV|<$r}M0r8m)iInR-sPqSuzVN_@t
z`)iRBfyC)JfOW(_pF1gXGkigYryUcz9JgQh)3nK@zLmI66P6qziV>+MM_w!N@nB;M
z*i3S*?sdMt@8&G;FsS@~pYl`=peZfx5zrDH(b2>(Uiq_S=t7&>N3Brr+VCA-TZ*9z
zM|2~GAh*gsZC4CM?uBjmS8G#g3W=BeZ$pCz*L|{<;sU(k1$%hCv6DL|l^i$fJr_;a
zt&7$yPVRVe@~FrYCr5JU`3^U0XXTb=wZXDA<6a~_wi*5+(#G5gwIV@F0H)1DVkUk?
z7(=bUvjT3VKkps9^pso=a2lL`<50-LWGBvtR6NLtW$yDPn!uMpQ|c1w<ZYg1P#o3|
zkP$2##+MXA^azNIxdr>hB?Xi-(>&orJKS}Z!te-a2zhwlOu^WC%^I9hCu7>?%2Czz
z2$1~D?oDa-_TZO8h|LQ5d&mcLSvMfC6;y0fo3EHkX<p!~8#XJ}$bGz#b9nEpnY;Gn
zrVj}JEy(@H`~Ts>HZ%)KISUrmmX^7i()K*QzmKHYN5ogCOtXB{OUc@cQ>^y-m%y}3
z8*AN$yeb7LY(NXKJ0WVC<Jj9qj5Yz3H}7zX-`cW>1XTU#5%vS8?s1X7x}zj?CY@{!
z<9}mTNAYFGY=fu&`zjK$;MZ1SKnoor9^g#te$J~=yj+|%3Uq5_RBJd}@X+)K5ZScn
z+RGo>xpv}OU(9%D*lU#Z;#%^4)n;G$kjV>vmBZ@jgiRKDu=Jgm8tPR`_N)Rs9UmyJ
ze)yYKAKjPZkmk=1bfHVk<wd)-0?FpRy>>g&-i$Yhx|Hw4A5O;+TGamqRVPJ_5AVsS
zvhF1@4ulr%!@c)@&=2nM&T4EjWHjfW$Gv_)>8Z`P0M}K{YFmI=<^~;4C8k??L9kze
zl>RLPN*UqD*_4zn2SXW=hH!rlVMCd)SO6&Q+aUSfOy<o@UB4wwS-&}m5!F8!eQihw
zfzPe`eRyX^F*b#)*076-v$=4E77cBVtAO6HmoA5sNrdnOh9*zQ&sXLA2#NPXt+(I2
z0feu#67zBvw!zlc-)E(*K@UJ&AdrmojEwXI1j=`w-uB@zcRC-vQ!&3U%{g3blEjk(
z_N?){x6F4Vq}X(0kLOBb-pRRWPYzAcH-hKvYQSy2D2pK`_v>2=4^fLhSE-6;m5!8M
z<0QS8W;-SdF@@Y*VeCm32Ic)@T~h3jh5+ZhGWr@Hw(4bU%eU@<6Cs^S9dEZARd-Dq
zRkxsop^h!6Zt(lZwxVYAD?{)xoS%7B^zgyV6go%82SYBy*59b#d^F3lDir<CT})LA
zp@H&DNmmmJrzWDKpo<dAi|gz_xls}QLz@&D?<Mq+xzlbz2{O{j@^n-;#TmW`gwV>e
z8n3Ed2_&VS)t4BbP#rHNuQ9L(++sTLV?u48cja<<*Pg5@e29FNLUmWmMF~qj1un}L
zxhhH4PJ-g!qQ1&@w;op|OAKmICIghsFk5=B-3YAvYl=$AQ;N#Re@RhUokD;!O<wz(
z>PD=3dPZp;$id-lMeY-ld@rZzn@jix^YJvCG$E66F6XwJv%O|@PvPxXU;o0j8X0kJ
zlzvykY7U0Xa^1Gds??C$D7ALUvVe*|HivjAWAoPV@)Yco_kb!seZWJATZag3F;DS?
zVRwvZV;#Q?SW7H@O1xMkgH*l5rr3XTZ94DMh=1Zsi~m4&bdkM0TN$VvXma;yO{ta~
zuuA%%MTi*}%c_n&=H}YPc_aF1Y$JS8eiX&VlJ<K$BOOv}m$)pqpCo9&T+2)YH<UiJ
z=BRN^m2=<!ZIU|&ONSnv?4lclPi_G?J6dtmKx-+qdspHcKmCBw(`m4?d_Sk`^k7^)
zU<;*6r0`)os*EvKe95%V(-^SkKtg%5YS&Bf5xR6EqoGT;m#U_oZ}4i6Rcpi*3Un({
z{bfe}c>bR&mP38iNj{n-pD9WEL-`$$P7VOI)Z~^KVRxFymD4CREuY!h7;o7L@_-A7
zn*vEA19i%CxA+N;us_yC4k`nm-RG|%kt+(pyt23?h=C<H<wfV?eG68syNJKkpHE{D
z;Qbcl)0f_?WTUcJ{s^ESgl%m`V|13O=3e}wZ{mtUOJHgMBE$>=4pF9Y>jmogd*`_s
zF5iC-04X9FX}2NbdX1vZtA}lI658;E5;1GxM)*)J>Xy%L2^CuPE%mjy55x*>l2dI)
zI(9j*hM(4EL(Fy5Q?n9&mDi^vQbHsTEb~@>{KD@25X08|`5}F3!H%vR__<fPyFZbn
zr&)KqS)}OLHKtPAdx1)OkL^M}XMwWU29YNn@PmujsSDIIV1K5d!)I|$+n<(M&mVyi
zoE;R9D@M(@dkB?(Wt@Lc2-0tRBy9X$0!wkl&JAZo!}kW^^y#{OtC(BW*Pqt9#1EB7
z(V19yRudG$m$!<x4Jc$B4sl1IxvDVNMY0-K5~^Oi^T{*PzE`xp^X>%vua6eKePdxC
zrK>8-uK?S<JnF$Svi5RbI-ZI=Yb~^xJ30(!r+@x7cqAin(Cd0K38{&iC5sShs6uO`
z0DG{Z;1zDivhOmMOW6cRqBqNduu6-dT*B)e$27dP6CZh6T|?xVVW?A2ySR4qfHB^^
z%g%IT0It95x4m`uPS*w}gOX_mGmRZ{76wecQA8Y3tetGWJ^~cxFk1;HEY{3Br&Et1
z5XFc(edtdd@Bfq`qCA;6wxC6h6D!Som|EHq^l8ax3Ecx$TPI;D&#;_3Jv`f+KvGp@
zp4_OP7Kh9rSKhABLA(jE7s+vDZHzwq$B}cr`J@BQbv29E6zhwumzvOp;Ma&QK}HVN
zXm_BXIZSZbdC)DmlSPQSC~8Npo!Pwr7wp_6-0ev@q0zR(m>g^MyL%|_k6M$jO9~1l
zv=WH(!FyuX7^#|u-l=;Qc2vc7<D_Tj2&>IR#Vu7GenQ9FB=YO&fqh#$Lt`4|Rg9HH
zr@L^ktJ~j`@5cT!f70tj*8z&+YU_T2qFg^+{=L{IQFeONz#gW$TU{5C!2nYMH37pL
z5=NR;;IjLc+POvaZ^T|_3}kJFJTqL+SqRPs%&AxL=e4_<)kHpcu44Ye?Mo;>YLC-}
zm6wy5W6gO7<D4jTOVqhgD$i^Mm*sH6>jvsYo-QDbH2jE(ySQasADhq|T(_XDiP0Xu
zlZt1IpnvGk=cW<Q*CaDsCj>%M71s<&9nkr;VAY!_j!X)^y}Pu=pWAj<!rr4p=4R@v
zf`R(E@m+FoYcF$yyqZSiH)0ZZC!FpY`f{UVxU;n#WcJdA?ifpQVtO{rGQ!t+0{*c0
z|A#F8${aPV9oHjuHQ_O>!C6drc)40$n7Q~C!sN4N#5=l#IW4!(4K-cJGwq~w5;m?s
zmQXR4xi-IdI_v*%E>*0gy1Vh-MCW8_Uo!L<E#IHGYtC}N3^}70(QVYU=9pjO@pDJy
zd4s@P??Oo87|mk&%ZvW#P;z*mcvt(D@4PLBIZZ!QUq08a6{O$G^T`G7`6jDn8q2U3
zkwLP{XF}IkLMQZD7(ucUJc}uWfpPt&C0bK)SDBr4)nV%JnJf{1q8W&Sy1XTK$5V_}
zfhFK1gd{KDhP*4N%smnRu=&XpU*u9*SGVF3Py#tM&AjSf`GC`GR(5pbehEu`(bb(8
z5-so8+)N2eO7aN|*-1_~C~%qLj`~^6T7CRGgFfF0{5hg~va|1;IJJ&=5|*}oiOfP_
zs=%{(w`>?{kgW2(_y+(x*xFGqYg=clM1Hohu2QoP?v74rul-x}gt%yGdHi=F9xB#y
zt!<vJO-HFayQ+dwBkyweF^xkBGIu<jTZSkBs8b|hwj$X}$p+0Ljtyz|Zi3izAOf5d
z8L6GyO1)vYiZ!8B-Qh*j^^HIyv13ae{Se}{?#X@9$=2P}081+N0>L5rRkP_u*F1`b
z3F*9M=R*{S)(dUN*tu$Q|G8>Gt|3e}Q<bB;dS_ZywFqm;v5lykRaBmoSAl`i6RGdn
zGKt;z%`Ub1z;ZiXAMHz18WTi&`G-m}r|&8c;-a7dIp&#v!$$bK1(HAjZ_iksDX^pI
zax>C(m@DPQMm-6!Z~(nttTo7S;>gv0cqssDN|cT_m)JGSvv~}f-9=$#L@lEz*=L)v
zIB_OD@T>P|@xvker?dle{jrLg7Di7ODKR1M8j+D0ohADKAu=B76>XIEL}5mhUu-u&
zRHG_2vjCgqwoyo+9ut69!}Iz2<V`Qp6>H57R^0J}`PKPaJ>5jM-AKmoy+AI|p;~3h
z<ZF@pdCR*YU&!|L^(Sw|97-+Cv1_HVjWdTk+&D+&@e*gvs@icI<Jy$Xjkt3E-$!w~
zskwNdNH%7q-baH%Xx%%k@V}@1|JA-3XbxAUF2;KTnL4M?s!jg~v&9^Trd)uL-fE-4
z2pAcX%V5UC%3bkIg8}=c`I)IBZyNB}&?*?wi#_k|C(##<azG|>w?D9lH>g|dfE;Gv
z-zOVmU?*wggsjvLaI~KFe_ClCS?hre+IJzrebnzu1M$Idby;Rl<mz7Kj~*m#G^<>)
zM#&ciRsZlBc~CvSmVA&q6z36jWx3LoKE`s?a(lZ0u8~VUt1qMr%?|CW1(A9+7#&ZP
z2^O;)%y{yI1RNmgr83uX$rqqTMg|TE)6&$qkCuDnmTTmm-g9!cuWV1*Fpo+*omsBm
z?A@^7Q)T?%{sR;G?<(+2>)ZD5a>7gMr_+{-^+;7?M^P0!Xpjfu;e-GLc3Esg`J_}r
z+MiX6WIqr|l}R!bwiMsC37|RCt9L*Vj9m3dLhgqPxi4_fc}oB%?KLfL8ea(=6$dRv
zfF~$FehD??H(uL32mrjsavCB<*W4hZ1Qm;SE@D%}4KxRX`y!3l$43G>0=qi70D8VJ
zhWOxVXQOpR;2U!|pk6l3L-Ue*Iw$WU_NU&_etqLfTjP7L#ki?n$K~b_ZY2?7RY@1t
zcag;IL!?}A(ICTVp+PPXzwXLmD0gn?i`h2*Rs+XR-yAdqp?^<dU*o(Ac&fT&fBJ8#
zIE~RJVJ9mWkeEt3h?MdC;36XAy{|Ogr*ZXNgUT~^)2e?X)&7GLmQe2*+@+Be(moqd
zoop3u_>|@?{2{f~w?0;l`0Hk@<>!owY*nZ10R$66ogm(KMBJryJkq}C=00!1@okp@
zlV{Ille|_Pi3&S}R}axSA|sCz-_#QP4Mn#W2t-H={)}2C#OBaS)=g(cM1&5MSbHHZ
zqHSFgkvYD<T6!E+Z^02)fLLtUHZSb5^kNz&gfMu=oqP#-;mnfWd)jxc<gQ7>oh<QJ
zBx{5BmCLR4*maYOkJai{F|=G%WI&&{X8R>lzFDZ+bzVm)Ok~&#KL^%v^g#O-_P$AW
zv%&a^scQl8@ttp>xjMY#izQCC>~%ixp$f6*7ga`G5m_4x`$zohP=;61BibLYOMaHa
zrXUVKbFd$e4zcUOE}~)0-+%rfJ#ofd5}GT_J3*4`a!XO~BeAhhpW9F)K~D-T3(aE~
zhQg}%Wa}gE#kaW-lT-&>c5$X@eQD)ZshUcD*9%BQ3xW%b-(rsKe#UW}u~l$k`&=`M
z|JO%z1_n&yG#6L|pS|yd_rrV=T@uCI=0?fjL{n&0FuH?Him)|^XYxEZmOwL<$>LLT
zq?1dgRwxbq8xCkNsyBU`Bw;a`JIc4K+9T+Lht20_=G^ZsRIH2U*8TBb&qlRCy77QR
zT)b1%qS!%CPG53nJ@=OWw*G3bq`I$W<LncMyNu&s$@qT&3L}AjpDfZS6%Jic%JuTc
zXdyT!_Fo!qO=z;6&;o!!js83#Vy}prPxKum3?N>FHR|ga9oYlGp9_BlZCz@U<a6yV
zn@?49PgqSxc|fZS70I@%9BDzIzbJDzRhLPpDigS_Pswix2-Lab1JDJ}L9lSg=Z@0j
zB~AsEwPVG`RVlt$)=*g;z>OIT;>F(yuFkkh;k=_To7Bh|&dZy5{krWN>_ANIAeTaX
z%e7!pirLf^U$2X&SGrvKf+O_`Q*+1tnrBJGM%_(;z(I-(cI^ry%8mxI2>WO!`^R4=
zHv5ZSipD}q=i58*cJ{HXYR&_SDS7>g7C-m1HLx>sW#-+XyeD}xECub<q(HD-1%6B<
zgFv}eIIFl-bhAauk{(Tpe?RJGT(lrzl(~GW$+c>P>xf5rTGQJ!A_mujX=k5^ye_C$
z6*v5!{pJ4A{y!?-DHlvl`T0+!d@@M?RLUo+wcesjWuHU}${2xG!nC@46{~5nq=&wi
z2H5UB$KFcAx&k|rLxZK!?}D+dzDUeE)&Q435mGHVk;lr-vrq2wQyv}q7e%L<KJ(7T
z!Zf$4;i7GgYm}Yn<+6HVXZh>f$4U~*aId&K-;(a0>pfL(TmgOmn2Pko{>`bAQ|1Qt
zqpp7GS>F}u@5QJj4a|%$sDSJJ4()gXZ6MM$mGl>P??>4}qtb$&E%f4l8qV#7bAv-A
z^lEw0Km`bFNA8*|`LcqOmY1;;uc<@LZxiQ8lOcTqe?JYdZGU~+adQ_~^4WreliT`i
z(sj6klc{P-?8$|0CBz(XT47FC4q-sYiMZ8Vyg9v%>-^B)TtVY#qO_5GOQ7zn4PNMV
z*4CAu$T?-F?LAOqWeFpU4XWEG!g5;Dv!jW^0{cVl#NPRIbwn|gMC7MxcaZ;zGmM6Y
z3vL==6kYgiH~bz(QT%ntH-rHGW{o{XT~xQ;`Ez((j9mvJs4FmeS_NZ5x<tKP)3aVz
z%Dy?__`Bqp)aKt8VuNO23{XfGn?Y02l<(0ARdJxXHQocg6c>r<zG4lZeLHmUChi1Y
zKa5s5hqz4C2-Ur%1hu2Xyq0WjZP`}b;>Vmg|Ku}<iejsWRj;E>!tf%~MRs-kS=LLK
z*4^*}vZk^l2EQAzQkS~<Z3j(h?IK(JM7WnfKLl_jb{AkIUFGw+upQrLnJ*W~ztMPm
zK4L?r=Awt)hrL_}fFWmCJ!P=hZdS<3&Yo+A>^vmhzifu^Rwf&0d9Qu6y_4qGbgkOC
zpItxo#9N&4AvuabJToJmVmC67xo?X@HDYRcHw2o!^xtv73-s@?_?`2YzVdr}KKSq2
zu{8LnyWo`nkG;15in`z5zZXFeL{Jo|B@~cYI;0j5y=ejIT#yo$?rsF6OF)oNLL_$S
z?go)A>1OE$X`U~49q)7Q`<(MTzyHkh%=16aIOyVxGs|bcpLbl>>pJhW$>{UcsN>06
zo6Rp?x!67H_k^!bXZ}<j1C;&$8}-t!a3nHq@|{N?KXL_|tTCr&cQR+xvts<XFj@|a
zpS=VTVML3Tm-QYvzPgn;!AYD>>yIPE##!$5!JZfg)G@QB*mQCqpxPix-&^#P*F#^E
zN1`Xgs_^hD+DM?PFr0yy&*giW182!=yPM&{g#MXibJVOxv{fsYAWOP502TKvcZFw+
zd8K%Wd2DKi-aJ<XgW~m_21?nPu%R^IzrU$tvRcMrUeNE0|M+6zbs!pz0fE?jWC-37
zM#xf?{v0!;$>pAlY?duiki~=X#fHU?Wo7l0^pW1o-`}D4fLQLQ?!bJVHa^yFPvu%p
z(RY~hFAg*4c3yK}0a0OsqU0t|yXwiq(WRJoYvHT~8Rul0<DELsdM*Z#{fgl<I^*#1
zAv#l?OwO{Skd%!LqQ=8HVeD4RlE;@I^{mN8wv<Q0HkmPt?>}$&R^JKZKRMZY5o1_a
znY^kD^InRmK&P3fE0sK3CHV&$Ej$J_)GV7>xi6hM>Z$FLTuO;88;sK4Pu_JYJ9kh4
z_7W;sKd<%v+2r!S-}@hMZ!|8zz*=e!QtB)1>+zL@M!$p_W1i;14L91?%UZi4!wJ8s
zmZ&iL#qfe=6HctNh3Xyp1#3z^I;xkOG~OYkTaAW81=8_wiY@&wZ75>5y9?1v@5dmj
zmmu_$k{;-GoR>Y!JxX0Z*X~fEaZYKm9K-y%PyK@J011kkaP@JYlj7_~VS02MVJC`1
z0@@j%V0%XWz(dRKX5^YyS+ED=R+zNqt=65=*^Bq|<Y;_juPN$S=}N^WX2O}PDge_N
zswx>UomoVwGIjk7i-T0HscF?c=Rl?G3D)Y2eBBeu2<s|o6*iJPR@oZ4z@G@4Z<!`2
zVOIajFD;#^jvJEZ0d!MTvEV$ARc1xU!*WvkyhpW<kPo#EV53{JR(4hqhj!G4$0xNP
zVdinc7eg<(rtghif=tHT8d%ip`aevF(1KCCtyV7E*!3+oN=p3*ewkgt@9XFC%G>*E
z>7PnR546MW9EdJ(O@YD6jY*awJ;J0R2>=R}2zfvi^<>67+Shvk`t}zI(M~5Bp`EqA
z0xy+s?@$t}LQTKL@S02o0GSF;c-$%`(m;Nr9ZZ1-L0A$PPf-^;RjV2;m>8LeXR9}J
z_TK78imjWIqs>Hobltb<Mb=E)z*3raUGtL8Wo6xDNybdao>d;jWsjcap2auG!&u)`
zKX6YQdw*o;`=Vc3m(^U0-+c~qhM$6OmE%bVcb6)+hGGVbdJbo4sEhr4kL0AM&Kuwn
z8~^z~`haOB1DvspJemOwCVBOy6#mWGLs5!*(a|HBTIeAmGq#$RS;j*5B@z2-L@L9#
z3z1nI;f#;IMD&U8p@)EZz`NLr0AG`&{8TDDR&ZKJbYyq4o4>rh)#FPPD#dVMXuVFT
zBLbd$OU+!rZU?q&Jp8=POo4%i!0QX%x19*SH6L*-V!lt>M|JC!&I4|&rsr|+-GB;}
zOOR9woQB9c#E7qcr5y{4uzS@dbP1SAY5+6IyT8vQ!O2+HvX!L?K5ovAu%@V9Xa}Qg
zd1n@t_vTVKHx5-hbM`!Gd{X|gli>OSkO@g^L)O=;4ayEvMyFUyFZzpiN2x1*(kXdj
zRnFL!$H<v1>r7*%I|O}z`e`KjUggDDJ_%C+3ta%yQ~&TS@QHUfc0FN-a@W;qKn|m1
zuTI06d?^P9-i>9kCo|jDuwa607OkgsDPuaQz0*Ea_1)Ct{P4KbI>WO{VeY->nW7Hi
zIZmF<4$BD(SW-jzJgW|UTVeXKOa_709qkJSu_!8B70Wknl-bL%JCo9+Ftutu5l7?a
zkst|lX77+qt-B39B%hN>b}I(l`e2nVh>^w7I5{#3L)pTG=uyFxw9yOqe!j8)l{7vJ
z@y8C7y}qL!ypLI_DR+HJ-0<)cbo*=NqeS9Ir*D}d?CofJl<a)uJ8jfdN+ZdTq5*_Z
z$ILj<Kp{?-JG)9nywqoE==#Fl-Q;p=OTJY#3(+pvE^<;Q^&A#wn#j?5D&FC*wN*E&
zotKwdwWX)&iD!I*6IgBNGHn8!hY00()i@B6C!hC)2ptKAZ-i}&{D>Po%S2`AORwlB
z_%ka_0q)%qICDg^jSX33y`Z($U?H@>y08iwCe2yUq2~hhxP}BRTov?4wF}mvOHfQ)
z#50TxTE*MPi$|=YCslQ9nN3U)U;b$GeV$t3Admo@l#Ob6Lxkq|$^~2LUd&^$%5<<+
z^M{mb34u1=w!zti&uc<=D@savPM&w>tO$tkI5fQ#aJ=)-;4PJnZ9Rq&##}`<AYnj=
z0}_T6N1O4ApCt^`ONtGvE@2Ra9<}Q8r*#R_7x+CooZho^A{Dx@y2=a6IJL9lUCz${
zmPDZOzssTj1Ir;uuN&=l&x;{t7W-H3{3DJhrO!}o7)Fc2b`(|saFuGQtZ6oT&agug
zmRMeG2nGvgI0G{buu4qEw8_ZRahZ~YC9`WP+}(W<JnYM9G`NXq2?ugF-57#|izbfz
zExCgT4&@i07A)g>EzG#+CokYRa?6-D3FB{&jx~<4mXwN=mQl6K-o)n)q``k5vM^hY
zfwMb(|7c!$=V3KL;kerU_R`>w4Kx-Oxh^iaURJkUrkb$5E(Cx_Y2m>o$oD%1*03$^
z$oZ%%quhqz*e>9L_?{d+7yhPFCBUN8g`mNepQS}DjOw-du``%$WjF6532`3P4rbM7
z)9+ojSz27L3m9(Gb-n>x1%I;=?B?rODqKc_U+HTSr6;A0nz>YX$OqIz8nj^s-!DO4
zz!1QS;=>QO3R>O=r(mUCi-*y&RWa1!d$`vF1H0KAS*&b$d$iwCU#q+y-lWa=WQ9wc
zV%P!HSLjz1<5R}yxtMHK(KACFWg3uL37<10-j%c!FFF?h+vi&))}&K1o#u_CY1ctW
z`G<qEjN`76t8{A`2?L(bvfn(Pgh?==z<IK92+u$XE$OH5hi0w<{>yCa1;>yOTz&6v
z=v^k1I4jyT>Y3ZHwcyv7;sdN6>h}z5*Y>G5y*R8RE4+CTLI~2a*~#hMnhO|Zrw%n;
zNHXPfjlv5<0Kn3Q%8YN6SA_kMJfs^L8R5Jv`b^85YrRK=Yp54^BmDopxd_a|duD(;
zXtnlX6^u@tibLXvLvC=ED31{v3k!OiSf$ulwz%SD-Hgj2TeBW~cD_q~e9y8_vuxRx
z)IFv<&GlAB2rKtjM9Cd-AiPUtBDt|jKGit+PT0*9g3j}gIaW<l-f?E;KGvMJZ44K9
zobo0f+&<lXxlj`Q^JtR^Nh>R(cQ3c)XkHe*Tu6Qg=`XJe%&16~+@x`S6%$+?))N0M
zF-j5``HjeNgLxXZI)O)Sa9)obb$Hy}kfTeGBi=Opq-6Vq&Xc>KEbpjHWq4N8c}dfi
z@I{u9S*;c$CL8;N+lP?ouy46I^hl`~Iu)$}M<aVuu4VD4L<Q|DH!kV#TYPgT*X9KO
z*WIPa!m%&8g=4Zeo2YbsD>z5Id$idH9u^qq_(>|pagoO-X}riG!U<YQ4&nl!6;540
zCD`p4la5EFwjBFB<%MN}41?+ClgSnY<%kf*39*4z4~EPZOC3%#{FTcwHgp?W#jKoi
zS6B9Rh<f09b{pEm%=*%TR2BM_Obqgib+o+HWyJF&k1CTi)WYXj)Eza2l~3}@XF_qs
z?jErwQ-1lb9d%CoJ+XywtOF2SyBk(-8}@hZaguW^`e^;ck>(?bTaBU#!NrYEn1A&T
zxb9rW-XsX0*`YgS&xsKXSDF92ybEHW4{+?QpRm7`7uB-^=6Js%Zjbb$oTKRF0ksX|
zL)=(8FVLoGZU4o6Q=&?dssv+Z7INj((zoPobP=c{Jhmq&B;MGR|9#|x5-Fa7&Y;%b
zMw+!QF;t4YDmOsPlBzO=iH&K(M~)1%3=BeidqaHNXNLG&<*gk|zAlHPab*zM0ry7w
zpSNbJTtDc;$B*>2W(;tndvPN>W>k?!nzL^FE+xZ-F9%r(Z3#=&bycybZS|S(u$1dN
zX3LRZA6+YDzSw|IXC5p&e>)q&_tL3x*$3n{6uEma^hOtC*<CFW0uj9+^(_|7PQNEu
zbdJ`$5mtBtb7hn&+gpB**q0xh=9)yZVZEqcBGfHj;vyG&_HtYNm9A3l1G%~DgV#S*
z5RD@A8Z{d%a!b>x>W$l;HQBFnhVkQxA?>OCEbh&3vE%_8$)iGszU0S@8F1Hd<Cc{@
zchBn!oe7^ZT(c)jy3=f#zoPya#X^rHk?fePD(e3`IqDA&x&QK6|6@iie3|rqTAns@
zZM@lTqSvlIHic~`k4W#ib*qfh1BMPU#*IjYba+d*MTh+>L%Z60+ZKp920ddcV>9(y
z(+bSncs8o1C?7U~c^dmX$?dHsL5SoVZPNkfg#y-hv)%2~t=M#@^)GiPZaZsa&ea9Q
z?zGU>1>E`c)<<aM;l@wx;Ou0{g#*wvezrWlWOX@wN_bdI+%5ueA9J}KXsseyWW&_)
zjE3b5&z;Y|j`#0d-f|NzBqI9GcAnKP3@?AtABEZf@WoBEJ+NO#!$Jfmukih|=Y!nJ
zuI99wvL%xj1zN}JXuQV(lUO0%J>(L+NXQSn@1(jQv2IMsdU8+)6z{rXZUISpqI)d4
z&9hF&)vo+_Ftu>5-XgF|b7d7hccuaE5ohu0zr0NV<1u#BAB@NFxAOVi?j&PsM_rbH
zkhQ2<$BY}o${fj}OtkR=%!0$d_9X-roh(Vo;H$J9@SaTDNn!2Oq~4~JV9v>=ncnGQ
zr{^<xCJ{|5Myvk-0;C;S*saBzXX?y_7DPr^i9hAQ!t#Zg{>z4?U{!-C=srDnxvJFA
zWQ=UqHGD?JSej0XCm0Kc0k%<3h;tFHjr_I2H!2dYm*+E*TQbYVV=I<nSuJC~M58j;
z?|Q!7FMkLG8@VErb25MKSBQiS)otX8)|L-FQ|!V#0K%evF)#rBi!jK)VA{YRufHCX
zTK6y67sfZy82(=5d%s|z)1F}z_lZ93?>VvQLL>uFW}JzmTKn>9r{Jda@q*51ubb^c
z%NS*Ho7<WgDwJ=aitahon&O3>Qn+qaH(wIaV)*)i$il>ITo*!KRZdZG2~Sb{icSm{
z)I$Xh;M7bnxw^&fo)M)yGq)$lYS_Dzn#;eL6++he?h<5;4q0%94<-w3TRz3ZCT#yF
z(i#<IYl6=eDv|4@K&7|ZwXFL<bg$0E(g7&NXnvWZdJq29i4h_(@K=f@GF}wJ4GXvq
zEI(aIH<+O6`Z*1lDf1ATijeDp_Po0+x*)de;k5OW1LHL8$cI5=q0apto0Ez|!jWBX
z8V8zLJ?)D$xR)<M858T=o)}ukte&$Kit7D=#~Krxv20HxkV%eilb{}w2QI3Vs{05X
z`F`3xuFlbocZEeaCj4w_c<@5_px`hW`$Cgs@Qz*^1;V0|rG%@T=WylJH%it(p(%^z
z?g%e!K_rZ#JB(VxG8UHH)3<+oj^fC9)3~B++g7QOr#x~oc^ZZnG`559e{c&s5*cY&
z5~G}2<rU}uq>0*eJ`XFb+UV0Qy%Cy~FNqbea=TZRbu}36Ca>UTA9`!jOh(3-m#g|W
zNvCEQVD;B-2#R1){cLtUxJen@hkPq@k<gRnKdWmVQQo5!C6#CtLXjlqv`Y%fyA_t_
zC!-J(4L!3^^=mC&YuvCOJ%QOhu2uv*t<7aQ)>-^s!KJ+V7~;fRUXlynX;9lBTn&1p
zOAM`otgWNjdWO`!mstZU(m>Hni0S<YE*RmUaqaEo&E{49n!&3WBsrT*y9$M-PT8B=
zSRS^mR-$mJkkwi>$h+ZY07qgHHa!Ah3c(v0h?d1h5hIME?&EQ=gnAgJEC}`CQPoXh
z?3FQC+}Ii1<4{b^w?W@Rq=E)@{jG2D?R48#Ia-N^*u9oYkJojE+uW)34sYY+%R`|3
z;P9%%S=nAIF}~AmQEOF4RiZe2!G+x(fqA>AidVc>=2I`66^|zTt0<>BfTVbR)tWA_
z<q|Yd?zynFA3k@E_vy4v^$YXI?el7W+L)@`K*Icv$e1TzbH%s#Z6kYjEY@JMp*vP>
z2Gm3Q-xHR2!yft76O^ySw0*(1;p`Fl<}7$`<&|23f=x(W=jN!JpC)aCiqGqnjS<bW
zsV$T(Vka)Fgq2{^_d<|sp!ht7%wbNT=;eJ>8M=3?m}yjM&=Nu;!`XJw(a3`Gmh`Rb
zvLR+y+lBvf)&Eb`FMztZjHvA9^+bXR*{cHw`|ZHt<GAq;m3-5yOhovF1d-52SU6(w
zGWwRGXMt~vnf4o6-gM(Hysj^A_XU#(-<BSFw}V*glbmS#d@^LP$<Urrd~Db)0$^`G
zYidQk{oM0ScLV^D0LYt>q%eJeLsHg8-V;dUG;Vzfdio~JE5yP|PUpS%IF^GAW_QVa
z4OSEB%YkZW0ZfL#-0#8CJ?L%qy*+!HnJ5W9s>G2Lr?R#aWNptq*<pTHmI2GVK!xBa
zg!a<LX(hxu5<v1hFLC8(4Kx6FbU>(hBF+s>yAv9f6W@KVbiZ@t<haPRS^LqD+cS1^
zsg-1^@hFUAecAHHlaR>h=&*xe07cTBo-LhVv3^3T^ihoQUcaQ>&ppoHYWm-5`#<?=
zab(-VAM1T@_%IZASTX8V3Gg{oaLaHe7spDxlZcBV^b>{g|0ZdJ4+r~++AlfQjb4Cv
zZ0`3>3F2!wUV_3Qf%uV+G>^!@cguCfKV6$&LMm$Z9th$YhAS5)d@FcB;xE6ACZJ~Z
zZGzLc)j4-;mFtHtNb1kJASvZb(3=XwN%K9O#qVIoFd(FisE2aVQh9~$SbB@k1yWS8
zT@zbkY5mzr2-U4TO%1o*u_f>UF3K%1N?0V;Y=n|aL4>n~gUcojn2h_RTZxc|>Z-h6
zanlq`5wm~MqL}9a8(vu+$-aow{kskbc$WzCW_$2Wv>#Tn!6Ph3!#TtR0K*wa+a3^_
z2u2TDPCDbBRZ^1B+rcZ!zaROIJMp=4`3s>7j*6Z^LO%3Q$)t+m&=e*>4_Vhfj|lPO
zbERj2AHoD(XxDZto;6+EiCP-9XLhjfFMip?(X(6K1ULIB-L2WX;rqP9jhr|Nj?(_(
zmEtWdwUXDI^aNAS$B_oS=uq&3(@72?v(Qf!2vg0$k}B`VInK<Td6T$SIrUg3VVFRc
zdzX=NwN!eA72xQ1ywG8-?s&Nf+tZu81Xb1&0!kUT{oQ9vvA<Crx;KBLI*3|tx-e+|
z^jCNH-@k6*<k&(Q>l6LVq)*!DvD=#T>*;&(7&b!5uZ__82$7YtzH<T&?wFqIHJVA4
zhF`0q6k~9xV+uMtW)`BX>q(FtKL=jzDrxntpSTF6#MxO7HMDe&^}9uHR-PbIP@}0!
zKU(E_I{y%OWt4g}XIb<f|DMQs$tND-L|>+#qT^Jd(f(!zs82Y3*0T_1*?#FBtW{x)
zJDKscujkGCK}5Xh0gK^OXy5L0TizlKevh}c@LdPBdm54!nnctQ9M1YZw!l-kXm6k^
z(eU2!pKKS~3YIh7|E^2b>faxqRM{{uUV~d02{)0V(5VcPy$r(St|jU%tjGLjzLW(@
zKD<?pVboR0hw7?)yY5fLUS5>Ui$Q=X%hzImGtJ4f@p&Bo#yWp%1~`OBuIOc74$|pu
zvUO7RZNBy<++m_XsAkrh*Lbndh>RAK$_uy1)DT?>N>?%w)W>BksdXnOc~#`Wg>qfj
zdL7Y%^BR#V!G>RW)miu9G4u3H_2}pCz)C%-*+^V@#9r;a;~46?`RvQ)TW^Gp+uWP4
z-SZs-4wS~AeU-ORmLqd#cqQ?ys+W*57|-{^Qqkw!Y&}En_Tq5EvNK9m+te_;dy5;i
zTXM(AmmrovXULTaE^+mLs-61pzyBvzOU5O@)w^0|Y7V%1ZTZ?d|8}s@xz}omj*Rrv
zbEb}BjakOHrxzD;+0FTwn&++R$)Awh;A^ZmzJ%yamltmyLf1Xu0rjj?b<XRtTPJ(a
zk>B;BN}6fru7R3nCf12A(E}d<XdS0^$tNfM#wi?s0fej*#WsU|@{YeGEd3b1dIRI-
zeUesLQ@R$<yUbiih68S#I91KHQd(XZ?DHUJ)3YZwSR(bOjn!#C^qPS5<VURBz98~0
zYk$IF^yZ;<%E;GU_b}nd!$pTmRe%@&5~RbDneLQ1SJL!l+sT5~pUXD5LP>y^xIszR
z56m;wEdpl9V@Xhd6tfsVCJ74`sOZphrb%9k7j=G@2-8xk$gaAOILue~phU;hxKrjh
zbW*qC0GzM?47Y@~-AQwoCcjFYk<Gx4mr<O`_uGgeejs2=xczQsrx<TDn}AuW@2Lzi
zYjib!OdREU6kk2fQh7GSL>VQuVv@YFejzUC#>{_c(}zgt%M(8_J4w>6o5f}}>(2Z*
z(Ut?pZTnt&41a+3%;Ug%cUx`%?AK2CMI|g4v8qAa@LsAqc65B}I-kmncZD1l32*y6
z_qU!bC!Lm6A_Z@|Te@GCcDbi<5s~Hj#I18*ZCpScC}M$Aezj2eRiLL^%JRit^tc{d
ztg<RpINqX0e`HwL8da<^^2Ut^uriau9(KYRb3`32q#LMoBTIHheA~1+2QUjvW9@#4
z^K@s-zl!r*@w=xg|M7@__pq;oT;>u~SZw!n!<pZn_`1U*5wnGtVfcD-*Zb4>^I~x>
zK_fFVW}^IemOii735#B7LO=dP@B?xTA4ko}<AL+MX=v!~yW&oD!p!I;Xc;fIAJljH
zGd1Qd@#aGpDM|gAPFpzT*C-RYJuNK;kd?%jYhqUHy_9bkR3C5^%5ipb7DrXxceIUa
z-jx*WvhzUUU4oKzj#<wr8(b1&oAshDL2*EVcBKeyIpOrw+JS9myi71GwpKIVnGrX_
zdVWn}sx20}5Zyq{+htn}q`ER*rMgy(iuv*1S^Sh+htP3c0&crkCVzkB{j0wNAzNP$
z9kB(|cN_SP%p&<zNQil<lV1;VDavHpJ&Fc`Qt<=#0RsCy-_~u;_TLXt6c{)}ScN|y
zqC)NzT&-`T<YL`U+~jmt*EUBBZzubRu7-wIV0o$GF6BeSMTZZV31+%7w582ZKc14g
z%Gv_bN>x?&VIYwD5+vx>O_?p_U#@C+mN$Fs$=WGL%^$Q84BXnfFT}9|?A_Djx|x<9
zVEtf14xY2TX;KSLd6j127WG8)O@r~f#BDNiCn%VLGel{y@eBK5#P>A7k*xZ)Qtg|p
zRE(U1dkQcRp~kx!hvd^E)1GdtWMpXuj~CsK%LvWLV<qc^r6X~CJKA-98<XR6%;%U{
zpOmQqIWU#K=fGfx;yt~FCkUhjIwL>NCTJb#FrMk8UV{9!jqdFfyiMZ2nJn!JumI&m
z9T%R#XN|cQH1mjImms71b{Ny#%MqJJoAT$ky&}XkiK($jx?GI{_PZb#ciuY{=Qx`)
zu|!%B>c`ASFQFB}G#y;<YkKuF+(sR31s9uo9HB+sN0T&2pk2k3M13HfJo23L|CnLC
zrpuj3Bu4yNWjB^y3G`$NYYKf4Y|aagk~JOZwEkvtH|nh!qIL^)A*r^*nOj5_lu0D(
z80C__9+#Qvu=TC=DD;Eq?DSnpQ`468&vbs$_vzCkl%kiF3r0c=P~4qE8@5Un!zG%b
zPmi+7lM2U)K)^5jCm@Py+k`Z2v4<~`)TI)NHG5BRX&4nh-WYa_lG^$TjGF!@-u!=Z
zvHTmN=Kud+%*eLJI{XrM4>TJGbq$Lr6tikvL1NMm=a)eGS)hfN2d%}%N_i|&ChJXi
zf-?L9iV+a%Fksdj-gsKIPsD%PsgKs6b{n6&L2Ds8A`u`cZi}EJ9Po+!gvh_O_CJ(%
z%d{cLq8-?5Z(k{~y0OkHD2eJhQ{SOf9ATd7AHqyAWHO`;B^Hpt##r3G0oF&q5(-#r
z7dGnV3mr0Q^<OBT)U7Q!u~LS9J)gjJelTpguQSqV+k4RE`RvH`Wr9PB(R=^q4ii8B
znP#7j2Uw@+j!?9L%t)uSmV~@Ob+O;gb^y~iMZx8Oj)b?>#GI@p?r~{jlZqdJeSu%=
zU)T+>=+$>4c#Vh23rc*MIJ9!ctef+VY#IyJY1Jpz^*F^r35I)TkMVO8?wvDlni(cp
z#!ru-#pJ2AUj{BHPx|n$`=rJ8q}(Ozsta8$xdiolxL-W7eycR%Ffcj+C9;ynSPAX>
z;-_X{U_jw==fz0Kfb7>3t^rk`EB)u*;eS0Pkb#>E0`n&LZ}X=2KO@5xf1yae>h_+S
zRQ<^hF%!eWL?Ts_)PEe2&)43tETkuUqsMJT)Mz%8to4p0tDm+z{~;}=ra*>~pOgIV
z7qt5Bbt9UY?GMVvXWVH{u4c9DgFKVCl<QRl6mqk?4&6jPPVMarJSIIqDmpybeo%A}
zFIZ(FA%nq6`W?YTc3~TC7d@FXPPTG)gyCLVdAX&*$C}dzEB#^{i)H@RcS(F!(Q}<5
zsmbPJBuo9;+h@GX&8^Spq%J|2P76@+IdbV{9zAyjPtI3v<%8xD4SbE^ozYQ1${Iwa
zt>x2F@5%*(cZudhob<2aW9GZ{v644v&hfR-60K!xwgbkB_p+R{*G?4%7Fo@R&KYmD
zc;Wf-wX#Q!L}6mWRV<2~t)}sJ5tKd0HTL_Wy7OSB<AM~jF*)Tt(K6PIxSWXvK+v(<
zWA@iW?!Ov-|M7Lmr|qo}%l%;X%r3&(kLmX(hE?VLwbkzWhJ+>BgQBbxP=9A1`Axht
zS}l-q1SinB2Xp^)w98dRcm3^#3WX^Ulfu_f-$RuJ9Z@0Wj<#p0`dRpjHJ}(k28Bjt
zsN3>nYt|``k4QVRYB(uA2TU~+N1_RhOZVk%jhxo|K0q48K~WrJd2}gN^-MJZBHPdX
zhvzy^jhb%+8SEXE_{B@sYv(nw%J;lb+EMeM-Z9)PA{cuH20}UFu?>wM1ECy+S0P2~
zm|_4_%%&5VJDLo%zMl)$*^ridN84e!|Cxu7CM^*~+>Nh|#!HOsu?(nMkd!_~WL}^T
zjOhI2Jgw4dlV?00u$$#Nyce4|6{nqtlnaE4XE}wf&<)YyFZw(Ty~ikq-3_9Qm6Zi`
z@Dhf@%(q?(4ZXByy$SOK#Df_dF`j^UPy(&jh_{u4fA>j!myL468$Y$q1SH~M3ZR}0
zH7b3iw|UVgF0C<q0J{c|oACZ8VA}tW1MU9b28br~kGXcf_UXqqO4=*sjVJ;G3Y(rM
z@bvM*yKqP$>B#nUKnd#|STU&<+2P9$YVs^%Iug2H$3|P#?AtX8(;HKel=YpqI8y_A
z5MzYRF1i;R8I=RoCf37}lIb@mj{_{spgiV;ooyAWUvyZeIAgonzXMsqK6s9*2ytem
z{;ZHV8drNymH_WJ-G(Z%VK96+K>9LtJ2^i*c+}^H_2J0qIe+*Y4M>)*%pP>2iDW@n
zk&@>HrU;F<7j}#8QPo@`a%s8=vM9zux@z2@_sqIL?l)6k_W{CEVR#c`46#tgBDAdU
zrwtNN0tQQoc&7Y8qnS+Zu>{b_t)Vl(rv0L6A#v~U==fCf@D$SL*~I$bPYiqXsnwx9
zAEd^pu9Rzk7f|s$HPkz2xqFF{Sj|*r3oA5N=-V2_gW6(IX+J(F#S<zE8oYS0Z(@)O
z%Gc1p+gw$oJXpC;m3gVTz5{0lEKz;?iG_79ZbV53Kx$JR<chDJ<k)q6#gyB~L&Zl9
zEPD92ZTPrH58e%FmHT;e*PT(OOgT?0#9(#3cB`8N0+f$|0A-F)!U^(cB0KK&q+i58
znuIu2mp*Uc<Xkv@<BWy1Ww9yA3sMzCI=L$JIS4M0ltg1fK8GCv#C68`uqQO=zG2q#
zinwzXGsi$_oMV5ku~cjwq;P1jN^>ey8*a2aWG~SU%tzj>|3_sN#Pi8^at@+-<o45i
zwbWSG&e+}A7ib-m6SvaA=wU~Q)}d;FS;^-vgb8b;>Ce#yS^50b%=tpm77QNaV>rAb
z9KwZIAI4BJxz^SO=PfQ-E4PWtjmm57tyj9##Gyt>PJTnlcUNk^`C3=wVfYq2Bj$BC
zIxO8zz>7+$Oq(VAd1-7@!|+C?dV9{&M8}@i*QXJZW)W%0*Y^3SLL#-M0FwObuOxZC
z3kEV?5;~9_I?XmOq3ru+M$=fIvJ{=8n;q`!F}^WIT|sWslc$iyq2s!!t1;x#6<k)G
z7+|^--R+=B{uD1t*zTBNep@+-{}3fp<G<Vb%75wpL|Bc;MOp!t4{!FMqD;#qj=X{_
zhwAgKnISt$Vm;xzm!Re{wcQ~i#o$fZCPrvWE0!|NPGd^^lWP?~zW9-x^7g1$T_EY$
zvr>UKnsye}iAJBd261QRd2?~5d!g#t%aPpGcWGOKvs8;JbU5x~@e!~8S}horWx_Nn
zi|gV&a`KSjgL}0(nz&njj^VpCbsHlC1IlBq*9oU&QjITI@NH+|_uG`1G-Oy7hn^+9
z507vS@t@hbm;q5d`cq2^g!G%U!uPV^QAEnYxNRDKu%BxioOxi<vwlzGcAqHWU++=>
zx)Ig9pxiDw%+0ZVG)_*>wr9C1ArV0!CPHJuM_j+<CD8@rx6NTugA_3iW%Y#%iW{DL
z2#H;HIN|YuCP7UuSjye$q;U1WDFsgUOrkj?8Z8N8H%5oJ4du+%=r>YO)`d-dflrQV
zb`8^(;=VX`x<*S)&ml)E_xyJKrjBMP*M{74Dl*qoY-x6uIj89*nq8Y4x5huTVzO&*
z>ckA>I4ot*4%mANSk!Rs8GU_qyl4V02;~!FMdWS_kEqBEZ*@?RxX*Lv7hQC3`{fUq
z0fZBqcECY6TL^2DRhtKgSUs7swjXd>YHJ#HTz2F9%>C7@pD910`KidfX#_e$2Rg?2
z#KM9qr?wcQJ^1+1K<V(Pi>G#GomZx)!r|N0k;lljDUY&|lYu8!AIJ@+6~K0BzRnZN
z$psk2er2sd@3c5P9$WIBQ-6EZO@go#d0~I^PH}s7x}Ing?*6e)a+4R|tTDjyp_8=P
zqUf<)>#>cy^Ewl@Cy-_Swb&GZf-Tz%F>K3bet5!)9kwTJl^bUTMh>6)1;|JGCaW$1
zgc*~OUZ`lcG0&ZjOxTymv}6Bk&CS3FCytj7fJuMEz*&Ytx#u!eCH1#23iZ(<-!doW
zqPq{Aku>glywmR(?a$CTV(BUJj6Mg*ZuZ)>B$@;jX=i;piT0;MBT>9A5OIw@ZeT?4
zEPJ%m47C|cqB3*0BmgjoH_R2~M7?-R$rKYmjT4zg$SaUJ1gwV?0B|$l`A{51RB3&v
ziBbdbM4_o60(b(~o~&(M5bg{67F*)Bq{sH^l~no|>@LO^P`BeC7u|L_*rZ+pM&Erl
z61RfT3>w7u^S0=OrM^zR40=AD(&@);^P(<9E#v}?r98M?&g$G8%^j8&&l>C4C&*GF
zYXW4-$2b%A#+I6Arzp}sjd_HjUf~mhVYC|TaG}+!j<^25Bjx`|w+_kJ&h)j{xzlx5
z1pS#_S3p&ym6vT)-8A%$_cRGL!lgDY^~h-UJatlMqSazN(%K3wBJsK|fp>(Eg>|(5
zLZo)sU8bBj+Wp$=0(EN_X!G+$*~IFu^Z+6^#-pZAnELg0T$A84Wu=Ot`297R>D5vE
z#F;xOZ_j(38=yPAz6l$7B|W#?1dA`a3j@09)JE*A>Gx=O^$?Kx!P5w0UF)DZH_aVR
zK-Iia9AhrjTXxc7i^|8CU!t_5;J|{~Q;npkDixHwkuEmmbRMTH*X6~xfXj&9)w;E6
z<*!@^TH*yeZQ7l%qB(HJMo*lH=i(ShL1<FUX5zCjJFg(S*2X>6NQK<hD`&TmPbiMv
zgAOSM)~nS7=Zn-IvO5qxcur{wy#&VQqzq=Lo+P-{`?+XFk@mITJs+UP34`DTRoedw
zbu@0gf;#4LR=LwP)k5BOe3)Vh&z7oB654yC9@h6}!j6R5yF)NW)Q0rad)EwDNokrn
zbMgEib&l&?;barX47zg?(N`Lk*cpphwrAJc&jF2!WDoImml0J#@U!pdqmG(xBXV&Q
zR;N%gLXVZbwjz(+eRp?2?Fj_B13IYz`O;Gz-#kruWrhB4oqiRsuVW-yR~yVPl1rdF
zKB{0yjUv%zhy+3)a?(NwseNv&n<gW$`;TIiPK4u!p52wL{7#VrP&<YMJrS5!VuXLs
zZ2j}5Jq{b#wD$<0%&Z^0;w9llPxeY!%{_y_Gd11wT6yv^A@s(%dQDniaiZ|}zHzYc
z;eGHe^VL-N$X|yuP}||w?Q)cD$Mt?BRikV<Hd7!C&NDW&Ts*)$HaC-Hp8W)bmmXbD
zsl9-AF#Mhp-$^9yRR2{~E(6_q>8{=s0T@?6pSE0>0mJ^f3+dP4Y8}DJHv`4NYQ^qM
z_CBLwD>fhH-klN6P)wi_XGj;<3>9MVXOVD6SGVZ1=?PnY<sF@tpL4l93N>BCw;oqN
z12i%)1I<h|gr2e*g6jH%5c>MD__YpH9`A~`8ZZqW$YP9IdS4{~SMVeLtf(RZJcoRN
z>*8-M2eP}fRr<5WErHhim!L5fT@w8Y(JMO+n{pW1qL^(*4^0?8iKwYm^>W#leOF}o
z5cptwa0lBKq0*DR?~Yfcwe2M%SmJpLmZT~EVoCDadero-@9J`Ni&QA|3M$;Y?L$AB
zb?h(b#{qK0FW4aNZ&ys9>bxr^kovDoAa)kKzcGP$7Bb!pr&O`@7%fjtg>UiIWVk(w
zvE&5;!Zq@g$_{iK6@61n4uGY$21{GD@8iOkE%tY&aX+B0YgxBrcv)F@LmpNbVJo^7
zsTkSw=jTv33FHAEAV%qbUAq2-1t&qK>cQivss{);{ACUQI+xNh^C}5P(C%%ApYWU=
z)_H|cV1pePZJ9q;63)b=Q|tG0S}^OOO!}KW3K6n)=rs;kEAg)ApsYDzu=Z-KPm`<<
zGqtqV+*t3%1hEZq$TbeN84w?ex66Tvi~jUmfaNCQ!oAkzn8LPIsaZ&i#-c9%3^I@l
zKr><uinlL8e)p9I)wvNKj|}hcpw=VGA)zQA6jEF^`^lPGEzOQ>!5l+;iF60eo7$ag
zNd;NQ`3~Qyt;xb<@im%K3$p@kv?8<$*6Xw{K|{Ib(${Zvjw!kAZJxNW1P?5IQ|i;|
zA*}8dg=S%lyL}sKS7)=~!3)6pWI_tT82h#c7rfFqv;A<A&@=j>x}ViYA1ApHDfYvj
z3TE`tT%X_MQKn)go}sW#7}3Fj3q4XtZ5!^<EF&N*Wof3LJKaY}u#TQ|18xC-Q{O-7
zr(jmilQzRzojcm$`$NuPLMs&uC%BDtr_pMiveD9AQJT9@MQU+Ic2#j=MsbWg-v%Jn
zKn9I@&X`ELQ}-x~x%J|sRJ6T~h6@fWX*;d?D58k-TelP&Da>S?XQlHt5Kx1{=DIq-
zT^8`0yX>AcPI|@XpA(Di4^;25cM}{sz1tNEcd9#eO}h$zp}h)!S-vh~X)9Rv{t&(x
z(Dm$IvS!RwKz5=%R{zJ;1ap(u{U%oz{<D95&i*^u{`oy(G?j*Lu@KyppiOq{{x<jY
zs}+Y8mLOW595AEqfVH#*zW);P5|PVst=WG;01s4uaW~l|L{)_hOOudALmD-(#amDj
zMv4Aw8fUmbpPh`fW;xr6ip@mj`CJ-KA^{Kkj1d+Ibgo9HsSeK$K`_2?!BAe7Aki)1
z{CK==?^XpJS@=l!dtyQO$w(L%C5~FCaO2@&8Alj9TC;=$t^n}RQS;cevazxe$)o?p
z+k?3B_5@fn5dXp3Q$wc9Ms~5Ac@@cd@@?n12zO-myo>cL9@yg@R4fZoAEhm96m27l
z<;Pn6A8-}u6VE<3#sh&2EXa3?^;0+pEs^$+l|0r@aO5lV?u`k+i}DSv9*lz!b^exU
zXeM1Fo@tR{y*9JEE`+TSV!t(Xk`L4bZ#VzhS)(heswk+?42A?EP%oZ#+<dDWA<_W2
zNGU_@9WEXYa4)eteHnD#@TyEo)P1BF`PIv6h93RX6Yw=zaWYYJsp=Ku5?FH9S=}ew
zk;VbUmLN^3saUP&r=Dznm`=lqUsBZSV_JJb+QCZLn9mb!kCOw1YkSFP^L#*}G1o1}
z7rm@1D4BAn?ip=pQq(+@0|+$!<kWzSG}!J5ij15MZW`-uR1tkyYLl-#8?bEzq(RY!
zp^c9!AnWXo4M#7+_dQ+tYD(NV&v%!?_h_>(K?LWj6JZp9R+Y%#9)OmqDwY7yvcV)F
z<7p(@R3^sE%zTO72-mMd)v=$2s$=k<6YEI-TtB8#8!)>etub|Ir8f+Xx5yB9@CMg{
z2^EHh;T;`jt$af&ZPBOdVTPJQIM-xcd?ZXPa26YxTUT82{_}n)y<PIc?fyk+d}iTr
zDtx3<_YH)IClFX?dC@kCT%+=0K|Z_$iM<Y>qp#?&Ac~OKB>N2gR01r=C+puUSH~`n
zZ2I#m&!Crxqw|u~FI5gQ=pK9q;_A%zJX24*DNWzBz(sAuj}wMYL@#Vk!%{s7zd3nO
z!)M;Rhwfo>L&}GMwKLYu)@!=r7>>&~I_5T!bX7^H$^^+J4-HA;BA&ry6Gosn4;<>(
zWR4nj3kwk<NT%3i+;uI>@yOc;P)R}cEC1~9@ZUmjQ9V%*H)YV=prihpUx5Z#^~~t0
zHWp&%Yq2rQu>84t2%nA!;U}4I5m4>Hd2mOca$rm1Pht42wRLr9`62OsHv^|(ia+y7
zx49u0YOmNlO0TTdccz-QvQie=q<MXdzuehIZrgJX=5FWVj`equ^uHOyU`y}krQH=;
z1?gH<0v*lEzQ~A(pZtW*Hywp1`_v$W0ImCM26YtNc+1@E<de5mB{HacT$?~!?H;}5
zGzhaFZQ&FMjZ{n~;oa+X18$X^1C6_K;CW%gz;K#M!MSrv@r8o}K7K%If&T<}XZ~Cd
zk2t?F+mzhY(rnCE`@r-)j(M^1gAtweDrP?(TAQ1yh)~9C-Hl@S2NAro?9ZLkT0VMy
zO?Y>Bu{NWKDR^)>ZLpM~Oo{Fp;++&*d8up1&WYUCeIe&Dv^_$dnMcW;d+Q-JM2$@5
z%m<ctx+`D#ufJ|@`(DJ*^Lr#BF;47!OYE3|qK4Dc1~c8L2V~k`d0+)p76RUlzTWlA
z&ct+KmVYf>$&{HR<Tk;Xa`&8Zt39OsZH%RZb8PQnDMup&H%K=6Bc{smp6Vl%i%Q?0
ze|mmZVE(noL1{UYgtsd5)$=rxOcKZ^2YHh*qBr_>J51EFgW;2dxv9rGK9aHQgRy+H
zVzN(;pP=ZPwTT9c@A;c%1er4IEKH8q9;JWrZCLBwiQx1N@m8}hncX5VA-yZ{7Y?_|
znqmk<1z=8bOfOXeXy7>~mvYB0e@C4!hnJu-9XT1*D0XAy>8U_dGK<U!SERAaK&?=d
z^#eA^*bB@yj7{Pf0xwyFOcqKIMDjo&CMhDlwA*7vH^u_(Sk1~MEFdVMTzx=mP3^m;
zXT8VsO5!p5jP>a%;YHW8syuExBcLJq>hMqBtKXezf1+Ofzvg=?D1Rt3kY+glDh2NW
z$)q(sgdhUzdcO056^C<=tjWqi%oYBxh`;2c7@j?O)TZu;(JW=a7=YK)dhXGnXC3(J
zDS+3bO5KSZNc8R@X&{`2dys7Rct0c>8(L7Dq^zKA#Jlm*_MSc+H6)5djI;hx`6cK_
zchQ8f6VmMvl<3y9>D&4Q6_yTG&CTbs3V#1f7Ogw}^(Ci7SF6r6<4cgh_yQmg9O|3w
z;_(v#kEh-!aDHfjp~Eq!+>Q}t1)?z`k&m$AfOJ81=Fb&%9D^`jZwbC-C=GiaJL5kw
zbFF@1XMlJnGP+G(P0yA;Mt^+;DdC`#)#uwm-<wjJJ1Ld4c*1(*0E|MNGmHOvAo`Dh
zEIVy5u+s~@t04o{@Q*#hH+0}>^BOPwu${@bE+#9%OPF>ZnC_JP{7A*JK<8~oKl0sK
ziz@S?lnoi(2Qv!dZAeIJrEZ{GHX#w0>QoJ-Txa`SmakSff~bRT+-SAbqf(fo>pXNS
zML5#aoV)m2cgKs5ZAg3*1k60;UlBlLa-H}g!H$DaO6T*umsQW6R`9SBNOV$x=BdNb
z8dkhCkZOhsyG>QdX}D)f_Sp@!5y{VbaS&JG!V7n@^$VFR-D=wJa{y}GpXUJZ7(lm5
z_oHqV2y#z02)gG?8|jlu)yWP8fmV$%H*!c+_G=#R{Tjs+_(!XyyzcBxO)^PVH(mGh
z#2_Dub$tUKMFuPk24PlSa9CGTdDo+?`S{^}7*CT*-|~skI}%dd+;tE-)64-cMr04j
zAOuyQn<itcM_yf7w+kfkBr%y~*FL9luIf00phgzIr?yN76w6_2ZR{{lAI6-tN)DK#
zGy2rOWo2kUC+4lUd<VWWLfM=QMD^74k_dHt!jFXz3#s*CKF(_8(Km+f3xZa(HV8SJ
z%ZPAHV_8$zR!=UpMf)3QX%(ta39E<N!G>!&d%&$-Av^O!3kLdUe@2iKX$;y)`wGQ4
zGFPQk6UA8EIDWhBl4xM9KBz2a<GU1G^vEhyqFe?h6tcdQ(v<w@r(5^5DTXR7MIZI+
z7lUq4u2!IU>q%&$OwpT3?|=NDT~eB1v6IwH<3-8xg8d7Rb^CV`6jo3tG8h;xRrk%A
zN~Q(B=ufYAh2$keF(+fNHWN{a`gAm4oR!1kwYsSsp%o9)107r5nou*2^QNWn-Lhlp
zeMfC$lreJC5__fgL5XY6br|PYY}SlPj@))08zt0c2$D19d*EDo&aXU5!(Sugf8kLU
zAp(-f08g-~(cVQol9ELFjy(~ugXqhPTPwJAPhO22P;0zE`}y~;rv`vA;=J*t4V(c9
zB&?bJJ_SPjIt79~|HBkWqaT<8;Y}V&4<-JP`UDJ4hBJ9G;Bl2Db7L!|{aUilW4<4L
z&3$U)9zORK*?xUItikN6q#f(9^@hsO!>w&q7Hbl+dSijK>uL%#^k%^BFQ!0C5Kp*R
z!1f4NRZXq**~NUysA}^ih;Uc@SaIm2!+eFZdUB*%G22u<3|`w~xR`EgX!hKSF;Aq3
zca^i-)d7UdNRKp$p_Sj0nM`{7xiQ3<A?Ioca_ic^%eJUQP`0W*K5<z|Xh|oneVb;|
zVBOTVn@>iWeX!OI0zf~-D#ban!PVq-$eORFvnzAdo$@+++Tr%Q0s`ST)z_@FbdLDf
zx|Jt3GJ5<f0!1k83;;ia&^wY>UDkX5(82fp29Eh#t>|!nimq_@LuvkwUs+;SDc8`0
zxg}bR^Er_zzP2TgSBOiHt<EW+lkCtr21241FG0qQdB?|;XYs7(Rofo9K#WX^^0xbe
z{LPv>ttFox_p&e(G3Bb#YO_f*kngQ>`dDkV*bb)g%MPeqR66p1o?{r%8U*|W+^c2U
zAwUuM^{Phx^Gfjl+SgP5F;S1q*I_6mCqer?U;{^#CYdvT-8f@MT5(`XE@Mh8Y(r|d
z0~*(op0XCN?aJuip*FaIm9VOm7-d_8Wr=ZjgvvTOYOgh!c-uYh&@*60vs8t7alCGG
z*GdvDYh&eVaas<<D+658v<+*8h4AF9K2PlczrgP3_aD8(OH$$*YjpOjzi!<;V=FBw
zHJ!dM^-gr^rKCe^a9Ilb(SlJy{rI4-_!}YGl@s@9_{E))7uO=9-!xl`$>PbgcPv(V
zarS(L^gsb3w`w!z{Xt~>+^q^KxjzuO6~F3=3H4x6C{Lcroz>;21vx`^IF*Y?_G%-q
z3g?SFo26eO$nAj$a%%yjAEDez%c<4zKU?6Z{+AYb<r-E6AoXu}4Im#){c)J85M&)4
zTn&ro2zixgfQ+9KpJTq;T-x6>H?CANIO@=nqxqA~4f#EZY!Cfi@7@r05DTYTE%kQN
zW+-uGkVMHX=3Rx8-mP%7(z9l(Ox{f~Su|em?%|#QH<|1s7xOX00UFUVDE^+<IcJPu
zH>ka#&1L<h83KRvOO;*f>AMHL1Z68VnZ9=Mgp4m7Sf8l^Ty_VmhS|Ei)R9bAH_5sK
zaFdh-Ql%Vd?S#zWf`}7P2j@5Cdo6F(W}5AQBcfieM-wk<eq0rbM`0Fb1-zy1E(y0k
zInd#BQEOL9DU7mCF*>m`?Z0?sNC-s2<F3{|c*pYIr02GIp1@f_=JUlGF_HR?Hk0L~
zYW7*R+Yd$N$c^*5)yp)Vw#bQuNPZ6h@6*vcWy;-T5Kp!Q$XP2xXMu>&*R<<dNax?I
zOz%G)(J2m6X?9MtO7&l;m{tueB8SI)KFlQgV^G{X85-PSiJoo$N$7sQ<kpZ>X^vC8
zja7Xy{0w~w!_}((0O{CFx(UDzOS&_xcFCL5oq-4f@WVqezHOL|b8cl_?$fY$_IZ1P
z7cd~Dk^6Pl8`YMoyhTm7lTMW3g3O;Qd2iiQr8ciB>XoE504l==e*Zy(fbXwP6;JCo
z#wYJf{jouT4}+q$%AB*s#Uc;GLFjQI5o5ud)ImKAE%Cu?3*daRqUp#l1>8;Yn(}%4
ztdpag$vq3UdRA|DZchJf0T8pNpx?G%3dXJ}O(vI?Xus)h_N5~+(g%%qL7$I0vRf7s
z2TaJ<D*e4(fQ@vMnB%pbD7T6yJ$N;3bQ6H{*EHi26lB|C<=L4Rz#VfEtQkVLNCW|F
z6C_ac^(@ul=ta*jmmqN<Ng#2x#Es>hUl-+)v`(U@@^>1mL6xwQ)Kz}kdSB(@*wLOz
zCJscsFa!^egVVP~=Hrp8{BUqhB5`T>Bh4(?c0F{Gt0_(gIvsefVu&=%qbFv%OcCH8
zFnWx{+kCH0aRz2N!L!(#>#}J%lcH%W`sv>p9i?NKpv5zFAV(C`2ty?p=49DuK_($Q
zUOA|6txWNwrtzCs9m-ft)*;}?L^h~ih5HZIwO^b@ctc>^86)(B<wLvAo_F@73&#Op
zuju#0<l$P#5hP0Z>u?=?UAK<)Q0H71XVb8a`VmWC|4b>Fa-}jH<_P|*P-i#Go@kwj
zbVfefTypIU0Fnlbl6ER3wTd49tnU77oSUOZr}5?Ikxtzw%YcUdrYU*V=*b$*<BRuK
z1mhoTo!@GnfA1^ikIs#rDI6O_1G-Hz9)R>|v5%TQGHt~RP|{hyrCZL!_QBNoU4Do4
zAc3@vM4LjJw-zDcfb?B{>jjs#qVdJ?1?!Op#T-^RrGw|!vg3Wzj)}<~IX`<H+=+K3
z5ZlECH0aBB?-I|d-Vj46@bD=ThY2m0DVT?fB{Zh6W9M4l=8R6{#ot6v49)x?5Xeg{
zxTmp^?&R3~B5r%56JGggimS8ii_|pzIQaDeP2x34y279`u_SY2LC=`2U3X8cg|D%X
zkd%`xkh~>nxl?B#_{-6F&N#>A(|c!Nxrqdpo7HP)94s6hVj|08A`4cg`b`uBgWRp^
zU&v$_WLNS&fy7C1H+7?U^x-ShS>&cSUS#o|^0rJD3@P4~iV-&Dqoue6Elw}k#(Z18
zz^Y)Uy#xi)%8*GZ#+k-qGkIas%Hs>vDtd{@+MwIzD3}0wap|9!F}v*D6&^JVvTW<B
zkjd(a4F0NY`fCI%4E)yE%`yQNJIw=h7KzCNcY<^(wYvq!zNe(Ftg)770t<;dEC1Jz
z8vuK29o{NnZ#4$c2kQ+{VlRKxDIPGB)mIYvnfqtV1(&nXC{vr&JA-06a5Cd8$SCS2
z+mY)mI+}O4XpO(SQoIs)+%z*ylZ5KOVt0b}wr(6jly)EienMS(Y%*WJJk6i<xqI6D
z^3>W#Ow`4|VT$m`*6?1LfCcxHoINkn*^Y^u52JTknRx5#8)yztZmK&9OOl4A+v}#d
zjLkPIh-}N}V-(oZd`D<}gjVv{64dG9|L6m&5-RYoUkT9KyD%yQwDLL7t!#Z;L2Jv=
zfeX<pKmm3xjM1YpbP#yvo{=j=F+|$Bp_F@~)z9>5enHQz3|xL%@7oHZVfBR6768}R
z9i6crQwYmUwAhQt0bap!;TRR<SW}y&y<UQ4Fw=nAfG@+8Y{vjG$e*|a#Pd-gOp~xn
zp_)DHAcd)FvvxBDazb95U&682=^yk~z?^pZFs{3&3jnK+u2SFyowKk)iJZ?7`gj<T
zk5%RXGm}F^l{WyVr<p<bF%3`Pdk`}hPs%4BRLIr<kUYa$D*$X0YaqOD-y>w}V^HQB
z?fD^#<WLtx?-%;i0{(xyDf!dp1(H7iC4Ep5b_r^6>`YVVBrlN2+~D|)dg&X6$7ZVm
zSiHJ>HQhUh-l;YZG^MW!9s&rk*xW_)KV>e~2=yPIk)@ZU1Z~X?xiya^(BBk}dYZ-%
zIlhVJ_1H_CPis$WaymG*e`7I!+W<dvv^|@);w`#8r&$AS;nOhL$MaZ`fTqyiUJ(I)
zR6Na9wSQW9w!dq1OAESlc-R?BUORAno&uo$1$DI4s*N%<TV@3nZt}k1xP^T<UX)MU
z3ChHky%#<UPV`OKU8_=G-=w%%PWx-m%fZ2cFL;Bi{a0>H>|+2!f(uO7sXroHr(4-p
zOH0Q*LlCzP67N*D*<*_Kvx6T?gC@PPkZ1yL8tfSdT53(gV?BK@L9DUKJ{eDu+7)mX
z7x&^NowK+eoyXR8s<50R4$G-YCzB;|Q#mxPn@0Fhsc&O6AvX9lR>H3rSVh`LXf-&~
zH@Gk4`VIt^_26^VT{6>q+Bx=Dvxz?so%?62hCh7o&sE8$K$zO=(hKF0piEMhl&YAN
zhjUNxh-uWABdnvu(YzZ7xq+X?0P}A@4M5@f1+6l^bY`*eX-ITv4L&u=!^*UP7g|Hp
zj8~CSs=E~pO!}XX**fFDpF&VW$B^1Xo>;@}+K^!(_L^YTDL=iw5i^9vIFTt=z`Jei
z7et@dk<On?JA{L|vM3u}d_wsNU-9FJ<x3J@=Xgp-aBZ4L5WBu(uDbhAb{-Zx-(}y2
zSCyWepSv?#QpX!=6)L~2+21MzTGo0Om&~pup+8ktGLmk7*wIdzBM!|Bqnetg4^}7+
zRIwB2!T<J&cpJ;IQnEcO*XhyBlaqjeM>6`7bd1~N{jE0?2nUc`@AI#?F)9j;dq@}j
zc!$**)zxAif8i*pWCk1Qx>1kteFvil!2Ln8{GU{nf4g&(N=x@9yCXE3X!e9}f=$%l
z|3BotbySpV`~E#hDG~-PrGO}%(jX!&AUSjhNJ%p=bO}h8fFKM?NQ30S(A^*{-CaXB
z{%*GJ=h;5n{nYne@A|#p_YcIy3`^I2-*a8(b)LuZIhHXw`z%JT6-SQ{{NyROnhCM<
z3TKyp%q~IarLBgv_!LB$I43B@7<x_fj;gvP&FR;9BjsBuIIV)$G}3dR-Lq~&vMgdH
zK9YUf4#lk4l_^-bhpSR!1A5`scG@1Q%CTIIR?Ia>ArG6n{SmN3J+skS4`2}F?vUFc
zS82}H|EMXJepJ25a$ASmyP!FUZiJ1l8#~wUg|(2<`9wNsG5g40s(M=|a@5Z!C+$4=
z`XX~==7M0M_Y<lR+v^}T!|Cu!!d8Ms74v5`<^3$vRiEQNmV3cdg2^bYq12ZWUaq2+
ztf0tLx2gMEhx>cZ4h8LnnTjPE9EU@QwDz;y1FH%1!EtYsRBz)zL+C<CAcCjiA=wR)
zWz*>KF#MHjTIkGn?kDn_FM^&I-Z7GYXIR#TjYsFz!lMK27y_8Y2H0?iTXk708I5<c
z>29Gl%XeeaKk<}*&d!_XG?Q1pTy1i}FzC^cQV4t0rPRnQ<&M{T5!%zbnDPJba65(y
zWPXE%rb^7i5}q;nf{ESZgl7#2zH%+0xuG9C&CQ6N-v!tzf{h<B5J_CaGu4n{>FF<T
z($JK5vJTe}Vce~DXt_mb;1%V`yNu(U?k7alWI;Jr2^Mfyyz5X3rq5!<)p;z=wrhyX
zgK0xTP~wygHJ)jzjCXs>a{ohnK8>^;bz%*J<dQFD9;WQbbsrs-*)YP@YFZ=G;C7~7
zIBlg2kaYC-=s2aXGuEU-=kupbvHANu0`fTqcG|2RBZ?Qs+g$Sq=d-OZd-6A2rTg~`
zE%@t)o=e_+k^J~0)4=@g0`MKL4!hbOYHO|qjqY5xT%Gq-ax;0%Sia-6AkZ?13}tUq
zYD?K9k4#mlltHSBkG5cC+O|^Ynoj&7Y-4q*=gb>0yK?kiuDth)%VFI!bj2_=x@Q}a
zbo32C*rMH+_%(2&hE9#;7ii(I#i`-_{8yfQk;<qv1}L?t6lKJy0>dP~Nd)f4WNyNy
zhG9#WR`D*W6<PplwYxFD=cdpL4XbxVaLPDhN0^an&Zq5voT5OrIDRuDXEPq0aK+j@
zG1mj<C`b{xF(#kZQ{;{o@p(KFWalj`B!0E6jwCN+4%rfzB1H`o##<9-rMUmN)Rq<J
zQ1Udcem((Gi|xekLa(x)x_&C$dl9x}%ni@=>%Rdgh}+z4G@Y~aX{?J?Yu=m*W<nh{
z^aiPR4(D6$CALvvl3?ykPX`Bk#kc0E*DKG@alH&(h3KnZBCS?|Ym&+MpEdpRO-5x8
zN}QQEI~>Z&=rzs4L8zHDNX+4K)GFl{ivut6MmQ4mi2!%kK#Dez-x-}#PUEnh6p-23
z;(Z7=HiR<4vE;GsVAF<r;gY%PImLL_t|bqYu2E3=#<_RKoigHL%{lQfOYoBOWulVg
zu-t^cSJ}oMD`EHq^|6$^y%54TcYT#zTuzRESTRj5v?OuL=%gAJq$}z*oExaS-Vr0*
z`3-b1I6OGwP~Iysi-TD|)Ymlg1~|VcLqKNm2l!9N9^dDr=Bcv*{2!6iFUro96sra;
zN0$`JV;1es6dwULJ<u|S)U-8yB0;p)v(-H9lo5+_rz+VDy_GLf@k8=Xg1Tqu^Es8k
zwadW;Bq<NBOvYyFn1api(zQA)_yBmqA5wkRa!Z8qpdVT=-&g=xJuXur-3@+=Y_d>C
z*FGR~E}AAZ9T7N_ahWhHKQSo?n?eezrZc(HFbG-sX_NMT1J&usEl&-f(Pk}&=QbkK
znu0P6D@(1|34v&p159gFD&tb~E2Wi!fH?ArDdFIdrn*Xurc@o&5S!KUzB7_{t(ngd
z{FKp^e|D!qV(g>&v)Uld06U9ETHZGc!pHMLC|_9=xehqj02bE>5HEX9(bGF}@=ieZ
z758a-rAHh~mt~d8@W;Ada7p6*Q?aT?@rf0h<LEfW;UbtH(F||yZC>3_Hjh!TaV=Ce
zcBLa}lEz)R%wtOZ09=-TI-~jN^}nF*ttBJ7lV&!Gj{0m1qwxsiOlB5bAK@NQ(&q`{
zO46a-44jOifIu{8D_mIOx^xNTd{dYV4`fu&iPj2N4UUZKPtxBkjilGT5f{~xi4KrN
z_5Lcb!$Tsll+M-vehUZ6a_Ia@!F;sutp4Dc)6LuM8z7iCQMy3VJA1OjH)mj%oTtBM
z&8ll$X3egDCS&X7M~Mi>khLp8<jdowp*wkSoD;3?@A2x8ma=HcEQIakpCh#02x2o`
z)CR3e-uF9Zj#o9#qmO?jM*WQH$%hn_RRCfv-zJQ`O&k*>e!?0UtP=U#_4?z?swk-v
ze?ik*$Vh-9orFvkLZFcF;W&A{ErD8*`8HTSg&#gBz(3m*DyTDIZ((L?ZMBgC^pJRI
z7R7*t(%X3nt&|;8aFzvUmGrv!up|J+&Fa;z{YPkoT|@N)KzI;;M?6rIcXvrc>pmbn
z2)E_i6POO3Hl_kA<;&G<M<?yF3_|vMPZF-<fN}CjCWYIl=J(C}RaVOV#T*$@pjM4z
z9y63x7i|OYQP+t&pIJ^(0ep1lC{J6d_2hCUC0PJoKRTvR8Z!#HAR!_lp{4?Y$9H(R
zqO}B8@+{^i%xb1x*SnSt9uB$2H_N14KJfcsF+i2_nGg7Q{f9*E2_zh7x!l&iT091{
zT>M~<pPGsDjH9$&PTBVs;Z!wW1ZZzqaJ?8RnSnzZGvBKbv(a@dt07sZ-cUyiaw5BB
ze(RMkBN9{!3SKAD%fQ@X<-vu=Ya<-|V#wEr4s;5Go5{U<1${2j{AtI442p-Pmi+i~
z9-r<wJ0UD0YCi2E_If%eKBQBBDJtU7u2!j-?B>*FCP|)*`e1%Z_T}@y)l~Pq;vEP?
z4np-5N^BEc4bdG^q3!Tjz1W?)!0g!KIC-00!l;C}03t$xUTJ#d{a;32(33vM6CZOl
z{tzjB8E7PmHGsUR$S@)5u=_O5X~@b#Lf7#Y8@V=a>(&gd1327SuNSU86dOsVR|-+P
zoP2r#9Oan*Wc>cW<GtWwi~FbQRfO?I72{e2OeK;alz~Vn>e?!%b4F8FMw51-F;6|S
zl7nQ5HjA&oovfo!llZHocL=Run_~4S-GIg06)BGCY8YBFWg?8n*@LIikp(SXyzc8I
z`j%wJ;4T8TDc}BRjx55jHA{%)D4j9X;*4FOtXWiBmKezP#d<h>1yhw|>BGG$6Qe!k
zwhCJz{7`l4tR`1sTDdFx#r%p<!QvJ-GJp4?*yQU)Gf>)fNajOs48!L$f)UxRYI;$m
zWayya`5ivXdDK>D#jIRfwxoU^srI8zL!&#l+PXy;d38WD@^%0Y{V$%I_G;sY5+gIi
zH2h2#ucmOKp0KMFC>})fSH&ieoh$>l*~$Nxx(o;@Q3w~)qj7bet0l553pmEm>K7a6
z*7z{-E5W$RkS3G1nGNd3<)S0$MFyFE(ycybLw-2A#iVAz@h+TaBO$W#!AwS8#_W4(
zf>=%u0)PWLGaS(%fUTVPjDJ3Aqi8?0XINrU*3m*Rv7ycp?X%pw39<|oKXGvYltqB!
zKv>Njrc@f((EMm4W28BEL91nFyxzg{>MPHNP*I3Lq%}IXB2v4tbSo43LVhEJs<l1j
zs*tT-So9nf+1Z4@{Cm(%*_rZTF3ipfh%U>Z`;}1ckrHghdAEy>JvYjzq7AzUKwcVt
z86xlbFTeic$e#YC@($xr_-g!qqlRkWSF1<hD^ju8Hl#aJccDGcf#zuDr|n=qm9*}p
z=~Lm)qw=IVv37<N{3soknAgWae1;L;(6!Jz(GQ1RGtakr-SfA3=tAtG(*3k{G;0d0
zbRi?!Cxo}_H9Y)pXhVlK>|UGft?{DD&BGk+>!)u>3X7wGYyplxv9@jtZC)&zhS1xy
zlC%$3$u=5@j6kIl#4DaWb6j0rj8W1%of|ZHO^M_41p<-scF&Tb+04=mF~ULn9-r#u
z(VbkLJuUw|wc;-?3ZM25G6mQda!IBb`V*OAEbRKo+N1udBcbK)%<`#cNmmxRh)+M<
zuCz;PwH<8kpNWw)lG1kwRn}`=wpI=m!7KnC4=W1kjyQJ);B2=%3&V@i>Bl{$9WL6}
z%_`cx_6xS#xX5e;-i@b>XBJkKXUT$cLtN@}#{msC-em^0<cM3g9Q*lK<xO93k>6Xr
zM7A53Dj^sj7%bA!^3c@~FOghHKn`o|>9U`Jv(8m|Ikzhd51?;$WVV9#JW`5wc%1>^
z2`=)dV&#{G%`kH5hjZNU@6K_9V<fvAE=rT~UHV7`?+QcZY%B%4jP+PmL$G}E(UaNL
zU(;G$fKg0z$r4aHFSMCb9xPT63Ax+?GMg<)MCx40EBAQN2n4{qvn)5vgzi?kgh<aM
zSiKCr(bDeE(<(+Yt*`8yfF0?Smv1cXT_w@Q++p?poM_UT?`yEkLUK7ZkhA<&cZsEJ
zqGH>X)F^1>0;eQa&ik3uq3vh$fD0{Kr)zBnJFv=-N}rZrJtqa(IuLid<Pm$FH>)3g
z)1RCLfh(NhtA`iGz(?j6P0b1%>gGcsX*FmJ&5(Wa6yG>bzc}u+IwjDr$>f~_<!j6>
z=bC~OiJ-ze?%A1s)HpIXDKrAlEAk}}?*8U3)2FgeIyS0r45*&FrZ9Y!R@N5BKslC}
zToUwuW!akd=zFgLz!K9h&!J0Bd-IdJ<#ry#0wkxtIzG3NdoOY-4ZL~t>M3upT-<$#
z88U4gp-iI@o%}iu#Wiu-H3v}18Af!Y&~f#i#-F<UCahSkAy~GZy6ro47!K$xVmnOT
z0a2w%UXT_tZS#Hlr*sP%@QJ`Xw#moPIvUWblTwSI7f-i&VxHOCbg7*#we=L8MCh)P
zqwY{x(GGA;in#veTJmsPd{;W+Y48p&Rz?bKz%qdB&n-m;I~x^)FWAZ~_`1am2#P(p
zIvXEQq1R#Y&cj7LAGdOq(BIBR<`Qlt@4qD2=3LfHT)k}X!i~ApR^aiuqoXTBedFCz
zf8-igfWO$YU{u-xv<ir}!X1Wmjc@}+6zVRz#PkPFsQKa~IaRvN*!F9Qlnn<FEAgD6
zaszGgVuFt4biA9Gub3stc2p3FWWu%O3lr;AM7rQZvQQW`(V0XWZpW;7*WRA)(aoA!
zJp3uM)}h`FAft|wx&A9!fC$yJC&pYv0_>Oydk7sL%p@I^&1_mxR2o8RZ_p;I?x7p@
z4p5O|eEgeU>ED~(eb+YqFM01T(moMW*PxiH!y~lOq%HDB<IJ>jnx5hVt&F%5f^0Cm
zCdcNvdR^SeRfZSFLxfZgY%Gj%0uS{br9YRK1M$$2>{%b%FHxGS?}%2M6DhScE#a@o
zf1T;iR4QCqJ@Eh+^guOdw43H{Oqj!QOtFJ1HJ=K*a=?fqUJKjL;ndaD<t8e%jN<v_
z-jPG*CMY3n5NxG4Y6-?QbNm-{Jl=Q^I2{HEnCC*h>AVkS42m7FEoNjhBeo9T^zhK^
z?h$mU_E5@Tm$NDqt<hENZJe9fwb17V#};>{L;4sb^L6r12IFB=!w?+zeZT_ZAHGRT
zjkf;x)R-K^gM50sxAO~h4m}QuJbi($2_i4+5-I(E_KW~|6VgCrg=Qk(qNZufw)of9
zRvzk)B&a@hS@uf73EKTd_Z5QsgQNTTdp109p@nYo3xOu137s|`#*MTA25~oF7}E3e
zQ4?=fSpo#8Gfnimd(X3<S;aGa6*8H?Wo;oDORTjU*rUs}D=7jr*{cY&xc<C2eL5D)
zZy-+jeqN<j5P*%_(uPeY8kw!>E^3|)^&s7illC>rj9nS4rWT?%cAQI&@@Whdv>P-4
zZf|IIYS_A<85qUl(~F_L$gc1l4COguVpN{zyj`}4?kKn9$@j8y6S<pL{6-srHmV5O
zZ|7}wm4^2CCAsa*QXoU;EUs6S2&?eGR*qx+a9^8r7c52!Y+2pEK7aqcb>sMtts94H
z`ZM`g%ShKeELPVl&*KN{-~rLqDz?^At-NStS8S`UEvNWJi*@gXIRYrrh_*M)PlD#9
z+CAFg!2hCh#Ajyf>MCMh)&^V3LNBX(I97I{9)uHBLAH}>jf<y+YpxH`#;mvOH5n=}
z*T|9cm^H91^OZEB?szO`<FjiBICL-x{AXG4%`|pIamK_55_onjnEDMBW*!rhJKMMM
zv^4{-Yq*%%dwAx31I1kgrO%#YtCE(|X(<(ZL|g2-)W{M=G5=+@C?HEJr=_EF*z7)P
zW|e09%^WKB_n!VQr0FKhh{?2MEt2BwHjBh+q!OSZz4I1n6BQiF@i!6aJ^Q&I2l67f
znJJ>eZ=hEeUrJ(L;0#u(!{5bXGMBenYDPZZ)cimO;E>O_GE7)V5X$j=DiVP^<FVed
z4O9%%c6D=O)YNFRs!RT^@)^r)T{zidTyIBqbD3|uDjMEwT{{La&huESkj&u=_M!_T
zfUw)%GccoOR%T({y?p^b5gblI?6EHA%?e%@-B$jb@4G2n1R-3MxxVz`9TvNR^)-Pd
zpSJm#$4#~x-_-z@R_A|E1JIW_^=pl_AjVGixjzP{YiPZfDf)2~m;TG6_@|Om*yapX
zv7h>qM+Lx+e;<s*<SPGoq`0g2*-dUyGKUkoV_2E6?fLjFzHJK(^NBb|{7_PpgAnDL
zQRw|C1J`<4xm7OH`D3s8ZO<}=I`We%?9Q1pky^ks)`MudMmv<Wta*NAW>}!qEjIg{
zU@H8`mG0A#^B{|WxqTa(o{~(7k!gbEbV1Jqza~$M)q4R|`8TfWc9|m*pVaCR4nd?D
zG7myUT6ka9GD`6-1yAod39R?E3G^^__erm-Pjt%w+>%4icDu$=fwy4bpIilmD@OD5
zY7A{EjWRG9%K&GV!HHvFTBPL<{TFC6l=Khgh)^FWoYbhJ(e`>vQsgsZKOO(f6XRgg
zmFP2$*;GU53*<r3=jaGE0180>)pK98{@OAS!-MIUjClCM=<1G?j$qQt*u1T3U43d*
zs_ysHs%O6$zpU`2!HOk@e=~kHl#j~c;_|C9T`J<WH^WFu;&}j78<L`V*(wYL?s}<+
z-v~|!w`R~hMHSzEDrEI~;gm2{=pxpUd#c{}kkQFfWNn{coFjd3MpKJ__!#iT(iH)p
z>ad|K{k<k8;W&$3&6aH)V>~hSfmeC<Ya_WVA5ARvE%HJJC|CJ?zJ!{U*mBOU_dH=&
zlvZ$j_FMbmPp76_V3BoE+$I<kNvo@Qi5<x{8sTjdBb<avGd)eF@&w@Q5i^vENq<fw
z;tK@=Tf`uwc;5R=a^pG^#TqYTcVa3lt(Y7l%jog6{HBrVpUlN4=jy9Tybi=68y2?%
zNbHQs;;1}vucIU^0qYaiQmA<&>A}bRDK0>c)_1Eh^>Gq2l}$a1e(fR85?%b-fwD>V
zpljcH>2Xc3+Y(-B;|uK!W=UY>j>+#6&OVLnlbY4O(=d~abWf^YHuNyl1?_m;XlG`v
zyxEN*f$lPV=Pv|n1R+{aS5sjDuVR8u&g24#rS0#$h5RH=y8F*It^f6}srTntLKv1`
zt?OU9JTrm@l9u^_eoOp5C9W%1;pbui3r9Tu^i7$NWRjuD)n*!Z-Zs<)p4L@6ZKxK3
zmeToXe>TwFtqbYQ(2L#D$u}&q>ZJfIhkq%E+)t!#5F$a+n7iaoHZb*1Gs4+?;JCQU
zDWFnuFpXib16p9?Hc?}R`PES146b%-0=!VRQ+h8d(m}$jm4*z)0mIYS#d&hDq)-*V
zd14&Ds5-tmA$8&NnH-e20KV>ZLAgaY0a(*(_A?jS{rEXAI1ZGP#I}WXrUrY*q3~JD
zk6GDcru3tbylL0LKVmZ6W^oyMGLkFD#ec-iuFtUAvsz!q%${2U#f={1pYBKhsDy-&
zvIH#^f9A8yHzzDeg8}yT2}1mgovFx#n`6N?!BJXO1Zng|smC8S&fV{GA@|l=Vv=k2
zdpD~kAdWNS49b0zhjoaz@Tf+w`Tlf;C9mKD;%1v@Vvx6;A024h(V^(iD99V8;eW;}
z+ZoMH@au@0&%GC68zm$cAEhc1w{<^Yi$)2k#f&&qO9)LGpA{}=Ig7r?-q!KIebRkX
zSL3&n)qL8KFhDgx<QmkoGrc{5`)?8{_bR+U%#2{9GPw7Y>V~+p*B473jB<^oY;pU<
zPc>~PLg^ORVtm_+pUz#<M{@gjfO=3>yzaNp5W(QG5LRVP|EEE&hhXWxyU(}m_-?67
zP6I&N8#Ec+;*Qvc+Zu`~d_CWx#|FALW$-A>@;Y{RWE{>SIvVh!IwPKh(B#!A+%PN<
z0Abnzt{-0u&NZu&qvrkM1$t5j;?KhzS5kdK9k7F48#1UirU&|=N%F|;NIbO1t?OyD
z19<}ieW2qzD90++{CV;upx|MWUto_lLU8^be_}gzGf=~QQ}~$UocgFn9738N!aQFZ
z+VjMVQ&8y9ICYV2A@3*=3ss##OR3Aer}^9D!1`R%LC5#Nt+eOM&|mqYRXkY3y?W@u
z3bbjc_5O9E;_p+LydH_|(lz_SZQ0ivgYU+Z)sM^G@ZKpcU;4naY!~(p1lXlYQgrOK
zr-5VeNlMa9-?TR&SxlwN!zmgmrPWA7KEDJm7EJBZG%L7$X{fT+Sg^+p%tZix4U#9G
z7%FS~bFbzg7EB1fE|{=0)*UxSBd6dej(c_K<2}UDnM@kgPnV_n5q)G~R$khR_xCXu
z&{N5Y^_*>dyn618hPYL=dCcdZ0Y`H?x`6sK-Aez9XEjpJ*~0g`=>wNbda!g%5zb}~
zePSLdZ9e4ln8CLm<EBRo*nPbnyjVWElqqeW#5fq*&b2Ze#>EXeH#rri0<PB&ybPf5
zm!%iO;*6|7e<~8$hy;;$IjX{L^cSO>Cy{ICFcR5oKyp4VhWiP-Sc>=Idy2Gl3K=!y
z4p{HzoKM7TEXQW^+VCKtE)UHn+svktFCyBO5%<$_$BFH;c`dcv08@VD@231=X{Cm0
z0;~%|ihF|x;RdLW!f*LR)$K~s?D4E6rebBz;t>fB7MaEqAWSvb3mTuh7Cw9A+nIyc
zDM=RQE~7`fz+lX$%$c?&Q!zGQ13siimo8<{m|XXW2F@UWRYq+0)xb7J)gRJ0e|GE_
z0%fo<ubiBs<EzbdInLyd=!OVj)%n4Z`uB3#P=?i^H5(exepe;)^K8>ywDOlgnzE0L
zqBL)}P4M*o^lh&|_w?ze_-<{{`q-765eATci2SGl`a7K7IU3g#*tPB_)3>!C>izka
z_G4eI7++pi7OiWSmBkGxb>Ny>G*^eVozuSV((=WgwG76J&@0Aror6=Bh5kX;{=4xH
zsp7ut><~QPb#`&u;~E$Kv-Xl_2G=!o9})vDTTts2gToZGsA%F^LF-4sOO%c7x2t+*
zh{D?lKc)#e=!_<A&pAxJr?g+9NTCBIkka{DGTZ9{P3cvH^Tr~d+F)lUSS!lI?i=X(
z+Dc7CH_)JHb^P1<{Ermd?;$o^!|F#=BXtB@LHRSi>*E+|0aG>)j@?(W=lqs3l?F{&
zTn!O!ANwosTAaUs`J6G9Ir|{98&`&P+HEe_maPueYv^-zmmSzO8xG!C0cz3PJ<u()
zW9y*A!%@I!*Q+}(c*d1_<ZzoiFhA0K;dxu?sE}6DTi=M5ak7L{+tj_Bnwv+3yXpZJ
zcSD(kWuCn*EWSfsXECD3W02s0N==0wzhsgLqm#griDB7t&(EK(3`+OWY6s$u+AMlm
z#QKN9m+W*q@{j-POOk)qGa?v-%G8eL2N2K&sE)}q`Pi|DdZUb1sqOEPpc#@5MUzIS
zwaIF~n`OiQ{N*4zHMz3;<s^xvap-mEq<WfO0O`Y*4s;+8FAZ#PnS$s@H`9zl>!bl-
zo{uJQ$A<K?PVX(3qwUY%Y#-KRa%DqKHV>JX#k+}%@xQ!j6{E=WBJTLP{)wTX;|qpv
zSCzR51Kr)bx7<RT3Wa)5nrC{ZEOYDX$WXnSoRgFr^rE-r<2~AIz~`<#*9;2cqDs+i
zl`fo^zJcm%@}u}el$tKckdPGhBgLVi#g(#`0RbX)^cr%{-Z6clRETb7=x`OuTO~bT
z(^>`N+#Qz|zqT{`NBagt7(rO}8?AiF+{j*v(CZ8-uU%Jn-cQP_)&nXU>b`&3)cn(N
z;O|2f7L(DEgCJ+-y$(Nk85Y<Y<c;@Sq?LMY9CZ{?vw?%zv}>TQR?PH#uM+;Ojvt_T
z1`Lo<R%({hAknP{z+#L~GxH>JTm*r9+my&^TmqvFq6)6!m~Wu@;V1;aiJGYrePU>y
zs%}B6Vv;vaI~~s2I(oELH<wSc;-gm52Q_XwiFsoHHznPbK8^hP%u#$hVN<1*pQAhs
z6%8h`qM7vd1T%OMvmuH(BAbWt#I06H+2325wHwr7jd|C7)l=5&GcrFHGarchmCv6(
zmvaot_H}5In7Dwz&nw|Nh<r|`bMs|)ih+{cEn^HOgSMDer9xuQ=Gks2Fry*iSt6*u
zpzIf*@2v^a-ptowVHac`qtf#!Zesy~>b$N;B~XZq86E{SaU;rHOdP(hpacZT!%?Wk
zXvoMvSn`szk=s5dX_Ei!OF38N5pA`*aePd)pY<+;HGAU17~TeK1n5g&#)u}#kzNKV
z8^e%jJ@mmwwbIxA0?A9XWjZ3%WtJay5JT`xbH^(dsymvoy1ymH{O;rEPEO9d4<WkO
zCm1t@bW_j8#(yX?Dl?gM>EnrwEClX*dH1E}<=+=~{QO>2rG}GDz)_pq{oZ;zv9{7M
ziTOE4L%vPhA;}zIlcW9ydac`}8hPwJ)qwa4x=);&vt%;A{idZ|oLvYh%-foW8@QYn
z@Rqubwu_=?Z~YvX@92R_Y_X3`669DY#7Q_hB>yJVSOvM424MiJ!7Zfv7Xwb_a8@0n
ze0)L&gS45w=5R!xDOuUyR_a$*py=L<qsB_T3FjRZ=b0nt;UONf!Z8)1cgZ{>;u!0~
z@*cHV!dAws3@b0ZR$B+8j)A;1Dg_wK{ha}^%+$iv?hcz8;++Lsko=-9UQdn(3&(4~
z6AZ(z8oFm*o*E?I*N?ts8QO}}w8V!IFA3JR)=}Rp6)xIi!I&&GUxwsru&1v--weGP
zDte{6VX-~Jt2p$7PhFl%qYf<)820E~ZUx3VB1yCm!prj`Fl?_Xgpaai@EeH!97tBk
zcfngDDA3T4PC4tzKLYE5jYgNmtLggA8185uiBIxp!{5*#a@$MQ!tDw<Lds|$(;Ia-
zp7OUHAvP}7{gd)cjawmo(hFaw^$cOoAfU*l2k0r%EKf^ijLsd$r|^8zMapvx53N+c
zf%4irF7N(-qs#cA<0!4<2V92@eVhH3arc<Yr#<4iR}wNetue%L`G=SYtTX9t7k!F2
zvZV=<XB6%yi951T`UxnJ3fQ&GoSQVGHZBu(i=$MpP}=cmMFks!*yeXmh64UF(OcfX
z(!ee~#{p4%bB#|CwX|;w`=<AdGzZ35=(`nfaSU5Nw={Y{K7aUIN?F!vT+_Pw4CKS{
z+*vN5hO(^b({<)GWB8(nw2Yfgi(jgPcM-)jbQjgAV%%sd@PBSAq~O)oq6DL-)}PtJ
z=vi3n6)MSnT3eF(%m5y2r0&S3RX}g|B~+5SirX`jpy&QukN6W;1bm@fc(ge6JmI$8
zg{E1RRkDsFJkECpC^K};R^jXxz|;iq(Z&4h02CU-TjFyO!MI0g!HXr$HEB>SP9Xv>
zD=X=c(cE#@%m*Sj@1mM4W%gK$Vw2Vm3y5Z{i4pF&YD#z!<cJ!wp(LP-w1B1o7%+!A
zepTgzZy*$NVDcAh)zev%HPC1t=<Gp1ws`2_z2g$gB`bZXQemDbzNi`3vn@GN+s1?X
zfrQShHp^Z?D>5po!qM2?fS8sz`!ZGbp7(#O%K1-KJpZ@8pI%ebX>&=ENk7sl$v2dX
zv1<=C{zoosV6nY65dhxC=2J-kz}wpjzB<?Lyh8#27nu2%GhrmWJ(PdzwvGh$&5Ip#
zLxESQ!klp^PTe*zOw5EJQlNB~6&5StlX%S(dm}S|S$HAAO~?q7wuh;$Mc}M<I1{@>
zF|4>*Cc@!V{;b;AAIt+;TDLtqm4dj4Iak-PMA7vN+?koeY#;}`hFc$i&b~v_y+wh<
z4;x|VsZ_AC=Bqr!T`!I*W_>44?pUDE7I@BcZiN9E7<vYGdFjHXrf*0{PnXC_0|bfh
zPr=yFq1GyPbi@cXl{O%ir!d2?T}frT?;vXT2n-yph09j=!tR){igLjUb=CTo6br|+
zC8c<qv0820ML?kqk*rRnL_!38CHpZRXgbBiSlKl37CmkEFzEQzKVQ}I3Qjr<eJnr=
z#LIdc{v0p67)rkuS-7Yh2+ZLTJA6xC3bDlvLQ=pfaL_%gr_*hs_`neleVo0H&%oaH
zqpDVLuuqTZ^I?7C*=$+ysdX4zp@o>rlO{Jp!qpr2o*d2FQAzLiX%fe=a&wNvUCdE3
zO%4^-NY%Ulpa<x2XX|E1f2d!cyd<{E(&U^!sO?OEZA=p_@MIxs<UAG-tVkG-F0lb7
zf`{Y4X94tIe;pY_nks$|X-^LR9@6gd$6X`p$F5=3eyNmY#}L0pLXZKY?W^Ry;a^|M
zz_pV%JZN>BS-$hSxc?@uxL}!{^RSA*qd<r*qweH6(OzXYeOZrF|A+F$>V?%4XS1`{
z{gs3<&n4XE7)ttb)TJa*QSDf+hh+MA?P707gg)*T<+37OFO6)eAG*0*YHVVvKRf$8
zbz^)EHaD<;{N{c+e?{CDGlfg}0?e^_h1Rz7>t&X!_s1+~p5)GRt?U}`?#gn_Eov_a
zP1cLF&J(8OYHi*3HPNB%9WC&XbR6ME!f<m3mx-?vMI<}5p)_rEXpy+rZN;7S;V}H-
z0gLM4>9wH&<%g!PjOxehuXxMxOtRbTgr=fYL}|Inn%W5_*2|j;e3rZH8UTWz%dP=u
z3`3$VSgWH(<?^;bmbtx@-@^!Yga9>g9xSV8SU>7dyoG*-QusDSME(Q+W>t%WPgciR
zBU!1H(arm)*dR1xG*4Cxr!0+cAny_;X2OaR6NoGeqv}puV}Pe7t!FnY{`^kLCsP@$
z(WT_$*x4%Zv9?nv@d61w)VGc9P#9TV4OkHt{^wSNU*HDp5iGCiDhl{w@*#v_X`xZ$
znG?*<KkxK=pP@`8Y$x2*h^=Ps-{X2zjZr9L6>AtDyi#o{$<V&pjla=`X0SK|CK$$M
zO6gJG$!|Jg85|)aU>om0P=oGv<V)s*PZ$bI;IDJ`IwZFMrser-NtmI-4V+=QtFH_x
zZby@aOT17XbW>`Mwbc|e{`dqz{`wWM#LERkyJBV?5$~3;SBGt&VJ?WB-~<rM#97q+
z4de_sce#n@VP>SX0Sj7hiGWZjV0aTQir#&^&60Q-HUQaobobY{n&a>=M0f;l5Gj{j
zFJQ(XTm(6swI0o%mDeqVDTO|apL+f1t5EJtcK(J1iDPU8_*J;x9z+0kl^0|K1cB2<
zW{*C~1xBPnRqQhxn^&U8Kim*my((~Xe-mXx_JxYP<Bj~KL64-AW6p<q6GT92K-JuV
z?y)e}?z0pzXX>dVgJ!7g6XHD_qtCLldUX%UN@v1RUa0N1)*knWb{r+ukEZ+6jbw<t
zle;qBc>QUkxAh%V7#=2O@ZRF5yju!k#XgIGUq823nQc3h#Yp8x!Z?#_@Fh|0-$&K_
zxsqPpOG4M~vZ7rq=QDA*8Tm<Okbd(?O#NM;1t`ZcM)RULO&p^AA^#lWhHXCkP=BsV
zVQkku$Z>}^`<GzJydlbKE0Yu@GE<}z__0)<V$D|jc_!)%VEDeT<|wyNo0KcJRX!zJ
z9LQs;KT60+Gpdfov16r2Az9LE?P+)R6rU8cRg$6Ut1RM|Vkj_n<Yknni5ef4wm0!`
z*F6S`(CI2U@dBQ_>Tb&KO-#|Op-LMUd+#YRZzilp;kX4gN~X9{uNb3dX9v_$J5RH&
z{1AhIoRof7-IwqK)7#>3n~YN}V{c+M9y(9FXNNsh+nmbh&NUoS(OdoL69w{&4Ym(5
zM#s1iZd+B|4eCgJddo^Chxm!mFYBLgy!2!{R{25}6{ZJ$<rO%$x(F!oSAHn*d43}B
z4mM;gyVLJjlw>GL578LuZb&L$O?{!sL~r!CTU>KsK0F0~+!TByIC7c9Cl7-eW)9cq
zPo8dX##UB=bx$3EoWq-9R%;ix2kj+eW}%U@O#|#Yn%sbCJDBW%lJ&b1zdTDZ@u6*(
zdg5DirCbVUTiHv0`t$!dkM6(TSpFxQ(*M)H`v>M3#-EvI=KcD8u1v_CL1r$nwx|j=
ziO_SSI;*#-MxQ@eoHi~|?Y0t3_|+=sQ<}0kT+cq|hv{%|rTIms;V&s{5Y+S(v>qwV
zRA*;P;g3c>O43h&zhh$vwJUM4U;VmzwaX#a`Or^@QeDa@r8(BwPsJ#Nrh|<Ht?m9*
zH2rFw#y!wtnK1sD=-_^j&{f@aKG#-ib11UO-?f^fM~;=PnQtjLFF#+QE}e|D;==fZ
zW%oEG=#=~RJE2$gs$n}4R`1t#jydcaFCGpGNZHgpe}5y`0{#Xt7+{8%3+y=Y3e2Sw
z_=^!NC}+|a+P$wZu8<CXP^a`MCl+YW|9}zYnL0;rMmxayAf2WCVY49x5#iPnPuMXr
zef|L;=xCq_(2s+HByt)s{ImJ5zz<fRu}3c5?H8bYzjb?z){~fr;vTX(?L#Vuc8=mm
zPuTs<iNmJ*$`p7y{=r@eWQJG`05<&yz@{tyj7^uI&KK>z+Kpk04mov(?B(SEstWgP
z<F%B19--VHQh&flGmHQ*Ret0I6N%gn7tHi0j9*Ngiy}$uX9D~bwe(Wve0JTw@asK5
zr3)YA9Gjru$St{JYLQOa@Q2LbqHO<Yu1<h%0zbo($gINFVh|EfcnO#H*fH<Y#$Qej
zT>1~C{(qspEevWn;r25O)FmEw%bF>~jWw)GWdGnpZF$EA=97<hi$k-op*t`8Dcs8F
z+--@=Rhth-Y>lo^1HN;v12Y!<cw`42c1)yiR`2B~KT<|B2<d#>Lmj+`xKD8hncTQt
zEOd9swG=GsSM;Xvd^4%C*_wA>_~Dg|qo`&$BH1lUHrSN!v21etS6`)YM@xDjuV*{h
zemWtlU9~%nlvF{h2M}VdUd-Exhf)*d-Q8(9RvNyT^hmW>?UKJ?jsOVT!+g;Vl8(0`
zyaB>CkJvg7#S+>4t~ziAi%LkRd&pnv*q=_S@Z7ubG8F2&XNy6pVf5hR2VL6k_xyLU
zuQy8VET9VT0nAw&7%M<vq5sJHL|VbYB=GH=>ZNbw<AjvsOcJ4_?sL^IkT^MwSz*|y
zF~7K)$2B^ebxfK9uAZZy2EKg%PYju(g-<oj<dQh8hKa3|ysfQmMhnb68ZI7I_Yqj6
zj=7}~Qds!5;@$R?szoDDr{g6@O7b*8PR$_SK*8T1q<vNQbgYJ<`fs3$Y7?MW;&CFg
zvb<S^jm1z(LD^UNoYV@dI|lqweB=J6eB7HSQUPuJ{^Yp)k;-~t%3lk>eKl^UzJ+D3
z5A~d^@AEx)kvU|^Aaw~mTSFjr?*h}D+o^yK;opZ>{lsrtIx^6jHpGtlf*sK|4K_OW
zO@Z?1@;B}_Wv)sd2gwy%x7E*+1c4sY<P)C}-@+6l<6O<NNExiE$rp{f8JsS*W5rzz
zsQ9aN{JCeg0N>4;<WNR|#?zd>iSb+E;`oM}t`L9_lCam7y9GC)xS8N#kmJ0WRb{zJ
zbmK|;nUm>YDCXqE*Begv3V=Mm-xQPu>xF+-P*RiRVD*nFeM}>8JnPxh%^v>Jvbt}>
zH>;g;mJReQTx!J9Gt+X{;$h|NZCR6Dw#t!#Emz|}<XJpg8zi+$WJ4DCV8*nE)u#MK
zh(w<L-*k1rf&RzSl#HATVzD>r$|-2dFtzfc4fz7N7cGxPX5{R?{-!2LOfF7WwNLB9
zd}*ZN%eOtBkr&zpWWB8+882=lM%=%$q-vGnrpC~SZ+K3lBxzws!5AVdN&%<kbcHwI
zw6qLW2Ar1ERJ&gS4cXh!+8CL8+k;8Saj_y=sSdb?Mvk)j72v0I!LQycsAw1Hiuod5
zqf=pTR~jxY3QEyAUO}*kS6|H6?0_$HV<UN)-ZWU8wtCEW>_zSmcL7-o1Lit6V112d
zd}0F{&2OE1UZvZsJ#XohleU)s?O<oS-=iA5BBY*8u55$9))EiQPzNomFGt8PzmJgr
z*<9fF*9h!n`mG?EC8hnjY2}GEeq7xckJ|)6ZDcTXo~E`DhC-tUb-Yp|_YwiT%k4o(
zS^Vr()$90*Jx;chTJ#uzGs>&j$J1ttpn@<7;3khJZ5$J64n(U3$%wwwhZuNK-vZ2s
z%{<42>48gtkRRX7d3bZ_eQVLxg51PX11}Y4P+Ut5@0llR(O0FETt~;V?0q*OjS~uw
zA@djZ4GaJ~xqlw+p4Tz3{Au8fdxq}m7pCN)lBWy#d0uQ!XJR+$NEW29amB?+$_biR
z<D)mT9ftWrI^i7fpZh+lDh2FW<qp54hN}X^oqC@oi}v4rkH7<yXP5K)XKfUD7{G;d
zEmae&ZegUVZb64W6V6&U9=BGzlux`8p?$RgxfRsmVXzJe<MhOG8*7&PZ_Vr9A;D<}
z=B(cP)UT5frn6cGZCsb_T$hx<QY?<x;!nqP6OesPVOUi>CnWc_VlUl|)l%Cr4!6Dr
z`m-wzpJxgp5-2#-2M0{5S%6!<GFp{$dCNs?TkLfoDlF8{@=(Kx=Sc47PC#{fG~i_b
zm(y;Eek-E5yzF->AJW~2aU>fG9n|{j=s^d>i^WtwWz<@()>4EY#sbTh+S%SNPy53^
zQ~UZE!VJF1oqYIn<^Esy#Q)n~`u{t>_lpy$Gq+zgafjfCnr+(Q1Gi5-tc_*2=%;rU
z%AQ%fY=>K$r{MW!2gEYbdbG|r&1LA#b!n)sBWj*nYy1J3_w$mQZaRfq9D>!qaltn5
z!cgmCg)G%@rmP2h33P)9lPc7#J9isZ3^|}XQjK2#FH=z@eM)-|O!<H=xD~ok)Y{T%
z*Ai{cR|43QE%#;ofDRau4G4t!7*vb8G9EQqF<P$&KcD{w+EKai7;1S76J{UXGX(}l
zTi-wtXXo;dx49dSADiP{uOrV*)vb{6PGVCCe)UWr6U`P6&8=U@^v^O5_Q09O+0|Ji
z=g<pnqGZ8m6j%JP1d0tTx3c$v6$Q-p^;ac4LH|lMOCo3MUasX3ldjaWSKcolY|rtG
zP|ZVHc&GLBNEaXEK2%Mlg9;xBWoL%G669MQB-nsM7GW#LDFv0tG+2u1K@G-~P>QF9
zCW&`$Cq01_&zuKM*jq^Lo$?lHPDK%pCU#ES6asr2?^J6M@(`iERTuu(us$cfM2=F)
zglz0!vYS0m#2kjI>H8oHp?G9!Ku<20)C}nFQ-65DR!#)+ZR4%`2C|=z`VtK^CdXqh
zWG>7B-41mO^>qZ~?#`laWGpcA!VO&I>cP|*(YT-TN%$ZybeTr8!+x1n#_CyQSzVg|
z?mPu1i`KqLcho{WeE%rX{`-Q9IIB`!Ilfe?Z~&$7Kl`|>R5DCY$TVUdf|y|MN#kfL
z%g~kd=xlVi^f2f?+;O4~?2CRl7|Td765_mvL_+A>TNll9`vs`<L#zbU?aqVr2US(h
z&%WvrGkQP`%Bh2Wycxtwy721RdMsw%c@%T$A|UF6(#?PqoS<$l_MF!ya1Qdl0h)W+
z2LGu63YPID6K+0E8%y4IbJulh&U(S7+o01;KGk?mBoB6+w~zhTNqcX9p*v;3Dp>;0
zIy1$JEr(_io7uCpmbg@n?YlhzY~^yEzq&qo^;69je{7oYXud-k+oe7fX0~=R7?=zE
zZl+<_5j<Q!SMYV^;yXA9QYl)kqF7$vs=R$r;bi4X>p@s#7{_$$41N>4l>2U-01Nqb
zilD$b`kzkDbM}9?u#<t+s_*p)JPW}LVtP?h{osk&L93%B)(59ILKhAfB(>KE>}|i~
zBTpmOFNl^;T=#Y*=pNBwo$qhlop6;Iv|x!&iUOj|lD8>eZ`qqP4Je9bn94`S4yC(7
zao~&8zPv5A?AF)n@*Mtlb}lyW&!=#<Tn4t7&Vk?enO}cLgj}z4j!CnG!(TFS$Q;Y)
z=y1nWNNEvZMuj(E`U-MfD!zc2`$ev8{LkBq*$gaemP=gtR-Bpml0DSnS%K_oFi+gY
z3MT%#gHlxvT_~{dpK>Xn6?~<>i%7gmbtCnx<`KqK!8`nqyO>(u?75+nQeup7k2ZL;
zsv;RWJT>|8gC9_NC0r4yBUvmvt;qbTNovi?E-wfo=r!ZyJ_NWofV=4ZS>;IUBsBr@
z;!^T;Y(beg70LI0>y8XX4CfTi$o+tql8&tHJshP{i*mSpF5AI#f%Cw~4e(sW+qt+?
z1Q|k}Hz+oI%FNbv&pm->Uuu)p?*M;1{+l%A$KOd|lz_Y9%08g5@eAHWpQAap^@5SR
zgvyuo5DN^;(*mqZy}pumX5YNloC}Y*iva!^yBcBZ1a5h)$QGY^1#Qj(_SbF+C1J)V
z4(|Tsukh*RN1Jwf5a-TZ^IaY{k6ZwR#aACCpO<Iv=9S86Ky&mS%(z!uTS;;PS2=}=
zCr30MC1$2yE(`|d{Qk?VSJqu`mDSdg;nq@!2VVg90!@6Yj{DBoBD-m<EqxDVCk8kH
zzX4ZjV<5^arJ=dB%+X`B>O%WM<Cr+d5P1;Frg_>ia}3~{dgO)tam0lF?E5mZdF3oM
zrTnX9_ots7y@+&*{N8%MhyA_vp4RJnS8yU=pu{Bu2&b}#Ey%6d`ufKt5KZHr0kZMH
z-m-0NfB(5hu&bpv;hlwMV1;aXx=x`@=yhMf-2H)?E{|AK0#>x38w8Z(g*@~IPHF4N
z?WI_q2%Y>ru=~?TleY@{nW!tb{ZbBY-gAoh`j}gr=WanbR8HAeggih=g^Pu#`@}F_
zHNc!OBDLDF?mCeZw*mjW0PNiy85x<E*2YBVVJx2DcwZ0yoPA{Z%U9UgQ9UBh`(o&#
zZF?`f?|@oJ%xINIZ+sL+yIa)<^jO{Vwo1H#LQSdcS09{*$Ug}=`yZs}nVoPH$>Xa-
zy{6&YiSYP_n|bLLr{&3tjfw3jU~)`3j9HZXSwE_5jXzY`kAJGNQ<B#-LIbRg`|=h_
z?GC*YvaKaL(|v*g`nGn^O;W@Qf^VQoz%=5sJKVWDdCQ)wo}Xm_$aBpB@?1#<zz$Zx
zlz69R?2bK?(K{cA6`{o^+PaQB+dDDy;rubn0M~#LIA7iVE3QHECz56Xq-*bHjS7M}
z^btpFQARo4$o`&-a7<Mnn@MuuB0sRc{)b$F|F68C!MLHCWUx|%d4j!nl4?xD;n+Yf
zu7hHZYT9tFMC)ODYPnus=jxy@aruBL?clq?!J|v9)0;u&dn%><9eU#(U#2}B@>K<r
zM8d^I@@A*%FNl%ii8xyU6INCU<OPLW;(F=y0pqq9OLP449r25m+S?3@g9#0(oCrvG
zYdiOr;c?+L{dOcKmP<k;L%$k5k4jfiOierdxY|E(mrR^@$7uV|1E%R3tGl`kJhR2F
zcahsKgXAaNvZ5cHY6&C|9&1;xVtZai6}+YtxT}i~EmGNL$QXF3aOKfFJiwtjow%DX
zYB&>c197O~s}cv-r<t7c<f%F6=G$dszU^!18Ivs^@G#S;xoovDc<x{MH*Pf!IdB3i
zmhpKM?Zi|B|Cs?w#0|T%ZT#-g<{L<Vt#EfK^Zt+%Zf`8v+qQ`wkw__nrb|7Nz_X7O
zfF4P>zi5w_L2pLUeMo5iH20iRyfU#%)={*&_kMttfiArf3)(ghbWwhb0XOC2ejN!a
zS1geEx-EMUo^5e|Y~#Ua_ODu=+dOCqAdyj9yND??pJ3Gi9m?KH#VFaCps>%nIp%Pw
z@>g+W%$gnHrINLR5(?d4#F_NxG>`CffjEvN-MV8E0WIX{i<qR&(&OB@qkOJ{1_jl9
z*+;w573LP=qnf6}KLs30FTB;#jxXX*dC>JxYyv3D9^(JBR4OQGXpHM<(GXh82y7)5
zH2S`qHk`(FzVf%Y?5dv=0Y7+x$ff8!g{oS~*D}KD9blAd`2xoF1+MK4&r0<UZv}sz
z_r8+fk>G91&W_8#ufA>6HCXVuPhXo_iXNr7RG@sUIF1rjPVED`ipopPHMkFv(GrEn
z>K;)Fx`yKANmsv9fm{;LAh8|t>^lH#8E33WTZXVI7yE4>;r(uoXnOTBmS!nbs-0Ba
zl8{-J+pCjzqxhoxIYr<!*LIo{ZG6dXBH3+iCJO)|B)yzK_@TiFWPfY-n6$61o*l?q
z<~*&2B@%Tke!WaJf&6M;{nI{sLAH&XHZxY5B$L!J<wf&~o5quDI;<zco84O6+}$3z
z6?j*QY2HU<s67Lkdd!$c%^w(!+u(@@<R8sP4mS2`<8QMEyCqaDA9$o2M3&;-PAc(P
zNP-Nv9qQCDkiw|GlmNSUZV7`!@aA0_5U`7fDpZ6@l=biksA@w<F@r60Zt-g?UM&e>
z;?<P-Om_FW?}N^3S}4Kxbpm$rBW1|E=-D@uyLH?*8}8-zq-j;tXs4jRjS;vF&umsZ
zYuF5N&m}#XnV15!Y}%Ad^LFPBP;&{woSHaSVWEQKl|`q00<IsE_FF$D?Ib{`A?&p>
zS98By=U$YoHgHKKfg{h4tbxn#1YBvwhd}gX>d(=W{Zeql`+Z<TuKXDw$M8G7RG{k}
zyJU-*__b!W3s>wYpf#eo^tjKJnb3-$GZvmEH$mSgr~DR;MC)d;-528mbU!hpH60*I
z0tczlcAogjb&WhEeREFPGRtAk!KvFN%9A5-?chf8)*C>dML)IF>(0_T4b6Jz`|4i*
zF>H#qvIc$e;F05zZhbHQPJbimmp7EG;Rg!km|o{+S2)6*P|@XVI-x$=16-#=<pX&X
zqGfNx=nNmvz1C^)+O+AGHR@FW-+tH<$q*wLyEbtW|Gcg~p(^M7+tZr<WSz^v$wmHu
zx#awUmdGCX2qQm*U(HoE{pfWIX2=Ie$nyv@)xcXObw9h*<MN=2yRx5U<whm*_ncS_
zDm}NoB~b=;(nDRY*dz?|Yw$6{0YMao1^teuu`u*uI~)zC9SSU$5(LBhZwC7i6`Szm
z!{fC@Yd1w;<E{8@<2`l<>xe@LCZED6wgV-w*~X4MbeKw1MDMtyd<KD5C_8J84!5IP
z*k+k9pCivtM^{<d^#fCDDVg=ycByZ$^HR(SctSI>{oYb<P;W^f&Rv8Rmksn4-P=u@
z-I5kzUCyrSomrQ%!P?}1Jo5o#5R1iZhtg3<G0=lTHka4_h?1zyg9FYrWTlW*5Y4GW
z@|2xS@jKU~`yQ?h(F^|a8RHxwEBfgQb`}&{R%`uAG1cseL~WI@UJdxUqk{zRN2rIw
zP)EsIDowG@VfN3Ge`I4Lu5O+Q&nO4%ArV70w;9}$AG^0*zcTU_AdV3W^088<8A5%U
zxJL_1id|mWe`sm{T#9n<u_O-_O4+<IU9}`CmzTz=hQ02l%9P^?Gb~?Mlu{pjt7eou
z<t+0XXhl9hUc)(_Z>Z#N>Pkv`w)*_b4lGG+Hzrr27(vIwcB^=~^$p*D?7#l1Q2YI7
zK$!ftWp?tDA>=bSA!C|O_kwGy8ri(w9;OW)nsK%H6(IT6SX%3g!%LM6;P50JA?uWw
zFe>LYi!Xr$aA+f=0jHxD>op9CSs*`Az;%ccDkpXPI1j8)Sl(~-vZ&hkW4UiBg8R8g
z#^%*&z}@FS${pOMU_Sd^Y-s(_Th$~CC@N)KL=VkesmP4AI76CrwBy!k7-DP@;aWWx
zQD05qzI7O}K2^12<pHa9!xakLuyiG$NHbzio4M0eQzRK9UK~-=Hz%+l?d1)nvG3;T
zLEA3+lR#sL>+^1krBTWVK+Iikn9Y2_(z>si8^13KT!zNw|B2-I|GM8TN>|rf<^DXX
zR^PAHIi^6ADg4C|far0JLuF=QAG5NwRy#-CK3eU+^6$33+SBg7EHDj&E{o)zP7xis
z)H(ReBCB%1a1ngL_RkMm(7ZQ!ZLf7>VA5P+3*5^z>Jn3Ftd?|V>80Ruo!~_f^PEb<
zG+9(tzf_Z}nQGW0l0xWILRrabBX0z<^|sEJ%A?3D3>F23HR|4)E-m77^w}Wn<Ftxd
z>QH&keak^C*siW^Uzpj6!Yy~rIkenvX*JeXi}f^1j(`WWp-{WbhilXIa&VxNT8a<K
zvy=A?WO{aTQ~p7;6MgyX@`XNOBUi-P;c7tMrg3E%prDI!n!1x3-N9B{+a|Dg<zsT-
z&X~mnY*dPY3aCJ^e}Cft-S6vr-#}!tc2?&}v#r9V_C-ZljWh)W!fsl6QNc@ebOVO-
z0|Mj(XO2WL?8=Lw0{<(L?-^`JMx~A=wQJ|RF{F4v)A4ik-HC2?pQc2e3^+vXu3Jjz
zw48)CQe2%Le$nLeH02GTG8)wtst#K)=#If0;TE8tcdPE$*QShzC$<lOUrbW<3y9rn
zn#~}+vz~~^O*JE%2MG*-EER^S6CQwUr7~w(Fm+c5ji38zx`|3Ml~`FAVpkTRQuC7Y
z3V2GAbUj0MciSgjW>SIWJ39M_8&flfwIW>{+{5xeg|#l4T;ff?A6kHByWc(zBr#Xv
zMM;2qT1CQJKh_jFySaSo(8{GxvX&B=COWsuBkZAI%|U958Vkg8raAgrpIfMrE|#qe
zw&@rM)0wd_fhk6pnqELC&b&UC9UN@9(x<h%j&QDuT^eDp_MIMiS?r@cym_y0PqpE=
zu<X{eGJ`k636Vs>p(1D)E2@;ukK#G+Pt_sJMs8K;T+Cl%Hasog$6`;Xju=PhYX9R@
zA!#<E$Scws^D(<Ts+aQWMPVj`{$S+^fB-%=U+la{qu+W@cwB?1CRjV05)=qOPK$Jc
zsVAmJe=Vv=h@p#=+BAKupydMd{ugO{zvzEl)@kIv`9UcI8?&FcLn_Q3MPy&iGdQ;V
z$p0Aa(PRA<fYT*sjn1Kne6>?||Km)6M=59Wf^t1x5+#)d6p8D!&Wq{*;%ZX?5}hwY
zNS1&Q5`bX$$3*9$0{Tzyd_9C}knSGN0>^p_V!QgfEQh-FKqVD_{7EUf;=P4@!{mdV
z>236ygO|Wql;t3?l#rKf^Egco)J9DM5gbruu9;y1KlQZ){6~!HqO=P|PT`+<>c;s{
z%TU5O#<)1@+ayMnTzdgO5W-!@sK2?XXGBFSYW?Iys3yri7+BTHL%;mCt0Gu%p^As<
z0eSz2xwj6Ba_!f@2T74oLOK)>r9p{-0Yqh}MM!rDNQ`uM2`J4_f`n2d5~Fl?N;8CX
zcX#7^qpoMK^{m+I*}r|f$Ns~^fk8x%`?~MzI=|=nIWypw;UBW9av>o6Q>y4}n0VNH
zX&*$M*Q7b?(y`XtoR=tC)ntv=i~N!)YKw@OD|x!+glG7X+~f;FWv6A^GZ;C)V58ie
zXCfW6m~a}GJq-8<gGNmJRH@WA&(z$@d84>TNrF64ckuv&DFu3RDWkQGUxLSCNSu73
zpw~<Gnt~T!FyZt4RKHI*b^L@gXkN~niapJ!1Spt6_UMdT0;F<TGb+68f!ftxfG8i=
zzG)<Zu`2RHYvE#ZSdRnQc?Jjmp{3n_-BS4%V_(+Xo=RgjzKCVl{X)&Wpi(^+6)Z_L
zjOTnSIQY%3Xx?hMw#t`%P9bIQzJaDr4!Mv4h*#n4;$EFD2!K9hljW=>H%JdZt>gDH
zRe8)<{sKXEV~>%3rPi{=6N>f>7WBs`TFRe#6?q3}ykxiWWC(-an<7hSzTYAiL01*f
z$|OE4;)1B*PEi@J27cg&jy-h)*;L#)!uD@Xu5(^Ud5ZipyObB)=t)x5J4>c;nP01x
z*3(Sdp5mK)6GpN~vmNCvhi_NZtr)#56Kme_gFl3F61$vhz85F$TcRcG=jG)mbF;7F
zCZ*Zr6bs|Yd5CEj+PE0@aJjX$D|%Tj8>oEc$<<B5+3k0f;MK_p_rvs0IS3ElfW9@E
zkCQQWI92`zazeYlHy>cv+Coq8Nc5F`3ZctqXOR&pj^H_Sr!UCcJ`qo3N^o&DTyDK$
z$ON<gsb9359U6d~jGL<Io;P0Tf^L(i1RmP#9;Kv?h~#ay(Ku$!1_sLs%KKY{g=f6J
z=0_c3VwX~>2Qk8IojWTXlOS#C6*thVTovkEFEL&M+FftPQt--JRg9O6mt+H%NdAA!
z)W4d`VNy^kway%S6(wZ!`pc(QAYZk2r{cjjU+@e~q;rGZ&W0S>sazvQ)Df1BD?hHS
zwY7i>DbN<v*C+=!Gf!S#sX+>NnIB0zj6@g0hjS@`N)j5*R{+d9ZIo)sxTOC9d{p&d
zpaC&KZ`ty=rL+y5afnw_^G?Z!B_|QjI47nGy2^L+dOuK~$X~W~9!X7ylR}pnZyb4P
zaKquO{socVdX<D@T~r`LiZ(W9!BZBMqV#`t1)mqW^KTD5@QP<w%kfh2dIAuDhhA0Q
z&vtfIEKf>H7cb6P1!|0J0%*Ff*44F`H|3e3V!)UFw8D?|h04o?-vPiM9^l^1OB3Jn
zZvsS6hu?^x89znP1EA;k-qR$tc1*9;E$-Y`h)0kCpaSjEbO`X#3i$rd?XLbNeD<%O
zl~qE#mzUjgsv$$8-F9}9lw4&h5{Q5a2(&F!$w+UR1iIg%R-0g}DM@g|z?s)>ykAK3
zd8+UYbDkjeI>z$~uCJ7({vCxu<5f2n4eg}KC0fsyt5S=s=B!1?wses*yk=}O>K49p
z@-}6Lc8La(*vx(?pD>$d4}9YKN&NLWronF@?Q0R_=yxsN>Fawg%dPFUVVtj_$@aS|
zVZSbvU;75aHP`!k7&#>YW5J=-=ku4G!!NQ+1c3!wuEE`-lu=d>vWtuREi#G|z3_rV
zLLwtvZ$!9IQ*K6Q>EF(H1lc@J&Jtys?B97$Ih;Pmt$1LgXJ9(A>!FsJZ1(noeY-1r
zhS$wS!=iAfHrTYBnh3hE(h|AEgI3G?rB~dA7p9!c;TpDff+s>7OG(=mqO2AHs3MV{
z{u>Yq=<nWFtqFuYzNAwl`WA<4u1J2hlmdb4=u#LkjHW^c#Yq(sv)ZHyI&UaOvozJG
zmU~c4NJ2PgvehdQehnj2+N~6PBfr$igBEc_RKT;FHv%C;yfdPJlt5FV&MOJ2I_7Rg
z*h-=`i=CAU05+57`O`sC8Itdza5eo8uYgGp2)zubS+9&bGL$f_G<3RRX3KF@Xf~rU
zAID&=U)Eu0`wc`!F&=@ys=}2PXy0v#0ZMgyy++%u5=zn_34O_WRwf)q7Y&1Y2de|i
z!{aXLE?se%6DuV!3xt-8osbtEED_HK?urHnLvYtjdd|SpMx!%AuX%-aY-Ro5#=N#A
z=-Kp^c<4+Y5*{5Ux89XnKKPn6u3_|R;gB{q>I!>RW6SA`;v_d3ngF=ji8unVaIXWm
zCufc+;Pyn77K8h#wY3$pN8hV>y<S`(&+%et_}Iy_##%93iH?~<W;ml#HR`xJxP;>y
zr~~F4+(a2$8PVX_D{g`Xc`IW-OyaB{K;uflBgbRo4I>C*_05n{j(adZywaD3%dL?4
zoo9V{EBLRV=70Qp45&Hh6(#7>tXJsaTR%V<rvh0;*2r%3NI!r>tx7{`zakeMJ+;=G
zq{)?wjT^L_G&Yz_v90|v;hqJtdVKUXnBQA7b+|e!$T9iN6ngEoZtB>A^hwi_Oq5ay
z%+33KF&u|}k3Pg#B&m+(V^v1ZpU6xJ`|P43lv`(mDcA4#ZVZa+6`1+IJmmJ68$&qW
zaP$kI6(R-WPs&{*Pt2fIt?ug+<())rKt2{3#}$#wBnhYP$DNm-Aob3!zHn&{PBqsY
zuM3ne0IJJ>cZVp~U;|VH@mS#}c?HPEjvAA2Q6v94Z7T>FLt<Exvd>^ik?qK0U<fTn
zMR7nqqe+U44<5f9-^Zk}6n<a39$M@!8(p10j_X-Ig%OQq$JZ2<AA8lEMk=$&(@sLl
zh)!8n^bU5HszkT$m^+6z3dX(48}v~0IOSmoh4zOKC!!tO+R9-`H5ok>x0bWbV!l^V
z>>9oNC|dbmHq&L1^?#J_|MwM)2FP{SSAaEUwpVswRSV~%f<Gj%ZrGjE4@ta{u%!Q~
z$6be<5+<Iy+G4rtqIa|4^E1L&7Zw+Cy?3CUfrkFUSkwfdAxHd9Lq^wmU_&IO1YZcZ
z+F9#jgA(yr=Fl-#AUVz{_eayjLrtWrd#z+M5tf68Xpb!zFX3kt7#>2tLMq_|M_y02
z@uy2r^gI?V@eI_A`iaKji?wr8Q<Qs;T{!%vhuJ;pwZ*e!S?+6@!9T<rgXzI<h)aat
zM!`YHa$=hDBvLL&(;h-hz0q%==MUI+Ob-lhB{MDBIAF8G)k(>*S-pqHbtV-u$T~(n
zT<jNssbhm)8?DJft{D>*lar-~i-_LV!No3@w6j)yFY9Y!y}`yOB(-jgw%E)7HADW9
ztymW-#Lkle5Qb-1i&B(RI))>u&H2*x6Q>B<qu>Buo|VHiJwPqU=(pTTW9xy&FEYbT
zwk`SRZZ%4%_kJ&#){TxA$1jqI_JD=>>qh_ICA5G3F?#0KW{A~ZFfVE$Xi}l?nk9_&
zLjxz<)w*U0Ic$0&x%-+0rj%r_{c8N4yU7d~CJCNA%oM*G@eB+Wz1IqqJDH+Gm~?wz
z6kR)q-raj;61%M~NNyJmCV%k_go6?OW{OaAE#p-*JVOz(x~&_&H`=<JJvEKB+8b98
zyM7*b!Bnu{dmL%brzU8zHt5t-$j?<g1YIHAr>Ud9(P?&MS6^Q9s)R2dR*qpq)v-o;
zJ;koAcFz0ia?9;1%p!KtM}4_#5H}W>X7r2v+|pOFydMlJVA7qwA}Xz2E-fADDx6fs
zSu<MXdJSq%^-QfBZ{*}$Z{Ef~5@Q6jjbVa(!XqNy*}5iQN#wjUmV2O5R_(Sv*mj(5
zoikV@BPI?#v8&h-l|_2SnK`~_3fpYBAW=_|znTl%=J{M2L6`riw%C#2TJoFk3Zd=E
z-_=jxmcEvQ1WO)hxu4eXxfWVSWN?~JKA2RiNnNYFe1!V+|9;5w{}3bl-*)W(>G#t~
zdFe@Ko=h)h!+nbRx|u2dsu`NLZ*cSU&nEI*N>bK#ctQnuTi~OBx|?)gzQCW%*imPk
zTXm6|hfVN|qC!I#A12Tgt$WK78T#ig!lyyS?&8x{R~{8l(E9KKTWcAc1-x|u0UrN4
zI;VME0dU>wq6p*m&7aH3v*Xq5(;^0pMUba<Vw4ZuMmGo%P`9dbDs`a6sWvpf3yD{0
zUJ!h$`z2*p^!24kJ3#A)beGIWJy^1@!KzIqS8gtlqQD7)dWu70$E28mFfSDt$<=QK
zfU1^}oSB!Ps;>1*P!&i3Jt$Y)X2vGQhI7)D9X{+H{unb(p^kYi7U{TeHQ?{4nk-mR
z;VUfK#GQvsj}3Pf7-e~Zfu*KRG`6F~xWmIwtZhLW!-7iR#J-RpaNtJ*5FIIHwc_rN
zdv1s&M>3HcfR?ZI4TP=Dmu5nVd~3nnZg-VM3ey^$K!CM>3$2c~rGGH){_q&%K~y`&
za#H@2d37WGsW4Y!9r#hO<TlF#TDHQV!K3$Avqx`@kz;~d{WcdZg$umNK1{~O{GjG6
zq81Se;Ihx;danf|HmaFcs)xRGw<QV#hS}<C{QxT8&GcFSURr7H{9Bjc!kcaSU~*hr
zm!~M+_90=Q^6L0`j)Ov@5|Y+jvHYTB4Y+upzxbbB!I~#@fe!32x8b^A^&R8#=(PZP
z?$Ux}0SqE6Iq)SUIXo73Ehxr78iI1veJ*ZaO}mxUg)qK@@Zeb<VKZ;qG^W4^<I0Xu
zhugGJw9ak0qKgK&6QM8nJqF58x0q~BgKb5O9h$|!ti7*~<ym{SM*tu`Y$(?*OB)hs
zbB|W8)u#owDiD1&%odj0ml1fux)5hv(s>cQDUm`g?yk2*#wZ$}tCy}fHGg<NEw1S%
zE%mO&*^O&yt(o8=)(m_$Z;^-MqAW=CkGsteS@3O!obFF(Lk{iQA>TvvZ@!1<(G+^s
zRgi+^!bD5OdYsEi%3RS)x<BeF0k(GgJ2gX#S&aVm+o(!o^cB9RSUY(PGYeQOpj-Lq
z_7wR2Qvk-?re85b)4rM}83<#Dt2HR)#R(3)I6+GEtT|X=7RIJM-AZa$)ik_`XBbXY
zU-yYLYLg#R?jcPVs1D+w-M7yQ#4s%FSL1;gMiZ4G1N~IkOCth8tn#6u2ZSU*68vTI
z)d%Nl`aloK(=wx5T3C`TXV{ri`wFaS@K6u^W2WJ?b2|By3EQk0u5xAFKH;H8ApfMk
zdX54}g`7l3GEaLB<&@T44c&Y7#CD-eHUR?6mQDm!@{e4HgtQ0l$wikv&*{2EE%_$h
zyPOVcB>4Y@LU*as{q--^4gYBiC5^_2x;c#(W|TW~<WnlT2v05-@>$_i^k9S>P?~`0
zXrfwpw<S3(pDR1N_w4q<7ksV8`+0GxLicv{;-6zfpx!_RKHXl(n_l&0d0?PB1Az1)
zA|C=g*AMxf47nbyG~D3@86}#4XG6Fb%JBcH3WhbKJ_dWU+RRbQeNqo-H<iwCS3Dn?
z3wPQU6-N!~+4O5Wmv_tL$F|p<IDJ)B9%edQbU@8<Sc}!$3ty$4!{lv|Vd!LSXDw)*
zD-fcNWzJ$Q%Y3Rn*r=Rq`~#-F48XJlYi<v0Oyr&v|4AHrBgb6_0n0wHq8?_d8_j2j
zP6$Uqr69#)#?YCEpb#X>a2{@uy$x~N*4m-G$<9sYtMWu~BB3t^LtXD@4^)!b5hUHo
zO4Au#IZ=jHEqZ%zhujmIWu`wH$C3m^1<eD8;lX`&qN&adU6~h)o0tH_%co2pn?j&<
zraZi4iIy{k@=Mcu^U%JX@%tDZ-Q91J#Oh8*E8y}V)yil9;fKG|UNAa$;(oE4GBU$8
z*{r>FVN|61S?i<)AP)$bv+8MY9b}}gxwYQ6xPzzmlxFJ-fwf8twYMZTHuX$CYpit)
ze>?AUC#7uM&x?NLJHUP?{nH<&h5ux$Qv?xxZ%%o>GHO=5d20;4%`czcuD!&d?oeQs
zIcNoLMc@pkhktEC!d3%z(NhYvs{6#W@kH5#JvVFvgO)P_?6h~>KW}^k$!+$`B11yK
zZg)A%4)n5zIr(?WqTW06?VNP()5v}U<rg}mI$&izJ6t$l69Fy-;p1c;=j@Zf;M~2p
zQiU~`PY(F<CabHSkMj<anL@&&vTuYzZTaSc79qc(?y&uVy3?ors!zMr!D`dNYkp^_
zf+vi?VI-M-@-%x|x2EIVehvBIk0QD09}AD;#cjqX7T+7gXexE@e%hvsv6_9QD-rs{
zdPVi)P4znWh!qi4U3u}@#4B37Z?lg?6$<iope>de>E&@U6$+Bqx+ir%KGe0Vg_!Vm
zsv-jS#~(ke)=J`=PP^sf+$N&^&LmKGHfrO3Ga>Kb=Ns9XxAaciy;6Y5pGopoRKxf*
zP25gR;QUz)J0zr>wX(<y*E#PAkn?SDjil}-z|WrIuub<ypnc-O&L*<a-uzXsipgda
zFHT?nu2<~~NnPqyL2opmKipip*$ZY8G*`QamA}j1!YS<wk-?Wn>yiK2vk2IA0lSo6
zL-@Zs0Y7Xl`XY-2{1?)0FAK_zH}9<C5<DC&B;p~M_N!g(a^^SMCJ3F5zY|<{Flk<D
z2}QWSPvS|xLAg%e?3!HZi__%LfZL~(b8L82BYv{JV6EJ8PpYpW&xK=@Q!RgQ;FxsX
zoq;yq0&u{ESW?LqL~4C04qqsH<BtI<y(IyOU2>*3qO>fVB|3qbUQiVass=f2zT#VE
zW^*wyY;DEmx;pDCSxa5@(+#-u(+wzanZ@^3ejr2iF7Ymh^2xrJXs_ojYO+Fj)@%39
z7u8?(fGmE+x_-8x$9h+i8~%7mCw_-)8I7yoxx_QU8!8|2l*e=i7wuEiFU!=&z3Ro%
zoKwdh&$Rl7rB-HUnc%day*b|r(~8keE~SFn#mykGRz&EoSwE}<_{@w>5m#CjA`43n
zZE+*}skdb9c#EbdiOnZyqxs(2FW<1}MnCJV`DNZiu7`)qW}-s4lGRKHcGm8dFnmGS
zv0I&`hPV0Bb91MvTHg7BwT-;+skjX-uuUfU_hab)!H@sC?NN@~)=_#bUYbiz(NPki
zbwRe3oIN99wYH@EFc3B-4H(%dnq3(8rqDw|W-3A%Y7^7~+4Kh?W{zpFd#4=t$?XzZ
z4evbenX;+tn%20udlWC+ng8|3{3hx}ucOPGr?+%Uao<^c+x0}%*3qz{!myHQ?#(h;
zZ6IF*<CFdVZIk$cCMi_=Z0Cg4v~JRcUS!S9x6|^0HjnS*OpZ{NozIzk89N%|Qn@<v
zrui{(R6yODfETgzH<0EKUL;%dmo^{0+hZ|f2nK?2Etang{vt77WZ9xRE-ORwxq$@u
zb6_+lEXz}Xd?RghpsdCy#8HjRDyF&z99TaSjwo*&=mr}BtI}mL=eKJUc4XJ685d|d
z;=$qZc8f7Innx0?3+L>ZoPinRdC4KbLx0E|haKqPk$&tw)AfwR+U0ygQW!f=hKThw
zkP*5>B+E=(`jL;R9X?qnp63V;AL=2YRi4nA*AStfop-}EcfceYQXqj=(Ku|3D?C`R
z+vS}2NBM`)kdbz3&4Ab=LPJOX7Vpt&1!twi0|sVBYTRBcf@Rn9^6qJ&s*-iz6Y+NM
z6{#1m<^%{p6fKt-HkPWFtT3_FGo)9XS9fdYvwtCy^-LBW7JFvzX63CT{wUMkexIkB
z;ArA%mi_LZ&$WMMZ6NSgfJ18hCK&{Bc!2IW5RxtE5Yv_6hMyF|&fC#hbi+039NShN
zWT&GN?pxhv1uzG#QhV1%@jml++T8uJXigx3->r!FI1`_B)MiiwZ>W!D1xkYP`<h$U
zd8Xfl_L<Pz3bZjqCQ_?CtN#dld;QqGyauSc+9_MCgnc}=&VJjyhD^~D-!+XkP2ddR
zrz340DvwZT&(s8?@w^P@6APi9^#@bay`gLys#N=6e(+gi-M6`(mtIrjR?tnR5~Dmh
zIh!@^$To0oYN~Twdz-8+Fjzz)=jU`FlnW}XA}$=KoZ|UsdY8=)9ge@<A5xysy>ehD
zbJgg6tHHxm6m1otU{lIN3kF?*5(ofTgk+zY_e5qL2^>}Ta4qJ#hfQqd9BHK;Ya#Xu
zgqkxS@`9WLNq>aN)@)Vkp|%InlWeDX)!8PyLj~gJ-*u(X%&hOa()zEu5}|^`Q)Sld
z9(OY*LxfDmigjLY`j_{b6VqJ^Xx=x<MzBcs1V({}U7F1_zK~9UTQ}y)HJdvC7j@Xq
z;Ld9~e*BI}F2!0CghgYR{Ym~uWT4ZI8&G6+44X6DA2yieV7Ems=v~`irAtnk5D@%}
zOj)nof08M4=az!Bk=zA9=A<{UWQc1)P7f^cM^$-{OPA%0?(7dLF3TD9OzA<`ic+=c
zE3OfO2}|phOeUF{8H*vj==wDLEe1H_4)lNz-E)!N7Aojh*ndf%ofu&i#v<)mW3ZSJ
z;x}MOdS^UG&gOh@*oBtY6d1~GLogxZbwnpxx;r0|1Z%-To-b}8FJ$Hsj-irk5bo*Q
zX*$fBgK92(gL(Lszoc8JF=K<V!QB|Xl~=5JH_6OTI&P1c4NlbF6)z~F)xHHC!%zEw
zDF%x2Ly>m(Dk+gN)0qI*O8)A~NsJ5{PW#A!`|idGkdbNE1N^D1(Hp;&r1|ZwNLE~R
zYKGBUTo8s>U$!A%37JZj4m}MkLX7r1UnCJf*%r_{5@&?5E18*~IL0ET=$XGnm328A
zMzsO%r#nH*0k<;Rp4v$OdKF@R&ZfUE&qOhJE-tqFOa{5QpgmyUK7MCA*MZfHeUW<I
zrr#*UuP4N>bv6j06B|F9Ra2lPzfBsVIgjX27y}c%7lBhJi@cyVGV$}q6gjN>v_k21
z5bl?kqF91{UsI}3TWkkl5!1OvjG--uj>Du34AmwYM65Wn&o1<AdBXUV^*A^nRT&3*
zKo)EFn9oL8X(34Rj&mk7O!-+}7?*Mw4#Ve6wVN%eN&CQX_cwmazk3bvES>7qMiOry
zDnvfWrRR{HA0(BtDKTX<qG`bP8A{x~Yzgn1&&=!i4io8CRn;3DpM-;7{c&@YAJ{<Y
z6&RvM%U5dTh&GF|kaS5$`{We4^Kte(Co=Im^q!TwJYp#}-|XU=PufHte8mY@q;Kle
zG*0tCeOT>o;uRj}whXwL?(ZxfFt2fgZ=f205ABsQzhdhNgkH;00NwW+=osKl(O_lF
zj4rQhw)`Twm&E2<^St2L$rtxx`(hWKj-E^)s0J1%?N-cL5$YUU%XpMTYHmI`1i<Vs
zua%#0U*OP?=l5`1<sv%U;-1#}-N*%X9W=&Y-bH!i2)Te;H_+&3fh$i_DO*r(%aJD+
znq<18tfn_KyWqH<y5!0H1UN50ooH8SxW8OtYpjideJCF$XV*aMB6^p4M=&(B>#YZG
z(jGg02YXR(1wgR%6<~-|$<EE+_8KYN&OFK-I#oq2T(#}Ih{2k<dUp}reBW=#TMmoW
z(_H0((@|%zdmc59h-_=qySC-FwKiE<MK#&Gy4V9ms~eQIOcMrWfH9yRM}biex;SM@
z;gf4zRB6qUvw3KcME&QbC(XGOy^aZ!8=fJ{?_VQc$)emWi(v!83YU|*(to^(0&L#h
zf9wLjnpbzmo8j!p0PtpGFL|>W8r9!<vq0a6t=;;UsJ`Niz$E3lLK(+{i^>vk_Doi<
zIj4p&e4yrt)=K_9dV?oTf2Fu%5719J?8g}52ngUtDcwHshXUB7Rn!+0Tm9-`B->bd
zSd>ztvwe3O&<pAI-w3R5L2+1M_ZyShDhHowNg4tS#i(0sxln+i=%`LWzDVQU+KPUs
zY-Dr<_5O^>X&l++iQM8kApI;jL&xS7Bibe7C2qU`81MD^_m`hVsaC)OUQ53lA-OAT
zO@bD+I^?s&$`QmGYZpBUjJ`(Y67PvWN&rj@Pk^n;-`C6h<0bcZ%kh8lJ)kn^PRwn8
zN+})RRQk4O&LDz?@0CF+KP!XuB}-$#mS|K;^q;`gTY|fhLF>l-?)SEK?iuz)ojz6<
zt*}|xaJK~GO<DY6i1`oz95~VX<5eq#7v&t^8sFd3DrjwbzJ(Aq2-NLE80YW1F(hsw
z8r<Hth9163DjWxs#>a%USz{}e8jxkRErz`T=i*DWXma=%^M?Df-Jlu5+K%u^es?x`
zKeEhw+?(*jOlb=75kh&JsrmfTi$~nW6Sq~F=x;=%C%ZrrlWkBz4cW1LNf^_9p*58k
zoN><>V*8s!&B9|&#oSqkj#H+z2Y6Y>RoC+zsNyY6tbS)KTS~1QmTDWXDEJy;h>=EW
z<QsH19asW?JVGb|eRFqy-#3@}6k0p5XJTeHb7~<YuOr&*7-jwx>Sg0Xj9Kb8M}K0~
zHsWdcHLAj!>Z3E${3k(#zhziKCfU7Lv$vhQTuGYcuqLbt!L`&wRH`qm^7f8Hipi8l
zrPa)wjqXaWhJ=j~eyO<0q^w=)-?=!nxw?DWEj*PWwQFG9J|Wa}RxT=^U~JA>dNI*k
z`IIbfrnNIRU1R}aMmAY*c-RWIe7GbW&_iHzCN>RQXVP6@FBy?CoYxz@4x~iz;8#a%
zZTu$bi9`C88+d75<r74M_H{%#d6o@{;TamXGTkOi2cB<_sn1ECYPXpF*?-5sJ_p#w
zUjv3^EE<+BtvEX85A{fl&<<ycx@LLaJ|1VM`uBPrevO*deYk{2doQEOnf(?bq&7oL
zgd|CO<q7ZQxtP&z?rrXXVb7-Jbh}s+JmOY+FZGhQ)7@7mR<FNpy9A;BK-z6rShc4B
z?SEpCzGAlvQH|yDfwy+t+4T!1{YOTMMvU9tYYR>73iY?w8_+|Bgl6!a6oxi67Zpp*
z2xb(y<m0XjOp|?@a!a&}>NFm#QTHdi=qkD}scA2nIqUGuf<Q|Vh@ISOD;Ljetpy)+
z$5!|YbS8h<)&4S?GzvIu9ns&BY6h`}mM}Y&O_G1e_<^*%_1o>|zvM_jg9}jpJ(AFv
z<ORMS)QN9`BYy}|Ay4_W$(FFSJo?&vH_maH5S08%Lx^F>bg0SCgxq%yMeGj_#qSex
zb~61)`|P4JRGx8hl2;I4GgPdO2B(#p7T?jsSVc82?-XD^e9y-X;wsbek?tTb19Hbe
zK#nJgbS(HBy=iwAASBZ~E!Wk`)K7{(-X;DF$Z=It5Hxkq?=+wmyh9jCvC?c?d5QJ5
zR1ALIiU7n2Z)%oa`TNCUl^{GMuTp+i0bDJH_gGZa7*7FvtI5t#Ih6DtTrPl)U-Xwc
zzJ2OxgXeVud)xAj!kl;7V~;OFZ&Je*OqfcwuS+i83Z&mdHGnx>s?`s@QdiHlXLCbB
znAVo_Tn==Eb=wz_MjcgT^~B>}lVsG&gC+V}q&Ac{;_j-unALfLHoKewClbY(n!)r@
zXo|1J0e=Tm|3;c>viuurPV%ci)0lCCMO89drNrhX@Uimqo)+9nkmH9b6LbOUnSzfO
z1(ceA2X*2bXiG%%INn3fVUmx1+>7PN)5CZd)ta!f;8qcsykTaNbg>5{EiJj*ApH-X
zYKInYbc->@TnZBbzdh9c`WlG5bR0MVwSzl#f+jB_!Ky$L7(?>Q{s&632>UxxswNgz
zGr|nIDgb#<_8@g~hqM3}J{5Dif<+F(>ADKi$J^CN=zfV@vq-DXZ_db&4rOz4{Mhjx
z4LrdeO-~>;WqUsYmY6F~xLO|I<60tU(ExpXWt+&o>|r-SRSWZ&NeC@0_t`DAUmn#Y
zOfF6?BI9cTA#Orl&1&N}LR^77?omFJAC3&zzkS2Y5v|CbFupz!Qvkz)4SRh4HE-8%
z@IO!h|5NiD{7-7;O@Mh9UPZgQzfx`7+w#cnKuNm*FrorV+@j%4AZcn?_}7;0zdY8S
z@I`s#>ITbljOTIS#*W}zmhoDHP7djv@}dBXdu(*%q;ucmn$0$&tF8MG8Lo0<1c3q(
zcT|||RV6<aUL;w!)3XQbw+GqjWN7q@4a>DZC@qL$9$}Y&7X`4&2WcM+@j6*?)NF}(
z*(_FSukz!u)EuVN*Bo=kCXMhW0G?Sv@J#s)*aW?HUVY%&;AY{K+^E3$aKkUNI4*fs
zjk?SOXJWSmV@3;wN^;9-KHsBgCVNlMO#v1VhTRNGD9w_!1(+ki!2YZ~%?FS_SVUY7
zJ%n$zxw>xvSH@qn^f9Y`*os#HTk*v2ZN*=iU)k#sYgLM{muSgK<}nOdJOj5r?f59N
zef)6Ab;@E@n~AhnhFDN0&iTO2OBV)&UkH+%y7u5BGSF&|%A}#lUgxNKr}76dC%i~=
zO0Bt!{VV|EV{!ayTFz!HB=L$hEa|eDDG*3-kIHAt7kFYsej0;=>;iuEVI9d69Oc}P
zr{CH@7J}Y1B{trgvxekL(rlxsUh^XIGqjH6x(m+fmM#tq*H;Y+^UBiB+F-lkE6Am=
zJ3+mJg|aeFO26Y;z^54jDy10f26fF)Yv-Jm`DiBWcBbc!_37r~azIZ!aEkf625KN3
zxm9$Kmt}Wnl;$oM(d1Y}Bt2t@ujH65x6dRfGI0Qf5X}GXT-8h>2b`<GrhQId%^=g6
z*Ptj206ROi1Cj^LXGz35kM|dXuiFt|$W&xqGlBV2<gy6aIGMkJ)+liJ`AJiTJ{$qB
z*p1ONV3i3&4;B@x5_V3WCoDYw+5Us>Es&S2`9OrzQ>UCWMK3nl1R!D%Z+UJA0~iS6
zBTpw!$yHuXN~UNY^&`Gc`?q8Yv=;Bi+7AoLcC1AV!=%Wk!u-NY6SU&zl4m4h&D1Me
z*EEt|w=pJ5F;_{58v?FYQIF+bpjCCLVfvoIQ0aFRgc~peVI_X|*X!y(z+L@?NBV#L
zdjl$SOjnv4ento<Z%6J=rOFjeH!#gzxDfRMnlTF-DDYSR21?BiDF%Z+F*ABkvh0TF
zF9t0)OtZ|0V5W{&5gjM0S9;*x*6m$6kWmGAwqbM)CpX_CCvuD5TK3V@LSE8w{AR4P
z_f{VN$gu9_q}jG?BiTvtU89oGQoJm3;4gVaL~f;zjlPl4wvFA$Tas@<SI^gOjDTh`
zmQoOr&Mt_ZF`kVje(rMSU9^*7+=cuea;cdW2(VD_-J}k^aQAdPJZF7+o1b4h%<aoO
z;e35kogCboloE7tdu3!zaisQUeY5z;Hq=STFC@TL(ApKPj((vu;cgz~QBcf$x2l>+
zRzUsJ`i9}2prDJA&0Rpq_>;QaKg%nB$EIsF^acDLo9^fn=@+&iEUwKWomlp6tz)In
z-?UU&3elT1=IRybZeS}HciY)Zkwt#^j?i>cJI#A42J8qN^wN<^>K)C$ESFS<{glDl
zGgcxva?_<N02!>+2&9kU>FE6^IgkqIk}vnj0MIav+W8yBp4o_xr(vANuj*IDcUz9N
z23(~!mpRX_QfH8k=^mLt2X{Gr_X&CCKefn|-v(pZN<v>?jbJk{d&|u>JCA0Yt#i;`
zD>e4DKkfbEui@NHzuT9e8<@ndn_WKO@ePC$<T@&M4rNG>U0xb$-~So_kWmOCem@sn
zwMXLMq-sr)j(a^@Uc|g9-myFFtsi+l9j-{gLx3{}lMY#_5c7iXd*HFo-0M;Ma5!u^
znW|Y6*`cW=|Ho4=zGKZ+(6R{C_0Cz=1z5lpany@yGje0kQ)_Hh3?mb47`2KFl1w5~
zOU7Vo)e)65r$RK=wyWLY7$Nl{A}#sK9>kaD&w#0e%f0UkwE+RBP3`#NTK~LF<4iJg
zxZxY<j#s*;ny2ZCyX>snxC$jo?)8IEW=qVNJW@Haark@NtIv<EvE{B(K$1w*gf&qg
zk25zM47U0|^~_~ZajrU5c)kFZaL3p`S;wqtTZ_T_!X)f9Zx5=teBtV2?%O=n^AEwJ
zNsZh6``8(F(W=oaUD0JzYaQ7N2wmzJLwl#*WlFkGY8tee-lBjBE%`SE;+){I@Gt@9
zdGrzxND9E_@ByW(KjP&rTdk$7Z4}t=DX=5!J~|96>vBgvNLfpA?Q{rbCw;=z#vHp9
z10jvT|60dD`v&9_;YuT|a>3iqv1+msJCVI1Fu(>SJCaYPd3zX_o_qlZf<j@6L2H~4
zR<jSI9>}^O<cAN6eP6#^`FBQibgvXfH%V)6I~71a3Q!cF_v;xXHI<8NEZpopxt|$u
zC&^($SQWU4J_5O5O+4VP%JBQUDgx;L>ZIm^?#M7;Jb5T{pBRX;%R1iF#n-wf_Ti|0
z@szJM4dU3k3N-eRp($^H4H9>_ThSx`tAp7@*j<H9xNHJxJaEE+;08LF%X3FY&Hm8A
zT;9D#Lsh?ZT+JG_4umojbkZm7?xjp}&ATul`YkD%Jmi~Y@N;5mNj~dPw!N{8<r6iF
z#(KstmFUwt%NPc=w$b*m=!6C~Y_``7A9K`*mM+XSKC2cTZ^%DN$<}gZt-0^jNPDk(
zU?4Yb)G!0<4(m02B1Q~9Ul0{Ae|Ccd%^~{0#zZ+wFn{4~h0xtz1QZfI5VwDHiIVwe
zoLbUe(`5Gk!u1I4nuD<Tot#*HugcI!*Sq6Mr7PTHczz*jLgHp}Im;rZLKLd+<tkmw
zp-USkTL-~2W{9}DxH}`p0y;cLFX0bKl6s35x@>xq!HfX8m*X#HD8=nf-$3S{D6N7l
zyoxMD^yAnjmlZ7O;bC@(h62LQ7*o$m7Si-)4w;Tb<K$zLCFc|x4XVl38HUef77wZ&
zJzxBg(#$(yOy5BMoN*fYs#K|=l4Y-M>hnv4MAj~XlI6JWYkL@~hAdUcS{;f)?Ry$g
zjdzx-O0;-al0N_otM&J*>u<r4Nz>gpndi?Xi#pBd=$@5CykcnZqB4Z@C1&l{X}b^f
zO5n4+ZmSS?aPzA3l$>icye0mDah^FJuz<mJEn6G57GG{Uyh&IwyN%i_taDo}$cNk<
z-HB?TUM!^`XEahxzn}*o@VKK#P|SpL6`57ymN@35dV#O*eu*Y1dcOu$>{n-i!#-$D
z{-b=&^CvbRfX+=jf4Vqk#wnvjRdKWRX$k3TdJAr66`r2YWv(gR*nF0p@}>B=YJN9=
zXGQjB$0fk=J{o7t(|C)H&bZs7{NwxsY%x`V9h)Ngzhr|yQCNPyhlX0B<*GpSvFgbE
zL=)6f-$DnaaWPp7wERNc0?vhQB`3{191^)!q421p4WV1A5rrN4rj^AO#JJt8#W?#C
z(ZCiVOWh;6-A;uq@#rxtdW0AazC#14Lz~8Ty?*cORF-dH(l7Vt03MmzO3qo!_^7;z
z^_ET@8*wJT1PiG_WMqWPlK5kt1m`YxrC<Eywx6e*r%{WtsoAtD&d}RlGl^IvpPC{{
zbCiEDu2pBnl)559lC+=89gM}@^4dWED^A-$De&_E{UleJ0+i&G>3G%$+{;h0&-|%j
znf=^P=d7L_2Jd-r4i6ucwE&81t1H^?G(u9|+`>aA0E58OEp+~M=26F(i8pvz_Re_3
zTPdB0!LZ+$%UdQ`xU%aQ>}av9ZK68ux19}t*;)~|nT5p@IUUcU*tvGf1JK!Or_j48
z0A8jTsf5mU()j*M*XQxL%bHJMpDl97=6%R-P5KVEn+!qbc6CxzFGn@q#{kz&BzO@S
zxp;2tuvZUVJx*!ZS>=pPe%^neOSbg_Mw^~BLt_*Z)gC1KX*5Q_=ml}gTPM7$x1cIw
zi*TS-BnzfR^zW@A5m(z<0L~MuU}+pv8)iFg`@UOEN-K)cH<W*!rLD_jQeM2!^ZU5w
z&H8W0HUIZt1Jymc1cUC61M`b_*5%JCyQC#1-#2STNPGb*tW|-aTu#}&>;jg7<sQEz
z4aUkY#|psue8$^fWQH-4-;U4-xlSYM#@y+9C0Whe#b8YThE}i4G+khxCbNf{j<_+C
zBoh_Jjq|U~%6<d2mNTVZq|WWC+a&opyM=sglkDjhFVRD=E{><Dlh3*Psz?JHrg<Ah
z%)9```Z29g)6Dk81`#9zX!!D4|9XMk5(-9AIK%3%YY!hiYO~~Ew3?793vmm0*iNLe
z^-zHB9-bs5VOJQY)n8QM!<X&C-i{o{v(B!?HV?zHzVFj%@>Kh4qJ#FMc~^0JO@<Qe
zScQ6iUKiO-=4`La=}E}ml|S2y{x_e)1{Uov@cMP?4|S0}Q(4r$goZ$kX3#n>l~ulT
zb6XLq$~DqGb*(oK6+zup&2pZG{ctC1*6`G#3|+wQSYes+5xhE`HKcnoaA{oQ%^EPj
zz$^2U_mGEH_^I_pIzbN3AcnYddyuT-ayxGx8|_@(-Xhrg%{`svI6^CHlDzrvU1C$=
zNNYm#)wu8I?D(|7sldkriM{|j+dW?WbF2OOVZM6uFdL|DNqK38Zex<MLbzHUk#^c;
zqISdof@Lw>9<Z*huF{=hOfBV3-f-4Z>M;y*OAmwH`#i5RS`$wa4+^18Ls9@)u}%Xu
zUTLKa4vp;l#WCg%Y2C8p0P$TlHu(LD>s%*oj4^MUB6@zvZ6lxna@wwNmO0TziTsOI
zEX$e$3p7!CVJ%Me`H(o!|AW0!K3*C36dGH6k0N4xJc|0s6|n~WMJg>uYwj*qb1F_e
z=VzT94nl9euA86w$jE5CE>Rh8AVbHdk`uewqLMt$MsM`I*I#t>zNEtRS-$rIm6mg(
zjl_=slmp~@<R@fE?{mgu&92R3HJ}lMwdS$U3~WZ{Q+upvC-7iQ&z;Q9-{+%K?5X5{
z*QGux&&vy`HII6?lL}VEdkPn0z{Yb6@l~EFv-m5ABumm|6Y@t6m2@}unyHg2pbA-1
z(S36Qs6qz9wVX`GbATf9A9mdSw1*OFYImDhM~%n>cXr1%;uwQSKVR??usyqA=-r=J
zcQ-bgGzV($ZfS94aa`55QsAluL9HdxK_&?^rny<qm}SI2deCNXoI8QDr_F{6Gty%_
zO^3QmV!J;I)(|=00op4=0p*@pweMkTRpG6EL!o?<M6|+PxS(A!Yjo~^i-(G58uR+<
zx>k9-B2|?9xX`$TiO0#V#|W;zttDs=gGqh2MgkorhXqM0jRrZ{d4SV~NAqm<q-8?_
zU);j^SLU|npD?!*?C0gQ3jq0$<x?)Hpv8kri@;zHL^x}8h`R})DRuk)npsdJi3x?!
zTXJf<)upRV*I#~=0c_L`ERUiuFE6`0-;?3H>aX(_fMmFI_|ImU?|o!|BpgD-!)nUx
z@6L{6$Fh3z^`#HF!hzJS7Ut91D>lBi61U`V7AmD?*ku~kU?N!}=kYh1Ka&2m-ors{
z0(mLM(t+E0_t$FFPB^QmS#M~OW?;6{Ex>ldfiAMS&gSi#aqqNpXo-u)Jxd9*$KG)?
z-fRowYkerzl1G5k&D*9k28<qe$Gh2ftNEo^V-0<L;4Vv;kHrmDD}S_VPYxw7%HpvL
zvbVvQD_l!<*XIg#t^-fo*FC>#um8#Ke{GMhAm<$?YqFuTBCU^gO*6PXU@?n(bp-1<
z#bONYS7s{igekyVA`stq=oGFD%sU4WcNnncDi%j%%-Dg$Fz?)+Am@!ExkKn{%V{|K
zV;T48szRaJT8q+W0!oQa43{0Fi!i+g&)fZ#LXN0qyR|>Sq8z5ShF-Hr=FEpb8f?Xq
zL@>RWd-3^MZkrsJwKX;_+UbC0jNnM0qeseR-wiSgj?}`>aOk9404BuJI>IVLZqz!Y
zX}PB50D6ypz=8=t@5$h0TN8e1@Cyl<+SVB8yemx@E8VgFa#oSW+DZN+?%mu@;s(mF
zTy&k=O)vz4(9Q8enYEwr&HkLBx3y%~JwRT&G~}zm9)-Ak6k;H#z~`^$9?|eJb1t4P
z9A(c_>^HDnWI)FW5ugy3p8*Mdw97U1B)=S(%hDdIG_bCy*-R^tpdU&l6WFyAfa$m(
zwt}JiT^Sy{^Lw3ui>Yk99B?t|V}opTAcY^?b<Zm7b&<$aRL9H$GU$jC$H|L$PtRmv
zb*@A(7uG`Ta;2fZ2RP%uZl<S~xrbpe+(JLCCIDWA4>Ujh84CwC(R(@si9jx#5>gmb
zap;M3y3|?z^IZ6qU;7y}FZ&ttL`+8k=oN-N1HH8~uUwE#RB*YY(HHIn8+f^ijaAl>
zTjPuXM9k_u{$ox1IpPH<OhTyIOv#%^vW+@wT-*@$y)#60##wcyDf-vW5SoT}$KDj^
z!UgK271P}$=9*X9N#C|Gr4R2~n8<ERMTSXO3SZVUu;%k-siLmu0QC%3yE<OjE7lO+
z7ot`EPI_MszJW^g<Ym?1Tp#k*)Q_B+PHR3NENQlL-5#9L+jDts%M}_DFb@od>s%w-
zVVbmv_Z^>Cij}l(GBR*|5dks72&kw6tev}gW3(S+<vHZI<<?Az-hn-)lFO+|tQ!8_
za5(Og9bX8X7?XU&?I{UgI(R%Mw!^z-rB70!t3$_eJ<U;Ww*N{x5nA19(1fg2Lo%_t
zR)gxS>VPAB#DAnb-Dn+CRYaI78E5?PZG>Rfw3hZh9h+Nq^(AA%dZ0yIX1Et%j}+_8
zxN&ypKi7?$swiVmuN*SbA(Rgdis!tZ6XqCO54Bd`USEgfWFa9cW(X~hsJcN}1nWHw
ztBeNi4qR`j%U7QJJIU{EltgMD6lCkc)G{}fOJTvj@13rLK=vR!kVsOS@QOeGt55(k
zp}GrLvuck$*4|7rYh*o3`UV2{BY-U9zPI)l0Ft-=Qvk`oW{H0rbNIUm#Q*d?B_R2{
z@cZO*nziM~=NLC=pH)$IuUV#6QB$4bs2B(&2zdBC+#-aATvFZn_#8Vw9#zi>30*T-
zkhxO4zzXN;sKiSu9fdpT>(68iRnu!MtELPmV;2XFV2;R6#)Tx>`5Uy=Drl5JwtI#$
z@U9@}%!1=s)(=wJ5!n#4g}llnHVl`^T@U}2lat$>fxdfsS2aa4W~nONvSOT?OalXq
z4GzWVTU~T<Kt_uUk^VC&uS$kiiW7*6V-U~^(r34f^a<Nr>F8_eSW=$CSp~aWC_l&q
zduYU|qBdUNAJwr-jF4-leosD2eQyqLVA!40U`CW@wssd1P8oj(W%-8fv+ofm`B_e7
zSZ)giV=-&0%JKBtmdMIVHR^bOPtPGt(x56v&mzIC>qKUaGj4d_e8Nc}=+dIcQ>nxt
z!NRR3LCzw9apNnBwdw20lTF~Z`TvlQ{`qJ5-N7@VG7qKR7n)`iq=-0V)LRAplBFx5
z8<=<_5pNE6jE|Bqc%dt(*HklW)x`SP*U@CQ-LnOI!+#HCEvwQ4p<p}sv{Fr<EPVg5
zfFoSuibfR13~$|>PqT#eL(7=wt4*4Yehf`hZlbq_F>F`J7~J#q_Z1rbu_+*Sk+ro*
z#b^_`gp;AVUg2+`^@;3Fnf|TSFQhCrS<LH#ZSEp)SHvNh^Va7hMO4Eo>0-!6EIoy~
zS!@Sm=^Nuf0eY709|T91u%emM;0m<N<(r>PPt;d23uyZ0AEj^~an=f#b%SepIo{3+
zy|zHfZ9}|9DW$AC3Wygad_9dKuG@9n^;ooG^dIUH1S+8>6}OB#Mq(<TTwOO-C>WjR
z$J--J<T{pk>QjN?bJ|l(Xqmn4Ri~Ts;M$=BxPWFe?etnn+BXpCS-Oq=rA5y8-z{=+
zpEsC2{?q{S52TCV`pnU4fSozXq!~+bpG8$)Fd<L<9QNy4#;Gd=sHnuSBW8hIo9T1b
zCbZ10^mb!c60E+wx%uC9nJ8;I`7#I9v#T|t@*>lZ>%kZwC)`{yWf4(+Ly1?u(%Z&~
zaLDqEXc1y-6(^a|KV|Po;q7R=hY{O`3!dV94996BU9J-lW7BKs^+3iMuOgx#()lXp
zV0{shTz9&IL+H8i=7ZqaYMNfigL*Ftos7;dROp@FU;##sYo8d*s0u>7t#R0R2z0Av
zWhE3#_*8>$#%JKyy;vK1w$7AK9wztLRzPWpBKt%w^jT$?5FMpPUao%7qhGFjWZw7j
zreckd4%xZdB_&W7c3LM2D~Ua<SKEg1nZbKG+ikA58`@G6*KhZHUMkH_TD+!zuoBm_
zyHWLE2Wo$8*1yo<$q{-+#{pQ<gZ21qq5(fRbM=3+Rr~X=l@9>_>U#Qk_lN5#w64Ou
zD;NsUL~}oV8h9_OCpGf0unh8kw2*uf<2|}h7>JpinKw(+pA8~*qjF2Od3TrML3@^p
zNjM%@*IEe=%v_@AOqyHyyJUuXlLcL;9rp+hn)RbF7xtd5hpi9Hs~^CH<ku!~>qq!v
zb2^?_{*wRs#fHfW0f-!Xlu@5hQDlxiWHj|ukE4BPE}X!t@<T@4rib3w-5RG08n;52
zm%)+<?qmMf#(wGpgg2HCHg_5u@F?ZP>Zl|-N{_?8d~Kbpd^{ujSjR{!>n5vuj4G=n
znxr8v7hk69j>~G7puU<+=23l%CThB`(hehz>rsUTGPOI2nD!dDTa<&~A^0m#jthn0
zrXObx+ibu6?0Ht23|&0U+*QE+5(O_Ev2`VQ=@)@}m?V0j=l2ni97o6X@+N%id8Lu3
zPTQ{hTQytun)XLka=Jlxk!**L{+q-8e=87_hu&}Ik4)2CeSKb%Sv@m&XjSG%T5A;H
z`$Yo4k6!JxQ)puBOIJvfV*RB2gn~^Tgf=#0UVW{k*Ftf(*$F`IN_5AWSiEMA_8v2d
z(GBiqNF>TE-};<48pBRBzIQw+A0@zzYG6#$Q$3KGIo8rk7%d%!Fq_R_#_ra|$#7`A
zS&m~Pnz<1}O(bc&2xipRH%jbJlLhLuUdl-2%3_ser-6!Zu07$tzQ{C59a*vwIf*F=
zCUr=m(#DzlwABbpTgIKF_i>b^r+R2&Ej7Lq7Fd1NvIs)U`gt4U5vqCcbaej4it6W&
z0KQy~DulFw7PQ_I75Nq6zu?(5c0O`wHCNNA)kX^o0N1%`m3u@Tt}pZrb#=e(d{f>X
z%p0mXx>iE=T<AJqZbtd5)N2us)^*=I=JA`5=TNTfTVakhAf!H;4mqAwM^SFNOwnHo
zA4hGiqWofT5aUdl^zQbJ9K`AB<mPFL)#JgscEY<__(rkItQyC;sQpW9e(mc2#<S}G
zx9`EK*N{y6?}pJ!vO}8yU>IEjb{!-~UKf!bcIVl74Z95lHbpJ0J0UNpqvzX}V-|zf
z8m17MB7O3)G!v5?n?1XqU1A`Rs%WJoiNZ?}w7oO2=I?Xt{kqO64I<Z|g<C}-{3RFa
zsuh!EQY?aPZI&uhD)l?oV&r*3P1WE5cS$5hPVtD#i+@pb5bs*CK|`!Mgk&;!W!Ax$
z@_L+n$Gkf3(NK3d(99j_3WP>mQ9};v^12CN2Utm|X`M0#rb@T=T@c=Omk^<JM{3Zn
z30QVlc09RB&>BIC!^+faN^)cjr%+VaNsA%p5u_$%h!9&di&kFKQtM6fPYKHXTTSim
zK;;eFXP3cD>GH1V&K=&e@dqv=kIEg!ckR(3M*hp%9@>3HLV&y7vT!sWaJO4N?l+>o
z(G%iRHygATcAHmt46qU%#T}nr?78gJbww@Kx5u3#r@c4}c2MQUf~*y?Y7Nz_Z^V%r
zdEp<W8}T2ZUTK8Q#$Vr~V2x@M9v0Vk4z53m^^NFs{48T40(o2EG)WS#;4JJ)%L8cK
z5iBeQ3E@D^PujTsPt&5|y;GKKxJQbfM8Vl<8o_^KDEb@Y!{3Z&G)M0EO}|u{d7V)+
z;D~k6UTl#~!Sa<zlJK;OKq3u2VIr2+fsC(r132HuBG}!H1v#T!MDvThw#eS*?{Yze
zr>h?8m{AT~-kTG&%G!W?Gmn#q;Eup*m#fj>j(Gz1%M8=KVD<f6Rc40MNAotg*Tt|N
zU@VfK4r4RWN7w+~ylrR(l96lt!BdTf@H>6ueB!hu1lXwlM5Ea&pH_`^N$566CwF;|
z*%i<9-iHr-oN;KZkT_O4n+QEIt&$nZLw+zvxg;db9kNlxKM9k3H0~G{BxubgKne|F
zg)7=RMO6sB$EmZe)4=@m(p+AAk|?ur{PcnNiN`bJ{Eauw3}>|zcP*(Lw3Nl;u{O}i
zPt)ucDb{zQI!#~`xK*D}(*qBNq1oxbyzN`Sp!Y|IueK@R=*tVV2td^C{f;(lRY@|h
z<%=~Bp*EUj2wFSofSJ8gyVwC3%xC+%kj*T4g5yt??Z<k+{DCeu8Q=|%O1S{LE7Ba~
z2mfA&V~sc35-Is|b9ww>(zIp5f}fc)^qs>SMu5QBAig60+a1G5xw#1R5Wiz<Ybf+#
zr?C>jOxYB0{diW@WNS}^@q8!!n*gML4>d$5!)@UD`LB+ue=;2Z*Vh2GvOhd&Jb(10
zy<dj_)Snn$qDyu#Pq6dufuuHR^KPBp5JTjEBn`~f*+mYrDS7DTUQxqnJJ?hoU6r7X
z^0;|{%-?;k7YMoMmIJlS{6T1}{!VDDxd-9ya+_tq2niZ_s|6(3X-Df@<3`>+%U_A(
z&c+bpOQCn9U~ii}-}VK61O3ZD?S5&XX3LR&2=Q-QjB0CJq!Gvw93DbQ{31AXocs;M
zgxcK&58ljU*49ED-<;$Jz}IuXb5M&mF_@q;P7!z;C1YR7>J_*7A}6;#p8WDh(L1S$
zd{r3=X;ASwe!A>+2?G)U1FuOuVksiIGqX`b{WB>lF(XXZ__-1wPy`Gfr`_UpGqR}j
z)}~<4t4S)|1A1W&14Lh)-E&KWa-{x{#Hx!fC9xWA>U&*4`243NmVE2qC9&zi#nw6s
z0R~=xS*_YvK6D%l2y8=Jo+c^#(r+xRk@E9y?#X$gK|3o(Pj%`?ot>H#9^Xu6=!HDo
z;1|DTmEYBv=nq+2ju2QaMDMqA-SEp=x-Wh+*YsfhF5An9FJD)EuToIkYzV^y-<Z`y
zwhz<BEq2$=Wk1Z`Qq=9zT{{&%S94g%Gwu~9?fOR$_&=QUN&l2^E_HT9!Hf->DGwGx
z;yFXf^VsQ5VU16zbNsA}OJbxNIAt3W{kk0INLup})Xik=+ICth&V_0o2UYVum|t5)
zfDd$pbk^eD9&0!CxYK<wH@CDrSavo4C^Vt#M@jk&G@NM33~>aIj=5LQ#M4c2d!6|@
zFZ!u29+mj$YG0{6Hiwd2f7pda9|5(7VK*iNN~E}B!AjKTuXLhmiTSoR0Ln=ksk(hV
zEtAG;wA(ArDz^GL?E9Q}BIQdpUCOTe-ha)BAwTEDVOUsFi|<JBNz@oDDhhg}n2bn)
z5)jwe*VfPbke5p2WeLc`u^%NM8vRNk^Vpqa&wp8NPS?JZmjZPn?tXXFtcY^aBq%*i
zcZn~6S&vF6%5SuR!F8MP#-N2WF(A{AxvFKZx=AtiNXjo?f%^-;P3s}WB6d)FUR=Wj
zTN#Qi9mV-xM?ySOT{s#6BJNW8Bpm^Do&`f_CDe)#dPgHN$8jq)D#$1S5C0b|-#{jZ
zsnzX(8)P)!D+<*~JwQ4tI~^+82$ed!AygTZF^{tR%Ge8N2Um|Ztlf$wC>RsfC?5Qw
zU&~PS<+4VV(r|7{$MX9igzkzUZ@DY)N)2<t63<`OIHmqA$Y5k^Gr&RbdIy<ok;yB*
zp`;6SRHp4j+Fx{d6!kA96P8wf77WXEAPCQx!%SYf-Zw8p$SyEhOVe!EY%Q+yJDO2R
z3Ozt7^LepGO(x9cYOfFF)~^1knJN9y%(wte2!svt5Q4i6N&B<hbnsXl78bGE({pKA
zht1fhZ2%>M11HSKH5FO?QZwzcXvT$G{~vR29Tnx;zJCvbB1i~|)DQ{?(#_DK0s;ck
zIiQ3{*N{?zpwc0rNJ#e}-6bK7<VbgSH@+8cpS|6CyPxm#{C?l}UGE>RHEWn9toy#^
zzRv4BkK_0lCfxN@UUXojEqP-o5AkO_uDr-k0>k9_JTjuKGt9jg)@uEoTx0*6R~_5O
zx25PtvgPZAE*8RViEZ{bY4C<;oo9(Ur|<27$UqfS>gNSye^e`{QbKK^RNE-W2}6Dy
z+qZ03{Emn*j|PYs;zRDzM`G5|s|W9CLwe|{Usx%t$wHMEkbue|3|g8z>7RAaW9RLL
z>=^;$d7Rz!s@eX_I%l63O(=z|qP&a(H7mmPCK3a47rXHdl>c^ZmdP*xH}J5Wzv<JJ
z5Yggt&>x9ab&E5}MqpcL+<)ANTD7Z-TmFjoZ{9GaL5=O!Vp`Zmtj(l3dj5$(dHR`i
zIbS~&6;M{U>>Y?yd+l%?wm%Sg8xC?MIEPM0b&XIevp_3bnqgdArZS{u!rMJ0SN$_G
zHyuTrFu6ka#6dzKO3|<EF_2v_{Juf`f2HL7uYOPE6@bpdWko8jRMCbV3Cb(8wpK8g
z3|^$CegTc13n}o&OLP$-L*CFX==%ndSBfMKNc4IsY^+u6FkcqU3t|*aev47G{&S4t
zHe9ea%E<e1QNPgRXP3&Zha<jZ3=I=_PoHj)l9CLCH4jCXt8DDPi#Hw{h`ms#9AwL-
zeLuiIWbX~faC_`Z&ESQLjY2~Tm8HFwPs*#_rIfxa7A#hD|F8@h$79Mp(ZVWTqX$!i
zoUP*^epg%eu|4In(+jB6p@W#uuc~h9!ta=Elc>q$s%(DwK>4IL7_#g|GU0?_)i>9x
zpl!FoV@)`lvFZ%drof?fVrU$D{~Npw4-D!4fZJu~;5&vr{PM29uU|_;B|=N8*3kfm
z-QlM5I{(sHC?X4yRXU^1tXDo)rZkb>gaVwa*zduY3b_5;{TOaxISI^V2Q%FAh({b(
zo`)<I8&6M2oVPhdhNKx29yrIm*=^GZfAH!~sZP1P1T;`W@<y7PR=i`2dNy_U&XMB|
zoXDz5IRhscd9lsB7URMc{f8Q+{xaox)G2*A>yl;E!sbyRy*z<;f7o2mW+f_dX@RW*
z2&M+NJ~_Lk8(0dFx}j1S{5timZkH-@0C>Rgg=OnTkbP{eZSX^K*W$0z)rcKZi($_b
zU~(mK!|X6y=^zH?q9Sz1<$X55^D6&055oBZQEVL(Rs8hfW+I;;$_J5QvFsNyZUm}t
z)y&^-wAEBf{*H4~$?S=zGzn}y>~e6Ez~GPqJhz{%&}S@J)gHN`BVB(>Ejd+?$kgCd
z`j&_mYWvYZf0jZF)AB;{`}#rmmwvV5Z%JtlZ?PuZ$IrU(O4PWiXuIc!HQuJ-Y5MhK
z5}_G@dvf4DT|N5^a(>Z9m%w*u&kBqW;#!}cvNdyM^}AT|4K&70IEv;X8m2A>)4lOz
zZ<`9XN{sK+jzIGIGLiKysye&}7213m1&Ip_Gq;m5lf&wX&e|+!c<CYjR7)Uqpd0Yj
zAkxApSRpRUI%VU$We{4i%ZK$;{*`|M^3Jm1KOMa#m9pN@`PH(Y10aJQJqRRbnQ79Z
zeMFg<HusbU8km}@W9(pQnx@rkDX^nP($v9;Z(TcWWs+>K>c$_t*iFILaII@`@R1cf
znn1vV9lL}k1VtYfiZxrNoTdiswWVi*%`%sQO;{-h%xG2A7_W0uCuqfG`M87EcV$Nx
z<Ff;_xC*CAR<HJgCiT~npf!Ux)P#7WFpN15XB2_DYP<m3nAY;4sD$0)4do5S?a@rc
zwrQV*=YO$fE)}p{Xyr)~NU64_j7;DqZx62tHLQgNIMD`I7$Er3%2W%|I`U^czd@ca
zef?B*GnVo!vzTu>Qf=O5_t%k>(Uey|u5aJjYDAHf&u}ah<(*;PB($P2KE;Zy^%8jD
zcKVrZw@NV|Q>D7TxF4$>xfO$wyQn=LcqLruoTSxN6xH83p_b0vqG#r2U{cjdWm1m@
zy@>Mf?&kZaY+n`%t4ZV?QjzbIH18%ZJc{`;m^;S$@YWVpz%lw)BcVA6iUru4RkIeW
zjDgZf_c`h=zT68Z<4kwBR^Ra_aIxCK75jr_Ru+KY$XCQ0lxkuMT7OMGeEBhlIJo7y
z7)V}!w3=nKX`5};H<@x_vtEG7`4&|NKp~pGOPgErh~utNHgE2@D_FDZhDWsX*)$8q
ziKc0-u8pLa`?oP+O~Z9O^?#Aq8Gg^A<-xVLk7e^x%9RyuRLxs_C>eKi_2wmO%+^4B
zv;)ZT=Nx(m2tp^o^`zN-I_J2WXgW|%TaH+H<i35+JD1(aj?VUc|Aev;ncA>c%bST4
zuSJWvLuXXtF*|}VTyjVubFp<FMm#Per9Wm$AYxLgn-4`&Rd8g5?o{#>EoE$)B2Mmr
zs}KM##UEGUA73-&=dP;_uuN8Nm~U$ezn_S>d4QxN)m{;6nkZdV-q8jNMlRpQ&wNaL
z@esPRq5N^-nPld7v3P!HK~e1H1a*O@#+=JaAT9G}bb5&G7qX=%>#LCyNm4=zcDwJV
zn!1;xuPGI(JLMcx&takqc_wWsnpE)ycJrH6km^MVzwo#aX<<QoG;qFI4>D}sOamo|
zRwK|VmhcJLn;A>kUIP+LBW_h1qO58M$}!`^%EWo(aaWgPP=iBR{hfY>NgxSrk|7rZ
zlF*SYv^wZi5ho|48ENm!6q~Hkcb4QkAmJ@QFrAVGRz+4jxH7+Alwawx>P47(T<)4h
zxbYM|d3*Vaa-q0Ju*Eq0=MhNpZTAuSs0oJb`AK?-MM2>nFbdXnYJc@fsa~U1qR3RD
zl4>D;(T;4*bBBd@cyy4YP?&j@$?3_c-pctrbv%i4o8Qv|`+t@8T!;UIjTO&(i0^kC
zqNmp-BzCjuw4=4C+kTqj#kq&Un3z=%jL^Q~yky;d0hu$W(asKkWu*&O(REwN10V|T
zj+9qPMFdj%R%R{m4YDj0^sWq!jx(5NiD6K_AgHC18xQQ0D5WDN24<t6J6HTClQ9us
ziKPEWB^2PG{*md-e@cRak)qRXqtn_r5_N0tO9*q0GJS)P4D-eq-6#$RGXlGxW(3y3
z#yq;D6{=$cr&pgBn6negM;t^cm0y2%x(-A4aFw`UL*a)@2I5v$W_IHaTux`5HXEfg
zXFjo7uDOP9Egna<CoJu|-&rp#u-Q+rukIaipC&e?K6i8QK4A$z`kQI}=y6z<C81;9
zmWDUWbzcfW8UM=>svb!O#3PXuB-_iFq!2>e4h1D8!eOUdtm>z1eLKhCEaNFHo$X}X
zZubmCuI%)kDZRB*t^P6!L;Jc=#ig-4*>kM+D5^a)_l7aaNeX*g(n=UV&5V$hoRt;?
z8;}q}Os=6TtlRaNsMg+<c{(HB2BoUN)KMuxr}wv5(pLG0uG0WiF=_@`8tIlfhw2)e
z1`S04%eYIdYD117bVkMUZF52>sm`qs(CExe^e3Y6ytr%}KH5Av!dAb4LCKY87|Tr{
znXW;B^b0>~vbor?3+v#c$ly{x{Oq-JiHWY)Oxi?KCLK{;h~ZIjva^_UeohFz(N;-_
z2gO6&R!y{64Oe@+pl{a8!EvS)rkY<q4m1J%A*G7{|CQ7~#n-KX__`*s%}Gq5a(gJ1
zZ6K#(#tS-rh6Z>ZqjCU4Y5M?c3fxYFd|jk4d-#q>Gf(n+Z~M|1Y-A%T&WG_T$p_X=
z&5+r$xP6IZj`3t4%d5jhiD`MS2|MUoc697Fg7H?>J?cbR#cg#MHdga<oPrOk^>fXF
z@@wu7SNIFsS>RoqkP}dg-_cYzx0ctP(K;TJZ`*XM)Fn+huPNF|mwHlGb}FeF_0qeF
zvLIMPVz8=|+&okja`7#M^sfFiwD?lV-1VSyB~%2C?^QN%8VZ?G9K9^=UzrIIn7Xvc
zDIq5(*v~=~;9|D;dEoQNOT)vxgBTL+qHwHd8dc6gPQs_~@2STno%jCTO^WKC{RQ6I
zG~cVip7OfCrsLq)GnWKmxqcpvse{*bj~=CvtYccdhz=z49SyvJKqlso2*)+e)<3>A
z$vmA+m#@hKv{kZ!ks9ma?b*52-A~|PmWWke1dSgmd3}X89z84;LIa~GYFAkyR|Nsp
z;-l}ZKtQ$hD&(@*;zc2XomI3IxaNqXWkX<lX56x{i5eX;Ua`MBwAHgkPI-!-ADv%M
z&RR1AkqOR9Ko;oi5;uRkg{fIZzTX-v+7^-7&$JbEdJg<~BO9XLh4Q$=X1&)(u!f3e
zsWorXUh$~Ma}<J7a`jyJm>HGKuN3y8FG}#1s`pdIHzPe~!K`8*{_?H<G0fKJSq8ZY
zU(J~xJ0T6t(|q~q5AmjVuXfwmYxycFoMn_{Yw1v|cVthJ-dQNh+PE;dRozO4=uqDy
ze_qr4*<|#zrt6sPa%6*z-^lHgcGhm)(l<?8Z*3|<dKUR`rnu^L*sA(gWM6R9rY>C1
zi%?A?5ZR!yrjQrfCWVZXEvq{!pf2y6s#LcxR})V=brPu&q!1V%cUp#y>UwVRa7<KV
zYk9rbC0Js1wlOz9m2c4jvq_56bNsUvKZPX@|1B($iSg|_IiV2k+~sPWoLTd`m}EA)
zVHQf@lr5g86DRl)$e5#-|K0rRW<hCe#{_*rtUCRJl~8)dIvPw2+b>beQyX|8lZdB6
zTINK_3;xS}E5WP7MD_<EX$M=yq$|M?9d)Z-)$QCXNztn5tFdPaMP3>#xpGBkDIi;R
zhsU502u;u%D8ywP)tdKLE4%HQJEm1u1_RAELbX^t$4*iqqraMPbHAH#Jw-WwLq{fi
zisJ7#(XxNWd!ECA?dx$8wNNw;5s<JEc=ioKDrA<{opVgz%G$Z@o_I9Su|c$6y>=-I
zETOT<phaXwC`^D!x84nm(**6Q`>20UMQe#`_44FAOGPWC$5IOO2kR%j&s#mc=er*8
zA2T;gf3`EZ`|xyJxZNxaX@<t0hcz@0Fy$FC)bdLW+=wxq2fwl~d(G$qi+*#&qEa4-
zN23h?l!q9#!Bn)`{V4gDF1HxM;1zIv<=3ytTvORIaq9^A7deS(JOwkcYc_~M&&BDw
z&q{)C2aXeO#6lj!`Ufk4ZKwg5k3djb@z{(zvDGcrYCRinFR>ex>jfW2mLGTQ9<Y$_
zbUEcatQ_LMpl|fgH62XYsVI3MhR!tYWZWB#UqSxGtC^_z2Y*Q5j6d{eGSz%m#w4AB
zO*YMdIZ$Hvy?^-WPS~7fl%@UNHwbOTnd|?5NbUYNveKu8=ID(!B*#*O#sYQT%DwS=
zG$ExAX_acANGW0BH3pI#;e;}VNh2wnHOfxQeaf_{`bY8bt;|MKV-~7oqUqH@zxpbI
z-U6Wx{Ug=4W87+AT)N7jj{~`i1wH1{=jAo$Oik}>u%;&5Wxl4wq|sK>Zq98=YZLh5
zvLqxBkNy53_L!+I?tX3`;`zzTZ0T{9f)33=MU6ZnkCteCbO_=ho~@<;cjl7#ncnY&
zN>|co(IA)TW6RfYpe^<Nt=O`gx9U~-Ejvy2M|RquGWoFqNLH6Q{M{H<qqU+}*_rl+
zi0)4(+20j#s{d?zQGR@@N<A}=UXgopj?bVhU!WKu7ED((RA*(21Rg$~{hI;2zak=*
zYCWMP>N(t0_w_sR3WJkS;`7!O>)Ja_3uoh)7?j=6ipA5YU2%dt$<&^-SkPN1eF|R?
zlqKl2lVz^q0#uC-u91u2d65&}u(CL*b|f$pw8aDD@W`qhd8Oo{4a$&-Tj4GoMtG?R
z?EFQ(CMUuBh5;A)#X7a;Lh&SUZ8TGooiauW`x9+h>Q{~xc|o{8Wd4HGxD}AY$7tVM
zWQ8XVn4dT=f`^l|e~frm?8@TUfin{uK;1E+pLxq5|MYK>TbH=g_z_}6r=LY%Mwq%(
zzl{01!c4UwjHZ}miu7idj-z6a0%&n~<!C9W{L&TaDr;<K4TSRpoqrO}-$$lRIz`eM
zg3{<rN(^ppCuTFf65fHqp043xPM^kJ2`I?0V*gT*jcGahiES`HVIv(pi9PZti-|IS
zf+q36!w5J*S3|a}h)J_72^{YnNfsWtaMq?7(|wFALQ;rqpj$0F&ZPnHQBS(JOI3H+
zY|td&+`%gvWT2(t%=et==kmWnE-fu2Zt`aU%mLnd!cWb!KfNvlM3ohwM1O+IihIOv
z5E2O37yh~bnyTERBw0_c@E*k{Fco*ZO>CD$n>N1n8nex5ZuR*KA(SjLb1J2i2uK}C
zbr1QhOO9=``%q2^>>RJ1s>9nrE-;{{1t5RS<|@nopr@gq&E|T^PQxc$zwE1Ct*m6^
zGby&-Op3?2_X0ODHkE(+a@~cGLXwjdKZ)cM0n)bP>W_SS4I;PEtB4P0K{d^0)x@(#
zJDP6;tmWlrv|L6vkBLKg{vpuyd+f;nXuDHQd5&Bp!(AK(78ruzOP|B?9vJz6c;4+!
z5}rtLWqJlFX;y&Li8g8YWU{a=_%^amgi$J1!mn<yqbB#mb+egAr7S&rPK_LKcle+v
z!JK^u<u4X=K?()oG?JV36H>1`IC+cMZTLUyKD@{i0%rr(a@WMc6VIm~0NiTe8B-Eo
zoa2>(T_Nk<b5gZDeJjRl-FY*vC@^c;<MRHJ<AcIGNIcG7IVE)qT9f1vcW}_edp^l~
zcYG+NxR+F;<DKJuT88;Rn@dom^Ff&W+63AbiTZ%WC~M?;39uN=5f&f5K@^4wYN7oq
zAGeY-`y4cLmRfCHL^xv{T9C>8Y!X%QiayjkO>pM@bK~_-Yv-TV)c*_br)RUIR+QXl
zp$4E!LH*a4IBJ?}pxYP9zCrL^1pDkra7UAxlfE)W8e2%V7odmb(?Ik?8yxvbv(qc!
z6KmL7Ng|hWeODKH_9Bb1Yj(7~f=T8q?vpD+31Y<^dTI(PQ?74Hb~?-#A1phm<a19i
zJf>NppIOh*Fy9=060pA8Bb!GS8IYscL8O1`n}_q~j0L0DRkV7e=3Jj5a@ExXn(`Bt
z^{|>5648KTrFl;D7V?TlUru3Wk3;$}Pebj)@>hS%g8Ilxr@~=nj_N-EpDwRb!&?ga
z%n+s1MY@L0tW{Yq-OWOs%pD+-Qe&h;=1Mc|9(M~v4xjB;=|S+g`=cTLKfFdySYPwo
zk;NW0Ro7(7Bz@RuZc!UbjYT_Q!x0@F_)^HL!ED%=4AWOHcB^iWDaFLUP5|DTkc9kt
z@YpO6YZ$Uq^9e@{OWf}6)dSZU@pj72)Wn4YCnyg)hwW~GF707q{*IPtXFjV*l=*77
zeg9xUK~Yc6pN;D%V;wfaPs|k>Pwg@xkbopJ`3u_D48zu-&%cC3Gc-XwL-+3<Nq3vB
zVU4&O4}NZoST1LM)WqUhNe)2^Kl%)VDmmIIX$w|I>XzrU&ITv?hqF0cEp@Nl)dhdd
z0k4g+g18OE#Ls3?MXfrPwvAd#@>cFF0vd7Vj{0#3CT-YYnLLgon*z$bec@?VL1FW=
zR-aERihM*A>s+0eHbX)*2~EqWd_oB(7)1IqZg5IvXea8=>O8Ox^RTfFg`rdNN+C-g
z>oTSTt|M46Wv4nu=N}-nV;C>RnijPl%Ns6aZZaCXUEb8w>O9L&_)4i@sNKm+a^Vuy
zD9H|uKd@PyU-LU{eS{dh1PWS1O_%spmFn))L8<e@`lKCJ0yb#14Yq?R$<M$Z*a7yy
zwz+`rKlVT_<$1?&S(`7aTVRWA?Q$8qI6kAYH5tdXva8mbx#dpl2~Od6|Ep8@d<Fkx
z`3U9Bf*&36mhT;LL$L`t+YXMfP`vX`i(ewDFKcC;UMU-J`^uK2U4n<jEFUq4R)fCu
zJk++q`ptflqoI_Zz0_qNH6_m^1obXY500EKks7!A*>*UA3TaTnToWjuVvaqD%UJq%
z#$v!1P3X-|1bor_Mc!N=0=T4i>5G+`I)e*P1D{1F{+g>MRX9#8)den0f~Eo*PcRza
zM$wd`X^3pVsHgFjJlJJhFLjj8ix>`N9N6usZRK(_9`VNeYG>~pv2|^`$#oWXh=41^
z^`|RzYyIz{Ntr}P&eOdIVainzEL<{vraTQ_9%<kUhTLwok`S<<g*Z=%9V?_f6+qbQ
zT+NrLdc8-XH+z*cmmfFxKAo~hN%Q!%^ENVS%2w@k0-fOi8|)qv`L0%pylq5CU@o+4
zS0`s%%}xB7C^krL9W&hsSTb&DA!8!>h~hez<P~U-<L^?JM!hoLmAOAUeQ%eN>@@-;
zZBA=h7a2na(FFq?Tq?ynVRU6ECOcc<k-AO?U@!j$ahB4~=OdYpH6gPkYAR)5RT<0N
zaZf02qw(AgRpDTZ**#+Fazm~a{`YI-x5`NmvGP;pbPH5YbU!Mm98s@qp11y|xV@p<
z-Z;B_4`@n)R_BmJ9?Uk56wmdwW#x?=Z1ru5uc=+p>iFOtO3YA44ZaD}gra0iK6FwH
zs@kn*d?N?R^AE`V?AW`f!+@bgH{(PlE*<)}p%{0|s(FR3A=1e{mM7PDnkvMOfw(o6
zV9UndpZ$E9KGX=u#3y%r=)J3Op)lnluCBB~X=?Gr)PZu$LZ9>Y9K>Mq^<$?<Va)G+
zEEUA%#?5A>`p=>A7P)Rg+xBjfOdtdQ`smMEX%IzL@Cz&&N<3x%jziBCmHyR)Ztlp&
z=2^wHo6A!M`e8jnQ(hs#j16<X+1yLOrz_B0FvF;-wO|GA?+1cdaDR_e(=g1Z!2%i1
zjLM&Zmw|Bma#j?~(0?w>htyUiXE{f0tQo$SYr%$X97|agxYk%K7Z&!WdqqQ24gU4~
zTj+V1#oJx84UIuyCdfhTZ@05zbR*t2c3E1?*?N{-9}5_m``F>sJX`wu7YN`v-vTEF
zqzbAWtdBe*A$;!e2M@revp_Uot>$nxHT%o6^yla5UtepUl5bo~oM<hId+_$=F&2$=
zDJ^6U!(G9vxpp>>Av0A`IVlzM$ty64eFP@4BL1r#?}12-m?%s<3Kw71{(2TG$y-CZ
zMr;uny~7B4(K!!JCtM}j%5LP~kU~+!p!G2)D<`Lf*t~=o7^lV9mk|dhYdL(}kgeVw
zjhceU-Ic+j^<1nsh{^iei~)Td3Ei>nu6MsO5^0ye0~gV?u34C5_uY1PqHI5E?W#PX
z%Za<|n@~33a{VOPm}T$9YIVVi{;Z5WJd)kuijPi!2c+d>DjJU|6zN=GBt6_JnLmF*
zijpLdt3060w9D7YM1ZSfVDZQ5fG6iXXJuY_)LWrsdo3)5_~FFcg5`@C=fyF@dN9Ll
zX{|N8;|1C`S&Ek{b??Rz_$I%U85HEpTRge8Hf_WE>#3R7zNz&3vV<j(E;FhnK1{m6
zrBw9RC7PfTe*WDVsRg;dV?#r8;(-d{WMmL2P7dO>>1zTHK|W}nhi%8CBaqKA`9?@a
zsYR$6g)~30=Vz8zl(#(_iujF1y607Q&ZUO&C*;C1`E{b78MmG2WQa0Vb0c(aY<TbH
znwVYp#TAvpeUn#s`}N*y@>h#ab028YJxrq#eCIM%?F`%b?Clle!OZLy6Wh`TXa(i-
z{JVb8pMJJvR-wC_iS|c^uht18ZatwwhpoR6W)378M~zP0RJve+uW4^Ae@B97eS0Y>
zrD$MBCkSCr7U!jEs=;=A%cZP6^y3JQiCfQQ<{FD2Qkv%-Kcah!lNZ&ZR0f9^P@F>@
z)qeu@jIErIH(Wl@VfI_re03C+oFwXw6*R^$Q;MGY#hkQL^2~6GU&=aW^c}bo8Asr~
z{|(}Vw=}7fZVC1)Fc_IXmYfhAp(OYo0jD%)xbj;BT<)Hn^&+PgRxQ$|G@~nq)TUR}
z$dGJ%>2vJ+vj6Vl{4bcGe!tlNX5zANt?KfZV+xDnQ_eEqRr}5`W5Qg;7TcQfYBb5V
zbN=IV)F@RdOvTFSGY%^u%-YEt%Jk5=eT68~oox#?hU+M(v4Ka~GSpfqy16ByC~|_w
zIh;<#028)`7o>g?Ij1ngxTLvk277`bQR5%$txp|KZ8IKigvs-K68|+>%r?8$d=tX-
zelUZK(ZN0qi51#IcF3i`gQjt-zMdUl5;*%(lx`bpy1H#rU0aoZ?ApO~Aoi}_klB`)
zdwr~w;TSsQ7SDT~WXO_$i7@zLlcKy(teiY-q2VzgtnM&MXGPDh4lDuuCOg1yMm|dL
zWyC%A)70)iex35`KBkYaalz_~Zj-jvm1C&{$AEq|(yy;9ID%GWuIJtLNSu3kQSS~w
z02rZ3YPO+Vh|?B|W_Q0dq%TNXYqj!@mW!E1poe%=#401&ZFbTpP8=S7VN;!xEqU7X
zNQYBCl7VyrRWg0#zv0zx@2W>sP|xBH9I9&v2eG!by>&}3>~&jCsUp>nkre;}Q^Yng
zM&vC9rKITF4b`?b=C}wG3Sth$H?!-Q6t}IS{!)m0ZYR5t$=-kUIxXbD=6Rq(d7xxT
zCrn6Hg?;md)8u!hZ`G4+>yUIdBc4`~&h2?rYDXjdpLRQQ`WM`5xXFbmzn!a`gh)gy
zN0r9aK<_->@l}jK5hb7It7#L9s<I7Fi!BXLT&L>wZ#^FLkE;N2bEm))V{|KFJ}RQv
z>T!40OsVyruRr7Z{o&8gqoD>{@H?L;;;<71+lgP<#k^oPiO-tU%iIgvm}2p_o4*q)
zVP85$KD2bNr=b3{rE5xzY@p^u0&iu_LyMmu(`)!j^URX2vGmLJ$_0mKE|H6;(~p-;
zC#wSwXpYlCkzD@`a{pu*g*q0`FfAsON*ig}C_nIo)ZcqaLaqcOfg0s#hlOc?`CWc=
zhD?;j@@lH|)r5Fi4c6L!AEo%uj6tG*&Z1RHh&Gs9jd{oE|Ktn|Gb%Mnf#1NJTRZud
ztWN2+b;e*le$<flJ7t`Z%~W)uIdU`}?@9biy2jWjj+LrzKLVnYT>L8@x0|VBQt3&A
zYa!83J~HXv1ysz0H5vXb)0_8-@&W({ijx!{>VZas34KyFdV{Dsu<+Edx-;>Z>Rrvp
zusT!k-`FsA`#H2g>|2`)V56|p&ri2mRLTa1c^|!dx4${IFNZ%eGz@{=EQSAq8ww@Z
zUcI=Y(N`xOHK+NxZ0Hm-kuTogTjLquYUcqEvrMC+${4!TxGQ=0RLZr?1qQX=b*?v-
z)-;jQe;}m^t7*5RzuoP^QKU=sptv|$jyqFwM(Uw*D>aR!j+gMOVa{8MbsY(_gTkX@
zsL);}y@f89_pM2)*~isthO>H(4s`-Kubx~=8O*OIHw9%cvvCi<r9!Y3r}bc&#_W3W
z3(coyi9z*cVK>J_>~!-!M+d7&EXS3GgpJ|w6TO_2zoui#o}9#SH`UnMld$E>Re#T;
zys1RW7>_CHb8=2CLqm%3$3zato!h#Zs4sJel`g6!FI%Z*bhE0(4Hr!uz2Ln(N3*59
zNU}TXZ~U*!)Z@X#mtmB1(CIA=go1WhbSnKV!6JvAR5FE!o_TQa#7SrVr;g;md!KPP
zAXE2gal+bzl4s96k{uW@E<1bTW4J!^c&0+em`HyinfS@;Xc|~aJDjWZ$jxi=U?VF_
z^IDqoZvn=eF7=Ce_@gX~QsdZjcAfYpnyjBIym<2-HP{i1;e41gR)gB0QA44&zD?O6
z{g`i1nk9evcSokjPmWAvj=5a*MuB@<waQ_(s~lBkU!8lo;O7I~)4@HRz@<WeY^GB9
zmD?LaW-c7uMPx;v>SRg<Bkr7=mb@;yW=9(*j?M!H1%Gq~f+j+&Lqa+6?{MPNcxkBA
zbwtgM3ipqp!g>dNIAe^O3nB-cMfaK7;ZASn|Bds+$UJ4=^plPBDRoJZW*<$H7Wu;m
z3NU)|;c-gka~G%RXG{=Q-5I4tK@P>oRQH%AIImJM$|;_zfI*>0#Yo7@i6AT!vL)sj
z*_1b_2viS*Cg6etdoy`%!M3n-NPl6~*oXZ)W=~tMm1nSNwZ5po%vnvTX-AK~c43=(
zQ~dFg2va|gse9fq{O$7X!J>%88?V)<y$36A50;EX>wV1BwUi55zgFFLHaG*ulb3y&
zdgPAjnxd@~RhAMbM3L#X%Dp*uT1BP37KWwKz!Dn}jT7b}fEMZq#ZDC``h1IDu-M+2
z!2i)3y(};+x$67--u_?I3Cs(7#R7KAeD+*Id>p*fc4uhVSM%a_sr6*?zUS&D)2_8_
z-x|solx)51fyM}Nz!UJdhcGk)ipOZg4Frm@pAGRnmxITJPM}?O;cS|FV(*|MaauiL
zdO}AwD;!y-K;K$jbba#CMN--;1=CZQRkzz8siI!G$fP~Jd9M%=(fzQMCAo$T=e-Y}
zny8#)ihwoz&Qmff|B9g?+~JhS^!#&&<~<PqdV_;|wgrznA-fY7nA{)B6Cf#$##%rt
z9o6Hm^lmcaF?WM0$mNhfazgBAI#WIq*Y4vU0#L^6LULmOW&By_o7{zv1zFYX3#v9C
zt9mjKy8;9SjT-@@HtI$yAM3rCBRjzu6BEj=W}CgLIH#B&nYfv@H(URfi976Zzr)mS
z8`Or5qDH%o?G73kad|^6BAr-j=!8%shnBHhlnvHCLj9$nRjv6oGHkM6=wh}W`Sn*g
zE7)FvXw-m|$ORW^jKQB0tZD^^E!3Au^{A5M)3$7?S@$E8rN!k+xromCDEb#khU+uF
zCdD2!?#4QvA9&eoX=)6$2}Rb0qC+8_6d5LJQQ1Rq6F$yixv`&pCK(DEef1p)(;#w6
z%U#D}dC&(toK(P1LwE>?f@`)_b;Q7FmcRdx^U6Q(Tfh2@g`<80S*p(}-@?}Hm6-m`
z&@K*Y8#S6(Od3po#AJ~tNXU2`-E28AqWkpWAGyY))4NCYASnnL<@ioQC~Plr;50_9
zX)4q6#q?s2Oa5xLO8!BVK)+x5)5voasvTNJqKJ<z#gLdR7_6xSpC|^-8Zg=VUhDDW
z%sXXOVFk~PZJh2FKjo;xx`T-hg~+kXnW|2GvKOI#xl)Byg6C#?^PL@I*2ct3rp{YF
z(6FI&{&S}}WMva0$H2D3`VGS3;$KzDES%`4db$Zh$@RB-+9sa<i!e3u0|cKpZD2s@
zOjbE@atY+)s}9K)8{>^r-ocN&%s(^qar`LSI;_D~B08D%e)cnp{LG7Y2c?oJPjJc>
zx!EvvbTvg1)2nw?1IS3pHW3{XXz<s;TKpt5ULBl{0-_tT`>J0ro4ZJ6<<gLd8Wtaj
z-g2_+*}pg!g|a&V{>587Xa2=E8Rz0v#Fjih;Kb=v;ETaUI>PZMkGhwO4ywCc=O=gj
zHZ&h<=bk<(1Q8{A-yr<XNnMfP-jdD(@zK9Qe*SO#41~j5zC3KKCLA``V&ZIl&5C|*
z(P`K(=<TCGM@%8glKuef@R?>=_**>=?vGz~!;=yMrAd;alzp!n)7fLc@}he^4iSu6
zD+qeoY?+#pI(Z_7D8C8+1f6^`5eTqaHG;SGoJcMd7;X@IS5Sa+E#H%<lw?vpwiL*U
z-o>N+X7uOYpMss|c;*KCivd*OoVn_zR-|qj$%L8*ULO<(1kp#WBG&iiC!c}fle54Z
zp)pgx&+b?P4_8m==gXWcpHb#uzS=(6PA}+0gAXi3TIUknwS}mbQKy}!2pnmHk=N>v
zS#asdWNVmQBlFK)T<;{B;&9+HVzsduIHkTX%HAYWC{Z@T)^Lh2HJU8fUCBiIRFHkN
zZ&Q;iC9=^OFEozxTpGy;Yh}y{&#sPKU0AG|=&F@rwNNG&cs4rx4MLxMLQ&}q4JR5H
z-RH5pbT`dWWbR11?M6XFN8QRpDAY%xc1Dh)xf2p7PsOcxm#Kl1+a?hNuX-j~iBSYt
z_r(i{5_X-bd!4UxDCZJSJ7=R*7R%03SO0Ibtc!&NCtPK8q*4mh6Y{-8>_+OAeT8lb
z#a3d%FiA;kcn}LMNu`gFZHxWhB&EFoB23|I>Dlw}i&;#CinXQDho%cd6mo2^mU|vC
z!C|1^5$4H{k-o@D+grePiMi;I_EyH?d|UM($URF0xo1+LSR^q0VFSWcqL#&|@YPIv
z)OYbf@y7iD;7UgSKuZ6-2H9fcgQtx;BMB$Ex?YPliqX8%_PDvVRlZzjYfEZnac6VU
z*`qA4v@1D(AEX5tInln5H3RzZwxuncq)^J5Yc<n&HmP1SQT}RHqitora^QcGrpJ&9
z>(COKo)bFkWpAbBO!`<Z$;fVifH6u^dwoS2Kc0fIZTI)M=s!Jt0~^AfG$+0`MfK_a
z!E45sw1EdB(JH<5cS#KuHhGFSPew$E=Ea40w9##nDifZKO&y)~l?#gU<<={}eNx9K
zc(Ni-uU5jJG^<<q@`yhDk&6n*cbnGFqo$U8v$4()Ll&J~u>ohwTZ{KYptF>|2>P=B
zsqpp>9qOM?v`h)>bKY!rZ`*sj#ZwoIJ@-(O297MnGxR?Eoh}BCz<2}5{eMe%*NM3Z
z65h|G{z6@K7?!ko?Dy_r<a59PF94PPltagulFDFXIwJKRg5`Yp+!|}%WroZCGq6X(
zY81qDnYb=eiH<g1H`bHm;?e_}Z>Bn3?!3cyuT;>sWCz^?{ld!Uv9VDT!mQ#wHDbk#
zWwod~)2vc8wA;<1G4|c*@)r)mW+N^0!P(X+*4#wJ7T@l3D8(3XAVq?3svzY^i{$uA
z?mo5}gP!q7^WL{Pf#jmDL5zHxwvFs0UcQ^pGM!fF9a-Z;vBG=;#Ti?7Fr&;kn=zW1
zSwUX$1<AWUiu@P^Ur<I={^mTd#H;-a`YJ!I$Q(VQDGl=Z{Nd3h96U@Lk}kzUA$aK+
zZNymX9^zQ-gJNA@jqX5>F>&Up`};v%uN_zvQ(Aw;b>Zw+y$HXw!T^Sy*a5lukMTio
zqu-3j9_vRNV9$V?N!sm_uPRIi^R=65mmND?EdCzU$pv~3|M7qh^7qd!9t)0_$4FyT
z^s%mNoAZ3Vp{)}f`<PMP4CgjYD(!RsDHu;OBUd)7I@4QJy<*+x*v!1sBCYC>RuH=^
z9dajt771{N2Dw5IOk15CLoW4wyM+A^C!+R(w7em8nbI|)ym~?jQd>`c;dSXvJiPeH
zN-Bw0T8?ZF?i=|B?MG=-J4vCN65-(SLGT}M@wG6$E-wXo?YZ(Opx3qtRby`d9xKOG
z6r=uVXvSsJeILK`pqfpoJzXM2FH*=gS~c_FRJZlukTNl|up@WkrQgI+4R<)a*#6r3
zff~~rrL9n@;Fu&sCyO{y*k<Y9)vCL{Mzovk`^lhI2Jx?HE?1kq05UR6MQINM@fs`0
zXXFJ)CwE4l50{3B25^(G%^X*BDL?IP?Mo;fKg<aN^$;KO^uZJZ(y!j_YDL!+@x$h8
z@yS)vI)gDA<GjP)EwmwF9&)(0g`XAQEXYKdv~52{rRoT6k9+~@n|EoyRs#N=iS(<_
z{USaJM59(+1|mPVG47AXhtfrqy9=LEM<FW|ok9o<PfpyYL01+=p@pWF7qyCq-eN?m
zmORwCO%j&J6`bLwQ!(YqiH1yjob_f&M7_H5kPRh1Yt`F0Di=#(+x+y1O|7R3en4Ty
z<^IG`Bg>6;RLqu~BZBFgKFg?>pxllHCLY>1i0OHc1C#34KJi)e99sKitApm}28FYY
zp0rbZO2-Ykk=uIiF4RiBSmLN}#v#&y55;2r%$lcu8Df0XX4wh?2)PjS^>prbi7lB5
znQVbc87EZY^+u<Ti}RA`UbV>2?<91~t@q4L$3}~D7INn#Z@!@_Qq<n7%wE-P5vJP9
zu>pbhY_AG}uF!~0wyI}a`d*Hz%%d3cOrzAp2X^P(4v0=7J-AhsU5Wp?Rl1sIw`%Nd
z;MF;brsf*@3ng<tE=WWix7sKWz%)3;h6|a@DrcSzb2_`0Pq^JA1wn~)>;D{Rtngd8
zOk^unR8ii$65rjeT4h9e|J8&So(;a4KJW~or2c0*1_+HHPfiZ|x-TgwOE%(%MUPwM
z6d6;h$C)}ypHAaX5crJ7NBLxNEwXh5ByOu&GQ}b`keODWKF2JN4V=|8)iHswyXKs&
zlD_z_+Kti{Ll`e66t==Mp2y@hk=Sl+)1rIY)c5I9XqZGH-(kcO$6gx4V}uSagdFJc
zvXWr>b1;8paK?d#X7(N!{<E;IjP9*Of>pFRadOXIm1R!nIzP=Dxi{gOwiRI(?a#_~
zL2@8`uT;)=B@t}ySF=<Phi@gDthS^oKbH)@)k<jizyqtP6>pB#n<Pv0^1dZ7=#ed4
z0|q@!rV=b*(BtH-5?FU!YIJ^tqI)2yup8{swKmj;I4<Y<lI-uFx}1U3*mZTK?A%)Y
z4MY9)R|k^+o%fV}4JzP%Z-2*}&i?LC%3b8|%3ZBq3ruu+ip-q6b&2;ALt^QUqnj+{
zq+#;jr%rg7q!@%^u<MRc!msT{`$3bqeZ4Y<6JM)y3z|01iM?<*$d67V7x7yhpy!!q
zre$C?Qvw@f!`8|cs%g{kt#X6N100L8=3}Owthf}AB+Xkzy6;NMxrld|`uh4M249-Z
zJNtS`2=rolmOXU_q-28|XP=8CbEeP=t{-2sG3h6?Ms#<Vbv${OalG($1&#j37Jv~(
zF@MJhBdJ(Y<x-2Y4i+6;ML!kkvYidTCxy=hB<D<J-Yu^ZK9id9M05<?u*u?Nw~`db
zLZVIyW9aMsu8MHx8kRhyfy=edgh;5Z<=pLh4TE*IB=USx(CVs}3$@lvEptviah+rR
zF4m0*)#6Fi746YaMG29nE$lWPwtWV@Z{}ja>|G%TJ{C1JC!yy(JZ(U-n7yb;SNmSN
zB4S`@?L5Eg`14YEOj20WWSQb9#l}PB&G9o<PUrz(<xr1r0#=T2E^3XCN!Liac)b!e
zP~ChQwDv?~5Xiij&NRB2$1*#*Hekcn)m>jrkJpx=Of+Vc2%7QpNNTv=D1mCklY}jy
zs2}x<+jJ17e$N(;QCIPe;X@n&QKh2#uO8X|{GJF&QmnzB4>x=lRx(LJdWT=ylEY10
z)^3^Cm@LKKI#>s9*99n3qvo?+*bEbfh88K=OE<%d?w4r`4Ywr4RdDj+amx1^Y7yzG
zZX~x2BBFExj4hLlIaxn@LM}D2e^?9l58K=!p(VsK&3!y2Gg>d`1Y&ucU3NBw4)o?U
zHYbR_K`Ks(4qInZqj*H~D|jYI_)PIBOOc;%;=Un_yTMMr|K3ueV47+Tt(c0(wu)v$
zE;*+Gw{qw%?i&mebMq;J2C5d~=e_H&W>|A0m%6gDas$6)=%onZNL{sZ;B-lR?oYR3
zQUw@HXG<r}9(@07DL`xd;lJT6^#zy$O04C+bXQiPY`l_Efq%Hw<>#}F0?||9q(b;_
zutA3Kf*!r>cX{qoyNM0z69ByLMs5LhE?-!g0RH8D)jcUf?OMMR8tcu%OD;kdAD%}H
z%GHHlz*-8%YBY_@cEzt3i14dqo@>u~M>yERSH}QrG7z$XVE99=qZXeOukQuG-%A6Y
zo7I6yQC?nlRwA91x7u1r@dr}j*K|G^0RjLfZ0~;7VLB9cm2-HN?cH-3P?uW2K`h`x
zgFVfZ?&6@;E7r?>X|||0dytdlMKJnI%LRUkRes7TArSs**9wy+v<}UebQK86B!UU1
zp5;S@e)_LwO^l{8#%rvEm+sTWI&_@H*;{d1VG5(AgjqDnCLx<lmFfoZ;&aC6ir%C1
zGo!cs$+?0I7vf5Ed}da~-Ye7^?{nIkdwu#8{WW>Q`ez#dKox+@tK#l0WU@7UdZULs
zw}d4o>cF%hqDhaRALlHfjtI5$FAG6u@!Yi28nF^^5WwBJhGve(nAkXnzc^afF?c8Y
z)e98EU)5{gu}{YcIW5NYH^MNuoTN(i8xvv0sCRBG{|2nr{C+L}r=ZrbP@vXjy5ZZA
zazj!3hl^ltlQ;2&KW&EWmVEiiwbq#}KvDgX0zzD1u6ZP0N$hM`H#B^nsq{9rSMOy<
znx$d%!LpK^3gOA(cXqE5zU(-~XzSLM#)tSl^6`&m6~l<$!3Y(gB=en5eihEsvJ+%f
ze2h7p)giqPQ*l`+={yTJ5eaY-Of-eB_X8C-QNuDrzb(h*;kp~m(8M%quNr{qCKU0>
zHBDF_^Rr{YzswwG(nHR~^5z?a+u|kvLp=LA>xDCVi-man{<DTEMMpi|<(P-`?T--}
z-HPl|8vH`%M&~T-b8Z%@JF4}2q0WXL^!dkB>0S+eb;iCy<;Pthlt3#7t`-F&W1LM-
z8C_5_H%}XqF^8R!5|fhBP;b*vZ^C%wN@j?OpJa93;q>o*1MdMn-Vo5Q`wuz9XP*PJ
zrXEW>t-_+7?BugHGLC69&ht=bv`~H_oF0Gen9%Z@ivCyL#Dw1JuX+iTzM7-ER(kzH
z?<|r9L66cPKNf~TctMW80ipYqjL&;~%SD5JsPNhuL#1x|fa_=$n!{Wvl4#Yz;UYHq
z9%xSng@JBde@0yk0>EL=%aCCkuCOs$v}iTmkKPofmG0q|TPyq3G~Rj{dWcUs4hOMg
zbmhmy?|JFU*MZjJ%Y3cfirh_Fkew2Iul5zWKISZJt;FL_xNv4fzn$rd$@a*i1Fp4|
zGV3e^f_WP<j-P5H@0=)Zs77!LDgHeLy_(njE*7?YtbCMv+jlEL=zZ|Lt64m2kMmRj
zx}{_t>dDlD=+EVp24<Y05NGz|1E_yA0i1hJhjhctR@PbV4l3#KQ3G@T9-ei?<Djr$
z+aB^f8Cz`%q8=F{0qg0|S+Jg3GY+_|`)hjAMNO|wi7dHGcIDiBS2)Rrvp7oi2ATYH
z;o3^3fJ>LC_Tx&qZYwM6L9mv-2x++|)l$4kU|OLTSzxvxfJ2RF&xtX0(m;)(DQ%IX
z6x~7(Jl(NI#EqRF5_hv|0|(6O&5^28`?(>0I_FEfm$Q)+OUF6xk?yqzq|7Q0c;6PL
zZn0FEI-WAMO{D#+VLASzVfpd9TlhviQX<OU=tGprJh%>b|Enp%neJ_i_F-Z(vp*o7
zYk(#lrV>0m?u9wRR0gip=y0=tR6a^rgy*KyN320-vs37am2}i#Af;Vgc^=RP>=^OV
z5X<953id5WWFN9EIPeD$-|H<bZ4*$5E@rL<%+u6=F;8L0h~1vL(JSt(PvFlq@4obV
zQ&epA;do@a&OjdkYwv`p@VJu>cczNGOVkugGL|dXx#XrJ=8gGmiWwYr2=VYt-(*KG
zD5$2c$&?RGSF7zo7b9p0*EBXkk{3AF`O0htwO0nX6YRfK+#nk4%#fcoYYOBcS7ev7
zO5B{D2BQ_<rUc)a=ov*hB?q(LN4&4TKeB-a9(3>Pip@pdiL~z%O4QlhN9!PQbMYq#
z^W@UFs&dCBm5xD>TU`2KCNZ|}0wCL3V)|4(K)QTA7R(qA_LtFoFr*%e^$nsDQPXI3
zft>^;jGPyU_2RZR=?}8##%+?q$qp=ebbl(4YuLHp&`yBZe=Uo7x~GuZPL@o)&C*D4
z%Ky8i92<!#76^gSq$?+DNoPjD`^R`rb!}mAW(m?!FAyeCoO4pn)~)NzZ^BevzK(o1
zDfpy%{a%esv`Cosjn{9^p;^gLMTQGS+qjtpB>I#W0VCFUxhF7USp+HrBNh$y))x>G
zLy0gOO<(TsoIA9z^l4PAhf7MafJ_OM!<B*HuK&rE^UL!4PX-j!8WD-gct~jwKshwe
zmZcV~e}0k7loo+1eDxmJoOHnaif59K<s{84MeQ`F7yRnS?r5j6a>_N!NcWItT~cht
zU2EVWC_dPhY5!WkzUG}{=NidH^syTqjWyo-MZnciPCkN?X?>tcrZwV8Jt<CdeDc6i
zm8xj$MQxwO^8*=H@|IT~#F+7BvFbMbz&^1br+Vg<6fAb!vrs3V3E+o)It-{cn4YTC
z>pOB(==S^(?zI8nJ-BKF$Xg4?nU?RnTGw^NWA5zEDO5(S9vVf>s{Vi$Qb00#6|}QU
z1uHxD8^jqJG(Z`B3x~<Ju8N_z;A#}Pgs&EV{+y=v&Hbd7;D3eN-1s<urh}Vl$9!U>
z>dz$pDWU8vME%1Tu>Stht@3~TGi2f?5$rx8>4^#Xd<~o{ww%FPe2-q7Zjgu!g9aen
zpsd>a7~dHCDS?*B;kaTRJXAV;P;PzLpJIRT<%jEm67uHESCgqsRW|RIFU=Ply?@n~
zh;@WbV8>_=7p>pbjSC4+aN#R=ymnMy{BVKHaj<<>;NS&C2_`*ObjTLelU+4?bbm~C
zeI>rfg~0gQh;L5XgE*m=n9-N9sEfobFsWHNw2l5%KJ?N5UOv?Pj#PTO5gfldK?I=H
z^ryNsBr`i4yb&VWV<Vd4Zg~d_)9Sr!7Ix$V7HcVI*2|7nC;DSS{f`;j3Odg$<koCa
z{>qB}Dxu)|2LH7h!;7qoWvl91ajWBgXhJ3ftqkwRl&>IJ5e|adk<yMw^||BDyWM!%
zw(hzm?k2-!T--tQs_t@bv~56DswWmr^(A>94eBWV4<S<#ym)~xd{i;1Jq3V*m1*Q*
zMrq=Hj%3f~CX8`Bk}LD2OQ>s+`y|{I;bw3c<K6MjT{!$0AnkE;zl@I`5!6!DLJ68O
z3csp5wj;w?T;NZm`d+ErGeUdv;v8qo6pj>nbaXVHBtH+^h1V+v)$7TdOT5x`2!-^c
z2e<Rl%7hF8F<}^I&16ba<=-hvIWgW)gLEDoMPL>Abm}Th)tny$1_Z(XA$DePea~kH
z*DfYoL9gJoMsj)d8z1&WdfTZSn!t*=6j?;@*uGKiCVvm{k-M7C`L?EOqt|f08bCwE
zE;Z59B;tg?xj%Nu#9BrOkAX!)<YM-i%}9#BGw<X(fmr|P=#|p4BI3h><|Jc5DPjkj
zNI?fQG6P~-8;)AY6s=x?(S}Ie#2P0)#_jplWV&8tuTVGS01fRx#R_xX)3NEit#*GQ
zI5UpayjQ7+nECu?@Q%uf9(O@qrn}SH=E^3jEhs~-swCC!ICJ7)C$dxi`qtk#lsyay
zC40gc*$KbeFa-jr8Y6d|^%opA#M2jS%vC+-a~Zw%6`r@OUl3TKzI<M%e7)lxGC_Nv
zbLBxO*M;u2o602^(BpS7!=X<4gdKWnYi<xUiWT~&piw{*j*g_W`(Y77Sao6~o;k$m
z%9p>hwmv;g@-*@_cse7&I6rm%{<x<gnW4SvD06=AiehIYnN#(}_cYZW-evxfug#+F
zp)h(1sbLcq$(lXS&Xq&ldd<;j>!VhMqk5Q<Pf#d+`xgVi^11tI3u%J?&W)+hEn{Ax
zF~erM9x2&%5_#rPGa8(u`<u}Dmyh?e9+>Ls^9dF$EpH^XxB0S)49`rflT{jN^T;r6
z5)?gfKl^=veBCL@7WMi`^=@oN9NTV86E4((_qdCmdfdy?nR1yag+v2(BpnnX;_6DQ
z+uAmn9^f07msC18fY@;r6={BVDCu3@wNgk$0B=Y(=A7tDGHVwwieqKR60K{7Uchb2
zB-UXKdQcQmSKGgms?n4=`*%j9t@BT|iN9C})%uBeTE(<FbB^&N+w)X$`(3`Kwx5jU
zRl#-NAJB>z8^jvZ#Y%>1kd&84=L4fnY|1-;A9F}Hzx<0f09yY-EN86xl^-$e!CYDO
z?-FZ8Ii-TnV%YVmuPEy5D|RXr04JekoC4%pMB~G2vqacQ(bm<Wk}U$`xWiL{>DjDC
z`6W^-^q`y*G<e<ev8lEex_z^(pFYM0rQKSsvUNg%imzoR&W{u!-4q!!JVeH3bXGRX
zUJZV*@gM-2)&Pe-N{3#S)PI1SWV>qYb|a9<ooq-Nb!qcvy77yUs~=$o=ot9#qoH_y
zp|VCxvA7kv`LdD^+*ja~_eP8D=N(Dtic{&Vy~4gY)SfBg!(xcriS|GpkeS1t8ZZ-@
z`brxFgEZ?Vo>0Vvw1Uc@$>BemG!u0>+J1^GtCw})4lzDdd{nv9H9&dE{6K0V(01%Q
zanH}uPv#3tKR(u=MYT3&-|9nRy-Nm-0l^+#LE6BQWtu`_)RL;Q*>JMf<zC0e<(tA`
zD}YcFia3ePTmbnkKHoD#2ATep8Dh(U{d2DPic(`ck)N>}QQ>K0k3+-=d6>{k+UY7A
zPTq}B$Hqw*Qf_tjSu3EDI~m1nlmXua6bC1)^EM+{s_(9Gqvwo#j@s4<@uYO^Gu2dI
zmv+P;(@ft%`GGpvl&1y%x~-f8hkm^7x<;uq;OH@OY#d(Xy~C@%sxN+|jER0;Js6*n
zD^|`%M&H;F<(X9BJG=L(xahFbm*WPvnRddXll>;>aT1Qr@MZp~z)WYIWT#|!c1MgY
zOU2T$0?4DmyErd#dwktAS5HNj<I?-i71t9tqZsC^X`||rEk~}AoAbx0;g&aQRzl)Q
zj_+_pm<t2Dx8t!gHRDH07@yBlAAN&3?9^Q9&vTKQ5Ns!-EBCn%lCL%ucfYI!p%qR1
z&agHy`mL4jPPAC&#?;mw%VW!^GSy69Y&5^?79~m(1NM?P{{emOpCwyLe>#u?Mpq}+
z=n_ZazebhCMrWf+Y<V2p*zxb9%5RWIUxcoU*hTp1^bse=luusN(2e6b412yOedx)5
zp>)I+G=U0p+2|Xx90@e*dGB5(9VEhpp1Vy?50sB5XI^A*H~_4-`ND0ONUqw|Y@cq?
zHq>co*_qcuKym}mZ{j`T<tNo<hcxf{sO(-zenzL)_#;R42nzPQc1S^`>eAk|xyot~
zau-uv9*q<C2!{R<V5^B#&%ze%6#crH42n)GMpO1(C<JiZP3bFQvyYFQ{>h8%!r6?I
z4n~wM{(v}$9nu7RQeQP4tHu;_weU$bThs4Sy7-m6WvQoPg$ZHKVa^IW36>BwDrhO@
z2<TqwS}hY*wncsF$+57@7|15u2B8I-F{-%}^w(?`t0+rkmBjDVH$}@}`@3h|L8EYf
z{>1`zp;WUJXyVI$XyWBc4ie1_eq>UQqqNM^_uU&P;nlA|OEI6v=)k>T<zsHsoI^XK
z)deY1n)KBVs>5$Gt8GUjjf$JMfrp}FQSDRCD61nfb5f?=Zbx??t4;w<{Mv;s{i#!Q
z>R>@*owzGzJ9&H~$rP9a+bud@=`S6eOP59@xAHu(>&lU<;9rnFJEyjtHOu~o%C~HV
zxYlOa_@y$6O~0$4F$lr+AU;aJ`BRG6JQhVK2_`=oAdPoMV1I+4)V_c;vIvky2CwFu
zkI0#}3I6S1`*RBZW7CNdHZga;MhEq9E42st*0lAjq+1scl!>UPtY|4O(wvWsWh&^&
zu4*1%y4e%{Cabu60{P_pZ5p9vQqlwYhZl#MkkVkAFp4k&q88@WIl9-=q0gcQx6{nm
zK-Ule-}v^~l%o1JWVCvMP9Ff(@hMwZ%*`|D^3V_Iau<fFk;RC_Me{$T%d-p#A2T)W
zbh$^qL69+l88BxAO{=Vin_G_k@z=AV<HuiYKR@#{{_kG@bq@06yRVjL-dWzmtRS1;
z&JwCaE@(9&o&gQDVJD5GoxX6OYy_QtG?j|)o&Ku&Mwi9tYv=qR;=sfgGK0c8%_d_B
zFxRstK)DxQxDntZ{tV&lV5;(~izQ#zww9e-I2}tb?uf8IFc>6xG(IJaKT1t0fyczA
zvT-Dy>i%S3u>oPq-bQwhy7|V`Q`)H+GqkYK0rc6aSW07q|A)4>4vTVK!@fsBP()Ca
zlu|&XTWLh41tf<a6cFj|1_9{?K|<*s>F#dHp}V_bsP*2sVz0HgYsdS3-ybkAz@f+U
z+|M1?b)LTy7+d~w3zij_k4<KB?QAX+#hqQunpfWLz>nY~FY=xD4gjDD9^HRj(gHNY
zgBuGv#r+*u84{OG#qNL3B8~STCq_}rxd$at8KjelPpaUf=O>LMBJK8<hXT<hZpgpA
z`U-K}CrgsmUc1fjycY4s1FHltlJd~qIWq_3B%3BMWMrjSp|3UtO7>0ey;!i#Wy;g1
z*wl{<4oaAB*$Ouwck5q%;=gp+;H>OTR4vu^d)+rh#bhLPynWx8;Ex7p+33jjmQN83
zTe3#7T-(1`109*<9Nm5rd*w2!d<4*(`)^;$ySsq?1%1&D6d^La5g7Xy(2}+-vL-u%
z0jMp*+0)r!6{R$fhSB<$m?2_C^a~Ue^GgfV3q4<YZnfpY8j0|}e$gl@PBHF{Yov4~
z3H_5*z{<4mgWXWxW{t)an+n0OLR5a}LW1szr9l^=<z*|t?Wg6+-x?%#R3Yw(<Q*)$
z5Xh>*x8iLTCB1}Ee!A+5j*m05g&0J$R&x*JLkf4%$>#)^Ar?i%eBuaG6^6++$8P)M
zOeKfkVR5m!aXJ<m8V$NyHzh6Dj9zLa{{j&l5340cD3vq%%mlYI$#NW~6|$~GhThHy
zr?kt*^5&e85<y=?OB{53zoP;Mlp<Ph;kTw5>-jF4iMY;l!CGRJjZkK~pq$wB@5g*d
z8wV!P@JI{k{`#@W<?fN$dP3#7%2==ZFA&=)#F=X5ni)go9z&JyWBGz&7$YtO^Hx>u
z==C<v4d2>C-^C2sAHFE7-lR)kR1?)@E~DVTl?(idc64}2J9>Sc`~a2o`pFUGFq2(D
zSn3u44BX`uHZzMU*LCEO#yrk`Xb?FyLe$yE{B+0{6*V@vkA|;p{$QG<R+o6|V<l6@
zdm2oH!M$P&t+t91rya2fbPvSWO^^!^()DHt;aw?~{$BFoXnBVLZGMLyCljWd7uI}_
z20EW@%PZeis~MPhdk=s)mtSBHOe?9B8ku(QTtH9w<742Goho$2l24!S7<C3Db(TNM
zpfEng?ME?rKo3!hg$Qnykf=g5p>%)d?h1GbH4BTj@?CG`4ZNiT#iligHXvOCAeJCG
zd(Kh?$DoPO2@sRi2IsJp1DlG!fp+}v`G4>i&p+;<$c(DwqjtI}e2psjr_8oARS3fP
zzG>U7`YZl>@pB$cM&ch<*KiZp`nR~&W;4F$hh3H@&uY{wVmAYlrwpKp{jW+ul37Zz
zI|O1y84o!*BDcvc96q+G$4pWh%Uz>wc~ZPPJBmY$$)iP8YJ8m{PvgV<8b3p6dC?Q1
zmp792I3c5Bq}oX9Fp6pX*0uObUCMW5nPa2CH6UQGJ~>4RR)Qnq%>YN~9T=rc1RpFr
zax&z!3x4}J>@`A#quk1Oh)Th?4<buY?|&;JzB1l^FYpttpAc>rcW4HqUPVEE#A6v>
zPY!K&-^c0fKRciP@!r69pdS^CRA&ENT%spW7m!)!%0-BIz4c(N?ci5X1xO5MrIqtk
zDwP*Y>s<}pbb#MF&L>=~qWQYE*?@Dkd30usjLp>A97~#DqBL@`41VX>L1z1)uP&qR
z8~-a=n(<JGS%g4HT^%7I3P+eax_70VQ!;r`Fx6prqg^CEIq$10J&+~6wr&we94tEc
zm|Ua46eIMk;{cXf(mA7KU#f7?eaWi$1+v1FmQ=ncA|Pbl&~O6vMUk8l8*1NwJdvW_
zw#RZ^jD?HZbna`5xwt>Ze9?WnxF?4OJj*KgKdBldS)rc<P6u9J%**nQ<LEr_8_B7G
zQ)l$Pz?Uj8RS`3e2Y9I8VHLrNKhs>L{u64l%Pq{6Ynkqw$t^t%l8;@pSqm{psJWhE
zP!#pT18uW7kFW$|`S^$;dfwGEszlY2l7oe^E*P$qpNxGQ7)wA`y=QOtiIjNzFlCmm
z*h9j@xs#AmtB3-1j`G40Gt9%)OdaDVj;0Q>xn@;@liO(_3AxApG6OkX5nudX^?6Mf
zTN~tAhXMgotk=9Lwi=X4^;Csj;6qu;#D(91i#b;Wu`tzS#X`_-S{5)0)Cid<8XN~T
zaz}m49deR&I%TB@5C+(m*vDsOT-1QVlMj$D)Limm;S*y#D}A1i)8!N;F6$i0fZp}@
zinJUTEL(5c?Ts<%ROtd|)Q}(SEHAPI3RLZB{~;mV*RdIG;#h!s5>DF$>X%N0V<Ngg
z!X{)^nk?0w6&0TB-aQnH1$x%D=eD&gz0ddzVulJOC0>@^UM)5s<8kV1pdG(z{cU=V
z0yxmD{!s;|;!X{qe+R&-JI!blaChi6dAIM@km*3Uo_KKtK7B<_wZXx!Rq*>NOz{Hk
zlQoCyHDWH)q6_J{n<l^={h&B>s}3r)=Pt2g^D2v$aUCaH3d0{R>omp-#kDcwi)*N}
zLH#E6X@WRi!An?JaOo><gdy)T$n`Ez6-e0c+CDB<@@r=7Q%y^PF(FJ?iNKzW8$5hp
zuKvr%)OL+0yz*HOy(+{0vg-N6-M4t0u7uQKZ4gTmRyJ1)RUi1W23~O})6M#$lO#rg
zBE}@hOKaCxqQcJ>jyaby%+%$#yIMx&9rMm$iEBu^ScSX{$-X2~yIen=3+nv+seHN-
zTMo-p!Sv($rBm+CBzEi8h7Gw`%xiMNTyJ7`Sz1v-U`jg{pK10JuvJr|5_y<+zrRxs
zpNj??G_&ud-g=Z6O9ztTdkPf>Il_yoK4Ztph9IW?%6H7L+Gz!Gi^g<njGGZQs~1j{
zQL{q4#F-p&_mIgyXe02hwNcR6hdx;TIcDk~Lh}37_jeTGGZP)D>V|IfIJ}HsLq4AD
zvT{=1mL}e&bCzJjJkHVL=JiW72<s?Re${C-9xB~l=d88_F>4*g4>s^fEYFxtAvopA
zeShf0$3v{}jXC^0=V=@N8vHo2%YJPn@uDDk>U~LbzkG>-gX`Dg(Cg&;<o@pbadjk_
zo>oNC{>EPl{G^5$W(W5_eoq|jhG<W_%Dys|WplNwo!0VK3ac-UsR}QtzEfrJm8gI}
z!NRlRS%n}u6Bd?5GY^*Zy-89Ij)n>(9|Cz+wEHq!ZTYk`#bk@g^CAzqvIqbXj=f@-
z@O!P`p!Pe6o4tL0cuVRsD)?tl(0>baGd{Ke2|m?flJE0`bkQ8wD!fPT*~*Upp|#FG
zG4`CH`!uE$ZB-@vWa5wxdUcXDTTofeT@0+VP*lyKrynb2G7Q=<pBmj$G}US=ERhTm
z@x);M1Ly|JOA|TXybPp1g!%1rI_E*}rV^?MT-uN-4y-lOp2rk>PPg3rlC0AGt)fBy
zE}Bvz(sk4)-WGiky$038t!0h7=&;D%_<+Z&w3HU#>_;267G-5TY%;y~SEq@}rPHL&
z*+fo-fYwrHgRJUlC9qj+<A>&hIi{@p-%c_=zkENtq<{C`{}|;kW-C{VKbp;=PxLuA
zA!%bzLyrLcJ(4ngopW`VfE)zG_+8wQzDhVO$}!=515bb<O#h`IWqvHKEb|qvcdfN8
zU4d*({ImmS5*Ca4I3GS-8#B7`1}B)Ml!iL&M??%Wx_Q!zTRApeObgO`E{VJ)K8<ru
z<FxbMdu{r^KpOCoRanJq%`wtmmPh@SH?J_zpgD|rQrq2dttAyhjsNnPt3G&eX*6J?
zJH_E&B77CnbHOe+Vm&2UvF&|S>w5k4;~A63S#4X?*$G(}m*<mC>;Lqq{^jSEDrA04
zmJ@vY9iL`vdgoh1yUm(!poYI`kLO&!(aol|ft$izkc|AYuA}0~y#uD#8jZDrJs!PE
zmbBxKZ36DpHX-tr<wj$uG0ZT?R{=W4>#HNg+M&a_{F|c=Jl^h`H#Fl|%DG-=G5(lk
zQ(ydRa=mAXpWy+I==#~4G^bMGcr}}Ck`hsfp>{l3Bry)qWFv%@5mVz)7vkU`a}0kG
zIPA|jRSDqUHDb=#13<dlptvp6=CgIiLA%B+_q26r$+Fj@(9?3QVsRPGw(VwL=}G+$
zaec|!@=2VMqa=W#WmFt(Rw=HWfa0a{eeel*WfTEMnJ>fEcjHUn^i%<w7{P{U9cP<B
z0!Z(fCRTWklR-s5S1cs{Ed`%Du+8e7kYzQ=w$ovr!67o)L%L7l+fj)WF8{V%p$$lA
z#kt<fkr8z3SazIv^f*XGt3S-ZWY<|1SZKGl@APoYk~jc6QT&o@Tx=xOLsX<0O5hy_
zEcCJ#E?xvQKjp<SJo*rpb&fw7NM-{2E$G`t^dfgMfP`j8>hnw)rFWfTw6$=c<nsd?
zAXj3k6AZqGg-sF9T4~X;ieJJVu#T|l=S8p<FIlfj?~}MLUsFuX&-xgr(7rFBT@0hJ
zC*YR9AFD8bWTJTCk_skxMfBJIOHBc)kaS!wl<y(7bE{lG<{|6F%5mgvHjn%6Si<&q
zzZ;=~^D}M^ZGZ9>`i1nM6${)O2&Rkh(=1QZ%AMbD81s@CWUlP#lVa5v9DjY?H}a~&
zSZmr8Lf|sH;?|5dr)K!CQ|+ll#!obfxFdD571+0h8F-CMs;Xs3Q}l?kcg`ATO6$~E
zrm-e&aFO7Bg_)SckaXwJ*(xlaS<{M(T{0x=In}X%oL6GGx^BJAlj7!IAY##0PSo!o
zZ4R4z8_!a{3jKg3Wef42j)iil4bn)36%N+G8`qOG;%xWiY%a=k`gh-eYxWLYxJ$VW
z9O!{$hf1nq35tRqsb)yEzC|IVUkbc}>J}Dgrf^+6X~DhXVTzJ$5c@<_bcnjK_w<Nv
z0VrYRzU?b~*I-w`jPt5g>mwqAl8JB?3*^e$nVj*>;JK`umM`XKL&{4(I>kIBh)rCg
zD%B7?x-~#5p)h!GO9RFxR~5hD!S*<$O`ZYqemTjlwssl{qoU_8;#;v+1yOiHN3o<s
z)pX)?p#q&l@Ls+uog)(Y3%YOHXYcy!o}Aua#L<VEU9$JF@cpmV2VUR$ekZI+l0K|+
zw{wFsw<&IXK94t4+TvB>x15i01~i7n5<0uwrpMy84yCJ;0I-;K{^ZihoGtb99rjOG
z#mA7`?v~~$gA(74rs6vWczT}7stctbbu5aSZ_L;&D;*d@2?6e-a=E1SXu{GtE29T?
zQ{r}1p-N7Cmpw-&j}x>`Mnj0|$bAc6@te@K8Akqo!n!s(&sHiaka_?i*4_c6g3d#m
z8+^%teywX5!lg(^z)2DR0iiKT-d8Dw$AtT=*yamKc}}tm+wCvd91x^8VQY&fgpi{u
z9dYc`W_`-E)W2l47^uBNpiX_-YI7<v=md{Q2;<D8b7>^StL{_C)f#h3!Q)r|i|>B-
z3THOPVusX@vZl36j#Q!DN(FpvXBRAhUw*4>mV-@@gbV_sr(ius<*Xkjz1#eet;|bw
zA|Ng8#Xw+D3b$Mq@NN{)4z7Inh*MT3-ms3WMlCHU^pM>FM{cQ4>My*g(lnou(>~^n
z|HPYngTl9j5k9kZ;|2r!ebECaSuV75;SGgE5%p5$x%BP}LE`C6GvC?2-TOhMsfft#
zFGcC(A2>O~?CLY$vbZ#ykMk652?+Hs9g#2~{F3?^Qoe0lRp<?w(;`b)9T9A|lW|lj
zA1}F9VTn>uLdh<J6AD+yqL+)+@e_F-zsdM69io5aP_p{xx%D60#J{XP|Kw4`295M+
zD$h|a84rrDb-=Ad+FWr{8h>onnlA0QeMnuHU~gW%vCfzrX;wEa@IboLe%HnnolwX~
zymG~nNu+%FTn3C5sj9M}tapV5y<6w{R`x9))Rd*OZ0%<_BykCWM+cO`%^uzc(-bI$
zlcT7m{6+W<n+?bd2{sjZ&Weuip>8v_k4^AuYV0`)ioAgJ=EMzmYdx;XIKjHprYbSs
zE2`$Q@NI|u^+V^Nw4~E+6Fu0?Gld?k6^D*NhI6eWVg}sr$ME`+YBHVZ_VJZ4E<8lu
zZCRaK^69&U!S<x3oRpXdJ}|kohnKy}?r!H;LAYm#O)y`wNuK{WV$gl-tHh_Yt{LU0
zjVm-_P?jgW9j!x^S0tCti8>$j!ktz4GI*m9AISv$-f+h!%^RA2G-Bl}W<2$^YsFq?
zGsn7k)Tpq8EtVuN*V_Mg{U1V}T@t?m1TNFtR1H4yl4R{|y-s+8)G$_aiI}E!`mA=)
zVG92|N}AimGsh)=ga7pr?bM3g2ECvSL9<0HR;;V3nOcBJm#}vOP+g7KGuH6&25P(#
zess1KN)pw04wDvw$2{c~nhlW95PeheKC!@?R5GR9(3kfy3JP2*nwpTaHk<o#u6_iS
ztXjW~t`RMB5-x^*M=L1(dp!GZcY<jR^ug_+^&7<Lbs^uUGl<=>wO%C#xMeMOZ}v2m
zJC`RSTJZF^MsfIrCz-=U+7|K#g=bCCI8U=Bbyp`b%RHo<q=hRypnV}WyoXEJ1odIn
ztmfAzesssxQZ#yt3^wrg)mNf!nV8<ooxXxf`o*J;Ok<jKaOB|ApkgB(67F|_-2-Fm
zJ_%obN>7<{j@UjcZ&^qSd)%wuGPX~K-xHwo_Ir`=ik)$^`#asXy}Rk00uDCjm(Ycx
ze+OOg{bYmNgWg5DcAyGhZ7wtm39pJ%XyfmJCyksHsmrp0i?qlCX53#7p$V9>lC(k?
z?4cFcUJ8abZbL}AEX&C};7mqjG6PembRsWVIp)^}G;xQcuN8#2bMpD{lA!Gvd3$dx
z<!>7$L_Iol(I4NiOMd14Otusf%*=;oN-%HLa7(90c^BSv!ZbKy7mLeM*=M=kyA(Q=
z_=8UOV&ja^<VyqE*ExffVz*E0-@KP%%*&|E(=hnA$P=pE<wNAHdI%*rl1DY%Oz<KS
zi{;vVAfY<-{;lJoq8erc#5fZM5i!ct(F@U|V(NZ8Wo>WmDB~BSrId1&c3-Py?Ks2t
z6`y-u>lROaq_(R{r$X0j0RL=s0;UZ$-7kNuMEK2-^Z)j9X)l`JBd-(5{}FlJ49c=%
z)kAQh)F@*F{xu0BR8Y7U<AgXl1oI%Y5|6LE`NkdP&m@pf?>+G`Vow`+)26%sqWdQC
z9k(VP=*~EilmCf`2mMfeZ6ujq2O*5JgV9cIKs(gT--sgcczTed$Hy_NWYmQ*K6^Lq
zQ+pxk;@V9?51~Eq#M54Oej<>g?8$&*LL`0!-D@OdUvpd(_>3B<NXU6WZdz+x%Mmae
zM6zn%=M*^{$0MOML{;ea?TP1@d+k+WtS8&0D1mHh$v**x#(Zk&SYOUnLK>gLV3L)7
zNl}b0Mm|xzXNRzvzzziTlJ{mt3eFS%os;b+zjx*Di8oe3*~b=*V>L76`4_DNpQ$$v
zAHOno){3TB8weB@<Ezaj{gpMrxU+r$+vZo)WdN*+o&=>fD;0rb{=nsN;0Zrqxb`4s
z<!xlUq1{vKEsz@bW!rv#C78{_-%ZJ?Xl4sXpXjb=ac=%-dv^Y))XfI+Hy&kd2)7;$
zmi~t&2#N2GsuU7Q6GDlr`DMRAe4IMo;ZcQSGt?4vi;cNk)Iu<as+)0(zO4TOiMR-Y
zr(UEAC}(-~<G=xLVo#-LEpwk!zaUL%d=>hAWVpUxt#eEUKSSWV4dpgENB{6KOU_L-
z+wu)d11iJEZ%Or9owDy-p+-3!rU*6_>|#A?`URrX4~TaTu=OnIaK84E6Zumy@(O<~
zu5NUxXPlhL-`W$Z)OV3qU{Jsp%sL2GtJP>1oi5su2m7!m0c<k?6!nqM=bEJuME)6z
zs(O*Tw+T%J_Xx1~wFZbCz3-o3O5d@qKUFF^MP(8EEh+%_GAdy64{lrdj&xLL=t9u!
zkK6AadCh{h)W@RB$SEq>TBE!MtV49+TYuD){|CIt?|;K?scs<C%ZPcRFkam4ye$`D
zd>t9SZ5HMqNS7LO^lZl@jxnV~cn7t!=kP<%h^{&GeqGyhyS9}<AFd{|dr%?XmtRRQ
za|Nr_6JogNG-qTr`uNvRbI!>?tRSd#{%c}w##t#Rkh8wazqC91Zduv}WM^DjIZ=iu
zZUKMbRybL?Mf`AE8~W7}<3bYrCYc<BC*zyKK}s~S!sw~@=%^7Nr%{f?YUeQ73J7wX
z;TWUe?E$KNYW~p0W0%>s{FAPsY(Fw`ilfp6chMBr1ZeCzREvs$#=bPJ=FhBttJ}xI
z2vL!Q=BTL=0E~m`7<Vu<HW+C7<J{BMyjw@^QQ{$-HJ8y8TW$gn{Jr}<%=g}3Q67e%
zDc7x<-k^wwv@OxRNs@%!Mmm;*vNH0#A@Yer0wWIZ)T9dr@*EyD>GzbM?7Ji7f}^zQ
zNo4vx=KdVk^fE<S4Jj<_cH25abj({87r#d!7rq{;`$q(_hDRB&^jra8G#NRZ(fQOe
ztr4pOCl@9PaZV~i+K7}Mj=}YsAD*6iKt$Cl{LdZvzwg*1wwFFyF=0(a@0T5#)P_E}
zANmZ-v|(>v6DaRvmW|dy2eO8Nf%2jOp*`2CDVe=X(sJF7CafgTgB;QlGqViRS);DC
zaR9RL{<_&vU2}4rxJjrJ0;W))QS&H3(&pK~K4D^zVxfa|gv0}SLM5zHTG7`1wbldN
zD0QfJrJhr2-64YzzCs_yh5=9LbpjOQA@Y!bB$PCbEAwil+lwJ^I?3s==2ICH<TVY}
z<Wj1FJf8*#gtLttGc2A?#M@KBk*DGUTGLU}0i&Su%K%QBIi0f(ARi3sk!JJBA;A~=
zqo*BIDgOrQF1*N#IXy=mv-)*AK5k}ByK*O|pR(*4dj(W6x_R>^@ifio#C6a;B&B0g
z*>OBlq>$=kNb24HIy5;FxZ?aet<(ADJPHEtI8DT#L&QBxQVBdO^VRl9bcD{wBU9fs
zWCBQaW{Qk|=Q|3DhUToRbEg(6KCK2yN;!ouS+_eyI?dvlh0T-AVwTP%X8EKWqY{@C
zOIh<Hhh5)jq0YMsWc<jT4HD9k!&x8|WmE!HhP88*=0a1m59c`|UHn^Vi6cys4#i;d
zw}^B5X&3juGoqji&cN{XF9?F;Sgm%IOA2uUT2%?q^U%}CL98cd&S?N!g9bwgSp$M)
zxjf0Ox_Rp%jao!^Ga*VOIfSbg35}V4oSSKzMsUjQ7sHnz{X;`*ps7V0KN>clV1+mX
zoWR5PRoQw^M>#HIsU|0<A!Dkjw;kL$DaP%|#FNw&L*{q@?3KOiZ6AQW3XKM<Ve)EW
zqP481Ev~geG~Z_T%-mO3VNa-wni?fsl%Vrc+I(;yN;&V^Kut)j?aJ1cY5RT<fwi@O
zxWMk%e3`ACUah9G08lY7`0m;M`bhI7&**8oK^KKeVv_+*frJeg4eA?VsihVT5fZze
zS1~IBGbG;~+1|g~QJ5OzkY+Mpd9vltLS`+ZHs>W5&rNKy<vlBar?JMukj&Bqs0_i8
ziXK4fR6&o9X%Seft$ig-dUgA2?t`_nESCh6p4Nn%fhIjq72w6Xm{9FNm^?A;$Xe#V
ztM_JmoFRR6nMhzmY+Ebf+m}ya!7hHN`v;l^!Gj!h6N(!kktW($*JL)Nz%A4i{TZt?
ziktjp5Qnae`37l+$uU1%F3}6?9!#K#G2g!C_-32(<z{Q?f2s%ldHGk|@;Z~tICgsH
z+cg*3ZTfPkAQi~oBe+QH&|~k!Ld-d{X=zsmBDgFBN1_LlqzZ{?>C(nG0(}x~W0}q#
zhH^w^6c(&R8H<{x|2gNiOj1s=@^}2J)nEKlvK4$x%{>gReP;@WRsqbVj%^R_Hd`Ed
zEKx&BPyuWQ9d{r_xTa-OqI_)eN0?$P3ju8AVwdmpQB;z{37=y(tM5k2wl;Uux5{mW
zu~inYn;bdK!;2;D?oV-^y@_j}KnZ-R8NArbPKHU&|2RhV9I9!uUZFUe7n<Wn>2ZN_
zBqgH8%wC<OU_kd6Bxvs=`K$e44}O8@eYY0|w)Uv1J!umFsnb0EH;}rLw^iSHDIY{h
zj%6Ra<0+oLSX%$a$q?tNSw^h6zg!y_5jUGauu60yVu(v`IULm?!ShxD!y{tid=?_}
z{Yr@|R}b5ZEOCz_TpQ3IOv|d+r+S^^3vH}c0$Mkh6S=kJ?27TK>{Z0*;7Y~7CeiG4
zx_T!Bg5`RpmP~3s{s83KN6MNz_SqQjKe%2`%d990X8ut3-;Wyqzr2F=!Mlj*j(Q=H
z+WkY#HVTpq0%}4n<Tk4m)|DpftNjh67@mR2nmcHv1lR>M=bd~n(0DV*H%}V`Y!);m
ztz_z@lI<2YTPnsDrshp&S@xGZMufPeks$ez-^Z>11^oFy(U?hb7;a>E8Izsq@as(B
zS#&wKcw1Pwzd!Va8T{CyuJgfmO0r6Pav65IT4>#M$~X49<lovgwM-bg%&Q;o7-!8Y
z%A|Mt83&Xx%&O;QG_#F|Au@iLVsYU^dNcbC0LHnst1f`|=74s%#(|K@21!wJUU?KX
zT^X3eYnCz29<t_#2G^m}+1S*A(A3KIMnIB`P_J^LhWW=11+;isCg2Eh^te+8t9?;)
zdbG4)r53EL{u$M&-#@-G*tDpwe<o7&k=PsSKzYs9WmEY;LG--rIbZW5gIpb8EjZzU
zQz%d0<6EbjH%L5&Wm_Y&1Xxv1c>?%%RV9Ws?tctK1T=#chtFa%3t@!rpJS!YeT%0V
z5AEdfy=>^WCu8B9#!^zm=e^zN9iapR+;I2#P{gT7eZiB0lmg~Q?2Wy*hez86VsD$H
zXVel<bzr2%e%p$+1|=~oKwLv*>Hhq>NhIXx5~E(DtGjBp4-O6Su792l{^zfOUD^lW
zoX|*UyH%sefL{#$yI+iBa5U(qt=N#N&)vqDFS3{{o~M*{H)HcqS?UaLW0%Ta$@Tq5
zocmdz_;G8WbN9^{r%U6fk6i^p_5JP0l-#$b2|E4wi;*WTk?ex8-@2b_=@DD<iLR-5
ztM)oF<6qo)X)qzD2OZe_?&=2Iy&}z679E&@BAvJ19Q!qn0>&gmhB{m0ee-7t^m+&a
zm`o_Ex!Gi%fwYNKU^qbg9U&PL{PtLYT*li`t{<s5^|Z3)+I)A9)Xv1f)N(wv7lYQT
zkPgw%X5QAl3WocbnrAJfu9~<R3)@y+WvFttq`yEm%u&w|BIdJ*K_kWAQ~e7w>V7My
zRxB1?YGHXPP=~KC{Y4#4DMJk7{x$Wl_abna+V#*R;X0DcB>&Pu@Ka^@r~sadt=q$b
zow&@lJ=y@Nk>_eJSzCgyVAecghSavzab~I@JeCUk5wd-ZGehk8QY$&~TYlFGkUrhr
zH#W@z&4Oulyvmmnkx?LFW;NH(>uIET{3G5_2P;1ilU1<Gr4M?3Qq%u!HRq?lS6s<6
z6Q|n9>e+8ZGJC5i4cx7j*pl>dEHo(|=u6OA^gEXAV|AZuR2f0#S1QUz*PAy3Av9>L
z&MN{BY5`+TS)6yzF>mu1h}16-3g2Sx+fn(cKa2$qRBO9sK}pBYFHV|@?)SwQhY(C2
z*>FMNWM=kx<U7OhY%x`4vkYv4Z}2^gMB>Y^GbV*e-*NFaV_(Mz<<|CS1=@$>AH2_@
zOWx;;(tqZCS{YZ;=y@ydIh<8E7VSNFqYpjG1OJH$7=Yna+uM<NMbA;i4Dn#&4(AqV
zXIpnrkQFxGq~X!-7M<P+mPX+u$Y81@it&UW26-4`C23PYLr2B%0S}C%E?kpTevUYH
z8tt^j?{BOEp^X{2Dr?a;tJO|UWYaix+(tdW1we`{=IlL4tk9ahMb~uY&5qg)9s7F`
zgE<t)PahyRUZa$n4QLTV?r9HM7fnw{OZ%!;$g7KpEAlWI5s3PK!BO(0OeY`@t0mv-
zr&W4~;G^y$YqHOcuds{2G?b6vUJKQ55D+QY??n<1g5ATv#9sbyid0n%((TEwxdla;
z^on_O>?IbV!NT{nHyy3!%@DEsZ8<yX@A+?kCSq-Z>wDxZ)W5w>2&3qbN}hI_p8P;6
z3U0pc<Grrk7T_%3+THBt9&T;cXb)Wi&;8(fwf*6%lq6fBu9V`OSuVt@?-Suje-{VV
z*c~E>loWT!_f3eKVs52s+KM8B?(_ubNc3BlE*G<|-tO@YP1CZm{Uvf5!d&Q|IGu4d
zzQWyTVznfYHeRf2a+xRXsb%l!?5ci&OgmN|>K@Q2Iv!`hPP1lUOhtSBZ6ro%zM2Ce
z432N~&c9y$`m)mJ`9zav{md?ks~D%@d~EF8Jp+x~bZJj=W;*h+-mjImJ<M$*uUlTW
zTNdo*)(%FyF`u~@m7%c$HLyri>j2*I$76(q=%|(y<fgXl^v~1F46=|1u%+dTeXciD
zVta33Oh?W@i%h*(trxzWi##yGZVv2#C#yX9Hg<LOw%7X<WL{A}uc=6<w6Q3JreTNa
z12Dg{h5so8%}C3Cqk9H%8G@$3oFg(S=LmG?05-R<$j!OjE*_x+N|eA4;F4e&Xbnz{
za;5(-r^d%XN`-x_atc)_3o{A~C$K9yqNEhPK|vn+l-OU>=F;Gq%PW{-tH#cM&y&eS
z+<mlY+=Vst!yTO4PXg^@mx5nl60LX<?q&@Bs;5~iiEff3D2wB!i<j60&?^wdaufS%
zo6+0y1V2WEXn)D$QDJ0q_w_3x&xJS3DD>KAld5;pi@a0?ZYT*QjXqIGg~iMYMxJ(?
zi%cGo2j0i+(En?Ll{f4hU6ThRM{!3yp~73O+C}f|#Ga|Ko0CStak$K)dQ8Z%`~+Bh
zbWFgcqM?QFpCb}Kd?RC|8AsEcD;SIT8pN^{-22uZ1TT$U>dH#Sm>BLw&?8KnU{Yo=
z2zR{vPLHM(Tg(ywKb&j=Np4Q}XVc!e+Dh#N#@B2OaI>}}!a4L9@k;#_b(gUYmjsud
z&NR<BYzK_>nus$2rUj(B9ib)E=~{yKnQl;i8=hxw_-jpCydj%;NZdeJNl+_GTdssk
zF9!q8^oz`q4#TC*NJ7QwyG7oB^j9~VnoA@<*Ig83b#mzZs{Du6H>!f87d%&$y>UPo
z#Pa_D<hjhadf=2b>W54L9rPD(wv1zGou;vR$M;&EiBgacg=a`*Us49MplQ!}57eU$
zjtXLO>!<2(q^b(J%-!@zQxU!4J1P*fs8x9T>a^#YyXx0ka$OF+Gm)fYeRhv}YtsoB
zy(T~0+}rH!{YRW*n_8x%v6^0B^85{37XKTztOW&ya_>9FauMzQ(_NrJg(A-i_jHLO
zDR8&bq)4V3&+$i)6UaxFCux3XpJICIBWs3>(Y@Y(X6y2zl4v{f;=3|OsqLEwXp#YT
zsQfGiCPjI*gGTo#lc>xV$q6(e&8DI#5Z##B^yIuE6YI?iRp|<yUAogJ-VBM^zd)h|
z9JVITHluqD;_p`VTOJHDB>VmX5e`G+X~ia>1PB~j+q(4|%@%4K`nE3W06sEU)^AM2
zR*LT*2H+#MR-0V>bG({+>Xdhmb(=!bV%}GBWH@HFXWq*GLep`j)_>lT8pOj<_RD7=
zF76gqJWadA<h-?7dt<VJV0VdTa5jU*oQ5>?s$5V2@#4%_k%zp;yR%R8av-x~j{E|+
zuR?;^lyL#tBsTV4cJG)}Hf@vC=ikx?J^!hP2hNWFA8<#ZMqiFGR#la)m~eRXh+bik
zOe&nu1q_ojDe!rTQ0Ah%D^7ZzV$&fB+tq-7?fKXw+aMB?oikRkD`9<(#ossT(DA{&
z?}l#NUNL7daB;<6>3L@G-N=zJ)mDF$;YAC+{!8CU#RRn3z9-*JmF~2*5j&QR?P*Tu
zA2lBmk+@x2ln)(^paYMDSS1SMO+~m?Z(3qLlWFF>UlF~<Na|3w5O34GLS^1*%FHUw
z2g%Kv*&cJ=g&}D{xu)jYs_7Vhz~uhdUm#&M7a|}+Q+HPS<I|@yR8ig!xSxC`pwK3O
zTGTwq|6;gNf5Z@K(Q-=&w?p-gY-L#{&qaJ(;P?}qKs?@XEt9U3s!O|vPv2!<<1YaD
zSeJW7{vbAr`%W+?FHxEhXIs-GV`sE5+oii;eM<2=uZVF*ZXNK(nN`RY`<aWIH~EJ!
za&Zy+hf3L^;D*6%q4K>VpLzM6LWDw07z!vcbAZ!(4#*WY>To?(;|X?zGiKV3R`%Wj
zzHi?p-xo8Yb;+%@ZjOXAw@4+<h%V<cgh1T|eX$$gI}4Z#Hftg_b{*i7P;Gy1x*9xw
zyq)(!r>sKXIWm;Pm0OjkBl1NXv~I?x&k;0VjZX_1+Lx4g@rMX>Jj?XPXoH8p|MZRw
z^d`62l1kHos!J_0=5=#@c2#VcKd8blU#Ju9L4~cr?xIEWe>+uJb3b+0-JKiYm84xh
zd0x`pU)+|AVn+K>kf&O1z^3(9Us1|)tGF-l6Z>i}0)I(*Ub{>l>&>&!iJBK7UNqFv
z4?T&*)PZN=*Pc)X>ULF>cl^yD!f~YGaEN7x$)qH$7x|{<^DoO5@xs&BAI3S&R**a-
zT<5+2wm7~0t&_N{%A$;Co7@>>gV(|RYRufbNU=q`ch;fMx80lOO7UXUWjRxMU(b;)
z^I2!VK(4J?FlE1uEJ-6fi@pdsgC%h@=r%<?Rcvk$^JEX8evj5Syt`!Fr|o!kJ`l^6
z9CO|u!2!DPve~N@T~jA#Smo?A--8%9OxCg{YMy|h^G^TA_(@7!Qwj7j)$Pk&D6u$l
z-_5BbV~xj_1NC@r-}LU+j=k2}-FGtZZ)Bwb!w15dXh*1=@^Hu21u8#69Gs39S}gq3
zm9;W*>DzpPCPw2wa+5o$?;Ah7miShX6Z6@UM_t_<AF}~QIqc?f!|U$~Iol=W+8)}G
zHmHR<Vjb5mR=A8CiFdJahq7dIH`JAXfv}!Kk*bS!TiB`?a4*N+3vha;F|Gn8*De|L
z@lj!q*-yF^-x=j325({?M~s(eif{PSGlUFm)`Ivsf9QihI}B?64E)Z|@rq+|uss6&
zYiYS8Z2vUnT}M{cCSY=&{>@<!`vVX2d%NO4zW$VpVjMl)dn?=Kg05PfsO{5+uaJOV
zINEFL7Js)MH5^XPx-J9p4{HKuE};jye2xnA+~;$H>m??=49XqKqvIOmDOIto(mdzG
zbF!VbZPN}=%}LU}N=6?6-zAB$W=wps!l*^X;p?oW<X?~#R@3gacN9z<VTY<HsmCga
zQ`-IoZ1el)v`)#v>dh>%ODJgo+z+Kv-IGbInzC0v0p6APco6|cin}|`n|x7?7cROB
zHj5zT)|tL)NJ~{o%TKzm{{g*`aO<|JP3Ip~N41T6P(Ja3tV`2DZUBZQMVsVhK~Op7
z$4qZzYtuMd;+=9Ub)sCT!r~cVBT4sj!Q=`t{fTX|RcL2^2U>(*0xcv#u+uve%;Su=
zN|6HC2G<DVK3?rsyy;ry{A!wbZoshxx9iwjaDZ39erPlt)0>j=%U$9xHi|!JT5ie;
zeee012G|>)Al_K<u?*f>-?|ZUH3QYKXM%#*dZn(mMJ`9Y>O6lT%CZm%-z`bvtnzeZ
z+9qRniKudxJtsMr>FQN4>hWfGvSpvdtg^6Fy%2<Y%BtZ^nf+eokL<y1nHU{c9_Pgm
zmOxzz=xz5@(!L~q-!{M~q?UkYIw@vtoj>J%{B{LV9vFJ51!tUeunX?}eNw)Bu>Px$
zpOHR`!A2s+s$}#`%YM{6;ufyIl0meatY8ZdnlS&Hf!o&G1}gH@&>0n*<tpVK*j*|2
zqe-}S5g0u#IZ~J1r=Js^FxIF09iPtNg&ZJfh7J@6B<{a`^}1B6qXu&R9V4W94)ozV
z2G4XY%+ji(lSY5z>X=0ZzY&}~?jVbTqk4G6EYMlW2B4o7b)HsLOTc?Jx#H-BX`Bys
zML>aA*>XQ<(q!#|e$c8^aneq9vgsbJ@)%PThASExPf+-sP_r>yH{e?V(@_UVPFYV9
zj=R1q=PU6;;qm(Nte=yE-Z&cXgIRniN1@zVms%Xd5z1v-hkB=$!oy!%>$@TYu4x9X
zNeotJcg|zQAgY%!dpx>@pbhTFs73VRk!P0pm~$Jy%A_v6=<wVovGwQ`s%IoUbeStr
z<&tA6tBQT9-CUz{>1~AQUkTAeT5zSx1Mr*nMwQ}tphbR4eLbM>vFSHY%Ud#^hH5=W
ztVM~C<^wBt<B`sU(H<=GG*CbXhFN2=)q+$Vv=`f2VX9nM&Rtxp$5UB~wwlgb&J{$C
zNyb%{&5$uZ8#k@R<6R=wqBrn~p&^f+jV9uf@h#`9ljS52Y|hK^jwAEaEl^2YzVs8=
z`t9;5t}G)mFQVRr%Lu)-{P9HnxBDd^Ys+a`s29{lE$Bv$5sNAZqDeuPzC5aUT*;Dh
zY|WX=Yhdwk{AqWLdMc^N>sp;yVu-UbD=YUCLEI{0-qnd596)D6UVM%n_6IdUVU<hM
z3NS!LDOwQyso)0tYac5f6k&0~a}&GZYj>Uyjk4vBKDsZ4*|K$K4{LgtP%yj8qWNjm
zkWZSP&v`^rvpYwD+ll|}u_;Kgxj8m^DRo%KP<3Af_6(!mZy`Jur$onb2K=I+C=Esu
zQ@g<NU5<mE+p8)=jg<*_dDB7$w?{Ca>AsgIHoXCfjWvsD{Q+o_*^``z8(4WBZbzP7
z35wFcW~b2Qe%tBVDK-$e{erYYvoSPEmo?)-wN4lST@1{-)i#;4D;8!+`BjqC<Ys|L
zWDff0MM{%nHX1=zyF5lB^@^iKg`)}XsSaa0hFxzP?y4-<TxmnLV4|_w)=q%9i@ynb
zTF0tMvHe2NPwQp~e;x;9gpPUFAvj;qP3O{EG_U%{Ok^qrKtX7j&My!^8DTe1gWXJq
z%aUC59l#70bmu42?h08tQ*K8r2H>bS&~pbykpq9{4cl7m5-br6i@<pcS21+r1&e_c
zZrO#H0-neJcdTLM{%m6_x@E)lH+s46jMDuE5|(*FZBb(MxOg6ji_^4Awc%!g^CaF^
z_+(D;XX8GSTHX(2jN}#_C2#7EIOnK+r(jqs_Sec1nxa&<5LE1by4Qx?lkGwopI^mB
zpp!58Ce4x&!1RZ7rQGS91VnF@8Ri7jZZ`(B006N4)n}YtRu0!?hbj<1s_|0^A+<XS
zEJSY<5PN*pu&&+wJ@#K9v$5OB0=sLod^**sLsK+Ji4Nz4S`pr(k7q&|$G*#w8RI55
z6Bwy}@Vd}f!opmCKm=nxWwi4KA8Cy^SHU{_0x|9_Y`jCJfu4tU6~7Hw#LEJK_wt8N
z041ZB*C=CUn;~v1DpSu^!9b#Sk#TU$HF=l$9)wE<fom;^F1$l0d~vT#Rb6m)a#XU-
z(EZEiop#%|rq|K)D1*_^?+RIo+#8pt&3%vDtRe#_VPdx0Cb5ApNUDX)a9ee<XpV`(
zLmTXC<Dk%{WoiCZkr0$(;y=i9467b@PL13WXtMUpRPh{+f?O+eb*y3K=b|t+wbL4y
z^9?<!BQtbYow`2NkgfcMz858b_Q9UhJZI0%mgg;r{kA%CD%hU^a1I#i-RSPGJB_Q%
z?@a<_YVTP468?W>$N`J?e|ZwSM0Ej(PMx=S0f6ZI*`3|>FIn;BOxKSkWOq1fPaoP@
z>(4wYcPWq6p0?5oY#7jmES6jMIx<XeEWyeyhK3S_LJYM~UlL5aO0f)(RoclNaRaV~
zNdSj5j%XXZ*JMj@aUKhXu=!Ka5#Q$GHLJy)IM7#eGQ--s95qk-!O1E5pnbTCIi%1f
z9;CcjnJ}s2XY`UtH}IoJ8T*hO4i#nu6<2s*>O{qr&ZQG$nKqiN(s>URRe_|JyZR-e
zAnE0M3q~cxIvs>Ta1sw$;RYD0t>y}Cw&agp+}zWZx_?FLLsfFs%0bxRSp^d%Sjo-f
zzW%K1t*#yvur<nJFndkiLh3=u3u{5A76HzvYaW>K=C+iWrXn;#dLW{Zr*7<IZM?af
zD8foVq^kO0`A8#u171m^mGuHxTRlu7S8!j!Q`;iSKE5%(=R$Blh=2H6fLWLj<y~Gm
z3K3css0abA2<n~TUd;R#v=TQ9&65DO-aXm;I$wY_UiIUGp_~m6J42vq*Iq%PE=$Vz
z_O<jRCCOauodeEyO_t7!6&GSI^YF78rWX-TS{OA;^DevEH8jrHgRwfegR2)n`6&G_
z%17S$I~8e^SHgT3=r9U(g+}$K5K>DDm_UDHm%(#kFld|*1|F;YC;xtfoWpSU#lS&Z
z3<GVuL1;3%4#CS-N@K11CB0^8&e=?s@F{wQ5nNi~ShdCVD8+X}OWux5z_G+Wlm#41
zOWhTvPQbB59k##!BVD49y$AbPfABNRYVhFQ>za|`-Eawu(#<K_gi02FEbly2=7t??
zAC6mANvdf|Id2t|a>%be@PAx88ok!G1m|3FQ`cy|XO#_V|A0K{#K+<6jXy*?YuP}@
zv}gc^k@2~udag-o)|X?+Q3lc>1_MQ(p0iiR(Ayc9$#(B=bTc~}dc+Ho&z7m1Kx>A!
z0v0n&f$s0QG5KQ*bO;1OT8Wh$pFD^`2Lw~{YJQ@J!1#1v^RAHDaz$cPz}{p7-0Ep2
zDs3>DG_8KR#9Nia{LY3Wdz!3k#uQPm5Ggip>$ttmcbZFhE^LbSY<gGza^VWABtr@)
z4AfVX##!n68U2vIBS}(@Jmg*%aeM#T8c+-!5`h&xGqpi`4dKmb=HjZo70?p+>rRA}
zOY3cJAalD2hzKKc`ne|lUHqfo$`{2<1bUO|z4gC9^p#vgT_Bx)y`^$t-RKyJB}GK1
z4nKfDNJmic>*(^SKZ8|zM>SU2OMu0!o5**SW9pi|iY3}^XG^A@t_8zF^dA0uhR|Ab
z=6mzINvQ@=myxMryIo3aUq7aN4C0_scTqhAW2xXj4X8_Xja7vQT7(`$Lr^93S86g)
z_r>cc-H_aEQV-*5{&h6zLjPdK<o_0L@q-!jBi_Q4m07ekhw#hxl$XqnNT%DX6XFzi
z^lpqM<A|J0+BTaC3t|Xq*@DJi$w!@u40WDA8hbM1#uU`lBx@P6DI&++Tls(&1K;IT
zw;ztU=q}Sb>vEPkSC0w<Qx_mP+^k!$l@cgkl{`9-C>3ej)jFcJ(@-uy$C~js=T1$r
z1EJkRAhf%2<4nrp4-JOG<9}!{)(~>~1l*P|{#}Q*)v1G#%LA7ZiQrFWB9z&XnTSh?
z{2dRvj5=BF+YUq<hP(#14nLjf`WuePe#mV#xlLYLLU4g2LKz`tj;%iC)?~V`IFQvH
zRKM?#8#G8f>`z7iT%%XN*nwmDNJKBwmQ>7gF3VPNevL>u_{*K<dP}a;6qYboD5d7v
z$S68T(_j~qEJ)rRT9PWeOy2!7ekhY@(r4CmYCEENNG0`qM#kua2er@9Ka*L+nkP}a
z?YgOQ_5zK3==vd&KY@?8+lpQo|2UyC$g*l-HS!`0M&XlKa`s}zVdH_yB45d<%-e^T
zv0<ja$A*=X-}N85W+9*U+g4~OO$Ed*AP$a^;QGA&QPueS!`Ba7d)6$W`$}>4pK$Hk
zpc-hM<;f)<MUOiYr}8ZcpF4oEya2D<3A-*PFv*Y!j%oicoVm-!)|#;odQEU4|9+tB
zewV&q&CO$Rr%_Fp+xopMG!~C{H)b`J&=gQNDHixdmlZtCPcACb4G=jN8EOD3m2AfY
zf);5HiLrCJ+H&DK!oF3|F2=SM;08SHCNufiSn*md<U)@Dmh7Ue+8c-4@^RnknhF`(
zh`^|aORM5GU5BeG&prRg<ZiK7MXp(NnH|}%O{(!8SxE411@wt8M1Q+1JYIVt^agr|
zyPOYaxe#WvR@VRGrj+LbiT0(d%c-(h{q`Tl!+*X^{Dj)>+L8ExD~B2AeNA*845Ll*
z9j}Dkrdw$N><6XhO)f>`jTSG{c$^i8U6o=jw+cggZU~u(+~Iz@FtQn+aaNOR@s>F}
z56?m+C#DxJT*FY2^dlA}<+oTA`k%z2tp07^iepg32KdJD)LN}v%ki@4j8D}dMU|aO
zC{@_w00w+j0*@~+HXIn;u_v73r>HMn?7WL|ykJ#Fa}x~EY{iSb)4)f*2n6u&y{{nM
z#T;$(z#R~AWc7$kQ8Q~r1)ha&x`$<HH{?Jji>?v(w=7ay9ymF$T1fndRSmF{Z2`Uu
z#zfD<uzxIlA~fH5>FwsT2j;R%Yd2IXe6{U4#(H~^z9sppytQa;Zj#XUha+ohnZZpU
z?ab?Qh~P;<-o$3$WU3`W_7K+Lrdly!A3w`{pC_2B-zsKs`r#qLM>AKSc<GKKx2@nt
zVyqW`+gr3Ow@eq9<kuZB+Pk#tv}Pijm?juSj|`wI_$ArZbIFxE3aN2MhtlZE{IMzG
z9Zrlyi<<IR*}CgO62cE40hPY<sgYtSf2};G$|xzoxohtBmk2Ef`V#0{;+GaVlw>*Q
ztew9H!$#ZkXZuK^6S9w14EXlSJ)iYhsfxl)yk46Hx7yA_K#<cMM_=*pVczjmF9zd2
z8u8Eg_{yqjCe1<OhDXs2uR*l8EuoUU629{>fUDf!yMI=Z6j*#qN~7<Gx^K`BsHl1q
z{|zC#-05zUByOUf{TbP442{(z8s*B?=l<9<`54n$fuB&#LiM{-W(YRdYYHo=Oh+Rk
z2d0dUa;K>&uza})Nkpcv-_MLEkyjfaIV*?nX&7w2q}NJfd?miH!ITfWKS+TvU9!t9
z_Fv-O|M?O6@jck5dY>^kWo3@H<+q4q@^+kt;!vW71dH7d6lUg`#$k&=NZP#IZV;^|
zC^6U&X&)^wY9ps$zEWBGaoVbmcm5Iv+klCbU*%T<U?{7z%5K_Ejmay$YP;%q9fRvt
z98O^m{^|mH#`@@8cx0V|)R*bIp?p}^+wSV~vlitQ$8^*w-bz;O9Eq_u+7o{=jTtI_
zC33lOpTdM|!AepbM6Uku{zs1qu>Uz!QgMeiW}zX=?mTU8Wfxie?wf2ja>sn}V)Ymb
zVn?3tiaPd*vBT-R`^49k;{qiB1M!Hx{c$c|j}YB^a1j4j8bYp~eZ*#jHAtB3EbjMr
z?EMF;&P;wejgYe<?cJ*+!Zbp<RGVOfYLXq?gpo?Iw=vGCwQ~wZL04jTHD0P|hoadp
znKgG8h0G?PuM%P8)Y3VmidM{3mRt+d<CLA6pr#x5h`+H|mifEHxbQ^n^y#$N{abD1
z=$sV4NsQM|nz-8shiW=YkhwJ;d%V9uG8G!C4e1LnIY_H>zb4(rGTT}-w$4l7dlwm3
zkoXjS+ITBUeGcW-;zWU5m9!`y^7)%Q!hl!2UrDX99pH$P&gB$8Pca8BM&(0?vvQ6V
z7dCF-ip2Wz+d&lafAg9K5}P{zn%JZ+;$3;yB}3$}N(>>^=h~s6?wS;9R3FL~+7OSf
zVbP@5F$;VF7gjayIh7;xl0lj3I&p4o^<N>FIF-{VB@vux6%-%L)DET|0?x#_rG{>T
z9BFJEJ?m2FM*czM6qU_9k%+qy`!Iu*0MS&_oA<|7`Agm5y1~!ptz@6On@U;7z%!3`
zZ4*ziJ&h2;{R+z01LWHnZ6~|@y+%PvfD0K!04ObMapETi9V;;g(Vs0Utf)`0YOx@*
zS#ps~A?9xov|EP>J!y$&qFx%S9iv)Q-KS0w%K*Gr^9=Y6KJM55Y()Ljd$&mNRR#(r
zJf1|@F%%?J-dj+0M_b?})}EvAUG+)<iwHhmkc!tWY(?v9CL05vbf~&tq}o#3Oi~w1
zK$vaC=@KI!St2Ng_~NIw`4oUijMhqL1HVFGQAHpDI12&*kq2bd#5^e%iX2i<^xeFw
zL5PAG01vDr<=%<^#Nnq}O}rzV@`dvID7)-PPXc$}%+sbv@)@mb-}l_v++y8Sj)<ha
z&z`4G;+JweCqA1<gNb=s6xn*chz)Ilu(WlXet8QYt}iassA)e!^4EAAuqwrTvgz=F
z!a9q=W-<yC8It@GbN@CPSAH#0#>^T-jr%9Dr{G(HE0+8(O5L9ooBf2hBf18^)eJ7G
zQ;3d=R+MR|ZH%Mp1*?U$wxFW;hj^qs_1WLTiuA7CE^lp@H4@%IX+L&!bv^rPimre<
zuYI+QPo_cHV#pC#wEO@xLig4yqlNYDwRq6=Jct4SPWP$$CnqGH@$fksjr)2^1ck>?
zww~2AO2b-OX|B4K_Tlt{9^%gLH?c9Fv8%IiHWDc7P(XN?=ZR^TP{X<<pk(a%(rg`U
zg`pLAHWs0cyJCD@te>0A8O48)Nn8^1A8}rj6;GwvE6N|G>vhiEy5wZf^Zhpu7mA!P
z;y@j@LC<Dy%vHipf8@Dnvp89JtbLHQ_;U0a&+M0U3Xg{J>OP4;hDQ(3(L)wO1vmV4
zd3<mid)4plu=>tNRRI&i#_pvLh08(I0fd!m1lS2g1W4b0uj1wAI5ZkjA^hTYD8#Ys
zS<B;z7K(Ae_NQYkhhZJppNbUW-4#OnnvB;mqE2pkS{s+V&ucbtRjk=S7KXW8{XjRY
zuG~k$UD+$z<wN-S-Uq{ATbX7lbo%<jlS%^v!C%?`J*_Qk77Z(Yim*<&Ny6^gW+ga#
z#rzXt0TZ-@d!Ex0&FiJTv%is=>kbA7F!KDBn(;e9i~KJHEwpkY>bgE7udT)?miMC;
zpm^CwOuw7CWE#kyyuT{&@%H@`X#xL-eL0Mva)&;0?$xKQ5V~skIfDQbZyXE18nO~9
zd}A(`(^#lWeK&Uk24Zb}>Ua%4n>H}oOs&JAh+g#*yu0<~BHpw3ps5oo)*HsH?&tM6
zILDidV2-O9{ngWl`3GAB>aZ57)F@OH{_wM+lrI>>8x8oHR}2GL`XOe`2A^Y;A4U9=
zaq#7iqFOkV-UWa47l>q~dnDSf0t?Pk)N~d8>gE}EI&xoJ1{?hcs-!Oj@%`)t*gN)h
zJC3%6Fk~lzy<<RK@J=fPhZ+3CUr*88W|1|suX^9BWLXuII@YnV?JU&1Hg(>doW4@W
z(a@{TzJo;<Y5=?n%SW(5AUWe~|6?<AVV@g71cGhTm!lrulI@eQ!=|f<FusCRGPMu%
z_U+Dvi-D9MZcBTO0zH$g6_(sacT<#R=32vGO!uc&T;vcmy60Q<D$bQ&YqduPEOmP9
zYtdJw$tX6LG6QP0<EQL=n)D9d52_8@xNO$=Ele%ILwuXNJr<e(`Pxx{{|CJW$2Wer
zZ?SnHXUk}@B<>jlajT5iGl2eYCBNXfW>#cGxSX1tTMRbC|3pWpm9W(*i|1sRvwIie
zPWe71dN>vW0ffufkNTk6R_~gdw?M$}8w0-1uQvC*Sm&{#Yd2cY)^hqCaY<rjrfl1H
zEI;GR%97NMcht{azfybO%a&3rnERtK?>j@o&(hmDi7VD03>^ZA79EX|ai@1HILR#c
zIcF>IaOIBjutD&d(*(aRN^^Nv%k{DZm;7ocSZGb0AK5VXQ_tBw-pf=HiX-+4G3P}&
zf$BHyyCN?(pJLA4ZzQFu9*oFI8q-Qa<5%$fb_3_CU>)RE3k4V7?lZzBO&J+p3A6d+
zGOgnpC}MY)G4d7-ZBYVm<)Mb3&RWf<9|)D7)@}Z&ph|-8RjHow-quwBKu(c5c?pXF
z-<Qn&myB&l<D_5PE9Ni9VEf()@?4B;P#9J{Wn3ts|3C}!&wqiqS#k0Eq8WH6mVfot
zr;QWpBI83Otsw1)75)!tZygrp*8Xn~qLhTFbSWVU0)jLHh)N4ccY~C4cPZTnNGmB)
z3Jgeh3rGt?!vNCV;Jb#c&$Gk5_wV_>f2haIA$rWrn)_bsx~|W8TFKhl8`p@}<QkpP
z74J?K3wOy&fwT80T(&fJ^pCLz=}H{NmT<b9{whUOGc|R#2wFEOe4MC`Q}KG5i$~br
z5vq>U#vIpO3(?2FLyRB1qgX-Qw3ul?6um~Nqs1<;kw&vluxV^DOYp6Y8`WOeI*!C|
zk%&e#i^d&yPJ0TZgwKt%%gQA1+>H6Ht5tOGx2{&aMk1w;<KSP91^>D2s1h?!V;5hm
zgWzU`)>oRgD0Z<(RS#MW!KF)M=N(!*Nf%IW7^HX^gvnf}5UZlYjcBnX(PDZbB(5$-
ztIBN1%_rd<@m`F^dKNfRI0#`gLuQhp^o<cX_a8lT6G`7MzSGLaN;^0Eh99?21x3>g
zH)mNB-U%4qsbk&fA@-@v1h$^8D}|}bb0urNY3!5WxK)xc@Wrg6=-y>ri>62TxHg)b
z?S~%UC^i&)BYO^ln@MA<A{rffg^h5biIR2zzw{IhUCTEFjOgo-D^U<|urkZ;*$v-y
zWv&7C8V6z7dXf8kFm32@O-iug;r?@Qftlxf_@{l!g+D+3!_GMT_oRV8ZH!$gN~_;G
zmC_b(@@F`xRlTQ{(t<LqPocjuz}8iCZbN+hV8hdM-3gpM8jtDY3|kWU^d`0lv7<uJ
z(0v@{C{L}d#7GJ}fWjAq@P)+RmKbLiCkohSHdqEd$&rs7e!Fnd2$hFiS-<IFP0Vk*
z<C@B&6q^RchMMP$`<{`jKzCJJ{O$dg`fEF76YGov&!*d<)2_bROSCwn_B*eY`4sd>
zaBU>XA+7X04c<Wr7(XwtJ-TW>oB+1R_n%svTZ9%x(Ie~gOmz`bwicD=XuiQmL|8p>
zCJruw%UzlT;4Q2B_Lsx=f7DloKh#%WNw`r{d@A{5E}K+b&Y0k-+@gr+Busq{M?~ZF
zcKBQ;*8!@bZJeyKbpK>crQlo_x^141#1&5Nba^RA?(C@pkNc05UK}9L{w}4r3msNv
z3iornvBbf7HaT=<4*u}id|F5OW{;c@PCYt5Rv0WX?_l(7t@Zf6q;TJk?v<C%r*GD1
zWiyM+h|}}mPqB@XxufnX!A_7<0J@tj!bi2`<P)v<L5_KcG$%Prrv{}v;b#}S-2Vwj
z{R7J920#ezyiYSJ#m*to|5lYq^TPUOXGy3r3crk_MKHJ%k#Sivx`U!pD0D;O3ODi8
z1#2H$jlpwl(>l84@+MpU!(^we0p+s_{{C%IXRa3|>sQoZ>plg+o#kcU9ObA#dvVc8
zdn{sq>UKS8+SHKxWlu}~=3jy+1s#(uN=I3#xXH6*Tmv^=;N#3OmCn$VglspaRt{6J
zIg);>#yUPeuOBagrbOUfX(G#sN8cg0v@>eam#h_()pMNKoXzJ3-0suwwM1#gs9kYe
z+z{>9jKFnX;l=q137X4I0V-XG1Teo0*iCk<?3-9S<Es@*RSDyQV3>fB#_G@en}2+q
z_iad-H)e&?;a<t`ea-=4Bpj(7iqhq<abWa#qe)UQw1CvL6=k;HoQ$a?gknzr;<eK$
z0ePQs#<Va}`{<}XMu#2Ah12`d*Fv-XO<7d=(_of}qiS5+MoPj#sJL~pjQ^F8wNI}I
z0>vOxAJ9`oQR%_FdO_+ci1EvGWwUGD916c+gxXd{Gq0>+M9=4P)kD4m5ZUNAvoZ_d
zrvVswC9pb4KKq83at=N&N!Zp6CvT>Z=tmb7_uGt}hpCIT%8rY+?rJqG8uCc?<9A4=
zq~l^<wNx#>Q>yaj#TQG;7GKsTN*5iPUKkN;#iInYx7RPLypq+h&0&a|Ppss}Qg|x@
zebpz41hf6`u9;=KTB5^`OsT<4o~3zc7ufRyr#de*(;l}9ya)lh^P%Q_U+Mw&%^WA*
zZ!kuy%FGg*wE0QjeXrwIhB1`r7B2e&hQH~nFNe`d{cs#CgDEXkA18XL?P<fdV@o0c
zvmdNlWBY{*!;$qMU2^mKQ~1H?sPZS7D1N!&%hY#ttlH2psJOVHb{bJ;G#VSpYl%QG
zZ%(Ux1bxjq@xZB`7H7#>z6B3CRxRIX(j&Yrx~Y}BJLnu1%hso`i9Z+J>);W-<M2Zi
zJ9b{`0bu8j1-WX!?iRv?`Ddd6)#7Kq<@8=W1(nBm!W*UQ2a>Am98&MUWvP{;px&hE
z@?dQzzccH*jjG=FmLWLNaD4UDnMvC8pu$f3)|RWV>EsC>m*KqLfqFwlYM_N%wZM%C
zFL=Q-Y-%|)hgis#4L1pNAxmsRvKHG(;_0ZBxu;5CpkzE+r*V=6<o$ODKGmHyyh|#i
zt;24Hxyzg)Ehf6Y(jDd{r2(|2*L6@%RMvgOy7|#~I^b}?pe1lT>Df_t8wY5ZUDJca
zQ^QfgP9o&m5jiD@%Sq2SbBQgpx;1D?S8l!kh@4>qWi;J8346*`bwE}lDk<wQW3Br@
zK9u{NkScQkxOD$-M#EI>sGr?TW%=K_nQTFvXocx~?u;$H<E;d7AuIAKA09mHP$t4Z
z9fM5e+*l=<yOtu}f=!z0t7N9ia&pJ5qATjd_;pi{{wsIuEW$}>yt`4L$)89H1oFNO
zm+_jfaK+wd=ek!qXTOBEOA!FYZ+5sV_paO;sYYN))fU}P?{*>*E}u5+1bUA%O{#>$
zETyzc-F%S9!ubxt)G#;9S;b07PP<CZa0UAHu)Ui{HoETcL0;;W15u?fY3jkR3C)NU
z?J7$J44!1%LFe}#yC+7nnh-dh%EHfe9)(Gbi_e5UcOGQujIvB00nCowlj98A9V8C>
zx0bS2Z%HDM*{PYtt^%1|>6Zr(+>B^1^x<;UYWu8KV0~ub2(4Hv$`gl`#Swmqn9_xl
zFg02UQ3UPKr^S*g67lu%PfTuTNAWPu-jvYlVm7HQIu~M%5WAqi*wwTk{8aW*=cDl5
z{WvB>!y6-d>m{^4T$ENfrK*J3m(zx^laF88Yig3j9n0BKDi|>c1+odzpkup+_$bVL
zbQ7L&7u8Zpt8|(v_P@Y*z6T;Erjn5ZyarrG+!FhoUZfK%b+N)_=@eUuvXn+cvcxmS
z{5!;we=;k$J@yA;DjDEK<Nt&gy<H$K-aa9{vL2#;F`WPjF#c=B;-BVu<^P(1%#szU
z8{9E6GM|AnN%!#y5}Qm~;Ah8CoS>WcLC8qx{Sp2by~q4G<kdD_HvjBM{3dFzdD{9}
zT0-aA&U%QqM)g0ieuj4g1~p)VCqv68XPz$5ecu?Ou9psH%Lm#ZPqx)xVMxkYU0StK
z7L;W)tRzLI^17Uha7<ld)hn-V!4jI{H5FBt!qbEAWG4HC0%y()U|F6xS{Y79TeUUn
z7oz+2kbLu%$Rd;tFY%oZx9=acV-DlIpIY=TiGE~v$5pVWLWBuSI%gZ7zcXqnR9|2?
z9=qlxaEFLBl(`!#0pwe&U#;A`x!Y$d6afibkz~TS>QUaxO?^ciqiY0ODyg+0rK|@p
zxoN=Kkq?I^r;nc{pNY~vH@MR|(##`Mbm~Gk|2Z7jNqS#3v>+>rNl@|$QB4IOO}%;T
z9VlzJt9PW2h_G>4KuPt5ah;9ig5}*hcP#{p!;KHO*m*E8xOV~ldH%zRD3IheDVqso
z3!KK|x1^hjV0K^k&`65*j<QxINH4_VeG1wq_a_nX?QJ#{wb!B6GBOB&rW-vRakghR
zO^8{`br|Li{R}8oCw-hi6AD>G6Q8oWudtX_PDfAgu-3iUa!-QwJdG^;*AvG-47f;{
z*zzYg$e2JsNXNrzr2*p?7h~Zq2hR0=lX1+9!T6Cv@X|cS-)tHd!1vmuv_=5-`yJY2
zVq6IEZe1P8{JVqT`u$P<Liltn&LeTA7u7JUZ~Fmc{`#%_4`{KYH3rQ<-IzDdzu@zc
z!I{>H^B>X3!)gE@q6gxjWrzDGC*9~T0e>IkoWFmX8Z#UjE$q0;<yWOo@wx07|K%pU
zZA|PJ>KXzlcSne2D#q(OQRAS>tTWoUrXFO~grl(Xz}IE5QwRgdRD|c-bLcjKRiDoS
za^W299mYK(BaPZqB%(bQs0n{oHQe384^~d=Z!1S#fO2Cfx3E2wcQAo~+tvS2PddJn
za_Wi|oAqefY9W+sT83#=|7>iSW})X9quE7Ys}5|#4TtS7Q&$v*rJ(E?<@1O7VCf)3
zboCW>!_Z?uq%qt+ye0dkip0@9yEA7gnmIb7sWM@H8dn29LY8|BSHYg7hXkq=a>mlX
zb340uLo20p{S*CO##iS|*^rYw?u+lZzfBs`hsmf87Q%A-9p7tkG}k|^41hp*A!v~E
zIQqlFW!8**WQGz6Krx#)+`Xem#mThIg3!j=U1mv1c|821A=>$;hA2TB++t<tsyMQR
zE~fj74m!%;J*VjqJ&Qt3mmSQ6R+b%diLI30fBsTX+r3u)mgyvv2*$`XSf-j?@)YP0
z9Tj8|Yz%B-4HCln6Lx?UkB?uzo{2eSH2bARZ7KUWg0qzjbCw5sy+s;r!U?)yOg>Da
z%w8?AFHxzU%nN`$!w0{2t{CFxzICd?IFUe$&s$N@lx8XC!+y7YjhI3qx^;Z%4T>iD
zD{CtBa%K>+J8}`Mn%jFFLci(h`~x+oR3nNij3nahk6vn$od}rViT>>8q;4ly_`b{|
zeVZa6F9?w%t&lOz@ht4fURR01%JB)fhx;@HF*-KZ5DmZ<=M#GMf;zAdhaK^XZf|6k
z^Sj_$;ez(2>9_tEahrP0_`!TER@-+gRi7D_*tIca9QEuew3e8tBq`|2<tsGa>LRi)
z9iZ0o%yLu1zC%jffNxr2@f+|>XC!IK;2%SsET=Umoy;}xQ>(<DyTMw`NMU=$NSv@g
z5+`h{^TX<zvs(}+9fLO`V1lGq9=b1F&DSRIG$^Mz=`uZ~-rJ2Evr|rC05+DcY~Q>@
zX(i2~NlCx**94G|?GFY<2>u5&mel2UGNYVRRFgAez7|&|#nMNKubI43A~5SNY%Vj8
z+7Xq)=HR_NrdACftW`!Tha<oIvak0KW8HrM1`_|?oikJMZkOqDGb2Gw8J3A!Wl_%H
z4OxVQO;f!5jSDtxjpgk(MHs=r15!`iS>?)KJLQrut#%-$=(ao_HIk1ECeYiNJNY-d
z_`T?b_1!HkdS9Y!b#<eS*udP)erj_#WT!q)ZG2-rh=b|UEx+Eh*lxGOp*T!{zRLLN
zl)RxV#2i08NyIDQYfTvVz7|K<PAo|2uE6ZxanmK#B<$PdL+@WO=Jx(3xgOr|$igE~
z#$F9n4&P>~T}4#vDr@;)64n~BO9TYGQB#L?K)~Z1y5WQO5MwGl+e*|lU85*C7y$&=
zZuBJ061d-X!6_mGG`bc~Sf_Dhw5aVu;3h$rJ6-R=NpG}2BWYPN=jWzqTUL|L<Shae
zRJMGrWDMRILj&7aKXWO6eg8E@{h&lSW}qEnev6Tb$wq5y`omj=&?ek$ROm+S9TI{}
zhWq)<YNjhKHPk7T<h$Tsd-_+kkCE<_D%105xlO~-#Ulp<nb;(Id_ClLHzrxdTxd39
z(2^bc#u%Yv>;!rgNtMVuk1qbBh%M{(kPle66tA$cV-CG#6Sh+cMe|$pcn@B6TL!J2
zE?ba^)0)$SmeaqSvSF-IF?BL#h}PI&-6*^@wB9Kr-|5Fzz?q&Yb<AE_=w9%RKQ6KM
z?HAJ&PM_}HJSd6oY2@=UaVsmMS2`Oqv^vE)YxG%II|aA?>aH;)Xa;ex;{AzW!y>JK
z9Y9=FF+7Ilj#sPiS}K9}>wlaa|5MrWlJR22L}r=>Nl9+Id2-D;nTzZPnd?7EAn7Di
z;RaKnwKY|5tYH|fys@!XSQ2$|nI}M~RTdE?`j!}d{VHS1Cfdt)#zgt%IqD@w)|fZY
zJ6~bjgpS$pw>a0&6fO4)khK@KW}#Z`iBCUle#RSlfhlu<`^k266q?7A=!wdl+p~0?
z943x{s0J?Sj?j)ZXE&Z{#>PW~UC;{CD(vMuWOq(>AUwl1yG%C#Rd%S*%+dU2fngS3
z2j5CF^4-=?QP?G(uT*DQ!K1c3P!=3Xg}bdDYsb%<fBg<wa_gBnW!?YO?5rK&SyEeC
zC|CxaT&4I9so8c}D3fLl(I?j@o+VJc_obmV#p86ZtZ{$WLk(Y)M4p06I(4mYoMZhI
zPPb5)#>F8+bjZq)`jW}><8wUhUQVM_Y>Bw&b!->Z7O{2;9){Zm46tm)3CokXv_%(%
zdpnDa^6G2*mV;nI8C+=F#=vj?+JN}Gzr(2gXcIRxZC#RQ+w9ik(xT9f4qPs@N3Ay?
zV)d;gc|i<sdF0)`I2b5oVtqs;RBZDtAd?ayW689_Z<a-M2#dK1``zGHFR<6@wIC!b
zcuX3F0qjhV9#or|ON`I*1&BlV=upYi9m&J3Q>>iwDt0|lJi+)y0}rqUVKVm|Ja+py
ze_HGD9l~PSIkyi_WuYhzP33U8{>r*AR<;D`VaR@e9Db`RJ61G>ZQg&YY~4k8?IilR
zhw-n;xr$@Y%Oi_JU$hSz7V8RO{ZD++=7o8V>mol`r+&5?95DF~F*xSvIRRk|Fo$7$
zGHHA)?a_-k^tFtccT2QRT1a}{)1{^Cyl`6JS?XMCIx%6Hn0&mwZPCNiZJQ9^>ql@$
z+_tRvSkO~>+_+jYJ0K@4`h|9}r2XF6dQqxquKQg(wc+4}$`7O#k!FP9nPDH)S;v{5
z-r1(|IYEUdZ6~2>R3o)d#qSTZ)=xdq-#)?v>K>C^Pfe|LBoFb~^S@rK{vY!{$N*>W
zfqwI---}KZTgOaRI7dhm@i?yI?KU7q+nMDT`lf+Emh3W_jrr~~4BQ#^%~sU(1g)e!
z^ZSh{O!m=2<>4ZORO>35*4M)%zC&`Y>kt80Xwql|!q%f%iLRNNu+nsMrjq3oHfA<9
z5urs9p*btlWYBs#%|8tgoYpzi-Uzd#+QOgQO9ng?XmzcC?Xcs<0{OE_UE*1?DrduS
zH^IGqOT~RkbJZSZiN1w!G4NT69#&J<7`;|gmvOd=P!qblUE|Ptl~DiOm4f5&(Mer&
z<3!tJ(=V;iDx|z`MN`YdA&I94m86>$juUms0s=rCA*=@mZF&rXCD&PwjQQ|rKhD`t
zqhsUt*;pg4XG;@5PD=kg(X(<=o47MtFAaO*YRWbjH11xTx^-wVu`enMtSE9wE6VF&
z$-Wk(6$Meyr+zbFZjQBWS_WuQgb7*!f4Ih^G9?t7p8+3{Nyf75G5udU_x~HO>@T}Q
zWHw#fJwxr($9QUhJ!-_2F#|W%=~~Gi=-nDb`<Nx9m1HW}WdeEgITwHKeL-zudGh-M
zPl-)#6E{ZQkqIv@6J;B>&kv*Avgzl^_0cIXX|b{9cFD++IgkFLvB_1=P47q`$Jyk$
z5!I`h&`w?kk1s7iZxihhv90p0B&$?5<h5$fTJ5B(JQfs09Gc8I51J{|u_rDBkGR*y
zZ97kNSvojp#br$_m6@4mt4rGQoDmOmlc3V>pwikn5qy=LUd3zJi<FuP_Ny5f^K4`8
z6Q-0m@21nSLI0c-Vhf5&!{T|3o-F?Qf;fhOb{u2RBt;C%*$iT7%ev|mA*i2xLkOCk
zP8HRx>ea{Rqep7}5hs)U(15pUS^5r{?bmmM0P1jcVb7hg#z=Gqv}0X1??JQRQctfk
z-u6)GMZ1vG!liHA;zZ#E7W#E%oF56pf%J#T7z}plhDbZsZ$Z`n>vzl&cni5kCGtxW
zElbiGyFQeo%vfP^Lwrl-7HDcP(FtIuzUfYBcw7xO?!j`}wVC6e1w5k#%k?{L$a41i
zMD7D?;k_mpr9^ImV9<`cAPY@U0S*sui8gIjsYkBSa_!$`Jw~+>UEh!AmnNGteO@@w
z*O)TEj{brj**>M5@!`{V$O{LW&HEk4%&o_`wtJ_?M8xnG)?v?0^YPKQoAmJSkZID?
zvnz$go(=Tdhm!{53p<);4&NcE!`U15vjhVh_@VRgB4t?hdctBAsEWRPRuuCltzf*o
zaLp}Md6d`8-j>yF9q-_g>$05saz#-DVGBC-Z55t&$2F@@qoOugNq*$tA;0p2pn4C#
znWdejCr10QSfKVg?)EXSSu8*BomHMx(o}?Dv8KY_A1;jV?5MN!RDy$)GVAF7^^^Je
zbM`}&JT;tMMl;0v!_SGM<W}YtX}LZZZ3!J#Bt>u&=aTxr%(D+z<G@4HqHEG2QI~WJ
z4p2tWDUipZT9fQS2sxSthCDn+r;e!-_wtt!&Z?8Og3M#KNwdTSpJp_M=?p(tfOOZ6
zqiE_~tZWt&KezDr$1K2d{Mn#a{9?}^)GZvD)8pt*H!mHjefx6X(5ET`8GhR4gIIA3
zERbJtDij{@=-e~2JW!)DJnKF5=-GRIn%=pMyUx{l$Z6NY({kcADB5g&@N$QL6w}K|
zoSKPh&rFB7sB!<z3F3o?b$<@jSCfS$gzQzKiJ1ZT@Qwv4lFT@g72aM?n@H+94nJX8
zb!Ot-yMG?Ad!3b`t~EscoWI1#u;eaQ6iN65%{)c@9GkDken6Gf`vX7C(U^XAp)y*`
zt(Ii#m%AkAqv?b}b2)*p;%JHPy0Q$eop~}+>{!XZsLmAaIp;XK)tG}W_Rm7Ve>lEU
zCg%JgMriWK7$JL~`3Po7%m|L@fg=dy3VFm<*xen`DZGQ;89;v0T}O_KSKbOqVa)Nb
zKXUZ{Xgh2EkoJ&JZ0A^XoZUYf_G!v3(+2nc$s_UwGcE4w%6_z%Od-OUjEh@mJ(y#k
zvq`WQqN9^$NycmwR#jAbhp(=l4%YUR^=Q*{IgQNlkCE2yr#4jcwjY^{C;0U@dSJy%
zrztm)*2$5MaGoYyYlxUzxGUgh;9{sSHOw*Nd3`B`_S57$nE(+^c#}j^25Or|iZe7R
z#kxPJF|9Z^=vDg46d;=dU#8h3RAR}|LAPxX1`#egbo;8TpW)Oe3gdMQdSh-Tsh5GN
zz5kJX>qpZZ@}S#kiIJCM>1iAXm*w!FJy(-%jvh^?tQK4#w~K$cZDp<MCR(=65r|(r
z8_)?qb<cQDID;1l-E)hWv~vXp=kSC(Kl|lBQ=qB8u0(wWC0D^F;TxM(*jo%Qg5^q{
zMvGjYTbJD`n%dI{v%=)b&ljngn5*5=-qsG<;js*CSU+y_oa@|)n>tD4PGHR3q<XQ?
zf45(*e?e37apcp?70I%T8;a4i1!Od-I#$x?92&bO(&upb3W9IL;rv|or^Z9y4*4H~
z*~BhTh5hU7=D$A2(2{Cs`);DqME`P^Eu;Bk*>-?DrvH!?9bGgg7Zqd^T_o%>xUuH@
z&dKML$!?LPs9sABFAjs}FxiWnoXR!~1*$Ag^>U{cx0#?d)WT3b?r^qm)vAxz5B2WU
z6zaBhWUELUbrDAo!Nii9i%D#6vu=8;H$@U^$OSRx)>!EF*T|%26=#J=G-~Qr{+T;K
zqf&YfEd=yq6x7B8*3JB($-MD*NHhPmswW~Y!2W4UO9yr5K|F?_kne~;G3AY6dr(C!
zuxIp(Sfiu)gLh>}lOXxYW6*;AM%lT$zRi{XB7|=B7BX3we02wFh3Vwk@SbG$LBXKC
z<b%qqQ;@QIsAcn_t@Ma)yt^(*)*9{v*K@mL4k?fKJl<6tnA)$d66P8Wy72dYHTA$z
z%{Qps$lO}ylxVb*%^_mF@EL7!Gm4vh>RNjXnpt=*ul;IwvMUZEqzmUWQ#pl;@2RLB
z-bHIoui+ibYjt{?8q}S#RJIBw{_Ae9Pq)I<V<`BoI76bpq>JKj)QCHHUOwCbj;b&%
zHxZ)Q(>cDvK$px-mt4VHRs+hCGc0JP6%?-=ivpPQC=_1~<|WRORTz0$IV}*+*@8Nz
zts*jM`tCOcK{)@NTgZTIUKdy;|Ca^Q{Wng|e)0AZEIC<eIR~+PwId>bdy40kBMpQ@
z(0Ge1zMBEq2E{4d7eO?`HfS;XiyaGQ53f_ooM}Q3)%e%1l^5&feQ6>v+FMb9a}b>%
zxbUD@ap<kOGeXk!B8pu1pxY+}Y#nn75ry;c`S8lkM{4WZ2=$XmndT!(mu7{g?~n>G
zxREkRS9wB|$VCVSCu*)Rorafb4k>yODdT&lKYSD=!EB@ca_%ah-x40<KlH<t?5*#=
zD<_Ox0p$tbrLK26ZzZ()v_L8kU?5kjV*G)b;K?7&1e!KZ1^vn&{aTw#nQRdZX{MY_
zOrtOFKF}M%8^E<5ODf}Nm6Zhs3+<T2eNC!1<l<SGhpBU<YYTpJ<ik;~ClZjHJg`t0
zvda==R8Q{9dKgjQn>@+&;C_pkR!r;QDw$GEuch!ryw#tjp#}B!+Smt$dS<1yBcx5;
zb(3nhRWNxNfFyLJoL?IKGrDw`1b6s!jjDsI8({42C#4MIzc^!9@JHrzDvk<2O&RBd
z4u-be7deuGp*znPTB98;j%T77h;?=so!Ut1TOQ=`B5R8XU~+cs%g5@K&ssw+pMNn_
z{w+;Bca$^QJzpzWifz1r87p=)14-J4qU^3cSXU%27f{J9eX>9-++opfe|uPTIvit(
zca|1`ll2PsTVWQ8{$rA{Mp}!O{{E0%ntU^+Lcfz+D-|Ek#)i^tNJohn&GE56VK*6u
z-H-I)%^`pG;Y5BWU%6@cmZrqiq4Px{5^6dcLC!vD86ffM$tD<HF_9fAt~^sbs!0i2
z|FS(nT|@tb4H3RAcv{L=t8BPrDgGYVL5tYcaMG5JGDOj3E9(PQ%y|OQwI1ngh(6QR
z@XN{3S}HTQeK*z#Hsg25xJl?CcBr%)+yv4=9R;@(iI{tTTSVPK#N4uOK;l?Y1`;k_
zRWXr&W3aIWM{<w285MolX0n&~gU6Z@?GHQN=(yD__{ITh@kTXkovcLIEjx?!;&J}e
z-F-hAbjd3N8ToX@Y8>0AoV=l)_4{fr;`W(6gda1raU6{wy|`&pKPb-V-R+_i=G<(v
zn=^gt`1A{l(t^|{<L)UfHkr8FB-6v6=8i))eY@;fkQp5U+R%3l#uYmuO)|uS2JwL!
zmgKMaZCvd2WF!Xr)78~1V>LlS=SZ-sUa?6xIhWZ9FkaM7X2EKjd6(}AOrk(1ISNdo
z#U4*=ewak#&@UPoU=In~bYIP;C&^`Zl+VTb2$oW+0@yi<gS{t^Ed8&)2nwfxX+w*;
z@}7y6<%lnBh(m@>l41BlT{|~7I>FNy@5M#1RwL!|?g)3M7ip?S{$!Dz)|lMr---C@
z3eUz!bwWM2c^TkGm}%Xd_QZlq7&y5-%8xnysxWSHnSlIS68GWjIiof27f`S*k-4%2
z{y)`S@%@#yFpl4H>xlMq;`Z=L&eNgd`8dO)+Ftj?slDAzHQnL6p7DjJw*+&Gww}!i
zQ1_j1h7-M9_2_qV;>}#T(BTjxAm@p})7IWYdyku-U309**=l>d2b{pU#2I7ty}hHH
z7m)!lrK%-5qBM27vfYDZ1*?+9GLF0y;AYw#F;)ducsux4%e&8vEp*M>mItVo_^vq7
z1T9-s0YF+TG4&=>w3;c3)oA`}In7T`4Z=|w&@k(JI$zdt7u*W6`*<xYN$I0&cG>Pc
zi~#r-`s7{2pAUt4)@?aziOS5>qAdwfs;ptEkMk;Q(^QsS%<A*doE)bmpozkr_Hi!I
zgPriqP>41TO9{ja)E!)HX|xeT=_dBjKX-=?3!58F*AhBgkBXoA7j(8pD8P{Xcg%4%
zhs`er5aOYlj%3H<IHQr;_FXWDk<C?>|5AHZV8=6_rJJ8$aoCldgCITMI3YIB>gM2c
zM5*n*B=&zHQVHD!st=#K6)73HF^FU+O#S~_N&oHJuOs{RgEt`Pa^h2Xg*NCetJg#~
z_I;n(&Zx#I4aPj8ds&pq%sH3iz}?2J;lquyuc9+7OwPVk;F#fBT{~4vm(v>1(*Nd=
zs9GRW4Uo3GM#$Iwt3Z6{O+`dz*sBcZxM5ma3Cz}uv({}b=x!H8%%rLCO*}|NgB$j0
zO=_SNa=R#oe5&Gsf-lJD3>Kn@$+22CWdiM4u1yB#%ROxt!X!1IHYz}&j~<H>p9LHh
z<K>3nQVP?W{>ixt507VNIPzBugW*Uh?OyFA#6ZH@ylba_%9=BX<yVMn08kosbk73@
z^S_IGnkEx;WYaMl?DA<)&$bOES5V9ybqCJgk>yw<5+9;95XyOQ`Ei|5;FU=4&~yj!
zZ&BCvK2*t0o2{b6s&Z<W^m8(;>)mL*O><*I8j~VigZwI**@dzbmYFW)#wWAV@ucH$
zTX;uhx_*e!0A(^pH=1qG^4`w!cSseZ;Jo_DP|vXFl9jts0g(n{6_`@oa)F)CC|*}~
zvs=eGs9-x{k2F^6uRU?rka%*{u=eH0dOknM+1iEK`2s=JKFbpIev=$Hth(+gTpUEA
zuZUiB=kwuHQnc#JDj)jjt~9wp70uN+ds9t1QTo2NA(C)7*ee1i$Zhlft~mRz&*%5x
z9%#!AN15ak-p-rqNp`e4rVhuFp)VBbMrjeT!Zl0(G;qQ(eFq=PZ%$eK{sviL!C?^n
zC0oS1I)J+Njf~vp;uw^{LQt8=0-WjcV#OH<UOczc7c>;N?J4>Oe4eQWMk-FE2kIQ_
z0nfr8evlJ#{TQg?HObIgPmfr%5}SLLS-xo=8*f6F>btZ4A@Evf)R}F?xBAOT_zgDM
zUSew(66RsaYR78TTrSCtV;TgP%e^2dUm)DS**yoLk4=t0*;{hep5Vnzw1wf?=ik*R
zudOHvIu{c-fOuH@&v@8)_jx=Fd9rqWx^a4>Y0_Ub?F)U3#8hro_^=@<g;$*O-ZRGD
ze?`|t^vq!(6Dz`Qz998cWuolHeh9PRj0x!?Y2s}vvlkXVj(538h)_-DBE;7mS?jv-
zg4`H$4onw12dMEdFPF~WXt_meWUPlygYN6w;-Ztp03^IYmL+J$>2T}pCnKMVUZIk|
z3BhmUrgfzBz2OZO(g0XU6z9M(r5=RQlGUjiSV;G)lt(->%Cy3kzto*4kp6ovT7)u9
zGpRS_wMxHyi~*;dQ5p^U+RYc`Vh0cfAQ2EJx6%6I74u6hGqsL;U8{Zb#BDTuL^MeS
zLR1sS3z_!v4IQ$3F;sV5YifdX8r7+YWxn=lY_C*!2Cmc!v~~AE@of=wKs;lpNhYCm
zI6AeO@PO;;yJSbVYK$HplnTYp9uhU<j^|Y*x|fPtvRGE{=;K)5Yop!bzUW)ub5V!+
z9uI|)60j0UO=Mf`13JN)4g_Kc!G#<-((b?Kup}UrjKj{KKVvzdVyWuVG1SbNrQ+IG
zZm2y3ofhP$2JQJR)c504Lx%d8dc^-2>cf%2Tdn}{7BFAcDDvpS=2Z}H>A|gTr5`g2
zp)|`AcVnHUcdRwsID_3B>%TK@$)`i8hkGG~EF?@l_nMZcuw8GnM8aGYh<F~^%Y2z>
z(s`?-HH6dR38o@;%-RzLs5iQErw<*Ll=40jjz(v9k?pn+J95*bqf_LPf>=GFsf%XB
z2b@b2iJv|eR|ZI4yVm3Jpr_00K@WeIdDojoE!r@&jhHsrpcZG86axZ|YK+j22)P!S
zbk&ATkQpP_?xwmLo;Cttn9uOqdX^Qfj`U(v&r?>hn<vWg4ZTYCzjlh}D$__af8L>?
zqy3Sv`b&r=?N6ba|2!@`VVX8uzrrU;2zTcN2Mw|6SKj0gu%p{aZa7e|u|43)7l)an
zH?{>&zZNXvz~6^4el2?Ekb`!+=OM8HAqg?fJX(dWpM^kQIwE}G{OeBf#6V%3K{7$o
zt`teHt&PNuo5o|{sM^#V-edBvSB$ZRe$^qq>*=Ileq;8=R8X<&EVtb$w@D3di8<$m
z%4d}kcRqb0^9=Cbick#`qO}gKW{mm07(%d_#t0}*alH&u&`~+0^Jf$}I>F$@vCKk0
zV*7cQPV%$tV7JNfV@AZ_VQti-`CkNxg{{|IFx4ObEb}4%v^dai=1uimyZlvxk`Sk6
zR8Q>|tv;O)c?hlu9`Uyb#}@(=n=$>DIkfRix9*9VpPiNfR0xLb$H2OsZ(dCa)3*V{
zIY&gG+XKu(^{&;35<JJI=Tb@p?vJDV)SkKC-{1Qkjx+rfKV4katp}G>r@W=f-YOYe
zeFOI8wi^R>$<3je9dkGN)i{?zL%-61Ec-Lq{6<Ua4E6Q_wSzN(WM|g+2k{7^y00=F
zoxbCNKwWFCxa%}H<XgG2f9QB<HYYQLc=SZB=*)2A1R$Ljvg4b2<u&0lMphe|^>?pj
zafvbz7`C;wL3cQCY)blz`J$yX|EJlLUuefFSa1&nfWC=nTM{ib!>>_mocr-{9mSj7
zA8OfLmcSBiy!)+yPhDMiH(kEAu|wdXgBe18ZvmCYPhRtBqcPweHlMEddQ`C7_bK4q
zviq>P5H$g3*%Sb$nKr-H`e0qt3jYvhk$8irMe4bDuqRfZu&QQbNqT6=y?8M5oZy7(
zhSO#kCF=KKYAOQife)k0Y{Oji`K4{QuSnS_|8e@}^^}f5iVMoqL8#md=iAJRlevdG
zJK6#1-g`yz%>vI#)sYC~%0m@!znuL;Vh`0(Xj3{TU60%7SU4_rlOv{`?Lo&#+ei|w
zv{S1`lW*~@#J5hFhM#(GNinK8JR{Xufr8^E%C#xL>b|}|1xe=s3BB{G{ZCEIS{UzZ
z?($<bncqx7C&%m>gY58ehShu+nTdHe)$bXRIm4Q7ow`++ZuadiJHa#wtWp%(up<hH
zpK(t4paPG94#BeA*nvckd`Z-H{ZTmlg~`0QE;roH>ryvl`cS_O;&3TcdoV`0OK7rv
z9mL`g`!pOOF(fv6aV#b*FTX>!1o@#OEg(bl7cyMDhU>30H2*NsCP18#Vi0uQgw6pg
zz?Uv?3c{DL#GZ;F_S}5e^2*q)xHK_^K#jH7r{Z;w0Xof*0(S}{|8gziw<9d~xVpVy
z%z9OOve%70H`|WO7c*{i)6|a3vAN8?EOB0zjB!{xC0beu7jRlLafPxwPkI(r8&0-s
z#;jJ+8D^=8I?v*Wu24VTrupDyQDOB+|3(Ns1J8}HrkwW)|I$w#_{E(@u4$_^DhQ$J
zTC04-Nd4A#KCYxmGC9A34msR@ZkxaJ+sO5gDI7a3@=e3F&}(W^<Z6Dg2Y7~dT&-U4
zqBk4aJS!s7V%!7;XXJfQNm7|<zBcnhprIBkw;{fV6G>J!+5N@6I7)df3~*}v=(gS|
zYV>NmfZh(loYi1Gvysw^a@zgUp26p*b{>Ym4_aBL#tOHHh_&%!v_Zpg8Im0w1UQd1
ztCX~uJ_M^2KVj&Yq-%P_m|SpA=5o)&)?7WXJkriSFA3n6pY;`EkgUf0kG|o4?k79E
zmZTs36~8@4S5d|l_pqv_@6i4bpZs}_8aJ%t_%v?&+v4inNDIJ8wz%B<Uyiu)zi!Cd
zS2%hjO3Ti^Y?`<3alYofqJkbP*Sf}l9mCyi!^V$`OY-iZXta6Ww>}m#Q(f$nnIBn!
z2L3klmb&Rq9XgN3oDsqBuJ*I?+!{srs$iUqvSs{2l_M<LkHEGDDC^vgYUw=r@XpC_
zl`=D(`NPXm3BtubD?%EW6gF3`*e?4<*fz^<5{0n9g5`CwpPC$rJ<p7Je@UiFY|J&q
zc@Yyb%h4q(e^*l0Dx+NQY<~%~zv3dT>gnm^Di@;QMLU}Onv;JG;8BRYoF#*kiT1<T
z&jx!l9+8c7pQ53S7y2j@6Qg>6MQ!^M*GLL3H?gzzTx_t0ll9E;X<FgCB8q|asEAp5
z)La8^4gOysPnP`{mZOU1L3!OXy<&@-L8shcNq3UAc1wAwR?%qw&jRzG@!Dl`s3KZg
zpxNwYnN<t|EV?-f!nM21M0gS87sMNlXy+D)vz96GBYxA)+DqY+geN3PVi31QVxZIT
zKUn0tf|9W@*4`aFuUS#3cvM(t-Qvo_;1ts_sa-S~y*{^ctbqU*N(A43_oDw+iv2Oj
zH<w^09K^_de?fChpe?;2x_$YJt(SFV5~{Lv(tF8Rtd;J3W7*(jQNwv%WzCEOs7RpW
zOy|e9-{wNo3_owX)!kER{meSH3Qn)o*&wev?Nz%GM5DEoC{dd2NP^|{2E8L>ho|Q*
z8xPezj`k(4GLWPhj_YR!Ntz#;adMPqJDa|@o32|crH3`OELF1$g+T{`j+CpeJ-z%y
zxs_+@^4WuK#+##|d<_u-p_#d?)LftYqDHWL2FM}z@ZPl(qlTviwd6YwIVOIG&@EO_
zaJz9pd0`wi>$%&O4yO-6X*#swXKDHe*OP+lcU(^l1!v24X^hnt?iTR^t)RXb)jlvD
zb5?te^uWb_wo_L72n2L#N<Gol%<d(Iqb*6gJX~|V97R(uQ<?gp@ve;%g}1)OU;BmZ
zztGmhYJ*o`lgz^{rK}phTR0MzwiaHvjU}gJqv+NV&vNT)Qhh2sZ3jTMU1S4?tZCZw
z+nk3+=a$?FRSsx2TfnA*JEho7D-<?OD<09mX1+nDs-RC7v31Wj$%staS|dhRDO7?b
zHmz*8zkKk~HA#F*Q@Pr2bD)O<_M`tx@(GAyW!U~Gigg4-Rb^lFz%j06U(yUyAMv%p
zt=$64M*<;z-F-r+waZ5#!pw!+d8jg|*J2{jr8p5kIMcr<aS%{Lk66AjXVawv_uAlM
zNk7x*%v6r~8!rfjIK7uZbsNR<yKt#5Rd+vXnAtMt=Fu=xFr$II!Cj2lCs)MkI>Kfz
z67altX${UWyR(yur(O`3#&>TkI{q0t2^-IkP^TC{$57SIJ2%RmN+f?a_c(+<*-d$q
zik6Qh5R_vhhmTu^1Kh;lndOs?^8)$W`(_i!9c*0@w1FNi8Gh&1Cs@rOk(n&65XU|~
zG9vNncJsr8A|c`H3Z#D=AwSTIa*nz!3uZ+@UNx593$kWb;al%8L8-!WVr@@R#n;^>
zaBW`FN|{Hq!wRKg3-{i*!qm`!)povzV%qphTrQ6_cZZ7EooX#)*6=K9$@=%R0IMgg
z1y*cm;)`fva~q6#=8QrciFp;x18PIL*TN6t)H!d;k$7*D`zGnQeL{y`5$X~xaGDS)
z)f8+PS`hBPuKR)(^Vy9MzI!C-rti3EQ*63YxGToHL-D4M`_@2I8Hwc`U?t9UsjUn*
zI9*seauL<O@7WBp&zq=s<yOo3-&*dt-uA+8g4B_tM4{XE(?d{$z#$irBWG{0z~$i3
zn=bu=fY-DgyeEIp(sCd*3W+sSS%E6+fdtM+_}vg>0w-fNnuo@>MF@)Xl{kCyfPU3V
z(si2g0G3GGZXAdB6k_<X92axiX;EcILzzU$?iilTyGK?@l0x=6(S~;y{V1%-j=GX2
zP+o%j<>$&>Z7{cv(C>-GQb<f8)F>?71lH5{6DBe53J`9>8BXz}c!X-rW^PYk46a73
zVG}%HyK#I74}U&&Y3V*xcxw5S`t#D2PRn;DmrC<j^St9?Zx|TSWFx2a=d+xQIu^vY
zh2572fmXpeMuz+qQdJ{kwsK0@(=R$_%Z?;I*8k(3_ZQo)m1_-qT9mG?NCLd@N9u2}
zlT`_d*g|7<FNMA=Ktt=U03-PeK-`U8U8(WxU$Gr-mVax=q&~u=zN1~xnaeXy^!RVY
zk;`hW4QJOTPcvEe)?ldbVM)$nG!~eh`t$V{9lNa*Y(w((Te$9zc4jYr5zR2(5_vZi
zp%cfA5<ge>jGkB^9kLMRY&x!(`RKqbL33h~?x^+?!p@pF|0i*GQ}R5M+H>t7U15{_
zco*{{Mho1j=;Iy877=}l3_X34-OL9Ny)adXQRV3xFRq9omi2kbVNi)&BS;$5Ut!k=
zhEbSNDw^pr#B99e1T+ysD<-dGKXAB{jKU9Eh7~^e%WQ@QYd2qw3ECrs+frRLq6Iw!
z{{nOpzECdJjmKGIrj&$9%WC>YxA5cjc!))W+PMuEQI;dnwb(#lI(aSHj+q^vW1fYa
zw6=gO{HD1n7z_$k1k99e?W^A*f~gbEJ(n0*5;2*z*Q)i-w2ctkPqKv_%yW$eXv!3Z
zb<R2moyK$E!sT>4dM#pc<VnCWOb<l~YWrysUZsxh{*OgCgev=qcM`dQl5Hc5(#0}?
ze^^Gbe`}@7M4uY5^1eWP&)uD}XL~KuA2|~9&+-$+WPy$a*=oPO7NUfCr5}+&po^$s
z!CRaliMr#aYrU82H}%co2}wT#1{>#eh|!zn`imh$J0G^+m&Zn~?P(8B*bFy=lCf5i
zD_ySVxsrR&f4W**6W1;m(@40D%_=7{B=qxx9-5Gagm0N(+(^BlG~!SaJ;1&pL%h6G
ztpP5LLEISr8r$Hs&&K~k(e5Pal3Glz%IIC*XE9NPeO(WkF)fJ0q#u!oUEggni_Ndj
zXP~NAj&lV5@6)z<1y<sGYrI&H76h%SYo`QNa1N+Y!4m1|vc{4!&do6i5zMU_baHAy
zy0Z<lan7p%X|Hbi=vT>bek{9L35F|5l5fD6J>APc4<RET|IFyH{~@FE&NwSkdQs|D
zUiS=8WF7c$lx)IkwzmRy`BVn!!{_O7TCk?WAr6b;ZJ&qS=xxoOTkgciDfc<}SgiWr
zc37i++<yDP+=3TIH)gY~;@?XTK*A(H>!x;><@Wma@aL(cq!0VC`0(Sx=|lVQP8k~B
zpjBr2jp4vZ^cX6Cdku)DkePU*sTT&-Qqc%c3#40;w0V=r&)yPGLRk)G5KuahEMPoY
zaBm{pgqxdtRdt|If-!}1=bR4J7t3}nDqGe@rWjmx5ZfPv!OG$JmzDE-VuEdWEJrum
zgLZyMJ9)|_`&p4*D3x8;jLES4Ahph>$=-|Cn<Wv3&rp4=w{}}_iOH3P@3Jp3o2Mfa
zr!-MDY{^9Jn=%<ng=ZJG9Yp!2*Kw9em-*CMKB_g5WL74<^1GK#Z#!E^6IQj5C1pot
z`Ni!fC%a*==Afv0=ZmH*Y&D{>$>Md#_0<^ANR<idO{ulQn$atzybttrKa@3y1c`C;
zJs7jOAH_T8bw6lfS;k!2@0H@@wqUPEq4p!H+`*>hK!@<H!qf7#Q^J(2Fj&4R?|56P
zLS@v9P{Z1^vX_7&Ij--U`QmqJ<%T>`+v4NN8!t?nA7ZuJA#d5Qes$FWEcDNNj+p!z
zTlKs~&m(!1NQk*<QeF(O%S&b3-HKK+dTxJ8-;AQSsc;!c&Q=G_X%GPqATba=e+m&k
zq~lC90LtW^!Kl$%dMt6*E%#WDk{;q6CB!E!eb067f^|Y&ej)BbqT<HM+Y)$|O0b0!
z)qLQQ5#y4BccgFF?(pig`jdylhp_-t2Qm~!=!2%ZyA9QXNCQgirj`g3!I=8Ufn~FY
zni{gZ)!rIWm#8|&7j|V!p5BrI?Ey+S$GP`_{qjQTz#D^`0pbq?G~VdHvY3rryWfom
z22t3jsf^E^ONR-)E&VxyhKw!lDQCIqTBh@wV5Vz9<(~qRvOu92{5J~4eqod8b<A<@
zp`hi_j3+3?Wpp<JeJ?nQ0dp|i1mcIyH!KW=W|dEXYtMIx&q++T#Md^txZ?0?K`>8o
zL^nSwqU={ilVg@>gt@25>S1D;efZzL``aZ^wINMgp^b)n8&zzROK>bel+|P&42jWr
zJuA4uQpLuvLaxkT;N&kiR7y8@01LmssN&bAhsyWx&8(N$#ktv#Az_o%X<;>xHBABg
ze}I5CZe4=0;vQs!`7H+c*@SCnzwlgVLRKaixjcueeqK#Y_`QA&Fri*0CBrNEW{K->
zH>=)A3%YatmrLmH?ey|#Nd_}($?<F<&yoxZ;wPBTsbX<bro`+_nr)1p78#9qm~ANT
z*B=&tN*TEesb4q|o_3cM5_?vul3AQeDK%cX9`xiLl(HI+1eKe+jlf?$g#rl;%Q%OI
zb^U~f`9|*S&~THq%~YIL^ByTHd48@{EZ*%sN}^KA^&7@sr$V@T!VB#e*Q&9387p}$
z{ZBNMqzH}K`BlIAefXrO`znt3_Q6#0q#f>8EJ*v@ZZ-9H$m1GLm&{7_u}gR*5p_A_
zSA=dHS-JS|`l=2#N+isywN}8-P`6wXpSH;7vphQ;DJ<FtA2aB4frHh*^tl-3e?MHj
z@Z2m3+dIkyC5i`%J^U!^fXyi%2t8z2_5`BH8QJR&`wUWJXdp?OV|IKW9%L_RF^Bba
z9&<Htu4j#yOYMsyDw9H@GzT`=T=2e7z=p}$eC7)dl`RSpz0S2w+Y2G~RJRCh1q#n8
zF0ggI=F<4-b!=zb1E1Mr8AX}IW45n;VO(T2s@f4&585d3o)JXO)Dlb_yo@EfY@YRS
z4zBtbBBl&Mi9nlyEV&p=K>+rS;C@pXm64Q9Yti!3(V3QTe_gY}-k>)0h^q+9xN07M
z0EepAtAAmV{1{eYF+PIrg}N~Bbo!Tlf)pU?FH$y9V(ba{_En77;{ndsoTsTs0$Nrb
z9;|^&h%fdqB-p!TON@4(FVQ>YYS3b4U^4d>zy8Q7Kx(VZ75ctZbroLgGN-FO<e2Lh
zsVSdcl@$KEAMtGH32{Lh-}Ec;RfgHH2ehcZVIW9b`Su`PwojMyO|xS*>)}d4f7i=$
z`n8m#q|LAg-DcKy{HV<stqt3fy1CEqvR6iz8{AZ;=E3|9am}GUx=oTVP>9vBLx}{=
z@uyCmgrqQJQ9Y4Bs_gf+#yuFjKr7u=q2JOjx3qM?JhL>(6FWF0Br?JUKf;-uG+QGo
zI2ce<?F>mWZ&zl4uM+j&*CiOu8f!=f-GrFOIR_JNz_lEIi<^SBguyIK<4#8g(&n}_
z_>#DMz=Uq_HLP!O;#zq{DbZ0$dxi;}IFTbw9G@c!sR0qK4QoAQmR1i&y4>h--D*_(
zM8^Jg5<z*q1pKj(Zp>2;{r;rLUT+G<xFJ}+D4@MB#o3H;AHNMFa6(1M)-Celn&tFm
z3TdT-k&Cjfv*2}6(tPb}Cj{+O^Jdzwv=>;)lld0{ce<{&m<!g&_O;S_M@h-eQo80q
zU(_9nT$tM2K~I>qSTm~n<h-^3Kxt$dF`cY+b?wld3vbgt<_9F3-FaRrX?W^Bf8a(3
z<sY-RblA0AI6~$_bpERKuqP$*Eo8~3k{y^lW)um<4t3_WCnj^aCG>nwCk#(d2K_<j
zbn0c19CFqJe^m^wwiTSDCy(5FPn<e-mj?(y6!>rF(KJ)KL16N@50qPwgC*P5FgNK}
zM6{mq`Pv7{%ivX-IaNw-AgW?hu!{t&$MSO~ZkwoF^;m3`z7jHJ-La4`z4kXRvM4_=
zN0p8#w%s_gh6-I0cPy=tzS5-(j1hrv$OqoPUjx6ZRl%TwV5@j(Y3y4W4$0W%7V#|v
zDwKDhJQY~#!B!DOmmW&UIv5ANnpI-HrY!Roei4Kl8+oGeaF>oBV1}rEen=^b+DYp@
zNx}LlT4M;7W~xS4=dV~CJJK_Lmo2}J-V7JSRDGL`z|S7EY<2YRtV#*O>>MAFsg7|8
zc@gPP#k8P7rW_z!yw#ZuU@r8h;U&I##cUe(c3t#PebDpeS=4bKPY`2yT*HxeKpH3_
zDzm{l+&~dg*8o{WY(Fm|hUG_HvW|1;9|5i)t3SAc@Ku!>yJHdu`4a{OQ@@qhP!UO2
zTK^^sVi`8-jR4hM?{kCOe{Vzo;y3*xo;s|Z7&iQ~$A2sQ(Jy-Zg`DZ&RE2R}ijdLW
zQAtixyE}yXrEkbZ>4nS5b^8}t+hyC9d0~67|7LC>5Y#siEA;+y`f7U{*|#S$E}F5O
zgS#Mfi<KMD?0L!NQKi=QPB45(`v7x5+v$C)n4c>i+6dEow%4h05wYd3+{zg|y(qH7
ztscm082qBh&xkd+pn43qlYCqwszh~J2DiFv0*oc)p2g{a>+H2R|2jGWGIQW^GC@1Q
zek;;k(-0P;YFLs)<oBQv-NvX8HKj^FOIWX087nFq8JOZNd8@`uK+w+@(^o=8$S0XT
zE}XX1SKgg$Gg+>u`e17eC1md86Fn3H>9R@aj&@I*NR*NuUtPQ4H`;VXXi<n9e`gJ2
zRl%&N4{B|*6f1B?DDRu}VT1<G_8Y#UwmIL*d46f9I>w=j^2OmZ`by?yqooSBn%S5A
zO}h4(>y5<+ap}w7m^`bjOO(w$r`0L67=yn<(6ll;ZnKrf-x6-3L9{)!t-@(d)j|1H
zb&=zx>9w@e)s!yN)Xz(eGdVLv<rU-nq`TUED{P?RDeaZ^hko<o3D-2^xG85v%xwQo
zNxdt)FbZlh>JZ&XSzXswPeWajDPo`5E~Oc-R0#5GOMGA|p-ghaKbmyHsc89_ux{#o
zM|sNgd)QY6t5}zWT7>E;SXyUr&>M#Onx_MRfLg)6Zjkxu?Z8s6C&nVyogw75A#vo&
zRPRldEArtQOI&PY-L~6eBVd#c^$iKVcU_mAP4C-H0cQtoye{Mtq7tAX$RH~Acia>d
z?mwFt?#%fzaZtNbiY~QLUAU*1-9d>^|FgG@@hASXtvPuN@j6AEc9*?_5ev4UJmc!#
z*-N2tZ(vb7(sbXoY-wK?q`O3>|FLTGV_Z;^$nQkeHU05Wv?$@*%o@}Y&Cty$&Xsr2
zJKe7M(NVaUY)h10Ep@*tf3xyA_i45kG=`veEEH9E^YJZhEXh3zanYX4@eTpETb?$p
zv2$G7Iisv8l0Wa2`QTn@uo`I{8O4V8kPVN<Hz->ZxSelu<T+3>e$;%{uCf{{B4`po
zDCf|g6xsU3$BCq_*=}35aFbcwQC(26ACVo|+8)qwf;ajIxq@6zcDK2Y81t((!bexg
z<ThZvgG^}Sd-a}uZ^ooi-*j7t7}(EwdnX{Cg^3wDWr>6-=;ejnQwYPL`3NKn^pZ2`
zr#<ubvQ7Pk9-{BZpAWwu$Noi~c*zbA2pcl)INIs<?Nk*kcMjoaVQLVdleFpjHl)Po
z-;qmJ?!076dJv@Iw5=Eeq^n7vS;g6NuHOa>XaamRNx=1U<oNpS46n4PICj5zzft;e
zh(zq|MT=~?dl+&a+ONHRFsF-4u=@+3phm^;<$$xRW&p(7Z>rZ7GNV|2%Fq?Mh&^=`
z7o&%xb^Mo8jdp6GI7k^{?L3H`a@uI)2OW4i0vX~-X?XW~JB8wRNLWEj(x`*C30kmz
zxr%#CVmCL0qR%=?jC_g`Lc5(J5Cm4vl9FR$?e3SQw|<%aQgWe%wT?>@g~%AEfyIBX
z#J{L${it#g3>a&%50t>I4IQWlc8W_ll4lNsO9<-ZoQW^j&EbAJZ!VZ1n+vS@{$S<6
z^zBd0zpfTQdD55L`kgp;YleOb=SIFZO?yGefxB58DV+OlcA)VOvjgmHf2pIH<rf2-
zdpf|m6OVAFy??7$6MWeg1M30FtW$f>XO}4HwM%wdq3*~IL+w1EtHpi|VII!GJBjxY
zFH{%gwBAwHeD8G2xWpOePW2QvSkl%u_66<gJ9v~T>(*>Y$lL{7)+8H_mumOZRyp*u
z{BFhG<dJhMJ=4lr0yp>Hby?24EsWW{RW$rv-UG1UcRTKP^{<WPj58~I*y{H=(O*uv
z@53meV5GQJuhCLUos6-q;Be|rxISk)6#M^?cHZ$+|NZ|zA|#_hwiHtK%&|#!$d;Xv
zy|-{eD0_sGm6>&9?<3jd*ktd$_tx)4pU-vG^%>Xa`u_gtmN<3m#_POauh;YOc-$Y|
zqngw=LP2XmTwa~e+i`<&Tvt@Bq7omD92C9xjf8C%Yw0CoEUJ;K_<@!VO(>sg$zYW%
zLcUw|Q8D!H?`!U78Go$Tc^vsLVi+6cSY$>)%w`*^Eou`XO})iez$;0gXXM1qAV(cB
z+%Gc^w!muU<LKkD@haK-c~AsAR&dkl;NvNC$HLAS@yM9T#zKtdr4&F|?X<F-W5OEu
z^WZ{_;zzeb%5k=IirV$&@U+KReuwmrJ3g-Mu5FA8&p$rVUO70s7*K&->sOBMpZyuY
z|2N!rqiAJ&SM>Tg3c4;w@g{wVq|n$@^y0M%W(_xs2B}eX`vea1K(h&u$zc?QEhUe*
z1tYC6)feX@oSBY}L<E-@;Ka8}Us`BJgrj1|UV}D6ET{W#awrJ1*RyfhCKK4(c%=X=
zRFFW|>~r3i@m(&uaqPtsv00#j@oM`6v!bF6mB?I%$Ihe8>2b=*GE!sHVW?MwT1wHF
zB$0SW>9qX!<a0~Pn2#e*vo^H-NTX;kSFhayUA4K*((4}SmqZ;%=Dc&wbFRyG-#k(k
zx4*_XQ*KX0Q<5gBsXHByVT*?v4L3cnbkR6GmTiIhJ5067jCg2g*&m-Nx9>jvGMe}+
zp?XfJ%Z;^Ihd{QZBvqCpOMFIBNU4>Q%8E9zU5^Xfe=v%|K{33OacBUh<I<)>fW;`f
zM4PW(a^mEu{S4O+T$a>FcdhjXL3||j_xK0~^;vvmk*arF@S+5UUmv59n%3fA;D@NY
zn>IyPC_El}=)wZLgemP#DK}(xvx6)sS{d)MvZ`r7!YHZ9u0X&HD`JdVpVL!=uH(Zo
zjt-b$+3&a>lC9w=;#Uu9B_C(3oznJqnvBl0DJlS*>EN7vS=6lEvBJN(MRalas?;gd
zt0MzrL=Bh3=+3kiiNrr!DgW^~)K6WNCe%^Y1EX}FMRAPpB(4eEdF6|o@kkjD^KwTQ
zYGSTf_d%rU4T9iVDhQrY{2n|DM%^TGOU^}gqPB_r^PyP3dc9pL$<jNgMFcFlx@l|1
zYuDE93qtJBJ$kWRkke>%>dqgwlQh+5h}&H|M~>e0Q5DQXw>Y00p!9?%5?|4ULfoxc
z&}B_SUh&;@PZ=N=yJWG0Ls@)nbD)-)+OyOFBiQwY1aaHF33%*+fN^e>Yi_^ttQMc1
zg3`w2a5>R|Ljgo^d(-U4GkyEP?>g@9zvnEtTFhoS77scUmRv7cZz%iRL`<7VOcn7N
z9)*Yg{xbD%3<%Qj;iqt;hVCN8ViA3C4^GA}L2#IHKG(q<yc49?(phmAkK=QMuMuUa
z5G@h6f-K%6M+Ua^HNBh6(StCi1i{F50kvk8J?nsXdoZknoo&@E;}ZSU{pYnr<r_GY
zraYApiE<?f-_sf@gIuq43}O)8_C-StnA9OORiB-|d=mXgCyJg(0Hm7lXM85jD|DE5
zMd>OVq%-oj6hOwzgn$q&;0n{lqtm4qXCKUURz)WbxGtX4s1-~9$-(!3d5s%eGg>nP
zQ)f#cF*z<)SQF(g=Qnj{1deRI{dWlQU~7gjg<C-BTgJMZccAk(L(^yZU3g1T1CxqV
zwe1mv$s_h2ALnv?(qEPE^a6LkD=4qZk*!c#_j`X`+gWz$$n>*8d0lBdb{-aqV5Qw6
z1bOK*S-jX8%XaqnmWSL8v2RUHP^u5asNOa3On&JH8&dUFIbUK_;LBMj85i*AM53r$
z-a)R1MUf*Vu~;>1yFe*W{z~WJc`1;G>%Pw9^Yv8(4d?{Q1Bb=BPL0#M>qUEh1BMY6
z4RP#xqr11UZN1p=(8j~Q0qz*(vrqIfsoY%=FMHqhixu&#E8jaCOaLF<e^xao+o`N%
zospOBZz)%3Snv#<!RdZZXe(NcFS#?z`N?ktEiJ5nz2u7|7_qrGD9hq3H?b67$}1z9
zxsQ}sffZEJqZ$vY7m$ffx7}lm`+6e$nGAK2O^o&1r_Au#I$js|^iv(dvUt0OmV%it
zOjc`xK5mD{2#f0?>Bb%eo0bk45z2j3hE~g^YDCGDv9A-baaq_9$v_Iv7QC__@worV
zjfFmXwMZ3u2^0w`ESCFeuA44PNFH6#g&Oxr#Ae!SCd9D6cLzkX)zzR49(`G}2~ORe
z=G6i#Kv~h8`yUIj@gZjq=|4($W`!a3#pTB~1I{hIG#B6CC=3uV-G=1NVTmxe1tsFL
zS!)o~$!jR&@~FxWtd<K#ZzIjcZp7b4nkj>X5rB5eBq-UJx4&Gqun0PhU^6|G?T{Jy
zG=n=*C-II3lPq=}g}4R^HV=C(D}_!b>_O$}V&s_fy_OO*oEB$jbAvcRpGND19DZ(u
z1DXeUuLi~ntDX5b$koD7LcWbg;jL@dPD&Yif-esY2Ua#=b9)7G{kcA;Y;z%7G@0Ka
z*G}~JsJxO&_~a%m6l<MGIWgHUH4MG-G=3ZEjQv|PHTRFa+BpkrQ2B#8mi<WgGQPZ`
z`jDIx;9H0=Y*mj0Q!}(RfU3+l?;S;p!z*s(kpHDzyP&@wm-Zq|+ZnlV8|6(9+d%EG
z)TO6LOsr}q+e=eal#>NT2{$xHG)Qso;CFF^Cz5LDdwqv6{a)P-C2l5$S7$XumHJuH
z0Ec}%LL8%?MrY&;{db7Vu^>}Eh_jlCAxPGfID$9?ZuPn4XAueQ+OX4Y)}0(1eiENf
zxxm6FI%%O=#}?HCe>aI!MkyD?u@uM*x^KCmYifl`N_8#r=WFM1?;u9L=E1eyqMK*f
zYLIC?IK$G+@?QA;;rl=Qekq5^sGwAGg*NI^H?P6#mQPJJHDud&Dxj6Z$<8rq`Wrzd
z1D1pl8Q<Xj5m=CGOnpe39$Y8{C1&Dd&VnATv}oq@^nz2w*88h3({)DAQ$-;DCY~PF
zwRDQt!%;+dKb4c8wYFUQi8u9ArBEk*UWrD&sa#t0vdqEtwbw;Dc#lYB$_)b?=R8l1
z$I@&O=@0|msVaK~*cax>3W=A`#%jyQ(GW^G*>fi2cCQ*+aIFP4ZgSV;R7HX*P>o}>
z(V<}HDJ@qY{e*oT69^1*sGdgN?A7TcBPYn1#JLO-aOy(}CC<pnYmdmoJ%i;dg2hYQ
zp`6j05idW`64P@yb!U*|DSDT?Kk)w-vYO^MWVJP$H3mOQN`z%o8erse7EO#{FCuQe
zVR~=ce#Ih}_c$;8(M*+?@aN`6(_tR;$cYyP&Y6Z)Rdf#)?uWazNL|2&V-9l9vwsV!
zy`9e|Jo$b_OMQ^PnCG#c-lt-e+d>jhN|e%RBU*$6DimJ*6pLpP40cNn5D5XBP=O-F
zt7!x#$L&_(qdHz&T$b;@An?N`3q?2Xq+ncc^)!8l6Y}O7(KuX8V%w04pmpC{tB3Pw
zwyXzE@<8oP;Psh0T&U<Wlwyu-dh3ZjNV>AcO#6ce&*2V?U5e<gLUiGK+XSaWd+Fvg
zC-2<<Y3*E&(M|=hnjB=D9b@6tFBm*i&IG*u76k;gkA0l-3#A^$*PGLp4_@QXK@44J
zlTKy`=6Y0R$dndnaVGcVtd`oy-UbrztR+mu3`&cChg@{wO-|gv@X0NVeEzn0%!DQ+
z5@s$^xA=RR972c|P|=Gk`6p#W9+=$d?bCRo9Hk*y<7|M<;&jJ#oqMT)$3SK88^=w;
zwm9OXjv~cA<ir-*a=Yh`qK7dd47A=O5{I3nWzZ{m8nW$r`1V8(PWniy67~+Z((15S
zxD9os+bu{LGcHN%RxB}l{^CP%-oKMZ$|N&yG<6svV|XW^NV>;o5I(StS^xs(`GJQ$
z)-CVfej#=#R$E7@WtzJ++>!&g<1C$>z8pqXM#vcF0Z6^uQiUIY)GNr!b;HkMMD&Ry
zKpdjf+Q~@lcQB-6^r;BLe)u~A#EpP*`l+*by(_%zn#QnHs9GXcR8%V<#G-fxpP&%a
zlILl~e~BYEtEisQ$r|ur?$|ml(72vPpf30oNPs0OYrO-m?{&^pVF92DYxiPkw7#jk
zlK-<RtQqw;QP&3eZDm5bF8-*ob@wNoBA2k_;*PqXmsB6nOlNz6i{}5SCJ9yiVc!lT
z?s!|OwzTESp4WJmwa{=n<rGN4I>L+HMQXKK!P~kp)R+Wu|0Ip5rsQ3~g(r<@*Q7V)
zP_xKTG;s(zrLWW3OoMm<KSB#3PVPp)Q?Q#g5_2RCOAxD!1K9T3!Ki?|HOjW^x2#$Z
zooerL*Qk=&qEM2N+4(ntX$IbY+L45EafHS08#R|=LP|ba6k5m?$Jp3ury9yBg7SEZ
zj$=g=>QlnlZ>GlR_7xezTN=jD*RPvz(r?-!**{%XXW*lUp`5q7i0=zh(FSDrcH>u#
z&1$&yEp2EUkI!et{J=WF&#_KFJCbn};gX{D16k|{w!p48THRQ8bL8;m)qSg7iw7+#
zB%C0dSKLZH+nGlEFovfB<L`aB7W+mI{w-4}=x$lt08^TlqxwxRYBT+h`|(ppq|%yK
zx*;@gr)QMqC?_<C(c)Q1;36)G&I~BeLYK-{>+g(*_I=`FJSyl3b=*22;8vg7`Bz{}
z69mReU;KNP?08qcc1dwG+Ax2|-JNjMWfe|En0nLp=GVU5<9jQMr_vccrWB0DT^4EG
zd<2&VG}!gbW_i=gP#ovNHt{OOSX`Qhnn3oHKEBAM&ttdMu+x<)7tbf%Pe#NEhz~%v
ziv#=BALgO|{bCNjKfffI!hcCJG5LR#eH{KqE9Q18v^U^oZ}+^DbqKa|A?3Tob>v4P
zbVJP{+55IaO;=-c9|c#}$(<8*n6vghL{3tTmvC3ItP?mM$=djmU3d`T?d{o>N1wXB
z7RX!}Aoodz0P!Ius`bf_=AZPuso=zGvg}$OeUa|;Oiy5JC#s7%^GFPltG@lX2g%3z
z3#Y_ZAYW@d3(RlF+$qjc90^~X!ZdU^bP-{;(=58Ax4B8z=8OeJ&Rp$mf7<^;Pg3gA
zB_*e{Yi4xf=o$xg)8bjFH=!wa<vejxl}o+_rWvRyzpR)huwrz7LJGrQ3HrIw5%ZPu
ziDs>!anB;JJ)Xvudn-)!iJZ02TMK`EGuCDL91D9!6xK9p9jLK8CkiiZmWc?jKTFOS
zx;&H?@Tkl8vbOg9`WpH@;psUij2Es(oGGKXyZG1wFkY_cl_M}w7x(Tu-JtvYw&Uch
zWg~(`#DQ<^6)56y_FtCEl&gOB(B|V{n3tW;&1hQcaf4VDQPYhp$!X+f$L+9a(Sw7x
z3^b3#N=wo=bNy!bqQ@&=!~a6e@}IIOadf>$efGflV<S@1KbY+N!`Gm~zML}jx^Ys$
zj2@+-^Tv<Lm*0mr*wkR8QwDo;!@U^UYqeQI1>V_FcxDP5e`}5QSEZf)HjEPfSr<FF
zwUMvd4^&t>`>!N+jgJ+eOA@U})IeKrwu91GYh3!IuuAp`Zkk}4fV%SNi!|03vxPFI
zAYr$f(RLTSQb@KxttO{c6~!?No|NQ{q}$au&`D(-R+yITS%B$|&PWNo%0CK$j_`e=
zQ)k<l^z9)L|JQmQJG5Z}d@iJ1NwNbKfu$V2i8i^H8SJ9^*Am$W0vYxq5-mjG1el*O
zX68^mTjtP2@ak|L%utNgIrf$J2JHA7_uUsM@|Az%mOi`W<<8m{kb8N+Ol6P6&wJHv
zMr-qaG#4T3U8>c<xT#q01<xq+zJM_L@sh3mQ!Rm&M=6<7lFwkcQ6=kRxjM&}M-E~m
zN51Yw<M9t~w)0NehnGEr5`jMX7fKulN#U2`?}Y)EVODY=0hJf#vPt9&Z%M|QD0O%+
z@NX&*{W5j>7wqWAMdu%U4W)VlhCk-)9&@*N*rc25P&77?Xa-F;Sh$9&bjdSRsNPgO
zY5w$X;7uH^U5}ith}2;zEiEN%7lo_M0)g(XC=o$Fd{q*CAAzqbyK4j~B|;=0QMS<^
z)~IdQeW#>fsl$ziN;G+}KF73^8w5XnT25yq45?a$WNo~+49GSCp={ylK^b8m<MJ^u
zWt6xAoLW`;O@gM(>ddhrhvG4?8_S(k<l)AROMirQ9m{d33%nzZ44Vmc3D<X2;UsQ8
zkmVO{!g+YgRM3^9-Cc8Norn9L;?#}5+lvs&e?5{9J9zwFn%aIFyt!n<A#>^eqk)Sr
zBok@&Sj8b^u!2x1DkZjjhO-!N1@j6s=J5Sg!=lTBv7Ezb(^uw`!@_zz9^&*SnTYK(
z9s<whG1tDss{R^J)Ysw#D=>I{51Z`HYnEY%_`3OZg&GbtoasEia5=k2>23I-EgO%5
z$UfF<k?8_Qin#ux+<T*k@ry-;KuP|OzNw$Y<9~P`!Hp2#a6btOFzNrm$#`2hZ-vQL
zNLygaK>;#FhKgiYr=O^zuam!2N$>V)jAi&xW@w`3;I-QDl=Ha$P!v__GiSRmPUUqn
zP8?w-hw8djJDmd*mn{w?CxY#Uu>-HM(HkC%Bso7DxV8S~vP;I)HPh(F+bv;l-)yEc
zh*R3vjK%h6h^=C&<$9-{G9NkRj;+Suxz)f)X3e!5-8Y5<2GZTDd;T#--YTSOYsac?
z<(v_$L-_t4-FLAQS3-zUBaoNK$aH4|LWqleB1}&43$>Vf;EknFvv(U6vrdf|vq+2)
zeq3lq;>M?5Ju^Y#A*N*0mLaC6udmHs5UP2=!Wv0TzST@=!O-V+{VjFXdeO0ZZ|Gpd
zT>-OK-Vr6Xc;-eQkRI~h%4TBw%n4htTA1JL1E-AEcUJC#5v_Bl%wY{+WIG+d{tw<E
z=Ocr^c^yj6!YFI0784__Mv<RNmp+7=Ej(O2aLOQ{X(`xlGbs5&q2)2vQ+P)Cy6B`_
z!vV+A>kD#(R6gw&#g+|XZT8;Ae3+<48#B$z8U1kEgh!Um%Cbq6yI~leigJ}~8n<%J
zzr<#e|E91Ap11k?m8aFy^v(n`pBdx)#qh5PAyFvD1Gltuc#i~ki&nR*>p_Ll&e2Kt
zm(0n`qUdT^rVe^_TNg+h?Nx+5*;i<nEj-c*%uSGO!odjy-P4A2b!2u0p%`CzrpYUx
z6{k)fjLAeubu#L8aYQ5cZ|SYwv5DKHkb7hkjEgIj!@MuUabnp?xe*n)+ZtGX{K%rX
zo{b5&10RBWnSzZly+vY<OMU(2ZZVa77gG|@0s5XB0v*6tK+jgu>-k2oO(@;79E=?~
zzuYai<LcUUn=Yr1)rEvr;Ae6=vIPn(tG><5C;4yTS^qC{z`uI!3WJ*+=kSHv`r;|I
zZp=W4b$Fd>&|(XUe&8G}ZQ1n9VTiYd)rw)&y7JLt$AdZ<%jSGz-wxrL8n@69d`DC#
zXnKk>+w7E_jGS79w?tPQ$d_X<Q`TP1V~-MKmc4{Q#i?gSsJ?(1x(^VCf>wvELq3w0
zcSuz!r>`VaQR7~M1lr<d-54h9cU%DZS!U)9lW*&W1SC<dPK(tuW9{w7JY$mtZoH|+
zH_~7PBhfud;pO}VUUQ^U2jTZ_p`dNlG+<J1D1kA@(TaBe@|F6tKy1qs^+ctkx}e6g
zx%d~MxF|V<8%&XtcLN3J^3<%}Ii_Vjdu#3SnB?J2H*33<FP?q*$C4AgZ6q`mz7j>`
zjGGF(9cv*d#S^b4WNn56V=qW>a#|*yX01CEe~0Yu9pl+|<Fzb`FOAhBqW57d$OKrW
zU7@_Fi(lbC(GCCZH3Z*=_P?55)d2I^dd}w(5(7++>>5}IeKjq|uL;itU$UeRhIdP^
z^NOayb0)L$k{1xqzJ!Z4IB}DqH4>A4auK}8Yt!cN)V&}=sd&jfXU?5*(OQ3$Sd95<
zwX{ymcgRR_$u?CFACYC`>M@mLdD|-$C*?2gm}nDEE@4ZedZEkWp$1lg@AdqR6~O?e
z5*@gd$qnS?yo(ZBWCoO!bN!&j)!z-l?k8S+BOa^JorkR^tvtazLi4E*sVCZ9<dkP)
z+Hk0m!0iq<8RJ_UGP&P&WZsKqnZFzUcGPuyJf1*|d(kGpLdiM^Ay#(0)(m5+-oKGR
zg|ux<sY>!_ZyD_xH8ELgUDHT%Vm*VrnW|h$(-0@{4WU4Dw8mw*L|H+hw$(f@fn?WQ
zv5%)+_xSMP_OMrUxp@GBx7EDxx#Z_z*vr`5kKE(&X7AzHa>a^8?qE}7W|qOzKwn>t
zT<@E4uh^;9*h73cvsm~1-H+n`|7%)4)!rmunjP>6M&Qw=s;(LrNM^0?AAgK{Jra1%
zr7i+C46CN%vHYE91REUl8iV}Wty$X|1#i2v0fO$E`SMc}_%n--0X+%xyy0NrxXf56
zh_~<2q7j0x)##pa;i0Qx>;c5nD?dNvjW5*)qCuPL#GH)%CJ{3lKOY8FvHWMGsX?zx
z-=OPpNyd6MO;HDnSpyKARhyV!?OJQafLr<T_9nLr$Ox^C#y+QA6I3bQR`oEFn}m^=
zs;^Xkd*R<It%+7pqLo!7Ie2N&nza#i2IE2*aDuuPrK@Z9k`MHY;K||PO3CMA{ZVBA
z?hO8*7)0P2!?9NSQtPe`*+9xP{96&J^A{On>XVhymY}+EY@0o`7-a7;v7J>qB0X8F
zCTl^WBL2Atg#dosLTm<UxvdZ}6t0kKJXo|FaAvObEh)uPwT5`%Jr-`FS{g<jtPm(5
z$^7O6<E%cu8ILgDLZs5+v|gfzIe__S9>CzXaHzuWq)${6Ni=5;)hC(;eF~Ttc22V$
zyT3gSGF>);DpMG78{$4iayXhUu7Sj_#u@8`-u^TaW-&FL(9~bKhcMpL;#XPPTy9Mc
z4*Yl0V<y)=knV0$ne6yKyaGUedELLFcTF|&R}A0ALm&=7p4r!H7xfx@yy4Rx9+WTI
zH8Bf7s3#KugWY@>n59>o`oO`1JZde8ducMGqvZaYL6KD_Owxfnhg1>}KSa~sS@siN
zl(tX+{}^>V<ZzGD30^F7vzCIykL09#aj=}-H$Ok(O73G+1Pa>KcFMqzH=b=WIt_aQ
z(%+m-X*#!4t->rC22xOsvDf;YT6@U0yfkubcB=VFNQCWLD~6`ak58wf2PSRQdpwZ*
z5qk+)3-gFAyE<*!o}y`A(qa%XwV58&NCOemab0(Q$p%>#Xg1GXxOyawf+nc4bD(2M
zCcrXnZK6XaJhw~Nu65F9ueG~wDXyLP9U}iN_@%NbouZACM)chbFicHz#iqE^aV&57
z$$6B}_mJfpxmYKQqdu)O@f=m)y_?*hwbM~G*HdTT>&C<thUv_2>NdKdOreFMX3WTu
z1;2<j;zafZ2jncO)6~3|ssz@+Q7qe>8dTeOTsE7qdWXtKW+tyx&ygcA&;h<bp6=`P
zrKR;ir*?DcX1xn>kE*#2AlzelLHT&IR;Zhxg>PRHoi_l_vj)!D+%6ltV$9>~>3UZ2
z+u-z{6~8=hT^{glxOIX);4yYnXj4ygLCj2o(V@Lr_nbb{fAv)V)t-I#FG_kV4A+Ab
zCW<t2NwjaZG;A#NDWJzS^Z6oKlF_c=;z7-)cspy6Im3<`CHdSoL@jEL$+Rx~;l0(O
zCsc1b?Pa7jN?8_EY=_HFCX=x$uW_-C8(|RhO_tMm*LskaJgbOee6CJ>51&CD$sS4f
zq?EZq5|wf@1-D31XTzuWP|_^520+uR8BL5YV9;3C4+t@aHSp--LfdS2vNEKC-&D<w
z<OoQEwL>6<pjB@V7i@{I=Jp6X8pxd#{39AId2@O?7CXYf2}r@QGYYbbPUb7=Qus+9
zWI)FlFq>y+o2Z)ErE9iY@BlQP1*kUm;<*|M<s(TKz1v(r!pqvi8Z#4K&I_>2c=fiA
zPVadiaVc0*Rp*P{dy#(OA$0_jn=Bq(3F~uzCAWLB2ti%i<@dyIvsI(=Uq1~EPGp&P
z4Hh~|C$87)L->IbBhk?)yV<@+uPqEof%)1J+b>uM0<s?LTC$a9FmkgIt1T@UIF1we
z#FL&3996gM9`N^1R)&R%I+;BMg&R?)jRPOd7=&+>fJ9pISLv{q<_28!pHVxQ6}Yv`
zL_uM>CvKJzC@e2mGt_t?+eb!bV1(iCUuvSLxumwI0sFlDtdR9n7PApEsOA9N5pC0X
zBpB4hF8!4s{ck`27or5b`B*S{U+eb!dcq5b2Vn&%gT+{^nz`>N%|A}tlgo;Y<2t4K
z#VJh}N;`t&nPEno4xy~KylXSa{C<aMjYPjg?mN{EhP<+j!C}LhU@;5}?g_jen0Jgs
zm#hKIxZuI9+W706(}f{Nc3L3`eBs5PB)G5>7x#Hx=B+X5%m~kmd3*o5m{%pUhzDfP
z+{XY2BKL!LZErpEu3ziT8M*Hesc0Qh!`U`+GYycO^t_+t!q}QSf^D7k8N)Of-J0FA
z%?KnpTWsIYMpW=VmF1ZHaM7TgGHXyE$30m)po(n*SUn?$ODVm3003`ko}VrVUrZK9
zim46PI&gA|(;hj)RLM2j$e49=ncq~E2L9neUsrgmSBqSWO>C@ZY#uEX?xeZCo0_!z
zyoufH4z{X1Ip|?<jI?Q_yoOTK2+j7N2Y-J>TI9mTh!u5xxBLOQEwOpKNMhvhDs6E3
zM}GRO!EX4<lXL!*s*W<?Pq}Ls6YF3fL~oXShon^XCzo$?57Jk-)7B#B-!vzVGKFPI
z4e+?nT`3?>zFIoZrhyv%oX&rmQ|3M>5i+w78`Lmq@OVN<OiV?&O+~p0g=Q~KfU;F9
ziY2RkiV#IN0XBk!J9*Jc+pu-jnDTqTgp70mZWN*a`4@qmbhnj*Mp1EhPHI`~cL?^s
zgCAH+9yN*k5A06zJIw|Y7mUpJz0g%_wr*yC8t2@PR3JdE=Axw8F0uC<R<kY6=%#s3
z;9*(Xt~6{@x~(t}FmC>ZMw|Ep8V$$Zi6p_dlIAw8Urusg(L+@CozX|~Q2IE37Cbr$
z%4q|)wl=%?+ZzJOxeW4Jl{QamL+*5q+!v)lN5|;yi8Yu)^{>sTs^TGe3?BY~{S2Z+
ze!O3L>k#H=#dZ9GD{~dwD%z<hzd^JztihK0V3iUAnTHTT+<C*F_hOwF*MU4*{L5QJ
zqGD%xG~nCbxbxuyM}X-PV@hT#W6F5tHFP502!3a>ohfoQ`Wyb%8FaR@09%uDS0%tl
z)E;>{^=Q36z(9O`=c_Bz$8oE?iY9+m8oNASp_x|@>{z@=7dY>~*mPBAY&tbBOnyu%
zFM+rk^2{Jd64fB;@QwupozKp1wxHMEMz+-o))F-W-joIua93zZ$Z)hn!HyQc>aaDP
zS|IIuLZP402D5m7mkvxMB&mF84AVVJjwjk@wYrE=K;eg<R05^L2-?8Lvnlks%~rWx
zC2)ZgSu#|xZDfco%Ck_)U!tX&IS<ar|I91->tR~8(BcjN%H4=DtN{7|W8oDDY6kWA
zpHW;5Nd`N>(>c4Iu}<u=8Ic-8NwfmyL}2`jyhT@Bl%rZ`n?2jYDfzm4`>_nQ7EDnY
zV>vV~RA|C?g34f(?+OZe@C-50T;&f5eD!Au{O&5()rg4Tou2tGej9N!00nM14?n>r
znlzn+jYKA&wP6B?>)`A}-?kj~MG%`+xL?(KKhj-x1rrks;`R~AVi&JwU@M?&_NHft
zzD;EX?m+s^(&#r>mMeC|=W%5zdb-lrJ(?Bb`9p_WAXD{4G3j70dW&D@m@7Pg6Fi_l
z@dR1nI{V45?+he7N_cjBiRx(?HDnH3P(Tc`xrR8W5A3_tB`QTxj2P-rX8f-zNRcQ8
z<+6JXxVVrBA%3&Kr1E={G(?+{cH#vK3qyxx&8nA(TL*<V+sl`hI&*a*#Df1O6Cn>W
z5xakriQq6;M?_EFO)Xtl{+er>z`Nk&{DeUIYNV~T(1COF6o96vyQ_0L)B<4;Ak>bF
zHdzm+*AMl2qqms-=K28I2ub1}^QQ^~9m%vw`ZL!{X>hOqGH*w%xIsa_;bOJy9&;oA
zD`rt?^a+WcW+0XRtuk#0g{Ny+vl)*JxEWY*@;ZW>0jbH)Ra9DH0h0$S47l&J2J5p;
zj8X_0oJ3#J@s-ROp*c>G=~MUXXGm3V5Hf(08WRt*RlXT11mV71ykN^{R+k)1(tVCu
z)UnH1w!7{!<D55Blx6{IH<KCw`_MtDLtD3ur~?5GGiI8Zk;&W=xD7|mTzW2ae)S<T
zxWI<T=Y=<=)?15=%2(%45Z^j|*C|3MRbdmb7qu|opLycA+ystxb$=|l{!{Yt&*I&=
z6mwvM8n0DxM%*XneEc$<hA698R4Oc$kh_AWrxl)1D}deO&<ZOq5H(C?k{;D$QHESC
z_3W97cP6_UrkW%`x}MrX9LXpCF*B$oI|<3(+Ju4e_32We+sIoLydUz)icv4^Six;*
zkA*}H_m_~?h;Y!oNS~vaDz4uC4kRs4bmnt6p@!;!dCUWt$D9Y^JC53q=HJ(;i~Guh
zI>>BQ)fx!sgT$Sz*AP(W8g5vAK841m*!UMv7?q^FtXFZ$E!+MBjMceZ8CBRcJUDG;
z=YgV?>Ff&1GfnE_&!=H}yIREEo<gEo-`=E{mOu8KsgM)cFG|Ip`Suq(eT++$RJD!F
z2bo?^S_5W{M4x(mS9_XP*{$^#33RfycJV~hn;wq=_wFYW81aFDrh!4AcSoRi(|9k>
zGDj|nBu(z_SucQ*^fLvtkk?7K3d(dcpwzkv!l7(<QjsLzAvepImaJkHHjjd7vBe1Y
zVU;098*ZRp*63s^B&mY88dEsq8{)(GP=*5$Rbzq)olmLvOgq(!W8a&1mp+d)!v%~}
zd{zAojAz8?=BF-7jC=8tG~`_B+K&n`>O5pm^QDV>zR9n0wuZ(II}GvV)#6b8Nz6f%
zpk$&Q$CPBN$s&@n@U_-VWho71h;cLaKHnyEulaK`A(m|hlNx;iPtj8`CI|9xR{9js
z66M3hNl)98J14^>Dpa3qNZd>w#&-Fd^HfK$M7`zZYMgzhXC%&YSIi(6N|;NQJK`no
zqHsUmG{Tr~v84~~E2;wbiR-2%;lrip!8^!`{AVP(H8(t63S`m{=Oupgh;19XoeiBD
z&9GCWitT{onLYN@=(<CgpLEUmTViU%drYa0A7(=_n!csaC^u$qH3(6GRKN&m8|ogF
z`-OE3`DmO?H%Y514p_(e2juuHZ|1e-`{Y3GuJ`mklP8FT&`SI~o>rBf7$ed#xsmk6
zII)Mr>#V>B`}YE$3z9W}L#3{e#iIZ=>mU8-%Bnj3!^nwa_GD*2djwt&Uqy1%X)EFu
z^(p(Sp=4`x3@BLv)->lCG4hY~Js*6ZP`;z_8Rgd3ZJM`k5vTOxAz8Bcy)&TGLHhA8
zodNB9d5bpn_I8iqMSC<e>(x<9GY-=>A1AHbM?AVHVAlZjFfQRe$bx+8IVQPN6b|~h
zqFb}SW#M#+rLX+n9<cO6j+O`%Ab-kwV6T;SzIiKS%kVw0d_Uw+@aHc6zmiwzVM6Os
zSvht6R~{7a(xt|4f(4|6J-xarpm5e8tla&3d!ITm_xFTLfBg*46<-ewGDOdrB=zaq
z7B@Uunr^+z{W%CiOG_>>?*tLbaw75doN##-QoDi3$fSEo;?p7KOGv~!@yOOL_Ifw!
zMNjS-2N@~g%QX9AX|Sps4ISRtUh06w)|rjK_PNx4>QS{VklYiJ78XIL)b*@{2FF8{
z_X6+6hiE@}S)=va2`s&qc+6#OoxZl+K1yxDS>JXpMy*ljvx1DkGtdOdFT-|@mMUTI
z1mVqTE59!awIemAdsZqZ8mDK76ScToKfl|4+h1hke%fDr!2U9w{@eb-ENUWE2yD*0
zM18g0xfJUDAUhylen9^96#vr(n%Gti7is%fgKnl2<#@rj*tt-8U$Tgy3|iFJe*^-)
z`eXbf%dh@Mc}~p0KB7<hbHzia-6NGnn#UfRVSZ={ll;xoQ{*_EfG_2NcMQTGkqly_
zr}4lBbw?+q8e<VD=D*09i>axu79=iF9-!70@?_=BY5*3|!Ruz(OKXj823Rvo@j1j@
zZUrhlA1Ckihj4PimNG}&z5sj0KP(5KPg<XQx#sXTX7$PKA2GCoe7+k)n-R5SbEU*Y
z)CMYV7G$%}62Doh=@0mJ$itBR7HQ5*ywGICM&#nceWsKY-U2(?k%sFS5KH3muwbD@
zlEK~Ri4<c#+M9#9!Ciw@Uv=~2QrPMO1?1Zm+o{Rc!D-CO(t&gUzLs`2J4LRX%}!A|
zaOqR&I5?xLnZ^uV5!H-*$om^aIk%2VosQ%>EpEn*h4bR5Hs0>)Eo?{Eh+~$fx+A8E
zToxXdHq7gXOqaB<hzr-si#}Dal0t4hH!o)v?U=89dhcn3QeUo9g@?si$7LSRgP#S-
z@)52EyH+cTxJiJwFXjke{915*PTb4GAoPk|yIqGx6Iwrws2Nxsyfr|3-_d$RKanv>
zkjYr=t{U?^ecq8!`)Y_{N%&DsKhDQNu}s6_h?(-2E7V@4D1KxFi_Vbon5jiG>37Sk
z*Pctxc-bQdZrf&;oiQ$a%O@uJnd`0)@u`~RpX6UxEfONTUWj@d8v}v|M~7g<jP{si
zr8hH;+)THMk2ju0P~mKNY?7aL?Py5P7)>LY{1+X@K>o`jud2YfNQPmR-s#z>p3lX6
zHQcvYwl1h?W>ML6opHprJt{`Z*rE&%T{5JW4#z;KgCOkJWXE4>><%#)URInqZ0@Rx
zarQZPF5>nRUd?-^05#B=B&K5zi>oCKIcxCDJkZTO@jwTYaeyYxT&@-rt?=+;{3EH%
zQQrAJ4#n_@bKgqg{^moKs2PKJw|jh7B;;eU<9W%;(5g?bjqpCmI}-F}F!Y-F4(T)H
z`aogJ9-atMC1WnpX5UgJb+Y51scm=SD?sj#P{W@DqoYgCB@%R-;uCJQ0?dR?)-hp5
ztD7v%!ci$~x_vuj@&q?pZNuKT1zgAbmQv?~zw)KbKJjdL6fDUNoyQX?48LgmMqYEr
zOg5`>>=;k9W9fq*SmK5KxsFFA6&~i`B-8Zm=i^L4x{l^TNyn(#*N)*YLt*_N1$!JR
z*MZ*|UX<h<%XLg+Qxug^NN4I87EXpn>5{h<5o?=F>$&NvDML`j@Gt|eH8lWeE;+KM
z`w}W{L;vFNi_N{NWX>?YhutrY-)A?~Tv6h_AsLC`-Tz?~-P$IU9vAS4C*QB(Rftjy
z1@SxsJmNDjcBUBSG}$%Y5MkhJutbD>a4wgmS?_5}H(ezWNkw8rO<$ybIQ2qc7iD`s
zlitwJ2R6<R1CB?deL=<d0HcijmI_uq51?^q<Z7v=HDZWrfP+=rZ-~`7or#|!k;?SJ
z@-~j)1^k#T>{9aQ#l!!s#~Wa`Vw8TRoi1#Lplc4BEMzPZTAPq4GR?$~&rB2P-KSOg
zO^Bo(y<60kJ=p%`M*b7OVe0DA!G47-l+9^uN;KG|WjqY-#bDA%I~BLAbSE%jGO%tX
zN~e{>EgJ+14J@f*O|LiIr*H&a6y(z4Mc%N9rVrgeFsPZI5yrx0;U;b$C6!U`tF(FU
zl!iku<;6%ZarHpQ=;i7&#Xw)X=4O!2T;*=F{XLk*5cp&S`Q-I<xSZmnbOyyh&AV{r
z{d3;w(-(^2S+CtTHDGie(mPHbPk~f*YyOw9%%7kt4e`x!bi^Dx_mSk!h6kPdI*W+B
z*+m^JZ`{jiRuFg$Q6a9Wnd*0h;P1dNOY;+y*LS{{#?alk^Kep4N&oeg7k2HBd2kvb
z{q(=oP&fXP+-T3vJX2Z(L5DNO++K3~VMOA=r;zBQYQtkh>z2CH8C1*ramTST!__4T
zjv!@($VZK&gX^q%(vM<wcZcy*sK+7bf<G1{e!m%hv7P>J3ldHDgkK1W%f|gN!`Fnn
z`)ppWTz*{Hc5mwTY=*LC!SdlDf5O}d6)u>V>wo(Bjq{%$|51nH9DcH2BG<3FjDQwA
zL3V^K-rsl`&mOUt*DE$@jSfA^ma%@LvTbucd3||LPU%Fx?bR2>I-2%mP_UyNawx7p
zc@uR+T`f*WG|Yh!SCp-h?PeSmnPGphALUe9cW4!T@NeEh*E0%wgVTkL=>yxT-zf%W
znbOsG&TXH21J!X0ogy5tP%OCGDwr-cnctWWi=SREsxC-=bxK&l)NU1Va&y!+^IPDZ
z$bLS-cZ{n0$^E_Vji{m)&H=SNxqhki8S42DHB4m_IIQ}Ko(_-4l94%Pt53&qD@HT)
zz8jOurWcicFC%bvOY#=_MPvHOzV;WoL3s{+O}Mz(N%CaIkXTpkUG#?ly7`SRqlfH*
ztvG0uzqRMV?ENUuU9hG&f1yJ%L||0~$40O<Snd`#gNI^&SV^dBA7R)%Rky4X)y)$v
zgi!*6RiP!3GO}MMze-1S8h-RGM)2}NJh?w<2&raEG~QNYn)*bF12+1Tn$H-sQ&ho0
zp`r$6@eEZxh1=bX$^NzCAs2X|7({5HS|JQBb9q$IHeFyIlKKzxP%58n>>E`E7$G?G
z$q<GqeR2xVcooeTm6gA(lU1<=_T|6V<u3f^9?HgIEzW-l-oku+!Q)miJ&a_qrT_9~
zT87C>@Q*_cP|@(-$CBX&gv(fOpRJix`yx5}9l4pqRXaVFH%mqLOn$4<ahLBjLtL-w
zw%_hqnFhx`v1oMOCOjf)&oVhW=bGh94R)F<rq0i`dpIsnmvtK%-1@Btp*Gj1d5?Gs
zBW9s`GG@at_qg2IN?l}?5$+*(G|NEn9nx4G7|*$@v;?~}sFeT`HR5L>mmJ@&^4T9D
z7krrV9<_C$O7*K_U=(y*7S0s@|1Hwl*AF*Q_(8!;3OuJ^8V{2eXB$5G3z>Rh<(SBv
zA^P!#*5HC;s#EHxT1_PSSmgCQ-n@vG_++xqjQu(hi!+HjS}gBOq7E6PL3tb0Wkd-W
zlw^V9ljVKHiv3p(+{&u~VR(<d-ML?N<O|$NFdqR9`)x^2lZ+8Wz&dqFziKt3kj*42
zSV*WzV#{C(13Doqjxmd#&-op4W3hag-ioi;O3$BwVI{iNM+g;_{PQ4YGjs(&F4LT&
zTblvtXTu{mcV=3Pk4!02y*=K2wDp)ieQxCMK|g203d2G_c(*TeMX_^mu@p}`EaL5u
zzv8=E?~ts~$tO#CdaZP@RdJAjllLJt6jNwRf7LEn$zWaJ@h|o6xtu^ixrEi8V8R&F
znY&LRyVNwlvxdGz!Wf2#ziZT;|K4&X6^|617!7uV*C5b{BAIW-d>>Zl8vGJj9L^Ax
z@B74pmUJSN1+praNVc=m?Z5E!(|Ug(dBfYWZzQ$0jA_<=Tdev%A~k5?l@QjBdo`T-
zA7rc7K{Z}==gKB1&0(+W`vTfivKkMPsyVX`vT{W{lL{Sju7mIu8c$9v2w&NMYAJ!l
zWdlgn8FoxF{AJ>SK{j$<DM%utX5{=?6Ao?!e^LZ@Z@r$nE9G&rB>g9)hr|qW5R~E0
zQZ5U%ma0GF!a~m5auyhmX^m0`0Zsh!mL553<5LKZ1Ldu}P-j`8Ma)Iq?#HGGj*9R;
zUPdgmj_v&+>)^I;5_86ymEIRaC<fMIQMCeaNVIov4K-VVBGkD(is$vn0-GOMDG-<n
z2Vtq8huxK&6Bu$Uv!_G7pB;}lQ#^Af4bADAoVi<Ky>L;uwO?)t+yWzfcs^rywn`pd
zwo2%Q&<1>6i$^=tTm7;2pR-Nr==3y`n=iJ48bEjHWG~PHXo_&zbLYR&x^@1*3GVo-
zhcEd2h25Ym9pjRuwMV5O{*meg!KB<lqrg1egY3eKa*uf@H>-z8?HLW<dOKJV9&*%`
zayuYJY=^@!Y)2rV^T1#2ouX!l+U|4MXAk3ZNEF@c%{KSc>h|(YCo#ah<@#tWL#lPV
z)r>An)Cq+d+tXL9zfl{H+`0V`Nqx=<YJGX}>&qH7Y{P2#k<WP}w{Gd$g?V?7*Tr6q
zKgh|7W3N5EyG6Tx(zyF9`#Xed*ARJwn{4Gk&jZp-4RMWcp_h9qn_q>I3l`80fE0)H
znNEx`(P#^vmu5uEX{p9QP3dMc(nc3lEi66`NuNoxe+G+k`){zQKM0iHh@q(QUNJHi
zx9*=s?qImi&lNTZhJ;gVs-IzpvjP{mO*l;8TxZOwUtf(*)F?b<C?E4EyO*K?WvU~f
z`f3yU!h5HtiF-0@-@BpzFi@;pMzo6~Csj1=0~RKw@9<}A-(g!Q#lZAVHs3w7SFT{n
zIW{-6waIs&m)ZYYf#iAO&V;CvdwhQ`cwQ8~@5z?L_Hsz07;>v%?=ZeGva!hpZdB)S
ztEW=bv0yP`Z6J)y^gbvS8^`-?gnAojx*4*3p_+Ni)!J)4UA|ZxGb^S7=L@LW)om3h
zC3fT=ex5S?$H(Zv0uBuDj?3+7as?h}VV{P>A$Gnu6MnR2J<NADs+VY5ub)^k_;By`
zCk<}3i$}Hl?7j^GDS6}TARoo|=mUl1^G=Xak{zQ8F2*9DS<yW(8u6$i*?d<0`pjMK
zxT4!jIZ%Cv8-G<20&PiX_4Z<8LpQq(N++D*d*ZKi?gTT6NV{R=my=F?witNqtQfmX
zMN3VF)geIMbu0`4fdo<Jp^Mw^(@|=8UvCbNpJl??WUc8=UecQhp9flC?M-cZnNPRt
z83o^2Z0Q)yIn3G=D#tx&nUk%G={h9zoxL+SKO%gZT*{A`+1u0|P%yj}_y!~}K$PXL
zEWy9<=Xha1%aAq!5&5bHE%IJx1*AOv>vMiZ%vVMVNeoDLb(^WkGl*!3^$*tBWN`tW
zTwJ8Xjg?5?ZjAJbMl0S)w7Fxpp|`FiB`DsD$E51?%&x}YZ+zSz$@oH=@jmAOd0ZLY
zd*PPV(+wi|4wPWXYz2U+@${dsp4nZUv(R0M>eaLxJTUg5=@O7Z7)a~aCS6a?GNC=P
zQ-58f@$OAd;X`(VOz$XY1Fi&;h=NtKp$NEDMn1n+u8f*#{0|ZPiE>?wS=jSD0QB1P
zFdq!Y#ZO(KK1e?cJQ$wmrTz=0Z+W@Wpxh_1yYi{kNwUG!DBd@sM@kr|7uCiAgPSjQ
zQ%(dob-a0|I6`6lYr+tTu%oiE=T>sfP5K5Q?zvC%T)G$N!?S*l=q(+~7qhY9V$O>R
zjjx;K=_!l0zEa&<tZs7=tfF{c(-JWIML=iuBzklHxWA1pj$oKvM0mr!f%8qkgI=Ny
z7xQ;s&y1S4u59AsjgAb5TSMT_|EQx|D>st8kifton@mb0uD7e%5-&edSvo9gyE}!S
zy1e)sb9W|l5!fyM7P_naGd9)nmjd*jw73uZYN7%qbc^NXR~jFAHb!1W^UANL4D;Ls
zO!6ys8eO$5Nwb6eqadetBmG>g7G0BEjsnw0!uR=XZp;(>s&(0Oa<6ZUkeUrY8q!w`
zoGPPD7Xp0!XC)d6>w7Py8k2<4%d&3K<gVf$$g@0s@p^1^nuULp$lJ4hKcJo@sxq|J
zu@mI?_})v~gZ$oOpj4-wxu<ZR_Kl9lT{Oj7J4l!>2NArv!y<EO1kIpeOZD#mMW_BN
zZt9s%OHeV<j&G`tZ6{*fDQzg=wj}*>4F8=%WpJ`L5_GQFUVJLADw~qg8iV^4nL~7@
zVmr(_8OZ>-Aiy6Hz(H~&ds#$Hla-}KIuPH@+QX_G!~7z|U{n2Xs9Kp_d`5QYu`$mI
zOwe;vZ?8x&L7f|jaDvg5jz?T5v9VR<3X^sA1ERG0+I#H}+#3n=>z=}19!w2XsiwrA
zg6a3?U={zR)nj^-3=Pt13~hnL%*)dH_j}8I9(c(@N7-yPgHuo{Vy0*PCGMPYk<`9{
zln7fGKs5U1f#EoUv0^nLndhUPN&h}Ymi@L_uhoh18COf@&(AhL&O5jfUq+d$I|x?R
zqhrjI&5NCg4d~=}VdWCkP8fXNo*IsWgua!k*J*v{-plm8H)9MM_DQ0{x5E5Jz0<_q
z-s16?o9rS%zub);B|5k<JS06CFjB-Xnxh%gsszT~0WC(E1E>GdI&#d$#KtBjJTE3Z
zZEYIoILH;8a&)EJP2M;L8LJl8P1Z)?OwGC|#2D<CPzgz2jKAcy*_nGx=zfx8TG?!A
zP5VlBQygtNOV<J;4b>sjSy|rh=@?h^pbk?tbJ<lg`;V;=gcRCcN6d4(IuQr=t$P%~
zH|#f%6g>C`NGeVBMq^6cj_@zL(%&>7E{VMd=?}~s?xx0^ZCXSZKb7d+dgaH>v=4A=
zgW_k|Q+tJ4siZkq@rt3-%bTi3G;RiWTL*Got&D-EsF|6|K=<cpEBf!zRu_I(Tx$UL
zdts-+m^~j)tV}@=lv~7tX(7AHM`tL0__19icC(f$YztK_{tpK_v7Zlg>fJ+Mg5TVz
z{<?R-ln}7Zc31>5W6{6iWMO7M;bf7?c8p(F{+#DB^1tz1&P<@FAOsk&R`^`!lMFtI
zZ@31tp}l9s+6Bk>#$cWolF&OvH*3oUUnf5~rgb3CIS|s3EDK#7Cdj9<+dEx_k%d>$
z`zDo7_`6j`s&csPX@{iGOk4MW(i#Qt>4?!G!820qLDXLsnCVzdQ9aiyck<66R4PO@
z)wE_xM2^ZIg_S@Bop+#<QAagFjv)>cq^W)84+_dNF7Z)b_c5TpCPAia_{o~bAc|OS
zv=(7Fw89*%qrCMgImkYTOnt`vv=#I^!RTY%0dvC7`De9FUfuP+cjl79#ja(eQerwS
zRZL9c8oSM4ei?g1KHiDPxwFEPj5;P4G45N3dq>o4VN&m*!W~2Dlj2DfG&lG3LCyAA
zmeAl9vk{)Fd-PH#GuLKW+{75hnAwe_Qxn~vD_JSh<9V>X*l<j$Ul&^8Sq6L|fxWY5
zs~(L0%$Lx>PO_~{q`MJTdk=0^N3#1NcZ?I6YTb3ME=4GTiPGi^^V83J&^g+e)*OL6
z5}v1hXY0c8`1q?w2A^1IdirJ#0@k*bzsaC8s<}uQJ~H}sYgo#OFW6S@U?I3y+n+wH
zgx0BSUW^We2}8j*!1q_{%U|Qf9C!!=*RmO=yNhUe(t;SCaTUaEG@N(XTvSC(Y=n?q
zb+p1ZIlaX!=tXPfps=}6Vt&oI#trA?adzo<h;dkhBrQQ*_e7M$9m%JT!AfT`qf)Ri
zMjrg*q-7aBli_}@_#tmDm9H}mG0$74W?FEbsa8JB5@h*fA^kh8xDtPcovi2Xf(<uD
zZQ)J*N`3)v-(25&jp00p<}OQ|;gEnTWg+%qLL+1)hb1uY72f^Z5?}B!7_3`lA^f(9
z*iq|no4KTe=t+c5W;u<1FE^;KX&P-`t_J@H_5dK}hi+f^<=WWa0mc<(8ly;T4e<!Z
zo^%6Nl)xyvMu?YCb0ZY~&Z?4o0`eX5ZN_25;)zgM=}Y$*25#y^q?2_iWf)QfS82Pu
zmYc~1p|%H0S~}63$_WglSzds<>}ml^{amiW*AdzpCw7z0#hA7cL|95wMVCv{Sw<zF
z#a42tV?0!tIIDXfUR%3CDu*_-Z1q+$W27O6FM$QBU1Oc>#k-AWuzA>51d!PmEL1i%
zqHo%>e#wQ9XF`cTBQZGRRCnHXb>rsDf>fU8X8+e_-8r4n`ik!m2RA{1{DXyQzaL8D
zFR?dJbT+)LQ2gpY=a+x?=OqppkyP=O`BO?y2N|3vg0=_O9uh)XODU%<S6$r_U&zRD
zc_;N+Fgf61jJhMb&{V?v%mY4t3yd5@CoMyBs6nN+Yf$QoW*-=)-i>HQTZqelIHP8u
zJ09$MUCX8}gXVV#RCmXCJWfsdTcf7YrR8enkv$dnRklAG6AYcg_Orw{uyvkoc*KMa
zb3a;)x_d+OMOHKsH_=F}fjx>dnjzqIlz)<BDlD7q<0zbfuV7mHS*r15&{%V~Kf2lu
zO>)+NyE4D?pzrmlaPeVqNXeL_YG$qh^o@Z7vZ_BmL;$Yw3@-jQmUh6t{vZ{RFcWme
zh=D!m+n}pGzr>P;N;&9`IHtKR=(|Fy+|#2wHtMU^@L-x+9|L2S{8jUeCp^<xWitJ&
zD|O_MacpMRy0?*rRw~eCwwy5<zzsY^$+>DG>a8e}CtU>dwnHbLq+uZ4A~sWWugCKS
z`#EBwCpb)@bu-d*SCXOvceT$JoO*WF5lfgR|G^IQa>uk6o2Z@o5BT``ZZWr?Vh)1I
zC>`g9FdnNb8ApW#m51QOa^Suk=^bg*cGjJ!gLUBGVKoh&7X(eND8Fp2e_v~jVU)h#
zK)+p5u#uXuTNKF6`n62s6|w^|jJ1kE=4C6{ObbyOEb;UiDKOQ>F6Dtop<~^sn{N>?
z&$t}_4iyFQv}V!Sv_Rk8DgCSAr}Fqdg$n7~TMxuF4IIZkln2NZVrJ@?tOSepb`Ik0
zKe44UxlxzFDk^nalebj19_5HS2@V}{`BQFIKDqg=h~OwDE`@6Dfc0pGtc0#gz}pyU
z<0cHseL;SXKYCDJ?{;<Ztx4<OaT}$S*8_Xxun$}o5XPtUz4m9*e*Np=sZVU>+KuLS
zJ>DM>{mEU}9s$gLySXO22dUn2T_R7{EMw{1$8kG{w;F{csJL^)H*SPYyiwz$H6!R<
z55(wQeZ0z`oUb2*nB~$RBf3={|M95~9pG0I?p2HS_lwS2_cXwbWWCO-4^{KGdk+Y5
zDk)<O3sp~9OD%YiqWT1d&Svj|JA^KK;oCJ^`gx%Xr&Mj^)Mwj%+gAt3o~pJ&F?Nm@
zp!%Y$d1S%6!6xE`SyV+?{N}`5Mf{UFH_LEUhDKCW>a7ke-}m*;Ia`Ho;U_xnXWfTh
zyE)SM2V++G2rZrW6)U=DPsO#f;o?8~HGj-Hc_Jr#8$Wb-ArMR2kadLgLzCf|otPiW
zUqhzKEovg0y&w$^=`BTA4&w{GLH+NBze9A5NAG&Kt;Z(l^{B2bIN9MPOt-J9Z4PHF
z?eL1RH<>yT@)#cPs;(DuvD|MI@%CO8M{`267QdbN!@n}fE$>bBp+<oljiRB#>?Yx$
z*^T0IoghY!UaOnU6p4Wk*A1?g?u;D^?ja@gweEG+xoJ;>wzN~7=nr4|s4&+^d;F{l
zt4Q~&C=gcqzDX4~uQ;>R=ndxjS@x@Reu;LWYS`x?hnF?qdLju$vkOgBCD+{fhzu-y
zRy}?wkpArEb-C*lrhvd0vuS1z&gMTuDCs|TR1&+xjP4|7uy$=5C$sTSFT_KKir6k2
z<d1Lj1Ng>*)SE?w8khv?cm}zF76X^e3g-4^#-UAd&OcF=Z^U0I={8q=yb;+`Zhp<E
zsqnRkrrhS7XOpZ{$Xkc;mGSqA&LuMIC-1-Q({+YhG&*M4zv_mLw0M@R#$^OfRkz@A
z*8O=WyZzt~dTG`U%xeeQlLyVIb^=t+)3Ae)14iVTt{kK<5HYdj(6uf0?4-+}l?B=y
z)(m_zDD#ftLU08@zsND^{k{L}4a@etcvQ^J>X_r6RhtjK{1eh&w8Fo!bmRFxxfMy{
z^UDwQxemd?;E^~+aE?qZ^|QMUm#r1lN>~M16i`uOgK=3r6ifRri&}_PE?59YQzne+
z4AJzeAS&n#4JWuDkgl4&Pj}eYw5YBWkZC;n_^np052d~N2VPGM?j_HDB1+px(756X
zTG^j<<<fvwcCXlTGK+U$tbvV|;>f;!eSUP0h%rfBI-||ab_@2n#3-E!+FAY=(*@Tx
zj(EUi|BUWcB_OvAd(K@|Oog?gW!HER-V5`mhpBysjNhHOo0EHW|Nn9K-f>NC%ffIJ
z6-5P65GfL+D1v|pC_O6D6{I6wiU>#t=|n|Dx^yWLY0`<(rA3jBfb`yL=m7#DB;i{@
z_u2cLyYGGPdB1<|d)dFecb;UGnOXD9%$hZ8##C!<sZLm2PJY|wVc%@Xj>vb9#52CW
zp*=zRg&EwAGx3GuS(<)NvbroYdH}ipliEe(-LR8l_i9l>veU<r`!+Wqyv(Ndjp91a
zkKR&K->&;r2%_}TgW$fa(Ou$;aM~w^oWXTdJgPSEuLf#ulDYP&aga8ZX39HKwg;z#
zLnir;f{3$^Bu3+Ip@@E^A#G}e+l#Vi5>DL*Z#4<GYK{4Ose-g2w}}bQK-!R2+d1cZ
z%7W1n2k-2c6&b+3(ds%?OfpBcqs9sCq7&Q`h#RzM0@5yW6c)HHz=f1%U}eN)@n%-~
zu=a*Mj68CzX(w(-1hO_F54$!~POV*Q2(s@>3K%H%M6eC1Iq#(Ul>I>%di#P`-f2)F
zPh^j6HMncik;QLLE=jXEzeT>Q#1zPr+39uORWeQY^=AoP<#09zy{tw~9LJ%si|-Q6
zsK?DLo;!g1j0PW&M3*IJty=YDR;$o4WXcGN!|B0)I1A{rv6*1zJ>F7|$=lTW>NR!$
zMP<`0^d_Zc%}WhOYSDU)Zr4%n&mH4spVn;RhuDt<U`5@(L@N(ROFX5toEknw*T?)v
zKIn?Gu1*oP>k5*s&OUS0dypif9sV8EH;+Wb^11ZhMEJS|UJm0EydVr`9B$8$ic8hK
zoo1<AVR+mj_U)tFqqr7mEb@@AZ#<}}_$f!%<^Aj`(Rs<`=YE3M_|jRB;1&OGy;cA8
z_UU&Pi!WcA2eBRMdiS3nm+c?EPThO{oEe4hTL+E#3`UWPyrw92;TBG3SK7sLXn@+I
z$wsNBY_UUO8pW~=&6SMol!vBGFE~<5=~FyR;#jlINRi<jkSXsh<&X6|end`dMh_Bk
zppj9+B3YDiHV2efxC9pX#_|nx4BJo=C0O9NW_;oSa#5Q8oGwt$$ePdsk6*;Wz^R&U
znX4C1*N)-X*5W?<JjtKb1a}cQV&vobPg?083TV7h@H`{Y@1Wq@1It|p0)&59>t0Gv
z(Ld^<Cu;M)8vQ8R_JFvKJ@9X_f<Slo+fH?4znlj$uIhxomC`_~V|(G)Ob1dJE+`hr
zlh;YOI9*$s#8XbH`y}x@zxY{lesMWQ%0n7zsbcv*ji#%Nq!n?2&h!hCTY9DQG017B
zvwxo<xX?{SX|4G-EQFt>oh`t$>uLR*OCwZp4brw|FKhqoGdsQRcD+)@;Cb<HAT7o~
zi8(#T7iXhlWqZem;ATarKx4xpYD%b3!F`?<!J>%2u#jQM$tsXpI)?xfhE2CA>nmSb
zASOywU)~sm@t}m9JywH@&nxyV-3U6Hkbc6iu*e|jrOGIKOxubFMIU4S<3OJHJj-6M
zp7U+ZA|B4{Es8gcdWmFB_1}z{`<J7%q9Ow)^^QxHLOBC@L8lBfW}pyof_yThfsy5L
z;gjs(bjntS$9K{7Y5JG)5wfl=Ic|EjYx1M)&(TaJjMYOHi~`NW;{_+CXA0b!hPGed
z%J;1GIon-yG`Xxo=W#*ei<3Q-FXhvAr0qRI_e;^V@lcgYh);$n-Bw60dh)R_LCPh)
z#xC$)7E5Rqjfvok#20~!F6h3_@<Nh1J|E?a6_Lu(KAF!r0>7Gs*jgO%S}C{u;xFUM
zlRhtX^;xW3d5}zxxf4jexEMohIo(VdGk(J2^2|3;5C>u%{+F1bjDLy=0)g|*@w20n
zy<=;V=gE=tRPEur1$r4M0{v`$V3hhqs6x7YvTTI5adzN!og@gwm;BD}-`?t2=4H9n
zFK_lclrxKLB?P@F#odNoIsDexcTC(NUL#Yvw5CX}I;ba%7F4QKdcQzsu~Jg8=zaeC
zAX{(mka7vg*8A5|T1Tw2nfL-G{NOmnkyV#_NA6$myhDHBj$Hgya+`>H__v)GnJzHK
zqc&!r*3tv#d+&XB{``6O?gv5I@_W<N9%kW<ZPYwrd5M`nagsZ(o?fv=Nl9{Iui5Dd
zDkI+uaEKf|4_>d<5sNzAq%51QJD34<|JQ;-6>i$b%iL1iKW;iDvdZ#M0gg&n(C`A+
zW^K5I<{M(-3xIw2;pcy~PyEk*<5B;PUrGL8#Mzc0e(}Wd+W%9zjX@3)6Na-QZ&-C+
zcjzE{3`DC<w%PAQWz-ZqJH)XTQK3`KwpI@cqS0(cr{*%3<kfg}h>F&qvp+_qOieAW
z#p`UyOfJmKSR5}>e3EyKwSLJi>_Dm4pM{ybvpe(B&B5tY4ptYR$mjR;Mw#mmR5Xgn
zxw+|T=r1ng8i8}Yi{UL&caxprb-7{CiN1L~@g*IG`Pxocvx?fauMuT+4uc;P+|vz;
z$$8K!7ys%bwH7P0?9?9uMUC*FrqLrz)MB+vS`5ZRczt;`zp@!{QlP@@FHXvQ^P7{#
zNT*t1GKHaY^<r6ti7~K&-fw1cv6Pl4j!|&1I+VWHIOrDtkFuv;&9x@zM@t{Ep!l9o
zfR883$B?u!YwemYrBdslm+4zC$v3bQAyOGx6j}M{HeR9=qKqz2t>b?v-!AqG9J(vb
zf1=i_fpO}P1-G0>dvB$Y<j9+@q9C0j@2f5^2SU+~FI3(U7{*zL=Mu-6W)|%%75&$U
zXjf~M2zUZ0dKwLio+3EFZ8f9Z*cm9{XkQ;V8no6sz3!#k@Pa;98hBCOCqHob%5l)q
zq28J;kSE3|TCNq8_UuZhQk{9Ze+MZIL_7SS^P~N1n>-XXE>(Mt@El!g`)Osgcg6K?
z?UblttsezDB}JZz>R;<_NJO8uE));4hEcmATa*-FpRfZW>*vl`OZYp~uqv7@Pkk7N
z)PD)FzWa|$u%-V}y+w0kmB|qO$va3@rpNhZg>KvQ%OjAX;x`<oPrjo2p1Yq{OlQJt
z>LbgCW>K2kf&rbikBU=vrU-e9>#=D5DwaI@VM8}-xjsSum#f>uCC55f-h|#xjG#?8
zQ1SwlJv~!~NxJd37nOLJ`rSKv7Ao?z$B2TdG(j0g@@R6Rv~}XMjf*KCi%P&o??TZ_
zu+duvSz#L}E<>DtGA(L@%%m@DyKn`IF8Jw>;ZMgaPHDVg4}Nus1wTH`f>De<)^k7a
z^hgy7$=d)joCp27K})D`uVT=8gae5MW8dTtp5!~Zd(G_E4cf>*4kwK;_i<{}CDrV`
zdJ8r-B$Z}Ey-m_V(MHVWAbyv3b-Ai_8EDJ5F*kh8+;}TyDPD^<7+=2*Y07_AvQ?A`
zKV|^jV?+ZYZR--xq)YyeDItsGNTjbYNHwZWV*4+StjT<%AbKCv`+U!(76|HnmV*m9
z+)Dqgjq1N_X!-vxlf!rz(w@c&JzeorLaRXP!x@>r^v8CR2X;A@<m)jJ53o(>o&eE0
z2Mw*w&!=Bbdo&ad%?#|M#+00<H(zF`5bm*?-$h=s#zlTFkM+0hJ*jpwVcj%bdHO9y
zu<wq&{Vnzjj|<4b=z*)wZt<N@CcA}7zk2c{S4$ijiKg@uZ8y2@c>8PK?THXr?Xx_m
ziDN^{*~zn=w&(1E&t8anJAOSZ7Admecq`8b$uu}IN-mS-N+1OL6iZ0GE6&*9t+rkw
ztW@Gz?$Zm86m7ZE93DRXP0ZBUF<Fa|k&!a#l}7pF_wLz-ocRbl&f4XU2No<-9Gev3
zP2<|!uM)qgb+0%DhKYN)&TIS`)$sB5KcX69U<eA1@o^Sy`B9b*FTv9)lR<TrsPzC+
zW2wl+MrP^8jG1%Bo}RW8iFUNOf{lj(HWx#AVT$)&eJ*BZ|7J5_EMl7YjDr2biTFi)
zCD-q`hF>SsXZhUTUkg&1_4JAf1?gagPK>gw4Ii*E4KnO~P0@5c(t>u!_psrKq}nw%
zV_5<Ht-l;g_pQ7Z(Hy5JmZJbZP*9pN*UE%bxUmSNf(572qoJqiW|lcul`6(&2Hbgo
zL9BEBpAU@wYp>Q{Jzz&>gMc}rSb8J7!vMX!or^rv`f6Q%M@3nA<!BRyXkPy&xwhHd
zcfpoN*>76-Vx2aw<{q4uy8>HfbyPS{=O|*u^YL6vET>E>RI)D>z2nZJX>ZvwsOlB5
zQUagUgBk1!>GwDfja<Uyx$s!p%;^*I1^%elask}>+C(uIm3yEKxr<5tU0z>z)52fP
zJBrdICY~I&cds88$yi`LS%NBw-~OiEnxl88KYk?kDaPwd+fn9k-|8Wfuk9V|sIvK<
ziqEd^D$VrGY{<8X45)g&D_aM}*OpL-0Uwp=f!Yq0|9Ige53MVkoO6H1GRA56lev~a
z^2KB5vQ5>#$QR%8b!ybSvaDPc(;l(9i}TGejjYZ2VR?N-Gm3Ol3VfwpdcH3ON?fs3
zQU5vznPL|?QexWW%zyl<Hq&rZ_Ttgz2BjDN(X=fGIlcZ-aQk<bab4kZm%v_5&A?8G
z+R>WelUYfXNgf-a@94XhEIWD&D@dB4ymkVf#YiXTP1lJ$D4BIa@bgvobU~yg&8@#P
zJb1F#RzvKH8vT+!1msw9K1&eKy&i08+j;vdvn(Y$l5sYWM^`gLR=;~BF2qX`+$Z3!
zU&Id;Zpb-Iw9rtG>FHbf9PjL$(kgz$HZ<14_U4!x!+FhsE8#KYi7WaLiLTng7$iLF
zNBr`SLIb@D*~T9?>c7tzC;O;w%R2NirUYUI!V)NzQ@Y|R(o;HCf$ykO;_4U2$HJK{
zqce(ax=jYW{6j_?U&w(2!QTIWvjpzvK+{h35)vzY!*u@!#<<&=i|$xT)zf#SC$mkS
zp4Ecf0M)iPIheSRa@=83+}G^nJa^^?rsle~+!(tRZsghV6y;Y)-p><P`kA2IZA*fF
zJDZ+UyPz=w&Ld?{IG!-MMHfBvRz=cLWkgCd+v;X~-jIP6sJEm%R>y7u<OKC|vn0xc
zfjsw|zkJ%v=4@$gbuQACTpn(@>VJu^ic!jfT2En-S995CG=Ltg)_R!p->uod`yEf0
z#IYPJrkT)Wo5@3^-J9Yfl>^gNCT7pi511LJ50tDnIJ|gmI72^gUSL%o=pnQ^XEs{Z
z&LbLZNZ*vFuH~&c9o;pL6&h@-Y530If%;yyoE|eWl2KK5;&Fh6Ezh}dhi#)nnCNpm
z3E|Uyu7acb65CEK600GdiZk!Vjm?sP&zwHrWR*%y_X^LzQ$)nIX7(1XN{*dGb6bnt
z_)_hej;GRKeWN^I{2RXYze=IMex~?!#^ws52tY;a>!6@Q=<6z_uj~4_pxfne`tR28
z<cIEl`6~}Yewaa)Xk)M5`r3X+8gh)nhE6*p+WKKeaYCt_?L5Y5NRB!!w#qqjA%9yX
zmDdUlj>*Sf8TSy5AAZ+0b5AL=@wmaw_D^qFAPkPiVd`&F8IhMOE51~Ju?`vv$iHk%
zp&%G*`W(_Eu?B$x2SuC$%EIPM;IsLJ>c)0<h3q!nX2B@;q~*)$W1E%aW2Oxnw|{qC
z|E~St1lTW#oq!J|(IXyUhE=6vnYf3n-1i^~M(-L*rw_k7!a*2mlYhFVYMAseCv!AQ
zro#EzN*IF}NO#}S>=4q6mR!P1N=o?ZT8Gfon5=%q)SV5ui6_dKU7EaS0(&QN*vF)Q
z2<(K0H)gv2Ls6d&8OHak%0nU<wt>Xh&F`Frn(Dgsjv@G>yvJkOxM$M)Xg~QoH2$6M
zuB^3iTu=K{A;*2q%vpq6?t*WBhYT}?c1IG@WDhb#I$751<zj8koA~4|!>5z6X0N%A
z(Als%ojUNfvFQ*?mxQ^4>qH3kpwY407N*H#+<xW0muBxb|F{{;2zmX~l*4A>OC6nd
zS9f{JpwBjkdFxjGP$v-u6`ag^IH{q#Et#9zvh_5gu%wS55eC5KnWZWIzp=djL!ZKo
z(P4Dor;+|2Ys0m_?;Nowv#81l4IBJSr{|dBbZ*zMW<D=nQ-Vj<@)r)ZI%^D#4Q8Dw
zd-Rq=LoIDt_2uoaBIDQ}n6{j(`Df3x22T%JmY<yVu_=n-2)Ois;l$D{<NiUFLgSck
zDS>zijrU?ssvVhiW6R>j6{N})uh&Po({*h<>eb_CcDb91o6Bw1(Wb3WQUZ4hmuU6|
zsLXB6oSYraAK8#U*_l{T2?$YLqauHhkf7pMcQJ8xw>PKaSFm|xLH?huv$><a-P1?T
z=2Xs(F5nw&OEc#uRHA~{srcp1EiIlnQwa+RQSnRLJ+*UGw|`^`n%p&iW@&1!CU=L5
z|BfZNZ)@%-ZD(U|XKQZjOeF&5xc|t>n(DeBm{yI7U)J&|m;!W?*0^hKYG(%e-vbf`
z%yFFzm>QLo6xDBl_xkt7A*U2&6=Wd?4niOYz(0_^A&4~O$f3hW4j(#l<nR$n$|Faq
zPEk=EJ4QuEO>^QD1KqiE40LDDGM(pyGBLBWoIQKt>IL>om#=VNVTAHt<K?=>$#sQ`
zJjek`N=mAuRA;ED&TuiEW#am`|MtE@XpbJeK#@jqfDLkx_5cO#fxTJ?6u^1-!2TcP
z_uqko6aZezqsOR@g9gQ?AO{anP#io&arp3|L!h-c_#JYH_VDS80=JKxQGG<o=0JD-
zMR@X2_B)@y(W`Z=aR{0?zC1>Cmf;*D6X&JNTvxy?%o{gFM8%}<%E-#eD=4aKXliNe
zJk&KcGk<LH#L~*i+2xt5o4beaE5FzNZvp}%BBP>XV&BEZr=+H(f6U0t$}T7@DlRE4
z`%+%>y|%8tp|PpCv#YzOx37O-aAI<5dS-TR9=(8B-`K=%ZR2+EWV{YQD1M;@{`(8D
zf5D3u;C1lOA&NtkWV{X>bOrxX&>lK`QQ*kw+p3h09L}&^e{q!VPI&U?Z^zgL)z;`u
z96PAaatKXuV#uiNWA@)e?B)LzX8%C!PrL>pCnyep#iO8wz##b0FP3|dX=5lBhrl1m
z|M*W&xl-$!Qq~eUknldlC+#P35sD|mXL(ZdEg999o-WbLOhqVsWeG&vTWX^>2rW%p
z@gRFWDdJ^8r8Fs}i&T+keK=pvpvqfzCO7qf%{Y8io>~cd8?E@tj%QPLCwEzTfYV*&
zZbcPIfme@vaN!P*r^s@O<*c8Xw*Imzh)watYdN9s3*~VX_+51>mUY1OCO-N6L8qHL
z^tpNta!90PB6&voLaJ7xX|UH;Ndl)??0v%kTatYCPkphwdC%(D#8Zu~+IxGWaa9|&
zAaARk2-kyI&T)!FQ;e`AJ!`K~r<_UCT976K2)|JJIA)!pJVF&dG%RPwam=mdMBHe#
z&Q4)py!Pu^*?^?ANNO+CNH9OHC;Q6oL%6~jVvuj~7XwrsUwl3|lq`QsU%8QFR0_Ru
zyLhPCQ0^nQaLId{``IJmc5fBkO(P^1M(8|2x0BOlH?TpATj_o9;y$EL+6jLB+IG*F
zAQ0&qdmJ%$*V>(>pgFcy;mRf1_1Md>=8TlsqS(#1dys-_rB(02EgqQ4>~h9OKlQ`k
zUW%L?TQN0muGU!)pTlIqx+<sNjrr^_Sd~VVsU~h_Wu^`);pLSs)$m55w=%lyin}sQ
z3S?YZ)M{g2$=z5L+&1M+LMgI}XRNy#yu8R!FOj@Hx6>29j~(R}A9e4{Gmsvw3Z766
zu$$d&x2ztPn0t^r`T*RER?TJLd19lrblfQz86*0wUAI_<-;y7F!Tkp93c{#Zs)Cqb
z<%#8quC(lYR;hl~`ZG<`wUqGGibwV*$6-&}<GqqW^ec7r<3Pz=RGRND^U-Y;qg9oz
zoeE2IvQERZM}h3msx|I^VQ682s#!Mjt1aipV0?b|x428QIDgHWPaSN*%fmi@idAk`
zSylQNwCt?QS0`v=Zxiylob|Txw7XXXw>Co_hnn!<*;lmCl`;?lgwOWaN9~wdnQ)Pj
zO7Z@><^0HD(RT1oH6Qe~*J<{uR$eLF%&@846}!Eawyx^S4MIlm^#pQl6_6qhM@*b9
zP}zeVjNJ+6G0N-s!r-tob7y6}4C4GX^M|&L9mf&0R~EBp7=MHlVovKx`Z6bx<7VU|
zUCWF-Qg``kA5!h?&84*p16f^`9eBm~;|Kvy#>DhN3aNYkEz@)P+#Xz85u^y3B`+S=
zA|&a`vr?Zy4|-jmkD-Td3M@UJ6`0u+X^`lyK$3oT5wl^!Q5U7O&((`$J=rJ5+53LF
zX?X7}XDtH{URuqI<w~%EydOTYw;N)cE=;R8R^3#xw>8<&lqi-mf>^+MGg1)6v6}%8
z`Di&JJak7l%We9Swd7YudEUf>n2Qs-DkJL(qEncR(jmRZ)>@tCk>}QNhw$B-s>|j?
zP}0w2LL5e*GC04x-Piq+zf|Vxdisw$3Oi0SBo>Xw%&8}687J4rjT>*cZs$1fcaexZ
z+7nOar}B#GD(ppGAKQB%_Uu*j133i$bJTRV!r{(`%ra$RjT{2Zq8uze<z$+_m54ox
zwZ!hKEusvo<b&g1#53NnWu7>6VZH6Jz~Kcs2c}_}67SJR15NGvnt@k5<%n!aDz9x<
z6UeJ%?Yf+7;J3)^XyL!jNE_l$A+ormo;X%GEKug}QnUPa$Gc>CYK{Dsz|hBcnU51!
z0YZ6WB}sl>h6!%T8_DaF#tS!`-X5LX$Y|gsxQ00wew!14Ag+!Z8=Iu3gaM(LcKp)!
zOYyUvz1!(sGJPrB=ki;#_2QD(!)tw~ML9HP4Q>sme~TY$y}RBwEpjj|1yS^rJz^rY
z^!m`U(#H`GdNuLd!ib*7{!MRZs-+{_EN74*-P)J*;MY0(Qy<k!E&z@wINfwDi{ndC
zaTVIR$7Q~`fO85Yyu436^m^=KzoW8KoqVfT{Ydbq$751D{hs*lZq;QoXn&c}Dtufe
z73G7+M~B-zFgP4Tvza&gsNWM?CsB-feJ(g=_oB`G4OV4<9GL=*XO&(nwvfr@y*gH%
z=Fplc=gM2tVmI3o((vf(*9MBU%$K9b-7aig0IP~#PmDOgLUI8wZz^-sr*_$yzGbQW
zRit)idyy5)@+PZ!>AObuU4O_4kc&R^fnj>Y;IRwqn$iBvj`E`Pj{^-me49S4y7Hkc
zv13TXG|L+wN>NrcHgojHwv{3D$9X4;cSYSKP=c*(T@eHA*c=V@ty~q(?+QZ0#i&7V
z*Ij(@O{N#+p;O+a?*e8r2kj5v3UG^2d4i;jST0LsiA?Ot=GqEoRq~Ila9rF%7?5_^
zXgP6JN>#n1Ru@8KyMn0#Ix)-XrTmn!97)zJEOVk{7S%~ocpYK+#Ts6OpC_&Ji-8pR
zr&P*^ym*R_fMTW_4;s!-Ka14k`8Lz+*gz@iMC1nIT<gX3J4^9WG9p@V4+Z)bBj&Pv
zC%f6ZNxH!-rlNBj=`=oU<-x+$LlLvmzKDc;m{<~^84x5rOEbuAgr)`V$=$~&!EgNd
z8}l03Cs>?9QPDTFsw2eH9+%cNja>ZJZi|RkkzwuF0(4$4x77v3yS7SaGLjj~x=+Nk
z`Lrf@EwOB4GkcIR%$eUn7tS_ncZtbdRk<SX7t`I$6;Y_Q%Y$PvuZ}29Nmiofhd!vi
z5&d>(F8*o#mQH@Esa;Ua=v?C51<a0SJQpA`$M>Qx$G+WBEke;IyWm({URqs=&9|dK
zzUSR}iRI0|cx24x+ts<mb*DPrlrXElTkd?U%F8XQE8xo4VUvT~^$X0wdbWNN#fA>S
zbC=?74w;vh`Bk@<xSz=XF50#{>?3RyD4BDnajg}s<(T0@``XXoVI$(lV_QSEeu`|<
zQvkG=0`BLdN<Qc<g_jCCC9br=6ia2OattW1M$%jwiYmvhL;zBs3b2bI^3~|M2b>G$
zQ@%#+bYHvrtdrgWy8^ANt!?h2UvubGmyL``waLgTUc0_(qF6A4_9T|CvcgW_6kERX
zH5y&NkVU<7R71<xcj^ipl@%Jg;tOS{QVkA1<UM8}s-%ZqMJbms*<vZ2`6Ma~CShDB
z5)UjsxLBn`SA5)VCe^=9Spl%J<gX6mUzCuBTcE>ThvBjGrP4d%cGqR7WR>X-1o{&N
zm$rT``Px)4s7J<#H0)Dg>2kz_h(a<lUEX3vaVH9m<hSpcmbCux(KALw*$g#ID9n!T
zXno#!wrexwNNBj~5NZWvLD(mW7+;$WB_o*l)@qi4SrycFhj+uZ!hP7s;5#MVN4+k|
z+-l8go9^t8hS~N!z&JfyG)s!iPD-l=t3%c44+qzu@J&7$hg!k~-U;j|JH6P^m|fUi
zzNRv*H%rHrQ??P=P13-VC%PIF=&Ba0oReCP9x2fXS`P28`Ve|B<igvMsl?Z9hjn*t
z_8@~(W$V19a*P4m4)w<tET1HI+c}?VdeWsJ>!?+#*)igbcC55>i{Y_id!EwB!CN-{
z)+sQWZ#81wI{a|;&Vx%g6S*kp@LVp;^R!J*8e+O)E3B=GiaXJ>r1hiel_9(gO|S9_
z&q768P7A0uIPg{#eZKz`XLgs`-=5j%nbingkKufqJ3WtQG{^hAj+MNj0t1=Kve%Q%
ztslbmxtE{1Q2y*w&j1!vFm#1#a)np=497VI{|wnJ;chn%y!g;5P=@2xp>XEUdl0I&
z;>0syw_38gzk{vaR%Jw?p16<l;LysK3>iKR*Y?if=YmC3-F+7~P1MG_ZJd~}ZVf-D
zNm2FX`eyF0Jp8^AEeGPtyL*>D7j+s_=W>TvHq~TDlD1ZVK46_8EnH(whCp$cj7EH%
zw-wFAeLP&gB6>M;GtH7-YO4pl)6cW1IT}_!%0QPDRptdWM?JYjBhYfYZzva>G_r=9
zKi&*CNUPE{@)Zi{_NMS%3cN47{leolFj_z9)*%eK*bbS4<RtD*(6`x$waA0d`Uh-b
zOLFnOB9^EEcb7tf(E0R-M!ThUD`L=Mf%%}Y)SC;3>0b~tkWCwMrq|TF*y%LA4YrNk
z{kMh<JAe`>d%BntgCNNs00D0Sdyo%I3)cVi*iKVfMZL5!kxCNAN4t~^r5-si^TQuY
zpJO^n>uy!Rogy;fdqZ@K1@lmBmGHcs=%qxcGsCGpWb2WO8dAEV=3r3WEPO>&Dg?o`
z!QC&>ER<Ct>ktTk7KRafucT21a`3;XKSK8=;ZPFgrO(T3>oz?qqY|I7mr{C#j|Z&A
z*E}0zYCa%Umh<>?lqg%Qw@PyJV(w$MbiLB1mBo%#K4ih}OAt5F{+~Flf*$~%oXK;L
za^~EJt8}V?0=Gb!Mqjin7yZjX0a==KichMtT;Dc7Xi;(1ofD$|CUZ_IirgIhbPjxZ
z#oqhMHE*u-zZxHS3`PKt#}CsPcle@j>2Re|b_O#Y{3gRklMFsSFFYNn50zH%z4g$K
zu1xB6B>5}y7$+~$q?0@QqLqB-pBxt;_lu?c`SYv^c_PsH!`0f9V5lPKeCuHV83xds
zJlZvHa_<9=Iq8h?YU6mOgFh6>U!42(t3Fhb3=Mg>pPhgGHR|xYD9~K>*JSD6HbDdO
zWaQbuZ3_MRmFe2Ak;|l_jQ2+dbO24szy2MdN`Pv=00oeD{9|MxFc-MLaFpyQ;}&^r
zeNvG*N<@JsnxAp;=VV&;_F{RPktVZ$x2CkGR0g%FN&?Llxyi7~DlOESBx7&5qYuUm
zx-6Elp2@MU9hZNRa$cYG@w0IUHeo)(63G^L^TBt<%ZDC^Z=RQ8bvbY0utM<y@AyPx
zyvT7ke7c=6FwuR=-%4^pL5_4Rl`kvfmXx)>o$(!TCpVQp;3+N2$@YAe{8hNFKin@D
ze>L{1WB|#H&cE))+3#nWborA-jHY>XI#iyNE+)@u{g|PdoV1iCT<JDTHR$1!y}D%H
zU~=YQ>{2y*g{bjcUm}Rx$M$+R1iLVb_&s_BFZe=oiF3%ea%J4$zw~V>;|Y;R=O;ow
z9hYS8wRm(h%P>zx>9$WUn)!RI$VjGD3)415Sa-PU4a7u?dP3gq73MM;1o4nI+scaL
z(hqNi)|>PN-`jIZ%QV;BdrymX)_mM;Q$y^q=ac%@uo(mobiLO3<6I;Qp(ZbLwvdvT
z2esn1q9mPsbvkt&MYy$*mIWVY1E&?AP~WymEE--r3O{T0qc$K_b)FsC8~7~+xv+_f
z_HJNq7d*SVJO{)HY(p}zjHtVE{G^&*PSzoNY3KYU<!gr?m-9M3xPSRx{JPo;Q^uXp
z!(OTwr%9Q);9~1HHs()?qMiJt!z4C`z01aZE>(K4E;xEV^+Cqh=wwH&b^CA?U&3={
z8|GET<~L;F`lez+Y$N(DwN^8uqlbQ|7mLD1>uDz9H)e2S`O-JzEHWP6l2dvAjsz!K
ztq1a`*oi-U5)dlwJFCgvkYqJjf`3*VA*rSkLShTwE`A^2IMk-(f=ver2PY;aXt(sP
zvhE@X*3Fse%NfI?qEb{hXZ(<}dypSk6`Ua}he&H)EbD6f4qgqUy~AMmoVN5>h(^$M
z0uQ-|#V~3qmw%mfeGekoL)k!c+7$Y@pdsIg04#klydllN(*nsM0x5b1*ozj!Mgux3
z(*$#pMfN`i<MRNAb5ja?kmKKL-!%;6eqM}e-$3%Dgjq{X5Tjp_RO*dpJu(RV(9_sm
z-Wc!e-H5eH38g)VRIff3Nbvf~0<a(64cp~8MnD9keqdn$XwG`6R`UjB-7xU^Qkze^
zDdJuU?7h1=@Fr~2EahHa_aVdE4GPe>;$qM3O2*K@69|?t@RSg?>B%SN*fUc^1{YTF
z3DJZ@ZAhw+7~lb@xzUEp$k9CrlM2p&#91#9bQS&;RbN>`1|Vo3fS}*Qy16BYf?<8~
z$atY@`y0Z|+l{J7!oP-v?^D5OCkd<p_;qY!)x1HaN{+w>0^8@LWI|PT`$;bU0)ZTf
z!8PD>7+VW;jUPi^yRk{1YMB_h-G2oYG_(uYA-2X!y4hh;$-Pi>A+hJBu<kBo^cl9a
z&g{S#NEVr31y(RpPSgE!q{Ad3#9D=yvdH?=&zp7_BtMz@Q>5k^_~l75BS3Kmqn8(_
zADY3d$Ox6z5=gTxNtHKoeX$*K#R&U<YFT}GYWs%1^F$V)ryC-2dcX`j0jN|>rjq|Z
zW{1}-VWb3R9-7XN?Js_59b<d6IU*Gv;_mn7GVv4If%m{~VA9L9x!~L4cX$YNtwKU|
z4<fNth6Yc6+cp&L3aA~8st>~%Bypi<28^A_0MrCZ7X1kTFmh^^F>*$HEihTIqOb`U
z9OB&i(r41*uTd?3Gs-_82%c*xXt!l1vxy5X_1u8DZ{G|cmB62jTDJ#@LywW+Bew8~
z*^f<u6-CiGtv@uw?&uM$e*mXLdl}sP5iAk|pY?Dh|L8nm{-O&ElLliVsP~!2z(>H4
z*Hgl5e)InRkf^otO4VSS!iL>Ek`TOR0i*0x(gIs4#r4Ih{uA{#+i?a`T=h2w#<4pz
zxK4l}XnT9eJe)kme>&_OvUwj=Bpqgb0P~+VRc~*xh$N#7cuFNuWasIcm{$hCDl>IR
z<xi~a2z*Gobq9+`QVTrfGJy|4H-6&bIJ^K}U)lC2{ejFBB#%;<_;8NcMP|No3H4xj
z@)YqqNq9C&6$m2otGBTV$}b55JSLoRIih<I>Goa!eZkT(nP^I+IZu-Qr`F3puvrfy
zFekkQY#yA6*#i$ObnOd)Jn}w8`r=jPN`7%`dohl@TJW`UFHMj|J$c%hOfh)P97aok
z<nP-z4VyBwmSG+A{tn)2AZ+@kNEYC&tC`1WQxa)H5x|`Tq<}t&`x|579I_Fh*ZUhi
z8j?4%fzYl9*tUH#)i*&(%*&t5G)`_gl(R*1$dz_nU&3!VzU@H(AW4znol2<F_v%d~
zL(%c;iO`#fB@TdTHmta|x>leAI<TEB)R|5=d8DxTu3s>a$3-IIyOK~90Aicp5L1#N
zp7a3xXGia_q3h7KZLv?cmdR=#Ph}4hNJkOkUPb4*&*V_Tu2BFQ5Xwulq1CcMWduQ9
zV*bFLon_I*-9kX(&EE?G-&pp!oCdF%!DvGzGtR@F!NDu0U(GW&_Xl1bzvxTGtB5?k
z3O#0HaDRG00Y?DosIF5V0LHqF>lfP???L7UC7~pS%Yo}K_g}N80n#;0R?^PuZv1Nd
z<iF8&5VVC8JvP9e{10M<ffpML^uu>{5c3BG_QxF@#}dc(AcmE*f38_-M|-`>Sqmwf
zd=GdIY+ob=)wwk!Scjq(P<ZT|(4RD54Ff9_Sr^xyV4Z|mXvcNICmh_6=QeB{`iR=(
zVHf^7ENa35SIDu``$Yntvj<u1ga#Y(d}VdXr-bc~tMQj{f%Z5aR2O%-t+;6q^3jOs
z0RsaULfm`H&cj?lGE=13Z^_`h2SGg91pFs;wTVb9(L=7F@SE_O35*34RXmjep0IPy
ze;GIc4D4T*NFog-p~?Xey&t174Mrv5J|i}E4y^9|iYz`Ul}Uj<zu3L=?4}K@O32%C
z+$hik7SMl7e+VeOc197?&80CvkJF#bPo&XHyyO`#n|4cAV0)%;>a~{o%cCnNy?NK9
zC(l^-HYoL&Q9gL?J+%kn)!rR5GHS~bR=0u9nqJZP+9cW%AKAI;wpFnRy_vn}Qi=q%
z5Gd2=PtFlMR7ew9+05;@%>?3iLUt;K9l=0aRVVPTi#FM=m}@?~933qSxoUq{T1981
z{7Tl@LFvAORfuPoCt5YLS5_JYWb~CTNh%Ny--}@{g9T){u!XSu=JCC@5xF9HKsZ0f
zO6<UnM$1!5Q$n_ZS!kxY3ulFZ)-js3sYNy3)TA^Ymfp^x(64Z@Xk#h=9WC20eJYm?
z?wNhY4#O4Wu0}nBwiVYx6~m43y|xwNmNVB3P9$3ibZw>-6JDV49jeO@y9@faByzSA
zF*0>wuTwf><Q^iSj}AY3Th`+9j<7hBja?nQL(&^Nh4!&*UpYQCCPIpy7H)dz*b@7B
zYv5|M{>|PqC~-T3Wl#QZY%2+A3rrs|9|!ae+}*}zF4}x)6GZ<6`(E5#FX=MmmgEY2
zF}%)o?4Z<aDb{}vVu94kRGbTl$M8O-=5urVCd}-*5J^;tZ+KOCOWSozc#ASu4i?Q%
zU}L@52t16!D=I`mWZHa2v-{X$3_B26wL72Oq-#alcUiZ?@Q;D@_6k<3M*%k(9Z#f*
zM6?KRzNd5a$IrY0oaaDL0UO?l6PQcmsQx~8{0SfTG}e<C#uM<*`D?HN7NRIJ?MZ4B
ztnaEEVK;2jYuJl<@^&eSqZD!T)6`-s*P2DZae5}<zVpfq(6;KgDWMPcAo`!78!NDY
z4LIRq630Nr?%CDz0)Fi?@kY2i1o?9`OV;`Dktr-Pbv`x9Xfft8$-4mqRKqN09CiBq
z80J#>4t!(|-O5k6XvjH8vnAXoN#0g$dhf#wxF5g_|FP3RI)ymBGDHk<!ZuIs0BKJ@
zX#j+css6ZUzRIGJT!$PNJYNT~vke6TJP|%|6vKCmRR3j;2pUah!6zs&H{?kTWmDDD
z;5lc0kZXnp+d>ay?G#y=Y=jXmvR?WM>+h4;8jjn8{QT8p32v(I?Rp8e$&J4eC@Mqx
zVgjEVhC?@`9084?wf&cOnWn<Fx)219SkfuGGXSmAmh14LurPv0b?|T67y;UZ?I3^(
ztT{R9g}_C&H+ZA>AaxHUPEI<002rujZm_qL{ETE(_fbIpLg77Z;t)m(0MLrvU~eG#
zDS((4{(v==EuntsW+#lq{jU><!E269hQcOQZo)QurC^u^Bit>5YCAz;W(t)6-Gk5@
z$$$w^eJn=na%B3??f?E9{&{w;Gyxn4(#sJp7;?423OMmQpZ6db%}q`63QPr&<Vmnu
zuLX(2lP}2xZ`s@cp&VqA9>gf$A~i%J@HPxk9M=1c3`;Vp4A`6zWPHWpHHRld;gc$t
zp__wzaLfXX+@2DEGgtZ^v?u;+dqAH9lZoL(aP(&+brn9ZfmnO)mca-nK+n}7h}6{q
zDWR(He3AC)FmOBb#}0@-r=gpJ4$xpXz?_qrtPqUyF;asM3|*-YHYM0inSJnsN%F*Y
zLVFTy!U&fUhKqv1Hb+@u82tV-0z5-EM*(<vJZqq+G|{0R&fx=ghD}fjcnu1uO3Y;+
zPwy0R2P2&JD0dTd;3RhUE{tH{eNu)c1@OKDstNjK53(-T4qZbMG=l+!P+iNXz!=i0
zB>L^Z!my>+cw!0*eBNbKav!1)GDLt%Qf@%Sc~9n^A%>2r6iEY?AX|M^7_D2RMq5wf
zNAje2re9F)K{%v-fwkX68;0Ssg`sCz0pPF+LtG9(3@kf_25OX4{W>L7gCE<#OnAGC
z0R6nco}Fr=PGS#Ii_9QO$h4Cr0WX1XM4%XMiLKqc`tYfqO<p=OFX{`RT7F{#U&|+`
zN5Bg3uAl{=XE%+%&y@?%rAklcH-*6H(*7Bx+U!fTuit}Q{Y5b;cuhG*)`1w0GAfb_
zBT|Low0*eh;f0i4%d{4IkUPi^^QqC4_=!-G&M*AEq12VC70`heKv6)8pI}$x=QJ5?
zu`B6=cmnivAo4?IYV>iUeFGd!L9%EcTg#VFNrYQu^exlw+lTpHs(|1Y8DNHejy?Gs
zi?Mwy;x=$NyGf_u{(3=B+VB|J{w~Ex(cn*bJ=?wGgzx)FN5;VJ_vp{bzrvvNs!rs_
z4U2LF9{3r=jw4X)2hR|!#{lrh|7;AFp%`-$I{$V9q|@vR>kY$cRbQGTo@Rxi%Qx_S
zC{;Ob8Z7GkAPkHq_!T~(OWvKzy93i;v0+hBiped?mlOnPAl@{z9(zJ2%UI|#neuVt
z@U>imQUhKX1=}2P11y9H0KH^Or$`A%;njVb+crGge+AYA*4k^oK<BrnV4K4Z%7A+2
zlPWt?)_V|moo5f7V=_Fif2Cs=v6FNhEO<*TVxxYD1jwp_(=y}$xBqUSwh7u*9b`x=
zpuZsf=Kmdf8oFct1W@cgI704**L=cUCTtXe^1FKwqSbah*UW8Fsp+oV3Vhb>CV__r
z5WZbpWp@u8IQM?=x`u&*#?UQbq2(EF$gpG@Ek1)4`K;nDzk=5wG0^R&s8w=Pu)EhJ
zv6Gf#iR7n6?TURUN}<HD3evF&=vodzjyS}>OM=%#dGTRr&tH`zmcR)2J&X4jSkD2}
z=iEh&C!GO!mDU<<0%HXZ80L%|fqRS=-W5h9{Y_&!sk68s$)~VY3=kKV@Chw9|J`2b
z_6`aczpcnMb7v3ok8y!Gq$;e1jdtxpRyW`nz&N=Wn(ZP2yzepSYdyk6Ua^5N((1?_
z<j~r;HDs;G9^_$$1*ziZ9)uP^fjk9ozb_7mO@20<1B8I}{(x_j3Go_UlZ~MvY<3lb
zLSR4_zxm+B4W6-GDDsX8L%-ro=E|oHdk|L;$@<dGj=+roquJa9qrrZS{!h<_Gy7zI
z{Ak3x;Wc2(EDR-Ks|&tA7#(UYTjF*Y7XKK&2&Myr3+)g7LmXMQwu;kaz0gkZvV6A(
z$p-?dRuy2KT6=B}5*EV$doshReb6hvm+ywrK&gZY;CP`vHVnUf89<_0%>UY>_x;Ba
zBYl0#kIYY!EDtKqlw?OZL@`QuYFGB&41rJI??WxtfaQ@XX36aJr!!s93})7{;SG!D
z(XNTFEN6JLNt8W%;X4;KrHceDzE|7hX$Gz6d3!7M!g82gmZI<nbh}1R^~UN+u?gE;
z<2d<?-7JBH`rF^pC#tDCN51eLJhKP!3Y@oon4{1?*)n%!!m?R!;IOpk9)#5iIQFfq
zUhY9i61K2mA?ZokckSCAhzWSOflWOnG%ibv=JpQN&p>Fny*PCb*X#20(i2(Z^hi^Q
z+sixg9^Xi}au#WJ>f|qOWx7z88Ecz7_gz%ck^7L-LN9+&>UDCr*rS*0TyHEVnaVHX
z)oYD(V;{_i9!<NrC4^!4l#_B1twOu2QSN`&-uxoXdEk!a-h;$$req`zE%?`u6)_Nk
zJ-{vjN<7gQ)0gG*(`a1)4ad&IHw6v#bSL3~-@#f=Ka}gjTI6{h-HjjXg%W`~)lhwn
zeZ?BC1K&#bD7H8s<~wP(!w4+PQut;R$N`}`0d5fd`*q3wC-gDF4Uz7Sc#<jsXLZ=<
zX@*QGd!5e*8z&&(@w{1rsmBOz9>^a%AFv;re%NdZEy(U>pdTVi*q8ZV&q+~r!WUn{
z=h@1wW~G?+AdRu<Ve;yGkXyRwMGq9S#E-nOV>FAIn%>eR2|n1cuu0AWOTRw6%n~p~
z|Jb$_Vj_0BwV&;WK%$E(A^Q=-PThS=RvTlf&soI7%4}P?>5|G~B1(1FKLjSRZ_+=N
zAvq}1YJ7RGT0?*LaUxre3BOgSW!`eb>RcdfdzdQe@s=<!<DKpg&>pP{k&xNUW?*IO
zG;XuK>)$EN`>>ByuvkCH)6#6)gn?i!-;u+c(nd9qujfzVd_n*bPdx8W1tziOvrg4(
zBf}3}yDMq0Ln=;im^`WGwOSc|dkMk6o;UR(d;8~lj>Bs`B}FT>orgZa{rCc%q+N=Z
zaX-^8_}L;x)^zx@kQQQ~eFsI+?&YHL5ef=gfJ1(jBg7A=X;WZoEdJbs%s;LysZ!bk
zFG+Z$5_Izy`#m&)2eHrN>_{?E-Y_kXzOP|l@`#VX`DgS(&kXF3U5k}=j+R3|P6`Yf
z{@!TU6~r;$mZ8&RJq3<J{!azY|406=1q<F;dku83p&%ekNnT(B20;iE>m#}YP56OH
zPWB9L4Qmv)A<6FDr6j)xaj1@t+clBu#MujsxAK$9E|XsJe9X6-=pzJ_YZL8Nz`=%s
zUN<go)*Qa_c9ZJmE=eK-IJUa6<n8i(uwC}A4Z*-yu&|mv2zz>I_fzAp<>2iH$?K69
zs#QkL`)MNT#Pnef(@}enPlzc)7g?Uq#uq)C3OBxBO8BGiM6ok_l;ZinF0DvdRR&oL
zV#5KHxkF)R7u4oj1n$84?*UJ1A1qKnui=;?%xv8n!)IYMncJ5hJ7cn3p9gnBh^;(k
zO?U&1R^#~G#DVa5khXb<$Sw0yn!w?0ZGNu7hUSuswaNL}VZ{4^lYHEr178+y;hogd
z->jCAqD1ScMRW@W=mc&t&htFH`WAka;GWevbe?jW`@C7`JM&`BFM({1BC>?cya~Hy
ze24mSTi8<U@J_<k3&1Z4N_!9_pmK8jIvz_iNJ*0Q<|kFQlU`f5EVkByl+<!)g6JNE
ztyv0@BWXP@H{4751b9~wYqcKs0_v)V|Goz)=IL1!S@MFOfj71xi4`C?=>xcF7q)*2
z_wR(P|4(Vl!(5M8=dy-lXKs?7TR;Bn1tJdEo{`y69X@{~yyF!~5~jI>5b84DgJ^->
zh4RPyq>n1wD(kuJLt1l#W7I%j-0MXB5`&6!QmpXCgmidcIaw--jb_xg3truWIA_f7
zdussuku-(>p(f$c_k1{PfTio2MPk@tnH-Y$G+nR)*?@Xb7xk{#UK1g5YnE;y75ZRY
z8Bu&6#dMJND&5`aC#fl6Ey9_fXzZHPbtFR`FAA0?X&(OBs%K}a##^>YpYkc}w%Spj
z;)HBhX+DEsY$;HUkgdD}M>pxPL4!bnCO<a_<e}_My0As>CbM*9lH32m!t2A&xZZ&6
zz@n-yt0uj~?3miR)NSGi`1E74%=)n}v#P74_xT6`c>E7O5`fi(qu1sLL0ovBTrA?R
zY|<=s$a}<Yk&@Jn)XtsyyrvJ>k6jG4wF*La1G%y#z!lAZ|6cF^gg&_{EMS%M;eAnK
z_yc+6wU`DVd**%%tb1tS%B=)i@HC-4J}VNQ6-n$OWNi+>dP;xxS}a>TE!+8f;rJC`
zn=1(X(frUaNPkMH<9~3FE}3O+0+w+BEOU4dLU0>~msxorGg)+gE6%b%6z9?8A6DLe
ziWga5<_^`pW0T5+Mc-pf{;`&2yh^vEPV33!7KGM5WY~?NSBmRlVZ0}U&3IFl-4B!;
z*|K^w-u#l=J}~c1brgo7H~q(`$ej;CgGu{Z^(pcMg`g6PDe>dMjQH6xEmiH9H_v63
z@v0B1OViout@{fkj|pjlgn~xH#uyRK)I2ER7(5PxTBZOCtQ7~|9i!a`eebk0e15{#
zg)I@}L&xHi?jd$>NLNFBfKe814pr$%Dg;K=B3uUsjH)Vkxvyarc|_xVb%&+x$MJFg
zuTgOPAwWhb_rVsM?TC=x9uv1Q(%ofiQYE0u&-?5dlq8G_L1{zED$TCk(vmqjw|%g^
zsG1qx826Fpw>6a$k8}J}+ok6%5bmw7qqgNee3CV>)K7t(Eo_op#aM_SepiH^783}>
zc?9hu*DX{nSf4Jp=UTyUYaKFDto5%Qv?-1*XNXWZ%Xx^+72+zaJXIffoj12>8)&hb
zjDF3?&dX67xrH?MoqDwkhK!o$G}yL;CK!tC8CZF{)7xWAK=45#>2V>Su-<OsPM^~?
z$x>sj&tEk>D_CuO1iz|xMsf0g;qM_)X54qMu@#ggZ*D5bwQL#!gx<ks#v9@2_((%r
zh09kRz3*S*aht*H-dpFv)U)ZTrk}%uT^)#ucWXP`SXvZbHS(OK8Rsx{@{aOFc@x%_
zGE#AyN#Ll6nCiS+4=z;@S*6F%5j&HW?38DvExKXH3F06qHnXXJ%<<KQWr?QMTP~g{
zl@Ts~Wm@ogs;5@FR=hhha>FLPL+fx+(sxV>;yQbO_mUTJ_ZF~Qdp^SZVoBY?v%(AT
zB7I()De-eGFENAkPn{dXb6R-nL1!Cip*=zW`k+7z`X6!*yy#?g*epds{6o%VhBkb4
z;3otxfNNJMydt>Ll(`0k-QUz7_<!KL&k}Y(8Tu507diqyf2m}VrUABo+1dz;21b|V
zc@fxlAbb*-W(MrUdc4{n8uB5cIIq2!{F?7;!b5<|Wt^kiynrh#TpXP7<sSnUQ{eof
z2jYyxk3wQ6;)BLb1O|O`*MCQ&=l7WgNmBq9Ud@lAmxN9`_NUUD+pu6S_!M8)!LPv5
zJ^38uCTVMWVj7bbk9eHu&3?#5qQz~fr+)%=kidgQ4i{<OEZ!gHuVv?7r|D@+%F`E=
zO#So`zCMJf=}hhuL(eb_*DJALull_FsKg1aft`u((}O>NF@*#1b3seFLOhFnR8d<@
z@qyr{STa>cXtg{_nK7q!Rmyjr9%$9B7L#(ul(A4mI(^Rc9wZT%S=3=m*!~^UE#O&*
z@P`uZ;Y6mM>F7mxQ6C`+I4Kr=fdcJCa^zbfXtx-(chjWccy&pOak=|;q<%QCusqho
zo)d-JcY(bRSPCs?x{>t1M*uQ}!KRgZ0Tnudb>6%D$Zdmkx60|a0KDWpjvBQD2P{4o
ztx-*=?j{nNq(R#J{Yewp`op`X6RZ2yy=Mk6_EYj*C+4J1fUV~UY?Ic2-cEheA}$7A
zuD(h2dYdFMw||Pw9sdD%&cc|(woh_-$qzC9IutuCay=C|zPQ6}h<=8FSL^*lH8fI~
z2D+tgBprVE<be+NZOCR$4ZoE~-7;Q7%wPYSp$w=0PoF5vNdsE-T1{$;d-gsu!v2Iw
zphI(Bl3fjWs#w7kk?ZlG18DG6MuogVrTrFFYcxlvxymybnB-)awF5ox(*<8wWe3bp
zvj<7lt&FL%-ijB+y#YR;q~G5ZWnmbi;pNf*{&c}!ABxRB*s?#_bV73BXu5zexCFYZ
zR%Q5R$;YV{wJw+g?iuYt&|JWdws`g5P2u}LtsTAJRQt|pY&(7<b`Nq}xI#xt5(o)?
zJz!n}`{<0qdmZR@{Jw~>xuI-omz<$?b3{09S52xL=jb$E#q(?TmzHlmLAJmwhz=@5
zh_;em4{l)A+!m+kg8;q<xuD~K33M{~fj7M#L`wh#d82+0QlS9~f1obe4ap_Ag=O=v
zXT37);f-=HEEQQi4J9~hhSQr~S$HIU-0kwT23Tdcz`UbblM*MkGM&UyUvY!a{8r}m
z=@~;7?UgU&mn+ZgQ2i*wJdQo<RVdUzeD#&+pnXmQQ4`my$M^zlG?{X>Ta8wR2Wa7m
z>aR2#huwPGWQrrgq}k^-&*ip+(OVUoU2QtL83G|H-?w3*x3tZ57seIxq^{kB$&j8&
zo|0MCv=u&n+zz{KfAM_KOZY{@M-HAYPKYA?R{p{-Y&pG{7F4`km{Dj%ryorfDZnQq
z6%{DtXL6`*bdk1UQO3QED-T|X-nK}@ja?(@c!Q%E8e%#yOH%lW_IAW`J=54lXc3AK
zB?DOWBw$gd%A_(YFS+@L`?4wlh$`59r@s?b^Lo(4e^z*L|L=OkjB!9RwOW&^jCQoJ
z`(kRuf>edrQM1sZB+epmv9n$S@?*}Oov>k;;tygL)XGcz+?p+5Ui~wGf$2N7#n-lh
zarfITk&?IIb#LQ3YFp9g#e>le3!n&$yZ2Sx{zmY(iraTYDDu-=_V#LFUI-O%D5i0b
zn;l5HuU3Z1^@lw!kl7Az@$sc^oDA0f@JS=GLL0`LRre)oGWl3$`T&3HNP@N$SI^_d
zGr3A=rUQ6vZbeW_LL@2NK?t?_Mfjws>d;CS?6zKg)WrgM%;N01O0DQ@MZ-MQS93mY
zm*OZa#QVNt%w4Qqqo$~g%e7F}+!7fHRb5LH-^|MkR&L80&Z;=7SS>E}YXdF4cMHK|
zE(&<6Xd83MTTpd9wy|!X$7y<SyG9K$Vra9wH2jQ!U!-Xa!H>TD!j_PR=QC$;GS~2V
z1GWs_KTcZsqAz^D9(ft5O-z3Sqt%9Pd_!%TYDZ}&s87OFno%PcHwXiZ&;xjD#Mbvc
zh?RD(b|irkoev+P0e;xeclrra0q|)HZ4$5*J0Ad-SNs3Fjt7bcaDK_T2*a-Qpn!O<
zrP(=MjKpujXZ|Agyl)s`Re;ykY;3^{xDkNr`a#UI_5QrJOS((^gUj+gC$<RzgWAM>
z^_Wa%y7l$;UrYyYNZW&~Kxfo7ZlW-Au-(^DJ{)#`cpT0tn5k$H{FGz3#9sP*ELJ;_
zIaTTrZM+4Ib`@J9)WoP$*PG~O&Zn-?Un|8z<ML<^%YO<}Z0(Vxa<|fB7quaxE~@3S
zj=g_!)EiW^EJZ(9IB)-z^XG?8o<7kRe0z~^z}F|GGhL()R?unDqScOiXU_*Fef9*Z
zRRgHji$^!1(e%kPs_M%pt23s(UhFEun}7f+Aq$|B?wTIR<tu<`7)bpH;yLT)EKOY8
zqPfw^+a1zVEaLedWP{}orC5m=hY=cn=}VpDr#=q<do*M_0c=phFM}&tNNtklPjCc%
zoOJg+5K;S5iGsKg3#3w50{X9xhEH2$B{{rnG=XmSbw=X1$xcxj{ju+<h$EJ8>^HL6
z#A&BJX_4^DZ2IG{Mp#n28#Yz*OGygXTfWXBG5Xx=dVRI_6?L|_r$!3DRiO>5&4g4Y
zs`(?WS`=2oN=K=Vu9xYpj8?4%hF&_ZkA+dyWGmxMc0bvdkmV%C{_4t`tV!-Nwv3}|
z*X=3ul;S#AE<ONelBfC~3N7n=DNtw+V_A8+E;a_Y2<$=3?O}qNzttzh%Rkj;-+FbF
z_BE35fv{N9bzmrid&_}c3&j;IGy&KBGKxX`fH_I7#i$5Dh*H@#hHpMXaw9c}X+Y4p
zEgt~ekXCmCdY?-k?!R@K>0g)zc^L=nFoE9&crVxgCavbQ2RQ|wR_H}74&;2uhfmTF
z0(9Gnp2e43#$lsb{~vqr9oE#g^$Q095iD2$0fDHXGy!Q+1Og%*i8N8FfJhTj0Vx7Y
zuppsCq*;K_iwKBx5u)_oi_&}VHKciG(0%sa=X}rizVH3(o^!AJ*}9UfGUpuqH^v+b
z3iP$xDGw{3O-a7{JP%>7(1`;VoPG!*8B=|b%VF;5m04M_{?=#l3tU&DxL1>t&{70x
zPds*t;!^2%NyYqVC6A^s26D1C-`hOCZ86dEzDDkc3H&;!D;ZDx@S?n+HZ52#NZr!E
zjU`m_QVa3uURj1Dm$5RPI}0A8@P(7)+nBC-jYaF}VW!Cl{^aC|#datbt#rh_+Nikv
zQ(-H{jlnwiKBms-^}w7|G-7_~cKG*_YQu@1_Qv79ut}rw*IDN`e7Er;>+&q)0Ku2p
z*P#u4*FlKia95C!3vxU!KjBUGFJ90aD+=8k;oh}+pTqKvVaL&{=32z1yQa8IgLkKF
z)B}<o=;m*@AMZ8dl{$X3p1dAzxT?t%_xSBh2%qxkH95_lP!VRL!>i~_=w+X%zR;Hd
z-2KfAy>_(zj^R3Zc|nNA9aM2*J}sJ)9fh$!=A3bD!F!#c1~^m289%n0Wi(Iur_YiW
zftb8Wi=}%My@vj)UbFgVz4jmE`L__2DSFKa_?x^tsF}=I9I#5Kb#egLLFvgYU+4(k
zBCBfaYAq7zilUCFcf9x_JbM!<<*rZ8KN~-Qk_O^`bEonjsUN_d312`2sDT|oG^D0G
zBgQ+RZN{|>G$s4<6_Z2^HDR*KNeT4=fPzkx1L7$pyTz%Vw0ixfKx0A#h2&v3!>|Ex
z<L_F|p!(6Ui0jEt&)v^6Zk-Lc$Y-sElDLw6nPsns640~8^K`jnLxFw*LvydKn_Qxx
ztIe6W=uwMl{j4JJL-I!-2bITO4D~&CmeZnCF9O3^8xOMJ*2GLDOQ0)#o++n4tb|1?
z%b5@u1hthn6G2yCxUL!c71+7{6Sl*b1=a*fNzyoWVeQ5ktFF}&R}px&9H9>aL~VR<
zCaDF}x^DZyo9-v<^)v}&Z2BVSnE@^VRNfRw=iH$HtkwJf1yRud_XXgy-N!_Tf$X)U
zdx$1r*ruzTcaCgg@FUP`z&TioO-$NJnilxeYw{6u-V}pALy@<AyNVQktkCUp%rAcl
zxKBH+Px5o{BNROTc~QoycvB-{kRShNJp&YZ<*Eg!!3e1Z4wM3qQ}FMU&7n}nNF6%O
zH#alysl2`lnrBcT_$)K!iHw_(;klO;<pop%`m#Tm`^TLIapUNdHGV*CITa%sgVn<u
z0EB;iv%%_=-Z}G{tQRC;B?Bl>LVOT_6%2Ek<y7>hTx;nk^w$F76La=qTli9195<2N
zW37GSWKD69qKA`S_eS@o`?h1&bb)u6jUb5Th-5hs?|`5!76AbE+!Z+4`mc`kUl@c*
z2;CwbO;&Y-7Kce^K>dRDzb{T%()wa}joT4;($H&=P}%(i{OYg3plif>LWIFzn#ACT
zOi20jSP;O0JPaSfXmk{KN7!Fv4=uq4Kx@3S*v;zS-qE=2o5=a6APZvw2#fxWA?)P-
zg4i$AK&4%~0D|j<+$T=-n<3E4j2?s%-XQA8RLysMRlrXeC-W_p>zZC~+A4;Q_^K!Y
zf?lg~)0@`oTy&WpQcQL;+d;gXN|6#e@@2LovE+Tdif1V!aEq!8gIvZ2#m>EW+KDl^
zlC=4aBq%&xlgA}=XB_FtTC`T}#35<#6W)-6nY`{amr4Z18q8^94^Io+S47=-VaTa5
zV)SkR7j1~)UR0HoPr8cDvFQ0U9q0IbQ0|lFP<AzX-lSIK9WEBlg*`E9No3G5&jL2{
z!t{-fMQqPd1u~IydZXE909R8X7vy348vpVzd>(H^t%aHi-SZar&NlGH_#L+^{Ho`7
z%*e97bVj@(w&%P{r44=90udM{BYu>i^Lt&gev>!ytrT>JJV{o2;@b|uFATZ(Cu{-i
zDJny3p=59&XA#qAa+70|U}NTL-ljH1i>1xAUjLgLCRk6V21Td8fd>>z?KEW@+n+ha
zR1Z-5K-p*e@Atpya1|OTEeJpP6PCv?EBF={4(y)-Mc3DopYn_6fzpykDP%sf-A+f?
zXLe(?-MX86Zje1p;$rMX{7N_rOn(7d{`B*IAP{Xmn+j(=-&hb*5Q-F|*RpH${@fv8
zy~^!vvBEp^6LzY8oSHWI{I}ct)!0*a;QorWN@U4P)74%de*8Fh?@6BoylJ9`i!Vn{
z+E`;af{4mFJY{H=I4=?Hgb+M7Ff?ce)izgkpw%9z7^S@z_vz-H5l|_7xkWwa=)|2c
zS>OF(C*>h|jYAhzybCTE%vvR-w{~@X4pV*k%@Ct37MEM<(~XF9taYGMp`H<NE7~H?
zaoV)aKR1*r6^-fv`xH_EM$bdqD`>eJXbNGArf+;+SW1gf%XoQCpCe~p#pwkFTG!QG
z9CpdFIZxJ~bnfFOYf4}@L1cYfa>{TPo3BQUu!rV%87<R4r>3=C46`lki^=#GjNzYD
zqsM=WYRm~ltZ~l`Z#F?Qmp&U$`JMr3nIHfj_kuVpfkAtr5j!*sp%8Bs+)^9KS>)%j
z+V4o(m?g~Q4NQJkYoYf)u~#o*1ir&0@mp*9Q;cQfZ)52RivIu)7gLPo5HOZ80C-@3
zO;jH~PGq2z|Aj^gev?7y>(^517aH=%o=ocdwHY+h^^~UEz`WCI7%5P121rs%3I$HO
zhN_UKRX_D1R=+&XJX%>EumIR(0@5>vlL39nhY0{exOHAISLNm=JXZZ9!8g*)3Phcp
z%I{f4PQMQ510ch%ujV+FQ(48L!$B>KQI+p-3R77EwyQM+vV(T`Kw-nK4Si#j>f1H}
zf6-}8_SjWXEhy{>`2%UY8p*5nE3^~(8-FrKuE0}4ZOA`ds!*_;e<{QIcXp|4$1I31
zKG%{S!10H(-<DtkF>9wC;hS}UZ^AE%EpLCe7(-8?W9|O{8m8XyitYjpngayeuXGBG
zf0QsVfFhU}+(n?M|B>kfwSZrKW%`bTa@g_vpbBfQJOS{_arhGZRa{u1IB6&iXED)y
zol*=4|4ebC@CI99Q+>xmDaC--k90M7#a-bzGxp}Hip~*6heB>jEdxhO@u(asQQ#iB
zFN=aQM2n|_Duz%{#Nc?mK>hTl<RRP3=bwo(%Ue+x=POE<!3`<X&LLnDc^NbkxR##M
z)U1$0J&Nf&2DAp)VqXV|n>(6E5-vgYsu*$!<CJ5wV>VD4ya0xBNt^i>R`}Dox>|^k
z8MF9nO{jRqzqGUbr$*!d$NoM^=7s74DLO(DfF?bkQNO={im`b14%@pX<Q+AlF0p;R
zY_}wD@ZfFV7N5)&0G*Sh$i<WtT@pyq0qXu~riQ>OiVOZKgreQP0B{9R)bf0tEYJHZ
zTeqtwvbiWc;O6D+`LRIZBe;)1NA;rV;Z>)Fhq=nmOrkH^_3xhu{95CvFmKwG?J_l_
z_2h?6JN{Y_^);Pk<*73@Y(5MQ=Yx|w%+6ssA?l9QsQqqD>uQHLAMVK$_SQ)5U)@4W
zmT~Jr=8;niO^Z=y0+)0gw!%})9NhPFezCQew%>QrXwK0hy@Fwr$Fns!*W=Cm>#_{X
zP9T<2PLHk;SlhR7$6U?&+0gfTJi}0@b=QPVw62Gh=`E$BAiaC}CrtBpKz!e<x+dd=
z+uy{b+2Bac-fZ@6exgKl6M-X#7Hxm6$zjNh`vgy!6LxZr^7c3`-0!+gs+HD75Wt;b
zhwu}KH#w3y8l?C-#F4aG;u^fE_nncGMMxZrK6x71_J0pX&`3lA^?KY8R6`*)ta^1#
zi>euSj!0T;TZ3ZdAdT1(XTl_$0ur<`g={1L1PNmA`s7i})E~~hKTz3JP+bzJ@}SwR
zMqn;O2FBesBF`e*1pcvk(&3-@k(o%3N7PN`stW2{JoB}#wX28xY;?K6PvX0l_X_MA
zL@qLS?9O=cO!A>G!oOZrx&aj{nJKyfXEb&A;WKolc)ZD`1sTsd-=0s9z9Yn4RAiPL
zPt@2{*gSW*)|o+t;c3WT7-z=j*qEr;2O_%Xfdag8^86RK^qx<o<2E~+Ks}V8z5iM!
zi8C1oP)CF#8gNLgXSEjsxH&s~y%ZfSyN+4}ZgfQhG?3xN^<Tw(|1r*uGYY<T+5x+i
zMh-Rx&4X~jq@3o;B9B2cj(_8hKgtU5AWZ%<k&<{3<Ah@*s|fv0r1%0hfyLmI|Fm3!
zlp2-amg`skgi@nIyG```U5tk-BDYd@+e+p;ahTS8YSFCxPSxnE5ZRUZp3e}*#|nG+
zz7I+CUqs9UFh`)kwBWr={XoCqH@%9sAph><en8|;^8Z{1Nj>U}2B{(4Y{dLavfDKC
z%rG2ig6#W!XTT@Pexq^QXAwVPC3+k3{{@1*`nN))f8)ID11uAE;!-zu07+sk=r$5u
zMUpQInUFvPzN-do|4;)Ge~IuHW(X#ut6<+10#vL1_Cy?Ga6W)VLVsi1O3dv>DnPHA
z?`i_KKawB2xw1)+D@%nRmHHLv?<c<LpS4&!kPmL9MSS0F(19juE`Z<z1?qgWri#;6
z#XBmYy<9<SfTGC*f0bIwF%CIC4Fop_KUFa8HiO{;iT5Nks8=%QVs;<!jn1W!8ln?G
zNb*;}&J*z$#}gzzr~hLTpAon;Km?Y|4Z!89LT+yLL{L~AMrQ!Bc@}s{e(_RJ{_2yo
z8~QF$Lf>CoPVzwL3k&v8`;(f2)L&yfkpK8RoQ<MLYtC*(nb98=Wd+Q`M6YH_-8Fat
z=@`}zp|-=B8tRgK9fQ9K@V-npEnv4_N(PV~0c{$ODm8V%y_p&1T-g|YMf8uBh%kuV
z)2^ZQR`IW;Gv2(b%VbT-UXqLP`sWQK+7@wS32>TR&zGfA0KcuQVYUU#U;Gz#`adW~
zSx*EeI&A-M0t$Y}MvmnWU&yABJ^=yE(1`tEL0J4{r(J(YQy{oMW6V6E)<U`cfF0uA
z0OaEsrHBH1oeMZZVfz0d?9eV@KkNn&f0Fa8gJ2~&fFh+Ale~>~Ar0=lc8~T2wd8$>
z)pn!zQDHTaw-K`x#apsV)sc<LPIIj_7L=xOcrrySui7Q2>~5NQyep*2<DdY>q!mAf
zZTNyOqx<WpU9x@xWVIMo`@afk*BZkTU$E!=qNJJA0}B?!gkm?e7)=h*L|T^ummWx}
zGytjA-XQRSh(SaH=1Mrp#D@|S6e;wqh_*i6!0slXuPr%Jf3;OO`Ww0`nok9l?%Y7s
z!R81dWiO}=D201n1qZh;h*P2iO8`{a63UP(*!tM=ND#j@BJmU0hAcxf5wcPtX0slO
zG-j?w1jfZ3#~t3Vc$uFcQNXL14_=5$kyIfj27bzJC#sczS`g{?LYvJ{r01p=W9?mE
zZgZ$tf^0b5{ih`bJ23xlOV8pC`8wTsq(rI4?6C{|Pr@D1)##nWk`@FTP-LO^d2YfN
zkf6>lgR;{M$m)XoB($6lRl}R%3LS_+iTn_-X<;Fqp!QXb%n!EK?uK^>+0fS{E~d_3
zoBw`O@>g^xr0hw7fxw;x2b4$OXksA}d+{mjf_ObK18n*$o_#R-9&xtZ`Et3lazO_$
zgKV}y>_IrF#Ox5JXvmNRJ3ysnDl|B-Wv~3B;{3uZmIyrtT|GO#lw_v-0~9IMRoR2u
zRmR>YR$IxMLdzr<<fQ3A_hAm~L?VElD5U+`yBjU(l0iEuzD>vv{>TLXi<FM_<upEv
z&a-r&u<}L<C%WZtuCT$sF`OJwjoCTuCbFFX$XIXY^8mpDO(=C?hXR0&P2tTQj)btf
zpe;5e;Z2}auyx)VyP!~$hp<uWE8jO>0cs~HJLj&=WV?LpJzqT<D|zcBKg*04d<iw|
zH(7GW*mywO=aMBPZszi|<X!H1i7(>d0ZD0@Y{xqV(1TJUJ)1xO?UQ^H;l@L(xwbFo
zr09#d?=YyHdQ>#7`Yv8vJ#Q{J+hFph@*4H>oMTe9SL9LCTzO3<0V@ZA0;6->?~xDj
zQhkFg+ueQj4E*-ALJ#7;CQ>M`ZiO;d(o(Dd74#rQrE-#jnJ65@0nGdi%Qm?rZ7q8*
zNGH7b=!k^B@v4<Gm9kRe-eFj0_!SJn3Cw4Hm@KvZodv%7a(Wc@S2U-e$h1!*Aft;K
zPg>ty0=~ajDH3Pm<xHZ^K`f_$noW&NI9uEVZa_yN#aN<0sPOYct&&*-qqktIM1LnV
za{_R>kH~KCDVHn2cW|2~ZD7ZBX4Vkh#9Fcsq6~WTm$Ny4o!uEeHWZE?vfmz=#$Dn<
zEGMY6L76*fA|CRh^zGuykpcY#iW1k!Pcl|JC(sz8Z#0=@C<udF?OF{jH-=VS&FJvh
z*I@U5+I9{obwI6$tvaiGZGN6A-a7#rp!hxkAHP*UPwPd$QUGl#grAVio1p1VLhnvo
zh>B+~QK;-VFNw~eMw&F>4N5aMo{S9z)#4AOwOYIa-AnK?FQLpIe+;KReRnt|iQ{BB
zN$u&>I?zk!vp#shG>O_kdKNU_AS1Ni(BaGeI-VS`hG*6AhcbfQ*2anDB=}0<hB=~5
zQpbxJ2Am||^9i_L`Ux{yhwp5F*EsCX0bKJ|1Tn*&(|HRbno+LM#%yrv`vIS7eEKI0
zPIh%U^%M4ModR~^f>b=)a7Br?p!m6%O$AeLXdHBM>TkbCc?x!bvI?QM;B#bv5-4Cs
z$+n5@=5C;ylk;UTY(voMY4?^%U|9pfvUZE2cc$S897*_=$R;ET`raT{043V(a%ABw
z8#;(KHzm+0jB-yjWnzf&T7!AYus|pdPjmhIQy%&X%>dLJj0)<M-T@FeNV7aENSKCO
zb<5h4Ou^JR>V7jvC9(B#;+JJIOHW`eo+TZaJnh|Ef?@RpqH$~8vVg=OyI~O*6#v)7
zI*MAaTy<2QCha#EC%>r$1W+Ri#WM1e81+ZMdQ%oFaR%{G{Ex*wgj)Z$YO6dBerE$+
zFz!<*&<+;ERvBbRmAhpS>n#cjSoz~hB)?rE;-EJ(u10ZC#gDcXsBKdLF&neXCfJoi
z*K?SSD@Zi{Rt!nOOZW+a`X7tcmYxIZwx8uC+$RTR;D5s2Bgw*GwPcUOXFg*P8}-t7
z;)WUB*4{q|lAvq;h%yGi1{gDBCrJ;mHRXvwL{z$PV3-=9D@(g8{5u<k69K`Wsd#RK
zY0{B>3J`=1%r1+#av|D(fBM_#C5+;Lfc|KMru%_i!2;;EdUwLW0AQSuWMbM+*l{3q
zH*X`>XUXs>FJ|WHVK6zyovkj?PuPRsH;03dpbJIAuE6~{^7wXh5J2v?{p-yr1fa%j
zI3fGD`2jst+OU5v|6bJkGFXVc(0IQ-eupxaPNT7wXEpOz)V;{Fhd{fazc1v>uZ098
zZ_Up53G)Rr2%@mWlUBTN#v&o&U+Bw#TJK!7Rh(w|oUlP^aM_hFS&QF~G?)dPs=r3~
z+v0;Mcq^Qn;eZn7p2$NFVu0{G8SC+@adJ}%r<{%^LOZ&DU;E`>Ywu=W{1c{!!3=}A
zx6Sw54E%zSn|>&!L<a&~HT_R(T07R_7fud(&%wAe7DE7wHjSdIj-}=%9XFW8Z1V4b
zZ^#AzL^up%kSu*axah!U6Mt>*G}!=rafl8toGx|`a)X1g`Pa~70sve1%}5wwC|q+N
zI2@nTOriJabpmLX;>B1ULIbu&sB|Ba^_^4j#UR!x65+x~Q8(0Wb~y+Hi^KsyFYS?A
zzOyoTz}_u@S=j-NhV^G-b~JW;$oYU<4_Q*w$A}j#^Yr*w`D5@-iKIDe?wAV7f-$1-
zRQt*3j9`34jE^rx80gOLY7Y55sP)xV3&mREqdDssC<EEL+~zBYgD?XQ-W*Vdjt`jx
z=KSO})S8Cl@>97-H--(USsrjugKt!O;=MPpD+ON=;e=Q%Kg^~eXc<IV)G0V%R5~A(
zdkD&pfJ6ntZvY*z(L;bUumQ!So|IO^+;PzSDkz@(tqC#RNj!u{jnGv?jQ0sy>bB(9
zBA`zce5HVhs9kas#;$*ZaPR*Zvi9;!HZ|oofIv}6z3@3YP)?wP%NbpQ+|qx-hW!A`
z>bi<7a8#1L^RS7<)T<Vi1LS$#aq??MvH%)qOa@emGe(neaH8SwsYSVO7*PQ!v8Wtg
zZ`1`cNDapJ-#Ar|aw-69cBi#NY5_Lb_c&<s^~ba>;sqZAHIp++hFmfp`HoPy{VHX3
zW0W)C$N>=qZu<{XueFd-BZyH)97Oh*Qw#nHOSfoT215a30(HZ+dKAGpo|6Xr#d!*^
zQy9t?Qn^PB$bloZB#X(A8dev#)8WiS#M;zBb=z!9bHwWM<R9dSCH-cKse_mQ_)QU)
z6Mz4;<dN_vgp~2&Wk>)l@qP+doZDa!Y^|;Kp+*llaK}LJ&FLr&ap!^eThZHwn0`)K
z_2{(S?<hL&MgVb#G8RCv{6mmS`n~()3{NhsR|L_pZSV4+105apwpJ^4h{Du)j5}*B
zfY!)rGuYiKW4~JMOJ7I|4vf_nj3L9NSn1gpY6#?8uznSQEgCQWcJ`lT_<)31dxpV3
z&I6`FPi6})dDCOQ7Ozk;8q_RXFHGF|@+oDU%EQe%9HXR>|Ip^g1=%R!h-r=F<adNt
z!PI7Q#%iy9+O?vm8-Z@aM`!!)2wZO#TdKW9cMdwG7daS)_tDHvq0=)t0~Hg(M}tp!
zA4^#_Ja^h$efDd1{sGtbvO=#vc4Rp{rfv*A!0<&tpz*C!;)6NiP?i{;4;@CEA4j#+
z`BiSa?^j_;d|43-j!y-FN{{pLx>}T8E9!fIQ^-g~N|8HuHZL(d!OCwb3+s`fD(>f>
zGzTL&PP9F^h_>!BnpxZo!xnh(s;u?r%Fj<Bg5k8;Bc;*$ZAY}Q%{<&sU*dBTwwBFu
zNpsh5(PQ2n8KhV}%|wUb*v?s&ZR96s1N_B-9X#soTF+R`L;o#$rzw5^R~h<OC%k%W
zb6Jv0qSE=2ByL?jpBRib7L&Jw{rZ;@hK9}Y)op^EpJIH?luz@jlpoux!LjP@&l=za
zD!b$Xd9`WP(H8aib3#n-q6wAjNnWe#hrC=AuN(81_7WOrdqU>Kqs(R3K}&Z|6)CUj
zWk&OSI%RaM=WMI-o+dY@VbSxxZsVc($FJ&Kzuy}N+M>@<F071GleasR#%kHB<JHDu
zou0aEv3y8cqBKBmBc3+C<1PpEjBSH#0L$0K!5c!M&%<G0tmnbM+x01xkQ;V6T#;Ty
zxQ7fpo#C_5)~ke~X;Qdi_Vad~BPF#<6Vqu8c54&!ll9+f2PJ6R`uNEPPh?O!vcxo$
z#aYwwhH&ZD0eQYdHUpukmr9~Fry{1)>OA9>M5pVcX~vhh^7p@S=T1x^$l(yh(V>iW
z9w`LL8YEtB;DN7l^+h_lM=#s;eWIqNS=McH@Ohd-!aAZ(GOgOGo{8UDxh9wZ)@1#8
z(Fs8!IIpA-0LF(OxZk^drFK^3by@PG$eGO3HS37gX`mu}P0$??_S<Q!pGswbYav8t
zx)G2c;A)td1=(6W%q>Nz!!c<bKpJlkuao^ed|x7Py0=9f8K*2f^-v|G==624m7mZ`
z0AAs!rbMhds7I0|^pfR=H^))usuzKk79%tm7>*`8*uq!Ol~0pnhl%{E==U7f+F0<w
zG<N_l$XMLm0@mk^&rE`f9b`3!-Pn%>pV8pALw4lK?j5lG5kP40jiupHHNgdu4|-&`
z?IZ<MJNa7=xJMueFGx7&l{Dz4BX4S0Iy4Nr6ft<`eDt}EUe76Gi?|lQvX$>;&mKU+
zIp~fyJCh%8|AcK%v^NS@;JX>8Exg3ivn)rmT*26Zx+W9f>W+qZfDi1H4{>}G(Uv}U
z1BgWQP%ujHriX=vG<c>E=zFyR3VaxFkH^`C<6SzpdEd&M`L0j`Oa&&4&>o`Vgr>(m
z-Dr1im4=tdQPdgtm@qV^0e!2*Cm~;%J=+|RqTCbPRGC<Wd_q(MO%X+K^MoWV&{NSp
zkTS0`KVcj(RUSz{8b6kofjNQu_U^ovxP}A$E;RrwduCgE{Rk_*Gr<3g=KYYP1Po}i
zx#hA@y-5@ylF(!tY}0gl_6rZ*s#^FePdP9jz>PdI=8WHC4tSR7k<6AAxvc{DQr~~V
zMzn}64^hA&AKkl(AW?}RmQnXsL{NwsdiNd1)ubP-d5nu3yua@{m7WbcOCp(|wxi2y
z@NrE!y0LIH?v)t`n6Tq&d6?TGe>vAKJH~^qS}irut+yMh0oO4y1GYP=6<0im9VgC!
z@m3PFfLTQ(fo4G>>oQ(~fM-Al!g8=yF0}-W)_F}|E|0t^%6ino7kP1@5+VIxt}+(P
z1XsC_wScP-)V$Nk)ikK0WYw8Ob$i5iIStpoF#RLwZ_g1B1f_w`oX3{&dm1|tK2S}h
z?+K4D<LnY&Hb`Tjj~~KDp$U=y5n9J1a7RJN^D?pY$VzARG<@}JcpT=7#cI5_*sAAj
z5|%`?01Jc!3nT|8l6RMVJUzRW%p4E|(%y%MF!L<YWM(L+1{%`?T$P%s_6c(v-uD`@
zLjsK<ILw&)8K0G(uWyMAJ_LCc6eSQDS0ARGrcd<m5bt_rN{-Q8Nc(Ql=b@JDaF!rs
zF_7IVVkkWK;zLU<!+SA}jXmW+Bm1(}Csw&F-sLRnNIz0Dyw>bBK0iR-Q%Ghf9_{cJ
z<uUr~Clx*4GCgg-wSYL}`2C0>lK`Kg?qk@9K?$FbBowBbrq9MR&1LLpB0t$TpEz%u
zIrnO?E74C=FlO@^1zdX0l&^<UW{G;K*LFS;MGFI1(=LLz+cT-Jc9oatzoY<2kihW$
z19TLs6CMY>h!1C_6CJzO#VxjFv7nb#i&|AVOS_xK1@rI9rz2aN;@9)z$eWE0h<$RW
zILj8lc3L+*@Vp6A^}zQg%pq3S5Cd>LwVngW^)Yl|=O;i-o>_y_TB^63rfzDctb0g~
z<Au*s?MbaxIGK_4ht}j~?K2;vvHGEO3Y!PhDv<k-%zosi;1hu;t}ig(FTE+iw>d?R
zov((rjMISgl+lizpTx#0I3Y%ao8G7pRJiO-EDA)X{g;2_J%*ks95(1u?*Q6eP2hNr
z4AG&I$i4E^EBV6kk1%FC?Pnjo7F#)bZA9>8&ZL>S#a3eQ1;Chd&<52NY~!be;Dn}*
zyL!09a{fEhlEa_W*Q0Spqf8$^#n@k6iZe^Txgw4>ckonT@=!T`)iOnej6R(>;noTS
zqbIw@d578_u?fP6+nM@cm|$bdXMN}Oh0-uC+b=0AX{%b$?aATtG&Wu^$Fpf$&I`q;
z7uwGXH&1#QSggD!@)Umd#{9T?d-khy^inXUHN}e)j1K54^DN?fK%&~`Kt-9+txFzx
z_Xz++Q*PbKNdkdVNe{PEh;3#BsqGk$^4afwhB-Syy5r{AA!T;|GLKE5QQwL@Ge6>(
zaHQjAUtxuFvCP@h6RkV6pptk63d=kX)u~|TzuCDwB$u9i#xqxa0q>JW>|9?{!~7tg
zUx{e{9@QcAt>jHux#GRO5TYhf;e^K(eO=3>{@Z&EEMB_AxQ*`^IsQQw(5O)bfd~7z
zKJ#v5V#}Q8UBYU&k3<eG4pKtDyQEE-Km}G0O?gA7=jc1SmSVPzrqk4Eteg&ToDmlj
z%Uefa|BP?Xf{o0B!gRB(<8PO;p$QPN6kQ`<%D~`O+Mr>0Q&){nBYvjYQD4*TsIw{_
zI|V3@{W6h;a~r+B;6~r8nm>3TRdTQ7gf*58yaLi9fQyNsok0q*f3bKuX<MUrZNx_~
z^$XC$syP6O;N39<I6S%$i(iHJV8n|yC(c}v4Rri8M`$HR4?GB2>8%L7@Q$^8QB-;W
zq^ETh^gPBl=XIM`wkzsW%D%RL*nZRGaXy3fV5rCRYIcVOj@Sl9{}cA(;I+@-8T+AL
z0IIo(hJPl1&NI%xnRIRNSYgi2O@MxE$IKIDSKik{AzYo?45g6kmkIar4W>qsfT812
zCbUjmP4rHE*Q)rttkXE$@V%BI_(5w@9mpZ2yS8rPjYytFYsQ*)Tk$jY=j0KNto>TR
zRIG0eM+I=x`N@g%91(3_@Oy;iAy4`)`Nm+fWXHb_v4<2~`7DpY%kI^#0&kdKZPlDv
zM2z<_683>EnkK`WZ<k3AEJ$zjr`*Y<NkKo<zGnc4X_4nAOwvV20q$|L^)z&=Z}j9L
zglidcw088WJ(+f8VD_ekM*dzaLhjMk;Bk&eM%KrPKCOUlGl_F?VdNZjd_AZIzGk|X
z*Ne}SmwKACc(cS6xCosuEyC@lj(s!d6dk}UyhFYkwSt$L2RIk;hU>MCU=G##xU<h*
zE46w8y42r_*&Zvh{t46f1QZJdI}!|fp*7|%XucQ!Hrvwznpb{fIs1UOvG*q|9LUBt
z$LNYtK-9EOu>HgDZ=|G_dI?WgYdN|K<Myv?<n}LhEC#$2KUHP@n7&4OD+^qN9)y!i
zz)Z#U>_I8T0(O21In|XS^I)0e;G{;cY8Yc`2zaI8C#;z?Ej`58Mui1t&8%oC_K2@i
zTPV@s6YioS+Q7p|yXgB%arDbuF@CelCdgjk{AA|>Wbo}gSvef)&4gyO)Z}uo$o7Ml
zd=D(byv?v>l6aBgY2?%VGfw9ZUKl=h*kS@c$QvrJA~s*qciKKjY_@Q;saj#=>xtZ1
zGinm)IPlln*b~YCXNg0-U}4+lA|~B(HXqvP?^n@(-^CKxk6ijj&RG^eyOR1G<1Cok
zPo9BcPcAW<^B0yMZ|CS=>db0!x|}w_QFy$6pl7l6iV>Nb7@}s~(@Xvm02t~);ZIn1
zNXnChMZF0#FUTjSQCX0D#D~e}@j+QekdA1Oryobz)IQI5&Gj@wK9-4g9^g1IR&;`F
zi3lM3I|yQTXb~iL1paV>j*&6oa!ze7PW^N+unmhw`1<WT<?QX@i_ctf2v?Xz#G}pB
zeh(LQXKuHra{Yk{GlT&sFe@_@Y%>Bwvi%7I)#95|h*uqkXPf{~%Cd4Da){0|^Aef1
ztIlha$lxv<wq{&D8)m{FyXQOk(rbw;=Sevv26)shrL_$j#?>s~NgHA)Z_pY_gs+hR
z@6Z#Y@~5N4d+{YzAM@pd;is{Qz&~>*Zf^25C(dR(at*RM^nG+7$=SPW)y~*_5^fbV
z`BZuw%Y1vDd`W6}a~ZI*VY)9s1A9T=x>$`H4sN>NEC)4sbuN|%m5K@Fn@M)`yTw?@
zSltutl*YR<b#>ff<7rMdZ8^N!k6xAQiHsh|!(++Ky0zOtta5<r`C-4_uxv3magGcA
z;~PPm)VOmRINuR(ZC*8d23;>#?{$WomzQ1aD1UP+x?Q!f?(pSWj?HnRLl=m)!Eol^
zg5ut;S?t6aM$&y~_KJ=fSSk9El`W_gUG-UH`qg4zU8|Eq+x`P4@#`FSiRek3zVIEV
zsQSU1ibHqB=!!F6`3y>tR>6V;p*%T@m<Jr&_RKgUyMUbS(pAxBFsGohvIU5TLwGV*
zhrG|4y?&UfX80~Y_oqUh+f0a=(ekv=@&bqHB?oxGnnWEofLs=^k)YA<qG8GR$mEe^
zZz9<q`br2p@~QBc3E#7ObsF2_k|%ETzgVn$ws#hWh&6TI+`=ruNqZBa%?sGgHqfq{
zUtW@2AbeeOKW5u;$pR=|sqIe%-5>VbUp%MID*BB&MZr;>s<?{pf?udYKA{!23Zxe}
zX{YqA^i0nnvLtx{zhv#hXK}eN2}P^)K@+H#CYS12tn^<~bIHcZr1mQv<2jL}UxJZy
z`zD>SSUv%E*&tHHdY4QfU>Ta<zw-jNwrTWvQY+(qryr2SKJMpYCq#4bD`gkGzvyW&
zS!RDkU3k`Ct5d+^11Fc$ksCEchRX0Fo9|1><!Tobw89=`=BN-q9ldUCl6DovbXlEs
zISh$nMb#1tK*zlkX})~#$Oxcx;8XmoKERQme?g9T_fR$=AZ0PRgk?E#N%?^8C*=tJ
zS5>RMSz>%`OASxneDqkXzT&)n6JNBMK1vqBFO!*#yu#R-N-URhN}zM95oX(PzL9jM
zPl-W+idSJlezVPj(1#Ly);a9zrWEM`004mqoHk?k#xe|Um`$BhIez$Y64wps?Xfon
z_wCn0kqSii2;gZnV@WQEIs>TEmb|?ou>|<^wPuKd{i95`cK64jnG+db>!ayrKfiL@
zGc@s7?8KAVuW1P4BQ$;<NQa&&R9iMo7;d}zPApTC13hTL=)6?-NMIS`R}p-_GfSpj
zr4klT#dgwqD6E_ais^GU(=<Sk2pk>L<|{vX7ZRMGIrkGfj#=%j9L)4j4hzMle##aq
z2i*$eWLLa8Tk!-4^eIfm4(0>k6wfX~@)?;`9%{df-TL~*sGiPYqJe5WeSrV2p-MqL
zLkS&Q?HvZ*pRlWl`E&|j3-uDc27RCu`UMr^`;$=^pk$oFc+wN@svFYqavYLg)Y^0Q
z_=NdsntRfT$Wj;b2-%>Jbc|e#iVINV@%hw=B}bl$Qct~j=RIaHyc5gO(I*fYAdn_j
z{y=uk4oHp>aA8dQqFR#?o82HZPBeqErwq8^gR||>(s@4vKt^)dldxVt{f3|knZA;B
z7%!))iZY!MSYtop`zlaJzRXK<BPXVsywyc*iFGEij2b9Exb#>J%)=lwGboskMpd*{
zhrb9uCyZ@%c(hRrY>f5JHFt9Pc($%-s}A}n%$ajfPUBkWDVqBoLFXAvZZU3N-dNUh
zCW5_Vx;EQR*!g#QkHltEni=O8FQ0oX==}1K*?Mi6?04#-lN<vas~X@Oz>rBmk-<0D
z>=lyrw4yMLYmZN|71zO6SIWws$y#jo4jjtp9}4r`Y$dsCf(V?Vibmiq(H8S{$dR4K
zwRG7L#)6^8ba=l|Sr;VWbrTrlhIObyL?Z@A>93g$CrB!oJFAuDk}stZL(UdN<FH$^
z4AA&eqaQh;6w14HPO;w!WOMW$J?e&bJU?zf!)`F-T2qD}4vFi^V{^p4rB*F+X0=Ti
zOC4jNM&$f8*Z6~Z6MMXS<^&1?2J`WCh}at)*zqAGer~uU(Fe+&zDDQa1ucFQfyvWN
zBH83;{o@2<wht#p=;|;%f6Sn(%5Tra1fnPY1GGYv*ojhhk@zZtvJFcQ_Pa$R_0Jy+
zHg|8ixIVD4bfO$NTRAX@N-~^hpd84_F^K59S-E=Nvtba?aI&<e{BzgU=D|JZJC?3C
z46YB{z&A$rw_NSOMN$kR>NfVacCHNK=NUwlo$ok5(7$I1UZN>-+2*0WwT+(IB?gg8
z_O32hZ5}8)JKb}>Yjf9?K^i>bilvJqgBazhdJH0}_IJP&z(vXimu;+_Z-MKzZSLBF
zM~Ge6Jwri(;rDode*ZZFJFKayp$eng1A|e4|6o7+Val+*G_-qZY4+}=-AhNecOS!H
z1_pY12Bt%d2M!-+Vr4zf#KOYPc?QmYf}4Yd<>a}O+-G_D1^C(ELg$6}&Y$7q=cC+&
zijIzsVIRXW28LsN>@4hj|KmSDzrv2}gK@!Psi{uG_8g(2K0@`g3I+$`q@~*Z1N;4l
zY7aFSFWo+RhW+4#g2S*qRMgaaXsBsvX=uRNKHzs4%@Nw8r$m+Z9@Dj?JAI!?%r7iq
zANQr)Z_Ik_D?H*>5B%vFSdO!@v7b51%f~MuA$dVcT1Hm+vWlvjx`w8{f#Efy>o<(8
zZ`s_owX=6{adms>?&0b6<mt2L0WShkufiiDqoQBGd7GG&oRXTBp7H)uUVcGgQE|!V
zipr|$n%cVhhK|mz?w;Q7Kl(<;#wRAHre|j7R@c@yHn+BMJ9x^xs9@B;rUm}~HL-u1
z*AXzUJv21bG<1}CQSEUD|5G2Kp*<zK_o$LCo#p*wr^WpCF<lBv$o)poEv~o1Z1td>
zfrUq6^vo({YP&Q0?@i4Ae`{v{nAo55>VqAirUJyHJ_19)Hj#a3vN|#ly9k_Y&BUA+
z5?ES~Orwt|g62w3k&lhAcWIC#y-mo9y0nenp?%zQ2Ys*vkkF{7UzH+#293ZB47-VX
ztM0^;aWq{-jV*W)DF}GsYU|!vgh_SsR!@!8bi%A69OLdwwHgxpq1Pzx*eVT68@I-}
zPqTRfswlA=fu=ARPx#fjIEK}0VU|K$nWI^EYZ}gZMjyX$w3_|aW3i_A1Fz`1P}__z
z;Q3Fv#Bpw82lv?(^<7Bv2vc(wD*OJ1P427BjYEgi`4~p_4i-Q0>+J_Ed=NXQD9x&i
zEJy;V#|kIA<(S8^PFI*L8dVw(hD2On7Z$#A1|?Asvw5S)#>1Gwj7hY6n_cF*^_lC9
zPljnC8@u2|_cz^Cuv`ZE8g;g9=51(E4ZL52w`zC`SkV++qsPA0h&6*v3&Ng8kfR%k
zXJqd6mdW;j>c~Uw1w!JjgOfgm-J|Ol#vcxTwPj<g)kY1sl{4d}%{tP$@>>r$=>1S(
z7@+4u2sVdAd=#bo7Jc&GVbKY%U{dCI*6G@7xW<*i0{X@1h4XXnFO_5keG&~>Mh%q^
zp6+Z)u&_y6>U0H3qE<Q1(K2n=#KU~r<kPz*!j&o)3EjS%HOC(98#p+*A|9&77SH%p
z5=)OmD-~#ExhQsT^xNKNZ}ha`;cHPkrDQ`bO*8(zccvBXZDc)yrXThQFhor`3L-?B
zv}~@uTn@W>Q<OUM5J}wPgts$p6u=i!6`yZMvV@S{OqdsRji#;_IbF$J^cGeimin33
zDa{Ga<)D4Jy5$U4FlO!fCoBr)j1<%&8DHlv^~>EI7C%haki7Qj>RzNDS;FJQn0#GZ
zJVDcZ*z@B-Dc$_mKJFt?-jTyx9SP6b{G_=#f^ofz&MUQwD^szSV>yf_)u{#59oGl0
z_g5X=dsfOO%;4s!Dvy%~E+~yGo%3cQ#S%5_#}=i`SJ9CvCic-<E}S1+c=DQgY;MSy
z)#ZkFO}jU!?p0<~B;^vd-x^h_OI)@KX(@6|*KH46vpTJ2!~IzKg_^uF$DtAG2{Zj~
z<^mn(&Xjk1OJ;rlp@J40o2s~;r2TU5jR>k&iukZ=M4^@CYO(-9&`yD)D|>Ot-P6ci
zBXqEE+I{)mkx+wBlk{41LExE%yft9ouKckPR2wN&a8Ow%KQi&8Y;trPzkoWoG%wrU
ze7XA{20aA7rOsFS9xv&6+uPvJDXv3xLG5J{1Jx;m`%kaQOYe`m%J^8)Ilx@JL!r-&
zkzxK`we6Qy#P?)7UHyyinqV2a{_fPlE-^-Zm;yNQCFU5^pF@sRF+a6Rz4h`*4Rq*>
zQo=zNf@+uZQNG2=qS9mBysr;ro~mG`r80%}7ahJQ3*x0kn-8-+a5_nO*|jCUoC2xm
z7uD$-oAm4kSLklO*WmSgDINuT?0w42f+&dQfZE=TA&Jbbpnp_v2R6_BD|W%+6E3f&
z5W6ZlW^zy#1lDMsu^S*A8&y_;Dd{5O==I02RZiAp=)e=BwH2xBS!Ws?j1xtV)U!(8
z<M8>u_g;(4%a@ri6<<<MW*xiS?KYoQ(6-UIs5yDKuKh;;mzMN>v@fpeh$*%fXA}${
za*TtoA&T;yw6xc^JuRFHJiMEW2aE2p)u`U@JY7E9mXF@&3kG+Hx1<z9NS#}VC#WVU
z9O_bOCG_h{>lTM^4-g$!Eygb7u5wp}WH@9^^r=LA%2hpk(XM_5@uim9Wt_*ajrJ<l
zmeJp(Uia_H&%n0}TD#<Z1vEv(;tiSMe_ee=ILruOjeq^h;$OZ|WFafufGV_B#H%nr
zj4pIkZD~Lp6<6BpnRLQmeJE+sJv3AmR>#rXg3Uz|Bjt_AUjei@gA?qAY%EZ^xadoH
zD^4575q)@-aIt|=xi>;dx72G{Pd#=sy*Y7q?1yxYLnl!tVYV-;B`s~H&nY#<rL?uw
zznlB5Src24G~1nzG!tv8cGTY>N5nA)g+r@qm9dbjT@=24IhH1)jFs8%#&s{|+jKNs
z9w$e70xFSx)|Ei(hgpx!U_ZK@?ZepBKhj`bU>oc?muvmJ;eC#XnGvcWixX>y-ZN9w
zQzYhabvC+}<yAJ#{dzvwvGqNWyYs!|!>VQqncs~)=)U#1Umd)GLsqVsex2vht4^)R
zIgwFkbLzpqlZRDc9yyB^K>D5O%yF$cML{~<A7a@@OsbegF6Rk^pJXMC*h@LjdD0>H
zEsSx^W2MV9-jY3X$|)*Nl8cz|$&`jXRrjVB515{`qkW5WPLgtcPeHc!^dlyY@@sSV
zYCT<CPVMNOiHI<OtyPar#KBl$Q4QOFr<Wq#S7guy?9u$Qp*xFN#4C;^*$ZQrP}Tzv
z>sfDGHTuWLOh{d&G9~sBj66)Px0Q33r=*(?4BLBU??~(j3u|W`^=DUyNq<jY<9xsO
z!lyNz1ptp#GO`bQBUU4$uxV+r6H_va!NEcIj~x&bh5ND5>@}2@uJ-9(T~^9nr2`#e
zmDANq7ozlrzmD+RO+MS7p{G=H&tUx3he~b<Dhxr}wAFS+zv}ok7cJT*MtdH;s!4Mx
zlVWun?w3k1f5C=wPT#IJ)&&XB6k_&MGRj}3!0{66#U<Fq3RvHTiQG#A=tvpZquwg)
z&T&wUyC9hi40_E_mO~uFN_GykYl@HJw@fLf_=pzw2u!RgIR-}8#sC}j_FP&1hGmuG
zK3kGhX)T=L>Cj=1|3Xt`tPLx_PkoL`F_=^9<N)kij%>RGr+#JMWh^UMT+QXf{6p+*
zfFeIr%?nJqe3W&CNmDBN`pTY|s8jv?Gg!`Yo<47Zm5_qaH#X<ILN-4X;;$BlO8R%z
z98o^(L3J5rc<JTCkr5X?^54V`=IAk3NoK)Ryn6xOUni2Ml2KW{zZkhRZSHd5%U#2}
zhL0=v>^u3mZb*`F9+#%GqLY_Sln2fR%d;_i;g7<}^PtG)+p%08Te@u<o!W!7O+UhG
z$$N<=UA}DdXLybdc|4f?_T>{@q#Wagb1OWsL(&Iebgb7bvV3K{c{<C_+I<@ry@3nu
z-j`R#{hR|MVEVwCC(ctqgImVtCZh-`r<@BHWVrU_M%s|+oUGx~GrXNI;4@m?slin1
z{9lE2uHWQ{U`0>7Cn#@S#}%dHYGl3$jhzze$w=#a_rh(@gWJz;T>VfoQMW&*xn(qV
z`23kw1wnGtD+e-<lh#)$*}Jj!F44ugrM98cw_2}1<hDd2PQmy&?p;c!`~M7tWd3&o
zA+hry{P`UTT@aJ_AB95yKf#aGe>eEqw|6hyUfO*ie4(e`$8dn@;DP=753n6Q#>m9U
z4(H-z=ioTWBg}j9^f_)04n8UVbLT}RBqZRxGV;=5a>C*gV!Oc)Jw5$_{RdbN9%L0e
z#c@jPfBa`R_}O!h=Hvehes+VpfBWEPmED*xyE2&Ho*z`mpo}TGR~Wz*uAWRu1hxKp
z?TY?Uuc96^7;Dn*VL^d&Qj$|ZsS02GrFIn|7})7y2VQ;y+Npz+{Ah*F{QgR>L$8fW
zOG67>3|=z<?nJ|sACV8!YX?>2#+t@f41AfN??(D$4g@_q;r@m&a<6=1gK1xy37Kof
zH)~9Wsvw}Tu!Vih{IHKavZIuf`z!t$D$^yap(t8j<+IPXP4f1*-=ayhSJn2B7gl?Q
z1`g~SA4hBU#nNjxq<H8LKadwxUfF(nel@<UKm~YT9aK*hDig_RLs36rhNWE?@w$hh
zFTU^*1wxqnb%HGmr!huHWZ&Kax#+|~8Sr;A(^Da#vv%>9Iy&@kMM+!RpK-fvt|j`F
zi8i47QS+r<WKdH{<kg3qt!+j!8MrbdSK|ju@^aH0zSKm=h`2Gw4DGzS4t1|Qj$R>c
zZR=z=*^HZ$Lbi!g1s2Q$X3tSgtf%By$RMN3SW(i)m(Aaz?{1sKaNj>4G*xBI;Nwe4
ze0&sT%tytSlEegy&>KU+H2Lk~X%eHr0be!PGzFI5N>@t-cIJ!_I3Z#|@2V)+q!CY3
z&6Iz2kDgvTYVYq~^7X0s`5n}6MvW<kox07-%49t1T5!woL8Vq{m(7v>s^)>XuU<V>
z?92s^k2-vUi>DW&mwn}<SEu`en(g0mJKqgFh$VvV=+Kb-b&_Ku>%+}3j*h6X%WdCh
z-^wn(&YG-SU|i}VV8)2j+md>O>v4<EO(u1p!7L5D1VU+Tzl5A><mhxv<yRY(2w^IS
zN($teh{1UA=jS&+OH3{*dOK(Hd|%uRlf?LX$!`0hBcXB{8S0$)og-4zq$zlvuWL^!
zTURE7!<wz6t)&Yj676(MW=TzHQ~v!GE$!lt>FakHjy4uE$*|_Agjf~?+_DS1oFuLL
zSn%2E*#xeHjHzRvrK4{;FF(+b)VW|B6LDWZ>stMzR23#&Jy6(oh6x7tE$LI)+XH6q
zbx+{zIUYnJT>x=?s1cpnaDal{4XDftr06-)L`IQq;{f$!3162>d=>TTOH%&9GeT#m
zkD~N76luW`j42{N;()Ts@1q(fy~i3~*%Z1+L2!I!IH?VKllbk?0RvlUU5tf;`_lME
z7*>faf#yD6O9g$F)#qc$xqstF%k`-@S}L^klsda)K+ZicJKF4F5xOep0mR1y+m$Ks
z+bKIBp~id^DOA!@SLC-#1kwriY3zy`Q@$=Z0Cf~pT8fE}skBs>_EAm%HxSxG*}w7o
zASGT&F>zO_DFXk8<WjE1FzH<ps68rPM=1b7j$Yfy5*Ro7a#-;^o$z!bqw$856!KHs
z=ns2V`xli>0{}`^h|H4Ji>q-HP~ES;Uv=e_K#^=$`DL@q`+Ti8<;$O7QruPtl`ZcG
zxi-2MK80K#_<(ntksOlh)-Ft2A<Hh5+P4Mku)hw}Qi&g{ew}wzW9|x5#I@=3fHYT6
z?UJUWLs#i^`;ETP0^3ynqvf-YRAY)j9=Mo<tUCTSO5Z)45?|SQk&s>$DIS$weQ{iF
zl0P_w)5acY3AOi+jaia9*K)c*HO~EQeC$xlS;8AFs&+aCtdb#LHhW}>{FXd}>nWsD
z1&ZI1TbJK1C7vb;h!GWv4+!6`kWqx{F9#Zm^gs{pp7r_<p-l7(R1rG+OJWZ=0bK_J
zQm9C;p`}87^l{2-TAJ|h*PcBOyYCYXQ)5_Llc`AGmQ2mF$Lo!Cvv?Ak1&B$cZh7Cd
zwX6hHy{^zlrD}RvagUpi4p`I)Wwmm<1HW`BG;QZmcWw8{kHM9x)f2%t>pa7-@KGYA
z$EMNxpk{{#w>Z~_TAuDZy#|)7ckJ1vdTxEvSqm>-oz?BoHGK3gIjRDzq+)gEXR{~Z
zJ!Y_rMkiv+Xmy+IXFdlTJ9X9zTogPz9L_e!pJ|~l8`B^X?NazDzo>IW)I{|#{0kIV
zo>q3POS0dQ=FV+<rpJb|{PI-tpW(iOue;<_+}vM}HXV*@03??@fVj<muxI*qv3*iM
zD{CLj`E}g*D}~}L&dd3M^+=kjo%gwt2X8Oy-O)Pxy;Sv!2uQ)F>*>C2*}lllT5Zf{
zY#h5_i|SoG%BNDtYW-ZM<&f-nXo0!^TgUrg!)WSBprZXiQK~+bW9dp!(@M^E7N`k-
zUM#!p&AD!N1AYBFG@km7%t1PI&O97=@?X%ri73H_i<gsA0F3}WU}wOa|9%k$#ou`1
zd@GgODpv$;je-BUgB_fi{as|H(jLU7^*Kafz#0>ahKA5u$uh`%J-g;#%5L*jkhM?#
z(OXp9Or5XghJ46{aP}f4it0@`NFn-j)Io~EZda@VFgz6>lOAf<oEihcqnN$lMv!6~
zRhSqq0ds2q0+?GxA*S7LuATy#NfAu$>YjEWx5m1=_LE|Ke;ol!`b)gQy@3v(0hjKY
zYZ@U9nxm#IFRMzEA2K8jC1vM*`|L3&oOF_aDMinNtR%9k`x3{R`WvlC)0vINefdGm
zg+a8fVu**5x5H&*B#g3H(=)jnV`5^z1F6$LX>6>?cX(I+Dp1ySVXEe81}bdlYGFoF
z8MxeIqSuADW~V-m_|SO;b_Fv}81OgTZI|6&+V9Bvr7`fD<YHXf%*9^b4BY!i!PU18
zh=O-jlGe%0&+gxs>`J{cVb8H`t!s2pTRSD$Rn19G!umsjRUV5~lLpU3_|PkqsgY<K
zFlza*2%wB;DRKyw<K(X8qsUw}E3l2nn5-z4@NXvZH8^GOnX|v;G6E2x<0{pz_`L$>
zQY7+#z|cFpyURz<i)p~92g3af1#K&N$!9-;9JvA6Ek)9k$JVfb&T6T|H5c*yrgTx^
z#rve~rP^W1R&f@d@NlC|ZBpW$&2<yRn-BQqXzTaE238-0m?8|=gS0eMME7gG)uhxD
zr=-&K^mLk=sW>^G(2)3W<ggo0?`IF&$`ucHbrZwBb!_wflW?Chg(qN_$$YQq%5){-
zRuQ?c6gk{fT%@Nk#+9{+Xq-1AJAQ4-^<LY$`onq7>$Mz0U^;4{zI>(dS^C7lY!m@)
z1PZFxO^wj=M`sIV%c_h|hcj?y%B6YM%^7{<3J9-pF<Y(@Ve;{Bn`L=mHRncJ=LhNB
zfFhs;MbdLFbmj+@X<%IwtmqC3t|SqC{XefY7|M7~4aPNY%B&Vx9=CCly7f|t2QRtV
z^y*+H&#k-*H_*+sIneYqiRFXl=CrSLw>*$1i+5gZ!N<*n-zEK+4J3TL{m$R!r8`$p
zn~$f$W=e7RD;M)7`|`Aa7d5jEkY}SK-Z1rD(q*CXou;o6A&v0J(q2(BOc0W&X$A6Z
zz|1N+jPqZ)@%HA#q|TaGkjfcm-mCdw!zoKCcJBp|bBuY6?U_%qhbs;SE-(@<L$U=c
zjqNeggR|IW?k1ZPHf|eM{E_lwi)F<Y8mztrw4S{8^Z*Y4#jOFP@rkOK$Gjp{f^N*H
z>J^R2_s|D9u=m-G=)<3N$}%68Nov;_toE%Klg5wsx4FW{wcTxHtUKd3l9Ln1)iwDf
zu8KBtpR6^MH`qwKqk-s-%_8+6>bhJbOwZ9U^Bh*%kcd1P9rEd5V}F;g1nVdI;3dx5
z`zochgs=|14t53xO=C@pBG`L|=^=3KfUEqHmNPvib<eKdrWHDw5)aHclOC1bGR0oo
z^V>hZ3X}@ab->8)I@S~gL2;*d&sCxv0jJte@fk(U*ir2F9u&|nz%}`+o@u9S#Rew5
zOkBH=#aJb){QRZ8&KVQr)Gt##hzm=sgp2RVx64$Oqa}NvhV<KBI727|V?!-Vt5B5e
zb)W{4(jB(mI*{?&^?j0)Xq;ZShM9lR-8$^`zUV-qb9o%nah5-j4GO6xWm;9oy`JkL
z!>PzLz>byO>Sfk8Qs*>S8N6+Z?H1l-lQLD;d{S|U$(LCVB^XjT_@nEUX5Hc@?sUMn
zYvu;(?}Akd)7dT}&laPWh#<po+6>(xLfTVo{P|t1M{9`JNucVQCK&jtL42XBg`znl
zOi`)e<DR2YC{ds&tfC$t4W^h}l<2OGr})9YwM6x<n|wf%-=1QhldFN(27K%MT?L`3
zPJK4f-lc-<`cA#$aKsiz)A1~-Cx-;M@?F!XWfiis%9FcuM=L|F!SVC(^$$wCS$A-*
zPu_n+@62I90qRV>OcMGSz3QRS%wV$tw8p!gx6N5*cdW?k<kF&b$#Apvf!UOmQ+CNo
zl4t!prd|QRjUNyf*FNc{-X8mXL?Afam?ihecQX~?c!l;{Kga9ua`L2<HrNoFFB(?t
z!}f)?O2()g`G2+c_ZsiZNX#p~tk>iLI}omsnaMaR?^`*h`b^s3HS+d-bevo|p1E}`
z6Q2_z@lJ@#q|v1DQO5ljiE6Y#TyHoPH*;8u3!{1z!-abVOWD#LTRhFU9Oq};&bet_
zkDHrw>@T^S%_DY2kmaF#eU4&LMSoR1Y|mrZqPdG%Y)gTo<sN=#F|(uz{m#(of=5hF
z$Lgz9^$S8`zbWxNrqjRvHXty*sOjP3E4<s-r%;GZVS?wwE7hI*oGuh!mZQ6<&dO;L
zN1`jR?2I&7xP0E;QLK7!v3jH2rs~7=#{~ud_~eui*>1_NK7sBK;)?r$K0VJ;Dneh#
z1rqC>+R%7Sal<_Ef6?~VVNHi^8!(87qKGIcQd4OV0qGoyv@kkGiF8YsFa-fcx<N|1
zySr1mTe=&hwmsiHeBynd_xO(E`{(<|V+>?t+wVHBGp_4??gB*L{1$MidQRZbvGHAj
z1uyg=FUwoYQR_!TPLQ*M><EMgxx=i8t5zrUU`d&|OW>X&;I^dU;l}}qA&rz$>x|Q(
z&`KVj)2~bW#M_U^o}D}KP1U1d1M&v=?4;9sGs7C+@2iKpZ<Oj5!Y{o64EX>W^)yLO
z3e*tL<v&elOS*seRTCJ0!P^5-2z53@EeP=}G4XupK`jjZkk0S4%^=>JVX^cXQl75~
z8v+ck19qlt<?nlkUF<V^sZXTe-&z3r_W!}8aY0iKxHXuvP7YQax`z+PC2qvbVL!dP
z+ONKg=^n5^Badl)<N^BzH?GP7s0&wB0>iAYfnNhy0=V(;GlrT2!i}jVCfD5PiRLw{
z){C>C@ve66M>=Xc-%~elXKozG*1W`e_-cj?%<z>>dWF_VaMKBI8g9a+#T^1}*Wk*(
zl;XWs6ZrImpm(+|PFxd!`{~{><ra?OfwGN}0LgtG7<>Kt#od#h8LfUN#z+^qgizN8
znxsdGgmi;aqn3fsoP}Ukri}v@y&c{Lfw7^Mj*s)*W8%NFKW|+QwUy<LtTa{x4LpC!
z%_a?uc<}0#7|Fl})q}c`*F8KJTvf{)gfYH_==9j{ZY21&nL8wQPP%?lwU7)zP-<MB
zfXnBQY}LB-acLdb3u`T!;_`_FibO?_(-ATsPV%<gS^Rv9ne6)YlSa}4fdg-FDjZh|
zeq4tIH{of+cO(>lE>%&@IL$wev?D=tJ<uc4k2&tp6BLJgAYx&H)ka*I{29FZpt>k7
z{)>?Ro0(&7Xequ2Md+V*fr9cLv?iG54|D+n*$!J9B14vwcQX^@c`0H8QjPvlg-`hk
zcWAMp44B#VyHb<=ynZs9c!Kv`59aA&nXaK{8~XG*(bn6vH>Q*d#3k&FDvxOf3*+;$
zY%RrhW9B{xc38H3YKILaU#E%~HA%opShBcCA$_*_RJVR!7q)hsJ;z>LK78Wl<|e7i
z;GG?x%^%<2b;30%ox3~~veLrdqTK4P^S$P9`r?@Hf|1cYbr)Q306(%U^QJZzp1#Jm
zT1#5u8lISZrRVd_=`D06=dQ$MO2yG>o}Qf2#B;H`ai{!Zd8PZ`MFRVl{k!N~-yv>Z
zToT1LSejazRC+$C&vns1;jH<_M;|LiA9%B;dx6-AYaCy}CsnqJ0u3fE48e*o$XM|v
z>NrDb1Ujhi#5)B>P@FPY((3X`qaN_jNCsx=1=Pz+zJJ+LFe^ydSGhVIRwVzuNOf*Z
zGro=Zx^C_Ehny3-^dn14UT?A17Brk6>9w9wFoIUOerl(+b5}&{vM95;U_gn+N8K}q
z+Mb|0Qjz00i)q8+d5M&ukCb+NzhVbxw=~=UG#HOD`VMHgWuz3FtXX<?zTKu;D@-q=
zlNHn6me8*7wQMVHJ}U3r8R=(+Ea1d8$+*d~eB8>y>8|yr#MQ1uPmdoLnWk+7;ig8v
z?4|x>)bZ9B!aATLr_;w;!^>3hHQX}wLEYsAh3rYkH0$mQ$);G<Fsc}u5t6dZGbQ-&
zQw}W+o^bwJ173)hJ<^=M=hm;(f=lWGz-?=LI4WX@vZHtv!eGr3r-6TtDRHSKC8tu%
zF7ASF8{&-m?e>rC^J5PvnQ$tS-3JW?W^jT5n~{Kp_>MF~DkoU4gW;saKGC3w4!<Mq
z+No^GYlz-RCu4Y^Ml(@>&OJi4jPIXhc0LIfznPkKy~c-z+_%6++@I@>eFST;ZgjoP
z{D`{=YQ`gQ{tQg+kUgj9^z&m#l?S-V_z5)UNv{VO(*CLvppRil#mExxF@nP<4Bf$$
zv)7<beFC)z=q#85_g5hV+oCbW@7}+D!&QUxABF?&2VDyTrt!(0)YVd#UDfPVKBW|O
z7gJ69$sIq)qHBjh-=E&r@2cp}Cr6sUJXNY0AxAw^R4c|b7xD^fOeLWu2AN`J!JrZv
zfesP~BYuoxSR}J&0$N9lWQHy11H4^zFe3!k$nT?dr5Bha4MT5*sz;}O6=lBLo_&AC
ziR-7vP~uA=YlT{Es9eHE(bs`sLc0kM=K>lhQyNpsZ$>nsZeiL~b&Fi1_HL37Rzd<d
zMjWX#e!Grysi|u9i&|JZC`w5f0J5e*@d~^mR}u_9P;9QZv5<m)(~|uGr}3-MPoLd<
zdG1(PlCU$VwrL{0B-J(fEX{1ggQ|X1(g4PE_pkxhGFB}BBQ&k%e72<=Lt`^p|68~v
z2Xf>$FywG{Vt$_Fc|W){=FTjPcVj}eD7|2h^0?4OQMzRGSn%Rv2Cmz0MgGB0T%^^Z
zsqK|oS>idtJYw7lZIq>IZRZ2rs#{_#q^Xk8scCJbSAqukq<}UF3y|ec_hVZbx_F7Z
zj3yjEhp9|{rzq-`i3s$wrzmr~FSxv4>o%fol3Zf7W}ru!1O6D0q5`rMLr$z?gj;t1
z@?_%>WKoF3y=zD3bFwp4UyH@~v{gQ61yECo8HkR<^f2QefxT>Jw3i(&j++0#YUD*d
zYOeMvRu!oi1ENyo(A|bt^XF>G>uAd1W91ujEJyk`j8}q&hxhZ|VUbecGm8-iefz}`
zC(bcz9VryGHN)H|2$ZF#XNav)#4%5SL;>%?Dbg2&H41<WKafzCagbs~1$Kt$_^+&|
z_OduYoB??&ZLCR6Jc|Jm@ip*6vi3Efu7`aRh+W>HzvSxft#F(<h;z8Ev}>JF&Fk2V
zu(!{TRSAE($~hX)RVH?r&OH&5f<tq>yc7ig70b=Kx@q^a!bEKkt^Md=ZDLf$t!l^V
z{66suHp#6ss(J4>KT|&>Jv8FQ85vW`V%#NrXjo_D--3VhiI4(+#brkpT4yvbZQ~zU
z<^xv5ZxoheZYC&w!B0A@>st2Y+vHc;=KRWXK->H+ZIc+)h7<rqF3(KX_S$)v<h9Ip
zsYaXugts|9!4}K)<w4x^2xC(pm6x5+l~k|uyYmHOna+WR%y;;357jU61CMkB(*XM{
z_lE}Os)elB?zTmr&<yf5Nkq~~v(yxUYcKcqBThw780A!q-({yoA7iQXXme|{pF<rW
zS{3jbijWri$<i&ygx`Qe8KCJ4kvU@I%sp@HVE4jGxe%Tw2B5_w`({l665=1IWHrmp
z>%{7NQ>F=@Q*d^C(ai#@`(p>o_t)RQ;L19^(ENFhcrb#(BT3=Tqagb3CfWSV|GLNx
zXcF2%CKmom!-F1Ida!QwJn?tEZqDP3GpiOkhlF$VtTP|EZ+FHdA}epSJ~%N#o=`MQ
zi}Fv&14-&wQ_=_B&8^rcPmUBD$0Pme3aj5|gxzT^PV5hnQqbn2Q~FWzqwF#dS`e~c
zs7({cHU%q?ZW<T7m9hCVt?ahBt;@MYXUB{q5=yO7I!~mjCCRcIKBWcrQ-~f`3|5nE
zyo*_C#A8Mcqn-0z!!OC3t@tGm+(9NF@VjtNCMn}(KA-9Z_^kC6o3EG4n4gi|T9hL4
z?WOo0Z0>VF*di9?(C&X`l|I{#_UyPoJM=KbheQmnlt!4H!m5XNscvWLFy8x}^WtW9
z*+b5^nCp==92CW;$&sO$iVi5P7;z)uq>7|~;3|QChFi6)?26o66O)pgty-OFKHUHm
zH}_+w3;Org*@e8}6#HM%D!@xsD9!2`@{|2-nK~NKzj9Zch9lS&2F02?r5Tb#fTKg)
z`fn16b>#>pVG2EPdVqMGqzI()E0gF-9V)#Nr2o@>UNx|o@o>+-g&vUFYmt5opq>3^
ztNSn7>h~IR*MD3ij6DQ;+cZ!n55#DWXcVXg1Dh0-4MLr<l$b~BA3MJly>~!@{1_~j
z%!ZlJN<zZYj8&5}sEo|T!*aNY%}jui!ueh3E(4b)XH^{{L2d4pBI3(ESHkhw4EOyK
z$wU@I7dx|#lF!eAmJ#sXnD6ZLb+pd&8rf;~{cfA#S}t0!r}byrdDAO-wB@xrO}hG!
zrb?7~Y{P(qB`ef&IA2czY55q$>D=uLk~T!y)@7~ld>n7hw}Y{yqaW$7{*=)b(RFqb
z8!5Irt})gh9pwh1*XI`mc24uROTQgj?B-jl9}|2d_Q1nC$&c30sypVRj~vy#{q~Sw
zOU=@KzeS^>2QF*rSog^?;G7ByUo9x5)RgU?=DhqGj(Gf94ShkO_SRe}vAK_LAcxTJ
zc^}ZHRehey_%VQS_A|Z6MHN5NDJk;g%r36FG-tWpON$D=@=r&d=hN!~9$aPIDJf@W
zfPS*Gbco~I+M$OLu%S}ri#noF82;2+=DC8*+x<^(F2!@6yuqQPwRndponJT~8J}Y;
z8D6}65rWS>hx7Rh1g3j5R@Ey5uN&1pJ$x^CaQ{OJ5<%9V63_BXxrjZz%7oeFgs!Hx
zsy@2Mj#(0&Q8D0{|Gf!vcn^#`<cpq<v-)ic5`hAJI}x)$mkB{eeRH~1tmJ_Pm=T&i
zML8i>%>s1CpvzpKifhlG$ENs2Re8e#E`Y91{1ww`1B<KeuiK@<_kwhp6=%GTZrfBY
zE`9r3YJ^e&{eUvW#C@`{BTY=qXt}Rb{)=jLV2D?ho@}z8c$bC-rjc*<V@?_rq(<cI
zL^PF`37!Y?>7hIKPBz5y^>m432=BTU7qjX6Nu{bUio1|5sEC8J7I!#d*itVhPmI_z
z6s|#{Q84S4<NO-Q0Siv`@~O6%n=R7F8V~4zYCPQ6Zt3VQb(Z3Oi(5{E?inQUCqZ6X
zUHEO>QbuB#LHYOT$$llPhV=9<0)<I&cM>9^a-2O|B;IOCRlk2(nDHFZ=x**)f55U^
zX1Bt3Xeo!V_4Ps@>>=y2^0b3QZ$+xMzHoyJ&2P*f^2Zyu{TX9An9Qt-kzk2?h86;!
z|GwJ8e_$z8kG|;bovB%-#_`9c`s8W{pW26*Md4tzS3>rQv`~(2ByTSTORz-=Wu<S=
zx$7)~<(h9#aFav*2d;rm_$_V@+~ON06802Z+(iiQM)siGi@x9XJn&!gD|)R3TS#i8
z`NPFc^Qc+o$YV<HS7KV5-ELmsy3f2<l^jn2W3~*C;YrG4C_T#?|5fwBrf=pzg|ysI
zu~aW*zDRCv$UG7?g{+%6CP^-Wo1V>HZge%0_6s-Xy~3SK!m5CkOe6ZmDJ2T`E(r5X
zHK!*wq_uCH7kP2Sg>6F{Rf~cSQENXmAN<-zuUr(TlF6>1Y3hQfG*1pY=ApW~==9Pt
zHz6j%XWb-0!d|p>DA>rD!(1ke^+|wTlU2i~+#faH%cHu><;c-+oKOT=y$YpHZaZ6+
znrzf>Q{7F&N5A5uaR$}0kmii6X_XR3)RK8O+ZSzuG71({5|%Yv^^AD#JIx8JTo{MF
z1)o^|&mzoV!SFSp0^}(%1=O%sZl!tqQ#;lp_MxhLA4|0+?+q<4SDt_RlMbgn(kf~0
z%O~vHc1GGMqC&}WHLO|$5^KmlKp(sfQ#6lYmmwu8>b%tiS<<Ls{Vr~=-Hr6yszH}=
zLF9|VS;~f=XFxczkyU^8&c@;c&?#xS+{NE}pyx}}ws@B;TF0&&_o*}lE7?QU-v#xj
zy}ih*3-=KFqW4L##`s35)z)eDd`$bsWah#=kHat;uk$#7TDNdCD2hBfA8*c6H=^m!
z36eR<PgRHT7ZiSY+bu_1>q{tI;DWd)tHLgM#gg{j#6=+`$!6^wGj6Z5j*Ag65@9!z
zG_@L-S?v&R*v0Coow(k&r8rnR>pI<C_t~JaxpHB6-8Cr91@TRoOn0Mcmveh|`tFC6
zHHF=jf)S6`b*xgO+gx8iZjndW;{C$Ao2Y;mvygZS`DlY$(0W-5dqs09tmiz%;j2jS
zvfldu@AGjGQHr#@<}A-M=TGMibCl#;<8!sXtqFLewfrlqzQ4-*djvoJyh!MnKtIls
z74lhJs_Ge(eua1a-H_5fj0y~#0H6YMDxRh$VF5)pyCjZ*W|(x!w!Ode_uX7qd`Ie_
zg1$M7CQqhc1668V$9pA`Ki5)`iuhn<y+?%f7XPKb94fVIlFCW&1Y^zW0UTz>G`xW8
z{4@4Y>IuYGAlp3oOLVRT*{jUM5dQy=X8#$jNF^@431ps9EO~|`d2sDr$vEIX0PPs_
z=NgcAt`wrH;KY@Sgz;zr*kV!{SLW|4G4SJzCONUHF%G$#A58z4*1P;L3v3xle8=~*
zhJbE1q~SO0R>QZlPezKIm+z?-s;!P+?II%GbEa1enmg`)@nbI|5y!fgz2Pcb;B%~Q
z|3lc(zlV-ZJ4n%^A*nITysb^`PiXPP#T`0IMW31?lN3%h#xc+{R{`IdA?X#y@4(?c
zZK>u?33EuFuA$0*V2+p<y-`)O=R@}9oIC2#!(7*EZ~UM*{ae~)Eav#5Pxnh652Qi;
z7!FXn3u9^N@Lu~U)e_CtwCG5NMne6Lt+#_l1EsSs1vVtjQ-W3MjqgCK1>D^)#(Z0$
z4^YLw*Z<feQkv%*-g#UGEnE<;9p~fM<v!oEwS(EU<|xMF7fdowH`uwU9DvfWzCbsJ
zGYR`OuY@M?k`c3*b}b1_(-?93Q3+n*ulQF`1UZFbmbb4QXiIn^me6bHD#A52*rJ3S
z;n@K@SI{|u?mwwgVA}NxGSsqs`;dU#naX1!S>@`o(7uJFD3cKON}M=|bY$7f%tQ|N
z7ouXM$sy5yonJW+$H*NX8H;4*JmGpE!1kjs*^lXNW3t~zHW|B@E!VAS{6A!S(F{E>
zWiE;^8i&=?2AV$kJjW|v8x#~F@|X__VlNLGX?7A-KRP{JM;ue5@Yb|dv#bdUd>n3C
zE=s0oN{J|w;;e9)3H2wo+2E2YD`&d(*63y+A)QBH*A~19ObC>;hGxI+``Iq?PMmN{
zCqqXc%;loR=>aKnM4Rixs}Ka?eWRJ<o|9xq3eMK}ighQ{P4)g+cC)(~!OMa3J?eWy
zjOUNQA?Y3wYT&d{*RuSL_CIPKlCxkvLv(`1;@&x#bv<b3lgEm;!FG-fC}ahm04C%@
z(l3EL&SL&z7%d!jfL2~Opxy(Iyc-P0{E;C!d3KD#h2Xz+m?!qylXWNymv13+5({4E
zuOG7^nqLD@(x803>L<<k72`w#Q>~YU4JcJ5)`l$YH_4SQJ1&%@>WE&3`qh5DA=OAR
zdg;y;Z5?-Rx&ea5d8$AC$c=8{KQ<DMOGFpu6m9G<5;&h9e<Or^+e5pK4Q3o6gM{n3
zr&ypo>wW`<B?ModEcw_q2W92mcIUpS*;i#<`j+p!eiMavA~>9|%KNA%K%%Gd&2Pf2
z9Syaq5dWQb+SOlh@S*KxW{f&;v;>XmX!iDTgIoi*xt5uz>4f;;Xb|{r@!brHaq>sM
zLi({A`v?n<kxaRvC7^}Oz*P}U4yr{EO6Nz}<jUgz{HA#}f^2mg>CUgFR4y!1aMWG-
z2iEnFWdE6psr>7K{4bn^TmNLzNB%DUsYK>=`0Nh$aYlOV&Qa;t!X;tjilKD$fZxb-
z$H6ES!CK$2W6B)5h99EY7ncb~$VVrqek`N!<}*oNd#ppY2p6OTcZ0)=u-|n&Pjp7P
zjXawzh)MO1Nj!@v=~#k49CIAIbLY?}F7S~f-ucBS&D^xp%eWK*gWXF+BTCxUJ#Vz>
zT;$L#hTnt4N}_nkz%t}K><?ZtnoDs{vC45GsnIJrYwaj&QMIPrv><t!ERb#;wlEh5
z*V%Rg699R*iX7Il`62F)P6|4I+PT?)(bd}bE(?#6kc>T+6i>LOBaXj$99&!|c?=X8
zT80-~8t*~&Q!C11ci%qggUxXT?$z*Hq>!^ZGT2w-ADpu@_&|2)5m|d`7S=B;h~6H)
zzhgsw*a13TK@|<c3EHU;^a1Rm0}CyhW~y21Ix#JHr}#-nbb}LkD)3jrmM45UhfJ;=
zGn*G6_1`p8W@%&Y#y<m>`xDjEX)gd2i2`k_m?gJ7!Cd}rVGAML<=exk6LiX9zGBB4
z&nehT*c>nPg)9E1eeaDu#TLuMBq0Nv@pZt<nW{_m80=IA<L<Rdlen;rhr2-s<4+=5
zAC(WzYWyk|doq(>n}bN~_p3UT^x+GUE}T;FQSnWaAF`jeq?Yq(AC>fBvk428;-f*+
zjD>y@zu74y=B!k9EF6l5y@>EuB@1>7c#@aap-bB^S}|OWPMJ^(HYdB0@^kiw+m^;N
zo6Z^jAbD4!UFOYuxeXtd5%yr!q>A<NCFT3kJl361lYUwn3a?E<{auCt@e1Pgj9hzR
zl~k_HImR;?PJ!K09*&NY=_;ys7gPZkkUSUf-qb&#wMwlA)s(rpsrTG(3K3Yunv2F~
zJTiK9WsA^pDBk==9=)ThG`}GYe3W|~ml7BWGv3>y*+q{p9HS990IypK{#tw#TWtUV
zx1@bUS>p{%l=r}%Az%lg3`tD#P+;I+fC^$u7=;ilg1OQXuke)(<A4C-2y75smTUis
z6aMv0u40J)&K!Qa@<99;FuEhKOfh1j$dz|8cXb~IlpQhFDu(ZZoFB+6UJ+HrK@fXT
ztNJLspSj-`gi3RRAm8qed+Ys@8ettdfqvT23TlDe43Iv$w381)-571K&*hDLH9teR
z79^^ZBe?1!Lxrce&g}JAH^P>Bv{A3%vg@PIeJPr_u(41OK@q~_SFW)08ZcP_hW8TR
zWR5uK_~zrA;T}7AfcS9ptwVrY#W4hBHZyu6<4*oI_F@?s5=iXexScXH?!6fs(O!_*
z>t;V0subs_FhQuN9W6~Yq}6ZWa)wkZ4x(`~d@02z7$!!nR_KfkhD2>dzF?9}SU2SG
z;M+*rwAm>smfluz&X8-F*0nBMfup}Rcv|E}-dC~vs_?!OmlLYn8h#%^?@jy7i#niN
z!bVfU&uT3rO5sad-(1d5Rpqjwo!x?mv`Ri90PgEN%2pM-kA59?Vg#hi*zH<F_mwFz
zgN)ViJ;bR5Z2Vk}WWXrGIPdE(CVDP80oGq{m9)p$BY87vYjD1v3#VsuJmh;XmGAVT
zopZkr-t&4>Tf75r<+xW?!~Sg5`GO)yR7$4Gt~u|w$)JM7htLlms>fU`a3?<6M~{qX
zji}Pgn4h0;aq#cQ1DQEf;9A|Ig&75KdiAVK(Z_zM71Ays#s5MrUM&Tql?Ai(qdr1V
zxMnF;3kSE&aadK(<Gtm_q087=i1FNp3+$W|QK0Vx-$(;#B+P8djZ)(#JutRJsB#{M
z2Rz4f(nNIK^m(4+RR6b96p3^XeT+@u)1XMCJ9GE*y<PirDj5wpy*-15>+hwE4C&7p
zkBjzO7k#L#L7IX4Dl2Uu>!Y3Qp4s9-2X2SN2b*NW#39HWtATcBB+OOtDL7V9CFrsj
zXdAI@c?CBSoum5bBg8sg=*&**K!zx;B5{gg4{PVi6hm?alwGi-t>KV!-W{y(5z8}#
zAJ`_s#}2HK0X*}{V6&jP2Cy9u_7mYxtDz#`saK04nGeO=3x*(WhG_Assr3^p)p>N?
z2!elgYbbAEw+T864C=I8xx!u++N(%pcJ4OGE1EyVtt2$^QXKEO=;sS_f=wsL*LZQx
z?BHz8hYafS5|GnQv}nWmYFU8r8m)!alTs!zV}eQo_BoV~z$JbIW$v(l=f~)VYT*OS
zp5dXiH=ZNbeQSHvwg|#~65RHbBD<P*Cql3R)ow->M1krD^hHU1PtE-D_iW4UVKaiN
zHJnIm1iC8QPInK%`b+%?iCqO%(wH~BRJM9%>>ntTxM`LPv&2~$=|lDJ2Oazzksg~^
z&+zeoumVRzT{wH~I7l2doh3ekhaXR^ieJRm@A*7r)I`4_U(2CYerzou951n;l-%~t
zw=e3WFIqi=`hY8b+WLscjJ-l_5}_MInLVQ&pPOKzpTpOv+n%mmUU6q1w=$dxhr;``
z!_`kFsQg)L!15>dl{I|Ru_*)p=~V>nqk0!4gW4qXIapwjnLZ@jJL!mSc#UJ{B-HLy
zBROM<bKIuO|B=1DM91>$sfra?dz+!HlNK|5-7W6(W&2uCfopPDuk#jh<}k%UsV(DW
zk)zdiqK7GOzB-z=eDwWc>`mgv#O5VPcP1*(1>z{mxZJH7l*L8eW^Vd)uHA@|8V}1I
zcBYgbwzHy2NAz1yZykysIa3<B@|p?Kq6%{aJ2%i@(n6WV?!BDl6^w+~tuy7SJ+l4f
zSRx6VQ{4zcNWTfN{PD3*^zOIE=M4|0(#%_{bzi(8GFY=UPR!hsKAoLNBey76LwS7p
zPU0VCX-Y!V@v7VEVuWLAj;1H#J>pA&bvnPw5BIwow5TP^pnQ?#aZz)V%x~9;O7wRF
z)5`<sx%QYTB8ozihrCwNHQ_rJX_3>G=q}RZrB#U1T-h;-Tcguw2omn_<Q-vF-gg2V
zN2-1B77Bvo5(k=ONVAQC{YwDJJ$rn1>GWruqd#+afBI%=&!rS^`|%t5TIQ8^*?e0$
zre1;gBHF8IvNu!}YrD&6d0aRqeo7OMCgrM2$1`2e8mcmIYK#mC=WT+(%;2}M?#p3q
z${Ja4yok5m+T;&9$hAZ?$4Y#A_YW-DPcAhdqKMw{LUfiUmQ`zdz8KBi=Xz`k`Gg1F
zWV*`4dq~OQ(rAA&$F60CQpx!b?gABur#Tt7q%PA{jBgfvJcN>*8P@XU_hfK(FDOff
z>SKo=_y62#(<{6eXE}q;<wY{>*5uBZSEoi*yy)ATZD=Wz*T4@*y`d|rEns4^d9pE~
z&u$k<ljv$GyOMMCc<nL+z^hL36ECl^;NknhLzsLKLvk=CHOvm|zZ=niZvmwi8yCd*
zfwKBHG7M6N3L>8r0ULb>j48>h2*Op25EB&m>(BvShl>Hmf5j6pBo*+}r>0_<TtE0R
zkSD-p0ihy5S20R2256rEgAdR_z(#={jIV%+B;jJQSe|LNR8Y~4Ef)GRL*^2+5IL_#
zP;P{F8uwnY{5ojD=M3#^A|f^@62#U4O96EW#THm_Eq%rs5(#adoE%fN0FBqRxz13I
zXVZS+!)_@uB==cGVTrF?vA=}5)lU+MigV;9KSRNNMO!E1L59p6z>Jeq-vd0ysx$c;
z5S7P%^;Eg!9@b-;KgpGZUp?qA1?j~~5ObZ-AyP<n#+gS(L&aEWn(Rmv6MF%i^W7SC
z^g+Qlxw@=#dG<?!s%KA8M?h<CncmWBBUY=q$si^MVOLDemg>_iOiPZ;{l$<R1)`p%
z3Vzo~Mx2#24r$3g?p#(ttLe`)hY!#Q_$oujW8Rt+I9HmqnGGjb&-@Mn+~spOP7!n#
zvIY$>&=&3_A30DOC12}da=jB9Bb=sG2e0r*1A;=a5XQ^J%F?fNKI>aK=6W<#9q^!u
zr#f)5fWzF%r3oTHs5gCp%v4*qT|6LWP+A51yvEuE?PyZG`hVsgod&o<{6GeXUZl*g
z57(bOZDv-ZUSiX2JONT`mbPkVSQ-8P{ic$t4iGVv6Qch&LYnt6527i-p%f3-(Dj69
z&oYIX{mSpCwu^#a+e|({%Y8y1gRV0KZW)1YHrX2T6Bp~nNz^~EM7UCf2?>!Vt_8mi
zTp5y!pc?p7`@YBkRp=fM+SB}DdF}rMxrb|XP}Eq#nc+FdIIxXpkcEf+55a>DyPv>N
z56i*`A7qS`Awd&PEqgi&J%*17>TZRh7T)kktn=!g!VwF)q1<H;s+sk{=60Kl*fr+l
z+SNHwA_^ro&EpHCD@03hk<hIga9tD%;3lW~%t-}x^PUJX%iU&Jp!PiUXh4}&Hr2h&
z9{1+TlACLn`k=Y2J64)hp?v-%2o&pv2TJGC->Z$V92MTW^>M$hQFgV_Y-h9t#Ox>y
zo=+`ld4_1BBN8K;<+w%RxDCa(i1I(bH9T?*`rOf5bhNkWXy3WwG-fwe>aqM<WuGKA
z3|c^QsVSfvl%$<aTIO6EwhUxwx4P&$Nm7FkLZQK_RVp`&VWg%4Uo3)JM{H|DeYlq`
zs8{jX<^yQcYA22~TG>vG*FC)IL@jHq>`PPjc&vXJPt)40SSk^1-1jF0lDRtBN4@aw
z{)gfpQv&9_Z`)ma_^?So{5ZJa@Hl(ks5<r|iIH93B0_8E<kV|;_D$$qvB&1z(`&3r
z=RqSQ!J0xBCAAg}$0PRi8>(>9ymzWKdK`D7brL4`R18NAf+HrbtG5rhv?)om&LgOK
zD`+p%j?fj)#sBczVWZ2fcKmk$wa;-peFPESIdHr+;4a3qZ8rGr%g<**GX6xzCs~T-
z_Fp?pq^0HVgd*<!IZmB6k68CfPI+Ot2Ze6E8jI{Fdmxbc*0_uJdCSIBPT6({W%<@J
zgAkt531@%F%wwq!%7HRPja27ZhE-xJD$~pb$TCCFe=I4vF<a=etQ6ECYA%o>?V-&^
zaV|86qzK4>vaShHmZrmGLcYfV(#?Yy#Ok~1<%jq-Wi2(<2itrrTZ2&Z3y`HZ`iu=u
zdvtkld$m1EWJAG7Pw8+z>s<xMj@ju9P-&}g3vti&-^r=h-77?kmYHb6Wo(<C%JJL(
zR+CL%XBYKNTtmQMM`&3~GkcY}+#@r!Jim`QlF{X{TI1I_K>~Z^glk}OO4O|K8<x<-
z2{gbYfd5*hZ0B6fH?+fp=`QT^j-E+h>1O93)1(D&`;(cE4u(wCD&hGql*&D~R26e*
zHKf-<Ca*OsZ>V^A^Db8;Z7DlgI>82i&Sz@j0`EYghi3uJOA^E!R?HtBt}<D&YOru)
zX+8mONo%ZONr?Hi+WqbdHK~7KJs<p}EWDP4l67hLhGv+Z$15BD2bK+<Y*7Ub@O%c;
z5@xhy?JqNI=e|#PkffT5Lm@N9{JU^b81xKJZBh3te`NLcce)9VW`<_Mma0>(PJ!A$
z9SLK*(dZ!s)#bVPJBnkdH_3hkQm>UgMP?*<+)ha-pQcB1*@}N%vZdVG8F3dAHx(s$
zlJ(@m&to}kFCY)~8ycMiPiA7=Bd4bib|o4Zu_yKfDD)nrS3tfB-1yhf3lK#?BK~i%
zB=re#DL&)X(2FF7!(D;b6=wu^7LG}b<6p<nx+`voK_&QgkSO_AWDfHUY-t8!d@P_Y
z{WFqZ>X;lE{7>H!K;2dT1lX0@YM*PL&ry%I^rf2qY31BOEluK$H&iSrF*3AoXTDaU
zNuit^N50(8Ec@i_hlb9vJsTvo$IC$r;g!Q&_u_vAYE;Ln89r6OQXkM$zJtXWu`rgs
zDZPCmO{_1D&j6yJ<_|uAN`FuBDjA9i_09P)k>_Mu<QY~~+EB1F8tYHsyM3!M`&B^f
z?8!=K%EH&8B^B<;F<S>K+yjkm!My|*E8|d?xY}ZNW1~%}JSfptiL;k#=<eHG(G?%)
zF6-GTSD4NinQw7mP01R2bfUEow<c%{%7$z}s%-#UoFS90TJlUcrY?&|ul?nZ;^zt)
z4Q5duJM+F~6$C?4pFC7gQ&VGd_mBLl^g+Im1Dl!2_=wJECxKbo>F~GXpT^wmZ}F9q
zdmsVABsY-k7u!9$XPs0AtK;<Z3XBmlp;J_lgBiH;cp;&t)@jq54@3%_80H>VO%T3y
zwdr5d*5+myA`N9|Cn9DF5@8%IR)s!qTQvTb$5i6hQ02&nphR>&8%NjsqCcIi5&&fL
z4MZ#xf#p@Yq5yMT506Gr=6s2!Er{KQaqv<y!G7W&BYY8uxB#gNya1od!yMJw(r|ul
z2E1HN0Jc=K1ri<+fzx#Vzfi!1zZ5WmRg74be(R~G&OIP*W_O@gF=>(aW8+_-%VtIY
zz;bCge(-u`xdV_buubbu1D)#*v4Un|B$dYE{C_0U2dMWbF$?DkwD|YEY{Yt5uHog<
z)*C12>t;j^pmKK*G!`>Q#wLhK>ou)|E$ur?{O&1^=N(%b&8>o8JZ;8FHb=c2i-x`9
z^zc0Pjtq&#Lkg3^;P=$AeWDVr=25Oy1l7q4SRDn{=sIrA&YuGMsO7|@+!4iR=`U0u
zv?R6$UzwJJzX~J(@Czs)5|(l3+HKF0;b`a;`0c15>n9Oj7|1%CdH#bJh=C3x^3Cqq
zec-R9slb*qwEg9VA1FWkM2|t;Z5a_a{JMkm<?94HL|Lb9OPzS=%na->GE{tL9O);g
zIv8)NX?dSmOYH7-BID7SLqu}~i}x6uuBjh%0PPtjmMP)4n$J_RnUSfN38T29Z7mBF
zE;d2cer(BMsyh40(`UkeBxUO&Uwg4MqN#&(jwv^x0z3X$Z0}Jd;l{@~_uxG=0{JR$
z+`m)sfcIxS?NOmdKx9`K5|#j4lAE0kd4$$=)dp{Wr-kcB1tXa(@uorLlZ+Yd;<oQx
z3J>`UK*yc?_0&R#=LMn?_AIT!huQeo@S>ItSpwSMG{f>)Zq1j_v-B&~Q!-EN*CC1j
zV{9n*Ud`D^7*}0x>+@GDAdc4P5x>bClTW&1Q)CyM(+GfnB+-%exbdaOCfE{pelbEn
ze8iIBR#)@%PKSJm>brIkw#PRR(*CL3+fIcspBI#o4c`D{>d$buP`s0Py!j~WBH@Ik
z>`Mg=g(XZ$MnizsQGkI(JIZ?N_-Uxd3sRhZLoo`%q`cd*PnTQz91Bh*l;GUu?3#oT
zwsRSIX4C3j!ne-VM#lD&B1?FgmvXC2*Zm^@Y><6j@F#r7Y}Fxd+%iL%a#^>zl9sFb
z+d}upWk;TggbIHE^PAs(t4<+8rR<HL^+i&q3M5pha}@sMGsYkHD2%3J`4a`ZshDhz
zIP`E-$2{2Rp68@tL~m?>Rl=Eq6#?bd5!Rw`53|?a%kQ%J!&F`ryctY*$Sc45QmO;C
zEVN0@r_<IK$KoE{_AVt6bSW&o%MZC%-MWV6h-QQ6r@;=-UYqK@*4qS(kDp8T^T7Df
zd%yV;Tdvi%s2$Ly<;fYuy6~;59|h?RN(`0Spe=9uH-sNUh>$Q%2Xjl>w}|5b{~EW?
z)0-{@FY8D4xEOV0V$}Ee^eRK=mFBXs@Z>VGPLeZXy9Wnyv}ZTzuzuSo4VYy8jnm|N
zi43rCnHad7T>lmhnPr`$S`(^|=#OQVw)Ho3VNT&6h+F8nWm~^|T7ED!+jU2cXy#c0
zO%N}a`p}^K?3_=CEHjS{umHvILtokpQY9U8Zqp>%Z(EBFpt&e%1^ilKH13k#Gc9}8
zEi%>k@`7q!TCfn=YKQIui<8EaXFdPS_*Gj{x2W>_M6irZ<=Rx|JNmzeo|b40rsiZY
zw9P40#hcm1S>Cd3sQq}5t5j>s)Scamr?pVmZpP1$$*p+{698|<P&N#NU}BRPhV})+
z@~|*FwJ}~Iz&H%5h+PAEBSty}Ux;{L5jhN$63a6HYKY17+{1t*V2a>pr5Qn3@_%wY
zdB&Un1j?(Ztc=KaSEG2l95c3wDY}g`3&K~MutJLQ29pbwa<5d;40uq)4ef)TqD|O1
z64x#Pd%xokRs5f=%majNttVfA0PA=a63=War?YL5Z~nQXMBV4+OWva%NAQqpM01!-
z9+nZ%N8f?J1Aseb<i$m|mGA+oetm;G2pxdqasK&oSHK<b=t2#)6!ZY`9()uH%0KFA
zG2*{k<=mau0g_jq&a1IH3X<FCLtW~QUpA_!5f8*NcwGwK9)Q0dOvHFPW(j+7mWCp-
z5kFIJs~Y#(A1)I{xZ{e7k%VluGck37_Z6SsXH&8g`tpLTj`-l0uo58c8p_vRb@FnK
z<l2q2w7cd#c0`@MLCPxT31~l38rey!@w;L2{&l<f?|TA-N*dupuf06wh)l~cmSf<j
z{ES9bsOfk>&z-bV!xHr1Z;u#cPGo`XK1tAIDP5J`(M+di#(p5)R$^bA%H*<fbda8B
zd_`oU2N*r<%l2c)3+lV8-vK?mSq4hmPk?MfE-srMWt&udK(`btK)Dm5u(x{pl}>Wg
z-S-Fp5`n7?d^)m(zx)@W14kNzl|bP1zuR^IM)APh6+Cm-SxXGPh*Dd1B>68Lv|yCL
z4lP0!g>nV^y^_cV6Y+e}oI+}=&UM5J>WR7Dmd>JR@f^tM5Ab`qzW;B4yloc-L2s!c
zUm|0+z~|G-L*2#tJ9OE!{vreY9S(%fhlqbMzVDK#+j!_57?K?sl5rzD%j8`wAsbG_
zS{m$8KUo!)fdTe_>I*_a`_+unQ3V^~h8Mhd_#gp}N(GEHvVLW^(-#^P-4#~xf7(8y
zUZozN%M_Om7PF@L_Uz<3q?Ig3I5r^CcLh4Tqsdz{OXA)3I`)s9>Jc+Djn|!|OEQc7
z9wu+`a|y`~EJe~ex~a`qSqcI0*vL>Ja{9eDKFoSIXsg0o1)hN^M&e29)OV_a;u%>u
zxb^9If>LbfzDsi{n(FUvNO92d-?5QxmVyfqIk@$!s#TOku0>!g)l}esH%yJp+>Mr~
zeTU<2O_BeltBS_na@2}$1Rjt^+r&s}x^I8T<gcN?mQPJd<<hsY9Rqrn<mr**ayfoN
zwwXlv7p5*oXB@ji|4^Z9c0twogWZ~C$l+)Q43k*+avoMAaK9sm1F~w$=QLs_R5zj(
z<JVR`NGv)V6$w>R+1XyM#I2O<P_yzvnw@;%?oMlMTiM0y#zL3EGBZ&#w^!MhKq)Rz
z>v|ZT`b&BFhd0-e!RtTF@<r1=;f!4_0w_E)8y`xM(vbVbCx%=!aMKW#U3qGU<^<S?
zW1ghm`5XCm61;cNc+;CwNKMkd(x-Vsmoa~;-%I#Jty)Wu`rY`5OL`+$%q+|EA6V=t
zrgnZuuG;s>xq)OS8A6(rmS*3&$bZb0>Swddc!8I*K%)0P?*q$CcwnA{ivEsj%8phE
z|3>6e4*Q?%!QtMa6bli9u*;n3O*b{pz;zRor&tDY*jutZlLD3_e7kGAK)z#<Q7;=_
zn$48Et<QY@<Jvwt!|ylOJSCt!o}Dfq0`c43FoZ`{?zW?SyCss|Dfg@dHsti!=u%|}
z9FOsY31T+@PIZ@cYL5*pT@hWR*iZQac{RUjo)EEIX*pcKC$`O4cGvMtmd|aI+Hj_(
z$O+myqBx{#2xf+8!GJN@zY?3_Lzt9E@BpABU=agz?tb}?<hhBN`jlrb-4iWcC1y*R
zYg^}PtS^)MpS8B7+<9HJ%h8laFV#-;!!3Ha;PFTVXZ+$zuyCN5|CV4QQknxjfI*M+
z(l-R%POO<bC+TD=MylPRgk=J!BzeF|RJHTIo@iF6$l=AaJMjl-YYI~_j1J_ly+u)T
zU>TXK<0Gz4kn1#k2zq&-<6%lH2$N#&xguA8jki+#E9(q1P$crtbPBcz208v^n*CJ^
zF)`08r1|%ke}@mRVa|@kj4><T1FQ;2g}{Si0OQ(cP7BsM<V87i5<g@dQA34`5|n7K
za}<G{2l;^U!QBGNI1TlVUe3fBxwWkcwVJ7^CVf+qw9@yy@8vU73iF>EdWdyVPOkrE
zn>qXwI{9D?M3iF>2|oZNi}t*N!OuX91UFtOa|OWX-we~$S3;TYFs(&dbu%5kOpbhi
z?Q^J9<F#7-b{$$vgwo_~NMWONE40?F=;F^Gq<IRV*l2t;MP;q@&)X+%q}7orHrbmG
zbY{6X3@s8x1hBW6@~%bJm4>QH{OT&-Z4Osfd>e8XCLAvIA=D<0=V$Wz$IuF{QaT`i
zUcW6xe*vTe`yoFtD+;|#{}j011*XucCxIaK>G{OQscS@|XCGdq+=2woOoC_4&V$Ct
zu^Qu%XszDyZitOXeM5JF^HY+KtXADg92}8PY(4bHs+lU=tUd}`$1l>VI=kv@%I5Jn
z9<4vi&h}Qp7HP!#fa`+yt+Ze}-qu;g=62#sR@sb--?mWvKlm%P4r%Tc5|2Xi4a)=q
z@sx!SF9?5|cA3~3@XqHfju@aO*HNwr9pmUhF_M@I()A_NG|2(OS<lQ9y1MH2QHxxb
z9i`nivW#(@JQpV~3y<kV8C!8hEF<fdj7>4uHmyfWi)SfBuE9yw%ngYrXWqmLa0rv#
z|AD0f`GbC>CktY09kEWRqdQg{b6U%T-at8FRLI2F{}+^w{Qir{DLV<i0Eu!NkDMa`
zd~gbGCypX0S{jIB9JS5=txTHqdx0*1j4J0y&{O7}iyUE^sv*+{aRQU!$13flMn5}>
zF0=(j14Bnr{x@J5N@44$g}~?jC(Dz~?FfjCyq}{B7JAaTu0Y_uU@IR1C3J{(mhrK=
zQWVrzZ`b_GXsr|?=Y}|<1P(bj^4%k}n?G00SUVFeE~lTH0;$cJf<+ho$^(||;Ob8A
z;2TQ8AN&Y6nOWcIXf2^a#zDs-Q_Ik*Plej#cY~NpC(`mZS%m7^7OuH>E8k(<78qq@
zDeCqR&x@5NNIrLDYI5Sr(Ua<M;3_lDk$6E8ICjhxeUR(5N}?*`D5n;3F;==IeJ!5J
zL9MQ8%!{Cr;lsqHfL|WVclzGPGeU&$HNDzUy6a&fgT4ydxIXD6bTo#~1%fu2^GTk{
zuh?(t)oogB6}FM`3Yp2qkhmuYI`mWhVyY22a4X2nQw(?HH(6pFJ2gyUs7p2cZb4or
zK$gZEA9o8|C>*<ELG!cd9U@s1bz45-8GR^q@}W;nO!<Z5hv7KF-MeMPgU_VOQfE?9
z&ByX*Qg^SlHoe-CD=+rJt{Rb{&#{Mi^T=$sef)*W(K$}+%)zZa<!xtKz~h6g(Ts&Z
zENY|Q4KGRHA?nJJhYLot92PXd8;BY2H4|p-nk|ub^v1{}xUKu`PbL&6p54sx`zeBt
zMdj(oEHkqfD+#JZ7KH;&nG|sW(K(FDH%($HGP`TnrmL(d&(eXS^6}K1PyTt=<0d}+
zLA6i>e!EYv-+36DAA1)Ip!L}$WvmY;O+%u$J!_7S$TJpzn!vQ2(?gYEMaD%xu=(Oe
z=*_nkVJx-O<u1^mW0H<7VF7jG>5Z(FKyY4fV$u$BD|m$K$Bv>tO=vyg0s9)&T%xyv
z^6lXQTXRo`s7WEXJ+VUw*XYXVvHwx$gnlSTC>WxClSs#X5G2izOKv$EPbGRvllajR
zItLk1(&1J}xVbGMZJMTL&_{@uxoy&51D_^H&H4~(e@;Gd3|)9@XuzxICEfDY5+D-J
zy+P@J4iVf4{R>H$MMB9}P7zyb28{&@4<}0q7s?2kJ)a&qhWNTZe?(SvpNAd4KI1}R
z_4?w|pg%#nAdngpU)&ldn~d@tpAqd9qA}>C@EW1=i4nso3<uof>WFCYLI-1jBK;bW
z?uM>-$u$fLJOwrsW>y`uw&F9u9w5X0-C7N-o4-+vf5XWCJE}-t*;69Gg@P9k@0LBT
z{UJ%FwioEN>85o3hohM5(9p5Wj>dr{(czI7*lYldL;TI>g4FuyEr05a>@91<XTLy{
z=8-3v4p1^6=~+G_d86=|`2`kayWkA1lJN}QxvB2lWT)zQxamsoeasBGyYbx;w^eDT
z_o(+-NTl#5SHh#Q3iGwc`5Bd!9K9U1scUXLTsiuSvu?0PFQvFl^kY~wl&+7tJI^yb
zbvf-cKKzL3gH~<1<Y_E(cdiHHe1~^kk*5u6eWD$anIGA)DCh0)nJ;0m=KNa~f~)^9
zUrNuc<LBfZ%Uh@%*LZIhh2qiUoi~I<^O}9`_eCU;{G(G%=@tA+ifS0({-kha%qghr
zFdf|Spc;a|6V;ZA_)O?{BHV%$GHrh$D@MfEPGlR|xr%;z_M^*xz1;e;<8hUt(4%4x
zAyj?YYWRj>=%R6~8Y_*zMogd-eOCH-jd*C<UFDDM&uVjId%f6RMe>5OlI$#pm-ooB
zyI@IWqg$K6MB%&E(4FPwlhh3vF{v>a$#4e25o?`Rph47bf;%Dn7nqZlARdY3+tgbU
zQuQAv#xSi@Sw+8tsBbqGw&wDpG@dvrg?Opi_wgx)lT}3lea$!%)04PXcp{cn0LO9p
z2i7sQHi6yTEg(Xvj-%Fq<Q8DhRXl;LcnMaD<e=%#y}1Sr15zCB_~RD}HDxHgU6Skg
zZVtCIg_pJcFgD}qggFR$ovV-?L%))##T!3NBSY?^cVVYeztMQ-;|Z!P8i^T(&i#1{
z`U-m`C%U8kqGvApD-$#GY<v-|=80lk7l}hP(m#KK<uAr2<&l*wH2R3kj<Aa`HFR03
zO33*i!><?ZOb+}!8OejVBqVvw+EX1ikeLuC)`8<Jvp_zvw$i@;Vr=gJrC%QLy>qVi
zFUZVYcAvj1^_(T~B!?QPn1spyzo?iB7&aY<MKj>>g*&y}#d241b@rESy3Lc0$E15F
zsm&R4=Rrvuvc@dqN$a=|wM8BD`suXeqkE_+N~-!`OJgZU&u!&oiNm!_)upB3()c)1
zpsZkn<rpT9iGx$)#R)UBdntmsSLg#5^J7I{naL8CjM04g{1geScyjI6<lYdr>zDiH
z;i0pd5$Ce63%E)Q?n6WJvz=okB(l7<Soo*%9?x*%yXX*Z$l@#i_E#nGsaCp04--WZ
z*x%C@wQpd)1DdLn{0V6iu5aDhi)_`fxvxIg!$R5I#bgL-O<v*9j|^>7XHXBNz9!Jg
z5qDC^lP)iuiMCHm)d?>hv;*B&9)${S@~7Jr*kQ6&HKoJD4!=GpQi#`vq1`v*Le-3k
z>(;u<3=Uo&hLq~L%c|9m*`sLXNMXFkf{dp^4e@ql1>fnbX9*fQeFHLGQL^vYTz=U1
zCW=wwei&=ZOLmlR)SSyS+f1OX8>Psu=p@AYkg^X#`{KXKPv7rsn!UwhV`TPJ3Qx#L
z3iT^h@dSN+>U$s#fPr1$cElCm<1U=3_xT|u0$)y0N1Pbb|I_LhB!eTO$-mv$`{Szs
z6DLdNkW%C{c(Ec7HR5<NV($}=SvEvUHa|eKe<(`-C)M_GdECRUw{H4zD08eKmEo-I
zm0knX+bzXEg)22Wu`k_*O{|u=WtgVdmhT5^9%mmbD9+CIKFiIeC06!iOL<9|GF+A9
zR79%Sfq#p>Fk?p&eLgcki+3JNrh}g}RX+<G8L_{SYuDM|^!x57d*W`mG@dzjew1WX
z^H!QP*UfYu0T0VbFkV&_m>6Iu9-1EyGui`>4@AYHl~wb>iI1xf1QSGT?k*Mb;TG-r
z1^O`&gcko7fPjE8h${RWKLFFXjbR{wRA81Q;WPZ5M7tVJ8v@~Z%<S=BsS6{DU4<O}
z^Cf1n0C0R5ae1%FVRZ@NVv*3W_1G}A-La$z03-Hv)k2V_sETRB+TL8eIHIG91>mjc
zI9e*b-Y=E4HoV_!=g%e@3cHj=L8Z&?7KkR38e5qKMLeET^CUN^98Dt<zwuUjW(k$P
zbEeWWPhwgvcw<<?lkc(fObU_L$>#i8>`IyLJ>AXiH-|gEg0JIPf$DOQTm5mvl&JQN
zX+E53&Rr(zB7QZ4=ZBMkq}$!k9$sb2#PJ*EJXzh-R@)fu?Tt4k!zlXsiRWDc^NF(z
zt>Jx^6UIM*Uw7&dbiMjRBi&4JPGw_;nzo6(=N=4Z?C*3Yn?4B1M^9e_4OPoPzQJkx
za2qSjtX76?(dJ<nYC%JOYYF$mtJODr^mHh#H{Ef;+UwY_5dHd!=)?sz@`e{>uJs@A
zV#kUOxXUtrYnrLyrzDqH>vk10C#Vyy7#nb?{8>7sT61#3^-ir&dvTvMyrgKGx#gp1
zzHGtfkd915&~6*#^g-dpDVM(bfk#fhdWW&&!Pkfip2!-Rgz2gsb(Qi*1lx5RR<=tv
z2~&eU%|k=-9cE$c9NNB#=HbSc!#pc*Q?ge5T2GR5L&1gn*_)qt&h#N~NIYh1N~pWH
z@X&1j-jj0Oy61jg2fPKkL!1Oqv7m=VMvB6wiBZ-a6$47rYY{Q4rTau`YGIRzm`;;~
zYmwR|o4N1hlCMMAFB0b0(%=U^0oI0w);7l1#O~uf$R^Zz1r0>-?=mIiyswUovNM`M
zE#6E0W0iz<&f~Kv6@Jav_bi=>%Uos_W>{87NSquom=Y4wq^c;2GvO!Qi6X?<d5<^$
z3$yy2>Cs}Ex~D(@f6X;8)}wzo(}OxJI7?gwh{xgYw>c%yqhXo$I8d3PWnw(Sl>d3d
zepFk=+n0JjSa);!5L8h9lk6nUOf?<;<WDpvg6XHr6lhVBmuf;56)&A7ReX<Fgj^qO
zF}Fs|Pog2UaTI*A-_S=Npa}^4(R}hnmOs=bg^I%OjchJh(Y@yi^agqn3+STn-ojBe
z$MARwU!VnQ4>xShLWA?j`an(}`Muf+<(6?sk|Jwix7ZK_RXdOC_+P%;0*q_cc@6#Q
zVZ+HW^cXMyVaSOF^fJ|5cU3iVP&51-mSL9O+4-U6Mj2zi-_o6zOj=fMr3d!|Lq{J+
z{2%r4H*J~W3LjPcR^`6fNqOSJR#pD0daxE%9ju!dCyO&V_k_1(eCGp;sG7rhe4U>2
z5B1{G;TPL;+T$Fr4{}Yr$UkExzUqBvR?k{hLqPe7yO8Qm-s$wl1`-|dt2CM>U*<vR
zP8VIN;GMg&w6uyPWz~ou==#?dw|nB;oYG4Uyvfz3>z<x)`o#CARoH+8)zefq&Tx4X
zus5dE=kw>(q#-ga%)Nitz_g}5A@Y35XiC7w++{fnrIsR?8SCQ{1e?@i*Ynw0IO&F~
zS!7bUbGc4F+_!SS3_8f0NDZ_nB=@08u0`!kx`-yODNUJ$O-bG~y6yxStI5)5N$q2r
zxY>0y=xFRg8rTq>5$LK)>r;1q^Li^a!r2};OR6E&rPGx&Z}4<za4yE}wG0X#>Yc<M
z*L4pz#6AzjeW~%@6Z+ESy6LV9R{&y>lqEc`{&BUn^--ACXz$4=(mQ4X2Ptu(%Ef*!
zBY8AdJizRtXEtaF?BbXosa3p3ns=jV3n_tQ{t>CMJ5!o3LQi8Hc9JR?!MEuyD_px7
zv8H5K9l@Ze>PeQF$(BN#?kB485Xki5V8!8;yybV}X|k6XX2}vQ&ef(X`8GM_VAJVP
zSS=VZ{`4CqCT^0vpx5Ug?@IN>p0nFkvTOL~CZVWI8O>#eIl?{xiu0D$va^?#FFdQ|
z8etv2{~Eq<{Yb8We@3pM&*JNX(*S`}n+pLCpkDGg+C}nlwx~jXDT9S(eCUI%Ggsv|
zp_sNrp7RR^2d|zK0g&LZfrc*vo)Zf@kR<-KDGLl5V;1XNIU+j8ikM^o22C)u1Y?}s
zmYKq=(89g4ML^CRBPW3`7(ny@lNA8L?MSfM0^GtR1TecVRO+7J7|o6N#AGb;YVQai
zo4JOJAL_$Jpq}fOAPYR`$l|+%15Rj_(OfdTFZzVkE)~&ByrzT$_6kx<LS{#AHQn5J
zh;BuE=Y_Df^HRl|_iIc^yx7)=UM`^sHCG+s)Qk@cXWNTpI^69=>9&nuB&;VxjVc5!
zM32}`xjut^d0piv#x!e;HC;29XDF_R!N1#>f3DIDSGTazGUvo#b{h)+4_|K?*L2^;
z4Wo!CAqGe@l#&uDL24q>(%mWz(hb5Cq`L*_Zlt@UyF*gCyT>-~-#E|fey;0&@x0-)
z$-r&wfBcT)dwhdyz|~qXPdkFkn^dAgTG^@TJak>L(^{OM>og-PAcjg($4nzLEB`hr
z_R~aFyNVBH%rR~1r%Rc6RWh+ECqx`mBSBVN!su2#1Kq0IdtjGcsrf&(71FXdl{<pu
zBALgT11_A5OMCWCeK~l8Jpwpj$(uTbrdX+$>-W{ps(;g!E9w=m{R()NFCfx`u*i1z
z)pJp>A?i97hqNO^jzKb|ZG(6xpVN%}BkTM)RxM}H?;R`*p@>$;gQDZ$LXrXSj(a@w
ze9)K$F#8aOYM)x&0<^JwbJQ^)ZHv{Ct=B&S=3#}!SA!rdmTbe^u;kLx5Ot}BkUJ)2
z8UFPZY$-L=7{<b|w?u`0B0lyd5!D;ga(wTiDLH;zXhN2@O(wvjL1px^2iuqu)_Ir)
zpGwZ_-O9gTxn_#&E*={JeMv&9t_bkiueu1?Z0Ql3S9B*1U5`H%R6Q_-tBn5!e{zKw
zU?YP#)TM6&zJ`(vv`ME43nJURdIT;5b(?93g$*~J|DTepS}9~sgm8g3^{okj1r2qe
z9vlvWYA11ZCjYkt<I`-F!p<eY1M%se-AcG8!*7;7zXIMcrIIae6U8~KXAjbCc_6y2
z2vgEtn;};mLqRWvJrYFQ9#vX;_H8EHdyKZBlPl0n^3ac*5~h8ba!-Fqn1D(LY;Do3
z(%a~398W|7c(7t*a9z9G-UbeKPck#Oni<jV13q!IX3OD&g;F_M*}`K<p0TzJbC*BH
zP7ql9*xZ#&?n&xD|AaM!7B9*^lw;`0$UQZS`(D!hifh_T=93;L&DAThz8a(R?9qug
zw?}x`QZuI@-v^;{f-v|=;Z!WcSU`ZT?``0C0G<FoCXVdMe-|9|vq-s##xkyra&K`d
zpnX>F@?z4Cc?tj<&-AKX#50aR7C{zN4gLI1L{|h|!H&JhaO&NQvy9JOO?A*`s2f0U
zD^JF!RBe0uFd(*%pv{Zns<jvpzTywVcy5xqi!$Fsc5S2uhyZt;h_8V_?DFm-85nlZ
z_6vac`7hi7jBWlc9oKj_aO8c5w%`I4=32-}2)3}m2muS-se&*6y5OL{d0mJ=fngK{
z?m1vJi>^yI3FR5FK*h<AmqYllz_yp5$U7>0H5uR|{;?O;NCQS-Z(N(sC2^%gT$Io!
z=qzlFIjCrGi5T&D3RVpw#nnjFl$MO9nwHUcSIQb%iF!?I`T}l60Y~qQO@;F6MHrt<
zhVlnS!MoB}r1YsS{(r2QfN+F9z?Xg?M_yrk3tZfi=%pn_UY{?MjVetww$C5<xLJjM
z=7O2xr?Se3k9^S-1i2fGS;N65qpNE_O7~=x4J}4W&WkE1n_V0Gx&_NMAoe96p-)05
zN*%0l&Ef?-J{_`zg_O2A-8kKYGTGLN-zFyg=AccZz%$f==Itnh*~~P?2V|#KR$wH*
zR8b0jcMO+*w~|WC_$gHVU_5#1Gr!>j5`C((!F)TUx#|~?pY??oLqUt?$aP#tGa{FD
z#%dpjDJv27INkF2t+S*q=U<E)yht&EWz`LO>nPe~IwPN6GMPv1)UzR(>aJcB^-7AR
z?)-|?WuMm=nC|ZJL)zX?R!$}%-i&^(%Xb&W?tOLy-gswwXzWpL{1BXqtldpOI_)eT
zp>{IB6!5HIuuf2`1$x9Z4Rmb4()dA<PtE@S7Ng&vJhb9qjVgaJ9wGW5q~NcZ?fw_z
z696_oPSX65(b{p%*N~bD*!CWLy_~&1dQ?=`0Xt$`fXzUWBo!+gyA%N%?K%=n;_{+z
z6XQ;PQ<3o|RA!PoL?WU?9n;Fn1!WxEsc=hzci5>Zzgxow8%)NNpQt9}%8Vv$i-cWx
zxvy-#(8#?kqU|L(13L90QI`e>A?~>Sip^WbjGxk|1>upG2_8hf_k~+1CKP9pk7(0!
z{-jbBtASejRsVNA6jai^L~ucDBD_r|jJ%(UF6Q5*b$F{~z|v=p(XPMM_(BE$@%Pk0
z5gY1DU=-GL1fR&caQc?-*CwN+quam(S<Zs|R?QEu+ofJ^d<ngnd{Bn@+%Z&kEu*?N
zX2~dCLs#QRK?Fr|>yYxT2wT_Tl2d0E&emb&AJt2U4`RdcctgS{N>eO4LV5Wp1<C0z
z6h+GVIVXb8ri;(-5uD3#jVM*C-=Y2!L?-3@If!=_svx06^UR4rb}7&i_nZ`5uo5X5
zDc5#v=wg9(PXYh-`d36u@=rDn3Ro%MsKj$I!jfiEF2qy!{kR5fDY3Bd3bFAM%FU=x
zWF<Pk;U|<B8;m~SC%x%F?IVoJiuf9OjEN_~xj(DO_4%<<jeDKDX%wiXcd@4f&xz{p
zN|@<%0d&g3YX1hJoqaemvP<yJhRM%Sa!D}ei-_L#x^@P>ZY{syNZ}LWF*5dmc89}s
zf!5u67fx`P)?$-S`XT9NNP(;3KDx)@fYpm15l(`>N084=$#elY6Mm%&k?a=S1VC#W
zz+M1HGN0q6@}Cif`7g9Rl9PAl(*ZpIM?alGVKQ~cw0t!@>_LmtxSZ6-GA+D}+{%n(
z>s_n8NJQ}4=3HveJ3HXn;YdA8NyP{K&%e?EG^YeWwl@P9uY09`D;ZjUo^=yYG9&;1
z3)BVZril>L!GCaDbf@%>b^whsp+|0X^YjKx=jfh`(G9%@1dpw-lLUN)_E_X+adez}
zw(3doB_43&nrwrCEM7}qgv3_k6If@z?^P(G-6r}s;tg0^{vbGqTm~$Evs#UN`LfwD
zrjzufUq{aW$45ZVdxAyi8B_MkJLS5WL!-(!!xPwQGIPlHA%*V}gH45HwwT#1vw#GT
zvxK%Bv@h~6(gK8{FqA7NM(1UJYPB8p%n{v|vDakqEOwwQ)3vOq6hO4Df7s!7mvMa@
zm!ZCS-$m7$$$0<O>W?kcoJ!|cKJFs;&PwN*7i?-MamF;~yK0}{b(VsnwN%(wZ7{ik
zI+OPS({urMMtCQ`<W%2G7B!0yZ(n9VJ+xiRXNwg*!Vwn@C#4jj!MiVhOL6$!aziM^
z;o}&tU`sa@?4E&(GUVv!(dLD!juYfTVRO>26*iVaQs|pID5GlEmVC|=MDhJY5-A6|
zI!$=t&D!J}8pw1#9xU6+!x(I2dNcAanpPrl;by$D`DpIJvE1_;KotjruZ#xNy%=P^
zqQJXq5c-R8LCgow%%6uDZ=5@6w2D7qMx9$t5;@ke`4K0H1rp^zx!dYPRdnUHD=RF!
zE?BS#3O=Sv*CF^&x8+)q(mf6Fzr-$$$VZ{`lrVNg{?K-t{Z$PM+n?Id{f<Rn-oXkt
zmHJIPE5bvH&ZoXgJ7Q+<PXt5gez^&}DX5HH^Jivj({wt^^0xbQ+hC><dhSbeym>K^
zN%ZdE*?2TlcrN8=%_5=dU_kl)&cc0dvGfO0pQlj4C~TU80<$)xDkw*pWF^1zlM4SN
zUlLis=3&S?lOo#Z{|g;|s)Ta%H7ziK3~ZDUaZrm8VFPCF(RKBWNaC9;a;`&({wO|A
z2b#G+U2~SZYzkgmOteMr;`kHF2ZhizSOkv%c0Mvv(OpQjO-&%njrT9cgU&z9!<NR<
zS{jzLP+AF{#xF+oO1<$T%JCddG`CeL{Wi>pxPu+o5Rh9XHgwB(ev2Q3_Y!22AVeRy
z<JlF|sI-k1%9++dkFT0&LS3j#sWgNTK{|~Ypl{;~-ktEkIo{$|u6u(#9y}MNc|}7>
zJft#Hv)v){na;nsh_1qO+H_hX<+VS_;_cg<A?w>J8i7<`sJ$7a><BOtPcQ(XeTLEH
z3e2mw(Bn{)fme7-TErJfgPt!5be?eHO}YTlDdDur$874+ChMvX<vtmg5Tp+h3LooG
z%)a$8@ZOT5g6Na48EMf9KT<Zw;PUL{t3lz_iTPWmw*I4QR!Sq^ff+_ZyxZ*pr|*Ox
z+5cG$iJ5T8cZ5Zu`!IB+^)mqt+AS_J{QtP8GSxANw1A;cQu1}@B4iH{yy5C$5B@{E
zJ6t|V{~({fRU_Xk-rD<Q9<?5m4qh>!d$Dw`0xke=iU<R-vD|~hnt}22Ef3Fc#3fXB
zc_~KEnEv%~21ByE!AzUJ$?2XMpDV8Fs}+`)Ux?hXIJ`ukM*NIYkT4;+?%L2#58c~h
zph0Vrs6#e#Z7bd1TS8!k^`fHld(};Se&1{xg%M9Q%?r8B0B;#Q_top1_-f{tlU;8p
zw&<g`kMkkLsT#b{>zsz0=ip5SbUDwMuQ<;@lXuN}0KnxaAV&Oa;0$=yV9fldP=Z_k
z;F7P=1U>Y`hOUh!_sg#t6Vk7#$}8@fa!QO?XiI6@+ek7K1(SAR`6(pa7#lT<d^ezA
zGYcLr${|YRCKe#+kWUA`op=|Av-v}$vZ!mPkJ3B7cS@!|3(S@u8pqD^`Ec7W_w^r)
zxo7OU`))NtDkj)i*XoSff89Bn4F27zbfHGREd5>ejFMygAup>M-Tn8LR;WrSr>?Jq
z4P|CV)x(7APq<pJj<(?3Y!ydBeUUbbzC7Qce9K{3`(r_sTR3>BYc+!}7)`yAj6Ct$
zUBe2IbZO}XTTHKQc~iOiR_}`2m|>oWPGsj0%yV<TY~2I1Uk)Ew$`%}`el^VJIwuYo
zxkLJ<Gl6lixLE38O@Cm!2(IWvZYg_tD8Uxl*!Rl72bjn25Yz}aB$n%Q|3y})_zW}K
z^mAWCMVK|g6;0J~;ncE(zWTE0TLo_w5)3yS2a~k$gE$`-zxMeD=O2DMoPH1`qBy@l
z{cBWP3dDoZCH%oDYnQAtkQB9cT?n<S#ed=++!~6!1p!1H{>%$s`Kk%(nwT?FqKupJ
zdlH5WNlX;O`|^vkDpIl;$oXzyWzcoH^(?L6K$dgq8RU1RIEB9-l6hde?jn?j?=vQ(
zWBml6G<Vf|?M}2kS>HeLs6tGsm76%ie#7Y!OE5Uz^4vf!cOxZ>>4$bu3q=|;529U!
zfe+OR>dR!gim-z~5@Rufk9qP$FGnrT8GbxCsW?kfSpWI~YIp_py;!D5mf&{gTCPp5
z+29&iDY5$fgWJw{ZigYsh02kxRASP8sosT5r%An{<5j@ca2-EmgU_doenwp`<{p{a
zA~AX=dg>05vtX0<>0jq0X}Rp`R7!AXT2T<cB~7SMV3YGJF9<^@YKw*(m$QFMzhOp`
z8OXiRVFT%1paS}lIVER_dU&l@Srh@PI;s)McN}m|-mAX<DZ3(ePs*F1Qq(!RzixU?
z+Ui+b_$x80KTD<YV^>L_f0nxEH4lyai{a@S`@g07|K0MXO<l753z2^Ow@jy9muWkl
z^#H4->fs{R_xOynKURc~#C?@K=QulFaG3kt%kfaChR3tG)62=)A5_Ly%$Se#D%`Y*
z;TPXBS*UOnkA5xL;g(>4;)O&rw)s*oHrz#3kaqD3kbOG6Uy}h+f6!UV0K;PBM0@_C
z`vfTrMl|*eU?kwb7a(<;@VXg%7WUPv2To?1_6_rl*}Zk}Tu#$yM2qCrNw$kKsa?6N
z6W6kk*hmxGJFmfY6~i$#_uIS5SL+N{>F{{{SC+uF^<LC6gjA&31H|%nfTGPv2nJeU
z*9t~m#xK`3G~gK*$n^n3H?RwThQSqe%_tL2xs`qSwK~ignF=T)#qUy;OMV5#-=C%!
z4&z~*ZA=T-H(s&ER&>R2jsCXoxPF2iifX`r+WQ5#u2Hg&9_5u1P0e*B|Hsj&t%Np0
zE;rNOV2c;@sHWxL$NzaIgsQu--zxYUgrq0ccT+@X$rdXu;l`Iqj39|eHlltGwA(f$
zyji2%;KccYuBQLKPXHp#0`C|j2KogM>4dGyGA^J!u#p58%J!?l-z^u_t~xWh7%bWh
z05>6YTlT?w%dlOl#KA>5jW!W8{MPZNlwFx;r3vYjofqoI7gQ%Z-cDmaz;af-91PC?
zT0fxGIn?M)khG)};~l_X2GnPCUy1%Uy2t{?GrFp3g3k5k4Kxl0xCns5HX3Cx!nBq|
zh~qEGiu;XxOdInx#V$sqr}b@TN*Pu+i1*2lJ07>TUE?+1vSoQXL@ZkkC_ls){17m(
zE)~!)NIrmN&gSFb<IYE4=DaqRY>~m%7J;|yIG^f1n0iuFw&?3?VVJbt9zWteT>eGd
ziu7R*Hs%7PFJK>mo4u9vq;Xv6iLO?<o_2a?hSos4DsMCOLpRJ(p*X?Kms}wXo!K%6
zMuFH~<qkm$l4OmA&gtus)$h)39f!VijX!4BAqY4jc(@s#*uLP$k}X+8`~3WtrT9m;
z7t04lt`(k=6wz9?W13i$8~GfMtLoW`63OLpnIWa`-gH6hHWqx33dl4~%l87l&C+Is
ziXKj6Jsn9a_iy20u%QMR@cJolF@G+7P5k1=hg}0t<ybip%n>&5F^%?DgK@JX72=vs
z#JpLN@z07}q}G0BrK8aSn%5~0`N*E7$Y_UaQ`IXQ=fa0IU!ox6d$IO>?k&10QPTwL
zGL?N=nd0+N5xSoS(u#CV`Mkf(IT#B_BiBT#jyIJz$==w+uX)uT;hYfoLJl`!fUf-L
zlI$4%KX+|rk9fUMqQ{pWCc7JHsdZo$cm>Y-A26mV#1YdjP4Wc7R6onoXDl#3yn_%C
z;68W)$#hxEEm$yr<PsbC7;`UWQEdaHd<9x0XTIl15W1_2bF_E<7vl>NYXQ`x-t)$U
zBoUM|AfPrGb7S8vA9r2k%uPQ`VlnwAXmyn%>i9~&`z_{371XkIrf!ZY$m`CD>l<>9
zWv}?-Cbw36@=znG;U=mR=<Os<HanyZ_d1$MYZGdaJ4P}m<UTic%a609edVHE=PubV
zu3lw#s!fOW<{RU4f0|;@pRaA56N_g&c<&CzpD)~-M7<X{gF7e)XZW$Ugw_G%8A|-P
zD6Jx32m$2p#k(b=JLOkRe`e8jxEtp#hQR?dv)UoPPmu3`9qm+?kC4{k2}JWa(Y#&L
zr&RN$)zcZ2a|haE#|>D;n#IzFYO!^fkPN!Gm4FjWbnMhGE5!L*SXZf-D@TIY#prg>
zg?rBB#G}nU4-;}%SnV84Z(S#mYcE8=k!aE8VH(^+=VtwAXZ(k%iN{CWm(P`0L-*OR
zPdc}CLj~Jj{wyEu3h!vp2*I*$q?_EWP?k3NVD+45p3aga;X(7xtNlwwv-Q+)zOh55
z45H;SRKq6|XLGf(5d@9d<ipP^U8;1eGi!p_r<)plRsMUY_`^?*s0CbXs#u`YRvWzV
ziMy6}<OyBxokUIeHc(&@X{t=u|FF`H<<}~J{c6(25PJIu4@OeNR3}}0$pG{K+M~ep
zhNyian$MMLg3}r1jU@mj`2fmooT!nFy34zu)VbYRrDxax=dOn?Y$F%tUXSC0{X^K-
z@E&-8;ggi>&RGGN{)1EChA1H@!=Pcjfu7-|7*(W`u=t-P?^bQfw%Fu-3rfHOp69>Z
zL8ln1Y0j=6VfPO|>TY-U_B8}?%PY)Ul;5^#0kq$ka3w~@S(aBr#e(8Fn=)Lhj=H{E
zf~MA?qpLtSGDL1EE-4F`imkVQprMN)(4zXp1iZiAtYAtC|3?xD)-E?B6<G{|`y7jN
z_fJx~i2XXC(*QUf+nr^b68M>Z4Q~9!IL$45LSq)34}iLe=wEXH_=xcIWeG~SC;adB
z#TRT}l2^?5R22IN^=X$QzlyehAR*$V_S%;&sq|%Px!bX0qf=4kUC5Ql?ZE1x8vn%e
z=W8B<_v$b|s?*5AiwGUfF^%b&R*Uz^j<*z&_>)l;tY@znmj%mrMRggsSz~+a5CXlG
zRUTvq$O5(dn0aP+bv~!lCCRB9FwT?0yZd0fMKL3esnh)-hhf%#f&JAPRa5aq^{Wpt
z*uS}~$lp^IRdZ9hq_s)2eaqZcUVutk9aT;omAI)4Ta}xKG9BHFyY|{88!XC~I`qnH
zn&SR0iVU<lKH5AH{ELy?pnQ1yNBT^LldEi6L_5#Zxv~c6U?Y@_ZFVBsHBTzhWP7+!
z30xk@^Y7(>wckK9=-K~o+5;Wf8~H?`DFYcd74tX~p7ldNcA|bBBZnssPqOO0eTKdD
z_Clg|XVn^iq4uDX<R|~e#w2e_N{V)bDFC;jXHo#90W*OT7zfZk3ZU1&9t{3Nr%wCs
z4M1VEW8k%H_5XWBim<E->l+MpqpX~$0@FKoW*wLM6JNY2#sj6Le_U1Xvh1!_*Mu!T
z^_S-KAljxPxnL<8>R##>wa~RXRlP5DE4b6~^h|FcJuW`ayktcXOTDzTW~?~1wDjwG
zP2w+cvU}>2Ip%t}_W6JtK<|syKeAaHWx0dv6OP0D5R<ACGwF9x(=Q>ap>k-zbbmvF
z!fOkbR4tQUgGJwgR)O`gtFhUNN8x(d7d*|CX>!C{xb6j9Zlki_B64h+pSTE|^HPn!
z>1}gEk*Pb&_BbzAj~T}mt=WC6teTf(al<3%f@tnN`U8Y5r!uN=w+7oI)R8Hf=}qlt
z2D8os9M*hxo9cX4UIq1n2Ui{OUlWb1p(dpPs?BXCGq9I5CxiiJo%)3cXw~Fr%nvCW
zWaW-$ju+NFn3=u$`S;yr-6o^8C6}ALi51>Vy0IEC^vb=E#{0hQEl|9IZ%fAJ&z(#l
zWiaBv9H@<473<*{m%~2FtAYow<-5_XBKxX%I4H^^Dgj7!V|S!N-dwz-pQ*&PaA2kl
zr2ip=mt=U=EqprWMn5fK*s&EegbDhtnSag5%$H;hGGt(FPm73&yE!r{3c8dhYhI#;
zJVTr5xX<4Mgj>cFz+pEl?V<R3<`I@bE~?Fl(dy+5Y&*5j%!|eow8T!Y3j-jjQ6a4}
zV}S9tIV?)?fJNbHhRKV(bPSxFj;myzAM1g5b7W+L`5R4t;xxs5?B^&&MD9e`Oqjm1
zY6ZsVKqU0A<d8dGx$wDbgvF&_52@5oEQyv|4n?@_9t7&??jr9(@1)!RWcz>w9&<SR
zd0E*xEt#fA^V*PbY#hFl9W44tzS13?&)oJKW(%??asSDb&!FWGl?M3sMsn9Aw#~Do
zHH{c<KmM3IiNp*kMaPSs2v<FT-n~VMm4&QNuTQ#s-e0{;ugb9met-io_}W5G)_>iu
zfC~Axh28@J7Zgt!jr6}@bkkRs>*1P_b>GWf(SlrBQ2#+<!&Y?z(=V*#hLuTZ7KC2K
z%c>&<u}4Z3J|PKS3>;iYx4Vt(G^vdqzrugi981h^JWg7;wDkny-q@HtxT*Wq+#D;q
zRBJ}8q|FN_Ur9leHvEuxr}sf{^i~5OT`A5YirW0flTa!DM&q_f{httfkI$%^wT1dh
zGBnchhhvQ`-tv4Uf83cnpYLTg)Wxhh&9M|{1T!}J=C{_k6{>A>Ug%c=vC~)7TP_Us
zFDbyJT0wK3wCu{sZzqj9`k_nki7qS)O4fI!Ij+KFn{y`FRDJ6Ha!7qMW+EM>@ixzW
z;1$wroY37||H!|4KvvFC*u~u<yV<xl?qiUX{^ZoXwdzE@4ku#%)X}e1fvHi*Gq@`Z
zn)!Y!_Q;GcXp(@2FV>2U!CU(PJDVggDzu=*;3OxLukoY_>uCF!FrrVxpG6id9g|%H
zBp%ATLKGC0qNVLOXOp5d;Z!4$fwhLA__{A6mvBwBmlz46)+@<F*S#*(obsJZM>_3Q
z>nx2a3?SihHGA&9o4RgM3STfGioA&2jL3;^1vVcKluI1aHPe1;jn%>ObheaSsyJe4
z_Cf$<38aMNxn!ipjgyGs#xQkhGCoT&wsEfWfaLte$Wln|_qHLLo{R8+(90pp<dAr3
zk2IC%Tq&y;0w9Y(<p+*s9{?v~0949L7Qj)Fa3xMja2RPwB|MOn0<gcQApY}lShWjk
zGuyIdiz5J}@Q`pt1>igb$bJALI<O%7R&#G+`YD&XJ_hX{ym*gsxkg)9EhFA{65(>!
zbHF;F9uF~QVIKydP=J&O0BeTOZaH)yxD)t7M+7{((fb6`lstB5WQU;77`g*g(yk!^
zPPmSb8t5d~Zj+#gu8Ht;YD<9mi<`0VgZ+XqdN3p;1EF4^Nf6GISO0TUu7cl;VV?iT
zRm$N-Jm6603=UcIMGh&h(p)w1yCx+^)6_w+zo26~7~xpO)dhW>ERtN)no^=qKwEeF
zN&2lYY!H7~lwPIfTN(Gks_w}fLL|Phgk*M!<CWN${YHAs(TKXDa5M{4WWzmJzF77k
zsk(L`m_E^gOk2D8`_W40e&pf)%u#{#0?zNPl5U5^OS$jgE-N_>4wIIXw=ak7`ZB*)
zk43Y*bJ27=nY5C=+%Pa{WNaMvjSRN|Et!jpwwtTkhxDSau4Q^AG1ipQ<T2BWl{-SM
z*{g81AA`3lN4b>5hP$%yie88>$^>XoM;io)g^0ew%f98or9S!Si?_ilcF+9TZ+K?Y
z`r0RRC%&T8JQvLZj=(U-46`OD!7qEvQll-o7N4vfu3Gf1LSxubB~1jI-Dw1ng-+v2
za}$O-;Y$8kiX1^(eiYyj#>OY^BD<?=t6dBQrw*`FC^61b<g){!RJfvfi>4PwWr&L!
zbtIlYrmGHr@96AxKd9GJyoiY@mXSf5#={rE7y`1FgnTFRI@9X#!Remy0=*GxZ9ot7
zgi)u#3C3w))1vgR(eDe?n?%p$x9a2xJ9;1olGHIs>}9C#`eD{%7H~<Ob4BU>)T%}k
zOytpDKx6oi2QWYI6$Z|JU(pT~plQrN`}vMyfDOtu{hb|GlyV~j?O*Zlq69>>;>x{c
z;T%$G)3@S6MgK_Fml)mSqQ3P&HosOi+Px6C`PSOw3y$r66K<x;NNRTC-l#$m9;kgi
z$@i<+m2`kU;KE;>Zj<dw@G1{`_2*pwLiy#V^r=k&%+-x#tW$iCUw8D!AM^WO2?sr<
z!^IkK{ko|QP<sZ=Ls;-`#rBN<N@dB9U1FZHn$F%~VF3>vELVos?9t^58k%h!gV8Z<
z@@R~R?&=kr!BtfR!69?2?$c@*fpB(F{C7rkD{7s{tXCuymfJ_?=ecY$_dXI3wE~iu
z>$^&e#*RK|E6k7xkKJCLp`@g7rB15*69PJiN{YS`%1U@I;tXA0-okPhhem5oma{%u
zjBV3lYkM(}n^hB?)P8UCsXqCQ3Rtxy=5)2(LxjjUcd(UG{isp0Ol8wlsVHGG=PeTL
zpX;dtm?3VX3RWNKxG4u(EKi`{RC!9K7K#d&>T(ddl+f{+kZP#N00BdYXMO3i`k3X;
z$iUK>DQoz&s9()YO^61NCcCCfYj)hF7|mG$tRGba)@La=>;XvzO5Y0I!0L+VZ6Jss
zqu=pl+G~*(CGwvIBQFL~$zlWkX}`o<uxMG#vYB!PW>$BCX#@N+6a8?o6=mEAe9P^J
z?Z59H;PoH(%oo5?Hf5Q14$BHUx9nL7LNwW)?~M46>@G@tcpaXClh=Te4I*tjs*KY#
zFDKtg^V}svt_v+JYwmcs%O*;VDtOk%rHi^)?1wl6##L!`#guscdg_Ddra(mxUl@0Y
zC`7YVVC34)(gyyjIiV>579Cql92AB)LKBkwmNDD#BffQqVA46yJWojm44fkv;l<aA
zI%Em^W9x{gdi$;=!1I)8=CIT6JZ8iKvI;po*m6w<b78Rc_(OLBC*PwcLr9^D?(s~w
z(<MqbRrl+`GD;8-SGUt(G`g_=xhut=I4cY`#g~XCF2|Gmcc_EB#>miW<z|fA7|nzV
zBKOh8!nTsTV3<;PeP2&g6sFIe(aPTAEmzgxT(O%`NnEDc$4)D&e04Qht%iMwEzuIF
z;_tfj3K(mIByV0S%Qy&y`m#6n)TJ_HRG$9D@Ir~-)hTYR6P%27%CI53Gj<gjiSS+5
zR&g!%WI=T=Rwo1rww7l@!;l!z;J2#TLpE42L(hn9`q*taC6TfDB<$nRJ_9x$4O2FH
zUnXNR$*^2k81G(@BhXL3B={!u@M(o{>mNq9Pw$?rU$APlgaGDnCx*eu&NXE)rR$#@
zrjy;-tKNkV*16}6`Wt+ToH5&@L-tvUBh~8Q@axB5B~1rhkzq;Mw=UYWCIdUxL}HRD
z_a?Scl3TDzF2Lkyx8a`MdeLq1hmFaA@oCy^rI~f2UlY+hy1qu-nhJVz!tu}2%6NYT
zyc>Rv3qFk|B<0|wA|MF&MaMJ=gBcbqyx(2t(PeuqRej(Th5j>R68gLx#H1OsPn+}g
zSY~X&#XF(Oid~UAn>ooUdn^D(H1gZaRZQ+Jk;r9*2uZ-lQB<rRLG$*&ej8++{j=!)
z5BP}=AGv1KF^Ukq!oD35@%^Et_|*cl>(|az83V@2)D3YFNlyt3gQPF2$mDMo{wa?H
zY_!A{j*qVFE*v1i#5(WtRI){NZKcQ7^YvTF9J2BYJ58MjS4&H7$nrcGfU=BMK=HQt
zKIz*3Bw$9lip@kGZ$ZiO(+8$KN=)q+o^~?Duy*z)Kt{Pp2hs}P$OcuEmFe^c>$i+F
z(^iidTp8A~s|ojohmSp2xV%#1T=fR<(oBP6{Fr8;Z_r%1eORw`KBEe$BH#VFk}y~J
zL_>Rww~dRLLq%DjvZXHX$`kFgInckt?Ibw|v%kwm^YSIZBN~$*&#7&nr}s_EzRUrP
zcT@$X#YLo4&FCp3l{8_crx<b}sy!Y01{MpEny5T{9+@L*m9?;OcF;T}mPmr{o3+?U
zaW!l=<m|h%tQh4IIp1%3vAq$(HLNI`OL0VN)j;H@dP=&jFv{1KGA#MJ_rChvoY=mV
z1y@e8OZuA@kLtXY`_{s@9JxoGMcRDD>aPS_AtmoTtl&lqK*b9|RaiPl9PyJk*H%Vb
z!Hi$@@hAjG=nsX@dJq;_%Mq(4(fsDs5mZSkZah=dDKan-;;kKxwkU3?t=Nn_A9ABw
zo|=?&GS4u7nRPb$uByrJXlbrKHw+2&yQ1*m_P1KpVb-g1OMJSvHN~b}6UZd!1v~AR
z*CV(H75=WP?)CI*IBUKYo=~C$f{}uVanVf0Hl58_DbFbw>3B7I)$8~YPC*vs#AjK|
z?L8)wOb-_l90Tc#dHaFom#izHZLV(@wL%3`K7WDL-vKxTc=HRc`mMw#c2>y7Gh%9^
zq`l*@RtHnDFCl$u^pU;yZ3v6<md)QUTc2>z+7Gv?B#J7^WR;s{jLM~%P3jc8ac0yX
ziYAq0a%om3ujxHqV)m0zy7-IXE0<|IRvtAd6?{iQmTNrL>S*V7L;&NDyRsUjVtmEt
za#9wAH|X1e%mVu=8%`GFdG8K&NJrS1r#8rOZ9RnqvxA*qE}jNy&>mG{=c0H_Zl5pq
zRXSKoY6h~;;i(w&%1dT{{7+u2#K^;c7LH%aKGu~b$zi5YV!aG_#)t(P4X{v9l9a$0
zkvGY@0Yc~T{^PFrj~Or)P{UnQC4h|w<276C|8gvt)R*Tu<OqNK9BFKQMv;IM+jUuc
zs0g-PH#7SQa~m_HAI$RHV-gEiw{PbS15W7YMUlb>vc*gI&##ofJ|xF|Hn$S56cnv9
zqwK%{@#VhvZdmw}o&FarM+iQG&U6{_h&%XXq|*YA-uQv_py%z`v+apmB&YDmE(*iU
zwawAyFNVo1h&#4!W&KKzaqEQSBoBHMx?&I5PQ{M^d81IKS6bN-g2yGu(b<;7E-mx3
zA8S<e*NtA0$Fl6n)=(x-g0Cn@?Ugjt&#IV>)IZ|=hJ@YR7mDQEqUYPq@clr9`_jvi
zZ#FHDQ=iHRl<unZJ{q!x;fyp)oXGi5Q8f;ou!>xPjQ4blxoKn<Zzt7q0zn&GvCQq>
zCaX;Ujr0m+(y4NUvi##cI-^gP{8Jc${muf4-M6~AWV=~DQBum{gm*p7jFqpCA0U5a
zY3ODm&1LhLU%8~4+BH&T+oYqDTk=@5J+ODCP;5`SZpQ!lbAZ(ve(dYqmLE|Zk9%<q
z*)$s^VGsuJW~(YjHiQINOKO8gJyL;PQZ_9<Qp`3hgN{%sj*`7W!xj@S$bjlpF?#sE
zS5O78F3aIT???EWZkoP1RyF@k%&z%GjmC35d$k*pKg#^*m#fp6m2crt5nYr^sm)xi
zhse#!ZS{PbW9@a~(**5|N=>%d%TnB#>Q5}IwTYGO5BKzu%$?jiipy$av~|@2RX7dd
zZZ~v%+gRV_X>EpA%_DcJPd3solbhAB0H+SFOVOOC>`_9uFKtEl7XusN=}o835pn0$
zEk}^lVk`3$9iU0Ul+(>HrJO9WYav#`(*7Ns1`G{aqvdt|s>|JFUo)(hpuZYd&WeiP
z9uSs-AOd|dhx<=}UEmo4Dz&$3!MgKao%Mr6nr?s>krdDD<!q~;$x!_Z)Jffm-ulti
zAj#OtC0B!(7Nd^NQuD_Kj@QtMI;;P}`qw@K<bX!y{0i+X60q4w0qe~Ci-EM4TQLc3
zQ#Dsq;RtcD9MfCSuSyFD*oZFw?&V4I>A^`Mfmc9XNpzueGC&A2Lf2-O{qzM;3>7XD
zWlK6Dnjgy~S7+A!^cP_e%^ru3(hs!+BIn~Yy30=9)iJbwP>es%oI?d>ueo-9;||@`
zAypOYZ*QcDOp@4vJ%D>@ovu)kj1Pnsv@^e?jy$&`IFo}lA74%ud*10<QE8upFeJVA
z$oIEoo{Pyp6;?ULeO5t!cb6VQo2Pu`3TZx8eU{~X5cw@Cy;k6j8|j}h&GyOjZHCxT
zr39R_d})XBGM_o29f=&FFCS|XVeiVl+B7}N1j0LUs`jg#3~%LP)+|H56g22}l+Et>
z%HF<HODeZum7RSIS8i8_C)jVT4W;kI#MHSznmIwp7ONg&g@k3u&|j9cG4^^0d2Q>u
z6_`7bwNE9zRsU5qCc16{hhI(TbMikny3Sjb%*f-n)-a@CtFMTK9nsB0_CsLxd?Ot9
zIbP{0D6AzED6dc`HQ5bSy-!Py@@S&*h?-E$4wq`JjxqxCv7M;iD3{ip%AwU`nn8{#
z94Hk4@Em@c0>1mAR^X<p20Yg$3HDoWTaAP#cUT&qFEDPSt_)N1pkXh)QWE?3?%-kd
zYNKZ@arLkOE2%_me{IJd?B^cYRhLU8+*ZVMx|RWb<R)_DUoU44cP~5~1|EXugg!r>
z{X)jQf{9O2&3$3RY^#yFVccJmyw^+MZ6Xx>g)`F1EE+VrU-ekU%kF^2D?<W2*K17R
zhDkpiJz%MAH)r2kW^pWTa>eytye)V&T4mkzeu{WM30BKDy!La^ns~@QX9H-O=emW&
zH;;HyH{YSn0vI`EHSUnm*uu%MjX<#V6!{(%tk!kRIHX+N6pa0f7}x9IC_p0tD@s5w
zM00HvB;Ns^VP;i%O`VaJ30+*2<p;9I&8JIYFC*%JM&k9Ygd36XjEa5sS;~=?<UdyF
zY4L<-5(`7_G1ji7(ii5>zANiyAs>ux`jS7TUtw(VpQW*Rm%4u18D{3=J^da1-G<Wn
z3I5`nb)DH;ayHMm?~EDn%wgZE<lGHHn){kovG=TU{)$XYpPDpW6c1H67)VX)WD<2;
zjpOY2^BUO9LCn6Xo9L2|SCA4bjEPIzuin1`s{$|&sFkdZ6q2dOPs(&x7{tD<+AUV?
zDz4Yd@68s*V|V{y@63te)P?Q9ki8hc@;h#}ti*_cHZnrS++6o*!$jiScKxsS^u2H2
z1azx{!57enc**<s0El8rd7+6D#N`?2Hlx>BeEPwtwz^tk#B?QGpXBwPgu;d(6PcUX
z>)AVor$pJQ&K~Q!i4*kdsX<1PdSK)4pRVsRmMwM9)={FX5Fh84pqyq!SzM1e^9R4}
zFPvXbJD82H*nZjct_W4wju_v58@e*Ms$9`<bGh|MYfjj<Osh*o#0Elf3R#v~gJ^oo
z&9zteNKS7S*KTL)8*7d4BKSR~EtAtV@;Zn)<fzU*2c06^w+i^?zvcnoq7nTHV3-{n
zC|rd-7K(OQ4OJhhS1^mI{r$MAi=A>hh!GBVCxA$Gk9~&ZYkWQwIqM=|rfcdCKiQTR
z@d<jCkvmz><Wx7=FI2UA@z7l8QB23oF8p(^TXuL|pR82qXUB7tO70@7(WJsxE=rxp
z>MgftyGLoj%l2JWbbdUeR$d=%$+{LOXFxB^5v_ej4VkE6)!P|1cM_L_oj62&kCT&i
zgUCtYN-k+1RM0t*bJLAh?3U?j6?IGoI>_j-8H_UEnwuqWEq<{OlkJ@Ki2iDvx3IbL
zL%Jq)P(I`})SK=s)hSnQT~}LRL?5GML(tbOU$!$<gn&drc_lWnvKolPP01v6lEhva
z>4VHHLqa7!#h>VpJ36^R1PpXa5idV4r)<dyzqt{0NXlFjGJYzEirVdl%#r`NYO}e(
z3I1Nv`%tdo#dzrP8=L#gs7V;Ag8noT`MwqA3{$vH9<=M|;cU_E<5Obn+3{uaXgt}U
z>)rs_69*~WTH%UhZZuC?@svzJCk4=!|8P`qpozR~Xo?ls@r%Adr_TPv008S2z*|Lg
zRDpe`^t+pYiYD=9+)ro`KJHqEJqy*0+tKEEzIkSmv*qacY@1w1HjMdamtr3=!<11S
zj10l|7vr0g@-UYUV|LRRTl&YHHjMo`ihBWAwjO}L9bP61JchlSP(hmKp~SFmg99g|
zUCd9uheIpN!=IlVl#&=9QgIhQ;PZbt@`Cg!9J3j+%cJ|NN`N%yW#K_@2VbBV4Udve
z?@xQ}4&I_i%c|IIH4Qt9e=&aNXCGkg7KXOy-ESCglV@&dGckD2!|sQHolE~kPK#XV
z;fT>8q?vx?(>%M44PHsAoi{;!7(upK*TGseNc{0}H*Skhur-^!PqH*xD7zfwHQ7Xy
z+f1}ZMi5#rxmftp9G_YKg_cx%K$PmVL<^GyFI1`pg!MJmMr<9qFjR-_xzK^eXEwe<
zW<iNZLrbQASGoh<zcQURJ=be!oHHlbS9#FLp}vk)8{S-GjfV&3#c|roSF=CRgtQh(
z(sp*uMbT@{FQZxnBUaIl1U4{QQ%?k#nEVYj`?;s*s>wZNUy~s&wM<AE=$oHpNmZsM
zt<Uz4L(jw+PHr~@Oi$zTKE`#9cov(M(wt2)dvN@DdFy31mJ2tG)-ImG^HVwaXj|0Q
zP#g(~3bi(kO<1)F^03dCu@}!F`@U1w7M~*8om8aNe(K0c)|Bz~`Mrt!?Msb%uNuOq
zekt(MR73xRUm^2$ar%NtyGf>@furgzj)ePeWI(k^&9oP4h)gfg)YNCD{latAAh&_9
zSX8`-EKV%ywidttMgqD^1&uM0+F9wGJR>n3*UCVllKnToV7#~uj)6}hH2$+ED)g05
z7O9;hf=Bb@3lHYI6Y{!Oi-(<2(UDSnBN8L8df91{?UXkEP)dzG2s3&IIvj?rlRr5M
z@_L3I5>p_RFvsl5(B{lsY4H1U3}h$dFGf$pBgr8aE|Wv^#|AX`%tt`Gf?$>n7#F2E
zp7pTt>u@V|3^jzGgElkgDD>$e3=yohu+N6_WX`$(tvgjLsOrN&Ua!^8*3>q+{tCGU
zrN(lA-h(a!k1JFy!x4AHMQCkbbg4moDx9)G#0mV29hk;mqExv5`%db?!A1B|Yf4u6
zhlb#18;oO`>zih>&o_#?)QY7}05fbGGEFA_+wjw%`M33p$P2j>1oHs1h*)Ff+p+Wp
z;jkO3ehF4eGczR!CS^@minv6g;8s4XCCy^J3x=XHEXBUpAZK2XIch?{!pfqSl8d#i
z0WW)xZS-oPr$$h(O%2{k6fgH2?-0kjDYVc~g-QsQ=9?fwthh=p8MbZPzj`{6`YL|U
zDEjKL0Kt2HWx^<Vw=E{7ZVg;fdQ))xXQXpsl%LwBQ;Mf%yfxKPAd0&d5S!<Yd?w{;
zmdUB{5o%OS2EmSIIqg-cnS7jiyM%UUl}ct0FIB@iyO9fWoe1-SQ3QkO2jb}pm+;CX
zCC3NAJpOW9QRgC1dT8-wyf!0q=$?DC`=A}lPCNRn&?&dK@koSv5Qi7{gvevXX*}_9
zx(Liw@9T(}2fIY%&h$H}y!4xj)tJa}FwOVWyxOC$iOWn9ixAuDvo+1+;PACZigKhW
zTG=HPx{P}q1H~cJJMT1fXbf1ZU~(xMfm?v07J|{8{ozq@-@I4mV_d&Ht!&I1K}IJg
z_l589a3o{FYAp(L<cBQUtVOXMC<e|m0Ff5w-7sLdfnReodChW3IN9Trl5p>F^_eV3
zwk<qltmg*Mh2aAvY5r1c>>iW}Q(0W}RamjEZz?4|N7xWx27_r9A1EKMZ%mKWbGqj-
zB+Xb9V)V-KU{cLD_0AVb%|HBUMJ?i#^Wth0dphIledzIgV8Tdyi*y8Icj4~n_(tr4
z9jDkRYlW7Nr^Oq7ahh}CN&cBpK`c31&B<@Yt%j+z2fcl^p>nWwwLJl7wwdPJ+9Y3=
zls9){<}D?fyIbJyb}A<eM3UwNQ^o05?q5k5*;txHkOZ3&>kh_haiiM3#<vS5PuJ5o
zdOLK;+o^Fgb$FC5BM5330rltAIk$JdDKVU@QKgOi{y}LmAc%*a6q+~TYneIjx-V{r
z3i36SRqa1IMm5FdO<VaFm9JPp6}@&HVGe&1K6jrC9ziqt&z=TGsT}NWT4AT_#?B0H
z{{H>~BpdYNJ*bah|CNUqsTrT_v(FVsQuKV~E0qW;y^p+eap9m)5~1)R>&=0)W7liF
zeQha@1>uB~^X2Ipw?MEUH!Y%bF|;gLryb6nly%tZmYOZuIftbo)Vo%kGc;%%#g)Q(
zti_jQK-Xm}Ls-&rELGAGw6|`S2lVh**y__#Nn0aJJ$6`QY=r4~)h$JpgIWj3Brl81
z*|zh%OVjV-RlN+O0xPbes0!j2g*u}FQBPMr=IYKsv_=q~@~SMeo%E!YeIefxN#XL*
z^J=!IFK3srZ#_`0fZW}$<bhNC#jq?Bh|)Xt-v!laa5`UZX--UsWRpYG^68zYtgDGr
zkPyz!Ok(zEiH{$no@Ny1xpE&>qQqFt!Uud7NmIL69{f~yqcYELI802f@*EfxuZoz!
zxQW}o5ai~1wN}#)l^x^8-!?R--Aev^qZy#h6Ma0ol>U$B&)-yQ<@j`CCkcP#ThGG3
zH;4I%Oew-HFf#P*S(9o}Fh4&lbNjT;Sh(qC_WVp}!<}F3)XO1>`Jv_GY$wMke-|zq
zr~}0p*uChAoQqQN5(|ErQW?In6^_*2pXWdfu`<d1M)+GQS5{uJL&MX#od$=6%1SOa
z?p;+B^!XafNo1VoJtT+HoG(D?-o~33ssW`(Xu#Ca8@>6v))aXw_M?sWB71TBd_nQf
zMlcpWnYoq{p~?Y6Was%<=sx8xa>yC6Sxf`f^+Ll#5nm+G8_1`g5kNhSCYFBhEbtZ^
z_0ijl*JIWDM+-@y84?i~Fy~F}<@v&tNsh<5E#3NbkCE&-&y(54Iq@+C%NCCndoo6R
zEI?HvyA1+-<ZmhlNMWJ9{jS|IKz{@RoWVkB2+f9+_-9E4te?Dd|Gd9F;?gfHDy=qT
z`g?ZcGbb3vjROB-e87bP`Pm-o#rr0b&s2SH^4b|`6EK+9gCUA!mL(tDo{~PESbG)V
z<=LYClJi1!A-LWNwydLJxgNl8lBz_(E<Uadud+3NE^cS2Kx_K>{rD#bnBSvW(@BNd
zUt!`8A~>UGYr3!-tak+paoR>|{3V&ZLv9F4K)l68&7z}&44LZ!0bzz#Qy$lzF#5yo
z`|eBzJIeZf9R=?lRz^2X3VzhoN`B(X;rf-KT&|>O5+}@YLr!?Wv|ad&>sfQ2t;_>5
z3u%Qh1ySLjfbxH13L#K-%+3F!l-K8l*H$Ou24Z_SKkk4o`FA}ZJ<VEmcyhAv5r~E6
z+ss!lB<L@zMa@w144a<AT7UwQNIc3#E|_cKr?aOd5n86KHp;N?QIFytRLj2Dmbo(W
zJ&V%rHJgFkm0zor*ND(6WwC3OGV4Aiq!)#umV$Wog*EZC(=lA>2*?9>#@EL;Q8xm6
z4;DYc3KD++uDAkaA8)|t>c@5EO?pFHOi4f21RtVa-(a?QvW^^8W6H{hB&N@|@io*3
zcGkv^Cu6;tpWxXGeU#7Vg!r}#-7bZ(tK<y;o!%3EIrvU;ALuK_J?^?v&53^8)@2wy
zQDLOHtm0iF8HD=pY6v}^sGx*tRwp^$HOEs|SK9Mo2!bbIY92FBAqGe-T;yY(<O@5v
zyWjg20Mb63xsVT!)~N~ob^*B!^Ym$4x9pEx?mK&Pq10p9#C(~ve^w+ptA*Mkb(&g3
zFHV|($j~1V?1FT~{;#`+l!HT@Q#q?60h?C+|4*MG?AjB<gV)C7H$$7CA25c1CwGKC
zro<AI53fFG%=)5$fucuZ(V$6n?~rs`o%_mHUdj7pA7~Sj%A<?|1Ac+fVu_C<Yd-+Z
zH!Y&vzW?!+YUJZ#%D7gk*=GpYuW!XA3W1U33U8|HlX3OTv<$-BlV*<_I%(Z-HY`po
zAg$JcKQ2`@e8p@QkkNlJpx*jh^BlFnBG&KaK@!hj404$7;^jnr0QA9Fj#6f!aj}6#
zc`d}7hRLh1wv+nv2qYKvK)bSVNqSc~%IL^q5K$`90&KiP)X~Ckfe5!@CB~|>Vbbxo
z9`hJJ@ls;oSSfFZa}SUgviH=kma(sXrKbf3wEo5kI@ME<$y75GAaerp!5y9r(>-#$
zwCL!lKS4^ScpxZX>)SQiFGa-k>gLfps4(R}ejRv0cB#sHfDXq^LZX>mZAj@^I+stF
zf+RSj0WSh81IT_J16%?lEt2aWj<#)$Y$AcYE15P8av{2bKq@5Q!v}RDUYgqx3AEG}
zA8OnQ%oM-Y1g#?@C(sf~8o+Df`y6AVCw6`y$qlTKX)K`YGogh~x_|3VLb6SXr_1YD
zcBkLDuWjU?au)*URHGD0^}Pbx@33Cl<aI=eR&CYvso)bipS`CqnW`hEXFr9x!A`3Y
z=8+@if+F(O?d7th<go+8r00U6Ki9(7T8R`3bYu;0)p9#FwdYlx=2lTv*x*o-w@t{g
z@Ir)y94JG?751Q-_Ck2&HIciH(-FN{`i_5iB-qE^gZ7m->!Me_BBH0KS(|lyw+X%(
zyXncfCC7VKWG*{y#q}eUZ{TAvLV8@?E#!oTkIQT<eb)qP%rKgMEV&DlQy$0_kWA6i
z7|hg~nHM*uW*Y4b-c7o@j<`~_I(r-lXtdNwS1wCW{_-ii)8!MwZKSlw#7;(ajrUFk
zH)$VZjUjY>5~8HtetYT@r)2f3H#%0vPV>9`h{7W-I;}!%MP&Pm$7fil<<*xn2Dq|j
zOtwS5j(gVbct*2!-q+4W<$l5)r#!PQ8C@;iUkaMFdcF><I(U@_-d`NzMJixmW9zLW
zggZ`3TDVeP!#w`s`y=>LVB8?_n}@4WBOckW)a-xcyHU!L|Hz>-@UQx&HgkM0xlqKx
z*iN54VC(LaFc@wT6UskD+uU;P)kmK@z`(s{M@Zph8!5Q)ykIj=R>@<x>Mw>562EL|
zhSD@?M(3xnW#_qVd&DqIulJ|`srAcly7g?1PuTtatUt|al-pNC=caN+uMYi)ec-$L
zn3bHif@TY#+d?4CSedmNLDDKK{S(Q{bV~&wP3V@px7jXtHw~rc1}srG(^&bH>qm;-
zp4o9(%{qSA5O>|wy?S#fz~X>WYneeT<Qf_w2Uab5$*z5q+=395N@+h9gUT@y)WH)f
zjdM6k<%?<j6_E~8Ft3aQ7-#a#$A(KL*iJOE$Q;(j^*!Hs7KZrZF(vl*O~!I)YfBi!
zh{Wj6jwwe`N+l2`jHtQ0hCVc~u&IG5Tny=V^%+~A>@fnRT$r_4@ob&r!-&lJV$@GN
z<Ra3vkW``0M^8c26WKu~^(;dk(5Xn__pp_wluE--TB~w5pdEoYOK2|co8sK`zPoMu
z*jJtCB~g6ez;FFXnQV{Niu0Scwx$4?_yrDn;Kc}dy!Qbcq!}Neh$K;pBT6LlB>9Gt
zx12yXajPyut`Y5;g8KOVu+-K?Y1mgpCR37>j|zR=vdyYiwwmPHQ2fVdo}Bqf>rMQ}
zWcq+S1$apR=+D4N3L?G$!|9)Fl=3Kfv`P)QxC1T8wL|Y4w1vq(5{YY7g@P*a9<WHw
zXFeAnNi&K%rvw%sMlGU5Rg1+0lpb3uoPMd_Zm!^!41TyI!!w`Ee)A(=;Wy3G`Dyc-
z7;@(%4f3><ZtmHQq#Kx@;AJbPk2jnFKMt}1<=f`!r|OjO>M8q1?{S=@(U?`N8bCQ1
z1dh8xtyY4)&L+JJ$VB!xaL~q`Kat8CSR^$3{^!Q*h-#;I0Sfrc@^<y4U!n<h-w8?8
z@^TfU#Y<(7o%vImfviIF<F2B>l=fzUf{c^;vMI%)@<X{4qLRzE8SC`(I}SvNsb+x%
zrtCUJm=yWN=>*5g9pxsJnzordvTlX9Wgg1mg>}_Mh%&W~QQ<phr5eFK(rru`=KXut
z#~h)4YYnya`%8}#S9M!*(hy~Au}{D*%pTE+@>1eXJ)z(ZICJ(D-DT^CHP>{g<zA4Z
zME#n!fsmB%sOMw>L%OMTAaS|+!{iiXTM2*A%3sNuO{_^NFT)ToQ{CW!C!<NB+*g5@
zdvk?s43)43!XV!R-kj)wpN6zAUfrS+E?VxGr%0GfR2-lWryzJGZ;(r2*_p*0R9RkK
z|6SDLRzw%fo0!{6)p(1S#X>-qQdKUiQ7)H+fc86i+!RuhzQOJn9D4RLC|rWwhGC!X
zjG^ieFJhbF*E|8=XMb4Eu6cN$&AqqAV@d0mY9BPk1m&Uz%S=A9`ljs@)d3DjH<k_b
zz5{;c1l*RVZ@oXv?H=};-KCl_*YHg9u~dtGurw!Cvs#EbS>RS}!Fg~PWuqwcSNazy
zQ+AQ>a}gg0cB<dIkiqQBxT*I4=>x2P3305OAZ0Ww#w~YPjVsIJ(n5@|dXURsM+Ng-
z$ee_V*}XbGWQy^DY^#$(<91cD*CyvK=QJn{F;~c0sMY$eu3NtOIUH<@GI}eiJ=B%F
zAxj<=@uft|IfBC37HU^uKMOXw`P$1ZtK~1^GhLiu6Uh_ljCK;}B=}+B4K%9<7?0AM
zb_LVqJ&iHq#Yv|fdcx!;&HrN)tzjso>fv*DXU-fEAQHGT8vEV?(PQ+ugu_)67yRrK
zZ(^Eey@}}J^Be3TxRRNj2uRj2aS*{Z>{mG|Zu6Bra4(F~GaFwMo9ULB5``!I#aJ)o
zR62}OJw*PH@V7?K`wA$K4HCMl-3Wx&Tc!K8-+yAS3jZn|QX!+*%@Aji@?1?Ts5_;v
zu1(rAieFNT0dRnwf>8uex073`f@B1Fkki@Eit!vI+@W2F<k2>UukWc*zdvg9NuW7?
z6?%wW!2?WS_(M~G`>~kqe6u}frW!~(C@nd-y>=>yz4-3h!I8hOt2KBY*^b5ge^`6V
zs3@bpUwAA~6c7cJ25AtKZbn2}x?2RKLArzyk&y0^?nZHF5Tym_lt#L{1_sZ*M(_K1
z&iVGP^?tymtR)P?wf8@M)tS<T3Nm<$oP1>tnuH+mMFGwuBS8;?1_{7#OH6+`0Ju+p
z7?K3BL!JY!B{NK=;L`UO(%2DrH_j~pwZh*6Uv<DIrM2zDTvx*#5rw;sSNX{no|-Uu
zP|PkI9$cu0Oy5m%=Cp{f9Di?||KVLVP`gB<E#df9!C6xYi$CMI&c9@kP$phEU(o38
z^*`ulUs$Um4bDxKHYdI#S1I`fcNHx(;6eFFMDO7wJzrU~b2ozh*r4)rx9t#;wZbXP
zQ$TFCJhE<oHfS|{m#4BZuQDaS2lZzATPi~n{A@Z+A@xvWz5T8nb<j;MiKNgBcCiTX
z8qAl^5u`tc%aC2wmwcs(<LUNxyY`I7jHx<5*6}!*1}-`mjO&wHu8#l+pkAVQg)ix0
z5F^e`4SKS}q2vOqe6{ys6bozJV==$0%jO4!odm0cs>-sq+gmtHMLK%7rz|T!>4}b+
z#H#mx<|blhYW;D*qN3^gTmI#CbG%I6s>ZJN#Kx`ihcDs}*V_+^$LbB@(`rY#*F8JJ
zDPK}+-vcU^k=A?stG^3}atqs1e*b|rlr*r}ohJ;2P~CBRK*lDj6z}5mri0J;CyW4f
zh#DpM7)%!J`|xhtYx`JJ_)kqucHc^x;uDSC1vLSVD`zc-0Im}Uu{15Uwq>NPWnf`}
zo4Ga<K&1@kY?O+?&Y;t2L)4P5O$9P@dNr^1+)K)0nkDFhBkv@LuDZ&W*rD1)G>_`1
z<6-eO!3w82pVgwY2{OfzJaJ6~e^n!{xk;=gw0Me;{M0~f((6lzngPQup-0oi`1sR)
z?TPSc#I!9(Zyq6$Bs;&~p<4yEx5=Q~kD|kazGVw0Zgt9hXrTm9^K{4$6BbhlkN|rb
zMS{&GaY#)`?Lv4pW)`>9OAw#}Z4dsyw7XoC5GAxSZ9`<5jRofxMKsD`I4IJR8(**^
z)53zs@M1cnU;el#1{wn(F_DGH9p4EPEt>$9N#%bl!TbL@UI58F)G0HE-~#s36Cm_t
zeycj7f;B=G-3R`+Ws#7P7(-g%{Mn3<2cGY4#*Hy`-|i*a_Scif=N5c)hLEE2@#+C#
zdt~yS8wG3@$2H;pOXakq0K<z0k;}aWw=<*SA~BvBK>UF@y8k2lhUzfWU&bg1VNol%
z31{??sk<z{@%UCUPV5WDZF053AYUIK(Bczq3%Z&AofK~-g}wD+<-A}>O+Vh`S)cE*
z8_x}Z(`u|<zxpC5hc__h?pTqACaCC={jP?c*@m@Ts|xZw=^4bSS^1ekzDlL@bM2^2
zDfHMM*hfu#{r2YY!}0Jlz_#Pfqv)jtx|v8X#rUPL3ryw+{&iqnf8}ttbY^Zibv?Li
zK=gND4B8#u;qBa_S#-kQyOB!j6EwHXpn9?cf5O~q>Gnq4@YjoEjXewR#*97<#^5s1
z*14iwY+NRSN9Q+vQLif3-=BoKgJrV@HR@;cfgw5x8C@<a#GJ9Yi<}!cKC57TBRW)H
z^y^?5{;>IHIC^e$pQ^LrPW{uS-2?Q~o7EQw>|~T#)#p+~n-S0BiFbSN+J;Ho${Qj`
zQu3gTzcVM2N~57Gw{N(EJ)-%6duCG}Yw4O^$35sPb)274g<66%C}A8PQ^{;gDW@$r
z3D-0{TW{TU6%V3FsU`e_QoB}C*P~aBj(0+yEq8~b!TG-ud7^qwpC2mJ!n?Ih&~+9s
z+C6yKYJxOdNd(+e_UOD}eQ(4Lz8-j|jQ3w><J{winUyk|0~DGyVOKNguB=~)4Ta9B
zKR$xVBMl*TA<NfnwDyvP#c8Ctd-rRlp`iMgIkE2M<#5xByq!{7kGx3|_%wVVVNbYN
zd+f{ID4A~Fq`tGC40re~Wn&O?W4~nt7#TndhnEf+u3&%QZw_rfB+L~Clt2-ops<)b
zcw(*hw&d%s5#{BYAJ_i;X!Ldy8<%5FYIJmGsqUsew$#qT<!$9y`WPn*Y}g-Ic|*6}
zi|GcuAT9TyQPat#0|d^@+D8-TGm#o#XBH+vI|dx=2IKnbX^9E#YH5FE+g;FktA8kV
z8(CU+67=}!R_h+Howie|ostsFMf}nMcuA#k8}B5Y>8Lqnm!38DO$?taBMP^|T_bG~
zi&2zWlK}Yq07(B69$(@dW2P3i*n!Dd_7kMat9Wi0bOAsKK){f1@u{TDB`<mQowV1E
z==qTpzt_L267fXp`b_x8v&@gSpEEKtL<Jw+bOnWr`IZjw9TfYX+yCT_t>#%X_F3~e
zGYQWA5bzw#RgLXD5T?u;Nhq=L?^kSsD?-z+6|<`UeQqsq<1m038|V#Sgergl3A%6&
z(5=74c|NKQpt%4_`dzk<2HL-hH6~o8=)2rs8k)=}qYjQsU6lvzoIWm>53!k6)`;&*
zJ(xv%wO3~+Sy$blcL_ok=JXJn3|3xS5(f~M;Y9_lwDdUE@Bxv=mc;g_#s|))6M!zt
z_2p0)&vzgyDmd)B?zn4U)XcM*f$fs+p<8eVK4T*k$`v(&OHV6^G*Wlyc0cb^js4{Y
zd9KHd%f70MvXMIbC*j-rm@#A7G`|s9#0?|Xu)dr6)?2b7XGeZ@z-HUVu*aPiZ-;2S
zD>7BY(l4&jD_cj#%#Kuy7QRjY>ug%caga(@v!-pAas+>^TtQ~SAZgt@_j$j})e^#f
zkV4(edW%3;N73(5#YgPAs<<h&I~n>tGE`!%mJ%fvsnmWp6&>#su<q>9_)~4;?}^67
z7P&e6fk}mQ-$iG(iM8ycf?3lXFRjyGyrsvm)-KB1ausEB;Vp6Y=#I|xI4)O<JxQj*
zoke#i)O^{HcLi>*Z(i(k6wi>LU(M?0Z}x{2@Lt*WfrsfsJoh(CZ3jkpdra)x2l7U&
zjr(~BDB?1!V5Qrf4BrineWgXB@^qu#*XWLn*urzZDlRxt681ZXKGL}7%6ufpqr$++
zf61R8{n}A)Iq+3Q_2@Q3d3!`}EcI&zENN77Ql7}+ROe>un#Ge%I={vg&D_Wma_(U>
zgDg$UaaMNp)EKZ^=lb;5UxgVXJW(g<A$;W%n)lGuUxCO=UT7g4U5Um%8M5A3e(3mI
z)7tw`@z6MJo3hbQ5(o$u29#yzr6EQCebtu4`w_O34XsiVH+;p%g+n`BA0d<v^H;?n
zFR3Bb<LtC`EV8q22oA{bSy0xqt%K{kYF}7Pr#NszflRERoiQ*7Xan4IYEU@2fr)fp
z@w0!D&|KEB@DiED_arg@iI?~v6aQxl=D1o%F~I0*=zsz+TLD2)8rb=P@MvHy0<28H
zxCo|G7!vCHz&{|-BIa*Mm}(?R@0H!WCq6USxm+6GU@vZ|$!hfFx1l1lS&~!b0aZTQ
zm0R{ZfP8@u09ZR!AQ5<$q=UX!J*j)SWSYYB3Q(Gv=F@ivog&J<Y~G_y;}uJ$GU`LX
zJuKN$72pERFVG{WIlsIc!i7HV^pq7`b9*=`iCD}|dw_OdKhgMf;#m|405f9ou{y*q
z&#II99_^ClE-$-E{T;b&;b7&R)UsSj)3}+Rfw$t{Z(Ugvyoe1p*f#K-H^h~)#49lI
zdCB%6i-IuiH|4K_7@N;)i`r)`YHId37>=y=_zSm0$q}VPh^g??iq{~7l^-xZ^8di<
zsP-+DCl9!0PVWr?75er{X3*IA>`o9!7KR&8-BPp{e%;2o_gI2*VOFzR7sR;qi`{Q}
z=5ucai?y?!%<QQ5&V-4n(a*e{RaB(G7tO10Gzm2uw3PLUE`SHqi!!=h=jDkva!z8M
zEzeki=5QUg)L^}geZPml+h~>YUily$A16L?nqzWMTJY|u`R4grcBy-fBySjwYKgM`
z_z!RIkL0!=W<O3zS&t?ntAuC6QvyD19>QZiL{hRfi0yU0-Iuttso%~>rIQ*&sKU{{
z<h)yso-fy>2itKXsbu@c+sJJpg#ab7ecj4-_y*Vj8B(RV_gGEZmE1wKd1{L;<SU(-
zHMoVg+|kwRx|(%Ia`C>$ZF`jgv+>tQY@NP2UdE^J6Fw2CCQ%xBomQK?2(L<_<|`u-
z7dsb#{j<v2^fF1BUi+mB5D96hzQZ4>?RrG9R=Io0nfz`(IoIW4#G{?uQu`$m@*L%%
zW*sm$QpU<hY0ZUZ#|{%nYA4L%x7DxB|E537rAAhTfLMU?nK`|sjABdDtgZT5_a_23
z`=$Eum;}sUgQjG<g6Oz$?_8nFaCe}vqB3%yPqLcU=VE31uoQP{!Nv7uPdk0WLiF>T
zbkrMmyf9*NWPEQCSb;F7JOG>ICwQ6fB_o@l!4P&U%BrOQoWS0`(ncn<UjI$b+4B18
z`Dz=x?mdN=H6aP|?wpkFgWqIY2HN<h6rx{a$1PHCRwBbUby_+mB<Js2gC-SH-ltZ)
z+HN6*2T=1SSu;P(Ds1ysLX6uk@1HY|R+X=b!s51UzM6c9B7A{A{jwtDW&N)Sg-|Ag
z?Zh0!gWQ67IZv&NuB@i_Oy43(2@q2T&`fDxb#GMD6<4HXn=YWhIIVeAy}(L9zM)63
zB2V-8So8woncX1BlaYsH<b>lM9cspfDAMSg+`RGJ=)ym+*Zb%}<z#>+nSauQbP6<K
z7+jeN7X6mf;!Iui^vA`@1#*MoL4hNLz^Rsh7+kjNQ`LFeOo0uu0kVvA<`aX-qoaYu
znI;&pnPEs!GjC%4@(KXdT#DM)$)tgceWFZ~kyVs6?tip&X0o!;KXF@p;hT6!^VUMz
z%+!u2li8f8pfH~d%x)~`i&5URWqjnXF<m)Fdzz;9J8_KQ=h!xAouhhZ`Bi`U!{Vg(
z&S$@Blu%fs#CbQf46UqFjz~EB&bA*<8sU^XsrpCRLVLRIy>_azZnWT;X7!2G9A0?(
zsjElolmgnFZ1k8T?MSn6=;CSJnGmbK=!lT6kXy;-{C(-)N`>%Csw12q&71`Z{2QJC
zeoOl<w%<Yc-CyXBY87{k(RxLDKS&NW)<jc8thA>dgl0$neL63#$-BD-f8|=OHB7Wf
zXR*9z94?$TnQ<gyxHCVU!!Ye19iws_F0eb=EC*P){taPHwFAE@i?jVAZ>*4bq9qYH
zb5?S?yI2LkS?65~r)3-;35k=l;7cesh3CA|d}e2($ZN}XmLUN&Nq!L6C|ley7ZdSq
zfnaPvMTzUldTmC7ZnGEP_`SCiwfN7S+AHjGOS0W!i78(3ARF55?1^6b0|Sp?*=f)M
zGqcuG!TUTRo~?>6Iy|7O{jp+gMM=@vulqCd&4lqWJME%kt`}4Pxr}Ev@7S2k6{^&G
zi;86w;f?$GHauwA&Q4u^Tl`4s?^2iEqRet$DG}tbL^$o<kUKne@(!shRHRtkh<~gj
zVRQE&?141Z@(N2V%NLr?WYxX!i)QaMw55yWuHFX;>%dULB}wsp{EG(8ci*5&189>^
znt*vLd6HW=<PSO2XYvhW<z+EZZTP8<7=9Q4S?3IrK5Ztyc0j?5RDNA$4=R=l6EwF$
zP=^t)Xu$N1U~XI#@d#^630zox4;&T1&Rj}D$j=Xxh9jR>oFh4K1vt&_4WEVp$2F%z
z@Pzl<e)qJMkihl@1Wt(BW&}KAR9dc)h`#grAe-Ntj0YL&cmw!0r5l28<vAA2W_Pfk
z2;yAx+z<kRIhUZo96t__jML5l+PHUOp!_MNfI$m#4vGMVimH%NBAD`+Er4G%qzi=7
zI#nQ+8h|Hxs!+`bMb0V{Xd{$*ZJTG3_zR#Fm&0KyZG5)F);;~}@PW;oa9}&C4ebA2
zPy1qftTi~n#dVltdWs@%jrAMJdQFY=TZ}kT9-K^Vs+$5yVn-8ZLt~1MlyT6lDDb}?
zl{oVXI_G}0rT*gcQf%}}^p>K>7ab;D$KU&SG$jT*8C&hUh{e6LmS<Xh517=I-@?9K
zjtgSxO~qlpQt&dvhqltf9F|{dGhbH`H?98DAw!a~MGXnCVD^=r^*XaJ4XNXbjW^3F
z1!sTPJqn;&ub?_MzOd1z<f|mUU`z~<i8Mh!MkrYs{?E{<A@^JK4~(;9b1y)%Huzk5
zre6XqZcpbxEAzs;-gO4gdY58zl|uT1;$ZaoNL^CvPD<KXJ<qH6M%jiujk9{;gG3cN
zt=d!xOT*}|oY^RY85bW3LJpjqgtypqsl!sKMAsI9k-V*0UE%{sQ@y%o6+d$BYGGE3
zD`fK%E!=zhs_|TN?sW7DqCkJm70dI-xaMYRkO*v3Y0-G5YY%5E+`Fm{I8xWX=`};v
z1|1EsCXhL)<eTzus%lc~oGI@ke-)FTk8IY!r+@(#LU6+}x>mT@g=EhDZYB!eoHt9f
z<SjJN{k5{n92U09cX#YDSVV~Hj}(=Tt?Vu>>2*kI&@E2vT;$ddwiqy0k4`CPNta~V
zbofT6shEpc2jd5-Hxz3470;Z$`RVn8Y7!z-B50mJ1h#u=9<t1ns55Zm0*e9A0D}8h
zBP>4CaBa_~;(ZJ@F74~!LvDI6tjvXtAfkpWH<dpy^$FTXzc$0qkr573pSI77a*;b1
zp>x&Ort>)E9<L1Gab0vC!_(%pN!!ENZC%Cln5%;G62RWm10gsVDfL@W{krPNms46t
zL2TdO7wBJ<-K>aR+PzX$tzG?#qFNriFB4R!W+V&YQ0CcPA?d}bU@r0~1)1y|2>c{a
zC17UPTJbAAMJyyj&b9@5SXPaOrwoQiKY?X;C-dO}<-JW5*SpM+e(mJUC1?X_DaIg4
z{<k?6`j9D3MHaC|m7lAcrRh#&d`k~_qslw+ijrGAi90_vE^QS~E6dSiu4#0>{Jg2M
zB6UlVeVQS%AwaP#$BNOfOd3n(h2qP0cxSC!R?r9y5z>kjUskkY>K18LJ;MNh-8xx`
z@MhHGd^fy2nnuzr{lgZ5sV6%foW+k3ZPhZF=8RDcXC1AIb9!Szl-;?NcZ|8fUHnrC
zI>48}N&oi|^S2C2S^#=h34md6?iX|>le#Eh9CuD<<#6#>JxBVVsa91~Hw1N(7+UE)
zzaiaT(0+ROZ7F2~htGrPr(HFZiX1t+K<_{UZ4(^Z*~Y4?c0~JNf?<J%>Z|=m-qwZi
znP%aM(A;*wInPy1ji9Pg>kPk*YU{J~m8{gsv!sn861A`G&cd8Jy{fcNc6uV`KEl6P
zXjoiMw(~BdIeaCYwy1NU!58>OJ?q3^aFev;w?t%2;F|%Ni?u_*M`<u|S^@0V*P{1N
zs?yzpc8eEh^7QVtusSqbXI0*RO*VFMb<|6~=yH_h%6{613*24o4<%QVGzw@XNEeZ9
zG<Ti~z2k`9nDihp6gJSFTs?NsF%YA>N03rR9;6<FX5AS7whQ-lvLhaM7fkuYncw2d
zabDhjAe!3#ppffxsE#nIq&KR7wQ4uMnZl~cZ%bMJC_&&J$0H{Agy9@CYd@%x7YSn)
zYyIU11XWi-DSVaC1nK^vIRntzFw#XlZJZEiL-B!l%f?B5_!PWv$Vu5=_Y<%;zRw-Y
z!X>lExlNUSZZWNsPml1BGMZRlSNPs-(-FsOlo})$JrM8FevGAi){erl5)wEK@AFVK
zZ!{YJYqrY`CaoaICHE@$hWAx~=`M!w|Cjk62a1q5G?RfBbXknamY%F}oI-;3nSBl3
z;vvOXWG7Kjasf3e$aRZ&gPvXshhD$uDq`~p9&n<<xAkPK0kN2;hZbQT)0@Hyd>7IQ
z86+nS?5JZ6AFX-kCMbYtgR(J~EwGiu*vSCfU`VR@ck0W<n2}>ZJTSdkKsE5&H8${A
zLe6LJptJ&p%0DnI?^xSHT|_Zlwo0qlQOg?qXBjat7!eq3YhGF4FT2qD1DlvRGgp>y
zNaYzV;|?sD`(i4Y%)x0)Zy%PHqU$1Re8Vr5r94Z~#o7{ek(Sy1vA~grL@PSpuDNPx
zG}TJ<@sP75^WBfS-u-QpX+^HZH|Q|L@szPe5Gp3R^if-Y*K7I;ZS$NBv*!T7n4XC;
z=lH9~F;md}rL-C3%;9<+e#8!&^>xL%lD1v2GGhRCPwS(xni8|YUu=GxtHK|y^;a!M
zqI{m|C%RAL-4CJ5vGZVAMcJKD76H7neVH-&{8>0@MRxUBpG|Ln_z7@P!Gn)l!nfMb
z#}ju+0w#(zg#!~VkYJ_r-y-FewXrnO!L!kLkktsbcdGOF*9$gElJ-zHO?zHNDiKUD
z5?ymj#R4%0fdeX>l`8{OWn$<1CmJ_3yo-X%HXiR6{o)#mB<3F`G*W|MSFjOL{9L!O
zdbssElEwvfDQWDygptv-j<cfd?&|o1*d#^Hd2(?QAk|3=b+4@Yog$_4G727TGk(7Z
zdwyMO|L5_&JMuJL9jysx(MhJ*)3Xjq_jP4~${FQy-jsYJN9zY!!lt1rn)%JQWJ!*T
z{&j#6<k>FgW)JqQoU_vRd@K;pM?N~@Y`c*n>9S1mWWf<Rl3O!>9PLE<G{(T+l|1cO
z%C4>W<n|v}s{mxUruzr>glIWtl2FB}AdHo*dAQ(~yo9^%VqPR&beC{9cezkUJN?)~
z^kJTzCU}elE_T*WhSXGe%IVBIL%#u7Ts{Ni^9Pt?fEPcL0Ze6H4g=mwWW*duI52oG
z>3Tf~jBqecc^W@O3o}PA{&yqy;>6Ec;AuHdC_bN3+sf_&j;i3YI8g{@YXC5tA?`OD
z?rIh70A-R>$BRK%_;OGMUU}b27?px$Sl2G=s`rh`FTtB0Lmf{;+a8YrKE8V$7_*R;
zsk~Ll;Ekk*Oix2IpH_p<J7dPLAC^f|7oXYBYCb4Ad@j4*D5iayyA&5m{u$?HTvSz>
zO84+$>%o#|L8>;0WdszGd}d}x?c|af4b1Mts_}{LTmtOQb2pePdeIR`o$L<Zm3~;5
zI8GA#j>0=!tu=jTk>tc{zOjD0ZE4ND_pqcuV$F4q>Bm&VT@B&xa{*_o>>v3vh^%y&
z6d8WX*ui{NnP_aNet38V73UhR2-#wwd-%of>M8!Ro~@NYc1mQo0mu7O<34A?*rIGV
zPvsFqH0d3h9#XS8?D?6U0-1&om6~|nBs>2{k7DE=pNTZ;_kjH@BGj4KgCRC!E*xb#
zd%;W2d_>Wxsv_@5-)!1THATT%9!AimjhkJ?I-#v?(N#GjT;)y%1RW8d8R?dyf(~e}
z5t+Q2F!ssv-IS5gelSW>3af4XMzxW4?xbm!H1C`&SENTMK>b#;5r#A0R%Y)JN;0J4
zlv!W?kCe<M2@$QkNq}wmKa%pbZU%F(LIol!HM12#XVI8%vJM%v_ClIN1B-X_dZzPo
zI51fd)?_J$exlS?l(%D5I#or&9FC%sGY(nNg9qngWiC5^U@bGaR^yJ76&o&`O?A2N
zR-4KJ5#lk*`{`Hx%uJ={(<$!aQU#l$>?adH<Gk+&hxwySfwmqz;k@TX9d@N#6>>F?
z*h@`ot0NYtH71t|`jZ_MIHZ$e=|#pg(@*$*x0TJ6u@9V7X62S$qO+TpgpV0djP0%l
z&ANgo81uvfN_@5nwJo*-D#(^O8YjxP54GMr%`_maY<g6}via)DcAHxi*GktAf_A);
zbzWac_3OZ+sAGlNxbY=;9i5HufoRs)uEE4?Zzylow0`)9r#h2Vv39p#g7MZ3apQRP
zpqL)3Qm9~5rGKSYkNPq7Td`T+>H6k21lGZn+0TZ)5D%~2h2{`(8WeuDH^?k1QwV#O
z#1qA+8S1Ydvp}$hE11Ju$rGa%o4DKaC1cHis?mx~WkAkiG~K=#UtQ$-F;SY~ODi3`
z#NT9C<-^wVHSZ5@38=2+<%|BVXKX`Y^N8G*@ysOQA-nV=oa$?c7xpyee46cHv8AD7
zR4zryOLsp)@^@mh0~&e!U;&DOh985P3+5Z{T`IC<a3jsEKG8E%^%+U~#E1fJsL-|>
z>q!<t=vQ>N6tLC{x41#}1n29!gd5n@z@{GTK%+e{c6cDlREIN5M03a~cc7@8yZ~fY
z&QxQ9Ouc0UjmSWbsd9Na`Qz_7FP_VS;+u}Kw+5?9Oz6jDFsy-c4Anx&s4tzE8YUy+
z2Y)Gb@oBNK7Jr|+>F9ob&+Du_)m6ox_JFHXW^}<l8kubTHY*eCQ7?CIu?h)vkteA|
zM)M0(rXO&R%VL|zK$%3wAd?8cZ;(VA@BVGCRpu_{D^|GcE1q6VxJsR}F(5#gHtk3e
zV0#i0K0<z=+iQZvfBzg|FmvcFX0Q;!1Zo2hd`O}Mlt|#!LVTP{BLDBi*9=X3vN*>c
zJ3+@D)l@XCh`r^DX;6`$R^tbP8i?FJHo36UN57^b0FR=@%+`<dkwRTcNilHiUVj5Z
ziC-TmOPF|v5M|As-tvAhnBZD1ao#~S@})?(Y1e(4VQ_RnX(pogAj8)2_qdjORYlr@
zC(u#prp2UM>|*Jo&N-IfR~d+O@d46O>Hl7Pe&2O&AAh6l@oj<jdV6KxCA6dN%zrCt
zxgo)^R-tz<?c&7-f;bTx;R<&0-fL#Q5&H5gZ_42DlJ;fhBjpRmgEFBq<DJE{F<}wY
zOZV*_3gNqe(Oa<drs}p^RO6Q>7OPG8cdHA@9LH(i`ZFqjc9^yB!n4M3APTA_-3NZd
z$3;uOv?*PDS(!xZ@fWPb7xt1wM@g>zn%NqfjfA*Z(0r}}uiFP?Eap(!zy3-p>ek*q
zR$BrIHQ+ZaE2|?ea_^h0ZgW+-YvS8Ku&>wLr#z_MexM}(`d#>W3u5MS{T4E<DJ*HG
zIp8Pok7ebG(a~wlF^@;J)Unafi#1D6K0qs;@=T1oc}naI-E=SPiTWu>f(;~Lrk-j0
zt!giRRS4cmtz%#2$vDwf9)4P5_@Hn9tMYNc8ExZe&^oM7m^wj;uAVkmTo!Q>dFsvM
zQ+%?v2Ea4RkLDf#JgYiE2reZ48ms%OskA)JqNw0r&XYT_+^%UTaVt|EmXnCKv3A>w
z*h5SMgf{lYAOH~Tt38eh@9zOBI9yq~ayswfnykXUu{lu1NvnW$=FKD>S*9yrb`%;H
zI=PGD(G$tvTF@gG+w<oa71LcTVmG^J#shN_P?vs`-M*y;Ao2wQ{m}Lgxx;Tblirx`
zS*ld~#S%uXk5c378B^(u6Fn^M6~_-+^bM)Cc0l>f&#c{@`f;4&Fm^x@Fw2Z`iT5nh
z3-%;4OBEktnv*IJfuTlivfl8S&w?)F&SWsFcjh&_l!gzR2PAOWsd(MWPnBnQzUFap
z^FY?ry$v310dCbS!Eo^p?ZrPm@vm9bvaq$)2u|ub>zZGzppN0`sNsnQ9qm5x%WMtR
z_tg~mi;rC*yXuIIe>`-Mr}t3%w41jk7yk?l#T7L`0Vr{G%$YFemCu#hb}}JymUl8o
zrC1iv2Y)cHZD?Ka44(M!h?y=hpDxX>G_1#zaghoAkZ@vtp!k^Y&aJcKY>wo=Mqj2(
zz$ZV#t0)ZJG&07_r2>$}|CpbctoI$zW`Mj7W-bXrf0BR5{@;-#2eVFX628>|b@RTA
zWJ)$v1$nl=8;x8Fz4oKg{b+ffY_@h7$j{7uRrl!18{wgPGl3YsUrrqpcl64ERdl{k
zTAz1Ja&b@yc}iqE)5Gs-cUopI4JEB2w*ykyhHr~h`Z?V`uz33(F~6YM?@hKN>NBSm
zaO50?&bn`v=<Tk1acyGdF>7XVibA`|>#j|%rG*o=c`Utz;s_Max84<&lF=qAl8MWj
z@?o=hJCii%8(3dIX6B7cHx_+6*;fT221J2F$gVmiJU%%Bb;e({R83#3Hu*y7L$e}@
z`u%Y}bvytjO>gLSM(WGxkyO9p&9W=At}E6$oqzILi#1qsX!-+V6*bGzU~$O9s!bz4
z7abL*UXrVRc0@O4JGUs}>#BNqexp>SLIIT(r)=+Hl16)YN;c%gJt8UIfuho}5inul
z_>P?~!W?a7?d*N~B%tKvse0J7A#%*@kr|gMe3r2=EsrvNw2$)6?$L+&>rcwlI_s}I
zvf#KZwkCBPP<?K1$g=q#PS}GuEA0U-6Sr3(TbfVRV^Hq|Nk6F8^efbbg`6n_?UY?R
zw@#Yr`n>xzF_WC_z-qtjY)$ld$Z^A}zhdS?>b<^$g<8Q7*Kig)|C<_kTOwYBUiMnm
z$PE|CY?IPN)i%V<14E(@?DLnKRfN&G^mDyuRx|6P(_d|e4@L)gbc1iOvz3w(kDFFT
z2=es>t-Uea71!T2Othvu!%O}}^~&cfXmo69s|I~G^(3sWjx5t#G$~GjMWTj3jf@0K
zfw3P6H!NmR(pw7V%$T0jBy}8ibU*<Yv=V}=ep|s7d#?Glx$1#ee@$b(6xG}OU%}*2
zGRK)wv276;nbv<6q^cnM!QxVU-ykznwa&svqCc=<pn>-QGQl;jh}Ul1sx2A*bdb5w
zbDn3ff+E`67KGv_@=-&tV*L{^J6ce}E<+SnV358}VpQj6xJ?-Y>vRjg;uK)MA(Ykx
zCg_V|6VTO!FR(lS90kUq!7-h3adxb+w*Hx+3mzf>HOhXMk^9T^c>&h`Z*L6&KLvU~
zcc4I^4v7f$NGW%3^D*B_1?ygB^+Yn3*A}N?iVb^w`77qc`9VRBAk^kNupE+42gVzJ
z&5A(Y1sMOKWG#r)ikX7J<@fv=7?&Zd)%0g0jq8eM6%K_ue_+M%tzl@%`u|(W9Xi1p
z>i&(DT-J5<x#NoBl>>$v%Y)ua7Hy*vo>lif^E$wi`88Z`FlcCx>*v#~cWLex$J-}*
zYpc;e<Bs+eX__Sc#!xU$i^J}d8Ktv(0n_ySQH$@5SBD!F;H1NKRB3Ze!V+#O`r1qP
z?(%g1{L(lb*_BoxP&)WO%hdmy!Bd=7gTiu)>MEoME}YOvYrOB<a!|yDDALiHf1s_#
zHz<6OSY}19>>#av1$6VfGkBJj9t!!RRV-UZq4h}RE`j--`wY>#y9QY$pJk|iRBqlf
zyRs{?_Mq6S&F*bUcuO0{0D<ml!^YQn<meku3*%Z`ZnmMnJJosM+ORC>pXFSrUokwH
zE2A57@a^ErKw-a{%j_QNzQkEYnQJxJoDB*|07leXP?8aQ?2vn?258x#lFazlN0ht~
zW|F9T<pRdaDzQU9JpHSJfw%8)uN~D4h5?|_upDmfWN9~9?aZdm3^N$$SwcBOL#1lJ
zni+VY^}oi?dRp;+{Z-PFpj_QTcD-?%57B&B#OF=hFU)mCdsT^U5bt`(Ian@O)Pc%v
zFPK|}D3<%W<<N<z!83Png;|GVMnk?pWo8=TGqRS-4~ET+B)S_FlKsqj0Mn~&008tz
z^~budkE`R*)TpRooCa2`ViM1@7i;`vzZ6s>kuhqCH)U_AM!dE_A}_HYBECLG)MM{M
z(JPo%7jQW6u>mHdfNr(2CRDxn*Xqh+KnmIK_Dm%uSDKQlJ}^ue+diY7%ZpwNMNlq}
znT%#>nR}D$7|?wrtt_rzeEW;!h};L2mZL_)Tqi-C4hTGQ%?P{-eH-GnZBp;F&^8Ny
zl7KT-v;y`>oisZV|Hjji3#tm;;7s0zh5G1|W7I92?%{eduopr-t265D!g-wqD3M)d
zPvdaeUa1dx-x*#+_W*6}+N)SJ3O{{QeU+(nD5{_2^AO;qCV<f|&Ig#~5x!^Rw3x5*
z%ZaVb42gbTUF$zUOE+-U&^vEcFSVfXN4^a5as>0K=IG=IQBhmcK2gx|Xt<ZlKAdDu
zDt&{cfu3lAccP97!Xl}OlS{iW(V)-4EcrYh@J3u0?VbY7TnJ9`ZL#cb0l@odc0f@M
znX@TP_9uCNn{0Eu_yN`+qov1lRX$E-_w<F<Nb4;YdF9_r-Id06Py~AbSH@LY#aR9L
z>os+>5&cLu#TLG%UfC~EOSW@TI3ijHSJw5t8+HO(k{A*xHmrzFZYIuG{%{NLL(gr&
zA37R}TL_A#WQ^s+C7KZx-#q6CF+oKSr8#yR6zfZQ;f>8@#^tp(@d~HK;AIbB0=qyc
zX<5!2)15lWU5&H+C!dCTMc>Hnbs#1He5>qxxN30ix8e15(Yy6~JaQ`e?F2o^?Tr16
z8O!4pq0f4BV(2McB}wR#qocu|SyG~by|qF_r%O?C{8%*`$Lr=}!*xSL3lE#p@LXMs
z5#_+m5`ftpQ1ljv$dpAOgMoIa!LnItTz8|2px0-{3afq9&}dv=%*zaS3K{(HE_D<i
zShz`w6<cn(%-Ot>*EV>ti<dU%MX9f-5*bHG^EAIph%zXvrbK5^l;%YJ+;C3D>4ZXK
zjrr=)S=c4#t1r;v1SccrtFDy+ah8UZJT<oXN46hL?XcYLZbkMEy~{c%($Q?MTZq)u
z?B84r7jDQRd;y<&>3ABnC)XvEBDkk3*FkwRP}e%L`n#%<#(5;aNX4^b(aN3CP;NN!
z6GORrT$YfA`Yh{$LxcHA6VFjG!+YcUlUn-i&KANEde0`Jq$jMHk9ZF9Kzl*{W1fQ2
zyzDJ$Y}{~S%nR8(Aw!DrtG7i&cC}@R1uZmG`?p*<n<-iz-Rdun<Y(!ar}5d4aC_7;
z<L4_Grtc^g^6}EXo=(_vs?A4*sIVD@)H8V}ZGy-l&c`${A@4+3R4rC4_?e5iei!%a
z<A))+cV<Ek**I@MBj}(c51)N;AODRRm7in9K+15hpj_-2m*O4!incl6A5Yk770$8n
zimTegm9X;?^#VDm_aWlYH*Fh#T~W+3a3zo1RMMj?KUalxh)Y7mn9kO?!b|>9!hc=d
zwICDs`VRYx4rs%di_8u!<Sk3TKsJFGU0YzYKu8F<*chT3;Ms^jxr7;u|1H4*^3Xv?
zW$C>Ty&YPDo`omm=Y#CsUNT0;2oC~K`a3sL@IhCFD|7>db&~ZRz(YlvjwZu`G&IEh
zuaeq=2u+5FrdajlIZ2B%2zgE03Tq6{;mL;blz^S?M76;g9(vL{Y$hF0%tNP=7r~-j
zMMe2FB(@}^2O88TAc758r(*&-p>PlgA;GK*9Hcw0-)Hgg?HjD5`%eU&)L)a|sQb62
zjDe$ly^Vc?7b-j>y|wxkE%ff`eln~fB7}HHor2CHepko<>;=SaV6y~9o7+f0Q35(w
zY2fk^mv9aA19!&(V*u3n&OED&Pk_6l$x5<iLGdn#sep-fYQ2edYHjvS0O)(V($2tg
z&<1B#6znZa2OFoNPfJ`6zd@07`gw>t#(kXvYj+at^AMW-^Tg(U2}Ltg`+R-+ieh=X
zQnxErH3vkID7x&-<m`<|V~K&q5gzH{`Hou-o9JN*dC!L&Qdc>e@A!rB;1mj78Yq7w
zkS>v-wK2D4vZRe&mVQL^MMpyG{8;E`9B0)-(d(PbOGJy5{39C2hP*4T;+Ddnq>dZG
z+^^UK_L_Is0R%PBbA5l(`n|{J?GxuRBKm9x1&|MXOgGHqg?B;TBx)8EFMkgR3l!^-
z*Nq|^SZhw~FY1*4z+B)<!{3+)$m>iSYk^%xPrz??CnnqTK%%8&CJp1JdExm+om9!h
z1A!EQ->;){<SjQ(vqrWL$wW9Od));k?qBRKps_vnrx5K`u0rX9$|V`_y&?1w<#bw4
z4eO@lwn{bEw8Fl$=jYV}io$D=F~;xm@<mt%w%ilQ!@?*Bi?-!<E*d148M%?@0!Gvq
zU-SSXGWWLH>^pp5NL1tL2TBKqWCo#_*EioV|0cu57ppmwi%ZO-e;^iT7vs3W%Br(#
zn^kNZ?h4_T<spYa@CbY{YEU|*u2!VAgZ4@*(74AS2811#fr&nV+4aES>z5fzu;Bbm
zrKkOpnn|?2fB3AK(><M`8IvmV(--HPhX-hR{?;GA2s5YKIgIiQEaT<uOl|i&J(*Uw
z6rYH6dr-#CmT*1uvwb7wP<02r_$55@1T%hqE}XE4n=$TZQyFL9GhVVoT+|d7(7BsD
zqWx0mpdBVtx~9cf-?bRD&%1ptXK#PK;<H3KQn|u7*f;!nnD3Yd1wFf$)z{l0M49g=
zz|T)5D_brB#>R+ZHa6ZkpPO>>#S@#h<AY2A-7yH9RP3Q41^ajP38B2s&mL|NNvSBn
ziiNfb=-k8lU8~LyY<*YPwOo@zyZ2w2oqAHw;uIzAug#MUkX}#n{9tRsDNidzxs;h1
z^xGEoi8z{D`3V-_*#2A4GUWyCV6-@wtG`D{a;1(Hy`B^)?*B>ewjAOw^T4JwZxkGi
zQT3nyG0*nI%KPFbH2-X5?&10KTysITbGbOf;~{5Mm{+K$NGLit$AV%i^rt5A-mUD&
z$ENVWvXEE+dVMeTZ5DkzT+imdyc#b_-Ol-Bh8qCV^$p?GOXacLhf?ao;yTY!BSkY>
zI+hwyI)=Iu_IA|G?JWMPC#3WBRJ(AgUH-5Uhle~2^BuANzwpsqwtrv>jXi)9kc%`k
zG083s$K6f)F7sl>bIygceYn`fE(I}ZJi6k3%rn3Lod>yntwoWr!=>JVSwnS2Y}L?0
zljC>qrIpmjzGy*w_DxCJx`4|PNAPLN_MKKeOP(6P=Ynyc`%Wbr<mOykTKjm-lZFD$
zI6fZVP4(_kG`{$b#;;PaY6ZwrMelX#0X>PM6gZr1ftGdSzO(A#d|%Rnm8J!4qJT=|
zQL;+AFf%vj!^m2HP4S3t2h@Y>iwNv<$&qvF-%ND(bi5r#qVFQX{8fM!3H7Y<_hxjn
zYblJ(87r^1#jWVS4iX4VYx!ouA-ExyRZe8gCEiMTz3*HfYf5(Xc<pgK2Ss__{G=y&
z&>n^HtU`qyD{nNy${nBXVNH;t(Ii!=gx4hr9C>TCf;Qc(rH_ifl$_Pc?QA6#g;?#0
zY(R)#))kG?M4sS(i%Y#eXd24Ecdv?$>_f*l{vIN!7o1)_-fx|eN(*BdvX6(a(NJHO
z`9>jA=#g5Iw=!bmT3{e<br}@klDA#~1xG}4X}3im{U~l`kDddxj+^(cnbz9H$pmDE
z&#9iK*{(`71PJ68eF;AaE@}RaPhqJ!GH`>fDlo&SKbDYPDxdD|$><{qdZ!#y<KE~c
zS4f8u2nJ1HxO=90l#O_^Ww#Z+X8!4&$SFNP#gEmK!F^)4wm&cxQJoKfiZcs^X?41O
zDzV?Qo7!I%J?M1kP<t^4rrb)_Kd>TUh~;z6H0fHo;1rX68`!!r|L@|7NlOG2B8-#!
z-+&ju+5xyl7a3fH(3vqu$U*8DYw2Q_szdctsQ~9~_v*bfto0L>9nE8M58va)-huRo
zT2V5<8$59-r8!1uKn={ZbYL%N?hID91KcLKovx4aHxF}+W@;!vg~CWcahRFSp>%qT
zViSs71vN6}7Wf2A7W(Gux3p|}w#M>Kb)RrjWDVAwGvBHvGbSTEJcO%C_<3%~K1b}$
zEFq3OF1UZV#$LT`yjhi=Z=wDRPwjU~OO_FsKU5xq_-D+Ih2e<+C=2-(eEAokSpHu%
z5@4bKA8Vw66`56VzU?bNy13iVteb@#SGT_vM%9YCvbVP1_z-Hr3Mz24)W?-noUcQb
z-Oe9%jnQ-aRedg~w2_9J&-*u!fx<=nPyc4AS{@QIWm|=Jf4)CzQ72VCadBOhK8~Np
z-Sl;2`oo{?Z?Qexsc%KUW&Qca;`ery^tf#*AdGa()JGt?o(ka`p$56Wy|6T9*^{y@
zt2*rau`7uj-^zdWirIpy>oR4w$NbO;LHreKV{^3PU!!Bu+@O+5_|qIo!t{bxbC3&`
z8JQ1Sh|4%Ja*<Hu7T%Vb8T_FrDq)X{WKt;XccL_eR}9q+gC^`2pti3oz8)qR7);{K
za-9Y-kfzj7z%4+$z}5X<HjWB_)2^~vuTqlN4cpVS5Kk@IkFE#}q3{B~q*Y9_QybO>
zob)zUI1Nl9eP5n`4!az*p5f<sobx&RWr>T7G2X`vhKELXCXI20_7L!${N<XY)#Gj&
z<B2{m7E;zhKc?n630|mL6n_NeA}9T+ufpsgm)w(LHo_~)-NL-9U$u!jwmb%G*t9-a
zmMmr2ysU}6u<fXi)=KhkWW7sNp3r_gu}zhiWAp{s_t7UD(k&#-m4wJi-*r?t)2*rR
zWZuh!H|0ei@+3+SE%!KltWWUeuF1~K20vyHOs_xb`M?q+Jycg&#sLOI0!p8HB`A7j
z4WmRGg*;rS=H<=U-9-fPWv_j0J}$&qOrx*;W4=p#2kOO4pJ0e8dJq|%G2b_u=f*XU
zm6hf0;?bCxuN4COIrBBdljE%USIu!5duFuEN;?U^P|MjpiBV+l?Xlo)_AQ~nTHZl_
z@s&<@)eS4zuY&y*XvHUAb-Q`Dblu}aJ3PXl;$QW=E#X<_E6TAt{w=ImZ*Sv~;$@>2
zPO3NP=EM1!3S$-<YnQ>&oUH!T6grECHspb&VZ7y^I;f8x)PHP4Tr1(h=R9k+j&o&<
zL)tz7)8)mL&B0Xz<n<TVseL<W8`z%OSX(g_uyW0dD9SbVm!)>8RK$%h3bs>!Z_huZ
zoDa%NI=j*$dLO`pFKu{qpCw97M!eolQ@71J)dVW8Ifk;iM$Uc3nF5QfsFlWsKm;-?
z|ClO_)qF_NF)9a};-#Yp9C#F@7q;hF@hP`dUuLx9fKdkhy0TMRJ2;;gL_N;VhMb6{
zkbBnIzKa_^P~R4mNBDDCrX+D)YJRC=LJE+7xAQ=6-aaJCebRKq`B~n=G&Oe|53##9
zyd0yl5IAM=HK$ujeTc_1+CG1JQokF0n*C7fQ?J+tOA4VnN#*n$(8GZJUiCRhd=0b_
zmO{S5i16Hlk|n`xyME%KW)kJ#&fTmbl0939TeLZZwiIN_<}QYCxYlf-BfUf&O?wBo
zd9*scJwh9AaeEDp6Bfgv8X-+PkkV?~q^x2qBYHAEGY!FiyvnJC9s~nm#n=h$DU-k-
z5L9LavbF%5g&s8f>)#55KPCTn8j2|80Mm&WLrUQMdVrl+A0m`iR(d?01%+dJsfc{5
zcjy4xh(eLEn1BwJ&#JLt9+H)PArlk5jT^cqNY#|I@*^Y+|EVCUjR2iV2PCKQ_tBZS
zm6<&r<<(r#SgT0olmAOL`7w3BQ7)LY#GtPPXg8oJ{pXcIE&xFJk#<&%rn5VDLWB|%
zwH2HC&x4gHscXV#U`PPWlHMGii!g^_lpx%OAhtW`uLJ~g=Kxuc;M#|L3c(l$MmZ*M
zGH(9&Gf;@Nq7}qc0k^ZDz%9FK^^PSOk?@S-+>|Xn!>8bKPybZrT6Vq6wa90W98fdZ
z5u4j+B)H=HPGR}W)&3*cN$wi_5vD0Uuwq=#HV>EJT6#MqkT#f-%qgBpRqdB?jMPiz
zua|Gt#uHqL@#9xN7a9;r#*#C<YtcIu?p@aJoqHT~ZjDN62us!x5^w&|p99nhdZzSj
zLR41%O#{uUYOAb|*6qQO_O-_}mVfaNrgYGY%K=fciGXSlVr$_*5{iFRQ?}<8iH(@^
zXJ+oAQAYkh)tPzXQ<+W2N;)Lc%#3LLd!e#q3Cwya8vR9X|KqY?>i-+KEEJ9F=S`GF
zUH7>;JX39Oa!`B(!qEkIM%)}GHpY$hBF}#G0Hf~nr1AFxOOZ<9Ttg!cg;&jC&+fxi
zEszzPpwD>428NHjM&=;E9Lx`|-cm^a%m?JrtOCZIS2I=`BkmHS)>$WNJEFNYUEQ)v
zr;Q#b3LW*A^eXI?@-l}brb4^6Z?_Yx^tp$k_m8CpM`~8LUe!eZOp<gt-c%YG{iuOl
zd-MEb)Wi3<#e9HnJVuq!gZL!^ZMZ2|S)*;64l>i0uz>j*Mj?tza>XH~YYkpP3_|O{
zAaey$Vc$mLDO}^1wEyR*nfnh-7jh*!yZMQc6Ijs-Liui_PbK><m!;<_%R-BR|LATY
z?ajZBEdB++&!=ej^=4c*xNB1N>dZC?4;NW-EOmx^4p&GWKEU@oH_JS!9qb;ol}gUy
z)Ro!mq8f6goPY3DvS4G|7I~JxRlG&_?l)HrU1(5wT7L23)g!(<?RKfpN3r&lk4`c&
z+>}JBqc_I`XLY_cFTyvgB+!Z#Zk0K^hOIhZBPl<!p(ftenIv8PMK=RfvfwFdwZ|(i
z*#~?r)KH<Ki-oZ4I74_KPyFa%QK-x&o6W6uQFWvzA>zZK$U0{bmrjmxVkMAX$;e(}
zgqaN9PRwKBO2wXERTwWg?om9JI?P4-`3pV*X&Y0m-pv?O4&cd=@UzFEoqL>F&jqtB
z0DgByAVT5q0fs7&N>RC!uq#C<Jv~h3eRN*ObO1zNG6r@Uw@76jI-ZPw<3y3Z{36Z-
z?w<2D5G3S*fk{S_G)SSV2{dc51ZnBB0FFt=8XV!2TmsCNW0cC4^u@~b%rvdf0TCI8
zaU4it^1P`5|9KMxy_`uwt{_>U>x+E{T3pbDB4c3xAq}(v0E7BYwzdLq_4L<(d=#lE
z{bS1o|HqSUu81#_YED;tBS*6LiB2MbC&}pUVHVJYu`q8ETzO3sKcwb#c?g_*oZI~%
zA=|!I{IjP=T2nC2(S7LsO7d<EM;raPn7u%fyyk7gq}k-JjPV$!K5e$cX`G^9j!}Lx
z@Co2VFz^z<hxFg1Yz%(<w=-3uhF}!1V+nc!`bPk)fYm)?*kZi@f_H_5zMiRqm0<P<
zy_8NDpW*P!8BJ%n3KQ|`Q|sR}=D3h)C&Z6g8%MoqaLcd)ea2qfk~<x%Zv%M}Q*KIl
zYVVG-eN+yq+-WI_tx5=2Q|D8^&H2QyCWJHg!x=FHi?WlwKQL9cYjNvxs_mWLE~wNQ
zF};T2sn*SAMMthKR`NK<Xr*DT!Ans}%{rioI(hVr-N6y`Vq6o@6$>s@z`X}(IQRj8
z>Kd~i0H20-)-cc{D_zZe9wN<$Z}8g}Vi+3^c@t5{<}3NTFt3K?CJn{sHWL!_Utt{2
z9{X_IqYGvCx+a&!wgJ}i?KSU;yOJGT!-`J@m94DV41Oa+nknvm0@8#S6^Z~n1=dD_
zU^kk#PNA1av28Ea1XB97@0X%f6LlJHT^|0T<H-R;Gf4-*6mm&6Y&16|B)E5V+e~7I
z30)aJ+0{SYPT0f(BW7xd09<Umyhw*|wEl+;t>v~-Rk<Gc?tCWX(RzzVRrani;m67z
z%nNAwS9M=Lo4x$$0c-*Jc$P+56+GAoKE}2KCn$#~HWKjLyVgwzDf!f)nH&<xE>dm3
z0j1DeZA4Nb%eODgKN3U<zmu0Orn!2zKDAKLoBMbYya7ZcsMkW#11U9kw?ezozd;U|
z)`!o&$gm&}Zz6(g3in@}^?$Of&iSVYdf*3Y|0~cQLQNtL6IkJ24g$<DSZ2ro=Cl1t
zkk<Y03Igba{*rYQB`&>`4+6R*z>s%>r1}fwx5e^Uh)Gty=H<vN7tR`c!vhbgWL+4J
z#$I6LAplQjz`70a^mB6)wm6MxAyjyYlw`AxA9#3;z}db9T(DwbplO9*L760&AlOX8
zfMq7Q6r(UmA&l@348Z)jGn<e<by(2l=5ekn=n59{vdEAlXQDe(3(Dmr8OuwjkY|oH
zxn{q(TziZf*82GQqYAv<mG4+=eisml(#pj8@ZJSTDl|Z?geilH{!>8qfmWT+_r<Jd
z!Ca?$ADk^}AX0&{k(n;xf@+Ub+5s@}w1kEA_jbyCK%yc6tZ!atF}!Dp`(4XP{uo8s
z<_ChQ-ZqRK6kI80QHx|i1e};#D|S}mn~1=1T%OjEHGuVu1|Q#X0)j?4N^2oXX3HEn
z1YU=NfK>kWJy;;R8r%wh(NS>5F>MC;=6?smzsDUwrXY(7oCl_5AJEMIZL1dFFRA_$
zEMxjA5BznBx}f7R7h1@{a77Tmy@6-J?5y1f{O}(o?%lk`L`UxH3&hj%OJLwG27Qm4
z^SPG=DQ6bAoPfbu9xEVrL2~qxPcdp~b<zD0txFyg0j=oqQ0N0RI)MRI1yad?0W}8s
z9{fw`GNi`?2Y5l!(U0UJ=DLk^WE@$w`XP5?U3mWll(cDPCSaWOa(F|gK^3jF3~1X>
zSE?XSPgqJ!oE-L}4=rUZpZWGP`yGV<V-HG@1Qt>paO<%}#RG7;KQTSvZhiG$a%`=+
zFv6<QOp|74Q40%uZ1mb^!vs)NAaa-83aZ?l)yiRxgkRG3y$9*W_aUWdke4mM7TT#}
zE6EiZuG3pTVq+tQ)1(cr4LD6YSmyt3@VtMuCR2-vE&{eDZ(?Y*D-lz1S?XdJv?Eq`
z_El;c;Pr19O$-3~XHYPjqDwj*^K<g-?xbF~Gs9^%`!pJRATv9&n#^V@5zI;8eZefa
zp_A(<ljPARJ=t!FN?Uy*f;E(?WncmnswU8uLB-vNKg1ZFH42vB%1fz%I^~iPK;1ih
zK(QK=n3GNXNiFyhnU<}g_Y5$6yHphAZd4Ppbp#Br-bOeG0{k5VO+ZJ%<E9#CkmFx7
zcEV2a2GELyKxW!WT;Ny1U=A{k2oo{(6-?k-1syRLFto?3U}#k^fz~Y0OHqDd{jx})
zDP-_M8coqCcELRo5s5Sc&UDNhth@p#04)GDFe)lY{8M_Y05<k`T7%(s2pFx`SOl4>
zwLB#|!JTS9kSJT);RaV;S7?$MypCZNd-@kS2=~i&c7SNysE8)04Tq{YxZuEhBm?Cm
zK_xkw8-@fl3CC}!)TWe}aEN9Kp%f2U13yRc-2wXSM+tWW+whOW0Y8xgyqGX~-jp-E
zsc*^20Bj@l7cepD`Cr(`S@w>%e^zD+CWY`Z_1U1MM9jPuZr2JR0&@5-asA~0Qu=t>
zN`dtah$6(q^X5V+!TyAhz6;ztZ5W{DO0<un){jddR8Dnfh531g<O4FqxQIOQ7V8l{
zn`)vWe2M}=C2Q5GWdmdJz%j}U_N()wCsb0Vj;DU;>v55_o8B5(3!zECBl8J3ZSO>w
z8iBAOMy+l{@z56+eRz?Xv|Aps(}kWJ2)=d}34)`1z-@>TB>cA%{MQj;#Ax7R09ok^
zp?^D=JlnrriwJg~@{8(+|Iv`=K#uJbe_7^$Q<D6d?rcEWyQ$(Bx;3PYK&Sc`T7W=}
z!BsX9I>6R3So2V2O4p6H)`kx!Q*EWKSaM#6!h~g1Za7@-;KOULJ_jrgQ^I{>G4q~9
zwA7q(pU@<r+cCqy8U}nZS)Hdiuc3?t1%ln0o?*1&oLIa$Py%jwCb@w3>K+uo3(58n
zI+78e#zoaHR&tdknx<NTUki}dVeX56GnE|FUe}>BhA^Xtv@!oA<Ze8pWBP9#^j<*J
z1DCY`#m>|aolN0@fpSjg6$l@*!1@ghW#E=1gw=q)M+t;F${eI$P7eH+<hUt)aXL9O
zg?*YN8JYY7BLoDmZN})AH0sUfng@<C2be{;V^pfOn1PYfzg`|xdtlfM%Fv=i07Pk#
z5u76%1ydqUP!KySo{5QYc*bFN4knlAwTEhD5xN<JmVl^BPg~BQ>(sOFt{-M+b3lg<
z8V<ne15L1FA71uBI@VG)=FK`@^L`ile@Vrn6dOeRiYQITIqr{(cqWB`+8o;!>xWt7
z3}DJ3V68%gUJ(;&8#ripU7#?ev@Iz4GAPKEs164>LDLJ%-hU}pH&dOFHSa*twK?Qv
zUiG5UK@f79Bm{zAQ0l-DRC$$6F#C5)pffw=4{}j2(H#+@3#ewGC`@24EN%L2+}HB>
z5FRR}_>4{KI5Gi~XTcf7Z2PZZg0BLqR8z=&4q?otM+sCPBo&V#{~R6=xv4_p1=@U-
zB2MxG>cK-IP)K4KR1_L%J;K1XUK)}jg$>-PiLbT|C`(+sM$bn07VK~nnxY^SQw;QP
z|M*haL;Xg2FC}|BX2JVL2r>#Vvbxuz?~?Yo<{6=KmiPn==|8oi+QB+E=C2C~<{VuI
zr3uCiEm-GKgXZZs5Uz~bHc&X-POc!R*X@V7gCi<g7R`*u@|VBpf<3|>IG5m^q-+c*
zk;Hh9y^OB@pB5Xsv;KV`W0?Y(e&*So(H5kWeQH%{$GIW;E_*x@z25*R%v2w8k$GfF
z)`ns;YZfsF#KoQ+z29d6XOIx=N+4D-RJ$=C8fY+bK)BTZ2!DcLuj!?!Bc$wA>}230
zxA-7K!OTn_9{X)F>fURfk5_@)C>YU4^AGbbwiFU14>k}@J~lNJY(kx0XS~USpUJ&m
zL&bg<@EZ%r_<Ju&X^1eN4ZshL+0eh?5x}=3E#Y8A2*-x<UBxlsXX7Xt#v1TsiQnUf
zig$m~zr`rjb%3+PZVv1IKWx2sJk{^}2mX@EJ6S~(iB4v+Wn_m?Mj^6gZ!(VUC}oC@
znLRSHvsavy><}3ThcYvcy*cOn?xWB5_xSzs>yMmsUiW%k_jO(O^BVVkpN<r;9nCIW
zBb4ZJNq-%;mR|ao=xq7;gW*c3P=dIb{C;jh$v>+ZyOX!|jRM#|l|<8PY2uT~1afdF
zQRv%?ujPe#Q-$~va3sv=#!gOa;McIdxBn6?`9Y$ksdK@yy%f<y1+-Ni(L(`z3UMOU
z5OIJ+1WH`TzzORALr157->DKkz!Sd$MXnN^zr<5?f>gkLcj?D*&aFzS&89fBR&by}
z^+;5_rGK~YrH9{8FRF`5z;ub=UP`?C-ys{sOTfT&aj(*ec*%$@AP~O8eC}>~X5nuS
z<~O1ddc;UHaj!D)_XArL7*fPRfRm?yNJBrs?(Q=KVB26UB|9Be+yCbn$iH1(bKndc
zk#V=qu7M3={2cWH<jCjbwz&mNBb%ue4u<>-Fm-mFD@w0siHUjjf50vaa3i_03viB|
zu5-3ycm1gUM>5=PA!2IYNNj{2qb|Uu{~Hk4KwV7~KyXJq5xcV!c~pSht+S`&=~_Xa
zPz01@uewh)f?r{ov*$RcdKLuim82fEk1~x;19Mf3m>K`Bqn`GZc1mH$hOno*vV+8n
z(umHx?*FASWOdSpg`D10KYU5z194-3Dw7V8y;sz7VqfNhE>BOcJwsepfQ?La01BMi
z@5BX7g?&<xYf{=TB04t6elCiE>D{`i^9O(&o|>1C$5MYR6eFIQGJ@ZVS>Ph(3i>Jb
zL<>>hmpGq3U*g~Gga5s9aP-8iQI>!vw{o_0_i(d%?nM0LVs1|^BtR}ePW&JxMb58n
z``psb*+$35)rwq*oL|Ak(Zx;M^|^%=IlrP6+|I&EOZh%I{{v5F3lBRN=hG_x_vQcU
zfQ|dl?VQOCL92q~#^n53&z)_o{`Zym)Bk=}5Fq}>CnzW;Dk3HzO8h7)E-EA@a{5tR
zKv+UZP?T6-LGWKeA;G(#fG{X1L@ag}w8SR_s@@eB7b2F^0By_25XbD|X6b%fN8tbd
ziHM4e3kwT@8Ug~mf<h8^1%-sfPrnK9iV2C|6%Z8_0fgWa6cV{BB2H{g$=d_a2ejhh
z=4tisKVxF^|3@_9d;Gsd^ECG$5{zHf={a~+emy%&4_nY2Xo+9N%Ff2tgIrKZOz{7Y
zoXT#`eaQLm+j+P@wsKQ&adLHWwsQ6$2Nl(<oNb7$fMJqr0g~G}dRV!EzmCs6tQ4&*
zTr9zbr!wUKn@aDrRa}?zb<Lf>UJ=_;kudHjIf_qmRFE@VecR9OjJ)&;X<j9>6=D2q
z>~cghULRB!Ldj3zwSP;*(fbcp$%PRIIejs?7V_Na3&UvpZa=c*<(<lq-lAUdOUcvJ
z_+Uj{s~he7AGNQ23-?-wpdh`*Em&rCFa$xO*zl8qXc7n-6XA0!VkU*4PY)G+t1ZAI
zdP?aC{~@X~;MtDe++)e}5M(xVRe=COmc9IOxX>D6eR|5|Ra6o4Sx|4OEf;~k3R+iZ
z>BJKYeeS{skIREXk@wX12&MlD$+1lrpMLr)O-pP_jRnmD1(ir#(jPe;Mm3)srtq|Y
z?YnFQ1XV6Pv{d}pw~!>B1nPYM6e;<y8|fGr>1q3^REqR9#373|Ge``cHnXFw*m(Ma
z^igz*G7e<m4IRfB&_kyWb+RT|An00^btNGSP6I(-axTT;5ca2q?lE*ZbbzKD$8Bc7
zz~1W9_+*XoLy-QUMFuYE^qob)2@R(d5)JrQ=GtYSQyM-?pgk-*rJ<en+{1r^{@D2j
zP64_oGJJ?5h29D7!%+X~mPSt6o_4g%8@BVmzUdEhPOGab*8Y1Rr_`P4?0?kgwIoPj
zS&8K3I9~r(QwWXF``1gpD&Zd~BHQ1%1LAikQpMrc|BaS8-0@#=1G=tVJK{^;S*As@
z|7&Ye?SwcgS*6;4ql$|7_iDP*VgAGaCPbkb5KGAV{@lN5NC^8h3kY*(slS5w_br-E
z;vWP3GNoA>JY^R)*oSdJ;=G>+^Zwy<_;#APS^p@bb@iAGVzp4)V!0@D#{U-;V4bm_
z?0N3^z1JXE30Zzyb8kQeZg;3-Y#~T)>(vuNIX~VRf27Vs4;b)Ukm`Q(uqos1Fp9s5
zfLrf~U(xqF9#%(cA6I}LnF7Nm_eYM}zXW$yVo&RzXX@KYb%}mP0oZrUm0f7^@9{TS
zQmr{4gJ{WXu3Z#+rTMMXmS1-UydRw(yZ9d@XE3L9^sTwllr7Wo4w$=;=4D@5b^j}9
z^*eN64B!2b-)z^#=^IozPAfj-Av-zSK^mY5V}zi0pR-E({dru{%JsPZgCKEd<vEw)
zbsSISC7aWxZeFrm#0@SSlR!aEt!;>JZipXIDUVLVI8W>TMk8u)Jtvnm&V&1h8OUJN
zn?_6WmYf+ppg3D|jOUCAY?K<jXKg^#G3)dT_tyRwCV+w4iaXd=cI){Yo%qI?_mxN>
zIW;P^e2pCE7*{S(8r%gxgBs87)Y2LSR48Sn@8T4HD7!HRmj_g!sk(?vuw4Jd=a#g}
z3@A>AP;`zn%}Js?Og~Tu-??T-9`2e(yq##Eg&^C%BjyQHBuGQUeV`Y1OZ0EV6K=U#
zZ3jZo?;2C`{#mcpb7vvBp${rCxTd`@sc{q!1pRlt=;;E%(dqk52=eCUuPpG|4=4gX
zn_*IX&a4kmWPLlkp)Cx?S!vxVb<%G~Cde7PLR36Ky<@cKk?5PBeh7i5cLY_%%9$0=
zZ}vn0&m_~Rolx78Z90y<-hLzrC_U)Z*8J3~m?QTlk+W4QEI7R|m<kFYFl}k#sW#M#
z8bl6fjcSRMx+mEuV=t3(s@#IAmxM3Cl_bL+;NL@jM2TU2s*%oogb?L+JC)_7iaV9X
z%nDbJVLe2qen({iqc$Fwe?64MaP4%Eblx<F*~|*w#V`q?UfRGUcGkcte%^^V`AHO@
zO!e?I`wkjRa%VhI5qR?~E+sbJpoRm&{LYt*(HkP{IgbNkGL-ma$nT3Y&_F?9_sC)C
z<MP!7ajM|GVS<I*AK(<&)HyH#P_}f0qeBNx3^Ot<iRUT_^vO{HNS1<suTAn(V)w3?
zFxB@g)xlvyWS6cD5XG?|*|GtQZ}OEUR7F&mzl-?dxb~}qRlbHFwn|B~0^0S6swb|F
zQo*hTFDM(Hs{H-8$#jRtl3{ZvBC=CqL?v0Dry#|@KRWsP@Ddr3OkZv;!VJd+*<3W|
zjEG9eXj7XlGo07$8*EE~I3Gp=X0bDxSk@BNbw*|I7WMSk2BTZ^k-zvoASf$&SWWFj
zZz7LP0Ad~DP;z4)mmeEFW)&(YYKw<ku*h-2zkg{@RdG;=G4dSt>du|qg|}b^zaF!?
z<uV7C#l<sw08!P34Hhy7*J=#?mw7s>#0)>8ZZq0Yof8dSVIhH%t8Z3*U=HSiD+Vh2
z_b98fU5238U%Xla(XH&~kX#B-tGsIX_cM^(eYGRT;pkT0*47TwZ!HI}Drlh~uUA?G
zM0K!he}1Qe>3fF2D`>TQfXL>xys<;kt?ClU-F*IKK^EFOZJ>d)S1;DMLDyGS&pB#Q
zw|+Js)DQr&IUlKNIy)|3zuIh<rMZg=xLs+@589X+xE0^zwERUx%M0uBBXV+#@;nq&
zi%sdJw|{9^yPIk~{&AObdslFx6@msby11Aoh5AH>WAsdYHIvPtAjAVO++S2*SuD;W
zkqn6S&zBko$UzJA#uc-&In2o7Zqt?&O-<4WV)a*7kfDKC*3a5Bhr2tWW@yV8H!w0q
z5w+4I`s9#Q?-U9Bf#|b<@zxZ*_gsDkbux#Nl0qj{&KV|)HNhKt0-K03;>7$^OI;i_
zqw_P6q><e{C(J2Pt9}ML(V{st$4{T(9I2j@x9mGXIU|*^kAc`bpen7Jx9?k;3e&MT
zg{LLr#re1N?gEv0Kc(1Yx1UW;M0j}dggL@!`5Y-Er@|4C{`oLMgG<JD;+c--d8ocj
zOpgbRu%eU9Mb+%7^+rs3-aZQoicjp`*zH%Uz0)z1-QQ137#8Kup@3XR<UUx~7g|jB
zepJa`lUJo)NEHnxfmqq%{&+F@A4@Ne-SuGKYH6(tHvjTy<P~@le={!QMkpi7+ITKC
z-S(u4t#WFPJ^yg)mp15ou3VLXN=2=<Y|_YE??z6BdZSA_t!Ka*Lo=u-pG&ixHvVG!
zYk2Or%^w~gJZYca(^x5`ISYLejcb|H9%Cr~%uW5ya}maqZ7S88`~^t&S<Yd_;>TX9
z(pe1jIV1ZMdAks_OvQH8-g4v5<DgjDAv(;HX+=C4^w*cglECtFdS9Q>1>O^u^^2fP
zRA^!O!ku_tK4r-(4ZYs#6J?V0+a%D5J5w%UL@YN|Y`Xnwlvhg?#Tn>#W)16c-P1l!
zaUNUVGFShqk?uBG2x@!~yowlGd)kr``L_L1v`c&Lhy(&iHTI?o!C26Ui*t+So0XJB
z%6j9e^yZ-7>TDET=rU3_<N&DaMhaymB8~mTS;^YsbK0zR7r+?Q=g_7z%%Ab`+40Y4
z4o_G2OU$bE!Fbp`T8Ri;4%NM`&i)IKN`jB7;}G8YJbfFYcR(Dh{dXHPLh!UrCl*qY
z<Y`tZ>raU4Bgc1qTP*!IrA&b@|8MzxU5PW0mbq9b-tfZooQ|c~A44uQg9H&G28CsG
z<IvvXDB5cku1q}~O5{YfOfy{btXNO-rkm6J1A0uD8WHixDGs&^qIeIIE1zzm6m^M+
ziZutvdd$%7IJKo~IlX|3^?-rP)kq=elDf3?$@;UFm9U1z_<27L7}uU;36bM3rIVov
zF9z^YLxLAvxwo{5LxuVJ?j@Pt6Eoe$(*_-q^qsCNIkc*^Q>MZgK^9@#WS>1vFKGox
zj`0Uw72&Nlh5HQlxsUs}6B#7uVJxPJHpP`R-jZd>X<BEtl>`lTb5r9`8;{rum=$y+
zl*g%{p#MZ8(9_7pwG2rlC6+Zu;D;AhWr75v8Br8GM*NDNMcZtC3|z~-0M{VuTG(wV
zD*_Kzpa|pR9vE%ca*?<agxMB=V~vZLJD5<b3^yHHsfc)+;D6hi;E5HtZ=^rWWmd4r
zKjiyImp=17(C&wfti-?qIL)qS{(LV`Y58gNLxgJhbxQwFJ`^t$ZD3@l#Qy0ocue>i
z{UKbPsG05cT~SM5Wh<?F4>0HKe}Ck2^&~?^)wZQiXF;dq`;KfOvoe=E?2rV@S|k<m
zdGvH1_af1Vr;^bFx=MRB7T)kSz@}eh<G!yVz<qaYqkVK|PgvbbiL>(r(`c|!P$8pC
zj-5Ol1<OYXAZrTzI`1=&-`bHE{uH|b8Yp_|^y0n7UsV4!ntQyt$86Kb90zznn<WBm
zYF$HWht9HY$cb54aCTAv>rX?E`JU`Z^aoxAgC6K!ZxpI{@){I0!b@L;c&;Y-4vrI&
z{r+yZDJ7LpAH@wp*aj|2oQnh5<>23A=@*;oK40<iIADcAkbN?b72y?}Rqz76P%pa4
z*j4MyJdllyB|hwdm-(^3ns0B+kkh&@)fJYrK;^LHtxkVnR{7i;vuism6SI0i1|1Z5
z^kq8Ql3i{xdv<Gco?-%)M8xD$+a`mD8>V!QotY1}&JQh|7gn7DSmwYpz6#;HUz*Co
zSJAPZb*K^7C=Njv4)we7V#ec0Hd|Fo{$!qY!A)vtqu=cC&-AoC>W@*le>kDYRIzUs
zbsK`hm$_{Sci1WpM#awl5WBI?P6DY+K9Rsp@W&TFzrD~ek#wP)2Mm_v;`}P%k>q8E
z5heQB#*v)P_4=}NP!M}UHh~GNQqst9NZa9gUU6-<o(f>;^n@YQJ{e9)gkx)L&!fZp
zWjF#XQr&)dOMS`9=XzkFSmQrzsgz{U#)OK*v8k<c4mf7Nan}pc>->!bl7gFR5E3=o
z-5<M7$`^;8$*oZnf>?(~deDS8I9n0D!9=61)s!d;LIi@?>~qp^{nfXgc){ETFJXDp
z85X3&i3`K4ZnUXy&8-*mzlu6C?Zly=(6TB$z&9jA^bXHWC+$oolPrn#vnm(Y4J0pz
zo(NzCFE70Lu<&L&HX1CQ^-n|aL;k%k9?XAkvo0vzfboH~O3s-5xXK$BwNQH5k^X%(
zEr4(@mI_x7riZD%t77s47M2lB{UT}2W<cON%Dcaz;B0*cB2n5l-l$-CfFMGTSh~@u
z)?3aCp2njRbid0xC5Uo3t&@R^0b@<K`_NyG618bLFu4U})?ie>3xDq6h}ix?Q6+*}
zn**rXQr$s9Bb+PnK=<wi*Jl=T5CnBl>Qxe$sR_@G!yK;=EM+dHEw=+{^+;INL^rCa
z1@EH##9#p7fF=E-1`nDL;*0qCHqywr&O;om`$a9XvM1%X9Wyr{vO|#6ul+O}zfzfG
z&Fp4xM&}PFt81W#z<RJ5mVZ4X!wO}uJQt@rWcE!nlJjDAAAt8?&haFyB6Lsge+p0E
zB|J|LzjK99&E}TFbP<AXM#)m+G@rKAvu+s*a>V!-j&FN)1N0uma61nl%<I^H&*j>g
z|Ne|s8xC8CJ8!>{F0}<n!KNw}heF{;*kUSw_<!`gKj=R!M-D-KK7`MIQ6qJPtqWPm
zvf_J-1m=je7kC!v%hP@Z!nYdJ0jrjp=VBZPf2WP5PXCow>pKwi+Ecp=PpMIo%)tG2
zJhF?WwN2Fp=dv#w;W!=%CfPM({{-iB@)ZRmgWuokR4mlGPa3(vZUN5$kRW$a8j)=x
zne4A9BgpH<viwvH;OFaZMqPN8ub=%j=58;&ld8Pxt3Q|0>0C*~0=i|fIEB&T>C1;m
zOO+eR3=J1>Gi8#<!?Q%_kvpBR%3|kwkAE;-N9D#+QOzt0`DXOoE8r_}5inIHQ0kVC
z3h}z7sj1zNxFQkNSVf3cAc3Inz1wKS&7)MW%D_8jAD9VIjyBDIz^r93;HGQfFHedU
z&Isk9qUKMi^_>Be7ws<Ym=;W$x?e;y_sE2cZ<=C-{YXf_9U7Tc2*Z_wKAupFO}EKJ
zF-xB!d?p-7@Tch8Xp}0tF+aceZisn!7Yi*c25UNB6!nq;tiw$oEeXYad*!t(R%HH+
zlM!#*UZh{@(>@E0Z3{oFn10OmXg+A><T)aYZl)2)2PH*Y299*Wo>b7J&p1?YRHh{#
zVEQkwsvhnUuC9103s=zo4minl?_I1ovv}qVbh$>i3%|*^g1V_my*2ixv+kh$D9Q>j
z2%9>)(2nWPq^-fdg$~Jw3*9UJfcR_+hiRyc*K40(v5)=^F88T7egCANQ`<KuV+ia;
zr-F1X!t>q9a7PX=A8Gg4jn(#&hE|VQG2ln|X~}+^$?5l@e}SI1YwBxD856QO*QGLP
z4kCqE<H!?sSaz$&|E_7(6*QaK`3CZO@{&OVJ5oC=>lvtf?Y&Vg6ZJ^u{9WgXd$60I
zr^u+z0VqG`(?4BXYUrFohK^5jVOl*PSgylOd$Al?3>EZF*BH$AxA41v=9Ow4r}%F&
z=VQuvr-!=PC?Qr%Mh{LM-MmSL{Q41N*zRIFZxnn58F1`%4$AGg&wfm(Ky1sxLig4g
zKfHPW2p2l?BJMATIwaSKE3_m?rbBD~Q-f0u<4zA&7Pc1_nhnIj!r^#OA+(vP(}2o9
z!j(Gs-E=GQA#}Cz+y%Dq->j_-+45`cIh_#;IKv%dOLfVRC>?ALn8l5jSe#S231aqv
zrHW)oScu|Ujm3X+Cl2?ZpnS{z!${k)D1onj9@gluX(}d8Tj!zQNt=r{2xW~~jH}sI
zShYeyE$>OS>jnT*=k96TUYa&XH(IYf6&<WI8*i}kTI80}ya3VEp&#y{2B`A7vs6qZ
zLuk~RDD68o49Z=$IU#5zE#;uR_Ag$gR@?x-n5yzz5n!00;*i^21YODalr}7K)nXp-
z{dMijSE0upp6oaTXertRNrt_;ocy9`#)O~9N%n_2U3lg3Y>^FhO9jc06t$*+pV8TZ
z>$OkLK(V7h36xROn%0X;-86C3d?xsuis%G%RmuB>@~{sb{FT)SZ0ccWwI)wnvP%y_
zFYKrh2f+h3n%tcJQrj5~r|5qb9tX_1uPLIfeMJA9YpVy~DErXMx`g0PfXO3Xh0})0
zycH2+?W<;n<TRDpk0nJvPK{MEDXht__;|HX@rwZ{mt|WXi?^v(2+v=fdg&$yIO@6t
z>}Etp8YzH-1KWAAILxHZ=wpHPGT+{*w;k?F96S3&kma$XTZzz+j2|&_SkwEv<1g7f
zF&_a|?}m@LgcsPy2G*|#h3<>DkS_PUqI;<8c%(_7%N5VM@TeLEyU5PjAY2n)BV5Y-
zQJLZh5#f!AfM-49+0_oZmJ?gNWLm<0&Ve*<G&LcJ{f*mRzn4SkU<)|O`Qs0!l#T_k
zYv|G7`_4R~$3ilihnnC%p510KxuEqq6NW0m^uC(5f5Zh={U5rOga$a*Cc1L>f|<_T
zNO#noMp}KMm-XGJhkN^Fj>Zb|*QVwkjZ-lAPu+Pk`mWO=6F3us&OWUqBpffEDD6lb
z-VB<p4zMpe;B)&3z#i*OW*fWIgK~K6YJ7WIr|PRDJ$R0h+9l{+yk^2`=E$wzesNN*
zV@4C-v<QDZQ(0WK!Mw>$-gE9o%l;^CW>9pF6(4sN>e8ey`_KBZR#n9%Xd`!P6;aBp
z`jzVPSjOm!+io=bO2!^vz^bH@aQyHn^A{ES3uD+D@A3mdtO9{QH^1^G^!qzEs*vSt
z;1>5(u#;NTZilx-$GL=T2|5VU%G%FP!+F&xR9K7EGE>RhwSM>Jn~%(_UEwB$E<g6!
zi}86p`QjW>e1v47a>Q9vZPwThSR=L_ChWL=+fZ|~KgBK-93B@g{%SKi!9D^CdM%Z7
z)IZa{rj6{!ekQnwB;uNXCOK3A3(?>n4_dZ>85}hIN=38Sg{u3Hf0W?W^%DWgcdv%B
zNm$*fc$Q?Fm>NY5Gdg9|W-nd1gbBay0D22sFl0Zraoj!Pp@zxkfcw2lXJ0ehr2I(*
zGa9sU{x+KMK$6Zg|B~;AW{aRzQzXN+u!BTrMrtVDNN<o32Ir!>8sq)@Nz=;tAuGY<
zEhMju6iHAt3z&iIN>559i4AYg=8jvne}%gDkT2RbAh`||_G5m#(3y9i9MH-_`s)SB
z1Ei|*+k$gvAx1tPKfF+rXLG&_Ea``-Cy!8?{~i1_s=9Y=9xbJ979`MTPXnI=LKbs`
z!#y=O1G|&hEA48_2F@)MUqq%Ye$~8!g0A-JRRU<GkzzL~APE~CG2a}B>U<FFqB($t
z<W%R=Q0K5J*N0!g+zc1}KAcN@B>IzI>*KLM;?Xu3cB$JQDr|PLDV{Om-h5D>kjbi8
zTKO*dnKGO0*B77xFW`q2=g{u@y}}<zFY)WYcG=LH2ZyNeNt<R}A?V|QRu}&I*r1y0
zZ7t7ASs~M#0dMF;rk!__ZY;r}teovcEy9ytUFL8RC%kAeu)<$eUE;_fG;#`+Gf+U5
zW9x2v)D<XZO?*TegPy8KTI9*o=ypj&W)jK!el4=13P?`(%54S0hw<zK#R$#POmy`~
zEY`e<chDconmvp+4f*t8iMHWxf5l;#GHK4oX^#ffzK10A_-7Ko4dFAK>qcX~)_qC(
z<QHckcEoLT=DAg*=lchK0>JSeT0U2J_}YLLGMjjA^_PGfN^unZq`Zl>Te!zXwxcdd
z$AaU^_^)20juh&V0TSuEd6ARu)5Y@j>`7;i;Q6EY51V~*@|M^oO=)76pFTFl;xc>C
z)LLI;N_La5@E*p!uv!yQ(@zvZcjF<mjtA_x{gxxQ_X^`x&Ktw_;e8j8w54Vz?pwYi
zga>nKJXfL4*t~~(h$`OzB}@HVY?<%jslK~;+}kz%w_Ck!T1AErR`{L6@7Mt}uP+2p
z*IhBw<j{)e6E_dra*vuBO{c`LXbb79>pLmd<7K;1*TJeAyX)U)n$AEWoQ?^yOS@N$
z>-FL*37N@8?H-RX)M}lPdlfjGaZtV&tfs3xiwWd}p;o`oWSU0F>Ssi*K8rjD30ZxL
z#ig$5%UbFAQFi=T9*$zL?{)fMYc%)b<L0A2TNy~@tGdMT^xe{3u`g_29E2~M`^`mn
zHb<GA#L*rO?I;1tgiRY%g%j+nu3ylZ7n*z5S?6ZO^!d{bI2;iUpbbrNd4dgLz(qoY
ze@#PxE%T1jM{U1DoyXVu!PVlSft%0MnSrmHUMg{j;Qw0eoYEO|BD43~>W1>nC#$y`
zYz=SuDUuUCl*wClX}AxG`YUB946nl8ErxxxIhoS;r}MAF2V}N4FF@u3v`#Z916Q>H
z%T+)!k!krIFKk8dOjit-um-Rl{fjLL^qK~!zCBmR?C&8fW|x0sv|C@(H!(w5%*Okk
z0C&)*y&&9bfA3#8(Y{nYluS75$|Y0))UxGZrY<MmR8a5gTTWQHe?+Bob4UQPCqIu~
zYejdi9B7qysu(PA>0ZpRYBK+?i_>_)=7!TY<DqCf^~s*X9MQ+qng4JvGkVrOl$SSn
zd+cSW^RZrX-vWiVCSSfY85CxnRXL0D86I|RXM1Eb$uCl_%QEPHK8d7l3=3QUjtNx=
zzP@7Xd`7vLLsdPCrt#9lJIFjMDD5=`^zZ?X0zr_aK$O?*^7@r@54!EiUDrf%ZhZG&
z^C!@N9zdMZUv;lX_{R{6G*r!}r|jQ<BONm9Jjp_VAYss*WdO2@70adx@7EHHTZ;&6
z=T~G?R;buqjqBJ(K<`mlok2wWEj`#Zb$8X#b(m~igIkAw>hRe~uN!~j6(PB|96+OL
z$JQNkZ%KBo6fZF}sFwB0Z<sDRnCt27ONaPg02Az?Q;A5O$EP%1zV_(o#-3{RHuA%S
z>N-_K;NA&IQ0&S<H}0+&Yhf|iN4*Z))RJaVEQ@Oi4OyYkm4G156FyGDL>mXbm^a^{
zP|sCk=5-VkbDrxK(4hgq-NPCe!qbm8UB&EhNiUu`|6z0@aqX@FO>(6NKTp2m*3$Gi
z1o0K6ZTVU3)~3hC{#-R~>R{T9kQ!?;9Ngl*J^(@dj`3B5h+RWX&gS7SAs3Ei+Zd2h
z^<}&K8ncaBJhh7WX#&z31VEk&-|NR)`N8%Rb+5C{J+th`8}}<(&(!zL$`Vet`G++a
z1k%?D=4TE#=ig95U*zAo9c2zjd|8hu7rroj>~Nb)WDGA9gxKznL(nS7@e0U(B^Xfr
zM*O@00R3`S8t!h)`~@L&^bBs|1@G3Al_{2qDfvypalwpiBxgRCvm$<F5yEHgk%Fl4
zkxn0e9POohB1LDW->?K9zsIma*wIWl_)0#X)QQq&mNO6q^E-R52aU>N?rJI+T#xnM
zOndLy4$OR>8xzR^2T8t5s4+M*Veb%6NZntNBl$ut!IOvorj14nL|Z&MhhR)~EPiLs
ze!O5o!F`r?=U|8hAM6GZ3NZix7uOoSKR|qU-pv*br~s~pa7yILNF?<MB6#kYrQ@oG
zyR;Yoco_k8@yr2>w(dnn==$Bqefa%xq|Sv5D-dk@FHf&+i`M<tK5W`BaJv<S(-RE2
z{Iz@((|0sT3Uw9%drK9oVlu(d@GJV}>(E^4qsWgF&bU_iP6H4MR@&Q=_;e!|r<tRC
zW(C?NSP}cSeRACUWfJz@*N5^%iOWszmOzXnf4TDuePmW3z2)rq-h1{dPB6&q{me4}
zoH}ziyT1{a`(5?0dPC~H2bMaLA>*%<n0v<MMJlb&fS}MBNN6cH4VT_Ws~LKx{xI!e
z2%AqE8mjRix71t-3QByMi1Yc>FEia&wwHTWb8K8tgq}|8`Uq7{BJ!CA2y!Xb0aF(<
zp8Z;o4a7|TBsd^%Vy~twiC=0Mp_<_x@;C-ySB|5(+!9gaj?X#b+ftScVbD$IJ{TH%
zU#(5ada0)@`XMAY?r9QVg-RV-_DqXRv+H;)#2xGI?}-zxs~w|GaSbGb`(%&BooK>&
zUt@`k-+kpZ4huuw>2L}wFOBuPBtdk?+I@I26QH3C1)djYUOXr$B|pBs$DAxBs9slm
zs^Okl%}j@rE&biAVZdm<hh&N#48$sv!5{n6_?UIbLbjbrRfGgM8}AC&N9S{$$1m7g
z4UJ(jjhE=s%2ob@xND62@Uk_x?0Ryiy1vM^p?wiQ0<<udpH{H%Xd&;l4+J1Jk}zs=
zPExW*qv`J-xC~cxBKy*1i!j$9p|TG`n*<ZdcyT(qM3Pkr-(Q+^_sG@)22HBLdwCl5
z;bqdunI1g;X4bzz$vK4lW=%(aW-7m6f+Wba1&D1voJ}yL)}VPq(Xw~^$K@LCt)2y3
zU_mi>F6#@BaXGVU?<@Hz4IZzQM^CAG^o>XdXQx^zp?8;*=Xc5lHd93^s!Dn%^ZUO#
zm0T#2>z%0osh7F`2nrg7_n;B#lChR);r@>f=<_#QIQ%cJj5z*6tp3QW1<lVsxcxn_
z=9X%&x4b25>xyaQB!{=pT`^cs*VJ>~A7Ft_gBxoQ3K^RNoy1z%v8IE5x=u-Kz8Nz?
zHQ#~9)n2v-ExSbG=81~E*RwIQW#H3f9V^-W+ueX%9faTZy3vIDl9!nPsMm$F??!o<
zA1R;dfnG6l9&eh`Lj%7o^CqXW;9T&xZ6;~uocuy`>+H;yzQ9#k-te5S=yAq1h^8ch
z|Dl^zngv`*!{YN~OQ+V`B=^yV&WCBEhN{ZhiqOX6yvfXIV2i+ETN3$?)FaZ`Jh&In
zy`i%xb`rm-^*(IH9Qfmb`|4t{VIYQoi>Bv|8w^)r)JYu*+XwM^4NEa%d>(fAIQc;H
zc>`)erd{yhbH>+Kvg+@x4P6Mgi?<LboEz(P2yPHvH`be9&1|qCRMH}QY6B1KklXdI
zHp7-AhOox1B9n+i%_sCsG!R_?uMI&7t3r3q)2XEzzZY6kX3XN`zSSmTgy6;zwo%`&
z&;chl5!fydQYnr4ugtRKQ;N+{w%<ZbaQ$b?=)8hya>Elilik#ypgNA*w1leh?7xP#
zPS?Jqbq357%+%kRo}r3x$<q$xIh<}Ud<%%Jd9gmCn)F4R!o}SnA(<Cjxp_Bqd}t3@
zpw*+kHiCo26KWZ8m5r-6V|pLp&we6E&FORzDnide-Yf3Fqie4`6aRyYj3v<QZ|<sq
z*3IvcNqKleoYoP6n)bho(Bsn7Y=W=M8|kV1xDmgln>!6b7hy5{1iY+t9sz+=d<+HM
z4xL}^e^Kn>nHGLs6oGztzE353uDR3c{U`>7g^!N*=74;V1;8&M%T9$NR^toWvq==2
z8-x+xum|WYz>Cq{1HfXw9Euf7J}WStQAz(+c}>xo@#&M!(CfE=`vzN`hVKAQ*NKkv
z7su6@Zj8PCe(PJl4ezgG>rb<moz@~yP;8#tUd-;!p2xjQ`bE3DN<;o1YJ)dBB07yV
zOI>zkiPna4-Xx13{_9oVFbdS+?G=uchLQ#fvtR&W9<FsS$)?&2SDPLD@bLWPp0hB-
zo8dY2xofx8<`q@CEyOyj3!K4G?rW8cp`GQ6DD~8Z)X|IWEbDp8kAr@{?Yhtm%6w}F
zuXsN}^laJfN9>a2b}a)`86C+-y)0fHA4r1U`f4_yMs|}#j{~B#7_Z9T{9e!%$K1#a
zaW!zU6F`(#<zz>F?(=c9FXBmhL`iA5YZ(jl@!4D&s`gwD{{FAC4{EaBnS&SyIlyCp
zUc1>mVOfz4afx%m);$i&B#{1&`3zyZM?vq>R9(UFiZBdOb8E9F-{$~fAX-t#d;z3v
zjjD4WPG6}rS&!_!9Xgk}IJ^=nVtTd;X7gP(eaIOy8{V&z#9#X!ZNIG)=Q-e?eZ}N@
zmWW&vNszSk{3_VXEmvC(lMt<VQ+s^dJvl~a-=N}P?%`a256UIg`6C@U=mEn_FoaDo
zlK9y6iA>KGmm5boempyi%wx=qtsRrO0Cla{*3ZfE3z-3h>Y1`PQM~EtBUl+#*SLJ=
zPz+Pn1HS{k<CX1MLiMSxe(UWJt$R|3%vb8ew$IQGIS$pJgq7+@gV-n&s|fnI(UKGw
zYV^e}SyQHkqTNQ8(#o}>=Y<4m83__Ob1+>42UcD+WObMR3jY{An7tGS)%Y_sIGjW@
z6}ba9>kA3)0z!UAsm8BolOdd=FvA}v!t8D!r6|T@?mk?SsTBm#{DCkJ3zXluGGaNp
zp*?rAcZEtZF*f=;=kq3vR3^X?Ce8D!)0Px_XqLk3gV8zJgM~FWcNX*&pN#BYeI80k
zSjtKNVR|0=FVDZb{OxOm=3}<MtPSr@+%FX#>T)}1SKmSI#Z$R4vO{fF4QV*U1OE>`
zJ;#c$tpTN9<0{f#u$~L&W@BFZ&pGeMAvvM2Z_mP{5xYC7buS(qH<>%lb-EasaauWG
z)~b9aTu+E2p6gyh)kxbF!^8xY=dwdbx?%7s%ckAl7{vI`ZYIgHN{lNsP`m54NBFgT
z#dlrUbU3hJ_u5k7Q3AcT3-?tigOf}`Wa5;R-PFn5L;?IEqRs6Zw9%y_am-TVdCmRh
z&-Y+(PJT^?`)Vszn>ycrn@vY~5y}y7=`-gn?CJ@cG+z)ydsfgF9uR|S!d%>~7CKI+
znw}_M;MBh^*LChnE<O|yfq&{S`rfH&0_T?p;SXi&yqG~BPq~j5XP!O6Nk&SPh#zj|
z;d(5cA*)+s_l^+9i)fS+_FjjRXHztR;0_T2hL(dtMvrVt+BO4-@0Y*ln~#dBr@H^X
zSBLw}HDm|Ui!dzv)SyY{@#O=B$miE}$p+>IE<!4y_qmTli*%VZY=+!}weo2e8Fz52
zX&)bRNmqNJR9Xo6c}~zvcq67~XW9)U+#tVk0YrH`ws!x1=AG|GM`i-I@~~ctGKqwf
z_1gUnQ=#dN$=@L@iKNf$c+Nl@-;BABIX}Jht&56!ZE{V;?B`TJh5wlYHn)?lb%M`3
zf4}kOWxEy38iDcb2EqmSx;NzV#$1HL8(Cvt+Heo~$6PQH?UompA#Yzcjj1Bk5kjx>
zP1-bKyd&3fql9}QAa}>JnYxtWm~t^#r6s|@`vw}ZOT(0zRrJG1C<*>Wox)IkMG&)g
zyU>9&hyZ_xM(}i{o?JRio!d<~XERWDRDw>k`@GV|SGJtgnaNh}Vz8zhJ4yy25|r`V
zs?&dEnvc;<dAq~bf8MtrXZ)qq*@>9s42Zc7oVIe5JY5<mdKc)c%GnW2$I-kcKU3+t
zJUIerdscPC8O7?7Rq>+G@3=p1doBgK0cTsy_by4+RW3H=QAQWTCPddPR7cfUiNoXd
z>e2{=yleHk@$`#{<wLqd&X4DQj&wg5@(xaPPN>hUZNiB8d67bO=}9bjY+rXOQ-)#l
z^BiYd6O^u#2=5Bi<mlD3MiKu63VPfEkX<ZRk}QsjTR*P(cBSKfbkE58`=A&`;Vt(&
zz|!zqKk7l7&ObS+Yj}ZbkD9$(RM~XWzVAeb*&9jKk!0xdw41yNrM=M6AQ%jF8E~^|
z82nf~WcyNNS0|HhxSwY;cL6e}FzCalNOsT4+IE)p8~|f`Z*;nrX%GuHZt;?YY%!J+
z$2<hdt8~nJd#)3CZ4tPT!9}}?bB3F;e?v9|7ibwtzA)?qxF$>6=$QT2Oz6h2LpN@#
z0=woZd-sZ`(KD`l|3PKw+cpG!tV+hDul``W$n+~Xg(jIOr>~j9YGOJ!KDT1!93&FJ
zWkU$Ss@#qqCVPErS=49$v1C||V$Ai3i7aiVjornYAS1RzYmbn}-1#US7BeoWNTVYF
z&!<2sJMI4+EBn5W7h#5~?V93o>weX@e5~~6bR|RH9l7aJJtXfx**78@D^6t82pP3j
zdL78N%&l+wGo0<NQRE3o=A#($cOMu0ydck=*AF`c$$Iu&;s=?u(9EztFy>zV(ss4g
zX^y5E@=qF<|0S@pff$hs{kG`?R^BXT&b-xi*ZG5MNNwy@MsnS9Y6r3>sfYbdAaBCh
zPeTur>DjOZWvQF4W^PSHsGr6Q$h$`xB$WhjM)N-UcrbJFqQ9fhaS;mgej0&mtN;PI
z&z+5MikjpFKag6efJnb?nYnF_3~1dY)PuAsyg&D`rk(QT_IMSO6~&zM(P@Y<-Wz}a
z8c1XrA{sGK!0ka(-V7)OV*1Ze#zpEnJ5R4qG@5keSj-0nHc44*b-Q##m_u@Y?GK55
zTopPp=P1kluo(%&B}`bFmo3>7q2HQMLOJVTHbgT>YNUsjK*f(L%bU)7>$lKF1OFMu
zvjU;&oAh%svamA5Fa(x~+XfN3e==P4xBF75EG9L|)?9ziAVAr#zcdNcSB**Vogk4*
zrFuw2&hJKy>IE*C$=shm1}TBPA{c7Sf4cr_@U)BneQ{Xtp(b>P{;GT4A@z3Yfh+%v
z`OoqE#@-J4?@u9VKIV6HPxVZiL0c<{J!nEPoDF;RPFTrbOdw`fxs}?t0P7EL(YjA7
z4CLc?ajV<jKHjzJxBFYIyFnLRLO(@nD00v_Pw?E(d1%{SZ9G+TONb<^p~~%O-(}&5
zciUo;dvfo?s4%CduL%9)6G1U-ZQ$quw<nN;Z;lejlFyXN*$v6rUzST}N^l=p->@j1
za>cy4o4Wb;vq$aayAZgFV>1Kg+vpA(5_PFhdv$Xa7S{$Z!8mp&F%JDX%aY3pvH^qM
zb?4!~CosBhKCAQ%du!Li=jZiEH>sI(%imt+ZbJI_4Ox;PdZ&ac)Np|n&w^8_4I!;8
zbgUpzvd%Sidg<B`qP3Ma0s0-KO7J=nb7K`sI#Bm@gEfUuf3FOkV-W7m6FMg2a{>-P
zTV)`-dV!A~Zw)aP!`@h~XWja<I*H5~&UblR;4Dfh*LcEfMVJtAY$>u)o#Sh5bR(5X
zDs^xa?b4>;Q>>+Jswdq8sh>erGC*0?kgAU7cV@okW7Y{cem79V{E2@{0(lWZ>!ULF
zl?ts^v<YSLVnCw6OEM(e?JCdwYy)$P7}aVc%?F8{i*dj!JrM2IfLb4aIkqViPJItG
zBo%B7d~gB_k8b#wEX#i0=Qd_M^Tl);u!xo<jo-)*VH-pm!}YGtv92Z_qzj1T`fp7}
zZn{NF(wwGTbstrU>=0IUErn|%lSS{?rp14_`O%JHRJox48X%H&Bc_BX30M8^Sb@-#
ziX#()&-Lg<t%79VumG<+Zj3!|)~e80@hkrYkpi{^IX^U%w3`&Z{$kVw!GL!gik~uZ
z4ikE4n#1A1JNUzdh6+(=&BwGGpB%u7c0&F7<H|v}J8j?e$62Y&oV;C955~Y<dKoxs
z=EDh&(w}vg5=1rYn&_@Y@mwueF)ZLd`$&Uq=3={8@Ipr>@L$MTCjjjZXKkccqpkkz
z;qrY1d7sZ7=QuHS-0RiEj!gZPMswi{Pe<M=OaFbo@~CQqbX;7gLLyHiMR;1>psRz2
zq=jG{tuj>oBc266WCRGPj-2?r?i=R9l2&eTt-a++!-Bx|55l7l>zE$0UWU+5`tWpY
z{MWqc^keoCOTAZqdl$(r`zV_lX5LlF-2aIn)4VDS4KxBvqv>7oXrfv$z;uUxA)g+>
zC@uDr8P++jzV)KY!G8E%M=!@zR;j;M-mtb2IuKyJFsH9<!p5+cNA1xh*7ABC?zbdu
z#3;8VlNgJ*`7O14`G~fR&9#G9nDc4=*Sy^yzgS|%VxzZRG0ub4TShZKA(g^zZq&7D
z|EHRx0b$Fl#rjj*dL7dXo+mcrXq#l`p?tgi)aJkO&SY7hUk4Dvrl~c3w|?lwfs-TE
zTQrY~R_gW3XNZG>cj2G+hF|}MTNu4_Bc3kWuI|LF*=21In{qI2`+N@mR+;ZiXWEk1
z7Rm-=AdFaXvS0V3L04XXt6aM*J=0&M4|~1si{TRor<&zM2EU#J?wS6IZo3$BH)+2-
z)U+`D$-?%}u~dF|B%QZ6<@4%=ve;<JM&_WA1kJ<d5vn$ZAy|VRfsW<VVNt_UUFebV
z8$(RAm*x;#QhAHVm);9OBLP-3vW>gT*?6<*Ilme+sY;XPhB@WA#t3w+iS#d*K+pB}
zpGXICTC}!YYGp5$PfC|JEXO{GJo988-+(z%T6=1-`FO42@YT0Mlzsb|FAhn0JHUe&
zhIpkgo)j$WC;-3wUD2n3MG|i)XtL&Hqc%oji_zjf&U7G~DY$~{Xl2(eSFWK|J7W~K
zY72f!$m-y&a6Tiq5&~py7aXobpO*O8yD6VpU1|V3e#xWhoy~3Ni(yQHFG71f+j~XS
zR%Q!fDRKFk<c()#7qdJ&@+Jww&w>N;nWHiT!=+l7J~-ajnSjZ@a#pU$O<X;X`n0_&
zPBIXS*4jh)98Dy5GRy}_iRhXjYE%!0x!Suk#rm(^vy;y|>~+Cjxxxu4#`EM6wzyFk
z3eE@cTUuo{EF#k__5wEqord*}ELbpnmB)+I<1%|#kVW_*9%rh1IawG%$f8FgdaG9U
zdQepnu(TSp_9e6?(#RCUFkADvbDsf$E!77RdwWTs>Z0^aWiL0ZX@z&nUUbnbr<4XM
zJcWgIh9fakdy2m*wrla_OW{IAmnop>-h|N;l=?0v?G}Bk>aMg4s<AJ2kAu8MLwW7_
zuA=y@HwJ)F2%&%{8&<UTGK&u}zcbAvB1EbTU1}^%GZq|vD_WK>h_ydEPxI>63Y<2c
z<ov)dH}2z6yp8xqa!QH1QN;COLYZC5H9ufyYJa%JA!=Hpq{N&5a)dE3=_wtw+*B?M
zvSu`L&A3^q&)KlUMSSJSe&}guzi3Lfjx%;>^<Mm_Uw5ohNBVelQELz3xR*uqwmr~g
zE9LF75KFX-sNYYQ<#ANS#Al54HJ>7zd%aU>+JIYAe7mU$rr$n~e_qr6N^+=Tf;}w$
zFk9=v#~Q)Gq>-$1mPINxu(3NM`W?o(`?Is?rY&?}ofnT=>HngeTG}AbI>Gk!`L4)x
zRrE&jaqW*sg|>QmLn2+iV+=!B=yN4dkf>Xq7hgxfpSCDZ*x=;n#2d`~&F@V={L8Q(
z>Ob=1tu(S@YJ)#>v5x-B#d$44-6a;vUc-erFekVe7$T?HDs{YMJ)?VQQqebu&@L2Y
zqwNWBg=e?MLx|mY-dC2F?H2q>!uyc=NPL<9LK4YN?bfx*7-zj-Xsv&mPUgtC8(-cN
z5+dBgwbxV-7puwS3|2U;x$Fn&UwQ>7y{5W7@b@rl810oenc^ft_S28hsNEcoj^xb8
zC+6cWmBV7?*4}!@{wvC`-6@;Ei$#aS&ChvRg6Js|DiMCett`UQEE7Y{#wjarM`|e<
z%hENY(K2*qUrr8)+5W#vx3!L3ye>_D>~y+A;`8@2&aI_2c5nFEtIaO!iMWIO3F9`}
zNCcn65VhP&V0<N^e}Ug=+2(-_Ea}^Dsa^X?0T)GwD>LHlcemI%>j$Hne9B`WakBhv
zVkN;xZM5mK#M>pUDFLSg@yq>reM<OtcXs~k9mAWI^%Q2+dCeTqV;z}!FM(Q~^R%%;
z6~;fv_A4^x9a7fswG>M@akO8d4*v5<H(x=oWePnB4H$vsA@dSF<KAEXtLyctE^PS?
zR~Nq@RcsedSlRxylwETsV|}#n2rY|e{?(Cu*kLCW-ha;__NDMz(oANRtg{6n&y=Ik
z56YrE)H;fJEFx8%#fnxsGwP{+|HnQbQqxL9b?zj?xvTxY+_nWABmsOeoB(TDg{`+O
z3ma}IE(yk@YJBYSYIKD2W^|!T7Xvaho;saE*3INB(3iG<(oi4wl$?i7;<u#HuR=)=
zbKP<qC6U2xd@Y$<?j-v{rZ%*4Ox?7EL9NoGjb7#(am~Rw_h-lk$|LAvn}Z`V!zpkm
zn(fB>1#dYq-jEiyHXav;Xj~Po8&^HyV_bD~>&;t#93-<X9Pseq#;ro*^Jakp8d%bS
zqOA;BNkX*0h?lR+yav6eu_05i^yNd_MGd$k`cSSuv0X6e`L+TM>@5qbyT=PW_)Qvt
z8LgG;x&?P*Gi^TEd@<>f=4fb_`)-$FGX$|=9e@Xb7G13y)9@$b$1yw4n8nDNsx0#4
z;g7<H47!GV#u(@PUEx@gto7`8d}$_wZ^ERE!i3^;IXuUe#WR65%^zOmzDsf5XOG&x
z29@aZSRtbP5GqBFqm5fvyAs-?+^57$%R7U2Q=M}^Jk}7Hi|?|yOVVckDIQltPs5y-
z#rj*bd45zIW&<*FI*@&TJzW?%NYp0g{Xneocd=$3NN}!?zq98aa_6FqJU7)h7jOUZ
zl^k>Wz2=E?3O1@P@6Wz7zyR^vZhSH6ClxMX=7*j(l+a8fIjg*VdktFh*{PqPysbV)
zq7oXVwZ}3<HHYzYsS`+VaAoa(ubLY$F0TmB4@}!Es*B^y#|DBV>@S8Ed8?>0=FT`$
zqyqM8&hbK90jCAJsiQR$HhQ#saZPcg+9Iqks+RP3vDTiK&GNzI!}&?^-G+D%YGd;J
z!kac6<?5_pQ=g*n>M+6%Dr=}TSQWb-M+<Vt!e+Wlzw!XFlLeciJZ1;-sfVy-#Gl(s
zrwyP$eQqlPK%$?wFdsNmpYAVr25!&k@1<H0l1HVF&VK5SMnI)Zx2*`YSULN8SK$&d
zYsDMP{^XJ`?o^G;{3=oHO6OcWgV#{+vVj=a9xhG)II?Nw+AD$6s7r^5H%<li=dm-_
ztd5DB-m8>h5zRWwM9++cLsA<B@i>NR(n1IM!gyzICO)z0cSCodb6)p9;5YaL_i!(c
zHd=#2Mq)sJmHjZ%lXMkTJ)3VlErRb6nf?T)scEP*uH+cPZjB56+Hc(jFQUN{KZr<z
zv#NWXy%Js%{1F>W_G4e?nWkh2;}&cJM7=Jj&FmOThK-A=+k&+2fg%*u+F`NHLloBw
z_0cj%Ll^UjW*sJ-)awIOIpLZM!EwRtFO@H50NX($MO$W(zsMLVIZ7pV%uU>Erh=n}
zxsS_#7FhTVA2NV5pJ@93HdBK>|9sMoKZlirJ@at9CKqb@gCYK`u9R`Xc&V(@;`ohj
zRYVF^P%y~3uAU9cUm4F<7++N1R<|d+^y4khqw(O{)B!43^-aunS}|_ZY~*ZE6DWFe
z>}9EY9nCxCbi+)nCOFL5bgl|cvF^L(?;vRde|)xzBW;^3>#1~x`iY*TyZN7OO=KFJ
zqSS}(iHXu?Pe*M}gTS+q7i$(nB;b7F<3%IGM-1a)yKyi50>-xW`l&Imf&!>v>sQvN
zD^bgszH(Y-l6sEy`8EO%18jO{O=d+&Y3BS0UH`esEBZr?Ua280Pn*&Y$BqZez5Jkz
z2`&x<gF~yLP+pyP_9G+yeTJ{4TH8_LhV9(((+jA8^1jmGn+2Ko>dwDA(@LslrYiaF
z>M9R2`KRUi$}X`GosgiiW*5mJ#{$NEY1*y^9~lOSCH?`vJPl1cm2u@w!ho!Qri71m
zhLt<KKl&IM!8wKk6Ow@xAu5?G*D8Ea&xibhf%(4VBGS{(Yuo=XL0@mmtxlMC-wf<|
z9JB&lmOj>YJ@rL#!T{eeLr{m~*o@JGl%uK2VPo(73EuH0rl9y_E-Qpr%uAQy*v{~D
z$#WK;bXkra-&c#UdT>-)%*xbGhB=Nk4Apk#rAv~iWV;m-46$;TU%<8m51Z6-9Tw)$
zWrwY?Cg(TU-#m5bE2R_AaH=CU`|iYzEAU)*MZH1XQfG>051?kp<R8{vZvLil`#2-Y
z*(<X<k<<*hqK*;6RBZB@z5QYdzjsHK@E|<rw6JN^PTO>(VShaJ@T-FTe&HBDiCmWo
z_i=#(X526oW~1ula1#H@S5^J(BdxnWL()M3?|(N0AwWVxqiE0$4>fKjGbygx3<OnS
zdVzFZa(@yqmV58#wWq*KU%7lZiPlr`=^;`1r3*ZnaSX=7nVoS9wVnPadY%JWZKjlF
zJfx&!T^>zwC4k(j?*U#E={M3djIY;QN{_hS;VYkXj_JCx#pkIKtvA*aaHSiw7<ptN
zkiv>b!~h%H$dlEElDnpwX|k?g9fXWw6&VHfsWo8z)FlHRqC-0#<hh<7Eo~m9O#PaN
zPTwCGX=WglsLUJQF<2|zuqblAdgpsu_@WjhWNR|$-e;;~EXe$`F=eOBTWoh>=Dm+7
z^Cy}`oma=T=DxPFeb#lPG%;&hd;QDFH!m*OtlMuhdZC?Kyqv^L3mU#!tF<1?vW5hR
z##Rb-L95+XFJ@2=ZJNk-@3ghN8{k=2iXQiFii-Hk$7t(y?F&32(&LPZiCur@d>qDD
znAhn#`GB9xu8|P~w$`M|MQFZ;gUQZ;OzD%yykXi;s52fvSVf@5%I(xhMKq_31joX<
z>Js1HbFRer$~XT=Tqf}}vTFJRRWB8tZoP5+x|pbOUglDR2BM~ohQmOjYW-3EVtR&S
z-8j~KQvN?yhr|dp!cdaRCQWII<kEFEk#scyync8iUGt(wE@!sciQxN~No=B!>~pd#
z<_WaPj_Hu1JlogW)eMU3@pN5Qx!~w12EMq+@3&AnrLz}DC<8V57$I&k1Fn1oJ<U_5
zOAQx}$1k2QHwBj$CFY9JcBs9vY{V#yjiylRdtC@Q!#b}KLG(*ek>O|#uPk^jWMl6v
zJ(IFbS-;s^<!Da!pPxOae_fAB;aRBS@L4ZDw|u-zsXevXy0>~d7i3(yGr|;9^NWCI
z6nXI{wq3vEVix7`HQrs8sUVf?7ZRC%Na;td2L<0e%CaBuAKWTAF8<>;G%S92KvfLA
zlh$56p#Ed{?I-ds2cC(^rT#wew{wV;gArG;K2xN-Uj?L+9KCJ6hXNL+Pbe(Y0kJ6E
zGm<({)RY^LDNRe6_RE<5r!~?Fx~3<y7}Gks@JhkX9v7VIAXFd4*;)~CSL1v}?*82o
zV;jeCIO#yh53RlOZKFs%YX`c0iP<kT1NLdlUh?Y>%T=Am`^DwbVRwqolCn|)*C0Yc
zk|t&~-01WFL(x^oHPwY-Iz+m=Q$iY~l}>4plJ1ZgATgv%kd%;8K)SoT8>B}Ij_%&}
z-S5Bsww>LbbMJZMdEe(b>%Y2WI}15NnTQ4X;9VnSqwjCcbJ!ad+L0al-*Lj4y_c2k
zeDrX?&je~`PUx3BN9^O2@BX#aLv5fA5#a_R+zJrG2KLy(i8O5V*-}%S0)d99PKJ*z
zmjA#+QGT2cR7oBB*|!Vx7K8k`ZoD)Hv&b^{pGdsrB5RmeNI0+YvxZFO6VO7M+W@?B
zb;ZT+R>(JbDWT8Atk;-0V!!%bqa*}R)&ws+R_3IQc+sMHJJ++j66;oVtOP`Y6ew({
z3g29uV5T4in^<L?Y1J?}%K=nT*H}~U&DlV0bckEubDsZ+EYf{Rbt)`x3a8T=Sr+Gw
zSJ6I>6Z?&m(r#Xt&Q;K_hoAp=&lVuUU_UclB&00PoJ$j9SsVEJy%BXslf$Y@%l&XZ
zNZ@9Pxs4=~19p)`%>Hf-aC!^VeP&47L40<ICvq*b-FPddIeR*|p~Z8~PRy)imt$9=
zQ>`D1*sr6%;^50?#urFgRGeDRhG73}%jI*Y!hkYFRI@(SBlt`2@&21lcq|?^Fjphd
z!D9sI#>4%@%lLe#b;R}{yLyTrn_x=0z~Js_BKVd~z4-}tTTTsFvI1^V?i=^6dKXbT
zd~|(qu~YCthK>khhQXup6?L(h62Mp`yvhzRy!z1%$4nw!n?*X;fEMOGwee8|+Aw~!
z{;H(%0w`9_maH%6<q*4F2u&dxPkkpvF;50jdSrGZ2!21q30s>;zeQDLFPPH1Tti=g
zi!Lm0p02yH+_G5i<yLWJQSAqhHyb`c`pX3swJ%KeT2`FNoTuh?%xYcCQp||@)#W;G
zBnIZ9HGl;5O&3W$c>bESM4~sxRhKE^f}pzHhEkSCu3+HTKA(y0>-N=!wMimjh;9sU
zG)|Eem{IipMj#fp7&fBWVt6Z^gA>hl=VO@DMRe@>i{|~HwTH45NAa2z8^8oQQ&$@)
zK-eEyA{wV+zaI9z(g-AMRput4&)grsiwe4khn5SfDDEbPl|T|`JCJgH%mM1%06$b>
z3O!JS*gxfl&Uq#8tD+R^Y{Q0+q0a1mzjr$fP+izdAr6U+nCnNZg$iqUdkO^@zbYb>
zpcvu}h~G$gBX0Omy5=Jv1hfUGCu3oRxW54s&Z0gpdhs7p9-MV6V^77DLwLsx2Fugl
zT~FMGXmk_Jer%zREi@4wUna5v{4(7a14i2VRgeLnC(``(E?p(akdl4~&f-b#|F3kU
zVI$8k>|(?%08&+iUxB3a>zCfy?@EQ<h|hmM)ECrG?gvcV3WQAECZq*U92Us-0}q9(
z5x3NHxBHm@eVycw<zUwET+=;aQ|Kq|%YsUrcsozrL8qsvNA##by9Y0cZ;r74n<&=^
zR@@L=aBLCHff{Vjjc3CQH-rHEVQz>3H2Ap?*Taz@RrdK0+;*|#7n+S8=hLtd_;cRi
z_CR$lsazW&XM-5#X|;J$AUFAE2g|F7VLa<2(0()M|2CEL;ZF^K<OKR~qU~|~tdaA5
zL}kYhDhU3CRCD+AjN-z_Y2`q6WxJ|1<jlL)RG2lbDC`gXN1>9m^1rfjMl)L{nJ3MT
z-?KE~Z^V1Ry~#P-VtitY8;@#8!B8O3UnbYIurF?LFqHnXt9LK~PWjTpcUW9-pMA!U
zT0|0R&HSM>b!NsOh4?#i;jlmd6T5&Bn4<MX)%ReQ2G2viJ+3d~Z-#|79gfLqas6N9
zb|(;xEzGKcQO{?m0kf>(u;l%I7#0B3C>6o48k65W=D;<K-^Gx|8)<GqmucyVOs&Sv
zWf@?KYVQ!(8#{@uffk`lOJpuxPNj!V%DyU+)DkwLql`bVdF3cItolw@daTFVX}|gV
z4j$*7%OoZDthWeODNHfZw-SwdXW={2^RcYKh>VQ3(B@ClQ#$)UxU|1OZn1C7fbqOc
zI*q9Sf>ZR~%cF~dGfxiBjC&0|7J&;3SDuI<cji{?c5+XqqnJ&!kkC058Bn@1?%wV?
z^;vANvqD0`yb*zi>@iD5d+JT6Hc)qGvgN_tQgPhbT%CA!Pr@|0tJ|Bh(m7SLxT4KE
zwLd87Pb^)<_He&wZc0=^V({SwxWP^ZiBH}+{Ex$z`Ok0LxVSKFkM=7dCqlxQsEArq
z11}zCllNaLIC8G+Vc%NkLHNF2!|}?!w~znouenkGH3Th8*gOq?X#1$YH*_m?2B@AC
zDivhFNvFO;V~@hgT@#xktIEBLm}5Evz8fxQbbk-+GMqUCWr}McD>u&#fIAuw-_84l
z#6X%pTm`B2J5)G!VMbg%V4NKLs7xi<HA~F23WnU9lGlTuepfUfv!&OMkp_{7&$d5l
zZGJ~q|3~|pxB(J9Rk?PjedDsxUHaiIwvD#qj)lKaHAAw?;13oJW0OX6t=<Fv5IjgC
zU-1bqsrzP|4|%XNag`VvgSgq9!T;T|yJv#Oji|rJG}uf(iOB_|8&-GQ`mD*BMw*IE
z%sekj7q)&A{bpAb17^qAY=*5HKF=rd#AhFd5%4?!%x~$-c|Ok*<F%9a`4bX$JmiM5
zRG8Q5r_{d-d1%Z>pGq*M@ez^lKbvBUA1o!M^1>E#TQ4^WWF2IZWq^c@GezSGNSL;M
zrRg9Fd^Tff95D$aRA_Zq`BS|EgaV0Z^2GCL2kIGBwm-d)%|egzr%F5o)Cv~YA7$s>
zFEx5)5AP3rQQ5BP5*G+J6F5*=!cm1Gfb4LUk9ZD9L6P2aNj*v2*TTeB-c9V*@7b(`
zdRgRJgT;ly%{-yK>>&xn?Cp@Rm>QT29tNvdOF#*d2WGxtBkpx;J@#`X6ZBH!W?x~b
zA<U1N19R^-QpA^i?JnpaNOnKS#~qM^Nxl*`4z1lWK4Ca)^L7ilZ<JEH{n2ru2DEBN
zJ_cv}tDs9F7>vGej3gS#->|v_dwl-pH}^M@{j3cqLFQ<pMT%a6*AvhcF(dy!{asi*
z8`Fe*UUa3S!(*uH9=tw#hMEPO8Z_V-NVImTS&obv@31>3*vBwNSkv^2`92DMN@{sB
z!Liv;<$r3=qB5rfUF)jOgdd_izcm8YXS{u_+EGF)Ppnq<TYRBuNA4E?pP?7p`|<E2
zU<nOe>9OehGUkDoZt`pm)_$(jy$c`uV^(WFH)d|G|ClERO+Q}Zfg~8NJO_`@9%pWF
z`m1tYgY4(N<KrU~*qljd%7}L#>k_^{(v}_FpXR8Ps;%;eH}B}JA#;%75}#olfD{1M
zRLOaD&#7UO^$7*na~Y9!mYbSHBp|Kf3?L{EhX%In47<g!%=_xaI|hMD+JO|uvpVor
zPg?!Sb2(AKj{I~s2+C~g@LLmLhwTD;3&L$QKTt<)Qb#YDvv>^JwN`uIQmiWx9o;4m
zzzlm*uu7jo!0h_!Pr$DL8oQIZjiET&6?aQD&D-%%-Plx_wh6y1++a>El=aqDOtw@~
z`Y7rzshl}izjNf)JPRdaVWVFeqtj0g6BwucK^41dqOnrIu|kmR_6;6U6rG`JDX@<t
z91H3o-ROmE#%HpWu{xt*|E4Vmge422C9Ch|Gg+iIB5T!ez1Y+fvglrv83dZVHFE_?
zS7THsL+ACp+l{4>kyNFDO|5#n<KpxK$B*07238znBqU|Ieybt#duJ1T^)9d>VEC<5
zuyeD5XD6UHlc}3^ucghCfVmb|U@!l|z&(RwK2X%4oZKg%%WWqU0>R0~bCHZrgo3&O
zo?2beZ@ts$QWTF9s>UZVf9A`Lof9H*JwCY087PVlpe<?~pP*6rs~a~5xJyqJ9_BIj
zd|CtUvG&T0$D)E~x@Mw@PwDMP_0ah|p2?x=0K=v#ev^6jD9&S0@ZuE8vk)K>@CIj}
z2;^)}*^}mMk3Ya-gz?c*+Q7Bb(i6k=$Fsxfg(x(@K}<j<gPolM+5A<`WqT#9(%T`P
zA2<{hCe$kTbgFG`@|r1KqY-@{`uAK}AfCM?IYqNPYZxpMyHp|0kuS6WDw?31F7~vw
z?`C0}=V(;nQvIg$@j^|3%=f+259htNCIBs<*(SI{`-CAxZ;eO#na_DRsRG7wP&?Vk
zm(te6oGcmZuCXUw>RfK3>SF$j83u7<3QBn!@@^<@MTWJ#it3+QMOAOnh}ok(S2s(V
z%Oiczo4=xMRi*+wzL{A7dGc8UW=|tKuG98EYeNQVbWEP}z2b-I=Uipu4b&w13yVLT
zD(ZR9s(0a#`hx334HT+J;Fs+i2jYq^mYZ#El%2+45d;WKj@p`r8Dw^*#7|Sw=qmgt
zd0AWra|Wqs9<rqi2;UPim({PniMy^t`|MA<Ii;HohNiN{?-ebDo5~?}mVKuY1*xa%
z7!B&=_1#Mc5ltUo4}qhX<fp9LQbp5uOiJlV$W5c6A5NdxlIdgrsyb(80L;*oMO>zk
z(7VCoY7h0yu8j0LEjv5FVCkzLDc~vK?Y1O{PT+T}!SyHHPlN2(j&pA$3oC~B^Y?*0
zR?mO?s0gO9r;)O81oH4i<$@FTm8kg1ACmmIOQ*rN!+K};?uG2uDRi;|BEWnFaiTX?
zoqVx;1mmFPJM|;RCgeu-?~`T~m|dqRPK>1zMuqdNDP@uCTqLsrYZKa!X97;hB5jT4
zBcq48vJ+-<XXJXpnI6}MvM}dQ@OI({Wt5oefmRN>S7c8ba8sfsp9VNuo(+$ryYl$x
zKdyOe_OlOg=tCtBd@*<y59M61bouNDh=w<Vc*T9&^&tMOG<Mmlx&k;G`o-h|b2kOQ
zG7#loE4i^c1I1a!=4$%{_$A7R*A^3S>eWvzRu(qWJ0@fTd0n}#3Va*ZpFi>z9sE)7
zAn>Q`VS`jzy?Qk7dEmwuL;g}_bvx}myqz36vV_HVW`*mS)-m!Mcr|ugHc$Q{39tEV
zx4B7GTIWd0r+vT*xx+(89bvp)x6$LBda@w2>D*hY3I;Thl=pZ?KL!fW7V!K7Rex0t
zU->pZLF0k4Z~=rwOO3l8)1Q~Iljau}aSGQ%q53J7=J&#V>=E28FYeYTNGhIl{9bSH
zcQ@h}uqBf{DB&9~8BV|}Ov<5}g%2{Ud47JC{X&~&_Vwia;jr}Zf4&ml?QekO3ZPgO
zul)rSmRicI^-dEb41LgsOL>HYV;+|5`ZQnDB^Q@-7<HPD%h$glvPN$+GwU_)Ve{dz
zmN_FnpWFl{?f}>Z0|mOrBXG9a@K>Krk!PevPESWZio6P87tuLGYu&k;mwzakb4S{0
zfv;ON{!y+v<VF1lNGdf^$AifZ>F1<VZ>&;qA#vA>&x#&4uLIy&%jMwMQTsMpfkaw_
zC3=4hxo}rk&+p%_-&7w-?qydeF5?Zc&o{Q4eOqw?zwW^ax{+oD(n(5DoeB6?#ik3F
zpF@%$tw`rTO14=}4>wDmOs}Yb>g2g=y9WO*$p@g28e@=wqMQe_dUUU=!<`11S0|^6
zBsh=e2PD;g2X7Lz{)ruA4om!VvN-xpm!y|#^!wzJ&;02_YRFk}>`M1kA-7ZcDyt)$
zw$-(*9+xkWsI~N&RoU6Q`#rqFrJ1^^La6~(_s~`Q2Rn0k03644V?g#nVvB88Q{gri
z9INw-=PFdHZP4v5o0;e*HPH7X4J(aui>jdJwnGG*h;;~kz`6{sdH$>=LBdBWBZ94O
z_{%u(L#@c$N2gicW@=jqn!s5@20XLXZ8qH>jrgI2HnMtx+35Wzt}#L$zdP>=jjB_S
zh|v7qLZB!OUc7oX;ShYSfzdKH?q>paLZ-_ohF0~-y@5R@-#1F2M;$*D6+D#HP2;YC
z`7UN3Y~O%-q4(O$Q}d*;#14??@@_Y{!4%ZITM$=BCyj;5P@s)_83n1m81#ZqV3vl0
zIHb8q*x?eKJwzG>M&q|QkSajv$!=51M<NTKvQgLUu=}Bv+t2mDAL|yMRGxV)aKrO4
zX?FQsy;*_}Ub_3%MoE+ck+Cnq3A<n(_GV5|m4I9Dws#fb8L;G)y^31bmEug^s);$9
z217)^e{hDFfy@Yc&@F&XF!@7|Hl=0y0A!=7#Q)Syb(tq>@iSaQS@^I@YA&$Ar$Z`!
zP-wFjc#N@EPf8xuo);sRE^c-0zSsg9jykoQ+e;Q_VqiL|ckjM4(QgD^^k;*!wbz0x
zrHFeo7S<F8ahw|!Rmdm?@f^Ds34T9Rb{?RT)L9i|z`#q-Y(+?Y_vY^7o4mt_$d8}5
zf+j1E!17ZoDP~K`o#M%YFE}D<-k(AD@u~BZ2s<aoV1LEc8nEZXTiZ4#3@4p-D<ky{
z&x|qNFV&7Xbe@rlp_jybN_q<+W;<PZ5yCCTSBx0N;LEh9Yf6G1qRYFhXK7)+WMA}M
zZMnP2PzO2iP$W(W0qsVkZ-HEb+PB^E$^_Q`;dMyl8Guk!EG9m%KUSytNqU=0OBQzN
zD_S2tZgjZrmy@?J6L6bSJ3S}sE9M?PQXV$nCJ}QanHQx5i@fV-nE6=3Ki(Cdz1jUy
ztd?yamHutVaTa5$;Y9U`>XjknqO}t!+qk{!nDB1@pIYp_7YCJD--G`f*R9iLvXmji
z%`oI;r-=vCz2)OIt4eL@o%b^>keI-kbayS7UDsm^!ZI@xps*=eWBiI2yCU;Uoo*bX
z&vWm~68MD$XsxXn`RvF(ru4IlT3R*@4ITV8kI%6U;+Wiff54=wMD_b6mrjY^X|>E;
zc9r-axbc$Nf_<2mv~1^Vs>X+XXZ@0qeA9tQL5Q1lsnPQlk5lv7{&zA*FGMPA>1UT~
z&8X&=m&WnWP$;B5fw&AgHFN(c?lD(wKYs%j4fMbD;l&Eflb9uKrpPmdq|YTF3_v$v
z`?uT#BpO)4$WLSCRCmV0-`qcW{c*aoT`OJ8b1p>$0u<4Y2C)av$SXb+K7bqL|F!%}
zN7Aj4l$s}=x^U8f8lBaxUJ|8o*0VozbG1DFEdO8EuLSHmw>M)y5m{|4yHP0Xai-1M
zsZEx(gD)xEs-Gr1#EZFJVZ1mIGF@zk%&nmohs3wK0L;@>m-J~{Y&Q7tTD$yYzgr#C
zb^2&qLY;U{(A>TXP3IluDG2=GM-A%Sulr;A;%f!sUe1-IrP)F`Fn2wDe<CFei8NI%
zni2EFzWPCW$fJ1kZM05asSu&#Z{BZ;hJ)Ai(?a<+o)n9FCz(dP*X$|i$YEK;wKNAy
znT;FdTKztI|I_X1#9tsA-_>Tote+^>z4BViZr48XGK|?*JrwVl2214?sW&kTkk1#f
zctK8;o&+^RHrw2D>%bL%dSvX&sd`+V06(9=ocif%b9hGI@ZFoQmh$U3^t)!w!6~h7
z02Mah843U{(mR3lOMX>PZ&H9qqiKcW06lF%bf?Rq;G%aNN&p^y$^fdLFX$Q8Ze!me
zE+&BD#+0(kR;LYJR<L~`!&cS9Ib|!L*&+x9x3pvX%vi|VQ?B$n2RkPMVq$th9CnE1
zye`!$g)SCvNBcmP)6H?*Bnxb_RmzmnB4{2Ipx-3x4O)-(xSs^JJz>n4+VejhB)9jQ
zuHrbWv$Pw?e81d3axB{a>{tAtsrx1il4650ZlAvf=n(w-z*~&4!OxW<6<52)D63K^
zChF|fD?=2$A$rL9hdVU?;SY>^CE-qmC2#9*8m(=$JlcC#U^P=@L}7^|Ry(5F7lP1h
z(q)oX6?>mL(xkNkaNVY(sggKfUFJEDrqu?)UIHo`Jjn-j@YwxeWZ}n1NE)@VEj*&5
z-t!lAQl5dEjlSd`qIdUyHZoC8p-uCiqNUte_tI*Oj3HT7s}ewBy>gAqJ~hy3+xdk*
zDXIY%*>riF7xJJtDVMXd`b);{=%MH5nqF`TG83T5wWezE<yR`HO=|<c*Cn@W_DV2Y
z^Fd*HD*$rbJ9-6dc#gF}${?E`dZd_%hQ+~2W`!jT`431wmJjLdoNo$`fA@W=A9WL|
z8GJq^t5_`WBowdl?`FxdDa^-spZ6C4FyA@)XNVb&vIgx}l`o!Ug-msfe1om=7H#E!
zfAxg^7`C~3mwuKRy)w}J2DwUNZVdj#-SHkRUo`z0vhHv6ck0tBv9V6;r-QTu`g{X<
zI#Pj*hb?b6MAfJExkFIME4$oe#5<Hf2JhNP#P!<!Y1+<&$A4)CAdsEj)<5hAN}srn
zjM+i53_8z1YLuK#FBk64Q{lUOlyq`=oBc6|thR|Ru5Z)_%0S{H(h+Hx7cC1F)-$$l
z!DT*Iw`RX<G0+G`hjecZr|B#ZzPD3ej0vVOeG}ijL}n?}g~SgeU$<@`d<>k7KH9x0
zH7Q{Eb9Z1~t<lV_=2WWZlK|Cn0O1j^Bz?`2z}UBKL9TIXBV0qmEM8;4YyK<9Wh`1f
z!mN&}ws)oEH(fCr2Uw$T4e!3G^jIcz**h}Lizn+{Ci~=}219K+j;aV<f(2(x6lQ$U
zEK?s6t7VcO#&I_-)J5N>zUdJp;>+a6`I|a)?($fSoF$T`L)Gp5XtUO5X{a;@3`j_R
z0Dj$1$g0<yS$=t-F~Jn+M}}J%mPCsxc{-0OCUwcrmFBy29%>LfQnm790>jJNO6@}#
z;R6xq3U_`vEq$3u!xyR{b~6t*wY!{rCyq6-m0vr;y9tNPayEqofiV571$#6#BSFHA
zFekI%`Wkz+J0C~^O>o82H`9ZG*CAC$8<muxe2c;q29JxU-5vVBA}zmNB8LB=E~5SP
z4^f+URo+KA!VL4VAZ{g(w@XRzb}{C6p2d?0ok8!eL4{=%lo}6MWL;51u#YiCk-9aS
z8R-^-a8a$gp<+Xoii2#!xloaCojS{9<L@8U2|QP@yWlNepigRE*H&j;k(P2fer>bC
zebS}d5U@ED-RG;86yMLTV>%32tk>Xhcy0NKD}!`6gu=i~rT1k|J5)se(<C0Ec<oyc
z(%kC{lCd8t?x#p}z*S@IhdYL_-)5i-@^%~hAsY!oB44`^oT&%bBwok6#;na-EKXq0
ze|0!OModV_zj5ZF1fdlqoF-Ox<K|UY;hX$K20pYWLu}uGHwZ!W5=KiG2TPb8yV{_~
zkJz97Au#oS^jA5x;i6flcP38Dw5?E%qO}F)_=f-PQ&wD-0h(35Iuy91s38Nb69SNE
z_pzpzo#Nh4scdG?#9e}y7dOr0r&+GXA{x!x)Qdq9z@s*RCrhctw1xbpwG_>d3MqNp
z_v8G`nw&m$fD$<({46jSmPGqo_q`%B;S<(-0SJbr`HaKy*JVG{_FgI}hc-gFO-9`;
z^(}Ob+?|fEaddLZe_8Jz^RnF($%>Jwu;Ne1cy5+n)q(CZ-Q*45(<a!^v&;LE_TKgP
zb@kV+l`k*(pfP@*#ILnzh<$}!^KQ9vn~g-Z3GySbAAMQ_r@n)^Qc*b!Dii_+-O^6C
zi1HLVK!VuiM(hY`9-gtUKDO-S`fP@c-W}|%dc54Cw-OE&%BVp9QPX@zH*va#qs4Ng
z<v0B_e6Z;)csXl*>3)teBU_=Efx;UEaya}8!OeEkd}}OxOBg&{Eli3#ohP*T$a;Gj
ztjouaMMATc{-`zWt{YVY=yIYtzP6+C`l?5$7~NN&bexHLC2H|NA<*c~*U|d=7>fyC
zuy?6D_BR?gz9^FKs>P~Fy&@my7f0sR+S?Hg)&dKu+{umoj19vvdunx?t=jMKKX9E;
zSq0|%XXet6Q~2Fz8S_tLSvR8WGA$@2(4bw$qb|43YCWYyJG1OJJuy>voT23T4!q_S
zNJ8&bM2W&dQ=!$}X26=gJcQBEqjoF@U2KlknD2JZMn3eRmR6wB9DQCQw2N}&w_B+(
zS-5K>-D6WhE6DZFE`-nbqZ<ni%G+N@Q7`=BrwTy#D1hp(`pq_=Qh0HmUMGReMk!nH
zX=p%bjFC7hi0zPKQy1A|+bmQwMiO$-JQ|*&RNJU34e8|>(PIPejwpun%hSa{@T+yS
zAmbagDToHcn?K*iy4*`YSiK-iJ;V8Kw%&Tz;Ya~;S(I+~wp1e6ImWO6lY2%n{nPJ6
zH3EGQx5+PV5s8&JSlPW|pNN?gEFLmyH7C;}pPR}|rDnh)xkj@9PsVJtJ(LU7b_^G8
zWYeVvTd&gx`}o)!|9-W!Y@umvE?q4+V?nP@P;%dL?<-rwmU}8{OZRIUIGZ9jKHAuJ
z>1s(6xD!2I@7PHtzx$Yv)@CEf7Skp_EP8<#Br_Sf3#y3%VP91`og!cg2Y+RJNVjC+
zx`dwCHC%|&il;-YmtKFokUaQc1-u478ZLf1Ew^S=s1cwXqgx>Apmq+Zg*fB*NP2&z
z3Hg1Xe;=MtKP#OwU+7>MeS4H0H!Ic=cxCZDZ*sMGmmGwa)FUf(|6GoxW@W2?$yfn3
z1kQ%hvynbCuYa3s`B;>mbv4;eo<uBtY!1Ac2Gps}9$M~~xV7DWu*XE;`63zC<=SEc
zXUy10Irm2^Bxu8xvp+E(tC;BI+Mu>0QP<@*S~fR|%kBNX+dVql70G}#M%hZ*%eAYE
zzc6PtqrjEOyQY6})MbcGdhopqx2vwuSi)r@Gn1jl<No5okWW1_Nt=@mbLjb#h9FDP
zP6gM6ygm6hi&s{w{k_9>uFTy;KDyadVsZ?&$Gb<}PHnV9%TqZ%`;9LD*koBZ7Xf%{
z_ejfcR-<bB?q7wTJ-5p;WIv!UERR-+K<57b@u?FxcsvE;eIV$=DIa=bYb@O`a_(N^
z;M>K^b-BuWleXK8^7T(En+eR(S{tV1Pa4AvvVzuP7tPNCZ;v?kJYsLz+@-RtSiSE4
z(C9yDplg|oWeKYGC!FVkfjuZk%qSLaTZ+C{SD-q0&SS~7i>tG-)%>dFbd4NQs=JA~
zdFDboZVLXS66}oC#}wIXn<r!GCRl-eeS_HH4tqT=cPe4(%YmvM2ODU3fh)K6vHsS4
zh9v*~?f+LO8&*LSc!zyNmpSUq5_m`Sgd_)rZ?MT$mklis*X8>amMelo&()9^83#!Z
z#rgsg!m1IqP`fQFLNq+fS4`k#{BXt8B?aOF$rr~m<I>ph0YQ!(W1T`vz{Q)M-&D68
zlcs-F3yIQGdXzrzJ<v)WZJ;|u{n?8mqkOdGh4fwrLKbJFWzs8z{C`xSC3yeb?o5)4
zxyT<k3NGV>JP#30A!m((59N!}+JRGJeCTh?C7|)+S;1xML<9J|Vb$Q+#2<Mtg@_Z2
z?UA$^kd%;Oijj6TRyKU`F4!-qeegXhfAfeS$4Gcq)yqnQ!#BCnEx<3#hQHOkKOavq
z4yvq8jJgL%Xr^ot{wQK`a7d9JAqqY;hVO6}6!%E=j(`G+*9C6~VR?^PB2ROU(~!V2
zH;s2s*vhJ)6;vEvqVxiV%<)>G|L%m)O;w@no;}+0{6Q<N;IFuLV~Am@^pD72SSkqX
zIWx8XYOKVka?|AIsd*Tc_R93*NfPfdR`<jCgPIxFuBg=CZ+hD@EL6GaPSJHFTHWTN
zvlLHaFU9{M7$I5mM$MDW2+@K%^H7gu;A|JZ!Ac1JvgcZvmf*{o>opFQXs2w3k6)(X
zOhAwS`-&$jmhY+RovzD1^J&;}l9+jj32AHd%T>>H`|d1(B{G~$6u*1;A2Ta6q}e{3
z@!B+>&D`E0Beb>V%^<{K0xz&XO93ljHa}UDa29fd;gct3Z*jMLgrvXeN))jITLssh
zzM9{b;nA`n?Ks*?lJ%P&9+csXv@M`Q(};xbvrsqoFgk_=7T0|uK&!?SXnXZIu2kan
z1DNj_r4w2ncnmx_Bp}OE*~Ky2OCfPDqkCr?v9?yTdu$?aMooxJ4Js0)0)^kL16GpJ
zTH+^q{>z_|@9+NZWch5$%zv#RpaP*020m|>s+eq7JmcYgTnM7vK0vU`Ih*X@yg}IS
zUOj8k>4p#g2o8h?pbn?SLKlrjqfG7zAPD<kWb3AP^DwZ8D$=-FFN3Kdgd{t|j#h+Z
z;zJvPJ<xV%_XzP&jzLO*E%@Y`+JHCndW`}{{K+%(S?vL_a~$*+ai;_CM$(drg1mdq
zW5p6}#p!}GZz8rcUo1y(bT#P_)m!9bJI6<;H<DODW`imyDsK?4ke)E8tqIFdZV*Di
z8e{-NDq~*-d1Ev5IJLtq=p%>~9L~D>1aW1MosfcLz-A6-T1@d#AYz6pgi`QmxFHRi
z1>&>PzzxOLimVrR_*%?uBVw3z4xyz279QYm{BZ+~j9FYB)*ktaV4<~5$%van<nhl^
zg}&}}7zZ3#T6H@=6IJdT!ow?H1!oVc1ZFPHQ3M}pH&YYTUg&Y>AFo0?C>cS&jqTpM
zBvWQpf;F?SN`vEwq{p;~Ll@bJgW%aofoE)ErYdC)j40iHrU<;w`RDpos$#Z=xx=3G
z{&D#43!WsJ_uPTBnbB}pI_n>QmZ*-F)!(bNAdAf}QsDT<`cxPfvZQ)U?OZWG9s#Rx
zVEpXypz#f-l}R*2nJmS+!ll&zr-zkTSj7|GE@H&*s=O@O!Cv@6a8PmcYi^SfTJ^m}
z0)kmG&sRqaFmz}U89<1im5M>2N~jZ*eG6q0`4Ol0X_5Hy7Zy9@uc?|P!$s|B(aeDp
z(t^V>Vbvw$jm-DM=_zErHqz!{X<lSHol1frpAfY_m9+`il!sRfK{*qJ8hUxZ?jc$t
zI`|U#mP%q{N`v4>i7Mtd{Y^<s*NDj%Ien`}c2WYlk6N1wdPeu-y6xslFI_I(%3b0V
zDxxP=cO-Bn`s5y^x!@7O#qts%^w%-BimYs#%Q9^Wy7K|qj4yEDmnQFNOI16Ew=q<3
zm}F|+zEKVLTF1x(&t7p<3$5zR(LJ?HeoJja^(g<zL*_XZsnfkReT>?{=@=goKB_S&
zsIhu0H?e1at%}Heli(5C4cxJ~&S^T?Ff`-PIK<PQ%pbXnua_L+x|GZ+F83!RZgCOk
zafr<w8PLwt7V!%hVr%&>ftkkY_5Gv02G&ot5ZP0{ayFvw>s!dO8%O^N0=&W8=+;qS
zG%6Y3EPY2u4f<0dV{+5Fi}jrYJr8jlb>G){R(9*o<nK%?iP|yZ92X(EUsp_h6NDHI
z^X)eVFIy|c4mT8O7H}gk>@`L(Ow^DD!miAAyc(bInhD(j->Mq4<wZ8gE6ZxZw94O8
z-t3=h`l^+E8kG)46S&l>>rRKnyVn2=d`%Vz%kz{uU{OL_a;qvz)iK;*b%)q0k3nIh
zh88{BF60QF^Yu7w&dS;-M@~<;R@c;rK5WG-$G`Ao%W40#ONR1{n5GYe)^ZKEbGWMF
zZ<k~!Z?A~9^fmW(iMFH=y4*jR+?R{K;j&=GuVY$(9VLuFL>p;0+-iOpM&EBLBoL-)
zAmSqUyx_qmUI@;d)~G+pJqu<7`=`aK6lyL@R(eetOrkuo_49ECYaWwH3zoaNbgx&-
zBqS9op*|K6X3O;J52K~uNJrjI<Mz}~9CYeXAz9Lw<^;=&U2|~WCi&#qpoRzMP1WE+
zDVa^jCaHx(1bR9aFcbU=oCIIVXva*h+Qmae<vv=gjxOb0DOo9#3tp9eO%A``RTH})
z+Dd%>4IkAXaUyj26~qoJaEcV-GEc>oc+g_SVkMzNDFrKROM`fG^{;Fsy}OZ3%l)q#
z@$szd$GHC;1R2HJlfqb^{zf&tM;@~~$;Iza@CZ$eL(l+0xVMB1`Jz4?*Z;0HN1^uD
z!ri~w2i4ffw(9Gq{+!_{I0M&BUKWb7CI%B0D`2D>o3EcVmr!z1I$li*ns|Oj6@HIu
zr1KD}-JG(bb!GTGJY#|(rhn(>b*`H@*TTXl`%rX=j+XR225@DF!<rl~dxgPbV+2om
zFt!Y1Vo7ie<?_Li>5atg701rbzD}$8SzTQFbgn3F|LKqC4(tUz{UVspoF0XXAeKYj
z57)NRalEWcYIeP$&y)OBwzpjp&8RcN#~ipJJ>#n9H;CU*S7RPCey`HAGoh1@B27~@
zLq%c!seD<HXol#%%37J@)cbYH%32nay_QNXvKHq+dBqR5_oGvDzGJ@6z0(mlEFprp
zRk2#}%gAixT%0G&1?m5Egi+$PgpTrP94pyPX95q=>&i19w4_KnTt{$@9<3_szdv9G
z#DR{~qCQ^pO?=Bj&|Q|j`=76pJxmV1OI0oYck)IP8s`srvvBj%#N9}?qm+b(QP5}S
zu@`@Zy{z{{9EQ?Pv*#^H#vZH0tM1Y+`2~-g%qT(O#DRLx&Ny^UTagUoS*6{B$;A2!
z<wM+d)yRwS9Y$;s<Y}L2la5i>55eUCO(PE`!<lMI0SwE)hJk;{a##q4J-%C#sp)#U
zpN!$x{&yPbQV@7jaj3EO(3?FeUV_TjJQcVp{qgWG+JyqcEe;zl7lyC_ZArf6Jyw@v
zv*38+Hr7lygzaR#Xw8VswYxLu&PwbvKjVu1H->?gmtF8;v)LvdGMiQraHgRj`m)e^
zWQ7Y;3u1+zNcwx<kB#FSO{2||%s{ZBNaJEwxYx(C3f3PVh3+4%TLyG(jellQhD1U|
zyn}2!mRr79q1J5Jw-K6sQEAV74h!^NBA{X7Id0cxv5boiGE-{l4>*7L?&6!1My)$4
z=FjnKcAFNNBhxMHHK`D}%)2)>*|uSfpt+k_UjP}9N7cZF(<H<Aw&@X})d-9E$@@NO
zeSTBi4TURyjZwyA-DON_BzJ?q+I0^mZ|Am9vqkcnkqnF1&L=U-774muQwG958SB*9
zq8)3Kw!b5<@oOHX^dpk{*OnG=74sTODG21Osw-q#gW@i6bo3zQpM>F}LJv#yn?qhG
zTM%#RIsT}F{k?4CkVw|;0fD~9-#?|sTq>S&wS|3<l$g|sgv0x*mYSZ3`#kBw`el-{
zj|_N`@zk3c(W{Zli`NK-xDvdlST?@def5%3#ZgDbdmYSgz)#2Vq4%-+DN5L7!kZaO
z>;C*f&>T+G`yLWbP)qT#Yo9Nf`Z+X2BKnu)()~LQ!J+G5B3U<Auf%1+Ck(`Xj7ON_
zIiP?OOY!+z6p>m>|A4|eqOBJ~Y_&G*CR>H^zQ0|@PO#an4Oe?2dqG7tvb;t!(+zD~
zvUeCU;r)upNYRD2$zcG9Kv_fBRy}rbAK$j4*zre53>5sXVn`0MYQrtqsy?F`>T+jy
z`F&2J4Er@60^P$a<qFWE-0JgYPHydaOe-;-4Kn@ewCK&;_c3a@7%IYY9{y>6r)=S?
z)o=zb**0pob~LOQ?OPS|5r9$QrTW$eEYf^Becwc4`)id_c4<tYjZ6XgU#u0j{nk9v
zwy1Edzqg|%xroZZ%Pj9dI1%=s4}#BrLS)7<Z;3zldQ<Cs3gsH9cbT7jjMrBavc&IQ
zL9BYe3Kx?rau^Ql166eAx$Km2p;Q?5Yj3p)bYZjruvf#i;jFh=wQIjy&u1BT6nY={
z&2X^KvI?%ol-umkj45uS>Pw^RhsQjANzUE*^vMk#77Kp87YCdxigUi<uPV@^5Ipmf
zBRyiycd<}KZ*=3M#Y$!x7OvW-3fgzY)Jb2wSo~92uZ7u9uJs7KA-HsLXoR23u^tmV
zBH&br$F=-2@*!l|)+G;W10KmIa9@8+dE{D;Yw^kZsIx-k8oM@J(3H73hqGQxtl{%?
zri&~n{*HG0W$y}o(rni2v&eZQjB~&e_s%25bFCs<wRV$)SdQK+IoqGbjmnBFefs?R
z#uGb(4zLsJyJ?SF8qM0(Ipk||Y-`&EMqaNNsY4Ei%y}bJQqn)gwIqw7^ON6O_MawZ
zijG^M=IAn7Qqz+nO8%<r_IjOtkMHnDt=0`i8Y+u5x)Yvtf)?%fEnt-0$Cjb7p(5d;
z#?ZSgOF_ZqF6Nc*d6;VEr~_e1nG5!Ni^{yW(T%lBpm?+|kAzR^G1{U!Gy8qVL9=|K
z((yXaTsRqNCD?mFLIXBLV|~K4krU?D!Bg3(hSLn$J9{rBQ=*qR1hXD>wMDEPop?w@
ze9GYq^s=Ab?XR+F!wvs>47e)Mrrtb<jmdTK{n3Y?OZtw(k3bkHf}9}K<u(hLCeV=2
zDXQ-=w|Bx`o^b358XX&8DT<(W%61=iwXHTzueaX|?I+hF8@>CP!~B&!#89L9uv9|$
zIl=n`iESn(^56h6cB$3JkhXQ@-sWPCY}mFhdekMy!#6jUUlkacW&OJb|DHBAz2Z_-
z?Qb#D_U-LqnBy;v>^N2?%lanEDtJuISJ>8(yZ?h48uJI5mn&+)ufQ>cP2Q<tKNtum
zwfm{oWI6GjYaX6-^k75~?oxc@^>)c)H;v{mHDQ@sM>39Wl!xzmhIRcsJ_OenKGFpY
zmCpD`h?WH*vzs-B1iUv%ZQi@C=={V+9sXW54Gbe(ap(GomS1)X#ql$>SeU_?(c|FR
z-yfV8mCQ5SJ}+-=4>;6@mi&9H*=2HgGw+K{{ZR5yKkK9rEf`|0kO&e5!eV#ZIjce6
zfFiiAVCj_Z_Ok0Jxybp39)*tP+Wuq?dT^M4Wg8)y)$z>(adGhg`8PwZ%5gBaH1D5#
zl+#v2FQOM~U=dOqn@Q-a*RKbQP!vk~ezEtTCeHy}asU+Mi}{I;{vb~ph2{*%&$4$)
z=1J)eLh+dM8RGilu5zCJ+y5=qWD7$uP*@G0kHA)Kq*TV=I*tzPu%|{~tb%+JY724G
zOQQJ6qVMq&Ml}@r_D^yKhW)+wp)Z_}8^_)gf_ged3Jz!Gw@gtb$37cWtJLcV{!lfI
zexlweV%Hc~U$D3>ebOvy_2*O{>=}!6ld?sTq9;cbn^=Yv7sl_nAr=WW%@#|<(Mr_(
zzv-WU%T9e8B=SrpkZX;L%b9)h_RqNGu-!>HA32@8z@Y5u^mIUhF=s4j$wkp0bdUHb
ztExX6-Q1rD8?3&PDS}$u@u>c5k=e)%|GH8@d@ttNy(5#*za9&EW_$kr13+ayz=e>O
z0*k}_Mk*Wp4;nl)Snk9ns;0Yf+T9<^t6p>vSphz0v!7uZf2_5`xE<CZ{t)S7!5JV{
zYZ6x{VWpVWN;I?YZ7h&){aS1IM!ei3HyL*cJu#ZZrH%JCJ63z7>N)3*Vh81$8GbZo
z9!V_rhh7!D6i~JOnf87{yYDQMT>NQWyK0g=7luDPJx~f4X9d0F+V;NHCx#S_Y~FCR
zIAHIqxekhO$RxMSf&C&BzbtcTI@t+_KrMgeKzR81=&bFd(Fb$ELgbfE`WN)Wn=cOl
zJ#>MxLgCvByw}|K%n{^SoxP&!9_zSI!IpPnS@$(ZMN?j(gffM2U0pP7aIGjiq_18F
z!;kFo3wxgGA~7W~jEg7ie)WV&zxUH!;f(x<w1EP7r|zm`YfqVs4x)5BlpCsn+*JCs
zibQz!e<fu#5DuIY#d%u1@`R3+q3tqX<V!uxw05o%o6{l-KEL^$eFWk)t}awVrNH#l
zU8le)E#xVoBU*iR|Mu`_g=Jf-D`Vwfk?cl|Kd!Zj3j$cX-j)Yw2fYV*EctIk^rm{O
zHL|b@DhkV4d1eQ7Ib2Ni)GmgN?)0Um&E2hq^;u;zBh5J8L7kM<4o&B=gVePrEoknL
z0<gh*$XnIvO-3WSb?FPa7Sg(JpEdAmcmvAQDc)_1^HW<T+PSirj8bbY27Q&|`N~Kl
zKpP0-yx__jwF@*r2(&s3dy?}Vh-ySF8J+IBr+<cGi2Sg)p!LE#|5?dHmh90&UjY2i
zFALq>ZQr3{iEFsJcdWDIOF=gclw=!y-RDV|e`1wm%k0+`j{Fit9hX^q>|6ye11$<p
zy}mG81i|HFJV$dayKD2?`EM^ooiIH#^QuWIYVeIqL|$cgYo#_3k2>fXK#6hNNh;(=
z{pb`bBE$91iL4zSp?<6{O$7E=5hh<?!)nA|YZJfMNEC~=iK~p-E{g<3^1@S=@rf1g
z-_?t-7WBL2oG3#3rh=)wFZkYqqkccuakqo$IY7~BmD+dM=NtUbSqnj<9vY+V=?G7y
zB2DNvWU0yUCongAxqo>?V(4OS+GM-58U4Q}WynmfT|RT6aPi1TiS`+T;<&o+{}8ce
z-mGLx;9ON^?HdX?n|+Moh1b7_jSXa7Z#c1{K5bf`5^PO4m~ij?3+V4+;i@_ow6`!O
z>frhonZsbe>4>D}?X`n4xV0mb_Lgi`l{q??^bqRp8ZBaUXI6`VLb2?K9W$PmWpR^F
zvnX7aVW%&MRvngY^Dp?17gcy>vE3dH5HsGdxFe#74LL!{q;%j;6am$-G1{Xp`xlmR
zeRi%7T#Xr`vqMOEjrvp|-kP@sh(M&jm4CNmMe_W&$hAm56CIFBTOrA_`PH4)Llp^H
zp#Z4F(w0nFHKbF}j+pp?22pyNj`!eU)%ihGY=j?aMkR>O6b{dS+9+}Bb89O<Pnvqb
z%y(+zH@F;W>Q!*dBq-um9N;G-vAFRuASHCnc+BX$IuUl2mjs7}$IOZ`DllbL;*&-M
zQGq~SkH2;hNlu7CWB8la(^*P`A8CAfoN&aBI&$=Dx~_^6H>g^A?w3^rY{<^_s}l&F
z(h21l15w?q-alpDGW<A=MUh$cLSW%?l22Pq`(?1#rCFf<Pwp3T>A{~@@kAVMi}%j$
zyVD#tc}Jkrr@M|ws2J4mY}i`v-BsG@)NGSA0x!{OuCJB?C2B0o_-{Wg<_34J{lt`K
znb`<BuD^9F<00c;XS*{DEVg9t(R~Vre!WEEvEd+iIyvuKE)HF8Fb&VJtT`>8brT~^
zVLafa(_9w-;MNT6adZ3rv%Hw0<pGV~zM@(`8Se7*&Ub^OWF`nFKdfO51i$m`bZ3c9
zi@d;s#wDEa6An?V*@KpAywM#?a&EchB?ff{j(L*4z2&Y)B4<QAgr*|R%}lpJ#g0X}
zgpOUTB(Y#hdz~*+&_4?N9hoL+Mk-WGMN^#(E^uE6ig}Ld@}~U>vwvCP_0}~dY_q`f
zdylR69gGe4MF3V8{Ajkj8}B^7T9~YkdM!w@PD7KM|9EgS`52LBrXF5L4K|WO@ta+u
z$o>esWq<TNb66g%qwcN`e3@85FhT+3W!SdaQQoo9`%Is{NEH<>I}|4m8?;^}q~F^J
zt=J#(f&va-`KtIk?P^eglGGJUmtk88ZTK=vy$3SdO{Lke0&3cm+JsR%s_&b|A$5^M
zM#|zEcRV^&PG}WRV=?v3c}-_06Gg4tGQVDIU@g~3C_ldwI<66%H@+fAHwm>=^a(iL
z<rIm$4>KWZ#NU4HTK)WRj?VJoJ_Q66sMJ2;RCE63G1d<MlnS!A{yv99po_$q*Zqpf
z#?fAXt9+n8#wPJkUu3lErLd0$^;>!$k$`cVf3V)-o`#^GmP?T{H30>e{1pokL2x_=
ziMy02A)xdqR=@$m(csU{asv>&p8d0*J@kBar)zqP6xjsSzCl9AA4=vce7?vYS_l=c
zTCnSeAhy>&&ZhJd`D~IKx;n*h8d*MR%{9Qb6gxQVIon2-n5!a&A^iI91GQ0>$)A&0
zAK|~kmI~#p^`0>eyJ<c=7iaL-+%SL~ywaOpFu?Xm2Xkvyj9x36`l$o;8IJ2YNtGHs
zWGbo>as&^FI;JZ5n#ei%sP6!@3QE`^<dOV!0x}%dOxaZFradB!ZqY#(95Jz51@&qU
zO76VFQulxqOCplnyRz%+@hTLsEQ+>}w)Cy6kAF44c>Vq1cU0#l*gR4h_S;TqV!xl5
zcb@Dh{2Twy4necO9nTl^(+a%iRyys#yA=lJ1t5O2t`@A-WRmaKt?!2;E3ya=Nl$r|
ze+tc;>T%f)n7Fz!Js977{Ozl{=ldmh>zFUOhjPsQmPDpJCRT$|N4in@ugj7p>hG*4
z#y=erM$VLJgkd=`WNyCc=8K>Fr5wvPUiiCf|NTyUo-Dkaa#6@Gqk-(k8iCCI{F2>G
z?ec2(p}d|b*P6N-X<i`LYj+Lf&|vJshbn)^l1kQHW3Gldz7LZ1m(_#rshQf2)+kvR
zp@nQNg~RSC_{KPwi<!<XUt}Pz`X@!AX!oahVaJGHYIJz*g8uypuZQy&s%4^FaWHMA
z@x@UYn*Giu1ufFOLPTQ{*RCcCVIS(E!bQI$nF7wb;ddGmRqL4+4~l2827y?~#WbR2
z-JbWs=Gz5R5L5h<Ui=LQY;Pgk#T1Gs==k-`oZ!juSTLV4$ZLe1QQ`FRXr6LfpVw3G
zdAN2rZt|))xo0z!Z+k%aA$z(i(V>F=@K_5;;xg~^3H-ad0%RkBk6s~ow8^%OP~Poc
zPPYfR3HGEo5+aIe4|jDDo!fz|3f)<g_DfM6El;z{GAiab#*`)PonH>C$}YG~uB|rl
z$|7kC(gc)M+wlfb<<i^ULgSF{(2c9~627?}{7pU8CtJgNB|*U;t1*+H>*pQ3+=;TD
z;f9)&$A)-xFA3~_BRg*?m+m|`s6*|BQ};}Kmr3;VK*R1c`I}&ssW&GfxZS8})1pHm
zbISzPTRzJqA?`UH<g1_%*<(Zh^o7p$<eqt?yRuFG>OBw*dJ2-yAK#+!(<*()8CB$F
zeM+u5gWGG)A?$$ukU3F`u%+16R?h3V(XI39f(iQ`eT$y5ba8XP_vs%$rf21@ZX+wT
zS63XkeLb+}cJND7G@6!rRb81`V5!8g9|MLN-gJzs$dLs>ME9-qXOmvmZhAj^o%eVm
zomZ90gGuuX4>Ud)+1ES19gcHbrvU{oc#CUpT?SO11+{b4ztr%+JukfQsnRE%Jgnpc
zd#MxoF*Q%85-j1ReU>wiE4_{vp`ixVQvnsJ8%c-Od-nn?-b@sA=R2`1Z&l6G;`XP{
zNLi;NoPYk7v9jrUu!ambY6@{V)2l6#3#h%zl^3;4u;|^k2+)x>T=N)Uc|`wc{G?Wm
zq}kA|hs~-2gl*gs*3Mp5JJu7v9go8uHf%Qs0^AaU&ePXs%Y=s<T_N)2q>LChZe9A8
zWgK}?#AyZrP)n1#d3mR)9Az7m*FMzKZPiZAoIO%Kt?*{)7J=iA*?CYVunmp5C8ZF@
ziOgLY&##s@gA@@jjv-M%W{#O6Csb-KzM3g2d>Jd`j7@{4gJ2^T3n&M%fAiE1P5~`l
zfqdyLl=gAEa(yiN?S#t$>VMa`^_MHrZM;nA@E?E0v2HMXi4h!y>C^9c-;E2FyPB!w
z_ZN#bsm$E;<V5{J>DE_kH7J+%ECPN}FC24_w;dDU@(F#g>OmoKM2m6eX*SRAPt5I}
zzsi<J2bT!XjqOTr(o3^?y{~0aClHP1f}>xcktUX0I<!H-RW);#F9m1O&+F&ah<K<$
zV2$gqAhe^N7YUS-zuKSGFkr&m{q8ekLLqOmgamY<{h9u<1^H41s}*wCe$rI(crC+k
zihJy_KTdiBd8}I_)4&%Wa?cX^eo>A69=n|v`j5iPLIF!N;ngb@JjS-l5EI3DUtm<E
zsL*?8p2zp&;Q6o0xZU?)en>Rgn88C_J~4P_QM_dT9k*_=D%-D&x}gm_B>nqGv)Z*X
zQ&26g1QYRe$gEN@%GL@1A6+8V0EpO0{3`QEU6ghwa7=tCmU|Z3kwQyD|87?Tr_&PY
zdhx4k+H_Sg?RE`wxG{2tPdg^)I8wAG2PX4?d2ZMHK_HabwJwaY#`@ker!&MucYP=V
zBg{s7pXWjsZMXwRGNQW6&-aiN_02%&OJ-?~uC3>~rjSzrKBUF@x$GP5C8bdkjnk9f
z1)yc&7t!7DQgWAx8MZe-j1r~Z%tR%kbW}2rq>7bDu<31$&)$_k_Qv)1@6x3~?F{kt
zrp#TxJ5aBg#2jQ4>B$fRtb!O`h3XX3&z2#b3;O<I19~et(6=G;?rk4zwPI>Q^yzwf
zVMw$efs$`1WFENWKp1}?U5LC3(~F7U0=dT5OWw@U>u8?fmbt2T{ykh+VwMW<BU)MF
zB0ikz`b|+tw0x|7g`?)ORt){ZH``_OmzjpD>L2l3vALX=Q=uXR52c~#OWDZJP0$f<
z<~NQXA>SKj;{->p5`4Zm+oS#!Iiq~~GlkeHtHJSW{<!^Wy?_Q(al{Lt9wXDz%Z2p_
z%uToZMYgZRf$S$iaX+luERZ!dM1Q8CXM5jXa2%u66!-#2q$35Y_mYIfi0+#hZ!~g*
z!O5<hM-lRbNjl;Y$8f<dG6#D$uO~QEZNFi->G}v$(m&PZpMGU@wuc9{^-F6WVb*Xg
zUib+X9UN(%Xks<=QdKHaLf&#YGU!N|@8@ax3ZwdY3LUqTp73)SnoMSo@G-$s7J(zS
z6P)`xnpV*>QR<8Me<WRFcpTr`4w?oH8Z@?zMva}uwr$&L(6})+wr!)a8ry1;jT>X%
z`Mv+IJJ(?6TyxHIZau|<9~qxaEH&bKYM3aM!KUkKdqR&WR~CB8s{=iqzuCcZzOI-U
zTHg<DX~wz2eSj^yL(O`h(j-^>c)8?Hz<w?<Uk2>`+gQ&(eY1~jGGG`)`7naQWoxT;
z?I_g0x?NE@s1Z{+bRF%sKaxHfgP+FV*ztliTsxKdbBH&|xVo0W|E00L^*GO{O9#DB
z2$^gWhBWO(Hh5Klza}&bSr2#Wx6gMMxP%P2!YI7sd;QneuVY6uB<!`4=zNn%1Rlpn
zTLIRlE1_1Uogap|6EXhQX39|ExAx6ZX7Kh!WpH2WsCa#uh^+rS-mqv1QB;`xkQi~T
z-WTO;%NXc_r+N4#Az=q-n(<+piNbhAbj<3X3ONdeGT0%aW2TR*WPPhCTjTU2Dw!r~
zOm_+TP=v!icX%kW7c?ptdeY>-<U1O+I(t?XA}wbN6uT4chuE`#QgQ%dbgxtv(9Uj|
z7roZLy#l$Af$@;}&NbrAU7p;bbDBSLb~@JR8VBa8$JXwzmkP#Ss!pXC7^e2nC(=_(
z6I#9F*TN8<`sJEfG-0#x=gp%|jRzkgMZtc6V-a_V+W9>cNZ{^Iob0cl_u4x5r|rWf
zbh3N5ET(xZdj&~e#hHF)+pI@e>%qcGB~-Focjb0@&Mi*P6H-!%E?KU-zU7K<kmrP&
zm<nsTtq&S6&+BvZW+^8ju;#%1n=}~N^9X*b!M>~FOnml)ad5Y8@DitD;q`;AZqPwD
z(UetaVgP8?D(ltdjdYDE<>4RCHj=CwX9cKSw%fjHy`ebTJiOp8^2g^w<zK1sH;LiI
z@Qw;SbmgctE|<ohl@SKeISUndZ!Y;qEK%1bYpX9MY+5x*nuqlG@XTm@@jKMJ_Z0?3
z#%kw;flDBZvTU;E5XOi+7U@BRJPp<9yH($suf>}_<&9Dui>RF<%MsZ$uZM;JkX@}b
zCFH)AyzXTun^IrQoHdFv390br!2f779==_4gpWhPq3&+DdQ$ADk)69oa{t$wGoG4b
z05f?5;^(}zsP_GOCJk+<Hr}S@c{p3{<;+ZMil^}k>WUUp|43W@Ief)k(DO|r7M_R2
zy<u@H=CPlkjoA0i;&UFE{zjf%=R%-O)FskDo#T5Ig*%+5691W-@V%JxS4Mr4n%3RH
z4RtbWzXA(Q5i1Kc{-53NJ1l+G3-Ar78_CbY3vv?*$?wNeOK!Yz(Dy}xe|&Q3$P^C4
zc^&+;pM`Jg2t0XLS4kdSn4f%q=ICaadaiZ8F3V;B2@>zs6kj6KN+^svXL4CvZ|-y1
ziJAP_zh17C5UG57z`v+7uAlIc^ilz5B-5a9`Xh$~bELFaG)6A7Rl#r^@ShOnX(!*(
z`u<Hh{G)nnd$A?Oa9P94fVqz|5;y)v)ktXx`?8Z~B}GqMJW5B@zRylI{Hf3Uy_Au!
zGA+3;Dkg6>A<#9=eZBWpan-X`XO7`W@8${f2xEu&m?E{fYR}_qcJJOUn(!iBzdE{u
z3j^S$rM#Sehq!*aN<3o`I+h+2Ctzuh*enag@o<1K2!9WRdP<C}<-hDX%W7Ydj~6o3
z51!Z9y3kEp#QsDF<X)O|m+Il-P*FTZWViZyq|vtjy`@3GsU623I+EPIRnavi@ou1H
zc3<n*J8+C+jA9Sc%=J`^kqB}bX8z_nL7^RUOQ^zP>EP|^8(k?FSl}d*Di=kLM!cQ%
zx`S>+H!;K1&Ulxba~v~q!eR+%sYcU3_I)%Qni+)9+{NT4^$HrU@Q9;JwVwpyYyY#u
zE~0W;pLR->{rlyFo_T3*l(b7dZ*&u)wjzbm^<zIecLs+BIu^OHMQU&wB}fz^WSs3x
z^$+&=y^N}42Wv+HOfwGEyU;Ww8h|)6#PA&8PXQ)yJ}aBeCG8D`b>apvpuFSko_G6y
z>f(FGs)Ab82+p)kA4s149`J{I{`kEXE=l|mM3q>GKej%9A!&*AlY*2&l=@Z>TfF8v
zzq{n0Xelz8>l>|?M(r)FeCKpmaUyXyq)AzDp@&UwnIBVGi|0*y!+1PuSD<jenXX_Q
zq8gy>ZYIRLRJhG?Fn<&~j!-I@yZf|l8B6OJ<6n1STcTX(1D&q2h5JIwUov;IQarXk
zt|oIlh=jsN1LfUOec_B$mvi-fE&}m&pIlqfJg;O}U<Gc@542SNQn2$fvwa<C7TWWk
zU4-W`!U5LHi<o=IC>xs4LH#on$XNVAU{P$mD{7yzU)_4t8}zKFM+u%1DL6@#?Sk$a
zdFw$Mv=J5ZD}^^L(G3PIwq1>~gAj5UYA9K;JzIsq?K&o3{XbLC2y7Ltg8KYoYNnE`
zV&jF7M~G~>q))dIC0A~sX@E0xOKG)p&7-o5jQA?jytY2*lTp`WcuRG|uPgzOYJ2o4
z)lzL?=DG>G-BPNU7|rWITzEDt@O(Bo1Jl~|G`f56Gf<bC=a7V4yD=6H6vccOnP?s?
z-EI>O4w->xw{2ll#yvW>?EnB)LIlJPQF}#ZWw)X+?mG<$0EQ}DN;*MTEMH>TyWevc
z)xjb_L&SH-ceQx>J!nsNq>f=WEF1HRA?x>~#~ysuh>cKyw}`}`XjLQC<9Bibb^XX$
zL;JDTBf*KLCoEuR)O~5_>@BhFU!uacd0P6I_V!g?f<BnQ!5RJmU;+q=FU=y8Q_g>*
z1q43e)!NON)g7?eZZ9tmm8t>1D)y*jbjU9Fm$$z%3*+V4v2m9{!J#$&84=VSe1#Ng
zwovrYB?}JLeQA)M9DvYACc9@w_RKiw77i&QJQ8}~aDcOdWKAtyeJEjyd&L@b#zrYU
zwfRVMd#k{(gv5z6Y8q{_qK+BZLdwK~5!ojmpPzO$4b|>4vnfa`QwXyXH`JKN4^%-B
z3_7n3eYJcbN{(HqDdEfbX+v#1=ry6k{Qk~b<Bl&&Dut_{2;$Qoxj$9zKW@?5dl#0p
z#0eBP2yJuBY`@-MJj!j(-UV_A`jxDJyV*7|7@kHAa*NM9Nk{r~tivp-4;gQ2ArTYL
zoPF$LOHl(ImyC}>mQBIqea{f}6@C<>Ehkg3>2>A5=a7o!-%ry9y#*JTM%R@p;DqNX
zlc?(YT8j{tPqWkKGZ%c+M93mhLJx8{3;rQkI)G=-I3!3MnZ`aE_^#+5tKL*D2$2`_
zDeZQM)&{~|q0DtcRM{t<9gjw8UwT8J#qk}Wjso6&*oK$F|L)W<8MVSF719SS#5BW!
z-xJ+D>1Ckcg#xEMlvzsFM9pZfo@_PscnWAeY;r<CXV@Cr5AyidG5%dJdQFg4-zec?
zb276M;@Nk0CRs8>z8R<yNqkduU9zLO@00|#MBShBH`G2_DGAeLAQTqSOVq1gbMt$9
z<w=V&S{u!`65nsHUJ)#9Vt+ab|21W)$y!bqf+6M@%BL4=QLWD}xvUqT_(}NdGSn18
zd#^x{ZZ`mqn{bZzrjk(0?DmTJIltWQ^@fol?NGT6@LH4p^DL1bqX>T))#j5PoF;EG
zk(%U=^6$6Vo&SN59z1%NHmiEU+Cri8&Dz<(Is&Da$=|;I7kkji-|bD~AFkqtrr>=?
zaBI}><O13ujhE~s_&O>;A13LS9=!l%LaPC_Wdiw4KZI^-Md?nmor`*E9UT@!IlkDX
zOl;2a147^-4s&pTJ|J1SY>nVpRA2}F=FZjgko2y$OLrf$%N}oiFS(EPJ;o^7eOqac
z#AarSx`)=C`rLz6!A4D)zhv|pRMcFXEy{FQH$RI@&X@M9VbVN`FnGWyxAq~2Bk<~H
z!3r62!{)I^rcj$aK^bd{ipMrB(~vQklGsG3tzc{&rijo3i+dPl=2<pd-(4ZN&LiBE
z<$b-(FQXANHw(dUG53VLB|G{zD9I7^FKPu*u)MNiHuWVAO0X9Ks5#~0Ku8jo)amI9
z9a<*5m--U^C%Q;!eMZ=Ya_lRRW)OVvJ8sFK_@^ZK{MB{L+=DZcTG7pi_@y2+kKbI0
zuxf(gNwbdSkbfJ{V0!D=Fz~QNbwmTYfd!a~M1w(eGKsE_J06O_M5w>8zR?EXlw@E}
zu-jbcrK2PKbYRfo2e~3bdpOJdNA%&$A}btL#H*a$k&E&dn8$k3A8q(&Ju($;pO(kC
zd|#yFZ+^(_^)T$bQ3<ygx5_2(nO#LeVn7Y^2van@R%QZ`_j7uGpK${-0)BaJmmC1Z
z;HKil7qa)Tzs=9z1=ja8y>2@nR;s#Z+=8{e?mG8>UB?5c3OnS{2DJYpP!D#){C$@*
z$j4*|G*1YnXZgPCa5)Hcu(csOL%U^dIc|L5f7#<svE6L~$=`dDOgs-_3X@w&?RcwI
z3kDAGd;2GR10CNEwcoF$g}ED2XyUrhp3!<-Q(aztx_-L(`QT^$>o~_jsQs5)jsL!N
z(dgIwB${7FvtU=O&IHc;XZh9<?#NgLkhn4u3%Un4u~HiAZO7YrPwXT&jiEShaeHix
z@x#Qnal}UlcjyTW;wEtUl&e_Yp3p}_IBkUifQiC;;6Mp-H&hS*I3h&SYpk#DuTB?D
zBFyeex*@Yt*O_>or7ILcgx@CJ)`V2yiuQ?*<xo2K0x^oEtxvS%->y@ikSf$gMGN_f
zwj&gTQeYfE4tlzn--`Ycu0p*|d;Qk|DW}Mnu8+Hhff*%oJ>Ki_G&<D?vy({@R%CGP
z`{u)~yYMayj{IOj@5WX<YyUGsJTnsvVw!7fahn?94$Qwzn(I6#fveiJAGBrY{7Qbe
zT}vyRh&~VST+Y9{s=AC%<<V@{e>!1!El_O4MtN;267D_4-C0EQKW@sw5smqYi=Z{t
z5{0zmEIr2f_{2mCluD|Gl7<)HyU$z#E6}eR1$h3K6Ln&+Gs~K0&^osTb+>}Ws_CpR
zPnd~Jd7A1E*Y?`AnKTq3wht`y-Y%P;l-FH32WyYo=%@hNl1fwjt%$rbh2U3mAKq|G
zsE_EuBwf|FOWULB<6*S39z6A#_rn0@r9x3yA1>dsxMSrlT6V!qC*BWNB~FgtD2(`J
z4}Rzda;c|+Tt!k1k#Zezb6TmNjyl4&>4oAEjLt^O$B(x=&XK!P4Oz)j{exryU~w`^
zrM=MKve&fJ21j7aRhK?j(U0}l5a0^XY#DUoj6ykOD2_t4HMO^3m%+%d-M#o|BfL5_
z#(g=U5VQ2BQm?v{+U}<%EG+(qmx&8zA1^OukLzt1#X4sfK2Nkif1LWeV6XDtnVwH-
zte;xs%C^nY^K-;bg#=)c=Ju7Y^2mf|h7G2gUlawNi%bnt;xmj?4*_vB91fiJQ8JZ5
z^ZeUUK>@(P5eYc1IkP34tLTPpNfNu_RN2|cpsYGi%oHBW`}aL!F1fN8L@HT@8NM#x
znSW<#E3q0ef98xLY;5H@{50CQ#QBj^reTpuj=kLdUw2#TcOIBOf80sEovpz3XT%=F
z$-s^4@^^t(HSj~V1d63Y@qj{s3iE9~dx14;1P6!2d~+MCb)oFvGhuw23-ltBJ|%N7
zaj7lsWWViu6HUoCv)f5QL#p#-pO@*f1~hJD<X)5@&F=$|)YNlz7_kf#;E6>Uh5iyu
z)#cyBPFvOfd`N9g;Kl^*&V+HnlJmXZ*aplAskHK_Kk(cQv^A@e!@qqY?auI=#+0bq
z4c##zII^@VGCw1x)@<S<ark6*Zq^<D9?qkN4j`wNAVYE3DbfURmom=C(%JWlXK=Mf
z9PJvK>xgx*F8Ze$!hkd8=fJMbev=>g5ggUf57%yN3SjNE&+@CZnGxE|xzb*7eBTn=
zmybuTz|Gy*SBpk3Gw0`>=#7Il>#=QYFb@4*)R$7QM$>kf4eW)#0f?L+`p!-bsK*BY
zM6{YN=%Q#-;n@ZotydmpfRjyY-Sa3(2nQ>w>IGKlE$FE;nK-E9gv+d;GtwBw69oBb
zQB<O0&&m1h22Xh#Iv{5%`{QpOKK?LHuYFMXDz;gk#b01;9Y|^(L`8W$6SD6>hwg=r
zlW!Ht;$vJ&2AmZ4DOe<?vx&#nQ1>Xk-W-znmr%$58Cp@f&l~JrgduLruM+)@HTqK9
zoF6U)+gLZFSct1sJ+np@{Bg8;ipz~RHNR6paXMyKs&H4V+U9cEN`RKEF?=|dsroAg
zuca*4xWRvvVC+<oQknV@I?+TJ1vsMsmxcGh{Ush+$DVIzha-Wyt1>4wHlrm3lF?9l
zrd0odwgy#KyRH=1wklFF%mjCxhBN$=-=?K1ejkr8p6>Ks>Z%?u`bV45@La^ZX5=g&
z^}k(mg&OSiMPeQ?D?iJKZ&BQ-dX0vIVBIIH&80DhESNUbGRPdTrS>DwWe#b|-sg_%
z2e2Cjli-7z-D6x7<@qd_@E@o0*@jXmPlr`qk}`%t-a3tac<JYYAV8bgPZ{Ns?$zdA
za*{YtYxCF{f9xX&I3y8VM=4e}f392hR}Bqv=B1uz3H!7?eSFX$syl=3CScKy-$y!L
z-UZn%NY6B`z(GTHn~Ayy`CV(BKgI|>g|(k4u|+VS*ZzR@=n?76Ciotx&aDQo1t5`9
z9<#DvIM_V5E69Mwm~amz&cA4MXVXuiKtEG+7E4y#*;H?M`lHw9(#UO(f|$FQK?#~G
z8lE?HnyKu*Ae7Bz^&xuZHAjhVRg|4SZUh4&6rLDEc;iHUiC@SiP!`aUur_{BjV1c!
zx;S>AXESClRw&9l5}7}^YbWN6Rz|UUY&TLRmVyb_g>g-LzX$$&TiG>Ef~8+)2itL}
zsZ4*|$x6#7ZSrQ`>j7|{ZB7Z63qWR8b7em2pp~dU^AvF@cwb8eno&0!xQEA{S_@2X
ziu}bE1KI0M`L3s(4cn5Tu;fI=d!E<Z?ob@ZurOWXIOIkk?lsiB_D|O=p}*sz-KYaS
z7kQmx4C5+Xz<(KwO17m}s6V;t7Fp?xYZHNuYn2y3JR$S8+gAh<|AvT~E?pW)R8zW{
zxM@hP3h|?&?uE)2hD7ls4FxSih;*6X*ZauFhBv91nrNBH>YKGC>A6$-s8iYZQI`Bx
zw3b$Sd8739iO#y%Rz`i<1J?dZfWnDBopoYxnd>%QWj5m%D0M*fvYKtg?njwN1@&VE
z<-RdhPk9f2RuDH-B?0PHMkHVzc`G3xn=EvuTF?hYWUF&GM_I2Ww=VTpUnkac2XQts
zjrQkV7p=f@y*^KJk@3MEiPc+0^UOQh=vCH5{l!oYC0}pBorL)-@fR&AliVayZgV4e
zDwid0^>?R#5Dw$&w~Q6Gj$r&|ZjYOOd|jDIrcgZ;*P)elD%Rf$B)&%mfo9ixtrj%~
z*JwV)p&u;hP)LIe^$Kx96^qR5I22aipZ2=&DhWXilk+^ux~`@>*yYNJ2)al7rlr*=
z#(_?@7Mo|VXBgDH#{QbE+z!-;ed=Oq8O}i!kq=9Daoqv)pZ;*LAy+((_cbb&f#~2K
z&E5Y(2v|9M&o2cjO8CBmi-(iYsGxc(p@Yu*2TAnsf0_~&&i@&kj0%>k3Oqs$XvpAV
zO9C_WL>;UMlZ}HgCm<vqF^kUwY&hgOBv^*O7KHG2x58+r(M~fR-QpNAtE6{SZo7z`
zEdiF{qVjCg<iHyf8{1G~R&`cS*w%2$5KEC)w$;+U_tDXOI_zacZgQRaAx%!C)RBKC
zu$dS5utGFMQmL8mL=c0fcQsuc?rYA#J<Mqqjw0JyRysxrq{Ba!j3dIi8P^C@v=>^w
zSPWVy&ww}@`i??~*}~ZUn5m!W1kavzncCfvUW$s&_e11Fg}7;alKIgHJDi_C<`*W~
zJg!0(+$fTrDu*)cR~Ik%77Km@0r3{KJL1TVI%cH4cGz-14`oKa7#J@0uj;BBj<g-<
zjh+PNbXUMJCX0AZ|5V5v_t&1Ts_UGV(tl!P;q8ob^Dnb5Lt(_Z=HZqpD(7$ZTb><K
ztS44%O#(3IVWM&?sX?SRw}&qSEX`{QnDPwGr>g9u;UftH$A+-4Dvw_KL2I;JeB`~I
zO7#RohRwyver|lcuL0#ToBCv5ZB_c=K9V`2IL&;7uSM16QPWx-MD>cO$cYU_2`hmL
z%#tNNJwV@yFZh1zXD(MWNbjZ53el^Zx1?uEtN6IZD=a_u1ASJB+x8kNN|8pZj5Z2-
z5|5kU56n8HU^xOhQ>UNn&6F3Wa9E*S?*t%HpshR+Bp%>$<St6?h?0de4A)nmsv8{4
z_T>yzjw%0a#sj<jeH3SeK2@fr2Jm~)%1o<UiPfFFXg-T6e=Ro2UTa-DVx&5|IX>^^
zZuA&G(dm;2?0L`95ArNO%}J_y(J&YM%n8dG<X*1G?<DHT#MIf)>8P(5i-U1*W_hB0
z$)1vm(+;ax+40M{rU@ucf^bkczst9ZGN^E>AlVtD6bVdy<SLfr185FG;`3jnP8<gl
z$7j)ra`sEc%k=N2=}GD3y?gyYC1tn51f(p$<YZMp#^=At>u4M|c%C_G?l@4Ezbxt1
z5J#EF8GK8qmhlPA_}t%7OLo#Xpwat@N3kJ<Py4pz^tg_F_pmtGzLeqJbSH#y;)!JN
zx%PAnxNs@d`cv+lCiKcU1TaOWnaT`>Z^wm>XpN+1$v;r9NAT>ir(hV&<Or!BtjudO
zSg+&<9}jqA`@S7f_l_O^N?tXi!-#`=$yrzmzfKN>jHT{+(gB;|`BzV+A92-3C*P(w
zoi7azK}|O>SHP?}NBe^7`zErrsTfK0u1;@DX32E?#YnoI70)Hy#b+IjyE~_Q!-7Hc
zZ_h!@NE7K3eK(|mgyh#U?mDhf;M+DZ$At-0*EoFh{;)Ff+~{jSOrqm8X8h|KzN?%#
ziagDsLkJk!*J<{U`>t^VM~col0-zm}-%35opU$_$zOG+f%h!V_77Zm31)g-|#NaBb
zzBg}0M+X2NPo(?Mu+wEEk1yGXl-gJ=CU1jSXI?k8@0#lDDLhznCdM@4M&P32yhJCL
zd?u$1j)FlaV>p@Mz==E06>-^7wsUr#{S>b!y~i`&gi<@dmqrz%@4P`m%{gR~YD@z(
zMPiAk=eVjmtgWkhEFJ-v2Ro#hFpB5rz((>{rsI4*;M9FQD}<RXcAeJ_L2@TiGN^!S
zq5KNY7B;4LIRCzeqif$r-T7GIp~hc#%Ph}+%`Q|;A7<u&F%0}YJl{<sNmQ;4pD&th
zh&AwTCU3TZ@<@w`3C{=1^&v!R!pg#a{<7&zDIBgu^hZZ+c0r####xVSF@T4Na(2JW
z!q^M)(Ux5He9?LBp<7UmFJ{O0AVTm;)h}%4Y0uj+1~fWi&vxYossPj?4H^#+K9j=5
z{N<pP{iyHvWlW?)G<krJDS%0?1Qch9#g15bmF%!0UwD0VgagT7Xdygil%QTJADP2J
zBrIlC)-9?H#IpWpN9~siiYo0yu1o(Hac_Nnw!^3maqp*y{vhJ@w4ygh;?wsP+@{vu
z8e&XmMg99D{2Ocej0{D7QHNB-@;B@x(Rp+H0Jc}@Q^8<em|COCt$;~KoIcCqP;rMO
z@|PfsmF{S&aj#K5@Y6q@A%hv)fFTQn-q9v|*MtF6J)7T1Lkbw_(XzHjV-EZHfQ7Vb
z`!u21I*kL2p%n>gK2`y`Thz_yxB$5of7@ZakRe2$YuImo{T=UdPXx(?8)AijuU{os
zy_ns=fB6<qKYm&}502fXJ;iL<t2*nJBQ6Xls$I}uTu())5cY9DDGPmW(DSkM%ubm9
z<8m+f{9L+E-}K_6S^|%;J1!W}^hl+I7`;)iy<YUG6Dx*mFkC-B#(d>^2j_fWWdPOq
zum!>)L3LJsf+o$@JyFGdK_Z*242BQF7<((;M_adUfs?_gwTd)aw0#g|Q11K2X$e(p
z4>`e}n34`m!T1(t)obHFx{Gl@R%t(Yo`LZ*w9Rqq1`=&fR3F-{k)L@8w%`uvf3`mx
zVQHl^qxo>wb4Sv9z%25O8GK)Uq?pbfbORat?X4doV74<7X`AApAddI83+5Bwq>(!T
z6dgAiK%=&H^A+XdbW))XN7AI~2qdo|AtI7cym!d(T~thBgVR+Yv3bf|4Ld9974~cH
z=mI%lsD~``-(+Bzyau9k(5H?LtUwCS+i$u0kSXtSGwk1YbH_}QB;5S<c<r6LJM8C~
z>XYoZTrCq8X~p@gUNQ%D|J~snhR&?v1Yypj)F-(L8qXs0T}-X@?ekg@@S_Czy?-6N
ztd?eC<D-h&INXiAGe|m62;Chsal6jVpy3bm;D3ahLI<qashV4X-}b(7H9#lxB)~H-
zOJvw)(80phH!8u7e;X4anyB%|@e<wRO<Y=mKkIeb#>(VJUEjHexHB_0*mh8P3@jy}
z2>Q~!Cr1YAxu<N8IHWs7>Sy@}aL^j_W2Ql&m3RM9`}*|7mujMpG3Fhz+bc}5WA()_
z1oI2Mz*L_m&$R$HG+X6kLo=V8v5bTt+Y_Y9KTjJJTzk>U&9tKYe!aLy#fn2sU`lpK
zf-n3j+ei4n7hv#S3(=M4!llpwB48jhTMi#05Z7q~f$+wMO<emJ2{mXRA&8?83ZHSs
zc4Ny-+0~^1XaRyTwv6b!Qu5%cD5^#NYTpR`jA{8x#O-Ru=a?gR*fjZZubs&^+kHEx
zyk+IL@tOJ9N8uEh+>`QF88=rx8TMx(3h>mjJ;XkSl2w&`oz9<4+E&V@?Vp72-5->`
zssup0I129OB2sAj**pz)uQ?PMWC>oKRy(%+3YMGlwk)5QsUoQOdYX?)-h~@9P-krw
zu2bh;=<F=1Ai&|IRpeyC>maHR_I`Lnd72mJoBA{4n2X)}A=7y2YV!b+6j%Spk@*2K
zD*#rYP^^HJUz?_K9mM=5rfr?_g=XMeY%)j(rfgOx5h@LoiT0LlV7e;~YWtvt^cMS$
zKedHRT=@0(u+?@>NNJfdcfR*_4|b);TN;uHrq<7?WV1#y5kp-@Gcu2$?0F1A#a*^(
zTI-BNFAT49K<E$cohNb4cac8MKpRdTn1=9CLoT*)__Pxy?IrRJ6DvHn@Yez#KV2%;
zPysFFvm9qRE<^b5)fa_E?(pW{Tls`#tQeZz)Ww&>PH7yrIBqDNXB^%G@c-iRBm}}1
zAcTF<aR9Gk9#xB}D8D%iC}!KBtSF0hlXB!KH&d{px0#s&i1er*)>)9U#o0jAY_B3C
zb^8iJ)&=td<}OW$`}{Y+24`ObWVr{F_!o1pJO-IEaacq}OBs|xK)bBDL#{7d(C>7P
zF%oj6pXg#$59pAId8OIGk6_d>x-^7ZE;(OT{bIEOR7p5~7MpE)yx;KMP*Y9RW9q!2
z&8lT3BmsITLE(lBq(&Nwn-B6Pe<7fxtBS9+!CV>Xp+c2)FZ3p*6&VnBq)4>i<1g*_
zeJt+4+Jez1@+>4EA8A*;@iT*RBdI|D(}tx?-+>*qdESh_gE;fP*M+K^OGShpEXQ1q
zH*WN)#ksQIM-$xAY7>b7*a7Oh7pR$JnSWzkeLX9RF?i}D;=}lST~S0R)F&7_p#Jcy
zE54GUS_WKC$7~r)wyL?FHxS-6k5}yxk~!<Tb(3WK3Q3*+2Ix_-dlm=$qhIa<Ap$G>
zEr_I2<9A?;oxNbNTw|-Gby?MZszhK(eE25(kldhx^cJQ#eGO$Dj1uM=gl9}nLq60%
zCUVzou?-xpUU3zETy;n3iZyhB^tF=Y>(DOs%HHwqdy@NxYHHkisqylce>p~dTIjIN
z{E32mX17_T#P(w^96<xNr3-;RqpHU2@wE#~eI>tv@y_LUx8@@T71Wr;A3UgckpQtb
zJ-bq22RM-L-o$-zB!vwC&J9bBnDw8edJh*-QtR?x*XNKCD1PFALZ}oyG%F}MS)1sv
ze^lf0R9E0~d>cbSp-0YMIOvE5y)0T|Em6VYpb=&8%d7h@Siw&X3!#9BX!TA@p**LT
z+KW>4B8;Hxz_8uxBFyMC57sFHH@NHWvm|ddOm}|r?IZ=7G)@@-6bebJYwv;8S2x=Q
zPf3X))!5J7=J|6Xo^8phA)N{AA?6H_12xrZSdQBZ<8u@8>OX3X5jo?uZ-ZYqAD5b$
z>Au`<4RQoIct0J>5@*8vTR1p`j#PK->@VVnj!Ub0>ct)e3RdgMjhA9ccNW_nb^hcJ
zIat3kR3_RNRF8u^4eLBJ5VOK8Irc>{*W1N@3gKNbM=`nI-}|P8>r7?bEkynF$~&Bt
z?K&s=b7}9GE{PO@$RsC|rU*Dw-p$;J>+o3Ap|o448nr(bqxA~ZGDG77Rr+EjV-)Nv
z39+MGxxt~vWv$N_-gZff$AR#(!haFOUP+5Q`Qidoxh5^if~qD`D5H5tq7pE(vE0^W
z>`;nxBpqiz=oU--pw|c-vAgj&GS@jJE(G-E5XKCZ={O~hzBfW~ewmSwWGZx$!Vr+=
zT618nvATDm!69*JP}fcizU|<W(fivefS8@<Jjth`<^S!nAMaj#*Q<MqBHR>S7l~aW
zRbVBMKC8QNTtIT_HuF0R9ki3rJ-zPQYE?B4Ga~<5pGhlQs$x4?0y>X`zLhawR^q@&
zJon~>AhUn|P0st=`NbJV>j}o5sE5v{uUrev0Y5k`BMh|<<=?{g4^1_#LdiwCwPu1R
ze1!2aiis`-7pa7zdVfiJD+zIBP4B4#aU~mB-Rl()9p=(F`8+&K933#u3qj2q|F-Sw
z7E9hLlgyE5wBbw_zxF4+*EyH=rQ4&^t9i_fD&F+D8nUWg2ROLQ>ZyjF7djgIoU~^5
zZ2@e5s|<jBKTS9la(0GjFL3#;zGGT6cS%#=w{kAWO>MD%xx>i*rY*vTq*amVl~X(n
zcHuaQYxoOo_19N-z8OW0trifPaxUuycQhN=IvM-5`gL<RF$c&;VD}pPt8>~d8QA)y
zP!rFpxoy_dRWDj9BzAFOgrCvNESaV&gDlHH1XJI~^SgRt+Ke_emrpq_HK-gF)m^pc
zTG&H^Saf`+t8ePPQBD+2wBX(behhhfeyy)TE}I}SiX=R=T<lvmTPL#I(Z&qOXR-P{
z?ouf3Kp&il*%K7#Uh7*ZZy8P$@3l87hR;eR-@mo)xYwPS@wEw5Tc%{afJP92g1P(0
zlY6>OLhNL)(P2g929#up$-=C=?QgfI(bW4-IHx*O+UNR!U1Q2#ocgXPu54(7_nXDu
z0XfLiRfP4|ae`%xZxEAMZI5#wmeGjb^BpCA?t|S1D5K4PM;IUKtdlnm>z8WdV#N2<
zi740RMR(U)2>g|eJM~hIGUzg)WHzw-)eb5d`Tga`VWa0Lm=4_c8(Ie=syNZ4-hX8(
zAARn?JZ0Vjq$GlgFxHoSP4Ops%CHW7UpvN^Yg^=cW;t<{IvHAWvV|1>$Uc@KwIshG
zQdf0%HX(7VV`#93Aa)Ba7YZLs69ZQQ^Amd5<$esBm?=(rySAwEtnDS0FrwJU{p9Mx
z+B3YJB{zbQp_!hy<3{H%qk&v#e3bpsys21!<rz5ZkqwAizB-!Y3)h?Zp+9|4q>n@3
z(~67J#O)~@sA>$nbDodgvD5L)?l!%jJNdEY3CpSZv?}6iZ2Jf-fbc<x^Y)(yuNI9N
zs$OhT!<1S+ujbz`RS^VWrqhp}Jy%A!e$7({hK)gv!I`|!in+GGLz^$^sA%{To%(8(
zMewrNirVLwDqY}n<KRuC6Dc8Wjg|b#@TD7NpL>}J8Ac7juS2=@ZZf*lJtz>9(NpYD
zOx8Y>=EW56<&xmmXLwaXbHo~!l$t?r$8|s2%zU)L%MW?&lsE!&L)n(B{~5;b!9yPt
z46iEHc!#Rl*TOm*eb0CRYyW$!6T@I#VgRxq2>d{aN)}F;IFq^<X!~QGxM7~ejOaMo
zL#zJrsRzmptGeG4TIR=58dz*`VG-6J<Blrv(Fi;o0W*C+rvV&Q9a)@~L{i_XBy@bX
zICAHxgF??qbN)-m9}h#c%!#RQr&fwFX)8FrpF(pXMoTsv1`|?_m=oNdnQs*DTmbyr
zMjR|6kdBoFo9tB6OSt4e0$|Xe6hRzX-?I8p?>`OIQy;CqthZ%}VbG*^I^s6dEn<z=
z3LSG#2d$u8)FJZ)h<CAX{?u|>=ikr%0J)9g!SNmL+LM8COiwc+?ikdk^^Noim^AJ!
z5Vn&E;}r=;=>%8>arStNB`)RM9znK4$>fj{xJ~ZznP0le)c1F3%6%_zpa!%1R3J1F
zMz#ZOA8b!P6UVf}M8YS+4xX-R%R57&?r#Ugx=wL-00+a6MNk%qyMUou7sMeRE&+@-
zT@g+Ul`M8IW@vOSoJPFe(h~Y`><CCJoQMx+p!`G<(6%_}t#thm3(^E|dfE9PGCvp!
zubD-ntUbUMQTbgJ&{zQr@Q#$nv&BfxP;GCN-L<LMW$g)9(GHgJ(+Wzev1Zwx?)=`0
z1oh`1qfKOAQ1rC-HnkQsROf`LnV-#;!POKXrcDp`ZET=iu~XbOCh%al>bO{I0RG-!
zQS{qS#X9O>ZMjX)SSMRzfF%5w=|r9e`fA*qlYN0vu=}u%VH`t}Twl~wtF`DUmOcj+
z2OYgZqM63av5DZURS8LV5bGmh=)C+G%`!n>;%IGyT3`12t$yde8S^5R2LRd$9k5Jy
z!QFjzk9Vo|XM7xAurPy$(!0@|WgK8okdMG48lwZD!J<?>B-%>M0?W8MTehIaK^!#N
z<S36S{nt}~)(Pag*T)lkcG$&}UluUwki#&a@Zyf+vWxD1H=66pnd%<ejOe3^b2t2w
z4=4cNacdvIV)gK2qrAdHJ7+JpsS5h6g5XrvEJBzz;~!rtj+B!pElf6{!1#Xt4jxl+
zzuh_Ja8_Bt7(x*iL}Q~#v!s8?eSoA%50ncb7O?(PIDuruCU52^z8cy{Y7`m<D%X&p
zUdD>2=slF3)jyRuvj@Ev$BS8hBX#G7kQ%ghXR*fCkyjp8p%Uy~=T1$*05F@I_rQ;E
zkcGkKbQ0_*DNUspJ2OU??jk`<mefy>7+hu8GNV*v`I!u|5!XgbOKUy6uY&7hu1FI@
z=?R>#o6qI8G7|TAc~SerCorYRdf4~KMbJ*&Me3U@>Vw$2A<gk)V!nWr8rKF_s-N$p
zS3em+CdeLk(=us84F>4PByp+jF%nts>tM9PRDkEP4<*mg$UQ)3dv8w155<4#m#;(Y
z9zTKO+KP&_vZO!G7iB?|FaSDYjAC1F%+c{)&<W#?+Ztk{+T;WRoeATAxUTXJrF;m7
z!ha6ArfOZ<uBkDRKdv%xrnrBG{nJ6)vrYyO+icY>T<O0fiu!Pb^j{QZ?Wk4ii<{j*
zD4m@Cj?tzw%`-U1wOsOyOaAVJ<MJ38i>V*~yg5V|wc(bokt_MOXuOW(Uvgo@eu$By
z=B)m!I2!vd?md71zys?w>}>3b`X8nz^JkxVx)!zi>Iw5OJe!>3u>ou{OO!0<`Nc@*
z%@$Q3vA4ywa%jn7bf^&RSWZmlg(C;5g@d?ha?P4!FpdwE7qid0Q1=Jv1fK%D1Kq1~
zEv<@(sV7q|%H3Ven>-B=yLmESC#gaBUo-<wFMF|L86VI6Gl!i`g_X|*V)T9<en4Yw
z<M?<o1;@)bDkpuJ6av~Bb)n*`rxI;tyXgS<x`LahaOG@b|Dwm-5!MNrDX-~s=BIdL
zUFWA2^qipjAJAD`Y6dWq^|$rSI%6k~#jKo}BnF$~yypklMhc6KIE<RIa?qge_=*8B
zu$_`Cvwdj_qIvXo@;rQQ;=n;Rh1?4@V9}p<h5Ms)vs1$U1>(F>*|GD@%?I%*x1gf;
zFk_ILX8Y<wHR<D@rj=t#0ZSX~-thhGk#K$0v4hjrRf7=~uef+W)gT7Bmv6;Y<!w^`
z_HTz)KhVmisqWEq!mXl7L}tncxdur*DN2myg%Fmp^F!O2m*IJ!^&s=<*#+ALk5fIE
z)(Uy0`Xhi`Wu2*l*-t_kTPs{US?iG+vJX?67C%xLi8atI{;Iq)vCoo0%ch+fr7W<L
z+MNDEr0|SpE@!h+0VP=7n-#8RxT>wrt)m6dt4TPFI{)nN@5i&c<4VErMP!_AE*I-{
zgF}dYDMjDaXKA@l_C<3<FN1M#Al0vl51xX~3QTMn&XE`Rm#Lkv7Q0GId!C1x8YYZ(
zOI(zT5iSxX+C1^(U)hwBRGHlOk~RE&;tm-585DS^iXxc$Q4n+O1FkPaW^!r2CvI>)
zEXal!71ffPUh69BDa4{_!)<v6pz`TmaRlXL&EP84M*c|Ed8cZNuO_Vlwrl;VJNsGj
zv|Z19uWhp81_I*^y_>B$064`lTE4rFbhEt~+&hShqaM_$hvs#Ce9sWNq262TFd<LH
zn!=ssb-WA6A%@bj8a)>!0N%51*E4s2goR4N$nHn><IVZ{45t(uCLPa=DcAgh9Yaj~
z1i$Uik0N>p2RG(Vm7A+X1nk}mP+kZdx2wLH{@43acg(i(!$33C5EB`bQzWur9gV>s
z>`{AeaBEttGFlN>6E<u8-b<`@y`?x1d$XQ_b=O58>Ln)H@OtWUi@{u-fv)Fy(-~KL
zrpRY9Ht}`bKhlVC9q&G}gC$Q$_sbRLd5)kKj28x^oMuk{#fWiYul4k<TeVO6$e5;=
zNnD|2$kFXW-%WdF)bU#RO==Fu(Ckm+YJvL!2tJ6ZKKJoF1(=l93wXZ$PeS$aY+x{M
zYAq@r4-@-}(F1=91ha>4XZS+zl%)e*R&E>PAM-N|lRbNt&_a|EYvj<8pI%2%k`b#F
zbaHS;>W9f}ggaz@+*q24Zi9#YO<7;MjNc_jB*85Yzprk5SZlPtubK3$M~EKqY!1S-
zlEwMDSq5*56!TBq&kl`o55hFIh~s#)twNU-NtYgF)J}}+ni8E^v)9u)GQ|Y*_Bmt<
zd0mtPPkct#>6q5@Zd_H$A!O0bUERfo?VK2}BHi*zTI8CxM-oZ!>nI7?DOK%o!H(cH
zuaND&-(OoY@m*;;(>~2xo@|KiBtfT})b5&3`k8$vWkQ=CX%UOUCW?NjDvu-&j|7Ic
zvJTZF%!G<=xLJ~$hV36sI6`F+A;#2aP&a0MV2Jy6Sjq4TyytFIZ)y^0+9_!urn($H
zRPS9=*yxzJo!8apJjpXhWW5dYXNOE0)cGlQ!teFyWfky(XYG%epiIep$cMH{m48sT
zT30mCT;S=#z=t{2ADFT{u}!M`VHaCKR52!#1L6%KPIg#?68Xm8IDu>JnIZK9)LWcG
zc>s3Em<y2ChOli&POllN*_z-DApma02b<;-Eu>4DCI8DC{`Jjbz71@@x{Pg)-|$H2
z5w9Ie)v2vm1KcO`7;=tTCAe&0`~}DR`q6i`bruXo==)fXVNqhfFB0$JZgl9=Dx(;$
z>0*Dk*jFMe_gU``nrD)6$>`o$IG!<9p~{*{xfZ2Pw-wgrp|DS`=wTkrGhVK39WqkV
z_2m4V7mvz+$&;_>PDAAcE|t|L8YChVPA%=WiWIVZv9urKD|ItBVL29}T=i0l!T2`x
zSZ)QsOJ+}=c@!^KC3`BUoGCO1g|y&bK-kJ0u;5Q;{Z9J}w;-S~^OF6H$sE;u=K<0@
z(9RgrZ624c{ljTbP3jv+s^GFx?X80oOQL9ZJ^3`eLovvag(EMZG5c<3+9#~Q5YPJn
zPE2<1h)cZBxen4rQyOXaih5C>D^*WTA=18$gh-9xG8*^xqw7{>3<jeNuqn$t&rC`s
zJ&-VwYL~-2$sOhm{7=F=w^?*CA<Akywl#@p1J1nxLY2UWsqWjACz2}@aE8*O)|~8L
z8Zt-4Qm}g&uXLnwxi^u>g)E_7-o9YGjg8`a%B;{#b;NwoiRy%!A_L%T%q9O9xJ2;y
zIAWiwVn&A|mLQl~nqf9T5^C!aQuCc*4Sg2*9dbyYbR+YzEl-N|b&D24`Dt<HLN_Y;
zmeK_GRnAPe_&*(U6*NCZA?Cyr`ft2aQ3c}_%d@|?5Et!hyg~qk`ySK{fe3|RhG|3Y
z8|e5G-aA-px5aA2qYZ6pdV8Pw-5H0mf`n1{UIv%q4RfLF@PUX;Fci4yJu%e?nhSbd
zNC9mhYY4lbca8Uz7N0?~u<#`{wt0x$LdV=hW6X9<gPE7%y^^l$JQ7V3S_WVpGE#RI
zkVPWw{<4J`&%<Un;sB`wM_4=E=R(S?d>JOkbp$2GmJ~@-tQ25l`co<CvUo4FjM|ce
zX4kj#(^IP3-^q0sz8A@-IfbIhZZToZ0iVxg<v$Ew7#;@-6d79*C4ji*`V|IU)yAI5
z5m$?M3=d=o_9jG|Fp1o{3sKaNE(*upwR+>M9ik;(ZM*AUEb_2BSV(^j+!_@6zY|MM
zFbDTKoAlZ_dsA>vexqImx-EdjQ1An;{U(;eXNyqOU_P_^meK~{4AH*Uf&K=)9sL|0
z{>;-Rd)0nnKk<oDN1C?fv{1Z7>l86V1KxQZwjk>&5}%Z$?_14IgugsO8ppFJ9gSK#
zs#5PNv?r>e)FXQ(6lVnuDoxli+_o^06(E1sqt=xEx7;&9AE|-b2Fz=f9M1(i4eqkn
zfuYBZ%B-ESKS)wKlnLkR2GJCE<S5i!<qhtQ|8>FYl|H)m!fH|#WNQb3I0EC`x2sND
zv=GjEEbvo8X=Gp#epFHxrFZkWA^sV+(`s-)Fi#YbP+)2{S5+L34bilt+{p4%^(vK#
zQot~&75bZhaaNST%iS6=-oRI0Jau^-GENEqPlBDt=oOK`L%!Lb%*6>t>0I`$w0(;G
z1o|ycQHsJW<n5#v39zW##YI8B-P6G=jz|6yo%-4r-SPiV;$!2E7$D7C+rWA6M8OND
zy$Qv1?hO~a$2^$0k&dby^iVO=c^u5BQ~S$ToFC9gTE*<G&=a&R_mldtVT(Z-4~@hl
zWa&t=>2E&ed@(j+!z-E_;NfBa&K;SHY)KSw12Un?_<bVE0V4qS^+O3=K-ycOh_k7g
zUQ>mBX#_I{4@g^r`7-QbMj??ii&yaooV6SShdz%re56-2YJe7u(jznO_Jsyd=D!Fu
zgTFZ$O4FB$xqldA64-~8a(o2u8>7Dxn38N*(wi??(^xWjP#83zQ*mX4m<DOi46fK+
z`?6TP%<dBkI11oAg%eR-8s*a*)BOGBzSNoY?|?~CHuvs=lAA~Mi2!Q7Va<fhn}N(G
zAfn#)=83#v>-LtCFEwyQ`3V<^*o9!;bx7H<aE1Fx?9V5<$}N2}Y6u*LulUrAL>t2j
z|538oMYRwA>&0z}aLi+dSc1?k==)oPJ`W~_b`s{m4JV3G*xS%NZ4IRpyi*2*4x9Wt
z&TF5lYQ<i3a&KE}iJI-#fj{tDW8U%O=t0{kcT!XwUrFU9i(3;&q0Y&>Z!rFVh}YKs
z4L{2vUSF8f^=&72*p79<aCCPLB(*%Mzv(<X6r*$k4dsRr{?<;Y<!{1z{kmsm@cLCQ
z%9lU^Kd<2M^-Hw`YdTHjAB7?tsUMz=t<)@z-s2Sdo!UI;Gm1BchUnVu$#!P5y7xAS
zTfhA6pJyt?TeMf*DRcw8V`ORxyzgYP-}Ej5j_JcL6ER2QR^t;0D)6Y)5rUo@KQzv0
ziuwGxoC3Mr7ep0A;5atWcAOzuTy_aP)EC}#)?W0_E!UEddi*BN)bY}W7yN5NLVx-X
zJxCKSUgEp<lpV=ECFYrg@&(IdzRipn5xqm!W#dmRou7%ONV?DTb0kqwzMLuJ{3x`s
z))ma5c2ZSla`_&I`S9jMzNc7>+yZ4ZYtUYrMP96@!EJx@26_w8B(&w#afmJz_%>$f
z)ab=H!PENOmc1IFGgaq}G;`5&vfF-V5$yL!4cgV#%Qm*Vbd%*W&k+D<Nr}$we8|PL
zQ6K+UTvBihSET-p)J)R5d;v;W|C|8%Yc1`6s_psvz02|F;=V&YU^f;ISL~Sn(TdhT
zSeiQ1CSp6N&=B>`0OVWdgSwg$%KvUHeWUHlg?Xm_z2h{iak}qCM@F2v=md$>RNv-W
z9cy{IB;Q7gYunWcT(A97Vo=bPIXfhSxIeYg(1x)4WUgZSPCiz78kZ!muL302k6&cK
zO#WTlM_bU(>VDlbjNe8k2yoRgC`uypc2TYGqL{FpnF!^wXX@jyRosj=5voU>wsNPE
zYi+3x7v%6D2~4vkC@Ya{UDbcEa6~cES?=`NJnP}JZ}jXhFV{^fn@bUAsmPgc*<2dz
zvWQ*SwnG`S#t4q2n(Ca-;cgAzj<qP=Lh36AIu{&i-Nqg`wqm6O1`kis)F!){of6w(
zQ>}}shm3!mN;%<@3h{rl?HE+Sxp-{&r}58LorU+Hg2Pex^hMz~u@)N$Z&IGR^mC#?
z$xGj^RfwVE4&|5gi``}$%e!wQSK8p1uiW|h^}Z!zUTG}h;_U0ZKU_qIqWxSTZPg1U
zz8-EUQ-E*Bw)aWj3OhIWUoU4A1rFuViV>r2=WlD{-(eg<(D!MqX7R&Yehx=dH@Gzf
z43;a-{pu$hS`SQlQNtFY?uONh5L@q-qx|>f@%^oXIx#HoiWP^LdOJ6<X4_8M@U6;0
zR0FD)1FK_|@ChG_Ej#XF9WHuHr;t<DRA}NzL$=#f`TJ8g_S)&0hFNXjI2pN&H$K5k
z2QiC|Song|j*25SCDxi@c3b9W(qQNPj01O2r(^h(L1VS$=7S9>5+nRzy_v(jnfW#m
zK2ETWQR0UjPTvocgPb2l+<Xs{|NW(+axy)CzZLe}Q^#$*_gPQ-ywP|2d`UGQJ38Ea
z9sg5w*3UhL<1;cJV115C5rz9^*=c0oynXXccyDCn`$ENu<j=+^s%JzE50d4I@5XS>
zG4xsKnM9P~U*UEBZ5It%T!OCWxz9Qi&38*}`3F&zFH|=L4O0Uc|La;}h|Ny-Gh=tN
zRNk2?GSk1p#1jgT#y;j|`ddT2{p4aI_^FYY{LdIsH~D;=1SHB~JCPo~NohOT4czrA
zrqTnQQ5LpsgzBBu_Ekn9hDXkoJH6YTfA_apsuNYbdm5AOYt9v8fB-ht6(L<KH)aTq
zvK7l_OlWC?ZeetH@XXJ>@q+9tL%m#<=~xMZG8ANQ%xdu73r=iNXDG7)n`08);zywI
z(dJyGHlF3V9$>E5Xwgb?V=$Ds9Y;0RuscNk42RZxQd9UsAIcu%I?zKtIw374q_7x4
zkOis8wj-Bbw?0&^hVSAJzh(+h#76EO5EwUph@wNCfW?>rq9{j=U;&Rm4c}vl1;T&G
zES`iL56%><Fy>)I!8Ve7D*2k%bp=Yap&^lJ{SwqO3e*<q(3cY95m*eb4^d+6B8eVE
z<9yFlkElCyZUp43qI|Lt_*Fmxbk<h0D5fRuKlT_CaNRl3@o1l~u(N7W&2CUm0LOPv
zT4n;t{jR2oL6oP-U}8Jk1|Y7DMtT6|h!f<yZ!Vt@1G}JvGcIVdmE(5Dk#M~FHqafM
zInedkoqs1rFc46-X^KL~vH26STcL6ZgckHi!nu3=@an9sjIzp-U=8|)d4@7CDG(yt
zRRX2wFdn4Q{kiq$W!^7O65Yp4+;~A2E61!JXt_oYLUsKCZoSI0cmQ-YLYo&lLW=``
z_I`~1s!X%uw?^tQ(8zcFGdh6XZrDjaT|O&%y9|zAI}qJQ`655=r@w2Q^$L+GM#NLD
zuG+9PFfUDh4*X5XZ)c9Vo0ToOQi7l~%G=5o`3x`t7z0C><8edr)w4i{pIsWeB@L#P
zM%QQCpW*u4pc?i6df(X0JWu?Ev&!QIGip1z-pHe?^T((*m%lv5(sZmw|927R{TdT{
zIc;`dUu7y>^;vZwjOIthWnUSmCBX}Bl}4zRNVB0g`w?blf;J;eDfIVI%%8kGaNoXe
zhO@LdA7e$-h0rB-N3-T&P9bIT_qhfoo^btC{`id(I4(K+2(wr5OKO5DGclcL5>Tz_
z74Y1Gbz1=iCQvYa*icTBlXQtRhwy}O<WgkvVNuLX8%Gpg3i1q~!!u|<u{<eD2lv^I
z*MO2ps`7CIUYTLs0a2<hZAWcoWCtl%CV8Cot(o-NfnpSbq`~~0cC^`wKkFY32#fbe
zC%ZPp4DAnAG3oX&y%FhO*Fz`WdNbpxw$}eTzmF9>wasKaQJYz8y)N`K=;F+@>_+O=
zkH!>d6Uo6H*oMcRr$W)EM;j!4<Kzo|sYrK7{=IvaE3Fzt)!7-}nGK3Dfk?W-rN*i@
zT1U&ay`F~B;t_gBK(Ul;G5t`Ld)JcqA<G*0e>{D4Kos5gH_C%Nf`Ed6l1fN}bb}I$
zbazQNNXHT;2)H2KAS~UDw1~vgE4g&DbT19>4A1xX`Ul|5y?0K0&gYzaXXZ{_&Baeu
zXM!Cp47+JiV_&CaB=8__jH{YfX5TlyzLi&`6}@8}yfz!N#a%G7kTs0?pw{&;K`m>!
z(t{)g?4RaSZ^huuybi(al@JuerPX4G8;UQ-)_X<f<cjB*zy4nSe0NZPPg+#y#hZ2&
zff*~3k~8dgnO8Xq6Fkq^THXqIa7NjXG(?W0OH%*3*_z)V$Zj0AxwP-L-W_#L6b`q$
z8hmh}$i5k1F`T3ieW11tFu{%4oVgE@B6wSxG5C8z*bcLoAnRFhlagJ61TI@~>aYfK
zCg6||sIS`_c9l;S*B~cp>!Y)hck<VvDfScPQ-XlkbC2*UwYG)|RR@#CcK6drx<Y7;
z?3CAqYlZe%W7V6N7G``Fn~XYN6$Or^!Q7Z0y>C%?Uy*Ck9ueTa>2o>Bcb-vxe4;;?
za>T7Q{sL0(90@#8;8o*Edy?elaEK!P`eYrCX~#^#G+w4mg1=BY`&w5Y=^5a*IbS{{
z>lrbe&A@93pEbby$rT>VnCNNhE_LN_q&b##$Joci<23Fl`%aTcRP_`hIX!XcSs|$@
z-X{@G$u=Mh^<SHd=Th!V_7-!i7Mg1Cd}q%K<tCUpSyh^}#EqdC$xoj)47#yV`V`vf
zQdGV11syp25^9=ebV;avGM$9^=eg4nwg4MZj-M_6)JSQEkgm~iqmxOwI^$GW6?3in
z%ujh6h5gmswV93RV+L#OwJI0UC%*~NWrcm%%d3CS@jqAZkIS6tF{rX)6L%$66UC_&
zvs`vjx$^-_-2#_nTH-0VtaV!ARJi1<L<*u5gx$gFN%!8(A1v0DI&LDkwy0>mND@Cr
zOZSu-1gF&2Us{`KCJBpfO0+v;Q#{cSAU82CXbAhnRGG%?>xR&QGdvG0GPt});mj2{
zqs=d_`};AC?mbp6i<Sh<hk19Mp3VmA>sJ0FiIv(L#42@4eOP^zx2RB~{qOj}_YB&e
z8+Ge!NmBYq1+rGk6LLw?ae#fs(!l9PqUS8|k&V+um1~NuEu)W7xa)C+t;T;Z<UbO$
zGSxrr(8SW7a@67F<(!!)B}$FDP_#A(l%3*|wBF@-CB1r#_$nyZSvv1UplZ*NvBv|S
zAP3erz6~>-RqJ~T-0;UrAndh@FUA-o2*qvORtSjvL(}~KGI{TdwrMTpJl^TAV%oMN
zrRCfTeEC&AHa6sul{|+78M#cGz$^W+Y;RFuggc?K9c%FyU##ETsCN^Si+iX8ch6c6
z$RufCXB_MLr)C+j;8e}6OkRzfb>WU9?^#@V9mTiZ3;i#3-QwpLt7zNWy)5H8F7N(~
z+k3M4c1DnOftz<0*xciQ&ThZ)*lE8pnobSag0Uk7*izN6=<5~%{xkZWaV(+up(pq(
zclq2+{fd2}yr?0WEc6e;d+ZI_G>okEPG;WNhJSf%HQgm3)+l`cd%3I2Ir;vjB}vTh
zUaE^c|L)_@7MSsUx(~du(_hj$yl;TSn$)x1tFh1gA)iFxOvPP%exz$~oLtcte~?K3
zM3`NW6rrIKMBWVCih0}YZP!3xn!3We@x&Y4d^g7Ef)=)8AjGozw@UcHkJ{`A*v8S9
zQ-rH2`j39P1@pLtSLd4Q_bRIUb>WFEL6Dz1?7!Lm1Y)rG-iBEvW+k0n!`EYHJRv$f
zOm{JV(VKXyZ)<m!47pBLa-(gnTW*-o#4nSdwo=HpHg3lhH|Kq9@vCK?&!Lg#IqI`&
zBw7l#Tsi<&KgDjidwqf398|mv9W6Ph$hS}@L&Ho}r~_KA<`&_FKFf^{tiKA6a`k{W
zZ>{*wA}=3!ab5HN-I#M^`oyIeG=o3WtF_1IW3p%SULeEN=&Ox-dB2UZJh1QPo2Kh1
zjzH~<Baz?rk7>M_X6J+g+!;*pe`Y!M>XRCMtbh2Yun<_Y&G~U1WzWPj^|0xaNKQ%&
z8HM?HMe|4ihgOF*z3HVuEPv+<3MnszPdxx4vRSPmIhYoAx#b5JKcw1b?0=>!Z}7c0
zTtBZHtD;luketn481JlpBV0p#gHyCl67{kkm$}ICn{qM!n@ME3gN>HV&8c?9ufTnd
zlH$|3CM!9W%JeZ!v!oYNPa^FU<+JU-i?o|eUai4T*2m3?vz4(=H?M%Yhl^#GTm5YA
z$A|t&gTjLf0)lXwo0oCK?d6{yi+y`5q%8cBi01D(Wv2`;>>2*hD(}ZSz7DiwM5`SD
zsB+*-JBtY)_=;wQ2^#;M{kxTMkN-<*Ith+`SWQzj2d8^#qQcSFf+G^jrBF`PTK&;o
zDjVkdXU$UlOvqQ}WU`~Y83i8Yb{7;ExTgc@!N&hAAw*&+*g6Oon~MjqYWZvaDBMF~
zY}wB1>i%r9Uz&^7UgV1LDG&pnuMl5lzsCo)Sg5E^T=0(8#0(gFS)9o7Z7s^{jin#y
zY*f<UeemUGj9K};WmdZx@T@Bjl}qX>$KSEwDQz(aC*ZRna=CZ*E@@gvfxFzq0Z-r^
zToF94g3vBU*rXy%#3W;v@PG*p;3-kutZNvsZX)Mln&ezM{HvktX}sLoxhZsQEav4y
z88gm1^pEa_QKT3DVWPWltFE<(Q{R4l)4HTmA6NM~O}3Ild`=O+$x)@Y*UM&ADbdd+
zIANL4P?9Ov<XA~#hMGJ7TG9hw#Hw_pXtrpcw7w&DtF$^d3TAhbX=|63@&m1%ko&M^
z-kZNWulEyOxKxke?^Vt4tSlBe>-Xz<;TwEj-{`lRtLt=|dHhwXqcq|k&!G@xoBt3o
zq(7=(eW>)9bzv(`nh997{Th(LLgseEB2XCi;8J|4?^*d{LCk8-$3K^($TCBFZ-%Fi
zn*VNL{cV;`Ii$h*;xxvH>q~XTD?Ig5kD#>cEs@>A2{y%#jWArs${L-FY=7|yW!L;u
z^494G;TbPHTb<n|#SN$w|FJt?DKg;nbQ>evv?g#ij~E$Dn+s@XOCqw$G=h42{&P*B
zC*B-UT0*{ue3aGP;9g9~sE`Uv7%q)?Pn~gy(r9t~_W`C=4BkLxQ1awp=jzi;nGW%<
zERH{_VaeESPNSbMV{>WKmg;Lmh~-x=R3l0R-}Fr-lQm^|bz#)#LiaW@9^dyN`=L2;
zzltAUPx_pj68i%`!`uTe%}&0iygGB}6LndYRu(cz2@;n{GbAs=5`sMXJ+=N_`Xl?k
zl316o2jmu$i`~jxDk*|Z%`|t<DwUjw=ssTl&fR>NAEo3I-GNBPDtidYZj}1Txy7Ya
z@bA7`9&7j=k)hQ?V%0M4$HHevYwCBYmo=wU-%ch;!7OK<!@1^>cJkj5ZEKJXh^}v&
zS>hf1vvdQFf658IAE@)bUzURWlJ3zlHZn{3^J+u3U%5BY3-SgP7GAWmCMm2g$bo0&
zZ0YXdW@Y9C{^eqBkH^D<_Yx2MgIkDSm|yV!ALjkvVKFg0E=^B!58roIcwF*MW;Vbt
zT{}w;TRdT29z3o$R(3YF9(eqGe0W^aE{-m4n(xdkfF?3lUUn8%a&Bh6cwAC;9`0&Z
zZqhDJ?_8X%oIUV_@VJz$oNa(Hc!Yt=Xy9={>>NF;+<@PXW*$~DRu(RnR(KK;c>fdC
zCv|%U*XXg$;?2J7tMv&Bd2a4)Vzy={+<3x|3cJk{4kLf672Oay(~Jpz<RlhbVRT`n
zz*`|dKE9QHt)(W?$k%(F(FRG0A{B_d44OOHT(R`>^78BsTun0evhi(l9(Ls4Zdc;l
zQRS!Mn77*#$=Dq>^X+0`s-^V&`6<uf%jVqQl^{AS*)k#7fj4-^`>+fe;f{7DFM~gp
zHW?F%ue_my-L^qC(B1Ct0z#?5y|=0#hD60i6n~u%?t9l(9^X&iuw+c75|g#>IoUrc
zr({aqTC?Ld+2EBGF#F~co%eS7$%VZ0rC_JXPvOLt%lPJS+bu;B>eMeTFdol$)qX3C
zyaj)ja}r9dqW8I)tT%rJx&KM=5A8rNSm4kNlgp_*{<o7bsO_`M*~WKuYXK5dipz$a
z{-06pv(<b-0TbnQ{awvMZ%_4NT47K4?5F<-h7kIB{+>|(6x<@QQ1a+1q*-`%)C}9y
z2ilk4_Q~|=;p*Y1bm;N6ZV15>%;Y8)A&t<%F|z&M1HXk)b!l8eYJR`vA9vaz&3wf-
z?-#fto>&UKJMGTAg58UJA~9k6>-(cY;6agh=<?@RFrc-_S0!8`nvvF<_ph-pC{JjI
zg1%QoMY-NwTiU-YZ;gt|bPckQ4w$)f1$*E@fGBo0rMJLtZfSr(&I2ycluyxic2A#d
z*zcb|eTv@WJ0du)@tF+1cjY5yY#q-&w6K3pfsUGi)98Q5%PCXz@)qgCOZM}#tj$Ol
zK*7)((Kp%wo(Oi;5TlOau~C1aqMY_E+KXdGlK#NH>)Z^lUiL%Dx-v4}sXD9L!6kj`
ztkFv8F=yZ%K1Dl;<moxdy1v@UJ9U%zC%$}LQ2zk7?GwKVd<l-`*0TWUPn`m-SqB}S
zVTiR~-iIWCG2Y>OIJ_k;Nn<@p+RJ^H+Z5I<nH&4nwW&(GV_MM;F1oXHb#V!CQFh0$
zlw}DQ6AmX0)>87gS?#gd#|bQPak2?6EW5_7T6&p|KXrU^4D@w9GRt?I&pJN#hMh-$
z{J3cC>w1kMmOcBz>zi||>sE!|!-hX-nNbGpGu6}JbJ&BB?!xaKq!E8t`E$7sDV^tR
zB;h;%3*~?#hoSD~>YHsn>HhMO9_pR(GZxA$es%O^>#C7wV3}sRM*MJVU%bFDa(Qd6
z-m|NqxVa$3n|5%zg~j)#q8jE9ePZQkQf2R8J$bI};ANRzeC2M@IRInRbsU&zus+MM
z6BW4Lzi3D^)VZ#8Y#*!Xy}ppMKR7TAymlWhyt&%j>^yG0Il8JOC<?s3&ePtE54hQ-
z)xFx!C~Li%3o~uGUNmjxxHyr#IlC&G3%W*-OI{s~GG+K59@b?9p00b(1??|{m|m{+
zMkWLv9oJ<v-^}LC`R}(y=a~9m?Kg%?TpkRckooVe=k0Ro?ak)Va-^T^gwS#U3vLUz
z;cH46tv-n9b$R!A_QWV5hwG-K(9o*2!EfQp$>O5iFRaf~|Kum0t`A$#!((zgWMn!R
z7$KkK7+*j>f0pg+`20^uS7&hWXSvSLxc9z5AouRw3kk+i**_s7NL<|9Tw7Zro#!1L
zo|&4miB4I2Or)x-OXST(o|KT6Qq<Qm(>~LN=<S!a-d$W}C+RVwqW&T!2Mzr-hE%7k
zChN(ja}bp)m>APwUocGBll2e3Z+(|Ce1B=%k>f=~MRm=~vy@QS%4fm3%9pe!=MK56
z7Ldr~xBLsRgllVo{cUo&l$6Wu9P+vJy)nhXtN!KfgpgJ-=V=G&bXrl&v6=MTlf%h(
zOS-dx7TNoUE?3)(OPMa;Ll@XwzHO9UEN;SaPbe`P=*&rMIT%G&$;o1Gdv%Rmi<p$I
z1zM5b!x!7+iP^8=ple@?bWC~Fm2Xof{k?r3YzQH8{wV=%VaM=Ok!&ticl1l~%I`)O
zeY;{NMsAk^EJe$w1Imag%#H%8nqS=A#lEMu8TZ6lc`9HYeVrzXp%F=~2<V!H>nB0~
z64CTd)-heZ8Vmi_oFwO7$;(SfCFx1$e$!SwUHl0*GQCIA7rlo}y<C!uuwEfg6^lyq
zUhv0+ZcX>Dxv8v}FgGNo7`{8RzmsIbGBDWB)#P<-)b@pKJRDJtHdv@X{36)HY1(9D
z<W;rzcV$r{dN*!!Wt`Kr#lS>c!($sFYbC#5Q@L>vO_>u{Q&*ax-Mvz$;G&Hva*3TS
zjMq(=EiBg5nl3D~b1Y^rix=$aEh;31jjm|(9}~oBdxou^_ZavtIr+vlU3<AJ*JLet
zS$G;tA2y#SpXWj?>xTUeeN*a-9W|y~;9Aj}yR5t2l)KaPjjTLSRisA<%6q1{NK1f!
z)&gU&%(}82ufJ-&EMi?-UvG7Xw|<6aO2+v|)6|ID47Ii7c;yjhTdvAG@uGg*O|mXY
z-)c#m$EhXYWWkZ-P>_vs=Q|Dotna4SZ<Tgp=nba8djlb9s6Y2+2kjN0*~@;GLP2U-
z0}X??We|h~Tdz3DVxQrT#wcqDbZ=62d$De$?2e8iHsc8R-F)3Ot(=tG(~`rICn2)F
zp2`6hR<hbo7TYB~$@hGH8I!C6i^DbySK>TttOVH#9eNa8W(!$b1B;pp5B&7?WshN-
zb<Wyx#%vr#KYfoOcKZ72u85k-MK;E9g)%aeX1|i`J%#<zXhrfeBhD7JcNKdFIaTE0
zVVr5=LF*c3*C@s1#dY_!fi;^oQ<02}n1qa=>!X73wL{gkzW&~R39pT<q|_zhdK(pL
z$w16e0ey(OTO}cFcaN~E#~d=Ii)gpEPsHQh$*eRk(H6=RJ=7*HilLsUgHG*yf_i7~
zOe9n|C{DJBiwe3RChDBr4|c>wH3haNGivRO6(-|hMS?cjjAimFQ>UBcisrH|>%#-z
z(`wh8b1KCSr)0caej$d9?X6k&kG?0Si1;*wEB8||`TnciZ`?F<M#2vK+<Gzj^WrB;
zrQ9=P*_?lNV7LqQS7vKv$<mrGZF&2R&dI*(%L=#SB!(p06@d;#TUN{gqb78>Aib8X
zlBLDDww9))rF85r*G+*+Jn`<Y0>WCJ)*lFsmLk(3hRh+}XWi1alEOkm(#u<vi@OYN
z$N2m1)hC3685`(DN}3J&L%at>hwsv<$fy_BX`WD1ZV3zX33Sf&a)}AJ6{@Of`JXNq
zEbQMmYx%$}f4?oz%vHYP!-s`^`KUXY-15V8AK}r~D)^D#GK86)(|Jwy>2s^^53db`
zg=cWvwDq0Zxs!7yzJ3u-rjk+h7P*MSyVhD|iJV5^lX2+_Im|9H?ha&Bp__Ad2Tb>7
zFKF3)*P4kWFW(}fi6pO2uNZ0lFHclwgCdnA0&hO4N?dHgi6pNsX)^*Z5o@M_`-r*L
z(+%K*dHa!NH^;~189|5Jt*vKklC2lljX^<I+eDK7C&#UUm-~`)frnRIt(SY--jX*b
zc{lzSOJz3~>lZhd-l(9U%Y}rwKzi(hO48Pw%fm{^Ya`6?jZX3P(zxl3Ue$S|Rco1X
z-9g=)uG4h6{aFt|%2=shg#@E-e};o*t)pH&t1s|<;!(<4=c#ggr;UM;V~3dGzXGK*
z<xXAk#}1laPIJ`~zFj*Ulw*0;TNBlRz3JkHF@oEZt)l!^P-}?6#z3Dm^sm>JWPH7Y
zTqn}vspts}qG!71;?)?kx$z`TD5@Shh)k7Uhw`|qSXx`IrixVG{0gno$0ec~6!k>^
zTA03E!X>g^v!NAvcO*4iA>GwodN#3Nl`v>&wPM04l;qh^zUQHXsn2RkP5l^sSZ{+@
zO182_8fzq)kf5vO$GyANu_=3I!xd}X>a$?J&QY1tqNDD=V5ELl6HboD=3-Lsab|6`
zztU^PKaR&0r<Gt*Z$wwd%)(hvP;a84#mL3M(lYuke2bQ%2%!Sc#8}(eHD_I}D*I|$
z`PMhp=Qb6et5Bm%=Ss^83tPtZG_^;Syau%Ec6%I(5ZuO2+VIK`TNT}|3k7lRTfsvS
z6`BoWlCxUzrHQL6^Jw&2uBhl6p~*U>9O4T(&HG6`R0g>i^H6MFQpr>i1zB@kH>+MP
z_So+QUy~;B5hLn!55H1dnSW4QL_b@_@78+D^gX(RL$f9A*Q|-94V%Zihp5S@f?vUX
zid)4_9TCKa4x;z<9i5nJ)~56hbIe8A*giB*bpD0da#hz>lPPYq_d79|Q{v-`x@B9L
zJufHMOESb`^jgi;F|U9n6_jY%+Szv|9B?T2f3a+nVT<bi`{xgY?q!B;Pr^i^3LklB
z$qSWoGJK9sRR;VQ5xh(eN>5xES5sj0_>Rh*$@e>SNILaHajY$v_BsSeW(7#X*t;TX
z;`fwi)0rO{M$%fa5GTW^ZI~)}eS4Ldt0@G7r_)e|FYbnJf9BRPk2*`d?|(mNaf-~m
zVsv8POQY=%_o{hlzYq_b0Hp<I^kf9B4I8Q9H+~WnerIG=RP<=yAB+@9<;M~0)GrgS
zZ3RADK5*<Zl&9)gCBY%YSgP9XGS~8v2#ZW4O^S3g#FLpP!P9W&kn)apjGoabeY~_(
zMjZi+N`%*#c~Z=T!83QS`6-38)Q(!Zq;Twv-T6g^<*CM>LU;^3x;7OPsQyuPI(K*P
z_-JfH-6VS9Ax|%cke|*GmYIz)F-3WKRehuFy)%f>nc?A%4vXl7#-hB0gpi^&1{YQD
zNcrW;3kDaS&7~!AM7vGT<6ZffOaD9{=*77TCViRmRc_#iKu!PLd${MyX~a|%FFozw
z>iyVVeqa8qwIDDv^Fzz^qo}s)mgnl3cLJYBExZo=puX&;re);wKFHEY=ItvzM~`wB
zTSrG9H6JMrt#^9<#KM7*X*9Gn#G>vHEuXF8r`(z9!#0ecWd~A4#b4O3ete3I8eZ*(
zg)1dXO0v9IPxH2xVd@LAu~xcl>Ns2?A!}-U$?Y}Js2IICdv-)?>Lg)Y*yL@Y?GZHj
z+ACYUQOkE7JCrdaRC(KygQT>e_^@DWA=av**daVEu|Tu;ZXPavcX}rRfm~?2n<s!z
zwWCVQ@s19^n*tMAR%JsbG%5NLKe404CI_=Df?LpjrJodojcON0WcS_04UJ8Tt4^*-
z5Jo9>-%XNHB6}$+m88_uC-Sue!y^~^M#?Lc&RVChPeGOrDp$$Ha3LG2#=v+X$+PJb
z6tBNA#G~jHW66Sgtw5dKSN!QKFsX5xjM0bUawjn+oJm#YF^H<UC2@It$J;v9s9dWi
zL4_k!w0;|r#cVo#!EjV*REm;vC*WX+TS}<wmAon~wGCUeSgUJDqk!|4nFOYE3sc{F
zr6?)yxTAL3tUi>~d}ps-Rs2({Q%e{6-iYhbq`^#UpIAoCBl*t)Iz(jAGu0(}J?yb~
zB_;nX3zw0aDy5(DI2h>1q!`9DlIYh>Pe)%;d-VnUn>Z@FOi`)H<o#zlxV|%@p5Dzx
zifz@N%}u%jR-+~rn7k88n-|Br=`BQ%J!2{AlFRIJML~CgfAD!HN<6u`g?+Q9xLC2O
z(yPibK{RQ5nRQ?j#VP5#01qmYPLc1WIlRsu{<2-_>R9i1gQkF5dow+2to^<_$QIXn
z-&PkDtQ*DSQv2#u_dzDsAWyDIRLRTvJoA-$W~WIriL3>~tZDYD+Ptf!J3cSEsdD^Z
z9}!xu<h9$?oxP7A)LuC;=O*;HLlZ4u(i~XWd~sn|z3G^_pq71U64q|?evImKB~clh
zpco1L`YHR$t~u4(-D-N$!B(%6BAfY@nYB9RVXDv7K~z|SG%P`ORx=l!)g;?hYDv7K
z!5AX!`KQazh=bHkDU>d#n{sW6$PE_WkpJMln=luL%k)>-V`#U>@;)us`dyFCwt=-D
z2UBfYlxbQfPwYZv?uaneBxyqX6IP*5&u<EhEVy35vC?8t!lhcJw681FuU9sQi|uZn
zV5J)q##fB@h*jq^7V=+UXap%Az_A=tw=CJ>OpkNM(D{9xWjQ`1&#**s5C1g8EKOyk
zuX8PFxJux)QsT@%tHKCPQz>u16)a$xp$=)lGRpQcWo^y#ET3ANf(D5!Xd7d3@>G2e
z4v=1FDBM3#IUC2&@!|b?Z7t4!(;%J(xzI~%uGM4DyrReQ$whqToJyuc^A)apY)VBx
z+#SW4XLxjzfB97d-f~>8ei!J7XtQ3QF=ghb$QB|Ukb`4Q7hBJnC>9{+&r{Xf+GDbX
z#1ea`l6Wa<(_NB!XjG}Ely=Jw=GjC0nmvqUG4DumQJ?G@*=T1q#xU`fm^#O1y|Inm
zt#`Uxn>ANmwWjdn9u*G!)JgWALFY5I<HF*Jp36UX_Kk&VTf*hox~Uq0k0IcxMBapr
zRXI9%{(K$MOXPfvX3gvJ?hYL83hG^I9nIW6Cc576612Zas5PFztd?98IO*;lnGSCV
zY?nC)EDo1O>38z)WDn=-$h0F_bj+d93N=d?E~{KZjVLvS8Yaz(=1(%r&koIb7>oWr
zHOFOf&$V=8%;1Vwkn!i?dUSw8%u{2L+h-S@MEXUepnE{&jgHwsIy>pa0Rnbv$x1qf
zI$+d@DuKPCdo($5pV9mSEbS|MZ7m7!+B34RyBRO^S<7pm*VR>-55OHQ?55o4EF0r_
zsqq=iMHSt0zUn_C)zjx*6REW%Gc=sU>yTnoG^|K;L8RiMI)5uXBQ;2hNtx2un+)v`
zSdG6MI`nrsSpV&7GQAYT`+x2#x;s3t`UPRA<*s`CCJBeGqNLzUiJqmEHRI#M{ywMf
z9_!^7Quvjx%pI(q*~ko%^$r;Qc{M95YYK2o>0SyxXPZjo8P`wL!|OKwzWJFfch!qn
zl$W<Mc}2!uB8k6-EUfrNGD`j|_r+KrY8SzAYQ0QGS9IUHme^Wnf`{z|+xJF>%}IrS
ztVuW!;@>?P{YgmJq9)9<>eCWkey6(4eVZ<u@X89U(X$mn8a=B_e``-qmZ-#VbFXOM
zT7X!ThmANnlIiAQ%6&_Y4+tOp58ZA}p(PW}i~k%X=qtUfB0+t#DdkCf`}}c|>Ps^n
z#uJX0lrAqG8b%1#kWQ(*-RW=?JHu!1Oquw)o!EOf=04f7%TpVB`iiHLZ3+y0)Ha-t
z4Zrc$ki_(k(Ov)9Uxwsb^#4O#<Vu1_`<C&`h{gt@L*Zi2RPjQP?u2i4@tQ-nPs+`k
z1ThoIRQFhkO72?Nda3W!yr^P%xB97^&RSiuGf#T4vqa}Nt_mt%WU%mDYuq2_OCd$K
zW4%?11KqIxuITM@3eh%*xnk*ypuv9}Lepv{*4yO2G*0Gw%Cx7qzEoNjS2nmZrQm;K
zDD9wrh<tm&^1MxAptL13GsbxOO6pTnn)uz{ADd^I?*9JNY}EAW_uZ!H7q~G6U9sQQ
zB#9ymGR<1jO<FRaYtA%ZB1U>ciiJ=y#l+}sVSWa>p{^+|_GqOm`rlVfs`tab?Hwl(
zQ#}<Ko#Nu7v+RleRo*?%qKVz!eie}W&zF!hRSZGsgX1*fhh&e$tQ20!`22bd+=suT
zdDWgJb%pSI^!)m|?NQY8>knq!>TP%07StE+1ipTxp84UmnL6_Mowg|MN3TCv!qjfw
z4}I+}|1tj+-97(n=qq~f$B&`>?uTy19y0IL-dKA0ym=#|q~!C?*3v`E_Kn_SUdl(x
zxn}AWNV5fG#lHIU1#Z_0GqWgUMO5Y^b#CNx1A2nlTHpoG=i)~sD$WlFi<Nem#aIP6
zMa0-&2nf)Lg-vsc(Fvq0!52vuv$7URNS5d=h+~M&yB#&CcqwT~NE2kN;Y%dMS@aep
z#EW!@hJE#@`}_Bi3&;~265=JgED~Y_-u?Ug`%y^wWtuFKJjM>$4&{vW$0RXA0R~bY
zm*1Wan=j?|C(_WyymWw=J6={l<s~*Jws~2#TzHDkerj3rN1vAjZV_YM_cc;JRlZaq
zQ5b4%v~`5yjb60rOX8=0ZiZ<R9wxRPOcNF5wi~#tAC6fa$PnZ;JOAigMVvR7GH6uu
zcIVq4{lnEk6@}!ww*%j@>+#nHRZ=V7E^Mt2uW_Ub(%WHv`|^_5^kqoK6t})5tiSq=
zQ<c{rXtQwnlsAbBktE@Q{D|UR<uG{(J)dR_C+kZ+8(8#S?K8TZjmD{3<qB|V+dA9j
z2(-a$dCwY)d1DrH6v+lm%01SzeDM=Fjm4m2(I>M>qEG}hd~ML^w5<_;jnnA-It%4K
z7vO?S72f4E<_Q{DB<fBMmtbJ)hu&OuxUaR|ATRKNpZmbFU&{&dB7C*^1QDW0)^c&u
z+S+Q1$fM;l{)vXS2K_uuQ<c2%S<i};NT#KH!p!|>>T9Z&eYM0D7n_ztq7(4szE`f3
zL507Ab<a~P)Or&zSzGTqRH5mcNO0#|n@|6?)l~cm%6oWFMPx-Klm<1wnUy}P?;^6K
z5{Is$TfV{1m?C%P65@h3x?8SLXZj%s)-zNWhPtnx$@`s<;O_E5p9RhtDul>#Z7p5M
z=ULvo(%3?K{n`MPqz@nPDT9ejk~KWH2x<xa@6g4eOwGQnDBiO?6)FjncM*LyD{I!&
z!l~}hxh^Iuc-Ib8XvCv}c1HH;Q8+kxRS_92dhgEvATGmg+#@pjxVrl#0$0rgO;o&Q
zzqsdBx#110S!Z+$>%LpH#Gvrc@~Wy1xl+aB0?vP*8Ck<V4x{q$I9D@-<Dd&tZAqFo
z_=6eZ?z!`e^-a9K<Xox!;%Pza{;zjX;R%D}%W2IrrDD*QJ^w(H>m0>1U*A5@zQ68g
zzBpgV2T7Mr8{GDduIr^Lf6gz)h2xyzEH}8XahkA*1?^1du#pb{3$r=s-yPuz;hdx<
z?Ch*9MtZ;jw*^KX==$FkHd)=BK{At;J|k^CEiFBtdi2JMqNTB0cyEVp+2iP%MAA|d
z4mvhca?=(gEw>W1f;wWfXgSQm5@Roq7|mKN5-cU<o|Dqi@TmEm#KBqb6<3VtGimg?
zvfr<v%oz_?C^c=>@jsp<s5~;TTR$$+ElY@t|Bfj68%-(b5+85Ws%{c^<+t9SB3L@d
zT*BTO2;Um(|GNn+di8c^r?NNeo2Yv=AL*QNxTW-jQ3^V1f6uX6(XMlj1-3C_<!IJc
zcRlpe7v?R<FJz{V=}B4MC_G51D=cK|cCzm_SQ)KZ0anin*<9jv5e_{r+T){IvAWv5
zY|c6(BRbIz-M_=^g{#VITMC;Ra%(rNt(1+GeSMXUovdV)(^A<P-0N5!R`}!MYCLPS
z<7&bhSXb?NqS)*U?N`DK++xlf3JV*~{j9U{3raQl#&kwmHXIN}F<A|@E$SvF>YAxl
zCnsO7iAf3qbh|W?l;2!kw`LDYeEPHNRA$~Hqv~5XdSp^$7lLylQarmt>FFCs81!h(
zsiEQL;js|8*uF&iVgu7ap_@hAO&F8$anOjd)l3IWQB3w@senCYw$Q0AgFVCbL2N2U
z6&H9XxVZb`Pk)1hO<eqb`*pOd$6sJSe$w|g3hkM)=B^2Jq@PD=b-aHhNA#A><y_I<
z@#)lZPMOS!@x70|A~%|fp8w@PDM|3&28ocV;-uOQYv1G@NkJ>N4qeM*iNWy_CKNKJ
zZS|V{OnLpb|JlyK{>8hwdP0YY3D$7^y7*OuB<=ebn=GtiU_<78C<Q|%o@Yy`=)%9-
z8Fzm1Zu>9Bw9pt5>t__S$jI$xUy)$>)Xs=f?0;5OSCo3Z0W}^!wV9N}dT%q6MxZj?
z$`to`d{@&DzB@GQ|K4V<q)avyyMRF<pcVQkJ+Ju~tNE46lQoCN#l3Uv4f`Xe$tl7i
z%8?tom2(ajJ1yg~&EO^RBP`>nxMwR*-pHyGKu2Tp7px}@35P_PTWZ&yy!jHfK_PeL
zJT&X}-o#w@z4*l|Ry^H&JE|*E+I1Xs^5(7^)fS#P<zK#$D72za2Ini?D+aThV|>Zl
zz&wK%A*a{;+x_>@{2I*@8Q<};RvJeSI_y}4MsU!Dy!W?YlN~Iz>-o=-EjG3;{I7Oh
z9auI=G?JX8u5_ByRkhlyzhiW;k7&GaI%e~g9cMT{rMqbH)_wyI()H@k5i(cFt2t^&
z!wqiobDEJ@&D|p0Q}~TMMe76zi1=JSrtrliCBaa*V}*^=h=_WH=c_@%NkM|VH+Rqt
z#yn#d#+%va{TsF(<P<pQ2I^uL^Y8k7js|%V5MEms-d8S_;c(<rSjxQ<fB4nAQf@5L
z?5b94%cPNV*Y6Y*9gUuMw8|3#sQ6Q6n*4y>jm1@<DR=y00;pgEjs|5B7BlRVQxAqx
zsNTAa`1@({P~iMv|8#Yhk1C!j8rf^$q`*<@2*kLKc&Hp2@Zr6B+Er1C`nGE6*<}40
za!2bOut{l}Cp3p*wk#a@ZxmuOKL)Wi<uJsIWrdq#)YY&FLo#C-hfGlNr=glmXkmAU
z;=nfR#jE@cwvXSJN^fP*@~0tFzqvks&l3UZk4_fIU$_KLy&_E_+=8jN%nluf9(W8f
zzsJM4^Cgc|*AoE}Zhoh~fNqc^*B<$20Zkd7@?an&DH`Ba*Qu6l{g-qAQBi?5V~2MQ
zI{9{F;8?NSOSXKquDGCjY0c_I=wNZ+@|6LcTWh}vi{?TgcbI$MS>33-06Na8L_nlB
zh<>PJ^>{T_1<AepahWedAufMwHxCSC`|ffGpp})V_ymRL<A2x)Gr^WVl>)2};%R}Y
zRO~j!+)3*(v*ZV0)Tz~u_<T6CjH?<oEIqTiAFEluP|yLssMhg_pRW-50V9BY^kOPN
zk23DGXhl!A?)&WlJ1ST(E6*qr&3Nma?00+=CS?(G&45hWj%j_fw&jaYKvg_>Hg`?B
zD@sL7#%1AHg%jxZ$$X(E6Y4>^W6)#*?h)_}pNvO<6J_zB@WqGU;8-KBRGVRRl$b0)
zXn_hr)(5)zOT4q7!3`%OJ!KaT0_;yY@AKjP2(!ctHvgMN+Bmw`YzLmFL{YBDA$ZRL
zbsIEZR0vY2H>%<S9<4#d9AB7hnXgO%7sWD0>=eT$|Mb>T0#|6zn4qkI6--$HU_nnV
z_HakA);=xDRQK<se1(&OYNelGtqAPJ0*pScV}pSp4w0`xRPX_S<9S`-`wY<0p(wUS
z{V++H5;XbLpDoyn(Yyz*;aDEqmM$Z71$O`eYQq5(BAd)!0?osVkn73_X%KZ#MgTw#
zZ#snl*vi4Jd6UN%JdLq>FqO2M$piMY`N6Iu^E}&5_t451*KhFQ6v2Xp0LZ;3azMOf
z1W+*o;2qsd_xr?FUH9~dpu7#O9HL^!kKbRQzx?a1lTy1Hlv6I?fR;SM6lr6r#gU+r
zUDxS;t7rKX1H!>TL{wzJk#@=~_CjlbztlQjM-1jN3gp<{cG?n_NExfv#|DF90BLJJ
zti$g=hkqMzxR}AnPX65E|KJT3rknu=W1iaXM%uO$g4i~RIJ^rfT7fnpncuTwdL~)~
zm90rp<$ycXYQvk=H@}`g0GjDH@Iv8c$GD*B8jbZRYY5Z<1Wneu^8wTTFknPQcPpon
z0oC*`;OHxzlgwa*CaeyO<-=d9xjq0!i|;|&eqYR{px~E+W3f)`0MXm6nhyK_$QF9z
z`VZLb_iR3c9!J?z036zm$JQ<*v|SBYBRMMOE?VNdX26<B;hR-kz6XPHck-vU+GlOC
zB0TTpFWK{{MOYYPO$t=DS~C!qNdhooo|<nzr@7}^z9<B^({b1m1Cf5b@kB1<@$jtm
z`&r9Rf)~&`?HeZrnMm@|zqg0Pq43`?&z|$A=3UDI!2PI91-my+Jq8Hu;gtAiGXI%I
zOCA>pr4n)n_+@^>mHlbNTM*%}ttDp3O0NtF;3QkpG4Cu-Bf3F67=)mwbMf4XIf-Fi
z?-LN>AK*yz<k21QjHUM&q{L$5FUU5OY5J5k3WakYL0fv6yYRI*UjQS&(q-)uqTrg#
z4Ti`81|iLUgKF&(EqIOtx<|inGGA6BU_%W=y}*4a{C=3zAQ)4B0hY`dt9}F+F4mRL
zUZ9y9X9=VkR7PYn6Tf5IAxJY7g1`wD--jU7EdWxVZMqNGlzFOs-`~SvIQ}^(p~nCu
zW^@k)JY4hxF9M=$Bj5rupeyy}3;rAoKu{jrE4F+UEFD;YW*t}l9#sI#{|MjI6U=l?
zp#e?t>8i?ZbsuJDFVqSq09g?^c&M_WpM*LvVze>FXbJ7b@6SYXdkP9C<AyZ?=VntF
zZzBcOi$Xi|^NC<6Zez=<T+sgMOt~BZEJ7MY&`Nh8;nvsSD?rf7nTX;!geA2}MrJUi
z3y2BQtyow7<WRtvOSU5~WLzJE_Ua9-QJ=!<;09qYPzqUL0u67Ns!zFc(c=#OJ!Pav
zNvc%P3k)CY<Zk6KqW&;nC;~*%V&`N&^Q%A#aG24w8uk6y243*GPBg_Zh07HtFfJ%j
zUFz~!fY#1cOomwz#FD}$<2XN@@S$)GNnbMHxFekWLWm;!*Tpw1+o_kK&FVpCETAmb
zE~RU56gZqGzyzm`6j)9U6J6@AFC|XyzM6qVK(IIVE`VqogI2Yg3TmYn0O<g2zzb+&
z_GU(%1N6QK##QTy7PR^noY)satp67EYqg)`DmVR?q_xwFVF&aMyvHD&Ip|Zyp}uI-
z3INXZC^-bcmL)KA3(jB=xhWHq;@BYnI_OI-aa4sCBc4ng!X~GGfH?<o&wFfFxhk}9
zMm&Fwk~HqWxGBMRfa|z=0^|<pph5*3+o1qR0X>NZ5{wc*pgITY!!bX7@1JumP~m&`
z9pGg92i0ak`%=sMn-!(9Qq*9pFGcE9n|IafKxCg)cWMDyCe{hax34QKz!-KAy{IVl
zHE)k^13U6zApN<5Ibe3Jtpb>skw1HZpB_NAJN2eOPT_((7no~Ae|92sW3RyuX;iQm
z0#02Zi;q`0`!9LXgQnx$S%dolwG&`~{P#<G<6@bvjT8ej0Cu$6_#-+6b~M_B%RzGd
zD@*}%P}=+iD%Q4NpD+=e2I^~!*@8g?w=@B3gOs&p<}$+C@Vt4A1jwVTD8y{Om6r59
zKzMeT1r<S&<a-cK+rI+S&&$uH!T#G3TXQGGg+gHDPj$}bJN;Pv2Waky3x#`KAH;x7
zoK&`8=ZIT~8cu)+6@>>wjC*ctw&)&YzUquVKi`ID%xy9;OhW<1gi49%Ew%oc&F`+`
zBnNSeh^tYrP~G+gJwPUifiM-V@B<bA(lfwAjMr{rv;bPMq42*2o@d}y`_mmmMHEI4
zFTh|8gWV#18D(!fLJ3&vErAUj;8M^o0zMVAo9Bfqdcalk%>fFH#`+KL{6L}btj2!_
zAgg@yeg+KW$^n3%)20vwL9u9I@Zlzq*R_kyCC5nbjnixbl@r=PI20g^52L8tl8)b`
z7>4(;D6(+j;`Tz<N0v?_oLQ^ypMzLnbb#{&z8Q@IUCW8FFitYoJH7+zW>17U9FZH%
zCIWJWN6A}pqECG<Dn;D?1v~M}!5?V@9co8Qi|10TsWlrdz+CT;!+UWO**UsJ17t_E
zK|j*g!&3xwLdmz|vwSNfr%899Qz^g37=(j(c`5|Vx;o(~N?6g1_+60I)ql_0`p<ar
zi_xZm)$I4a*?eCO=|Tz$0_MEiQmr!a*wgsX=Zi>sBt&}%Og0R%K%Z18>atA;0AbQ>
zw{P&!{sMa+E}&LX!|4*TkDvHS4brw@eR`z87S(M)4UF1a6jDem0lw9$fHkYT6{q9|
z5BdP|XusoA=tLTWj-yV6Igf+voa1^GSnV1@F>qT`w~g8=wbOthwH;k4VE=TqTn_N$
zP)%9@Rn1qsiJ9993>cFqVh1F^ZJ>^4&6244ACTLw{bTtWfUK@o`voWq)H=*STMIxj
zkWZvtApO~4w&oZgWeeTb7mL3p^PS#bG5|LG23HrAJhQuP4LIg7Zwv^NNewFfTOb3)
z{%yYV(Abvc=c53luKY`lx?GgawlLV`MFb@8|Dg4W*8y%$3lc=a*6+#uKa^l$;IwM1
zC0_O)lw7Txv_xuZfo!B!I{;|nQX@v&u?v)86>TsMb-DG&HBE!enbEgl;xG-c;OY1Z
zko|qNZ_|zbcAG?mN=dJ-G`tGHHQtzSWh7j4Qw0#WN5`FS11QS!FJhY2D@>Ks|3?rN
zli@Y$$dP0!pkkl_QO*by5c88HA|P5MfhzdR9qqi4|5d#~fQPT+Q1`%d+9t)jIFCPT
zQ42r-KV9v#1rAgU^}w${dJgib6r?cnH3w_fO;rrUsl5<G1ePEi-ZnR!q1_u-(jYtc
z>Pt$pR^2ZWyEGaU6ak!<KMyo6p)bOK0$;zgzKNJmO!feb_*55;jJuEnt7sipJ__wP
z?pw@8Ux_BMFKu`cf>0^>4nX3OZrZijZ8&@eW_6_~*cyO?5-XrOR%xOBUok<$H5WSm
z4U5^3%R0b#T&&cY2&li9r}~h#{#Oy1pl-@ruw+KQ9Wc#-*;h=b0)QD%*B$#;o2`L0
z%{Up5?_i>%?`ZCUg+-|=U#%HeCrIN!P4WoL@M}2!dCC8=S$!w6bH-i>7t_Um>!k%h
z35wzGW<W*?{0c@|4@j`>62{=T0{3;{Pm@6zO15AIviw_sX0bUy*+8umBttOw=n|a2
zv<a|4;hD!F|0_bYB3${ZuR#)E{{jTUeVtT*He#J>fC;pKnkz8~rH=F~=<wyrZHBhQ
z9fNFNZXAH+0?QWcfN6XM2)-U63R0y~j@zEgwjh>4?D~!ELR}yGjXb`cAt8X;!i);%
zhYK|nPP{v*2#8t94-mWG*kjOP0zy>+tjERmV16*{MWRPUE_ZO=*J^VDQ;*+3!L~8h
zP${@!3?&358iQ@>k?-RC^JAMxuvUgTC&pnAltQN-7-PS*W3vIP+LeF95NZHU366nG
zV&1w@WdIsxg$5X}fE7J;2wS``!P45#11edm)(y@7o2!wgZ^7<qtvmrZsUaR9cDzeA
z70P3Oc*f{|sa_aJ!M|F06hU(uQ{NV56Q;b;`_e@bgj;8jRxs<ml^lyh;l$Yx-GY0y
zEiiCqKFs1j)S`g7Lz$QmP>>BBvu&=KSk^uw4Y?)Mc)<H4I)NTw_Hz*4v}v*$iyDP;
zM*#YMJNAe06rl_I*1!PCR)4y#j``8s#k;I0n05IJA5@H#ldy6?81+YMHy}Ol^_~w0
z2_N3x_yyc*Z>w6pcOv<S+<+n=o5>uU-JZ^**QggI7WSz-Q3k}a?yhUz9@PY9D4yqs
zX#$fXz_kB|P7yHW{F<;!ftW!LYXS7DRgnxw{!IQxo-vZYk#?KB7DUEMeE(ML41c~o
z|DjpESE!?O!PvRFH|n-Q%sZ-0R?IiFAKbVE&^h1yQ|z($108P93vK&qhd8i}V|2M7
z#Z<XXxjoE_ad>z6KbYH&(3NrreC>fraBG73_c4&-deOmGs-w)_IbdN^&?mI<=fJ=E
zdHd-)#Yz}BINj(hGW40eNR7iNBAU<sG!|yRr^gHGHo@*>cl110J1=C()}uW$k6KQ+
zQv)1!q!w1Y=t!*}^rlV}=4HYH1W3mxi<tq6n$Tj&{81Q0Klrv?Kd_F#7ID0Eyl#?B
zeLLhEpwJP}a#e~M50RNnQ$aGns&ia%j+LX>9?mng00u%60yDBkHCfCjNF%9zBcv6G
zM%Fi8Z=JLrGDyxeAoF&smEo-{|E)ZIfg`cbk_cfE+PO|9!UiU)w`(N*ggmv7FM*ym
zQ-bH!;FvxNlt2M=HkP(#=izu%zys)}Y7;{bg~vE>dGLJms=F0d8R(VvXSU``F-$@h
zFxEUvF+fCBtE_VHLL1Ogb+bV6TmbFo-+^e~y2TM&4sHSz->Q#53!o^NlB(R-V3W}C
z$A^3wPYUpo07u1@xVoBCY!_?d4ki<)zkqk$TCmWwG<)zugbxVK{Xn?tSFM^%4;+wY
zlDlBFgClKun7^MOP-kY)3;GLV4M>4Fky<g@fMPjN_(J_9WG(U{tu}jOUfaFE6Rz3~
zI<nn<kT6t&N_9KwWYgZ>s~*(q9-Ej^YMQY~_(+l%EysxM9J4N<+K;uX_4VIqK&Xsl
z{7GucZ4(e2{6$RlVk0f;(3@m;ku?4un)R3<e4udEs+vA@g>Uo3ooky8?ZQX(;Zy(w
z-_z7w?h8$}XkM_8uEEZ2J;_+c)c`a3{S5=qA+Z{FPb-b*1<bx69`vewZ-9}psFt6k
zrmNaY(rXG<!5(AKX#Fm;r5qv%Eh@Ei!P7u^p%pm7zyYF^J*wfW6srp1ik+)$;rScT
z{_Rwom0GNLWkSN2uJAM+;LymHuFLqC0pkWM9*5+y|0YDVAa<qhC7@tlHHF-iY!9Db
zlQBF^yU-vT)UWm8=c6>w4c2dkVh41piWhctfHB3FgJPydWH$b46cjyM)EQ$=udT&s
z5`b2cyA(l;Zh!ESW*J5!6QC_fNpMvw9xCZv?UYk`InncpW6AbHp^<!D0WkH)Ik6cU
zhl}c1T0>WK+yzV`^Y4J^jFlZ<{eP=$y<#)KKatH5<%gPqJ{}1a+x`r|*_x=^lojOD
zz#Y}#J!b2F+>$^mFj)$CZ;xDmr;~5ei#=c{-&jg}72O4sSa?@g1d>GD<<7wmBq45-
z^YR(GP1jJc@Bp-agHs0_G9|ZRO>SD_!dF%%(EDcc%Nn5lk0~7q=W64eWxcxG9At~}
zw`vD$&;f{yff5QQV>?ASF68k1*os=d22gUc#BK_`q+mR=y=aeV{=+vZq7ji<?Z8C|
zB%Qcocl&WP{LRcZ@$yryTE58_8rwSrpn(~wDFgHhL?tr?+()h;`jOs1L6q!d8&o`1
zh&*lRBX2<2cD(_PDF}G;M9h}OeuE!hK*SuYwR2{mqyGX3w$#jn@wgCLQuI@y<l!?=
zDbVe||1xW`NUFHzSGmSEBTJiLz?xe=Lru&YoQQ(-55Fa$-!ys{y#5bptx%({2Teia
zvzCRuc_#kC1GYv`tQ24lRw^m*Id8ZOItU2xs_x}dzFc0M-@ow9NJ`*+$g-FyAb>8l
zH4G`X+5g5vj*}qTr^mor7}_kwcv@T}azy%ZLAQY8FggYo@XJuUhSAIfuwN9L+qoSE
zs*$ZKGyx!KCVFGTwG~Mi=l6#0vA)<glfe1s55Tw{iannoq7m6Ni*Gvao0tMgew0j?
zNOf?4GVYJS*6Ojtl<l0e<a1yIR(Vg)pds6kH`HWvXS)CcUVlD9z?{J|Z(Qk@Z1bWT
zM1s7%!9@~BxTqnVvvg|XETCb=He?MBC`x+Lg}jKXbs9l5|LpsjL1+jVWuB`7wd4wS
zqK}gu$+6q?$ONbUKO`u3m?mAHd3s*z3zGmzwH8^W4KJbhbQLj_Y~X^z*>M5G{jgz#
z`ucf_eD7HmC>t}Y4zHeq?Ko%MPUss1U=k4{qtBPp9ZWs>{C*_eg1AT?Zj#2wnxfxo
z*jfe2*!#T`L)j0k7qIFHuA9M~2)&HOd16hH)2KHKCu}cd04Ugx)jA!SWvgV&$#akF
z7{F6oX+cX?O{VZoF1#IQJl8=LiBXqA8c)HpZ%EuBK*VmusYl*QNL4q_Gh6(~17tpH
zPaBwD9&6CZ2(U6c_<n_&($n2AciMhLwT_8m`#Up8G(80-CPZ{VB!yqm_I!&H0Va#{
z`sIbja2lQrrIohv8V_3jo&%cTJh2f#g2FQkg(*lgdAg3XUs~Q&;1l4ONAaH1Xny#o
z-k^;*$wNNRj0yBG%?1#Qqs9Ky`Hk>hU8^3ku0TIOfKUtaK!@=61~iL_H#JRf$*Me(
zOxK+~pO#Wp&4Fk`aj^lJkVMWgS4L+sxmOm(=^89I1E2F|V35XJd6gHCGgFa94YCbU
zHk^sJL%MQh#&GdV4=riz3}tLJ*k!GTe)P3smS>Q%xN(5^4y5s-5L_%nMmk?-M(fJ8
zUN%)kM5MR0TrbIZj=JT8_eZL1zvkAq1WNwR`*7VZGkW%)?bhAz-3t!B_f3UzdtVx;
zh<`-;ViOPmcji=^5nxcVB8KK)!_Uv1(j(jm;4{LYd00b79A@$hLjWVbn)!I#aOk0>
zcr3$D2&9G5qT`{>OEq0x<Mw=r$iN4JAy0iBzcktnH@->VtZhmwMJ)>l>}}XRv}}Cj
zkV{a0@A<uZJ7(3ru<L>!w|A%LfY0TIAWNw?Dqj@t>l1)Y#VPK35KM$1nbJNi*qLzu
z9s0_Z*F1{VEO(wFvT?S;49%igOsTG;_%Z(Tq@vWMQF<n#-L};$)ZY8KdMU(IGAI(`
zg?&WULA<SE%DsU>bP5rVKKVcn!)id!as^*aQg29{Y1*X;6#jnM!yDG90&TzJ7fKu=
zaW9Rr$1{JbpZpu2Pm_ep%JA$v;Qn6Hhk+&f84PfR0bsP%D9*?s(~wWb?@PM_(z^Du
zN>%c>o_KB=zds>au~Yf|3U3I<%``nQuiciZm1;XvW>>I>cUBrYb;s{h**W^j({h@P
z4UaQ^<2aI){og9Xvp&EL%GD3a5Gq=Q;q{FebyDJh5%jM(ShXPSyne!dSg?AL4Lq&Y
z{EwH$jPr}0rO>~&E|R~hwrAU1#Vp#r1|i3K5F}wcdRXk~N)3`J^D8D2YhK^WJMw7^
zI%c+DO1jl+!PETLqQ<1;KkscOg5-|5UpmeKr_7GDLcPXp!gX&HFG8^P`Wp6Eu+lT1
zcO`W;ToZ7mhE`%wzn!m)Cnf&{?&&u7aBw!YT+#9s&Y@z|cMjnmEb2RAhPEl!MPcAG
zk0|&A$(6aJ#S$TI12sgw7LwurW9o~9p>0dkKU`FIs?~!mPL2|QmjWRW>IjdFJ(^#o
zEio-c0l-^eK4=;VMZBAkmqgyH!n0|(K|2zc(l5L>dboB@8;9M+2(T^UWwZn2>jHih
z9{XmTd3V&=U3bqv9k(XG-n(;!{tcHCabLi+<17n!cYka=p_vB0gcMTuR>yK+-#>-@
zXII}#m;3^oYsIk!WzOlC82mo{y25UXxMithj-1LJ5n((IXJAhYZPr~A7IoIL)W#xq
z3C)tG!1Kb&t&uOHE5ay#ZQ&3_)&VLZU02Mj0hl{3p{Yn+&|s1~t``kLw3?0nWTG^!
zOLa#c6=bP<FxGw%BS<ZhoD{fs+Tyg1i^*}GsaQ$qcz&5_xxAr@$M1LgQJu-fWd2%D
zu=m5x@G<K51ayhu_}cWkbpdHn-*0g`+nyAUUqV|(?UMih*n9Ips@Cog{DdeCN@nF$
zDpTem6ekHGWS%l7QyGdfpD2k8A!BheWhP}Pg%nZdS;h>R=Xp5J`R$FZ!&Udb@9+2f
z<9lDd@45S&Z9mU`_OsUdtj}8e*=yfGj<hvM!?kSHE|f+;7uaLQ{pNw)l}5j!eKyyW
zdkr5lzmAzb^)Bmjq*D6{Zsn6RQbqO8zMXCK40~!AY|fO#M$X%)BcNl~r-3mnD!;w(
zQ#trnT5FEuskG_A?~0V3Q*Y$7@+=20jxN+P_=J}t>^RPzS^DAf;R8K2L*?_!mFL3W
z-&Ji0y|2kF3vYXV=bXdPL$BxINm)IIuVxB%{|M7jd~;^`!|cadENhEXe>R-YFd4m=
zJ>A2O%@tTk%Ev}bj?^I2mYgRf@>w-sk1uruRbYmZs8ej{+1jQ;UxY777*^6BIZgD&
z$(5oUC1|+lsFVFj05jXZ8*_ZA>dNkpGiB8c^o8}`j(z;xddJ`WU1(XG<A;ymuRqTW
z&~;6?$ZwVGt&7$?rE<!kJ&VU~iS<zJgoO_^Vz$28!rNilt+Cy?dqLiyokn<g#OgC)
z-ej+3uAfEzi?hQP?7of;!=?1v%PrDh*z@=lp2fu`wa9gZFxAD+1al17bj}>FV2Ez(
zpUSI_EM@!leqmSaixJV#chmiT4$s~do^!O|Hd?x#HNt1t&usRUE+@gYOsU>qi*KrY
zAn@8;>lLXxO+OpQ7|9#Il|(O?hAU{_%3T;O@497pQ_@Q2_V+-2G3AM(nn7B(U}ol2
zZDzLjRzJJyH5=Kq-fCz&PB;$CeEM+PP<86f9%<q?a)DP74%5S#EX6)r?*bi;E@@O3
zlzkek9Vkwt9O-aMoxG@VeWIw1Nx;xO;4VdPT(Xd}O-Eu%pInNL)qKsUA(N30X2DE+
zGzi`h-nx{pbLWUAb|kU;Z2pp*>0%lRn`Knqr<2lxu9rZ>p<hqelCvPxrf0sf_vK-y
zNT&MG-NkeM?F)@YyLZE#1XylW#Eo4n%A0e(S~7gH7XNr(`Tohrs3QUbH#CNoI^u1y
zk|Nc|+Jz%K1KJ$#f6x*_I|_w=h<hs_=-`lZ>3Lgtkpd;~ct)Lwz9EBE2H%@QEndK4
zOmDbB0c!jUKW%AsTBv&7WEWLZwzwA`{LHkQ)hT+yJmHCx;Rh}96Ah-DY3()Wb>JVl
zoqq~MG)&Rkeh{Hw9N#P6KbaB1-7`Tr+cz;?f)ef_sXQN0Tst7m*8gNr8OpiGmv5nV
z@@Rv-rON`lx?f{oCpn49Ikl$msQoOa89F5wI^L$ebV<Jh&&7xniZ3tGX473fyObjR
ztkO$(Vam9ze99&A6G<Z~(Z4a^$mGpl&i2c6BXeP+9KoY)9daEvZ@iUZ<88~k{XRWC
z6rG)rKA?Tuz^S{fWhV3P({h{4yMf;1Cm!T*-6~TMyVH^_{k1zEW6EoXrVQYd^8D)Z
z&CN{8P+cTe!ET}TW-NNxE_U+E*CeT*3jy`t5(B<V{fu3HH%F#Epc*Jfy~F}6y(g&;
z9R6;bGg$Yf-0cjv$_S&t`-$x3;90gMR+hV;eQ95loL<tCHlNJLzA+d}LoJ7-FAO2k
z>D_a3n0I_L&wMfOFpVVb%Z-D;D|x0$U;FksPv^ra%9o4NP-S7uKeP9A_c>2ZWQ5$s
zE|@E!C6FjO&hGBHX!^c91U<iFr~jpnk_E{fdAp~&UJ}Yaqu^n3v~TT^JUD@=po^3r
zofYnMR`9ThfA1}Q4^{GoyQEENnAX%te{2XnOTd75)5zL(B3kF5?PV&?FYR}FEcX;=
zd+BsPBcbN<!@jO4Z7`Ve?%<>SLM!adBX@UNlkkIx#ooRNZCmyGMm*m_ifQ@0in$L<
z(uIh6mz3#F&L6(WMnyet>-07A9R1|0`jaHH!e4qKjbBIy(Qx>le(ky6?x~sIPMYNs
zUZ<~kHzy?ml2b*vewYNfX<QS5Uw4_kzcb92?Fl06@~)Ko{qy(62Jv&}YU&zzY4~k_
zyl}xMoHinM;`e+Vp8Teko84O5INQClVR8Ini>%gUC0u1pN;{qHW?vXWCGO?vCA<2d
zOa%7sNKhbl!K$sn;yUnzL82Tf;_7lSI(`l_C*wHZ$C9_pcX=2w754x;)xjBIg>wAS
z7dF3ejv?+rY$sl$fb^*r+X|@zp|%x!!;ER3^rK&j>4pq2K8DRz(~ITZq1UmQv^S`t
z^@-|R^nC+2nt$##zH^z9wS4cAHy2X9_J>SuWLTy5(lgl(KLZKVejoeVCym(5;EYW7
ze7;Mfa|`l|G+)^F*4NOXUDLA)#`~<7Xh=pn<g&3xmz@dmy=SJq7iqcTSgt$2&RHb1
zZ_as0sL}jz*@nm3Ywyyy_0rJzB2~t@*{{)>s4`<3|0C~Gg%=L?&*frm`v#1Kn##FJ
z9O<TXjp&M41A^QqqKj`ob05QY_;zC}XR2$s4}UyidgBJ#m};cAR7{B1IZK4j`@RlG
z&0(&^qC6UU@qL{p!gC*v$(a>e-i&B}CDLP0-|JU4{Eat+`eyG@vA%*4pmG5(yyBem
zbeG?r-22ycCeLNmGd5?*XI17{M;KT7pkS7$ho`1)RUgu>cG8bBr54`tBTrZ(XAa3}
zS~c;tKcGXxS9k{oFRVFd@u4`OmTiFfGga$qhL1WDZ_*<2T#gNCQVJgKkCMBWANEiM
zp_Qd-t$Czx_N3EsIhf$0@nHYpn|$v)_C<mhGNOu_a;j+oW7@|L9d5@vN6V9G(~LBE
zkVUabV0*{d*w_Sd>FMPR-lZxG(T?*(G+|CloKE`l1hy(B=o$BHEJ-P|_QVz?KX}$^
zdvJ5{^9ih1{NVlDiXWUneGsVP2RFxmRqz97_KymF6a`y-PdU2xi^q9_;|E-Ji63=6
zXso;b^+U<Sy;lSpr&=B6`y7W`w4Hqf3YPeJmh9)bo`?Rd(mB=WQtP~TN~l%aS9ktR
zzLa^s%VXQh?@O$$c|tYIc;+)^kq*t@u_Q!-7u=l~mnu8oDx49dsA&?r6gaoY-uWPl
zPU?HHYWZQ&i)M@X;bK{IgLm*P&OF}lV_`Q!T42;VQE%E_use`2E<n+mI3r|dlk(I9
zW=-n3!WL`GGNVfFD2?-3mZTA18Ujw60yk9&EgfS=6-kUV-X>J1b*6q#?L_Y~k8F3y
zPYDrFx6TsJugTRj`=S4iI-73Fh~EqKH0<WC<g|A}?s^Xh7t|BJzWwYw*q+X7$yiQg
zIezwM-{_CG(zTf%PcD3XocC=%$&Fx3FDC-k88y7PUYJMizQfBEa8efJbq6Ab+Oe8~
z`p<`sJYj(I%<O16%bzTe7V$&(rq{i&mUM|z37jp`{Lgk=mt7uE<FD^rxM@QZE3E6V
zTVnA!xvFK7v9%Ox&u(Aj$5~Pz=VN?Mi^byCI1&=8^%MuJ%~FL5C36`W&X7IKw)7hC
zKUd!0LVWWCDp-o(3`6^=C;Oxi`YX%i-GAIHtu1qfpYG^m*4Fe7pJBds29?&Rf&`Yg
z{$B3}Z&w-bH`qg2N&Bc+PwqQ++b-EBZh~*G@@Bb;vNpYE(-)Wayx~FvyfO!!-d<2Z
z+1_Y*gVmu?;-1(IyIi82V~2<D|0Hj<<8;Hjz3=dRVDwY{<KdS)2oruf0DrS5GTW=I
zT{qED9?BHKaiM*Nc)zbw<l&=H-*Tv8c_L6dovO_T9$F>~s=6xkQdr%-d?wB(1>do4
z=V<>I%Uelq(Kf03!ZI!2Ubu0GN*<x-sLK5IY!2t)0GZLSb5GbWx`@&Q*bIL7Iy!43
z6KpPV@ItjFMRfK{{!_G98bYl_!YF+A2$Vn0XP)4q?oIxjDe9pc5NzD=tfsZZbdm`5
z=&<q@hRFvRCMPe)x?P@G+sVgyMu2;LFaO$JUT%&vzxIOVbXJP_oZ;eJ-@9US;NCMl
zoKSnHQ?R^`xCKy?2l~QC%n6PHtjPoHK10k29=Z05A1D&E@(U=<!+u528YtOgzS8iD
zo{70NCow1I`d`)L^i2&7R=ZuP8pKTu3}~gNm7hGsoFEDT9k2Z4CFTU-2l^>M%(+?^
z2t1LPt+j-rHBc95<y0a!ERFRzh&k7AWaTFpF(+8XNC7Mv#D3+Lg@K}>HL)h}^`ba2
zyON=;_1al3tZhZtwvxnJV3V~<NZjD)!D#}gLTRPm(Up~QM_2T2fmMrEFOFTt@S2I<
z1q)l?1mGCXaB&dxaPR^>0rii}t$_n?69a{jR<1?C@V14`EdxVf&)T(%n44RG2drJJ
z#4QUO%a!vf0;jyCXMWofJeL7bG)WZLvsy$+LE-{9N}Pd0C7V`cwngP6sJasO>J$Sl
ze-%<vD>c6=b|5$4`^<6D3kSd7f5Pyou}y3F>ahd-$3A?0axdx<6@%3y^XI`QoeM~j
z1)e02p2ABQ=2@B^7*d?(ub-<o@Gb79mMbh(<<4HZtZH-Drar+GL6P{>6*ZHi7gOZ0
z<YIgJ8dIz%o0>_@qt8xzyBhIDD(o2oZ0ql4WVBmGle!C{o#a{%ybtL~Z<>E$Z*3v%
z86IcCI@0&G;zIM7$NS*IM%(=f?enH)7Go6wTIu1<h>=kyrU>&fHg3t65qN0}Mtk2g
zKYh!NXODXPEIa1yzW06}Hw2t6PdzK$liH>6rt(f)Sg-<|q0Hz5U;5K)MS=<ah6Bg-
zNRyJS(!GS;llC^q+EGd=oOd`P5Jqhm7|{Cm>D9uwFEURXjMxkb`ZMfBF%zO%=X(ko
zDvrb!N|4mj7=>QiIq73#(tScRu=0H9J*pS`lejLcb2WMQlv{ri2noGT{*5+(aV+=N
z-iF8|(I1@lVQLnnLMX`>UgQ@?lBJUPd|baqGT(Qtn-R7z*dNC6MLqFm*^B#LSzerV
z*IyNC1`ozxHo`yayPJnvl<#XPqm$Du&x~0Cm6?zr;s#kYhG%-=)V4KYO!EVp9_B6k
z^TS_{U&jy5CUqjXH$Y^#ccGICubV;NV5)O8;!t|bG{cv>40b|x1QgvdB-&nPU3483
zXNoi??pQ_I9ztb%>P=`*+?-IK(6Y*XWvj!U$JoyJkY3MD)U4=iQLyd9f$XHBxT1Yt
zKibJZq@AC1aMYpm(A0NSc08wTo$@VILH+QLI`TB{!g*mcL_x&V37GxO-5(`Vk{>4&
zo#p!Rnk(6JK03pvNUQMdgGal`dS~qMlI=O}-Ggy8lw2<v$W>L`O^P>j@7{;{U6rX3
zFDeemYxW>2?rS%H-0$2Z@xe038cq3<U(&>&rzAU1>7o9);fDKuS8k+c7DUTWVlxXe
z55AT+6_Q|CnAW{*nLgL_=4xc`=i?(U*~YE4(K;tg4SS_kWF>{K9%r$UsXGy#MXfaR
zMC5?m^>lAtlJNG*eGTRx0<{Tr#1-0shoLppdowRO_3}rE7m0rPiQz))y{%s?Gs(5?
z^`eoN)s0E0J?`_6=rdwmfXYMZb_zLi|142jbCclRygf0G?{_>TDthd9i8_6M))S3<
z-v`p(!SmHw2)=^v3Ev0~gnv6R(<dJFkgfMg;%7VLcvL<5uwwomyKsA<bGB~s&q7U4
zi!8`S-{dv5yGWmQLtZ<?#0rm7?Wu|Lq9keu_W_e=CbxUpFMWuW+R3=%2akCv%P=()
z&sGgYA3qwa#^y}$>GSc^pZrB!y0dn1pKX&6;K|aAW<BRFA3GT{u(#p_3$bNYd*t4`
zt%-*aXSAZ&-ae7Z`qCDg!0COa-RMf7h=xF7Lein(7ar1M>6dp;UT31U=|0qRPM%O%
z=$iL#)|4}@LK#$w4|PwoG4A4(Zm1#-oh%OII2oz0C`-isjQO#S_{@BvD0OK<*o}uo
zFG7vZiDwNzT536Ak$dg(5xtKpC%Pq!TgtwZ<-l#8?o~Pb!8c+-;?;2#>dTHPJB&|I
z5&NXzwSIjkNN{9e_p5IrrDtXcu6GIXOB~goBJIAf%Xwi^X87`3wqCV*gGXnTn0Xt%
zU2i&0;Qf5;G(}m#Bc6N5Z6qIl`7VF0g^tocJNUZst=LZ_1*xZRx(;0G8clH9CzTjP
zZ?#`Q#gK{^IiwkM<C?<_&M>b6dV?;!t2F$>uNk->pUPGh3t-F&S7oT`skjs$<Y=1H
zjJWGOo@iSz^Ye$Qmzsqnw?U%O5pFJ~lm{M9Z=c-hS<F9`7++#*>2dqP_Y{kelBB~)
zx5~PELtkCa`rI28`LZr)IgF8=^z7**QnUQjbQQkOK?#RwjeJWR2pGvS6)R*btA;1<
zVr1RAuvka*UF_7v+mCyWJ@n@{)Qzf%)x8_<)JmW>^CF1fr0rgc?S8fcj*RB~Jx^{O
zKXl00z=uAfVDZvbAL<Z``HCJs7PhiO)^DEDQe6}jOtc^E{?W&tNa(c#bZ8rk{H-_w
z(6w>$0*({%cM##%1e_PN4`Lv=K5*5~Lk@q%Gjb8L%jj9(G6B6H7Y7?B7Z2YVuqg*I
zEACIgF|u)hu2Iog@0y9Z5i!rYpN39|OGGx;8I%P4=`BkOuqGg}^(~wA%7dJ|z}hS*
z5aHzD*fJCW-R7312Nh-XZkrMFta)Up^58{LrM0?)koV-->^-qf*dMS1QsR>0upM|X
z*bd--Fl-A<6h=s}lW->iA>mF!A|k?F#0Q9hr#Feo_LJ;AKuJbLMM*|ML389JoQ9VE
zFa^cY(?{t~F)%SRQNvj|SQ$A^GBPoOo$MeYA|l>Je2AF%5F-r*4dZ|O5Bm{za2I|*
zp&<T_<1oB~JMa(gz!t*bz&LmASosHA`?muR9~dvuuHD3YfCDlQ!0>k9<Kq$F@7zg1
z037WE{2fMca3|?8P7%UG@_Izat;o1s{33VJUq~+?SEwF8!L5JGbvH2uB^5Qz$x{rB
zOw2sId}sIt1Vt~3iA!9Plu}euR#8<`*DwGc^ELtssob`<xpUXn&i?)bw}<YJJUsma
zo(2X5hlGYjMaRUxjEhf5eElXPGb{V;yPQv-3yZ!Kmwf$JQ(ITx(Af07xwEUg=VxzU
z|G?nH<ka-c?A-jqB6wXpVEC(-1^jpQ!ZuykLEyUZ2ng^Ah`{UGfp-`9;2$K|d5n{g
zR79Rg&+5=|E|*<o7yKgA3wG0UD~yxt->N32IKk6-ass@xl`H#a7v}n3UD^7D{kpDZ
z*k1e{fbj4S!Vs{<m!6C-@U}nObFi%g+d8nV1KT>VtpnRSu&o2zI<Tz++dA+s*Ma@?
z@)KiCGkcy{47Xt}r_hZdXkT5b;9F8g&a36m?7_mm`eMGk#lj9?VI@dKEG#VnInAv;
zQ<Lze1@7O)kK%CyN~&4QEQicZ3*loZ*q1M0VUq?}Sb8+>k2FLS>Wwe(`qVgHEDV*u
za2i=MO@ea*U!3nBFrGrs9f%fd!?3W*4s;Nr$DRm%T4&J>3+pMy!VDyEe`q7c=qiNn
zFPoGj`^GTR@X0?9!q<qd0F%+1KQ)Jio%CIxbHT#)P+}sH3!GS3Q#J07MpU)L8(&>4
zOyjoB!V(tdUySxWkA=BC#=@@TqeHN;VdD+I%qsh%zZbtkrU;~=mw{O`z(~A6ek#Jk
z;&m{Wk+VEF-+B9{<%heQ5Dm{8G0wn6rDI|ARftY~EUb<l3p<5aqS^3cYLRi)Y8XBw
zYlej(kdtaym|s79JRLbmiG>Bgm%VYn+bxqh@XwNLPcty(+td6@wYRnTFQ9R38wXaf
zeH(6Rs;bVJET<%i7|xO~l($VSw4}Q+ysRG3*3lxmm)~;(z~?N~B5Q)wa|Qb&p?68I
zE2mp0C?(l`lb5?R+?+4k*dOKDi%=qFjJo%~@;N73h?s=eVPQjqI?H<-oQ!SVF`|p8
zWhZGY3|O<4T9iJ|$38zbgA9=uBP#=Qt0H1#S9Sm&jwnyY1Hew$7N5P0QJw^3@?tQY
z4?ZxZE<4HO&x4;&Yh(=SY;%WD2OApUHpXqZV}o>)P^tGn>P+$h?zKg3nWCO+UcLV(
zVr&{w3}0rV%NHY4J+^dji!pC?9sh=XJG$tOVPQ`&aafp+0v6VP{msxOncrdcEl5We
zqms~oSYF<CTayns#s5^uzm*fN#(+YG1PueU2mF8<1PL3|7O*4G_*OIp7|u%AvLft1
z3;BD5k0J&O6GdBLVKsh3)AC}s;BO&?`Cr)59qWQGkPIScX4o+g&4e?~iDF^LmgO*c
zu~=ADxlyBj6PlJ1ZMT?T2H2(%|0V;#6#=f%{zW9XQwfUacS`afcev8opJlvl$p65Q
zCw>_+uB@Q%kj!vx5!VJc*dJ~qygvvVf=N*5u(i)-_=hyfWv4YA9uWDwF2*z?`?FG=
zb4Yd|OTGhv=1s)3rc!CAQRGuBEWZj1JB*x;v0o;Wzv@1EYz;Y}QU9B_M2|MQ;1rTg
z5qnb>f(Qsl>EhP#8j=#U1w{-=3z{ep$04}Il@=tW--=!2H!}})xEaUS#ZO*ky9Xm)
z3STn8!lIhrE%u+=2}H++zRMX{SoKXs*3f>#O-}jICQO3H`ET6*GpD?TErY@ZWdhAV
zuI>IZu{D+jY6PSWn>7MgGjM4fWW%6ltb29bvqA^29LVxwoD%IFgaF<Y1QW}=J+ndR
zFEzQVz9BpMkv@n;1tDio##GTcNMHUJw)lmcoN$BtBV-RE0Sjxa%U`5UUL4kh-|xc0
zd=aV(Ze;S8dvSse7huN<Q+8dmX1z5-JQ}rX$(tvT3b3ACYuHN&$PN!AQD7%v2Vmph
zH3T~X8$)IWbpl#4*b(e+EScRcd_it$nPdV;=}AeXRg00AICp{V{#QP>o1|JbL4tOl
zK`br=1ALShrS;fg+)-zuZx9OujF#znCyp#|g$5xfB)k<Cyjg&dpdcar<=~w-rjILm
z=u9gTU6Tx`BEJINjR1Xhd4roy2>w(l!Gwh&BQg9~*ubTkMaHOiB&~RB%K5*rB{{Gr
z*Tq%2YWyXvO26T}?=j}wvQ95B!Q8k83SlN_V-Pc52UkdBpVpuq7nz|>Aee`g1l(>w
zXsDClZPz>Brr0=G2Vowx{jc0IIJKYwh^)Eg&BFeRtkz|L(*W1);v(k;Vg{Y*@6HDM
zvs>2LBeXYe8RI_RjfKV1gGsL*gyjY-z{Q1s;rCxjuioD!y@c13UKP4gs~#7EP*9$@
zFbaul-Q$8b==vLE1U)fm;78Xwg$x{biwp9<1$fsDag!=ygIy;Yj=!nird~MtkFBT|
zaGwsMUVU4r{~swBu8bg1##M@SWx!PgQ23DGH+O(5=ylis$5>e*sBCPbjJf9y{6Vd7
zRqWsJ{XeDGpp4hkiV#>s6M+lbkT-xlHDushZMVc{sB>Je{abJS>F*4AJBC_KWE!p{
zGPg41zl)(DK*qH{Nbt}W*B-aFMVx?atB$}9aA`TDEvrbdflY5pdMN<pT6B$EV~jy+
z{kC$OT5q^xv5{Io2Rtw?=;8)4>oG4L;DK@F1PK_jZctX61^o+naRTQZYc3nw9tAKK
zSJ==<{xR!Xh+gGfR$DloU-8(#jCcLwT)(~1h{L%ofjQm^k|E)NTL_;25=epO{%MVn
zgF?g2l|c>Hg|?<jP$CqxS_souv;ns>j*WK~D;q_AurJV_MvlZ`9-D^VSU2MB2ze#*
zv1Noz@+(3H%@~^Z-wF{lW05rrgaip;Hl!htCP0w8p|j1J@ViEk<p1sl#dUju&FQWm
z|0}63@H&5&?pjNWfa$IqztUYHp#4A}*S~>e&^Wh(<#i?wb_8|;Dh2e>!y(m>Vt`u+
z@3;2J+u5#PGYHKj?)D#LyKrndWX+p`Rs^}@EnP7r7D(105JPTwUCyp+@`YpzHQKBk
z>kV)<47?1m;SNwS)({)HvJ_+!U^||k=0eRa!n=JjPknWwJXxMB7p}R3&F<k}`FmpX
zoyEuvO9<Xm6#tmd@2*>2`?H<~foyCm3Iqxg0%1rCAV#yU4Y)$xY@EMs1nDN!7_#tP
zf1Bz$yq)U$^ZG7;cFhQ_=Bz<0h75AE95={s#kQjUdM66kP$8Rvlme9PhE9&IbpUA+
zbl_hx<nKb{?OYe`TA!^#WSm^rM?lC>He#LPf&lty4Ru8T;Do3a#Fjv~hPX4t*+4l#
zTzNxc1=J4Q4ses(zi+Tjt|5@yYWoL=%(c3zZ|fKtGOFJqD}<<!6>hfwKjHvr!nh5$
zvU$h>tZx4?@mkG<Y~N(uw00AaGC;e8<bEv~SjSXcwE?9Hnjx-$AXR|ybwfkk29R@w
zjQ+P=&2<Z&w&K#az4At_-;~Vx&ypd!Yet4E4(R)4M!W*(Za85Qu6g6i5wcWVb6@w+
zP@Dxd1{GqnQv40`(&XND%75pSH|4EY>=AeBAp^#pdPv~7u>6;XN7v-FS#FyfZ;1qW
zI7a>VOY1kU;=8v-6d(otH*f#ha)B+D)<aV)vWC(iSpu0BE>VI6jJw@Ho^UA}*df#z
zs5Q{%Pb_TxVT?cCWmGENPIzrxwFj;5!by1HuJ0-UrhoIaZ)VKvQ~znr)^HU9QU+Yh
zffNH5wIL3_CH2PT?JJG{&Lf|l+)jnyJQn@eR7lgWREQ;Dt`H`#&>ftt5lFJu{iy3E
z@#?KHvdxX5Mi6P(63}sZHbmucS-p$fpKdaOc1*pUxL#R(Teh<Lc56ExwEy*l4CF3x
zXL$p`0_6!pE#z-O5rJll+i-&{K|9~75!3*3$Qu*^SBvyEtn=CGS+{M6yn5$&Eh^sP
zSvQ<z^;<DzT+)Oqm*2_;vT9rd#iiB1Z3t=uu12h@(jQYH+iB}f55)WxtAVt2WjzLv
zi=qHzJh)c3*-UW-v|_Hfjc{!nR0l}1zXf?*se+9+tHp{B|2uaqw4Jv8o5zxIRtxCj
z%<|TrannsmNJO|>Tq}k!9G7n4e#iCK8x#h&L%hGsTK{EX*8$)<AoTgSZ*f-d{eEE=
zPS$#5^&SM*xW)`k6l7+&vVq*_2B!_l2om__4sZpH`yJ9OT(r1H{O5dTP}%gYO}zRe
z4q3$Q{$KeW=N4n=O1Yseu^PI?2=QuAB2WMWMLtjnwP9@s7y?6Ku*e!0+bVnl?HTL{
z3Yj+O1#TyxZa^LF06JXhOci&TPv6jnN8T>yQEaaV+3--?*0g&4@uvc4R@bO9u2|N?
zVn`%^+J3@`tu~7cGU?4ZmA~Xqpc8B_!iA=6t1S*z$Nr~_aB)p-9frYacf|>XKvO#k
z7(H}yh@e3!kl*qyz27v%<?X+S+MgZrn{CduWhofP(k)8CRN!LuX4kt;i6HSn2S7d!
z^3i{ZjY0ec8-WS|en6#wlmSwLKX&qu<Kyz}QZT<M1p|b~3DCo;1#5Bu{UB(Z5THWd
z8012@pAFvm(^k%O6YPVHH#AyD<TZE~!O@0w*S_tMH_bb)3}EsBmue0DVglse+|^eP
zeW4&JB+3603)45zncfSO!1`#7g%MXpg@3OY&!9`)Gb)apJr#(BoiBx>iR8wkmnfyM
zuopm~hIzU16k^8rB#BorVsrEe-2Kr@hgJ{5;K$9YxRGhO*E1rIFZrRCJz|knT)>my
zJ8IF4n4+5eerlkyhw~vc%LPxi&x219eoiHon8LOF_XaRzNd18g!+QK`F_xr9=N30m
zdD1#<kq{{3^g|Ho25$;eUB*9+96y5il))G^ESw;^K-uaARBx1F!MFq==J%sIC2+4}
ztD%FVmB$_8A4autvbGpi#{*y*5$Qa?#%L@r*5st%KFR)$8Yn{fYrMg@Q<pR?e+RA<
ziGB>uI~(r2|9?28zaKo#aN$ikD^oi53F-E`q5BSNtxvB88P3QzXv{wvIgZfDBgH87
zW~AUHc|As(^zt7~s4tGte?O`<J^p7Z3aH}$Z=+h1^3ph{qBtVoprSZ)D8Kx8#fmU!
zhX2C2Afx*`<Jv+K{%TyS(x2-@eEO{>;9Sr;cKmtH|6gmuFTMReEd0{j-^0R&Imbb+
z4Y2TE&F3%U-w0N?qr#cE4Vr+1zX`0<xx(#+LG51}m{g-<m}Bk??z|fHI6aw_>U})R
zBEXKAXx(sfTafeI-u`;%V0$jM=VDt2wsl}z2ex%!TL-pvU|R>abzoZuwsl}z2ex%!
zTL-pvU|R>abzoZuwsl}z2Uc|ej{Oe4+y1uoEknJV>u<T|2VPWfp>IkIzUBTOzjU61
zi*Nm<^JjpU!?TN8+_1Q%XsKrayqNx?;T;nL!@qmyJTGuw1!DF;ymOv!<p^P6;<XX~
zA9&|HUOxfe_B-eI057G_+<xag-r7QkfA^LJq1bRbqjgUx($;zS(is6X;!7gutvjAv
zDcTWq`(xD^W9$2k<*$C8f2ksnUGwwWjQ@G}$$~hEt{3?eGjUqLi%(wKK5=$bL8&IR
zOh^#TRvb#YGxn7y52NYKAT4Gf(sh$rrDZmab@_zCTeOvDZT9=DckuqX1ErYmhZtqj
zIDWKLvCLj)+Jmt)e!<a~!#o+|1;O<x|L$4;>-FumAT>?VBNn-N-$D4IU4Qg@n%<+?
z2h;t&`rrBa(_GzK`Zni>hO|`45{bzJ_B)3bB24OAgWvcvFQ9}(P8+H|PDqrAXZw0q
zr$MvBLH#aJ(Z#QSpS7yO5mEdmuX?-FtUAfeh_>zp<wT|g{^2qfJ!4hOX|h}eWawV2
z*7LV-BJa`(vWH0deoB!@G~?)|<hY7#RGS6rSMVMoYaPqUFX>aap+fHd2Jd|8zm#V2
zF`v@ILJ_Y|R&~ZUwzy}X#^a(OB8>3yoGiN6V#NbtU!r2aJZneXoi0^M2UfMXYvoUf
zAxZ-=4DuE!1Hmw=u@`+Wt~Vp;J*!mq?oikzRFFz6ZF^0?*3UOVKFs5WzE@DTiSBK*
ze2GZBwMp(Xv1AotIN33Tco(KOb|J!D%rd>z)KXU@p**`rnbi4ZibR^}1Ty(yjm?o@
z=Hf-A4`=(U&3LUatkh}JlE|Kv{Ex$osip|>n?PaV6v3Y)%Us9h#*?1dK9dT}dKPd9
z3%hfX#kZI$!J3&3mDXc&xSOCYR$dGXv!4K7T9tgG`if?|Mk^LpoLdMyy!7@57RDU$
z+9ZX#|3Zu@oAKE+@OCf7pBDc7pZ(j{Ue8@+0VRGf1}i?2lr_M;9pw!>WoXQn1`gse
z=~7M1AmWZl9#t)NM$G4@*#^zZrMH$E8u?S|6+Up1Xj^0xewpRQl4^36zO2xoH&Kwv
zcuLZ|CBtBF=KZA3SuMEX*DkH&XP6rkFJT6`Ny>=REmBOfVRovou1)W4k?XNbt56?J
zWjnzockXqG{hN0N3t_o>T}O=MikmW}o6cj%LR~THMJ8XRD;F22mM#~Wl@t9eJvl#x
zC|S~xI++~U^fNRhVDOgdPe-?xXr&3Q$9NV7Z}Bs#NqXNRQf%yvioInIP%O#%=%{!q
z<VO=?Y(6|^I8~co@L;ih{{zN~;4{op6aIIzHKl`Z4=}TQnXdF%JY6I<l3V|7RD<L5
zl!DxV*7eW{iBFB)J@u?lB3wF388AyN(tf$&<ycrog2a6KQz!kAxtPYTyJRX(sc-bG
zJ;$#`Cs`ZzI2(ArKV1D4lX?+3r$!@7>eJusbB08#Iq+gffM|b|XFxpe!w5{&$`7gV
zgm#s)lI@PE57m&~qs|$kgnT~<D59g49HDTz!`%Z%$Swiq`!Xu2S=#KmLaC*{V|zJ6
zn=xkQx+FzhazV`~t*?oGG3LHX^aSg)EhWt@$-!!Amj#+=F@|q*p6L8z$%i}9%(cFi
z&#*9Q1wMlbtzh(r&o<_W+!Kz@f%Y9&YuR9&?Vq^6x9FjLSVH1sT&ee8^PpM`q)xCN
z$n&O%^^MECRNBCb$UTefiL>`gjr6<EG`io!tfJu)RZ|AxC7q?}cLd5IeRV&&Iuudx
z>AKwr#Vh?{BkZ}z&p~hYDj_^BU}2s9$VJs-ZPiyD?MKrn7fVJM<Oc!`mYM6EnOU$f
zxW>&-$i`EoNH^)vl`r$T8mvT+6kNW^T6xo9XxT8&BKN{YB`@+mW7N{?V^oU~fw2}&
zX19S?GR<*(b2?bS`#eDwK`Ll`o$9J+CbM6_q$w6=r4M+Vv;Vif4Rcl;(|wuufzH!b
zXG!7-YNbXCmBQkP&b(F?zOelAoEBSJmrJY&(-Q03{Xgj9<|TdzTO>7lHi}J<-g!Im
zC2RDSSSiDge8%OSw=)|RyG*Rl-N@R{Z!D!l7R)^pl(slbrug&9Yc8LA-C>3o8WnT<
zhao(Zwy+Y)h%n5k0VLP%?TIQ=718TXJEYeAwZS}Of9*kb%!7Tmm6VyJ&T<nsY4A=b
z?POO%_1fPForo^Xa#69)d@C|sf)w?w$!TNn?z)CF9=Odos&5l8eGD0Hdy?F_LCZz}
z@%q&S=13=onkTPkWFD?KfTD5ayhA2q*)ZxLP0K#G1D;~jY~;;z<g$xVf~J(*wLmq@
z`M&8i&-mzOv9SY-5y#=5Q?am-9@NioSlFS_`LUZZ)ap-=AFR-WmLk+d$Ma}kHD=yC
zi&w0en~gtj5PA>&#&aN}!&93%UDvri7-oIwVt$z}CS#1Kjd*_Ef=aIXEoPtelyH7j
zo>{H%*}<xN>>2a1Gn`VY)4KJICa5FRcAhCCDF8@Z)^qROkCbvu7_Q2DuK+KKJ~?2*
zUXVRcS1x9mV^oA7?&!WAXF)AQ;QJGWc4W1ouy04%(d6cqnaAZk_bs!McoTe)H%yP+
zL=ISvxZ;cadE(={!<hEd`%x`%@SYS^IjhHCceU!SHn<x1%Gwg%mBsm9ksxI3Q}zE+
z|79;DqKy_As2&v-pvg_sWXfBgSRh@`u<%4|?<<4h>|o3I{-k3q3(E1Ctk+52+mQi_
zH%kw|<9kEJ&hX9E^{U^bLK2T-VS8ip2}b5AqbE+HZ4V7hNCWthJuQ$VKc8BO(LVY<
z8$aosolcpG5IGx9`^3^?rF13G^8;`D{Kh^hkMyW*8EV%0Sa!F{cdnwc&$C)Wo$?mf
z>&5$iR}ViCJ67gL4_A0mcl;B%{`i<17M4r<L`*bVX1E!REXnjJ{@mro(BF#OBR#d^
z{{7113jniT4F7@{NIikEF%`P4_6R*>BIv81jC_$`>s%w2TqBQR-OVm7>AW8cb7`u+
z`g;B)@Iafdx1iFI53f&PqF(wI@p<2yJS~fKy{IeEm_4L0K0_(@UZ<o+pknuXsW|re
z0HFS)Uv;(mmBECwH(fRDG*b`Whga2g+zePsSfKe@ltSGho6O8+%+nYYyU2nVd5yF|
z&`Y#j!wfo$`$a~I87*hYjmGsDFWo@3$(2+Qx{;%1zaw%`e$lIko~I#GL9QMiytaq3
zKM}s#y<FDU<vO%C%vfF>cm?0e8HHOI<`gG+cKoBBl}T1RSnCd!|DO!U_aB_x#CdHv
z&YqR4S6H)ly?D#yq8ldT9(%RY+Tfj5rvx};Z7yQhW@qR63`(y~(u+OQzrBV(p8K~Q
zuZiX!591#uS!eCib)w=|$7=GIX*V4PJfB)OL(M%n&LVj5v50^CQOe9;z#D|mj4@zb
zO-B?OfS1(oiAOemKrQZ0ikqN+MvEC!M6*vKgwFx*O{I@`54<Dx4YL3GtD)P)@JWFo
z)XdTu;BBJ&a~LML-FITf<j^dWC*ERVSFtb+pIFrL?PXIz`qzSS6P%2(QK82HU{C{G
zT&!LzKr2pD0?|RBYo{2Qye{zV$)^}syPG|vA}od7(e&hqkof)=GN+O&d_EV`olGzG
zOKy90grL0F7meht8$eNikhxB7M3KEqNcjmC)*T0rwF@VYO5&~Sj8K2@tk=56spid6
zedw5=QE|ojI_q~zcR4SmEgs0P$SLRUR()uG?@-w+fZK=IC-)*W7EC>z8*_9TBjMj$
z^FJl=qZjh0GwDZIxxZlGb)Ju9q?*Nrf|MC1i4d{oCufqpJgP`$eLDJdb~SiE%uXC=
zS|W_LGbb{BX$XJ9v+!f?!YqH2BQHI>S_Wns@D#UPsjeN6h>uP4&FJvJFsB>RUpeGb
zB}0m;gCR8r0W#NIcvweGl+QjS7O3$bX&&9`fEbz}v3TrWEWS!a6nuM~SjB9!LMOT<
zgH1a$w9Y$(yA*?vK4e|#nMa=gQA>8$*AW&fENq%1V}bVjOZE{OE6nMWaJBbNgF_Q%
zzp-$YYSpG0kZNj49FG{hOHy`CdA`q6^wCdoVHcN}&XYNO(LSG5?!?KT8BCial@}vt
z*Z|@R2X+;}eC;(D3DcrkBn@tK6OzG4z4N~XvPK+x?2r_%y5s@kwkLCLOxC-ibJ@Gk
zlnulz#Tv~eaVFhPD7?iM^{o1u7bChcEYQZGu1k}#hv9?5P5kk5wTv;X+7mjBFHVz1
zqM6_LF6RP_HFk<ZRXYnl6#35mh<f*eL>IS;ZvBl@1hK70Nyf4O$S#lXdB}ul5ci(B
zVyY!*0We2j_s<GkGv287@cc=|Xa#Cfrk!#Z1ZgyW3K!tz&40eQ97^RX9LTktb$UVY
z!Ge%u6@b-j543BR8qoq~@W<{Gj5=s8xp9BrUh521;hcwYboi{v-vpnN1C;MtLz~>9
z%!B^?>8}smftc=Gjyk$jJ(nD<_Dwkbrqe_YS|*W&mA3`o<wVLJ)DOR1^oz><<|%!;
zM<bYMsXy^EOveW@6<b@&mstk3B`803N==(HzihIPDTX(+nJFfg=P4{><3lnl4{H#5
z?puB39t|VUx;?{;UsSJG%ia-nUkrxlxswbQk&yxXA7)?O?5lBh<>1u=fj`2?6HEXP
zHGpww&@$CP7Uv)%rgyNC$zRg@PhbK%b}P6*Vqw~o$o^BQs6w9`7E8Hu<M}1%`H5n*
zkNw!PGa%2%u+J&^hmj?H0R3qk?f_nFDAkWDtT;@$l!+KmD+#igNtt=69}~Q6;AHZ&
z`?a9a1Sh9Blkv-AoRYFp_h`k~7>i&hPo5>af^Qrfb&u3jg9-Ljp$5Fn72pVT2Ol+i
zbrpaVl|622SBBpicIogru5;#sT%3g2!{^Mpr1v_Z)IS`xCe05+oGQPaq09v2ADBDi
z8&%fWpi1aOaN(?;ih<d!=+quY<U|e8fR=ga#DojJd`%4gJ5MoWl^e#UlT3L@-KMSw
z^X)TxXB^4+*R+DO&O~+gMqeuTX~Eb|_<yf7(bro{?Obfsd}%xMx!F(NB%%2|yi;8X
zRVuK|(zVDq>jCh=KwIQ~08X?0k^XWM!lOQz29dyU7#3#s6Jw*N#_{cmM10!A)4bkt
zvc*ljd*17w72{?^yQBul&Ohr)qPS`*Y^&{RT%Ugxf3Y_AOq(;JhkbV5JQDHD7YjSN
zfYO)O;T}L8u?gW|Pu4}%711+b+;Vc-xVtMtPu1tY$#Hw1^|5=30AAyxmK(#Ks_Z^t
z{MBAVdi*Y$#4PIV5$>*HH;WQ{g@?zHeF>aE`bC$dA?F$VfJtz*2djB^pq#bt=P7Ek
z<>xspuH_s_l9j<|N$~ZKm+GUUd~C1r`zRUoQz>Qc<9*jc{3QO}i`o@psD?`n0Z5@H
z*Oq26A*2C_-aRiQbGjJssjTa~meWZr%AWpHk{H8lnVfqyueN^7Z<E~L@$IFix2&+r
zsKCAc*B4>vOT8$F7VcW5h0l=yEhN#>SVYV;$V=JvGTm`m=zXbmXGh_<mZ(p1^-qZ|
z=1g){kulQx!^()xM&#_|V;z5_N9_KTxN;QRC>tX04zgb@DPHvD^sy(?dL^lME*S(Y
zUo)P^Oy0lZ<k~7ctw=k2O`lU?K+%COA3n*d&pF<90eJ?Fk(&}sWC;_o+g%303y_L@
z8?aE9fK2!TLl}lis2oj#mwE=fkDO2_>w|Yy`A=sA{}`J;vXk61tkv_jRb1KQA==#}
zKZ|7O-s_$xEg2WU?5018d9IX0epaVer=;45ACWDrGr<77pPpX9)0OtUNr{^IF~3I@
z<OPU8S@HcOgg_RkV$nuV`L?3J*;mlHir<5fVg)6jKxrLRKuLhW0%Lq3e}4CnwB(TV
zd7_jf@iWnxztHCj<BKahG=fkQqo}@I!-m*6v_ss&*m=@wF|vnHkN?S*Tv`(-R>~F$
z0Y*Km1?GH?`?AAV;DNHR93-hgI%;$V@d;oWQ!QUQCI!s$XO<BFzo5wa0Hn<5gFyNL
zyhyhHdb(K@@(}+k<mfaO_9_3k9kSs}L#Tq}T+7hqBK~0?5A<azCga2tz<*v4R!fV)
zPLgF@!ISsYkUD>gv51vy?_~x3a4{I4r_CwG9gML>RKQWPMJLw|la{;$kd&y8z@@S5
zU!f;&f$2&H>B?g;rg=y<ALGwJa_BXG|2Io9E>D8`X(J%sL>z1~7;Y}_B@*+O;~*(`
z%@SWL%xN1@vNLeRTs3bEP_!+?j1$Xk_!A9*Bxh)?>S!RUJyWRh^8CV4X5J&L<ANcv
z`%oWU&_l_!!e?yFdv@HKY~k!b>EVvK|5mlMPH{FZ5#TAPSySKf#0tdh+!;(@nN#>n
z+qutS9`a_18UW6arXo-GO{dJKja;KvuZ53Tp@%w|-|Hor3fjSS^WSG-VX53)NP3BL
zbp6_&X-OVN1t;4q)#~`oNxgpijYDq`NR@PlBf3;Qlch%L%D&|iR3|yVtsDYVOtqTX
z^dng+Q@)GWhf#|ZopP-X9J5U&j@F7mRF*Hvh%u^FQhhXlqRSY-OIh}=V{LOy@+~_6
z@RW?o$J*q1N0G)w2ZdtGY_YJsd+-!t>EWvU3_W<)C;6GjNH6pJLsg8)&qxlM+?^Q9
z_~5BLBfcNOTW(xzwf6x*5TCHiLlb^Ub8i!a@yzgqI+@v={I++1CsVKiK!4pS?j*qD
zFpj#%^40L>(PNRaPJ|=_mx3a$6y+9`?OAT>IZE?JOd;W9T~~ybTl_*euk-AirG{t<
zCn?0cJN_;JNg*loF}+rA(OnsCwD<eKPswa}gvnEdn?harX(Fc&xkIxaT&AXV=fL@}
z=0SS&WkqJhL6sNv84DHk?;j8L8DZQ!%U?>8-7+ZihQr&b6D(gYs%1<}V}Lsg^U-M?
z6v02NIde)}x^?^Qxt@F4+<N(`!+GX{Z&UO^Prsc#S3k#JHHsUvI*Rs|j-<@Uo7O1S
z??g)h-0-1J%u^&Hw3db?LV85@ST^4q-!Z{Ji(1cc-giKZ8)Gt==ri&57IHtcHl5aK
zjA3%SKjt(8TrGRPIMn%6J$X>rj5|8h?x=a`>1&4;t|>QJu)aJhYPBc5Kk)~uH05G~
z?AhojAHxU93nuleG(}E~=>C1N>vvp0ssWk$3WyLhl3l^Guc@)GsoF6lVJc)ivLb?2
zv;qDIQ(1!xbsLC)R1svziyhk_EL_3;>HEgOBy$svfW*USjd;vXWTSmF#+H$CAn_<l
zNux!U`~-;yfE0@y4XoC3T}Bin%k8Ln)gCouo^wV>9HN~kP<~$i1LhO}2q!sr1Kgts
zz=o>;Fp9B~!Ja-Hl!9HBm-Ymq0^}p$K85N_1W`f$_x3922YCX2_0(XbYL)*_=?d_~
zG}B7`5^M8`x3=H?+%LotsQh&IIwz**`^Jp&#eUC8O8I#{G2Lnz$>Qq<sw7gcGu0C8
zV=BdJg*j}a%69ron+1;Lak*n*hv^qowO%?phD&*iO5fO@LKgXE{s1D})^H_z#gB!(
zepNbe@)^xqJTAljaS?fWzO%D5g3YU;5DTkRdjwQ%xT~u9(((Lwdvu1TX;5-GTG;gd
z0x8LW4t2F$Gs6ebLFG=g;25S|GVLp(a4C!RLXG^>aLz$nfUO+Sy5&Vh_oFwDBE6n{
zdg>YNP!jM^?`6Yl81Wn#M3)4BB*XPIhDTnCA?v(W5?BCTVKL~eIkW`4Ve~89pjwA>
z0ChOC<(6=Z(M?N4)13=Qq0iH)Z!XWz=ys}LJ`GZgDxJPRMSx^>On11Xb2Wve>q_vq
z8lC(3KOEf1`+yu)C2_|AL<aqXh$yY<Zp<RgIkVmbbE3wEpu@yrZ_*GgFhf<6(cep7
zMlL6~=^TECEPRffj`8+nW*pUhaxXw!a^&sx*m%H;egnLy_VWO34M0ytUVv^A`q0_e
zk*c?p?C)2Mh}jD-Q<_#(Ff(AzU}{iFAV1lgsv<3NpeSRG;>XNEsq?&C<q6{ArA2-c
zV*Z?!bv`E3inlGCoMe@Q^t#bJofwMl`BP7R)?3sH-;5#ciwit<71^PlP^<MwSI*3a
z_U^GWjA#)|poVAAi#ZR|ho|75)7T{$GZz@<!#K=n97i6FcEiWe_W@pCq~&=r5WjG+
zAL$`0cDqL0fA1yF?&ZiZmy9L-mIn@M*36fRq+?gpSFt)AaXAk#^T<gfWwG1L*;cm+
zBP~fRI2P_X6UIunDID{jtz83@V9^XeGwuYCtV~^ftrL!g;YaeQ93N6-UtAVGADtv|
z^p^8|&rseW_`;2vmWWSkB@C10(x2=4(*_dE1PYelO(H!2og0v(iSkU@H<DbqD^>4~
z5E*~v&xVu(A_Y{u0grw9$6__Y4a;RE(-^GsRstAr(FUJ7Ac$Eh34$+12$WJIyTS-d
zk(QgElbdRPJ)}^J5voPcz1VFW<tYld<IS~0{{DAt3KmvEc?AngvqMZDQZ)_A#=?$j
ziDGhl00oiJLU<f*s+_Y&bt3&1hPvez4%>7rVqqvOOq|z1rP3SGW7UWp!XTHa>b<oN
z&4(60zz_&g_Gp;D^nY$2CKZonY(^d;^$+*tRJzm*a1Q_?JYhG<R`3G|TlPvx*{qQa
z1;uy}V>Ccai6(>nI+&GporZ`VB@KYuGEzMaiIYFSFDhKp6DGxECC<1bLor=)4WSfj
z6u{yOuXX|u4Kg#9ou7a#i!Ml8z<f&#N38fY-I5|T>!UwBr5GuCf4V>ZAfo5{dWbSH
zIw~W!&Uv4omT>5VLlK`S32$b}Sg%+HYUxLc-A{7Un1-^hgrH95JQGFLF*8K2sl&t2
ziP4{T0F*fapv;TDae6S&akLsAso2?wGL=J51JAt=zfbCAX3k9-48VK<p22@(0Pj?K
zjvN`nkoHP^7c?qF>@z)fktR0b4hGIEg7zSqPW3q=UZYDa`<7nd97#pqp(GW-z?u8z
z=^x%@3BUUG743a^+#%9QhnB=Oan*<B(~o9YKQW|Mv%eo^<9IU;EjA$&)E1WPA3q{^
z8kIo3Y?f3j%s({S<Mg_r`3K1;_c27M-lF0hU71iS7yQUc_VLnbAl!En60-$jywR`s
zXda?&AEFziIFC@qC^rnCDA6qTO0+$0zVeLMihDU1YkTs__biEXVps)=8(1-%y*eKK
z87geyT~74!G7WdD$`Aw3R!}D8Vvg%&f-o+*o2@mL{%tf0WgMA0r<qSJY3Yo%0_zGA
z{&JUR*NKemfU}X8L0qW_2{Hq4q>*A_=;tMI(|U5LTUxS$p?4^vdjkQs(m2+tUm9P0
zFF3N!TAiK<STylcM)itUui2$jbbgl<7l2&(soFO7p{hWa9t^p9F{a&OJeceBshoQ|
ztV{r8VUB$2j94~J-=7{=b|<z~7YIO~7I#^xPk*PEBs?Le*Z-N9jjThOA}?32Gcgv!
zI5bz3R?>gm@084VP6?`A(N8v2d3x!(Zu=FLBgFoQKp}-*`Vfmzk>L|Je*h>_{kU1j
z#f;X=y;w{d&9!_YxYxSZv(Ifbf$FH_O<{);H#yANqRTmT1DJd{ClE$%Ebo;5TpBIc
z2eOst$j7^(xy?SG9MhQmZmO&S<EmCt`7<ng-*QaL#k(Bo=8r!ZO%BO3EBf@e2N~T@
zUeHrHGh%~$f2)2izcCXea>Q&6Dv~RDq{YY-pb|0bU=D%$pSH>y!jtz(nUxE89RQP9
zPmWTrB}auEffNh94;Y<H0ny2qWYg~xacCbwfQ3|IVbL_{Nno@xj`|qapMSi=p2;}L
z_mj8bN=`KX0)PZD_{Km`0t<;L67&L+9B~R)@Dvo&K@(T#0<9eYk{EEOyfgp_{^4Ty
zU{2%(K{Q#0{z`ge6=wi&S&3#=QY2v8>R;%v1B`lLAwY{OoEeJoU{D0m878JCT<nno
zlCU6x+ygTyM*swgDgZJoOsfb2z{?J0&sT;g4p#YaYO2t&G)|-U$Y?K+St~LbqJ6~l
z<z*yOyb`P8)HPxhwN3k802bt^Z1A~Nv(*Q4O;ZwJ{KOzm*uR%aiZ^k%2i&w-rb22=
z&@eA2FTQ`S^Ic6D%|D5BdyA2wAIRnI4t5{iMQLUQgne4a5arTH<{_TSNA1*gc#n9c
zwMNjVloc2F0CI9zewCc?0_nrah1ipTi$vKJBz&*f;bVQ&>wcB9ji~^sNJyKSeL}e-
zgAvkBe<?Y2l(nUSiJGL}Ec(^Fd)KqWyJk!b<(qBPx#wRo%*2%wf!P#*o}dF(=n2ZO
zT8DiAMT-`>p*nJ>A)A<gLH!A;4!Bteq>_I|!+7@z_MQ@|y>ZVu2_66Qar1@6He)2|
zgFG4Dg}8aT0WrHTp%d<(8e>JZlTX`wC<nkjsFux=YaJD%O-1=st1cr3o_hk^bT<!>
zO)-TxhZv$IZ((7p?vvJ9iL<TctM?mm$^J997nJH*dEb4P%@j<W?g^V*SzWV%qA0PO
zS)7s<rDjNIDVGuBX>O{BrLj>?6yxnpRrV>@>updUsZ3Tl7?!!OA>jsIK|J@-{?}h<
zXNJVcWp9q9rN$jE<*3FSwnKbsMNS7jwz9pi{CL?WCAqtXj}fVn3HOYqqEw-jkN63*
zM9{G?dp=xYC%}EpH1;sB;2u<$^__P5n$-RE?=PBnomYf=bY;p1)^Twdo^#zVl1g!@
zM#STwnmtFkgn2LpDK*d6=0ndzzLwpbfj7ifKggrBP-tMM71i)lrkrzXoZ|xm{f~Yf
z)oP1$@917QdeoNW$_G7)ply@0Z%Q>OC}@_5dstXoq&WLDys-;)JzMT8z}OVb0sUPM
zRQ~jxTmrZw_=FV;Ted_l6Vwkz12IAgDHeu#ivaF~3;^k+FId=nAgbDf_N|lyGV3L6
zsmPTef-~uOCK}+k^mhR6u#%4WlI+<ZTv&0AVf+|i;6GXMU&MkI4&*VJnCe1S(-13E
zK#IwP5f&30<>CPb5g`COIKRRHz;q{=f{1|_!?1!rnCJvev<@fj+00b;bgvXAn9w*W
z=>OLvR*ruPMki~g9}=gauwwf_#$(0oWn+qfEXUgwv#(n}^5oG26JOJm#w9)vX@(yf
zv7f$0J$l|aT9sK}PSK~Y{ayaUJX%a!gIf`B=ejVj%;Q9*B<*XYqV~J4a(faI<0<X(
z`%DYEkC3#paH)~c^4{T6&kpk^*5t&=-Tvx)%oZszKK-g7uI;My9W0Ey@TZ!1Ue69!
zCl;TCvDCi&4`G9oq9+TJ)tdmS<tB19@UY>ju4JEYCSRB&+aB5u$yyt?-0)O>wVz6N
zk_#b~jmP?2(nj!M;6q&xclcO#_KPv)6L<W@?Wo?QmmX@Zd)pK<$_IGaSEFR|vTEO>
z?O+RvJA4~sDRhCo023l`-34G6K!fnFe=edKMY)(Hb%;ktEtIKZ7S5^4ymZu@Q1+lr
z)qMw_ZaA8scrz8xGgHCrx|LGtt4tl9fuy<D`5o^@!i<WaHGN9Kgd7G)P)D^3#s;7a
zM|k$Q?(DhC*Z#iigtMvUf@)cvvV&^<DZ}MwyMS6iw|$pCbab*A&cpQwP^6BW@jEAN
zq_6ZvWkkyLG$CTGvle5Y4$`nZFr+^^i(XXyl&N1cJNR|(duydRCjHVC%+uQiqxT2r
zOB~6S@{8aNtj-c`ekJ~UzYKQQ%bLtg1iBZ($<%cvk}8k;)Vc*D9^-)&=#1^druZD!
zhE9n&>0^ilcr3zdhBEWZ=kAzT47IaAuznya>H`Cif4U*gdxWo-%i)X4dBijgaAV2K
znc_opn(a}8I;rFkw3TlI>g251;tb`itM7yfkb4?JdfE96@TgEc>nf*I0PbkBUTC*i
z>^q*1ag{NXxNC8g_PVS+o+Xl5_Ia?Vl${Sn^iOXw=f=iS`+#Z*4QAPofJ*^cD<175
z$MRG!gD~zK0U~AIdfU57n3~tZmMwR8f9G;oT;6xvI!G}bp^^3Ouo&m$DYQNO^P-~F
ztl!U}svpUiICcH*H?PA+BRsW%(p5DU-;dOj$zNrt0vy?|oY0@X%Qqr>_5k-VuEMb}
z5nlWFq5MgLd>}_gvYwO7AFW@_N!ETrOr9}Af;mYq(~=bA3Mv2r1q2H@CnvalccXXN
zvzL6xw^pb^St~R=nU{~joC5NX%A{*_KkCW8B7oKtuI41ASNQx|sIU<qz$C*eD1d$&
z-%4!t76@Rwz+b?)0?cUwSg_u2A;c13r*Ls&Q>XwoTFYes5VM{URUGN`@9JVadSObc
z;Go1U*`0j3dph?&V#^e;(R345j&Grid@_T$hq199$nlpKw=re5x@8n&t10pLeAUfl
zkt@{+b}^W#2z77U#zOc(_<<oWeS_IO3I^G9c_}lz{T<}IQ?bSuzO~J^b-0ESJ@tKu
zwpaDI2ZLGewCNf=5y&{~bNL8gOA>2SplJo;C*JZBLaGY#-N1e1j<&_Syhk$johzjY
zygGB8pZIKmTyBU|>EWxIg?wK)eT3xRrJigZweJ@_mv*l5bR1hT1DaXz4io1keQ<V8
zs=H%E8j)iX=yKI0d6M}c0Qd7Lr+BJD6+AV<+G`x#*vYPa5iBWWX0P{w4W6yZEOs~`
zuPT%K{PfPEmdg$)i9I$0?_P1w(}m2%Xg<62EoAs$$rr~3b(d}ey*uOfKHYWIrL9-n
zJgu*%I^}-+)S?bEm~3(i-QU^t{QeX&gTv%Ret5%yPaW1*SsvSdKG<K#UXF#~m9r_G
zeH}|~?{x9%jy^TDQOvZw-3ctLgMg$a>e2T%&dcWXbm`<boQdESKH6pMZRGJu!4wU#
z-CDvUeMa3ksvb$9QoHg~MC@+z1{SyuoO>rR?oZMqQV`Qs#dJzcj7-T3U~z=7A3c_4
z+Mf$^+EFe>Njev!qdY>=dSqFSdzxgXhfDDcrfT@f*d;~Wj|N~*{P~Y^t9{LPNyW+h
zW-dFwOVb%Y^M#fDYS3A&^Rz5qew==w=Npv`Ti#F7kf#%sp{&zf_ajJEil#Fkfc5v;
z6=xAS%VEOPo)?2SCSDl|6$$5A&Yzj!a*%$@bJN`5gu;O*vVG5I#StZ#BZ5xUWFDtY
zC!Tz3y)P@T((6;Cm(KMx{Qsfst;3@FyS?F2P!tsuL7G9p07P1v5s@zG6r{U5M?oZ{
zI|QVpLApVtL+S34?jB~w_dDqCKKFgz>pahS{@`*3_BG7N-fMkot&Q6?OguH}xIAr@
z9GY&O7RVsmmpc*R8pDn+GJR&RVn#lDdXR#yuH4V{DU0N>?Ne-43aYS$hfk@=94C^S
z_Fh#R{taPGNX{{V?_c=}NWKej#P6t@2bv9-9I=$zr(c(Hid_P*KmtRJ|F2{~nbIBo
zJoY!_2xNSKSdbf155xi~fYm_q_97pV9!rVdy2wZHBf)7!t6lylAJLYdFtTTj40ap6
zFhJAEO3c%A?((oSe)CI124kQ5tVsomqZd&0M;U^IS{U6?gW>&yhktr~E4aR+*8jO^
z{{tC3=OR?hxsV~>1xWm9<$r4cC?-)Cp9j<XTQIT%pabrW-y7d2;0Jk;br$HzxL*An
zAzeEkxqSaQ?J~bomn3gVI`Ja|7fzCl;L5gw^-EcbbbnF81;F4V{BP{y0mdIuxPT<A
zWf+KYA(Z~>ExiTQ<gXw>Q(BXDxu+e1moeHeNIXdVau=1EsC!eQMiJe=9Duaf7TIl=
zL=WsqD{%Lyn6DI{U|T}tiPm%oIN_T`H>R#lTDFdE(;~h0kR>p(o$r~~c=HeT?Cd|8
z(sm$?^C|6HoSpRrpIbk@v+DEiY=rVL2}J2wp01MN!K1EMulGhxmKLfs?VLSjm!gPb
zU#L!-8r=0wn6t9l%o%exI5@@E$W)k;G)`JJ#MN3cSxx^66>1fe2*!xLAHW|0)Z)C6
zR}!}R_Jr58h3Sm3`tC*^o@84xCCrER&<41=lGvmpJ+Hiun8yosyp={WcR+hnqPu%E
zMlfYFM6g``wOR&(rV+uEx@fuljS{{bSc(1#yML5>!o{u?z9Qa}ccPkB<b@+Ngf>b~
zi*5@8+E45K01Tu1!^#-k&2zT&Vi;XDxHEr4)Je{Zj)-m%T9C)Gn>w`Lx5%Ws6x>Ec
zvXoMH*84?lAa6>u+iL!yOvc;hFgyGgtnx$0qs+J@{sfxE-7lsJZG*o#S-^=k+*max
ziPm;Yp1kcy984u`LWH^%Gu23ja>o1$zGNKGaHv0u0>8~X^mA@h!q*+Up_r69-!#kP
zL2+6MK5y|3-Las<ogo7yF4i+*cHyKMt)TdJEdq9gaxlYu!A|P;eE;p-y~b(X@Kc{v
zF`AV8N&lTfL*Je-3I0U2ITpSUVZ0WvdXr_D*SK4JY`%mF$v$hZ`d{GTiFm5+a<v98
zKyT%9*;&<B2r9i#R(sd%MSFC$L8(X<m2xCnyqBkWkA^W@R_t8d4u84vpn#sQL3<@J
zzR396Ld@Yb$W%^eG;Db)2<8B`N;&^Z2j2eaH)I>StT;sc8?v_yJO7Xi1>R!em|5s~
z(LSHRUG(z`5P5>4y&1NY`bVuI4I09zL9AXxvydJsefZUE%+0*hO9&LvBoH$ASNP(8
ze5~ZSb9Pw=-~b$qh^U>*dxCt&{2Q_X1X@fiqAf(r`Mmrh7IE<3s)A-~<38tx4kkqv
zWY$?2;32&P+|SEYANM)*enV6mB|V=(kE9N>M!ufP+n>f^tcbLi7ihpFOCEp&aH0OI
z)xQh4xE?Riz@PU2S2OrGvcM`4=tPf+Py8(smV{M6E@-GnC2^lV;sM5WEUc?RxTpwj
z93ps48a`QrR*trQKjGKnu?&Kj^RWR)%gh_oxC1z)Vz<jmWwWu~7>87mk}fuq7BCYa
z$@Uuk3Le$g3@H2>fM`hMuc$+)YV9aMSL57jEQt!n`OY}5NFK4RLb?`Crg{fw>wf+Z
zQ&-De6DI}IG?NHT^<-uye_E%J>69;GBe5KlruZ?}A0m?Rl)XPNG>Lc6*_bk}7u_7!
zlsbPb%+y*&&`lN1$5^Kun6%UJD7Dae9@_jHa?2%jE^4B%=nLIM6wJ(^3J*}0#}C{n
zC_L%UMa+wNWsk*v4k;m|uOg1Wk5vrXbI9LobJ}@RjWX|Rc<RAebLwbqXfK#~WvhNF
zm@N85P{z%rkdy+G3E4J}!cqQ-z^yW<uNTK?S$K}A+s%CqmRqC|F9R|t_EX0QxY24G
zT08z8u)I^dWv242XB%=!LnRNsTh8DpWTiqSpC-Ru82O@kD{cyRB|Mp3#4~T64|-F0
z*SvYcFYrm(f#KD7EE)dYs}s1{o!q?&j0AGNfHfc;LeS)O6%x;<ex%RPvi*kC`Po4I
ziDJuN%NG@UlI}ks8biwN-pd4kpVykVL}J`sqdF}e0$+4hFX@-!Ev~weEpEKr$z?Om
zGI~hQDw|H&@(*4F+7Tb&Uk(Vm$zK(T-XsG^L^&*SUA&R+jyNuD!me@5mb!Rpu8_EQ
z3hJB?ze7ZxsWR=^D{^^JhqP**I7xWpoJ?Y)<B)knhyHiPcTpKnpFJqAdMd!(iIONv
zDc7uM9NONYSk8*hSeg1&y9ce!Br{I&LoJ&s8A>bXmyucFbXg@vPNf|qjIZXklS|Qv
z`aInv^psH>N^x8)v@5=Z`>yZGBGx2NAyN6yllnk#`iko*<-TFS%1Es(`O1U5hAyWh
z`F!0Yn|xc#@;Lk&T0O_oVa>|uI$>BeMXeu+(7KpLE>XO9Zj7D{WL+*(vyNtlx%g#M
z^({X91^71V3a3>@?I8iO;U0&#xMk$_2L&$Z4%8mu@TC=W{Ja#z2J|RfKSsQ9xMK~y
zaYy6T>&9b|LCJ7wk0oeb5Y<e*X@MGFhC#n7|G6qC*~VpvW_q3eO8Mon#_432P!vZH
z3$h8?742siP2{}E*Elq-(Ye*A3rf!0FAXV9AFC!MRnI%PKrBz*h@vA$gnn*r*Yj}>
z2`1)rSr6kaUPyPBTXqOP(#dwxe9EJz4oxL8X{TH;!d5Gk7c^<VtmQ1!M*+vLr1+#P
zd5J+tL5RYen<hcepn?{~I|UyUK|9jQ>NV7KFx`w`31>g~u!umARljMRAnxOR%S=?s
z4c(s{dWYJ1#XDlq?l8cmRSYW-2&**wF!;;pmR0D3TKaH9+8bq#o&1;ihEzu)#=DAt
z(oU(`&@*&oxOr!Uj(n-Ltaui)S`}3EX$9@ZBOrHP&k%X@3PP!Cgu?29lMW7$MsM7e
zXh%KkMIqc4&C5=C+4pWp3w~rq2bw+p4IvQBo(I5q3XE5H>qH7R17^tgB5$2v?FV`-
zk4ROK`)lHwvfP3g)tjyNxd3l6cP7mwv+7z1(C92Nw2Bz9nnDgm(8^3U-A?X=L^-Xl
z)Sw%X0Zr)tP6J<!g4iq01qVD+Mx+)2u?J+effBS2GO$I8|A0K>mDs?>C6f`@#=bS`
zCWzCW=AlJ{_0f$FLD~OdsQR+f_$l!z%b`wq7Cs^qp}6)Ho+FnjSmF2G4;By*2--ZG
zDA0I-07LROa`NYzy9&e{K<7v>=5iqYkiw-4a1}^z`-j?rv!MUN`1zyh01YS(T&l6a
zepkSNLB@^Q@q^HJB~bUG4W0X=gF4v!mh<&o^ZW_VQuD_r)?KOvU-o`Y8lUub;W^IF
zEpnLnSQgAY?w~){3X)1$0RY-6sCEGp2gJherXfiiU#!#J{VBN;eqO$%L;q-+Fm+Fy
z0m&*@ygLdlQTq+~`VxR&^8Q`?(D8)>RQK$X$?gfX1UPD6U(O=#D#1&i1mt;;fl9Ch
zH3>2ICxJVNS1ST_Kt*oe3oMy7b%QdWN*llK6GI7V!dF|1a^R*_x>Ys1gv7csbv57V
z-qjF2dF!+3rrP60RTk6UMy4G7oiKS);luSiA8<>$E@68S9g1yvi}!o5dkdW_W!xF^
z$kXUu5PjwJK4fsQsD)B-ekL+gF5Prwl+ls#`+zKYx1Y%sQNobAz3_oL_62ww=ibU&
zro)d(tOcARRT5vqS#%9wdHs@|A5BGW^fwSA)%uX8X~OezRPDr*8A4VMs$S{VEkagK
z>Dmjgx>4+DJMN9nLy`9(=45xJp82qExh(M|^oKsztf6|F>?!fnj5@+8VkkGb+@&60
zWA9P-IV1I9|5jsyYL^C8IedOvVODt{D~7yQg@9g^)`@4rQ)pGJ-m`LEhEHl(@YZSt
z8A24HHDPg`xAT6m`1i$M*mr*Njo_v1LciIpe>GDXIk9Ue$B}ZXWfQKtEwu7WfcGBl
zM3hmwLpy_&496=})@J&U7eRY=N2+mIGPy7J(p3^e1O?i=!D;VNv)o-5_varqhn}RP
zyTb3Zw%9X5$VobIXbaqNwxkxf7&e;o<}JzA8S`SIr0n{>8UzqhJQTCDZMRUB+N&c%
zCEtJbBJx(+((&34ZZ5)DTN(Oi=TLf6gdsZP0s6<+y1IQ)gL95sPn*`Ad_rcElpRf$
zSvxZ6w6mMBJw-fgbJr2XO|u_H2%59Hj?MbN6@Mf4h+vDX9$PHLlY3ZKv>?_By@Gsx
zYMJ9YB0AfmvXS`s>0)=@JxB@f-XK2#uS1?P`C2N$mxx&fQ;)mzosC9$GF~zd$IS1T
ztg+N8H^(kUh$$WwCHe{JXh`g%JMX~92w-bEkAw&#y9uA|)s>1j5pa+i>3@UBOU#_$
zb}Q>fsitns;_zFhnMRlqyJ;~SQ+QcKv^qk!M@i3oh<K>JjV9xXQN<$#%wG<U{rFOO
zQ~t$Q-Dv7iGY#xNT@+)hU{u+^l8l9mV293WmQ<x}T+jMX0VO;0hqc!4pQXVGf3T9?
z8v)(q9-oM*B>$lJ&$8+_<EuKikMN6K<m5faVjTBX*V}Op=|;U5>U9>Ge*WN+DaVO7
zG=*IuK^v$>jf{0_XV#LuSu}IrRvYY;NR}UYJbtj&2FuC){N~b{Dp8M{R$$dt*XPzJ
zs^N%8W%KwXai9<>kVNUlL@OtGr(s&(w&^9KUKG`JW>|n+>^*pc*rQ#XqvKq7fz}Xi
zfWoy|51Xgo#9p`+Q?>lc)l1yGQ5Ee3JG(puA9X-0%NB}(UT9js4KTG(>h-8>;9Cch
z%Ziyy+Oadb<uqlay=A&3x<ld`l(+Vn03Yej;aT_yU=l;CnY9{r1cg_$N}#jevPjV(
z&U)pm6ulDsHL-DO_z~CF6jMxwp9ZFpBSL)R9&n4TLRo2g1auwYeH6o{dJ%U6(p`Gf
zb97c@^6u!oe!)uFk_xY_3O|$oY^IV{=vkeJa;z_F_(h#{phd>t{pkF7pnZq18XAd(
zTrIg#0y=I-Dg4OU8d_EiSAKLRk4mA1=fq4{8%ANBJ-c;Jx95HT0V>Db#~Vt!&!Lq&
z)iP=m!~!CUKBp2e5B%+9LBDl|kw`;(yaF?$%4lNSvp@>Z!P!hB^&VZ9C5RwSPgeS6
z9;km-N$I`q)nqP-0+kt6hW?1Y;`4O=Xu){?l`n2XTrvBa;<Ry(->~oVR?&{-P!Gk1
z<;xb_ld1D@u<+#b*~Y(`2irw4JSdhYf8E%WngSh55nqO#-OBSXJeW(^K79uqMy(9c
zXH5Iibe^&|7qzY!qDIf4ulq#^L*{bbs@sy7=V0=x3^70jrCx*2!4S9eGC}k5;dJ^o
z3ZIHy>J_de@n%JLpp_67!goF&6Ryu0*IzNo0BQ)0_y1<lJ=^>@WFPB78b#)!{-b9O
zo{r{phk)_r95nG6G+CSBHzYhA^opX+#zS@x09z<JBjXH3AQOK>ggIkh6HI@qvYu=1
z_Y%#3t}CuGNE-b4X99{#aiNt)zr^%yjK1(0yY)i*6#eHK1BS`JY|el5228F3T!t85
z1jB~@Hc*VkG6fVstP3LrSRNpT;aT5u{8M|vRTs>3^C+GLhGsGmURu?#ZuQjbo}X&C
zWzI+H&{pBD6nnEIt@sh$lDF$25l&ODzcUoy@g%Nolvla$y0cXlPDn`O*3D$T5P@4Z
z(RuUrxGOphF*6h9nkI9;g^#LhBfCG4wC}OMNv<M+M6M|;lCwoEO$Zjs5hL&KY3Etz
zYEPT2D7>hBFhuig6Zfz)3}QQ3U^h!uE`ZghvEuFE2~!>1AwHKgoM^Vo>JIi^iol1w
zea?B{l&AkNK1WM!N&-9L`}vI~>Ikky>O8z_)ZVw07{G*v&qS(%#5B8@dbv^PXQbx&
zv)PaBk>52k%SL26{N(LQn7<mlz^}yG(DvPX_}voc*sgw%^SrgTu5xgpGQzIqtmLYe
zK7X><Xy93?&}q`54DN%Ea(hH45uX{_ZN59c;)T%RV2vs3khz?+By*@mwvYuRlT?fA
z3sJmTB(Dg`+BnsVEsZqW(LEQZ+pH7}->YihtoRms=BojCu>5GUS2q=hC07f(i}tb3
zp@10M#5T;%ks|vy#8uQQZ$}+5+QuiNIZrWjJ5sFLduKCTQ_LnJuT7HeQ+N~UjY-a>
zd&IG1j;Qjj$TMe^f&6~1^c-w2QbN(hWz+Y$59s<=b;?wIh`$RytBL3$`Y1INUTFFK
zCIi=A*5{_BOJjk@v!RkW->$t1@{ai&`b`N+3~X7xxpcD{={}k4am`>M8d1e3E^;$%
zV)AWvuyG>e#r3+z%Ud*WuSTep2IJ&WTtbX^j4oGaF;yq5E1aq>hT<W`b{(j0?|lw=
zEl+!g!x_h<=EjME7)kRY>8kxF1JwxRn^U1|m)jNTdiy%3o++2@V6N85-qKFJm;9)z
z=!}5Fa>b=oIQ}UIH&m^xBb;hF+UR|Vs8W~|*0lX#xqG9pWqG~aoab~_=v?I14?|w@
zr#1#A-;+R~X6p@BFApjIV9m!mZST^AvY4!&UJp(~J#$X6nv-$+2~4)A%K~rIzdegp
z2;ncsI<-F=t?;;es%|=G$%iHgC90FkI}`a0aj~V0GO%NVf25R~WAxs2ejDm5cv}bg
z+&tRTwcy^0j3KF}$df87w`xlFHw*R5DlxF&-;gWI=#DCP%a?CDuWsTCT$PsP%X1Q(
zJC}ddZ*f~=Ml+dfFLptBrzOdZ606x(=3($J-w%X3GuqwBB%#{~{Fc!Y54uz5FCNUh
zTkZb*G8{MZNTjBw#6`Q6&<oIC?xQj2?pTCu^y1_+pGMifV|8DvDMua2xEGRJfMo8|
z5jX8Xf!A<CRsfFwmP73V&F%(u!jMQ<Y1R2;uah?Snm2xbxpPO^^Q71^x6)oOrqc;1
zxl8=E!}$$!re_2ykT3?R$J_fXq&%A$dq;&-F@fWZjI>D=(_;W-OTWOV!V3S0Ba(+Z
z-hFxkdP_$Sxy1%|;F1RnM>{^dQM=1MS!j(ZXrEpUOYYH~A0M4Ee%deIYEN9a!F{R2
zdlvShJq3lWdgZlPOT5P{sSdoj943dZx5r7%->4n381OFVPWv%4R9@omxx@U!exq*5
z>yxsUa)A^YW+2=Djtm7^$WyVl7x@~Ok);<XOs-P)8!}xNi<3cL<z77Jl>z;pr~Kuz
z04tlIX(rPlE-PXiMV~6z3W^{}25Y$`d<hSIf(4p1kqYppdMM7p#)!?dguC=WExM19
zjsF!FA^h+!Dd0l8C2JsZmT?-E9~WW@!(-p)G-`Eb7ly`lKk9;wP+QGp7?ssMfi1v6
zD*`XyM^+4EaCzu?`kC_U{i2jrnfjG|lnkGQUbV0(Q=O}R4NZ_Den>nIgep0{)mUrm
z;A*QQ$r8^Jv_s)=iGr#v$&=v+ci7Vr!z-v8&ahCOwlvw*>^!!5H~eqqy)ER{COQb!
z6xDPOY%S#Tj}tg(a}nlX3ZBaIXdU4Vvd3vYWemxHsexXH|BGQ+5eWZFQ094L>ucr^
z!K{=-coiUZ*o_a}fH(~1*;Z0s{GZYQ|Nb+glm+~=OS3@EyN6azRYwD5FpLu91Z=IB
zRpl17vmU}wBSoh=OTE3!cL7uE&V!FmVTPKz2KQjdpqfgQC!n#Z2|a}YRzEGcc6C=9
zX*Fh1lAa9GicF0|j|MVYE%AM^(GM|dOe@jL;J;!$MqS7F@))+)^4A)@2pr!f#PC0i
zWr#^3i%^q`@J3<|!$gDr$rECN2LDoWfWdh2nyVh9*<%xOIcnwv-PT{$E4~bv`==j}
zT_$0ZsLX?a2&Yh?S0Gu{VDUPyZ2J7U&J{B^X}9{kwO3;9$JtpG`-PmOl<bytQU}lE
zKkx?E%W14S%CI-{MlWi>bxoU=Y7^S{^0-)uE;kt;TvPPZrRLrW3R3+rm>MBY!a=|<
zUH3thL2N<rOL}BaztVQ7eDN-hpCgII8?p~s#@YOCF3~{}PZT6vNm+fDh%OCnKjNq2
zHL5N@g=cqDh)(>P5OX&-_YRJ3O0dVx=3lwVyVsQO$=8z5kYrDIJX+L1&$J{@jmLiJ
z;nVuqM_7HMA{j{W#^S*(%ZG!TR{XK=6N57!xhz&4jIcG+npl3b{U)#{l2LJ^Y1?p}
z3TK3)JKnNrYfQ^CrPtTeKgmGQ#y`i9TZ@%8c@FO^-_lvEvCon3<1G!a!y=BNZGHVY
zoik3=TE|gg_UXX%;l|jH{Qe&g>Q)m;^gUt&Y<LzSR~S>YRP~=$>v|=#k7k7L<XdiQ
zoXAy05MMH?_Un4KVsqY6Wq~KC6~ZdUuIcwgyFCzswS#qQop&T>53kH&UT>n|^N7&!
z$h|7Nz%IK?A^zKLcY;(M=Phxb4+&C;F|F5V@%K^=Bb~krn{s{nNOi`A^w+o88vj7|
z37LWCqr7{ZNcHYPL1Dao=Hz%o?y|M6`jRfex6G)jolb0h(+(W$K#IP{eA>UPebF$N
zM$wAEiGxkIvOC$&M<r)$+w<R53ohMNI6YY$sa^=a{F<Rxu5v)PI;h>2&Yq)$Wt(u$
z65F=#WF?_%5BhdXG%ME>O*9MVa2}}$4=5!J=l9=KjZlugCZQjs%Jt|iQq+;uV$<Px
z=rsWkb_~<6w$<~Bnq;;t^P7v_EUw>j<b8&$lnIL0V_|naI30JdBk3ty_BQUA7EfMF
zzKXk@Y5#%3X-C_0*StN_1;4det83s{xTC*ynj%sl1M9qdbjm;#w+n>P?!Tk<84D?k
zmc;$x{9wpgt{4ad(7EE8$pxry=2Vcrdk&NTeew2Kn+z{VO6pNzk!bB;10Rwhq5Tz0
z^TG{&>o+{!HhAMoaN7@d0%J}^aZfyi^2anf&5d(sTFq%lCN8m)bS39~MOG~x=XqV(
zGs>Aua^!qX@KW8IBqQXx`U7F)6ZXhn0k<JutC97O%E~*Iq|y1Nu?f%eoWHEw#4%eM
zu*#5bHlKO32yI{El&!`0M|1p!yx)+o9NI2Rbf=V8>`FFwRm)!&+*S&?w({wa|B$Fd
zCHHu!a{_UJeuZrTioJO;#xyW605U=KrSk?N{Nxs6v>pQ#Xqq~O0(CRhk(*>)$G>JN
z(CaGlXIOy~z9O<(KS)M1*4v|jUL35`vuBk*dpHXXyIj0T>PVG=>$z0YZL>dJO1jK9
z{^?Dzz?uaxU26~>=|@DLQaBPh0+$0{Xj6{b-<=K?QP6@HMWPmw>%1`vxROAM^n0gL
ze*2!dK863hGID?RoKqFco&gaCV^>^<?wzxs7cD^6&jlTYxRIj~gi&gh(?OYbJgJ5u
zAi2Y!c`V@**LTBLFTa1N2<nvZT|$s-2KpC69@n&jmv@$0Ke0nTS8^b{K)`O}piG8j
zQ&6Y5obRq(^@mrk0Dmy(VpH7lSv4D!R5kn5hSM--+7$5OC$a8od-$nwn90}IQJ{-_
z%SfS1IgwFqy`N<ZrZz4DSC_Kpt<Uf$J)z)UW}Klo2r%?84ehGnXKky#^c!LbgfJ}i
zJMdh&6A`Z6qK&VyEohzW^$?x<Q>AjkM))q#rwXQ<MUtqLHV-d>f;cdBzNT%iopjD0
zbb5p;0F!N^VzRMqAvZ@+1MpELPetGyIr%CKpMACAjesS+&aLt9!4)u&M+^^~_OBRq
zosx9}GfDt2@Np48=0-jLy0;}J6Z1cQ<^P7<hW}9~EB6a<d-w2>Z+C#z^byWb11CG;
z0kfLh<?v?a&Xi<rz`ny{RR9aC#;~yHtOfWPsiQUGJQl;k;xR02><<fTtwg*>C`EN!
zA6-ApVRZ3${0NgxO(%K@(8AxTxId{>%$N(vonr#4m`Pj^beH@SPX&KRkZ1WLwO$O(
zV6trxtH*yFC{cQhM)Fs+{QF86UIwD9f5I#DGx}$u%&f??rY<W!DLg+)_8kck>bpt#
z)n{tDetH5MTBnJchK{jHwei}I-Uei_d2K~2$Nu_xNl6~uNscNyT;v{^vA*TrT~%)v
zE9`p@mmgLpNYqu_vgv31d?08gMHiGW%HFi05$+*Wrj}Y(Ik@t*xH6%6vy);*pYD|w
zM~RiachBTc78t`pE`!!xdYQBn|H9P9J-i%Ovul-AH4!HJEKa2a+*>21YeUg5FVcIM
zJpSJh&Yx)AKcO1TfY2qUkrVm$XiI^fKpaGB{8iXA4+)Zikxe%1k`2~bmv|fNftyod
z<h;A(o@WCdJ9#M5VbpL>aQw?hi5TwqCC#rHxl414Ma!CPkx@K5#k~x<oIFg`ON#a!
zDLc>=>8wsPNE*z*ekQ6>UX~a396Zc(`wB9nnJXwK>lG32WfxV4{!mru&m=cz?WxNA
zLipaIlyU3SBUG`>Coi<t(F{C^5-W!YqYp*f2?6ol1-7vaE`UqQ3`>psS1Z9u;|Cy~
z2*;zoOcACB_kCq9Q$bDm=Zw#WI1O^|FMUco!~*zg^u=9$ac3_AW@#H2<k~~(+hh-w
zDS2q#-+9|^j}>GP_)-+Q-W834-8Ow&92ym^2UOxq0&@EqQ|eWGnyHE>GI$EY@Aenp
zt-`;DUH(zrG(C0#MVUS4;hh&+%yrhWm11MeHstZJU-gP&rCq{VL7$w|=g{(d*Il*^
z-A>v4LQ_v9&~?SL`$QA=F5ApPVd!EIi!^<{fz!V?!ww9km!v~$bv_s9;P2(E43OfZ
z`PBUdMG(pY;fxEquYRDvqKO2AVTk5KXjf@WYfDJI)UgwE@3l01tuGY$k<!)DEo*Zf
zwoq0j81oIjq?9GLD0bCi>wQZ1f!L6Pya;U-L;ViToeehpk$h$M#-kXYk$IdARp3%w
zHAk-~_8kJ8T6eH|`F|s?V2&w80#Zf|91z69Y*!g0tVL)4GDdJ=Lgua^&4-qHVAE!p
zF~CR|KfeUXo7~F*c@q%512^i-6KhG?XEjSXI${O`v%EDAYI%0SY%C^klBfg5XEJ5v
zG1LE^3>K;{1qr3m54i~Sk^-fb34mfUb`b|1!#EQU|2`Rt`T)Wnm;lH>x$!@41IUq+
zVAAM%5n&hCc~sQqpJ4jM>?|wD99`Uf^&+$WN4XIJK~)Td#YA2IQEmW){U^Q3Dx3E1
z4+IAC4F=o({Q;|l3e%QR)vw2$(sR{kO7@|3E;;we#RJYonkB_{Cxd(d3E}smrb;iO
zN%CIijk%$|4IBEtE%1EK4(HM5rO==GH(Ee}Pn-Du-oX_oZo1xOYi%k-j7Zz{R|=Iw
z;he+GajYO4!MFI|gRkT~8vCxlMSNQX-C?<P_SD8LM7)V&&R+J%dt=|~YU(4pm-usB
zRLRIYQ_5QMflv7;<(kh^e?zW2dOx|{Qcy?mIl@bLD#GnI<df~|#@2f#WsK@REH7(A
zU2q^FviQr|rt>_$l>vv<65l_*$3DO7qn)`Yhz0XuzV;guBOT#Y^&2vtSMsr*ls2%W
z+@!RvP@h$+%P+T@h*EthWMeJme8u?}L%nVN&*86aq*n{peYg%_$U_>r^Hrlf<-~mr
zwSeD{WKj55X+qu&fn{Z@d#HKj+KE2uDIBpn+cT)Y@bb}TUF5pdFrzCsEtC)1%;A8S
z=>{0XhX=0{(a%R_kHD#dxR&eaWPOGO#F|lO^oxY`M}6Mo1yL;3-s)^FCd=1UcNv7T
zq$mS|6RvM7w~H?a$inA@8Z%WhGHu5Q?HF1zxw@P5-zD3wy<(n$Y9xjB%qtmF%F)gB
zJrtF66=o2X(?@e;f2KF-oN^(ZLlYK?2XlSinS^$Q53wj~Ut0mVfDB@cXVZ+ov2m0Y
zLFDmezBXn1+>>5$`<JwFS|rLej%lB3mJ<K)Gd31ly^+eVZz%keRd`kVO#zf?Ab(S3
zaC6o`a?dqv0ws@vot@__3>uFVJGJ4x^T^zKO@ICS4aZK(3ass!SQwW7L8tGuJ_@1P
z0hj!#QzICio^C79e^?#`;KgTNTx){|wYP@=yDNYRA#<B@PoNueeQ<`K?!*MVN1@|C
z>=!ml*Dizq@m65a@4FrCjF;OlBrdMuf^R9UB2DIgMDLbp+k!l5_~8$*kzyOSz=7R9
zD-_`tiWpAt)=m7u4Ii9>{{$;DT+ebF?wJoBh=Cyg|07F<o?X)U7fYo9ES2crS*k92
zLlwz}j6a)SkUJwOmqQ>f`hJpzAcz@;e^de`J_inP!Eis*c&{It5X`YzY2Y84prfBL
z@G+krg{~>;Rr-AoNNH(X2m;e644veG(u#XvDg}7aoAQAmix!u)0GQ~Me4rE9(7{fq
zml7!b3JYY}PeDEDQ2<X_pWkeK03+0U7nBBO;(&=6dyy#vB?ZHBF~e;C@-(B~N-``b
zs$m;8c<;r1%8xln+oJL%#oIYwGlQ3yMgXh4A-^xO-`ZjtwznG8m`%9J7#|g#TSK|@
z<Kx592EmwE+m3eh_!11wr&N@`Z2`4J6||<iX}#=^{0;HEB$9wV$T++~ezmSVJoQS}
zL3#k8K8}-FtbDs<xgp$9kM3S1Neei`d^(oygf~&8ClJ*H&!$=(G*3k5{@lWqxCvqZ
zL73a2bZEHpq+!lR6rVH6-ugjVCY@r_H_MEx2m{<%_?^T8vf~+~_$Wb195O!*!v6O8
z8<y+*L_EFN4xC2<t~-Y-<&NR6q7CF&qEv8Vu!?DehB;~oKGnp5RwASe@FGa&0tx$K
z%J}~;cw=&bej(+Ybp%?Hw7z!j$+8ftjN#B{<m~96d#--S3f*X(6Qv_W3c8*T%fNQL
zT8M75VmDb>;uC-dhHfd#h=H?_U3hyPmHFQJ_*r{D4%S}p!4KEh%Xa&<e94=3re)fb
zxYO-Za-2<y{6XiUgj637vEH33IRKP^8Bn~4(>_rk$&|oRdNUjC-WZ^J4)-k@fW-+E
z+ipXqQH)LgMXtL+8}9SLJRzjgmmi*dn-E)j?IPovKDF4o*8Q~o!_1bgB|~V8xGK-~
zMzdF1-Z1LL_}0SX+5PVe;@7tEXVB%M)nr2(azYHQXmcsWY2o{VS+=x?oVV1p1e0iX
z$>^~{6-eHMHbc-H_e*j}vE7CXM0!f;dLX8>FKjoT0i~;4Bfq<R^Np8to5r)l$zgb+
zR}|B`ZDkOR#$X*#;3mK|V~kc-Bmz&cHQ=LSUuq%{gxQ&C;lgHpQ%#b{&mrZSL>yv|
zUmf!h_QmN|JXY=HroM~J$$VMDf`ubcLl*b>R)pN^@ssS12O#;{{esPQ>J?*<{;yB^
zH+kIyMHFeyi{NIi^1(m7bce9Sw<T0aCP%I7@B35`KXym94}mEMj!VCEy*5H%y(3Zh
zGlY~RwkZ1MrO=8!gwb0{Z^>+)#Ump1hCRe^2Dy|V_j&UqO>SS)J*F)cm;I*&=^l#)
z`CV{+OO&bc;I^)R*IwQW-cE{-G-xv!m2@ngb`BE(sR^;GNQ8P9Jlc39BobYuC>R5n
z;AZ*rKul>PGphrXK@Jqg&fGyz<jlI<$zF!khaQ`1orcN_hCe#sT#ViXMjXq}`dsMC
z(BBZFwAj`Yv>2W#8juZZVX&Dq;1F0eLK8%wNVXpXUq{Cl&Kr{oKf7j{a&!Vc$n|Tn
zF$x(|_h{sBK9m=+fj<9tiS7UNm?&uh1_~QkuUSC$a}SDqThzD_sXPE2ruH~^jWTA@
z#6vF^7eBNxA_e6M(zvM!y#@HUff5H-{HLZJ)m0i1!hE43XXMAUsC%$Xxxm0?v;Zwa
z>9o+_<8eGv+UjvD$hT&P1H}z9YeOCgv^cN@<f793Q{f<1^sI8NBpF!OE(+e8e=3}<
zM4%TvsAjDX=}!S>`lk+lf7}Wqj03L`Nr+U?i@VhdRu<`9V4LUv1*JxnZT(&~_XQ1i
zGs(UBDigzX64MU`@VT=Lg^ym@!0#xVq`#T!<82wZd)zI+wwe4zN+dWGiAxy-ConlU
z41kZUjmET}k5uZ8qEEvC1nh`Tk&xZg%I-g>N@Pa5ucPG!?j83pqVx{LRsxm!ioS3c
zpELc2lqU_@Ribvu;Q#=ajf(tv4+Awf1eZoDM(?p%G*l)70kzhaTonHBa%$d)Mq#Et
zG}bs<TZkBWAQATnwU?B&pVL^r6p4mCaj303GA_Se4AvRG(1#_P^l`GS7Qpz#V^NmA
zM>$6oHR`J1&Dn!4^Z5K;5_nhU*Ga*<8W9g&fyOn)6RJHmQcy`Wsq`h?LjQ0k+t(Oa
zrw35&ZJrg#wY@MgcvsO&-ZB%CDYqfoEW6~G_eE`70{Ao`>9+jx8YGJ%-YiSCe$*A>
z--A;WBiGa&&Dvkp6l?mH$LeW`>P1WD;V5njEjiJKj|EDb7JjMU@jg12imiMGGl@35
zO;i^B@S!v`iXoz9S4{RAZ4uE&PkraCI1yC-@fX8cl4LgDQ91*xZT#ieB1NI)tVAtj
z5n^ylTZa?Hmn*ofLw@Aq^qqVqufoJAY&G^hM7%d%4CNPb9J^XsPCUTd?st5X_jaR=
zgd*%4?-Dc5UDv0+6U;`go5zEb`AoLhefj+XdTjUQX{ds#*RzIf<yCXl%+N%mZw8o-
z#<m_*hfGtOYBN807lMtO=+lxab)DyF`U6={du9*XG_BcFw^`x3ngoI8;s#-Jl)2aG
ztgj_TdE@$7#h;n1Y~xXe3Z~U;sW!>zKIpN`8xLUmUYp<F5vP9r&YSEv>K$#oSVM~m
zJwqOh1!|DNvC>pDx4NO$iB=AbWmPp>z*a7vmAg!La6aHyG);h%_zEtLy`q-dj3&;x
zOw!Q(XWIw5hLcr>_Tg<}a@s>N9^xxi0Ud}fj**OdoN4JC(u#8HsnCYGl^=rD=$+3<
zGhnO=2r=Hea9uI;>i;eQTvp9PKB_%%px;t2>64ZW712#uN!U-=Y#^HPOleWjjC^1H
zzED8j75Zg;7XPV+fBRi3GmC=7Zsrn~NY$56y7gG$$@8(}&O(KHsRhr3e1!IAVkh+i
zL&g5+8sj}!S6zKrIvbbr1Gynv$vRh~@9(QWe;EEq!4dIt?6TT87Ia=f2*r9jM3~*i
zrHb`H{EdL^M6m`rt524+yK<u80d>{K2L9F)MnG^Wna&inMRV-V$sH^Y()CGkl2fwg
zWhx>&lPH3_@Ov6(DBBn4H=7-VMHw{x>*AM!D4S%l^hqg$#Uz`nCMsb_Z%{^OBhQA-
z%3(+!3v>y5Rq1J(C$0nFLqPbtto)7=&})cRaP%O*CBG+qN$7TD(<TmVQMo^mBDBSA
zC}U^NPCx+GTfk<i8z=OTt=ZYa?Kp${+1CkKo+UKlzU;CxE$yi$bR;S?{(xks<FkRq
z5<~R&kkicT2Oan~LgY5Y)vmR7@Fv#{PK7n4eBsuB82BwM27iMHK(cdsq$m<3g@sK(
zl;dV&M(C8;?9n{)fkv-@xs(KS714-tkwCT@Q<cqhMAwol13gJ&*eOQ_UEWas=?67i
zebKQ2>F|;LYB79Ea!>LY(3tn|mUea6QHxi^K<1uD%95>7$~T?GEU?qB1wjKC?iOy)
zt%>9~*xEAwvVx*6>F{CGZ-`72iXpXe#>PnU)TwR}97|i97RdM(@jr@S|6L%<-?;-S
zA?`W4n$u*&8I+QxE1n=Okx&@hRxiunjv6RBH9TWKXl{Y+LqYf5_@x8ld!8nLdx%H(
zpB}PY%aV$Gj9~6qE!#r}KnL>mQV0DI6mZGXz!@m+L-<|NK+p~zGWh?~EcAjfaG0d$
z5B|Mq17Lg`;9m@%p2FZ?0EaQn;tx8;AmE#=Bw2d@br1l_$s#0Qus|&P&p}b3bAV<9
za5fkVGr}~K_llRwqHD8E9-hC5LG$^Yi%s}u+{?LS&mNX>>)WpECLaEfiYGeOGploX
zR=pQ1ObzD+8;*j2m~hIATa2mWQQ56(HDy)hhQutLcP!?(+ib*P*|fXatk2(L%td_+
zzkmC8p9Fy9Hyu>Z*9(qFbLOk6-Z?ed^P8fE!?u8)>*f_rNvP)h@LbCeW$~;OUVlya
z?8^jyx61kP;7d=vIBsx^8a@j5GuY_4gjUXj=hcmQKJtw{dfj}KDRq4b1ORO*+fg>r
z2Cy(56hi}jVIY9z$_?opkh3%wO^c4b%JdvX#K4Ok?CvLcdy-iUtF3C#S7Mw`R8?6D
z$E=KBqF3T1!L{^=_Atw{U=n3<FVekC6MuzN15$alF<1Eddu{%(uQvTX*twH?wfEn3
zc3@L|ehYAVt@$EKLU-SqY0D~2zUD!DY>76PRQO4fckuXP71pPHv|+mEx$A;pu_T3;
zG!EKVEZSmreTT?1D<JadQtVO2fWAyYNb+w;+f^W^#3o38*?tt2cT?~%(jw9OnfN!z
zCkhIxW}ZUH86k?)cxPr&omXywNfu85$qIFpdiNV5yZ@vyEyAp>xK6G@$z<}pkOi(`
z`rvD#we9Hbv!{?ZdtbY_SDTUUP`ALW50)QGL=Nu%l)M|_DYWTA5tz6sYM*%dgtT|t
z8_EG;laLP&wUL{b9UV)Yw2LNmT$2({{ZGk7W1vV=c4*7`_FNOS{oxM6C{O;ypwg|^
zn0qLYnl7sE7A&!P9*`u{Zr6nlaxRSK8-+jRM(tmv!(-#7-Drnt95egX#2)*7VDbqY
z08&7D75@@mJR<Nwj?gq+W|;E^Hi_DUgZW;U*{?{r(CawgA4Hr(3(bP+yw<7jL<G4f
z#FT=i_#EVi2E+@Xh#?0M?hr3zFN=|uFuuFE5_I+w5t4V<PLnsBNURc`W~B2}_iJPy
zbRNieq>{y|3i)`~1cVOLd+zWz|0oZ9Ww&;ob&RzQ$`+ELT)ourfQ+7nHqL_Xlchl7
zpwC9z^=wK~%J8;PMQ?n4;q4n=C&~fmrn;vi2DHmyl{{6Qy=8s$1|a1|zC&`UvS0-Z
zA%J3FpnBC4ldgsJ@Eg##O9wumGsYDX43<fIhtK{DqRl$>DIsX-Q)Hx+#KkDpbIfE`
z)XlyD_~NW8fSAN+z0zQlHJ!aJVErayu0O?bf=WGQQus*YNYP0y0f5x-ocvs}=Z5aF
zn=P<GPM`IDe58})?!<}Cc$n9@vS5iQY_B~nv~?dI-jwhgauxQsM&g1IWoO?9mAt<|
zjm&{%GCk`>i!wcim#u(al>1?)A1!v(;5Wpsu@xWn^pUd&q3Wf>|8XqkzmKk{H-M8e
z?A8g&jx+P$A7c!2Dt+|YU%8+N-r+0{K4v`ZkXDHSUH=<$e_9OP0Df&>@T-E%TGmt~
zH-a{E5Wd*OoT<^OGSH5=sUum5DU$5}5(@(Uhz0bJ|E!Lzf3$-?$Qo>`z`$>yqJv6@
znKt`VV8M4Y{sT#4iY7*A`1?`-h6Ca9Pi3WNmHvyj-!iX(-Fqq4OPZ+og@c&+mm_QU
zC9bk`wOA>B!@)LiEQ}P|8!rx~8FFZ;3*lfSm8h`1O8D`Ly1F<cS>!jKRh41~&zojW
zax7J>ybXQNtZ<G9*O1JfP{bE+-A!;02p5!@4&zkWQU%BS@S)5LG=8NpW!ZH?|3;I5
zWbX08n@O~t=Rw_{Y~&WDzL;nTHWnmOKGVgPFt_U3V!1_IR{SJmhuTnn$uj*sX(OR(
zkh!3VT|*YKO>Bc~6On&Y5X~+48Sp|rC%s?WAu~FDl{yBR@9REH(}@RNK7Y2w$8WK$
ztceqx{~01haVN}<)f!2kGa-TN`@u0ToLrdgtA*7{5!RB0F=;zdqG9%|>HNrd#QN}S
zr<x{qYTec6w6q%<3927CEqV8E_(ngay5!&TEx1nbngPRHD62oHmYJq_dq$i;qK69w
zhb{R@NvRAB-4`1hiFAmj8(XCE%3R9%I1+Hey7VN-yRn0A-tU+L+n=?11ByNm9d##m
zi$^>*r1n+g|8yQbb1K-#`XzDwVXUa39`OH^#Q#h)>cs?sSq6+{gqeKCj1i83ygNo-
zZhr}H$Zel8$`^5TB-jjDca+;Ee$sf-*@0qUc>Hx+=J<>C(a3Scd0buTS*kojNs+@!
zDCF)vUZ011r#7sJ0R@GxT4j}q6RhsHs{%PEa<2s~qUPA(6a&K6*1WakRa<d)D|nQD
zik)|5rDPLn1S#uOKilNj?CN+;>m20hsGxd~{SGJfhYa?CW(U=bsjh8*x?R=*k-*P%
zSI6HFsG{r2`9N+heD<aBQRZheg|uW%0e!jC>x^g)A6@<(oo_5C*!OqA8F^pT1UfHI
zm>cW&OMhoS6P%E$=RNLC%#&Eq*<qv1LSO0YH?FFVY2~F?vxIU%!8)kP-A4aye*RI>
z8M?&YSI;`cm8nsic;!TGdGG@B>jLw4yXM;DZ$IAem2Vf?nJA?WSc%pTkm7SfXH8@!
zi_ZraZ28-WK8S;N%ju$f5AuFR7kFM<4&IJQ-|i@8o6xLsIxmrJ-0yRmM0d`uG!n^B
z0&u0W*|_~lX+QMY2#=_9`*|f4aUHF{OQew*;}?H}qNZ(SIL!Ef0$r}R(G^dysQ&>T
zBNO^fchi384a#1b!CmzA55kOV%Op?W?~kpU&+fjs`cfW$I+p5Z%Ftb8ZqIIg%MF`%
z1`gk4%KiE^KT)}Picy-C`S*8pQctYgh^1y}iqphCtxbQUJUT3=<=%&1O%d4t8<H<3
z=cItMqVm-LnG*?hC=&wSU|Nzl(WSyeu1g+1G{=_g7rKupW|sWR>0BWBFhp*;a`w60
zi~s^%rfFlX7yOXHvyW@WH+F^xf1fAafa%1@@HhgtejTlp&le`Ih)U|6GRXk()aUq1
zHl`6GbXwhn{sQXa(4>1e!Uq(*@r4sKfID%qjO&jZfelX4Pp{a}@vVh<APPK&G8Zg!
zC^s%0LY5mpy!1AmXC<Mqg3H3UwQTa)buL0`%SYs;YdZru1$XGjOUjLZT-bA*RSstZ
zG7)k2-%QHIv)!aH9&Oa`LyS<&Zh-gVGQxRRG-^Vhai-CT^NbTn7c$^W$a=5nN)a3t
z7mK>9WR0+Z9YWFdgq2=F3q40!S5T+$HSrU$mnVFRP%Y>*QVP)tmK5~M4u0^E$OQK{
z&_P|!74U>E{iJBukk^?7use&!38TJHo&ImeoiWF#SO>tCurTO3*!15YOD%>1{pC00
z9|6XBV|Jfn2)^-44s~sqtRD0X`+xNeb5pAx6F8or|2jv}>F&ohl|5yLaP&LkfkM5?
z(C<Mjd#r!TzCrL`H2eo6V}bGyM3@XLKo&6w`ae6ze_>>xItM9U0?U$sunbzpUrqYY
zQ`%PSf1opHC~-GwA_@2ZO{#ICx&_^1j6~O@ENhMxsy6dxW+o*H+20TD-o`Pdh59<g
zoWxW@*Pq@GLof!Rl|RLNDRv_`%r0b_uOg}XKreP~LVh;1q!&pT$hxw-oyaVHQ)~nP
z(lvyN1DZfM(%Pwc;w8=z30iq*AtE7?n1Nd}^yWINakttR=%yh4(pdiF#~ZcqqvO)g
zM~`jKLKp{G#bl$kHj`hvzM?*)Mm;W)t}ZFB2FUTFi@}KjHrg@KcD{gDD@x)%?C_^B
zGQ_O9pFe2cr0@&;I`quB4rf9M4Z4Qp&y?nxD0M~xNdbLZWXLT+gQqI`dV$FcBMW0-
zE2w5SacwHr!P+bDYjaDAw=v55^*~7{`p1`8G1d3)^uhwD&X{>3%(Rg>#^C$wZR;hG
z*FE=73Ztr(AVuap{(OCl*(!f5QGMy7z;lZngiliz>7&Lf<vZUD*CoGav+zbh+F-bW
zGuNNeUBBJgCLuuR{HPB%#x<OVMPsEK<|W(|Nj2?Pxgw+e-Kill#+rHSN3Evj#Pe#1
zgzdd0Ht30+s6cLZM9-v!ySj=EcMMMzOqm+}UfGOQIPwbN#}Ng!eCbH??CDYc+eC}B
zLm}6in&y(DDUOf(+q#V6pN4<!=)df@+SHh}sBEjE<$9d@t>^38qV1&6`N93P6QcaK
z&Rf~y6O3(oUI>mW>Vk1}T)*gh&8;3Oy?${upmDh<mih*IcQX9cD7Rk{EnFF2wyPfO
zy<qNINF(=&RGT9j?q_as{!PD7Fk06Aad63NO|9>GMiYDN1iJ(-)8D29zGYi0?MT49
zU*60bErz~Zh#2$wwE=VPUfD>7X?)qqd>>t2ZN(_Z<@hO9#XaiY2RVMr-V^(sRa>9a
zA?KKoiWun~+%Qs7vged|i^Fb<Gue7&+hFTdg;dI6wEtEwvg}foJbLsXRsFNGbnb|3
z5rgYUX8P+Xt^0Veah@i@X%o$dM(;h-`mVdNCOubNokBK-FjNS*4JfUuWQLY-#q<nL
z1Q!**i<h7}r4+0BA<nc^c~Dn7>BxE<0&fsd3c(-bInIrWdVTeak7#S0gk#o^_cJ%_
zYf+!JI;`~rt;0>mrUh!YW#-!UZQwOR!afN1VKVwDm8a$9F~jsZ5OwzQIe2tqjX3(v
z9myvJKc_2m&m$k{*%hD$NZ-*;8LugsWIB#Hd3GykHr>9eQ}Iy$rv?N9m)>6XM4T(K
z8z^lN(?yY-#p0sQ?Ha?g(<8(~x041@BQzOYc(WV#cwnIHuZ$k0KQE;iP=9;QWJI^c
z*kI$7JU1^YguHf?$@Q#jsa^LT*9UpJ!ZFGrurG*4z)WD5YvyfHo!uP-MSscF^HSb(
z3Fr|HLOxr~rS3*>Ow5~G&2g0mRPDAr?fRoLkz1qWk{?8_yhtjh{>e*)qvO?ZI9m!X
zN|oJC^yXV==U3AR;U~gutu**5pl6AUsgtQxo`mY=lupaa(t1&ZCem2}<fPH5r%4{b
z{gcf;=qPW*g;(W^P%k32{k$#b)ubu5av~Xo@+#vq>!Sg99X!cg`0ft|F|utZ?#m^G
zS0@8Rmn~RH6`NMd^%eEiti*I)c=Z6Go8X7^Z^$4V6>Yv!gP=XuhweQX3Pte)cc+~o
zP_t3^Biku(QA1$yTcGCCmeEgGBZDT4QRM)*-+Gpm>FpttrT;Z7<$P&atSB8Ba<lo=
z2CxbkAQIO9k3=FFOgx5NIYHTTW~u+z<4iy#vKM+9r#9f2hyveH<JnD2jJ72OaVJ;V
z86>2_fXIyU0J3!|S*E5yPxfyJrb`?G(nfIF5N%JSC<=~ofJxQ{&cObV39yAX&>-O7
z8bd}a7Dj&o(D5J1KJtP>TnPG6|7J#B7>@r<q6aMnquk%bd^?@+n-NCe$FPu$R{jg?
z5+lO^HAY-4JL{y~P5KpfpU&&a-;nI;c%0Anq1~A#LJKl4_;FaJVUyC(L89<LR*|sR
z=~+Il;x1KXx;x}6humn#^s9|oQX}@HhvDKVH`QB#(hAEW_N4=<$)w*{q$qq)A8^i;
z;)+<>uF?8zs8SE@e1?cPvtSilHt+Lfb_v?|<uHc$w4CIi%kRgz7Y-t95i0Mg=qoL*
zZ!L#TU(-d=+m%H1_bo&crChDdk_mdv0F}6;v(joJy2h{_Fg!XeE4C)tT%)V}lw*T2
zGJcENe&Z|FS%}#(;U!<&`H$Dx^bb;Dn+;-UfrOta-|a$APilkfGhQ@i_wE<g1S$T~
zTNb+{_$~)nJWtVYjskqVl7K^=O!|g9nVtrA*bgKa-a`aFEl&8F@=rM${?Y=X)lo7T
z-=>F}+)`BQwQ|2$)k{w`04^Eo<bQ;kYd%^z%KGWs@$+d!jRcb3uKL*tO9vm$75t<8
zwL<|(XuZj{fd2j8kXTqIU#faKTcC%3|Fd!BbZfCIavL&V?*H{d|Cs~2*o~+Z_WYo;
zghc=}7q<jMin);XqI!s0RXn!Q4F!+T1w9r6!K}$XFTw8xAWWhGVk!)@eD6h`w7-RP
za`@R+Wi`=%cr|B5Nh&9blbvH!TJ0Nd;Qgxi<hfSlB!z?E@Ffy%eln-8CY?|9?uhf3
zXgnfM*Pn*BIB=X&i}-83wz_loy--sa${in`$yBWVYEu09ls);~@0D47hsa=IKFI++
zJG9=dIFDu9Nt`bNj}M5$a#*kRM_;{X*(!hvl|O|R$Wcz5!Hr!;_*5a{v`|*s^awdR
zFYRH4z^C6k9CpjtEG?+!{X{AKk8=tGZjax#d1;J;#y0t&WP<$Y?a?^rL7*=<(_WRe
z&dN_S!gH16B|Z+dx81cPoRN>FwvJ!ph{xKl%<#f{fdkX(?u<D4B6=Msdm$>Y{8z!q
zaJ6O0TSA#p!5;|wF}x4K?ZtA0N~5<WtmX|BGCwQ}#Jk^i4|NL+!>o{b4(5_ClI8#~
z0HknJ(!q{j>_m1Ay+)HL!ou9j*O@tcR!c|fxAPc`p(2Kvr>TldQjWpC2ik;kv&^#k
z=Z~MXeui9%@G{EMb=bYmaPr<5vLt+TWSu4HJ{Fz%{iPJQwA8bwnIw^J25pVg9oz16
zs$9$npu4+_6w^gW&_zbbxpl%DW;NRK#zqpzbws^-KK_Of9)E_ft+k_hC_Pqm#Jzf&
zsYvTjYQjJuvsfXs_K>@jG6x<4%h|+K!77H=6vizTUi~2G5%{H_XYUDBU-g#?uh4z&
z;z>oFSwD1C$j`vXg?DHE*Xx9P_PCI5nHx9a3wZzQA-#v~k=Q*$^or(1=3=%02-0R?
zh8!cg^aU&A)y(q#IKzxvV?>oa<LYSWe0x8o75FsNWAI+L`oPRIcn2G_{cISi(mzhx
zyP(f1g^5+LiT<@D|D}mwvKaI?|M-^}#pI7~dEq(!t0n?v8nZq$>H-U2xR`&c93P<~
zrq~H$QX7Bu=|6JyMJdc^z06yLueByKAMa4R+v{j=dtc<0Kk?FwLIVbMxvp<lunER!
z!$cArFQ-zk)kJoa^RIu=)Dzq8n7|TMD}F3RKx{H0Dlunk@Wx=5LHtp|bfsoDoy>ZW
z5;`g$LEKZ5?qrSS63E3+V;dEEwnB4o5H-h&z5D^v=1P@Tay2~LRY7t@^-fzD>T_9f
z)K%Ed<*^QgV*w+aXhWXg$b7U;e9wRTTfB>bZqn4QUeLMa2~WukOI@rKxSfe;*tE#<
zJqdL}udTaJK7HU07GLw$B>6!c=AOj}7(z!ztNcYUC8L#vMC8J@Wg!hDEP1x{Kyz63
z79X%}Z}ge-29b<A(_R|i{SEn9M!hF95G04q=3WSrG8#>QNT}m&Zp`h;r0;PkzVv*4
z6V`rMK*H%M=y7d(p>uP^6lJUJ8Tf+UF7=>vi15SfE+HNHj<mWiQUl-8o1vsfqKwGA
z7q{FM{LtFcJ_91R5JxC8S6oFgcM&@qmqOilw&vuBD80sB&QzR$d~njJJ$w)D-B}II
ze5%4pXW6e@a751N<8PI!zgCO0&p(`Rn~+FkTbMd(o^5!j8?Jsr_WyDB)?rcbZMWzs
z2#BPDg0z5im*j{@cS}o2cY`p33OLfKC?G8@-Jvwnsep8M$^gT-e}g{H`+VPZ-gDmX
zpMC9p@bYqIoN}Ds9qV3e-JHo1iW4%K$B~QBY&HcrWQA!rE8h+Cpl$P;%Q@kO;c{_~
z;5%13pPNcWv(4s*#WF=)?XZ24NK_5svhDnj&KMnT78dJ5yuZw&E=;L2(R;g|QRw_=
z?6r+<ZB^vmi4Gw%{)!UNieUBoeAepNd;8NVEL!<$6rJ^yn7#JrPRo0==eB(TV__61
z2`xwbY4s@@ot>1N_oKEkqd`UwIvAyj?r-z;uO$)jQl}RRof_(4oZk^xy!7?s&Jopl
zV{m$Pn6wMKd3p`TS_)LbHYSW*UI&{tVx$tkT^(M*do@Fd=%XR5P!h>-jB%E8DCT>^
zfP^Pou$(da_H^I1h&#kfhIr)`sUub&Pg5GKM~-2xlc*Y8YgG-FH19{)7<fW#7*Q=F
zS{`Osk>xycjTV@TY2t)=DIHTDJBk98cles8EvxTwgpu^$Z+UM;ogH6CaNaH@DibWI
z9dliNf975vPxa&HsRzAsm9L$fAC-79%-@3EgIEbSYtH0IjOs@{lfmiyz|MsEo;psu
zt-;f~@mtXLy<szkzHjQATF*O{<S_+H+uIe(obGzdyeN%E?J}U^3_h9EXu#b#$(~7>
zSMSJ|&%UQ5$c}0sRE!Q=G>eMj>zt3mV$MygO!1t=yx#r2o%ott*g^z?l%>Rb*U=&v
z;v8Uw_w8t+2D&m1_cW_zna{4QjCoo*XJ*nwzndrCe@Hp<xsVRS!oh`!ocHNR@c{KM
zq}-_+96mp95G1z3erx;VobES*kweLRe%b_42PTc17H=;-<L@YDcPsZiJt}zWtGxlp
zGV8D%P{ge|XzfX@60ZxEQtZ$a+K=&UJknluP*ONm{AokB+t%OE8gdxX=un*1^klT-
zC4<wc6BnurMWV5>>ion2fIYX7Z#VftXs%~<fULCPh;w{HRp2Yn&HaLqs-D-Tp5rD>
z7>CWZ@5sXfpl`nqN|S!^oBQuj_P@KX7r^wVGA&g23glSmIGt>xh=@LtC9wJ{IR7Ys
zb?P6Z>Y7k5Y_kl;po<)SK&K8W)dvC^m44B(2$w@yle9=gf)oN&J5BH`&|`OU{vDfD
z=grXZRUTcJUJUBcJ7xaB*Z(Au{E67+zu}B$7t_4I=^=j&`5s@44Wj^89<2rg3>5Ix
zz!@HWE4cKBY6tmUsIml(Bh;m=s~?jq6-LR(>Q_lb=JY53ED7?<=|bi;y$C_dhn#!B
zRtyB*O^tF8c*3qt3M%pS(v+Eo92Tr0dAw8CErZpMSYa(kMPEtGBA#$+`7E`^!myMQ
zVrIS6s{`KVDRF-@eZJ~D{?RNWi7baKi9ZTfnbwr7%Uwgr+jf_&A@%++0Gbl0^^U^f
zsAM)l7;d|(!*;T2CY*4cN4w|MqSamLyKJs7{F#neGWcU?H3C}1CNkf?K6CD0-YE`7
zZ2qjV56W1g<>4^wG~h+V_lHDyF$ulP68eM%aBA+n!B39^(gK`b#Vez2H8fT!kAN|Z
z>lIn~`?m+YU#q{qlqD~F&M%2<XOkf$O+E20$DS5Kg&^(Tr02ww_VmpY60Z%-f^k1=
zQVQ8_m$IkaDkK6IuYY~V=dq(^^!udF^p_MEvA$Qq|6eXk=!Lvy5I7?NECfu20Q46J
z(GCr)t|AH&>+G`rjH2}|9<N5)HjqGG5IIX?4~)LXIW}Z3sDWQ+aP`G=y(F;+18Z2`
zb+d>!l%MqXGr;Os8jt8+oyMy5yD<!AI+U0jhr&s$Miz39`44YqY6vIjMh9OjvG=t&
z%m!}&&s{@I13PRkq!M;n6rNxmy};KDF`S$4QwjiTj#T3xg!Z2`4C-@5DEy~w?x|%k
ztW=5)VBWueUrk;NB7C>NgtG(At5qwL*GxHkOzD+h6#XSeAe6=igZGO4i4^7LLduDF
zHRZk?Yj6R>HlqZ&MUXlJFTX3~zU4i7ahq}t=2HFX*_bnj%+JEwj1&V`Flf&fBTd!%
zF{32DL$II6KW<5Nmdn;EF;paZBH+oLfH!zufrmPOVE9(r6;kVp@_fF|QfVGx=@*3T
zencv=%Qn(sy-q9il6Q`;@+O$%t$3|T2c3gmffcPkORsWd$J|04+H0ZWsf9ayS@6mQ
zC`w!%#b%$FR=i11ZW##ThTXRJI(ETnbt}a=D6__}7ME2?`N7)2C|aWD$&j!-uXT<6
zK;#(-n=n1bhmH?hYV*m`cY=q8=3}C6ZZ$2Ef~K+o8x?GuY*+<CfhAxyNu&GCT;;>-
z>x^bPOQvI_z7(44q=ze;v(>w%5@qtp4uo!x#}VP?YW1!Njh+Rl*gocr56tyQh+I4S
z1v#^i)Il4|eby1X2c6GxIz5D*lI0y)wZQiIKr3q;0^~F#sGbG_cB?j7q|3R=m;YHk
z`FEVM)iHrX7cZf~S1>{Re~((DC!@unZ5IEpQOoiJtdkW4s<D@9pol>Rr6FO-*7KDS
zo$at26c?x}j*>dMrABY8L6dfY2mnxWqwxO%VlVE4_m5C@`ggbd7an_YV$l?a3l`kp
z<G23;#J<VC;5~p=`{rha;#ZRWt)<IiE9SKH(Eg*sdt&O`&D9m*9R=W9AS)0Ef52Qy
z@Fb#<@cN^!K-#1ms3Auh#I~KxG^%eQlrzn3l@jBG+OB^M_xZ?W@io`<n(u25iN|8<
zx39f>4MQAPCvjQ2VlNGWiVZ96CWe?B;i>iWlQ4}X8WB+iC0!wGxGb_>pLplSMRT5Z
z(VRaCJym!S&;ZqE?_QQkBY7VY_l+rd_Q_TAIM}DpP4V(@Db^`H{V7;+Rj|~$n$<zU
zWF-FDzD0W1)n5?PeW>BsGz&|1n?;`n47VDfwSE;6LwBL-DAIQlfgjs`LD(@f#ssks
zH;k4@6_gA^4_IasFka2a@S!H6k?UMpzOTs1#3H4%ium)%_btmqV}HmDpTM6kR#SVx
zAF!3De);Ky%9c-us-c_bf{n;)hDA!Zh&si|NTFl7@;5sBoJigjiiY1(doH?V^lbYL
zY)NlBi^48f=g{=IwyT4g2pT?b2G)KcqWu?r#@`O1a_HRwYCP3wk=CE+*T(Kr9+7)H
z!Sf!3KpAp}UT!@)*UJ3a2a8x8ql7_YW&`(?r5H7D^&h&YNxB}DnpAa;abfbz;H>CQ
z&NOIYU|<BQnmXe2L==T-j|71^K7DmQw5}FIl&*R$<+A({Y7M#X&sxFA7N$p>5gj9K
z;W3+!M|?ywQHHls0wm)MY{#DOMF^$Eo{5J-UtXUiO0gg)lOASk!3cX_Y%J~)>C4U*
z4@kO!=%fo^YK*W$WG?WkyP!-9f;r>;tLSZ!3=wLTWo^&j;=Vt9Ji-qIEZ08)X_VdV
z27H^B{)%T}c;2`e>tI`@g9(T3D70*1VeTmH$Od|7H<VM}0M&9?XnF<CGY#rH-|)wD
zxU98yDn6{Um+Rb@<{VGkwrVagm1v4a@iBC7PIdF^z<j$M2oW3mRz?6oySj7bKQS9a
z-^bEB2PJ(ra}51hsNcP(ihO<Cv<*|&S4T1UtG6V<YIH87>j7T2srxqoRkx@g9l`Q-
zDojqUPQ%8n&@H8QValQgf_~LAg&Kr8C1~V<KnA>TcNM6>9-^=0z(?)FfCGJX79e+Z
zT}M|Hbm)(+L>hhQe}iLyi<B*QRk?R&yU54(dSmm1LHwQyG1S7TyO8<OXL&gd*h_D=
zBYuVum)BplH}CZkE@*exM)#ePDmh|p<v4w$)a22f_lsKO_P`E$;C{TO#756|HG}<J
zk~YG6X%pAK+dG4lCo~SPKH`OWl&whkYn6rH?It?H{8cgC`ESD<c{nB?2{FLsSe}8R
z;4co956PSCE1l&vj6-8bjG>9~=@C=dyq#JW@t5T8QO};~z{u&V*TvcVWcKiv-#Jlb
zx*0Mi9DB)GS}>F@IDc+mTF<E(s%@Y#DIG=4oaZ>04Tks8*3tSOu!*vr*h?<K>JA)E
zLWC10I2cY-Y^BMHRvww)Pko!XChBKdZ8vgD<9k_l=bNa@Y_ab@YWQwF{dq6jHs#70
zV|g%@v}H{d&DzzafGu+8qQDl{uXOD{8o0l2Da(5h$PUbdFgXpoW}D*hUabSab=-Pi
znnaUxE04D=upLX>cg%9@<&Oybt*o|cv(HK;rC6+<@2_)%8iQ)R=vA4tlE!T>s*i0v
z#9QRplo99aQ@7&}$%u`5Ae+6_0kQ%npl=00lcI0xhIx?bAu~(`sxT1JcC)wj=Yi~Y
z<~>x%VUaG$o2>4Tp1yT_E0uSb92YeF<l~@4K(D(|gJXH58ExzUr{}og_$o>8=mBWd
zUE}+Fl}W#RF0|!7thJ(!f&7Bxt{fHOh^dRr8tS($j0v*B=#vZ!p02Lv;uJg*Q#8Me
zna|I3o;d|o8VhesvvhXBAK~;Dg23o|+4wbV5?EqnVv4@28~Kx21XQq4r^k}ueNB}b
z&fc*9=x@#lOC$v&u16Giuf5eAxQ7Q!@T=2P`54<Ml~81jk>{FH+&>+1jzG`QTRrUL
z(Eg<2t?Wm`$R6E{B>#G4u{9F!>6L3KD?|Cov7M2u+p@lFBLeus4+{y>tkc!Q3I@Yl
z#3Cxbc*jgo7^!Deg~_~=oDg}EtFT!8tqTM|?d!mZ56waNgL3_uc&Ve^k4ef)GUV1@
zhxa)1Izw;V$5bybEpQ2|b0-yxVdp6q+^Vj+t{B;{Dc+QPy)#;7z#v9)UY;ii)pDM?
zqW$rk0a_s%jDGgO@HPoyhF8bZ^z8_GS02sh<I&3L&)CULQ(t8e%P9mh+-GHtsJSmJ
zF&o+bjxqD~jb3WTDxJyYVw$wYfIDefhWYticsaBY>B(pCAHf7NvI?v#lVWG7LTXYT
z?F3{pGlqfV>-Y~h@XCm>%%q0<o}xYwE-8F=#brHR6Dnn~rn|)|I$8Vml!fUq&y~LI
zZkKw73z8EzwR2$DAjoEu7jQCxtV2e|Wg2XgD4|O3dCr3Q&PNnJ2eyhbMG%^(94^?F
z05VX`OPuwOUR4427Cv^Es7wt$xy7nAV4!&KuD}U|p^lOnV`e`WxnWHqxJ&*9M%6)|
zbBs-mj6JulA6Ar@5%~Tkj9DCez?}+h$fYazbN!)rP2BTD+84&61es?kYzc+OXF02O
zmp>H_j3ufS=fkY_B11f(yL^B{Zc!YUzd`uyISrvbHk!(wVUeY3;~VgCp#wT&I(|HZ
zdiQqqH`2HBQpV$J%NlOvSg!WW)q{d{>cJ0b$m@sa>K(680$0w#?4eRt4@7F>ZM41A
ze-y3%Yoylw_mR5kzeZ{m579C((oaP<l{%oQRGf`WoAh==NfM!;J!1)MLZEuY4%tIJ
zsbJGC<w4V?5=qK685Gc|`<cT9Nfd<cHV)QYGswDkCdTZ2!<*#PseL(6XkXsbFA~~J
z_o&PFa9@7z?1TiO{PvVw=Z#9jTleL*#jz_K9JO;Jh4=={UraWXFuZPgymur~J{~_o
z+db*BA64(qGS3j9qvP^?e~a?{ZMmMur8r%ksJn-`;|?J?xg;;@ZBK;H3j19Y`o77N
zhKdsqx@bt>iPG&>dArj^GHPMrtckJnGzV$(wEKkcKv4-}F1nePn%mFqD4YL*76<hX
zPr!akc^&C21;w)FVD*NA6h|`?tD)N_?A-l$D!GysjHachvy~n{55^cDOKW>_D4?=n
zjm`()uv~bcgCsHXXS6R52OTn+6&rXlv;p`Xg*+T21JEc(fmset_9cpXjm&61hEORs
zmd_d@M7DCpoN4cR;q%(DJqK=e!mu40&7+T@K&N4+Z#RC;`}lUK(Bj0D!Ik7!{YjbE
zJ95c|B`WHy7GjFBmwVbNeBMk5C0KOxE`$-uv0k%CjdGTeT)@d}<J9Wbu-?(s+Re_j
z1y&Vrwl#1@Iqy_H+V4)~K7p*?rxEl$q9?Qb893(`|Loh3UcA_yYxw0GJlYt{i}$cO
zFH!Jvw-npX@!anQE0nl}F`Xqd63b}Bk7Xqn@P$-{>FVwH6IkdQtmpM8?#k6yIO-;6
zUWbLQ<TPlH)(iWY)9ueyC()*unqM{KIxgwc9c+kH=uXjN(kPSLzpO~LsUp7~kX=4M
zz7x%WH~0F`9@6cz>gOTOGybuV&Q9-bZ{^MnYAx%`@2tG{P&dh-(b>^P_QotmyHD;$
zex>DcTMjwF-J#t}@qN5EOvOqiF{7BMT4vBzaYMqu*-MXx;4F}K7SG``{lS`ccS=vh
zlPXy*P^sntD+|wVH=?Tgw_;zk_+B{6iKXN>QywwQ?nT{C6AG>%n~*H!E0MJCycJV}
z%NJI%2oYu=mSwx0!~;H28|4gJ?$7+g-+M{aK3aKckXS_U4U0vHjCrs<vdQ^0rKu3a
zeV=|hMfxr?8G_T1Bl1-2KzcLcKC)IPjGAu5tl5VC4dKZuDD`!;$<jMH2Zufbn>j=o
z^ie7_4P=ag=dB{{_58iWhtW9aGSV*hGBe^y`vzBc4W*p<ocLWMe^LtV=gvpZ#ao1J
zc?e?<j3>sE_X$&>lk8C=rjQ#%^yU<lJ}E`=OlssP{GqMJRXEuqL!vRxl<%i|RI2s?
zOajX&5Rjr;VAU1u)OQ<Ik8&|veki2&fRUYNq2GC$x79wf{v(B#RZhb_>9!Y3J#ekK
zO?7?pzbt=#0}g0^I-ri=L8qMyBUrTV`uate_V<d93rqrSOa(D~AK1Af5zl9ASRP<7
zrLcBB?%EvSe#UjAJ9D%-)1z%Gi2wDfpUC7JvJM8>@)EY_Lo;3|h8*XNg@SqIUB0Mg
z%qjnOk#GFn)YQS~`liGrEkmYGr`Ha}W7W7b3-_OETk=0QqUtm>Z_g##+Y*`9MqsNt
z#v7wYQ+gILPk!)6(pw38vb$~c@{z3b$eCN`06Gk$%R9U=_!C<|0A1|)@FUWf4ucgO
zL5*by5}sKqC<+YEH+M|#>W)J(b)8zy`KIYWJuATKr#K8?IbjoGP;uV?T3H6KkqcOG
z=lRK)fU0F!K)gb+w-~H-Tw7ugMlXe6TszHpeFL=@{0l+>?ta(9U0vFRdiOu3HmSma
zGQb${S)E}#`lGS)O((aCVN*0cI&rX9G+NG2nzjXgK|TZPjO2+#<O|294M6?k)6VMy
zh!-72@#*?Z&#3M9ZC2RjLs1w$fCQ-t^I?4Y@o(o+PcS|oIW61iR2q;0bPyB}n14pr
zpgU0n4qou2kxQKO&Lma>RLV{-ue{54IT@95wJNda+V*KzWr$qUwpb>@49z2ye1ALD
z1y}QZWKR-Y?W)`i!%r6j<yBMs&S{=yP6o;59k@FAE%GZW6d&%ySV)-CU-2d<3GZ1s
z-`UU;r*6;Ju4d<qDN=vd#}_g3P51bn>eE7~-_;0U-nHq!Hh18P0SU0TYQX(*sZ#P5
z-N>=Yl8WwmADJVrAAmVdbNABU@`kSqrZljG;^>hC5%Beo#ne)iF|c}xGO;drLOYJ~
zhB(KX7d@~ia%9++h_`d5V6loKgdAWfe3k8R`Q50Y{P%D97bB^HUK#Mc_$T-30_cn-
zX?FbWH_)x5xyGX;C71c95x5xAfT7F-fd6G<fSd1K$R*ITnmZRfu8SOSCkpNZuHzJR
zld+WsQ^;YHQwJBd71$CJNe?&jJ^KaW#uo1Ef4aDw3(|v4`Q2FlC!<R#*IHA!ho%x3
zKer2Un|DZco-11pm&mIeW5#^50r(@aJRIu}3~Pp_EtkkyU&_?b3<tst7M4XI<-=?H
zEfTyiC-~E9{&7)L0*l1|7BPRzL>E(Fw+<T1Wu(3Eo&2+i2ejgBq<EKTxhMQPvIPI>
zn*srA_nrY`9hOU^{YbyBsI>yznK}R}=)ryn1U}N4nojs^V)B&CsEM$=_;kK$tWmP~
zQzIeXQ|J(MBM7#7CmtFsdz0^cKBS=OFu}7NJ@aIf`rLxLD+21aB9l(E&_xLK;C9t{
zDN6bGA&O`^>!UzAf%>Fp-8vmUFFx?!6*d3vdO<2F_~JMCp=MEL6?qYLSE~n$&D9fl
z1hI25?v!V4-D~2D<awU^A|Gdaff2!X@J<87$MA80N-x`1*dc0r%fa||eXM|IX{r<Z
zEbA5a{+&`b8#ci(?gPy%a@i+|i(V4s;351pI-oSN<7%PV$9fJ9-dGWv^=4QOSg2-W
z{o#Qb+)!f(tTh9h+v&n{=`d(ho-M!A_~Kl|6CELaZ(FI7k}4>S+7s*CTJ4r_`xNrU
z=|C3mdmcuYuwlxb`*KU(&4>B+FNzq1<q6~|eE3&?mOqOwkMIw__q@y$DvUCYYokz)
zblZm~hcsqr6DGY2=9SEfeD@4C(JOLCQVjXQ3M)Z?oc(Pl_L8`@5xd}V4W-G3>;f{^
z+<wU*`gy<0LvzAItk4do^I^?fcKG>IR1d!3(1uUlj?Gu7o(n~3wTYUFUB31>(wNoI
z>_JP~r2fNKFq1%460^)GGa2gOckm8#?T={sBLL9a=YPvdFO)+ufxktk7x0<~-EY0B
z`~?PgpxnlN8$H_0o_|ImuL{l(k0kiks?nQ&@f?_1ccSW%XAe*pHIk&tPpjVTd&{XH
z%Ycn~D~yu8QzCW?L^vPl#;c;ShN&yJJ(&IWRCRo+^J2nPJ>JK6JfAEqoRt{LIii`<
z^OB$(rRySMZy964KD;NeD!}es9@Tp%x{{*?JGYBIvb#LRL~^|xRo@xRnRg(TFn_i1
z9grRY+$=j(_hiHfG%!aeg*l<Mig>Tfu{<orFoq@K-+HC59h4kwnh{RrZ94Tl9%nCY
zKYCH*SW<~d_ldvDR#Uwj9t&tVN#3eybR8T08{lmaHz>XHnSJ9+nTE<ZDzcfilg&EE
z&w%G}=I~12Wj+6y=x<h6w3Wi&_v7S>+gg-uG-=QL{1&6RB_pFd8o~q<2yp0wFO&qz
zcUfA|ie0o87!1g>ll<vOa2y!#!4)2Z#Ea%de*9pL7Rg<>?)_#8^ZZ%Za?vZAfpN}X
z27DJQdjF!hqfPnDe(wMV#z{c*2MO9ii33pDee8<+E!f_M&{=TJ=}KWu14x(c2suFn
zwk+tjteXxmnNW^@2ji8QOV&+CYlNuR`f3OZ7qh16kFd#^=rNG=B4!I|up$qC=+)f}
z3kWXDSN)uEJn<HM&~T^%BT^V<q~4)tLi$&3bqBfCg?jZrO_tz(m-d>rxaP12>(vD0
z=%JQ1UxYEzXxve(JV#Q-Tqa;9M*Nh~ZvGd9P}SUx><ROOpG@DVJ7|ggWyczC?d7~I
zMlu!1Tf!(Dy7sds18K1j>8rPl!q24p8e!vaXXl!}v-&Iea?GtzPnS&mC^&m7I6kiP
z;hN8)G|d-6nnZ=+sy&WP@9Uvi)Em!Fb*M;L%Dt*{YQ_x^*+7S7f*GCqQ_l39O=U)J
zc;zgSIcE@MvSREntt(15^lBZqd!1a4)tAUkrOhXdPw|>#uxxmPb||0{5ZQ7s9Dk9f
z%2b0Hm!EXGr%Kgl6=}@0Sp~Y;66VW%J10bpWi^E!u9eivgr*E}9g&k55zR3UjJL@X
zvg_W%<I$e24gx@NMilH*^GHh&&X%&MXw2y7E8J&9A;zLZOXjXvKHGk{nD%PVc=@8G
zm~bDxT)-+HwT(_m)+3YQlnq!;LBwt!Q8oClJ=#`Hd?s?5WXmNQ3Gw>4FYQypQwjB4
z+5O-`eq;{!IbZ9XYhWo3n{}teRaKU$7;vpre+`PKB%-{M*&uG59fc{@;&~g%iRX>m
zE-L43j;#);0zwUCrRoF9>n_ciED352*y>Yi^)dbiC)yljDIekLXYJW$nX!osr^7CK
zik>!9QRpbc+(s7$8ZSg<8xP)v^5!D{qDdk>8k&1@(jY7IsN4Zphd}Di<ZpHWP1>7m
zIsh+&<uSKyF3!#^ccc3@iNS8faU{%If`ntWelQZ7{l|(c_hFMtk-ct)IxK8O!Muf}
zU#Y@aP3P2qZ2Kx#oF|VX{fwmO4t2?qwPVTg3*Y(QnY}s=jHVSMawU5lA&C^1ET*%>
zAC)|XmpJ)(IRJ6jv0J-1Mhuj`&9j3~LnoJ}?(|&6>v>r{gJ0s$9-&(Q`5uiiQwny4
zq7Kh_y*jGzOlkBO*}mG>Hol6!mU)zM?e2hU*MTE;wm*-tiPOBl0=rM})s8cpa+Enu
zcX=Vwh`70?EM8p6o-&}ikj0F9yw<@tRwLQYHde%!jdP~;wjrWzqP?U1L(aPQxt)TL
zyr#QKQ4`pUd;&i-)wqE$>JxsTj))I~f(o_s8fr3U-*$G-XeGR95evFe3%gr%gLM80
zwEcuS;ReFoMIP?K=t2dGpgYN63IeD(IrA}Zf-k1aO6UgHhvbDC1~5?ru_+y0GyG#c
z*Wcz$Xg>G97XP6;h`*!^z%T@D+kuHj`7b&N5Xageg6PfyOVSH`mSwPNyObjM0ZJV3
zIi1Hv4M(elvOej4pTUz6!_SCRd?br{pnzy^96&e<B7_vF6M)-XaGWN>a{r!->UmMn
zFUYOMh!pfj>n|1P9Kr*tc;#p3Y@8KhL~aD>u(id=PIa!iuczy-fJF1OrC1oY#=dq@
zaWwzC3giFj_9E4elq*9|O>?@i(lDRMpzetN6muo4UfCF`?Pg6A!uEb+<~&lO_R~Wf
zY=U(^R_&$1Ge+_{D3BM|6X#BD++=ng-2TpfKLNv;)?8FY=t?I!2IV+aF2dY!Xy2(k
zzcbDQ#vBI(tRXao{(K9m-}eO@Dn|mSO<<Nr9jrCM%RYkA<@m)U&-n7O$XB3#v_%kp
z`+%EB{nCS<-evM{dc(K8#1h$g-aGI<X!A{Z(@(z2=AlD4uXBiM((F6U=8cHUV=3NY
zgCeim{DQ=!a;lpcEAMu+CS~<R&QlRKAG`1prBC>U8VbrXPO}j3q+p3ecrQofoZVaV
z(iv>1Pc^G$#*6+e%FDJ8buE{jFD1b6lptO)dW)+*(d33IqMW8cKjxef{nX5Z#-n+t
z{)t1E`dW)+cY?J_Kd-Q*N4aY;GLoO0F&{_Z2z;@fArRBf7QI^j*7Dl)Wd`VR=Sh=7
zK%bGo;RxtuioXiGHV&z9{es*r=~UM=(x1{-Fs}=G#6YE^1)yKG5vs0SwlqoFMQ7Wi
z#$uQgs%TxwmuCv9pC*0DE}60THRnQe3RxCe2e}694G7TVZJsJwRuPZncfy-#T2hCq
z;jA@p3Eu0iRr+SVK=Ax%l}BB6R-Lt7I0*Bf9$g$YoA|l>EwXG%ky`jm3C4a-e^#iw
zN3B)v!sA~MdsG}Vf$Nlc?orX@nby-V+2cscnVn*US%m}Alw7UqW>H2>cwqmmi?aOF
zQ1?s^hU*A%`K)_Z9lMcBdY&nFhM%ZO3=l`|cH%DVt(}g&=OQWD4tnVPV>B>NUOd#x
zAWiFi+3*M+!Lz^^7F?QmxrN*;Sgnf0k$^`HLBH9JF0h|Fmh{!9AwU~Oa}?U>&;=HH
z(&<6c$_*NaPEd8BDaCYvTFeaEiu?GWUvU9p6@6DEC@tQg!)qL5SRU>I<{20^pk`>c
z1oUMkDIPSc6$j~2dmDcIP+t(We?8}bWL-+>D%g)(UA522nUz2pjJx7RpCfKt1R^f6
z*5cy!w-`lJz%oJ8*UW8rR6f8ld1F#R(Q+}Ojd_E|AGZ%w9&dh^HQ6!mr9oK(x{Wtz
zHYX5$14o~KbuYkcS{*ntT?_<W{&Y0x(9-^UD{&&p#o|9u&Vbv%q%HFU?(xjtn$THx
z&BSU2HT%-3E;@XOFmICnEN(gaJ|_+wu5f^(p#FH9_RsMkU8k3ad%qw`nn2@3A~l=X
zIoF!Mz<jFu3*sOI0zzy(n{M;M`7Jf*;UQ@4OY==WW1Qmx`pxhpC`}*!f`o8IcL<;+
zrBKtz2soIp)BpI7`I_kV>Yu+Oyy>cyW7{b6SJ%k`Di}$a9A3p~C9=m42IhG~rAE@N
zw+rsD{<u#Gn_-F^s;2Uq<$5V_z4uD#WX-Di73kr0>^0*$Y1{k}Bd3krm9Na7tGrv{
zk6*ihx2-Q>JPvzO6U&jg&g;A7UrKlmqKe2tgV$`;Yxlw)j`ZsL-V<%07H({&i558K
zAhoT9kpwIVCF+Lk+BL~DG9p}?T9Hd5Na2DtAE8sDMOKlzhn_(6E)_XeYIhjCAv;`D
z<@3|I#IfL(9Zjp7VMN_-#+Ta9p4G$i(=)B=^2oiqqdd**)5%j*Ezy`nY8y^3%;Woc
zuK_sC5_sv2#o+C2-ElQgs!5pod5x}P@pIFgV$pG!RVwj!%L1#2IX~>M$WbqtLKX#*
zgO^%@8^zB^_^7fG@gsl<u5R=se|M)%#GE@-F6Dm1Y-{R=mBS*l`Dr^FB`@wSyytnH
zS#n5x78&&)6a#H)tuS0$<8WS9KpIxLEo5Ojko!4%P{aLp<uvWc7Q!IM<1lu)f8M9?
zk(jxJ>_lM(%==sML9c7M=CWrAW%P81pVNG}h%p221K6Y?kgDf8`P;dn^FOhis-<aa
zcYQ7Vf&1VFe{g-@q-H~9N2~{H;Gma9fGm8ZYES#n`v$uv!D4vM;lg3IVs_uuu(Dev
zioG&`Dd<uE83Q*eJ_D;Pr~jBU1ADM<W<_POy4+erQz{sei%C5nHq78bGBucl$w8OF
zuL;S_%FMoeTM5|1OS#C|fXWA)TSWHorR<m#X+{Wd6x^RKo30#e+SUX&0Wbhqb(i0M
zEQnURno)q0a?z~0d;ltE7JM;qI>8y0hnu1K5}lbJu+(fu&=wDI3jpc9cnn&42o&nT
zIrV~j2|$E@d90$1gyQgc<k3*!#pntE<rha1jPaS#{$RfkXL?}Vkpz1t5}NEbI<P+V
zs0#rTS;<eRYIWB@JZPNR4V|2uBnF2u@dOtU)VR3YIhi&=_>d%R7n->4q6>T(z-nle
zGyf_WfII7S1i==*9HSa%PB_fRngY=_>pq|YcS0tBFE==rT}-G+N!aUsS!pm?A>aOw
zrYis8^o7{aK+?6&kuE~}&;t*u-!l4?Jk2(m-%E$Mw94KBoKO10qF{LSNL;{8*YW1L
z5|Od&Oyp40v^T15_u7}*z$aCK4(|{5KP$mz7=Zr1e#7WIY1{m(jmYchal4nXM<=SQ
zcI*0V(#9q>Oy@q7kt{D@&o$Hz<Hvt+S{~C}+epQ#H_Eym&_(rSB|Q97>e(jYK+^mX
zlyLpj7*@_dS?591x<}P?Jg#s~NlW~^v*4`ZmU3Nxvei|leC7$&d2ZWyeJA%pLi~uF
z-9Ek}6|Nm!lM|McCTah<;-?I|*(D9x!*hBRi26^e%iJ@CKGSt)f@^M$4xH<c2p^XM
zHwr@3ORXB}A-Z`Ul3$S5lBaFCTtna)_LE6BPj@y?<_#z-;s&RfR|sCJF4u+Z7h!85
zVDtX`RjHYVa<}Tq5)Tbido+K#{$NAhiLiR<l%TofpXJ?Dt7F9>EicA9*=e4_1eY8&
zQiw*}j`*;xEZ{DWx8LlBR}9$7cgh`(&L2=dQKzL!b^{F1JZ7v|5m3{oTxqKs$$&|r
z1hSmwuU&P<3nv#(b~%k;3r<h&avv7IOYz2vJXk9VR@yvLQ_PE*+sOc2GrtKKtV%5P
zyzu4ufm}NvTKg%E&HuLO0pSfpt{YO6&nH=7h1Q?v6=j>_EkaMDqfcQkwFf!zDNZu;
z)NBP~7rLv%VkbQb7j36)q6XGkYBB^K+>8ku-NIFTbo5T1YeA2L^xzJ6r)k8SwflF%
z89i0!en@P~7jrmjZpJvWkZ645Nq$!{LraYVRi1iMT0w|!tZ%gTGdjMyu8uuL3)b9x
zcuXeDG2piLAco?(3_e{U!(j1Zg51_tZ%YSH727pzGvuL~tK{d;?F2mU$6PQ8B)3^#
zl~KTf`#v|IRgJ{qIMC(Xe!%i<7{mu~nn4%<=N#?t&kz0zEuv_4U<BS^XrmVu{);j|
zY>4=N@O%`g|G7a2b<tIUrEnyWztS*JV}h|P+BE5p^yT-)U9?~`PW=LNK;Pk?`y4KM
z1Kit9NN?x}IPM#1W6*`qsEm_wal?v6`s~Cnq{k9Lf@^{c1LjA?!S}l`#v0cL!D*%<
z5dQ^vn@)pqWRlxvaDJMIU^*G*1ZI>>&N|~kAxMQ4i7EnEyxG_csP`A~I>xM^g)Cst
zCNjckZ^WPJ7o_qX8d^yC_CJ6Y{y#S_|M%z85)!ODW~*Gr$)b(`$b(1{*k7G@*Ewt)
zr0w4IX`BIpN8Lu>WV-!`$O4q3!QP0CCWsgptftWHW}mN*k5YiF6H3&$3#9G-{HCIu
zWcJjneqSgf&k8$!LFDcBBy>Syob0R;jQ=P~@bykUD#PX+-)FjN*RQQsUAPS7MSK68
zednfZyX|h7OTlE9#ql)?Z|%u$quvs7wMrobW-?<Em%71ruK*WY{hRq&D`&DQb(I*1
z%vV7ue>TA;*`h-Z-c=gGZpxG_tRWcdg22pk6v^muc>+;EIMVo0|M?+^02=W^W9?2G
zBaN)Ku(|lu9}I~orKc>?{;EZ&-rA>G?-XkjZhU|E7HqZx^Ap`<^uJNrG@(33^aUky
zuapMq<$Nx!@e+0OEg|;{X!upBG0qv^df1H)=Au-sU7A<rLo?PxoJO*H_c1eo@UIVg
zdwCfyXTienKoODGf*C;a-q1@{nNpeZK?8ZNFMqq%uF;evD%*z07waA}50_Or+*?f2
zk7kAiu)b_ukR|%u-bs9@Mr;#zVPJ#0w3^e?<*c;*c+CFEnn>EAOV!DqZp_1IFM2kv
zkHVxYB&&<wlkSe){#vu6EHP`GA(>d8F|XsS>5OYN>d{6!abiXZuD+L(qFYE?7a{Df
zU&l8)r8IM07;N7eF9gCnJ?tBk`F?2~2fex?^xwPeeHp7lEh6R^5^%csWW_e0VI@Ze
zUAvL8kfS2M(U~x*Ijm2{Q9O34$mi{t6>dTH;1MNr2W?oe*o_V`T|%rTOQspCFrct#
znoDZBG6fpf+$13hc#D8SPhwA%XlJ=HpUH@&pW<QoceCpSH^c70bvoI(tG~DVGE?qj
zGf8x`4BFaYdTOYW%-C?NGWHFUDR<U2Q?77gO}nj&KGvU}n(#@rtVtr|QMecJAZ>hL
zc3(W4BkQO)^NWGOE3+ur^&0Fd1YxJT)f8uKh9Zi%LDl{1;s@((iB9b-ZHXt>NEc@x
z<Gqg#>^BcffJ?{7O$ZWFdld;AQc|9}wb`}I8yrTg3x~O74U6{IyU~lh^kje$L)<3!
zgePkD3PfUz3V*)Cuc>)?$EN_Wa6deAHK2?sxQ}s<c11YH2Y1k4g^e~WjL4r^V9YxL
zM!4=wQO&t+HcHKLKvR|&zKju%*@&c;Fw0ztk!QlM8DxJ_Il}4S)pjNG<%G2V*Ci5r
z4^X&2IAU5}yi}gp!$i=*B4_8g@xZ&SD`<|<nnBBgRr^!tBN`=Srny8&6Uh!gun3vf
zGt<O9@re=AHI%E13Zo7ap-!$Hz5B9zFja=72e(A$$|DcV$8aevy6mXoaKHrzn1v?M
zgcRsCu!aCl`q_k%W;h9?Mb2g!^fsVffrDv{0-D8&hBSV=$^Io?Vf<4c{jrngLANab
zoXGqYO&K91aph`PsLWAfH0z*Tsu;9`?i0qYH}%y_EEeujX$4%D!?FtV{REJKUT|nS
zMYs^RP%rG}zLNg%cSO7Sk5B2#-hQeFR%ZjM2fq};X*3|`iqi=hXml_^`}6VE$IJ`?
zChv-x*&=raiBjQnJKQQULa^>`si{r~^}<FAbpr(6?o=eRhRKiA6%1d{-0)5QX;=dP
zW1h-?SW*4E>Wp;TzR)q4(_t?0{1B_=+`KsntB_o=j_ezCPg=)fGkl#nKU}Y4&Wh@3
z)3s2qd}X2OiSx4*j^cp+#@mh4W6`g@=p)(7VV&_ni)`0-H1oX?Mb(=%QwM@6_PHcB
zh&ILf)`g^AKVx9y(LMWbIuHU(gsHq|S-pry2&f)HcD|SU{r3*%2AJoW>f)K|l3_qr
z`ns<vz54L>*0UXUr4Q#<$plU%R*UM4qzE7I>3IcE4;2Mo|K83wlJgar7q8&tKE8mG
zaUzV&+3milwG6-R%C0by9t$??I(@0F{OLzVI+;AJhK)Kkq#3K<F*<)&FjZ%xtNGCH
zN)$KpjTPuE@)Wq{VvwQUd7uXkf1ubW7=xq{LMc40llJ{tw|lF#*5~eoToIA`bT~OQ
zVeWMNS}ua3wboI&J=(P!3MXQuF-heAA?#$@!uzG$u*gQD{|C&iOt_Y1NM=u1o;bQg
z+cb!!0^4?6OaHlA-E(TA)@KB*ivcplpXVtuo8#%Dd>62hDAI6g{)roKD^2Xs5B5HT
z^5j2HUYb1DEPJ<Yc-Nn73tH%WsGS!UA}<~(g@@BAOv>)obz3fUku6t;D)b)k*FVus
zZWH_TzKuTTtU%f%#Gv7I!E4$>a9(k<v_0sC{0UGT8gpuyMMFh2kJ)9$ACpwoG<QIU
z3KR>wIFb(u$*^|5V%q_t$?=2YO1X}lp=#@=vIDA@PC?P9J2zI4)yx|w5yA5dGM2CL
znz3DO>&eLB#)8}Vhgctt8F^0~`h%A|=`S^061r1(u?P(hOXgSkRX=rjeJH0DpMrM<
z72SY*xK=+W3vGFSOdr@O&F>o4y1Fo`VsnzGSi)&Eu&%%-pHzA!Jr>kS%>3nXIOrWm
z++e(-jINaMMPdRk%qu{x1&kB9FGj4ulOBz9jsOd3P%UBoUa@=8MEzO(fhJb~Ipl?u
z?V^Ixm=F8CB#=a)_yoIY6qf83Kez$go1NLgU15u9YV{aIDC(>I$kU6|ivsOW<NPod
zJKZTv9})6^qM|{}cMAA-&6zl@&Fn1^o|Vha2ISzY9wT5uCZ}48Bo`xCzt4u=uH)-q
zu1;KVdsPg;!FPV-Ai=?xvQ0|;5|Do+Yz}m?xUkt&RJ_t;dQ8|j-PUVq5{<u156S*}
z3G~0?y0&7nVE5`J7rSc<HIk`)g@ek16%Vy?a9=0b2rRqm_qXg2t^<$FGFj{o(GQ;m
z;Nkmh*PV$Ye2;tV_=$K{%{;?UhQ({fGt%}YH`aI7efsZyaZ(XOmsz{YTn#jL?V8F`
zvK$|+CC1#tptA^*fXym^o<3qc)s6;NOgFm(gwTj3S>a&d)AJ3Q<-ewsz`R73!0)o!
z{jYlK(yJUK>+yb^CQ_FT+24mRD>vfa-kxUaVGCO;Q2Kyk(7t_stA4jH);&`^{jTo`
zjMKkls5;qiw(8}P^43o_4_Dt4Q^NDZcgmpLDyu3+VhFMOb4A1?A}ou4u))@3TSjz;
zYmYZ)9K9Ofx`{otxZ*;KHaEmL9Z$Av!Vr_s;qy<Cvw~P%XM5Nhka3i!HHq+`Th>ZL
zT6fdTzpk1trfJ>xWlJAH-k28`y1OA)%PLZ?xLmwkQ{*!k-CY}R`Wa-o#9LH@<FdpG
zwGAw}Tz69!aTTJpqWq-|LNx1NZ}%<w3iTq_lSyLj%ynX?CPP|paGkEIcbqZVpelT+
zd`EW~uFLqh%dQz#klJQO12lEA#m_-dEH}f<&kB1#A2NPPQ_4dOx}F^^`@s>)T47L2
zH@Mli!vCa3&ZDmU?2LhW0sAn2&~7jFXrT5iw;!PcFVK6J#o#!ox4WJYbNE*4ROl;m
zeZIE3`xE^L<=Cs75&{lK3Am$;o0go0y7Xl<UjdzuKLX?fotlBg7Z_C!D#Cf>z_=j>
z&1d+1-fn<VtA@tK(L=9`xfp_iWDF2fygws}TxJX*qxlXLCR=h*h{=2}Y=*R7mkJiT
zk+GX3K|xV3ofT>DF$5*Sw)K?|aS(DoXmSIg=C~&lA?`#+gFqBlY&I<n(Hvv%r$e!O
z=5kTUrsiJ|e!cW0d=C2ZtFz-$voj|*feY&_?36-RWM$DQ%RPXI;;HBp@i#y*-kzPa
zo0@m7q7U2W$w2{VZcVE<i8;N7(3!<eUK+wdf+0=&5A^VVTSESKiJHW*JX~S}%kSQ!
zh!>oMYlfglS-C$N>(Ex<)Gu$Ycc1#XGpgddx_*0w+-BeH6UXay%efcXdPDOISW~d^
zpq5}v{e<0@%)+{V(Tl@py5UUB*0XL>wLU5@ERfwG7&<NW3sO2hPNH2PjbhG01jzDr
z`#=MATuu(SkV!k+)(CnXgu#5W@EiYEoLU~-a^N#-G{8PAQdAoP2KSR6^$aIc<<l)t
zW=(QTRl&2D#MHa7@2^t;O4rIu{?{LW3KTW_Zkl%<(k^PV#-$vaM4k|>J|U@ePCBSJ
zK}|Jb26(EQIBYaw)(hl@IF%Y;GX>q*?>a3dazmgyp0XEKJr08N^X#sIwcSn6?m3O+
z%J3pAnz(vG!U|OpBMkMUnN9mTGqX<zrG2w&c4b?W?1W-=RUmx~_&10VVF49w>jC(C
zH{Zs3Wg5MtGUh)Z31Ev>9!eT()9l%eXY9^nI1{It+UyH>A0uYPQ^s<n3763*&<@1A
zM;j3r|8}y*mr7@wJ>b~+&=eT$8-*CV0I1b}WZ|$tfpt`#GqYOyP$bmjo$gsrCv3uG
zH^0PCn(H)I9juxXE@Fib>e{&pNxO>{3??n4H`ct~RzVyx(I4f1+DN<>c!xf+a|~YZ
z`?mJ_s(ZQ4Ly=AVKvoeNM``0=)R<F^h}FP*nz71oxrVpzUL>rRNpl%XlUks$e4z3H
zEQO2ZOx3@4DsVER^I#hz-77Rr;o?aCPL*iBJN&n7Mur)KzSU5_0|m;|qJUaLVo<x4
zo9qBTsg(_QRlBD;LOBvE4ACS-T{S?646XQ?m3s5jFGw{s{;AQdODg%Q$<aCZ&+lmS
zPeT_^QLyT!?mTb?XH(Ar)4Jvtr0T}du#K(CKon}LF}N0X&E<n0;ZJC8k&auag#;WH
z?-4+;@Sqfsl+3b=cTra2Tqk6*NMN2hly0j5vb!tww{ie=kl-?ZxRM_Df7UVl=kdhp
zCRg}$MeZ}E1+f;VyOH4HbAdR92w;V>1|LYz<BbcrWiC=~GiF$EC$oOEk6s^P^TD>{
zWlfd5YQY|ReE>cEL9sZ1;FE7Jit4q~+3zhXb;_LzE|Ko=>*U{nRutzh*C*mOy?77(
zG6lojLeS8GEIOTUw=D2-DlEV6?u#hwqC=(=-79%W?md+hgY!#{+P)R_flYhE!RKr{
zdBO8T6SK?n)8r~V2Ot^T&eA8GkDLOFK|`Lk4Wmf?PE=S>JWJ=Qeb>%Kj#d2=e|p{Q
zUE{Y8IU?0)ddO8zm+>Qetcp4Fab6Yv5%!&G2ftZZ@DWu{LPFZBb^84Xao0CpNY>#T
zjw~l_lrCLAl_DZetEq+YL^1Kes*OZ<$QO`5=kpuNC*Qr<8@AC)+|{he@Av2rN?{z<
ztIxok#e3;L$b%#^Kg!w6L{a(U_+*j6$Q3{)Rop?qZhZY%xTX4qns%7iiT`zl`skq0
zM_@b8DQ!w5NgIT-jxY5(Vs$IaINq{XK|!%=W}k*+{|n3m)V?{SzEn^4q4i%u^0t9}
zDYMSbVcz`eqU!F{Qk*+)jdLuOI#eu`ulMyAgu|0YmJC?+FiP8&+%R}s%VXt6`RdNH
zkS=wen`#m9qulNo!jA%uR4V&ib)v+pGeQT2HyJ%-oCr?&K4lj9QU$1^YDt`qRiN#~
zQbqbu!bZMrUZ}#T&hzyrYx3>_EUaXXh09<SACLHRw-c?S^s;Zkh1F=N{skCzU!+EK
zmINIv7#yI<MkT=C1E}}X0SOpj{~dcwNI&U6hm-~!kB)NaPU@23k@Fa$uN!)`VV170
zy_O7ki*!b!#Mm~!av=_$qiTxxi^EaWc!&isJS)zG7W&6p3r>6yCn6lmgSMQcxHm06
z{sn1nI?PrEMW<+IF#!h?eW}oXQB%v5wI}qb3l{HkoVvFLJ$G|jGKvV|N&g0%oJdgG
z0<e$+;g2w|YXy9VCZp37SjsEf{mgT1m`U*T(PK7!g$rqg++`pwLH{=WcUt}b6K<F5
zrc(HXm-#q|7Y9T}K1X*B&ZR0v%bT0#Z1Jc^MJ5Ia^AEPo{^`@g1l&ry1tGf(m)UC5
zE5d!FzrQCfEuix16;U`JDmxo}JF9=ZxtD2(Wk+KDCiTSYP44O3KJ=2Y7if`d8=|5M
zin_GLnO@BLK3!GaFaBg*coQt_A<;w<SjAPtE|)JX&hY+%bj8A6?cU7Y?QawDv0wWI
zvDRK6+Xr-~4sWNS8iS2%U$2VQZ5X_^LTwJlK??(-jPxdrf;b<;4Z~|JF&8!-jiU$$
zi`6m{+O)z*bvmJHt}J<RsU8R*qT!4%SG2lX{GJA6So(uT_?f05f_$z)+O@LsE8V&V
zAK^kA{SoPk@6P7DmgriQF3;>C;}e=^C(8O^Cg3awSco}*?O|!mCz*e;>x{IoXVtDr
z>x3ONj<)(5lHtv}ebdOX>R#0^zCYi_`ejbbWaNi_y*RA08&X*U`O+FapDIk)ZP|YM
zLTkRii5C;{B3kH9lBRyUu>X+|8w>to;@g%DpAMDl8gvXZ$}fxtoX_G`*w`0fIMk2O
z6_&QnR|XC2>s3#pbsg99?;|uaC$MA#4KhnP`Vrl$su8jPlP{&wzE`Njcmz&oEniJ~
z4YP+|=ib>5fFi<9k9=u}s4)jHwnJ#Ltn)v=t>u+DB26VIvtpX|3_As%|4Spdbrwx+
zG|l-~uWc5&eb1Es4?-{!w|FH@QvR<bi$T%aw6{fgwsN8?YIN&W)4~MJF>ufFthPhi
zZ)NOKakZGHQmtm7QZAk2`$rNIg9v1y+mVWg_0&Iu@YG%vC1STJhnhdXau1N_R#37j
zV8XkE0>kn(4QdvfD;)GSq&t%inQzG11)qtoz_&L|&jjM@F;}|7HKCI5MR!pXATDHV
zx8E{waqK&Pb_#m?qj76Ck?pSg%U_#d#@Q@S1=S;yizbbAJx{JFu&_wGQGZL1)4<i2
zy7}i&UIBvkzd(3A=08i@{%`qHMy*@>8LJGA_=d!W)G+6x@-dg|GQ1g1`)$^P+T`8P
zYbEjeB>6@9B^t)IV6^eYF7;ZyX#Rnl9k2oBZ7ro~UH~aqbnF+z%IMCVm!4x_zx7@E
zLuc9jVpw{`qqpaU{;J}O-?R(aT96!B#|{V@YEXA>S6EYRI#zwW*SZ@8-O2ia%nuq3
zxQ)nBc`}n-zTU9)4J@8IZc;cyeW)(0tifZdf-6r^brRUdTSMVcFXVM<Y;skEc1=?o
z80C@eqm+=-^`*6?v0oc1Q>In7zmiLx+%7grI}Le$XmDhaG-7WW^kGSL)|Kt~xCAD`
zN_|=M(H--V^fwW(SxmwnZ6@U{Hjr4ALNqBrzV&HpVE`0-SCl=X6n+W?(AEzj!9+jj
z8ZnGYP<fWV5Aay2UHR-pYV#6VJy)&%jVHWmZx(w)dlR&-hjh#CbV$1vq<q%##LTN@
zt;>>~^OYXZYa2<%%0J_Mu16FvC4gOXK)xBSHf)d_m#<k+liMY*xUC<eRu}SD1v{`Y
zT!dNDzA*Xx(V;eLi~;ZaJIAt$1a*#x>ly7Z9^JIYig(n8tEy@DpwUIV@KG~{Dn9o+
zKSjIQLWAe6VWSFbs138CmO`VB<F^bnTU-d8*TmExdk6dp^588YCQ_(cEb3J^-Lz5r
zrH-8kspy2QlUG39(>olqs<8(>4TVlayKB~`_ZVI=aFhLbWU-$k@Z8X&QP4vjK|J=9
zl^hY65&0A3tc7qBlTzacACz;ZR%rHny?~mutLch;W&`3?4o;$10)ra@m`r~vuG2Dy
zc;@t_UGeZYS@nr&87YqVxHjTaZaT=ny)si3Yw(`o$+BkX;n^2erH(*gxsd(b&s%bY
z+@bKSHH5QeASI}_+qq!+&J1qJP-(9A@D1%QPaSwb<>;yLk3p)!dYw-Uf~(gV$Z%Of
zKV36fS10b>&J7RKj=349p#hi1MMnZUfC#B^qpJk#bogHzlra9$kN#I?%RgBz|0iFT
z(YB;}M*H&)ARG194Z3eMOnYP+gtjkHs4la`jR)NHwtCc6Q}XKlkyW@M%DaEV=m%+m
zomRxF_oS}%j5cm6NloqrsG}#|ST$$DHn$*^sq~X2TO^r;T`e#kW3Qrse*L32Pd?S?
z#Zkw!%C6TnMHPQq&DY-9lMav}WOGJcv61bn0Cc%nz<RuK@C%}iaGEa^c%zsl&uzR*
z475p&vc0Fe99}jqR$Pf*m;>_X-_>%F;Q`T8`k$S%03AWiH$=_umgcVKtB>tnE*9?|
znN#VaPQ*YzJ9Ck32@*_I9p%sWU}vt#$i7pyEe@|)p_dic^(m}p&8G!;7EmX&0rBW;
zJITu8&xz9h>0f#YI60@TXl2~m?Fuk?OGvJfy7#eL!p4mY8DDjr`E)_r*BIp6wxlP^
za&$HKodruCz;-@iZy5Toyg*7mS+W`|ZWk@UYdL_xsf0OSYW6r+P-Uo_lzGD3Mq1OW
z?4Q!lQ><M!SRHRo5fWp(g*vq-9BX(zm)QKS?%f-wdc{u<GI^VYRT0D}t`7?%Khrdw
zbkpw^nLi+mAx!b7r!qlaS>CMgb@~qb?Ao$yH(o-@8@Pl;`GPXCXZD=LcYNqUo=pO`
z&6tgYZJoJlPpYQQhDe!)rvZJ=rQl@dZjS)ry2h{Rid~FO;wI|S%$X$XojbVtl8SPs
ziubcVJZ6z5Nss!1&P{>R7gb~Cr9agn`pf?pB>MlCKQFV;>MVIfv#gY}zIQJ6T3s?9
zdDE`Cpg%%{^O-z9Y|4`-KO{#_-$ixQu=}}6S>SVNyUX0G56z*;2D!%Ut_|X>V%oyO
zj?yCBnKh;)i7}rv0`HSl+^xI`8hZd6bI{`Iv)JHW;rJaoAX)zk9T0#`|KA@z{#|I3
zQ41(nzfW8meVExsqD|BW_!Mf~=zl%O-yg;AG1=d}iPf*~xR#C<Ztkv@rVi*!PG+{a
ze8RZgxabRFVz^vdKF*f7TxzE7?v}2Oe_yz`l^2&w+0@<D#v9iFmzSH9hnHVaNDw@f
z8<*psSNXXGIJt3+aJe+CO)YF3t#J8;z+E(OB_#fOL4NdO{(3=84>R|R*OYfKwE{0K
z?+9Mm*~#A2-4fT`)dSq3Yh&SVjmsk-gv%voX=7#Wj?2f5%O&Mx@8qiKY-$ef@zB!K
z#@tdv_5m)}0~>cYHA`11CkJOIM@vU{+<V}SD4V+3;qu?RcpF?YHum5Zz=Nc;9$K0^
zS%AkYSvp#Qm*7W#5EpOs&j<AD+pk#&k%El84CK;f2;>s@1^G1zk%C}hUctJ8iG_6q
z3mY2?2bTyJ_v%$#5&}XzqFW?nWVc9e-n>o4NOPNlp7Q2RT6S9cyG$&sEaWsC+#Jl@
zjLd*f0G{L$Ha0dc4(<(H+#AfdZ{BA9AOHMnh7jXGs3FN1m+n9=6JNq0zVxdVLId9C
zl}i^tkUu|{E@OcAi;Z&?_ZqlE1rg-(B@B$qm>5^CU}A!M`-8uSU=m-sPRApObwk}0
z`;H3<Z(wv94*i3Y&!ifIy9|70u0dCEZ{8v!zs-1;iJ66!UqDdkp0J42LunaVIe7(5
zEo~j$M|%3^7M4$}tZi)F+&w(KynTG1zjzrO68Z`r6B`$wkoe|pQhG*aR(8(E+`Q7V
z@`}o;>YCawEv;?s9i3g>L&GDZW8>exPt46PEG{jttgihp_TD-uuAti&#R7!j1b3JK
z!GbfmyUSp~CAhl>_rU`M3l4)r2<}b@1PcyfV1g6e<qn^md(M65RK0pt@4rjI6njta
z-o1KBuixs`-FqjeXXh7}SJyYU&vYRoApesr_~$<f`#<QygVTkCf`W{K_DmNdk~jPh
z84u+JEhj3zga(?KD*+u>2>NTu<bwL%m-O74$Aso?Qy4@5o{cvr&!qi>vj2C4h5mn{
z>^}(m-*hb@U?L;JnTL#rAck<Ewv_lNuNKpNI1dj>7S=}dbieSa)UAuXQ#}6F9B9QJ
z&>m<1(kkIt9%!Wr-*9LTE3o?x?(dGiJmG(6dk*D;=I%95yzgo9P-gEHE~%Rz;@~+t
za%Tb6cQE<K%U?tM+XcJg)cM{)h$jiTRr9)e1Scp&Kj{@%8+IF+Wn;PYV+;`x0IBMG
zc^D@;$!2Vql^fMgLu0JI8N__}gJhN;xyHX>rl8HnUg1Pje+{SNzV?J-q1!Ys@fG<b
z%Q>@kE@Y7k_gLv;<CZgF{6<}E2@9ErCp6oM-O!4{osVXd2j<w1qBL{DgwSfbzW0Z^
z{RXQEX?kbu><({Yc}5YevcyRNI2DBXg*KmSIz2AisImep3=2ugScJT@<`5C;F<uVI
zlU@;C1s}>iApjT$)-U(r=cj4teheBEJJr50xkG}-w~Bs$!6BRv5UBA99(i1YugvD2
zT!jUGo7*_!+w@xPu_h&jpMkXgvy1S0+i1FM_Uk03o#vtp#>z`7F_s?*X?2`vy%{tv
zxSU&l@eh@o)pWx;*WZs<n_eDf9B}M;CrJph1QvpbHb4?$zTTt~2+1&O<Z@Bod!?>x
zd$Y3j_ddqk?;Enm?^Fidc{G+xhY0-9SFm8m++aD<FF4`6-7l{bC7P6~-Non5m#tmN
zzWZ7Mm?k7>C9IHvD4PrOJClh4x)#3^U#|N^fnxvIvxvPLSF+Mc`kSn7%86Ww{lINP
z9^ibv@r3Y-zpw2>I#I$y)|PS8>_+KXv!hD=VF0`6eS3)Uh{PVtUTtC!)toTsINxaM
zE4fM2p021|I!<Q&(Xz19IyWxbSn;X9I;vX8BaaU`RAl7mmpet{b>BKHevPk_OZ0f3
z0@By1rVAoTLxA)Y@z?W*&d0;z$A5CoptU&f2TPj<r}b9!mIv@r8ThS|wM}UUd}uKF
zBz_;U2E2aAy;rb>9`YNXB&L_Vx6M#;r>t@ZH2wfs=?fT*)ThpFdymPYO5un<)ZZ(A
z*6o+)k+w;gX!a=An2I?yr<1dy|0oqLCn80G{Tq49NUPVFd7AZ2*IWQ^^}?b|A{X>e
zpI(u25~_Y0Vv6`}vd%plJW>0R`Hsa#lw!8#@W|U&*H{6(`fc0$Z#EuS8~na}*qG%A
zp5*XZo9wE8@jPxAzB?b5l<L>?LK?y1jGu3r<>`Tpq^MtoU8`1oSb9tM`-6yEe|?@G
z3#H^%MdXu9D#Add)piZn5dpsXq>l5E*E!0Vds=kK69;48Wzf1~Qf#5vMng*|dmN!c
zBh(u?-aSWmDZh#OJ}I9dc)9j5UB;O91o<*4Y$zDJL!tnS=uURl8K3D8*4$1&&zOl>
zN!v&G0?`m*xf$0*@b(Ge(5h<p7d0BMh~ViFQ*9G}q>%i}@8g;_tH)@j5Cz7NB<@cL
z9|LHOOzv3{DT04yL)GpHC!Y`o=BK+Gy?eS3Od75mhrV^6@Iv2X34-9Ot5u=;aF6>_
zXJ3Bn?EUpiEok?EqXjfEhJ0hVuk@_?&6u4*At&A_3DAWiZ~@h2LLe!rGD$oM8CFdo
zJ?FV!*7WoI`=KHXcVtR`xnrUn{YA98Dwp_VOGVQ<wtXJ;saW$@M<wO6D_;}GCZB*G
zEvwBgq(ic<Gjv_MKfflT2f-VM&Dh$We^<J9@a0anKoomcX7X-X3#ieOdbM(Ie_{gV
zt3RP1NT{%@-dd7LYp9oH5V9HF5$hO6cHabq{CuH~c&YnewO-@D8b9rz+2B*j0F@^M
zr|w%2A@zUmeQ|08UHI04|M`~5|KpB0(W9t-aG%mK_dx!lF5mRPr9v=8pUTweYt_`0
zs@4e&?6ra95sLYV?s~QRbP?Uho(A~tu-7be!B!@*8rK<;jmM7X#9~XgGO1iE8^T#^
zMV9izB(xtr4NbQgpo_p-yP11|g59O+iL$btCCAbd_x8#5&^h|gM&qQ-KvIV~l&w=)
z8|2<#docn#QS1}B{@h?$n@_i+e{)ePI!Opa^!5A*KcJyd`Oy6S71gh{WYG_|`pFj1
zo$fkMhNXO)QGW%J1Jc!Bto0U=W02Z+M!K<0)s)>fiAX!mznZ!1)OR!HiBf7%Tt}JU
zKoBX|+u5ZUSJp_ha>2j{t@oF=`l|l5TK}<O&ptqNu(Yq1ykf+P)(xEoR|dhS_Rs{b
z{my8{*ORKvajJ7wxn#fJ4-meSZe&iSA$j<1%kRABizfEg#Nhe|wEZti0PinhsS+7S
z-oyM<SjkwUtoL}d+v~8Y#Gsa1nuq!z+F)zjm%rcJi=6Jc4Ewsf)81&lNlVj4I30v;
z<spzDd>Xs@uly26>rsp2>&E}e0KPe_zE`nttvP^7##*d+jgovY{~r1!XNzAQ(eQr$
zPS@wX-p?-ju99-&m33Rcnj4-Qc6Q}z{7^D^1mHsXDJ2Azui;en0G`(0k3+T|Aa;`e
zsk^K!ck7S9VSId?D*+}KCv^xZ3MvQ)91NU0`72R>g4QQSAXP5ce(*_iz32B^8(74v
z3QdV27wyfIs(yMN#QZyD!%6F7tpQ>kccmBOIJN-I0hlrW`xbdC`XmX2P?oVS%Anbw
zBnLe3+_2q-;@D7uCVNQ|p(6yLK7=K{t$N9o#B>1!|M>y<E*-4!DJ0%v_<%mNR&AGu
zaa>ay{Ewj+|Mt@Gc__wHqW_J+HC~*9fc6suVI#oz_-}7Fi7-7wYf--idxfvvwC!yN
z%7B3~LYFHtE24Njr4r2wf=;dA6c42q{K%eel1FYi_o{ub?hizt?IUCxV@jm)NseDD
z@@MEBBjtReU4FaMP1yxl3Sd4?XaZ+hvHB%kRDHWu{|4p_ogKoH!u3Ivjs;03dHw$F
zuKD<1)DFSkXRrT}D8DZ|I)EJdu2H6<zw1?t+R?VLJ7$Ly$O-hZ9|@i2<H#EC9S1y`
zc&yr3elG%dHi#miw(NE6#ryE}KfMI?0Bf`>E7f7F;qk@P;YZZ__p?Ey`)>gFYd&tf
zy&Vl`>B2aCtj7QZY#=5A8i|fcb&x;+V5W<~rgxK5{~A1p-q=YWNs-TN=w<=P^JP|`
z7qBwLdG}D;MRgqqI_=OeTQl4f1ckq0oQbC1QJO1_M?8Dm!>+1lN|8pAxCObBy41UF
zF25cU=wO4=vi+(kTgs01L~{EOp|4)mx;65u_Q%9V?mEYt6H%7O@f5p9fTL0mzo1jD
zt$RjGeY-UnXgR6pMQ^4iMvL&4!bP$i?Y~1_JY4@72>lZ-{Tpii5BNsb)5*fa*4gPF
zVC~-*|9(c=+0o3_2@cOVFgTwPn5LN%98&%B^7+=kZcA}I-(%<G<mcnz=YT^vc1}JZ
z9~VE*KmG-Ba0_s8@;yH<#re;IT%5e{0^IO|T+hXL;We>y!5`%X0=b^cslw}q!#g-8
zb9S?I|Hm^N|Ni0O0|L3Z;e@htaIkT53Gi}qalw%o{ECB(p9{##!N<q*FF45yhiLHH
zWPCi}$P`}7Kj7a#K8*e|dW5&*e?*V}#)<+w{{a>`;cxoy;G&$HneTs(7yktZd7ojb
zCdPjNM%iaf`Y*@`r}keM(I@91Fv=qLBDuP&axI%}6!eMBo1EAIvy^z5hrn(J*AG1j
ziCofe{Zw+zsbR5saW(iduschD`|R$BHyerMr@*J0ni@>RgPrT~EcXvK(KP6x|M&O*
z_Q3zYJ<zpabI|!W^+@hn*3?yPK9>eb<nv6>tE`(ybJ3!QE^yhP3X@-3`5$#~{^mYK
zlfWI&k(hb-!d$3ehh)ALY!&t4BNMzFO&3?opQ~%cT0TNY9!2`Fr(1^CFC}nMPTmZC
zY1Ll8x~xg2J^vYg#L;FW7%Y)*HyV7g{-CCciy~o&a~}LuBd0Nhu8Q*GclVc$qu?oV
z<B?#q8O-Zt`1iObsOO{$3W}K5ntvjP*b*7O)zC29J8Pi7K_7W?o2Y(%cK``6(e181
zd)~%ea4xgMW}5iCwsKb1LhSEnGFa-PKD<oyJA71?)KebFzCMa0&+Y8n0$V6c4Q~&J
z%KVmm@b}v}`)*12+X84g<TWu{f%2)0Gg$R8<d}$kbs3*Y6mO2l6kue44a?NWf`8OT
zCCJs&RUb9fQ>GHOtJR5`PC_4KprxURj{UUEhXqiIhosnR;?&5~JyU=_OHh>7;^N0~
z_*?DpqL`9wJAUbxyaTcy`mN390fLim^@k$QmeASf4vP@y{+)U*vTU)zX%VYC?J&wK
zE1xigI84t}8Y0BC)klA(eaqM*Hr-?q4zGG(I|^G26AMIryt;0LrArxuhA%RZc>9Vs
z&ch@wq4InZHVY+aBr#7Gfw#Km9rLODdVb)y*<$NJhm$LM$KBfwX5Z}-oTMj>QA&7q
z^N3E)CiFTR4K(eP`QgTQ^m&_7?}FFV$S>rcsDA)>waKYeE)vx+;2ggW`1w+;N3R^}
zYf4z9SdzOGOKCU3Q8<#nth*m&T&u*u8#Bw`cadoJ<T3kPbv_R2qsHo?^8+iJ)I~-7
z(bZjEz4W_^c&Y)}Nrj?}E-KApZ#K4+dw1ZD6nfJ6!@j!rGe5lKLt+YYrb)(vp^2Oz
zYR_;7^`V`Yyi8i>$1iszgF~mK-c8B93+DP5cWTJ`_x_KJNu&^*R8cg5NU~^cvq}4U
zH$3Mo&iPCPIgfX@{_!`f**o4&)7OkC_Di%<q9uK?ps{R^C)hJn)ks&<a?yAiT9Ym1
zN_Yet`sKguT4`P@scT?HmlS<~26Nu9>QmlyOI#$Qz=h>xw_ha8;hip#uXn_ltdh^#
z_pt(;{`_-?miZS$`U$U+?z?}bQ~C1q^LfK}B7J678Ky}_-_`1n%+SY(_wj|ti%lMb
zbz)<UW}DF)($tTG5<K|$4B2~~#u?I(U?@rZVz*u@(%a`J*F)|_=1fQxFIy5L_FU5f
zuP*;?i!kEf42e0cKSjM_Nkj9k2w=jw)CdkeQ&6FnWnCmVS=8OUl<U5=38gcqjEAfD
zHRjJ^jl{>7UB-~Tv4rce;DF#O=lcn)M_lz!BkvZZK9E@FD+UxNFEsUq;gQDI&waea
zhnoecGg4RUAIaom-oAzM8@kbty<W2TuVqn#-}*gr2pig`_;sY~)Yepprr2`79u=Q{
zwh?6^_fe;iJg=TVj+<x9*BcifnWv<kTcC);(IQ~X;bq1o`9iR0ieyzCy=2>uIA0>U
zz2^p!PZcvVaCV&hs{XJ*QIDNHjv2t6$UpP4zZdh-L0XKGloZioMCr6fY}9yol4OXO
zD<u4T9;04;$Q+1*!!B~qs^0G;_PL@;^$hhA=Wpq=AK&Euve*b-o}Q)AFZjwqNAfN4
za&hE%#N`%~`k?l^pXEmq(r~>tH*8V}k6abGkOj{yHN3xru>=dcSM-3hy!>^jal5Z6
z;w|O1i}CjQ*0>$xKV1>g!=eI8ap;X0LZ}p$kdf<*4Ng@KIDekVvj^i-J*YhklYO5z
zXx|Hr7^i(5Da?W5wBB~nF2Ezr#umyVD?xHelYc#vtnu{Hh)CmtQ!@^y<tRP)=qXyk
z%W|`*v20&Rw-_5<$rF~7rFLp|0ng&7pT+U5wn$dr)kX4Wz8so(fVRzb>RyQt$D6`@
zsI&QIW%5tz#i-g3Iu%!d8QJ@GtU(O%63Ksvwe&o-ngAHwo=kCa9`!IlcKOgz#Hp+r
z@5TA+F{!!!e0oRk@vS;ljeG+VXCCAwpk&s<CLKRc?`vPTTk4Vr`4ikONnl3m3iyr`
zboX(rB*X&!`X6@V50p&TEV(PbL~{C)5X6#@b3;jHt~eh;y9!NeTTzezT4*Z-?jpi2
zJGb=wE!G>Hv(BDBPoCKWC>Ha{uAYJ=7_aq2xN{tsCDipwkoMcM6ZV(as}u0b1t7&6
zr5SutVn!t$Wd{6xz`o))Sv+TcmBbUTREc1T`P{z+ZH>tovK@-6jKZ!Y^gD%o{Ks-n
zJlPObO^XS{FwQ(G*rw0A8mZ?Se0<9RQoxCv3N@ARB<YoCf4|n5$|ou;Pq?H?Q$sMs
zE#iZIi3`%TlgDuO&5#^&MeW9Ea7emH-ARd2QqMDPUf#9@$cXmtZ$3zKeV#>AzWNQ`
zATf*}4@>%z&l9zcm^biQ{DM02*?epKym8v;q${UW8=oo;WWH0)@v#6Ls_oJ_9)38t
zk8`z%auw!=knnRQ&quHwYZ)e-v*7sv?7FS*C|*h?)Ln^Fx-vre#*N&00^?dOpG81)
zsYj}tn`*mn71z6!Q?q@eD2w~psFOR6OpEzrDG82pd@x<SiFQo9H!O<uh~C$hf1xNT
z`=MXAy)Btju1lDx=CktiAS8|C1vxF$@boI0Q6T)#@^}50fd#7;8jtiKUZ5c-Cns$p
zvc4rpQ6^v)NW<AZ7FOvr2P#dpn`15!I5lt*X{CcZ1BE?Ty%UC|+1Hg@vbBxAmD~{U
zPxN=fvdX?xFX%E!YDMd*2`-JhK4ye#9!O=#=Lio;P{(x0+8y<DIdxj4=bXBXi{J~W
zXXBwrI7skNmPWspBe+B@B+oqk-4>}&E&wGaqc7Fk6wQFl4uz+L1*HvNci?PZmMfb>
z0NiNto?3jpR2HKGlX-Hd<Mf+&562S}Bzn8SMNR`@H0b7W^j4(_Kxl{YQxaqkKSmg6
zPAvL`Y@b?91;t(4kTa{r+^xsnh>O%)KV|6s!(BThNLKbF@{`N}3d=>ZPf-l=e%EK#
zr`(POxCt@0FZ|2A_M0?a3EUB8FCezn!ZO|SN1F+&iDL+DG<J0KR8&B~)`9co^l{l`
ze>cLTI+f<CW@S>1b6)tc%~h9N?z>uONV%xPv<~}~`^(UUrRdmh4*p2gL(Pk+$XX2<
zE@4u#Bis0PP7RHrVuDbP(11+!(@bUcwj}<$*|p=|GD8lDfB;@T9SwOt5m~M2eyLEJ
z#L^Hmst>K->uB$z%sG;1qS>O#&--7k7D3TtbyFe6C490D2s~uFU5J|%V?CMUD|oTy
z)2$l>92;XOe;ITeNDGmxEQ8}OQst`l`#5#?5JI+C)U!k)3-cqua9wzhsd7=jTtqd#
z5r8*r+Sol6<FK{5yk+ZQ=&W3P%gGy&sCBuU7R1L3Gs(pu%8IxB<eo$zpMS+^oGRB0
z#Te_~Oi1R?-6K(q@^~3a^Nr6TMeMbci#b-#^>?L~)|+pT0wnj@eJujYR{>vIa8qz2
zGm${bq@nT*58q?N#c3~DAO0?8j-%;p<_4}#)qRf&6FEgZGd7{5lh%LyE5}TW4rNK)
zBR5f$V+<}5J1KL|(Pj_zlW_i`$ca^@_QI-XY^QGU_0I2Fq>;g0`cd4H(inrlfm`;R
zJB`)m*m%=G?YgB#$hMADa-bR2bLYWN)rc!8NHgN_r=J_aF5@-4KMCNm8jy0-MuwOs
z;G!s)pj)474Snsr>NXGyl{)wfIvL)wywn`Oi0%bB1l^Rg$?DLDl@~4Bq}zKe%1h!7
z5J_-(Kcr1H#k*2#N6?GzaYLpipoigSvTpsG<U(CPqQ*yrIYf*^GpO0N3Ocy3__B`f
z-^{>uM4VxjKMIFS<Hbb(0M2)0yt55f(dp0{{!~+)bo`KsZn*xM*cNkBd~(<)+l&Fa
zb;>V5Ei5?8$dm?>(X<J=l!SPBd9xU`RFNWR(&*!vrWqex6kYQw%JghQBUILeo2Tbi
zUB4P8SZ^e^TC^N}jr9i<{0Qjd*WMO}j}Toc$E2?mv-ZM*bK9ZiByZQXERgw6gQiTP
zG4ODXBI-jx6~%0lI)L%CE25d(DeBuG%^wVe5j(G|@M)-S<@=b>M5ag2W@GdyIcn`Z
zvWK23vFeeNX`*X^ngP|L72Qnbp@SL;73NuXJk*Ol`D^VJE+#&GKFn!DJmaySUt&lw
znT;=$-AbC{1uAqwYJm}%sJjF-wr9+5M3XG2heOIww!HPm=qU?SBIS~zo~+Mo(;v3q
zz}>@>ImvaEcAmybcjkPJ3p;2ui%K58S`*!7y=2L(nY~t^vG*WpFY52uQ&ARYq=0zF
zOI=`G3sP3-qsvid{73nv1r>7L3KM?HqH0CFeOZ<`?}1(Hb*rIZb2qp?m~j3k&&i1L
zCfKyi9dkU<>-!<$ddA1#aQDriGnYe-en<;~W;g9pq9J8#p|gIWVsgb8BU8#b4%w0$
zq{<QuaC!kb^AVs(tp92^XN6r3&YRcYsBhd=hPRtgGTr3+*Qv_DlZ}?Hsa;iSmHGRh
zJS5A_wgO(v{u^~XG;ovfA^mkY_J`VtEPX~iv)50_Wd`XFwBP(&sLTSDuYWTS5)Ny2
z8P>i8&u-Dijhf<^h{ipA#C6BAdTzRmG&XJ4W~YHmxQMVYl=#s+oq2d5jK}=yl5DeL
zY0!nz?61-IO+W80;1!;Ak}{1JXUFGpA>GmQ9X;4l`YZ4AGUV(o8=A2$Cb&0!9c%Wb
zGuckI@Apn7dA|-v=wFC}lk)60pDM1K@G;x|A;s%IqV`-xiL8G<Y=^V{!91-H&EjTw
ztA>Uz4+}F5c=0EbZ<u1sY`-r$!@tLnL^@GIrX+nmc$&9zNRrA|rg?V+iwhmz>X*_s
z0p;(yHu{-sHJUdGi{u|+nb&$L<e&<9AUX0c$HoZ+$MGM`+<>5-%_ffh;L)5%Sd4gl
zvIq66_xgR*3tgWjk##U$>NFiV`D|%X;jzMXDau+)DsXT54V;V=`aq$6e&E8UujZW5
zzz>xcxCTK=wKJc-^ndFoe`M=e`qW3F*nP3ze$p3kC$;ux`=mm&5$95YO<`K^yUkl#
zwVHTA?Es(JJLwFOLQUN)Dd$g#+70w7Rhp~1HFUIraL&SHt`IajRpz#?WijHf@P>Wn
z6nQy~7s<73rFjo;y6l|oe!cAvmqMF(*++PWbZ4rzRrXQu&mR_~3WwyZ#YMX)Z^4-;
zIgtRDInHsdA*s$&HxZ6-xma%>R+kYmX={;~FgTPI`3%g@&7_ai22DltX=n9vF70v+
zh_a}*`;|oBPI<QB;M0H5YBXxg^me4x``H|E%9KAg^WsiZe6jx={exj6-((*Oi$;|5
zq3j}vxAAkdg?a@?(AQs-$XqZpuPsG<7qpw_*RVmvUdk=Y<1`eNVktvpg}coDMEXHD
zJsYEs*8Frg#C4Gk`bp^{H6=)Hr#@Pr?P@R;2UI|lS`~vm%KLYVj2Cii(xXWK5G*oJ
z&f=x({7!&OGXK>xS~szV`!#B>=34aza3noFqLJMp$%ZPR+TR~645KXs|E^7($0U%b
zz9F{g3T>1!<?OTuW{tmNJ;xgf_!*T@BN*3?cZI$u9^i`9u45taKCi~dW17<UJA@fR
zeQc5kM=alw-yt}o>QNX4TL6SMyCUu9w7-Q5?dBx6%P?CP6~^=AD^5f(qoos_#jvI^
z5G^wv-i3CsVT4K&5p!q#{@a8g$aUJ2r(>`x)2eX#eU*!!{j2P%JQ{fTrYCu)aas%3
zFT$#Kk@U8fi*gGKZa>41oy~j6!iXUbC3b*U*mbC6v-Is#3636@<#kj-^JTpF&OkFJ
zMpiNjRuZ*yWR!;TuSkBQn4z?vUg2b(G#w(I?z}d<k#QF?5iNLvTIfy76r_L0PDK6l
z9!BWR1HgHH#mFm=)Er`&4Os}3qnC3p)`In_ta2@rBJH{|2TSex1}WWXA#%FBRKuu2
zuVMJq)m9;I6wMz-7N4?$x3C+wP^3gj7^of5wtMN&R7l>8+?h~ZFNyztN=3tM8Wpa4
zvOH#Bi%(ozVUXA4lW;uNm;N`$OVyc<E*Ll&t^y%t1TX4!C9GB`+5pIlLTCC@f^_O^
z{wgWbD}BLx$Wn?C_6Q(EX+SvTs195C?ErX@3d4Jg6X&BR+%-+Pd*EO>*3XpaAeXx<
z@16fV<e=0w{bUgHiI&o$=vSvecPW-JL<jQ}f0ozm*R5Dt`MB_LRNXZaKPn*cYHG&3
zPTI7!<K4TA#P6_8O<y$=m3)CP){6?9IcmMN>Wmsl&ak!))$!;)uhA^6ADU2T2*;Sj
z;Ke7WLPxlyy+iD<kQT%A!~*xa6)}@dsTe*KH6K;^;ng^6$^@HHX|_@u+hTEd%oswX
zh{s-y5&3*OP`g(ed-MHqo)t#=EA&;8i&$O2+$3cyxvN1$6x(|h%tG+jFXW5ZINqjq
z>HHpzQ_|0>FK+h)<~8&L-XE9*h9Y0_59I<GGy|mm8l5+5*vbeRl=Cd`>rR%<{&d-=
zYm7`mA~DbITy7-Vg*je--b(>U5D`SRxKqVQZh{vVzD-YkCc6WbIDOX7+T`Rj=1pPp
zFUDSV5nch{sO<_q5k2FmxGC+)&lp4>k2ZGJM_e4^%h02u_#qf8eu`F6ytm%YR@+`v
z)yIQ%OoleB?}SW9<kF%XjYgElC}aU4tYXYB3hz1dQFQ|~db1#DA|0o1fB0PQ>cew%
zaf(*TEs8&Y4J`?ar)ImUp4|`WEh9tcC)KI$($CrnTW(So3H9LajY{p?va=DV@@?Vm
zm#$M}uNJZS)ug(L+BNXjuU^q>1L`{;>Q&ZYu6JI6w4HXrFGh+BaV-)7qLx0ezW$<6
zkdy+4+$SmmCaH0LVOhDNm-X<KbQR-Z^y%l=PyNPnvyFzLKv+kD(8@k0#DQSmEqHUT
zq<c1htvhVl+A&RROUg!@-RF|++gn%GFphhp7RkH}YYbnISTDB~&QI(r+%s`=MwU0C
zM0S_uTA|TC%Kk+)iB)MrLxrgWXgUz#)25z17dfLqc~rQ283(qbZEg_w9R1k36)lmT
zzb^hmKGsQ@v1#Kgo}0x)(S~mzvr1_wPa3D8z5}upy3YM*Y+yq}CyqK}4DcHpTJZH2
z#$FNM_%^=xxE^B1UjtA?w7$2g1b>uJfF)rceX5*O5bd+u@*-lgEYeLR{YQmgh3kMf
zWJ~R*#mJ+ltp(kBWc3(k@@00yk))a(YkBpQvyHfAc`14yZi?Piv#5hf@BXQBG$1+V
zCE<m*=@*MEerOo2Fj1)B*oxhdJ>DQ&{;3jG>di;F8p*We^v_bc^1iiWsW>oeDcgBC
ztbxWw3RiMXnO&k{KgqDw1RzuF=lsUC2Erb1eTpEQ+H1!HsHNJ1d2S`iRq=<Sewq^X
z_~G>s=gQN7rogVf+A0Qy#hUwia}<29XgsY<>Qa$U@xnyO1j;Yk=f>@ZW<s<SJe5nA
z)ojhJ%Es*HH0-gjvJP}3SKuKbVjNfO_I($R^T>diO6SKcs7<$$Y9y~yGyfjjiax~|
zcV~!>M_Nquq^Uc-QB1?Gc40hWGIlS?7;yv(hR#8eFh7R=;3SuzMsi_rB_XUR)3oAV
zKCZn~h^VqP9rit4@Wb3uX8m2GtrGvX5JVIohOOd-xh?Fw?KP}!?I8p2^}*0};<3v}
zxY_WYczo*^KO~u63;i|BFHX_ow}HlANEhf@z{e-;U|Pc0PRc-(#-R*Ce^=Ec_S)Va
zPQRmyNpkIi{jK}OJ0k_mhUpVAz<oW|gdFR^hwnv`Y-%Sxua7gUa6Tp81RdE>97Qu%
z<~^ZZY0O<bvOR}&Uq&xRKWXp_Y}No}PcKTfOOB?xqg|9)T*tNDik3<sznoW>%Nt1-
z?~Pv;;I&D%_SP{w`;bv@mA&ZRLI1w3S0Lhm%<|34!el=6&)EcZmQd{bqXZp!Z{?fF
znxrUlSj*jOthSBRZP?0$r~c`)GsR;m_UnaQ8;`NHTn;I5lm*3Nw}-JXv9`*xSscY}
zs#s0?QZybYypOZMjlZ82%bhKaJq<mS>6h2eGWax-cuVRIBab|;>I1gECwcK&57!Ce
zM##hf_;hE9GD~QBQUB`>7$%v5r>)<*x1(HDS4q<?IDg~)98(F+?E@QJEL13tcmr<>
zgOeYTU6tv3IK%qM!_H+@C}8i;`Ig%g4&M@!>VMD<*Jv@15;Y`O1Sqly(WvS;7B?Z?
za?FS%M@<cXsh^YV+Qlo;+4V5ZU!?7mVpgz}ARgSO_xo#0vIs`K%KNP6Gh>pof9@Yn
zgI*Y>w^o7wVy^mxndhjo#lk6`zMGRb3x;~cE8)D*idB6n?neI=RaV<}_m>a72I`LF
zpp1IIs{gWnUUSkmY|41YBE{~L)vvZ%Gti3JR&uFMoGitwrHX9->N;!Q2zF^PJyAp<
zoAE>N02OD0-JWICn=u74xSc{Y!-@(FV_qLj7o)7?Uh7Kqw-LT0&n;4!adH`-@b#gG
zV2U(pu&v+rv3)Ad;n8uVYWnuap@2st)2z&5z9u*9i&+07Bvy>0!=RsxNHhG;<U4ru
zW`Z(~S?J)CTspSH)1Zhp82?imb8R1GQD8+6jZ==lUB^k@C_F&aMPmc?*Ce78!Errz
zQ%d(HXMm0nf@aoAj<!F4==|wI>sgvj+x6P3MF46RR%@z-QThTfG(m$^5^K~x7G(rW
zH9C#yFvYp`8>A7+73rbb2+q9hnV7qDoa%p1`iJs6eGJ&JI6F0@Zp=|^-dcx5U&8AP
z5}qQ*gMm@)IsiU01V--%WAV9Gp63fuAaiZf0Z}Wlva|+4dU3Ig_WfrYTt$jgU1L-7
zY00<_v<s_U>E6DYqRwJ0e|h8OL*-Ck;T{-O53De=?XlBR>9xbY`5%DgJY97>qB3ZP
zrWoH(Qc8R+QfL*wUwR%A%syV{UxBwM<Z6{Da@&JjIBQanVdSg7*B!zi0~BBQ)0b)=
z^Wi%JruFu%v5tF=R%P)c=usXmz5NE^TQv1&(YMlm`}AU6xOjL>@#~?1JTCDIEyhBP
zVTuknp^W#`$H!VQ3jwW~m8ru?to$M=8UQ>3UPCRMvqCc*V!x@vK15m37rbg;pE~7e
z^Ik^Abz%2tr_a;9{{XAK{;LDx2~RP`y8yHmm-tL`%#vF=8*{Zgi{_3DG~X_{wS&qS
z8STs#Bn46VrM?E~4MkWMxu=5`43B_CV4KtAqHepfu_8!>8k3^-?+cy%RzKPA(oq$?
zd&FS4;r64ul|7J}oJi>3aOpLp8g9u*z+4%q-gC+2E1co*t59~Kp*%wD?ht=Nu6c_6
zPAUR9+B8u-#v(EBm$|batI2w`*mn}ED=JF!LBMxITw>}7k#X+Ch}99_g;_gJ;?&}g
zQO&ff+W~T8UOOr2HF|I6G*&Sj+-};|BdN*goN-ZHjY0wqrH9>9igvN?UNUM?Sp0H|
z=BC)p-Bg)Uw;JaEu-(vIAktD{0)Rc7o;o)02KX}bgxbfi#xNQHh89@fp<j+<2cVa;
z;*l-Bum)5nI`~^2MT3l34Q^^cU7I0>H_B-#$}m}c_c4~mDG{OtHgN|?0p0V+fe;og
zwasvpaHpA0?E)bj)-Fsi<efg@|HK@O+)2mGUnqxSP{fd6M9b|(u5wUaSChEEfBVJx
z5^@sl7Q;fAZ_$f{XWQ71raO{Tt9@WrR&aae@o;_MfbzY}y0mORE1hlUv)a)jI1PSK
zw_J|mMvOk3>HGn=8c_)CoM1~=X@xnT1E?x!oO54>{#)dJDE*Zt49jqKxh7)mW9?KB
z^}JQZs=kGGalwi@lex25EH*S<nbseaWts#+A83-Z^6xp*d$mz--gy9YII0H31+{b-
zPvxFGdWw($IW-7V;;kF|4c%t9v6+k~yItTqmH)2K-7#fuDlW7?fSX7JG!makKfp=&
z%Lhn7%RilISMTA?T7;_WRe_pGPNEsH<U$~9h`Al_SvPbmN{i;Z(p($Z&wVrA^?4M)
zgMKcTLj5IC(YLC)I?}8LPolC(vJY9Q?UiJvEESV!hJRxcCBf+55pN;cYLVs)GF<;&
z@>NT?9Ur(5e~d(Nrw{^l8n^L+RaWYkNb|YYGReltkqu8ATTKC@SnGxOOABwl78GmT
ztSOQ-eO=HsL#F0C=J_I=!ZUKaW*3z1?PGts5OR6xG)5nVoT2Q^%4)gD`Cg@JODt<O
z;4{gUvTy!D-J41V@0wH~dT2|YJR+i)h;9iml2!o2F)a^r8Fi?wA4y-UEtAzoFx){-
zG1tj}31K}g8|F21l8!?E<TN+6@TwsBkD3G_Ijl1<tvTU#N{l3nDSN~uXGl+y`n0>S
zk%eCbBkC|ZqEZkRQjzYo3w^Bmt3SBf!_|{Lq2mj0gOwNN@Cc;at8>Fu9L{`#`}avE
zn<RF2qf?E%)E7e{ciX8DNh&Qo@_bk5&rk^d!;Fs9Y`l#ha;G*~ZK?pFjRj+9(1?SL
zEd7tN0Gc;i<yaO83E>ZiiKjo2Y7a7Wxzg+<qcStFFE*CjOND7f3jtGUQ6pf-W#$bH
zP|Em^!ExqxO05Uj{$`VkvC&~2p7~lm9o$uPHTt+K$2EL*(`{_!>M;{c^vJ#T@%IQ8
zXo}n1)paM~^;%CRhDvjV42pkamq~k9Gd*t(OB&<lJdnnj@K$et#4=FiWVnr-dh|>_
ztWugPQ-AkOFXSh)cirURYFU<E!{=FcmThpopxRL@*eNf7DQNB><3#Y0hz{LcsbKVP
zjF6_oO4z23w$))|g+|~QKjedOpN0?p=UHNUj;<}jJs?`;cDlJT%)Dp;^P4Bjz?3Vu
zq2>A1Afm6Bi#Qd=<#JKi2NNEQ5GGd>%lt7?qn@Qrd)-XK(FNvEs&Dpl`Pj1rRBj+6
z=7sH~qs$opMy;j;m(&2^QLw6~(?sf~Zc-5od^R^&8kC;3DOyQ3L4@|pRmyEg6~qRt
zixqPA&i<3io%g-soAcFXkc@Nq3ht786|J3=NJ3!x&tu;-jZn^kQelU0&e_*A`TH5?
zG29CHbS_fb-srxWu3hu^)V}(<VN~S|qiysbbPT?i=vr4chH%zPwjc}Xuu=Ob%w;<3
zz3}#6_nPgFe%4D~=()+#V8m}5m%Dd_AT#25^0`fOhq3rLPEq>_pYP;xy9*|N611(O
z1?E&Y6IR=k7VA9qHxm4SCB+5nHwiEKa>@7zu$`!c7rHVS!N{siinN#B({DeuZ#R5|
zz1Q^@wgcCvFTnhCa6kBlBWrchOTygGBq*mX(_eY)8_I1Y*jc9k0Rag}0@R@JQNbMr
zI?}bb=-~w!C#5D$P`rrQdmTj#xl;rk%Qi2%Wd9<A8fr0<Xy^*-leg#cFa2G;iwAmm
zV>qFfss}n0NYkcqBEVR(Wcd=ru*0txoL?E}tzL}NG*B7ru&>nr;jWycV5_ZiOOk6w
zo5JvbI{=_4EwoU|{(7^y@B<pNXZbXhtrWhXkRu3V79-oAA1ZRPoYtana(#X0?ZgL4
zNYnU%fArA$?#Qp`;gfyS?m|z(Y@`smosl!p{s1SpVEvpwf-am3B?^1g|7I#k81VPh
z&}4+7VV8m~m|qXjr$S!e99NMpp9m?iWIVtYqA%Z?YAD(o+wjt(Rp`3g61~xGBPJ2i
zvFNgxYv5z9IxP@)>1^Iim4>6^9McIOn5(#3i$Kj=@InPy{?1>1ZD=_&<d2kdnv9_%
z?@Cv7l~%Qm76icWrC%>^(0M^R7euZu@j=`a7|t5cY(Sw(y%g0S_3-9KK$d|9kC+B+
z<w3q{xa)#dWPtt3t}-|12mL-cjYTa20HPkPT79c~`jZQvT0bEHMp>y&*{|cbeqD!g
zztR2WS$5uhe!WA|&`DVj#CMG^RrM5r@~qkN=fr9nrfL5uOJ^QQu!@VT_4uRROHQ<+
z4z0_{57-=<s0Np5e<%+wz=^^RWsj%C4yM~;M2U;WUi7&9`4sZN*J<};&32AwhI6n-
zv{BF${l|NU6lc<Vr!ZZ)%G784UHBrWRt8O}rQG(1sNJq);38rpa<|L;-4z~u#s~4F
zy3{qB{uS7G04UoJ-6;kFVmU-W`kRf5zc~i$bKHZ+C@NhyahkLZ-lf2X+LkvKzJ&ft
z`g_Wksi<xY#DDEtEG`D6G!Ze!L^=g7;8AY`FgeO-a|{ay%rP5OpXQ}k>wC^n+Ijh~
zyZ9k^0~R&1Da*yANfq|qZ$CS)qSQXPU-E_2EAl!|PF`LCaiN*a!FIAX0l%CECpHJJ
z3*S6VOM<Ahn}Q7zr_Vjq=w-FZn`+Iz4fKYQC^W6#^`eYnvVn)9iY~K6#r)2hy7cfA
zeo-F<?>yH0sJ`@fjp0A^3LnNcX*77BPIn0q3b1+es?Ema>gb})w=-$j2V&e@MA`Cs
z2Lz}$P3J}Pg-1OnF+b6r?Fnxu47Iz8@Kc?1-(H#!QE+pw>a4r~z&Yo!tt}+dX~yYF
zsg>1?xQ099H!~N>lF(1f1qMt2Kf5ZgEqVJFu4qt6aKPS)=DZx}Nc=&Q*hk$<NklLZ
z$ONR)P{Oy0W-*Rn(rI<pAFMb<Pg84E6Xg^zHRrYK#jfh)4Fc5pXXi9N+dZWos;h(*
z2k`LViAOwg#mT64ynO~RfS4E-siYBG`3eMFDh9Q95qasZESI~J3zkZ%_XlD%clVO9
z(}IB@_$mgK*ZB2l^eI1S_ChE`XEzd6))zcakKG1DfJ`k~S8xgWGGQkpGyKh?!vZf5
z@Rm?7J=w>XU3<9P3TbfPWpwKM_g15#9Jr~`iVXI*y~RP$kpPo`7FYE)uy(bH<BDo3
zV%_VfG(f!Mev{ER&^g=gkr-#aTJ%#gqv`^4DWFuOTFtv0E^xCm+t~1FjHrOqyHVnY
zZ8Cp~!F%S`ou~j8n6Jd*-%wb=Az%(Nhp>SsXB{E%X*!4<8`XgMXAz~b4A;gPM4EEf
zR4%oJo=rDd6t3Fwzx@SHbBBfI0x9|PpBi(SO(6J*MaB@wU;f4Vh1aB$s8KJ$xua_%
zZvCa&Zw!;KoK);6LVp4w#fY4)hP!<v(CZU|Qx|Bsuu#FI+D@e@E-fzQ2g+*FVmh33
zDp@Kb{BV;lryqdN>~b{$QSV_v9a7VjZ%KAw`%4|z`4qCPpOUp(!L#O8$dyCyynbh-
z7CuW3de`t`#W0rrO6q2i^GfZIUB8(i?~xG5-Ih@IQeBJwXe?F@a$ruNC@Xy0Jg*5I
zBS#y+AC6ZfvVLU?AXt&pVrI#ChasX3jNuQPiV=n&X*~Yqw*u%<2X1XhBnB>?ERaXa
z*-al73w?5j2scnRHvR@@L6GYGnd;p0C?G{0`yV`0QqthrRskQPrBpAsby+~eI`Ap%
z*A)5kBA^@GC@jbyV!A#JUhNX9i`=HQg-tgL3k&Kk)JW~@Qoh(Hmw_r5iv){d=D-bU
zSIuas<;_A!r%PdB%4Q!8-;ki)0WGvBX_&Swk%`&%>14XliD&N!JOdMI8x?2OXEPgB
z`~hyY8)X)N&9#=@_BlYoKPk+7uHV4}AOmILvu=9Xn^OtPQf?jHWb-jn8LrFJfg9Z~
z-VdsjwDgh(=?Y)ETzP$~xRi3(NrPb6MN{FT-Iq7YmcTP+oPP56D)=X5IQL}a%EXJW
z5byeIM`>*pjrks28La9xoh~=(6tj@Gu^9JsbvRaVjm@lr4^p>NDR&oUGO7Ld1`EoL
z1tU{F1K_fQiMwulzvFW`6jfOQsgGfI_F0#2BW+KT-24_BCovZ*xcM#0KD7UQ=yq+(
z$w7KaO_E%e+}2xBVN*|r43|KafPckBaZN2(@Xh3Tgx2Z#?Av1n85+hgQ81c+ae8Hk
zeN)z+Lej}X_ID5a#rn2s5s>JY5xb#Ec~r_QO73i7BmYxh&>+QarP7b*en}`bfR6iv
z)&xQ|(j7MiU6pUD#?)M+p-EPT-9+|Q^l+3VFlVq=#$4J!v{7T9Yqr!Yg6l><5P3sJ
zqG86B4v6Fo?-9)r^lW=@Ra~=YO8+QfnPPRu;{Ma(klFcwO8B*Z8+?;Gnol0{oyy)B
zS+FrG+u^acs-Lnc(sJ7q4#xFvi<~tOWLLN4iE30GDVth=J3L-xTjbibf!A}3`di-7
zb*qq>7F<!YrXFR{8$+*85jfiIMl}kBPUm+yQy*Y?^M7sU(Az}UD`G;rV1PS6P8>rm
zv?GO9u`~0sH-$+tcKCBNe0>-vA?I=*aQ0W&D%;TbB&Y<S^^6`-iB$k?s*8OEuVSUf
zMt2}lG+`xT1`=8YxD;t8%w7jB%b$Cw6;hX6){d(o$3WI$&b)7~LT|yo;Xt?RTH`?@
zm8otAXFxA)jnC--FEyB!aK)uc<%MJTII!B%b%<&rjrv6y3@d*@t=tD7Ymk1ou|!`l
z$NGK|gu|11otOS95g)v+;keUxgy1>bAayiuKpHbqd9P`zF84Zlpc4$7@BPCJH^ovs
zpnAWS%{+twMDbDA@If=(97UJv`<K4#<F0B?Y&h%{4Pn7H8vG`PPP~pj@6ww|1f4S*
z@r-@G@r3h)b4Z(iq@2hRcpt<xW_?-Qkt>p#Jlg+3Z-P4g5HBx^=nWB!_Nt)pb$ttL
zDyqfbyG;<jiTbOyK8ocjS+4RCNE_F((FCZd!$W;ce(K0m8dB6-Ag&1qY5D9O`n-J<
zs}spn0fIy&djzic&Vt|sA=k7L=I;ItD|!x~*Cm_wo8TghSbOP?Ek2Iol$Ys4Jowf?
z`{;P}K49g+mzI;EOC!;havbZ)z5YdM<`@Z85OfpODsi*vuwcb?$EC`E@Kj#srt6|k
zXv^h`W|WnXj*+K>R5D1P`Qt&)4{Q-``#$91JO(JAuV;OcV(L6&-UvL6F2K*lA0F3k
z`7DUd3EwlfKXtQBD<ZakSG&Sk1@bAQt-Xbal;4^nRO+(g*TaB`RV;NZh*|AMUs-Bf
ztIR{x^Y$wS7A`{O#*idItoy0U(Gb}X!xy~mL}eNpoF<Xe*}a`)3cMBJ%$3uHDVa8l
zX5*Z}&?CFA$$&<SslVeBdjn&i+{?~9-Kh0ta1_9vrXt=<kvczcTj934oBB~sqoo|=
zv9j-~wK<{}`ve+weMcd&EFajdFcIGzJY=jC#@xR2b^bzD@!?IU*-_*r5gk#`^qg$+
zi$B5b)9Pa`T}<(=HMm0pzwcY)KdYokq=^ntaNd@q>Xx&HY?>Vc%roMSn4ZXf+00Su
z%OJLofKS&M)(@jm2U=Aba69)kgUg%t_fjfVM1>72!Fl?W7eVZBgRqYFpk-r~kS!u=
zm;v(Ll<(9j*&do%)N`(Ym~R4k!01tbp%~5!t|#T{wf9&X2}Oz&!)DIq<W&1wdmq~;
zaPiE-lSiN(J)*_iry$?2-QqjQ_|lXYivB&9J1N7op2FA$4J)NO0%R@ZL2@iY2VPNQ
zU=KEzx3JM%q3KcVRLV_(d5vfbp8S0qKb20)^q^{ZGS8#e)<$!1)D)9`8|6NcoD+q{
z5(hNtA%C&8)fAf&#1;izV5bBvk~R}i=)0geI<&3yFsBdk2{(jbK{C}O?3gT2baTEd
zyQX%%g|BSBFa46@E=wy*{h^@Uo!!5ktEIt{h2)PMnCjA}bssyKlAN4Y$m@N1fG#%b
zuZvctRm))qGQBw!0EkfGD>XJ_5i*Mo06y<3$|l{Yp|$-Kx!(Yp1@YGSN!0>Xd_n0(
z2^ZP*bL=%yK=@dPiJeR#TFw<F^~(i^5~DRF&ttX6vnd%>dk|eLyHrz_qK}Y&_kG-}
zQ{$kW<p?C-x#)rDLC@&&#75}Hg@dsn9Xb)!NDHS=a(9z{z;day;YZ}-F*dRm>no>s
zQ->xEp?h^PbN78YY}*sJ9b<O$b8l*es=f}4#S}pdtzW@&;Pa6<dX9}fTQ*mXFYs7F
z3Hk!;6HmK>>~0k9jc3LQ`vdhIj{X_Ia|4HUh9lXXgdf7Cv6P1C<SD1AV%PbqXBEE_
zSUE6>G5Pny9*!p|ROz;9B?hoVZp`+IV34o1<XSB496o^LC|{UfV=Std$<K&IGlI%T
z%V9}E#w(syPrZ#k2T*XPz5KbZ2YO}e?ROO<_*~atDfs$Ugu30&n*~5~ZNj@2Jc@iA
z_Z7n7%YfdunAjQ={*IckUa@Q~T9%*%)mxcnbXHdoIoV7(s<zeA7Jd0E2#Zr!>oJOp
zQov7de?-H=*KWPi=(F(57ibomXO7F!$IXIV9lpj`w#thO(IY0Os39a>Wp5u+g;~8H
z8)H=t+p1;)x^y9QNHcCVwSTbvX*l?*cG3t?POfOl+%}JGu4sl`;vw+WFyZ-N6%eRP
zyXm*C#muf)_no!eQ^zvLD{w-l7G>2R?Oz}FtCDT{`N~c0a>7zK1f_O+t|d&Vomyc~
zHqu8>32qS%B|H|QezqxVbR^>c%LvC^*h&7wO}&M!(!8QVRrqRX$e*+@!E?9ay(LBE
zs)O;W^#i6H;kc0WJuuTm^=Emv&mDGR19i-n4A1(BeQ(QC4eF($uDFEIAux4tCXC_P
z1HZDU?%FtrlD2<aas_Ih*D6Dn#6Intos{<xHqmB@X>01w{!Q~CPbbe~+GHS?T+Kl*
z;usu^V|#CSAm^*Go*=r^&B`5(Q)`(@ytQ$VY^}o<=)<YtG$Zq7RQ74aZkzr43mxNO
zK8NjZPXcUeRIaC4st;ye=R8EMVDKF0Y!VOLv(f%|PYsC5PgJ>V!K@r&fo8_i$Z?>J
zyY3GS7Grdnv4Gk&l|WoWN)mI39_1FQRy8ei>z|i^us^7?vfp@mNMZin3UP773GbZJ
zsbK{jr0iqXFwf28I0iX~%onFU2V*Mkl<&=!_ad1X6-sn|V;7Ir7r-aMcfg`YdP4(t
zv<y0pW?sr6LYlj6mPqvYJAA(0{menT&-O#nN4TnsI@^X`4#9QQcDfx>2%;n!4xo5?
zPsRgLtZeajX&)t^;1~*2g$<aAM7}x77}Boyt*q4I=ymS8`NPW1E~v2Lwd{B(b+aJ4
zR+@M^>e#$TEdC}&JXB=h=D39AOgQ!jK5cL6hL2vuN<)a=l!z(T!C^PB#X|Q$uVOJ7
z8P-dwArt!R;;o0C$}eOVF%{A2nPd>*zBuVAZV7xK4JO|Ul`2Xwbk|FSsJmxEAf;yy
z-IlItg%HE|N^hW7v3vcWcxMj+iYOfTAzaQ*ri$r06~CkIP(fz#GzpTV&7s`!jF`=@
zoMx^rwR~TZgtee6{2Bf+$|FX+<$9?M1-pDNnr5~fE+wXgfQ;AQu4^3XEykSQuFOzO
zZwcT7@djHN1oysgwXtSEKdRiq7~u^4K6R~_9<+DjYKHw6RLkzBjfS9wf=d{+8#}{A
zhFuAt0y&`0aeWo<d`nkTt);M6`=II|)WXhho}icu&xs^l`k0D1q2BP5|2KH~FOxG&
zB7YTI5RXfP7awVW&BG$`6&V@N<fg2nws2TLD-5|2#O@d!<l*%cBz6yIE0Ut56Z&Q$
zqDzLG5zs$Y>E79|s9QxNI5f18d{<JIcQ|(AmF}&}y9LMbkIXz-f@JfQs|}D-HXDbp
zqKG@`^xWytB+r$>7a~I%gcLQ^eVgSBAS?BzTEo~uX7+g3Y%R0gv5UwT{C#-yKKbE1
zPCB}q=JHrD%;Q1Ip4^+o+?%2#bRY^wadeVmkj*V}vb)3ktmC?PIYqQz4fMoyauGGJ
zcRpbcP=3p6hZ3+5QiAe?^(kkVjMT_=4r}Lj5Gs-5TE9v1Zxt!RlR&!3u)rg-pQN%Z
ziZv+~H|y?#yFlq=a*$kzgKJgwp|TLjzn^Sf9_^`EP6P*%#-|E;-!egd$bV#DpZSt~
z{lE$xq%oB1jUmHy)V5zE^tY|CW3fN?GW~Q0rCBH<`rc(<D#6|7kDXr&4Dpm>HTjgX
zzQBHdj9!cCuC?9Vyot^V@PN$nu0B@Ybepf$dQ^@LZ)aYRqdqpJVgDgJ5uT;OXb#Pd
zF4Ci**QpZyRJf_&8r{p8>rRnASbxww^kcJ5iNcnc-)hLJgc-xNTBdWF+&YI3@;3c=
zh^=|xqvEhuDNh;)g?Av`kv3N=0j7CBE2-HaTzuqMT*kSgHeG8NaCX0@oP8VCYTHcW
zr==swG{Bu1WYnPK_4KLfmkg;B3>D&0$ul~gdW~K+@f{o1NBZ1tB#MNmRqT~}REd;7
z{#+M3f>eqs$3B40+?gN-U;FU1H*0PyToayXd5r}qvfpq8p>IDr6pXQ8$vF9RM!(=^
z{p0;=HnKj_Ei#j&hNB0|yV==$-DnN#Y9w2t%LxFLEWTHnzJ@&Hiz7%=o@KLN&+Zw5
zeN1OC>~)3@Jbs&bj%j_f2+Zfxk2zS#`sIGs!)z(%WR$;qy#-JFPUyi~@!bQ70O~)A
zgd5Vpjk8HKfUj*pgRpYB%FdkPe{po?@l5!C9IsT04CN>`a;CXT33H!A6tWQ_q=c|B
z_mPS@GUt#)lCaGgnOhBWA2Ij6xzCZD@!R+J@BZ5M_`E;w&-?v;y`Jw+A_W$pXvawv
zfCbR!z4imd(`!SAdVdKdeud^4<7J=MqyWA0ev?4Yp3Ksl*frDe(Ow~J6<=jRFL4_q
zbtgk=y$VWnIF+nT`>-8p8W~$0eNY0DLa4gm-XeN_M?hDtqAWs2c?&Ty>#rZlRFl@#
zmYUkl!U9dhh@`l4U@y0gn4}(yf!o;gaO!JdK=e7uE1)Q42?!&y$EHJ<o8Z_o==doq
z5;zVMXHB;MM3vZGp2uHh1_S;L`_Wo<Bgr$U<>#?EZfDO!2Ohl)BE3QoXL;SXgkaYm
z74W+|FqI=x6Cz&5XtC_3>;`Tm2!fJ_ly%N*5haa_jRO7VnL6O<+ls!E1=RPcRx_uP
zv!sge%<(TL)hw4dlljb{3Ri}UAyUR_O4uu56D_DYK*N231VG|{m*MR#h4+zOf6~)n
zkNfP?sMJqo;77ovX}{$bN-lV;Wn$(&Y#zZi`kGu?bxlF>&nf0J)ZskHld4&s@e)<=
zRIPOF%=XRB+;yId3Hh`2fg4wb(JX7cZ}ry=wx}{*{TrwJ%TF8=_lb*|UThbu*DtJZ
zKCRkWbZ~H*!Tfvd<Hs8{!SY_Qs@M{CZ{KFL<oEpegK&!TH%x#{xWMJh|9wHWTB`|u
zC=NSbZZVgdv7AVHSqJ2g&RJIc^L)HDcB3U1;Yan6`P-{WFb9#ui~99`G$-8*xi1V5
zVUs86zHIee7JyxAx%L@-KXr2^vAzR+C^O>PEgYq86Ou+ZHHeE=adSpdt0I{rCbC8F
zj!;by+Pkg&8TmkMs#Gh}hM$9VwPp2p85`mJ9K?{#ARA-w@GPcaNT~C6A_ny*L&?uR
zg%LfMTM=I+&=nZb+4!;2WhAY?^ih9loHgiFG7ycydE;4hVWqLI%#Nn_E`Oklq?s@E
ziTCpd5SGSc7ru`ZtJ3)O-JWg?8na!>bNQ4lg{TUy8Lw}v36fCX#NCd%t^Zq4M$KWV
zT`JC6buQay-(M__zo&Y=SFS1f(!ksA=vvLnkE@M7GB|yyE0Lo+;kxQqBJb`SReZ!_
zSEy+g&8U%QN$46>a47F(hI&o&1sq#VK?fJN$54{yC7N!(%oPcV(^iJsAlz6z#(#%W
z*z&k$hyP%4BIvb7Kd>2ZU0=u{McBsrn--EJO)t|$DQB<^Pdhx<c%f*2!NR5rIk$z~
z$_|!QZ~s_#9-NRBc#-Ant)9Ay-98q6iMTN>#u>2OR5te;W|K%Rxz9aY`bBv;ib0|`
zeUo+r?)tKs1t%gL_7hmrc0=|4`oQgof8f>md;Sg4<^M%`bU;DNjj63yPJYA2jE>}7
zA+GJFH>^vi7@~r4GQfC1JyjT!BE+h7r2(wYEWF>?G{-%LXqmqyHtv!H?#Xx1aiSK;
z#e#t*7qlnCMT^F#j)_RdHpkUt$t@e(-#zawWVFL<-W<ICb8E=PIPN#hL5RJyBU}aN
z`BdptxHNviNo=LcUvsEkzdf2F(2AKw5lz>9&#W0v2SuOl_Diu*AedC!!l||4&xZNh
z<os^|^cmk85Y(Yx+ee(gYT!%8Unf5^16Ic=Z@9uHWAVEuU-H4VbX3g|IzXE>_G5Fx
zS@c|U($DNSq|2e=3hNrZ8!}T_$or)F6+0x%e&Dm;=iopMfw4IDMJm(Ym*W9RgEtpK
zBf~=Cw$LU}xImd}`0LNIODz6=a+~K}pDL`E=u~xJ*!E~VEaMe;utrlehKA~lT1{)~
zs=_X7T<3U^8DvTEnv7fq|NgJB5IK<Ka`-`2U1i-A@Dk4_pCocl>6<1{|CG2_(9MMt
zxTD$JJfq+J?<v8Gy2w}BN)&Ce9={sERGa;`<&_>VVTj0YrJdXooZ8t;BqV3Qr@y}Z
zZu%#)pqrpTV@@!R!=Xy>fYixB5!gk!vBLy@xXodpodhG_j1)g;H5{{JbJK43*v9-i
zTp8{xJhHClp8#62A={iilPAKS=7D;Tfgi#Oj^eZbdww7n1?7|zbD~dSFfLs)#2V@-
zK@GG<TvL$F0NS-KC^qst12uon1pIAbp9Y|vP7eG?^X8ihGM1?7{)nb~Zn1`ivBMwU
z<YdcfpVgZQX9h8dn%azEa*#y*=4WK|l}JE|%;6?j++rqeWuV=gtm{$n>kBL|k@mG3
zG~A;qmG@l4wBEf9Fj2Z?^z<_5en*T;5@|(3RkX~3JGCu0;+b%FqQ&E_pn|uA|IY5|
z1-6ICyH!>bF%<GvNjrwD<$2bND=EhvmfA7|>O(l|!qR77Pb)sFMR4JXH@ap_-iq`T
z1YJ~cn5}*->Cd(;pM2L%4b{-~<vKW7>MXnZQ7>sLJ3Pcn0IQp9AmDlN%nst*D7F56
zuYj;hNx_P1b*VFqD6$12D!EoQI@V`>3`Sa)vQQEL=l+VFiG|FA^R)SgZuApf2oF(y
zB{>kf4iBS7ywayb4!GB<jd=gH8fT+)nOSN67f?0_*PMJ}9ren_j%>_^w!}e_fq<y@
zdHu$Qz#ox;->*@5xKo=1Etw`Gs%P$HmCYo_<_es#mw<8E)LBiA?&7ybNOM(Nkw^mx
z&b&A&RVf7tFUjv6Z<UK~e+NJCS9s(;xANSlsmU;(L=^dy_9Ti*^C>1-5dO&Rn@^U2
zt#1FtKSh0x5Y2<=UpuRLw9)u7Yh3yFN;gh#TdnAZ(zkJHiS5pQJ5{2o6m+`L9Jfv(
zF2@QgE|wxtiVuLPIL=tl<OtmNNfXr1K~Il5%P+HLPK%CUKYsCh-hu7T+UFnYU1h&0
zV#D3eq4K+4RXFbN*We2(mu@@!p}($PoC&(%Ps=AiSx@2jU%VE_id5ye(c!4Afa!9%
z7B#dmzh*O1l9&W?RUU-nqp%j1(oOy&Bg0*V9%pBXtDe;ySO3B2c^9_+A74lRge3u8
zrvM^teM)V&Uy75x2XJJu8xnvl*vNiE#>rS-DP2(>qlq=f8F_xzpIDDh9TxmsQ2tbO
zJ7UdLtkiz{CiOkq$XvpXEBZpvT0(J!pUz}GT<!Z%tU6;iIiBM}6I53q%_>)S;_mlq
z=jxmir~%eGe_U?vr31<`hT!Qu*zWbu>?wAomE0yd-@5BmXme>BNB_Bv^Mw4ik{Mz2
z$sX$2lEalJ@iqWK7`K;71?<CYZykfBGCKbqtbT$%^%;iSh{?pgMFZw~6~$r5w<7#N
z#X5xRX2dZ6t>z9e?3&rnk&^v^w=eI)t}>|z8JTV_=FI);+v=QTntKs(VJV+|Y^?4~
z4^@plz`1tZoB3Cm+1J3y3Cx{I=qxm=B<tfiraKzuW?5*MZljCNT#@LgGSik@z*iOg
zZ2!nk{*BEWuyeX`Cdu@{Jj1nj3U}whT+W>0Y<kisTI)3p+15|LA3abM;1@&RpT)S&
zMH=A-OJFcN#MYkR0bAUDm8CLI3=@zsMca=pX{JoYYk^Jqe+06Y+W%-FT{Y6QQu*R$
zx;Wbh6%71SN~TdA=W<k1D*uvmTEJS@AwAW&%*dB<qdWTeYTvgi>pG1&Ka~FjFhB4$
zKUaOz#9b0Tn&~PH4{_wN-&z|(3g5EXVr1OI>^yUAIV)2r!LoTTkzpEbs^IuHYLB=Z
z4;*gQtq8cGY`aShc#QpvgDMxDKjph|hLOakhKF9ZG(Vt3QFC(*nPD%CJu^rd%g^W7
zcA9e?&N|`_GZbvx(nfFP3RP#fGH-^Pyql)~U89pb0{2bSnme?F!>!EY7f;>)gC1Rw
zBjV=a90D$W8h(qt?N-CD9AHF}HOD7q4CsCrBld=Uif)kwj0m_eSn$$InQoMkGRo+y
z4LNN}toRG<v>C%KaH7n27UCwtd%V|LBIw0eEDvSy4muJ5NIz>>6}3EKnkWl<<@OYB
z7^xkA!%%97FA}FE7Mima-0Qk<p07T!gsFQebh7)7azuS5%p{*4H7W8tin`JMR?Rg_
z-Bitg7NK!dXN21KG%n5NrvKjXa+%b!FwH&&{uxl*hZWYr+g1Lvk=0BNqs)+)+4r%J
zCrYfKMUED>-A|S*LGWr@JMrT6#2io1xaobsSg|mQ<LvFL#{X7Fg&H@>IrE-|J(wQx
zSq*FKc_p};pf5vVvm2oxP-_}V(gxme&yUPOGEzomU|Zxz{`n}o(j9AOHb*w%wO?1`
zI%??eW(@o#dKb2IUg|v7;nu%qKXPRF$txaxsYuTEsj<QmhKub_0=5PuSB6}^m8H_H
zimLYdJ|uJnKNsLYsTxekcNF#qiF{B(vKhDwF-QtTapVh_uZXWvKXsI`@rlU*@ED&?
z?@r*Epb;}M6~Q*|apnl%uz6fgnc{3vQgZC)(O!Qld~eow8Nw|bnriIcO3M$r(es>G
z5^<3&^_n5?LvW_cRD0k)J-NQ)#zVCw(b+BSuh2v7PhRqBO@H!J3X@ezzOGbljS;%r
zp>XFiNVrCoDY?(hN5f}zXMOzB%^{(C`(<!Tq018D{-`H|XTpk<kgo2<XmjQu4A<&)
zhSBNv1>?*|A0|yggNB~~WLxFuUz2Y$`Kn|g+dDZYh&7J<zD&U)Xh3>%b_X%IfPNid
z*Hl5`_Z>Rcv&s#~|Hig^SL2%W6^SRJLH`PhLm9FybRO+Pu;yc0+gHub<NOhkK!K7D
ziqx)_&c=7J5Bhm~PY$NZoZL3+14NIQx)1>V5}qPev}M$)_s1Zoz`K^x!W?N<UQ{`M
zp_5~#Fx7GY_6hWVM)C7ZzT`eE9{*t-$u)Y_K!!OH*yrV}aB6`ksIVP_Dc13}F~<B=
zp0u?l7fJ!Jz{F$am-L1^FU_0)WL<7xIxjRY+o`#WduTj@cJ%vw`weql`N(d+%jKrS
zT6Ay!P^(Ptpt_@YURLZ?v|^x&`xes=f1<$fkHmn9Xyw(j1E3|(&*zvr3bwv`wm;gb
zKG!}W9;a9ZUl^@rQ57}SDSLPSp_6HKJlXpjCWE=$pW=Cmz^A^I{GcOI^TL}&ZHnTo
z4Eg~sLbdJod}YQP$n#scbUX&be&N)*R5VjlShRM9qNke;7rHXm(ij%~z60zo1h@iB
zKVb4mR>JnSX#WVYZqmSC)N)mE&*+PeEPgAO30DzO&kULW@PbySB3Z2BDD_4348q|^
zXf)@2k-#CJN*r2pont0D7yd!n<Y!19dv_)@0eeIFf#G&_(ZV-2eA%a%x1buYB}fr!
zuhvB<Rj}Jf2RfHHWYPBV^a|`hN7Q+dZ9S&h&BM|}TBDwO1}N*tcd8dM$<aQf)PeCI
zyHW^XJ(#f4Y~-W6IMS@*$FTvAsyQCn{9p9g@(Ak#k8PH9*hG$@2pG!;@i$DS8%>YA
z$dcYzqu!Y_IQ%TDF5>L~(cx-+<Pyqt;5W`}0ah(i`$7xL#-2Y**&tThelHVmV&#?M
zm5AEvZwIxl#&hGfIWLYkMqmL1AKI+VHiQtaL%@uRWfA`3i#{=X&!2LQXINnu8wU|H
z-i`blQRJ{oPqDN`o4B1MAj%pmeoE|=b8YDjJ=mcFA~q-bWTLk~!R>>{J)G3f1RliB
zgCwk3n0!&Xm~CG~0N+~Wzr1jH4b~pMOi6XC*0;e;Lo6{WherAwIdQ^j<^jXMDLEzr
zV3p6x<C3XvPdNpAyaqG2Qj~k2IfWs;6Pm)26>Ym?!N`~--*r?|@Q9cvGaunOV$Ogm
ztlCcgUgp8z%AJQHQJHYYJ0dtAQt{EUt-=LWj-lOoZJY2>6iTFqsPKHpfm|tYY$|o#
zH%<ghLEQQK-U!$I3A!iC$$XZq%ER06)eAhwhEmXRS2>Wk`@$kQ{#EbtwQxBrm6KYv
zAAa2eqYvrN&4pdQ#-q2<?sgxxIEJXMS^_^@!d()%00Y8L+#dg2lQ4!4X7P{rwF5ka
zmA;6<neXjx^bC{+ranUdjZYgY<*KRjY8K17AG<Ocyr@UEw7Xt{C}xrur7=uxj0KUL
zY*mvM@+tjPTW?Dz@<Q3{Fpm?g8WVGBI+IA{LOVK|hu0@myNmi3<b6p9bo{g&b||>n
zlodD&R`8y?SK87q7sAqV%GP;GE|XDax^CqzU^R5ohB-QhNp9?nhnKdbSBI%9>hTLW
zOs-@R1H7s3aYeE~V_<fN>frOvxJagIgcj)Xkx{JufU&|AWmm!)y;FjOKhPk>%ehy=
zzCj{x<vElv9ztQBsoHLsnPKuytj!o67sz<E*<aL%!_<&Vzdu3}5!V$k&dv5Sv9lQK
zgPsF6+3A3!3m9co?s6soq4L@mOl5m^FH@q4p4=Dlfv-pHQT;yutJ=-l#3oi*o<+yl
zzxSsTc;BgK$}*S?f<4c+{LawqwejFtd)`hV<@K;f>v_r<knUXmIUEE-5`XwX<9l0<
zqQ!Z5+j3(F<qQj9>(dP<z*4(xAp4W9gjm1=<KMmTIZ6`?0Tl>W*0(bpwSQp7_HarY
z=3|>_D(s?{H{+lqfCWXdV-K(pAf%xBTsGnou5&t4)n+jkzZ^{(<EYBMZ(er$T!GM)
z0$wA>@^|##_hsuW1#A<Un`8d&Ir!hXd|PbxyQEREn|rQ3yC*u4Ok!7cs}qG~Vb3w?
zqI9H83aC<MVb~#rWi0>(8nmBde(vic>dC!^h7{v6Fjb-uPiwd?)DR`wJTr9KKPlsS
zq>KqtF?k;LDe!?vn}DG2&#-UW5*Yuw)A{0Lp9G*iW@B`2SJ6}HhZBZ4J8)bDc|%nz
zfNU(O`zl^n^v+q1W(BmyLft+rBg!N5M<phI`13(NT&}-WezdvOp>;);H;6h1SnZGx
zQz>qVyw7e;l$$ecrMk|is1xo;4ly$J7Q+(RD_zj|3sexJ<4X9WQPtE|81-!XwcZ(p
z!J#@uUyCLPyfTpBSh`^eebz==*53wmgX*7Byz-bD9<^RSt102>7vy|FtjhSFl3qzX
zYbxmg=c#rNNBJj8zPCX(PR+<rEK|y?MwFUkQxRSK7H_FOYfa4=?Xd_kKq@~@A+zKr
zwkton)HK3~+qL%DSH@nn*pyrKrfRjnk4<XL)TE2Ag<Y+y{Ys<P_CXghe~nw<4^;{t
zNv=@N`C4XUmjPTQq*WqY8TFf+PsW3ZD)Oz8Q5A^+Q*&~C-AXVw93jk6fbri@%P7ca
z*df;DF|-5RaG}dp27pI+8m$z>c1P~@FJR86QO-~1#v|MsH!$JEx$;$4m@7UW7_Jah
zXc$SIp8t6;O_YYUvE@ma$0-8?-jU9d#p*`A8&deH8xmT~c>tC2V36sDi$!ud@p>h?
zhm&S{F&1{OrtA<wOmV-&dapla-{}=nEg>+31Md4GaYT#b*H1QY<pFn}|9kp5{7i+K
zg58Imx$zQ6tyi#YfW8?)8-rSGG%UpI?@N@VCz?YsiN03)h6_g3{e4ZJZXg*qp+=EX
zr#RVj!UFqWwbIqumAgqCp^o*lX|N-&pC*RpjN%}CO^9XlG-`;;_%d5=F1T>^%jfp<
zFz0V?#{J~l*bof&SK5HdCpsI9EBuZv_b=yAuG+u28TsI$Vs1H3AJdCliE+iYChN}J
z#+g=+JGFm!Tdzl|;t#vli5q6Ny|K>F!(t$gDg`HGKtwt7t1yc~1&=_#Kz&+fQ(|%c
z*oD)|Vxl6#_q4tDvTkk$&Q%{j5W6tTdM1q@We4lT9cA>tdqw*N%*rgnQ3@AKipWK7
z#nF_tMa2i?c`snKIaUu=|Ni3**kjMeYeT2VZ*wV|oQrJMznaqwFCn=3UBY=sdzS_j
z%#CWlyrYlei@9rUC+$L|HxFF*j4tX9M6z&j3vQ}DTQX$ZE>XElJ3YZ!x^-w>#l>3f
zTd;cTyGZ&_%(63z`G?m-;6q(eu?O`hjV&R07*&L=4_g7CQ0TE-5@W`4b0Fbx@X#Z1
zHz0xeZtB}6hLBWXNe1dJP!Q#K$pGWsX#i+#m(L@fiOkgg2s4Oxe3e%S!!8n^Am!pj
zkiZdsS!>u2bM90{_sVT!g#EYzP9UV!T2J7S-MA6Lx)BDo(Wi<re$CTXF2i@ao;pAI
z=L(OU)qnVbB<#44IXH!x2p;eL-r9;U#TG8J_ztJbuy9U*8`Q<&yWh5U%)^{NXt4Su
zuiIp#HAhgsu@RCXfApqh?xRGPZ}r{w7;<8M2Wh!o%oodZd8zYN`ZJ%W4bhzpkDi>Z
zr<O>oeVs_NfGku=&g&}@l>}tnE)W`uJ2j88@g?t$bs=Px-eVY^<%RA~H3q4;@@qpI
zp5wuBpcx{v%G~^=ko#3&oVLfJ3^tIzr-6gjT(+a}V!wpxRXyHlg(<)7uC3t^iHEFz
zSc@fNBhTKve2$9O5|j>17QN5{7gx#TAyK1l82jc=m=d);)RlY}D<0=#tov#+1BSe!
zD1AAT+GR_&&}z;_nSCFdRO3pgm{pBn%H0R3rU35um;`&}{sc#m_J7g{x%BbEOu%VF
z-SrD!fKEcbXQD-RU@#QSCs8Dk(ZX9_`h$~1=(Gu85aapbB9jWUgL@Ntz}p4jmOTo(
z;zbi<s_CJ!O(-&3dcQ2z%h0!4VDH#kJn-w^9JKaG5%gHj3EE28CV$iu!l@0gC8$cF
zx{@|Gv#~`>Ut*p-Bg620b%Os^eq^mYC+ik!)GmGdXjr0M?ZvsOIK!+gHB=hv7>Zqv
zoUpMjafu>TvoGA=nF&gxJ?giu%-mqYXm~TYCvHeHMo=?k8;S#8-|S?{z@3svcU}i4
zlJJy&o5U%km9Z+ipb-27x#a~M#w`a>8A<G)&wa#rutGbV?0szYWio7UHcpkkcjf9M
zRmWOWc!6zD_P>-#+!@p_yMo+^sQ16Fo||%;Vp-Kbq<!4_ati2hS%-%9gyyOY+=Bi(
zdTCew>!N0*vYCuYDxtS-y?F(-QT<0yK(<W#qt`1Ec#IYx?77fgK^zSGPP^}8&9jYr
z39`(tcM%>c9I}P#15OIH&Im<H$335Rz%G!X{}|D|2FvZBj?gSOMWMjcHgA>dl_Rx{
zFve~$P;4Q1qoptv=Z>B&c``0nAUE3^3zk<5dazSIHVgR{u%s(!R#8jmD{tW!zx$5U
z%11(l?z2z#IW!fdwT&GlmPX!BRG0}%`&)u#xWwHa@>b`ZRS^h0G9^4#eSdkPLrD3H
z+U_9HM8;Uu)B$zoUKM}<2ngrqA^7A`#$i`L?kJs^gH>-!P`aqcR0|{(LQ{L1tCUVW
z(PbbX&q?(J`Ke3@#BCB;09<fgJBpD!{&)De)05UGkFCEyrmR1)f;)Z386uwf9+msz
z@Xe>26H*Ye6KH-adwVd#;C*ExY4^Xvf4zmZh2Ml9Cx0swnUMXbch-8!WonGf;?WV)
zE`)<ZX0_X>+)-?!1IxOX3ZqwVH853^Rsn41Z4IvAYX&49O2ToFZY7j+5tTS7ID6OM
z-Dc{$Yh@1}4!3v%i5GjA3VHr(DQ%z{^`~$F0qY5|c&Gh<qiIm@kt*FD<}rK@ZFlCq
zJL=u3yc{831HdZ~UGg=eqhOV)g>+lC;)Xym(Epq!>#<X~`!JvV9v=j&m&#{6(V}>C
zpN-14-3;@%zV^a}shl2>6!GBe<h_=?!OF>->cEYbe&6<?M&b7By03$-{3bowwy@*;
zdtp6Z7ysg|vOuLbnkz9`Kxd+7M`wRxxSKM&Gw>;J-slqH8L9m|ocM=p4n2?he9t0>
zCN@x7{`4F?g*l^$Wr%#kq0Ug0+}i4?aDUR%T$e*<T{zkR_VtvP?z$x^K;;VbRUBTq
zC=k|69j@pfM>Mo%OQT!($(T?2ng9;6an($(84&IfxtVnVgSWdg8&Bnb_>;$?PKZ0g
z>}DcGFIRr@9*Pc-pgx&a^$+b)4_$bYeK|L^Qa3#R$eBXs*Apy$tCFm2oA}zllb|x0
zJ<gecqylR02Iie__n`3MKdKI${y2V*fJt9g{2JBB=20^GsfHbY=izX1`p48qARlZH
z#0Xilm3#+8V)~1x?OtMZ6@T32>p1<F7xZHwY&4;rroTjgpuN6@gd+9*f_TfQ{I_us
z@5R;xk&xD<uj$l5Sgtk9sQ~8(^c9bxZsiUaRD<8-Og07cb(st7eTRW9_&vBr_r%L1
z%Jeu|0>eDU-UbD2JPGCi+`Rkt+TfU$K--RUn>O-I3a3;AGm(VzX7ycc!nI-;b2(aw
zDsR4pGDGqst}HX|W=oF!krB8RapemH1L9mR@yFV(46n?gYkXGqYpQg;rL0-oj%o!j
zWc)qAMMZfh2bHf{pbWj9Ans}dA9FUrp}&C?cdRE_9|vh7v_HYvcoVO8nhFZo!IDIx
zDMS5g?tHMB_@n`xwdXhv;UWKXhBxDAJu8J@SkC<%43b|~;ur1CRVU;^HO`5xjFpe>
z<xnymXbzl`xhu4XQT-v<unjs~9qSg};0vyG{4VL$efvj1S8L9tLPLcpnI*NA@i6K`
zVPz@a#Xf*tsY?};u_*6TpYeQFc%DghrVjbrxih=DQdQhV#adopc`nPh8GF-29>S8x
z`(INE0Pgdb&)P@&!(?9q+K`K48slESA7d{7dXU4mSiMuJi1WQ%<Od2$kV9fT@Wz8l
z&#m(-I4x@A+{u^e&B?&^x6RqoFpF2byQO5+pV_Q1{|C9{37xT(-da09jPqGu)Z%~7
zju~E_+VA%581wB&+8F&fGd9gJ!=51cG|ppWo??B~%HGr>a71-FyL9VD)~^Wn8I0O;
zJfGx9H*A?<U#2y$D0+>?B^|zjF;XBaT=~)NjL(`{Q&{7^P5MWo$gV|m2rR2FyTM+u
zP&iVWO)=BBP%+>~y!8mx1X!P7Z6~nn_yAs5e`lOtCjl}@&A<q}@~7?@tWq67yz@i>
zMD=|ZsJD4853>*Al^OSW^j1W7!Lk$Md`%5B7wGWmzKHx`l4%lD9DHbdI9Q*$aM14i
zN%x()QLsc{<K58vE%4jrThdRq+fmw;UzNSv41EYkw$n~Ert1pIp3m+fK`%O&75#q&
z=+oq?EJ4ii%fljMC*P&;Mwpakc6d{<N>`U&V$fxSt*FK8*EE?8s@bo0_zmqUFy!+?
zSNeiSJ-mk59(xed^A(V}OP=mN^>RwJC{ZKKM4(Dr*mZO#E(lcV2h4kzB^^yYQer<9
z@Sb$2SMmr(K)gE<NMZ#p$_I5vY9GZ~Bu?tPP+!r1vAX8>N_@4?psW5ooC<8Hy-ACz
zxAJR}IQxg5*$3sbsmuLEWqVR_d0k=zrOK3Brp*W*f<WOHkVO%3WM;04H{qfVs>m+D
zkQ;7WRkV$(3xtHPP-<}|Xk7?l-!mXU?nayAo!#{Gx4NQdOT+toQ$;Rf%!`U{Y7l7R
zsU$9PkU2ipl;YEcDb8NF#YsLk&Vm^%=)b_Tw9z*e%L@!W6rWTHHxt?SW!9+=Rf>Ea
zP**J20L521C-c9VyP#w6j1foz-_NTX4JSVj1%p1v2?lMl3!ZIv-QbT6Quu@ZO|BWP
zVIc!QGKL~7HQGN2Zf)&<y^7U<QCo*44&h954oMceqCcL(xEJ0)Akv~so&9A~DW8T!
zmC{HGUXLyspz^e%n6Op*3IN6%m+f9q$-@Zb`CG-b1Fa&#Ga2hraM*X;t1%L&@-g-k
zt+xW)g%PBOjPrYX)e2)`;5eC2%e#CYi(d`(U_Rm6AVAe$=C{=5RJ*NL;6=8PuUpb!
zkjc%L60a^eT{xZ*Y!941JkYfD0vMc4{EGIU_i%i~i$VWgI!MQ&+q06tGpHInji<84
zSvX!j&Bc)%K_zXJ6~*fV_F;{6kYX)XgNpQzhl4L>C93q=wxe!Lb+OHR#*K&cbDS;Z
zo_XY|elCp!%yIF0e`C4C9Yq0p4ddmyO1mcLut&feWfTn7m90yD=(?bP_Ea<N_3W(}
zQY~VmIe4H$FOej49^DZ;BwCY=Xs9%Pb>UV16&XVI-RlQu%;~|+=;Lfg8}W^Cqd>TF
zecq_{P|<sp0lMEK6jV~hwp6bvwVaicQRn*(S3Kr={FpbY!g8q%(6IBY3Q!}9zk;VC
z7GL(W5bn7(w0EnljfWlMUU4p4X7mi){^Xu`|D3^`catWP(Gd+@`2P<{C8NzQl-yWb
zwkmcPfVw~kHI%hCt7gK0RG{)dmd~;@76ec&(HO7+EG@)YyT`f$Q%+)Xac;4xPi)L%
z%cl}aS7n=o#>_8Y8G3^Ab&E0F&8uh4&33#g6p<pVCgmY`{JHjIn)yH`>-1Lts9?65
zIU~4JOR+5MQ~g-)&$rNUp_WA0s^y2(O_ruZ+B4{V(7prO3X~|0HWv6oD(X0JS+`XL
zwE)Mw@*O$F{hwpn%5CLS04Ul^7`wRAV@CRua(krL_28o(?H5B-GpQ`cIk((zTIBxM
z4;a7Wvh!)si>SbfP6vjl{G}Dtm*HY~5sHJ6Oi5s4go-d-T?A0tk`=r@vXIqpY(rD9
zMN8X$;b)A6!`QBw6%^Z>Q3c=0zq`fabo6;TM=<D*>7k{G8bZQ9S+IhE)fiW0zarqF
z>1SDDgPgn7o(+*2O@NWPEkIW-n^9Xjp!^a@z@Pj`j5f0>$KoMuF#Y2_FUk3m!`InL
zol94}@*KU1#d5rbXa>OZl}@{)2izWxjnw8Qa}^<-FPH#YWpEucouwjGRLfRXlPYSJ
zph5*Tr4TpvMsfZ2EOE9e+gH)sEZ0dSKw|JLGs8d<wo=4!%})L38r$G|nV&7hbTjgj
zP>kU6Av?F=(%X7BsV_(LY)o;o%4e1O99s5x*ar%Kbq-!^6|DR;*?K=<V1Xx#(Y#x)
zEB?_YfB6DlJD(}F&AJakGvTtdZ)neVgbozC?#wuhc2fS~z`so&p+AYn{R8i|wh5dq
zh1n}%Mg`-_NPQ}V#1<TqCEpyLud1fL!24{4smv9@+*@>NHb}|{LtP}pW{J0}aWX6n
zS&_aOaP&Pt4;mY*vYX*%&W$Gh^`uN)s1uskyJi+Ox;Gt+lCRHt*8*+flYV%VAFd*?
z8ZLOO|ACex$PyYPads;hrEaygr}4vwvbFa&usY8*2L2P20#;a;c%WpCjyQ9>wAzfA
zBegJDcrFsIgZw@y=t7`g0;r1NwOI*&I{T{&=XvIb6D+(^Q>bQWk9m0TO5#$lKX+Qr
zSXze-v!>h2yKTS?>o$;PGE=mO-P|U2yv(A4xSHr#!C>DN8>Trnj8S!wK;?k73Y;9n
zIVW<3%*3wpR2deh!k2_AR$u!-Pn~|>a4@=J^)kOeJ%^3L|2z^s==@UqxtYn;aFLLs
z96{f{`V>E%Mcwm{b@4%V<;?HMyP_d781z*Er{^$ls8!!NRBIv9h#(NSdOHC$`1<Nt
zl|*To4I16nW0i8$6m^B{_B34MdNuowIa;sH;#C7!Ua<SnrHGS!cXW`9HzIE`D9w4b
z?I9hPX5vK|*Drf4Kh5|_Vhq=34;r8oS#G&ihg(xp6<FV^H@9HqK|n)mSOvHc_%pv9
z39OHmWJ51D@7w{7$|q*fhko+UMw2E@?jJF|&wr*OrbUv-;m|w$o0P>sTB>6erpa?o
zIh>9hV(cJW?*1b|wfH9Jr9vIQ{B@2I`vJ}}s*;zojgR?Hz(5go@Jh748N!|NQSuy|
zncchqQ*Q!Ywb*~YKK|Y}-VewjUd8x``dV9!FdM<G>2~w0sdio5M^WZTrW?;#UroPT
z%^0C>SNS|U^l4D3@8CyHfTqR=!pDCBZ(y?Gf8g$Lo-Qu}Gb~c9%w%arnJPMd=POPE
zv!Dr-#gpg<E6?ALK`1p-Aw9H+&GVP&?4j3r{1UIJ-~P4t@({jx$KNCL$SAYDLrX|K
zjO8}d*MG_tquLAb5|y$k`rk@IZ~HU!PJ**ci3$19LsjgVIrczbnRNZT#sY9ORxndl
z8YhxQ%AqmeBQ&)C#s4uUzpma<WVe(-J(ab9dy&a+lvbOP5YQeLFN14mODkrAVa6HW
zS}dNm;uyt_gf+T1v!}cQZ5{3l)J4nTAeUxuH6!K;9xx#?Liq>oD|OQl7W+{e;L2}M
zOCMdy&$}E-O7(oJP`_cT*z!n^ul;KHO)m9Hau)Smc0v|7^yuueb|E{bK;kh6=_qiD
zbz&wE?!h1)c|U%cgq>Q8cMN;((<t76Y^wz{T=rYhRle+ZY-0(!A<S`g8y9?7wmclh
zlSq`R87L@Drz?XpMFqW*#!0X1&iglJKTAl`y5P|9xge9z<ARq2>OD>~lS)kjD?Pu(
zxDCLu$i)&Dr^DswRoGf<AdEjGS%d}I3~cyWgvk-K7{o0rKi~mEXY}cca)?Dk%KaZ^
z+#iX2hgT-`JIr08P8x&QgklBp-Fr(9e_lD)&?|T_vv5!zbSftDjOoE%!f$l7zz=t)
zar%=s=K9^D!p8;#o1*T)!z#-jRMrt^KA^PiK4;sLnM4szXB=rBM#e&r*L!u)JB1qr
zSrk`a={tXz9|KApGfV0O)`j35Bfo>+3@5gd$*(NsS6^cK${&X}<GfRHWX}?Vt<|o(
z%0Q=P5H_a=DsXq&fx5`2f);6{b;NMKVJE%Z+-Z_{5inNpI~u1@nAJYZKWHFUW8OA)
zVNk-5>1(z*J;v^+EcnprP<&(VZLPRqh!AjVI}3l{e6oC(c)6dd9dpsDMPzN!p<`Lz
zy0^Kh{R^lp6Q8YN3d&q5VPn`+@T_n!#C<?x+Mr6tnuh=&7Xs|MCP1B~&keS0f)qEp
z(4V?(u30PvP@GYqUS)k^%6$%Nj>wb!HG~`Oi=U_sW_fSVsQXkmSx7?!0D`YYdp$V(
zB4m*SbcoB6;?zjSG!YC35gWwsJwS!H90`ExzunF|J;M{~Q_a!<G!K8siuFdlh%xc^
z^Sxu{cz!2+*q}?tZon1(c0OIx3oNEb%NECfSL~ER_9dMX>>#0OdmL-_DgLD@YRPHS
z%o`uqOFTdCJT7?TE+3iOX4viH9EUxx{I%K8octCCky)z4)bv)#gf+5?L&n9(E;3(e
zhr3V#PhXj?ogExe%JoJYWr>4gI*Rw4ZF@_r&=t67#sDPqyjOe!Nv|&=r6{?H_&St1
zBK4u`TIsM?mHkv#B9rA9HRPO0oYGHPFSS&`QIJ;?bNSQ&(uP3A&2r3^WP(du8t7Y+
z_X^C=q%*+LPsbA~dEna9FSISGc~N&6`QJ=&cIaRHkcLpakfA_}fNtPkk<4@WbHCPf
zO68<KzdN%Fhmdk_=An7=f^BnY-eQSaAA-NT<KPW8oraumv(h&c@Kjy1$eq^)SxD#3
zlC(f~V89X?>o_B*tP;ay>}JX+a($3%T+{kM?=pLsIcQ${wIyLR6O8nYRIcYwCGYzF
zqAnvD-qiLe>NoH9Hg;r_5(ZslHKV^|ZZYe({&;+*7awW})c3rKh?KUSHy2Ewj9(l3
z#V>p>1TeanYtm92dnaUjWs2+QZ{^&KLc>4fMrWNR?Ez+S3n%xTD^CVtHAkdrKxz9F
z<sLpoc`}IFrNF_e6Ivvu{2B7>=}rkdLB?J|p#bomG4Q3)qLQlZ!pF+^mL;}vidzG|
z1&+6sK#X``!Y~QzyED#WTFjKz(Dtq@L;fiF%!oS}9ed=Dw9JEv+#|Hd!iEVfNlbM5
zoEY$o`MiFG$l>6>*90z*z>W*57!Q#(z*xH%wBw{sJLll=edasK3oTjfv%OfHf>RD|
zF;)wRQ%D@&ljv`G82ari{k|C66~1<^2G~)~=b%05P5v3q1$K(SOZT}HXdg&0q+yP*
zJF($>QsB_W!pkIL;;!Zo)_BM0wx|#Qh&EYKyf&U4F>i1lZf57?--vtnO#TBcbLsVR
zyyEmTAhS^dfD^=E8X!SKyOp>9TkIhqxSMHX0UQy41_ZUYQxK_4%%8saJY$rNv#(dx
zYy>JdiGp5RE2Z`D@W<FR>h6=2MI!K2?Ln)^93R^DBoHDEs{>XLJ?gpp)KM+r3hmzr
ze@)xc4FBevyGIU~l=dZR&csX|{S}P8b-a{yTu|GA-YQTzA9poyco94gf9{`eT@(X%
z!G@Cc;9?Wm?r39zZN!MFINVNFZU0Ka2?sx%;_hx+Qf<1f0+SYnK1G>t<0fjP`m<MH
zE=jV6i9wpYUdAY+{SXTAlOG=_<}GcBAQkOOQ|Ln-8yhh;p<JBm@LliaxQ=OU59rdV
z?wHxlc)l?Ejv(`2zY_E5mQtsH@2o~;wG1ub33iui7*BOakY%qS^pU_J#V-Yhskrxw
z)1I}jjF&IG5B<Cp%kE^fLz;D8Jb0DOR{ASc+DaSxDEtn~lM9YV+v=4bTQU+^{0Udz
zUI;!CzaM9pwv@nlvswAqlYS7QSN&E#nnB-0VHessZ-lPira=Uv1rh^qm6S<Ub>X|M
za7=K9+y=Eeb|H^M0Nf%Ys{xktFt1NrxY{&j@f8><|LxExMsoU9vy!1`QtXa}t@&c2
z==l~|-6UMq@}A!<@&iVD=D$(&@5dC=n~(t#^+k6^!kh7J-mfT~F<g*2YTr!s)OJ3Y
z3!TXqN+E@Mup;)r>&zS0s~aMn1<{g4QEa#GHSMPCC*z{EuKwaa`CX6ds~5Jr#d7h0
zV@o2?;+u+<OXB;_ZGau+@imT`9P`Ec{pWucqDScCUOhs?^gU{vx|Q^TZOXijYe}NU
zwDjOpCph`0WC;?_^Z-4<JWe&(qENb@7f~!=b?Br=Nr@tYS&?I}N&CY7gt_WHhFtG{
zV*oT=N^v;=<*U@5rJ;=|Z@l=pl$?s_G2lh|rqhONUOWLKu}Z%Q?W^>DE#QLL_kcEx
z^<!8x#ua(gX9jb6Bf^EYWHdPUe9ULl@2nq3U<#VJeLYBSu~WxXkDq)eZtv)!?d(4{
zLWb%)lD0UczWh1O^i@CZi|sp=Uv!g+>=}*1?`Ao*Cgibj2#aqm_=;pU1{WnNy>Re`
zqB>d?LSCyJLyWL;ipBjxaf3cU{uXr*+vj2UNTy#RvfH?-Rd1t*){aHR7E%42FCcuG
zOV=X{-;28;WBul46G}^z#B)||!9a#7+6u_j$~o=Vr3p0{Jh0vZrNV>kX)(rF6AIhQ
zs5~?Y-cxf(f*{bhIqVT|?oHD8KUZ!Bpw!z$41g|t^kIDOLjZq+x%zlhi#q(Pss5~Q
zSlk-jvDV~5lj2v(4V>!MIPL;_Cn1Co2sZ>h_vIR)13Cdq!v4lZKDB$ZG4m*ue>+AX
ziwY%+0DU)GRGz>J(eFMm6^7UTLL(o*z1GC5Zj&*iBIreq`Lr;oZKCqTb^nEXpOetX
z$5oRJNf+PjjhpxbzbPau={dpYWEdp;@iTX4O+J!(kgt_|2)TG*APl*vw{DLG;uPH#
zVe<Hz*<Obo++4{D;%NcPjSTN=L)uiZqFat(Bm=I{^I5^>RckyrNssed!=d8l;nYce
z?TK2Q=<4Zn4&NoWJ43f!`#}xyAF!<$!77-HJK4ANv#T<EFl>)a(iZ9~bB~}hNI&HO
zsyZ^^BXnn}dt?JDAnn+^94Nb>3k-T_H=*D)XTto2R`B*~%?IU=fDS8P*whEiOtSE<
zDR%**3<vPpc>j9fp6B<>=513FTxIsA#w9!t?{CdKtc_&_e;#=^XKB;K6bOy82xP3a
z=5~ecpP&9`fcSHTd|&A}uZf;{5untN{fa2~VY);KD`U14-`*6F*s>AA`;{I@I+5OB
z+20EkON<MZz5Mk*aP>1}csN64@C&5=BZyhXFLKpyV`7)^z6s1R7Mhd-vHjJ!{8F~`
zw<TGdXC?j|{&YnZBMtB3F{w;pP7N;G(_vlz^b<EG-saFCMTWi*p3bGTM{z-V8{YZ-
zLfoQ`j;Nskoi=nUKjUFOeG=!fdhEv)H~jCvTf^war)Odo4^AK0V&$Nwz@^NjE6{2t
zKdzyS2ic1y1lSS*M}Tq9mxPR$$KmJqk{+t=4D^3cv}&{OAhykxTtW}zi!{yzXp_y$
z^u=mVkKX#N??x})IxYtMJ9~HQaLWr8A`whn$^NBnQJBF{s(k4H8*=pNo+)Ou428qu
zYVH@=G8du7{TJ4J#{qo_9;o30fFg)lfqhloL<c=sxN$qKb`HaxM!Vl(`$0LbYy4Wx
z=G_nPF%s98WGw8JcB_w{i!*3fy35LcTwgb{%D=VYJhu{%Dq;bey*%CSV-8x64191E
z4wCu~R=plLdv+CZN2y(FUAl5I0MCP;3QyOrp*@pEn<4j-=T6Ga>#T4t=g7*p3;1s3
zCn{m9_?s`I$4wX`Q1XMT?OZ44k7lOMtl=5*GxcYYVzkpUGX`-fpFb;yxcHEvEg-?Y
zrsYp&dWkLs+rddx2Wk<?(8#Jh+s0{u%AR5iF(2Dq)~_+zCvbGiynsn+kSfJu#sqq{
zEfpC^A;98|z$hJG%CNo?K=E=edc0FCvXFWF^p18}-NDuCks>dYzHL3m><=glCu##A
zYbDrm)t8nP{+`?MaGF4~EoG^MT!9jGBHJTBTY$vSbC@J^Sb@@UG#DV+f{G!1q6-Fn
zjUn<)dDbO-GjAqrE}3&)`Ecv_`W{tqj?TU{!#?Mf&5<29bz(P%iKE=Jm^)o*gF^QZ
z?oQDE&H7l%l;|keo}uq3GQ<a&?TyQAH&C|cC_<@iD1{-Wu=&IneF(W%^HxAlCMwuN
z%`LRxmq>9Utw@QmYr>H20F~y`XS_Ubr!u0;4POQa!V_I%VGw+}{&$?BT73zz#JmbP
zSX3|hAg;rfa{3zl15FX*zM})Iv`i$iAZ2xZ#@_;^y@uh~kJRgoF_QofGZ4Uf{I9d0
zzu{gWsj20pj}z+|vHU)Tm&Lj~hz@OTsNBn`?T882Jl<oza^2}Qj7BCyh-dttQou(5
zlyc|I)C8D8vd9QMrO@(a#yH-qdD&06ipK6>8(u?mM@gWPyT<$B>4CLCe+VtNil2Wr
zVJsV?$%w98w_sb<Ee=q1+R6vOeI}m+=qmg51O8~nUJI$&lZ6Q>=4t>GNsru)xJu&_
z+~xRe2pFHU99wD@Sy^nA{tiw94qD`jlVc5m3S$!pDcU^$>$v<jdoi>v=CJH6dFocP
z(Bxj=a6zJWsbKhY>v4+*Dz&{fHqO{p;-$v3a&Mt`^c()Jf-I|59BqQSkz6S+PqgIK
zp1I{7!rMU&x7YV_+c1JLt9zOt)&Xuw^90K)Z85Sb`qSSZR^mv3`d^Pqq%5D*1LZ|S
zQjdNaFThZiQwLGhkYtrCW`akeg|E{q8}5%)3}hxpOx2plyS`FyzFV;P0j2-2B0&{>
zjlvt3nUSv%!7AKwi}skus^^GL>qI&n;ufTsS@3^7{5B$e@ghtNj?T6clk<15lJewb
z^1tht;t?xKe;J&+Nk{-aaU8fi;gK4m?ZLml$SgRb2aAs3o$S30%Z`P+MUFc+?4RI!
zBko_ak5>Oj4lVaMx7S-Q>JjP^s+G-?a9ua#NYZFK4(5CGeFY=;{a5sQT<8{65bPTy
zIM8=|$2#*!`ffsN?Bkol2@~U5pk}d?^nv*DFVthnRM|P6#Ia{KsP7f=83xd{INfjB
z_q>LNOtog4(Vr%@Q4k2X=w#Xowu;2LyeO9UR$NIlXl~|&x7Zgca^5+b$sTi2b%}<B
z=^_;oiv$<tE$VH;=mMxp4i5?7GDhdEJm&t3TaSLstp|&<^adUhwSXzW&<SqnHQ3TW
z@mKtPFq?^dmj<sD0e1tBqbrQUhQxVdksGUi;pNfN6!y;9lOB53mZj|;dx^e1yQ$z8
z)uwwV!Q$+@${|kHaP=f_s0s9O4~3=4cd~TN1_m;72xq|;yAnv<9csysK)zE>+u&7;
z3Fm*XW>M&i_3Zp&E&7a1gJjKbUr>olr!jLI=aMHr=Y@>FdAv=}R2PHAQhy;eCmjwW
z;TT78)E;w9eW^T66fKxg@e7v%`8$)@uUWGo8qFkG^+8ERr3eLcDqhx10<L4m)YfAh
zkc;_-tWXw2s~BcizFBB4BG*v$GO(8c96JE{k(^285r~L{=Fk-1pILJ=JqH&pb(V6B
zN(Que`)#mjg4N4v8%SaFg#8l0OW93b!IV6<*xmdSV0^aSy$BQ#&3E}(o0uVnCvlqt
z^bLa958$4MjoNY#%&ft5QTdA{EQwa$Mh|EmuXBPE05NAd8GB!#QnL!g&KaRbdv>q#
z(BI`r57u@$3LqJopJE+fJAH45Bc;#g+XKWfJE#WLkVO-7T1p-6(Tm@DMTUShV7L<D
zx<xle{cl<&%)o-e$|wT3n(Zk>pI?l&6uTx+ogNFm)1vFqIB{!qPa)^OLhV|()baRi
z!>C~Bpl`6%Q|~iddr668L9DU{sDadJs0VM5Ti3v1c@`ONK;OH=bie~2eN@pXZB*MK
ztdV@HIAHp86$LR>*O&gWNM$5|`<_=v?egZ&x6IoCl+47X;R+JitFX@HWmUC)(aXky
z&DKY2Le+zPn!oWlJkeg4!!G#GA&>-`mza|4oXd}ZG1epwIE?);M6Q<C00UBTz=U7t
zM)c$GZHTeL$|+MDOyB^`nHyb>v5CF#)D+mGvLc2quIICcZScft`%{_N5oz+ak=jha
z%ZHN35#kEbRdi-7{}=gVQ9>U$TKyz1F=D3S<gj7xUjvOA%6)#n_(bju=YIC;=^1-Q
zHdKkWz<?&~I--l_&V>HS5yY;ep7i|7WLB;}x7<5t^C#Ytz$8=kBmNnlWQ-)t8(zGa
z&Q4h#CfxHXyi?ijO+#P{Flu>@QnK@3ZVxdkIbSXYvE11Fgqaz!=LAq+;=0**lif?_
z1(qjnST|1#h*usLs0`R)lO||Ei-s^6DNJPxO#*Q_K;IdbY3!k(lnk0k%~vX4^z#Gu
z#Y$qA<#5qYY$gg0a<2i)Om<{XwqzSvf6_fl?j3)%qN-!%j@^PxH`PzJ)#sj=s{PwI
z+4sm!Y+{h#PTXnsKKo>~?`HV%w_(FQ*qw3q&KtXHHl=NL!7#%iyVuKm2T2b<N9fGM
zbiHlry*(z2tNltNF>o)UL5OzK>HgRo^j2S1)Vsw^mc(*fCn|1fU31IS0tCttIRrjq
zf3t@ZhHsvz2X36EIel=7?KgHw&+xk3X27Az+4e;rz+g>@bDR?~&^>+e%jegx-@J*w
zcqvUIk+JR}|Eh-R?Kp=A)T_^1Mn3$T4D6}ft=cI5aA5Jzw^Aw~Gw<X1Plbhr8?N(z
zs%}JSb*G}=03gv^GRsm`&F>LUSxw%<ocw!l0`WMUh(*e&mFV_9jhoQz`7Y~UiDNBO
zIKSka`$I)fu1qUFc88VC>5L#AoC0uLb6+K&D{J{VK@2F+nrM|Dx_%b`r5LH27qF#n
zhk)HVhAf5iHG_mtwQRlj<qf$VaVzAMYD)W@3*8<Ae*k7)xxV;xwM6dnO<Tbgyw|6n
z%TjkNOAXighf1Z#M&Oz8q8|MaV~FU0rWSL2j!##w?c5q{P8uo`Lu-z)#@Hm}I16;o
zycStcAoJRVguc1TBMhY%K=3U4*G5hO?=sc|5MQ1CW`&dtx5nlJE4nP_Sn!<*9l<d1
zxD^Rz93?QaRcM4B_6?Kc^^B&Ufzu*q8v>~>e_m7uUI$+E)PM8#wWG{Cx;5oZjWhj=
zSPa{}v+`+<qE|~Dnzy)*!Y3yr#~&RLV}3ebb3{AOcdDFK9)5xH`lUSIsadU!3_A}>
zQW`;ETiObubh@epAl)or|IjUqo%vs=Een)yE5ZR{u)Z?*=xYw3vT*3q2SAktCo)<3
zMXM>;JiesY)JPF(Y8NQ+vT;?a<9su0WN-E`&d;6YR);lG+qlTs%Q=N~uJuV>^*g2V
z<q~mTIEAytbSeO9Qq;Xg>{8;SE;i24i}>bxT~IFYhgZo@r<Ak;fjC4w-taB;Ypml>
zgHgTfv0iZp8A@Kn3_}$CtOC#NiO+XnXMlS58f9MdtWS8w9oe4?E_!M%bpFi>ckkOq
zN4f(EaGqWD@oDAwwKNFjvq&~b#Z)FiLm-d^TqUilxqQmodDnh;S;N&m@UMlvKySQ=
zn+j$3)rvf~(&cW`a0B#Bkfw<22SgEgdG&uJU5P&v{{MFmF(SD(=88s+E;dIP&5<*k
z`w9^ywz*Z#CS^9}$Q7Zo%^Z<ij@XPOA&L@n=Pcd%{MPsPC%hl8_xtsFzMjwL>-9!u
zg4VRk|3V~u6L*&u3#6JNuhUphhF+5Lz3wqRW|VZ`d6E7ETvvP{k3~m26@K+~%F#ei
zMQxT+Pb90xgE-tm8L<QwaEZt<P+SCSSKk{aiYbreB6>2Zx1lLn{5#ICOEcHbr^pSH
zL$&nBT35Cbw(Lw+4|OH<@!qC6?zDcP2gPWk)*CDuRJgMv8dIFNuHa1pvu&40QF$fq
zfX=r5QTXs6e0<95gxB^HTd*)VT%rEXglj_=%L-|C!3dQHl!$h{qt|lviaoClzxD3D
zL9cLQEzFMu6nACat*`pgiMs>eZ~byvHr=RMV%*3_{GRMG@@Wjba$iv=nCbtk)mITI
zIHrNTc+C~C6q1_hbr*wkit7x%-26+nyH+>>ByD53H66)}6pYYaEaW+*Z4Dw0UcWS7
z7@UY;XQhQRNj73GTv>c4__Wb`j4sW!-E(y~NZ$^LC`NiE#JP}GyTn9f3V78#up)8r
zo~#u)Oe3PP$!)hc(~U7;zhQb^+YO*kKZILlU5r`t+!o9NF?+|9X#G>%7s0B{efG$_
z343H8Jn#{MOpv$@8q!bp70?2WqSj!0Jp30-?&@^^*n59U@8W-h8>a!@)F0|B<#auP
z!W`HU*hG%!s1t$ZY?SgN))aUWt;DB6@InCHiN;P#k?smeU)1&op+(aTD|6Uw5uwEf
zmVp+R#$4-X%B4H0$-HHhnWw>?X}rd*@sFLS{bqHituh2Y32+axexpAWeCM`6pOm*g
zz{?sHCS>>l2M{Ib=tha^#HkTJ!$-EHyk{#ml0y56nHTJ<H#|x-1Hg_$Z4uxxrP0~&
z<&jND1>vhB^35>;@aK_Q&$lhEKdq4I!nj)KV<}a&Q{}wg8?xzbp(B&mD<{6AIUy|Y
zRphg?%{~=<#F?#ei7;#A5A>}A+J-OL<n=$4l*%?$IA@cE%6j7t%xAp!H$xu>gd**C
z_Y4M0Ms=eS(<T?4YvE#C!V&i#K;GZFNbj)ML7kd(w(K+bH28-<`MTqjSgTpR8PDKc
z&pkeAzEfKcCb{3aZtZkrn}AYgH78QNUAe?C9u2S8&rTVRRT=7d(Ms%1mWslTVWoyp
zi}#~e`#!I}uGEh3->X2pf^Uov)wVTxlbO7aHc=4pxY@)0#&I)=li;IkPgo@2W706B
z?G<U|k(||w!VRK|rY4Pquc$w_R}Amwq?mIFzYq_<EE?YL?*qYLvJ5C1cJ)yGRf<n3
zAI1edMMJ%>&AzMBA{34?hfR=%$(0u~F(m@5<SCLP(e@sKMNwtyjkZ$^xMG_NDUYgE
zfi79|j%uw9X>8F-d5FAeR$hv%u*{x9lMdJ69@dRkfBqfuHlv>(M@^{jkIr2_t0@#y
zI8CZ29A6j}1!`U!UAl(Jg^v!7=6Ybw;7_iXT3}KL_N9jb<o2i-y2SYFRwu-@I?C|q
zEN7FT+dvx?+M4`$Jc+RIi1c2eZHXxhJK0YCY`7tIutnfp)&qyK6U?I;<t-H2SdJ#=
zK2R?C->+<)rP#O!q1uF(&hTrHE931%uo*@-agH#frI3E|Vr&g_b9K4o2RdkST?DiW
z1NkfC$*2nOTMVerfbM!Hwf~mBW`veoJy&F;IIvH&&3P{C&?GB?H$>29EMc{RovZlY
zPqTRj?~8LHMul-SH-Ge8wXNEGWN|8?c;-PufE=8jY$#1KJwod7JCiAbUMZ!9fyn?P
zgf;S`NteZXeb9`NyhE)=v&glLc)CP2LLN)Cjgw+cRevMq5uBBC6uUcF@2LlNk5o7z
z9B$G1lTo-S$^PIL^in0nP=o<}4RcW_@CO>AXS5lw{R<Eai?uFGTuZA-Ut7<^Aed>9
zc}N$kwAPw%NL%Ji=n-zfoy7thLv5a<UY8{u)WZlZ91q}UP2qLgn2HqhcJg3q=20=@
zCSgVDs>9czRV6OW^CY~47;_2Jq@2B_Ok!P$%XdTWxY;=<(gu0qt=PX3u^fWNZ@jmL
z@a8WXsdEf$Y;OX~V1unx&iTNxx&OK5KZ~M6guX$~6W;ZDSC4&C1~1dc_n_IJ-uu*4
zwmSveI!eiaaGs*rgR&auE|sIaT3#9k)Xa7}br9A3<}8?Mp;+hRy~1#ER~t}C0lnmh
zMNo4-koaKmsP&2Tdnk2Ja;1Z!yuvxe2Icm}9E1f>mCF+Rm}|buT8rTD>7o?lzlfT4
z+55XcY4_9<5q_z5t(rahf@e+7^1QUtP5H2nqPo7<iKnuK0C8i<4CC)Pe)c}z55cwt
zCoJnrG_6%H(yyrw{THRLfm`hj?fXHEUAOLR;{lt)NAuH7XYx1SBDYZ?CZ8$8jb|s6
zBprCb8Mq(bGaf~2PoP<C8MweHh5REdrSFu7&Izjq$a+^P$I-)PoOteSpE?)LJ)AAw
z^sK+H2JCLly?i?$&w$GE2tti9!Y1l-yv`H&4CKliY@Cy7Y3ucKLggT^p*dR@8Gc<o
z`(i98ic`{smRha;w!Sc+lUavl7a{YGgCs}b@I703ZAFgU)pF_QoQS*#2=fqAPVyV*
zrz(!d3Pq1`C}4gQiB-R^enUo4O$)h`U;*%s+sjgUAo`Sry87z87d{@V16I%5=)N6T
zXajbO%UMV0@4blH@baAm?xRBLLf2B+;zJvkmzk2xf_I3+aF##}YN(%vQ>Cf!8aU6P
z+?|xOb-MrjZ4@?``V^4F2cB}zs~k`nAT8~jX`2VVGg=^Uz8X%j4L`I6zxr}>{n~)r
zfMlZ(2B*S?_@Z7p8lGf&Ae$iiX24q5M1DW@Dj|S%L~*f|v?01;-J+z8YC*^b&$~6G
zOo&E*{1E&^sZfcy%TyT(9!&Ug*j!xT@Od#WdPXcQa5+-!YWs*`erP-IF-=KB;^#s-
ze+GGj=*Ez89CB*2AB)ru9^!18UY#eYUo$zqx>~OMGcsbCqF2D+mW2m`9La>DGojOc
z7j4!wF1FwMzO=5;RxEJAo7$M#0_8dX58*r>e&7x?OksU0M!v`$9tI@=!-t}NFZv&<
zFZ#%%%IY12=D_OtrfKPC(cnV?sDwzihrbl4ZM@cm%My<;-w=FOLgWHH?pn78JwNzW
z6G-VxlN`U*GE4DR;ntsas1ApE)%>uKazr@(+e&cb!a2psx@?KWq-3K`k3vQ&ab&wg
ztTVMC^(s0a`u47r7Me4mK;*HQ6JqPOJz-A^f}%e0L!;8ByrhN>uaEuWSQHa?D`>p!
z-zev26Rb)&JGAvUe=cCEGauo~!@&MMIiuccRh5D<u2SPcrpB&89Ra8p*_{0I_LU62
zc$q8Wh`lIL`i-9H>Ff;k7Mdd=^HKK3(em}hBg<CRT*)9g9;1pb*5W8>_|tB;V76Gk
zNcm^NQ>Ic2#WCCPaGr{h0Wd3I>gw05h|GXwUZBL_;g60tcyn6Evbf|;GZ_k=2*p2Z
ziaQ7~H$Me2BW4c3z1D5p?_K2Mao|ywEPVN8*PZgzVU92DL5as(_2G%!SZtIJdJrB<
zRiPPu@{uZOgMi<eDSv|w;Z92jhpPmSRAW(_Ma_Z4&P?CD<}J#2wRcrzEPcyxX^jq*
ziBPdExbxrY^$m_>vi;ve(EVE0cXT?)&tI50%+<EcIHg}o#$=cfSkOvP^G54ocTYuR
zerh!A-GUo`UggCCZEqQa_|~<^HS~%qqyAIBkiqD_GNZb{JDPtYQk79>$xxDETn!&A
zRX>Bu`O6#L<7gQ}$zyR+5V}s;o%cfO>*RU!4~s*KIz!jLa;XZ%3MPujKJlTa0KNc?
z-6Qezc-nIBB}<^Dg2sdRzvPJe1(NAmH|tcXJ8Tu?IvPMC^ro7^<G-H`4*wn=?)L1j
zkeq7Fm7YN*(O8#|ky@v&^SaA6Z{uNVVA<dHZ8bL@_sx2v>K%JcVV?t~x`!4xSTFHM
z$zbx${i{=qLo0`w*t@&6l-370^DlzDNXym5Ny?+Ik=Y<~n3rJvwI}cwWfxnvPV+IT
zpc|1?Ia;$yunMo$?b$=uhJ^;!7u7G+(<wD3jEbI5MkoOg=%b&cHd|Cl9#a<oS<mt=
z``>8JFNGD~uXQ>9;Y8gsKG3bc>eflsr#2?j$cJ!R=+${`iFAT|QwF<eC|4bSV<vL#
zomazhs6qt9#ws44fNBXZSrbplo2B;AX_}tut4};z!mqW6YQQj$Nd-zZl`d<}`2r%9
zjW9TrT8-!L8g=S1XYUS3`<mQvzIS5jFq8ML`rA$B(TnMzx0Lei0?l9s)D2USz0n|i
zyhq^K>I-rzA}NIC%wB!sPEatuup~}e{Q4&7<(;L-4{RB=jRqGiQyHI!@>b+Y`s7mm
z2s(5yH<TQy1`_(nH7D5GThDz{DRwt--PlaA=dh)iu~&_ceP_VZjU<B9lcy=?T-_P9
zUwYuJ(SL8R$qA{}q(W&|Rdz0QxbB+IM|^d47qa$^TK=XxUXjaAtQ(IsJqC8Uzi}D9
zeypkzeQldg;ZW>yD){q0539}+)B3!oU~X%s5fe+y#bzj{rhGqiqOI3m%^dLQy#Jc(
zD-w8Sp{5b>vChY=7%9Fi&iX_^W%0p^?lxo^04Tsy_fU;1Y2o|ayium;{>7EDTL<a!
zR5`|NFI6t}D?CI^<mJ(#^uv$&43=L#c=g5ZF6>3`c&jid@v($^;u-H6x3}W-T|REU
z=a2gmik^=@SLTZ|7ZhBB2rDQT1djs+mtuAXgpX=Qtq82vyD|8VpJTf)20qvIq4DNO
zjhAX!psK~djgigi-sm8^HNi+z87!iza_aesI$?8sElwjs0~dG?x6^EM()?fi4sJrT
zi%oqrp2k^Zqwax6bE)}WC|Kf5MHSav#?^~*q@|qMDFzSh9wwuKh3EPm>MymA63y*~
zUSW#f_BsqZcBeKJdKLAQcCqvfa3V{!hubz!94Pvi`)o$I(Kn5!qL1W+WgX6yChmE5
zd|PXF7*_uq<|p_GP$kw6Y<E8#Z4~kGFO8fUZPkQeS!v9eb!}jm#|A%-$oBfFC7UY5
z%RR0kI4OxSZSbl?L-+4ysq+nW*aXu<*o|*KWwm+uR5Q)Sl+xR(a8?1~KgYbI3VCvL
zp<!X{nuNSOi9fv`-*OK5@xP&`dNVZISbex*qh;cpzZEe+)G-t@oNsGL-CJM$%)C~9
z*M7>a`mTN8(2^%AxNK?lb^kMl-pc78I52Ut8#=@8Q3ebx;;1&iBdr(9o%iFugy*Fo
zc3rN#&45vo<oV>YP5SB^mLuEjxz7k5n;Q3QiJpW1YDO!j3f1$jnic&Fa5Qq$yk(`;
z-UB?$ayrkmYASiB5PO}uvz$2*xn^+OtKizqVH@};yFF@iM2*x5kW!4^SlB{wrgAf_
z0Y}S<PLHm7)Pd!&RDtSLVm}gY6T8Yhez~|&E9%JURi<!O+o$&%Vt<cv@WGFR?+^a?
z6@EjdJ3W5bOQsG&hq*J=T4;-)@cRfj)yp=#(y`9|*N+B|x|<7kLWee|PH1sEZ!?p)
zm5k{(P-Je9ar`}5%pJ^5&3aLo^J8cTD1?%86G3)4;j1moxWT+We<2S7cp=*EWc+g?
zmru?@Pof9%BKGp!saHEXH;2w~K1~k}dvJD(dm*`UvcCs78e^rq6Mob%U)x*G4G_3j
z+yghl?Q{vBQN8*Sd}^@H=t|D)LQ?xKE>jj;K?01M$;H`*u<gtVvsTDL6<79rfRq)!
zfZ5*$jbnGDj+t#ik1|CJgkRi6ae%^`0=1j7Jkj*=FjPf~6?gk-yf3d-Z&;GHY1yB9
znSWv@p+1T$NBp|t6KN8`QYYYGtVkyEUFh2i7ciXlx+BK78ztJL0k}xOzA|>8Ofnod
z1kX@?gJvR|QBJk+D<J(iSE-TKVGFspJ+1Qs8}b734kpLFcng)T|NRx5Ble5+fJf=;
z5u=D^%(U4&H(t9OQA7)ANiFX$#`5C4V&;w<12<|X{0#DF)vh35RVN~kS^>yF-12xE
z#}HW}fcpkL?x|l<8QE{d>u|=|zeg8IUx7mFFtzxF+Hrc67E5>~f~-Q|8RW2biJ?hO
zc5e)jN-Zy)EDWi$X8~X;1k02wpJHF8Gp8o=y<E^r=j_Rq&G~Fh{-P?!19nuPwBFbx
zg7^gFK^mT0_cAnBW(0}Dj$J6xkWb<Q(n0qt<?tnx{MksnF0jExsi&enwohMS<&;##
z;6;TqQ;XN!o+p1C%=(&lkbF@45a1-nBj#jez~0?aVaDtXWu{}a&5qoiTo_=%1IrT6
zy1L1(Ip%?CfQ`%RT{b0cm+IsK5#W$Ic$@qvhrwdBe36SgHAKqovJog-pYFLB;hG#p
zelvx*4a{Xm$&UR(3R^!!yhQmEjr#tfK*r-UhuzCCtyh5DgdSMtiidE$iyJS^u{*_g
z`3YL(jeAhO7Y2Prn1~`szH7NI7LZ2)Jq}ImJcj~f$cV>`Pt?XwkykMhIS5N2fp92d
zb|hi(&{6HQvxFlIVO^jyNGpOC|Kk(hzt8T6fNzb&EMy{f(2+N`A#(ANo%|X?!HgMy
zTa1|9%q504N{f9mYZiqzH$)dsHN040bDEMUtDj0iLl;k|n!`EBzk2bre?_-&F}o`S
zyyJ4hb9<J=@w`@l-)SWZT-`c@c}Y5ibD^ToNC{{GV)8sy#G3IVFifWDs?~A!d068^
z3kBcApF7sMHFvWg%T3kzb=Bv>Fm}t10eKOGJuRaA(!7ixr$>S{`Ihpq?bJqIL(K?h
z6KUf|{6Z1vg~h+W#RRD!Axw$Np21YfAVD7g(`^Ff6#b`tqqNqBH)(aS%lr5FlE*e6
z6uVzae=^rxKjRwTh+j|7`;x@50=6b3?Menw%-FMGzCpmbZHUvqXo?F5t`ZLrAz+D(
z!n1Zf$+>)R@%7d;Ya|bNB|T{7R8VeWQWf{75o4Gcur&5k09{~62<G9&dq)ntaS~@W
z8Q&cG&YSZvmzjS-aV#$sIgQ|G`cQB0Ycq6^d-1N$$1bg(nJN39Ph+YKsa5{Q`c<$%
z(RwWaQ&VsWvRZ!{k3+9j<<gj;H$k3Bk1#t8!dWQeel5TWZlLVR(>OM3uXP_)5oM7a
zP&7@cLVI5>$=5pOD)oKAxl73!1o{NAl^S0NQwY|{D<6a_%O?^qJ?af1bq24cD*P9B
zs!~uX!;cZ)?OB^XBYd99u-Md{>Q&%Kz*dq%%E|2daf|XC0(Gt{(-Zrt4l_EdgczOw
zMd5zuGav^e0q@6}Z~J#F65gCH_lyk<d6U$R^g$?tqiYwY5G^7hZz;30oKke7ty@pu
zlcYj5y}-wL!zKwnFK{Q3&sd-_#@&!Bd6KX+tW_{7eebNPPaX;JYci}uujh7F7N%TH
ze<b^hHhz7v*Dc*sN|s7f(RTy}a@Dn_=);;I1^Qew=qO1s7)N%y#1Gt(cXG%(3=~}a
z+?#hw>ZvHVX!1SwwYca*&)H&oLVx^zHJELoDY0De!Wi+*auW$j!zacCsbCFdGpzOi
zJiJLxLYOaSB3a{SP(gbF$`Kw>2lqY+?wYg5AIb@k9}~?1WOd%Wp%2~YOPY?MSYg@G
zbm2+V*F{9bSiD<PhAl2I!8M%QTPa&Pj`M6E6a@J$>BL2&p)Z|UiBagKdh;^R3zq}W
zoZAXWl7gx+m0qe$QVeakoRE*9)FxkV7Es8*Yd7N=_51o9=aeRB(H3KM`)p5NsYFz+
zKeLpz*nmb?bN8s(iZ8l#C-T1<uxV2YHX!~EP}H`F+;b2LO$rgbe0AV`qtvY<A~QS!
zjd7AdSIkq7j{Jty%vyznd;Q?#XbycEf_&#+Eufi9*q|?J{Cok)$*xp|eWX^UTEMZd
zbjL}ic<r2+^l_zA;G6Qg$-u*KRZ(U${w%Ug8N5`Rth(qGG>LlGv=zXH)M4nEg@-v0
zb~C*+q!9aauxCrgj@ZG!=a}m`>zW<%zQT+8)eZIZcHNM%M;Jy=AXdZyK9u=cNVXsJ
zFgwhe&c$%-MwJ#n1Qkdu5kvRGn8dIa=ro11ZXb<9ooM?Tov|na8Zl7diy&6p2r=F`
zoa+j&^{F{)J`x*!D0XnF_LcE>(5;G=tnRDTw|Wiw*r{!RWc(u7z}-yamRm(C@6yAl
zS?(#4DWev2?74NQ6(>X0EUr_lBfNi2wVie?X;Zn41v!!eOrPJpTxUMh&Spl^L*Gvc
zlzFV4E)QV~VJ2!0jUFCF)$m9l;Sy|(iaS7g0hdvd2U+wEAwz*fFTL_Xi!;^Cw>prZ
zC5`+dNI^iJ7B*v~f`4PuD;PC5vV7PLqjt`|1qwr(DIx<VYuc6WiqFgXo1>EgzFKN!
z`>sC(t$9j0!0sqYgYhR1R_svb1`4UV2NM^CoH%$QK1BY-*}^dKE<ZA)b$VIxugYI_
z);XRpR`mg;GPSC%qxbhvW}n5U{I6g<g)FYq=cwg4$4~Hr<sz%Cg{0%-X5XMP*baos
zN@G;5@zq=c?sVu8)xGw15$2$mi7Tp!1jM?oS>ZPn53l+KYdf>YpMlbVKhOU^Q9o>>
zf@I|u1Bolkm!E+z+heC6UA)$a7Fw#eQx8+PQd{O_P9UU#ygSx2v^+5<Oz8Pu5P*47
z!44F_-W58s1c@t24!Au9`e1Hre@Obnpc?)&WiNad5;<LwX}&<zH`On*`@#1{1TygL
z+WViz|NZ&4^DOzMZgl;6Zw_+IkoizP4b$MZ8-i~HN^i7U#$#)GI7o1gdMu9Qg&cb2
zFh}Ks{rZmBR%&*w&~vq72%X$f<x~^g=~L{UHVRPAD%5~IW`T^$!jXkVRntKJ7pF#0
z;_$>6R3L~GJ4Ihzdz&H^O-q>3ieI|dQKl_f3w81YcC3MdQ8PxT%euSfzHg1pC7XO$
zHgF_-Q|G9hXUOcnoZ(da;N=RCa<*^u%#snr@X8*W8pR)R`ySUrTwpH`9Ob^moQt_D
zuOCZs;jl?bTH3gPyA=XEDJDD7pXclTT$eFQOAy?3Y%bwdFmN{xH;3VQ2K=kr2x_*g
zK4)&3{6UqdJ$~n<48BNjmXOf5;Y3oy#Ap#Wlb6>R<p76IcTwz^B>e&lq}!VKomuH+
zG|i>gLu|Nc%s-4x-yaj>y&P7h(tlr`Tb0whP39^ddU|l~I6ws{69v7dXL=8gqO8Va
zYT~N$r`W86*nr2`Dgx8mPe7)GdXo?OAnI+APtj2%MgzoF)-;cy{`flTX>gdQ)M<iR
z;bQ$D>36EE^vpS!i(W)kWPp4GuW3W-htX2Qm@&MO`QemoKEsT}tNYVtorpBd53IYo
z7>$=?dU{3MBkhBib<_xM%IiW@l@(yJRuWT^dIA3#Co*3O%)(`K*o>kW8#eeH!Xvxl
zcc(dcb^q$e<4p=^O5*gRr~>{G%Qb&{r<XiOr@~Mp|G=Qht$hB|$zH_D@-sB)A-&a|
zU$HgLt3xNK*rbJ_$&{#Dw9upg)Ww#yiQ6n7;(5HfHTO3IOBCVe%>rJ+EVfOh0Fi{F
zE}(!?FnTfk+B?xxZVKw8{!kzczI7USoZ@^++cnFmYjn${c-5vl5#hKPCvdkkR;P2P
z&;D1Hjv=?wpz-*0gHH&cm?mf#@>R$K5dYSF!!dQTFFj|yXH>EZh*{2gp1Cn4x#~Br
zCpYS4>?#WGs|pa8#r`fo`Td9~QW~s!PDutk<DE{Ax&o=$J|7fziBJOL3_Z_2x;o^X
z&wr$v*S+VV-XR&^#Q*$t$VDDA{?WZ-?rKl%C3u@q>grgCDSea@ilTND&9<k2l!^MO
zPgymf&HLC^7UiPaIRy=X9XC)>k0%`!O~Vjo!^oIf-GC{YAG7)yRGaD{Ktg<O?K4n_
zbE)2a{MPxEpd!U>ZtRrQ*2R%if;y|4!r2FR996lqOL5N|pHAl2YUQWKh({MPGJ$A6
zu-NQ_df;09r75K|s^hI?EMA`zZyKM}Jq((8EvI@8e+q1`vi%kr9ApM>XZE}iQeW-K
zJ-U2sjHAIUo)@j%CtBmT>6hl8xcPXB*@pSj&5-}X`tjC6?(->kf1qv}O!(-9ArR~X
zS@RlR8B5N)La-UH_c?)B7Q8|jJgbr*Qi3vCQ}qW55VpcC&?H`O&Ig-MS!SE-&TiFv
ztxrI!=z^bap<uI@O5vz0^RXd$RR$9C^UC{CJy}_O`dsotbJHAJrKjAtV-2f+?vE^2
z&Y$ehM|P&^nSfZlIX(lNM1bU0!eZ{vQm2ayuYd6J6l5Pz!rIa-@`GxAaEhZc_~wH3
z>AmD40i&#rsRro#q4p_Rn1#yq@MgT|Iv_^M0GSm^z*RLSO?abh2AMAl<ew&SBwoeu
z&T}edSgRBxM*?UGq~?rG3UVHW8lopH9JDo%e}C-<ozK@V^_ad#V>1k`goz9;j+NqN
z4XA1LG_G)UapkubfEb`mK)tO{b`@#Et~A2Cch1g$kSokCP1j2=?%1K6^&gJ6LKk&E
z@#yoNH9ak;?bFm!e2W_)W0FxojOf1cKKh$SWM9CWN1~jul4F|wV5;g{GXYIg1~{<Z
zqcwv2BQ=B?@Qo&W%0e{;tXkk}^Cd|__1u4*q>{BBd&XMh&V;K0;3Z39WgaWFNqTRC
zq~<#p$~Pvt6v}&unZcp17}N%yO2-7SEi;eqZ&3>Q?{NshKaHPV>m7f&t4lKZVO4(K
z#C{F@U2ZfTIt8tQt=kk;a@TR672;*rdW799F~F0->wjYVU}I6MUn6C4eG(8mCLvdR
zo=<vd#}aSP78EjdA@J#I^8!=}S@MT}zZdRK)|B!?KmxKm3;N!&KkD6-iB<J``ZvzR
z{aR42HXA5m=sfnx4Inm>X%n8ckpm#3Fg11UncFCtb-w`mad0qyfc9f<ho@$HbSN%_
zcc{S>cm-ljtaJ+fU|qnC@C`qP`Jv?({{Q#%vt*wWMAOi)8Q?ZeOwFDdz+h^dZO)gn
zG?vEN5j6_jOUwxLC%4JYxCnH!9gHf$QVPO5yPxrcs4$5Ao|yZXv057x;mVsQo;RK`
z7h6UiJa;55jv5x=8=*k1lMy>WfHtb$#dtWae^CG{x-2bnG)^Hv@FJ1V*k^h_1zZcs
zJGD8@3_>eMx28_=in%Ehm*LE!j*Kv@yQ=!F$$RqQRz%MF-*uwhUVoFT|EDz(a&1_g
z)D`xe*7$4gH%SJrO6Na#Ss{6y;a6pJfBx56v_>KbE8_wKxucxUUgmTs+vj$M9GjxE
zTiw+kKy->Kh4$u$&V=RpP{$9kn*;>ePh8Jk!1m;7`U96h?IZr={uRb6&`CC}ezoej
z=@z&mI%<ts`jCt`m9z?DPwoa?rndW1D4$&{yIT1`mj>qA_uH<$(u>GwKRkV&M^Z=q
zfzI<kEX`kPal(o^TXBbjsY&4aRn|Z#Zw?r3scfnGeeUsx*&rMEQSGsHL>fFX2h`u#
zshMyX!H5$92jA6;slPsAxv8WK#?bq00HY{V!m(qxD*d1^_6Z2g>!_~&{~zjm_3hHc
zlFIrH^jZT{|5`0{BZx3RRO|ER5zG`O7xG@oiIBg;mWTj3{9Xj(&QGBOg$!h1qmDQJ
z)RPej$a+XZDw@53ZidWKAeabTVjdUZ6375`ZMr-Sv7g1q0X98nd;|hJ&7bdl+gkc~
z<eaIojFF6?U(==LfKwrO+vt!Y&<C&3b7U=8GcnDPk(HzRAigUQe(bWq(0yFh(J~ED
z4Qit!TzBWio21Q`-qq=CtMt$(sEw#ohpfzx5-Sil+LR6z{@!j(3aw@3dlc`~9{p#E
zNtK@EkmLNN$6Ew*fiUz>Q4ATaWaguQX!J66Mjc0<SOOI-huk}jH=w#Lmvgl#P+NUV
zOHjrM0=C)(;IgQxv8Qpb*E+vwkLAop3SnB^31pRmj!9Vq3AP`rVb%%gLg+#5H*o=M
zL4gC+(;vU^fI4D6S?%ZOir&84mEfD_@XP9hW`e8<=e&l|n$boMN4+0`i+@~7p98*z
zD?9>H0p&SQdxiPYiFKE5N#z2!N0xvRO|_iBP4K&zT{;DpQQgiSoPF~|Pdb5JnmYd4
zUKqRSHBgHe9q~?&Q+G9$I2I%evne<(RjwjkrK0}EE8TkLGYx`!;fVZ4mK5ZjL|++*
z|J0ZMx0#iV4N2+5$u@yga1c`;I~uBl_d?R*llc8JrV4?;t8k^4uPaj7jE0fdxdBOk
ze|6~oqrgUuw>!V+sIsk`fSK72ZT9iVJ?3I7s#bU2ipaavilL;OrH>md4t_B-Gg!56
zMmh!PqzZJsUClk`V|&2-!Ohb*-<ye_qdiNG*4UVDGaZVu`m01`9~Cs}v>LTxG+%%p
z;~S5BZCUBA!e|SXQ9_O}CD{gc!q|>T|8V3?jPmH~^UF+xjN|FOc9}KZaVM!sloZtM
zb-OTFt#m9|*YCCRBa-xlDP9iy({rTzg|u%X@{i=o-EZK__=mG8$MY(m*b`SMPi<I8
zR?&#lkPv%vAeUpiDC1`qGaGDzfLYu&!Kf6_W6o!aTG*1C@nr#0PK1U>*$yR4cOVZz
zKD<y5`z=d<ujEbb+2ypE$ZpgfgM)e;Xu+lVgE`3aK|;8pAilMRQ#~WZFMqZprt~aC
z{pwk~CGn$Y37W(>RKFUIAF_$UkcJe4SN*1TA@SJBq69;VSlp8J#uV>bVF*(%{Hlhh
z;#v#$@p1nx=$eOmbt(**umHODrrYanyjxv(3MeX+8}>&IMn`qGQ!IwYysG8Fz4>8q
z<g;|<K(TzqKb`yKq0ynMO=zjp_bUajf7>xY>Ul>Ai*6{u{($_%nTVtk<F<FvGJyoi
zK;*NhXR^P39ty(${UutiXPO7gz|@<J4yY7_2y>i_B}-OG0hh}`6GRT)70#~fiT(Wd
z5uvX4-H&(867u*LyR&D{ENs2Y(wwv{m#>ouRE;$w?heX-z00v_G`~$&5c(c#xrGj#
zP<tTN06gighr4=ms@G06%tZ~~D?Eoc(k?y*uEJd?KAVRRy4cZpWNrR5L|_On`bHop
zxe56}eTlxF5@dRd&Z(H};XDhZ_i;$%7kdG)2M05d`V-sWBFvYlbnpK%Op(bh8~z-F
zQB2x7&#1<&!`wj6s68PJ17;($Bxu>j4Z{_u+O^T+UIY@*#~tV*L=^$6Q;p1QF{>rU
znGyeA2HThmg}RZ>w^?RnL=kWwohJdCK<^*%LU92}25AxXrI~^Np@q8ftjr|D;Q&SB
zgA+e__?(s-Vy-6voeh2F%{7l2YRveL?Xo2u9Di3(*qAzxn~&$H%deg<<;UrNq(yDy
zua!sjXx4Que3ZdP(#_-Y1i{9iy{fk;5K_R0<3!-;+P9<A<k}axjpS7gO@7rYSQOMU
zT%xUcX}t{^oz1z>-SNP)WQ^5Mt91|l8=Y>`5S=^|H0r`j?kUrh*>R94&I&C*<rFgw
zJP8n<>WH{mQi6KCzs`G~SF;get*B_`jTge)Q?Mfk%vO&vgbV~>ClN^>NW(pmV*4Ox
zPbq%b6paL8zy%0)MF+WjfDQQsALY2zCebm`{(FDF_Fh+1=m!v7>r!Io11+bOq^Z|R
zKF>oXjyGJ&E6Kz*V@jXFw>q&i;Ip<0WP-fKnxGk`EU!zognIrqJ?i+#nek*Sr|v8U
z$=2tgUC+Fp>aW}YTi$5901u5=^FPy#){D+)u_><%tdZzWdXY)ZJo>Z6-BfZ&CGmyy
zN7BLUN#x~EN>SNF6Q5QMI;x@x$`67P-!xE^W6-FYM+~SoXBCaZ3YWZXQ9l7Sjk6IY
zey^8x4^ybHe*6?KrbzN1>H>9uW}~d+8;|g~u$flbca7|4BI^iuslqo@Xj!?{nd!U6
z32gfTT&jbMP#~Ayhs0AqUsRqubeqe_C*VUvK`h`mEqc@W7QG(0agLm48aQMImzYvg
zQ(YhF`ng<OZ%waCjTck5;=e-z`uYrLf_ZV(sozR@Fnqq@#e8r_Z%Y+${gTbSKN?5j
zvz-_7SQXkWCB>^6$1OKRKm#xG!m9Dgq%bV16ZKDhOFR!JW2*=#7=4>qii)m<-hJq0
zhy7vPLmqkUh!31}S7S#05lW=3Pg|FwK)j!G%?TsA47GxLU1XAq8|E>kVg39Qki=5!
z-})BlkH|J^X#Zf=XNq#4*{A2y#CgA2Kb^@i)2tiivV79lyME?(vlTzYORn}#R|IQL
zvA%zv=|4s-HFQ^htex}H!-A)#pC`H3*K(}adXN85XV<zwfk4_=<bBOLmXWKqzxFco
z%xkl;3Ug%fM4L@xl4y!fOa2dxcP3~B`fTYDg_<di@D6v9gbPbUy~d<#A2+C&TX70g
zf%@%)I_y{ti;l9qI#E+dMq3y0KJt11kxuSBzc05=!~E-6uYHncI@G7^YuCs?qR^rX
z0h8_sNtWIvzORvvg!1e!w?C6NBv}3o=q59WWp*m*0xTqVu>$|Z?XO-3irYZzKm3j&
zF93*2k-xqZm#M1~2LOV~b*`%`{^2u|_@Vn5@`3xa-xPOg;`_4(G>O&uUf|K8x8=Wg
zln6O*Oy@BxBbJZ)TWWLl^vSi^9qffP93NX|>k+pQOk&lsqLR8z$J}T$5(zP9yv`tX
zjQ3M`z*29zXPqnBp>t1tR9`Taa57h0Es$)*e-=oeL6G0GYuG9es_ILp&Q_Of^0!G9
zDVjzL<uvW>Go_iz4Sf-2asVpKB|GFx#ul?|ftVVQWTZ08?A7ZzbmH7i{*A?4KG-AY
zj&@n<vW{E**ki^QM*<hfkpUYtD}%a4`o_;h1bmeL{Y~>KmnN{&ZX5i|{MPBONjpkS
zsSSt<m0loesO3q&O=lZ3r{8zU*2=jmAYUDvTb1(S^xh%KRY6Vg5dqNY4C>VHul57X
z8Slx17n1fpa&cilFlvXUWmYH??H8>`@+%QhZH-%OXZ9G3xLR+DH*|xY<480AvhbPr
z2_%({awOrQf2oQ-szLiC{yyeficu8|mr^ng%6eV@!E1l_ETcJW15SP7|CgQXlv@lz
z-r{4P;w;cg25~sS-3%u}ad>;&hfdGyrD80zH;V!wF@yPeL5M`sE0eo2cwK_=h{0#a
zffR$@!Q_@Cnd{H{x4r*xe)3%1Jvvv<p^{?iUuF&vye}A*xnj32I}N=o>Uj5&%F*~0
z)?0Va&#dh%p$dGr1j^EIBDSSe9HA2_wmuxSMHy=vt*UfC<?D@lbq!~=<}c+%4XI3}
zqk@LX&yK`d;n-Gh;G-xOtdY;4>ix03ERI!2|JC2>ZyaHiD1F>3O~t3ivZvpjnmDIa
zj2X!F)IVePffjelk`NFzQG<|)>XY-U`;ZA*9s*YkgV;3ln}2LxX8R^wt7nf|*MMSX
zE69r`1PsmRWebH-QyW_PBT^rWN$j`+O7O{He+;X8T@m`<O=D-FkWSm}@|)eiwF8*%
zO~tGfenVn9S>`ZxL%#;|IPC<iz6Ph{%phG<AJ+hnfm=QjE-(_$E<gM(UbR?6m0V3a
z4~&t@C46lY_BZ{3aX3}Mdxrp&y+g=9QDprFuDVzG(__FK@OBBEtL3NW8t(@Gf#HX(
z`k+qJc#b}^K$^*~5?gC-GB~*^5xMsTd(EAHB%c}yY(kqsbn;coX2~3L=l~3Q*@gDD
zk?-egr2ZJJ=h18~RdnN;cTuIS^u|y%7Ys~20*iffh26GNRxndX@CQBwnF2YEI?QZ0
zPS%MaWwcV&0`&mjvbl~b;i?i<f0@;Pk$={&uQwRl?kE%jO8h?Go4O6gIgF*gLh~uy
z17CW2vLV$PU<Tlvf8J*w2Nkn=)5soKa>6*lJI|Zkkb6KK@wS9v?&2~mOzu&p+V;iu
zFfiAs?GMeGFAbwyuqe-or5uY75ASaeTYA%rsFXWnBpZ_Fiof;SxWa%*RGNG|9rMgf
z9s4Kp<L3V?1ix$_P+cG~9riF;+eQsmv%C5P7`;oi_kpOhL!g!RwH|B4&qDK{M$@wO
zA<?o~|NcD?Rl7sv@48S#L}38*B0+v-7AL6zP{PYmHH>fm_g8G^CQTY9!6u^jH{XjI
zd?TK<M|%xs{SB;=c($wUKiK=dFX6%SW4e88L<Yn29{BgyOZ%BsJT(J06#-AliprB_
zo?xmg_9Og^qQsgT>l@{LcrFB%3p}~(BbMc*0-k8TxjS$?MhaE?Anw=NM8O7;(>Rsd
z_dU8Q4xg=}34-^nR=8H?EoVYeZ<Z+-du60|_^!*VcqdL{Xn_Zt|18#0{?}LF3-p8v
zH|Z#Q2vS0q9~5Upg%DkXMxA(t+w#!-Y~73Wc+7q5*ppnB>?)E9Vp--)W)ad9MqgMa
zQR}Auw5~4-EfqdDU09UixiGXiPCFPmwNXKk#LT;>8KaIYi1#%-_#trTlZAdpsIDLL
z_dM@`-D^b8B3FIDgCg1!0a6nXJ@nus;m(Ymy#BE<v#LewZ?47<Z2<W}1t(Oh7oU;O
zo2amvwaI}TtNnkY1@BwLqFf`n@A#@nSM(1uhrA{YAV}jgu9HvvH|+C9yreF3+v-J-
z=QaH3XI*PfyfwqW&y5<u{|hqdfPFp6Mnz|p*#9*$2bL-QN>WLOQPO{nD7p0HumN6`
zDc^A#FbrZ0HL&<FOpr{}r5lO5C8++}V(JcCKcyYt`-dpVp7UR@C{ui1_Kb^zMt)vC
zF;u-9=>%)7UpKSQPVkj-0t#cUemwXyS{g!$UsD?tbvF2B_Q@c^^hFk*!Vz5)s}Fd^
z#2-q3N4d=BlRKnh0U`JXpl~!q!b(7M-7A<aKAxO_GKX(H|M(ddGkf?QwJL>gi?Tsq
z63E$g^$vQIbVP;GEvW>EaTQfC5)Wf{CAdFCsP0KRu>DPs8;eA>Wo2P^&LdBJ%{Eo4
z)9Uu(V3W-wdkgmuffMVXPgW>en#LlVDu)d@#y#fEt?L-*D5>^hV|Z$3p(Mv3uB)aA
z>uEAA<9vv`lr!=g!sdd#{Im{4EekTBJ`ib^*%hD!^MpXG-Xz;6`sdOD?O`LL0`zRv
zqNl;?SfDE(E7@~$5v0H%OWpy!5B%%!B680q@|zgT;H#)tjl=|G?8i=jw#hG|;(rI+
zi+~D10N^X3MSMHS{y-SSAzcIOCC0h)ylkvOJo3qej_pT4iD_yYZWfpOQNV%#TA|o7
z2rmVBId<9&qir1Y5O}VASJw~et>RE;ct)uLv5x7NX}eGLDzDTcR=PYHw)~q>yc)3r
zwczH(R7J!8`Sw(P23dc}I8Ez#<fWh_9e{d$>A*t`j+B*RYF3?Po-wn34+^Xu56FWc
zZ4tnYA<KQM?+VL90}Y`&vOdeLTqlt!Ab$~Y2Ib0|N3RN#kCabRbsDq)H6SsJpg1{I
zA2x<vl}N%+Y>27a9JTAiP5Hg^Nm<!DCI@Z@#Cbq3ezq3a{d=_IVYI2niV;kaRu~1j
zF!~+3?+Odne#Luf;mUD4BWpQvxwcj+z3aRcK8;&P_LRUJs&N~ae}q`5)1v+x({X1^
zX&G8V_4wp9NxNT0oz5Trt3v-$51qlt!k})i;*SsW+~$!mc1<sfl7!QAT1-{{X+pkb
zp1e&OkUUOucksmU8`y9pp~faC+kWNA!#NeX74hWGiX%%WBbu&S!c0Ym#?RvO&{4so
zuc@xv-D#lI3(GwXnZy8>9rn8e0~Nrl?7Jo=w<@Z+3UXPI*ULfK6?LJTaG~t$lb(6p
zfUw0E2Gbe8?Nj*7^-Z{jtssj5Hy@1Y{MsWqiZ6n<JNtoifBnF;sLl~fRh`cA?@+l7
zzwzCPi#e(*29O~5)}sZ)g`AJiA}YwPFZE*bN~v^_6^hg6VdDbg;?=hWcl~?#;34<C
zjs>Nj(7#9O_p)4}{Hi%16-`>MJ}D`{k+rW$f?Hje(lq=+=$KM`*;R|33=T)T(<mG$
zz+JsvFK&RxWwW1*^a{rvj{xSvzIvdVDf?g^7-8=U;n4*cEx}>~SmWPCb-;=*$uPP1
zo(2{L1U^wvy1$sIS?9vi8_;UgAFVi2UYo7camoy6!;KN-*i;ynOAy4?v9F+TvGrCS
zKvQJ&LZhzz`XF9W_^s9aLaxIBIg$C>Z57}mW{S@QSLMFx%><!)i-(~w53Jh6uFM0f
z)tcKH83=cM`QR3{gzA_OJ4YsWtdBPY40#U>C#fLI0`362(Q0F_<-^#|wq8iU-YzY8
zMO`TKHtj~cAFcP;5A~ltp2m!twZ6=KS7=S6sPYbQ6dSk!EmuZf_@A^Cw*@c@uC@6N
zrdZHVB13ASwf;a6o|6#}fLkT{_Hk*Z(wqu9CWQIgk{<&@?=J@AePx$zCSa~4c`>-!
zjukMtEEOLZ>bsy%cn|KcU#7*g4?hAq_>)slB^^<?b&~;XMnw`9qwN1nj_gcDNHvM#
z<zgQkd!7Wjr=S(5yUDd-&;!t9@!1>}s>|IbzVn({chh`{KP?vWjj}ZCKjKZ3YooI~
zHY-rI*)OjegP=FsQmb^npFUk{$Tn#ByL*hJ7*LJ3`}6Rsw-zgB%&FPKlyL8W)UO85
zbi<-#V)mZR3jVw9*UO|7E~iEv5xJX`-rP(nyk0BJ6L-F(9|x>;lMc&cfnLs?MTSn+
z*xptzprfGJDk@TfoiyTKY;OSzFN7t0D}njn1pWHqt$74C;x<6=nx%|kTLT#O1j0ok
z!XEYeLzOt-$88XWCp@v}r{Fo03YGkR;O<KIaUj+8J4QL;dw93&wT}Yh+`%07okj`^
z(w4<a<E`*h3ii#MY`$o>YDG-V=jK@6CQ+(5;t5v?@LY!`=Eo7364G{4@yc|)|KEB`
z`(-HHHGLEz%$xtk90>up)htkSUz?pvWgj2T`ZsgdKkS^Er-Zj)9<seARX~$IRoee`
zmwdd%{E6Gj6qJL;i7J&EuKauUrL#n>1kCTB<IsJ!PptncP1!*kz>GVe52s#!)$MeQ
z<Jk_`6<k{+FU@~AEJK~TeqoLx!7h*X8j1|bOy!KUyGyCNr#?B)bL7E|{KT8zW-4B>
zxed7#5}(HZ*Oj{6b?Duvkv1KK+FKr~DV*t3jR2DcI=}m@83%GOD$txDf8xA73}Z&%
zgAe*(b}gl|<f<ipM%dvvQ&OhIQ%>>I=|xj#4r$yW1mNa`B;szIb)7V(5N0q=@fjNB
zpLuLDN_fC(U`(1R@{_U+Y<!EN^=0Y2$Q@2j|GReBERdkJ&px@LA+ZM<IGLLCE@rg@
z2`z5PBq2Phfnvm8K+mQSSqZjt!xp+U{$Ug40V<mbDtF^J?7X67$3aa388Y+tWYN)u
zjs(lQ`Qn(_f&F!J7@DI-q1cy3tiw?W5R4-+b+c8Akb62DPjTQoD|kBR`%lh(+3R>N
zB|e43=DwHfH_p0uReAsrfJ|)6ruiaVUorgMyfwaz>J>mI65_BcA3l$w>{na=ILoe;
zcXK=jhwsaSZ#?;`Tg5!}3#odD`If>5FFE0=4!@vOM{Wu3B2QzmckvJRm8ZN=x>~F~
z2h~sVn_>sI|K|h^)~SM(bV0R-%$MumK_N)`w!-lfPwkgVO-JF#5LTYMx(n^8=_sev
z<y?y~|NX5UkRgQ8u3b0{prH`A>qkBzOPiiTV=-?^QD3B44Waj)fyalI+<`tsOaHvD
zs4F>(d0h$nE>THyt&bwc?%PBx63cHJab-AW^BGxfL+)z-#(unkpKFubi2b>A%NFjH
zkXJ_CvLKWQ44o0l=<}-aaP{3Xuwqv>T>;-{WAf~^QCxN2@sr2<M+I?A?fHhrEmg~n
zEI&Hjg9q$Upy_T3cg=HH19_aw(Ojln62u)jApsS;_!8x`!pYu$_RIywtni$nW{;tG
zA|uH5SrrphZM>u#hT5NilzULCnr&z(qfs+v<U?F`75`rMS+g=5?7eo4uWXjw{E@Qd
z@@3KtcD7;t+xr5H2+@V`+tKJDIiS>$5Zn@8E!$ISG_>nn4x&YN+FesoFgT(wquX8o
z{iie^_@08eku#0A7bruUF48=JN({x-1oR82fIZAGit<=@jt1Tk(LJdEuLu~gnjh|p
z9kG;-yq8!d3~t&Y6M+!~$N1G>$PuqeN_8N&B-?SccM{bcb+?nENIrqA;_#Z)?n=^k
zW{arzaDR%IDH_ons?a3PG>b>}r3yb{&VSWVYndOTX=Eg_lGIFz_Kx^B<rMPW>P!9!
z@035W;FWSU_ZkKNi{a0?c{!B(qR5F_xHM1P>QFNmj1P0%t)<B8J}$=}xDG#k!^;rU
zQeJ0MJgJ0nglX^H0*FywaQ9WzlX?aUe&w7KN=k~8*(^7gXvK;}93I-JtJK%e#W@Dk
zsSpyDgG{FjY)b+Tqv092^8JYQsAzhMg}pgIb?@Ffg}X#qOd?MI`JvcE!_w7|neixv
zskaBDcWZZm=PZ3jrD_Z6AMTfc^j|B*0k5W2XSL~Bay*g9KTm&~p$%Nq1>=<7#<<Z6
zr_k<K@;2PWc;fOX9EHczllp>u*Zpxo)uq3!(N|f`nfu}DlDLxm`w&H_=*9{Mv-4pV
zKvU5Mwo_b|%ku$wWUv5hx3vZ|OQP=mxT_QTQt2+}VPxlj2fr0>{;2SxWL(#{nz+B@
z>bq9QR_qRB|1eTg7%_xILuSl87@pUyX}qFnozPoSW=M1Rlqc~IXM)J*?-)X9T&Wq~
z66edI@ZZom(RyW=^$06v&0b+2H|E2X^f8l9>;X61+H9nQmOP}6!TpA7B`<TUz4oVj
z!CdpSq&iV;IV;3<DAnj|aZ=7|27vlw!EnJBJ*HKW9X1rNv@#SWi?Ji(3Huzel|p8a
zJ@JbmWaYN_NqjWzcO(I*p5Bg7<wz<rewLhZ?4uXySFw)!f@;jRO>w4KnO81MRiKsp
zouPN`0CECu{A;!7jL_1U7Tyt9#aKcwB_m{z!Uhu4KT?zyH|n|%;6GWuNeaHgn}TDz
z-8Nvrha5QxB0)MPSOdH<Wn62+SSO$F{t66*^mgYKtGu<F5n5#U3bFlsweu8gjz+Ay
zA7`&ddAN}`XJ1R#7PnFE3xoGJ-o710tSQ!@Ydxe2__fq+@Yjb=lr^YpzPAU$C*0IN
zV*WK^hYuQo=Z+P>ZV0z)TVS22uxtwwgqdFq54xXI`>7a%2+Kp!TBbmL3AwO#7Uj*A
zuHTMMTS>{O?hvFCooXloGj+)pUn(Sk-5-Hev0CmD1e7MCkn<-{nMkVr)uFittolVl
zK}e3uEak(Ef&fq=W!zS(_k5qepicL}FZr8a4J#O~BH%PIl#Dp`nCC@HI*#uaXF5j1
z3Ye96ZH(z!YhINaCiZE#S{IT=z&%V|E~U4drvn4I-IdQJXrvL$0*CVs4hPd4!}5;Q
zwm7qiqy2nq8<XjyPH)b*Dvec8lQ`L0S&CmP)RvuoGM^bx{!i3-{qzA(ZIY@WIQ^u}
zl=n3$0?JIOj+g@rDXF~eMqQsW^bp{dKSLr!Nv{Z=#BXw!MSIklw4z0)GNaZNlvurp
zMrmK=_aI60q>?wFlP}HmdIqlC?-#>{>}Fhs`Na0tfG#ns1^vbhOoHaE1OdGQyvP*U
zk2j0|EYzieFPQLbikJRL6^p3jS!1SxAYdiY*4wX8LKw%Y)ByHyzQ<(yJ={nMEa2C~
zMjZfCKNgv8!!B7J)7w)DE?c|W2F2|>qzS-5m?qQA&d7icw9`t(1)QmJotK)5u$4sI
z(7lKI<P&ejaB0gFK`;k@)s;O1XO5D*>m7w*DVlGE*wxM*_IXgJvecMT;2V$hFq90R
z>S)Eq#z594^dvxk>5_Hyj-MdA9$lK<-mhncwd!ww1dE;Ee2TQp!!cBp79*Wc0<_v*
zU7hA)^&V;@FU8(*<?=;D|Jmf-&Zre$Fz}{W%$KW3^$)gue9egYYFG&<=QaOX@yf&!
z>R1H~ug8q-DsS^{`LVgym=UgPHpnL)`W3vBsM!Kra|X&@S@GImmHzre28C*v2g=)n
z|Hsjl$20x7@m#s*D3#jS91)Rpu(^#Ul_PDgNxn$PwYihXu~N<EOd(f}&E_b_<SJ!D
zj>wrD+02ztLd5UW?=Sz_>+|_M&-;1a$79O8sQ)QwXVovnw${_<P@f>er{g5ll&wbI
z?nDAAE1Qhx3Xsvg;-6Z8(^#+Ig(!(&Vl2hVG1dGDe(TIBM<;@9Sk%QTwX>Y_x27u4
zkHLOLCo;Wq5Fzsmml;hDabibwRhtCE-wH^wnDhKwMIEUXLEfORWS8(Se%1R~XR5~?
zYn+nN-^#}t;d3+I=}1e|gknhc%)R%z4%3_cHx%DK{*fwi_nm(8eN6P+E2QuxH<}_0
z@}o)6*WU(FDe;s<^b-yaJWA>sV*FmQ{mFUOH$BT@c;9Ug7J}Hj<~&P-%;*aKK|zCm
zEq*ziJ#)>_UWyx7i}j^neTdZ+G(qu#arFKK;$z3wt5>mT{SWZlGLnB4M-7q7|HVil
zffa(qy#hSD23YvVQE+Dz*kfV0L>RRgG{%nJ0WQLy-N(H(cDWti3h#6B6kg+pTV33M
zsNo*(<7)Y)-^S08PRdhl!dP(Q=d%v5+;PE&xO#UPm>>~-mVZ-0RgjMveSM$D)TS{G
z7$*63_JM^lQG0(kjOJ9353sb&|ICY!uR-@gxx!|#gT5XWk@GJN-h=@t`xt)M=;ud-
zp*>9O0cHITV7XwK2q@ua!yjUYbHcA4GG%UY<wI>TAJM||b3U(P@)?x%)BZ{N+0=#4
zWp>nB7b>M7S_$}iU!Gf3)}OCbUVE2-l(r!w#{rA35&*oSR;wT59l9d(gX0@-RY`LD
z-nI2RRfBSnwH~KUuTyXOnGoBsRHrlCTPj}_k8tP4fZh0=z<*0~61->10C-1wQNHPP
z1Ow*C&tfb~dJ~oF@asY%LqAY4JGS0(`CF@3Ea9OKI!$C40sNgNqd~uC?g#a~OcEBH
z+drLX@TcU5iGK6`;HXvjYtS!XJs6Gx2mnh#AmQ+hkH+EIL@j6zwJ3)FF5~B{ayFl%
zvA>fw$-V!*7`uLI2fvOrXSqplP4hv<j0*f1E0}Y)^F$#vXa%mX48VGHXE+03Y=NdQ
z#}bxi(0OletKQ&$4D82GSs!OT3G6#%Z)o}xJdt)xm*B~2D^I22KTG!5+LQTs8A#%J
zNq~@LeR@)XHt-wjaH6)tKRbm~$#C8|y=1D%rQ~q=aUjwpzT!~%B{9h!HTl`RcC}(~
zMGM)6SXV?}xI03D65Fo6tY2;0Fxml<Q-7&%{b@@!mY9PSq`vx`zhC{gJtTZlqceDg
zHPCe`>w@N&81Vl1HzG7bqgXvw)S{@tGM*@_Ef!t_6THZ7Tn>J_WkHrWR-EmAV{iBF
zHbvv`x?)bqp_R?rqXPQH=9L`WUm+8M0-$6o^G!z*uMz+xH>LW_He>NQ?)xP(GVonr
zb<NPR7wDW8kq|w6ekxE3N6%4BUvQ8}EA*Lw=3S>g+i#~CO#BUkH|WKJSth*jn>iPV
zX-Vsk9^$cd;k7j5<#P1dh1W|~L>~J4qtGs}wKlG=YQa$t^YRHg9?YhGgOntnV8V(i
z6)hQhG6$Z>?`7w;znB+}*7|Xy4BTfjJ8r#seckXY^%ph)3hzPdMUbOJhvojf!yZ5^
zA9@(|$?vL5$bqYDoy!9S>;HPRCo70-6)fh(w#ai|fiB1c8n3WZk9ha@1if4JlSMdP
zJlH1+L0!x%EKX!m9k}^9)YmtgJSZpYRJGX&kHE)!+&%znF&O}v{Tg`jH!awMpy8MW
z1JvJh;AJOeUd9QwOg`xi6ndF~Dl^v1ZoABgq%HKp9+NimOj@rik$%=Jhzav11`$uY
zYYsIdPjhhDNDmNupSQ(tqF%k5iwBVa_;PkSN`lQpAHCoAwJJ%3`WR=!PkKWERk2JS
z&pZ!soY>?ctsXG=BeDryx-lpD2<Xnzb9slPk3#~Q880jZ6`26#vjjN(j=hUnJR!FE
zIdv$qR1pF^`RA7Gw7I7|J*PR(Dn-M~EZCp1=EIa%A&;U~pd+}`s_M3_Ryl~2o=>~s
z=`3ZD2i4<=V;OhSPLhYy3`Vcv)1OjR%`|5z-*7Yqdw(gae2^)DD!*0OvIzKDn)jx=
zMDAG#@Vt7fE8;krug3nsSg}!LgZb0&Xo2&b#CL72@P*-F3RXiNmenT6qxYyLNpC0%
z4;4}!qD%wS!k7VWeQ@~tCEl%HP|_Fh)YYRQ|79Wfvqn?ZbI`qpZ_J%=-XbfWVdd|R
zGq;UFfIy|4r~NHTtrbYazL;w)Sc!ZOVk2}fgZhJ3pa}d%3vlY7alpissR`mURN<<v
za@278F>c0(5F;6HjE8e>_FiK{^WAyF<krjtm2eXZM%%Z&yV8BrC4z%x@PiNYHR@y*
z!L@xb5ym0=!E(8eXqj|;T54{{1<?H`k_x@21Jc=WC6T9B5ene|hcETF-1Tc{&byi<
za-mQ+34cGk2hE`0H6tm;64yAUlWys1gOsb;$R>11GNR%7-68m#!v{2@5_3_K^c<%b
zdVv{vtMmJ?(QC}b?3tauG*RC{v!}Qcs~P3dW1fTFv5wS?3Wt2Su{mg+JyvD;4t(O$
z@>^&!mBll)nHv)~-|o5+y_;1zb1Gi$9YT5xC<t`emW7322I8_}N&9%8ON~_Xc!};O
z^3nOeC&Yv?Biu~6<9)D+f_=|hKZdrbZtw%5-g+I78H~{OV=xPTO3qT+pRlmzBJfV!
zIbnw@zdh8eOf^~4w;8|;YIl+k&dUwlpa>lU@XV>)9rU5j{95dDn0<bmh=lnZQ1>er
zuboIs4rDeg0JXi;y(vq8=PleLhffNpqx_}CXg^QySvz_yCTK%w9(+IsUYt~8iOKPI
z&q5v@YBDBzg9u>l`68CdYS04fuC*%RI6RN|>b*%O1vq-i+T7y0Zl<=z<s&QO9GLd5
z`2@E0iy{l=^X&~=PyaxB9{BlyvDc>!`rp1JEOp8BOxv+vmEMczgWT*wvtu;EiazpM
z_D1eS$AkM{<w6M~xSHtrZgj24NU1Fn37Q3G#S%rd?9=g=*qX@eC!r{^LYC~>?Eu!3
zIl%aW`qgE5F1h}<lmJnympp1{s*Rf0*6gt@lh)wHwAD}!9hQ^h_)wqCAqXdV`{}7v
z+CqjY=rH$);STr_o@8vOnOx)3{xR#77`$@f_2b|B+-Q+PETGG;FY4H=v+zk^Km<7t
ztQTDG=B&+(=@qbGt*bRWf>OkmeLBCSf_FZa&!GA{TFlGiia>_;cOUPn`BW&lYo^m$
z)<i@hdK_$x=fH)Du*hdu*~0S<P0zZ~5$!B)cTQIb<4n=5oNZJLxWQaAmM8^$|Jm*~
z7xLmv*)9m~L*7~uYD{BatZ%vp%dLyX`!Jgi5-npRh$uQ)_te)h)3!A@2pubQ6nNs+
zxmSsj3a3<y06Bv)guYT)Gyw11&$ig@O7H~~ueQi!^aGO4?f5aZ>-?AT#8j(q6zn-p
z?hw`fDBNN8NJQ=&IMc#+FdW4D>_pgc{<R1nnp5YUm<R!!6W@5NHWN>RUmt(P4P>f`
z@K~lHV`lXB2@<ch?5t6NKzM${?wXw`B3h{*rUopTQu|k{NW`#7+c23N>UGoMKY*pu
zd@g)v_1rUoYwVT3iujQ6j@yi*0$|@*;?EufZno53tyc~m4T9HuHHA?7UJ-rM_anls
z4`mlx%9QDslRDs*X|H362RSjO^gGp#op6zZ5B~YPAgk8D#7jtocHku;k`A8<Knwfo
zpUiQBRj{;Cr8LUR8noLb%psmO`T<3hin@N0OUXo&L>xHFuG-$^!xhGG!HJFiQmoN5
z>YbSRhBjs^e8{$~;U)a6v1Sj2A713*0<fflla#4;0o*>F=u3w83QygK1Xn2xz1^=~
zgt&iUx4DRC<A+YZyUrVGxa`Vk_Z0Xf*{FS(LQ?2`rK;YI{;z9rmU1cB=FlvqO@W}w
zE|ZKnR?b_nO5%ky*IQPgWn+oBtUJ{mVP;ccpRSh^l+U$xfVgg54_KFe)5E=Jz<tdq
zU!+yb;QqvF#}dCihBOGNvTW(5TS+o%H=p8sVMzb%HVi97iqwS~)3ei5U`NEoB!Uma
z**AP;nDAoj7x@UnWBhpZHl%AAYehqE$l@%%PM^`mWEt;%%gsE%&eJd!!QaT7iIXtg
z*>o?1Y^`-wxUv3D3&PPnI?>zTD_Z`pSG0WE=GZ5KZbFnoqT+tH^`5iX<tgEL7#ukK
zhuZMty(tr8!Hx$<(IZce;C?hee@-32elTCuUN$pjhDZx|u<Nm2JjgsGIW8XbOkr3u
zVwes%Rm5OxGgo1_HH<)yElLR|H&^OZQ;nsnUDLAnFS}a%J?;6i-ySt5>jEud_RjvX
za}`PdHfzCbI|YcqtC}A+GPo}(>F<yS5OYof0qKwMpG)N^xW)Wh3i*&+tx`|WlA8~;
z!Ol-ckjK{WzwDXY&fNN2A3q%K5`qU4ebL;?A&P*1Hn7o>u-RZK#)GX5JA`p(%LDA#
z;SW7Q6uFBK>Su@bgyV4V477feYVe<2OUn4_fc5c|GeCqCLu4`LwfN@j^X=bFyH2JE
zQ=W$ydjb4lp%yS!n@Gcx^)z1l0t(Low1Nt|zH_~t4}RgX?(<;K2(GQxju+UUchxKu
z9pJ;=I#}s#O#G9^B_)95fbE>y1Z6E2pyncy@K1YeOK(s-3?iujA2``47MmRmIt)8?
z|F;x?RB{W$Bc(`dVBmSLV5B&@og}^>5EI^CgZ>&wTTosE$L-ItS_FHEyC-Bn!#%{`
z%8nzsYn!u5w75?@j<JQgtTT&BK|pbBTqp`5I2jc95dxO#q#U8l7Y_0z27vd`1Y#XC
zV?WhC$vz#tv(|O$GGh1Rh8orIGk#ETmL541@><R*MCLp~*Id(`Eg|@?Jk?D$zpvp;
zl+IYahaY#h$?#*iYaTT~e9c%S$JOOTdfe87=M;KAy4n5gocEHtggLh~_76E8e~ps8
z5A|WK44)oJy()`)gOO2s2&i`o-u?46a<lxi@^Qvo)&H8%(p=URJEHb8zK^ej9KK|h
z7p`b+1*q7kFAl?tYDGAT#rSNvSumg<7Uw8t&N47$V?*a};PEt3yJeh9%1d45vvUZO
zW|&w9rKXdAEo=fFPRd40&q6y_(``VdGf|X3>U_+}y`Gl%5Uu&mpUL+UEqZ=adOuxH
zPhrLN<zHD;Amcy%IbfZ4>ux$fBI6QwTET)X6zp(t#pjs-*xJ^31UJBXn@)&hM87|X
zLlRRF{5f%jF^3ca0E%QE$mn|!0u|w`;FVLD=Er+AQU5K-+woKZLhuCJvH7OKc|dmw
zaQ~)%u}2i_msE?g3oR0B)P&f&7;=wPN(>L&XRvBaZ8YVIxL(bmZ#oWi9mX{`PQr^_
z))n;YxGE_*OtGzAEHY`00qfk7l)S>w7YaYT0m1nW`kd#Oavgfj8P2(1YQJwmPA!db
zXy|H%MSX^=@$8fs)E~_cZaIB>W&7`sc=>zE03e@HQH7Wx*x2>ak{3~?HH52Aw}+l@
zm&YiX5Dypq3Opl-F#XhE#`6QfX3{=gIr2AwZSjgIM3@`H@OiBfoNaJ>#Ie!LFnr3m
zoHuvq6}PNb<+(AT0hg?Y2?lkLbbg;(ybm6{qEPVw0A!wVrkeO_#`!+-7}q$lF|Q2#
zt@FvqzvjN1dZ>Xnl$J84HUS%!#U&EQ|Eo2Xi=>7pHb&KB&^2R}v7YoVBpMnMek2%l
zm8Ey7qoJJSE=3|MHZ7iY>O^TuNUbealnBAkaT1B^A1*CBBo>dSKft#-t@AVCx9&$h
z3Qk@cYuYxi!UR2=Y5g+WkscWW0=U#o6Eo00=H%|~o5q$i-}eO@EA3ss&wdB@IJWXN
zKG?=}*>Iuj!v(=CYUQ$7_DojI5VmFkmce?6Z_Rk*o8H4aVJr$6Cis<fwdF1)99HET
zcmJ7+br2}>1s1VOo!>7b2w@yKMN!BVtm8kawdX++mLaXM;mNqwCGN?Ptp&C=&VBP>
z0b_qrvtIzIptv<U>1O}RDpjP%34PXs1vE0H;Iz8aj^{a;3c4)twk4M1wYWFfx)~JQ
zmmsueda?ytQ&CWZ_o`pI5Zg-@hqcI7OiR9;efHvE9y>+$L71z8UA4B51*__2_W>Mj
zZ0<NKti^)0O8E@gpEU!7#@W)XY8LJtas`4q@9oTN+|vr*xw4GDH?0Z`cdmE0INTTV
z-+TvA&ji?JgiGWfW=Z3Ug1it3gUvkgPR#@Cr`D{~fI;8xYwdvuswU)4$C2v-jjb6h
zDFEb>NkluV`Dr@(JL6_fL5zQ1;X^L?s6c$3NE14}A79-GH$AAOV#XsX18PD~ILb7y
z{$CUE(~}n!>NHm=vsM5zr59uGgM@iaVO+5YQ#b`<Z%>C2{5#Gk^aNdA)E`zmp|3BH
zK={iKI7>+`C6%T<CdQibwh35W=6^b-(UX5A3`>i#N%(U2p8UInH<H|N8LCx8IU1w?
zUpvLsfeoG7M6K;Ew#+U5XgM}NrOFV2xW)uWrS$M7hLpHS&yA?%5Eg?U?M$OJMIM+q
zLIpE91#5w7cw)!Af#U%D_1elWljf6|aMZA-3nFBxln*lRU82>;6M*)URY3g}dV^EH
zcEg@NnQG8zy4-`lNv{q#w>|OC^h+GcT#)NnQ(jCEgYzRCpr@8oWAg7Rea4`va)~($
zp4T{QH53`ZnN=QEB*cI+%cj781y^d4beVmxYF4zaajq}x3Jzi%w^$lZh6M=J5m=Z>
zYj-C+bX1pcoF#D+%FL7lJT}rjCh;>ZDI2})VWa5GJA*)lFFl*tMg53fzj!lg2R(xG
z9Dg{5)9I>Dy}%<iSI^CT6Y{0w;2PWnX06Lq!myAJvat+qhw79gvWIQky8CxK!rp(F
zejSF&Z9BofhD94a=IyMZM51;2Y+>g_o}Ra7z}6JX^ik(=F`?B-NFcc>tjK6bD_nO<
zlHK<WSg?GAH`XPk#%K#Wm@_?m7Yqe;30S~i%*(y?!<T9S)A5z*#b-y%l3L+F=3ys|
zWc^g@pYPZEQs}~2Q(`>+qbJ*V+RcF*zLF29nBO6o$DvG6PRQ7sjhbQYH>k(>C=J%C
zdmnReH*7!g-WtkO@7jFcesv4>B&82<sH<fCRjg?G?URJRJz5=MR|!1O6__~rXN}Kl
zK`RiCs%vKWZ~;Z%$32pIU4iSZqDk-fF0pH>O9}>ZKWg;o;x1I6pEI8D9tYxpY<2Kf
zhddcp+`j5@>HKIjT|zo%tOl^yiQM|`W=8x!z#Cb*TcCIbnVZFb64r!%c`5ybUz?Ro
zuyiFQquegOk$8ny4F~NFI*Dam4Ii<E3kDMnQ(!7Ne5}(cA`%fJ4=FfLX_BZ!34rWJ
zQ#c_YYNyLqE8ihliLRic;AMv1=d|rksxYpRY)Z7|#pNxnpbRj|*>Pq7E4RB<aqsUX
z3&IHXz03OFjr(9%Fv3F`c$*A;==~3gIeMYS+>yqh!lC4H;V)M87&61>Q^A)?Gphls
z=4i8$98He$TAHcmuv#c5MPuXI^U#Hp*)#luaIHQ-s-kG5;*6?5XLE&+><s>s8W)X&
zIJ2|j!6Rxn%Jl&c;?Bn7kUS5AIG_x_EJ7ZY@J?vFEZaePBfI9)Z>Vt5_yQ=LdQ@ld
zVk?H3s01}<>0O+LiR<MIJ;wt1f<^e1ngwhK=P37xQBZ*@`!P6*_Kcc92&?P~+W4xf
zf0;A`Xa{YXe`dYv4C^2hYI9&BzL5YKwch<T>h(et7p2aF!(&c!H@Pjl$NFONG9P&0
z7kY|jj-9i=n+OOrT&PFjxu}DIcE%tqRqh(wp;l~NF_dP?nO>Iz1UNDWaaO#!5r|~o
zwbujQQ8balm?W^@StK2SLSk5p9Slns2AVo%jEZ=k+Fj~+Dr26O(%$yD+74401B6}!
z0@kjSJL#fid{=`KPY|v1q6_tPT@sw2#G`&KMG5+xT2yD58k54kRjjd?f49g$h3Cx?
zt}e|!z+YZg*M^XD8K#rNH>{S+U*x93g!}Vw_u+1#mnrB1{0*tVfnu*0o;^~*Kw<2Z
zn<B_7v+_d-uJ?X+hy6#p%HG_bytgL^W47#Wx9qL=-c!TvP)q@(*rXZ`{O9q(wdC-}
z`ahj&wi6C}B<(l`5(8=9l=5&OH0v$AXl*6ZS)pYiDXk|q7Ss!P{=XxK)oA)l{V!kL
zWYKQs`~-Kydp~IfbN+iU&Vl#)R==#d>9PUG{q*Neq+oOSAD8}vb2FZf?sOhPJx-M1
zR`OU0`h%1Sy4bqrR816vivnQ}N_*e!tm$a+V}!e)Uzmj7<UG91_5&<+f5K_US@7Zb
zi>+N}g`Z+r+@6r1U=wcO1dx-O+g(WVW&U{+5dumg?EwVFy#rZs7EGhPtOksC9$yGU
z)rtEM^hH4sw{(}|$?g35O$Ij$mdLN~94-f3W>32i1Q?TjF|~id>hK>iMjEi1DmAr2
z5Po7H%)*#<_|bDd{A_5BVmJJ0a8YKC_D?Vziv>~?Nv|*$<FTc*pTGXEOP&%v=I7{G
zrh21P-^||skHd#n*pS*caP4tw1o7y6JF*9Vb~<ByRwEt%+E0|Nl~cIgQ4-h{`NA-p
z|FfHl9qZKPAmYOVO+C|uoI~y-7vW5#1g%(O^xQ}I5N-0-qnH9x%e(9uaTDT(bk8cR
z22-Y<8R~J*CSb6l<ynmg0(guqeDLV)buR|S_Mq11<Q2`l=K}11&yTJjh3Ue@nfjkw
z4AXRe_7)Bx@QAk8-gbQ4KKSUP3j^6pTU>aKyVe+L)5)_5EzBkP%0y6!?g4|RHJ+CQ
zgUpFz<AztSU>N}BS{YV5s&LA&G2DhFs~ZDO5IOvDAmYfX0ze$T6}^{?oN>e0utW<z
zn=FXo)TDVa#!0<&+qqJk>ttkR4%^AR&vx?QT5&#b5gbVbh0+j?bhJJaWUr|scOQ=p
zpH@Y)vhc>R7LY9NB5#U%*e3<K(1z4t;+?;hsdQ4n*iuSNAKa!|Q)G*fU%SwCDk3&p
zeMm#-NFzF!`iJ=gNBaik6oEoGDLp3ZirzVj?$#KxJMd0r{rjlGzA}R6zdx!uxp7k#
z02>QF75K+BzJrVce0B$YTwf%jGhH3Y9y9!Q5VzQg4nT9%#;S9xmiWDZmGXzi8j2Pj
zEs%~s$g<!Aq7R}_D|(M#iLmlprM`jb9!*7yv=pTq97~{5%(#6;XdnNQ2b+aIJ6GsF
zc$yZ~h3F<-N^E47m6&qpjP|)Ovbj@ti9g$F7PP<9L`1eu0=1qS7y<H;x9xd5OzAGi
zAHg+#`w9Lb7qu5RMf<bUb;>r}Vi?d^k<|~20AVrGQ=6wWp|QrhuWC8Zdh$gf-u84T
zQ}i1xC6-vD-M3o$3zL7+{tN0*Pm5=+D*H@{qOdBy+J3G^Z7^K-S_4iH6k|GZMu{gP
zZ|42)@5zEd{Khz*xc?hXA))am?WjZOw~Y0q^!i##RALWV4ag?xJ2$%Yxu)|QSV|vY
z)P$nxt9^FF`{#un_<gJ4=63Y)l;)_S+oNk`N;g=f1Kd*kitD*bQ>SUpio)UdgE^t+
z6S9v<oIn}|N*=^r;l*tWDKcO7!H-`J7(6FCp*9N!UKLe##82?;E}4X#bKk%LS7)Z(
zQe!6XT1#(PpEb0q9dG$-AOqv-G6RO30V(V|I0$ka+5BUDSRCFLUM~|t3|VaKiB-z;
zWQ{tTBiYqUN(dm|oDK})@8GQTu59-?M}){oi)%{^I7?(Js2zUm-%cWSrZf+~Qf)Uu
zAJ=}_|2!rF3#cDd=WY}l19thTe?!RcE^RzI6k|-hA3X}-pU;(cvW}tu;emwSerI%d
zUAern2t1WITY!HZ8Uf580`SNOb(Da;UB3OZ^R$M**WdBC?CA`g*Fg1wMX;u@5PPb<
z4fV24M0Tyuuv(8sDk06BajmA$s*ymo_R4vy$&>daq;UT7TT<C^oj8WNjtNl$g6n%d
zK)n-J*IARCw`vnfm8%cnSRPYANt1$!aQw}mHEM0?#}2NE>LPo-D|)5W`9PI<P9P^<
zseC6rQXdXweRmq{ccC8rT=7GPXVCfO#a0p7e|`2V?9@$!ARe@Y5A2St<g~8=R8p6U
z^`6xtqtgLJeg}w-vkSvJQjX54QZKe9$!Lg_`c~I01m?}$a!mD;4rMXcY_JTK#CBvo
zuFTV=5uL$3GT(&GJb}BMs2+9{57-UZ-i|G(qY{8iol9Z9u+U|mSsYgEb?dU~uco_K
z-*Vi0+KYbSJd<A`FXiq}QQxR&x!DOIK|_2tACjF2K5MpoOd=NiHvP_v^Kwr1%QO#K
zwZ7nao)781tf2fZd}Yt+Tl-)rc~j5}{-wMp1TBu`w#C3Td%A|6;|#13Si*R&JE7m@
zP_f%W&v64y==?|^k>y*LU@wMsCbrFI2#@2PSGC2;to6T?fp;F@_WdST9(U%dP8#+X
zWhpSLYL`A=e}g+PH#MQQ3XI}G`@iGGAUB^78hV3dwb{k^%O!V#C!mUqRuABvh<<~m
zV(4k~aejDi_}ax^n4lRLffe>W($;xsa%5xnxge<VC+IoVkavC)oKAQQc7SE>O3BSZ
zM>cb~@HE_xxhgZvDcpji_!xW{{uH0Ls+A9HpcU977n%T`-XSzaAL!pMQ8a~~x4zY{
zm)>hEHZCc-Flv{~Sou!~$X@B5)5ZsZ_NL-~rPj_87T|Z$c$8mEn-EUDJ^HW#*Cm+4
zr;WP!mCLHpMSc2Zh^oD!_i*ctanU~|s(fxH{A?c}1L`7i6ZHu~kYdsS97{D%Q_nk5
zzr4dKH;z<z#rY7T$g}CyFHBCS3!~o<_b1Eic((fybvBFSs-(vr;rHmt_pR2M2u_^^
z{{I_S4n2=~z4SUUGbcA<f0varnmYx-nSjK}1B?Z0H8MVEFwB_vVh>m_-GXj?nVgRc
zM51`&40Ff$i*yNcR8VD2QW(p1Oi_>hrPlu?fNKf#jx`V?oO%sr&wfhlvKs!6Fivt8
z)6kQ}#o)!{mWDj64U~C6i=FA7CFlFoyN1<<;72P>qtl#2rP-wgHR#5rG)C{+2{i<U
z(+7(9)C!*~ksPj;JMeEDVH*t_XL9r;&WYSgQ;cWX0hbkQYqMz`7-8S)bMsDUfR@c)
z)p}iC7u)mc`jE$);Kk!EjHY;eptNKYdW1hsl7R!7rS||oJdbp$)sR`OH%;q5=lGBp
z_W=An=8Lk~ZuMaD2xtpsHMjX^v7#lt7JGVjcOi@wa{17odO2$IJAG85F`c#A*%eG1
zTYm>i!t2+4fH4o8Bq{d3&5jFYWomI-j|1Tq!OfTs&{n!V7N*BO3}hEf1zrz5Dy@qO
z@N=w#tQ{cp>l5>5j#S{!lEfHxtWV*pO=wO{9pHUb?jNRrUtv0`?LtYc?|Pd5R?Y8R
zF+8uv&iHr$1DxCLmhB86yQyBfR-HBpt8jQr>liYYt^{EjD0!C_m^Qn61pD%N%t3{^
z2@2iiO&IqsaUc@!xNIEC$$bdHnG+wiKW2n4IhYdFnbuQ4l$l;oo}vk8l)v$ASv(8E
z4L5y6J?~drjde9L<pKzDhjf7laCC@l=A3}AD+*5F9+MB;-f6e}H>4=kshJW_wLL9A
z7CP3lCr$w{?8u4Y@$Tp6Z%^q82Jjm0X!%g{@F&p;*>J!Slg)h!41Mv!_Me_Dy`0fx
z#8UwqS<h@nNG)a*1XpLjha*noZ2ZuA1MpJyOi$1fX;@{-!iyyXS4-=qk}myyZ~*bT
zj*>T&thLxz&HK0c|Ks?tOp)NZ<2P0?oLhN?^-K7)wROcM8pWX_74!){{_NyD_)5qD
zn+o)I9>@sHNLG(s>L{-}V#-#$kgdpa8>Y0unB6)m+3vfhpx~3h!mN`YE~mr}zXsIy
zdJ%l}L50bee1KWEy6<gajQqW|6To&QKZd<6PnzG{@+yY35+|ei0s~hcP{5PXzGv7k
z3ThVOHe$d5DIZrGE&v-Refj$_zQcwxbhJcXl!pL>y6jNBc^*skKOT_2jGwDnurvXU
z!K_J&Jirf@ki{K`G4~;fc6ThcEl`0V8cpO0p;5Rrh}f7NcR_yC2|Y37aVbMY8<ht(
zZ|Z@q>E^YaAwB@=Lzst=3h53zaDtLuu!1Sms4D^xdPd0iPMUNK5MbPdNr(k`u%>A~
zcl7Zfs9-whH>nc|W#+w|0%Kpv(a`{;@K*Vp3>CS>s%i}aJxlfMiG|@9m;_s6aWZm_
z)PsCVHQZ$%7)$+YYAKNwykoJUhH$7FF|ntzyDHx4ZeCmG6X%WIu1Uv~eU$nG^1S@p
z9K?(89X#{asb(Sn8d}qpddMO^s%I(djMrsm^#MHS0x@VtOIWA}@b3!pNO6y7?d!5K
zD7*WfG^6w$ew)zf*>$M<ne9wI8$Ly|jEOtL9=t7GSpY*7e{|ahmqidwWxpzF8vhc!
z*ZXgB+uL(>NB|vHKW7h*9bW@$_Dv^Ijo}t^r3HQYthXXtpTvRLBoHKx_~kU%ql@zT
zh4KFT07^JyZvq>(HJ$^{4154myk?v@kEqKTwykLD2dufR@l$H8e}YEX#<IaF&tK)f
z1v9BetJ3gyF;IxnuGvK#-0?5(XXrR|sug^Lm3#oVq6;*DH$3p`ch+SV^nz1k#;dGq
z(AE~&d}zi-A_ZtXn@-9cMQpX9xeqmvcJ$8bhsR)Uj!sGix-ACG$H&!0uYq&)vU;Wu
z;(lVzc?1l8Y7kbXk5k4CdD&CGXjyOhAm3_6R(7Gy3TEqFo6*{~0Z=2hC!-p^r`>%z
zK`A&oC&^}sH=(0wYKJWdHRWH9LrHwIl;heWN6zzn@y;zga8%+6{?`>4^8sGT%<x%C
zOsPINAiHg_ycf-ONTEA2vzKNL3SjG^<1E-;YBV-Hg&+Y-K$xK`{c>=W$Q<-#+eJuJ
z)t{}yd8jq#{eh)b3qN}e+n{+uY(WzA-uJ<#DZset$Q@bv*briEw8cIU557%nm=xfd
zcdEIutMPNr3E;`afu+Ipdtq&);SioU-3eFiks=i`J5<6JhhE~nO7ISnl?hjPlj<n+
zWzuk9c3UVb0iX6eH3kGP_cS1Zbb0~k2XKtNA)NbxMX|_6^dW(hHw$C3^w=_h4CSaU
zz*8@dRol5EK~0$X*8>;n(MliSQQZyV<m3TKMuk2wSe`k|s(Nsn(Y4&Ts0l!|e^n4}
zf6;mQr(W3dSd+6d&J^^S^DeV%(TZR=ObH<a49n{ouL}|;;_t+7ftOe^oiINjBOchf
z>zp-dKK91y%h!Kno+NA3sb=l^H*nY=p)KrX-kv}-<A7~=c$o{eNAJftULPk`B#TQ1
z7n4M}7OE)U3!os*ef(!dd(Cg)b2T0=x~K?0$5R?;MjEU)p^yAeJs{$#K=}K3P4M2A
z|G(#LD)wH3h_fON7EF(GW}3z0*f*GT3?3b^&`Hb7Mqc3Y4f^|F2Asy7GG?CER_S5|
zDGVkDFTI~ogEGDK`^XKL4pl&a2;Ad(pl?F-Eymva`*~jHfkqgh+h|_1DUA7?afwy+
zJ4?K_uPW|U%pEQB-N;!$xoO|glyo?^zBS1TbI<MLKK~u~Tk)IVeW0R!${)$6g*Kmc
zf^T<<-z8i%R0tw&pXjN22V+L1CF|O0c9ZO~XOg<knHu_h7T`K}G<1{BaD|G;>28;6
zA-(w5LlnTnaN#j{eetdHOZVyw{_-Lgc@~VLb=G8r*ry*$WYuWs)c!yDB0OcDwZ<ZU
zAMzNG#Tl7ta@CZ0Lh=foo`$BV=B06xO#P8;E&CkRSdb}5EZBzQcJFifi=dlF=CpE<
zzC#DtF$@t_Z1uQvlUekJf$W`XATbl81U%|ZfQAE@qsiSmkW$eMREMV0x2kd#v2=Z1
zL%v*h*ko!oHLu-zA4r<nMiUWOWF@y)4=M&6!z}?e-oWx|7nO3-PrBWGaM)MRAfj^s
z<HI-bK(Uqiv|Fwa;{~h)3dIwf??$fU+^gLZu_`>y^MLq8QHEQpY+~GmIUPKwPe@BX
zn5m2M-v{#37c0ir9Y2NwtcHL#a)BiFkSO+0KZGU%!{ww7;?Wll+N8!Tbq>Nuk6$zD
zFEGC(9{k#GcsU%yvhKHSO|^!<^s){Fi3S(VdZ4;gp#?G5GSp28<~)q(c#?bB4}Gi#
z@VigofHf-mIW;(GXZ`N>MvDv(IZd>dfTVz=D*<!OgK*Wzop`-;K~NH|QgOr1oEV2I
zACo7d^@ZlhZ5t5FY$RYMkY~uUV%Mb7;kQS;#U%8qYDCVkuT=vT@9&@A`*GRjKfzb4
zqxCycMQWKL#0%mtJs?4V5G3eG4;f03pCgGyJcS+3QGBk*jsd}H1r%of`7>7f_1KQb
zgKq_)FF4XCxmx*rA`zaCd544|h=t`hn}myVoEBaW1o<&;epQorvuZ5Z-GSreXH%uw
zy3QybKdYeyl;m8V<W@O9+yU4sjaQw7K_cl+9~@hmWsIbcXdHd4`R^7#+;kom$|KSE
zv*+!`#P(EN@@-iXc}D#;DN1l|6CWObbgBJAnI(jg!pXB$0pS}t+5c3|-ZB!riTqo3
z*|U}A#>)<_vos*dL{^ejRx84SnY5k;oZh}Ncc}YsT+WD#Io}IYUc8om2Ww0$?t?4!
z+S;q|_zsmG&yMq<Ue#kGddZAllU7@$@3c<bHn_?IsN}>IFQa`&gDn#EpJPwET^XVS
z|E`)W9nGexRfs~8!2i*|{gDD1ga2ib2qE%f4J9rRM3<iz#-r~Yw9kR@K>+E7!G%Q>
z9c(mV&J*xd7@z*D{M7xvpkdsizF0SU-m%pfQFO}wm__+-(lwlq^WITyMs~S$<0g4h
z!c2!ZFe*U|YK<7BEqo0tQ^|CXi3gj(Eubo$Z?y$Q+1fp;59FxJ<{Lsam{kN*17D>q
zY6oyxKsKl^wO<POjGmA-JlVSG{A+Yod3eW77Et&e2Z2=CM^b6xIc@3X_T>(?MD)qv
zw6z)lkpo5)$yj~8OCg{ruKC<Q9_=rKGEU+biv@8zHEs^8fykLBTr&6|oJ|LGRdp`a
zM+o<Muo^2CyrO#JIBq5T<VW<?jOQvM79Y@D%Y!S@i;gdJgQTBR$E6t~xWoC3q#m?7
zU<Ny}Rx;q&3c(n!Ei4w0<)LioJsBjBnfeJ4SpBVVP~yh1cRJ16%g6o$yG9GU%J2co
zl0kO!_V3unKbuw}B%?Y{QFO9W8bH!_yWa<I9N;>@SW-i9eO!GAh@Xe~w8rOspqe}n
zPOL8ilmTxD8yr(3!<U@WkEWV$S$rLn9aeMXO7;MWLfUK|IJTpqqElRXQR)=Hni(}p
z3S1s8_rfPO2D-%&vwyv|>w}k{v^Ql-&-GPfXTVD2MM<~-g6PTalZ+_o0ZQ955cw4Y
zK&D)$gMnaD+ybiJ>n`PY@|^UR-=o8PaLla&K2zp1CO{7zfcPIK^`P&#UdnTCIXEk)
zzuDZ*WAyiOe%wdKWYjif3oonRoQbMj{a!a&39%PvDB+^sx0<x8<<3sQ9D_0WZeJ~_
z?;T$PepWOIe)XTBqo5dj0T_GYg|=AueyO!xSyp}!NK<}VAEjP`KkNSh_(sPo?Vk7y
zqGwCfp7Fnq0IAc|fJ~k+T4%c$!-mKkM9>FzkprTC>VX@1(u`~>ZVsb7L6NS<q?7-U
zMNGJ*fLF^Fs~k(b@Z{*F?#N60h@zV=Nz{f?jk*#jGbT;L-X7q)Z196@YDLrev-V$u
z?JN~sGvJ?Ab#th>8D^+kPQACF5s$v3e<*%7>EjuC`yW%MQ?GgE)nM3-W0Sl(4&V08
z+&}`fZWJ|A#joRTL^6U}sie+YRgz|#!R5?AT4y<$fxKIf=LgFExn@vA+d|DLjZu7X
zLN>Wjz8q~}4JaRl*pW2Ec}}OFQk&HZCKi7!bBxkS#9R2u%)%`TqTXNOP1F_4EPth+
zOKYd7;{NZ%((Hz{lF!@Ah{u9*LaR^UUYGkGw5iQG0@qS;wqHbPseJit&hzE!UzRW+
zsJug|r|h-Hj=%C}1vQ@xzG0nVfpSuK;U~TI&iv5`R@r<}Q?&FY;ak_&-}>Ep-;Y1p
z@dQY=V2k3o`)q7h*M?dw@l?wn#54rp7c}xwriLjJrsA#p1LMwtpoD#bPPoajmQyAm
zHuJOz{m*9clf}4?`NC`44zn@F{{Q^xuWow#rbC(O4MImeKu$2Pp0~x=uOWciNkblP
zn3nwd_Gteh9!H?F-H1%g7Lic*!U54D^=O$e-iU^~@6*ejJG$lnipv8q?Qexa$ZT<J
zn*idzMxEJBM}Ihy*!h6>cpq$7O#w1*EZEyoJL@ZRn?Yi|Nsx?qVfY^IFgIo3c+URG
z(GW5UWWj!_uptf4p<Ywq;$<u)ydQy&MhNj;U4${H{Y5j7bi}*2fO0sAzrQ2t7bsfT
zqYn_ctAkxDsSB@+{$9L`{_*9=4I3cQY$>G{sY_)$yu1@5F>%ibU4E(rJoWvv!8Z?L
z)|s1uAksESg_v19UiH=~#Ogk{Em54~K6v97<Z8S=58yntF;oDW9r=)k)7b%`h`ZEI
z&raI`641m~hA3>6hu8r)zm9e!^{n6~>R$5yk=iBe<X-Ro{G$vU5s;9{c%l6tN_+Rj
zdaJBs(82>&POqYa?}h^u>VsgY$b&y*5JaQzZSDB=rgVHZ@Yk)4@WS0-(OpvtpI*eO
zNO%Lp0WfnmfdleZ!BEksgkb$Q$}`yYPHF}2C~1QwwNQDD>1C?dEHuTlv-xafzaFJ|
z=UZ1VEC|YaTcc<RpJ00eBbULcv8n}zMz1ukyw?~+*Yk*tDr4`9h{uxRE;EK7eS|?4
zfzxIq=Qto{#?pL=gz0qtZ%F4qXfvl*R6Ks3=9~b{n*oR9;{)$EMh<?ip=5iqJTIRw
z$JeisN&IJh(Pys#j7xN+|KUD<T$y7X49GaqKMCq_qsDlC$G)^}ZG~%_vaj5J2xbLg
z^`26d%qE`npi6)dy!mF0VWqVy_fs-}0a9r}o;<6jZSU=(2_vM*O{78vEtrM3oV@ap
z=hnC{CK*2yzP>(j3=pygG+o(HOC%<<ZzMdDQRl=1KFgTL6^@7Zu4<wQhJO!=Gm3~m
zX-Vcp9a!>@uj*Z3y)eVQo%7$z0SgobrDRNhiB|1=+0eG7-xD<R<kiiOtwQhy)NyP`
z0u&|5s#-j#3mgr+3&sDMa#49iLP7(O+JafQ=Q@M$kXf(_JJc1%;F%MG6kJzY&v?ih
znqgk#;qnGmeQoZ+{}<G|XWFN)vgy%9l{r*?1kUc<q6tjGlhKbwBY%QJ{z^w2xGr#6
z#-6NU&j+Dv=oEV0ea|A(y$sH&-k~WWJPrj;(13FkX=covu4#J86VP(k-K*O;vZ6#+
z%&8xD(b)_T!qBWdu4+coo*Wad70DXV8_Y+RKWR(e{v`O66HY+J06I7_RPb<esbTXI
zQry~%F2*1~jgLjPO}n$Gfsc^XG9k|22WRm{+y`@y;XE9urp$&fDSnwrB%MrMz!QE2
zdf3h%ttnr&Z%*~OG0K|*HZ-;Rm=;rbE0D8bt)R&VgfFjhk`L!8>Z!jj$2<Gy1J`yx
zKBHoL8%A;J9wR`Y#A~mwybx@LXipHZEPF~lYevisS&(1#V~iWUn^ltwYxrhq!5+ry
znM*@n-So_+E&~?F+rb`}J4NP4a?65mmB!H+Vi4iQm=8&_o)5z%L-!fZnVFXYa^F#}
zj2UP<k8An`_<M)-{#<_D@+F&Jt0idp;eA_8Va~Ri9-tnco?IH>WR+t8=U5flWkbMO
z#9g|3PFRk^tnS6<IAtN$uv!M3A5N@>-Vm4PPxDRBNM@T5|AWILxbSMx#LfCh+|1y=
zLr-r9TDoF!E0de1mWZT32N|QdOVdsQc;MD0@I=k+d6fI4ZZi~u0}qlc1W`QQ*be|A
ze~7Q_`y`k{h=ZH^vtl2DAZecLrypO%*zL*R`7u4qiEw$O&4(o9gCL*okj+qMd88ry
z4>TpEO-o_0YqmcI7iuGGJV$*nH8fp}l3wV4%!f0&P2+aC*?0Dc+uxgpG$#WBQ||an
z=ZO6f6%*>>RP8_HTM@eP6(Rayfnp4*r<y755eYn}`&YAk*iazS;_t(+)R8Ree)R;<
z1>S_vshjKf_KddXdw0$VGxuU3_V0u2nVy-**ctnlU$Ud8S~ho>Mm=gML(IdEu(X*7
z8;~qlD66d>j4S`|ej{+5fKjt>Uz7x8BAByt4z5p@$p^VMu~-ixko+%HieNe{BS!U6
z&c}SIznor*M5u@5M3(SJq?He+#B|^8)c9h>NguY&b-SQKrTOr3rc6<fGC83?$eFBe
z=fPeAOR!Fv{qKsVA7h3EukSNq>)P4#B;apYhnk-ZE}yLT9+=f|K5gFYtS50=G+c-k
z^imjdAFOh_fbUVYF|j0fs{s%@-|cQ^DT>X(aj)$EN}Yk+`{SFAh~Cb;M@wbj3jk5~
zF4Q2`iF?XnCt@WM#PVT#V$HCA-OK1bexv2dUD`3+Cq3S&P1(ojT1BcGNSrjh9%KV5
zhRdO|W(-r|R^j(|7N`{sYn}Rw@x%}rR!xo1Kq6pdrB@NxIbBUB!gxr0+62E2D<Bzz
z21q6QC|DQ%@)$n)`0kVJLKQ6ID-YzlVSoMNXJK*ggy1y$>&)<p>me!C;~5$Lr~9UD
zTMc2szh<Nv3aDf8#DfB06#HpfCcylE#By>7W3S{yAu`+%hTU!81Rp@X;cb2|_~H(c
zxN4g?hA69e-TwOB^%|Xtyf+Iu8x!~T_)Jj=U~M(^ff&R}yq|F`ZLujyP`wYta3F`5
zPOY}=gBJMhygEvG9Jmw4i@FJJ+4|`^Kvs7lka^!%Eu<zJ5w!%5vs~|_pKcAfwa#*1
zVH@V<Vnx_GzRzYxs?G|9pKgbz)L3qVbS!++ovB!8SWnQOr8&LqC2heOu=o{5nR|{m
z(SiT6EUp|6xIe!mLbNwGDMp+wAQy9QvZCyK-={PH^f^3e)Z>E~Xov{m)Ayl_P@p0f
zVN{xtz+w*5(TC=qQn?g!Qv?`}d7*B{K6d{0e_YrYP8|OFmdgQ%3=XVk^>F7<I;%?6
z_sU}Jr`U)R9aF_RJUS=XgS<1`vfCZt)5o(!dX&zBwCnS0E_sefdSk!W-^+}d(P=qP
zRs=JuKIWfe06}ZXg(@3mCAqCt3nnHYjm{>63=bLjwOIhuXSur`V!3s?s0V@kXim++
z9Vtn;5rkljq6V*3wJ!7Nrw903@lh6Qn05I+qY6@?S{=&z65eJuFh`L_I^3vQ(Fpo=
z9~b}m(`cR|f%WFt{G9T-Vy%d3>*>6=So0iY35)54PY;o!m>DK#BlRTg=MDla#vvLX
zJoI5-5Dzn_NK+?iC~L0%@9)>57VN+<8AZrs26*esk6UhZda&wz>t%w8V5sMbkOxEg
zHGoVmWC<EQHC-XD3w^>YqtJ<by6+v7TVZNU2`oplb2X=K!c5FYl_^S37UdYPKL7$-
zXlvjp@+IW#h_B3|v-;FN?gL$BwdW^;e!zKSM|Y)O&<O;c<@~9#9D@I8I8j%eY~M#d
z%yW0>L}lR(iwMr&%zFTX#;L@k=fD8btYhzg3QR3vs8#TS+<O~ffQIb2LocEiovmQ+
zy!_vFs=j%%W-&`yv~-s8R}ibPQ4pdGsTF1Mrs&$6yJ}u!hP6<+YTupqimVVtaq+BG
zugJ<jG*hN)TQ;>1<|F8j*_*ki7QIhvx1=yp1g!9c+77GdaYi?wFGlWo0eJ8UP7-d$
z3I8&*Z!}buN%7J$*_~_q1sH`yWER!%b5#o#!O6FL(~ID>K*Et-^@KrzNh@Q>>6~b*
z3HyjqbkyyR;$o}>Z*en{pXbi3F5wjK`3Xu&4W)6dbGzd2e+lE4B%T|XfjUj{3!SgY
zIXV0L`WE(`j{ksetLi)LB!l~%?2t6xjb<=>WFv<{4h1$nqh3~+thpnhj5}fQ*i4W-
zbF-MG&hEnxwrQW(W~W-Cj@UF%o41N(W-W`5-_b^!(?7gN8@^Jb<sw>*_PPV^huAFH
zOyoPkm6ApD+0@3p<$75B3=od>WBr<Pyy6kT^ByK}017_pWf;*<7>@==W^M)PVVXAo
z!(p;iHYV;YGZu+@{>W!Dk@;XI9WaV#!ZqWK=`xF7YVLTr=cd#E+FV0r=S2rEJI%v9
z?g>$<aAsa?+);j<95qswJ2ydVGM<RPV(bN0202`hfK0t~?MVb*0ggO5fpw-j(<fE0
z?g_=Zx3;z$IFdlmfajgmr~rBO7@z0$^)|y$_09PwdW^oHec5rxAl2s4<y8%qOqPq{
zy+p3sSyJHSLp=LF_yuq(EQjGLG{2d3R=)q)wy!bM)pjXw?Co=zRwPe6DW6i`+HMpZ
zV0?_w{uYSa#3%jQl#im<sm1Rzfls{b%y$FA1cNXJ0$%A?LFdaS0ST-r{F}o|cxw{w
zL5*5J_{&Ep<+vE?F&Y{S8~zt<(g`O)y?oQdaVW7@A)t2npTb&7O)gBr&Oew_488FR
zfPiaWE)ksc4cA{=(h((AIrnk(j80~b4OTga&=mQ5`GZoPAVO^_rtj1F*KYZ3$~aJ`
z&)x$lGmETn*p(hgOsDo%HH>$kbTWEzVlB~plzKHprWd_YdSSN@$T#a8Y75ZcUc&3!
zH|@69mH(FHpeL@&C@{*{x(>37T656Q9apHFjMIqy-TTM(RNrkHsZK%zcQCTd7kgQ+
zi4Ft#w^{8pH7YpZ9;yq}lJ#$fmy7!t)N+~R<psnB7=u1BB{<+4=J2P`$p`K-{J0k>
z2_M~9JideM6BlQX;GKln7Njo<z+#{F7dP#8>JgrwJ7>y%FhQ}pUVR;e0h+edbzSA>
zC;O*GAwZA1#6E{l|M!EBd@g3i&Z+_PTMuh`RxL}R?qpsu%Z=_-b@c$`nZo2g*X2;n
z&gCz4d&XDhgxDlJ8fWi#WTm6zMa1mlH+tkJ5qy3ypyu7QHAgg81Q}0Ii&`x6k#8iB
z#|1-me~=2(^{0>QbsNoD3;UP8w2X}_p-id<?kreGm!%c{2mVG)k(^5QFgxTNBOkre
z45sEKD;n*l)Ik<_Bh2CNQ+;{XoKp>REvcH-Ng*X*=i1xVL7-`{E=HqfnanuEeLDYD
zF;&If&VSuHK*@=khMRIar?miz!~I$s9r%K}Dp~ng;f648hW&Naop$&$#a^iiwN!XY
zU+ixwB#|c~pHF(Llw8=P5w`RG;Q<wVL7UPVJe2O#7=BS2;qfS{=?{>caw~_GFU<gC
z<(BzC!<=DOw8%A&>)Kbn={$>5flPWFUGXCklMQiRbWn)UqA>-z!L#?60qP^R&|CNI
zcRA-Y|CPck@mAtSBDidKT0SpeCudFkt@u8{;q0sC^d#`Ph;cRQ#1005G1w4)j4;@5
zO@~vL>#vYz+JWfX#Pu<`sofDMGo{?0RN?mF&)P}6DpwZ*EIqu>D|boZ#CZ$um;s9A
z+Rs%Jr!;skWEb9%kOwU2H#$FvFxGuS)#hxkN9=LrMThJ-ZhTy=xs~5iR^*Lk>QVS3
zs!uHz2ZDqFO2gZXYyluhvd8ko8h*Ikr6pRi2mR$}7>@*}A6Z5>J<`X`X?&B^71Pka
znv@Efpc;~@*M&l^mCsy?Bf7qSYw1nMDQDmOKpiyNQ8Y`wCoQs;954Q@eez}k--m?)
z;$Hvf)fX(<0`p0$)CWavMc)kU!E)cHGh~9C#p%`qW0lcgLlVK6j$fzW@_k<b>695S
z&w#sZs+w=bLIqU?J&1F1vOkK)6Qywbd9KU~#Wvbk$eF;|uSfe+n$TAgZ~zKJ-JN&(
z5KA1-@Xa9@n)@3p_QCgiI4_f)nbEV|v&B0pX8yBk?^%Zf3)~%Z=Pdrk;Kn}z>Djy7
zY#w)C?rK^;pG-EILoZT-q2im*uJG-jm-M33`0j_Wnk?T)+}l!*1wDYsgzluf5u}q_
zR5m2{N$pp73PY*AO9VWOQ!g$3fCFl~`DnICVASunAHG6bA&{YKAV<EaXWfbtMvnz>
z4|&u$HrDj><?`Kwiq#86-bBcH0oEnO{KFsZbU+q8Rc`rJ5iS^hl#G0YBMf;G6QMVH
z^T3YKAGd>uH+>x>PF?ta4cj^QLBgjn#?ag<0Z0(~FDd&WD4+|%Lbra#3b0pZ)npKl
zgR|#N2}+26mPo6A2NukT2HU?~0;f!~(z=_+$0JKwF!Z8?L3vlq^*cvg7H@qV^fP|X
zGn%zsC_nH_oyO2ief~kjhj2qsK*C0Xht$Fyc!6)Woo;vCO}I{p7H?ne;s>9HZQn6c
z;%ut=qmRsnf0yy@5bu0@r9{x@PdyO<Np>HcZhH!4R#{q7NwYR=2VWW*MmptGe<Qa8
z%m&+)Bz`=d0a;vOH=NLcp{Pvw|2Vqxc&7h9ZmlRWsa9fh3sX8Bn>)%;A#8IWp+b($
zedb7$G8>i>a)ymLD$Es$jfiAOBW$iYiV`V(f1iGTe*Szv-tW)*{d_%N&)4(Gaa2;^
zy=pTCD08JD;LOg37R)nmHe*69SsmNrfXp|Q(}&&>K?xS#DM_2Bk_{n5ohK(p$)5GH
z1od8F{0WDqkj3>`6QYKn;{L{-0d({2iN!Y$PG3?lF(z>(pN7{3Q%FQ1LsWjm!CCZx
z!=9d{FT-eu1c)3QrS>iwZOD`<`eUuU>p#0pxLt2y_#e?HguQcjj(!d7&{W(mt5{17
zlI>2Iz-{9`p^A*-qi7jn8|nIgfI(XULO1hE1U!q2RMYXgx(dE6{lSxBLtF~Y;i}9F
zh&gp`@A>DC`w4vbJubik5Lry6>}EU+9^1=U1re>Jc+1iNA1$eS+P~)paIhtJd-<cY
zzsQlYd#UTaOA-Tht!wSt>qjCR4xpUp7c$53zX>Mq=Md&(WBGvuqUy)zvnQrtuC!(6
zi@cy<cI3RqUbs;3L)ZlRIr*bYml+`wa;lnYX4-|aTeM#I=f@dZ&VA7|3>qnX$;H}S
zPqv#1yhCeIC^TK!5#7bTQyP=h8{tf4X~zjq{cGlPGt)D4|E`o{%ak^sc=f#Uq*w*-
zoh2dLY4mUV)-!Jh@5R5Y)_LflT#qST73T@;L0yu2e}<EePUFHR!^hM%;9)D{>}s^j
znBL5+!e7-*c5Hn%7PyntPo)R*BqHY>3yil-eGf)1_Y65}w137EM5JznGKxPke6OF!
zdQ6!AHk})AYrG}SK|6;Z45sXZ&-+ibxln0{1+z2jfUOIocZBtI2!_;HXI@k|8qI!D
zDI4i>4&H)o-E8H=lvfZ3UT@7P->RV&be_WO%>wKAPRVVpY2A4s^GBoSo+Ndw!tzaF
zd%|v68e0{w80nnQ$!EJocRfT8*b9?17@Nbsc+cUUJah_37|+sV)>k>%&6Sfp(|TYz
zVCRQLoXEJ!oY{TrJ@tw@kC;@l5t4=U-Gxj?4~37taJkE=LYt9H@3wfcfP$%5w^{M!
zCI*RDS^8%5Y0?tKaYoBA3lz!eDTk3dVjme6+Cnjm{TJlLhH5e9%p<|r70WYtz!EgP
zkQ)_@oro)w3YMu|M_fbYAC0E$?wNS<+tLjF1zXW6T-o;LpvStwkrBY;zW{y*^bC4X
z`p(Aa-@n4nU@z_|xR%Ludny0uosw*-!JmCeu-E_nmdD4)v?n-G?h1T~`raSdCfAL~
zWSS#u`Z_$>zzkyC=aUVb-0ShsAZK+w2Ek+wFtt@-N~37?7CD{Ryt~0CvWuKw0jV>>
z7a1?Eg)bz<i;hyKeeUK?DD0%bV)cYr<J5pQ#m~uSO#y+!Gq*g8gEcMds5hQp3c;o#
z<mh1ZD1D=jlMg@<C`knGq^`Iw-i=&%m$$H^kg-RX`_S=7P>)SG_Q@cb$qLuXr_n1z
zv5_8h1Y8rL=F>hLZ67|@7HGp1yR-G_rh&~uP*u_x;KkIU(9S*e-@yfOF#~WN$e8_1
zDu5JJQz=|Vm3fN#yU3Jzz*?J(*68i%rp|{vR`{{@+xrrR)HxymuuwikHFcd|wHDYs
zUmxNNEYA~q8K{V#WjN9v%ihfKyydyM_aiK}^?F_`;V{eT;Jn#Y#$RUUdaqhFSohRH
zUkgXms<;w8{ErfVL+U~wL$>?~x|^nx2G<#>XQc)A<))bkB}1y{j!jn%!D(I-sxb^F
zQKT6#9vHf1w&Q#;oHENI3&!+Oh(OFZdB4?{AJOb+yPk{u_6|PtE~GzH_R!YlPNLg?
zIi_mf(!D4D4(0#p3dEIcrybY+W4)pL`oR69@y64T5882GEYUqA8k|vy%JO7?|74H8
z2C3yumN5~pc-KvTjxSWAZu=7eS%oh!Lp(pK%Rm{?*$ONWRXO`C^R^zw91_I$k|l`l
z%GVU$hd(xdAhsoK1QCkaIK)}_%;ZDTf<rcmp*F-U@D;9y+hSStzlZ7T_nfoy1<k@_
zh<Wfnyn8CFADt?77`6Q-o5mu8;TV@$uB9Bg_?BK>d>lRFFmfcX@<)(DG9&>aBRG6|
zs`TvFEIbd2H}MQuCcoIUE;Kf0E~)7MdH>nw!u1M>H~h8G$l9Kdyy2dUD_e&;A&Jbu
zc<DQ9PHnHP=^!okGg_hWw1KVmOB!GKFte4OD$fM?lTCOP{7j@Xj4|N%2*}h(|Bw+K
zcoBKtAnx7$Lt1P0r5;4Jp<R(EOri2<I(okH-V2Kc<PqaJ!-?q=1EBF*-<G|A$&t3N
z35+Ihq@Gp$Y#&b}Hn*{ZxbfaaM7z(PGR39+%{^7!vi?`k)wWr~fz4`OFd_Ks?8Dm^
z6>A|02;K=jm>ExE2AF1NDQ~Gyg&YgN4%!z6I+_t|_Amw-!|)r8miYE3><k_-07eOy
za-)W&@14P(Unj`K+L5?Dvha;)ievDrz}D;VsG1AE<m{PNcYeNDuHCkcd_7VOEZb^R
zYnu`eq8B!T+ODk~R)Jm6PLXneH7GI(z!ji1#6|8l>ouZ)yQ$43Zaa5R1eg5TniXYI
zCy<78(Iv^ba&2bnH(pWHTYUVv=T2QHFJdiORz^DC*_xPuAVqJO$v}3E=rUZI6Y(Ln
zO~!{<m;e7C&zzh3=1E!Uxpy-A5Rfg*I2mrJcTxXMT|ECC+`!|{+i`~P$f7p3Kd+&k
zN_+HN;#X6sl<p<VaJK&a5VLT$5_C};{|TBV$tVGR{jp9pm5yDmO$`p3-nWU6gMWD$
z&DQzaW5+b5hfcX~{5pE}%3s@JI7w&t#zvW>no!iAOKmKn-{i!5fOXD}#ji^$u<7oL
zyH4j(^$S=DKN<xHM3(+nB1f5Hue8GtPr!3>RfN*f*|)y4lA*Ix=b67gHw-y=GZE&&
zc3FUf;tyVtN_IX+74Y{5fXl5-0F{InSoPFjn6n;|6UiDBx2<z2Qfa8biPzZEfZx4S
z_qTCjoSlLabp8FZjCtrkN1VLdjH(lQFAWLo*$WHS_j8?i-)7&tFUr~S_8(kqm-xk~
z|4^7&r#gg_GiQ<&UX2@@gGaK6gtxBAlbvNBTsMls=J+UCt^6OZ$!|8S?i38JDL{4N
z;lgl(|2&&2A4cqrSeUgC=Z&s!jNX%Mv{Ah+@kJmg#^<4eCHh&+j}Jn}@iCiK4Q)GB
znbt&QMDJSpbAhj~Po;r;<6162K#;{ssx5?!3|k({zvtEO@M`Av6%rT;WIbH2<M()9
zQzv(7vhwhauMm6)6eZvPLHmO1GdZgqN8ryMHOeoG`F??b#dbB?TDgSJyt1fKprb8N
z_e_oi4Vzsirvu*XOTd6M8c=V99NBM%SkN|&Wh{;OJ&f@S(904$C<iB;swx1iln*X8
znwvA>tPswfJHFKiqoK$1U2CJ+Pc<liiqj3yBZYI$&Xrz#b6rf`&)v(`--3R$A8ITQ
z;tdE$@}D1!<Yo)PX1Yo>|1vCK2HVSoXFKsm5OJgcERGh{4`W1r=y`|^zu$|KLKB@c
zqkRrne)YSh!;vtqquqv(a>1d5n|(i<Ix8~Mf*<-%!Sd%MynKjpJKLJOL7&TzsCTv0
zUBu`1a;G8y{0U$B1ZoPXqH16Z6W;PoIgdV<1^TrzEMftDm57Y=1wt;s)oTr%$#iJf
zz4ZQsYzza6Utsutk92DA*Kr#_M{l~y&Qp`>MIySOSZO_BUJ5-_4!+sp3e|zz#F$lZ
zH?)4ZUaUw;Udq_(CAQCWS7DgS%HUt;L_%)WVS~R{1Wfe*sv2^!ic)uqYS#91rH<pQ
zrI<05{Q{VW+==kE{Zj?H>g|O~Tq}c};mmZJ!sfJ)Uzb8uWfO#gHf3kfz&yvAIFJ{x
z@rnBC!ST3CNAhvjJhuJJyvR{jnN{A|Jv2)*(zAOwNIgdMn(b<Vog=&Y)Xlso<h&Vl
z>4c2<lj0Yna7~6%g8;w{hNfg&?$szX9_;*#S2D>LHj7F=c{HhR(Rojyr$jZnO+`n#
zlwkY(%zk?^g!ay*MkSAi0j>bOW?IQc(EMr%Ihy#VJQJc?o#A8HA7Z$8U}()gg(u06
zNLEs$XS_~-Qf3vB{fF>OHRRTPXhCNr;Xt~ZfbMWW>F$#4pK9@!Zb(rB|K!FPH{lYb
zt^nEZF@Fj{1QP)b@IU?cc9q3`+FSCH3!zEg=^V!8>Biav^lZv$f?fLEzS>JF1Wfv^
z&h6`&$oD0$5a@I}))`A8x(}4|irQa=25T6qqf9rf+QMZ5f(4Kyut`_cWebw&rkS|_
zz#I^w<|=*Xt8IqJ7kB`%znu4AWWpJG@Ym_1sG=qWl+>4_u@s^voA58MmUeK_eM#<T
z-tc3!665oDanwt{)<g&i(i375O}WpriYQl@1r-P7O*+@h<meo|E;LMhw!?Xa-y@ck
z?)C`_)r?ck(e~h`v$S%9V$_9&cExvSPckd`IvKpvWUdm2s<>N%=v)SCc;1URsWa?N
z?92vo&@}VZ#~N-9tO8~rx2-&g+qJ$G-2zI6bRU34yErlJrB;=y^l3U$>@?tae<5H(
z!AGnntSVJ}J*W3tQT+e=IXjMYA&|?$t;Gx*p57Jt>L)b*l4b4wg%ZzPAD#*E$qQe}
z$Xwb9k;ZQ7$gK08QqMpg&ww$Y9d2pIDqKNtx=$~9tjLnL5stxb!hWkyzx;h4?oqRz
z1U;J|sa##d4R)>!DR4f~1pRK^1I|{{bKN;Rc?zb97%mUu-aH;8F@3-v*6yJ}_}W@*
z4xpE|U)xKLI_nwFnQZKa*B+QnsEQI}FNmsiw43_Hrw7V&??92j`5ZLAvNxZ@2%gVZ
z4UT^iY_+NgxQk`dn21wVk~}G%z&{<|=Gu879!}nL^idR~rlM`&|CMFsD9_P!IQ{P6
z^ufsAL&lXlwI>@qCVaBYc%Hez!&*T7oN{XOM7{Kz?ESnH?{+wq{PpuGm!+dJL)RQ6
zf~)nzR$e(QHY#L7Mz9?@v{FWOd(Q8<hAwv{4aFe)$ocJ?gFVUNe>$?=;_hEzcoK?)
z){IqB^gyCDqGeLuT5oM;&p@h}7ab@!m}$5cVv+GvQa_qd0&AevS}d`vn=!xH08Uv{
zN`z&|%-8b&M0G^@>I`2i>w2IocngRkShR=wK(3OWDmQ4p_Yhrb>jx#YIE62R!q_7S
znccT7^EuC-U++Cx-9p@a{GIK#(hryea4mhV)gR3w0^T~Z$Gi?kI)<aJl8Y0G=7)ld
z6uMYP?+w;oR~kU4!fHhtZOLFYxUw8vi=#Lw*GdSV3>BM+=l5;Qb>0+3xyI^2?HS0U
zKI<}LUBcdqgE~M+vh<y|o6Ns|_X;75MYk$~%7&W6H)e#VNg2lBXgN@d??zye)6VSC
zev%rI!}J_n)PKt?Ui#L=WfCj&A-!_%U_w4U8aLTTieb7KbCCo7ga@t4n^ypz^5Hym
zosf3akMe8!OC=Ku-N*y7>Hb9B3zHMrJVyaoUUAf2R)SUCKM0<r`{TmaLB^k`&HRl=
z+ea7(c<c3|&Taf}+xc(14nECdpIPV8-!M{H;y|R}jC1L`_@xn`oG?X|`0cbCF|ZYv
z;(kG~E}=hi{18KOE9i{HMh!D2SS%xirO2R=02)XX6X+}26aK|W{u?+I?wIG-!VT^s
zo;s`($M56L8z}E=F~FBZ&)*FwF{XeB&Q!0S#bPo2h%X7?IF6QU=7@L&Jkl}{{ZDGm
zJvbY&H7!)d2O2mhm9NZ}s}Sg{k#sZ!_IVaV3G>2!uBBceM#aPOfdH|+vx9!@#+XV;
z%U+NllvMo6&F{;IbM52{U^e}eL+Qg}kI{;Xm&AW0Sd3^WBhN3l*smcVt&QWlArbjs
z0{F$?v_tz9p!t><;x0j&K)=hjT{s;MH6vJp#~BtRZpP1&&LjD&jo$-SWGg0U0`ODT
zN)3inPJ<|*0U0e9CTpcWC^xpoSc4Q1sM7l`*cluhB%OMjcIx%5bSX*LO+2g&(IM&y
zt47S0#~c5qu2=E@{{C9p`$1h_8o|5>16L*k^wx-d$F{H-=~TSFKJz&;CNXB_?PFQ1
zEKe1(r))Z4Gr(Wjh4g~Rnrfv7D+Z#2Gw*~=3(Zo1HAP<WWn7YeP<L`Xs{HjSm7tKX
z<b&|oMLPdWprJlCa<R}GbWGu<g!O2imrcDqe2(sTxXrnTZ0e!@kf9U)O060-a}HkF
zr<YJ4>Y(^~vrR}k=360vH-FTQw_4b(WBp|Zqs#^wf90O%>np8niI?IF;cnl2m8J^I
z)DlPryWb50vcss7nJ1~c2&%Ag?L=D&SZF`~mE2}&wrj-nubUf~(l)BFw)6+3_TMjS
zEXo8<zPl#Jyk<mvhu}4qxV+x}^*KZ|sQ7RtHp{pZ_89D3XQC?P4Ore`+Rp&?yFRv6
zFMR(r4l-3qVz>m3)QHpX8wt+d5FWB=ZdJSiqoJiidDIDTK@q1+E<dBN-PSfvxHp_%
z9qx=8iFP_t^UND$ydZI;MB%u%8t<`ho3mx_`#d#KMLgY+Ut&x)_7i(``sgavCHkjb
z3D@xIVj~s4NYb8i3I7s(%ABAcs$2S$H=sXC3<dJVUP4~jtFG)_mW^P2;6FHZM?MW>
zuyg+n(~3)z6})C_I45Rz^gkS?8$E5!*)qHgxmNjiB`^tR7Umpp9DsJib^{Anke)Sb
zRS50vfI2J!tP$2GzNt@+RXh0xcC7}&dwf%;F0L}ekNwu!F&Re`mzI^e^8UlKQ3Ow5
z#h(2b+~-5g-F*V6s8GYfoh5n2R~G?Gi;>wJ1~vK-D>>xlPj9yXix87g^p)Ow&4^?W
z^6Pn-Rm4RiRPBRdonV`DdWgj0nAMQnIe6VSJ2|1V0NA?KTqhr@dux-*grm;0*Vfgl
z(Un}$w11U_dKXb_BLDJod4cgBu~KO_{_lN6tid&r4l&v@`P=1r{NO{~8h;3v*~}KZ
z`|wSFA7qSL9#sG~5T{U$x0XIS)%Y<G7>#5aBGt2_HoST!l(Rg`h@gDzM<&)Oj`JLO
zqOXuuh!6tv=6W_@?#-Uig5oyCr$fL{K^fA}ulJ-m5!l$EQ*wlBkN~n)@I*x$@a!r;
zNk6_fIj_w^u2vEBMao$TW&khrLh;gHo%29S<(I=Ho(*Kk`w*{E?$(AD=fEMWTl#NX
z`F;ydcN~Q)^Rp#0vbpZwKI`F`W7j;GWd?({g=)ZWjVlO{hyzCJzu&OBWnwHNlVXga
zkd^Mzw}odQxzwULk{;m}{DTv_Sj^zZAXw~{2UHapxMHgaH9^E=P$6VXluNw1@&b3m
zn~1)IELjP<=AYmkjW5GwDUdo7l925!e6K^ioVkJq3m&do=ddk68(piN%*`<sjsWf^
zLiE+E$P4*TM{rdZr34-<i<K4v)DI~@><4V|yQQc9q$&r!7yQ2T43^ya2vqy^Wx!7N
z?Y_`b?wbed2Z!XIKm>czFT)1SnRz{K=vpFEHPoHrY|o@gA0I7M2Dtg9)8lKZ<7S6-
z<J{6Qx=t1Rgw4`B*2A)&1Og-`+$Z+hz`k^r@|%wn&w<KI6{JBWsP}rxlhlCb*}GNg
zPkV7lJK}@0vney=t5TYk4?y_-^iw{$bM7L8MD!tMQt<hoJV@=F_yf>S|0+1`VQ>g-
zUf}7ASJXqy&To-F(Qz67XEi6QD^wR@M3_c2I(+Hf3i}1t3-p_6LNoyg*zuUj`?;Pk
zxA07lH0MKbTY%!UG?pNJjGtFb(<MXnuy8XA<}B7Vl=2po9Kwm<UPWXaLduJ=jvTD+
zk9BwjnL`P{ze=u@M=+IT9*h@is`<MS9RGS+i+Rfk%SSv*@{#b34>+K`JCUW871Z+J
zGG$J?&6|$cMKBeRxg3iYhNa*+A>55dbaE}fMuG<EO<is)fK|A~_9Mr2-&|FeXU3Gm
z9)d1?PYJ`Mp{KqLA@-AW@DYhER<Q?8Ut!SGJ(F~O@%vqY-DF1BGKz)N{$!My5bs0O
zd#~G!*z#gyN;)-BfK!l&_O3I)bm|tq2l;#?mH}N%S*3cv8^Cy~V^Nv~KZ5}KES+`D
zsg4ICNIOLX%+a2}>H_fh_;`qAXuEqUkf)LrT9Cp!Dc<|#TC}?40j1A!)5NdX*T3#O
z$EqQnjD85jN!+tD*jk$xM!Y^Xbgxcy_kVW-+&j&eF6nB~4+;q)hbnp#xc5bXEX@N`
zq_wpsUAhtj8Z?}S)+xuATvdLTu5}lA0GvzSSX<NY@3^<&!IpaCPc&NXSvk57?@V)^
zTae_!<buz8FWkcKcl%cZ%jLg<NBx%~Pe{`V_3^3L4+qNmGwUM@bjim+=@;^lL?(v$
z@$M3z_z+{-W?9)MTr555#9rUg?dScN=tjTIfV@RR$-x4!|B`&h68$!Zwz?6`_DnbU
z`_|T~r<E@Sfmi#8-}l~?7sl%0D`d&WQO63eGt8vz^mZGj$dw$k)3p1%)hZ)=JH~BR
zRGO-9eVH9C{a@x~c7vio3XJ*SRHL@5AH3o>wIrOUt;&Q})TTPchgJ3>2y;yArN>D=
zL?j7ttjP6dQq863B$ilbIDCi^Qc(08Ut9-sF}IkI9=t`h4ZZ{!9cbeZtOJ<p>z5sk
zx2)I)ob&4eJud7+RfN{<$Acfn5o~nMf`sl^LGkuPSrJVCtK!uqDE>;$%ql`_?!B=@
z(AvSvV7jwER8dMRVEkYjV_8qvkT)nB`4%J>%E|eI-h8UDxu%>?s)B6H)#2enYK8D#
zRNDhD!Xt9b)-+QlGh%PpAAt;l$?lD?4TVx!gE!b#s|3H8=QT!=;Ku1k)bKB{zx_XU
zzgDGFu{df*PUlSp9lAM@Afml$LpI(|JFiD?hT&;V%R`sh|LVdE$YBSivxEj7{)wk5
z5$)TPmrX>U8>;n<`N6v&gH34hH#?thpHsZ8EM1D$n{kAGhSdr#OeiG#|NrJ%JTPJX
z_}!WH@k>I#@mJ@qmlsCIPo<IHoh~>^dTVCtZ;Js`5;yyAEKRrk;)Ex*3U_l}BAP>K
z%Ve%IWhP!eqw`60|Esua6z&0K&Nu6ikxxIA;_MsT_4L8%UzdkbV|Nx_a$7fj2GP$b
zXVYa=z875o`(%ds6{H@Km+|b+G65iYf7nXk3@-e%!huWqlK*|Th5A84Gq|cLFiB7e
zE5QkB0tw+c?zIj;&#@+62Y$&9>x3<xo3(H2+gSS*{Ay)TGw->FDF#J5&dcYBcgC8H
z%nA5Z@jqt=$G0Zpf0T>%)SEzRRHbOCCmVprchV34q}aAU`+=G1Q7=&Qa{x>-n)z<N
zj)Y6Da?G(cYRDB$w*b$Qq<Mg@Q<I`V94P38u@^VL?5V-JIDeI8%sJ*MR#WEqDvTPU
zY1?xL{JkD9%GJ9D9EpFj9I@FN4%W$vh@sx3iO2}c8H(%Mh_+waqb1|C{x$k}P|NqQ
z$G9##%5tMSu)ID$OXzH)!r6E&XJrJFZDW727uO?Kg}U2Y*a`c5eoy25lMFxKN6yd4
z-j9>AjE8_L?1mL!;&J+^tjz8N&LgA<($@zfM$%a<55+*o{wcZs_zD5Tu%d;<I`7eX
zwjZKSe&{e0>Ws%cULr$O;I_bKUv<zVMR=~(dH0cNLxuCypFa^^C`j_qv^hQ?!<bL1
zfLvgX@?1AcqJly27W+a}wlCp$Z*q8w9sS5eYDCPRisSD@^#x@A#u@gN*8+je+PJRN
z%N(FlJkdBrqc7D8!>nePw~~fP(dkOa03_~Xnijxg6v2k*aa$xC;{MIAWwpM_Gu)@&
zOFr^1#m2<h<NGuHo?5!rK;EBean-W{nZ6ZJ=qFdA8BrzrOLjVTPytn-=G)@Gh<7y{
zDlPTff0r159Qq&t-%%xd+F&~44T&FzS`G#CEK%=S#dU=td+`xp3svD2t^7AhM{N~H
z3yH<pr)H2L@j<yws_C$Mmr20|LI{1yl`!A)C1yz{kQ_dBLrI?|X0G=mpma*^+uDxI
z0po|aVr0tKdX%3HUfn2^#LZf7sK<jF6FA!OTyJM;rM-(4I{l#b>Z>B-YF24A)rBpm
z%A~^!U?ZVp1?kVcvpm(W$G^Bakh|w5JL@jYvoF(6r*67O)Ds<nkG^q}@(y+qY3Pc=
zzf=2qIO3|qJnKF%F23+?<wi*-0TfB+r$;IiAS9x=!algPVD4k#U;qS*rp2_S_o{z@
z{rY4A+1+z-aqM1lnTt*R`)JA)T{O#Mlj=F@dh;^e0`*d3Q(wCBWrqc#^1|`aD+NOk
zUQcpZ%)I}Zg^X~+6aSf2VRlJJF@}~X?q(Znwu2&j(yR=~QqXF<(=%=VspmCDmD@~h
z%`GixSLRU{s6)1FV|6@l&!;7OI%G=wdKR}m0eE~^(+Htd(-Q{t25MyRAA619?w39v
z4{IO4`uKFAi^!liF&F&uJyri&jk>&PcoaS_<b1eg9@;0Ng~bD&o(}0dK4tZs=Z;5C
z1H9YrMKdY*>N{wmu>w4*DpdoYLEKj_!lFQAC@%5z(3jY}JTt-sEh}Wpl7N6u_le%2
zWRY^eUBi3z$V4qn3nSZpj&ZHdjwYBDoF`i=SKnebNUTIiWm-KHjB{V`;D80z@8{P1
zAUsoHw<q^5+$#`F#_8D=PLZ+^d0cD%Kau0OD*GKW0Z{CKZZL7QnZ!yCmF}IzU4N$@
z+KZb?bk0y?BK8oi0UM4JJxnU{W{Ohy&l5jrpCx69Xba?}=bq3XxDDP<F`hfnf5Uy}
zh56fuT69w_FD?PUCUL9CyEStb8C1=`?$G{dyv5d6Z@F_<#@|;X#xzG$aL=uakjvl;
z3gMosuuG_0ecpR|`0V*8QcNZpQq?!%^a6X|jBZ1i2f6SY57BsH5x+cczz6m%S=T0M
zU>@$__weCIb=#PjgTHod4Q}2aBBl47(?5P|f#<d{S$rbEl9L+P^6Tn(Sex&7<5}WO
z0hpP9{`H4kX(8evt>Oi1Wv}WXy|Q<^wITNv!e2jR^=>z6Vf-f*H~7}bN>`Vk%+fmF
zxIWf<NNh}oHRMF_!(*OLEh|=n06TPt%+J|b#Ya^LYP?jKOA{$Lgf3_L4_bIUTOozZ
zhc%vT2wtCkZf08T8u_s0nJ9SOS>x?op7Wx$o4P#Q5_O}$E*OgEJ>Wck;NPy{H`4Vc
zGnLnz7y>(dhoT+42kDjhC&!an4Gvk*FE~oq38{Hwkq95q|9#?YLOi6C7<k92c@(M>
z@zRE$&<X8fn#z#fwfp01)<6MvUn^RSrmPb>e|EENy~i8<nU3!~a)C0ZL5+L5SFQ~)
zNqy<OBQHznV)}moo(Ow~Qnflu<ol4R!P7u#!|ij>5Z-QtRyK4IZ~v!_`9-R9!Z(Md
z!Q8WRdOz4vAwcW9v+eoT4ZWq>{bLNxOOv7x>ZBD$qtSj>dWQgw0<%Uuj9zEPynA@@
zR$z7SIXEp;iew>_%b0g6?@SdF=ch!oUpdCA4C3DT=PQj0s$uLS#rNfyiRcV_mMWzL
zwsjRlZ}e`U$BfnsAE_mi#8zTu-R?`ylt!h8A=p|A<=c-A5wqPqY$>kPa@=VYT`hid
z!c&iM9Dldk0)y1;#T9;`YVWZ>hsitCrSR%Z`?&$uBTi4IZAViz=mrH0<R$hzPu!T)
zV;D|OEJ2*k3ypn}FdZiY-Y*^L|F7TL!PiYmkd4_e^HBsb<OhFojw)DKT$oUj2n<Dy
zym~KqaFvW5^ms)uLcQ0Irl`V)jOrr4&wYQ-ZSBqAK^Gg%Oz?R^Z;vB4L2UQX2eriL
zRfQ14rHGmPWx9u0tDJ0yOY(z-9qkR1+pFOw-`d%!!{9PCft1%@<z5uN>Hdu`i4v=e
z=+Z0?Y`<0-st{EkRdE9dDwIV@mnww!Rv<1R&x6bFId7m{t|z1G_1ltc<DY8zvo`n}
zGvvq*)zXigVYF_*zVF$+t7X%j_pt4SqlgAf;W7}~kwDDXt5Ru@au6B<_%;<Su&GfR
zu;!G3I1f{-i7l5w_4Ab_?+=#<Mk@@=Q#*`M_R){euiGy^_P8Llf)>fh3=u#LKW^?g
z+QW98&0{oTU7{AnNkBt))Li!4^QQrA7a^GN!KV)<o%QVZgbaEr{p4hyJR%WAfLAFx
z1{4W>5(=7$ju4cTm7)izOvnc84QfyQojTnee1!YW7M)7`@<bv2Fp}PudXFQFR2Q5b
z6Pp?<U0ka=B2%UizJZXWJsLmF{9}T=aZf4S1`<rdi+s%I)C*b#pfDSBEJn!_eHS?d
zbGKayt^}09z#UY0Qmctp*@Pf<#xkA&j6>CmPT}e7`;Z1~WQk`T0{*e=>a+WL>*oqX
z78t2M?ZPO`n(Hg#dyZX9<IQIiv=hVEnz7{2lny>o=WE;V03Cb13kwk$z;I*RTJ8|>
z=pIzd?lmVf3e9}8xiB(5hP7g0AfP_UbX$78MJ(vnf!fO5ZrPY?p#7&Z@HcW|uOegu
z7CsfhlLHZdf9<N^Lsa4SHOd;%a=mg)U}JwSAL+*Z4LgjvHmjYzy@i*g9XVy<&33M?
z%sHlNIKm@dJy(|n6gz!;mK^35d`79j=`DSr%zB#B`l9#N|1Y33&yXrs(u=o{j5DM1
z@Eu1Fx+LlRdLhHtWdQB^SV!p@?Xh6)DIY_Zh=cDtWRc5gDXqYSbKyc?(MO%#OFHL3
zdKUCS-1mJFl^G))=aDBcfX8cfLDC1vVTWJ+!VEk}jIEm$Enql#NB}3>A%++xz2^G2
z+Qc&LaD`IP+ji}1R5<me?arr?G=smds(tXzngX%!%#WEWA}bdL<GDo-iWW(5h7s~s
zB~^t`#p3_beu%!AA1A276e)up>UY?~lko5+AO%@_@Q*MXXQmcDwIg)}$B;DGnGm;c
z#Q>h23-$y25}l<he+=#qZq|569yP(666>|GX%_F|eXDJFHRw-Siw8=<pX1|+sUej{
z(UfkG%i<V!lbYmsA(5<XXqpTk{UYmt53IRP=f+Wb9Gd7yX$N}Is&}5K)3g#JS~iZv
zG+F3P3P!ak@DgRd?LIv@^4h%BE)abi%)Tdm>}Z?OWeS8Dx3gH5A7{g9JdSe@;}mfN
zXibpmHDDqowH>EzLX3^xT<tEf<xmsxCEW;lVEWUlI==HA#9QQaGE#f-d|#LspjX+m
z9=G$mwyqZigv6BIxd-Gf?Yjv*!O+EqBF+Lk8v1S2>$lFLEBn(nzBvSaKi9%Ez3I~A
z=zg=9(qd5$!}BDSFhyQUf^q@?c5ARF6I-eBa5YT%ne0JOY3CBnMDa`ZD%vcRr7yd`
z(*Eg#Jmt@O&({Lo0_M*3jT6Jfz2PlC$E5_)wI~rPG4avmKa51yO#8MVjrVRzrAqFS
z%8)Q^mdje37oXYM9(@+qokNw@m}(TuQwaZnrW|8xU>~5=p^WU_3jXzd>GMkM{w5G1
zVld{nIzTl&nJv(F-FdBlvKMl)&jZX;xF?Pj9F-dJPXJg5NR5=X(DiuVs$S!|_gVny
z-$MK|<UfAg`)Tl!2i61>9FCUBAjY++>ag|)UsVV^QN0fP_3+8L9%PKv=_oNMO4scD
zHuZb>Soa~5^#_&bM@t}I9)&KD(hL(I4|nHS{#De&NbWy82}t88+K!8C;T%E{VTNG;
zJYG)mSn4r|RA5_$7dRX-FLlcH*q!(NjRHjGg&9M=RhRI|_qz*zz+8o#D4IN1+$ZlF
zEWHQ;1mP?Mg}*9YZ3|h&0~7HC<Z~?>VoCb^)iM%NQY$a&rB!f<9KOZ}iKGcf{i9Xl
zfL&XzEPimE040^2b{~KViVPXO_kb$S(a-W8pY9OKk3o+l@^TjK>%8`<1w)bNA&qh<
zv#@2({b))BkAzbHIKnCB@EiYjODr{hd<7BIk&ZpFZx$LdSnwbd-KAr9BK%u~t+2S-
zx6=aR!s|zBW^@9lbxSo76ivIscZ?_Os-LL;wNc?FN<pW~&0%7C5wD5N$%|>7bDkf9
z7pfFa^Kw`qig7HO&w54eOvUX5dKaJ9OLKPFc>;Xlu>x2Tz@?q(xanoe(AR(1P3_nP
z1OE;d1xU2k7y8osc_&Zm8&1N6Bg+!u0Q4z*RwnRt7i#@qRpMi-nFUNd8#3d)`usgT
z0<y3U?51OYz<lfq@Qygv=O+T@6U|t3i7}rR=2Kpr2vL70t&e|O$HP~jO`<#w?m-<!
zX>a@}zqd=~j!hPR!@hz8T8>x*7&XhOwR_)$ROSK^@i9(CiC+YrSy&?x8_~(~!<s)V
zHmKi45nKyxyXkgGp^3(8c$Eg~A(V{N!%h)K0c?&oPJ5-G)2>~A`$Cq&E7~c~N1oGf
zk~iqaB?4uZL=VUu)0Ft~YMC5@Bqj-vo!gNjH4W%=!?~J#XGvO4YedPDs-4mk|BC9>
z?<S^Y_ae(~IR-8|(&+pI^H0Lsw~3q>Mv~w`KsPvE9dac%w;puz;~A`4@X={k=mTEJ
z9KTf<uIS8fuR9@J$rn_6BtyLtr`E>^pV;%{4~Wk@-1{t~)R{+|e|G0X3RCSZ<f2%u
z(-W=*sANs`1}hq@q|mGR^5E!?wE5xG2jXQpZ`azvO-!5>Py3Hu*EFsY3CB%Y_lg_G
z=SvfMJ*4X7@wd$Br%*m?tjgP!IR{v0P&d5x!P?Uj+7v#IH?;N^dJ{I}91bC44%FOb
z0?1C`^>Hn$k<mQBtjQq@0wxAr0qEP$@Ae08IC`U(G8PUjNa*Wk5zj=THG4;1oWq(k
zugk&TSwB%TUw^d}0zc4MSLvj+U|rGa6r3D-`f}XFhGX0<N1@B3=;a8O55bUdWlvn5
z4Z~;lRBKTxllBIFSbz87yD`=~W>$A>QUu+NgSfA-9Lv%eZX{Q#T#9@K^7cP#?Kfc@
zonr!aQ>0(^<J3w=xIAHkI);7KI&lJE+RtOmA9?--cIU=GzE76I35MsjFm1{9GktGh
zNkU@M5|220gMS3TWWSD_Bp~;~`mb8L{~LFM?Bv88sj)5lDXOR`GN!RP+bxaEBL3aM
zugIBtd!_^Sc^B%i{ln1!NFT3nyEQ$t+~-2!)9POPW;+G92D!Z89a;L8#J+Eq>Gz*p
z27GUp@d_yuI<iacTf}toQHgH?-$_BgmgJwP{jwf~jwO>t+D7wk8y;2;C~q-p^QgeB
zNOe5Sv|>))rz4Q)i7QjuVf`ATFg@RTYA31}Cnw4{JMT5iZ|Wr{c+Lu&5|j5kWcaxd
z&iR{Q0GgA_Oo!fN-@+58RrlBrq&MI%)k}jP<~T2>n~KyhDk@ozu#>85f3T6ed!A+m
zN0caFP(`O3!Y9M)))A`n0W=1!=nS@(7F50dgy^tx)B8Jp8HsT#EhJX4z^jUj?tbb8
z+_Tkk$a^m9QdKFt$8ei^a$)VBd&bw!-x7+&h(vt5y{Ccg*W%I&5fPU-b2`$6++}4~
z-BRhZmhBo6sjzAX4N57sD8(HissynXwDB-y>-5XrxM4mOBGbk@NJp*!xDL4e!e~R2
z;%Yrz>P+W}*>W~*Kld^3EJ2cXeaJ_p4pwnoYeXQr10ef^_KzHz2lAE6Ydgw@u|IuW
z08ROhP}}kU)Yo6T!vQJFJnO^b&o5T#bv}kk#Cj39f{kPl4CAeQ^;#+TCp9%B7x#Q6
z<V4?l4h2^&JTzU*`*6X=h)GTjbv9aPoE!J6zFf)G9FaNuX|13PQ17I?OPyLf(ZRiF
zCT-*E9jCTyubjyp)~2thMwY+zWCZ4`-ISD7#aVS%XIHB8%(pOSHCmIU2GDuAMMLq}
ze0ls^1oMW=ENgx1)4S}C_N5JoU|znyU)V6sDhGCw;fY_{>x&oabkGpUEuO2S{w05w
zbe|-@(rAC*Ph$09(6awv&d={X0}FKDUMAvM_>5#^mUL5d>L5UO$oZr@n=>Du`4Fug
z*~_c&nN}r3P{C|Bz}NaOl?4u%Xo3r>dBTMteBfx|_3T|br4ROnvN|j<yEG0*h+RmC
zs+Ip*?!kO<SXV&Wx(}-BDjqcW9ZH&EWA95;4_(|yo$9+x56~^UiI~`lmJFu~YxUV&
zoNCm{qXsbcWFu(IWNjkUu!p!*#c%&RT$PVOj#R%|!>NPRUGNwd7x}K^K*4F^KIOcS
z^<$rmz(PM{rW&ZrJu7mfy_NVz!+g*9tDnNx*s-qv@3QQxR*f({SJ2rsQpM;^W0)^2
za3ztBVnUZZSA!7n;){!e^w0pXW&T-j$rbbq%Z6m-B;t$pRz8PUJv78I3teuWY6t1r
z18qPX9sAlH>q74FE15bg@p_}<!G&1{Yj@*?YCH2Vrxrd5V_e=4@~h)ztG_M2{&qG?
zG_iYs`LS#Dh5DSbv_O@B$8U_z(V5x-*Kp2iru0(yrUed7#+hU&e4(1azbsrOJd$?9
zoFTqgU|sZtrlCKUP1|ck&fGoU=aJ>PRa4lB;7DBefb8XoZflnzCBVz~dZ~{Dh$*0L
zWxEcb%+gVERoDArX8J&DZiLkNljUt!&z3Y3yhMyqSw;`DUbG^j#F9dIGo3Jgd#i=L
z=|xn1K+<q+^93SsOcw-cmrogs_IyxzpN!OUsazFbZXCEJRFhP=4nWYk#p;_~;Dy3E
z0z&5QfrNdD$-C~kUxEXt)h@(%BP})1Ol_6xRt&{n=dP%u8_K(J+>KG0*Q<>n!X;+#
zKp}>9u4g(Hz2QWGV#s(iPiVC1u)RjCuji=T_4wt=y0{G^O(5$GL`ebz*(*k}rg1H_
za7?K{r1GIYpuaHtufJe0`)Xj9rs<IyCkyb;+gb=GD=>s!3NjU5)b2MoHDvyHA}*9W
zDw|P!4tvl0d#mr$74WKN1&|>_S;8tlfej{9C{IKQk0+QQEivP!HXk4oRVnaY(uvXo
zG>6SSlk}`4m4_``MaGx*NV4wx;kln~_9xTA5FfSLE~(L_sjJM?%qPGBo!vdr$V_k6
zrnlo3OS20cb}sm_C{7dtvo*{_*^7d==9#6T`|y2(Cxj$vih2-F%8Z~lvG9zbS?`B|
zY^1!wYL^0#uF<b>otEkY(OQmWKl=zs7bfpay}0r5xd{rTHToX?h`%sh2oVL3tfJcx
zpGkr|&8e-d#mA_Lv+xDkS{Da8nBSeL1_#0ALze+|d6?uJabOc6QK{bGvF=x$+{Hi6
z=Pk%HJ{Q5EE3#j=a+cr+bP;qzpckfV`X>T(U_Eiyo&(%HrAh;bH1|s4O6vreo<@Ka
zcyrP-8}U{<;Afa~7}42hr_l=rf|b*Tu0aZ6OCy)EjE&<HVIS!ETyALZwVfA0|8rX3
zFrZ7}C9lp+Pn6WG+~C(xUdgv{n*-bp|DDMEljKn~GZrd0WUIwiET0y2!&AKpNHTwE
zv}l&bDEp-Co<q@yrcBc28qMf`sk4pPs=8>3861%zwKVpE@Pa4Q`83)DF^XO)7%N-_
zivEd5%ZyD2GUc95-_25x*wu(z-Nw-Gccl?`4qQ5H!8*q?R6^n?Z#BMeo}ZbqA^~aM
zW|yHs#bFieQ(K}?uD0|;<Ad?T+UiXQ>JfRMN(rGRw$|s|kK?;x@3K!ir0)B)=RUr`
zMQ@Jjf3bdB`K+)Kqm$6#(De(qKlrrXq}Bsi{;Zi_JU#uKVZQ&Q+w{%Qe`<D_zb8xr
z{!-_>s;NFa-##ezjtYDiEEWgwRD|l@=jYu|=vJ8Nvy*r)8b21|+LJ4t-0CZ5U>oGJ
zt5-tHhs7P%!B0Y+yM@)ddp?;Ioy0UuOe@oVCx+`5B`XFDLFYUcuE~KK31C)myzrfY
zb=?h71*rku75+VzRH~E!QAj4@+uz?WN>khA8s(5gE`yf3RGV%0P(d_(G!vE&(j5&%
zpLsWZsBSN4T%DO^o@ryg>XRdb?d|x5lO<HZR($c%nqJ7J=ibEkM`RoJMuPs4He085
zP=VGgTXxjO=ZoR1I*cI?^b-Hw3e$|~?m+S1oAK<%Pegx6#OLiR{!RuH;oe8xx%W2_
z+q99h?AlMoyuOUD6AgC^dc{idJKxBID7yafL0oGJTx(LK*4VEyE3A=YM4(GoN#Ds;
zcPW)Fdi;47Xl%-^A&5qOLBj_I&D1%}l`ExHjbet!UT+4dz=pJTz3KS#On}M8;8SeT
z5WGrIO~~$h91fQ9j(xP@HM;+0SZElWIM7Wc--Bry=&RU4BJgnSDBcjY``D+b%K>Bn
zgMK|6sf<RQ_$dC0FwwNJHyRyCBI;Mwi>T1*eEZ<J^6;V%YyJV=>6@#=K3;&SMt{W@
zTA!PelH!e;L=CNa)Z3@c&xB~k722aeQMWxXPL)5rpkp|hT5t>aIz#cD40fh)YVABr
zNWeseHTv2^=EvvJUlD}|{Q+#9Zald)u8>}Lb;n4UyUB^&oVcL9YV8BN;Y_1a^QgDO
zoc+<iZySUOC3JRj{RTwc(CXMtCBvV@M%~p01dzA~dSlPVIFZqw6g-i~Dt#gB7w?+6
z|9;C8Z$kZH%)dFft(#S2+m~N|;-FO_kLBTd{0Vf=V_;(K{M`1Nk1A+X_x)Di>tS<_
zYaS`Q3`MaD<4oTC_RHlt$&lsJPJ|E8S-qe<nnW3bJP6}Vzcl7S*g8QkZI<JCMh%oV
z%yU-8zqXn#u+9}6O;wJtTCyFq4mI}Z{3V!pC#vkiXR|IqN^t8M`>NKWBop_UE6d$G
zrG3B%QVRR*D{tDR{Ser(u`1umm@wXPp1UX89L^B!QrHniZqErYmSEB{^8yT%Y7j7L
z+D+aCRD9v7EyuAvI<KrkOd`>ntLBOgKdHC+G%AYa;TWT{oMm*|M{%6tUDO}fuB&(>
zqSCuZC!NTbdPeDP4IT=@l_8J*{DJF)YZ)??^be|Z5NT-ThFvDx!IUtSu%Ke+SL;GD
zBgN1v%(&0S)*+~{?w*F#k5(YKp;12OOj1xnb?PyEanuY>%eGVpDvCw~u?nd>rBnz^
zf>*O)KSq5S!izagyedF^EFJDf5g<T7RNXk#ews~;?nCqk``Io9f1vL3tF+kRqYMH*
z!dxBLx3?oKK!8pduzcfI$jO<up4Ku&^*yH95HcV?q#-Ypm2dIRKpvyajw_aem*R62
zpJkfho3VNRY(g*UZpiI@N$gd<=%3T>N(`d$qb2JH><`7G&L__$Sm*@QtUKpdny3(r
z0nysnjf-8z?Z*4X*#Sy!h6YnDHsw=VdX^m*yADyzX1t^<v}6N;ts8I&_qd<bXk<m1
z7Cb6&%3v4n&-Irue1>QCIY>3e?e$0}x59biT)eB!^){-i&j+6?+$vudNz;vd6=5oK
z4Y~bTsX>{npl!PUBqMLao?X$i*YxG7f1nG#`J_)=0bV~;SX_7VlUuTxX?jRCpG&J#
zHGLnA-rZxR<G(CX)yIyeq=9oZv<eg^Xl5vt(Ayz_t6@@0HPQ!f?{+Q1;g>^IRvIxJ
zhJ{X}mAbOpHJx^y)z;AzLIP7kP&yI3`+$3j{)d5QFE{T-1wu8-Z?|7g9+r7<NkA(6
zOaC6_=iSLc?%J9z)I{8Afe1qhrfWX+r31XZL!`h&ptai99N=0?ncl`>y(K+#{M(e}
zZ!G*vWYAsx$+BuOfMS5$Pp%(6o|j|u)eIr?i?5&eude$qH=7As>}y!1hR_pFZHDL3
zwi%ZKd<;`~JebCi5jm#mKCi6Vj2LOSQe79#W&p|Z3)%(+#=T-<b|uCk>z&IrMP0&$
z?MsyrdB@dMW?jwXr`8Hoq*EU0Y#!*C!Rfi`842`Q1vsYLvbB%hE*Bl`9j1j7oN$Ff
z2ef?Kaf<bxRkJ}~0~7@Y!VTz3$X(hqm{;+}@fC|T(-?FnlZz<@0<CxKyXMH_N8C5}
z2ETkM+e=PIYaRe(N5}sUh#k^n8Mvx9SFCPkqe3J}tJDCA2tHt@{FADU&AUyCxob>V
z4)MB4zt0<s!27LUFG2A?)-CH_ndIa(pSThrq;|5lNarXD*#%MTO$)mvvu}eKeHe9E
zS8}j(fq<Cj$%bVQ1saNUiJ;%IElOAH_-~S15_X#=OP#PIyul@@!A2J(g*1ql)h0`x
zBbun^L63JDcfpEqHF6Eo(xw;HRfL{GV)q5flRY2a6%f_ljk;G*i&*Ev$Y{<&aT(QB
zFAMi$;gTnM^wFckbGPaZe6uv#0jvRi1~o0YVtR9bhVsyd)_TO!Uxa_Pa5OZJF+-<9
zWrp0maqT|mo}Yt6+#{guV;kT81Yv(87y<8YBvERK;FR6K6#QVq12(&9OztOVDZrh~
z-j}EHT5kfFr(u2F6nk@<@}cvWkkM}6OW<49pCT5FB7&e=3!SZM7yqmDFOi2W*livw
zQzQNNqF4O0fJwi{MeX`PJ@c^Ktj<`p4cSkw{o~C~2MegMLm%kxC&i!a>RXR^%4C88
zqI!sK+>8#r{2p<Lm8lyLQrr&kvUvxqd(2FmFpIw=g^_n5GKydG%?b6`iZj`p)C6z}
z><V~XTQ-TOizSEH`_NIrO6K~b-{XriPHozm()%Z7gw))YriL<8;Rly%fJN=idTLGg
zHRV*25J#6Ag-mI`Wg@JNrNyrOw4O~GRoh{S?G}kBKYTu-WY_0{r^4Zgt%@sCgT@pW
zDt#@0vzO?Wdmi!<hRO1LIsyw2zn|2Oqfb(`Wt&5Ku0xS?P8WeMJR^!j&Bc$^S|k)-
zy^Q}@YhfH8SDDHu(_1j1KISZ-!@g#zWatW9f5XN4lY=iO`*vkyEiSCiQ_K5SGP5B2
zGa5d)%szqG2Qy2z5f<>dYKy@RUD*-{8#Qv8T{u{qJWJ3SG_J!IbcW)+;pWPt4=C=0
z^gTD0S#QA$YXV;}B{IDR(j83GEO*^h8H36K5dB($V3E|3Nr4H&c;iDb3+<rt#Iy9;
zwaT<&*ij|I%2DKS`U5An<7eJpa_2U+#W_|JO+0`c&QM!#<a0T*64Ykc6f6N2D@8yK
z>JIg9vpq#>f+gpIx~~NQRvF>Fy4{VtP&qbW^Xy03*ieItW@@!kj}R{p5=J706!`1i
zL&;_g9JoU{-ZSg2Q5~E0XPH7PzUQ^moi^zXb!57#xxALRsu(nXV>!M@SXs?6B(OCv
zk&wh}-JFOv_=@S)leR&v1#!=LMGjU7W=b8|-apppa)`V7cH>g085b+ACBY>TjXOj^
z#EIr`?A;`J<|D_&y|Zi3<M?tpEnm|c1NBZ64Y==Dmc1B=cztx*S_>oU^|;vWKa5``
zzxX?_#&2;O&S7Sexw%Qt4E|Ljsy}j;M_Z=_8$eI}koaWCI4vrO)MAx%CcM4fNL2pU
z-tal1_|4S_Th#L__pJ%F#7HDtE}{JewsKgI7JQy9Cq(Pl6i-QOpJ?7(P8utWhL1&|
zu3u+fJNAU~fO4I=;XByskdAqy6L4q}M?h8CslUd4oV_Q#`#|S`J7NdVh@6uyAPe8-
z=EtY$m}%Kf88%OcPL>nf$nQ>t+d?Hx)$OLn{J6Deb%+zVM@0J<O#;lbSMetvjfiJ5
z2L@MgMvzpP?e&2kRi;@PtajmWm%<=3+IG%tg@2=xU*r_egKapWjQ}mJ4%;<H5t|2|
zMfXQl3#aK`1#6n1hFX26ri_TN&cnznirDwl@151;a23TkDj0#h*)zIrFQmL{V1NO+
zKxhgUJ7*PFs=ntEnPRDLE_2_LxnlQDHIfrM&>An+>@035ARi&N;M04?I5|yl%o^>y
zk>(VjXXL?wpf$TZhO`xl#>a7XjYesnqmWy$Z`=%A<wm0OIMoapM9n!j|Bw?>ehmVn
z@vjlZ&1Y*iaG6Znoh)&gz(GJ^THf8EVR)3abEx9q#8saB0Nz<Hj3*m;83366hCJ4i
zg=yFv!~-^%Dh7gwRomR5Y*Y<|{nNm{F$*2T5d7d$Y9ob{&L+FUS9gWo9g(Z#9xR4q
zU41qf)U3}vsZK9))Lx%VBD{S^iB^eH`R~A9Ah&b|6m!%{oZA-twVBX+ucJFJXqtKg
z5^LOi>20dtG01Y7n{+-E2D5sYbdvB?>(V02S0?x@+4Do<p8a$EPqmmIxi2ci-Ugz%
z9DBfkzzywm1Gckl&;G5L2E+w9vXGKa_@}+X?!bByPyLr8b_ZIGuDA_<&yhxoj+t`f
ztIp5OK@N6<2x+oQ+WsNy*sB?ezp|V!;8EsG-Di*3hEwY=BCAvHxA#BI?6ff5b#e?h
z*c^OH@8Aj`x>N~sj-FUs>d*-&8b~cw+y^unImTNDrf2kZGxkSsCf-!}AmGcnIvlS8
zky_oyOp{6sY_~~1NmO_=GZ^6P32P3I6d1h0RO1W|k#phI63mP)Rj~bMP^Gs3^4*zn
zO|PnOlV*sJ*#9`X3WuiNE=(yF15}jQKuQ#pP-2vz#E`Cy(IukvMmLBsBu0mXf(Xbq
zx=Uif2thzb$UtCpcZu-r_x%TVyXU>{InR0GRRGCL8eUq`Jw*E!zyuhXuUU?IloOVm
zXCMPj$%ImV8&V{K+JN?|h0725p5|-Ks2Ey6JCAhOJl<@TRsQvlbc8J-v&A9mz=-%|
z{tcz}lxRc6;l{2d3o-#2S(~JPcN4utZ~G|c;&~RlDjGh;@>TqOFWfQdQX6t_7QYjA
z<qK=#A9(<~zB)8CB8kC{gZ=Ip>5tZ6XPeZk)42Dvt=4In=mZY?bH*6k#%zpWSGm|(
zUA0(Y<p_-8<bPIQ?Q+02ZIm)hww05A_NASn3R}4ve_AJv>^DxKc&G794$o0|4>kDv
zQbvKDpYi|4E_OAhDac^KM~X)Z|L{<sKjU9NyG<&n%;iFJ<7%V&5pG0l)rgp_4CGS)
z1`mLx`@U1>EJrhFCS{Ite{7w)L6MDU$EBp>2Ae2x8P5_OeJg2pm=@b2QTlO;jDg;h
z|1js9_xsBJj+lRCuT64((-+x(*^M?p$s1fX%~Thv?&*UOoY6HRT0ACnE`yWE>7b(^
zGofzt?-WG%&VZCD)Onz%mcWq#FxZNW>sGZ+aivf-@?d4tmy+|OrQ$rEQ1Y+g6lu1>
zmNACc1G&}*&Ce4~Jo-^tA)HuPaZuA%bnN!(5+{oXlQjHAB9?LJ1&=<VseZ5cuUpS>
zzC{qLJl{u8r??`4p&sj>^51Z@0@w_Fi|6#cxO9f5o!509#`zlCb$D%~0fpPV``CcG
z>vo1O#Oa>WNf=J(3bFJXnmk4RV#sv`%HE-&cO&bUT<jQD2VVqbU~&*4ZZn3LVtF^v
z*y3I+v6@@z4#oJZK>f1Y@cXNheX~3$BTx-PIhqvukAA)jGi~9uoC2N7tH4BOV|LGd
z=3ic?INnS@JW3R+t=XREsrQWEkMxI%Tum&TQ))4)4sQ_*m+6Wr&!=q5-U0`|0<=7T
znC65kI&*(O7-Qydu8oJ-A?ai_*D1qBkS!<*#MJw7!|K~vIv*`a)}?_h5yemE+6YR+
z%HB|HRorL4R5oL`svXj`;Z2&oD@c@dsW<L7bTgRM_S~qxGfPotslV?sXIFT|fRd5^
zKK71$g$jdpz+bipx?oKPUVHumH*tF(;>3H!>T_2_F#wbaF*j}gnv2zNk2l5NZF$8S
zUD77qAdW;2g0Hzzept~#MJ2`{9V?TmhIUW!rYx)XD^zx;0~w@6)dp_fj7R5gmL}e-
z=j&N1&3G_CqFA74XEOf{iAj`Q6AgnJmSm2W_vG-Jj7?-m8_sZZZRk!T_}_&ZaqX2)
ztd%Yesq-_k{OEU8Ipr>MLw))pew+(OqK0nVWO&YCL;;x!%c$?VWV`w_a<c#!5m#n)
zKj1qM8fbqsFE!y><~-PuIl*=_tD##gTLtBZdE$Fk^-G)<{Dc*yMV(RJ>ksjByvDRg
z215}+O+pdUPZqXqp@qnAf|No$JaN60N~c`F>&NJ*jv`_Gjw&iV!vJmQ=V1<qf}=(!
z_kACah^3rkl2_B?9-Z(E$W06+z3&;r?S!%LguVi)%N}-i3KoH8DBpBXI~7?zwkyp_
zt>lKa{z9xhHZ#_rB&a)c%+1s;Qv1hR!CjVWan$sm@}-f%(4F;mmF+Ex@8y@)ge!#3
zyT1(b>v!aXiss@CR-u;uo6<`q7M;s=&dB8;oId*LP`s>vK?I@D@v_^^ggk41QWpU=
zUX0O}cEd(JY*m&v85V`u7Z5(uR>>FAa8g>PRrz01YfG4c#UHV|n30cty`*VG$qReo
zTw67ejA~rTONz^9Qge$#L2;rIzvY9kVGOVXIN|q!<QTV5sA(;)cFB18SOks8{;3(O
z$Hr?r6JI7qcyWv$=|>;SHW`+COThQqBdQq6<lq+OlKu!_ZsrzdO1=^6s6%X{mFy~)
zq9xSq)nwI9XhUBCu|J@l!wH=TY~prZHCnSY#1_Mf6v*Yd+nN9cJcaT14q1lc=g2j5
ztS37z)1{m|5KPa8;g$dT^WnI~Gi`<!6tT@?<hu5eU;(v1_l@)vG_~|Eu^;Mcs;~Wt
z@2}oZj2;o2f)hU4|NfEm9P+;BSDVAX%YW9a?#JH|+Jl4S-Z=BkgVNUeubI@_5URW6
zd}<no>Iql<N^UF8_Z8PpBORMehh?8*5WlpV^rl)9nZp<kW_iRoY3P5eYO+KATnQlu
zh@+jVFSRmw#@ebpmT~!8o(TFJ>u|tU1{ITY`7Rh67dQWYeK1!*BhIwZZ!3d$EQhuh
zBP_!+8J+^QkRR?au%}>{-o4G@bQu|pjtIr5`6)9#osWP-K&h!tCrW9!>({rTLgVW_
zbRzxEZ@8uLw4s`Gf@|GRPBLB%NJO)EAdlcDJyEii5TI-#Jm~QNY@Sn!<U?CeuVX~T
zG<#3rrv8k`ZBgxS>_K~40}}gcp8pWC2B4>;co!w_IZP`;%{q)%n+}~#1H3~X|B@!?
zOdwL_P@(Q(^Na&?$AG_!)p<h%_Mn&C?$NzrsaHe?QJMw$-XW~F3D?$UHLtnj&d#C-
z#zD}VVuB=VXPLxLT^!tzfWP~xVKk=Rcdkfh9E&@N=kcA?4MW!%#p)%<VHo8#o<$3u
zWYK{TWitN6Rp=6&uPnh+cO!oKAkeUvG3t4mfDrci?YPYp2=tMF4^Ux%(`!*q?OEi#
zD9#Y3&YNM^->|Dn041_0y+HsObH(k-Z2S)}3p$Kmw+Ov&nT`?fDmS(T`eA60xUXGp
zL1s}v8sNdgjv6wCi>nr+=Y_3!K=IC1Mpw~|vnS^n{TzW4vuiOjZXM+qm<g1E<z+kk
z)P^1a>lqWhcQheKgWY-`9S6+X(5Ln4S@lY4GOF*N-o=FtiV>l^6BPPQ+qHAS3bY;P
z8r&0LhkR`Qr;hD043qS^#XuW2tWt4Ab7kSdbEjn4xi<?@^y&0X4OgFaEAB^L;;a9V
z_K?ihZs4-bkpg#%`xSOwiZ~?1Ak`|B&bD;O<$!r4`Q4UqxRJ`SL^IRi>BvOoF|&OS
zqKT|B<%B4?cwjTR)2exqICjz<?$##mNkS@>fgh=ss@M`l<J)fnRr~L-w8!O^Wbtlg
zN$h@2q+eOq8Vz-aIx1Z5X%6dn0m8qO(NE6OCnUf9)o#V#ZM}dR&1`%%QL(_C<c~_R
zqxmW8Iw?7so=+KIQK|PVIs}CxdPQ96ITaZfIInTGGS*wzU8&cLr+L%njc1Vf0WSH5
z_%R+a%rGW}W|Ct1=Ppv>0&a^IN)wcT78OPn3euvX3^BIcA$fsbq)_|=R3uO@VGWAn
zTqt9@C-Ca;ylKkaI1jCVtGNhqsj*|#!WYt%_0#PDtxr60idK{!^!aYdi3PEbK;0%C
zkdT!*&yzUWo%Gl<t83WoU=g|S;Swx^Um=MBCYaRM=CGpQJ1?na;mX5YZj0r_HPH-J
zf-LOv{phQa*ErkcMv63uN)z->Mq{@?`@l;<h`iZLpE$p{<$k$z_dbb^W3Y2bkFpz$
zM+s6vIxcEHu#MRO*Ty2cxKntA%z&0v@j)bM_ksEJBo(UWWw-YC2#EySSFFg%-%rSD
zS}09w%KeEztHn_^Gi@f&8Y&9@Jrbz3B1?m^g&a((YD8;*rg~&>@4ntWgX+DQ%dU5J
zR&wGTTpfk-9lf1+Ss(sN^@m*kE*|$^fz<<0=>G1c=-=hGC>7bm%}EXi!t?8wZ_2Ja
zc&5nRWYmqbtutemyRA^t_<iT9Nd3SgLxOM4J09WTh%$ypopYM`b$UY#{J<aQ6Ni?&
zb1r{49|HO=auFS?h%`auvERBGJ%CwSl=e#3Y=qe)wPvfeQph&6vsmyN){oy3D%BUq
zL5{4!tLnJy7*XcbqSK~8igm=Gf=y*bfrm%sA%;^`#_z8-<c8;s%M`k$x)O*2`sfqt
z(pS^vB<{j<CC7|W@#xA_6F#N`l;~0k-iF>3_vUAH%0%GbZ^{1O&JvYSvEEla9_+Ld
zdr7dd2UN=&QN5JPIz!)jlJ(Zi@tZY7P~)Gua0PhFa9VG{lsv=n&2UWHbF53g3sIsD
zOa+#HAV29r6i8qpKWCGBIH_Y+5VUBS1t!lX7@TMt3r&`8IQk|9^DH7zX|ap!`us=f
z{@_IWC%jqEXtALMBb<m8yL*H==K~d;FsY-6#j?m4#*`+I$B%5Ou~EB9>7(`WwZS`B
zW!ahpud?oI_k~zJgr*Tg+ya~>sg^<f{1jp84Ck0x(hRL7TIn*P>fWpPw~>GE^mge*
zaU@KGk@KRlb!<}my43^&^8MI64)6bZuchCds2boC0=I#75GG0sa6neAK0UrXv;Ba;
zl#FFeEWn=|&oBQPFbX$-O4VRZ$8x1$<y@6z|1F(6xia}G)TXoG5RJR^fN0vo7+sXT
zjEUn~$Q92U+#WH&9vUG<!uy^2aOE7^QB7#iuK@!fE>&2-12^!ol|esbnNx_R_us3O
zH>hnutoMVhZ^p&<{L}`Nc6h0~tNFN-pZlaBQ*$wwoeUu_B}=X#$dTDaKXmfz5Q<xd
zf0JF0N#MV#HC8c7GJv;T{BCZZW)D#`1hWxf@8+>n92KTJmz`b(Al!{^2jqxQ!wln_
zd2^9fnG4H$M$$jvmn@-}ZqLC7|2bb4&PCt(KnE&tFKfOwV1~UX=AYs!cc7IyKOl3N
zR+{JKGY7*5AW`@S^^(g%_Mmu~IjhbDMQQko1z|N~y!@pnazLJ9nX_Y-W8%@Dx5l!L
z@u`BuVdLHf)4l&@-g_MWyo=Z?j^<e_EN4)gGfKajrm~ur{zzMic<F9OzJoy51>CLs
zi=Yq`)y2F~cMW)*8#zd6PMGb1sq^VGDyY0>uUGJXqZ9|oDe*;!yuns?j|)_<WcpQ@
z_N6D350qiBS4d=+S?RMF<B2A~_|s16JeTHRjOh^{g{2{6#u%L9>iND+FuaHDYE`~~
z=~Xj^(S-Z5H#fF#b~Mj}wv8Wp7<MR?lgq>y-B&HFw{wRHL{STB<&s=`^`SZTb8(-`
z_#mT1XS3JeawT|)!Ng7z-Gw!+QHd`oL2S`)%tQ2u)R!1?7V)4&@IFBaG^PSLBAYxf
zVdzF{xofLShj7edciSmEl?wBz5-5*-XM|Ils%KLb@V|Y?`EZU$IyQb~`K&Rk-U?JB
z)ORiMyy$zB0SMo3l>+;Oll0y->`VOV5aW3T`3N~`Z9-UGJ%U+-9LJ=5aEh{;4<QXo
z*I(8dYEN_9W25}c*h%Ew7*5>*?$6g_mQnlLQq1CRxfLB;)=HFUHghKxUW_a2pYdvq
zuLwA%JsQh`avUp0bmgWAssOlw(RYRClMUp%+xQ6c5e^6I*eFxzWX|){1vkqSNzkEn
zqo3q_f!D#noyF}`QiG%g)7Pe5?WrXYU$wI$htInfbufw>a^$vnZDTpwxAnBkz}a|o
z3ktK!Hvq}(-L9^G`p-%QMSN!#+}#Gab5GrO^Av2HZGU}1*n9obmZJFf3r2bxSpaG|
zm!vcSp^D7C5;BkRF?v1d_IJZhTk?j4@Z~9R2o-8TD%a`N7+{3MFVD}AtlDWkf6)rY
zae8ZyV_r{O$<arDu!xr(RR);HOU#r((bTj(;Bgt6*gWsR7k6UtaZrl3x}W!wD1{j-
z=i6j9S>3DduClWHsNg(R?&YUVXtGR<=lspYaeDD!mYbolx@Xqyd~`JZR-JIj<C}GF
z5bWvs+M6~IAKbvx-{s~x_%hqiEZq8!bbjz!(`y^0T|H@SOuTmGRs8WR3s?&p{8@~l
zURUpCVIA{Z#A2th1Pw`4NSG0t$sMcV1iXnd#{|e6K1v0iUbeafEc}@v9sL|#bOZV3
z`Q|Z#p_msxTzqZyxHanL;o4oa83&iqM|>f{v6<H#w=#G{=+WG$ETHi5WmPOsr*bw+
z9MIu~C6B#|G2aohJ)_jk%@~PF^z(@f*>{&<6z14SE{^wR=yWD_d^UUSeo|jMPMIdn
zajl^Y?fzoDtXbf-Y?Y$7fS`xgquL=wi(=tt%FSnGz!G5z;u$ia-i#3r;0@S)s(hnG
z2b9ZMqVtYd)Zpr5{3Z0ieS=U}_~BLnwur_pr!eX!>LVt#RM$D+>K&?E<krhpD&Q|3
zuM*ji%_hz54CT;R*6CKT!wMn~*t{AGUGLr)9VWWvnNL`^MN<ebA_^Dgp*+3@OIa(+
zzi+bp#(DAcy^sMDxxd;fZdfgZukl*<GZfq2?605e&wf@pAhXz@sl5z`-I5)!tH9@h
z3X%!^>bbnu1nN$}r(!BfpF|y}5gTkKO#kRP)8B}#+eX5bd&%b<S&ns=(q2=nX<el1
zbFZNVp<T66?X%o~Bg5jZb4x>LelPPF*ou&yU<R#&?iemG)bp}(x<>P%Qn8uc6egBV
z_oxg~nu6ySyL9XEQD9Y}QiI}9x~4p7I7$d~@DXs*T<~m!S<qJv6gK(8a-j&&pBTp`
zi>|J})r`o#6)GtrODO2!y;T?RaiQnHMrD0G=fkcR8Z<d>m*0esf&J}xqmn7S_}NU1
zu%W&~)@S<A=hOZUz@v*`+cJS@UX>c0iB&I<np3wEHcRRBEqozVVuFCqZZ{-&u8rcf
zT4xvP0Kj&zZk)egu{&Qi^sQIGjem8#ziwE`b`9w~g!~zOrUxeq(L#iAtGlw-u~CEn
z`Toq7hrOq?<H+S6!6fu}3Uqz>S5T4dOit(nGw<cH%R*RgHic<F_u_U3nQHVk=>e+@
zIbj&PfMv~#>r6(wHl51SeQGZ@!NGq|9<r+?mE4T`cUQGr$%fNrR9<->thrzYfY({C
zJiHzp{`vNg8DI5}mraVgC589PzypR4B&(Rwpg}2daZWb$L2{Ro?YW3LF%3+nnoZ~Z
z?b8p<PqyW$$@&pDscR(hD)I=*fRO@abPY{D4Pi-Ge?2&qIKQ)KR<ijPt?x~7ZeJjR
zAxWO`;!=96Oxtf>;*^5Y%FQR(k)lMgdypP6VnPD%a{^td8Nmc~6rYv5NUGmke0*;$
zr_<qMI1S#m+9f*^C%8Ud0ey?w1Grok+#0tx5@Pjaq>*=Pcyj)nO6>M5#E!K!Mq`~q
z4aY=3-V!jPSo<`%9kEZ1zcdH(L+3dJ5o(i>62K_&Ag|%ByKHX9iNBoa(O!GyzCHn8
zvoJP_HL;%1-$p6dv8T$3wA`&8m}{2MrGVm9!%<4hS}GU3!|`00yQtbojB)uZt$+|U
zzzi1xTqUvP6agqX0z@&V<FbHK8HOWFm2e*%C5>x3cl+cl&ppv5c+>G`zJ7@V;eJvt
zbknNImQa%2nCp{nf)2U&k$#)DR_MwSJ1bwrvY7frc%VTB;${1d@;{taycAGQbXM@s
zxAR7#c76jG2sN#mqR1M>F=IAleRQ7&i&qv72J#}YIZ2P)BfNS8gj0Jc2+t!%q16+`
zQGw9vQD%{zjZgj%6Vbj<1E_r;GQDf4=mC&|mwswtk_Lir$TW=WQb2n3Z+Z4{-%8c>
zAuZ>h=r!rF+l!wr7vZbWmq&AXLs!dW+)Fxp?)rWp4lnejW)d8#i+_}ux?VO<lKt`8
zj?)~oAZPlv7q841xya&Ix7Di_3Cx?%@LWzj?unM*+;jkwgARCEtd&+SOM+`S{*;-R
zS<bcQt78$oQZ8*fCq=Mqc8c(zl;CXS{>D+e=-${;)+4#;-zGvb`=%)=*jjN_3ak0l
z*hZgV^tZ=^QceFpZv!Qdje?3Xh1A54eGQ&_Mh8{-=x*9W{4*;VI0KuE)3@6AHz%{K
z3h<#!S<h>ejAA!g|Dhu3gkz$KyDXAV91TLhf@Dsr-fE~VM1f?zHsjZ8RONm+R$G1!
zLDhNsHon_XSDdx+N9{ZM-8J_}u#ISo5S%OdP`Dp)*D%!O%{$t<a_Rv56X0_&t_U*#
z9svImM}I^XWk@=!HwKZ!Y*m-unQckm9%x%YBoM-oU$0JNEiAwOj%nZ?OQY(`{V&wP
z(Ff68f|9wpvizDJ%Q=-7_SM@J`)u7bbCq>`JVQ3icsKn@Rt`P3C&?q76s`99=j&TN
zr26|wrVj=i)dK8N)ldAqjh&|hIIDIyZp#Tymm5ggTmOPCmb+56cCWa)6hm&@J!u37
z7c!BT9&&!8z`QkWNI_?|iR!Sr^1w;hnxsc4-T~v#U+39w9b;QEf02y*k;T@7xP*S`
z0gW|?#k)Z9s9GK5NC9Dw$ttgOl@E$apssrUe=UTOh1}oR+#VHVnheFA%2&~petn|y
zUxkwbB1n}}R~nLew<L~Lde{(IAQP}$WTA}oONRG<mQtvstgX@#e7=&{J&a#NcL0~=
zzNEY|k}<7cFIQ+o<+QgYeZS5iwk~Ja9uXSBRphmiTm`nW^&jqB>6p@O>uM-7d^ii9
zl!MwEy8svJ7z!~fzY6Kye9C41BKT=og+g#JE;%2oM1sLaWD!|7E|Xu%5bZ}-W+AIT
zNMRiJK5d<et9)@Td;gQud=C(|T6)dZ<wC~e+X(lQlgJRXSh>c)p;9iWTx5;5@=>`7
z)pCyfU2{Gmg9KuRr&q<7=}@?|X2Uhm3;A!p%e%NDPNc&Vs`_{?VGo`;oj6mlHuaN3
z%QBts>yxIa*zCmu8wH~8Nax3yZ{c0Vg;DQ$g`uKQ<MXY3V>jr;Dp-n2K$oMiI4X$5
zB>fu*cKAgOd`$aBHbg!LNr4r$PzUmbZm^Hz6dv)X|60@wNOOU94{{>84Ue+pz}4Sb
zjm!re8dXP(FsnmG;$MZa7*cl9Nupz7Qy#m<WfZ=!EqZN!RE1}z{7X<pMZWQ!L{S)E
zeY{5NOsh-I%UIbh?tq6qi0Ya6Q=dfo)^V-@QzOaSQDp~&1BNsyT<*22=mREjvg-&w
z*a>WCK>QL80NS&Ysa)vD>1wi@@JXcpOlz^jvZw&C-el@Vec(j#^sjw{`}```^#;G%
z1`ecg;^fuff*An~%8+TqX-UF5WKni6n?E*IyN7t46OYik^!lLcVgR&f!A4^EK24iU
z7oyk}shuR?EgS~g>$hd8QVK_gqlws`^0i)-*Ve&5N02Qh3BK#ov=d6<jAo_rcW=`m
z+s+TSXub!^>1?=nhg6g&!34ib#kjU=+nruc*|`S<8$R}K&yBJDzHm`RcB_G*?{($!
zqx9lTpA*s>xV*tq(h=#!4!ZYHedHMAS8l~i=sM`71;q=y>G*@6|MyFl3*4-80>k-7
zXJtWC`pHdQGN<}{TZ{==(`HxckV`MG<5aUHf9Kl16G<YpIgCDPaJRLAb)r?Gf0{JS
zKWc=}zN+@C?gO;~Smfe`?#@|9Q3g$=xEW6WL)Ldpio&g9r<3-P<*u%zLe}4Iv?ZV-
zLl$}$@#Q&>xhL)A$oz;4%{i+m+NatqW5d*~Wn{nNQ@%&YD`Zv!%eZ{-vk`{+5%4Mh
zOk@Lwog7k*X){X616~sTPj8m=-EHB?pk6esSAm37ZLt&&eSzKI&KEN|uliZ$MVHm+
zu{)$S-Q_ap-H+pbyQ2qAKRY{n%gO60Lce+hU0|debX!(6z}emRoK6q)jtA><l9=u(
z^YE3CPCcXa6a+X%HLK0z3^S$`H(h^qQ2-WbyWT%WqHKyU;?^uYD+=RNB$Ew=K4k@d
zUT<D?Ab{4$<yJs^o`<p<ZFeqlwYc~Iq-eUJ+chMQC9lAVq(M*k@_(@bM!{l-sbTXE
zxDmrcm%fJKlop5?ZBf38l%5AX==~|8ia|@C(0yt`4}vAp$P}PPXK}VcbiEI~9x>);
zeMGKVN;TV3!n-_7p6@bkm$@Wne+(G8(#`pTZja4>yZ;`qb(gRW#fK-7W76=p6g1#h
z*I=haTia|)*_^sVRv_=bp|L^AB|@Ogs0}cKT*lA}pJ#Q+1UhtkDr`~-$;9l}8DSwF
zO>OaxU6_n&!Qc#v7S4B}Ct5+jL47)F6KWm_d@M;!c#A4dw0AA(l*#eDAr_WGkYT?S
zYP_B<sgwk&4D%BANVuoJ>3~WpbuY}Cq!dSkNA1X9SjLIANr~Woyog{hUBm-5s)zfK
z2-X4dGu2Msl(%!2IWpHZ?O32oCNH5Q91fARb=Lmmbi_Nhy9;%a^Wyb)KwO!jd7%g}
zQjxq|_+H705+ls_e?m+cr3|P{YW?&mP$H!;<Q;!(7=BKX7#^y>?|E#9no+$*r#dTB
z1rRbLyqGDwl7!Ea?MnUhC9)&KUH&$!1nhx@)bHFECrAri{N|u)qQqK^cb$m~2d9TA
zv%Dg!7we5<Y7Og-mb?74?;_6S5uao}Q@Ae)a&->v)t{JqTye8z>kf`m@AG;eL8I@~
z@&XOPuerN&z0B|o($H9yzS%chz}ZxTQSdUsZcR-TO_H5+*XCT<_Bt?2oGg0vUk}!l
zr0`eCu0;O*I5WGn>L<6-FO3)o+}(c+S1$^`x|D;bco62|QT(o(%T^$mvJC>6;hq=O
z0Y?p^RW^T`e-DuMl7*|i$Yj|EtW>K1u<i4eGke(zL}RJquQ7PBU)N)=h*qG2uU|`?
z&7mIGrQNLAd*zF7C~DVYX#j^KMvHjy<sDZDU&627VV?#65{6c~$MAOS?A-E@9nB-l
z&~#7i<XX6=SCEVUu_prMpgVBll#z76V9|Xf#YQeL>i<QuBVkvRmo$a7DN+K{Yq%4m
zZcUR|`N!@g!Uoaj)S$4-raW$NTwkI`mZW5cyFk76v%rkC`G>lkFHU&uKnV|BXF%Mk
zvOa3KcVFlu<Z3SYu!gW+O=!So52$!`$XYtrPKL5h)~<xB+s;WcYk1n?Bi7r)b9?iG
z?K%Ej(MUNmte51hYt#3PB;Q)shjPphnnG`5u`<uB6lu_-hB99qwdG0hOT$C$rqCrt
zfIEzWdQ$&?qS}$@l)BC!H6{$J5C1x3MZ|JmS-)Fc|D6e*CS${^YqyI?y)TswT$}eR
z>kUQT?`3;<q$yps3l%adHOXGZ(a1@<ke0WtXShj9@<wz_-CVNUETV`YrW?PW=DdCI
zYEYG5^L6wG4h~}nHD4vq9ryn>OoR&EuDdI_4nYjy*NBTaS#5EswL6d>#Rt@jbF9TY
zA9jCGmVhGs{q&V5?G*eX1lPS`^Ih-^e{>IGaLPxqm)Y&r_*ofp8d!(DAuY3HHz7{c
z;{^@MoIdC0nvvkM0x1RZy1kmd0+b!_Kmu`f<6`oOAg7-a<-D4(0`I}s3(hcgIl~=A
zkq?fXnY?`IGrR~UZf>d%ds>=teYcevj3frI2nJ$D{gHi9i^S4{Kk#aY1wm_7L5k+T
zQ8~K~`EBm_4@tZ$cc+Ci#ny=--Z2A2(HWHRBytd@x7#{~_eQ-%!sN|X>smn>tc<ZW
z^h4Z#1j!b1{w_vaIDy{7!z(|}6!YxHZ@o-@*J@qV!Q$_MTectu-p~n~1sUJ(@S@J%
zvM@^898*$?mvJ~`?6SSqj^Z<>>$>_*D!b3AxZg3oa0};&adI!yZ5918Tb8@p$mSO7
zjDuijGrIp3tA9Y;?Yg_90c~d}055lC+kjBF1khZc<MX<}5huw>Oz7va|LOu)pN42l
zJ0;_vgqSyZcZfhE{u?4Jd<B9xCrVvuCI4Fmzod`@Z_pjCPsvVUeadbQw<%khf^qPy
zOy1D@UYZ%p#CllB1DTWcrvswvZq;}l*u-nQ`{og}W9eFHKf>&VS_!F-RTbP?Xx?49
zN*&`A9@WN`1?dP0S0`>i{@|3(_uV4SP`A^0kFf##2#RqXVL{UYU(Tsb)n$>l6P2)p
zYKw#12q1huGDArVS#|ibP|zMI-(=PtUMu*TN>&Nzts(4x=^B~h*|K}S0AW<%M?wH$
z0LOk$N8v+i|HG~}j0gj)_#Ozj#+qD(UN&R=&)qvZN#|2c8~W`pd+^3RFUn&xG(>9&
z)@HJ-;^yB}pPD`3OqLthe5YzIz!gP>^pFv0E@pd~oV@*{x^s9ob3;|d4ll9OLGisU
z<whu-bXDZPXP9J{3bh3kf^}mvuR)v$SG`E(7T8bgb$G+M?j+zpjw4&4<z?a|8zhc%
z%276CE-*(%+gA>Oe#c7r%coloS(jSlCVY)dQ~5Wpj1CQEOinte`IJRn!`6V|47H19
zJOtLXo|S>@A9D4--R(07n37}>vkni!P4$JL*PX)3k|vjYaEv_xw?_N4r2f1cq<4Xv
z#&dRfpYLzc+Ng1{2pd{|eRm)5G^J<`3o9{U+f~KqI<&nbMQgNk$K<_>W&1T=^vte;
z1w9W$O;CbYBF2-GrZM_`)>tj%$U{mGW!`AKrk2NDI}t^^?)Bd{?_$n<GDw@YK@H$q
z!tTxi`$Q+Bn>pE+kN#dHCG{0>dnrQmQ^BY4;7GL@zT5X~9_W_Y9zM#vwtsGxjvKdI
zDBAsVmD5kz=HZ;*D#d>DfnaU`;HZT2izKZUP-I=QdT7glV_kXS<&JyhRjG-hD;yfd
zx5p}i_nHfOg`vNtY;1vEMejJqP+5<pEyU2X2Xr}(z<+-sRJuCQnx3J`HY4Iq9uyR`
zIGph0@_$&xKMqTSLOze>v4P7VmwpO6C5KlHW#40(gzwFvt+IWyVU>b$FCVw|-7OOK
ziucNL8Q1eRF7JyPf4&X&hmIuP<GHd77a9<_#OPO&6{<+1$HWZO6B)hF&uaK|U-HtA
z93bF_?l_aPtrj_@7h(G_Q<e4Kb-OGS1~@mvN*FPj?LNL7oA-`kk9-ZtcxdCfiLUiq
zQTrXY5Q2*aGE?IOq%(Xm6+@~2!CXzjJDo8)204&;bQL3<>&p7<G|8!KmEzUi$B4I<
z$oguVEVcARXVZrMJu(y^xNztCjp=f?HlC#3P|jZ2oK$-(OLM~qKMGl_jb2Py!o!O0
z>eX4A;J(XuC3vdJM^A4&{80JoeRIU8zXmg{gLU>7i@I!M4G9ye=b4;02_1(qwzng)
zR_!Q0NtacPQzj4_CMf~XC$!^g(p4oG_biN@qJ{2%W7l7)mI8La<u>(m&ENSojN{cp
zrtVmU&O^Elw=n4E5v%;mLW?q&c}Mj)u2Lp+aAx{J59QD~<uu(-ruTX@-xDQ?rD!WU
zhkA=)Zl)`<>O;0#s&NNvpy$czPE;?P<}IB?FOjz2eNheRV$Y*kuY91;E;bvEZ3Y>x
z043fAz;IpKpCx0jQCyC75nxFqr6Rsy9Ugokhh6TxV%6f*U2Om@weW-9?i%V(Bbd@i
zzgTqh%{oY1`2QOGpQA{4L~+>Ht4El{^->41qC8W1VuGK0p!ujVy&&%Qi&eEvlGuS2
zq#e)<?=J&%cva<zv8z>Q!GwBJOW!R%-*#)<WN$WSR`hA*iNd+IUJJXyaI(_!a?qZk
zPvuONrLLT&tUSw0aL?fJ*IdE0*epcEH8LIgtvET+O%rzuph-ZBwu?PdCG>z#Q528=
zTj&g~u}bp63ZfSJkz#oN|DY{bKVQQdi{MCq7Fl;*^%4rC;28#efxZC>Gh1WD{H-YP
zoL?m&o*WvY01C!plg#QTO}<$f63uw_@sHa~i{&p$RNsO8YLFAQ4Dv=*=HZCDkLXOg
z8xGE{wrd>J<{HqYQ%hv|fpzgJJ1jz1IJ^o?)=yREINS#!2ah!^V~eL>St4%Ee>=Bi
z!%L&rF%=u|0W=DGO#)RMXpqRu6C%G#TrEJ1V{5T#T7{I_-MZ*=tkAV8^b3Z@y2Ek2
zwTst$_N{Swu0R}}^yMzKdpWl7b<etSJuFYTa=kC^b^pL+a}CON4qo+Op*Kx9_P)6T
zCpMCEp7Yy-p5y1#uO4&L^hzCHx@XJaYT!un^DnXKlExZI0E?1c9*teFJUbBxu%$j=
zm@W!9VXU*}&`$0W(E7sWZ8nXtp>l)wBC5)f?+vttkyUY2UPq(M15_2BUp0QaBfq!l
zguRga|6yCh7Sj#eTpE5}Ogl<i)hU_cXkhfmX9!i%HrM~-FhqW)$hq6BP?cyziKnLe
zq1lF_;dTg#xku6TMwL@eC?(yr$MI6XZ9bkJ>TXdQ6Go--W^RE%ch{y-e(a~g5|#KD
z%l8>RI9EQBn?g#lTb8ft19IgL{m$DcIOe|CKci-`WbnQr%X`|MowhK?);21u1E@H_
zG;SlMD@$-bM4dPcWnj!UCzny_-101`(zc|0&Qgv<<Zh|BUwv5#<?`Cha&T{~$!W#-
z_gk=B4;{ZUFMJYmUTuaN;{sp_Jvtn`)oUz%nxff2P$W;XPNsE}k|u1qV%P&^jVktj
zu%lZq7fz8>hs32YtSeo;q78qpyniR3Yb@l`12cGU>8xUPA|=3y)~;@@J+`TCkU_{m
zDm3hUSZ4V{3C?oFViz;nO?Fc>9TVYa49%cgPpc&FlMlaejinMM;yChv%INg?$KkyH
zU33?t?mAkx;o%asoyL$biLvH-VA@8eB#qcuTfP7a{WVEwgEdJQcAK(zJGzgZ=*i_!
zTDX3v#-6h;l{f_pVdUld%Ju4=oK3b8j5_%qfvQjU;&!#$Lv2(^x&CjJ0a!)(j|vWr
z{`c1#o(I|rA22i<WG4Wi4n-NO9NM?2f#fE`K=B3yL_8HJ<MtlgD*;d@xUZ-&rh%^j
z&1Ig_q`N>j&I~Up{=Y2#so1-i@ayCPsN?SR&a29NiRd_kHan-ueFd=NE*FgqjZ%S9
zDNT><yXvL;NkorLFQ1c!HIVy~e@Va)kITR(mJX$#u;HjTC~Qhllm6{iS%`H<vWLp;
zzaNNL29e`!F2td_k>p5-Mve7-v$$yg?b7>h_u9qWBjREw^BvliEhqw`H&CJ)fuRB6
zOgmVZ<>5tghBmWLVhk7DC^2{F#fXg^<W~x-Z}(iv@|h|Bdbf~{xpC0Aya?Ulu6R8`
zCd+fsdO;{u>C6h6xlREFSR$Xx7AS3~nZx2`73CH);V$EC9`z3wFI@eX+Bog2Uzs;g
z6^|t1oO+P$U39kZw6gqXX<sj1TonEc)DAZ<%#`ILSKY~ZHG9@%3T<>Sax|+Z{hn^P
z`43(kc;<>x+ij_tGU6i#`%&+$m8wW07k-)}WJ&vhF$M?ENkMPVG!$lTx99ru4i)vP
z5}Pv{Yos{qSMS<U51K$BquAXd%z>?T1tAwpuIy<@J~yJGnmOX8S0-2C28<3&LFO`E
z@@>7pp?~|r^81ZIT~AK>MBeM@Xz!`dgkMe==|q14)#!d=i+r8z|IQ`G*!P#<Z&<PY
zLFpiRv^Hv(JXT}3>Az?Zid&CMi9GvxQSxhwIVI+scthooIs;o<;EAn$T5neoj@0dh
zw{Vk-Ry-)+uy6}FwsyLZH_Plg$RvxX95?Z!#|?=ZvCjrN5iJW<TyLR`<+9)R^rdT-
z_?JYNF!!SXRLAbel2(F{S6sq!65g^kGKYTir^BN%fT^_yP)MwTVP)Rq<Ug)<ki8zR
zKqe4YfNNq1@Mpv4@T9T;B*OLmXR{rP|H7YOk;zbN-+fS9#p)2<{Fo*7-Pb4|`CWy>
zq1W+|6c4I2X#P&LtMh(%%jYJ@0^V>js&D%9s_G5Hg8+P-LV58{P&7G#4>+CH%G@aJ
za)+QI0>;hPK?#UFXv#@lHI!dABttqW`1&9t)p7Ij$>5dJ-ePp*GqaYxkrK}vjq?!C
zV*HCS`Hoc?ksp#9k#rqH4=g`|5W7A1J$?!PR7-Tt-#jiI6+ZPoUf_&AuJkO?RK)o&
z08WEZiSzy~B_m&q*tA@OcFvPoIJCqo#=E&ma-`dPhL-hiU)y$!O=q_Qlq@+eTEj3E
zGu<)xNs;`cb{VK2?I4nPuzoyzN7@T2Z4;-Yj{bNXczQ&s1n&f_RYoAI9iiQ;$C=x$
zdbC`?0wN+Cr4<B((BxZtdQMi6yRhiLN1Q$cj0EnKh)x@x^?qHv9)HFBW2HWUOrKfp
z;7l>)4O0I@Ua|~Ar^Hz{2;MmJ7I_&|?J8bWZkX`-;xo1@u7v%<MFF;@A9xX{qsJIb
z4xi+hV%-uV|7>vC|A2{eMk&=?Q1rDKZt%J8lnxBa4d+U=3QwuRz?ucMKp$UA#|cdW
zsi=ZOUg|_H1{yc3Pgmh>)%=`XO6X3@0gb|$(tO3M4_>3<;8W?7Ltn|(pUY2kmf$bh
zUv}Jk77gqu&G2awtvp+E{T|y(re}_W`Fb2IU*&h6cQ{zSn7BQk_DyN{I&<}Ly=OsC
z`4jR|mBa{Btrdprw7f-_LnQcx<&hj|-JrU^#lGTnOyr_x_fLd2(cBbR`<66W-jz$P
z`-lyS-}EU3JKd8C11wcTB?_R{o>Z-$?|nZW$!?u4&9H0ft(Ea;ceu#$2hsmio%sgB
z+dzJri`;_ECZW9KR_q{?*8?!NFiXju<;KwF-Qyb9)ZnGi$VFcta<7Szg4Z9?8sp^O
z?X(uSgpI4IqoBV*HdpYlO`a#gFA4KLru(<$>D-2e(_OUABPTu}K(=!hUw8DIoe*1s
zFtbqY%-yN0RrQwBLjNET>oLaK^8<1?hrY#fYN~TlW-~tDwSUY{YuEA6q4HjCJuH3^
zn@V4<74%KAzJIZ1g{09a>Mz@m&XlnwO7%*h=Wl(kK(2Hv-|XW%ISrTL{KG<!lcVIP
z1fBNKmtM1g?|TP0^+v^9*uUE`NXq$MZT+zBd)<(sEo;H5ZJlJ~-_FXPpX()DvN4kS
z3xSx?Z>Oyu<e=*qK_w^>dFE98Ihc~sVSxa0&hLx|#z~VVwA@KvR4S6M(rBq>L=u=)
z17{S>kPK$EvN{W@Gj1zAn|-NhqMfkUt0<y*v|_*v2nz`_a50AI7(K@RoD!0%Y+~cA
zCtC;kVo=e9mI_be_4v(@y6eLhCvu}Y3U-%?I_C=i{t^ze_lXIMPRF6}y^hBEoqoYj
ztMvqf1x2XwzdbXvKeOHGg7R}CC5Shj3FWIQQWk<JE%GXy=z=Eqvb0|5W{D2tWT85P
zlGa%@ck3U~MIiSZ=lvzE_=SDd2na)vm<=&ssnC5v@uc^G>+hk8G5*V9VN41~4S2x7
zvtZ`Gp~bET<}SYJKHWc3GPq#x#ko()9ed(-Tpn~`hL3CSvVX6z{*tiJCG}^1_|M*w
zSOmv;S7la5by-4OM%z%@1!uS$$$NG=7NZ6%e@D)D^C=YkiRR)2jl+rOL0v$M^rky>
zqKHBwQt+e-Q3${9TpL8x!~qnT>mG~oHCtEL)}|^A*Y>#j5->&}toi%#^}55rUCz+u
z>kH0Zt6_wHP7r0|gQp9h7qf_W?{n(;jPS>~cJ5y}*xrP`>5jXoIXBo+`p23v{A|;K
z*-o`?mh<&;XT(&br#Jb;=x57Fh~S<SjHqhHzGcnJWui&Mdw_dIH$5MNVV5EGpiBsX
z@iA!3o8T>9Eck`!?~`AHL3-OpiLg>poj(d%Bpk{7;QjeUiIJ`*AMI7=k)k}DpZ9qU
z4h0FYE6?46y{0Ik(3D5sQuX!jZJeAHi_G72!{;%sND_Eo7k{4^sl7&hGS(8{Qd?V=
zA#>*6O6=svXBb@A{n2yP^^IFK6_RRj*ndcZxum<uU7tGsT6}(BND}z|_vnE;!kx8t
zEy4si#o?MQxCRA5=G7h{*BfQOrycs#V5&?d_9Eu*Xwy@jNr*p^XoOaNlWEWpo<PaU
zWUjT<uX>JKKrGkcDImmyG7&GsytC)&ps5Yrjj~VBr+xBQccOn*J1$HvsK~ug2>6qi
z$+Z~lV>YL{eydpFAS{i2G^gUZpltKb7muQhhu`&Me>w+~-(sbnZC)naV(W}ez^ofi
zNjL@&zp>YV*FDw|d}!sigw47wbgix6q>9ucv&@q{p?Fg~&poPEu2;J`2jh>lcUX%7
z^&%VzYtt1sEAbKTI==*3;$=gP5IJ%YxTZ~?WJvGS=J8kM!~hs=v0nl7=?_a>mrcvn
zF|w&%TuRWshnL11#&aU^Yl}9nTdjXv4Wrq%LCtFphM8kTG^OU|{}leaLLdZ&;cuYR
zDt6$TZpXWpi-zW<S5YiL0s-M3kUv=8HR}%bS1R*!qDmDC*<j52@9YG2z)Mt1ejYU7
zEbddhoa;q;ha%kLzN~^{JJHW<JxyJ`-cJlw*|MnG$YTlYVar<BG|SfD)aZrcb$Aa!
z*EhhnD01pZ^yGN+@0KI|8ohgC@wdpiIn=V|KdTFZcY^J5MnVNQv1_ovZ*|Y`d)v<Z
zOZ42c3O%#QbJLZszIWvNKQD@LJLz4;OW^(ZBulCvQMLm5074Z;25pM&rlC6XJ>#h_
zh}U#3#>>F+yz0ivak*<QULEQ={qO@cg=cK@ljm*puy>RmXCuhMJAl;y2J@<t!={GU
zsVki|eIOVa`!~7u$(8tupLEB@jW8uK3#pzqjU4Snco)D@`f42<0}P@Vq@=zd^DxF}
zlv!J{);=c*#5Lj*1Z=r*#^h!LPvdYU9rPde$AEt5pX<@K2_Jd)^rY&f0aU@V36Pr%
z*z@h8%KDm{b&ZW%D=7L|Pah8#G1&p03sJng=>&o>h3@{jq3t_=PyOax;di4=PZVI4
zqAGQW(~X0!si*d9z0g<tzIIW4BjFS8ZgV3Wc4l(x`&Ht9d2G$&y2MCh%un~VQX=FD
z%CW1C$Z_YJMb-{SW!FYT()vaA0gU*vMS8OrVKpUK1RmkoD#l2{C7h5HJ+|OJE!8=v
zL%-O|mfo$zEwv$Tj!;e;&sTbUguu^dRdMj_+J5w2U!BgTlx+LPAUH9-qM{i2P|j%(
zGr92dg^b_I&YABw2w**E>c)m^%g)WO{`VyDnLh4orsPc4&%OG1D7k+9gZHI9;gpHF
z&p~GhWe$_P-k;|wvOugV^cGrn%t$6?&6n4Xz19~PL|s;mX`1gQms=yN>Lco?!5a2W
zBs*%V<29c?2dp|lE}2&VM-uomcD)ko4}#z=AQ_+~X`2)!*r(7psMlOR*KFP!tK77C
z+SmWs6}!;vnv#n8xESUGKd=sH4BeV{#u|L@*&J~&Zr13!E+PTDh~(d#HN4}vd>3pe
z#iP}XbMqmoZ5ehRw7|*B_&S05bE9@dqth~t)#t9Mk~@$QpfCrs=|RIq4Rxz*h~|<>
ziy)W0gQr?cZ>eYZd*X9V_(`_n7CbxKd_F#<9yF#zP#5rc8qZgS?;uk){ZAYh%3-ho
zwGHM`RP4qfyK?wf?<)OAIL-2bkuedACN(LN9sW@A`?d|<OX|0HN>7CO%$w)DpY#rv
zbJ@sxZu=iGjxFr|o|D(n(OF%w@5sw<9?!e2WRm-VBDT<fd=LbsmCQS{rlmULpL=kS
zd_8o7Nw;O!(A|CPoqO8UeFeGgY{k!Iy(CZ5YvL<)!=|B+doi9kWw{?)+k71*Am;Y(
ziRi+g4J!$=d<C55il-$xzFe?iRtudfsrIg86NebHu{R7D`0ujYBoT}gyn3f7jf3li
z2KAXOjo9MPCV6x8IECxN6tT!c=vmn*&jK1v!G-PEy=y=CrUUmV#u%x+%$wkLYN}vb
zJ-3c8<6of!lChIisqN$>v~ksQpD)qHt11=xwIr<{9qr<67H$w^K;yAhI&kT*!M2+H
zSj`XS4DV@#>G|%%vGyC*pH`Wl8Vxl^al(XNoI#t06b{=_g%<B$E1z$q%{j~M(H#^@
zYVsS@33Ir()!}!nC<hhPK9piB@%~Oj0>17aP0nXBxa?h?DKL=M4L+aVuTgR;ioQ;@
zeZ=%s>X((rcqGv*QO&DY)k-yCzFYt+V}V5S%+|v^#~mPy6%NA)LNCC(H`8l;LZE)y
z+73mzFy#HfAI3OW1IA~FM$KUdO&GP{t&_dYS53>#!gp`rjVNzd0#PcdEdK0YhuO{>
zL*v27l`dLiwwC&Oggwa{d^YWKgWQ0e*CZyaL|jE_Lw%pQY#G}9$hC{t`o3~vauGq@
z+K7rFy=fHGrt_MmT(y(e`}+GUcrobyp?b%op2yFQ)Q8nJs~%#Z6U-V5@>k10XA&zZ
zBNlGaQcD_1>Lqx#+&GCmB<_8C(R9c6*<9j|UFp+DXNT7nMn;xg752gvelZkDej)jo
z^~SoyIF3eM!dUv(=Qbex*u8BnQ-QBzy}bk2HjmHm0Vf{<pXx}DXs7&~uXq8VDy4~i
zwq9OupbfV}Zf-JJSD)%1-wRWFA-}6@#W7fH^xC%Ytg8Tb8o3!3k7k@RJaLdNb51>a
zi6x>T1tx)``po_-<ubg>M3f&_$vrHOvL%CS@QS35qjt}FF)K&$Z=cg5$ZUp-obf+$
zL;1CDe)9=+pPV1CLA`mLzLMOY*q@E4VqlG8-!Hu1m;$lC%A28f#*|r0R9ISz2!cGO
znn@AuF*Wu+&J}PpT6uC(;)NU80Pp83CZQ?mBrxAepFKXI$%kBdxYPVylvv)H7M4gW
zb0bcetJ#qS%PF+8{N0yzNiU@8&S;t?B>**3&oc01KtgsAR5>*=!s!F5atNB&qx$EL
z_k_>9)P+N{wfDv5INv6bm|q(Ed8{cR>5U;M!by29k`wtm1wm?%;p{EX?+uNhYW<@g
zGp#9|=|~IX;oNA#W%>P%&ToZzzVg}}()B#{aY+U}1nGH?+gKILa-L+ROfIbW;=blB
znRI4Y9hNlt+7-$-&<<ZjHx=Q88(QCI@6^lAS~ylc!sq^uWHWP@;#4?%NP-A`E~qWy
z6gMS320R42{5ia(ZRbq7fldSudy-o#F>|ZO=)1srf>;E!zMq<ETfI!2SZ0`Sn__{Q
zPMew<`eOUho2GcRF2#j_7=RzldrI}1QfTBdc{sVauaHE!2iG~9_m@3UMJW1J$raXE
z#!|&malSv>-VON8pa@8m+}}rc{=xJj7M*<Rt#8$7Nq(y0HsiuOZ$?<M9qE!98%}HW
zW0}x<Po?KZA`lYa)Q1txbK|i-Bseh5K>L@84GUX6<*8V|3&-B6ukBxQ*E0XJ!XR|i
zb95vxV{{(}$Y1`Z?Mr#7$$84l(;KK>+m<{ch%s;XSa%gLgtoZ!ey6;EtNb{DXICZA
zxw7VGQ+NEip&`4Dxr9x;p!p6VHILI7gR<M%TD<SwRa)w5+GI@!jOd*GRVRj?OvI%A
z#$Z?=MrdCTOfRz{5<oqZ@^oQ8Ru)^CRkm9UP#B|xv!tMRy4Ll)aB|P2gp)1J4nOs$
z&~bNpLB!;q3^}mKt)U4?0$iDXJ}X0e#m}m{5?3G`s3#Jlp34_L27L!#g4IXaO4zyC
z-bO-1Q_|<+zD$>e@Aw}XNbyXTmBv7RcX$3C8ZTg9MLbFiqH+_FM`tskMG3aRu_Z*|
z2PEY#7eflTrD}xwme~GlbprZ3^p=}R$u{gbK8#$F_xm?oh_i4&@hz*KH*jTDUy6go
z^=54*30U|k%Y8Umlq`4T;MxpIf4{H(WliZj$Te_ufkzw<#XH36;6~gu&OR7&#5rZG
z=9;@SxE`v$GMsvA%v(#gS+~>R*a4wOiyUGx<e}N+it-qDpnnO6udG*Yp{*UxK}ac{
zn#zJLsd3)79B;bh{%0+6<iN$VJ9I+s*78HxLht(9N6G$E2!DeKW?LAd`0Tmmqd0gX
z%%`IaI=SDSAmsiG)=4N-QT*L^K5Eaa^LTso4jzAXt74~I_;298a#9heMz@*>c#|;q
zr@0ZETfS^y&SHPo)M@xqbo0Yq;GJ0P5?B%d?WCFU>z#$IqRx6~sG4rR`rPyZqHWaU
z<YI*8?i8eDVw8(kK9V_m10kZLuZ#8iGudo<e={yI$CmGwJ#HgCy@2nNf5D}_nZ@{b
zr1tY>-)Z=-CdG{z^7<K$<`1(TY)0GHBbKyBIPzSwSWsm6dnFpkquDY_0?TK_?~Q1(
zpGQC-t`{c#08BN*W%C#rxElez11etKHr08OJ^539B6h+hnX7i$bIT~Zz^e)<^t7+^
z@B2+p%dIm1N@umB@BAjlk6vo7dbN;T(rOXrrY!q8H$Rg+|GBa4>?anUi~YG`Y0OWl
zo`}E05ru`51;=DazQ%#**!jpzHv@X|j^r0(UVS%ZQl!%bC>dXlxNyw}VzbXlbLp<h
z41X)>sC+z?voOy>UK7{KFnCp*-`*<;fmIdAL65tl(Q91$gP(ZHSBTVe0JvVY+m0W>
zLyA56mF}0w<$X2fnrJ)i$kf>=-u|T!>w5Mzna$al_w}~``@F+%;<g?CWA82FqKdkI
z@iT-dX`mpffOJbqE5Z=c-69~}%z!kafTXl^*U;Ueq#!kPw@7!_JtIEP@BTmkH~01Z
zT;2?`&)#dTy}sYQ);j0xIcFo-RhLI?omA0oiN<=$hEaPlyRpUKXEmE=%btIPI+?4Y
zosr7$1O@a9S?(8A@bPc;E=H}4pIYQ1jxW6r7nfWuCO9@C>XccDlBq(C9;U{>^oJEq
zP3>97h-f^dkQJIpf+i0KlkdNC|Mbb<n}X+z?nehQn(?y)t7VR*;2KuE@Qwiji(v1}
zH)wu_W4>Bxp1#yz#Cdk!f6+56m$iYhjPD4(2c*!1;2NloXDP*#0duPF=)AJHe&)$g
zU<tsD_|&IEjP>Y64weqJ`HhXG)M}MI7&O%?)hJBR&wZimTB{jb)Mh&3ySp^+;SFd%
zr$cAj%<u1hIWE5_7>W%Q?t0ZC9jr4^?B3K^Z6M$|lZm~&bBLG6TWHhWFy>&Rn&?tL
zzbj?O_k;M@K!>}-ikLSIVgB3y^J13Xn9GXAMI8pPjbqoJYTB{H<ZVo6YZ8es)u+oO
zVBg6YEzrxFZvq3;z1=YbYwvIK4{QQc`_A-h^OF>zBIU9;MZ$s%1G-<YMmn+{Q7#8g
zZ90ghkCIRxv4qd0F-E8qc#epRO$DnK&&%Q{IT`BUgzP)~BzXawrngwc@~fEHiENoB
zpT6!^8?I*!hU#5CTD}EblnssPl<?d0RK=1{=8~6=&(GJCK636R5GGH~n6}$8>0)Db
zowtknLc?JaRYDW)|1GK`oxo^VEGQKGxdyeOo}}B7#gko#g-oWk8*xLfnt8cVn8s1y
zON45(<c#IoyvpT5GA-$hoc>f-@IDvc+L8Xc3SRBKL`Hel?S~!au&F+~Uos1w(PR)B
zO>*Fhp?+#?Z&a5z>t}aJ7AXrb;O7tzFPFP$4AwZrXf<}l$G_(<D<~H~Z7{z+Qr7h*
ze4UmeZz7$$KyAT5ex(|S!otuM$=`FP*&7%=M55n$#;|Q37Itmoq+owCQq>BR7c^en
z(xq&v@bO%=S*jQt{yls8;h0xWFcU$Cn54HRCKIyDIJ{Q-@sz0JFeC!1dMKxAp(c(t
zZgD{hB1c{;5bcCk2eDA3aZhyHQltqpsBmfDtYQz()Th_C!lY;oikhakLE5>bJ*aI|
z^@xr4ZY1M#EKm`oXwNU)b~*4>8lepB5#c4sknuU4-ZIco?|LXk9^4-!>=y5%GLx~!
z<f+T|gD}(%!4#X#fBbRr*S2k>#Bi!MS-0R-wl{TShd~44RB+2KQsXd(M-XSO;!+6B
z>-dXHz8HADi9Jt>rcsUpFK^frZdf@?-mqbtexatn^+y%T>}1r(_};N)hkaLaQ}WOs
za~}&qDfDM5`TV#0w}70W)^l3+O=XHvl9rwwRZqs4)`GF>>}6l@k;D!6c&}O6x+*jX
za<S+6x;`4RcgXS{#c_2g3|EqeB=(F%rYA3b6%mgF6W3!}&($9#&lUzOLNw@$a@X5v
zs}L>k^Yaa0jz%nb510gcd)L%XGwF(}vZ8#$r#e%tT`gTR3KKq-itmq|YD7`0`3vGR
zz2>GWmj94}n9ndWDtRi4ARRxgJA&=zO&T_EOa)d%B3Mc7TXTaJ-hWqQ4LOH2*Q`s#
zk*x*}7NdEMHWNaZEvfqhLx}r&e52Y5w`)|B;>l}?=%1_c8xO0aPct<|u9H)kF0Xt4
zjycaMlwJSbs#+vuIX)#(^h%t<FZ!Dt7kBQg22HxV6TztCqF(5CS@|ib?Y2?HfYomF
z9q_>pwH#aHz8&{?>?6~wOSl_VEZo@Y?Sx(k_c@R$kCTTw>o}qVdJkwxw6*!)KQo4I
zsu%Dx!k^Uzc9i02{tSx3(<H~6c$();wCvVlwW|4fSy4LlkM_@p6G!#i*bDfQgI~XX
zCFok$OFN<Sn9Fi?%$^{O8YMZlln385=~Nd!UH(|djyJBsPQZP4c$b!qPtG?I@zg4#
zyS;RIB-=LM=z{=05S_w!oLsML>}kIFZ~_7pq1O=pSrjOdPZIDhc|)NG{aM0atnH23
zJrY$nU*b}mWHLQ}Z=;058G5GXWP@bi-ZS8S>DndoCf}2LuTv(RVCrX1V(zy(yw_Zo
zUlG<9x+{cRnYb#kY#tQ*Dy*a(StPIw#x*?M>uv`!!-Y<+yk{M1w?b?s9szoEdJdLm
zzN!a#<pxo!H8qnZks-rfTmHAFr#Ag*TK6T(7=58et7pD*iDPWrycpY3eDBOVebOi|
z+pyrq{WCb*0>a;G^>T@h9YpGnbC$YhHLPBf6fOnjFBNOQp!?AHb1k@2*=d|lBl=Sd
zF=E0D9u6gAb;;|BS1p?Y4wmfzuhEx!Pb)rBld6?T<%Q6a2X0n8W+Ecs?IMUSdGyB^
zTIPRl56$|M)bX(+Gm>I@SMsp>%R+h}6nDd=Rn>WA8jS(wUrm&Ce<I4h=Puin`sFL`
zvqpW|AW0JILYoBrgqSagh^Y&vI?tzM%P0B~v-!O61^)<|kVtf|!PkkP^Am$KVcV)$
z`6`0t8^v>nJc;Y)OFr^RG4G9g*D^4Q^<Pil``od)5HnjtJz<c@q|fDaX-aU7MfGH+
z%VmypfKa?G?U($i)99d$RS08IKnJ~QWiD&xOf~(!$_!$!%yR^>CqRbf?k9#FGA*Qg
zo##!x$hW0-aqM#44gg$^namdWo0=^473u97o8z|}$H=kZ>^sE-X-93M-7kaEy|d?|
z;@xy4mhB!UbtGEsb_aU37JlgT+ZX+mk?ngjxjDJDVm<4wIZ{2^QH>lkwIF4QX6y<6
z_PxQ%>77*qql(yC@ZwN#3k8q8X}4#RO^%o<H)++T{@VPQX0P%oam8gx>Qi9H<;#OI
zu_ne%eBLgn@-<VIyvsLz!*^RtHt1uzEN<0FLU9r|2WT{1KRNolEY+S0HOW}G>`>Ok
zJXX;&<12XiY`<!~OeK{h+K<WAbKYht)(%g3JH7gR{d;wtdsbJ%t_yD^{$e{bt1(z~
z=uNHohl`P@rBXDkbv|Xfqqp5~=B~dvrXPK0I-QV!yIWp|zt?=Q>r72uod>Zl^U+vG
z-8}SaY!o}gCduh(NzC!~xl$^2`?N}MJgM%11;QZCphm?!AiH5e)=uDLv`&Ri$>s##
zFPpTo+q1Uq9$kXq<ElQD@fRVgMdl>Y*OpFX(;)9;nIqOoPBokk+CpNkEltMf$(bIP
zY8^$Za&$fWnz5p(+9Ec!cQ<rHOMKIyZ(mVJNsOj^X+}4fenGcttc)c}xoUbyayqA1
zf;_X!oO&@=uI<rwM0LrzN!PuWYS(b(VJ6->-WeBF5*6-vyt3-du@qHIpeV}u_Hybt
z-&olBQWm)q++UvJeMeTJy~s>h*FgCqjlJXZm?fo2HU502T{T%j-#uy}$13J6GsV*I
zpgIQP-(Id8Rv7_PxxMYfR<ne>)78Js5YG>JFW?cO$_*FC#Y|BCMSi7WEw`456Pt3x
z6xp^X=YvE>z&X7WqPwY)DPyhey<a^Z7U=D29qBYZ#@0<fQ^MIqz2%f}_H(?m++4r+
zm^~EkqV^tEq#`)=Vw)H9`PLe(^jA_A3F`%F_c{eKr`+c{9Q7}k^GLHuECf7<XZ$6n
zC?<^~s#Ur2Wh%C74L-+@kj~`pk>j%oP=#||7XyGETSQ}mpwMXJoYiwR__y8%chlF#
z9(Uo#_QR?cn*+fU#|PZq=ZDz?>{TtxvceaN9x(E=FvGgb`E8}Unork@Y?d6{louz`
za}K5?hDaK#OB(l`YRwY5`r0U>qwLm|bGfYx5Go;USq4+%whmKQL3i;0XR&Xk%9*sM
zZ>I1c5RmrjE;VFN=Lj4fFIYosl)zVmoa=o^*tYGU?g}ZRC7Y<!Ql;Q5uqa@9Tn9c1
zy24>wczWznZ3BD3A4Z4l>!yLYwar|M5^m-QMlF@b-O)9?KCTT}L{K);8_{ym79*rw
zO|obn-2KS!R*2)Wf99?!BNaKYbBnVrN|drVZsTo-w8*1J-qjuz)Qb*&g5f@TPLYQp
z_6|qPa?#p3szd}oE4%!|aYym&PY{1Pn=4GFCBE2MJ(6DkEM6%2TB*W(@yAD{TGEI?
z6*ZgAWm*Cr!TZ`%TfD2}_;*zLSVC&7>`vP35<7Za7XiSAZ~*^{K&Ej!V~l`hyE(mp
z*3p@s?~{p!X7t%DKE7Ym&FN(2h%hyl;Vya6Ve!x`%CJypnCl-s@gZyJpB14adfHa0
znC*vA-EC3NvL@5?Da->Vi|vYYu}B_`?-VpG^2-@N^Q*{363<REwV%i}wBD=Y^UXz=
zrO99dHuUE3@+yRkp4i=vo{;L(p{SO=$nCs&#bbeqn6(ZLOBhK7lvl8qi>QRz)o3^D
zVdpTcyf}bJ$?=(R_Z3mqcSBuj@x?u=&n<l|_;;xFtfvC(5Km>M^LN9oi3P~)&TS57
zbtDkK%jT^uF;v3@&;T3ed$R@aJASo{uI$IYSy}T}UDw=PZD=-l<rFcW3WE|-gvr{!
zcW0VCtiC---2pFRPH)KZ-}Kheb^W+7Oj4EJ{znlEUGtVhFA+JswM};UcGY3e)9|55
zmw69VEqtmQFRNB9EvF~uZa)F)y*1FJ5~6h@2=3_h?dq@zyy16~;BC*xXMU|N7uAsx
zW#%{SX)Z%y!kMRiuEt|;TmilJHOgg*M~aw+3L8f~X3_^QDJ?8~;7TaaJ{?CZVaC>B
zacukY!&evUAhwPmMv;~hZM=}qTzfym030vvOj+)ykAWTEMN$l8dE9AgbF8Fa6nVJB
zg5GJP1$0~Erwe#zw?MnXB8v2*i8z06zRkmIjC4TiI(_KLbVc=jsTy6gT55#B?0TDm
z1($33rI9@vuU~FR*%V)pb_q;h2S0cPlKrb~*kFo_k4xU2X~WJ49hlKLz?sA|peaiu
z2TKC#4>TTdD)ceedBw{Ru>t|NAp};$LF2GyYsBm2`QW?_y0)$lz1z`BOG=UN5~^63
zJcM0b=Ub}2SX)<HJ8rV8*H4#V5A)G4x9dH`&*fF&{aqm+#R~PEOD6+%+8>PjHONq{
zlef_p`GJq4n)d+jH>mPY?V5JkIa=_|8%!=2IKW7fK2VOhpYHvjHR==NV`b%C{N1)m
zFO$Xw3xoTT%wNuyDRQ|yR*}fH7SEYa9U`SAMUZk&vg7jw^BRi1Si7W^<)3<2jSbA`
zNE7F6z+Mk?z?gWqe^r{ieXUt=f&aYANvOLkI|!dA!GqD)kNJZ$<HA>k`;O~67GL{6
zbtC8$V^8RewYxsilc<=iSVT$un(ex64Q@VQj<T_F)OO1?X<yIXy&qWDFQJOR=n`X|
z_c{as>M?PDa75rN8;g!k93ASseW9Y~gx=j?ufOZxQg%O(cu+0d3cZiFC;rrK9^0Ox
ztnPbe3=M@*nh-0K_S7AbzN<)<vqa4z=9tS2@#U-&mf2}Oe+{wZmcx(Kp}gZ$rMf}W
zBVmj^y!m$224Q93)kGWqXPuKycaVFx$BUnr1&Y7XJXL#3wl!9<9Kz9S{(`F@<dxvN
zCLIabvd0JHF=i(2Zr9WLuaW-ytb{9?x(Vk=?KPGbV{@D13YOojr}*(@1VdZ19GTtm
zN9AlaTx`#+#&+@WzbNa!Zs4eTh%d#<+;ptxQlHd>2kub$#HYufxo8m8@n#x7w6u%t
zwS52K>+q)@x?)n`&z8z-#V+=UM|vixE%(zXR~|X3l4$byE#no?-X~JhdmVPqY}JI7
zID1zNydiCr!((mSDjB4_JThw^`;yu{w^4$$9UoeF9R<GlB2Aec72BCQFIp-HTV=`f
zqFlx#%9GsJBtGQdVl6xHw^%m#Ko+O(p&}h>D4?fjxi8E}8k4Fcx);?cHjM4M>f4?h
zLsCQG;bMPZoAkF;b;@+WyY#pPO`AyJVV7!yB$CiDMuJ=t{0_t*2C&0(&mlF!gF$e=
zCnTXycT6wkwPuvSa-D@o$4hHxTqlz{FT(DNlO>u-b&kr(>Ch6tVe$DX!$~oP-mZS|
zvM2R!I$5`|#+UDh9~V=uA5@-rbo#z0J=>d=<K}x5__@=!V?nxgUQLU9vv2<JiW>k<
zE|-k=G+6r()GH3ULiHvUjQpj>#?erskUv_RlgJit3YO#N6jd1xQGO|Mr5As;pjkA&
znbQ_wjQFQ(LkU5OY;w|%RP)cQ@_Fzb5~SY^xfaeV-LjMAg?C-jCg+e;T|4?2O3R>s
z2fV6ci61;XEoO_V`zb&=jo(*FA|GYJ_>;4IQGplZeA-^0gYpO?Vk^N_<=qCpZ;S_t
z)>DhQJt?{?##-f$a8Fm6G~B~2Um9g{W<&fcQ{VDjxaA`!0Y_@JYc~X9_6n!xwv*Tq
zpm-N>w&=W@Ct1>kmC#z)_uk$Fe(20>pjKzx&lusDX*Jxo$j*5$eXm+ocYo2py0m0k
znY5u4KRWSC*E^$z;^K)kPjfz!(q$)|_8jv911DZ1Ps8dXb$Q#3*AlAvLC4clnk1vF
zQRO*1ZIHPF+6mPbTWeTXx7;cGap}b4R<Yx*n8O{*pYM((b%_Z2s!DV7B2s;pw>qR)
z-JMjw5KMSp6?BBrq@_J&K~O7(=vj>Y_Qh4+l*vh5BEb*zEdBA+9pPc+R>@$Q5hT$R
z@^=eKD12&peL)H>+P=;(8V+8qPACn}8usX2?J}?FglbS24^u-6ORqW$zEAw*XW33j
zN=QhEUZa9@$stUqq=)^<?Y?{uPHd{JQA9)NfXIjrr|H<nnKj(|Ssfc(_l#`-B)IlK
zkr%fxuaf|?$11Ow<0K9_GMMa039d0I&8Ku)y&R^f=Dsx2QDWngOqLgsl;lMG*n-<P
ziqpVc(r=Ajb&*}waO`2I3pD~y_hRxf5g!eqQ&z7tH;)1?;EeT^`5A-IuQ}a)fjxLf
z-0Z#al7Wh@x8c7AgYou<@cWEMQ}XmancfL6{i<|-k4k!=CnzC_^Lyv3MRxfX3Flho
z3vsTfe4EzKyZ$`C@;q0AvaOdChVLqVwg#HDd&-ZJLP7&ng(*w(sd^ce9S_|)o=}`h
zj=Y>M{+0d#CNqi&TfT@69+=>>V*FHpuL%0H|5=mRwtP)Rsw-)d57R?G%fL|Hc88R%
zZakJ3v<xq(Vu>BdfEm0g(yFTcC51C`E%?%>EqIV-&0<LzDV>Q^p7Tbaqa^b?EA8c%
zFZGE8?_<68EzW<m8vp02prW0<VT^`k_-^QvDSBSF1jhHaGT#;DY{z=5#}_yijhn1E
z{Oh6&Z~wUk)L$;Cf1i01`-79<aAz|lHVJo%)pfZpF5SXn*@M4$grf2t-QGPX)3!6d
z06)*#iKgUqZv1C0?2d-3*JjKh1MSrXKN;3NB6BcP!F$+2_^?Bbfs1bmyfF2orj(~G
zrjG=Q%xp>66Mr9mz%X56W!!yN_C>okMR&<jr_669&#{9-voE0%pPwPc#dU&|jQ#{9
z!#d0R?+!@H*E9KvlN^y9CRVs1tOkQCEL-mCJk|)TMIQ#doP4B`Ow(ny<iCTDf(^N%
z+6WPUjGTUqO<<#CT&z098WWpmt(*s&Nj|bR37ra8C&dmbBx>M&hOUzN67~d-u_tqH
zU}0K=Xgi|gKG%J4TN+|bYHj~pPMn#9>i9(q6_%HipJnsp#LJKs>rBTt-0r%s#;m@l
zpDx4ybVjD<M{h5uSnGWZZ&w{9h@BK-q(ZKTMTWgp*f_|0@z}srLu5k~X873202aw;
zEOxOY{4sBG!G2%<cdl;$bq24tcOelUSSS}NOi$(t0w%d+3>4hhc9YP8cXCcG<xwsa
z!Yy2HHo7LD-2LfM%h>iylra-DOSB})StMA<RDRpMXH~5+sU)j`Cj3#4NMFcT?AReV
z6{5OImKUoP`%{U5o!<NUq($J%=R%-~0|m;pYObH)pNuIgI<Ay>G1nX4J_z-3UI^t+
zOX}PSyA3aLXJE33K9nA`*IyVsewV-~&PHPEv1ubXO{jj|ZdkHwzFGAUnA0^x*qF~g
z%iqgo>R?uKTp=w_@Ak!A>&md^DwLiE&rY6VBd-S4MqXmKrLy`Ny-%gMD<b(}?{&ce
z_q&iT#$aokjSPEBXu3HE4?;T9Whp4q#c*(&1pse5_X1yB#y-?(;3vck%9FN&_nb?Y
zN~-jQ_FsyW1BwJf<#YWD53JI734ia*y*+5|x!tE_*z{&r>(*A|av-=vZ`n6~LC^AH
z1kLaF!qIH&OTn-BfU{F<SNlr_0XNO34wq@h!@PoSRf5n0_(2e~_V;;s=hmSgKV_ro
zy}oOoYaioNvIl_)^_#&AvK&FXlM`v2<6|t9CqKG^H7*7}?~;5WjWFlXY2#uA>M6gq
zF;TzTgB`w+2`yQ(UHt?9Q1xv+Wy_k3tqP4MkDvf2njbA{<_PI<M~q6z1V4Hr7Q5|_
zcsnxj^on{5FXw6DJ@8&h=U#gbsf&pl^1=2lX@Dc>gf}ir@u59uAECNT$K;`#2+FJF
zI;(HzLr7`CgL|wF>gOefibgbN8nmRa;*ptwwnk*E7QWnx#{lk~?+>->;}%K}c|#BJ
zh6hbmYWlluXiFi$w&3IU+-=q!(PQMA@L&7RP;0E;r*tKPKaRiRd|Zg#j`^+1Q&Ru4
ze99;*^h7+@Jw9G*E03sAUnV%mr+(t=<Eh(O6Va9k@m7)m4!v{<W?7+kcH*BPzzmEN
zL$UTy$?jLV33rSjQ|zFw<Y?EUwTnB`l%w#&ADBi(I=&Of>(U1D-|k9sFBIgs(TzS=
zVXZHGT&s+DJdp|R49z7CJjv{N%_|ru&fOyW^axC3mqsK>9x!2EG6(LiXZ_|SEEB0j
z7>k+>CaV-?ZbR4^BNS&7`mADFU36beH>|#93SE1*jF0JBD1ClEq#(w?D`?T`$#lWX
z@+o>#1aRKYagYA95EBwbK5>*4rP+ZKUmnmq44)y0oQdKIJUWtA`=WwXBd9_9;Tqkw
z1dn1f_mcZN{klhZq8<@%ZPom5UrZINnR6W8PEyyaNk2HyeBQz}LZ+OdRj_%h_kGDE
z$9{Y7s|>?=KS6W$G=yKU&QHznm&~t_=o~L4F~@N#b{<b&?ulf--`E@$Wn}Y!kK_fD
zWs!6R$EEA}+NBq%52MWkUdMq31%}<BX7WDvttnBmT0Q2IT?8MP&sMEfL+V$<2pnCT
zJ0?0Bt0@bqujVgv<d2}F)J()pUmNR$Usni3lj3L+Ca)BpFh9CBN`JP7$IwwJ9fLg%
z%8lsk#lvxqQxU3F6}Hk~NgnMII}(Jq9u-H0GNT`5;0}-&1+TpeI)A)-y}8Dq!Ndvg
zKCuc?VtMqePa%}2#&*osiwAL`v=PSvR)l)@!`64bt5qWnYZvuS-GtdRH*j8{8N*MD
zjT<c#e`iLN*JWF*)VXqe=9W9`TG{+9lqHnQVYH@J5WI;@Wz4F6ozp=d6*Aw8unkgN
z1Ay%p=ErhW6q#G}$6Z!!h9moTmvL3r{Awx8cuz703voB4A6WE>G{%Ta5z^HO=c(oe
zB_wyXg(oH|us#SP3_fTzDLb9GTc|>2@1*V-f0qF85`Faz$#$G=Ca9_^@ZO_cOrpSE
zwm%yN(`SEkTk}$b>GjC$<avQjU)dYjLFL4}D&Oxk(tUQ``k79is1sp}65k*dNV9A2
z3E_ccxU-ks-eEN})><4ir$aDlaLrX^#Z8?J=gRk^<=gD~nJ)>B4}+>{SQ~Q1yV|LQ
z>@=tR)5M^5)TSBNk2vHp0fpSYHbK?GFq-Eg%8KD*&{;#`;i#_khm=YlOB>31-Nn7i
z9&gHjB!+KDtNtX$4rV0Z*RuW9HvP>vu_+-VAWh6OrXLUR`sn+#aui+9bxD0~pAYh|
zMH;8+R)tj*)HOhxq4;?ro&<zSxU;vgiPQUbV%S#X7xAXzlIP~W>%N7S&Q9j^yn6|S
zs-!h%yazh~AR5~h_-$}HfTcR^2^G0v+Ll}DuG&-b$){uj7Hd!WImaHZ!^9sEXA#3Z
zq+4vd!<`>DCwA~f4J&iXMkP5nmP9qNfj=QwQdaWyA8F4|+slbi8>m#e%&GgmTn^=X
zV)hXiE@|~Dc-y)tcoJXjgr4-MEP`0)d0Sazz*fSo+cpE~XuwJ68^bEb1F`Uecl}+1
zV}UD*Z}uBsD84Ej8A>O@YeWy%lazaJwY_xzM6O=@eYTN{G-mqNnN&PuUa)iQiZpVv
z^L~&4BjD9Tn66{3(E2Sbn*8~fcgeqYzlFASyt`eqR}gA-EXtGPFZIPKt=)I%)fDdj
z!m_`!-q8cY^a+wdW~^ZF5>`>!60cF(5_r}jgv*lmk`KA1;UskMNX2b=`}Zl8Aw0dU
zeDkMzE*`0BrYrGY)6Y2Hkm;k3EuIwMMY(_gDL+=5Rx761Cf$8L&>`0}uIdYbB;yy4
zap62_b=V(iEokGBqJV~;mor{T@rV2)t2KQ~wvkaTH!no5V$W|2F_n^^-_l~pt2I)c
zeu^>!fQN{Ws<n;9o<6MCq;``-eEFVxUU(Rv{-2FuHy?aSF$;l*hKgKb(%;w@7oo`d
z11=ug;4G~?KF82!9^V0A2dgu1(!QO(<!;Awit*C8_ZHv8g`z17sWg2p)gu19TovJH
zs`!e&uwP5o_})LpN7lf)RX2Q3reGT#+#>uvhK#e#%)Ns;y<lXh1^aHSJ!6adh_Tim
zWD?<{T!un&3-{c!=|Y^C%B*&b!-F5s;;<V)&pEtVtmDifdB@3BID#&%BJ5_!9;Xo{
zepTm>A6Y}aRa(R#@rWdgbU%%#v|6zX?~A(BA$^nO5^6)g($rp@<wLe<&f~U?`N9s%
z=&EBS@ez!rsxOtJzh>FcRoaHXof<SHr0ucn{;3@=GO^Ho#_<B&6)t>{wwA%hLqtJK
zve-Y&EE6hQ;m7cO%tvY7KeJ`+y-`URB-p~hSI<x~l_OK3IwXY@JVF0VED$hBh%AYl
zGKkigHe-L-o*3$^jUadsks8F_M&DC-$g1Iy%=6pWxBFJj?O2@2EY{w^3^c&`nIsQ1
zu_WBd_{F4ybQ(r1PwbPC8v8px)84V#ETzrY;(rKBot)>Fen=YpD087H(jWdypBw-#
ztcF(BBOAy+kc_sgwo>~BwU&9boNQ&8ziTNT`gQz#qb{ObdD-ugRQD3gwp{9604R#P
z@B2r;)FR!)9clicOml>6Fa>ixx>L*e-c}Xs(a+Dp?|dydmPEv^8M5r}a-sn{U7h`Q
zs`r?<kQ|}+!Iap7E<}})(V?<-r-)w3GK=9{XSbn8>BTLhPv+qvDpwcTdx1|!@1l07
z;cX8c?p;V02>M#>=indYiqzjD{me@CxSO=C`z|$S{z*l0JD0JHRa_~L)^!^IH0M1_
zTt4iu`Ly<XZumFrNWS2a$#Q|Ep45}=TC393A&u*>N)@3WliA=sos*7lYw_cl;U*=$
zo9)W{I%|p|Yw^n}vzCm(4C*0xyUKg~m4sDGq|zne=^waok~0h6uH04TTjlUw4n5+&
z>?e6ucwqG&_ueiglSpNz)-rnQpbM<^>K4!}5;8_|nvk@hxXJTjg!U@`TI6?;2a&Kb
z(`VV!4x;PV&jY~S(0~mF1K~hJX-CD_peC86%E#HWxsyA4S0m8}Y31MOS-2kKi}3@%
z3{6%Aw8}Fzc~}x&q(j*HRbwy|!KHoXeIRc?Xq4}>w4xFW{sh5UNKz-IaU#I>wW|PC
zy8Wgh**r^{L0hZByOWdc$k`_Tg~5>wP7XY5G*B^Fgj<-1Y^F~nyyA_HcsFD6)gHs{
zOE#!IoDmOK@#$!0ZWpE^HQ14cv%`oDtGne~dRKG2yvuixrb6tfp?t-dax9$knelsz
zlhzZiR&bF78(%^ar<w1C>>c#2WvI~V`LqrVsUf;l9H~f+4(qN6M3_JuTLv_BlS>1R
zl*xnQG7f3DKlA36v#37vu0;dpSl&<U{LTus%Jm_qm4sIu7@vv+;%&bx)w58r0<Y1@
z=KmBMB2_MUl*Pz6sM5&NSmRdAN57Z5NC%=m8Sv|k)oPhXo`1{E_-=tX<tqxFVdB+B
zFkWc?Iw7WnW?nf^ch8>oyh`(!NWL~h1DfMIZA8YhccbD+Vfk>M?On<y3(!C;dVHr#
zN%w2sH`_29bkO<eugOMeQtDS?eRD7Xz>!CGD=Utj0TcLtfB(+||5tdx)Bl=)K<!)|
z+t}L3!O`B>zzX%B%{y~!E-q|#Y}7x`IXU>A|F@O<U#p-XHk&f+o#O{vV{A4lD+3eo
zL*2~C(G;75os$QfP14xR#MBWReDEkXo0yHIjlHt1fg#xEwK3ex&=_iO@By3cm6@Z1
zg0a1rjg_s9wXwA$HXk<I8)It|PzW~%s7DE#O~TC5(byjRv@~!uer;@MV`PjiER6ln
zROf`vX)`y~;TkVH&bvQ?a`;pc!{!xj_-c7k6C(%%>`yNha6kIvepE`6Z1txy#fUXl
zL8DR@ZS`jVNplwq<E6wsuKSAYX}2F%S2T>mq~tzA!W)h!UaZu+ZXaHVobDPW9|||Y
zLgr;NrT>r7ZYBipBmW#fJxtx+bI{)y{o}T(j{YQIp|&Yk&i-wiznr>yn1?2iHlMpG
zP44QsXLww0HO$CuHI{HV>&sv44tI&b$<QbB@;9%0ncLGxGpjXWbxGS$bKWHWn6KJ?
zNN7|g$|DS*G7L}>pscT84&Lth<#8?ghks{a>PmK9rbz`bP&4s9Gtg0rh0u?j&EJs`
zzDlJ>pDpkxT(20;)aUfF&8^dMpB^;73glknbUv#6*bjR<+8xT>q;d8c{k9LLxs59p
zI23$oL7?!Jlj1G>BJ$b8+BhT|rKos)PGe)s2OyvbJrS$V&BPPbyUK*FrFWm{QW>z#
zOh0qtodyUkVvnYNgob?P-|20o;2ny-(gaKqVc8P3xT2Cu9dss3TjwS8=pTykEgj4f
z4ni@SOIC(my03BO6uLy9E0!W8wfOn2jVr;h3{O@7|3c}~CWam32~F-|vzdiVA-WB&
zwd;ragHWtyBwq!WC1~q{x1x=u(0y>2=e&1Q($mZ5X!L!LmX9n%Nu7kQ7S<ZB)g!$x
zKF4krF7X4-^4b;LoRHg6TikmUJ+pp==%iT(jjL}~lZiylo)1?`K6*mKZP>MT(GQ#J
zZj0UYRMtGpzI8XeNQqkCi>k*3FS%(|KXtvi-OP-4G~#LiqLbekpacX|cyd`RCtb62
zHD6_lDSO60xx@e>rc>3#s{rx1nd6Q6V82(R-aUioGxmiCh5#<NhU`On(az0Fx}r{;
zO-cq0p8CaY4d|`clgv>JYF<>bwFDndeSAPo(Xp2#B_X)}Y21j7Hc`b9R(E8nJSfXX
zEoj3LmUiF(`BkhqO(%3o$F+L&3uF?Z4PB3%jZ5l53j~erUDLfkC=#(wUncj%k*ew2
zHCb^7)M#jy*|kuYrEcWOOm^AmLmRs37smrel@Vz3wiC%10W)kEHT|{QpPsd?cj6aN
zbi<WWUUi*Ch|cE7AswvK2ZVe~8q`Y@9VsTIATik2Gzyw~>c+;V8+W1x)>2CX;l73F
z*IneZmoA`0E%5l)&)XsiB5CTSmox#=Yl1mLa3r0UUKd=cIhG-MUw>hLSoyi&MT4lM
z^n}9;0qM#Jxpx8#Z}WQ5pb+{-e9I5+Lzg|7D^n66fwGgw<jzPyy*RKK3yhR8B8w~`
zkC=mmNi#bn9I3}!8iGsj(~CDp1Fd2u9<KWg9+9kF|6*p*h^vcrRGdi2Hymh<u3)LZ
zRqjpRQlcOjt|iF6c3ALiy^~gC=eQOrPrl<H@(@?Fg#3l!S$SlVg8(^2vI`QfG!pjR
znS1YtvKQ6)Y!XL~GWF_<D!V;6QrMF2^FR`TArP>s!*%ps4fGHl$RX|1RG5)I>tkdi
zWE4WY8Z%EI+Ii(<g10rL;nHixwf+G#S9?qjdoU<a1@cN*kL&7bpFY+ExbJMQ3}jy(
zuOIxa00VC6vr<fYrDE3eTvoj%d@hEDL`R8P?cN9v6EAvG($4_lWQF687ORYvDY-f*
zEgRd6+}UC2Jo$AqTnS_H*Pn+eoxJO1&+B-?k{n1uR>f+AuuU>oMo=~HrR#Woo$jVR
zv|tiiflp+~YgN`639RPys;ftN6nPcbY0v;qv3P%xBd7OAy$fUMtmur%AEPbfe@FYY
z#Nzq1ArbU#O~LG^%sNkcmj<j^k`_>B``h_bwxj9x4}C|bj6y3sBu*drU8hG=iRvA;
z(tFs#J@&n@<DUtf(sgUUsA*am4Xf}ly;um}%&=&OH&pr_Xx~<8CYetanVy&3_dB$t
z1w~+2MKo&HCpsS2Ll{6`%UeZ~AKNcCMMc?Vqi{c*8xt3}&i-?F#pHxGDK#%Pa1ty!
z+BkcGAgGL(5i)K6vYD|zE{E+o&LFTTx1lQp^8ycqfSxRW3U(*pY`UAV?JrUpfzMo#
z=%^6i4T4g%F9UhisIl(1nb81c8&fMyJix4s_%V2)>P6L2$wIstx|yN>sSy1X=T?=W
z07LyxKg`?XF#_&y>56RVtgf0nl_sTJuM=TLJ0!D@o)~q!qO_!wCAWPiu&M`&(RR~A
zktlXPa5JOGnpG3ZQ_<IBBGt4nn)-zBNh{H$)b_7Velr1v_0A{Ed?5UDV8>&;_@-Uk
zKbSUgM|UTsp3=VsHC8yg&5nS4%Qh7-GrjIq@AieCkdHznZyP}Z2(9Q2FRsEOsv>Ah
z5(yO_O`(0-(BdD!nv@#U*SIqK!*BccbVtsTPW%9)0T6H06rn4NUnxSL_WL!h0CEJ*
zKPh$Zp#<R*qvKMk)udTD7wsk~n@2Wum(iOU{(?T(3QKcX9^-N@PYync#DU1a{%VGK
z`=|EqtFuj%MY2tIWSpWb>D;$wED$ou4>7`GG3o717wb*7_pji{Y`F=!E`H8WG2g*y
zEP~!#d<1sZ6)0SXfhJWGgVENHw}*0OaDBa#1V$maK3(*R%^73>3)_40$BZFp7a6t!
zxhVQblh*x7?}sZL9(~#x9Ss+Lxx<TX8?epW^c$3FvrVu`d3rGHT>uiGie5DKs4(fw
z84Fyw5y<QVI5G+36AodD8?>@fc+I1)h<crGC-cFil)i}o1D7HopkJ7H^og=EqOs&K
zdo#n+Sb%{n4G1Bdj9$Fl%&3|<bk5z(kgozCHJwo`4&gd^Ct$XBNv%JtRGP>ILRKsR
zDc{uKqwN6^6(O*qyL_kkn;e|p3wkdB5dIfAWye(!A@miAT${hkGUZ9@{m@iCu~kM?
z_H}Bhf`p$9Pqn0LlcE>>{IH&Pok0ZjW~LGOcvcKW?K0V_4_0UjU{GqY`>8QW9}4ea
zn3U3l-om~shvin1Sl-e9fzpl0<-7L#0~vn(Gu&55^-}5wl65h18&2`yvOxtBR7v7M
z&OT%?Z+3^-(~@qJ$EerWMvTpQa^ry3l8&1I(?3T(T4+0OGXqOKq!wHZ5~)C#lkMWv
zQ=xhfa?>g9=jWH;(sej5OB^C3e4@3dR^LCnKPjaxB4{AB3rB9xxPX<1B^{n1_FYv!
zo?g=5r<)nUwYW(Qg&=L58h*i%Z_@#^qx`NtkP~VmR&+x3aJSKQb7@M|*BF>z_t=`i
zIcJ0ELPi7nh>K8kWF^nNII-M#!U0Ew5nMMV=Xjv>yV!G(SsM>`qoUs+^{8_PQy$Ze
zgf;LN_hjZ%<6vOVJ^nl?CDatcyquiwP)VeZH4{Iy-_DQ3B7XQ9Qor0e!YlE?gIrUo
z!+UTfS_f-}c<Q%(A^Md#r2bEL#o(=(<wKZ}_@q?mC%v6BB8s;Hxgv_d_C(V2TBiV1
z2wdMK8r@)-k&D}RtYaFNTYFB}ym-_gv?#T0L$`^lGoDRKWgj$xVd&~5#Lb}NM~N_)
z!^Vb&PunJ?h)gQ4@g}7%z0gklK<Ihax!tb(zybPi>S~e>?)Y(I&+!Tn1-o~iPfAht
zXw}e_CpumuQ*$lp4q371WH7gTJP?7SRS`TaAfPT_W{48rphw5tDbba2D^5H(x{6R=
z`g{~h$V}P}S1L*cJe=k(H{O8Zh<tAk3k$@$`<F-XnB3Z9!Y9OVw!|e6<UY3R3@{ON
z%Bj;yCwnM(iJrnQbx`Dc-wQs;BV*Deo3}>61p^lfL0gGf?#r%<0Fz|ZVSKgYv1fqZ
z_IFg3;k%ikL@&zz5DY?R{H5*3(O_OO<(!nlRPcJzt<6z$O^yl@uvxG~#RpL@kK4=`
zkbt0V_h+g59v+;*QWRspm(76Q<lp9~jF7;?WN%GU)qE^GDK~+tDkLZ{*?%5W_EOG+
zgpx|c>Os|`n4V|YlTy?{Xx~=Ag2KHdk;?@76ONP;vd&=<Vt6SI!9BeEJqn%P2FH*m
z8wr?wQUuc7OWMJZs7+{1Cq&}%eLcxUz|8ql`v~I)dWf~|92i1w3Ws`*>dj@4Oa${S
zSbg+UauWk!U;--#1Q<k`Mx&A_uOozDJ8|SM($Aee1kC(8vI}QOwV=^W>=Bz852@Vd
z=EVP24H2WGVTtvL<ph&by5U0RJH?@oLfrfJ*E^M-XGL1lUE15dKfh&3H~h@4YtHU`
zHgVZ!GegL)Z&n2i$zat}(V4_{($W#wer_nRY68+{mTY3a%90ND`pD=z6no_Kt$<m?
zc~T;(INLvHtV*C0dYeS&nlmR*7cJ*JhT>3ceZ8~5>S(vGlaW9!=KMZ}K7X;WKv^Cb
zOJQta0#s{~Ad>8h<NcXLb27fgOZPwJfm(gyLHv)+jC^W=&pS^)&XP~DJNbjD^nI`9
zwJeyJ`s8f7;K<}o3QCMtx^Dd)(D(iPr9OG>Qx3A+tDvU&2p{0odQlK$-{zj<Q7uR&
zffeC6x3B{Y=?J0cx0C9l8pq`LJ?wV*OT{eONg5JWPO6`L!?%hP$v1fp2JL}ANytel
ztc-6pi7H1aPx?_+=M)22y=V#X!3TQ5vPr+@mNnf&Vd~rUU<Tk%ivi8+<ts^ayn4XG
z#%&^yyRquUAgm9T04r4ySqUHzsrM$OjQcQy?2Q7!<%gf(0p@6n@3V4@ZnSTc*hb{`
z+u%sdNw6es>|bwxo`J>v&WHg04a{-<<G>7<6h|LqRz+0eEWwrLeSq}M?!)hJ<Zpr?
zH+PGl{G~s=C*>Gj(SS@iGudEv=D(<Wgx(aBG`VxnW8eF3GME(poW^HDdEaErI;TV?
z23`~=a_v`KEEd6F$;7Lxcv!1dWPGaM>&k999i8x(va)R|o3Ae-7fEj+w|NvQLy3a7
zC$(JqS!nR45JPoNk_5J&rJDM@K7WLbQ_RRs*i<P!w~z|8#guAl^D5Alp>uH%Fhe>(
zhmY1XO{(8z%<449+KiZ(xY&?uuD#E6ktVSFEZJ1#6*Ao|SeaNppp%&;DQ|}fo_Inb
zR#+n61TyMO3en}SQ}n`<43F0&n_|6WK6L9#HtD)t;0U?B>4~H;0$+LNw%HF>fB`mi
z4cGp0%tAk{6#)#<c{uXu;~nRdCiCzE`nuPUyM%r?RT0<))UFrTLn0X_<K)<0Z-08q
zfU(E%@aH(PWdj>i6mV}kt)K^ss`8gT5fty$=>as0?X_HV{?|;9P5it<<lx3FOwnTU
zagxl<46z|=kt^MI*uVp~68OY}FfizN$I%P*vMK<?i({4k)^wXk>3j3D<mmwWug0lW
zbOCWtnLW3vOVXhtKy23WgTrhd^x7&EmUSR%0rncba(e#>Ca@~7#<A)>A^~|@yJJP?
z{<<KV!qkcoP!OM#N=EF!ks0V~p~wdXfoK5ThL%nVSa7Ol9lTyo1Dbzgs|7dp8AFgN
zg*OeW!umsf;G0`7v{hp$%w!1x`oZWgtR7}>)AuGRAEX1KFN9sC>VW6&$Jgi#fI=a8
zY#b(WT9!;`IW0Dzp%I&=>NT@Qz8W_28Uiq#Ho&m^<=meMA>-(Qw^sQQ5Urf;OsLia
zOu&+PSkg-gNnP*-4S+`rur=RPg}P)NDgezR(jAy5ifz(;<rLV!nD(!1pxFqA0eH)4
zaxIsVd-l>LgIf`3{^DNsf<aUUrU8CUWV?I|@zfywg*Fu9QRpQflm>WxZ*<)8yREF+
zcpzy3eieH`2(ZUqqFgI#JARGsT{mofV`Rs~*u#|g397#~&W&+l1H_g%n82Hn?kwQy
z+y_Dk*s{i>0k<Y4AV36n6|1O7#jC$2i2C%1-0xMuxtR~w*u}LdHh>Y=gH!-NCh*tM
zj1ZbP^CQ7m0-E1;fG*%%N5fTCz8T?IUdr4|%zZN-QRsb40QdbRgBKd`{k^Uic%J>&
zpp^M0(C{%u(5hcq09&s2KZ%yuUki}`G!ueOdyAT$EaXuR#lH@XxLT0HNRKqH<R#1k
z052n%evXa@QzLCF>@TYQZ<W2G5DhoZxfL%$EDG@wO$WSwT4EQ=aYx<sDF(5*r45Au
zKI4RM(`&{5O<NXHiSYfWMh!Ky8{K;<=r<n4lL65xCc81&b$I!|CM%?@-SEV;GYdor
z<&StYGDTR%Uq*2KN&y>7!B+Now2Ksk^j}Ju7Bhe}`O96B_Ww*22GK&a{A-jzHO7J_
ze1kzI5Jj1ET11!tmj=-j)nys^a#n1>wDUITiWrnDFbV;@Oq3@^F#lv#O5Pln%m&pW
zQEJ!G4wTmaM}X|I^i7XHAoM;U=Zr=$J3+i}G&rKBpajko9445n7nWqIO9=G8)%AMA
zE#r~~Qv^iCm_Qc<p#ijItbcL7Y2-xV{1^Z^k^qCyBEtSnBOm8$Cg+Xl1Oe%P`gkxq
z)mCph^pc}UjeX;tU+V4|f2~L;V`xSj7W=EOxkm6m`WTv}hxPt7hN8f*@@5i!unNUK
z@t1|zt6Hpn85veN3quorr|bno<o;dxUJmOh;n=`8kZ9VfVqhO}2(V(08XkpmuPj7Z
zZS=-xd?w0Xg2ST!G@y|FJ52^rZv>mrKrKBmH{}L4GNaZFXra>@**|HP*tV~SZ(L=|
z3WlRwH<U|>{2R`^93G&waom6zm+L7*P|kx5@R{g(MXweA>w<!s7+jy=B2kHA6Y8Hp
zX^Q|GHEy9itLxQk9`mp34azq%Vo(@j76F@?lnis!BbbuPHAwV=U^Jlj5arlf5Z<?7
z|Lo}h(TQ83;F3}S9;i|I&kR{bv*MoJ=+qGa8}lFD=$tnX_^(dlbXv)OcK-+FB<00S
zEG<$@Afb#^G`cJDZ*;cZ5CN_J&(a<oesE(?$T;B>?aY5xsEOVzK735zBM1wQ3c=qn
z4|Fu5*2>-u8<<rSZ={ofzD5E6*XR;30o*w124hsd@G>MtIT-exNfdGL9P^?j3m_ft
z0reL6{ridn9+gOdj=w9L2XjmU;`OAAK{Uzy$<4gSlu*d}-5^V}#`&-NBMqVy(czez
znf(X&Q9|JMza{>6`egBP;CzfxzUIL^36=im2ykZ7QhjB@Ak;j*D8a0vU^GPQsRdYu
z4OTylfDx#}SNVTi=DBG9TESI=*vnkeq{IZsx=}6xJp#s9M`dmB2Uw`abyW1q{0DC4
z2>7gilopUBTv1FyeP<wdG<d=J{3--2Kr#Akt0vedelQ5<&?`_w4D00^$n~E$C=sYQ
zH-hP`)IfDJ42(9M!_5E8(7I9JEYTC0Wa18Hj9;~Y;Sk2Zqj9LC(U25Cv{{qrZ5j!~
ze<hTvWE}{ugSaR|L0rJF_a+q({dz-y8%qz#L4y5<1&wReH$x+DBK>}TC>kKQeB;i}
zo1t$r&Dm}`4RxUC1+E`d=BPnr{?nvgfP;$gH+Gt%#G?`$7~sLjRo@I$VFep2!*38~
zg;jt9T~*Ff(HaeIR(;Z;v9yRvGq3#({oMXB1hw}6dUWW2U;9s0<^NVM%?vl8{x2*E
zU8pq&1_PDh=o>@2P!tF)!vTF~P6ev}4-ZQDY5&$o%?#^k<tl!e9pjiFeo;~&B$`Ai
zQT#OjJ(_`VTeX9GgAT#V0EKg+j02gVCh%{Jv96c3dEfzG9k`^j|Au>1sH+9c7}Z@8
zbV2SY3!&DAHRv=DTjVh3KWUmoPsCUvDNKk!uBb4Arh(+?Pzm`b2qa+cdz9fVnUsuk
zq*mw}UU!fL4|jsqZsbVhF#nTNQO^7~3*6}X4;|)SaO?e34<;9-Smfdc8c5qSUQiJ{
z@&*E2Zqb`AVo*>WnD%d+pz{BZ4S(m4znS^}i47Sy-HmP%{@?lgRiZcpS_qa5Be_}s
zluk&3UM&FG2qIG~HT}=EPvg-nRq_7mEdR#}ILzn90e)a1l1(CcgPiFd(CTP0P|7&r
zoD3}YUzh)c1{0#vjAX_+qVbo^&CILW*e9Q5A^15s|3riKfqPZ|4aq{;r-^c*EaWN=
z@lQTjHAqXzmyv=bF~z+>g61&&fUE8$1n|qp=~p6;PI}J^;?xhOF=FP3n@}Qf81>&S
zsA!Qrjt5dG5*&k~kk16QP>(fOLp;3+8#hM}*ikb<r3_7?IgbiCm$+$=A!6>#IA62u
z|4A4ElLr{8ntjZJ|3`l6Bk3ChbCmDmu&bWsqIraow4wz?c_6&>HHhARjiUqA;YOmq
zPMK-`Ef(UY|Il2jK$=V+wxUhZqy8&qZNAGb1}f!KMoBQx_2Mx92r4PnJ}W^J9^m?l
z`HkvQ1Cm^f>t%z}uZU^{`$(C8I$*D}PdYHfyqJfA^=IyzRRg$5?tu@c+q|hLPQUWm
zceF;Z@XK8@Th)Zq$^H9k8O18p%_<x2QR+oWhHDP-czS6B5uv|r4mlzE;f2nF`K`!B
zM!r;=$c^dJ60-fT<OtVwRXQ6-n~5QsLQ~OVxwM7!foURSja8^)OPA^9>)&h?!u0mz
z!60V6waHf;1+&6~MNC0!?G&7^C(#G{nDsq3v58Q<^E0Ki$lK<@N-d(diRO$#tq&ar
z;Hz}F&f~RSL@CI&^-M~RIRhR{XMOH4iunM3*DnXpZ`FfEIx1z|DXh*#5<K3?uee2+
zqU6_r41K(l6Gcmyf_(fuBl-E9ESShL3!{@}c1&9rL{o5?z=Z_Tw$Hkn%U%3T6MZJa
z@C}4fm7mS3<Y4iZV0#weI%Jcv!jpfW<jDPyY1IVZ*-sXNt>V6#iq|Bglsx(5atdPO
z+}4anh}b<o;Ki2|aTC?4Oa-qYfAHIl&zuEB!5EF7>w+{SF{rS1aZEjk2mE8LbpLYP
zUqY<Mf^t6jUW=qAVT#67-(+vJ2d|eY=vfX`85hoU#L*#orBu^1QNnRTQHIsnpvDvZ
z@|966gMd4PDQ{pT`0wiO;<EdqMds~glIz8IczSh~vWlW&rSFe-Yga4|*$43$uYZ|#
z|Bac@ew_QPO#;xfU^FVK2sFM24kJBcB4Hj?UbbMSWjaheSo$Cx#k6I-O^?=A3*<8D
zyZjNP%bF=@IhJg)68(mo0a(*qoi#2aZOHH5dQ8|{@NJ(&=s5G>97`n#2H8>+$Xxlg
zh|q(HcqS4GgW(YsXZ=q_H%@zKOI>iUA|)U{(kHgBPb&}N@0fxrohme4N-t=(Oc*rt
zDSV2+S{+qtM{N&P|9*O<!{L@rhw1NCeP*S1CUI7PNd}hRRGA~NP|HXUR|qMXgkLu>
z2tltNdD_)!B5gR{rsf&{P1ujIz4$#Tnw9LG!8q+7a3V9&7v@pqJqRXUFRdp+{E+*~
z$87SYeuOjcZmM+4kF@hK<a!YvgWeA&z?XCfzSy^sFLS|7>JLD>oooLAdZqKYwL(r>
znz0F>9yVHid8hna*)_+3@+viuUhxK-q3&;%e|o2}m1)ae`HZ+(LyArTcv*62O&-hU
z{^)I5#$Y6Cvj(@E3lFZ+;i!<hbTZbr-v?-sa(}BpoR-$4QKKm$q#xSvlhh!zNJa?e
zUB%6+hEeHc+;8(a;*gMZ;N1eNWKzBSne&q!OKf&!yst?Z5p62hi()lMD2De@0}N6+
zOwG|DCI4|?fz6V;Li8-*Ne(vIL$6!619M?kO)#Vh=1VZR)-VcX5w5;u*S-+n%mODl
zZ>;Qvxz_lNm}HKe19mm#8F7&M(raUw8Nl1|>arw#S?!jk3vkZeDS=&c+U6asdV>#q
zo|A<+#bTyFlD^t%uDPu~!0_w_BcL?Q<OSvv2*o|uk=djx$ur{bRh7JqOId(Xv%tIi
zp2G~#Gy3l_uQ2I(AvU>3(O}n^drn6pzFX14@;mVhXpu4AFhnd2;_sE+s?xAGlZiCJ
z_Sk!w9#PEz8uP8%fi(E+&Dq=UbTc+av49CUKIwt-B|^`V)Vo0$$5#55u*$Wq5<oR4
zwY$PgS_eJ*^nG%MDGv~N_BQ@3um$ZaU=xtL>nCg@mCWfpir~btr9vmce1bNkTI11`
z(SU^FB^fDt{kUbRj>nBHiY~}pIa1-SDdelH`6xvZX|l#xfD$27eNxGAp4mrMZ}i0&
zLgJp~k*5xj%zY>Uowu#K>VQ?$S;8V}$&7b9;TvPjjPRw!Y6})YF+;O3Ofw&jmJ!OE
z@I|1^pdAZ|b@#{LoTy8v{pmJ_@|y+Y-0@lI<X4@s;CmHlo-{A4T?SiGXO%KELk{=H
z9+--HwW-vl4Kg9K?+t)wUepL{%lz(JlF4SKfg&rEu>u*PG->9wY7j}$oi;U_{$;#X
z!!J3p6DNEtnEgRs2WGx9QGN0xjml@1R3w(zJNi)?Vc>))0}D>iw`4N<=%}ou7vC8Z
ziRLP!H*+`B-yz~5ZCNXMLONMpqKe+d>ZOLB(Z|lnSa~#j%oZb@<9~M@jY~~L2_Qt+
zD|S`)WymxAC{lrR<%n9qsyEO~#YN9{sNO8}Rv*2r49587Ppfu^PtU8G@4i<u2yaHu
zz9s3M|Ha;Wz+=__|Kpb}*?VPg$zEk9J9{Q2Bq4i*a7jr<MnXx*Ot#35Yzi46D^l5e
z&+C6KIdyTX`~H0Y|KIQb``sVik8_{v9OwN$@ADeZ*Ep~D`vgB%$soLP0YZ2sW9^mA
z*lO@no2))Hw^aB7<A=-BA)Mz>>|Q>$j2hVaA~C)g7(m%x!+~@&ZL4UGNou2vfq|oY
z)2eQ>-JG0c-Zh-iOm^rT(sf7^k=956?yDZ5FM5(B@foO2+PA)Zxj`v~te&P>RV<9t
z&*b@d_-q>TqcHCo%XDibYF4R@P=+cKtL>D<GTS6Ifu$we-h9P%0+BQbNd>wBt;V^_
z5yx#jqpcYw+6&WUkySaR(1_?fPZONTEr9k-Ke*E_PZdl|8o!0PrBzN#CXX_7)?}Nd
z8W@0QEgBmu5?)%N8kbZpA)V(*0v&tjteN7qGvoZYoZ?Rnn1@`EzMNq3R)#d`E+>$h
zN<>PGvZ-aKNQ#yt;iU`C&ktLBFS*^lTf`6Ry!B-1g8T({LC#l@+GDPUTmh^|m?4%?
z`4q6UrQ7xFGuAGK#ogXtkna{EwPO(Yd})32e3oNeCPZ__M%M;8`VmLvI1U|>9ec{g
zx5A20ZqEe*LJldnLhsa%Vp!e^FFaa|Xd5FWwna3&9VmIUn}b8}peRXdv}N=u-y?3m
zS@T`OB%fLNdW{qZpbHa(Ak=P9C1f5i=v#km%nc21V@tU*8)P<!Q*Ecs2a6T2@e4d1
z^T<q5_Bd>(Dn$g-96XpP={&y<iR*Z|OvdB1FJ6g_Y)mGyn-Gl8fkYIe(HWRbY|RWt
z9Z&MBVr#5zdV@|(LdS;_Dq%I3QM2(N?$b$e@;Zgr=PR!Y=H)#_RflMwzcG-0tIS=>
z{WSKR>4L>Ewr#~LFDV@ikW^K?-zj@95!_kTDKA=|vu<Z3w381H&!kk>^v3K*PEsS=
zqMyl-6c1g@T#7-}dxEycj?~fF5iw09g@k|MBe%8S2IKgJV=3WScJ3(OU&?dp1)oPr
z!Xxou$r{A5Q0@^Tw804H0xlk67d&NqCeoU5c*)s8^cY(rWLU*}>4J|@ZQQMqYEE2b
zHC6Q(UGH$Jxe_I1h5P4`lUfNpG68C;z6YjS(y@t@Lz0Pd)Cb~*B!K*4nD+YC({?>&
zwb0Mg{#TJs0wU&tkI7p=<<wx(cmI|dNxU`+Y5FE1VUyLaFgf8<ACoLy&n--rZ%kbg
zC_Guo;jFigc0Uy|7xega#iYP9YsOv|!NT)WibxD|I^IkE(h!}rIDt@WMgtdt!t<3E
znb9y|Tv8i3bn$?<@O*K~v;EFDD!{eU8<0a9lJqANq$tyHFY++HxcFTc$JHpAiAi6u
z(i3<JOrKLL8Imqf>nC`rsHzMg&uoE{7(wdGWQ{VPgiMTOj=w{_q28#&@CY)Vh-6w5
zyPX=F4doKIq|q_-ULef5v|S#c3kXYDS}(VjT#ofuC)>iDGJvV53WnvAw?=c^r<kk^
z^4Vad>W1D8fUXNvstca7;=gCj$VyCF`Gs`OzvPWl8oa^Ttzw+blcH?m9<g(g&PWnk
zdV1`Ogz-RS1To~Y_M)D3eXjLYMPNL{WORg4knvU87usnHZo(4zUqY9Nl{j>~^9Vz;
zchqZF2myv#6=ao}wzIZ}vzaLdm?6K>Ak*{zz$~?4jiHq0@%D4O9!%Mt8m){5P@FiF
z9r<S$n9l-z0`ER#&rchrstz)WKh#)JQVNho>V09VLrqK<i%iExc&dn<arOR^p`4l`
zQj@BbZ9#EBIBL;)1ycL0fO_oX(|XPx_Ss7}<m%tC>qdD$pZHc|M+^X$Ld84pWDc^y
zt+mqjMG80WXWHIcL~}3QMdmw|y|-`PCWaspIM&V1#F9+ClQKqXszCKfp^Vk_w)4ae
z^>RcqC!Ayzr|AD^8i_XcQbO@O_Pcr@-Dnh;xw(1D5xLmU$swS&-uuZ!avYZ32K-Nn
zOgm+bT2x7_Lj5ey*eb`PydP!jXr&`-PXz+cNMuL9@;<$^`FJ}`djj&KMcyk(?wn!B
zkkps%8Xe{mz@kb#PeL_k>b<*+(l!Z+7*}Mymr60U&rLmnPVvGx$JaB92)>bBNihgh
zK=NMD*_K^+CGlD2bb^_i5$e*qZCfFPV3R|AqZy@&VdkXKEIkfMd=NLX=4yJHKM?38
z^m0dsERE8%n>VpbJq`Jo_YyccwPrT76JracOS^~ij@xbO7L1R+M*FZ92k>6*g_mN}
z*mS#AX5tib|K^ikdovv@ND)4C#krhp(+qDsJe4$_2dO&v<;_!>2FsnOBCt55RI;HZ
zfb1$#Oga@w%Z@<KpzrohDp`CtX>wj`h7yu@fWPGCM!wl+#nz$%c{O&aChuj*m(R-6
zb(0}d<TagZ->gSm6kFZagRLL)&J8{^!W`qv80&a<yx^q<gw6vnSFci|9@1`ljHamc
zEkfD0W(DuGWa?%bTtFInDpgtjm@=y1*-&}%SH(h{OI{`zO{3hf#b`^}7!p8`Ag4LH
zt=8tS8gENBFBe#LWw`AK3MVHqUAm>aJYq=d{TUNE#y`#8t#ouTiM67}*%$4_g+v8s
zEXX<eZ|=e?7rDf@eZ7EOE(Nb3)OnM5yh7dKax)Ry3mYxSjx!Iw%dye^$FZDb-lher
z>{8<pbqF1$iRESc`h1Tt<Qw+tkk@yS!lLYE9&CRObVs^uzeDeR>8;e=+O9R7iJ%v!
zm}k|1l_L~Ifa07k`E&@BY?Bgrhw&{S)4ul7tHhi~TO9$0NNc6HrI?sw77L|m&%K85
zS1r*4*ANg~9BB&XmY?DKU<m8JU9}89iOU?b8Pc#-oF_=Ijt{()$O+7xpKMt?US;UL
z`3#B&q$uo<jSfZ^vwI-vlVoy2&>&UJuj_0}%3SD9qFpEWafV~KEQ$Ui2c@?KZWiPl
zj895d5`c{OvnEyoW3S_pq0g_nbs__uV=9VNwB?-0LY^B=KJ^9-2=Pa2J{G;~V;F#V
zI7Qe&*dX{4yvN7{Xfo%?lm@qTR056A+c&J~uz<yZ3?F=6Hk@FCIJSs7b4wMyL9^Qs
zr$d7<(5Eb{tJL>y`96H+X&K>(@?y;#GO7n?**T@E+UZy>D4vDxfI+0NHxKkUFof%Y
zX<l6ymUr4&H#<7&Bv;eoJ}#Vt-&oqdpj9kuCb<yL$o`8O^7OOSA?E_iXT;tCUg&n4
zg78~qG*Os$iO&S_x4eK3aAjT;F5ZdhEwF+Sdn*_s0cnsEydTdZi6p8%?=4WnlG6WP
z!2nM}Ce?mCotOkML!;|Q`>;+5&|E`3S@j9hTqOzoH@;SL<5tx6Qz-%*2pS}T;Y~_k
z2!v#ZG!z*^qn;euvgJ36eg&S`KBs(M5Q7$}X&V=4=0#>CBMb?9gA7PdG-1;YYCJD&
zc(((N*Ds&WLKvJ;fLrI+>Yd@;F@6TsgAb&W`P?)ka1SvyA>J({yPI(O-(9mb3x>Lm
zewGGkK*zxH+zHZD0eQ4|LdsPF=v(Uijf6W?5F`jPr$pNTt9OnkDjmc->2Z@PH-umv
z*Bb(<G9jYgBJ>ViX9d31QDbo#Qgsu!vo}VKHVg1}%Y>*u7>Xu=OpGxELpnj_tA0p%
zxzJuAxgZ}OzsS$>a$&^s^6SP|Eo{uS;U(sLhgFel%AW-)!<}tRoh)o^u;3Nx-~rg?
zoUOI7g$>q4pjTe3OIX~R#x_8q`j12SslC%OJn(a;czK0|1cZ5jk)7fd5)tAP7TEnM
z!ox4h$14PHFT?xeLOxzW-~xW&LO%Fq@M`r_d_Yq{5fMK4b*ez$K$$vF`EKiQ)p55C
z5BN_&NJNC6pATrk!^6ePCo0Ix$0xFT#KR@bCnCrrBqV^v2MmEvKu|yg-kYqe6Ht^7
z^y1{;Z1&@Sm*CxlmHI&I-AesG)Z_~a|18Pp=Q)g)e_xRgjQF2a<kv>of6Ao8uJe~d
zWx&6UDM#l+aQ({9pJfgAu+>Go7yECmje1P=UG@qVeY+_lu<5?W7xU!X2P2m5+Z|rm
zi{ky4L$0j7s!+12xE<))`e~D^|BZP2HnPpK)$?1upI~?xr_cI%vTe2ktJeyjCT;JL
zRft&K;2ysFnnvkUy<Ri5%sHzKlxMQ9X(n7yY=r}HgKgcW3E!Ic&wsQWe0wYcJvCg*
z2`m3GT93}+U5<+st2KR2cJIww`4bGJUfU7I)^&xSv}Eh6L$~utp3%ZHHz-PL%O1}9
zlr_ACY4d#WRz>Dx(F;zm<tp0Cjje`EiYW?d7R^P1;vPj?V`gL*i~AYhMPI*=)>u>>
zGBKDdXvfx!VK;Z?+vv<tk#a{tCG&b^;F~5~yc<z=L7u33%lgQv-y!}TIMmxMw1k|{
zYqv01J7(M8eyk=s5z0y{u#D7qMkGTtJ9g-bb&z*-U#>h$8gHMn$Wx?is@voGA|Hp>
zt(_^8C9d2$CchCwqGy+W-AO6#_^}XZ<qBc27rl_@M!nosp0t;3##-Y}R$1aTisfvq
z!o>Fq?SjT1iZze*VOcZ9MJb^QvktO^;wTe5)KPhJC$LxfvWmJ04P78te{NYdB*e|M
z)hX_68fVeNpyCO~57%)`kCU}h-LE%R`@}zhsT%5gy2w!QwT}!}Pw6QWIpu&Gw<${q
zsJC(l-@YXq?6$kXb*o$6TlR)qIYtRR_0*kjB>ir@zQ~R^)N2umk4zYzDfpwOeY*wx
z%^kxE`|{<^`OnQy*kgIl4lZNihG;*hrb}olAx{>FjYIQnvl+i<mvLIpM@Nv<-toL}
zYH%is#{k;QSe>0ix^JR$7EW}5UD4SaF60`L#vXbcMQ2KQsl!!fqQyeF&)t@x40oO=
zYn)keR*ABaCpg=7ku<R|MTCV)z3YjSbTnzmana_$3XXX`iticK1v36u!lSNtJ#FuA
zuw1~1yHBli2%3rRsUSbEAP=aQz^@;A$;%_kFDUx+G#qx|6Ki+@kok2Mu3qr7!UDYD
zmHYs}{8Vf?TVR6BF2(^rgs=cS`k{`%kuVl795><9Wq>1IK`fvP_#qsD)Qz2h2{b>@
zQ60cSCte;b{=K$8j`^|p;iLa?xxSi-rJ3oE8|}{O;pN5R-|PIxF&`EH*Sj~{Jr=|Q
z?)U4ER{%=@{@6cy1At3j%L$mdvpaC<8+O-?0mS|BckbOoJ}llJxUxG|2U}AuGbaG(
zxYf_eVR37lxjOAlE&_ml_jWRSdqn^je<7eCBB6G%A9!x~j3jkq2l%|AALQUxF}rGE
zeAd<#j>o`%!hAfyU<G$^9iSU<p(B<ceAW{{NKG?GTW1GTGvLhL<4N1t*upQ^BZj<#
zt+U<kV`%{cbuhMZw1eNv6qwc|1DyFW%?WOxfKeh06r5DG%g96KHvOFc^n*n}%b!!7
z3iOq2sb%qFKb0>d9ivCRDdNf{HY2|rsEmxvdRO=|p*pdDgW`>Z2SjHgMMkgrL*KGX
z(rJ1@BpjBw8+aAgnr@@$i1QDKmzvgx<jN0@r;W>h)HBj?Zp9@cF?Y)B#2KQTr3&f6
z9U&R5qDmFLOS9P8<8Kr4n6H<T=3Z<2ov*#fg4b@$-1aI2mKk{vIF<8J?V8%_8Hd;F
z0%Pqvvo^6-D_kpAo_L0I_jjg$9vJ8=ttf34I=k6DEpFV?@nAae<U^Hg>hUcqm(sVW
zw;HG=JezGk4^Pp2NvR}qSa|#$ue&9!*4@<HDve3U@+O0afxQI>N;Hzl2*>p8F1vVX
zZ3DCR3oO8d&0v!U?E*5Vn(5w@G23uqxU(_mdp8wFCtfXIi0CdK2@Op*5-TZnGs<nH
z!N5`Tk#`u5CscYxGDP$AD-zd(yfQ*XA!R;`HfD~7_M!8SksK+)g+t?utDXd;QxY;~
zbP0X9YOIZVu1AZW0kx3Etucv=lKnlio0dgRv_MeR1wt&wXJipKlWtPSDLZPPvbc>-
zK`-rg=>nRHoK_Qu?6VDY7Q23nN&?l>0hYtbZ47HfL0FfA5-zYf7<L&)qswWaH|BH*
zNh#D5V9Y*!(bnYJG!SUYfWD!<r4CW@o9}m|dZcq!(Zcc5$;Qx!Se6&4pEfdJ=U;y&
zJ+73gey<m!gz7mbGi1^K``V3|yPfRm)N!izl}=HaS>l6({Mh2OJ3UL%g@bOCK278{
z&&)bX;#FpI`);JI#k&@|V!%Fg*44__hSciSs?|219ofD%uQKn#8_T1D&P75?`uU3>
z?yL>55ouu#hWMrWO=s$L{+-KDbI#mwzvC$(o}E>7#mUO)N_L$xk&vgts|uu6BKF|*
z3nqGI8Q<TQR@tAp-yU#H@$S;YJW|1thhL{+YopO0k4y8~=9mQuTaYD`5%;>@xRsV`
zskxkQc*X%H<`ape;XxyALj4AkO+vbpl?vlreFtT|jjfzm$g=F6ys*8nzQ$8*O(%=W
zVs$4?W%cE&bDUkl)F15L+7~{zOB1ceV<As}+vS{Z;M+Bcet+S*Pco2F4m1eOo8e}?
zt^u*RJFh+x8F)_oN`=_<`Zqud<W87@uKsbdpsjGj2{LR&4s@ZLI!U-F>1@f_cjxqD
zH;GU1d7$Yjb<K0yXVYCe_0){ds(eh&j-^BaQ<;-v_^zv?&FjZ%97H=C&jR8Vl_N4H
zJ3lu@h1qbH*!M}y=eoIT+9cZQoah`-mr!K9=_7}{`UJi3!h%S79V`ehFd|Y8<B`&L
znd=_<Ga+(I7vIFM<~=AOL28RlaZ6TF>XbyMRnjvo^;WHZ8j-_EfjdAWKT;hu*~&Iz
zTu)|^dHz#@!-;u!XZte9a8z&F<syb}+*Nq-)ev&AbI$AY-AvkzEINYCoH*nPeu<<}
z+o4HSn_+UJ*68O6UpBIqoRN<e;cLf{;^XABhNzsbE1DlpyWTZ2lh|<lY;B?3#N%0G
zn@F+Gn~!IoqgB>>;2nQ_?t8h|nQm@e2GK{sI>_%03uY-J9*4cGuoxaQZn)bL-$~6N
zHdb^k$;mSsm+*x4s`!wNhs3QEan+~Fa#E^iO|#`(LrwFghq&~^Rv$1<@>s_7vOgJ3
zk+89kNO~~M8!g-kLvtf7)|<@hFA3}%yrFrK10P44?7?|z{p!#Q!Kii3v|;q$I%8S`
zp9^A}`qq>*l4aE0EsOJO3Xe(3e8c|cGIo{9B}Ko!+n1l+qi2n^7AN&xZ{L~6WDqx!
zXI)92ZwY=Sj8Z$@Pxq0wu=+Ccv&2muR-3xzz=aDfmAaBw+YQ|CHBHnwRNRD8;<PW0
zi7f~Rm`Zi=O4+URtA@J}U7+NK-8U|vd1QMN{hMPiVW>AyW1l(vI7Bw26zyE8u22$m
zAnoRHb}`K>TbB6KCvA+&w97fJ)fYHoL|2Z)BM(TzAoa*-4_8K(rr){E0_)hfr(O%K
zx|#gyJms7G5;;oqhGcU|I+0lpF&JbpD8g2P`Y!j0VN=YLmG=xVkGnEe#|wP0Z>(d#
z<S^AQRqByQnkrEsJhnmmCA{s!U)>NvxYgKoEd&9xwHF@jS}gd<i-4sA&mo2kpuzm%
zD1aUV7(%HSJ2_auP3Dh~L`WEZ4<0No#6!S}p5lSqQLP^#8<x;d2L!w!=pY>yqbLH#
z*TK#fKE?M(bOX*L78C_$5AV$+<^|%X!vdGxAn>r6#9AuGj#gMg2f~(fGTM97h(S{e
z595CLD|@CE)&m=Y;48@~%0ZBT<r0v9{~)kFhztZB6%8E?6&)Q79RmX$6AK>;>)0_Y
zVq83Id@^Ekax!94Qpyv|w3Jkg)TE?zC+QejSlKz)DQLNPxY&4@+1T0OogiUgU|?Zl
z5n*8wu~Cvzvi-;ZV3iO8Oq4P7(<n#`5M%-*6apkz4TKgLCmPc3KX9fp5;6)fUJT4*
zSjT}23h*JwNGK@Cs3>S?sK8nVNS?soA*cjsg!H`9=tLUE7!3Bre7D1%V=|u2eM_R*
zHpj$o;^1=(i<FF<f|8kqm5rT4Ku}0nMD(=GIaxV*1w|z-Z5>@b{R;-BSIw@OU$?My
zbaHmN>FVZw=dSNPzx)0H55pftL`FS+5}lBkl$?_KBJE|~tNeo3g+;|BRn;}Mb@dI6
zP3;|>AG^AHKJ^ZN8TtC{`{>yC#QehI((=mc+WH3kxsV_zKOPJC|Boj-@LUAIb0MRm
zqM%~Hp9=~3Ca|FpprX<9q7zDMU>MsIF#yXA5uXivp8NI~BfsVxiHSoS7Acd!F!Mb8
z(RQEgpFNn*|LDnnKG?74>V;sV0Lc{s6at7OWFsYjEgt!3JEFmn3>?Y8kqjKkz>y3b
z$-t2e9Ld0u3>?Y8zgz}z88zl-dzOzswVfK+IiE>0D@m23&?2;{16|XvSUwJeG=}Wd
z6~Q3*Fh~Pb3kJzfgD&x3SZ+_N>!W@6MI=tZ_d=bZlgjqv)g^J19a8S?voOelDGZXE
zh<K1KnGp9X#FTb9RS*V=t5`n?ZCJuXxIqZQ@3Nf$@t9i}8y(RwNbBdVNXf767+WWe
zHhf`_uk|p9sXXGrWvDDoi};;wi)QHP?2a<+!k-5bVovjRC;xlJ;wlWn9I{Sx8wNQ}
zw(}gi&I^O|v>_gJ$F<473b_J<7&scOZ^9rC>$gIrU=ZIx7(~5d>oE*6b$#EFRqI&d
zr}`XdrfBxoHb6Dg9r<`@RV@ti!f59_bVUH+x8UfK#?(lUWLHf0ju-GyxiARh2gzX*
z7^IUM24Ruhq}+F~xWTq!KSevKY6XKxLKpO5kgze@xm@T384MCmyZr$1x7#-HEs+(x
zBQgUdKO*xl(LR#qzkmk)5f1EP`w`qye)u3}v7MPNZMK5P+B~qh-k0mkn$k9Y+2|66
zcg5Em06xEt+u%x5iqUjG@#H4qHJx0iH0^ZPCJi-(son~i?y-b`?~>YBYzf}~Et{B3
zjpPDtCk!$<VYH3i<$2xJZ%1Y$Zrf8C26-OcnpK;-Cd9qAxD0))Axr!oo?DfcC00iQ
zHlBn4HhkbD<d6-UEg=AvSVI<qu%Q4Xy^Th!AqC&6_M9=Wvx6Oi9qem_*ch=P(mw8{
z$7S8AG+Gb>%xj<8Ht9#cwF_h4Bxjc->uI;yX)0ui_2@Uf4;k}e&+%_KhxCPp9tH{B
zNrgd-G+~gjYp*5`@Z5zf<ZUjrJ}!L=U`vXl?;d~PB>tyN{w<#nB?iu9kkJr8df*#e
zf<R`&r3Ky*T={k-1sKk5*s{y)KQsALY_Qf23?j2-4}-LaO)hE3I?xt@0`uRnr=kBs
zyN)*jU0&wixo0JjFD3(n&~K~lyh(;ZJ~W$moAhi^k!`tcRJ;dt(_G|$0wA&gQEC6e
z5=2tM+4DOg`Hwr??d;DyK2qd=pvd#T6d93M;BSy;h`NZVgZuOku@Ukgm<_@toavCg
z?I8Svl5`u*i3S;neDdmddZA;lv%E_1kf05pfI!n)a_OS>yJ7R^k6@6B4=@NdbScSw
zn^?opZ-#ykIlxi>oA(&^_nY8MyaN$?&ud8xARMJh-NS2;OW+>PVvt)Pq2M?U!Yv}V
zKra23?b5%YJlNqu9RJCFk`J!OcjVsDZd$+~3BAP|V`6APbZi!~oezVwS!;1U88bUz
zl<yzFBygPn#{EAt%7^GOoVjqGfb>Vy-CruU=Vieq0+fb>5`icgh;AIH!*I#?Y1I+$
z3SPW>A!qy?+17(d$(0TmM7F?jc^}hLF7kh9f_@%@21{;eihBjHWy!39^77xXN2xhr
zguDFiL%&L<!64n86&n;88&el)?|gwlLL~LpeTg;Be@6&9ZUZNFJ!PLgZ8qLhM7o3@
zntYIe<bd{I?qM%Fz&m8P69w-C-T}Pv?;658f;R@$4D1B1$?%RKf1}CVzR%XxHn;KS
zfs~$-e0G~GNrTrHc)S0W&Gi6RKg{E8`7KLstVaR<s9@ZsK+`!7qxsPZ7z9vS_LyM=
zULZ0JL{5--yI$}?27-(Nne>;7(GXN0k@Mi4b~(Do8Mui23Uv1awBhzXGo2Py)hf>p
zgFv6}h`=D@3d<X83B`E*$a}*1->}ES-{b4X555}wC9KN5;e`{pBerey9Uw42qJn~$
z3D+^uGyVy#Aj_)updAsJ!A?M!2ZaQ_--pm(C%@bO?EJ{ZM!-4{^T7T8$SlK23s(T?
zJ+pj}*?-~HPhKE2Ks39E$hprk1Ml>AcZ2-dEE^pc$4=ee@mm{#L6RBaNw2SxcKfgZ
z5f}c2zkemYzW*-iCGj)q)p8}_hs6aU6wXgX7zNq&)8fK)(C0VE2)D#=1*hBV6jX4;
zJtD~e7T|sM#Z7vW`}F#y+1#tPBi9Qd|8bb>1-z#NU9ZtY#Q%>j7$T2AP(~DrpTdAB
z2yo_uj6c``BBOtr{y)abnvw5k_w$&475@)ng(zbGhTs3GdkyFD&$J>4)*vAeK^wFN
zprr;C{ILC@_zZTAXtjT9t*ib{k&j}iABjw}-9+YLiu`vm6bQ(O`Uf%|+#~Aa;kt+r
zkR8?$yaPnH9F&$HNU+bFK9Ka%1e|M`J?DDoI^4A`YCUqT_r0;$?^?$I78nt95d)c@
zF)uP;ff4xxG8oiuIIj*e`WNsb1kOl%CL7$-0T_$OY;Yw1*y~zP{NZ!iA7XTV#bf_6
zzw4LJ_1hPX2tJn`K;y$88Dt)O55n_b0x7t<SM53EaHb*V%D{#{nYJfNU?LQ*wIHVN
zN&{kNJp11)wsuPoaj#RIgifdK1X@11@l%P9BIMo7$Dt82-meH5uErqUf6GL;8cXkK
zAjn7%vq1>~B>{xoeVrYYgx@s+IsbPrD6YAS9!z%){kNpL;LrKHbk|;51fK4?@hjc+
z7_L9y=JPj@3|G#>VELyf4(|xw30x?^%^1O{1_cAY2l4)Jn|ze*`b9yIl8F0%l<h*$
z<;Q#06s|>}IX=`BgKPnL4F_V-4FBY_&mMn4-hzz|3dhd|h!O^W40uB%xM1udHgvZX
z<N#oMoLu6ITiu`?3E6oRVw4cT8M<AwXATaUhkxbq{J}Si&-axOl#<pDtyPS4{;2)=
znFaxM>@XJy&PWi1K`8(|nxE2u$kc<%`P)XIY=VtJ4afZ3R2TJ8s_W17U4YxQEdC>B
z4cB5&ArJC#AOCiBE8(wiq7W4o)EQ7H;Jn?}3Ef@?pd^78{uM+1E<`@cbs^UJ92O!Y
z<hm*WCWG0CpDr#OK&$ppR~i6L(A5IHB{*DzzBA~v!TALG%KH*4aOpto05Q4!`vynO
zH3)Kt?f+nq`F>RO9UdctO7&Z01rZh0!h`z%M;w5wFk-{QbRIMSKlcCF@%oVoIeN)>
zpmr1BGT?TJtNkh&_=%~AVgu(YTn!N!1d0NPulpJzHUNz)sPw<})qD=|({@ezkyYL=
z^#_tU|5-BR%AS%TvIG2m&?DXjbYFxp2~oWf`3Pz%qPqXI&|sVeHiiqtL815?&+8)p
zkx~9TqkJH5y{nIiqz4rkk@O(L5n=f+4e9pyb&zid8y|`U$OuaP_oej*tN6V490gE7
z|IPb<RxWTzX+20{={=N&J4<j+3(-*m8H~8!=R6_0Z14`j&fro5Zh!K^eon^t<6B1U
zcSi}Y{Z)HleHTK)3$ecIEkOQ*WIyOJ|0I3Yo~|JZ1SkxMnga?3B5H#^{GqNlqTjyT
z`0p(8nT4ZN2*R}JzotTZex*X}0Cfd1dDq=R$Qr?&te<w&=Ky<+_dK$Ljlo8s({L!D
zBl_8(D~IUS-}e2}OGdaJQye9(cdKvT?^fR)uE!JZzh=mQ<`R+0`y4DdKjBad+FLk_
z;A)H5a33$>dVW|VumNb0_Xz@`6dCWU^Eqs;+mS*3@#c6hDn4Yc8$wzAVV*Lg(}c*E
z-|`03YD5J^bgO^c5H1af67f@%{+J3mN?RY85c5~82GZ88A9n!0Xo-T#gQ#@})fACI
zyXuPA2vN7;;sA2?w;+$mRe0lrVzFz(|IQqXAEmATW?C{rwZIhwDj#kc54?l~S%kPp
z)M60B5#24s--z~lpTHn?i2Qe1>%SCs;RDYBqR+p5k5Ik$`@$}Sto3g79thWn$_x?;
zR5L{0fM#@`(FS=0GW=i%h>S-34N4XwT6kmqIiDH%e#zm0UtNjdEFyOQul$Yhit)+r
zazlq=HTa4V^sC_<0RtE?@&QAreYG9%5Eu-DrT2WX!@?)HKEpc#L#BOlf!GOLHo%UM
zfDU&%(?cxt8J*lW<?Z|%(xZBieUsV_cdLI+e|ig2b<b5sWXsR67-Y$x_EiY6)j^hl
zDt$1g@|XMxc!Q%NT##gk?Gdm#`9CefMO3w)FbpTV4?-veS2a37>A{<W4jPyO`K{k&
z{F{b|e)}&+?av1J)sfG2=u$8q?+#fCrUenJ51QVeE)mEc@B+}rfj0Utu`wKf;f>$|
z0pH+40SW^s1b^)0AIHbdM@zx{W+@mTJWc~AtG?ai1KbY6l@kP1&>F*iA;fK;b*?(h
zm>z(Ac;kJIej@T7yh|fU!%x$GWRVZh9gznRjc|nyv#_LawO2PyE<B0XR1{YfNr6F3
zER2@0fhDjionR2G4++mcwan$yWF4Q8gRZbdz#vlZXtyxb<`Or_lwgo}V4;RJwYf|z
zwo<&8>N~QljFO1w6E}%|T(pCdx~A((e97-48<b%)EN<IB8Tx?_m<f*5vBkDi+g>q7
z0j%udMYP3vHsDnC#3RWt&xY2Wn!WSh<2%Gqlkt7S3e4F^#`|jIzz?iE>6E>J4lLs|
zbQ<bQ+Y_y~jdBt?cS5o%pDkfZB28wUtUm}?y-|g8=XRvz8gAUMJmPa4Hgx!CH4umR
zhf(b()*++%d>0_2WUj!kF<#e@?eWy~Ti`CH02ZPAHQp#h(xoqHxX@}p-wK4&{S+eI
z|34(@?+1@CT-u(JU6RgLL4AKW^pL4bKgnxAj4<+j67!Enj=*%1=dxtR%SyBjZ@!uz
zkjsBW&=3Ts|9(_^a{SLk6cEM#Wuw~T^5z^|L=jlNPec)DsIeWmt3^9otp5Y$0+sIX
zl<N>l_^WdL;Qs2cWYupa0pWpuV#l9p{{LDMe#!0cVd0nD{vH<g(HsG}_QAsch@QWc
ze?M3ujtYTr`y>GYf77^@$|VNPA_wcb*!2>VIFei@&<qm-b2GTeOJ8tq0NxQhl`leW
z3pAcb`(Kj|j%aa2iz690l7S-`IFf-Q890)GBN;f7fg>3>l7S-`IFf-Q890)GBN;f7
zfg>3>l7S-`_#p$duut%B+wXnBeea|5LhujO!@qq0AANLQlt=LAN9Xx?1VsKPADtK2
z{iHm%oW%{`%l25@hkSHi@c+J#&SOF_?2kS=e;oKKeZl|rADv&<+^bYT{#WnW=j9d^
za%+NS21w)-x7bj#6DZW~v9pBAW7{(MCB!#M`a1QR-#x|TY%N=(apfC9-um?P?B}i1
z1CnY59c^7L1mup9Umrq=nhoyUijAe^OxL=wnLaPd#aI<0U~);em)WeTF3!W#L1g3B
zN>;jBPGQFo!9_VTZ;ISS;bQTP=+_oFmI-0g>Q$QY<+a&fDJ*HjeVpSo8gD3`GUd@6
zTV~wijsEJag1b;9|6b)JBa_k{MwH^EEvt4M`lO*J_ZYd8FKTCOg)k+QZYx(u>M7I_
zlXei|E>U|5jnYPPKKv+P)hvSk1f@>yeAw3)qvT@ty?OT6=Q)R7wtY;`8f#7n;82y?
zD}sR+!W?b?SJEJ|Yw%+FU7rE$hs9MdW~JJ#KM`oZURg9OR(8D_QQ4@iSx-}@cQMIT
zw9sEr{?cPqSt7^S;b2Kz$<q^48Pii-TTd14+JB9~b?{Uai*D1hb?mDCMq+8DHDKgl
z-?PT2ckWhS7(oMzNVk1GwRybwErR8&lDekBIy{bc=3uc=l!t1?V$pdPoC>w_rv1<F
zCi-<ncPd$*etQ1X1A%*w+9{8jP|7G-;Gp6NJW6>OhF$k@>A1Djy8ovCW*%F$V@%GB
z`=ViNa>Af~!@7U+-K+lUSFhZZh<o79%&Z(>j^=@Lx@4-AJ)yK&zPjtC5+LFW4{^T&
zBEGbh9?_Y9v0PlNQRnh0zWEq$PvA?a8<WDMAvCXXlTR3w@Lx{|2!Hh7RGR+pc-GYX
zg4hM;dtEG%x??XTwZ_E9`YlAya5ZpTyyZ4yn4Hgde&}k3rT*>7TIXKYJC`0Sr#}nq
zJo}(=bnX6hh|K2~wazO-x+|n#j*HyYxEg~U6Q`-hlK((xRovs0if(qf9w68a7GB34
zzcr?vCpPE8_J}ckZqvVEK6%OdSwz93TU>O(bW#|WLorT`6Hv-LI7mm<e^7thR-HYN
zd25+4+M=`L{J?z+b`@sSV=Ady7Wj41yAqy@L!T^g&j&qPNlQ`T9y2o+GwOq+<fJ4S
zUT1E+-b>yl$h}fL*p@<ZFS1NE+OnpSJnGud@}0ZS$8#o5t*#t7w6iG1uIp__+RL`s
zOR_hGd(k2qOv2U)X&%s`q^`P~E@YXjx7nV2mmAcG70aaRI{EN)Kyz(kQ~KRB<%^dn
z9%;xjf~#GD1*J#(U(4$LA3}@Ny!@i_7#WM>@93uzMMfzk?!>0tt~;gLcqvr7tE*!`
zRQbBulgfTwfs<0pUrM%V-*PcszLw5eQ%@&DfEsf4V%TKm%4mU$E~!wjXOT|}a{!%U
zWn-gwqgZs8z|;PfoML9nH_JxOUXpXT!isas*Vvs!y(!*F(~6RhT`Uy0k2AgG`RqYv
zz>WOEU;=O4+P61$#XKJ_=83sWA|52veB1rbvz;<30wXE{E%)e?1X4mjDDR5B0&tWp
z@Cct-=$T5A45bB*;j4}rZgMx?XXX8KiSwB+#LnRBZl23{?|x&1c*^W_Snw#11&-C{
zv74krWs+}#pf_J^anj#L_2H3Mw>YM#Y@G7&QM)FyzoN3DG@}K(1v`FCl0g1FAMy?b
z3l;h#8NOv4()J0ubjr%fhm?XSizjLw-S7F`v|^nJ%VHF%W>}1~?<#dv5j@2n6JeJ>
zVP(bN%$C)s(PnK+{svofXsZDo@S@5cZ<YuSWJhm`HE2DXkZ0^ZVM%#?kz+Vjt(hVp
z&>6&~m;Vouk)KOJ|Cf#@bG+AcFi|qX45evXRRm>14Q2j0=ajZF`y2iA*V<`x_b&SD
zvN5_{wYeXlA6Kd8nBYp`k$Wne(YAqs{Hgbudm>vRTia)-IM3W7M->W9;tg)%4G+4y
z5sSh4LrLa}aV*oL)4v({*NoF(Shp#^JRgq|=_BF5`=QXreMF+Jl!}w;BJn44TVlFj
zI#QruWkzx$B&qt!bz{Amk!-I7N{duVi<hVM?}fHU%K*xe5^bLneUA5s9ngQ&p}Kp-
zeDPIIQJKg+{=&^sU)l$@pT;7)-hIEs6XCa7q#+$NA;&6iW^C^Yb)@KvArnKo*yVnr
zAkQu8Jd+v4nIerH&$06EE8cD{0ZdnTFo)&Wx+UE_?Oi{`p4Ah@5<!_uG$m`5WU?8Y
z%(<BLPL?odM4TA<;7b35uwxUGTMWq<@etMvE1}to9huj7Rh$x}JK4B`dqglWdc!>%
zqh2Ltv)XE9yqd>u3oTS&x;#}Tyrvson`(un6v2n|(bax=IZNnRV)1R3+toEA9M$Ct
z84Yj40&>Qr-=;cT64)M#j@mf!9yOn_CFJ$z@^xKt8-1%qS>F;GOX#gcy!lMI5Y;Xs
zhmrRpjkKHrx^HSkn<NQECX_yvf3UgoPTD^_o0?!v_YAu(N2Sjh%JY_rQ+y92ABH}D
zbT2aW0~}x2lLYRY>{2=Y9vpPyBd<+R$`*Wy3za>kIOvV62#n8GyWKn&n9z}NCu9&Q
zh}OOj2Kjg?lUZ3$)N*)Ot1;G5)}^pSHo5=l0G5P<0Uwg&<<Acsqk6?ZzPO3S<S%zK
zJGE$1y+dr{v0L?}_q}WhVcvTM{oqucqy4W>sr_%Fg<*$NU$d&|i3g?ctJA2_COcy>
zWV#+S-DMU^BynkSHmPg*vSE)C!!3}S7c^uJ*wC=XFQu7OmG+p4QMwWDQ?aiEd6Ruq
zzB%1-VqM(oRl)0fExl)MUGEYxCD*z9G5>mD@$9gOSAnup={KX0ExbvYfHn`TT;=bU
z3rR2eP<aWFmY9nq%J6J%>6uwuqh*+JT?rs&wb%c^#@daXDsb<0khY7&Qyib?zPia&
zZp)iB@Yv?Xm?=9B7k!d4eus)khYIQs7zo4uVMqZnmeHM>I>n7kA2dBv?=49=_^OR-
zI_iCiF(a<quq--%8hOn2GvC_b?f2$3c7}6kwg%TDyCwmg2zzvOW>|iGHDT4z2V$D9
z!N^w0=u10dxcqIo_S5@z!r}&vN?KoZ?pQB{&u_ZvZo3$~i0~UqD4u*b8Cdszf$$95
z5MEV!bp1y$Y11oAT5OTS@&v46qvWjdtFzOJr8eiDojx9IGni6v)v|Xv@(F7Mr$D&<
z;}Hr*iE_WiuX-oaT?1A%WN6OeKlIXXM7upzUqLH9tzQtH)-yj(QK7{79R_LW`{*Hm
z>lW+GrD<dGD!KmA&O+4f(@q;*%*49ZpB?Mcbe)X^20oo6YPR_{{p}$OBWfav$kLaR
z2mG~u-$FD(`kF)LzGi=S-AaF$;L8%2=$|G%h`p?A_1NY)VV^=C{Y+|V?vmJ2TG$hE
zK3-jFA6(3A_QF_Yi}vf(N%tMdU9#eo=e2B)rP1|yqlRUR&get^z8SD*rDn_X-(7l<
z0fV5lO*yY8^hPOvPgSYDM>}FrW3f>Kt(p;C0=}-?l||DsbG+f)>-J-eEqo$xS5Lfj
zx+aGmq~muM7stXevx?8K?OOTHZ84^T+{N$?0N65gH8XT>W8-3q%kCoH!T_G2WO<w4
zT30TmS1yg0?hVtn?yVi|3*z@3A9*nbCJ7co<JE9SUrRXP+P8V{6a-A@1mw^K$9MK5
zGjrYBjgT4i??qeGMPH})2ZD<0yH1fpBz;Q910f%ZxEB_>-IiV&)K6I5A;(y|yNXK(
zI40U|p7v9n@}u*-)qTwZ&mc0(QTzF^3AbgEPe$XBt08aH-?2jSVhGV3yGvx7b6k4&
z&@L^vR`c%j@8$r^1)cp@XZZfSAo%}p+0CTFd&*Dm$NSz?=0ufk;Zv+6IYEqLuo3H*
z;CjsD>H98b#Ya~$jZYG95cbnv#wZj|&&$huol~fPa#+EHw(1UrNS#{Rkb~RHSc-~p
ztq&P9DYWIz^sQ-{+Of~(V{Ual$!d^ge!d}raqM2AD*y8nA7{HYa0EIY2z)#dBm;M>
z<A1pEgms#f1~PCNgS#!5aDbXVd5W8AmCa?<v~p|Gp<C{Cff3*I#~#N>5e<bZXGS9Q
zmZ~pvAuRlbV!1<D{jb|Ht%;gTjp;9|&Hzq_(Bh>4=1*5|&+!~1*I3g<8|Yj;Pw95t
zG=54F3)@I+E9}GN$xx|MF1=>k%K@Bm<!_40ZnV-f<^@BxIEph=<ZDW-V{G%BiyoiS
zVGzZJ4pL*O^f|DMs~dK>EDKrD>dvDD1K`A8+FWOP|LP0z7CTAo(J;fy*<X|g6tOSh
zONTGiDV)T+Ccd_TXIYbRNwq%EzeTTF+T-&&Rdk5|GF6>1b;Y&&OZr9P(DH7{^LUok
z2?5QoSH(^jr0NVN7Qxk_3PBx?WoEGyJW{mftlN1BgiRBiNgZ3dIzpeT^lz_znQ(W;
zm>*rr(haawq0+3;PMqWKn9edTxvyx;(BM}R8(aTjQ~SmHAPVwy+`H5SmyK)%A{Uu*
ziWTv{@??ddpO>*c_JVB>tQ24nyrxXG;)%BR^x~|ETX?d$^Qdjs%E^nN_N8zy%0Xb;
zL~{5h^?Y^6;<_H5wLMPfS!FlUbK;##D-!oobg$Yq)apCY4F$B1D*L$CbXR;}y&DNY
zjk}Zaj^HlR(EFhhG-STR!&f2bb9!S5b+xPBvNC)ic_BoSQ-XJFatF$BGPXukNs^$J
z(jv22rh2iucsk@6d1K#}6x5*BnL{au-cMatB}0&Dg#r#wM1+8&7IsobC6&_pprte8
z91!ZA4s5uqAVt+V1cUfGu9nEw=J7wsljBpo9Pb_mgG^@Sv{R~(t3JAF=cH$RE46Rn
zYr|vcY&HfAlC4ixa(?A2`P(PQ>eQ)2UL>1FI>nry0Q|DhBfsqDCvE?C_+dz6lGx5d
zW<?!L{ckaz5lrS^ML*%GK!?=d?P^uG#rWbG|K-<@a`clVw2Q41t!}b@pr)-V5AD`r
zzbqs%OILHtkekuHUM)&`7kj$=@@jVT!2r$x`7!B}X7uT=4V(c7#-c#-O+VgFxy?lj
zp-BHXLm5G*U(F@XB^hgGn5Jr>x2hDE($zgxhe4?9I2}GK<iC<(ZX_i580SmtEAN>t
z=bf1_Ydb59vXF5+JuNHFX@Rs}y2p!{yg)N$gVABtFn~U<86~W4q$(se^UA=0iqmFl
zXkq-6gwJ!q+ZnD2RaM;m3Q>;K#ta@o?vWHIsjB4?1zgF+B+T+SG!~^)DLH~rVttE+
zGDeTZ6lwhpPTZQf@t7;!M448rCAoc^nDNwZ8V`vV<DPZ`DQSkh2-W&K0WE#2*SVhp
z9|t$rnWuUFf<nE?__bq=VjViKk9(Zg;Kv8DB;nRGt~wko8O13x0O%xL`_t@KWovuE
zj09yjO5qco%PSIzy(K5k)O;f{+Yq>GPDn=~QDY}b`TcszQ@Q-~7U08MN`*!DzVkAd
z1v1b~xZk3cnbzXu<GE^*aT?!F)-8re(Uwp7_@gjYX_B__L6*%luh>Boyi|?#SV@io
z&e&%somi8W%;S4peXhGCx34$w2t!FFGjEV|6g&o0`7_0cpAi5;IJVAc?K6cDOysE3
zqKp!W1<DVT@D&(CWeu*)U>VeW>J*a{6SXoOWlfc%9nrVR2-3N&ON}pwnfXl8sHl+M
zMiNS^>NU4@Yez7LR<$b}16}<z&57%Iw+O$nZOKz8UX1qh8@=P$M|+w#Jmd??Mi*l`
zBgqvVKXp0GG|RW|W2;q!Vl48H-A9ZNlVtGQDYX=?GvBvJiLpot!%lSraD~?b-ygGX
zSwwPJU(Z10JtXfo2QUq{dm$^no$`F0_LmlhfQjsr#wD5;&Nj&7p5Bot2y{zsMM6W0
zz@yM;{lZSYkn+X6O_mt{PYgQx+rBCD`=)OHr?erN+97+RA|w6k$yIabAbEPz$iYMm
z$;)Lc3}q&zt-ghHicrgTA%zPXqV*Kmo@cVh#|_$DB0?Miz&WY+YMe`AT5p}kdshTX
z)QSM7M(@VbWMCP2hb7drh<4k(|8=`H7m?@N3z!q_c8PQGRms<@Wzbtyi%RJdtYx;W
zD>F;2Il3A>J~g;pz9|XuA~~^AN{ReBu)LzIA8Ab&=VNELTFI_gBjIz0^riOabJl~C
zxwVh-RleF6%_WZO3+riJk{JKWHQnPyg5%iR8nCp934_=(TvoNe>%YJ|p??+k+3BT?
z&exG&wVzR+bW54CjUFusA<?&JZ^Zm;Z}$Yvl=>IStOajsI~;$^HK#30g^wvYxU*_&
zYph=o^m0W4N*4QhpgJ3lGp1VeG|4a0lU}Xc73zPXl0Q!nn?!roiY9=QrLTW|Bf?x~
zQTwKsu`IDB|F18!WtMYSM@1z)k$xRSO~ml5KKR|byOz@TN8_sL-+YSwFGk<Imz~uq
z7Qi*a<j8W9Al9y8Bwz^-$CVm$1WGSG^wd9!DYjUnZ*Jv#>C;P`s_iC3syffy7MYi6
z?sP9_nksF^J~)ZZxTSaV6ZFYwq!G?YCs!L$b3R3D@6~mGit$%;v>mBNM%Ht!)t~*^
zELzR2llu%C?ePQT%9%%Rus3RYjW{UsPA^aKR!>N<qOf0iBDvUBPwSn50(G%vEZsbx
z?ns0ltYeaKm)a-EiEgphR#hWq)+*Y>AtF#uExcn{US}lRo3zkDUeagAG}pyL+4>e|
zK1Zok6A$*#*Q<9*&lE9|OW=Hg9-q8SR(jDIsv6rQw;41<91bDMt<%XZGDjT|5$mpS
zHUA=%mdq&o0=;vnzVUnGYgy6O&u^I=Tt%mScmtMhahX=r2o?nQe&;;%s>1z~QB}~}
zN-^IXKK8MCBIpH97P?)y@8@#K4X>dX<bL;a-nLlWY`uRyJITXpQ_^6dU&VQtb8HGp
z_L!-|iIIUAUc#?AsE$5VF$+i|mCJx<XhlO)gg@zSJrEe_BqLy^do~p(w?u@3I*l=G
z($M+3YE+GX@?{b)QZo%%68{_o7YT{0yykVgKV4X&{eYSg;J@Bdo2S=bF=AAZvu8jG
zpOQzJ&vFQ`=;?Z9(Xn=6Ojj@Tat+h%YWs)f-4kcDhayB#ea-|dzPJ`i%0fZICwEMj
zkx_KVr|^b{+}Lw&Mm`5ehAY&br=c9lr$#-+ZkPc^18SVz-{&2^vyHJD(!AbPH!XbO
zJT-+lUeicO_cBRMUw^ejY5Wh9QRi;no`iZQ)K1=BH_2uwIYVVYraG_g_@~0?au*t^
zx#bKBQ`eZJ0G)buIh-3kR;#36x$0*}mL*-i#9<K1Ud8<BYdo0+F?c2YeB11w#Dn^i
zPqZ+#Q;rGZ;VM&bT^j_}S+g%PURx5p!ysm(D|^+rljki7m%gRaMQni%Re=so<pb7Y
zFEZi_ZEvSMmzVtUF4;)~S^9>$Zz6&ZoReGe*u*}<Am-WME>R>2P$;p-IFqyw^t?SC
z7s?nj+<9g6b64J}{7><8@qB3`9HLvYjI5*q0vfWYzDIMJe|{|Oe@Q)}g{#BYPm`~S
zj*;@PsJHY~YTA8j%@urVbkT!+j@x&tj5&Fdv@6F_xI3)crCXSu<vOztg?_MvN_J^#
zb6DdUIpOEBA0wh<M8CXwIimH_oZdXu@KRW=Q0h$^AQ-t^$d#XdQE<@)(}jA*3$n%5
zEv9HDxLiG^DeG)`^~$U4ev@N3g`McAC?7@`>An~DmBL-nnTsD>Xr(V<Z=ZUg_$96G
zWt$@FXj<W|EO{EuHet9cx<hiu*;(+NP3+mh0l#4l%I^ggWEL9^zJ+GxPwq+iztw1U
z89lM>?$WGmVRJhCxo?QLyzS&h&sei#Z+*bhwBWb<{Dy|lIZT7>s7@SrS`lfaiKv?N
zV(AoA#N-n!e}lEI!3(*wJv(b(pPJKb+{KsKvp!{xFX@N-#&)Zsbw)@KN?>{VrGOsc
z%gP!eVk_T~Wr?!bf)H7fK<gQgZw9Y2Pgw@fz6Z()<N%Ygw{j85tCTgbnYnN_p|(3d
zSG9_^F}|JEJ4O6WqnG2mptZ%|iSiO>e)__@J~u^1#|yJZ17^zvhe8HwcFu;BoL@Yp
zI2&=I0!XNKTcbZsx!#u1jh!Oh_Vw%Nc9=n3#Oj&xp<&uDXWlf7hzSpQXFaS%3W0=3
zm?(;^(3HQrUF)*4Ve>Rm{(C=P)YsXl@HM;zD}K#+86ndgmGqAH_N_yl&tlzdm@Qac
zZi*{YcfD-uSsHH(*Im=Q>P#6DAk`m9Fk1L{WEo}4>S<9)?8Mns!u$s_?w;ZtSUL%-
zr^h>jgk*f#l86(+@~GM64WyOWqZte5W@|1Poi__!ugK?;Cx7%sx;t@MENt~v2en=@
zOZsp&rA5cMrXtQ)VO}Jzq$Z7Exhd?ClS$5+c5>2VR-^Np)r{2~%E$8^=&`d>(G<p{
zr>xvv{pICfirui0zE^u|Zk2h!deP{c>C3g-bA(N<tmSi8L#*uli!2sJUBA+?Rh^+u
z6ER&RMGfUkD5I^}A@3^Vc6r^q@=W~EgH?)3b`}V$RZzOAUCXgLJGX2vV6-?!N>`$S
zdmj{vD#nerzFL5a?U0PUrfj`eW@Q;!_<AJ@JB#ARGG<uI6zvn8ykm7U@^sF17EKR0
zKBEV%zgIm@6*Z~hSY5IW9oinPanfs-5ZsQ-w3%TpnTuF*fh63`EykUnX(9J_(8u1h
zPj3Zb5Zp-#ni$#4@hF#*En^P^WOdKpMeiA)#tzmFYgi_!*S$OLq0kcHs<U<>T$Wgu
z1zddz36Lw4k+3gz^QDZzL8+*^1Ah0-f+EV%by&|lg2)el=)xiH$hAx3u$edav~ou4
zwJi)Yym_L&(<SXThcv3sX@bj8;=Hr9&%;Jccq2@3Ic?t6oD3kH;b&##JB3u=k*vqt
zhizz<lz-+Oj@S3k$0TP*Rwa41tgNpAaZFW?E_9|4SF*LhF0$KYm67Lsuzd_li^Ma_
z8=(%kIGSPUL1q~$(=yc$0fST#ow!DIZ%f<?U4M|3ogu=wli<!pQX0DALXJY(ijX%z
z6a%dTe9AKyf*7sMQRpxF86}@#&BfIW9>ur7aia9|V-AXXWy>pB)XxK0uD201!t4xr
zA`=-rvdX%+S69e)UDc%X`|QtNDGB**M%V(ssaw~s-(k{kXJO8YVN@j=|AK-O3eytf
zT;`&-vm3U{RqSsKhIcwDmg4=%0e>6ye+keY8L}US%=66VDXVU>9rDh6i*DX=hxDp-
zYNq7I^GKf}f)yp9)DX_^97|B|LH4KBu@bKeS>$p*Ub>O`K#|drT5hd@LYFZ-hEoDv
z#mU&xLFfEvt=4E#d;esaEa6xjv6x~~-utl2D%;66i`Z@{vN$XqbyC)qS7?hqiJ}*0
zTGd5+CTTL?@qGE!Ob;@pc_zHylRw7!gjIWmB_6im%5AeRR98d1Vg^+jd!I+MV`3>2
z9>dx~g8=VFS-o*Q-s#=9dDO2lHN-zL|F$lO%Q<-i1~GCg$XE;4{FuPguat&F_c-xV
zeAs0FHh+&U7qK3v^^E<;OwIh_i8DFC!YmZO<VyF=)8~eR91UytNGY)UABy{}eYu-u
z$ljEguk${jr=v{L&1LfYb07Y=Cw`JD<yIfW&J3MRqf*AIlRFk^_U`M=<9$FO>+5^<
z=i3+;uX51lKcvpxfG(%&x4#)R6FX@-UkWz`{6n@U*GsXL6c{dea|b~&>uFOjFZar%
zj=PI-GW7}LdNjJ3c>1mBs-}L4G|^I1NpD!Bc3i`o&vJ45Ruq;LD;L(Yp#MEzH@N;e
zmZoLjsfKZ9TH;s8kpxpPNJ=mt6v=REQQ4l}Ey;rRW3VNGYEqy1rPKEJssij%0wT!=
zFCd=_nsMg{3YX5K(v+cU8fKJp5l0S+?(f(VWei=-{Fc2+_RuS};ClJW(<DZDo0sju
zSgA~5+aubE{ppW0pBr%%MZH6feSxd5YXN^<gzAi{+w1ypwB=-*oaxTc(2nzqyz%G;
ztjc4h=<7y{v#O0#2G%wX43BgHPt$MIkIT|yY-0rew&|KCJb!|LO5lUTl5suy3VUap
zYJA&qRpMT|6oWIgxUQQz?IgxAfs^X;?|9F2;x>JbGF%!V8QXx~_YnWmM`Y^6^=;96
z@uV$2ehu~Qd+QfNG3#zQWn-pd4U&92LGxlhw_nn?cC*d!;Y@`N41&GY5>f|)yxLB@
z(0^&|?2J>%r3J1B@6Z)RQ5huBc!ZHkU0fTfqvtA!Tulw;%6t2)dYx7@h5OARNsl4V
zviLF|REw}uy!~DdgH*?!`RMdSp(Ik}Y|q!nqoI)))W$6eV<KOjM_2{N+;ww@VG!zz
z@@7yoYx~o2!c%%V8Sy+?k>`D=P;QFb$9S_vVCi__P%MgMRGiqePwp_t#W+F@BZal@
z6|aKQqR7cAy|y0Y0MfdzXX;BuOqd(5@U~#uI5uE}pv<%SEgNA^Sf@@#I$Rj=#ml`<
z|7eM$GPL?d18b<fx>a!IvG%nvUyix-xmO$kY#Ay(2rmFI<YuY-9y}p;;;@so?y+jg
zAY4M%gmxkMNF-LQPwH!H72Bn;-MFc{$}_++#-xXmbvoq5w5E@?Pm+%)s!J9w`&HjS
zS;j;HAMLPOt6r=2_~Q;f(s5;FwC|p8v!^)A6UNotjP|Oqzk#f_xwhRx?j=|hZqfVR
zSf8_S^`al`Xm647t;aTcPK2DnL(a4snqPe|MFcHni&$R@7XVQXx%n%op!}RL&JKEx
z*@G_*4>=ie<AW%Ba^}&R-;j>1&Tnqdwr*LO**FcDp*kRacl7ll_rxJpGogBPQzTKr
z>UpP!=*g?);couhb;H1$OVr#lRZZ=y_8;}H1l)^8V_IQ=*J6b}-YssC{`DHWsw?@k
z6C*_xUMCC^cG00ISjeS?n9$y^tX&{4KiJ{DqjbzYAPgn^PZK{!*Z=b*8j1P&H$@$S
zoXVRNVx^@QG+m9ZTW2Nl#o$Z7Me*U)c@Zxx(ORJ(!S2BldZ8k0JKd53$pqCg5heF=
zmXbe_1-%<2tW&Qp3LnTUpCscI<FBb@3YO()s2uXaqr21l=FxVPheCHW?(^ZzCuE*?
z{HJe++VF~=@isKa+6r&wyIoJQ5Er~d1B2X!evwOjtui+uInNWq6-i?%G~`OYUOnWv
zFcR~<bY8M7l`{RiopFV;ruLibi$HNr5$;^VZkc^|?gtwilFOQOXBDbZN*5BkPvJir
zNC=A1oFb9F#tK1tsAAPKMixcL7UA)@$K3v{L^VZ=)dvAQw49zgB%8z?0|kCo)oP&B
zXRs9WWPUTDq|n*hn~L=BXybu347&ufi$7wEG0wvy3Lp&e@oVle(Uc}^_F02LuDWcW
z?zXZuO}QR+jG2uZ`c6^QbcuHO0%cUdlR){@l#k=zi@t7StaS^EE%Ym01*}M`X1$<g
zThFvFyP$QHX-a3A_6(NA{1okCTb<evXABT}F!8A|D(qx9st4EsMns#Q{03Vxu}{)H
z;b>`Ug_h|y?W@r^p*~3g!Vy*Hf~MTjC<IGW)@&4c;6?<)WI?TSC6j_Xe}IOcq$Isb
zgd^r5wAV73=39zJ$CmI(Z}E|J<?Y&U6%rANT!5)b3;slsG?TjkCDJF`X#V(JyD)-m
zl_+Ri&Ao+qCbE{<QBA$eCYvw0>_rF_QAhu3#<!$o1HIyeAF&M^7Zs(~|HIx}M#U9w
z*`h@tf#4n-f=eK{YY6V{?(R^y1p)-u;K3b&yF(QOcMtAXxRY0$bNck@?s5CPzHhwy
z<97e3LDks1s2aQW-gB-w*IZw-o9(AxK6~wi#rIGx#dXDsvk8flCHTDQp5zJ~q3Gz$
zJ43BOH*NrQ*X;I|xX^fr>h%vSm!beJ=STeNEv9%=SNG(6Fbx-bHxV5eLvdCy-85DI
z1*3_?Xs@alEvLxznvS!P``)nv+LwhUL!v*@*8jZu;yL1MzNk6_o5e;!wDnQOQ}fb}
zg;ODK!j$B(C*-jSD9RwG(QbMKl#RwI?xh-UIc3PBb9DHf4r7^_87Auf05E~x{p#P0
zfDPyDYwv2>!&s}4nFWpNqaB40SBad~FLN71JYR||S${MmmXx%A1+=oh)!N@NP7Y2q
zU)=~>`D%{N`kg=jgb5A<0o?ExxiI?xKofnmjqKOA-+DT<<}OQ)DH34JHY5jmdQO!!
zJbuY9@4|9dc|raFqB-p7brslFmlBerJ*Zk;UE+CNx7;?`NqP++H{Wv8<>M){c+fag
zASD-{)&rN4RU$3$DNO_~dD(4zc-gj{Jni|IZVH>%S6r`-FQ$fX-6QTjHfXxiQS?>3
z*XhV6E2Cu=2k^Qna7RV(S=MmZUbWG}c+%|t0ld3a(S#%yUTd#p#KsO+4`Y8Xf`xZ=
zh-B{l*ffd&AF)yPHS=S*rHgXkr>dSS=HlFlzU6<61i0FtHCZksef<P2w`P)?mS&h{
z+%sMsPJ73#Ldtn*>Dip-kL^y3n&rkNEBQ8y?;~R8(4!~*_LevGwr;89giL{P-pmiZ
zk5+}Q;x%4ujZ;@kWy-jsyZw8+ahDveIJ4>HKcv)rMg=9-J7J%3dKOp2+|zSxH;ef(
zRG>$xRGBcsE6+m_vRoZ>?XXk){ARtgYZe)bJnElKjTS-~R21gyD*zILuA;SB5}SH(
z8ZGXXL3FQ@h0aGsf^SJ7&@=0OvxLi6_RtnRiC)`g?{~{WyXjYtC@yp8gK(idadBXC
zyb`M)$_mC5FAdBbl(j-y-@&#R@&uwWy`7ik1f6Besg?Xc{UmGP=Q_`y=tJHpI6`kp
zFJplJPnfFzT|Wb6)dz9roy=`sZd)T7+&k3ksz!H8rVu4O)E|SjRe%6*^Y-BDT*wnB
zXWf@iJ1{UtIw{$8%_lxl@s6gJ9vPr8mIdIrK=CbdAOvo%!zm4N6m0)4$q!*2zy@C@
zkpAWq0hH(QBbVsE5%XB@^pscauz168<7T9><)bBrQ)QK-JB(AnfS9eXQ&iwc5@|%Y
zk8N6-Y*_l%*b#6bXKS^H(%&2Gh|H3K&Rgqk(zto2;qn7W*Z3h6!@hkhA%)+axKsLY
zy?(L|8;yZB5o$(1j`{^Ru4{ubuPi=Wi3{OY)$j<R0y#zSj7Vd@K5PGCJrc~yPI70~
z-1j2-q=opE^n6k@SxDp=C(3tY(7<`Vk3xU+v2l)ADAOfjjIpm!YRi-8>VvcODc+GA
zC?mi8QbM5wSTc`2wK*@en|Jm2`d@alBDyh2`=U~+V|!4905%fiRuPl4gKNa}bQGTy
z%8eY4Lhn}5>1ON;d>@rLW`<uGEDsqZ6Sz2r);yM;k8+j@C02{F<_xClPN0D&-!W)$
zI8%JXF2=~$`}x>=x9e~_=jkmJL)$rX3ilCB8pW)<%YB~Bn~z1cTiXd`?v(tUxF1K%
zBbbu=^E6(7#u*AU(c*oVHv)&eX>>DO&6a<?nGb!MtS~<CBd@KF+aN4Vbw(@__J#gq
z<ju4#hpVB7k@X!GQ12V=XEhMBM9HXvw!9Tl{RN_`>&hMRaYvbnle=9`bJPyVu`T#g
z0Bv0(#1qBAN}sx|)-VNbxi`xrJHu^nbu%loR84+Ykd*VAduhc^%qQ&JTK0D9A*G&f
zrUiw^8b88L1^v`bjzWgdC*JG_;<-D)E!Zk0xtX#H1lI)HBh^TB7kQT^1NQ{W(Yx|9
z3AQ;NG3zfh*{N<__4^&x^zRPHW%YIi;fTRWBa~=YXA*ERkk|Y?K<F-;CFq|ieCLr)
zdSj5`i()U~QDi+4wyRi^1@J=<1Z5`7Tm9n8_)&zo)B$;n+dd{7HaH=H8i52L*B2Ch
z@v>1+G#6PFjOfIuXn#zgV&}#xN1$NL+<Jpr3S%&ZrB}2|6fte%BlsBHH|NN_H1e$U
zX(#wa?XIQL-c$9NQPwr<hQbGBL{(&5o}kIsZ>avIn&XoA`rYvai_o)Rkm>Ns05Udw
z@Ms5lCoyB%+6FnE+V`lbj<Z`3)q$;hECnD3G@yzY=8-Wm!v_G1y8Xx@RmqFbNdo!G
zh9BCb@M*a94x~@+q?R()Ebyv+uqzN9EIK3*O(G3x&RIq)!kX|r+>Uy?WN{y{{9Xip
z>-|mJ=qq^6ok?w2IC)RSK#f2VoW#EgTPY!}oG0Dbn<psoE@|`p*o*||VNj)Z=b4SJ
zWFUKcx<-=j7dNuDuOgfI&PGR<ZxFl4@vbp`_zUv2p(D4x6vUqZ$fpgl|B>8sT$HqP
z!aN*F!jmNbR-H7kyB8oXJWxsB<T-hp{FU*87;h)i^zMIvJ~b*$)_4SHRaPM*XRg_k
ze?Tb$I)$!PdpN6xjUoj$scdWs+7y%x3_BiwR->!r!H)~3z%d#R4%T*0YYUrie%kN~
z;6mG%T~JeSshhewgkqk`3+82a&0cb~xL1>=kSYHGEGLALib6q8N4MWOBo_*L0%9^5
zMA7xqa&P+ulqL=Y2@GZCJJ#ohT*k&p&nm62w1<TjmGWp=MUe^Srs{`U^{T5cHurE^
zVsffJpVvJYyt+-%nROj-SZl0D7ek&nC9(ZNpY<b>jY&(B8E!K}4TM;@h&NrlU*RU`
zmK(u<{;%F{?!RB8;(uQMy9KNN_l{MCjsUKwblq(Pt0(-a$^J7t4qmgZ+24W0X0-zV
z>^T%4KfUx7$2W~4QZOx-WXK4|-g+#HEe8;5jd@)#2na4theoh;lKM6aJvsC=)bVv2
zm5T6Xh@+A|O?6k4$W5iNvS*=kytm3kty+hc8!9CS7~Kx$DK6|szhp2qx2xk7Xec8C
zvjPw&qvxc?$uT80MgZ#>Coa%3MzbY5V&^+{wE`8|StH}~tL6ntPt%VKwao{bTWLj<
znG;j;iOs6|Vf$`EIC4zN-TaBq56<96hRkG*G*QaR(cLnZK@PkE9F)f9DTLx9ZsiCO
z<s~SZ<Z@G3kxqzPa*B${IY7}SY%MBtaE*4vmDeNmEzIc_G<6|6{s+LOVb5X5C-d!B
zjhM$}Owoq-bG=Xd2qwMNZ+w0!zXy$~<ga(xkg{{@7W?E1l+sYM0}3LnlbMkNg7%d&
za*2g^mQ#VZ_cJgOtUB1)CK^h!C#N!W4)j=Y)dB)zUL!9>LY4D)ZlW@x<BvMpB6ZH3
z4J1Aq%WkVe-Jp_j(og=q+?5JSvkne3@m8<;Bn7pRQH4|v2TPnKcPgTbWW>sNS0ws4
z)#I>`Du$c8KJ)u}m=JfS%r*<CXthlXYh_Rx8iGkaWqD<J9&6R9@^E@`oYmV{uA~_L
zJuP1`!qC^)fRQg@3Sk0h9F+3GKJ$QazKXFg&QB(3P5O+xTNLkmjU?xmZAs&bQzB#p
zJbGJ9WeI`m4nc=GQ$8C0*4_39En&z;w?^QbPB2HlwTHkFr^~wnGY57rDsFZ8xXK0V
zFZrm-ijEX1FzJz7E@S?`>O-tEuLWAv-mCMEdwiM-;mn|qiYqcITVAx&`)w*3RkeTQ
zt-hs^=2xD}GyNem7~&7B8&-s96%!{Qw{(g&M4~+bEx`^QSJyR1qX?7S%wB8^jdG4}
z>9TYVoI)p^mmH16JK3cmip);~z+Q;N_*9LFywa*lGInmmY290jp+&Cmoy+_f&m7Tv
z6U|cCWiMJ2qX`fi;<Ln7q-8`c$S?R&=bA-&=2w(=94X0UCk~&$LSqT7x37qt_K)?$
z^KZ+<=Z^Jf4}XR4h!Q0?ax;);A#OdEqdG+wWif!PdKyBkB;+PG%=vkO!N1kFv)%41
zvUhh}vp8>&@(ybB^?~jOa!l9itc<O+Hj3`qNy0F(xZMLEuuWfs0C%T-9T;<utVb;;
z2_BY#L7v0ux#kQ_uVc+LH~C+Ak&5d70TkRWDUI7L>|~6YASMHMhU^siNb&%VyxtlL
z>#N~@h-VvuDLkJ&ztdLF<OtK;rP#A-;U!ZbWiH@@@k=u4Ioy59ZzFqQBYv6Zsg?8}
z&0Q5;m7HzkT%Jbzz1n{_>*w%=@PYHrJrMbVubXUeS&A=HCvJe!rwPnM@^(`J-bNo~
zT762d{=97jgdf)^!CKO7<}k3f9za26szIg8zwaX>il`ak=J&2-bV3X#@TDR7@6|%7
zbgXKu1X=V<flZkdo?7bX2=1{n|EojRh&SmvBq8fEMx}ap6XKIgI<aPkMb-(KIqhu0
z0bXl!T4y`w#2<UI2q4ph{QI?~dano_sieh49-4S!O{xZXJuZb7dW92YZh>>}8YU>y
z@{b+!!QlkNIf^`FnB4A41HD_moBFV4-!y9H1gUIN?rlSL#FNOS1a*Z{2tZoW@rd#H
z!CB&H`2FtEB)_8W2e#CF+ihIKLC|&-klVi+2LCgS>E9j;^@guM3=U;MqZ}A?i<1M6
z0h`=cLIDEeR?sN$K<X&7?xef8oRw7?bzX@SLVbNAn64`|HVj<C80i!Y<t<er6Fyi)
z3%!J^Rf{K0=7WOTaif3}!RAq3)TEi6R=TyNS=$R6b15r1gJDSKr%4^8g$nyORN)a>
zsAx@NCez*oReGm=$1G|USKQYnE?d8N?YXHG<biOQ3P!p(E^0+bTN@rm2M^lT&<+4~
z^MAB$U##1I{-6&UeibCO2J^e#uFgs`n6LDs8&Otg60DMg37v>Jj0hzJaH_4Y{dp>A
zat8-Y7%KJ1;Ji4BWX_0eB!i3<@1LoKedItOFz}%~r%v{BCzpr4<}-(-id9eQ1df?0
zxAG*Sw)tOFqrcQTL4QRjtF-q)g$+T_bSU&S(Ip~7?vxLcBjq&ZBJZ80e`;AH0VuOT
zVrw2$xfv-jZZduIWIgSjMtehV)q%$^RV-ESbq6hx6mHcPu6((qMNtxMC{W8tWgi;<
z04keDBs5w(DW#|fTE#Qaz_YdeM1!{4?(-9!Gbg9rTKP-R6;hI|dj0^e4wBeaN?6Bp
zGw5<NXbG@YLQJiBk1G;m-i>@1idB<9lrZ-1<rq33=-)nPcOJkc7dam{bh>}I%HN6$
z(KX}Mwja$?nLD<7XA7q*EiNqnT4H*RrS$L}Z}{Tw&=;re9B%&IY?Z0=@<n>0bpFNp
zmLymE0jSRNGV7v60sfXo|IDpR4!3(NfOCN<|L%QE(x@&(5*c+O8B9iC#d#DFNyTMZ
zR-0ZK+~bEf$FJsrtSy+$|8wwT;+$+GSy*5~hpeF?y3<@-fE3_iEbtl5ijy<c;2qa>
z(uMsSJSx{9mbf5<#iM!ngun|EBGZH0ubVVqeApPQ(p;UbNi7;*ksfWw9Q|^Cj5}Qh
z5YbYJzJ_mpZBxkYr#7OrK=Or|9w{4xN$ob{1Jq#x{b(`t_Vt^&LMfF+vme4e;X-4^
zbmZw?7=?%B2R^s2KN<AikjU2;u4wU?i?NBTnbJEh5$3_f{fg%ysozT$B7W4sZLmL?
z1#R><gjQqNis9qaJ~kP{Y=47kf&gJ>`FYMLdW10SsK>7~{f4N9C1b37eqov$znRY<
zO$|07b!$QA=JrXnwt_d;sP37YOxX7G^{?6|rI|1g2Oh35R!rqTqhx-_XrQcbOIjpr
zm7twBho^{j$y~;WBt<^^80wadtXI*|UZh|_;R|v^lnQvexJf_1%ogO7L1KfLXrbWh
zG}kkeb5_B3$pS4)hIbK{CLX1Hi|jt_Y%C)qYzc7Vbsw-qX9|>IMp)ICvKMH(nvKXU
zWaZ@DhJuxaxx#1$4CuuH@&2ucV<a6jbqxJB9#Ut5IYnW4A8MC=EK<a};vcQ}hC0I+
z*buajc_U?3g|^&PoeOZQgcw`tQ%=>tJD*fR&R?VKqO;FLb@aL%^)0hiFM;Oi*lj+Q
zdzQ53SV8O0Qcm%t&?*<JdJoSyWR$3RZ<3it;@{b&#ZrlXV-r6Lu%`$MvkI?Hg2^#w
zD|SBK=mbCGMDLwdYpAOehxO}M&s5q0S9T<x=AJ_v);p@Fr-o8hx#Z&gMdb&B5_39=
z7-e))(vSe!6F2@pSNwTF$uuF?(veYn;<VPF@wDU~6)3BrBgjj-jq}(7`Un>a%wd)$
z(d;Y=8VlctJU$%`F%;eg``qZiPbOv2Cp4rGj*5K?Xl!tH^k0Fkci|XPdzd})^UpLE
z=wMP`<n>*JD2U!#ooQ%6WW=ny4tNQYse2?4R2wP5)RQW48HQCKoD$ORvAX@Sd_Hda
z3RF~528|x*HB9c$on&{gBHPJkNat^RS<Hxw`*G*i7er(Va7hH}yhV&jH}~b+j0s4y
zFY|QrT_0LKYA#rPUkAL=Ng*?&W;W5?6#^nd0C-jKXF`E(66+<W?^Gx4XBTIJ+P55Q
zbz&tEdt~jp2M&W1f?zgUKEC!bIui=T9GxhNQJSoX{oIg($Xe1w^dZ0=4!L;H5ayu?
zfaU=)==VpuUG+<G%{FdHqmroaT-aWIcc;zH(|a!54fx5A+O(P+;{SEUoM=9R^j%v_
ztYuYcn<s=zbk=Us0p)`iXI}FbnZ2bsr74~6^N~FW5vr*D0)hj9hwC?C{Fr--BQ+fP
zG28tf_75BGAg3(EtTtx+MW<Lc-5JLjI_uf5av$V)TWCrKp|Bn}{$kbPSjg8jP1hso
z5Yj#_m8GiVC6L*>lhF>Yna0hQY1H@)-E%GZICzvwy}5NgRH@OsJ>Q8v)@K`4l;%Yj
zY^tCWU6hk(&eVF~=5ZGQZzSgw+`6ns*An-HF=l~ekTl;TcJhIgIn*eTk%NS{=&NBP
zZcE!YuZ!j!<ZBCoKI|s)nz*;c2B`&%<jC2=Kh}_aH#5#+;498*cS`I*c(l$_tq0Jr
z=}Zj8um2Zt_1|e9oQnKgZ<QG}{mF&4c;O4(WBsN9no4Gu$f-!(%s5u)l|f@_I@=KS
z!<wKjjPZwAc%Yz9K)H|iW)`q(?4t5U45FTGh3(+iY16!(P6=&8fm!x-$#5lRD63oq
za$cqG%nrv-#@}T$d|hir;jc?ccPJS9WhzS_X>zg^JlEO4qQ`Gp4XOr}hW(%~jRe38
zzh<%=aqqzhs#DrlE#s}c@W73akElWZ13=#|DcfgT<QzZZ5(nSvy7F{`bHK(neTS<I
z18ojP5`~B7`3T`~rBt8gBhcWyozY+$7{218U{4%u*W0de9T-B-*4?asL!|$aRR4$P
z(m$&Ig_*RdMlLkny&FfDdQL=PNF9hg!ojX32|!MpsGBrRw9kw*q1XmVkxtehALj%M
zsv1e1PCvVG7nw-*HWSy^sqf`d0s^Dvx1QwW>0Z+o+SifrLM!RXL}glS$HJL!GEyg7
z3wBtNzk7?OuM4#)a0Cj<Z=CPkC)i`=U>j#!^tgHk0-%H>1Nr;-njdwgzKxe(DrtiG
zH;Tx|YRHd=v<Zpkny=2usq4m0)H&1>b3>wI8`ejQp!9r@QH@w!;6wH0SgZg2VcN9Y
zx7KTNDa6lSP}cI?u88fTV>}%{KRM0eJp@s=;sp6`r#W^$d5vKQB`UXr>WS#Y$O^D=
zzaqLB|F*gQX=XHh!hHwS@911l+pW5?X`P{C2*e;e5(#`}&xmKqV#2<j$>hwbTwDZ@
zlW%-t`(jk*E9aseTH)rk>l#A7i;>d>I2)_l)Vfr?U>hq7FHxz0#`th(xRu0QN!~#m
z!hBSAh~Z_j4!AE`bjzKBSdxDCF`a%VZXQK-lA~UUQ~H)rr?xOQC%P^KZ_`2F8p=qj
zkR@rF^2?@B9R0KK;3_pUGXnSFKo@0z?`iic%%u#H6HRzQf?BIvuNYySB1lp{UDBK^
zlrS6+d?Qlffa9YF$qu=kZJ01?oIa_DbnG`Xm+r&DA4sGVE(PG}X2h~gSIIg)mZjy@
z2p||@zY`?aEjxSexS;9Ees$SSzW$M4ir4xgL|n%RU(z@hU59^1BrY%(2LD&aS>8rf
z#BVH!S|qL@Y3Q7ibHPT#6bVOT<hxy$%1;T&+<=T|r&xs`VAY03gpZ1elS%0T+5Uwr
zHRpIwTyZy*2AMrQ+eG-*D`#O2(D)ffP(78=5HX@m3JRfT`{*I46PsUV!+R<C`r#W2
z&*Q-4uUX{?a<@gLf$ju~$`c-204hUBZp3b4M&`oqsB`gM{!6f|gzVA*=27<yEo4{o
zWH&`)irK}+<>N3a;58*#%_eNLMgmA)q8Vrc{*8M3)d;7u1SQeqlV;b{l?b7IQYg$f
z541ruIKb~8rWRXX3_xQV;wuR|B42GUncw;r6IpDxuWdY>7{|Vx#`obUHfX%h5?JWP
zV3L7}b`*8V66Oc`hx1ca-CE7tq^Zs1zInULY9Ic+at&7`$s`i;cFz~Zl?3UwWWxbz
z&<gQ)`*ji$%B%()Gc7h#zcUgU02$zju;&TCCxqam0BMY@$g9q>tZ=Z;JKvr<6<*x_
zS;%3`IT$|=TSD5y1FMFp)<KLvUb0?o0K1i9pFLN!>=P*F%d#00NFaArl)jGpJkp`}
zLzKS~!aX=hdE#a-K>@vj-#GK5_3LBJKGHeC@jho=$MB|vC2ME^*47i_;y~igtO8<2
z%8~mg(Y&|Pb%InyexbzJN?JtSI*VN4r**r1(R1pLJ3NFL_n})cMe?26-MMLYwl?DJ
z(yTj$M`NlJZ4xFWKVFHz-63sDcVQ~r__x2XxF&|)LvP75`J5tzT&CJ3vVYIwe)L$B
zt@nLQ`vdrR{t%;ro%^%SAIs`Kx$gq*9Wwk$KKCwnmjIejOuYl*3j4KSe3Z3Y-iX`^
zS^;(<qWQq&3lnp%JY{8xNoqwiS!~#7ubz&TU{(a@c2-qaDko<i(a6c@Lz&!{uH-tq
z-iN3;2*;QWRwn(ggN=30@8}J4d>$mdg1fM16*7$K8`FWU!!ZvP&m8l&)<be<X6;uU
zMdm5Exy<omw4)vta3nt>-SD94V=EWS$b-=Wdb_HGi#?w>C-#(gm?LcV$>L1Mk){dp
z*1V@3oR++#p^uLD9$&fg=^O~hVA*~KsU+0l;*%AE4wkETf3DetDmmG)T|`tnrblKj
zLPgsA0H`|)JLv;|7To8D*TUfI#93R!dF^deQu7doXO<Y$3x~=>)CkCk@q-xjtwLFn
zytj8aS#3*-U0aLak3Ig4O+pnK%n}~`)GMX9>}cA`Qq7jwiGyhECSI2r%dxUH7YLWg
z+3U5|N$TgGCcE6vL9c;$0P)X;m9s)0$u^@?Dd)!g7$NZCJ`9w90E>&d8?#JuTlA&@
zC3dAA(eG&RP(rs%kt3!d3jGdPx7sq2>i06o^tgoOm6C>vw0aR+xWWKDz#7K*IokL$
z#%<oZ0{)Vi5kF)}f2F@hPw>*GQuB!AjZuT_Zs1Jd{xr&+r7`D?)>jT6!RK>9-rSCg
zv(BzlG#lI$EK3Zins)HjyAVvhvK;F;;8O1uSPQVo>B6~KjpBd3@e$t6*BLxiAFm$4
z@I6C{=!<u>21P91D`9>|rx6VlUY!cmG|e<Ocdv|kU$+OoJr*lcR7MAswmAI*+c`G&
zFjyR9b!KjO^Km>2A)mPJs_$(`Ib7jw2KjpjHP|gpYAHiz>Y86iC|)g_l9{X)iB5Lp
z+#Z*K*Rw-X)Enro{Tpnj3^h&k;__gd9f3&OWyM`<aglC>hI8~u8slKR<qRvPq9J{j
zxf6b+4PObZR=s$=U%J%L@)w!h6ehD2+k$A5CJmGuv0>Nf?w%iC1O4@5q4%&Kum0x&
zJq8RqQjq6@($e;VT2IQro#w@MD4OUR?&25WHS>|1ad+#>4-8h=5%%6kSCAuF;u{-E
zW(lhcavw%}Zo&$UwvI4#6S$>QrpVsJS6SSt@C@)tYzIm5pXuqjPjxqzk8w7bCMPC6
zj_Qa)^g^>nsCJh2UCvXn5c5b^2H~sxZH-%i6Xa1QQEC{%YHD}@)Br?nh6eOVoZJ|u
z0<9U3^rq(gJoY4U<B2qBTEGalc>+7K_U1FCRf%A7<6)hQ?WgMJa~2S<OOUu=Vat7$
zzZK3^;%p-<i*$hkEXA@#(*e{!j@$hfUO|xcD>rq$PVL)+l&yn#eG^_XH9e49a8n>g
z=~(R$WWC6?uhP;2Jvsiq*7m=Z*8V|iv|O~RV1-X=pz8)WOFk!M>ZCE8)YD7y=>+Zx
zjam{gE-m!~Ua|j$sXcRWLlYpWrBJ<wT_xo8`yQyrkTp8#-OS%=nI;as@Lcb+rbp1b
zCyQ$9vd#^d7OCS}AiTadg;Q-G;))ZL6VcyDzwdgK(`r3?9h#9Po{2diAw+{9L~<pK
zyS(seap0>gq^6Qo(HH#enX`GuVZW<8RX5<1PN^jg9Z6x(-}&S=WN>iPxPT@5+4QMz
z&G#kemP>a*RV^*$L!FgVu5S=jGuS}!2k_y=BAN9iD=6@ezWK}74HyJCThbxYnj;o`
z5BOmk?+7SQUvd78ZDjAW?+FXL4ZnQz$dKJJ&GgZc+UO_I7o`B9v37=31uQ(fGG2yb
zuip#TpE|rf=(|4dj=0P%CXF0oF(iEgoR7!0d8^UW>okLv+YT&$2SW3sEQqv~wLL;;
zK5`p%QgxXeBk8Oqt>42o0M)Mp`J3Q~j*!K9EwDG=(U?Yj`HRk!P+8lZjrJ(EaTt~&
zR}HM7RCn@qj!eE)3BFi6;n_q=$hd}!0YVJAj$x%_WGa9iCB@{S@zl0DZ=sp~N*F_y
znD4R6@p;??f^4@#>zS{9t4-OP%(`KlDLL3~iHqQWFke&w_<J~wzJaH7lR(XFE^Q@=
zWX33LKEtdze)0<y3h6+wBq3_bRyw1)w;mVH{fyOr4K!Z#U>o3y?S;+Zb802qjUvT)
zRD~1;xjxu@MC-RIZharmV8<#s`<u)lb2t@2Vbl>uU;rji5M{F}-0%HahLcFK9C1Y&
z^=y6Z?>K1>`{lLjW$}0TYj${mcm*7(4Q%%Oa!l~2`0ZZt-@fv@pjE6#sg3m3sJW^6
z{TheQ)eW(^2=jm!>PF_$8Z8fi$LUoPbNMANe{`{{tVYV7IS(btl>h#;CW%{%i6o(f
zY_C4bGFi-)6FPZ&H;4Q7A>%+%5Rb^YEsNDzptiRY+XsJ>k>!{prM|{paZ1a&mA?=)
z)!R7G>$J)3kisX<u+_o<4I_2yxVle(XY!l%%ZBe=zy?r$YrKBS&*hl*d0Q`S9;A;?
zNtp!Zi8NhXLx01ZM|4Z`ji0y@sD5JU79|K=k2avQPr~b_1Bnl^1jn*Pw>!hYp{&CD
zXr4)gl#dj&_i4-qzz}J4=VJf>FbIaiU9k3!e5my&emJ-7>k8Ob8*@7GC`<>NKFSNf
zGa)sGSFy#P3V^*P8IdG!XFySUnW>YTA^kod;|&7O-Ec0eBA;Jbc{s{&eK{fNxvWWQ
zY))+NST+iE)Fs^*WE>R-@Q~na#Jsuv+Vfj$uCDpmB!STESDR_Zx<?5^>o$$OOJIia
z&k}Lh8wng+Ds3UmsZP;ssAo>`ogrtUO{3WA{P|g;Enw^Wwx7!Z-d1!buiO2cz>BN5
z80D2nH6pKWQDK=y^>aoMhODs(s>!LpXmU>{z^iNgiV1xTJ=Bnm)+c(3w{P8GmO{Q)
z)4t&r&Em$}CG%3BC|kb&K;l;yP31FpM^YuDsm&FBxgz^H$Siap%sdD}bqeqz@iNJ_
zUa3e>Fxj`9Ez;(n-by3ZuV16pkb%Utv?UpZ53TUYoPV%<!zy(gvXU*TuVrS#alEWP
zTV0nR>0Vmp|J>N_K}zC=P!|)D_Ju`yw#wDGF3|Yb?gu0qVwfmhB8UX>nU3g+yl=Gb
zXk$&m?Gt!NkalKk?opz|dNL=fipKMcccU#Fq`7PK%^OEvbv<m2w3U^GyUVRz8aloP
zsFXtf=^tPiO%}ohQoy`*zRZ+A*wp>$+kbpYLv@4BJVb~5LdbM+*RbMF{NCNxubtvr
zo$DNMq3=(&iP<x9u$B?NDkXv!qNvmiK*bA?Qe@adWGGCgFM!HxjIvZbhc-eK$L$~2
zPrtfmziSMu8^SxbAL)#JAC6%p+Qmw~x#gT^MK4U2#VRF;{~&*x=Dmt5y1s=8wkaeZ
zBySLo*FtBuwSa>&>n20jdLY>0Cp>fL7sRRNRG&j%)kf*i^;j=B575g|425H2Ip2jP
zGNIxB8g`XFhJM)C(opn1{^UfIB6Ijtbf5-hY$-sItqb5@VPkAW@AFf=W5<<wDoWm}
zb;*P?g0>Q?=^wi*|NA~~xU51tXo=5{)45X=k}~HLXNh&14hEB9s6mN|7#0r*@!Xw-
zLFM!KX??2uqC^<TL-r0K-+h$#oSW!E?>T0zLa^s^@^;#}B0^sTe~0(+ZexjH$M*vl
zJy(c>XYEME_kscrf3}qIM|`8AS}D(ld)>#v&ppK;!4pXV?*|i{De-V@>$uWfTEx;k
z0L(ayOd3PWzYvq@7h;mfo@ibikek4+_-fKTLRy%~GJgacSzC5eIY6olpB-QxE!B0X
zt?tEt5it3@F8~%wvME>BHnyiygARSDE^wOPVITW~wDDx_`{_m{83Zt4{Z#$N6JE3~
zp3@PYl8dIu`Vx)kkq1(c(ko|A$Vjp{Q}Lm&DPo6vrU*4)fQ{i*A11TsLw;a1%ZM%z
ztU7sok`KAW9dn&HR%?MP*>Z<-iQJ^Y=bw{#5W20r=@&$6vC}{2%aoqI7IVq|jqSr*
ziyB~Wq1FX}>mpJWXFnaZGjplopyzfmkX#bol4fYQ9r@9_z8bbzpPAVft0g()^s45y
zUS&@7Fn|-DDUX<QGaki>V{4R&)yWsl9#bVE{zV&=68X=hQ4QBrS&xWj7=z%1JO6C2
z0(o)TgI|unoKXPL<;oEeE5os%<H(vIr^~Wr_mp?>VaK_igimo(2i_{;17FnA8Kh3B
z&X04g2s_{vN{;me)7L*ozICG$fi1Um6v9%se}u-k1`MZiwGf_n5zyw^4L-V<A=!|l
zaP?G!vh0g!xwmpN00JXgt#e20^FC3W9C0ZDSYJrCZvFuH=NOBv8`A=XEEA88zV*cP
zK3c~Xjo5wLm04$ZBUV3E6xzqk%>48bQ3x@g4qjSG$vfnPkz2(|=C$&$up;yZDk2HY
zt*PQD11f!iA4!R27F6^dyH&@zdc4W^9DW5G8^Qeg9l6>jaXnX+TNC4|smyL8KK;DG
z=uf886Z>zTH4VLwfOW6k0=3)(3-*Iw-XYjZl28Y(WfkF(|BNeQQ|dC4<GF9N)PC0p
zTNqQsP=N^so(~oyI+YAJckAeHyePghuj~2s9KVIfwiWJ@-JGNMVDAS6VR$P?RGp+d
zaRnX_t3(ITVJ$nPO@QEl;A-eV!M0FJdn>FW#m4@($~a6AenebGjM&*K=m|@r(b9)|
z;*cPEH!`l-=u3dG@%+=;C^Pz6fS(b_OPyF$yAqs3glxrR`?<W;jRwNiZ3o+1MFsk4
zGRJgd&gO(VpQo3Pv7KxPP8hQI(FJGP3eLv8{0KMPBA8^^5^|jPlw~8SGY~yZ25Wzu
zZ|c~p>J$nOXLySi<wpTb=-<wpKJ`h*1>fTov-CdF#Kr3*!SB$(7c#^YefSiyonOwg
zxhdytl;<FHc*R#m<fCv#8sShG292;>HY4S`<DMreVF3{NXy3>N4%)NIzY306x6Exe
zqoHy4yvQg#rE!0OpMO>bqV9GJVL|;Cn^xb(sa31$BZ=zf*cQBLbey+?F@Uqi$iP_P
zes6G42lcJZ2D1PBeSL=dTtbq;&sE!GhR}~8nuB=mqrG*-Jp8ahHd_Y_)^58fToQW7
zcG|r9hqZ#4XRBT9A2ph6#!wVUVt6Dz+M0YsuECVv%mA@Ex(5M3*e2Q8Z940E20dQs
z3pVO8Z;^+Hx}_o<SuVuqdy$!M@VfzLI)blnlQu}-<j3w$fn7|8>g_&qNnu+!@x{J*
zEiYpM56>SY4DJA`KwA?-_!WwtQndd@krwqc$7>9CS#c0ltMF`H;)1(*7nAhbXWg8k
zf)`rz$F4ixh<lU%Y`~?>Kw)~XhRc4VL}HLRYj@A4y~1d-EoNT>PuCuN@NHgq)_cg$
zsQP1iZ_TYPEg<mU1RVNJ{!#35`5QsXo#59g-k<ynLE2^cb;oms>?|Rl$$R#@d6BMg
z7BuaILo1V&SUy(Z2X}~m8?4oyMaZM7tph_bfL`v*vqm@S{Hc?B4;5;Ol3u4y&z^!C
zu9bA#!cEM>DJ9(J3yen{(eP<a21$AwNxC5l;@_YyI<g&2Ym?Z!2sfTBk5}9?;~0am
z0P$jZ?~`4;s)VbGPkIKL9n+P#>{;iYOq814i1_o>u#_35H`FbMQlLcR8;gqX8`i2h
zuQfK}q@h^N*89KL@Au!KkFsKgu;)IxaDqD|r{0;3Jp;g!5jcG|MdUpr&LltaS>7qA
zEi;mSVf>M&*amUT{u>dQsSKx@PKF^7(WOw5*PCza#C)=8Jfjca61&mfuWNcB3ROA<
z>fyMnbpOQ+N}f&`-ep%n*k5!t*vBY1+U1E?9RUAOiRE=WoZHtU#!juA?-tRfy`WKc
zBi=e;#7<Np?@nVAqqb~95~H@F#e2bTW$5xW@HDUq!aa$v<l(97$}hurVG5om{p)xh
z%e0JZrm(zm)Jgl6tM8Q@tCKA9##m6ePV#OZz>o^nh#^_wVO5rA>g|}xS_ijApNi5W
zgHw{uC+mTDiMS!j{_j_m<7~zkx^dw;YV)1H?G?5)Pbv6t-OWvwGtxpma~s18vOY&}
z9Gr9uKgv1t&P5%sBc@4L48<i-gsSO#nFImHitOvLO7Ix93V7K{kFnh`C96SW6!hdl
z!^4gMVkwTHNAxph$ZB7co!wTl9)n8y(TBG9rF0BI*1Y#&gA^eaU4xadYSSlIGQk{M
z<-3%n7TdDdN=rYU>-85s?d-{$8j>X~!h6A#wrX*K17y)6@ELO`vI^`85%X8YhIj92
z2Ty$I9+dZ3bb$`?bL5Tgt#wVf=TZd72)bA)+@r7|NC^R^0*f8yRrQxhWd`8}$c8CO
z0Uxvr%EWl#NGSsn&4oQoPzw?>;z9&$Hio`aH8dq7ea{aCe$S5^DA2+qLKoRW_g339
zY)%rZB|+3bEWG*bswCz_ob#V?2<SHWN}xnH!ZY$D$5L51b<kD8EA;fwI+SMJwvP*o
z3iem#r+v5twgwhc##;D57;cf<7l5D62AnJ@j<?CJU(i|Ms3_J4yr)dMGbIZg6l%ev
z+2fsK+0YTSD3@*O8Sv@ft%mkP?KGye;?Q34Eh-h^cRSq09q`uw&iw;;Ap&{&*nT*Y
zDq`H~3Mz!FPA|I7Tg3co0IHNgF(W2w;tLf38tdw8Xz`E)_{Xek&ZSJPtVws#@*w5`
zl$%*g<61q+b-J`vSepP*`F4-bNx^QuPR<JH6m~*g-1;3!+7TMeNm7!~0s!GJ;)ub&
zh$EZ|)wT3bmBtj`UWa{nyWK^$YiP_e#a;NXBp~5GB>}=T8PF-rduWJ{_z-X?V7k8f
z51?+VF?><IO;tyYD07D`!^pp_&yC+H?9t<_^Yg^<Z&Fn3Sq|bcd<y4Y3|N?NCO5&{
zT`EB^cVF@MHQio&Rf6-NETGcobH(;_!un~q9id31E-;X6){P<vF3cy)PZtLP=qGje
z-CY?+a_h_h<bZr@NX#YL_&gQ=n^H4*B#u$hb)LuqdT8Aw_gHzr0l-bL_HN|K<BI;S
zUCS|@1&mn`D-2-}rt@;+uoV9$cNbAT8hUPplqOY76vyD#sJ79({w#qrnh3M>2Mv{s
z#i8!HkVwbZC`~BAq1_-PvnG6+SIu6umFCM(8%x?bz3oK`!4Chg-o5!^Ui-+O(S%eU
zUmJ}17E$+kGn63ZM2WyCW_*XB5jt|?!y#+50Sz{azO=b)?=5EjY;10s&o-GR*Lt5O
z->TNE5~>u{Ek)(X*6))oW+&gaUbuIZ6ICYWeA3Fc9}^}7`+>tsZuiSpuuKcjM;kH+
za&g9tAXbwu#;(^u#aHJFfwzr4EuCMkxN2rAD8Gc7MH}Y#bK~9R*&2o7LmP#J`PIRJ
z9aO+?-Nlgose+LNrkT376-uRygl2%D>Q;lJqsss#viE6-;76cJ-#xH?_T`hBF36Kd
zFHb`f;LAfk;h1fr1iy$Sv(u%=C$)JgC=s^?l%23!2lJ57V4?6fxgyK!BHI+_FCPQk
z$?!e8Dfm=bK%Su2z8Fw?5vWa4^pxk3GbWhn&ozcjm~vG71R8HmQV>8J%6bFP?z`oI
z6zM{4q6yW`;FNk_M+`KKU_<SpdF*At;6h#XT|-9FW-;c^DHW*-<XHoC4ikKa!W#*t
z2jPQ#Xr@1Ob)f;{j?~_@Hp);?F@lQlJKzoHv0^%K{pk(EHvQGuqD0@BjUZF7R2?nE
z3Sr=!3Dw-U03<?zh$GI7V7PW&MNtr*mUy`*Z=|MLKJBgz)xval5&nZ?{|_y)|2?<a
z?foX0c9SycLwnt7n3}JPQj`(kce8#xRiSFUbri?;(#>Il+2E>xYE95nyOaw?z{ea(
zQs2dchZjIokiH~F>q+xVB1=bcaRl`Kf<ctvQCi9_A!)an;U|S`>YuS&IboAecDLv*
z`{Xn|;~ey6wew!|yGbBJg;qWipR>vItsKJI!ApPm{RRwZV9S9ChGsa{r|m2%mEvMd
zD3o`IPbPgI+H!xPJ1p-0DP)PH3FlJds~|eiTQ*!r8Pht2ETgSi^5Ih0mt{Ij9JsF^
zY-V9+0tf>ACbSfxlt6@2RQOqTKTKDqB5nh#Uba&~vAu*A+VP<s4xBHA*JV3=NaAwE
z(QF6N>6;Rcml8~cZPeUK9r`$Djd4eC&l#-6ulpNxHdMlRGM3r7E(J_@_IHhWc%Xqs
z_)1g$0O0vm>}m&f2uBvi;siOLJVFkSvyv_|sXkUr6Ata&Wz!t^0nX$zcknN5QdB|O
z=u||Th0D7YE?5$jtZgb367(z@5_t3ya2WG*i-omrnWS>F?=h^C)o&z!gj^`H=x%Zg
zNQg{L)<rWu<(u(W`-YPeP3T{2WCyqSj>r4HT0h#Q@kpRsc{lEl`P>--`~wK*XDhpP
z-u*RW`<u+AM(IL)lY77jygnBfr>9tkf8?mvtD1Mlh-^*ACcL$VoHpL2JI*QzFwF|8
zv%U1(>6Lj%6wJ&1RsTwJ-x_bz-`LYc3~a(WCYj~KzS^STR|Kgrh0-CpVKvP^04!%v
z%_&ET>75-oF{@p3RyCeIT3`GFxP(1mzHN@uS$)PG?Uak=yxhax{lk$~jI*;fVfe;h
z$q?1SNf*p*+SV1+r4Y3~M*UvmLOWoknf(FX+vL<^iwN5D#TysYYF@WDT2`ktH?U7+
zd(N6mOO+Z8fNkagA3Sq6L~zP6ac0>@N|DEr@SVjf6gix2aOlY&sy4IfOOFiFr{1Xu
zB)abjRVY`|e=od@{#qdMG19H1#9w*#;}vu6{r0xnUK{;xmLoIU;BJLtZp5}-yVf3M
zZg~)Npf1~9_JU2{g&axV`nMRCNo=l$kwJ{gZ7nQH2p20l;6OKFpi<&G8WKrDdZx=;
z5i?|0epkzjkA%VdlNB9dUH*z9VbInPzz}ikvJu`!y77Rb&GtT!bO^d+!NY*gS6$Or
zP6Ke8&LzhN@{d4B9|^^+ueT$djdwwwfe2mKovQig(Md-|k~gfsQn_*VL~rIjNUHe{
zQu4x-_dgy!zdhT=R?_#}gDMAq9V+y{_)82Q&?X@i;-gV?5Ie%}2&Vs*^c8Lh#;Bbc
z$O9XB)4diTQTC`m5f$}NLybu%sEf+UMbWr^RfSNM%Wjh%L;A=)RcRJ&^X<WTQLopq
zR(daI;#`XIm@MA^n}@CX^wVBbW|PO*Ta~-2xl8`<%JJCH9Q+$8fzqsc*L$<$k#FE{
zL!R3Bs+Z!*qG&!COA+18&B@z0(hFc=Uc|xgJkEQzE7oV==JzTT!BMNwX$*7a-@Xlf
z3k)|iZUVsrF0zCV)%Nnuw_YF|IuAr|EXWTJDi?4iKiFDSPnpi2`nuqM#`sCe3L8u<
zyy-v`8H;M22epn~1_^BkwQ^e@@}sPwc!T13CXOfUDD2|(mN^IF8g}u!DKFPWK<gQ>
zY4`7X{o&i*uZKll7oz4-vN$B$iKPt0AbK>(zD9Ib7;CkM=fN*sMfYRhTZA)T>K%Dg
zTbxm1xq5^C*o>^}_!xIya@185HzwU%%w+vSkKnABe4ru;GK8iZ1*)rPwTYLMTl2*W
zqi%;{zL5?YJALC4-wOwG9_^e(dAqRgk0!q87ifE*zC;_%(eR4FY|;G)Z4WT8SRe^P
zD+;{*D?RFKX&+s3TdEm-HS`J{VHrIkdAq|TVU#TrW@r)^f<niD^}*GuQkUPh^@?{4
z_wf@{MVgd!vy+ArNZbcXfEX^)8${uUHFTD?YP`dYIT|sX;jOKcF+rEam94+bkCy!Z
zh<-53K!uH%h({J8W^HRy>zZ#N^=$?mfTcQGAx~9DVRhK(OqY`uG_VlD0q)&&e(PkB
zn(`n!BY7>x1)OCsCJeDAlQZ{WOk#0G$y^2}@7`va(ga@>n`obQ$~8EQLqOrzx!;l-
z<5)_o`^broy(3%XCO1wtbl~9hHq`8g$~&+As|@e|-u)}u-}P!omwW&Qt~J_X@qY`f
zyNE^m{V34lR{GMQ`7e-u2_0<2+otc<Lh0xdZpMu)VH6;Bzez-J%8vGSeqWX<_NjC?
zl0SkupD3to{&JV{48)K-;x^Ue_R^r~rEI{KG4V)RI4@qf!_n3Rm(412egWb%jTz&A
z#yeuqWWCX7ml5Dxlu1v4`vSE9-Grp;p(p$5ZHh*W!W6{{h4YEuk<H5YYtrY^dyj5E
zv?+cX)9QH;$$spIIaxtZ$z2HkkwD8vLy0mrPHsI<@kGhD6!zcQvtY(G(hyt%x`-Q{
z1^;50IDFlH3^I2iU~mQ&*vA5Af1ot1Gy+G}5Woz`P2qrcvZc4hm}k;Xst4glNYkUd
z9-+d|{{fgJKzYyJ^~su(eTM^!z=Qx)sxN{vjfOHT#m>Y$NFJ&z&|Su44bLIz&hG#s
zeY>IVU4<q&h`wEcmrUk#^Oi^8mZPUm-Aiyg(Kgi?!RTUlinwfF3&nG{&j40*<KyKL
zW~{YMz;N&OcbG`7PFd34{W<B{MTzwAE}B#2)#^>Img$;pC~Ri3JsLb&|1vi>){IwB
zwra`IqqZ`h&W~Q$i0yke34lf3vfvg#ankOLHi;0AkqI#eAj?sI+U*?bev%NX`g|ac
zr0!X_C!bfRG_SYZYh_1y!}`Gy#5(M)L0k^pc#j=t<s><oQJf|W&<7f}?M7aK?b{i`
z+uNEtGDbYuM&6%*x$#Hge{4bM+nrSVrL`qQrwRhTxMh_$79VhVCFaU3eNFu;3`Cmx
zL4+Dypqd-81I5VYc<GnGi0I!hp$DwBv534ga6mGnR{Y8Hf?VdkyiYIdCd@L6araz_
zLtFQ4zmJFh!UL1FhkFOjbU8(JmJQ*2%1CoG`4C(fae}u6VmW{JsFYpPsh%d!`Ls;)
zVB}X0>IV{=Go;>5NCa?9Z9-jvlfg<N@u5c6HfPGI>#m_@7Z!h%yVAWQ@Tr9VBep^j
zFl$~shV2_e0p9B+8+M1Tt#vIanjgaOZ#w+S%cic~h~ylv1PVCFUTj-vAoG8{VsVw@
zQ!2kQBZqe<if;9JRjrfFF@4o&8`_3QMm*sBY^JRD(4zbP3LMHWS7gH(?3x^ZLKn-G
z1IKF`9Q8}ng2;lru0T+#gmAs|fuPiXCi?U`1QK!U-QTO);QByaGbvAwze1GfkeZPY
zD|146iV*-9OPZS%BE4KaJ`FkbEE?JcTYS*iGc;hABSDNu5OVzxa^uY0kr9(ndWOE8
zl_^(!nZ!GmVo|Il=0WoI)?`Bndu8dUItwh9VA6gyY=$o06+3{6oC+J&=FBS0Q*Hvq
zMCYE2QbA3I+OL&UU8^WQqMNi^>GFY$<ue|PGdp`5u_sIQ2r5lmoQ}*agKz=9H{IFD
z&;fb~I_fhgYppHcthgH2DMFV|f7QI9q_8kt*35`T7<>aY)wyo{KO>=r=IOLxvO6Oz
z_hTCYN6+&G<yjiZA~T}drhlFV?UX)C<RK%|G1<yiY(M#htiJIffQ$w^U>&IMmmkm$
zgS->TSrNLFP^H(<PVISiDFWCYt<J#0lgcM^B50-7v;`(f8n``jeLf?xn#dO0a9jZ9
zQHj9YRWR@0qyyZ;x`K??$#7&CP48)T{*H|ke{~P&HmBcFlW^*d*7mQWx5;eO0p0AR
zM$%b~tPn8zU<^OS3PRwJ?LUa~URBCRFeEEGd)QtS@yPv_KZ2g+pZ^)hdi}z^a6X{R
zIrbYyNNFO+MnKn=1<y7d`LOXr!kMVh?ExW6&7CCQ3zJ6ZCNd=~88V)5ycH);j<nkL
zhR6VSVQ=Mq{{TS6lhjI1?(xuzD(D}b@_%Mq{MWYcx8bk%%~3Xa7bf#*1}IKs;JVCX
zBCJ^mDXCvoy;{-IrkrKtxCr`fYRnv>3J@V>Sy_#4XURA#&Eq05t>f8_D8PT<5s>GN
zhzFWACgnDTZzOr;l_(3rD$PoWum2M*59UAJ?y9X2>^36pf>#qiBk?<aU)GviFps9l
z&?|DI<ydI_3qyT9@h6F2&aq^A72q?XEw>{fXjW0?wRUB7%%0N>czxfB&Stx0`^tVw
zuA?n-(8|n(-|(0bTegc-Ht>XD<#Gi}elih7a1>7-@e~PKHm+4~Mc!xiRI<+HAm`m}
z-;nrR6kNZ*sRbSL!&i)TjzlBbHG$J<`8v{F?(e5}*RM;3wl~1f5B|^8?M5NuJuT`Q
zB20y(i}g!;o>GuE#X{TdDNomb0FQF)w`i)Q=f8)Z9~_|jN`-vxfd<-0{5@@0%O6M#
zeNakb?i?)s0DK#vHI$OVTDvlB>P$s}(FDe*!VcicW@=vb108?O*VNo$`Yb;00)qty
zF3tq<LN3AO;;{$O=;wOr_JR<#md4O^PF*pgV$@G9q4-xj&AW+JwG@T;!T#6^WVx;1
z{s0h`WT+3N(pJ242*K;4{wkW#X|f-W@gpRz!@i2gB+QX|RQjb>A~w-aUs)dx9EFl+
zT$^)X@2X3fy3zk~6u~2#vWfjSBcT5OZBl4qeAlBLo%iu{)0_K^3uQ@gwr~;L)!|f?
zKxy7vsYTlG=_n3QKB8k+0@4r;6g9Yf#`<Q8-9&Uv66ZXkvrG8d))A~;0>30YLG5K-
zQ?7LSAQ93P(%vz_j-5t^nk=lB9z_#qvgEtAMu=-GLV|CL?(jRCLFQ$=tI?^hXTPiV
zG--w!7A1Ab3yYV_e_j2u3@J)QsiC?ia?r(bgWbU8aE~uRjbZf};a1VgOKR4^n86pw
zf^Ky4ev`O~ac(~%qFx}w-sbC%Lxsen$JguL4sZ9A7W!*slJ6>Mkb)`v1NMaa()LA)
zMT&y;b<-1C1w)w?rCH`v*v-GAFj<T9M%Y`90QlHb^GDvZ1M;V&@~OYeu>=!DMKN%E
z9+8D}QQNZiuGfewji)t@Qr(8?1f}uqma!8%1_XY@TDNl|X*!l|?d~%qI$9K67wM!2
z*_5vcE%9l#xp_b$x4(AY+SyYzHb+3MfL~HX5l}0j8;(Q-zTPin_{nC6bn#=?r=EKQ
zoc-*xV>kMWEhG{+WsDeR9K6LoX9d2cl9fP?_eHGOc{3!$&`|F`ObJ$R2wY#W=wtg{
zC&zknmo&*`Y5XBBg~tARFJSGw4;3w^Fv06RXM8KGjl`!3H%5O&8DfH8-b;nu3z)l>
z1BBl%)dulR0@wztfDnbFCv+K^v3CZ1Jc{R5vt6|6%c!#{G>%KLp8^Nhn+C5KP4pot
zy(84XmAYdN47q`y^{P_lG~3A4$hefnge^X8u`m=hS*Yqe#YfS+-{)78(^~n5x;g>m
zb?sb&tgVe5Q68lW+U$X(WUt*5w(VKLmawr!lx8-Q^}Z@S*+^|X2=UymOI#nw8XLc{
z>b8)LvJ7#)dUfQLwA@SHCIs#zzLGOuDSu>hppJpD&}e3bPtzQD?*t;}=HaFcj${T4
z3i*4w73&ST`MYq;Oc$}r@rSI8m6!}dS3y)&E3WWPE$7f4y~@grk-6<ZQ+dYvo;St*
z@UeCe@+$@5B4)KMP)my2ILC1}S^<BIn*=(0s$V(3R3=Trjn}D&L=y@|ikknVR)e|P
z?aIay+aLujEX9BGE+}1)BZx(v!HfETSbGboINCgW7y<!;YjB6)?jAz$V2x{nL*ovO
zB@i^Y26wmM?(P8^3GUXxg6sQL-kI5%*|YoKnceSj>hM%o(FdrmdhT<7_jhk~oTCPO
zd_+wH(sNIX=u^}F#f-<J=Ei^tQeCqzN7}YigFH+K*QVC)AWSJc)YqbW;f?pgHvyAU
zXBms&mIQZx4=vlkiFh+5=9-#gh8;wXlmK5jvUE!Mv-v?K4%sFf35>4Pz72A{y)h<q
z(6cvN5kuVEj<0EnOfyBQP!nc~uf!6W`S#yv?${e*NT5DYpB4pOoViuxlVr?xrm!|9
z=b15oJs~#v^yWNiQb>plK6Z05I+ZP5U23CM{*oo9M}_-q_Kr(yR>rr5=W+(;!DM*r
ztE^|i&6{Pzg>!r_cEaU-X6v<$5oL);@dSy;EUOIS<QcNccS37+3d<uHqE!vPdj6{F
z+ZR>a;=sNs8YQ_Z5raCdmmAQ1h}dXgL~Grpb>|6;*lfN73J6QHnLhd3e-#h>Ycp~j
z3Vp^%H{MW}*=LZl1nNFuIEW@PQ02=M8s~xwr!3;LA|dsJ!IB2b0hQI^Oh}WCQpv?;
zOiHW8`J*22o}hJpjrOPcy#DojoJzG=C;GgswW*DT#8kH21XmM!H96$645>n@`Cw{v
z3j+-P1MXRSMn-$OIa{tyH!P~?5RzFhRFGdLGOecdMhoDrmUO2Up<Z~-GFT%jO+UpG
zo2;4mT!a(0)btegvJOc!SEAlc9Y;Sw7+98m!B&g43tP%^wBZwjQD~{choN<(`rpuB
z>klEpN6O4hI;n0goP*a%=F$YiSrpZ#j?2G31nYcLzCiqlTvcEJrSQpN6p;s@kR<j0
zbCUme`y>e}Hf#u?d@w;RK38pAIU;j+rs2u?BC(+&g0bnh6AC!azF5kqzF(}LDC&ZB
zW?y|Ui+SEXN*1|nN%euUz)s!T#b_B6E>FoJBs4sH$p}sr&ngYN_bpWzox0UR$P~bI
z8r~{!giL<2Khm<UyVcsoC;e=O!(jwS3qM^<3X-!-pG#YUJ~P`#7H^iS-56y=BgRrN
zkq8mQLKDr615gf83g;Wa!eYTW1U<`oU1k|?>U#Ljft)T<V#E)AWUh4DKmn8FaGHld
zjn?Ru&ey9TH={hVht>2C7hQW%BwuxVHA@bs24_n0>nus7<wd!dMy6Cq`<X9gLHWLt
z#ju2ve{cRRYmrIzE;m9m<X<UDFR{!12uD6F3V(V0`ow5>gEC}}<Q>PW;ux@iGaOb5
z5!Zm=kSZko4>+7XqIH+da(>K0>ibp?!D`Pt9qE(SjujQ*)A>(scFxpJ^|nXy2J(U*
z3{^y8ozBrIKe)_Sib?c7y_n`T50JEPB&`0F7A8s8;L^k-2twH+i&me2jMoL(>~r3r
zYPi*}x%&(-@K%IQUm3<4RB$Dg*FbGqzHNY5xS{WuM^VFqkV+EMHQq7zq6YQT>eL_+
zprL;2$#IffWUbuHand5w;E-DdhPlS-O~rb#bqYV383;t69KiAM&Y2?zNBeBu->qH;
zu@gcE29<dm&Ffh7Wnp;;)GAmP7oz@mW%b}NSW*XWqC=R?GOR#L^+%?$v<FE;BF5cb
z=<bA1S6h}T%pmb8%gN*>#ktLRK2ajl(=&oxf#kR~<KnO+5dc2heE+fD{r|-Z>K~;c
zm0zS!GjobZ?{8Ko;M0ehUH*oArb{^!GIB#R<Yu(vt0(3q^KMi?(9fU*eQ#Z)4c3t2
zNpsjtY&rtWa5rotLqZ{flFgo-n{*;kk}CT64>*rZU*B<iZF5lu-Ap^%!2-T>&I<>$
zgO(3reKg+r2t4wWLKCm|g$|;8Va^fL7Ok`d1ZL6vf0BZ1_y7jsmIb;n5>#IbtAs3K
zJ<$0v)z!p$=rf($3rDY1a&rq?e!7{5R@=SRc>Nc`<)Vu1hPV(-0%Ovz7uRUC`wuu{
zZe)MM*@M!{y-oUY7I(1+3`$GIv@*8fA_UFZl8v&=L1RI%BlshqARh}#vKwhB8`M6x
zOHMDQUIy4+!f($ImjsnWK!0+L&EnPbW#)L4%9*rkdQpT?l*wIMqstqWyt}wHD^-`*
zqXW@oz_1LfYiEJHE)3;Wku;%s+gJ%1$`Go+0F-TPlx?kuUs`s388$k7b<yFXiuuDi
zo`I^<yX@oEB5%pJ7!4(F-&^k!8HZF8q#5<!OCNAammIXTVK;dvTCtOB*s?Y;$|Ia$
z>o`NG1{Ka0H%c(&d0mEe7Z`KvU9m7>6x8Xxxz@=ZW0j%1L|<6V!_eAWs02l;5d!zY
zAiE#9iwZwSD&Aw<_-mZ87q<9?SkmwO0Nvw%B#;G-$)O6P#|crn(X`KZzpuS`Cc-lL
za&71rJ{Eh1ea;*H^*6lDBEhSe--Sd4h{eBbVi9@@Y)oW`GF_2cztm(av@Rj~+6sS8
z)J=5zS|p7OenJkpG81PhwX8;PFG71Kzj9Le#`hEhXi8WkRU%u@k@(SY-1SVu)F(SI
zk-nyE;I&BTka(6$xhKm;dt^tJ*j!d_*OEdv3D3~79WHmarS0c#XH2>6-8O{5_hfu0
z*h^?i6tp?|*yxdnJ4Gg#o-xlC+Xdk$Fy)a6b`~QacZ)o)A&Im7D>EM{thc#EKEQGJ
z0X-!M3#g5uMbdiV^Uai6WxA`iw-m!$lhJw=muvCs>#j@BQGM=1)hfvwGP(kE37kC#
zR7Nmm6rx`?XX=-Q*|VF+S?`$qlBa!XY2qx;5GQ}4Hf4~=JdxLy@<Ta+sZ1J}d~{R)
zT#WxW#gPB?u|F60JAYr?_q*zO1R2g6J*ndik68yeE$tpW9OVC~XC`0~ktADIYnw(4
zBVNAHBxX3RjFvwgtD=fmdt7AkFGa-NI>bV_giW`k*(iEz_P25McOjO3R2DY7egK<l
z<=9PXMd_p1sI5Fb_ZAWHW*pJ$sScbcSAkxNfx+tXT96lvWmLQgYOlWr$Ax1chDqZG
z$FeeEAjN&+EU%DyTi43I@lKs<;zI0f*|kDliMPT<sE0=@uDR#^fq=WhBr^gwm4j65
zBus;4x{N_}ip@U$TJD=1SFrTf89B3oH-(!4p`PvLeg(OdTuZI#FJjYfk?**06dj2f
zs*WR=nA4KL-2Q*96#TZNg5S?Ve<C#UgvmiqHaZmP8XTChxW!<itsVq){Ho|hA}Xuv
zWH|bMM5lgv8yac%?tM#O+)N%iXDkk~4<&+hd$eN7pVk&0griT_HZZELQtRgVU-mB&
zkkw5KnSUl&d2mKt<`%gqH{De91?gfI;0~CH1_-<o(JoMkFt&E%5Xh5>L;=~)Bwto-
zJL~4Q=&w9uiXZ<L!!GkCK2btShtNHKQG6-%2bSr=BZeD;%MMsAL4X?2e>WGJu@UFz
ze!_PXqg0tiO}p3GF&`jJv_(H_`mhy0VDoX#2gBDv@M-K1IK@vjUgk2&p2!TyQCn-D
zjMAjdK@rUMu2cO$*l)WC1saVgh}W5gwuE`47ZC@Fqf})#>-vQp#Gp9pYH7YmkBS&B
z93h}KxnUq)vCdMgnLopz9~*yP)Wb=<g`9JJFx><;wj?(N(8Czhq`cJxb9n0EoVPrp
zhpHl4Y!hp!Ml38)b)K!<<5gxcFnb{ZHIn}}SCL@KQ=(_SgQh)V5D!C)9?eO7y;T-O
zC^TyNoeY=fBX}*qhtz5FMcY!fi*?cG)!NXew7o@5dD^L`52Vi>W%-Ut>@qsCEHNt5
z6*1Zr>v14hXJY58?V_0QbJvH~lw)VLWYfHOMT)w9?@wj+7nPD?E!bR_+yXHA8v>N&
zkL8CMVEZg@*=SG`rG3dva?6uKh9>M)Qk8$&FIwwm+3^LbrN$a2<rr(}06<`lwXz2o
zQsjVTrp(ZpkqL|s3G?l6TcIlIVs9=YH{V<$Xq>2aLS&|>AVH-b0A6U5qsW0|93lZ{
zAr~7JL4poQ`#zP{16;onSt&8mhd`~&Y)DdN`FO6gUPr>*gju7O6_y}b!ri_1oRUX{
z!D?-xmw8dc`}i`dCrYQIC%;T~9)wXy!qrdrnG#>(NNIfSB-{Vj|M%ZNW{4EHVRNKW
z20SQ0JbS{ITajfk$}aOoM&6o#5mn|}mklrM!Lp~?7)rozm=xIB%L5&gq@b2Hmj^==
z@RyY*Z%-$(3S_X78VQLpc1N;fWUu{O0V-tgStE~O!fA$uSA8vJLh@MOv?xcRb(~jh
z-^@EqE%_mncCJqmn6d_ztBpKL;{-p5ipyvx(su;BM82fHo05N*hL+02BV&bzCZDRn
zgl;gCE0d%V#g*(#AX~yaHa8i_`n0xL!M*muji-z|KBDwt{0>3Bl_e47TwdBuJns9E
z>5OZd2%`+NG0c>BKp9y*iW`yznb9tX#udr4Oj_L~lCsd;waZbIuqM(Bs~PJwQDk(K
zA{SsObm^^~0DY8@iq6%@rwbh|R>FJ^&C!{62|8v!FG<DTOl#QDi#!k0Jw%Sn^I}Gh
zE1_QSiPO|ID;#FiOwya8iF;|y{Q1{qL8?*x8!yOQY?wSoQ*woc!RUOdZ{Lay`>uW4
z+*w$zEW?@dfS7i-UO5OK16^iUzzkh8@3!fJ?pgDN>3o6D<wh2|jS*v;jUBRb=9TpQ
z4%`b$#K;N9vWy~PTEVW}j`U2|Rndi<Owos_cb}#uS9DbnDLzx=wr~)5HueC4SG-?0
zo3QnYd!-5&2ENcDnI`FU!?8=@4kA!R?7@v2h+5nNx|`mpGG=9F=A%rTb%&2Hzu4J%
zY@s#hH;d5Opjn`X4ZjkIF>8>4Uuq;<&%}UGR0ERm2ez5)nQiQY?hT$^OS>1=45<9a
zf@HOJOYK9$>hax!fu1K@9-*RdV!QKR@RBMu#psW>=#n}Lox7K)ata!_3DJ>Zu{LGu
zr-fNIC+=oyanQwaS-3OM#d*<XUViDDDJUQ~7t|stu(Oefh57N_z&0@qE00_Wq7`OV
zhN3hKR*0@*Bz<D?_dG`6K}e(#SwNX(D??txBVNRMCX&yp448iZN9y7~{0jdEisPTp
z0}Mv##}3d@jAR8h37`k7_y*GS5BcflIg$}%7i^inXSXx*wGbk3;uE6tRl|&-0!?FN
zzRM3;6_<T6SoVw$8*7Mr_AbHGCbrI#7_!6ro|aa9MenyucIZy%aPAR!Q7ONBX;bS|
z4OR61Hb3j5k$R&bx=#hIBiZ_lAFKG)TLen$?lTsbQ58<7O34u=kT5aQ2T_;tCwUOs
zh0?M`6=hRKy8gEIprSZyn>)@6qTEs*a88Zd6S1*$a$RT)%Ua8RfZ4D0e#jBv!M<6S
z{qE-ro;_}~w#qat#^oe}7gPh%CxSjK+Yr_&kiDA<5<&%h<mS)v-kN)j+99v)H)^Gr
zzZaG`q1yJ9HlLR@-Q-4ES{VKV&QAD=rgGS_2)u6=8u?%zA0VEaSoN)W*^ka?Ag-R{
zLb1%CCR&(lVw>!Vre>TbUd0%L9w{7=IzKn?_2=@|N8GuiMadQ>eY%8wl@iL0aA-c?
zE0@m}6?9GlsY*M=7M|Aw5|Nm)?;dT$+evDwE^PD@9v91T-OY?7a6p@m8r@4eWNrlh
zYSVkwCOQsZ>cR!dt}l)>n3aX3`+o%eUnm2kz*Ab8r-hr8g4?7`Z*R8ixSgw?3*s_|
zFZzPTk$eYujC|j#`i-RuEVSWylnf&c*OTVeDBYe@N7xzh43LcoKlA%q@$GakRn`b8
zxxPHv&TmU<3p2;Y#k;^N8c$x7?Xhq?ut5|liqpAC<cpjPret&xU!O(cET7foqs6^W
z;5g^<a03Fh#G(4mo9vI8ItZ_p9nHk+k!+xPhdx(MVRsYk&iZVGLyhLXP8MC=)CfY%
zUdX4F0W$^-ttzjc_}(nz%4h%=)j6SVvAG+yCU}WldM{)n-Kzoj`N|N;x${${-{G{k
z?2;26_4U3#i9XBy7ydC^Y%ERDz#DBT>&nHIqC|g^95H7B>H_yjHifF|_v_9-3dUXM
zJ1B$A&TZ+?Vq@}mRKCwkcvy?&9W_Pdh+&yt@IvFcOJr16a4aHbtj2j*FmuyV4Q2?!
zAq~marAtH(CfY>Q?<u)0TQXOWFDnTRPTBg<tMWw*as;`CG<7{;necn!87=d9yWt}R
zL>kMhQLhRpgANu>y+i5$p(rGB!AI`xmzTc)R**g_2gN-*p+$!i>M|aBfQ8NZJZDv_
zOVv0M8tTLSz%TOf1Md8%;G-wl*c`w#Fty*9W`BYt+%@!UXlkfDD!+^c9a~man!j23
zuK_UsT)nOQ(rrW%-v{|Z?aw@c&if19zIy_gk-GP?2fvdYAuD9*&QjGhXpP3UcTFax
z>_jVP8F`Y!)_8q|mlUd_=0^DBzQf6>qQ$^1FCefwa@$OGeRynZE;_C1JLh5bnB5x2
z3VV9qE<C;3Gr^)Sm_+Is43*wTz7&5v{H5v2$4zpl5vL_Pq||Uc`a+#vTOCwV${EKn
zi9c9)Tv)66MoKRS5*ztuH?~|256T8={u7gA=73WUkpWCXSe#k#8<V^ZDkVJm8-_vC
zm{jGXwTcycJ<9_S9jkO4t2vOAL&6ha$fnx<?h;{|KMYNSL!Iw8=5a|K5B=1(uMxWN
z(B-QBM38Lw`6G8s7Z8}vHxA}6Ty%->vXwV*zpBC_58C#dCiRnjM}EN!^oZ{!{rlMD
zKjTP!J**H8w_x-y+e?n`rV#>o0vqoKs~X8-mARbV-%dCM?8et{+2l?8P#3Qal1=XD
zFEwdn9>tA#4IwO5_q*RQ1efzRb^n^%+@fy#p@EC?baL&rH^02Dwd4M$+C*ziSp7W@
zsr2b;M!w?S>u9=%O<iS$zy(t{U#CnZ+uiVY^9BHDjNMcIE%)vRV0z-)1p~lFf=A9|
zS}j!pPLD?(_?<x(86=`nxO}XG*$Amf^ltCbX+6#|(sFl9bjc?m7(xDNSQE9jb+SHu
zGq&%Kqlz9_YEFe}Yvz1HBdl58cCq_e?EBwcazjWrG-0yPOS7aRc^ev`_QM{f6N4y*
z8J$^OX3e<TmwJijB|EPMLgUiu%FozD6;IShUUGOPcqJ;1UuTb=NC))y((?{$jCEYh
zu#x4M%*d<NC2AI27ia1f;4FOm1;tg=Tm@IqtzIh7R*S~X3Rx5vq^*{W^I7GB-o`7P
z=$?<yr<$GL&$;zIdR64%#*w>77}>l!^lO`5UUu89v9A<9*B^KlhTfW0#dn?@7Ud&f
znx)_Df5BsP<l!`*dg_l&23w51Y>xQ@Zfl^q_PN#DQS3SyUqDW%Hu8V}Ed1xs2C%Qu
zaH{AcEcJ{q7PuoJ2NzYS{HJ&EkxhuQq%N5o(FcQjO0UNEH%hhL1BBA_tt$&~^xsYk
z{md(BzM#0Aw$8-opm>y#iAdiR92&Z2h=mQp49z&Do+Sn_Zi1ZOFsfzs<X7N}WR8>7
zq?7O7hO$-U)Q3vj;SL1WM0M;z@1b>Sz`B{P{NuEmoE4DLLY@DLo?f@UwyD)tl2o8%
zA9>60d34A|C~}(vR|vf<s>DF5Hg^KlLkOnG@?~%d(Y#$hn^Il>N*Iwd@;Y)Ca5WTE
zd*Wl;{c~O}4I^@V=9qT|<Xr&nW-Mtl_wzmO((C@0`%}aMLbtTpZF3c@$s-MFv>av|
zvRek1R|PH*m5f(-_g{KunK3YyodQA=)a1Z2JxNSPObC5HBZRS?lz0<fq+L<a#KI}|
zox?rxtv~VQv1MkI4VVQb$hn*sAyPUScojs+hV{Pv86i^AUF5gRPOcRkm6N-oXP)S@
z-`N%zdr6Sc6(C7OTU;63+viM;25FtYKjf6%SgqRuGIv5pbF>`A?;Lx@0p~V0->^NW
zn<(bE1~&|(-Q}c@UcjGIdmRGx4>H9G44jK+k{1hz3zVkj!l2HL`L2jM);U#CnUPPL
zmslfj^!YCKiKs$Y;oXE9NGncobcOj4+KSJCo7K^F28+rq*3M2H>zF#KRKEs)lN09V
zpbRas+A0ZxA;jiZty*hql{Lo*o6_fPV^u+NK+X#6!koGPewYrtsd8<W8kDWPeCwRO
z(p<;n-KXY-k9iEAhRJPUDqrq`8bABtt?KF0IpxQ&C)(hJIMpXx6HhqPVoEZUM(pMM
zQuz@td+!iwe<}1~4KoAmuGmRoFil=I;5G6>_6_npepcOT?bRB|qIK+K2e~lRA=*N;
zIbS3#-6a8sA|I>LrZVgJK<HXbn6jy7q)OMSvkGR4^#*vj=(FmDqsdBsG<jp%H2{Y|
z=d@Hr?yYT1_Jt07R@1_XUS32MxJ+`|(phjg-(psL72lHEu!Un<9W9l(@0pv)R6*yn
zVvA^AAz-@5BV!Xc)n;w!R>N|3r5lRip)<Vhc64(pW>cz-nUfH#MT|%mz|z7E(hl3z
zC=j-v(V`p2ADiAS9&7#$K7KUD6i+B*N<OgU)Xm%3f0qJKgZ&FyM*p5>(dpfI`P4V%
zIk^jm4n7j-Tfdo*<G(Q>0{kI_INX*whZ0=UiI4qhyDw14p}(*;3^9^A9h`$jwsGRS
z>C90IN_p#<vsU~+jj9=H?glzI7wR+MByGbvhdi)kwpTaT*c!ama77nFJ}Xt;RnHT&
z*8-aI>c)b`*{$nTS@19I*k?2wtQ=^5BM$`UzakIPzakHw|BO6xca!-t6gW$o+sTv^
zB+zE6Hwdvu9ayBD@cvRd@z@6oU$el_l-`IXH%uvWY7nX_1kNJ^nN;g;S<ejmX~h$1
zCNYs{V?V}=-FB(NmLC3!Jb+qEPhtF2x*`4n&Q@%kw3!>duFi)5;Q*%k5f1>X{#9+Q
zZG5^XWhbSne;dqZyUaNxA)4_Tc`3jjQ>emfI?=jVwj>c;orf&sDv|}~>E&w3tLTO_
zu51t{|Dj*o0~KY92<{PbK?F;fHRt0_y<61SQb5J|K}l+qUphXaU(=JCs03gL7OfE8
zSaZF649&!njgl0>_~U#wHT!(F*UhrE8t<&w)M{1r-f$Ivo%srVXHC+NZmQZ`R9&ny
z%@<BIkmCa4DmIuF2&Z*Xt(V))agkf3bNF)vuqL#SphMZ>On?^wa7kk6Z}#L>u~7l|
zH!l))h+LBXyRt&3qH#h+h|TL`_6sYg%t0->T}`k=y8lv`#(7$1O6X4q{}~ns{W>Ix
zx)Qib1g!UvzN*wJ>8Z3YeBf?CA3*cJE|)YGS<j~?6pFBTq=bM3(dJ7;F+(csZX9~z
z!QW&(L`O05@FLq<*VnhcoeW<b7=;yC&!yVRh>*GlsepvofYURJDqN>~n_+A?{h<Rg
zS*_%{LAjp7Bcmg!=a0<mOz7qCp?LdT6T&W+T}M!mn&Ii^4;6SrB_K_peH8F^$m4ta
z96v$z*={^9$l}u%ppi8D`S>fVf=CkC7bHoh-{IvD3*K52F*8|+eH^#>VHGD%a?rqW
zE&Kkd-l}d+&%~BgGvu_2)em^MB3b^}w_mU+T##sKOP%s6ud8Fu(ToNT+EAS9W;$wd
zEazN^KDm9BXQ12uj+Aj+D|)Nr??$OCoHbD4`AUs4yxc6dYuG7COkM`z{8e+=Xsb6P
z`n(IBTGUUc_=t5#Cf2hWAAv1T`ZM=PjQ03p^hU0M0qq4z(>iP<2yVrEI?fs&ZVA!;
zkC~tXA&rRK2CF-Fp~u4!l@lGDW$)SIW3fX6mBQ+#_<QK6K)VV3VEen;d#GUez)))X
ztLySuiFQ$y6U78AKA#ha=m})>{Bi&M@xVDKl2)LdtFU}aqMfVgx@hDjFNr@SXz#j|
zO``qvHDFmqTMdzaJS>mDpA}*kJFIJ@xCGP6)w4cbD%eCrD)=Vb)iU?0`0_vKNrxQ^
zpX)Xfl6w`iv-`rhcY&AdKIpw|)E4t9|I(V-2KCT31V&#1`aT(Af69HcV(?OsV2dOI
z=2C1h@i8b#%Mr@}R|(RQe}a_kC2EN)i`J5EiO59L7SQ%EwUorb{z|(B;H|Y|od16N
z{_QsYKYS-(tHWKMi0KO2aS2jeZOLHiQEC$}+_Hzqky+krGQD%UodK-sf0GU?*_}hX
zw&i;r=~6btaqsXxzV5oDJ7p=DX`|5<IOM^nb0X6jI)G-1c|O_{*VYA$z+;q~2zE0d
zq-TLt^wQ_TUoKx2o4c-8scYY0>n%xHql7QgM{)g-eeZJUdkAL2u!6|bl?TL3&se_*
zLJC)SVJxr3W_!%Oge^0E2!RJgLFU;~C|K@KrkDy*`2LY1#3Nvl^v8_!YljAuQAnfl
zC10m0aK@VFs;S$b;D&y;-o_%+@UP(J;a*$Jzr<iQYqj~s55iAClSbZKv*o?*sDKl_
zy4v^5Ki&p;GoVV4>{ZpXq>Y7{^-!)GJy*}qUm3{G#SczOle1-FQlh8P0cp7xl<Vn8
zB(w004yYl?Q9J^cWfKNB;dfe(Q*s)3AIsuofj}E@G96&8Sn7IV|MTZKy-TWpn7T>9
zFHWaVyHrEs+wKoM`lsV$r{&+ic`lgYD2XI0*D+VQMe_o5OA>XFG)pg)XGZMc8%(AI
z62$RGi9Tnl7oM3WfY#1aBDw-B?@(lea~rPt6-a_~?1ce;OC@^-Su|d7*bgEP^*~tx
z7h*~KIzB!C2rUqPxju_Nj!yek?v6-Cf#J$eK^u#r4_)nCQwzLxtq`)Sdo<zR*G$Li
zNaqBCurCjOh=u+JQh?NaATN7)Dek-96UUX`>0R_`xibnKP5`r=NkaUB6i~E@`3h2#
z%%^6Kyh^e2yx&Hz@h}r)fN7U7(#Xr}re~~1yTQ}rjZ3ZwUtYj;>sM2Ayb6{KLg=3<
z$gUX)T@Fgg=f!#Y?+B5wyt!9sss}yDQ>ZYde>#)}PnHO!8@L(+Wg38e`{xz%f4#qa
zDpr{6yLt3#t&dRNra%;S6-GBPotKdxfErB2{xh<*b}?1koy>G>T0H+orAWt9YC|(|
zdHN_=-?VgPygqvM_4d*5eKCP2tWj{dD)y3e_>%n1?$s|9?!#TJRP8R(j4)P5L9+Pi
zj@h%!PYzrDD5FKM^62=J!)x-dmgsbmSEYtT;zjg#sM4{%KC{{BB=g}oV+gDe|4}UU
zeEj1g#o^RwzHQ$}B5Wd8vMq-(BxfhXuV3Zq;-)A%OclUf5rnPyj!>YHoI+6Zkyfj9
z+LHT+Vxzl24zV`e1?}DC_ADw>;Y<sDZhrZs^i-Rj4X?hN+Lc$Z@&!mO#6E@UDc$YJ
z(AB<%rp>lI0)d5Ti0T@tjl0e@!{T1S;X-I6$8Ma|Ir7GjT$XQM5q~aT^lkxVR1ZQi
zoXTU66uYIb7>}+!Ro^z|UK>HweL3L_FOggYIm~m5<MaGsNQ9)N9wWIg?Jfh>=NT(e
za9zm{<55gCXVXn_9(mdvuXUhSOHcgG<Vc%uqS++k7-dH^z|)yy-DuOM8cc(CW6Bt9
z-5Oh-w~u%=u+!2x!jAwZ%C`2lS+-{}BAnZl11XmNE&#MkOrXdsmiSZ|FxtmC(V_WZ
z>@u*<U3AC<j+AgyAAUmSN#!wAnhUY<B2Mj*e)EGC`8VvlUn2d&-`{60<4EL;wWTDI
zq8yP^wooO_pUgWJ1T3P}pJi4Q>VX@^F@7>XU{}H|ryLhGN<P|z&iT9$)s2@=o>aNr
zVM5(1l3AzNYuqvl0}5OTfKX<C6ATDtLV{M7lq_B7+sEw4rqa0^!NKjd8q?+Va#I}Z
zx^Kv;=x}bLY=Y-R(cJJO?liuL3KB)hJbQP&2d`2EwDFY$CAdWuUs`Q#h%w|nU~&UI
z(A3Z{O^t9|c{!&fxg`GLjz~cJeD9rsFn<a`I<nt#t(*oR(u<EC?Sw-;=Ll(W^;kSf
z6BdyLcYtHNR#BGXZ_~YfZRQf@n-kUQ47KOqdU{pZ)XTfhCTT!R!8NIgdhPLjRy7qM
z7EN=oC)h&irIdQ0rXzG6ioL1Q5>qb?Y|nP+*xs=z0h^=(O|6Ell|}K75)wLElCVe?
zV58N^DF?s$v!O($T8ap&Z2c4bk~cCpSg2TMW&zkGmBy(qHh@Ne33($oLl^(VXgc5R
z@MSL1{_<ijFw%$uzsz^Q6)3FI)6RLWD9ltL@6H-qBRKMnDjK|fLd8E1>hu46mZiK_
z;C2>1bjC|bCjj(8^d5Rg!;Fl?vv`GC$>WPW-&cPECcUWt#iXa%&Y{u-J;7a^5|CSt
zgD@V;|76Nvs=>2nsX?Jm+SCk3S=A-YrAcBqCD`vEJWbc4P+Iu|?t}w*jCP2L_~_CY
zHZzmWSF~}2x+D{LZEV(TT))@-JXjuqSnz13^102tFPU&u&GIiU!9fXkQZyNB#>%{p
zJkrGZ;|M^94ig+;u*LJbKQ}Ik*P4tDtQ-CMIlM8CLijIE4bYf3e7xS39$gfIA%FkV
zKJfgWD?4#9EtCOqwho?F(LE}`snvepHu)2dX>32aK@`)-xfEoOo(|Kq`sSpME1aAX
z)pum~+f|@*PQ1a^D=-1P9n(Jfr^)vdwZKzFS-w=bu*jxRKc#X<gNR;Tg6E#`1gcG1
z=DBDsAX_NCT>^x()WE%Ol>F{NwpRt7a5KdiFEQTJ-jKEP_O~%fJ3glUj4ijkz!ud+
zuCig^SHGpTYC4T=+l{2Foqom4b8`-xiSoQ3ZT<3NY~Dq*hT<pSE4U89grEjAGlV77
zMTO)kK1Z<;)8(7(oA<y~aiNuGNw1~2#K70)T1>2yo$bJ#O;bBvP4=LJiB2!cOb<16
z$6Kw<eDpBGSvb?5TE3qT@gX_GAID#0eHeU3oK5|Dv7p18p_3J5t9dWGN;3+!+McSU
z5fCS0e8Q4JV{i|Jxttgr8hS$y+)gys$%<Y#Qe2!lo#?Q*oq*7?AeoXn%Y+mc!CR}<
zelsVsi@pcW&m-fVPSolr+s#O`Af|@iGuvn+6)q>LVw3IW?ep!D^z-eYPX>kQ$>NtF
z{Vd2t9Bj2@)a^ton-5RMrV28d39I6hvFT`=^SSo*sxW;9Rcs^#AYN-)N87C8m$nN&
z)ufp7>Bb1u`jAl`IY%bis4Ox!3qhDU9!X-HkP78$ni#R&mT%1p|IEAyGFyPeI_<ua
zSApx31oUa8g4A=uxNgi8_(+CcOsXP3AdA7iR;3MUUL|HU=#hbvd71#)bKqZ`9{-0a
zv|Lwr`MolAeZ=sq7hPKj(D<&(GNn^b?X}`DGK4-SOXMPu*X26aK<XE7a(vE2n+G)I
zM@$8jS53}IXYwqc;))BR#5^l&<xk^2<AQA!w{h_821J4d9|Rv@fJ<y+^+zciqA1b$
zPZKI73>EKeq?O#n+W56m{VtW>uS?n3VdT@WSj7nrnv;8*-DL_x3zK5zLh^y;ECmI1
z`Pa{ZBF@`TYvz@Vpz$rNS3HfanQ#v_ka@|5Pj8b|b_uq(H>?*%H1U-o(-Yo*C%Wb!
z=-3=7kd2}3hz;4Bnaayi8%-Qts+g#+L}~_)N00qm7G5vN6C9B@WI`v`vf>0z_(p9s
zxO8cTw5dKA1F`24-u_OWE~1|+o$-N_G)pjE4H7Z_q^D=f&*!HGPzZgfH4FbAaQZbh
zzEQjK@ZEB^w6LW{<@(8nyb>69+sm!dpeHR<LAA+M`*sOY*AizTut^T`NWE`tdx?!!
zgM!Q%YcuWW8%&hTi%MrZDUI1qH`Im+f+PYem)LVkm6Ab%vcelMW4Fx}9v2Zxeh|g&
zdg?w+B+ctsnq18AJUBo6^3`4OiF*IYUzJ1K7N_mgdLdD7lYGvJ)=d|(p6X3h9K<@-
z#EEHEW*~`^dq!WGMbbR&bGepfYN&tq7ByXnUkFlbjBd~$i|~w<>U)RT72rzJ%51e{
zb__zbRf=y6&EoyCXa+EO$Ud)o2M%9sHm9X|RhR>BFxB+4x2ow9xSe^u>a8?#A9v1$
z$tC)X*UW#he%QmM5~S#J_9s~jx7r1LABtlXq$k43>S^08s&CDly4D{VQZaCqQ2Rau
zI<`|JWjqj5k<733P&vb1#JyGi`4NaD6_W$v(nlKClY};PsXy%ZQiYc-p9EP!jbN1W
zlDR4Gq?E(8gI}MC&_;bGBQd8(tj(Tzkft%_&>k~Fx?Fz}uP>wT$S9ZHWuG&hjoBEq
z2l(!O&>(Fekm({r4qczwJvL`#n+vXZ3UsqYlfJ(hyp|om)e;&K6eZcW^^vDBc2FOq
zT$B6_kLB$yj!d|RG_&pxda<hhfHV5SP)&9$fzvmwHSrrAn`b{hy#M*QaS23DZez>Q
zBDx_Jlo5<&_K+wrVNk>8^MXiT7;99yE_pYu(bROhO9g<BsPo^(L3k3|rYqT&w$-`a
z&B>lLvkZqz1yb$WyPQ?&KKou?UJgREgmz?al|kX1UIml31vhb`ncCkjY3o(<Kg{U;
zE9@ft_Zyx8lF7h&q?Yf;ZB;y0sf4OiW2MdrOb;?LM9&;$l)QiUsz(VMmB;FN7Qad<
zt|h?B&8ijGdA=Q|dOmTIyu;u)fjs7_RR>cBdh*Z>^(X;~>JrEZB=r;-bi`1e90|An
z`mJ+@&ajrO;i$`;?3jTq@`r)_7Qs4&$c_Fc$BShVQcGyvQ59obU08}5{x374#~%YP
zCS*mqx(6tO9?Ul>(YyjBXBq0F-X(nriHMJA7<lgClWjlX$d#_$?5VzWmCP4`bCWx<
zxuj|xF3*-OSuy*9$QkW~Xm|*|<5<R}&VEm!w00^Zs*n`Ff^V4p5i8BAs=`O{w6pt3
zpfO8x#*n(T%_0H(63;7kXq|wrQh{@2)UKP3@++=Q_k;0iUcWeDqkzE6Fkg$34#h9H
z<~pZD8C@T{;F{SY^Jvr0bTxV>NRFexHzalSD;~1X0YV6w=szI3{C@+{WxxAa+PS`D
zQ?aWbP?<nJo-FbSyxfXvFDr|j)|uThcQsBl7ea&t8j)&WtN@XW@0M9Bjp*&mdf7eq
zkZDCRA@hc!hKc#n;tlYMdiH}gQwC80NY_saXW3s|)Dlq){CelcP`n3=)`QW;no0i$
zMnA@I>&dsMdg)cqq?}gw{m=lg`K;ycFWA0{ZdsLi1Nrp*QQB3@h&tHp*Ck5VQ1=G_
zU9%+S23J}GHQPabj~u-fhBRZE9PtomlD!jKd)6#MoWCIS+`6{E+`GOalszq^9N4{r
zzpA#-S_8VwRiL0*62HSDpk(U;h|s>YV=f+{&*3t^{0nQE)n46HYil5*VF@2X^~5{F
zok1++8_GB?0I1N+ja?L#azE)*`5IgMQ;d#!7Q$f*6w|x>NpWuSRXyWX^GbbN#e<H3
zULYy@OUhA9Q2gPl>h(Br`JMuwfDE*nfXRn-uMN5AF;Ge?i6MN~l8q{s|64Z|mca+h
zGrk$7(v9X4g0h9Y=gO#PIYHLK@h-lK%(FD9<rN^L3S|%6k$O=+EesV5Nlf~W(4$!c
zJ`p!=A^B^NeX)mH%f}sh04A#?6((haX;T3C?liOq`bCW(^6fw{I5Lv<?I&QA2yB5G
zpG{S(ivSW6U@b`oa!gf#-F!QIzVSB$nY%fra*K?nsX>u)z>z<PpCbRlWipzQ{P`+C
zYcfW*Ktq|u3kxGO<TG4N-Ia*)J3}UBj`6HbRAZ1qvb2}|;#^v)+H6Yd?=DNEQgqHo
zSfmW=U#2F6mo*67es}u*DD09tS@le9$Bt(>-GFZM4p6Gd#r)Un<^Kv0ECIc&{IxFe
zEh4-UZOQYGiPul>WB7iX>Ra+XA7=~YWqS$JY0~(F+MShY(#d@Hs6rckFb*k9E?PQB
zvbM8IQ}d#`G+mBgp807<Rb8)Wqw#Cw-H}0jM0%!5a|vuJPg>o`GAy*OWn$$y;5(bx
zJO+rfb7T7R$LaCmn)7qR;TTIQ><U`q%@}pA#X`0WF*4H}%!2iUwT)-fvhP4mW9<@h
zNn19fUpK`&J)^-37PZsHf?cKyWVKp;IhD8yx~CF*Ib>Pc<@|t8OJ5u$&I*mh<F0R>
zSf>`>Z!rFnFD1306s*-^-kf@@nul0wx$EPuwpLupp?j8oj-9HP=8F7E7CxovAnNrA
zY^lIfxH@<j`t7{zG_R?nv;JGO@Ag?wKCS?TKDncCW?q341d!h(@khT4$`K+;efM(E
zKRHH%XYgQXk~e;2T7`C)*3HsH{y|CBAii$|=t!R`2>9%ll$Y-w`(xW=qA$rpi0&@c
z?l&O*TfNd~ijUYeLvQg8J~`-@c617abKfaOZnE7QNTBQWvLo*=FJt9KFRSuDKX@;q
zZMn{Y%~w{LBJ>E2c&Ds?+<5Kv)7!N9Bva&+FTs46Eo;}|jk`}($<L{kd+343i9x<c
z$E7)kFKpg*VnV%GzZ2rwdR=Mm;Cm?PeWL!ef5bJ*<~n=jeqQ8i5`wYUPBA8={1Nz3
zJC75cSJ$g~Hfs<9&K&`Ylhy3Flhta9>(w%O?-Q+(#1T71uM>^kw(IibW{ZQ=h!elU
z3UxF({nYdCv)ZxS;sJ>!C2`DCZ^Ja?f@sH;W1+(Y%CVaH&d^F}GB?@2#q94FUhF+(
zBXUvnwj1epTi>5~yAIfxeGcc3)6$59x3CaIMFuH(PDb$U&bzUl0o0<zCC*SOF*l*R
z)1hohrGY)Q@xj5FSm)UGo{I%p)UTmwxv}HES{^dMi$IA#oMji|**|!8|L?}trj|~=
zg2B_YbYB?|BCtRz&svTcdT<6552NUXZcQUY4NRNYpNujN6Z97jdN-IiDVyp}zHi&H
z9y?IlmE$Tn!!I@?h;c)(23p2Nx`zrVRkQqE@J$hfo~{eULgre^JZb7bQ8&JhrRpg@
z0%?W6u=oDzQ<^9S_MSYY4QE`BkVUs9GtJHYh`i1ORRvF~*kK0))y!umBns+sR&)x?
zvx)zRkF#sPA60~;xb|pKu5L)b<jIi6%dD9>=D<2O74ZhzN(Nfc#4s0s_>4B-e%n6Y
zkfuLwb+G5xV@wQj>IvVg;yC6Y<r$LunfFlwl~+b3(@$=n!)?jijcbuHHo=YvK-BYM
z-o8$rYn?HP$keiMegt}P!N2h_K0sjN{|3ptVJ0Aw5$GjMk&tV9oE>YF7?FuQ>_`U}
z=<oV=f>HA`s6$JG41RLep=d@tkzJn5&B=BBR;#K;m|R7#u3G9mtYDbJ!1e_q<W5_}
z%exq6R?x=I7B<j--%R#vZLi*FrcDI@L;V>5j#2YJik(B}F4XenaOpH8r!+pG>a|a}
zmucUuG5?G}!@{89ZvPpejA{DrQ&!dc9YcJp*lf93HCbu3kBkKb^7^I_jT}X}9BIb<
z3Jej2)()zEiiOFCIzPfc;Hs3sw&A?>i;Fie^^3JfQW9H-U_lQpvjwMa?E!WjGAYrd
z*VxThgO{Z{W+QdR&0RAL!6KnXObMd)oFm@hhkP7p!$ce=PvGcVi)Ddz2+3YSxSSc+
zSVWX?FcBY{zVntKRF5n(XT#yLMpyCp+qXvn%Ughig{8ODHPzcSa<*C0Vf4anRbu(~
zv~y~B@Sm={HED`8lll>&;<WF3NQSBK!-t`q*Z<Ql0bARzr6IZi8Cmk~C%<~=p%H;D
z{aVpbEK?WPkTP<UXqGZda!W(%oH{|D9ck2<@O`w}iRz4OqBa&N@H%;HrS^=Nz03pm
zqY8V<y066DW$W`X0hX2*Ajyx)GeeWbM@IgjrAfB70697{r)7%H_j+KNgfr);IOqw$
zZzqXUF{e4GrAI}5G<%dKXt#4B7&9`%B<G0;&p&p5Qx3Kr#=r-Wpc*TO%LYr*DG$M>
z64t}bkv{P__x7pxxvx~EXRVTP0{X-`tGX3y#Y*&yk%vmb6PSTH%FifbqB6|SWH>5m
z%?a6!GVM=5Ggnf`^}a-lxWh<wG;-<+fd6@^K}SB@WcFm7lymi&Yyx`G&IIR9=~bAW
zdaRj!E`krTFRfYZ|A6bA=M1>|$zX7SfG&Y~89t&J{*Ae}n3jM|2Q2>+5DUgk;~~gd
z<!4K3RQ;rGB{r^6IVs+L^aUUBPScm|PgtD4%S5`xAIV6Ol}J>roGvjuI5n^rc_!x{
z>FevX`h`d#+4O5})yhHqQi)T;TVlE@Rk426e6tz--*uaS|KT|VAQ9MIQE)vUlviZ1
zt`$`s^07PN5<MTgH>Vpp21}J?-vP<TbNW($)SClaCxcn{ne0_Tg6Q+Ja~?AUlB5Cg
zD*<OmG|CjK3hUWKft)ER0^r&L-F_8q)~9Q|64<sfMFo=%4&Gd(d@QVrWH~y)=%wB7
zn<k{5<)x!*2Ldse4xw!fj^kI>d~6~%BOGir78=r`DKZl7P5~~lljx346F2Ysh1Y^A
z&9h!Z>1(}S>puH9bTc8q@~nthkj^PS{AvyH!Ka=->8gXhE`vSU%+A*~C-#=AwdlDc
zr}D~=Jvc`e4`$5{HsU4bueMsX*JgJY;vTsj^=BM_s2KTXb#?0>F#8MI*i((TX2xC*
zwnoGlzYp?N=x6gi4mh45A^Xo#pc&1yN19oA#y|$wuvw(3I4`vsk9Rwwq8pX_dletc
z<X!Ar^Cqow!@D+7JM#}4AsV}iLhi={7qral6rcT#+ER0XU<;2o2^xth`w)Rhz|@r*
zO7rq~;hCn;yZgOFaxutxIE*TlX;b$@EL~)aFy{w<93yIN*Ky_ZcOKrvi!@spT~trV
z;fF=xHu7Lc%`O?eneSJ&)4NUW9D^@UaM=sc2Dxkr!<@ffZg2Yv9o%ReB2G=>jv|J!
z+D%ObBHV=k43eANuuKEorXS=|!|knIw9IsCTQet=u6}XjLER<P3^9^JjZ-C9R3q4B
z(BKm#)C?M|@?7LJ6ZnNk+fnC^CHMg*9P;5<%HZ-Say;I|b0lg^Nc{%t-srL@4)fB*
zYLxnumM5~L(0q{eaMVGs+WgI@d;I3pxl#@0wViTwS8|djR5(0nt(Q9!f!rIr*;sK`
zFO`!j79}2`sRTZ6f?6e)&#&V7$c}<2^`=wXrn$eB&eGItX#vn0iYJ{25Y3e&nItJ`
zVITNJ`Lr>V0XR*!QL<DD2W>5hA5m(FoW(p8P-O>!pwqL&U~4c^uAJW2KfhuDU|q@&
zegho<qsb9L|Cx&hAht$u^<R|%q|z9_F*cwK_zsSl<HJjJAqg9&waWQTLtg>rM>10Y
zSIrJ^)wII^@@7W;7LY5cg{{S7>5GCpz}$lx_FPBOV8*ig4Fks(O8Cms=)hdG)#Z@H
zqm#j-dnRk+Id2Xl+Shbk6$1)R30w*0P1sN$i&CbMu}WO+ITUC;0X{|lQp02g8=73x
z90wvNMs*dpf-H(e$pz)3ixLBa8I!!U;ZMbl6--}??b4+1=ZJOvFW@2^MJ!_nAljw6
zi~2uaQ`ZI2M7XO(q?<B8&!AJ*4g>{tj`}jR!CXOViv?8*i3CbsnH01*%#%aErGYG_
z>5RD%-{F7L&eUIItedl+$-&{Oyk>-V(bKa?y7r8FmoIw0{K&kUoEOwL9~e6nE$YX6
zq@s(n%fgN3KdGGU%lK@zf3`9aC5n$UnwqfW`c?DN(!mKScjIXKXY%Lj%}sK#yFjr)
zmh~4uvUvVHan((q?XNm_k=k?R;Q_(>>?hjTCqBUQnWa|G)lzej@v!PrgiRFB%Y{r9
z?uda^QgBFZxKcvvtUQiIw(za-wuv>T{@TtqreB*jy_*x;N?-i4oLS<8ZZsskspwDY
zxCo$*VQji={e9Q$6uZ{1963p3SYN}U{0eh{U`OF;#kT-pM)>>1s06ZZ(9Q_M+j_ID
z)mH{7q!eSxK17&%R0ECh$o4LQ>FR3E?sCcs%tz^$u6~%O(V?O${<bXyk)te1JCBW~
zteoHA!>r+Y)<0}jy?Z8yyw*l~iY4`}5!W-<noqyseJbNhZUFb2i$$qwM1e6mM9LPF
z%EtaqTv3K~)5jDyi95|Ywa+s@b4F>%o~um}q6OA{6C6OM75moxs}fu}w3*3$k`&h}
zNUpuHnzzx3p}TCj#-1Y#*GNxGYb@6NL{Bb&{bGG9KI*+G=I1$%s3-25=)Rg|siKiP
z@px86;`*Rop+VMnty0b|U0q8bCAU*M@Xp?PsIfJa@pF*8j%`fx_iD{v|3G%O)YuNu
z@v&o)u)L|A>X|Ri0WW1RObC;x{=&Sp?N|EMUiN)Qc-B?x+$?V_uKd;r>SY9NmOYx%
z_X%ldn1H0#?|7?!*0_BO%gyY8?50<HYjzWenG}s!vP!C%lxQ*6Rcm}95LbU;f;viA
z|1MTDD7;XoG(lN+69tz!gQi5G+^H>&Q)f!Cma9t>fi8Xle%$MQl&C!)kzTJ1ds1X9
zZ=apD?6s_8NAvc@x~1SI7j|!N>U$5D=S-UJp=+Uj%+ab7DTU%N4ck%f>b`t`ltInw
z<JW@-44-quZy}d^Mg}t?zk7Ru%WtCkZ?#tZvp+8U@0i(mlnN6sGqD8MJ!0{|%=-C*
zOiZ~SW>5><b+Uen*OT`v5O36-3p)iv=39Ge_@>2u|1j@}tAn|A1!9n=X%cOVfa-`-
zL;yF79NnZ1bFXT7dQo|@a@MKL(o(N|5Zh)H9Rt0oYMywTMjeP`;SN7eOH$6-y6$sN
z%yg=Cc1%8>{Y1~^Sx7wb(&Kp-Wu(K8efPQEu@+;d-+*0&SUERr@`sLr5#{oL``+_O
zI6uBl%bX>Bh7|W6EwYSd#y{Z1FN|OfS6icXYAo<j$J}PvDD2C?tG|)j14a)Iv7O$P
zOG{PBR=HYa=#F_0Hks|6O>GhYW<UIs(~hKnH4;Hf4oFHR|Kzl#B&p?fQ=^*A&FIt_
z<J`z((zo}B7_uL1QZxU6)0{&ugL7-7dk71HGbLghfLuH>8^j61Oqpif^*V+Q_{8j|
z`%zY3CDVBUi&onCnTIojhsDg2G6TjMT>aiAIMo>ZsGY(2qM3-<GK^;^j`Ok;@s+}i
z2LRs9WU<y@4pM#g=_B%MW;aW^0<FfrpRF9{T&zA~=w3Dr=V1st#Hv_+F7f(~{bVc+
zMALi>g3@pn2|!3)xwUe-^#h~Zvly-5to)VLZ@;#fC_Vh(04QlqN)uCd=NIqc8;I|1
z`gHFIpxOniRlH#AS_9)2N^T>3Uu6IJdVAh0Js-2mp4VM*w$F(!D7Un7mQyq%c)h=-
z%6{I6;^G_9raYfE!aF7Z15R%>$y<bIG_uG+*P=`9f?Ps)=hB~$Ddvl+rPJWoTeKU@
z&XH!3(WSKc6*nF^-#e_{0&%kjhU-LuDe|P8E$v{?qIX+OCVKR>Kl|e$ijST{)VP6J
zrT~26Ue)Mg)06^}3y+n01izT@;s$+~5d*Fagj49zs<p16GunI%d^7Rluv5y&#o9wG
z@3=8BPwedb6T$Ss6Mf{6KJ?e*^-S!oTPaAzNg=|hOh&rI(@2B<C*_#R?d~$?gZI1`
zE9lM6D`0`38H`dT*Vrtt%4=W4P?|pFW@86QV>i)7?nLwxvvT~2>QZ!8mNzaf?PT|S
z=-DRG&VW<9<luBmg>28SKD33-)Vv$g;0G)zgNrG7^dNfR9i`Aof-9QaEJ?md#Y26V
z^X2J3=aZQm`|W)fa2PzVv^bpJoVr@>rIY>paz+$b&U{~aW77N&%Ne|dt*T`8%(@Hz
zPdjxt1#vG|@S`Fl%#|_R^d^JuMhmedxAATPOTmz}1B2P4{44dZ_IX^xADv>Hv6?n(
zt@DN|LP{j>NB6!j)SSVO&@X?8SRZN+0lIx|wYCYdm)ZB}WQh=uL?iC*w2?uQyfJbV
zgur5k1do|0g^j*s6{Iaz1S`iJUHj@DD=X$5eR@$bY7<&%a!%!VkZz`Fa2TmGY4Th7
z5)csNE`uJS31kqghbu@)vi@Fyh`wc8yd8er=*2p#NFs5sr|{Eu<jRZ!@)b6%WX&9h
z`gL4^v%!XA1<zaf>#?v5B%6<-GbjO}%M)Md;Yhy$!3V&sil)&OaI#QBdEwsS?C<H=
z<*&Cut2CE8IWifYS9SYP0?2cmot8H-=<UH2<V_z5>%}4d9(h=2<+7m9WzUG*X>tl1
z0jYCvsvR3WP=ElMpS~u7U@8IYW|adI9#n8yRTcXAytosP6U8KKblnsnF%U&UAzKn8
ziHOsU1SC>AStD-O#Re?UI<8;9<c52zN2jzaU4Lva0BmvT<wI#ClKZ!R;o%G4zA;I7
z6VmG~6IQmW_oj0C7VXu(VoeaMsn8ooxMA{;Y``YTa<D=`Et6CQ_Xjz*7HTIrtZhi~
z!!fJ)FZ55*?elSP<32OeHp+D+N7XYS{m|^k`6AQ9Nn9VEQ_CpVfvjH8!JG%zw+JI^
zZwl%t1yQRv@xicO-&IFWAE`lqG#{xAkzj{f@q!{dFX^59cO#+s+ap}}wGnvfQJ$uO
zQ8v9sujYKX+~<W~=82_8UiV;w-aSLw7SbBniU^F@)^7I^x!EgP(S1xFh+?(R{)__&
zok(WIL}3h9;75^I5p-zn$!IRoys5K%FHVYgRw?gs@aV5CZkOB9HSb66$ue--P=L?r
zl`KT7I`ay_3sX^mSjNQTSs&g>*WhQ*+V!>Y3#M1ziYiAo_&XN0x9I^(uep357rLpX
z;4_PmYBMPuXTcFH>&(-$;I?Rf!0izsl=(QT^u6^qsYr?mT+$+@MjTgMQQ)mRfkL=-
zeJP%N8P60i&|S5nL`Hb}n6iYn8$4p!EOehIVbu2jvGx`~aWrbW@Zf|Xfk1E_2<{Ld
zSb*TcT?4`0U4sR8cXxLU&JZ*>!QI_u!grf|=bYXDzqM!Yy|qPkWja&UR84w1@AE#E
zc|9Y<p@zv&EfG7gOpM1O7+i%})@oehR><2CzVi<x6E)CUvXMHenT}(NnOJ|tpBO$z
znBzM3g5u)ZXIUat&@(%Rd_0?obgD`g!Re<A_BliJzb;ofs2n~sv8$5zUUu^1b5)5-
z${Wj5>bf|u_V9pf;;3mgQT+|>eEFmw)mKb;bl!Ol_VLCE5#*}!^G8fq(!BG~MQZi=
zEx&IxKI0Actux^do-z4r`gILo2f2$hSL93|E4B><mNC{PH;5G)V61j1@&*Wb<&d}m
z)50PK^rKb+PuarA7=TGiYa1j8I@qbPy8Z!7{JDUawg5&+CrDwUd@ONMhADB8m!lOp
z;8Nx-;gToHUo0soWdqjx81c~!91SeM4@JCqVj;WIOQo0ciorYP5veh$dB*vsx%8Z3
zqY|TlX4yRYdEF17lSxhqF#vz4auN~%dKvX;2D1@BJ`?ffKOq-X2N{Jpp)Fv+ul1gG
z;K&^SCwb4{<h4nOFnlloP9hLw{aOmgbpud=C_Rk3=w+WSpDS{0G<T#B2vmZpb4~C8
zuS&3r{q=dKu5E>;Kvo$r{<e%$0<Z-1?~e=uj>r;%L}xO(;vdvM<q;y@4{XY}N-!Fj
z*o#Rh3d4R_n&0Cgnk(CL*VYvETNEByI&l%~gOot5{X>h^b?`aDFw)*0=vA;%=REBl
z56JNY#j9339Vpl>I4iqRp?w}|!^D1}pC*l4(RtBFfts2>8sk4Am`_tV5xWTnA=12#
zu)grBF+F4qeQPi)tvZ5oK|Rd%+A%vcKPb=Y52e*P%9I%TaEa=&w&-7~&B**@IHG70
zY7XKCqzDo(-#3=ep-yPksK0-`-1#swXt6@xFsWqodTEzLsuB4#@d_}OL{+(V=rbe6
z<7~l~ed?v-KKR~#%V)RB*~?oWISzi~%wud2D_2r!-W*W>byWm$`&4;;Vy0pESZ03d
zlj>U#o&hB_(bYKLCD4Cngst}4s;zD^Tv_Eg#4-jD-O9uKIdJA&#n<OT`P5@Z^Y>%D
zLVl?oJH%kCGbmS6CxJ@Fy7~+XZRvpAZqu?jS~0o{XC8t*Pw?8YOMg;yZ=TuZFm~*{
zjN@PrawMC}k8o6UyXkXZNziY&wJ6^Ou{g$z+hFS~<&MC<3hPpY5^hp@TKHzPxY!T+
zzH0bLMdvns<1bv<20XYckBd6%zgZF(B@YhO2w@r_P%J2KtNUTw7SUm7+oqSL)&XfL
zVLP7nD!+#BFxJEp@|GBPLyDr*)9Ki>;GYA{UYev2vazs%z&uKsoSsVOYTZEo5xD;B
zcHZel5+WfnXM(<pF;$2o0&WgBzGch+y7;%d(~Z+$s21F>QyF$yW6y5WkqQbHGRml|
zbSuhNAS7yVAs>JjSPENAtCI7AGSo(Opi$E2SpzoMuHpI4aesjfG$Hg7{&F#!3E$4X
z#qn5Te8`TA<;J^|qN$V|Q*w!G`GsQVSFZx>$BG#a>X`{Xn;lH7z<HqyD1g`FcLhD*
zGdq6QgkEKEDNbFpK7DmT-9>2h4+0SxmTaLuL~gXR0rFSu5K7q}6t9MW$VXyi&OQB0
zg82HxVi{-Pmi=*)H*{0QIwe4Ep17@gLt_K}!60$5blwGT%kvk=xb?RnB$c?owqv?h
zQ+guL_1AsZ7>a+)V$EiDm2oC7hSIUtoCrP-B<Ck`N6AOsnKvor`<h9K3{}V5ZtRWx
zkJ_6&_vnN*$5W{@m}=VEhE=!@_-Ynn3YbcLDvqMZvY0CNDblZ$)k{Ug7V0XYa@oK7
zDAQExjToC=b*B1I{eTc#AgSNQ6=+)Nu+efNaZ_Gm!HnCpXJ*ulYYw=kay-#e*eH5{
z>($G$&T+%)E6^!W%Uqlih2YU&sFJP<_OL^$YPzd9=J;I74{of?Ptoep3k<a!>D!5H
zB`G%}=f@;?DplLt#Vi|hzgsTgsa_Y40?(PdLO{>ZYyfWPC?OQBw}00IhxHP5tqGit
z?*COCFw${K#g;IcwbeBOQIf#7KpFMlKWYBECs8PfzU)l3W^1q&7;p}@zI?G?b?R&z
zH&`Sd?<6YVA<lDh{8Cv&{<RxvHr3gMt9LE|CDe{TD7Kc5vlLBEPKoksWgcEU0vJf@
zll?G`Q=x;~a)W&!R*t<{2Pdg|boH3l2um}zdddY-J+6$fF#T?{7=rwCi$Xh}GOfVE
zaK!XXeo#61?fTNYPl-0vhfBL2Z0Th{kOd*<g}R65!hCI%7?E(8flvfJ9i4H<#iE$3
z#cC+c1pedYg}9JQRX55}y&Ov<%wBFav&{)Jx=D1xAA+PphC|yfz@S>*G@m0>AJ`q|
zOQVRWFC+yYRVV~7F&V?71-m|+3<xsJ@i_RDS|}vXAjLtY@fPx<6y=&X|BxS?HPie1
z#Ghj(%rnXB>p;SyBLRlU^HxN+f*B4|x(BJ#Bjn7)EtFPD4Iu78>P~=|fUWptD&MDY
zf;Y6bYjgIS|Ii5gUkHlO#=*~_?DM9xPE3q`cK=JH7JYU-eY-%UhuJ>U7&3tSKmxcA
zT2V$0WpX?-Y{vJg^hz=l)~D6oe8rvLp>S8k`vnfl#<PVPxy!3oMsiGGs7)7?-=c1!
zoeH7WtqI2C>BjB>p~54qjaYzU(}wh7!2z0BFMslE(YR&3@_8v_9mZSC%_qYJC-7W{
zp!IrLeSg9&MJeju0{E+8?aZo8#Do;fUS50nTIX9hs1MzCWo1!YoYzPN*dsGb%39Kr
z*}L!oTs{NUo#c6=H@JE^E1Tt8sd;eV(ef#Ytv>1iQZzMLHaTl8liGtB)H6A$7>f3)
zzCJ$JFS@?oFJ6iE4a3RqpW)+MGcm@rOJ$tgIUU>acj0ou2t*+$uNv)#!ZcBmGz&N4
zKK=C=BiR(C$;6Y%g(v<bO!@~b9#Roq8!J1;`n0u}m=2-JDA{x7W$CRek}nw3QD<d}
zat=HSaw>Uf(mfaC%z95>t}hn-1ip1ROo>vm;qCkbVu>}hMQ*U14c3yMpfQeCG#psA
zgcy?i7T*+!(x;321F=ftgm8M`GikQv?cs{`vve(rrahS%K6HfLmkNG8BfQ+R$V{Xq
zkIpY1+$`4jSDc9q9%I)eN-S9C?2A>G5*kp&-KFM-bKaZ-FxJV~#zf;%H>Cz8?69xh
z98wOHe!7&f%oGrPY4`n8^mU!)=Ru@$G2}3t8Fj{2nT1{Zu|L;E42-W7ddP|Kg3Pxe
zU=knub*(n>N>{i6aHnauq%9Jr;lt|mOvFv`WBk10x8QmcMbh}D0wcn6REytr8|#2Y
z%+~PpZs>yF27TZ%YUm~?og@X2wUK0@MxlmLeo~p<!W8XC{g@b~)WVVAZ&XR#ZG&w9
zLQ)t9KFf+Uw~gkgk-*+cyHuC=28wL+(G#NN*?97mgX=M&)jaS-n39qoB8~<79Qp&=
zKJy5+a|3v(dbsdV;k;(ag@~JU9H%e!qq8^w$G!=pqbVjiP$T?YoaW=TL)4tUpSXsI
zk#4G6mxrr#t0KW;`k`6xKY=resGgzPNx0xZBl46}aot7T=HB6x4;?@iwQ!%<VJEZ|
z-#Kr9bf@q4_b0yH%@We8(scp;IXX>Kv!d$wcmgS5I7v~&7zPoQ6D#rz2}hWav2767
zt|~1Wd>!JU3;?a%670s1z-Ohh<&i@ND)DQ6EJBr~WjY$Y_CmHIK5njW{Rnu5=%5eU
z6PNfJxS8pgU-zGIgueo+jepyP^87wwCgHht=Xw!Z&OwuEFkVZ@XU9+d&ao5eWkfDy
zS0sKN<2|IL<yA~Mjpt&St?qbZkMsEXGMhywJ&B+TZpJZQ!>Dwc3Vlt-8xt8K9ZdqE
zJukNnX4pIS4a5{DfwbQlH??Dk1%<V&8j*M@?}#Mau?W*yyWw|$;MmVdd?M?Gl8#qi
z)<a_RB$J42ISUx$cw>kzAR%z1tpv{ConXIvQ-G6cRlP-`Ol1{g8@n49$YeW4h%o3S
zhC;d@2It8W;@x@C=d#|7JA<jWqDxKh_9<f|?7ek-*=YxOtGW3iVOCQUY{JBxO9753
z0hgie>ZwC6wYaL%sT2N=dc)JKLTh~I(<9EQ<Go)SsGTxY2*%fFY#W^=&zDt~dQ;F}
z_w7$>Dl4`X84Ed4)z^z;SXi<s$@W@gK$f5_Fwc+~@$u!A&JfL1bJA9tJ`T6?4TaK_
zqmz}jdY5<=MO&T}1jA~X@+e9SNM&MdD;F20Y32Y`_TwKX`7CT47;INXZj3FNQweF)
z?d5L8ygS_Zj9bGjl9}?DtvDRWxETo%K@WDi)M}0$vWL<w8WmLZgA4%~RgojS*MgIO
zAeK0SHoQ?e2Y+JdX8mUZA-4D#Wvym>EHZ|Q@lU8Ri*ub)0PzIKAIV~<B3jv=i6<S~
z5_~AbWvN02ml=g-fmaM&W}nK)46(!-<Ze!t_;D}U`Xj;LCd;x34m*aRBE-`5lI~*i
zzG?vXlmVxO&xl872Jt{=`el3?5K>4yZJn*1-&XQcS*zrwynv$cAA!^4bf^N!A95yD
z(=T594S<3)0E$K|^w}#g%?=y{l&CX=1OQuO2D}2W4m)7u<OJB8PiE@R7S8;?odhOI
zfT~FapYuH<>zg9c^8B#_4oG$xGHo!OBhKhs_i3{z00JqS0_bNaj^CVxoljA4Bdhf<
zkgw0)m-dSe+<pTRlD0pm7P?NlUOvI+>@()i7Ii4lqk|K&@yw_G+b@fY0L(;^=?wMQ
zQG%~Yxcy5X*84|Q+<+^eV=Ix{ym!&-1-*LdyC5$K=-1r>_XMZ)lFzFqSrJu6N1K<Z
z6Ow@0q$rt@>Mf9D&142dFTm(KNT$*bhM(ZT7*m7LuPR}CUysv4uo9iQVOzs^O*zU`
z6O9SaF9ol#Q;ky18pj!qat4RFZp8tw{7z+Mt+w_cMPslD{29_U$2(rGT*{dSu>C0I
z2>2@u*=ygt>C}r=th+=jp@o%+aMe%^`*H`GEyJr#(%$>shR;|QwTHNP_>mJBC!0Xm
zlv&4LprjpHPTSe4(G!TlOs~E&|NaTE7kBtiO_Vq;;*+ON6^e_plgBGNH|sZ|SWX5|
zUtlxe1&Zs+q2K%3W<I1c;Y#1#Iv0M8)bO+7<9F35zOim_phopeR;VnZy00xdnunn8
z6R3xA_HdvH-Gm{sQPtiz$Mz*dRd}r2kT7PrA?r9v#Kw5=6V@3QRGO*iFOXDYC`+nW
zJa5XYHM+>)W?kn*QYIE2{Ntj4splxi(l00Xre$@RcP?jgqGwRy-9B2xh7zJzl;QWU
zpv^|evZS%z#>DY~iagW6zjhxW1-?W1<#?#R**2Z6KFR-X{@w!H(5}TV;RCj9Gj+ly
z61W@cbN;PQfT_uYrq5k9)i64_g19espcj_svmiH$1Q`Nati*m4XK5l6#~dS$4I4Nh
zL()Oj<%0K=1gd;a8dixfGrZsGJQu9-YiOu4+zl)J>1-3U3m1uPxcfCXbmKWTjQvlQ
zdO7eB|L=X_stl)0mIZ7Y+A=oeIt97*0g=sv$6cjYN-{-`gsE9)(H4SNxYIsoR6spK
zT|vxF!dAjBAh0hbQu_5YAeW;lq8-wzp(y~iYB*p3a{B&H9{l2KyS<|xeOzY;rhdaB
zdgmQW*`(}v@DwJDmoDqxs)V(yx_%t=UUZTOHw5Y-sD@qg?vDF9knSwPs&FX%Yn`S1
z*5%y5@5;g1@O1&!X_7{tGTPxXkzm`WHu|rxllnZuh>cH{H(Eoet6vSsQySJDdB!CT
zW!gI&N9X-apb?IZcWU{rkgR-jil(r@Z1ee!^7a9$;FoBz!*v@4@`-S`O^RFozQ4t|
z$BU6&Ec32Lpp`{oo)!(*Ue?gkaL7v#NcB&*iyN7TliNA4kXedA=3L~4IY*XP&E4l0
za4~7RB`%6(g?6dqCUbs(gT4!7@PkhU!G$wWAqzdv`oBODX{~vv%-r4lQM&Z0S@P2j
zW#80w^1j8?XqlI03K*;c^XXSr%PWaonp;#uTZg7QKrUYG`;TGTJZO<`A)$2cE+fg%
zNPRE5_gk}o#WmzC3b-}-RO<mHkvgCx`j7{k_*Jx=MpRs1l#$AOzm;nH2486??D4cq
zP-rEi(!7D)0+_IwnHy`1k}#jR)(ocI=S=cl6;~!%8M{cYC-tF8(Ax^PQ!9=;>B?!y
zTeF(1F6ZCwv!TTObTL7XDVpMej7PIPy92HilHWc%eZE{wolkuj{uDfzgG=<HkpK6$
z3cH8Su<-DWL0pHJT}f!yUm((<7K^fylWjKbp-HZm{j0*Q#Gc#T@4<&oQFt7+q&5Cv
z(t8W$E1V%69XS`~6bE{Vr*d~MemWRw`K@2&<akGnj2udVh`|7}qBzN5n_H%<yZDQ)
zVI&8R2>k`%ni|)2O;rNF<W4Z4_nky-^m65Xa^z7TD{xhs{B*EyF_!baC1`7j@^lx|
z@5lv<|8lnJh))*3arGni>t4uDFCnN;Pi!n(QDi`U;x{>Ic}*P=7mPF;GRHACe(wbC
zGTz)NHQ`WAA!#8AO$8b3dhC$nN~*?aJ}eGv-jd2NU>+xDj(b|5zQ!3*oRZ0nl4xwv
z*t}#c)Oan>Lh`hcc<@qdug}E}^$Px)=teNXZMmVZani<5Ozax5l^z2NQGpn$=ilu_
zEZ$s!9k(>5tTbZ^+-IzmZXURoxN+M}@Lm}1yM=&S%XC{zT(`6rUM+i3JAaU}F~Lw|
zj6Jin7?5dARq8i%d}cbKqHa7bGPwV_IWLvJ50%=xOf~!|V*8beB2op3?0pbE)S|TW
ztgJM#HqBemPZnc$>RyeP4{K4vAoE=W#2Bx{bT52e!PI^sE08>6L7J8?h(|yRwa}{#
zsK^*xS&%d02|8dWN=8CTkCGSHyq2=85$7=Gi7^bnR>em;E8m76V-VAlt*izV*lvsh
zw3H!DACI0{6Z)zdJ}Uf(t*LxFvLBc{@T7VkE{B<`n%k#Wk7Y<IZGm|VZ0&v+8{Fkf
zntYn`QuP8<MczRXm91R}Em1CIMMy;jRw5h@*{&HnUP6_0>5&uFroR%t2^S$I3`Q6?
z@hXYxX<8`K!`SCcAu;5kJ>dYY(r809UwdJ?H}SH6$w+@uk|}s@smiNmG5k{gJj%=D
zbG%4f@Cn`xdkOFxj!S=LdD)cmh!(LpBA=I`8>Xl#Ulm2*qQ%V%sHcB)TSs(=_tteu
zYi0=u$^z4R^|A(D8EiQ^G8mp<VG1hbU=z^%8|n=O=&jkYV|J}5B%3rpo_if1$aRt7
z4Rs2{AvC{YS-iLD6{3gIZqcnfpbo44_2(MEFi&7%yCbJx7#lySh=>>)N<&HaGEKr7
z`&1t9vKf_htf*A8U@iuIT7QQN?*yp=^hE|g)C|n85PAiXGWtJ{kcBD9zVlZ*`#qkO
zd%&eCtDzIXhNDJj&s8Nxl!*+EJJj7=>x`<7ud6#Z3J+d~l`htb?oP8MTwp-Uv!OQQ
zi^NUG$SkfPS9N@P<EYTDl6S^_#EcE)J4=e>XsNW^sFqF%4`Ni3rRf^f+A*ea9==2+
zikqnx;;BNs3p@+cK8qJSng0u9VdhU&)D+_12YbRu;n3iHJMw~*nR^hY*Hm-1Ap78j
zN1pDuiDNV2hNU$=k_CEr3mlz2IuFh%3G&@N@#yL=sJ;n8x>a+<c4~`g7oKYPiM6*)
z^6P1|<{uUJ`>J;dDT~Lp^A&VV8h^7OfTpW`&XW`<)OsU-;Cu=GzNYyoYp9{M^*L6%
zWD6~wWvLl1Jla!azz4BiCVNTh!KgiTEIqWGy72=gWjYSaR-@3<$$B_Z<cG0B5``J_
zNcVY^_}_c~-&x(`c~&<JhL!zkpC1#Rz(+b%q9F6GLD)=EBjYIrh?7VFPcuG^wYepz
zS1&)Eu)#n9^K8zv4hf!Ngg?D~Il2(MA*QaNmcZ+H@zP_Sk(k<W_cNaYmvvUQo0#y{
zbWRrAs17s+7yXj%(q@26cz{a)rs+(AGQ=Xp>?Eu~b9ulqz|9E{WSSH#pUPVoEPv9@
zUn~Y*p5!^f3`zgPa0~Y@A3;7RmN4KU=m7@pH@Vymtf{HMpbZS!&r@~ae+=2-GlZOo
zAt(d6#yP2Z1`-ow1`4bNz%dF|_D!FfFvB!A)C^%SP2i0bEtxPYZg|h=FeF|gmb|5z
z@g_A)DR+)9<zS+aA0QQy|8-{Q+L6G=Z;$WGAWuVGvV@MbhOw<{rvvH3Z`9BfYC0YK
z?CfrZ2YKRuP{YvX)Y<YJ@Zw}pV>V1Wd;lhGjZB(<$N4Eof4m$gVrAN=)C*+~kF}+H
ze+)&+tL!e7%eXfRF!6o==E;Ecw|T3rLqbe~d1<^`%CzY$ZQ*{k76nCZ@g<7S>&>{#
zqO2(#7mj$f;_`%;^><q*y&QkCep5gFgq;A!Z@p2+Rz}~3uwyPH%RtHQO}*RFRK%<u
zmX>7VQg5NiqS?IjcjaM3H9@e*U){7FrsAe16ME);mTfS8VXKv-%;n{7`LQYR^fa@j
z3!bBzIbmTZ&Lv%j96n8X`~_kjNxCc2v{F6GXY%gH|GltD7|HWRkk7;2LEWiWvx%#<
zk>BzizL0~oEx^O2AN|LKR^@c3fA($z8X+=pK5Alh!S{}4O_GM&a!^c)NkFk(z#*d<
ze=-9QxP)YA*5p^cwIxM+BC;UiZH_4q)!hI29uT6y)nkdNfF4h<cZtwbz+gcIQ(fY-
z&R!dIN&7N{_IGxj8710cS*DIA%MBUIZ+1;lkhtYxIK?+e`_M4D-fJgf*4rKYFed5g
zW?a<Ar^x`x`<4tYp<{10c-C!Z5m=CLPETHHrXYtn_riZDm-nAD{jqgR8Eeba1#;2N
z#4#(6e5u^u;TW?28Oxhz<=`tLA3oJsh5;parrEl3%Zf{oirx|IS`I2pS0wW3M$_wI
z2Rnvaw)Ux^{;gOshOxe_SUJkLmAu?$bCm>fH}>xtG)k(Wzz0;v@gJYk|Ljcr@2>kk
zE9g5@^O;)caf1ZN!uj{;k_Q|<8N*A2A9&U<NZ@Gp0ilQ94FCoH1tPxF&S!>CG7a)#
zd*b1a6lN<Yc8Iq`-Q>XoN9TLW=<Ywhhl+$r$30<M8S6AQVfpLRu55ieD%<jffsv&8
z3S`vRWh^<b(-l0H9E~yP(3+`c?(JN8v@kJ-t4U3KUaSe-!N;}8^Y?GDWpUk)<RLD-
zcJU$MV<bspcU_egGt<axn$F|%$6qL;+YZ9B`q(wdg9Hbk`9ecS1WZqhk6J_)C2uB+
zp5CHygRjbOU`p#%&|DZ>!zqY0zW_$o)*eA7e06@k9PX`AX?}96JUb%<L$;^FR_u0Q
z@3wy$t}1Irpaz*N$oJaaa%{~CE-yE94caf%_AB{GD(utCU1`26KYg8&{&5`GEL$oy
zeBg$E4gLJ|oo=)+1|F3_*hmj!1<qz$(<v>^BuNWX^?NL^PfpO!6Mco@5JHJ`64fd=
z&=8LRq5;A9BI$o9$Tz|(K4PRP44s+c;2l0<D@ww>UG??$F98bUR12NV&02}KZ)RU?
z3)?+HHlyTu=gji%WEaK&c@2@zFfi5LszHBS=x#hr$p*9@%j7-Jz<0>U52-UE%~Ezj
zQ4ZANXBi#2`Ez*V@RBUQReZ*08>zq7O(~7Y1S7#d56q6FV=ZU~1BhaFh6PJo`1wzI
zK2h7+70XMv_V>WbIO4?Ji}sQ#7iU+H(#gFkY`Eo(l%dW2A(M}gcEil{t$hlUksIku
zlw47PS^-X4oJXoK3NLytF#K`|PnF~XE9IBcDwU^Xbt)Diu!!75SaNIhS>Ml5$3_~>
z!Jkms!yA2)E(<&`729c{pZ2XQDH?o7Z6Cq#sGFSy4yjqen#!!d=*9B&+PqGCi3P`{
zx{R6nlM{gw03OOo<(7ALDg#pH6F)s;`6_kQOdMvCw^EHHZQz@@FompMkMfmcac?S)
z9La(}_LBT%vz{-{M6_p4-q>IvO<esBAw#klrJ=;iaRAf}Th)V<o<-^0!b;AeECpf(
zCZ_b6qM}|J%w1JT-&4>^BgA+nnm9L>yl;fYhr0Zdw;biY6~?vixx&A{xQi2BeV2%<
zSqsXTJ!~`rF{_7AZpHZqHY>`~ORn!CI7f!2c)6S3bQTsRi*Qu4ni{&!ha2JfNA<MI
zaP_S^F;6Xy3SAulHmGgw4xCUcqN}p8xOR<w=Q&L6KFX#TLy=`UIfFf~Qhi+`_(`pi
z*q&`lrRbhke)hi6_P5!2)*vj3%Pd8~-itD&6Zd$#v&6WG3>`+b`qrQeOvd`Jn`3O;
z-4Dte<yWs|bkMPL(`2*j85yZy{eB#uP&GwM!iR_R`ae17pl5A-T7QNIWKUmOVx*PR
zMED6N9b;K;YRme&y0$QE%oEkKJHm!r1J&KRxE}~E(*XZ-{wjQU!~vS)d!LZ^R2M#r
zA4x}i0ySejQe^$yEAW}}*6m?DUa$jh&D95jT_&=`1vw_y1+K#&yeeT}(eK*ZOELJZ
znUkvT-EGWKbA*l;p5ud(-4T^yfnb=jTg5x|yi|6g!B{c(GG8FRu5{XyMaZPuGg2;b
z_X-JWk>2d5<%a4o0C=l=a>|Hbl>kbr*cs^CIKh;{*1nNnrc2Ol4?ROK{>LvZ^ou-4
zCM?Th263RZ%a{Y?L)}W+*nXmk<edmWrd}5Af2V5wB3(VaGUKy5$srU2Tm-JS{M$o8
zaNHn>+)YupKc*iCMm~}<IGlFBtpxJO<yxnf6))a|R}Wnv3kGl0*_ocR;=ONnIc4On
z2upPD9mrwAZjI!^=(u~B9pS>%rZqK0N78nN(nl940u#Fsksq&e@<5(eMgo=o!XXwd
z>=u%?{SeFQy5{UHrZ%j;?flwJKf5U9&08Q>S_*_lMoHxF|GYr|H3b!Mun7dFc!L%}
zuHDu1ivGAyv+^a#lb91hbEHzwh`^tg%>Nk?a7~ZN%PHF&2oNT+>HcV+dD^t?g<8O>
zuTay{)p8${vxr*mKasUG^(=Wm38bI(o}X&Pi~>YKpkDdroz^$f-Gz+!Mlb*hzU8)}
ziS#N$66<_8eVUiJ?g+YLNVw=JYFQ5O^rq`)x8G*=DM{3PoD^JENZmQ1V*hl(rOMAw
zw^HW#HlETdd8+e^c_5iSAPe}vO<;gi`*8lIW_^ET;cbD7VgJOkesn-|36)EgI2?5l
zyuFu<N0r}`fJQ?`MNydL3Aj~0rsKL=O%i<rH8LH$Ye7Qi7jH0JU{!``1?@}%f69dT
zYrx@we|^%iCWizS{)w1VBw~TxWPZ_I@@oJytOmaBYs4-XUJ%S6peR{|a^BQ^iskxc
za^p8VL1G&Et(#TIDxj5S&)G60%4qXj+gdYj_Ijx~T~92;>}c`p=p+fwQzoL9>{x#y
ziOfh=2tv`Z+qFuv(c1oQg|)$N=-tw=hiRpPEh0|deOgx94*Z3(9%_TlxKvYr9xs0-
zAr4e@nCZ7*)xqxAwAx(jsee2Ex$qFN?275~EuzISPmGaeE;M#qj?D62-C7%FKth0e
zqth>wW|C?5X~_TaOAmMZgdL{D(wb4y5My%_5{!!p!2hD|eoJ@K%tQGXB51ALo2qCm
zvH@?JT4Kqv#)LoNkE#M+D2ouimXP(#x3rY@w5noA@UPt9NoI(RUT{lFI&vFUrkdmf
zYw_}By8TK^@`R^HR8o6%_6L=pGuO7U>B>n;qwx$!>VTU;r5DK1d9@)+kkR^QkItm%
zHT}mR{MA0rI?qX@HDVfx_T7QZ%$oyY;1w<4aENl^Xdu6ceN&iNJgg)QNQf@}?ACjL
zv7aY3dGtAaN1_4q&tBc!fD`fW-Fo;8K2N@BG;4uMj%uN3vHg3qsb-4lz53t=Hbw(l
zk_bBC+<%+_<9?A?^nZ-|`R?&%e`A6AdrAqiSTouAO~oU-bP$_GrXs(TyrfR1&*m?M
z>;8|H^|qxf5Rq7)7@X1R+a@;M<zWY&kyuuPIk<U~>V0`Nu#1b}`vEoe(96<BOMvkg
zXZbgSKa7va)S}Y#dLurvtf4-X?tNyuJBB^|tX>G2ANLnRg9u@oF<VeqrA3#!hvt5j
z6B+r51i73Me)s+=<!@FUes^s0VZv*Zn6R>O0hQV}Kv1D7gscTfZ36NNfno;0#-PSg
z2KKPWJ}0=?U7Rcxi(m+iDKRndMR2m%Hhr)evG-W>+TnmfZ*XsP-dI3IG8$mLRV#4q
z40l>>9I-sw9?kW-=%BQzvgL-l?S?L$uY6bKu`-C}T>1-i=sMO1E~?@4CP`PzRHJh5
z)F+9=`UY)JdM<_D;s@paGkL6he-<}2W6L?!s-S;)I)xUk-B{cbRu&sp7DT;==B0HO
zw=NnLpxUePo&CoKVgo&gJ%<%GI)r+-XN%=?bOwaS8Ukm|L8bA_QeU^-w5(&~)PEJ3
z5z3FPSruxf*F5(|C3X2@!Q{LZ-e4EvhyGe`J(LoqOtVhh@2uVHmv(t~y2@!<Aw4qe
zA1Q-CD*hlB2fD^Fl-g^gXi<kOVsH9_J~a}8v;O{y(S$x2>(iW=kRN)VOoxPH>h+^W
zknOp<tFjJD8=NFP=mgzH#R5t@&9qJ^|Er1wVr;cc_rLW{|I|JGPyMM;U(?zSKKjWU
zzG;gmZ<pCYUp&>$2~S1Y=D-o^P>)Le^Oo-~&_kJoV*Cw9Ag!E1Qgv<SgFbQVn=RP+
zd$py^84u;3yHiJ#E-{Apjm;lyzkd_RN-{rDP<cfMDn$grflw^ZU#!JaQ!<3g$IQWh
zX-&kZxzDh8i9^ahVp>8SB<+?-8=W6)t32)0WBYHLPJmd%i-jdX{>%_P{`y;_#C#bT
zE*khh4uhw-w7(<&7T(P+qv$RQ?lPOv0f=u3AYqatbtMj}*wQwCb<!|RVW?9J-2W+p
z^d;ScplVx01kdYpj2_L-04K=L*fW9DgQ-OvZ_h**lv?7l#Gdr8F@vQ~D4lI*iN!Yc
zi%F9C;oY<-0;a?Cuh@S=^P)Y}+^QC%UhRiDyiPHJq!6<Hu#6PqIfU%%#FZVF<UdjB
zi-lKT6UEgVy6F_gp-Q3lj>P%dyCUsBapq>z`DTL<LBu8MIA8EyiNljj`?bhP(K3c0
zNzs<g;WQQ8xnDe5)ZSwf>8IO^SLeLF;gIYIx6{(J`F6^TZ1R}`43*`9A~?4S1|F9i
zXymIX3T~G#)d-Y!uHVl_tP~g(^ta=D@)_1}`{MIUceMmsrXttOBSv^I(m~qee53!i
zc`@Bk5-@iDd>-#r4;5=B^HxyEAy_hgkl!=F4t0*O+_gvJS72;3q`cPN2S&U77Het9
zusJ5*VL8&QrFbvUZTttZamgl9%#x;<`Yx=7tR$2^xwSR(M2Tvo3Y>ZLytJ+^LK*$h
zF&u#H{3c#eL1F@h){NFH{+r^Abld!M2OLaIwErn-cKORu_l?i2WUw^jFr87Pnrb!d
z6?oQ;E=jfvA9Y>e!UIoMh19uL$YY+gI4&T!OR%d+LaVdYDPgR}lr=n**KcFvVjxO5
zw5Ii>990|@l;t{$u`+D=O@3Nw!P$)=+nK5_i0n#$z7Y_Jhca{KP!Qwkh55rlzsCk{
zoOtz$P~axT&Ide`Z7?$Oa*$=ZuXD6e5sH0Uy+X!&PI{@IY9=vim9ETd&YfkFW)4-@
zlUKWXlOIRZ;z)jat8}Bt+Fia<-leniKh`7(Sz8TUFk^HuGogpjr?u@X9kUnrvXyi(
zAihTSkBfXs;+ZtyL((AK7NUQa(W?F{LB0u>6{&eSy#|g7^hES($#CoS*NG#2Y0W5I
zh<ndO?_qGls?l$sn8P;&q<-IV%xcXI#r5#9R-{{gZ6_-2AyHFC^pU}ZZ@z>iyY6l-
zj}D0=`7^HkklN8I8;mJHYqkwb)Yh}t;#uy(`*BYHxY!|fB3&W8<55<^`rT}c>DU)E
zOd<<{J1f0r?`yN~*1(?`p`4?l8fuS>93NPrs5@7IgfL$7;A%9l?u;qmaqIgPApfej
z3mm{TUqj0y>0SFAW#^S)<!NI5<Z39|ULTA@@B30BWzGKw4Z4GG9?>0VW`>iq+K-S%
z(oOxq!^qBc9fYcH6^YDOK`zmi=;$DUJU})j6<$j1nxcO&TX>3ed*sDjdH1?|71MHK
zjxYDr3njUMkO$RzsE8P2NTOS$MG_B!AjT)%mj&0Zl)t#7J)b6{iu@~B+L*!s5B_An
z3v~@6L7FHU(S42@Eio_KT=k*o+ev|Rnae666IT&w9NZw7$Upp*jC+%xH}8_DGXvDd
zyo_X8w5>6qtjzYMRKNu?@AnU^k=VNthWn!nxpgPbJU=UsHTh~!8u?&DA9?$p@Xm_*
zym+8L%1<?^F`06TWQbxvs%7|zE+OAX4cQA=ZgO+3e}47-rNw*r3WxQrER88y+4-ON
z>-W{A^7c^7OPZs;(ywDGER&IC$_}bs%7ra?r_A7C%afwIw9&@s{A4gU64@ic9w5oX
zPLOFje?w+_zDa!`DBvTta{@q|4Rxk3t|lR&|G8#aT>b6DxE!WpVvG-Xs-lv-HCWOH
zfIh96nUJ54%02DhSIii9B=zlM$p`gyn36VvR$eP8G=W}#bsd&s9?tJoN-`@@d$1<m
z1-lLr7)4PhWDBwrd9aDF!tqSbO3cS4UrNhhuYbxBWqg+*WE#7&p=Acw4F;pH&50Me
z#^vf3{jL{+_B&vs<R9^BUzKS!??!pDF@zkT3ApODg+uHJS~Ex9d(n?s?Iy0soJkBW
zv!PkfyGBeOcgXZU?y>k_s^(|zuw`eKiK$O}GJRmy0~|<&);=+n&KobR@-KEH^1Pe%
zLr=@Aa$7!}Nz^hQ(0K&wwMPyA1Jfzm9ibFR`MfE<)K^&Q#u>pt-6NsKGvYridxmtt
z)rdWt_?`erm(kpmxFAAwUT=-g(o>L^i$kuUK@?Q6j<-dA1;NDfHr)aWN{-wFv#NkV
z#B!!`$`>v#`{ab(Nppxu@(SFW^BpBIV@1`(@aTX9tkEesgKwA#ie=^eb9Y{lsHvD=
zcx<ey#K_#7iwBvn{6tNr(tF>EVTn<(ULWv#%#pk3yO?A(Xh~xQEw;oTQ_o-V(*wG#
zmze%#-@G5DI)wqj-C<yh&gSEAH?-A<Zl<Xj(5g+a2;?<C%+X5ammo;O+an(<I+WB^
z=9g<(X^N6*gANb!kf8LcFE%n9UI&pZi?0j0w2<cm6i*_euLKXg{{bycw%AJ624R{l
z*5>Vb<Q8-_%l%po<SN@cfSI<eIFmo6tVeHzKOdPEAB4Ad=0!gY#athbdVTm)eK9JI
zH{W1F+1}p6k@M&?K2(d;mygse_s-iDJZ&xCQxm&lDUWSyte9`*b=ON$<P6gdF(#oK
zE07B$Qcr0sb$oj3xqps0Ct7=+SZ1^C2K`OKV+VK2B(S%H6SX40=*tJ>5xHl&htkK&
z9@mx9{Q!^~?f<i+b>VD0l(Q36yZ!;az|L??<URR_{VP1QJ^KpZQNTQsuGZj+yE*;Y
zMC&vDVsknh#md4*l!PwS$wGT%z6{@8ZWPw>aYxnYviCkO-_vZE%X@F$I|}@mX(wMB
z4|c{hKea%ZTgZJ&|7grQXb&4iY2d*06J+b0Ko*(XPCwuS-!7Wn&A5`fU%mjQ3v7%C
z?1r}=U~)x@N=V*B0-2Dw<Q!@y`WI83M0oILOm6Om)HK7Q&l2O?BPwqZ+0(DIqn)47
z56?E9M^tnKd?HS~m@uSC1_hWt8Slbd!(XV8p;qtR#Fs+NM^0|$E!ED|7yu#8=c*Og
zsvzqSEUkAEaPE)pQQHr59|*oj&(&j~d48DE^)NfCw0?c7aPZDLmhTgy@EfJU`&#*|
zjd3J+&t(Vf#wNDKC0fZ``^cg?I6wON9$k)m!j33rQa@KWYLB96*MB%PTBCRXjwK$j
zkxLPz@D)S=NQ+DH1kfn~yvpCSicD+VAIyaj9}k!{K59lczyXP-e+M<?D~6Dp>jOV#
z<|qn80J-u^umC3WFeUtwf)dc%nB3sksrD6g6`#uFw;ZPm>`DP_1)PPc4~geUML#1g
z<bR^A4*+*E3E;1WfP8o55?DsrFo`fFiaEY~cSkdH(efy~&lN!-be@G;(O*Ob0z4u3
zM}ms<c5m8uA)3kGX9PwGqUe6sTJJJI2s<fQ?>y%CwoKAC-n>S7o7KUHJMPo9Q=A*x
z2i^L2s%m<1p{dU*(*{ktuRJf_*#*FxkU*arGIRsiWCUn9COk5xv<>Z%2H`M$z0TwA
z+*RXq#_91k=sdXJHNBUhkRXr53!2}Q4`ojWvC!TFf$;kzGzvgcDU9iJ=8}SBYEz+R
z!}fw0%sjgG0}5#F>^O0TOObiR^@F&L=5D*i27FUfti63n{8#5)hiJPjYeDiu9i~o4
z#tOv+B3ip}^kH3`4KEo^8R^lGcMyVmDTj<TR`OO<6MlMv1|D$X&Yio!tmcvN(m3Nx
z@2KtewnL)93Si>C95<pj{f{gR`u)$p9@kT*z;)-=)qjEZ>qK|dyQ2COT4Q#2h&2)-
zakG)KlGmN`#8ixi!pl^Z4Ms-g{8nGg^$ev#g7qV=&mJoPUtHoZ0{#LCJcO}bq*HXn
zsp(9U&7}U4*bN)>JH-P)8#}w5_r3kY7q3C_AFqQ3VVV%R;S=z9C6_I3g6<+`Cu9J#
z%W;8LvG~HtTFcV;7cn*8(yWB<pI8iT)g#(>zS~!pUgyaQ3?+?h=ZL9L9hX9*0liL_
z%YQ3F`|o6G|Nr-K>>)C39Yz=AR^RUC_1!nC?$l(8?yOf<6mOYt!VSz57GQ37Qzx+t
z_#^bil;(HpkKgUedwxh3N+0}%!e4hd6}nfyiYAK3=-p!shQW?58`r+(oWPQ#Opp7)
zkuZmX8TpW5+dIH}@Q!AZ@&y(h*<L9N(z<MJ=-zwSB%mglJ?=aqkFn3iycBGN+~>4B
z{<-&FjY~J8WZ`#XkA>%2>zNk>Ebt4q{dgwkmyT3z`g1)~cknlcs-?>smhFVch}=r^
zRNb8XB?f|uh?(%Cwprd}&A0TiY;YjEXtx_q*_MUI-S;jt|GRikCCo#z2>j($Q3mAe
z{Z9n<8VfVVG0*CE{(gOHC^HRH6d_F#o>TLfkZnz#Q3RS>8qNLaf$Sl^AKcW`U+;V(
zOi`pXjYHHm_o4Wu$<&Y7r;jBVCznvh{ku69o{9?k-nphWL;WpbTao6iD0#X($1D1{
z4E3Mqi3wZ7H+#6Z_Cyj$qBfr)_rJ{(Q`Q$3C-LWw&VAe<g1%KM6In80a+u52vD<1E
ziQ8#Q=&PD}Zlyq#%6+gZ0x@OuiM?0nLr<fvoP2l!=P>_}CRf0*<2BY23_jp*j<bhE
zt!qxU&Xm^|H$fV~e}VXox*ei~o^W~(o>&r%^$iKB%O@`&dx8TkAtzKV$-{PFiQ}2%
zow!s@iYlOir)&nQ&oI{WL)P7G@<OhebW^+ja@dYM){R7*e|~FP8Rf^1j-ha6XChiN
z1V-@3XBtKmMP#pZPAyt94?kc2!`KoOvPX~dsGX>%IPXS3KAK)bIt9Iy-5M&_Z|QV%
zLreE4@-)eflq{!Tb~drp#GvI@hlM<-GU70%PxVP@G9nl=^e4ymZN*Jbs)W6yuMj)o
z)e%?##(VZ!JTNfcOZG&{fwFo!JOJqttP{WH0^us=^1FnW@pk4lry0=~-L-c31FX?~
zSoVl4=Gfax>%s-Xf4B+W|BB>T;KM(|Rc>nzwRxjW6_KLKXk$g=5%H@hd@Y-_KUyms
z71o|VNv`oMs#gY!o9~gBjUAJb;Uw3ilL1Tei5AbA4`kPdg7~3|@;nK$e{%e`;jAE_
zkquWk>6RgK9W;zVk03-Ho@foTNolozqr4CF72oh91m*;(RndPR2BPr6Q@K-~NM{XH
z)36Ks%=T?uKNw<%DT45k^Xo7Z6@{aO-BI0qBE9*Sbtr_^7F}wETVf9`sLVtR0VpKT
zf=s!~+YE;<Kx)U=#Dz8PKo4*@x{{P%01iiz@<NjT;C;x3ma1PZYgw{PrId7n8?IA?
z?5)Q1i4(En`iYG-sb_4bqPM><s0(BZ0@>0fXxB_t+Tgh<L<hXyVIlW<zh_zh(v{Hh
z$VAT-Uf+l5FVIj;I2FGv=L?yoT}zI~FhEy%ahYU|?aeu1_JI0|#-dz?N$3PH!gp@o
ztB&GK5GX|Mexd=M0~E!gDA{yhf!_ohuOMn}&ZyR2*VL|}mE0T1LliB(LD!GH@O`sk
zCMBWZZQXi=+M{&O?Ku28iV0aFQfai<EHMUu*9lCO!kG_baBXVae?XOs?ej+!gVX_>
z-)nHFhN^ZAwd@yXE+n`_XHE#)>A2C!yC0VHxSSpc0tzs`&dVoAX-+1zw~~G|Um-d(
z={rPjc=O5}FSwt0yS%_K%s!~s;4aCQSDQHhYRi8kljDxK%8c2~DI4!vhKC49Kkz9)
zzKOeJ0)1g^+NP}OMq&Tj=VP?Gj|=-K+L1{g+=T6_4WaX6y{OG>rX<O#a4!mc5?Ee9
zuJF{!uODmYpQ*(9WVM!@1_FA@@Wn9TA|<6>PXbuXg07x^Uze|{mG4dHBd+EIu)3D}
zG^D+-A{9dTvW@nYc2^OVN(g*0k53Fl`wV&ToSDcIbB<5Yl<6v@v+;Off<g$6;Xo2h
z!J=jVdqrrRpXEil$+zb~_?-&h5`<9<Hy825g{4son#2{c2#6EES5)y$W!R^4Nr@YC
z%=!QmEHOm68X^qc{|<^tbx1KUn-ps<^*X(ZT@j7JaN_5W%DE{y9A?~!T`^2WqNN}T
zA}%YL@>Fh)<h={#?)?M=JCx`yxqGXadyRhyGI+7CBz{M%LsNQ_<a}$^x?s8uxa4`j
z{A|45ocyNltg+^MPC&tBc5Y%S?eu^ocGc@|e>Y8N-H?EtdR7Y0e_!DVCO81^JJUN%
zl%IZSk@*QAr<yJ0CR!^8(j>>wA)&|KqRoZ&jTeT0^1n875SsvTCT6QXvy%JON{0{T
zN?8j3h>;M#f{DUe3%&=^_-}RxXw=;tj~#sDg&V+(b!xNpyCkY9$l-ZNDi_^)@fr}9
zn$5l}?o*4QMI!Zx$ua<ZWrrdW-O43$8#5%1^#13C)k$%T2`z7Fh?1;Fese!KT#r|C
zp5O|iS2bk3zuM!n(;8B;^f6<=wF3*X`H5l2a`SyXgp30!^luGO7}{<GD`_rYwliLh
z;;TfL^jca+B8t;VY`M=m8PE*e{Jd~r7<&B|$Rz*z@JUPsTS0p_6no3~ITzrYtu4?8
zg_u!UdLYq^(0#&!Tp>Xn>4^3k?tnL{!T~!wfy@tBC(;m)m1d#ZaFh@kIMj5JTz|7E
zZC(461G)W%*m1k|?W=K1>}sE8LmR|=kg8roK-JszOVORg?y4UfnweBw8I!V!YPp$s
zN=B4leH!UE0r=Kg&UnlvN->Y1H39BLydNN-uAZAR8qKq2lh}K+pM-kaDXrlb)l!?E
zt!F)m?(GNsg&Z-UfG1PN9ryUf=CBX8MdE{QgwyUmfw#0oz)`A0xBeKuvTa4=sh<#H
zdu(IhwCwbHEzjBXc7?`CPbf{LQu)6dU;j_vn?Bp=EOoU|(h(79kDWZCl{tVzRGMas
z7D4|8Px68PLq+rTVuka;#;H;YRcB0-#4rJ*Z50Is4YUUqwF56ERSt@ZicfX8wMFtc
z9^ljB-E4B^pZyOtQnh5R^K6+yC2(q!K!NzqHZ_`bYxc5qYjTU^twL+gve*H_zw)V`
zZQxvh72??tUhuamLXnh~++6riW)+IUb8EsUM#&%91(^LM?Wywh*HTGf(<#d@6;dT~
z$|X4TT;S3S%+Ln93VzjmmGS~`YX&Bcxr(NWW{PS}eB^`UN0kx<GZjF)HK53kq8uPv
z5@QM+7B3{ON)&P46pH4&DO4$^0#6o544)I<PhMGs1(3-^#B6=NBw=HpBepx%l?MOq
zXQr%U{XsoFdmF*|`Iu2TUy(Ag5%6V;BEd&<5#4SXOntrP`>nS;?mJ!sB$W4EbU#*4
zxP7mB*aK$neAj2%^1s^fBSZ+yRM})Ve%euc8Qs!#Vt2$-rR~Szhqn=I70HR5$I}G|
z+g$Z+HuM&k%Q_&rOJY8f%^}@m4WsLE&L;JwcVJ@Y#Le}`rCd^Vy`pjG9(O;`IQ5)O
zB??%>VJu1~^<)I)%nH|&ZN7M*_tbD`$u;O!ZjYE<z7r?usdVjB3Z0$LuMLP0yI0Tj
z2e81Q7cD~Nk!{wi>lRoyyWvKQSQjRkK6NnCRB`tW=dOx_N@tSd_t>2;_7If(-7hx^
zPhJNZZr9Y~^qHe5x??Y#o`p#7{uT^XR;_pXS9uz3Xi3xPH9w8NrfF}DAhdiDWRQd+
zTnDe$vX(WF{$=YZkd~&buKEt)?D7fAOWne~TwXe7UP``~dGsd4&kxsB(8-0K=*(67
zl@>|U`RWD+l;S<!l;dWGfno?iE-qLZ>=~_{pxO(QAS$OroB44=8+5qVvwR6Q<!YMV
zG*WO|mA9W`Bx`h$OTyRb)n&fm{^F5(x7nxJzZ%RrysV{Yf2(GnLb~$>cS6mMk}jME
ze+|T|mZK<*Cie@n;gRXY-L4{M#vEvA0^pBb5&(q&Q0{-~P_wKbZtMB}iLs`0I}eqK
zJrXdQpzH$=YV<`dfybank;tz}C_rvvKCP5-bph>>!+Ym6hhhP;Pc&nOmVtQ3S-J^R
zX5Wb$zryK!<!eD|R=I)rKrSkhWB!#}uXI?64JN*Rzb?$Ws!CCs8~6c7Sr5blD##68
zTB3E36n(DG01#@$OSHEKm#D9Y!~X&ip5LQi|J2$~d~f;1EVPc9ck9S25S}MrPu&bx
zE#TF6ZIg^s$QJKhDU|6962#$3J-aZw!mm0lVe&my>>jhW|7^4YsNIC~^^)}j2D?7G
z7HP^QpYNMdU24=DG&{4FD?Ej7KLrW*tzjNtQF?Reu3T5zZ=7B9P1$usY5XpPGNb3L
zOSFr;`q(~2tSH8fD52wbydNu)K!ycE{XOd0_SpnVdoJaA+ht}~yyzD9*3u@?NL6x)
z;=~fhubc?08Se+t*SL$QK2jjZlYWy?O;p2k{<z@x)Gp<~5HS}KMw$icngI_4XFS}`
zxr{hvQ*UQxZ`jdcT0zt{qx+v<S5-zUsut>D5X}LkKscgdrWzgH)}3IVu^>`iC1+qP
z`RXRyw9KlopTM8ylC)&^tJ+@f*HBtf4yTF^=H8~JZk?pTfVES*A0$1gYD}~p;qHr*
zP#zC=5s6NdZ;xX<f<ii|&Z%O)Wt2x1g2p~6<3F7rW(A5i+CoC4aW245=iB2~IL^`z
z)+(eSX{-xo1n}O5M->8WFQH>T%fy}IoN=YDr5m;rznG)Hf!($TpAtsf>LYc<jGcKH
zAe5;>B1w8qB*VhXl{rpUj@INUiC<XMFJn$K8;JfhlEGeAvSZqqoRp`b#UQ3N%d2=F
zBOI!ra$=p+sA%K_k9s^l;_X+%?36;KlX&ojXuB>}{Hn;_h?97<ZFt^tj;(3*7w#!(
zPfZnPi%yL>Up?_4Ley1x38kBMd*m3T#31fdfdjs3+`Q_S5seTASxNqVy8gg~**q8G
z$}B7Xndy{YsF+F4T|fSTX8gMaVL2I9Cs%I!TsnW*{;28C6>qf<NDmr=w+c5nHQ@6V
zqsx&6lvXIpbgIsNEt}3jOROFCn+d+Dp>A*_C!mj910hkyEp!xhXTfkvmj#=g8}&KA
zGs5fWsLwfpGeLRL{XsB{tO*Yfe#^Z+V(oL_f<<j%mXQ-$3psX~?h?7RKedNnZ_5Jf
zJTr;VW>sWrVHMo3J8Ps#GKPaWgx+zAS05mF;ec`@7M-P+=<1Qqu`~E&>@QH6e6NMB
znpe{GlX&g>JN9+45GNpYzexO@(M3Rz<cWqYY~c;V{1W%r%#vgm<y_p|)aLf@l|vuo
z1us7m!O4>ZU4vV>7embC-*^E<5N#FiG;`%OVN>fgQ&DTHr%kHc%Qig_8zjyb^ng;O
z!1pOLdIDc{gqmtt(!Ppfr>bP-@O{QWPN}w}gPZN*R>C-gPc|F~rV9kquT(bct}`=1
z2&M@z@i=4s?Sryf{qy)Z#H_~le$##p=IT_vSV}Y994oEmtA3&Oir*LclHa#$q(B>@
z>U*k+R)4yXEqLe%H?&nXmPQ378vzc4?yFRm%aI!yJQ*$=uc$a1lsh4+TRT~K(o=7D
z{QLkpqYXT65v$NLyH#UN3PLo5<Jr#wuIIeKnGmjPwaE}DPIaenr)141ZbOu#A5!q?
z;ur8hd5S-h<Mlz|F%gRxk|<Djg4df=Gp;H+Wc77!`<hNdZ1EPzldThz*5pdfTIOSU
z3JOD$u^gdOklLH5QBy2`@5dtg&ac1pHqrSuw9Em|wg?=H3>8(+4f||c>yfP5>Rps`
z@YCFzq}8<2YMxK783`$eC?X#--M<^&55q_LOdOKd#>&_fVU^#8+)34+FI8u=WKaA;
zWdNOxHKN@=JyJp$S5<XR?{_Y?L%20K-OGKNrkS^UUVb<KRB~}R=Zg3yWUVT+)zCc?
z+=(1zg|ozTF8$&P>>n+=Mua(L7qr_CH9O<gozy)!6k<I{b?0I2s|brBnY32}vEnUW
z#Hz0a;&*LqR?l!q8n*p(A}pp_P)>6rphejtZuwuNy>(brZ@(@+bVvx&k}^mm&Cn$+
z-L29f-HjliNaGCBQqtWa0z-FqcX!wKEPP|{{hr^u_c_1w2iLHGiwkD0^{nUq+@(G!
z=GZB2l(I|}#aHj6I(-FKf*nYizw$(#0!E4&B&7t&$I;s14zg?C(uJ9rMK;O{B$}YB
zy=+@YVa$8__fMLC<A2CWq{%T>evuXBZr)SFK_v0Cj*6Yy|4Fz{V<hAsfXeFP*9-go
z2G<!1>W?s2a7+vdYn@DQ7ysr@1fKAtlfN@tfg7QXjZv(Xb%`VISSusQgK7^49Aq5#
zY|=-4v{^h9B}94rH#0!bf7^xD<g6O(_dU~_Q?Pd?00{o?Ymrh+UCm2*Xwl-UgoJOC
zWQ19y<X_EM<ZNGFTpnStW??teIiJ2Nqo^mVF;Yi9nXU7n^Y{)3AM-kw4cU@bIwJ^Q
zt#BqM_k2gAXfjFztU(k6x2f$|1NbAwQAdJgs+#+D`v>u^mBT&k7&FZ=sR<On$&$4~
z^GF$))5kJmzp3aE!D2s(%fd)agW*7ZGEj$HoCEhN>d4HUnNq-um7Ak>F%lD&Ln<Yu
zpV9_1Pc;!;nJWqmSFuV6x+Siw?vHg~MHfG(ceiZ`MfyP=myB&C)xE|4!N%iv+l@bb
z5dFS<g&z9!v+Yt;5O?7dgjBbn5O8V$Iidr$D8|)ot1+JK=4fDt;djQ-D#+?Q1j)nf
zO{oKKT!-vzEE@9N{c%laya>}V#Xy>so4#0C(g(Z_>26aMjXqhhC|zJ`j|Zs2qW>dx
zAO^r0<$H9J0-@Ax8!lGwnfcYVd?$^$wg<`YkVjq>2`!?FUYMQiBa&{of9z0Nk(=9@
zixj6_@8It`5+%J7)H`y$(c7&~RZgmfGqHPYs5r=%-r?YoAabHgxrv}(O|B^81P7@B
zR|CQwu^Jxd{b9o^`aCKRK1@)%H-PJDu7Dty*KYA6Q=N{E>sd2K>6IH2i%iAG)y4_p
z&z<}Z#OMhiDkVoETAs=0M?gg2hD;~7_UHoS3gf4Bjq}2l-Q_Kl6;fR#@F+J%vNU*V
zVz4Rdfpr8TDM3884{}|^G*ZT?$QdM1?OkUb$t0lzn|_ER;YWh(PEtP=+b9Z6VZ9K@
zd(Sw2Wt1Z<Md&X5PXlgN-LG2Pn6?z1zd+O=Aod6ZbY~)$WboO|R17yEd0^bBuON@V
z`caegdh{ovM-J|nsZ7Er!85ZuG-hB2cpwh*^n<|FbtBF4TGfc%YLro<*-5}mKbF{f
z7L!Ie`3KStcYKlUqS@!Z#LE`&))BT@W_0KQT?lQ{hDk7Mcv`|#0H*_l6cchy)oDcE
zcpUoWkmu_Py#IqF#@kl((7EuZpe0ubDZfcK&$i;dR{RUUQ=zF>MVg!bnCt+GJ5`qb
zKgDwYCqFkjVmEE7Lmm+te8E#uUnj7|-Md(Y7`u-j?tXjktz8n(Znc+l@)wB4X|AC@
z-W7$BcQVgW;Dg%^pSoM(8!~rdTJXGFeL|2lHZd_R6+j2Q9F?A76On$N_e4EV?NfH2
zTGrHn<&2^{eky)kOrd4;r<_lD66&oQ{7J1J$+CsjvH(6u%g#cB0WV)84EiElHcz*X
z!Xbl0ElV>ee=HyREz4~*gF`D@Glyv`zbZV-T|MJPk$i!CfjZL!XUvvb#tYUrUnKw%
zDeP}hPP5p!(`#_5@Bxm{-rjn5ZSaw_OXwyw4ai*AZ`143V@-Usz0tK_MT<p{rhZ1H
zv^vq4|8Stc+g)tIAFIXU3C0!UnsT9RE&FhE6~q%smIPPxyIt(|PkN{)+{y@xTSEMA
zgTt9+;1{&2<3B#Oa9Fr}M>~jAavT-rI#gtCpplnn+B-8uZL^xuY<$k!UE`9%)p)+<
zdUk`Lz0FXf$jnR&k8^T=zwy{sS4aRrHqc{fOkLKjZ}By)sDn@c83DqOl_OiqPg3*c
z&!<!rzQLXrZHBs8h?Am?wIZgeJ-A3Yz=GH5yE`JJ>|8}#Eg@o`5L#n>6k)6qr{3h9
zAU$`K7c0TAg?4%qr!$$xVmr6fs=krN1-y%4%%9Hx`JXkxulSdryh8F|F`AbH^VJN=
zxaZ2b-ln5t>d>e;q$BalZSvD2fjk!XR+p|_(+IJ>mQ5Z8M)au_@ZNFv<yfkDpm36>
z{@7bhj-0)SJ06^JxoYIdGTLvf>$Rp-zZ-@}(%L~5lcUiEwPQjze`6EM<5V`uq<x7i
z;E@pJ>Tcq=ns2mS=}g38i#MxZ=wlWEi?v;6@v;wgzH3%-l2%5OB5Y^muX*V%!Gx!3
z2>jW34F4zB`v3Sd1u#9^`DNpmL{oF2?}9rVlP~X>e~vZ^+kd#-w67F>+Z#+3>h*{2
zp^*pZ9u~m6In*(Ozti|E8g0Yo=ctdcJtArYqNfwCL&1LJU!VwErcWyQi231w?2Djk
z9N>FO)E^<2(T}j)bQKg8b`S|jJ+HE=tQJ7%u<vkgpnD~NC~T;7gsp_P^iSANCnfxs
z3(<{j$oD|~P_@;oHR1bz!maObn+$y2f0Nz-6>PTIQ`^JWaZvMzyA-q`O+jFu$F$B8
z=lF1oBZ^>f-`_XMX`d?XcDXNB#AxS2{P05cTe)KA?E&Nt#rcwt%b@9c&BESqoRFY5
zTx|-d6qRRSSiE8_^l#-kX1Ds$Nt9G9RT}y>EROp9cd(P(T)H?ZXJjp6z5h%UT<dhp
zO@uatbmnG3qcUNX4jH>K5dH(cgw)CTb~D^lsfu7@K`@C3CU~n$WC;$g?g~feSK~)^
zT}}RIEbH+^t@7&YQP1%C)Z0d4j^{R43P?a&L0lzvxI;OJUE3*UYUGpWSnl2MX<aa1
zXmJ5+!f`NRddar708x!^_F^tEZyfil0EaemJA(lE)E}$S;)ORSGgi|na*G-Ss#4T{
z1`fZn=RG+;&j)<@vO9J20F^GZS~PnYs(u(geSmM2q^+6sot*G}7<^uqY!N=h?c!RM
zedTm<782t(h<lmr<QMo$+2BYCy4)`^sXDB(pd%zJ)$)$3Y!)5}p$X+T!tv!Wvd{M@
zUU5=u_xb!6sL|8;9>s>qCvrp}M{=q`gO|2)L`al4L6BJqRop+J`!A5G8{k==5Xl1&
z9bD#plLXbOP#M)oT{lIR(+L+>SvOEfGipuVKw4j7x%CAcvliVL-nW@&5^Kd+nUNI(
z7~5GngR=<&!yb918op9}qzwp*=toccp7IhNPdb#hs5Eh>7T~CDsg{0PYnxnZYGtN$
zkvjU_kNxlGce!L&_x=Lai|=9ZBp!@#Sdk_~sdc_glIqLW{1yCO_bUh8mu~uBbh@K^
zcIV8s``o*_2M1XLU2ns?{!mMR)b^<4?U8b`uYyKJP17;q;f1N%hiE;pcMfA*^mKDX
zS-9_>MKpT524j!iu#{T5T16${AVo!0ZBu>ZOb><~8(2_{A-bXL4CG`p<%4@fuhrCW
z>SM4tUCmre@)k<ziGzwx>%_E{s-)Z-?i{llkMHqpIXFBPtmhisr$VHY$#fZ)$v6Kz
z@)9M4A40Mg(CCR4`5<7O_^Uzp%K8r)yL>5jsz8d&25GZEqeqT*3?bRfnO4uflX0Iq
zys5(Cty=eVGoHMrY^Fb=YOMu-G^-rJo@I$5v7%2@LRXXNyG5M<-48j>ovs=2T^$w}
z8(tgX8}H51&Ac9MixLV&qYkPg^dtu<_a>i)onTAc9I7?M?y3Sh$elL;9K(v70%4V{
zErCP=3$&cuy0<CtA`Duc48Bb=o&0;XuTj}38{51?@C!&^IHa?t$bQ<gdg96oEsee)
zDjs+OlTWCA%5suU&T^jcavh(-#*%p_>RU^7@84R_%t|yfhs5x#i>nt$lxakaP$CyW
ztQqMC!OjBrnBubBYep*u!t~tAN@!-zHnDa9=g+RF<KIX}=RZHq*KqAh!)5Cmsq;M@
z{e7>fLW^98W;7#Hs8aZ`dIzorkoK60fac2>PMBQn*}}Xif>PUQO_qXNy=G(@Rg#0|
zlt207f};;CI2p0ka*aSSb_d$J!Fm7Kq?&zgOiF{rj~mReuMv`kUyAL_>wPEjxzhX=
zgMsK?GR!~HCYKl0F86*bAfhGD?H!MIR}-v=iO=K?+-yXW3SUlwy2EY#p`F4JX4aIH
zFlwXW#xe4JAwD23ue3m~)3Cm}wa4eG(?aOMrF-4+>P@F~MA+Zp;iyfS+}XUD1O!#7
zXAW|sWd;xlX5p|(dmhnxk9YUjG<ih{pBOD&EawWtdf>V50vUelXnOZDd$()Wg+tV1
zx{>`}6sk&U&$%f}zty+8fraL`<azjQXVlfaJ?32^r~Ks7f^0#3Bu*W)I41PuxZ|W}
zYx_a)bJvex;?mbhd92+rs0aplJy^?L9Q@?2QqDFgBm1>qz$Dam<l#4z<Cr*PEwd+t
zB3^7~DUJ1%*PhuP#4EqPH);i`B$6c3rDBjV?!)m>*O!hY330Mqsh=wO=yxn4H%ew1
z&ME$ox-a^PeUL<sF$_Y(3VoiG`<yG~7phpX9=4#`@J8$=d?tH5Yp($#MC(h>k^F%g
zR~Na1fR}dGmBQ+;ixezgKh9B$`Z#AUqgEn*O!9q7EyTD~PR!$}Xs4`YVWt9+jo3VC
z03r6=X0{&Cz-BzDYa><?UosrmLrsBXWB{D)t4>by3CMhGdNF0xh>>mF?~G4sw=dzF
z&k_|4>o|K?lj-jgh~8B~bzIZzE2B_R+jO*kd6BGo7(FATPmhj1^NbXqmn*Fy*#U!E
zOC2s}L!mmT|LPAH=Sj&$P%cRwOKdskVg{i-E{>Buev|jIU*Ym||3j4+3fd5k%<g2-
zTjOa%t4k-n#aU$=XG%V}kQs#&CudGf3)*r1`9RWF{%!3%3GJ^nF*|O26O+U7RSBj@
zxfC*Et`toDp0A(v+pX`f$G)UR&Lo7Kt<)RxwU>}v#~*X&&~v7PR%?1k&#6{35_h~I
zJ|oZmKt}<+JhNOqqX1hw+UTW}AIkv)oZ@R*#n5*mdAYOGdTiS{4qscSz2X9tK;87E
zsFiwqUS+YdjfTU+J_1KG9-&&%^9Q%sxws7K5o>8sfi<L{SYeJ1@uIXDs*X;HA!6~-
zHPzgmn9?N12D360{St{zCWsK)mRsVk{lVE_NGdYSb6uKfr`>&-?7#^FlO3a*mI8;s
z^eAhx)2k!LyKu*yEF{n2lCK84NzOP=v<n#Il7m3xm=lG+!ug5zPPtf&E21hQ504m!
zr3hPnwtzu3!uG?HtKk)2#1*=+1Mo!UnwC0B??)Q&8ha8-Iqqc*7I3m<hEnmbf|rdc
zBrde#87xvr!J{QAERk8f+EzWaGZ-`qZ(ZAcbfsKJI+PMC#>uN3qVw{H)0D0@mtMyB
zT5Vj3|E{o)w|qLt^{XK~r7f;*ypB9jrZ*gG&C&<;%F%K8xk8G%VNmxZo4Xk8Gc-JL
zC`8a>uCH##<H^tg;hG5YRsYH>Y{Aal?w56DwDzWrDdG8UF(>j)Vgn=MSddlZIHTaz
zSCM+QivhS72(hew=R#koeRn3rgHU5kL8!D;jL1O2Br4|QYo>RH`$Q2g{MM3B<14&!
z##a0-ajEFPxVB_%O)gpv?OniTzLqOM7oKFUIvSSL6yso!lF)ZEWHjDDDdhOMhI16v
z!@?yVQ&IoNedPZb1^gcYos3=k&kNGwj9nsUGYnHWneq+#wIFj;S1R@nQL=iq+BUa{
zAnCqB0Yb=&`UqyV$Zg&?nlBAr^}#nq7Ne}skERB^rS(%ZOmhx?_3ATBYq_a?C|+>R
zoFcqXEie3Vk!evyzH))$`z@WRqsQ=@^S4~WR`o!QWkv~&Q&{fPPdUhWfxvNHlJrM(
zc@O#TbPzg)ghop|<UB$qF(|csf8Ta6BAtB9BTNHWHLiRD*>NUKJ+DWY#!peX6|Rw|
zX|)5uHZw-xC_*z23b1No9KiR+wspifG+a}(X633l=ep9n?Af@IyP7S?ks{&3s8TY;
zHd^&k4MGFJ*g6{ZI!Rb0C}{9}rLjR{?4U{^h;^-SE;cU>$~7%x7j&{w@hgfRGLRk+
zRgqmJbLI8$*)Av7z}h{^+3hyV4w&$`f!qky!kBOeEci9zlILfEO<y2zs($<v(fsS@
z4OF2Qp}ym*NCC)9PVC+_6#fm@lN3hKWs=4c+*xzs@Z03$z-g19Ym=jPTM52|{;%<@
zg6_N(a?(~@hMh20f^RBBKrorK<&!6dd?EXHNiwxgXbGcJm>U_=FpUV2)9B0{o7@RA
zB0ZH5c20ON)f*@O!6MKA+6qo#>wueD`hk9rYOU!@eu%IK$zPz4+6h{R;r77`#lz_$
zhP5X*$##Q%j<czvn61T_BO5Wh@3v1QADeHw<{mFTrhybQ$2@DIYF^drcx}!?j+aY(
zf=_|9fKzr?vtUlt92ZM6cb6=+#{WZ{xM?2t?-V-<pOu!&OiH95;-hH`NHL4@8uN0w
znF8a45Pq&1mq*cg@LwQo)mLn6cHH+b@JHlndmDrjnpK<oV&5V<aB_MjUM;o>v@iTF
zHrlEGdQji+t>+3HJSb%lEAcS^)dPeHM4`>tx9|HFNiN%XtVLq;!@NUmYhha91haD}
z+QQdt9@pX`RE8w=UwWrIO`Vsv^+ZPWAN^gcg8%j`{p(r#x5vMJTE*?)-lkVmJB&~U
z-6^_Mlc8i+lfAq6B5dIEJN{~;5->4o*kE#|{=#_=SE_63u8CqmN9k?`e5mz;R5-Kn
z^<TZ*<*(@c1JZKTfi$WxLXajfBM(4fb!iPZY0A-Hkp3^~9H9Tz#L-!bj-XkOp`R4E
z&c;fI*@{aCguV|RLpF~H8z|FqtUl8v*)4f^;wbqBbCQp+1Mln3De|j$s>{WwF887<
z?tM{(sJ>b=^R>gc8{89X-~@dB(xdwl?Q+if3bQ5EiaxrVtD^2e5wSA6DOB8lh0_Tp
z7j-e`Powj!AAHzkVPUVupS#tMlAB#xX&%PFU@$Bv+lQyXftk-Kw}k={h?!PZ;D0=T
zfV6P3S7hIsP-J|WMSGRZAUb(>YS6!b-@jX-%uGn{@Fpd5i<xvX+-<DY<8!A}-pGy!
zI1qCDUT7Of#9WQQ|Aq3^r0?yktC+nzMbG8y4a8ZM&;5wJr?+RMG>#|5>W<(@pDNN-
zw6=T&tM%&IFmEf<5RdOdPSWkVB;<kUYfk~mtxdP0;+fE%;xV3M%t2ZeeTW{mveGeY
zJ$2x^R7%H~rik@=%=b+eT_*ttTJjSV4`JULAzmN|gN#YGn}F<BqKJt<xA-e8eq=jF
z>NUsMEOKXKq8(msGP`tF6K|?`S6gODCOb5nJem+0G-OI>F=rY}-9+DNi^fJ2?L1-b
z<AwH*B>~s>3Sm_>Ut$647%Rf@dCr|eFC)EmU_ahl=Kxe~VGymTi#E^kbNDk4XT2Et
zhZRXEr1>Vw<bk%z)39-5)<8<Qv4r55-D52xtel-68Lx}_vLv^%_ezBIPAGPNABL?p
z9?tbTG{k|h{C9ihCN<?!q+{GD)uLp4zA%&WuEwvVtIV48rEi)k5(D~A>R30`C~&wU
zGsiToHz2$OYNJ+`WE5h#Y<3ydZ@N79GV=<(i<EQ&@HXfUgSzjmq7rD|ubez_dL4^B
zb(<LnGz>!B^LuFpT25qAaYR1&%MXCd=)M5LwyZ44xOY-IrRDWwcB@sR`v6-MCrA^>
zc`${X%&>NZamPH@NO6Sde#<i%c8>DJiA>?SYTf7Al%iK+k`7{6><~LA?i_hdiVPb`
zY_*0;yya>lZM}#&w|d{oOKmj^Q+8>?Sx{Usc`AZvus89?2V`sa(aMEaF_pa<bW)A@
zwEgtt6mX~9?n`>)w+=SbB?msVN4>8-+lcf`&Dn_<@Lpf)LqPrn;e0r9koj0?xsqqc
zlbwp{+BM#y*kU)YQBw4lx+tw^se}JBtLDw*Qk8pfOYs*-3%=}He4X~kDODY{Wc+F3
ziTR|1)rr9ePGVM`wku>bGZlUNo_Ua%Tr=`yoJYm#Muj){=*n&cn|JIeuCM9C9k09d
z37a-34?EIf9{u=U;^I&h0CFnzsXKpw+~0Y%=0~ek@-e5E<m-3Z?8))0uUtLx4U}2?
z+bZUIPL-L7W93LH1fRvq3B@XVMHXA#_*@p<mVIu4^8+H%`sdh`3scXipVg7{<~HA8
z_OLsRt%lRFD!Gj+)i)qyeBPsfKKl_!zPn@oQ9jJNKP8maw?s*T{TpgMtS_A?ef;xL
z+?<}90ZY=;B2ygSn9!Jh%&qgItZcoQ8!W;W1;85(RH*hZP}3bQe4_rjEmNnWvVhzF
zhTZ^VR_}+H(hxJS*s5PO^1<cmt~an4UI46u;+iFQ(qDmz(B|y{yC~D9o!!s+IN!GL
z{lg(&6iKO$^zpd4xqg@1&6wodi(Jc$!1nB);|<=7<}DrL!u{OEYTC@IdQm@r_R&T^
z<fP|w%_`uy=gr<Pcl}%$y4Irs>>cQO3<T;VNI@|Z)!g@P8?#RsPcv3Sgrd?5y;Q{#
zm7Oa?4wc7OF{su40?ql6_~Kq^*<OYkI!!1y`a2HbZW<h|W?N6$)Mz!cgbs$gIS+2W
zN!4n4#;cP`%*e#az6VE5GE8>Y^D9nOM==-1>mUJYGshGBmnRK=#T`=3+5P_blSd?c
zbKB}qDl`xyM<GtoBL04iPitr%zHR_S-8uMLTQgX%E=s=>&oSOggjQ!S&(^(ftg-Ey
z4S4J2*nv(RExr^U=^S>ph<4}JR6X{-^f)_Nnmo(i(=OXc1f6Y*lZxKz+HJ`+z=N=J
zjE{H7pm_Fktau>ma@Sz`zRHi)LW<uslBsdO=<V4;huo_du&+uoKou>yoj5D8tsDIN
zx;1PL4!tQ^0dN~zG$7T{zXOo(@^~|s(SOpvmG8dzh;@>oOxn^7-j_B4CJ?74<mR>C
zEAJI#>k<#)i7EZx2C~ru&A)^>$RDc5a-yLPd1+@{$*lGtq!GCJag6?Kh|&GJAYRSy
z76V0PL7^8iC0r%P=T~z`g=(fb%V}mBzj^Ix?BZe8hCgedfYPUob<8108zW!N4xtX}
zqQ1!8-5U=D6vg<3sg6WRh1g-?w{8Zn)4M^b;BfrsfaG_K(#NJ_5#Z?AMpiE2@xN!H
zJDVh}kN1;bN+YhmknV84l<Ne=g>`sX(Ru7dde!;L7JJzzcvA9U{b#gSlJAFNN$j}A
zTx2uxIsTHwMrN)k$xZ5o7y`t6PJ93ziG-B@*!~kGGT`+s=!l)RVK-<u$qAy{Gt<Rc
zntjdUcoORz)6!baE-h2+H?+V{_A+wed8HO#eM%W;4|z!(o`ZlbP0hy_=g1~=nkr#|
z7Zp>B2wnv1dUnJ6bEi~MA`pB0tBAASCk@^axXN+ta`wMJ45+#jb;E6KcM4J2l`zog
zdvi1Da`^cA204p#HItHS02!A?!oPDL5OdFq_)42l)Q2<l3OW>==NNBm!>B8d(q4h>
z)uDi{$`4YU(^^esT6&t0)K`lTb{xRpx#fIytJRxdPv}6Z^EQwZy}0Y$w{-WqX)Mlf
zY?ne!Vf*K=aP{V&4!xf~JtZ^<6iFbtV}_2o%%%t*3z*?>yjaV-7%VYj#u)y_$DSvx
zviKef1c#CS?=t`YA-DHm4G~Ngw5Sq)s+NM}q(Cn9M)l={VVCG_0br!4E8?7!%_{p`
zZIvELMpA%%ED<bX71XIOe|JjyzWF(MEQm4{I;%i55hsi#!nv?-+_(o|l!9%6Z)CAC
zlxmu!ma`>eUf~lVJ$sr2(BVDx9I}{=kld2;cr%@8h4M81j33(5N*L;&vN05rtHc5T
zsG@|QjGx^%!Hq5fV3-!hWhV0eRk2TWLUfO8Q+nT4Fe1+*biq*8D4ZL}RiOpI3L^kk
zip<yCBtEyx$7m&^GLi=D>h7}Q70Hdj#m9>1NQz6uZIX`BzOq(MSh9-MHK=LEgIO#n
z2K~HoCA*4F*3MQMgLFpMM$R!<%>=7YN&=A>xBLektj2N}m@8Ht8;!||hJm|eN%_op
z^YZDU;h?X}C9!goMaM=nX>;?EH)dcM^Rsm`dfs(<w^m?78=diwaD)HvS44dsy_F4y
zrvWDrG37ULVduH;W#2_IgiH-f<PJCh%S12S;Xc!_TyfU%<=v{N`$p%sQCi|Iyy!WE
zBT6F}sB|YBa(t2~&n1@#(qm-ESmn9nK}+&7qg@B|FT$cllB?MA5F_btE6>fqOXng%
zi$88AIzywye{v5v6e`4Rq5TEQZ@lc}lXv+Fa{!7MBraP94*WsZru#&l=%;eDgT>}H
zUlYt7kh<0f1Wc31G*pco_y2LB;p>aDj<;!D49jt!l*+C~C~%cQKnUI7i;{{nf9B=O
zRt1atnn<*fvqfGT_hir{iaV!0IJ~k@tV3D{B!GD&I$a|ks(pOj*bpd3J<8hO$_FFk
z;CP!$5)<HH7~iCVH#BK;tL_oATnXr>Y<U+e%@4Lwm*kPE*_G#+bogmgRh7vteq-O}
zs}()~{F2{9p=C+J=|-kEfS!o8C(Atn^i(<0G}Mstg~b6v9yd||$h;^6{+~2_+AjCJ
z8+U0mVqy-4ks#5{k$OWe$(ky~(fmOU65D1%D)D=Ns1>H2baXaj@;EHP-2+Jy@1(oq
zV#y!CP?*~vxS!~o<1%v9BEM^%J#YV@YRH~Ra-E`*NphGA>;&>k&0(=&CPYBd4^TF0
ztz#Ll{hHYLrRX7K^Q36&Lm_wW-8AOG!(DP(vx-8ZG)`KE!Th^qPY$orwR;r%7L%N9
z)h~3+jm{f#V`=Xm2vhu5UdSnco3}Rr*aD>UbM=Eyh!dvgE?*|_eyia-ypvW^>*n|i
zq)7e<JCy$hJJg(2hsCWKKL9Y;JTN#Te1waM(VRvDD^>|a0IK9dRvQr0Bn2mfm@xr`
zpM!*vpaz#L4ie?F-NV7ZK*e<hv%6m>%~Q3Ql$HYi6?j+!z=ON}^QkH1Izd+TF4DiF
zuHkm~>$T*Zh+|4VD&jp;5n-=DdFm#3r^g#ua&>`qR|7Vr;Oa>Dt5QwzzlL+=A}xpl
zb6=ts8%OtLo8K^nI>qr!WP0aM_bX+CR7{NICLx;;)X;sN<>y~t;k^obL9^$I%Z4H6
zSkFJs4l+Qh%zC?-DrrG#um~gz8n@M3e0KR|uh|r&aLbZm|AL;gZ`J_mIU$Wi{Q+`_
z9S-{1$8BItU*vK-7?N122OZBY_;hM(T00xZ>9b7RO(lq8x|+<f+a;20)uZE1TA**z
z3zhABnyt8Sn??ql*$v7c|G4n9t&Wm9xI6^gt0!><e?lEvnYUU5^|+$R12E_?=GeJf
zNUtLtUDU&q4ToJew!4)CGq<U}`jG``jPBnlW;~qCY;Zu#)Ec18Z)Jr}aAb05YfDH=
zH15-c4DSmpoR{XEG(0}h6_Q?r%*Hjb%dLeU7-4|;ARw$)5vd4GM=gr#@|=p9-R*5(
zFVnx3-NMT$K_Yc%qy}f2p#m4tQ-^IMn(xlTY?PX0kR08y(C|h3?}xh!>#B5<@kn%9
zRwI>_^?t~KW98`cxS@TXlbB2$X=d)Z^PM(1GlQ<KFWn@O&E`unAgbNX$Pa`EA{bX_
zE`TVf(a;@Hueh76WBRM$k(`Vl;?fdDL&X64(nNGNQ`Ee4rNcS1pg1LC#x~#0LMCBk
zoE6XfT<8;Wg}BMQJ<uTdNN}>kgLsLxf6U%-mH7)xOg!GqbWah3ZD;%k&W|6PNe2#O
zJ8*Mt1O@{ih^&%KYN{%s6FfvP*^muaQp`RKlmNKTfv+cc>6)sIDpLEV(tNPhaWH!(
zIkY~yB#oLm5JZZ%1Y5(OV?^;J9NpVio3J}9+wwKW4w<NEY@qCYnX^<9B48@uY%sIU
zF6jByu3;V8Yq9y3kDrS1c@#N9DyW3`IH%LrSR?Xe5I#}14RcD5up@!hAvs=u3naua
zz<T$2Eo1=w1c+<^JYD}Kvf<-Lm{2N+Dp<R4^Rbxsb4T?%H5*u31Jw(KFY9%+Fz*B-
ztM&IMa<oJiK#U!ItlXjM_%18w%06EQp~>EW1GfG2HgEOrDK+%C7t(cyCf~vC1j$6B
zMeS9nt7mW{_!6~fudE`FIA1wj^p+->G>xir^bh9*Wwjvz+ml%VE4m)p6Dh>X58Pi1
z`U~^QAB$)JmI_^Q)>)v^1sH8yZfKmWKHMJRj!x9<pY>w1B2TgaSzl}0Y40=+?_|bV
z)RArvM5FVoYUmSwfBI#UHMPCnv>dZ|dlHSd^oL^_7XO<T80iF%{Ce7fIhAPzDc8na
z4tQ`10Yqk#v*<|6zn>bktuib{D@ITWwOi=WEp;rzb(YX3(`Lr3vNvOyTYZ01Wi_iS
zi3^!~DAH22OrNX5S-0_qq_=czob#B64Ofm>Bw@cgFgdsT4YjP~Q7B81)xm8P8!WQ#
z&(`Obh9tlYEIj!|p-x`aQNGrL;DG+8-KRkCuj5QybjmPY`zN)v+^L1koORuJqVkqr
zHtkz@HVbhqyxF#QYdq85mmm|%jW5&XZpX#cvhSUOJ~0u8yqs}Nl;h}0;r6~+D9oVb
zGE`p6Qi=7c3PVP8F!20GXuhPd(N~^iv;C~AoI;i9N+qd_2>Z^Rx@m#EkXF!vFP8lm
zsP>M1FdcY6^#49u&0{sa?YtykdT<?lgj7|9JhKHV_{xhNf*fmp++B}M*tCg9GSF26
zufQTRb8|Gbx@q*&M==*|Ud0kgySMK9eYE@Il{xTBo|i0HGAd{C-!Ps6g*gOJQgT=1
z_X&W(D80Tq<lq@$+q+Tzmh+pj3|Q)l^=<O_K#-$_5TAh13Cl3MtKdafF^(iN*4xNm
zKqc63%sb}^m)@x&A1iaVA_<Z0{bdXXeQ<#Z4T(Q4g2yH}5SL5UKwsRc!S00|D*E#f
zSpXR6-trN92tGq$QcjGkS@T7qZ#PDbz~5C5)ep4XKM@K>p^vF;mYqZ8?;`D3sG~-T
zifI%tnBSe5Kgi1!xh<%BQ_@Z2Jgg0l{_z&L!w{=naj``%youF9!P1+^-bjnb?at*L
z$NX}tF`b(40+~}AH<=k}S<GJ)*)SI9m_0g$(EqXO{>v+Zv-Iftc-2=5-su>N##BL%
z83~CHH%ts_N={$q5h48}WBsGE6_1=y)e!_rvo`;RSdNqXt!|-M+2;x_-R;(X{YC^q
z8WV@E^Ad~wp-NM*4B2i;{!Nb$OXVO)OUJp;Q|6%uut(?K&GE=<x}u_1;Bmtd9ezAW
z%}ANNIn%%}6rSEsI|g5-VG<e1F^mFhYN+I<Yf3++D=}Bbjw(!i^dQwTT8G%T`Rg^0
zxiB{f_Z4iu=AR2n_72<SwVox_P?ffPxj}as0<?c05q%sqTX#-VKH}*!w$g@)0SJVJ
z+}=pL#Mr*$7i!G7p?ob?A-gy!vevV7Qrq-F0X*0YrHPbVVoB)!LCCF2^{F>5w01jk
zQT1@5E<#4JZglb4PmNW4Hu<y<H|Hz0oAN4iYbm6XPLEI{;U7D||KG1bP6+H^UXxz4
zR(!tpgURHbI8U&YhUscq5z{$C!>F4u;;7N69WSnEkK14`!)#RE_RU07&q-L7ZLX0%
zvJTtN*OE|`P0LMT0j=XUk(@F~0UP<@-|5@4j1t;ZCM(x*PrU77BT>%;mFsBJMWHs5
zEAzZ^i1l-?agXb<aJ%AeH1mfoDrDGOHMBQtibIy<9ps0HxqE-PD=W-X&L7(9Ko`;H
zt3IylxT+5=EiDBN1*t0A(^Vc~Z4LL5GIha`@n-UR^LEreF)_E~Y-wUBW2gn^1m`*n
znEVZ)5NI&^nvZ@bI+)Kv4kC#r>e}I$tdfk$f(j@kX3BYPJwlj7Gx5=vi59{E1mpZo
zq4CC_Px^SzJ<~2-@7(U>n%ijwO8k3jgy@ByVHD*=(z0=4sKSg^%6XEMOLy>JqdvXs
ze%LOemAp<^GN~Ogh;JFKN&emKpP-vXpF_|$Vjezm92VKxX5vh)Bw#T0rOr=b_(O2N
z(}KWAd;9m_U*u9jNGG0eZoHqR{q!x!%`($c13Yxnn5D>gTjD#6N<uw->p6T%^0LQa
zOdCa}Gj5qYnYGTORO}>Ow6teDN{thRdxMVL<3qr06#^)6K>yu`Ybq#Mv3+eVWh*Se
z4UVt;5XfBF?`#Bs{OH$<=Ric<7PBFpyP8&@P@&{6X;L7TPAlZaFrZQ*F^7t~VK&A(
zFxC~!fc@-pKrPLJk!U~qLH4^?tlaht&w2_aQ@#8HN+^!^`X(oaqItn)Er&3O=nZ;_
z+Ofto3|)L#{5{v)+3MYS3E8o5=ZtH^Pn4ca&$oQGjpW`I^v8uZ4bq*`_<SjS`3xDg
zgMXJ_R{9A3{0sEqD(KC~-6H*djjFz9gZqbtWp@)=$be(aqu`Iv%+1&ER><-%(6lku
z2UF9Omt%CX$0MrYrh96cNb3xr;l<9$OJUcUD{ghfpYQyOcVHtjtc5i!u#*f<44OA!
z+p0R`j6CW~`i~<`NmmWUuL2%ONL)-~(OeZdyD~Z05kJ|@*RnHxp862iVCUTL<7rsi
z*-J8Fh(k`c@h!h8U5Y>(W8uGh+yDLd^y-Zwc$RhPP#HM+X;DIr<L~@ac!=puA?@AM
zq!&jDj?|Ip({mR{Ig>-$sz0}$zRshYFpC3y6Jkn*tQO<=MrB*;>A|f?Bj<T(1V48R
zJ&4LD)~8F!Xt}nAMV1qVaY=o!V<iRTZWL0y@!ZXN%xdu0_4PC<KHmZT)M{E!O?r9h
zNaiV+x#9K%h$0hbvmz1j`{L||RD1GXv<)72M)(^gGA&yg{H=KTFAysbjk_n>T2XTM
zT8`25JB3guRW1N#0Gi|x%uHRr{0^wz>=&=XqqVv@9%laniR*9;f=}!drf0_^tpylZ
zrC5VAV#9}2Dph6oa<fwcb06Ug1A-MPl%OIyA61SXgbDwBOz<>bL4&jFKS7y>-rIsc
z-=F3V0ysgtA3Hn?EsQv3)k#-qDXIj7CEFaNzn4>f2&Lj;#1xGg1PrwPzQSke2ULL7
z0|~(osui}8BB$&e>uM$pi~<V#TEmzWEa~cN!=6}XC3@<B9XqlUrjkLRwODTzWLFF2
zvWBtZ)ymN#i-tdgd@kB*1bR$<$fMUkt;HYYs^0)$dfPTPBB{T5TKN96rzKW6bx``q
z7;Y$Hv-P8Fc-gk4_@&c`DCqn6_xKNc$S*d*4qS%cj+|i?!{n}xr6Donsjrrl0}`RP
zLJ#bTifqWX1-3}w*dE@rBoCHcP8oB0?B=C3%Szxm(mMDg)C4ufwBbeU`l!p~tGI}E
z=}kMGB^*=-#7LpIPUA}Cc&)(M7FgVL*Q|ok0u%9@XHcC7v(5GEFT%33Lz7>26DP7u
zjH?bRyoL8iP3;qUZAs~^Bg5+GG1*Z)2y?14CFSK0>*C9bjP;6p%ML_@uI^vW=uNh0
z9bY3*P+pwS)>g}Ef8h!MU56YwM`MONFMAE-c^6s73q<BQ)AjGe?P1zGo!5X46Da_M
z^id<XSRR_AdE2*_Elm(#9|*kp5fcB2UBqDB1Om4h_p^b(t)Ncu2hA9uUOZA9?U!%R
zGWPr4l{C1gbS9Rio$CIp_u-~e3=iN1TnNLCpKVs8oVqcE_Pe8oj(AFpV{YxbR7C;f
z*pnGvs$WVD4jyw^Yc2<zNMsAaMsm7)1ARm^swvq=zq)-?0SUa;Xrr(9a{tSYgKOv~
zSo_m5OOlAl{z@$D7TsEv=F@gB`anN~U*pkr$HD9E$$h#~&~%9|gy*{1*YRmd>!9Px
zg8{Mg-^6#~M~A^KQ^kiRvCabEX#E+^ZkDcj3Td(F0HqbN)u3dgr3ay_`J!E7T-=Zu
zMJlD4<5=FxQA7ulYEd`Ga1?&zwC~3e*-8=go`TmDahbtzxw?jH%3jwMQN%kSR$4C1
zl4Y8&_k!7W^vz(vqNp0_M-{A3j^X4uLi+7#<c%_gQanviax&q<WYkab$!v3Y8{`Px
zT}=7XXd+G8|2Bi6$0I>Ob}LeE>L$*h^in%o6)-@~eyv<2(Tu9#Z|3=Jk*%*!@PU+0
zJ*9v5tWe`QKP_tCb78iPwe%^q7k;;1ULO}~3SA1kwQz&L-^rUGB0t=UFqzGeBQh1K
zvkAUwlHvSN)l2mI;_4>JdCft!;yAd(n9duM@aJppA!d*3$||s~42i!3W+d0;(E0mo
zfd|Bjb6mVswRQ+FAbF6yvo4xTHGjZA6EIKt*+!R~XGY!_S~8@`45;5y|2Zcyxci%p
zj&$lY)>?p#2WKsAkhLvo!_93Q#zR4%qKC;)P(9;Q9&O-hb2xeO6WSy9E6mkyrbD-`
zqwU;!w5B}dS#(3vcwK=+kz`#)s8dzdH}<!y&VPYC#`Bpa2IW$n$c*PYcjo<>Mkcsx
z-UqC$RI+j>Y$B|+ais2#-J=-7Z26?$G$65Ya-H(u;EWGi`@O8IW2w&UmW*jAz`Ga4
z)J7ed+oDTS9FFEH<-DNZa6Y3bc%pGEG-}2&*=v+E3lmkA-!x2^swguTmgDChRh!1K
zPiLr0Ht>9~xt<=lpPRTyTJfZ9HKzaGh`kHPEh%yid%~`X47l76^@*Cu$Jl5%J#DB+
zpU||}!|xmw)cCKxl47@KjH>Wp<Kti<SX3bHt%AWtcKU+OdYEUKzb}91m@A={<ty&(
ziWdq<K>={u6P~IZj|`oon(mE~%OTKWygauz)T7rKXW>N00m;tzAaSIoDNGGPkZNdR
zZpJUZhz9u8W}U25Xvcb+uB`Y6oz4WO???qlN9WvrCP`jq=+u^lseZeDKIT$54FIvj
zKhTZ$N%z|&ir)KCJ*~^3KK4!%FFxggM62Mj@EEBN%4P&v&}))Q3Q?wk)CnCYU8mm*
z6pY+M$$B)|KS#olS%Cq0vulwzw$sK`@VD#X8$Q)Do*0EUWXjGJVY>jKHMOkp7s&DI
zU7GSkmAUbi>lm!u7k(S=AhT+41tyQgwwl`2*2+S4=Jua=j=Lhmctmd3?_>Xi)cV9X
z<5xry=BlzuMSJADXCngG+=>H!CH<Y$!t^B_99B;JdoO7PmO5i1POja4dc&u7M-qV4
z@}?@1XSCvRs5-M?&Al?surGCs4)@zXjyu3bIx6<tSg_H3<BnHpCx|yW=N093mKe4%
z@g#fJ5nq;FY>uDwOt=7JdGyMKe>3FkgaD<jl&fA;h-A|(nodiHiIanH%i05Bzrk#;
zEo0=$V}BBbZ)fghvF_+MK7M*7mANoLEk*q(Soy~XlY$3b-Q(je)oT51OeY!4;=Kb1
zDOL_p6Ba%UP?AUK92eF@$0*H;p--W5Ga5>rc<ajaA88Q<I2i|vTFFmTr7NxKD^!4*
ztkQ~_E9awW+ss<4jx;3OSlRB=mu_G)?dYE}ouxY-FB^$YHuQVz4(yD5P6g#?-(vT5
zf|ne}CbNC)C*G%S^vZ-tIe%EROp%_LT6YK%)~v1|cZ3J^d%Aj+DB|tE2iMinmQ#^O
zJP(aXFmPdVkg~U0pi5+-TLHRCkKwq-#a?037*%C+++^l;q%O35t1Q2nql(^Ii%`{9
zp{xK2>UpZCxUJ>1?h){gzCwN!CG?_u!L|yis#nhj#5<PZ{^#2U1vzztPsORj@ub{N
z^tTgdh$6oA2A#g@S=|wQ;0emT^4l4Meeyi^Dp{aXeIUT-m?arg@qh?hamglqp9u}M
zwbM<-x1IagickZLYIY|%e6x*o8Ld`CjAR#bXm|G~o0x|f3-fn0o6TsE@uH<n07Tco
zh53zE*v%qg*br#0-Sr%+`bixRzGPaM+Q0JC?6(#$8%UK&{gDpA$zf8yJ};IVc|4WU
zDs$OV1X||e|L{NmKfI!4_)uMaaa<}=(HksRB)V|9RdHHt<wt#uB(xMLJ)%QR?qD+|
zB6@{rjK3XYqsP-2w@V~X>k;#XOZ=3aX=xo!9&SQiy0%YvGVjZO%kR<8V~7lh^<`{j
zl+=!3Snji?CL7?B?CRBzHRfDFk@fhSO5d7f@&bXh;N|?i3lWoyU%0C>AJGCEB}&XH
zEid=>%|p}<DTf-y%eexKBO6V?$&;zt+)GQ>x|`!UOzIA>Eyg4HBSrEuigM|eZ>tdM
zHFbtOE@2ayCPf*gkY!TRu#eQn%RWv_>kdX}W3ZY1y>&2M%X18SsE$PqAhJem=$p)x
z_c^Xx)z04A80INFv~?sOHt`}4KP#>={^%<FLa@ORCf<m9;T?6lZD41Ue-yECWm*x3
zX5aT)a?H<vpfDfjGH5!vh|PMTz;Z(Sq}4HeUG^X+TRq1awQ#S~E*mvLii6z04O@gq
zrwUon)ErMBfPD@h$Je8CecQm$tE0p;F*1dxA)gD-#Qc`>ad4h#Os(a>t1Ov2XLsHR
zW!?gCz+2bge`Wjr<(M*J8PZsUI?Gs==1j@1q_gy(bH|}is4lM+rBETGR#^IjI{c|y
zBvZc^hgO(O6rU&W;|4$B#fYjD66X9-rDvk2<FG^!KysXG5!vJ%&7fCqCUo$X@t>;#
z@`rvzbE+?P<7@|;KrVXT02)NK>%n!EaEFrmJ8x319CLsXU$>BHw0{E6`g!kXugu@*
zm5-U|n*zYj`3K@J{R{gc+VKbKC%xY(6?{379I`s=IXGxkIA}p9eZNi;D42U}wyCCN
zloDB=w~@th`$@I8X>I*TY01<wrw=#5FXrF#rwnKD%+GRO$?27=H1iu<0LvAh{l?K7
zY}mVQXb`UqSbNW|ynsbeM;l3@EM(HWTYWW}3(xmaJH~FW@5+t)>O>B5fBp3tCB{-Y
zzHk|kXvhQkays^*P>7$g9higYB>i6xLzwc+F@M15K?t#mA|$DvT99uQWzC57^R%)G
z&o;VR<+^qwi6^O6wbA)2WYwL`go&jviB`^?=CxiRkaQj+-8E=S$w|3(Ffn!QeIg)?
zu2fS^EN{;Mh{o)G-Llfu3&m0z=2V>{6qkuaLs$}3l2g~={WSz>i{Yi3Y}@FWLP04-
zXdK?d%N?20qOE=I{TCeIY@e3lG?=Kk?&Sk5xExTcDRXr0pj}OhvXpQKufN~(1dqNP
zfo<GheqMX8HNgJ${&Fqt$G(pGAj^q;qO|+DNn&J}R2Hliu(>gYyAphx2Fpe_7Uu>P
za5NKuZcJmrvPRk(;^W_!a63xvedO>npFpOw29O}FtCPk4Q0K|`8sfqtXBwwWU?YEr
zVj?iCZ*3xQ966Ihl(RzkrO!>ioHLoLhRN@{(7k_(v%5BzVeiHqzk3I#uLu;Iu%9Uw
zw#l+1|41FFh^a~$44?JRTd3EJo;6sp+1ougb(H4RIllvuf>S}rsVEr6ud!#f)C<Ub
zBNl*Mf}d$N!a(dikV}w2@rS=ydUmB<??HRv-(b_=T|&Gd1}i9+E~|P!aE<)UeTfZc
z$n9VdLK|dM;!GdpM`(%POU|2U`X(60FtGczJm(;y)8`X$CpZ|p8?k|LX>F4GOorl(
zsrvfQ;z8mo&m(%3@fH0=qHYnWwS(FO`%h1TVkfz-DC9_VRyZPYpl^**<xwbHm`KoH
z1g@Y=_f^qht7888Z3VvHS;Q$h2zLQNtc!3JFsuFra&`HF7Pz0<jk%#v&;`xLt|fo5
z9*u>FVLSaNBwEoz<JUx$LW+!Lt#{IF{31)qSlW-JzbVK`5Gyana;@YHFF7@=S9tRG
z8Ynwgm7`{g=G#g=<mXvf!g3Y9eh-?n8_@X}8{m(FZpZ0_(R?hJuwGvaTiMWknX3H?
z9LoVDaf4$$!KvpIgq>=IJA&OQmD>`Dl_~)7mGDpA>t80YpuZm@414%p$x%&b(|Y;#
zrRsS3QT1-?^T6TEaHj5Ogs%L^+J-qsbnCUQv>qUV8>*uspi$ReNqZR9P5>=<mtkla
z-PiQSe*xI>GfOID*Tw%01|XIG+49E<2LlE>-w-HO5~JGUVqD1*v#823>2++ou*~<>
zb0lETZ`-|LzszlWb}uUbS%JfF_i^B``^cV3svJ|Hu&6)GKprIOwl`rb5~p1Qopszj
zucoXibXfox@DlLV`6ZaBj$rCZ1v6y*+4rBU_A2}RhH{sb$?=sb73*)G^dQ*J=N))G
zXy(~k5g;+u*&k9?y{}R^up;yAV%?_+LLp|oU+vD@Dq<FX>3K8~^-@%8$1kw5Dnf0~
z0!NuJ-70Gkf=hp3B0QUS$8;BKHN$D=hH7AH@n>I;q;|~O-mz9iDM7We)8;R)7*syD
z2s7l9Q5k6NofYK*ZqM^VY~{8ZKIEd@6O;3u&O2t5>6EX6L?&Z#iSn>6=l8OG2fE$n
z^x(KyMP8`5If6Kg5{P2g`OVS%_ypzZJtbRXc-ftxA9wgV9Yr5I1_Tthub*fiQhX5L
z9d+h0cp2J%?H}Qys=w_;AfB8ddbt=c3T%kq?-((`#MD}ZvL9}jYSxF;%k>jZdyFx8
zV;2>MGESerhmdon49o+{wp}f$%db@Zh&_aOLEUk&ivimPedXO;@zCkHa~3CSF1g-P
zCIwGxcQ?I@w7i@cmkeG%Oog7b&TP$bAy%xqIAwp<NTrT-<)MpW-paFn>r-WFnU_}$
z9d}Xik*|x60(Jr|(FXcPR_@eY<&rPbpq-Lu!n-DKj)h`?>Y_d)wC|1VH<9NhCdE_M
z9M{_NWpz8TOL;eBMR^`tq(Bpq&`;6kHRv6XXCuHmMXTFBqlX)>JaV2JUR|8WxK`=&
z)PLp?k>H%P5ixGG-=A$#sg7xSf3@l7d}}I4?bnBEoK9Hw2kXTD6YHc<ZtSSWd_kET
za=_8>f1;KB>yGPb)}HeeU@Ns#wD@UbX&M~g_i*RKw*n+p&MUw#-9A;?Y_{L8kw@j`
zD`r$hwvA4;GxYdG><IX2rU@68-mmun2+}3DsKh)dU^f1?NDnr7^dE>P&{|rPutfNq
z(^^T_LPkYSHH`e=4^`!cnn(ixXiSjaV<GbB=y_6sV!nR=XUD30;RtipN3c^CcBwob
zEybDZL(Y<ncg7=q3I9Z7!_O%Q#A`-4SLM7boY#A&;0Z)vx!(F>bMot5$#b=^HU`s2
z#Du<Qgih)25Rqm1X|zaE3e}0G=W9Pu>|7`xuGifo0KovLIdhwgQX)Vi_}aA4hlnjH
zX$Eeh%v6#C8q1$z$E7W(z!Z@`MFGxS+LYSqC&$q>XHtrG=P$5nXKPVqTl2Kh0*nm@
ztrp{YorOiNEIiK*cgHLI?9IM?AdLI#osf`Op$q@cyG&M-^o?)Y+PPP61rJMI!^zG0
z=#l0qm6r|r`x_@lz8}z9&bht&gOb)#_$8fVUDmO?09A1i`{VPpq)dd^YI|ugc*g&t
z6>j#TV^aH#N*>mpu4Etr8$kwM__`Qra|!6`+42`3$<<l@F4u~YX?yb+ClNFL2(Ca*
z9i*V}{3aYJubTZQt51BHgt;W!`dK#jov-b*KbSBDgujFHu7)3}kh>K3ajGa~MQMYe
zBno)1UVB!x0d?kzLWfOOSyraLKZxDH6;FZ3S6nlN6;!MBVd3G$#bC0DQ%qpaLXoz-
zRS~8lkISF2FJLf7aUAX%uJxFPc1q+RYh9$RSgl;!6AvgK;*bDs&}S;#GlGVRTJ_l>
z$n(c1z-<T=ww_br&g%sp`#o^XqxD~F36!Z}#-blE+bbQ@wKw6fc^==SlK2U4)oCj`
zV}+AbViV4Adui1tND%qBQZYy69^On)0=T0<O%GwSeUSMwbj&}P22$~yTSXihh-jgE
z@x~iy8K0S}5PIFb20}!r*^SCcC+uC=u5mMK+|qyhz(Z<OyZgYiMG*NPz{X5~12#jV
z^vSF`G*Q*C=rD9|GolfCLdTl28!PgCfa9##Ms>ul5M-qx<k9WYt$Kb|tUK~eNf!{u
zacyOU^*y=}{s~e4Z$D>Nhm)-zhE(ke8^5t^pD!R%eQ}_LOlU?s6evR?bR@n}zV$OD
zWoXpVU1n<WX{Gloz#xqCk_<@oO`6>I@)>?swf-i6U4AKA7iZ6w#fg){m~yU#wWzJs
zpdHNB)(-w#9!elCb<oVO$qS2PkFcFhI9c%69{v463Z7xtCp0S!%7T~>q=Tb*jO)_h
zmL=#4nO9l6LoEK&HwC7jGni<;Gt7}hV)z+QW*x4Er{?$0v}hW0jkafh&M3oMH20(c
zNYGH29C8WraX(&LOsOkm0G*$l?40$*IS;nT^G~McW|VIq5e~40E;*vO$xCcMdP2p^
zwc~(5;R_P|ShS@yQq~)m(@$xaySFot<YN0OJ=q`0`Amok&{G+PCZ?nePk2<1DcBOO
z89=Y~DaOu3Hz(>0Cf{X<Ucdq;PN)*Zze2V+I?wJ3qGHGxDfvju=wvSm`U?uGc*Yoh
zZp3pNY?fASq_URZQr7T3XBIsS6^dxvJV!ff_cF4HyZUGkhQVskxyax2T#-jiwcI#H
zwQ2E;FS#t6^{UMePy*qI&&L1w!2g>@cVVZnH^Yf%$|MHEiFTGh-fsX6NGgbvx)?+c
z<S4Sn^UntJfag%+T0#D#PD{q;q}W+?+G_rXZy2ebE8BS7jL=A|@chiNHL5ji&wIBA
zz@ZwgVSGO4zr|`G<v8JYytNGd0o-?{E`LCPZ^BZ8)!maLyXoR(m_mx666`|XQ>Ase
z%QO59j(oIE9@uR_P`ktR;<9~Ti9&RF@Jn$qkwoltHwZ64*2>@Qm+TT(_^m~W{6UM=
zph(wJC+{51JP-_@aLoF@ID5;eIMy|7xRC@B2m}HIZwT%LcLD?t5Zv8q+}$O(LkJcu
zxVyW%ySuwf-XeR>%s%s-Gi&Di(Y;`GEhwtH9-iyIY~XBRL7aP_4A4UTbI2`l6&n7p
zpKeMK9j8sDHJPDq&}+iL?O5GFaZX$iRp}VhL`g8&8&2ee-=LpY`M$UbSsdo3>O^0{
z+NhJ54tN}%eC8@B7{%2Ci3`FyV&nl0J6hjs@@!$8zEvWb0cQ|{5maS;mXXXC1=SWA
zYCW=3VAuABOgOC9^*+6jTrI+xtWbLLa-H1Bv@FLOF(CKOMV8UpdW<wKEl<_h$_b+<
zlmPd`g=X>Xpw0X0@}=G;2b!=T4&<MCnSktw_&Pl}7BdrQo5}iFk{)FG3@U{GfQr{3
zcjGdVNJ1w(X*dO4PpZ`BQ&dyEG9g-P*f4sy8o*V6tMF!XvvZwFtw$}VWd+0wrPNoU
z(1luzUOJ|E6GX1QUKKv19ocOEo@XiJtjJ(*3zGY#8cF>$Bvs5mXgg-1nmt=a_SvQ7
z4IM;z6q>cPuaZ@joHfr4kPru9#CuX_AjBvs5VRDuZ*ls|!+Z+)MJllgW*7hJF;ny7
zY<XJUD!(kPpPrIv@4|$6E|1({ZeUpFWcIt_KRzZ=ic~2?MGY(}lek*KEpomZlEl<{
zx97m%$hxZFMIG60{HsH*B!~ffZ726W!)lrE#c6Mw|ArSp>sUj6nD?yZh6cG-OwMkk
zAUviP6&<eCotmA`pblVn%@FlgW5V`F{oGChEjYlQ9{O7#IKl{t+s8|cn({LRV%Z5L
z>g4FaEybRofg8HRGJ{T<@g7_!ESA`~@X&tf!QcPbT16Gr#}V!?@t4CQtAFRWVT~NR
zkDYu}p1WXzoiz~u$C#?eRl0lg4`=H5{8(BRiNiww-erFMq`i8$*=hD6jEw_?yV$pY
zxYT+_x2cx=>;()pR{=U~65?O^&?otSfQ3tf9>9<_M2U0)3|W*Yz>rPYD&mQi=N*$e
z$Y#A38wF-n3I<;P+d-8^=}GFUdF7fa1+zg46&|fp;=vgYF)I>g5ww4wr=0iT9zBvM
zzLdu7J?DeKQ_sY^cI<}o#@K_rIGXFYB?Ds9F2>4UJR}&K@PzLc0blJ<Q@WTpW!`RO
z*O5K-m5t0cO+ibbP!6(wZ69%ds!Z@$`?6^&3%(cy?w(??o5huNE5sC{Qr#vr=pz;b
zvv$h79(pUU>7OmbYTF$zY~_NpX=O9s$S|+`k^uM<R3OR20iY7l(G-Ng%H~oY7Nt_x
z&~jB=?|Hm7W_<<~U*zY_c#KO_uOWK?sK_@nL<FI$RbPjzl&a*p4H8M!YAg+5vJ3Wm
zIG&kwlEX%T0Jw{uZI~fJzsP<jy9}iE{lOLnAkh{q<_xop1#utpx7qo25BWmM6^Gai
zqSB<Vux^u^hc|%{{+eoVNLJ3-yZc2Yz(x2Tr)*&<N`h4wDmfq#Ko?Iim0EimBsDc8
zX2Ox+Vg=q+CE9@l08IeALT2VHt;NrxKi}#`iT0BIFz(CxPU)?b1mc`pN?5H2DptDh
zxYVl=|DcP=q|A(3Unnw=-qcp|YJPokq1973*3-#tGu>&Cm+n{veDz07R@jY)G1l>i
zpteaaX)7L?L08}1XU>DXvYKH#rU}hFt0_KBaEqnW)pE%C@Z#ZKfhBt_L63y`UB8C#
z_k~h`E*b1OB#Mg+{<tUF%QQ#JEMb0$$5kdpCCXS{Z)d<xnjnZy>LrnPsyR1ksTE}F
zWR-*zu;YwfDt0}iD5dqh8!W`*RBjk=QPNv{`x_Kz0c^W3^EskoJH~((kAuraUYYQo
zI{DC4ZvaF*ILoU`wT+4){&2Z9>ph!~<rSE#*&7>Y&L8CR!cAN|#yR6f7Rz6@p)*)7
zz<M)SxfO4T7);Cnb5^tC?q7Maj3$ot$~8sjgsXEkV8Wr$g~qvECcL*!K5+O2Nvpyg
z_%v@W-Y+elPMa*I`v!B<gD2xMeK7!gh<0owMVy;XEu<eslj+jvMjP<Es~u&n-uKfF
z`3!%vsf8nO3CiZK+)AWp$c$jy0W|F&s5GTczns1h@9F5{s5_Z?lB;k@v=LJMUUglr
z`tWm8_@vTg-sJ6|r(`#G_{~)N{I1G@%Nn6!m#AiJ_k=?M-ZMzi`%jSa%*kX_<&-kV
z$XI7+1L4itn{s3oarjoXZh{I`O+OYqajZS;@@1A~{AJM3aa=AQ_F|&3qYTW@i<t{#
z5xpu>_JQN0XrGUl52_5h0McI2q(vx<Jrz<?0l;A<vt%j&1G&QQt~8Jte~y%}zYF!x
z#SGF)3+GWwY3j;ZzOjkAk^)p5K#lCyzGS;fT}4~mx$e{c)gAV$4ah2m8sA?ar4c?S
zzqES7lv(7V*4v-U$=X9euK0oTI;HpVuhLi}>{KBe+t*P5NLk1nEn`hX$7AR$qUu!K
zw{s>Gyfy2mJ(jUb?FmsB4z!athN|}ZuGYf?OzlCJcd1X!Sypzv-*T@|dIR&X-U0)W
z9xFdI`9W-P^2%T=W+e?bcCyeSosiWOf_CRHVPZWyurxomqCHQ}4d?2_3Alas_%Z`m
zR*i6iHnCUh<TDYh(1JP1CmkU+>K2%ZhtYKp6!EoTbQA1}6Jhh~FExR$2+`#}grsD@
zW^n8shRJf%T|Gv3v{)1Jv4KErNM}daYf7C$-hbfooQ0pAY4s#V&14y0P>gjPUO^ve
zsHr`PJ$Pdx&{O5`rEk}-Cln0JBKc{t8cZv?ncq~&N=_mr7jF2TUp5O}K&fax1*xE?
zH6m8a8lH_{>M40mR7)`Ih?iaH<%#9Y^(Akt?j8oKv)w{monOIKwe-3xW0$U753Ifv
zkvH<X{C*H)41Pc)Rv)s!D0T7Sv9!u7xl)`U!!5A1LjJ&L0wx1$0TLe^EcSfaDanLn
z`VRHz_7<mQi;Hg1o<9jUv28nQN)#tHWms~astM>8QNSxIg#OcS5KpWFa~+VRzWa=Y
z3;;DfusMwIQ=n{(iD=nCnZRBcZxFUI=T}GO;Yr}4e{h*XN9#%yHq{-g98uDeS_qGQ
z<i&2EaOHL|K@fb3#60rZddSC8%7@PM=0H)ca|on0YY~s!?tV@)xlZ3y=N=$x-HNJL
zkf2ikl7_&JC)~H*EcqK$sJ*8FutohXTsO7snhiV|4-~Jux|p$Ad-nNYQQ=$hD`Em`
zV{?t{rvseb*EEkmgy6e`J?{UQ02H{ard?y789skwpyy1L>Z;G9Vjl~s{FqEWtdac;
zfu4Mftus5)Ux~t5Bk>-m#18IZ3r+@E#LBN>_NVn=JwoE-vfjnX>A&N6mYsP2P5A)*
zfA|{V4k>+3s5aX~x~q&kdBEXyh$Uvm%htQKrlQlMNQ+Z})fh(OcRbhf6V#Jpcw@fW
zo4jmrTY9{#eTz2U$UX8G0SCQn#g)6P?pU=J%gP2@(_y8IuKO)d?@fUw`-E-;btPlc
zMRwC+ak`vDTe6B~#;rT5rkmx}SuV~~z*;a+8)P?;aEbX)NvW$$>=7C8#T%KQ50eY^
z(+VU-dee;2I}?wct;tJ~$z}N9QF3XcXjACcpA*F=-1VK@P9^|L5)~B;i!%zo6@_47
z>b<pwzsyz;_NSdX7ObXf|D2A2@AnCu)A|5WWZvmqR6EVWR~TpIBD2+=Xh?S#jW_4+
zCc1mFO`)u&Hwn4nB!Tj}2An{Rdh=hjYJ%jk$XiSIgZ3VjQ5TF$7KMBG;n|)rfHgFs
z!fj8&o}H4SqW0%DMh@gObB^Y$hanxq)UXB%oP+MdRKaYgoo#5-ZItg^m{vMbL{nmg
z6H)(-xcIB%Ri|7rbH0&_=%P9RBSf_ShwTkqp|r#xR`I9P&OxkSTR@iFvsw;|ro!EB
zK-v&zf!2)yl6I<!0)f7w6@36qJ{lz#nG7ZhtyYl)=5Do5v4v~h?A4MVd!OX)5OTMg
zIP72Pd4;v9#SX)UXgy`07m3w1<9YOlKOp}G=@-e=<UN>P<aoRR&Pw?Y&4Gv9-cOiw
zbKX8xXm*v8+3Yju+ugvV-RjoAXzwlQ*uq|%#%scPOw?k}5@@&CYvZ1nhN{(%oe>@T
zMDk`cdIqoYRD<&b=1FYJ=Qqd#d?!WXjC^Pybc}$seklAK^m*EjhJHN$a%81oyrYfo
zZuucRWhXsom9y>t@cD&K3L0wtieUg4AEJyan^y<fL=zLg^-BAoECPcc{O`x|nCG16
zn6;cAj=X*$7{#sG@)~KkXkWwK0NtpK5S@@wb*rGDGEQA|bUgstN%L>TCCaL_l1#P<
zynQjVV)*kX^wKMH5|p-(BNwQ#x_tyrH|)V*$pH!B$)|V7=Y!NA=XUH#lDwBY78mYb
zZ!vR=nel(pZ%coiz<Yi}Qo0;$E=VUYm6>0@hKq+zdC%=OXfP`HGFSpShyu$y_aBZM
zM3pdQT|WVd4?>yi)Gdfpv{}Vnfn^=HVeOCFurGM|*?Aw$D~Hw9rEKquNDPU7IV1lB
z%>D}Ex>(cVW|Cp|9Uu7*@haS{uyA_Yw&y3@<%bqE78VT;-*JX)8}rgS+wRKm6p%>w
z+x)P@y#`jwpPuPK^%=YIbwk+}*~a!`YD)_&J!^dZ_|2X$z}yKG-2#l?z3NT+<Q>Gu
zD&J_V{v0!<J<gV6V6q>nD0oj`PRPgB3&XS4*uJ{lq8do5I*d#2kKQVd;N)dbSc}TB
z@q)lsAi6#;(r3TR0^arG2r5R@xNr&eP-&cDlmYQe0_!uBT5G44?oVt7**?)~lX#Jx
zvN&kB#`)#lT<G__>guiN)4>)gEpb{?EUowwHEq$fVm>LBFjfoix=RBe&`<7WSCpCD
z(7vJ1(f33TVsB6o9rw6jArmKEGOzQZG;uC3XmY1|E2*gPF(Oyj!9ikSKzSSwL6TBL
zRygj*R2pPCn(BLsQR+Yl=HjAg=(!YO<U9!KFNcQl;qKS5sQM$rOXtbUyu%HbfKU%3
zoWy!#Ggl&Q5+9)RW?B$9r$3!H!&uY{hMrRR6!|81aphb#dv|`D52M*}QR-jD%6^H?
zA)tQhe-|#}W)k`j&Lk$MEvn*qi;w_#!T!%-^H7(^t(rKqj@@lvjjPWCEA!d7@_P)h
z7=@5V2^K^x70uT?z9o6S-tK!Mb(DUfTEhq<KuWb$QI&yeEAp6(vWaRy$_C=D&^Mb<
zr|giCZ-V;eM?E3?2Gl{l4fF*5K$QZJeC@R2Gw7zcW@ho}G~72<*KgZtZTW4a7<Yl6
zBhBy<>=_in%GLg^?2lr}u|?dNRW5Ews|Lez&+S&xyz#iW_j<pk0`8N1@f%<J5V`LA
zNj9B@2$R+vx%-p@<7=vU<#vlcTGjjRXxT9!XbFp~q>z&v+t|}MJSqhkZa<;tDa=gL
zcIkKnAxwqhz$=#HsU+OUOT2z+KlUX?qhVfZ&$teGwADTebi_Nn3AWh~KI{i~KTw1V
z){geFBxleK^pOxX4{V<tsy#g;8}EJ-u5ZIQb-?KQb(?{q&XD*sEci9CfLo71#8_*n
zGaw1f8-AFvqhwm<WPQH?u*p-xYH;AmbwE$}eWOzNE?*3QT0Fmvv3-^q=zeB$Eq0qQ
zYf>RgtdU^#j5yv^)#X#F5v?aQSC2+uT%OwUoYesdJd4xqkvg{1;myLP8K~W)^PNAt
zNQSrIL=_kZD4Xm`VDms$lS*OG^x0#H>-p?jBIksu50t}YBqdn<yRjh-IYkEtLkG%%
zy?{7Ydi+PCj1k(jR*>>HdEhSfe4($gKUD%vIB*6NLI-pH8-zH`>XNIj0bMR;|1LQg
z*zE&T)|kC6PRyYS-KuQi97xqw2Q^!b>v?4f=nlxmOlq0{I*@M5-ugmqrV%<`<ucK{
zmzl1FEgdb$Zm2VLjij~r{<P4YUL?{FSf3<Zgxin3-lO)=KA1jz7I;Bzw)tYle?w%Q
zfC45xO7bXA2uW0~;Gl{$nPVp2sE`+?bzh-fwYHL2?8}a%<$*Pie^YV%>ar(E7|n}{
zWHu>Ow=8XCv4xlgp|jP7t}jvS#D*{>-O)hm6i=4!2Z_~JnzCN=5Y?ew+|oDAE>4sM
z49IC%xcDNq+Is>@duFn9g`zgXngV`hQ)aY^TUH3`u@Nioa9PHRa31=0+3LNJ991cZ
z-9M*_<zsMEPNoT>z7LdIFn7Fw%gGHjk78d}E+n@1k18*yOjJz|jK(dnM5#{&uqZ@s
zd}dZu9KeGDUw#(ivHk&snSTMoo(FC!j-Xe@+*pgV`*rSF;Aq=?EOSKbf55>~5ri4u
zxJB2hKa3UA<oz3+tB&I6kL0|YiD%8*yHY>yzt;hrRiygt;_kQ?2bUz0e78W@%2ZY2
z8sr;&eDHSn<0>FhDs-WHJG1v{V_B#a<KQ9f!30mZZDcsXcK5S>Eqph{4Sw@bustq>
zt=WZNv1-h2WcVEvt92^X6H)V2?W0utbewiFT<Y6xYot%t=t5g#$CBTjPJ0o;LU_~A
z3xD0DtRVt&sNKh-5V*_SI+w(A00~Y_+o<9axi&9yQ>o0$`hSH@t@m(GO*U<8iY*pw
z`ha207<;P*wpxBTSHeyWC_3mhnjQ|g?_mc^%Vn;YOf%U}z9*{;Qj1_IJ)-ozDie$j
z?cbyHt6Z4chF>Os!q`w~EXqdAq<;RX0jGs%6Tz}FjJpsOh|(`C7~`k2NvuM>;3RWR
zX?dLjMF5GvO^=I^8KFo2LqPq72X+6#gCnHT3kO;g)XX9svM&%lHj`4Cx~EbhE2@PC
ztK&j?GWpS0-ux7;T}seGRy!`!tZBP8CU?FHBUCI~P~Q%yCL3JVsHFT-;Kg0Eh6|U4
zPF3n?EmuH#IxQijn=6m&VeC2-%48I#;k;PiY-zAP-pxM@$3IAA?K!j5+i4en)|p7B
z)aT#3Sx5_@6xk6LP?jedI9pT`x3Zy*mZFOPr$CX0`23Mh&7xI7G#L=^H$kgH0t?M`
zYAWMI%n7ZCt-GExcKiXqJ=a#F6mZ|-R1PE0xkW1m+?y{tpgC>pCyNrS^az+spIZt!
z?R&m(;zqYj`gx225v$k*0_yKkyH!ufIuhA*Vs@*iQHg}&s!j6ku*k96V9uf86a+$Y
zTh|(zyF5Teg#>ZiZ4Se(0_3Vx5xJxbT9LH;(J7Yvrwft80rSH&l^wG4Vkg7z;Qm(9
z?tGaF4G8WoT>Jt${3UdyW+J`qGe<l>QR9FcIBg=jiM`H|Y)0~BbF&1`xnBfld>co>
z;n@d>RL1^FZie3=(VDj=af%AEu}eg?ff+irL~L3}49Gl_l1;4@ldcG-DkHOHtvM2i
z;#7QGW@slbDJ7>?PWb)FJ8WSigj|Q$;93%Uj*jSDF;9ohi2dRvW3RXfBK<@$S6lks
z*5E<b-9Hjm=hQ|fvE=(V;<?`szH6HdqSq%;!u3XiXD-in^k180k!&{7uv9K-Kiwt*
zX3~IO1T0fCektxmQ%p0j7s<9MbqTBG%|_tOmS^W3^Yel&CJXLYz)xipg?KO5gm|Z?
zmu%(<yHDuW4MSBxd&^t(PkYs5Ljj)FJX+l0HkU=;b$Gw;`V(>!+snywz7d<c|FHC>
z1{6aC>yc_w`(u%FFDzypC}>Pb_pAZpfdS4=KBz>W7>FIRFC1j;aA4V#*>O6xWN<%u
zaCrhOQZN#QVH4e1ke_8MQXx@1ig>k`hf32=IQ7*petuYmyB5MZD-hHvz!HVEC8{(x
z2Ci#06s>S7ICnK*UGf>Lvd9$3dm*wBT%yG;7>ZBpKE0!RJpYj7-keh)A>1C%veKA)
zK0adEesV0<W_6$~{R2xGfWDY^FQXz~N@k?ZEqdxeFSfLN%xS#~+Om7YveqYzjKd_5
z>FJtj7@j>=->2(mN7=#<31BrUim{N8Y#|1&wV>TfI%F#7D>&_q?=vTk2X5|7jrqwb
z6a=y931TAIu-Kb1xDM<jaBq5mU4GR61*HBtwqD8?pV$J?@miwJ@N-3tm9ed!R?r7)
zD4h=67o3{ai(Q{cYw9R7$S{7;CM~j46pmhG9|~vm+pR7VDFhGbl_sx7VlaGC{&d^#
z0soR&BPkyD?qOO}TRG>{qZNL=T02i|acAi(qh5TS(p6Hz$MaWm58WXlJ|olJl}!{b
zeURM6@15*<`Njl5&i427u=*B8&+CZy?1Xx9+qin~b{8QfgHFSKwC;n2t?_eFTP*AB
z!+bzok51!z=6Sv)7On+3GtO(g9|skK)lct@B*)~jI8TI$?y%SPvrpt^T)vBPdA6sX
zAF4zPtX13m0K{FB+AMRS9iPFmLku>p8}7dHUq*B$lLMqh1wZ0DtdlP?-_CZy1{Gv;
z3ytu8XAV>k2rq12pW2n3A~SuW{0RJNMX(yW{I6jZ-`d=tz)3TH1y-Kt)#qP5U?z9c
zqnUT`KLPr(Pk*&cy@!4Z07By-9=T6K6<o?sRr8NiPqE2qsW*wLk5XsMkWS$zQWQY;
zNBA&^_hRCF`EOXVUJBczhnDW{fcFBUh_+_$K{$i&{u{uk49oyepew0a!zZzq8NWeV
zwY(R$%=P!m9z`e3_tm^Zl&z0(9veURz*h*-zd=Inio7QEw|b`v!P&7=qzFWo1yBnr
zqF5qa>zIL7-8MJQDE4i<`?;I)K5;B>Y^Q&NNFbM7{6XZ!T$jM}zYh=mr`IS(iNrq$
z`OtQd<7bY%7$j{iK4RG@5brMmXHNj)2m2s&IZDsGXWt2BO1uGe!4$Rk?ZSpF*~5x_
z-(EJpoV{!SB~Y`(2)L_%sEtW~LJq`MMt`gSeFaKA)GxUy)L>k)e@l1U)!pae{Ob;f
z^~`)?VsewV`tlKt_P$EO1Q`yWlB^%><u$V^R`tL^713nz^4HpPcq;6ZU?6@fS6Yxr
z@TbgHROzLeF^yEbiHxX^b}OtOcpbR-nHw4T@1nvA>T^xLDrFxd?TYkuaipFUiAztA
zHpNtge0I9kh4TUqyv_^h{9cZ#loTZ?$`sqr0ZbwHY5@t|bNYh(BKS+=lpUuVr+8J=
z*41j2Fe(y21bhNaQ=U*{Ui^xqF!qx%c}KBXCLEpZt(i0G%aVaxf3RSF1nb+MNqSzX
zRvOcQ)reJ5<Qku;CaM?fBVJ)r&Y1s#ka|haOArCAO?^~N>t(H-6zl`-*y{L?t!YuO
z<pEVYI_e@-UQY6b4cAO_F4r`h7W7#uIMUiY9yzOtE<qj@NJ5JADtLBp%`vU!R3XQ#
z+WN}g1gnLrg&{SDUbp9UJB-gTezA+kO0&PSdROPTZFkrr?p$k$x>{aT?%B3$06R{Y
z$G51L5{}(Lzd=TL=0{FIAY@ikqAC2@b~5aE5{rY@gAWlXSD~9L<>T5lW51mh^)*8;
z(^;t#abz%KDLZj=FY$H0-LCXlQ2miX$t47$JZsP0+__wVk>+B|T<vdrd@#-M5Fag4
z)*OfYa86aJbea?g6T#k!&zQGY7glUpzBhgCFrMxNAsHB?deO_trz6QA+FhF`r${0;
zo_oqzlngI(^Y#BPBm_xI1+m7qeGWNtrVNQzy|eJoiim60eeL5J#HZV>cJ@L|o8lnY
zmxMdg3r$9XKqNBLW>iiuwXNFr_>DLdgk&K_ED6t3zw~&=gJZYA^k<o`umz?Dy(*Z|
zC3>k~T8_RKLR6H3MWd%sQCd|2Qf>KW724w3VYfe3hm2$rn!V^389tlIW;FvoRuJ><
zcmW$d@_KIkfz!qkW&!+xaR$(pQKeCt+FFy=%CJ`6qc9-!Th*4Z0{tS7#~vql@&NjC
zvYZCjN(o$tuc})F*uCME2vO=KaPb4zBRX&*t=~>ltc&;8yLi$B`VXnC_{0sT@ot}{
zC5&H#iGyVpcI)Vg2nNGG-6jFtmCaoEx1uBK5|4~7k2-gY;Rh<LKpj!wEhJ48nd~pg
zPN|655Q=O|kJBB2ih_7ZoOE`qYMeHF8$P)Na2hN-`Q8Amf`hyu^?)TH!I^qW`~w6-
zH-sNY`vHFY_$GGeD}dB^K0a=HoZl)SWv{vX1Lx^Jp{dL#*z|e4X7yN8{Mr40QVTxj
zMBWbLiS^5MOj&d51(2Q_EB-UZW^;6KpgdEKpP3Xbk!2}2Ho3>Xm}z~~`TfuBIY-V+
z>Mg7MU&h7m=IO(qLaMsk;ysvPa-QwxRkg#XTsxOY>hIxCPT2_a=etW~$wu9}SW`d%
z<W41?^W3a=YjD6Yrz!}!*m;|-k}7eE$JCb)<YXeE*_WEOQy15mLlPIN&%HUWbr5J%
zq4#FMnQ|kfv;}Kpy5a`Bf*Y^kVSF08aAnQ1Qe_|FHy-J4%%i`(b^D2%Z!syTmom1B
z6m4He{b$7kGV0hx{i6ynBPuX2HvGeWXKK~Luzi(ecxJ!x5pG^kxQGv9Xny!<d1idI
zQmQ|PG!;(-#|}%*g@lt7{<;1X?B)J`cU#oohz9GwxzZ3KyXY<1PNlFO%ubP-&1ill
z;yN?u*Oj;!<1T1H#WHMIs;0)ut%pP=?e>brcLAw_8tusbQ~6u*`j74&R)^Pf+g?04
z%2J3D*-FFMnHI(ddD9HB{5`nH-=jDflUx^4Ae|4or{kJaW`kA1&_*R3hmq^igWosk
z*{ng*-W;Ho5dT9Bsef4B`v1EkBXCWhhA91G;di+on*ntV!RyKsUHOl{n5mWz>2B}O
z=ZEg=-Jfj6!y4I&<xl8<Xhab&>IYGny_1)Ms-CN)p&-z9hzJnQ%16eoo5E!t)Q3*;
zMrX)GDJUkD3F`{h!2|h;L`5ahD{E<Su>+kTA&zt6wK&>J;CtAQoRaXpy>MiGTxKU=
znXyA!I#+g=$80p04VG~H**0hvzpl@rA=^jWxX_YRU4{R~4e5gH{lsZ<r)D4LPFNW(
zTORn?%rdjE7YodYDprdS8A3sZWuAHAqGD&8Q*fWWtep03tikj?qo??wsA9jC#ty;w
z&^)8-#xNwKNJvQTjE&%lS*KmTwp@!9i|8MTVV9ZJ_;5Fcza;eWIt%a9Yh>Q{*H+)x
z+9JU~B`2*LbK#y*^>NvpfTc?vw@zHkOe{IgAdmo&&2MI4mNR)ZJ^Vf)VYn!?lC$te
zI9oxrHzF<<nha-bRCoq+o4k(wus(V9RyWvV%x%lF>buj{Dtj2?bBn^EC&O66YM%db
zQrszpc1HEm?LT*ld%%*HDEVW;Oc3VGu%V#AvMCz#AVOW-0;|#h4*>Q{nEr6V0s2kF
z$kV<2G{)^9joi(nn>-rUy5@3|*kS<YA6o0~P+&cE;_xQ^G6T!j$9m(=j1Jt@X50As
zzD?3Zgi-_9<0;F9RtCkpbAakecy^PMcRSHK8*qrec3m7uW~mIuamilVjmrNLjt@Wo
zA%*ck*m->1Rm$q+M1v*|PhtQfZ&wwN=!>eXQ5@@-j$uCB2aLFkf5iJ8nhPiDtYHux
zg#qi3AI1UOl%;)~cVkmD(5XcKZk;$ApsK$eUlw`Do*ZtbY=^j|6F!Il;9Q=r;(n1q
zZ6F*AZZlE}Zb#5~H-)^$=aplVtH;t#`-8DFfc{;+PgO?)=wIKX&I!F3k|#h8t-09T
zEHzZ6F)uouPKQ7_BxK!8<#Pm-lcYeHZWv{28^qlxFb<d5)cXQFMTgelEL3u8X@bQd
zs}nw7m13aLoI-bZ<*35kbY)5!Yy55XZ0&`rli@$ovr!7eqJ-#9bMHGyP1Df!5$d81
zSfT{T9yrT}8ujz*sxa8kOk~R%KUZk;z%LnN{AHX-&`3Q=Y@>0ot}DFI?Fns?GqrXO
z<E3kRt{M%=p9+O%@7Za<$(nNnx3MmLm<&WfuT41hY;|nGA~4sjlrzkQ;hG-6XFb)(
zSbKEdmYy(7$Z*0cJY16KH}^dWZovgX5g<lJ_ZA(mZ+9@Rg{oIb&?*s+6zC(7gm2w{
zZWW=$0o$7EW3HUdva30fSnK55@EYR9uQ^_1Q1njap7OQ=^og230QA2?{p|r8cP?&b
zg?4q;AluQp9>oImqiwtuCh%Eml>Ps}{V1ndLm3e^hPU%Et_vtB&MQzFQi5t^<eZ&9
z#tJzkPwaU*%BHzqol^F}lbCVbIiW|=&`!#1efY}g3%3P}R1g5Bg9|!8#&91VA&I%h
z$C#wmSR=QNa|jACj9?`YWAVjthR)u?jX+XtG0XljwMG^Eob;O{iW^y~AOuI~h3k#X
zUaWMY*-hgj3K3U#(w$_wuq2L+fB%8|rxwd6osacfu%*Np8z}!0^A9pFBFK%<y(uc!
zw$Z1j{wd}Q*V;<yOn(jQqg;6<6un0G@<DQZb9}mIf~A8rZfFm+Ot1!hfr01jh{*b#
zw=h@8Z9o_gR4>H%DiuzB*y+RJ8$<gZyfaB<y<5fb_)P*^G6y~}N5fOuNvx^<IkgK-
zCMh@tJ*^(G5_VYJw-7_A(-)m(rpfLj8En)YtlLAvD)~i5b#Xp9++pSV+{t6x8?jb3
zdZB&J3>&!gJ!~seZZ^4M$O3-sd{><NZzQKKg<}a6iNk4n-gH;07c&*sBfni}k*58~
z^yy6G_Vn`jX8JQ=75+Gi$nPw2K%Qrh9a?!M*pOfe!+_$=J6x$&INsFFZ@lLXND)81
zGy=d5Fvt2&q)uF0O&KpR9PSl;?Fmd^A#h9yKaBwkBEzopnK#aLtBY$9++~r2!YHjN
zE63B-f=vS=$|ZU%Zuq-D9!7$dpk1b7)H1W+uQ)MQTVc)Lj-{-NvT6rL)%~-6&M%YA
zF<pN)z-mj4Y;LRN{7zDpke>Wnq>(QzA9eh*os`V@YLjn45XKkRGN^Opr|L@8L3A3@
zf*xaL1IxLvWbTkmk*tj2egZJXZxBqkSeAyL)oV3AVg|&F5b){UG+}|Ug*NF%zbYzp
zDG__Oz%BM>u6VqBX|GH?ZN4r8Ktq4|-(#-7uo-fuhkheam-u<gHh0;rFr>8i<(jAz
ztNSJv8$!$w2)7*HMuYWKQ#hFKCa`Em)ybWIc&n?li%4lo5Eb?{8<fD|0|!#<g!|xK
zM-><awbh{lI|lXh9x<VO<d>jL=Z{cW!oSXkb$JhI(yCI|zgNmBo-vD{2QyOOn`#kJ
zdi6lLW(?c2aR<mX?!CG)%;H_rO26xzzk5I?0swQ&xiAp}N8LvS*$BQ?xT!{yhOkBf
zk=lEW1T%KGgC16vk8!x*3GAKr#?kIz6;icA3xt6WQ#!CYsL;OAhuwRif~1Kl8O&mW
z2wn2Mg^QJG(O$TI;z5u1ott~!pXiA{iCz+gpA>LS%dabyqZhOaK~bvi_kh!iWD@Mw
zjY}tFjcxcs!yLK|pGW`=(zM-g(1=Qn*oD-4$|^5QWj;!|T%xpvm%=L&PK#F48h|?0
z9YFR}?=qhe_P={vnurx<_l+y5iV`jyqn3kZJ`E}jI%M1Qnam;l_yS;8rRTyj3MdbL
zK>S+S48UI^g$6}n41fu+2@y{Qc{?6w7}a;F8z#rWXb9iINijrcypPUqFDBNx6tSBE
z8R>h46f|`scq5rxr`^^(ZlQqSmllr;LbW&6Q#WA`ylu|{T65qD<N`h@2k<%^@NcX{
zE%lBCJN_!iU;cC`o>OS;{kS{^e>Q}npO66G*RwzJh}(qjd1Qc;_SeY3l)3S5BZFhH
z8=-sNiE~Oh%Pt}AiwB%X<kXz>pcU>vy8eGN@%X1HNa6AuW$LhL88fW_liY&^+$rt?
zWE;zf&d>wL-j<>@%qYw_wirtC7U;?>occtW(8XQ~<BG~L+vg%~BTR*B00MGIRf_R^
z<|Wt%#uh+d2g6{o1u9BJcAOT+>)p!wiE-071XJPydM^)O=kd=H7eWq!%)A@|5Ew9x
z)KJSw_xKLg%ZMmZ;*FHdQIX7o0>F1Us0~pWYMHt+bsdOx=wi8QxxNP8i02AAnW&)p
zcN&v@?<*_W%vnVW_+(RjE*=GKY^BwrqND5CHp$5BflDk(C@5|QTdjzqIxk2(4ybnj
zt3kJmY8UL63QI%%K|;8zYTw4){U~XJ=_^Bz<v>rTevkahLyZnRcV(84yn4E>N`+B=
z&v~kE^Q)o<GaM6+kh9&n5A?4nyReSF(<A0a(SsIP&tSB)OJ?rCQe#|%C({C9>-zr5
zxG0z^ca}}Ak7~KD=JuSTbKLY9AgDoCiJShc8|AI>3w;S$mC!i~St}G(dX1u)+a6-*
zJQsQrk?k!DjGJhgQ;k}l{DQ$PHPN=blSqP{Z=B@454}Jr;ekz-zk+`m+XUrW@^+>R
ze)9To*j-Vn`II}Bw*)@)QL(iiGE-^fU!miN#6BVP-8=&ShVV@S!L7>Y6j8<+N-upm
z$`(VLO!o$svO(y78WH_{l(cWl3$w=>Ep+Go7&Yy08o5Q!?YRy2c%aLTEVh5xfRZ5q
zVWPn;tN0ntB78fZz1RZM3ah!q4WmlOREbus4CAP|V_Gcs5a`*-rPYp_TT>!cFYD;U
zvq^euDU6P1lN|V`^$hfUkNm5Ltp;*kD6Puuy2Q~d(U0dYMQ&`vtLkP>elGq#D~B?g
zNV_UUMWdbQ2mJCVfC_z6^x%~m{-X;%RrMQ|X*%8d*9+01RqU59z5_tL1*Xw#cL}ey
zhVq)XCb$S7SpzJ(s?;kA5nc0|9JF{0xtm{iOf(4C*@^-4yIL^a60htN`k1{k&0yo4
zf-gKK<2oFe5uj}Yc9om~;9c~ez<a3l`Hdnz6a6(J9<O~WcKW3(<L#aUOv>freE<7z
zObW^%VO}cT<N^-x2E?oI4YITu%Y}%wjzydxUiZz|$6O?RyIO_4F^CJW4<^-`x6EL_
z=rr9;!K_INXt4OedldEzqiq%Iijs{mHW%>~`KpcjV-GLDfJ+OErZ)6iC8t{L@nAFj
zMp}n`n<Txo8Q4rWzT|TKwqbZbv^)*Y(lU8wU#*pkBe8lGC%-+#dL9jRCjW<IR3a8z
z)Z`NPXpG$nvmA(p?`7(fm9UqS8RGvFD?}-QSpgCSAx5{L2Y9SeIc9+M9xnp8`Mx%7
zbGye5nQ(-5-XA5GWMGC`qv<wrJ5R|LVjkxD?hA36*s6qoOY;g+Ax|!`zHRe)^cZFy
zQr~;8Xu4&b3Q3AV<PUHAHBzB2t~r6)EmW3rwp)7kxpwXqj17KJEfKZlODE=oC%79p
zlF95jS6v70q|h3g<P1XFR!oEFEe&^z7?=s%?GL45S!N-tl2s&gR8lRcG;~r8lNPI`
z<7QcP_1_P}$m4BTvAA47qTHUOjoq!9pezOz4acfG=1;8~<A<#}{S|njv_j)4NF$E8
ztnB#FIXBs@;5P-$WmBrEWTE12{zKen<*;fN-NM?{ZwPVfw!I<k4Th)X9V!>7bGtb|
zm@~>sAjX&rAUI0>b#JFzc}aQ(A)DgzEb(;*L(S55?dG7{tXU7u)CCvw+G0nlRrz$)
zU?tNd(!keqv!4*p)05MZPLuS*w#_YPh_@P~x;3#ckKcCVVzWi_SIh=}erFLUw1DI~
zm?wt_<=3syOR(Z3kDhdj8W;RoTNNymz8PLu|L;RJM+I$?2>-S>e-Vr@U&wL9S;({H
zqWb;3%!rtLKhnn^H|!NS)VbToonxPa*+*qRu6f?Y{+oeQL&96A5XKjrcQ8OdA3GTl
zKChq}r5G52IZGo8NI?Ya%<y{iQ0_)81aqqMt$z-)V4<VkS}=6vZ%51^4#}O9TzR$C
zkl48lsuU-VT5o6V%_ZIXFsDTrL%Uk>k_-~@s+W_)lD*ThvEl5wrJ|x3@xQfHXaQSu
zGfi=Eao)G{q}lqY-{$N{%&j8NQ6;Adt?54zuhS$&kL8W$X9*fETwsv;6Mgw?dSAT%
zFbuBo26#uU+Q8KmQVL>g3ShSn`_>5-f6}~NzNP|*`2H`zUQmq>e^Zz>tcy2T^mC^O
z&F}2U?CD4y#<N8)n{7^{b@)TWI1p_Q+NdnQm+~pvZiuz_FRRx>x+SA7bItGWKa1da
zSI>sd(B8*$fj64`<%I~XvlNgM56RxUy4IpXL2F*no!)Vo3bnf13eGj+@R^0M$j&a(
zO7<$^coLh-j>Z$L`tx<aOw`R&oBh=@tHRT_PT)p~E>saYkXLcYWG@s|esJjmNe@!$
zrouI~&;(#Rm3Ve(p78+*5P1M^a+R2`zB~97PI1=T8(IsjS^Pm-W6q3q;}4?xZs2Iw
ze1z&gfwRyXV7$*LbJAEimSC#Je|QcxiF~7otax##axO)5aF*=zq+CsP>*2>^zD1i{
z>4VV7@*5<X%-Z>(R10N1LbU|eq1a)>mk0KQX>K`CL+A%v>=tGHg5K&^OLmeNn=Y#;
zdI^CO|2b}B-by<J8&shgKh>jh<h9+N!qlK8Q1$7dFGjaa-T2&Wa0e08ssS5L3J>dB
z7!V)kg7Y?dC5Lr+jGfyX1r|1vVR@6Q!#!8OwLx<WRL5xP$s+;kcpEHejK$4j!7nR@
zCZ4t3COt*{oy%{yWLL#Si<#9qpGZzcHxqM6l;3Wwus|*3NzyAJiQq|6g%<N<>SOV^
z4bhq8RWltK8_#u4Mk6QnV}NEhB0v`xMTz3mG{>sC?rY|K9on@!$Tnj&&ihSRH<Z_1
zOT<9B?FI%4N8@D+=VxidBvkmNPlQ59Qru8PV)A5m=(%|v9Abw%&U9W}>~!DkzOB!>
z4+Svb8Uj_SaUK!J>a5+%*vJS*^f%(4Q4oUX4OFwK;)0-A)-hWRZ@sub!LC!oA2e9x
z?P?;p!d`RmBpW0A>KA8YiNF_#Vx`|$d1)>BqD08rMiXojKaKq>+aX7jE$ZmVFvajS
z8e=(zt{(_VbOl6Jj3PVJ9cd20n7~QL+1yH_!uSLQfE8le{hvH!#MLRPkZ;*lvA_+2
z{1+T1@Med_zua3wxS1}#v7SCqnJkCUzZt|?_|nTp9ERx2vI%B|HB6}iDJB`)3nm-H
zib(tO?H{Wg0oKL|hLjFH`8I2x2IWf1N(z9ezsvY^`rg-_aJGv813Mw$U1jLS>ofjO
zSfs3QzfS7?6^T71oIFCGpo(Z|AHa@$t#;!_Vb<1?6VcU}Al8XW$HK0d%y%%cJfUNa
z2yM++4HB#Q5EmK^_)8ak2OE-s!YhBc^xIk@sM<}@RwB0fuyC{2KjbtSN0j=QFFLxn
znv2gbxVn|b>1@p;*QF+DmgcS&t3=;j!ri_Vf+zBZC-RZo-ybCE(tx{3fHpd(wi#xq
z4@TIr@2Pnqs<7#BNbDV211*Kg21t!CA3#QCAx|h1#L1)X5b?FNq=$~f2oQt&S2RzK
zsKq?P0Q)VUx{tZ>eG9;>jtfOO(ua@|n0Z+86}s_i)K<MP9Bk7K9rWhK2kt=DjwSp_
z*N=I4oaz-2@seQDw!YO^e?G*_Ts&boZ+I?mD$)|kug<s>eaPjUhrH6&O<&q>%&kM)
zk=qJ46cZID{hO^`eXi{oh3V}c4lnlTJ}+EXHzP{N^t%eHXNr~Vm#J(Z)Q+(r;=}=z
zsM8OWo8~{9Gt!tY`2^7tenCI0YN3x3a@CB_j{M33jtO@rC%Z`kzM1i}%`=2{+MJV(
zT!SA?R`<l6HmVZz{encY34&;4Vk>A&>eTK`zsHz|hW8Wfc(hDnA6zs_&MQ^k)0{}L
zg`ji6UE^Q+6dNOFi#KsqmV;xP>ko_|c{t&6`m)5IV_%B|?KtNn`iKjPCiFs_May-W
zK#4l;S;%Quz($|!L*ttmhFGoFe^~a2sfz0I*o{EmQBh3xp@l2%-=Ll%lbFLic9XHH
zQih%MppF*u{{i>?_t$pZ@j@Oxo%H+$<zy8<g{oXP&-r{&4S%^i=RMyLJ-Y<UP_#xA
zB*<AF2BIzvNx6Y3=4DcqVlM1Z#2D*EJY|bwC(<bhK@xxlZVwwxl?S6{Z=f)tsL;va
z$*gdJrL5zIsutVvJ1)ME5F7Kf&``{pvy!+tvI1S@aHLUs&<58?(Qi=eIrR@>qn}%3
zdZu^V4&dvNBItS#SdSi3&ATIy3-m&x2Vou(4LD&TWAZ_}6sOr6AG2=%weRL2(@5b7
z-PEC)gJ})$A^w|10=0tA$TzQAp5(j7S&Q?f>hOM0R2cZAbV?Y@U$~6yVLH(Q!WmG6
z2gmvAOP6nPYfDOM5mAKv!fGgCRDD#5D0Q4A;X=T+zsRQGzh9}pe}9oo_QYrJaoNdx
zfufMl+8$N$gC?K7_qE~)tk)fs3VYGaK{$ihm=5rXqWH!rNNO|)(ilx5%{5j1b>L1G
zG<s@yH*b;QA=X`@Red$k@dA~C_yXobwX5<|`tsxYL+-_U*~m$$2eD(`{a_$3m9$~4
z5l0>X;_BOvRvwSA(@E3JW~1`~vjA<Yl>9tjgv)*!;s~kIL^C~HQ<|ka+^UW!VV8&3
z?>nEi6=NTUeH1pnS1ul2HMo2)@EauP5$dGaCLyHGxTfj9U9B{`bV}1>DKbxY^!-Gb
zQ!Vm1tdVN68Nz!T>v4DtaHZ3B>>g#kPQO8s+mpXiXi+_;LfyaI9s!r>-N^s6j{etc
z+3oKJDZ5eQ?AbtHUtaqiilC~qd?M1hzf0Y`n|c(4K&z@|el*kxW0aXzQ=}}NebH9{
zKptsraZ!~g+|u_BDSE-*(_49buh2RcV+RL6%rZ4H|Eg*05!&YQDftcJ9<;8WmU6N_
z7oDs_YH?N=4l2H8D-TJc#s1>J9dKD>pGb<3k0(f?*i;`jw9rpCDtsNr7;YX*GgCir
z9oC%l7zh6Fq0Q-~0}@NP=C)e?M+54PxIYmY9L5^PDxyl|rM;vHYSHnGY}-7Bmgzy1
zBCn(7UYQqtsICeU&5mso#x+q+4r~Gb>5x^@6gEsd(9h3xoU46VV_WBovj;+d7NRwk
zA24oo-}{(G%TB~5cCgYP#JaZhnrD@lTGC5GA90=0XJZWuB68*P(r%&ecZHZ=Bm45c
zI($GK_Q>nC@F*(P7uA97hPLK)sDX*YQ}VR5_hhGOe=xdfM<1-;NqN&y7pAlgHkv5h
zfG^79Irze(gJ7qnc(h`!FlY!I)$(Jre8(Lnh3}V0O<luW&on6f(ggm6Z23FyMV=!E
zM>h-Aw`pK~ar15N*QiO2g=Y8f)E9=G?3gDv#)fS;E28?T;+*ip#6NNYXfFEesGud@
z>fbic&mY47c<hX3+KEh*mqN)4iSl@R;t1OPp!2pvsLgP>yeG+>8;pA~gOUU_gglKo
zED)mTlD30^O<7tV8dAVgQHD1pWE0MJ12tk$XS{02t?_NGFg#maFrN+YeJe-kgE37%
zP0Z(r&q1z3oQLbpx%f>97u;lg<F=XM2XUphxx+~-ObJA=M~A6=UcKu-MzaQ;(Q^1x
z=2HY+)y3vm^=IsWX$pF2zwY1@#cbUkMtnXtyapY48R;ua(c5phQShMXBw7wAHD;HT
z#%w%Q;kr^8fxc!!I50gykt3HL;=Swx%n8!g9bM&3*XBW*?SOriHI+nCiuyNw7|`37
z2S?k+n8h4T*fzO<J{s~O*w<*ze2R-S=<eM*TpJ$I=M#=S_xDxF<`s{>b}EXAq%i1*
zgy0d8FxO4I8m=&Jk81PAV#)f6nqrM6!<qPj>BB!Inf~V_qH%tOHPo!A(43284YI3x
zi0C8X^t}X@cA1>rA|6Lp$IDwBaU+N4os8<gQS#N<*lyaI@t0>X6T75_HE{BT=Js^H
z3JqHmCeS-^_pf!nq=UH$n_jc<2~9~OmRf@_JwCX6cDLS!YT4n#9Qx>g0Ht<2Rh%vH
zOH<T>qlD5DftK+`G0To*po&{Lb1aEPpGcH1-G?BPsbcOEU~U0&c$56TG63a;GH)v~
zqP+k~s&I#8*Z0!D2kLU?n6SP-PFUVthi@Q%0I)J+A$rv>#$o_4kD1^TR{3(M8W?|C
z@j5f)X$0uAEenexIy}HQoXhF0cL?TFY+zn3H0+o*nCBnQZisZh<@5dGEws%hKQs=I
z!di+oj$|u%ITh7)r*;d+*7L*=9D~<^y(D<IG?AY6huv&sKFZ`1g;gE=v93~W0GSQ*
zk2tA{dWYJ^8neibWYMQjP*K3PQglVJ8lc8WT5E&$yI4OWSfV_2nrxKgXA!%CYF6-k
zx5*IcUtJt3c0M8AIAwQca!+71>j(O(xaB1fV?vdD8k#a|+3Z=66y1ZgJs6%=cW^v5
zRQ)g^4K+F_z@8Ig1wr*CIIdLlQs#EO6dAJJ$QE9Aa0^S-4QSh!KNqjQe00K}E`&V2
zx=}QU+ckTU)lo`2uS(9BVk=w0SdG=Cx@Eup##<87$>nmIp)qYvRz0#6EizUei50L}
z6KM@kyRs>%$i~m6^UAz(Qx0e~7gM1@@iTQ33y$O2I|wv4{ILh9<)2O2YQXH~Iqiug
z5U9gr&jG5khTf+CYvI`Q7!|tH?{F&F0dFeRhP!aWX_g5U&90}l9Z48AysJ@nb+~I#
zTwqpz&4X8d-2aSh=suGyf|XHwntkPr)vg6W;}3vFIyI=s9|~^3x-v-cSUC>D=CgWH
zlvzsK9khijVXDqYU>M7#YmJMV4ZGG*+|>*^>Rjxc_BCH|QCR*kt5&Kg2?ZbCW18eu
zZ_d`s_2Z=8>8}n;4T?3b(_S2OJ;1$46v20_(YjI`HrEsv2hiPB5|Vu+D3xtd)ocqq
zI-+wMv_kN(NvMmWyH^u?`Em+w!-6_HI`3&eu((ZMJ{d;-PwaA7u9Zpq7K5-S3p+80
zo11DsU-KPM297IZ487MayErzt#S+>}xy+>9!s&f<8y&kJsiD3e?rE(u=a$_%ZL=g&
zFQB|w250^^nv1<9Hx6HX>DN(6o)#JUu;4iz(IB-Q#HDI>K*s8<7L#lQ|MDj!YMRMR
zoWI$HMyJn(Gpl!&a^12QC+0%GhfO=es`Z!ho+3*SD(g#n(V2Fl2MDutA+dE{810y_
zrl9^TMBywwa5$C@1Zc1B@s~qQut%A$m}R82snSna{S8lrs_`=Qvg#hr#VaE6pUASb
zRa7OM?9dwv%&5;wJ_}+|OYv!(LIZ_4ub#jXxtc=dns4hPIPxW^+-4?H+M}$ZJ-gvB
z3kh-R8zV;pGJoA>ofHm)hvC!mygI22^I4r$n0nfM4THhTXZ{ia$-1E1bA}rX`}U1v
zx7QQ-O?+Ft{XN}w)41+TxULPM?Z+Gf%6HNDQ0o@Bh~6)$VozTdI}}3{>wf*bKPt*%
zX#S@r+u;H-4N2Egd$!V81xk&xYiFVZUZ@9+lkH$ynGsRagq(wrZ^c+B`jI8CKi}T=
z=zw6U-txf|F*XsnqK`1&J001w>5g8ir`Ded%{yVf0C8z)3%$qs#IDovaji+BXuqWy
ztwDTcUcfM0;>A!3D_Uhe|1J*dD@r~@4t&PyEix?jqHk;K%>Bxm184faF<|ERI?W+X
zIKUs}V1Kea>z2-$`x)bWHkwj`5abJk<Ab{b4aLURgH@d4`fAmUZnfEagW=nl($9N^
zZ2O<J_Hz9ZRyFAl^NM(!dQp}QB&YRlbAy@Sx$)m1T@zICO&lj55g)Qm3nto;Y_7QZ
z5Zn_6*LFZ1*zvtVz`71D;3)Yb(VleAXvWDw2AUquUXZBBvSS;TvUH56%iE6Nc&5*N
zu3m1daACEH?50f<>!#@F5&w{B@us3GMWzjXE>A>lRooQu(~)zMK`l0UF^7z``In0f
zblCJdfbNz7lxzRW$7IU`eNwp`(jW!Nm}QOK(%(!<)Awh_G9YjV8G=fsBa_BM)RH5z
zNYL$VCM_f@@4qb5KhB*kJn=Wp-?Id)BEt#%T6j!m%AtAcBTCh}m+G_5v@AM4NBww?
z3fWe7X`iZAyjE2CEIljCR7hSWeMTy2S+m1k=d5L=j$X3VH@BE{@sTp$SsB+7ga`s%
zz<{J>7w4pm3B|u9AU6wKFu$<D(-!F~pzp(UMu`*`1R1Csn{?n<zn@e(RX_H0r-dxN
zpOBgFU{u?yQ!C3K-mZ;XBk6h-m{5CQAMH~ODiSSHc&^;2^Ov0o3CbDz>JUtuEIQ^o
zVsAL!gnvrs>rTEqu0oBn#6-0%uImOmC&VJhwZl8D7415C1*~G@-I`GP_X6sU46BGQ
z)aQndWH4E*^Ko=xQCgOSK1OwOIUaV!<519}hDUlz^@ne(H~YKO-_*Bj(_Fq+SDChs
zq7yZ?--tsXXD2?|n=ke9@(S9OPm>kP-*N`4Wvg4S>7ENGL$LLaLUR|4@3I==rsEFF
zM3StL&wz|iVc56AFLS4->x4rZP)->ZZJoTOnEK8T{sr1!eQ-FzKrX{ceKAa4hfLIK
z>_kuA8<N*C53HzQcJ`irMBIUrp@k6#A$f*d)s)~Z&A{_Xlij<;!Q2lrh9OC-GaGJi
z7&S+kd6D;MbPJUw3~e*)d*PPUB5S3Du;3yiTMOn|S>LC19?Qn2gyJ=&=Ba9;mX?Y#
zUV}lY*@c?L?1iDc>M0AtXnke;HF)%`R$-h9r-ct)C&gpJ>Z0<8bOa3w5MvlWHm<kA
zD<;l!*E5Tp2eigOP!JkwCOR=n&xd+EWW{h9-&qr=FPUcBnLZDY&@35w9|{7W2w@ZB
znVkNZsp$%b@vLQhmD%vV#p#(TLHjzS%pX}9DjJ8zo~^KMmzQ_btOdK)#??5gTY*jM
zclTgt>^)R<>Etgzh*L<z<Pk&Y`Lf3hGJOIkO*PuKwYOM$1rAdJ!Yak;lO;zj%&<xC
zmz|KT{14USM!8TctaBA*z28_*1W>W<3B>M}0s&6XLfrplm!q5XQ}CL_Z2gmJHzEgb
zi7rXbgS*VhqgYCJcHiaYv)p%M_Q>M^D+d6PvWk*8PIN@0{gp9m|Btb+42vr4+8w14
zK@g-v0qG9u5s>a2B&AEba{#3W5D<`7y1P@PTVUw!?yli%-#Fi!-#I@R_GXA-@424m
zUTfWP;b7i>rXt})VGprein>Pbe*ozXBLb>BAT~?s|8rVQ8Pbk>L{5M|H@eX<^n^ST
z_HKb7kz5k~9&NJqyhNno5Ks*FR00EO8}J#)ngws+QTOk^h?Ci0G$l0~HKo<>o(UYK
z0!X&Rsq7yM=zl#v^ahCPRDyO_gow}9YCO@)mIP;78j7+nG%xt+u5q=;rzry|oF|()
z2WbHW&-o{<PFWBW=T$=#!FOI25s&vAQF-8H-Lf5~f@75jP^cqxQspj!o34ScSq&kY
zkbd6z06KfF@1h@C0PW#CMAWq+0<4F2(`vSM+xLC}KwHrdz%NJ{SHS;5i`GtgfnWUq
z8YwgoMZgzNl+GSNx0q57pp5L&)H@U*%@+Qn{my~%c4Y0i%3c~6fy%oA8JZ)&MR6-?
zCK(}vNPhqsN&|mTy?S2!>N%hF1Be2xUmb`eOl|w0GU@N-(!YP!5h1BzbGF46d&e%^
zOSyc{MAER2ibJgs#sBo>f~ZI{_$}jhVWq6q33sIgEy1YE6A5DAE&f;<gr@|;+-FhY
z_91otwm|5Fqbb~)?Svq!dLs}}-<?1>w6IxLn8wt^!l+#$Rywe-S$ln1pf|8~a4k=4
zVrl9@w*D<ffisMOB+!v$eY>&or8Ik&Y>wbf`e<$Stv_nY4k->>PiAB)ATWe-=mr{V
z8klSrvsD0v`iBqrDgYmg?x(`aA|4Ck2Uhx2k{1SzF-etEANs53jRENEbwc(IbtHA7
z@R+byS>t^5(r2Z9tymw6xxK)6?g4%L)%>ZpMQ(ESh9M;?HIZ*p;x}DI<ZV7!GhO&!
zB}EY|ey(DmlZi24MQps$i%j+il%`43d3tHDTuPO+*COQp07BrBqd3nCZEC?+ouy=4
ztBZWFzM<J0$2>dYB-&hWyMEp1KtMorO9JHz#!;9^sL4OUq%Ssj>h1<PmMo-5UcMLD
zRBraBWJPAFmO}x=j(N<F%&4$VBs?}VOd$nVgiCCZ-iC&Dc{=ZPEN5&6M7#;LKQCza
z)q@Q2xj#{FAm<@ted-y8r=$6zZ&Biy)Q*3X^IGAuitgtg#h|YJQbK!z+DXMhV_Grm
z-qVk?>+u~Y(VOj-Zd+w0{umNsSHi0I?Ap_chT-|rA!!Q#7jq&(wOr~H90_pcVLQ&v
z3+RdO?gJ<iQn2wQ33ROBbzybok?%oiR0FSyVskw#*MD*91hYN;oXYM{ORnhDCDhmn
zu1L!#m^ggm9@MuoJwKd~mnnAqTC%MkDVT3a@p&#%3QmbkUdos>&R`U|JCoj#NagF)
z6;fiVm(zxInDT^F9}Yr$9t9CA<qe^uy{d1x7lKm-oJ?3-*BPhHm~iys7Z8(6w`l^6
z*;Uk*cUNOaczREv)lC>r*U!WGpKq^n4x(;c%e#}NqKYl82XV?hmTgg)y1ogc&wr+(
z<4buoe^AkuY4CdLLt+*hvN@XFWt4#}|Ep#?(WCpw5EJXShcqd~v{Yr3^F&Bdr&F3|
zWheP1J!_?~K=L={7@6)&%B>N!^`?~}F&wYbxgu}f4|k+WbG+{9+HcIh_FcsHZ-UU0
zHl3WiM1{FxQ;e$VOT|*r)n=W#i^KDEB=;JzGr1EpdFuNF!X!{aFfjo2v5qi>rEAq@
zpJE;26*!wI5Z3vZC%zNpn`aKP4f3DFj$K7q`kUsw_SN`kEUYzQvr)~Q&Qf<WdD|Uh
z(fC9Q{<vRW(Y4T}cRk{R_uH%dlC1@bfW>#UVe^R{#>%b`XCyicSjpTMk>g=vqM@f6
z|5t-tG>mH*Uby{yhCD-(G}DaIrCWR~N<6XyJ}A?9(yWlD$dQ*4A6#<BaZCni+9|*n
zMc5|<HiF8UFW(KWN9<u5Kl-!@`w)ZnR;kaI|7fiR?^ypwhOVxZ<3&+jJo{T0Q|w%{
zA2aRLDP*v;>M6u<8e_uS<N21flddG!l72fri~i@YNqc9cs1850d~-_kixR!h7vhYy
zOoE2mtU3udh6@Jd4G87*N*broYxZpSe!)6Iaa6y*$M!83cK2OrrIVq2Ga^B-ndbMO
z5g`7f@?|jYjy}P}(m1zAQ)9@LsjaHIuu8WJcnPSreArg@dHXvNB$db5VUNN#UeXKU
zeLkPB`hpH-dX$2@Z$J;pyu&-rxYFr>8a3-c_foZ`mm6bL20ox+PBY`P8f?&k>3PP2
z3;V83D+SA3;0BfHzaBuS@1sfHm_*Aqq&)K?vGJtq#KBAzSueFo;Aj;x&z1L)Iw|Eh
z`@f@nrt&QpMQrQ=H5o0>+K^YZ1Fl|X37;AZaQXqWK#}o*#YJ5MS&HRT*uFA5;kNGS
zpT5N4U)-vJ9(;(+cRbn}v#&T`f%b&(@NTCQ<R)(X0;MDIZD+tEKk#s~)^Bfc;Z?wD
z?}+nk;UrdG7g0a6X(XYSv$DO15gOWP^H>`gv@em}JQ-fH=@mastu@Q8t|&u)*!vNN
zRBOxMCPeawYd;mDS{&xPGj=4z)P4ilWV1+o<ksQ0WBq13O>|rMbFSkklLjjW?N#$^
z8zpF^y75*CX1mlB;f7LKWsW|Lgf;42+&y^WCxBE33p+SJ457d};_<79+?ZtNl5BAO
zmNx*S+(c0i6nlavPB1(OpA2yyUbPEx+4ZpDhDS+OxoP6qP?P$B*1hK<pE#Wqq<k=e
zZR*Rax6rw|crmjQUPUG8wU$mE2)FAUzxf12bAFlfkg<CIE_!NOqT&79ndI5;Lud=G
zC^cy^1S`HgSMw|6`X?(aj}7)x*$*RlUnS0?BQb9Z>g1Dhz|Q$lo07u%a$c*BSVVeG
z-NX?x`;4yvyUjn3?f;?k`0raOu-*Q5%B}Iwbkgc(ie<y&m$6!7HCZ203%RK%w0Obp
z4k<zWG&tX!(y22_xW4j)^JHr~r!MXJcx3MaGqGBuiHg~5_))%-jT>cx17<u~Awv&x
z!CEE-X3%cf=`g7`QUjqIp+0V-|GtiQxUplWzQ{j!C9KYsP`v>igTEa?PF85q3^mt_
z`slze^yPO=M>t^4@@`@zqOHGTc()=wGO?P!wH{Lb!1(Y2-R+s|###N@mR=*@@Asa6
zAKJ;7=grOdmA4oZUlW-?CX=8cch8S0<>cs+x-N%%UJ!nu*}BCLRKJ^zlk?tAaSB?g
zAAGXp8=K+YDnG%(!<29HF-74*ClDn`qgNB}r7mbzkvF|@812)}X!Fv6|N3Zyv#E2(
zmBP|i)gbR|r@(k;MNxdA%d`0taZ)Oug8@`@v@MQ_rr1@34%}5?8<w+ra}t7dT<W_F
zOa6gb2O!8js260u&it#H@&a}|wtW%4ocem>InSIt4=B57O8G1O4}XvyX`5O~{?;Sn
z>lT=VqQQLk2D6QZf{%V$KU5hYHGVmL{9ox<|3l4sBH$9&m7S+OH7&I<uiIDFk%;6}
z{zy^@i6*l8!n|Dx{k=QVFAO{WDxLWt8_8?O!k5HCm6Q!(K=Rj<4=;E+eTTs~#v^Cn
zn&b*a0ZYa_is6mLwYUB4*llx^j)X|CvLZ07^%)(!l+7EQBa+S=5u&rt&N*Z*_%59Z
z76|&n-n6c$h@pLEDaq&V_5R>O=%&Iw@s|E$tvT&6X%|F<eIm(eqdQludoTV3c^>b}
zj|z21t&%-Fhm^-}i<ro@Pllh6WoJ_Uyo*BAF00d*U?{34aCxR4<q}E7Gl`d1PBNE%
zk#G+uCG#%f%smEdm4TUCyF*Wl>E~n_V)SlCpo6R3Xjq`9wIu#p?KYxsY@@Y<tmaDE
zcAu^)*0keeaE&MBk36QbYTy^Gp4h1vv%tZOP>OMa2T;(;*TeGI{$UMU$Pu@rE4D9S
z*ZjV@yspBh7B}w9_B(<{`+HeVPxvc*dtxPJOSm$s%TNL-s|`Z(jE-tD(_Ly69Lg;$
zIf3)M^&&0q<lX*yX<BsNY(0_9!aT-e%+y*wZDH8=6Lev~6Dy;D>nr)nAj5bn-5{Fr
zHVe380qrV3=PBz_H&-LtEy{*r3g-dU546~78Cs%cMQlz9kIP8J;{iJBQdGr=M-bPF
z#sn-<evOD@0D^2%6Rk(O9~U+=<2KBGy8i`@E|oe$>q^yW|1z_kv|q5e{e@915MM%w
z!><6e_mf`e83tW^Nt`wTcR`D}XQyiE!HRLIvxmZc9MHj}E%{*sbTHi)v5vp~gN51N
zytTwpZYRs*`32{uYAMagoj!@@V$zx>y=az<k{ZEeCMH<k&BsVTlUf6+`CqmKZj>=2
z6K)gZ%3@0sZ<Pk}i#f7;!k(vUW0MrC42QP$MKzNf&ust!WecJ-*gdOt;7y)!OOhtH
z<d^pSeDX04LDVJSGyrN7q`Y2n{AG)ECd-sM$}?P#vVHOV`L+2S^xkE}tRa(@*4d@Y
zN_LArYY@K=2)e-!J1&O+WaTcVnyR$L4guqCPLw!z!~2Q7_PbliQ%&dHUS`%&_j>Ap
z`sLtk?ml4jaxoz%m=N#*>Bs)>+pvH}J=+OkV|lqoW$kyW{oOQfx}K8+W5rLkXi3?N
z4DhBsCRWxTalT`R&fj>MgHvtHVlq@VG+(KxYMQ5wXbbG;PO|~p6b2E~Gm6aIQagD~
z7e^j*<G?~e_KYwF^nWe>{?j=V0CxS%!5C*scHjq)RIdRQWP%c-nsN{7chQg@x9Jl$
zakAMzU+ddzYE$3V<p5in)PFi-dmp95XsHqF)2i;B4kRYN+(2<{!2};OCLkIq?@_G7
zN*3G7D=e`F*eNtkFNu(@KWUF%!8j-%H77C9mt=n4_huqW7K`VU#vaOwvS)$~x**70
zquLX&gR!!EM1pM`uD>sow&PA`a?g$aHZ+_rr7M*iZ(Sn*jIMPJfFwemjksaGJ(p$8
zh(D8Aa?$^#+Cwv4I=n`e0}Agbpzv<g62S)MyC$vYQ$VTCq*FbP6G+A*@|xwfMMja|
zAbw&dH>i5->T^{RGq$7Rx*6XEPd`Mj5ZcqQctCfG|579vw}A30UJqb35CZgY1&?*l
z4}ARO)&skk&DaIxKmq>O3Kvvb+-k}4W`7aOyzbPyb?-LM)^&e4F~(>%<rq=RznLSr
z(IQh?jsUKCFZE>WelX&zlwO^wr;9LnV7XIJJ$Dx&)eUUH4&?tol`PUSte;b|4r>qJ
zJeOwy!m!-az9Sgv7@}o-f~X$XJc~~dU|?bbxYHJc7FI0y>KD8lI|uZHg*6yw<iqRo
z*tw#i%+5{@Y$$EfQMGnsfc(>eOIL}ef--eT!G(gZ{+2f_ek6sMZ?{JUA+@U;_hu@@
zI<HDqgWPPJWseqH)Dl0V#9q;Tcv*EmuHUwAlfP)bczqkF702^1bBTJ+?|KWkRdkEz
z=T>bGmH|r++}!12yweWP{j}Je0-pJ?J%#;1GLv!<zsE|xf|Jv{nX*@=M>_-!F-m*;
zj365K-<7g^b8)JQPkOpRDNpC$5>r5K*{?)i+BvNBcRKN#S651fpgaj&WGp9(aZDuY
zA|u;`foGJuj(2XV^ohrYY^tW^=6WzIdPU|y96eJ{kcOE%a8Ck!NO*rpjC(al2~-~w
zXwX*7ohUuCh9F*!Z;tbXB1U{f7CH68l56r*e)*wcqR9?rgq_aX%%=s&Fuj_H%bnYq
z$xchn?c7+<8;C!Ws$;z-56J7K!iwRiBe<Mw0|z!3w5MV|{!o+L5i4GCgAne94(J%!
z(pkasmRR@0I?O@t;60~h9qWBJjbolY!q+xjCNDVGigeZ>ctD<K8!yZpBoo7_9#x{T
zC7m(FU7v?ERy*>coYfK|uYc^x$Ono+WofwJxFt=2H0r>4s^h(t<vJis_nat~$ntKz
zmGKtf^~}5~l@vQNkk5CsAv4%nH}t2P;RvQqIc*N6^F@2UT#C|dcYAMYoTP{;hQXMM
zGq~er96ed$elw;U$u!HbZ$2Ey828bo6t%TFrtiesvb=>CuwL=m&4?qa9T<MYnJR1P
zxYu`_(MghJl^6E7Anzy08KhPzlf<PL93&7X+iaLK>=twz{Q&Z4ycf102(x<f3?EPF
zEtBT3WRgLW(>h)5v1UwmS{%iSeK#ykYr^F(m0sDON-tL8SJyWk77lQrPKgq;HSei*
zynJ!p3H-S3{t!`Z!o|g5W;Ea#<ETKK@l*I);|n7>imW7A8y4ljK^AUDdo&&+K{KKH
zpJ#{CEKYq*cDVorK4#%mflHibe={reHL=;#81+a=5w*0A<FP2$v6h!nc<#tri`t1i
z82j3z_o;rWvioMF4wwFPNJMl<e1nc6G^3ptu`~|!r?Hz+bCHW7gAQrW;ZGwA@-}gm
zZfjS6>_Nesy3fDn!Mz)~X4~^t7+7sq3=J$fW_o$DqF?oVE?MFl&J(syPJ11s8F5_i
z132PXX3NpSA+94$Iils!_%Y~PP_}jDE9lRfo04pxorOU*Iz5di{tf-q;ZvkE71mN3
z4)J-36xyJPr*p>6On2Of{`PU{vT#Xsj(E|PNZaV>Jn8;#=E0X5JG9Evd}Ifk{#C1w
zBHZ-|7#eH`Mw>ByC(r<0xIB*kVT=Ir6n}Gg7x{EWx$33oC0BhU*-Uz$L1Soa|AZqN
z;`GtTsXES)Fk@e@4%r)!m+Ye~)eC_gEc3R%mjv?T5)CB7)Rs~{oTwM9k=3Bv`uTYW
zEO^+Iyh@va1i60`a+LhzwiAH9_RMQ?iURfcMZz)o=P*S+N>N3Fhd@LK&F7CP?88)K
zsH!+<ejWKd)3W+A*vXz}!XLTg8DoFEIb=yczxV0xMUegGQNpvb&fSW4)SHiEE0=zx
z?!w&Rm-)SyItERZY5or92=B@JnN?s^tiNxBH##_PY#3Q|rMaVoM2<#B1F>E)pu7_Q
znIvCR!>QHWL1EOHV|gn{^YoPIBT*C}<3J1gNn_MRxq{O<=+;?Yon43M9m5tEwPPau
zN-(1-wd#1XNDp%A;X{qoR`+Gm@)F{G{=UW1b^9KwDcr4dTpQ3rB$>q0M4{VT)*PRX
zZmtY@v}W{{S**m3!zoVaQ_|4`h~Uly5Lqy9Te{uH8r?DTLYe$X?Oz+THh!m-{S^7>
zb<<2(pL?jBL<WDMae?}!@j*!suxtNZ`TITkx6h2@*|1A_p{keCbY71MPmBA7U!h}I
zI&hgsw1a%{N9&TyLoE#*Tm~#ZBW~@%H|HZ3GX(hytYbqyiMJgfr&*$Vt96|*@T3f4
z8DUf`L85$F&?&Nk0#N<eRJFU5cVT<6L3cRfi=*}1%P|Y)VI~Z(QV4jq#|Z|TAj;oL
zsNYiyE#2JQQYdlrxe8m=d(#$i3-yI<yWl)&U=oG}=}S_3BSqewAvA^+u*&$}uewjc
z0HJDB*N>bi)?$oN-y1;q#Xt-Uwch^Y2j1*|qrT}UE|*3uFpW}k7|5U&qlfoL?aKs<
z;Rgy%qSQ0$xXR4J@&1fVRZ@N&Rm!^L$}C`aMo6CcNGaDhH^mM#)W_w-UHI2e#dIV2
z_X;yM<Etmu`e^-^X3F2Alt3z~I&Cb29m+cIPL-IDBl+N!g3tXxWHCxs7YcSu*wyA4
z*<FcwZTVKzc8O-s`^fJ1W4H{<e8kpF&X?va``jEP;alnj$pOt#yhpx%F7u-Cs=b!z
z14Tthj@Z9BaU8aPQ(B!v1Hn(LMplvwOP|qZUqq8Zx5|fxh!mQM<>-Hvf!JS$qPfkV
zh5yul5vy3OBZC`rAV#rP;b+Wu+ZwFcEOTD^7JjfgTBOMbT8zlctZnwhFFS^*#lWv;
zuBIDels!Kx9Jh9zy8HfOp_Z<Td8)bpE{gHTfIWFT<2=#}-N&47pI$1C8Sqbj-$~M|
z$)@hN&r<AuEdl1ZxtV11S>A25*Jf7yberx)DZANm3Qu?=-ijt*AIzpk5{6E-1S4Vk
za`>0`W^?XNf+n+2B8KADTt2Ytdm%vtnOIy$&xH!Bak=cpPl~Sq0;&{rd5ZN>OmBz$
zoc}n^*l0b;-^!?$4EJ5@(3^4Z$*Yj{+Fw#$#!e<vbs>2}NG@o{1>@82t$96TeA4y_
z0CMylkS3I0;BHSoy1j<YwGI$l#l@r4G4+TCR21Xigh|Ta7v{I2Rr7u?%d@q~r~}Dj
zblHn`F<Q|-ro`U8SqyNIK6Lh~jgSj+KauD1Phk#Cp}@E#rg`R3nsfJP)dpupF_bo9
z?U{@ZnY7(URznoBh^z(%mU^VKVX9TW9=eT^4p*vA2Tx6Obp~_iI^7Iu%A0Iyq+nl0
z*a4|AHCoC=r;Ti5ZqC+DyU}K_>w+-Ax9UG?Fu+i}sR@f>3tsmo=ryY{a@Q38okq}#
zH1xzn!^h_+eZ?miR{Ysb!6tXNoKNLrCE4I-EECu>Y);B`l(4|Hlc(;7fDj<aW;r>O
zXOK*WHP%J2s+{JfW=}aO<kKYvGg{x{W%U^8p*V}2=4|1JaxJa8TThbi6QRfk92_ec
zISU=XTE|BvCA*`$mXv#fVPd|<%wbrH-pH1-Ca-_KPX_qaiu_QkbNY%wsT0D-+L&kj
zMOI1VRIiNQ6JQD=p}Tlgl7FESRVn{d^yO0evfUAP8q=6W_V2n7BZesIidrC1qxi$5
zU5+A8GqyAxxEaYf-M0Xmu&!YJL&dxQ>k2&}!t$~Xefib!_fl9mH>}UI`b%?_DJE6{
z7xCrUohO7q-(NQ&ghitH+60*<(|r}l!`i)?ATWmis`4F41R@H6oWuV(|NiHhI0T-C
z9iRgR!b0dmSDdmI`5>xUg~acbghQx4%{{YTZ@7u=;_A1%<(X~5Yf^MhMrMYo#~I_5
zt(GGP2nI+vFIR2&O8rRK-lv;kzP1G>YsSNvhfQq2_>AeV<1>GNQQI!7_O2Q$Tajof
zvNM$6uXDVluYl)RgCcb)u-@N=zcIJ~SOcOZk`1@0CrxBSeyH@<e7mQ(KyFKp4aB1K
zr9~#US#)Un3ULzoi~X;UW%o8mLeQ=!QzxM-QP+=j|EA_danhXIYxiabc7vX+f7=EA
zA)`eQ2Mw4NavI$1{bBUZO%MVM>@{Mxdspxc=ES;-__7p%QfRo0q$Oj>3mBk3MYS%5
zPl1EN8G7i`2O!i*yR=GNzuKH&Vx%W+h_AmB`yfe>Y)Gn}#F}nDwws5o8ef;agO<jY
z^Y0xA;9k(Z{c|rM(*{+qK3}P=(2^5;M*^Q8lY3hmxOyu9Ojhd7^b71pV92MWHznad
z=mAaKG&W$7wY%B!rUNQRjIIBlAuKs%kRgK|b1s!22vt}RFn_l(E3i}vIooy7UHWe8
zqXeEPhR8ch=@P`eh)<SNSFUbcrgvNDXCRZT8?FbE1W4KjT}8-MY%&tlsqjY0Zh&#B
z2KT%9=<pTmC_!~+G^S_h>|W>KQp!M6wVW^gTs_nM9LBLprc7U}G+)%0J|C*k?Z!M0
z!Rww|jq1S}YLK7A^`TEX@j!Z^>8PGAe|)3qq94yya8?d%Vp?R&kSbwbJ#(G0vwn|P
zk=C;z`_bz(uPV!wbwDX5r+!M+Dy8=K@n^)gLNa-~6>X&2+HY-EV&3sT=SQP=fPKco
z;eRYTT_~%5p9PoSRll%z6b|p2RPh$RdJm-w-XBFNtJShmvFGKgd%H;$^fKL}=Q@Oc
zN5R|p@17}x|LmEvI}5eabG5va%Gq+zm7IvLS=o?Yjir%a5269BzI+_l(}VYXq_Dlv
z+f>o=q&RvwAh#deyb+T=pXGb}&I&zCM$Eqi59<aS-VhwEiYsBd(@Bot8bhjTHIn;X
zO)aAasUOcR)f>;2ijFo^#h1OTyDW^J^O_V7&6MoxSHja&9X?dWxZmNIFn-%BZ|SoW
zoxYH1dB3&(<i%QiK|haX%<4k^pu?eN26w0}-R_{t{G7c<R(<{Mps~K5y+`r#<5B8X
z;LIZ`Vuf;sV~*{vO0W2w9B>E+Gw!)OX);e*@s@j&N^*Ls!&g!#*3(WYmyW~6B9G~8
z@fRyucaU1~hnNjRGI3_lw4a_yTl+Rkqx-OmIJT(7<Kf?GBHA4Su3yR@u`Cdmr`9j~
zwp7gm#nFK42Ry#TNVMM?Pvz8N_P*+7@h^L&7n}b^j*&j82jq$r8_5dUIWL{$6o`SG
zjq#BEZzp#+6XAg+Vvp#MinYS#qgd^Q1>sv^pVo<THxf8x$=h(1y)%z<H$q0%?W6O}
zgh9kSUV9EYhNbK14$*jy-FJ+-G2=;NnF3MqnCpBaSs%)QZ}KZq1t|QI!kUo!WD`8{
zT@tdgVIwc!=0Z2E<G{3U6r{S6^O&9e>G}J*sD&$XyZ1Y!y`hzH;=L3bb%o=ftAv{<
zaF-W(q)vn#7cLb9Ui$M^efRiS;Kpt^m)>)#uT)}Pd#WpEt28}AlrKF@N9O1`dL^iQ
z`#N{6$AP@-*#oF~_ImZWFioHgcbNPH3qwR|^U81aj56DpZjdxHcZP>mBf~uFj_mlW
zc60PmO9S%ZdWD!-d(p@$>T9%8;?*ybQikb_S0hLJO~eIH=7o@cEcEr;CZ{euCXj&`
zeaDKq^`QC8zh<&BGt5#v0C{o3?bNaI&V>(<vEW`!j))MAJ1>S&pf-%0$4HF8q+H1C
zs!!0F7}N96>U!FcT_&DtM$y#jP^7*tcfN-qXe;k=qVq~Vb+zEbo2ZNDw5)hfndO*@
zoBO+~S)UnW=h9GM#ysL1!r>X7WKv`uI5j0i>!<zW5FPq&%WJ)9{^FFV3rfWKc-0%3
z3isv2Xfs{hV9;_9#?nnvt^~%EWpx4YQ~v*mVgKovz;@`@%6@SC=a<NbAH)zYji#BR
zwsH!gvqHAIkFL~Y0Mj$W_uH3*-d*364r`GfK&4~VwliB3zx_-HhEvv#z--5ZmW+YQ
z1t4X1(7v2zMu=nGw@myhwenX+#oMjBCJ!Kcz$8P%Y9SR-p>&CJich-S8bPVLU@=Hb
zAT<`ARO(@A=Rwi`E&i>5dEO00X10>VV@sL$DK(kPK@0kAleQQfJs!g!u))|s2q5dr
zzd?O60P4p*9WNr3t69PS^1;8(k!upIT0Gb|pyn~>1PRxmMM;A4QF}(^RFBD;(VL%q
zH~$gob7m8d`kwqpr2kJ>>0hdVKhIH=-ilmtDtL8r>_Sw^M$ht*{lm)ehWI6raW56g
z&bPk9c)XNC5LCsv5tHo#Hmx(}k<)2MG0Gi-WnItCjDu)kk4{-hsfq=E%?MFG5h2ne
z4Q1J=s}9ncjX(9yO0#KtRp~s0$I(6TR?yKwck&bW^j&`S;D@Y+p`r(nb&B6&Jr-yA
z(?xdlI$g5WFBk;dqfxI^bPk3F+VM{2UgbWeW7|bMn)^9pUwMxhPxKpdH(Kz!EaB1_
zWzDYh3P~Qq@;wyGycvh$CD)|0!fN_2IeLck^O$-13w4>&1vsXM!Ku#l)deEpnO~lO
za*R`brc+Pa5RMzbi1*ofqft~OvB<B2{<-VZliDS(2@OE_y%Ee}wczM7I}&^~YQ;I1
zjnSr$y|w1@lyl;YQbY)RIT=JS07R<S*YwXK5MaX~%0M^Omzs<_8vbp_AHqUoN9%VC
z$KYE(A{<82jDF_7^hdTA-Ivir{K(PKk6M%p<?!2W$K0r<#F^8vb;n74wi!u;lkK1g
z%kcbq%${~bRP}!Y*{rrb=R4!!j;4MNWkC8%Uq+Ja6iLgb?eUa#&Ft5^C7<Q?-0~6w
z_0i3-wd<~{x(+{ktK#C0nu<^=S1F3%((;RvM)`4@b1jADneTCR^qy}<OJzJ0cPYhT
z88y}O1bcJ+AB!$FQy#^n8`ybvc8Y7xjR*$f*JXUc{}FR34qqCtl3A;1sI}QSJ{Mn%
z{EYiWbSXe|X>zm`)A!|+`>DKuNamB8VuJJ=6DP?WrnuY4cCruaj#)UZ{$DUkQ+J-o
z&8xL1Jb-5ODVpmll0o1v>yAG@*%*$*GG^uXEIH_?6m7Rs7d{P*r_i<;C#573dcqda
zB<Wqsy!~dFrba?*9Uu2w4^2wRIx)@KGp7{)Hpmp^G2>PH(J;ctcLcFkYHlBV_W*LP
z03RKce!Wxrv2bOr-!#g@BkE?gtYd7eiTt<-=La%{y~i3-r-r9)X_6pkd7Y_3!B+%f
zc`|90Bh!y|1}vN(1T&Uy0T&~tKe4eVk-qbEOaz5`GMAjb_Rb~MA#cV84{Hyl)W7eS
z^)A}W%NnG0PBq%7a%K@N;z4%o5ZnCt2@XAPn6SaueO{BRwkk+r+zi8_j8WQx=C12j
zyUx&r7F_x4lLws{&|h|6DuRb)S6_!NC$4-k{2fQVkbIzf`y)<DyY`KMcUWQl<fh62
z_-48gZkAnGNX+A6JiJxtS@hHn${B~59nOl1IyOexe^e0HH6F=Z{2f?L|DRI`rd`T#
z0n1SlB)#nnCBZ%38rKcIMz_6q+Id)tIXTxtiy{ydDhTbRJ|?`42SOy&2wV&i7_HQ!
zZEW)zz6KlKZUBsA*a-9#i36~CBlu<|{RX|1uT*k0>Q0Usa8U_^ZoR6`t{)DWesL<7
zWJ56G^mVT<+zt)Jb!e*s8{FiGwyW#oa+7`+dJLVU2ZDvBa|R0!629y()MpQ(qSC=k
zOh(1>e|l)>%za4TKye_LaUVm7IzT54fh4kO2bX@xilBuzFdo-5``?=NXgW*R_)~*K
zV1eGcC?iyGbn(uHH|Yb2E&T}RKB+-_JNQ?mK=^_YU<V^V{tU?B1I*A|mL5QzTn`{X
zSUXyGv$L<&8u+ce_aw#lU6{jb>2)W4D8QNMkv&8-w4U-TZqz+hLWsRFI3IriB^Fuj
zIjhXa<pDy)zt#)4=_^kM2wQQ46kIGB6>LP}T$ojV^fhoZizCfF6D<v5+Jj!#9^L{M
z@nW>G3?QCU_zJwShfa#GhS6u#DZTwq)1!a>T27Tj%mK1PoVl`8-XO@;_4t}yio&T}
zY;*E)x{O@Xj^Lk}vY}plkx2XUDP{_JAq50>gYceY%kJLT;q6T^6TRE@>cTU6VsU)=
zt;W|68lgHhq?6@DoXP!Fm78hD$>YWI-gsmNP^q#K2w_&&u+t>|dXOi9_>_p%2QWyJ
zUAM-JQcEj@121c!hiUIHAc>$g7(u$t^u*R{DnU6-41Ml|UYOG%aHh#v(8*7xG`fi?
zQ(=V-&$2<H^&7>Bb4Y`v2}eGdYoA=KMC*hPE!sf+&TV|G-QWppago{{ka{(p^Ruj@
zky;YXaW$hfJ~9&t1~bk(Xq&;*FcAMl>QOhUr}VW+yhv~NX8oWrujRI|UK`Rz!wOhE
z#^7UtxPF2(UGO2#-Q3I_H8n-GDJbC3^7DHxwUeg9a@|g+^@G_~;~=2GN^$8lACWd+
z{H^abzEyI+8&UyZO`?fmP?eq+XUas?MEikkFV$=*;d7`To8w%UYNh7|57=F(|J-t!
zFLBr`RY}M&LR#t>anQVrybz@wdf2?B-u`tu{%|30*yHd$mx0%W3qaM>x0W7bcsJV6
zv^!|HXkhPA07(kgw@z<`d!FjCXIT=(^DrTBc!mUJ^7KNCNJH2DfaXG|?<j``KaXAe
zP>rR73qRk_w;Y#Ix;Uo`4W`&yyoOORK@^Z3n~d3QUJp9D`h$)7-PwBEb+(tQ6`y|Q
zEX?<MaKwn8sr<$asK-5d1q7AOjgAonn`MW+{&K@sEb;`p5_?jpUZNW1P~KG@_0?%t
z)hs!w9G{VWlGRv@6GUuA(S8H3wRvB}(3iO$&`2FYBKd?Q-gpXY{IFcYwy|`53c4BN
z_yD@M>KeaOv(BQHK*ba9f>ZVQ=GGQ_AWB!B3`$qTbBICxaSZYgb;mgvET6-(6X<u}
z-$gH2>vLC*{citIKzdtFmfqRgTSBOIOnZM#J#eBNBOOJRp1-SA1tBYt)k*togVK*;
zg0EgPajGZ#sy1Tn%Y{nPj&mt`rICWHLMFmP(&J9)N>#;iDpW?wDZV<uI#f(Y@<axX
zLR>1HHl!ym{^ByP(0&AV`lUpGY}_kCPWE>u`#XHTwa#b#=0KZ0!f_@y)Xq+v#(eK6
zjrYe|l+y!fr<mYJeey<H7jp;@L)??CC!>j$_o`Zmtz^O7>3uES`Er)Vd_%mirx_k4
z2EG}Ooh&AZadneCjty^^yJ72U;Eg+0`uX}&9;T4riBuiVMPOk{`#zJY9>P*-rbA_J
ze_s04g_QqnUu>iA1kAcKqZy>$Bd8~X#mOi1X|&mV85%)*lv9ScoLE&D|Ja%GrzaZ4
zs?d%9S;_1ww7us}!NgnRJ85`?R8Oep=;-9&o7q&cve}?Hf+)U^fhzv6N%hfU3YUht
zGiwQ>?OTgGIbhx8{*&J3VfeqyaDlb;A1Fr#<)a6zQ{FjzN7$FhCX`Cr3l*a*`(u}3
zl``|G?sxflHF7bMC?yFljs!8ndC<@+a<22@T|J5kP<HH~!+3hGl44x8ghfVla;&jM
zu8MqgmFmb_3<*~HPS9({zvE{D2!XZI1L!^7Z8}`pE(pQxqhc1uC21j&MGy3AfSJi4
z@%P6+8mog&C>b|6UYYX=M@{4aUsHHpGz8H+8bjr@oXcP980^`+lG#5$+p$gs41G7;
zbHrj8+SK$DlY%xT7PejI-o;=&dxI_MgJYFI(T(yE*|dlo>c3G1k@H!0RUR}2+%Kfp
zmd?)4hs#QQ-Cx&!sO+SXmwfBOD1E-Utvnv}2UuT469CG;KVyRbYC`t+=a}GN^K@*{
zlB+G<g?6slZHFgSCOx8jE+_4{51_{%IJqk8kRb_^lax=Y!f}ED`teH3#OPCz73r4o
zJjLZtjxz5)NbdI)6_(*NNrPfzTPVoJ8mGzYFhxd-7y31g@9cnhlXD;H_7^=X!|QMt
zG^Vf4SnnLtlaXIY(n<^CM+TJ_+p)4J-3S#W?!$d0%bYQ64_6x|T*Qj=tSU+C(R*id
z52$Ejt5|sh+|kGjHJb%IOU&WdutlO{_e7bGRZ<G(E9mQ_Y|mc1GiNegt0!nnWUpM;
zl;m|c09KzRsyWq-N#mEI)GrSNDS`08jm3JNgLEe|rKDgW1ba;*`KjXuJTSUxtC=+K
zhU9no<mwmXW`*FK^EJx6ebsr33%BU&8d!P!8veS{vK+jww{w9x&X#-LOt=D6X-s5G
zL}|QGQF?~)qhC9nAKVB4@NuSj)}4VD&U2rx#=bCGKegSMw37Co3MR7s?nR<$ZER-=
z_(5o2N*ezF0Ju2zcNht*L;zw6I3wLV@I8RE3(tUKlArLi@bG84E7H)G%v`u@zNMT)
zonm@3p|j&nPPCnO);_KRTp+U5KpQ~$B3{J21Fa0VB?2U8oR4-@6dubF%i!waXc$K8
zj@wU;le>GnvBn6^gw0Jjzo{9h`H@B;hYfH%CW_=CSQ#sO!}`x*<14iIRq9`f{wm3c
z6eZ86|L!U<h@*Qe`eHI$JUY;KaL;EaJ%rn?GQPgbVD8+6vh6^)@Nq*c_AaVVO@c|)
zw_p65ZsnJSO39LDtNjK10!&UF0y0%`B~%7yW<q`<%YbgQBj0L<gwDkts8UtQBXgJ8
z!b^mRSHi9NOE9n8l)uvcl5IEPeDj2gCZg`w0eBvb|E0qgxGDi?S5}=#3rQGS3r$||
zg)MbWKc3w%>V!@k!=14@jyQ#6wI(c*-cT}OL0S>R2zr3oferm7?0f>X*k(GZiaFr=
zIp7+HmO_UvMfEi0)PGV;*1<XZM3{^wPD_aU!i$n|M9;1h2fa3+NzWlWD@M+ur*fwM
z_5AR2^E|Y?5B+IewR|9d-8jcyzDBNr6f(fxXJlfFFlgs@5lmYvk|-_96}&lGwHq;V
zFf(xhPR8ZOTuQ<6OwZNctJK3^cXn2b`>g_WR|lV#V$R<uYrLad`}UDv_|~_{mxm3;
z+!TIZCwijD>GRD6kzV`(=~L3a%a?}Spow*RJ$zXl@|Gh6G){G#klbjbQzc23QGNi7
z|2Budgew@WpBnB6Rod0vclFFJZzzx90kv?}lXqWtuj-mQ!L?JyHBy1uZqWen@W1=;
zw{%?XKY(bWIt&hU9zfgj8Yi3WrPuT#M1V2iU(6|PxGrMgX608OCyqWdKs^Ym8iS-&
z8uW#+w-Sy9U4Cn3^Lo1Td=!SPBh35MRU{lKK0vZ{I?6=Jq-C_=^uxN3!cMi%1}5O1
zDd#uXgRGW`*@GXQQgd>Ej&?YrUgDl9vZT9HmD7TQaTU8KcRK+3y@WHFr=)pJAk5a%
zNxG|x5Z1azNO<o`dGiE9s+Rzq5&!*6_uQAdBKVK1p_vu%0Qzqq&Mg4ZCt>&s4Kb+q
z+B)_K24gdWQATIZN!3wP4opIl7Sew?j_V(($Rsfi0C|5|0P_c8n3;Z+n{eL^fXlr}
zy^Mz1;G<kxjdm}x*t?KiJQGKaPWNzxI3eW`<vlXQQr92^y2jz~0D1&afh0`Tj58uP
zZ2s;P@yNjV0W{bOohy9+)x;fl`j{>^i|Hv{*u<|a8$%TE4(5=NpO(`^Gpwb#ey3X$
z7J%4d?9#3|7;8rRn)g=yq5k~%r)}>ax4^$0L!3?C^Y9^I`N{cG;eq2+3vUST0zW)}
z{GnT~lja=e$xZQ9^w5-5lIXvi)do>>S{;9>M=$E0g+VzP4PMB!s;VO|QzN0}C@Nj4
zr{Tbor`J}kx~mX0&_LDW=LzGRJzaBb+Zw;4s?1d+EwbJRuLK*CHz1wFbVND8pj^85
zAKeq9W{q`IGuYqWDHu-*A*hpbJAk)eKGj+4^u*B0=1NI2Pm|YbRhUN(KavqqlF;eo
zMzj>*CQ$nJzR<;{MgTi93dtiz#*NXO^Yw3BY_4CaCoW`ht3Qf{r^OY+^o%<MV!6|N
zns9Y80(j%16ThW#rF7J7*5C2l%?PT*U#`ThHx&}ek-FQgFk;Jo#apl6ZIIlK1l>$J
zdVe#3-1|zQb%&oBOm27t0xrRH?m#{I2zcwG-N~^G1zZqf4bq0AK!i4Uhel#NVeEUL
zC;GA2*@$uP>g9P=1xiT30q3mxezer_%N+sO4eau9b9}pA<O*^U22#f=V|%j~5kF(u
z`c7mYTN>|9lw1_hpS8*%Nx0S69NAd~V%WxmM9!TXP@96CUDz%PFnHK53Sk0eh;v9R
zgmU4B3buG@x+>Y-c%n;wq_5Tb#<-j_%{V{n>#xA1hFhvHeq;O~e{!S9^1vjut_L6P
z|82dV$CeaowZOe+E^r+1yA+x1R8`O%6Q{44v9s-2&dBBL8G&N`v6{hS5ij;mfzoI|
zd+{}sX33>Qd;s6kUSNFcB|2w2%UwRpGWwf03kVIaiVQA66b)jU6cD2hD+hT}zE8f+
zbVXK?wmB8E^cz7R6d*F~WsG&SX(nAF7kP^rCl_LPx3>@|(v!$rXL&H(=HK8j;mOcd
zJb<FKH&dOfLbsPIt~D-mGk7x7-h~Xi)y%7#<bQCzS5oRfFM;SC%k>SuNa=)J<xp?X
z2^Z4oPUOPZ8D-=?IF>(v)DGWk^a_+n<r84a#l%z)gqqQY0)~c%GODvWgD&)83v|)L
zro<(=vPa?Ucvh-5l&5`M!z)(!x;3v<Rp!=<i#O`OO4&W{*{py~s%2kEL{9S%v-63l
zo2UN(FJDhIcV%Z=s1O-pl0p0FgLFhT@2um-g=D<EiJ#r4J#SMNiavneYq-MP;6o>A
zGvpdWnb{V~*UFz4$NIzL`4GpzPQ6}jfVZ#^Q~qXp8L>m51fL-0=NGofclww&Ca3uq
z|AofXfYN-vJZ5bvQwioh0x3s(Ce}?2B2#~*?@kDURGyAXXmRv6moE3aJc2>FVio*H
zcEL10t6xyOCim`-v0221z*ttrWNycJ%(6^o&h3p1KY!8_=2KJo!vd5(T|s``bcdC8
z<^&tF^gl+9c@(nJLqq5reyPYcNkl9J8KK1S#ng5;*Q^*ntPU@17DIt(6~o)e90^{+
z%Zx_ZgnS14#2Jvow%aAW`&6dR*q;^e<1bb1*i%v<$a#a^5!9oIaR*Z`p&0!`Oo^(<
zYcy&iN#?gbOMXxAenKK9$J1Z<(z@%&mDT?~*w38YOvO|%$M=(>AbL#m#UwKT1N8W3
z-fa`fwPG$VQT}Za%$wm?>A_;@7Xab=|5>vC>uQa!8I+o><Vo-o1A}h?stYXL{gKtJ
z#+kD^bceWRU(U_-!H?84rm-!_?&ISC+tmR4(5OXQzH_Af;#(Gqnehqn1{qXzmfw`h
z;Cq*B3GFaRTbob`7J_%WvJ4jAS!wa>GV!rjRKj#s!XB?WNHR=i;-hq}6l?ihL+8K)
z8Xq+ZDO=fYgRjG$9t~fPoWFysNT9)iHRGRHDJbG@Hc#hXGkt6CPFXr0RFHVdom9!M
zAlJ_7$McC8m0t$^X}U3BFMbXI3vucU9LopNs0HLSvu30%5MNv$b+axc!+F613HbKo
zKgG1$#ewd5uJX~Z{TMl7Y1_i*ku7bFzTi|RwRYO3Vf-Fd2|g+~kMUrkm~#t_6u_GN
zkEE@?&nkr9ETIKvPu@A$<q4^@q-IsjDQb&lNsD`kzFkY*Z5+dNf+OvK$$6w*LaQD?
z=<ny#IkIl`GhW7`(tq_1Y5y@dfKE(fqe+cSvT!An!RGHvj8PrzPCkAv_;W`o1`|-m
z{Qmh_qHig6wmgk#W6-OsA+m54z+Si+op!>rAR|oTcUA-%I7nbddS-T+-c_FYgOQv}
z*2c7WTDhm6F6>=XhSdiNdMyxqWlgdD%@IW@DGX+F!8x2$L_3}^hlz&vPS;;qW~DE@
zS!C6+_IW;J#BwJVaFy-BYbKp$TDE9RgpYqC2vG2YjdRM6vFrkylz`rzj|XLfcDY;D
z^kQzJtp?GV#SLX%iR7O$U_#+Yy2mTBdxrt5+AUY#aufqZtG*^fX?Ikt$EN=t^hx>2
zaQ}uY_z)WLf`Teio_6P>@S9Sqdnv1Or>tp%+*BlFvrTXBPgkm*2iA&N`HdaLg<FP`
z!(%_Y-Vn9z9sq$LBgl9-$PfuTT11F+D%OQ>fm7|Arw`*$er|ig?32P*EtbT{_GF%v
zo-$M8V-XsIPjAT*JDofiJ`-_YFuHBBJlpb(8>usKl|ttHBb>6evQmqXFjF8o%{Y8M
z*h94xX;D(yAt0`oUtfi^FWdBk4=+moLL~S|IApcB<W-&62(JU20=<;8m`-6j?Sc}Q
z<hWrj0bh0GeJU@e2CWun3_6f^metAf$hhqHIX=8td*%@J1Me4TgpYOFMAgRFK^WFI
zoo`c@6zPHLwMlXwF<M%M`8_<-rO~C9dc5W5Ynhti3z|C;_2f5XA`F(N9Y^xV((GII
z5?lm{-yw2Gn;mrR6fBjkjwpo>pv-vy2Qhzxr8g+`iM627*>d%k*x_qP)HP--(_t{M
zj2wWgpr4`DcU%;W=GeRYZ1=XE{lfLP)4yU|$==X_a>NbTAQP=mc|ISP`rB10XzxH8
zPfV)Q6xs(ZQe}gYH))Vy(QvGd7RW@^wR42gtwO!Uj2Hh}ZFDA0zKKy5%+Dcui^*F|
z)hc5;mH4wU9m&XyL85G<9;a)4SrCMh3yabbo9hNbpo1W)djRR!O5Jm#ouJ+LR>!?D
zHx7%f6u<%+uS`x^Oyx%(5iUTEBH3qKROsi6yVL7Q(xjQAh~e16g6DyWvW`>4J0i^-
zS7SN}XqLoo_SMbsvbuK3bttv+M$MfeT3lg5H{N&K*5I=u0TS9m!6&-RBj2*!XHlZV
zQoJBey0sz3)A?NHg77zEwP!^I#jM8fEuH?DxntXB{CCTjKejJOKmJ8Ftq<s>m4ODZ
zf9?ZlN)dcdz~YY9UKtfaK@2|stFT)C@>XRS?}}R9KU-9AhjE+Ous+V{3kOmiN&?;e
zk6k_I)=$)9fP}AMT*UaVvY%$wrqO1`>TLM0R#A(rK@pzCS0xU0{z)^N{8R40mFtL{
zMKrJ>0>-<|8Yzk66c}e-Ex!52F8mf4>`ORQ%g?lS338hyOIi{UwXpx8+8dltLAO|R
zU0n1z;{uzjv`F8FKVPH*z_A%m-z1Mx$ZqBlu+S?1uVCKh3TSL|LMN&3I$h#=+~1G$
za2DC?a~2)|<_f3{I}2&uJO&|Le{AbizE!E3#rP5OjJq3p559IDdL!KqKEl<_c1gnn
zUX645IbgB=Qc*BWhb$9|g97+vNo;KDW<%Z`PtW%6nM$2bYbWZJ2*`GD0g68mv}P_G
zk?$?Z@(-x~4nX@cQr{myv(S6`m=?a$vImfP?@GclFDzP)w24K?v7n5WbjWpPA=sLs
zZBO)2uMTGgEFR2`AUOvz8dv*(ZhGX>|KnDJ3U4Uy0$=_W%I9g^;~>Po08F6Pv*(I}
zk%F0pncRPXJ&+xj1lsl{y*!Be$aY@jW7?5aJoYFmC8|GaTc-sexkOn<U3Q<8KmlO-
zC1Ud41-fCC*1;C~XDSdgWZltvd{24rL^&{_VC|lO0B1gcN{p|QdW&f52f?AhO;MFO
zXWOelyJNb4cZnE_eE>;F7zp1<0RR7|73eLd9&~F0h$J^nzowfBz7M1UNIoi%;dJ22
zt^K&lMEt5XxZy8sXg#8`|BVnDa{XgtSNEqC#guiF8={!}YE~a_g4y$&gHmOG2aJ0-
zIHIju$f&v*xvJ{mCRH_a{U&~7PP?Z<oT{(lGT(Q|XSe6f2bhFN$GUu7SL3%x{%V`p
za|h~ayDXI$xwFgGZ*tIQnwFh2MOd7sJgW2cpn5dSb7**cR#2!UX>t5KwDiL1P?n{+
zP@6kU{-cYL7t)}7P0RQeeQtSp_jMwM&Auje%|-FMnv1*zFD>7*0;P;og=}(@A**i>
zAWov<=6u^M9d#t)=wPIqi7F-%9gKApLfaK0M-<0Nwd&6HzByYV9MNsvxN;dwr9(c(
zm28%vN<yOnM<q|2*OpGYg#0LlHPJSYX7jg%8A+vUYgR9%P75RZLI&0t^LpvN<0mt6
z>^zqv<KV6+(}J6n@9QcS7tUF$6{o^JzB2a9EWAw@RdJ8fw2@sC{irp|@XP<sW;beG
zr-35XE<-DMceTQ?mBVg{;?qK1!MKxm`P9XcJCoPx;t5SfRn^f#%GeyA<&<G^BjrKq
z^<@bd0?&aTz$(e;m!CPSC{3I*@CZ)CRlFjT{Cq!x;E_c)Nizw<XQNJGj65Ht^TA!@
zch<r6lle)^GqTk}m~@P1-NpWME|AhYsyq9mg+67lVu;?3Ac^yJJ($_}CjIpA{mo&R
zzSwWetSplcgD{Ts?%auD2?>2EuGrWrh2&x>x!*=7MjCj~VE~IGkfB}mHfkNUwOK_9
z7w*u8;MjAXFquC&VsoQLIcguRVzkTYGoq(e<OESv=2FyOuyDS|qnW2hF;IIyDNwM_
zWScAehGOBWsMj<`Es^}&`P$j{<fH`cjJ(HFwjWQl9HOlHlOTzgeVxhKAKm4C&9sJ{
z(^QUpT>EzLgr-wE?3tqzwX;f~of8bCL~xjn<BK|NNyxr<m1E%|m^US$Etxf2h)QES
zKj7!r^bAc|9CIR-Sbb{i$LB(WWo@@DcgjF-hT^M|6?f;SB68jS;(g+bjF0U(2j2E>
zBJuNy1U0X=r9X0Rlzx@mnScXzCl1${l~rA|W&fUnMt4<#dFmg4swA;;7)F7A#Ohr5
z#QlJk`n`1J7#?>J#v97$V}D|nMykhBG?9|tXkClXn`Bm!8zU~qrnW2W-j&yU$v~e1
zY4o(kQaLq7DuU1mYFU8tzG!!?-Ov~8tJeTE7?1ic^!`}qR~mMt59jauf}8$(@{i1`
zGtum7fh>Mu-~DoJWz%?%-X7tQc`F~&!E8i2^Au33{b%$iMlfk$Szokbw9d)Q?fS4e
zxpa95Qsv)m=JafqMi%NQB$xoW{)5B6VdcMLX9C}L+4^RM<ANfe)S*W=5Gm8l86CDk
zqQssyOH>~L>`%Fq3;7ZiwA_)d-7*ag^lg~$x({o~JpJL5;)a>C+U&lju}BGBkIs>*
zEmgGXvrHLkUek91$Q~n%1Mm>~bBquAmencnS6~lUCL|5xPy~Ws=TyR6h`ytahf_AQ
z0Zn}M8~s?X0%_H*`Sotit;`)y$af0^97C<eTe1BlGcgVv%w~>WVsN%4CRbWMCQ*Yr
zlT_-t&`sDL&*J07_qMT0;E#S-OIQL3fNqA<S5J(a866`*zav{w)`sl*sxpNZ&60YT
zeuZID7e3zwX!KvV{ip7Y$}pDGuVeWis}2FV%`y^?t!}sy;Z2;4a@%`uCb6Vx99uY7
z2$vzfnL$gAuoccI*wT%U^{8d61b%;w#cH(YGMxS1N>`;5f`qY4PQ2j^QG+h~4L5Wt
ze@|0YwHNv9OS!5$KiE_=`t5+)V$RiYa?Uf#Gbl-@uZm7?<()bZY)SR6J5M2rbD3x!
zFz>awDAZbq#4ma%@jOC_wO@DS<P<O~9C^!vQ|7Eh=Kf|yxG3rM1Bh3yC*3#Q16PVM
zx13nDoiu2InInxi#R0*5g_NUU>_8WI$jWk#`c23|UzTL<B^^Dw!YVNlP3?T!kQ+{N
z;iwSq@u!Y7GJp~q8aQw>{>hfj&W(eu&Oe~yi<U7`BqX*=QA)cMGfBgM3m(ZE2X%W+
znS^L9>84vL#kBUtuL~fDD#Z+Ls{S9!-U6)2_U#`Zq97rNfYMVzYJ!4v4MadhTDp`@
z>5v+T3L=e&<fNn|1qn%MkdD!vqr0~GyYP8@-{<>%>;FFvb>T7C?)%<#ou4>A=k}F$
z^fUtlZxpXkYnQBCR?Z1)g;!cfW#8jw=gMnsvTQZ?Q2woZdj(&rZq02HdrJk|P(K`1
zoMse#63lB3u_rBxYM-`aV~8wcAtRa<^VzyNc`|KqB;oPJH0r)tX{FnahT{+~RpGpg
zFjVk@Wc~91LoAyUY#}F|AzQ*S*(c?wuYKcg{98SRkesj#sQ7MpEYdL1=|z5ypgd@c
zFmriItD_`Em;&gZ#>s0#7#@d+)ls{qXyKcJu0NeFQzeD*=J|CbQig;K&}n|pS_wg#
zRUkMJ3(-k!A@d<jar-o4@eWNwE2>aoBQ7oPc!{3}w!Qkv;d6TQ8Ns6KL#Xr5K88<x
z=n@ic-Cy!wHPEyvKBM-#c{4cr-J%LhfNBbS1fu+0dE*BKm6Nj4Q;g&@Drzc(swT61
z-dwY`@F~^EW7j+z%bRbj#_pdJ?%+hmRJWw$6XdUqzCYkP{X9X74h7!jFILoNCh<&E
ziKE9$OG!OHUhy+jGiRVflbfwcc%I@VthSfm#%s9FWT$K@1R3Ykax@5~u{13hU9a&K
z;*<cRse`hsOGIu_YdFjKX41ybR+*$!DqyoSnyH(YDpXFT@RNoyWG|M&MB>+0if^`t
zL~$11y#W%b35%%tujk1A4CXg`q~9yn_hXwojlrLt){NRZ=crZ@sW5b_%Kw2|8JPhc
zKXFb=RDvXgbP1oPrKfM$AY=T6exQorIiBvaGTohpYuC(usOf^!pG2C6sP#S^tq<<)
z+3b8heOo!|=nDDjk)|s*yHefYo=5?;_KU)Ity<gx<YB9;M_L@9mCarg-8!n+(aeL}
zK_FN3Hwuhx?-+7F@|ial39f*l-@Zv+W$&B)5d5;McIJ7x%N;5ij`3&jL25DpMMLvA
zYPo}uKEv)=yn&cx1q01V;koFJ8+aNNF_(J7sI^b*8C=+|w42z!ApI0sR1ae5HejVk
z-(BspF?_xAG1Ar|K3m`9#t{Q;^kquOolZjMo&EWtUhjc%qwHQ^&np2dIbx4WT!_5$
z<ncJq`=zk$LbIrol;22GwcVU9zWWSm-6SfSNa5x#`lU}*#+5NelkeF3-RcVudKUF=
zrBWll_dk{l<~}-8=l$^adqg?D6p0CS63!npB-s4X^K&(ph@r}j#R;LVuXtrVC*ieo
z4Qt4|kEU}rti4B2T(yfv=&UKhC@rr$Y#kZ|>^7RtL#))-DxFKt0wn(1MerXBBcasR
zE=~?8jb{L649p+S^CDaa-L<@B*lNT&-8S&MA$Q<M7Pud7Qz!g3!*J`(<CxlYAZS^l
z9>W9fL@uiWe^oZRmd_hhr&L-zORqhZY`SmH>EutpZ6n^uaYUV;ttR2m<Ni!tNfIA5
zh4nVtBwtcBPX~Pp;X$>N(5_M*IrX{l3X6TjivDMt-0kl1uP3#8`O18gi>0WV7V}^`
zE@pa$sgPfgg>D@1))%Ah8L)+Xyjr3kTF1jI=I4kbsHpsbpcqt`k&>Z$LU-ZM&iCKk
z(n)|Wm58QV49Qs&^QhJ}Ae0@GfX{ta*&8I==z1~iyAyM;=iV!<06pd^cm{H>3_?qP
zSS*lTJc$I?5_JbkafTcaOq+N1bHZjnv<R}1)$MmW`Er1t8;m$ZEN;4SU}+7VI;-|=
zLbsJMub4qyFMS-}<we&w-h4K(>eKHk9BmIKJjrjQfDkQt_}&x#olYOcQ$VV;i4VZn
zIM{H(Zz{LoO+wpKKP0TTnG&#}vyAEryWX2c1`2kI>%gcIbLP;ZZC13<lHR7oJtBPj
z3$n)H3b+8>3iKj~>Xv)LIGX?ns`O9)zUTb&@xLIQCkN1NtUYMfzINQN7y8`IMNMsJ
z>ERh|Kj<Nf6Mqh$g0@$zEBuGcDQ}Zden-D0?6n>od8A2@0k9o?!3p{o<maIH+wjKr
z<BaswNONc~d|?cC0ShCjB&WQ=BgICe$%%l19suY4SBJuA@3Zq3;iK^T!%O`6@HO5?
z;UJ`pya{?hT?wE~CkQF)fbS^plb;gHgN(A&0;B{p1Lpp=@L8ri3Kwd<QGmI~zy}Y%
zmjn*-tBpU@9P!weYr$ygsZU$Q&7XN)JYj*jlQHd><>Yf;FI!!5aN8_*av}nmGKAX`
z$3rD1oqW&UB5w&Uy6o+Jc-VYJP89`-RPBx5i~iOUBpes_?%q|C@x;N-o2Yg7taRUX
zU-J`B4bGK4cA3%urKMQ<@Ios62TUxLbqY_WeHL*q3!T*rx=@0=kFeS}>B20l*Ma?M
zY8zCp{7lySQFe+;*(-Y~p|Ik1b{S$3;stM`oGZTd_@u7y!I9MST>Qj$N)SP@Sk^&v
zxQ~Io?fYUj=t>>VvLQO}^a5WDndhX19Ffa?*|1yVR(+{}aCuht)U_{w?iVCilTrDw
z2DwzKzO9*WpC59W=akQafr&8?k(puVk*Q)JQh%GvSIcFrWh+w|mElO;$weKx*141a
z<hEsBYf&@rnk4=J3Xx`|dBT`5J}L5|-f4#^Se)>9G1o&uPEY&7{%Aq`9M96xHPkS0
zel>1O6uSyHs+j6FD~Z}mq$4=fE2t-z7!nc|^e9$O=0_9r=qMRKEh8rn`QHWW!dN$R
z`Bmk0h=T9mf2r+9$P#b%bH$z_>hZLr|G?0Nh51;r21g2u*DEd6Hw2CMhjOU=ZK+$-
zI*}dJv0{D7tjBuJPsu)J-@ct+N?*S2a%#1apWfB_H01j?0wpRZkMlU{J;H`sf7Lq0
zsnDu-NZ#9AuaxFGOiJEZQ3w8%FyrJE-Qdp<QOm;iKN9l%7-)HCN6fvxh7g5$CTwt}
zDfzsuyz7k-QtvEblY!9bb^UL=l0pUETLpDUvf+`j+Mr9#nZCx2%d8yF84?%Hz4j&S
z=x}bUYsFV+LQqz*P4m$yC7pMtY%I3>+ONqUOi1c0cir#Rw>3W^hA3g$Ed-tSlWoDb
zlN(p7y|}o|MQ!t1RVb|tLZ%5Eq=e5;NB1}o%4Dk^m0H+y)01qUf?kFf+t8*dLJ#xK
zJeRh9mE?)@4x=k*u?%|Nw4bN`gzcGD#`g}DE;3!1L%hYYY`@MN-Y5F>tx!~9bo9o9
z$oEksR}`4iLe`I^nq_SQQ;V~M68A<J2Db-oEGPa?^pI<kGGQPal@$5l=z7t7$UekJ
zbgtAzKtv|*lPtwsR@II&vHe!Y3%UX3PT5q>A1b-#*J(XMRLeBIP02HLr~3E2Yy`*y
zZhwT{^Y`<ST-SZC8B9deo_1#Zc_KN=G4LMpUTro+<=k&+fB>KgU<0~}$0Hx?c6JL?
zgEdvjOHI_->6Wo4U;Qocsk%r*f7}^B*{2?njb19Yj`B&B0>o!e1QMx!qFJ)6^tp90
z?_Gx6tmlCc7fil-kd<OYa>x1Q(T{?GJ?cqIU;MHF+sZFU%jlOkl`cb_2XM$xH-`oW
zilFIG<`4&JDhQmoaR{T4X(iRuwlq!}&dHnzb?!kV!@dc5y2SF0EIet^YLs~NXfh!|
zbF0aoxXGSQ?h1B5%8zsK9f3Kg)CG_0sL<8q+XJqTo1tq%$G;$26!mcR0j!8thBt_t
zh<x6GtAJuJ4*saj8aIAa-}Ua*;=b+5y{>zmW;P;ZNnbclO(AU|MCuEUM~4_^edR_*
z*-fSG2b9|5@+8<e-<4@h=YR`5RKEvzJuQ-{i2MU$sYEjJsKBU$|6LxzIExS8UH-X?
zsMJm0u{gRVfBUtvj;FpOkR?l+2=Yus!%n`;U}SJ*%$dg>Hd%tbk5cthFcW#4bdW4J
z;Fc5L6_9B|^sd9fbe+>X9}Zo%;h0e$B3(^M=t`Jxyt8{6PM%tcb+1DW=|t6Gi^<aQ
z0*xAKXO6XQF86+C3Dy_@gG??;ys5ZFBsKc*V0o5f2;i|sFi1f0{=eBGo}HB;0FSv}
zE>XYkG5j<exL}mJWt~N0-^5yZ5r`Jchj!EK5n@0;L;;ui*Te>AT6sdD*6Y}d)2Oro
zErD(QMw9YTQ|XaFWyj?|nCudC`b8=AptS@Y+36ai2_bE0TiqdH^pO_7vprYIXVIWh
zLB@}+hfJxU|Ctx`KmQNrEm)s7_4d2QWSXyKh0X*SpBsv<z+yz_LMUV8XqW^1zdNWv
z@bRe^2Q*~QhTUX{d`&<8wANiz#lJ23gXy-a2{pP&e3Vbo3<3RMswpb=H8JhOr9<f}
z(k^I1`Z>5?rNQ`>?ita*!m8UDb{l4Q?8|7bGh8D)DpqiAhKPBi3`1w2ArhQDtZ$#&
z(`yzHF1_5_GzJm6Mpa~Z_$>a&N}Fu0*D}^wdnTb7I%m1JMyUPa1#gWRMf)GIs(MEO
z%29ptz?@KADOATsmY&Vbe4Qa=H#jeK)xA>ed!Fe}3(*ws_r`Mi76tf7>yykMH9}iu
zjT1M0I5+shUJS?yB)HY_A-QKwt}oPGk7ytjSR!e1fL`$>P&f$xc0?!i^Ma(0h)&Sc
z5qzHSiI-*NNgHT{*sfpTyyUf)gqk%m;#LpjhkC-p_m2{vzng=JmjAH6V8_jStwOHb
zdv0L~m6@IYx$6ERQQq@gWfj2>E#CfglDipW`qbe`K<oAG;AL;o+3!ihsV}$VZK!FQ
zdki3icuI2KuHE>-Ioiq55^gp4>*}ZBN}a6M^m-rj*XNQ)rNGeET(W&GH^Zek8_Nbh
z;3|Q9n6%<r)Olu{UwyGaW-Gbk62{29e5`y+CG6E9(^Pxa5YnFS!|v_Evj`!XOZw&V
zO%sgdp?tFacf60@W8;k<GJmpHwqDE~<WpEhP+6*t8Tj48H+|PK-GJFI5FA{))z43q
zXHLlOtJy4g$K+@rvo~HN_-O7ck87TQxRz4Xkb0Rr=h68zvR8=YSE%>Udx`_5A%%BH
z-w2L+*fM~YhXT`1NBHHv9yP}MH199FJ#HscR!l!wll7^~_g0iJ`&r2-MAyYT@5P%`
zl`95gc`-V1PtCZn#HK}Fb7Gh#LDb22<>2H*bKfC(&7enBhUQahSCY$+R^-q08RegZ
zj^kQjpn+*+zvkj~+O!4&MnJqLqM*TRVq6Z~d`sUV2zF}J$c5FBxN3dZp0~MPEl^p`
zp)^~&JLa$UH0M^v_HqUZf_Mz>1Yb7v;8a~8G%o6(>F^G@IB$|Ys_h)P%XGvXpPxVF
zeDrw!gM=QrAwFH!J~!t|TB~LD=Cf1rfk=xR%21`$Pgz3AfmY8zHtf}@{Z2$gHo6A+
z=Ru5ie)^v1)p{_N=o49AD-nijIka8&7(>M0wD=uPo+dw|_exS{#8idQNyaheamCup
zucga_dnofRl{Yl|UBZ}7%fU<bI4R)FJ)60z(_wDL71s{b?k=bQkr4YE7BB^Dk>eh9
zy#|@SAi?%Q%ph)H^i{D3Qnp`5y|wJCAaNaIQ@Ya^a-rs%`i|o`24tP`F-+td7T}iN
zD_T;&b)R35GvS99j-}^vX*nVv*n7JEGWMvpb^C-pwIW>T>t~=1$)a$TnY+}Ji{;{6
z3f7t_Qf!^-b!+7OlbQnuck?Q*=2=~5RQq}NJZ;2fFU*e|jcR7x{UM|M5%}H>U0OL8
zdyj>&?$XDY6a|whIM#X*V4pDZ6N56Km81CM?VVP=ZFM==)6JcHxc~xrkJxWT2z+@o
zwr!7j1tcB-J4%hU#12JLwg3j;RQQjQ_#X|+f1cx7QR+o&HjxoU+?iG)U$!aFzorC!
z<m&>gtI;B?qSHp%gzo!089_etFRdW^*p7-+AEhvTNdH_NF7RY-EPl}@Weag~iUg#3
z=Cy3z;TCYc&EIkdSi<Nyey$4O#2Xj?nyCv?x8N|1N)_kWiQ`=?z(|ix4W!xVbp*l<
zfo5X(HMzOukOx4d*74ssX$3kWr~1KwzLC!6wy#Weqt?Z<Q=_R#m}o-5Ewq6Eq}H<X
z$UU5S!Kn*qCK?<JK-3taq+@Anoxl;u4D)^f1QY*1f=Rw-HTi)bc%~vBNJzD~=oZ5l
z+8UY(hUNoFGuO^y7p2bHX8tpK;@|E+Ie5S|e<29+Fg*%n++3i-8&~Ty4?#%{a9dfG
zs1V9eFP_uOXdTyh2t^(ZnOB2P?S(w7{gj)0`Rx24_Zxpf_;V(iCF85cm)z+0a+dEO
zg^U7>_LZ#>xjhHPx<Fe|f(C4F;d9OKlVx~h{`2DGMQTBCmOcfnAV<_yf{jRQbgjQ6
z`&7@4i(Uq<taDimOTurzwm7270{%@LGQ~!nc;w<H;0L8IHd_GJg~cCY0rR&a<~pXO
z&j;Nfn92CeYICyuVgdNG<Q)Ed@OjzDK?(&?h70&CNGZeWOx?VgkgIJW5B#03(TaD8
zck?ewFucy^AEUaDcO`JC*Vp8Pcwcw5fs0;j&81Y8QPv7{?tlSS;$K*2XNBHRe>agx
z-tV>PC$STM8Zuo&MY>yph}5Z}e^tGzfZ-`Xdm?l#f-H9J5Ab)Izk42{5#6N_^TiJd
z@w(^biC;u<o(z40KnSHY`1a~7#E+;ZtT)$mZTkwQng>pj15XCpH3ueR1Yx%Z=Bt#w
zpYLA_)uwqSs>M{@y<~7L(2lv!<;9)n4oot;MB?}7UY{V*u#X_32bW7~`#pkj$D+p*
z^Z+%NdD~|>GKQGWV|EZySOn)x^`?LiKb`e^zGWvA>dp&yuEtF6CAhNGv1aCLmz1oj
zYwyh`&-U!_XE+}iEk)9x%9WoEkPVyO%WQ#F;vewRW!hR~ow4^$p41ymd>n{=1RAtG
zy0tjzmCK$##BT3xTmzx(*{m^(F$*#89xgdkj`wps((jrJq0)GjmCqJDA^3QhDG4-1
zFGd=_O-EFwu~y`E#8$lj%EL}HO#UoBQhwNOuwlHT=CK70gbb2*hv>*zZCkU9EH<qH
z3=r<P=MZ@vz2U{)im9Vz!H2%#6YajTI^-$)@$$rk#2~N0pbFmY#uEsUP}`iJGWCA=
zYZor&84JJ6@^bAV?Wfo1UjHcM68q#c$W_M7W_^cI&W&YVHoU~$i`ko%8s**B2Xnhu
zkGs+%am~YNV+W09by2_7l_B=1pk$r?8l+H7!y%5PXyai4-BIRtfC_3%t#^;(3L}B+
z#jjs%qq}MJd871RnRnBi&&Na8?MzYB+(hGq%R}w&>#p?N;}dX*F1eya+jiQ8*X+UQ
zK%nGNSy{Td(ceoq>sZw>(%W|fP)!_5|0B~wo%;-+mef|aCd#L8eA7MsaYFe~{SS*v
z9eN+=w8%zmFeirFp89Kk8cEDyPaJ&n))g!qRkAO662BI}{Z<XQ-o)4$D?G?ZObqnC
zA|A+~aRSq>XC`{$bR}4qGYI^{j>n#n24s)4Ghfr0`XNeX><4rYg<u}ZKe|YsIGarE
zpy|0j0**vl`d3DvQ;c|H&*;3)D0Q@oed#0Nv0l6rcMO7aD2eFFFaRx?e}NWe@T&AN
z3w&O(V!?}WsL}J%$>rpW#U<wyrD{+DzMBuAfr#BE*T_^^e`XC0#&aQf+McLjm-XAc
zv|^|JEin{b<Q2>CZt4*_sugalWc}@!ZStu2vdrUzq8vGp6GlM=$pKTThlv}0!<+}r
zrn?)2n6K{=eUzp4R`tosW~=4Y+hN%FDcp-j2jzi%czeZ3@W+}6*#W1nQlr+Xp(>qh
zYp)*o$od#_N6;K|PjcqoiI%uh8g&!LBc&aSY^6l2Tq$ikFD*aBydH2S<^zK9KL6}d
zfyLG}%sV%u{Z^3uCtG>9mU2(H2x&4fSHq4x$^sQaff+FJ#+PGIM%!{YSsKLZ2x5;l
zU!o${+xGM^`Dv9n$yKdbfqQTBSUt=bo=b;>OQT`s00)WqUo8TbHThH;c<?WX>aiBG
z_Yw6i^4GCOBnp@FR1tBTp1vtIS#_+%<zbfHuHxcBX!4@pPzQ|$(1_RM+>@D>IUN7&
zkh}X;b)r1hC|W{U>EI0)cn~SE%omw*2eG3-=JA3fUkwz)1M@sSkC@`h0jM}3;%7HX
z>=MGF#y|{Pj2A`acpVD%%s`_@^M8@^j8Zf=tLKylxLhwj_@<uThHIPmk+aVIvaIV{
z_{va{6nO4pTIR6iRGDv-wRxA#`vd0lYr8kZr1{J%*PYKm)&~Hxn5IdEFrqkUjFVC*
zeX&RkXvvqo$lu2Ph^$YpRJK~ABR-)V1Sh_Kl0XuFPhJMX4VuoWAQj*lm2-<{86$r`
zZ7n<-HhVSLl$@UQveljnYeAZDwL*i<SKs7DL6#O~2cP$ITT8q7ZnL9a#^<-%nB?)D
zA`@L(@;v$F9PO!p$_mfvTt0Z#Kki8vOP{FWppsnJn`|%RDiZ!CpyrfNyS~}P$w9mx
z(CyumBi&{kVKc<LeiI4HUITo+OHWcnjIO}I{u1)<IPhF`?o3(p*aWY_r8`X!{gq%^
zCQKYl#f8K|_uDNVv}1mFqXfLN^i7tzuNDYB;(PN%cozdCs*e)34i%4Hf0p*Kaw<Zr
zjzycf(yCL{2Nxf|I;X>vNG)d1wz%x8G{o02L9brkzpvo_t-8!E>H$^?_kiN%#cA*d
zWwrHv)-Yqb`ab(}mgL?0_8;_kk9Xe4PhC}_E|zEZ8xdY26+dlZy3&JV^U!d;#PwyN
zHfjoY>m>5dYx)N2r|FKMJDBMHPq(F;m1Z=v*Z6#yd$TW^q@vaPY+T2W^%_nln%{|5
zaYo6po)4O+6Aw3O!<=a4j7;iH*0Gkv-3mEWPjpO#N_R^eie~9_XHJce7|Jb-k3H&X
zk0Z3nz8(@rc2OK=@*{qCMT>)U6X&<~*zfu+dC2qqH8|;Zd@ywd^!7Ii_iL}04x<K{
zQe^m9bSMl3G-YWu)g$Dxz)ZMnVvf%8@sA!!T3OPi$IE6?54_-%(4j(HNlyJ<OJ~(<
zLw8#@^yAdc>#k3QO~vN+3wXh68j@6$?YLtdq&P|Bq6d{#aX!{Y&elpR_4{Ib+bR=v
zv6^4?I*{B?*oRkN^0ZXDFmd&hCFHi}z+IM{PQ4IF-Nwv{58285J~p>v#=rH4$kS7c
zJNPtvF{M^A@;W-2heql6YIci-@5Uo%$&wbvTe4&&bQ~Fwn|SrB<K)UShhM~rr)8W>
zZ1L_uPQ#F>y#j8>`DnS`XF0n~3Kc!73c;L89Ynf@Oy#En*%T(P5feyI*%SnKrN;Nr
zRTlMm)btPrugDoimSe(?5AvUXS182|Y;8HX%NGj4*U75kAk5;L#;v@zH$%i|7hdJS
zd?^<HDsuY|6`p9m8^0h_SQG}7p;A<76(xdVtBnuO7q)e2Q^NznLRPezIW)7&cX<5@
zz#o{}NdBKs?nR}RgmnSe>8CLSiXW#Tu2l$>4SK}MVr}~utw+NXwxFbhxYZCEyNvj=
z_}{_r_t)2OOC|)>AdpP<Q76Q+=;YQuBVyu|JOCHC5l7^>SDaXj)%@Jgtu)g`5U<3g
z6S}vyXTS!?+W#MbP1>o@%GC3txJxYwU)QdF)n6Y&-n%YSCOn6I?%e&@y|wIANtvql
za-JH8>LjBGU!;aV`=n{;n>`^jA@Lw_wDO1-P7W)LtB*n~59cC}4gm>o0VJVs(36`Y
zE2Duw_l&;3)LdomUQP{O6q}Q4nA)KMpy;gU;rrv@Sq$K~Zg?TUfRmRt#d*()UK_Lw
zVhNZ9zFOu;-joF0_+PvCzKo)_z;^g{zu+$+CiN!Cq|7e}eP!t$G5OD;9f{8s?GxK)
zG72F6QMYjBg;r%*XpF7yJ+OXsi8l7d@mr`7Fl(rWKejj-(y;Of{L>VoY3JPG=Gt<m
z1gWu~p@;wJZ&4<q^*(UY73@-vYXM&D&x5hW68})eCa`vD#0~5Bsm4F<5hXDo3;^!~
zw1idyd+=bz%(Z6-&VZedZOqGZNBv>5Q9aqSl)oU9?~qw%jVO*dPSE*cbaZVmzqS#+
zLsM}Q4!Tut%p#A0Hsg<Y6t~Zfls*Rxhl)SWD6yJX*l75o^)E=7GB(dh9Mw}>Y@|#L
zut_FvC_fRporZM*yJUUr{=n|kC_e7d;`cppxcfX-yJ0;*h9d)Wo2Cvne?ii>QOTMb
zwQuieT1g){?tvqqX`b>AsSoeJxld>>BV)OK>kIeN?bdXp_mk4<u80h<dDKm8g=1c&
zgDalxI8S;OaZJ*N1ELP6GRb%D0vdHcbo=BSE$*q>Q5v(BcUVq2Ca03}AS7NNSU98F
zbw_ipoTKnyB_Uyf4*6=8ofbGLEhsp@J+GZyV-$Z{Z=8XwxV<}TvHeX(2P?lIrMca{
z;Ie7c2T8nBU>~2$4?NI018v}V4s$DG=`UIM_IcV5`?4uJE*>LCuNIE4kA>fXG=U^v
ztfq6zWQ%R`h|Oz5WlR^%N^oraF9>r7IPtThFaPEo$#Q3~WpP>K`j=nHF!d&<eB6in
zF>mMZl-Gh<3IMZjh*N$y*D2|T%xz8I2aSJ2kKsj;aI)*c^$XtY=3qKt-61HB=6B*g
zzaVq^sm#XT_fVp3X1$uez5Wt<LJn>7p_7L!gVE#jz|gxISHe&8Jwyh>{cqi5bC+Qs
zx0AX|%f2xNendpzWGmxm_*(=$$8!=fvpoJQExY-i8@=L>sYM5BO+Ib8oa<LeKG64P
zRmNO!#yacAU>gh#6&>aXWVu3?@C(7fbIMEb`@wy;@vl>mA4)ErkT;iGFMfz;8s95X
z+$7Y-=02h1`Jsn7+6VJsF`Nkc$vFEfoey_r=@S@%P_ti~Wb2_uUDy-9s3H~33&6Va
z0<yW>D|>QrQD?sSn5L+uS}@(#DWg;1^s;e?dd{~L2d+GWwi`jC<+R5|P3G2n18pd7
z_x2mI7bv5{H#H5YSK(j5Wo?I1&KtM(Y${92usR~44=A?kzM)KGrb1-a?b3QZ^1;oe
zTU2IBiMazRVQc${mo+2-^@dbFTH2STvnQIC#uYi=3l!R2THvw&9&+_Lp%}wDK^1)V
zu#vui&c;dle1Z#1UR(D;+&O*I7o8DA#v<n=R2)%`5^qlxJUY`JR<S+1Nx}IAg@Iib
zBnT5*;&c+E@N@i1cs^iv!bK}S_&{ZZad@<y=vlUH*)BlR70P%2+jSw&4u1c8Rj8?`
z@!LXaxSF`+F9?H{;<NNo9o{O{X!i3jLY!V;#mjR;=<mg7H!kvF$u_{%>lu39MA*X6
zc})bR@Yzb>0N*K`_xaA<dB?FH*E~9yWj%AU21ChzLI)0xfqwxD!8|g4kALeQx6c^^
zZv;RPFa`Nu`%;~AqmoU$c#-8Yhin+({8gDPjii(-MrETJEfdRrSWz52#zrY*si<4;
zno@Y<{+dI)(mO;>&FyJ(sUg`J!nxITgQ0iR38IoL1N7_a7NU-?n1(lT9{EKSCX!h>
zSt5|T7o0~??_97#RIh6W9kIjR?Gkx7+WhjKOnF0#I57in>4ndED>w^jIu^$q*%S&%
z4Gn-b{eVDHrJ8AF76Akj@?#5%E{V)fIM@1B3C;o6+n*3$fgmF`E7X04911x(jZY+p
z!t{o6kLfE>!KIAK-p_E|wj)gX7FptN!MpiFtP2ZMb8?SF->3MTNB!)#0wiw?4#b%(
zWL%w4huGoP0oLPRkQBP@FIvS%lsK6V_{ltCkJ&)m=<NxEM|Tn0v6c!x|11z!9Sfj_
z_1tQ~5#Sh^&%^iEYELM&Zs?cR2>2uuVkepW!Ln$fawcet$4oSZ%-YDOzfr|JbUXqk
zScB%kxdWA(LpLWy6)!Js8=>Kx)9ksg<)zJ^8Ie4yEI}P7?>@`YMPDZRk}03I5+hEY
z!YDVV!JkB;Jai4q3o&axpW6`Lg0X47y|Hoo^OaFW7GCmM>EQJ}W$0aws|8nQ>h3k(
z_02dFVajKj`K{8L@;+#OI$jpVnTZ?Kxqn-f>z~)l`nr>HYy?=K8+>Zg%yPVZP8{``
zG}p1PiQ9M9|Hcu1zUr+fVQJf0t_C+-G=ehLh?i){dt;X^lj(SeNL`$*-%oM5B7Sb6
zVI?RrB3D~F11?-YP20{`ApTep78V}QaXltAj!yX6%P)6j9J{W(iIOXoqfn}>7IYE;
zT-0yg?ccv49K}rxZN*Qtls5`nGgT$S+(7!`!?kX+>*4-EQ!Ey%sAH6%vyFJJUHRKN
z;p@*C7(AKwmj^~n<W<tM@&j`UTlu-!=W<`Z+7Ani?=>*bm}yON*N&vbJEV!C-(J@r
zoJc<iFJ5E~Nse3g4NO@D-Sr~B1sZ_zA2$B;&A^6y&tbqd_R2z&jy3x>g=K7C>^+4Y
zY_jnuf{F0TF%2aT1_8-SNY>OGN(b-OzEB<2_(XTPzF!ci_vIRv-qdZwS3^4;R<@=|
zkw+EZ@Eu%j*F|OLa6RHmRM2=B8aje%j-@*Y6bQ`vDAAkVL^oFclu27yh1h-MHGSY=
ztk}+^%yvut!Q|y_C%Fv0DiMuwlG`MKoFNigl56rN5j4BaTRi>Z{Ij29w3CiTt-oAl
zr5A7YCdoVQ<&Ja274x&QaUI5<Rvj`H4ZF37``R?EKfhH{9_ICe)G4LCaNV%p#FctI
zUF$AG%gr~8yy9V^VKJYXGI<w#$YYvS=VN(CK5(#ivf6x_yINowyP0YI;gH?2)X)A<
zS+~2BDp*%E89A50H^67PF{`2vX?Gqg*y&y|d=|eCy{I3m+;9m$s+(q1jxDnP1ln9R
zrW&wT)-OqRUjXl5U7l_ztg0hBaMlK1W*Mu>xe>v=_v5)}Y$CaH|8~J`;AqOe>G$aF
zQ*tHPh)wIhm!nP2L|vB2gP4~b-6Y8(r^XdLJfm{Y3A`H7c%*o07sXzR_C9eDCjCZC
zFMMB}Wl0<q6ma66CTFH`gTcl$Dl|LokjEo?fgjoo79IAWn%UpgZyGmL9O#8kJ5_nn
z4R5`AWz+^W4~Iu)d8^YX8VoaRYS?Ge;9~5xBVy8fBMmgtsJ2o#9o*nxoL)?Rk;#rX
zM@gY@P}!n0*79xD)g^il5}hupE01j<j7Rw*-$S&hZ<})%3e=k#XEF_vE`0fBVPYA|
zn9e>&n)NB%`^kW+0fE2FE!t0Hs0KA3WP^G)UH;xKG;+Yd*(SKt%~Sibhk&`;%v{9Y
ze(SmNN~dN0gZo3uLBAk#?Z3&|Jl&>kSfPRo;Q~vPcr(0l$Z5D4K@@P7)A@g8rsAzZ
ziw`m3CxO@i79cScX~DNQfj$AqT3h(u1J`9}aX6+EegK?TrMZ6pT9l)sN-wP9EHYH}
z@UKmP=%J+n&=a0)l{fRT0qylxIFy9ca}QTKWL{weY)`HCmBHHiF+a8RO*6G1G=6BS
z027#pm^L~g`r<uw7;x7$AhM6OWks`$ntwB8k`LgNKSj8WNmFqwid8*CHYaVx50PhL
zo-oeoZR@5;3rs$7%}4)Pg}YiF1>o)<{_fM(bbWd#l2#11-AGWA{v$`^U+-TCh2!As
zwW~QGM$h1zO+e_VFm=z&`<LV?`5PtvNm9;WdP2^<tI@wnjc--A0Ll=CuSVjGi|*-3
zP`VnZ23#hQl{^$CJW*FxmA7OIM$B^}#&ze#9^(~<777wU2*(I2H>nY=+P@&>rL9M?
zII%N<B;c4%9sLC4zkm*tgx{Kx56S7Ry=^0GC1TzB7+u|P@MOUJT@&3<d@eN7(Y%bT
zk+D9_A%{??`IhbWu&+3coOQ2ok@cRb6C4TzkG$2XgNCybwm`h#{?RW808jRyO$dM|
zWyTllGWN3ygYhaj2A|77q>4OCJNzGohO<2iHH_SY{RJg8eX7?>1n%0$;a$v;6uv&!
z1A0oVM}9%N?J<D7d~F>sLMd~?8F)~N#O%Wl+W^@Zc<MBUd(nAJzMbj9(2Dlv2Z!vV
zL?}S2@kO&h3m^g|xxU=4wZ#u9yIEy=>Cc@GwsEtOpX}a9!|;;IX~uRoY@@?t8Jk?-
zP`-zlo0aE>qQx5zU%I?+ho~^~#EcR$W1n@&FN<gf-x;ac6V3>FWt}CME2ImHi`M$?
z)?WFkMMf3t{1`U~RFLGUBk((4n{|a^Qw90cLb)AR0gAa#-9A{cPm(=rxe)6ls9Hk4
zqQS|s@pFmWoJv*8B@d=DxIuS`^~c7EtJ*qa2^Z`_EA0&_p*Duo;P(YZTw~6IzaXId
zg`F-O`*I$9X$pH!)e&uy{k3b?pt#WZ^dtPVqXfyLP}@UKf($z|cYCg?-SLt3cXaEM
z7r_YR5^Ldo=4@){x*|AB_<*=8)JL2MSZ|DxSd7n1QM(RrSAt$4r9Ztw_|;qIvidR|
zJ_#qj9G>^f^*=#&ReFPfUz3LzIR4F<baM+~v^xc|mAw7iu3;#@C3EwaP1Uf>#*_sa
zaiVi+xgwUA5YK5$X$j=!G)-M3Sd8PH*q6KTFyTj9cj70vb!bZ&arP_PR87wYot2>X
z$}*{COZK+kd7ngC2^jFdxT^Cq+x$9&SAH25y7iNF*C<T>p>cZq$c7Js_mXSu)b@fS
zIH6<5nsEPT!j*|{S}u~C0L-e~Re@e*33uiS%X^Qpb6m8RhX`v&n0iun?=(5LfB#4}
zKbw#KN+0@YQM0@AMza^0pYIbaF?os2RY$+tReXlM>rMzM{mzM`ey^|j+svWx2IKP#
zh1vwd_+bc1o9=Cc*l<&NyPIuYI@s^TbK4r~&UCPe^3gg}rabGz{_`zKjZ8~rD+U*w
zu5sV0_#ks0Cj68<g+GBfzx{_^16SjAy*+&gUkC-W%<Z3z(-1;6W$RP627ysT!_*tM
z9V0zC<8N*@j^07-I!nWXp-qKdojYL;zA8d>1&KB1m#4;{lzg?k<RX(DuJg4L6A6T^
z6H-DEEp^@H%{Dy<Yaa`oq$i8|FNp7shZ~~qrX9dQ`3(@P+#__#X}L(CIr$-#MbK)o
z7))zmlRs2xPGw+&X>n)funo3vg7L%mBLu<|wNfxF@;kbl=i9_E_*VXFqF!#iZ<4d`
zPp*i|=>)g@#*%T>;g8n%I+@0lZ}iZz;WL@I%_WjebtjiP21F*J*%OD7K1~>0F(a6~
z>+m?(9r`IhTB$eB_C4cE9VfCwNQ7KwhE=a#GZ;LP%W)|+Nk%oPxmQ63&+$xeApHv^
zK>h(1W<yk;p7mQa-2$B$d0a5rnn4y4D}1VMUP0m-;5{O<DetYiW?}sxcKsmR@lfPC
z;E~0=G$YbD)|`i$)YG=by%+?d(~PY1-aVxGBm`as6bI`K7yAn%qpzc|HG_ATp5F}^
zV+6HRd*%BFq32R_t}jFCsQvRiiW`*MA52*zPm7T6q0VQpp%=ggxi~S6Kd?cHjzu*`
zHYYOcM@|TY@R>gD>+A$vnTtX3AiIU0Sqy(;0)87s^5rO8WsvrRymzj1q6`$DX(=0H
zLzn82A0dzy>zad;Z7!M>m(#ew8r$KwA1pzI^@?xKNUgZV#^&bf@apLw#BlRf6HP`F
zO}c1k6HTUZG}VR1v&UyQUQmC;ygtCFzh#I5#scFlLCm`kKq&_*ghv0HBV<a;yHlo2
z+HElq_9sP-^}2(5HQ2gXIrVmG=dLsmq&oog;CJHh(3`UunMO>^ET0kV)Nw=qg=fEd
zdz1Tirp}o>!AMI6$486je(S+_b_A7rl#%s65XNX>0Hm<|4Jn*a4eI$|Ds1&@Y<>!1
zl9`AiljCnhk;AC<uxQYP$md+E+=OpPt+XM`!rjs0?uR~$H&U2~4mRI<#k^OGxeOT_
zQsQp}?8AUC;Mzh#YjqEx360d_<?lE%9~(f^&bMXMjv9ld*H+RIOTMD-(%VKF%FtT{
z@Pro4_0!-(*rod@l~)QDV$Q61?ZExz3JsOcSrHKVB6BCNPdbEfxnob<O8FA4&ABY|
zQjVHOfB}k|rA^}>u}QvA`AsYKar8P5DVPfyLH@i2C_qp?H7VF1ymGUGjYxX-H>xPE
z7IZulBmQrBA~o2RgwN_`K%&UYd&;T);_kx0nth46$cy8=H>vC~Gu*JYt70`*G(pX`
zm*i8IAVs}IONJ*SuZKzU)nKzTSp)dM+O!CXY(Q_$o|g0%%S%kR`UjJEcI6TyH^hCD
z5Sij<sa<&-YHktWn;i0+fCC)SC314~p)OgOS<cGlH*}vWr)dN|qeh_=r>qq1{1q5_
z>Kz?*L6`)+{EN?$vF`HE%SK%?Xe9behuQJn4Dj$C&aZb}Jn#M5NY(deWqI|M_)x;F
z)+ir|m6r{L0aU!81`lDVO&E_1a}Ypj(q?+vn|tcG3?ybLSV6f_FSd3LeKML7$~q}u
z1d$+!(2%|Jh`GV=ZRW>z(3VPUv|dK>t@&^&)pg<`;VGtbTLjI9qAs)99%@T#mDsc^
zrv_E2RQnTk-QOG##O(?5+1c~PD~7xQ6TX4jeX8<?Z)eVUOj%3XVGRHGol<$bZh1<0
z>@l@^%K_4SsN=$qhZTfnhR8_jxS4m6b_K)j+7K2<bdN>&s)0oly#sSeIZ2yw#Zs6s
z?tNtf+!L8nXI}LS(lYdtO9>VOA?hcLj_PPe+^mgpk7>n7zx^qo=6_mhq2}BZaS>2{
zie?6eq*ctNPfR_YKd$HVIQ>Eo2Ud`wyx_X6u}H_;CN!qw2z<b<<_A#Mg{NkGd64=c
z*!(q?K#Huu_9xMWZ`&I@SR3_b)kyx5#HZOt;Jb*@*8I{taevvNeLCO>r8q}ZrmNSH
ztkFJ)27!ADGp6vj_oDMb8HtktrQT{H;-?mufd&`_5Znu1EA$KUF;!eKZD7GsKP(p-
zlhswxrRToXy`NuGktB0f(aR(xSLB>{A*W8aj%8RZpPH&3DFC16-Bb~+At0;bgf?H`
zJ5BAp9DD<cB}FmDJMkeUzrZOG9c37j6U|8*lE!?}2v*;xM9jl;m`e{1c#uDg0dN1d
z>r4jt-~RgGow5Vpd_PDVtv%H(Cl5#NXu3|F0$DVb8CX>gz)_3K#7!W8m1C+!ezyE5
zuRy#io0A}zx3$i%gBV68`sO^v@Jm<@Vq<$BG&=X^;^xSWc7*_-2YlDaR%KCj%*&)y
zG0HGJ7L#MJoLm3c$~;NvK1}-s8Oe16aNyp!{?OseZj2H+*2#VmcCPZy`IhhMF}sJ%
z%uqGXp&5Cv<?PvlV{!uoFk9j2Xk^a1YoVS8-(}|H6~FI?&~5J|cT}D=`Kl2A+%nz5
zBx0Ko^Lh!4w*%|!&96C=IqR$$PWtn2iE)r=-<LU>cbs!XK{p)7+421!d3sn?KH2w=
z6Q(jQ!kUnPb**!(5<t<^w0PPHXn|+Ch716obpGAX5f|ULH3LM0zaR4r&3aw+)=qGx
zw#6RRw`8(bz%R=}70oBYxdKcWy%4&qRp8)40qjJ<(KgXTpnAUs#{gmGK2_#`!?M$R
z5VZVTyrEu06nA6ZGXhP-31}iVEie?QJ6C4k&ED!$;AHO1d>9G4dtvNnXkksJby3|K
z(YoGD?K?_R<*jsuvw~C#oYTK5(yHgx;RnDK78Q_r#%u%Q7{A8?4RW^i?$nPUfC&7{
z{|`j)2QA<&8$san`Ihj5ZNU8RX!ROV)iBCzpR=P}7l|IxTiN7@WPT<3s9<59fQ{G@
zN_YvC$$)t~gS7^v&1e<f=WzJQ=BJ5;jv}My3!ENLrDlRw47hW*)tgU}DjS?<>C1cd
zJOtW5tS3@*$WldiKc36{l;6(3@+0BZ;J#4q3|c8Co6rVPFJ6nIUHyUFyNrTw?ipdM
zE1^f~66XNIAjc``Beq?4KBUYRTt;g;=~{~%<hk3h3O0z(M=?Kr$(ues?S~+4&fJez
zur@v^wWyX}6Sb_N9Mfw$Z&81XStZ!i%ZkR2r-SEKcm+#*G>%IiY{K-QPKSXw+>@ol
z%b;Ck?Ucydd8_+}JFnC;pR|!Gbis{&F85sj#OIbzUdoA4Mj|~kbG==+48mg$bT&)5
zjwcTEjB5;eLXI;;mcDs1%!Od0Wyl%DQ==~Uz1gutK1SD;D7~ew{1%;x*1ETe7qt*|
zfh3^Sj9b1-sKvRP;aIMz;4O5k5K&w^tARxxKm~DzViTtah~o0*Zr{?S5={*reok&3
z@k`k=R{h?+x&Tk=FG>D=O7T`CDB#=5x(J{Z?g`|D3=zJ}+;!noEZ;FT?E)U8tBCE*
zzOvlj&)5NveXSa-oW?qZH2T9#r75zN5(|?kaRJLDr6v3fspsCaESn8KIt|2jqiyKE
zd4mEM>hRZfeAS;s_W-%QkyH-g`~VcKj_s9?@6!#b0jeY{{A6*eJ;%esuHen*j~myI
zqwX>_F!*Xb-!t!WAY>K5X~-v~Y$+{or8iP-4}T+HR(z)JmAt5z8ZDGFvK3-`vR`2s
zL>u031sy6{^{O}8p@Z&s)@C@%SckpE+)ik5qRf_JBDl&`hXrSgcriD1yBqU{8B|^{
z%xJ~9s(6#~jEthrPfwS%@-~C2(?o>s{AwmjpEVIJbv(?D*~P*>W|{MsNrYfOxOhZA
z9CH1<Gy1~fs?Epd<v}XZXO%PW^5stP3+!2rzULaOLMci|?ij(%E2Fw@onL=AYa9$=
znG?G0*u2OVf~xT*2<y0ibU!|$u`A-y;Wd;}gG0y-_J<G)dSgO{#HC@acGSHNSI66j
zyls3tMK4$)-`xX40HWJi4)b$r*4ZDdH%UC^7vcuohtUg0a2_+`|G9Wm7o=H!wWc?7
zUKq2u@VzX5Y5}<vY#xwNlj1}hd$qN}3-p<-g(DV@wcLWUQdIAQ0+;|oohRZx_)#Ob
zBXvA@bP{Iy%0ag1(^^_V#lFNo7Z-J}Nz|;Wg3MJC5S&EwiTkf!2t3EXdLi%}&w3%$
zjQ!5W4wR?*QBrB<N2VB|L&SoDn<lkp<c@IE<Cc>YMMaIV@D=qfr@007HBlV@7xs40
z(^llNVmUF=U?p-1m;L73tDta9sqeLd0>qE+K5X?vSN(N21)aitpS@mP!SVO`Wql&$
z%&NopyYSRT0#?|+3kvqQW?${@cJc~vT34Q=C>qKo-Bz@fUdYS@wxaD++2F{W9QHaO
z4rme-&33|-$0G$tGa2kcwj}bvG)wX?9>E}8%v|RdkEC-@+O)}31;&Qy?-D-`{nbc&
z`)W$gxoCxjI>f?zZ;q2g{%{2urwU=wuYIqWFIeVY`u))(@Ba}6{?-Qm<EHoF`E)=@
z>)Uye`-4?nzvNG`f4#tPOBodV$UnvY#0f)r-VE9iK^cyD0)#&luqQ1m>WA6n9VPrj
zFu0{3b0!#&oCyZ;_hhK!20#WjnAKx>))NSxpn{l(^vXbfKS?<<sjs8-Rrm4sqs$xc
z=XUp*28Wj?#ghdo&_zTh@SQ%MH-_RO(7tj{&KWh8k&l`UYWdZBUSY90I_QYF+ZOVY
z&C?P)O9O77(UpoHaxW_kQ@5TL05adEi7WHNsM&`}xiA@F(#-Q(W~m+<9@NHzH+Op+
z7c<F^!UFg5vy7Q<S*5k)eRz_7rX!f}*Pffui)Q@*l;L-{7vJ#1ml2QV7Q-HzSuTPf
zBV^|IQX;jwOmXn`zR;@=>gj3a40lfgTF-uUST@txm`lVQ-pSn)icZRgX5ISN41F1b
zZ3afWVsd=u-x+P{P@44%{idgnP1rh~GyGNcGyiMVe~U=k#f#68Y8BS+PJ4FfSnL1o
zc>VJr7Vn4N6x}jaEE-232p8*w2=|soOWD&0+Y*`iJD9szLT8<#(wM_?8qTZ3z76e_
z)CRRyT)UWQ&a>-Y{|h3%8f?biq)q+QL5k-3kdvlGs9`_`%;icjd-~I}FDvy5^y}dK
zK`m9u@Y85hcSl9i2FRuqy%59RailU6Qg_$0cWWa98$NsKuK;iZnZE<T#}XMVXu2*v
zxz)ka$=*FO5CY~&f*C#+8b{$l%%m#Wg&*Ut5z8)xlN`Pkj%AAwD0m!lM0bxlH;vj=
zn3U|IMCsn)`hEE9%l>Z1>=sbJWfa7&+NzbxndI^WYfMxoH<-XjzvOKQtnZp=jU~=8
z3w1tLG(M6a!HAk0#08P^DtVAfLSt-DrUtWdJJI2{;~5lLt=K<5JTm2Z6a^uYCB-`^
zP&taiKYGDplyHTc#uK^&>wxuD$yX`|YT89L%HZ>`4Xc^=3~@2pXfp{0cJ{;_nzTh4
z(X3)X{o7LeXrj~1BS$bnvP!#Io88u;@Tv0hB^gEICOP@cMF$+Hslq|smTz$!yuzc+
zL>oeD5uMbYA~y%}uk&A)Q|y&!RkCtercu!iKe5Zt3z=T5?7k|n&Uv-@9w!pxf?^9s
zV?ecf-3D>8Tzf*4qsPlqD#vDE6r}(8-Ie^iYdO9jyZ7=nE5XckiOA;^3XH3Dv^dK9
zBMCB=UAh&yo5wVPSeNi)Vl*8Gm06ktq0{FIMa4$l)rTXa`5}&L7vx_fUNdr0Coq*-
z&%fEdY?6ED$Q+5yvjA5_?RGzox`3BC&izhrd<r(#?Dun^v?E5YyG`wGlVcCq%bl64
z2DLK-Qbrv=8WXOZ*>OgHKCdD9<`hDa@;boe<wZ5}*^Bwi{AzsJl~*gKC=e}Z1d0dK
z>B8T2^bQAC$5n(c+6b>b6AuCWVDbMN3wLI&m+-^BM=V+agNG3|&roWc{H)=c5;3d<
zxO~}Cu=B5h3jCfj7Hl=^);r`u2+(kyfcxQYbi$we8Brhp6HvgF>idWUVKjSQ?L`kQ
zz3s5#O072~$M&0Xbjn=BSx*eV{A}b53t$O*$oP=@=L=xL1MBSz+#aGW*Pb7pjE_wa
z(;o`wu5it?GW6(<(C_BtErJM4MW1Jw=UGo=nCk^A=EzqC`I~lfM%5qg!aXAH7ezUa
zgsnNRdE|yf$vVBWJ&xt?Kce~t`K%9CO&-kZG7LG=@naqTot?UFn6ZRr)WamH!*e{y
zpBnT=ev0X0Q7iG&NpTlpV)Vl6t*rU?v>1g(<-aa5J_Qk0qldWf@Lhhj@5+oA_%=MS
zlq7rq5~qpfuCPLo<851BC8vt9y6(;ZkicUV*Jdpe{J1xsNGM4f2j4)f<|6KCpuH9^
zc{#L8sWV@elkSw#W<2BM2>!W2|NDLFQEfy^Xc^YoXdd=1za7+Ip8&T23|seeSX#lr
z+{b+y5u$u?>8T*P%Kd>eQ=YX}wok49+{qxrVD)wIp8NVi?AC6|b8-{)X3!%|j&;U;
zuHXW_C((cPo){qi(V>1V57EkNf9B-k=yqeb4bwey`}{VeRFg~-Vq!W8ag*@9<VU-s
zdw2YxJ6e3uQxD+jc>&XfH-_i%7GQ)u?-gTnU8Z1-bXT(%m(~Re>=x`!Yt%O;5_gfJ
zG%fUAVD$mnPd4!57{oeo|5&2BT|aZ_mV|7D?HPj)@634Pe-T^o{(t-*q5HJ*@p(Xz
z8+3yK-hEooY4T&lUzQoy{R#QWi#tWcgEXaH4<h7p^geVE!CK0hPX<W`^FS+mWAj;9
z*>2urTdSjVXz6_i2X$JE&DF9htzQuC+Aa8sKF;zAWBgbk_7S2IM$TVGe)91bWP<9R
zHB3`pC%)r_Aw}5}2;swenghb);J!|Cn+6<*g7P6?wR&vmzB3K!mmoX#h0v(2gyPkq
z872JZgyVK>Cz`S_tsmny2XS*?AM8<dYH@Mx^!idem-P*OSsq!<G;Z>l2&9QF78z)T
zBjy(SvCTN+3hQjl19d|*uQ&L1GI4;9OSr?|iBg<pF)zFzd%v7**a@DMZ~oPsx`r8@
zaBPPWJ{5%N>X{3>c=Tj`^u@NSY(^tzV-lc#bt^liKGJi@V}W<}rvz40Csh19`!2@r
z!8;<m*EXeG7Jv+P7L@QOpFpR7ZK1YO`+D;%5z7*UTwlX_1H=D0FDa_ywhVU$t<QvH
zH&E@H^qGJDM0ZCC^5s2Mu<@7)dPZ?Sj8I}}G9x3ka_z<8m8c|H_TLS&ph%>oGL8j~
z^ncy}FGcWRp9^eVH87Gw`+GYEkPXlu-wmKYz#t4$u=YGc2JDi@C>MeQ(?^wYkGMR?
zrNmx6sILTuRla0Tb`!ocq#WZp_gB&QL*S~6;S!cx6}!EIn1at4&=9}#f2|_nM_e}~
zrf!n?A&m9(@f`fNg`ZESE2qlm0_Ls{H%r|+$m^yccz$<b_*&bV$fvZ%_N7YjH}_fq
zFP!8kQX6Ey&)dOLqfeNwy2Z0Oj^hv4>89*s9Vp(fmbF3SZqyFc%bV@Y07_GJiySpn
zv|^cWamEAR4f%H-_)qzKz5H);{_i-VTW36as{c61Bu%Y9yZi1!V}Zez*6#}O=NTP5
z@4A{y44QP^P`C;tmbminX{~fDWtF%RY}Nu32!8Wl7WE3wRS8z;5wZcW!(bH$?66M$
zqbYic?hBZUo+M{;-pyTq-$1||84zp@GVwxs&H*5HPx8M!eLg~wt19&&i$^*mEloBw
zD8E}~dwiR>C0A}qZc@9B6ix=pJZ3)g9Lo0s=KO_wtGSB$hoEBlIxx$tqZH*ITIZ^N
z5;icQC0{gXJmPh(Mq)LL*7r@7=H#rN)d#&7Ov2Y9+8t!vMA*VI{ch`~`+Ab%aXQSQ
zK}lLU7Zg$wFXlO7_DDH7pmtGEZ;QXPg4fFa;A8Dlg2UViw6B6FHHwx_I5I8LgLCe@
zFZH^odA3FN50>I27RDA?sOo^4wTMAjYI*gyF!c}u=0*JB{mn<(9v#|u)8Ym`AH#BS
z7H?GzYD%Z&RZ8L?*I4gUJd}L4Cr&;WJjZ=KepH>YQBCGLIzJscRFSEqGQrfuAR~g_
zGIaq5Y=Hj19IL+%q5ftt-`q`XG4-wY#*&2go4(MF6$3KMPS$)2&G>94P0#|ImaknJ
zvl{V9nwgSGTx5=Eq{%|lPJ5f}8j(;T;GC|U?GHYx+pJ(T@qzoP-F&jyU}tDZUkzk@
zZR>*&1DX7a5ezlJB>W2!ZTSr-gXT%#G=q#x6u1%$15@HeySRWK605ARg*dx<w&2)H
zx#mUQ*AcTxU@!Ft*OHwcZT?5ND-@>TwX<&mwwOnpL8Pc0kF@Y}ZQ*Bb$lUgUt50)?
zj2$4GhAFdsaxW|Q0am`BZlmD7{K7|V2r*CY0|Y(b2Ix`L`|=BNxvS7JHh((8n4=}v
zJ8hpY<0~u4q#W%G;`qgHl1+E=ixFu{5L-0-#ml*6Fl)Nh&{HBc>JUiH+#K=R+9;Rc
z%#`a|TC+`K8TZpla^Tzj`X$g+P<(hGM9^X;tXy`pEt5_oC*-(lwUNkMo6ONo_Vu%D
z4}Y}T=J`Q5k8p1aEz=WZa}~ql?@%;0zFkk!!hX1f**1JVQxGyqUiOBIccqjB&+cji
z-@$3*$ETOY{vT;?9th?BzK@S2QjsE&Od)HMJ&H-Pha~$lg{;YzeR(QLSwj+Gtl4K0
zvK!e|_AN_Uv+wH+Gt>7q>YUR#zw`cVzdvd`k7btU^}O!uzV7S3?sqM1Tox1$O@WtI
z5k2k)4CIgKJVJ}Ho$Bkd{bm{R`Y4S-9BSlyeckoOeGk|bY2K)xN_nIqW%(2)(+qRZ
z!{Umd4e$X><oQ4fhV|l`TEd@E`keDBRmX7jdQO?=p4rYg=5Wa5t|}enqomT6IPmDa
zGqsF&uW8=0<cH!az5b-CE;lRpezclrY=h{e!%WzhS(ikCiEX}$tMD(Rs?iEpJ_i*D
z$vN8=>eTN6jpW8%`Mk4d;L8Bs-$hv~;)(L{)}}904;xFER_k0^jx2;39Jack%YoV)
z#LR<b;rj-9i?4$E3ANwxuLiLW>R-lXoOI?`i)2#Ebfuj1!yUxA^6r>HMMI!cUpKtf
zpE(in-M;gpRD(#P*hc}*xY7SXB&P1dzME$ddL%B@%XPFWrKywZM653F$46ez4@gkk
zH}+QD>vi4l>T9-hqg21wyLqA{!hA2Um08`vNT;Ydq$=st@aicf+2BW$$i(CfFNpat
zhdOTizKXNYY}H59=DbIzel27zEjdJ6?SGh)PWi)krHeuLdq`{y(`MMOGeXFAtLnCg
zh8dyfl6na82jd(9IXu!2I2{e_J{)b9ACkrJ4!)5D*5_b(0@ey=RXczPSkGJ^rnl)G
z@Qu8McRXeCnep7DjKNc_mu4!BT)j_i-RxeiHBLSUJTdnJ#<<WH0r4vf>IcJa(41PO
zKQ2BF9VOAvlx+_UPaj}<QotE#|M{v&q#wA|ZKPT+&&o7okkPXtOTC3bbT_wTnR?a-
zE8#av-ge*eI5%SdPO<j6S9o>EVQ>GNbF<hW(*D8~x46y}yjM|K)ZS0wC{pZuFaK?J
zUpc&~M|yFhvQ=nmoCNRmIF&xzVI}jpH@W5)oa2G$OrQ172>nN-{^z4>+{J>Kx5uO|
za4zqCXq@0GEky7?y(@)R1gH`lcdbJ~>$CzR7*|u2{#ISJ=heu5W}cPo*erX^?VE_D
z@F|543G^X<85^<W!ErAE(xL#je1O|G;c$uG)v3i&W3LG-;GCPC9Hp5c$3p2Y+lc6l
z-(r-IG6d;|I61|jov)&sMfM|)R$O%Y?peMV@c!$d)1?2g`H}VEc=v`2bH?`f5p>vz
zB%C>^<|TGp+;*m1U3@4gXxU~{CVaC1los?z-$0Qe)MpE+P3lhj0jsHa%Q7;X?*#Nm
zmYA0UKDI@cE+Yxkpp97I#oX?5{!0(>|MtA}5)1+r9U^!E{W%!4d^HaVfn7j>krA$L
z9XN(bGsM&S7BySt(x+Lc0@=dz<Zl>3jdf%PDZ^JMse_r`8(o0&p54C%vRX>xMZ1g@
zz&l<JCzXXy*u}I6pYAELb#Y*kang@20?8qJ2a!+I_F|M-)*Np}O)gE_3#OaI<L4m$
zQk^0v)PW&$!0OxT>PX1MmwO6v2IP1l2m$lZTp2WdB?k=oq$F{JzU;4{FWWfBrA$pe
zd1c<5NOvus@G1Ob=|MfK@!^eQ(30dTQ^Qy`#E>BLkY#&{@M!X9{o_ih>YVs6o~q^7
z#dUU#I*(a_-}KO3^#<>~%o9Da#%033df0K_5n=vQ;~hFmqiy1=mA-N#5WtbBoqe{5
zZN{Ee;{7p+z~r7V_W<Ao7!6jbabx@+sgAX^u7hV*O;C1I2$$nmiASOv>jb;@6@B&t
zMZ)@Oj@AC6x17)Gc(hGwem9{L$bMme^ic&q{a&q;0_a{W5<WqGcu+F%)0@46+{y^d
z+dnuvQZ%DK)m9z(`hHwzFCELRHc|kI>AL^xccQ?^HG0COOe5GkJJQ~qUH^iJR1FZj
zqW0_ei!?itqIpR;JhX&bX}QmkEq^2h7Lf!<MHm{=UolA!uDDL=A{~D?gO(o1w)3<D
z#68(9@|o<a^abf2M_=U{)lzDwFkZ|b8x%O-Y(t7haDGRe+D-%#A}2$1F_aZ~&XPkE
z7{7D{%q4=*%=)?B>XQ5bclX=<c3N>>=u+P-?Do}qbLyvE0q}8L@15f*rLP@yy%>Um
z3a@Jcg6MobU@(%%GGnsd`Zp&_P=18{@~khs&ir>&%`|6v@Go#!@tSE)_RwF)#mVJT
z`6p_7*fi^~c>2Gfp-!)lDyUKs5F3kRF*46CxA^7&?(jOeT?(ZC=uz174}X;3kN2O7
zGxFT~TzN%VT15B;g2Civ=y>Uv0DBHRKH+-^tacf&d}G$xkG~&^4ZSNP{jp0=rku?2
z@doz;gxF1&vvE@492gO7d;S&XmWuX}vut1{hOszt7a+1q>FokUR-Q1c$GZU0ac@>_
zc;+;u*-$nL5Mu0j?<an3pLG);%^R3{m>$4t&o3_$c1>stOW96}Zct}@-qi6qlr6YN
z|5kWSWsZ9Hg7}5K@3nJ-hv-=RQZuv5CIhT;YQ`*XqK+H9@c9U3Zl+(7j;x>#{G6e_
zs)wBP_|BAto-Q_&=?J?o$bjIg2F^3do4I8ZHW`-Qj`5bIDU0A!N+Zj*|15yTj-5~_
z>q@{KxpE+D^Q6-E?Xi;V^`H@P0f+oy^?lBVmwm%IS3YD$&U${Cwtb@u+z;q4kqeF6
z#p9n}8q(J=cjk@Wf23EOU!-vH@ogH%{X7>28CWK!*e9!QU@{?FIR5Zm#5@n26!fyn
z6djLTIqSvpnz&KU<>mh5w6)j?G3Wh!*l@)&fzx&xS<}O-)cFA0FaX@gk=J+aevquL
zS93nlEZXoz>Vxlu50bgC)=Gf}kKhka*+SkA`SFNPzC^6-IDkx(8Q+)cBj@9BqeHlv
z7XlHaFU?L9lRT*tJ~oVJ2F2eI_%>^ArAw8Rn+f~*+{-pE&QoXBvcc<U<HEn*Rxq`0
zUhX4!fW6Ozew8WDK$ZnO;eNzi7U@dSiZSoD7jn;$AmbZdVrOm4N!+@zGn1g}seD|h
z+-3vF&AgC=#|wyE-KCMA$eosKtH~2#G9`dAOD{N$@n!1~WHd`_7kC^ef3}VDmT10t
zxYv@vgLKXqrgrdoMm_(ps<;34y>0BKO&8C5oGV+H`Rz>8PnYCWn&4;k?@2F)R(f#G
zATN7pE52Lq3%tL;tfv0b?Ru^-A^X5B=Y>L;L6||<J{6uyPx|@JR1#Cz<0%|fgKU*g
z^nCuOB@-R-5Iqa`u{ZI2AMPV#(=eL!H*Xj|SJBrW6I@CY(y90;FL;dUS?nweS7xFi
zhO275^JJj<8LJ_+zBq%)xfV;~w!XMtVL^@)&1Gvy86VFMzh)O=rDgEDn*!$#R6jrX
z<iZA<-$_r5Q)S6qi({2+KI_txjguEdp7A_;eD^CL+#W~yH#o(+wb;+&Q_bR~qQk?d
zQ-Vg$|F<!5_C6B7PaX__15rQJxu@G2yLu>ag=86b6iiI&w2aJ*a3MRZGsCj%q48Px
zR^wWxi-sca?57?L1q$=L6^P)U0@hwCo^=ePxqY&c=;H9*1Qo0zZNWo|1FdI$%pk<D
zyMR>%3Vhl_ukJeE2bJwzzjvl~f;71rJsQ44YY5hE58A6tC=juFy+Rnc5~?AItVP#x
z5u!MQbsn-vl50y7VBR!no8K01S@njPg`G&80jPm79GE|<BhU6}Na8ZiQRB!2$LTMB
z#HIhgkFHhVlZjc{og{V7E@Bx@z(RuvFtT;1?~c$z_IsST5I38Z3o2US3a7g7>%QU9
z9&<^M<(xZ3QY;Oc^|_K<_*_%x4ksQm{O)q?h2Y(piPtyVN^<Y^Hh>-x_Gch1k-qjV
zyv{H)RS-<(*w`dY>|a4$D^iIwKul2ik|wZCy)H5#*zw5KOQbjNUetQ-O|nP}s%FPY
zW!iK=d77DM^U74r${4C(fQ@b6EzJ>u(0X@MkU2iThS(S)d+&?i+!9G$X4#$w;)I(&
zU|@O`jUK0oTP5Jgv%t-b*glL_d}k%gIVPJ$OgIM>RWVlvtRGgfvv(CwQoQzz^VYk=
zBNJ?~`d;R2UW7d4^<6|i{0E}<sWbs&Rw*-%EnSIPg_3}b;Irq?w1Ua*+GAr|iS~EQ
zdJ*!xZ32m2-j<Ki-1BHJne+;`_Z@PFYZQ}}u%%mBPHGBX2joBA+kQrlg?j*T^fHL-
z#s<8dU%*sg2cy(XVjkT$sk4<-J&)*4r6+h3_>-w6E$--Mr?XocETaOcGSvpxfjRsf
zn-xx`4ZFJCr{?W`D7v7{d6d&MZEKT#-Slhiox5v87nIvAP{`X$rZ$*4QQN+Yulep}
zY&mUvqrB!`q$)}%#nNap$=cjC=p(2(WgQC|Dm)gulQfDV&O`jw>8VVOe4s4Y^O#fJ
zkk=lV!v!e-!5<L*CGFjPNWb+b=k*Fy1P=i*;BWr}?q^pX7;>F*7xX;%JLc)j!CfRN
z3?jEDp>_V%c)c7C1W94eVfS$0$^2xU1HJY$TojN|PeXHG$<_oKW!PuPRd&#K1hC^3
z+ljfb;)b@u56~X=M;$5(RxX*qn<r&Nknx3<<FO!B-jV|fXBdsCQX+%S0VYF%nZi0P
zCHMiDBA`(Hj~_fbV4`Uy^2tuLo@13o1K5!XkCnJyGWz!7(b6fQEsJgM9le+iL+u=1
z8M?a~$BqZsI1Fu_m{S(YvnVdRymH|KH9p*HHT=l5_H?nnl(!Y4Jm#ctc%^IA{uRz)
zvl=|mnY^0diG|Jk8g2Uur1jjN^S#lMhwgJ`mpgfLI~-gIb3;j^L~+)l^WvU7#T(g|
zbc6D<4Ae5deX?^D=CWdG-0Kx?n`bPf&a%#zC6El>M|8t)Z_^kRELi8B4{VKc+Ad8%
z8~G+CcRb?Yk}B?B!}+3D!YURTNiy3vUN#(mwWjT-bb{QJ6~g4M*!8_<Blx65e}q*<
z;zf^vD_5Sl(eAJ2VUdkiEd#a}tJg09%(uHQ6^@}h`Ds^GP?!C>5v!-ZfN~0X{)SH_
zQj-KuaM;w6Qb0firMFiCsmHJ$?v_v^p0j)10l!xt?1X#4UaMgIh9jFJh4-e`gQQy&
zGioLRSABANhKvDC$9sTT?6HCPMV-4NP11TvKFaJG53P<ylpL;bKSettrinjb2=&RC
zOw~K!sr8{gUD8d~uKq+j<E1d{1Oq+Mojf;BA#U=LyGZZ}YvqfH>LZ)g$H8r$JBxJ<
zd$iS|R104j<srHvnsh5IJj_X#0LOvOz|(#~U-cCfdbnQ^VAJ0EuSbL=b&HJ0>C0EA
zwsm7d5aYAM#9G2E>Iq;(!~t+1M+|k7l|X_osAZHu33~mf3D#57>Ge$9FInsOUz+WC
z7^zatRNd#42^v3Sr%0uetKzkt5sg7#f$)l7<8sP>J@5qfkMC2?FZH(&u#X2$w;>Tf
zU`oxVIZTa}o^7>w0%i~Hwii@~?glUI3_AM+)@$(vU0FwA-UOC2U4=NSg{Zux<hrCS
z*jH&eVs38Nw)LiPy!V}7&yu<w#>@Djxysa5_PZhPp8e-4XXE?)HdHB<OPySn3?$u+
z*=;LZrcCWvSGO?Y6{ifJo!J;RwTtb>oTnFCxUz#0|2P{%V7GghAZlH=3_rr<gbTi@
ztY!Y}Ui!_e$7w0!VHasz@}Og1iN$s9YxaXXEw5VrrVpSRS#pC`__^M6E;@cvtO?@H
z1U%WF@bV9s`RAjaW-8Pq0dK^|O$wy6#}|dsoe#MQA?DQg#~GxhM2TMw2DkP>FrYRK
zOx~^n$=P!OUp;&uWA*vd4^AzEAtW(R6D->0lRv(%q0dB1WP3*)3X=v^q0l{K*#FO<
z+u9rRq)0dg7p~gFdQ|$$*Lr6&`nOFCwf0~AL&jM?G$v;U7hH=KcoPm1bz288{sSTg
z0Pe6uTkn(3hR|-P2EzY8W3_FW6SiK;5m5uMNGV<QKd$OOuk!!&m@;`;i4b53RxUNz
z{0tXzo&l{z0I0bBaf}YH@x+CP7<W#-R<OP0x(zg#4+m#~gjafILuM7{CW#PbR5Zuy
z3C7)haZx<~&0C2ix;lUT{yY-_lFT4+jS#@;g<$YXD;jip^R2e&`?&dr@e00MNA}gj
zTa}HT`#~xD*c+vS7%&BEo840*oM`5&0AiMNVnEn%<8kS$Tx|XT-H_w2yB~Le#q!63
zqpvE8k8kW$fccV!rHkeY-svYTMY&@ga~@n-occ1gt#{I-Dj9$RX2eD_HUiD@E~4$3
z>8flJF$Oy!hXtQ!JZhVtA75bDmEI{Hydd#C)n<Mw@|$8vWO_tUqzFZWQo1kCju6!3
zp9wZ3GTr7uU8jlXW#<9EyX#Rror`tdcYiEqN1WTGo7|>lO<r}njgLECn-ue>1sv3W
z*ly3sv%---m$D29i1a@`&NACoMOTxg)?spKN6+RvIgtGp+Q8S$g@WQmGKv=+9Z{Z5
zKvsnF6Q5PiV!X|u!>RQER=o$1uY2{2-oNT<DmNW@0t-2rnz4ZhRUccp`o-oB$6ZZC
zQyTl_MW`*$P22eSq*e6Os64$0HcYUqf9AL2x6L>8HK<c1)rUvH_L)ly>{*>vH8kee
zN2zEslMA);75SK)$Pc_H8#*-VxycSm<fxoNu0xTt4>K^c8JySyx}9N+W<k6Z!sJbk
z9JR?}CNkUrLvcaEU8!9IUllTf`oK<~toKqc%R}w2ARIP7g#pDF&M{3wAh=E#SFi!b
zm8#BGfyLkCCbYeUB<|0NM)PA&$aYZ^Xtn`CVvqnBxc}I7M)5D-qfB)R?db?Ai+@B%
zBR=PMte088OINYFB>a1{lKGc#bMh!-%&7e}8^bznsXC#ZQVr1n89+e!8);=V3vmXY
z4BT8_|9aQ0>QYAw@o9PS<$HpSEwjx-ekUR6HR&x8rWcPWZk(5!R`3A6{OfCP=9rJ+
z_Q(v5e;`qI5fHRpM-RwaIDhwe(v`M-*Ak$)k6u5~9C#N7-%fK`_sQ-6uR}xe*JDC>
zN@KDX_q58ql^)J{-HM4ENS^{!f068-FpByU)t3)H1dYBcMsg}+D%ZtYnYzy(d|S>p
zRdS0)=IOp{+EwMwpvf$z$?)66Ozgx}&_Kln7P=w+NmUdv3o{m8>vb;vBkBH@y<;wH
z;FuV{+}7uu@MO&E(a_0Qj*xrqx3Wb;qB@J~%e&uQ6qTqfUsuWlqmi!l$*tCO0FpP!
z^2y@^cE^$xH3+0V<qko)KEVpj)wi5*;?A=4FkEEQVVbjY@P}yB*yj+Qw;{g0y5<|y
z;gi;4fwi0u&}xm?)p20ch}bloor_wTB7od<P?PxbUCy!ys8-g=jW%uC1ogMQsxP|_
zMo4Kg$zLX8Z}_qhk)}7mg>xoL$Y~$QL=PQ8&_PX>!z8MoEpQFySsYO{4d)R@RYnnb
zS~$RYuTtxwRYv&6XUGuy&T8|sA)k${`d!^_XaWxMC*#+6*3q1@Zo~u}EIeZrII^{H
z9NUru_T}*p|79ip+v@t`9CiOUmZ)YNG^%nDvNYoR0mJeczD0WXo{JVQ!q%KTGPyY>
zV12tY57`o3lPP-xCZfz1^>ERSd-w+Y8|IFDEGKB+DU4c-_@?B$q@A}^>7-?gT+j*V
zh6b|khnZ?)b{r~&F}`yzNgZ36!{lDUn0L&4ou7P{Zdzft(0(S$kXON?xGYxO*oHCb
zo(XbeGGEA*j=n{ID=q^W_ZB10F%cjo-bKqDv@a|*%N3uKSc3Zel`Hqi8LD96YM8rN
zvZ>{#HG^-06~P+q=&Mg#*BUzb{X;Cw-JAwbjbk;W`>vMS$hE9<r0Y;wc&c}|xVVZf
z!aR*j540a~saH_2oiSzW6AyMP>AY{Rx=rO9dZsAnWAa<N{nr&8mDtCsj0{8{mfL>L
z767^JV|YF2gPg<Sguq_^ER}Q^ItI04$h=4ulEjVTDnF1Y1Lj*zL!&gHaq|G{6zRbC
zAFwfN@SB|V(E3?B)UV%+H1P*N=@m44SC$=DwY_-J`jU9g+3<Llg*e9JEZ>KyPF{>F
z$ng<baf|v6S=+E{zD_{RoPX~WvhFg=w<9&MX{N*RHL82u8XZhJTnUkU5UXMkK}WlM
zc`?gID8|Vye<j}YsR!ZEIRiH_l>+XdFW@Ek&5^w1z^p|0a_Y{WzrKz%37Uv8XAkN}
z(hn`3NPm3J^Hd}h4YF*SC87*8fgn}Ns<_cxook?C0+Hv>lR^Ye?D_^+;6Gs7>)uk-
z1u^ERlrnmp5;OxU(WgNV^>k`~lix>^Fu&q;dfXb|ouKErwBOo~`-0{>3t1-|?F-8m
zRaI5KrvT|HT9;5UzPNGV<dc-w1c76867?ti9svWkJDxva9NA=`OuAC?x##mMw)m&!
z5gqx_Tx{C5c5S#F6mgT}ddO0LH+tntpZxqbEoeEw6=>Hy;i@0e;{bewA8^<P$+PZ@
zv9t}b3?`neMTq&5niYm1*>m>pc!|ory=M+)?+H;2ZQVaFFqtKGqUg%ax(SH3m}iY?
z{@bZr-<aHP(D1R-EPd>wGSR_$3N(dCupSOpD{X?zhoLrlf-lriHV1#g8t^r`vTd^=
zoH>ED`FoSqP%O)bx~mr6M`UK~N|_zt0URa8XG||VKNv=qoPQKc?Vit2WF1-y#s(S^
z^qgz$Pv#BTglIC=q{u3I9AUaA?M$uN09IXq_ZSkt90+!Hp#K@0%LA7(MvJtL+^UB!
zN7*921(R^8{g-8;g+yZuaCgQA`zvxxM5HVl7IHlIIf3ilGmO)&0vmA>GfDjeXf5m0
zOeH8(F86fViW)Y0vnI>aIPk_l7cHlTN8bgqe1#vdZVVvx=}A56+9_lRiHS(#yDhlW
zEC#;hZ2JKl)xZH0FeF|Q;4S8x8=3*%#JU7~?NIbz%S7+)`I261wRbiD<teAW<1@1Y
zU5HWe9%l7^z&?VvV4F%}6(XfO5Hg|7Y^n30&xHKvHC|Gu4R5Soa&rL2YBXo!9O&kR
zYmbOUDsPGeT)nO)e9;58M`fPsR^NbOSmm*T<zSuOQ~H~x(~{@3&d_mM6+3<^p;L{N
z8*xr^LLTdN&EmH=vUC|+o_!o6P-Z(y?s`A<Ut#M1@I8v+(ft*9ceL;MbOT{LxYbt%
z7U$Y3guv<^bik2)rLZloT7EON&rEUi9iYf&7(Zp=42{LXH$EVqgPc4zUS;&br}nEk
zxDZN0PIQa*nFEH~ngnmjohdwRQ;W^?yqjv}!+jA&@Q{uiX~)mZph!Wauq{$aJ+|Yz
z8ae260_Ju96sl`ID`I{G5xjcg2+ai<8-DL(QWW`5bnATd(!Dr*7(k9Zo}CDQFx8By
z+`Y<UD^5<HhZSl?Quo*e)EjS|Pbu_Ex4#P2RsBl5`jSMR+{pbI`#p(wI1d{3h|baj
zyRECBwWJ2LmSpBs%W{AQ<`o1n;2d_{POrr86KnYEQP4!a`qmyDIo0xYtD<hO`1m-x
zu1li3TchmBztn_NWHsS^9rx6uK5Ci=R8mpoO5NHOa(eN;;xy-*a@wrw2m_<ARFM0g
z7dTc#-~obXDh%1{?6Npu`I!8ur@estKBJ!J#1rsvog(PkZgJ#g@4k}KAV#=Y7^5F|
zY95xln!E2d7oWbrvi!l#YJ#&Ifj<S^$?g0-IAYqd;cZPs5{1^42Nx+!UB~8XJ#(9=
zhaP*X`OkEdppTWbiw*??EfSKR)@>o<7g*{&MGGz-b2fN25$UXg4q9yH^rt$}+!8Ss
zqMeD>?${OWFw*@R7!2DjO_BdktB37Q6#nB3=zrzreM>Im{KHFUEa<W%qgjFi>~H@w
z&B`7DWgD;IU5!sgRVAVZ1t2Hb?Z}u@x7!_Pym-ChmFgfoUHzX5pQ3IbMX>G8BY&20
z1dVn4Bz)h{;~3TfwId+<W(+Vo6i$E%c~Alvoy*36(MdW7IFakjWa{StIX|ST2h`7=
z|NMh8<{yevwk{W+dADN8Gxy;n;)($MnEEq5d!GbGye4jyevQbFsWnO{j&ZA7o@P7f
z#ReJ9UNWH`@R9LII>!IHn!0_mJZ6cH{Qww=*<e!yWTnlSX(=U|UcWtO(QmlXP+T4f
z-jm>P2edApw#ku09I9lg1DG>*jLM6?S_m&-$lM9Am&yc279)q-=d@yV1xWuu=+Qi5
zA{6TN`ZhL{UIz~fa0{R~^lNC)@-GW(a;emGW=9YD47N@O<c?y6fHHWpq8OsPCXq(B
zBzzpW8(R@Tq%mQbSqD=?%jgrBLBm}fY+%`)5b_?e1fQ@=#-XdfeF>Wlqo2{Q+Vfa_
zjJIGb!d<BE6vSbtH<m-cAfU7N9&KI7Dm8q>dfJ9*v1!c37!}q=0N}bBP}7F9IWJcF
z$dGaOs1;N5DXDT@EeUGkrU!e;V>=}#B<TEq?u#KhBPaM<09+i&V|)yVPqSEE2_JyV
zPRj$V*S5wu%vkn5`$~MY0`->-Qjz3i^RE!+)M8^-AD0f20qg~q<0MM3*$1H?8x4z+
zC**Ml_$ra)wvZdmV6mZ(l;^2Gn(0$`O8N12^P&<{O?T5sgO4)6rT>Q#ihm<~)&AJ<
z=D{xPI<H-;&(SfcXeL5VruLIJZ3ItjcL*40yz)TPcw<90bUgewA>x`M%2P04LQi7H
z2Mlc+eeQi2qFwjJ=I0#Sd{;VaZq<B)ekW%`W>XOPa7`z@CvYq0X?u~KjIGeR+n{4k
znX*y#=ExTNc()Zxp62O57t=a(+Tgfz(=9jsrI8D_iL;>__hdI*zNvY|QI*QL=*(XS
zCZ?}-LHx;V$t))h#XYmH%(i&HnSC=tr0&X@8+Tq1>c-N8h6gZ8_6yqYl=dnbeB})F
zDu}1R^=9+gI`uTHD`>ISpHMkX8zj=$uJ_ub1~<zvbdBQX2_1@AX2&_BM6SL=JFmTO
z=yqtfH~DH77dgj$pwxJAWS=87mZO5L_E<L7>QKy>IWtdg*x;tQnJkyeBgMOCs85nC
zFh00vD+g4U;hWHAedYSF{n{n$yA%lt`&M_6A21)UEes{`RnP0OOKE$qd{I@QOd9gv
z?hRki@w|v@RL-{%wL26T|LkFHMcDBv42Kw@s_;r`#*-UifZx~P?@rY|lCpEMjUXlz
zfS87(q2X6p+=9?whfl$wPl1AquU8hP+Xk);)m{NJb{}pp5plskU|}7g@A<$eVw-vn
zyEP_6x`;g6q10y^2!8UaF{z_Nur9}b^cmL!DTa!e4=gd4j--fCG~SK(ifium6D$rU
zB*cmI`^L!J^ZB}yPpTO|;k(`Uq)%>C6YmA&2#}%LQC)|Zn(`@6j=kWHGfYeX)kesD
zqLAO;=B|HS^9qs>KusP?+W~%IH!T9=RIG$@KBgVy$PWL605fNYqSKS3fyJU2Ey(i0
zUR-#6k0sdT3K*(;8v)w*4sHda9sB!BfFu+o7dU!LS~-zoAS3J|Q{E2_l7Z*Ru+j+;
zoV*K+CPaw65hx8==kG!j+78>JJfs$5`<vSgbQz-VK&0vdRSmZ$X92iBzUZ(ui0>As
z0(t#qDz|OBeO(Jd&y`-LhF=$Wimv@F?JF#nNG+Ywi@;YM)S*6JtVnnZr8}0Ow>9xc
z8;M@w#C;{Kvk~{po|yy^n&Hdz#KcnCc`X(K<CPH9SyZ)zI@f*qEMUA4q#AjU=uMK-
z{;Bac4shMxB0RGCL(@S!l~dYcG)6Ati^wJcy5_Y)8_{1JPNcQP`&Iq(M41!(pbWkI
z$z_m@(UO_C@ZEwm*a7}y_v^oXuV)!c2(-tN+W^tq730d5>bjqEm}G53{KNKtz$mud
z*ZMMEhw&7)ZedAzFBOLFkjEK6VPV%sHANY}x6954o6&9T+zV81sq|fCSDR_#83H2j
z&Sc@bCA^Yl%3m%I9?I%!u0pO^W45Q@YhIWeGa?k3LrVTHpPg70B#EEhbX42Q96N^{
zpLE!2Tg%LD%{U&cRjR-h5D|zl%rl;P(=m)7JOi8WEMlE?MA&5Jjsx`_WzPAMCYkCF
zXu53QgS>gfs~i=Zm2@QsUR4A?Gvncw6hIlX>E1YBpLbMd?YCZMu#MLt@Nj}U;QcS6
zh^#$xsCV%zf{o9TY_4m}-J2s1)V}uc=}BcUQ2YJpoT=4{w}!M{UEAToSf8(3ic@Z1
zOV%#Oz@HGTszi<2aKd7_*e^3!$?bUGKeaPVE=nK(REF<{B^~KfK=hh6lFBoHc)#)f
zwW?!Y(PyMX^in*=t;xm`f0}-yQ>&E^ZG1W`Nz*`|A^zE{3`ODON#+F_*YfxX%8d*J
z2?yL8Irae8a>RLB;aO#jM7<YJ2x5W~u>&+u$+T;qb#!qdZz0N!-I|pykN%4nv%CjF
zf$IkapwhB<K_ei*W51vdc}$Yl?cFoS$lMwz%mEe+R)0Jt=<@MYa6jzh`%T4yQ3tk8
z!Mz|G1VDdUXVP^h@z`IGrzpK#IA=w^d$fw<H{R?eI(1Bl5C~5F;?=yya#ji!&ZDZs
z$wkH3_W!1kOZjh=Zb`x+fyObTJMs@X%8E}ac0#Y1X7rX{zdrGll1ikZY5zh*&?@FY
zVb0hAN;-GXB({Tuj3-1<)8e>=TDxQ62Sm5*_|7$wTchi|lmB2?Zi)l<qCH=U%s*iA
zhFAkxp4imR{+kC?M^DJ2yu<5gWAENE7>KW=lLe&yrCXTGxcy`c+h4$iLv?L?o&Eu6
zuD>rt7GI=r<?;DAZAjEYtn4{!(wYN7o<<GZ7Ka309o5j&|8z3D<t$iU6sPrgsyb#&
zO-3_&O`JQ7E%piG9w-wpW7LV6&;-;4ns``%<<QHDuA1T1lK^;;?QqeU6=dcb^UlY>
z<W9>dF+I6aeNmtdPqNZpo+2rNd=CwFk}HO&u^2*#7C@g=B+De6W3JC-Hu@Lb`?t8D
zhZ#QCxNzZ-8XRCVZZ9F6odEn--BXK#5XmJ*QKk<gY_~{(tLOspdXFyBl?bR0;E-hT
zJ32e*?WXu*&><Kz0RHS5(v{q9w+>H<6@`RB#&b>~BW7v2nwdfG0QiVu{Fq-k@&kt3
z1_;R!l1?8(;13RwIYkD&3U)*%8ZiWKEpUxxHMueKn&k)+ftnJpJ$=P=hj%Q7vCu3c
zJ!Cfz;@EX976?Ii)p3%zc74BS^q92-+b*)KU@rfkN=>uF1De-gei|)(bmmG-UxZPU
zK3l+vw2y0j!WiRa&0exd2k|$N4w5X=p_dnR$E;p`U(jsl!c=$gn0~zS;|Gp%O(V;8
z70Z2LHy4WgeA@=1p;I5JyDhw(y8BRC+VTw2M<)F*O`^Rk!;&+QitN3MJbNwnxW#*o
zjPyP&+QhIIAf}%~CD@PX5AIHsOOM8^2akW0qJ{@}Iktda1cXz3)~8gN+xEU$t6bL=
zEfPA#D9^ka(TkSI$rOpU+j*CE3rO$6TS32Dqz{ixRMb<@0M6Pm*->0hU-xP>Lu@c2
zJrkFz{_gDaqprMco{+oj0<hB&)$c`bsGMkZemf;_gxIsbjq>`GDn4Z<++#Nl=C<AB
zRb*Xk)Fq1u*lhrW2Hh%<I0}tg2W$b^)offme;WI{ZGjC0Dn-1k?!-p`(06p*@B_mX
zue;LkP&I>zk+%WYQ}}(Mvaik~`H_03p}xYwTALGW1x?g4etO!C7_?mh>9(I0J)zzw
zoC_qDPk&BVoT)gMI)CH+zVXw0x26#drE#;DK$^~e1nSc!1lVYfiKVZcEPf2zv6y0e
zOe#{VgH~C<I(q=NBo2&+JV|!y2h3%=2Y&diz1c|CUJE*U$5ipI_I@8rP+r(Y7eLy|
zoAT;VN=f*8(08`0piar(Bq<@@ub#@2+253Sb)3ot55}Nc>V^dZtl&TzC7Hbymb3vr
z_>|0IFTiaFE3}LZ+UF+iO*tz0f%<S0eX-$q&fDd6Qz&pE&}~@M3yjcI6bR3G+4OX=
z)pm&_`v!0~*aUf9q4xBN>hX)u#)soD*UyuSX1_y>KDde1lZiF4dSmlXW|dxBq@p~*
z7Hfji8#w{>k(AFcj(w&w6sN!-k-3Tv#Do?LSSZe5cr%)=EWN!qaj9D%zjMDVLuoS)
z!$;}~yD)UE64;*=0aNga5DL(TOE~CKV2LHy%>Kk1CEE)dXAWfyJ%NP_hI0;-1OfQb
zX5<Ji2j|h*;r@c_FSkZZ9_d_uDH%D~aFZ?iqDAu*+QLBthIx?#TrC05aN-ASXFs^!
zV0dOs&YR-p5w8oyUW^X?q=&mLNxQJ>pCae~=J;4422X1MwiydhiwW?OwQCjo+X)G~
zl(5eeb@u|&-*omiN_9_<PA(JjF`w(CGutv}w)=#^#|TXvM+}QMYg;7S$%Bu<h-arL
z!H`v$IFDNF6i=&Mx9c7-qsS7A|DM7R?Ljmo<w#o*{6G;vf@BsY6T-6+(P#(Mxy7iB
z9&Cbk&Om2$54v^_eOzP2mqh*qm&!Js)c2jKM{tt2FMM_eJpLZr(G`<Luv|DI!RwZS
zUh7c@W!(+oa}d%3LyrK~dmjCBdTT|!qZf+s7$DEN9FR*JG}W@alR<8pf-Cg{b{&-T
zEKu7L{M9%-Ilh1dc-JC*m|QG`x)Jj%JfzT|x3aQOvq2xU5J-9&_8zJ>O-1dzfa*zB
zC=k<r>2!3@avOQ?*u)=+XhL6}dmxv+e!cLhUi;?3T~pxow!?q({es;S$OIZF->>AJ
z)VbLD`=->-(HUnwj$1$D0e<8?UATysoQ8L&E41OU$;Kh$)`##6rY@$@U}xWB3Y8M=
zTC(Q^uaRK~up|~Zanei+cn<uWXYvA+7Rg;>uQJR+cIUVQK1KPL5drWQ1C_d8vrkeU
zK2y;ElTUtfF+ZIO$fMxNaD`i-lK?gWj&)E**~K0u7}e!QLh$m>lAdm1v8A{lpjUY6
zka#)}1b;P9;Q{*K`5k@Oj{Za+AHtK!?oql{%H)T?Pqg?CgD(Et)BBblf&Twq2(;}`
z<a7yT?1)F#jk+ICwHoXqlTsNE$E{Y*6!11(o^J%zSbT)(Gtkh<4lIRARLHfX`Py>1
zMDANr7^VrVgvTb?4XnZ2?DtU{cFdrVME6sPZkbPRcRV!>R#7HNG3rYLcDbKCqbzoU
z%4=%AaqkVnl`>B=C6D_v>=JkOrg}!8_1Z^YS-5ezV>mIlc2^U*^t`*)dIMJ&dLEH3
z`Km&NiOEb$b^d!*N9XU36+eG_{H(i5^wb+J(~=3+5%M;CdJuTf1GY5h?{1;re|~S5
zNwsPDma`$!C~F%nH0eck26%h5dwc+5L*Rcp>MmVTx(;v74zKe(fJ?b^p@!oj-fFvN
zIAC~{`8BbF5Le)Lssv*E%Fy+&?QOm6li(4ni^j-M!~`ER(FqQO&UfNQFJ1pUFf{t=
zdGh7G>nG$$Z}PLj#MJ}er02mD2LaL9vuDnM8nBzRCbjP%7DOP!x?TAQNczY#!-kgK
zzm{)fHgW~826mq_(75@r4&Lzk%TtVR^mHm?Vdz<NT*{R=)AoH_jv2D?U@UlmYvNgO
z^WKLxx*<;Egsa7uDv&FCf_Sr}c3IH>LSGGj2vnwj{X<(1_>{fJm}eM?oZX6QbU2}`
ze7*I9+=ad4Je^s6a?4vJrKLllygvvC*Srfkg+Y%hBCV?Yx?Sq3Xu3{;v}8M|Oi};d
z9sRU}muD}ZEtM&zH^hfkJs{>_Cjk{wj3K5X5xuyKod!3{bGRqvMyupxu=Qwe3m^-x
z7Y%vjQ(*(`M=YtLBm7F3YW3{L+i)xIK~xXK>oi*0(LYgQjx)4p+Q*qAVCu{naNz?N
z2}vsJ&Q0(p=|k1n^z$--n_68dG5Ra}(pq>>4tsT{lS0!iEG>CLri9N)EkblW009u9
zE4@iyATSAR8u<=MX!)BFzY#Fv4+NvpOrntU`5R#CdqhvnHbqT%E`Y4*=a?`(z0u5%
zHs#NbyPp-tL#p2e-nJtqj#85cI$RO|84B-=tbZ;RO579B*!Kh0qraU2wo)v)f7{59
zZU$Ur7^&!4Hq@lLL@Fy@+l~9zasa7t7G%Akms@K{Wn%EtInjJI^9!x}tSSA;uw#U_
zqXRL%@B=o4_^j({ZH-!4{{dTsPx4aU1D7u;<)@yBvS>Mj@Q9hXiRLe-r;)OkR=7~p
zbeRy~wBg*(aI(K`7P|swevJ|WZsvGl2+$`SbXtdhw|$(c8)rn4TiwMkK#Kd<fsNXj
zc<Ks!M)GqXZkf~=e39cTbYG2AtPjG8bwsp0v#l&>Yz}S2Y3SW_P0wajJ%*L>t#o90
z?1{vra8jjHbiaqtZmW172ro%NoTVL_F2Q7NMB1bGK*(@v2emyh+|);J^0nL2$RPCw
zrL;)M`h?zoeci8Y8{`7BE;n^I0vH58Wd?cm(I}v|RX|GOg4Ib4EBi9ucviW8L8rf8
zlUNwe|G3zoAsRByUG<#2b)bfUO!Nj&q8#%10sA>69Q$iXc-frL*URhqYQ(rG;4F|*
zN-y?rbi;plt|%R(kQ!~IavsuSfeyRYLM(oN|DSN+jDwP;i<#t=jyP3OBeq79QTIa`
zA|c<6CxHftT!3JAf%-J31>(!D$B1$q<S&JJTfRPXPgLAn$?Tl+yl$o?dIr9-34Ij{
zwehhY%sML~ZtbXXskn`FQA>wx7@Yb8=9+1hAJCbr;ZP4>Wh?!KF5l%C)s2&QVh})U
zyH{7|)|QNW=>YDYVodGP)0A6&X6G)hpeF5}p{G6|R%xP0<?soCz}wB)FPo+^R+Lpo
ziiGeqAinC6EX#-VsIs6Y#W_+Lc1`?6h%lB`hJMqn`^-BW%4)A_fKXE0w=2~Xyz<<7
ziKU@lQ;+<La&`bTX!>n7q{}b`Vj_1Mxe2btRTUHJ1$j_;A)$W2Zh@a#zgzT<M7cpz
zK7#sda^xQ$`sP`!preaIoiR+a?1z6E|Bxf_foDb}TCmgALVer-?gAq&<SH{Lwhn*R
zksnjksoLkt&arno#)C8k29;todk_;W;C3@cl84?;il^ImgfZ;o?FSK@=~<ss;cn31
zwG~SJWt(|C$^Dm%w&WG)huH&|4=v?$5<#wvRAe{OUyKC#_59lqG>v-3gZ5sUPp}iF
z{y!@$-zwp?(5g@^nMfxE7;4Yn(H;xTs__Az!}Ez>^%Nl!1R#12{Z((-_@D>;Hb)Wu
za5=ykCQXy8D7)<8zkhL@Ty!DpYhnMNFDSZwWXaEj+W3Ht>vKY%H(|vUz%B){$j;gY
z;Cw-(Yy`XOAwq9C9QZ?5`ht&*sb2|qcSSe|_o9-X4-{?2W%9|y<?d74C9Jp;%E&fe
z>G#FkJc>ysh!JQ<Q0+_YQ3AJ1A((CQoyyy4z98ch&$EpL1%pe$-op20RfY_e4yHMU
zm~pqsG>(qBu2cVR`!P(1(K`8x%IB&B(b|)2(E?_TE)m~?M2(@34|Mp_4T7D0{iq)4
zjHX~?ozRhr)e5vYOS@>k8IuKnYGO4EHV<P$eptzwt$$^acI{J}{BuNvxR7DYnv|1s
z#hab?ZlJ&tCEo6NWfC}OYdIxs)nv+l9a6nuF}EljKBq4$ealDF^AX(%>XSLCxNDH7
zH`rHczhAO|#xlFHbNO#J1%39(IF-c^LT5m9P9dq81UR|h$o(dud;KyqO~v*j3X)EM
zN$7IUR-ge8c4f)N)c{Qw@5!)?8iui6PnWIubF%(`Su*}SJO@OJfYy_qC2)eBub<qf
zqGp_1yVVI*KndFYERAEJ{d+7Z%ILVPpzE>g4VtZ;_b9(mq9z5R(NPVERqz5RLC>7s
z>)h|96K2CpWDP>ttzTRJ|46)u_8(m$gnwfNs4AhD6lyp%SAk>Ms|RPg&zQ&+P5E)u
zL>~6(z`I26M-<fgu%0fxNX0^Cab=8{7te2XE<A}G)5B$%;Ts@C7TQg1cO50@-nT?7
z9l`r4^D7@#xn$j6d!8C@81|+R(5acwFmg(tO-T*#Sl9oG>Zs0AL1CQ@0R`8CdHj25
znm9SiAh_~}v*Y77XB%gQN#bfC=08$`1CdeeK05&u#4NCY>nyV4G1+M+(yu37+k*OK
zTkm%fRJ=OIdTnk!k!->zP`*4qR~>;s<asRBUmOG#g{LI0xJ6A71?<biZVw-ahFD)%
z*U?%E^Tc=)UqTZoTlgj;IjG1ZW&S=w6g}|qiwEbE;3|&0Q<>zEI#<Xrsr(QnN$xy(
zNpc$dy6f_1-L_@A5`Kmb)_6va9Q-p0N(Ljt<?b7rbH>E+*mIL^4F+H0eeE)r0r&Cj
zeg-xUdXCnGHde`({QkN`cwN(UN{~VTqt>-OAXQx@8;zmW38DI#;`DfGuoH8WfwQLh
z6EX%ErELco0IUKs2JkiR)X!Um0SiMy0g;!|?{^e{24zGKKpdMuNocbj65<|WE)|lV
zsbH<{A3EoEn_GDkEWlj5*eWvD9lkw1+=@ohav+XMeYK`=OM~sdtcm3=n3D&EVY1HF
z5fU}npu9~cAx-EXgCfTqiGpaChz_nnu5JM^1D0g=3_-awrXgG(SV}yClgdFeXl<X}
zi2K)!Hueh!qNq&xsIeB)mrccG)AdK?LR3Ie3~kQ>uFcrq)pQ>ZbLu4@)Q&jA&~(NM
zTjA4=a?TKuNSdv*tR+zT*d8a9Nv>t`u{`zCL+K?YMo;ww+zXWP1DU(-zMt42Y6qnE
zv>-!CNyeZ^yFvoVUqXUHzmG9dRj4rm<|v7`pZ0dVp{5(HW!sogM8%Y1B>$ek&Sftt
zo?TyI-=vGLLZa~OzT|G6$^Q#CK;?DEGr`NmUM;H)nY1g_Fk+k18AagMUX#jzsrbSY
z!A}!hpA-1r;m7(5WybM)(&$_BU8(qd9do7DPT+g)pSdR&SDAL6*<Ysn;Z6Q;F@WRg
z@Iy3pie;>%CS~1?=T5#y!{hfI9)ajg&KNl7dO(}l>p-N+VsC(}<_i;y4y)gOWhKIq
z--gkg(J!hTr^nM~5S`(ldr#gGY`dLWw5&p{`h1Vb87cO7+A*4mzB?lhxQ#MU{)70x
zJ0u@A9lDYh!4~o$5qIIurqU&5ESGM*<3P8mMvil7E7Hwr4j9KSmV^V|_0Rh6N2BB8
zF(s(jKA*ingjtXb4MIeQGj8xA*@W+Q+w2*@&F2_!^I6!bGWyfa#}_wF+5>okcI*O{
z^fa=PauaY4u|}kC*v(J}DpH#ea+OIeai1S{0-!i>Ir#p(9PAA!C%+d(Opk}H^NUgU
zhDF4EtS&UQ@_TK#cQ2cU*n=4xhX?q&U%;aCMji0<hM<rI;)sDx4mhG4_<5vpF@@iU
zzI|ci+7FoJSAg9B#%x#jd@0b4<~%z1iGgcBV;1LoMS)NGhPu-(qwFC+`G~stKR`nR
z&}-zIh-W;g(Dt-B)PfH56s%}^r#M?767gKAn^ir%q|>>dt%?^Nw^N<S^R^&vcI|4#
zlW$ByTp<<wVQGEh>SCMw;=b-z5M-nw_ulRWpaZ5#R&(t3=7I-uBM&IP{B%J7)v)_h
zFT4wfOoK<;@XVuN)35^R2iiq-8ToX>js|o8EBowZr}2C=GyfMZcsGM-Kr&9U?z(lp
z!nuh1k$XSfs36W}YVdDad_3yxud?U~uM^sZAjaSmxMDjg&|P7-yj0&;R_JUv&D@#v
znD35UpWqT;A_)TYAbPYHgFT&+VD}_d<L=HuvCeeH{)P?{_KXn+#u;1Ioy*;+H`0q~
zSRPPjaaqAbU7}+<(-J=@FlrzFyYflJ;b06igWMkGmx?q&(gjB!@E(ZhFp2s5b4VhW
z9iCRmSQLBpM!4R&+sa{Z#&}QN5$Xy0@2V47_4BP@>wEKihwPuN3*gBpdVMa28flk4
zk1FM;UY`JEp`7d$tsk%;uN~kZD)0*D3ht{I6wtj&PhYYUP#T>}D8awaYD?xQ=bKSU
zJjbzgEGF(!O%N|ybl}e_&!msRxqGLA;jRa)WSpId0&mcI^~lx3;iOXfN!vU5ZO@=`
zOL0c6>z)shm;F8>*2Dl~havT1P;)bF{cbcdA6Vn(7|q<f4OlOyy71StT-UroVOhOU
zvfZc1WSVmEU60QdUksj|`X3S}$q(37#u!owin!lq_%L?DZ$*gscoAB+yMYstkc>IH
zM<Ul-c`4H62kc#3i;oo@&%#Mx#-TWYq_y00fEJFsV$A}mnEeqC%bjI)k5kWtub@Ti
zK5LY_=|`&VQCX@+uZ<!I{^!CW(QVqb7H9c$`5rAH&kQ`)LFq$BCKySfCSGgBex{8m
z1ByNyLwa=3gaydzvBbo;IqidoRua;Iq&;oh8%U007#mzona|vh{o;B=7{1kn)_G>h
zwZS9aZ;e=`K&FDc+SpaX>d==L04ga4ijNE7!K;1<{%lc;p31mTrL_!dTTjwJ&7}dr
zVkWRr?g3rUE+9%?{vYqgUewh{ya4MTbL&xk>7>@pBj0>9-z9QietBKp>6DrC&E#;(
zu+j+M3;POFFgIl1;BJ1kHY&TQIZ(WWL(YJuQJ7OL0CE@GVeBXbx)?e!u$;P|FX&JK
zeCwGHmWxUJ755@2-i?Fmyn`wTm^dsD?@&IS2AK@4pbcV`u>jnh&E&G@Gy&Sm^$Q1=
zrw@^$c&BH+N13`syDh(MJr68G>Db(Mh6;frG87Gnh#cer@$lvT<_-m>eR2lUOWy*g
zp>#W4iITcD)|CgPgf>7KJ+SH|yE8{E00|wKSea=zg?)+wjbb3K+*ZSYf-wNH^DB28
z?3Ods;=aj5nlxWpdq3u05}isN)%b~(?)-%f?y6h3XXFteb;FyCVDIn9Gr<Me9=<ex
zvC^|35kQUyOS_AHaUR6shCWgWNEecVMg_|9FXq}S17e>SvC?7KF*Fcf=azWnLf09d
zhm$BGmEDV1{$h{W9yOG;9cnC4aBFohkn9S9R444RUMsl)0b6>SKKaV;V@kk)`0=ZT
zrdUt}s+)Vk%cmd{>Y)C7jdaWjw2C;zpVnQ+;C{e@S4fK4I(g?G`Z93QrJ|CP=$`zJ
zdNKg`sDi2yo3=GQ=Bq^lFIt^WPpzQ+t2<N#OmmeNt54U2fT49s-9A!zCbM0{*Q%8<
z-jT_t%~2Ul>92$GQ6e|oFUUC2#7T}*IqjBK`p^SDCss_W0xELs#jZF7Z{8O|Ee7b$
zgt>&JWc+|V@dBdjy<&(Rq7X1*$kz7?HM!cVAEeUXv{EK84DR~=kBe%`gIX(GhfUa)
z!Vbvu(`lTq?@kmZaCRjY6{L|`%dVL^Y*v-~y2g7#cb*AuZnU~Pw0blMhp?B9_0kng
zTdus&)1J(pCQtnlf|lv$kjgd?Ma79b7n_~M1?5;Io-W?olO6A0;%OUriJ`fXC+t=7
zI6P4H=<-5kZkc_KfhTC79V*`sV}UL448M`?&HvCHSTS#M&|d1MmYx*-9*}Y6_3ez~
z^@Owe-(<LD?#cc<0y_^Iva2XywM;lljMF!lUz1#NA+$IezRrz{9!x$MD)3y%Q6<}(
zJyg<DLKmF@(!o`LzsN8!=OsGk!;!JE*|Waib=%s<w>ymz&JR^%!EG_O3p0~);>u_?
z)Y6Pcl)w5F-G~s}Z+vF^aaD;9j5p!|<=Yl_5A+GJJ3kNTBf2_F+OZCDCRR1&fw(XA
z`9HhFgZZECJA7?NhCJf-MekjFznK5>MC{F`;}5$Z7&v?1V=t=l@g@TjfGh^-i3}%Q
zHE|3ZU<>-?6MtzN?C#p1|J>dGH|{R$Mg~4R*69ty!j$Gx4T^THIqhP#KVU}&!Kf)z
z6JY$$=e-lOeEC`pz(18ydOUa?51{#;s9ZQM4g}LGJIxvq-pEN2KTFzb?}JnLpijN@
z1od;!u(-+oS-{aD2~a&)_?$Oqy^jfa?$`D&p>GRPs8!)i&jPM~q+#MXnU#MOr?R%-
zgxVlef?odpsRZTi7X-63TWjSD!Uy4|>bK3xG+Cj>mg1d2e4kX%N2A0~(jb+jUpK;R
zHLjwq^uQ;cw?uS@h%|i)BYKD#r<Fo`hsL<6jQ~#F%DoIbQ<uP$cpGd0+cJqONT<#t
zoFp%~JK{>u$v6<?SQBU9fcb98;k$b$OfLgy34T`@U@rg0|C;J8qprtX!$pktkLdS*
zTM=w>R2~#s{IaZc!6n?sb;dO7H`!#dKd~+bg=e_|&Fe775$RDNRr-FZ{a3<E*;}ZI
zrvy!?70@<KPLbwS@GisyiQc<=RJm!Io031`8QD=fo9mA<l5Sw&_f^-|iVgEspRIOk
z;k}tZ?QPye8~un^Z;H9S>J!6F^@283S3m1Ud$E;hq>!DLgPP`#GLjX+NNdoGe-%jw
zeUTUha8%F-iM00k+ZpFEHzhafu{+Q+XjQX99u#?i=4qO{N&@rF58T7eh!uLGryBX9
z;l71P*3_O{InA4%B{=eO(&EVg-<jA}Ce9n5hc64Hjh#+q0%3t>5^Rc>eZg-~APM{d
zJ%zndh0NDK?fn$m(Uh)lVPOHc6+5ARPwuAz`0>w5)G>04nUmsAVK5-A&PWHr$at8d
zP&X7EoNZEFFfdbGP}4ui<#>_r!-o%)CvA~9C2{OFC3pn%+NkPujwpAK3!g53^%Ls7
z>@;ch!f*q^L2wfpq>xcP{ET~ajnChXT_?M7u?shFoYRkj@OERsFrLLGkuP!hTF;Hn
ze#N~ic1J0m+>S4c8ti>r*cO&3RS=svM(QQ1jwm_VKD;@VxmpuX)R0R4kYSEK?y14A
zmbJ;`L=wk2jbfM^Pj}BB5onZ>eE-25b;<Sa$sw5REsq&f-{qb0uZabjgELi}`8$W|
zYoCsnK3EKPV%tX@-8{}Iqv$ANH)QK}y5W9e8JwP=x=fcoB6vf<4$o2YzJw}o(QM?x
zNjcMOMJ0B^QDax%@)fA2-2+n{7n=53cXF?!L}xyy#nb%@UqZ6x`eZI+p4vv0PG8Si
z;6#%(#aeHFvTe5Vqb>KWBlSTqk8*-MXL`=_>Q$Nx6WZ9(<9*=DQ)fdXT&PiH<EG|3
z<bDwBx>BLOdBpbd+_;`)6d_bvlIRCEjN~ASdEXsVshyi(jYz)(^h`YPnlRjyUcnAz
zkW^Y?h>yXY-r?LW*mf>_g<&<C@r7<+Hd$l62fP;GwfN63+~9Q4RXrYGF1qoyUTC#*
zXaJkEkUD7<5;lP7pzdL)0@YjS<2YLde=ZCw$Yh_AB0VV^CvZ08poP6sTY1v}D{es+
za+7=ZVTRv*bO2dM0}6T1NtR`C<K#$vpzUX*R=D<FDqnL*6p$qTt+d<zyH#RJa*_CF
z&nVCXlKJ?{pfJqCLkbEib41n294r9a8aK%4R;Woz!$-)D4pU?qzvc)Q56+S|N$NT{
z9_|BH{!jUvq(9>O8VNvy0$n>?U_#J0Q*2fjunEyJia!msMd^+*@}ow3JB9RDnVN|L
ztwjJ(9yJ=?2FPWb0i%X<qRn_>8R2p6cyVbn3*iAqxcjR`_q_xf3mfA{7enH*?uH63
zGR-|zuv+0}JmS}_N%{6}+=5+X7c^n(ustWVYFm>b@55htwUVwJYz1=b9~6N30?c)r
zbMNx9+XWpxE)sVMLGQK=d)t8$YN>$1wSA>*+LrfwbMNsvsVQ(8v9*OXN?2jRXZEg7
z)PyHwLR&ER7Gaj<>E?w-V7J<PV`#<6ZL{?o^7;Ro)Wet(UqKT|pg8|ULX*hC<ax*q
zaiGGwimGqXRidi}|FS2qR~Qjp7^66((c4C=cwsJn#XpaQS6#v(Al{}YB>f#A_CuC8
zi*h`^ee@Mj>UOwgB6Yag{_ZNTgNXK{n+)*`jU^aP>~a-0!%)RF)7mRNFV|yOY%`MM
zoHFHEMQSekhRQ8fVzQWu{g>GRiFA9}d43}ijdVw;v-LDmZO7NAI!B2~m-q&1LCnK4
zfVP(Dcs}(~mwWC#=}+=_5H@xwA)QJA5@L)1MPM@S1Gpf|P*xtsGTw7{{O+XZLU+oo
zqfLsIQyH+0^~of5E}V>)LasonQL_|7Zch4f)uRpWuO1+?PSI_k-Ubg?H_qN1uGR5F
zW{ryJz5j~S8%@KM(I2(Zid3;52)Rq&zVCR>7K%!&muqlX^Muu6L^Wa6#@Eo7YJ(Ot
zT7XX!9L3=2KqUuDJY?;$M7pvJhyk$flEuA3;QLw<hV&%jB4a`(xPlxtyXg@8Yse6Z
zw$b6EMuw)*kxB&ya)A+#7B7yYUUYwakqq~weZ!v4?~uTj$E3ZZ*hlgLNIHYSujNVs
z`uV1M9^`6>*wz8L;`j^@oPF-?6e(L&JXn=9neUo%XyAd|X_)L#+}<{{ECtle0bU5X
zCqeZL=H<_BnLkLb|Hs;UfHk#kUBe(KDkvf#orp9w6cLb41f`172})By5s+S`ML<BQ
z0)l`PY0?vsCPjkuBE5v7^xg?AK*;%5@SJnK_j~XC-upfO^H|tPfMo5x*PLU{F~{fw
z>DN6U8XRH)MtFP21hU8wy(qRTRu=XA9sGLnk+!FbnQu)CZ>HO1$|{f_G3%(!TFHgM
z`cNRZBAq`1Rc?~@phW3iMjQu#1|sL~fq43BH~?xTRph}^Q~~;&<Y*-@LcX}<{7wjG
zndA_oa<X&EFvhv)sV%_B8NY_&TtU8f5x@$fyh{OdCoseD<Nej0lK*Hz$%CL29|rD%
z9p|!Y35MCYjsXhxFCR5;GLH>|o)FjzAz+u$JVY%~5MaPADL>&dTRZj2eITL9FpX$T
zmkjIXdQHOas|391$nWjCQ8k2iM$g;BRA2v`mWYgxP>W8mp#vr{r+l~&wbg`v@R8s<
zK_gYDJ$G#BvoS)Oh16jMJT+qY7N!=x2Xf67-OYabDj`u0cKxqZyn&e#PAXR3#~luo
zD&;Pgtyg3;C@Xp%E*6BJ(q!baC{^myqri*s27|2~lKKb9*lPrC#(jovRG{cUUjG4f
zIXTQ}Bdf{r#~m(@dV9{o$H7v{svme)!&>iA+*6Uw7?91|;B0)5RNL+}DWk%sbMZpY
zdzVI)gTfW^O$-x0z)?icwnV8aJ}v#O4gD^&WNBHRwJdz6I?Ed|W6^e?Th~@3-XTUC
zI_@K1EX`Ht(lc$#q0BUg#$jX(jOoD%3q3M?5W3Ccc=vtJ=cvLyK;>40YYx+Q;h+S0
zVFX5S5t@t)0?j{~6hb*d^RBIqn6PN)9wo8*bxX&JP?hNt@~OtZDy1V^%hWT#z9Itu
zQsAg}ZPfqUf&Rb{>-LU<6|sMBHVAvXwg=g!J~*KQ7<Hyd#MBr*Cdmyn+2>y^9c})9
zvw}c*I|A{Wz0*7V@kI}?{W}8OtoZzpNKH=uzp!opM=vS*v4tQ4_W*jk1q{L+t28+a
zLM{8zz;h~dPx7p2smOdrx@cjCt-BiFRo8;_91)j0dQqdIYC=)ifB$qL7=%6vVvS+M
zCOyR~^t2!h3<lBYb|rswx%&jsGeNA2O8RA%JS-EsFit^Ea1IHdUs!-2IzzUHVTV-O
zmY-E-o;%XKiQ+WFP+gWuxHA@!%QB^o+XM6ka9c^vF6C_GQVq9s+?yfje%HC<H1u=<
zPe~}<JnScwM1yh5vqm7rhP^4UJNEf7ZN*WHUW?)rFJ9rXdmN%3yLJd#_G0Ua8zx_$
z7&)?E11CDsWV;?Qf7d9$G5LCsO?&as!Mrx(f`7{4`>p)U!emjOg)kgI8=Sj==w)6T
za9Z@f`u|p2bszJ!2p(x9uqV&z1fDEmaf?!6yqfk}CrV|UL<&>k)3<L2rthe=Hyw7Y
zvr4f$higJ&wjJ(G(V=EZKMOmGx6?V3{i@HW87sAK0nK%G`#%eNqzi;IfFx$yNuU5b
zW{HhyVHG26G6B>;e8DYaW1x@H0<7xOWgFa!M?Qs&xrK4R+Nt{F4F)}k=_{6?+5_L~
zH`Iw8+t^?@sN3t6_ek&ALy3V|bPgBrq`_XoRwyRX3WhxgN)|*_U2C1`+SS%#?d<$}
z--z^aQYeV}q=;rv8$CENf|$=lg<3DK{r&*bP_KEd2Cs(NfD*tp`wFqt3XnXe#hB?+
zi0%eYOjbw7r=LF?$UdKAgnrRd^c=?wjGYIZ0^sypl}W4-dligxfI<)^2)4|9w7Q|N
znx@c!49%_TkoC%1Ne%f5HMrxIj)S7vxlqTfncanfN-1~KQa^G2Ddp7H@?1|-b?K-`
zNWf}qFTKS@Pi~BVJtlK|n58t<!S*%!DV1j2d57MaL+e=V`@)f@+VCMZqwDVJ$xIx{
zB2ic9($ljaKjtJq=izUB{0|aJEFfsT&_nMYqHBw{QX=&7Z}x9lPBBS%-X|M(-7|o6
z6z|X)QN>=3?wLEDZ?MpVw+rkT=x7m{$o)oI7C`Z~l}*>zIB_$w7e&8ihvyh&1n15P
z%>30bqHzg(X0`94tYEYvo<p^#Y+c-+*!z<RtDR~p6W!r9@@#BwJ7u{k<svP-6WCQ8
z2Cb_wPcVM>=rQNd7>lwp<+d|HemZBN(T6F{ZEV_&ZlA1T^~ydWlUF&vyf)VuH8&G~
z`23sn0mkz{4bfbf0X89Ut93DdSsOwTl=9XNPP7nrl)Mn1h9Zf~?Y9xGU=~@b4zeZi
zbPPuZYSpwRGK4N>oA7s222VxWpw{ANf+fO7xx?<*y|Fk=(n*FzWn0gt3@Z_o+SCsy
z05nYJ%3oh8e{VV&BSSMo-{mD+7P!>JOvj+9By!$Z5ycwJq<?`4K%V^53qH&s8Na!{
zd+5^u*5mYY?Dx$_8=Q+M+%2L=ocwGU2x>xz4bf>tv0_lhf}~>jzHz*nIriSf@bFJg
zz8m3ZyM&E5jRg<xg3X8lz*E#~80dJ37&s~Ay$;q%4tj-y*X<_rV)(bdiu0!2xHl)R
zquFA%eB4`Vd@PWiZM`#Ea)fe4UK&#T<3;^7i60@|&li4}6*wS@ZoGdcvSOw^^uFlo
z2*pLOY!Xun9~GuQNSr<3rTv)fy>iXu3!ysCN0%?7XmS1<33JLA<kr_?9m6J{RZXKN
z$Azfs0yWYt8J~sDm9a9<yqiM3-aRwmA;(q|s7??_)p!pVi4{mRLV8o?KTR+$Ip37G
zu=6fA)$jQR^lhh61~$vLc?%VWzrO>+sch@^o~J9k6MvqR%vRp_mDbsNjwBMD9y{W)
z(n>dyp0ka<6D^pMpBy!Cy-#o6)T;c<Az9rx>5RJ~)Z^S+yYG&sxwWn{vV}MnAhTBn
zRtfBw`?9L5OE3SAM`E+;JLTW4Pt8XJRYSp=PJtXBRIs`u3|(9yAo@+)gYW|859|!R
zEwv{t3IYjq^3|(2n;i9gcZ!?URVuNw*5dfO>nj!yubHrih1K=Zm@vC@ej7%Imgp~U
zd0Lo{Ua<Cqxsgch#T}AP<;+7@`Kj-PD0Mp@UjLbt`nfE8h^a$A_p*k1_3_7?e1@?h
zIj+^`){AKj@rpec%U|>O8R^kQNzh%dh<|a>{~Nh0>dSWCR?n8_(w^$8m50yc%4=$K
zq*H3ES=YG&?Os*0zYS&Rw;5rNkAHf5qBL5z9bDWjwI*B8c@vyq5Xf9m+=rQXvDA42
z`KK>EA~rV~UHj6*GD=F6<8p$vi(^QpF0y)_-fi887%n2H%q9V-qz`f^wZ6z0CRvx9
z%`#tUjvQRCQG{BLh6T%PJYo7u@_qD&H4{U3mWiOiDh_hRfmW%uEwF*vRwz8b<&o1!
zi&~%hkuZgL9LB^iP3xK4Vtamee<kM0&#3heBvclmu=siPUiuZC8^)LN9A^xU({DzE
z0uPQmBi^Qqm^x<f(AZC^W(M!0dY;!fd^!H;h5E(m4SgX(H#^_?D^Ya{=H#}TR4*cb
zkj=7cwzlY7mN+fgottOAQEpRa)XTTlBVzy2U3d6e-Rz+H)q4~d{cE;RuSA}dA=vaw
zqE<?5RE5tcx6Fp6V;ek0=T=T91O>X>QP~O!kx})uyi}Gj{7{!IkUrdAQ8+Oa3!|Bo
zr3IlV3+!X4LBy8OUCy)s2{~D_wc&pO)tJw4f1iHYi@gy+%g*Fq;Qg`#@6^w4&NR|A
z8gwPqku9m%I(ESmWS^u3@4);Zr!qEfZ!8&Kd_CDU_0a6qx^45ya&i`0?nm(8R+i{-
zSKe>bFR|_)pO$>}xe+0!$Ri$p%jlB~MH*S(ZX<=G%m{&=7hI!8;4()?AvSbJ>geom
zv1+6>(OJ>cC?4~zA#tVu?xnC%{eIl$)LO}fO#ukh#wuto{*dAWQ;SScPK~f<vU6@n
zMzOfbt7I13<8hmFV^*?|lBfx6=|G-vP|{b5_8Qj5g}#wLUij!$##mG&m<NhqP_m#=
zO3FUf(H%uhMGNd0aVgpxuH~{h`S;8dZoQPNy`2=P^bjW8Hyve-!bz>yt~D`CE^ghi
z`A{?VHI9l2@E2k&*A_j!txBaHetm0q141Fo_|tt#gTc*ryo-N~_D=UlPQv{xv|94e
zHYy!Gq2<m%2pF+D*aOKwy;1o4N7k8xa*wmVv3<=reO^4BQJ4Px6gBNa^7*d0e$m%e
zU(6V9vsR(PX_Ooh9DU>FeWP=%OZSMMlF?moBIRYVM9E#V+a=-Tdz$1C)o>Y_6RRqO
zo6$9**jTi;P4?ohn4YAUq)lGgYJsU~t?05CyUMn-`3@V@dQvcK8^*d6=AA9}&Nkk_
zS{KH3Wnooa%kzMWw6&khRqNv<iZ>f1FztSzop5$!0<-^qZ8v(qAN2}?JrP8x260Bt
zDr92Is>0^`hop9a-h~&WkbRmQ*^3Zd^ey0%M+pjgB`&D(Wa*Mdua0A&o_uTY?|Sk-
z7fW14o2)@Ch9TwG%yc~KAlla>9&|ZW<^sIs4nQNJ+4nCAEibf*hEE%K^+mu^`9*y+
z5?7yO54?|eneTkJRIu)MxiI0TtZTHTYz-Ac*f7Rr6gVyNzd`hx;bRN4%4c+OcfSKw
zKh+;|pUTq!|A}-74aCs3?9#zN28xq6VLOE^y<vQa>`Xy%nQ?s-?3S_WU7ZT*WmFuT
zGefd%^3f&MbQMmr#gkS`)=}$;cX$fQi{hr9Fm8_{wDmhv`~BeAUp0pSk4{r=tCR{X
z;n^lL3Va9!;p+$(#L3H#NftcihlVoNEDXM(p0|G6aKqxREjK?uUDz{+(cjWoecj3_
z$lfUsXAPBr2X(-GnNA8?{C$8+m1{sF?Y|lm{dccF0OQV}f~oQWv;h!@m!qo1QOIhl
zMIlQF8J{RLCh|j(-|D17=&=SZOMTy{6ZSF+ULi(bvJNV&+wkG6R}W{D<_LfU1E={x
z1Ss_LS5tMaz5qF#B&o5taezVhqO-=L>kV+W_#peccErh+>I*vS<$O2UZ=LnNcN2Mw
zzN`IFA8~*&gqE%tbTTd6{Rwhliz4b+JrE582D21OAiq_@iVFAe#aAjM763S8aq`d1
z`uDE(-(Txt0$|geyoZi}5X5hVvyxB9y-ao<dZqKD@Zr_ejZ1)*vjmFfD^l{MRh*!L
z7xM>+L*9j7Uk8A%vkhX{x*38I(^4Rml7h@j!F-@B81|3D#~Qn*Z0nH>zcpnl8yq~a
z0sY8hFHXo!^=0QnpE+S3aDtITq|@82&Y=-7yEf^aNOP60+RyqqCE1%)s(9Az@77D-
zM1S!^53@j_>N;?M<^LCYDD@FNbSLF+dT0;&#i6>Q0FIX+h?VvLzrd{H@4M>1>C&u7
zgO2q@PsEYzK?t(5ZVY?Up8yi)ROSlLcyNzM3acnun<Wme*TwYfkkxTe?De?EFo{~2
zb@%Ig3q{OZR)gH?O)+A%44YGRAFLxtkcpMhyi^&rXT4LfDwFK&O?4o{cc^eFb`G9k
zzR1o)v9#x;{_)Em%YxcYYDT137@~g|h>pUc!AsIlLm!qrV@r*rUA+nVFoqwmJ}zI;
zpO>ZqKiLwo1dvi!Y%UH76EsMild3Jdm#B*-2m6Aa$^Il_i#uET5qKR~L<d9+#C*=A
zVUIE9yE`WH9Z}HaF*1ezJMOQ8{Fy?=&hfVWMaS*!qt(51Jm^;?SqszF|E~`XyhQ{F
zM^NHVSBGrN8iVd{+$JdM9E}H1-&q$~5)4XHAZIk{F8VR&2Jt^V57-lKU|j)zTADy_
z(Id0y7qtdXt`{=vz8MDX2k0%9KgW1g>_AnA22lk|5~iE)XrZrIx!6UK2~S?!*z-v0
znS)jF!i=rEG*%VtG!w>4x<OX&iP~Ly@SZi!?)BTt>2!KGq>hDxdyWxRBn{5mC9xpH
zG7Csr(qgNH|Br{t9Sk_pq#M_%fj;d;aEJYg*HA}ztrL9bFT7TrjRQBsC5l(DU(m0W
z05ZwQxjOXDc@UYq^X^cuUoT9lf4%egIcx<)uuC#v<+MT5=Z<lqvHAh{(9IFxJUpTU
zFV@1yK*HGEBPNvh%7}t~Tb)!t*QxOl#%!Pn9)<=y%Y*CHBLDJ;z?VXU^xhgTzKykE
z6M{k*F9A(Wc+ubF)1HErF##PW^+OhVS6FcwK7?8Q&<6tMbs`Sm!=|4D(%z?M#PO@_
zKS+*8Y9B5@lrill#X<Op*pwaW2v9{=F;T^|BZ?9D2-m+Jx&MeD>}9teaRnJYfx<@+
z*ojFI8aO)4IH#NeQ(No6i{cl|S$$XADUebhQD_ZzV@uTDv3bx~<R$n)hoOzI-;X=f
zH_`_i5T}Bc+ni{hdh}=Wc7#uGKZ=-mTyv;_DZ(@wQ*H3Cz1$uwk%3uXW8r>Xy<8Y|
zJqt@A^NN03-M`8*-5uG^-HUu<XwOyhW+jq^iIZaOY*lDD^;hFd@3m&<AHOVMQn-~X
zoi`a&%P+rlziL4GhTe>AhVUJ$wV?At+`-Y`$agvvts6z}Uf)&u8r!Q?5<4&}92l;9
zRS6g2v%Py<yT3T^j4@_;I5UyK-a?A!W*sc-T)p^w1Dt|Ms$mf4PiOjdX_EKbE3cew
z>XWOAx&i}KcTO~lhbBAqjYoHqu|aFOl)@EN=p*~ywAKNWabVf|5g8#{a7D{Ca@($E
zZI8Qx_pl6H0$8}4p&;>iSn$td7h`Yru;g~gL{m4bZPt3zx8ckY!?F1{?NTmIeE!nW
zLtj-s4tnveD}>b~K+ftHy-?&ia~)I^1(Xk=WG1+Yi6m+*PiWiS`<ZIfO;qOg%Bxd7
z6%i!3-CG;&8NE+GH-D}jj2a$49z*e@hSz`b46jd?{G4XR;KH*N{$-o=vd?9Kqobmy
zBX9fC-<&65CDo?&jqVBFJJ?ByXwd8W=4Oe2;W^J|MN8A1^OK<7-DrcJjc=yl3=M5g
zWq<x))@0?>hGHB1vmKSYqjPzwg<e%<n7`t|J$a7R>!e&Bph)z_3+$?q2X!Vpv`2T0
zAt;7XBc^@UF^4Z#&|6mh%N|00FZm*X^gqmMY>(H&?J&R$ER`_42ovhlkH+5HT01!1
z1a9LeIZ7!?Qy`Ig{PnS56`8}wSasOFibsWVo$q+R=X*MiKAbv0r+kLjL8!beodCy7
zA*UuxwCGCs?2l_EqSVjE$Nl|e<L2*rhm3bJ&Q}ZenpSqBI3tJ1T5R=CJ(4;3c=4Kh
z=dEw#ewUy2(%fw{{K+%{p(C7FRLT9hm`oiE4Pko!{l-;!X*HE*x!Sj^56x+MS)C?^
z!va?0U3V&CG8-~m&Ah~D;(j`kGHH>ro<lGnp3eX2Dc^&aGapFk4`qm*rYY5Jf!yk2
zr?`|5sZn2&Q38V%J*Wo3{U7+lcx(eUe!0|dNoU<aN{M+*((Lhj5~{stDtsP^?4DHX
z&>EZB<i?#VlRVJ(&&hJ2t)COasZ-e&M&}Hl<O(|P?@oy|K<&r}O9B(RJ10*?3pGC1
z2fGh|&2nR?d+1A63}upGTf6Uit9G@^qf`uM;v=*yMJY#;6nCuK_NKp7#D}!-g_Xx8
zPh)cNj5yPT?e^rt$-oO0oZmT11GNiL)8A}DQYLB>r;sPvnr{e)nkkBz1Lag%+Lp<9
z(}5~E79PKsag$tul@A?!=U>e6R$r5f+<r!*L@rcEZb_$^t#ex=_k%qN*@v`~>3)n8
zz8A#PHD0~CMo0RBWcg~)Ytd6%NvHP-J&iW<p6;QqZBDUFbAIZaTk@^pC24aLU(|77
zir8RiVz%%t7WU5m6g8<<P?GkATIy_Fw-VDc2O^pg+K70)4P&s5wo0fUHDAM~Q7ylw
zxUD%zl~Nzw*F7ajYn9B0vFO{559yc=2&LkJCe!?aG}HZKfgU_DlMu$ih2hn-(hFK;
zeD2pHd#?SYD^p9Ez4<XFyj7>4+pWAC&x$j1n+m&WG#XUab<ykYwTZt_&DeweKS<O*
z755Y$c(O^7mlgXSQ#wy|{8-raTFjkKer@Vy;iEmrPqAu-UJXu`Z)3SGutV~uyiq-q
zXVsxUcM-<P(#X!+E6ttSo@*`q+@81fl@JleP&nEnNYv#_81V`ljagGk&&I6y%*rC5
zHcyeNH?ux%n>8A+j=Pdj!Y)W_BXRE=-YM0eYk9JRG!3qqrhG)iF+UF+UWiv%>My4&
z$Qi8)5Qj1qCx4sCbR&?!HhA6>s)?7%1OG|7<<e4nk{gvp(PLMy!L~T{yvRc<_yXR(
z=oQlP482Tv*bjM?Bmx-Kmc(YI0pZkilc7oHmiP}a%LIM19nj81Gz%30!{sD~7zheP
z!UseZ1V1PW2{R$)Nk>Be<T}l>4PKOeokS4?5>%egxt|KDUZ+F!g8SLV{jk{Eh8*#c
z(+BPT9W-!WaS{)BtL`?nFM4`d0I|#fLfgDH{2qgf*tCa)b%}~79<?QFj4T6;^Rw>=
z6)DruC}dGB7&MJOI$-up)-`!K(oPqjRwm&uqN#9ECa4a}Saq!DGI_@FK<_v32sqMG
zuxO$$3nX$%O|u{1Z)S59yx;OW5<t@QCK0_|4}RkvqvOkAY>8Noy8LG~`{$r!-&&hA
zV_rzzzD*lW3PdULA6H0SqukA2+5m$d4Z;h2-24KUKUf&#fF&pbc2QFVYr}A8LBA2a
zPWjYK)HMKN_TjvD<9i-l12gT+`V&>!oU%n%3!87|R@VW()OBl~5@}Ez<fu$JT0eo$
zo+&aWxX;@FW@ugie@b=#hqPF>qQ`l@7(LXzvNEiww2t2;FDGA(y$};b;!xhqKDabc
zt$-^0gJgCLy$T1=NEJ6(=@9%QIq2-Ev826#zs4R(xoF})hI3yO{-mL<7Hvd;2K1t*
zIRKOe#rojYJTU6MkXj^J*@wknW{@}>hP3-4wJHwP2?`DX)1`xj39xPFC^~(`LE-r8
zJH)K=pJszgttlHmPY#drdC&1DZq+mq+BLN&%yn@0zk_k%Mu(&R<i8_-KE-(wZe0M^
zoZun(0GN!VVt|+N-DKiS(aNF+>VDwQF!&+EZUNS~2X_<tIGIM7d=e4cd6$auqQtc~
z0jIC)?n#HA7re|sp)=5MR=NNEQZwPE9-A{ec*UFiU#%9yL$NQjC8wvPL7?IYi8wlA
zMaWzAk#GBrUNc7O2FeIUEa>au?pXnnEzpR93$?nX9GeRsn?(9;wnlPTYJj!7pX#F7
z>8MQN#&voHW)&vYirJD;Z|@xDHy&vl+4U;>St&6m>nap}W4DvtWPOupm`p_^M~o0h
zZapb}8^T!#EaqPH5GncA?rOayi#STxiS-LmefaPGRtkb!p!w1-QMfSRcm*KrZ}6xO
zcbBziHY&JpPE=ZaLiB0Tk8`lAg_Gb_w11+YoTnz(3m^sX+-L6D@bDEaGMl|xlkzBH
z1CZDb6i-;neIs|F8@@udq%lL6oS|(?dQFu=D{D_X{SOj7w4Cag^Wl}`KIb9<_dLSQ
z*s*QUc%wB8a~Zt?mY%=t(3#kn;Z-$Ao(V&oQte)HxH@$n3iTFBnLRET0&2csqgoZj
zesnh=+$tR-UIYD|ED^YPaFU3ngr^6*QUtN)IUz%I7<#6S*p>Q>(Kamm`(VIvFw}1S
zF&5upT%C_g&%TrA(}`UayBZ=hlN3`Q!pLz;I#P&?E75!()9SKK5e}Ok=0`6xWg+G@
z2I3HbK0z0bAH=|S)!zY_Ju5w)_U9aKH_*IpK9AVPfsqXBoCXKP8Ma`nllOzkm?)D;
zr9LC%_TV<bTk}%AN<qPTc^pLjaHw`7@bv(4;XpK8Gniz{9nsHwkoLvMi6D<LS;M%T
zr4ov49)^Z)fV#=+`Y{FIag^M|1DSks??`^Y-1V0XB$yF6fYu<eobGOfZv$idSFER=
z!H0~=Kq>+O=;kajTfJi#R}eY&0vB%r^u%AWUj$&_3Rra$K6ffagVV&=!Aa0H>qq4f
zxWJX+KS{lheFs8^C>HYqEV%pn+TlxpzP7A->hM(g78|DC(Z-qwDu~|!Q6A<kp$CTL
z90V7y0&GjCq*G~1$(R?XC2K>JZ#Pbzc<*xzvSEmGBh=mi1%FZN<qF(LjR{uzuSbNe
zmlGx$Y$LQu*NZ@sXlb{1K?JprhwYQW*$%+BG;ex?Lcs!T>zVE#p$CoSTQJ$iA+}DS
zxN({}N*Q>$ZsZe4<@Gp~xv)iTX~fqD+VHgQ7)!@VV7r0Q-Aq~GwOW|`DLEg5oh_ot
zW|M=PIsy5U)BD%IfaM*f3~5ZbRKtDE#DJE&IDXHK#xGxnnth7w2fLN9M#8g|`d*hS
z#bvUJ08W+RBM6W`;gt56m+Z#lm~VkLC-xGlW*PDQfaDp?xn0m1BztOu&quUJz@ppk
zq2KTXPprz6(ADfm$p%cabqQ;4(_6Qt<K(@TZY^E~<$MdmO#m#sRETuz9gmHaVKeZ6
z;Gq``L|H$egs?b?4&a<?b=H#B;)|5x%mKOLIqxu6Suz{~Fe*AVQq&U|Wm`4j9prqW
zL(NpAjU-I_!A}a;#~KoJ;!+g8#9SYY8Ue<k=(Z>d%!#jO-A6If5f)NT+^I#t(bSl`
z$5qLj%OkVmMWyWt2pObNf|msAgy9ukl_lRGL`<EOA1W{FJGL6tp}mO|ilSCDOh(7i
zV^ek%!99KR0DXWRn=npY7p#^1;UiEsV9Re&)Vng}*na)(W?A}WT?&+Ravj<5r-FN|
z1<Njv^7>~re?k;6?SOA@{4xO%%(pFmK_o)+)tc^jyxB!znovh3*g5Nk)9We2E^k{V
zimAkW?N#UAP{;W1Ls~!8p}pDM>yvnfM!mpB7G;!nRNn&>McrCrMdbGflGMZY-)j<B
zy=lNonC!6%pn;g2(BiunUiZDnJI{|;Rd@<teN$9ddCdJYC5O0phq(Coc>h>18Y^x@
zocR+&$|6Az3Vt>^BN`?r4a>j3w9o%B=c6ijamCH~8vpQmRyXo<N~UL|jCu-0+u1kO
z`b^Ic8{O_!uCgF^VSniYhAJ`N$BKgLsh5om-R*Sa0iA6vky6i8|CW%nfE3hXvnhvj
z(W7PFLB~G}3OR*WUJvW^tAaaa{J7v=I6I;`_`UGFd>NZ0&Gv~r{6FI_6Fs~$@S)(5
zJ?B<(T2uz+(oo)Xog~ZITT!@4_5-{XLG8;9Tkql|w{jf=KA6!`mVI+U@w-XxO)CbV
z^|l81KA-Xt`#e_Qf{Pd~BdClf{nb$FzdQ-R{>;@vv*#|4oZsDG5H>Jubd0K<VN)+;
z4PKLF$6x8kJ54OLYu~B-{8A1!)N`fn*z&O=N75S7AmsCf`w!OY>=>UqDhn1<_Cz8#
z`A*F#mC3mA+yri<xe-dq{KLfIxbV@d-Fo6KJR$m}TImchzDmUt<o?y9GybfJi5O57
z0=m~}xY?GO9xexm(>Y(tB9)(pP#eEAr-@uJ0Z7YqF=gw_SI||VCeW_}uh$oNl`QxC
zrHYu6j`*x5vWCx(2Ql0)YFDIJSZ_FlW|K)zh&+0bC}CS{(G!DZSmB-+EQY<}cd=y2
ztj;-CAtAwTt86c|qqkq!#7d2_p0gXiwY+O`u8PUxO1Rn^?pKNUu&d!psddyfJ&KHO
zmWgQ4_UQp_pKa8++uie*omg+jSeH^TvcJ0K=()w#ywy4E?j1DI7{`b1u4hh^g~wo@
zy9XQEG^x2Zc+$}**-_blV^*TGqM<oKuR}#b@yJ-_Ko`*>@tMe@G}#w;Am}Qp*_ZvE
zb{x@=u_3MbG?^nt+eq$J=EdWc8Zf1$$g%8I=#ceh1(Uho(-}XdaQ#6^N!II;%@@N1
zL12SyJb}^HT?m>yr6uDiTCXisQwbu1#Wvf1_+(%(N`7=p4Hcep5>{LVJVo5K#tvcJ
ztIMY9+XUnb1SGquJ#qVBO!(|s1)tX#KQC9@ZBZJBN!aO;$t^POp9zRI+u7TYv2C`E
zCfM_jlJqO9%^~CJ4QnNbDRn;3FFZ>#!L2*D2t}X5I(I8bJa^|%UG#f{a^!v|IsMLf
zbFV`ucZaJxC(!giNF8?h1vBlolOxMv4TJ3XvtJeczEYRamf~90YcWmC&nrKlI)S#0
z3p5V72El?2!;pPw3-v}+Ms`iLPk_&bk*loIw^fDC|F|-$D|b^p)P!<H+To$?@@>6g
zJmo=7b4?ueIKuAM$b!oCr|_BG$Audu^cGs5DtZOyKKEUW8eOHh!lgxZJ#sitmu=!t
z**%I3qC3`-NgjX*iiHG@Py7$dSzb6QK5uFxoG8JwBPNqe_R&C5mkh)y>^YDLAx-))
zfa(~q%dS9A=sUdM1`^O_kH3B%si7>`COIfm_7}&#V;p`z>WOR#9-;@SMD#1@;@Fu5
z>_SS>+fVnJJNCJM)?8L$d91>v*~~goBfAIEb|3^N4YF&VZV-$gwo3s@LSTjcuoH~4
zyXI-`o#Ol0LziT5U%YWn+3o|s&oIeVmR0vI&!zO^ZNi?3Q+uTPbxy5$>j}kgU-syg
zNi^`hN$gg9N;de?(r$g<@Lcwz=1yDxeRw$LlT`}#?i28_AP1uEt5&lnL${e<gDB~Z
zIdlY#4q+g|u=nR2Fd=&}!KKCNg&7nV>ARnhI*$5_&KrV@{P_++k1#q5u#kh=K9o50
zSla}jRIYy@;*i6|dDYL`7pYB;!Q~O;{0SA*)7Ec3?h0qF2N1;;!tRmPYw=a|_i{8-
zF>H{K?FYB#JwV|D1Yt`6dCe>44hTBU=2mv7f4`g-eEUD*g@1=5{)fjQaQDp>54+_b
zktwo0i!uU@r!;284C5lZgEZgVSC-9S-czh@KKuZij#>iZBz1tA$%zVEDq}4WsS4*K
zt76#%8173rabV$C2iQzGC{6Yk(cj^2!IN9`XYvey6-{*KC(&W}UAFLC$~#GVpJu$o
zNZ6RnD6pMdNWDsGAj-f8?6wZABMOF`cfb#e1jtZB>bO(205Aqr$3X~fM)Xdjf`1*{
z@5kLwGVx8E0jMqL+<$5u=_ZL0<Zqz2`(bgp{T6q@RT73ebWxwZQqaWKJ!%@2q~ON>
zYPc7;YX+|PWD%3U_rWC@5x9gQK+yqJp{{_F7iP=CbOSRfBe8KWD1OiqE|o7X;2j7R
zy@vyYnD5%LQz`ZItvD1xUI=^(2fp1!_xB?+_{6n>^|)f-1e9nY_aBkY#vdd>Xe`X#
znovuOT-Ni{!$Ckf9!97ISO0vDb#B5}CiYl1lT(@=5J508*ZMs5&pVg&zxm$?9>^A+
zSQ91R3^bb<DfSa)z|=nam%FGsmR{pW@Ou`C%=R0>gEie<=xKf%!tR!6&Ljvp)?2_$
zw8DVCuRt{sBC0eC==LWap5bj+g0Q&;=XNDpuL$4K(j2(?Ej27i{zI^*ckfpAGxSsk
z^)ADnPE(|gr_hk_Edxr2iR{^ja>vBTWKPu(J_0tmSx#6rt>ywN;yWAy0MJC%L?9({
zI98nL5iaHu5;sPW*8odPL+oR9fOjNh3DEd)YuqHC;c#0@Re;a}paUiZtjFEK<#o+M
z-*4ng71(_Ixy$-d2*U|G5L`0ifl@Rgu#_Q$O6tSoc@od=@f(MR3sir?h^(!c4E0DM
z#9D_^4SuYSRLbgD3XG;Bzgv_#b*k>kR-;Y!E<$$sQVzKb>|60|%@b`=R%zZ5L{HQi
z>6*V#&=;HqaLyGx0RI+&jZUdfaPKwI!7{lrVGDE|>Xd>)2_k5u|I<t$*oy>X&3}QP
zwXM#*6T=7$7eT%p2I!&9rgk8$<1l&x5~hp4hO6L$lW{v%?~9V=Sr$h2^`Zu6(l?6O
ziO}i$B9MwvB@r?)cc&%XMgS`4pyb%mxQ?9>e^z*vx`p+blF|}4)^ll1%uuSUzAq@c
zPS=+3YI23=i@GS3c4o<P0VAv5V2>{a9?s78S2L&3b1H(?<iTBQxBQ=NcGurV-FOtJ
z-N*c`_)9{^BFlSAW{C-xC^6&QnrWJ?OTjvcmwMT}<nu(iN@Yh;R}M2^)5?Y5M+GCm
zr3=O~CLXyL5&SXe-7cUz(m7D2jkJ!<vB|S?W3cCZP0uAk`hpV{2}^pce&%w^jrPSU
zGjZ|E@*}fKmt=?XaUnpiAa=Dl?T8%D>Soj{8v&l8ion@n#c+2c^Ds>ACkb+&OBL!k
zePccVC$`rPw_vs9OPVgsPnYXV%@jnsmk`BS_z+3>uO`!6<Qou~C20&EjJ@72a6CED
zzs(ZzCEaH6GwTb7&;e0P)w47+Ped1Ui)NL2QYfl9<WRuwUNKMH$ch`=RnGO}Quf|!
z83UxEqy1fv059=V<mc=aTs@TP*DhE(WH?x%M68tB>_Y@@u0#p%571x3xV^?Gv9%V6
zct29`ngV3T&U*Cb6bO)G@qk;chsO0!=Ecd&SGc@C(HT!pUdWyzb**V487i2kHn!9k
zk-5}}utb0^6?z+7QTr#sU`I6<u1tgcZhl9wM(VkMSLYBv$&x)Vg5I8P*{a;=isV_1
z%3JLmjueLGJJST00zRqGx9=sErZ~0E3K^uR_;l_ghNMZ}9Y0nwjlEOp>PF&9o%K_6
zL3hJ73}rP8z0l*rlBbp!6D&`cXvXC%I<$ab#NRg;5*c{cR(zS^nsbv^s+M|Rg6=i!
z+r(&r@ar_eAqEh2O%rioEx)-ThR4m1?arDIBy>d~VeHV#S6n=`&Him8H7c@WQeq4D
z4<9^1u_^CE4F~u{_+{2y46;`WFku}IU&fPir4q?%=7RSGCqZ+wA^A#0Uu*LlRwX-@
z#J8c&>@Sj4$jW6r2A&k=ElT!dhFuI=R%aW@REKJ|*i!;D8k~F5au#>R3mLNv6w+k#
zaU3A&M=Sizx3iuq5NtHQ)RTYdb8m@to~M4%XRc?*Tet`r2`j~&Ot|2?^pB(A6_z(F
z9Bh5IAM^2LjFf+scD|HODf<eWas-jQ0gh0Vao9t?n<NhtsQ9ehkTgkEzssFap4$ju
zQ#uHcr#UBMCS$l>4{^ye-M@D_vde!EGmJRy^{iTS-Rt@fRft{@<?;C%@={rN&2o*!
zr{;%}@CH%T#MpUjS=LxfXMWY$hFOiz&jnwMJ2$U|BZM{joAgqO^%lJkO|E&Vu1DdV
zrpf}>3d~NK<t^G9UM5de<xv-L>Ww`EsDdj!Rhxth5n<?g^FG*GA%Xsm&c<A@sHT-D
zn=N+yLB~6dwTE8ia4AEFKJy;s)}&K%tKMVALSQ1XMG82BK_P_K301WJ^b_JIshQkE
z>h)AC3l?|br7ag@%wj&1y|@W86vEGcN)38zp46F#w)iS_AT?q9R<)jezQwVfai&b@
zo2`VDd_>LJ{`u{7-XL(-<6K^MiyBmlauq61bDR=yfp#TRh_4tC;x~31OP}0w;7LMM
zGBVs4arKt|{MCE2Con*pnrB1_^A_G}vfk~(5AJPO|3654c)%=4$-4r)+Xga=z1fy;
ztN*HQb<>GcyKS)-4^L*AUSPK9m%XyV6Fp(WUvkEAg}>n2aQRHqr+fWmQSPD}138oL
zQH*$<qW;x3Qtqu&ROX2a=j`ckwlw85IjVcih<Y1n4A?QR>3#iD^+n=v8q09eJdtXP
ziPyJD^ueelKk`yC#T7m^Hbxgcii^F<^H~bF`VMJO%!j$?>BJ!*9w-RRO5GXo{16sI
zR|`;)FvCNIO*T?qRoyZ#O&CSFcs~1lN>4)n9OE%k{A>JtVd6DxXmq)6g7fvN>lvRa
zl`frYU9{H;f63k$uOOViUkC6|HeQp?gZI^A{p~)+V6AIqRut2aKDR|F-{q3M5vtE}
zB2IFgO?=PT*iKR9pOqtb79B*?c5jp&QY8c(?!ane!c``aYqUcINjwLkXA`e9amQY;
zsCu=Pt0`sa5-Hv%9dbiuX}9_b1qEk;tI2w?7f85o@uY%sQN%h@i-7f(-?6T2p(+!W
zc+Pe4aojd9+d{gP!&}`9Z>Du#fNcmz*ane-FT8Kuj2LjGDJSfziTU8S_fMcD^F9Sl
z+J$kvz7$cP@anckUi@`?nNFT)Mcr%ojt$v_-++%DYUCrwyR`2V_#z^Nk&W3P<UDfA
zv|_j*8CDg$YcHX4>CM9&WY#}jpdCxYqnW5N@1pyaQL9T&)o-ZTUUX*q7<NToqx&lr
z9<+2W-}u$b*&3r#ywqhw!ZqXO1gLc-?Km89RAK~-iD(;%1x4Uh_|QvnNcE=c4E^0F
z8I=QJ=dF=h>)q26s~czb6IY3Sr)H1Z-x^N>*8X3jJHEsk+Ke_7CQk8GR*YX!o^Egk
ziEPFcm=tXK-OFQUA9OeqX$-s|0}o4s#UBRn_lQqv<OcJ;I%3Jg_1HX%e3a6CO)7Ko
z=<j={|14YoIpZ;9UDQpV-c!)uc$U(K91z*`Zvkvmn5vSX)}t4AfkA{s|Al1o72$iY
z2-~nxKvOGN8gE+P*8IYu48v_dzhFHm?ZOdJliPYiSz+#n**+#hx6^U7xf6q)riI}t
z0Jfs1@I%b(9t|Ms>~8?{qw~wpT1OU)MZOyYgTd|k=vS+4=-_HZWG@)Ic~CTeJ5!hM
zo6h<AanjM?6m>BAa$rXU02&kulZ}@;z)!?S)RtQTBO9Ox_z6*sh;iH+oz^m**97Cc
z$^%XBt$^SM0OZI{Vv3ii9;+A&kGl2Fm9MEU;qgPSs-zJj98msGdH(<YIV+s{y%6}u
zy|9lzibIaiEZ@M2n4dVkN*DP?(cb%v2yz*?XLshJpXQBtngk?d2)BH`Q~oHBrZ{Pp
z8_pS?a#d)q7ekLd?tS+_+X+Ns@M-_@ORw1I+(mOnkQCgR1<W~zBw}`cA|eQsk_AE1
z0%$i~cU@f?-4O)&onKuXj2-zC%c)RShKC<goQy<#Xpup+E<VtQBK=y=uTxRiU^tB6
zp!7f0L%j>6=o|+DI3myhVjce_;!Fup&Ys5K2iYRyFOpV8>pvY96|BeW;nW_0$)&TP
zEqD3f>ZTF3mR}aYmU0n7y15-7@#KK2?=Po(*ER^3O8*M_Emd3c1^*=Qk*76$XWFRl
z#?MiMyeaXHvrm~NAuQnZfrh9HI@5^}S=2aRt(!MB+a@?+m`Ux>=^$h{7V`E)$+I){
z*LYc{K*yv9BLNV_p7Wn-C^04hae6qW4r2YlfsLYWY!6ZeT2has?0`Z2){&m#rL%xA
z_Xs2xpvb<7_D5aptujd+9aWhb9x;&<LHW6+HD`uX@V@YXcSB03@vkHie=)#}1SizC
z)=`JCxw0nU<Gk5C_TRRSh_A0Op=|y*@O1A7>dXGa2tpy!stgYWY858ykR@HVmgFWm
z1#YGSHNFSE>UcF91aUcysEKE9cnlcb<|P!xJgW3l>gaPZi@0f>v4OyQf-C~u3R;7K
zB}#&K5^OD<v^4vN5KV~?(C5inOpdx^xgIMa&WYtI=uiGG8vF#Aky*ueEHsiCQbW`e
z0~cR&7Vp7l#JpnpRjql?!Uqh_f_qd%-)aLNNyrAsG0BK3dSq%&?CH;1zMU7`L<Tk8
zoNV6N10enZL+y7Sv?py;J~cC<SwL`q8Mbu+8Ti>t8z2uTu}}N*D*LzBVGDP<#-U5w
zpuS8Brq^1)WafjtW7RD<7(yU(Jxe~>MZu-i+Wy?R8}%#9$(|D@K*TPoUE`j9zNe*?
znEDgKLOi9<<^BYy6i(|+1XGipHc*p8E`G5Kglq!TQ)+S`<ED>Nr^bu8>vvAwnb|uP
ztVZk<ImOvtZjhpj`|zhkHL25=Zm#PKdf#u73yjKy!!jQNOz{`)wgLUoo4@X?lLLYw
zq=c@}9c<91sNIA_DqhjlH2A^QvyqoG)7}sZG9+)`E`#Qi&5`I-%`e@Ao4-^A$c~gT
zHI4yA1R#Z=au3*j0evl?mJK8p{$Y0uzFBp}8MViNA(R9Cnf`{!%DYg40$3;{;y_fi
z=sa#}F+vI$Qw3fE4^e`RP1LER+kJ^}3*cA`J=hEq%70+u!T84T1gM~$OAGBz`2OQ^
zy2ukCh~LfxTARYaMi-C)|2Ka<Twk1?FMZ@o(Z<R=Ee)bJ2kPJndZ5w<+%EOi;2jDA
zojP21Oi3w;-)$>u87LA}69GNFb|0;Mnn>dA|GNi24lV10P1XMLv#ZwvM&ceB;2o&6
z((f<;%}TCeZ~;&sUJkF8L4B&0f#8b414I?eo>xmK>UH&Ae5X1Yo_RDST~-EIM8Y-%
ziB-Zo_yGIuk%h613Gmho-|d~A^PSciEKInZ(f-t&Us7;8hp?W#spnh*4B15-Vl3a#
zEQ*~b*;aog7(sqJZfPd*5QH9PEFY!-uR22g@`K`|D0;ZG`HVUw62;lBv&&yVqhvUz
z`sL5z+w^t$Pj?!xx<<WVwO8&y#Nik3+7aa75P$)?0`7vr`{Us9Gm0SimAo64p{fwe
zt$wmiSFD>N_ee-jWP^|b-XyWv?}xNJ$<?>=c8=xS)JVcPnJ^T?HLOi9E`)X;vAq<J
z3~88}E!h{_LVD88l#9HpcnLJk6l0~4!1J3r`tJq(ABYP7)pPUJtYA7ze!b~1fFH4C
zg^@C1s7u+qYz#L2Pnjq{xy<%b4o;zz^*_u(Pp5#&$PQfur~%wH;fMF3OT>U|5~v?V
z66;5KGr0>*2)fxCptb?Z7t>P2ZSV}BvNfCj>6p9r+ozu(a)~)Yh+JYn>&jlRj}b-)
z6{t=6{#z50*?7MBDnNl@e{&Sf`+IQTnhkUa=k>vUxPi1Pee#xY4uqT|ooD(cT!M+P
z?&C)3V%-j+i^3qBVG^=Ob>wSIqmRL<S>t(ZKp`*dUqsXX*{WSPOd>{<@`)q;?OYXJ
z5~^U70;OD*S@(Pc9X!qBl4*?3dfHnTI?{gJ2tlR*F$QZbzq%}K^>S$B6Xdevsr?8-
zi32Wm)o}OpT$SO=rf2wv7a+;7+6v~{4LiKYEpWzRnHHMHe2r;UM^)^4`{UknM>4;@
zSwvm}3}o|1V+wsR>_y@#(-K$tj*$qU5_i=ij-k>H|7?w~|EE~{@184IqeQe}@D%$4
zXRJZ}50(M$8jHPPhad6Jocqc@_RN-C|5Sp(eIomqTGRaIA>qWA{bgwo`!53SD$xrh
zv*?mRdSpAlm`HK3qz!~1*F}JR@Bh)yM&oa};oGl5vDvwuH<+tbbZ0ywH5ZMA-XScf
z?9(7&^h1`@>JtZXL+<KA9@~qE0*ApYfuM5g09t)S(>5Bg66TCd!VuGJ)Q2vRX3UkR
zOKd*`=1wCsQsferyq>`(jVOpubd^34Wmvo9;1WHVvPTM90!Li`!Tdi+&fS`u$5>X{
z()u{0RBoDW<&QSN;h9{O!X4I2YrY7qvWUs9Eo{px27AW)`TALXq%5takOH6WM*P$p
z=rJ=h;ZjCd@yFsauVj|gcpDF?p;ugyhcF$lAV561G6QHkM@ngIZgucS`9D59Icd{I
z-$@>5$m+wpDLRh>%9qyQG9CgM(hz!!8>Q0V;chaK%nrlV5(RHU;R@kW#2QmDP+TVN
z^yPy%1VQe?QF?ZAz%HbE8`X`@G+OV(`@_a9_H|7za9nwI==*4I3V(I1)~QJ~NK8R8
zsz}oIms{mu_6kRW%YO<iADJx#lh}gD^S8MI@e81QNHl)}(dKV62BOI&<<Z*_x@o8e
zfBX^AT#erD1e%RV$x1e{zoQEqqhL6D_9hza49&){{Yf;?;+Ha_2AmDSU;0GJC;?E1
zD5(Q=2o9hs%ktm%2{caJqj+#^F4wY&z`X;e&4HRL1u#6g1~Pb}b&&DP;KH;ts;i--
z^Uw}2m8<PYqt6zkrJIW+6x;Ou2FmGe-=zBNn%hCT^>&-M&k+Bf-VegNgKLAR_4*}Y
zrGy%{4nikU1=c|%!(q}5Bndi+-@qsk@gCC$5c=q*YqBFR6Qhx{p>3DWKQBI|^?mss
z35lbMOx{8#u{=&meQ>G?aBDM>39!2O`9}y}c(+eh+xE}KJXWh$*K&{f&L6jr8Ku>)
z!OjX;UJ+Kfe}O^NP8l=;{<NvomHhglvDf;BRa|q7LCQ@>gq-{j_NH|F13)D4ybInR
zSjC&7Gr9|ZkX(qst2(dkHh~?ntw>j<&Du1)VzI)!wdwdyz^(+v9+{pO1Gp#45le+2
z)aVseDS<6g6MSGfeAqL0RqhCdu(ye=-{)k@o3`i^a1ly;@I34dKot|X+UZlPyFyEl
zFCAM$sAdMEQ*$H>s!7G4ZEU5UzN2XAj$V6k$g&TY3I4HRCN`2L@1x0na~H5yUgWFV
zIcOU%5+`j`8)KzE5~EM#e-&Z=Q-qoa^qv;Ezk`pA5p^AE@3QRg!6zQiw@<tC5hRG-
z#GO(LoHS9d5)*ZwezDkv@fDti>4rYc<kP8PA9Lj&LLEZiBBkb%C0V`djKs$#i{6pp
zFA{U|W#U`D;dS-H;yq>Z{M(^B62~eF&ROV|cJ3|(0s*0ypcjKw0t~!j*dC<;;_D$4
z8By!fgF9owc(|mV4mwhE(6kMI>g)ZEVkGt9xGDS@r;;MkEYMZcRQ^ERc9DYhFf8Mr
zIl`q%)k!?a2ma!>F#{@FAm@beQ&85I`0IN8cmGo>rKK0W>9izAl2|C1g~xM>3P8JM
zxU=7CDv(L8(X!%v`jYQW6XBktD8~IAXsN32MiX00&ApG+?eigEduhsmtbzADny-E#
z0{8B==U)0Ab4OO~_gpE3#3T?4d6Vh4mFnNOY(s{A0E{zhWH>n34jn(!(Rm8!n@lIi
zV843HO{M(i``H_WvzYf_WLVWT`DxL%Mbs*A|KEe+f5ck7vOx6IzWV+wA}&9nr;BSS
zJD|}m$0Q4}aMzX>$ZXtg7qGs?VU5K2w@=_^xX#~@@|=s9wT^6eWd?q9kev?LY>DPj
zB!71^@Qb`cZ<f&oo2n-Qoy?~LCP8C2!oM7#21>3*E^7=V+;Dd0Rj$+}FA^U2jG=FW
zKbnXo|M}79VXMPR@QlEvYn@zba+e!a*qi9p%{||i1aDnJjx-7d_0YdQh$7owga$Xb
z$@0%B*zFDk6bTn(jN5<7^+4nOP>7`vknr#z`#t9$OtwzaT@;D@e9Xf<R41Vi9-@q0
z+}GZ@-*+jxj=3Wtm*D+%{L7PzHqcAQH6%KmXf490*7uOrzK3reK*vEHwJ%5*$P9GN
zj!0=sDx}#XD7|*iQV&ttkVRz~2p3;)i#BNNIj5g1p>dCdsb(v`V#_3A*vt}5yDfGg
zZ7=5@`BS0j>DklApVZ8&h447FNXTHl7C$FGH}7tHz#7BNPHf{w6X7{oHqJ%z*5t)d
z#`uY+7`BKro#P+B%2zqn_I@pURlFN|h39cZisGL7{9R9O4{;@T{S7C^;WY0q;1LMT
z-mIfD4Zh51N*o??PNsioGpB}SWc3Ey&x6bj$rHW(g;7X}Ef9^V?tI27w@mbkZ*%@Z
zQjqYo-*mHh>E&Kgab$Q#xDqzcfEC;0CLXFu#7e$Gfc^X71W^9X{`GGIFj)qu49Key
z|0UWO2CHc>9I^OLaC1umV<DoQGiXflG5m^sA;*7dUmU?VeqcS2kp*m%ZCsh%@F7#b
zU{f>32<#fo)v%=$Lc5ZpIM5UXku3#O6OJMq>^&T2KoA4Fbrk~WfZRZOROP17%8pRu
z#lzFyE69CXyi%+|mi@8&=2>t^A{lH$NAl~TjC9}&ru8JW3kZiL2m{{$o~P|VKP>)V
z9)=f-e@|#gKwjt8n;V?l*QFX5^Pkvsi7_RmNkwGYE$JSA&MAqCJ(C1x3k11@jXI%b
zPL)DUIid?5p?*-xc*gS=Zty}>vC9Mfqs>z_O_Qd?UuQV?;kRE!&is4aTN2&X?d77f
zH~b|=RxTOqU}{ozq=w~`kJHR*%kffPpT00dmN{w2Hb?eM>APK%6|3juSM8m=uOKEl
zHV7c*s<0!kVLwhTqj%SjA%>egX3$T*^4nEkVksy8V7U{e7MkMbX?l$%Vzu&(__QZ;
z$-f#_xNx`0RWEOSNW7-yJv7z-6GLmm7(07;gu|#d(KBI1SpPQmqhz#5d`2#p;Q;z2
zV%ik&bDjfTY5lzdFhE(~>t1$G_wKj^pHSm9rv!(erwY#2O>w<c$Wm$?cw)8<Aru)u
zO4t$%b)wB)0CkGf_3b#Y0}i01)9kc{-c1VPu<HBsu*iZjN<{N%%&!r}S-fhKO@*KR
zo%67(3su+h6X>%aU$t){H}k8H==ms>oUDWP0GXearUGLDwa2#yKHwq&vx<rY-S@%0
z>tpzUw0$vbDlIG^+WjBRc+<&JFRjJlIL&^}(>~?A`vWpJ=m>Q5CYq6{y{j3a6FoeS
zWnYp77Y66$QR8BaL9C`AZrnVQ2?|Buv(tj-WPyj`|37oN&`KQJV>`qKyl(wx)2!m>
zsv28PYSw%6?pu$w=N&rfYvHMQK$edx{{V=6O@!!{2bu#J-kM2v6K&ne{s#{b-}8XW
zHsV0B+7p!uvsT}WL9Bov@)XnQf)vK}5Gt4+{z2joS;__#m+#KR%$Q~LeCYe~ndae~
z;{E9qP_mk<TR`jiCq9e?PB}j3KsgspEaw`bfs=<ILpM6cRTHN<q>eKu@Pnm&i`Z^P
z+{jlQ0SM_Oh_J|8dnKlNAKwfe2eW^X^2G9p+9N|a5D^jvTP3Itbt$-()LCoo4HvYT
zF?xUL%!2fMLanD$Db)sx5a|z({x2*AiVv14*fXGrh`fRic#xZ*eWI8D^c$tO=@)m&
zP848L*&-K|%<1AX)8abn;DAMN`z`8f<mb(<Y3k{_z<&pvyyiIcb_eY6B%I@Jj8M$$
z$<DtgjVps2H`LVjjmH%^?VDtiU<DT16Hi2CFF1fmX`e`HqGO_9Hwham*Bh97=J0f*
z5W$y{Jb1<VThqqvwv>8vmp$WOZoe{r+5axo*>O*MF!>-IJjIJ<_Cb~P|IO_8>dtGB
zhKM7GZoj#ro**ZAlL#ZyyL$~@C+Pu8lH!Z5)`b=AodMV{kaE4b!$ewqURb-Uhpnxb
zXz`o!*S&z*@;Y%}IJ}+z`a4nX_tmUsr7p`SVI8H`iR%Xe)fd5*dJcB$5SpH=l=sr@
zV;D76vtpJLyZF;Oiv{09YluOpLhg_34$9TJF(AZW9%1leI>26I3Qe&;`F`@t&Z2Ko
z(uV)mA}rIg3yg%&&zr$5Jua9~q-sE(ophfgHv`_!6)RgBw)kt0455sp*Hos^u!75x
zuX<yREofBkD5#Xr>}MPs(JT+pNXrPNzvr{+zO)j&g#vbl!EKYue!7mk1CGGXkm>{r
zurvI~`DiQ(8nh8At5>>KDQg9tVuJ-ia4SmVD<%gN4IcM$jh(}L79}2I&$6XciDge)
zK)*apWF6nQ{|$RrcoydSdJEyZkWxZ-9u>CLGR%8UHZl7%z102K`;;Ue=g9<=Z0ZK8
zY^&oAvz;SK+_lyEHF=-&*@oWz^!U64Jl0lxFY4Oan|p;Vm#QuD>Kpr+?!T0<ZX-tN
z8lnsI3w}#CO3R#KLuJMcVXjby98zC#ls)P=>RFed>{!~+k9V7FlPn{QZQ(2t*`h!F
zV>hJpJ782HeOlc{P0<cluJoC{U{Sm>n9)FD*gcIcxy&Mdyp-StH?4Dg<3STV-WT(*
zRr%sH&2Z)W=j2^V7aQ5+Y9tzT)T|2P>pGc&Ejgv>P0=yJ^qHt{(~AN+kIcay$o>b(
z+-Omuwwd`V^6v^JC|#ZbHp3)DOCMn3M^xM=I{zI7YdHtdLty+MaD-Wp*MlcCj%fmX
zM)r>+f(KdvAWWne0s}itD3@H~LrjBmPbsKuQa=$#5JNPA1=0KfU{7L%HlhdvJfUCE
zGX-@OK+n=tyg1l_G_2@;RWKQd-G?s#hAI$c4g^RQ=rrxYa)!JBDXJmJv(v`GQw+oc
z(61xFj=Mm@S@A`jPdU_~nN58zau3d795nIX$u9jS%bK!u9d7GT=s`C;vMnSgXQZ4V
zWDZ+=pEjxIlbnC}9;|H}d7>hPwKLwPpy}~-b{Th2y5LtWMqR8`icKNzk4YUwOz`Us
z)o<K>d5heg<$eeRKs}7%whb;>t&`mSAlCo}is1wKs<HNZZtua{jf^CE`d}JhJ4=6%
zl;i=AswKz>gjQ5t03kWrW|L^b^YcAL$5&GEH!Yph4#EE)ZEqbA)w-{b526B!paN17
z0!j>^bf?lKIW$Oj4V?ng-618QbV+x2x0G~uH~ahI-e;eE&$;*9bMNo|{#Y~2a%2{3
z)_UL1`#jI*c}`zXOo^E?%%@{?ZAo0Wlsn-vM?M!ss(bgLxc%pqR998d(natWxRV2U
zoDCc*aa-QEM6*6e6IoZYk@cczuUua+mwG7qd9&d7G};=cdxN4GM}XRm+D&==Q1#U3
zNzh0>QWwVE%W$5CaX!`k9|yV>dj6CQ;{4;fd*3j~{hb?lpYZp%9D<uXpx2S5F&6RX
z20X0CG8J*X0?fwWhkaTYpbL3J{R{0ueD{B11{F^yl!J!%#bOn8rYaU!=*Tj4F6Y9>
z0)Fgeq7*E@co{oQc-5tM9prfwFM1JJ;Yh2EfnP+N^ZH^g`2sl~5g<~bk+VJrSZjDf
zS01_bn;vd!B)(>j=djk-{G*r^sU=+9C@O@{cqiku6Vi2kR*;T!{nwmH{B<g=xHT~m
zx8TW3lzAOl=}JN^ZXkqkt-eD+S8YtiHOs=z?7S#pB}+zEz$ud|x{^d7?I)uTq^0{-
zei;TUQsRb!&%QT)g$O8X%%m2Wb4mKRp2ISxv?9@~KQ6+53rhc2@5NeoD=tkq)xffz
zNC~mF4U=MQCpLMDLCkr4o+w0EuY4$a!ZV?NBZ>wnbInT7vB6YEpq}d@ZizPXbxr9y
z+uV$7-#bj}KyM5mot<%#)h_JMgcghf?OOmh1)vNk4*|3&*sIPa1)M=1KD?p;H<BVg
zc;F=<`oy!m`-_@|S<ZtG!LY9jy2=UJ3wQqj)ik3Im1HADyppiJ0h~%`<nIoNY9%pM
z!9Sp~B>Qh;MwKMr_-6AYALqu8?7zP9TD}0hK#Ve;fPn|N{eNF2BgugO8w700-Byh2
z@{zy|@V8f}f*q?ZCjKM0Q@Q(pH<eq?*Pq{+0$>pc5K^{@`wy>X(Y*)*xiN3!Ml;ij
zDg`4N8;Cm}r@2BrKw^xkEi=ynIm@+G#CiN;kwgrwyHXNZtAsMO|ISWl{KuCVXG)R4
zJs*5)7K9cs(3kuhBtjpcN`-o$V)-JW@p}9R56EVVSmU|PW)mgL&n2muJm8`(g3E;;
zxP93_z6GA+|J9fNU;P`Fxu_-K7sTgtWk0#vc=F^jT2?4!1lr`haZggv`WZ{QR7XSE
zs{pRReN8VsQEnO<lu<|wh=br>>$*pw=P`71nja@}0!I9{;D?kV>HN%5TF6H$pX00Z
zT9-D)#j4p{X6VL~H{}d51L9@3>OZaGvR-ZG<WsRwY;2ASlT<TmuH|M>3G!uN3^r6}
zJh_`BF;nuj%*#TAz}q1&1m_*9!q9$btJL#^!)qSpmMYwU;I=9nF`HHIG1X`b|Lt}e
zcCb1e<6xL=u5NrD3@zGI{j&ASw@itwj|+il;gRL&pgpZx`LIAW0$44ABI3CB$#m{J
z^ZOrWTRzk#(O276;vB8yjMe+4yfJ3j<L~rQJ?&UM?$wpi3$^pt$6w5G7BjX&B<RxC
z{-GUqb^y|Lj0c>xA9Q}{*b=5=uUf3^`{{O{X?66|SVo_o+&Q#-R(3PlFGAHmdCq2g
z`)gSz?H0{$4@cv{03)2I$1*V+e>3>LeL+~xM##k2=B3KKb2Q5U-^;wxkui5%da@vo
zj<=qnR=OY711&cXd3;M|x7;2ZIqH92b@AU&F=sHFxqP0#r32_{dShp)nl$dU8n<0i
z$#QG`!9SI>>cx9E2FrW3-$`{-^@VWO?4I3-LpyUS&(!Rjb`CmrDAryPu{_{|?C(~<
zZ#wc5s4I;e6BN(j(&l9uUj}bizQ<CK-?>CSOR#zd*5m-r-Eih%iOcZf(thcNRzFth
z3=o!;3EM%!@Yh7rHxi8RMhA^s2F$!EN31doFNh8=0L4>!L}XABO|A2N|9D$f{?UWa
zLroyV7m9bwTq^#aopbxkaejA{gn(7IE#;p{I=|ZEC_vtCYN+aM)()8GOK#aq_Q3au
z27d(jW*39m-R<|0gvNivl;?JO2WHeGTygJj$XujXZkTxXnL}<WLRLoI<A3f01-dq<
z%Sq2mHDM8evz&T=gZE2K<M{!8n<jhjuf5W@S{sD_(e69O!a=Pg?>~yzJ#0K?T3@?E
zk{t-JWmPFpQ|B3h3{Bgn8lsaBqHd-!qZs~vsU*_|`mCwsUE6EpRR0n)haZ(}y?oDE
ze9c^kb5&W{<V`*I7K)2S1T<%6`p)v@!hap9z{7YD84kH^8>ctCE6o`cp7}MHD-)|v
zOg^+TbD9ByY*piAc}?||TM17|T?9?7Q_C_iLOhdmWoHLdTFtJ>l<<+$0<F&n+xIFZ
zEBY{B(eKD3orPJ%kEfWEdEuS|75RFh^Vn<@`5D7_i6cKT&S>h6dlQd?g9z$it8~*2
zVtB#y=)1_c>$6{-;Toc@BaSU)bp%6<vE|tsl83^ZFCe+R&R%Z57$oIf574-{jq?-a
zYM0U4zr^*Q`o~W~FRsx7ng>lv3?Ix@+w{NZxj4_`9CdnpFA|>@v0Ju%D5Dpi^u97Z
zy%)1Vb-eJ3GEn(U(kZ6lsrZ5Zbtq(Y|9%aeX^Y$}Y%eYJ%h!?{v=#7`8|5dRB6iZQ
z9PWIJ4Ri?BAdF+ngo{Y46+J7)B6}RjM^KT8+xx~iXXu5DveKKB{Z39;=6J%H6;`rJ
zi4YlN>g@Qv@U?&=H&u#Lr8rloSpNagu!AB~W;ChxQ+`g9uR@z3Ycmf~l-20ydS&U}
zdPJmE;9S^j0@1PruKbya)hXJ`BoRo1Elo()H=qW>`vFC4`_68#k!?X1C12Zya-#|3
zQymXZ=gUxO0WpC)hy)+mZnPqS6MOy$*;VkXTev$KlxDXn^8eqrf1JJ-qjr<OyCha`
z5R%r~AKIY4fBXD%NLR3GVVh-V5Qly+d&1EN`Hhy<Ru1W~e%IlcvQv#G3*IO!orWJU
z86KsZSoO`p$Cqt59WPdD!fPKc{xy_$wG?Y+qkANmy_DkO9;UR?FOr5p{}Yf45s+Wo
z@N~dT=U<<rhycbs<WPB`h8z@H>$g#g{ME_G0-rzo!B5}Q(v6ez3{_`2Q*4Lqb-9vi
zPS*S&o};+FrzgK{e#2kRvpY&HAK(4~j0NuAw>Sp0cXJ4A$xjAWT8_Xes|<b*>fqbr
z{J+`|D*?3PZhG55_#}_2cW?FYFOFX9r49Ntf!ZOPVvCw*Ny6=78L)2c;~(ZvunF;#
zC^1bX){k*OfEu^AY8jtAldi%rZ8JnDvi+_dA_=e$kiFq6cRL0YW>}UJZnvHTn2gmO
zR=iw1_b_fmxIKS^04Dw@RrKtl?(20N?aR;e+dWpjWPbO*kXb_MNSG+`O{IUB>9G=Y
za&6`Sg@C=Il1izuolv)&e6PM#jL6vQlBsCHq&^3lC4){XC7di$;^#V!^6bk$4&#f9
z!C&tV&ilU~wDdQs(KP1Dp%Hv5<L7ec*~;SHV#wbcqV7qRp%Z<hS~2o_R(eJAs#ggc
z_h(=|Xf+%v+UQFp_P?3wv-nQQdNE3aOJiVU|D7w|zn+L4Eon3$e!WH;?L&F2X;abL
z4S2_mV5OtgwDb>K<Gi8tL&h^nEB@`PihRK;A~dn8N#Q=LpkxywP<f}4n>|p-GF!<_
zqbocCm>hbTO{xeYM%!9H=N!l*{$K+@G8B>JpHe6{O#KV!;CRQ19FqmS&XnJ%i54l~
z5YPD!?kzPDXiY~?KHuWhXItaplx6DR43e=yd>}dBb|0PR+DPXa%TJ@&?F_UG3l7mm
z!Xq2@^vX1C{k8$ulS#|KC<=$8CE&&f))u~u9M#tZWQwB%qMhDs4V+IdR`)<#GHMTe
zRaG$QGlI!)5Gqr(*!g99r6V?{P2HN}_?dmb$N9p2=-MILy$;$rq~F=2bXkc59~-af
z?9F7)butD*R#UJh*C#caXL#NgewHcTTOu+<Yf|IoSJ!`Z7&@d=-s56_7mXFuiO{u-
z&GLtUZ%IUH$m{FaE73CL<5Qm<b%}TnzdUzas+YWCkctNCgy;^?iI2ny<GSRtH?<}r
z?6oloe<&gEI))-R`I5{JlaAc7zt2&-2N9>uC3<y%yg3Bvx`@$J`y?cy$49t?sP3pa
z^GO*Z#%aZp%|cD`BCJIXsh!<6>RHqWH-eem?+g;wSa;G84l)%qr+n{51e)OVE&50c
zGFCp%A8b}<ocBJFH0(6J5sCmS&^Ct`w>7ki>!T5DiT!&e-|ISv=!EUt@V|+yAvBUt
z7ExpeCMbuKSjYwhY&e}zw8{+ZNUQ|uS`1MakWr|`JTK!mOR(w3a;z=c$#*V^2r&HB
zD?x|if4kVvqFFW|7s1YcY#8|-3H0X#sY$+t2v|*y5DHw*5fmJTv=?lu5E4}!nxdMB
z81%6nZHpC5otL?41(vAZAmy=S1!_>|!a)Fp@Fa)^2DyBYKT3^%egdpE=%PXd^~JC7
z6;TMNIa(nvL23k0O97eUEz<BiEJ0i`4U;wo7Gq!-M7$-n^|6Lk+&XI9rh!b&i_)Yk
z0|fe{_0|{yKny5JHhphQ6|rhTX4<WJlB&=llc&0XlwY#>+cN_&mU*h&E{RmZPj}|Q
znZ&-G04e~0aIXohWoSXwj$i?XwTJ)srkr?zj42!B4<=jWG$DLr@i1GAaM7(TXF9_Z
z2`c&qzn9$F`m-rlMHgdkL9`9t`0|`ZKW`d<PLX?b@G3JgO3np>wOTbgJ7q)pO`|d~
z>xgKTX;Av0tv#8KJxX;#@YcO=@bAZg6}Le7z;H_N%?{>o5T12qo4&K~InMPv5x#9I
zNvj#_S8IAUx(3B~Aj6)OzZQOCI572ozo#lE=NwNJwJ|CZotal!-hIiV?!#hLU{ZU>
z=0^WSxm0xbd|^f0BHgUIm?hzmRrZ}WJIlr%6Q_Ou*++y%0Ug`j>zAS%*G!xRCn5WI
z#)Qlv5~ZJeN{3PpVj*AOZNXpRSXtbmL`ow?MT0Mwg*lwkwfEr`TCV@hI}4Dx`2hmQ
zvwUkp%4Wpi%VsmhPSH~dsGxAZhxh#DE@%IIpw6`v(c-xRJce^R*zuSvPekIFor*z3
zBp&r1u%<~*e@0_imgkbGqWtZx1W9`+Ltuhlt;)i3*Oa~O<Pcq<1O);Na!-2r9EP>m
z*7MW8YN9BrTp_OVXwEfV9;Ba*H@Ubzl%G`iNozSyZN+!xWl$2JUDPy6prt|E+R#DE
z@4?fb!USguDF~}V2n&k{>H1C(K#1z4GiF!B=Fe=?UhuGguC2OjrRI@Ir>>>N#2wg!
zlt3L?2c&wkkfti5v4?Nhtu~w^u`V{iWty71TZo`$Rwz*RiB$FqiZe3;);eeT#!>-&
zbspTV`nc_1&F#xn-<l)0_q6tBwj-V=cg54k*Mzgh13wB%JU>;9;1#{PvQO@%q_pVH
z5n$R%@!vM?t5E^2^uGfVyvqKc32hB&m7nc^w1_xxZE88s{cp(G|Lp(329m$)Yk;fk
zSM*}i=9<(5LxF$&_V{lQW0)lR*&yI7X&KJw&t3JCuG|2>P+s6Rg?>#QTyyeI6-lD`
zg4k&M05A>!O_f+-04W2(l4oK!d_!*IvR7VqKhZYrKm+VeX~XT#@3%XntAB$a*?@<S
zZpu4f_tHw;P&>y!4FiSWTubLDe~uY3Q>r=-<RSIXQ7|gIopeE;YijHh)$Sz~G1{4*
z%Fo&?6Hvz!$5V{l4jzHulmGfE$l=;*fklXx+!~xJctYcU2R0ba8#?#Cgqd+>==@Tc
z6{wzi>d@TldG{#0(S0|Z?)sj!V*Z8Mo=}>|Ph?Sw)ZA(UbB`aTUwceF+#B1tgg~tY
zrH_mnbyrXz_MiiR6y}`j^cT*^yXXL8*&Gur#|?m0D-cJ#FylfeJs+mLqWCK8h^I{X
z)Zr@@&4{`{Pm#V|^fE)BJ`xs|Lq;^#F3<O`ODJv&9M2-KWd%SMFFJ)+^Yf#*j^yN`
zg8Ky@u490G+z7CLBEJdpE^Drq6H>o7S)<hHtT((c%uRmgfs8vrXlWr9D!DGL^8t7q
z_i+`C=ULip&X$Zto$wG$X|x(sTWU-~IhU9_b@}B#k_Ub|_>Ls*;kb1ENJ8GQMBhJz
z#_%;WID2}U;NgD^e3_oP@@vPjHoU0k`3)j(tZ?6pw)-2u1%ab>7SXlI*fHaak(5v?
z_F;owI)ZOG0sUy_8TqXd<4B<Juq+)vGmPF8Ft+2oGnn8==$2<iPbxrq8+4rR<X>s5
z_s+TsgDGo%onOO*r!C!0xvN*qoPm#BG}%GYwQiJRGP3ejy6unj;tFQvNVpp^&l`fq
zP1VKC7$p3sOjjtmYIZ6ksftV9F8(5qK4~;qahE!;6ZTTKMX?#%hNwog*!sht%M@|h
z-^u)WR>omXEkhxf0PQ74<XPp~Y{?k2!A*w$>_ekFU>-b2mA|jGrR1kaP8Ja^!J<+G
z?@g&go*lVZY?jKg4`>=YWfn0T5D&rY#Lpl0hE7LJ*1*;GoeX16pJCgvyoQ@Yo9W+i
zFMesnUF7r}=7J9J=oUP|&wD64K>LdNMCM_DO}KM1<;_7Vp?^NhbIUj<jQ*G_w}F_q
zXECmWRMdDLc^6d0boUOPCmg*JfV;OLuMe0@yDrOx^c)zjGDR5<e^-MY!(Sb?g^TLY
zspxi|>qPTU5H7Cos;=Z^No1?$jz7e!O5uI{m@eEYVpA?NpZwJ+RX%O0u3<MXXgz=a
z*V_gu-I=C3S_L`<WAneSARZA`%|;{@!y{u{(Q1F{z8mBNZ0cy1`<#6qAoT4dx=l{H
zJvd=ME{s^oFl+B$!90huOamo0yZ<_?;2(N`2+RvnNM*VzzVXQFl3SFQjW{Bu0`6T+
z{{>4mg$Ve`X8~$BiE~~*kFr6ZaaQl_)Mu3p-y<X{7Xes)ghuJ1X-oHM+U5>4u@#Dq
zZO!a&3#4%P0=HW4UrYrMX#;T_<QGK&5D%b8phghDNdr2SUql5U0Y3tb0f^QFr3FxP
z#{%swM06dj7nam{cHFj_Dy!B3W))@+;&eby?t?gI>THdckZjK3HldqWfZ7;;a@DK3
zQtqt#XRV=EnA4Hm(qEo-#fY262&jwON8bAey`V~qXAr=I=mic6K>od*)vu8!9GHWw
z7gs-fooL)t-b8h;+XgwgU_L-Y>3;IVj%h87<n2=-oF)=4>9u>Ng6z{vt#aR&1oi#Q
z>)JEkXdHjP3fSH-{?u!1AAh+W?@5w8^Y-9%<&N>IZ|RkB-w2<F9;4oRRrO4({vB*V
zh^30wy5k-$WwdC%dMQ6$tc?(Y_`?F4KBoUzQ6!42^Rnp7Q#J7w92WEI`dIPtDcRi)
za+4UoTPHPTrd4*xyfabTw2F({=BQVfb=K>E<W=`%X2S5mB}&JihJN&o289JKJ^VKa
zb<{a`BHaIgXQI0Ki7_`##b|zu`TfxBb$rd8xYN6!il>0Fb-eI+^0VM(_~NLXkaYNn
zHRG+JA*3Rl5uVJ}iDQ|dLo7p2kC@b}W_{g7p9~*qzFB?9o~WD3DOr9*2Gvu{y!Rv2
zMM!Ejz9GMi=}DV!h8G0&5=O;Ybfot=p5o!dc=162#G;Ml`&%ux%3hbDEQP)pKPWnH
z+`d|HQ`fTl`0nn|i^hrOOYyQ2b=4{~;y2HtEu!G#N1&K~G<!LllpM0IPOdB^oKC=B
zIU}RNd?Hz)5vo50{EgygqgpJB%PdkN{8vepUcZ)RL1%V=bk6C9l#hLX$h;N8x7TC-
z%*)_AD#2GDu7IaJ{7}iys3NG8nA*txSc346te6*Tq8*nH-Y<Fh=)9x_WE;a<4WKg~
z5eo~$!$>$H57`IKCe_C@AD2kn1Fd(jjo&s|BA9d5=q8&>#^T<TdS!~6z0QbSUC|B<
zo~ajgK@G1Jyu```7kW_cD`?j-G^BKPTJm93SU2rWioW|9D(tIK{@}V@aG-oN_6zq$
zB*T@O@5Pz+aV<AE&Y&F54S9UK`2WAyptt44jb6besE8*=4`*CRFDcfCTGP%vW%NQi
zDw3eq?<MC3a~Lq%==@;MPk2HU9=V<aFAP=f>+YMXq!0Tb!A0~Z(6N~C93`<IPHxvR
z8qpagV>-XJH2Y3PwlM7jAs8fSYxl74dhVp1A-Z6U*LVDKqc<~0*8hM{08>HF9aIBI
zrXUR*QRR1fL2dOD&*G5VDQJ<hNP14R|El~~IEG+#J-`Io(|?29D(#NIqz#I%7=u+C
z^s`@sLVnOyFQ0$XzUNQLE~`A!$1Z|KcxiGkX~69cK7l?z1K=%F^%tN^sbf6(@70Oa
z->Q>W|7LY^ABZy2Ke%veUIh^@a5dt9T*1jjXL73c>}^drnTaQ14bhtM_xwpBgjpZg
zIWWBCN%V%GbS`fqSM<jQ#`Q}wTvKwwa3u8j84k0H`iF^zve$+jl=E_SChva4*s^CT
zSXAt&DvJoD$2#rcxps7Ua7oT2Kubv{?CHIa%1@v^M-`>;qRnZ^%8hf()XcvAh9Af^
zZjCBFjNcP5Wa!PzdxbUa{ItfSeIeSNX(UP26xxJ_a=sKah(ws%#Y1T9lY?iobYc6&
z)JdN_#>SMY7h{efKOKvelaO~)lzut<gQRnW%vQh4b?(bovrQIrrb0CqPD{Q>H(k)x
z?2ELM$RY08y>s(H;zP#G^r&>pL*Lm`UAe_-Mx9`!?k(uD;}m9|bfQBbn{hoCKUhD(
zKmBj6)TCB_b$+?IUBo?3ybWl$ppK1>R&EBdr^h3k$HK3?$W%XgTcBBPi=)7Ad#wx*
z)Aw8&lrqY-PaAAjD>kpdHPXM2`s$JLhd`v}U^-Ae7sUGrB&ZlgA7FURlq74nnw+&E
z_|iho>qnC_q_2%m{gQ^*a)*WuvZ!t3M@gUl=t84UvtaF)H0m=XkRJ^5miI<JNf9Cv
z5QC$5*!fjbIbH;}rDjp=*4;A-_<AKXsBY{>>@ojy^d!2)Yap8xVFZ`iX6`Y%$#~Aq
zC_C58m{00P;j2p(TwQ<XJE9KN%tZ|is^3t^th(5Goo7rr%gUdqs)&&>w9GGtGgEam
zEIk$?_WW7bKbp6^-`<3TF(t&clac<l=`B8{MhQ-fF9P{TvZ;~9U@Hc-GxMJ^iLc`t
z{jO&e<<E(pfm*-8?slR4AMh|IAMfL5qa|W06Qqhup#)tSq{N|?=Xy2V)gj)>jULBG
zSy=HL9y)=6&bip+T;~v1H8!TvPg$KD+!^<^g(hWIR0_JY)~&%GT6B2&^j2;EtEUP)
zAzH#pJ{NqS4w^WaT{bs&%<!k<P0G;g!WHK9cw-zfLL-saEffyRj+j>139?(AIyV!F
zBO;RClpNjW9yJj~SRp5!os2`7NT{P|W%WQqUI`CNiM(yr0`y4k9l(@4L-<{3;ZJuf
zssDo}`KuTa*qQ!C*!Z`fwW@^c|5iUtuBCzc!KVHfHUR><)m|?MjS}jE^o9pQ0FCfD
zWb#r;dIN~b^jnz}gQEOmKcGbh&mM!g)b|Ge98^m4kEi#~*9yU&A5Jdk^3fxc87?nf
z8HcJ1zrMt>wdTee?k&x#3`M8^(6ECIu1AF$KDQJ6XB3u<$y82`$<0?#-q4(IUc{sP
zhbna}r+srb>#mA7N%cY2A_syUbKeq;5_-Pe`g8uCd-&@E<zNgiYtX6VCesq$-$(K_
zd!`cU_aN*s8|la~QA%#Sf>w``AGM?i*E*FXF1J2FP}VpR=6{2ni8^b4U2Bt~<%n~0
zY%F|d^ssK&^UxHa`wW4@qB|X=*soH{^@o!0m#DnH?@TYDa6G8KgTBpCIcjGbptt;-
zb^(iRs=uc{xb$Gwm&vKtNu_qw25HvDjxy?;jMkBADI5e$Ff>45L&+uBexI9eP)i0G
zW5W@%a;6>?Jqnv5`M8nBD)W{k7`bi7=YE|^eu9{EDbv6a0}6%JK*$6mqhhpJ>JADr
zJ$G$=p1J%Z5_GC@hsz=OnJoZrj-8l#9GZso!UKm8;IJcnjWVOL!6%V3l^558ofnR-
zOo{QEH7Lfty;BJ8m!+I8Qb!qBwrZ@0BBWXSu)r@K!Zd^v4f3;}OfJz<oW@x9X~V4D
zY2V%>B@=r#hdvKNVylatvQ?$7UKZB#HQdMx=8fveW#EdGIFUDRnj;y-ubJ{1(&9K+
z^4XNW`(A_~CkUYG0}Hxwf=%r<B4lSGZ9{XH3>CE>Qg=UQde0~7u-!F3WO)ujpJ`Wz
zPpt&$shz%HYeEOGM3~y^=A&>9<IbqPaQ1HqY+W91Cm&S!OH>`6!!kd-vC8oekO6-%
z>Co4`ALoHEBHr$6w~J9_DRec;bG%nXGE|@JPJvL)lH%dOvyQ9mCCB4~JGf!j6K>6z
z1};7{0wV>q5iU=6jP*%b&n?;yuoQ%K0>jA6KG~qAYn7AiKmT}hG9%o+SH_kjedaOA
zdv{Q{l9ls5;?*_90Nc0ncZCb>%@brgf>N9ZGd!}YLFSuP3E0fWk8;8v>Uty3DLg{W
zmbNuL26cO)Kb`Q%s<XM}(%J&Cto6`6;^T%@(tX53Alq>x>{^v6_f4M3Rr%P?FM@Rb
zU<Ha&D;3?74PPLN2D86h!tDh8f3j()xb{|=|8T`=v|Kq)p2U__-JS}0eOI8IZS`6K
z-mYrfdH$-dZSV97$RH5rDh7e2=!z$w@sFw9?YJ-W(ariiY~%zS+RtHT_nda5Qduqg
zr=``D4w#F9z3L|RWK>sbzXNB?Q)*2w)Gd&;B1!LJ6om=Hup8MCo&4KaOR(aH9g#kn
zZ>P($igO8u8|9rVs_ZJ`a(>mNn>!WVtUb)3?^>P-k4m!Zpu%)B+_AlJ3MXQx69V<w
z+K&nZsX9sPL<fbJ)>8fTz}^0zRxeI@olEO15<wFZ6@A>NL}L|H%PnTXoRVu`qFrV4
z086Sn|6+USDA)E#bdt9b5_+dS1<CUQL)}wdUp>tDb+Reyl<m1M5pEwngPNj#75iSl
zwFnq-L`K+I=sJQcx<Unw^Y{Hx7=OH+iiQ!r*#Z^WV`xZzo3old7rr4ri8|6HInj{E
zVzCebICPO-`!0;KNzF7!q~7iZ(wcE>{%p&B&e}mSY9v+nmKD;$s|x>x{5%HF$9X_A
z55+*-(!dY~HaIUG9I~3c@=N%fJ8^a8Bj3H0Ve3QuXd$xh8Gp6`5-{#jg9eW#mLYSR
zLu1tPXHSDxPcwgma1g$M`HAj1>2vNM-cQrD{I-Fuz*2N>r!Z7P|7~tcO$3#mmD6*m
zst7N$yW{8(sUOeADYf)gFcSN}0adW7Q;V2&Fq$e6k9fukbKVNZ=ypn4EFKdr4cy-`
zG%R^fH#({AnPqQhj~kj2YB_DQes*Kis#n#IJbhjkKE=bW)IkV<@Pez2`5%7y8BhVK
zOt7e4pC`pvTwEV<jm<vKqOdgp^e=*EUX#pj4`;4tNao@dl)Z|;h&j9)+Si8an!Gg5
zC48qY@j8a-eD{hWbFDbA{cBgj!zGtav8S<!#n9*Bt~aa@SdaV~xZ-Q%S-h{D^v#q7
z3rE#VR(&yodMxo5iFFkh$ypVgQRCN|MwYVU`u#JuDH+R2&kn&vv4!r(?x!RkW~8xC
zC(#>CsLi}*kGSj8#&EFR*=O7j-5{DYZ`#*5Qy_ZW@`U!NU2)kAAskz?qK{s*QszD{
zLULt6OlGU>i4ESfrx_*RYDxfNSlJhv`WJ#ShuvnW%H;^#cJ*mfqYpXKkHw-jmmr1I
zc-v8w^wGFoNBIRKcGJ>nC*JrsX9_bVi&6bW9amIi(7u~z8yP*x;z@eMA@nnffvEZx
z1m_*BC)%6p0sbdzBPXFU+!`1ngPC)`^A*P0NejQa1f?}A0Pj&EgG-aJZEErTwHY#K
zauXow#_RB*Y9^_CFfwS)nenFUhu~%9mSMz8%c_}JZz*=VPw<W-rWm!r%<pX-i&V|`
zE1jnFOJmc}W6q>9)1T-X0ixy$#aDo7{4=QncHW9QepM-d6gFrJps+yz(oH~f{LyEK
zH9&q9kax3s(*s4ss;RO6OSM9@&^}72yNLeRYUTB+Y{*R|`ie1Hjp3E}rK83jaB@=y
z{@r5RS-NJ3+A>RD`y-O$Zpmk?!eT|fdv%9l(_=7i#@SbNcI-F%?H$O=LIsOgIV!TX
zV)!g^m0VaZQbubTgz`OoRL5+yWa0%_8~1U%(uL58yOU2`c<`38#r%>M?4o63;NeE>
zZ89r%?1s(Z%;3n<|2#72!xlT@$a2-EXeTFtZ<#Fn7WTn!3GVe?WcBJ$)um?_&LKw2
zQl8Rql-^@3+SMW_EkGIzUDue%Xo6~|b}#rX1&bVG8qkc|=}|=U6WM7gh1#+{U;_ge
zkG+aeObfs#tYcCAPb1O=h8SK1iJT`JY+&k!kbZQ)I&Kdp)VSyTrk?w8v9NLzq-?((
z*YasJ!cw~xf<868qgy|Iqge<hy%i!wo1VWZW{}M4Y_^a3^TnA@=J^2G!*9iggI;9O
zic4;BAz51O!Jdc-I(uXLxGTcrIfQjl1V(G2o^{$DLS1z~>sL2b4<aH=lUziqBCK2_
zbl&@Br#(o6$N-=x>~^+*EX~0jY<pAf<)tl(w^4@ESTwrhSFWIXX2<q^GTH&Bfi85z
z$E|AnwY!N<1ljr~q%{2sJaas8Im*z_Z)XC+dSy873hJ@S<GzZ{+9*cO!{s|qUM3n#
zX=w(ID}r{HJ#g_<f0UOV4tdkHHQ(PYX?~}Z4UvRO5<S@nGa)kknH5ZcxrElT$dhkO
z=x+#wD5I2DPYpI{YII4yU^5$%u6jQAy3hRyuNW!ti$1qYLfAJ}iupd*PY)I{zoie3
z6jO^{YItxFPPJ62HZrjJ{a7^d6=d5HBFa;{85ssD=8N$g&_I4R9yKVxjXV5&AzS@O
zmdgcK4QtSo6xADvI7HdT0hPWJ)k9dveu)4V4f)Dga8_fKW+2xt{IR5~#q%4JM@;Y6
zz2QjvtpyUmr@IB4WLK#=jydXe2^QPk*O1j&+}sO_+^M<@Pqxa=&SP+ug}wMcD<({?
z-d6aCpTY7=uRO5uRHM&{%XbNRXkdZIw$e!nOLK4yqBGjAS?T>?FKs8H&&F`KyY$}{
zs>9OXH<RAg!5EIe&_9V8(ffX8py{Vg>E?h{^VPjWx=OWx%kEt*ypczFx2dx&O6c0=
zHwc3d)~?(q&i)94RR1}S-zRV?C!8^rP5UKWp)h%$%vWBSFX025g(Gg3^M%1|Pe`6S
z?m@%+-irD=KD}q-N@@ODJebME%mR6b7YVe2smHDLTL+7RR%pJINPw&U0*gBL-{la7
zk%YoYsRA8Wd4?*oH)^zLY4YaVe_EaQi=(=2jdqP=**PSz`s{+`qhjpeYMTG@+3tcm
zhdIiq3;E8Qnu}oc0}x@2j@-XuxQk*^BGu3?z!@@bWA0-c6&%P=l4}Omr9bTM*>dCm
z1`!(|FQXQk4Ixj^xz$kSCpXG2h{d9q@mg@8S^$fOtkf@+J<>2H-<m|3b++Fiic;KH
zqwFY@n~z=6#4AHkMfiEu(}Q`hS{<$(bsbjH@R~DK+x&{22|lRVV`$efT56$*Yxh$T
z&bwVNb-AEiQc6Ji77WCLKM0oD@V6TkJ@w!{egPx@;RuVnGA#yJNm4yluB)mkmAIft
zcPCzTl8aL84X33tQSnZ}b<93}7mNK<{Im2D+sH*+{1M8I^MF)}&4fi<l5!ry-bW_R
zYT7w1nORv43gQgU47Hk~iTCce1){oH?@u4|IHBbYCPgNfG(ufsu3ZiGtH2y6#rW@z
z(|>&*m9dC(z^4e@2M!l@nFc9nnU5PD^C5)_(7+1Abc%fobRW2;=DvSlnJ4vV#wA(a
z7vn(evKUC~EtTZ5MGHwY*)WHTF<?SMi}+T>%@zog%^$cIzrri?hu<U0g1)X;PdMgN
zRQMrU+PVJ%=!o7CXMPs_S?vA$$GF0p$efRjqvAL#)ff_UVLYN6#fnu+qQ&W+Il)51
zS2vLeaWX2sG$s4}=A^BR;sj)Ze_|MEsqRFEXU5XQH{@4LvW}TD7l`H#c=vi35WJ~S
zOw*sU>yzE_u45Z3SuY9F`VAscX)x);wp1RLMwX?cmF{8LCg8-gRliXG-RRU6r^<YK
zR&QlIID+bGvkA1q&{_#2b~h|%$859Af2JXAadgeo^g|g{kmVGPy)OriV_&3xt^;9{
zaiBJ?tKZGcu2on~etXK4NE@Qv2F~mp*FOrSfa9$LbF$05nPSuESEw}!MB2gaUrv~I
z;&rd<GV}?0)BX1=?tW~DBttAMltk|6D7cfqIqzDiS?59}pclLpM@mXWdXH?io*4Zb
zyOnV<5-eP`K+mBvnrKq?B*5mJ@H4n41svP^{eB5M0MEgDtLH@GOaJMT`kMCb<;e4h
ztG8nr^`$DA4-$}`=Mc74RwSl|siEOY3Rsu1Ky8pM-ZXpTuJb)ok&TUh<u535AJ@^}
z44O8wrLg=k<7wvH#U+d#cGojh;2yapoyadH=C+aZR#K|^OU?T0NtuG61$_FQzmy@9
zlt0oi@3k%b!gl`B^J(@Qqz5RUchIkq6$qgKDem~=m7LVPUZh(9k(`5DK**K&;;*K%
z_~u^Iv+6%lNiA3ak6*H-*c=~VU9j%E{{#2(cNHflq%w^$^8KB^8nFR!C)k}=k7k%`
z6tj(yb@2WwC8W-+Dcj&eHU3j2n<Dlu&k^DARBE~b7A6%%1L8-hvPE6)N&zfpCU~Kn
zq!pht5DQZ$VzR<i|Gg>yRyhe-N1&7AwS@XUVcv<)B~x+oOV@Lv7PqECgDj3U4=-8`
zhu@Qk!iH{@rGGglfV8xmqJ+zO5yf$P1h|JS;HOoZ#^77v`tpR{)JJK_rrU;1OfScV
zOVu)mwNk=4zzE9savNK|Zs1tVMM$J7dgx@PT!>o#u8wAi1>bGXvS+CA&l`Mat4q`6
zvbaT@IrsE)Y?-%3ESd-_1p=MZVjh?}&M7(}iJ5tnqfspOp9fk-Qg-jVsO_WA>$xwo
z&W#>zR=ZH?-8XzqvjFp7VeU59#N{(d*zG4ySPitlJE=M;Nwezvg{U?7`Gx1t9DAWQ
z$8zteJkxwK7ZQiX=$&q2>PF!XR6Ytt)Mx6B`m9*%c(ldo_C@zfzeiV7DNab%bKl9*
z`ef1Ybmq+u{#M@guOfo^MGE=?O2aL62DC~xhnxrg>&GDvy6>->phVLFCaHgxNJ@D{
zO$jF_OM!q7hosOjEnM1iT9hJ3SuJf=quDGVvG>sFHT+!WDQsY~2Kr!ql5D&<OO}`x
z-X>>#b$+!OSe3YArkf;HPx_1}$d-_)M#YK3<O7G;Tp>ZIHBs_GK2^S25LLA@G(~~1
zfGvEn8)t$D5og2kH%PM4kBZ2*4?AWsU2S^86~jfy4n#8Pw1DUV`LAQ>{~tde^GuXW
z81MR>oIWJx%b4u7k_+6u>!3)O(1kv)7P74mGLs6fYu&c-+OMN>cZk~XY7btSekeR3
zb7}T*coM0d)e!_LB}-tHfj3dNpO+McIX^#a>TZ8kgR>I4WBwV}B<0gFv2EjwTGwDx
zJ+lRm)3chG<MSjYFukGtyj{Iw<;~m2OQ<v7)nd|PI|2<1I^#lfKO%c==*S(ZG6@Q;
zq;5Q@)^mFCWMJ_e5`+w|vP^PDSj`)(+@g%mY8%5R-dG{BtcL7mC*cHgXX30b@i!CJ
z^5k)}(wmKVn035EBuv~K;INAe0p*ne_&`KZYkg!3!F}`Epc4P1mY@UV)}q0tbfFXL
zm^a%>=1ty~mDB-Ak+DZk&BW^O{Z_^QeKyp(Gd78zSsMAOW-d}8@OsKOD&=IcTr%2Q
zF3XJzs_26cxZ3AYa!4?UN)C(fWKkLv@VBSGf~qtPoh!GzB}aR(e*`2R3i2YRufyP&
z4Q6x|&W>{{AC(zYTKCQ!GehsUWTHul2fyKYaXv<1^OM1sE3c+O-xzBqsRcwUg}0(+
znZ2|meC6AkD=Ip#ilpussD19KRts0BE5|q85oG8w?d;s)DOgn;hq?Fq!rX6jo|-K1
z2_Myz{|o=RlH-`<ITiepvO}`6I<;Zs1FfL2#%{L<(Fg5cI9zgoh2+@JXJ_tvcof<!
zvTD<YjhG!9WYH@a!AgEOh9tm3gLCd^<IAq#doF79UCNQKqdCbh!3X~@4a31Vct79!
zs>`bu2YvM#s$3c1AkIJ*Fe)XbyuOA9zE}4|eb1fpscw_rE`lzUEyu<E8=L-(lhl6c
z_$Q})U6+U*UkCH+I<wxsAf~k~lfq%DU3{pvCt#JLi`KT7$;H!OtG<6kYUr5o6*tx2
zqqSFI<i+8(8t+S=o{H5l1&S1Et4R4g!6%QVyl`X>(c7=$bNF5rc-h3&a4kr%z{(FF
zPV|LGilFKVAgxF=r|5Piq2Jvz-Xg+YXRd$3jmQ4>iL9GJOqrnk`~40%P6t-gTH7+V
z$sUB2I-b3LpHdBs4Nu8|+@CvJX(C066!OxYdRh<yBr=^)_E6~NtmjXHQD>StF)jv`
zBsN<4BzZ4L>-Wl;<sBkt55<U$7SxX@M{ii{0@OD-x8Q-w;jRbV)Ty=5lTSm8Go%Xw
z9YfR4s(saFgjUQCGHkV)N3EFa&`-}Ah+*;LnDd?F*aJJCMi$bm!07*8@vr(W*@du$
zu)i7zi>H3%DsQ~#GInH?De*U3M4-jy^uF20A#%c93{ERG)2b0`Vn1BNOHPnaFAFt^
zf8!Y3gCrh2aZDPxQd>s(RB=c+QJn=LDst%!7c$fK2V*Bi<0@`#0`C(n#xwOsz?Gy{
zNkW5eV~d1oZ=D`Q{O>Fp8LRk|MRMvVEf!%B0zrn2!r{vne&Ig8YpUps48O+cCw@ZG
z*Sj~hx=Pcvxz(Y|Qa?46*YZ|GfM0M2&sP##HhyHXCmtMlqO&6<`#ifZAY#*Qj)gP0
zI60K4?4IK3ZPH?Z{n`0@FDh`6h`i;BfU(4_xw#-1Hc<Z*eYpP;xk6q+E$f%m+)j~h
zK0%+BCEo~i@=Oz5JkHG8D^@0I1u~EN*7^essf#6^xLnc6ec*2y@eBBPRwME!@bPze
z;lCQ-sdi#Ay4@^`SOu1+j}Wg6F9hRWUj11^OsF(smGHAZCP8Z|`Sd#HO^!;8KqcAZ
z_PbC_Q7lYN1VzFZV-R#hBP&S-p`#Nl+S;6lHpWiyxY!S|ZeYcwUdf)-H%ZFQSg?ER
zFwnAjJ3juotsGZ3TCxT+Kf-hwNdWWYrga{T-jPa^R*-LELmLOW#xPc|j2@Q$$$N0g
z1pW!$el4qrA6tP2DCu}FU_TY2Hjxi=@6ZIiV4o2c1!C>qYzt)`O=`*5eE12O=CgH;
z(~eJpp2^3txRWSI31$rt+ww`hsQk7=rRk~ZPZOU%D<I)}!|XRuAbSmj$a9_{kMd{`
zmFos<uxf^NCtfjE6;6lK@=<l!lM)kYA>a_>4N6`JuX!0yGBLCFst8mMOX^DOyY;{8
z)My_nzj~s-tkUa30b%L#sY8;zaiMhPS`1=P2*x*+?H(>jrs$ctWb`4X#R-3(kg#(u
zIK2azH?{B6PG4V?67G508A%sKB`>7T;pl38E^``Y^dzJ%aj<<8JIF0dij6GG<dqY}
zx?E<ucBxXZMM_b_78_Go-^@%;t&t5?Awu+BI=1z3|IRGhmki<uEDCJxUxoPoPbh@{
z20cI;nJvB_a6*JQvk^XZ4mV;E(y2aNd5beyqmPKDM}WX14(kW2l4IsEZen|n<9zKZ
zq1rH#c>1r(WE`Z8>c~HG`dw?rM|hCYuSkD`+%E|T(!M6dcTy@KGp{duW*5nfO?DNC
z#(o&6?+@|}i@3Kb-pw~Vjb@93Yij;?V4$i1Ng%-3uiWJnCD6K||E3pYbE}Q}e0j6}
z_&#rLLuI>jg6FwbSxN!)^Ze*4ym-&U`IKHi<zYzw6_i{tv^!h1_>bNwXzJdO1G|{0
zg<UZVp=Y3La-Nl>9S2KRuWh2`n1tUSGd%=TX2D<60&nD-sls|J<ZaaAfCW#KOjf~5
z47GkL53HG3#PPc;Ukd0Yw~M<Xs!hO=^8b0^|Me#L>(5DD@*W2$2~UeU@_9Eu!rx2t
z4`39nkH`}|(BKd*HLbSzOqX!|ljo~?tE1nH>alFqtpvNx7UMTahQ08cNhNJ0GHWV_
z_BrHy?y6nn?p4F#sY)JF%YI%V^LCy@tBAG_Ny4!o!u-RI80o)$*M<_cGOw6Y#=&D_
zxgmW*Z?6u|6k6#O#}t!TaD`;j9X(|!4qpW>6Y31EL`n-d_(WqJzup?n&rh2(WXv#V
zxscoXBCkk9#jmF1Hy7R}-L8vE(BCb;#Z&xfH)1ho6IOY!SW)OwSn~PZcjy-!)vF%t
z9_|#g?fBV8w8{ZJ+ua*hFm*>lm;F2Kmn`k<*C}O})Rwan%dN{>4{@zzjZS3Jp9H@V
zgeDj0UT0XpEZR5qE_xg!EBi6`<3FMaXQKj&2fb;}C3y4|q+ObT7^vsZ;o@I#KL7Nd
zsz>y;Nh8>oUAC)SE}O}D1b9}(u~Jl5AzD2B2Pp=Vsla~-W}IHN;fUhTOOM$E-#|h-
z$6LtJZyI;gA9*LvE8;yIF<XA-%Jkk=r&kS^L2#gFzoPjCm1}C88d5-RkDZ8h+H%aY
z`RPZ{%(AR{{VI2haVH;BTEWC5qc-wo)w5&rkKErvdtB5JUIJ1)k;A={Xf^%_-Mjvt
z&1+006{D)w_7lA*W<o}kxK;6BUQVjQKAhDQ4q@UrYc*OLJcEL-q4>T^IxuaoKoH2Z
zPhecQ-`-w9L$js57sz~CZsxx8wKC``Gni*Ivn$%<uzF_^r_WVA`|-B|s(Q;#-$WsU
zA(dk;insIV-pUVqiY5)l?nUA8<{pT)gd=d)d@?h!Y3S!=-9z_v!?($El{K9oPZk&!
z6kJ=nvta(2s<oZ6fru(;>){(xLjC+r<>>lMu9IRXuI1s?)u`eUoy2T*s-*;q2HZIX
z7xo|JFS{Q-!L;y4k2l)__s8#Eop=19!>-s@<RhHwn)M@iVg&aE^u=PkIK&lr^KkIL
zf11D1N`F*~X7mM##UNhxEBp6lk7~|Kv7zHf%JV5hxn>0!^0b3f{6mGR?%|jifnog>
z*)}IDpRv82(akdq%1n*F(QIu+4-_X3cL|D+g^SFgMqIZN$icjB25%lnkSm0=lp#K=
zimay9egK3><-~zjb{|{zPd%TyYC==L;Wn|<UM7|voQfv1+Zn@K*KQM1=D=kEDd0Ub
zUSKSzTN|hP5iMx&)sS1B4D}Vdc&H;`-f+Tr^6)=aI?6Jc>tb;@3lwcN&&gac1flVJ
z`hH)=X|z2AKV%6J>dMr-!MWFn_&l8T;$)>t`Sb%5Q!mES#&8rRtAr5{iAu`}{4&IP
z=uHW*69h{-1?nC3F^SHu<eJLO_n?oStF*-qrHVAchM<+tO{@H^1&0m+dcjx`&8m|F
zVw;6ia9erq&d~CGWb_%hXcOCds=aEuzkKa_)bR9FyTxZ60(QcM!UF20GV@q7$sQ!k
zcB?#q$pGaEFvt1>LBYS(p5WXnOF%Irt@%r=3K5sl0-hW!fB*+aRgo9Rv!ohv4SLDG
zJm|=CsQ>c?aDwYC{0(wj$dtGG+`PK&0R)1RfcS}h;IQBq?slu*(psru`@NU}?X3}v
zdg%i|3o1Ss4~#|rt*4>X;zBu@9!CUTRR$G2?%-2h-2}|?&7Ik6qsnvxCtST+M2mH7
zX&{#Kvc{E@?8@f;_+Sk4qB#DmSs1cbFmg0&D9LNcgQjt&Gz@$v=Ic2gj^Lk7*_(Lt
zF{cXRUCAxiC>Kr&Xoh_*kF%sNWuB{mD~dde5vVsA6cgVT3mO9S2C_96Zw7q1IDYNs
zMe7xSvxB8shpYV2hG9>mTr@F4CwVEH{p+DxXQ>4VzwILDW%A)q4}ESqg~}wcxWMp)
zqN|TbSXh`cY%Krj98!t)1x^&6#~3c~AX0e7PhO_gS9&U%Jb39MJ_C5AJ+m8}{@}Wl
zJi{|E!d^S*cb6_4x4nn24HRe^@vRvgH9oXG?cYRt5i2JDm+gZ8B^3Ur{^u{UE44xE
za~l_}c8M~BA*as8@}P7w3VqF#ggcfIYerEvvnbZ<Hd21B&&%D@U}7y5FFSAT!9Fx_
zZu2A6vD;*Otc1VoJ!manmkLx4D)_|xR9$I;+LEmBRg@uyk7a3$q3SBz6C~oIjWo73
zSFVDLdZW+X)_b-QItT7{OlR?|C&_V7Sy17D7CMqB{k?4#mWPjQw7)tg)CP;Ano3?b
z0c{>b2^fwb&_QbH)S~iWJ|E#xMaReYEUI*f3`c0@p_NK)^9jziQtR<YD)xcH?T=Y$
z8{z8_YKpqm?0em|HX#90s07V7ii^v~=D>5;@_5WXtI2S`B@H3Ldi^6ij8aYT=%gaD
zBGvy9n1Q|_$lEA=!ZYph@_&Mh;PYMz@t7n}fyIB>;3zQ#RfHs~KZE>2PGXWKjK!eL
z@^&Kr_nCQH*C&-v*S}!|4HV%(jyOHsp5Mq<s=_|48k9;u?o^7*!kv4}knH-&m1%O^
z1qIG~WFQuQ3k&`DF}?Tcr~0=+jFwE^#fsH)y_9`%LdgPB1g}t}IZgfg4TiH(D9TN*
z)7=SHp}TV@yK3lxb2C__UBUO?Cl`=j3`6Y`z-SSh&ewS6|6|H%*uu8Mxs~j=Ut^r<
zv)b#xyjZb&1Ix$<Aw^3e{mEUG*@xNf(WZo^U=~lwE4a7OopM$#G)fk}z-nri7Oic5
zQ`mxI{+=G8YX^r6F@f-r*5LcZ#6gsb>a-1wNfmyzw+(|v*^i~Z_T?(YxgVszz?DM-
zQh!1x%Em2M<$?lETt@ZRXD_j$qo`13MNQxMDZ1|H26UgFEV(DJ<c}deU#NSVpCBUv
z@;1`q1lR<#FK?GC%bWwZBm4h!%Mjeg_u-fK;RmjLNYZyb3}pBM-}I|TUUUuWlX237
zBlY~EL6u7|F#-Jm+Ci7_L@5x<U)ba!TOZ=OR9IfsH;iK~*MDB#GH2khT}-&pDt9J#
zSynC0^;wFET1^AoknMKKHJOwPcSr0&@APUR;aMI{Prkk@OdDTpZ;_j<{v|f2AbWDw
zHjK%|PHMnZf#RgZb6GL1k#zd-MmS%kMV&rr;q9}?HVVjZ5T%f~kRz=2B5DyW5zcU@
zp%pP<ug}xtV^@4mIpRGBobSU*_ycVhXUB@xQq!zF{;a3gIPvEn>9=9;8h@EQuTvOi
z>}w?TQk;9HeU^Y)1etq|cfrt1_-t>rNsU|OGN7zxbViwy7KK8YS(BeyGZd)<O;Qrx
zhm5Fft$I8`z-aM3yYgq)PM>iD(Y-ut`xvGD=`i8Fs3;TZX8tsD5lL=%MM#w7Y)sDm
zRwMh(McSD8Zk&=`lu02=dtVQ({p~XEH^Nh1#Nl^7LK+~!_EV~ML7b*;3t}GCllXL@
zMV^5kPU9F^N_pEwf#EpLUGP~X+>@1Z8%%5(29d=@vFYX<+G|O(LzPi;8|2r!OdOj5
zYs}}cr_&srgu_vjElZl=g6wz~!}I07N4vi2_q~_|N^7g%DVE|ZMQN<cHh;%Ld{n~P
z(7=fp#k9XjsX*1>jdYhVwMxUM?oI8Uly8JwVK8M>XtO2iM=iyGJ95k@vQc;6?67ro
zuu11_E$8<ra>}N0bjzKRpT*2o&)%~SHWpckxa5ZE7gcCih&{9KhTPvnMt$?fVU3S7
z%EfOX@1gKn#vBeUO*8}b0DchneC&M>8SYK28TYW#@g$!r4{o6`#_kz>*^1#(F$bCg
z(<z-Wp7(BHcQrj&i9J{uVP89T%Cy@))CN|j?bZ5QOABcJN@jm%eYu&(z9gm187j)-
zhel72hMqZRVP9Y~a2&v8)tg^(_&S`7Zb5FcA>=&@0Wv4XSPh8HWXYc~U|Dd|u3~P8
zehS1RN8CQ;!^FoQiU>O=w)#+Q(KnyexV}6~+V!WCKiZsf5$)orrsV8)U??q%>O(>D
z?0;|62c1yPNn61)ocINQyt%cE2Cc8ZI&$tTT1p1Rv!MB)vfY&yq(IbamsWZcF|Sc<
z%aq!M1L!_SPt`K2<EYEVPZ6()HYgR}#l$P&8k-57KGOXjrG@iY=q^n9?qJ{NG?S1K
zSz1$)3Zfc~&zH@4*tk7|Fte?f<x9@%8%R=la;?Bj40P$-KHi#*{JlR1@(Zt_1APvd
zkf=PKtAOy|AQe1EFO-<_fYO{~ss5G-l9NBfEh9QBIu?q$%}V@RNu$C|1vIq&zbYDS
zm={-nMaEtV=w8AD^QOQ@Fw%gwA53XYFt-Olz=}@sj(<3^PDQBD18n#Y*xPSwRG)Qf
zIX>Sw1Sk7_OPzQcAH2d8oNVdnW)&;7TmDc@;qx~>P5O^D>6(?BXO8kM@<IHmUeW^y
z?n=th<&O$=JfHRshg6|g?w%=RQ{ffI%SH+57^=-Q8xo!`J>WoFU4w>?mMWQlHaLHQ
z<hA2kD!H+uk|iEdsdpp)=-s!8Qg%`H+9rRB%v-(6-_aY2+&q}f6U0ZAk6v^Ytu9|U
zff|ZLHGDL5Gp5?F%r{G8k#u~hC^I#z_Yd0V-_syq(UjJV!{}5dTgk>TSc6&9ZoRPY
zd}Jd_qT_uctzNwt;-OsUlQyNXwsVoQEl^eJK|dt8EXVMQEsSO7<}oic)K!bqKi?vf
zAU()vFcG_(Ni)@-3ia>9*1whk-uZKQ`)}S?yLuu&NbaJdG_EKbJ=j1U8XMfH7N=Ht
zP5%XhH2L`Bew#C1UG{Zs$$B0)k(3=fmdez4I7Y?ej_j-iv}F2<)#1a9#`gH^12)U>
z<@Brm*Vo^eyz9^WPVO0gQZ_BI#MC=ysW^N{u^pvz_n5=Q%Ynvv_G#(p{_Ei5JcU<5
zDe+c?RZt51(7Qo}(;o7235((O1kkwL9I>Rduu_}@S!wWPeP_J=#+a^XFhp|NnsI`Z
zf?eoBHlTx7JVbFhZ~K^+>tCqCJT+Tj7@;+x{!W2bZfHWwz<>@%B+20%L5_GaU(zjO
zQ|$;V#ZE@GWQRN;y?5k^_RbfRRiM*7&bd>t`Q6V(#T%!A!=7!8P7bPVkVBm6PeDNe
z-1Z<*efC|>0_G5CC#{fWFw%VIRZe<7c`JQMe2YJCi%~Y+df;ymS;cW%_h1qQ_b|ZO
zAgp@*XZ7NLvhSJoW`v>3-MIwPJ3nyA?1-X`2XlI$14o9>)TjnSmyk!@9=~yuR<noI
zNY+r7`&ogSuDAqRWOp;T_r**s-TAN&R(VydYGdPyS}}uqvLz_zBb{X7xPR_yjYZf_
zDWF(ieo6EHNP7#QINEJ(bP_ZK7&N#f5Fl7^cY+6ZcXxLW5D4z>1Q{f_TX1)GcX$16
zlkc2;_dc@kU;iy?m}w@JYMQs_U28pdIBNe*57v`Y(d~=M;2A-~qA8<+$5;ftbQT~F
zoq^Lz-7hUJg`z@45$4C-zKO(Buh+5IW}%9vkDA?BuBWG;VvN8fkbe(QIAb??zCFcN
zv#{JhCw%O5M_sQE1a<&X!>ArR9u?n1w!L(Zkqyh#cf1(Yx0d?n8>Vu44ALW{CdaN<
zM*6pBT|_X|bC*Ql=Oy?WH(KH>$iDj4f7F2^#n-K=#U5TXcx^t#YX(Lto;ONcXG0yl
zKBhiqfzX|&P=`v{WT}(nlkty$l(o+&Oh*A2D9pcN8GQQOO0vTN5H7%Uz^Bjum1Zh_
z-pJ1|>di*M6=B@CANFf_;&b>?rJ5>LLG{D|kA6EiK%i8{goMkaU@wVJ)u4>PeV>te
zqEf5&t<taP_4|D|`P)&><OJO4xvwl%j9G|qUmZSFd_FmLeABehm#oSyZ3Yp7{+IRO
zX569uExGjvA>I<dw&a*|p(&|c#qc+)L2+St66-;iy9!pFkoH@-dj&7<3DPrY8?n64
z$;PT{7xGW?FpG8UcOlmYAve<BTNo#4nWk~s&Px~sTkHmN9q+x<-L1t@%#*ckX9O@}
zHN{J>_nsVR&C<zEZ#tex_Xshn14NBH%WKZ+BAQg9RW3Jod_cX}gq$U2Hw{Az8Y_e6
zy*BKm8<_k{xpwD_oaqwueN1uoDe-B@9>TPamu?>`FysqiX!yJJZvCY%VwVKNc3au@
zA~~Og>=k!k*K4{<KTx-L@P9$W*Rid-_vQ#L{TZ1c*m#SzadP|Rs^h2j<GgSlB~_zD
zmAY73wsc~^+g?PMRj7;vxans`588;XUo3?=q&ByHA3I(Pl+647F5ku1N9fsgY1fWD
zSa^nhl!*|P@J77#UHkDBrlrrxDbpufr8p?GkTkL<QVKi})+k%}t~pIILK{wtF=7g0
zaedAu5OR-o?RRU7TAR|vfdmQeu$t5f5FW219SP6$51WN!U$hM*-zn<OW0le<-t3f#
zdvpF$GY_`CEU4WkqIK6tUI)cm30*+u=<fftb;&!DbtqD$s@d*oiaC@Ep+*bqKUe|Q
z$kBX@W2ygdFS3SF+Sd^4@~HOs4~)K1@v>2YZ9Q2V+_0QBb!EoK1Ns9!tC-fy^0%#w
zixdSGrI{_&A=~4M@o$vvI4()<iL9o0sAkpnBT`NCjs5^F@Zz6LDL`G=FWwm;^g<ZO
z8`;jm9l~Ae^VOD)A1$aiOrKBpR59d!Y3ySJY7{~ft`}<VjSa<1M+@HJ4%9ZpL!Hwv
zJWY&OA6c)b9`Tagqff^b!!ma@)f@$5?TQG>%*gc@=h8tFc2`<ewRxG_M_h|ND;&cL
zVcenS*p<TT&Q6%T7?l0(M+y=L0ytjm%U&{{D1ISznP~u&k=oA>fR%y(W>Uxmz#fUR
z(*A??aI`|Pc6j3w7My2b0RKpc_aO4wsQf^`3+|ch6EG&}xnPb+KFzPcVS2{EkWFTk
zlaUn$1`IDR0d*5#2mVS32XgO~VC%w<p#S6HkT;=(sq9yZgp#a`s$T(V48U!jow#H-
zx;qXI=52fwd89Izp0GTe#MC?wFYU<a7%!3LvJo~&`c1qqX^!hOl_*~6_QkTKN~s(=
z;I;2c{e80G(c?Rbq>OED3_D3ZGu($3xj_r<lUn)9%VHM07r8lCw3JxZq{J80?Bxok
zY9zh&Lk#(?PVWG>jKbo6MqzWZg~cTykuNW&EUGI62#!Jj@+(wUOMX%R6#fCR=PwWe
zfDDb2jVtTzC;Kf>iQo)w+I9;(nWyTh2LEYTMmsCfI-^}lZ*p_(`!(8yEcXbpryPal
zkt&7WylUEO|3Vz<$C>&7HK}Z?zbZ+&0=qfluwc`kVzx60(++HeVeAt6lkJ;zO={cU
zEE=16*GB04aI8M6WQJ`;HGKG_=lx2Zg$HBm_?oEF6}868G{uU3zt#P+Of>|%WL>3X
zLo{3Kdk6;d6AX#cSx0H{%_o~73UejPd(&s{tnHw-`^djQ@z>rr3*Ki;6RT;W-UH^+
z4@a%H$(KO|^VKRYSkyn@8+e;8a#n}F{CRH=c+d3IDU)}ry6ow4<x$e@t%9Y(uTl1`
zn6(6vn{;jOY_oSlp*4rSj2Ar@v~XS=;8H4<X4{4-^+pq`Z2HA774Hu_^6M^nuE4M@
z18h`=sErO=*75@;rN3`}Pal?AesozO4e(OlJGi~jRBjsyYF${Sa!<3vR+pX-=)bNA
zTQM<OM6t0^K#hrZ1Mwr;MogL6Q!Lnbcgd!|qjh}u{alS|FCrL7UOTj2ubX@%EYx@T
ze$MOz-DNX3jIwiM4C4c`e8@pyFyBEE=suBbjGmCKP9NXrvJP|^w5kV%7H-<`Kbo11
zrjeiE$D04HXcC_U+(ImXV)!2>4wwhLm1W;nXC4(<@;xuqcb_%-u<i2lslOVm+U4k@
z_ilccjnY#5-%?W!N<Pf<24=vi3F6CW&8y-Ce`}+2uO)H}(YIMvd^NI!z}Rh`1BTuj
zqKR7Z$vL95A28WBF(*Q0vc&5_xwV#yXCqX1OgS=g>6EEGc_U`mF~BB7!cIPj|H{v0
zBqRfNZN>mMA^>fELN40Ws0n@GJ=Vu(3qJ{%_myoRf+t}ZkGX<n>4JSM)|qJ61Z9S*
z@fOhHq1fM{7W+hRTj*A9_4_BPFL<)Ddax4EGUb_D7=*`d>s`CCPwD+Y?NfRrvgea(
z1gJgorHk}$CH6L5H9OH3G$ddKr4i5Q#Ym#WE9lsW{d<Y83l8>qL*|_Wnv9L}7K6XU
za9ND*vq%;H=HWx+4HMkiB1KX3A)(P`F`MUpjv>aHt`x%K%(bhsD5Rb6ll_htM3P@n
z>Q>d9Qr;2V!GTtN9C{DbjsKr&ng8Q5`K6q0Sx)blhV}T|P&>9vZ<}k%P$f@_040I{
zwOcNTBp#-hecwLaeA7E{9_==v$Bj0QvU^n02G_vJ5DD$|IjwS}IOJ8Rod`(@Kv<PL
zfaJTN(R{+;dQw_b$e}{t5*Dm{%?8aH%YN7cRd@XRA$CVL6}!wU_fy%y{p6hzQ2C)Z
z{axc^AX+jN;_K5MVu}=UQ$SUoHX$KL=T#=D^!d^Ij(Sr+Gw*ug%Ub6$okZqV#?1Ks
z1==s=S$>a*`a6j-1jD!#)a8_%_|A)v{<DEX?*@7Ov*TWuU2cR>Pdp_#2~`rQvxSwO
z%EodM5Ehyv`zKc7<tpiFxfe@chskY!ErjWXaYJE)JI7qo?j2KE?8E8EwdnVR$J}8a
z2zDol!K4B55rAaKe<^zYhvF9oLn%HWTl*m4hjl*RI9eOmH-aetbk#;=@C?4elrXJy
zJmq21FrAc~lju;%6V`9F?ox$zlhHOlU8dD+6n^4xhPI7g+(H01?3)KzckQ&&yJtF+
z6<k%<{b~cDp4fJ!j64-zS%g}p%qURa(QRb2b?}rPXT32D=E8gH$&HZJ@^t?6<iYY0
zRUgkIm%(_3eIb0gx;gh&$28suuF3V;uI+Fh#I}LMeeR8WY$QIC<~HL%hw*7YDwI(}
z!db3%(VoGy*k_$jdc3F)DqjXX-tcCo#8`?V{vFs7EEj0~y|w8CuvjFa1z1kJQIL)p
zpF6=}ju*b}L?|I8#a4%3F2p~QA244NPjnU396MgK9WBWjO9O|}ggW=x@Ek(?4@Le0
zsS}mxDC?JfY90MhFB>mYL6G^(yE9+6zr(pz2c)wN7zN2)M0}!yc1Hn`+!1v*ig%tl
zSlr7P;=Ca?;_-*}W}u=xYr+X|x!_OL1U&m}x1-fZXsSEq7sO9T(BZ;GXCWj|k^K06
zV7L2A@U2<~T(_;IZK1j&?+2PrVD9_+11|%weeH4!Pgx$X5if9S`Ma+@BuL)7yH0o5
z1=6#B^pRl@X#E(>djQ&a-SDg8CRJ<j(r&KQSzKMrTf6W=6LbF2U~Fs5i}WB$Vw*u@
zcqXcMEEc&U4Isr8AgbDN#Bp;VQ`YAZDowDN@&A_koC(YhzW-~F{?GmTzj+;vqlLAC
zj%gJ~fC1Vg$hA9`px>8d`7g6iNDZ#TOb{iD$kR1GQGSVBX@+1E77DxyO!P;nGT8~H
z@w$|X&uR-@mN=qVW-*O8<Qd(K+HdyFZNb-$D}w@&0jGkWZ@fp$Hb0$;pY~UL=^~I4
zM4l>kAVarxW~zRosaohp$Ui)`$8);(!c3%UtceDr?jA<_kjwg~7u~J}0S$##-N1mV
zMQN^|4OG?+zW<5Bj11(h`+$+45Jq;?cX`8Lvf!LJK@vn1)5~l>sn3eP+~1te(${}P
zw(n_e70=P!x~kBeZ(?{AxNCbOt*>E}Wpb@7{Wf(Ya<+TzKvkTD_1j%7PtfhhGyMnY
z-qV{9THbZt-)dUDD`#hWco}zlyDMFzk1OtY8)d%_BpHUS(Og`q51DRBh|H@9jkH7(
zL1W<x-o;SXy+!DuF(Ib|u6Z@->_?j}KZE^qzjvu(<NLvHqPWjY5y1kY?)3x5@#_3=
z8ZYM6Rm!CT{EBejwyjuC5uCSEQf5`2sW-dsDsJUng0o6)m)<j%BeA<>y0>Ge6&nIg
zDQctd(+|GZ$E*JI!?S_;-hBe7(&D|n;Y<)PUb~@hObxNIaWW2<2rC$@F#+2u|4Z`9
zt1%bO&Wl^G6Ql<9H{cW9W8Qgf!N+^TPIuabg1P+~za8l`<8RT8J|xgi#OJ(3vf5lq
zBLUS95#W6ZTVw;@@96D~CUKsO{{Ay?aD*Gg*Sh6a35_(ZB!fMM`wjL%U3ckMA@r(*
z_-8Qjjm8-9=N~jMsjs`*9opMBN*Pxc9ro0*%k&uJltqT6(7vS_=KMhq$tb@Au;Ghs
z|DPurdH`Ak-24G*HV|}ZHvOz(gMT6|IO)Y)Vr@&%HfT9w;}){BrvO9<*oY7VDDSS3
zFPT6E1<zBL!IEi(u!PV>e!i`|+Wr@h%FysZIOcr3;_o={l<woR#`GcLyH>^Pb<k1O
ze}S5)$hL=77(^E{mNAY$<Y64jhUokm{Sm(y^Z)?{YRVbsG(*p;K;%b&@p{!~?@jfT
zKQLy<aBbVr=}LD{5m!zZ(K!kbBLy(9+-A;rAHShL*8@3GADVEiJO_Dz+FVFX_iygZ
zrf`&Bck!Sb3=R{*hMBvBSZVHC1oVA(aA8RpFF!ljMVS7%MEZic8N(FO9A6w0D-#p&
z(-_QCqzP^2{Sx?^a06W|{F_J4qq$0C4(TdFR)JZ~wX4Qmbi}Is#J;;St7pNY78<E#
z`ClMlFnG0JAM3;@6MJPeomJX{)n^7>60UMdw4re|)LF}bl{7$P-*&H{pkyVP(v83g
zgCQ&TFRVOZu>f;O{e88}`7yPaMm7fI#A_g%^o?E3W^!rHCORT?urChVD)?+qMXGBl
zEnGER?B?fmx^Iq#xpFq1Z4L9bnCKeZ6_0=GwuxA+!50#_rYSb6+R?)Nxsd|R9&=No
zB+ebPV<<N0bZLTDWn!l{e$<ESXl4ThOVg`uuRW?jr}W*2H@!U;ZbvTO;{HMt)AO%2
zVj4uaHJfc`-M#M*q?soW#LPzO`YUkR9E$X?m>wLow;!L6H~N0k=aMB3sgru*|0KZ;
zE<7}2VHVv=4P^c@dCiQ6JBA-)U@6Ni+MTVh6fRc5QZS!Bg@;>ZCmF@eGkm@MdyAI3
z^kZ!r&tX)#953ouv*4n!E=9895!q9~jVzHi*S||@hUNU%Cr5m<k~gb5MZR(Sb3}CP
zYZWZl&)lc){5Ou6B<u=4f5o$8ra%^dE%<45UFe#9Ed?4q`K}M*{@aUT>XC*cjYsxl
zQmhzrYKEN_oohRVEug8=2!w*o!=#uO-@Pk#QYbsJSw3uZ06bpq2)#F2Vay5NOm0+8
zXA6APJY5u!5Te-N6a#Id`@uuoxS>chYFnAQwFWhLuhktM&v&ntS$;`S)BlRA;`+*0
z3)|8Q%7?w<(<biS!g@self-Y{y?L<=#j)XQXO&i03s~tB(0-%HeY<a@9aiX_;%O=2
zC9_C|2<G4&r76h(P&;k>2~h=z8Op!sxmt+N2vc&~43wJE-qS`UA(}}KJ_s}XEhNMk
zZ>+$TlIp#RnCobFuEo9dqHGKibvRIrqESh8J&%-$r0)l5p!W><Fb2NjH6_AX*q<47
zv6qUPW7?ZL9!BXtKa^=yL9=VjRl>JF2<JAIX)eE&JRP2-mT-xGi%<0?rO&*O;CxGL
z#n0{}6d&Y{aQ9ZGDMO~UzPTx8u)aR-XWS|5j-J?m#7lTP!bn=(aDSChF?$OpSS~J;
z5~AHNVi>f6VX1adVK+^Z&W^dC!P&yQ|9Cjh_^FDQ0^86^(9^u3CPnOwxyp7$ou<Fj
zqq`<*iKPa9Siw((r+O#uBalkfU(rq?^5N2ujafD>EK9aWD$qH^gWh><C-|q!PE86Y
z*$*~2@+}<^B;Qm!_SIB;otbJE@6M<d;p-Wp56Pl~QrKZJREVhl2kCKrE@f?Y3wH@_
zuO)1)V0UUB#zjUwnimaruzLyYUYS|3PLrgO&M+YZ3C0C<|5tnazs&6at^v3^t`#Qo
z61s4wf0htMSsT?1=B9P!+VqQHcYm<BSajUMS*f}%s7>dstq9x}L+c(w6O}qD7att9
z0pn2U_YwLywOzH&4M>L!tXamMF$I*BlGR7jL&Ji%Jeq7+I-Bi>z5KVzFwGfmgF2Jr
z%WSvdn$ou6&vAgo(w`C`0|~%K2CXVPYA>yA5Z<R^w7PzeZ8R}_A&oo#DSk~%=$P)S
ze`)xHZKJ{3U}c;Vg&EICtkz8qIKC(12$1m%w|@-y<6R*xyPYgzoF`yBX}JLf@$>SJ
zd4yPZUFg!RVs9pJc|qMJm#tB-E)CE_p_alC03<|pX7$b(*ZE=}{9+w)jVJSQ&YPr!
zzd3y&8ZQYkY7|gZoinftVlh^N;$L)D37ft7%mYeOx{LFQC+QZUqB(tR{qKqT>yuYI
zIfr{PzB{M+0erKs|Gp#oG?pXwA=hm9P@t%wkM#Pr4>K2IwshHkp|MrJKi+0ktM4mN
zsxwzO_XD!|E&-fG#W?l!jI^)rH?&#kXt8}Uu9&M!!nna(bP-(I9~kyRxLSP|!~J$*
zeQo5kC~O<-SA7S%F_@QkUZ^rbObJZ@x$N@=j|g+u04k4YtD_f>_oiv4X4544dUB<$
ztOTw3D3?jsB81m%IHOrJ>43-SKyG+nGz&ORFB^87cG%8Jk0Ui6S+30A$TN|0n|5qJ
zkQot=n!RO|4>@kXT!<&MS;RoS8I70>_eN-|``*D7#kwp^=?$eKyEtHOkAFSRWS7-n
zksdd>ACq@l+ZvJAsqb>>xEisg<>_WdyL-<?V=VVBes|>O0PX;K4{<*mWyd707e$x-
z>>gLwR8&YEW!tJB9skeiosh$T=F>D)r$vK91b#VC-zEF7H`l}3OdMOCSXa8n>Kgew
zz}N|6>Mv0FGnq*=<M4<2*m;gGUVv^7fkHPb4p}zhp}w7187zdFK=t+0&~I_`tV`n~
zkt|8upL@7l%?%7{l?#i#g$W3^^vA@WZGy<sFx@;?9y{7PDiOC|z2JHPw=IT-#<4-Z
zp}y!nl7(pP+i#GY2;0<~vdH82@$>5{v>#mZgG0pdLjWRjJ2W9bT(xybMAOfPw7F0$
zj-r}q5&!~7yZ~0ozcrxvvw-qy{L~@eOOCRmO}A{KdT`^7^=v>;(PA5zg=^kOW-Vls
zdX?kUJBd~0U8Do(RW{aaNF)@T%7x^kMB?|gYbPC^Z`ZEA)h3|vJ9`uE8B8AQt31Yn
zB4SAI%rH_@FJfXsUyTWZDa$I@57tS9oQ;W2J60`Ql7+K26l$9resi&iZe@Qv?HSx9
z@Vyg1PbJhQA=Exw`Tb)pf?(L<2yH>URo2$5{1bdWNHiz(H6FRiDy&x0>t@~_B7)+>
zCVtqowcDYtP%K%`N*Mv7!7y!xTuK*qs8@aMeLbhmPDD6OjNs5`B59Ts4Az9{vmXO*
zat0E#-op29)?DJh>L6(G3Gb83<FLZ06~U*R3J~IG6usRKp(vxi`d@FaTt8z!#b~nm
zgV7CU0*qJlbBjIBpm^#d(on*j1No56D)*K0#mAkS&mCu}Zny`S{uGA9g*ed8C3?r9
zxy4%J)>{*$(=NZ<8PY?k%BHDxXP7n{s%#8}K8iknzLxfwL7+13XlOL8#Up~97hnZ!
z7EhEi1hSY<2lU^^LNIj%q5QyRRKI{2iR<bI&+o_!cKb~yM9YNvcQZtSN{oeYa7GmQ
zatLaOZHk`a-Bh<+^=!KRZ2S3-*AObH>>12M8?5;8d8sj}I^C6W!t5k#u9_KCX-ldO
zuCIjbBznc6$o$ZD@Z1Nrlf`<i{sS?A_&MQ4KohloLStB&mX&7H(W=KSWJqzIMwh`_
zc=frxEQH>rVTmctG@8bXl#LCc)(nn1C)0-AkZ{vBvPrpH`<v3eQR@B5x3$0p>57`6
zsr0?vsF9?>5HX82b?P@V5JFednQzKt8L%y%g&eJtKZjbA1a6c51rnJwwt-Ok-Wck)
z*>KQ5EInJP|76xzwNqHBKa}ef#KaVCc_O-cV%*`N+SUHS3$xC0qc-BNYs;ojJ#Xe)
zRSN473Cj;hZp=Q6g^l3lRTrpk9;{Oryq-?>iPY|sk}w=JiYqkX)QDVaVIyN;3!%fu
z0R{k~s{FI-(VDu&Eyp?0I^50U_)yh>?7(_pxU({~Q}58?D-+%7ri9)}MNIV}N(iGd
z(Wfgef;s}1VMZ-RAqUw`sUH(oJ!DjH(rC>`MD}|cvLWXgZ(N?$nL|cY!CZLd*V$dU
zd}5?E_H}j~IzF72Ws(zRM~+m6b>->oYrLI7Y;16FqpRUy=0n*sgn=cu4Ce2@Cp#J?
zO&2SHH0>I8;W4S~ABdJ1`{LAplOqAgWPm|HMk#9OqU~V8|Lia*8v>fCo<#df-Adwi
z&Ft*QiDI78rBc%nkBqV9-QcEB7ru2+!cBUY{hKu(xTGDVB50q~7HS&9JwQ&aH<FSc
zsDD&X(p@rXX0jK{syVCKLRaBO948M0(UEO_oTy&~O@O?>H)>cb=QNUkI+iXO$jx7%
za~kQtj||mUjc&C!1gE@=V_Z`I0(G|Y9wa^+RZuB+uKZ^MlYDAee?xaG16X^>X?A6o
zsO()Vqv>f7vr#W1>>e`J(a^P7ClI+ddU8|7s((<#_-c-XYaYtg+7Pi)_(+vgS>-pz
z(w2Bd9&LKwANAgqKvqOfiV7?<<JM!udzAI;S5*-lwk0#y(BwB|&*kgcnDM)QNl-0$
z;}f!OL<^YwthnCLHTN?Wmi=UmWP!cKIMeu|oShgs>6n-he*th(d>U$>0MGLm(=n`f
zA>tHoe+YfVfa&@v`Jn^7cLyPdtY}5M$E<E`b7T=Ne`dV?0g_~;?NE~H0F{{;EcszL
zr=WR^B1y$Q)tOf<ONfKXlt7M|`jAgiHd;C}S8pMPW{<<+K5u`1-nZHJV+yAN@}_T3
z{yNo6738fa!w^jgx`lZkIfQUCeY>)WHIFPJzgR`M&dM-KWSJ*}f8wf#`4?_uq1>jj
zdxm4o)&U%{>!bB4FvVifnQR0c>h0B3ZWQ|7%8UKnPF70`w#P`;#}%0TZ5B-*+aC6%
zJGDDUUm<FU9Z6rdJfFTGaVjU?!W=g^j2n2b1V2V!E!)f;I8<XN>t_BkMFM2yjrFmh
z41KKbmj;yO9G-KiAr<FfXm{T`<?36g^$JY}mD{Xn_F<=G5GLLz9RXNNgh>4K`e)z{
zY<UTe$W7#3It%Ap+<}zBBVKf#w|nzf#aLd5wZA4DVG}&+qoUvFQ_U&RL8H)Dft*?F
zyF3O8RF?K??bOUzD(5vt!cIqU!e)q3<G4coz#Cc{tGvOu5kaan)<0HE6A@4sPrf0;
z{&shFw+#URXY^a^4sA>>79-!)2U(f-t)lJ8i+)nmyW;0_0=B~<Y|K3zGM(;|mkIj)
z0jg_DMdpM%-ID-Z4Q}J;@naU#Z3*6)7<dJng>N88p(Bd3TNYrE#lE^hg6N8Hv4w?Y
z<c1oZ+@zvBPE?uUt1Vq+jcztQic`9-eR#gsG%J&UydVm)#)H?5R!Ha5&mg%~Ty^!Z
zU+1l0iU!hF3gV9)<wP}BKcwn#+J{~v+SvM^5aB-Bg8iD<-~Gtx!ZpLHIYOjDhwn-y
zwp@N4$$yyG)*ti8#?9tJQD)8^wZCdA{AS(EqUMUrdc!$9|4cc!l-knD*+dB~w)P8&
zK`AV*9RK?YXG`8C5)j(lg&RewYv0fXqhE=bVoYkSL1gEIc==CO))I&E%y4F*-ON|X
zBV$K?Jv$tcJI6Z{(^W-c{6KLEVq?c#zU8?;J|EYvCfLJ4h$hSr7iqQfJP51}-brW6
z!Ex5fbWc96X8$nC^a`eafhz2~{lz<O^-~~~w$7O)CvR(Xjmy;B+__kSECCwj17)`y
zDSWtsJ~8sEjT*+8LelduKoSl=K8kr!Q9_NF-79R7k>wt>_+xz<&0(()kMbtz8X?N%
zz$DRsF)7OaFB8K5lViyIyA;~WlD&J)rYI5SqfV#Z^JrAnSqd5-DF)Xz^7(?9qUWIo
zp{<k76i?x0-b+cAPg?83O7mR3^UN}Q-RmlmZ*bsysx{f{`$X!~R3F&bowyHr)G9nU
zZZ%0v$0IoUr>XGJIe%VzKr6Lta8eA!b;HY#I^6zliGC`oE<hI=tD?g^HmYMS{^C!c
zO-0<V&!%_eAN5=uZr?LhJrNeSZ&wmE;u}zS!95FfB;8KHbc7GanFqIq<^HR?FVZIl
z6zMYQQG|8iq$yty_JCeROS(zM)rY{-%rG!ecGI!z!Ez`|;h4=$1*p|H@!*H5n<8=Q
z(@LZ-BGcb{Rrh~Aq8=eRAMT2noKY`koppGRc18JNBfs^WxmQ_t0?Deg3vg$B5fcL&
zU#^palJR>*VKH(L0%(m($j-{qwBac9&I}$3``~`N@{?-PY-RMI6!0;bEPkGQmtq`4
zKDYq1iIIN)uG*~iKsT`V5HpQjAm(w$B-XbkDSJ>C*-%m3B|^$kIkeh=K8cq3=JY!>
z;t7662_d1X1mnqTBL#~ULC)mT!~kMDaH4W1p@gP(pF0wl#;79s)zvI0?L>6^VWK`d
zSCTqT+&EjzEVn|T#z8(`kA0=YczDUoHMfY7TY__suY^;{;b^)<>dBnPsn9q}{G;<$
zm$fP4xSFJeYtM;%xE;^wBj9K4GmRl=zg=5J2lLdjg_!p{(%rxP*|AS^Pk*IN&cYFs
zc@xRpks7HF5D00z1=fW_u$MnoJSe3a@;~%4Y@|aT1@E5;uR4|UCH`(PIO25okzBiu
z8r7DDpp5CuHKIbpdk8m@*Smy=MAy0mhD3pDRw^HRvodF_p=(>bi^ddyqjZmn(5T>t
zCLpbm+U47OCoT18d<2uFwwr-UW=`Cn{O!ZtWV9_wV^FuJc>JRcTbErc_$uNMjAzo2
zqT!j2O&c?uVD$8>e1ROB^f90T@!me<p7q*iEc*=H;eEu3lmOQ0bH(`8{gFYS16&>S
zWxl-+2RqbL#K7BCsHccq&AatCn`6YLM;<_r!rA(>6#qv==s)Q7PTI)NgyvdoO+-3B
z`X=;aMQlCEScJNzVELVTP9qfiWb73m8Q0jW(a2lCFuwqCNh{#Q*Akhq&Kkr;vdTt|
zI^X4p8~a1NO7VNsw`iM8U76H!3;md>I&L;M*_37xgK!Ta)poVyMq{BY6CUha)3t&6
zl1`_0vPFH)&YbUD5yCRd_r<s|g&BIxwtjh8-BzAS$ehJ3UaL7wEVx+Q8PaHC5(>*k
z8xW^HcCH#*_vho_l$!T=F;8<@7m2u*h+(6W^;)jM=zX_M%Z#=Y?IQ(PZ6K(mqO#x}
zjo8cJG{nzTI|V1i0IT1~8%urV*5+1A2JJy=g-KmzT@>eB%p$6eGit%FZWw!JkhyWy
z8g*dpGv?m?QWNSTH-w&^otUE{RyS(&NZ)@L85t}-09Kxp6rDkpm~ZbXT<{trL?<LX
zYczXT{_WRPhXyg+@gV(nxJtShI34bUj_1hL&@*A96}$&%8F>hL95G{~HT#UOm*}Dk
zDMil$zmTSaRw#6&ICqFq&$>Dp7NkkBP@CkxbP=-30d@QfL5dslRg+fif+h)Dyy<ky
zJ^O`%B?T}+|7VhUNi$g9Fv{{6Ckgo-gX_E}?}&IOU;u|MmUatJ`v^piQ18%NjI|r2
zm53$*qX)Ga%pzwxvmTK(O9QpqIjhAxWG`WE6kvu}=pm8yT~JFEyhNx8clr=vwoO%X
zI$ah1L)SA@-@rly+F{;oq9t@3O<p7V4!;Dmb)6e=j=ruMdVw&ff#|dtGj}S~5ZG#I
zXfWizfQlO8zA2x&+Szo(+OW$%6HZyh%Ksua&f1xYub3Mi9j?<Iy(XD-SHRq5jknSI
zqF=|?fsOPiamfwjKvwMm-rgVLBY3HOY*to1A#VhFzLF1R9csfqf2NH>FiEGaBl#M_
zrM7HAJqn{mqLUdf9}4Bi&&K;1XezM1u;y<orgs!3-qYWPv-$9ql1QYYb|&H1j0&Vi
ztU<3LdZcOPoc63A=dCeb)2K)n?ZN34apm?|z+&APT*>6%A;UqzxDH=J$cc>Q^=Gm|
zLpKh~aZ8`Vp*lIpveuTgJU^@WsITy0^kGLCEYu5vlf($Hoj0<!E6ooHoCQzwyD|`)
zr(#DX$?5qEy55obPNq`5hO)d1rkL%u2sL2#m^p)Mb8GdhX4h>A6svk#<@bt;!pPh#
z7!mUL)Q=wJ9~z2|X~Je!EsULtU+^$C%{?p*%#M)hURFQ}H=IW6XldxY#{#SVU|66W
zAF_?e6*gBYYVu%qa?FngGMUgB>bS9^XY8||8Kq20o6OaZ0Y0_FHGDX|I`pB)x4WK|
zlgdMwb1u$3_wk7(1gDn5h#r2bbo=%ht$w0AStAyD%^cXzab6c4U54QGtQ+qbAg-tB
zT8-+nz!_{xsZgVIol+!X70r2XGh^H(4ipIq_kl9zp0K$1UOMRp1&=Bf{h!{3;Y%0U
zi!085W-@mEoqz=0^`Z|$^pBb@UC?gQq4syXzbSH%!Qy~73^yFKfPYq)JK9Lq<ByrW
z!3+%VZI6r;u~mCFA0d?L-4=9J`0H4?zC4;xen;9WyGU6yv@|Q$4{WPgYLSyd&7*vU
zK?X~pHOafFn(;RZ<F`I93La*=BB1n?cos_f3j~Pcu?tF089hFqW$m{z_Hjx41tJ3O
z)fc){jN0-CB~M{yKGjei5Ukkd#G!+-ck*GZ_Azq)BUPK(;luYnVajdACbUJKUYSOB
zrKi9j_$uz%q~6C7jewDO3ETVdWxB{rMMD1)e)j@?6M7OLRH3dZxf-LEF?O*^s69Xf
z5r!zw$P9N-=}y#^Iz8t&q_bsmrx8ZwTWCf@>vW-<{UO`<e&6x&c7x{xyEXr;CnW+!
z@lXjsPyQcn|ETYZAHRd_#Ew*J8;S%L-oIArSsnqz8fwt<>dENhky)-9l=sP9ty8MA
zc@RvgfbzbBiG}=TV@akM7DFfdV>eGq4q>?zcZ7eCqq0Nb5e^>T<WW~}KTVPrp%ByD
zNZ7}O-)_JiEZX+ZFAO+x2wLNbQKeFbU+v#JHq5ECTO@XhV!gMGS=?B>&}1|77;oHl
z$Kk<IgdCApMeICz1)Q3;O};8@hcxue7RFfREy=>>I8tE^i#0?h8|@2Bsz~Vv|BMH|
z&?QMeeN|%mZ9<mVT}Xl>Dhxm|a%K!><LvqGu_wQp4gx5R7=C5sG&4HxOP^yBuG;%|
z`y>3P{lU%Fm)4i1hlr5QF|cgilm@k{{VdEgkCMz8*7LqI!8Qb(Ea;ATdr3;{>Cm@}
z3P{V_py~mm!m1x)69AWrbfE#TBcAgfaXUL0cPKI~-<lRPT|9Xv_7EJ4=x7$^79V~K
z+1ofzkWSL*A$bSow1p2dd|YH#2aS(=XDn5jAv;M^T)c5XTWYAH2as=PeR9Zs`v}aN
zCap<Z8ccIfeup{`#!Y(=jxpg`qyB_I7Cd%E=5S_RW&2_-;;!&@E(vTS;k$G5w8Xbo
zf1Sx~HkXb_pCSk4dobQQSyk&|R`&)SafI&R{kV=`Cq5eP0<EU=4dC9n_YjgcoM{J_
zIjYwiIz|hlkbd*p#!veWTGb(3k`n79oyqnZUFN{uF5=?W-D1heAKK<R6R)7@3}o)%
zKR;ah5c#H$>#~d>2UXS^nUiFyNBKuJf;XZ-@vM4Ea9jI%54C4AWkaD6LS{VqOC9UL
z@@{>3Nx`@2yk}*+UYh%zNp=V<AWp7oB%l18T@xBW>#9HN%!EX>>)`cf!qrkh3)C-?
z0qi}}!{v`+1!;nEPVx_l&!RoGWgE|!W4AxAn3fng-)a_(lPw|_rGWv?dnsY58WrxO
z2Lv#Cl>Zo|7nU~CpTi7GW>rtzDSN6O&t(U9_pBHr{SU9k%>UmVM_ECuVKY5V6J~)K
zk|n7#Rze<hN!=U0FbvwoQ$C|u1Lt0DwmYYmiD}yRx2C6s%X1`&dn~4ihVS7k25o%j
zUST7VSXtQ**hxCAX4j`K_u;GT@hD1K&0Vl|A89`ruRGO$Xxhdz_3FXx_u7elO(z=@
zKuZwxFxN&p^HvD6kKJCZ?}}rMP_&@b7w~nCePOwo-Rhy!mcN<B(T7>!u3LRJP|n*$
z39c5kV-svW-vcnI)dS7=3yq44_w%`Bx|9C9(&uG>7^)6+$VP<pP>a)%cjCPC9<_>F
zYF{Eg?IH5E#&e<r#Oo-5dbRfm$$+>OukXmF%h=`p0{>d|rYuxXLsfcdBwvg)KuRJZ
z#wJYhio=Gwgn$TC{;~Xax|=HQEN<2~a14*r%NgJC=yroQvG_nD9<jfwUT4?{7{M}K
zy#9AB#mjq*Cm^0BGF`x|Zsggox^2dMHDTeWIPV^SNslTup08{?hFhpLa}pHWO&+i|
z8|1cJQ4XDG3)y$Yk;o6<<eD}g@DArP%GVS2)|^kdek?j+ZRRJfDm6zC+=?!g{D?N7
z_z~c1m8Q|haLdM3*vd(MWFV!UV@7l0M!-l-i{h^Gq*9vWP*gX$SIT`;WpKUSw0{LI
z9r!gpm6A?h^~s)K{Amt$`aa^h_Po@tQ8nngCkV>mF3Z_re_-a~xw=~cUvAOTj^}eZ
z{UXhJw32+a?=u=4Q6f>E<82Y{QpCdL-Up%sxDld<j<b{AM{~;2ogc!OStGC!+`xc;
zkn2|&#0zv#vThwzVR~PwwwMC<@a9`l^z^dYA=+mF_{I8ec&$w|FS)X>Pw7{44jJF$
zYmC;}imOS@UE`H0^ZepN!}(U~U~ooOi0#ZhxPTCX;XxQ}V^wYAte)Eq0c#|eM#XV#
zHVM@^JqCtKCXwy1U@Zoj!bdmcxFD^&2iaXzA+ne<wYhAr!Rr}k1U}jY{_m*iQtzZ}
zM?umERBii|9nn@~E=5}1#hJh&G_wDLwf(ntLScH8yEBEP+csKkj}I|~HC{+`va-Al
z`0FCv@_j)&P?Q-KRwB&uWIR#R0*_hJP-i!MmEeR*FvNk&f;umnUv9XF_ZzLUwJYv{
zc>6%aJ~~M*I0-!&Yf9)?9y(Pew%gvw@9mohO_M|)qirU{63lVM96ftdPGQnY#%D+M
z%PKo^D%M1OHMp~SgLCK!m}=y{h)SS#Pv(Af6FP>C1YF?_IGWp$PGlJ_kcM>4E5hYi
zvRM$NY+Ge|)Dcxh_->U?!v$A0LQ68N@in`6`>mGWExCc(3VK(6vA63s_IhwbmP~NB
z;vxAp3n^k>3gdO~2o!4~ouVT7NQk4fbxoBUc)PrVXm)x?of7u8H27k`49f~Swo!|8
zN;vpoxuwWdquEn#QZY*wu2V4`Q`ZpV`ZGgJ$a)&CHP|IWZrsW_iF(JSmdg+^1l<21
z&DVj*aVnzLUkaP-WSsRbHwL&B<*@%IS-cP}{`IlDl=I?iD5~QLUs@|V8GXl6^KSLE
zDj!?7Tg0I9dpUllNKry81KUMh)7d1E#1kQo0#mn8<z1(+=rRRzF1HA^R&^RFqv9)$
z5u^h@p?7NjP*K&SfLq~Va^X77pSoVoGI-P59xz1JxSvs98?q3E7#5(|vE<YWKKDV?
zc8794GWU_hW-9#!`hLl1(7is1Zs8Wb`(g)3pQ@pmC^z~EkY<QDTN5l*MSex@!DeG4
zS<cJLRAvj)7D;YT8pWZh?6|=>^zO+&FK)Q}spv?#$`IuT-}|9{$eeE^$ySehkl4%J
zyW{+j>eEC`!7`?G?spHQ^&^pXx4Fs7xLQ{=EZ>bff!_Vu13xe{fRy)#ZW<8fKN4)5
zAUz6?mom-ST07dJ`gwA!^OaE;a6VQbYudI(1!DKTjnXEXjK3JLw8gj{Z({6h|L53{
zqBvLiiL5={@|dijXNT@0on?Nk4faC?F5Ct!l}5(qM0e&^S@!4A_Qbu!;N}~VK|Ax#
zgJmzgNBakYycaLRom7!?+B}@)2RqP(GDOE}z)xk>BX=`{@2s|i7wPsu601SAs-iim
zX>-ydO4F!s01JUHhMkwiKGi<dACiL$NlsXFlz1bJjwO$Hb?6Z$<d}iN^#*cFB_EA<
zt7ZPWjo%xWh*HLmZ{)P)Re#K%exYxMG<*GUguy13h&nD2SS-OWEP#(M9!QSK)28o}
z?5j8QiW%r^M5^6*19?a)rHIc!VIO8+FLnlT`fN6YUi}3!KqQ>ya!tc5p`6G)d1t>)
zS9OLkq0N&&uEgqea~-9r+F!BI&q`7zz?*e_B){I`I_9_}BAm`zULS?3?fR|!d~pNL
zZU>GeLhW(|(L<nWGXLFtuI;SEFVs&lH&$)-Gsh1G8DDpBt_n7E<;6@!GP(>MO_pVD
z64ssBaxm(0Fy~$M^Z;c2Rh4`}CM*D#_y9qw(SPeAV8sy61?=%qxH)krYFonPtDl8$
zxRit`y2wi3q`d)!67m-xxeA!Dn&lv107A>xm@v(Yk*nzS+(@`jn@E|<XlryioZ-CR
zm6#PXpO90jnoZow2G=~QF1Usut=LQ9wvu&qAxo@-Yf2T?)p>$7qj21dmyZx+Q-h>|
z{;k9tvL;s28lGXMg~iF1X@i7MR$NujXAeD(RDhEMX|%MQX_W%2y+QP>BgXtEMBp36
zt4Vp2OgLG|Y##z4mJkr|qwsZy+V4#zJ{-t9vog?Aa>w^?E%%3#_<H%%y$PpcT#F>=
z7v9j5mv26ELpc0ddAbIGu$N!pUjMKnX|5aK?{lEYL6K{;^!q<HSmcPd>1U%t(!(Sb
z{k6)m2&l^?&0VwYN4(b^xo?Eu4t521!-G~4Z+4|O)K_O9K|wUk+nz@1U_$|_mR9e_
z*EXhe1yJ(-N;TXc87wEQ3ToxH<3e^wmqgWamc$x<Kqa1==1xe+OURd}B(6{X1`foE
zM7!lNlEcCfUmyv(*l%Px`r-g2p#(q@@W8VaP<$7OZl`_&;E6oo0Tkk!%wfWRU<)On
zRyWlvMu>*rM4hj7B+!x+UWVqPETGvR3YWCsF5Nq88hjrt!AS@z)o@@hyl`SCE7cw^
zR(n3u!+~daA_%ZHpMmI_)hN{|8}<<WZrzZNAQu=PdH>VO#;wvjz>cy10?=349ow1r
z%zD4BmFM^iBo%mS7}&?#l9QhHWS-Pml|0T@Ny|7I&R;rQUagE(nOCgM(7lkS`^YnQ
zb?|Jj+J``MC_8o}rfbs!GN8D+DRKLvD1;D#DZ&ScvR?8(LCTJ6kT2s7!Jn-HXB?N8
zv)sWw_tS6zOzqy@+v1GSyo~PY9gp{lC%9(m7TMi!uuSZch5O4HLHQ*b4$3TkTN;OL
zQ=he-@704DFNk7|kHdc#jS2C`I8RcMsMRh0hJo6;3%<E5p(^}_!Wqo~H;}$lZU40^
zu@Vj7c4U4Pr^xmb__x&+)q=N?bwJHC$8_GbV=$>Cl}LR+%kXsjMvHY)sA0-h+XCTM
zhoLqREq^Am#9G;JUd+cYK}TwUXXze<QN7RI-lh=WjuNh2HVKTF^ImiS?BV$~+pF&x
zKX7VB;|#gX)lMTWdWfWkFA*C?MO19qb&(^St?!<27@qp*eRX9Z1x=PvI7PNhA?_=m
zA~+C;4pdkx1Ls3Dr`!(ptk(j-!)@PrfiS&<PTsi~^>K0O)q&QdUW26e>Xd=nc=-D)
z+QE0y0>TriD0Sr4bI7-tQtMJkOr@MeiONbBYMPRk&WMp30^96*apDbhY?N*1@FdW<
zAua2-E2k^cXV3AZ(zG*LH3Br&@M}TZlwa*+q5;de@M64myzjtAVf@>~bewg)Xps+b
z20Au?^)vsGl&lGEIRQXye5oBk|MY+wZGpOVe?|ib<9gk(2<Cftc7J8TX{yo8wDAu8
z>E_W`KTHL5G^T%n-g!odR-JZ1yzU>cST!61)Hk)1Z`14}`3beaNXooM+Hbq^Z<VxB
z`caRsSPX&#--Ki6)$K(}1d<x~VRD9?Nr!rUw8j9eW#k%^!;WYY=jIcaG{4G5L&1U!
z7~cT|6?YtBgcI+Ej)mfIn1@5@SZ~H)ppf)A`J3hiX<#BUoubM49jQT&Gz$1YMgELi
z3XEF{UlFfmNw#c4O6zZ>BWELz=4CK%(%5r@yD@x|zT)v0h|Bo0R9`&k2sacp{3zxU
zKVwVXi>B`V`&#YwyM;UO!JTqJTwH{>gh@_vHsITnRPf?N@<#(oHS)+$IaIvF;0Lm7
zx-S664V1^spTb%)Y$@x6Rc0YX8n*ZAP0RJRa${dMyCj5AfYS|K|NC_R4ZD1|iQILo
zs%Cf==^}HZ%-dVKcZO45O=441h*kw!M{2q5M15`lfilEEifgQVxA1ebC|Pmh4q~Ps
zJeMEmWVW^2y~8k^=)^@K;#9_t`#4VX-eQJ<mT3`Od{Nc%)!Ts+@$INwm1s2xX&j!Y
zSX*BBhaR%L{vJh2WNCg>i5f|*+8=q;C=W{CP#%;&s^yQa+E6<-X;NN9&@M%ky^dcd
zOqKtfYK>aB=JsShVz-kPkqf~L=n%Jd&b~__L~dAMnl6^Yx7OAJK6#}3E13@jjSKsI
z2tu8+u6dt4LQ0G|)is3}b|~8GxJ7I=Swl(!hQ29B`Yq5&flt%_0`)h5Q<m`K0N-Qs
zSL<)dD<|{%^*&)Y8PH<Er6Rf+V<u_l|0o{n3K>qKc}42GB&|IFbvk70xHTO_dKf`l
z#ZGSc3&5eGqOOI5xXU`V1E>%aA~hx5^=L}-=wZ)GYmf%zLm67Ik$Jy`!!w^f=NR*(
z6==+9iEJ&Yi;wmv!I>An4-|ombW^T)9@HXL=XQJOxB-(5@p~NTsD=dVL;rdk`ns>r
zig(I)1d|Bx3-75sWB%C;ja}3FU5M#N-SZP0UghsC7N1u;`uH|thmePP@q7ihx{T{k
zF7uM<i2LVSF0~iWoc{m54oW0>rI%_{Ph~=j?w?FvHwVOM&>2Gujtr%uUzYUdsN^W{
zpBHqofigiLC?6Oa7?qXNw9~+~5(6DH`M8mr*89Ie<4NlfbeNraRM8Nt{9iy7o1r~i
zjv4Z|ZOYMD&h({RJ)u4=Jn!#~d*e%p)_FO2$(haV)5Vw5!81{o27J`71=MApR<$UR
z{Ir>I-EeGs8e5KzK@fFUc~{5{Df>MxbU)Ayy+!~SjT_w~0FNI1XONTq&;9daol5$1
z<92vOVUa=c!d34#q%b>u6p(yYDRI$|*eTJv%Dt6&iFPd9=?u$t8d@TT1L@%LLo28!
z96_GHKuJD#$j2bk6CeV<MX#*f3-)%5OMP`$KUq~<c><NV$yn*GvQGG+kMjqmK{Wp&
zo)4Y$2rsS&M*7<`_YQr$(kPd7&n&&6DhHDr)IRwI(jx<4+@nQ_Af^;Jxba)THYSUE
ztnL4$O#Zhv?r%g0O?~kCBDXx10YBojv_pJSzvY`9gbl}mXwW<Ts%x_5V!)a>8t$c;
zDCqC(=jzEsj;+qf*{3StlVa&lL~d@$uA*`TVtAAm_nUajvO?9&B;y_+BzEwZ)@MIm
ze(;_9HcX5rM$q71)GoR!Gf-uZGT&66AC*3vd-*=(--hHqBzK#c#~X8tQ~jD@!e~Tt
z)lqgw>VgxwfqUGpe+Q!ic@57-e4Uj|4iKe?^Rh!wBeT;)KMB#}B$xiME_nT-!9wPB
zfwhAx0IuYIDa&>Dc2^W2a!kO{;)grK+`S^`YGS3wJ|<B`xz?RnbR%*LmY16x$JB6e
zCp6Y1_iZwMDX-m!aKC&|oMUcktC9=1t$U5k&kl_uLXt&XsdTzI#yOzJ)$4ZWdYAAh
za-eagd%~X<yFYiqzwha|Y8?XT8Jbg6wNu>R-uZvI_uL2+i;c`uOoWMXI%Uy!UcM8>
z;d1We^)<D#Vg|!Y*6fQJBun7*=en@#L>|dt!EGTd>O>^!XQV+Ud9Xb+CY#8AydV>%
zaC+HHtxYvhP=An#V|+wkzowl$<uIWEMUN3V>|SM!#JCGKByZu?)8{gtBuM+UJ77o?
zb)pR5637aXF2q;G`wyRmCp|u%iF~<O9-h9E)nch_3`6SrW#Q*Snx#{ZnEz{sBm(1X
zq;1Jq^unr%o&35vWUDC^rcUTCoaNF3ltUFrdK$+}H_UU%EbMrG*KR+4lRZN8hpqUJ
zS~RAEkZ!UH^s95g)&N<usTo#EYGO)STegpldA|kk%qyYvj;`Z#jK{8ONh-b{htF(>
z+u1OC+YTX;bcjfxLNvKS6uhA!8>NT<SYK0t-ahZ=?!}p^Bel@-_;IWJUI<ms<Hxht
zJCaMV6*E}VJI5`n1`&nat`^Z8wIJI)t^91Wn&jyWf~{{U>sIhw46Kg2vk}jAt0C7E
z>+e<F8?Sks(fuHSUiTBN0!J8CN;`mmKOiRYUHl`r7V_J$6@Eb~Q~<Bv7m>*iARp1-
z_Lp}TtM@Yydb(?_c3YhB4$xRv|HrYa@-u!j&V;}B5z3Wz(w2g(kjL5$Ft_`YIQHtF
zpG6M~^3wbY_Ql$YSQ}zxtVEw(MX(RS&3YOd12&z#n|}7ST;R-HiD==p;}ZXx8Mso_
zggd~xiA)Sv6=zd#(3Nz8BD1gN<wC!V=Kk~lhRfNdFUIB0{zQu1ak0Ocv7-i>1WouW
zH{|q3^VFnlhJ@@&A<^!CW2W7ww)iQT%&MSXXfNJnA8i!lDAEu%c}Q!!RhT>RR_<MP
zCwn-JBw4Z~Q*v(T7QNU{bWycLNjYJ(MEalT{7l`z#Qi)n)Qp9x*!0^JslAi{z&n~q
zoV55el`jT<zRirYIhAWS%$Gyf@c9jw&5G!FKwD^9&#gHEGekBNVFaa2T<cp2=D>aR
z!^#pCJ8C$pw5|dYM|NGDPQX^=nvB8B2qRuie?#7eTCO=7M3Tf(W{G!1dbmiHf3qu|
zv>%9giDzfOpP=#Akg_&fOVvexfINF=G^-b<)K}>Pz{n>IOy<0%1ZVno_<?$myL*ON
zV59fjy~2Do?x)l9O{(r^me04zw#tUTxrV!b%w?Z$2Sy3JN(#h!`gz>*c(45WaQJXo
zf)PL3Ek?PzMCgihJFNo6qrC92S|By8M^0lz(l3NEzR-TNy&MmX7YZ(t+wAM$lGLWg
zR~G#49RGuZXV0QE3>ne?I-~h7$FFEgnr58;C(jx>s!R8_`>%x9r$1w|)v-gJSo&VM
ztfK~FgOeq5*r@09`?ey;OFRfpo!ZQJ(I44SQ~J(Jrw^Q#=Fa&OtYv467#G-g@;oOj
zz2Nbue+5kShty9MFJJz&c59ay3$NO6<2KnO`cy)_id>!IYzN|+`g9V=G0lCQ4dP`s
z#nqQ3DAEFfna`b%P_s%}gY{>0Ts0lR(K^aoVPlHQNYCTpK^bx3?%>R;Fd5Javx{;M
z-kE)tdN;DIQ^{YTaNgVLi=2m_54hrl2gW~u&1NTc?VpzFD<ubjX#`|cmRCd!H8jNO
z2D8E}9`eb?wDpmcD3xhEB|G4SiS(?@_b$*lBqrsu!P)nR;pS_E`W>Yb)rT`s?g`FI
z{)5DGqCG`?>v}qbyMF#IMe3J?gmN4_7J9C_KHjU5k9K@qh^edS+8D~Ce}Sq+zUQ1*
zwIWf|8ZI{c=$Gz?B@I(>%V?4Q38#_jai+;Ow`}&-z+T7nyd&u){itqu^rZnP&1rY~
z3v_m2Gq8tS<BdlD7szAgvzC7rU!<whZ~B{2PQuNojOW@l^|cMxmGZH`upO@+-8Bjx
z(;bq`S@6Dhp0Rl?k;!Bp@neA#xC3ym&_pCQb$ho?x1SOYr^NgGix**Igq(TVNknNj
zR#phsR|rG?rSpJ->bm)X8Ci|Z@RgsZAKCs6K=C#p#$EQg^W~_iccLWZHFnZhUHZx?
zS{f6^FW+>52x#H=|9qwYm)Ec@5$--TiviDTSL}Q0c(YEW0u7Q>^5L7gtVGm1K1(T&
z;JfQGb-2)qYx_G)1lg2ITGyb_acgTqWv`JVahfN{*mdu&sz(SfJ0Puho4TsKE{tB8
z&sH1`Q8jmu&Gw%!>4K|P4_}!t5rV6>S15I7v#9O$!{#n}M0rq%;y;ob`moRwGeGE9
zXDr({M<gin76HYP(j;<j^Z#M(Eui9Bw{<}XF2RDk6I_B7P6!@c3J4P1-QC?ixVr^+
zcXvo|cX!{tvd=rWPv3jb9j{;aU@X=uWQ>Bp>R)qy^OJ8bwFB2vs_FoSLOEL)TVQuS
zH%ss4@QB@-#rtDho2dv8`K<3@ExH&vw$1F;ri5d{xV{0?TIy!}sj14h!4k2ZO_Ck&
z8~`2Js^i9vD08)1Xk-(n=AzK2Xcq}P^w2fH+HMuT?+|~w;~1BxE+3G=_*+Ww51vo^
zYuWELX=@rPlut*zB%@e|j-wB~vJ5acQY_gFO-~ynizJEmTe{-}mBCEZgwuOkD2l+4
zgYSBnaUY=c)1DT%7>D`~QvU5NP8uZ)*Y4@R<xRf@?vb9|y!UL0cqf7V1+jlShAYWV
z2)fSjQ#wjBMb)6nIY}*Z`1ktMbHEUoA=xgiOblN39^tuPKT|+ik^AH~h!iY~Z^{K%
z%a7cVtLRWrSI5V+g<x4p<+n!@<nkjwcBlYQiJ}PuDp6&}W0E=&zh$9IUUSuKB3{+l
zd@_|zdoGyX53$!6YWA<2J~&x4<uo`5+_iD_G*VU=2S6Pw`A6ybPfQuIwm?G+oe9ax
zKHUvvzCazHVN+UYRqafhzxhq2O8Ado3k1DRuk&9J`t4UMZ+jNBcl?nC3NpOB{$N!e
zIc(EsP3^(ypOyTt=4q9SUs`44zM3!*c=$>IT_?Zy)9vsPXSAU!C2Cf}g{Qc_3e`M1
z&U9ia{SU=03W9yO^r+l|-0a%qRL(Hf$hWI>C3=0e1_tQq;-Tk<<7kb+zbAW8&fQ)g
z=lDpf`pZnIkPpfu30vEmv4U7OB`A&I@Q$+Ysw&&Q6&!YAcoEB?WZA;>amBjcfhlk$
z!Mw6kac#TbBD-+3QOvi(?k0cN4h-j;UAY*&Y%MA#NLrE^sziA<kpg5k#8QwTTQSrg
zrIRjQ{%d-JF*Z}Y`I5MU%iezu#1vjSlF*Iq?uIK+tt$Ep!ekP1*^CFdgJ#xJV!nJN
zEe}_)vvB|k4RVxb#Mw6BeVkJ<35zPnA&=6o(G5M_)SfW#&ZX}DH}6(R;Oo#0*ZggV
z48|zI<gG+BN>Ohdn!YwT_StYy>BfS|`<gP6&@;kp(nwgbvcgyj$+RDW+4xbCs&5$8
zt(8SUNOo{j+_%JU>pK>zhwIAr?6b8Tbuva;9APmAjrt?TMNO4)&vLbkmT$A><e@&B
z$&1s0Hn-NYolUcQ*Np3U&m*qL{717)91P8drFib99ErUmHm#aoU);h1zyPMMzlEej
z?TEysmGT(G>#w<2mAhg(rbBGl;S%HY^rZB&NOt6M9?xMnzetfqSBjRlCl#$et@L1F
zDP*O0G_5WK#OHiVL@$*fKjX%tXgg2rS#r?m^iGn9Yq<;tql9q3h)De54J$>vMDwj;
zv$zt%9hC`zO;RbNB2JLOeoFOI!Ap@SpXg2O;PSsw+TTaNdvQxXMKIsybs2+Ez`mOy
z$K|vcr`v}{AN~c)BBYeb$MiN~PLSlc>C|-K&T>mUubqoUC3E10$@(exv849I(!Dnm
z?V+S#c^xnAdQ=#bYr$SmO_=PZb`ENC)sf1%5h8tYqJ!f>eajlDeP!I>zD1eAX>Hl3
zs}RZB0J;VOa+m@ls>si^^Sw)&`bGb;<^fN{ogLRYys#uUsg+2gg%$S@_k=jdjkR9~
z$b_e6=^LOost`^<pwdm#rxx0*k@C-2XMq&68^q%$oGbIt_%x-|yDb=cHri>wTS|X~
z8lnSTm!UB=xhau7Q!mIqG&1q_B`2CR%1OU?iFKLKuap0wwWp;s;Fhaqp@J9#FA3yB
zP1`j%PN0v>GJ5vO4|3~giJ0;|cQvk5f&f*KJqo}uiUMk>j}T=Vj<0KJ4vpA27{Y7-
zhmFv{m|Gyvw|lE}T81-YDpgU{xa2`+>x--(Dq1v?uumf^8J!qtEicASFhD=kAM2oD
z5lySBR%4uSs=;ZP09MK0-;e)z&+YdVpLD4SZ?bIDGE$Rs=p0)$iME(HV1JqE*N%w$
zC@z&+)puF#`o;KMVfyaC6CsRMGdjq_vC!<)+MKt({<*XSEK@=mV28GI89QJjE3TyF
zML%Dp$bq$W=JBfWDUV4bZ0xH-7$DrJCHvb~1G=AzCk(>U00`6)tq^(b2j<HQ4S<_H
zpm<<7A~|Dz3#w1_-W;9I;1;|O^D4XM%VReRqu-lsN1jgom<<Iy_y{o$q_9AI5;Fr8
zM#0~Ybb|}ciLX^$VV7<6wNKo#F0y6v&9t=ptrKHAJX`%Xt{)bt_Hr0!PDm+TCvZ9!
zN?HHumMU+w1Mq|~F@U}IKg?_XdF}Sy%*M=zgB$;efJCD3D}J)$7vP}BE|gCFq+pfj
zh)tiK%x;vsDt5%cWG6E>GdDgrWBMzZb+@DdDB&fG^to93W)T2Avqq{I+mCVpsz)gN
zpd1@eNDJ_1aAy(9B=!>m^uOv00}u0~TqSU4a(8Bx4dz1@iu=t52kH%&&}Q{DG6u*w
zGXDHKQk$O3E6v}5EoF~wtZ%r}b~Qb>&jcq)BGu;h-AlA5e&4|WrO9iwEF?*kI1%k-
z?tm{EjKUP+V~KQ50L6S1;G_8da~R!PqAqowThgU%rh0Wu-hyv|CwjrA7UlY?>oxNe
zyLhI+wYT$&*?EMcH|s=}MXw&o+E0GDdvBD#AYRR87S8pi>Y7d&x<0UN+PEsLMz`BU
zNMoo0MMCDS^{OgI{ElXsEpT7*M~|2K**7ELR8?S~jFGbEN>E0enP{!tdYyl@rKhjm
zbN~SKp6_&lEtT}oYx{pVpuj!Jv8Hbyr_Zf)46qkt#wosMlvW~e6W(CmX=T>12$(&1
zwP$VKhqs-gto;sEFQ3-^jss<at0)Nh=zpr!#9p|9S5LsDe=t<<8{IBv`Cb1U94E4+
z5Z(DSyWUp@oEDwu)jMnWnfBEoNK$`tFj_!(nQdBmh&Q2?%gxkSaUiAT1rEX12Vqu<
z5{-|WYfY$pqkIA<c}O*_7ky(W_xMe{Ru<JQLGu>`F-eA#q!l{8=?dLPhKYShp(Du?
z`k^-UQl^TEaXxX*!{;WK!6Dw8NgA3=*Mcb9JkiQ35yZr;*P$Ob3ZgD>-2Za-hX60?
zK-@T84EDmG)l23DTC3l3nIe|<ejpEI_&vZ$>XEMR1dq#cjpN$}Vh;BJ7ahcCid)=&
z?HbvL2`kl#f>R3QCN$WNUFaxyc&*|LyqI~^HI}@E{RV9)`W?zo2XugJwoMTuF~Adb
zg1@U+`b3C34C0>Fl1qLgI~Kf%dD#9ox3GPRHtF#8rIphvQ1;hD*Wgeo2=8{EV`5s=
zR<fD5wuM$y9bh#B7GOa9Qc$p-^(}Nr#6Txs)>-r=CF(#smqg>UY96wIp?!0QU(-39
zI-4lfN|>Mv=YahL<bHH9NunD#;MA|5aTG=EL`Qf1<r(Zn%=fd?z9YhwcD*T+F$)12
z;+A*l74EjutkP_e`dB{oYh3eEN0$oE0heD5&>i^s0UfxmOp<6AO`J%8D8t|sq8B~V
zzz5u${zy$IN*}CkO608lu$0jxrY{qkv3A^xMotVnwXDOGJMl8PVOP<lf6A!;-Q(A+
z<8e6m42@_i)dB9N&k5ws3w>$ryu)$=L!-ig5OjHwF5c;+PA|uPo$6E-_kr`~HDZE;
z*VQ$@uH|c~a^qbUZ9_{_!|I*sZm<)Vs})#KQ+a)9Df;Cvh}FL!*7pFLhQ<(!+r#|?
zjQf(#w%d@?*HX}V-Sa2%m9=jJmyu(Uq$}K$tH)VpS4Hz22<Wlrl_|JbhM!oWi3d}Q
z)TQ!_uD48tz4nqitY13E&gyjtp*>TT5sy&W#!v{VMBxO2Dc`VSH`^7#3k6*9pX%3D
zE$p_7W+Qyyim@h?VpE8KkUQET(hYy9PquNfn_IPCWtq%W3LIJ-_@%;vM)r6|)y~Lh
zMr~tb0o|GsxHRKdT*`SKmKKPKMj4gWEk9ty9AtysP2$Vw&3RK9ln4Uh5uDSKE;I&J
zi56yKO^~PUQr_`LKi-zKsq62ohW{AAux>vf0J^a^cFbEaiy3_}#?g`l6`r_O(ejG>
zT%G*<klFqZ%`a1$(nv8HoF63)V{8=`Wwz<5qSUG=l%9KQL^9dn2t6TR%2KN6@<Ei-
zJ9EL5>7VQP1j|+rcvb<HNXK#+z!HfQvT#)Gh6c2w#xWA*Pjnv|@(X8M1o|#v6OAwB
zHWO=$k_i{(8COfx?-_6iB$meDNHK<1+%Dj8AI<=?Sc6N=t+(@Du4IA=4GLSM8VT4z
zxcx8C250YEAug+<K-A5hOB6lRCIW2I&mZ%pWz>l`!@0j(agnfpJc1jGoW!$_f`!vE
zJS8oyN;%v*4ap<?ylOH@2Y_`kS3UnSJA|XabTs5P1i`jQs|Q?A_#sg24eGCeKWXrY
z4uy$)*vCL`oFXY|hZ36yAmcy3h?J^w{Y#s&Y~;rFsQtL`5-WB6@YoTOYFleG%9*y3
zv&9?Xh~Hw*+GSYq$6pWvx3->m7+MNr3L0;evw?|g56NiKLxZCH{RYbQmPoQsAwu7U
zA^f{xo0pgEt$CTplpfTg>Zj-3mv!wCw4tI@qRoUR?859z#0_+Vl>GP)>;ArTdb(cF
z4~B1@BUfa+OusjmRSEmTmK5jG<5Qcl5+{c&%xxvhRa}MguzYd-hE`$8#NJfI^M0SD
z)uRUiG)7e$-!()N$Nd;qT}jicO*ZfGsU%Y5b9>yx30XvoPj|wtsv^8@7dPn@<PnT#
zB=QqnKgm0(*pX|~<RJ_dvEK|BwD0Slcz!DR$G8ZxWqRUrgcS`lhg!JS${{Ib3L>pM
z#D%S1HU?RHP;E)K)5uFghK2^I%H+D#I1RPM`oVooC-fiU2-J3$Wg5FtQUnYCPxPKY
z8#Guv&%BSV+e2(c*O1@-ZSmpFtA0X3hBGulIWgt%WA_|e%!rsU9BG)NZHsIx#}Bn4
zSQ7{c)Ggr?_gB<LsbfYf-PZ8&#uy%BJmUIkJX*q9|4=;|mlZyXq3t}{Zmb1U0SZZ_
zq4{@Ltb6*T5#DH(5=v!XK92VvIJQ&;Eqom>LPOXerSZSv7#$|)+oci{CsGN5uOOn)
zXr3L?eEjJg8GXfHR$zUyjwbXuU8<cIn0$rg*{$d+ZBD0i7pW!{<!S!H80#<qZ7!yJ
zdeU>IOnz)?Whuy35GIq&$IMMd8{UZ8!wGUgC5T{4-Q~zaX4fs8tvP^X{6N^Kvw6E+
zy&v^h*`=WLk=9C?P6}0Iq#$xLCck)SyYy!_Ng!K0m;5Xv2Xz0KPy-90O>Y%IB$C>8
zv_@I|jbIdkV3`n~Xi-z?!ob4o=7ztYK|`eQTei(OZ#uOD@*%j=h2oSpzwU#^irw9!
z)FiH#fDI%xCoDH#gfTbnlTwd1&qZS&BL{=gGi_@MWSUgFeBaMeT@hpn*q+~bT@W!v
zVGn0vr7FAcxx|Zt2j+6l&WQ)xJR}|n?s%m$<hp0%c#0;LEd1S1hiOKvDtzmpNvpdb
zL%Re>iq*9a7wt5TuxFQ6|5iwfYx;;OUvZPZaU2W4J?xhs3dmH2Y~k0(o$BzCF`<i1
zrvn)L;9f5)U%NXGv%eSpfm5wCAy0(Omd?i^{ml6vXexI<4JT#?oEoOYgkbCM9FEOp
ze&6wE69>_2peAXhT()B!WuXhaH+#ct?3}y#{Xu>@+p_DO*EFHpu(9U%zyqnwEKZ0C
zzRG4}1mPv|4Aq1~=_IpmfP|XzH}%hv82hrYVDkZ{&YWmG^I}c8c?9{T8=lYjK+JVe
z^Xf*W$FA@(_hjs7CeY++4lF*+gBnsd?!<R^Pd5XzGSxUr?l1wKGC+=qxUVpKjG`sR
zQ<TVv`$CpDw^2d_&mZZA8uUiBy8KDJib7j#kX$WMWlFzr+NYQMW{}?n>u73>f|1U|
z<Bpy>o&SjGxKU~0ptu~cb*%$zT@6wZlzDgnZ?!A_5I+AHS1b-UsYzv*Xc^oD#c3e~
zwKrzKE!9{aFgx<T;iyO*ybOK`#}9rE2U2D#40Rq9Z;WM8U$?SKUnZ$@Bc@XyTeIB$
zSdEHyeaz#KJy!@?Io(~)#Hqf|23MP|DoFFfD9pwC{-N3rd|tM+UyYU;Yii5fK&Qy)
zTqQ)Tl1OIi-A&xJn_)G&Wgq#N?ellFS!tH4os+-9fL{?gA92#U!23gknm&#V3c@x<
z%rjCcPq%I%0w@ch|Je=v^X!cOrALeHcQPq7(qtpaOr^hCCSkfjCdCH3g)mSX3056y
zbeA1`>@c(S60eXd*b4Pm+{;;&ZmAp?F=#DuR{mDJDjE!M>?7xik7VZ5K*L;$9~92=
z8D;yLqZwuXd{AdZtPElo#slELMn*)z-_XAd3or#R{BtSHfyW_<EA@RK200aCxFk<1
zkElPAZp>5?U**S4N*y^5dui(RC~-!^3Ren60J5Mzzue)|LV~IK(x^Y1m|%dx8^>s5
z78RcBfjN~)iu~uK%ST)PM$mrA(_BK`kE(Q5U|x+0@4?zOlW$9FY##_P@vnN|`MC1x
z770gwv03ihp1|#^crfNOMo_;!kT+`$x4x-YRV@ITKQy!PQmr%j;deG+az~y=i!GIw
zB&(Ii&2kEDNpGk7DWOJu@4OC9U{rwy0s9O~M7foPG)nL`LXhnEwhXLP(Z)z&ALY+4
zV;?s(Gc>Wkr=JQv06dxhwmJLfa{Tj*rPp&LP4J5;r`si+1v;Ipx*HBIXFsR(MoFf~
z0j|V^m|_+%1;B|HF?Pz^mn1MF)KAnO1RbW|-i$j!$=+4LR3H(VEB#bUnw4(}<Br;i
zG~|Vx@H&@muO4@svlmM&9e6Xb%aE&?w279zD`<@ylnx)8W6EyOD({lml!n3M6;~DL
zrHR$%cikpI)9Ry0R!ULkJn6xv$SU=*os{ZH5>ExkfsJE_jhsLXa*A^H8gt{>oxvn+
z-2>%sv_v|QeA-KEj25aA?3;cn7sLR0)0`++_aXDwj!ABtTfMP{=Cxa@7#-aZ@R}UU
z{`(dDci&W7q^@bE5m*tK;AJ>JR)#DY!^Mk+X>h?NaV$jg<!$7NaA8TdwnFn;U-cS~
zuqD0t^LR<qaDB*gKur`XBZ;5`80lHcyxOc24JNUocN8|o>L*Vqlo&N-?P)g!_s0q#
z=7nOnDu*U@bhEKn{)$f0I$yoi>y$5tukGUo?2<uDM5c{ee5Q<toGo7?7sjML{WxE_
zwj`w<;QRk4teF3}^TTtgLVkyFR?zFIx~exhpqgt!75Y<g(+-uNm4>PR*nnV@EL`Xe
zVthYQ90g|Wy{_J`vL57ngDqv<GsVKaW{(<_sO4->y(@L*#^t-!v-3tyJ*y&lW)^{u
zfcE_i^)`JZeq@f+o78DCr;>K|g)5WiZ@yO+)~ahV>vE;j0GsQP+~ceHoYWG<jH#BW
z1B*#PKW?EJ6%$anLjO_hLTU<z)3`c1hei*hA?6)H(i~47(ATzPFk0?pDg}rR-`^46
z?$r#<j9f|Bo%R2Ciq~u^QU93!1NamH6mcP&|CK)RKTvA^lc^I=7R*{{ibWPg^)=d4
z`uFH5l8Kg<YkK+=hO@k;fM`|}0FIdh=W9$Pt4>d%k4UrzH&)+QzOX;$jsCi^sb?nE
z?yFM}b;ux(LJ`+E)uXLA_$JFYrXPE+31Gtl^?eKLfmL4P?mNw|D=VG^jSuq5>S1Ci
z@2Tm{`#Htdo+ng*ukTL-La9i-De7`zcZ){Vc%ff?VPF8ntsZRDxHb<lXiV8kL6iuF
zk#P&O%VeF6+Vm#oOsDjLO24x%5`F}8QsYFk9oXrWtnrQJi~_T!F4x^io-0pY`G)q|
z_|cYzM5E9Plto3vbYfIe$Eu%vDn%MEvJXaJ=_HtE2T6NVh7pqC7&NDh{8KA@P6|rH
zmK#BW#fG<W0VZ=IfUC7a(T4BOes|Jpi&+}bamFS>hw_3&=+PII&OT#>@jEl<UAb}w
z?I|NFc9Y*9XOia7&Hv;~Lgemz%DM?+xGnZj!mJrZ$sV<~sT4oUm*^5|+wlu=86-gE
z^WhV#E`j@l$hYH&S)pbFe+Mj34*uWMU2%N}rrg!Ya&Fzsw@#^Q&ATkyJ9i)Tkcf*e
zun_!rc)-(_+%E=L3<%7Fe3yK1WLQhOA1}Z-MOniM*P8w%fHnC(;-!*zk-#2mS@vS2
zKnn%F%#A7A;kj#{n)*=_Rch^$!>6SIC+WdhI6ityM`QYVWQW=D&n^%)R!a}AqkOz9
zp#fNF12yKQjwli3Y~?JX_D_M;4e7r31c`uQ0Q5BAnwu@G9ewd_3$p`xF>dW`Pk3{=
zQP3<}H-5z8yHp+sj!Z-!q}>-dn699L&?G5Esq9yRgGXZcqI~g{1l@zxEY)*00sOIN
zZ|P!y3Zq1<2LX-@w<b<Zd;|p*3(&^?_g2PL7Oz<Xlnp8F)|-}Q;^s&}Y7TeGn!@zF
z7!|%v!Ny0DOF{<-6eX`Y9fX`!)?8tA{`jj)!fC(YRjzY|<bI$!t8DnsD?^U>tj_0F
zquu>nFX<JtMin&V&m4P9{WIOU`TQ@9(!2ley8M^6w7y+!uU{8>&;-0dQ|X-id(E@D
z4866#AQ0Y4?Xy<n(|r%z|AKfrRxux=&!6!SJLu=Y(30E|RY-jDUA}!<xGb4YpZ~b5
zmSHG~9F6QJkrBK2rzVGKn_l@G*R#288`D#ORRe0^si5y`b9M7M?+f|USRqyyn_xFq
zht}OkancCVj&SYHUR3f_9Nyn!vspLBRF!55KZO~U*3TCeFOPywc7EG_AUly0x#2%*
zcXDzYPbwn$eV(Umbn+L3Lzezh$x#QM0V-3b^T+)Wt4`l@*`7rDN)z6^)B?;Ju}cX>
zQM&D7UB8c*xGV+v1(?Iw35tj|g%l(jQ;fG<*Uq?BEU>qD(5MRQQG%~3eP%pbYv~Wo
zApsN6{)znVZ$vzcMN<cr5m7mbLGTo$(NYr*%JrN@Aqnhmc|%A2fu{=@&O{4Y_WTud
zuD{taFdc_TH-jns#J9D)N;W?lLe}k}v25hUDPJ%0#jY<jBQ1kYj9FI2^y48mu49kj
zk2Pxoa++6V>x|2_i>9(r1$ac=ZS@OXYT!@v4X&1zz<rj~E=)gq-tqk8hD)c*N-n?b
z?9F=r@}(BPGQ%F4>)P^n$r3u96lNk>0t@);Q%qMeURS?Iv=)v3i)Gb=*oHv3H>C~s
zDph$FADdnC2r(p?&<e}14fJn==#HZbTEz8y-t3;4WcJL1PcPD$91r$ea`0BkN;TIO
zVuG`ll5r%PM>dFdT^?Nq`*@WC9hDb?{hg>T{S-5fE=hw5EyN<<G?^ZNsT+(+3!x9}
z0u+^B<b3=k&W2}DvB2Ucbg*29t33nT$f%X_8D(jpUPW9sWFUkC=6<k@y`r;7iBH6$
z0KVqv(_6iOac(`IWVTr*{@k+MBEwEyD<X+LT6e+?T~|zR@eoanxV$-2vxd2tYXx^J
zAR?xP|8rBUFFe9=Gn`pb)0DJkd86bW8sesC8X_d7U*O}oBp-QG@drm*P?8BH+nTJl
z5MExPyu`7lXM!%5=-s$eroE1*cKW}U=z%-x&*z@pXfaIU)U*sD=h#}(gWz)Dnu-=D
zJBTlhs<Jm3&bXFQADz?oqdSG?T`4cb<TMv6T&xH2#TpbzSeCRo;o?D1_Jqjv4py=d
z8(C6!AN5V=rw=Am`*#y<o~qpV7mplnqqk8Xu{luhasGl3(OBx&cj@!)XD;?`>U_dq
z0GRQC%wqQ6|AJVfeX1I}lKNOUbd3M088I(T#$))tx0E3KN5xzU;X7ET{rCq}!-euO
zhz1x>^<cq3BVHUQBajh@X3bACJlQRxwnVhgHWQvmZd=(T*N>p-PZzH6EfeFSp=zsL
zlA-P!h}yE-;D;Z10O89FmnbgW$~MG@eov%}`;Dad{3V1o6-@lflD%LRac^?cA|E({
z>$x-B)2M>_A~6+C9-9ZL#5b%W`+*mvi`qVIh9=c#_Ef8^YAUYeShlh}bbqwLbCi|X
z2o#WRY*r2*<HjWX3-|14W#vwF*mKCTa%ZeU=4S$4Btr2RHC<Oa5M#t5|8`ZB250Qv
z(u1Agsrl~6<4Q#f$q&!7DnHDZPFlF2s*D%uElcCRd%b<FIpeliuMN9*)IxA($aMQA
z6A%+@=3ZvXUPS84lfm6D#5b*3QZJ4d<=V^_1{&j$S5`CGNmm%~CPjgX>KEd6#fY)p
zhwBu(bWiqowwI9$jrrOpE$N4pPiFmhnu)5M&rUFi5R_yJNg%;Ch`Y%s58aF47qU0j
zrpCJZOd{fKjNg2bZ7fS%#nyLfvHsWkrl27zu#~Ne{#=BEikkQbl-6_(Oa;y0AO9@1
z|8drC--z~2efxRmtZ^wrFXQx{(&Bfs$({dICA^}2^bfzbxFTFG+4NFgQFO(8)3V`T
z*OQ3-e2rjg_`*2uoNKC&fqqQ8^5anuqmc0fYAE?&q4%C3j%0rUA{V`lQETIZLnS?g
zA7#9gO$}Jl%rt9OARxMyeh;sxt|?R9VUqVmhQgKDi*G!Ido_wnzmj|0-NnS6`<e5W
z87BO$QBs}kv0zm`s9;r#lOKl7V!Gw;IgNmw=8RSGy`oia_k?6BLh-1Qvx1%`VC*EV
z#HEN`q(?aT;ZFnhr|(K1{O}d%#w3SJB}SCqnX1@Jm8521q+nZ^QK@|?_)>;m@X4f0
zVy1i`p}IgVk~RZ9gxrVC1uA_J<jkC5OL0dNU0`Ka3(qJO-AMy=xUv9=S4F~B=2TJ{
zu;6qrrXVFoOFzPjc-TgplNO47bqe=;a7C5G<LQ+yE2vJtWI|g{b?MW!{zG&&NA*^Q
zA>-!T#7|x|h|1wEA;AC@Dogcz^0>WN@&1;@rF?UG`w)c=C%E(2<wMPRCR)00&FN|J
zt%#pL`$<BeNV3;QmabXrLmTf93KGeBKh1?0njgp8bDp622Vw!_U&=q*&i~hg{ue-%
z%|g;T5?}(H>4TjU^$X6v)_mBPq_k*NzIha};@dF<GJg2NW|rJXi!CiSliX8Q^}{~K
z)DE54U<vKSNkAYz6ZG(KME67oUB8#wqJ0mzlDP9x`mz^AklKN|zUZ_z`2wO`Rg5h5
z$IMZscs!*f!ZPQaUGI9acC3M-d=u40j89ASD_UZeh_D{;y%1gx@`JHmG5Y8D7jE;H
zvbD@19+D+y_XNFbve(eA$Uz)5yE22t3V+*~s;U@j6xF50*5i9kAd>wd@Z|id`?RV8
zPC6!w9#6h`4j?G9`h1F>1igsbrCR26bcFrZlJD@+`xNocyTC0d!~CvwC|mQR{sf#5
z&!Q?mj>p(>PcN8j>d*mKG%0R&xZB1+pv&P81Ustvb@9V6Lze5W>dLgf`*%o~4H1xg
zHm(P`%^IgXIaO`I8|;%%E)X{ZgV~hp13JgmW>A$jV*xfe@m&9`{pg`Z0*y?H_HU~S
zOMJN7#2T?Hz;rG}Fo>S1ZDe*Y%{W=x<N8lz`Ou$c@&9;b>8mabALD4MZ6qUb#I_0S
zhh8SUNz8WW-2bI75feTUHI?#+Yc8P6oRG}S2&4TuRQn}P%q}V?;mLm{OS|MavOrPA
zpO(}=M%)ar)pIJT)tY*<>~LbuI%_(AbI0FWmExsGW=lucc*E=DOwOgT5Mf=i|8>W~
z9M0eoUTx=dl6LL}3($yw?gYxM><5RAeEqj&P{qoIL=zB6<P8;8Eh-J3j+>uP*~5|N
zuNaGwVmVlr>+GD#tt=Zz(mAT!3ZFN$eXyK7`gC(wsoK^OvlA~KuSytaix{`&YFSC1
zxdaBdJA8Ix|KadH=b((2_5Fa&v=iG4Z@Ht{64r`~Vc43K(UJ$Fb?!=`ItXHa*9K+7
z^^qPtYt8N{yDc|&y0&z+dMEkeR_P^#AF$#QCIn}Dz+6UXV_%woJNiV)qg|Mbmv4uq
z7h^E6vvD~}y93!tbGDcZ<W|Es&ok;?a{frh`S4qGXH_T+mjS8$WnCvBzO@RD4+e-`
zy`OtrIJTcJO=3nVtqS7>f`1p4_KyApfPMVe6{a_qY`uo?lWWV{708>ZE}3o>+nh?&
zoeG0EGAZ6jq>13OjPVvZRQ!jK9IUWu`4#<+H+cU|9mD%_Y4>nwED8@n6^=A&ZnpLV
zSe4^NywEdhV;sZRnrs7gQ{cx<x!LK7mF~jLVwh*{XO^R)*aJ~Jp1}MhupDw;?2zCZ
zQKWLR^2d&d3I#2pMzlK10XISi4n`~(!nW!<MK-}Tr7%NlGpA0Ia5wLA;Xx7?H`Vw5
z2nq94x**t6_9CCvopLNI;<>GfC5&gGzG97!ac_x&2T{KNEyyXLTE^peI*?YZv92!p
zM;=l8<ypkik+h_Hh|jmXqFB|z&_Q22tb$n8U1xAT2udd5A-dOT{eTUvQB`%};hSZ#
zTxt$1w2Me9cQ4`2*`o(jNACmkB_avl0eZK)U2vaj=vyLjH_4CYo{?-~VFG7;Ts;?v
zN)PZhxTo2J!sclpB$7F}&`XIbbvSfWEmI1^rrh-ndmpB;PeD<8DRXSUchNSvx~zo{
z=vFEzn*McV{@r!6Zi$u}*ArhpwVnJ`(ZvhTZDps#qUCvqBxg6P1>GlOXW3w=^vuK_
z1u$My%0z;ZTLz<zn^C)?VKw37!U1Q<vL8Q-ZR&}`tJK1)z2!&7hy*^C!)3rHqlJQl
zBC3E^s8M4{wb4;G0B$^3(DoTsf2k&r(IiCC)>+&x&NTJKU5$i8%*Mr$c;3IvgbVxI
zP5@rTAc({T)%Mk#2tgG&-;W1f3pQ~}^7}j9DZ>bF+~?jG(^UI`!uaWX(38d~6Z^QJ
zx(I){ufc(~;1T_gIfu~<{!1Q1UY@JMl=MR>p0hB$BwtZj@-PiyDcaC*`PJXc+SJR%
z6bavbo9)EhHtt^N%rqEnsTYbj9jy^ozL6#MkB=C{{pkI8`gXth2nI1IijYMan5?>$
zA)`Nls}_t(a@Ear*e@-U-`oa!osN%Z3HN?x67lOf&i2>mPqI{fdGNl}*S?4!guW6e
z$<Iy1wjcIOhiIiFO@uOebk#JDNRLudy*RzgYQA&5K+a-gO-FHy%Ja>Va~r61*p)fV
zIaH|JdOVbPy8nEM>M!uo<Sw+hyGYubd>H4>^S6jC64vOWanJy)NFg`gh96w=!~KTL
zUWzsUeV|pAd}F9|8Yuad0)lykj+N|r5Ld|uVnxQK9ROh(Sv56ADY?*^;z0U;oMA=Y
zfuM=)wHGh$w+mkDr|K`Wo-E62qHlgpE1WLkf<)zs?EMFDJ=WcQwdl&}4i(H-Zni`7
zLN%KLjaR*OE>J)GTcpD?vDC%AJL?03{+yQOE$PoXbnS0nM=5!eNeR)fnKrr!2|tWn
z2|qp$dc*UHY)02>X%yWR##*DLoNXaS<N?vmO^rm7cm%GLcCd~tS5alkx;jvbaeLA2
z#0S@Az^*d^D91iR6p2#wlS_W6kqBU`NynndflU)d_{GJm^WH;b?xw(`s@F{3vIoIn
z>A*hyyqnT~YQKRs$`cB_cr$L?y;$>WwQo#U9Ut3<G6DgUXf!>7_?7<=Yf~Al%$i66
z2UlvGrNo#=7h8s9lyP%pwR&XRpBRiGSm~wk#u07HmyCg(7<xk#Jd>N-EGOFfXCC4g
zMnA^~b78M_3A2`EU)q279&wARnTuTQ_fCY*=UhJtBe*hT$T&M8C53>(Q%qCYgrg2M
z`b=wGL&xIPLGz+zIY&ooClP4F)t?C53d0*89>6Uxf)6M&l+GROiCbjDZxg<AaZt$C
zF&HdD)`_m&a5f;QIcz}~52o2lO1T=7g?qU@EH=Kl5n(7q1mo|m!BC_InLCT25BuAh
zwPlYB9fZ-(<oz`rPR^PwFTLjuU;T=ZlAvvF=Sr0FD#V?C-KY`=;b@#)okXi$%0=^0
zTs%uQ2aCzjo(B}YQ6<6XuaX*q*LO?cyS!cAIc+#>ck_8)N^4&_j?zssr4&9|;{2*8
z{9akHI7UHmJsTV007b+19xL(dm%<9bE_%CEMYBxePFP7}X+>*Dzur%M1vxPiiO_8W
zES>8@FW;8L)uB_fl+HQ~^9wy4asqV`cT!}g9Y=bmye>bM{n;_lz;b+8&l5zMj##Ru
zE~jo1{Q*5Xke{NAg%2vvO#8zEBgaB}5{|FGoVhtk>a0k&OEW2km=IyahJOq^&<ciY
z5OwzH1j`=@5TzoOFkZWxlYh}F6e=gC>RKsxd9=Ncp@k~mE^B`HRtaB_^|{qRXw0~p
z8<7CSCdLB#-ZdO&C(;0mmU?!_8sVxsb~5}4N87Gv(M{S~dvNFmT>LhbiS^cXS$l+i
z9L}ikIC7o-75-YBL2{Vvy6f=*@P2c2RSFMCSFhKwN?4(q0`}v0pyU31F&M;Ag{jTa
z;9n%?PX2o310C%rw$H6HF&hz^{@q@NdNn3ZQtQY3vJ2E^L+3Vc2=UDPX<eZW<s7x9
zSXmr`kc|OIk)<64l0JR0_J!ktsPJ&Xsqu|D{In(Kb+eZF2iXo5GThSuE@=3pGrE7|
zVBtgHrFHKcdXySz5<eI$4sTJh(<S#KXq^;BJ~AI`w?-U-FzS~sCYayYz*f1xSwM>J
zB)r@E{R{KOvxND$wlqO&@vgd#QfDNEnuLXTtt~kp253T>xYGe((J~K8GqSl?aP>?N
z7E640!1t35@Uy6iEFJpdqx+5Y6m+glyWJTAOoJmcITo1EEy*n}m%bGa#Wwi1;!#Cw
ztEF36d?y4`e7Q8Ej|;1T|NfZ8VeDjjy!2MFg;Z-_VTQw1b7n;B5D>6p_qj@xxC^qY
z$OKFd(x$P1>(<QtbO^wbQX>V5%6|ENAZVvbGsgnNF!zk<dnaDTIjizh&Ku1yP(QE1
z=O`)nWocyxB@-Ov1w<)DAkHH|22;EW*1e89%U@ME1E_T<0HH4B??$b!ISw1}pfd77
zDALpHXOv8z^)t#>JN%WQj;3g)995upWEhoV1}#Y>8>&d@$R;ja{+$)0oE)r`^TK)Q
zR1<cGkF_i|qRE&2IUgztDF)&0SSvBPO9xxplCWmH;9D#5kAjR*n(Czh;{zE(2GNfu
zJCRCZtC_N)N~Jz*ZiqMh`WxrrHw|`4=sJC2xWlF_7SAvitb(FdoR@)xd3i$&RVS4e
ztF>7?)L*ypp!nS)wij|;N^Sj9ojLZyz+b!Oti0y!G;RC?iRU%K==Y0gKp_6#1FNgQ
zfEcg>&JvdoiGiTlt^<C7!n8b7d$VLR3K%_|PO<|aE2ey|s=|X`FR3A{LO?);4^U~R
zhE$d}iJbC>)Q@Wr;m=z*+$yl(LO4XYWqDtY+tjmPwO!TKvby5#RG%xLOUZ5}JpM>f
zP;o@cu|&nYCL!}4$oG4%dOoZ}NBw$u9KA`ht(LH_cQ!W2Fi1ITiuSjK!N20&kpF^x
z|G&A0D|(xJL-WRPS)hNUjH747+irFK+-xdh#J(Scpi1fEqR35&f77{SK7gQ`E52z$
z9wm88seXocZ-kp9q-3q99urjrDM!LWQTCv+c}xQ7!7V*H$9a$O&9hT6RYGd0NoE(%
z)jHOW^$2$Zo4n)uL*!OUo9@>0tA+@v@A7DU<nZepeGe0xkYJw>_sW>K#tqGL7-74C
z>(uM3msKn%^<!?^_4GeRHbuPzGIZj&qpdIs=?19~hiwD~M+R;B0fwx_gKL1{PrCj!
z;3<AlP>3yEG$=^!t)$tIs7LCzHt`{jB|CE`Q*O_^VGhrs9cMIPv$|TYgdd0jI#LRz
zRF;zzk3)n5RcOAJDI`8F73oFmzDbs{>m}83Ni87&eAs_5PO-pB?a^|z?xC<JHf8D9
z0*PkLa`@WxxaG6ZCD(*c#6Dj6Zz>t;SE98%H9P*s%z%|>lI#C3i=?&Dy2C1INU_;#
z9r0n#8R{_Njk+c58i^pNt}V!MnDwUxR7BLaz;@V8t7~3UAeC?Lz&2fPyBn@q`t+_R
zsx*>PDqmF&6{dogxIEa{=<?W&HcS&w+0x?9YCLtDUR=2I8Ro+1F9;Qyk+-$rm**L1
z<52=p`hjhffD+;WCHlfk%OE^!a&3a$c;fbGz||uy8^4;cI={Njj_F_p%W#4XRiWQ?
zpu_->Z7vTv>nB=#X94ac{MXumAI8hK!u-2Pm$bG6<#!MhyOTG=pr<#&hcJ)nmQ}*0
zRLwspmA`Y}0zDlsz<q-QneSMRj;;B}bDrOi@cF4`^7~^*M8;qH2~UV%SvW)OXdHSG
zJ!I;@yR`JG%IrZ~CbL$0yCT_a<3Yp-d`B4ARdiFGqjLx8<ShF4xg#dK^AEpKyNKz)
zK9ruzskC?sI$2s7hZHADm7$@E(KpdjG#z{j+c`dt4qYRudq}=`qOU@ggjt=@JC;k4
z(0a{e>oc@t<IL#fsXY0<2;9Poh8a0^BYU6mGtYZ&f%R3TA^jWX{D&R{(p|dw%IMc=
zNLHmA)bY3a5!HoQ`#sT}YTntRrfidGpdiBqejL*LYr8vAeX4-CnC7<4O=Y7}UAX#e
zoErQ!#43R|hv0sNEmqa$s@w?|v1ZXLvB)*aS(ZjqM??x!@vx(T6BtHa7M>!;l)mhe
zGjXq^twGU%<QUVLxPC;r-iW(3yF5c<Y-bV;_l-p`!(9G<QN>~=6vJ9eG(1x^vjvnK
z1cGNu{#M*U7G#^J76n)JpM`qc>f1rUY}&QXu~?S#u<a@*g5aRYJGw8jLT*sQw9zuC
z{6PA#(BLPJB1R-)w<z1#MBAto-0wmUH4Ol1OGdgUbqBvPk}J`cWMpI|zt}A=>c~cr
zR2cdlkIn6CeC_<FG<1=rvI=}2op2HqW)FmtU=gZ`P@BGQTIfUk9?h&>HoQ0A*?7>}
z-g{Q$n7PUIlLXiB#hli6hMu00GDO{7p`f6^ub|*b;yqXR&U9!!<ZVcwLmk(MvKv3s
z?U{Pl?wKYoNhFj!{)9w^DhA0TOt8^ab33AXkswjL57~cRl?x>VLIyR1zyHgU{Zq#C
zU(QNfv70e`vVW7kNFv$7AP#S$Kd?(;;v8uScc=0BE>m<aK4!Md6s)!{Sv90k;zFN-
zDEQfUy*PGn^+xXYMr7`4*)80*bDpAtD=ZN!OeWkCFzZ8)Fu}a}51B|l6dipZK16nT
z1ZN6lMH4z!hH-*L9lnqB0vL>_gP7DeLM328!w+;MH3*D5ChPNZ8b|Ew=pr^jM3Pu`
zEZ^`{Z-)TJS)khI{G93qpkDLa`XrD+USjom|KqyIQge8ksihICCYd<l#(bopQcJb%
z&XC7X*N7{?inF+W?&ejSneG&wa&RU7iR8*ORRhauI$ev=0Y5otH}GrH*V&Ip!34n%
z3sAJGbX|TZ@chLr=~Qq=?-CRhXFp;4ihe94GtZiDV>EUXS=O8R`qGa>Cnne$1Gjmu
z1%p`tLuJH0A@3Z{m!~kxbn}R3rR%6-nJa`caNb?2auU}UFHETzF-V@Mn{I&aM<2D&
zMySl*qJ$0l3qpR!?N0x25N<tnw<OqHE#sy-HYt9pXNpg}{J~8%{>wZwgL8`{c`vPU
zOb(TE)v67f%Xe{_xy8;0r0x2oB3qc~unHyF=2$<Zp>MAwl#T1i_PEb^Al*30CHlSR
zGFMA0O218HyPRIyQw3Frqmi_!TbqZ{1P=e%3xV>>#vT%shmN&@YoWMBanJ0~a?AOg
zOma4qemaC5v<=|(=Q22%Nq2!7>cLDkcvqNgd#47w*A|EzW6AuJ)wX9R*5{WX%MczG
zvyX>&`2)Fo@XVM}Hyak`q7237a;Yp9@|ws8p=QuV?9CH>PZmZS&Gtdg4ATaZyOUEx
znmb%-l!{0k0Suxa3exvoHxznzrHY-2ou3cm?Za=#kHkP&_@FnW?lZ5J3)_}3x3P0=
zYXTO1L}}lzA<_%3`1FXMg912}2Q5jy#T-eshWr^bJ12>N5Fc!p8PN=f%!b0vF{zkP
z@*=TO6;vYpd@un}B0l{uQvdIZNub95uv*^%)Yz`%+wP>06ho9&_JNwG+{1VSFzjhg
zA`zMyNqZbl#E8JKP7v2J{%h@3d6f68RcI8+)`5+*UA{;5#x{4A0U$8tm8)s|Ip?9K
zy|1Wxt=-3#=D58pzL89NW#be-fNQrb!2eL2?ZUI>N%19;>Gqon=jHO}G|SVJ&pwr6
zun;u6U#|*e*Xm~pdBXNePol*#VLl7YqMfulGCpu^P6qKo=GX64QAN(r*_Bt7tPg}#
zqpeeq_k~<Y?1Lz858z0)*P{+CnQ{srG$uWUTQKJgW7VO8NZU-<h-}!(C5}g8SUj8u
zGdbql07Go|a(0PoQVGj!<mxXhTv*WYNfdybQg{jilu8p)vs+m1S16chr@Kh^BE8g5
zQGEPikh7{-YkeHw)s$*(oSx1gBfFX#PtW#9u0o+K)hf-kL`uK9(e;NTg-^R%eAj{7
zqVwiC^l~pD4u0h!lknPiXxzbUfzC``JDy#jyX8m4@1Vx4k6*k5F~apGKlR1d*|MwV
zzbv8%$b*JS)(*spp0?WIgf0q#;>sw)8o}T9Ct}^~;FsEbBT(FK_v;<l>kkxrKjWWG
zVs~&BXmJYBielE!*aor&9NL;X8gs=uoAPLi(2NPuxgujFBpNd08^;V}$>!wGr^u(5
z49lX76YWPizza}%a7k`8_?T^>)@htL#`JOzJc#U|Nd1^_fi{RJ9voUk8@1$%(G<Is
z`GD!N`XABARi$ru=C-C!X(rC7Ow0GK<%3C5l)laqX|;hXkTxuAUjou&=tl%iq7gMs
ziCL31{MPZci|X5kwh==GSPpEwt}WN&V4b<N@)u$0G8P3@n(tMN39ayPo2+Z!IxB<Y
z=fjccE5y!twFH*j%St}g;8HN1`o;$mW<m-Ex(WISym#^MSG~~DsxjqJ9-@qLP4<YR
zeeW0Rhr$NO04DP#C_4~DebDa#*s)0AeOIU3f$EhU1Qiv$v=qAx5Zs$WqJ%Nr40d*T
z0qL)YCehdpOlbG|Wqiq-i(R4C6(<~W*em>XvTOQ>=6D$FE{`G|!k^_-ph#^K^_-sW
zI=4s=Ubtpxh_xb<R%^YD)k5-8wZ=ZU4JNM6#vc^Tw3Q8dlkDQinQye3L^erMn2!!c
z?diu<VHkWzZR7Hf6QW}gzMxOpZD~r{+Eb^_1T#~{u^KtiPy#{gnYXo7vVObymCq@3
zSo9rc6Qk9K>u4RH%rj}fxv*Dr1{&j1e`#per!2P<Fou*}A!&^;rreKkwZsGiAvt+%
z856&hA~{UT0O5zcnxb#K??Ro!DfYd*XdG@&k0h~vI*Oo<6^s+UY^Y^n+;NH_smB={
z92~F9HmHJ3W^`)AF%MNKYwCue(V;0NvIXj1;_;VpAumejrUsYOxHYY|R91_e+d-r_
zgE{%BBQ!WCsN{tGz@9;5ul3hnLn@28*w%C|h_Fas-qrDVK+5crSO1(ow{ljxZa#}C
zLHw&npk+{kxN3mICK2lu))z<eK~-pnOCp$JGzQ>WsoarnP}mF_iAXATZj{K<<(p9J
zC3drUp&FA>Mi*mUO!#UVQQ-UHvRV}a>=&4gNbo>v+L9@2X})xed8i#l2;nv*)Nps#
zarX_!t(;E>-h+4dv^Z6L%bJ-8sJ%&E6NAMmDuhL1JDpgvq6+@OTlS(O95yAtcefXJ
zlyx`X!tTT!u<btT+G^+p`-Tn3*48<MPJ$Y9f5pY5S{<31ZGM8~h~9cnA+u;fJgQdH
z*k12dJ?87fJs_U5?+3!lKUblSD<R9<V-D|x6|BzAQoG1;wb0j^Rp(USg0LG|@8gYe
zC4Oyl7Mt0dJM(CIQ(J^txdA}4d##l={EO&t9*(M@Q^Wb2G8G9*@3mfB#M0C0j^NJD
z#YknIG-2x3?TK5YG96S?KZ5VMil|9V!}_n=nuOPqwx32nCC36t!_D((iZv6yc`!4D
z^UWO=%$JNo(6t*3rn2(~sx~o66o{AM8!T!A=VaEU{`N=xdu2!J=HUV$8;FcDYbNQ)
zsVODj&h_Bal$){&C6^6Qx1#;;)JzJZ>a*pQ9E_hA21W$gj`mc7C|7Xot0Bc?A$FqV
zFyDcB1^u;=b?{u8$=ajDW-M_gTj|uDQNoEgxEb6Hh)N%T2$mO#2fTmMz`3LMEjfkT
z?{?yMxm3HB-l3^&0FeeH@)rex!M&)#XyO&C-v)`QCS4to8AK#0e+(lcadOeY4%p=R
zPPt|Uya|jf^>%N4!=07M+>CHWi!-Q?ObJ1Oc-@d!Hh|$)wCUSwZO`Bq6)QZsQ$gm(
zH_Px2eS-@;;>1ZcTwXF$ZNyHNz^vm!|FJ3pF(MTMKSUZWFI+l*$JxG71@9p?b9$?f
z*ts+%iBe$X(X45JBFoZe@jDp064%CjFDpb4wY~~^mE;t@?UYCItJ8h;wn3Z0yH5!g
zP6CmBLgTuM0XdZiTYcY)MC}>%SGEsw!@9Qr(d_;UC-KJH=M7T_)8!1dy-qrVuKRue
z%t*OH6nvyCECQo{-GvH4CA@&Gj`0ii#rX>v3Cii|tu9Q#&^0r2`gnpE-|mm}_tm9P
z(aF0snMGv?(o3@E26kIV&)n)(6XJJ?mjO!xzOcS})1kM@`ZmY37@~-Y+a~)ccFlZf
zl`Qsyqx17G3YQcQWrG@(xlGV^nWjP0@h);?2=FR8i7NtnECNRQzUg3Eg^;pSqxH`h
zbM1-jEdb1`M(_vgg|U7R>z!=lQe@H#KHIU;xjJ3EDo4E0!st``B?_-dX~FK3{<4Go
z7ep{%2eCO$f5*dev6t~o1P-)>Ze+IECTGGqGGqRr<$C|7k)BUs{eskaLlS5OqeUUg
zw>j_j1aO%J3vBa~D61(mB{>d=s_zTNfIj!@AKVad)Rqo|Ft5q|#0#T>2ZTn@k2720
zADx*lgJQ$Kr*Amn-5qKLM=-?^F%MBN^Fr|ZkjB3RZ)=L$Y!x}>+UV^&<pT3vyL8|G
zLu}>$fx~Dy``43Bry+P<?dE|9qmFNnyalCp%*>@j8Ljj)DS{&#QN8s~H59WbD@~>H
zil`{&J{DInk+(KVo-RAcq!Xe~Z58ypwVt@+baVsH=Tp@blak^r@x(SvtP}c5mHq?Z
z;CR0<ZtP5nVmD-)rSNO^W^|ysEy{2LvKLih1uVYB%h6FCb@vO_Q1dzA_(_TQV5c}Y
z41w>t&*{B>aR<az0oAP8287(|&GrjDT|0@!PyEDiA+1E;wIAFBKBUIWsn<oS;)afN
zBR0agq>Cxq$&_`!GgZm|oFaiL5(?^o<ag14^QW&KWKQHJ6k*cgG(%uq%SmFv@Ujj!
zAA;h673L+9uB0cJ*M`=75kh>&V|c2@F!m^JDuk<3l|kgv!6Fz*n!R^zUjJs=yZ9>;
z1qj8xWbOh+mdi{u4V<YFtPoX5Em(TlXOD7Jl9RHo&?qA^s=>8M$NCGsl6oaPA66|q
ztVJzcdWExkiK*ut%nR44@(Z9gP+8$e1R%Lr3S>VG*tnLv?U+rBT@~P9&#nS@O9`N>
z{|A*+HgbszB_N0hzHnNIh_Rq&rH4{pTn|-W3Cyo+w=i={fa~*{sNFnU3?*#DuAJ>X
z44KK_gZzYdeGmvVKeJKtdhshS7|w8$f!uHl*X@}SmvG5v${=?GL1XJSxC@et(gh8U
zmtAe{2q8P7iFGgDMO{p$JNox`!)ld;z_2tAK}KWHlCTU1yjCQ$JSjJJy`rEM;6+j$
z?X*dma@gGBrB(u#su4wGoQn36QS2Sg3~=$rc%x3fJ+Q?f9}1+DA93^7JiTrFZS=d<
zh7`><?AE{V_g@f`ZQhAuPnPk>{N+sicu=SdWk)rh!aE#p!(KG8)7l00xu)^i;2IwY
z`zxm2$IACca+{2x9V4-(NVzZKxFkPlZu2i{5A5fL%LX@1(_yd{v>$|hsYiCuW3R?o
zeWMi?v&{NhrX7*gBI3WX2+x(gkGA)-;Xei`q&thh*CaC2!IX&(_TrptL#<@I%lz6f
zqia=x7a}?3BoM)7^J^n>BgU(8_Kck*OaNMvDr(K$y;y3P7+btHJx3K$-Anz0ZLj4G
zg&+M^*pV0U!?MzaKpnHg!ZqVg&&pDDkF0<7jc$C<5u2Nz@FHr+o!7}5w(E~{!8*<9
zhghz@b*R+`oIaB88N1E3u~?^7_#}+Rk75@PM%}8E`k(<62wlxU&t{kj|4WgsWb|(K
znnULU@)U)(W?e_RO*Q)<RYV&*6v)Sf>#NDW_28u<KS#+Wb5jD*q|LaAa~GTAd6gk3
z)W%{`gEGq@yrPg^JNJtP^4=}i*Wp8oKhBde$Ny!I|4%&g|M>pQOnq8AC_$Xe1#*uX
zgu7o<q`h8Y^tX*bI-p@YSfZ}CE-73iZ<^pMw1_|BcX=t(Xp3rjPt&)^8IH__ShHM+
z;~R_!%ff4W{<!#s9<Y2+dcOeYF0I1;`gu`a+*~riSC+sJ{^k8QteK2E?j_UTX&Ty{
z_D1hy{x8<vIw-FF+xBgO6C@!JT$08ef;(j6PH=Z<+}+(Bf|CG^y95tG8+Qxt?(X}o
z?B6-JPStxy-o5va?$zD3y1Ke*$#>2<#%H9j6C1{X_pF>@g;o>WlJAW9?GLX>0OR_G
zrR0B5OtXiWr9eyB8yK+<`s)zcx&V$rW7Dx_$|NL*f-aEnnu*sVYL0ZHh2&HB4KK87
zMH@#o`UE&vyc~{&rL#<$OF9x@%NFXXXB6N0e~D{;N$gP43~XK2SK?LsW^?i_X$bz=
z^5WBrgX*bsE2A2iqm{0I={}-gNJ-T=ec9GQCBH&<x_&4M`J?JG83f0>u%x)~LsulN
z#arO=SkXZ5gu5it^g*AD&8y^iTpgpzUCl?3mWfgS`2Eljy5YFfv>V7ccM5l}KCdpD
zW(-IVjF?<B?xm?xo#huWE*(siC*{H8vG`Hqo9iC$6z!mcRI&d2Synu8gVF*gV5jf5
zo}bcwe<g3SDc0x7{KybpPII?4vgnr6(4SN9%gyI1p!X@Zm6^j4cLdmPU=Xq{ueE5W
zT#uUE&eiwqRPl@5#ochK2~?knZ_3v=m%GuM7o$tMt-%!V`h@>EUOVTbl1}XmX*;_2
zex=mo#L<}XUCNpC;pYat7o5aP)gLSGWyHhT&(Uen(f$UNBQ}~KB8m&14Un?x-Jh*)
zX60=j>G3$T;8Jp+eE$$+k|i0=B7zSpjW#eLPUIWIap&vG#jU@)*5-S@m3b3Me<<Z<
zjn4p1`~*W1?v+&EW20NfSJ9cy?O)K4)(9C3^Sm+dzorBNU6#ZU>lN59swFpLWIok!
z0|XC>n=0M9JB$qiZ#jXKnc+7O)TY7$mKOuqAcA%f(r&yx5)s0A>pXiE7Esf3CNULU
z_+<K$CqC>)*U6+(kfRCxr4;X<bv*JH%cSSfU#2q5CG;&h2fCU&fLIx^{TLcrve6o0
zlTvU=CiB*Cf&bO_t>t8jUHV3HH*{ZpiF4|3ezLQCS(XJ&t;N+L5X)~Z*bnXaT)K2J
zgiVU46De+QTk^;Yz;c;OY<FtQe07Q%eq2ARPsyCFp~EHgsfe5$9FWk2>8ou2liA6E
zV`jJ!PkDf&XVfH76Tgn{U1Cp;6m`~YY&k7N&T45^BZJ#?C`{dF73h3}PJzr5&AB#>
z3lW4k=sweTxh!mxj=|4%@gNP79-DQCSX2T*H!<f7ykNTq?nw{ng+=bA%1wsu9MKo}
zN^Ty4N<ZK7*1Dmph>i|52|hyhL^|>ElODR#=tKo!L|0F;fR&vU+H0O1&~HJ}s<CK?
zL{BnnvaurLJd0E<er+4@a2Q{qH=co)ISDs0mh^PxpoU6APEnjbOLBctQ94FNMSCeu
zLm-V}cCWGUw_F{xYTCSP-Aq!GOs^1{f}$@Jh>Wiy4d|vycQOlg^_#TaBS^SNQ<flt
z`1MmNa>cxD*&ateB|H>XXlyyH;LNkxFekTSO`SGyf276k5Xh+^=oQ>80YQ~f>lFKA
znxWMl<B1lY=K7^ECOF<_PA3-MJZRdi?Qf9Axyt)UgF5{*Kexsrfex+nzd_NwKiW(8
zeyr|K#;}2uHx{_);=UqkhMljiIm)xJAP>tsB}MBj%wJVEb(rFX6keqsoqBtmuS!px
zkdAe$?U&2r&YZ}Ge25g5)Nx2h5|^KZ!|x_OzwC&3QmAmxJGOOs7Wev%cY+K6MnELt
zEM?jG-0<83J2k~sY?U8fe5t>$%3z`CqfG+~$etydqHdfdNpJ|E1dz2R^+aDZ@x(Cl
zIHKTa*c2goA4Z&rx>*d<_bl!lGNM*y(aPG+F1W1=w=rgu3bg0`bxqyiN~jR}y*^&X
zb;$nFU9^KP=h+iLt9JXYpd7DB8VDzR>nc8$=a@pH<E@J<{HQ!(5t>)}v6Mzt$shFV
zRgjFBr2!@TR0+n182;<h+J)GXd(}rT4_lMp2-e4YeCnTz_E>xPhh{Om?~s?t^tC3l
zrM|dD6wtNU?rq5aMJh(B>&iR&-Dtvt70^-HW3rT8fgjY_70n}0i=u+-Q^WFQa8bRr
zaQ^}-aBWGMU87X^N<^C2mLvrg*FHMwy;5*d_(6Yc4!D$2xUyzCibUh>R2SN7MRJY9
zJ)z%=qS^u<Pqouo1s3rQDX^}kJ;)!c!DL73fopL3U)<4Hi`-?T8sKoCEvc`k9PT5Y
zq^O!4E-Z8D4#a%G#;sD8O4RMfFna+@m!{jQw>=v*&>gQSLg_qPI<BT$=-_+CA?9|)
zrpzi1^f~Zsoo!{yrIt7)1>-ghIb+LP3FBu;p{~XXUE90w;t1xX!CpauSVr{H50^nB
zjt|f?(4{UrAmwEhG?}g->{e>7j}LXHuoxgYb5JcSyo<o5j-*aO={cx<gT&$x^i+2@
z#|$o4s_X9rA|N>ixGx5JLd*MfWK+)xD7cmGllJJd+FHCy+=S2s4{mUdMUR$8S`j{;
z<v%=IR+#)waszJH|8)@Lf3(1~Z{FCSG2rExM{;=Cu^N6g%c+HL^nBj87bil7lb6Tm
zA^^pGx-(pVe_j<;arGl%qh1wq0*$lXig3s>Z>CiL$z_fJuP^Rxc5c%V=#6_r!u3p~
z*dD$xUqGX3C<dn)pv-Bb%(;0Nc_z$#(A`OKAY<aGLC7k#L1#lY_VA=Y|D4xmz3{Wv
zo5Ql0;cDP^fKHNFj_H>G8}zkgfyq`<PRgdUl7_skqoX;lWo-o)j|(pr>Rq?aS;f*P
zi-+LzZsMO-T6Hyn%Ho)JmqGEMF+C&{^0!xE-OQ1Mc5y~uC1#Ed8m3nmE39|D)gg_$
z3n&1Ao5tzl)|yjLp~NN+asrNU`f9*U0BhH!n=E{ash)31)=e#|xuWjL4d}3GYo2~0
zqj<xfo>2cAsb@J*A$b{(+5!c@9bUru3wr)%TB@TJ?7M)9JuVdU)?6ijAag^z89nxI
z(Ah_)jH_euxh|pi^<^gQi6$+LV=1-zOcpZM%=N@&<`x9xkH!_2>u4?A67xqTAw}W0
zC0?~h-f?1X9d88jtX9yan06&kol^|*F5tVi!*%yOl<fu78IU&Q>{UkqH@+09t~6lZ
zHY@Lnq$wc>t{VTyc&}FdN#7*({NxCIkZ?b8c8fg`7iF778itG+sU$i~NUp_O&2?C;
z;&<k|%Uz*peJQaV@Ha~P5Q^)vq~r48mkGST_=~R&Y0~;?X#Hwf4m|eq=Ns*m20YL5
z<44#^NpmNCR;l+d#4$%UDeA3NV)sb9_wHqivnS*-ZY}nINlKxVepfMXUdX48&dS0}
z*&BP#iKAXf*!}!m*eLWnA_N#sXL)}3w;~4#7RsP@t28{&g8$X)6&vai*5woZv^SR-
zlU*B(K++y|xCr207}s0H8z%E4q6;czYIB;Y<BIS%+6gD{BqwfVx@nfWXX5O(=qK|r
zB|URuxV^Zw%h<eCT}@iFO{uND8=JvTLfM92wp~-z6Yk9@<7P7>=l3FOs{xa_tYPFo
zi(er5=WeS0HWSp$_l7hi?w<OrU?H;goh9ATW}Ad(V@p8{DY`=(qvQ#)-*9d>?pHC~
zEopiAqYFxEsy{)j3IG0Y;QqaI``_Fmi>)1t*qmg{D!Yz~cWH+h=Bzwn{ZhBmQwLmT
zB>+$^nn2+@3H^k#%y|i9p9jtap{#fm9_!@?)~4>A)>obAE0z?dW&&S8Sz1>wt1h$7
zcXU#dmPo{qzU38nct6Jll$1QU<Lk*=WS@mU-n1K7Gi%WFuz62B3kac&R?aFg>rKQC
zGX%wdy43+Nnt}~|QbZD9a5Nyi-m^gBZ2B97w-2R!w5ExA+trWb)Rc5dx{~!UXQ;Tm
z2%V{qmu5?({c?OFa0nzDM@6J)Sr%A(_~1IJ)mgp1H!$cF8GQF70~i2u?n_;^0jeE;
zXqIl8I^-;~kL`}HceW8*ejlpC68XR)KO4P;O#Vtr)D0ay>kZbhRa9R1K<_dxYKx<C
z?B2uFCSHKi`ED3_$N0+-RmH0a#v(QR=HNi@>a|Ve56M~44@gu$WvYChGoM_T7r<w}
z->W-or5K25(TONmJ_Q7#tgK}jBbaOp4?cf;A@egnz}nFLNSo7jqh>YpID|0l)XLMZ
zPVtDeDZ~~qqeWNlQ|@aHjSP0cnWf5@tGa%+aBu%J#r-Gb>)+ijxFz|^HiDlMf(8@4
z9@KPk;AW=dKU4OU;n3)b@8y?N=wsd4zMSBERV6c1cB(h_z(+1J2GaaU=o@Nl8*8FW
z>n(GNnjbP|*)x|O_&dVNHf(rTw!Clsm@j!UvC#NHx06S^&svTS*Oh@|@(s1hjNetM
z6Jd#d@6-XazwX<>SlHZpZ5tETozh(E%-<lrAi{hgOx#$lcrO!w=4}aKK8NH^T3_)(
z&J2-ieyTBs_{@jmg$m*+ux0dgj8aB{lkC_u`;g4|iZ^|G$97&cr$fNl-MP-s{PmJG
zEXuNoe5LrJu*0cwV3BlCIngq0qs05Bq=o-T{C&2r*7VjB-o~<ir`FgadkI=Kg^U$F
zcj%XfWRLK2E}JFEvCsM%?q7O*$?l-*s1s{aM!*n%!5an)@g=~>1O)2%`w5{4SeYD*
zyerSFyxz;%?uN&?(t{Ir4OQ?~308#st+M72ArA^s4=KFppnxlG@<2HJzE9nD<qDaw
z?YNED!>ap?zd<-J1eSWJ)07!2Jg4mM@AKMFa~Vu964wm1DM0QRIXr`L0#!9Hcu&Gp
zz8@`|v{u9rJoElizUl1SO28V_6?vS<S_?{S?i>}d!@p}j^SteD#M5dFUH7VhQylq-
zG@NP-CJ%Jn`xM_z0djL*vabkJyGd@4z$KRHs4L6o|8vfLs{i*(@c(4%%{BlyM|C&j
zolUvH=aqHR=XT3+%5jUM(LOx%_c=mzTQsH7ORk@?xu^Bc4<~9{kj2r<;Sh)e1t1%3
zWwO(@?27@6bv}wo4NU^V{MW#2<6JIf*rL(q26BfCrco#s2%9VP%xRcIn@D{i#<iae
zUC7UmA(T)NmSO#qoOm*7yk0>r8O=Y=L$JPd^WYa^=q^1p+G3TCM~nA5q3`si@lM&j
z^iD^&qRl34<1nbx4)|ntm-2dis($YH8uy}sLN#G*SmRZ+k57sD#7@0ky~PyHiIH)9
z_rr@&w!?LPq2(N}$1Bd&_Z~4VzNE<-%c@`0ihr7mnOA^?emBsJv^`_4U*w*>=v}|h
zU*Cg%p^QSAzpTC}+VfIPtGqgPKv1qaMgBk*C>UBMQ29MSa8}-y5odSMFcJCws<ipt
zx5=H*;+>NUXhRx|7sugnbxB3ERfD<Q#f0;slB~@Uo$ME2uuLg&ca<CxNVt4g+2w0^
zb)DCT1S&#9OW`&UArZ+7)KJ{36(9H*DvrQb-A{hQo|l?NT-dmF=#>I-o@Csm=0g?K
z+|6~EYb16))nR;&8O^mfXp6{82HD#?V%bX|wWq1Lsh#UC4j}dzNfzLn3LK)PSq!P>
z^X_e$Vo;XyEC1kU-H=o7)(Uph65BenN#!vKF?EUc3HxB83U<5@7eKwPXt(NAzy|L#
zQf$Q&@}LFsJ}owp2H{tVx|=qp<mGThiXFs4C7&=H2C)mT1++Leg*-E-Z!@bF-hW=-
z6Dy1k(&ffZ*T^)CHcftoznhz!5FM9ZGZtm_k0di!NNd`*$^?D*r*lZkYvTB*2?==+
ze89e@i_zfd#)AV!0W*78ZS<NsfnZR=KoM_UnaODBT}z7k&nq#{i3#VZcBAd@^{QRb
zZE^8s`$>QsXHGxQ{Uc5+kBd2k0!)R#t;&C<;ppWI6U=Ls%$M9$iBWwkj;mq-w})sW
zgSJvPetx*QNkV%t>euc2{>S7dwl0G@SNakKeU~%0q7TaBJaWc94NhL`cSJ-J4^=wp
z{GFutku<nwf5M~+CG(P%OH&O>QK`SZYLR>0)u;|NY5s!4Gm51w1jT?hD*`I*cdr&!
zw9`37i1<9=CR<6cI-e*Wl0e@~3f;*zUp!~$Uk1;vn-{=KNHRXWzC!7h`da6*x7Nyw
z+i`VopTh2@mxqk4zCeGL@1HhQ2#E!Mwl2lw{<ZaB;P+4#G1D+qAu_saB723LDDXF^
zt2P}7W3Mq2km3ObY+_)7ndDov(3eU2M}lKpJXYBdEKowurT|RQ>#cHYfl_@UTOJL=
zpZxggBpva_^H(dxu>9VeFyJ0I8CbHIcP#+pezLSw3C8=$%WkRq^<-kVB_^xI=j!Gw
zJa*T%0y6TFdCh@9j9SSlQ&D?M;?9A1st2a#V#obenU-3dTj_hw{yYwD2=Tf|pKsCG
zHSVU?$%J6eQ%&3O!NSCofJ-rR8UVmQb2a~xy2+!o<h;Au?vkM&R$hOLZCIEIzmtSO
zOEPU7>s#PC+g!2!xja@ntumf=|G}mr*z(7CX|-;lDALVCMm@xWV?3o^0&LS-Qy-c<
zA&kzhoH0Ii6%|#BAB3a7VmP-)i$1DqZczN16~J`J*+3r96Q6E_``Y7Ogx0l6FhY~w
zxX}?~wJp^g!+<Vc%{7K2q*KP;P(kMj_C!0cZfC5vaRZYHhoKb$cNm7L62aXktL$kG
znW(8Sn*@LWB#*p#s4|}@MNM%{RnLC>apQ7Fs3l6sBTWBWiD@5~C&3_eo-R=140K>+
zCpS(iOwmTg{<8K6JKWd$z`$-1#EHKAX=dQ&s$5q=Bj?od!^JnDF5ZL_2$5qS+54S_
zlM<_<zYOZd%*mK$)|jVnE6sLxv?DS!iFO3D;O<n!6EkeAG0Srnu-<W>V6DsCgpn;j
zm1b`*w`bTjrx+s_dggvR@SGFi*j}kg7UR63{CP*ghi**bG3uME^Tj<QVJbayvP935
z_LIKSIavbp?_*qBrdoB2QJl@@)2kZ++8Rs3AY{mn@W|8KVzm7E96v3nl@)HOO^8EI
z!G)ZHW}BFLTl(JTY(`UuF^0I?E!X3rclvtnzPE&O;bW5T{sxKQUSN2^x+`3myqS$k
zT^m~NF@J`*KZ|2+$|vsHurBP@h<UQkmNV{MSAN8h_4BMKED&nf;uYQE-E<eQq-B<<
za6(olZ9r&=f4QcV<dF~cS|8&`ar0&ID3{5Wb-GmJI4NcEwVcI?Qe?j-`3vMxDWg99
z3*%B%PC*S{h{FkwOIeo(l-;l>9Z_$TTE5Ni;F-HX<)MuR26^TvylQ*7*gt`;JkdOs
z&7;knm-i{WS^D<X+rdT*v_-qXCd9u}UDngnI+N0xrAj$MZSZHN11RtROXTOjDTio4
zC5+!v4>o8R^AaK31_?02RC6PH5PYK4vC`c5YTapfxZn_0WWymuZop^3r>*}LodIrc
zr4&VWGd%v%rxbc9uWdoI(ofRhvJp{gx3j-N-8W?D-pCXgOR1c<s4X_4H=Jggg2vS*
z{xCEZMEKKp{xVJ%b20o<UK?X?mk;Jnwg!7XzvEm-(Bv~FhV#eLLC;DW;Mnh|H;(}@
z_8ews?HQevDZwQSb(lI!i1sQhMx6d@Z-hT2$IfibRDR5RA$FCJ=dE@9uCN{sphSi}
z)^(Y~j$~PhB3N6*h$Ql^pWVwV2w}&K1P+hMoxb)8I#`n}3lI`^+SL_fODn#Tqe|nZ
z`t<d56jNtz@@ZAZhPJO<Z@d45DX5a@h1K2R!N$t=FE!m0XUu=lZ}USxGx$g2nhJ=J
z0P>v*_rF0fA_bJ+?uj(s<WMFc$VRfcQO$@z)T!HXG1(CK!`Z)FT7oC`2-$jVg*;d3
zvJ6sT3|3=RHb!ka@~v?cT%s6O%J~l4rW=%W$@ipH&Ak&^TCpjNHRj>$@d1fTCVshE
zBb81=$vV!4Kv^WIUjH(jgR861)2MZPo#mvtKTwO5B1Hx<LNV=MkS;c!qtis$MR0$~
zHgzbmeE)+}>He!aTRAJ0@c&93@X0I^fj-gSS(msuu+M6lm_n1qxrV?Urlgf?=s8Gi
z?o=&j$;r?$#spY&$q=UG$>{5wwDYVMvviyF3Qo7koqO3v>)=4fd&O*Co>6;|E`vbA
zpJo+gZw~Q1Uz)v2513mHPSjG)q+aJlHdBPagV4`FxY?TOr3WMZ3n7%!|2TjD1pwDt
zA*^|{E%<4K9QvWX8x!l>)1w#RK$Ym(anL-Z1SkDcH>!4*n;M=ho-D>rG?%|E;U{S>
zf7JwuMCj4a39p@|=Ovx1gXOU6GC|t5Rl0@m_g{7#vHTP+54Btq3KI(O>|Y18x0=S;
z?dt?j@=w+$61Ng3=|!xx@9UWU+obuQlAk{O+~#3fpMmuv^<LQ_`iI98H(7;C3v_P2
z{{DnDG3r;J2S56wN#tdO2?Xjv!Q*B$>?2hvt8&yVFROFZj07BaUG~865%3cKUwYWM
z>nrOD-W7Bln0K-E6Un<9=X6tFj#>8Rm9jZlN)}6XmVjqjr8IKT+LM$TA4#Vud&m(~
z^)&hHd4U;l&9t*j8PQ)kx=^WZ#9i}3tJ&b`je<BWTw{t{C#rua(VrEBr{!Yi)rFek
z{a;o>>-oPFRpE`pHPq}F7uBhA>6(XDg)Eo-URsZ=L{eDMSLh1-YMhjh>!w~~^|~*5
ztIy-}flyzG^4qu#ImQMe4wlWa@KjlVPIe;nbz29~v)v(wX>x@=wLRn$dfFxH6XW5P
z;Lql3Tv#OZW}-U^>gPke3{-*CaFlHqi#lQg^;PKSEbdz|k+m#52ygqzZ>uVO@!ea7
zHn@Up85;1HPe1x=St@Z2Qer~gLUlmINNWZq{riEwqLo3va%fu4{30q`yf`ks+X|}j
z=<39~(F@{!MQ<UY**ioogy@?yy7Hd6=Nbz5;x$wED4@%%W8vxVvmvv9?S3R&KK5%T
z^ZY{C3>5C$HsDp~(l>L5iA@Poxg(p#49ejg-jux#aV(`$9E3KFvT16(O}Mm2+1zXw
z9|XWlEj4X%f51!MQ@D`+#l_zuO+K8wu{|{7HzS&tKA&Ya0?J(t;y))ZoEQ+*QV*n{
zEG~*q%6;f6J{6vHbk&Y&43&ur{~qEd14a-VWs~}adq9eFmc^@hc^a&a*F2bIYTVhs
zm@pT;dvTh%LOOoztnE`B$7Z&@<3bcG+>d}B(m%>m;cr!$O{%N6yR=O}!7^K+uX(fA
zF_O3wJ?&MztTq2&>(DbLRRAR2@V%u)0YG=kK%fm66-b#UD0(MLRYH7W{7=anQ#vt1
z#XfDLU>Q@IFh<2%5}MVQHe<1q3AQx;G9o@BxdRl$IFTgM)#wEVfov#1X>3{VINTp}
zyn;7lILFT;^t-Y`#FP>t#1SnE3E^!h&xjA+S=a_NENZP`@-%zx97hqJJjp`4Q0bE2
z#K0WhK?mJr^Me%Wo0))0h@RPDl<M=Yy2z8>=ITArL4kZpdA}=TTlN%(Me?<)u^rd^
z*-uTtX#>^?M)QNX6V4#kzabM+zyc2*VY-QH{MZnAY$kJy>8;Thnwu0tec|kN50g6|
zS+ZX~Ar=2-jFNa_Z4*z^^)|QNzlnG)x=|aT(u${Vig13n>>JX5Ya{jb70<k}MY1uq
zzY0qyDEb8LeRGj0?pFb_ri<_4*?32XKD+(ws>|9^)6O1~7<yeNUFHg`#w{UvW;zK?
zNT7s2SVQG1A>(oR$Nyi~0*gB@$=12+Rz`Yxxm$I|@T5S|-7-#qx-&pc43aZfpVY5I
z4%V8IZ$8%@PGtBRd6PQvsuf*ix-O@Path=SQ*ha2tc8=US)4XkcJyt_O^>%>qK)M2
z<m6xhHW($}sIevqLf1$jM50dQV%y5fGP&@)i_La;&M$)bU`u}d%DozWCdmV9s;G+L
z-Ebe<K&%R>IHA&Imc^W7Mmxa}oXUEd?^;*HhEp>?{KecD%ID?&EyT5#Fj#EV9`p-$
zzr)vdkx|e*N?AHt+3(%lmWlFg@ND=~(V(An!34WGW`VMUMcRlY9(f=)7;3Zc`83;U
z+&nx1KX>Q<(hwmAmK^C^p|+wd%&nl!K<>#0wb)Bcs~Wl#Ll{atb1fQ>U#T7--(No+
zrUgRC<E38La_^~Zw8(wxksjK%MB_CcR?2!7BO-G8Qg&`JbRkl7=wK)Mx{7EnRKFOY
zJ?~yK67GyS1?&j(th9$URSd;^B<PsDDhXD;MkLy@v*q>6p{+i|UKlo**|?Z@PLM$G
z%T*Z6J~32I{{9n2K`Z8px4>9&;W0Z5b|pX*JoF`7*O@sE=}ijYH-VoBqw^y)69dlg
zytKf&2AlWYs-10N&XG_xF-lFRtHaoQ9$cs}pw~^?q{efv3;A(I^m>EIcBcH-S|4XW
zj5Lhg>BQ6Pd>)daoAZ?j8vTlVmvMmNg*u~I>@QkTqK^j~bSjgwO7b{?S@d5(&~M7)
zlFE@H>I@7_%+R-s;=>Bw_Ov0Hu3}oV6IVnda<H!ik`JebPi18jPt<nigiDsPubC-G
zb5j(`?lR^SK4ZiqJ|pYDG;V$w@rg;n@79Xjk}KM4v5mmb*u-F3N?gjld{EPC+*l97
z2v=@`ksxobo>giq%`n+5M^}ozyM^04zb<8;=B=gHZ5SeXD=;!V=lC^y=-p!VgNkzy
zkpDxtlA8}}xpC2CO^NVuJ&eZs6`h6USvalwJK1RK7}pgtC$K?=JHJ;)<beRBg9AgM
zXj&Lt#C~qiW|s39YSrD4;*7ET$JY?cO{<T@b(n0geUS^fxp^ufZ?k9K%J2~*!c*i*
zZ<Iyv%U;u%c376(6SmxR_*6)D?WjGnB;;_rcfpU_BS{jQJU-0Y)MGD=#{UZ0b_!8i
zX%Qgma?+vss>EzZW-&)JZ(P-A+jhOLo05{<9{q|)BiLap3)9g@ia%plrAX;g_9(^E
z`70&6lcz**ew3GG2o-gR<nO>Z?=z<t-)zy3eUahcmBe2K_#;CF<L6`z^6I&FmA|+p
z5n4bC3MCh4<#=gU)KRfN)g0xsqeoBQxPDn~(ojsudM|*ysqIP#DCpV^gkKO}3d{8@
zXJ_fR7K;<&4d}9Ho*;;Q3y}9eq;_>u-1KC)(1g$c-TJzWgjuryfA`cGZk&gQz~)Kz
zWo*zlTm+T@{wQKe-T5^*vCa=vsZs^Z^mWY#QYF?$=50yVs0qt)AYYEgqCK>Zwx8CU
z*^%x~a)Osyfs;a1ow$Q%SZ8tP1-2!Nnijl^()Cjt@ATMOV;xtWeULqiiVshuWIi-V
zoLBFj;U>5^aZG3KIv$^n`ydKKFs6Sbj7tEJ_an_XWqGLrb~V?MvW5MF&L#de2kacD
z)BU-2s>!9~tn7sE8lI_53DS&L*V>t(eJDI4Ii5jdWM9`KN1Xi10&ZZB{I5GBa4Jtk
z29WO`oy%^<C2Y`o-*m+d=YG-TX{=e4LAgzrV<3e@KO{ZpS+6-=1T02l`SPlTFyfcg
ztmNgD2Nyu|{IOf~5v?TTTD&}n-i-8LVf+o6`x}I|Q=|1j73NUP9e)xE61hZqT>2Y?
zq07TPAcae``g!{J`g_2o>h!F*;I%zhD3R67k4SGx^$(~6&{g|(!uBRn4)Dl3^C2&t
z)6rU?cGc}aJ35fs47|{ZQu~%$rV^_M9ys4>jd$Lcy+2g*aC}Eq%2>yGUu!wcnKM&v
zQDDyS7rDxBijl7rk1C$M(^`TF4sP^)vBiIhT!tkfTdp}e`pM3=6)p^NB;ITgxewW3
zu?N5jrVD-6<JfriXn0l_Rk5frBKi=W<B;3tWh-#Lhs-@<9Ni;<@tQf}_{E&K2D7eq
zzON}mCMv=_y-@~?2S7Nb2KZH+mGs$`uMPgayZ+yAwSMA_S9!}-Y3>th_1T`JmEOlR
zsDL!na)rO;u(_|j>t(Mz3QbC?<rNAReC<c*Udc^`KgGy7=H9D~9uRgCpktVuFl~<?
zecXAg5dD+C_RP%x0V$axNUf>vwIz9+iR;9>YEBW|A`72Zr@(x2baU4(Myz$_?!C#2
z-DlE8%I%98)7I=-dmI<zXpmG_@jzFSKBarEPWw4iyGPl9b?C`{5LaresxX|Y@D&Jd
zRDn3rqq14Z5L5O1(@f?=3aQxnkRO=oPZN0nNZB5qf?>zMu2xhKNm81VT0eYCtZ$i&
zaUv)itK#`0G;}CO|5YB-wl6l<nvoG4Zfs9r#Fukz7D*Q;Mo*9E@`5`xIXlwuIv~`P
zQpOL>O(@35-Ak4?W^F~tfs|mZs&P|mg?YLfF&M#^AUST_FW0iE%yKBQcE=2}&UYc@
zP}cE{cX3he44Nw~9a%b-?qB5<5)zRv%hvB{ou=|~yBjPgBqPM6G_&LY$m78Fa0n4W
zub6fYMe`7})?ajeemCnf;NFk7;cT<(;;y^zJ)txzVrxgb%SRLZbv>P31o*gQY}V#v
z()whb?1bH!2EH4K3g6)zG)+>w_Xlq!(PhUW_YB{%p(aWA-RPXZ9L3$XOkUCWPUSFp
zEnAYk79mdPE@E5K`4rMq+h$O>!uBdZ$7#R`Hi&wo5b?q=^@O!{7#6EhUPTeGHpO_n
zp+~V8vPia!lCJFj3!g+1dE@Xuvpg(^TgGsR^Ih{F@wy!FPA+~Y0haj4-~M&@$%~o0
zs3`ww<|WF3tlWXz7#D`&%<mCy)nM|RUw{_4t6iZxRo|iwyCn%n=kfjV3&)5Bp_itH
z7)aU7srlDdsz3)OGHD7xjFp&pv9?nJ$em6vejoI*@g2pN6~wayvKVL5^=N)#OaG|(
zp^B+bwgTivAY}pZh9{20j#4L(hMEanQ=m5jm^fts?o$u6mr-rnR&c<O|6WlERd*Tn
zNQhr?Ii=@HohO%2FEy2(0&HX?(TBR+55E|<tJ5n8A%y5jVd~D;ktusl(GQdedhn2n
zNnH;7AwUJb`j0|^|D)IR>cVFyH5)`hm=T4`tK7~KEPa~B4EC*ydGJ9)Z@2}MCvASC
z)~EbV(Q7=LTl-P85yhvguHHmwmc&Vd2jO~0B|(RUR{klJXAg4{h2y{v{U<u)<$bHJ
zgmx;1wvqyqq>%GqYAwjkX2|d!jF|kk{teuo_vgFcdG5YcKh7>YD=Z~|_;9k1WMAoe
ze|29-3>MYB8WbLL;b(_bdY*3CtMp3eZ+)xUv5_md<6CzNtkT_he-n!%114kJI8ba-
z{510rkA!0yi(@kP_WQw24%OuH3@40y`?X1k01wHdkC-<QMRDl)HJpQ%`8xCWDO0Wx
zf4Tg)6rYN-Dnb^`FM^F0tS~+BSLqqUMpr6SB0C0<(g3-`(&qWY41=txph|fQ$vmBH
z%JlLgAEWfhksU>#DCSBuUu<9LoZSWy#dQ5v^AF{V(i74A)Gwp-5taE1MS><&v^SSh
zHoS7LZ4xj=3MWLq&+ACMZ!JItgJi#@AeS~e+yN*>hsyHU!8IUs0n1pc1vAf@sRm3|
z*MTV@a46BsYth*r?CBBI_>CR6rFr-ZRRmSYMv5Cauv|c-gjEXAV=rn}+weZG*(yFw
zWbM-Dd^%OJns8ZWb>S0Yc$4&Dndt56_#@d_6+d7CmQXG)LU<d9;o-9H#p6M$>Zv!X
zWz7l1P@!X~+)<yC?sjXn7bcW0wch!<v4*$`|ET3-KIP*2fP^V7Oq5=&p#RrD!&j^Q
zQ(*W?gZ(f_<u&tI;eZx!Y0k~yPx_m_&sP<B$MZpZ4X?+d0fUxbph{Oud-*qm;(Tj0
zKt8|y%fOkbg9e|+Kmwuc-JH0k)o+C@Pj~5>GUTw*D=!Z+_6fa#N8u--uaYx6=cFmN
z$51`a$6EZx1U}XQaIrXr!IpndEZeucWvA(&;AYKkt?1&BE)js6Pk{MnNEV}+9gbGY
zCM6K!85dlSf0e0{Ve&U9BB%tL<Q@$b+2VNKmuD9@YE1y2=4G;3Q%zC2s~jqh7MHt9
zzUF#3*JzF5G7dEz9;@iT*p_3EQ!QH@8k<fdRJ3H7Zmx_XQ!JDM;-Pk;Cybh50Kz?q
zeR5jk>p$Rj_DRb`wq*YdL-u#F#y}2K0hrJbN(E%P@@)0h6p!%40E~C1ffyhS%A<IG
zCO=0OQoN8g-3QEfGw~szS&&d*s{2nVtYTI|JY^0nJBQvpiUH7jZWq#m>t}}my^yoI
zO~$`Lq5Ro=JybrQKSwgt;l`+p*hQx-$a69C*~9#iCSM)%Z(g8q3|OX`O|JP1IWLv$
z##vt0utUZ5X1@+!va*9YO2;4m2KD;BIfL~wzQPcveY>5y6vZfyej<{!Rz>7*AR@kH
z>c1examm%A5SB3)aEf&ktmm3ZQOM`DcV4T<#>OViDHQy``5G=GXnicEfehYiz{fbf
z!sLVP(a^DWFmj>2YxTgwJU8`sgrIA?0B^hRcaLI!gCs1(hT~gw_mf!6#lTj9MW=nA
zja^wj8?0^r#cUp_Ti~IvU`Xbk`))#S^PG9j^dy&JAuj0is%EO26?`1$@~e}3RH1eP
zbkHL}(e>V?YU6DxRZii8fLpRPX4InqIY%8k@Z|sBJ-FIluMc=@Z?p^j6}ZEv-eNX9
zNox>UtlLB)kF#cv+9ydISJ~#a!ABP6i}0=|__ezlOg<n;@^yHB1pY3cu)LJ@x;!d3
za`<z48_j}#=t;xSp+xAVl6^IMY4alsC{&LNG%W9EFZ!X6MFH<T@#MBoAN%;qDvECi
zgG)B1%i}x*BL2ibkT6)Is=6JD=jMnEm1c@zGCh|u9<Jh0tD?U%ZjL#-m3YKVxoO@I
zadNt(4@&$<{zjl~F3$RDvkc0fGJ`@RCPpfz6<fZvs)PZiF$@L8dAd+4p%gJT0)1h+
zN)d!W7BNVMab8n5`ZTw`vBtEOxcO9w6a}J(o|uH@LSLhT(M-y7Z&GMueDN5a$Cqo|
zsoz%bwW7s|rX}ak8}7ec36#YaDH%(uCA06jB<`zgdEGC_LN^b_n-5<&1PaUSoV8XS
zI6`%fX`X^Kc+DD|OoNSgMUgmJ_knMI!z!{$Sg)q)10qQF4@HV7=$;4#dl@CVzlA0a
z#CqP_Or3Fz$)U#!4kRQztcTJ=FRmHM6Vu!3mBz1?o`sau!8zTUQO1Z&aQE7w`cS1Y
z?xxmHQBd5v;=Ol^+s6?(Lc)TE04XYvH=57{5zwBZnE>K#oNp%M<T!VE9tA+{)4T^7
zvE9qTZ=2R76k`?jpt$aJO`UDg4_h1SH`SA(?y$~1hYnj2GA&I_5Z{EY?Nci;eRHMO
z{dQ9sdZ;|bPH*#Lohty=QC(@LbMD+Il3#zXF5qRnzj|J&rb!ARl+vhcq{zV0Ub3wX
zY+$#sA_cc}xT1_;o6lwWDRkBFW{61B-SA}EsWE<bbHd23|B9!~pxDPYyxcJcb$lT|
zZ-53^IG;5pZJw6-?mJ>R+=g!k9L{m<YW>J}DqU%x**r;T0y!)F7CxfSsib3><gIJO
z^3Rqt&*Ob|gG~;Wk;V`SqufK&MeLpCO=5GJ4;Kk4KW=!~QbBAfJxpyYk2G>iIE>|{
zDqZLUaLY}b;d067ypk5bS8j@&_3%2C-(pfX!3We^f9~ub<3VuQ+}F`>t30_85L#MS
z&1-m){~~sFy;6doj@E0}O0>%Va7=Q3r|tmVbLF)qL}`>3+Ah!i<hH**M{Lx9LFp_S
zZQ!WVBVU;LftD76VPW(EkOM=|rCF1D^=hVUnFTGT8T?jlQ#uf#IZ1fgABe(;7L#%f
zg-=W%4-`|!UUAERdBD!e&MF{OwUZxE@^@YiE?|e6Eurn;>{R0+h10hK<r0)>b=Xoo
z6t~}AKLDzN9Yr!G;^&#uYmUs=89#+7>UJKH9}H{FKuGOe#olo_yEC@*uc26iX6ijY
zl}yo0&!gyUzRww(SPp4<hjAN1VU|-F2QZ1?UbN6;7ex=jtywc@r5q2fU7GPV@{UlP
zWnY0hZ&;VkGzVYQ?ERv(aUQb*Y_@nZBUTd}%68Gx7gWaji!25~x2CU5Z$<mJ#LolO
zXj1=cA(83pavKT#gss$7Y5(Ew*SoQ*QqQa>@<M3P_g{amS29Dn-f^P#|3ZF<T}eCE
zlrFl+R;jMdsrpOGp-k_<dZ3Uw!ESu;iPK@MQV7%2k#=^$`Au~~Sf-F#!ac<<&%;cw
zVkxdL8WM=4#FEiRbN@>|p_K?N?Q|NDcksuABp*qgAr?zv?z&gXCI{K)rJT)gnD($Y
zM-qPtYImNW^5#ME9POTBdj52UGi|FCa_xmv?}t$Ue@vJ&sbYIEaIa1>aQak|F%}_e
z+c*XKh0k`g{{()R<*X{#IgnKy?RQEbyt)}HDIX;I5pJud7G8d$?_tKAbuz}$Sm++G
zPQ<KQC_l{F<QHQ&0Yvo_Nv)vwDJd_V+Hf#(ZmU!bf{8I|y$i^se-=&&ou4B=KjCg)
z^w)@wff2>Fk~DY=i*AA~40R-OG_LKs8{8OXmGrKZMwH_qq=$|+)<)PXOCojzHs5#R
z$*HHPJCK@n6*fp?0Adu7>6wP`=BJi9f1rj5vD2-BT{mp6xGYm8HF>7vUAE!rd26Qc
z$8%0-Rc+Khj&Mvfd4y|Tma$;bIW+-ypA~i_{ZQ7n(xudLHrl^ZI1)nsrxO()$eG)(
z8h5Pjy46EJ(>S$k^sk>%@qYw^ylb~M;StlK(H}yPn&N&xuD9iFFaurv;t%sg@`0w5
zQP?QCBp~>cE#h7KJ{(}+ZvmJ;EfV!nA=urNwa2`{WtZ<h{`d<VjR6&*z;+7Rw1WRF
zO_%Ib@FGzbT13ntRIZ|Rr9XFV9DdikdH-Zy*~Xc~GHyd0rSXf7LIAxSiz3G%%TS&L
z)%yMzN1b73m&wdy#!|X`X}cATrlf*#WoP}P@G2`P{!_hqg%qmpZ#;Hge!XEW#V&*c
ziE}bwsFFL|^1lwZQhGj<`X7?{@Bstxr=&ZDWs+BrFI#bGDU|itI-~Jjtp!g0v?=rM
zMx6}htBNf|8YN(%uAHXZ7gZ&7vr;b8hzw>di|=0`S!Y6v#?x2F&-7sl3lipznt(ds
z#PX)0_$SoegkQXa!D>&auULuNClKglQ!?UGV3f|?N}1c5+ADCYl8k5>;mWYW0o~~a
zN6+Qmh04JaB$|t|(*uYAdg)lApeZUzK|=PZW(39K+#DI)6Bb@5KRwcSA4AHY9lpU!
z1m{1wZ%GmYp2&;Uz?BL@&TyN#Aby~!;VqsqG8~7LS)f4tEtn_Az>V&eI19^bw@#(F
zOz>of#or*J&xLn3Z32bM->2<zO(%QFR}sjOK2-l!eoO|5phKU_8Zi*%nd)C80wS|Y
zM-=0R&vT<m0UBHIVb73@C3Td{k8lYq^lmG3f88`Bu!Aj|P>A|ulQc~w&!{TJHsk1?
zh$tQF{GWm@@J|uff`tkh5m;E^)~9+;{_0b6&4V%d?*5%YUR_Hmt(mbuXn?By)8{F~
zHbqTs?-K>aXj|$M?!Q6YxD#PTBlJJR#0hiRD{myE*1f<KefzNfENZ~^dg!MW)zg^c
zvzi!o>)-%$J=NyAq)I3#S0WbVq^|VJy*$)$rJvx-Yt98cAN7isRJ0cVEU3~D9ZA{S
zH7O%UIfYvJw(vJ89LC0TM_YVE_pQqdn|wu?91gs&dN$f-H`H=AG_ydHtd7XCNg3O{
z@)O&-@;bUQ5-BcVKpZf}zxF>>2mH7DwFsfQ)9V9c3Do@kMr`dNR{s@tYsL)&c+Pv)
z0Dlpfo;Vx@{1q&~7yZtuTZ$qh7*eU%-%4<5@EJR%=P7~M-=Q8`hLrmkh1!+<W!Vpy
zfVC{m-YtLbdSj=6wpQw*()mX}v;8u1MhGuUj*A+Ba`P9$>LspsIdEtqNbQpkhh3{^
zZ8T_|&$)#j<={vh4?Re_j4?Gu4XVG!ngO~$qJ0O>3+IBxi*5QkUf|39#(mX9cegDJ
ze-T(?4II`Jo4XC??+UnSO*cG?oi_YiJz9~SPjRd?p-!<b4jOyalC7oT=bF*hnl+fB
zqtO0E@<sq_L!nRCyqDgs2;vWEA%-RyRh{leA8&{cz?S)`xE%|sciJi==|f#8xja6#
z;B3li{h<g4j#=O7ZYY&#Wzx<^<ii&q{OO1JRQr^UMY508EPI?|ElGR&xwH$WY!Whk
zr%EsBbRlAyU*((%l<<Q!-M;!6JZV?qE%V)0U0o9o15mA!>2F6~on3ouR_@x+by%Hp
zd(wFwYBE&jpoS7C==HdM{8ky%%opN9N-+K2A||GDpc6HBgQVB-YHv9|K^GOhh&;A0
zpvdT^v4}+Q@O9Gbi{O{Mx*FZ=w)n#Z%~)B6{8PBm*&~VjYuo{yPRjaYoS}xf;%_!@
zHk#w!?<2Wz&8~TbceLptsrcbd`!PdZaOPB<O<d5+SwsjBR8#`9JTy}zX<;cj3SxG5
zWs;A$umuBEZB1<=^_ZC0v@34vtE+Of3v*=T!7(a(d+&0(*>oQV=z-eT8zyjTLppWH
zAQIX^XYzUgay&PAWSN*0^(+~Bn`YsY%$akGP<UHZh1^G4AM5>U+4Or;MXbkW`WV1n
ztuBan?)R(qj=IN0ta_ho_(GGdk?vb`->*c+)?|}wd;v#fo^>H?OFi7#^%-`Lr?T)D
zHMMO@QE?@h3pZIj7~z#*)sLpL-QGBaa5D=kO(Q9)Kpv5dJ|h$oVY*+Tpm=zYJDt3j
z(d<X!stt)MWMUU4DQ_$DRiK~?^tRLDeV_4AnNQMk7POmC7x?CFme-})6J))04D~Md
zRI1}YMkDfo5irxad646+O3!>#Q+YjgIAKjqijTj9=-!~{`F(n}r$<xCDl#AMh6{2z
zypXeK<mH|*7L%N&qk&UF2MN%wO$$#2REfiu#MLN~zH+=_Z-yF+vB^!_7Mev*R^P+S
z0N@1#waAbs78w1qXF%AG%(iIRyDWfrs?nz8RB3&Ikl-oFKIJz+#au9jS}KkmA8pA7
z0Wy`#B>2;2fjZfV&=9DOlL-6rjpc#;{}~mh0XyK&<Y!nL6BZR~GtRV%``)VZ>{<RU
zUdW70+%{()<p@yw5P)DWa;(Pwc-YQ)!Pm}v;3ZRhS!+ST+OqY=zB?ga^2u_x*=~EZ
zHqXCmjtoeT5t^-|-?f}_F5Gw^u5cDixr3aK&ff6Z@b$@U=?~CE*cpdY5V=OP7r71g
z)+OT5^gn(hcF}+5`wl|N9QyDuAqd+5l3$nWW0eLg$77qxX+h}4{p6$`$XjSvt6^k#
z*HtKCjU8OPqiNOm_F6;scmsyjwCXe?^>isHEcragV{-h;iCg8Bv1n;hVwV%H=G2=)
z$cK8E)9<Hr8!lusquKJ2V@;6>)W`xlf#GmKg3h&1Rnfr<)?LbXn5`a6Db_uD#F$54
z5VKfH_C%a0d`Z9&6NS1*kn#zueZ1mjbzQx6rh+TP>oe(LcmN2A$Zr;Xms?R79LV<9
zY!`d;{y`KpO4+-C-8^bS8Ymu7z=0T)j)2sk4`?nH!2K7l2;`b4_Pa&D^}FNxv9~>d
zkoe<8o;z4I2Uisi#}PN#2F8Dx4Z{~KE3<sCi#DtUm~%!K@IAVsL-_XPzpk$o#U%%0
z+pTuu;P=TE7M6T1Z5tY&kD3XPN$|cC=fH}Q+G9xaU7U@|F-33>3{81HuXvJ@8V;ad
zbXrZf`atEZUl*N%ul4c|=s6p$T@nSgYZ87>108I)B5l3zso3z1ACk`$+FkUUcZqvH
zl&PnF(IQ)^8kC2}3@uZHhtN)k2E=d>C(vJxKTH=UCViIg<rEFe$*B*le5=GSe9=Z2
z_D)Q2OEg8J3`zMjJixd|Azz!2%=eQ!$B8eN>4m5`JH)I$droI6)J`WWn0|!OY)Rpf
zrB!l58=6vQ4Jj~{U=GrK=T$`vGZT~0=aV$=c4@p+a`$wHsi%iawMy%97mK$3bnnrh
zMlMehcQaNPo<zZK4p2(91A9z~4)|22_7PE<CU!2;;##xHBHd7xl+_DQ3@iy%dy`DV
z((!Jm9qt}fKj@}@^>JX|m_1pL+$GT`W1fCcThhaxQcd0Q$-j#X<n+s(3_UU?R8HuE
zXbJ2T958P3q4r&ltGgB4Il`nA*v@CR`Ja|0rT_z!Ovzp7kW{pY<u^`1OB)9)2sq0s
zbPwcLtWrdM_XK=@)>{tkgfNGxxn!(HZANIl#@%wbxFU<YQ^)i25;%gMP%t=Ux#FsP
z2~n0JzRXN5rxjD0cCo_XkZNy<{0OoM-VUcGK;scg@i-0Vhq(CWG4hSnhQDi0>DvX6
z)bR9E0NPZ!p7yl40-aHMY+1{VPr$F|hVT=+^81V<^n2DD04^qgZ09S|>oME9q5D~#
z4aN}4CvF}74gjShT-)h+-QdQ{HgX{(UX0Ou0fyWAL^->?mv`;$YF_2Pd*hN@Ow)EB
zn-P2kXS#W3==mg!XNyAfLv<!sALct78dDF}$s0dYRN9yF%^Bz2anowLsHx!tc)8$P
zl6g<3UpG4~Q5c+qzu+J?#1aU$@C@Qkfv_aC5ePbOZ0&SkC7bdj;YS+7Sd<=n@r1s1
zToA|?=TaI%|7{aHF*SY?KQu8Xe3DyZx{lNzJxSZsH@N4tjZb*b|N0^0GiyafVY6er
zxK3=-u`Xh23`X^(?QauP0`lhx<)s5oPiJ2hwDO_8o;9qJO5aDtoU1sF>YzO4R{@!L
z4_gjcOe3EY`ZffWuC6ORfkprY^QW)IhjM>Gi0SA*kp_rMRSaRkWn$}bPRtGIbwm^l
zMHByEwW%m<@u~jTFJk1x*qQMk{>JSmAqpYeRA`y8VZVFIWS21DrCvr}x~+6Qx$*ij
zeDNMW?+X5`!0M!XB$GF`4UbhLz@LQz2ERw2n<|kqG<bA;0Art$5@E|s-5`|CFFCmJ
z^kmIYoTP;x6n%YpycnmoTglXb0bvmuufQ_Q9z}U#6Z$abt>&1a<-!3Kb#WEXDcT^i
z;tOqz<Z8-#!&$UE>S;cACYX}6wPNX|ubLbluoBNa6j!x=cd1svz<8|UVevXp{sz>z
zt7Zj+ZhI!%Clr+}MXs#SyFWE4e%$3Q0b&3Ts*{!e$WlWP!_fduI_@My4=+PqllgCu
z3!bh&AZDhK-c)h~4uOV@6D8a>8=wRA@Sv_*c;~n>g4kE|kyTGR=>n_Lb0(_di^BLC
z=WIBsDt}*52XRg17v&kI2E37;Ff&K69*!^0m6#Ums+!%w3-#O7AUQ>0MDIy%vXjVd
z%7pENf|TFO&3|yb7A3ZT6-_%r3@2K&#EhJVfa0b=vZ=K3>-YlPPR)`BT0T{YC1IC1
zx@(hLAJ@&7<3kP1WAOWg^t5XRM@ve2YjfH~Bd^5)+f_EQWNcM?K}9cBOPca%?SG{w
z{R=Dl|6)`Af3cX<OP=1`IeTjYdKJrqcx{FCM@=o%^+a=t^kG@?ku)KC{DA?ze4=LD
zL2rRGJ?N&7wI*b9s4))1$$2O_0L$qBhWvV!#Gk^4epBeJ1=(wFFeAXk%0_&dd1T5d
z!k{NhmR$2528qgWt^AJp{jr5+Qeicx|Fm;GpMJKiKz+m18*=BLgEDDzrGOPzXL->R
z0~bm8cHtKh$Y113HdHj=*T5#c5dF-uu}b@F17D1UN^|1Q&3fYi{WW#bIEV#A3<43O
zL6x-1O6adxdyVuyy6sN@5-3gLPF>fiqUT8L$&ky{65?ah^io06Dfx9b`+VC^gbAa5
z?Js1xP-pH^$&>Dh#-Ba;II0z#Bd4d}KtV3D^mb$?6&G6zcXJu8IX&n6XHszg%lQ%A
zYE*;h1ra{Ve8(YH$yJ4b(Fr4-jEt3ag!FM-Y)%2to7P&7)3aQO>=km+0D{wtKUqlA
zl-|xsnOjeBk8;1xGI>y@Y^AT`>QOJGc%*wpC^p3DW&Z7{G%lo`X!YG);E=>*kJ-uo
zU`fJ{QvcVV-tFPM>r)_p<zD_9n&_b=rP11`Y<0l=d-oTcyPI5+-t?q<gUnv^s|9y0
z>K|eWjjvF5ediZb@Il5U6*S5&MYdsa(LEQvV<&unHB1WPKMA(l2qI|92_mIMP@v4Q
zZN`kn{XA~)bOWJ-=r^ly4(EPS&z*9_DCKjx$r3!(FO-7NN|C=QBJ=P&N)1##Zl1>a
zt<#+IOw|vK@qL~;E7=w_&aft#ydvmxg->Kb{SwNtol?kDo4FO+zuTo`uXAyi2540K
zUH_#?Q*CGJlM}rL?mtdLoNPEiuFdXG+JePeLb+D(_cPlpVXJ-N?pHO=0%r=1vc4|+
zFZeYVn^w)@1WmFJZX98GkPVOZA2AN-1}5ftu|f|s<9CrqTE8pGxiLPjMLz@nIezsL
zdE$g^i6VSQu`l9O4W4#(8bOZ*_h0r8?`F_wDy(f&QvNBg|Cy806_&XF;A9&e{vMbe
z&=FDdt6)L;h)7B|YcAU5y;oc{tXY|#K!7+N<q7$IUuT5pclPh>s87U+@>1*z7nX9P
z^0Ma#f1dyEO<^6ulAXqCW&*DO0?rK~xwsTl8f%}d`x=?kO5i%OK%C8UF27BohWp1u
z+16NYrei9PcSBJ~do2Bw%|rhWX<r%D*1o=(0)-YW*5Vf2THK*P305q)7k783P~5$^
zyA^jS?(XjH?q_z-xp!pE%v%4s^I>O)0I`+5^LyUMeAuI{VUDmP&Uw0BYwJ9=q+cLE
zxq?^d{VZJ@UMLCNP}>1o)QC<^3M=v{kNFb<fvX2yMRPENnFJc@Bqj5YYo!wu2kwa!
zEcRdf>ontq#~fB?yjF_U@14wp1tIteb4I!HWxa}(AJ{J-d+u8!D_tD9Hb=QC#V|Mo
z@7$DGgo{xje@2jh*AmfH-5G6AjbHoKMR`}(bL#Z202n3B=D;j8s|?dRfti+h+lfEo
zoHC`+FM3&BCr4xnh#kQLQZTNSv6Wu1oO4!%pA($DJTSsS)hPllA0D5bC(or5ZX_eB
zJJ4ci?pu<d=w^PzPLJ=)CC&ZL3Z@PBnMrh`2%8xA5%)rYaEiFk7D9b3`MRkFb{MJN
z_1DWO;bBy11nPnAh&=Lfh!fWc|Do#`>jMixC;?HmvdD%73$m5PEbUU?hYaAW?mL?<
z-A{1C_w`iao=rHs%Tyz&gs)A;OT;umOl^k5n}=En3JxCZgwl%x$=fyqVhFTeoeRIp
zB^N}chUg}4q9*Nz_6jXYq8FU}?P<senA4`QUEGM2ersBFwh<nrAxvpm@C?LHI0-wM
z@3plmE`iW|`XDzX;Vhy4u-N@_(#$qaB0{!5VzZ9MuXnqOQ4o6m0-^TgMgO*e)3KyK
z#lleDc@=37c0_#VN}z85;SFa~8JEMNrEZt~1iHc=aTjQwA{{S3hTa%V8YQZh`nrc6
z@ShV4wV-k0j!gFop}1DB^12)s^S8ZbgCbTbnaAQ;0}$?LdhQfT4zyWk598+QPW9VC
zOnD~^L(ozpYe-p#CNM>Q?C=6eZUVq{x&(dzk|Sm9FahlU|H5@p2s9GlK7|3;22@yo
zmIB%>SbP3l6=KT6lmMi^Id%g=Oa*fj6?vFS;Vw*X3+5(+04@}q^wlH}Kzm_f09QIN
zdyadoALe;Z;33L3q^ttCi8e1z_3y<{E|G6Xfo>$WogIa0MScj%fg&(a>Vw&dC|ucF
zNNvr`UFtV;vs~PaXYt9;-vC1Q&IC!$%=U-_1c(^$Ch&>zUH0vpstU>A#kuq@dx8<y
zEaa-$T~i#&QwmB=lvAmktMIBx71hKZIeLjvpEx!b(Q3{8dFHcM;qy&=v}v1E12+^q
z%9vg4!Cd8uycTDRT`Op4jQM)IDj%O(7h=f4ClNo_u(o}|e%soGPP)H6N7FiUxUQOC
zk+R9}Laa?^E%|1k7vndAUDc;E;<|-_HogLXSGZn|KmY72dqK~J6gJkH>im1cfSg*<
z7N+&M-F&_E77jVBXK%x+>Eq$UiLF{KzLhIgAFJ{dkb{e!d-wsxWj%3oe3$m<rW@%u
zI3`k*D^!2Y`wc9PT)3z6xq#nw8`5%VYg^u^{^>1lI}Ig>N-wln&vqAXlaqIrLW6hT
zT~fFxo($XbL%AN{-7Asm_&@4L=!)*VvP6qbt@!%Fj!Qp{;v=8xrDpH<$V}qw6uq;H
z4rVEqgZie_in^^WlS$zVi!lmpZiq7XWmaOPAfvUTY1s{1LMN0Pa0+s<+^csE#0S(X
zXw}UUEppJ1q7HcQ0w?4#xbgXv@FU3@WW$|zPm;oKA&}R{sFSlgyq@sCq%<n0jH>Sy
zP9q*mpZRFjj(FmX{Kd#=XydGe<?s%4>uaVqE|yTX^a~I8{j031O~8Zdm}Fk|*TkD5
zy?R8Elk*Z4N^tLhnSc~4$UizhI<hAc4L+MDJdP$O2kJ<giwy>u)OXWi+t8k*7HZ73
z>bU3ITM8B_WPLB>Y|1XO!W7=}`Nfqm78Nm4nKN_!7RhkiC*{dEV>Ca1w$u<&4MRk_
zdN*4yh+bS*oKHL}c*kKCM`gcNZQ-aju7QjOewyg$)$SqyucGBcvA6p2r4<P?%Ixii
zv74nBx(cx*r<Z-cFBX=8yF58$KK75zCG;&@_qP)ePzxl0>pZg~rXAdlp~_}W0s4k3
zWXSF{eDEJKHqQ&_ODxONEpnTy-hHO{Kx#KhmGNZepGOOwKqwY{h3I*$?A0fEI2dy1
zpLSuCB>(i))h-21a8$5cbHX0~Ssume{hZ8GP0Y6RGoK62Cfl5G+Pk{SSSj~?$43a5
z=7Q#Q_SDUYSVlS(T`vsEh8X;*C>w+(D1l>m{qtZ`kJvGq>B<XjZr@WQs&_||_Lzl<
zi|gPsP<0Vk4j`UV5fN1)_q?4`O41zGP4UktIr)moJa13&Z^bWmUyp)hnKMi2P>9^p
zlVo)xrov^$l)76}P4e@TdFYrgTkb%Qh`C;6F|kz|sA+l*Pp?TndS&c00m{l&{<78G
zixN#?)wC^(kXzuUN*94JBe7#}!k@)4`POs@A-~&%d)&RKvLz@7s_ZDjJvn)$deUkl
zU`Jex3OrC3w?}*eTB_~9Nega^M?k5ODfdw&lcdaY@1za!pT|&cX!P-~V%2v;A)=@C
zWdyZv_upQXFbFHwH`6yY*UR94Xq%db5$B?!OcwE@4cn_0g5r@Id@*uF3}#kI0r8oo
zO}RsOSF85XJ<6;$JRLuBK8dz|-m*0{pdjo><&s*UUTkXcnZRTiD#SxQa(zUTKh_vN
zX>ju5NXT-pAjRKyz~xQzzB!#_gPGIN94723wVtfUy$HNl06b^7?N5i|V6icJ(}L^_
zId3{DF3EnPTx3MGp=_f(VOU%WevjW4J)(yxz?bRab@5zoR<zRG6^7&&cEFd5vm_^}
zRKofga*wFiqi#j-`s$kXb#Pp1&K`&IHbHrurOPFL{S6S<7H9w7mBK#`r@k$Yu-66f
z`v%x4)L3CLQ8I8^Xn2+CjIPlvEG7VIE><W5OXsf>TjVVV-lk^+D~a7}D|Ah*r^uZZ
zf-Ct;j;R^mO5QRpWh1-kpIb?WH0(4|N5BfKkOh$j#}7L6S(aJ+Sf$awrXq>wGb-mL
z8u*NOCdR~)ih^*M2WXN6qp|35wZoD>(<QY{88*>3(7Yu%0$$i{(WDgl2ynMnP*d&!
zXloBf>J6a$$nehkFPabk{dc7@$i_~s6tg8)VN9~i%S?)w_@)J*Dkgq!80Y>?ZyBsr
zRO4GMlGzg0WKf$)bE1yYw{Cf=c#DikKx713gE2e!3k2^hBYda6o?KjfSWoVJ+iz1i
z4Ab+7ItJD-sC_E_F=!A$5J_jsswwJJG5e#V@uF#h&QWD@W2_b9Ng(Vaqt|%pg?=m~
zOTA$+g*Lpz#``U&A}%M?Z2Ke5UB1G(<1Yt7Q-x^jRt+-(o%fu#EO0nm-YOU3{5dnd
z-P#0_o9XBwHDSkBj}A;~?L*>7DG53$2$n42zai4h&W%OaE-iCMAw9ZrkiyA3Szs|f
zV(n*Q{9v{+P}Yv*VD&R*mawQb)$n$fjJl7&;O7ld&BAXurSrgb5fMV~!xNAFT)TWU
z(bP*xoq<dRT5l|55cexdNfFgO7_ituU~XbKh)~LLMrrKM>ua>?yqYd^mlyg`R<X05
z#3Q}o!?|NU?q`{04O_7iO)mut$kq?N8+`$?P25{H6Wij-nc!{w!@`f2Icf5jO#5lR
zV~VaCPzBr|5eA$LVO5`hknt6E-@$|L%2!2c65)$it4lNKfmTC0rC?b4j4Jpow6C7p
z--}u?&Q@|aT5M71L<5Ez65<Ux#UdS?_+q`hLD8?2Y#l{WX)D#VrSm<`Fxyc!JY4y-
z6>7pQVEUIn*_KpEXG-)8HgVo}>igtdPEO4h1ASAx^=GX?R=In#{L-Zbmdj-5tvCp;
z1GtoQKP&Yb{RX-z2!%9})<1O46OAlB<1M}-W2PN+;`wIq^I9)7`c+3^d&hTeuyejv
z%Q=6WONnV1Zd2no?ZMB%8K9yJ*ViDsXq$d2%BCVV|NNubu3KI;lMPchad$dBN}vm!
z^M7=qH<crrlo}Zuq><DyrwKHF2!-7r<$N&w)l8Siw!GG0NQ2$v-$(2cKmz;p7YI%5
zS^!1G<?=aC=GulhVY%&LdeJ}kW`5B>-{6?s%p`t4*CdRg2R5qZ%!^c`bh}eiqn|Z}
zC1rD>=1IzHXYfWPc}q9}+~n#>Jo2l!hR|A51(+DT$C3-ykY%FoX21gJ)_Z+0B|A7%
z{~{CjinKAbP59pa=`i;kK8JM?WALT*Yl$A%H=<=!=Y^<dH?(`M3S&qb@O~$4b}LkF
ziN0qnO(4Snw9=T~0A%{x0QsNq)3K~rLkLV&0RzHk<l-4T{abHt?<k|wx+}s%Wts8#
z4;UJieVunqai_C<W||7LezJcY6Q+*bq(TpU<pu_?lXNNWo0@EU&x={*g0l<Bs|D3P
zai{nP?Y1Pm>^=&~EL&+`9;;N#rhYFjCj1aw{T%+0jF`@bYPO=B?;JaR@}_#piGcHJ
z?bTCToNKtBYhzr<qQ=t%?Xh`!b8F3z>4Qy8y))J4^E72JsUOgsX)rj{fV<18nEWVO
zS<l3U5L%47QLH42FU9l6G5see`xRf@P_44{(qe_G?zaI!aQ;N=kF(l3qm5K_Z;GF2
zjQS)#s0e_2>Tp+L^~@^J=<KE(>!529vsPu0u%5HO{e)>>6N~nOhcB^|=3;MDbedj&
z@?-(m+6{Q5B4r0Jl-9N!@|o~x434g~m&7aJG^&h7#%kHO2^2x{p|}PuUDJ#vx`cLP
zRm+;_<)5wO@8-{yjch>PMNR2tmbAD@nj!g&(>$^~PtGDtR4K%L8<6<L1xJ9c>6z$&
zTJ>#aR@lCX-;*gFf)&sjKq#U<b(Hg~(Kv;$MK0nTu~3kmsaZ6KG1pQ*l(?p+J^~K3
z6plu4o?^?z*3MnYLszII@AKw2e2Z>FI`-ZmEBwVYSRDL17o_KWATwom{RAreDn(@F
z$&=!o#5<VAlcEXq|G4a?`L0XqnPrPKk>*iC-y)QM^#m!6u_3<xqWBrevH-?I`LJ3`
zI)m7lN7T8}h)9{#tZUN%S(UGs`8C0T(Ug8XNr~=f0;?ead9pfp$%jczBUlYXkbc^j
z3Yj$I#YlHG{2{PN0njto-v>3xnZT5yObyK?`R7K{Xr_NjJ}C>qxMFYfm~ttB$sIWD
zU$hp^zpRd|8>Y;rfUS`fptWq+aM_G^V=$`N<~+sna1MX{1!8(OQ-nyd-wbJ~-y00*
z_`<-OrGG#*Wro-&8_|eJIapAXv}&}&hK3SsxlXZN`u<zv$fvj7*5jexiEi?sRTSct
z*}jewN4Z1YXb~0y61qlQZq+F0;d@zCJ+ta+p}mywd017b(M6tF%<&gOkMp(Q(YBO$
z>I^+U03va#@>ezY>!OzTXXO_(MN?x0NyBDIeEkVReMC1k?JI13w&M%7ihqQzvf3Nf
zJbk`<>tb-D+Ke%Iz*N`I)-p9-66iwONm!&@K`7WOE4_-=;G?b{WO1S!jk{qRElL)r
z|IJzuAyV*I>wFC@!ph=(dY*I9pgT?NhpDWn#Az6BqAy&G^SFj^4xCU3TA6cs2NBL)
zNR9|wZ;Wku1X#Ypp82)XH${DrPs0jgN@z?E1XAY5J(v_STM^x*ka2Iu!1G5r8h4Ji
z_R_MBlXL+XZp=*dDDrEAe7j&y7|85uoUMLhaBhWu*D}+P|B-P_?$}|I)U4SNOkF_#
zKc9u@ew}dylZ<Cak36tHvPN5BWb{Kg5y18BqXg$;yW#x7jdu3i!<gLF*=oGebGL&?
zixxu5MwO{lfq#K82-emJh=u#sE;ap9o7r7$OJ~M_^YA29jmux4qt$h^WA)-?+Z&Ua
zp6M?1#X=&@E<fqxr`;{&9AsOScaRA*;dA`11*L?|_hVY?+3&jXo9cO#M0a&KU-lu(
zlRG3)!Plh9X^7CVwc^<6&WVSPX}+c;rv(y{mSndhy{9mpe*CU&a%c&+uhNkN?lCHM
zo#=B9Ac>nPt*)<}2BQyPiHR;-W<268DmHA}cI0<vbLmNyh6zLBk*jgzdG#M6&P#ly
zcoGK~8HZj0C!05WA|~@@7#%Ruyj|BXq%Uj<g1I{2yrh*$`M_p#4lfVah*Di`ld6Si
zYyF7F0fAH{e^pZJb1o&q-=)b62I_Ae>-jjs(*tvhsM~YcCYJY=ZY6gXDznjhRvXO_
z4`$4i7n$GjaOjD&mrLbC@!%;)b2BDzhM>VHSjY~B2M;^xIp4HKYn7mbcs@hz9^6J5
zBd;mzth}6z^(M=e#?NdQnbpJLy#fy4J@}p?<mwu0o1#8$#xcI7UoleJ+S+a7+HJ9$
zE!jT`A7aE~OWk^bv;{WHIhEu`RjV)P6EjFl+CTQT@ovJNx0m3I=QxN>C(d~nWs}Fu
zDc$(4o3*G>)H6n^)!LBWhd2;W-vS!Q*-R5|zWCUmRX^x9QNXsxlZ8*O+BX*(^dJt}
ztl|3`G&-~7=sm_ONNKv-iiUNct-(UL$>9xKs4FcG$}VPBD7nqn>JYFWJhrIm&k1FH
z8c5REWzlS^^648Bnw})np&zUZHaVawP)4*f$SFfte%)VuiJW?*_ZN1lPL??1Y$Ly#
z!{U?Z6CK2?n2+%z?I#XY$B$I}JCOr3YIq`#gFVXNJJDrgdFhrJ(%R?g${<__JpW!v
z$g_l7hcID<(GTL?q^wu;Ah?)zn8<!cOTz|_$v%zn#A7L+x0d8@5kKh7DYd3%_A`<<
z4cS~T@Sg*CsEzMBJ^@qEGBby`qqTJ>Za7<}r25NyZUWf|=KHw5mv`3Lhlf(FvtU2>
zVr-N;?=BtDF(tn1r`w1`b)<O&K}8fgCz>fqF*Lw17K9wb<;XWIBB^jqD6}Z;J?KE9
z^;U6o=%wB1fZB4QiZvz8uc&YO8YqpamT*5DO)y7FNlBMQMRNxfg;GVP-0OnoL>=><
zdSnfQM51td;6Jche$He}wWmo=O>RbrYqTy`e`mGBRpApxLW}$t#Z)#F<F1876^1E&
z5n{M>D5{6sgZ)mmMMm%fDb^eGS0j7}8c-!u_NnW_3848TBd41ITO>$4*nyG;6nm!=
z?E+_=&65_KO<Bj<hO(sTe(O>fG8Xakg|KZDyM}KjIiq8|J=n09y19a{j%fASGxpvs
zHgh_bbrhNQb+Vkh-VPJYC;t2=+Mdh}Bq=`LFmBGRZvp{7w9m`D6lN^1VH8*Osa{me
z0eNW^bxSRNlG>LF7dIQ%$Ff`#v~R9x9mTrw(K%sVS@Fdynw`eUdG1CT1Tn&xV`)|8
z4(e_e1NlR7(uk-6YJIKKI}HnD%P`?h>d~Gxi7Es6dT$kv)LUDV&SMAtWcd$vad%UU
z%Gsd7bnGYk%h!N&82VqV=fL{!RFXpcnWUW!*86eZ$${VCa5nmpt~C$>dCWrm!rQVk
zvbx$}@%*?hn}5<=uz)z{^WcZ{wcU<8cT&rw+UknI^1gsjpLoFOlb@-}Y54HHN776p
zrr>IBzhgZ&FoAZlnEvV08DBtWI;zGYUQWbwHpS1R7jbkIby}E{plZzTJx7@J86@`D
zo7#Au6kZ)hj*XV_O{{d{?tRM%Xf`BpE&;qnYmo?Awl3}JZTK&gbwNf6g5yI`CQ5av
zRT43D6gLy>Db$bOebF!9%`3H&==Bw=O+&Rt@CiAazbbh65&L<P0#TPVJAV8)X)a2f
zu~ilAFo~LJVR<2MezwjgHvS?+$jFNuE|_r8j-rgyt!2;Tm#5jDa}szqZIFb}jzXE_
zl!TOS{p}-aB^WI++54Ok?ndtv`Ov<`$Th;6yrX&Ew0}Zqu_q#((wnq+-_vIvS;nuu
zrhP8(>{?$|Qr%b?5X`1Shfk+O#>yEP4ofVPQDzw*9DgD_CGiy+B|?f)#9i|+_ZgK#
z;{FYfhm=}lDnsdtiCqP}G`y6Ja@|KK+lxLKs_*HIJc#i}cC*EOC3U2R^xZ$ByS8Gc
zW@lGlw-V(00MAal%;9h@RwHcS5QN-C_DNRswUe!&0S-CHY*@hPW5DXd2OH-)g^igR
zC3R{%-XMKgc&Lh=Y0PheQ>|=E)Z1gK&E8*iM3@t~(L9Oc2CeZNa)CbyglzigKlSDh
zR@)NHS`s0K@&Ss-QC-SInYqp#m)@S$K(Di;LjYI}a*mnb`4Mkp_Kz6Sg@*ciql&=_
z&=_Lx#L8*dC8wn1ICdbWDChzfK0)AfD*H-aZE?_vyVJ61+k8zQdCjOrSTp^HeRuG@
zm7&b4c=|_yj@CB$!~F<(HE8}Zg`S$ib54mp-uqav7=3B1QP>cI{Bp$oP1(rH1|RsV
zSSB$)d&cdFNfLHsMU`2I_j`!ukjz=Rc1Odp($T6GYyL?@970C9B6+oFRsu`qJT^|e
z?vOb7R?JEaR<%6)FWrC5Np(c9eK&^1)Ku{SlaVHO)RcSis(_a0?!G)1wP<1#SAj@>
z%4%Q@dckUZU<{m|xl7+@VQ<4TsHBLxoDyp5WE4Te#cv3_NO9mZ_fLDof4G00%D<$k
zC5ptPsB0_wYuLfjF>(Q-gx%u`WE%B~fIG?hF|i%E;FJxFtP_;>Y0>+(j84)vlDMsJ
z?qlRc804mK{+@`$$A6D!eax?H6wf|D15Y_&Pam+4A99;Y!XtZI3ioOO1Wsu=iYev7
z=FtW5(tz_{AcMAtYdH^G%m@YBhi>m??@)AB7n<uUp!*E@U)+#u@C_Q4Nhbbrq_4j~
zGf_ZAInOz^H{?;_^J~2TkP|Sc5}3)8=wZtoY8VGnW)%p&|LZ+K$b9;A?w;gv<!YEM
z@PM37F7lm1BMxNr>+nUyl_S_blNtX|Cqb5@D59CqYt;09p{0D?C`1`rfv1(p@nDY>
zI3MsZwa0ah3!5f`5R>AhQ|#gIAXhZWvRB%MVL~~e$NR=}=-Fjta{sDC;)IX7UtIIG
zqy=yMB>k@nWi9`#tVB^m&(ZSzdIa;3(MFCtWl}rXMd`BvpnuHc`M`tyK@us7-WiNz
zAkamZH)WwaQ+-um13S{AkoNXkUd%1Uk~+UH48M{)&VZBTCT~nCoTHl?A9A6s2GiG7
zT{u;E(z!T0xj&g&8D!M#Lq$#>O^d<3mZDt9O_vQWFwpUN(??c+EG%pxpj1;|`??g*
z{+21V)AxAK3#}Z*oG*8nFdT2rO<aObI$r^WlkE!%quF@HNny0F^ssP}tcgkuv&O_u
z7C`3!g{tJkxCOUzjR2Pu!<v|9nX@e2u}hpJH1&to39=&q6na7?Ig=I1KR1A#cwUSY
zn1dA9i2=VT#u@kw?B3>KDny0mz)il*NctDS^C=1EAK~7Q$+v*jt*7vBs>cD4^F^6P
z`8pAW$bY|>lr#O-M)RPcpzNy!i4<|s6W7y^5(Xo`GsE}`1o`&6<hKD;EV<1URgKj~
z@ck^-u!j871`f7v2_UudU5IXcY{IdOs>=#O6NQbm>78jfJZ5+Mtm^GtbvyeIJ{=PR
zf%=NzQD^1+J@_kKeREf?au%PL&`7ZrnL02bB+eua51GfzMrLsf-FoLzLQ9jkaq?p#
zx{5#N>_e{wu`;@vb0U0<XV=FR=9v-cF|LC|^5@goSJBhu=SXWSK^u$n4sWPpB&Je@
z;(f4~c&zA0$v{Y4OM*NBmi4<^5~t0u=aOASn617;&5cv`IkI7ZsaLZoS5EFHQz){p
zUyq}=SuIWt+n}l@0o$ia-`$L(M_etIvk!sp1d7*9n1sax<05wW0l`9iZ?^PpVL@UD
z;iz1uj~pFD+-G%N$?Ah|GBL2hLzCCkk=223NIMMTyh&UmKaViKy##EHUNEi8E)GS`
z>|!J)EMSvxcFH3R_q@FZp3g!sq3J)7K?)rvqvFe`X)Ic514H)%!A&J5PK}KDHu<LU
z6Y5%vwf$r^1L<2pIZyZ-l5iAg+56ILo|x8xe*+>~NoR_N`d}pEwEr!lt<`hTlgMAy
z!Ry`fXEia2`2`+012~_F$Tv%62(hrp?q!=PDVm&I{UZ3XS%(U;nld78ZrVRq5gC)Z
zJtrwbMTSb>5qWflVzGFO4mQL(kdu9n3BJddYfhJ&Vzja%zho>kFv<1EuyiD^XkW9H
zk+>xeSDSE-=)PH?C>>J91Nya3COC9nq8I&Ves^Mn^oX78eC#55W1wf-UHEBZ_vhh`
zS2nYkPXe_2T~rKY)uNVM4K;XX%i-y>TP&Z?88fpW=V~}<@D!o8d63QTDS&&&soT}?
z`$m|6@~2+pR>eccO;{t6@OsYQ*PAJJ-$!_LgGb^i?XQ-J;K8q@Yn%9YCvNbD#@wrR
zR32R;&P!=Z&1+O{JAUgQHaH6emcyOhhLzL9bQZuj*Nv_iK5uM2q_?d4-hbDM$~;th
z2&HkzTXJuQ89*iCz0q0Byx}~dYfV*AxYNo{P>PelQ&0{n^~#qqv^{L(A87%!4ib$>
zgy!tv7P(RU_RVu_ij|1h6Zf^!1u|fQLST(PbF=h&5;}vxCT8kZY+{ja-luRgDtuL7
z8d|%QG;`smG$ie~8^`Ob9={M)bMZ4@5%O|)B_OP^3?C!>b+L8aR&oJ7)T6^Isze+;
zTep%%=?aYPIjE4fh}b(E>IFppj?L7&F(~oALqhHK#|AHL8<$ER6B*l%z1#@sT%vVU
z?!7{x;GC3#eK%z%jJ3!+Hz5^D=tRw<Vh<jBoQjPN{wg6XVa$qbk^=xeVT{P>WJ&R|
zloFa02R=V5)qTeslU<EpPIA#Q%WA?*CH4&`?cdl%pLb5LuxlgdO+F>)U3$4R=v@`n
zJuH;>8!~&fc1CpkGK$-Y?5BHgH<bi$qJ0P*l34US5YXNbSXV_ztI?epF{`74vFw!}
zL)>GiZj$2rG7F{qb@D{b-;vvdCzKqY$DW=m<Ko|&fa-bw;#1q@h{yV^Vkp01J7RJI
zP+uJq^y;&hKV5;-+m$ez#JW>Mm=47IbIp?MAjGI8<5O%wC#@=%$ezJ20`jT~)p*ED
zDK&ahA`ZMtwWn;Ifg6JHdJ7e7>6nZ2gA_GcY~6Ef7Td6{m{aLGR}Xp=VaG>lhE=wc
zq@8bsBQq<)KeyxD0P=@z+G67aN1Zdf(z3ofmkr6}el0>&l!1(sc){?y*S0pNqubqz
z)e~5fyQ_V(%5b*YQImu~YHyrLFW#5$U|?pC4FTmVIa;X_O(QdK(}@)P%!&`rE|8E=
zqo(YDDkjr$of=#mXB+YL?eXW=IB<IfSeS2KUQ>zVit(n9{RN8H6e)v-7zyO=-KzN-
zvdzCc1c#z^&NLdE+b^S{v9A>mG@n>C%UEO;9;8t!5Gf`3g7k(A);wO@-eLkZf|5Xu
zV7NG|ae#BLo|WP`MfYzSqo1Vv=^KEhZg<}}=bE(k79%<V3ra2#?2_%ne94{l5Tm-_
zUxN&nTaU@l?Ryc?+jhUx(0@W%Z$1p>>IVZ0Ss94|MU1%-V4Is_>!C78fNlD<TdwoM
zUlRmw4%dPh=}lGi=Z&j!aWwqM*#;DF*yR6Z_tyXH@)EZ~uH!%#w89+ZEy3X2gbp1^
zgFv?8d<Atr>dAo_wLv>+N^c2l3W2Ik5QvLBZTec~ce&r#9b}$O(*VQjokR*MuKCop
zBHvOtZa`x=v$~o>s<OWQ`mYHfF3Peb1fUDlwc+-U%kF|QUgj@CnwroUdwAX3Ii%)B
zcK6^vZ&EZLZhq_zIDgYJ#tL8Sh1N&*(Qca~nG44j{tOYcC<;rSztV}W?8*M5@-q1-
z8sPrX1{gZM=ry&30&$SNCB|O6>BU|j1TUUX(Mrt}<+Mi9dX?zVaYW~2?_BSJ_e3NA
zCs64AA%L~2!SdvtMUO6&YxK6Q^YRJ+G&GYA6ayhd#1q4fA<2GZwy4tr9jF4}*~`)a
z>SBrBazxV<7ulc1cpfQrv*O4k(Y-PAqP8aSW8!wq-H7o~;UMh!P68sL3DqUKA=jwi
zj#m$e1;z1M6x-dc-}6e|=?}CY5%!<-)F<k@=$laJj`RXurEJ$rvvmxt$MJj!-}qiD
zXGw2ZZpcBXbHt!riqIjU0$lPdnD~ZMbW=?Wi`6L!(HGzJU0`gTvmAOLCB$LC;3oSa
zhTb}*J;k?gNyeR6Iz7GAzU{61D}e}yelnBR(cA?KxBl3$HFn1=v{UxU{xy*JDCkn_
zpUj#0y$7|-rbgSs9rkJ2SM*&EptqY;;jeg==N1g&!_G$A$<Yavl04dyZOA}jcGPkW
zt%lo6-XMl$1#3|0*%V*)PC`dSdXH|3y*4Jx3(eig?E0<WI~63cn)jcR98w~=f~N7<
z9A16GqGkU~ZokP#x48_t*@R9pmY3`Q^Y!Nbs$nj=7xsI!jKuu;ZE)F>!G>F@?m2Hc
z%Uk4EgC$G_9R*b9R3Mn{aCjSyV+dtaF$24xf96qk*%9y!y~{21kBrSs(uJ{1&xbT2
zsy4#P?pR2945QUQ-Jf;b%cD{I`rZ0ZYbS!U{JAwCulrzyaPno+X17nk4*f4sYx3m7
z3~@kpR;2p8de+-dNRiGA;p%J)s~RHN`~3vqk6{IzhtHc@xp<x<><6y)>qnadb%tI+
zHOT3eUz`d0yduk7<K~*)>q=rq%Ro)&^s?yURH(B;<*BK2yRkq&feTqUC(K?8*kPU@
zVepc8my(bD<z;Ga{!6>w2qHwj3w6yV1-Ml2VR+vJI_gbDH|s4TJl*cljdV@#B+$+i
zS<;rXHYoj3lx=gt{2#R`fK~4Q<@V|;y3s047xM<yK#g03y33LQ>OWF6Q5O+|J&sa4
zBoP)vmB+MPukyb@MK!eJdk_hUJsKMkhSz@tj2-d8)VQ;I9}c~YXX=PqgPWwi!dyKa
zMh?}y=E~A2@iVO@b|aO?rrk_d7VMM20m4zI$C{yqs13O=0Vq?LJ+r-DBjp<q3tOHm
zUTx(ncBk-6v7qq1QFB*MLfSYdypiPHocK%1`Au>ffsR#eiH*FV^|<UfiN=(7W|Sp1
zGx>cdwYb30hUxG5e?|Vv(*EqP<@v8;OI<)pV}ZbwBRCUVE0`U2PX^xEXR+HAqjXYe
zwy3`0yCA*`33|HhtIa$!OqI!;$+98yw_%lfRzP*^widzcM_z$KhHYOzU3Re?7((W^
zT7o^+Tm-Xi3#0jWRYKth;~^dQh+>^z){qOYz+mv0@0hPv8c`j0)zWdM)~I|yR$g;$
z{K$G{Dq`bH>qcf-_Sh1gC}b*KrXH8Py?0mp0H~G-hId%lNoowGb23!SSxgfM^$N57
z@=gp4=U8e1tH3TFm}_-q#0$tdJVcD|0wg$KkK=zDg6WI+&#sB8{jaCC_ba`My)yIV
z4gLZt-CePc1(O!GPmxSksm)D)jm6WLQq3Kvd!HxycRa^Lg~nE5HXD)g@OxC-uM>ue
zNngix?4k{0Scj()0aFqxWh7ub`Y~C7DjWoW9pEQN7F#Sp+Xf(+d_AiF1^RpfpbvnD
z{;)fkf~*~;(VqayCltuB%#Kmep`;B>N`0RcqJ(bhLv72T63*@whxNC*|EoxGtsRo;
zW@2oda5REi(Ej`3jnG~Qg!Vx3`){~!!C#dv7+U;m-WvDO3xq*%Jj_z2s@;+qM(c)t
z*tNK!c}d*w_~)eUSOAL3Y!2CptcH)|UQH>NX<dNE__{c~sVZ%{g85xTyH1}#n4`kH
zu6VZbwrpP~9A2Uzv%zZyX`<kjw(++XHwHqRv3jd>e}Teu05BRCrK;k9{K<^!eI1jH
z&C;KHkNgAt%k|HwdM(UEFD!V)iEmnh*WHhf8$|9QPWCY%rcRw8-WKO&Z2JR=<Yv`W
z3Aut&a*z5tBJ{iD^?QbRGfh3|l}cX0MDn2T-%3Q$a5=xB;lf?R?RLJ9xxa0jAmwPq
zh~HGK#bs9O`!E_N<Xeyaol?vagv^`)zZF4wcGFaNX9rb(#<)=DsevX>BG9_}pb8Rl
zf(sC8-0Hkv1cWT&XM1Wdki7ST+>GAQD&rW%*+mN8hqv2B!-OK=x|y;~7ZvmGeyAu8
zaLPGpBIeT&WT@%-rO|aZiis7?g;flO^?AeVgJv4uI(S~*X@%^3u%h{;C#Ycgb1Nj@
zd}~XOdRuUjqz7Jx!uk~socsPc@w#Qr+7I<aV0O&5+}=<JBtqL~#?mB%%?;|1QF>EC
zQ|w07k+@w?!uB@S<)spLujEAR2q6IhS0SZt>Xj2$SIZ7g)IrQ|k<v=$;QV08Q><UH
zUFQd~Nq+Q8M=l+A<gNY1kXs=3scI>foQ0Yf=67nt^;R^?j#m}ckG00M)9w%2tntyw
z>LSWuv)Jd&PrU+k1q8R|p=;A#Aw*!`?iIH1kvIC1+Gy3kDx!p{G;rA~aP(rkOhtuL
zcA5%$qd%y(L}()s>j+LgLKh#Nq(#MkX>tz<;Z$L^T-b7agAGR@P+VXVv8T={@x#h0
z3FeMZuqXf-2@xP8$os=SJ<L)S87HulSHiM_jE3YU!)<x&4=0+6=xAg01mwB@Tny1l
zx@^}b0!;@Sajx7<P#y>DSyL^-x>O{!S8xqf4N5n?R-G4R+Hw_19d=lodk3g9Yea7e
zHrcwlZT)vqB$)jl3F`u$9M$AdYtg|ApfpylzLzuH!y`_<ipeqiFy&984*4TQZy{@<
zq^;RcQQ87Z@e!q~`xus$sc|gvK@E`ol!$iZaF4^Rc!pA{BHpBXcY{;t_zS{>(n45S
zh7W$VqTPJ!KL0fI@rwcdO<05L5uX?AO7m@J>!-@8r)0O78?%{?WAK*a?n!!Q=5_n9
z<BVF)jW;#V=F6eu1Kx3HYyvCpt`ujh#31xXU|+YU#IJ)lzw>4l@OqWMqCfsV>;&kt
zkY_SC^G45`kBSHUS*4N<DTQoB)4299ioP@?zJOy)Ui|COY{g6}zj}tI+b4n-HqVWL
zNm*ffbB?IUJ+Gf-x;b@e>Lx%-l=}TtHBa=){^f!l*)|$PEAH#8s9uRE$H|E|gxBa!
z<_@a0H~uwGQV2bQ#AusU!-z}F)GXP>B3&Oqdbb4t@S2eKCijLHFXbU5QXSd9#B$yY
zmm*D!>bmH|prG%~fT=BE{fbU8zh$=_abS8CJ#S)zEt}c?m>n;m*3~*~)Oas?vN^ge
zKYL(;WvY1)KV!13?&qilQ;sNr_q(|{>9~qz%TcbK*iX<$8iBILoK-dd)h<8O75$R9
zBWA3idr*&-Gwo0A<losVbH;*>{jQzi?iG{gY?kUFgp_<y)Xeq^%@q$xzuTtDKE6d=
z)O*=D6ChSgRjtWJxi;+HsjxCmlZvK`{DgQ`{K7V}v@B)+m>-pLGb(teV3=ew7o=dj
zL_>@8*k^8`<(8l*0_QFEIuLHnsBkmaHs)|4ycisY!%)+xcUxJo)LVbT^OEY){Ut9u
zn=LaS)yO#8PIcD&s@jI!N79>LMPWN=v;5XIyv^S%r9MG^7T;ozy%uh_U*6x`2)D0)
zm(ZH~9nB3MUuhn`RWkJp$C2|MkNv~rOqlL{?m5v8@kc)fgJL>WRY3z>F-+W^4Ht&%
zVk|i!rMXja1|MKZEDIwisg9={aAJkXo84c>d%`DngQa4^Q4t9kz<@Y9XAp9XCS~Hf
zKRvOmMUlXE5|PXlkOOAIV$w?dJ<jE4=q8urVMIomo#HH`)yrr1pLVyh*AHn|NAcV9
zqIRygs+AMEW@b3kTk^NcC%z|cvkV2MA2=?o>La7(5fJ%(iY9dZPrl~NL3QJUzo2Ag
z0`|KRVs=}hU07Hy&Jh8LT?ax-)pUzY<E$R$&r4pNX9clSPGs_OON*^j$49rt{QI%`
z5SEy`E9_xY?v&enWJi(bZeAj{hiN>zG<jRDT)981vj04MF6aM-sVGwo__GVt=H>xW
zsm8#su4JDRM-uA(HCs`&hx~Q4jsjjh>C7Tlj>gMv^v&1Vb@DynKDY`(b<o-|fqrdu
zA$RzoUOtLn8kv&1gMrr%FBA)R^luBhfk|k`=`^X!OD>K~YbUQ7Eqj~<J~O}Skp!6e
z9^#PE(q5a)J1was$u%igzqk|G0t%SQLXmz0J}14hx9|d?#2+F8$zJ-;N@n91OfW>8
zSS++_3Q0iO_;J=~)++pnp>~^!rD_9o^OJM?T^reN9+CN%wXFe#dhDf8FrAs;1pmyJ
zTad?34E7YC-Y0>MBxS}_E`<boaeG4i;YB;gwx)xqsN0s&y2}TL18PM@*&>(%9Ke-B
zU5Zh01kEXg^hwyuHCNKx6dLJyBgg}$F~p2`DiG@RoUyBdt3Kt;eVhSOnkz)0Cn;<g
zTK~-0L5MnhV!7nf?WwmX(8y<&FkQYi#kinE|IRv4W*M8YsjxQJA#Ujx)tj7`Hnrh=
zs`0n?f9Gw?S>WV$%TIrd?wL;wynI9Y;m_xij2y_(Racn?R|ku2*xZz$WaBQT?Vi2F
z4Rm7NCdhTd*~-|l{P^-&b<6he4hPl*%>F;q0L!R~7;hfk*4XECe*C;dJ*$mWL(WCn
zdc|ZJMaLm@=1=t2j?o9tZ+Jcv_=sUk#FX+YIM)xU1@Cx~+qWS+y)|3=h|Ko#D^j>r
z3O)K^ee3nNQ1=xTOF%}aPVgQf8fNo1Kl78I7r~)8)+hD6#C%ES`GN1ZLt)jH9&?Ak
z-m&{|eA~q>+r0_B3%W_9I17&;$51PqEcn{S#7w6z#M!=}C=R9)_=xk(9ks4&THFoC
zJe;15a<#S)h)Bt*4<GxpHu|%b9d;~;&SiYSqzfs8u&1#zy6R1>5l_xkxP$YNiaYIS
z(`jK4uW>!IFAndOi=EA+S2j)z?ms-M@Qs!_t`~aL0v9<gIjs=?D8nSpm|;7=$k2un
z#|Vj?8oJrmMiXsPSK8f^;PLbK**8I+qewegkKHoJUJuhDngvHbk6$G;<V09L|NGgL
zJUhus@pp)RtTlpGyy|BNufM|1)Uqf&K!8pWStIs<6y!twh@aildwz8(-q=h!+HKH2
za_%?L@US$oR2b?-i}wT4W$f)VKo9yqsNMh1>#rE9Pc675i8u;3$(ne$W_A|1V!Ssw
zulRa*HTX>Tls9IS!lCYkZ+0K^XUk=@GxEar6t*4R2&J%~(}W$sX$pwP6k&ixR*DZO
zz(>lge_6k?**{gSmWMAZ8ENX`wr=*;R7bfe+TGrD1#EVgsa`UeU6!OmMj9|!`t|#O
zykb2}22ORvS>RwUE&XVUh<uWNn5Mzc%XT*o_9Xp`O-fS}*EX+#+yz^G;%f0&>xGVx
zc3|h>M&sV`W}LN>{}mNtMvV8{2UyKhUr#(!e*W_uZp+B?#r6ZEriREZ^`1A#>$XT3
zDxmB_-Z)(Faa+JDs{6+^IyvG1`@XCOno9L~FBcmQq|^zb&lK3fWgmF`u!D9-P|@Pj
zaqiUD(7FWPdBn>cX&()W-+KN9g2oDOACIm^Btpd6@45Q;xXOGLpA(+k40IT}s~0FU
zY4t2>Y9>n}q7mS~h-`9g2Y@!IU|Ls(nUZ{DhSRa!`OcmE!UoM&2&YQF)h_NV-BTRT
zIx;<O4-l!K;urR6(Z!WdnXH0l2L%XQ;pdZ89Y$ZxyL@0ei9Y-qLSYCOt%m*b9v8q;
zoFt$ObpJACphjK0tZMx)P_U)DKv5^`61l79P#>fFl#$A;H42&EuC>P1hzIIxTYEWN
z&ZbPtncj({+_=03T}E@mV8h=Rc|o0YYf+)$Xj~6?8-%z7#f3@;f08B*+*!|;8r{_P
zlCr<pcYJX?t$5cyOiErA-A2mT72l78(>~%s*R2K~ZB)@)bRZJW`=tICsElqVS56^p
zd{3u%bvdd_H`oRa<IQiZxWXk03uErzRXVSKQ!ZWc{jsd8%;j{G%<VS|=Fow)R5$Z>
zWu3uO$}F0w-%IY*Ev)dF($GiG9*Iq5-Wjhb9Ttl`&jK<3{F@8kYdqw-(r_ZAsfQWH
z=B?LUcd}5_6E9T~SQ`p%p*ta1|3p0|u&TIkUP4R~v;Tc1XZZaG&Zh~?ufvoF^pZa>
zOy1_b&!J2Wvi(D&{eh4b$&mnw_IKw2ZUf>!+}gBC4;1Df`C!uDJ}F8clNQqwJsJeH
zxc5=-^F{I`l(B(bj!5yF>fudvITOoP6|{zKi4fV<6gX|*Kpu>b4J*}G`gacf35tD^
zRp4~1<QdjYlqkXh-OsFM)+6Cyw^YBE05j(_i)?ynh@iAw8`@c!?oG!=f5#F;fhd#<
z;XGeOdr76g@dM{cz)5;XqZx|UtgH;>z8pCfK5?8?E*~!cmHP;P@V>)G)Nicu^x}YV
z&)h5OPn><8zZgMIU*Ae7lX&s_oU|?nl<8_^Ijls%E56x1Q&SD-uVcHPZR0!MCv_;S
zo}D`c4^B^Xv`quK9(jw)Cx)7pQQn&m;nyjJH!N|Cy`&-<t&{ncvJ=PD(i}9K{OP&!
zB?}cHN=v}PLg>$kgWC$mc~<2NQb@5ALar~7Oj-ByeX!gJ2S~7wip1y5mOVLfE<f&*
z*7%b;0lQiVWpe3}h;i<>3hC|I4Gd{<^71~H`(GU2lJ4IJ?_~$2GSqS%>SQV_x7i)6
z25G;pUd7T}I%wqUy)i817&%b>^!1MS7eO)8Vm$7i^aPN9*#=aB7u@M}$?msOiqkW!
z*bp!NkRtz@s5t>~UIBfx<^mFtyY02nJQ>Yi(4(mtDPj~S&=HZiwtvgSzMdzAE5H{W
z9N6TAvE>guI}LHCIu{menIwCDXjW~QJekxFPX2}OBe(_IfOAaYf`C0aD2iEPA2pP(
zj`(~%j43Z!I~ntPW47aiqhmas<@x;5qD2yQ1lUW13nkjtg=A}&?K1X(#rT_Q*{u(=
z5?7+*y{~{9E+<tPvrW>KHl{Q5vi)|X^-Wv+s%WdwEVtyRSUPWz{l^%8+)<KkQSxt$
zZ1FW#E-zt)Un=^?>mnl4doxRuJd_F^ikyp_2W(Ol!`Xum*gm58!)tQ&Fh$`LZ0S{$
zSsLs62*rTG;X_QHIjcqf$n>LVDtn@PpbE;u(<=IS4p>RB@zcEQ=tSxt$U*7@mNIsJ
z0+GFk8e0|3(oh9`n`xDA!B+#NZU$DaMRjs-VN$}yz~|V*@~CMQTtzxDGu%XW>I(?L
zAFm8lvgz0|xGwaMqu(yLhQBPu1V<>2QB|o@{s^*|+I`Ld7SuNnGYqzmSLue<idjk9
z1rbJLydnlgok+i#MeJSMM_`LlrTIkNBPOFXJ^bs)RU|WasH8ei(ay`0Hl2b+qS^Hw
zNaJGHe7N74RgLpH*&s2Sy|I)F{}NSH{E_g}r#B;fJU~i+^|^$a0&h}1?xg#acHhlm
z2$GZpWzxL2<F4()WAN{mUunZ_u5C1Xosp*D5k(Z!%}%aB&M+NFdIqkroktxP7k5ip
z%BU1Ta;J*Q0^Om755WiOnx^4YgH$HQBi0kjq8?eIWVrM{VIV>=k)Hm)sQ&i0Ve8CI
zwhV0}5cU-<$35Ky+*-uGY}(Qm=46QNXEfJLWnbjV5`-RE?U|;I{P^m<C<cSsX9b+S
z@w)eHX`gFLZLH8kHv}VM>*ORl8%j}f(~@zbp-sK#ZBP$Cqt!zz5*kzXkGG@pKoC+>
zP)@zaC70uEZf$MSj#MP6-UC`s2v*IU-_I&wwo8<gvQs*@U-#ihtY(2gSUqt-sriEO
zm^w}TbzI+W3=kF}yL$LtG(i_0)N{e@@mlJ%qB1YLWRPh=Wnb<sCG7;-hGotp;@}ip
zVZLtdeefTKF3eDpZkW_XrHUwL%3g&~ih=MQo=LtkUx{<pNQYtFceRrv_DKSFkn>u)
zmYY$OZ*Zcxh-PpKh1>$|&eEj_oD}&5xlOr}BM7Z)mZ8YGFl=<*UPWZ6XwC%3fa%zG
zlB!&qXO}IVA}zaEf_%o3>799qy#V#$ey?Y9ic=}RnQ<u@`seSMT<zB-8ruxj+CfL_
zm2EW&BM}gcrQ}kGVMBxA()?pS5EVu2z29v*F)kFWPSmA?Lnrc91SiYqM>hp`ZY>ZO
zB8P=u)o?_kLNBOnzs$TVYs)aXO{iH9(@4nC8TGl4KWi=SK3Ly^sOvW0REx}K+C7yG
zyANjx9^2Emg~y2ove1__D=~RxJhO2kVuB#*nFt7KJiOF~rkf?n=fk^jVqRQ{n?2Lw
z{2c7~ru-#?)F43W!Q@0{W^4QQIN~-yNz!+1Mcaz!O^ibgDX?@aKVJ7S+~yFsCJ>+x
z7#+S~r9>}DOYkH`H$wcj3`7W3!$Bp4qFSJ%ir;HKM{V%}T3HpRR%IXYS^6Y)Nf8hQ
z(0YnyFp5@sc@H^qM2G2y>BQ;YJ93dvQfF0s`nT--KiZFvRcp#<x2ZGW^|&p@_&~8n
z##9)0_^@r;-*dw9CN-=RBObiaPfZMpRJ({9s8Z5?k%f(Eg!EwPs4s1TFuOfO*UOQe
z<=2%0XX`lL30v!4oUq}?caA_biWsF?e1AwwkEeDS*5!&!P45A6UksqmCr2476X1n*
z<rUy+G2OY;YvVjHY*R3jMG}ST7#fWZ!sWeip#r^HPsj13)^x5s*_4>bn_utSe$C#a
z=a%wnD3OX52LlL8BiBcU-ld<5DxAl4cc)ghqzBxhF^+-oq;l4Cz|rEnmX4txp&Z0K
z#l@=XK)}l^c1TD>MJAAK0SLQn)2!u0ERDIDn&$0n>W=2YhSI?DrZj!~PZdB)kz_n+
z#vYKoLFtz35F|$Zrsw7P(TjIh%~<hGrowB$&5Z+s&IGC46pSlm>r+s0H<rSRsM~+2
zTZ4h$1`3L&9w#MsYKhl}X)H(|4G#Pga5Z;NJ{DfFg_Iu*7f3_dyNifp?UzqXt=^eQ
zx$hv^D$UD`wY5!D&?fKwcm&c~jSI*ns0(%@g^{CwQOHRWIJDzt$Vfr7G`dY-rC4-C
z1((tVHKa2gXX~t3!W!0<xfb|nE!3gWFM5OYpzU`zn}GI!@38TX;p{{P?~v@|h2{CX
z5y=NCJJO%W<d7ezE{jc(LUnK$G!Vv|SX~#KW~fP9WqA3G=ba%N7Xz<)NyU3>$<_`y
zb6kDMUm%q&dqo3It(<UY9LvF*?{~h>zPYIgUmsD1SF*9jw2J#1j<b#1aYab{btnaS
z-CIzd_xP#Zfns37J?n+}PS}Hpcan5)_)u12YDZXnJ)Cw}TreySg{ScJ$1*l4=~LNO
z8;a$nQQi?OY9mAXUPKT<Ogl)~LbVqS%>d;gjg49oUBHa5k*pN3me}n7p?v<{w8l$_
zp{-&ceh{+;aCYpb_Y?`^57Ua^3^u)%OUt<`7e8BxxDnH>2?T5Oc{&k}-l1L2)MZL8
zNNR@dL2sgG_05f4zcoa2>Oterso}z{5d>pa8c`hY%}f1STHh<-;5*ONFn!u<G%6%Y
z)hv#xPduS?F|Ys#(%HPIz1)%0vG8E(JX7Gq1o~%FaA-Qu+dt)p6%$jCPkAr!Y@Xf`
zn-ttc2?e4ysY0(wD#G{~Rew#Sgd@ndX$4$dmkH(6r%5KRm@GAi+YY%+Ic!ZA9#agt
zV4HGB?*K=070Z8gNCQi>|J(m@mm)rCs0Zdn;!bVG45Dd!z0{b_BAM|lO2>$V9XR*(
zm5mH+GagT<^ljO`dd#mc`g)ovpQw5wBMH1z`@hMyU^N<VRJzJ>t4U~;nOh33(6P?*
z_H`L|+1~eLmC7%6_`H3|-XpI#1xAt_u{MVyie3=zxF<Vah(6?U9B_MI;wj5DkntA5
z?uTL?$ne4Q2^y3cPMpEXrK~AlHQ^izf8UY5a5C(VRbZA<-8pidHYtbao{**NE-q|G
zNZP%o%XqaDe{%;kW@;-<eMY%d7U4FG3cC0Ubc~c)o4VOw!`bnitVHBYn`uK05<}x6
zPvO#qmrTpS)Y8^EK7Y79CL*kf;Oai8d*PzGoBc7vw%*T!E~h4_)qm#OJ?vg_=cd%8
zT}`4enI`8;0xYp9E~jjMp&v9nhG=n!NO6a!lm$+k*6|0Nvj<9wJDKJ?QK~#XMrq_)
z0-DIgbG9rK?(FKuE$X8xPS|5P#w8fLgjj?A&A6}8V&uacd}v48Wu+f(`7{yE+#;;D
zwW=xe$|59D0(Uhkmv({mbyYQ8#u!^Vokh)}=V=y~fYaQg7wzs|R=e8yNFrg%+0tUD
zD5FC8H`nuHjaIXww9{i()>@7)wd1V_CnemlM=nJ3PYnb!Q`e$=+Kyiu0IJQzPFWYL
zp9OLd0Ym}nTt+NI4h;X$Z#MVYKz4*-s&9%X0F-uOSb@C!`J7?a8d6h7iXlgn+(N)p
zCEa5w^tagX@0>u+ze6Ve$Pob?1;`CS!z@&!+*1Xy1#!#_pXBNTYq%NS#BnpQ7<ZwY
z+N=H9495e>W*iPr>&@*6lyXAJ{8DbPL#DQ_%XvN(W_^cF3NlFo^NvX1_<?0(9X8z=
zMC={;fo!ffx#y<*CEDa+iARMd60OnM;XxT&T2%jAU$=@q$y#tuzjbR~Pi}^cMMCY+
z`ECaBrzf5l>`>=J^#!Lu{U9MNI*IJNULZm6a3*)!FT4~z{=FRO?vQj_V7}QAqhTvJ
zG^_l8TX8r9<FJ)+f_n4(s)#dJcP4|5Sauv7ds<D0=_G$EBamx89xP3Bf=a8#63|ea
zG=DRSPs+zK_TOlG%cwZ^uG_Z>2@rw=0txOCG`Kf}5IneRf(Hoh9w2C-ad-Dd8<(Js
zyEg9b5`3S^-p~7-bMLul-1pdEw9s^apsKp+zt&vyHy<#?^cGIwLMC+LPT*j`fd1i&
z%N%KE^EbDBK+lWFGh(#*X22--?aP>a6d5lARTbMF!Iw}gQ{z9U34HMP#AThIS{NEA
z;%5sy<7Mes9$$VJG8LRy`3Zve&wA&nK^J@*8NVWC5YSZJ+-TNR{*7#R=Zv+Xk1UNA
z=PiGM5^z77Mn0YdfQ-{03xs0&_=l{dQIg8LTcphNOH&2zh*ow_hG=k610})%ekJ!_
zx_@>;d)8PD5%dRk%wvpcZhF$MW4O|N@qq@Bb$tr0I4&ggo_ED#lIU~DRDXA2p>CL4
zG2gwoPU~nHH>mElJ(^wvHW^P{+q7>_O;+w8sY2(>>#W>5I#=Hv)IrpV7DF;@?n!u|
zg@72db}S1GXhn*j?+S=_CbL+$5^%12A!prgBGS`L@)xLvfp|_<GgXa_Nm6Cp+VSku
z&sOGBs*8IsCSgCKidf}wMT*iP9SMJ>fxkc{^($`Q%_!U<e}Nv0C$h7Zl+_JmRpXL=
zS!l~m`LjE|Llct8iGWX(yN{I1J839Gk(n@FN{Hh77hT&EwtG-f#%44s^tu6bUUx^R
zOrkR^1g?THUCHl3JdpCj7o0kRk#ilnPR-wbNrHuqzeDr}V$k5|uNrQ(VdTp}zW94T
zU87<|<a;@|36?x=gx_UCPT0O3Q6{D}Q6iuqHe4PUphpK2_Md<;d=ZaED4tX-pxBpU
z1Cu|~W!L4UFupDg^x|z`8Fyg0O-ime$rV->duM2hHC7d<PQ5<?#$xkfypVg-jc_ht
zw#B`gdH219Vm0v!Lj=khr8l|Xksl%9=EOGj)#~`;5eySo>g+1FH_bVtS)`{jg49yJ
zQ!{;jGlm1c1CP4kE~9Z4s4^jVZkGxH6l)Jy!%!dLy<ln?dg%c^AbW$5X{N__I398=
zrCJsA9!6F*1~k9!yx$U=FG=S2RrVP85SWn_e{=j?t>**s$htZd#-u0A<2NNHu<?xC
zk=#K`06@FXA+Qt3f2&^JPTS>KZ+eK6QYd)1anBzm^})qSQCHQ9ELsj1Tf$H*8=~LB
zo%u!xe_aYW;(ZOC{*(-);OP&@ep-?*zV7d7ZgScYdBWie;C#-zem6#GUJ$#4u%C}`
zM8s}5Za^|rM&udGAU~gek#>DHG=V#OB>gnKnXFAkv$1R!d7{%Krl|Bnv`BAHpGws?
z(@MD4eigEII6oRS0m;y398M|_E9iJlf$_s2mpUH!{@aa1$F$D&2QST9Br)YfYhD7!
zm>O|7^>}oKl*Cu0n&Q86u2Vq*$&=$3f+gooWU73_SEN80;3$oilG)xUm;Z$`W}t4=
zxxg@1XR>$vo|}2qxWx#=EY1HIK;!GANy?8Iu_3a#(#APQ?$Q1N#b_oM1hZP7MZS7U
zAI5MK@uy91I9A&}7~j1psn*y=BS(p|O~t+Hb9*U<w;=(*DYPQqqew#&q)wU!YV}0J
zzPg<y9D57L@ie67$Cqx!^Ew#@58{~w0~?g9|Du<&0!P*e^z*B(kcAsu-s2GnC%Bi+
zUg%FywhEU*ba}0~e?cdz&9^Je6;<OV{Xk6cQ|eb=L_C|D$b*f0XWQvh==&-ZT2#Tr
zCkm^h>cs5M%w5&5{&b!jwzXKOKJK$*f8BF$o*CF&k;HPSA&I#J@AHH*q0CRE4%HrY
z0NhcE|7dsruRKE6SK*!E8a>H=taBF+?AdPK%e2)sRyBu+pa9dwdD|7<d~BT)k5$qh
z7;S#tnx$(`0F@wZY1lqXj|Q-D8J=m-0}Y<9D<!5apW);$xv+zX#A{PbqZXHRigh~k
zyG4fZEK2;TNxLP+*&}6*od~J()1FzoCsU7guFSlHmFN0!^kliL9{=!0VMo9Ta45f8
zh4oi24a6yTrE6}+R)P-o{XytA5o>S4o!$}eoBmc5)@ydt(GmZai{^o?&PQl{eE>q{
z>`JGY5|S;d&4TKK7w6um%sxZU$y5V9Bb5h{M7zgmsc~EK-&Kwgu2n+n8ZfCEft8ac
ziKsaK_)apijr8%PRgXILjL4x+(DtqzQ?ha%BXo>%v_>Lhpt0e`@F_=+h9JDH?i^Yb
zA3DbL)kC$gC)Nswfn7Fq?*fzXi>RA7=nF3+?@5HpG4Sc|Q7)4@B@gc>RpI?*zeM-E
z08EJ4{_VhLcE5$VTJn?(mBT~XHB6K8)J|)ec?Mv-?BOvkM0F|teHTzJM`wOeRsmuI
zLbZC;kZEGRKjYBGNu-K5#DCvMvx20nUtP?TxmTP=`N0|LewUo0I~Bf9@P*dO_x6o&
z!TkJv_`4wQ=abD2&=;gaZt7#JQ0Stx)T`ww2%6fF7l=l_%Cl0aRG&dB_d+NBk<e3k
z($lG!Ad6#ew-9R5_LXp59pves$?EcMAktR)@UwzzPFEvu2Y~L-gxiiQT)E;-_s_WE
zF2pMGQ+&brQf-6`eopx*Apx-8WgxvLkmnj;sgxuzG0%7TmTJvN7{a`P@df1<$goxZ
z^f(NrKxFyOt!RX@PSU4J2N!+5XHZJ%I}+b7W(oPRbbrzz_;Y|TpN_6TC~S6;BiK!J
zcpL(|8!}Qg{u{Cf`+q?8wyFxVo44j&%yOe;{wS<s|E#c~DIExk`WJ4_Q7sKmsc;?Y
zar#Kv+X+PCbSbuOlpI&~gjLP26{J1*<hnaJ7W#PtMi%w?s3$XaCz64I^**kBiS(6#
zs6fq(RkApR&SYzLH$IApOADV1#<Dd`*+Y&LS1C5iKI-dm_X@wzKm5Gh2I@)$wN}gh
z=xr+Y4hHZuWnj^0T$ZUM&dLxb!(b=-{&^^{rUG%#DG@IE6^BL3gYdVBj&dFfyiK21
z;yY7-ZJ+ZC-%pSHytJb`6kfP5o=seNY3BzLhL_hv)tm3ttj&6Bg%18a`2C5`3j_Yy
z|4k&sfB$(VG08R_4RU^?7q$}X0e$2=!hY2|nT37bi=?*|CK$Q+)D(~(%G20EPME*6
zKWWz8SJS7nkJlBC0oyIr+7Fmhp7<wJs5<{sEh4=1IIU6!Vz-0FtsiP6TwXQR`IfSA
zI@P@pzEqBWQV=q*TLEW!Jfol%x`d0}XeeL@O9%tk2K~^S;n)O~P}R~AB`ZavV>Q`u
zRgkyE`PL~KeEGp5U?w;g`TVhFnlMB~P)<w}M4nu~Xrlw-9lD(nEOhnF?foEqRcgwq
z*J?~p7B?r0X*E#urJOqPI?wgDyDH5?yFL3~AWxWEoYP+*oa4Dm@rfAw?r%tT6Al%_
z?&seng!3EFPfy3?tCe=M;K~-(JHVFSpom^Fw<>^mxREhrf7zvCSC>Gg@Z*0<c6t04
z2*Xq5FVJ)A<mm+ckM6KkyB?QCYv39e#Jm@N{u=#z>kH#(*WJ&;YT?3XKoWIrOLa^?
zkVI`7a)LFZjGjt{g+^+r&8^4(Inx3L*{*l>7q@)FIqx^!_4w8cyROAx1~5CmnR6YG
z4MiMjCUpHI_R5|gn5~m(I~x~SU95{&f`q;QRXXzW>yY7=rLFc{gnS-$!FbD8z@9~x
zPmEh!0v;4#u#;efR5GDIl2fht{#Kx>v&hdwN?+b2blOnsP&ZY}8Y0Ee9X~3pmQCKN
z+%Af?&RhH^wX2U;sqqi%p?z4oF~*6LD=8Z=LN$g>a7rgLv)bL{(gCA_6P2t+eSgLR
zleN==?aAc0U|ayqe0HeUj%%qVOS%Z3A*O_&Bsoqwy-2xOg^`^oM1@KviqTjGGY1EU
z(O6qmCJ8sG)DR7*Rv1}?C8a2%&E;puWZ8RcQR(7)#zInx2eZZ(IF6~^bk8A4k4_&N
zUbM*U?cFc-QNHrQ5_o%oJYG|CXqoF$K<eX;y7QiV`?5T(ELhEgpJcc=hWBf3c)U19
zSZP6)N~HPZPmF(bTNY&80$4-xwA_hQ@8ap`gSeRNC#>>Mr%#oCKu+B39hdLv_je_-
zGR5p$t$s3pbAzkd6y(__mLR+f91P!woRhoGN187;ki<{Zym5}vmN800uQQtcQ-Z`n
z^NdO)H{>(<{{qF^EbsXAl^)7=Li2Jf1ry5Sfn_1r;jD!h;fRvFqp=}0Pt)n?mvLq0
zBDaG1#iDaXR2tGfkj-$z{sWPRRX)o^(aM3o=&gp9_@~U=k3~gfKH^R@x8RoPE2Yg(
za9X%Xfy~zNH&$jK$0r{z6$O=I8rMH$gwdK-yP;rDLme~4O-gqoYg0jfIY=KS9~z68
z!cCFiIpSKz(O!(MUPFAk&zfhHyqhJsx3q4qf;lcapAA?XpJx#e)A0XV&pP~d>!G11
zq#&IZd#Xq0GG(JMY5k36(T4IxYOGL+m$;FpMXgI0^DAt&@6NoK6MWlHaPg&6etO~l
zxU8HKV%D-&JIq`BjOJTsT+B0qyH^huF90%QGY4@RojOFcH$tTMFOZmSxTU%F;ndG(
z&YYqXMr0XcpZX^3rcq$f#*==lOV>~Ge9I6KoCk5btkpY@!sbK%IKtL1oUsNEOcKOt
zg8FsOsfv7Vwze?}5LH{_mzbo@4+1Je6dOH~BEiSkin^BcM<WiYEj7u*M))20);XgQ
zN^1MnwNs^+G?tdv(+tn&D{slO4lDwTRtw&bYqC4-Z&q%ffOm=bE+u(GWum2)7zk;U
zp#^|A%MgoW0Gth&pK81w)dkT9^0TMfDB5MnYyrX#7rRicJy(<4S)%9cvH!xIVPiiN
z!$jC`Dqxg-gu@Bg)#z2JFD1~p5Err!0*D(sI|7z4R1&s(AF?#2sL2|p67Z4#u&>10
zemhwM;gH>A&f7g0U$J5=w|25NeOP(TCHvx0%TEHu<3N>+<1f*|t+U<kuYW@4_TEbu
zEUcLjGNe_#`*eD}P95QXs_ke!)>}@@ArRT$Z!1cQ#;tnF5g4KB=2W4&XGuzUA!f;I
zg__We{BXiHm3pA}lbtrCkG=?s+}X<G!`V08AKTvDQ9yC#{Y8WoAm}XhpDo=Yai{ii
zNj9dgtn&#6MYV4=?M{YGt+}ZcPUatSsK`Z4^UZCTd{mU>Bmtq?TM~ahWr0A3Ud1Qx
zVB9dwQ-{Md5088Kp!#Z4u!hff^5#|t(##c1Z~5pc<x%;5-F1qTF-%F%SqxRo62X>2
zduOMbwJR3-tn##B7sU-6)YhWE+KC;aVn$@(5i;o)rHIAB84mjns%?u`lRm78Brau4
zvQo_JUk`K6Mr+qN6hy)mwD=k<Id@Lxyadp%nutlvai50ZzjRb1Kt9RK%T8J}0A}uK
zpHwI*1TxS?(nt+&10gb2oSmZY6O;_Tb8Z&xUW%;Vj2RTxI$XVe^Je^@?t|S_gy<#r
z#N1bBcTYMi(e<bxnl`kyAoq8d^Lk*+)(oPicO)2pJVAgV2VhMfo1C*6vwC2C_j*Q*
zEtS$(5R%j?2X=<?M+J#|hgxWu8=KSoZR^;I!FQ0Kuy%URGcOq_&}5r)nqzOmTAHOp
zB=7Iw6J%@PFX9&XoUF6OvC%ugB%eORae%sTb7NIw2KnA1ux!oOpDelg;#}8<5->Ks
zKKin?nTv@RBsWUAB&A^xK4^dVH@b+w>^fUZ=?4ajRb`+l#jA9IE2xJ0j6tX*r_9V7
zRDRHQx_df6fw?V-ZkdFZBWdLca;E(R@?L=eyV(7=J7M!-yi;i-fz3JvyWUI{mM}Li
zAU;RZiNX*R7Wo3>i6&M(a;n`7_d#0?z2CvHCmJFyAW`;^8Y`dRCufH|sXVr5+Ga2x
zVv$46v*fdu_pmo(!sip6S^WXx#a*oUz1JMMI)`LRMxz;VGZ0&Uq15EgA+;8UOQB}R
zZ6_^oM9fzJrwkY(J6Z)=G+D?n8Bd40Q>+w!ynIo7xbn<UVky(=^63e8H($MU_k{q%
zkUXPoA>eGH4fv0)^#AmuhS<so>b@|0n};6O%+OhFQoi$Z5=J<vn!IbpBp4O6G9g`O
ztZKM%V+b9ze8E&EaU`fGjPNK);;bT|W<B(c2_Q*F5()64K51Hk<wsIY-fLDYFE{II
z3ZMoqLL8b3qbecuqQktNr2=i}*OHwgFD?i#pBsOS=L0oQ77T9_4&yo0yry`nFONss
zg{;qhYPoiJ3{<c+<yi7pi0A5o(oYVfPjES;sTqR^UbIuBEjmNG<?-Hd%Y8PQ3`f`G
zJD-`>!<oO=x*o8}m$?1xe`M6qW~^={@miYd`w^<erj{|SJ+?tqA3yTeUC3rbeY{7K
zzWJu%nKbolGedi6`e^B6r7_(p#{QfpK0AV>HCi{Xc5ys)Gd`6ltwlAwYW80s;~05A
zLRLDdtPf}Gzn(OKv85pW1e?ih*1i1v!wXmBL6_Tj;|(nsLM31xiZL#Hm~nj*<rXrf
zAmwAh{oV8~UX41S)&L+8zOybXM!!LPQJNFbu>yoQ9>`7sND?4>%kuGyCM!B52lu{h
z>@}kf4{Y}us9x}e6(g7j+09$c1X<_;@J5(eA_hK_(=9W76S!^oeRWj`8`8TZbk0|v
z^WM9?OYYBV4JH6u460}{4CZK=Pa5=mw9Z|0wCav-h5WBug8qyV{{50Rg7>KL-!GM~
zzQf$}W}03dulXu8A0ljOx=JNFwQ!{rb@QD=3dPB~_w3XaW=7B=P;rtFc=-;0Khj*A
zi_EGkwVL-iE*5mVD(o>6BO2-Ub{yVG{-PO3JECpLYi9R6YoZ!)-6?H%VJF@Y5uO_H
z1fk-S2MF;4f^<OZ%e0MjzU=Uib%-CGn4DOs$Ux?rD&f9wJWWP&EAzcX%jr@f{?m8_
zZPP0&3k8~sa~k-w-or7`Un8_l;}G08KCgt`<ux1Z;ZoV<UFE?784zwQ+GN=jJtp=<
z$K{$gp*(8TE=XeR%-eQ^NR_GRYdhJ^H`0CQ;E@mPiZXwPYDEJz2H+H8Jc=pkE7C`!
zqI6vt^a=3ty8Uy^a{+1bHl4|`7QCXHVpmcl!wz8?M-lsn*BV9FE>aM0PZ(sHv!i&0
z{eqyl5i2sfq7EjCS>s0YM1EA>mNQ0AxWql#B)i)hPeuaY2N<=S%#&7D-*dMuI7nbz
zC|P4s7*Mf9elmy_d5bNxWj-idX-ZScPxG5geVRASP3=cF0dV>j{TK6qt<(o+Zy+Cm
z7Xn9YkW=*73RXVY9bZq~0aMQ`$sU0S|4dTNTWt4p55P%v^xrtC8Y=NylB*U|>ywv;
zw5)q+oTDY&2-9Zc|4jSsN#~D=y9LGnR|)Aqq@@3IkBpV-7`cI{6p-x3hc}9EYFG7w
z5HCGD33@N_;giz|90>WUj#&f1qBJ@o-&138$NxENNl6i*+wJmX;Dw2T^~x<#3cguk
z>C~w5m^k~Nvs_=9nWdXpxo{3&FBH;mQ<J~%mO@<|(+ky4g^bl38<q;Zw6!e9{250|
z)JSD(uPw+4Jv+iag)z?cZf`St!+u(oFLmVdCcIt2W_S12e6X|;n-QL&7PpPeZELT2
z31m=CxA3j+2ybIbt;P4f&YXBCi9L<@X~oP!Q$3z5`?Dx#&DHoB6)Huf>b5H!xmNT_
zVCk*SCh`4m%MW%nU#x@y#+{pfLmn}|(14@EH%Xe*Lz;B3-FSl?e~fugbY0Sq6PT{s
z*6~JI5sjO%8?Cb&$$#A&u3djbu0OZe%<rsg_Un&o?vf6zbB6meBXgh<SOoTbG~V17
zyuSB(=Ibf+ftur(_IMwYpVNq4omV8pb0fL+HyES8e`@arALa%JEL^>r{vB^m0JYlC
z%8qo>P>FQApirN*6tL;lE*K&mu{%Wxn`SnvdsY^5uXsyt<K7KzYA0i_Ic<pwJwAwE
zq9ij*G9&m>$Nn8V@%w4&tJtR*krf0hrvDUgI)2lGK6qER8YP59OgYn?hH7eN4FDoZ
zn{l`rSslhEyY=q2P9&<BxTGYRJDCn58fOg~Skh@J?Iy9ir=Qdi=hxFpH)Twy_8c(f
z<uc74VztyEN&OFp7CArN*CEM&99q`7EWlXZ*NO)CQ7&D|5bK0|*Eteb><RFLQX0&_
zO_e8Aq|B&76hid(6V>8aqPJ1Ss{OH-GI7fOYB-^B9C`f8d8+xA1i>XLRO7{}#r2uf
z>^K_u-PaSE=ebq_*q3${92GXr%Zuw3$LZ^c+IzV&x|DCHAN~UELNhbxBa!$PcV{2@
z*73Kk52>r0fawQjd1+zTrYS+nI}_CXM+t(^c->&YIi=6uqhRjDQku1D&%fbpQwa6z
z)C#r7wWaiQqTdAk&RcJb!;%>}?F9Roq9!gGN*~oad+g3Cg}lH_xs{U?ErJFt&6wRX
zXDD_T7iBqI!@)yRb%5w;G4Kkn=Fg#_yq4I7U!A`ngE)ZLEOqd0A0r)Dl7$+YgNMhW
zJ9UC=Z<1VlSK}+3Sa8=SJfk9bkcL+$vF)^?dQbUWXG^etkPz)S9^<6rKG=(FXGd%S
zaf}=G^#=})8YUjOb9)TiIu()zodsf-_=C&4GdwJJ7dIXPX9cI(-96H=yH!+D0W@k(
zU@;7Tg>1ht!G~uiQ5!I)uyoHVz7cN^Z?zGHr?qEzNrc3sp~uB92BfUl7zB{vn2X+l
zRdF;|9BFu0d@@XyilYG4sb;Wp{pfE+A?Xi^n~jem?4@N|H{2mz$!@_>Sx6Z*WRAqq
zgpc~P?18syLX=3{g*-I}+4UO__(5S)_YhyP=&dKS?Vr1gd7VPm7^mhwieL2ReT2JF
z^QT26gJn=USgf=SwZwX3dMkX=14wRhO(zu9IidW*K`P3)Z~>?Bx!tcyr<9fc>O9fa
zqb)0zD`EU6SgL@+-w)GKTO%YdIQY0dPGmdtu5(Xth9?YK+$+X}0T|KnVB<D#i&*53
zwmKDND9%?6ws3r@oKQzY``;CR71@_WSfPqVf4DfFztIq}bl}cyHK_?F2BsV*chl)Y
z)ihzxa2i(X$r)}TlZ1H!K3Ih@&MD>MHLIq`VJmz<!$wme-QVHs;HbY4by`0^xso1A
zPNtZx_e6p8hP)fGLcb4dMu4)vdh-O`op3oZ+X!xi!v6g(QBSUgdukp5bof}NVk+mn
zbVJqCYv-2ycYuQcB*npi@>SMcDib8={#KEf81HLd4jwKoo|4QjV+(go7@|D7$cjS5
z?Uf(@I>>jq%)T)&!O3uFTSA)+>HH;b>fKD{I7gtmI;aHWr8~~9ru+|+qHr0U_!5Uf
zOG~k;DZ-GN<h5aXq~!O5zVL5G$1YGmQj`v+7`CvAo~PC>Z-2Kx!iqwN)5(U<OxZh@
z*Eug1=@9Lz*{F$FCI-V^Edp01*Lm5Ec*^RM%AuiE#NsS?J+yf0fl0Xwd#LQJv%Xsr
zE8b)^zSP2Xjw4tLx^W)m3mt$@<Le{&x(=J>ZX=1l;}Mbk@O{k0Q7C*$NF3ascqr<}
zIaPg5ev;j-#WLgubv#6&55*tsGW)U_k*{E}1p^!ID+=n>0zu?LqbuIRFwqc0SzKv=
z=oI-x3J^HIE7|ed{f#?GGW31XyNIWL6t|l4GYq`-<>y^nk5A|Qsm_F+c_W^%_A@Ou
z;g5u-K%m9tPUQ&W&#!xfi%cDRZOxPNTO&AG>!;k7N;8Md)L*|%8OM1m7PI~QgW}fU
zgt~@W2B&RB>L3a?RZqNIVO@LaR8(@w-qUi;z5VV{vmPEmxw553{nU&m9!B1~%YEqM
zaFZO+qeG~faQp7tdYN6q?d8<4I`x(7!^``{roTXeOswWa=K9iDdb8CeMl=&l5U12y
z_B8biZ9qI>qNad0tty0Qba)F+a0`ZzGS?+q*H$BK@*!kF&%fjb&HG3Dw_@6JsY%GQ
zNITLgDa*erx_Z;2fW{kf|Hj&ppM|c)w|g-+$oy57N~{)V00w&M1+4}jNkoL@?($qp
z_w?^2QX34pv(M&tTR)!iMWc8|>(FmuZIGqn_t@HPijX#wzxmPpwWpni$T>TIk8<;=
zRAS{aE>8Q4c90QLEV;^jXlT(hZ4u6&FX-j1!&)U%fdc23OTfP_jDIeU|LGfk(P|s^
zUOMgMjKb)_($PVYSLlZTrO9gCClG%ch!m+*d5$-+C(U>>J!yHckfcajkxmyYA^mKm
z7SCu`x|Hb$;_cz3l_yAL=3{YkwF0)++HuQGbq?RJT}~ubr}eDw)$54lf`;2nnW_#G
zZ8=KoMN=PEW9sq=xZQt;cq*(a1h`XF!Rq{o{of?n6zH&$*|YhkRoJCsG@Uu8T2tfq
z-OF4rn-tI>eEbJpX2MFtJ$<I$&%t}qx`O;f@7f&iJE>Y7CvD6oVJ}Md;s2uFWVs09
z0$HM1(kpg4jgi?6=6iQ(Rpqj14R0-3OLv8Q)`yIGl4GluM`(D6J4L@llQS|KGr%Q0
zIZb*;=rezj#Nlbs<Zc{|usXypbEVA!jlvN0hWy<bqOd%cNdxcmI`q~g;Y*v3V|i^(
z(Q3vu+pK6$A4JGEEUT+)A>#->N>oD(jMSJti&$$Hg9_{N78ab(pC-OctiB)$Od#jV
z^&EOcMnK2M)#Jgg?V{RDqKuZZTF@;Voh+AqxWS%<7q3F{qaBIZ3&4Pi&IF8#iJe^f
zf{x?bjtfLa)o8uo1}rS!E|}Q4`&8IhS~(ncV1xTav5jGODVrhQYwjKy?mv~<G88ig
z>!~46AU`jPYk0>%v9WufRAYd)RaBCaEI)dtakMQc^TS$$!b?kG=Y1WXhZ)I8pEng(
zk3RAxYowOLi<YL#jXP)9Ygc5;BfHaeKbm=qT+4NWWX3Yjt!ZwOQhtP>YB<bENN$1p
zC<vzI|GN^%_WxZ1MGPWEzZcPSRq0Gd?N~;WKT{x4>haS#{9q866ol*>6PC(|artWi
zS9(<e>)L14<_En?8dWGa?y|)z46Z>w5{y*iRYfx>ie|L8#dYN=*>AXe;zw*N007T3
zoqMLB!12je7qW;)f|Xn6X+%QfmRFi|J|0_XzX^#FJvCbcA44wR2h-G!vCO7eD!b7a
zB+>D)N?M0vp}4X90@nHGDJfg=+gWIDSv3!U6~FX9r3F4q^PimNUjZ8q0ZL2Z?M%^{
zT0>s;6*^G8#+Wh5qO0;xqmCxwMzHD-p`jcP-|*Q->Y16#wPIHzF&?{M!@)Y0FAb!8
z2jD;j?w!}C;@P`{!!Eq)U|w=j{WNspA-yAaE^`lBms57r_<8Y4bbn^=z26RdmQm>%
z>8A1O%m?<;MK;H@EvbEgGU(*-w)k>1Y6@-Ms{<JL(gcpoUw`x;255iq@BzN+pM6@O
zLAmzuh22XSGc1wJ(uvY{c<cfW_K_LR6PM>Tb+TZz+cLEYaZ;aT9h9=Od4;b?Oxa7n
zb>B9^9WIW)Aun%}lrFTfb(8qNjDz`~IQ<X_@MKPNeuuO1BefqMF#)AeR;*vHG0te{
zIbvayTNH~0s`vUORu6TgG>O?nxpwYwGuZmGvkoa3Sml*oJk84vMZv4jj`s}!#ZmYH
z{Y~I^r(5oO?YN@arcSvqHk);_><Xtv@`ErjiukD!;y}9ti!kdkf#z>&lN&gQrWY?t
zybOCg`B2^qJAr+c@O5^KXQ&%zPs1(cJO~Hg4mD*&1=(CF+-y}_PQr$0=3fUo;m-Gs
z1+V-C@+}vfDkbXJDHt>q${||^hEug<c=*`y_`%l)N<gxbyyCy~_b0<?K5qH?k}mm+
z3tEft$QYeoBd1=9Ro|z^xWYeX#+I>#WNl87r5hkp(WK5})UP_m>E4Ozaut4mf~6X-
z$j19lgokM>G#cS%1*J+yXi=uqVUt8v{#$v15e>(jy^<6Dx-;T*iWPk88P3co*J>-e
zPk13b6{1)0{oc)Jee1Qr52e}btbuP3JR7RR57oE=2VaUE>Q^pNQ(0X?YTi^wOCPQ?
zet$fp;um`)?{E1kC#Uz#-Bnk+<Y+(wVqda^$Xn1M_v2STV(iAZlvA32Tg1c}U0>@;
z%RtdiUM5*HqvrB0f&I`MZD%Pi$id=7N-c;q!bndsgSTiyqodJ!-w-k(F`>?*R8_-&
zBXcK5%sAYy7>i1&Ny|s8`CJCq_w41<f~Q3tDjkZ-z91P_nM7J4+GmB4#j1ab6R@)1
zBw8G!noN{(u4?|*YzaU@0{%dihZ0JS54`LSWtb$Qp&%$7a?$)L7046K6EBU0%VrnJ
z9+OJqly8Zc6wqaDz;ssRva8?&oV@Sh<=#`<8VMYFi?Vj?gVF3phX>#wne)@cZfSe5
zwfitj^^I}CpDs?|jUJsMeJyNf{$InkU{rcv!29PaS9>&!a$FC5{r)EMGpL1Dn9#8C
zKXt;3RYd8@DC>LT=7K)K>T0;mM*0XFn;#(^{Gdr9fGgp(|D&Ljsgv;^s-${U;q+Ez
z@$|Nv1QWL03{Gs>Df%zl6*BKkm$Ldrn)jzwjp+gMqGjteSG-}dwWQ*B03jwj)Ce7D
zS%VbJ+`y?>E0N`e2j1C$8_9m@5JMxhvSA%H&OkQ}?}+~CaE{W+8J{_Gisj`Qz%&Dw
zq}12NBjjRwfS4R{-3ge-PwMZUy^X*$-|ns+Y0DI(@=XFDp&W@Uk&8Xz{iZt-Of?}W
zTa@fP`}G3xiUSzA3%Z`BW>6M;f_7l8Su-&!Q{a(5ukXO@>T_Ix2`EpyOVG7YA_ZG>
zFkz2{`=={@pUX%L?-LB8JwbIRcUof$B9b>K(uSrG)4u&Umeh^krSy`epMaaZOlYNx
z890S;K|-;jcjKiGj@mv-sRPVvpwTqXuAo1kfw+G$Awr04T|^A7eZUoNzpP~Q&OFf5
z%!tJQ0(=cc51mdk7aK*SnX6oY<wI95+FmYdSLF>5u8asa*n%T`;1e*XWbYhH@1)w;
z*F7?11dfN-fJtSvjPSr^qKqhoSlhJ3so>Ryun|2S&j$Gk6gr|_F}3=7hViu|@h6+n
z45LRm+e!7DIBpjAG?OKN2a|UQE^|#1&t9F3&dPi9Z<oCrrm!hP94U@cO%sJm(h^SD
zQ_QJ!T%YC6$FZBBQ2-?3Xl&j}0rc<_!X9Q6&NJ*p8FP2<wR4!1PBv8Dr4<N3B|f~0
zv&n**ZY^1w3pE8Jc=rQIOY-93Dr3(*Uf+qAE7uPT=iG+YS@{&~Gi>Vilu(cZ+Vz!+
z)EwW4s-0@w=$<!8GH6_zH`PBa@dnsg$WL+upW@7p%7zDy$%e{21ukn$AZ6u=9Eqq7
zi9Z=6$TZ_GFp5eKO`8+Ntpk?JN8JHPxhL0A3CkV9OnJP(`odMo@8lLpY`R?P*CT8O
za*&stAf{vqW#uT#xAiwfVWHh_l=b3Q!Z5O;HSsV4$4%5Qw;#5`eiiRvFH*LKx^kiR
zc(yqw#WnuP^H}L_*0dZ7)Pm`G;gag5rPema&#hkZ9|37P+|#?QWUxvx?sFO_|A6h!
zN0D$QLiudSHh<nug3G3sA{<GmcRkDl>vFQ)B!5RSgwFU}WIH#t@)jEoQ<)Ny!*4a1
zh%#pS<?tJI)CKxV=k$prbxH%mGO_{Z{2E(S8b+!WvlZQ3BdJs3nyl5_TN)JiMuGD>
zqW%Jks&<OU*2GM{`--f*i7BJpdwE^=DyKy6^Y^L>sZ+m@$b$WSt;+!+F`wsQCA7IX
z;KhaCHmzIgk&vVvVgJm+x7iITt=obwQ~xZ$)gKd9`wA$J9WXw6jr|_E_7*xFFJ`lM
z7MH-X?(GcajqCUrcI3_&7Nf_K5YQg3eP)WGk+_b$DWdOiqkb74`&u#haP%Dk%e~x@
zf_t@|ZD(F7OpswUdRjZR&A(aPV?~5eybw_oJ6|oy%sfOig0oTtFUR1FL{sq(z0Fyx
z`*G;$w2~CvXLV$=9&t!y)%C3`{uiId(<fC(VcRy03y1h;zkeP~9jYIy-b6))IrL1V
zFDr`(T(!*wbt~!Z@RAYM#|>@9fV&$BetoX4Bt!~QrZJRvyXgU3|FJBD0vvPc!bai~
z(Iuoa8=gbr?#qXSs|*)DgtBF#HsSA7J8z<T@Nqp2MpquT=G$m6j=q_hb8p0TDr2Rl
zYPAT2=Bh>lD~o6U`C>(VJHV5n>>9e}%7rN`Tjwj*E5^u(Ji*+Bkq$JG{ddfPAWRa&
zjYE8AgP9`Fch};Dt~JDmdQh%1+7DdTqmO4hxCI-i1bRO*IG>skU=D+AR=3;B$U8Y_
zE!<-x3N6{_)(HG<NE&*L^)jPdkc?)we)09ZiSQPjoAXL0f0j!W7POVTw#V?Ao8-H%
zw>rx*7<4%@Fhzvpw^jToS%5+Ew%k0#`Al%X?OI$I|JvXfx6kqJwGX}H%bI8fR??{#
zsnNFN#Pi7c@5|F#DepC=?{)X_+mdp3_aX@EYU@1*p~ZwI6yMkVeQUn3lUzcHH7Adq
z(&X0_r&wtkn(M93WVYi)Mv=aQRzRQ?HG$B?pm)v!)FcuDYHw)XFna)%p6)i9lDKAd
zb$v^WNvRwqsokiTg6Oz!53771{(jNuy^sTGPbP{$DUG+zA7)({3-QMw`FW-cj&17~
z&Y$(#21Ew9%e5uIBRZJAo4<>XXDy1epNXRv|Lvj~A4Q@8aVS_+k5?e3#%j!+P_S+w
z^LLMJGHuyAWM8$81F5O0gn!(=QrRaud!J!8;T(-JzGB-_Ap*}+R-Xz^{|ls4J65KS
z7*fk4Z%<D@Jk|{#JkuRM8|+R4h=)CfgIXa#qY%8yF5UD!Hnv9jWvr6Y2$$`Lv%z+1
zrD!=So!a%ZIMwRNViak55c)dzp+UJOFery8`qzY8pk;D%!g!5cT5W$9>$t=zoc^qL
zJ#_xs?c}%iY4-||r@nj&Nw#3hE_)SoSSp6!A*6H4UX^4rkD*mFU6_*~*<6ry^Bu?)
zXk_**QOYsNeO;r(n2@7fd)p4G6^MxkAuRx<u-E5R5v)Hky_AA|LU!Ur&uw7O1BpyY
zuu$YVYzsMOkeQ`<SPW0#9mi<hc-8QN-6%fw<oEj0n>K5L5_-d&zgFJ8FM;=e#`Sb6
zbUoJ$J-dB-m{}(QSwheo7UqTY^|jlh`~AW=)JI`z9PN-e)*?f8=<Xkoq83|&cX=$6
z?)kn1*M?Yk&1=W>fra|m+X1qWqOCym0w$hD27g1VxwZRCKfg@~Ak3-8{-amOhZ9Mv
zhHIq-qXUs!-~bR>=}}>*R^keXL;3>xyW^3ZCx9kSXkdHg?Y1cZ&Qf{&L`E=5G&R1p
zOMK`?`I6^7DrE8Y_wl}dTK4WhLC3^G9Bx#!!bfuL3$_b>uU%`G(VT-Bq2D_qpQ?V!
zz}yOKX{fiqoqz)zlGE-JCXT$RKiB7E;?tEEf$!@HHQyYSmp7E&9!MR8xwrhQcp(6!
zC0!+8B2HIH73TE;%rR6D`+D2r?IYdAh;?j=lExQAXwzHQ0`<p{+B1W#H4}=Lv$F!$
zmm>ueh<bWw7c*y|Jkm^!_Og&22x@AKU;Erf{hGoIdDg6AS8*ol?`UHo_bENC&%pd0
zepE29Ui&wY|Nr81q{(X^Rm+$wkC>$Q{S87D7s8iy`mUu){tS%2Hh?%qDE#AO{1v`5
z@dK?WGtUZ6dTUy@wpmtS`OuN9gM2&?$_nr^v{C37zGnLdNZWA5pZ@`Ct3--RiX$1p
zDjNN@D_yq~5-|jB$+|Si%fGI^KrB+Sv-gXfQQS@(9GO(7nfO+8o>7m^=;6gTZic86
z7)&{wQ(oeK#)*kwz2oeJF+KmrD%9Yn($BZkd4E;xw3~bsQSDT=W-YNv;={gUIdUoZ
z?{|=}0ampV1_^jZaOa(fyCB|9c4$oOpQ`iEEqdvnszf8uHBrc3qFalA1aO$Y^q2t_
zJXpe%yXnjo6E&EQu=0>6H!qi@2VIOoF9l<o2CXG2HXvA<ES|gKmNGR(g4wjha|Nam
zIn5fYNry*7QeTW?Q=2vSA4j1=e$N5y+vK&wsh$&0&1ka|N3dUT8O+djXKsCjX2p+<
z_cY9;I=ZvuH0TFi;O3%+F`SRWGx`DBNFOE;RapLNtYh6Rqq-!A5B*zk6{QBD3L<^4
zcN3se0qt}gX>Hw$G6%-B?i~II=C;D(CMNI9_(d9;bqtTtC46_O^`Za;O+w<g&o%TH
zV+wmO@rL56%n$4vt-kiJGJH_`9=j6T841Nr#VvTQ@cdIAE-3aSjtwYYUMNvMS5PgA
zV_1F5@IC~nS&E)aRElN?kH)UB%WAqugw))L8<1ptjdj#)Am#ksXtbM=_i^t-a`U2Z
zpSWI1T<`uPgSZw;&2kb%DSro*R0XxXt<HTLCTD%8+&{uP8*yJ1v8li4<wm&8oun^8
z&2Fz-Q=>O5llXHN=UkTNjF2vBBl6OWCgvKjpf=YY+5dlDa5Zb1)5j(|sX<uIW}6~P
zYCBniPn-n~MKt^l4r~@>AEp6v5!pkDO!H$+&4a#&Xl0wno8Oved<P!trzQ72r)A@k
zda`Oj2CK)YXFTPvJ_!N}wf;G-D}h(7g#bA>pDjB~dGv{4>T{JyDdB8@UyD?izkmMz
zi5@bCkB10wU=htGBRaKy4oWDmUrz**e|~JSi(`H@U_*DU7u9G?<U-k5%(^EaJ`}|g
z!Nb}#=?JjPQ}l$>*6_bnE<vYvx88|ek`{X$;vz1e)`nF!Y%}%41fRrcOKq6jsoQ)j
zsE*9tk<4)x5mVdM9Q_s?O{s;Wr=VsK>4Uy~`3^gfP8Rn~#N{W20z)rgC|h8sFz+pc
z^{33dhHZO^Q+{cjD7cz|9|LSzUt7!#M|zZ(;EzhvFeEFQOwVFWq*=S+C$SnaAQIpp
z9|M7N?bPqV*cncxPNm4`jqS!_S0Z|n#ElIdZ+Sz6YH%!Q6EU7eY0xj!iOBnNPwEVj
zb}=xslJOE^2+ky`{UmNEwN|%uMy&f`OOOR28qL>q9peksgk&MnlNXJS)_^pX76t!M
z@Ki%2&lR%dTIt#M^zJ(WswMJrEBms@W7*!}kIAXAc|wMgoPzOt#b2fFets=NQ~TGD
z%RG;q*}bu{?xr86B+>+{t=aV!l_nl`CUke^gkVXdOZ<;A37R`Lw9^IIagZ}k?(9@l
zk`=Sc$3SQ^k#!SJ6dN6UiG=SKa$&wi1#9_C_kc@Bjq37tIYR+{p1*u;_bKD+_$Hea
z|BG}1XK>r?MG(=DN3|rlXs1q{(3#9wWLbV$2~o{d2Ae)&p*`ac)<Rn!eDNR{VW+JB
zHQxOPl?RIET*EW(T|nv~Ix8rZ7sQJzO~$-wIwNAqAv}M6V|V$OX6Za5T`|6LUarj>
zX&mpJ@m>(vVNbIM<=%-lG*fPpeH1R`7ZKH&n{XtsYfm9rM*(cHNLua%A+(VPl_)ev
z2f{`d7f`pv|A4N3B^{rgoV*+;S?n#_=<xAXpx^VDRzr^Q)k&5Ng1&Pe5H|RpzK+p3
z>!TgRFU_L$6Hi%=3Xaa%<fukS*JwrEvFSHZn2J0SU69fB7f4k50AUk!I1JJd`a;q)
z!wz+g)(KufeO;T_Y4Ux<T48-WeLk^4#s@2S#|HKjla8Ef3TM$3r^goQH+RoI;(Rbr
z=cdaR`7CpI)H`j+ULYd`L<a_o**(I7&d3u!_ct_bMY|<yr8bAzOG7OZf7C$oS#ufg
z1**-|PM_8hLPi|f?am$TJ<hO^??uqNoXre}W!V91Wwd$C-<|AXH@Ut=;0&NF1uPV6
zs_UEW<HxvuIKf3P!KgCkpFeVyXERMbaLP1Hx+Fd+ey3soexzW!kwvgG{=~|odb@AN
z<|Asv$mxBFd!s>+jTWiu$<RKvpu*T8bCexX-`jQ$zP{cgun78CcIdv6lDed>VRk7n
z1)hm(iy~)jj(A!X=h3+dpZOvJOkATIS+NX$tg$?t-X)9~R4&aKJ#jnKFFTQ4g`{PQ
zqO^IuZJCzk4~R-qo|7_W3cDXvgGl$180D`Ij<^}+N>GUtx7DX+6mj>tPIMs_mjj>|
zJFLwu9Fo}FRXqjveg(%bHNO<6qmh2qt@J$8sN7yJ9Kn$vow$$q_>j|Vl=&CPK>u3(
zW4xEGkaFRfl#b~Q3A-tLDSQ^QVb3A-COMR8xJ+w0fs=1%T-B%_7=I}Z|L~t7<^B)B
zY&-f-t|iN_i!$pQ!fRTnGzWjWaiFlWpB+R{LhP~RQ8?^fQI~64UbO?8hU;}x+<L9t
z7H?aF5^Yyr?+ub#ANkuGRU>pwNPZ*3>L!axwqW5GMpfO3-$sk+3Ma=a&RHII28GuZ
zd9}#{Td-i$H<%;+5x>yTHdc<1!x;EKYt0DBt{ev>f8!xj*0xciapqC7j#uii;ioW*
zXg+vhB^1rBFL(NCJ^bOY`!Q{mEgoU{F1Bv4l$AImX(I9^&ad7DRDNaKR(frL(Y!ov
zmxaZ(B7+20QoY}14yUiy<g3>O8{+cQN2IKpxHe+(2wtRhF&^I}*e+l#oa%DpX)ym0
zQh1zbm31dv41mRHBpwij)Mv*bj{YVJ5GO8Yc9uv&pFu1~^;bOSk!}>Pb|)V*hLeAq
ziDPi>H%VG=(f!OCDm;uENw92s)>H>w-ptqzJt$?)to$KqL!b}(r%r}RFo_eBEn?8T
zE#vm;0-~rsk6$!gK1b=Ee<{KhlzHnu#Uk&Q){MI#Lmfc4aP_3Ig;UD^Q<&ao0YZ(`
z?aj{$MMXa~cV1^2IhL}+mmD6R*(2g}?0o2UQ_uvc9>##)R`EF1yM2L!1e5GqIzG-Y
zf4}u*M8)pcBI~t3IxHFhiq9(Ei@$aBX%Wn$W+K@0`Q>xDLuViMhAS-!e7L})e#mwB
zgA~<S*ng=$%|_KrVx6ghWhUT*0@&M7z%04E@bkjwezMK;utP<*H#<yIt+<|KEvNY1
z(2_MNvYGeBuOtF0X;)}gKv+sx9GWYU5=%`#dN@j0HPc`7k|iIK4{o&*d2&v9y4G>d
zE$Gb6>Bx~N4+*sDILo@Z>Xr6`Xl36meb$XAbSe|;T*hdo_^mW2ZdTA?6mE5h^IAGJ
zKr}3><q9fIQ;9B3k1y6E%yqKe2}W6hZ{B@W|E0NG8Lc;ETN1x*0eD2=^p-|;Pc{0y
zSx)Kl)`sl8G_+EN>SF@bfT6gtm(EHVlhM*N={>7I)FD+u;)H99o4G!mvT$#~>3btD
z!9CtOWCcz_ipp~lC$xcY1RxX>EDbl}U?`BUH4>YeHn-Em$oSt_cmT8fp%88MvvAfU
zBQ3fZ%MbN^O0y3N<T5sa_d*8j`ucu!sP^LU0XT8X-Fhw9l`JdM+;r9}f5Y&Du$o8*
zSfRybbw_78YVkt^eH%MMI5D36A%EW{CG30*^?F(zRt#HD%%ZgdzJ9GOLxOsfLzDRg
zIuE1@O7~{>Ow{<ZQF8>#O9tYsZ;QEJ0a^nfIQ$J1kUA&~J8D;x0E$v<ZPuq6E;tD7
z0U`KvqIluQ&ZXvc%}JU`8{@d7<}&!e2Un$ud{-fiyQy*<OYEYN&HQII*3L#Eyx%hZ
z0%;JIx}URiKjdse;Bg`4hvdx8fOo0k-}1rV9KC-@3IErg7nNC?)+7wp*+=+s&QLF?
zaw&2lrbwp~JQJpi_aqZRxbL!n(^G@)v$V<Dn9>R!0w>bo3+{!vMRAuWL&$%Rp^>}S
z9JwdDKaK%30&zSwQb0bd&ol^qo1NHEP~8|m?i7#GiM0rP3KI`y+wxCg;tLcelP+R=
zOpuuxuckwrSB_TweCwxV7k7e5R`gn5zOmf{Z=VsTg*F(f1)}XW+(h1nmIrsk6C^8F
z8`FL?dchOkF}g{T68J>GRLbRN91V-FW}@OlS`Ykh{AXv<_ndKef0OAp7j2R_0<i~E
zVL3*_T?P*sEu^82fWX)P&z=N4-}|32y_x%R=6E93wi+k7-j+2teGH^A&$OKbu`|WB
z8}u3SWD+3bZ`7!D<Q6q`CACXyWoWq8bwug5<1eO$u#|?<_#H6|RPj>NI6cMjKkjxb
zTdb*#so^Zr_&l?q!Egd!Bg<MTnf{Jrm#rt&_6_E=e71q&+OrzM<0r6knz~}NL|Zj3
zWVV_&?Fpt&Gh9y`xt%u$-NXeM^7W2T_;H|d0}D8!61h84zHi@(xaI5m(zV1tPdPSR
z?1uK{<vbFC{wPvc#rTy6bjgkAMiOO{-m13@`P09~Jt7mmFqNt%zm=oCp22B)^*#5{
zsK*sGdE_)ce>#4^9Bc76x=T!-+U~@1x>vX@EI_wIHLpKzL<C2fYkL6C{g;fb%$cL9
zqy~WCwkIHY>1DBIf$$TkTGri^moTRBmh_i1joN=j8?2|a+s?4cH0-lVH`TTc_@OB2
zuT?&GxmV{fG*Pg%cf1uzB*gbYI5vrN-VfXk3X;Ww^2*<O$=rT4_Lz^CAYe2xM7!8m
zW8zI_jk^DMDw_=!IM<)BQgP6OQ&L1$l5VWmkzm8|!@btu{&=sc(-3>f`5m-73$Rs<
zAh2#F-HAbq0r9MquAzgkOZ(aZhYfyP8_gg6R2iXm7x-!7_}vWs)@Lqk_V#}owaWj0
zE?K01YdR=(-?*>DncT_5QiBx1^>DKLX-s^j7)ZB-yddd42hA9B6q~U@q`0&$KCG*@
z>L!w3vWElAlrsUFHAP}Q#mjwI5f<CMc+_<&TUP@QC#ow*SShbXp;rYe6H4_`Y~TRE
z+rO(b7J|G?L$xO2yPtG}xGxKe$y6Wl)k6&|)4bBl%nA#l977@QC1(XY7Wp}=OXY^k
zS3?nJBI~+~7Uqpp-B}+UfW{@l-S@zJ0U`klNny6Z3!qho2>7wfLC45Cb-tr?vOVJ3
z4rnIF`-5w5C>{=|Gp@e>&hAuc4eRM<LG||+M+vmf%0VnyTeYedTu+3hyF(tlTQ3JJ
zh^)Fp$lU#YtO%s~SvKXBZc9t`I~u*C9@>F6DV{tuucpu5aFE$eVe2n8IqvT2wshA_
z57oM+b4H`Aw!^cIb*uB&8~Ol#^#*rdz9p~vGaPcS#?-`=tjqR2CZ5nlz*mUQVdwJc
z0+UG_Hi;Jg9AeM8S?A5)etdtutL?NI*Oc!H*_t<Y5o!CuJ2(`5eZ{|h3hj4Ij}h2i
zE6*K9)YP<??kjx3AB_A9G{P(7O%@ko?q%tURGZHKoDhLMh+@~f$2bJ|k>L8#dc#ME
zzW~bE3Xc5GwnsPV8IgmGGfRPW@#YDdJBc_>smzTo_x0V;8OGca6lF1F07ktu-YgBS
zoO5e*t^Dp2>=XW)V<VQ^mwAak$zbm4O9I7eog;aW?u>|&1NUUUY{-j-BcG0@q_T@c
z_XVl2e7SlIKI7Zatz%DKkEi_=g=w0Rgs$)zFaur*gE<R^OiTVQul7&xRW|?9h>p-*
zu5wIq)MK08C^#k3jpWR9T9GRRF@?c{UL|m!xxS(6BhukVD%<oveMEZV!u4^C6UB*q
zp9U=KKXX|+q|wdX1utM7#lD>($pF^6L>o?vUdT0dGi2W~eK#4N1$w=y=(f|2Z*X!C
z6bd%%yHSkP1Rz_b#p+?;Pr2)urboju8mAaM)s1Pt-;hdUu&1v0xo=0vY?NOTm#jZV
zQ8J|dAbESwn1<giP?a<yFrM*uXANlS<ADG-z%1jFK{yC0TF!FU{TUD$(4bxypo7``
z6260d{^&Hd+vrK;NhfIQZ4__1nX<2=lEq+gA#t%I<KBYfn|J-Kb<QRQ?Y#lf26>LL
z-L;0Sl?{IB3yc@F+`}l+aDD(%u2)e&@Xfg+)u2L2HniHr1iXG&7gj;4d4jsGuBC&Y
zS783;O^ObgE`8eJf`|HIe7L0vd5Uu%HBz7F)6XNfQ(lr?jBT{R7#_Wyz882ngG*8G
z#GgST(9F>=e8K}YADGCMX7W?)wIdigdlZ(aZ`D7ZOA7@`r=^Y9TL_?JO@&I+)5m;@
z=T4@Fh{oEg1r>7L15Q_=W9{nK0<oioR6<9eAn=>@e6Qkg=SQY0k0v}<qj$`5k$AXL
zLN7r;rq&wMP#KoA=Gnf=M%*9MxfUUC_dlN2!q3XuX^e02uGQv_{hh$#Uqw4SDy28*
z&bS$<xq@+KxztMT`5XqBW4*V~wv2Xp!Q|E(#vs}i1`_mt^;?GoONzTpK)I-LOzeen
z({G%0{bwio<?DL#vS1><Um-3-cI-@eVyV^?uc9SDpqRd$=j0NuuT~X;nkfqqd)kP0
zr&6u0EuA@IlfWk^-fA?glkJp=W+J>K&l=X-LcGaOB%(+J9JH2~B(|nm1cr^DkS0DA
zUbr!k1mQ%xA_p>^Ye0mYpsvHmLsLi2^U%e3+t->eze}wA$ViF5387ClBS7|996dL4
zs<;L}+&sRxy&L&<x()YW;aIbLhmL?3E_~c1Ix>2Uh?HDFcc8fI<W~Y>(l7x^;2PLR
z^^`6j5m@I&yEvzqG7G|&d|wPg7f1#2g)Zr;c1ju5<K%{ku8ZTAn=k%M^B6k>;Hh5K
zCcLq!MG(^RgANIi!5kjmT$pr=QO_*R1@MP+$dmI7gPeJV?U!<~uJ4($#_oBaRp9C$
zrh9wqSNhKT@r!)cPc?1CP!A;?(ZG(cJ65|3)%H%Y{E}E3jMDQWUGw7j+HqIoZFcG9
z`ZN5mC6w&{rcLLUX=;vmvG%^=+k<~+Duh*3jb*-h!&=7nNWK4Gn0xD}INmK?xRC@x
zkU$`~1oz<H5FmJPr;*_9?iSo#g1ft0Ah^4`yE_4Xx5zm&bI!>9)^}&Ex%ZEznuRoU
zz4g}K&wgYtD><wqX+b1lC_};nAzzljN_uvp)FgR}&H9Hq50yQxBT7@cwA$eGbz}M4
z-ZvM=qgePVt}|e^iE((liI$6+=t@J~Xi267^f==8=yDS}-mlPS^@R*<{zeBXGt@kX
zk|(S6#s@JM8<xxb+`N96uvkc(DaB#jiSksR(Wy}OXHwfM$F=?r4tfTXDRDMV45N1(
zk{wn_>{$)PCM~a*)!rhpy`eunNjDL0i3jvRU^qE3AQNb#E$2?`EPS?Ol%TLgG{NP8
z+1W;rB(QX<_~YA2YwBLIfDDi>d7*5oqkiRO;!$Two5aK8h%`{DbXf6(nfBDR_~Okp
zxz-bQM_FTQ-D1(7%5)aZ+Mc^^xR?77v9Sdj&h7*m_^=1oP_})8?Q^8sdc#;xLCpkW
z?R(U@>#JkJC+wJ2sy9#}l_>5TWC(14a!W#OUxA|F@p8C@Mfp*jm1`uUITHUg%9i?O
zHo8#RqI=m;p>?KKB2`4OF?#1_y?&79n&KYx8U*77f&nQ~Qvz->2ctqXMnL2L_k<j(
zzJHjTWW1i$T6c$o=3eZEjjR&LjKJHaAoS-v9acH(4VXbiTApB5Pm?1jwA%Fz-@P}?
z6LN8g$`#SaT=)cipS^S6MD!Pk(B(8Up#CRwQy8+Aho|+2fE@VGjm<Egit>-VyDLSe
z$@L3wA&cxMo<RZUp4SC4wZ3*dKXe9B&I$Z}zW7=fI&$mcwiyHa#@DfbLE&GHG=b*^
zRrMBhbfo04d@bLcfLoyqpH@3g{f4`{18eU0sJ=2k{Yb=6g7&NZlqYx7$TCDp*WXb*
zk4nVPTL8pS_Wlo-<sX0L|HO0ZlQ_2<Oz{Khcu}-Z>Jfm`lY$HfP!JFVm@}#K<Bg|e
zhen(|OvQB>J%kuv#?;$MdmXMG(A4^<>;~!k`3iRu1&?#5bt4QET@t>u9Z(WNbT58y
zFbHWQI}ouM6$m0XAfB0Gk-<$(jazQ3HaHje;^o!5y2Ti93K4`aeKnBaeJ=(l<C&QU
z8MwKmtz>)|wb<7w$1ike`deiQ@ETn{1iL12T-;}OUAt3jaL!s^eza^R!rC1R@2M`H
zdF0Q2YqfW{vmnt6ZjJca>fBSEBavTeHx$2>!T?9j@q4)$kWT(-JsQDx=J(hyy+_Z#
z_8zTkKR=kXAy1EFXAYv<HaW}DM$wc+ohVV-_Q7Usi*oD<o4yV<t^v|FO@<zNJCgxJ
z0T0UgB~ODMAUAOeJRH^mTS25B>w8IQ!45*U62->ebQ4-{PNjFG!MztOigcuyopPP^
zfk@Mpb}4_D=tl&g<gKvaDuAwp+DCL-p7l)ls50@W5V^0(cER!_%wd(B6e)t<rI$Jn
z5}pGA2`;H~i*fS%GTl_atH+<Ug<HRpr=#;>JR1@!o}Oe^)x__Z-CF~b)tEVyq2Mb^
ztUF=|Hey{7h;sp5TMG!=<egss`Hue6$7#KZvg4J-qi)sgDDg&}48X+KY8h~$qC1?r
zk!?KW(Px)l;9uG0^t72xs9s{@j~e_|XT^>98=1NlT{(1ld49Xz(E)hdKK^fSng6@n
zDeyH+Gkfl09{6+sh_t@fdal=;o-}T%!5rN#Fxu{MsP|MSxbBfv6V49G0a7_ag4MR{
zT5TX-RPwagP}@20V?DL<4>ed*m)N7;5Lqqhl{sq_9BaHwj+#aYcKrZcE@QwY87c!M
zOl6eEsF;Msga(MMtRWAUff@+8dn>6t-FOiNWgfw>8)>`xw)v_il|dWd0Nbs>FVESJ
z$vf9b^gCTK)F%-<To-%~)30)e>Y{^)Y{HJmo=kHlukQ@CsPC27cq|S|udniia`D5J
zf)B3gps9St48GV9IC#DRdi0%>Qu3M@{VubBIv2vs7fnj!l(N#;@)w<k&-*EB4^vaJ
zrs1=k?h>6P{$gfJSnYJ%DO;{6YP(6QSj9di$nYevI9JK}1;#VC`$3aCo5(E;fcw{*
zF=>@VX~1ll1BV78J9c8uFz(A^*hJO0*-(<a9jk6<NSn2pO;*>CJR?ii5{4Uo;PRVL
z_E>{AVZ)yKy{sIr7pc(NlgOQiV*j|ZR7qiTR;H57d|Ebo5Uuuxy&V`^ivQ7gdgsCY
zsVAMv)o?MzLXHW`HR8gwY~qpM+_}|o(d4iXc@x&%X?LO7c!LB?5PFgy7<%Qx>;eoR
zbJ02gZ)HD8yLet|8Ysw|!~h&(B5p*(G4OhW+|)G86^gRaV(riste?;p7yEQ;`K{)@
zK^)N8`4`ii9~`e{<U>8kHKe5L?798|1!}514$go7u(n3L3;V<sqt2VZp-MW}WM$;F
zoiv5!UfI`s|FEW^E@96t$!+<P)4=Q<K8;~D)g`VbA{gxCf8`%&Th0B!Mm6z|!z_?f
zo3j2#r3losbVFI(P75O7Si4(ZpC)sfPE%YV)<ZZVz0Po`<CxX`XUShF`IT1rR7cvz
zO&TK^(vcZN9Q3_FPW`B~+969T+CtasZ{#U>_n}-a-yHU5OHHW#6cs_#ULbtXRc_gW
zoi382p*<I>f4LGMTX|(>K_-UC^!4{gVTUW(<eAADsuPA=PJf;&k{!MPllf=}5&<zf
zbt9p@vq44xZ(w%bo!d7tHyh90M82WmTG!$Ql^&8>g{Z$kO(~R*rtf8EEIu(6xg`en
zOoKi0swvTY<E!Yjv_@UY_tV4sc=sNuOVJzhjN*KP)qqd}VJc&<#4;GoNr+Sn5!G*=
z?=|MW5%!}6eUH7RF0b^Qk~=JE5&h~~8;qfPY#93vS7FjkdRjO)cS21kcLS0+xPZas
z<j{Zalv%dBe%dK%+Y|l9eDn8*L<Y5+bu5ywMbU_eRDWD=?~AplsN_)f)F`Wb>ga8s
zW)71ZOVA_Y)U~kBWjFnTMcN+Z=)B^$EGbeWEC&CGluaiVHFMNq+S{`L|2EA13u)d=
zL}hkY?d0cYy%6ViOFCw+BJudeXeVq6qu%7Z)6L<oyo14xn~miUG9**Eoy-{rO62PF
z(gO3F6%^rd!srRC$`@ctZKL%BHnPLT2S9NG7PvX=NJn6iQG#dL+gU=Rl<5ceYYc~`
zRO?!UDi@l)`ufU|?tIUGsLhtGd_o>|%-(l})yJ3}jtn3bYgJ&;D{EI^#3K+TZ>igG
zwy+>e+fhz-R%wYA?M|9Yi5A<62JA^O7}4UR#<7%pN3ym8nh9UDEGg@M-as1~?jquN
z0}c>kv^$Nm=vZ0p8(w`QqQ&MRJD%M<IG3ZVRO&@ZKP46<dR}AE`yY>RwF<hn%}8E_
z5ale+RGMFx(p3^W7dj-|=#S6K6*MJPRdrRNxg|7MVC$(TY5AFw38f+`GgmvSnmsof
z&Gle$z;^_&zCI0<f3v*kM;OLz6A2p$>Ic8F*w-YCwjyg;MmNktY4QA3YhH3>C;DZw
zfm!#IUHuk;23KiTzZnS~)D4Bjw_;hU7`+su1fZm~lO(^v(Igzt7{80JZ_Ct94on-r
zCZJ(jj=8@Q45o&d(V_$7A*dR;jcD&Tvg%8Mrl`>yLSb+YVE2H+n<AI8O4EEQWlJUt
zYn*qY0H~I+e}Bc=bx?m{f@w*cq%hh~upxkAIhdS4gU6AgXS9#6>Zvlj(+d0{ofiDC
zhC9}$`&R@{CbQl=7$r`N^3kJ0L5ygp$s0OKlmQ$|pD9Q~K~NMiq0l1wXNzkil^d#C
z>0053LX+D1u#!-!`JAxdm3m&UZW4t?c`a?OJ_?rK>8?Bao9jk@G&O<`UKp4bl%T>|
z`b=twJ;+S(7%e(-Wi=v^Ru*{gCIuc*3fYOlT`Pw(@<ejubY!9Xs8@ek`*wDzNA{fo
zU4<Scs17=G6MM<I{PkV_dGuePu4jwX^-bQ?%zn%S2CFR7(6zb^=31x4T4|z`Xyoxh
zH;Fs%LZ@4q`s8OUx>9q;5K||Ahu1{WL(T^6GSV>HYlz94Mx{YbH+D5asfcvxHN_=B
zL0raM^KTVlI-;B;Q8>CW-jyOY#aYH{W!v?iNVPRSkiH2>iZ2d5!~kwfdN))LC;it7
z!M`z$21m6|4?O#?QrUjt)6eHO=wDjL>yC?LlneM1Cak3Gy5k@aT-_cqi%g>Re5zSC
zzqC$s0g7gv{+U{(7F%@E5PQDc*~XmdYs0purEk5U<21+;pq1C3)!`<=bbT2c7<m6p
z65fypL`eY=G~Koy<g;x(YBT+TO|K+4KMRB!!hjzfdU<O<1zp!v`5l{&9OkQ|A@fwY
zKDqPpmA_I~NfG(fh(AIrMUt@O4{Y7aDbAUHmzhKT-#Dtd&==jHnYq<gl2-Y_?&6DV
z(J%$GQNOox8wV3msOpNn+s1n>AD(fQuZ)>(a{5hN6h{Raq_Jw7)|qeH?I7D1o#B+K
zfg&s)X{vDI%0fe3EZI9Qgq3H3m7A4-j>!1(KS_lxuqy*qVTun|usIz}<*adX4o)ne
zK{EomwoiWc6Af+`4w1K>(Nt@WS25y6<MGvPNiCTuwI~TtD|6A;P|#R9dVgHkswNaX
zmAV~I;%GRi<4MpQM@lpeu`u^%%DHId8_aLjR<1itMj0fn>%&1qz6%`1KLdk{hp(5R
ze3P!O22$b!JyDu|yLxEO4**gMEXePxw#{TfOM$}kZwoINbe-<^7YNJJjjeJ&jr6^V
z3xd#gS8&n9;wG6uOxWO<xo$fQEL6?YtI|D9th<EuL9r9XPbE3R(Gw>hsLwyV5|f{L
z=TeMlA=_xfsD-91zeb32kcKp4ZgG^C3}K0EnIU%&&41;P;$__o=fmFtTHC~!7sME7
zq&5lXy3;fql@`{#i#uCYKEpe!Jrr@wS7)YWk9@rtDTUfWNE3%!8O<Q|rlS{COaD%=
zHx1)1C^t8BRo}F6{Og0{fj^l)1OZD&hV8?^E)1+6k8<Lp*d6K(H+QRi$D|}f#BIRW
zNK5xd(tGLY3dZjwq%fE7y)@M6Q?63S3Uz9?O0#(og5Ac&U`NsW&IfTZ?5zFeIEZ}5
zCTRkX|MMH=e{D7WAHF~OO-_9hnO|^U0MV4444hED(|0elyY~QWMmXddu&sfJmUB)U
zSz!l2-Ok&p)vXQH_C}=NGPd$O<gYPWXjpT?)>TVM9jBCp)5{i@qN{b5FMD?SNDdcj
z<9rMBKgNavqF{_kY$`K*VPIHll#O090C;fGfyn47bMsy;bIUhWYH!!={mv!;YTpSp
zlMgN>0#wsq0wU;sKOtF9$xy%!KZ$gXq9s)85)rn$05Z};gfB)*Il+nnGQ#ks=Ik12
zOWzv+yWv7UhDX<#MKb?dWMM=vU6KH;%X|4hY6dzJ6E3>$Gz~uYci6PqQP&s={8^53
zG!zQsbSE<+L0^<<9WDDicsEyS0V+@-4a19_ZHEb${zw{sDt~Con|Iq{J=TCI^@>%v
zm0WZ}fr^?Y^Pq$Y$@U?_f4aV3=eH={mn9$fAij}CL;g}78->o=5-GLd_>C2a@mJfP
z@rI+$@`h^+4BI1HGnM3v4O63xcqJp9-@&e)=@Z4{LTslEi<VYd!Bp^+S+#bpXdCxc
z^FFjNtz(bvSBr=DlP@KWY)DKMGwL6xRSMwmzwq_hSr$oKEUAf^D}j8ZI;ZwBU&)E%
z65`K+<<uAY`u9Pn5&Xx>hh=H_bb9uaon$3}=5*RM0RwfR#D*Mrm)C^_SxwQEQ_*Tf
zx!sb+rmRz09Pg?f!2wgVBHEdP7H#^6w4t26LR#k;a?y~)WRC=Emrk9dh~|pTv+J_(
znVv!MPzh$LNZTC%Zcua=(F&&<UqE4!`tcX&yF1wQ2Vf|(BTsswF^UZ?AfJeTAkmdM
zhm9_jU}dCwX1)b54gVq4zZp-plF>0u$;|<wT@w8KLg+e)ujqiSNl3Y+rM@Z@JXMSZ
zW}bS2lb>k>OLx^{;zo}-qo%Rj+i;#P)=Q66r>b<?a!!YVM<V2A=vXd37<~H3K}GNu
z#dZ{<_rPU%`T5Fm-eNck?Fwr@W@^UuA4>FDB=L*1A0+;{&eD=E?DQb7e`bfO1J*N7
zYU`y}#kj@u(-MitnZ{U@M1}}&dP&k<=&W;A0`oOcd|C)goCf8869ie{ebnN0MxM)1
z;#fMqPXVcTSs~L*Kf;~iIJXVDZ~Ts^E*kinY^GvhhYurO>eqjO$@j@hdT=j|?)>NX
zXPkL(YFueSi=)Bw@MJVcpSzcTEJ_3X91}k&s@G?ZeSbnJlkmPPs&6=&6V2NZ8+uNd
zYyJV*?bS}9<dp>$Vj%8l_&`wH+w>L0U9ukd-T}@bO`f~WT%+n`l|8n<Knn@uYjo{#
zNaaIGh}dGEd_L1$T=9e|hdc`0C6qZ$$YXS+>rB2Dn1?jOYByUk;XNKPw4@+2f%?k`
zid6hC2E|m0689$66ZQ3%md}+#SVu8NVcUqNNL!51OT-mrW!}g5$-I_&p+$pVX#+tH
zb&JhB^J4ugQZL!t0tnP9M9J#|kZ#hF*P=qS)`#8pT*`j%M%z;w@TbtbY1|bgu!Pd$
zCUi%Zf=F`BHK-%T3-%+~R1zw;<~=(UP$G?gfykSYNII2fLfVe#hE~42h4g-Pd`P!=
zWzmgp)kEU<fdwB!81zUrUF0Lu957foF{4%i+(N?7@;eY?`d;WCSI~7V!_cOo;Bkg7
z;m^+`&lsh2E2-IE#y=Msz{F~*q~C<eMc6>7_E!j0+JDGs_i{t6xl4+9mJ6D+38w{b
z3&ZGc5lX9dPuW9$YzWr%MLbr^_ii4l-ev!&C=s*fsYk<16LtXi7gP#i5Rsub<YWlQ
zN+{GKiO))_FAc!xeuSfSxq0Ne%IS}dRoprXks1gb`n!0u%uxNDIPcpegdQ2k4EpC8
z-u2b!c3N#niK+a7bhwT$)<s+uO5^oT)ge25Z&=U}Uh4wH5$|Z^XrwzST#SM=`6hjS
zwu2Y{oc$&|vlOLXLuC*rH>4PTj4(-0cl<&z!FUtF26;UKz3j*OX~?PD`wh`+2&|a5
zJmMK2v`P?cnROhe44|XL7v?Ww3N=WX9^X_B&3~P7&6{~QxOsKP>mP(D&s$i~&7|7*
z1EK4%2GecpyyYERWEW~Ld7Jn-a&3WAh)TM`3<W0U<nbjbYLUf4rU(LPFT2*=`<(e#
zlV|uN273&GrbcPA`hLu>gEuyfGG$JHEjuOWS||ZLtedVaY~3tchb?;KzY8Hg=(WA1
zIUd_?cV&OuYXdZg4ajHzMvG|8HLgBjr@|8-#O5$|h%WAN&db_53czaQCZ^*WFc;XT
zJD#Oq7JG^QP|m!AboNX;2>6)x0wFQ&E{IozqZiP#{ybb!=Kj-AF@&uR`n!LDrh8!k
z-j7BDMDoLM;OXIQ%51KHPk!;zl`+6pcj=RmFm=Zn&WZDOa~pk0`?x7C?DtsH)uS0_
zUY(j!^Lw0~c%Ar|eNwPToolah5Nciw1ayVU)Ban;`=4S`g_m?zSz6H2Oi-iZA+Wdb
z_KGlKX5?pyP%giBK$G=_$o`4@&-C30?qrc<!+60a5uG9H(3t+RuaX|p4%{hDDI&z%
z;Tu3eA@|<`3MpoQgu)$yZ~wf5{g3e8{{y#Psm!m4HS`d#G(?HCVKD`b>){3?P6!v{
zO@l--Mb4K)S}|h0Y_9?9DI9le9JW%j??3cb$r`cdn@=vMJX)-ikF%o4KA&?n5rpOw
z%@i)(6eueuBpy&^C5@rWN_>9(haV3eAN<-5hrUktY4|caz4PN%gzm9Ytvd$2@@N%&
z6>4<0*IyuMmu*vs$n;jVeYlR=Vjg#SLy>f2O2%yK`>=E5@71)?5W%W5HdWiOC+3tC
znAOWNUX=wZP0rW&Z<GkWE4QuAK@Mhqx!Pn2FjYa#0&6vm#`pZSPc^2$o(et8>q`M>
zDUQRbP}c_+1#$dvt~r(I+sy1E=Vc6&=bnuoxdha>Ek852(g?xTg2#hWJ!eUdW(Hv8
zzWe(rf+DNASXdIWHm3!aJY2Zw9FV&m$&crQ;_`sGp5N;v`E#ztktC=yIyqD(EZ0hk
z^b0mD9!OEjhUxWN!qkFNW2HC>rzFK}grW)Fp7YU8LL{d<`obO7)~hpLf=q*sc-i_b
z148@RNE-%GkOd6J#cUW4eyJ0?3`EjlcHoj7%Rm?fZy+DG7^Qt}-HU`sPpP+aG^pv+
zCr{;g>$gR`6;99kTvpg(P(*rEI3yDOzKXxSJhz2x)AH@3z&MeQ?YCKWKH3GLeG&J=
z%Xg?hXDEBt+U@WIi5yrZFzTW?%9Y>#Y<<6pK(oY4?uOJlnPx81@k`>6+`yp%Fh;FA
ztmmVmU_$f({az}#50`WTm@_wy@@gxBw3rOsBD8Xu%3)J$#V~z9avf{8Tx=n?82;2j
zPf?315->hZ{_kMHe}2~3_@R3`ZF+g9i(~F703XF7UD{+gE7{z{KWDRuyBSGt<`$ZY
zk>c^v1NSdb`DCp|IfoKuM{L|T8+Z<)nVs|vs!W*#)7?)XhW2k<9(=pW`+oK};RVVN
z(L+WFnML&uo95DOvDZ-C(j>guwUQcd<ugqyfHRLs*$vpYpaW*a>O4|?olPn7lo_;k
zYL0<cAGo(EQk;YN5&<-~*)><qglcDzi6nhfN)Q;@6tgKOe6Va<5okQ%^1YM)*jXZ?
zwSW6T4kL-FHPu;O(ON@4z8;7%RNN>rbK<@iyaysbLjW1@&rux#g1uhfD;DU~ny4XJ
zIcdcB3#=Vs5&Xb{{bW=Ph@c~8f-P1Qa|!|HL%3<&)FYS&rKyi)Y?Bm?ot`g!UBjQs
zloPNqWlp6WwH;di0~Wtnp(3$0A4`kZ{|xn)#mm_pQp61c^5CtHkJan4GnW^>exO|0
zU}7R*p*W0W4&F+|78%<t6p*=MDw_5S>we6oi*aCV3~JXZ1WMMkiL(ArtJWlm%3dhV
zFptIA!7M@0UxEX<s6(NY5xHIZnw$)-qat$mKFo~!+6D2<kBD;M+4TypM$?!C)08m+
zykoO(0Pi@MQEkB@1U%Cl=`2IwNRZ=-kXaYMqejC0N(hMahGG4g@8mvLypmcBSlUco
z-X%{$_X>F#A`Gu$8<c=WAZfd9R?i3Tdw+j%O@?ny_+_?iqU56P@r4?D_U?T>kQNZ5
zzWkhR?Y7!#Mxmz(DzcNOW)KB7b-GtU0PLCfg8c)NLmFJU^H;fv(8Tn5Bt*iUM!SuV
z2l`|f4pd@7nqTJ}6od^w{^1TH?AWKHQSuWc-rEj}E9Y0h{k(s$eeln=_qcC}jT;d_
zMz;rq%7+Sv;dx}O#MTPk>^X1f$)h(6;|)KNq{Or0qbpPOzX;L)dGpms@b<tzT%rG2
ztwMW3XV>51FlFHPotV|UL?H#v%m><c3U3WsWNZcF&UBp+YJontfaU!%e{H(#l&T`J
zSs4P%Mg9;JTs-Wib!p*PoTP(@CgCf&rk#059?N#ESJ%fb8*jsGFeg}A+xvHs>e1*$
zKfVhs9N7F6j`a>V*R@*JiDcbA!~}X`Rm^9@l42BfkUL(xd2soXcS$705YMo%ocDaS
zx7f*JR)77iWexKeSeKNXqU^L>9sR*?c61RxDq(ic=;RfqSWW%X72BHHQk8Z3ZJEV8
zY^0!cq?p8d8%tYrxwr(Cmk#Xrv{|wmbC>@DX(g<<1azf`;p8=2-&npKw$It;|4a`r
z5d<OHs*09@W`Ir;wvn>p2@j@8wvAoha=tc|s%gwS0Y*yvK-F)&&qcSAbD%2_`F^N`
z0d#Y{zj&1wH<&M_NJxt@p9Fc3_P01$*4&qD!QOR576HRqq(0dW+jA-T8Rlo)!%ph4
zClUMb6E0uvrXO~jDg~$8&UbDr-4^pjNp(usPL9V<e8kd?=Oj(<nl4fkAG<+UPy`lh
zWN@{yF?i_*-KHT)AwC??a_MI-s#2tS5_4)woxJl5V<|&Q<g$pfcH<XXL~+K={|ltq
z#6ib$j03*pO5!@Pj(>cmFxB$82vN=DYIBGrqFtGjr%IYC+R)H;Dn@Gmy}_`#v{u^g
zR^1S)W5<2O=0c?yt(cA&Pqa~1?g2Nj1&RXs0tFegY`&qk3ijr5t6#lpN^sQmiQ#rE
z&+zQaJ}J#w0AR5a02bE|ity}~NxMji;i-h`bK!usbS)w0q}IiP`E2*DfVntaoe21;
zu}pl!n4a7@-{yj|UsrZqrEY$0wo9tHCH)1R6MiXr;95L}H97oyTq6(<F)v6Rk@F?R
zthY<P*WGp6zY3Cr6A;uzTxBg^aO?;SgA1{{)3OV#FyS!JPJzNp>_A{(dmqVM4P+s#
zu}uz|T4QwAR0;A(5pa^|l!PMl!`i@u506ekP7%^~VQU5YQ>9n?yY|q(r3Z#8D{RoK
z*hCTKZTufcm^J-g7f;&hH_crhc8?Vlix@VZn`2D6iJY~xp`80?=2S#3W}ntZT_%0B
zkl6*jkBE(AY*ayx8=8g9+Bh27>ldQ}@O3J5bXg6yp!Fm}ZThToM3cD-RZ)Xp^;=C(
z!u;1|=-aXjloLQ+xkE6eks9ej?7#>Px9p%;MC(yoenjV0`PZ}AfZ3x%jHY{~{^`Dc
z+tmY8X`wMk;@SacnF3s57;M5ZCI8Z5vPia@qC6SK-Y?}+aafa!wqyBX@)KNbTeAuA
z3qn;wIM8$VGM>!pxzk+<@-@|LD$k!?5W?nD2f050{;j8CkQ}=no-CaNfHIKrr({k*
zmw}eshz|yd56oUC))X)>+)D9^K7oN4^=HKviE{cB|CKra7VT?PAi`pg@BQhoC26vu
zQ<f7=5l#c}VRRdr;Bxpb0SQ{>Nv~C78stwzTG>lPnu4sR!EWO6uYaXa{0oiZ|KhQ>
z2CPwY!`R0TVYc{&NsG*F18$m;M5oZn<mA8naus5{+30QHT`xS}(Sf~-f1tKj6DFm>
zrPGd0Otiz)h4}E~RJOCQft&a}{(?5pwQ&E)9i`SNb<`9kP%$Bij1FC=U>`w^GD90!
z*$lbe=rT+@sh+H%9od}H8v;(Olf|ls4%(1YWYN(f|AvA16=S+>Gy#B-OkBuB_V%D2
z1$B?2--zCuf!Qq@h!(nEyLmhutt}<i;8ObbRxKVOnh~260QVm*k2UA>4l1;Ix77Vq
zMLU#!moG+~m6RF^Fp{*q-C2xu%(nG@5~kLFdl0TRMFJ5srr!;g)!=Ph-wvi|tmOEj
zG5Vgs%bqBG`!CQznNF2SZ;VoC!C*YU5V{=GzhZ%v+OGEb8ol=UOQWXt1P+q0e)u*F
zR-I8DB<Dp}vK55FkL-7+811Igc(|@w)O3TMXq=ZSW>9J@O7{^X-Ts)NAey%Gzd)U-
zFdG;x>=#n!D~ae3twpg`H6CViWo}ib-who++Fs>hG-Y?ro5xxmI63kvLzny8L1`UZ
z#8mw46!;it*~qVjU)wODnDc1NlIh!7P5n~69Cy%Leb<I(n)W7M%yL83u9`3A)dACn
z9KUvKzdi???-JhosdM`qk<N&~CiX5<njar(7*+%IOiOtcnLh?l`_&&K3^*1Lt!+j5
zaPpLQee&jVC?{FDlQOa^u8y9mqQP}mY2bv_>-K{9!CGa!+L|o<E~kE_F(%*L&?Y`G
zbnhSBT(a-jL|<r|ZxTNN(Oj(S*RdW*-{Qw23Wp~ON0KZ1P@2sh(^l}0K=uFWb0A}a
zZbwzyyy}zSi`bDe=ar>bkXN5Qtp6id@HS;}n3%{Hb!u^3f@nVtK`O)?y>~Y7`O4{Y
z2bgShKb+zJ82zu`*&k{c#FcauuqV`XvoTks07fZ?Wf<9XT&b~#!Y=l#z+X4D^wN#C
zGrmj!)VLf<ZS@odEx&uhI1sGFr3*0tj+rC4Kag~YqN(Ev+aDPol%%rP?=zQf0)|6v
zYo6AhS^eL@k@!M@Ky9+1xKGTqPCaY9+RrT57Y&c(*g*0)QFu@A(N0ap3^7{ft0qf9
zA8=rqqwIu*nJ+i!%=dQo;Xy{hASoSqdBDm_!qSqi>jzO-YSS9RHz8$OyWb%*Pruw+
zmm6g7W_D6DdeMR`6Pcl+(|_^iw~D!!E-qw*4=V}dxwTM79P%SOPLReY>!<x7Otl&q
z;%dGk<X5OAe3vHIZN;~njj{#Aa#_;vG)K0aK*k&h`4#tY0#uQsMdAkgx)ZNSw<e8p
zyO||kq1OO-BUWx6v`&0*@XiLVN@xNatr2(S;SpH67PA6v8uv+Qq$@5>dj}-dz1?JY
z^JuMpQn;b2k0xl4#nP|EPFjh*77kSIhqHXN5iEY&4vt{eaIr_z_&hQ?BAcmhvK%C^
zv}SXgAi)<#y~oPvw=i>Q*D*pEy;Pjs)xmN$e>76j|3VJ>+fj4<>~Kwg`K)HD1wt`z
zj%)UFeh)rrHa%XjH{p>2h5|MsGPprLPQ>VkY$n&mwhvECrw8FQ5Pwvbo;lyTJTLq=
zPrrB_5dLd1yhyGn&D%9;ZyYl<_tMpn1=o<9!G3-8X6?_y(9EBPhPa|jUOR0erp<Px
z5uern8bz-8P@&dADKlnV*F{@hi7Qwy9}$y;%jekG&IfiAxXUkdYB~xePZyu$$;O;3
zJ;6oB(thm0T1`tN0a=HOfq7#09@VOU&TF5gcirYL=3hUl+!EqH>Yd&A<u8k5t?(C{
zzWp9dSvBS(>{#Qwt&jgJT5L01^nS93fa4r4Bv-f81g*91Y2O%o9#+p{K>+y;)ZA-M
zGdwiYq^!z9O-1&(tu9?^<q0+V4#1S0f>Kt96E$@jRe~Gu6%1**ILKVJqN?F%Vz)72
z5|Kui9x@+cshx|+_gq6&RyKIAtzY?MO=qHO4*Ni)`yJhSy+HiA2-^E-RDsZkb2Z`A
zTd*0MB3IhAmc0kx8M3ADSqUR4vkA6y$C3`L8G#ot+5c4Tk&P~^MjGGSEP^8S-TB-1
ztau<l19{^pAm)}K&89Qv3PVhNd{4g@w{M+9Zpa11Wa=t;_M1c1GQ9h6J3PlVZ8~c>
zZ!gFTF4>*ekZ+9!Ms9}w6TkGeRm?5=^+Vd#QT*1y4O=;@sU#aS5-<WkN(VCE)R&L1
zyAMwqA}ioNih$f-Dd%*PpL{?A^1q-_#iTNVVcCKiRk&sYGb-sY8s0BK^JCx3Y&M<(
z<JXB8V+(zy5-O2oi@t@1G;SjT<0VofrXg2lni8j+fQzf)T*jf2e9jxV$yERV8(lqM
zSH56Y7az*4hwtFV+@ns_+nqaS#E#uPnHcvVNljW#ovUW-C*6vX%nJ4${MUQQOU&tM
z+uOTwH_T1=owoQd6ZErvEeLPT@s%VqE)<*BQghGVu(ppYzG)BxY&5OpLqZPR?a!+_
z#+^1h&JVcsF4Q%R&%ndM?H!v9%5y^?MV+o9w`S3Pl3KSAEoqNo54ITP39_^4`(^vQ
zFQj#m)y!hAkKWlvvVBm*i-?Pbx`=ktTHx+b#*q%(KBsH&{ryQkPBESpUMJm<C}Lx^
zHr?t3!n0OyL5@&@;p8@g$FfY-gmzEBF1Of0H?)rkuPMTzh=1VDF4Z_?0ECe>V=Z;9
zQS#<L0y*)BPI>~xc$6_;u__z%U@U|g(=v4H+)dNM-Y7Wkxm+1>CAXqR0VeKmb3D`&
zqV8{L`KEPk%G{gNC+}x-0bfLi;$2O1W6%i7m*NjIGs)neNhC;H+BsmcD-7Qvld6^I
zki_-pJ+MdZz5oKkI2fLvY!C_6QF&(Y#J|5yfI)BT{Z$D9WvLu{sN5W|g=1yt{3++Y
z0v_Oh!fr9VH#F?+w%BgEST|7$LS525`R|^z&o%4JI#n0ZDC`DBOZXgPCJ#d&bctr)
z0r>IB-|*vfwT&(vXZJn}YaK?Owk>uzgBO#HAsaDH(uYZ-td`B;e>%PYn<U%+(eG=_
zJwV%^CD2nZTpvpV)L^ahS>8QT^oO?NcE1l@??M*atiuL`5z<|1HLdj>>EeD3!)OP{
z&Ie@Plx>Pltxshc1gYXPwnFOMQLJY#N{LTgIn3k$<2#!tz-O@F7%e^+;4=x)F(3l(
zFAP*i-y!5ds!6v?xvR<{rjSretv&1e5tWdbiG6Zj1jfPrjh~Y6eHF^Ub-R;q=b=4G
zH4VQLCN>FFE4ydJC6FgOwNv3nwTjBeL<ktKef*%dTn|TTyVqx2lcUQ)-e^LT-A;dO
zSp8$5F|_Ay1jYKubqeE<fM|>nSHu~uA9dY8c3^kxh6m-j)%m0{bIG`W=LD@I#ZuM>
z0GM<sYn)X=@d|&B&5%n1GAHYQ0?1t9d_1@gAHK%NH{C@jPDc3*($Ld?cNKUnjl>GI
zxc8>DjmPdgf1qBMQ&`^UE0kiz$cd<%v4nS%8Y94no>ZwoEF1UNi~a!XM{0E*Q(NKG
zH!5S=`AqDFFva3$y84D^AvZa+wdRM%IM&-}VFuDI0uWLkh@HH}S7MqKiFj+tSb0{7
zxhj?k@^ze1j=x92Hyn;&`g8^Q?g^?EqJ`5z)QEyZww*$hP0lb%ebPr1`slSwfxy7-
z@Y_Ujx~Q0U7p1Z|z%l2fnUH6xgRZu#LcN=mxvQHrT!^}_ea#1j$af*Typ~7n>@U!-
z6|UOwgOde5E`7A#LY1nLDyp}>EzqQ|6hALvfuxoUSud5lJpGzxeNZh7?0!yaEWQ0<
zw0bL!Es#{j)&sF>Uvlp2@8wYXHImkx?ZVNZIB8%7+>dQvgpELv@ZWp9E=wv^S3M3}
z9P%ak*htOow>t?~&UMPxw)NG=(1Ucoe~SR>eNX9Nk)Y15qi`;!6jX>nb$IAPs<WU-
z<vxotUC!P2o)0vSRUl9-V$|rl%ahCbN)yC*qcKnnHiVeqz{QnN@L0pD5c|mCSB_yN
z89kLz>07`!Fhd6@Z7887oVV&@#ooqRFDV0qes4VZQ!n{Y=U@&#S@mJ`E`Xk@>X`*u
zE{q@lZsC0I3=psob}dTi>GbDWzP{m*<3zg3SJ4{PC*M;)J_(59^RshsIW8GHX?U6n
z>BqOd%7}2`HL&=RF-T8v%1EJ+-UaZy44W$_bmq~@{sNs)kUmM@%}8aJOL9<|AW}UY
zJ@!7*phrtdlY3t@x(PjrC^fWlPz;9r4t4>E>b${f20<z>L*dUrTiMO<(rZCS0r`2U
zf6vcLC^~dlaJ~PEqgt6-7!Jrf4A0916{mKm4CrVuLilJuKNdeztW*?gGE6$?%C%_c
z9qrkFdf)l(?YArg60)Ut*=dPu=@X5n&4uOUOiO)wZn_i|4+`kY=m!I?DHzlPdFw!7
zVW9o*PdOwFexl@h^uxZIX1>Ese7$W69j$R=mB)eiT(!216K<6gMt~e-6j-J5i{fYh
z4%#=KUyl0_8{?Ax&De#)_xb%Eog+<d)rX6f=WVyaAc;r^=;CNz*^7c6^h$h5XRR*j
za7X1q$Gkgn!m0(fy`MFBQOxCpEV>b&?);^s;7PPG4srCme|8i4y|RG!I&kQr`n8KH
z6?R+a-!DrHhagQv?=sux(vwafQ@m<COB)7GIko&KARaGFZJlBrr7;&I{)W;h=}5O|
zB$l|)_;r(oazh&AN04D-+)kR(C(>v}0|yGyXlK&2YXESB+VFc}Sz~188ne5k{4meH
ze{D;nM|3k<P7-`{<%zhUDvY!LVaGw8?F`}57~zgPw<2Yo!+HgVHBPSn(#};n;>z+c
zu7>c;O>ewGyRPpTa>kR$&)MpUs~?g~;JWec5nGzI#!<5eD~?hG8l!HKy^1*m6?dJo
z-<1Hp@5N{#>5J7zfS_QKT@qY6XFQ8J0fq1`73dQnbp(XLl#k2&-b8u@W|Raw2{N-A
z-d`LL%0$jl{RqX29Y3~p)h*bE$Dobcb>wI|*6SY8aLWU9gs}K;Jpsk2mxTGby6Vz&
zUH)P@hPoqS1%;e;pR<>+;&q0^{y-@bLZU}xz<>W8h~~^_Zt|IUPd8MIr`t@BKjxBd
z^2VIZK|+C5Lupo0aJR3`TA-hh6G+yE2~A`2%(YpV4ccy!rfwIrB(Tw24zRS~vOQHl
ztmX#75)59<I^0b;r7Jf#Y=v-p!rKhW%F8uOWD^rfWh_RzMtPIK=XXlLIy7Ik?Jks4
zBpYUb;ldL`|0h5T5+RByrpxO_{i6NRs)GqxYQ0EYe8mcWYGHotEi{_LW$}aF4a{F+
z^nT6Ywrmru9&GPmAqy)jc4v$Hly65TNN&2Cxo0T7FrB>Q&%@L7U1}e)V<W}yg0ZbH
z`kXjM0Q`-iz4BM^;jfu3x9ItlhG6B|FSQXHmPXIGdO|@lM>FTCnIiHL(&wekgNqvE
zQ0SD+=W#;U*Q|s=ZeqFph07i5u5%V^VK+6ETi-c3Wuq>UIkY211We;~UYH;ez%tt_
z2G{Wh$J|uP?@2m4vM%L`{h+8g;*A4_ensqy+CYTnzarj%ltK~!)E&PSWdr%BaHSxw
zM!xq>-@As5^V{$&#I%fGiE{i(*F@oqQ#i*Ae4fRwt5~T>2_hwV)thle2;_V1(2REJ
zl%I5-@;nMtKOgY|V`Unz%m1e!tbc!&)6v7w3rP);L$Rf}P`_q*&7H7-O}Nj96W-YS
zh<p24{B%qgpDSk+1`^rD0Ztz>JnPgR&dpyS>X}>X$jBfH^@rEDw~tSzqJxcx+SWyy
z+mgRi=>Yw4G5BRN3HnF-F`l}MppQ1;+`-}T-V3|RxrYqP89t|PX^?W#o30@WW7bJ#
z&RG4Sz?Ai@%%P5@)dV6_Ihv%6hjL1JbDi&cqPMnLg8W|ftf^XpEKMg-FA?jT;h3l6
zPhc?B2-sS#7zXQ65vO2)i}!GUaDz2b*vO%Ni)N=h;B40Z1wtXguOEY%C)Y%Av%OCN
z0wa&CW;z7QYOWG20^-KilIucj^Sq9}RHAv<!EIw>E%#y%>(5B4To_6ztkT9M0&|gf
z|JY00wY@q|D_<*BEVnb33Bok1yR={!Vz6%H$0i~5jT9M+^a#82JkJ+6M|V)-`k9n}
zXv<>dEI{s*7q@71F{kI9;{K@Xz%)nRCYjYlxnU?FROx5NLVenJozP|J^B@v*VtFme
zrpoeUV7~++Il7QYiMQ|JxA<Ooc=;`5cjpxQj!*5(A*(KVyF6|Oc;&Dr&R9IO(tA8S
z23S4BS&6gTjom;V;`7B(nu8{RkNk$#<OpsV^!@N;pBH#Fm9f{}M_ow=@Mx^_1>*?q
z{2)A?5v{h(U(V~tVE@Jr2N#LFrCSrXg{Le{hbP^c6E0;kX9<uouw=Eq0OX$6RsD3Q
zKKkMB-Vq+nF9(uRjr3#1L<6N?j~KUCJ0YJ5n<I`xrme0kVS>FmjUcriep!w`HXhzP
z7iD}k=A2_vhlx^zqH}#0%B(8Z|8{ksJaJ$u*0Sh~z{?mlA~KN)6wq%L73?1j1GAFE
zSIzuCe}>ibAMvEMo|?J9ut&^cs(4Y#YwD}1Syb9<SEAmw=aaMT+0MchlqEZb7?TvG
zkpbMp8YPQ_l0_3(;uyRw!$FJZ20&hvj!z@rv@sPoK95aB1Hj*ES-yW?5)240dAwb~
z99A9#5MhC$PQ;qU;jE>aLv&29vdmQRoPlb4KQpd+s4P3b;`X*6RkYKFLXJW6yt%-H
zt?tc_pwDJ{MB5RXK&EC~|G^4TLyM~Rclgq|&4@PTv2;(%Ts?J3vaV6u5lvxES`)7I
z!ob)oH4^_kV)^kGfnf=<)!#0*mkaJcJYZ(|47D%^v+r_@n5#Su4@$lCV+;Jh<r~X5
zk)6E@&pFx+#s9fr`>R52Y3?q01XH;=a#6D}5rh7n^OukJ-qhi52tN(9zPWE<`mZed
zX1UbQ-K6d~##su%+tcY$jB!3@&7T=YNPcGzDZ1&NMD-xklqH-}HCcKD6#99pWYTgk
zoBS+4wB4en?#VXfO)XHL*A&@ahKP?1B*B>$e)JcCi*!-u&%G1aSrei=@_|pZpnR=&
zI2P_3Q3j@o6KX}K<}j(<9+cEbInFJ)wS_Oua@GUK8p2Eg$y`Tvp737^q7Te8`T$og
zD3>$Qt(*Pu)We*~BlDU&H5!h`hCvGwYo0UibZsS5qe%(dJ%&a}F3oE#=Vw5QoJDI?
zh~p=Oh430g5L;8DQ*vFxjt&xQhfU{Kb1{grc2NwxSm!w<DIZgM5Xm>H+@8Z09g(K@
zh@G+!j22e<v3^h1x$+(jH8T4pHlFJGEj~F3QdO}ipEuZjSl2{txqG#rKs%&CzW*V)
zpC`?Dna*!uWxM%Fc<277+nrQj3uTeQ!B>S7ZWVE$D@F@eWBmNRU?-YGm+9+1o^CN`
zJ7JjqK^sxk<SjYiTxK1$-DB%JDnDk!+cw>0!qt6~fv_aymSwwLKG13#>e$<6LdFuo
zhmk0knKk_v2$D))y3w#P*Yr&_@nV!XGJ6pZP>rSMf3&v+FZDo@G{sOHz}#yt$Sw*j
zO7xQHe1Y8xU3~8Qiy6QU82;@)SzZ6Q;$Y-EA7b|F4;EtuKPn_Rh`x=A@m@lFxMtml
zAJ{7k#m0KUm#@o7$}Zd4F<rjPsnRk_Zh@3OGZp1$#VoclFY?AM`xcxY{Z36Z`(nJT
z;2<I-WZtoU5C3}O^UtGlip%1{+(p3&aPKt0MmSV1$KzRz8r2G9u&W8#@zC1&3nY=!
zN<VYO7iV{hKnW%L8J~f=rC7}!GPLm*NLBvM_!&Un+(PZMYRUNb6}I{J#nxAa?IuRo
zKZPT?05)(@n!&={CZ*SpAJ~R@w(CCW%SpNOJ-I2p_w{LsPzvYr(?1zJ9dkck`XGZ{
zmV??G$>iLB1+p*0?NU2x`W_AG8mKebwOHEu%=JDU&{n$_<yDrbA4GfH*R^9+ec}4F
zx%A{NEk0aM-bOaM9NtS$g0_3o3%sW^kz4=mZSa2xKw)R0vp#AmHokd^WgIjoizVDo
z^W-|(h$0K+ktz$wrt0GhbM`YbRx9mE0kmG`WATGMF6?)N&$a6M=A(jd!|a~s4}Ox2
z6%-{KWLg&d(yQ0KNMWi+{HfNcMlht8Q;rYpW*Hf|-M|3srE~yv1;MW+Ol|2(vPAKU
zJ-H58o^)33VKG0-0WL2dhwe1dS%uv1sZB(Lij3gMB?tma^!@^oXgZfUX|kb#ld<SA
zV^G&sp1~;lSBDyH2_?fu0+LDES0_Kkmz_#j6WOU=1z2}}n(>d}JeZVIuT`A2-5o48
zF4bpL7ydiNn&2AA<u;IqEmve=?R|Ry4N+h3mJN;93=b!3tR=Yle(V#e?yl@8#S}8<
z6Ad<h_CUFJD(f(k4nUj3fcqyZg+lzLggKAxV&A#sdpI%Ff7Q(v>}8;s-5H<v%1xfq
z*#UY4iJN8G=cARQp|dmS_}+(ZEY3c9$M^B=^2aWI<-X4pMmC=*DyK<Mp{v>t3~N^V
zNba(AYpgzxEWHyJa+8H<VxLRZue-*lf1Wy_P3mJJX48%IYPS@OGqW($!_(VnrqWqb
zrjwNIReqgwU${3aco%UdtujX8T8`LjTVgCiSE<0-#m9yr9<H|*ktAY3rhx1g+?IT2
ze?BSIRy%oh`XPv}R@js5G!7lY&^vHq8%ug-#pXNmne>zF<|jW7jPugQpLL=~rxuvQ
z;m_@1)fR{y^CE*pWc44`!{LU58?`ebt69&&*4<Ju+huKry*0{~o1^}k#AgcD(gmIP
z(=mBFO;xL;viOS*jnr&u%Gg-k{%?r9yOhzhHjc@3o0#O4Lja-*2H8I$QZJ3<|KEp&
zaofknx_SKG(+#9SHi^x--SnP{y`s=1jd9r@Ax&VMp67*YjM8nnE(=Q0rJu4&#Y1b!
z63)>o>N$Zn@MSR)=ag@@4?c!iY$(W1F1fmTKK!QIct4?rUvo|kB%Bpw{Xh?*h6|b=
zyVB=`JI~)}lFFnqej)X|2pV&<s_iv&7Nv02?_(Uo;QKat9*|>m|HkamNLKVMz6*Y<
zH?P;vbH8;h1lWn3mANX+l+}X9D^c5}+-gtvV^;62C#nEG5BbCA&BEY)=#flU@KbN9
zReRlw;kI6iN3B{gO<dizA&Gf&1wb(Xv;cqe+WoJNG;^MYVJ^}r2g%XP5YEZdtj}a`
z`{S^_gJQxO3`gN2TWNZWTh3nH$B#fLNElMbFPLl6oNj>9XrYvfTatNfU=v$MC+B$X
z>L&qYamguI!-R%oJ?;1dr=F6IdO0X18g2mHEd!>;I?Xh#tO>1YBv3Yx8Orwn%Z@MN
zx=buK8{?ZGj1P**e*7(ORkW;nAyPM)1fty6bz*=89c$3^76qlKApWTb)c@HEZfa^_
zTP#O=URBzaeC}N&SH1S#tcY=r>i&6Bxd!Ps&QG@@V~#m(Gv-IJojQR>+y%d2o=kr<
zH>aIQ-lAcGTj9p!$59PQOy$pE*mNs#MINuf&ps7oQQMI%B_q3qx`5@SoOxwIZbd9`
zsv_SAVF4e4#r22IA)ha$0E4=C-Gzo@NcSkwo4k*KsFz~IKJB{|{e)>QH#uAJyYwU&
z63FH3<rev}1tv<#Zf3L0#1$I97=&+*+sjCl&*@e&!qC4#7Arc0IB7Z7($9J|ufurC
zc`hWWmPtc3!WjV&3p%?bmu)ny+dz@#cjc|j%Z`%rk4?yb{akZ&O&WS}KdRHUSh(7R
z|9fE0_O~mTN{jnlSVX)2{Z4JepafbEv#svUkKY4WZudf^;oMlGw{@G(p^P%W;nT^i
zkAev!Vs$Ha(~5*#T5DrJMAEWVbi>l5R`z5n=xwbbb0t^4E5_wjpPke`t2sNb!5q39
z(&Q>5SN<_sF9@C}7Ol;uERqXeP7)A$qf|IR{rIbJa3wc2c3wbMVH?9mEuU3_+qfz;
zt5BT!s#aVr-cg>j)bLCAcABZ}_DC=3`-^n>Yrro0Qaxv!hpEP<P+8sw$%V8wqG+z$
z;d>mkOoP%0<MmBBGp2W#v`1RRC77C3b7+gQkp80)xlvBfHn@oEY{7Uwl^<Xw{9}po
z|MGJHOZ_998W0Wm=;zQx-->j5vb*@Iy&Y7Ka&<duxeM4}PF9WwbdC7lIvlyA(%ImA
z3c~rcY(kbJ1>N^r{APE`aa60+zLIMYO*DY=09%SNQdr0&*|1d*6=C2UUjh(P|9C;%
zegPX$=${b}2I+eVSnqWQk!yL`iLnn{=G<DsP@jZ*2z#=9uQAA;gI*0d*Xirp_Q9N>
zKGDP#$K&{Q#~6?gI0|p!IGz~nFRCQA5uZ&+iA!SDHy}kZ<*xvPOxFhw`(FoKk~?Wf
z<bgFNP)r$QoVUlLc(W~P2TCp}9$yA97VijujsXlv)rb55n{e~bQMezoJl1Y*A5C6p
zCtP=G_Nm(^eP=E-4Kr>u=za@B?rEDmJxd?2HwzB0Hgm0K<74Kfw3|YE$(emeL@G~J
z8fu(b&uS^%B&4>0%Yr2FAGbJ~qBHgg*40;<&Q0KvLx&~J5u0Jy?_TWau-Xk;iSL|x
ztRtP(sDLrgUXqZQnh3zlMsA}u@}RHnsus*S@Ruf?S68RkTM?DT#dA)=d-s}u6N@O#
zbA!Dd$jW5T14t^9kiB|dshK(nE4poa(8ph!gZutOc-K8PknLa~Dm{P?i**!HT}Ac4
zwk<p3bDCJ4z7`Y9=qo~OGFKWr-R(^u?(AScp+Qx*5o~RJvBoh^62I9;aEX)4X8+99
zVlyWFp1;vRiJug%uALPVr<@4MOjYr*Bn;%NyjvPsI>hLdE-F~k*cs=(f)O#Z;?071
z{KA2|6+bKr^<CH*!QP6r=URHTd#oS8Sg&eYBTkLxe%F<H;)v19pY}@VD~UvMT0xUj
z*D9SP_8PiE0)vF9HC^kF9KeN>6Wx*nxNz`97x2IZwaG2;@8P5WgU{cxVOFb11KFoY
zq3-}35som|{=qY_lzus0`$lPW0RI9WSV17ei!y>gQ9MGGrCbyFS##Ia>dH{Lrpjtg
zsD)^sk=^Q!4}BN!Z6}%r@ojpJRqnIU@^KA5irwPPnsc3}M=eXW7;X)7`5zp-RamxV
z5@rxxa^^VnUIp%=iswv4_bygT%iH#A)^osMfP0qN*7}d(8jc8f?&^lXcOff}OhoiR
z=<8SA9DBBFKD0sG_d=%F-eN!>(Qw)$%ov{b<T48etN=LyD?pBXPRSKuqX8^w|2TU7
ze`h*lSc)~X;l#D}jgVMDKxoRDc)tybWcg)dzQ@Mz-Tp+<Dq$Ce@%OP}=xDg%+nuQ`
zulZ<SfGrrfVfF!JBkiUfcLyV@O1siM-?Aqb^_pW&^z@pdynK6g>CjOgQu6ux{bvJw
z$RkY^lcb4zDZ)>cyrRy+YPz2E?2n?6*wTuckaKWxI-oiV*%;W>Bi$0_D=(ELjTYl1
zk3na%$cWDbl7*?z*@D%?1uA5Kyn~X%8y8ihr6h~bqp_(~9Q}KI>0nBW#U#aI1lgS*
zRjl|kEQSsU!AvSCAh4wE!f3F0$$VDzTU$2XGt1@B2-(?sn9DM0<=IcHY}&MbL==JY
ze!ckaE{;z$^i^?Ey}rT2i?>EJ&hfRl``2&l8yd};?O?J1siC4#RuzvJ5F{?~f^Ynb
z%;BG^>i<Ak7Baar6pevQXV*%R5b_K+Kv()ek*r3-;Y;V4WMXns_Bwps%EY8H3-4VI
z@DEw?G&NyZfBy{LjDja?Am&el?^wGW<@u&u^2L<Chw`{|!{^l^x+p3p=^B(5XYqKe
zy8+I3BYu8D?67iLArbZqmTZ$BLmSl-;+{#}c1xEjZ*olvsq%T^G(~cZ;UmRera2{5
z;)-%g<wgdKN~wzErVAzIW2dU?lBow3a*J(}bEygq%~=%V3ni4cS;gh$MivZ&%Z(^P
zn<y`pQ@jUJ#CQ9MB8A}(kp35YZvhq8)9i~vAV3Hb+;vDGNN^b3HNgiB?(VJ$?yd<E
zoEbd06WoFm+}&M*<!%1o`R+Yuop<kB=e&2mcfYkxR@ThkLwD`o-PP4q)z$TLDIG-Z
z{B<afQxbM<(hm~21C0OEbK;jb#anJ7f*;eWl_Wes|14(YU+o+pukp&@m6+?1{xrYI
zNA}H(7NPR`x@3-Srbu4Vd(71=cULRFH6O)1m9hSJ4(*oSDfy*ubL~?|o6I-Ic&dSl
zLml0aHO^QM-mgIkLX7q8JOUWJKAwI$MuOWl!9yTE$%2?Ru|fbkU@G&;gA1p;_Sg11
zaAYDM*uF&lHQ@q1bj@o>#+rFp5r{HT5>AIyn;AurS>i;pGkY5(H~e(#6fP#BdS8S~
z%Bs`=zkei{1MN8`35g1?*b(^wU?uC(<MWNhg3k%c*WT`2vpFxQCKp$3YPALB)kWo3
zc+dh_kBTX65lGXoZ{e33`g7um(3}8}WLU)yiXb0!w*t*QrLfXj)fg%HkUfT|Q`%r`
zV24yLtW__GHgaWMK<Ku2a#A+S=x1q4M?rP9PYhj7EvFym;_hY!?uadtcb9IuQ`~%^
zZc>aUr_IQl{I}!YRcgTgqB8rx<^)EI>uFDy1vf39$*Vf0ZR1htzhDDHK>kwex~C`C
z>+6znn(lM7smY)_*+tw}FVQ^WJ|V#|oil^sY-nlj|G+&#YwYrM|Lts$)SPE)z{+vh
zoaiD;^`wez-*Kt-i)=obm-UV)=iJt|@cgCT*Xttzg48F2G>wje4MreqOfv)`#Y1Eu
zjl<`R_E*yD>DbR51PM<iYgWB#8%8;a4)W|;i$r9=l(tWHD!30kEX8>d^T`)%u2mCN
zP5!1{hg;ormg-E?Cbg<Ur?jE=Q<EFP96W7B*{~-#gQh{VxBnx0iNMa4plVKQ+v#-&
zGsaCay5!OLkfv4L^Ma45`Nrxg7I3_0P48c6z>a9l_|xxyt}`R-KVsIuEuG=F$Db#g
z^y6o9oB{IZP|3{M&uo0wo~oG0Z|#*M{Xl=%Ff=BCH|+c$wlM#r7U}<{JORhot%({!
z+cAXH{@*e^B8U{D(<MLX70?{J+@z?3RU(bC;&eH6u0Pcf)K@1Dn=Op$_ck=lco~gi
z-G0`ZNUjxVPQmHtmN>Y&<SkKF9t)qjHF*2hBH=wLRvK*_DAL7DAMRf6nX6Xil-lFt
zuMU>$ggjYKgvkfE4FI5g-}fEl;a5V<Spz!@Ke;=qly3UPRT=Nz+Q;IM%+;azhC$Y2
z&4HYc<burHh3^;hkA*rPU$hjvmmQr6y_@yz3qeeD)cyn4Uf;g^$T`AS9X))YIkQpu
zS2R$`M?0r&D|M*OIm8X%+y5B6j(YAr+XVkt3zxUZBV0x?v+x_2M^X;=f|uKP2agnW
zcNj5dc2$GMk#^eK7#_C1dDHnx<0`PNTXJ6$Zes0XXdB5?Vtkd-o^yO_`1a2Mr0{<E
zbNbNul%YZ=3e%4k^vLl!7WB075lMs?aeF1D??F=*<OSOwDB09t@ij7_DNQW^MKyL{
zN?t_;_)vqISz{sgKnE<lN+Fw^j0Xjwz05Mu`I1}f`Fc9EPj{amiEwWu<;;a^26f&_
zbZ7Qpr|?$oc|71*DF+-(pLf=otMf@Zon2BC(3g6ztGV*LCct021^7-HP%!>qM~lG!
z18E?&CY0-FyejK)hwDw=E+o~z+MUP;l0oL%6p5E31~?$5&P1&sL<<XTb8aQx<i`^s
z#_>t6=f3?x5v80U<w`-u%ljVUna||JOB<%Fx3Kr2vJKt@0lvv;$7{QAyb)sJtR{(8
z!iK_ws0J<Ys<smS-b@HAg6#VF-MH0gfc}q!3k0Y<VG9}2)--1Rk~@*^^NQ}>W5}!g
zb$Arp>t0Mk&a+AAr_j?NtL64aQF&pv1|5k<B)KopkPYWXVf3mDvr7>Feb^5ZE;pjV
zS7{iSj%;jB%lFaAosjw}6V%N$GNl-b2g@D(rphV97xYg7DMCsYLaQ=)L-Z<JF-#K9
z?nwCs+PmZ5wW;P%o=G4ZVYB}L-LFB_oAxp(T%@@6x4UN1iHN{J3c+pOwm?y+4Nsae
zVghbqoqi$3$azV=TxrakR;}q4Db;ysuae5*+=#{7@GaV~2SOtdxbKpbTtY-M^P?Oe
z;4J+&>Jj|%4dz;1=sm6Dr$rg)?mQ@Tc1iXKN^JBDl(iV!pcGjSqPJ(gunTN<TU7}4
z)K*ij`KmMgX(Ug#$dC}*9s&LP=PFlqFd@y`6>l>M=kad&%&)m$%JA_xwb*wRLff7(
z9^)S?op=}gItWg<<2l{vbN_8*%ikJl@5m<n8?HRd<pC3Na{2rFuY-4tw)Pq{ed?aU
z3=ImB+Qo34lq)OKP<Nd5+M3)@8-AHrQwNZs^YhwGf=vpq+!Z9SK2e0@<>8^zDn$f2
zNoz%2gPi0~Qe^s4(%Lhl%{Z}7kjqXZWHcU<AlqH#E-Sg&E1oH>86W!MvhD6f^_rXO
z6-j8}V#gyo&R%W2?K0^xt{u{|bw*9Gqt}geJ**>Ir?Tr%S;%5u^qh-<sxBkIAVdEq
z|K-0n9set@>9>;n-hK5U8=|={+){LC@qz-j^W|O!t~JDX^)+1+hZiqzU--_CxL~oj
zeV|F@Y0OnWta*!Du^*n}1YzgI)MoTv2nUWHmnAJmU3GKugx_mVfJkucmk2$C*Xui&
z`OaPvR#~cyOOY0DkCw$<JV(N<54f0W2m49lL9sSUk0&F7%Nr++$%Sr3eTOdW->Yn~
z{9TzxRp}Xs<oZrnHE!!u07$zZfMJvVpAkOKOW)CCsZ@t6HS)ZXFi1DXhnudHyj;H(
zB5sL!a8r0dQ7;Bf*CpPw@i+g_$(5jiCd&?M(yPX|cx6JqnZJ1JJ&;3_fBtqM##EaP
zV)I&!O@&zY9p{I%4cO5|Z~Qlpx7u?o_)@U(7Hk2vxIOt)Ve2SW6HD(HRbxvj2(<)*
zsyYuCN@Hnk<nU9>mCr)-sB4s2cI>mKsyTKwrF>Gin$);{(SgGfbC}VTYNCEWc9mCp
z-2JB#-W_jSR#@jBIBn#|z^M`SF!gn_l<1gu)K)`Jyz)=8SM#q`K-BSZmxv5rVWr5}
z&oOUP4-t647lMzMUnO4r4`ti@w!5_`Pbx7@Qj2T<l02t|p?@rm3^<<qwvTcpKnFi*
zE$rJY+1c+=*t%y-);#~pFPP7W6?$6tU5&HP@LYJQiI<HJk(Xw&Fz<TNZFFwFR=4K9
z1eBrB`3-Qs-rpa98HWebXaT32n1ED0bYLDb0F~}5v1=0tBGa&GOu<t=bnAXQgW}#6
z*{aXiDSrd;nxbLrNAs6X&y5aLY51C#SveMOwM2sU)pq4$Dl%0&kKP`ydZuM7USr+z
z>$E#@v5Xc{3@^8P9>JsoV&B#he7^2Z=X2yIaIfyI7#sIYn__yN4LlwdnQr#vR`LuR
z`ckjlZCQpXZ>iPLGBXwL_`L9EVMewn8|#^Tx2Da1;M7LTIhI*B<gNy0u%U!JyK$3#
zQ3iAz?)8z+Wy#Ne35+E@%@3-7y|Ah~m#Qm{zaw6kX=|#?h|QI;VHfX~K}Lik6CuPH
zK#H>YtkLzHc9!A2ed@j*)C#iJ-SIJs%Rsx6)g4BwWgE1k^PSFJ;qF^w*6rZjy?S~1
z<6By)-BQe}L}2qh1!8CSG4*~WqV<Hdh|ZKNG2#1Tf-kI=URR!GX64_wZV(<Dn<W2Q
zNvZpx-JH)|rm4#P424!-SA_Cfxtqr;32y?-V1VoAAv4$MOLNcgs~M+t2T1hRDM=zV
zpQF?C-XY{eeDi50WYeR+{e14uZ%r?v^qydquT<IY%W4&Rp2<t(bSNDOqJcZj85qF#
zq6lT+*P&BR%CQJ6=B>ECb$L1m>zHBiuY2U5<obCFZItrJV-xLTAj1T<>{*_vl$s>{
zz|#T!>D+n1$ca|%Q&(&!uLp4+Y$~fI$}?&+n_4m^QTJ=^zm}#c*WE@a(8E^#og^;v
zeoLi+e5l^IfFlXgFUO|j05d*(EqVr#do4b$+>oa)umL+0;M^!8+a>9Nf6^(FrC<l|
zNl}xBi-a+Urc7~*R-?<s$PARtN&`C=7vgbCQLwXv=r7*t`e<gU26U!#NB3}=3+)3*
zDMr6EG)|wYj?B62=e$gcYR*UVv{_l7=MjnmY#v(I*|XH&&^1f&;ZvC3|4bJQ-24^b
z|IhTTVCCjuepgx$Pc2PrrBCYIcYHIglY5gxq)cdcmXJ_A`03Rx&hBrcTL*}WviWXy
zI8@}WT)wvy#E{d-Vqy?0(g*sL+&uAq>geKU$LwTJFB3^56x=)MOYYyqMBByXwxq>#
z_KvJJbe@Ld0~hPad1>N=zyg<nd~J-RjbS()jISdFS9$bF+XD6xv;Y7f-~-Qe;L3}e
z31NjC=7D?yn^XkmcIo%2Qo97;I6X<l5A{0$XrnB9^)%{=HvOE0V#BYeVU*#${M2?e
zeTjFUU*n?i6~~eBZv8$&<SBAsZrW@qL~9`ufrv!$5zgK>GxK*DgVMy2^X`zk(qH*M
z%8xL8b6P`WtX)EDSq3p&Gl_hID=z&oS;DSz7Uo@yT@csHK`r9YvXHFM_VKcL-GerS
z4)d}m^%E}%EFUhZxD=xB55~8#?&Rq{9*5dBL)de}Cks?EimQoNCE8jGrwpr>qmR_T
zFQ|b%L(<j1&s{x9-yw4B&(3#kxVrO4jUI9}2{J?^uP`%469VchKYZ@#A=(H(QNT36
z_IzwG%D3om+&fYYV|(#3vt$M_2!STu9-i|G@Waphg=AqGH%w#)JYdirGTIa*u4H1V
zCp6R+F-kg$W=bi|2lzKZnc})5zkbgrn_U5LqRgVy^-ihHzj#Mma}+wK1S`EBcCABP
z3F;ZO=VA62L2CBT`(H*GJ5Ckt$@FJ%Kw%C_fEEKG{{Pd4|4%>LWr;MMD>alobp|>z
zE%d8_cy!D*sAhY3CaPy#X2p}@d|$_%7?uQC8WH1-+lq>wGKL~1Wqw!bO1f|ZFS7lC
zOOr~21ZG~enzisH91I34cpAjR(gb!3o;0fO<A7Ka9tU(RhA;HS<*!ALm8ug*^P}GU
z%$C1{e;tFzs5FrqUfPXkz#CE+(ouVfO}BTzIxaz`6VAH^RlH?<gR5Z#Ehj5=-Y*Vq
zXU0{aM4zC<`S~8rWx!i>QnVK%3k@d2x1~x8Dj4;0qa|;jey$Z#8JcddVWH;3b?HUQ
z2|!O5ZvUG#^zU5vPxy_r6thNBOc2hK`qMnuwgXA{N^mJ8dTMT0E2Fj$K7KZ4z`k#R
z?LorBhlea~YAn1lJs260LaY8~?r5heC*3ZS(te^kN$ySQRG{a#g_eAY4X1mtiQV0$
z#(A$$TNR&XD7_hxBqGAD763!j7Sc6QR*w8=Tn!kzX3|d{&c8&{YbGYZ%?YFse+H#*
zhf+qb)p0Dktk09JybFk0KlT-@36T&80zgV#uJP48OQ<zcksfa`08CO$tQ$if)z*2q
zIH{Ms_MK%s_nzeJ%JU2F0VGwjxR$1AF@v&hw%=|rtQeBYv#j!bd<7?>2@A)Xp(gUT
zCGMu@3R1~z@0ccy8zb4Gc^Dpvc83{|S|i%Vs2cRRekKt{eiB^w3vwW*IcZjRN^Xu?
zZR|lTzSkfm@4^r`VU5#l)QO?4RVBKcBx}wBg1mGKf#6)vo(Q)BIZF2>X@WR5=$r_@
z+31~`iQ!ZXvGb<9_LIXCuWIE1X}z1AcB0x!toD6_C_%fR7JP~~HhYa2sad+dicFoc
z>74Arb<C_=$M~GZ_2cWNU>0V`$JzSW<g=-muSukEnu=)WXXKyGdmhJi8EigwuS--l
zxlL4ezod~JFyiJvvc-HY@?wNuED|mKt~bIZLLr0#gTF7m|LUd2!9lVkQGP6)bSIp;
z05=zlYcQpQ9<I9Y>pNo0@Zaf#CWkQDs^7rm*Y()>Pm6&6jcf29MUxCa#oa8x%FGjv
z5I|$!#&eg^PRFjsVGN5J1d`b&jxC9`3KH56E)ZX{xYsE2$1nO)LmD!JV%TEXVmoCv
ziI2BME<IdHjSJG=igT=D*1U68?v#lmpv{NZgbj2mmk3V1%i*O8uyce-sDZ*uXauJW
z!No6B0gxGHYLvBNB?;wTJgsPE%gqdxxz3fowTQVg2{K+f*!!^Ts@iz3G<<L_k*Pp&
zv<s$ZFp-GUd+|^glKSeV7q;8#=IcG8a0)aSH<#tqt&Pc7XI5#$#z_(6_2iubAtGA3
zw7-_Mn$=!z&P&8$lQ&<|F0A+nsYGd)F5EPqb7;(kXE6Kod9?n41Ckyf{Qw;7{IC9|
z1pK>b+y9dT4E~pGE9T;!=3*nLPRli#Cc~U`7O<?r#Q=b`BC7a)(spyzy(D$(?MuJ3
zsgL1VPmc#*u9rF|tzSZO_SJb+Dk88&H}InxeWbE`@p6FVYWA~LYEd>#nQ0QH7Q~C0
zd7+@#*FQ)*fGkS8`xAA$T1hZBfdLngGXJQX2$1OL8{m9NPVM+>C;6>|a2F8r2iIU!
zw4hmkwvc+4y<?SAGiiNE*W56LH$p;jOAH_~%WufWC%4G`RPUUXL9f7;oJD_$cDmp+
zy{qe1>dwYxcY%4K2{FittyCG&PLJ!Iu9H13;e;N}FmC*$X!sqn{_&$Vr~CO?)#n%~
zE%~?UQ$;;Fo24XW4+`n!rEe-5+}|n1O=f=k)CpwwR_fKdCAiW*Now4k_N8m7TXa7A
z>h&g`n!g%h+nHwNh*5>op)%Nm`a7o`TJ->BGH&DNVK()ngdU&9ObJiCk%+^4(8`+t
z@$u}BP12%TT5rVVXE!bx9pblX8J&jZEl)-xX@3fa3~e=-XmmbgEh!vJ#rcjcy{kLL
z3||>P@U`+G84B8<gH&&RibczWSSx}_gZEgh`suCuX}=tK*pX|#%b3mgka;((Fr<+w
zGwk#wxWQ6xG9h8lL8SoNE#eG#0lroIGxI96)Rv|u%_ML&#Aq}|OmR$(D`Rw`w&>tu
zaE9|aHGc_=t#8pccT)A3cCP-psU%upF_84`2T~)MP*=&P*B6o^328WRk2*q0p175D
zYH7O$ryQF{Q)AcMU4oN<3{tRiuyXlq!>^3pR9lSp`G_~V#vC~BNIr7~U71W;hsqdS
zLGg(jD<&f_YfSetoKFNL#Dfc^TVUg2Dm1E*u*@h@%s5>zY{)^0|JPMqNW&L8#dM@N
ze}5k~tCT5zJDV483q_}qk*{OU=)mg;&}|^|&Io-9FN1o=it7GP=67w5le?S@`#$e}
z9@%DDTeTw;lec4RH3OK$7jr**kaiB%g_>ff9}2D?_0o9Urk$2`1iB}V(@q;IknCB&
z<Q?BiJ~o^-lzFL;X3$$DXW5od-?!ldRvoDQ-#CE&K>@=5kZ0~(WZ~(21b;kO=={_Y
z@Q!c0jl3<xDN#kPG|GG$DycoW7^6N>eprKo|4|d~Gu-#>Ed@h9XHGl34Yg~Wj}2ZP
z#$kOu8-|7C>FP$g?ls2d-zF8QdeBx*6s#j1E-x?0I3tg91p{7w>B!Gjm%8z5=bfWx
z0CX?KmgdTVPb=S946@|uwMH)!<aD0@i#<pPY^Z6$$!gJcBcOWQj@7%*6k`OEV#xt6
zu3O($VMq(&c?_%6Io^An76Lc-$St}XZ8w3RrepFO^bYbn8_m8p%0Q~)WuJvKjZI_{
z+*k5Go+kn$>m9$^!Z~RtT{K&Lex0&Pf3hw^MvN(A|Lv(J;Uu$|MUkqeT0EdM1NbEq
zBL6FW)&D5k49d%TQ<S1m4=Tj%ZTOL`_Ai4#3Po!R`BGW=i;d~r%CR4753=Bn@ACtl
zH;Whw8^RCtBI|PEeuFQC?pE7wU|V#BLw6YtKUw3{REZ{INcKRF8k&FLmeK#fb*mDb
z%6~uoPBM=03}a@LqWyE6Mxt`li>=iDoxQ>1x(ylr@derO5zrvW#m%tm@l9?{xYWzP
zLTCTY=F0y={K@|~PWaDO4&F^+^4R&IV|;a8Wy+mlKAoJseXGfaq8r~WG|aVQZk_aK
z^~HAf;Y3>*PdR@MjLrO@(+IY@+<4T)K1)~5HP$TUQHUpHT3?Gmu2Lrt{;?5hR4Cu3
zb$AhFI-wHGP8ym}hlFoXk2Q@@e_fi(F_PP{g<DBXYc~4@Qms5i26!6&+P4F?>;NzU
z*&nBw-)gnQItas#M8rF`qq)sa!1q=ji$;<jg!FWS?4&@fk%wJa4J*tth7FEdWV1)o
z*97s*Y5z-F6KMD+t6)b&_>z`i8sMK*=Q)G_Cp0AgyUqW8#~WEE*S%HMIYLG8G$DX3
z5^ujBq1-n0-m0Raxvs4aM@yC_hQ`<-U`J#_J$CXcMP+vAbxqP*teZ;Yc{+tsuk1J{
z@xtXvLyfHNp`M4Y(DbF#3|*Ou)Ty^hqgYW7l`9w<`kU`^1XNePs-t81#fw5h3`+rv
z+|u@mJAVRNY5_ZPk5+2M_#B?9g>8T&{K(6g)W_WOt8&g#KU_=ZqP+>SyKiCP;s_@8
z;J)5}5!J)$W<6WrtP*t_>uM3e2}SzfL;LTC_Mf&-v^=@0T=JT}`jkbZoNX{dNMpXj
zMZ5R-0N^S(mG)42$E|=W0dCn-uB;*shZOU7q=#62yy>pCnVs2!Np-r+I`|=L5yeEP
zOB^YRtcb_fjkmE1XOG&y#-Iz=Cuu*I-+=%OZ1%BY<eo47vlf^rhO`aOaS-?&nuI?0
zmUHIkTe>#py?M{WZPT*}Ld%N|^wUizKKH|3ev?}=!vF3N^CkJQFds%Iupt21G<G%B
z=$q(V`r5`7acQapINrAVg8mP1E&QWg82?{AhvLsHs)?<!le43Vfz8vEouMTv7b_|Y
z>eB^3KPt0|xq-2Ttr^6_-UO8ml^ICPZs(|CZ(wAC$}Dc;YGGueEG3G{Ea_rv<ZNMQ
z`&X5}-~7FfxSfrGg)QnwfGR7h4l1*<fvuUzzuZ3k^e;b)u{{0uj+K?0i-Vhm>*<mU
z%*Dpd@z*7og`J0umFua#80+5(vaxak1=xXtY){2F0ZQ-KfU2BeFxyi(d4RT{;8UCJ
z9F3j+s>Aa4e;iz3FgrUNP=keqiIt6qla-AP{MQ`|6E_=}lZA_m1C<SE0viV>2l$Da
zgu64)KL8bHM;DX7eds)q|9htawEkzOxfnV>br`dZjREkg%<2}#&gQ7BoID(;%+e+n
zX6DYQtUyct@48dU(ZB<hS=7SWNzuen%+AK%&ep`%85NAm{K3T544}dVbO)+3(B&4^
z&L)n)x3z(@iMWZ8ow3PNbN*#0-O~?zLX0vl<4RkLm%cLft0ptKkq}s;6%fpG;8^aw
z@<fS!Mk4CDd?vbN`+c@<cG2(3r!9?#{rv8T^XoIhQJ&<ovNAOIgPoh9G$&K@P)Zd4
z|Nj5qJ@8-K1FbXW2Q9}5M^aC`rYLXzrNCDti(?ohx2z}5Mup-(!)A`ePjX}8b=1td
z!hVJ<@~TTsWa8l)eU6OfGs6u(lMvHSbU-=ER<`=B>l^rTE<76!Sx~^A+c&r`L|!4D
zzV7+f09n4iDvP7K7!5pPX*B2c6Unmd_q$wvP>_FxD58yd;rFLZN~s4$9`WZ&+qdQ;
zzcFFmK0kvAw3~V0@2~WbE{JAiWYKPvw}N|^V&2r2QNFpiQ$l%-()Y)4xb*4S-h|*7
z$GfJl)8>Y}Q>o47;{+Gw#gmdoLdRc-HxnK;fij`Y*hq2-XB@D7O+*`x+sU`t7HbS;
zob4=f(;L!$gSS&wZKA-_ys22EmC+i&(h0N^=#^n4Xz(2sDPIU>f1eBhZfKfS<AlfT
zzo?P(vbDEXhV---$_4DIv>+uBf_$}9lw?sb{>*cs)4Y#_#ak(3mPu1Ty#dN3PHtko
zy(i1zio)S#9vSg=<lHZ5YXnb}Tk|hnIHzrj54kS&{*zA~79`BRl5im~Z?wv46s|sQ
z-Onj09n}Nh3!*Fd%*VFT0Xm1=(zXkY*BAu?q`S65Foe+1RVhvumvzw9$-<Da1-fEx
zUvfq`>qSHr1JEs#YdBSehH(NwtIL?_&!m^Ld}=52%zUg*uR%7ux6Sk(+ozbZf0X*k
z0CLmtwsv|Twbk#GO=MYtx_6+=bunhYB?Xd8sXr7yX*eMy<Z_oW3aG${-*}I{P-xdE
zTJzAyE0N95m<uPf9A?Ss%bHi;578}u|AsSc@{Q+ZjKLr0$tTiTm`IOGi-&d(j7(ye
z(8#0fyUa>)W@sdNm*j{{Zb~b;a-JI#Q~bRXct;E+_Tph*(d}tGT%|vUWv7o54*0Fb
zu&PqH1X?Th?7ZNlQ@J>Ku_Nl|KQ6{RCdKT>_9@~_oALO5OF}Q04|r8UWEz1u!SXu2
zrsX!ilCcQ8a{+`*&fUt#6-EPQ&K7-K+IXuuDlx(Qj&Rk1ug-rqp9WQdXfZJZnd5sy
zoUv3s2k-Yz>2JFx$~W&7mC!=-b4}O$SbsBWlKpNIxr{>unB{c0Qy{>aSsmZQEoeaU
zz5CMOKsIJ))`fNb^z$CgsF$(#ZNHMpJ-E5K-1z1jp9ZTCO)sV6da*~M=Tp$f$efee
z8t3i`p@Axc_0UyuipOpd4s7f<U-w#cQ^a9@YlKa+Z5j#B-age_{(LVmrAH)tRUZ?y
z=aA@geRaGoK#TpmN632lPsmG#L}U-BHy!4clAr&%j2wj|<1EhUtor(uRNJk&KeZuQ
zBrv^i&_?r=Vjf?#>caL0qHY5Gy#222?uXGIUnwT{G0%vZ5}IYndgsN>)N}-35k*!`
zeY(O1#KM~0v(|<!(YQR$j+vt0)cv1+xJqK<N+S8a^?YRE*S3oHY)(=uFM|rkTd?Ey
z3y(j^h{DhJA!o2m*Y+)&^>g~0)yq%xW8!x8Yw*3H0?}x_^R%(jInjdgq9qj|(Z-(<
z9{5swPYom)%cFh6+I;$})O3cl665O-nm2n4_r#0NA83!(;zDFZMDRv^@6XDF`gMCp
z2zv<FJ_inF(rQ$Go>C=cu?*fbsq{Pze<D<@n4*|(SDQ5X>2=00qgB88@kvU}>}nQj
z!rGXt*}juL`&%@MgYrR7<4=S{ff|jD7(_4*sS*-CBaTT5puhdld9&LVG{BRb+!aU>
zySSv0#?p{Hti6sUcALoLYkbgVh<5=dNaxLGa+x^<gbH1)Gr0rS(NpPne%Ry>3Qx>r
z)#0YP?-~ss0l5k0XF;@GZoF*b;SgtH@@J3~A-tl@x|xVm`tw2uU+I!nIRdl(D9P{W
zPpFKm@p^7m;Xa>w9tJ?<54x=}B;ji|$85i+(a9}DAg$y2GVTjkI%Omc#QY{<FW;Tz
zbxziro#A?M+$hCtNV%yR^qOWu^1cbZ8&x=8^e?s+pQcdYiH>fHBR#zcdFUd(dT7pN
z{U9Id%KGauwyyGGd`IK)ts;4u^!I11nXnf$`IAQGN!Sq@)g5h)33JXQe*n28f)=dK
z<I$Jh*1@t66%O|7eAtaVc(1=?%ntn)%<4gi6HZ9NzD784&HCWqnxj|VfcT6?1$hC-
zNr2ye=N80WZ??)hY3DL}`ZPQ=c|z`AOUE{&beGzLoLCMFqAGrf5OrF-!|N=nRK($w
z@_rVnlc@FWJv|apKRwOy1I9JC-s}ba%UF)c_r-9=Xixo{-B=ZeD%mW%NXzd)2-?Zv
z;y#i3!|@e{q--<{AHbSPzPawctU%=Q8XMcVi-_h_N{)h@e}w2-u(MO;TrQa$-38!O
zaS9l!uu-J%FJWHlCXz7LjtRm;wvgQjB^FV8u{$v#GKy*1^{d-@ZwbL4`|A(lY+ojk
zKU}XwuM%npkp#qk%i;*xhR^K!B78{^{3O1WMt|Gxv``mOD-4b0`Ox3Vr@I@`94hQm
z+Z>u+SVcG(g*foD!w9+A;--U`PE@p`E*P-fX)N2!?nqyVMpax3lR41BxQ29`ID8@+
zjGtIQaIRgfjh%eEWAT++1FLe=YHk|)iB1c91hESJrvgIE50QS<k$RA@NVm-pq9c%p
z1@}yD?AM1*^`^!+R;gBg{IV|}o)#hTXRffb93>am+zA;x)B5A(Us^_tD##q--B>=_
ztgNh5F$kK*EV-#PyI@Mzwt;|R+bPw87|SX8e4aBcTY&~@KpDtszy2|-UGVj$ctf(h
z%A=Sa7Cnl>%rE)DgZw#lDq*=`B?ZovZtJI%K;;9m6zO#S9ubPLW=YGV_Ey^#lce-B
z`yl~r9>uR%h$7Y^9ApKdxKcP*NI4{_XDf}tnj}1H1jL{Mm36@s*kn&&e1LCa?@cr2
z`c=^fLl_M^a-@q2*AH@|ex8v`sk0%_I@ZI<Fe#zNu3xTgR{$l7VFbveAPT(JtotVx
zwuc?Y4>lwa{6@S_p&*Co1kq+qt2cCPx6)xFa?_0O`S@_x1oM@YJPl5k=t5+;jC0Qo
zL)dTq!uThnc?J+6hE_Sp^h+y5N$;bZ1FU$2HtHG1+qWQe=rt@o$o=8{{bzzaJQmih
zFUC&_uR7b{9u>)z7nO@+%j_}(d(E#~r81by*FF~sT92!}yLNivKQk8^-p0ZmjC81c
zITl>5B*Df{M0{is*~F@()RTwf&*JZ$s(6<AL9sEG`)+dS<VT@4i-@;3CzqO%G?##+
z%6O-kKV?k8X9IH6hQSJ|`w&BxSjteQkfMvumy5Y;DB<b}Fx`AENozO`;@wvGb?88Q
z>d*pKxZ!xiDh|u)0OIi*_3uPE2qngTk(UWlCHoz$>U(gXHy9Mt1cGz2f}(-B@DWY!
zvT{C`d}!4ht5?6OZ7j@sV{v}N!dctyL*6YbXHbmF)o!9M7w4v41}c79q(!n*ERJ;6
zHLGrdRNWftK<9c?9E<uMp=^lr3xCR5F6($9Tw8lX^z@s-_w^0GYhl^XoF?~GaL8VI
zf2)5L|0+23nd%23f9W?5gJHtLR9B1-$Fr$J$ZG2uK8s@&gCPL|XYl8`dSuk%nvcg)
z^i(Ko3^98oda_cqez`)Yg-+>^cmAFtcHd-K(MuGbo3sz?RCMF+tdu|N>)r+RzsfHN
z)AH%MeV2Zxv{)A&sqX`+n5%+qtBJ+=7?3}8UcltDi2UqC9TqRpR3Anmr}q7+H-|}=
zm<<F0rXTeRQAQ8N>_Vldy5+h}OUPgB;8^vvcf<HfdFV3qhpM&j?;<8iHBdlN?!0-D
zmGi8$=&LS#5jMAn#Ic%42MS0KNN|rGHa5I=7<ew}*tt%^*ZMPLsE?mT0Dz>YVA{xT
zW<%#nJGy^80n8EMH;ddMm~2YVhdaA42NAH&R~ZGz{mZx$^wpBEKM%J7^H<LzkDWBx
zdY^bb4D8q<J+o$H#9B!FzAFwHg46n*kCT%#jaEheSrBC+D3WfR_Q77(Aro4tVc{Pn
zx5QsJKDFpjtsP~y8rNV{e^edrMU(y0yMr6D%@3>)t??&BFJ;sA0{k+X)`|$<E~^+J
zaG&{(>4l<VVIBolepZF%F^Q_t3?*LUPuz}C-1;j2e1jLXgIj`4Nq#HcL5D0b-hVzB
zra{J1Zt48B=T9+uB|;o!XgOHfyR;wLMpxwDtrP_{Ota*mm~GEmYJ%G9xp%nJC-!g*
zg@1X0Dne&4G*fshYKY|{(+VpG2c;tI;!s+g)4vvsHKOSKTy(nOrZE5_%a#k4iVgW=
zc5adMu>BfP4^O8=m*tu`sz#jXvy?6^*FqWOGO-nEsMjk+^Cu0gRD5*Zx`}=ut%RQm
zGT1%yj-<U(2S?ODOY?uUKT3`KBt17HN1_hZ<0i{3mBreZWQcI<+QnEl>G3mk1m=St
z>k3JFN{AcIx<$r-&8bGmPZ5W6t~b_qwOTD1EK;Bz6&SMRxP88on1zwr@}->KHEozg
z0qYQKL#mrRjn~`uIqck>hcu?L+H%SSqbNFaT649sYWD-sZamQ>y}|0SVxQC1`qr^s
zc?!Ad`%w<U`8o?8S9-723Jyv@B$y`Q24a|&2c>D!Vj1B6i7V7fdZ4QHswX$_`EavB
z-;LL++^SvvB6@OzDxzN>Q%^AB&!<;T=q681mk`IGN?UKyvJVvC=U*duG)$uJ?F!&9
zyuKn{ht74|lNlWA4E^rp+@*PmWfuE^QiZko%MhP>|HY2R=26m1w~IoAudU{k1Fdv`
zHhmLr@U11zQnF)ZCzYgAjm7^MCS&_yvevzX?RVgSMQ4xf&6c1QTW$>Fmg#mN;}+T(
zR4|SG&07UzZ0XGaeedU6sa(CJ8wUFwp($SN+JxdUA`<yY%YNgW#XX|r9ujrCeduf`
zK&xMfn|l{Ax2|^5mn+q+<K;>}Zl>O7#FMB(rNJZ!zig_8;cSL}(zDa}wy)Q)?ECen
zKW>HzN5(l*y!@!yK{3<%MHE2|^@Uo^fvx+73ON=dFqcBiRK$Gt#$N-k5fAd=>*NN{
zta~U=>2&>+s|RKftN@bw=UZoOC&?pI^IUQVp={gbe$#1(_np|%*7hk>unO}^hDl~z
zW6=C9l|or0FT~ru{7yVYAV*m}P0TJi2J#&wSE9VAUPevj1B~pZ#5J5!i`>-4jU;O1
zHCC_tlq@H!?ktIlg*fNo?^a7Y%U^Fh1I3VsUv%J|KfBXc*eLv@v9-nU3~C*hHalw>
z;>J4>A|>E$KgBwv(j(S#<|x1tC>8GJ&S>8!ByJ`U766#C0$;#c8L6OPi0W7<7bNWm
z>)b9|mmq_DlV^VD?U+j=CN{`arAntU)y;-VW3(>lj4o?n;`yDj@NDM=im7%L*GLB<
zgHnjyq2#P8XVsTbBSk2SZ}l%S1h!2B*9}>0d*t6wk70rdy^xxh#{8aJfc^m{$=_<Q
z73{gT?ot(cwB)J2Dy)v6)ky>jRu&<=9s6W<zN<u+=M7zpZIJbIF6!LP)t$*GO9~;{
z!kMKXnZ!y`TZw{=&>w5)EbEy8dX2)%sRoTMOi>r-Py{DfoVJ{5`HHELcBm2W@zU@`
zSQMfBYXYNI|0*$k))q5x+7L721y-N;Xh>8UZ$uN;HOii_x5Kk0H6xynnPu+I<76I#
zFnSopiC!jPu?!+G!`UHekm~pu(eSOe23t)*Y6JOp)8m>X=*@C-A~~{ThlA*mlkm^O
z7!%*%&(j{>`8PA6`itTdu&1pY*TC_zowaAGX)Q`L$eax>vT?twmRyuZj_&>49=B69
zuCm!Fz^HK<`?j2oYy%yTpMfWKhChe{2w>LvmNYLhDv*dLK}};(HqKW?736%=g`C)S
zU;{c@Mq&|0LWK(i#P3Db&pd(CDOAZXF;h=#4&l#saJ7F+IPvKTX8&0;(ioS>P8!6B
zLE8GbiRZ>agZcD`zL%<EQ}Bi6#Glt#ez5L^8!=uN7B8ieCf*dMqbuC}ewJiA6Fgp2
zprrF%<9qL!gN00HKeE>*ab)}g*353eOzwL!JRe9<<L;GpO%6#NLQ7O$r6~5tF*zm2
zaU@{wNpcuO8zr-C1i)}fMgV)PBk4HZRo;%8+7CPuC<h~=jh@wLjar1tn$wWv`cHJm
z`>Iu#AHSCcz5j;wkoG=|-`N`v@jKiZOKHHuiZ#vigiWlsm=W$8{H^0;y9d_B1D$j+
z)>0X}(r#H#OAca1&FC8;_fRnv(oRKE6#G00ZIoz^yf4zqo$Anqg-<h|`V}35u|vFL
zuE!<}E5!91nwgnXVg@(Yl|2;n<g$1I7%!oiQxqCYr72~w^j?S>`APpir_LmmCo-S^
zXO;nx?#pD`92<bsnBkj^#D&mY(4&7i=F$_7$!S02)*Y32VwKq`OZXX(D>qQ+TA;Hx
zPiVu$2nJpb;JeozDBQmvcs=+y&A3VQ%l~Dpy-<bs)CgGviGx;92-8P7w4CVbZzQuA
zm~Q%(N!-p=W8zO!U)b_bG^e%;`2Il8#~<OEyC(zuM%i2JSm&Zn$wGoxtB7NUTYaQ(
za@2mGx+*yS8KL3Vmia3D-A$XDFMIJcBKSBV^-knrqU+JKGqvMmUx@Ei^KHLqrmeGb
z>2k)?dF5d&+Vd~aU@GkL{=t8;qawy2BVSPQKOL>^Ece;lL>8iigmA-97d&N6LO5^T
z>`b;@$4XDSE9kV%8JYR?2&EE3Y;^kG50FaId}b7)f1Y#CnuVn9qx2&UmMGAC_V%ay
z&93I+7#U{nLXlCPX|%R6Uf$Sb8~Ky^A-<ubZTClhtgYY+Bx=J^%qXfdx^1->a$9)b
zXIr$*zx~2tjQHg&2DgG(Yi^Sg*7EgB5QL_(<)Kn;Y184()rYFZ((id+Ud}6{7#cxi
z_sx#ZTz^$D85XHzavVCbA#Q$2soWQpZ38gqP&CT;lkcZ;b-vDANtP#|If`##9}Q-W
zGwtZNK9%1#nYGjwFmGm)D6}DF4teK(#Z>#&fiZyPUZ-9(GsO(mLsjSpy9wqfM#-yl
zVMAJm*Mj(#S4ArRq3$2Na?4^$68U;^61tGpVEkt_?R)l8IzG}!fO;7bZAn%4o##vF
zW5Y(MNK)3a@K5P*+YhugtJPSJM#H(Q9zOJP1^yg~tlFB^2x2H|_x<5M-@mtDD$<65
zYnhP!ZZ=T&a=C`KvE7C=;G2)NRD(h_-SkDcL-@Rn@j5^WQntQSPio8appn90M}efD
zP*12smm6$DVbrMa(Z#}udO5gs04?t7Yt)gbf+b^7>6o3luyIiVO2?~sjj=jGYrP-)
zXCFdo;=*3wT?*@eGfLxL3!vi1_vam0u<WtI>SoG1drzM5`;%0eXkuK_7qJX!kMe;8
z%uO>fi)p~DS&InfFJ>DvxI)7CBf(VWjX=7ezVgZpy!m+Ro(p4zES+>A6+n119rNQ#
zA`b;Ul|?GC11n*6#b@3%KCOG@C2!u$mfcqxB4WFSVyUE36bK|o^5e(he0bh8HDuW{
z@mWR2<wL=|f`y?;;egeYk`=~v+JSoT0^kxNz;wW9+P8PU2=<;RwtGxlGjDq@AIxc6
z$Gyk2ph<ep-tt+^IWa7BMBfRd6ZU-<k`sv+hw+1OfFOtgRqY^`pBq)PdxVWwDK5va
z7;iH-RUdjU9nn<4hhN-~v^ki>YdUq5T6tGx@t%8|4<?Aci6Q5Tw$1Oc?b@qo<}3m9
zdbj^F!N658AU52FAK%(U_J}5xul?%f7ACFtTt(*2q4sge=He2!*3ai^B6@?L$nrrI
zg}J0g2-nIAcz+u?y}0rjt6Qf_W*r%{@8hRJH20P0!%~a~rh~a7ObVy%xF@M4n8`7}
zeUHpZk3#8-Gyfo8D@|QKGCjF<Uxdzv{!!xQSuX=io?R9|@{h*aLhU~=I1E7?bLaA5
zzw8$0i>iob?{!~fV>OC4{HUO}b0?<QD16?wgEF|Sku6}2z)<UIq&J<gbv{gy#uxta
zC`wJ*?ZfZjve*!k&H6iB^v2bM?ahT@7tOOLWs1XC=+|?pMh;zZsdOTO5F^srHfLRa
z0*KtaK?Lb-f>2r0Tqu@mU<YfqBX=hwx)W34yF?U!x?iq4^U-I)1RG*^sF@@YC8ijf
zE+lzN?QEy;tDlFvqR)2b$kO=6XEm#LqBlk3u^^fadpjRWDvBxFc&C56J^57pGdiNR
zE@z;!eQw~}9KX0n1cwixcGiGSl7I_IInvFK7hLmAQHO5{h%`+hflBp;A%fZ@vNW;`
ze3bHPHhDGAZdoP-;zGuHzg13&w(er(tL-}LXU$S|h|$X!ix710gFKHd2xp^_t~0-A
zxKHS%?_YQYQljJpXe>dopHG#Z(sLXY*BjYJg4$R)(>9TgI7RGc8qiCxgdIWENRkkX
z-Cyn?C8QnEZVAOsd9QiR%(~d^%`x2_qj<|?lV6SH2C54N8*v3{5t5`Y=b&G`N-NAb
zgWib?X$ZpenGYRCcagJxx7;%hc|9OQ49F>X1N0D|0Q%+bBq6e5_NCSsFLVAol8jur
z30wQ2VGnl@3{9X$iD~(^gDJTnokPuryry=`I-5f&)u7O5x-28$8<6t?7B0lntkp@3
zuN=5F!VGwChRGu6`3{n$k}$0QbPGVDv6B<&%R9(&eW2}>w&`A$z){P7z(LeXX};#A
zj87(j>2TrrKFN*b%~~Ix>cmq1(e@Y9mQi~umx8ZUt+=lBJZlC4<@ze91<z@EhAGkW
z!*!YlLUcA0bk4$>^)YWfyD9lH1llQA{Zg;mho`P=#yUR|ZIKOv!lJeFz9xLG7_bqV
zHd7<i6mk9b3`>^fK})B6nFd%Hd_wpA(77CnFS7VZ5!lwL!AQmEX)4{S8WG{NR-Nao
zY`L;ytpj7yiE*#2sb&^iliWO%1?_|wjyWTx{iTpzzB<q;?OLE`+IvSuuF<qv>va$<
z<>H{`9FjuWGe-MygiNG5SEfPue(q^WF!*$nbsfDyDpmfTG^5F{p0z9<VUuKWW!XCL
z(OdSp7pMSo!i8-^Gp@03hJMn1v?z%k1VVf?cJu6Z@9ytR12s_9CO=>1&+8qKtv=L}
zens$Hg*Hd2m$ccDFXbb}$%)FQ5symQ!r0*mdRDF&B@N&KFQed3U!d&$Y_%@;u7?cT
z;kRg2nJ{K!{!v20VP^Mer^Cgm^8mf6vf3K{lp_z7*&BJmJ~Gu1E&rC<+)&}psIEB$
z*`rlz>7Y1F0+L$)Oh!<8uH(D-s_bSOiHo($CKe6@&o-;xWyN+?71URN0*$o%__^AC
zgQw)6cnI{z9zir9xIL+FB@e_#hNC)H?SB}M_tvLGp)GWk?%8K><xH@6LO<A3k{!Xf
zH4DEcQ9i?977IcM)sGPlGm7!~WoYNgsJC1yG)QQ2O-^RmO*5$dihv?WV2C{?XtB>@
zX3~<CAR+HlNF9~@wzt%P>rQ-9na1lWrA1V0$KQ?1!4$;QcCQc}bUyoNi}yOk=kB84
zy`WVgHTq>6%1*kTu`V~JXwu7Vy8XQ^Tc94QN3;2Gc4qUP)7yid!`~`$F^pD=re}tM
z8Re?)t2as!BNp-Ob2FOa7;7)%qfk{HMy=mvs;%pvwSRv|jQ_AHiS0DNFgqrIKf@$!
z4a=r}S~=hXLdCY<97WwJCsEkL@OmLRQQDm2r`*Z(eh4kp^xQd8h+4UCqI9U(T}k8)
zN-N4@_V;hU*<Ha-Lmk5y@Uo14Jj1f6>O@xWOD~5U7!+pTUOPYB99Sa`7Mc|l?x!U&
z?R-%<nvG7}-?5iUmt76h1O}bk`&KCgu8B3;*g;%o%KczXUUi6dUjkGcyzdXXR^CL{
zo}4cWTKZHz=1Vbc0$tQJg5+f{DAF0)8H8i3C4HdsQccs3RYmElkuvdWKi7D<T4~sF
z0Jc6VrHSyZZ`K{lIDK>xAOy22;l)RqRds4RPHtn+>5jD719K{ixx>jOerhbjztfu?
zUqH1lG6vMeiucPMOiIN)o@!a??8cajr0xnuN+lsw4w|#a;nzmnj&!N$xfP^B_E@MZ
z_vvK+J=FT8pN0eFLMoo(Ta2tnNoi@YK^c}vagAsP!u!UTqN$SPbowb?Rk36^{l|T7
ze3GRCbt%NJync`@8Uu2?>r(hJ7}1H8Pqjt2kuzFup>mEWi)|^Dc!&f+`_!gEpQayu
zIR|@g=5=*;p3?6nS;Cs?8Fd2$3a%55Z~XBbeYZ=NzDaKGR%bJxudZwdKp_YzAKVxj
zjb~Xu%9U&gr7e1YA-w+Jk#$h<y7-M-SppcvzdlnM9$rX5Js%uQ#e-^-m<hWIIfQ5i
zgUTTiX^l9&%_O8#EpO0ZjAw<toZ7bHAt=eVQ)4qPv*WfDMDR#9TYM7hqHf282-E1k
z_UWbfXoymrwdGVXa0{S@9EJuJ^KO2ICfV+;J(e76b}zQGwSOH}^8ngl;)>SW2WxX}
zS#=Nw1|R4CW31jfp`~U2SQRJ5Wskt!b^=V4Tm_3H%VBNQABO!fp(ZvNY3_;80wFF>
z;K4IDqV@Ofvo@Cm{VepRe63Q1ZWI+2_;46=Hu|jmAVr-m(MmKVH3j2xb-t;9pHeV~
zW-KwJFWP3FepN{|e&}cS5PcJw%ERXVdX1c}&S3?X;Zh|vpej1(eA<;_>plP7rfcHh
zJmH7`$iDPxr4L<ojNQ<|VJ8ZAsXY}{t_~`J=vCFK*VI}E;!I~qq`jI3Q`+I(YIG4A
z`v{!&Hj+^EpGyZ6i<75n?!Nv38>M%v80lUtOw;)OW%3=vc624L!cjxCZKgM!@6<uc
zDeogbHHzW;?Ed30K4t5LfOR#9$zd>5$!CBYX3F28<PQ2WNdRJL-N4%eBNuNc8GhI_
z%$-52bz$flb70ptz8LF<_YkrdCP%%R&uul;<3RmP=b&etH9(}(KDTbAo~qqHL+?*s
zYc-XHF^NO&sH#IhvmJYs8s=4{QgdLR;LYD3E$?DGoUpDQo67*~=K6`NCZ(+l784KS
zBmZ&`bKH?vWdc`(^Vzw5-AZ839E8@|U9bB}*aa@Unv*V}vJ?}D@<|#!@kmtiXYDHB
zx30DOdPAADpK=k#E`v>NF9vZ#@kn)OoyMl{&{Pi~FM8A82r^aE8q8NWE3W#?S}9tO
zz^BGU;T1KNYNzqs&H0_{WLxOdyyRTF(3|THS~0i3W5!c8AebhZS~s*Fh>Tzrv>J9F
zB#GFa(c6lGn1%98$*)H(HpR|XxM;3Md4luvvX_5Hz2M3q=EA|SCFh@MO`(lOkf)QS
zx^f$To7}Yh{nO@0buWI)=*py-O;5E~rXGO^Dy<;VO{a4avT@_2m(KgzQmavx#z|YM
zU>rhkg*9MRa6(+`Yu%f5c7+WQ0htA5FT?h5LkM7ZvZ^PNb+h(ge-W=~tI!iFsq<@+
zG-Ytl9WUNRf}Pz^ZIKETeXO&^sS;V?HW|_+xuS$H0&iyQUTSG9UJg-yC)e6}w@|so
zUOYw0R9@m3D^-U)hUyF`0IDG>$o^!Vl?GFR2b2a+{HZTl%zsHLg%dz8M7%%UlWS`{
zu0m?-fP3d=%cUBXsPq&2=%Io6$TRmL*{WuDrafvhn2*F##|~_DfSHlKe8C+=9ms|l
zg3<5wd(4-g=J-rouaETmE-AGiw+2mz97$ze1T;xH29|A1dw{_QD%u$Pp1U!y>Z(B{
z(|Wfd_#4tlKq#PQ)M_;Kor}KYEL+&VrEWbz9I%el^@rUz9fTe0dCJ~K&p?T@c8<9r
zYen?1Eit=932htBh1Sv%l~Oeo7!9|pW~H=N%O%m2FNvavsjxmckTH^8i&UOsE~GQ$
z;q`AG$v2c(1eC}N57Mo@t(S}fUGJ_fi!*$Gg7%{m85DwOR4MvP7T>C$jj~}=XhubC
zk`*hGb*gzT-&CO9ueN=A;+@xDaCZp5w~$qWu^l1{<Xw2yIF>B9)5Ddu6Cpnflj!@R
zOd=x6owp!ANbnaF*DBJpyw`h%OQQ=RrbT|)m?0Sc?;^=C{HQl*5hFq|W}UA_|9pPn
zYO(xd#&m&YfO)WoznWbWy5+V*ggN52lautJMBjagIdGO$C55uUSZdoeWVbaAJPTii
z&}Kh<cZ~(?_`si*7C3wby^PlF0!wzT?c{-J!dV1VHP@?VS6I3$)1CYVNQ)iTF>4@N
z%<-E&jq|HB-~4~Y9-ncg$|~xDv2h*pgoW0~^aKpio}Gbbuqal&>1-q*EWP~RQ}kM;
zXPHT*nl2M$magva>^<S!Xl9kZk`)Pw6Upp-+<sDC1u5KLeaqrggl4v!p1!ySzgkPB
z_p_8V_x@$uJ-ps^lk@t|xTq>Qq{dGxX8gig0VD|_sVO(8?fMZwC{we1_XBYNjVZb(
zB=;&!P{{Lwu2lm|<`>10-_B#%&(bR|hcNC#*T7y3y(+DbNz_*~eBS1-UpAWST_0UG
zdb9wUykNR@xn%XYJE}C5`bnI~9)Q<#1TC5Re2;%Ss;9|8fSdfZ?e<C!pOl?_QElNl
z4KQ-f+Ymm176VoXGL^JC_@!49o)c5S3{jm_Y|%8s;4cmzmgd~Nau$@xMOZeO1=C-2
zHOKs<jOn2GL57dh<wFN1S9*_a63U<(M5oqZr`ZiXLrGL<P!MG0(KqC@{DD!@!s$y>
z;q^7W>PhasZzsQwS^!dxcAq*&B0x|3A(2)oU~d9~&EWS+;l(di!E<@4^{)7?>I?Hl
zP9(eqqKch9=yh#Bh~H5~gH@~f9prGaE0IC*qm+A}Nr7W)F>=c@E@vl>T>@abdX;N{
zL%t1LN=Wq9IyW0(`Ov(@(@2VQ_jm{CEi!r5y>H(?HaOUzlba5R8kJx_FN<4DI5m-I
zLe<$tjaBqr2th<{88qCfa!g5;lf-i*^!M77MO$B(oklsz8L>`jwxJkUELfq8Ih`%K
z&W>rI_bg11$CkOD;9;BCi?sWmzF{ZC+kVqSWcJv9Gy9Nc3N{6|iX~+h#FISk`wjz1
zi+(hhOjm+!^&BQnwyQ6dP!D2Kj}ru@cI1i|&sjz<-;@s-ch;Y(40=5nc1*4=40g;t
zTRDSEG=dcJB08ggsn4;q0P<Qp?%Gz)lGJ|`49kOOb<p1JAY8jS#W}NI3*_g^9#PmS
z)_+Cyip-R(lqioHGl^W193MMSuhsS^&6jslW!@nlH+`GM#>w9PUmRU`Ae4_AuT(@1
zNs2o%lby28s_dC{XA@Gg?>L)MapswavJ%4G+3Rd&948`sk2`yxY}N0+zklzq_kHi#
z&*$@bZm%wFOf~^>fEx9wiKg|aVFxD~Y?p-Zd|L9C|15{Dg)mV}V04{MCWU%Vmvy<c
z+k>UI6(HWP*~|_NP58En(a$iO4y-yFij=xB<3%DTZO08ltj?`h46pfFr!`H4MKUGm
zl}zQLWZw@)DPk@e{T+~X;y33GAul|M51H5-=Zw&F`L&g=km`+5tOQk6&7(eIE>#2x
zm3wCcF?mfJFA+&eDO9vo@XJV5gToaw5eNZFU18q@=4dHFPMDF5m}Pd}??%$51zZPN
zHM8R+xTB*ZH~DIWX~tKX=zm@vI4{RIM}lz3f*Q;?a`DB<cv!R7moG`A?{{Uoz%H9S
zi+KqIp2Bz`;n)B6etq$Hw7!iRT2g4}c`RxnX5XXJhpKn!5td&XsV_YJ?zV^;0NVQ>
zOHc<O9fco;;pQ2n!MG_^cvCCKSd?lSY>GQ%q4kPYr+xwc8)vAQ;-S}(Z*B3Rs@rM`
zhTbKTi<$Pks7j-NikR^jko~3|l#u4xmX@U+`*@mt&3^@HLe3)wY#v$8nAcFIs-XEI
zoDCwjZ7ogi#Zttf8PsO-N-}6|d?=keXuUJHa2Fhr^ogHpJJ*@#UZ1b}A5xF)6<{i&
z#6A7zv>NU-COjq8M#nrEi3XEuk*@FBe|MeEl0DqiCZ9d!)Zl#Wr=v|WSLa}6HDHyU
z_R^VsmIW60`8(W%@_YFHuD1H!d+(J|v_bi3Y?Euv$93(5z444*AJ>VBhF?k$<<H$N
zU0AKFppT%38HzSRlmJL4@D!`t_uqGk`)axPBM34p|IP^QP6EU9PH@C$u*k&(C+pT*
zu1<W^E{iHtw_Ygxwer?NscV+~<ToW|IA2G^3CC?Cdnq)3#DfoQ%9&t9!ylN=tg8_E
z?UNTtPWvL>1CCq5o|{~XH-j2zf0y1(^%-l{^Go}<MC5u+AU5CzG?LUbSNh#-E8r6k
zN-;Dr_*8$%Rj8_S8NWAmUiCT;R<pp;c6xPQ%N<7kBFuv-E}b<*I)01dvjB$lw8FW1
z78ifzw0LrFGWy9@H%gk5=*;tkE*%I`iysfkE<8{77pLf<F^!Wi2~jRLM()adr{4?v
zt@)B^V_FQ`Kr8cvOMbE9o)0n}$8XAYu%YdnuUl2+Eq5!D4SO-|5^XW+>!sEAu28Bi
ze`@2_PM-9d-7UfF%83#lWY@wJ?xO-e$ia`xY&&iA2V31d`M>d$`cpcjxluf9(_T3J
zEAAhD$d$Z+b#e8la9=50V$2zTR^-pGVTnFlnB=R_6t$XwFg;2>&PFrD-$2b7xvzfT
zzJM66RNekzc_*qLdv5&PQ1fPDM>9%p?Ax+1H598pf>Z?JN!b@VE<Wyoedx3|%hd5I
zIlmSl{sZ>xpBR&Papn6r&PK9!)*jOC{u1cA+hEW1Di&M++D9KAeUMahcnj*!l(z~M
zBECAzZ^}|iPV8xaY2MF`-eSo{-V(UA#B-GU<z@wbX%LAI@@oJ$*3vLEd<RYqYDg7z
zV;ZEUZ2BR2O+JQ1t-)=C8Yb^s?qg$Wla?diWFh?>IMbgv7!1Buu+9oQ_XMNj6ksU@
z!maHKPJEJbzK3F_0&nu@qg~aS$TE`oN!QR_k8Zq@bB&BO{4R&x{EXl0I<!%qE@FE1
zbG>~+O*ra_0c4SM)hV7-vz0pyTlK<OvQf04CoKo%3S_U(#z-dxs13qRH4$PV{C2ag
z51{nW^*aqATX0b(08x>rlRS1WyPFE53l8)OqRzGPpTK|zSmT)XWKx4kcy#-kX|b(7
zCN-_05r6BB>?`0q)x+Y^KOJ^X(cIAx;b$inda5fXg+9uN(`tG~<_qZyT~Aq~y(wPX
zT^wD4pIKJo_3qwfs!^g0udgNoS*8`!rzzuu>J5%{wwaypwq2?d`KufUcYgG*cMwy(
z3-=LlZVPoLZ4~0UlAllnw2!%-8mn8m|7sfHiy%JJ8!!`6w|VqGNDoW`_+&~eq*c2=
zw(d=rt?ql_#>wij0}Y)&0?qc@5r?;UZ-xFE(MY_q{HF1jA<?TvC>B=A+$BGMULX5O
zKjle^atH9iY0*`)BGE9C{T9DNTFkc4KaNr75s-!Y#l~(FWlnHzEAnbby@4Qe^M>)8
zqMD8MB&@!&qBRzkZ2>w66{iM-Iodxa&Q5U|O3K!0kN}caGqhl(YiPpUvl!z*l6!=r
zL+&indyd2QiVVxn85iR6bbthV&mvB)4U_e^js46l_8$_v7n|CY^H(U4fa=!At28&%
zKnFTOZHKE#1RjJUz_N1sD^#8X&l##IqOj?UB%*x8yzVdcWGVdW0VIP+@?%Dkj*oIS
zoCEcnU!X%vs9>JIzT}0vH^@ODiw4lfElm%g(WK;J!k?Up`ugVp5JU{QI4%x?Ox&qs
z1zLDrc6V!-ZWBg#$tYHaF=Eo6J#i6oylj@)s|QPNxjz~I_x$VUBySBK4epn@jo#ux
zjZ*kZgvjk>O%&ImfBgm^5yZ*Kqu^^*6l?~#I(ksAJM)6z#$i69&kteKuI2{Z%cBv2
z@>BP&%3^9&MkXu&A~q^9!w~7xK-Dri{QwBsChj1kVnn<YDM!t9*8zz@<szx~s-s>^
zAo}{SY@eAnL`~vV(@r{-jIYKT!0&9bYgRD~6x-0%sqjkyBat1EoruVy_^QRX<D0}T
zD6f)1gri5Q=Go6cxgymR!e5$Qq8JDM)sct9;FewGyY=#@k@N4FVk`ZpO+=Tm5rHxV
zTy+OADi34*ih+uO&$%Sowrh*PlV)rWSVSRl7V_f#|JK0baG-b9zHQt_M@5r+P@3Ft
zOSd_}ZH?8qKE<!mAZs*d5+zyXILBbWcs@>4@;du<*^T#qc7Fm5cvpCybO6Fm?AP;_
zFx6$8CL)cJ{``r^fF<*)=&QbV1K|_)tk}OV2v6DW9X+Z?m@j;HgS<(1)%tDbLx-(D
z?bW|T-F5A#;%59Wl&^gv<;ppjvYp{sfH_Rw(`<yp;BWV@1B`${?#4^sR5DC>L_)_6
zPSxw^L}3t4j-jHfrcRS&z9I&Uh(}BP?qx6C-~qp&i`HLm!oR7}4O5XXiyvtbnO@s(
zNx4~2nW|_p?7@NZwvY$1>ynwCpZ^{0Ve`HPBF=5az+T>rH;nhv5WKW(84z?=QU<r0
z!g_h{h=&7C+I2p<OYn-tP}wjaa!~pZNQ-IByqV+Bno8^0E6smRQ<4m*xO5W`ZrOD7
z?FKH<xm~8{xl88z<OQ(mTHEoH=iDCkON(N6{z3|v^O!)?S%~32NyBDaDQMJ&$y?Dw
z>*Yy><7?e99c|o)nRj8!Deu9*;e_=`9X;IU58T|QP^Mx`7<wHg)L-&R3;wCeMWv%$
z_=Vtq{s}mL{ip=;jf=bZ5W{;xsOdo*k;PT6TEt+@*-iOQW9=kN&iHqk9%fP{b;EwI
z=sQ~t&qozgV~gRP6n{=MXSNVYkn`zGCS9InXJ?F<mG!1(fYDr>@?@*%!$_vG7s>48
zh0VlQP_YpI2ihJ(>H<9)|GHgP#CxwmZ3!}NE4BaR#h!7&C?5^}*th(CbgLeP8hJ3B
z@Q7O3n7%#d=11nl>mTB;W4lBa)1&WdO49y-ZFF_!(>K|RKpKs8AyQqsPev~K6ge6=
zmEuR{K26FkEngkhsD0FSXDO&vJ0^xbPQnAty_DN@N1XU-2|-GX5!7@`zd~u-B<g#E
ztn8=OBZTg07eMC$`NWD`>JoevrMzw4)#1V;2(7aB)eBQFUTb)9iSNd$On_gzaOm29
z@k7U75!b?<;moIb0oL>SS0m;N1aylK4E$%s@d%@X#Rqvc_OJpayFv_>I_#Aq1h&(<
zOe+GgSQE)_o-HTKq7TKv+S9&M?pvxS<I1yN<0(Dvb?fYp1)?6mQ|dU`EfCpPjPAR^
z^DTM7-@J0VGR%BX={e)(R;wJ|(QMPacp{Nz=^MyM{oUxneIIlEQ5q2yedS+6i4eAp
z$9E{q1=K|PhI9R$YF?bRw|P9q&^sN2`MUq7^#v^D3&uJY>nG=%?_IGR>*>P^L^9du
z5IsGf>!6{<^T@NS5c}A>aZm5my?YpY?|L1B$I#KCNdUv`_jo$(WkO%iBNcWs>`-qJ
z<<*<_OZWxhD?1McVmo(#&S=YgB8qZ4Jp}wkmcJp#(pfJEUhgG0h^8&R)jwUjNBu*4
z2ak2oq3e4vd%zB)OdM`Xd%@%~GaGU(dPs@`fTgZLHn}rl46&Z4yrm^3+UsS14BQm(
z;<65LI$2aqB-`ZM<cs}=l>@T#sHq(x&!s0hGXOA)l#%p}OC4f9j`0i}9FKmIG~7)U
z-v`$((Nsai-6KPNeE)^2obxy2se*VFY8{o#IGEFd+lg53=5`%3++A>2*Fxf1L1Fe5
z@x&MHXC_Ui_VIs(AAJOKjDcn<F%&Upw`%2!t7yK5RQfbxy7P)smk}GVwB$RfND$&=
zSW{*l-6<>{3(GLE&mtZ~T#^0GGUlK2;gJW_jO3ujxO9ED6V#S<GLdzXmp~_XnLa-<
zK_}GtlqS*J&FbTBd90=m?Pw(*d%0$K>CM$tKnJKcyK#|Kgbf7AR<r;O3E4d3gl?6M
ztX{y<#MIY5l_lrtP(dKA9E_-Lja1c-j`_yG2~zpln-&O~LlcvQaf9JXw)7MrLG2uK
zTD1T2HI<k!DKZ8SD||oamh85rYx*_uxlJcJh*4LTAHBNJcEd)g!cId~(?omLA(}FD
zxlSQG^4x1fHO||A*(DIabde%ClSlzo<hqU#`AoRZ>Kh##YIvRa|Imm?R77h%Uy-SQ
z)uSoKvN{HqtcXsk-1w6bPerNRb6CuZ%rgh_L2=5dUr5@p$Zrp_yn*P>ip{#NK2o_Z
z@HM-vQ<qbLFg>h9z4;gCt4tZpee`aZSY5|k9fHZ%M=6p(zYyMSQ>l8^>kjRrckDZ<
z=A$X%^+O6tf|Uv~tyL%O*Ah$`NC~n$ytmUWnTI;>8G)n`{-y0t!^*+$6dvhk+fW8?
z(&74h0ZZTS{P)>z>#$L9;@EYrcu?Q+alSi5KMzZM3EB4+!dO;+XE7y}o)*L6{_#lL
z$^$b5q(bRd{<`H7MHtmR{F@`M$cireF$_mkM8G4`Z<k88G5Xbc`pwzQG9GnjJZbUZ
zUwoQ>uK(*8^C#!=1vSuqhWPRDx;4uG`4GJ;l(6YDZ;v3F)H;Ub$XG;ej(;5W-ft6r
zq3L0hvvy3T0>9(hSf&HkAxiueZ<Rh+-=zj;yGVYSh7Kb(>=e$$0hq;CYzB&UoK*yv
z0exdt4PejjjGbv5;@UZ7I~VlVec!eRYE%yy26_F=uDFlhG76s@;6c}O)D;il_fet`
zGex)SHSrD?QdG$w_o)Zx;>w~=%R!<rC65ObyjK-WbJH@)EOe5+1QoOW)<nFaeOr00
zgJ>KUWE6&PkG~@9?Y0w>{L^gs0s1PG^cENxeMN*76r~^prh4|&{G0U-D7sQ}`hsY?
za6BsBieR5b5;|I6#@?nC2K*WKCwCo15*85aFXQsuE??CgHhCS~?heB*vU^Z?Aa_iP
zIXxVx_wdpZBVNZmr9VnN3ff8J2BnNCs9mDqMfA(`g8Y|hdZC~8<@{!gNwH~`3l~yy
zM9Us7ajqvfu9rI#I7~HVS;x!3qWa46Xx6ZqF2oX`RhKIfkn~?Ld_a+njr9KgDIH=l
zXrE3ZWmO8B0N3XI*Skgvgr~Y@7IY!Yu$z-_2^IBsWaWNepuI#IF9h4vFW#CiR}!9U
z5^Gx6zyG6P`_{F@qQ#b=9oBIq{TBOst!-@zN!)vA=R!dBKgXmK{OS{L#%m4Rblbbn
z>kn2P9Gn(Ve=L0c*`sFYW9910%po!-)|2JGmZuHEN1VT+0<FWjZru3q0U4VtXE-%6
z=;>;+rL@fTr1sa%K+fpAb-CX!r@P~Jx(Z<aBwz8vfhRaqP`hC1kVb81^8HX<UH~7X
zbi4ZNZm)GN$epe`pOLz0y9-Gzy~s213D<t!C>86_^gSc(_-I8pX9TG}k~U%{mk;Zx
z`2>XY=^?%#oGQ;%Jk7S|WM<gx+Wb|?h`YK3)?w7nMQJ~~j4B@E`SBnLh4`H*?{A+<
z^`0BuuzVq84T^s;VX9&sP9CZ-8LEi40$oS}B2gG0EWJ9UBF>f8(MaaT$34Du)3rgt
zA<jVD+H~AX)il07om0#0`Oc_5<Ml$9tXxr8eMsYUOHX64kjgIRLDU1SU)<u#4r@fw
zcq^r)T;G!bfq2fJ4ch}!9Vyp`-&Y}<o={by+kC|_TB59xlLz7IDy)%@PV{Oru;>j^
zx>+Y;;zcsD5fSo+{RS1i_T&{5-7ta-DI>;=BrgkfJa}Ee7aFgsplJ<rWAL2*^=5>z
z@aE$9Z#0Gvxz*+`Y|P#~7<x9sYi;%QDZE{5uTmYMkjXec@9^^RD>-{QGwXWz5(Q1k
z4UteGW;9<FPRt3qMxQVFv$^JIke*X0e(EXJ2F!OAO#R0hg;L6O*%m9lD6B`J1&BuP
z((gfCUw6`D_;|y<0n2;tDd}zxKZy7vytynB&>CI+pQlF$7I)p7qqsZykLyz>l1n9+
zp8GzKKD9EiBFae{<*DhVNZk~{Hm&NkA<f3&L;6N}9x-_HB8tGYOS16KA_p}mQn6H=
zFwl@rbvB&8bb9VD9{whVviVnpVr~2DXRMjHYMAxA)3?7R$E@|^e?c60m@0b16)|4V
z<u8PbVTYXrHtGYOj1jen(IZ^ls6_<cXxs17md<=|^yPm4RBKtBVS_D{)D-?=oTEo7
zKoX!ueQH2(uU69_e)+bx9|3!p@WL3_5U;S~3Ym?=9{u}LB;2%zXgo&-QV-r{bS7R#
zE_Eh<%YD~=<Bg!~_Tzya@wpthZhOmy9UNjm{Mr9=NYG=hsd%PU63y|Kzr!Nh@95q{
zhK0sckcOI2u1eSNx1S}}=mY$vcCWfVm)$N`tM5fI9+Pj;PuF0DsaMBQWW<lC&GeqW
zdi46^yUee$gUv_0XCv2zfBiRDh#XFKIs2%jqPT4Yc#Y+dPUgEJ|Mdw_>w=(n@cos4
zP)FmXW$L{9&vTq5X_cd*8_(ZmHGMmfrYZNZ%UuJQIELr6R88p$N&C@>$ED=P?!CS7
zVg4H}w;MNCTV4o;*`c2MwEYM32-gw9jS0e4>$Zf_{DIT+%S`pxY=EK;tnb?${k1l|
z3srzR^G<9l2PA^ltO?eaFBS4JrF$Y`QP49;@p(e-f8_^!m0L<7DKGj03gyzbfNvyC
z;*>#K_$^tnOrTx&id-9~Gw{i`g}}ourg;F;>EEe;`?Be-thhO%VJM<Q#w|{#ByRlU
zyS!W})yo<S;j|#8o_1C0GC5eNW%n~Ynl%zoE`GKvENHfnzA;SnA*g%SeE$L|Od{tu
zfX06+i59-(GiveZ0nAiT^q$`U>GsCBB)4w}De+f2u%-1BM7-ebPcpNh1Q)-@{b#!u
zR~VncAJtpV#EcLq<wO+Wsn=!io5^_|khHEb&>+lN9r9`M?Y!KJCfH3Z{$AgL;d{QH
z#lhEP9TpqjiUct3OQ$??Q%1D*eYq=~B6^ug<$R!>k{cds$%R%=(dP2HcIg0iWs=mQ
zJHW-OSYEv0+EC#P!Shi-czM_QHpiBnj1ah01^q}O;L4%Er8w}iaG@&a*u5dV3+@@h
zzdR4Tr*@0lBeD*v5dvkpRbjFD4H#?r8?^Gv-+>Z&n9h`cR#EQOb_9J!q&Wth0t7_G
z77pp_0Ba+Is_u|(v88ozo72ojG%U#ER4$~%6>wd$7lPchZnm7AJi<~Y+L!7nk#KDx
zmcn>ZB~e)+Z;`6r_X?#Cs)P*!WKBGlHeUL6bm$bd<N31EZK6nI-?DZy+;6E9)7f%i
z%Lj+p=ZMb{{DokxJC~oF@3g(nnO69<(T~yCS1!FL|8<&FZhLS-Bnfp?fG)O~Vzx){
z>v7z2s}(SWoB=Qm!xHC}5`n3jHAH+H_3~^s|FUT8wCX7A&nYP56GU`Yz4}b!Hq$je
zYc?XY;;$AZ-uT1(5IV){4;+5)y=_=s2&M}l7ZGf>Q#k`x@5D2}m6-4KI;zT|`dscr
zjjb$iSx=NFC4*cQMxod!w3)eBN5I6ycwdR<<wg9aR|E6yKajmbI?Dh3>--O|2%zr*
zfUjpzzURSfL4waPh9GcH2#^DrIBCuNH&s}%Cnt@1g4W0Ad41NJ*^W*d=RPd1e$Kxi
zv1KGsVZVQ$6pPd|6|%b-O&7eCSXSe&HroPKt{RI|DP7mYGShWvs&l1V7O2lWs%mg<
z$Sc>>Mq3q4OD(;2K$yqiyqrgg-hYgrqc^$<JtE89M@}Wy*Y`1d-}W(H;9r*F6Vy4`
zGYwlpxWX*f8o&)<^H!{Zd|Vu87Pf{@E>{Vw{6k*&48iQgWMkeV0ZRjNf)Mz7K2D%q
zGt6~2Vw_X5vsV~$$N1Ys`N{D6*N-5#X%u<%jCNP^mi`P<e$3J=y^5e)D`J|OYQFT7
zq|6lP+%)Y&`#sD!KWKIa^>9{mQ8TAJCu17b9}RIcFVXpAt&Ysz5bCWrR+U=8))#*x
zW-t+cp$muYobFvpHZoYIvi2@u9vUp=Ey*o@O3os8-+3(2o%PGaK#q%30I9o(a$Snl
z!;F?gAa*dyG50BB{7JpJ!mSt@Aa#p&5?9_iGMDgF*od<>h@ry1wyXWN-V;m3FK$Mw
zi-VfnLBA^qWRl}jo?>d<AtA3z_~~8n&jw6(<m>p!11)TW-+RSvwYI!kh2Md+27abj
z8txl<h(IT^UB#fGj<@V7TT^geNoxu<<DTUfnyN}!8foIpJCBp7q|uHV=0B76uty2N
z@ox2+z<Ua|N2EXt^dUx5q4eqnznx3eBsMob_PVRnU?hrEP@qE#d8O}_*`B%na*6Sv
zv%ul9Bjzkq*4iz7QnG-jA-9`$H{9^U{NCZ#9-%kr#8A1j_bG3<rD?+I1>N7s$rUL)
zW*N%N<>LR?e|3OpIqvQN!M9s6XDOgSx_wmN8}}`hByj2BFkz68wb$bP2t5UaUcNOU
zeNLe43;Cikl`Zg3f#WjRjgS5Bad$blH%FPYCROjCHxU5$w}RA@sw3v{5)gN{=UAOc
z)j$ktq!IrrX<lfhGgsE5xew#zo<$#~;w}4w$#0T5>N9R3<>I7assDM@J>q+1*Blii
z<$y)l<NIn8q`~L$>DKoHj>p$4Mb~-B_A$`UfU-d}uNu~_?vJ&^la#QLg?3t|6ST!l
zxus^QqnT~L&6+s~+F)xZShk&%=LMQJ(gjSF@gkTnKe(;`XLFLLZI_U@?4|P)^;2;1
zu@(BNJk*WbkBYE4ijd`MGKy?h1>W;0ip+ykQ$}4-Ph<w?a+F=gft53(BP0IK_uKKk
zje8#!v;%|&Rw!z()hyK5wC>nXoa<zHCm^qvO8Gt4mt8~MWc;0oZUjkH!q+8p6#JDB
z4c=8_JgnHIK!=g~(ZnK0-T)BaM|n7-wg(SYNdYeie+BX5^V1t5O~zXl(P#rKu%Gt&
z6K~Cs@!6=F5bIcsDGWGn8lP7ww-}t968Cv>Ab<otUi4cBv+=%3)A#5m7X{z@`4V3q
zag8zUjt=`X;cS;VV$jK6N=xs(XUc2*ixky-%`??3Z)xR@-$kh<DT?L!8}*baTt870
z>Rbs9e_U@w7<BV}?7MleJ)L!bj7R3A5^BzKLr5?HVKaIutW+NE>QRO?r42^i+`LOA
zIz6D%&o=ouYxpL3+y)@gExr7f@PNioF$Yfk!7_tybma7-3E@KmK6U2y;zNq}?gH#O
zYT7yd#{Ozp76cZ3WjuQH_>LH>kPUzEpW?DNRM-}>ko+;^i3PbQ|H+TPMH75MT;;tZ
zqDN2FcB+JZkuQlq^H3e8gq}rTAacUU1qTQa^5Ux}uOl{nGJ>6g9+`{rGN)U5lcWN8
z{{5v1Q<@GS&LICIieIJiBMhRk*pJ)ro0GS-#c7j(gWk@v7glZsmk?2?GBqD-ebk}C
ztgRKHL==DqCjC`-z1RBiwXqX`pw0&T#I9MG>(trDHZ~nWKK~U<yl1K|9og@HquOZv
z>7Gx(8_R6A;O6rLb_Voqq+F1q2Zg3K0M9jEn-n+`t+07{7_{c~`3g;MF{R3jXmZeS
zg*YP^FINv;nQWq0;x|&O{Gj{H$*3WL;PVxgNn0H-;&mOzp+ZS9=uLV;_ij~nL~c<W
zX@H4P>UpqSm-!C-QWEnCi$XEcUDy_lrs)WaR;`iqa<jgPtcx?(heXHr3VZMXSb?8T
zX*^Tp(F0wowV_rWkFnRDx+;2P4n{|oy_d>{D)Omhhc177MQ&CUDN}S5{lb3<=5Wq4
znHO8ib;h9>j}+NvUdSzgepE307COk(pRJjQzNcWIv)@p<@|6)=nHBRM)abniE=3$S
zx$vZM_xq}8E+vhb^<-S!fc(dZy2`h&L9@7fR*^(*)9}ay<<wS@yy3}?_MsIH)NkxM
zf)mz&@X9Ynnmod^FUn<14SUuv-I6H!z86;=VRh=cPrnVB$<yHzMst7zbW-;8<|kg|
zi0y2V9xiF0eU?z+^Kk&H-Rw4Td2{pBf11`zSgBO`3pp$oef9Fl4!+K|s#36nfnAhc
zD2g&f1odntuwhkMu1&W^paD2v@}l)V7#FUFLrn_g;102+S+qXO7hDslRM^$FQP_e{
z8|O|GA?*5dG<nrJ{va8MutE!75V+vnRB=xOawZFl%ZvUuGf*t+_K{BpBl<1z7VN+v
z8EqUUUHVDDb}%B4W2^2@VYu{ThMyeSA}W^M??XDq=wlSm^t71s;(3)#1IK@j<QZ}a
zD}Gj(7D;n^&cfyEJ(@{LRTy~T6bAQ6><EX~^c+ovz+;mAwh<j669Qhe9JrUTC2g9p
z20Lk)?9<VWhtEQzvZ2&EBBTghlVRRd<ASJ0ksrRbP0Zle#FIi5Z&hJHt|L%%8fn`v
zo=<oL_V6%P57VEec`U&~dzqkgi@i19TX=~PA*<%0cq(o8g<fPjU*pD|a4Ad0e@)7@
z{{38&&-PxL^19?FAor0Tb{{FsV<gw7T(vIYE=e~5!@M?b7T>mn^r53UoYR9ufG4l~
z7Xc`(%+b!z;fkO%6Xan+`dG!y#(M8gfgIhqjoFY@4T8Dd-EvqNjWj=*N@_c0!Lcyb
z&zec64v}nq%$*1;m5bxIoFEOTm<#jSc+yRzqoZkfOJaiuzh80Tm&72)to5)n?%j@@
zphaO>pCy@!t|6&V`mPJM&T~@P)Hc(VQm}%4td>5`+&kXx#zZZ=R7Jddja(5Hub>dA
z@>LY@zKSQSNb%$0#RHOq?+5)-@%jmJkV^)&S*wLGK;<Mh!rFXNgLyxa!DZ_OtYKfl
z5t4-t<<vqb%qvaR4Ye>%IEb^J!eWA`Rh#{_$ML8}LPeDc91puIi*oL?Ux-^oS)Kko
zWt5l?Or}FAAPUyA0Wih4w!$RF7c$vG9eXK*5g$2zDx0*NaJo0`HYIg1NZeX=j62kw
zPh|g~k}W~iWZ?e!g5rOPY_EzHUbJWb!K1JpX0lzVkO}TD;9SChQSE}yK0dDM$&)j?
z3hh~M3mv&ckE3MWa{{apC4!i2`V!*+E7Y$`_c`hb8VoAtt!p7t8MVJ5`u5O~9#lq;
zQ5xi$w-43OVZh?jxG4iP7zi$IxRMLIj`=Yksbswxhh2|upJJ}h)iteraHW`swU}Mc
zvHHW_FI|adb1vH?+Rm86V~2o;Hy#KqR*C49xp@@WGkGDC2<=QtZq59V9P||$b%dIz
zVKGV6I1D`oGj9SwK%@3cv@iW!_`TS+kl->*CaRtv>}3U2*VIAqcP@-w3`owr8!2uG
zmrGfOWCa=U^>A_feGB`lDufDXzE~tk@J$5Tqjn~jj^w=LYn@Q|#o@p8;CCeDV(`wI
zil5wFIiI}sXa+!coTl5yby#&|(WKC9Z2$-O<Bb-{>hoPn?^9L@_F&QyV6#^`OtGvh
zQkTgJFSTUUO>$jMRlz+J8KY)w3Y8K$AXeP=9aJ2n=8F6MxW1#OB<jWfTa8Pyqhrl-
zer6qDXk8G_k$O2^^F>ely4Joh8>r>^h<71Pt4a6W%TI*7{DYn81nTu=<Tc6@7}DBL
zF<#0tn2|sH1eqOzep+UxT%~+=1FXUnod)aUG<#3--RkJfB*wu60BM{U+3fQB=)R)p
z3Zn=;HrJ*X`8;lWajB9mM#@dU{u(wJD~pxg3A^3gluzDk8q{1x9qM;MpD7lbh-{2p
z@iWgwuLEwDw{PMZD@kA7d@~JZ>IstNlZryaMy7<8=8X_GD2$i67!|OioLO8%r9*5j
zqsXV2@e-HYQ~@5|d8B+W<3p*p-+_5qlPp=L`V(xA@1er+OVyjM5LavhFkCjcL?@Co
zzx?fV9xn#zVJs9fjaL8$erUf;5NMwCX-(y5Xie-gy#=U~76uu8yjCiem!MIuel}~Y
z5o2cOK4%9DriuS9FmU%d)4>3bQaO$a9Pl{di^rS&eQUETSqMCO`RDoP@JltyvUVR2
zmZr<WP2M3Afm+5mRTN^iO{WBPaw1gzDalk5mE>osrL&^fFf`babq`LBgpW(*e+Ux1
zX3Wt4bt`>8`U-aO6Qrpj#>Y(XyBG0q@+L80jt<zmX*wy?WqO^lpg_1}@ylo8RfzM~
zchmk-J&Z6a`zw9eFl&zyax?s)E!%hJH#eIOF$>ZmV`XeoEWSq9C`s{UwualzZ2H-j
z7C%&LeXO=4m9S@h+xQ)0+krS|&9gEfh9nBbWrF!xit16TJjEuU@1Vh_#&ZJk0qB*B
z3IhCmyfUgj$2s?RgO(cp8VJxWGF(dMMA$)oV9qm#KDd*=19P%VF(V}_hNXm3x3cJw
ztyMV#!m>B8!4$0lX^G9a2eI&KyEAry@V;PVmt~dF>U(Fp&UF|Yr%O2d<iOgntf^kp
zmk)cB*fO>z+gZCeV!NlV$9mV)ha>5k*|>L=UaaXb?w2b*B43<gsi2%$)!$@j@GIVw
ztm6AL7PIb*psn?O27IQ@FJRE}udOSz5TyjO^<^vul<-(cB~y1S_lFbDM$bHxjsg>D
zAEmwTpaMy`*2FbExQe43uWO@xerN-_iPDAmOOe^C84&FRNB6=K2znK71DA^Dg99fx
zC9EK|rfg|)9(DWrF#Bm)3|DBkl?IoI-LxLestuxPtwj=`zRmOQn>ruVz0|&OE|r`+
ztJL~~gzVV<GPCf~;5<JZN>UOk&?W2ie&e6S=~-rkTU7+1M_(xireV$>A2ax-Y+Glh
zcSekSWyGa`e{0N(>mvBqB?ljPjychO0Czno<A}R;W9^6grx(7@TcdwaIeJpIUQhYD
z?VI^Jxg<2@rM&auh-4tcelgEj{DozNwIAVVst+b1AB&=LmRI_-8nx3f)py2ryrx6q
zK?`_zy{YMI9*^6=cva6;adZ&p&sJszQ;FWTYePatw>8+KW#|0&`zYg~LeCg}Gn9$M
zMP9yt;|dA;lv^w)g`chqDyW!!tDO{ePv5U-#t5(KsUq*UT4Pa!vKnm44jl828X3%+
zRjpjJ)ofr{6+iK{PSdY*irIV|GV;g((GkcNi%PUt7)o>mss0Czkoq)Tk`1`1qrOe|
z1?a@%cPX0h00Kcke3ST+s3W}Xwci*Km|71H3N~F7&NnN&IC?yz0eny_+;u#Hta;Tz
z-D-L&?&C_0*J9TN2B`Q}GxS4SGXwvj-BBygRBq4pykJV|J|RPc2cta9n5ZO*=u6(+
z%|(~4eTlJoL4Z&X-gE!isLk1UNl-6&+_d&JL#JG|!JB1MZh=-obgbfy;~VsP<czgd
zxl2@g1JjD`!9s94*<{GJE_;W1+SiAwd*TK+raCnhwjnp1|L!1L9O{(Z{_t%`Qag6!
z&n|urZmF+?EG`kYfm6JJ<Cyh85;cka@zsS*hsY8cC3MjZHwcj9#dxK?W7gXyN{&rN
z&|=%*+&`(am`jN7cEtq|QL*1|Uzu~8qu*3LBWF;)TmU-UP$MI~Gz%1mB{jdFzqYIX
ze(gz}g0Z+^8g8I@yK@7v)9{;{OQKRW!`r=Gc#0gz>$TEfgC7m6BJ28E-P*^z2ASu!
zxbTjZjM-{x0sfUdy~GnK7XNbI0lh-d{6qEbEl5ExX@YFN%dZK%X#HNHMIlmE52f!0
z0mYRF?{t-<VLXtF<u=n&#Zrp{al+Da!3GD_Q;XoQfotmA#x+fQ9MxT%f{#A1So#Vn
z?)jeV`JNeZlY6F4lPV&0lVlgd(htkgRF=5gGxmnO%Zgk<=SDaSrPv!Yy*vtEl#fR7
zhT{7CMh=KeGW7r)ATXTm7S6YDWE#Q>@<6C9oNoG<gFf+l&UJy)z+~m;1@fQp|J13H
zk5@#02Ky_{aK-Q9=>a#P>UJY~(%4_&(@r+sHWpS@79-m>mQbfEj1KID-+8qk2HSbD
zGcgq=F@xkJF%d&x+Oc&>?MMGL{@Yy)U7UuT7-`9Dcw+AFfkmr1m$@kdy=QL>kq4s*
zUR3QNu|+XX4zH_UFNxliY^7;v-vlsTwbf?DHVz9t6M<sD{qhLsQWAcYd+||#hxJ^Q
zYu!&Q6l(SkoFMQl4gB)^TKaGU;&;gk4DvJ7?1QQSbH}KLiPD}u#B=-#((Y2M2jatp
z!aN>!ZGbyyPvkAEw|JBE6z;Ze$p+R$Y5vDF*^ZmT=t6u?e)_@~ycIuV@n&U{CyXS<
z{Z5GI-K|$HG}U_%$q@$mvoc-Bqjj_QRe(EPLw>}uHeTXg^|!&SzuIl~&FokX>9!Np
zv9I1MaMk%BZziR1sm=U6P&=6!?;lw_7|se>*1L{-(N4Sy#s9v!gj_~^mNCmC3k+9O
zKfeM^rOhm*A0ymzXx8B;ba#8n>dtzZsxzx?^G0h!@-KL+Z<`|m6<Iai<FN{*L6A<;
zc+Jo>thGB=4B5p=KxJt?0WcHv>lX%$fl$xL-5fd;*6!hA0*Uk4w_9e-JZurh_mf66
z3Z!Rc5PJY2lFhtQz?+{cZ&qw_Zxp1}sfQPxJC6`JHMq;(E2b#eCcO>#fm58#on}dd
zlK|8U!-ZFgo+BLC45hJ)8PhU2)Ted1{HQiY&+^HvMkegTXX9m`GSW;yzUW}E9=wr~
z@(|QcbBHA$U8hbJYaem+UOZ$6)eeVECKAb7YkLN&+Z4DaT+2V0y^_TF00Z_}?M~zi
z?Ox0OL>h$@SV5eMG5$b5!59*yV7$0N_+8#?M+irsDc5loMA(ee^XBBSV0A>L26I<X
znCH~{;NTsb5N5#rNAK^9PCe!7IdJY#g}+N>5sje5w_|)5{8l?K-6-l_jvT7QUSy^~
zh5QIAh)=uO65?tzgD4TKU%)63%X)bL+IC}nV+q;lyQ$S!ukIsi#n5x!#7&oZc#4UN
z@<|D<-ZVq#c-z1psRAunI;eMnfg>JhFM<{Z+<_z7psaoHcYhdhbJ;<X`JzY0hLk-x
zAPWh}!x$^CX$;I$`r86~=J|F`Dkra$#}x>;sIuHY+T&(3j|)jZFRm_5I(mRv-e|Zp
zXioeQ&oN4=mb-NybhbIw&%47B(&Shr;@$tCHn6Wd?|O-jY?Sz#^2T%+=^3wrDEsOl
zz^=ljo<^Ua{kiXS5d*Z)upwKG@b${2qXN--w$iev-ubs~NcZUbkolfLQl^LAjuZnt
zmTz3Pj|_lFyax2ZR|OtVd;hXP(*b_M$8FIX7t&x?2W}D!WaYtU_ypiRgIO=i)eX#3
zQsmOVFY~*zLEG;;bHyNL?(9bu1f_4e43GeWg6hN{adkdV4{G&`=wCHqe=Sbw+?YG*
z_v@YV>rLL7%vhM3XI@}R<bEFSIk7xqb=%V3$Si0=X+F1taxdq5gvSC(c|CzcWTGFk
zPNgrCJ2&LKC*zaP-a)7-kO8V-a<t&PrQ8wLc4GZ01J8G4))@-P8O&|9mn-3o6l0Xj
z)-RC@tWB_*AQ=K%60PjGjvNi3B`pu9_nL)3+G&|6F82V^vGyj(0mQzH=Ylop(rfyd
z7Tlusg}EEET}4tN`is|{sP;8C+*z!~q5dke)-c;JxGdz%_H48zZRM2cm!<weMK44s
zsO`}k-7e^ZYKoZ6J`tf>m#^T{qvMM^x1D!tG}@L`@OmKw2fg~SE*J1UP>U>8Zw{hO
zSRdyjIQgxGw?RbBbHh8z6#M!#l7eq&Q=(Sy-g!c+-N1Ca*MICtmI|LAV;u~c^z<HQ
zwD81zDw2g4ta*9(wn)i0A^7!BGeL?yVRw-~Fu|ZYe_-LW9I<H9xjfT_z}WUPjdBwR
z4))<6S26=|RXVsoQuRE}ENNEDh2*~Xox!zeKq%inb5H5p*<4U-(|vMOi=}^u(B<EI
z*@K!K*3AXqNsKl%H@1Z)5K1%!m8w+d!Eu#*0hyKJCl;3K*%Pm+AxiB6b=aV`^`-lm
z<{)tR#z+&!5UCEvop=QXO5N*me0cQf(|dLP%N5~+erbHyP^P7&_aEcPf@$qH3Bjh=
zG@}vUK2%xmiX;o+uYL|hdqwLNmcD0iSFXBP$5YOxp0^XvbRxb@dZt+F=YU`}V+54l
zW|=MeYU+ZF!BSTsi5%Z<@3j8=cE%n2Ii5Rsmx=o_(RGJ2E?D+A@)x0Typf&&%%Cns
z=o?jQac(`tL+>(WU=-!7+##H1$syTHoxk=ugl**=7%axW_G74WE;Vb6Up~EE*4yNo
zHlk29iUwVOA`76_xQsHv<<BDES0&5Hr%y|{FJ*3vLLpTc_o;SJodr6JJWwOthvMD~
zo#yoNZsJA7Kr!N3>qi`(tNA(_5Z`cB5TO2$_C2XH&5q(OyvjI{PZ1La8Qy;_<WA>A
z_jiGt7&L!&`oz{7pnW+h9~rRh>1e`^LLRQ2enKOOIVn|CRgHtT3pvyD%<j(%Fzt?@
z@}7|mxx2&mVQtOevZoB%HJ>uhMqe!o)ob+ZN8Ow2V_f!%pAH>jzFfh!VB)HBCA}S(
z=i(iEZ@t_DF#_}+$4d28^v&!+On{9F2neJvSDo<8bw%s)g--I@Mah`<CfH7A$Z)Sl
zQajI8WN+LUe`7AJwNBri&b^3L9GCm(?&&4dy^v1i-(2b#@tuAfSGYn;;iT$VX{_S#
zp1%n~Q$*3WLZc(Cnt_Gd=lhM<SlqO*V2`RXU+V$19=xarG)iDuu_V~)>mhoaj9V+Q
zUvX<X>@UWhW!*gU=kS9pk0jkI+DkqiPvF#v=$n=QzepMZX-rpsZ)@GM%!5nQ1&nJP
z*?PBW%nL{ZD*U1UEJ3D+0hN>V0Xx8o5{#8coGUQ(UrYhUEiTQ*+BB|uE~)*tL<i55
z=?&H~8;qY@jLuPE3qwJ!<9(ipR9<CKPwu~;oBqwyo{HyOqzp}R=PH|0oja`pP0utp
zg!cI?iG=cWB|$dLKW^^Qcbt)5XzGGa9FUfvBtfJ;*O&Iv-cy%tTRBh{aLT*Lkwq}z
zC90>|Ryq}cAist%3Cdeg)1RoDiAJA6h6edN6;v~;AjPt@K4ettap(_BIB+@08uiA@
zvLHVJLlqCn#VwVX7<QQ4Xe3Rtus%$YcTa^6P|=kWvOTeqGo)`#mbFES*?!@qu7$%G
z?-&=C*&CC%KS+O&q<1?1JfFuM{M+cv+)x=N6p+GQLzUH-R$^l1@_gcNUTzIvk|gGW
zMJE#>1U56!ZSzh9MGaI`4i5ZX6p2!$RbpN}gN%O4knt8-E<bylEB|Bdws)bU557!_
zy#z@W@N`!rig-fpq3B3eHp0zPxHFw0pj#Z%yYQoeubyPytz=kFs^^xiA*GgJrrybI
zKUl;scI5iW`4|^C@dXNvUZ$lINWwNssjS(#+P<kBj@L!GJT&(suk*xkub(loaj(5^
zaTEP=zL$$COHur+*pf%ioeujr!r73A71$J3c%EW)5;(kaD~CF~+iota?UBAghgB`2
zN$as1gpmzzn%lP$iySqFOI!~Y943E^{J{wSGBQDC@yGuWKI-n_x?BOVmq$%<$5*xw
zD&ms5FmU=JQ)rQrvdRkkiw&AeR~YR;>4n8$Q9TrCl>k}9KWM;+(^FwZTE@W1Sk7BW
zbe!T*rkg1nvi;C&WR9+xXIbNpan$7Td<a6iCFetzW*3Lpv-6^GMWM}b?!Q_e$$8xL
zZ-Rv`Q$i3bmXzbiwZ0>i<HMkaLf07RH&Cju?6#1ByeTr`(u0ZyV|<?I%52G%NT?dT
zYLwdrN4gGB62Pi5;C}xYYA9L0wLG3^=AD*GGDdnXLqj%_)&>ID((|U$d#!1oxV?VV
z1KhFd0X<2fiRQCg+C@)Sn$_SplN@WP+IM9->5i>aBy~7YA#ke(BSmG-@v#zUm=vEY
zK;jiSk}+i}TOaq*=3`q=CpRo#7Zt1IF^+J)j6{w)zgB%|Y<N4IFZ4W*+i$QX)n9E@
z{i=mJHrTG3_5<OFKU5rryv^nG65^w2Id}!pT>{s`aRqHYNCb_(y**VgR8eV-ME3l&
zOg-<2VkNje4}W~Of$6{$snKKR-YP83-GAm%%0hTFIZD9l5q7C6&4o?G(BA6{3H;RX
z%M`~+*0)KDx%t_X4EO=BHm5XWw&az#wvSs(&8T@0(AphVBU}RfRz!pYTjE3*k*l2t
z4}p`?Ntt_N-#8be+h+}R&uL<dUMLDYZ5PU8);K#%&Y?<Ls-R`(2}@3SERM_qOdwmf
zp>uBKgbvN?C2Iaf+sqU8!z`5~d2a=4U(;`Z;Zo8lYqXXz%wr@&<O-CQ$+Q^NVyL-k
zcJgw2I@T}2AIL0NPyLDXR#h3d7{T_$?S8(IYIA%BKW!w<y%!Ab^B*=dCrJDCzAw&v
zTNPV+IpH&)x#{8X>F>aMsGNja%tMxo)uqBziWCDaK}=4(eh+()j}bzxJON5z+xJd4
zUdB#=M;hlsf0841uU_9{dUN-df6^V52j7ohpFwvY26(<X*UKjMKIKsfqklk?|3{%_
zQgsDdu2?y@cUXrTAih8zBsz<i8xl;ODWNYdF$MXFf6{uS&jm%IxwDnTFnsCld1P7{
zTr2Sq``eW8w&6gI$y^-qT*3_MO(49J-|R?+Y5t`5*1mJOqGllkqMzyWl-{dJ5GB`}
zxV7g)>m@Bq-iG=C)sa#d@byK>PS`Te6T(A)Db!-}NxM3bxC}9XE2nnT-sDD6;f*)#
zX<qMTTXt;ax=b`Uh_}P<-&Cn1<dCl9CgupgIlsKFTEfJ_mGqan{XA%nVP+u+>Pb~R
z^09cGjGo&{a149t+a}lw?`Z<G-tga0SGeK-*V-I(kC*xOJ|^U>a(z7PRuW#cak#kb
z)1Cq-o1fb|`M=YDR|DE|UnC|!rE}>0T%66}N#`wuh{Zg~CXteb<zGrtqk(W7e6`%g
z>1;iE6SCDE1mO%#;iHFl0$ab8qVl-SMltIO2DgBk3tD?}Qm|E>5#3s2whTPS8SAW8
zuc=GazqVjTo;Yr7|MA+hZ>(2Z2e?lcR!*yfFT_M%GCDm@{Do}bs`YT1-m~eUZ8<6}
zvCzg@m-dgI)tmoB<eak<0V;ZQS$b?1lK5DhG40C`0vZgzJD`R<DA~bDAZ`v;d<cN}
zQ$>km7TbRSn?tdVkyXO)#*?}U1b1`k&DW^GYK!nrj8AHw#ASSlmGWIzam~2}nDxcs
z8q7l?P#yl9+bq3(8#Z2~^JA~t)M*xf4KP*wD;gtPl0#hN9Mu+RH0_z98x_)_$<H<2
zi?KVe3^{W;6Wm#P-z3N#$^)eA=U`8r|E)j5-xwmP#$2=P;@etv=v|k#8tCjGegRcx
zV{;!HfwDKs8L9LXECW;+>@oa!Ub|l0>J|<_C;`~@&47MXyws*x2g~jBA+!3e@0hIx
zjyNMg0}5LBR9$8(=E#31TQE2B7k_?h)cWzUUjK!D0?%VU00_Dj?QL-Og~u!z=n$VH
z%JMh`)q&F)h3(+0egb9V^Mn9Oe~x}U{5d|OGS?{vK;GgE-LTqe;nT<edU^bpHi6Sg
z3o`1`dlbmZN#syBqN6uDUpM=ExM3$BdLrVKXa|0ie$2dOpBhl1sGO2MPrH+`UGDYy
zz@pg1LprjcN2lM{IUapgA-_|{l<*z{7GG;dH4fB^hqW;Xf~N%tF5+LvXGfY`UVh?z
z2L~9usO!C+ku~NKqe-mSV$XYWjXKvgW2!*%tysBt;7={3?Wyu^e0~m<j&Lo_?Wdn0
z?sY>XS3HgR6e;wIVZ8h|@&Ktq){&e23F^j$VYoGpgjr->EYB9M=xW`gh{zNhBik<l
zC$s*}C>9DgU3{f#PAZIgM9u%ka*Jbs62>0$B=G2Pb#bW&9hZu~gue9e{xniI8^Gy7
z>%z>VFpzy_nzCZsSy8xJZafI%?C(8&hyFx{FZWn#8FP6lZJ8A;tAfnL3KrX+f*wME
z<>FTHdYTgQRFbiq5w*$ng>T)Q*8=)f+Cxl1%c^h9ag*7?aKA`}7S1%nk>7XHI-JT)
zB}S3H`Vf1V;2rWPWU1wX)|#o=qW`wV^uhr4jSf)D>ozP>%y!w7`_pW~*3@@SUYSt9
z<Z*#vS6SS{(EW|Mo9BmhOAE5CfArg&)z(ypX$8%kJPufGMj?&o?el;N;@pS~HdSFZ
znA9iB%%JwBR6yY~_{H;saweR(y{v38po+TiC6l9)8|=cTDmm7L_AzplVZUO>2l61Q
zKhU6Pc(pvJwwN9>_jGLkNP-G~6nUY?7J`gB4}hB&Lil8G#5l+}jy{=YZ*NHec*%5G
ztA_7v^v_$|O%T_C3!)4Qme597c@z^dq8FX>FxWxUgOru79HzwqG)C4b53?Hg6o`>c
znm!g9>U#F(YyO_D03$00@n$RJJnwVxvDhx>0?P{12-j<mrBuy95O-+n67Fbb$N68e
zLk~SW4WFTha)9vT57cRkA`SrSk>JOwVwqse+E<~*c1{6pm=7<cKa#W8-mWLe&A$NB
z>LmhLKvYcwIB4vs?!kYDJ-E1!vaQX46I_~s!9?N+ERBXX>x=ITYTLN@c2n7!t8N$1
z?M>OJXn}@Xpwmf5HmR$4;Dx5sZoVZBr0u^Tuo$EnScCU$VH;FIbcM?jzv2#!deU_c
zi%dNthYc$Rlb$TZ%$*-{$4UNO%lTW})QhAPD_)Ji9W=fwybOIAP-Ima19d^aA!tAa
zW^z4{`Z(K&2_r$MorLlUYw<s3PUwh-hi!R-(Y7K)j9>FP!gL=q(<nNWy8&@Yme5HG
ze!}jpkI*{_9l>Y$bAV#rlh<&f(XM3KLBwBuJ?bTtYjeGR+XKvZQQgGAKDCD4g`>=u
zD~lg+;{VMnQCX7mKe+rBAJ;XAlLKwgM<ksDk_U_+aR;Ua2ad^oDb`8D#LCTkHM#4r
z)5X5|ycWmgq<7H1=&^e0p37MA{f(HVs-{W!LwXxJ$Mb!aI!}tYP!4C}?e}yc=YqQN
zcIj)0)SAsQprySQ7rp7fkzuU)E(*QU!*cJ<<^wXAE1D}QNV2?Aw7w79Z;7FSQsFj;
z%_+LVb{s&G0B-=8FGIYuD43>n1;GsnqUilt7BxA2Z`{a~Gc5B!L$>@-QF}#ZIsNUJ
z`t@UfNrC}&JoDcw`j^Fs(S7i6JLy$_X5zc)efE5W+7u?(6meqAe__8!_$D%&<IPC>
z8&3w<vG6wSj@9N4-;d&Gk<uu}2QnQ;sV6Cz=%=^8v;F(kf*5S!wUea3cFIf<3Nrhu
zXz7v^`?&{jpfJ6~+?Z#&+H&&p_e%5x^<ef-p7Fh7QoM?#*otlHvbAe@(&Krt(dSN3
z!hMl)IF`l$IYT>5(x!}z^uH_}F@rQClTDJ7__%W-r{1=o@CM+P8jh)OJ>9lI%}=6o
z>wySAd1B6ERakY~HH!*D8tkVwJKXORdA#wJjW8T7{|iUl+#7ldTrsW+>_J&sK%!Cq
zBk4-~nehL=`zjOV-rS;*NRG{IG!!A5`wAuG*x^o&YEou%CyEfZnIm$SBQ{5pTe)rS
zgf1QQ+voTF6W)*4`}KZ3U(eU`{d@(Z{(f*o1SBh-!nv>r&Vxv&<pS-Uqx<-(x1v#D
zJt64}M=N1nQvX8k?%f#>>iUu}^?ERC|AhMUZ|t09RvFK|?izOQ+0T_MnO47aEN!=^
zeYyt~h-wF)R4c)g9w?n%`<*;t^syy@_POa(#LO{a<&18uDCjZt2X(M{U==}5<?L2G
z_m$MLjk$cq-H%%1{9sJ@22|?lhFog(qthX%^l0WXv91<!x^znu0kX-3>7nwPn6Sh;
zVjG?eeC>=i6hpo5v&Fkpst4*<#2BjLY)lkI78uo=bQQ=<&YC?87G)WfV(gUxxazBq
zXAd67O22V3nSI-5f-G~eT8>J}_`K)WZqN5tzidK<WVAm^;u9L8Bv9gzHlXWKr)Ks5
zLx2s17+Y#&`@!<VRjlFR_sbyXMu>B)Rfre1LT0Nu`Vue?L54kN(0(J)pHH`F(eNJ?
zaqA~m^ON9SnFe!mF>AWTS-7L4miaeX{K*Hi_A$U0dfAYR0Z66>%L#v$<HEB2lb-je
zL`Wp1oD7UZpw=($_~rmf`l0#=9dg_9$hGezX6;slPnCd5Ax3fvwgT1<DYZ#unJc_6
z*7LYUCxEjq3QNBEqrdxS;os}_f5sh3+w9!eUaEZ^y7M)74D^QZIERjxZ9!;+(xU2$
zgAI_ANe6;zUhpUlU5er49@{lg%U^pb%J4Ijuo6HcbRegq6fPtign<9?p3_4!?RlRw
zs#40@9veIX47x=j79Qi5vK4+hh*q)MaDbEtrrR#GBHG_0<!u(yaQTesak7~Bs98mh
zhfAY$1?^|)#;&~s5T4;2hd?@u1|xp)EFM}%d^<_I1UagByZ4kI0C`h#t6BE(Vl5;`
z!*PQ!@b-RY-<JgOvc0&Te`mi4{5ptJ&dj)TPNeKV<7$7@y?ZQ`K{v?cRXndobn15W
zm${#mM{mI=KHbU6g?e>&Zr(gsH|j!ziER<M$?T0StTOzQjL+jt3V0LrbusDPp;hLW
zxs*}{lxh<N6&u>fznT$$@e8JMOkPyU&ks8lYtfIROS6Fa;=hcr?W5>Z8PkXVy&9KQ
ziu{$G?bv^N<(!8*05_gyorJe?MxUB0v@2P!r64vaBnm=wwKie4A%nbnkaflA`}o*n
zeYbw!!RG$u+T*zKO2y8lSQyQz-b%Th{iEinRmfh={!tC!kn6(!pM5kULG^a?R!KL^
zxw??0RCzuKwmI>^lB0%287d@Yv|XZl@lvs~F>9ZrW&t0FVc6*^fIf&<PiWi3-U2sS
z{Y5LIorxFCXIvWedTfyKZdS5w_rl{xcvZO#4QF4-&(@>sr&(@SmYW9Of)jg>>7;lF
zb8p4wDLR9eMHUAloj^OOadr|&korrokzCv|*LH+9WWapqY}0%!S&Y1JuK?D@@IQ-l
zL>*)^|1~&uxRHXmX$D$VQks>Sken9jUJ=}^J!=F?vy&J&^^fQ8(gMe4GE07D;-9L_
zU|(9Y&d4n;Hb@AHq`~_@vIlQBiySXz22s2w=dpv>bree@Yv})#WDctL$*IOa83@{u
zWYH%`T<)rjeO|oLg!7U;oU1<%6*oaa5H5qU7Eu$^RuF)`NI7nHNIA8dcb5G-tiI#7
zgj}lP4akdqSNyMW1BFZ&0Q$K$XV&PZOJhv<R|1kD)9W>{QA=yYDh1GdQN_+6WgHWq
z<%Fn$9HoH)YJJ#;Jw<!6@nsL2r53_Fh%cOaDZ3j^!Y3bV9?2c7$TIhY_Lqd10VO9&
zG8X=MGw~S{y3S1YCJ!v`J>|mO-r;hji$<-5K|9CZcYT)l;ORi;X1@y7i+e&ouOF*7
z#hJ94dE-OG`CF@Qz;MnLaF}t(ovLodnoI^2LiuUWlI;K?s|8EwaIHL6c7>4Zkw9c-
za5@4?F0gt@(l>rx+g$6^0-U72R<p|(^qOFoL_TKd<3qn&0GnJgdjwGDEF))AfM?Ou
z$ebrDa;!0vj2JHvaO~)CXiWNzZd}jXzJDKtbHeX$KFSpraBqm;gZI8^Iw)-)e0b07
z=z#a6TtFg%L8C#NIbwV!z<&W)gP}8dM1*y=;>=!dwad-ISu(nJGg_gAA#}~_UK=A6
ztBTEjH#>$bh-(MNKpEvN($dSsPbGLWR(6$#-1aisKLKjZ-+BzV#2NV;zAYs8TRM%k
z*Ft^y-`boyZz}+f+DrX<UxFbe`}0Jx4Pch(@@b=2aciA^_9ZwUIO$w|nwD+@)cZ6S
zq0U&9PRyw6_f^Ju;s4Zg(H1m&<>wFLrmHexb+Y#s=|_EG*t~)E^bFfz)tjdN4H)^m
zdnz%(vI5&JC;DYAQ%~jI{AaFX>>pD82RQ(GqqTET-jA1kxP4#-IyNq<=0tQk+5hld
zuGQkpD@~-HIIFV1wdyXOuYo#B33-3JZPyT3mxbRCRuZxepYc+{GM%FWZh444X<=Dr
zo_N^uIqdF-I*gPif-nyG&sHS9@k6J=7ZF}mV#IAj(TsIpysHs+vrmWO;I)i3bzTAT
zkFe-3sZnG_PL_|(R|sd|OEAP>UW9fihp(A&n;5G{ioTVX!Ob1T{hSNSOMrz*|61pj
zow<ledni6XqJ=0)M~0-%2EO_Ak34e!(sAE3lSA5_hA{4fk=IILcY^MimxvMNEEE2!
zUH+PZi2D0-3xED)ciK+Io&6PAa8$hP_=h8H_osi)ULexbUC$^G=Vr}8y~_Uz#t9A2
zSB}*3&N0O@KlyuLUp5j7t>OI{mM>ts=&30O^W|P#(L4+bg^DW8=Wpe-^ayXRD_5kP
zhM2`Om;Q;@M4=RU0@FBs@%%;`j2wg|N<U(q5@fKyqDA?*25LD^hQ^+<#Z_#%ivA$&
zq`8V-L}a*NfPb3Jfw{mtbE0rb#Kz(2Thbp89&?pJZ_ryZq1Iu4PqG@D9^rq^<>@AT
zH~(%d<Y;sKd%yQ=-^J@dsMg9?$U*kG(Ocbrw@(ZGG)M?=N19||;P!CW_Y(qdqvq>A
zdmuoL*X{|BYl0~~!-K}zS3yw=0bjw}&U1l>h+ZZ5jh&Lp8uPs+jW=p-qfwyRpdnk{
ze&LO9a_J3?7$<_q`-OKbFP7JQd8GwNL=TB|6+imoB~3OO@|AG1#Kvw?F7(IJ(=oHQ
zHKjC8wU);aLqjSS5m2*fmId6we=^>Acn!5)X>$xN5J6YQ|J3P~XWlQjF%kieunfn3
zgQ9x^dm8RX+$Z+l$&KoI#$0;;o8QG^qx5p^xViY4M-GnScC*z3TAeoMy8%EOgqY|#
z&_1mX_jUnnxduY1px87i5&wQ=8@yQN*At)@Q2ei0(N)ApFVXR(&j?Fw<$A3^rW@w6
z9b+)D^fnRjkV}}g_XV!Ltk*oWB;V;Pgl@Pq+K^@U`R9o$XyMbMbic%amjg)DS*}W7
zfHM9&_Ki`(y1f%4w}W)`#^^<=4Im$Q4?>Z19>$ye$ZtYeJ5L;AH36r3eJ7eDyIHi9
zkQvZqFCDDiXBpNxr}^<fuk^o0P4b@l(d_b@kFs|rqi(zTU^w;<vNCD1IR>VnH$6i(
z7m;ty@0jM~h^@1J14dn#-UHZ0T4AXl86RQSk~(RcHL;8AEfWz79UlswPz`5dMRn1G
z?VGz@DZF1}C!S_*OgHv`(bXM6H(Oe*s5d*ScIj6?%ePK`FdHS4$j!c%C%kWe`vdF&
zt*S1ZA7WPCN3hl;j$ixq$_BOF&<2dnEd^7$xo500$o&zYs+$%ZJn(Vjj6hLb1KuN@
z&&L7y-f&A9SMyrR9q~mh0~WKwDHM^f<CO~I1d9AoJGy^bFRf*dH%I!p&XE%3131m(
zUq$Bqr8ocnykQ=`VXWK{<@r_f?>vX_uaa%{C0|xGG)!~GgXX*k)2K|2JKsuWb9S(v
z?+>5y8ocJ-9ASEVBe+mFHCkQ~{K-AGD9Wl0KYxMH#O5?b7hSF0G>l<H<W%8}EBw^Y
ztv=V9Vs&y+r&x~Vwod<ec_R)2045u!&UBs;LR;L(5zCmitS|?X4Q6GUV!sQXrI^F1
zQ~1JM&ib{tG8v`7s3n2LoIkSa8o1__N=U<cbTsfox?0ZWc~Y9E$6VF#a!Fvl{r7YK
z_RqaJ*0mQ_t9w-DwqlZV{wO5gVb|o}R}-eEgYn^)f4{;?GT*YC-~NR%d?SC+j9)sE
zXH$}<-{*Xv6&h0c`Prkc-}^SgX39Hp^Wb;ZmE!vrs|ZVs$7@X3d`)X~T`C@lZnjQ<
zy=5OuSJ|US9mC#T-xbJg@CsNVZS0usJ2-<trHX%m{zAzIBn9N|Ka;pG?2LfN0qJA5
zK?Q|qk$&qFX2Si?tpF^qsnaL86|F7V`JWdjCMGAR@gL7O&19{6sFW~u(8{=Gw<2-9
zZ|3pgeBAqvpDkZ%9{+YejA~MkeOmE^r>MHR`b+TYw-%KL=EHfoWB@enl*XodOYfry
zpJVoq5CJhGXMki9Nzpl%Z7XfygXtOg*VT9K-I<^I7D&<ArI)6to+lUeT|*J|OpBQa
zJ2rr*yQl<>yS}e$t~s{Ke2%U&C3gV;pSWz~R3(`AH31xYV#-CK(kxzqt#AKPlz4*H
zea!?mquc>z(4H?IX$R)rl3VxLu01bu#!GgKj4tZhRM&Q?v)PfJsyq8>2Kkhr6gCF6
zg({7kne!4#Bj1g9F+U@iXW<$T8NCnP@gBs|K$+pCM8zE<P24--PO^lU0(`FuN*4Gf
zIl~6Lz*-Z~e2e{s8%ph-drl>=@tq4(fILJTyp1@Wv8BpOnutrK%g^j3y}*~E{TWt;
zBy(Dc4RGaV7ry~e4#*#Fm7J33r*U`BeImInaPPVDLqT0GoqRtfiMngO`=WpE&CjXL
zUj5tru**-<4;Q#PWXNSOeFKZ`Hdq}pYlWebctBZ@nTVXe{;CHS?^<M_!vf%#JNwSx
zSG%$M&e$k=#5Jh(&er7BvQj`(_0;jlfEH(ARQA~$bO*2#p?1XKvOe6wJ5Kdx=eGJF
zPcLHTVEIo*bf|#lpgRg?OSMG@=Js&YJv&<OLK-$}Pm3cbg!>#8V&V4G;r-@!5aE^e
z&ZRx76muj98-%<fLGxLFn8yK05d^YL%1T+fUzhdAi*o7cjNgS2baSB%c8^O>Olz)K
z8^Hm*sN1QLD7G_)&iL!geVgjzB+rw)B|4JQ>9=>S2f!m_<jQV9_?!=&C{`>189HbX
zO=aQ)z%6Hu%r@CDfj@nxH%)^><9;~%%8U>cLkuT=-rCX;g@_D0+_T1=0huYDdmKRp
zZ*C*ffE((?hjJp`@q5gbJkf@TFv>t>|2tx?$0NGijQlxhPJ}NW(-E7`VbRt~hK77d
z7V~$P)fkZPj2NhLBMdf?hAaVjY{#W&2sXU6v-j<@Pe?DM!aLK*_rb~O+`En+iqbYN
zCQA)w2dV3gG_UQ%?bsTxAM1$g=Dbg_-);U%4T#b}Y}Q%SDY9pT*C#vf+{Bsk&bC}1
zM&uN_^0v413_}O|prex>XFa}DUIGb#LS<?nj62tL3|PT!FB>9q03wmj544&>ZrX9$
za9i&^>hlOSQb!%cA=pc6?tIgWjNj}1dFQv&s_9l0lXg27_GhBQ(5v46=407&H|V~<
zo4sY>d?TvxtGAqanSm*39uH9%hnV&o*BgIJzOELC1B%-i>`X_{BlyBKSMoWuHLQVz
zzOZYH`8VQWjP$#qbfS%r6I(jhSuPFaKCMG-W6z`pBiFr4BnT1T^Rq6b)gB=po(x(y
z_b-X>dn9R<9jqE&-{7*>mF7b0wc9cc({SO{qaMSo4_uAfaR0)W4y1RD$WwYI*{_0>
z8oTY_IpcQlZm9nYST<hdKCoXe$(u(VIE>hU>~nBmHhy^S^}+rpZLO>S`nE3cdXf)R
z1{CgT@#JShPC>>q-G?3U1CEBt2hpa0^GJCvRlElb;7TxZU`Dvgz`YS)=J{7lx2((|
z_mA_h)D7sXv#HKCZ<DS)NJ-*+N}73j!~HI&QFCmC<FwDL=CoBR&k_%N-@qT_eBMuX
z3*>oe>m!_`VSZey51<!Th>WZkDUY8V;xc$~iJ0?h&E_QkciFVdcI8`cg=&5v`~H@2
z(1`r-Z0PFHXSovmH+%TlX&%t_P__G1lk+bt_&otkHMl}lNm;v?({oGmUQ5u>L|Ezg
zPb4dZdET;IwwE%rBTqRpRIlM@4SfOLHGoT@Oq-mZ=O;xoOl3@L(h=!nu7F(HCtow<
z8Qvhc-QK=_U*WJOHvaC!ieoiYh)p2;(KESEcdk;~?9L&yCmb!i^_Tkoawmn^PYN}g
z)tYhi&2>KF66ez1xni94lkLuKTZS<(c~)&a#nYKh2<2AyVN-X~V5H38oCl@Q&X`#c
zd>Sp<k63w(UGLsr|4^zC?z>+Cdk@_jA}D`R<4mG+zW9ug1C5$J@2MX(6FCnO+o&8M
z0xF1uaxL$PYcHg%-sW!+6xGxyL|jR&$^H}QYt|EE689VS{OgLr<DPCH1R_ZTBOxKj
zYC}j~MO-K+&?E)%sXF7KViSKT!W=SA9Lz4gnuaRm8AzHW+7m84f(?+A=vu?ABz?B%
z#(dI?awULM`l7vZbKPBrV5zj6v}t-yvZR2-zD&b8HsQ{J+s(e*yC+%<e=Q6flRt^g
zUDs9PkIJ7W*5c1B4+{d+ZVfYUp|YUEeZyI9XftSKSdj%P8E;o4%$wbcjiQQ-erR@p
z-KrrC4$rcj1YLSt$l&IriqS;;@(bc8nHDBp5^}zkylt>0bhLwKUDl&3PtVfDREwKP
zl#xs|)_ovd^L<>}JWH~14M4OAFm<?9vrA)bkE2r!6EOA=LuO!4_DXaW{qy>2;Q=yW
zV)Hm~9Rl=Kz-1#!KvO7Sw?5VRK}ydZJ+*Lkms+-nh!cQr!4}84^kWkPah!pCUL$eq
zC5$ZDf4|HYX`F9OjvMC3P+WYGbLE$m7bBje;GfJqi}RC$Qj-kCiKeHBojy8g$B}DA
z<X})XuOZADzF^#8u~{21V<>&4+O6^Ut*uz9NI6UzO}-Q(Ixt!OgOG!FRLGQl-9GS%
zd}RAVkrl$hrgMK&^FN<t%)11<Qw%gXP6K~{ILYMs0t}Ed8nh3-d9dY`Y9}Teb3O4}
z^F@dpYWn!1TnD14+8TdMLqaF$6g%&Ol{^~*4UWVvC+0cC^Kf+x2k)<{{4mOhqA2}-
zQeR4%n2=F}fGm0a%D4V?c{bFWM4X5aor!8t$k<UJ4&02%b%F1?*j|yP^l?I)(T5_@
zEP}>ow5tj~c8G+ZI}I|jGlrxxKvs$-UQl$_Kj++6SgIWV5Aa3&$1czEktGGtDs^-p
zoB`~5Oip3AlF-e=q*OUpDhfS&TIJZGD8{Mop{h?#YqeDYlFbulL1YWr8ZXZ^nuDuy
zuVOOr9XBMLoH<YAf<UpG<M$pRRNS*mugFTvn83D3_pfHcEC5PumY@o@#WHJk{FSAv
zqO^bERjrbb_kK|xsl>y4Qf!;mI`#N;O?5fmS!pKEZz9OfpU%aS8T`C4BS|!)pP4>(
zUY^fEm-5b9))uN+D_y1DQtJPQ)l<c+cLjAHkfS%P+gmt5=Fs8Xd!{qFpQqqo5P`<q
zq``XKaru*1I6$eG1J4<^f{jXWdP^$Ce^Ms*)PVd?(sReSb$xiPv#9;Buo)|!`(Lz8
zLfHp1#2a4qbXS2~t=U)a`{n492iyV>BedZ0+Dwm&crJaZ;yN40#A?cB?HqqG5M*G^
z(1eGEsbpM@24YzyouAokb=dq?pPD@&EV&}LXx~S)2Mj*CB&{LK8h15a`!#o5`Zy5v
z992y8>FpuQ4oCAxj<6_TZex*kpKm_>hS-MXtO*bgXxHUkku(6QZK0yFzUYCAMV|wy
z<ZQjZ@1Ji2a*4^@gz4?S#cp|cPXN9n0&9XcQWz)tx2~_!Ptx-~!i1p%JW+`L9tuW@
zqR6T5IEQd`P{=s<`tM=Afd1r?Um_Q1(lw{FSFxAK+|_AW1b#GJ#<Nxp$6X3NwgU}$
z_j&VHuS@UAdVUl}ks;@ecyDiTp6&*3kkc~*R71vdd&nVpzkyS-E6v0$!8Pk9c@0Dp
zO!CH}OI`A~VC2I5jY|1^dBPrDvHwP2+<~z92_E5#LLSuAXo~-8giuK9kU?%xE9Yso
zlLmzCd@6Tp_7=f~CTidB&|)_dp>d<1<utv%NL0CHd|`dPSm9Sh_$o;&kH#(u^#|H#
z;|p|xrn|4&Y^Yvsee{#LDbw<V=dvfcKBWoFaq&NdQ!)6=6=0A&u=E7}HfwMYm<R~%
z$NpLIJyu(=z@aqI)d$Xm)N)Nz?&%^y$NUg+5ezq9QDDnxwK1C|4rac^_o|S<2CV4V
zv;)35`d#Hu>b`q&^iI<($y1SCZ~97kDA=Rwz(Uj>X8)fn!R^Z?vJ*8KBJqhyhV5?o
zv=qY7mo}mHl)97<WG;B>p{P2N^+SQcVKK+g&}^w>O!EP;OWa`W-AND8e&NlL-z<q@
z{9Xx#v-Jn*;%uB%A<IKsi?wqBRi5?&QydKP?aUnZR4yy!i*gnn4KOuw4rud3yv<;}
zKU41|a8Fj*!cW-=62!-}OfO`lsx(pT@o6tIw#14zS5B>3m9r%Qr8o>rItEsTiGxdf
zulX{Ba*r2p<6qL{n@IK<2EsXthWdbXzsZnq>EUU9Nt^(YKH&xX+nkxrBk63?rfD=8
zcbM$o4cT3okc*FukRd&j*R|T^i_gc1icx^rfFyMFUB`psltGp*?OCDQl*-_ERx}#x
zh3tbylNBk3OJ1UdEpnibW(q&R{g?~lH$oL}43(o1p9>oO3GHd#IgLA{(Q?nS(rD_A
z0ds>2mIzn8l=tA@de|0gWb)<Ta=_#2fuG2GKp$TL!XR7ADotCjC>xb(j2{4(0vorQ
zg<aic;khZ1kdMnQ+&QIJ^E5mq^kbVhA~uj~O0?Rg9)A7d?+Uc?JkLn(@dzbajU`Q9
zf)*0mSEQnY$UNi>?X<UyBIOLQo*-n6f-C3cln+UZ=JPB4E9d&dzOgCsNAty>h_3Xa
zCi8v;7`aB^sIipQu4|S6H5t`sv4`2=waY|PT^H*V(FY7g_$HE<i0?`<g~tBWy%G8|
zG}PtQA-|MT)XmO5dBJF>z@ch~j*FVBHdC<>Wsu|_yOyfk72UI*h+6wDQ^>Zz=<EJv
z7S@YDDC|p0_#QGzJGLfFM?c)FCN)39n1AKtgj=q!OpsoDi^u?)Lp=CuZ&gCyKE2ws
zbAgLa2HuV!OHmpXZzytF-Jd;nYmmQpb4BHHEtOPdOe^VJGDPqIfeSt-H5h{O(x|7g
z+gg?n8UKCF`7N{N{jDbRA4bq6b)IVVO|wR{Hl;p^l6?%Lj$B{V5V?n!Zb)Sm^k=Ey
zZqGz)eDtVW4U!3$v$2ZB#UYwP3pY;0<;;@1sT4JLmGw&ZrqEkWf~pWy1u;*)s?=%2
zF_-6fX*~oACYR&5JBA%P%^7>W;@-x$9Uq-#3e!0ss!V;Ri(S13oFWxx<f+}Dfn87~
z8C!J%XF7Rat-sAqfh7h~92x7Cu6P-v%ghtRm2YDK?;bEC<{1*oTXjxox&kf-;VH|J
zxa3s+0^ENz*Pj%j4CG&6o8xQls%1}*kKXg&G%}Oz6t)yH@~HB%YxiT`PQ;5=zDzc8
zcBNH+?SwW*9^T)O;#aCl0aHR0cdxZM@0l-#e{*)_xAw-a{?HsP$zsIUj7FHA201<6
zx(?kuT~>;`^@U1eQS4HRxQkxT%XA5MyFDf$E*qxd<4pQWBbZfFejYp9(&egb&bxHc
zcf<KT5j3-0RS#RJ@iKb?Ke2jZU<r>%=YkYGtV`49B>}V_A?nxehJI(~#F`>|R@R>0
zIl321mZIJFP-0WL$w5$qUmq^GCtSg$zxw{!`>(bSA#b}zn+1UJ6(X+jI-XT7Qzxi<
zT<lzLD!Ste-i*Fc;EFNl<J*uEkWt9HF$&;gM(y?rh^b-Mc-CuOXk2GZ7*4d_?V4^R
z&K$1#PB|S|w&K4v^m)1~GQf6&FTzv;4J#|1d~>!&z#LbNQ4Lqc_&>tzHrkvw|1W+=
z3E+$;re3NqV=OWdk3hp&<XjH~Bz~r(jBPG8<f;^rnK?U2<A6LurPdAL*!~3hihf53
zX1xaAqzm5n5Qdz7P#pvgLA<0~Ez$vurz>@`U&=WF5IkhpO${~tq54wrg_MBg6_cX)
zefPE>8;w^6RStuF_?CFfgn9t2uELRq;R}b9?375W2H1d=>Wo>(7J7B0Z+l3x%SSoM
zR3=ucq6+UIFGRP&DfRb1ewePp)!$}wgBr-FA6rUqaq}vtn~lidYbnE6`Gx)(@x<nH
zWNLzggBewEIXNPKyB4Nchg|sA|59s)LK&$IHK@0YpYydM_zBtvp$2m=8IbokSGMW5
ziXYldx|Bb(^Y3T6BW^rpu7BuxMblclaDV|3CSHSQ7@Z2d{VN!<&7TPCm14*5F<(P-
zl3{yJH>Xk|q(o^h=?vrU+Pc+<7CUwwzSEPV?oE+%(BF+n*%ba-&ULebUw-z6E^2qI
z)LT0N!UGN$Io3^2KFCLh(RWwV#v?ZL&v@kBnh~~v4l`P@pNEu*?YyG0kz30<2-dIM
zG;3b5rv(>=*WGGBQfM+yc?zKi4z-D1r=Pk0q+T6+>cTo*AiZVj)0WVo7z-a99Q}Ou
z*C+o6;+{jr^R8@iA9#>GO}UA(0t|f&gOWWig_hda*!@1JbE`>Meh}3EdGf3}yW<yn
zBD=g1^)@1#9cUE$ND}n`wOh4W5bRh14g?00G816gPG`L}1ZcPEVT+e@<apl-wmKO7
z8qeaAvd|LglzSU}eNOxR?zx116V}r78^O<Xci5McN+)_c0mD&Nn!BN52DuuZQZBsy
z`%gNdhM3(B0Uf1~cOdP)8pE5Jv&)ICdzdsybP17n)J!VoQXs?D96xIX&sTJ2Ec%IB
z;qvG`E#MeNTgr&p4p@wSTwmbrLj(&bjO8gO%yL9hM}rY1$yV&G7jWL3>RrK!8m3SG
zK1%x=JpuNTT|4E|5gShtxgmNM3PK-GgMSQ~Dsciq2R^h#dA~*oHmLGm#iQRFT_H`-
z?6>%I$ld`n5se6kYUoX%UW~KoQ1hUL)Kq8lBF~mIkMtGeGaj7z@?nR+Z)6Jn9(cwf
z|Lv4vcq3}sY>^$OQ4A}f1U97<_dG#!VmzYePMrqTYsCEuaBJ2m!K0PNBgCwDvjLdZ
z(H52<vXBS!1AN9^ucS1h$B^@ij-zj<CY-tk2G^jfam&@CRIK`dz*=~=BA%m<#oEOO
zB|6xS>BHrl-Z@wpkY{yyL1Z~JU8;DJah*z^oXGWXLdu)iWtTSQGEliIN-PbS7*A2H
zk#RVo66i)8oZIv;Fjt@joPeCZT&OCY$OfPSAD2qu3Q4)M5jagios)cLNo#bsp3IuI
zXi48y8J)?MTP|;s7W&e^<s2m)RX^u-5aJMWFw|%4?JClvcKg%rp)|}+J)BtX9f0~j
zjn{Q{k=(G)0agL(S2sIs3R|w#NcqD+fi=(;>0uUwMQi#h6{Fox%<8b=dAd2>c{SWQ
z37b7O3A+!-qGKgTe!~T<pTpiEd<ll#|Dixyg^sZ6Q&jU!06V@DlD6h1Q0wHvNwI&O
z?7dovR2*{+$n`)WZwe3)_>&)-!i4;CNWhAq_;wQn2$c=1pe>Q>mm)$?;h8W?03LrV
ze0C^q<(QbpU0wVsnt&!i0jM5Mi9J}t`F7hL@OW2=%*u^N_t|qs*F~(nu$A6`$(Ye&
z?+Xz!8rg)9hIgYYXU(uka|2}lWZm0k2CFH-TK$p_=)Zba$sEc;{^cv%z9p{(o-jHB
zLAy?8-M`EdS(?}KpS#Tjo{$|K)H~uaj1w8DBg&)B8<pd(DAb4>f}qk&*R9SlE<);`
zTgZ6F|Jt?As(P4FAvIa$(@~oRLD{a_`{jh=_tgo~%tZ+wR*wW}@GjzD*eVZw0Gr`;
z<0+%3e1c%e<(0!fLVRQ(KdMl1Uw^W&4=;`T<uZ<Ni2U2SRa9-mnYiB9;rZucVTBD4
z!RQgyo5(WPOTEQ4<kQ*tsW5&dkD(@a_hu?V$jH5Jv5v>FrJvQmsGSh-Und;F0zo2M
z`MS0oNm*Rb6PwL<t>GM?wR-_G+5uVdiDm3dLq-rYKvDEHKPpc@Kg7+2^MMq4>paG4
zBDOK;qbDmdSLuhqm;nz&_FcTa>2t09Z;jwS_LYa{7CO{_r6qsgzJMw-AeZ?X>6JnJ
z1#8uL>1upTx%Ju$I1F;5EQ>-9N&vbizCi8P38W*8denK(vI8W~U%)U1_M5*WO0X75
zeg)H{GNkAA!d&&!&Z0k;9XsT$fxsoXOQNI8!7?|_<rMcp6{O<{*Isl565DTVq{#e>
z(JtkaPxYb2zILy^HzRP7Otbi`IoTz{8Ub6K<X1>y)Q(ydXX43o9ck|9r5e=mtUPRZ
z@i&S6qgSsKga~*XZT`i#Z3RDeq1Zh-C~z#X748L707X_WPr{mx2TqY@XIZ7_cFSum
zJ$Ira+4M3OD~FBayxwBY!(R;mM`#ZNZ|0nY+(ld6K-}BcHTB9N!hTN#w`q0WPfte`
zE9(tqeAU2hu5`KFa~G8)Qxx^=0sd??&B=O@2Dv;vwizV$q!5HPcDu$6*pYU)k|PY@
zTiNc)(H4Cv$S#=lh;b_>^4J@O&_4fPpWk(6J4jMA8#F)a#OGpTk&_0MMtLb9RRuG&
zMlUq9K}tk`D|0+a^;bY%YaGHJ8eRkSJP+!av%?+B^phSD%;ZgPPq?iI-s(=Ajv`s1
z8Ie?h3B<P*SlvjhOGD}<jDMVSD7&Y8hC&Q0ZJ*@@cr(w%L?XfO9GVGOB(v81sr%*Y
z{yHW*eu<)BWxD)3#R-zZr5y)&1(@96?KuG8*Z0^<eMSDcImbGsF;cL}NX0J0-CHys
zk>yJ-8d#}ABFou3l`oxGad{oj{l3?xMgE39;g6rJhDF5w75<>aK)&lCy`Snu@0>b5
z!@*M@a}wZ;dg<1dTbGhnEfe>s2b2`aqE7?iAAQSt)ROR9)D_iVZ{;#GN|hiB<gyeC
zDEhtTDA5$Bkr{PwR9+jDAg!4M5QZuV(i?HQ@TUqOW_6O%ibuc%;$y>(A49GNMNP{W
zW+m+Bdqsiy=wE%EI})~pHtv1<EcaRGjKEJN9^`K>h?n<k`i<OzQCd9F$FD&9)3*5~
zdw|a~f~~1+H2c?xq9@ORc_K_g(Dz_EA-D-VO=8*YBQc1xEr*e*E60ID`Z8SMgmN2x
z+SnD7j?ikaDqZuT=*VNyeUsJijeY{}lr*Kk4k^FWrQgj+Y2i)6t$_4h%~bEWl%#Mn
zpJQj)CyA!CYT)TN)<IUR7piJylUyF|`FpbEf^%Vu;(avGp6F-#CgFOG`AjQ=9zhNI
zG|BVSZT&)VAcG$@UUh6(co<Q|Ap(brFjPw(0Hk@GhKX+3f)DViGAw%Oy%+KXUD<r6
z4Gv_g<`&51`Q@miQ-?~pw<bJpAm)Zvg<Vj}CU#9=2+~Xz?l)1@D*y1rqNJ}mGSTmw
zrFw?<=5yeNyXY0j16gqp?)=f3Ey7%1CPnjT{3^c#3s1xbO25_34?fZ1lP%Xgy()XC
zc&IX9!tvFr)~`sSTFH6%@jk+A`^2R0O_V#oMHqFCT#T__g66FjSnVt)o*6a!0hU0w
z!4%i(vDHQ)S$NEapi@fwt*yuDeICZnhz246?Yv=y+maPt_qn0r$QXSEybJhs@qa}9
zpp7DYAnOT$u(o>r73jJhdiurHTlGkOX05GCu*}Wsryk~b{9T}D+h(e|JL;@4HP=Iq
z*E}(A7tG7p<3Gieiz!U<yFUq>H@{?eOnkmi8MjT^51o~Zm@Y{(Unc08>OHkR;2JwF
z*Zbqvr(Z_@{{Gl~m6V_vS-aVl2_G?_KbO9Xs&m;3#MJ}Dx0)?u(N&!+BsfPt9Ygeh
z_rJd~N9Kb3{t5dc-{@ST<!nXcKfkNQswS8V+KkQ?5<to-NS`rc0gp+?WD5u?-39ty
zog6}(fW}85{DG|4$$D$r*%T<MSwalgeC~OO(Jy7IBhH^ikJOP+%0|e0lCI8KpPD1G
zvW@3g_3iOLR9I6^ooq&T=3t85jnxvMLWXzb4AW4~;O0JqjO7l$|A_55#=naLig0Dp
z=b|1;>qV2CSZq?Fx(3GYVF}M}vhi-@_F~Q7FbTuEaeRCBjfI>t`mRQy<`5i5uWxw^
zUis3xm(CsIzlcKRijN)&psUnI5fMEbRwPx84OcKTIXU&%D^Tck2g#OB)XTGgyKJ0z
zFe|=_q&RiC2@MvE_y#km-$#TvuLqYY_B@tmS7P;U6IrsyULKj8;Z=l7V8OSvOdmlJ
zr1e--RZLm#BxB$x+OHx*k!M<?5@?FAHJ;Z4lJ6g1io_CWb#j*^O><}}6=8^%H-g<o
zFW{B)S8Dr+e^MmHXG|bYTH$38e$wHbrgbUv!$k&BBRE5I;p7Z1gVgwt@6%@Ou)C-O
zw5y5`g_CG{VNJvB?!1RJb_g@+aT!}?#XC`b5>=RT8Mlo&zE}iE$E3E|3?pb;Hn>du
z3)?3jFR<|H_mG7%4Khel{PYWK9`}&thOeE&I}WkQV8qaWV9@wZF875b4?=0N4n@3Q
zYkl{3bd}?J|5-9Rak+mY8GDBkl<0@J+O#o#e*ge`6RTp){zKmqflo-t<HXORTNLwP
zi5T)S0w4;ZK7ro)D5&isqeAQn0zjZU7XW8Sj@lZ|>4qJ{J5Ep5ZOY?e_A4<w4~wGD
zweNP@{VqFaz%JisG&)`970CO9!e<cpjo*zocFJ|jK4qf&Ugl=!@X0a&YBlps+ScUB
zb)Qi!sbLQzXF*VRncoRX^q=DMKTny$#X(9Y@)GD7&wEttO}VNs7XyN?;R_+GPtUV2
zLi!zZxlfgIx^_O-Iws*A|Ihbac7fZBZ)DeqtMW@b5zYpLiV9lJlsZfbLXg`EW?Pei
z3Ix5BmjhM6&yUf~1Ej0UCNiqLw(I~|EslGLND2x+8=Q@r)%2UB_|VH=fi=i(JVe-b
zbGN=sj8pku#gyZFK3S5>+=#a5&eb7pzH{rJ1u~8v*ekJT6k*=fznsXeR?kg|IuV&q
zO9LQ%Kti+6Y5^Oy*Cyq4lt!DM4sd#%9jmXbc^)wHK}yL4rwy`G{4xc<5nu*wrFV|;
ztE_isiLIU<Va;GxE(%tECs^aYP_Hdkx_G$@T?+Q5n!*1I>%yJotT&Ucz5va;5CO5v
z{Xockw%RS60y;bACf;VW*6S>6mG36LPggPScp<`YL&+DwgWn0YKoU7USqnB_4w!x3
zbaW}-Z>|KcBlCW_1cA)n$%i6tE=C9Dl<A8sE-HM-cBZFy>#<4m&rP#vmCj=CwhgqN
z$zMsf%)c4ir*@~QX}r-mb6hGY5igfj3W<6=OP($;2%GnC=VKg^f?Mud<OWn7u!^Gs
zC}G+9!hTW#k70V-WF7cZf9s?q#6mGFv=Jw`$r~lA4^I!mW6J6i$2}1?ee`#E(k~NP
zBVO5`j&q7n(N@WZ_IMx@sO*SN3~(F<8z3hvu4t&j4}X6TxR|R~<Tm|?!k`&g2@q&(
zEGfmiDqzF<1x)_>%Gw`wUV@(j9x+v-;C#FVy;cu>y{kI|gs;&%)SR!qePD}l)O$YK
z3|`S(;?U#LHNC*6;nmRe<PJMb!Z<aL5dQl1r^p{}5#4@cF9ccNN=~c!g2+l!W;|-9
zG?0I-TXQ)30y&WE_k$v-ZJ`teQp)qT`I;!AWb&__Sh&$?N87019e38}eK#Powulz}
zO#Ea6C+9lmOV=kl<x9H>nL)wMD8v?yOhx%IEYrlk?~wAjAF&9*zxCVBwf4VVRZh~m
zA!R<EgdSDgLv|z;JP9s?Y}yo*ve&Td@^dn(-GUPe^>Nvt&A-vzkP+<qw+Km0w}_lA
z9iMe#kxQJpYl*XC@bQ~E;kooQIC+)u>C(b~J_)=|QWN!o$@yip=XFmp7PJy1qLqAJ
z9>y5E-U`UlU;so697mR1c!h@2Y(mqwGI_HRsH&RQv@ZyWO&>q%8PE-GKaC3ZD=*FV
zsbEYXXMde3;HI24q0}L0-a3yR<{f$(b)fDO`oDX+eX`p@PR+oek=JFKkdiUei$Ya5
z+FUFeP-Tv^!m4E0ne=evlFLMUOgOU97D5&okPpB)y6X7IDbff%?x@G8k!l+R{^nSv
z`|Vfsm8PL*Z|sRH!v=Y{dN6?PeE2SaR|8S&WHflUXN3nXxGH{JEJntU?<#@I$ZPt0
zGN@WENBi?MJpic?*_<-LDdeI+ScTFH+ERnju1YF*CLT$LS`k?GzncWx{hkJA-=&S?
z+10@@qBj|H>Z2dn#}f6O<uA^ASiw0Rp&=5Qzy38BY!LAR3K)NXcC3T$byj!s#bmeN
zz9BNB*;VD4+_{2M{{6*%o!}fV^5`)}0}mgg(%IxPx-(177r+Fz4*6#HtkK>B&od~s
z>t$z5cR(eP*bREo^K6)Q;yQ#eu@`Wi-0DptZ97?ZG;;y3_0F|^Z@KkeD?GJTc={s8
z$#W{t&b|3Np!QoiMnLx5PK@vkaw4d9eV{jpGZTcgRIpU~Iae`18(;$!(-_%=-G#<y
z0(<J))#8L<w3y?d8xOUjYQu&sKg%nCP}FW4-eH6({`6@~nO;CJ<E$LSLrhcee~0>6
ze!nQbu(Y-fxlsq!yHyR|3cxS+S9^`UfS5w00zb(+;B$8wBH_R*e^x-4i<3xyetikZ
zu>I}7wb`&Zc&%Jq3X-vmY?PZN$)UnA@i}a~*MRznThqmNVc*laSiq)J$BW0m-Tck&
zj~(X1DHBs82}213pN4CVe%gV!OOb&Ez<G}#lWcWJBjK(+Ej?4|S!{<t^z?O}{>PXy
zv8Sqns^ofmsOIk5vBb~sJj?I3tW$$35nEX8V^-#3gc8{87WrfOf4<Zw22~H_x;@#g
z7W+>WlOjILBFDLl&NT650U*d<f~ahyyqT8_tlq=O5pf27mI*9a4SaL~r%!fSEoN(x
zAvb#$6(Wq{crIz=fu3R~M_$H!*l7Q%F_JkO!H;To#b+z#wM|Isi!gi!>Si4PPWVp5
z_XalJOF;kL^67=I9Kg1yC9Ch5nu7NqcEow-T={J^uNEh1%sQ_@q*|om6*12jpeF~{
z?#%%{KxJM4$h^gwFS`V|k?}Rx?ucdqz6>z|A`R87z>RY|nO)NcNhp2E=$jp@)Dn+l
z6s3%QuoFOk_UNs~2@ZMQi&1el6*(Os39-pLBU-E|UZ$ur=5fz@W}701d20{<k1WZ{
zIgh;A8@tqf@33(o109&$j*)BtC1d1Fy=*CnLe9&HE0wX|bxdXa0U=QNcOObp7__>f
z4_SVRhrio2|D(W$jlQ&hJ*UL5asZ@dTxqe3h40f>ni18Si&g|qW;2SEtV<o$U+Md5
zV5Yxr*9dp;JD0-KF}0p$;&thWe!$Mrz1Wq8o1?r+id5ZNY%%S}S{=%h8De~f?N-A!
zw8qQO(_EtwA1q5<6=^L&67uj7`bmbqtpK_$!Z#E?6QwZx;o>SCCSiYJzg1#GbJRg}
z0wD@^`Oqo=QZ5=v()9VD@Pa5lZi<sa|8gIC{Z`yN9{%^_+QT29>$vB$$!Bs(EA0qt
zq?a}W@PUFMhkky>L~j;LcJY*({)Ap<697nOx4D5x23D|^DXOCj6JnqGi8|oxUSwP;
zq`Lw*@Y13ATIe6?di#ZA)w-*9XChuB9_Sy{Vt~s|jq~O}_h)gT27I{YDpvIjKXHBA
zmXO@JjQ!oYa!2H#lL=0w9jjdr#r4}@QN(`P8|yxkdvdYpiGnx-l28oOdTWw%BR`O?
z6&j-IF1yjherD8n2fX2?Ql0{V$1MYIjlK4migl?8O$K6v*dc$VAXLQbR+2^kh)20J
zs4F)Z3V(Hv-upzl<i9!hyJN%sAq_~;3y(|r!hY=P!?irI0)ksIkiS5m6LeT&p;61n
zNC|)ZNq_jOmpU2Ww)+Echrb1jwM=s$si<1x;a<hOKmnGLv5;w%=y$ysI8I>UU4e|6
z&gkvK7x<d4j|U$cMWk_W_hxl<mUlj;t4&-gmaY-;SBf?x?Da{1d&rV$G)^VS@c)dq
z+(G(}D?byh1Dto&!i1ck?6Oq~c2dT53C!UPHJ+RXm0>PF(apgHTy3jAwXt|Xj;9|d
zIL4Ei)BvAXVNy4f15EEwSrwBpm}3F=JR=wJ)s6?`#=;E5p7<8%ar!&NJ<orsrtl=E
zEnk+vDC(|>JGOpDm>uAb-RDQqAT|<AKFbz%2<AzOZ3{K#tv?=l<_h&VL6OHwyPlpQ
zWW}WE4Eg@n|AM-luNmQZf50poRsi^p%n^Z%Bfp>WK(GOb`gg-?i_-Xb`Il=()6)`R
z!hW(wM`wR=a5=2jMTI2-91Xk{&DF#VRA+og_82Fx*#9XZF;F#b2^DkX)%S0hxiNYR
z6zo>+MlrTit)_i>K>{5?HIK>R0~u|5l<$z_h<@{D2!IRKQ^V8Q)o-)vv)5JCxRq|A
z5n#(uk(Ng0W(znngLR=_#{zV-QC7dKHr=>yx4TTsoy##sA}+sUpEOOL9R&(vtdP=^
z4pGy9^SlC+ZQ%)pg@}spo1Bk1)#_o^va)8LIDXV48QW~X+42z@zdj%2JS=gZIM^8>
z^d0EvF3Js=q!58LC=cGY;3$iWcS}0XOCctuL2yK{=h5M}t}t1d9$vh2O>)$tzvZ;N
zIQdrL_99s1Ox?Ad!ZdUvs^}GTryV^5(!C^;jhD9A;4?!#&FN4oBwxHw#hw|`8BId7
z>ds1lWNi-8S?9xKPw5uO@^;H*Xi)fuug+_vR%B|EO>wDzmB{PFw`t@wv0qKDrYHLq
z<KK!e5RYch!>=#NV>1ZGUd^ghL`egf8we(h)sYmUkcg@mG_VHCiss51oAjlE9z0?i
zV<SlTSu5!pEK_1#@e(H_OZ4sU0JZ^Vu~yRcr#PG#bgPVqhITU%HTZ{Qf!m6d^sMr<
zdwWK447*-T$`vPme>Sc8c<o<rOHGd5XEXHjo3G1@=KVv7{Oov#S_{}R$<8tL?>B>r
zOv)=OZ4Pz(T76P$O)X1_6;iR{en13xd-bY;I5FiZKZ-a|T;8EixS;l)mWrTSrp=?j
zs$$UD_NzGqB^phIPu5k>SZ*B$_P)&tF2^YlgVBg~#DCMb_>0hNbQvB2p?)D0AtI~6
z51)J3q7RHZvxh#|<NPOFmFW?G`Qs^@)7C`@Am?_LIeti!rkwYvBb%t`f~p|ZZC<Pd
ziZGiGYn#9a5iR7Pp1$;Ll0vuH(i?HYqR*_)xrt!Y^xMUfT;gFJzj9wQWanc~u6IqB
z+)$ew__;mPbDCUa;Hpxgk@?Qef}^U3BdN>Va-_?8pZi#Q$0ko6&)t!T$7(eLhR)W$
z8mn}j4`w4J=I|%uEjIOug30Haat~0RX}~q`E9MIlIZYhq8R~EnDj*K_7!j|os8ckz
zVil%5mHTlu=#i=cD#9{kyedB%X<fki!sD5ocvAbt?^2r-)PFtettD~#mD=R*8dVZ<
zSft>x--Ijd<bc*Su5S_c_~MMO_qVgRL<W3m;Lr4c0W<By%aFjVl@eT~%b`{qf?Z$z
zA8uEclNW$UmJZvENz+t};ROJT&xNVT{^c?gIndmen`htlnPe}D|D>x=5m{gC0*Lib
z75~|l$7hb2E~3_kEMN3ARcC4GWmjjkF_!OQxEK;UFWC7ZBJ1`grQ|PE)a@3-<ALV1
z52?hq(H;^9NObJ=tYb+lc<!Z_(p$PbMk1uy0?v^APXg)H2lRP$3ti?$R(j{q-t3f-
z{bNE=l%m>1x<HwFB|lTTrFWd3<cA1$$_V_Lx<h}uOi1xdG*ld<cWHGVJ8P1_y|t3X
z1$p7v)+$L}J?Bz8QbGG_k7ong(;$6jPr)t`-mx>`ehboneyD}8sR7z;zkq(5-?{KD
zaaX<}r4Cl2*aaZ=H&yo7w71YRd%T&KtQ^bya#cWCWyx<Z>>oS1&Zh=C#RI&MN}l}l
z&90X|<2iBk_M}~>R7~&zO8MBd#2RV5^{N$7dMzB=QoqA+WQ;%v>$Rph0~d%1Yc%uU
zE3ES=j;PpH497qBEmG7&)M=c@Jx1M1HY|f+k_$(H=^tw6J-+Yh(i(%epyW#5Lq?WE
z))P7S9WJ^y%Rnm$$l?U|QXTM5LR(|z+ug&8ga*vUR(OCy`iqNvaw3WEjUP(jH1S45
z`rG!s$@*P=Nll3oVQ+fAc>ZN=@?75&o2z9}Nl~@$(t7cpmkpjeqj#=5^uH@;`?x@6
z&G=<DoA)lxZ0s@-dEPrbPw!%mUn(MF@a=G+%|YxAX{2GetkhN8+Y|Br7RGABSJZ<X
zSeimb1Po@sIu&DuVOWhphY<sidM^F4Pp9|OSyCOn_lM;_Sc6f5_!*D8ie6QgojtDP
z_&NC}sNO7hJsq=oN{qH8-VZxo1(U#bOZn8yrvX>{K_!Dg2E{z#ug$v*@3>pFjA834
zVAO0$_KGncMe%yqM50wy2NfMe=%G>ZZ8w2&UYU%A;F=F5LH`nr9Qgy=FMTOac>PDi
zkN(M2$V%pqTvYpjIYh<4r_MY^BMz;n$|^ZCa3`gTD!^$_(*pi7Enau^`Ogz&D+T0}
z>xmZuQKDJ+Z!H48rU$4i+9jM1@BqmN_}sGv)?-km{nB4<z2>}AOk|e2kFs;D3-kcR
z4O#a>T%d4>y|RFtNv{){s}g9ew<;dK{}p}9m3t_c906!Rn#rBZReU;|%@T+9LcrIZ
zC{y)ZzdpeAMj)LpX0ynGTemz5N-v3T^_R0jK;%=9=&_rOmbIsOGc|Z$z;mD}fTgHI
z&A!G+I^abO*UFl}ZlF6hVTeMuGC`Gh={;AuXMMW6Zh%|u`2&IRKNq`FzJM@SMpE7*
zxnv%JuDv{8mtxIp#>+bYqSto}SjcLuo-xF9Ksi9$FB;#LdPW}dw1l7@Vp1)PACV?o
zzMs%SL7cH)<{Q=C8DO2z2={Sjrp5g8$6p35J*fp`(t{DA4bgqg*Lo@@-){nOS2~u8
zdgY;l{u{CI`Tr#Zzb`!_JIO`0*+C>P)vFFPx~hzWkb7i1FF6%PAh^`7+HHfd&A$k&
zH+{O<FZguUw`U(n)@VC^xXB+Lp6>^~ikDuS#hg^-mB&euRgDt<9SZFxP{bi33<C1|
z=TCzAKM1;ZNRPhsL;o_7S9==1eO*7h<DR`at=Y|hrPACVf&P5E_C2kPqpH`Y#P4Oc
ztiptuJBaLzUV!Szifp(H{2+Y_&60y;0nV>_38i}|g2o#Y_Il4mi6W|>#r)nF&)Xuf
z8mA(=?iV2^ptEHZKG1ioHMX@y%b6g=*eVHSrvUd1-E(>$>%eLZEpQ<7Ur*E({_87n
zd0PDWpQ#8tIk<=>H!#MAEJtt-7<S+kXvslxGc>PKV^NRMBb8ZB8D&I8*s6q1S^?Y?
zLS0@Zl4~aaHgB%*GxOh=F0V*%T<%{Pr5p`uZ<XLrq86Q$jS#1nPjuHkJK%Y+WTBTD
zr0GNdv&ea5`vKOu!dC0|tbkI<Lu>#b`=2e~AI#WF>zy7kD_gPt;cWEWhBr4L@2q0^
z%B$>)#)=Gjb&@|zYX5II?^BZy);WUxfw!V~NlzcW-(x~w4sN95JW=VpWtTJLA$pzt
zl2&;3qN)#7*SYHKlo{?*7Pc4nUyzAMj4-T?;<<G~&$oz7NSgTjlk(?ig*~?jCz+MP
z`Zy)JblU~qK_IQaZh#9#2TEYC-Hz8RMD*MjQn|A8OWgjGZ=j5%iSM$-Q`t99U$L>!
z$gk^X`^)zt93aiLn`U+yao(a1fdAv@%Hx^-|9GyP%@K(<Hb*pPI@laxG^w0zLsR*p
zNUm+JQjudN&D_bzRcW(1a;*@lHe^JOq!MH9P(q^Lr{7=xoyX_%dA*;n=k=B%T=}~F
zhgT3lzdED+c9)ykFPm>>Vb-tjiK;0YTRD6otH-Xxws<>i$KqcoMT-ZJt3gtcPz8sb
zdb9XTe7U~(YZzPP;>)k|n5a?t5k}c9(M9?kYjS7CGS1t-KTc7T)3O^T9);VbW+4~E
zZ@%VPg3?;q?acSFK42*m!M=BoxO5zC@H5RCR;k~D2e8S4;>viQG$ghXUM`^P>siVy
zXv&)d#y#$h#ZUsAm(Fyr2}x+WzZ)=!8*A$!T5GKffeVo*Gv2+2@^>J*zs-U$QxY8b
zIjC}{O&~~tYp^r=-~j(z<i_N9MM({+7+gPX*IMnc-w!9+8Gm+Q0<6Z#+I<K7$#2W~
zb@<Ae@L#f>W<Ph~pDKKS_O36rr&;}`s{h><nh-A*_Z9z1X^{IK=d>*a21r-GDuq6w
zY`mjGfLBfy<;C~MAcbK@B59PA`E{oq1uUSS<WRaLL;ySOoW*w%TpIHE`Lgi^w6~^n
zrTGz9F>033zL%ZHz!#P3Q%ld3ciC^<&Yunw!0m)Y2xXDTf4)7<4gV8AZXd3A@ffcL
zQ})HY|8Lt%8;Mp?;_8(h<sPwd`ULi4_W5Q*(I-)$xeohPhc&gSjyKhpmsHM8HSRD$
z-vax{$Z_a_{f~R@$14^MFpR48#h-#@2@-Ny38si%;<Q2>f$m66Fa*@DFE{qB9FMz~
zwq&*Ku}vKlZzGQ~K`ooS7bTI_x&jM?dd2++=qcVBd=-bdWY{C}-+17G(-tRG<y6^?
z3|8}T2Xdm2k;<W+pD{JxNjZwt`$i2qn}ip4dSO#=8pG=wexM?+kTIOowWZ1WQ3d}<
zP(i>wdafSm5>6IYu*4-5M(jpb7&TaH{nLcb7oHWV)rDpQ!`=BTLCnk%kc4V#;e01S
zdC6x@Re@Z5Q?cTtNm%U_dxW)2N8eF$Ha6lC?>z(ey(JNxaB8ZxI)&<cW{E$tZKf&S
zlXln2>Spny9l4pE;h{y~wBpLk3rNYd(1EkrLgGOaug!*UZ#vx)wKcWc(d7W0@V)V{
z*XZ|3x{KTd<a<*)==0VENJT``J9{morlK{t>fD9C<qz%|S^_huKXUQ$IO<f!*ZQ#H
zEL``&sO$m;OGZF<o$s>DrA}NK%DwB;DvAt9#qak|FfdI`Z^zpU=)a$Cr#~35pDw56
zlClhgcS9O+lZm<)0$79sa^V%brP}~UyHq3Pw^QiR_bNFvGAWH;{;o|b=0F%I6Y<jv
zQ%7Hg2qP#fft1Im5Ea+#=0Hz<ni<YSxyij;p_ONT4}AT~)nIuODSDM>IuE|lXPfeh
z6^oc@MlTN8fE<Mg5`ayGV?PN+E$;sb4w0R06c(=yj~uTtcA9-lR+k!b7#q)Y-p-2U
zZhB0MpOLjDr$EXw``c2$*tYyGIKqpl{b70ULx#hQ$4nLoiR*rNlR;y+T#NpkmGxq_
zuiCf6`%PDzCc4n~4yXmI-TQuD5Wjx$wE|*javUFVs?giI1?#z|%4_wq&**_fZp7$`
zi$ZrLXLKKw-U0E5esl054fLu1OG`0};x?C<j%yIQ9m@nAz=Sh>Kr+H6VNh|8Qf%@8
zWiITqCN?U7``%uRfWWR!_-6m)7cN{Q1jgYxJJ|bkIXmptADWw<!5VnKU7fvHag{Is
z80_qmm2fCdQSIgp4yX<jPML^s`WqkKlz>vI-9=W7ez^Z-95hu;KgM`r$DCQKxL&8I
zqr7Bg=6C7{{^P8NUN`x$Y``!2WS7r7?+R5mtJ7<t7{g5KzG4Z6UuP$j8Lb^Y%rxhl
zRc|ftPgnPSL_Yne<cha`XGX7UotHHwbvwOX8=2xk#O#e)sUMa2_qvA`Dydyeh)|Td
z8<$j9N53D+loF0PPHQKDm>$YO*`46-&qvXh2cDix*2!gI;KVWpT7e(;&L`i=4iR!6
zaqSlk;d2B0d)-@45%JFB4Fx|+?<F?+a-1j>cPh#Wv-zb=PJBHXOcxG`eXt>M%&J&3
zryaB`XgL64;MNElVQV2RxZtll`-Cn5?0ZFekiVe{QJL&O9#nIx1E%@J>1hXQLXHq%
zc^klJk*EeZ1<2<YdW3aF1Ppz0K|OG|%4e&}-f0Ss#3k`iQX)A&Y|&5%`{_8{_`S`s
z1pa}pd;c<L?OkpO*)XylSNdeIQf`Ivp@R0G%UK5+Y|A|agKz+iQ#DI<abhb@1*25`
zYlO{>KKLsCT(r-0g@&`CI5*~a4w7-Pr^R(Y;MopXmYA8ynjHHgzn3u>dg?P>fnOAf
z?+6b_NdO}4o=Q5N3FXIy6(3&DiM{dbV{s2($b5%d?6a$Xn-jh_OOJee$2LM~4+%4@
zk=%2SP>`&hO>5_7Ed2nC3bLi_GdS*qAlOhuk#EltmhF}AsXkKJ2s=#zQc~9WgRWPH
zlO7Bnk=DIK@g;qhREW8L6gOZ=r+g&1UcIebG%xIUn<fm=h7c01(cd&25q*nv{U4LZ
zW$pkoeQQSE#*d=E$~O_{Dy)Ftm?XrFL`}ay!}A+b(ots_ezMfxptH3BDhhnJ>P2k9
z)skBJLrfYMT;u^b?C_B)ec;-ixA%^vs$e7UyHM=!=ExC7->lBsBCvoOh2j7A?nDUY
z8kFEdO;~8ur(_-uA=8~jk4hZQSla;lWkbn3V4`ZVb+5W-uOIbnF7*;eiKh^w7HlVw
zrs^RhV<*Uk47@LkN{Jx~zRdG5PScHl+*D?YS^$rMeBM6D_41#_W!yu*(OS~nA-X7%
zW`NT{o`O|oHC$@W8YU3$l1o-K2JskU{mvC<t#A7lWVe(5?*zSMRED56!}U9Cr>aKa
zP&Dhi+5v-SPLl=JJR~}xGuu<=OvN*69&prU1V`C!{(3HcTasYN96u~xfk7o#z59kP
zsC@>HCiE9zekgZVU(Ry_9q5?!1f8SW`(*#b1ZGTRH(y&l6A|~h@o`vho@3YqwJ6zQ
z$8DE1Q45Ff(7T44#IM)MpV_K&(HoODPa^TxvI`lDb`;vqjw3R+U*Vs6;m$9bIq*ws
z10mPhT;UZq9cMHmmetqJlOS;o$Es@<we08aU0@--gdtwJdY;xuT(<KJ*y~t^-W2^m
z36i3L0$kR;8{;YfruUx}+nv1*WFXY+)p3=|@jqE##sxpJoHP!?tbTwNc`?fB94jyu
zJR5F!2`Q~iY^CL>O`#((^||g(ey8e~V&PQLRQgBaX!Y!`Pq_pc>KV$Wi$zJ6Z-EQt
zQbWiimDU1_j%BwZa7B32>0nJYGey(A#w}HA8_J@PR5dvZw+fLq(B6vS2YTCZg^rk~
zzU@0TAzn5F^?gK7Km)H1YZ*{O7W?*<jde9gzq3~kPmL{;g48Z%Q9)r8m#fpi(eLmB
z^hbU|yZJ7>wgF6C#N8&kdX@pY4B#~%dBT+Mj6PtblK$jR(RCvMs?aLN`kt^#x272C
zv(L1-{*)L&&%#1R5LZW!^bY%%atc^;_>p7aed|v&L{Oyd`BcrvJ>;d32tc_{$QUq@
z%EB?z9d$bpqJ#q;4G-{nqzoU>Eb{Pmyg8wvsM0Zi07h^@7_QtDm!-cJdR1JN-ufo@
zcg8WvxVV_T3q`gHjYQcn`Hs2DQd84RlFKC)1DZ|*km+#lNt&-b7I~Xgv>G-W5y`q`
z=VU9cwURnZ7ous%D#Vz+l#Y%yFPIMa*cYKTIJBKUGIIxX%>EotiJ4nfvPuJ+zK6wt
zt|UIX$3AEecp}k%o^9G-&2UK)F|eU1kBa+)SkJ)hIS*Okm~1+r@SHu%c%60E^NDZS
ze_M@_S32ubRzq}llV~}4P<8mOIRSv#MG52J!AP@{gFEb}#(cB0AUivk8=rzl(-|x4
zca1K0!|sAh!khkXZ>rx|FUHevhw5I5U7f_8pQ+@lxA^hbEnsTz%%PFck2YSMv!N#{
zM0R0~F5gtLLE9n+&r<&Y38Hgby(m~8td86ea~`1Z`&q!#>M_6fn5cAuFW?`r6eZAJ
zapMhEKnrZPqq6^`m(qUZg)Zjqi$dD(eOPz|E?Zxz3B%41P-o!`i=X*%8Pm7L8SCTb
z<L9xx`o(EM9amw3jtCXPX)2kr3W%-rEKb&0@&p)N`d!Y199gj$P66p8Jx6H)lFHr-
z_COqak2~uM(PdRao6BC1<JuJBGZ9)l8?)9p2ajz-4Um?<rym@Vob1&nyMW3#li104
z)LyidnZoe;E!f0dWy>~lqw{>6+Igu3iQeTFM~L{B3{?dxMLFt{E@W=dlIh5q%{t!l
z6LcBc){>d8IduA?<OJuuB>%#B!)!IjJz>+H2l&$wULIKsqwkfO`D}Wg6l8U7Xo!cJ
zQGbeMdMV|K>FYR>L%R$Lt9A4~If0NLJhZ<O{w-qi+cltL`}5ydhn!}QcN!Giv;8Fy
zw(cSRc^S-a`2<u@Hm0Is5PacUCgOP~y+5#d)5Uc$E<V8%igsl&%w-VPXVT;*?^7V2
zkHK0*eNP1nMh|r#xD%*QCc)`S$LDIIjyokcAVYJM{^feEFF2OocT%bC_$yNhqn7R8
z`)>R+FXrH6Ac+uo7Ha<!;nxjGB+;8dI!4z4bT2lzmy2WCmL&wqe(QQ<3{9kvN)o0D
zSkG;fKz>4=8pp2bCQ@wty0W+BFR^NZvK5&PZhR`QU36w{Ac^PNe*_2XEoQ_4(^^AG
zO#kvpev(NJ*SF}OsPq2WLt$o|mINfp#BtC&Sc!tMfmKp75COE(WDmydpt;vhp?ycv
zDG|y72@~>yP+_E3rBx$#*I-J-tQxGd4OOFjUgHyZw{0A)A8gWXbFlSIU|zc{F<|-j
zMZ~%2wx{6#xQ`?*^qN`uk2y$)x9t=`-%|N{Bmd8MWg_I1mGFXG!Jh=#uu9<>ZUPtz
zf$eHc?!ibBT*?xB`CU0)1J6@Q?`R0$-yh~G#R*lt;Yp5s+H~*171*W1nJa8KX{n@Q
zClXAkwN7aY_kDqN6%?N$S!-0{wKb(26k<A3OIEWChGa>JQ*;RkfWImW>mez;bnhw`
zDa0+kAxZutw--*?aM!|wr~**GS5gpWuc#KU*uBQDa{+E5ZaVqjiO8i368tJ`LE7{7
zgAPQ8_UDfg(I0?Ik*0(JLq$P8+Ra2<pWSn1ct>ZObWPS|^c~!e^Qg!_3nJfdGo{AO
zyy<phMVd<OZyUb8=S2N9FBLBmvE3-{v9gD|lz~F32))Z1-$fQL@OR8`!*DZ>=yEU9
zVvzyNXzoc{4#r7CJ$OsAy-M2bzBb{Z#`m|joD&xB!~ZM?N4VDeU*6Lzj=bEV54GjP
z(>FU&fXm7yCtm~d@$cgw#z4~8yyT%Ym26`z&n>Vu`~hw|J6VBA2D@+>bJg&}lSc!_
zDlw_x;Iad`mkN*(Gqb1I&36bgd(Cv4#iQHA<hYy}(T%c>%*yaU(C2jT=ug2lJGqBy
zMm_7i(lFx{BTb0uiNI`>Bl?SG1a0ExYcr2;>wOnA+fu)0%3gnE(Q*rWWBM6N@}v(_
z69)O-EFKi%f~=CgPo)G)lEPG}U4!gjORhgAAM}2k;<5v;za>dPaOVpiWI-m(#DAlq
zq@Q!2lxY)ZtZ?#zuzGwD%k2){Oxy-73?{Jpk|?R3t!{33jKv$o6(zYX&5u^7#sA{u
zQ2>SDaI=KSuLB7G1Uli627e?fK#E<D#bDi89pEzJ;T?j2kyCFGt%zPPf5{b5gwu&N
z2%M0*Ltq?~eT6tp)mLY@L~#+;`BNUS!cp-%ghpQ_m^cM<Sae-OS6qa1<J=Cvv2|+#
zuuO`Y?f^?-WB+cg9h=rc-NrN5|FbVc)q-w;3MK902ZH=6ug*NOd=Ukp?0v+cV?W*@
zt#B}z+w|3IK;(jJBc?^1ioSy%Du{O5W6RkPs7JbD-(e(YrY}E>D`wMI4~C>z&=|8H
zp1L#Yy&3e98(P5E`{>A=w#7`9_R6ayl!8k-Y7~g*Y5~A2cDW{%=+Skxn3UKQP%S6u
zebwIQRRbzO)%zW^J;%5hY(r_sGrSH70(3rW?iEar0NnVsuz#dE6~P;`1m2MzbWk=6
z$%c7~a@mV=ffVfq;;Mwy;CFP~AJ;&&;*I6gj)=(Hoi<ABP|;4CkKw;2ZiV+gN|6+w
z-uW%r^7oVPHWn>ANwLd_TF_5`9*jl<0)V49&~W(TvVrncvN5!PQ5Gk9o&94<n<nCE
z9pdFo_3e8t!*3k>LtMq%bA1#xzKK9aj+F$nm#{~!6iGwsFdBj&B|!D)&N&N!v00|Z
zG*?oA%@V%2se3^*72wB>ocD9@h4mWYtZaXPzhvz*Bl~mPD>9kH4{|(LT)K!b8$~%P
z2MDs<_xCC>mcfG^UW``62d{`~rO8)bk2r9(i~@lu0Yv>utlU#^QbvvkSDz|+3x5o*
ze3|Y-X((gOULU4IDeZ2L8kgJGj{O0eQ-A7h{BBRPmYs%_WIp>)yi@NN4iY_Q&`Db2
z_IDZO9XI?G2i}?ZLW)Ull4-<CJCr?lOr)ro$VAt{#82>>7D;Uz4(YP{9@Bg;{N293
zNjFel)hvkEv$S5XDrWK6zG{-NC1FF>0Gw=3gR)T+H!^_a#&jRJ=FH_27Eaow1K+jV
z`5aT6Sm!q>S!v~?V`1_HR)KEztcPq?>E$obqH~M~JKYUQlwTmkbMtsG*G3p|vEVo*
zD`oZW9U`73xsqkQSb;e_TRZPW5n{bog?53RO$fc!v!3SINB1y^U_N6U@+9p52lkj=
z`7*~`Y4<(#zqF#a4`(EA7=OR;6x?ewHR`;6Zq@2D<0n1|ir`_)W71=#htz(*!tX{d
z?zt2DKG@AWVz(RL^i+Sz>c2DEpBtX;M3TA0cPR2*g3hV~9<L~)yTUtp;jfm1RghjM
z6nmv1=o3YykCV9!4?%GOqxNF6A6>se*My&R7rdY6^9G>BlmKM*v;W~%7Rirn;F$*l
z+~3pSMK5h(_5r?9G4%x$dWwyHYHdhsKgGVvob83BQrC)XTF+@wf7H#&ND3#1Qx5tX
z4z{2UP7-J+KM;RMpu;bUd83cFAB7C$a{hEYA=yXXeZAvzb&3=tmEa;ueL)9Rb8S*5
z@<TnptP4?>cU%6JT8GYGn3lT>oX!f<MSB$XLqc2F4;{ocIe_Fd4<!Bey^5PVAhZ4<
zbMR`pCIoo$`HuXo>H9*wgOd-cq@$lY@IT<~hv?5D?#3=bhY1ID^;}z>3XmDR_uJ9g
zTy3e_HKWNRIoGoE(}%JwKb|3G-)HFB8BWp12}})Kh&)3*+?LEx-za@K2jp2={(kF{
zy6GS$^sLQH%JXY6od1Ts<f6$3i)IlqVn-*FU$wU)W`~C8cms7<Uc0!E`Q5q{^T9kK
zR6=)<{tb{8Ml1=d14HLd3UB;`Qa^#m+*Bj}%R}wte$3P>!1P$Xu=gSaN-g<ERlM5I
z*|Y`$29>u$Z`;uDR-g_0M4`2K73wvJk2E_4>I+|jB8h7+fvXOh`fY4Eh9D6u9RYlK
z5>Bv)^ReE89L{-RJydY9=L{cO>?<6lwqhr)Mfjp|Z1YNBS9VagEQzE<9Jo_#(4aI2
zuJ46OvG?ExD%9R#l(LCgnS~L@LAUP7Y4jWn&E_Mtr0%;RHKG9xUw*6N{O8DmS9K}r
zr4rp#;w>5v!)9H#qiV)eRwiw~`eefg=x#JrGbSPp`TX4VLBzDj8w|S&dqR$yPcV->
z&bb=UxiECB7JGs=@uxRSI%vS|KH-Veg!adM{sV#Wo{XGIk79(iJ!q9bQtkK(eBk6_
z8#Il<6&hPFj7yk#dw%K0c3#zlQKH%_q{0X=5LmDc2M6&S<SET3Z%2E*>*QNTpP0Q*
zSDop-M@bqvMwqDZyal$=!13CG*(TCvq}vqp)drw57-<sB=9K)9o1(wH$Hm)AAvy_1
zBt1_5^3$ufHROJ~!UlFwcYP6rupn%WF0l{5Ge(7fFnc<S>+$(8TyeXUto<}F_p9d4
z9LP!w<2;`QW_!7BbDo$`8^W(ZM4n)({psbgokBf_-C6b6@HL4U@NOl<<CHo_Y(a=`
z9!hnv*_sjvB7;q4%D6Vm;j`T9&bs9Nh$70f*EYFy;L=O(`i9{AdS+`vF{&!TgM&L?
zOy)a3EOX%GZ?3uehlJsT5Jy8tY7biWwLK!wcPa6{x$~cu-%J#NT<pT|;|!w8-U&PQ
zT>X0^5#0Bz5K0~<)ZIwz#?(s<m%E}+peb-(JVnYFmrXp$H$<J&hoaLp@>Eu?gmUjq
z1Hl*c&o0L!X^p?+#VE!-=^w3ZP0%wYhCJ7&3I@X1_B#3=Wi_?Q%ZvxpNV2|gA1jl=
zoXxQXDGT;m{Q=)4Qmw5F)9Nn2eV6x422nLzoBC^q5A&)77dYit=S*Ezxx^GOV1k?h
z=!Nsw3sxpZ%uBei*5x`Oae2zi9i~6!Nq^o|OrZNZUfNeAl!2^p*HgFQmn$`V4YQdq
zSEQsN=9Bn3|Ni4&qOLx0<4ewXG(YIZ#JuGSx(m7@*oVpj3O3Pk;OF*+@f3OB`=|N3
z94|_+<$EIqcZBPu7;#O#@j=;sT%Rtc@Ew{6<c5-qII>K?;eL>3u4^kP91}003OsS=
zLN|(>hLLU=U}w;Vu$HRI`VpNw`3~D%NkM?))fJV7xlJ{_k~jiCCwhuV$#fd0<Bv=h
z4l;162#=|~F@@9MT!)~6Xpr!O15x`$S7I(Ry*jVO#fTBSL`GXpI7BMq+~_kw7zZvT
z<d}tun=s!YPC4`P&k6%5gcn6_uejSHZ)o+w-~h>#*|%Ixr9^#ojZ!LLoU<MJ4MZyK
zr=$NYA9)~lhQG9>NsJinxWZNy0|&)Ze()>>H2J^vmkL-I5Tfx?a|EOJ86_xtCo<Z3
z53STu>8V8pwFBXpRU1!HoQ$(&U90izL`W&#{+I89EIa?)^@K`(3%n#0s`8;wjAW37
zet{RPl52u4XVM?lVSG+v_XxGKc59+_^eoD}pL}VSO#tV)*WkS0oMsP|99Y{a&;6Li
zxE43_yq(jE7<6ra{s?i{+K@*VMU;7a11hQbSNhmnF~Sbh8z-%9mKxoHkg7EX+ji=e
zA#WYuZYdL5`)*q7Yx;r_t+Mp7dkn0fe(dcKovP9EOjoZP^IzA%6#XR0WzQ77U4yL4
ze<~NVuR^$FnJNrvX>_c_sKiqUdDm(>qU^@Nm%AQ)p?|1%2h4S=<^WwfZccdkobWlP
zVvbp(MED(V5>FXVg*=zg<+`$LH&T?~7w;2-V5ksUJC++EPwhgFn7bQl@M99<lEKOd
z{)HeV4&t%%!(t>kl{k816VkPacVc4JR0s~Aza28e=2>r#7v}Ef7a3Sf5ijIUB*<F*
zS@(Sk*;whS^x<xO6Gvc#OmA#1RKDC=t$g`@a}t*fx(LyVh)wv_-gCrZTj+_<9a7lP
zZ^rZQuWdP42Yw<rmUUHsnDD(NKc6v-e`7yqvS??^iBJ&p<2T|j389Km=?RIT2O2|i
zF+(gMsUibgnQ(&<R<L3`SF{#EZMxj6t_IJ5pE1UTJawyI$jaaM%dbwqA<PkmI~x)|
zU77NaStIe?H6UWo>b|=u5k6&Pze4RsPJ4-kX5S@#C|9Es=8Eg->3h`bwRqw4K9?EK
z-Gi0Hg<P%vqfJ~nD`*UO_eQx(0zsk#VFXo!bg>W`z-Y<3tZ_9H!Om74l7zz*q3-<X
zJN_WL+6f5bgU4#pegt>|+PKcJ{7>y=#^`dt^ZtxOK!p@rYA&vJ*ZNfc=C9^$FI%Lo
z&>bvJj5ttg46M~Q3WzjwgW4d#;n|PT(BU_Bu2zU3j;EUClR(3S_Ih_=fIsi5n=RWd
zLI_Z-3bdyD&Js|QKxzOx=ktZW5)VjoF)76RJlFCIbU(|h3_uV3+9VTCBY~7*Mz?;+
z14yN?H2SJMbp;GO?<K7Kq**6bBpk#+^wnWLhcRch=fDX&3!LV_mv;Fk(H;=)5Cdol
zR9_Q&?h|9d{f>QnNdfoJoK`q6T$^UgBFJ8rCBfv-`38AUDCePv`V&ha`)C7kj+?-Z
zz5U8RNcywVWpoO;{ca7;u=+q85T9aQortJa^NLV9iZrt~^ySNn{~J#YUt3<+O@1k#
zaC(i{@9UBi%=R@@wM2f-nM+S-D7fl(#T-#k>VNlQ_k$yW^Ln!Og7Wy^>50TMblMK|
zo0X@;?5hkn6~YUwlGYu-y;Jh)U#?M*7m`;@uome4*NjmRa8J8aOdg25dnV!WDYv3@
z$#^4F2bVoJgea?*n$&zuq#^7`fPZ+`q-O3E8=G!zb#@#)nkDVNNbt^hWX5@L1ZmR(
zlj)$>b&9S;eL+N1X&8kmXy<aa3#fb|mi}8$g!A<;?`2|y@yz;<w42EeykGR5_vf-R
zxCy<*r{^@%iSK{!b}kCIo-K;ZIVt$2;lP(5c_=Pjejo;RcC{WR^mE&?$qDQmuN4U>
zN+wdYAfYsFk47jUk?a5+TPQ=KW6o+^Dk#kg7IsUvXafa$8kHc$5AZ!(E?OQ1e3yXs
zZ@Y!xtAU%>Eu)n>B-g<u_-5F2o_t1}5aRMc^$7f9#_3(=bpt`!1kgE{z}`BAD09k8
zJh;P6PHu?qS~FK>(;5dh4Um&N&9;z;R$hY;f(9-howOBr^w_h{7JjN<*nk+#k4!Q#
zH5zjk?DN)BV=~YXj41f!!7EFfTi+AaZ)yX8d_qSTVu$48S3f>^7;9TccDuhhn7>&O
zr)5J?F8djFNE~VV{<)pdcL19yT<$7RzX-6!OVSWYK^*&XtpSN<d1ctM$<8Wz%(_Cj
zaPXPnX}wOqHTgLq%^XVtbx=)z9htiY9yqO0c^d#^{t32*#2WU|-t-ZHb#hbDQ}B4_
zz2Sd{`*!A@=faW9j1l-3*pLb#nKJrcy{+0+Ms#vhY$Fy^H$orbWq+bFG1%z6B#;}|
z{A9=T3aYO>HC?lL?yy%U+E7-0Wv=px1mehKGG+D6$wiOk$D`S|iLG9%q8voPt=PMy
zwE2<dP5WwW_=AboPg5P)S0g}xmbz|Z2in2;y1o6P>E)q?9VBb5zvpi8Um^VVEqzWT
zxtw3Ln(caXTs)6awP;71$g3N~*UiFmxOa%HId_AydBR_;r6EJ);3r+}h4V?ux&rI&
z-(&F}Vr4-95j)?xa0*F|npD%2hMdNG{<B*9D^l@n1&uX-c0kuIf3`|Jz}lScodJtk
zhe+G~1VjbRjgMb_aL=4FrFdSL!+u=gAk!jcH5~LjI*F}hsQ_<Vas|;?aDi`@LnnL+
z#~5a(IbaMm#SMhrg0m&~msALN2byM9+9}%M6UsvFntVmrc@6g(6A1@y^~LVp1m?)}
zes0uD2ktWc17v631W+31%5tiky}9Q+P}F(z&&1kI<LE!97cn=#=>p5$`Rf~#f`{tk
zK?CRqVthOD$@K4bDWjU=!Vp=@^`c#!hP(Oqow)~rfWG_Z`rR=ML&&v`z30T5T64Ja
z0LV?JQrw+pzOgV1?282@aUn&ecLZQnvBU<cW=wV;v8EGYt7xoaCnT)|YQ}u=RBBoN
zzbE2{zc4z|Yr0Blr37ZndW^pXk`%Uu31nhy5p*mL$AXbVI*ums!cWav48adrScoN&
zw?u(tDb@Q)l`YT4+ECp!32(;v&(!wD*DYDA^2hiTVudfS_&WK8oFH0>;S^JW!CL(H
zmVVxY4;@=auWZk~oSyssa^K9DE?Ww6K8_Td!4po7c;c-vJq#}(&ynu_`Gzr+x^3eL
z70;b4SqXy^DIGJGp8bg0m8G9HE&90#^pK%9GGe}51Tqu&#JE=|6cenXf!>mMLC`yM
z0mu59Y1w4E$irM@)r20|{PHjKOBv3cRqI&Mo=cKJh$20pMvIwo#n-hyU@;7}<bqlM
zGm|TIbR{5}RS{Jt!G?04j)Awtm+Df?IK9v6mW<C#o?A2%AHaHUa1FeyN|5Niuqd0>
z?oLGHM>Fz%uIxo9Csz%~*eLL95+`0}to87Rj@`(;HULcc^251ZjCc6e6BkqdV1^0)
zqjyFKrd^Gh$A#pl8wG_gB0hB}t{`k+&So4fEEjc~hGz>pbjLhVJicq|_SR+$E@X&x
z4u&plKfphO#~e!)?yRF<#hCWG!j4GYKZ;|+Ry3YkppO#bB5P7mKyy=6*|9&y(Pm?E
z{N8bZV0njVYDme9Gm-SL=lBK9T8W#H@j$*<SP<|%h~WS;4N~eM(qg8ltq7p=u#-u3
zzHj_5_ZxUJa`vz-C6V~fpKtxm$3qakR1CP7Um-dBp&U>_#K?=ax*?Mn=u~2?0e9KA
zm-BZ!YA5C93fk8E%uLZvJqP|*dM}Vr*U8(`tZe>uIfZ!TV@-^E74SfpV7t<P)LmXK
zX$9(0&Frl1%%WL41bZ{jX$S&!3|W1FPu!auQb<7WN1Zuqmp21A&)N5c_XBl6uBJq%
zJ^pMbL2u2dLh%hdGjjIiNF5NdlL}byv7`JS;0@1TFVQ@ND$Enrhc#m!oy<NE-0q}A
zQmCTmRJbQLQBDiP3DBN!eLUMOde{{qPNG<4z;p^kxCb+&WMhW!&<XwuRB72K0J8s>
zF&P13bb4>JitK?sF%#DmKgBlxkhR&#kR&vv+ftl`2}ScuXiKa%Ex`^@<+e8}Z*HA*
zAP+NMd#`S--2$HnBmESBx5?@<tM3k_z&z4gFx(VgI+#`=`N^pfo6f%czT{Jtom0P4
z%MH6H1%{K_D_ORNL-5GS41={Z`H{2wv<cAxgmEumRna`Aa~55Rp$Q~V{2WnzgA>-_
zlT%Z>NW<_86&64S@y}XnM3J9m0x*Ujm7!E+1CyFgsdP|ZsH|M>v(h+WeH;|cP&FMm
z(Te3HYeDU~<|n?vc9|Cp=Hr2W!7}1f-7G$0QdO|`Sa^vpKNTFye85N|M^*8{*FNi7
zoT5$u-a%K+@2N`-Rt=CZ@M$oG*hGeWbl(2?@zO(SLad$;frvdQSQot9-q#yXRC*(X
zIL<4Z*mneXJsB`)cr*4Q3ek#T?$#hYL+uRTqh4lJGm>dL`E6AVFyJUD5}bq!V~}aW
zE4BTBu}rDbxD;^kVH69AMq#;g9c)K$Hij``jgHCB>@N2-%9&wiylwwb<BqM014^#}
z18Y~twQT8hV%Kvmp>SsB32#PiLkfbdC8T#ILkpVEC~I)cjLQ%NJT{mszFuajBlKdg
zz>J9t4N+Gyb0HU;f|(YG48aRU%Y1Y=h!7#c4nhECk&Y=LUXTy#e|+hoKTn<n48~5i
zF|xWgw>W}){^pPFsQ;L5{PoSRH~)&mI4`$1U;bU~xd|uyq1ysZv9E9f_;;$}N?LTP
z#SgE#%_L>Nls}$flrZMFRuKV&;kF^lR+g@w)p$9ZlEsUU2lW7%{{_?#oM|!N_vqP0
zF7sl+4{$f4=e;p$^1s`olZd{cnn!gPz1I+gA0fiYbbNtmYWY7nH{tK;%Mv0t5~RsK
zPg1p@->JEv6Rj&=H53_yG*I@S^>@MDnT6T4k9-~U6Pxray@=?tc^l8znRL)|3ap%X
zqP6R=<b5nxz>D|+wh@GV0eVskyGyA-oZl~EB0wqBzkq;ob9Y{X1LxS^yyw`!B9RET
zu9x5r=#z#xVgCB0zo7H;xDsIsEL+^zIaC3p%<gv~$uJK8L}p*Vlk#sFb{0TQmD@TY
z$v?0VPHEg*gzAyYqI_t9W;fzKsVuj^<Odjm#{(^j)MwZeiTHBnkDvedC67t(3-<JU
zs(Yc_!VVYm+v80uY!E&UuHVmyp{UNhMe&G-zvZk>8DtY{gQfY#1*MxEPr|ycKD45V
ze(=$8=Ng>~r`*}y%=<<z*yB5V0>MGaG9Md!Jn{}P$ov{`H?D;G@)d1jmkni2fwv5+
z!#>r^jr6<e5;{=%@<E*x5_pU+MG!YOS1+-#u8PJV(v}R1^2PZ7o*&C17TZNgunjpf
z7iD<%K^p=<;4$sBf$k!LUc|?{$NOpX8v;auuki?a-OIljBPpN;Da9}-zM%sL4f3Cm
zK=zc8Q7gC8cs78!mWJS}8b+Q?(JovSvp8^)l=8d&n7zvyfN<C*eKQR;;e&PIN|*XK
zJ5Zt-DKj!`ee-PB>2jBI>8RWSzL$Nk>sQ5<$Hl;n;3x_xl8N+WVJuJ}oS~`OEh0Yp
zn=Xc%N3@2$1gQ{C2xsU;z1L8Se4a_7T-&P3WKly$<}>1Y5iT``QXAyr`q?g{n0T7r
zpn=5RCJc%3oAaH(90z)eKoOG}JeyU`zyeKQXKcDJ@J{9Z`>3Kmvq>`xckA@mE~)@v
zWA<_-F|{sefL%hQb+AS)q+&X=^-%l~t8qobTqh<JGYKE5DXg9sy#!FoZ<^}p#w?6j
zHc^r5AOch$#G;qXQ=dt3i(BQ#!7RV#vN>jk)`dw&U{Xx@d`6n=|5OB<LOeK9>N{|d
z8QX>Irk+f0;yis~E0{jE!<$VLj9sVvXs??!Szt;@ZRi8DUJw=ox~%TXYa60>R}l9S
zn#O;CzpKUmO&DYT{?ldT8tpIyc&yU(l%;^O7=^KQBSUDs_4c#+$p^e*X-FWB1?5PO
zGc)2Tbtb*b<v+2-`nXT%J-nCxg}VGhPc$WUi8Z+CI`}}e*_r1AaZsG?mqS`YF+~%v
ze=Vem1N9rDM9R)_rbbfJMW(7p<ao|%N_JyCJvNz_4hOnPdXIdZ|4`RC4wkn76g7z(
ztmR&J%B`c49-=`t2zz(dXhutH*_DqgPqi*^sk;T`xXN>dT4M*9XEi0GZ;>V=k0#Of
z$sRyig~=%rP74z@B{VsYdJ+5GLI;khe1T7afmcPBAM*ozrAsO4&yjI(sN2LhpUk+g
z*PRtMoDW+$)sMd1vQ&Zz%s8QgX8|khD+CC#AJy`Gb!Zo&H@Z<Nh7vK?#EaJ|^5=d$
zYmegB%xfWmesdPEh`&N`v%6@%)1FAF;g{!M#)0#sHp1T`0{(Fl@e}1m#HAYdFRW3M
zM}7HmF?hiJpgVn`)EbD(kNsOhes!4;F_Bnn%B>q80sQl!%3Z}X@;@Tb(A#$w)7?;^
zt}TVgq)e3%Ya?TT9YhRq^>zb2^zXLF&Z!yZ^RU_lVgQcCCS2;T**ym~l$79)y=_N7
zYLHS{>9wjcXHuU~Ck~yjVNJoQpn9Bk(Q?|?o3iqR5cLgtT0$p*t!HXOk%bU?Yx^13
z5*j+|(u$T{t}@gbLnj^gX`mITBnpCf@kbrJJ$s+xinJMux1f0`qv0}CTj&7l%QKw?
z>Rr8|NbZ8yK%X~5^+V-%Q=x&gk505osr)-<Kf{bJBE^ZId16@i)vC$2D}a>LrQ`h9
zX^!3Lflhw~n2u?s(H$A8)4Gfkttm<dQsqH4b+chb69Jx?!3vRF_KFLht&{u~)kt{i
z@7;vS5$v65#^fF#oJ!V<QY8X$1Ad_AOSGyikWv@WIS(DoIEUtjG<$ryocd~5zBK`!
zfA9BT9-f^ju2h%z4Wa9;RldB~2_Qi$B25IvPX-^hTihob4{po8_VB2h7jBX1$E>js
zKPvPlJBS-z+(oS79Sqn3L#x|@9*WKv-6I=MI&M1jpTV&V%snSyO#lhwzv_i~RlvY+
zO5_vzn=!>#fku|`F7X~L_fUNM<v}7rct+P1ue8$lND0xoThRL}y=wnif$mqUzOp<G
zPIdkKhjT9oyQjy#z?XqlJbdQ@Q3i7H9{G7sxQYq?G4a%s>%bGxMcvQ~75;ML1)hOr
zWwAy@5rxq!Cw^kXCtzf5)WTKQvx8rU*QWBtK}|nE`3x)JnRReBITh>y%iWe&n}!ar
z7YGnpgg^GWoG7nohe^#;@F~Q7V$rg3F~C4;@Q05#13JA&WQGNBetX9<HF#}7HMR4v
z4d$BWwY=H&^LE_gdt_9P0`H);B5=Iv_@1tJcZ7uopRoQYDq}*9W?cDr=Q*KEyg<YR
zed4o#TW5xT|I-Rxf7<-c#tZARe@;~O!d%4RUcd&_MHM7lkR>3Gsk;eW-6BKtz+{Vx
z4zI!lYU$~-dyr-R&Ch;f3p%~oeO83ud6)LneD~_{xzzJo=KNt%KVETAjp-Ls<`nSz
zFPz?!A6GkHo19xv7_+m>=`2Pt1|ishcBS{TXPx2c#PESAYs$mF0KpUh-T3r%CLs)k
z7D})x91$%uBdak$Rdp#*-18%v=KN3fA&&rDOJ;SffY{NDGcX+gKC{bd=s)r()mO&A
zT!j!vlu?@>^mDe<76Q$6X8S)m+Lzrm1Rq4GR@vUjIvc6LFE6RXG|gwRd)mIhk=V&z
zP|W*Q#Pk!np&GT_|JD)yu_5c+NpsmFQUO_-iClN!W(C)J8nXi{8B}v*#tQ?;vc=2B
zwG|EVy!Yn@{a%pf_ItCN6NzC8a?O}w(JVPO0XQrJ`$Z8&RHIfaPL26DX5SIdJHmw9
z;QY8x+IHJD18Kvc4Ybqr`tP~Qm)Z6BgHzkHQQU}Adww^nF<M?(pp&gx+~v+L5_4qr
z6)1&h(eMVw*{x62>}jJVL~?VD1+Dvm@(NN5wga@0jl;vt`N}|d!C2V2NL2+hbZD?=
z17u})x~K)Ecw%oQ@i0|}?aqB4t=o*5tZM+WkJ^1hbnr85M~!<VmAhbW_>XFSbsj79
zY~;{oKVX6L+1_xS0Bkok^Ji+ZzQQU!+L#@K)(TZ1JR7a<{Ss!v?;gfK%8ygjX!t^B
zdB2DfT&MJ3C3-GeM@|;rfe`E|ci*P6qvt(rDS8~|F`&xKJiJKL2J}(1>H5<|E<_M*
zdzW!ExV{E|{+O)*K#+f^$Ay4Ihtzt(0SLdc<NzTxefO0=Z(aW_DH;uMTZ&Qp{fd2&
zBQO8%q5~Lq_`u`Q?);-y#>~V+g{}S=UuF~$^)X2_1dxcK3GM?+U!o-L{e$^O6Nc<W
z1`s3TP31(?V?Tlrdi>W2<UxW<Fvh$eQLdNk51OYA>5MsC;wmBFSv?Hu$*tSFk+lu<
zqQNxdx!xM#t(O0<<3DqyNYnc-EMX@Dib@;jiCHVFn)6J$M@J^;J!15M{tWnZ#BP^L
z%z_YP7<Np>oL}y#ZZ>So*E~+s<oXQJ+hLq;QyrS`wk?RH4-jUZq6jrDe)Jh&wl_)<
zYZNuUJ`w@Kx;4FRrE%&vR}KK|N^u;2Q=K}qzH#X>q?PjZhDcc0@@+c!>y4m8{D&oV
zvk7Z);LwbB%g>JkjFW}>t+=2eD<u|2wkXz548mCSs98UXXN2qz&0Zu<*UdWGfJR`>
zR81k^AC^@i?1yo7peXLw95x-$VIU?`>K?gCvOJv9L`yiX{?QBbWzg?rj+6<y2yEZX
zgRPhqwI8C~2IfPQ-!UEPHGbF^I;~_0`_!PJ3_$2P5euD6g*c$VxEY%i5Ax%FV_v>y
zK?Fg?vnPL1J5f+hQQH_8|4faA0U$-7&WALpQ~<ZSH5~LH)1Ma)Be1bauGYKKQPWf&
z>ORA2o4<P`bIaCIHjnhjVGWM-s2;Y#G5B4TuguoZtcvUszOh-CjeYt~{x`_~)GvFG
zFfwT1P@7lXZ1EY4;d#a$hs0RkeBPl;r#LmciJ;?@@Cjo{2_BH&6&I2h>^0ue<z)Hv
z`fKWh)@#HSa+818p6&;(6UBVQ7}GH>;Shh|ib7Qh4E^|>&nEb348>OEv!<c-Pw|^Q
z|2DV3f6sd)ft2-*;1KbnD`3OkZz&9Ggu`@sNpCT?O={!)E?_qa11TVXdJXW*(3gH<
z1GjEN$$M}%upw9LY4Ak<8=%E&!fWy_V=>3I6~lOgw|BL^&!`VcGKgARv^4VnSrJq+
zk$G%c0r4sh3OTlIcY=WM+!Fo(9fgjyf-i8>b`zG&fCJ!#5aQgmRi#;TQfAy}wNo9&
z*?}g4VXr0AfrDq=OM6liUt?u|nGwcRy|(-&6)Y$)&8Wn*$ALve1ZJ2OaDjOq@0%jw
z2lj|x=)n8ulDe!>`lyvKe=G>25~v;?RKw1rmAWipH(s?LTiLV(X2j;#*yjsb*YAI!
zm#9w5@wvO2F|kazvIDuU;?sU8Rb-03-$ZKfQK3(Pg{8YyW$zJxo`!L56SeHD9%RIo
zTYy7p?E@7(7`{ga%acQ!pHLLTH{3{Y;D4$!So4>Fgw6wHhUZzQNU>7W&`0ejAhFfI
zH<XLeD`$6xl~>RH=&@>t7D@2MsnDAX1I=SVaMM#Ty!7sQg!8ct{_aHZ73TA=VnQ=s
zbr-e`eoT7-I{7YuH2C&f(gbBSNThu0MCkJ5sim9_ov69NN5o4{h#qoPNvDNV8tAM=
z>QET1J(8P5%=(oX2SQZ%TT(%$Jpl9rG{&BY$y;G%@u()u9x?rkrEz)Yd?mn!qG|@{
z)N>;>?!G8cGj^u7{{-uX)*D1@_w!xpY5j8SN(*4IJfzI6zI}z=wb(Rg2tc)eQxJhW
zadz>CdDP-a^I2_zE$GAKtK6<RC$iNLJt7@YSZXIO9hbG)^=elDc%G}&2@3`~;sMUx
z^sr6Kz86lPKL1<u<hUQb>Q>H;gQI>+Y~W7`^TIIf-LBEmPrVsD^Y5cX3xZ6U3Ly>r
zm?|xB&_xFw2Zc}GB7V@s8IFUG)cJXvp<{wQjSMjCELcxcZ~8y?fRw)mc`J2A{N|_s
zzvt~bxJv`b!%`j&9KR!WhL1<_FR<BIA|__GlUYPV9Ty4;-?}{k&Jv7Sa}Jv5baBHq
z2GU6LufM>doIs1-^yk<PUBG|{+{bm>!iEy`7=Lr?!;I-|gDAka(X!%F8uuaRB)9rk
z-md!I>V#);*NpAAuTBBZO<YHFigICNYl;*0rq8<_A%75UyDoxvfXa4gze_(TvHqYF
ze5G^Ob+Vh4MmS~j0I&KLj1!xcX6A0#O?9VDq;wszwYvO4OmMd2c{lZtK;rQz%jZ-*
zq=#5LNCz?u$5X+pb8TlI`PSr!R+Mqmr@#beXI)MNE_+`xx6Z({{{PJv(HS$`6>j>%
zpkKcV;h3GF0InqzQB>-6KQcqNC~GpsHUz~t#uezsgKR-EB$r8_n;$A3hF{z}ZCro~
z8r;o~V@q-4YevsD+uc~RRJm3IG-hJ8fJeO!$Z&vi^mV%dq*XQnHD&7bF6+1<=g+Mg
zs8^T`*^Dh`7QJ=e0aD<!Go{4lxM?q)2Q)+X5$1syZ&*c*w@wB12h05yIO?;1IOS|8
z`^`AG|FM((H=jZY_CwecD3nNPxqfw(;9KL9jMou5I|G<sG?fJ9+BVkB*n^~L3vyPP
zVy+oFWCtkNLgq2PVgEif5H$q6k+W2pI~18a77<J-7@;6@fQUJ+=#m*X-#LKzxc|(t
zz7qSByGXUcLyOT^u5+JjYo;^e(Iw|FkTj`m$`9S83oVH|lcQ%#wijaGNTm8c{ceFb
z0RHa-1b{}x<TFSqe^#$=uDw(ODyJ#VvXBgrLKP6MxgD*0^-rRCwm2w-P^G!%Zcj-d
zRE(%oFcuQi>FsL}M;Z!<5~#CPxbZ9U*@!E{fikk@)pb&b_-AT>iMRFp*G>Yh;s@BR
z=7vQlx(uEhK{>wbksl-+FoJ~d<)uT(>eE!2nENp00?m9)ejEr^FQzf^FQ2j0XU_NB
zPYMXf9QR~>6&M$bNX7W43J*%eP)aK<HcLJ(@S3gd4-aNv{0x_Uv1~2g-9eZvrZE)w
zW@pht!A^s-Xu0Vkxs3`@ga^PXjaKW!AXiylZ#-K$PuVH&Fa*{}%hrY{!gdB0DJ0wU
zgV(n9WpgYc?TQLDeL}C68Y@1%PK-`eoqzl0sUw7)F<IoQ10ps}(*C)e1C?ZjlSMb&
zX;W49){7qJr<g#KiHaQeX}uH|X485QNO}h;U1RLLa4IJu?r0B8d+tp3HM}+DaW6uv
z#}%g|6f{`ApO$c$;bzW9_N23WY+7Bl7MPucO>ngzFv%%PmyYdFB{?Kp<l_(eoE~HW
zKNqgT!tj~!N@++6_&?V8Z+YNg2stGcBauE=M^6X?vD9ZIiI|&;xB{361h8&c9-l+A
zz{kGW3x(d7Bxe7tFuK(nK17(akm<(Ec(z(2%ZzaQ94dZM&k!!3{i|xird233t*3vL
zwKEkCi%pV&IwL<aXFo?h)yegZO9a~?9H2U#Z6@N<d=uXCZ8gTC{hCA_b{WYrAXaNj
zy8~Jl&<z^I=#vLNqkGgff4*6^=n6|$9no=-3k<&0aF8y4ZzgkBL3?%uuEN8Wg3%{s
zt<(XC90;Pw#ao!4i~z+7?5F?fXj^RhC{<J@9wg{AxHtp{rRN^-&Jlr3u6tmrYYG{c
zB?un|YVb0oCEW}A2}?BncNn*vd>tu=HyDAV;*!Fg=R>n_g?z@S0(+RCT+B}4Vf277
z*nyQN{hqB5to6$5TuHh*ln=eBgaSHK-y_3n#!CleFYJ3|+OoO0??3SQ8<OXhL;z>W
z0KaAPSA5g&btft6u?Bx>Oqx~}AkugH-U6@f7I?t8@`DHqLSqC-RETrG?(*v}xVjKQ
zrZ)zZgLob_Fal3U%zI_4X4-E!d>&C5f_n<&ctE3&310|-?|5F>xl4Oa-Uv|5jy1`N
zof@jRL`-f9^GTr4e%8A8A}aK8wtR)@-WvP_SSx)_4k3o5`15<^VxI7T(e?n8{)`PE
zQ-POa7?_$ci*CGho&GCrT45vjuCfRM8&D!*%Xz>7<e}Y=5M?S4bM5@eBHx#aQ)(9L
zEpLU6ZJjDkc*p)4y9wDKs#vt-qN|n{8opLRaJ$%AgxJ@uHgDmDQ)4hs61Ldqvm@iR
z=OZA`ilHLh{slTp9^;P#YfqxY2A9|;zp|~uEe;16s(-UU>pdYJ4!I3{qoY;s_bv}$
zrpmJ(h}On{^q6p<lP8MV`BsMQLJ<xpTL4^Szx3}$;Ep^6HjP1;#%h0|D>P!W(|@N+
z*$B#ktd=WYJDzg<p6bc&t0zT~Wf#3u7|+WM8lFHoaajg99H4i(5C`~-%I2eoai2-<
zjvD845bu}G3K)escIW`Fo&adf-382d%?~!cLW6DpaZEeSTPB_jL|xeTRoK*He8<EE
z6d>!yGOp?bcU+H2Lo%wg^tj7f3Vb_+njOga@T6gw@J8xP|I>e|88pSU)Nst;BaxIu
zOD|Qgz*ss1&PNIURVMQ2WM{BeyVDXjo_HpAgx*OZIs_|CAskC$U!N9EHWSaScxF+^
zd`s6Q{6C3h*bQq<KZ;Y@6%Q(itT{latq4+dsV~@zFxEMXn?oDxeEMK7^vP|DD+w4X
zuhARne_P{6pM`M4Tl7g6oO2w|UK$UB6*gYk-yOzl+s_$Fmp>wpcYXe4(QUr4|K1;e
zKx891JWja9$LDpe!Q&}LFMlJyK>&Thpcrjyl_6`pt955s!VwUZyhGfJ@O9*+kqwB?
zIcUTBz5e*#T*A9z$(2oysW|J9fBE!h7XyQ`p`7gJ5_|nXUa(8Nw#WF-5rEstKpkO~
zl~#M@W8WSjPvB&`a5b4GC98Ld091=KVw9qUW1e4son3LZqg#DzmpTB`wkj<nrXI()
ziy?0rG}vAA3_+kMowtSe_riwY8ju-l@t%(QsUW2*Y%2Ffl3dI~tJesR=`l;sBe;92
z5$R}<1OL9pngXJLaYjQxRC1IJybD&1kq~j4gRvQXWfPEW<f}HoIh-Qe*OBrQbVJgw
z7cjW%fzMYlW}h9~I&mHI{nOqHE<mH%d`3OWjKTMKbS+Ny%gtk$3Zp0Bv4szo<9?L9
zLl?t9)J>2MCHL`Yb(>d&(=Bj&@~%nWfeSw&ZiyB`K=RbZN&`6T()Sp69qyNixz6bH
z?{w{_0*Cn0Af2ys2j7nnH8r`)I4r)7zM1xaq;}FdttYUrSd~qn02VT(OPG*53W2=%
zK%G@AMzY_@>)8#`^=Lpsy-k8j-Ts{pf*AC+)sLQQ&L+};zdr5chrX6`zJ~I|>@sd;
z(hHytfK#vzTp;g6f=b^flPq3nPvBQO8I=T8>Ka#mw(1P$lC61*#F)^Z^#{W{&FL+F
z#=Cl8;ZSZ{ou(t=3*R4Dxh#!Fs%O~-Jqm=19%~TG+%G=%DSt;yBA%LXiam7q9SkxD
zTx~XdWD>;5nV)$gYx}ME7o_taw3#+9dpvrSc{T}JGy#q%CWhT=x;pToj!yIE`ky*l
zL2O(}r-~j9!W=#WC@wdyhA8)n5}tZCz<`bu3w;pJhY{z$fPduL+KMo-<)6NC2h0t}
zo8M<>*?qak!#n{>@Mc;JhO}0yeT|fW0HoHedioUH1Q+OS2qR~yeaVE1J8((^ye<`^
zj;shCer5ki`doWpA7Eq+Z9csQPo|{tFC^Vn(wj^Ka+Yzam7dCf-TueXmH0FL|8cX5
z922z?n_HMt`sUc&SENFixg{jz+T7$!6PeAC2ob`@93>`1VslH54riNdjv^wV->2W7
z@OivHpZDkadcK~A5*n|)e}bP@LikygY(!9#O#42m*bCDL)&9Gux>^ZXpvcBDy3|s%
zd{1dp$8XJnKxXR8+kI`^$R^`6j=_l%#>W`7%O})<(!hHXxXl?SxfG&-gulT>t{m)B
zwb6G5Ig-^@#@A`1|0!^hvAvlC6Tus3no)_n(;MSD>&2x16VwO)b<J9`sL>@g`IJK_
ztd+{Lo}_>WZP*cQ@DmoiFBE><`S3L;hI9@ChEva}6?@)$&md7fwN&IIt7K5_Cj+Lc
zfI5myLwbJiEHyn9vetXg@(-3IEzlc#{`)<29u0!hHmppjWgf$jV#6*(Fg|LG78z8g
zcBK9J!1ZJ<3~vw%=-@~aT&L2?wOdn(2^&mx8?B;DFoSd>GjjPHF8tU9J;G8vEQd2Z
z9=0Hgb+@JH)0@7g`(`H-)w0zAPxy6-Q&xUxCGiT5Mfs<?#$IzUZGE%8%-G^P0ds6~
zDJ3uvzPvt{cB)WXL-AE5&cUw;Xxr_}r8o{Yea0%fe*yv}UU^P(!W|#;4g>;Z*%Qho
zLqb6?TYTM@Hlg!w9w8Rm^v%?SHSVZkBm{qX+ar&%23Q>L2DxAB;aU1rP!V*eJfVul
z2S2(T+nGG?@i6RI2#5Bfp;0*?_x<eom?_Z(a>=@kd~droTyRLea>ZhEy$mfr&hfh?
z)ZvDbJ7fSfP*4RpS;c5T9ji2}VhpH7JfOPehvwVPt6zDFmE~rPBOW6UAqjO7H~Ga6
zW%^`2PGjj2ZXuE33&=X&2Rn@sSmx-zqNnzcZ+qjgKc;u|O;O3aCupCsS7+@H<AAP9
z;6#luAlV_oyELhwfD=R$E@M!?V<&*fAL43;K5*sZ6OcxJjJSsoc%}#IN#Dy@tH0ur
z-)HCN!ktnsf(`IR5cr2klA-Y>kP!S(lF~6D{c=f3>l@!k*{>t&JwAKe)K{t7$Y_Mz
zqCaG+w@g?S<VF4^{8?=oQ=0Y<NRRXr%IEve%g5b2S9|27Pj$%lB#JkQP1c1pQVga4
z67V49;q@GEmIM%KvHx(A@+pUML@^O^nKLnD=Jr<1U!C7egM0rSrT>kEW8Md1=pNYy
zaZJqH&C{RHzunoR>kJ@_wQU~uNoF#`Eg+{CxN|y&Vc5!B@y$Rx0j-`L&r6h`qv-RC
zwl1k_q!SAkagOc;Ao-uW97VTXLw(jXb`bTUY}%Ldge!*TN0c23&#W9zkL|zPbMC9z
zT-NxF0@urOlqzq|xfy-ql<c{X@1$%-zr*Mtp25{1%lg-%=}TiWkc~rnEOjdkC=qwl
zJjCd1P~~)^*T?yD4$4NY4jKZ=ykXpoz|y1ec$nPX=irn&T|!yG?<PR(e6PQYA<egl
z#J<Gr3;qX>+4adnMgPf;smfr*_(LdvFV`Dv5&p`CD#QsS@)b$`<!hB3R=<Y+dq`((
z`k+b_`$2<qX6N)H^lNE~D}<joz7=Qzd4Uu|=P<Q1kY-`=du&Q|(?*Zx@_j-ulu=*r
z{qX@{WTn;;w&r?U6hc8n@I}0Dw;7O(Q3XgPhscgjhbm*i)QN-Cyka>=+9U|>tUcVg
zJaUxZD={b&<4g~mat=<fn|S=#PkCteMw_-|&?ZxeCS@#opK#(Z%$W5gGaK0a_c_kx
z<G;KV<Ap;PKGCf10u_9~>J4Y{i|vCwNnAkeU}?OJ7h4$Tdt3EtQ-yEX`P)-5f5H03
ziLi?Z#gDP5ANPHAUso-+By%YaL1?z5u=1Jpw;U4BefM69kRJu?g>o9-hQ0m$)8!*c
z(FsrDd|%7XNYf!);5x%_iOf=N^S`sjaQng1E-Y~5VX67#GC$Q`;to^pLZ;W7{(-2O
z_+&Xy93?^r0(VyyHS$(2axr22*J%}Q`CbIuL)T7YD{+APa}^bQac76DGuI2`V*Z`3
zu23ENkO_c3+oWa<FkI^#4>vB0!&t`{Qo_K07NR9G=;KuM$;Bs>1+tMo3Wl_Krf9_y
zRlR#_LGlZhANlHz({VTy3)3)rxOXy(Q7i9refjl=xbQMHedz`qIzPyrv^W0tpx@tn
z2(&^>$zs5}G!H4QczinM<+$1ylO4-cd#g&4hS6&Kid1Mo&{|rt+;&A-L0c_bPY-gg
zr$y_rI}~X>4`BKnH<yzP*B&RuK!|UZeQQv6dNTGCiYr$79H&{GI{nFqB;1|*Q6?KU
zTjE1H)x=^%gR%KloW*=VzH}AwRI_|_Gh{O!dw=A^=R#>b<BjOjqU@IRYaaPF<-&GH
zqkMxh2Hg{v6)Z+J)K1GY&=9~Zo&dHOC#%57kcUHoAbNg@l3Mau&SK;KuUEV#tbkCc
zG<^Co?DyC2cU-B|Ao-=XYj{1b5D$gmq_LuUKqeQwA`v|^Tg|U7kxH*1Qwd=8_qMWa
zk_fth<J_^H_56k@Lp}?6IxjVicTRUJ2?%Vd+JMcFt{TjL@_{ZpD9&&!B&pNuJU(a*
z1I`;Oste_^S^(tI+-|Mu7;?8sq2WauW{7kObZ<<drue2w_}qSW46s3)tHGfcVZfqU
z4dZtnMtM#{RC7Yy2Ad=S4cQsnLDV2RPYUC(cFUQfY1FFpf+5RWK2P4~a+KPB9xMxg
z&CB3SSH~E+C|#k4zNIW6R_*_mn4wA%?laasBWiZ5^yw}gd6XeZZ!SNZzswj!G{=R5
zvf>9kFsW2Zmt-Tz0o{bY60zqA;K5YvF{I&K*w-<R&mr=3vgZZ8gT;<bz$nB6T}I#*
zYuP42X?J|GN|3LCgd?lEDXr&vZL~3a72Y;ImatBA)ZOkEFB}CpU$hz=0!7ZN<Ii)d
zPLb2=$;}%*f2#LyB~Dxwc&cRx>Cr1HcCZ$+ckuJ^DIQY3--+(19a6T3Vt=LCCQtOE
zX*BQC5o5t816pz^*QBQFBL!r!3R;g0xk$|0FBpofA>3%kMTI}C40B^)izZ6z?-$T{
z(-MPKw9d}#cdyS)lay$&@HU;l{r>U67AqE0MfOOUG#*VBrTOn#qvU-i5RUbI%Ubrn
zv@n;dyB-pNf+>SE9jb!v=b(t}-+>x7EjzccHaT+JQ;}=5WrBvEK`t|*2u7y@M)7Q<
z(tTYjbopz2q`O-|dOe`c)s}Tww)M19It6k|jFLyv3*!<*4q?S85vLaxr>a_Xr|w_Z
z^@PbnY@Ng5Go>yA4`A1Uk|%qZ+DuQ@w7lhC?l`x$wk|C@A|w|$@8o7F_{&GQLeI&&
zG;R4es;L^Zp+Jtj1W|aMQFLW(lPR6yBpvf$0da{KF#Qn6iibS|s>1SVF5F8yIhVwT
zbN~40(p_$>6n<%c3T-n0-6s~28{4{c;{0_*@m=je+$Ju0b4NUi+JLyvp@*C*?J05v
z!UO|tv<`b_Swd7RrvVA9KJuGwDY7jYn^cb&hJEd`mraPJh*qItlH>oPO?r?-2~VG_
zFsw1(%V0<sa<}+3xxPSBz{)RZ?uEq7mjDFZ@N^2F%i4C?{4Eq-W|kk1ZKU<k^DP`@
z^YJYazt%cs3b{~-nb@HZs;^v&I%Khs9`C<N67(FB)F~Hg03nMqSlcwwf7V{-nZm{c
zqt6t}VCW!vyZrLO5Rh-yGuGj+`DX>EiD^0LYN-5mYz{r;43(l)u+(i&FJD-c2-$Oy
z5QEx(!rY4&{VV@&M@N2IB4E$vH2vA%oL2<fk41MGT~!DQ%s<As7xFge-wZF7&=>gj
z8qw1ehz-z%e4q==!EPEMpGZt6xj_$MpQR`ExiUaLqb!9h^TIfLZk7r0s}w-&SM6hG
zUC*cB4lOL|vy!IBX3lla5F6m9E$FN+`}FMaEH51RM_py9;IjTbu<*zWM%+9CnBN8%
zv-5}?sfM$KFBq;=`&!H6@LZ{B4wtnMrJl8~4S#j7FLJYpI5ZYxC;X$k>{<By@;7S4
z2OeBe5TNGWxnYEAtq#<kqLjQfEi!l`U~q;jMEyIlI7@R@_;0_?qWMw3@>0{dgfjB9
ze83*tJh~#Y_!jINCH>e;n!Djihgk9GAFVJ-VVbngL3#t6%^7Zle4pV1+HlCwE-<Ai
z)g=d)!5m)StqX+A!qjcf)vu9gCl{V9O-g6T8Cm&lnfuGwQ!=qL_9_?HkOb`J%IA+?
zjV+JW>`UD|%J~@MY#iBz%#|J#oI+$E(}&`I2^tVU;YDDf-{qv@mUE$d?;jqQ!#(ei
z*+7O+?VH1{2%+3lqFQ!=<di%4j3OZ#AS*X50)CiGdi7he)(Le??VFxUSULE#yT}h;
zA|Xv1>q&(Kb1&<X4YomlAJHH~gtyc-jw4Pg_DhpwPJwoTn-5?W2eaaZ{(Jcw{O$Z4
zT;q9`M$}}OO85kVGPP%eveDY+e}vLHVopU;)*7!9nO#8i?Sri^VlxMyB<Sgte#C0m
z&fSf(IQa#2I6!)Msmk^WV);3rM;Zc(<<}#%Q|HfdUd}6y6c7h2=r?;hd1zbSA&A8r
z&f$OO#CgZ8=3K!G7Z!i~5;P-iuTeyhDHQM5j#vmh6i^!8rR5z4f+Pn_6*h3=l}>M?
zr3cVoMM6OWbHfG|RDI#0h5Y6>$-S{n!|TZzkSU5bv2Key*t(K=HG$yrzTMOdpI^zk
z-ANhM*^@R*ixJ}4NW0Jft!w&rBDj<NobY#eWc?YVicL>#6YP|}DDCsu@kFK16DA2S
zW}@77{7X&rWbgx6w%z1xJ9w21QLE5hW5RkZYFqEbNpQ(?xf2$}PJe$f@jwuJ1ay6#
zJFXd1EvAQLz4|<y-h#fKhy_rX@x3Mc&N#xvW1oDywvnIK@(}WfyTckW*N~d$mdD>i
zHuRfEyl0#Wc<yFbuxRox2KRm{L<8e=yLG~Ct+!=MHI1aRh+ZZKN$~IFUI!mpI_62O
z0>=k4T1?*v#Qau_gCxPBA$wV_c%ihna@)r^1dm8Pku*lUdjNPCXG%?dfdaLIA~cI9
zAnI4gcOUKx!SFF_h#fd8w_jR7=h0#8Ll9!l!knsFDc(OSUB@o*BEYwvJ36Hsb?#ow
z0%XxMm8O%@NUksul0ga<KjuMrAaQfB5N0Rw{ca%PwvVmA`OE*m!}e4<1-y%6wT;XY
zfdrvj$$1YU{=IMpx^2YqFzd%W0*ZPRl((dhmqGorM4J68STH1L{rTk-Fr%N7+21-b
z5mC;NL@x_yRrba@M+!SF-{~9m)qM~8ob#tx{9~?S6-_DQX(x|2{wCL90Sf^T@$JIL
zXSmiIvt2F+iO%F`{;u`jLoijzKan~zb35{WXyN&=Rj5}te^2}MGA{4kMgj_+<~BOp
z@kD}NYidd%&Rei-eX7us#PjxzHw(I9ESOc<gFfZQ@Z}$@CIvM~V+tKPVJ|Dqs&6#_
zD0A6i;GLZdE?l5{zOe~5W3=xI0y5v^i9Yl`AL>X^OiAhjnWPILXylw5C%L_rz$^9e
zV9(k$1ubpN84^@{WOy692hnftPA<Jmxo}yj#DK^Yc^X=W%OVoEbWsIiLUZUryTjef
z(<5lRIEW-1rPv#Z)}@O--?Nb8{A-;7x9%wl-Q&-}bI-?|`tIMZDzjTwv7Q_t(G@ot
zxEuHx_1qvff|4Gxm8QK17;QQ5UG(WNcqS96sNsHn4SZMZgIks*VL3RLDZjuW;Lx#q
z_+LKmXYh%EKtEGJWHFO;i1rBgiJP_tBAAP^R>S~4T14}LZ})BB#TGf_?u*WzmLz8P
zkT-gkg$L_e*4xxKPKGxeLpd%iW_-c^!5a?DBd(APqz2;%3Ljt0ot=R>Q&t>}SOK`v
z@C6laI2Y~_Y!dx~^wFu)1fKypUrjbK?nGHHSuFm`;|wlmzHAx+jTOCOVk~bZTF>~$
zP@1KSj92&hIhiq~Q3*X^j%0><G|$YxWj-?_EnV|qwH#9>yPf0SUGJ7<j^myqBHJj`
zA4fMb?&7$yuc|d3*~z`ODP0p}aU4cnmK;!?NJFPGVN;=>6u00Zt6xT|(N3SVzRgJ=
zC~S}3d!3B|?j)u2X*iZ}_=0_*!LG5lQ20vsu%k-bS1g`S^mZ_<_#@5x)+LPV<dr|h
z^MfvpcLXQUj-f)htfTM+-^o@dG6k_{qPzjby3l&Y7~h9sNR<t`k@Ts^(U+AH;ZFa-
zn=vihEfZ1Y6@<aJJKyB))Q}51&f9Qjf;GHnBzM-;Vp7ESRJtFCkUv$Jy(?;qJ0w9F
zRlv%GJH~aeM_nR2AE5_rd59{s?GbOR+emjlItj#sWvJ3$S2<YEmlNGmyJ5Lt$4Ad6
z!lNs5=Z<c4zn0N>Oed4{kPM_ZCo&B^9Qx^{)BTAmv<cDpezQ9R7?_GR-^je$wn1X$
zmw)Jeo-#vCIHD!#g)*eHq!UODfsZs(b*?BHufCMPaIMW1`bivS)l3-+M1qDEF(Yu8
z$>=gsoOta9;s&bVRAknn?#Y}#W+w1yOhpGzW$T`h>xRzBF(Bl>5FP`11{D&E*&07M
z;Bf@IGta}-3}@R)*{5PkvdKDoM-yOg|NfD}Mv1q@Ib_}En2z|_@82rfg~*^^LDuxO
zyNv=K#OSZ*8Yc2?#X<udm9%Jh!+9XoR-P_~qP#ZE?ZD*U$DPf7?pP1B&hQw~Ufu{@
zOo-(lC(nA_&zqFqPlDak;$nOu`?bn^O}uCf2ppcd<eLiBG;g5ZxlI>=jrmBCIP^Gm
zt8StIfFe*LAJ#!hW<#(Gx!9Y(xG$Z4Sd;n4{$xP6Whf?Rh(u?EsufVEmBE;BS1JOo
zics`w8;P_Hop1HGqzlCCeD>6_Tnwm6_ylAzHA}ZK&;J!#6co?_*MSU1pNaYr18ORH
z%E;nRQ3p$O@f61TRHRBzdlz{j=!x{^`X7(WHpGrG4uFO7A}A_p{H`^{<a>J&USe2o
z(5t{i{4Cv`@<hTj*X@qmHup!^y_Q?~_wXke4nhki*J%gzjEx?}YOv;cA#YQA<ErQq
zE$n6qz#(;_Pa~T*1Ma74q{21EUNcg0eR-*dT#1k>s(sV7<8X@mq(T(UfgfoC*aL%i
zO!gg(LbK)=q$5#%Sp=YFoWyHBy%{+gY29taZfj@L??d{7C64c0?I5`P%{5l^5bHU2
zFkG<L=^t3Kn|ell&tgmN?XiamUm7n!KBz}eo1wdj6gaICmFYJ6^Rq4b2BelXRYphD
zvu+vx`m$Jwy6cMvWEI|khj?LJlZMixj!H8?WV!5%^t)O%S0DjwcL_W{XMrluQS9l3
zWA~a<#}L6bTgN9BztY)|R9w(DA=r|T3BJa3by+Hl{P$z}{xkRDLg5=8666Z*DE4MD
ztRI~$dIGikE}Oz2f#Ehzb4)WyQt=(Fy4YxH`U&J%e&uF>bRr}UB7S7#!c6JK@0nN@
z6l>__w?cZkZBb-!g}yAWy*KdHQvX&3!~_18Yi#}SN7hKU(dy3e4oE!RKUOSe-J$iZ
z1r?+=`ixS<Gpl2z{))nuJ3()uCQH!){$v|o1y>GtgwY0l9s`{kX&=%f{f&^9bfSA7
z9#>npEp;U*4s(X1Y>MQ@)6ff*4_=x!AWs_1>rT#|9Rz);^={?{LXOnE4Pg{1J*CXz
zXGd8o_wpLs30nhBeCmC+Su;$^LEic5=8Xd_XR9|VcB70pi-ve#jiXrG=f!GBJc4yr
z3ueL+{sy?&8FD*HGeM_AZ-I`6fKH|3Oddr+qi8<kk-|UrLX@#U05FQDlo>H1_COhP
zX#+2Q&zi{WmVj?XX4&KF{abFqBWm=2OWM-SV}89{sok{-e>+wTJhu6^+HO`Xh+5PL
zYQ3?3LLR2Co+N4qYmlMifh$05n29`O(xaCJ?jpY_aoN9r7FV*jGsjOSPa<`x{L3Qq
z<?8h0AFSsQ@3FD}y>RG6xf5zh65?V7juwPC1Tk{UL>$67rb%;p6ORq5Z8A8{xcdL^
z_}hOoKislbyC0m(J`QvX)6RwJY8h$2tBYm#!gXBt-hZKak1eTV`tuvw$dtz~gnu^$
zi)vmr3mw&d7-SMUDhpjw$9{&UiqJ|x-#0hN#$xwYYLjsRvq!fPlJMzQk)s;lyRGTQ
z)Zm$$Tfa|Tymnw!3@2)g+}<h^QRIr)yWGm)`a_C;07U2PoBqBm51Z{W;=GVg)-Ghk
zZ8mb?2@LJ;gbBF`TiJbfXdHGTPo66coqgvgBM~|`bBX@@Ys0Xe2OV(*XPpToC~mTz
z%V!r%C;<8X0C2gp4WN?HLi6s|`tugUl6;v%f>w1-&*d8`0tIVqDZuC6q4~$4DB4<D
z7P>L8B7P<KUm{NaU0T&ytyjAE(K-D^i-&m*tRHg&H<u)>SiC|@ZNk54uRj!J)F})H
zN?xIpr0c&JTmg?|67cVx6Q?@LJ~(eZ51D79B-9EvofF?}na30ktxH2SV&Ob+oxg5P
zm5;)>!xraE1zF=8TjLKz8Z8y>3QuzcM0q`uHbXy)+Wf$E1{<|q)zG?Mm0>}UL-eed
zzu@@(_IxVHJGxmP0)i}6lC2;lWXQ^=f(P#XcJ<%xUL%5$K-a_7I(E0m4JA^CDkC4;
zSdU;speU*S59<2P&m_%r?SU_QT(6)k>Zd*)gXwIvGIt97R&QD(O+}lc9vGes7%{m@
zN&~XlmjQz`8c=Tpo#Zt^EUFvdqb-m5Jc{!1)5<&|Bnii#uPOwhl!cZWuUw(S89@^<
zG2Ycek<c>*&b5)FPgSz^iqmw^V@30hj+O50E1EWSzYeWf{0P`=JKk6xz#8NbVZRUx
zXJ#LPed{b$J)oJwbaq$p&-P>WAc9B^STrS~A4UuR(ESJ<`miTZ6isl<i1a#9`Q7J^
z#)Pmz9px^Bm<JBVd-nZm>Zr&_#Xa(!ffdXPyL%C$_jgqffxea@QN6WfPQnXY$@5_V
z{)8`o1~vIrkyS87aqrp26OX@^`TMlcOz#2uDn4;BeS99k)vFCFXV|rAULH6r5k-Sy
z7ir!<!yOuYHCzVKk=xD^3*>~?d|{nXjF=V=D~TE`3EysahHAhqqf9E8TWXumMimK(
z%jw+i0!NKGi$dgAhYlR$@p)AzbPld@7-}CV=rS=fqA|~F)_IwtX96um=~0#a95#=b
zlcBA=GliN;ZAHsWbDjN>j5Lb$_AHlAr*uSR6C?|5Jep1cv+Qf4LGHl8$7?I$VgoDf
zNoN=fm^S4FzEg}c^Zbj4DP|_bXAc4)uWk5mSgjRW+mBYC_sow#E|@@<&x#A?6u%sY
ztI}i}H~?-iI4RqVTcyZgsN*YE*06xbBqH(Lsf4;E$HPT#!qw<jc@42rywwY3URx4`
z((6<spHHy?t^ln!l#;E0g|!k=Bw?>S1ENr!?xouwq`P!%c-=OMCBhC%l$D{TzfH?2
zGY`t%!#`69y7LfP*b$CDmgd5tIpSA(sATt-V(jJHqGbQQyeNaFz&O!sK=*spUJ(dy
z$e{xMr~lrqGUcVbCoMbSo1`56vvGR5wVr~WOS*u!PP^Y%ds!ZDlXj<L_f`gSprjsw
zPP1kxn-S1`pxk<Le-#?6qN{{5-ZF0u75Bq&Ac<hZ&WNj~MB{CfD;xlGfRC83^j@g8
z946_r0Ahb7KV@vv5i0ci!YS1ACIpn&m#eZIq$m;hudkLOv~+V>@>l-I6U7pPOIShF
zE1#Bl2ocg9WEh$CkYyfLE<Fb-4#=N!d@Y`<aq1S=2;tfOL_PMfKth_!XAD#|S|L~6
zm6^s+%L|B7;^E?qZC9V7SFknGSr<r5*$J}DAz^}J8LZ(&58|B0hzFq~8|Xn(%~$%=
z;5oPkgn`^OcO~rBdRKID$m&wP02a+?a@Jk3Dp~gPY`DM$An#t^Z&KPzpeCd$S#Tq_
z=f?Bc|L=45?WtTKr^P!<>6R?5Yf{xY6!x-NE$?E9Tb>uokdX7zTO>S>a+a^Li##^x
zc(~NfU&GDs6R-|9vt|^nqPK6(F1fBskaiLFI2RtDwWreu1EH=p8wt>haUycnHB6ji
zWl*8x*(T^ui*9hXqL%ai#i{c!Rm4bn0MqkKfbi@wUs#)~3jTXb@f85QwEo^*w%6E5
ze?cF`Y`GtXSq96?(zron*;8HQX|HZ5>t;KO2rigFvnzWFCTO^Y0tH;`OPu+d43I9C
zL7^kgSBbDhSsed#eB0}nxLAQw#^aA8AT<@Oga4l_E5}*(#v^I>hh~Ms{|p;cYSf-<
zaGmtZG-0{r;YQSe`8nzQ_Sx5B@3MJWNgi!*GU@x*^G?gB#D{O#3FE4@LsskUmKvoq
zAY+*JTuLdex-Iw5d_(6=SrwT8+wg^5&!O(b(7pC-m*|JrXm0rDT<Zq%Nm?NO8vZiT
zF17cTbIOn^x{+PhZF*{8GvT?xQ(`|FUjl2O)S51jR==_NGYa68CE0jby7)pZdoQ9r
z!dqkHMp<Wy=8-!<6~U4%)C+Q*_*AYzb-<N>xwRh@*X$6w0ty)&Lx>-`YgRDv;>E3=
zbJfj+?I%A+T~_;nZ~&&6*NxYwG6_Joj>Ktqp>X?9)OAvEJmJc5+;izp#;FHGwYOvk
z(aEq{zD6q&SP?EK30Iqt8Io+lhfW0xe2ZoGZOwOh@}r#ZX+dpi$WvY$;-5NsJY<G6
zfRbdfnD^WCg9C0ZgaQ9fML^kbli=1jo>^kLK`2@hl;pkT|J-4J?o>ZfkuX7b8(PwS
zPcL5n(Zr+^DzqUzlD#l4uWl93(UZk6O`9ux$9(ZAEppq}fSmG?d~_X`dc<b=4ejNU
zN$D=+F^M!^f~Nk|BqraU1D0PLai0-qUiS}zCunZ!?+DTMBDM>*9`Bx{A>b{yo_FkG
z|5z>j;1qhAIjX$DqQ0XgGX#N3!EcVGy|K$<z&K%yD)HHG)1zT3E=T`{Vw{3EbA1rQ
zlB?+SrA8GKI#?h*h#^DEA_6oJzm2~)e|PA#p41O;GTc7jr<sZCB%D8?5zX#nF6hYZ
z@6f=P`7hn~D>29d;T_5D-Aly++F{di;OGf8=ZrDI3V67gKl-24nkh6Fwlm9B#Re8Q
z=j5)<mCNI)jIlH{1om~#CM(1p^R<?&Pl$+x6#xZd+;c-dqm5COB4#}xA1JZ7-o<Bn
z%&~UrCE!i}Y*+fI*mb<3;uYZ^2^Pg4Ow0GlEB0ydOKqKS-VzS~8wY+lG;7y(4OqU#
z2i+7VPNI9WtrjnYLQU{y;4d^&A~XG0Nyo{8wZ@-*s}dEH6b|@#3)u$U8HXVhuz-w|
z43RKb8j}39PFsgO$CJg5>Raoa8X}&5pL+i7oitGqm?suihG^$^gH<Eu%3}@wkT<H>
z2Y<eo_Iyy%7DLdDVBpF`fZiIjZQtb)AfAua)~3HeM#V>cd;dhjJkw2{<R*~@#0;=k
zIg#!V31hW1oQyvjmk|>(%Qcq;JX82JZ`x(Cl)7_YBFf*Mmk$W~P7;FOTcWb3{dKi5
z;Y&pxpwrTx!WQHC?v}5m;PX`b6RnQjBx6^lM>LJldc|tgxBuXkeOhs^gY9JAZntuY
zMg1rO@aAUimljj&4UDhEP=v`4?LhKHfwt`Gj$kRa2=4O3TXv?XOfinAbEtO+kR3*p
ze9KAZ#4EtQsK;Anfw_3G^^)7A+0J3Jzdg5XN?XZ1>S7;c+y1<&F)iab*Ly>fenXGY
zi(oaDIKAEd{WXX`p!h^3Cexq;_5|!$XQ;sC0Yu)}v?&AeyIxjRFTM8~hv*7Kfxx&4
z(J_ZVx8oc=AS`6l{F-2cjf$E|*5eL<3ko}Lc=cJ<sLT4+*_#cQ)<!xa#v&a~);#k7
z87vB)ERjCrp~!mT-Rfx8Gmx*yFN3Apvr7y}20jAy7f!8_og#l(moRm&FEx_kOGNb<
zr_kxh^H=an!J4H{S%cc+gkYdw>=optt->nzibNRW13Tq>j8v+P&i=!9baN&};>ZmH
z-FX4)Q-1?(y3n&06Fa(BAvY=yR{awKO+p-F4gAn9m@eSKrN!n<TBL(}+M#w!0BeM?
zjBV<ZWYkW*gWafsu%38o)J0dO`;5MKv`-8q2#QIFUmN)FY#hPjShXE}0`Bu7<Q+N-
zOjM{5Tt`WM@%1Gj(qe2bmqw0!%t#D+^~=M>&osy|7=5kh!5c&(2>Jbz_!`2909E{;
zTX&?@F)c`V>67`e<bUwGAJ&pw7Xh$!=S`hdu;!g@G98Y(G`hZ_SdFe^@~8frER;G4
z0+R(-SIP?w4hxiuxv>8nC17-J@U;t2o=M#;&u8O~cd6{*ua452tsla-eZ7!Tiuq&?
z*kH7DHP%Ax)J)??f4~|^*F`F2M{K!wPs(Mwl@UM%n2&UfL-fQ8<k`L=MiGJw%$o1s
zg57-M1}!XZm3cZ0m<q~}x;{PUt`LBO4LC1}zX9<hso^FoT7loLG?cjcv&nIN4syK;
zugzD^h%*6rp_ek34>T?TEtS(JO57SqkbxlgQs&N<+QhNr=6AH;x3GN{9b)WxDhskj
z(zBU2J-jwTGd|sLrI+ap-Q}tQzc;ABL&A>fZTxx1=n{`I3r~nLfI?QgO5YbLL-NSa
z=ZRYQJMa$<qs0O`n?qoMJFZX#z;HDx&(#DG5Jv@(%ur6TSL7C%TOI`TWn{@}zzyFx
z$4G3MO{O%lBQ62i*35Q4&dQxHY%pa7R%@KF0%)TfwNrVy#ynxb-Gq<4ejTY_@N_J&
z%Cr>Ef@LyNgMj%V38?*mE&Vie^PN(dKy!l!N|iCBj>n+d@2~v!yYBV{mond_C<zTq
z=0J{gr(J~&U7_c9yP#_cbcNuXS&p`JirAU)QaON|U%v2VUEzz#3C(DiG#gEa3U=If
zX^h2)#Agma;mMnm+?KHEj#BoUGlc&@<)zYMpc2%8mfRHC@6Fu(s<fv)fk<mY%Eh^)
zZ=~y@s+B1qY=7E$ue|x2d_x5Eae4yo(k~XIc3v<A^vkyjPI-h2qAYMceOXUFPVe{;
z{tF$Q{(n|;s=7j92}XdaM505NdsjzaV%$N0$c6+%fPnoHHT5vh?bQyJ?waa&9Bu_r
zoMr~X#E-EHGO3y*h!zHJVoIOGI0t9F2PFnggfXup(vKsh1Q;iUs{8NR)kEe{9PsZV
ztL0&IIq{S)MXHLvE_nL`Hwys|aUQ9#X9-@y-m!ki)DOio)G`B_Q?6#stG9Yk5uA8q
z4)Lq^&^)jt>_iZAs}Y@8%dQcoKzfo_S_@$nF8BJ8Uo_ucmy@DLmBJo@F8@plu}MYG
z{1`^?5;d@4@y+J<j$OD$qo%nfXnJFLoq^M&N7mAcxfJ)(%M1w*Axb^BEXS-^_o7NV
zR8c@u5T81yGT=_#!FD5GjNPL_my*`V9=(G$Zb}%GYT>T{AU;cDLv^M-g%4>hqhoWb
z+rPRH{4+KdViw$XvlQr4$qX(`Vx1H0nZ6OJByvpltK=-<JLc{0m=_pDq=VijN3`$*
zYn`3-1s=rP^TQA7_z(TP?{~A~%JOARHL4KT5#(@1PaN|hAJC<FY=*eL-lR#Dr9lHm
zQqdaa*plmVy=iLqk;lM!q^<RJ?f&)$Tdt#`?|cb*Yu&4-j$$1tj`NEmOqe9@lE>m5
zEU(MI8CbHQ9v<;GNeZ8;5$xqv!3zh*dF73<MXJaXVDt-mL?jVHd|3AhIbMXQ);UJ@
zStm0$Dxt@FeD_7aO=P3bwqO2|uE<a!*mqefeVKZ9g0i+1IqH_CbMW5Eyt{=h3V~O9
z2|o1T%nxC7v!yd7qRF3%ZqZD{thEm5CP|i@wpO+Ny3-=gb2rLmj$e$dZE<xpQtWTW
z)zJnSjwBd8<$R;Mvk$!D54j|irLI7SR@5dt#D-M%An@~a%;hHuUIZi&NUX^7pp&nN
z%?mFxlqc8_J>(JoA8bJl8>75pd>U?tY=yfF86RwA4{iXM>ihJ*%6rDWl!;3le%(%^
z$E)xyyHAEbd_jz&a~Fj*KNS}5PL@4~X@8fwz6`})%l)>7P@5kx5Dr)ux(cQ``a)$y
z)%?B)rP5ZkG<8`+65;PblED+Xd+6<_D%<OF1;i@I)_ffn&ZSrc??JVuxZ@v_qIPEK
z;u&GwA$uI@c*8?mAzRX=5<2fNE#`4PQ7>xr!oiKRkIA9a_x|{P?0Ty}C1V1~>A4-A
z(i+q&1U#SmnkC7AmvTvq`UZxjG_4F@9sM^K>LW+&WG~_ySlApl1p?Z;J3pI%{%^R}
zJ8F}qFOG?8_BFYbW}92QD<@Wp*7{}-{R*o+vN$Q7===YhYw6ge#gks;jW3tE{$Q^!
zSgb6Le>tB@>b+2Sium5d*w@MiP)T_9-(H?={yh;I-@?;1@e1)Kn6g4*I%a)~l}hi(
ziR`bBu0{o>WX*eL?&*2;L$e&cah*?7F8sbag8CG*_=?%G?KOmcmUS^rT>fX_t%ICz
z^zR_0u>ACAdn<T=<lVFq4%E^AWgZAFWsCg%X$AFx1gA3<l3*gB5=NW@)DRNHvgfw&
zL(elN-}+A%gml1`|C_UI?b}-ajjLZBQq6ziYHWj|oM9DA2zJ~v8Jp+us$zf5#>KY8
zV>iqByI&hZY7|5%$>$n?pYN0pHmBICKRd<5_>?>7%?kib(%!ILyzTLqoh9j?*2zKF
zR9*bsN)i?Tx=v9v3u2drUi|dZbNX-%#>w%!1a00vU#2>1o-I$SAsDy5u){v+2BVxk
zYQW*xoRzTcmQb)pW>^&2lfoy?BdIH>ZOPwu`LLR}!^Zc>7Xi&bL!Jb7T4${^-UJ@6
z&&Lcp*C>54R?SfkK_9iWHR=iMmaIbE?<wkleZ6$J@!>g|kN0E8XC#j&37H1Nz!i4e
z90>8a@Ki$lP~600Bp=e-3nD<&SSk;;fqwd@<l6J*0?e@dMa3EeXf3M`5$8U%n{ai+
z+B{h%LFD09z+qpvQzeGEt<`z-ktoAO3*=wF5bh{Q;_&PhtY5kTn^*zSr;oFow@M;#
zAb7KF5h~jof2JofG|8HJaxytAYOmr<FTXa2#6h%fUwJK1$gCdNnS6BuSQJk-4pXSh
zwLCEMxs{!SVPa&OEYc4d_%T%t;4z-VhN;mzL`wqi_V=<{Z@F*Gr$0+RvM=9@inhh}
zXZSodbFP65C^tK6S%Qq;b4d4-D$%rv676Mc4QnWe0x<LKuwTYH>kgNe`taT-_#uZs
zaKQH!NN$!k9kIHEkHgK!aV#^`0He6BD2N*y_Ps~}UeUsSmvG8TX1s_{jCpDT85SIp
z+$I~3-0U<g)W-)=m!0to-P2La8vdlvncK436oD&Rn|`G;l0Vk>#g7?0x)UW{zTPeO
zZ0Pz{kx1a2#g<YmxG`=*J(lU=NUpSXGDoKgsjt;PH>hTmR+F7ZB^BsYcp+>o_)}rp
zGmlI+rCYHtJqPm+dyZz_hq?7-_-NG4cJsTT!?2OJJ+pdY=a9P2C~U9d_Y+~)?G_jh
z0lWBO@9OQ64m>EF%1#TH!$XJ!LFuD#u_Jj;cyIs+=1+}kP3uwm0Q>#f5OS#7Xz9~~
z#4;z#*8`DR*EG=#*KM-fxU=U~xGCzD%C@#x<*Rm6M5X?j@oR;{5LS0$NYsL_@?v_Z
z?%BU4RW_Vr5wzjuteYlV>sCX2hf~dUNTSec>kHpn|0?A-MwDC5?94AOs#oTd7s<m`
zqXtS?*5S{~wp7TB`mIc6TO9E7Vay`9l8w*mP#ehMxIJ4HT-PhFk0;d6Tz_(*$cb;r
zgOCS)H9*$BQKKYf92$Ym54sd;mXG#|Yi6*3Ur)POj91y~i5K=KF95vTp(PVh_*yTt
z$Uqt%QI)KMO(z_E&Bw@sh-W#)QiES%^7Bpbla$P$9Wy)vKHJA1la)!#`*8#7-Yp)n
zILm`<{q>1yesMg`r0^2SLazD_y+L?2Of<v%(UItzi>?!3j*W+THJkWn@}q5uJ&O+t
zk0b_aSr^R^vl01B3*Wu)FM(CI`y@P|*a6+92U5PpS5A<r9+}LIUZvokz?pc*bVWMi
zFu?+d;W*n(CnG(RWJ7<Q-K2aKkszQ=k(Xb%K{o@pSib~VH-Y_I;7?YFuWhht7un2c
z8Td2_JI_5@GUkv0)$Ch#ZI8b+TX}1(ba190)Q=fZ?2W<QcZ?uc!TQpnZfmg1s5^Zg
zhr8LM3lYSq3=*WOZ_?o<=AjAI62Aa)VmBVAumr+>yWWNm9$mJmO;E9UbeP@EhM&@G
zrP~Po=G+<DemG1_>;6ys%$-G+%hpu!SwFLhWdG*h*Dt|Zy}vYGBzSVbOgOY}Jz|P+
z5ss@BFIvdCR}X8I^&V1(Jd_T7`-suA+o)#aJ0-Klwm?=oJN=@U)_F(wF$N&_qS7rO
zXK{~CyFE3lSPcN;(Csq5W@i?klE*8ul3`9wL|hP6()b^=aDBE)43!FLJlBBRn0sMj
zT<skGsQDQ`c*9ZU{d~UTl7)+s6x<ATyT1+x#j;W+o}~D;srZa_zRO5vy@?NkoruX&
z#~ntxXYA#=(W}8hi`s>!s2V{v?@Z(2gW7-2UW|){bP)Vw9NvsWHNsw5vg10S-E?Dd
z(oOaL*qU{apY`{OX1y7UxQ<_4qgEbY8hz>Zy{>t{nA4!hywD@rikKq5a@?1az<1Jp
zKLEc7Tf0)lIy2-z(9F;UV6<WO*{SgCHbN^KIth3Gs@wb~Ryttcgrvf5X6N>NuqH!*
z)ptkhi=EqA%eB0pXsVZ|_*3e{q{k!CKG%AN0gVE^Mlgh0XF|V!V(E^5b<clrO0X!=
zlq-+6;85O?EFj2EiX5%Czb8Kw*y~#$JAOpb#x`8=Xs!vL#)w;~Y?6O#XEF44&ldWV
z-bT@5#YCdO>OBdUha%rfBho?;qiT!gyN{0(vRz!QvYg4~ffrCz#n|mhH!b`b?EPv}
z8>D7WV9_*L{jlwSHu=XprR$a3{u^XGp6Jf7YHz9r-Od67eTm&K;<u)>Xu4CA%Mgc4
zT%SG*8-F1I*)Q#B|DWI5z_*Nvkgd6pE8_@4&?b9no_wUJxG1h99xz3X)ejsIS|eeG
zT<h_Ar~&QBECu+mUS0Ul`JV&KmY#GLbg9wA5S!2S{tR*(G<q{QrIrx6CLN@^9QN&D
zndWiE+C;Y9WvQW}_O^zp-L+7|A8n(_Bj7Scj-<EWC0`c3>-vK&i4dp@>r^fGZ@W<%
zEFDoEQE?k6DwIHpl}d;9R3I)RFM-P+IBubxZY82$Yqus?#XeQ@Wo)sxzLCN|REs@!
zgi*SH_`YWku9wYrJixRSjUyUtidKNqjyOVrR+W5%s2$fZz_-b(fsOT2foDz{jCM7~
z7+NuDWFKz{5^tz54lO;nKyKGV*+xFOv|+pS#8sbb70s8P5yXKSdGe<HRQIU!Tt2N4
z;}o$ZNCXzT<5whpym;!@Y6P(f9eSEF<)~$QIB3XC_SZ!Axs$>XczBhJz29@L&s+iD
zBEyb|NQhGX<R>NkxC7df|0K_L;Z8DtSfP^%(>c<yCy><E<OdTxNTnllp9E$;l`gGU
zofI#V4&6eCP#%A|K;JV&-hLn(Y6-y+v3ws3CSD&g_e0riQ86~MZs_~SVc1QpRa_;Y
z3<mC?qH}6Zl*%RqvEv>s2VfkkRyB$)WIu#7V8Tn>>JadcW!IlQ)Y|y3C}@$E?A6AD
zvRQYoCk#wjM>Tpro1~l_x$y==3QlTg6EwcJ{_)eW)zV)KO9#x2t?PNigj0u6&4<<<
zOtL6fw%-(m$3`($O?5bwrsyuqZ+8fVT^dj;$-B*4^9_{0@`DHAliV_pNm%Gi7)ugF
z`18H9f(=oCKU67eL`(Ka(t(5hwQ{m6@F3)b&5b$r?A;x#2<7B?Lyu9%>dM^H3c6z~
z!u9{^GJ#>I@9?tS{G!)58F+h3Q{)&=b6Z~a-1+|nr2GsiZ!WfU2T4;NmxAxxyHZ7n
zmo|!M-cEyP=O-Gn&nQoh<em4@bqW(2XqP~)pheaE<Ngcf`i?&3c(bHq9;9VT9SZz;
zRJbyIto;)5tPPOyT3wj%0dm6bcRvpe3lbRB%#7sFojT4DDA6u}7$Lr8`nFi!qgw|S
zi9+vMx2==m<X2YvpG#784(hADu#T!6_j<3KHkLtFE)K;qpQk)uBEo5U$UBu}d3+Uv
zy{G;N?O70gM4rx920PwwcbFyY>VZcdVI0Ojw%JmiS^V6F)I9PDNr5Q`x%?;w@a#O!
z2gplw6sz1E;>EpDc|;mF#2OP`t7B44dt<$;Em<|_&zVcdO2J=aV+qMYm3om`T_C5W
zPt0v{g1vq`Nlw=|5k5XGVTbjvxkY70XLZ{(QBP5h^`I4Ea+D})@nOwdC!?B7wWf|l
zG)uGM#eW>SFg5n}N{h8W`Yw3%f!OI&t$J6pAoS?{rLux(%ZbJ_fj2`Yo-_R@O_14j
zz>$*N7N~AWxEHy-)>UXVL5|0kbRnbw_osPvY)3D|gYQBjQhn)CUx+)PS2?^9z5l1S
zt_KB_#FWN70D6~>dP2|AG%>-5i@=En{}^}wqp{>X`gs@oCJ6m7&(t`r>GIS#uSryC
zF~6(sC8B(Y3@a&4E)D>@HJEepEo3RUqD{GS_7JGFW0_(oGo8JLHVI~EOYm0OK26D&
z`^tT(7T6Zh_it^T9U*XsHvjq}%8{m)6(%1Q8(F@o$G2|Ww*zT>a7Q#*gi|zK*!YcP
z=K6x*x1HVbXVG1`WHFVQMuB|k&=2UW({vR~3Q7q|%kHUQ-#VJMAlv3^2;m~&Z2l+#
zR8!7ep|<n>TkUf_kaK;mV3za)LFAEf(J|jRfQ5k6h^lkliuJDQF{m3*14#d7!rrj&
zmopwuam%h4Ll7<$EuKz@ZdK4=@ZzpZ`=71efc<`y^ItbIO7ud602HNZGO$bj8TzT~
zxZy@h<)!fw$n@jjMPjOM9OTiVT(biiEgKQu6H|aRE=%2hX_O}y{~Z4fZ~G!vQs#8>
zX^5zQYlS;F6tN(B-s*JBKz}0#fv*2eS8L5FbZX#G;U>(P%OOjZ<sA6g<2FMpj01tc
z2ti@5i&a}e*06vh9*=yXW=SYXTex0EM2e{8N4zq}1xaFSypTu=PsBf3B^o%jmCE9j
zTX-n3<igEC*b%;Ay#ZIK%sllX>&b<7u7W7^SUf9t$+ph@s3H!EyaZ{KM45!FOgxOt
zs$daON*~82iYM5O2VKI;jUVeFM>NFlojp1S4H_y;$v}5%Sf3635oX0BsQBXohak_!
z$(nB({<E5;s)#IA>k}~slh)NaN(Ywm%y?1gZ21+KfL7RB0)5ITwPW7x18%WO`T{GL
z0m?GChh{VC$sNgo+`#VQ>qcoVr?nfv7oIMJJqNfn<#tbZW16=1qb_ngCk*@t#}ANb
zEibjjcv<JpY3okGc*4u#;Q;h0dRE5qloPe_Zz}P!Qq2S$&${$j_dZ`YSHDb*-DuNk
zKw$pq8t@;ne_ap{gipM|pi2zcln}4-;&_Nsub4LWeH{y1eK8^H39cJ;0;RsSS^j`i
zJjOB;yJcH30a^)L0vI*3ne_)hxa8;k5wTGY&*P_$I5IGLe3txE<tJ1(O}EHD`4LQ0
zb?ezS5w6L`8(8@U@^O^7=%WrkS|Mzn@`X|_t<k3b`mTPabUo#~+he!ccZpk6gA$H1
zGlDB*o^DKdb-hdyK@<=H$j;qxzM2Mfn(ll}fujf|w<WA3r)t0S?7yLU?Wdt}*@N)1
zJNEud_7o~R?#gE#^}B?LC|bf1AwW0yr8?+ZUfyfaxsS>iMck=bXJ`s5XrA4|1DA1R
zx7D5Hsbn8fd@N4B7OmJv3!OZivj<|cPV_trDs^NL7M{g?NTMsghZqUeI^-}-K_%-7
zw;7ROS?M0tS3={PsS6{?DS~CW@7LSFP4qx>minG`=WJjl5*|2X(IaROTOfw-aTTqT
z!rr+;J&*EQXH?#;%ss|XM%{Kl3TsP^YnA@`rJ<##$OFG6X?GkMb*$z-9YA){Z_lWi
zkB#R8VNG_K5HP{-8bIHE?d8R7*?XXu(-)5|3Tta-5|qQysy$;b|HE9N-;#v)TI48R
z*{EL*f*<Rst8`FXw5aHCz$FG>xEejVWgmUVp6lv3dL@kEh1bPjI~<*FN%NXJ-|{?}
zPI(7Ep?&DY{V0ol6Z06$q$4*C0+{uf3A55DW;j!{T$H2?dH>f!{awg}#%T`g8RBo-
zFXT#lxD<Yp{0URvGI<tY+ArB$dF*xooX+jR0<TQzvoyCGA?hM+%6;!(30wkV!jC7o
zahrZHiSJ|Q@JMc0|8=vQ|Lks%{oJUNHCAQ6_+?c2KB;Wab%`M}2?zVwRY_wHw=^I=
zPrnY+KN1Om^e?Yl@63K%>2u0rQ|jJ&XFK3p0-Rp5PA>mQ7=37x;qzBA9nPI;uu9B;
zj&Umf2%AkjCH#ZqCo$mnvQ&=ZZ;Ns0r$iE8>v;ZM-4k+t<;{Ant`&i+qV10|%;{4P
zsR$%`^4g4gNWaQBOw0Q<xdYV`D9KN|xZpm=Zt5Y$xy|ty6B2pt(tVup|M?o)05m6)
zo(A<Cy@MspDjc>QOl!biek}%ml<T;XX3SSZtEgl=#!M-!?_t6ZbwAC-g_TI#pq^i7
z2%QS8+dwER_)%z-=gOEKN<j5S4#95K)8i*~1!?0_T12Q~fY)S}Zu%${GA~w3A|E(y
zh*l*X`V_dWB^lD@cKFNsr8`{rZ1}={+&$bd>eKAh0^t)BR=yDKMCvrRu5PaMTF-V4
z3YT89h6W^+nwAEhB*+Ia7S*vZIg7NbU4bKPGDN(UB}7H80=N#i{X!_iQ-X@!ol11a
z$+_}T3NP~s>mpu+a%<R2z7AG#Ms18EvK=7%xOm5oF97|@<+bf)BbZ-aPJpI-pR4uE
zU!{$=H{pPkWr6YG$=8=_)H*NS1j1`RxU{860L;ci?)r^V@Go+5P+s7R)u6L|0~1++
z)jY$q#jFqdmU?tja<HS`V&nW5pX#fXOw}>*i=WpE%K-IGQg8Ci`q_4-k%^e4w@0)h
zC%2?w3}f4yUnSGmVk*q$yY-BydBsH~XGdqU<F_9nj*65fGZkR-a)*Lqjk2Y%?-BId
zPIHWnozK15A8kt;5I9zWwok|i#XJ{wj^>74=k~^Ob=awJ<Q30Xk`G8<MQ%=!>Q&kX
z`iYD_8??kfnDgsr_uwMcyN8Z=7Wz#jJX5UcP4W;xcSw4rIbNYZQT`CA9^S*M@S0U1
zK~T6+7a-UAfXo2<O*X-gD7wM9AZ*~(!fM$%b%+V|1vA=BZ8%j<gbC=!Mbt`tFL$NC
zJfX=UX3+=LbQTO4`Uxd|8^t^nt{yhpN}lPvO7+t$^F&PUM~Z}!dDQwWjb<9v^2vU*
z!`TQ5JyD$i)$JxMSFzg;Myd*IkYm;L>w!ujB`2&6gNf{IKUR2wa8xcoXyf!}Juug%
z_)G(NrF&I!yr&Y|s9WF`d;N3h`sh99|8H52Rx5-V|5w=2G*(6HNu^y`Tx5zM?FG0l
zyR8Kv;KfEuL)2hDuvx)H50O>$OS6VVxdg(?jTZI<t9p2N!X$X*%}g6e%NAGzT58zV
z?pqWw&s@vUSdG;h|AH&Z)LFkD%T?QvZ*zX}GmnkaJA6TPtVH#XrMEvWX7a~(@s^*y
z@w!NRqAb;4-tWmfz5l3mb-x>dj*7<AQuwxMAet0tm@Yj{HiS<vUdKNcbFon-yj)}$
zxj|FWAIoNKRl>jBztrcN>9$i-)Pa}~zU2zxX7TT;mm!70D-U|ek2wfQpj|oZc3{lX
zkabql+B7jvQJWtlcKl*^Sic?>F*$OX5GB8Y9$~y}K|}~71hKw#z}RgqrnbgLsMmf8
zBeiez3BYT*c!YBGya9jr2l;_Sq?%LZn&3*~;2o}-grW@qg3d2hdv<~si|X(Q@%zW(
zj>ac)KDc=q4!o__K?Yl?$^IsaYfP77DCQP(RSDft-WAB)8W(@N)(FC1rsD>SY$*SA
z&)!3CIb=a?NLUj$Xr%Fot;#)bw{gi^u`88z(OY_|K-U>4D*+62ujok_M>kVKZAv-9
z<&O6O`-QoG`vsl3`aw=r<C8TGrr=+9)esKmU<kDoWX!Xq-hahdm%f=J$dxxPkzV{C
z=7Go07VoF4;5F3>phG5W86%Se8;Yxtn~dQ35@(1sv-x6d`2iwal?3M$ix(TD*li!4
zqGl$@KWg52ZgBaq2;-p-migJUKamoG_^8%;S&=G6UZW>x<Nz<|+@Z-vdfFRxYFpq^
zX?CIAzP=A5%OML-ZwWD!bI-zBuuM|Xeb~OCvs@w+87+ug*0&=bgd*i5COsbpvyoCd
zYn{?SyGFnCEz18my6!+IA2)83a;QYy*`iaVjB^N?$>unFr|dhM>^K=`kBlNo?#|w;
z?6X(S$oS%pWEEwW`n~=B^q-gK-g}<UOn3^C+X*AR{sc%DmLpc`9)EhL4u{Lljv=zQ
zHdl*5EVMIwh!4<(R0fLd%1P$eT=>#m$R>Y{jYTExR)2;#gc>5~zXPDl)2Y@$Y{yV8
zf<%+UfqPYK-`0&S%BEn;!W#(3F8{Zayln`ZBD7Kk;KCHOeg{#r9YoX6vytgbMaHkl
zGI66yYpIA%s(=*uc-bij+6(hK3a}2qT0cE+b_P>}-{Yr@K*iwg8O=;Jwa94jWaTR|
z*?-9Bybj<$SMRHM^$FEeYVDL*QrkqE+?(DLwv6pIfONxu6Zz_P+N`+t0KCBOq}_z|
z6+Yy#lSC`fWL~fORXe$*Y#wHxmn9RLwT$0r)~@`6TW>b6s1421hCtJKw&&_Fbri;)
z{7`l1EMmK8u6PeP`j@hIT8=H!vf>m*TuZ50^@5)Ct8x5z&I^rT)4ZxPaF3!QB9F@I
zmHBZjy|!kM3bc7^KjQEy2`E2UIbq=-!+4X_E=NwoBwE=Tp@q~0F2+`p+(N;p&vfA7
zoZA)&7v||-po?sjHi(`Yjc1~FnMGQ9FkKdXr>Kj*ca)ap62Y(5wcR5tQ|_s}@?5rC
zb@l(JX6O5JOWo@aZo|0>_mtu`!eJgE2B86mp#Yo;Q#JHX+WwYex%Pch45hC5Q!%PD
zmSAPqNLT|Orj_aG`oEuMw>Y4E>2KZ7EZ#pjum0w?S<}+0DE?P;pyHcYVXrBU4Tnu5
z0qSN9?SOA2bHw<8;vtI=&$#05R@?wj0uL3IkuT``pI>#Q37rDX0`gdL3qE1HCdV{M
zh$Uq<1N@3wan>6lHN1MImWlea1TphrhVjF_r+IwlLtUpReoQ%d*9{#i>nz{;&ILPm
zjlYR0nED@Rb0T>T_ck0bA%z?+Xaw#lv`jf5wzr0NiP}Vai!4v3^w*D%prd|43un5X
zR?16(E}Zt{7st>u{LEca&3p-EB>me`Q-tymYbpBtd)frN^8SqpR7X5SZuwG;nmZvg
zpm|XhQ^{Mw8&M!(Q_A}$cVQhMHu?9VSk)1qX|@S%iACbBZfQj`tIG9{$6jLKDLI<%
zuHUbzh$J&~ya@t?7W1k0ql;TyG|w6)aW;KKjMfME2SBjn{kXI^u&nZZF;h?w8UhQU
zOyT;k&xbtnN&|M#Z&!mw5%61|*c&iQt%ppZ2=7$v{ffp*V)$CO5lDd`<c*)<78~V`
z>)!NJXCPE#wERE(h@FUt@Z;)e8M#JyZ+_crM!Z@%Z1xE5;b3M(`030shvKWDZKri?
z5gz6<Un^eOmmXlGQWqPT{pi5=b7A&0sQ9ucuv@37EuVZAN~zU5S7jz2FNPg2J%H^Q
zJ_SFv#^Z2>IFA5pPsA?|<p9R0o*uIMIEx)Z!u(i7<p|rXxYq;)8uzHXkt8##G=x(Y
z8cP`{tz&kNw9UBqqWz@{rtzxTKOfwQYsK8zqmT28h?}5XL5R}U5@IkHaI8shoOOQ^
zL%{oAbhtSNY*_9)#8c9RS<BTjC|}O%cQ&~Fc1nAoPXT82f#_^Z))Xi)U~#oxjRGPm
z_|zNkL{e0nvbu@)4Af3fS|1GDE8<KL4Kmm^nK1NMbLcr`h>i#;d$6G02S^E?7?Jek
zzH$>$3uJyW(+Z4D6;ujda1+$(gCzm~vAGJj<!1qu8x(sd(nClKOP|m=i~QLJRm(P*
zm+uQz3;d=JU^VSeqX90yz=ZZ2=7S0i27c<nh~vG7!c9lGCnGZDC4vw$)w_#3h!3CG
zQ7X^jzis>U(5hIG;q2R1X_|wxm3B=ILd*oe?BBm33W0JeM3MWK#k#O~glH3u`k8N5
zfLMS}iFLyPBi~F3M}^tvr-vt3IG7dboAy2#P(xHyUzth8_(WADTt}CLtfAygN)<R*
z5Ky0iV%&Kt4g}_+R39SeaP@waXLqoARM=eJK)Wm|42T-17!JRPH-4s=gqTFG_X&9d
zcb_{!=X?vU?DYw3YeDij3(}zmbizR78@XISK&#`9oECf}7jKM72mRy))yIlHp-6#p
z;o3KZOKG<w^Mqe#sH5A=3q47gA^3AYj|(xRJ*Cj2ReO;ZtXlTAVIpa=WY+rjy(k?8
zuj&KqR|Iu2j2a+Xn|rL$r`D-<k)7lvVyB|K(r)~IMNUb-OQY{fmiC%6kB%I_H}J0;
zw+VE35!0+{khRLdNhPUFgZk}Q4@Rdu<=g{Rnc01u=^>X}FWrl@RdD=(yZLnTsV=#~
zZ6H<FE=>=r#b+dcmMhXEnkEF(x_G;#a0y8&A7s+1m;ASML5^RJunR#Nr;1BzZ_nGs
zYHOwVRc(>+wKuiKLJ@R>1`3`#Toogv(5z(IJQ=wnp(VUFT+H9Y&wDR`XS<sBvIm{*
z8x(rSUu?J8Y_Ua0q1iw}RNP3RQ(>=THXaj26k_0wrln)EkH0@T{<{A7d5AZM%zKZ{
zN3qj<iJDYAf&Y!ti@xiR^|6P^+Tfy5cc_9?xQMo|aP=0D&aO*E>Qo(7ZVv&hrIhHR
z7BKX7uoB%Hzw><nT`%wR{Qh!T6)ONSfL_ElPTwfZGybLx<vZQFU-<8?`&*Dhr2ab6
zw1@MnjFvnOEX1F+XnH+WiKkG&GE=H)&stwl%G$KC!795|wV|XIpjmzsrd*^p#L8;=
zR?Y9AXQ%p2A9Hc%HX*3+hPc?et+wFGevue&e73?dTh|&&$yP~~YS6&TGR1@hyYBIx
zWp-#9ABeF+75lKsxpkt18=WfFeZF}KQ;i2ISBl8fz}CzfBGn?xzgDlBAu@<$vr?eY
z`W)G}k@oqT{V|hoeLeqBS_(pz4Uiq(`2Rv|krLK|s_51=aLs}Hai{L#ytsn4fH37F
z9L&7XBlX#HHO!8mvuouG%3KiIeb4bNeCt!~&VAkG#lp5*x?YUpw`<-gaKh#LK*B@G
z0Z;fY9AZPS!mlcFPxNeJpkFBb0Xb9NDwp~$A$mzVrMsqE-LdUabXu`Iw@fkJs2FkZ
z>?Sv(4EB-u^4oXNR-80-?s+o}_zkLBpoy1POG848F&`9m!ACI7Dd{;C3ycmPS5yN%
zAcNBoi<>27I9sJm)Xz;#C&X-a_SKCijmmDBGM&J#!SR|y>#eSq>&0}@smYE;==L9|
zXBBfOM`6oaC60q{%FYGV`Sjkqd!V2=3>+EO+<QcA{tMdTHT*axs|HIOPY1Z*C!!Kb
zq}Dlsqs476`!v#pLa~oZOMstd;M*~4w@21w&ncrSotq}@6T|tSP1PVD4!O;q4sngY
z1kbmE;7!xx>t*7pf9r<W7pT-n9W-E#-bxPx3Nm}b5XNcl0-c{+=PwuGz*i<K$ClY&
z(u^Dg<r9gt08l+usn&+@e>4WYGLWI@<yX=P;If66s|K~TTFt(max=?62k{Aid-V|0
zXkIRrbBv3kjR)(}eunYKP!!G6{E$y8;l3gd@6Y~-e3LGDY^qf`y0pe9ZnwQMm5~6s
zyi*N46jNrtVWpeaA|VyZxzo(3h5yADWT?i=YIJ0{9y2R`KEO(MDd_!G>7chX3q|?N
zfzXq3-IWQoEE`<qzSklX)~-MrR1Y@GbjqIrd$GTW=|oj7<6!)4euIu2@*7qfz)$Fw
zkVRYpdagz%szmP*`csXLT4XpOVJoe&-OT^#!vTO{-`5vWu?1d#(<S$pC+e3+Xwoyk
zZti`-y&u`l$OK(XZ<@4Oe+feR5=+mZI*^Sjorx|*{<k0!eC7_Rc%mkD9iuRzR%>3=
z<BxWMJQSTx%(BO%&_CW8=%wA<r}}30mTyRzw~MHiX|I^Tr%WiKt~82bc*ApTnQBQT
zQtb*@2j=rW`fg>-J|VdT%qfD|<&>XJNwgwaE>M`#dd_g|)?u;;ESvmvy7)o!7I|@<
z3)co-0Y`zucrfx4ic_O!B&SQ&zT6u={YG9uR7T*CVt+FYJkOZ+VNN#8++Vr84Ob;H
z$Ve#!1*E3>6?rPf!THn2*&?!T46fVDRE1^!-pRt3#5te$CokJ`SQ2f;Z9a183Hy9`
zyc0RdEGlm4=iN~ljfo+49500`e>3Y>;x&fv`;hNB2TznUWbj-&yExZubA`Oud#LHJ
zO*Utj<07YG)w)=yu}f`%=FejUiP@H4nb!9?ZlK=_$hm1f9&fbDl7YB=8$hyBV;yH#
z4du*OoO4U;{+hWHwn}~g&-gw3&^kanxS$~Bwer79<mS)3o!O36h9>HKcX@Oy=rcaV
zC$-%mMk=tgQ<X*Vlqqln%kH`tWCDMu`@#@YgAJA^2}E_)nG>cN@V?R{0Y?0&EPH%%
z=Th78PRv|!C}b`K?&wG~y8bdNG0Ty7=r++|kz&@Z;B{pgg@IR?N_;f`v>wMx$JWCZ
z!FpNh(mmdyG-eO-tH@*pZ8_5wm9|y?<@eYRX~U9%CLG*a5~eG2?&O-g3fLu7HWpde
zN=3Y@hrX3P!=6DLpV&pIf)c<cj^l$jiP~l0n$4?yLKDPLlMU_Nt;d9|H&&4p@Szn#
z70}WukZkjW%?oMQ5u+hh%*l#+w6f~(sSdZ56;&*_=c>G}u=&{Pn6<b7s=Ne+qlL=5
z4$ht-8AWNv$6G)TFs;6<_YA^ICFnKNvh?pi<a^;n+%+A(8N3)a-Vw>#X3efbB^boI
z`E*E1EjF29&JbaJm~7>xr0TE;Ldf<xOu>Y)YBx}(&8o>xv!Ey7@8on8;V|0zGfrFH
z2bXv6OVXm>dm|7Szh#7Ff4E+Kh{_=1BQn|fye9yK>HGdJ85Pcf^DE{599M;c<7jJv
z01AKbBVfVwRG|!P>u3dRfE>UR39QtRfGXpNtiy`&fPWg;Zf*ZLGmJZgM|`Gu*;<_@
zaE~V7`HTR8e7OW-Zu|7G1(&%nm|#_xC;stv45oKDD^x5*>@OP=&|A7j{fyIqo%|v6
zTN`F5uB*S$XBBq~6sFdu*_+^g9ki2d$NLHg1{);B+{Wa~X?`7W<MX|n<}?{ie{o|p
zUyk^RTt^7#^+u2vkw5@}9m47{_<RRR`X!tU)CE}%$a7nv^M{!2f#->q{F}!b!BK@M
z_kfHo^2)Q!X^|r<q&GG|m;0$P$^6?ePrn0my>#KzOzQ_|_(P)N>ui$B%0XRlRl<wT
z(fo`a9W9#MbEt_nUrD9QyMX9YEWkQ+X@9#*!RyU<LaFctfMi@$J7HU0yRVpjG4wdv
zRcw;VZBcJJQVhhicY&D96Ybq;9D5rpl)X0LW$grR3k;^3cuW*uoR~^0fK+i2)BA4H
zA{VF$E>!ZvQlDj=D+1NqK#Z);&lUsZkyVugleAAkY@lgM<7UFGqL|DQ6F4F(9|1fY
zS~8B>g!Y21*ND<!2XhA|i5Ao?C?7-VvEJfRdOVVgaw6t`bW1oiC%vIO0cKB)HcA?4
z;a#~7f0kFUw|LH(9&qPska}^C;Ceu9>#Jnp+F#EldKbK!BKcQ)_G6gdaHapJ1mZT<
zK}5x6u(<GWbIvaQr#I2pCFgvW@|?EQAqSV3#^d^jHOZ;15C`qAk^0@-AXQd3Z3ZOy
z|88mUI=sGYo;5{wQdGMCrkkZ6U$>Qd)+~=6wa5ap(*zf$)&Si@W6upa^RT|xJ^#lp
z4jwH7$l$w|Kt_tl)Z}m|>#q=(Jt_p8q0Gjj!MtT!0M%JPE#(B)di4y~12W4Ej@IF=
z!LsOP<j)Aa>|DA8*hchIvT_L%?Lb||{dD)>I+}g9jjni%af%9SSm44r?$6$h;p$)0
zHgCC`GCZFQ$9FUM&^}WOgw-#zHAm_A2jQSAhUO&O+r++2SOz&4avW|gK49|!K!mT2
z$yp&h#|E2-Jb56KZ}BMunhsgsfK;Qzta_O~vqWAl#qTcAe~kpJ*(TpCa6*3Q?O{Y|
ziA4JGNL{T&dRgsZV^{f!k25_lhaa0f@<BSDb@G9rF|obnN5wCn!KqT)a4sd`m;N3p
z<)V{=4&zGi3ACd4JY!o`#vwv3OZ)!gW<QJ4N8g)!^v%bVuL}LdKWo0|V){Uu?jD_t
z>Aayh$Ed00J@hA*VsEg*H5x`AvT^0#eba`Bzu|efB2=W$iYa}v&@L8VF@z^I2*_On
zg1_GBF!)S8zaTrjDu^+MG_urS7o*M@DgC%*+knk1#8OEuF0l}I@F$4!@FI|SvwZV7
zU8<?^J4LX?KlNvPC_?f=dfA%VNArf*kI-0ne^N~;z?MA)PrL=``Hxr?MX7iSyg*st
zD3`bAB3;mQ3c5SMu@UYBNr12oz1+2b|2tQh7NX$QdOaN@Lg(EE$-ygJQt4Fr$xUCq
z;<BY5*}ogOxXKA7$$GU|jGFqGtm^ykHe6c;+*vx$`)#<Domnt&`46+vWF{&c-mQnh
z73_t#9DD5l3DzzUctnsMl4>dbdItx>Sdxl!D9m2=Q-gs(zT4(k2W(}Re5*7XI{{<%
z0UoUUu(l3ol8cAuYh!)00s*r6XRXG;au|#J9qqBpms7FDdsXTDEy9CetMbIg7J&#9
z{e1RckxA(a+jn9Rrj_|KHG@S$mb3GPiKZ(8e7lCrD3RzWbG{!n^V?NlCUrzuIYvgk
zHO>U8eK4=yNS_oV(U{3gmswO<%mI+8teTqBtI#{BO@IT$ieg$de9_a3dV~$d3Q-f8
z^C>WQ_B5xxg4O}4LJdp^?r!k!`cKldu)ACsJ?gxgp-`<5cV@O9WEcV!-Yy;|e|P=6
z6QT_L9tsTN(Wy6mHl6xAp%7Mg9n2y=<hZuhKL*r=RgG~wg3g$q-Uz-uEtT~Lm${Xj
za_dxZOmTiJ<N4q$VLygLFv=OCqj1#M2Q7!J0Pl2v7YzmB>r5SLo#fW-(K5U%K0i5h
z5o)+{BEZ%y+4P@-vabTw#*EduI{oxS)c#Jl#`kYP?&X`#G$vvn=O>fWmVKr0^0icx
zErea@p8S_e+rG_aPxNLu!5DjQGF2h;T^zB@ox$gFT8TsGVm}cxSAo-)_rWLJ>{OSx
zoVugs`i}ULwqB`>h8I|wwv;}}ZGXXyZHy!z;HF;=4=paEDj&E?6gz1{;F>9w4}p}=
zjE;|P?<&&OMC`=g#;}+jB8i_5WoHG%qpX^Q^eg9TX5(lif1X)$`RzV-u?%KoMOGw*
zERGCwd?%X~Ul9#vzD1P;Tn;`lUb(kGHr75dR^&^`?gpeTTG{>@Ia*@lkH&(gd3}U4
z7(asOn@a0L;nTl2H(+(EBAswtXwhOp&dxLh=$@I#(4<{d&l<Urj_Y*aYq^S7PzyJ>
zYs&O*Kc7n3_^r?K05IF!M(^k!L*G${3S7#~!cxnBk{Z#`)_fdFdVb+Xdg8Ry5|a4R
z_47!Es@C(tPhD>34F7H0-$=bC{sRe7eBvogf#htDGF!Gd5*zvzgBn{WTZk7zDzB<g
zhAWzu(eCY5Qwpj$)F-`mqovMt_86AKRY56U8ph9>y4+g-F-4M}Nn<@4=sQ{blbtkf
z!@Yjhq(fdOyB%JyMo1}oeSjvXq)?vkOcaYgO0jAS`IaX%TSVK0lYk2@#AYFEm8N=4
zTmcL-aHvC?E-#PO9i@^$S+W*3cnL}eRaqJIVbrGjKfRwUv$!}&Cpqf*L_ofWHcFQc
zx;=3BG|zcVCXvGreT+OEOi-xP0xP5=!*7q7QF!GRgJ@eA4a}+7R{2FQ8?Q)Sy`%r0
zJN$><n9NUY|8tar3FO{ls+U^e8m<$i?GPiRPlqj}0be7}y~%-k5=m4=R2WWtiA7lP
zEckPUj!>lN4+OmrKiw0K78Ptbuq-GIP2vMB`M&Kn2-&#r?{E0w+@OI#2$F(}U4{sC
zMMQ5}59h1anWUEBwQ_?wJmEA|FnGZ*2HR|&Y?P*mV^w-|KM{IbKnFop!$V11h%ZRt
z>NJ1D-PGm7Fw-H{1l1f-alGo)l)Wr1#4XVvu<{shz=ops{doQa-bl8-%P|+9aBIqd
zWeR}Z;29am<ioU@Is)Us#xNR|V}IJ^;-vd)ES$h0I2ttJZGTs|bpn_Me7L@^jZWg@
zYr+`?;A_Qz>|AwhJ>494W{LUuG?G-<goFF^*5J%65dfA~=r*p8I0Uz_rU&lpY8_7u
z7`=2Kv+ly4wdfSIsA<DBpWovo#7sz$5C`*s{HBZf540BR!n=+12f3hc+x*vj{k9n{
z<Ml@qeX}Wz+G84~bum?sOog>4>j{jxjP0!#?hmN^jHefFd69FIe7)Pm>pM>t(kJCp
z%tblUq&SOQr(Ev!FGqZCxLdLxoQOxe**srpR$Bet*{J+hzVmD8qU)`AwbZ=)@c9Bc
z4MJ!F_u@5y&US$XVm6gY$YK*!g&l+@c+?W1{qMulol;y`AoQ(3=HP8Q<JV2SnJ8a`
zyE4OIM@;VnNY6vKab|%rG4tuCZhMgdhjq+Mew*`r?YcllC??B=W?aF0L3Sax6gXfp
z+5EP>Q1Q4SNpD7871niLX5LQL7F!pl7Nb;}CtZO(EHWdo%J-;|xwt8oSvf459NW3C
zWTh9ZD^WZLDuXC5ODKcVVi7D!P6Cl7VF8O#Jz|)6uu<AJ0>isr&Bib4{EK3h#hK!#
zcfM7Ol9ro2(JXr)5719npXt34Oi{51c2L!W%2Qj?Fp;`T{#jZ<K1DEnVIbqSe?kA0
z_2CA3{RO>Qo``Y=iy1UyxXbOU@eoB;&(>Rzy~YX8OK7K=tb^FPl!h=ipqY8Q6sOA{
zk<{iHJ<MmXKz@Sh!%-!x^sji|`xL*S=e)5<$1~A4X#{YisTe4gR`1`&7uRPU!P~QO
z{Q_A+;?`ih`qc16dEYTgZiWU`$EHvBbCgV)lQS23;qzUxwjM^88u<Q1VYO2LW~R#$
z(MSd0-_v1wUlnLDPFjZxnvW76L6!#Lgy^@NzY#_c)(TrZJ=HvTC$?q~!pBeNAGX9g
zYmO+E9`q3Y4Oj~ZgB=~nNc>#mgwaqq+FRgpBdT6xxU8__=AWf_nbk1Gso9!c@v3rV
z+lT!Nk}YGmOo_oo(Sj0Fan&rh`qp$yn~f$}M8G3|=8x<S*1Z1Xy$KrrTa4=6Lghfw
zCm}o5j39RTJG4ywt8vx~)ViGxYLVX&eHBn<e29o0LT)&PhaBJ7qiNu^Zw}n4<!9|-
zKy<`}vSVHCJ3qg=BOI?LJmi<Y)+PT-41nBHM-2jiKE}l6+^t+i8BS!e?5qVQ6<e2W
zDa>|=x$~v6$C1&B@MOFpYd-AP`^?byzthz)$$?CMV*8z>p+&P<F{;hogdt$Eeq*oP
zEqH3}{@y_g`smz7q89eeblGU#ioC+}-gH*qf3{z#A62OX&IVV#Am1HCy_3Ofjjv`7
z@=_;#MbTp6>umn*W=N7%G9pvH_4vJ<nSVKvN{?IeAn2c@`-KPXf3Y1<^NrSzIEi$;
z6z4JSk1(YCluZXis!%{Dv1YYH{6-4pW@lXL<d1jewkNLP)fF1k0;&g?Z-{gGi7%rj
z1w?r(v+cq~L;z#z3h%6S#tN++R*eBw&+nZ2H2&AMp?;$Tp0s5cnsO((`MTUs!v>-W
z`9^XHPvF1Z>&s_eOe6R%QNTn$9G9R6IwWg0oSiVNd>13KW#U=W-}U^lplp5`GmkYv
z$Ti}vW{c&_YWV7^|B=ppeEGt)+RFt<tw)@UphViEBtwiV+|qqJlF9#)fL{`LkVagE
z_<X-5R=vn+Mi(*oY0Lyn$d(ZGBaFT5WHFB1<Q3-_I(N=`g82?g4ix+L-lBp(M0-qa
zUx<33L0BMDH7E<6U5sP!Fx7e}TgikX#}}557?d`nRKA)1%Je>2g#FTNv`<olgP!(_
z`1tr+-^9=mt*605dnX<#RJeg+Zbl7|!~nJ%R3u4lW}4a|RE)0AU*9w`mmfjW+aYiR
z{u5&Vk}u2F60g0WgS_*t?qD9X#`8;sW_c?f>g7|$;0(0#f)DSznTkQ~AYbTIGKjlE
zQsHa%eQ7H4$gj4<t-QIKhyLg>B_J|q-@3@sZ?t5aV+R*hua$yNiH@Lq{@!NjBv!Sb
zG$f4`+%BtO(Oxspy^y1^m6Ll*UyVf1*<0!++W!~nGw=o~j==P@?=~}oFAAV1faQeU
z6`W1UUD3dlbObmfN6oX`w9ZHmB9%<O4GelAj4GF%WAy3o0xu}jh=9oWe(S3HNfz_%
zpt*Z})FoaW5jd-3VL+uJZp|8z<?a8x3mQ9k{X%`IsMQ5)mYK903YT}kU+(RoK)zet
z^fT>Mt07lQvHEV=I(#plB9iXdQma=MyXs7?asQDHV(1AsPxrKb{JvO5h!jEUvou`a
z)|-)egMs49KjUs<r{&%xkqbzNmCzeRHOQ<6=$LG&TFEki)$`TYk&onA#UFG7I+a?R
zrAmaLYhRp4j;4QmJ@_9V@@J~ZFBhNsb@O*yL5n@4QGA#={ZILa1QSTlsC|~%D}rp`
zf$4DixLcAx6Z#f<#=(-fwRLRf0CAs{3nHi}=-$+7RlE4G*;Id7z!jemV$HosK1kv<
z920nbF=-R?^Sd0ov`=wuFQ0=NP|arJp&^9x=K620;n7<Z64#xG=fJqnR-pQebD$a^
z0dOLx1SQi%X`oA(NQrYh+`%VUAr^{Mv)6s>vScAg4s9W_ly?D#W7jsmXD_zO+OoZE
zKhR(L0ugTTRN)DV{-^`P2xuMqY%uR`CI)w&^_zHF%zQ(b*_WC?;6JW5wA?$l*T9gX
zts@4yK-c(ng7?l~7KN@C*ChgX=)b8*e}BNrNTUG4Y!)x7&1+G`7c)gta6#seCwzYG
zy6DSZl96Cof<;nc#^j1UoM%DPJRv0^rew`N2g=`07=brXe-8I}o~g(f`@%L=VMZNf
zlPa@PjlfdV4#MW(G|44_VGph)^`syGZ}q4U{T)CVs~FsFz0feE<E!y?^VYjR*@_Qe
z?IAMZN&b|}>2r+I5geDJ%$n~zbPLnbjN11hwQgT-euCo8E!E$1)CwYu-TPc)Q`A%K
z^qND!_?E$lkOQN>dCrB?&bD-BCg;?XRSuXQBI30aON*h=<+5h>r>KoS3mKZlJK_?o
zh<t(MM;_qI7#rL(_|dIw@EL<WJ-BQ<Pd-r<TYd@sM0M{3#Zn>EGgZO7b<&w|`DmLH
zYt6%F{<5cx=-we@L-;yzOdQnRt$PRP@f9@e&X$VyD&4TLWtF!BDsUfAtAjJt9UVBC
zI;`q^o<cOe8K4}SE+z<Fj#|#g&#e}2-^dv5CaBZoxNo;sV|^d&RCkCzR;X7A6ovZf
z-D;Xtv8|A}uio*y8eAzML;8(=)?&?y1PMJmxTk*UqXDFtx6&Y5=#I&Sg;aX%`A?H5
zZ{*RpXZUg&pQ5sa%b1tA>?%XgXBVzfT_JZe*lWPv_&KLvM|W6ubhFeTlDU>UVQybh
zCE$*&WW>(E?#vX)r^II7p(_y(yhtklwTTi8Hu+NUb@TIO?%<RF5#a}L7)ju*lgh6B
zdhE84!zfFI)8)~Ywb8=+bz|_2R$cu~q}dgPF_+q&63Dwu;;2rskOPsr5A>>n3fPmV
zQywKpSW7V8Qf2!U_wA~=MBR_fKRgBQ&Gb2sfoNJUxt3yPEELh-l+e8@06I3U=>KD9
ziYOgopM}{I3)8F-&4_)|b(R((E?)0MVN5nYe*jQo84S$8(eePEU*R=iBn-f+;#DRU
zQFQGk@<@z0<nSfvwBz0VX?AF^HY8?Y#BRMDG@71rT>;zBa-{=RcqK|!Qi1qxQ0PkY
zvzP0GhmIOMb44!>^stbHIhWG*o+Pthy-zgqB{p7LOA&W<_Q}R<FNTA<qd|g(sO#S>
zwRA7YO{^sAypvngagngj>I*J=AYN&SLacsoP4nNLA?S6kt~Z0g-7v$H(2xpW;ReLh
zfM=J^n}t4IvRCMzG`Okt-^_g@BuSiBOM<X<pl}hNF!3+<XSF8gIk1kSHwU2^*tsmk
z&gQ4^a;KG|C^756&1wd5yufwk<q+SBZZ~)XmRWwxK2K4?j9b*M@xetl^8?2|b@^fK
z2YaxHU#B;@wKFO&r<`+Y4yZZuI?gDm|AgtTTZ53z4qtCxjEH@Gbz~)2=Ou$>`GBm%
z&uZA1shDg%I~Fn_CoRo;9ebGBZ|?L*QiqfSBU7#B3VjY5MU-Yb2{smtq%0Vk%Q(j$
zBUo^9ki7oMg?o`4X*-W6CetbV8`hP3PqD^<Kyv#!38t0dpDHb9w8i%Q$wPu#cutMY
zJU99dNs3=<P>Ph6CZtNFtFk6qVvbV_iZ>Qper(+4-!AHNdl^g9<J90)m`{N2%+(^E
zVt#<U7@*(gT+PL~{8?#~d|L1RQKgc)x~k>E)tU5Y2aty25^sMKH3y=7T78bWm*yVY
zfJG1#9w<tCAzlWYARQhs)z5j|=Oq1;2O~D%M@?|hv$q8}N0r88f5d0=tc&<F^>kW+
zPCp#89pcNgiY?O_U}ddRjM(Q<l@KUzFqdN8d`l}TP7SgqM1r>#uNRerfF1#ol*dW+
zvnn{tF|J->7>SW5wEyvW<*6hv-vzzwK3-~E=|;SfF@)H&Z+9YA7Pb`!<yvAR`Cl@A
zr)?5v`ohg69JeW@Ganmfl81WOeW~U@-g+Sbl)JME{qOysHj;j6D-4XVs$T+ZjncST
zN3t<?_z_1y0l^Fsuz1}=ewv@?`~-}o_EVOipk@#a^A!nUh=v(<$-&)Mp<0%AhNDan
zuEXfu{>gGNFo2i7`p6~^hFyZU&KUwAz0Ug**Od2FI>uTb|GZ+<WyF8qc*RiOQ;%hs
zDHe*_s)qYk_6>3dzaUMm4`=5S-5M%JDy_U3Y%&x^9=q_`;MNtbo(}b>v&L_5gfxE}
z(vAn0Q1bjY(@zEyWq9}8VC3*aAr1$%uMD!VMxOtwEv@a=I!kr%C?PqouKm+;vqEmb
zcu+<3H1~btu3yeS`=#KP;__!parjTGtSo$!v?icxKC^H%CYt{mv;?N<{PlOR?1_1J
z1+I*m^m4e>|A+ZueJOT;_NeE+Jsin$9q#eIDfP+eDwi^HGGD=;d4W~xGS@jKo=zeu
zk#xWzd)M70>MaC*TL1Ks_Id(DAz&|cr%_XJ#J$1pbtI<QKe#P=S4U;lF%<LDJ%rQ7
zFU={gD-OC=`J(J+9H(iN*OO@4<{Ii}J$J#XFhV(Q3^oS)B#nKEF3*$o)M*P}lycJi
z5^eoW{_0rQIx3AAgMNEqzF>Xx@dsS1z-$iHaPhxV2lpV<KqUr#`RnFmMm+CQNzB_o
zZ~XlotNbmlxw$-r0*ixOrh+0y{9uM(?qZ_$<MGE=1{YgyWLSw!v}r$c$<{dy3AFHB
ze#TpWuzOVzx?E!-=j!kYu~Fj<uy)RT{VI`{I8WPP5oK)TFE@GL12Au67aHn$eZC>4
zxh8DEY+KeZs>coIHrnjp?U3YDN%@<J9x1p!h@!_n^g|?@B=>kBdN54}=;?RFA8hs|
zRa?RcOd55)>i@kE=C+Ezl8Xm5&^d4*ohn$xig9PY?!4AR85OR{YbdXk&smwmB|l|~
zeg}WHS#GP24#`B0zLrz218A$9w4k?(+<q315&Iwp#Wz{b=5VW)of_pXOi_1N#)pe6
zQag$+-EmQIeB}YVne{Mxr_iasuf0o#UHz@qrZ-n%3yKI=3or0`GfNrn>!&hCpP(A}
zFO&!kmv|(>j88GhKAmW?8(&VANXZwGGsT9`Rof~UPXLPJp?jSxDRmG2DBO7EK^X*_
zZB;RQd;Nv`y`L7idm0~!m8y9(cBEDesgc~Kt-DoYNwry|#AzceZjwgI^AD(fvmAw#
z*KK8nJWzTcym>$<=S92SrD{p#lkgK<Gf1(5=~Lf5va2@uu(M!=NiN)Y=cr5yp6+|O
z@;<h|qAcOLkOblm!s5@jpB6rd`7M|nm8c<4Sw%wlBAfhYFwE@}IqWv=6NN~nA~XOi
z>R}F*%6!aT&H*~&SN~Sjzgivd^as)NnO!{?7al^(wXOJ4(2;pV+%&t6)^w_K42LPe
zNoU-dm0I#Uu&4&~!cN$2%8Z8KO3j<_+S*c!Yw35)Ks$4ddcXDh6$32PeNqkuxx=aM
zOWzAhXY8Eg8?!Q(y_!&cNIYc8ks}l{U%(!+!7{z4dm=nwrY58}u^_N3H<`+dj-0El
zu!meg8?SU$xNY7M1-Do(U1|xNuUP){6Xi?U;=9-y($va>wn$&N5b<tB^bv4mn)BK%
z;@t`W?qzRecWYo$$TR&IYshE}X{Z1p2G<>Brf$%5!TV7aPH6oM(Ljk9$d6Gcj(W9N
zbS##HA6IG$sAJxNjZdRLTBZf>EYr@b#j;vgrE*@SL3jN*`bP61OwnN1cObI1Cc_N+
zRxZiAQ{Ux`A#0x>3^TnQ*j=3D^kMyPJ=v$x49nkNEP^pgu~H@Gw(<qS<mBUWE8GnE
zF~j5}^jiTHdTcX-eqH6S%W~@B`2X{g6~p$LJzz+YnN<bIl5u8xKm5#C_#10l!Ls!Q
zI`o%^7YUk$vY(5cq9rqkU2ZeCT78`y&HAt!iQ|^-lv{1cRp*9~hG9r2h(j?|oO8_~
z0XQ_(QdW3FkGP`QR3tiQ&lX(cYrMS|%eX%K&{jgqO*t67q&L_6*6w!KpiATa>aN)*
z(B9MMn4O~TtR{z4oC)7TGm*JW>{3c$_orD}reS9yEAg#3ZgOM|uFE{D1WYgS&u^CT
z!Ds#Mgi#`Gz&jbarV2Sh#&<5i`W~zlIgfHs?rdr^;`bM~4L7Sj4_?lN9LyYgjQ8~o
z)sT0x#6Jx}z04Lb(S5UT1g{=E=k*XXI+<uL%3$MH7Zk2uJo8U5QWoWz(QU9vG0j_6
z+4KI?4*)EPZliNnl0sH6>dGpzAOROt4lhI??s0)%?{sXr5h2^;8hdb0iJ!U;?LaYU
ztD@o%qGGjf*gvU+Cx1nf7AO3XoBwJ9%p;_ZvSTP>0;s7;`nNFzwRKWnS3<A~u=Bts
z0$;_|v*;NU2hJ=RA!Zpg@OPM*Rf1DE-O$Z|Tdbu8FVWj}ave@Ud6%E1>H*vLYOnOd
zm(Qk|26!LP{kR_beUx9wp<lug$l;0SSunjShj{j>f1*#Ot84XR^_q@bL731_Qwx(U
zdSV!S#u1!Hu4d^(Qn<YG!EOWo%6nAe@T8y3=6Ef?_O4X-eq3GyG$If1!UeAnCMp}Z
z>MR%RA#CEow`ECbPcaqguHKb>@FM?9QZZRXIQNw(i=A9qwG2pIOn|gs8o%+L8z!sD
zx2#|R7>-uIrs;{8yi<M4O6bp2NoWLJoR~J%&7WFvTw~I|HT#6Jo~|+Q<nQRZa3H=|
zK159OxW&^pJA{&RQPI~q*PCT2(k<5@eECr&Q79N%g}hnzT+IWh5f=WxASMPF11ig=
z5F-Fe1O`LNePq}4b(YN3WXlcz6I0BJCNrJpD!d*fZcTi!Qq7dnQ=rhF{pwA8Z=SEx
zRW2DbF<ZIM#Sc!=wuIEZ3C(nw?WDkFOD`T?KPz@66|MlTODEKi9C|-;iqJ;K{ZT@_
zg1-i|FKLR+Zru&9*ay7{tJXVi?sCsdhHfDeuQdsQO<|7(`ildsdsyTV$r{6}PriXy
zvrT4Tn?#pw?K{{-g*9J&-u3SRht}x}<<9?hu=Wh)UurIuO3&xmx#cxq`Bc4W!)YOX
zLuUyscaRsp6!icZgvC7=5%0ZCdx)93BMP18TawU=#7to|_Qq{KJd+PlKx#k8=lBWw
zTBkGOG#spG{jd{^#Z#p+vjlKoG~%vJRHj1iFsH8;QO_CD?lt~!4(@3!@7CjJg~g&~
z%7uDrdYOoCVlQ6fUWI*<K-Bpr3H9#pU-46zDIvpY2IlvRZGCfV$rb0^>0m{~K9aO#
zF8^$z{016`kqb-s|B&p<xRjS<Ea4r?)nJT|d`SscmKV81X0N52O<?~}Lt+@L1bvW%
z;dH+OS=l^a(H8ytVR_q>n})m(P6b^cX*a!BAOhJ6LE41qH;i$Ljr2iWkz5zjTJeQr
z8UeiucAiZOQCtg6Ut@Kg)@0cq`8)N*?R3W$50yl?^8Cm2DC^j?MV7a@%h*4jd}YTN
z!9$s_LR`h;;rH!TXs|P;@Hg)IN{dMPsmX3D#1|EiuNi=PQvd&=+L!5*yT~FpD`D0W
z`*zZvgy&`2;jC!+z=q6$I|>=P9H6pq$Q6RODIwKEQRo{(*KZ!{%GVzt#LcTL3%3X~
zin3mdo8KK)1Qykl%<0$$_!Pc#+(Cu2UHWvd=&6|Vgr<n@<HQ#{JQi-+!D{~dzW*2|
zVy$66=htGla2D8O)ZY{ZeQAV)FIWU43^qz}Z^Efg`HEGiVTiw8y%o$kgFT2O4D337
zfd1||=GQVg69(dC4u&3$*F~O%HRCVI!@s!9OOuR*AQSL2RS~`w8DV>fT9}ZJ^D+}y
zVayK=CN$4UDWyX^#${@Rbj{ucPCQ=sG}BQu-B*!(;m(^cB%He<gklpApnCB`Pd8=w
zsyd6g%orZULh5Zfb}j!X^F{1GWP{r})Ik#pc>dee3!BmJ*G~Rhl<qIy{|H>M%~Ggn
zcF-Mc9#Eb{4#y1*I3x*OYOzgQxZLT`1cl?_77mCPDgOkLAIYT$IDLsUMnAuR(h@7&
z{Y#&X@<qHG3^9irpU18^L0E*M<{j7J!5@(2eM8kTK-(N!Mpl4Dtkx`ptKPoKeYT5+
z#vU36s#F5eY!7^51(Q5{s|`EvyjiU--fFw<lk7>*!ms8HoLA_)KymhSetCrGW_btO
z>@ReLV6KQ_`Cg}%^uyv#Gc(w*s>$cgVO#ei_2oS>d+tWsv<LP|BI5oX5w^ji5qtAh
z-n6p+sNjcyIPenP(aw^>5<aN<@>G|)y%mgrEXWs%x)Gq8w@GR-ixh*O?%W%@v*Xjy
zV_-J_*yV;z9PMnbUd~92t9U0d`?jXC&qtbQrVG?b9<d2sd<9y)k+C|Y@3&ug<O+YV
zO))j>^Zdcu3cH2Cc~5g->A(-yw3nI-$lue|@Wck&!{RtFk`kY%riZRSdRPW^1uL~%
zcf>Y9A5$r)fdd~&gwivUfy|bJKkHho$|7hjPz=a@)Zbm=h&uGBzY8bHVphQq0dI3<
z)?+uVS^uSbCuSJDO6tNs{p1SU<qrUUZI;$VJ!n%t#}<L|q~Xk3j5kwpPB&W9MwBms
z3hf7%?5Mc@Ff;S}-G;uY)%;ye4VNC7{azsVwn_k{cG_QC`kZBfTQ158R0cCl&S%#0
zAYKSqtg*$v+G*}FT^q;%pYt3$iEnO_7Orch@GiM4M6QJu!S#a`QP^lM;7`8%@rdh7
zXUcrAxmC8vF4N59MBc)Jn|4rj0yDl5hGc2luofh8<qUouD;!a5`RwbON5oZTN?P~&
z5ijekPd@IGP?xo&4<fJ*KD#nAtS9$h^aP_9(khj=H}KETZ?ulud>j&{4sWAxfbM0L
zui?!qEw3MF_7uByMK2~k>J~^UiB7)$X|DXfODzYM0>;b(#Vc`hnHkGC<6#H99(wvF
zutV9jS!`>U2sF(nkS+%Nd*}UK^IZtnr)|{+c~^4#@|eA%gB#{A43}a*l*`Gz1zr6T
zr~B&NtGS4H?G@px{ElLV)lNsZ@|l1BvCbvTxvZBT{C9yjMBVY`TF4d<zbOVSeg-<O
z<b5Mcs|S|ck!_g#X2P?hzW#9Ex9)=6d^r=(ql&AuwGlr$-VI40KFc{efdk5;d1f&M
zx8!Z5u&al3MegA9Us_a#28hPN$+|9c(q%ym0<tlcc9-EFR&mZ_XHq8Yw>dk;0Pz|H
z)G0+m+8EbCtBjtZBHDVVC%g7pINzE%hv0*9iGb9A0<SrvK#Q8;ggMpkuu#NwI=>*(
zCQ^J%l%6%DvLH%@#)yp_Y$Q2zLxjup-cMQjks>f?#Bh$y(@Bq<HH31ynXk!pe$k}>
zg9ERva1p01R|ifQl1rjlevp~LtVfRid)TIsuiBqe)*}gtV0LPPsC-^9u68o}AI#Mr
zvEP?uU{a)&imhiw@-gkKE-!jiZvk1|!>m0HG6ip)GUdM9HP~}xe2$I+LD#QcytG{7
z(<PWO6vaEFP?YV8=jdpC5dw(Cx)`O@W&G^vE?iipi5O<!lo712nK`?3^F^KW^NzSz
zzf4v-Cz@UVZWvylZB3ic{*%vpnb>=j<a9NzV9N!_Nn+5n$eKs(T4p^%+@+n<manhG
z`4-?5RcsCaon61=KEC4)+3eE!qx-qEk#(*?+{zcP+;>E`>l1@`J#AmgAie=-5SlUK
zxd2?~u>9P^LEuB@QPh4TlQG~HWiUY&4|ps3CWk7_e5}5%>P$N6X{H=*LsT<$Jg6Rc
zQ0zSK&@X<Eexn)L&s_pUue<<c7kjNIjuR|QV40`S%n1GZuVs^&fs|uI6igNkOvD?!
zo7fw23_~B2{YQ_11`|Y;Z3yCO|Kw;6(TYa?!G=$8!C}t&|7q}ZcgfheikP<-j&U11
zRc=z{C00tLv=HAgn;8p6DB<&iE$zKUsY83MZcqnuv>MbKP+ua&t=&*yCO(*56}_SQ
z-KTAjyTgWEC8$#{f#BWA9CL}~^y|lm6Rs@78oxC;nrmpPYYGCOKTK}FEr#YK7og&p
z$#mGK(&Tg>UBVTRE)jdDTk4i3aS(Qf0W$utVDtE9>&S;+QB8=KK;ZrVi?+N&f=wH3
zBjQ6j6nuqrDgj8rKL+stdkGR_z0HODRr}7LvbBi1dt{0MDO*S_u<M+*2N&eYbo6k~
zz5LF$QS+cuGa3@oh@N+1Q8KT$iA8bVqO%-mJ^X#4`_W-ju?bx+wM;<>%&<pepF^C9
zC!ox7=S*{r$9F7#;zZXjxnkMb4t1IG{*T@D9(n8zu67qWhQ;8SWiS<CCh0<gkxE;n
zt#_z7d=oxLuMC*oZ-0l~YYpwoLLv~!zDR;l(*|?UPX|JYH<&;t&(N>UU*v?`@o%0p
z!VA`@w*(U&kB%|eJObD`WWCt>P>w|M4I4LJd^|6O_r2KQi7K`8Z2_7gxf6PRCl+rL
z_r;LVO2>YAytxdxJk#se>|c)ir=riCs1I3|%b%UHHaqa>XZDNgy}2G}y^M0C@<9%v
z>TA%?P4p$u^(j;V$206>RJHzZAAR;kf9NuZd7$|J58F1rf^N!@eoD21c4l$QpmK?)
zl{K^{PrRPCqvf2(6#W{ob9dQe>aeIve_fp;>s=Mo?~#k_gDO^+>OG30fOgYCcluGM
z(jG>HuWeOQ43)-{wRIvLr(>Ja?6}DnD(N?N&+~!^-olGM%2^dY1;LtP<hl{#zN;7{
z?uOL4d52Uc?58QmbK1fEt{C^uE-L#&gfz%1WjCw807{9}Ax$AzSPN~))l>#o{44AA
z?SR)=*0H4G6%F4D59<(o0eb~*zHN;~ow(3ZTaJrSb4(P8)5t#!)|gp75S}<_z$4VK
z%@Lw|rw|N@7tA!scW77BHQTJ6^20b_Dgwp!4O<jr0ZVmcN*2qG+65+kq^kPQYo&a%
zk*~z8kwaChDh=sCffKDu^ICUud-DW~xQSd;%=4K1nwv7bHK>h#cCwGc-kn@rT!;lC
zk7_5Uj{K8+^oDOXn>e4sQvz1U=BD0`75eu@_jktEK<_FtR;H=XLMujQwxb1{vzsqV
zBQ@JqDvH6r%@E(^%8)R-3J`C{H}La=#XM^37q2zC@(yQ{mdqkqh4|j`IrA$z7OI(1
zXYv!Nh7JE-ZSc9NkEyIN{;V-(R$DVt%kyaT`NdY%FeiyamJXA`G!VkAJa3Cf{|Ysj
z+-@2s-HOtZ&IZGMp5upPK<Y%_uiC6RFeb1K{2ooN7h?CfDZR@7$KqVW)yq=Epcq7*
za&3sB34asU`y0{WnWOj?#7$r*pPrndf@A|rk5hERmm3)*zrBE<)7EW>@0ZZZXOn_n
zW3M=R)yB=H5}si2S>f%*S34E79C|bTG_L-7LBg|0o_yy+9qE|MPDeg!bhu%ik{J5E
z>V^-0x0G*OO7cRfTerF`U@&@uAZZg>T2Y>~6J-T{0gIl94(<h<>ADY4bBEoC+ucXM
z1yp?pf8^}$TZ!xph#S~ggwH8S(j6U0w-Dh4{u2)C;!$e9?GgDq05HH2ud47)ZCBgI
zELA~8aU&n;HP_|Wa&zOacj%WcUe^X^n~tT5>2!j}AiBGs&M8{2Aas@X@y6f3W#eJ`
zu{LG-3c}?2YemkhzuT=4ZEoi7)(wlFms>BNBP+swd*ieZJ~l3y3zH*4sDEr%X~?42
z$8Aswi$BAXOb%5S!=L_sq`Y#qyEs^AvV2IB)REuTD978f#pyylVTsV1!5@_44xRLC
ziN$zw-C%3xA9E_Im16-$b#gsn%>2*_VgnCQ>Kgit_%$3;I%*E-zk50?`P{%j|A)>>
zEJNCKANCET(eTyv_{W){(OyXw!JnX?%_>|Et0u5BO$k%v*+!SW&<)!t!cIz7{O|F<
zm7kW_vy$FRx7JPSuw3s7J9To+8R{=5EDm_|*!n0YsvN%KvGsX&;^6UD$vVIPFrO@`
zande=oiimpO1?kVhx)i)&-WD3R-^FYhp~L)7m+V_zTj>ofT&J<Ph{<(TF!hDiZX!;
zjqsxo%GuNm9JI78hR{k@HmxhUo%x@)i`I`pzA!cjUX*Ws67=70(9vn#JBTFThw%;<
zj?nf0A|w~09D;vBx@xy3=_s>y_~^F@K}rY8N0X0J<ADsS97O4UqPOSI*pIK<wbpw~
zHxh=IUvFt%GCh3OlcHQxu^*mDP7?+%=XA2S$$MQRYDmHelx74GRf5PmZEiq_C`9JT
zXGC0_V5K_gI60kQsv4@m#^1O8_+z@#|56)8%fF)M!K_m67F=>fb~m1`cT&vmB?NUa
zc*E}#bX+^#yL9iQYDVHL@MN7g@ubebQdfl#x(+&vz@$?`KUPk^F~6?o9lrl3lY>W3
zx^`|rU{P`L>JL-97N56W`xaKK-=C@3@%-(K!PTw|B=syvmL7M*5h1h_Xwu=%$<#IZ
z0EE0_ikc4g<yG+6F)#^%X?Xj*FfJEjcfg>hfKS6rji{}bq(XvTI9Q9O)WP3>p`P52
z$NoCz4I<)X2xla0&eUq)<BFYBCYzUa#zZn>euJAQ5Xu{_^B?((T{t!?#jX{4>35*y
z!|(=g>GB%WwAX)M<NH%8x&L}8n|(75`x|Cp#2P`4UEo>b`X){uZ}s~50+-^6QEU7Q
z_-pfgkZS{3y*P{y!JBFenN^Q7>wxM(UOtvj5nljPQAI>PG>G2_v*^%SuJ3Wu4)O4+
zq&uqtwMpd53s-E3J;tOUmvR>--;y0(*PIo7K|bVu*vo%E5!_pq7u0^I?)SF$hvXqL
zBYTQju;1b41rbk*+u`Ql`Ky$i_i9rY*&9w;{NIJw+$Ddhmzid3vd8hA)qIrTk&Jj?
zcdWR$W707C(Y5w$R`T!Q!GCf3BpWMm)6>O;n*L&P^Gkeq>RwP4%!6Mp2K1!?A@dI5
z;7`^0n*YPebYbUmRi4Yop(eOrx7**MPzd9>=E{3WkE7POjpP-x)eKC4;#U`~g^SN{
zPG)wp`<rc19S0|k-q{gfqT)A#gUCac=E?#8EpD?e{Q92r5h>&7ZRHLPH7Vqam~t%f
zCx&F;o+k}_wmVzfwe{e{8r<>_27?s(R(qO{KXVh4D^b?AntjFl%}tttih9@)BB=#u
zp-&l8B)AQ4)KF9Xxx;QP9K3zbey?e#2QgVQBw&Q^*}!Kr*64-5mu(r{X#BePsO?Uu
z!YDQ$?nIIslEG50yskxm9Z<hKEPQ$v3+MfhgQ%zo^rwWM4Kh|S+aiAkKJyq#Nc!s<
zy>F6H^r6AwX7h*UNmD1TcUw-)vhlzA>c(HU$aodvWR2Iua5L}EI{nDu7jaNE1RDL@
zqv3S~(9vOw0`pS#=fYCt7w7eS7Xzp?WSw(psa7P@*fqmel&#S$)=dfq>zXS*UkCSw
zv#}%>i2&yWl1-w@vlR$lE5^jj!py+@Hhz3bT&}MDI&TZvAv_p|NhE%(^(S3S-HU9#
zIAwdPIAfsf!ay?kqkR60cvSe4l(yk<5{3NH+t#u_3VpTJLNr-dL0Fvsu(tkhbs!h2
zv^HIddeWCxv!x+t3&rS>w~!<+EP05dlWBnCf9!qrUsS;t=-LVbqJlI^OZOrv5=-|k
z4boCeE*&aL2<%ErDh*4QG^oVFA|SEkE=YH`)Vuoqe%~MQK5u{7d*{x~IdgL2%uHkm
z0|n>|ieINv+pXum9_qf|IPWj|l9kt23FD?mFJOtwmCN^7cz%NAaG4mW9A&*J5OPoE
zsG*ItPdb?V^i7G&fhpYglTX*rgcL^DJK-lM6^`Ag9XLlPdhodR5lu^_MOMs0CwO{(
zaC&b^Ae8o^vns8<raT6f@_iublHt88-g{;_8m&ZE@pdlP)hC~`AIZo-KW2ct2<oIm
zKil+xju!$!L^24_Ynk_K&b2`}wPI2k@;V*?mS&5Z+S)|9!P;&YUkqBGzR2|5*m~Vz
z;4Z_PW#R?r&eagixf4X*@IYwc^I{tA5gUWH&oC>>rDOm0!S*KfRTt{=>xJ%?+&NXs
zp!B8#xs77o41?`*M<^j2;XQYv-`_g?nsW~f!zr53Y*{cf8mZyhJjJm5n+P5;*iA@1
zeJTV)#zQ~qjq#Q$;mpGM`{aH_yL(%G;G+V8F1UjhF-PJ*nftTk$gY3QMS9hFCdd!w
zW`ABYfYP(m$j?52*#bMEkO0bCioV|1#>p9h@Z3$;wrsK$Q4F(fNz3?fEzy;e(bfQX
zZEbmq_?iDVTnB4giteS&w6=?uFKX483*6wa{}c~{e}YRA6OMCAE)MkY>@BB993E~S
zRJCiNMsx&PmvqiGC_Q9eiQ9d>QKBX3(B~_<+E`>Sbe>Y<7U)bwm|LU~T2&z4pvpTQ
zCLx}>_Pu@;F=hraUpGjgcjGAM^U}*cll??b*wET2&wvW`NZr|q?5}ZLm|Rehd?6Ds
zot?_K80=#*tGNE4MCKqQiDu+Wr7WjJ^G=p$Van4Mo#=k&;5qvuu=M6l%meC<=os|6
z9zn!009QcsRczgJ-Hin)|2<~2ZVOp!#W|?}UL+S6+~fLa+{W}6^o`Ma_shW;x5f@t
z328kaZOqzK<^8I*P!G)^_STOQZ}i>1NQM?SZTiGRu!POy9QoJ)*tHVBJgCr5^Wsj+
z);ptf#@eWapnXp-)mLN}I9yJvMsb%?@3s<J?fb?RW>YbkDVk3WJUc&~e|{T-2@Gkw
zi%hEAG1zoH-Zfv;GcCIlMnQ+cxOoKR{;Kbs@qqfvmHRn?61iS)kfr_Aoxpa3QpM8#
zgN9-=HsCDhdOqwxs0S)*RV=y#DQ$%?cJX>QK2U8%p=c>pgrNypRxe62{}!AWxlpoh
z(2ddZ4X`Q<Cmivg9B-a(Io?{k<<VGD5I#E_wybvk@)F}6W3`+TQ~3nf`76(Fbx*J5
z`_8;Fa#p%h+hp>>c%`%F?HpVGWl8bQr_PckvHg#6=AfS+tk`u(G1X{sq%pGVD(KAj
zjHy2FqndL`n>Z}nt8TQSICBl|)vofT*WdsN#2H)mGucNDdVkPnXrwpu4xrM7!Mv&^
zixS`0smPr*MPT#|{hM5SBujmTPr9N}!}sFIxfK624Ik}<dgs9sdTJdU19U%-fWa-t
zOk`22<rd~twX%42RAXBVyA@-x;asyW!tlMECUTmFhqM<uO&n<zlgzxQ4X%4e3JR8p
zf!rr4y4WtPs{eYwuCZ}zCG6G=!p9RXAkoKk$=~K-Jnn`eAiMfEG<@eDtK6T>Z_(dG
zgpsZSyGk8US}5q6N@B123mv7Fwac2jF&WIe&5hJWzbCg^?%@93$JRWig$p-C_j|0B
z;UI!xj-7QlTFL^mv>n>2&W+Hx^~>}F7*4tM*(TQQC4sY0Y?yYd1TAVH;^YqO$L8F>
z2D)Hy=oL_I#csuJDGfZKeZydhu-0b51b#lNMj52n_9FLs>NGdO5<fP6iN$`ZtSoVV
zD(UnKJ-N{TLfmg<=ghYNLb@JAxVz!fx^q9r|FLLWs*lH-@mwm^XRJ;ebgq6q!u!S^
zZ^HQO=b$q;d0L}vZ2v`q1YMCL^Z`<0R9`%5&6nARrq-7(=t_AFx@o>^uEN5-x<0h-
zikPZh6W-<u=y=Vi$Dv3CBN@-kUW{j-9wn|S@~4NinL$$Mm!4TB$iXt+yb7~r^dYi*
zXQ*)BQmChw$E9eY*(D({EO{}+$Kb#spz+PtymOImOZVomgJH93Co!K0>@u8nb4HKS
zaru#$9+*kJx!BbQue7DtanNcox7=38UVowg!>!S2`RdEhorF?K$S@r*ExGYQ!{yg2
z-y~kEEg7|PGD<lhlv=T6h^}`ySv7-`^yga!>FK8P9~0{7N98ao?4Cj&S*qLG=YW-d
zLC1v(7%V_(gM1_`dgG8r{(X*jwGMZ&T1DURD4$uA5*TmOb|~7iZQ14po)Avx4mJJ#
zN|rf8`(QbfdQRJQKN;=VO5=~1Bt}N2bw<CPTYkke@4AvY*GtD|1wChhxB*?s>@$mN
zpflE4j)QpOHyih~T6gt4JVxJoBoWwTB)8L_e=f)35ynKqD|Lg$Z+Nh1M6tZ&&#i5i
z_ELKCA1$%S{QicOm>HHl2Gi$%O27Cr!h)&HG^@csI**MUqD)3#k)RDG${*tS&`t(5
zJB3NKj3-yaK2s;*TK%a-?~fcOFkTwFEmB~*S9U7W==2E&yf!r6wGqCb==OkvF%q%l
zn_@q%fP$}SyS8VI<v=lbLnm;V)#N0!aTT%85)1dLPK4%^CiNmC;oc_ib%S)TdTy2V
z-8gKps-Zbn@`E`WbT`7ZefJHD>^3YiR>_6*2bw=Hz_?zVL7N6-4u6E@o4vD@zt~8c
zb(Y+_evmJ!#;RM#OAB|cYukAVC@TGrfdng&ca#k=ZFT2YzkHq(D}S49Oc!{~)nNWp
zuWIQZek3ty`{<q!c<80)SUAokR>=#i_);-uzJk3-+|1pbX{H{A7;}J-RXPm1VX&m$
z*i^5varXKt3!5;&VMzIjMT|1628{j2={JWQG@+G(w@&spt(%sec^}<v(+9XK;#MXq
zFD!lDZnE=A&+u3HO6N60>el*tH#@wy*x8iN-MI$$c{N<jO6Z+14XCd)d`r*fXQs_Z
z^_G<rqs!1M-x|ZB@UI#<HLiQj0IqhDxTm+bk{ONc9jJFa>gJI?QW;d*tbSSq9Vb^^
zkh)XxITcq046%wA&DEc|<FOb->)n&^L)>1$izZ56>DkyFn=&EpvqNH;;o&70nZ5Ti
zLnMWwS$H24Y&1N|aU}c(+T6cBv%$@e#@os~k<K>S+dF`I^Z4R1-Q-g`A<bvQ8VUXL
zl`lv^Wmlu6*DLCEH4JRrH#hHD)cnyoejK9oLTXp*CGD>geOs&iv(CKYKjE7pACY9U
zdM6Ig%AFIBl#6gkNS;yPhz_~`N`*M{GA_)IvGj2fle{^JOYn-QkE2HSdI=S6$%N0J
zLdZ-CT+;A-uAzdcz;8aLF2k9F8tTpDl!JE_v^yJCM8g^dS}wg`8PgRFRWw6w41uv0
zKkqYj96f{w^gDsS+t|?iIFsE`e?{=5)T?-SLu^0yc^neBodo7P>9fbeHTje=yZBG;
zZkRy!ntBoLn)qE5FJrSKMG*tn&T@+{)spt>YRZu$bKnBhRBiLX<bas;La2OVc&JlE
zSk(YDyIXOZ(tF%z9(?K0Y~g*mImWVy!{wGme;#d$iF>6-AL=AO8_wW9k>G}J5NE(v
z<YM21g1$|wL`|tZOLe>kV`A87Do*p8h|K*4Ls)xl4rn2cec<u*PwBP2$1Go#NHCnF
zB}^`?_!j46FBx^DygV#z^0mpAYPdFd8QD}=%-itoUHVSF#Eh9^HFsO)L^!pH2be+T
z@F^a`^*OJ$kU`iO&qMlD3_gAMK*Pove-{}mHi($}R)wBjJw`sFtH%h0LhF04fVNf2
zg>mJ2xmF2gVN*#2!a$Z)viH@J)w%>Y#;wobU>*U+8UtbE;@QQLs2oVFBnL4=^Zqg-
ztT61>s^|(;G+Ej65n-0;ZSRJ*&7e@o2gy@z%5#`@=%SNPy~Tq%b<vFKCnk(-&YPj;
z)JIzQ#)dz&I??x#dqU4<heO>&3RDK&nrFwNeeec!NxB+CMwS%R^#E2>Exgf`^|ifA
z9_pskD<oV;-A6}K;`(gGq`Aul8omHi<Fn<Lr#8Z{R;}4Mda~@@W35%v0i@ZDcRLk%
zj1|W*OuGt!&Q)Lgo4P(;=;_gDnu=I{<TTyEBxW->qr+@=wiemEJIl&kjGHX3(}i}-
z4AluBCu7lx6KFIAL?7wviN=yYcPG8_J3(k+KU$)wDy@9Cgj8k}xSS;cxzo9>?Nux(
z4d#tEH#yAcO}PG~(+eUXDLCLjA-RUc#IZA``uVI3?3GB@bjGegXu||W_z}yOKDs>z
zS-~nJ)TJ~}sO`fc{0X0CQCU;v?|1x<biquM<z-QjiLQ=`fw4TARX6UWAdoAc6f*rD
zk{@G5H@f7OAK?!8ashXC*F@DfzNJ>@-<;_D9k3N9V2Oqu$EV>-Qhw)y`Nd`qVJypv
z7Y&SQH8)TY6gF)$j@`^pUNYijQMAI5mT@!a)4P3@tTnk7dY8bF1t#G(Xq!W{X7RAA
z>RE&yEy^inHPaN{;Bu&Ftw*poWUigFT(?oB-JwU06gots=LTk$D=VTr==@7*eI>jy
z^Q~-(9k}E^UICd=$2HFTR<s!}c}%Z`4<Eo0U2n!EA1ptGEnwH}x#Rr_ZvMLC<W?}Z
zk~3LzZj?bR%%{B^I=SB!!{s3j>%inIJfG;f7_np4<k=pfY-_u-Rk>5adm6YeA6Lkr
z+NH!NwuzaYZf-2ftXS4HrLa3|>d;f>-;8)fM;TqTBqmA<?YR2e4?6=}4Lj?;3TnD<
z{kbUuqM_gI1lLDC>EOI}k4!RB{z&}n6$FQjBo@H>-?QBGE-)-LEvncp=lPBox-{6I
z8!~w2O)kK?1K!V`d8_Kb8iyLyWA@V<$sMFR*o?HRcU#gJrp<<@QH0GIypy{M;hrf6
zZeaQBHn9;o=jRy^Sd4`|;}8S=X0+sS58MrfQqq^KZX0U~rcd@ujYp5e;~8t05nKA{
zd0y3YTtYo%r|&iq=3C|dRnAIBEv!a{+{$XJUafd|Qmvb*F~$Cu`=9ZMb64t}{n-2q
zf$7`khOB_}gq{wD=I2l59nV2>RS)<_FNS}2ksv22MY9Z<bzJ4~;ZB$I@og1umoB+<
zMd=s#*-tL<B&Su^K|ToiG_>?<TijYXx=pdzZ_iqUeN_Q+(CzVD-?sP%M}He&h49@6
zq{P*`KiY=dASIr?a%`oN**V6H<KO?Zr)qALY!AsqyPW03Q#%_n+ZF`aWgiv@TeYu8
z`<sfw)@Zfe=2_r)7f$23{FXM0?mE8Uw%zbJeL8<_H)}oI1Op_3t}p@$9RJqjXWh>E
zu1zEE=={yW+`PZzgur@Sqb~2G&rB$5ip*5ma6}m%zY9;2F`!^jmzv0ce8xr7?^y=E
zdl&wOLG%y%56oa9=X*t7rvfL*)my33+ZO0sWV?Stqh_WAX6kfiI4Uhhe5Pl@=YnGj
zd7C+_#16f7L0?#qcP*gfc{-_dpx;nS_SbpB-9@Slw<Nr*#q<eC8#4}>{rLl9aT^<D
zSc7iRQ$yHS7=zul(@@Bo(MrxHv%QJJ&JK&MSM$|w0&1$m;r>p<QT18La5737`=U)H
z+GL_Uu(hSmLLzu7muO-8fTRdq>eACZ=HUWO_iLKjQFasiL3LzdB7$+I0%xHe7Q^4q
z<(ZB7EjgYwUI%RvyZy?1g_-AiW5e!h7f-6(Z^|X%-o=?H(Z^eChXCBY+tE|rzC{OL
zJ_-Du569}vBm+vOTAjE|TJq_D>Box^OdciULL`2}LoR!ihVhUmb}EZAPOl_*L_rQ8
z4K1HhC)V+{G9gCpd34h}Ll8I|=Wd17Ol`-v5$Fk*JuqAoZ#2a0f^y*|=&WjZ%%nox
zU9>itezK6ha(rf{zLL_XhfJFOa}L36(+<nW>p$a`5Wyl~mr%hH8~!N)lTBuglZ!$D
z+clWA&6EP>9Ut#paa7HP2T(N^!W^otV+;->Wzo=YN>fg&GkWK<pV?@qG|chX=sjVv
z)kE_&J(33UbWTm^76rxuf$w+wsXE)0NOy(BkREjLv<W}9J8BBf>+V73(ei)>!aP#F
zsx{79q74qNx7+xWl9Gq3OKPMNEN0e5s<3LYYitZf6WJmquvrVur8-c;t?Q;T#k)Q%
zy91*KgV*k`KHYMNiMh1%)^a}{sclDSO4`hAnliT4gaog+%-4+J7N<{qkH8v|xoCFu
zBnO;|PRcFk;1c%Z$s^1GG7bVg(11F^6t0dtp3wrFqi>K%^uF47#Zj9jFg;*Xn<d7g
z#;<dumOnPvoWtDt219#P0)fM2(9JLFK|>2PC^_{_3!Ru}iJl}wXL0G4-+rjh2qUUj
z227Tt8gfF|v@p=eQpnLq|B8|hNDa}O%30+KHWmBv5aovEO3oKQdOP=X%QapRmuXDb
zBYBbkhPee}(TqNk+;odKI4BU6B>r7<E_L<wQG{Qy95CO+U!=^^qQO8?gbVhv`ii4(
zUU$ttgPCtGLm}MW*8QBeo^9LwJ4zc$2jMsNZlM{amhqoY7Xv?iD2Qr5W#iw_Wf-Mt
z>)nP1b0)QyjMe2YgaStrH<N=edHJw424saqGh*1cR{R)s@L`HDMho|q9+}=d5}*Bf
z{-caSJm9#f*@9PoRItttI3f)=$_m#y*lN*jw#CI32v2LCq6b_OeSNF2lU(-l+Ps9&
zSbWzPxWAKsPHEcPN`<|#6N3asShyr9m%Ip5xu$OpdM3x(y5fmCns)r8@er|7G-=f=
zfRC(+NAuFUw--ju+J4vOMV?;yR==j0Lbnn*RDSjK=(mTE1t;cTkw~ik-q3`O(ye-E
zMk;;7BMu>$xD8JK8iA`devO{t)xz4F#iY}MQuVdPc4(QD(>PwS?1chDSmGxQVUfaV
z1D5PSZ?aL(IWyFEbxl0Pb<4VDz<DR}4sftTgTUr^D280rJwCgxLZn5{F@UehP3oC+
zzXzS}I6cb8#Pb@+>;W5%v9Y)<s|{pBzeJqVi?uNlQ%Pdj9hE?0NKZ2Hr0C6~g#e86
zisAbOZ57nAaW}=pVbd1TEUD7a$B!S$uxn;n$LvAB^ZY&YCmtq@(i}Ny0yj;1H^vgG
zsZHF#Da~#YfjhVzHa;<p(0KF{=bWC-%7u}9*J5j52~tqv7tW*4O}aM04jU8`S3qUg
z>K`u8NmOWNNW7^~V=#ksSBRGzzxf+IlF&F);n$F1N0=dBuVC<j{DFD94DxU7T8PN{
zV`bEegGF|`RAb5T-394|pBhQzg`Ga4;b*2x4>xn~>Lv39G3@E_(qi&x5ILNyB&L@=
z9&}c-UBX4I7}!mut0E=HjNQz`$vzaiUsP?8uu@+?SrL!KVK>8X6Yv}1EbV(rRh*#^
z>y<yDzthL~w!qi7l*KF^x<axT&pU2;+5DO!-jb01-e6Yv=*UB+>8M~HJ8j@BPg6P{
zRXksA{EXeVrF%8HOV@i`%pmby8x?xO-YXVD$Lm*wO@&tBLHi4Cpx2|aW>0F~GSkAU
zl#7sT^pP7i)Lf6qz*w@x3d&_0NLBc$J0x#81M?P>8_z)4Q97uLn9Yua++Fu;hx#lL
zu0BPC*FDO+Kat?xdyfyVfBr(`Pm4KQloAcR)FsV4Ehz#Whd<+L41PklaBLnoT@3b`
z4Uc0%#$S6qB%cltKRwD2u?4+VtS4E$UjF+)G=1%KK14Gk$=0TCHRpP{xjcdVJ!WGz
zX}X?y!Xll^T-f{k71`x2rpHrQzu$rb4;4DHerle0j}EywBRR`HU^t*(3wd*=>NxiF
zrqH`p!6WEh3A$T>VRA%Bf|TiH(HrJDu}#?7k>6z}2qf&8%k4<IVaVfNlig{sF@Do?
zjQ*Av|8_Z9)?vr<9@(huH~BLOsR1U63vLt{m~_XTp2*kjrM_KZd(YqH<cA(lZcJ`2
z!KVWaN9sl~b%SHC9BFwHIeVi&eQ$R5wscP8)RS9{o*RyCV-R(J)f1fIQXmHvp{?C8
zU!55<?9)A=syVO7d;;3`i+E5a*UGs;3dVX@ufF0bI#=t*-D|H{=Sadj-fUEY5T|bp
zuo(Kk^9=W!Z#a=^Rdw{+W~@)5)-$sgE0Ja0t6i(o%cMyR<MI!lahXqcBhlT;t~*`(
zUe_3yhfUk@1Air*>*VIO0XiLK_@(ezIT~0dL-T6a6RtaETg`t0%{Ru(6YmhRACigm
zXqt%kISgU{!1VP+(QB%2ZA|nXP#0sPL^&=Q-cKr$j<!y9GKo3~deN!0ru&X)ixi7`
zJ%<nZ%>(Lg633&Bdh9wb$E0ETv|oFI8#>6@(<G^D`}M}3A)#dsG>Ml^-gE>&?$o*C
z)@V))y!ShhNtaG`<1_SJ)RjhuiBJJ7>&KiWLui{Ee)k?~-AG}>qJK|YN=J^RdVb2Z
zkYm=gcC3mgLARDLtVAg2Q>4$uIxx=_YIIO;#nn}u+F{At>ilDMaa`a=@RT2vMo%P_
zq^d4=><jb;s4T(f_Cn^k*jUWzd>*}ySGXpFEhaDBU1ll<J5W8x;_fMwG_NxW6EEi4
zfvHP|?lMbx)^cy!YgfibH9n<UeC@yPobv%+*w=}3o_+`>)cv$a3mt&Zyy8&0&1XmD
zToCa&aUGmdK-<KzOEnr#w-qe-Ae|HBlihX2bi*K56>j`yuWmdh@{K<{-kUJS*F!&5
zA=t{i>7Dkcd%UaK!MyK?ALZo-vqhBYN#dVvfo}+HuCl3oq~%eB&oT!#YSDQY3YiEr
z$u1Pp=FvDx1mmW{mGBIcHgR=O;bPUAtp<ztsUx&gg}d~md=gBtf|unWkQrZGOPZwA
zXv=SBA(+>vz6bZRSI4Naq{+V!wR7Jhfq~-#k)G3o`~m*jwgq+RGwmP*{ht`C#`Bpi
zoqL8)*2-MwJpy#+CbA3m@ruJVEp-(wd)^K9Y1sY_hQtK7HQhoHcnMk$*^y^~A9wY@
zUqsy_0r|*%s?^P8J5j@vJ|Ls*Go5eFClp8=9?ilb^*X@SAg5-&X<M!sW-PLbjc($r
z5tKo&#Ib~nx)C@Ey2fKmnlMJ$(9B=5%;}MT**cK2x>4v@A;KNUX{6V(GrCIBFTAdf
zj>;c=gKpdJNRra6qnUGv?x763iS%3u&)s>&$wUv@zA4y|@SL$cW&I^aMTU~{O<hn8
z^PESRWNe6;cl-g;-Q$p3Bhk13`iQLiD>gj#?kI`-F?zY{Ta6t-F~ZH6Qf2MELaCCx
zPL0FdkGDDvv~fdvFqf_cHZoDk`^NZ9@CrTY9ld@YWWBT7afe$vrq_QC1af&eKpG*D
zYtzY@B;nNQz#(CD_{S{t@kH~tYtx%zVm}GrvgxYPF)$t+R`WSd0hPxXgYrT6FPkY0
z!&SO#P$Oo>&Y3ql4-$Gh5?J#lv&<PBK1`Ool^5Qkp&Z{XX`K_-uwf0WDIBDlCUA8g
zYc#i$*NTM}qV2O(Z-87l9K5P)(W+*0_b|Q4x|89Aw*L67q8aTYiHW3DjDQn@rUn9*
z>=S-e!R>Fo6GPF3LsXZ4c%<XWD&2GOsP?;+DYL@dF4OzA{x;G(%w}->2RHN+RYLJj
zESyS$&h6CYVA@0xy;wB^ce)OZk+=$S;U=FhvBmss8(rE<R$E#PhpriJtTcbKc;Ov4
zlZk*lWQb9Bw+-Z)KB&7r$&B$T<IZj_2;X>PV(R~P7DrQ?-MOp{n64S8VOewmxS`dp
z*sU%`D2o)5abENQ>KIbja$dXQ<V2YGefu$}>5aiv<+Mc8II=rt{W~Un5^CZBir~&-
zQf_&DjRee>1p6>Tu!AatonVpiDNNMerUpX(F~JWns!YYgL`1BgG#NsYkrfj=a3K}x
zo=t3&Hs$IuH@0=|`_T^`#fORFlxeFlCP8);x`$bPAbxF}t1j|{8nhicM|*v+I^`tu
zTe4DE0)4FFtl3G6BV@~<+YeaTEitZfOrU*hry$-}>_U-$JsYHanLYfNP*Znbx!%;i
zff;Qvz1E@SDD0noZtZ>*99D>|!iz;2S0KzyNTZjo<p1ozS>T1mgf#=X*4?bHfu;=h
zi6==cSgNw<fi3~FFH4XY)3q`G8SQhVT!}=$F#1;9ehbd9Jx+dMCc0>yy#wppx0R?f
zuM=;XR?EW`B<<%v(^eY+hu6V9H~96N2o*#)F^+{!GYZl|upW4^Ml*pI68bxv4z%6*
zU_7i@m1&K>gRLwKIF4#22v~1`isN@)Vck3(#bzuf7fL)3G#S2(BY`KoKiI7M<-~Y-
z!E=ip8yu=xe25sYP@0+Z=_+kuKWaV2LbyV~Oy)2x8!ehvWRjm$EE;Sj_iXi?O<f#s
zSw{q#GEt!_T1Uv^1Q1-{t)E}*UdkJmoRJD)y`_4v`B9{zX+fN!VcfnxoU<Rb?t8A8
zIDY)~t_RJooqWu0V~l;rL8E84<d~rNa~gXa4g?=?C%CwH8V3~Gb*>fe+>dPhr3fXR
z^Gk9ll1G9-O*iiT5QrmQuz5Z@ad=?z@|m8Q_qCp8ck`X_wyOJ)R70?Q=WG4o-qaJf
z86tOvs>biRNh}Q3SyH@Q#`rrj{TJ~(f6@)hxRcIv6c+N1d8P?s;RbS_+Ya6`qrl_%
zO4BI9NDOB$xY&)^BBlzMO>_}w?V9wyGq`(uyj-X%QbEn|1oo0{bF5|oDbVNeOt=L3
zLejF;L=mwN<U4qDBlqqO_DR#n`0zd6hf9X0X{Q;T^-hjszc<FUoIb(v;-spQsP;Th
z?m*H}4Oas{*Hh=Q9TL(AU32+nfm#YuWiWT^k(pmpMk@&rq4G}5OgwkaA_1dDAVpPT
z>Etzk9mvN%2{M&a2DU9#H^`msQjPRZFgxvKF)mShLum{}!xl(N*zP~lF_VuWw_ma2
zrOMxt0~VyM3q;{I?MhL)3nSC+$+FCWg)NG-ourV`%LL%!i!5FKzqXyL>#VKjVY@ng
zQG(x?Vs%E~s-kc4P2Q^gaK{A;U%C|YAUze7m4um@)1EXZZBnMm^WB6lIUJGyN@!<c
z5=}irke~Z~W7<XMx-Wzemf0z@hA#2aIKMiJ3>s7nCs`p4DF!`s9keY<?vWW6^i*=M
z7n#;?I%f7o-Y`L8q0uo2BMbMr>uuNg`eD!6@jT0<zQET>0;(bmr!a%Jnv~P(!~O!M
zJ(+j1>3VDoBEBEIo%?e6;OlWvSEw!RpWSH<5i!ch_g$fwS(Ww~m=XO(|IERK2nck1
zK5w&Yz}t^zUh*)NYO<^06tA?gNrXH?E*ou34z|5v;5iavsLk<62>YT@dA7U>$zuu4
zB{;@#lAf#%r$uS=X{b;_i~l$mi;{YzsaOvCm(J+ibW;a=Vb9q<7tqvRdWKo4s9yUH
zdR?1L^?>4}oG+oVTY{EA+Fwbdnc&FTEm%FL1-^bta5ooVJiH#andYx&xlS6I6hve6
z#PRp8GW!K*gDxgE*k3j4?!jg#i!MF46>06O(CR`jCrWP#PiEL<02)1gLEL-WTka5~
zeGla0*mbW+sRDZ|t-ZA0*4@tQz=zuc)@bvKGtM*D8P_q#FG!xfTL(4Wn+vb2tRU#p
zHdm4+rbl2ct((isC$fSa#AqrPyiGa_97-&_!Pdc6b%*+zuIuuO(Bh~gg0dmaC~rb_
z!FI=$-z97l&^A{%0^6f;;zeCKLESEQgiSiwcIvh~QZju+)?Zs$SQM8TvapF!<_+|Q
zMvzSeUzA{CShBL7@SvHsk!Fr#i=lUQH&hEU=V?eIgDZbL2}B1u2Yh|%loO@ciu@Ns
zg7U&Itj#K4O>}RxO7sF|tJ5lD^Ke0ZD_Dp6E{Fkx4UQR7T6xh`@_nLPoM$U7BP}g0
zah1tSSOfhEuYwDwcZ>KQo!;6|uYDD50&wOzF3ZF<#lD%myDmApk(F-%5OCvxvezQg
zU~dWTpcSy3=Oi)xU^LyKj+eotikQwx-9n5uEO34VQ{m$GnXV`<Bg31D+EFAlLD0fM
zDQuM=I>!&S8lyn@F{4RL&nBrKiLpHN&g=6L5!Jd2^11bqoAs&G&)=qd61!fQlxgzu
zih&yJ%h;bo(Ik7rr2RIdUy97$y}A=y`BCToE|bbYZ&X@_;P<W<bNrfZiarh8X9~gz
z#V+mdcfv(~76q?F<-_N-aQC#|!$IGSd#evKkf;w(X~xQ8ran$x&w~KWV}=u@5m`d{
z&um|W>gWx`!dYVUz=W7H=es8IGD!C?)>gSK&H9>5f7*-?E{ZUxNEEo!;|sQjgy$LC
z(`QV{R33DoDH1$wZSCH?)*pH!ulaYIUQveia}`yz>~`KoKI@U5O5B#t#tX8t=8q)r
z-;xh4FQ!~cUA`!(>Ev%7W1+#_Lp{cGfCJJvZCzErYiqcU_0^5f3ToT5Itzq1CRp8G
zz6okNpV$9BrI!3dknCW41DTw07tiaz(3q0#=(rFhUOvL`)slUe-1}9>AF&T%!3`6w
zpR+|sS=;zMtyV7Wxd91u*Oz=})ksO_VXsF*fq6)Qfjt!#n+GPQ9@kfjb|m%FKn8Q$
z(smVWWA~pDDx7V4?x{cPG-l|jIP6kg)CnHjFSU<ADZXbNR8TO9(y?Ct@EOrn{p;R<
zl4cWEm;%iq-9dUy0NQydy2h#Po(Z)<WWzNa=(Tr<a>lD{)lJRsz)`Ts3#N6X0`(w)
znuyHB$fg{M=S@m3g6kF`ram9S?NInweOjWZ(nrl;)@ypXvWUkdoV~fb1G5B!M_X~2
z`@;8uur&0l^6K8Ff)sm2==fP1)2-LuVNTyBCuEUJ@LW$dkwDWIW6s~RPZqqEyW+Ep
z6So$=z|G#qc0xzVk|(7&nFiNl;$vjB*7u8^QCqw+kXe6@u%h<1K*V#}$enFVzb%@a
zb>GumEDZg?oC7v~Q~F2@=qQ(J5he>IL3V|7PZ>mr+$JF<mKxq|)d_wK(rv<O>(~j1
z$gk{#1tRx(#-s_Bc{Uo|JepgBnc}WRthMb)nKUbrcH#+?w9hnaw%yQzS_#;Sg}FNI
zUzt>(?Y{fwv}M5Mb4W<~K#6Vx%>SL&I~#@?%!Lm4##+nE2dEIAS(JEIM%Q-CZLhMx
zr(BMS2P#AE=CeabmT8;{d^D~>8!nQBhx(VDRuwxA8?_Xm-=<b*7l&!q;@v_n47ZNw
z5^Z&MPw3rMYz|zwRD}SHPM#1AUJSuTWQjU5dBd!2Ga2s5DEaQnm+XsJBC(v&aF_KQ
zcPB`;gMcVnCEjm7D&Eg(Xp08~EIapsBK*dD8x2U)l7=*C+krLb%K3^~bE!R9nQD+W
znN;=fU$YOKv%n7*w|~Ff|JHlE-^i*}ZQAJOX3Ih(5TUmanmTLdbT)D|Y;pE*x?NWC
zBPqzoI~m(4`&1&p@QKHHmJJRp8Bi+;De>Bmf;23i#&&HUgo!h@ydv+v47m)kIiY(H
znbx!s{Zw5bYG-mHOK^OQ=j-tgY_!4I(EA;l2--LY0h114UQiR`rw%UW7rTf9HC0r_
zs_V+Kmv8N-wJ)1+I=<SgEJb7`#EIfp6Q&LaJ?_Xc>DZAbP9zg`EGu*lrk`9eZ;})|
zDJ2KiO1gGC3uyi90tO#!?a+Sk1c;#KH=l~?{qq)L%5_AK+CVd2EHpZQIvpNVk=!Te
z_0T`9u+p|>`D4IFizpwN8t7;lOg19bI1U=Pd*?faaZ}1{<pCIVK!O{3rC0w8>%vxf
z1+*neZ7b3N$0Ux?8+!fR^MSx`EuOGfNd7qbNc?s-c`IoVDq7LhU5&TSLmev=2BxMO
zZ5BOhF;|T)2x*%5NR7XpH<9RsR%oaBAYhiQ$gM7A>89}R3TO%;cwM{UK*#N8wVg<k
zBv<l~snRHxa`o&EfpOI9;KvQ?GLz7Wqcs%^%}@7~L}p700@z1|^mv;}sT*|B)DyWt
zWN0C6<Z*7VJXkVCL8MLn$syp#&aG)Of)LVRIu8*n>o122o{7vy*XInI?N%7<1BQum
zMi~A~nDfdRVc8>Itvi3rmAZV>Ha=$RsPo=-SWE6HSkkdQnClG8^Dc2i2IR9<5SX|;
zn}kfDpE%4*FvJk2R)6Tjc}<bUPbG*(9v-T|BJ^(6OB%5GUS9LBAYs@jJQw-Su@)4Y
zZuSV=P&>02dPC27>XaDVMeBbt8RiB0cG@O9LZ_Q!RI+ii&$ePxV6U_9MUK@>n4|-L
z7CJ22q}%ZOIrodfYXY)LH^zx;wy7u2cV+Tz*Eev_Ir)OTMv9{8@@TNpDcNSBZrNq}
zxT`au*GG{SC00Esd(9B{_Ad$QM!gP`STbMkKPzx3vS}rT%+voHW&+bv$5_gIF>_v^
zc?h9p=Avr-*wQF1Un7x7OKkY?^HS+CH|3>uHtQ<MQ_NSDB%*Pk-ngzl5@MeeJ*ft$
zw6g)v=TWTOp`=&)VR-_I``Tg7-2ocw=vB+8Q|g_|jn$_HT!LOb$IekYJd~{cS}4(a
z*D=@EqUbZ7^%Mc1M`(6GW^Lz99W>smVb1I%K$_2Ro%q>R8?Tdcn-)jy#oV~+#(c-6
zMt_0#A{qzSrHw_YJgGtf>s44u^u}N&XI`Cr0fr+1In#%BjnZBPfwrDG9BD8y<Zf~t
zVVygyM)vM4+|^qRYhbVkALk5}-rZ1n;MgzIlBA&gkiAj52wD`C_8Hp|o1U)4`ylFJ
z^nSZt)yc%YQaw6%Z~frZdt{*3&tH5R<U7i@mxMwkY=b)G6ieLIf8`?(=KN~64bKg@
z<VU6_PfJ|-tJDztUngduVvAX{d;H+0sV>okV`;~V&?vnt-~9WIAMPu~`n=ZIJ*eZp
zwVDDcz({5ct@`UN1?ck;UxdDOdYRue6_Msi5mm>++gzxC?PQX2GsK5y$wAzhU*%j<
z3TWN{X%+T&NJ2|vScGJBwPVL1(^gct1Z*}1qfXHLx~^GId7o~OTJ?|g*mV_XHx*Gd
zC;gt0>(36tr_l7)w44uFa=}TzNI<XOhCcZ^dd<v#UVn8@><UGj3UTYr8s`Lv{|Doz
z<wB(-idUGVyZTC71>f9GkJ*fmP-rc$5ON4z3oUi>@pj+<@1~VPY3u)h_qRcy=gHW}
zPeX(cJat)*ndq&uHUlzuU{B~LpU_D-u09bL9HUr6C{R-6Q6Yj<+FW{KeW<^sW5g10
zx`OHn89pr)39Wp<7J_+QozU=+&f=`yf;iZ~SDo{M#>Itdh}dKMw|BjioL@w5!ONm2
zNnytvw1-u3R3<_lRq-D-({A2&8OXj0I!38k)pG93#g<t9!VZl^E@`XnwLH^)Q93f5
z{fMOHTCACphOP6~{QYB%CS%)tYd@76*_(fqQ#p&GeUg_{1}D4jM_F)!UiUuCHi2uk
ze~L+@7mBd_{B!3Mssm$ryMDI><$Uy9v>;qL!aJ)obod4S?%wP|xR2T41FP%_nj!96
z(ZCc|S=Bt)I%^&nbx7UiDUuZ%+%)i(+NabDSlC)TVY2ed?x^1A)-NQXh35KG?Y4HO
zgdz!tZ`*<yfJwOzAC$v*UD}<wl3Pvp!~lX^viR%If|NKTg2ttbnDr6MDn^i&Lv0BI
zv)4W(73IFght8|!PJAPy!U3<*ecHW?j&gbx-Ji0O=<5tJy}O@tgFrztAyBxB<E}ZP
z&#qxZKw*JAuqZZ0%zSwr7Z5_KB<CnWVWllBr}Bw^ZVocov@a~m7M*8QB<6`?4f+lO
zZQtsOoOJKxXuF3IVi>PXv32~UAeG2i%48Vo1dCgiU6B!Jt@(IucCUf1#Wp-CMBM`3
zZW_C*TC#Nw2oe6CL?_r`ABbVjE*TkaBf6LD&e^6vVq>&CnDLOZ@M$T%V_@MQLMd_5
z*SyZ_2m3!*Q;3=Y%6X{GH3}BcSPBZ4j$BjGlMb-rPccYPxM&O~jjw0ktSoz~NJ*1N
zyO;H-vQ8UI5}~hrz|rb7|2Lpt2fv%*M8QW8JnC4VDaAM?)*k67j9j0ujrcnHbDHm(
zUI*^eiA8H#)-KP^a>IC;ouetMz%w8!T>30)HHT015d#~|+%FurDoVX3?CJNh5S^Lu
z+_qI)>x!5w(T*0OW>!j>0=Zgs$S<_O0R26c#D~d;gB2-wi$nv0JwHWfI?BfwP4*xz
zGm5{1qqp>c*C6P#=%P(%&&~SV$;6X+ynRDCS3y3kN}`bTidb)(XOkW(S=W<AlOK=N
zyWi=~vgCD{&zfl<^^M7#oDo-{ppB-?oo$T|_xfp04+5Pz4==67H`DvljCMlXnM0%6
ztAg5&H}f1U+scQ39to{C#`Wkfgi$K@%=2t%WZnaT%2Mu!E}K_6X4?f0Iy|T{9HATf
za$_yA%gBa&vzGU;`+c-!sH4EVjNIkZJokHoS3%p@u3v6YaxURP0n~lKCAM9YV#>+E
z=&jx<<Ir)+dwOcJ)7-1`?56cQhghWE#aaGt<de~Re<RdLwuTRO&y-3eL!I{uNcRh6
zn#gJ2^U_iG(026PV-_qvuKC<4Y@_O&QYmV5*#QE5D`HJwIKa5PTV4E(TjU)nmOQju
zC~-1Ve!SJ-T$wp+a2fMePwK~HKCq^9jQO;hI({S8uA*<FQ&-$%Ra<5?bwO|1i8K1C
zK9XcdcUS!D!`gXTl?q_^2Pn?x+|rjz_jJWp1VR^3ha%^{XkL`=JKNqR-(lpE`I>9A
zaIJmF57B;c6ZB06IYx7mmNBcnA?iEAc2RsOvsf1NNZN+$z4{5}(WSi52Ot_6<Z}J#
z!-3{XOwHJkA)S-n+vz{QkMHbWj3n-7Re$2(5vC@U69<8&Sn_HhwZWO6aY|lgCJ);`
z8VsS(!p48z>}$FYSr>=QFX=@CTM&GtluW*~Onh*a_m^PGcHgj~o8if_=xEonJU-rv
zpKcYO9U93I6d)nG3IL{y3y6_X&kc$9s!=mh=;8c)vHNsKmJj0Y#Yu8k`^ji-A@+tg
zGmw!*5M#}EtEcT$Wyf&58XG#qQX_ZRT)kw&I2OyuYGdno+<q+F4k$^q&H0sd0yjBw
zcfWr%M~}@cq<wf8hQ{i7GSONeG+vO&Z~-{B4H%k!uKaMQOCObzbHF0<9$Z+>17&^F
za252M$97_SF%RWj7(&mc<W;k8b0QN-vSnFm=BVWi%+aYAcgqda>XuOEadHmnweYmm
z2b7C(>=w?k16-f{@Keosr7EZ>yls1Yr$mAA1%oJ#YNZ9R7sfx2sTd)-7aq(#(<i+z
zvVtZ)U)o;<eM{|fkr~V1Nl2kZ6nlki?J%}F0tnvXAoV_13cLiXZ6RE)0mQ#1PdCEy
zrD-WSwBR}j<SDAYnU})<^akkv|NcJ({-2;gaQGz|8SGS_$Odlh;puK;;r#c>#nORD
zREUV5=<kD&pn#ar|4kMCZ>ppu5uYx?($m+~hKNtu*}@L^)3>+wd_^Sij9-L^PszsK
z?v*EzAiuB}5ucoklZ(5qtA!PiN#4fG-pU5zZsAMB_rl)OL(9fp&c)f)1#ScPBm(lP
z*}(09T13GBARQt;MSCYt8+YK}$->h{-p0zs+J;D4n&`i{`lPKByk9?DIG5R8Agz<Y
zYLnd)^V@o?u+rT29W7JQId*?wESn9s-ux0}dYw3&7_zmn`I17*>X$2<VynabXr2g>
z4@ZsZgmhnE*2Qiyc`3PHsA_9eh6%qR-7n;^S04zZ(Gy*H&3F*dgtj9`09Fz7*16LL
ziu-D=NC2$(YfzEyp)%BDoMPDd3J7#NFD;Q4ZNNiZXbc#Pdy-Xr1?ZV?E55_gfZ@HJ
zco@^~I5O$52G4{)0=l>#=~Q%`=lrz5z|{QX$F^sE)p*!xdCoJ$HK3|9m+iS}J9I5h
zWh)mBz<oV^zBWy{01O3!)$`$OKmsbdp`&4<^IQ@wg0T8q!v4(JtH=3g!(_oEG2pTw
zTLG&%Q!xJ}&s8?SnjNe4v(v#Q#oB3rMvOf|ar}N`03?G_-S@+<GK2%u+Mx2pA<Gbi
zcFnIW0R+%}1`Wd`vR>b^1keKsDluw*yH;@%c(mob0iCSN7$yKPwfcY8>)+<7#Yv|{
z{;Lg^j_C+$P=8(wd<4za2X}MSLjTqMi{uke;RM^`5g`5X@ahO^VPq1GM%3zf-v`<<
z7J6izH2KN9@5?4&(n0BPc0X<BxqE<B1{tDHZKnP7U5e0N{|Z+QY}Ph&*9tU}|NENP
z@!m}TKdpLBN$o1GUSIN|gJxd$hyid7v@s#p2VaTE?py&qPpq4>!@AS%3H@!)<KH*?
zb4$Obp#FillE}>d--bRePsD!U`0aLVE>wU4$n(7EqN+gE$(b40TSf#Rs>LAxaQoW_
z8-Se;U6_b`{-N|XYf^a_DkAikw9i4FmnHe+HzdDaCi;B@@Hg3&&U%g6oYqD?0N!NK
z0I_-gp?)DxrTuLV@wd=x#^x6^+TW}QTo$Xc094mSja?w0%%z$X94K`7^uG2tn+22A
z0pMG?LT30?Uesl*-*te-#XRTn4VDcDgnUH7Epnh?*%wuXMY&XskdbT#6`-t82`-A`
zccsshgI9nI=G1DB0~JrV488Yz4itA-@nS-}f4J4ma0BR00~FhpmA{g7t3R8;5GWfW
z1GMn0&j0SgZ=mceBNKU33RcG$h*Uf9@mi3wDcOSmePavYMc`85p{wj)rfcom$zLJ+
zCu9^dkcZp<B;j6{@6Ty~CJb%OCcqHj(<SqNDcAHc{(r)Us%|;h8it}C{^id%V%iH8
z)189AQ_;V#&r9L#+WHbAXC!|m@UbT9wc>wk?y5YcU**id|Bs4yd--xoU5Ol!e?{>g
zC++|EBae;!9~A9PY|8(h$#3>&mcCl`_a!~h2HN-8pPTr9c$tWaa6KTZ3plbTJs1GK
z1v|*ZHiVz3QU61(-q=g)5x<b*r2^rq&{4Wv;4px(9dB@IgHQ4*A#06$RrJ$8Vu=09
zyM>q$L~!g3uMr1l!Xv2v;VJd3l>jlV{@E1JIE4+Zoz@`G2$4Pcs~N?Fmehuq$tUh=
zd+~|L6M96X+F2d(-$sAbw%}W}v{}sW56idTYP`&YC;g|gLfh6eE=0QE-mdyeD*jv<
zs>=Hh$@Vtm!pQjKkUg5@uYSAr!zDr?f61a`g|}F}YJ;{}R8Mo~ETDZgyVS-&F9C2R
zl6f&e&NTgJam!%Ci8|~ut|6HX#`G7fyC~;OUNu{<bo;Vfx_vqD!hevTzx_deLm}Gv
zDC^Zzgq8X~O+eR3q%=HEM!Pl$xpiQM)kP~#U;S;eH9#_*N6bQwWv)}Hcl5PtCw^M~
zORwV6Lvs9H)!vdQq=nB;);1DJ`vA7<fpj>>Z+9geMb8#9fWc$p1rxNB{CDhRN$ThB
zZHWT^my5Fh%F`m4iCPNC|7)ARy!|mX{2udD^E26lVaVSMpbFd8093=`CqoNBhq6!O
z%(cBS?Yd(`*FcYHC5zWfb#5)C0%H0pfB}K}S!`m+U7ZgCeWAMq1gz_6{$_k~TQKDm
zpbT1}Sn?aKNka=SY^+GorJs27djPrYy#%CsI9lZRqT>5*10bn-K|6O4Zv=4IAo(jO
zSWkh(tHmPC953K_0Le!=fZ$;}Y4iy0)wc+@Kp<509X%k|&c8IlsnjO`x+lAvxxlpt
zVt^oW&^l@zbWdiG0P?5g#fs2Y&L30<@~hbBbIS}6<}!io&)CjG8ghnbMYCRqHB{V$
zCiQIx0ptAVO&kc>LRoo06aQj+QLlQ|$q10OzIXWG9V_pDGSjAJF9MSs3<v>>CT{+$
z*N~%py=ajF@nFi0Uw}z+9L|*oo4W!4yO(rOZ<G7~8m-?R8wIM$cs`0`VW`;1?|TPh
zKu%hS)}vU5f!hZh{6zXiweAvE{tB%0$jdtj>XUv$`hr_eaKlvvVeLPUg8!O>*DmKN
zb>Tl>DN9|gsWDQK<jDJLg?}6GwXzg5-b&Q=o{j?AQu|l*zI`5vO+X%%zEULkdi?Vv
z6<tJ|+UW(28HS7qD-u#26hL&>$A#1hWLn;nq<>ldTI~A5Y_CLtg!2&pzjuxYl4TTD
z0sA{nQI$vT|C%9m&{Xok+(eFGkw0~gs%5sG?zAna2S)8NjfA%QJFB|GgoR)KF*e^S
zrf^{=Ku}T-gkTWD_YYOt3<~^EfaH}F-9;S7v-f}XYT9QcvSE9ba~0k&T&Fi4_OA4k
zq7=Z2mtnVV98IGY9&T%aM}CLN+|6VFgrOXE>@t2sw&Q=M2t3dGL#jN!A(-i(8K^U5
zskqy8B=H^)1GVGy_5t^$#hu|008Das(G_NK-{JRpx_LhP8ky2q_;L7O_#J^9OMm!e
zvVMm%uVOBAYX{O?YraQYx0=TSwAB3bYFZ8SdR@q@GuJ#wUUu3yrfXd2Mdl_X^g%;y
z;(5lMf3zhPB-%7sVXT4sN$NOvn6kek5yD`DMsq5xMwO^U$S>-JMvG(tsSDer4CuX_
zbr|P?d%6`*D8fpRFo_+pyhUU&`)M=6Jb>K?FaOs7zRuFPmlDn_llAf&O9@_4bTi6<
zp)s+rZl=`Px;1#vO*4WH9K-uhCSor*w~hFuvc7z$(9DgW{FJ{~E5f<Cp1sQomIYth
zzhP#-|JSU=vy}e6(D_5sZVc;`nNp-KVlFE#9vb4P-(&BAE9j(~Sje%DX(pIO1FmR{
zeUXMSx(jZ1xw7NX7?h;#?Cl(JNm!7BXb3vMk6@LPvBLFwKbIrI{t|E@ysoJS#UVC}
zw=uFOG!Zyz8^H>mOMM&GdidBU>MUT0_u@6CPR*--Wvalo_%!m=bA|i{nN)rP4(ER;
z7}s6I6qS_Gz4j^||16_~4(oW3e0nAR>R(-OSXtU_xcDPD&a+O9l(}8~6<_exCY7lM
zKkTt?oxONy&)aCKe0~(bmGk0*_nP)U><u_4mKS4rWwO3ZK8-Po>+bfi6-gH;TXM>t
zKRn>3-7c0;NKhJpXZ*%d0WzP!WopvD0C|YN%z>$lCJM!MJHqnIYGb-0kG$bldU(T(
z4w~VuDszMAhyUCORxHeWGzWWX1KtQ9ngwznQsKS^gc#OD`_G3D3`M1^nHI~&VK0eF
z;%EO__UGi<r9H=~-dMQ)bZoozE@?J?6Q5X*?@SYEl+ksUiWIqht}`C7p!!!ozFaMR
zyCy6D{ejVmN$Vs>t^Y`}23r*jFWkhcP%H}^Wz)ZK;bCXme-mJm+Ow7*e>&}t+_jDy
zdXshfG$iSOpBiENOXZIqJ}ZaPS<h3|rW{%UP~aV<#V1eNY5pSgdWsrZI%)AC{OvAD
z5jT;Ov%Z>ggb2q+yp!oMwKBy}37=VF^AmtH)}HS|A`k850YiPyQENz3M%jE7V98?2
z<-p>>L`e8s>K&tQ`G@fv^XRW`g%vlYB%?%*4ILIdEe;=-{l(DXPeKXTf&N4C8~)&g
zhJxA{nu?oyK&Co#_nG;_D1A9VBShxM(Ii42tZSLo<-hy2bX$+8YAzujM~J*Cc~yLc
zh!+Hkz%T0lu;_`tV{XpbNN>+Xg!QT`{ptojl1yhA`SSTg#Z7ZxoIhYM4yf)I$x`0X
z2h{Xvg8T-BF+R9KB#k};urefnD|%zAyJ%0bydIUbJd^$(fZ|C<a7VvC%2@^>feaKn
zjedSO1PH|cQwjEXZ*8xUtP3tLnDu42;OoL<2W+zLJ?l?~9=WDS5uYQ+Eo`Ak*<Z&M
zmF2UOJbcLzS0tn?FIyk|?y58<P369$Ys!lUJ$!yRdjPd|;>~r%Ouv<~J{IyDYa?A~
zK)!U3?EH(r`}F_03)FGNXy(rQ)!gKRvsupZtqiuTm;IE!IMK~j?QuHCZNjU5aUj>-
zlHYyy3`F$Cd)Twpp~2}!FZnm+x84Y*_=@g*)Oys<mWc9C$@($knxx-+1N8c#dUcr1
z%~9SuGlhr6;{d0eK8hv(G;;R{&Ytz7c6@H`uI+jS6t1TF5HH>@sK1cpkqf8+4T@u|
zjpd=!Zr+3gO!`+FU?8OYmBJ-QewW?uxB+^cwc$?=e?YX7?9Ldk5<Da?|NT#iVhw@<
z=x1NNh&2dN&Z)Q=yn{{!9KUYmZ=~k>3!g)(@vSkhOiJzYzA-&)AmA92ct5`cjKg<8
zx6%$krr%9}L)ou@zOa?xe->V}=~oc%O6?}yV`U=x^zJG${H>J#;cbq3RrALmM2;Up
zzaO9@f!b9wVb18w^4!&Psln-zB>|&c<DP&9M2n!Wa{wwT-SNgSK5on)q(v4bvb+Sn
z1e7b$=lh24dHys>+__mq_|?OylD+V^B%R(a1dcEB8T6ao@%aBk(p85=*?jFa07X$^
z0cl>4PQ?Y05-DkxZjcaRiKQC^M3x3=5Gf^>uBAZ<DXC@YmXMTg_{QJ&AJ@ebGiPSb
zxzBy>^Q>tXb>{p{$Y3|sBd%xrjUGiEyQn~?x7HQ=;QEFf?_Qm{Qj97e@3SwYsj!Lg
zSX9B>*uHMi`Cj8X2u|2s-{!OozH>WL61;DH=C!|=2^CW47~=$nnGy|nM9orTXDO$3
zgSeX3!SVV!Wb+o?6A^RHdbvn~M<Xb(jB}K3>*P5Ta+s=7-fVa3mVV0@0lw#W@uO08
z2b}3&w@>ke=;38vLLw=fE;<FnGiUWHTN{Pf{^@>v?mPB3L^Q>GH58YO?fK1#vcI^3
ztYnxfXEgc2uyM-*i@uD3(OXS}RT8|S-orf`QDO^G{i?3rAQ@}J8RVH^(@NAHFK%8j
z+Ki~i3&#wAlcG(VGT1Zxxk1A8w<q7Bm1fJMPS2}F4n8#~x3};0l}kmkXYtxSCX(l&
z@1XV=1*ABCRzlKU^%_<C<Op`tnmQycybO1;T})$hG3AvLvtyWa)Ig`_B(qcE)j_0>
z4$uJ&3J@|peb3k@!JLn?-=~DCobN1mQerr39Jv_s1yuOz0>WVLR<%q3o{?_WHvC``
zeXcylncRR1JUp}c-PF)0PL;Gh%yo8jXdh<xy)lb9GUNj|p2>}}Ht05nG|y3x*zw1T
zaMv~EynMw(h@+Wn`nF>6G~9Fgop)|&rS<7|lJvtck%0!?Ac37EU8MiA7D(S)HLZ5>
zbd;n6u4XK?=Ni0{jB&y3)S~G^N_=%~DA>z3JV@r4wm~Y__Jl?(30}EDt!0fMl3T!@
z+<_tnfpi+!6^Lx&*QX?;N$<1hphh3&UxMZ9ejSTf3x2<&jg$f&<M=eC1FainPY!qL
z5-7(PIP<C|*`09D0(<Xvf;LjIT{MjAdA4a@TnGyHD5HR@C%xIqj-woZp@2C!A{qw%
z+7lE6)+4A28}2{sg@VcpCmi_M&pOJvgAU|i6udMDV*5F@R^6$g-!s>Qycl{I*r88H
zdb)>r89MCXduZ*i<EX%=I>5a@JVk@#K06I>GdPwMp*B2I#GYk>iiBaha^Bv8ynHL8
zFYI`Hx>e|1b(7^EU?xEj7mxR!QUhfar`h(h$`SXN>9kD%-dIC=)(r?_+-K4xReTsN
zL#YZcGa=`vxsAOA`W45obT^%dO5T_geK!&-GL~w&kXLHDq{gEJA#%%*e7c5gF<4#&
z0B=?tV?DgJ-AMs0i3!qqcsJPInB(g_{gRgV4M^*&#`y>H=PO*>xUf%+00j0)y&@N}
z6Z@G42bX*7!OcSE40HZU9v`}i9KrD+YMpAuQGb0_pYU}llG4EEMY*C=LfwpL<C1l6
z-8gpAnH^}S{;+yX=6k#EH$@#UX24@q8-UEO<kNp5)BOx~2R&e)0Dlt{3PahG@|TNd
zM8fXW?%KvJbB$pNYbA^~wWPqH)MIOG3rm0O=zC;nqZ&im=i5ZHtE?K%SDljhM0-%M
zJF0Zt%W7Ypk9aBZj=2U>??NEBmFIjID=|7gsV@NG@|zKP91Z2Ou;3U)5&2(p;EHb$
zP(#Rj(?>a4#OGNBTV5SpF<oG#Zg)|C#s)pcF;*e@tbij70Kp|ZC(r=7_d|czksMz3
zmP-!!*Y{vnek~NhwyoDy>reV;$Bg$(8~4gc@DS;<Ogv+?bw~<$EAyjr{45Gz;q@(R
z<7&Xk*>Y4g90$js0@atK@=yjvg14D*jL)u(^6=anb(8_pGg!o{tsG6NPHvFqdTtAX
z-3ThMx=+X%%z&5<!SB8Z$yrQvIY$4UJq^q8YA7wzA^LaMdL)WGDuu#?<#D!Y?UR%~
zI(VxT65Tc;U5?-1<-3qMKfA0|3634>*8U`V`o75!f4Nmf5h`%BlR&u{6_}L7TWsGu
zOzGJy#9odsHyH(c?h~hD2a>zAu<GGA%_%`($gVVz4lCj8nBU_b&S%E0`!lh?Q?bSR
z&>@g<{klOd9;1w4UG4Nc1HJ1|sKE42i>D^iZFF*DqXsSq1)`;Dmo!1mlZvm=ZOh<r
zF^dXoj#AT^bKzQ7>YYJ~KUj65^1%99`L*<oN_2`qHlt98oo4#<>WT5kZUtfz#9s&;
zEvZO@=kDiUnhNGzV~v-iywySpQfDPrXIZErOhkF4#4BL+8xu_g9m6FE>fS}VK|u@F
zUtj=JZ4MW9<m>yVgSa0DY&tp>Ine3TpkO2b^UaZC7}&Ro{mE*s(+%mOHvCEB1fT$E
zwNmYIhn{MOB4K5-d)m@rQ=f)(!zl%U5Ennf)xJ`s&e(C(#yrqK8r`OGs)TM++A$-V
z{1@6zl;0Fz#*autHRFYOWDr7B36Xr+^GA*;G_!x*n$zkwB39F++o?Y*K@rF(Yjm4>
zLz?SN$or%{*)GBk(aY<5Dt^*jk2jm9cvS9<q!xF|nKyU;?v1XtKl^F!X)H`SVSB;)
z-(%c-_JVAO7QmbT&bP9d2BCc_Dv&2iN2D%_-Q!zOlQNmeMbzpja}jQh2nzg(=ZRae
z8PTi+&-BkC3II}X8Lf2md^lpa2Bg!f`-=%wAmNw2>OB&+T1E!Fo_+e*VZuuR3`#fX
z=b8qH^7x;kw0IU;E(|N@wI>yF0I=Lqehr;YtY#)WvUfhaG3qPb#=`a-aaA_rIm=>c
zrU&d2o~I1sw3l}u5Vx3x3*hEM%d8N!U>lMEm}TSZx&>aWT2v2)i!R+)4e=dV@XUK{
zF=Ov*rq`<dD7GV-w1e8`i#qbhn*j=Ykg*Aj9xi-9EE>Fi0{k!?<$pIw@T}eD%Yp@P
z?>)EWrO}cW+Q|S#9UxUpXTc0<2{SyE4+(~~IKbt!l#ItDcuDkKa|FM1Z@uNZ|6e(N
z?8F-Yr_yw?!J_5w_}K}ev}~mV_7}~ip_`Mfhm3<;O2Apd%!ru6cbEWPPDa7TJua}F
z#!Y|-e(u!Q+qtcHSEW`-1^6Rw%>v*&)_?OZ_&DV3GHow6`%o*RCBt>wd>@O>76}2)
zouCTryJg$z;_>CG@BDGy4YYZ8txHl_@<nXgsimV{#7_A3RO$vjP(1c^y;b9S8=^KO
z46u>1Qj@D8G8vqxG)&J(^-XtKb>KAi=3R{%0q!DxF!w$LfJ|sS00e|3|IV~e?aTgu
z91SU0^E0PXbE5UmB!uT*6~JS>Y?xJYMGfTFhq1FSO)h_b3PKGNFvNd(UepLRRqqU+
ziGS5amB-A4q*Z|%;IMR2lzehYi3D*V3<T%}YqX?4aGQ{2aK$Hu85!uN-Va!ctq`DS
zLbyEiAB*BLecvodmzoh(9j_V5t%I!L{jF})&BSn2U=z7v2A+=iu!)ldISQsrIwf2*
z`^@~DBeWdfyjp0Dd+QK5`V<T404^ozHaC!{{G+PZ%!#5xg}yF99)d>(iWJv<)dBQW
z2!Mavk4W$=H!!Sm*R6nK3wnW@PqvWKkBX;53>q8cZ0b<}oMAC+8kn{oTc!XYcSBOq
zWOHN0zo9N!@;SRYmzFa|c>m~{8vodr!Un@-ihQ|y6QU+#K(d@Tp=HzcwnPV`IoxBR
z;e6smbi1AUD|A}zJc|^V^MMq=Cu;4>?)zGiP+RF6WA`wTfD$}7G_-T2L#R13EW62e
zlY?=nd5^l8nLr_s&mtck%wP$GBzT5SPQp_Nm*iDr`(ih20W%kl(HOa_1k?+~M{-U$
zn#6NdV3AeBnpE$vh3#TPpX;whb(5Q{I8%7NTh-G<)zApoAo!hSkZld7{k`LQ?+$?Q
zhK>wyWMmpDP&UXs9I1%kP@p!#yJ{okj}DMG7kT)!=KCY=LTNKuDhPBp+Fu7Q6wo)J
zs+WYXXjw&qr}37J6Z<)Z*O;Y+N~hP;oJgTB%v$Bjw&^!v80=Aa;5`W8Bhkfj-KWPw
z*e%9b;BFOPN(ZD_siqy@sXW6>OuZT3GTc%Pg_SiBti<2nVy899cF%WpK0aqqjcSUa
zjFpB!a_eVKb_xq^c`$fvVrE8^XiPLa=HfY}?>n53p~hSyukj8h9COyXDX!H#inF>P
zc)C+DJ~8ggDVkdv{-C2OH5d#7dvsaMx$t)jYqx9I56TQB%!JxtA18}4>m}rps|>Hc
zVQcW{2z+4Z%?<G0&>o#&^MXRS+i!k=>AGi(4%nf?ejF)W&vYI^T0=`HHJ>EHg}O8%
zr%<{nO0@97GLs6%1f_7Tt+SDX(D63=LXR;yZDiy};5m&P>ilf7Tt$EvL`q#9G_OqF
zQ(C<8gFxKzjSLeOU#hNCc)r_K7A60NzlaJ<oH;ammXBE6c|k>1UP4d$V#TNAil404
zThJih&|u5djOaTVMq;`19`BC(EeNKnsiN>B9#$E^eIciWIO=IR=z%jCoL@UbiC(82
zeau7sO_jSrFEnAy;mKGgz!O6i=~OMlZ>7SLSDm_?W_#07z&IAE)B2T@ogQ&&Qaq(G
zMW3*YjM<sh;ovhTiQKRDSFmSt%=o5X)1Z)J@PNn_sipZF1^@+4qpVgHw?t;pkAYO;
z*#*{RSx|(~{_^gzlUA%|JD||%4sSlI(n$5UGK17(I5xIH+C$S%PwG^WgIC$*<e^W{
z)goQ>?>I1VU43ev)t*RS-Y?fU734<;2xe!_qEfooo#Q98AIOHLihb|bK$n;k^|2=U
zFQDmcyXnM!zG16cc#-PgPYy~Pt5;U)_C@eo<(db4E#I{y)VH4HDhZpkX-T(XPQCtg
zKe<lUWs|!uJhi7MB_&3b3C+;9!XHev9k9`US=}5d)J76K_mKjN@-d{p$gWx$yA@Zk
z8_RTrgc8H~du7=4foSyC&l(DosYzXXX<D$XCeCK3p~k<a+B&KG?98v7&*#U5;$57s
zK0+YVsS<nePA{6ZK<~~3LrZ3@0&sSBy=zmBt-}P&AShr5%PEcPKSGB8ThJVWsY~AC
z`Fbih2qdq@C$(-`Tk8_}!j;C7>L?!7ZK1_P_<euh+0Iu^rP(+u6x{7yQ-1wj2U&D3
z(92#YAToaTMVo~k1DP+7%+uAHO5V>;<B*BlHeAle2Vu({<H=u>LJ#Nne|3*7JtK2R
zd^9g5{FuRwKqn(bHz*&VBU*nE!pN%+Kl*KzxZOvZKV1{ufY1&x6LQ-UC!G{W#g!~@
zk{4h@*&j{!FC4o)aYHzfBaoZHhL<Xoi23aKkFV0tX~@T9(E&%Uw`LmugS_{Zl@3TS
zThApFigf7usyRg-#$G0r($@pBi>MWcV2p0i(M9AP;YiqEbK&49%}vPo$l<GoQNfS(
z)n?>13kAfm_!8I`WELo)%%pt?1)$!!yiK0+Njd%n(d#k>M5dTDtRZ&8{WhfR=^7K;
zvY;uR4xl>L`#V<!W>JA;Mh97zLQQ3BAO<As2Gz|N`b<)gAdq$8eviMkQ(GikjuF}m
zE;~UW34n>BpwF={f8G^}Vjq9QeFo<M6;rZX{GRu(dw(A`L?a#pBbi{5$5f^={*L>x
znqb)?z?q>3b>o<cG<(6Dnkay8wKgKVEtWxDj{gb7$nZDyGbc)f+HM*WGp>w&RezP-
zP91@|9PuF8!GoCEe2|w82;Rt_;(7H2VBO)!&PX|cqYZe8$>D?W!Pb91=K-%aX<Zng
z;=Iq9NG{7kn*IC+fNEb2>_K*lhj)xE!t_WMrguWw0Zi_RwYLdN2T^wGK(&9No7u4O
z*Xv)pK}6)Cfm{~)b+Ty5;ynKssG=<h<PT3jF&MY1N~Lc62ppJ<b!mjhO1cfXI<UjP
z2@(ZUbI6J#Yke28i<(<l*4qKz)bj{I%!dh_y$i{t2uIz#S96@NrM|?Rv4Xx8p}sWx
z@9tvChCd(TzyOp$P8b>9q;g_LM8D2kPng<CjUBn_=^%Upd9TC`HWWH@`#p_S7%;Ux
zS_vcs9!{xgbPWKXFmHkSv#A**7jsG!&W1Cs(nfY1q4!_DHJex)jGZ*OZ9&HfVYk|6
zE9tRI$YAIoCxw@dzGk0~U|(CdF<}P0iKtVgZqVO8=2MdpW?bfiVXQ#U-9I3k1qXw%
zm$5mayFfg18;{{X61=_=_0Qm3q%Y-?HU9q&K^AphlrHh(=9^{9g+6m)=06U1P(OPR
ze$7n;As*T4yuOoPE6#%f97Rnc&BL3HTb$J=&xHn(>H&Bgniwy(mYq{NXVynT0end7
zPjp1oYoptAi>rhZcC{ffGe_6T(sjj!XLCCR-ix0zQ8&%cCBce6upjm?1ob#z^W3Q4
z{^@}a1}5lpj^0?~)z(XpMSK#e3(-azx!i*=rt?NI5k76ms26wuv+viSMIagAf7iNs
z&(sFhu3b7o3M{3GmK>AY>Y%38AogaXbdTi0TAt-lF>Mt?7`cQa*?-!)6KuF^qNu^d
zKW}H>!<&g<kthKh)`JFt?1R?f3BhoT5daLnL~recp=-6YH1b7$zh@%ByPV!k@u_-J
zzVQMa3>pM~;<e>wJN2{)lndi*gdVC0i2NVr;+Q(kS~J<HcHA8hT#|9yi2+__n;ZTB
zyOBADFA1#N2zImbz2kJAk_Fa-E8>f*n~)o@3+V1LP6touKvXsK*}u4c_=>XF!6JU@
z@1RO{=ZBy&-Jp8{4{*EsZHJ~pmA~nG|1IVn2XK78VK1FpjoMhE*dM)7V!a0-R9idb
zXE^NLvyMvZS+{cE+%xYzZ3wZ?1vuc%S=%YM8ok%L_yN6pVho~!<U`h9TA&8_kk5=L
z)!V}ahGSTtGlMV^Ps>1cb!BHn2u?UH6{Op?w+u^>8#279Gnh#D>{n?h@{c82=o1M-
zEq^O#bKM%~C8A;e<3`ew?+Lg6_#EO;?Cf*x)tc+wf9#nE@l~I0&u~_snyxx_yMg1J
z{6!F#$^XxNh*x&FN=v?-`<1hu<$LK_$U+9V0ocGjX)my)9_8otDuNlQ^O-oLt?34R
zdNKK_fYvb*4-%vB8qA$6U&Pu(sOv5UY-CG=y24@r+-3VC4ZaOC6JlIoZm*$Kh%y&U
zO$!0V(;M$qT`0-mrVHdkX@9*p?}v;IgCQ<WYW9FJ&opZs+N{U}WyF`9Pj=8p2&CoI
zcujbvK`4S1@?QG<YDKcHcxBnInHT2$UB21^P;~K5qf=4#^tY)6W%z0VbB*lg!cGYv
zzPn1|So_&dZ73}5E$kS18xoTnJ}4F^pxA8X_v520$GPo~oEij+K#E~ob+63tp*X{5
zRhiYs9gSd`!}h7O`oOi<{b=%Ly#r|_Dks4^BD9~e*Z8quHtA<@<}Voj&pzHXI(4p8
zaDIbQ(=T#RBo(si>O26Xn9To<`24+W;9jPwya)bUs$P}SG|{#x)qnbLxmn|kWS|kx
z+!Cl20o2d&8~SXKHq%9YFh*F?lARAq@Z_`W*44!|#eOps-QmUGkEvmNx?>80*`~}o
z)vlCqHCwdO7cTUi@jG#Mzl!B;GonQ6f!o2$_;@!Un8$3{t=~sGZ@*((zfm^WU8oCQ
z+2DpuFmNQnqYHMOV!k{GwbTJTj@l+U>q@u{1?2thPfUc|qHm#hM|T?Z$PJl6Edjs8
zjyI4D49;G}*Sb1QH;AO1a_zqoP@T`_i6aM#_jjV11LI0zQJA>RO!yIxJ^Q^Po%wNr
z=cR{<g*bro`L-uMsWvoZTo{&|s?g;j?2>7lPkP0BRA9K#Gj#bb<KP;+2RPWZVuxT7
z`+ivY^s}SlCA?ZfAl9OA0)_({<J|2|WRww`6($9K_;O4lSyR!HiICMz+qa;WB?%Ba
zfc$)4Zy^WOP5EqM^mrYSq&vz$(<ES5t;v?nI45UdnF?ZFCi(OkX(}FMemK))P<zUT
zpz7m0%JHj0fAJzCE<9=I#iUFS@b-7bf?eaN{n3(g65RNZ_qHxSh>WG7<D8hLYOZhV
zG$gpfL;xUt4^V;SP3?#3H<}`JgTz(-C2><a`hbf%nLd?U*DpHNzL(V-IaiZIPj>H?
zdeOHRBzVD+-hboyaGA3a<3gA_^fw{IJ19SFF!*xO=FJq5-iL7k{VDndD$;FLD%odw
zP*z-KQ-8rjJC0WF>F;=uV5qUCywO{#NgM3ZWP;Z2?I8Ryw(x(?&B4F3@x_J~?3)N*
zJGSoPn-JuDIpI2W+AA)Mr+L+?ett;j_XFu_7Y6v?9H^BIot3EXhX)F#^qH9xb&j8$
z@&8+<ue;CJZyJQ-czHTqJ}qv<v$fF5N3xH%YS|_ABZoeEb$;n~p3$`PN0K5kd2S;~
zEFMA_)u%L?GkHs^t$8-GjdZ=qqN5WKz>?EU?AfMR#y2zSDVMrI<=_ZpMy<MQP>#9K
z4^3)k7i+kYNNxus5<=ONhj<Mr2qvOngM{|?O2Oj9wB40ZOTryosUnP`+~n;PL}gQ4
z#XIe!+y2(`&VC7He}_K#-Jm91V@6be{w7NVViBYwkiSt_V70`9ElIL**coR*%SzvH
zPmXdpG&3Vo68y5A)nDm7#SM8sNza?ZTl7{T&YR|e+BKO%(%(oFJEIvnB1TC3$U!`k
z_4fOD%;pZ(auiDv`6<$tT>Gj!bNWe_7NsGGi1a9SWET@I6aEN*oqShXStCv5CNJ8N
zUn`UL8unk3V;wY4j)&IlS4WSwoedkU`2kg70l*RExq(UEja%<`X3C=L(W#!hh1kRg
z5k^l}YqF?Vy~FAVd6@`5Jc)+g$pLH)j|>yx@JR_s9J)^@8~?og<XFMw^SxqiHuBdx
z4-?^Suwb$k*Tm;(ITfz;bdaBPLmBmjsi(W8IU`l>UYps%&&Kv0olNyly5C{tb#H(t
zn}f8BD2~CodQR~(8}1earRI^PK!V4SXq;Blv8y?)O&=Y{EWA*}l`Udds@}YGpK>RG
z4#Y&TtN(tm-)#vapY{w3F@d~P6Kf9nH-7h5%yEK<q(S*F58|YR7yfR)!`hn$05>12
z2XbgYci)K)W%=bEWv3~aR<8$%iG)V5zdqTW+v-ab(`g9w5>ld_46c>Ufs2e%kl?8U
z=eqE*?$Yc!MP-H+@>5(v7TV6!Agb{r%_d3p8yo&q@Q)h8k}}lIYRXtRSkPS1uOI}2
z-1%zRkl$OFQnB>36jdn1<Tk^-`|dLa8WBluSTuMVi(>x^Awy(dVede04~B-xLN$vV
z>YV)@mhaiW(>+;ySH*2!XSBwe#fTM91Pk>K*OsNtIRZvQ9TZQ})B6*{s;l{be2b2w
zarSTG&@b<-niO}6Orspw23WFF`w>q;+D*vB?**sz3LDvI_OeXnTonYXd-8M&jUPYt
zjE%NKp1b@0q#nRO%p?eYYQ?%6tpY8V$-sm*2F|Mn0-o!9X*~mK$Y_V{l>{IVoNlP*
zqel#8)KfuXcrHlcrZQYYP4N$W?}iA;fJSSbDY+e&{X(z_b2dKQwUOhv^%8jkJp3#F
z;@|8|O-nIVc<#%NbViMDXT;C^f>G?C&Y1+{Qx7!8?p0+A=>2*g3WtgdQ1g^}?$iXO
zB>|lh<o!e1q3HkZpC)*ecbtU5sT^n8KtbJcM_g@#r<gP#cupi2f_K!%v;<fIR;jm1
zko#jga-;lbrm|O^@6mlB)%R{v{~pAUPXkx8riRDp1sqwZ)gOpk-oJCrNnQLJH&qTI
z^186>wF>~~5Qrs=Ue!pe-y(v&jQ@qUZzuaDbiJyQD|=|G+~&NolI2Z-(+17d<9@9d
z3B(Y_qG~Zcz~8P4$U=43vd9^~G3-4eZr0$!L>v8Hbex!eaK=ly01s-1ff7Xf9>87+
zCn|~xI~T;_2=gklt=B>Wy+^PLdtx{!;qsb*_>iBcm4*MRQ~ne3IjL{FKTZ_N`HYnC
zfB)xh0ssFw+7nZ>s&9!P_2Z{qna#}hLzq95`)7#!jjX3&sTZ$*k*L{AWxbG!_lMSo
zrcpfLXN_ZXYs)i$K(vf<fnH7x9`JSRN1+5&{77`ee9aT_8K!Iq<fY!aEOfKM#E{Rx
z+CWkXdK|cT7*>t^vgFW<0JYWsf5XR1tm|ldnogY&M}nCLnz0{x7@+r&LcoL2J|otv
zPUfGb>$iR4>Pu3o7(IeDf<Eaguk#$qbfgj^vMTT3R63n&7g)!&K<I?a9psf1zMXAQ
z@o}gQ6j58olbQUU7keZzHs<i|fA5QVH?HTLbh>P7f5D~MeDvN$IUcxs=jezl8^ovY
z%9f2)?7zMktqbD7^GNU@vkhgFBW|ULBpv_VZY&QzlPWt6oIfk>GksSQdAFzClSyHA
z4A^yyF0(Z@QGE8-#aFra3ep}JBc7@Fq(he^tmHRbxRx0@`p5Kj2hQ$kFcIqaIy{0r
zCVysskv+9Bof1j2blPM)bo84~1}l5ljVE?|%cD(8n7nrOwgH|HOSWkyC8!DYN5rXK
z<s^sCe2P=;eCQykCYU{cz7%G8B;ufne$^jyN@4FBTK$(joX?DjFqb(S(kjB&^!S;|
z)>aZ|B_(;CYcJjAGSOk4sr^;c*aX|*g`*+CW7I1m=gLpZ{L0`*?7ww!8p4p@fVbz8
z%6kz(^7Vr1v}uRb|LN;1n%xoc4?+T$t1soCN*Urt%f&*Ka$hHjq}J7hq&P+#5<PYs
ze9w^UR{{4QCMb#`rcdTSCmJ94d!f~o?Ke9N9ES<FA65Fpm<U(g@9ImpaXi$@ATSZd
z2G`Re4W%oQ6s}V7LkC$Qk4+#FUTgoYs|3CSyN349P*k|5e!0zZf0|=KM%FyQaUGK0
z5AuI?&9$or`(MV^bLj2NdbCAy`>X#6!HGE!bzL7UGM(&pDGW3P2uzT`W8h71cf&?U
zbB>p?tIG_wTC9L=BKDf~)JN$OD<XCl-(ZP)Y<TFS*0y&N<z{I0gMTzO+WWmg-*pX<
zjMzB#^q76VmpzCIyzfP%sLdTc8>8s3b!1!278HRB)N2Yn`g4R%O<TP5xinoDv@DNf
zLI*n+OiBG&XQ4MCN;2{nb<Jq2o^ap<PD1N2K&VBk_RBMg&5*#foa(YS>n3i3UmEO2
zP`O6KE}r{olWZL!4(dW&2v-l*Z}YO+(^Kj7@|w9#p5x~m3px&hRrXZ*Me<fVs?=7K
zuNi{s`*^SS^E@lW!*zb4b(tqvfq6!P1SeAGPQ@xK7gv5^BYRb5n5r8GU%ZRs6od{N
z2_3r}+29_2X!uKBvENxD(QC{-X!il`5W+z>NU5-y*XMIb2-xSr&u@rCXp8aZKaCjT
zhj&SyH@US%O8?4`n&B=r!b}(Sn!FfeUTV!ynN#qb9Cv-a&b0iXllOW7H2hv~Ckv(W
zV3edK;s04yK7Lev=$|qWeq5_A^yJ>RqT2FRr^<EtA&vafwCkD4IIsJy1s9#|R*`ml
zDkY!m`z-dRZ(8p#$JEpyoHkWK&A>3>xN8wUFx!0^(eqH50NyO$R;-<Q!B=GVyTEbg
z!h4CEYA5q~%319*0t-9j^qVR$m-FB5oxJ;tcu4?c(N=laX2mg7dfR*!jjAu!TbADs
zq^aZPdeG5LV`=>7Gv-oyy&N*d>lb?F;<y;TWD#-0d&kXCWX@JgsJ6b&dGdIa;WlCI
zy-ABbQ8u>KF1`hg606+C_^f&Dq-l99QT&!qLP=T(UoQQFvb^r&+xI4CFxnT7e*Y4n
zzfHJ$@{YN^Zt|jb_F!Awre19BdTsOf$r~Ei@XF3o0o>GUi)E*EiXK<A{#gHyIf5<s
zEk+xDqlGT}er~7;eqAve^{89?fZ!TTpZ*K9%IMpx5uLxE>8(_DBxnBGs(B>Hv_;+)
z#$^VD4e>g-WYbgp++1JHA0Xj<)s?xbmh(39K(Ee{aQlK+a%yD}x@|Q7(A3@i^rP<B
z)N507qSV3^GUF&R6U!iRx928#VfmOR?4P?WI#<peicK1%M{ZHVWA+_WjlS8QpQx-K
z5zLYTS5$E!zkgePPJahvrw>Kx@(Nj{u4R0k{x+!gJp$#UXJnJ%o^S{9j#T<aRAAP&
zgyel?vJJ>0`2Ef&$L>X{GrCzH#X09mS^N3&LkNcJ?5Pez7i2YGheeaXi62C-u`H4|
zjhXrgf`ne!#rM{F)a~(`=XgS-db+P>3<G#c9Gw(ge6_7!=Ue|ulhDYZ*uEIOd<5$A
zEXp>P+b1%9ahWp>$~5rS<@ph;@7)q|6+-*>W<*h5`vj6!dCxN5WN3WLXMmeZ$+?@y
zP{Rjb^|c0ipQc~49*Cy=?xn$7M=YY}WdlhOgYdNpj^60v{I0t$l<2SGbkZl2qmNEF
zvl-Ja*2Ra|dL;PXDb5ry*7sRA6}w&8u4^}pF5O&~nC)y@7!k2(TZ%^AL`WEQOW=!#
zv;U;eDP|(XY#PYVl+II~M7a7Y|5z=@_w@gS^y+aW?oA+{&j6S6IZ`Mv$U-d$(m+Ki
zsw*nmEOM!^_Q_QwEXFfXp^Qsc@yF#)RT4a0)GBolXk*xX{WU6%A<3)eGq;72Nc*zB
z-9~cTvUnuy-QOxKnP%fEalGRCB4xn<q@44)U(kl&G<)sRB!TOcFau|-pHuT0lPg1z
z>0jhll*g?rFN3XGvVw-T9L*ytPI@>0tfdApq^P_g4Q4_$`_YAG+3$Oge`+||z4f?i
zjF}4D=+zBsqW_$gec6ce!dArdF%zPNsc!+Cahuu%5Ep;MyM?v27B<IK2jImsqf^N=
zA5S>PZO%vse!;VT<<Vo%E{E#tOT1kUv=IR<%!D^LHUELjQge5AA^Z;i_x7{RL%!XI
z8t67<<1aa{#9VG3j$5X;F?4(2Ug6Q$MN2N+XU%SH*?1hpw#p1|P?$I*vA1>PN~O8J
zt4}{;u+Y57>;Ijv9AD_-_pUtW;8=6xn{5N-kAAYg?JO_GaF4JEK}EhAG6H#eWLfF<
z;LPJZA~T}r)lt{P=@p#%cE|e1u;T!GPpognoBz7?IQwF;OGz>pba2yd?Y1pDX{gdV
z_|&D`4K~*Q_3@m%laLSkE+n^9W9MYz<V%b|!bYt*e=gu*nUi^Zz=m7S!6ljxdVPA5
zG<`cs&lMF8T7LdgtzVtPFY@yD3#Hp4w|NYf>K98eI=gub4u_XZbS9^Mipmn~o6^3Y
z#gLjSPx7Z)^J_-REh}E^iCjjWVGB~nqr9LOvIYc0T-X<+1><q(I`VHthGWx|2G#0E
zR822hvcy$o)>OqJ+T7c?umlriR9)`@izU&T<48c`SDk#;7<ziU9RF84;WiqVMOKLT
zJ!#h+#${n9to}5x-kFv6o48`f^N(J%x3(i*+AStaetfd_QyL0|9oVk5^{f>e+d97i
z-CCd5=+5O+i3vLtf7kPPb<Z^Y^6fBklKRi}dblp~3`+jH*StXPX=@-9Zfe=m{qM9o
zi+I1dhzYe3Y2|x~4ltVZ85&pnV*I%GcpWx&+357xNj1Pmk$S`Mm9JM=ke;QUN>8F{
z?GskK+Hn;7BcZ;jg%BkbuZXjVg5}5U)Z@cQpUo}~X#E&_>^G4E?>eTM?<m@w@pdQ1
z?K#%dcNruS0B-~Y^9?H}0G@Gw(j1s@g~QW{3D=tVVDh2ny94za>5@6L|IeAaHs224
z-CDYWhHgy4Ss!$rOO)=h@yI+NA2Bt!e?u?UO8eSl^967=VC2>Hld4)lgYqz&--R<^
z<{Qn6vfA8P+xgo)@5MAvN7U9yh?4O~u3!5qHR<HcSCHT>Ap<!q&U&$V3bH6znHt{_
zGpx=pNYQ5Wr&hy3=yLi7kY8$iR6EvM+Q0lZobpmEH^6Ds8QT^2y=W`tzjp#ZQGhn+
zc-YWs8LmP9RUD3{^@#C`zzRM-k{V^f@)(60ws3GB7;l%JsUHhM>toM8#Lv?_rn*Bm
z4JrhED?bHRs1@VVvZf1}$AC1Go?%8tOoj7a*S&3lKZ+KA9{3v9y=o0x{-&ztJ~rTq
zw?dyqk9&W|4KSkJfm40s%Qs2zIH?q%pmXdIpcmdftd3R?|B$Al7kp*7t$zb{Ogk(E
zKe>5Wz}|%yA4L6VOib06_U@%5P2iDlgp)`?QUy(iWk&g!Mh0UPBd%3Cd;Zse8dFL!
z|A$R+SEe_8%BBtjMsh;Al22A6-xudP=X>38V(XWb4)`>CB69d=0h>XLh><OKtId70
z)*Zp(w51&jbPiTK-`2P3*DKXhGe`)w6ttzG7TS4j&!wU41#w;thT~7~mgB=*NBl6a
zA~R|@KLHwnsU;5udxr@-yC45YbBEyB^NPpWj5)KiAj=4Nm23Rc_bpNiElG436?W;d
z{K3!8i0KxnO};<7h+7xtW?N2xk>F8nfl^waQ_WS-Sv%7FnhSd?KmOz7fR4&B+h+Xh
zwsQOdPdY@*G242jYDxO+11q)PuxxQ;*a=W|7Z!}X6FbyfnB9%c4}sH7s_Hfj5;w@G
zyPzeTLqs~s)iOMW?T+pFgP4mzap4Ty5tici;86HKd^4g?W)fy2sUd!E8l=O3pbOU!
zx*UnkOLuWN-m~QoS|nw056Ii)U?PkkzUpWdg+}QHVXn#pMV^gFVXB`rsGf4-OeZA@
z240*RJ8bpq;>#S#KrQyb^_ot93D(J8ecj>9qE{tXilUreO&@(d^lutNqeq4Kws#JL
zD5a=~iE=I9NK3M2%*!)cD&1Ezb04mv$L1&~PieljXRrEh9SH@>u|3m2zTd>BM4u|0
zy~LMs10k&{`7HV6bS6Pdo;an2huD-k5h<Q~kHRX;utPb%j#`E-{i#pMwB!A-|0X~l
zeV4F=TKw$unNkc(1Ar;-8kCkpc$YY1n?b399l={F)I;0({@v4OWjfDv)R5%-2dwKO
zFH5+iVDBi3YBkLL>qj1Q{S0(4Bcc{n@J;nxrL4ez!e3$_>l*<L4pg+?WLl4VSuYh{
z;c7t6bGP>O`BH3`GiYrn$7g#T2K$-qRkS7fFqgU|b{Q;l=Dhkoh-cBZK*30ZCj=7q
zm?G&jX59O;`}<gJ4yi|X4qwO=L`U_gA>~hDK!zd+>dq0P25xbC5~5vNk3sEg?MVF?
zrsIQ_+>b6$<#YHia<-2M8zO7Rj``q23pz4KHp5{k@@Zj?rfqjtoluMaNlHaoo~i!b
z)(9_9<&92oCl&FNbnK*9XU=&JHGEoUP+|5orP_hzFw?tes&Tv~3U=kx%3;XzsV=F(
zD(QS#L$SnxsVqlI{Hu6%<I%^~p?ieVP+h6EZ}7Y!{B<c+b4kGt>ibds?5ZV~#{*66
zTA-GC>jsOC1-gxPeWb^G!i9b+2z8SN%;`1@nA1@^_3!9V@@bdr;Xh0zpL*M=@1*Eb
zfLgQYp|H%nzu8A#eqy-kJwo1qBfhtXQVXS)ifGA=GQBpU;E!}aw3t$6@{TrLT6`4L
z&}~B4JZQiV%J4^ZneWbKRIvo@3~I=x<Gh#li)-!f6F`~K5JY4Db}!m>eXdK3c|teH
zX^dQ`!YuUMPh84ZJoe<z<6~w@;&kvrO2U#ZR$~R<pQACLb!w7VgX%k9nsM)83^5sk
zc!tT;>=X(Ja=RLh45erGr5pCsH<#L+)}<C0*fC!S-+@IPV`vOId-qz9UmGc~n(#2A
z7YsFYxoK*wp0BQDeKj}ZUcM>|C)1ec`4~9^oPj_>vh7eE2`Dq#tNax*fwrdu_46Os
zt1w|j(x69UNQ``&s{~XDF3@5H*S{p*1w46w#&~j{u*52=G4{-qYwc$uHbf?sq})rS
zt&?*0kXt8~TYxpOmhdFr`@zoQZY*|{IGr2A^GPpS#zceRRt9+8YYG5`^_oy;KYwPE
zPph~!5Bs7eT{d1Evn281<|(mO#93RSw<s71W^=@EHU|Z6L~epk#=XuzSOU2)LFc}V
zyM-OD;11Q4^RQlWL|N$B#eWBL8qe{$*_~b#=h6E!ylOjqnb%eDuyXN5ikQffIi1;|
z+sDgNcLqdR5EE`*blo`wOEl4-cADH<Krk15<;;EPc(0jbRfECu&`vDlj6F0_;F&gZ
zpU&r>>Wn4IEyJej^BFcP0oIT^>N1^#mD*9<(O{@;?fnh}J_de@zF*r5Dc$suTA?tH
zU-D?lCx@O==;;M(5@MqKu9?!=JaMPC#A<+n3DXnUs;v)eDwiA#7J-P)7|TXfeg8c5
zwsvpa-!-1R<AP|TOl5=DzCM@Bt@57O5T#_@ru2!P(_`2AHJLA@^5lq@zCAJCy{G>j
zHT7eIwoSk|8X#PL3j*suHbhFNU;1Ki{~_nX<Y1azG3Ve2^yV2iVpY&>JXp5-b)`|O
zFMf(24Z35^x6Q$wP4h4EH(8^WPfvsLr%YG=x>FbkoVGu@3M>LbQD>a;jH++*U_<N<
z<M}AIsDPlc#$CuI%RbNu8^V{*%0UA!dn09D9PI9pV;`CloqKxyUzR;p;OXW&uPxFN
zraJqiymI_8cm@}tZlab5XU3(#p~qOw-=As=gzK{7(!Ljg)`LM3Y7Dw$57TpmDohvB
zu*FaI!*<Mx7V+F;!hN}fL0n6V$oufMiyGRZ;G3J@I%KYSh5P-(p+K%7k!!L`-;Kmo
zz&2YvFyJ7o@Yr4gkx}sg6I?OiLVJaLG1^9!9Z=J&`CPOM>`j1P9a(fj4YdmSGCl!`
za`Krd{5#u4*SLv3gS;5F`oh&D+fJMV;}A#R`trpd>w1vQVuSB3o7$sEUu^%=<yGCF
zK&pkWlFCMn53JB_sZTFC{v#>Jzt`{P{yg@K7A}>VQN(DIHO=~E&SXSn;&}#iS~8x1
zABBx%$LxGQ;Azf{sJDE3L5mn{Ofq)-;j6#j0-ke2q@4T7KhFzqmpF+o&1jSo`vpsH
zo8D&M>zW~g8kWzV5FC=g%KbC{kd?^Y|7!o4L!yiN*`ETPX}vhZ|Ba-u+H%;OsH{NI
zP!KxZNKhbG_pxP1!7j4`@lwy^C`;I@4ZHhfeaU(;?U*MQ=6@;fN~Y|3up72qP<fE*
z9iK)NO1~5i)78pS<-P~HzY3`ke{URiXNAd4e`aY$uFPP~Kd)yTR~HX`pHma+jzY*k
zFy=3yfg|TqaK$YS_guO9Pe8uD+e+H>+f5|!+VweDG@8gzOOgiF{<N7;yHN~Z{s58I
z?dEx7^tc9P7g5oS?7HAYKp>ZbktH)BZZd7aRwT4OE4Rjw^>khyn;mZKXcb*BaQ)(z
z%1RMX-h@TKP@*1UBe@+|wvSK6skhIh;d(jd1q9DK{7qD*6xQEPl+7*OqSSPyw)-j`
z&+2zl8f4#hRT}uPy6aRJXWF>S;cjLW@}`m-C{=zM1J$l{cjV{KqR_gB8X4s4$sE6x
z;Mhmsc<=4-^efNxCFL8uCBoA|S+A-wycSTT<nN~ysTnL}i{`BTD`9;ddc{-c`6I%+
zPRtM}nCg>(FtXxJ$YAL5&vAQw=UlZ6GQv9L!Gi2;M+KH!bPo0Xum5u$K`S5bVeqte
z?`3E($dM_I+l_V^QHL7(muOk((_cSvE$Wx{p+%@+;iVYo5QD2p^C+Md=BQ%=lHP|V
z)QJ0pyi(Yd>@Pc4a$+?R9aMf>N5GG6=i?>Sli;1Yro3%FsBkOr`NL9l^_$~7W^iH0
z%K&C<R44a`#eJ6hDrq4ShC-841D)-k?`p5hU7uC8r*qi+IiNWFNzEx_VZXtFC910U
z5hq1q5eJ;vedUYBfb^zEK6K8-jjm<gV#IW2L|-3SZi+7hL9z@O)Q<vH{BIZR+oEuJ
zxbR^s^)Ka?(=f@?z^U0da|**C2DQVaixA4E{hzOjsFQm3SM*)Ducsx{k6Zf`7`mvd
zo@sLvFyiL<uz7*%fqKYVj>_l(+!1cHu#I|MTmNO7s|=_T_=DPfWJZ1y#`Tm;JEM#k
z!6+ly7H`pU=!<Ss#aadG)04X==4UTxV1rUY(YhX2T<n&n-V1)bz)<qm3N(s+&7rEo
zPp8trFWRkI|IiyG!xld?p6dY5CSYi(ZU}k`?Ze2w|01>&l@!apI~G4~S6(O(mD+MY
z!Luw-c?K2e4Ms5mV~f*kDUXnAc`M}V&=-I99LI>wav(M%G8R+vCCy*n%CuATKit4d
zQ6GN}3ec*b2R}D~zG>gTQMk?NYD!E7A6)*jOvRVNHy6iYAey_yxc(r;Yo@Cl-!(OY
z0<bbEPjN2`LIkvsg=PCvck?u&^HzF~)2mbKn^L%Aoj%_zJ@Ht-WyQ*p%~<-bAhKwM
zOGcZl7X^zkuNN=h9MBC?w@e(#XVS&fiDZ9&{&^c(9#-E$^;%d(a%}6up&&Xf<@}fF
zr0}_68s)EWD+5=ma(wkF26oUd$p=TbA+Q7{!it8Q@x`BIIJqV2r%n$B?yn1`IhVhF
z>TL%Hy#Vn*FIDP}{L|<cFOx@tV3Zr;2P>F4j~kYrE|5fv9ja-cUm;3zxf)uIkMRN@
zs{e&)3i|K(Z+7bm&Fzi~%-M`yqD!?-B87N><NBbm5*iBo=~FoyAFdm8iS05H3*f-S
z706Ybh1J9h`2TUyvSN&`wHGNn`|{fNr_wjjFY(=RxycEwbvzmgdp^IU8>EJ~)F^2&
zBT^`ct`GcGCa%)Vf3C3}i`KU|y&cRUGgg^Meoyq(#5|rQTO6oLbei<IE<{T6roVjx
z;fdC9t4_`^Crb9N1L6u<lV7gWLbj`6KvkqHH7ze$FcpnmIvKm5y;@m?*NQiNTYR7<
zh`AJ5zx9^W2!N}EL?ExYnA32_efTF=|GmE7V{b<Es_yXgfvC>E{Y3p;<*q^wieR@W
zGJV?Bl+Tf1c(LKX^lxX%-^2~y`py32O=ECLKMa1FV?dy{omsQ1iuD!T9nxfwc#O5J
zGIl<%a@u{teDVtdKEJ_IYJ>fd{_ulBb0*!7Il7G+f@0jr5o2+s3~kzG%z0}@L3CnD
zA1Li|n-jfi8u+$dP4&;hFOJB7pgz@8e9Y0E7J!Aa1edI`k$}FC>;LH5inoeC_1R(q
zs_t3yl-a}D#fmngUVyfPV9-qK!R?<NIf|;%F@Kmk`M`f|Np8le9dr-v=_8AEjkWX_
z*g>4q<+2XRj|))f8sG@osr0>BXcytsYbU;7=#=j2rJN(K`PLSw%ua$VL635H1;ZJ@
zzJ!O32)qGDcPJRl=Y%TY$X<S3z0ot&;Pxfo?;^E==Fc=+p;a61?1iPo%xsqms}=az
z${V0h_t|R64{4SD<GQDE=MT_U&hi3VI}a?p*gi5R`U|yxAtIelAU(@W+rYw9$?%rM
z?QvvFE!lYOynfDR7v@q0Oi33Q#4AZHIuLwq<HIY@bcWx;+coAyYZ+M0A%9g0Hzs2C
z>~Mc4YPjjQTf04_)a`D($zhag3@ie3jRTwS;&iI|+77FpHKz}*53k>|@w8rP3PuBS
zbBTYYzb63Nxq|gYJ6&}oSa7WeZHCb4DqadVQjgMsG>ac@bI_r5s?y<a)+uYVc&fGg
z3BKEjeA$d|mvCz}%A?mapHHAUm#X-<a(tqlbFM>V@;F6|ZqPQbTLxkOMRibRkg#e5
zK<;T{U$3dblYI=4Gz?#<tGrni*M12W&SH<0%<o>_OYC=P+0@hR{qk9k*9l2wRLOPJ
zZMjoo)G3hU?XLGbnvdEJrhbcj+zr;$?+4OJOCS$*BSFLn{FNoJLV+GeRN{`pIXOGV
z`m}a_g)H)sm2^P01L}oluedzj{fL*cQ1oPuk+_L(aYe=6DEkka0WUz44oaD5M27>T
zYI+Aa>^uQ|9`$uc!r7aAU)xKN<t+ad%s$)D@|%xjFVj|&9L|}vk01SEswSNMen!9(
z9VZq?7WbjF`AWsI&!AL*-2J?>Zw^6+Al5$<JRD4ZiI%Jmr4-?+z6&ItF6RBAmQX`7
zqhLBeRk~gL?srB)CT1Bb|NT+tS$(}}1_6cYzufN9ZT0Qn_KSlO<o!A4%neoCZGT=|
z{yVGzz*Dwik_;Asi2T{v)4Wk_bI`-m>;CnMjIiWx28H1#axQ<Km=_E&=TBwwZ0ZO5
zH#O&HN^BC%w6t!xOG}zLA+NJ~+>L!j;7F55*)eKz_nq0kQd1!Nd<pV62jCGI!Q|a(
z&L6U4Sbg-64gT|&FMX@aa}NB951S2OcJZ_F*L$EHoK6lX#FjGDjm3~_gKcAG{?9$~
z_vUYG?YJchkoAi29HCqKK~!L1#=Qg`LM}~D$|C|1-=pzr1=@I7ffQ@gWAHp`l)o$7
z{!HBneAFU&3exn;t)fWNN&PRFxC8xbL&4r;MfTox<84nCZK?6|>5PJqp4;He02t9z
z%a*8Gd>L_uD(s2IJ0=^Dvkpgrba*exW42n;Pn524Ar2MD_Qlz$SjqOy-?I#^YCunV
zE9l55xaSts4y_r7i*4wPqhKd2hwoCJUo3>oUZ8pzd2#O@*zSYn*C%O7YKT4a;OzC+
z(H#)7JhN@lkqA?6_-JyBapn-uu$k#Ze?>~S`LSka_UfsW#37a}5379>LT2R?u@%3+
z99Vh}Yfis&sqOf3=)Y!Gx9(n4L59~5f{pVemG5Y$zV8N7^V%uhTXtqtcw_NpQrjd0
z`-JU)#C$jG?ROX*-qmD&X<EnZ>t^FS)Ad1)g&BzI{@zvLjissW<cs#VV2ztd|Aupr
zmnd%>H9P(XqBUnc6Z`gG^SYW59oZU11|k&3Zyck#Jn>#J6FyCSW_13hZfxqR9N%M9
z%YRp1x=n20IYzWZ#fQmrKfR~+h@~XX5}|R-r`y1z+!X0cC^#dbV-B`OQbjrbT;p~N
zN6TY)IsPGNRB_u_eSHcdt-8_os9LthelB9bxtB;fT#k+8`5#n-f4q*^E39l@j79}A
z$vsq0>^xTRJFM=J^2hBAl&I_nlmB5$<l+XX3w+1vD%$I!@1i&-`uMvV3-0~FujI)O
zbO^qKBbVw^iKhB*6OBd2_CG4|dA%lkRah^(;w;CnDnBinj+dP%<wX8?D^kbJ$`&{0
z(Xdy1Y0Vm^w=wMBQym2>^I@-AFw+9xx!D#mSh>qWNro7V<OeN#|4hAg!(pE=ie?2~
zE2}E7Zg>7RORY`H*iE3#iSmqlR4H`pwT=D{Y3MWk19Xt0nP~RQ2KVzWi@KSF1uBC$
z@4A2}*oou*qm;aO!{U#CQ{eT>pXmSyB9+wr>$m-<rSls}V(XeS|H)SK2y^ZxZHR6b
ztPo7Mz?{>Z2BHAJ?7FvubP|5XMEHPCAyFmV=<7j9h|OImw4|0)Z)XvJLU)cGM~JR;
zZ$S+;zDHH~G&IsA7}1N}#b%GQ*N%ixHE=fnHqtQ{PpXrvnj_&gR}7D2e<V29ouC%Y
zezKn>!IGq~RW|;M>1}`10gH|_`i9=m+=MQbcn=l%P7pQ1jYL`6=@9S1{+Na*+C^EB
zgwJum+mVlU3K=kEjY|`_R^Pc%dPZGIJTUimaXG83$|7K>>?lcmXZ|UuEUZ1eIl)o;
zWJ4(LI);l8_i{qZT5G`j@MY%hzNYB{`<uTy4Y%j-3v7NBcUvcQLs@QINtAxHD3t4k
z$|XEnb~BBP#u~FyF_tn`X3f$ODgr@@MsK>|Eg&#zi2EL)W%*}knGl>xy2H%W)45vG
z0nTm^DUsc=7o|Ta5${)#%Aq3dPLX>yF9p3SWy@s<awb)j8!&A-bU8wEoAUmbo16|&
z9}+TzRGv&e`#B^?31cQSd&-lbU^QBD@bE4k$n0!_quKobJ(Px$toKLyKkx^Z&gUEF
zu8owO!{QT~`>A%=Dc(Po3NJjI2F~tY+yA$blC|UQ_?SCBy;mA~AU@SLTI%Axg$kTW
z<EGz~x4O(dAnTQkg5`V7LsRk+4FMvLkmNlo{(MRkVii`Qsy9OB?qd03Z*DfCGr&x>
zMkD=sFMF-ny}sr`z4D6(EsHCsC+H#ltAH}~zANn`4DehQ@uEPCkZPZHk4C}$YldzO
zXxzKP02H$O2g_``vT?n?6KDxyfT;81>y6*lE;VHMhfg$;F+p5$Lgu@Y&KrrCvG|D<
zv&r@dlS%iM>DGM(zB8KJ{_$RqxVI#dtiy9ae{<-l3TSnncq>OaK>fRe+7|Biu>W6w
z^%Uh^OH_{Tt@T^E{El+k*}bAvVTcfq!2}O!NyDAl$l~UUG1Bw%<?3{?H6-IR-UJU?
zv@IslI`n@JRsJ@P3N$jHZG8Cx1^Y_{TIf`EK3<dxborrg94@FQW0p7vU|($cHf8FR
zftc<-!t8Q6YcO-_n=2-I^A|p<&%}rOzD-Bf54g0X9#bAr{pj`zr}QmGz;r`(Z&8CZ
z<LL^vbH63(5{xkC8~+<QEqcD~ZQACkpr~hS<`;#+Ggq~~>^VOe3>ix^Bo87Yf=rkA
z%MA=gK=Y-tPd&)dIl1Z6s#VR<0r4Y7AC5(S>w)AFw0dB|!(D0mK_h?~17~ok$k&R`
zt8MI!K4}+zpsI8${jv56kDrc<e=T1ku0NC1_s*uSFW(5{UmW}-q6O+!4K>0ZH+qG}
z6R*qxw1alo29s>tAe?x_3_u)IW8iQN70Isf_}kj*M5$UZ0h>%#q95!z>(w}*Y#cbZ
zaBv$YjQ?ZyFo4KJ$=<rLsS;R`{H$rpLb~nC;Z4>!4fI@sn;FP=!kz-nq{ibe>Um*9
zjm4-uTGwShoztV}J?|&d5@V}+;_=D2rtBln>(dSM+wQ!Iv}|jTap#kbtWE=waCY75
zAIVBMpj)OOah^=`i?alsX%CrjFY!U|s2WoFu1KO2)?fPUPUC-<OZ1>0&f)oSj$H2t
z+pfwjj##l?R^}^KvkN=UrgTrMe=`?k?b+Jc0o_8cKz34!{=?8$JxRF4x$!WpclHR0
zq4T`B?a7v6TO2||)>~pm#M|woug1U(ERm@Gb50#oQTv-07}s~Q&LivUp5IbUWd<+O
zY5$QrEz5D%yUwY5)Km@|K&?9()o$^$vPkn(_WxM=3Wun^=WRMAgaxEqKvE>6LrS`9
z>5%U3l5#0Ux)%xQT)L#YyOxq}>H6Kz_kI6?bMBopXX2Te=b-z&75btMP<G`qn^vQx
zX`kf**VmJ#V1cgfh0?N880fSw+-;7*EY_&%Rx+;SJY!C#%@tlcDJ#M8Qx^QjypWZ;
zDbgbaDofULG}kUDZv+C?WU*KO#Z>@ZC17(maetv?Svc7~?<+P@ngG2}F`nlm0_IaP
z6}3KFeaUl`IB9Kf?;jPsax1>9O{o1Bs%iJ5<7ywgMy+UQs$zV)U;!e^f&H*D8H#E&
zZn=0M8{=g>Vg5E>V&J+P^Z{)9K>i9a|Gv#>iWM8Jm+h`|<MU%eDl08k)tIizpJYh=
zax<kt_7E|$hdyu;P{S%!qR3ik6>%6`{gTw+cP$Q~Jq^eP-0}@N!<<PjfM#D#Q)&PA
z<#Bo5K`AR<P0RIHS*B8;7#92tfn`|Z!gcx&rf(21M!@A!(oN&YbhW&=R99(`==Og!
zlqFMjU{l>*GO1)yN8Y{Oj-SGND~|x6sMjGF{r|rmA8TILar}n!$HH}lQtWJSEz^*^
z_qs9rC-l-gZ){!0!IeZ>UTEiF(K0X=Rr;{@8sN+^chFmk{8|RMc@p<(G7o^5Z3uvb
z@NLD^I%JxndH2+W{^yPxyP1|iO+sm6EY<r0ZLykV&ZjVfb)Zzt=a@BF8%Yqvc;!$#
zb2l|63(VskS=8_Yv_?xk4G)^zUtbe<8~Gm>O`)wZ{+B5F#!sZAV*EEz14tW=$#<5c
z{_tc^fB5!{j2oaF?G|3>c~@v%HO6B?vXWT;)NA5-Q{5s!hjrcNCI<`?$7|UQPbss3
zfp9u`#eo-d2E3{ph75FeV9YuJ5NkSL+>7N!^RK@D+(jDw$pR*yv2BN!yq#B|LjICq
zG&6$n-i~uyIy-e$M$owwsP%q{mJ~>4wRQFghnEvwq}9l)(IDSk*&+g){#2uh2Ch}?
zxQlRU>Xvmyyr@wVXt6vDFQ#$(8PYnOKDSnUi1h{39^rB0-G-I9tyC8UdM`Vv8h(bN
zGSH^^6IS}uaHQuV*)@M#Uzv^Cyxy}25kR!|%<aV(-_6054v?Ymw6ITl#pI6uEoWKq
z`t_jXuL#C5BZ%#>c_WVR0wcV*6lFgFuF-C9js~-FUvslXpzOF$S8CM@WB}5u+S5OD
z*u8+(3<f+#Ag_?dc0AD_cwlo#NrlPO@5C@8?Cfk~2@~N3eHiiH5%lpAWVZE{lCa#N
zZTmF{%ypTv>8{m>>9yL|AI^6B0Qe4GAieWr?+@R#&vUs_Il3o_hnpToG5>SDs&()+
z+Uj97lG?XvQGgihiSY1b!?V7X8p?uNpNodX+P;_BZzm42eTm;u@*BDm0|Tl`OyS^x
zkxU8lMCke9z2uWy)NZB+P{skD%8Pw+N#NINteg@q4GR7v*mL5^j$ha96&n>wazs*V
zAtm9_By#Hu{V@oP&zSyP5!uOz#cR^8MjPfl{^9}x0iew1gWpWXS=U>MI$ZPBXv~fK
zgZ>};P@`L#cuP17dVzj7o`%<`xg|Yy8L0yUb3iKdjx`Yz6=>(AdJIA``fA!kcErAJ
z_P9s~AgP;-rO0Zks&BX7VC-zMa}l_@UX`W-oILcZ&eJWrD_sOd<*n>L#XPGSIt|?T
zpq;%#zN$;APt29h0d$Vd5k4Csz_{Ig5tw$_fXxuJjOaf3gk&_-*+XW(W~ayo?kCed
zuBNbU-6upOL2-HJ*qPdFs>r{pT>&T%tO>8qRTF=p>a4B(URV4vxkkS&1qwFPXS90X
z=i%W)g%!;_ak}~q=)cQp^wJmB=qV)yn(EtHQokYtE+H>%7qf{O<09r)?U<XPEMw&t
z02u;4TD=<1_h6v!Rq(T$)Gd*zcrOY`Rbf+{WCqW}#e)o3)0<r&gN*?SUrO%#z3loe
zn1lytUiX7$#6<t+Y4Xg{AR?J}D$dED=U6Ai#78K4ALxK&okiE#Pww!D=~GVwEW5hS
ziLAt7LMhfbyyV55?M9CoSTC!`yaAAL@`_<?KL6TNUGV(u`)V|B8qsjeJOEl)0QvS3
zrx&{JGD@~3mNPXF;AV^k5gF(<fVHi}QWD;*+NC}-sGjz18dJ@v|Drr-a*)gu%`BDV
zGw5$!fukya(>9x(BzMwkzbYK?Yxs`3pZp8gb&Ag}BX+e2c4`*-2-7_ZukL&Y<lT3I
z)hU>wDwsn3pbfq`IOu>L`il~Zm*`g%$X;3-@U@{n_T0~e=`-F<sQf`+P)GVI9q3@d
zBO5D<x%lz2ecPf27<*k$4fuBCS{SS|5Bvs^AO9Po1}NL*jUHgh(AL@S)i)Lhcyq3u
zyB&b2iB@e2cT#qc*M@M&*pp;+rd6_SrFmcx!8qC}WIpd+CC<zER)7}@cSWBaiemow
zZ`Y!^71*L6-ty?!Tmhvuatz?rX<nt19}t|Q`PXH|T|o+a@~$7AmRABW37vjC;{+;v
zt>XmepDRs9>MAeqrQH=Wl$Ek$w%F%2Bvt>#QC}=j>j(-VhXaN!$smpGEfijcNW6ON
zksQ@9nFg3ley}j31*siAS+(wF?L%@!wQaU>Qxq?aFvWqO@tEo6&DXN*=0yR<@=4z|
zhaI{m(#OJD&k=J7KhsBnm-bXT8Yui2d2qHJ7!y^ly@YIvSKqi!_mfGndRjii3LxLg
z$OP|f_2zNy9*YtWZq0GNOjF`|d=`{nIiUP8Jx<LQWRUecQAogrc#Lzf_SqF9?$2#j
z`GS7-@=;*1;Nz(37Ah#3S@${gm_uyCf`rZPZ8cg88*Hd1ju)ftB`b3{GW;dlm=gK}
zsU2WkVd$51xrif3NiN-SzubxrC0}CoLBl<zy-kwvaHw}s?(09XSyZ$lB3Gla;P$y=
zRQ3cpc@177t!Y>RQ01z{`)dDCAXLAxG#+dUwQw)kavQK}{O|VIfoU(9UEZ+#&N1)h
zt4$0v?>-=YgQ6;Y;q6~Bs#hBZMB~+DuTfvdFHAGYB9bw@b;3TEb!AhgrKprw#qeT`
zHmXkX_N*9(J|Xf)FwN22h>pj9z0magDLoaF07tg~Gg;~Wr755xXXNvaKlbGxx!<-+
z9QQ8;Mp5SyYwKqQTMRpe$fp3g-slT6)ICZMNAM*y5c>JvX)9qN0T?YWeU==HwzF8$
z)L?v*7n4Hi=b9B|yuL3xaNWR16l-EEk7tFyZcc;`jZwgmjxd>^{(<G-f4a43#`@||
zH%unGkL+lhLV4YV47h;cX|OGOrN}v$Gz*leGr`tm?ZkKLf&IwAAE;oectsuAp0hEt
z70;|oF9NhKPUz94=Pm;X?Hg47X0PS+k#(<Yn$ig0H+E<K#06mj5Z=A^@!BvrVUe$M
z428FWJX7yqq7gYX<ocm+(F}5>C#ef8T$LJE)cJp{sDOH2fiF;>);D^WOC$&+O1)GN
z17sn<%>Ob_vVBNuLA)Zdszx)SL|RuZh0E(5)9_W&a5g2Ge`fm5i5>WXE0C<`OVpZt
z(B^+3;5S*p-;z`^AZM34+5*P^R?~*a=5W*j?LBbmvaTn|z8P7H9w0I(ymy81M-IFt
zH3VhoOb7|&Pjw^?q@cd+=X0uy(XIOQ%Yf?i;oIHiJyD^iq4yk|b2Q-(0J9(!(5^wI
zAyy4^=8U{-$9LouU#U(60;@Ee7>kYHe>C34?D|0{Mp#mLcjZ_TumqHn_{ENX-FpL*
z^k$n<V3jfj2(R1*Kw7HS(Q_*=0wi7jg`AHv7kdve>ZlEJecHuzhYn#9gI7pM#-PU%
zrO!tOsRUrb8jhXJhr6(<b1muVEKRDCsL-!yVfB}OjpbV6Q)W2o#Z-3AF|#e`No~4e
zVhR+#FL#sOTjsy{ty-;Rh#Y!&tIRJR$-=Fi@|GrU7ZXUZvbwX~N>4wu|LRs`l4dfL
z>f!)q#;ukYa|*O{p4JR>gv9tovdWrautAIe9Cp_eu*q7r0SBc4FfeC<)5^)B<*br2
z(G`}}TVDw_Bd~O2wa<F>KAdqd(&f|imBtC+BTXiemEYkyNJ&`#8>up#+iT`)w}hV~
z>09Y`usZY-0bB)1UrQD0D<2j~7jtU}?P#o40^|!qmn9`%+KJ{{S76Z}?6Mo@Q92+w
z1WkFWZKw5w96&W{d~%2mU=dmQzLDOyyd<rpUnYT7sv9O71%OnhR`y{rz~mUeN{Stq
z^q=B~<lRW7u-YCkPTT4)t0BbE)3zthT^UlLIW~A(5mwqSHa+VlDvh%Zq%Sj;F^Pio
z@1dPz>c6$Ku1f!&ZS+Z*@(U3TUjXuL1ek>00<6f8*mF!kOHDjoj>|Dsok>w5`$y_G
z{k%FqlgWQ!w_;HKP5-rx0YyCfx=GcK;bE~Pj0wm$Q-t?&2L>R_AD@}Y+nC>EuM9H^
zmo?tMK+u_9yvELClGoYa0}5tY*2M^5#~(Ne{G&;o%-xYHm8+@j@ToNH5_kB>QR188
zSCaw8;3MMoHg(h3(i8(^C!tiVnr?*Sy3}<+P|14m-SKlPNtWgt8-Uw(0ib@-gc@@a
zCJuPSI2`OMHJoF4TsRU==y#XY5$VX4Nu&+1j+mh@R!RH^H!0Yj95(1~M?EYn{>V?9
zbLzcutSyG|S|@!>ks*Qje#ZEAE5DO{Wb8q@`KuAg1P2S$C1Fk8W7@!M0{@e`Kr`><
z4ZF-Cp8mD1<^5^|+J9QfOk{T!@9Z@^tG^ifAHl^tlb0QX&xp>?mwBtYpYHUd$EWYZ
zimkjZ`WVOZv*(Pl^_T)3-^|~kS&9A4ttwk2esO1|1y01mH8I3jkJ8}M$f*eNp2*$A
zjl7a~W|B}f83=@CRGI+Rl`m01LmMYW_Iy|0fJJ0QUrkFjOUJc8jdf$d>FbhD8eo-;
zEU=NuQ^hp{b@E<FkrPYSJ)#Hp6htLx&u+fb|Br;)qPCh4)a1X>T{<DF!+(1Bt|@5s
zR<dqndw2mOun*M~@9xWklMfrsampHQ_o_5|82>ge47{rMuPsxn3^}Lu5_A)zMCCux
z5bA*W<~N*;J=MvnPG2OFP=e#RLn$24bf`6?<Haj){q3I)#E9cvRaNEZ`>-(p{HT3e
zD^|XWL~WujJ}}1<x(GwXVH%sQ%yT#{8}E3qc}*#&4$wD2!e_&{jrYc?+xvk7%Q&F+
zK`|H)6VH<!SbM$JG>lqbW@5kjuM3Yj?-14>x9>GGD#uwJ+7<=?6k1?{kV9aMq?h<L
zwd1igsBX_e@r~6xm8|=HWB!(gSiSrZpqF#RGY1;adwcY5<%@hbfN!eoW!<*Oq8Lmd
z!_}vdy9JGJ9j>OOc^zyYR|Lq06ZZ`~X#!R8*5y}!{3GjSnsoF62rKB-9D(Y!2eB8^
zaW$!0?&&+;YMZ}FBOd8-vz&Pv{R`gv99B_#GCxLi!&+7h%-+?%uKqB$SYV`KKKamd
zD{2rXZ7}r|f7|)yf{I|ZUI?YWEO3)*-a?`hJ+7Xa5BJa(?04W-+3cO=8Ng%P5>;lD
zldAZI4(lDPrA+btFtwAz>XK@)c+eQkLPkVrovXVs!n3ZHZ_|az=4-OIIZlO>&7JDZ
zOTd_4^qnx@8@Jge)}kNDA7WOE$acad176rSp(kF+ZXDU9EX{VtV<gj6Xwg@Lo^yVo
zuRO;6VnwQ$)Ek)Ed^gC=Q9HjBtL*<3>9cS(vvh4r_!{cAyI{i(ATd>mqg2FrJSU?b
z^)8(Jx7BDx{SkkZ>7=y(8#{F`C%>TisT*(rTG5gAa`>4W!KjT8Q+36H(9>dRcMzgg
z2j}orZ+See)^hQBTPOzz^NQ|mq7$jL9XT2>NdI&8vfj#p`*~%kk)MCjKF2p1U{AQR
zNnuOuCHwi@aS)PfV?|zZ^j`tBALrnrB5Js~gPnI&<3c}VuOeD+U2}JD`$~FXI7H)a
z)sA{8VkWkP{q*Yrwx53n+Trm#ZAO^lm;V^+h*T4dU@I1%0j{?Z&g$E#dmJ<5K#~s-
zW2jgy`H4*tOpJqX&cxw9+7e)l4{~dbun=>E>jO%Z@Xha5|6nWcAq8I1rsn4Ko<m@;
z%14blrR#ek_L_p5eUQXzSvtXMR4{=?W?JP_!JsPu*8V)kSBv4uvMs6x80KaRZLmEV
zA~N+Z{lC6fd*kS|MRM(#f(0~_*ei5A{RABG$+!>zGlsH;;V71cEJK=4+oS`y+^vE*
zVOB|IqVTulNgJsug;m}G_xTE|6=cAWy%fu+_r|(fVG39TYLXu{xV^rtCv3n9rAbuC
z;g5La9FFPW{|~M^I?`bJIA=23ci~P1fbw18$`$W#Hit|UvNm0q8(lsW$A_P|bcvKw
z;`f?sZc3$@SlxKx+yCMJqM$dY&L7(=17Z-ZOgFx2V6c)(1IX#<2(ajUJfWKa-C?Tj
z-KYvn*mLanVsPYY;hHO<G|*06U?aAD!an}!5DE|nO&89V`{4}&;X#YdJ@Hk@#3<29
zH6<NcQpTfnU|Ez7vh0%LptHhpFt^`4z{8<SVmxE+D(0!QDUpi|T<^5rP-;J7J&vAO
zQvf(jmgmiM<r;0IHdp+Q@oPhy?`<+Uo3D(NtOs~n<-erVy}`N|Ku<U;Vmu5d1IA~j
z8Hw$jmt_4@E_3lyK!@7D7vk6nYr<XqS;Nk@E27pfRyIfO(snf(I4ipJ0K|Tiw!+ee
ziNB$jDe<O5>-T!gYRlp#i#nJi)AIivq{{Q`cmefI2PYpEFQFZmLvC#R{3k2Sy?5r9
zCv`cl4SM#s)>$%wm;9a;@0aVd!CvG9X4Po%0_{K12jwl3nIUUdmu$4L^1=e&nYMd7
zLo~`g1z#iwetc}00+7Kt71Gn+0eS1hDk<^Lcd7t^22Ji+8C#9V3xk`K#J3IVM{B{0
zp!LEaQlN=7+jRHt4^#oweZETYsi#J|EF^1n)4qqy{{f=gP<@q&d`0$E#dmolNm!Mm
zP!vgUtbc5Dg%zq4-5P2mhkl_;F67tg@yoHmMoQwb#MqojlN)Mcd{qR_dyUGu?qKC%
zLQfCP?cssa<PDmX);AYj&37~+IslxDZugYb!1FQ-PYI?(cDWu+wWB0qzao!~x{<Ag
zuHc8nQS6QL(bgK=mAU0nB*+h&uTiy6XdMfDq$K>+eK;Qy<hh~n&Wxl`daSW5tJN7*
zqf=5}t&uls_-?D0b73!|9)0Sxn*flR{O`tf)C{Mht}UJ0t*i^C8(G9x`(Tz}afn5w
zSfm!;#z6-&mrMpRU0}(W&2|)VEIVD&O!Hm-jZ|dqEb;EO<dX(Kt5!ETpj=9Cc=R(q
zzi^Ln5*X9s8UK6sVwv;IK4y+H2Ac5bKB%{0b-V|dA+a5JxNM?)%DTn~%~!RYk%@OG
z9WHl;f{P=KyqYH*0~}Zxmys^8FnE|bV4|&`E2rygcmBl?(NsV6_DPAzl_>@ut0V!W
zCS}(aF)Y?aI-iE4LM73=jkP>5FF~iT%*}w85NT@iLfgViUs#mNLZ*8?frL;@q;j>v
z^VUq2{pAA_lU@RIt=YSE3u%U;A`~7>A5@evzo|jf=LB1lGu#j56))he`G*DS#Mh|k
zYsDad4|+mbN}{`>&%7b|HR^7;>usXvn#q$Nz&Vx*v{s*({7tn32(O3wQVYmjUN(3{
zf@tT))pS?8wg%)Qi}b|pi7&QeFxbCdABqK_{<mE=>*DsAI49I*7m8lS`Ep+R#32HO
z&xS?H(P7D`OqIgrO5?k&geYHZlkCevsyFC?M8p=T*RnPDrs^sO45jUUncil#^D;Or
zB*5MYuui)qWXDi0pz_LE2*k8j9rGVy@+;*~aqs=U)==BtMkHppY02j@8FZC3^a-dK
zYqwhzl{Xpw!?FfAZ7C^TNiO~TqN`Qf%5}q-egU<jCG*Ecpe6-4g(3In<mS^OmEHd4
zk6$l);pA(HqvP7D@y(7uCITH^PeAiGNpOzjPm)lFfmd}-TOGg9K|3Q3;&m(AjP5*-
zl8;09S@GJF9*=eaTAi)yK8n+`>$DD792I~eBWm>dQWtdm&e9Eo0r4{I=ldQ0_thgE
zVEKlhx?#I!PqjpXul9wvHtjD<yGhi5JsT$C7MD6jYLm|+nX6cvWR<tF%r6?Ve1R?y
zUZNo1mYR!~TCcSb7myXX*x(QL;nl{?H9x1u;bgz>JIInsNQeZTU&WbeL*l6<Pum3C
z&Fw$(4%b)^l~SdyQDWfJpvp-`svezsepx;qJsLS_Z>jZb=n!j<zg2Gda5^$pE3^}E
z-FE$NO=r!2%V$T6qz4MWF%a>G@uk@hLOXGt4()Mj(Al*rSQqAUf0yeo%ZA(Iz+(PJ
zQ=n#*cZmfODl-dp>jhym$VSCA4W<23!h|(V-hIzC$VA}$$9fi3xu+NV=IF8})fa;F
zmiIg$ihq5jK_^(c3&o)nG!4yd=mIt|-d9Ad;Wb7U1&6WH{((Ykd96!lUB%>KXvYF{
zR_YV}JEL%n-;M#4Pr4Dcb1w1N6wpr<KZ5uz>JcK~RNhq>Pgt!qetP9$bAju%uDBUv
zR0moK(p`3P&c=S9ebz6=pt*L`N)9Ak?s?PPKcqt_p&#mvDeJ}A5pv4A!tlG)CKt($
z>?d(CMP?xM-ha!A*Mi`krRr_kcYkAKX_`oj=TRegq4X8pXmv(n9tPQKrbw2j3+^rX
zbI+U3PT$gO)lAS}%-;7&0S`t&5<VTkhBS8HlK+NUs;T;afQJaTl}lKBeb*G~fRhgX
z8NE|3#+topz{tNk>8%OXKE!o>R3IINzI1xD(o8Uj5|$$s!#O+*G9RzJGv82VSG#3}
zt$%nA-`dnx8TwqsoSUx;>M>TO!~zHfQu7#HEc8LGH>3kfMS$EAE@oKE{tAqoWS2_}
zQ)S*ACQGT!364kCzAi}B-@o<Zrbrg}?0c@JGI>51Ts9v$<`#X^A11Zuy3a>h)P_5;
zIn+7d)&hpH^FWa3EcKJS3e)xPD2G2mkQ}(vY}B~QK{Ssnd-gbVpJt9Vpbj{mb@hGJ
z$q?=}J=w0^>|~+)*aQ@(#>uBg`T9L;JNwYGd7n54J+<LB>8fO=Gg^$@K-gaYeH^6O
zLUCy~O7=F=yBA6$k?+1j+-7`?R?WOHpf<+<LF%)(_+A)&M|n0Yoeqd@#o)>zV|WhE
zyzozBN#9YyJPTGKGS=mOCeGHVO~4(Azu|(SKyvb$(w-8(QUHrna7}=j=?^)oS}ney
zTlN#RYKB4w47AhcxiwQ4EiLixs$`{)b%MebHB}mMJR-E|kr-7Z$CC6+0A6lYk6nLS
zksLidN8@#igK(}6s77Y3ZH@j<UWMZ?_Q&xgnT<96;i*4@iu?>GoEAnKHj#8B=Z0Nu
ze21o8Hj;z*2dV$@8e{}bt9`CV$o`yds%G+LnYCWJ+b{u&=%|(;6g3||$ma_V6D^%R
z()i@_W6-nRi`C-R0vuLKm_l9Ul69Rf)TwN?T=sp>3ETeBMh;78<s?FMqs2{HRv-Nr
zd~LUpCvoCQQ}|7;87)tl9;oVeL){X?@bqyek_sjrf(uBriwfTgiO3leYR(z?N-TET
z-3O0pObxr=+zwywzlL|qoDvaik#8}R0&MngOjp59?mU?Y$UTs_J!B(dN-IjjHN>(v
z;~Bv$uGd#<_`KM(8k(pJn*>S+_(R_<LvkPjY*?CPbx#6G_zJLhLFu-WP!rLux2d{2
zYE;YorFD?M*J>mwO@NwcaE87zv#~sU>wiW1UDTX+kbV0dgzC{NMmUYOm10Xt2ZS@e
z=u@eSrCUjuMf`=VJ;%iOr=<J#lJa+zq8%;|6jU&#b<of7^VVPTTFWr`>-jsx24?H|
z^NzFgBDXfjIasYUIBa0<IQaX@5}_d}6Sb~ZnaznaE2LU)p{Dkua2{T-jghCUgg?K5
z`_C%`?W1l++~FS$_^T?zK401-k4(m)!M!+>d+Ngch#SLis?F3AaupMoMer*w$l%1N
zvPQcyx1-J`fZR~LxNg$@AB|XFTz3}_>vM6of%nf$XK|T2J9Y2yD*b-l-1gVfbQuN{
zv3lsIO78{gAI|xV#q`6Z5ySZ7-puG386vY3p+Z7+%Z#!V9e*QbDZ*^ks{HZ0p(ejE
zNYt5NXy3y-P`~ZC3VZP?KkWq4dk_w{g5@rq&!2cC-gsl7{QK<W<MB!eYwi5K$*A|#
zS*qIC(+=nE4h8=^N)vM?+BQy)Pq7VSKJQhQ%}g08Cn?}V5}BBq7i{_<cZ;iK&JIiT
zDV+A1WwPz!ot<jlsJda~=$-K6iR$XX<`ow`0IwWe?d1PZLrXye-)Ah;@r~5bL$VZx
z+lUv<iLU-3JU*Em`!0=`*h3^(E;VeYoH1S_9g_JM$<wMv3lfUD^=94Bvod4DYNK<G
zhWnUccf(!`Z?J?G+i)zjKK<{tsaIz9ZH8%|j;dfQTa8t7d<Po`LS%>^#TtglWH4pc
z;Yb(j*MYaGW$K#B3I@oPQvxEUMm=IN^CgLcO0&664chEj#2<dhOMjCF*M0=Pzf5G-
zRCxaCla7MO;k?t=!p7kuF0_Q_+gGRmRGm#p>vf!W-ILG*3YdmFf=fwN4ul9@&yVYP
z>M|qyo1_sT={;JmDS7j$VOdGM5dQgaTQ&Unl#q&5eHinA)#~&FF{<aSUzRpiDd2|u
z#I_l7S?O+-lK)NL)$$A)igee32q#khekB~5_;<0FnU3+UjQYwmk*+a)^|Xq)4LXy-
z-GfP4B>DH`my7SFy!VmC5rrA|m1*32VZg6Ozj?D5h@2uV;iScgMe5X`r=cK>Ax6@#
zH1myDO6cQ=r5)G52&SWme;c2H$9HfX_E=|>*ltb~*}F{sg~yu4d63|*elXl3o&3&=
z(BN=!XlBJo8tT;e`N%0k7ij=cX<VD%C>^064Tp1DVtK!kvtz**dZuGNh*3xCm-AO@
zn5&Ry=V)^B=j<H5<SYrI=VU-niH<)g-y{pgdG_%Q-6r8b2s1ZZHHYtYl7*Bmc2Fjx
z<Y16dSB!TeS*dkO)_9#j$i7?YP5kVC^QmzSir~(@SR*ar)pui9&s^2LytYgx9CM6@
zHTrkI#SVrxx#JdXtcO1q+$5XA4izdCdenC}!Fd&0nqC`f5i9F8jaD@Moz_>J9ZOfv
zF2v{16s;FsvCoNw9n1TIWseO@8;|S7_9S<=6<bWqN~nr=&!T&d2HUEXX1KV|)(wp8
zAJ;G-%dxpHow4V*k0kc^*<CZXbN2YN73zMB6OVBL97{L@SUgoOrAGkwL5Tg1;b6}Y
zrclcqJo>IadKhZb=zHS12I}*QZyK3C1Dj0ql>a2GKho$ntmgfQcUXQG$Q+%m!P~pa
zwNeGoh{rot{>y9{#XfaLd4o0io)@XHwI}Ik<k+TjJ4QMVpg3$NQOu!-RUa6#JI3;3
z*4nF?b=M=`rwI?TLXd<$*77z^$eWBGe+|m8s#xopLnuns|Fo`7w3)zR(-3#qaJMbT
zfTrDGmq~=e`Hd(NyHT~#RIPK9abJAif96M-`EUCZx|r1pJ&=6^U_kQFw@TOaK?@;f
zc3i{@b8vvr#%e$IlXoDWWIaHZCYsQq0@)MA9EvA_#93i==Y*83?Dh-3ljHvv)AsHC
zw{YjJIN&lU5a>{a?c!0MW(cxa?s)<RT|hR(of!2}7rfurz+4qZ2o4Kxg`qLQF)g2u
z`lY~OVQ0u){wKzm)nQI!l@jnX$_bo6MC~Si%B1`c@~OGwq9mJNx2O>9bQN0JEKj=W
z8OPrfx<MnpFN;7zrG<Ob3Tl~6gq7G{g93+JpQ88*el_r>_7WyY`@_&`R)dK;Mj61!
z2FU_@K_j?sn~m6TD*cU2TESElI7*6D7=2c@x7Nu1`6zyjA0X~uvG0#VP`s?C8rc`1
zCeSZx3A;Lgr2X%9#%Ekx0Kp)kk1c(btts#7`HBxGSvkX~7`AxQc8^5a@)9-37RD&^
zWFNx{J!Q)VxzWB_VlPFu(;{b(PiT8(UGH$7KU7Sq4{98&$+O+>a=^ju9iIwMmhE5w
zWN`jsevF0ZGL{7OqsO2BhRcBYvC9(Y(_c8~_eMkzg7W3tQc#itp=GCCR(_VwUwxk$
z+&JkjnMq<)n032eX^0j$jJGHi^|s<QvnQ(O)Z&2y4pe;HnO1RXi}HqI(v;zXzxcp#
z-`c@)Q)akSm{tlmaNYreM10C5KZ$$X!QyU|MWySwTEo0BW~EjoPkEL`jCy+C3GF04
zeU>OkE-sgdpR^u-|A4{q8i+wdofQg5EO0)DWocO5x_J<k1?~#4NOO?oKx8Fm-)Wrp
zL4&)*(BH~)BZ^2MZl|8=l?Z@>!JxB|A@@0;eU})u02+20^*h~T%_OT_f<G>jprpKO
z)LSymPJ@gTNC&vC8$O9+-0$Z;iLT_Zxd>~buI~zRs342=ReUYcDs=73QXSooTK-i7
z$}>&geVWYN&#12lR|8sxY^i1f+2xob*5?I>?U`kx69Q*-=QB;If(n>l)@Gr*G<;SR
zVdTDW=$33AW=ZH6OmXAkH>+v^_s>tlfF_-N|M{K-({W}WL%`kU-vSd5v7UNgqt#0a
z0_&;c4vta=2H2*iY+b?gD60AL9vJ?yKD+WNIfWiuz&jq*Q#nlZI4OvbIpG%!E;xA!
zVyge9%Hzy`5ro*glIl^!uHiWW^L7Ek#Hc>RY*=Wbtb%(ciYNKn3RZUb#{>Fp$`kvd
zVdY)>O#`tAolb67&3m@H9Rz<=oU>j%?&{<^b7&Hsx~YF_->cwo7JW)>^0o(z=sSY!
z@7tq)Wz9ct@}HoLz4I94^r^7#g~D~$f&091thBVo0LXd6IW8t14UBBhU-fK~9sFTW
zU^cSo-E?|q`_}zfr8ughvyai6Vz{56@T4R8IAB75GGfh=caRB|rPuBJJ@ftm|D1cQ
z(X_J40}1sAfiYJ}Ctf3z*YZYjYzx4OfLk|5{j@3}jEHwmj_ASd?GBiHHBw}){?p9N
zUD620A*5n?OENk(EM0$kB{Aji=^nAuqjx^h)B=^fxW8a34q1Ke77SC$LN9|bX1U0M
zWleYOb3p3WUfI{0_Bgm*p2)%((~|zt@pHeuePrB66cGql2q{5yB<q6+Omf^m=)dZM
zsuq4QFXHns4kyw~#9XUWtvzfBiT}I)q2bM80|+EaTo(|?C4HTT9iV3EAru*-#I)eB
z7FpUn4)^3sUMU)MR7X3>roDtTH8jmZtE`XJ8=2dAhpp^VKzy8l!XG*%T?YS*XDze)
z$NJy=XgPwm{|(3HQi@d<5PYe0<9+I;x0S9%XIEqNLL6u4g0A<$V!F^!5bpXUrQY8&
zPPR=DR8k(>)mjwWCJVBlv_pKxtiQf_4Y)!COpa{Tqr<u%KUz*+pWF8P3Z<H7INSpV
z7-|oc)+cf(`#pUqt5!P+g1$UrZqQez>?vEL20686VQY;JQ-I7~H-|?`&a$}S+pC%U
zd6;#5eSUV-Scpw1rcO}l`U{pqJ?_S+K#Y159aqbg0GNk>h0C5rLeq3HDK^v>{8e;;
zJDqyBAZ{H*1?0WlS8bD21D2*^*roQ(lqFZW0&U_f^i(dC)PF{l9|y*BoNJs8B0PjY
z-<IowK<f;GBSw?%iQ0CfKtViVfB6GW0H?4&zPENZM>C%5c{kZ)h#4YdqcV49+#f%U
z&V!${ukan!#JAqA4lX--BTczDL^1{Lz;3CQeU~#1eK_dZu#UuGyipZqM=hP$jqM+W
z{mw<iUK@TDcdOgu80a?f6zOq26B6h3sFIr|T}?u$;7*h3|LufOPr*YioMSLmUF>5e
zR8jrY?qRaAO>>B!V$3c4)qlat;v9{wncalMk|A#5#h>^6a!)3y`38ujV@>0blaN>K
zLdNb<3kIl~^X#}(W|MlO#hlrp$lYnrRm?Qb=M<mR{K`XKuOR;D2Des^G_M%BfW}Yb
zhnWEvp$p^f)X)jLU79!aeSYl`P9BfZ;I!D^5Qe*%T`S!miOk&P;aWktnv}<ygNnO&
zNC*i9jWOwFZ_ZQnlPA%uQ$1a7jV51tqNr&9{;p8(#aAfZwf1kst?SF_l`Z~9dz=fM
z2dn-W<^q0$QwC%4h(xh1-bs;!u{MdS`cyp4#fM`OS}#=nEjLjrE3Eb!X1UF+h5<&I
z?utb7CGH<g2lXy?ff6_DySE$Hl)UFAV307A;Fx5ZB#f7)+&dp{?#}$+-9F~Xe)ZX_
zzfUjUPJ%7kqkBWo#{MFAWd%Db{DG)pL_?J_LY7{ob2=6%v5$!>jnv96P_R7pE_##`
z6DYgrfh=(52?Q-t0bGO`hBmBjkAs#MbkmFESOf1nF(PdKv1mD24i%yaae7XF0}A92
z<e@;oJlQ2YB0<D-RP$ztf{1G6bk@BQ&LCD(h+U^95v+XP?itS{-u1-UtYv;vN$F;)
z4^mVX0>sT@Gd|xGQ0K6U1`f*`!0`zYt69vn+#}O@mT`{`9TuE?;tcl|vDKUm*+3}%
z^8zyt&E7M*dfI0ZOUSyRQ}qkEbXcj|?pC8mw%7R%ywT9(by3WoBP{_tiNc<S(r{{|
zIBMvX>=&=i<z~$F=?!oOW{pOm6|VlB!R6-FasQ1poD)!Ae6?lNB+U<r!zRytw{F*g
zV*XTH`DeFG46nGp^KO?oLT$#mSjWId?`)4C`yYt`F=`XCj&0&#nw^?SB<DXETJ5ZW
z&*&V&`oi=v9}inmLi4~DcIIt{B_H@Y`Xm@Dr?rxAkDgvSG8|L2fbu88YI2?ee&Xl&
zTTkxG+k&z`UNZfB^9c4a<XN{_!`q|`gtu&1Z^t!u_`2D#j&cFR>`wMeM!lN%Y&urt
z2-lUrX|n;UK&<=4pRM_YwtcxY=VbE&k#NvYd=_Sm)QSWWwW+!7(MkO13-j1qh!CXa
z{m_YQJ$GyUuZo?mcc+GVuRs9w6^J-))f<!;t%CV@ITy)p5Bjntj#<FT(HvmaLG<B2
zr(d@<?v}IegPU<CG`>AG{oyz)Se|l$uJRO}#d95_j6d*ZYIS~kFK%=$F{Pd9oj<rp
z!vP7!ZG+T}ik9(^gx`FNt94?TVLTU>T0UAOAEmT+{&7k~FkMtT7_cCQFS!}_wmR!H
ze>cX#r+6=c3!kHLy5Pa}SRz<UUX1vGU%LH^TBjN4CtQZX{8p^@=BH|eiYO$MWyykj
z8mLnRZJi>gd%)0q=;vgv%ABXhf*=2AI-Bc+|K_rvx^w3`B|m(8Vw41bi;EJ_dBRY?
zY_UIm?5`vZY~p+xY<WSmVIXOA!D#u1wLt8}D<uxKCQYGh1Wq=rE}u;i5}Lw21mKW>
z*OD`GYJ=CTKD3&)G{O7K^2$RD?_-E(k3EwT^)Hks5#OU)7arLzqrM3_8EyhT{X^jz
z>a^6^8^G<pl2XF??v&eoVEwNF$3;@v@;~vc@<^NLffPj)+*89s#(=!oJdMDxgCS+F
z8?>TpZD*3hnjJKJ_<X%@Y(3hzI)8}F75WhU#INaZjx@*IrW-&jhuqY~7^z#Ppu>Y3
zrYre5GA3|+%DQzP(3w748;-vpt|!LMoNk}`+(>MNc9&xN<NjcW7q#w*5I=RSyX-kw
z+rfi3QoMb|pE{gUdA6FMVWxk~QW;nHk5dp<Q)5=@(}vgL#h3a~<$yT)ONc}Me$~fw
z1;3?|AE!LP52yj*&b8$6#yCcHn*_vwX>dL_;bdv|wc)%}N?eT87tueAjnxZROwk-J
zCTTodxZ{HQ0ZDrFqDNZ{UF0To6DBPP%%4W@#{f~0*Pz|cIbCgaER+)HSLVFBAftU!
z&k9s0U4fdwlc3#-TP;se1@TWnNR?Kn|0t;@)+*N#qTw{D0R{w>akK9Aw72PH9Moek
znUiXnfIwidJbwy7@p@$vI~9S`5pF~7y$AfmnE-{%y_9GnW8hwlcdToC2pBZ-pQqD&
zUV6NLfDVgqRc43-4??cY$?_i8<Te6FjLf&Hzw_nB_oh-wSP8=g^oKIozR%v6S|FAU
zFBFp3|8H^M7!ulhZ5Q6xffR-Cd7m>bP|oxHg6L?8w1hDLR*rc|MW*$E*`u*i>g%F7
z&|?c9XwpeAR+hk9=OQiaawkbe5Du^4{RY<p1rfU!awq3|SEF}=7@8(@=jE%zcp>D$
z)6qw*DJEoSR1rWnW;O$-aT`KcNThE`U#(&u@Y8iqwRyY^<0}zHcY}_jVuhb3{m=_b
ze>nRHjq!BM=&75S>%?^OzZ9`gxj*j@%9Yu+|FkQb%YjIU)AAvv27b@5T;haLC5?#f
zFGIM^=4c@$>Eaa6Z{W+_?*)VcY=ZLt+d#rqbQtf^R}}1IN0UIMPS67V!&C+D%ka`q
zSSbetMUT5$W67!Mb-#;Ft=az$T)?L&kShMyb#k@{kr2NnG(!VF8&lrYH37H|Y$zau
zIy(O@RN<4qfD$!}UF7X?P2ZXr2S{Hus@Id;N+ZRH#HY$ElK=8}-Wv*K+QRa)y(8kU
z<8>Y?&W}eMn7Ce9Yx~&IOZ6KS%!<t3X#6o=HWd3<`So8YEtf&p?B)49jl(9Aio0j?
zom2CVR&VZy7K&~7o$22jUmJnM$iG}{SO@JO$}eQ=M*)IVPIez+*epk(!_r%joDA8e
zfO{xvjHh(<55tme*l`t26Yzf;u7X~k+gip(6^x1RBye;`XI)k9XACL-0vP(q&N-`W
zqdrvK8&wg~+3lbvUf^f!@S12~5?MtxV;xNCTN)=Geo5NFe~L0`T6o@VHO~4&&Cb8?
zWjP4AD>8ZEJvkg)Xb$)`K{cRXB1$FO+O8+95?^6x_>Xmkg?&RPmtNG2#qVL#^hV!y
zZ5xcwQ^S4mMgn#eog<Ovm==D8OCyG_urzP?(g(Zlc^EJ}=}(F$R$3FI9?EjzV#l-&
zPFo0Q-!2<(3fkg0*${EwdAyc%vV)5hFScBFOS~&}tmUnySRzB1d@({XSFb;JkA_4k
zg&4b}$t=7<*m592Xezy45@8W#0vU)PKQ*KF{g6gX^C{(R%0lvzuMoLkq$>$LWW&0z
zo!aYoRQc~0_pz;i{njv^(g(lFSFp_5<DT-q@vrKGVJ*GoXL$%@l(Q6?l}#p|R+L6N
z5s=g+n!@s@jw6FY9hGOEZ7@XF_@h?{ye)$(XCK`^DlwwDs_-ti`lA0dccQY6MN;Tz
zaSG)@6Q*v3*Et&Um|yIXC1?)4yM6Nbc>W<vy6Zw9W<70lnT>uuD4bDJ@XUDWS9`%M
zDNLnz?YcaF@~1?u(wKti*zXVG)W0IWXt`yuvf1lVku8yZWFi-Pa<wE94q3syD&DzW
z8aX~#kSK$j1<j~BGmf3H;r-U)Fts6qD4WmQ`3hw-NrV$k$Y`3C)Kp_9K`O|`btlfN
zrMu7{5`>SEt-hCfmVQ$+Hy94+uKcj+3r0Q_zqGRRUCjjLPpz^qjR>zllS^3x?}>Y2
zZ~1O!D=P=KY52nJcb0EpQ^39mGS0_uzfknPbSC~CS$&|CQ|P=z@Av5>shrsMwD*d#
zW}GB?a&{T&03`2Q-JBZ4jwKq1I$VC@0fS0p>GFMPTGrxhZsh@@5+eWs89XSDph-HN
z@MPmBEy7g9aKNFM4s4%cARo9?Lpz~sKuX`(P#}Bj{(z9C%w@yrVAS@33@0Sc0xc~J
zEtCgY*pnTLM-X>@#xqMOK9hc8G2Z8MQ2+n~mFnpgqZu&@j_?HDQu}oA%|RVr-a9V(
zk2XXO6?(U>dU4r4XC`8N0;(6u%U>9uGy%5*dORCVa(Ecu<`XaPyUBEqS+1`h;WTk%
z%+To%Jv25(j~@US>r%f2|Aj2uGvO!hmn1Gje>+-!?GHo|d~gGfn0xLn|E}m8?uVqH
zwm48;g|G+nqF&KEnJeXPD}eE1uB9XUprBmhTJiUjRSaExuLn>Z%0e{`^V5!mp^b@q
z?MP)i;WF||AiuDlgtz;NhQ40OS!liA1diEOoD7i)ofwt-G6gu}KW)N3BGq*zm5qXs
z&~`)8pq5L+{}eo)|JV0|ydO12TEFETOV8Q8Qi2?CPQ1zqe+9c8Y^$O0Ya9K3=je}T
zd_mWf)Nx*cwLf4z!&dvTees;X2W`RBH2;EmzSR8no38qn5WMhgCQf6rL=R#)!r)7X
zjOp}x^2*;1=LAu@YJ=T65-;Vo!0Qmc5;v97UC-3#{zd!FQ-#WG{NzQ_pTNk%&95M-
zJx*R3h5s2U9mV7&OPq1sx=%TD5go+Gi@UZgMIYSZ7(^@Wc>u+8Hrf=@#77u&lsk3t
z;PKKT2VTwb`775`21sZ@Eol%?ocr(hwmK%YfBVis=Hq-F`fFUw?vOjug#!0u%Mphp
zV1?uM(+G2==)i-feF*9Jz`ZfS7<z!w#BY_(6XY9*^S!$)-)uG_w{y1%Zwx!B7RZF&
z^+}i6qwJ4VMLwk^o_hDoT3YRUzQywhs#V;TWH<@{;ODS65QkOj>q=?Fp?6ySiRpPI
z+N+O*6yUIkNW)Y7=zf;pgd-4pzIbDwr0XAGCt8v|A}e3jaGo8L)`jl#(fw_BKBbd~
z!SS}QW!WV5_H%W{-7CzBtxrr6eK~ix+0OpTb`gJx@Uym}-|zSfyOl=^AC_D_!<gYY
zTWmI3jQrv-G~>oBSu+%Q-^mlH3xI_;P!NoKN&093WAkc4+s8IK-MD)z@K4Tpxp8jw
z)VYOY4*y*v;jbzu3LJ1gf{QAq+`o{JdS=}=d^&YuwiymGe@G}yM4Q54=%(22I|~f$
z^v(^7v8yz^!uRV2{j(tl95eTeor%o@a3xF<m05RCY2JzqhR7=Q&Z^_x{Ylc3ZiQDw
zma7Ig;=bL*;3^VYO*{G~jflQ@ARXqUrfRp5i6xm5@a`iF4V|jFv+ZPpYLq!Xvx`J5
zt30Ft4(R#y8^~Jy$En)gtWPmQ2PZfNO77nt>Z=i=;ByNZAxG_^`KUK@Px#g7e<Sjg
zOL^xhAxOAC2|NA^dY@^53tc5GQJbXr3d_<R9G2w)J(S*R@zQ-*vY*Dh3b&U(L6Lmq
z0f)hevHu2m0lV=HNP{`N$%2U9AM89bg*`Gh(ljXjZnL|QYCy3MK<fUv9`=<AgaAQW
z9owF*B1WZ<^TAypMimtaFVF?m@w%i2Bx^CW>zO8?YJic~+oyu~db3tgit%uBe<{-t
zE|Gcnv(1Q_e^lp6aJaXfX!|oO+`hzs;yS(nTG=OMYZODp6lT^52GU8C24<5FxgT$d
zQ4KEBcyAqG0M1$7z{{2Ga$a8E6(Y;&p2zv>lfs>0gB#8u7Eo_(20|pQ3DXtk{=gw5
zvjMN%<W0c=BCLv6Yl>L<S;5X{YvU3~cyhC^`pqN8pe7Ptw2R%%sH@Q2@4NP<<*@Fe
z--C@N<N)xE?8hJK6>h1{pGjK%_P_Aa3$D2<Tx+r&#qUzNd2gG;J@909xx~Dg<{j9I
zCpUw5cY)mRF{K9r-Oa^74cv2COn|pyvR4EOc3hDAP>nx;!<?k%e-0rmyz0FO99chq
zHGn1wMt15%Ml+X@r;DU;n(1y@>VIhBdq*zeNbEOH6`JkLJ)Ty1^P4(YiZX8bsPK>W
zBp9SfiSe4z>$Y}Jm9UE#RoI3@-mCu26(3b4|A-{|)Er#=NVC)PBv{!}h0Gaw+&fbe
zu+gY(6Q*c!8exmuS_U(s25IuJ7GqMQbnz1+zj-6b3Fg8*3Sz>FQLym#3b%@t8W)5q
zD2D4Eg3E{43s5*>lJTa^wng>cym9AE02I{onV>9d=P6aeJHi|Z5DbZX%91sutl7Fx
zk4gS3Qx=w<&tF4Xzh|X|W*k<!hpq=~HOc@6H`ZX#T*?(Xu72;P2Qra&e;3S6mvqQ|
zTJ);`>lbjA!ZaEPGvt1|Zc<4yO29`8GP6^}XN{-*l1qWYHUv98Dh{<aP^Fw3mYR8%
z@(p-WpL**ynY8d<qi?zNJ2m)1LKoWuTY5F4aGR(Wp~1VyF#959M6&I2^%ipXmoMJK
zt9b#*ws!F4=$-qV;3HUfXv<G4uEME_+`^GM3p*|`!iItcq@ohiv1d9pXY-HrOez__
z(%?%i(h2Yigo^m}^Let(^8Sw%34q=l&;%niDTnOk9#)yCsa9qvR?I%<{*qs=&a6o$
zmjkpXKJ&Qsdy)K;ixGNu^+Jq1`=BfEPe^(iAMqmMR^`8a=zy<nktepRI*aTeMmc{v
z*Rtv_L;}RLNkNMqQa1g`eTC@y0u0jJUvmT}zU2Or;;*#NOv42vbz}TdS+!N>;CmwH
zHYsG3#U>YRB4%PP7*AM8yYqR|yoc-bJJ}aJl`v<6KZFsjNG_2JWHt{jqAR~%hwF$-
zkw-Y$Qc$CxuBm7&hl|i4ZR12n$F=oX?d`xE@cPxpxu2GfvoB^iHBTqoC#+Mmlxujo
z430$BmDxJ}j?9^)&oJp+!y2R)2dF&U(g7SFfvqwMeJ4YIaB`vNO+F8&aP*=-edBKE
z3RNE5wHlLQfy>|tyQqFJ3ut0cB*Vg|8h>+Fx3@=qyKTr8B5b8>>j6A{%tDyqJIMP*
zZpt#p_P5fS*^fdPnxX0xgjSlOYsXZ!o-d7hiL7&q<T!(D{CSfz`n^o-pTyTkba7kl
zMhJ9`*L;^&nQ*GpoL|V5uRNAsWGbfEu#$JtffoljyKLI8JF0ZZm>b!!Y~3S+6ti~}
zhTWaI*dtDDU})#becSO<Q*+`}`nf3luf-kS3)k@mqn3Xzw<>y-CKbcg0Php_P|HK6
zYwU$_#5#U^CCJ=PMmK}+|12pMskOhLw47?7nTk$8r4l0W$}0ZJxGh4)(Gh}VS?pvs
zP#gH538B4e2Ot3>%haFBVqoN%_bu03q>)WF>eT*hi)6y0Gg`yzJP4#)H4Wf6-vp3R
zYfy-l@*-19A;7Nr%~(Q;ER;3yr0$(LHcwkt=Z5wEryd8Rhdn26$AwVokbR39swZ07
z#ONIuS=jdd{2ctf5Daa=*26S%jKuA0Y7S+~?`qzi%roBkpKF;PvY7DmmpfS--{08%
z`NZ6~#&wcbNlSN}ne`z{`6bR6I(QsPg}9hzFEz86>tyUBLq=Ps59%Smo!Uz|Sc}>M
ze1~^!*L-I`3~gMufp>w~WAy!Zxts3>5?h5(nGA<2po0RSo5B|P=rE8L8|VDKWBxEu
z-Tr%|%Lf%!Z&f1P9?S|?9Sf8vnm<PryTqu+Li=wM1MJi~yQGog@=jjXvAszX%)KWR
znC7XOH4og_ryX!MXCvlA|5fu^bK<b~(oY19w~R~feYBp8)6)Z*11M)EW0f<hVp5ju
zaD>F>4S#iNL#ak<D*~I)wM>y|8!J_+-F6fSR-|80F>2i?z@Y6{^XhLOmY~653L<zf
zvOpLhS4xcPL0m)edFJ44vXVW{X3Hxln|+{~$h2?0`<X-+LKSu)c$L=stz6>hkwz@5
z`IX=?SJGX5esoCrZb0u<I2_lX5boKyK3DKT&e`f2hh`|w#ZisR<NMo&|3Z?kt+SwK
zv>{hDr$uPz(4vZ>4P#2VMC)P#H;srr&V4TEIGq+eZ-WPp%O!38B$+(6V^lX3Ym|xm
z?+2MZ?*on4`?8hLhcj9#&G6ngQ5jvyaH`OV<H-r43wlbL(4&OY4iA0E5mow<V_k#o
zDd$`7kH6W3KxcX&Yur8mAn`vdbK(!hb7zaS&-J`;hxt5pJf)Ld`W)|}FBF4&Fn@5G
zPTUR*`Lx#tkxX+z<?K_mgtS9-2K~J>)y&s$lP-3Iia5@+2TG}gtc?X|Zg;0g`Wjjn
zAiqly?3a#piLhFrQYqxTMAqX)_BJ`d&aQK@q^TG}7GFa75_C=fId=wVQak!~2Q(y|
z;0&~QBVF2Abd}?wrbNcPUb#D!=vjE(0EDoq)v67i<QPEI^0s|P>GtJ;IGfzlM9l<U
z8PGX}whj8AB{GAd#S&{&FW;e3i~imQ!Ec4HGhk@dwcISTc$}-Z%4i;fDR0zyibh<x
z_XPbSn<X$&=N$yG*B|!*=qdQGD*h@y2v}dxmmug!6+QzXftkSl=L4?I<Q)9V+M@1^
zLgZ^v>-A|D@kC_n@j3V)y9j3ZuzgKJ-nHQ08(bzCP(9-Kdv<EY5lq4r+RUP?urZz}
z1R;3F>NMqCuDO$v15n`XWazj#tmroePF}zZTnKJ)uwwwqT6y|6eJj?fxg1V2|5iU%
zKduEC;KedN|5+}EjNp1u`H(7V5|QzOky#U88kDe1T={fJ*+iyDyetD8-cNqOSmhTM
z>YJ8w?x@+4N}>&I(LH;%04`7>U^}~Nm`&a{(fIxxW}(Uhpk<TgIk<wCxjD|-k#(C|
z#Od?Q_`D$|$zrMlIBdbG`$%Ij*Fx}UWpSQ>9I-ct{-DTD^)(uP=!26G$=ItdN(N8l
zp<x7K)btg!F=*${>f$e6&7{vyoWfx#DR7|jlYk3DTN(eCue&9mBAVM(Z)aEabW)9w
z^)X=J)36qLZMzI;<%ghh*Of#Ki&|(#_*51La%FtS8ytMYWdNQoRP4K2+R(l|)(7!a
z1Iyt9Hl-sTZa;hUe=L0kLzK_kwMa=fNF&|d-Q6JF-7MWLB`w_z5=+O@t~5wWw{#=j
z^4`Dy`+R|&ow={M@|-gYnx*(TA@*kp4KrxYXz#>*cFgt{V^XB2goT%vguf$35W}1!
z2!+SppZmP4PpYSXpcD5zyP{K%3y+1i(6bj`_!~8gb>ajAvEQ*k!&XCm%A*^K9@fV5
zV20&dvprDy3wUn1%f?aNad2VFsWN+W_QTCP;b?(q*?3E9rphfr)z_VmF{_^dmF%5=
z=vc-9{O$Bv$>{j-HlBlC<6cxRye!BD;BE?i>X9~tm*)Br-vX*!RUoMI36^xF_!U?P
za>TRbg$Fbf@NmFydw+n>jN$JKpDqbSNrPeUblcJW@u%HUW7@*HtW8SY8SUTXdKu}i
z=xWLi#oF4lSr8hK4BDa|tjtS^u0#rYlL{>qZ&k3xeVG`H#D@>u{ljoA@M8f2{D)&l
zX4F}4j&`2!x?<PqU<uMb-D%G9#Yv*c>s!-xR6?V!HUxsQ6C5y)KX@B!O*Mo%62w=z
zwZSHw&OU%<E(e;?PaQpKIhhY-?+cG6sgy7Lrh^Yp8!z$MNb7^&zdaNHYB7<1u0ngl
z(aJ+#<)kydLv9!Wi5##&MAHa34=g|&l-MOy>;hU^s^X8NbWOdjUq4E05K;~^+~>V_
zlUu?v@>D~OtV;;N+|_+&rZKIhwc64^&u+=_m$Qy0E?iONaphqu)v2rT0qL9#=f6ef
zMY#e0A&R@>__wT;*I2#wZqunCA5l&KwK5FI=XpKKc@0M#n(?HGk#W5eZSw%WKaNB&
ze6dWJ%(Ms@sU{*$a4tSP+6%EExv<>WjTibQH>H>j;2Rvyq%7~MmJp}M*GZgOS1QhI
z>UI483fJu=d$@q`C#`@pUoGM#9(`JfEIUkBy4+v-6GHZO^+ia04ZC=Y2x~_d(*ReG
z7Gu#1YruZ(ZK;{wt|eL9q1<V9-Ie2QGnu`WC+2fiBp2}SiSFLRjS=x~y!fNdW=P8`
zq$i+yepH18@?(`KKzY4jji9vqdkhk0yR<FwqKYe21fQ}N|FK%hPQxre#rM2>!0*M`
z05|Qgny|^VhGS|XO2=D#%*Fx*&28_wR4G`Zc8w~U20j2IMSyG0I)$=;U^tN}FY@<C
z@qjjjRq}Bs!w9D;=+|q)O-f|e4c<Yl9ZyUn;>@!|+Q1)<J2(rH((~8=WNBSu8xwB-
z&*Gz8{@`YXj0Dx2&B8MqSH{czqT3q>7Eq)tv7Yq<;N_$qrKXqH3n#u)Ngf7!30Ja-
zo(EamKip=&7q;${+jvG~bAM$Ywa0`>9TW*r<`;)MIvinn@=CzXW9yP%wEQ{(qI!{7
z-F3W}z=u8n4oQ?R6BgOJy41-~C3Den4)c$k!raEO$Z*`5XNhRw*!2BL2kO6_B5Mqy
zs=LD@;eMw=uOvYfTh2CTv_wz!gHSHa^{=(ASp89OnU;cooY;=d-wzm@?=&4TL;C&-
zs=TX}fi|@Op71xJZa~S|U&99a@9g8k=08V+My$o`knhzn|1-3i{~4Nh&-<ki6|;i{
z9;%RTLEGl9w(B*EB*5l?_J<xk5~~Nzvzg|cV$K7cuBV`NOxMpL>)(1HU8yf=g;S=U
zotgY#7UU(XKhX(zmCGw(j?j`K=@7EY*bvy0ed39)Awvn1S2Q%sL}|nYFy0R2M9ydy
zg&lpCk6dlW#Bq{d!&k>H!T}_~KDniKL;&tM&5)gcQqM3#UsI{EAi;g4IKxE>y%baJ
zSORgox4~_h8{a4<<_gCEm%qaCQ}y!~NW%YiH*>|W-$c*vPg43qmAL=Lf&HJouRBy}
zIiWdhJiv4d(P{nU!E;h=za&oI5Q(6hP(LWW@CIz&69{@lC>`vRqrWUW<UxccYP8|R
zu4Zxzss7Vp5H=?x-XQpU4q!=a16*--ocZ7hlJP(7W*S8Sx-C{3Al&OT>F|`nwLZC@
za|=Z+k|H_|Ej%&vA_tO%3lF<xheI?yq<pSEUM!gxiwMdfTooz++uc3?Q5>gEXw+>G
zR=yIABs>?72EH~=3&eI+MyXBVf_kDmq5qRhmt1^BYKheSD$*k^e6n+N7ghC;(KfMd
zpVu5(BHm8qFj}%z9MDk%x{g@uQv{Y5Z@+Q^77uy>EA<G4&CwF)`3q7ZFIK<i4KGl*
zR~rI5MMzXoi%eOkI3{DB9v!%hXPcmkQbN8UyDL4l0gf1cd#E9JUc)GE2WD3>#`nrC
zz)s^Gf+|1H=vS<Kz-*2Ehu;Oqg@fq~v$rmMuBg`flz;wO5EmnLY2o=EI1CmESDCe;
zv+b(Tz5*)8xd$gS)!so3ZZrTqzdiqgGk*V9*|m%y^$dmexb$?D19#2yJ!PKJe~~4J
z0ce|Sag7YZt6fLEc>s$TcQ*6sFe87ZO&J#q`4@PFxRdGe#v41UXzXr_0(@MA^Y8i=
z_cO7y#ix^PVIfXv2KOLW{a&fRFO~1g5DZ3_c;{a^H5<kxq2=Ey!gF_0b^?LTOi(kW
zjx_-Y_>7S(*5Xv2xcBY?&2&3wVrk{i<Lz#yVe+k_@EL!&lAO^tq?5#p5}f82w&WL`
z&~hM!UFV|{4MBL{6a3kGJ!u)V^TLUR1_3h(h49sy@`%8<Z?eYNH6a18Q~g*Ajz3a~
ze=Xy}5eho~<ab)BX0RY@9&xBUw}v5N^`(SNzOLzhnk{lZ#|AP67L8H7AKCk_mX2oT
z7LSJ=4HAC^?3(ORca%J#d-7l+WS7ncWXddM7l8#}#>0#pia#2TuE_7T|9b1%{4<FK
zIj5R`L!;UYG3-<i_hWXerepizvHtG57!Jw<n{-L7B2$Yv035>kY=ly1*0N~kOej+e
zmM|2#=vX@=Y|U@vOX9|aZ!crTH6l7<fS5|brApXoY+;L(&J67XucwP(18_Kg^fcP#
z$*cPHg3XjQ+Gek_D0&0&I)z~_NWDy%Rb>Toi4)qnh_=C)M`?Z#0J(Q{+<VDAOWNzi
zLJIlDlP*QHA}0Iwcbz)Oo&u`U+!(xlkJ-q5@VbtUl3j%l?}Xlg(-+&@TSyk{q%l3h
z!DrMYwQjXLUGnbttJ&En`(j=Rj;w7~k7bcHUFwotJ$wttzmMcN=}e%Ss{dBooH%i0
z2e^94iABc9wa3`aCOb#4Hq2854zVb10eXE7g2?AOG3q(jxr6BA{QB)&0#wb48iyg<
zv19hXt1s+khVkJ8d^0R=^~;%ox||ljzJHg;p*ew^BsM+|{8A4jmICjF!8?8Qv9k`&
z9U7rvXkl4r2OsMbaJ5Xv89Fj;mFwiFA&wtSDcj`yxH7kfvd%xaya(3qwfon3gR^FF
zFEYL$$h<ATPPEmenhikz#u9SNpE3L9TXj++`raaYW{0gwgc6($an;-ES+v`qq%*f{
z#*fPWjpvl_iXA_5ou6Pc{6<Ieb8!SQ`crr|M|jUVq3PMGWA@kz#Z_=XssYE6PUZG>
zpy#0LBf8j3aH}yi;S32r6IB(IrV}3UL7GCv@0UId*IG&F<TTn?0{zr`zVacHHhR15
zrAIhtjp@%qVx7I}?HP+*>JwPP;onk5ih)RLl8fJN<@mR%pLCp@G~@dm^FxN}kX#!=
z;FMLL`!Nze=CmV>^=1(=hon4cIr>%-ssc-~Z8wytl%LMF!-7m7{}Ag<m9d43m+;1c
zKyHZ34cO8<LtIb7E{R-avb2}wk6zDep3M60`71<erwi1JLWU7OYMIq=>(f;a!12<w
zSp~OF-ex_7X-vW`^6!09q=!HcRAcyarjMET5`p%UR1#_{J%zjT>^WukNr|)CmAA)o
zNl~~Z=W?A4G$oBBSgA!Ow4+MS!^8i3SBMVFr?(#?Xs2<x8Wq<(f5#SzRI8KeqWf>#
z5R~}Ok%7Cuk^{kZavhJy<!OU&7X~t5dpd}%_?MK)5J7$hqX1{9>rRe|`e#*G{|aW0
zF*avwgG1}MaQsAJ_%;^gb1DKh*R(bSal_xo-Lew}+yza_Thj{^IyHtV8<tu1T+KWW
z0~KKC^X$)K3U}izAm%au+WDBG>XoH85NhN2BQwegh6zzi5OdFW+dt+bnJ5(Rcp9-7
zF@r6~C46;$o^)(;{d_k?*;Rwx_Pt(u#MIK~G$Ekl`6wPM0+d-f$^b3vP}Il}Hp`#A
zhv>i8(*NvANvZ;I*Q@jX&Y{1W8v>Rvs*a5w%Kr~1dI&=j0=k-*EXj_yahx9T@^xCp
zU8JJSTP6t?iv38+z4}v?ep`iSM4Uc+FRmhY%fKzWagvix=C?j>?db`(t*oFMmYam?
zM$YO3*;iq}nEtqtylbb|D{fo$yl$lHs_zu;n<X`j(Ce67D4PG9f#U243e(0?!-xS`
zb_-KewjrB9+e}1w$}9KxTX9D&6*QrlV4$Z8f$)P&L*NWI&e|QOL|Ma|;n*<=#(#~|
zLDD~rB);w;N?inQ8Rh$nBzm}iYtGt;M+Q?_kU?FSbCr6l|8~N_63xX?Ko&r**UYo@
zmZohxC5HguC>6;}VeJfIz5a#PT$DX~aEYp!|08YM%CL&sa%u3NxxrqGy^w@U`FVCX
zK5rh%tM5Ic2YEs$xI{U+FKJ=yxPJ_)|0e|;v)@sJqXvj|5U8cw5ZEjEOw*&LG~R69
z2`H%zd;9_79ZyuOHIP7pLt3ZTnaYT=l#9A#x&&7A58Q+o#R!0C9mkSX2~Bu4N{Uv$
z%8U$m9P0y{aQDF7bH;qse293pIATUdMyOP(g*o)BsJc3}3)s62dcG5h%b52iL0oI5
z*RvYbv-m5#H}$;@0UhV^#2Ibn7_Czg$m?QA+?hi{GROM#MvUTtQ}@LmUZ4hYDtDST
z@GS`!<Ko}l;}7hX%i*i9l$vJATf7|Yg|9=o4wzx;k-zZQj@}|-KBXLVElswSw$qQ;
zBkFI4dOYG^=QgtTs%=j|KymNmCNlC%|CJ-QAu#kJ0CNU}^**KfQ+E;DXfZyGhuac=
z$4O6~P~xxry_++C#(X);9d7u0y9aO0K151^sOXZn!=EXxQ>?q_S}9<QQSRV$e+;BB
ziAyIdr>;{T0gRW#&|0S-gw4NRRBMyH5rH}AeY)Ts<e)?b`m>m~nr~XmFd|L(2e2@y
z@7!wb?)B0uK_dEFgSLChT|JOsd2&u!i2^wA1ngdfL>$S=%Il1H=&Tl<<@I|F&?SDn
zIw+wmb<5;EmIS5RQa*o9Z9>;I10f#gw|{h52Ssd9In_cx=gnSS)0k%XMZkynU(F;6
zPn4L|t=s%wB}(R7OEjG_RmTR__XV4eYP4sp>M_0c*Uz6!niYP2llO<>1)RzNke>Ws
zDNYqr{y+y@u$;^7l!PCMW-*ou^bi}XrY)0w>eze+G~=^$c~^~ThKP9X?6sEV7hWgz
zCjRc0i|opsOWvrYxHx=x^qhp@g{{gpYZ}cqDd7Fj+g{N}IVF`-tRQkSZ{E`3!esgz
z&zW)Z|8_2t^vRVCi1yz&_slCYUiZX0$dKK>05ZY|C@z`9pWe%Fi3E(6-{8YX!iF&s
zTSalYlVmuKr>cCu$~H)?@3PZSU)nVP+yhi{i^SMyhrbQIxs(HY|0XJAikT2u`>kEA
z$pT=#$uc<hSPxe(d=(Luue(iL>G|os=+yK$XC&7bYcgL)RTmQCFc~22FfmdHDCZIH
z{!m?BNgEE%=;M-bl0m8^WL-7HOKN5F0XO3JAa-<A;$(=MtY!<Cyp0rhZaZLB(O<L;
zBc4l?(D2AS80H7vFJ@x5pDf{}fm0<N=TMbcAv#s}rwr(SK023^#OyysW-X+tlZTSR
z7NG+pvv)I8m-8UQa{XF#9AbZ~m`nnKMb4pqSrw56nXo|l2+DGA7UaYdecbQ*<qNl=
z`mkG#JoNjld@1e#_Phq#1ps;>ZzBV@37LgYDDIgdXOMx+ATGM!QikKk?O%4j{|Jqp
zEUCh%6<(Yj65Vi*d=A6>VhkNzp4N9mf#>@U@uWP&5wafDO1+4}hgTqR3BFH1(~K;Y
zF>V_aWexaX;qbd;>++eQ{5LZ)Z(Z0gJ9+@SiEW$*da61%{UXX1)IOqipfm^&bTzlf
zHo)DCDw8@yZn_}L1Ai?PY@j<;K7Sf<L<wQ)MT{|FWJ_q&$oO~s7gOcUsU{=qU+5@U
zw{8?1>}p3-uvDX_VFYvo=-6m8Re)I*iXdT@nPJ5KNjVcvv(SCV>&1|$Y5K#tftv6m
z1k28m!d2I0c`$8_yLBYpqId4)k|_fI{@vM8zHH}*Iw4w#H|l_t+*$KpLH=Jiiw%3Q
zb;X;00du2P5i()I<_?(uEoG}#nWhZ5rv-xGfI4-<2x9`JMPu>hXTF1mUD3YV>48j?
zA5>eIZfyu(1w>XI&-L#6Dc<3FTuVFBhK~!+5Fooy2%uAXGX&c9Q0Olow^-TeX&Zj|
z2I-ULc}J&*JCYsptrr+E?YGnWx)Yac=g2^ZEEW@8k(znF3n+BbpD9p5b=Lir!8gXH
z-p1pAZ!E2%lxvNA9Bc_3p0GqYKO3;4fI8a@GUKjM%;HgcGIUF}$?;I>P8eM@D+u&W
zKMMX-(Jdy0bD;QzmbtyGIbr-8z&Cd^k66zd;zIoJWs|`Y%NNNbx%eurJP-d|>=9-P
zZHFS4iAL6)F|L0tGcH<giI9X7f08R@!Cljyl>)Vkf0-OHW%&1<R$1fs0>+=4j8Xm%
zCf6$(nqOrk1TwJn4S-%po}_-)1Td$;H)sTyN0^2YbTjaTG(i1Ym)<Lc+r2HW*UIzp
zou#9?0S!5(g=#X{PB3aWEubgsgmfNN<k}DsV}wk?B!fU(#in?4o@!s17l-C!l+TNy
z=tZ(rs=~Y4Lhsu|Wo_=A_+N+m?-J2VRJ*EGd>aCboV>2(RJ&(~>haC2&%x^55h!x6
zFr@AkL!u2~3>!hotx$Nbl|AM?(mBF4OackuJ(0>H4b@qscTv0TABEM}tf}eCoZ^rq
z4qf@yRSRXCJIwtwr+_nS8>i2m$Ol*fP)oyzo=W+hJ@&eio|mg^P3m_{DB@wBd>fTQ
zK{M9HPw~6Jz3T`Rjmb8!?r;plln!XgWhaGimtzQ3wJO<S4JM}mA(#|8wc<vki*Ur%
z_7QbWRh6I=6<d2V&m<<Dn==n?yDm4=^P9tWP+$Ti#%Un8P&=1?LC6C`H*!vb0|L{q
z-@#gz1e2il_VewcbtV`^v{H{309P!zi;=7K3hO*l616}7gNq~0BNtv+II#eMI6bF2
z2r=kACLh%+Gk(ds;$CA{Dh7_y`om&<2x})QQOzZ|twv^iL48PY?|c4C`derK=i^;(
z8jCnP@E8701MgEk)ztTHbF#vA%=i+pZ;m(EuC<x=Qi;9R+$HJf&uQrZe}Ep#+1!bE
zDY(qB5i^1cYORX&C7hUF2lmTEsCD0aYq)jwrNMMT!L6dv?~1xlhXPyi144Qov;}Ek
z&Cx>>m)sn^qzOhtm$F(^ap0&W00(&{TY%khX|iFUNx49hbkSw7{juQJn}~)!?-SF7
zPnX!C>v+@Xig>yf#3Xi;ImrpFdiM;rc7twV0h44koOlOoO$n}o8wGw5|D6Vx*?c{P
zPi@o8yvepTUx&E<_lDr1QJ#GfjZ)H6Ak|Z8&{}4mw}KXL@sE8aY60-{Ku2YK7`xpu
zfj_FRf?CmAOpEsD41Tt)s<C$XtNladOk|GW7H5CHU&{HdTM=*LuUeyU)nWcN9(C_f
zE?$h69OEpCFu27R)?&DD$C*_J7in=xXluXaI}N3wCR2%G_Z`Fh81H<XLLJB3lEWsu
zcp-@ZW3ZWR)!+zHC1VzTE@NgwnNxe@e*`{Y(%6}nmtjHOKbkDD_gPHo@N7_StD2Rg
zXZ&C%Tzo$nfnsmt<;H$JO$OuEtQn|ku4>(hrQCjxkG`uE=6OY?K?nNI*uK!SD?#zO
zZw<$~$<4}s`tIexWA)x3&7MFHPG50u|EO-VAy5WiqBqM6L#ha{uoNA@E?J4|j{h^T
zU^c8jbC{j^X3{h8-hcniC@*QwREId<K>q#!1@VOJ+roFD41hMS>XxNvWs9;{dvy`i
z61<c5s0=MHlgEJPOaFmV=QcYk5V?RnEummz_Dx9bL*++Rr5=h-abzT@NMn2mr+#sF
zVz!U?&aTX^W0yTJCjv6vl|Rx<pPt(ggxJ!8y@%$?k7-Iu83bIe8uP7+3x&fejSGv`
ziZhR{lx_;EbzD$0!O&4drzjk)IK0fpvn}rXB+mduLr`>bX);py^FJfUMbyr%#9$N(
zJB5J}{d>D#+Ig;Y4@@x!=j=MC*M(nMQ<XOWo>7@W_#4K@aA214AE+Nc8F(&bg@{|e
zPe4FuwxhlRa&my<!)&QyvQtkQ(qDCds4L`IdH1CHn^8{GI{jCfSK^Zn8gK@KF7Pt%
z0L^f7jtk#ucpoz9UpJ@Co{!7`VtLUfmBhmRXguimFPRxTYvIW=Ge<OlPxs%QFM%C#
zO!0O?OWtr92-uT#&{~|qtIA9!<ud}8S-Y!T{GM7lsV;^G;U$43b_MBr5n7F!#|XOc
z@GpSr7;0R2uI@)CXyk|N0^<eNdZ)B9WwWovJAc@cnQRMwY)IMAO19BV_E9*(16)S$
z>185mM9j_E+EpU$!o>aLbn>ib>8>wsS{D)zg|F!VOgA9j@V2wRmF+&KRFM^!a<+R+
z<Yg0%;CJlnAn<+VciKl!gv)%?%Qp`vCd9LY_P|qG3AVXeNiP;N|Cpew>qXjbI%`=u
z!!+hjN18dD!Dwi{(;LS4zn#MG(jmmPA(Uf~<O-{L&tkt3bH3gGBow!KJ_d(8jGuPh
zep>gAlfaojLLmdx0&o!(G8}zX5si21AN>$1pykwZgX(ZTKJ<_(3h15!?75QYmk-&A
zC@jXtGpqCe^w6c1pH30|Z>0%TX&fE6{n6wKgyWp1DoLgn^>KHfzBhVW9XR;wNvm>a
zheSoHYyX4$tn+p+0Nbi`$n~~ELLrRkC~U<$b@nu2yFzZYSNG|2qN2_}zqV&W-f~y2
zkl~<TtxLYB*harmS8<{1SjaAn56NGcZruunC@3p-RGA2-z8$3MKH56kCegfcgExg|
z;I#>RKN0nCZTtxMkcnuj|9`$tW#eDJv*UDpFpahME#`XSp2C$t<G+UxRj*bToj)77
zzzw8uUk>7ZHXxl6JU=7xD}a>%9?bz#;=(v)V<XX|h8&AW%FvqcsiT}1ajeBrHwIqD
z-OvqRxorZ`X26HoIAR)0dQW{EwslnZgMCWSo}VP{&`CAQdnA8rC!dtJC;3P7W*pEj
zdv<|v<b<}A_$6h8x{DR7%g-kL_uw!E@Qx6t0*D|49g734z$1{cd6#&VZ@m5FUuWTG
z=mi^|v3x@B%;6OOX&3(`FvI!Jf6k=u!j%fQA>i?mWjuu44rmjR1~_KwwR2*p@N78T
zfqWWos9&>T0p`YL>ZupMpU(1)@Hth)+SjCZU|*87NaqZgFj|j4$6)R6-~x5)FGt0_
zrm5=$T`s3?d=3U`7RZTqUb2afoH}CjK2?<hEfjrq?}R&(p%xxUEDw%BaO2Hl+N)*C
z$ge#OSec9ho^?uB8BZJCBQe!h|BDQj*}I@N!-{1h&%KUQ=Qcso#o8vepT}9Acx#cE
zy>;2tkavG(%}0N@e0#y)PJP@(@$E_LD0u2AUd*w(`RVJ?0sf;p<u*P-@UezP4;eUP
z*d%aRRlUS5&Fto6nQ8I5FEE9+*zw+=tfIGkmJ4>>IltXl2({IDB)c!!`*g$zNuebs
zosdUBa^Vt(c<Obua2B2>5y<8PECN2S5MDE+ThbAnPU`m`liK-}`DL2vvua6&@&5CR
z=)hGN5u28p{d%)7rvdgzqK0~v;%B6gzh77%HX{0TdGxz8NK?ldjdtnC@4-_&by>Gf
zpENNDsM%=sT>i-PcKl(U-4O}}RlN*L_PWtn&-jbwm9Yb4&g8;}=IbkLJbL_Gs~~4?
ze?6(SQ6|=jk|HU-&q@P^09PHL@4Jf$Fo6{2IW$|dyNYP5az_^)w@HEvjB=>%S9+pJ
z0RW73&;1{L>+5D`lr@wr+yB1i{)cm&P&@mVfuHGnx2t#yO;(WpQLlyLN3<s<Yraao
zh|)Fb&1VrN>m<T7Zi2JuDt*?H<{>{L2Kt*eg#HnsYjlA~+_YhhuM7naYW*JPOundV
z#+8}fS5K)1-gFi2%QGt&ce)<Ta&jKE<prK$xBsF=aweJyIte(YKEN-2Q3p9|I6}v~
zX?x@1g4k8d4FK_#%kBZC%fP{qpai|CUh|nlwe}%maFXW-AQ`_IJeEHp_zwiJL?m5N
zm_d{wcCCi(b1uYv`PtO!<+S*eHe_Zd=%qEtFrw}^dD99k(<P@%&$3VOg~hZm<$t$D
z78HVv$(+viP+#+a=VTQ!Z|&Z>Ty?zQZLmP|r^|Yu_NzKUeVgF)AV7Ut4w~zH`~{#F
z23H0+2LZh>=Kyyz1NHgGYh+d<6m1>bEyX$#H^@%FqX!TRR|{H}P^<@eZWDx832^RI
z|J$E3)|$~Y_ZY^NsotHSA=GR8hs>2dz^QSGIp$b5*b$xG$JhDy4*THS{gyXLg9JGH
zf*IL~LrO_Z24H<E3+j?*AqYnwyD^Yb2`MR)-Xi~4ciLPq3;TTW$JqI_U!uYQ4^9%w
z11;D>aCM?2nqJ;RMj;r2-4dKRY4-$J?e(O^1V)WDkdcq)L%wU<>^_PxkBc^}nkRco
zz#)2mtaWi=EXuoKc!=a3T0f1el&FdSQO#d5#l_Bd69IG}6pqt|mG>EXvt{tRwpFPi
z0l#|PBe$XrhUFU#Ei)iYxJD>N9Ajb%-hMDDoULhZosL157IqGRwt}5@go!aoWk83T
zlb;A6-CZ~1$pXv@DNm0*Q9#f_M%Aa)0M{_W`w?S%I&FilJnJh0_zJdhBXR2K{c&QO
zvtx4WjH0f#HVxpC(u-C<7ENcD%b>w8zK6jx3RPza^dP$bEHr`>sB@=uYg}U9Qvm1B
z{FvE{Ot+C<_A1-YqC1E-M2)ao?JII&Z<He=(aUOCT+afWt;{N-Y$MOdz~!A;OrP`{
zyvE@gaB5`xE8Cyu58HeHXrjOC9y$TAg`_-VEUk_3O}B|a{-_Qj(M2GLe?i4sQ+Zdc
z=^OoAy?lMCB2>s%yn}{xLmXTF7WB1;sD>So#4r-WKBGO3;zavkYHmQDU^39lW)18-
zl}F~P2k^iv2}Tujt_%SGwrO`s@3wrFzy|RQUbhW~5ORl8DI%0T<uaWy#=Jzdn+IJa
zux4!7&awX7OD7*YsY$pe4N_?b4NF4NKB%If5dJYe8;AOwa`vv*yY{{E9=V(Ly?R%z
zJIGO<Y_z3E)5Q`!womW$M}4|Oft3s{!L%JV^c~^_uF=P{HD^q~&{8TNiPW9Y+@DHB
zCQu^UtmrG9PXzY*5(C;&`ufUDfG$%*V#*eG{RNJ2k47=78e{InOs$*1m-BBE*hY#j
zuEML6F(%XS_o4GDhheyDCNHC?*{3_b)xx^~zxMcxDQBIa{kMdc<UD+MW!20OjL)_u
zhk^P%r877V6S`1p;D+U_APfQ83OjS{MkQbg-VIXj!RK%R3+lR=h7k?+{M8@&sdG$6
z&S)RiXfm3ZGPiw<xX2TWcoeaL1Xf!R*9aR}mWzTivg$z9Zw9tcZo;-#a?b<=Beya-
z(bsHnf-)9*Y{bg8rYem`X*lZ}eRJ$Kbk6Isi3ga3j{1N0U=pN6wM4Y_rBotL;#~M;
zVPl6+JYOghrR5h{4j77hovQU(Z+R$<J%0)wbBUf&0j?Vr4xG=A0L+x1FXZ>1<+cpH
z_)h}b-Dx9UFYU*|sR>bl-9~K}Iz=;T+xhEbjF^%p6yUn9o4XrU03nz~(4hhrK(#*<
zM&gdcL_(JGr(jhQ3I@6W^@{|hr!2ghd-*8!Lk4HbeTa>K;uJ_Ikrf-cjxd`7(*Nmw
zq+ir?$(8yrKV-!*qkR0{wlYu3^9)1R8tKs%v4k=9{ze72BqP{Sv^V=j_bkE%5P|q}
z{3#Ro?L55MJ|{D$4_BmD%zoa{h-N~*oNPCXBJp6YpP8=5>l|sPXc84XlPf6!Wy`HE
zD!p;x0d=;m6qv}YbOhpX$o=`p+LMt|qnkDCzpE=RE$Oa}0?kN`60qD^3(lDWFTWCJ
zlO~Y0CS-t)(_{wv?8TJ18c}M2{Z>>hR|08=FF?WZOJSLY6%%0|d9Okux7B1h=eVz?
zMeWmJAD*m_@6MDtpug=dG5syYP8z6{BmA}iLw}Fy_U%tEZNXEH8QBJDNTW%(;nHF-
zGKiP(I{anaF4`{TZ>_QbSLw`-#U;^CQUxF!r;q{E+`}bZFrZU14e!iOj~!IKLYaTr
z78B{G-i31**dw(H@tnpiKlsJRw9c>En!YsAa%{;e^N24OKF)suG>P7gM8@Dm^|zx$
zOzpdJKL>k1W1Qms49w_!Z3NAK_R~nAPs22O?~1!-slfdte{4SVs{yFX#3H~jiIInz
z`qYNOYDvO>Bni~^Je(b`KF|azO$?21tUegKpQLPmBO}BM_cl_3hj;igN&u9f;_u+^
zX=3<46<E^hrbCx+d2{x)A#>gwzY>pF;A)((Ge^Xdxc<gWq9)i%lXLcd$`guvSib>M
z8>w$#iIAH&3~XcCxRIKf6e#%I)14{+{de2OL`wVW1aHv3Xt*J$QNSfa;b&EVQBtK+
zk-~>&Hn`6qT}jVsbr1`P@q*@Z8UD9&?fo*_P^MVvtKAgh8@kRiwF${rw$OH!$D&s`
z>C)(pg0##iXN`v7hQFhrutR6GX_Qsr%dSmk4mdGBl@Ub0-&@-$9&<G{vF!BOUF_o>
z@a<o{c<q$JR$;tiTkwpMTSspQ)=+}K#H32M9`VYMj$eZ9c^O)k6%f9^1<C%K5iwg{
z(^79+9AP8;IjWSlec$O!M}iOE11qF}_ywr6p^7tv%FMHfYA31_?|CTA|Gpv}->&YB
z#bNIb7;}z8@O<bTH|G@UqUT8U!UMGEAvz!OwoDMPXa_#$>7K?5hwJ3#3ETU0^p^xG
z$?G-jPEoX$QJBKfy_!0=Vr?Duu@d!kwj%AFEPE3Qu!RBoh7@+h?(0CqL!9H{n&rw;
z(kdsnCodGglB{NLI>jT)JaNl-cu*nTaQtYqA<t)#yaDbW7(jzDxuK+Mz_M@$cwJkh
zV>U<2d4&$XRMvdwk?(l8|4;^|2XYT;4D<y25<yo@vsCMDOdBpS+Z%~rW0VnZ<zWv}
zyZ+Rqa+W-(qc$tBSGZWCdegJl{cX@j3CB?Yp0BMmy;W;DqM=h9=<}ELY#EF*n-A$t
zGHpwJtWnu7B!{D)=o6%U-3@Q=LwwM{5lv?M!u4KN<z<oWymLI9i(NR@f`mLN(@hW8
zbDS!eiYvt#tuux-n#U@xs5c^%CEVB7lnG(O8J~qSH_3FY26BkkK0$3sG>j!q{+|=F
zXM@N|N-J!OOyaH8)ml%ki9vDY?^7c}osfS)RC@6z$vN!dI$@Nr*E^JTN~m+kLR3Ay
zruA`|xz_h6zbND`W*_W(WxI`k$raV7azu3)L+huQnls!oZ%swhCHbVR`IWpaU&}3*
za2#Sdv0oPy7Z?6KcUdqW4kxXv7yuN{*xPh@1OovKDw@j1u-ZkX^QI(kl+$WCSeZ%N
zO5T}rCQS9(NIfu}B^}SLRrr7OEm80~jF0<HUrx$@*^(Qxt6LF<Z@cyW1Et|AZ`8L?
z|8$>sk9%%88`A>m>ts32ER8Tg@M`-ZwjE?<1RxDidw>oSC8o$|##WtJ)~iV0J1pv0
z#Yrv*4zD6sj;xx^4W@RiXgUt7?A1p2lY$nm;k4aNFXwH?i?Uq8PI9*0q0(r7aWnnl
zr<GOu$l8Zt{=E93DFS2sw`KwFO`g~{IzwSEkv&H>f59+v*3Vz5SBYeGv-7GAe$qi`
zyyV?{wEF%|YhzfTssNvR3485OoxouSUHw4wesj#H$J=A34%vS!j<x<>`eA5ySd$j)
z8b(e8)3h@J5zWeOz?PkZipaY???hSw+GA$qg?OybtVGMNJ~T2deGj;lz5BRxgQ_xJ
z|4L7Ue%)19raqKA6bQ?SPCGRXdEyps4<);*!>-2%r|(_r3j^&EEM!*l!fRvJ0EB{(
zvfyGL0rfD<SaRV<juCS1y@7!}bc0)ULL!>&rcY;YNE5?xWUeJE6&m@#6X)Dvdz4y%
zZ5(B6c_iltCBL7M=LV~HG7AXPg%84b#g?qWnsrWjt&Vs>I@yb(MF{JPL%8LFzDfU{
zW7I(t0K7A4FEDc)8X+QLZ^EVS$KL*qgnj!USAMtKaZW?>@)m;qz1%4bW2L%-6=1{#
z1@UDI+YN_&kN|h+cy_#uqs~DUb9XM+lStdjcKXTgys*jZwU9HSn=`>hxrBcO35&jH
zsodzU#r4E+(eFq>dHSz#w1NAK9`jKFWP*WlM_N^QAf7Jwfqdk(m*J@6B{+p4j@I6A
z4&ZTCAksu8r*|b0EnH?7ypKaTH(eU5J1glDIX&W@%lL+qHB%WFAT~+^v1Tsq{UKmD
zk-6RUV;6-R3jXy0y2qE7I;sqH-s&=96E0Q``Fi;@C(8Vm!Q<_7CB0N1N;Hnov}bJu
z5H~G6#AvW^Ukmk(#Q2%*MBf*%>mD2J9kw`hbL^*Bh6%V<sg7M4A&Y#vjYovwwiA6$
z3jTPHy>ju4M-8ztEkbeukOtV<43IoRvcD_n>tk03rZDMpm;tx<vZb6@-mBBn^A%I4
zD6<wi0v{s-i#JL_MWGZigc!l&ADs4_PfbVp+Z-``F7q3cM2`M2o2c)rUg2+@%Z6m;
z0&)d=6Z^CXxf1}n6iY7L(WVd=x$aH>pIGuoQb@k*tm{WX?3QG~!A{)o{68OxmC0zP
zDZbYUi;xLG=!w=TZ01{Rxsk{Xa07=fvs&M{$agF62yEqzYu+y}4W3vAcX;&%>a&^%
z`PFl-Gp8znENQ-ncYQC+&31bNR#OuDgoo^csfUJL0*mOf+i4&aNLx@)&TF0Ouw@4&
z?c-*UQ(aEP*LIVrA{nxCIFX7A53ljF?CL8be?FKk<Qc!@(z+KL+D+h|McImWxpQ!I
z(wcN1t&AX;wn<;z{8<i3pfBeP+SL9rs{)MC6X)X)6hVdWk!Hd|2tdXx<by-h_T<X;
zUnuWij5~*~R)&06BWtU><T3WBlQCG3k?Y&B*Q!rsGIfP#HD8n&oCOrgW*9FRs^4b8
z=*|(&?ixbBl5)iC&>>-Rpi3qf(%Wm54LGu|fYmqp&xj+j%6~y8@r}N4Sn3(KGW?|O
zCVkZ_EYH22&)lfTvobe(Bh(_0RdCU-BDn1~6^#$?`nGD}yNO<n#Q5=dS;ZQp$yUyO
zDy2Kr5Rd6Clc{H!cC6Mtz$vgNqch5rH)(6^x#F-e0N0NKNNR_VWw<mzkE{#XJoQg#
z|E)ysCq|>Fc<)KNA<5`QUEP!QOTq773w^_ZnlM8tUB)v*4Q%e1(ym`xo5S3W==C^b
z-GKg;8$~U|lP<#153U`%XP8ez3}c}iQ3<40^qC9Sh*AQ3?OL32fS4+cJ%mu?a#l7I
z?WX$=&Dovr<(_U~#$KD>eff9Gn9<i9u1_?DO`wH*SH7QU*?E@wcx%4hWORD5y5k~s
zXDTDXr<luRf&>?zD})I121_BgnmmTz<s#1S3t^&>?3p1<6#oBxD+N$kLG0r!JciVP
zxa~||1AGN{xCWfhaC80HYWoGDFs)A7poMO60TwkC1Hovbkig(KD4>pJ)ziZ@Q)3cv
z*0I~M5Ox2fv(eJ!=iXUp0_S&C1TA1|sLq2GT?nK{`VTPjme4c!8Mj&!Pv?Ck)<q|4
zUUwU|l8|CcBxQT)2yeyow4wV?*nA31y-MCj9^WB8MyBS#AxcH95bYM{+Np3qNxvNF
zmjAm|HuRfKeok<$h@DL3b7ap$P23yfAC!L*7hAp%Tf;S)Vw8}L+1j_s+Y%KCJuq0G
zaked)kc+^T6|Scd{8#tnOOg=%T;QtNu6r)5`t=9pW_kYKoP-1MF9KXZx+ZbQkzyaM
zJ7g;HdNP6Ek2JsULs5bP^@EHwrNZ#=Ose_80a}eKz;p=6ejoaiFkuA$h8Pj_S8XWw
zCbNbIQ0PQPMIX$BKD3;}@2cX4)37HHXd`@nA)ud}UyP}XJ1C->XA+d5oEc*jj<_-q
z?j5G+0EfUJH)!qZTc27r1Y?3Vg~JW)do>=_On5>)p1`dP5VYbgY^3BZQ5dX3*ypz&
z9$;o_Ug9IuLpaTkVt>=SH5f0EuOzQnng~@G2@t3IabjwX^f<D%`dai|zInyWh2Yc4
zIv)ic;Q5V)7fFkqBBC`Lvt|ScdUF;z=MhbERT;(Isc49yCq_a+3vq}lpjAmI%{RC3
zXVk^kzl3WWH*94|TfxuRWblQ4gITXFr$o5$Z+?irUpjy~opXG_tbtRn9!eNx>L;@d
zzX{>;+XX*Q6I4}BenUyjbhAI`@LfCfQSkq*Xgt_6T#64u$6k|C?lq%@OvKas>7Z}|
zF_V+rMy(VcYHZeYnjsqgd^gTd46|XF-7;@^JvE&%p^S}$1}F@ZdT+3HniR~Svy8{f
zzhvg2lvGtKiX0f5I)4l-e2qq#Y5N)|?M=B+tz5M@9l(!EkZ)IC9@JU>qm&l}w7HvO
zvw_SL5G#P4PaBha!KD;NMEBh9z;CnW;kuJ2fWEGpaQ{1F)^ML~J-Uc-rbj2{bfm?-
zu2ND}e-@j-HH77Ek;cIQ>yA#j2Ve))>ZGsnMx-j+M+(8T|4h;?{${HphoacRd@M{z
zHZw6ND-uVXg=$s2#o6Gm5vXgGyme(%{c6-qX9TBg4tITP`!G=ob06X)UC1qeDwxt5
zm70NTwBxYG)xYrWHqSgoe)D<H&uXolXx`IiLI{=NUm^a*^1Y$aoxu0MrSv>qUq4YF
zPgn&e=n5pAbZjDi2_OG)EF%S_ndTeIvx{bkSHJ7Kr(9Xl0Czi>v1OKl$!PdW)Zvau
zB0K=r<I*P_Cp1}kQd__Ff#i4=l;d>K&l+GAX5wb4?w8)xVp}&F)}XmliDo`2d3BZv
zK1Rerd_G(w1RXY_kI*yJ)QdpYsn(|^(-U!Is<d{~A8akw4sUD{0!QE4@kQN`bF|6c
z&qhIi05ZMc!#7P&o^^!$x@>}2RHni0>Q%bW6$&nK=9U_dtWcqhkbx=5*BQ))c%xQt
zl4pQoIDran734&a1$9YEAN+u+t0kbPWm4&TuSH}Y7)O_yn`%7ZFl}HMbS1sXrok;3
z#$EE34OwpH&B|K9881zXUckGY8;0oBD&*_AF!3of^99rDcudJwM#yHBdmDF0exl)6
zCaOw!YK&I-12k3%(+s-pqL5sybrY2mWI2jg@#RC)WN|lx9)!QGuFK{+2_x&!zOJ(3
zCMd9j4?PxE0U^Ww0`AGiJR!AX9vsS)l&0DR>I2XC^b40#fRW0`JId+JDZWn=X*@E|
zWF@bl%!}r*s_?wD8{bz5<Y>U)qayF82g8k%(8LQ!P~IM{5u>mhOs~`d`&U@+D(Gs?
zS|io=)$?aIVDPhx3q?4`+_64`6UX=rrRK(w-tyl^i<GR<BuS4oCadav3*syi$CI&R
zE6UOxsgeSgiS7Wjsl*EMxn0a52+75z5%*hT#by-@L&AsNXFj5BgHZ)D0|h3vgVK1d
z)T-V!dkOD1hfilI6>SK1dW4v<yBBt!t$9qG`H^rPfh3FPSDSVaZ0hJdy4MIMANhRP
zc0%s(G&YiUJ>yukVML=m4l-*5P`JiykvyzgBr;88P&O?DhOvAPe?IF|Zz`-19AgPJ
zbwgWr@p;Aa`gWs@kiFe3!!wG~rzm9@0izk6;$*EBn?8R;?UQMqq-~$ynXzhi=+&4x
zsKPA9SY;lNr<N~_xoa|pnVNMPr-ZY%q(88EOAOp9pluwlSitlNTHYCH_MQ>qx?QW8
zzSm;-&Q+V&<@URD{+9!Dnj-Dc|BM}AZ)GTu+SpKYYL1PySY}p0CIV1{YAh<BvS${G
z%I4!<x23(6(nsXRA=jfkMgy3saMp**3lKHQPq=I9pjT9B5CqN#^Q(N=V`ex#<oPYO
zy<S~yM`>=W9j(7_BbGLOv8*ydqV8naWw|UH42AQ=n23?KIT|+2PWuvlyAsXtdMPI%
zlu?+Dub#|9s;H{4<rI}O5>8x+<l<CZsbYbXv1OAlU1dxUu>x`o&X}MNeApcy%J@yL
zcnrFn?Ta?vIPGfWO5McfRpjI)6y*4xvZG^N2nV8%tQ@Dwmf^rjhxhnrcGJ{8l^iu8
z5rU2Xkq|`KMu7LyJQZQ)sTAA3uv&B>d`=~&w3?L!(akszAhTu{eK_~SgbJvS^s4jz
zMk0XGB*6d({GaD`>lo7qz+`x0a&hkaa^>&k?_gbl)gs4Mr4eD{3l8y#KE~$NT}XX4
zAlt*=*<VL~TPBjPVsKZN*-v)tNcUqiPo-X|)P*zGp#ppcFe+-rg#H=rkG$X*yA(o8
z-u4C1vEMCw))l$8{cLx13&qWs-%WoD-o8|mX^&5QEv&;L#i00_X1j1Un*UvTRdn9Q
zsP!)}O()P)iOLZUI%syS5GlJQ#CuEXJYs>Qn7;GGsR_?*7RFtpe#-epdGwAUkq?kM
z$dJ8zz^qYkZ`URg^MCMVU>y{Wm3sg4#$tvgRZ${jMkDOqx?~S!%4WG|!<DRa53jXF
zN25NV$c1Pa5dvt8J=O9oOZZV;2TNjLsZ<@TbNudh#xsO4K)AYV5D2k=fiX6+3$`zI
ztiUR)CJ7s$JypG&I@)+;u)cu56J2hY$dzq^LKam2)^%9%sgViI32jJ;)LLVBWJKsg
zeyv0M%AkQGT78q~f3GK)-mKE+W1TA19%$dOL>^17mmfMeF9DMn1Ry%HC+_@*>pthl
z9K3w*q|uOjmkh4#kV#!Vo)e>&QAm%Q-Ns|au6oQp%qYIp*>Xl(kSDcvr*8VPHZ_*h
z(rUER5|<5@XkE-^7tJR~`8^4yV&(ASPxVtvM>GNn)dCsD;kqcU(R*NMNHQ;dWc?L^
zvky^&WDzh1mfCV$ZcaNY<L<$%FKP$@J9lt)D$w}nj>8NNx}`RR-(@CEoY<qH@e9j}
zIjvP`j62z&iG`xIhq;3eF!UiNgDdXGpC}#&NfiwlyQHp6-&J<rk+>DywI_8D1Dq7d
zwhs-Hm<(!c=e}S(HIKRHMle|N1EMWkR3e+Y+P2=(@=<7Nf91!S&rsf5>tTgCmX%?|
zq*9qG=UAXtii^eaz(Ua|fBk7IIIP9Zp-rK(FUilArz~u1l1Jg#fe}(c_fHCX%Vqoi
z3xYOCC=7Q*1!$%-a049gn!_g}cVlie)t#Yxz_!V@31Sjcjh`6ad*#~~)=W?C<t!1E
z{c81fbo|?2KE|rplyt|w5B@Au8>uV~=hHAspbVdhm5YjRwAt4h`r%w{X^}9tgd_J=
zrVypBLq-C-d}Um=dp^r|>W4nPuw_K9TlJ=XiD6V>=n7F0>nzV@#rUZocxAv{#s2DF
zRgTUX&Q9Uypp!oq=WNZCIAuXvHKV_)e+iyDacPll7Q&*yXUfn+JR$IzrQ*H#Mj60s
z3qb{|8J%g+i4hulQA?8c%8wPVik{<o+k+G<M5w8PBj2Q<ZzJb{LMNX2uDb3AHICY%
z3ax3kvkMd&sq>oY6_}2>{(nd1MLLkP)IpKh$gFsqNG@G96pFj(fS@|ce2KVak_)H6
zo)LA}SPkrq@rZW!r%vly%^>h$mcC8ti?sKM)agdrp_<^RvvRN~bB%VTv8IlUqJh|D
zHIlb1WluRHn9@d{c(T^KXF2bRC0K18ADJ~y9dy(HPhe<<f1P${7lYjq>ZF0`x}(<x
zUX<<Pt=979<oiS%VGYgI29!!Y$CoTEFtOh`{7UJRlc4_g`PX9MHzzdIBOS%LB>9ko
zbTCx)@l$vp{ylx&(+nKn!s_ZmqcWhXP(bK#SyH@p{3Codu~HhPM=WLvrj0&1qc;l{
zip~<`+#Q({%nIMF<)<1jta8l2g@L!u+4lH%`rR_oE`fZHr3LkDQkN7!m}@yx_E*)O
ztZqH0X7=_47#J@x@;*-=N9iDQ0CmbJMf}5g7!HdGw+CFi--l~Xd^o-)_#*jf!1?%g
zCprXx)eWZFxt2$GaMWo-%{peDM}Q$IOcT$?+IZRnxBKsUKx4YQvETv8jjxce4Z&HY
z@p;BmGctO;zcw#>>)+(gT_ZrWP@dHUMF+!TW=AhABDHPxR-+o6-hVb$TzzmMQ-jTZ
zL2p`@N$JPG#r_YE@rk_+q2tiL*5ixivkRvnfQ~l&hSAeBvMRd*bC>{zis#jSJ6&^w
zZFc#7)AEYD(UxQ_3AO%~5iUeR$w?9(X8~2^iVXAp5V~`nl>W$f9G)T>>0;~7l~ft_
zYfsO*tJFC6L~zwrl`Xqh!*l!x<_AMqPXr&CXZc;5e<n1g?L09T(`w92*%YI$u_jAI
zzdlkvk~>rE`>YMr5;BT8qmQ28H^~Eg0w`fHERaemT;v#X(>e{{-L<S?V)-We@B4+y
zy?Q}a`SCxsM_Sl#U|#F4%YjU&x(<g_nfJRTYMitUFbwA{8W+WLt)2hZ(_#?(3Z{9>
z2PVq_RFRs4HdrUWYIUvu7fEkfdU1`&_q2k&b(Qr`87=e5t@Uu#k1Bg++T`jXY0kO5
z7VWM8L47OWKeA)HUKUO)$@pgd&3{}umQI2d&b`eMLmZ=ao`<`ZL_5OBtZjec8Xb9%
zAwBt%aJ23J-v$(aZBmnd!2@L!IYv|9U_8m95!tV}X8GlmB}oP*HkW|dAyF`4s>kgW
z7&9T7t`fD#>8Dl7QkFgjWWe-*!zR0nlpk$#My+l(&xe8-k1tE*ThAw|e<$kTTwZn%
zQ)z)v7;cf_GiB)^M6@_^)UxN1^ch;B%M2G^;+vZyuk~@uuA(jDc`l*^Cx#-xttFN5
z0-L6er{WLG3ubAYX?efaTQz6Ym`{G8q&Xv|o!z$=`gPQp_eJ*RH~p5WWt`7h%aI^3
zGRT*LmSZ8;Mae)D){r%rqq(&ikPMFqciDllq-<M)YEY^(A6ns1>ul7<EIuHMAk^|W
zzfiQpSfwT(9o6xSj|IR-yA_Pv*FTBT^QL4<oS*yW)oAbu^fhFBE;dLN*c;9aSW{e(
z2Z+X3hM@&On>2E2IkS-wf;BVB7W~qtC`cSOT(V$Ho4@*1CM<Cxmkx`mAVLz4)a8>7
z+3bZA^lY2=Rq!i1M_9pkC3%67C|4Vz!JJY6;igNUi=755nWlnlOxa4_L2!9rsWGfj
zu{C6%jPI6o14*w<*$5|&g}Fhk319X2Ob<c+_7xYSRlSZ0W^C_ECeC`BWUw2L2V;Ys
zMiFS8A<Z8nmv}I~1(Uh{10YV!LiUn=NM9K)IPgC2=6a;r_xU4X2{`P<6}%g{))g)1
z&(lS4DX05;XjDO2cMadaic1gV%JFRMiunnWA|(k;CuGiVYtERFIGic!YZ)qgrS|>E
z$+g|=ph3YE(IhM6WTI^zT5jhj`4<>9Yq(_{iW6sL%mE5nkl3z5tWN-@IRKNsj->rQ
z0X1l*)wj<hN4w{;EXVX`HA?3zeRK||F34W(nhfyZ@UCzKd#Qjn)NhfNeeQ<0pgHF~
zj?sYtaa#?uJ0958#cz&z>E+dDvgn&;NuwPmdI7#_s%?j$6Mb5**zC@bk<EX&KCV<H
zC+%N>{q4#>Mo0^HzHI5Vq;T!M*PO`is;~fvxz|TcsI;3ETj$)4v_L`q8s`en=RObu
z^VKF=O}!HQLjZ=TO7cH&J(1$K#afs++z#WTJ{B#&0XN8;s?T689x|$Q;3vsHwOh0q
z*D}Bv!k&Ixl`W|7Gqa;^vdcA``k_n9sJ9fW?PDWT#(7a(yZc}ODlOh>0*a?_p>Se-
zM0IZBz%Sm^nLCeGD?Lt&C1%gqWBR)q&2x*ZP!Se{F|QT)RbX0<q1U^<ZV^7mut5Cg
zHEP`*l&B0SrZ6mQ;k%pmepWQ_h*xR^9%NHV)<=6)>crYaImh0Xib5^_DG!>!V2BDo
zu?%E}SX`-m-s;El<+4SY2>Jm4s@DSDRjwCYwRgQO>gL)1BUAynqV15vr~Vv>T;m*z
zW`N9d;JJ(3ke#D?cp=B?$U5O!RZ=JJ3DIhJ7u86(qhP8`6+5<(ELm4P{@Qy22iO?8
z@LaCn3#D?KeeZB5iA?`|dAFyh#z0u=WPocVm#sW`)M}KkY+@xK@4^LMx|aQmrV<zQ
z_l8UP_+#WiQpQ_K*EN<x6VG?`3Dgmx${__^;pUBW@jhRplEgAteZN{p?W_-V^%&bx
z;p5b}M##$0GYJuU+sPI_7)9Gi*S`WQ$jy&d0BPW!z>7}T{Z!eD(+_u#Y5UM8pKj=T
z?_Q#5oC{3%5})n+$NmzrzjtDsou^vh)^eKv$JCd{Q}M<9+ueJGYY(Z5>{%j9ma=4D
zLZP^5Q%SBtQAC!x6cGvuiBO2jlCd)tr4WT=$dE0$(uO3zbNlu@&+i|vmzgu?e$M%9
z@6R%4zTVed%<0m}fxmOPjbF%>Z7Z6;4Lxwm0U_ZvfbI}^BsCWN1ZU2u!!18Q`3E1~
zgR1lEMCy}UD*Z1$IvrQhKVqd0?8t?01B8$pSfTM~ZF5@V@`sWwp<-M24crTv&S)3>
zz1#h=(fam}LLYEZUG(<{*@9jd_|qa$&7VItdw%@7Ba{Wl*tQw9C7t=MG4XaO59dg(
zjJ44!QOW$=8>awXV)k&59aO8G<1+VmQ>_u&>?S@<vuSDl!r0T<*`Tn^y~H8v%)AZN
z<yJ&hm6<7M=JEVG6#Vtlt=Nj%kt9l<y*Nemk&U+yiAM63LH4>gEdY&vq>iL2Jzy11
zxjGF6XlL)OaN0ZS{!kJ5@orPlNc$_-xV{2nvsUhwZ}HV2hxyF&1nKmpWTAo5G=swg
zaF}ae*Ra@&8TpLKb(tRJbq;Taj_#41dr~Dq;DCqcls2Q+!{Z>6lO9MxQd7yk56`D~
zAFy4#9w=lI5PGV(0Gw%Sv83Skd5rDsCaLj;n&BPHjKq?E;*fN35{>=sE$98l)X<q7
z?~~P=_?pUDU8&<YBH8NQxpjkX@85H$&>FnWSoE3t{n0uo|84@C*Y47mwCB&Fh_U!V
zaGH=@W~YG_VFWQ9@jB90Fn0H&{^ZA!qciX6A?y<pz5&36<v-?%KN(P0_VtqQ!<=CW
z#gWydyS?kO6%!VVHF;6|3o4cZoJ%R?SB}VT`K0sp#8UmxRz8rF0JXVe%N(J%<~29}
zkTaI<8d^7GlvaAT-FjPf>HWdm7RHG&GdF$b{X3q?X)-^~X9`}Xvwt%Xq>!qRaTNlm
zq`2O-V%UcF9+eApJ?PLGwEM!jh2#nu`|lbjUS@-+85CYGE;>Nv7JDu8=Nz~ao{2e(
zkKTBnFQO28t}!j#@2eeOBHIU_bP!m^0YK5oFZNDtWVNK}_(UV<;RHtnXO%~Tv(Yd9
zDst<+uj!kK7A-sP9E{>#YRa?h5Ksp76OgIwBXYX6myB7+h(+)_Iw-HEOT9QZaO2Es
zX`)A?ZxP!mr?KwsFTb1ID{tHJgK%)iO>^wgXYdY!dzMS2k;8D}neq!G9j#`oWscAf
z$5Kg>TCOAHV__hQSsfex#v&*8E!Hq^Q`wbk9a+vlG{~}-OKeU$rBqz1(Y|p<UM|r=
zR#HzNyh*7Va4T#+eOhomRAE--tLx-*(J!wpP6!Exix|C7)a)eMKi&w)+?YS+{ACYx
zhXn+xt6EV7f-CNfyDrOyM@rYr3u+t6HtM##dJIl9Y@Bz6-;e-PN4Wje>$G01e#jk?
zI8=q*^&VLg?0%So^4gHZz8su9SuL5bf8TT8_WH41USqCWdhv3|UB^@Z7GcbxyZv1b
z!SMjwSNDFt`?Y74*4$pGrvD;l)m^{t1WuhgN4+j}WNi7vMe}Zz>0~F7P_u-1a)Fsb
zcd|`Eq3{To`n*|!ZCFQyoznA&*1!l(cj#!#nR1a$PXsYbr5fH#V}Aq+%$U-u(q`}I
zvMy~LeJy2;be;45^~U=KAD4#Zcl8W|)trX;{KDRBdpmF_Rp*gme2(VZ)N<DMTb92z
zN2ohK-i8%XeI!pi?*0u>fHJEXm0YG<me#vln7SbcFx58N`)RWiU;p?fgPQj4vUhRL
zxq;URsw7RifrHq)L!K7C!*}KRWg?4amJHX@2@Vggd<fjfi08OkYRbCljj9$=1Q*1P
z2g%%gC5&0#J?F}!PhM-QJa&2mrx>deA~1I0S7+rm(E;}fp{BH#spH2EMS*Xy6|RF*
z;Iu}8#2@kJ)#r5)sXZwd_@oka7WZk|2U^c5UQJGYz<PRQnR8Y;&K8>ZI3fZnl-WjQ
zFp<2*JR8V6ZOQhOF^P8ZUFP;li)R%aN)3CiZ>`#+z|LOF)mL!nbC1bHmQ$lvo5EwR
zL~v42)#+i0>$cV!UZA$~tO+)PAKf_Bv+DN_9&VBAk8v5Oq>yL|4KW^4Ks-SwA3Ohc
zH8$`bp{ekJN$<}6`;8XgUQO$a&|O{onen=S!fx&15!(ragF)2WzCG=2I#9=Q+U6$7
zS?Yi}Z{e8QBPB#`5d?j3Od_i=wsRd;e289Dp4^q-PrMSYnZ9z2?<fVlffWyqC8CrI
zoc4nr>O8Wm(mt0ma^Cv7!mqU|Vq3(wooT$2M?Y~Mda^Uqk<-<hT?Kh|yywI5nC!|g
z=^)<QC4VxefvuoX*+%SH2B&`<x8?bk{VG~@!r+U9Di0i`_}5N4L3}5-X=Q$|)>iaO
z?8w`z$Vd!K8!rv`8M`ZX!(;>eRg1?)4D;T1JojlV$KYq4<1sI-TCNSnG^ADckL>2K
zhXP>52WWT@zp5p-^p(xGJ1=Oyxx8Q)<iwri7H_)SUHG@4W?EJkyUd3|@a>J{Y9Bwx
zA;F73d94GjLtFdTu5VF?4eu?f<$u2)l#!K_y7VN{QwAJHc*qvIbM)N@A*<IMVg(54
zVyd^N?W66{hYzGqUmHFU7CvY<-knAJ_O{$P-`wQ=M5srs{S^nhLYd7UR8%LL-`X9}
zYHZH^I?=#7v8>&edfCNpD{_6)bpBWZTY)aqEgH0~Nq~8KwvIfC6YlI>@n|3U1AxoU
zs)Xw8uR}#SchXawHnb6ded(;$e%IY;Z6`h=_bejy`|GT`e|8i;dahbRKOtJB4>D`u
z?7!_1-W&uw3TNp0%b@kA702vfgx>$`)_QYq<RPw->+JF+ck+NNb8Y%1LM5B+u=(xp
zr-ASKR$+I<GVzR#Vm^`%^Y?o**u<atC~>X}m0iytlNTaY<n0uqXxswr^1E5CyH0Tz
zUDQc+=sw!y?=v&sSyJen+&8N8`-Ib%X?=toxAohJM~}Jg^wTV>wQro9kP5Z@EnbN9
z2<_VULuSdLbz?D!vENnNtj%8DpJQoXnHVpp*c(Y3NZMXcMD^LNZ@e#bnFPPfYs}ek
ze%dcFX2LX{O;^Cr540v6m^}~9SatZ;)u44g>f%8`EJC$pi@#gVqqTjI^lzD>cl!?d
zY~a+*ss<VX${-}Q_BvLhV*ar|8{|Uw6TiyZhCFor9bi2zy+cj<y2jl>(pk+Ru*0$I
zc}?H=9^NTkS{^wq;hS<RC526?FvY@@l5*?~Pf6yu*_e`*fQXWejEwndep&Mi_XvH3
zvRK#gs-f?d^Ui{lY7V8CUBW3cO^o54T1$-Fu<o1{`}N2_F?B;))1gzk-|9lAUafQ$
zO71#jhWPNl?^bM-t41=-cV{#_@O2#da$N?yyN#xt=Z-y@^nT5IyX1|~IZqh+VT?G*
zJD_XICf?ek+c49|?ng>pf0PF|vAs;&<fP{GWlp~yXa5Pi4^ZB;EE^yFv@!8&3x1*e
z@$KTvYfmHIj^7y&?}d3B*3fs8#Kz60NEiiE6uJS4g)gY&Lc5ilgZ&m+YAaLy&)j!|
zY}fgw{zy?T$OfJJC>q$fe7>@cz5BxV-w!pep2<Yr3sm^GUwp@~n@+6ZbTP;Z%-eA>
z=%`=AnLA6(k6sF$llqU^I8&sn!(btns5@6zma9}>`n5hIyDZB?@~o}b$pGTc0hQ$@
z^QC&x(~?bsob2tdd8No>lb5b*KRj@@BVwrelY$7o>%^m0-@qS<uS_fRSE1YaPlV2`
z#s0Syxv1(#`S9V#)-7?BKUoHSqrZ3`u-nCGF>Pu$f3U|SJ2A8`X%ksi#)sG9X5Q(X
zGxTpi-tTdFvsq`~&}q!&nT4gHg-%eY#4m&B!QJv$QpOe&<giH^i55!2OUc9~frJXp
z&2OBmZmzZV_q0+6pI(@&HeTkPn!NCS|F&MWz|`=N@Uyp0V^MknN`4PtH{LtB<Za;n
z(0>1;4kUcDP6V`f&el*jg*PV$DtEhgxg6U2@O(TEdX^1!krq@l-z%QyKj0jkyRyHZ
zrWg=xH8b4h>F0Ltv<@14z54q`OPy1#+7V{k{4}b+$kxW5=UgAodGPM|yS-S`RQ9fQ
zPwLqAZ+b)bBFsMw5gWV918i<VJyn;rb<j0-b9rP$2`)30#qKDDb)I{ia#NHx^4zm`
zG1D{2$j{(RMVNnf(8EEB?`&kd?Xg&{t%%X9O0M`*?MB#l+1j=A?#$Cd!&%T4-4@9m
zg*8r<Cc!GyAJQq43S`<z$73<W5vGXp4s^u0cOQL;rziZe(olm-=)wUH)1d?6wXol>
z8(})04VCuWYG*<&Vbw{eo=0ty&d^qzyQ>Nxj+AXw2yNP9R5o<8GrTr?*YbJ4>}f|{
zad^%i=_TBh5uz>#qdt4=kY}$>YxX>TNS%Hp9Q-Jza_Ig1u?MVuF@l^<(oZY7+@F<l
zPRaE$f}2lD4z;?TyAaki8$0lhPtIe_^rCDeTWv78BDpmNf@K8$PI%^)B?XIB?A)eN
z-FW}~VR!pdXHTx9Wf7X|oz;<h4d!b)4yOJ(Z$L>D<V=;Gj`$O^E#5DHkd=4#ci&2>
zf1#HEqw4C7%@Y}oiK{}Ti#E;RtnU<IhCX4CNO1Gn5e@Ye&)hT3w@InLb)E5OzxMFk
z>H(QVmx@n*p9iEZAM(6UFv&G)w<OsJ?@9d9De?V4sS!gX^7Wg^V60<kAN9>KG~9jq
z$li1GlhuFj&&_bq2FDe!*s3(N=73nwo<mN0rm2LAPziQC<eh_t#v{RskQSu!g`t7X
z$gy?P*K5U-MeV23Nir_QW5U-JFG=JzN)7O)pd4Y>0u8WF7e;g*#x+TNzvLVK!i`uN
z?pPn`FczZfgO0S7ln5RWPEMJQCTu6uj%&5Ga!{}~j*(-+8TZPzs|V!&X{}K|2$h$(
zJ$airG|m`}xx*nxlCd$f^5Lylt8OT}Q1gxMv3F87Aux0xo2Fc=Mp;oP&F}jW#8&IK
zU8Lg8Zb(?|gkB5@75{2THW44l5=~@STyBN^YBK8eVu|%7Uq&<1-uAmqzR75OsQkEV
zneH3;b>k1`$8QY-ckXbVr${Iock|-cwP#BDwKkskeMoP*v;4$FRYG8wt$svHjY(;A
zUz447^spAe&C=0C&n%U@BDC`>_Wk|wYJwf|((r7shKa5SsZ7yhKhfEn`2JMrlc@|^
z`>v!n42AeQTE%9tT{{k^YtNKV&2D{iJT!fSa_Ga$ok_(an>{3Rtamun6gB0v&Wpo-
z!G<U-!_O2Z7iluXFovdl(z@=Zz0*LG+r81FkMC9cXLfwzj~5BHm*FFVSy=(q8w;Da
z?0CN%mQrTJm7Si4^z1qvX4zEpzBOv_B$u@UHL`<3l``SPH<)imMwuE*p~iS=Ru}Fc
z^zLtReXiU)ye(!F9cte!b^p(4z32N5oVmTn#17ehrIO3+?J;emfxsV<nW`nfVQc@;
zS{=*k<!7U2w)M{!#Naa7dz75~=j?+9bjYPZ7DKNnCUW-V4xah#V0rZFTibVkZWR<v
ze3CB^V2k{A@TmEhm0nBxK{MX$)gZM|{nB)|*jwRGmruQpRS?d;<L>`ySkCj~5)axh
zu%F!RSZLBToC|EgD1G?a?M&4RrCpEiYqqT4>Aq3=*m~UWij;ER=KK$}icVzRUq5-n
zR!Ue;tyoRi3h`_nqc+=~->-D!%YoRy46_$|f7<VOVzw0vZ?b>;ouA-FAPjP?(;E`O
zq{3dZ$K*(lGrjZ%H1UBUmo{yScOfK$$BAL##Dq(m!Q5uewT5Fm#5;?Zvy{cRO@o<B
zhPvdH19VO|m)4NiR(8aKnKf)J_1JI{EB>BrfZuepb3LINQ27Gi+5YF`57IVLFE^i!
z@Y8FxgBwUXPQM;q*LKlll6cVb!SAPCx*HeRrH0;1biMn`m@K{s49e{oC{Bi#LX{ks
z!CL&34xVt|UN;cfl_=NFxc7tPdQ&Bd%YG-A@J0*pa-`);zeKYirJ3A~*Ax39_}K8S
z;WO=~(p^n8H9fu-#b>9qU=I>JXXOqzBz!aOtb#0?tX|v3LT4AoN>S}ml{ZM2UO!xJ
zbj$PY%gP6=!14u73%&{6xn(FIdXjCUNDj|A;#~UW&K{#vl^$~v?w-Ew&ypZjdE-;Y
z2yT+fNv@E}>902ASqe&U(7Bjj^r_yWXpf0+vMU3+Szy@qI@=-m9S@SfDk?`B?@_3g
zXz5zH<o@E&Ej;0EfXFn-%k+tmYWqm;ha>MWeSZ=v!itKpp*6Cb(KYHzD;*yjb!tfW
z&4JgCUX1yCM&djlu*i|p+ExR&Gqq01u}@^ZGr3S4G<m19x}@XgmElDH^jrr`#f8T|
zlZO@Lv3}RQr>@Ap`D6k-M}W%&1@J$%_RmjcheC6zd*4&Lm$_)6AqS?z2ptBo$5XBl
zE^)MIb{+eg$jE44BTfr?g%umVfc<{c^pST1mv@-;z28a8)Vblcs6zI@9jc`Mydz{5
zq;bN2@ja;2YvbM*sPaBLq(1w|To;c@ZP2a!hwuM<=4QNd6m#@)vDBncl<(h^vKv2R
zm|(=av-RQ1aE{+OmFz9yw1v^T-?jKWko)h1VHIN%+>k>dQm6(OL>XHXc8Su5ZyzhC
z6-<V3<A2U=F*^am+--bSTyL*B7El5kS1xGOy@}jqAh!Cc)?u9b#G|BJMMZf!dxKEA
z2YtBa<}t&B`L(!VIf7e<K(sk-rHIaR<C=W#0-Si{ZTXK9a=wy-8HM-E<zi*{bC1j<
z)+^7Sc^S#YY9qWg9h5%AE>AvqbgK7Yx7ebfj?st=X8EmMkc%hLe#BODBe&?yhO5J}
zVCpZe1rP^XBTc}MPwg>5ew;D|`@~Xt@0jDqT}Qp&{ZMYrDhlhocuA1+#bmrm<JKL~
zJ`eLZt-TG;c`#mny0exLdUf_zP#LtBa$aQVk!i5CFfIPhR(b;;dX@w2zZ45S>vQuw
za%%U=0mEo8$J7st^~?h_Ej7Qux|U}v%A+<eYYyg!#giJ6?zipFtQ-kT1G}2}i#LJS
zild!B!wpjC*{yu2Tvp3`6{J-E?swhId-q>8R(vXVe{s84GkpE@4AH~%{3Kz;(eU+A
z!xwr{R#k0F!2BH)kDZOHi!v-1DG5LJK-0ey`E;)5h;6C>!+sZk;SM{*R_agm9Vn^)
z<_2RV5;h~WwLUdP)Js>8q3Yw6=CikD;<VNEdz_Q+`T9&!j4#Jje`ylgb+-@t$?kVA
za>9I5xyaD+7p?H6UEeM(COeiv>zPN$Y3f)r-+HSPl7m|{LG0lj4uUb!0)h;i6}#Ir
z1@hP@u6^CKS}}&)$ag96=V~s8w{52ja?axO%6Ts(?y0BE&2jNgP&+(csQ3hiia%I&
ztJX2!&NYsDdh+8LX<@j&8ZN?0;IgnnhLrL{9<6X@Bx~!GdA)U?q%qD!?Cu;|-0+8&
zdR@^<@=u1gqgak+<3fncwCQMA^F36%`%{4b<zpNqb%{W_-^ExG$}2z^<co>E91HE<
z|0b2_=H_*}ya@`>`5wF0nk)2O1yOWLu}}*PYoAX2dQeoXSUfba;v;A2*PhQKtH-Kg
zzw^IL5otF3y@`g#c0oqSHR#|hWv=tvo9`nV+xVtU`VK!2oO4b1VuCGy9C*<@d0k)Z
z@b$=vvpFi~S>>@NdHj#tqkL~Cm>+j%!S&hkQ+q6t^M1I5x61zQXJVU-bf2t?>Dui4
zp_(vevg!P~>W98lrD>g2--q=98Rj~>?h^)=$A6U`G2>B;iHB6JvY>4Bpt^kow<p<<
zchSuF?gKiNs~wVOr~R7BA^x|a6UHGslKS_o0ff?*9N@$2df<L!TV0yi(CzyXkHpY)
zE>wi62wbR3)uR_%sWq<NNiLs0(T8bauPue-NXFlkFM63u7JvL|7a@KBnqKBtw*DV>
z$nX!Lbefd+Np5tK1t)>sAgkb?UVh0+oDkLX^j-|v5~8t`&Wma*I<W{}Q1)xBJh(pK
z;oV)-_&nKi$jIkOWBdfqyfLzgLN)o%Zz!81XNzVJz7R$4Rdr%Q-<xL2pFX^Y)hE8)
zu+d&X%ZjTuxwz+Hv*=)PQI6mFXw^<L?5;oEw(2|m@ze&`gAJauI|YXmPi%1#V7OlM
zR4wiGs~(lvcetbPfYsYAofnZrnPVv%XI@I2$twR?^{3?WJt#N>ZE8HX#EqW)Zx3Rt
zu38a8?R~@E^DIe3DDb(M>XkN~<@c@Qk|RY$4@#CSl-unW42!1iTk;N8o8tVs_wz`@
ziMxx<uTxA7$Q4@T3JTM?M8N8ps*Rc}O-t^66Z9kE<V({VijpyUU@PuRtNCe!_}H4N
zpDr5?k()l^bvw}Q<zB2K>26nwDVRXZ5Pw{gD8i(u|I#JMuPbDv@bshmMh_OAD9Xi5
zRtgZ_OnlEI#Bjd&7+y$3-u=!PCUrk+G?s(sI0<fKf?H3TOisieYvfn(HKli-iYQNp
zH?|SP0R2J%TP$y!j(BI}vsN7r9$|s!F7F`d1`C<+6}ltdk&AT+PyI+$O@vzBa_GlC
zqto<Zk3nwQi<6`&!KXw)hn*u4K9jeCT=S;+gDR#Z(pT=fUs=7hC{4>x|KQ9~N?Ky0
zc>~m@z$F%^b(o;5rSu0K`H?BAoPF~qtvgJwzlo6f@%sp>CNv5g?AsN|Dt|(0oWuHr
z_QA8y8B_hm9GRi_?*|LhrWQB?O_AdiD&L|AL(Y3}W6AIA?$6v_GH`=S%dX^HsOOD3
z8Vm~>Z&_Jhu{$3vW0!K_6pdn2$Cw({DVS3lG(|S+nK~nWUC$crjgde>MjwOoySnsN
zD@5|l><dxn(Ics~mf5QdWzdJPJQ<r5uIArT_TA}HN9qmJRmVulZE%CaILg}$)ld#v
z;}x|LMFk=R-B0LzqrZm%W4A;G2R?9v{<2w<_V~F+69hm9@hcvDa<}YW0a+{Fs%2}r
z){}DOnX@`B5NF3dr{nhX+N4@NZv_cdPF!}kV_ZZa|7wpEz2V7uJqmV@$Bkf(GeR#}
zY=yJM#2CE4<j#ryQo%m#+e7Gk>MMMHF!<4ZD0o;H*O9pO41Da86Fm!uY6l9_in`(@
z$h4n|yHVoCP*h6WJGSYQ+o6NI>msg^LgOofqRXKNuR~1)7)M59dixBm1SnP_3kyXz
z476+I9=L6GuJ_5at&2OVfq$B#(YIn;gj!*OuEB?^5L>$ml3Oo&Bk%0-+gP(T-S5DJ
zsU0$rJ_^jVQD$#T{w4mx<owa#t6ig6_lM6&4?-K{G0Or9)ph=5Wn=Nu;vxwB$b{N-
z0a<NPXosXN-rfHriWpk>eQaltsQDQRz47Z4a7NDfm_5>CVUBpH?p`$1k7UJ3X+gNM
zmbNm9;HRUBj+~ao+LeRfe+qAf=gx0X-MMfyVa8bbJR1B<>2lMaX@3*EVu&5LVaG{9
zJ|2G}&uq0tXa~cp<7)fc@4+ueB|a4I-D{5UHU_7cM^9gc9=+rI(rW8zIQ2nLu8Mm`
z$Eek1(-Rw{4&ARt7!)A5U3XFoy=jAQ*0;W+(gl`X*3(^+grY_{@*AZ@?(T!R`d<F}
zGphMe3zlRfS16Jzj6lL(U}4x2uWWcFisly2u?R6DpE}h*!q3hU3vY4-C_RS_JVM(|
zk!E&0fek-(f7`>T^;$2Y3G(Z#)aox;%t1IX`uexzyGOWk53;g*3dNxQmF_ESOgJeb
zH;Eekf_P_b!Zpdn+ENEs#AfE3{=RtaB$;g~VUIsA$nkVN*n(sgZ@_I>@q{#YJVfgL
z*xaYJ$7Et?>@(BCarA8X$GTVO+A(8vDk$>t(2>O$Bey_ha>Wineu)U}h9hb43zy?L
zbbg)Hd_T($-Ihsd{wyf-lTM(>T{h;%0;1zsUX+#Igm{OPw_>*<37M3wEc+!Ur<M5+
zlpd?434!_eP^q6>CXPy?6@4q8q)7C(b0#Z!{$w?NLS~E`F*!#CzxANOx)$TcZ<&Gi
zCyBYq53SjZSO6Pj<om6zxhYZ^udi~DYQL^b=hY(CUxr>jSlhw`zqTf0Xm0*+lMHqq
z9KrVMrzM9ptK*pY?EWhV<Wm1r9lBMr<+2dNZAt%a`=6OR+THPTnrN3JHU+6*y(-ew
zg+0bduob(z37O0y_t7V~_ZpO^;kDM^Y4#DV8GAjaJs@X|NLgN;y83F={--5427tBW
z$li@;*Ct*(EFM6jJyys)H<o+n&r0lG*p@2F*oTv9pA!c?Lq~iRRGxYxCp;B&boTCU
z>YlpyTYl!i=V)kxM2E8P$YQ}x4_H#Z)v`}krV>M`v!dHSFy75pL3@vCJ1+;wD6j3l
zvgVc_IrMyWLJ70x9e0Zh^^S$gqaY$hfaWr4ie#ITX{(Y-C~K?n-jXwh)Vg0=4%Yjm
zr9j!gMHwr<YUbt7zSih2J}E+@9yp|g(H80?^W3)iv6vy`iW4(%!xOz{J@xJ>4oH*R
zYf`9)`3{ziD`nJO7W)zPoYb1*cnaHE!rIk5D09p04+B%*Ee6f1%QmChY`CDY0_J`+
zl0*o#$=Hu9IdQN@UFL6=PEQdKVHoK&tKu`hq(x!IktdH&Wo`fUT+enB>H=pQJ-rG!
z!#!wMz!XpBwv5VkNAMhH)iF)Y0<<Z+-vam0&E~)(Z9}e?N>h!<YOF*-MwGwsBbGy#
z?Q8&1nM%AhO8aehV!gF0@!`9+$3ESP?VF6B9pNR@l>QsOD4fr7sEb!nN!$m2tchHr
zLzypcCF6&L8AV?0v#M*D5<v|8VHX4sw;kpcXKDO8xqwX{GlYk28rWW5lg73OL`?bK
z-bIIOqaY=UUQjPt&78vWuCgL?F6TQ1Giop;S7ZfR*751@KZE9upD!Hs&ZFXgUd%g4
zQ%Qtm>Q*>hg89I{*?PSSYh*WBlu@-}MbM>PCxs3fjK+T|PkZT(!gFD+Y_Kisv(&^W
zs3k!HX$^Q^*JX1JqF>;_JNGGLeuTKv6*EFD%ilpf-iZH2Qvq(4WW?T<pnK8=4kxu)
z)qJrI^z~sbhwoV`7{acIvb1JRP>bb?Ah$=)^5W{fcf7DuhQl|v8E+p|Zj|D{O_9-j
zy&#-t$tgjD1uA~;<L*pyE01r8lDV>juvFQjWRcKIz%?mUl45d>BtE5|@j1r^q(Tc=
zqB=PJsgp%H5KtIj5;_m<erD|Z))*m?)i{MMyWNp&HX+8-Oy)@2i*A>d6fpnu1UFH8
zWU}S%#=C6Z|KG@+CV2AFrYBdGVpyVj!rU$sajqnJOk4QL+s-#mLW~y0f}n<dgiN*s
z*=c*^RvBl~-Ak-20@RUxaZs#<2u=K%V*1wuPhs1jp^%2Xf5)9T80EDG*}*yUVoH{+
zRdzvUd$`3uB;ew+IdL)1{rCX+N?Nj*a-t<g!jWS#B#&L1%BGl%@p$;tJpwLdzvjlB
zVU{Rzz&4S+uV#CN8ArYLB7`Tf!Q2AJokGi!ezB0#MUGEDhTR1sCTz)g!uuHQ8r)cG
zicq?LTN!Sb###@fMu~?~He4Wq9p37=sScvA3YrsGE(IP{z+dIia^T%Ij!3vPb!WSh
zEaPS6r)+8JU&6&oq0AOr0XCMHD<Tf|*PtzsG&Wx*O&!$02L!LAUe=}j@3;p=msnVw
zyhI)B_o5>w-;r=qD{QL)J_-GSh%3j2-<wN2Xv_`dU>{PY#KvNr6T2t)nlr+`>7{!V
zB;^FJy2VIW9$NVHFjj>wBQt2=(zkQ2S$T&def+rzLNRZo+|0g?HaYpTqGz94;`P*T
zPfsYa1vLRauq4Qe6+?N&1QwP+3iiBD2Kx}XM`MqxF#@(@U0yFpnpCT6vcw8K>yLQ>
zcxj&qEy!$?_Cxt9t~-uLL&O_<ppT})jBt(-?p6^K!V>WMF@Zzt-9lGVv=4K;k<1NS
zLYWL_A&9YrHd2;puoyliO(nMbL{O)H)E>5UV>34l#~8w>9Ay+;(=u6Lg{<iZLQD~p
zi83fOUdodwyl9LZHddhStD_LawqCP+S}BC`-V7YtEwCYlm#hZQN$E4EOc8uq`37+N
ze!=yVxZstmQh#p=;;sy`7$eVise%wXNto?^ungZ`VnNKe8ASl?p9XB(73x%r1}K8n
zJc-(a)Xk5h{pBek*MkU_)}epS#dNce-3*2M_BkMBp~gt%vNAT67boSVB8&sF#_mA6
z-{{$kTd~JwM1B4!zu&?%|IKJR0BEeRB-bud?fU>cgfe5m!ia|Myg(F`xSl5yh)X^(
z5CzkSf>@!hdA8Y|+f<aWCUV8ri9hDsjYELTu@r>a@i>zl`l@V9Gdm@E0rjWOWkWp~
zMjs0J;W@TJREq7dfAaqPSd7+m6_uOOXVF|%!}OoHn&O?eXxmxPv(bL|&nT$LOd6XK
zo2UD|C*d(1(6-%1S<qFr5jOmnZT976QtisahwR(f@OBZvp`}ZtTKgAqffu8ph@wzY
zRD>JljorwzL`tY&r^H@?)P)ySVHH3C7eRN!k!{#nVNY)3xQXQzrkeMlYe6>eSVf6@
z5!p3@g1IrmV)Z&XJFgI3%XrUW-XpiScH>wTwB5H;kB5wKp`6AsQS>rxliuJLZ&bOA
z5n2@Vgauq>Bj|?x_urwX9|(M&is+iCNe62R2b#2*Tp>xp9Fd%{*FdoSjgj6vp+7@~
z*^gPG@ahY?8YoRUv*2uFn=jH=H^M3=3#Z*nIh_c#E6SN5)2jsbJ0&XnwimogfK{Sf
z(6!~9hZBCBXp-s~w44r^gpJ87!je1wkU~S>;pr@RyQn@+i~oE59zQxFVbyWeHW7Mo
z2PgnjcUc7SDJo$pp|7dR49VNyAx$OAV;nzBkS*MOi|>FgeN(h}E&*(~9EFN+CgL&Y
zP<uyfoE8oFEV?0XUku0_$+Xjpdy#aH6?9%!6}z=p@XRKbgNV4Y0@i5=tAHQdi&<>n
zle$Hhp!;}P0mCeI(+#3-e_*kC(&Y$zg*%+xlz8OQ{bkM1Gd9uCQ688lildQZJ||t6
zu@A^o0_4`Tce{n?ri~$IioPGTB?|zdB&)Fqei3||4GpfyW8ZwbAD_ET&;=%Bd!>vs
z+Vz{?WDkw*p~D9}4;^Z`S0zSchk4Qn>LyLZLFAx+v?;>Qd}iz}bn$Im%Q_3u49VI~
zt_W3xhp7STm^{!?0k0TMygL?R|48w9-XL@(HEVB+_yJ+dgZY^0pMsB|kQm6xWHfUa
zpCVHfH#FRRy=D_*qPf_v`HK-!*C{x>%NVi#D-K>UH{tMiBjk#fd+12sp%lBfHaxXY
zF3>xcZk%uP*+Rj#0+v%))lKZtax#$5IaZ&imM1h%2wX{vUJ44sLl~!?2^{oLoN}-<
zL!LBlF1pVC-*{l#d*SfqM2;tgck30gN&%AX=l+{#aJ8bHt|k8nOe58r`m>>D_XyF7
z;||?8W9W8Jm?l|U3Zz9TP(*FOnJXWCxz`!zbIJy$Sc#BXm~fcrZI}}aX_3{4FGsiP
zogu4PNjCn5A@;k9*lvL<`&7Jl-MS{o7`HC}9e;ZZnI`kj9Gam}Q*_QT)yTmK@mIXC
z|6}4NH{{8x$Lp#>zW|}{6R*;KTCwG*=|8OM--Z=ZUrW|pH++0Q9o5*Ns3NO(g~*L^
zwi-45{w@QO2r32ts3GYFZ)-Cad67jQ9`YYlgbf-Co4(LJY?`em`LFyQ9A8rnG>Ey(
z`ro5W0$q@-;N7wtmD4Q<ZdBxW_rp3o@?>=NnxecA&5Rf3=|g@0Tge_I>lz_0VbKC?
zcRZA6j4%!Z;1>m%xS#BJxpxa3{w<S3YVT!8ONG#0O21kbM6S35Nro6BrYVG4XDU*6
z$2O!JR;hL02=kb3-GGnU_AXWvLi=_rTFm950<VdoZM$d<85i&Y7ypMJcM#n8fn@vr
z7GxYJxJl$fT2<@w5f8o82jm8bgKJ;oUWm~m%g>r_!JftBlPeVN(;Mn<sbF7Ukku~9
zMiO=Tahp40wBz@tAB8<|ks(*aLXw+cgXj4pc;}&zV51w0?Yr@*PYBv|1t|L_0PwFC
zLR%sw(DbJi?A3GKM&ABaIZI$r$+Q|Vytw=inMn*7ZbJ$k^dh(k-hs4&BWHaIz0_T-
zp27ypJ~3QoVziDSa)mHpzIdPrqx7fq36E_WMBQr#<##(T+*jGj;<of!;>smRt4DCh
zj4M(Xb_73u+!zVcBh>aO;J3aK&4I~7y>VBdqye_Mrx#mIk*o(TYPt@2<-Jl-c^M3L
zRGS5_Z#{ue)k@R~5_PMR3no~sq_<+6Bepum$S$qtHb~YhRm~^gqYsZ565Lo(IiOFi
z+NNkOwVoCIk>xXh`d6J!oO3#*=~ZJ$TEg}c`J~`%0)@&#op48Tmn&VOprS_tG@gZe
zkAgY5Z-*BZF%M$$COCToa|}Cf!Do&H-`}nOF`pl{oJndqxJi`Y7Oi^!;i#cLxq|0^
z265xZH9I_&b#`rGR10&%WsU*oP2wR>R$!@b8q>prBnLR)xl3RdCyheCT25!x^bf?#
zji5%~`OXR-gR_HAZA8;KP|jHyM||@G9ada_d>bYjw4y6D;1>C<OLv~%ww|6{XC=k?
zAI=yw25q|P7`5VS$=zF(8`FEd&(mrr4o5>G6e?RBdDBjUSm6eOZqOxy+u=KC!!v=B
z55JxYU7hyJ;kV_0S9jNIqrjML!!8ms$qBODc+466E|k}8h6r9F4L+Bc)D(%py>9yn
z0KXw@$p`3SLqQ`&g$KOKj|-Xxe!Kxmx=O}Lpq#`>ORRE;OnVL7nE+!qY)g2ST6Wqw
z4qN_ty9T=IyRR}>o?6EyPgWx&9j%+SR>y>t^!f0cQBa*R0t2W?Ek~f>CZ?)1Se1SN
z!+3#j<dDanMPMPSyy(bbtuqeurbwDGLUCD^!|Xv=A59F6o2w`?LE0s{Idk6AA-PAQ
zv}AScl_^2&DSr#xz>cQJDPWq}+vA}+2yQ4IO@zXc&E4nB0zU#Hr2JcmaSeD5L%gC=
zJeZKlV~Nz+d%*@>KcIHWznihYO@wjM8sF6jlEzzI(2=XRpM9YZ^P%bNC}&BG3RVX|
z_EfU-wEH%zbjVt57+q_5z8C{eV%q?#bWHz5M`#xe#8A#h9p1QvZE_#6*7ei=MD9pZ
z?d$d(%y<XvQ81a-Jb<KIAstS@ABw|pLxJ}TF2Z2IF?s_hI?4KXmr=5sHBb=~E99k(
zE)e(N=Qh^(RD>Agcj$^`91omLRs@pD<4h07^}S#77$bdlPHLl;dcWBfaGm$%*N#1m
z%Ym*+>jjZ%&bPr|H7gM^?c)v9V^5nk;-S}3^qLFyTN&X1NbXr`EM!s|1<7*5a}qd<
z4L#fY#OBQkct{{qGMVcJl3C&G0X#r7<SDx;N(}$gU2>S<#s?&g1SHKEsSw~hv}`6P
zc7`x0`B!L4{u3I%r?OGd>_$82@8$yto(kbKt!nGn$Eud;VrbD(jkdo({>23WAr~8A
zP<vf8ndSek|04>(F)pD^J6(_@*OCo*%+tVtaIYYMq1o|zE&$=$I4l|8Zd#N{*NRrq
zv^Sa~mZ2G+^h{b<Q}7U4P#;gNia9_pz+-J8WG4R|jJXElp9VHN!P&W#{=k?>b_zQz
zX%r*GFs}8qjfdv$$Md1u8aKw60fs#gz4!72w~R4(uHJ8!TrqpOfCT#;0;E?7&_uiu
zaUgnpK=h>f@lI5THaK^hOA4KQBA^ytps0eKU#;K#`heE|%%y-SP^i}DP@`_zYia7P
zO~5i6ft=*qA5rZ$0ck+re1VkZzm%glFeT6j9R2qC_%iCx%}jyC>;Td^bDta65qA(b
z#cgs=F1GH)NAqi(BKOzR8+g$l-G^dim&|jUpsu?6!$vUAk@yxMk|5+t0EouG*MCD-
zu?GU+-NFVC{d8Td6{9uxAqQ*2&*PhIdjnZ8S$Qn7$Rp>$j0CyDkX+#hU_6t1rUEqX
zgk<)y&D-%$kM+EJwJB6zuCLUS3K-W1`fvs_5VJn~A1`l0>X=II-wAfyf`_X|r_6W>
zZc^NY%&33sV~U0yBD?8N^fgFQuY(hH=>W!?xt~A|fpw7O7OHqt@R?je+=;uZ-uz6#
zvRC!0d2kyxJVsdHKGZKtp;}U?OB^y7ro{KpKma_R%8s7Bia^}=CRlL6|6$($UaqnJ
z3F7?|LYwq~)DpbutJ?sA?xXvizHW+a*(R85!X%LmL<w#n1_J1m6;^4>gO54_+KQNt
zg{eMKkQ_kqQ4Yx2xcoTCL~!LRmly391(Oyw%GB>Y0v=(8MO#tN1yf`nh{>)je~&o!
zix-c9&c$bE?*i~?T66lK;lF7>G$tR2d+n<a%|IO%EQZ1IpeX2$C4?Ha`VTtGV831G
z+F~JI5NRN7>iFXvbzr&Lh_$)H6(-1IV<hbWPwk|nfg7?4!g=6adt((ahv}gW`mjoj
zKHp>1bJ`ry^1OPoF&YG7u@}(@HZ&bpz@$TB`S66>$+6{7uos*?KNGTN0)U?=Ndz4U
zs4Il>q9Hl!Y)DH?aEC-aq!mk{Dgn#68A0c1H@iMrAlbax{i2HcYCm+04ZrL|bWd8G
z)Y6$mJ)5NdV(Rs(XI@DA95>7}4q_&4nybg{89ms~!Wa>8mz1hf5~~O^sg;l+xNRcg
zI=hdkQ{S-42-1e?gr&G!Rga)j`|CN;AL2}7pu1sQ8GE((@5a1mW&TT-?#weH1h<<y
zplU(uUR9$qZMHl&;F>NX#&Diispo=Kl5}y}nO$n&=Rk~X%feh5usm(BK}FIUvnOd9
z*?$rQSD#~=-ygX|p#}m!j<En|FOMDOTW3LQj2#fyCzBNHWxc^ase4Pl52-t5|6K^k
zTce9Hw?Gw#cEzj#a0HlE-ZoP0T@VBUD<ed%AYaQ>o7qVi1kpPSi28t8RRPw8BuN19
zgU31c0U9BSrc-87?cLl(WX33X3mLdWCX-v;a7GMM#EK3`ORxif3P|Sxq_Z-0KaMpE
zvR6+rLnzU2ziNV1KyuN{Ih3B=r8aZ0b(x<+RROw65nyly;-fmv$ENL&c<UdMC})0a
zm)#b);c~&mWigt{QJ#~T;e<h8wKrJ7*+OD82Ar0wg&+4{o#FskH99*B`12d^aHnCr
z^^YGJM;Y#jY$x_JY5X}|9@Fs@*BZE21LeXEUHdP&aH85{d5~W=kc@hOUlwDsv(nHm
zGo(_F;5Jz;!RfM5+i!=m9Dt%Fk{Q6=-=+`y!|eyoE;r}(1T&qC(FJk^>pGlWrFMV{
zIIRfmC=cy8u<QHUX<O7MeV24OZ=Cq%p?mrrEB?4I_;~b6T=WF7b|4V~$Jq6q198q6
z8|`=}fT^1agFGXN!NnQDuU5MjPGK3R@Xf<shc_*Rle`fZFIXjX<*GVhhuYZj<F3xg
z)rB7}$h!4#Q-f%+S})|Rv6}gz(QM+@0YYf+?xq^V8V|qFFG2Tc@!`pb!qs4?2w?wH
zW5<gXa0!L*KH`#!^WB4{GZ*i*r|O`pnm<n`CB9{cCamUT4?79ciXDn`uSPl<@2^pw
zu26CG&#JFPyX@#t(Yf%NCP){!6l+N9%{3?~*hre{{(ebaW569T*OzMF=(W6l`ZV3c
zb!=nkE!7MC&+YI+kN{!>isClJ6WXvB?ZT{qm8PQhc5+1>=|H%y8Qa0D7mC`~-@%7E
z1UT!n{?IgGTg%h*)e}s6El4|Jid^2~fcO!Tb1p#-*5l&dXqs|oX&aojVvTQ!g@{bs
zz^c1F37roSfwNf(6tUnik(26uSwGEt9;;KTQ@H=hA#&MQnC310!4wfta7THC0eS>#
zCk6=#q4rzJ71yDj(0@SIH#++UNXS`vmb0O}TL^A8$j-ZQ(o}0;MMROy)=C)tln|M=
zTzCM<3NS;CVWz19K!<p+r!XW0JYz)H?*fNbpc3R`KqQ^nb+;Q4mWC{)v3r8IpcaPN
z4hAS9NIxe4GtNaj5=Lh1J5SIpWv29q9OC(;!Rkx0Afo5i1<B1lY|Nx4`53H>H3s_l
zf!IB{276j4#+W%l07x{99i>Col;@YGN|VOXwGWYU1}D&5<^BMI7;Ma`yM2}(&d1d0
zfPa(sQe9-#Ff5um%v0@uhk@UbS$ab;LbZ*YV5l6BCW+I=c|ymWfk0m-(T;QyYx&S5
z9dbn#)Ro>NO|>Oxq87-`W)SFsq>6$v0`kc6f`q|aNnUXHF-NC895Gjz!REa&`C<^N
zfeN67IJnE}1$ziMlAWR{vdpbiK6k$EfGZLnA;ORhF6`EH1h`3z@dqTinf6)`+!lAj
zN0rW|Maz)Ynn1u_v1tLwp49#?U;C~>x*H#xB2I^uVIDlqI7OhV>nGYJ`9OL<>iL7y
zx`!1q<5X7{!POK;#w?KbOmVRL8a)4Y%Ms2#f3<L$1<8-e%m4v?st`jjK^q0%7}ong
z*3d~_?l<8E5^B#9gc`*%k<^PA8IUSsQs(O`SdkJSja^~~{Mq4H$mFvrr@HE2j@giw
z4F5-7_`p~oFlDQiq7>{4a7^^M8|VJBx!fX+)rG<gpHn<cS#n3RhAC7{MQ1jYQ|TXF
zAXB$47Ojm^sQS(3DMCQTh~OD!CFH6J;v{E?@0zjHQ;UXXXYBs(t_=04NB}`slgV=4
z|MF&iC1XW$aJCgQDaNIb-;CP?VxOZO6fbuGEmtjKlFg9OC`g(rVFi2CxloadiX#m&
z*k@^HDG+auQM>GI!*ITQ-~{J*K?G0~4g7u=GYe~k!r?dm=GF8fiJ@nWU`bzLyaHNt
z^A%)(3<Y5ey&+2-I}D<H0dRlcW;AIBS#2+(vpZ0l$_{d`pdo1kKzJN*wljsQ5OR)8
z3t<WmJ5Wm}5a)OibUXj90@%F*h(3JOcPo8$D9d?zqaq9bOB(wF1On^{Clz;iW#No0
z*ybL&4Lb7T|4Pbw3}hnl#SQV`^<c7IlZUBDDTJl7;rLY91wlpx(<}2HLHqrqAtB&m
zaX|qOyzlK!wpLCuO&>@^vjNlHWp4w{bx)u=mS=(xfnQxCFvDw&e;4N{7zYcO7!)yC
zF0tXoLIgKgg#Xs(w;Hetzz@zQ57GH&pa$?nVG>>2avq=R{@;j%asV$?1+9+Pg7B}$
z|Ck`-|E9S11zw#T{C%lIm8>Q{=|(=r3Fe6gE_VZ(q>K}nf_I~Vys&KtXoUunQUW~g
z6j&eAOzeM69DFFa4VVrtINO2AYmz<=5)G8z-`~hy&H&}P|1YPNf$#JKdG{?$jCbxQ
zOG&cOcS#oA##VcqEik~*APQna5A!j!sqV}IU?4wW;15@VZl4Cenep>MpBy#VQxCXd
z;QWSBF$S<@Pq|uPkKA}jw##atJxQQX4x0x^0&qD)9gCn)$pFG!XT$X;%#k6QiMasi
zLuGmTWiQeLl$Z<XWeG_Bl4DgcwW>Qx*teo?4PXs^SR!Ws83QihqO+5Vp&|zjM-Jxo
zH2~`Vc>1ejH9!IgM^MiL_0K?A_e%EcSL!DYcHl>vEs3mPSB`^J!SBK*$bR936LHB4
z_!LU=4d|>GnV`$c6fW^cB8=0_t9)S7w$g_|y@Y}lg472kE*!t5IPO8v9k(K7{tXa7
zBxwv16S;q%144Pk7@6fj)5REO4l2M+F~fXL4i)U@DIsC0O#L?F=(jveVqeiN6Y#1E
zSS`U7nSUz}falqmXtokDh7}=m0}%D?6zq&(0krpr^rj{7U5hgpE>Tp0m0`Oe!f*h7
z0am1LDM)2O<v!A4s)11@fl!mF{+wXbW+_6nHy|9?D*lfusbe6`2Y`JV$olR~03TyL
zbek#LeI_zk4oFp;xc)hZs5|Uh%*<76q&WbYP+*(YgV>mJF&Pk(eJu?g*??O}$Ws*p
z4_wQURgl3fCWOohgA(g-Lm0s7{-E=Oq6P&!JA;UqDGxt`*G|0H8Dxm-D2x620eJq0
zs9T$^g1w3ca>Ik=To++HA=9o$LpzC$?-L<@zHL`dGBd&)x(Yt@)sH~SQPAT^8eDs_
z$V5cU>nA`3G4n-^H&dOjL0Urp2>~0jGYiPTbm!k2%vDKanWdlU4WcOLi>T~tHkv(i
z`zza$pd_Zsr_g~#(`077{nRo2Jh)-qg30C$x(fEe#($I2rpTG6AfxIBayn5O*mdB%
zFXuo2X8;8^1pI=>iVK~PCorfATWs2i>j;3vl<s+;ri3<oYl3bnQwl&4i^UY$C-@gZ
zaN|>*QW9~HTr_0z6))ae1O+(t0HAuoSsfd7GeM61dlvMslz=Q*+}=<0?49DM98;_a
zG#h|(H~=4rD=8Fp!2b(~(yR&6kYrnFf}~0t;%bYsn?Uz2XtHP7Ggb^5k^Y)<vL>#x
zA3*B1e?$PKC1gS0w1HNDB>|uyBD@v{H8C{-2B}?lklH0Oy??r75J8Ni^8n4Jk7r3i
z7#RBh#xO}7%Y<~zkY0<O_qBcouDbaG89N26`8w<|^i+hl0%Z0ndkZ`aA`Z#PhYn|e
zxfh~sMn#^0B<(V2%-{rtlvWW23FM%D3&WB=6lyZ0QhQ#2@ud~L#H?<x5s0BqJ!!l#
zXv7)ye*=PRyx<1PLyZDf5HhfU6sQYGf!cGBE4<OJZE=6$>o_RN@HP{d^h@6G2+uI<
z>98Z{?`?u42foq`jQ`5C@I|_xp*`r>ddR}u%6u}dstNj*y^Q9ny;+F$x-+B45(DC_
zelm@X>F{h&5t;??yqStX1Sp`X&(l}<Kff-kfF=ITr0$u4{Yt%9@R*OSLX7<r9wq=U
z{CyN$&pGKUi+O(v;Rh?GY^9Ef5_E}7sgT=>cKHj6(Hv^S!CuAKcIvGVaCsrZ;5CT<
zZ?bf2ZEqqpeI{*o*%r7V<11ShzdE@is?8$}FCB-!8rE<Ep#iDwFS}px=uR`8$z@&q
zI6oMEk(qGY{#%50?XWB?DNe!crosrBS5oK=SF0f{=3E<YLEQH>NK5+vXi*Z*0+15&
zu(LuYfj+Vu;(X46bw_72Jf6~5a{}XbgK1D9Mp7g!%L!!1<oHQcJJP;ZfZ=Al#D~Y|
zefhM*LB|v!GR=*(^z$oI*rzZMpt;qDf;6Ypy#91(2P;{o=cR=&&WM9#K^%^!nWl($
z)lqZl&>ROmY$5*b{@WdsEl%Gzu?U<)RVCGwFx8$KfQXZRCGqE??l<guga7#(lF9LR
z1YHHNbYovU`R>e47MU;bu$rGRW4YlOeYN`V#0V34b1)g;OwfE{jqrk05IG!%!>zK@
zR8J6BMA0Pu1Ss<iklR_Iidi`kV7OvHU{>2_iWJwqtXl<NAG`rArO)cYJZwj06~wck
z_zY0-yA~~jJ*!wJfmQlbo?j8gD{G``NkrXHlUYU<RCMY!&@qj3FBDa=`EUwm#f}Hj
zJzS<uke6KCBIbL*6UXf<Ks($CE|^D#UtRoaiU`f?;L<o~v8*&ksQA?5^8nmX|03g8
zUu3XX!UypTPn+JeEF5EUM+X!!YkuO&V~g`DCm#f=z>-oFDsZgP(Bwk_TJ8f-^t(|o
z$3kd*X)bs9>b4OL>*uvPX#e}$WX4P9yP}G({kMZ%cV_N-&nc}m-k@?P9h#O@%m;q;
zk#*sHIL!&{5n1d@kN|40I8n)T>_n5}J6i6H?5e0CS3HZp;Z%Q79^0vD1mK?W_vylM
zoJ=!~1~5uZi6bkYP;29gWKCA0Mw1Z<&Frmo1x&nHr9)Ht!;}t#4#_6vKpo7ay>6Cc
zVY@*-LH8TM`~&Nl3{xSbN2Y>)xISAUiIsQ|!v0jg&Eg~(gM4GAaKhVj9c7T4mB<DF
z)HIgmvD^e`P+Ui}Inw$2Z=Wn79^wB85H49vmd6?omzQ*PK34u_^157G+fw{Tucjv;
zmXh<r`sv}RevhXY{8TYB!rrb-ABSxKA#|M+V&D$EcbyP^a$&pWaBx}eFtIjT7Q0dn
z^)PGkR2VL6fe55fU0Bkef{DhRCo|;!KJZN`Xkv&;Gy8&?TT{sdQ&hE_nzC~FHne1l
z^n&(lkPar8Ax3A74lPamyf$lKKFB)uWp*(4&BN1$)(HQlm5`e8Vf`oVt2`feDgF9W
z`RY7p0!Uh^KlmZLc_%>fR`dohJLH$btR?WHo%@6P9tOL*BKEGRk-gu9UP5!rwqUPl
z8G!V>fl3l#TkdqI9Q0r5D!Z%>WM7S`;BG3SgEprRtPp6lkH4Ny69lzn@LH{b`3JGi
z95>)H%fNTIOyn>uB+)6r@v;B*Eu5bGA3<HZV1Y$Xb}PnO<k75NI83EoT|m=!mK&>(
zE7%m0q^V*69rvFCU8+v+V<W^m2h;)BVENJqU9v{R5>_&ZOIb;ANn{!v1&QeSZoumg
zjfuv5JULnbIvH<(F4nV$4T0=$Q0J|xL_Hr6LTmFsc1Y1}Hvd&uP}wn!v`yJ$j??(}
zBmR-by`e0d@S^;*=6z>_i#g~G_H}oD!-tP9`U70Xrh$h*!0!lGEWRMXe(dQ`uqf)1
zNa(*r2u-#7&|(fA&N(^06>qlr<)Aj=EIl=h-ARB#-xHR&(z;*fxZF+;bl%Mc5b$7z
z1{{8;f`yh>1Z>~7c|B{r!E7i=Oqrl-1Dc|83@g6MU~(g|2{JNZ@e%eF_Hn;Bb<i%=
z-m{1E??d6AZ_gOA@PVHl+EwI11@-j-y%OkZ>dvyio2H)XLvOGWAMpZkR=^4#&Uv%>
zoqN|!K|xwbjNP=K73eoneNc1Oq3!245j=x7yR~>2`*l|;0q-NYeJW%t2NX2gWr)zO
z?jY%|Zi)Hq2z&TSW2dqY?hC^=gDSy2bTw5^UPT2{O$Z2;tQB>ShGbiJO`(Z0#)vtE
zD)fMSEdCCpdi=_|SIcX9HPqq!U5W+R!ZHsjEFIdioz^e0^Ygl*K0h9Ir?&1(0f9^d
z?^JM<K)jOy^KkZD`5c?=T(f5GUC{pW_(J8YovbhUwtJ?96K7q+Ri2*<!pgNPQwo>J
z6}nsL;d*WPvCuWrWoQd1mGSxFoBtn6U*Qnd_q<I=cS}llD2+%7NOw0#OD(l@cQ;5Y
zAR*mL>(a5L^a8H5z#=Um@VlSy`~Csv-h0kHGiPR==a~Z(^PRkCIZ%5F1;!)$?SZ>7
z8(z86mx;V(hFe70O>=20=t9Ux385O?tk8!hdsi12v>yJ|b^U`hVczfVrp7i<S{1Om
zU~C+to7_Sk1X5H}m*IcIC+#%3W^tn@0TSS6iU!2~@w@Am^x=qEUjRG%qP{Pw?Zbc~
z`Jeq-u~e98K+@#@%OLFk=u$&{F%$zip%&|mJn-oYdn3PSP(*3(pxU=O6^Ie;p=jQE
z9rn%K;$4c^CDR)&Ci6yF2)-q^B=${OIX!^HeYsW7ck5b=0i`YbBCG)i{S;AlgJKMr
zO!@0vcM=NzAfRlBY-2o>iasL2&ik%r4@7)>|CLxLF5XY;LUOJ|J$_l1AEA*o=r_B*
z8N!eTeBgsulY8`iGC~A6kWFPF$&W?)u^<b%42F8B2!3!etd6S>6vyjAeY-0NBu^1(
zf95@!RUnf?K80rG*f)n)vGo`ThIezfO7@zZ+Hd2b7Dw{pz>!j+U4cc0>;}s3n_r(y
zUYg~Lh-jBxlrwM~N~0M5nb#sgW&&GQA*RqM`o7}xb0n<1%}~1X;7#;V4spzpyzo5m
z2s*Wl7l|NmFhFQF*1UaY@q!!(GO`XIO1T1w!r6L{^`d)ZI~DaIJ$0%W_1tY}h<9k%
zd8mj?!31WRf+O#*Kwve6#bV_mO&o}DsED~g5>W0Y3eU&YJlD{l2L~SJ_P_6j)rXps
zG&C2nMbiRFO>84nW9x&H4|HSaEhMinPp@Rbpz@w|m<pxoQ)E^UnZ~lM4#GWDlceE{
z1Udg!h!rZOwdaGz2K*-=-~=ZguX8oWYC<HapfGy<`53u6Zl!CKe55?&8wYY@M&c@v
zH<uC#9_~z|2CSv4Xs07(YV{dFyrF&zt#5mrQh|KfP5V?9kH0Nbrkox;*Kn7>Xy95n
zJSWb%P+9!8BZo<FBP<8_=O1rHIIixvRB9XD87l!#8E3E?Sq3^~JM91Oc{b1!<lRgr
z_>V$#;g-__pswBXN_?h+i@Do@hu7J0oh_Hu`c8bfzn<w(3WePtYM&F?eJF}^*YVpE
zTMQsl0U_G59HikBnR`k&XxUxQY1Lt#FB-3G$R!RWD8R!9|LvHQ7n!VOx<>(+d^u|L
z<WC$iEJSytF(mf%gjTg<SMAjy_(Q(_&3=Z@3l#LQUHg*EwmVh1<#=49+lZb?|E((R
z(Z^^3u5KCQ->&~#zOWb`19twUS?o@^u2kb60>-6VtI(0&gp>lueNC6|@;8oI|2;~~
zlQc~VN?)_?Q~U|^!jl}Cz`BuVqJ()64x$EVS2YU*%B*pj`Um&s)SEC&#FFdkJkS@W
zp@kf&9pnCw;dKj;WFgV5!}I)k)S<<9j&ca;FT545b>^T@ta>0xWmb;@Q3R8@uLsnS
zyE{-R#<t-ag|O9rZjPx8F3})bz0cO^EHv6$`;0!|!fdWK7lMNS=UkHn>AKMtMTQYF
z$xZd9eY&YxyRUpwl64~vB$X8dq5$yc;k`b_QKO^1w-6v9b=RgW`~a`hJ6dqf2VV`)
z9+`5|<qO4khcS!`qM{r;pH%6onOOACb<e5>9nr<C=TzJaT)pz6hRAC|wz&vPUm(Vq
zS>gX^u#Lz`5ur8NLokt#9`r8Ijkactjj{=SD6CguE)2y7@LXa-HTwe3V(vMECf)=6
zt3aQY@KZno8ouB!&m|C#IlunglBDvQBN_lUg(tCMtnkx@Aw)~&?trCmDh?>$%<aCO
zMo)X3R6iBQr@C}Qj#F+SUoFjY8#cy(%F&`H54<HgN?m%f{ix@%hQ;MFn7)G4Hvc()
z^{~;f(QE#3Ej6GQZ~cVIiBKvkqOCAbrur>P&vdY^G4mQXukr~XeKDHnP=w-&NlH||
zEJFw0KhWCD33n?r<7}AP<c8~+RmXpLLUr10@0#XXj^*p!)alfi?d)<>-Hqf(p0p(2
z_s+b0+GPn5pP9#uuKiUA>XC;qSQB|JbJr~qba@GL4|pGZd}aIZ_Y;>eDvCDajEaOW
z0f-CHVAK9zEhY(;emSrdx4`Qw3*iP#u;X^Nc^BYf6DuZGLl@6}7US;ndPv@`JbAJ{
zV0{{6*PQUx^$M(ZU*L;`);pwu++unXDxLtQD{(_&I!J>jN*>ZNi+#hkQE0qh>OC!C
zWnX_U07qBeGeOsm&hs(}Kr|Taoyc?yH?<r00hs_k0;h8=4OD>uYFA+FWeQ=aTZ69B
z-)k1~HF7fn+A93o#+mF;buttbn%-nR-9YgEJRcsCjNCoSo(~R=0XszpWxuF0S;N+X
z#NCsm3cms3cz`MZ81B~j`MK!G9+tyH11?Z2()FJd)-Vz@9YFhQ64`IC1-&wZgcjM?
zphFEL{sGAP<a9YIY77a}H2YY_o<mR1$X8I%E%i4RR#cQv^J!TgLfOd-U)EW<;WWdY
zJxBOvjr_|65^?M(R?{tQsE7~$rUVe+SdbK`RpY4Gk!$ev=nM*@x$GEy5j9o_Wg&7E
zzuQt9a-4dOY>%xU=HMrG_X!7y^kUzPY7)ppN}60k6HlQhD!@E(9lhq=KHf5ov&wA=
zBBXDcW}u3%%yAjb378N|W?|qQy+LORq^B^3>Tv;pBn+gLk{q+*poBX-(&>Qn$A0f~
z^HN;8Eea)q#ArJx_c@6^CwwZenfWH-YJz!_gjJyp5dlaplA^?{D&7}0qV+dcHlaI;
zQz)4zC{DR#4WB%`&9dz)8R9^;-*mB!0Jzt@oC?9ujmMpOAj<+L0K)`;s6P1lkV?m`
z>T99}4>AgOmRj;3PLS7f5Rzw5zMlZBJDBqdsIfFt@S9b<K7!O$8cj1NprAD8f%2{v
z-R_b;dANXu5FcFYK76)6+872qq5Z{uxXpRX2uDj|GJoH%lFkZ)1+lNR16lhDh>v3t
zGv8{t^!yVo;Hqk^x@-nxzalK!Vx532A0VVA`4b~Igo<f2Ye5N`m#rrSH&&4Qedo6*
zHC6N+i@b@67Mus`=2_?1H#)YkgHwlnm=hC#cHm%lVhhwC<?xDXs?Ulq)!4AZujPOZ
zfSp+pgQroe?#z1;(p)ozF3c3(=8exWH?iMdajv^j*+G?r>$hJb6;vXGBWCu~J`)>x
zdCIFsmI#tCps80b2YHu7A2mKN8!vulGVdz0QK5yhtxATfEcphJI$jWM#`JsL^m+%p
zumqqD@eAHv*&vRmq@UQ8?;sX?mHLokoR*4w4tPR;tSm4{!c3wO1FRGJ)8YQ80|&1&
z0VnTaznik7w*SHRd#6#DEGZz9_`Xw@4GPone5S`@?wj!=yeytn8c$3pq7Ot7M=aaj
zm6GMK0TXk1ouHZj9xB3L-pd|lDF?Zki$?j6>f13t90i*3G(W?JUd3A6Z|8Vg%)@4g
z*QDN&qbt8U{WG7;ceG;GS(8=m(YebPUD)HP%r4|*iYMe8ecx~8XxtqRG9w{%-=H~~
zp|f()ss*iYDr9h6Lr=OCsEyZ`W0l2A*q^04Xd>)QmU!W<7C3&zo=46x;CH?M`*^hI
zbzCEeh^hlE6*d(mGW*l7cw!FiorJ*xRJ;c&cO`XwOiKjYDxD~`oV&@WuSTwcK_awR
zoeY@w{~Nm40=2iYu9A36vU|%4F9x5y_#R4qc_tDo>GU4uaF^OLl`H1f@F35Zj*}a1
zIw?63#wmI!Qt<pht4?_SQMs$I7|6DHpa&eBqyVWPA0@iy*f#UIY+%jLij~I++FiWM
z^-%7EbycuZ*MucR;Z=I6QH@>rPGK@RbQhLQM5hIPD7Ia2rf}bLk5q7We>^Y)pS1q7
zIPk!KVoE@*$X$Q!E$I4wi4~q01jKrs<jBY2-1x{ph#^%b8{C`yON75&M?C1{!>nXS
zUGh2p<}Y`Z=ywoU-g^6h2eC`y>=26XL=~0yd2Oj8sQ}q!eV~r1N0<bSI@u82-2!)t
zGOk}~Ar7I<zi2Z94j%Js=)r6_G@g_r>|Ht+4Au_zOEEw&?0690Wc~LbtAJY(m2sN~
z!HMEfU^#lffM)nQF8vA^8O=#qV<fYF5szpAY_%4sTb?1pLApXYXKznM6xJ!FPrbVP
zIP$WP9TQMPLG7t*9@ck46hmtJYawe8U*+a6gN{H8DvDD%SqSS(1fkD^qfp-qS!^--
zzq|nG&JOpovi%t0tS8H08Q7dOsQe&mvxU^=S6NRnJMAnOylwQ`4A_?%f8N0II!9NN
z_Ie}nMtN&WJ@HL)2}o&+l^Jdd?5=(DDkF%3n$^FRhKGmMHLAE<+M#w~xo~0K@yP}X
zhUlKyoR{m?@ZjE!{@BgRpVHXadCveHuOc(l4Tvl~3k1oK$HLPE=OLLp$0*T~C1r+K
z${e;5<HH{kV5eW#!C$LEV#YJuZ4?a?ulW8A84v?#FL47y3CKjnoEqVP$%DS}>eEYR
z48^a)7tuUt#zPbWq>8AzqiK`kT_OhKTPAmI%Uz`IUp$YvH>J%uU1}Mh4{aT*>Y^LT
zLIMG>?9&fiF|7<97_4yx8NT}mRa!}o?3psXM_5djNfhs1eF^99^{>6{Ad6kFqA%VH
ziFao$wU`m~EzrJnMzXE@*CB5#0U$A7E1d@h;AuCvJdhq*5Q>wqCuwbPcV<7!CG7@|
zUy^g{5KSmY@hVgbtkZkkFK3NPhWydd@RZ6-R(j3E(CANsjN%Y)pNbCh0WPY-VMc_y
z2g%#XIGEq494C4T>x8$>Wn~$=g5waie<R9j)pu$5@Gv9>ULj<wLivm}#!q2SW{lx2
z4q))}r!DHwV?&&{VuQ7}y#^|O>X%B3fBygtu%Xt)ldDudW-*%;6gGCQf0sVaT%6p0
z37q2?%2a7*=U>Il3fubJ*XeY&8f>z}HIiVKCsG?TP9Hvt;GYtp#qdVg#&N)l02)>e
z392FqUqjVc?%tl#@p;<`i5%~#Klxmu6r;iA_O8LwuNXO<t-arM0!mWxUXMz+iD0*Z
zV>CZm2vA%IjE`P_v*nJ3)gs(sK@%0P6c0t=`h~lhMcARehW|hW=dr-)9M|s*SBE4&
zjHc2TPK<Meq9AC9Ns*!pb+RLVYm&e^^=JX>lxV~`|E25J1$;te+K_yr6B;K6%!TBI
z`1Fy}XN#C&zhN_lkjY#OCqcLCE`Q4ON)|IpkEWvmTGfo?400qFGqnBVmv7Ivf1Ll!
z;j^_M(SAM`sSLR$%1nK)hIPE}{XC2j7ri3(gQX@xt3Qq4Bfs2M!)AkdvZx%S*@mX4
z6!CbvS*bjNceu?Ip10EukUeA}mdzV-jBHVY_hd1sx`Rwb*}oyOD(3QRb*;}rT#WcG
zjVk=IQJFsD=1J4x`m0!CAiCq2ElmH;g0TQ*+_T)}vmp}&&+zO&gaYL&V#B+4Mq@-2
zS8ne0UVMTYI@1<=>o_QH&=3VcEi{YH%rLs=Q{lFZ3OD)T{4pz>YYI{vOlW&86OV>^
z7=G_AuC{)5Hz5tLGF3cZf?6Q{|5#up2@8qn%`BaD$XMCTWitd|u+mb;&L}VN?(6we
z@efYFP!4|@^_uZ-w{UmYMmBkLHbH|cRUz}WmMB~K>|O6=*MPK$v{NH6Mlylf$`rEh
zj`bB35_Y8OQ{#tXDju7sWnTbl<x$=2A)$1S@?u+aT}w9dXP(p^ul-S~Jf9)WfXjX{
z9~@QpALMM*apKV#7r~noFnJJwDdQROvh(bsX1k58z-yn1vh69U+GCk>^0ny4&imdG
zu5=|s2<cT4%$1EO?pbM!Bu~zkOpt+&ojP7eqX@X<OEQvf0R2#w97|dH#q_UzJ@$pL
zj}CAXvehR6e`S3j*lRI?Y`tab8zcP+idz_!kKjOT{#+5JJ@J_?=q_TmEufFC)hskU
z^wR}e*N|f?zkzd2&|py@d5k!p{5}JpBFaU@d_e|xezceQ160`@ez+AWG`h8jA&XNr
zZqyn<T2JB3_NGnstP%w<71~`tM(<5l+-I!xKqGJyZDho~LHwPlQMq~SZ;e8?eTv9g
zXCXt0vDS?zo6MNPTTy`pz)Fy-Dj9+>LMW_hm)`MjKX{K`AtF5bLWxR6#4FbUZX3$X
zYi`)-N)S!UvI0$A1vfmoPi2wg<m)2V8orgfR!6%GFgS_j!a@a3KT`jd)?sB_o$|>t
zpkF+OmCQOl!am4v>OyYrq&<k0S$N>K%A|su04Gh-rfB<zSEIdLZ#SuqvRCEm;X8|$
z9+;nFQHg&pBw08t_Tw40*$D)VZ*>bNqF!6OlsmVcBzZFizokIl1Ov@_ULoA`fPP}k
z(MQzxezaAXtnmAqx2WU0jmV1+L!Vb)w3ODbi~b3jEcq$A^s%E<z4SC37kfDo)z8bT
z4-h4UGdq%tt{^`XsqNSFD+v~Ilc$^8%{K)@9|Cgd+utDE^&U-%10(}F&|e#Kjl4n{
z1#5MHgnFGPB(M;njqn=#j?DE)AX1@>;>>)9a9y`Z2BgQ$+a!z#ny=cjx&c~(?Wy(4
z**#0Q{a*F3K)>GK3XJM20+Dk6!W?((60?)LKu1#-=+sK$qJ7VySIK=KtY*g@vS6a!
zp_}UWs5rx2?jNOgCmTI<Q`U_E#>y5UtA>wkQU%DFGCQRUbaBLFZsgOQ&+1lC=(pPV
z(3id;x3YX=Oi2=hMmkY^F7R~q(YO8s{Lby#=+ngOBehvE>@2!;bc89C0{H=8cvW6@
z%&f9HFGPln2qI`E1MX1`I2ki`r0N?WPbq6|yOs4FQ2SB<4?Sa6N4Tf`Nh}3OLuK16
zo*j=rA^*)=ZR^t*EyjIFQ?m5Rlktd73|i*cBEy2qgvWBt#D-l->{L_N=rva64yN=g
zH7{L`1W@PPsC;ZX=wvh3yQDP>P-=*3@1#UN@V~>lbkI&y{c0?Wc2;CXpSoK8FtPEz
zL7<Uu-_oN*ky&Sz?pa(N$fIIxd<AdW{SXgmIU|Tz8=!6zAVa==vOR1`;(nekJ`yz3
z*df)g2WfQmEN(W#`F0-~kv4{#$I4aC3qJ}NslQ@{yPk&sil<>sSb*~1TO{j__{BU#
zPTIj$De#qP9B1uTPzM&X0l}+b&-cCJPg}Fc&;LFnLmJ<NDP`v9P$HEDpuU#B?SU;<
z9JZF%XAgxjP?lTELjB#Dbz%wbMo!iQpBMTVeOz3xH}ah#U|M_iC&qFjdzFGTOgS@G
z$1+k~9RjXRmK5D!fdK(*rUak4druPKMK-GC+RT%+gAN9I=CE}OIS;L$2SUlc#<F&W
z{enDmVWW{68_mv6R2`8SCy#9eIigej1t8Y-wUS`wak?0lj(hP)f<LIJ3f`0^!i;jg
z$^~{8Jbu*^^=^HQy}9*CHr+`0z(=2%a2gZDHOsi#o&UkX1y6}*=QwWXLLE6?=YwhH
z4`-X42hEQl4y-@(t8IDJWvDo1d~UhE58z_afDiIEhJyE7zLiI*gA%A^;dP+p^c}X4
zH_=7MijZls$<hBvc4W%BqY@#QFSkjpu6e&tLcR@sLFQHZRZjlp!Mn*>Jes5wRa|`&
z1qcvDi>WxN*zfJnT_Zr=UG<{vugUp6T?3QNBP#7cQ&p^83vZ3qLww8`RxIxQfG<%&
z7|NU<{~U0d*s#o>G-x@;G@Dwcm$}A2IA9O5U?y?*JNM^A;EHkZ!BN$6RHRUcNhFY!
zWArgb$2XqV+DDQOYwqQ^SgcW6@s>D(FZZf)3cSR2M4Rs?_a>)_f>(tY(V^{*v#@>~
zF(E)__%mw3^=2+0HFISl3VUDtD@az*cu%jaz1Xat+Rv=-iVSW}R0<}DPp3fkK9!G6
zIpO6ETq<tv89*o*3ielgzQ&k6GAW*O{#y#=P->o%<_rg|!Br>-m7n$7o0{Av+>%Zi
z(W~pEzUIlP)eXA|^J7<W7_oqWPfK{F{9FV13l(X#=`yyNGLM}<PlR4abbmTmc*2`=
z6r>7%M?n-XBXDPmRd<u4fw5JvY}9|EE#pUkZEeJsfPn_oZreaum8K9MJmJ+;FM*B%
zBhhuPc#tMr64p?O)qSB$h~efZSh3*pZqJV`3-nWfv1leai>06<CIIc5>_U4Ttp*)%
z12_5C{9Zqvix~38H<4xB>t(g_wM?I;D9kyUcDN9!O4{ndw8SxhSaA@=J!eAf!7y5$
zPs?nrej~!>OdWfb#vJn8(8_e8XJ)~t&|>9Px<6q^3NItEN2GG6bEn6I*vCe3e=M={
zrne5HldcPOLRY@${_zN0zuGnsQ3Ock?=1Z99~F!Z2PMp_+4q}fb|ewv-WH69OP-rr
zu$X;sxw;FqH_d>O3{Wu8I3vKC?VujGVx}z25K7-w_Gz7@e`~{KSMh7OY*82gM@eoz
z$5~cvu~=D1>LnFv!w;_sb;v3T<$VhKau#bkbmJ~ok|Jz_pRpPR8EG`mjMlun-HJ8^
zxgc0BbVfzejxq7TYsgn`sqX&wjT(J*p!FH$c2Min=P|~ZVyryjb$esP{z;K1s#3H_
zj@(68L?yf?FUQh7R8n}h7#$~&&$&yOFALJFl35HS6Wy_pWS~5v#|NL{Vdbj$v$*um
zaf<I>uhi>5IEBR?%t_co*`JOwj>WD8>hlUO&^9GNGvd2ztgWwcR07{wK^~C6B)V{g
zx4B0<;;=fpLxq`CnBF<Ie{TUV;B{Ld{;B3_xqimO8Olhz!z}gjllo-ghQtls`UX(d
z;&uT=lE;VokGq<XkhEBkvo@7JQmpRpCHVZ&lL%)heP9Nc<<OzD*3zw?Vq`jk=QUl8
zd5PU#uJ+D;-WD5CJY56GI|Yb5r<6NE16mpK+^XK_xI7kiL<DZgn?oO_h`-J36>XC(
zwHnHjSo{ZkK}Hw*<hQpH0dFq-Ns;o?@{`d)3bGLjX)5Fr6)pT(Ce1BB*AGiv!qUuM
znIVZL`{k*~;^}Sra`X&CE%>R9vx6A{$gGg_TnLCy{;4ZK3~TGS=#Ew{jqU#|NalpC
zT#%~_t$-E2cO<1<n%8|wJAaq4lU-YG#gT+Flw2&AJ>IlEuND^#@ngh}o{Zsvn>r(a
zGCq827Z~S%F%PxlI>p$>YQ0HxP+NLqtWHT5Pd)0dDV6TCLKM|Z8itMN_{9kCDK2Ff
zRK&;SOh1^j7gMBs<*pkdIeQ@}<3=f9RA|b)`i-&Wqih{Spqi~xHrOVQGGWnS;GRn{
zQB@y7P|_M5?V?kViEv$5o%mDr*X^p9+@!*b9R`bR7*3d8eb_N|Qt~UO8;aN1%pziC
zFhN+VXO>@{{Y3?6krgrP{6P1b6xNjIi>rrN7k*=(PYy8Zp%(17A)p`IJ~|OAKP7Hu
zal=8kpcu0gMmQ~9p##+7hx8{|W^5Ijnkg2}`Zoe*6VJvC3H{Sv@)8qio|S|!p6PQg
z=ctfo9nG`CX=9>!+PiJdIxZCxOCQpu{sdoO%!D{En3z#|A;_;{>W{5gE33=UULh7<
z1Zc{nqvdkt<-9^Zx$~;z_P=|P{=x^S-+t8$l-QL6lI5^MWS>BslZ<Pces1UVgyxnb
zT#KAC9)~JO3m6KeXgGc|8xFYY&T%=&G+v?*Vj7<_9ee&vj5WVa`5Nhg6GxE?v+k^n
zYkHDaZK;1?V8p>2!Z<y|()~7;11PKH5Td4G*FpOuRe`rmIVjWrro3rFZaE@DFPD9K
zdYf#XNs1BX@$Fr*e!oS14;?MX79?gZ9iI@fZy0)!Nj{j81d{xh$pQCG*^FKn_$bRf
z9@uEocIFUiiT}e#va5Y;mbYUUWtEaklb9H9(^xe<f)PU*FOOC0h7^v4AH51Mg<M@j
z`$hu{EZO1OACeWK4>vOpV7558WmiRC>j%y6U`iIzZn?)^A^QL=j}cS3p@%?M2?FiQ
zc*9UiOy(Y%bmds}y2GM_c^7*1QSAgfP}`C-XjZ<ni)_8)ZOdHCq_QR{aY(NtqcX;Q
zD_+W!9(U%OloZhD)&v>9+1>kEz;`5q_WcOi)0K63O65*V6q=qiLvmVw4&m{?+yptx
z7+v%E<{T+clM;J^)f$vBbw^QFjb1op+I?`1F6@fGCj(He<=4w^9eH-sfVJnGS9u)~
zI>tr7q|lRp%nK13I1}Gi+W6>6b(QOOhs9cj6EEEJ$_5vknGZgoYxle7EP(c%Iz&Tc
zsZ?SH?errUkz34`C$oN^r7v%*mS(qnVqDy_bZHWFy*eMlTDV#IOBi*o5=({%MVr&?
zL#R6&W&-F*g(2M|I0YzG5&IP<gBIB+yD`X=S@WMf5{?59Hi;H_TKbqzA8XHjCnD}T
zoIRBd&6#;DY+3FJhZE4sCNEkVQz9<sVl6c67+zFrK=QEyp!HtF$gXKOEzKT~kYCSq
zv6euFe*ipE<(M4O5NgXNsXLflnpab6L&v)Q7^YLi$=F?SOA+{!)EU7an8a+91t`o4
ziHg^e0Dw15PqUF~H{%r6R#~GesXZX{kOf{?IqI4pDOT{T46oMB|9wFTkvD}5u&XSI
z<J|a}BScjNs^BvVU;7e%q8lY#tnLa2*-w6Om~rR6E%B*6M0=eI+j$`nvJWER#$wB}
z*d%>PLrlJk_O|IL<&eJsMHtGKHmc<h(9uA|$hV`FJ<}R}phmAOF+a<9Ei?Ut*)~tp
zGlf1xXw$+EJ<Z3$5(<GbomoY^jFIqtwkPI6o55nMauj`8$gg-Dzql($zt^2GcBDEE
zdulv$iO9^%Z`GF3O;_-F%@KibvWI9X(co%;paEE^9R3iD)r{y@=nY@rKR6~mG>P~|
z&;q4@!d2;?$J$}J@k;3#eB?k{OjGQQa*f)^0iHW6AX4IDu1ENu=k!zZ?HR|8SOH<~
z;nwwg4^=gza=)NKx}j(VxYp9d`?=r*j8wXs<V*YnnIe_U#?vgU9geKw=$@s!R_`KO
zD||%a?$pVJ6L>jhV_4?4<RAM*vtTJnlrhQV;k-eTl9ap`G+eoPO%L;3Y{&1i%Bbtz
zC%vC3=>W?iKsJ<_6MixewGb8mC|jnoMU#;&k>TW_x47)`V&(l6!*bN5`jchx61(@;
zYW2Sy<J9P7&tM9-vl8YM?qK(-rl3s!ikO}lR+}t#coD$b8wK{CLRU%Y%bV9*AE~M$
zEo|J~n*x44&iX7^9gjXjUEk}hWfZ+)d~2?|$A(cZ-x2PbLC83!ecd0WzBX&;+8bSX
z+mQ}B`dTL=3GMRSRi@M2&GLs9QpvV7WxuuRm>qkyyto=HF|ph45QtTM5e(LNtsYn<
ze?40y%*bqh!i7~ncv%K&Rl3o*p&0XsRULR#$!r#&Q>RZKh{q8dur!639EzNieOF0c
zJzo;TB0X`$r#&j&Fzy_AR1O`zG`i=rBU|5Dh8155j+>yDeZT3eu#P_HQyxG1ETq5d
z)u8*0j0x{%|Hs*1d@G0xUG%-<zVG!t;Db#Rwe2kJg?k#ko#hukRLMK{m$aC`R=>D?
z@q-uc)S+hlyjL-i3;4(#0Zua5o+j#%!Kp;AHJ?@dB~Z#Tz6!w+8>~<0F(qjjZZnE)
z1@)+f-Kr3hx#{g97HY0POD9ROY#E;fa~kDuHNlnoSjPus=I{nQvm%r3$I+|WtQV$g
zCmi*l!IbcX-L~@+o05V}C9u|5`QgF$uTcASm49p+7}+~GonD3S%?qtGr=cg}=+KkS
zady2>#f~J@<CHaTvDHN#*IloL$SSuqYmTY6M1DDEbYj&1jQ@nE^`1}g96{<IdUvf<
z_Oq2nTJv!dZ6z7%9>(Zt4XrXY$Dj|(yyx-3u{?0|`Y2G?HvI2%ppRpheVH&Fb5^-w
zTmGc`@4D6AX~daZ#FNNFKv27O-_(RFjXb9&9kJ+s;y>);yPYhpepa~Mq)e_B4^dO{
zl7o`Z+@7We{uhq%xDEN|T%PC%$5K7JlZ8u?+mw%>UEJp{5&Q(~sbeh*MeL1}OQB-r
zp@VNcZ3i*?-OUc1-6J%LCayD2-}V5G>NO*9>*27}6ngBV{@26L^7g7<0<BXsXNE=W
zZ%oQ)ZhnRbWst6{5N7@zTvt99O@P)n_z^c;@UT7P%0lw-l2y)EMY5{b+$EDk2LIin
zn??H+PChtS)T9U+eiaA`4;C1)h1Ea?L&(9%u0|EH(8;dJ6xh`zNG(R5XqW#y(GcsB
zrs`qrDjo4H6|g*#0NMW5_@Io<Jw~`%5v|b@jk$CGNEM!ZsyX98M;6Xi=%0;SSWYAq
zwjuuQ$C&I=e4fa6?QzCEP;Qe%@P&iN$v{^?Ys2>jyw(Mx>=`kocdf4c8)f`8xfbl(
z7(d6J*;_k~@e--An4gFLb7Z}t>C34PVPZ4yxSQLtMoZxBo^L*#*T|iy-V)G))T{jH
zz@>D#(U=JAt4&tL^xR7-m7rT~anAvcvbDQ&?8(khhI1H0tq}`mOXpt8=v7|W6M?ay
z8nsb=rtRqL4tap=;~<s$G;kn-RIRy2Z5<|-h3NG&85i3$UX;Kr9qx162q=$GoJK^R
z{!%zxwhD6)W208>cV0|?TAvxvoVR@Q;?v$bV-ht+iG;E9E$84!R3)cb<8<lrMx0b7
zAf^(r5CDi~<%@}b`9Kq>0e$Hl5t?EY^V`GQ@h&O3T6Z~v51}r|)@lvmMEa^>hCo4v
z9Q<Ds0oO`b{r8p}8;iMSIfilk%Ozg}{b^y8OHBdo#dE92H7*yvVsr`vqvS%e`4z3Y
zdz|ywH?HULXg}?k5T@D26eR9O*kW0?sksbTI(@kM6^<HN@}4-f48qIb_-q^b9Y%u=
zaJi|6$nOI&WNxEFJxYV;`GsDYS+m`)8M;nC_<JkcleKQ?YUTv~rmv&{OUhMBD*#DP
z%lJTzpEQ(;UkGVf7$7k%=KQ+#f}2ZiWW2>vCAIx>p`B=YSG3tf{{87Q3h~Xd8jRmP
zWDKvPR56=}+(T-blm4x3UpU&C<tyIz))by+x!h{krm?rGmfzmlR`AH8vz$Y}sC+TT
z^&8@Q3x%!M)&As#gY}r;>J9)-4Rg%sT)Qajq)LSmj*4V!81r%m$Sz%Yz~!yVB$8yq
z&7Hhoj!K_wNtaq0y@yk0cZPJs?ESv-$w&rVfx!)R_c)cBB+W!YKs$n~Sos2=)kR5A
zL_-c`Lw719FD@$K(=Ai?7yd-}$jCsVg(8gw&J7dZ{f$mzn5E&)p`tfs#LuQ$qdyY^
zAsZ(H9>@*PYzKIGRe-VtdWcC9J+DlUgwePm`PhDfBY$O{JEahG_%D_UjRna}qvqB=
z(C1=BOdbd@Xl1PPk6)o``p_6cUN!TdzD$Cr=I>F)RqL4$UN=ok0zV~5sgB6D>&mO5
zE!ia`TXHTy1x(enw`UsaQ<-_~OK@x#aM0AY<y~&`sSV`pbrAFe6=Trv=6Ll2aO_^S
zk`BhG=)GQ=uz=w+E4|UsUtT;^2Y){gr}Q%Y-kq6zeOhft%z<oqboX6rj9j^0HzJhs
z|L`3$D79mb^E+)Xq+a^>lS}T+;#bd8(dAf7q|G2-`xKf6;jjk8Nap+B>MuuD{geKS
zcjxAZZ7bP>W*E5YkZ8Y@aHs(r)~7_6zB_rfg?6ODD$YqmOI{2|+<cJ=BMLVkEc^EK
z27T=bFCVPrJYw+*DnH#0op8`-`q%fS8PrnkmvbS*wrVqBGpboxee;ybI$M5L(=H7<
zm~kES59kYEis5q&Exr13&pq9r9VIALBDT(=x;hstpYGSa>oF+6R~g6fY14q=1kvEN
zPPNqv<0WPTn=lNZ%7GEzr!U&i16I+o9e7@hR7#nJ8BX0#U|v56KdrY7)E&?pst4sy
zq4_Sd9=4{uVJ`j2r|@`-+=#8c=w=T>JZ5;yaPmlI5v(*p{jpaFfL<P&yZkMXAp(QO
z&=TC*qJzQp!tkQ|x>O4pA~sw*$S%CW8&}55K9uWFyRfC7CMQ(UV6t>KEbIC!cZmt3
z)TE#WRO+o0)4AB@>`aiG>-a2tA<td&wB#`sz}dS}T_7=rC9m%w-Qe&iW8ntPi@HBQ
zz8|tWlKsiK=UsjiB>X4zUrUmqv_Q|wr0FJK_Kf#OsJE5#uSNqPR{I^|!<gCz%IjCj
zlzc_(-qXN8@z}r>(3J%fS#b?PNPiEQu#yBb{B-kX4m72YgdO8Do0d0*4<C`a{V1I9
zmV*5%O5K8x?1$9ekGu86>a6@NYPhfGR5!X7HZ!TmcYC-iMkwO@hI9l!zI}6eE=$|-
zby+-N;7u00?-&d7euWGK_uw?GW3M_2<UQ@3KIsUkKa6pWgpllh&_3t*u3O~qOue|y
zoB2^P;E0|-ZV3+U;;z`_rF*GJhAiSYd?1Z(e>o}Wac^m_9&!~tZgp(`Ij?Q-H@+HQ
zb2=%4zi-A@`N_XdA95v1W+Nf+fUirKte8T>D1U!y%n(IzjMlPP?Ah2^oxWu8km6F;
z`72d%t6bts_>1Fq^Y0fWP2Cr#wt`sBBgK4r{_hk+*v7iYkm}yQJ@iw0O!u&8td;Tn
zWXd?Gc1Y#~r-nCnn5~erq}ft8#x5Znk4YD)SSkYy1iZ$s0r+26uLce5%?nwU-}POa
zG^TN=u6_~TC;x*wIZS>^&?r-y2E!MC8#JWDAcw~;WxN0GQp1{+LwrfjgV7x^ahuAQ
zRe@4$xeDz}>v6FC&=%|9ovZf|#)i8gq2t!^1Na5E=a=j(-ZVM4tf8`rE=j_dodW_v
zqFKcbeQ!%Rm*<KM!apv%)K#kS;U9&zOeCvU{!vBR)f_q9D#UqQ>D7B%@j0YF#SXhM
ze5>lbJmq9YyzA~bBar;E9eDa>0ucXG6&C#d6G{h4I}<Ud@J$#!5mhWc{+klx8T6G*
zNvgr{9KB!xclP~l*3Q3l$tz@YzGxg}=uT>`a);)zfLr3mT19_%k(TsRTmz}(vvX))
z4!d(1FP!6z;&n!5aUp&5z1n_XrxgxDcYgDZbBAr>`Hq+2k*e<}NUeGQ6MF#}9`XCL
z2ktBhp-bo8(<c_aO`XE}Ua#zXJIR8FFIVuu_4Z#p?OPBLrS2^z>#d0|NW$5QDTz4?
zqM!+R2HX1^)06x-*y6vNBElviXFJB`%E&W6WBQoI->;jIx&BkTb)l3#CKb~~=fXx3
zSpm^IQ)v3Z*Pxh18&hiV0QsiO%dC8>zZovKnN8>)Rtq9>OZhy<9#pTgO?sXS=s;o#
zx_&gO7ewFE_{!RuBcvc<(s^d<P6BWl@7yhV9K^g=|E^87!|o`}*A1K-xmuj@KK*S5
z<cXPGVNYKb!>4Vu$#Ng?%7$)$m%78R5RR_^9O|{9*fH{hZqjV9SioELQN(n(|3&xo
zNt<^QAa?jPo;QYjLzDT(61FJWdl<l7MdT`7n3s241}$<5b~^|u-L=u?aTU|=5<(Um
zUP*UX8%ZDOIzo>n2|ae+#p&^;&H2gT_E^yfbOtrw8k}$-=Ox_xf74g@PISNnMfRkp
z$F089N1S05oZ}ou<XGfz*R3dI^3k%~VRynXSP>#(GFJP4%J%)lZx~ita^1fx9J8G4
z*>hwqA}?dFJZF*VU1aY3Vk_^l=-b$Cdi4dh|H_p8LuUv$dq25NmT*7Lrq9qQ(b@V(
zP<x}epVliYto|#!&~ER;myh->7whrSlL1sB!lBBf#ZXH&z9ZKX;#5y0hMCr?+UG^(
zm&aqdoOjV1csVbOUtnE{x!0R*oARm6dw>2{F-ICZK9hzO4R;Umk4K)8oNFWGkor2?
z48LAlExm`~u^j1dFDdgCWE<XbUwGw?P36Bnw$Bs>8qzni;b;!mU<2(4w)?L!Y9Dio
z$-rXz-R5=ybcRCPqFo}$()#3{Mlj++_eEz6q7}!RSovJ35Lf#NzsJ_0q*q6+H$Rek
z<gr-;*5ZQEV$~<0fAP~(_qJG*T}=jbN1~Cdpa(fQaxSwC{?{~^#-XXS5_H&X$=&N(
z2BwZzB@b(RLumFxNtd5P(`3tFiJRJPG_be!&7Ccj_Zexgqqp7KCMkG^_tqJq)G&6D
zELvC5a7CKp_Grd<#gmj{;$W61jlw=bh-U&R)l*V<yWFE3$@6Dg^RQjuV?E_F(l!}<
zIx`41FHsK<%~q2%@mEi=ZVLD54|~~$<BTp{*9~~NTXF?)-`G;X3mi}jtBDd9fhA4R
z2#G|p?6A(MK&cxW=KPuIkC;~j&225u(O2dW@Z~l;nH!!vGZGENQu@%+M9(!;YP5^v
zp3h(!x3*O0%z9-a(xa6pE@p!|C1*+LeU^SrKfKt`1IyP)i?@q=;Y*QbQNlNj(N%+T
z!g@>8yk!CIH)FdNLf7_IxNb{MU2hrB7V{22{CMhG^scOmLY<$%9-U`ZW(98JVecS4
zULGAtTA+%%mwsh!UF*@h%4Ku&uKf7fk^JY!k@ngzPLofqewz_GbjvSfa8$w%tOHN!
z=V}k=pS{h4SW6}Z`Tcrq-Nr<Ec6xSx$Dl>W^v)#C)Rwb&UBJcv6Ef_n(Yj5!Zhg^H
zyt>h|a5B|f9MaS2H@{!{><C%eSKKLdv3GANMm|zbeb{HX@R3b;IP})#8LoG!aN;d)
zG~IG!PV2LP!<sh~+oU8z$csS*mriig`#pk~p*kl?bC<WL*NnxD;Q%wzL=CP{CZ=N_
zUT1HTLUYnxL-Z8syc3p8;a220f;sqk#e}1)_RV~CdVfA=&jf=OQ@4mH^WJ`NB`f&m
ztCLacWDr%gmc_m(UF~lLY3Sb})A+^Zv;hB>T19yel-cC>$>MLM&kFH6OX+W3J^HN-
zEUdU=1WgEMH<h#SDOGO2zZ$oKr*<%J@Nt*urNouZ&P)n_cUbT#e;fF#&QmIZYTNvq
z%MiY+N`Zc-n#F)`<#oxVP9Q5DoNGkjd_fE?xx{HGFOGe+d%!b;2O2r3C`for$@CJV
z#u?Fj)c8`=JY(>Lw3e{*R`9CJV_m<;_LTGtFRg0e%y`zKg{GBoxpN$pqDDos$;Q5W
z&Fp-i!pFXfoyF19th9aMWTZJ}bpL}xAnG<&GPd<W@IBeLos{?ZR&5^+Jc%S2>9~CZ
zP)CJB(>9o&flMjCyBkgzl-Cw9wPkHyrE$a7YKR^Le|Z$}c^L?;J>MeG^~>Q=XCJ+y
zb`<<`sndvsqq%^R?2Txj`MV2SmXLoXzSbV44XVGpgb7Qx9w|OLkz1eI*f-<HZJITH
zeJX8ym7CzI5aZLM|K}h`JT@a@gZXGBC-qWqspQ=EA61Ei5PYZR)2t~^bpY%xD-6O8
z5B!!j5+&y&{;<oQwJj(}?SEGtV%@ij=iV{SOPgTLaf;zg6B-`J_olI6Q@{M^G$AXX
zaez3es!AY3Xe}p~Ppaf_@c_gExq7ZS$!sHGUTR(LD;}WdTY2T=gfocgY(ve}I>zO$
z&qJZ=xZS*>ndVvhIn{9VWmZH-Z7=*~;a7=X@Txrvg6?Nxx+VR|Z&Zov%)4jPVi3BQ
zY5!v8rteXg8Y=gN{!aES@kxa;HJ7)3L5uOELsBjuo>#5qJwM@*v8~c2-VoDH@GwS>
zfZQoHOnG%muhZ|<6&9w}1p?c@jtY%LW$39@l8!`35^dWbi~AZ;%O#C|0Pnp+`Iq(L
zR!DN~O6YscZ$RGisNycPS-#?c_igDgsKygq|Aq2u@mC&e%ZcN28?IldbXop1Ju0~-
zu?sI*LdAz((~$pgX4vl?&PiVC$QqpIPk%zAH0&&9?|e=)LU?{|>1Mi};rqO_GFG#_
z({eX%gW(13{Ttr+>Ui+O)SnBtHCy9T3sCp@3o7aX6Q3~R_rHg>S|W7~jXN*@RtQiN
z41$PA#0hWi^_mOq@}oEjg!ZCTV{dVP|BxP`LkeF>l+rPnX^_2wIC}KL+(ybXl*Dpi
zSen!hf`3@?zw|Yay@Yj2bc<LLx8#`ZVPjfbw7EDXHWC)Ay9o%nima!YzW|6mZ)I~C
zuT-@ughJX}^oo@7`+Kvz`JG>sKOdr6;cFpO?J+)fe0~6nRL$^g3GNzV%4Dy7?C5{%
zM@G|nR8T9&K(yU$BPum2LN7kNX24Jj#vb`4eT!wr*CuxX%PQL(;8`;ehB^PZG>jgK
zX#Zq`F~a9c`0C<VmDFVH-#r0#EJK{|w(px#6Y-^=(s4nUnuE`SvprltF~_Ny8=Jb)
zr8q@&Z7P3e`1*{=R6%^~OEOM*rsZhPih<~6oVFCQ#S&Jx900v5b!(rCRr}m@sx^@S
zrq{SY3?@zzsOh{6f6lTUiwq9WaLmKGw5c--Fn>$$-ZEvBL5JL4(P)_x5GSxD@$^VJ
z@0Crd#yBPMq>|V7>uFM|u=z60>OQKdcD0Z)%90ld|FBm=O*W{G$)J^1(`Mvgt^az`
zlGg20FgWpV$K{Tbk#4Ni<{uwh;iG??+sik4Oz%q6N(jNfoo<R~y72G_{iss;tUJeE
z&v`<mbsqa7nty@royT$UdDMjFh<v+sT}k<^@v#jI9CiwS+7yj{%aZk#*}2a84b<0y
z>f7Ydba>KWeKCH}(vhx2dQEHBybZ$Uv)A7f)Ld}~)`@f$vU@Vq>~O~jTBeVb32e{!
z<exvi`R+1<a<~9iI{f6uG2{5g`;t7bss<^HKg?x-QVy21L&F`_-ksaduW9g<EHA=`
zm`Tg*jmcolA6mWZDQGdLbCo}THjLYfN!|Gp{rykLv2vYn|9XOuYd!dasL%IbP`)G@
zCH&BAW=FkF?@qyT-A+GX=|(veIe1d=`EEV5?r8Bc+%L1d{nsGwguY*nhU2Kcz2Kh;
zbsb4Z-goWmR{uW3D%a8>gg^EjhunMDP6An~e|~teP1(^+`~IiFKjPhcnk-Cep?HO+
zw(Q&A%i<0%se4omC5Dkozn9aVt5xn}h_HxNT7(K!!@L&1fHH0TEjsnJY^P}T)vDaF
z>~L`%x3LE!GYe`rqAvR9JlkL$Yt}2P^kCx)^)?>vnKP|6;*l@CSbs3$1E{zpCw!09
zyp2A8^rI6rdqkue#RXAn_K5#0ZYN`@rdC0ICua7;s!=lt%lxi4Qmz}9L|01@ewz&E
z+<m;mk@@a=^4?fi?~2i{!deDB-Y@NBkLKy0H<7R~Gs~Jm`^fWo>@t+jY@0ACrVb5{
znpScQw8lct4*EFZLV**|eQ45qv{LHEXJzr|gn1O|0=R|DLcUf?fpUrKZFS4?;t8-f
zC6o#}0r}1HiKKOf#KNf5`%Q_k0_j+`_C@l_FGCK@U8~ac^O#Vg$#2E<+aV7NZi7-K
z4R&N7vOUq2`mkS}SVZ#3HLUe}k?lOb%l$!-LglIclmD3A<O@M+5ms6$(aU4~irbCv
zi-b3uQ5=sUgr`2rabKk!7!T-veSe<m`nvOnAitJ(z_h<mnWEWmkWj`O_d*@<(|&@S
z*4V-O*K5A*Q%d9X%IU-JN8CUo^j(23Tb>>Md=932OV?2J+rIZT{963vmsfno#y_U%
z?^SOF^Q%ds$y^!F(o`oKj4Xc+8HJ9KE+?f+VWokOsI%g_Yk5h&9$&PJ@Yg1RXH(Lr
z!v7$`=$qF5R{T(xxk&)KkvtE>+(+?48T#t{Ax(F0%gT4ISjKOz;LR1DUH=_z(cBX?
zCG7#@oDZZw>(<xh?X$!<@dXn0u3S;rQ87vY98M*+OFhv|XJ=z{t1<#sXw+##&-E34
z>~S`Ha~!@p!el^H_<L`Au0a5Eu?mYp_Z|97tg%P{<L{N3!GNU`2~B4{nG+@nxLAgn
z9la8rJH4&syPu#%_;BiFltfD#xoFI`?ECNf-z9bbzACu1pL((S#mC5GWLx?>ZVHXE
z6!LwIu*JKg?eL8edhaPN;<`tXHHvo#dVwRRKFaqC0jxfy?GAr#Eq`Kygq<A3Uc<3L
zYiv#;-ZJleSOPNzt@(8yji@WdP6$3i)oGa_nTHLztR4=@i8&U#O4MHLEI-_KDV##I
z*Zi|x5^WtWR#`_&5(T5yQ_5SimgRW6Wr<(4k92d5^6Vs>@?OB~Dl$ghGknu&Mn+E^
z%}>bt9*E;4*E3RIe$Py=+(5g>)i4s9+YHQSD;9~<{tO;a-^o73G<+v*U>X1hqU32&
zfv{ikS0h-B=58HfCj$dNpD)w4H$Hrbm!is4`W*RydK637=;P)C$zT*oCR#uw*0o15
z>lGmyqzXd|`*EGu5YnFn+S!+NsBas~hgJNV*-7wvCi)kX=QDw8QT6<d=Bgy$_nm!f
z(3`4t8Oa!wYCfzRyH3H#7b4N&cXY9|GZEYNxBq<JR;7l~*B>j41YA3z?%>}hwll>=
z7PIE4;sflLGBKTQ!pCL`(i?@l4H~=b$vcoc8l!ipgE#o)ZP5yg+YPeaj5}w-Qi~+_
zDFFql6>RQ)yld?vJAdoqG2LUH3xyCr_xgj|(AV)iBz};d<;tK!=S3`>`B}Q@NL&c!
zd3JT^#K-SwSw%K0GDl*Be-)Ya4}A;weuvZrC`gUwXb0eb%N*9quj)4Mx@3xVJ(GM7
zeKqBGtNTInq|Cy@F0{HT<cwx0(>uOboClFV)A{|x`F2DASFR|TBunR9V0k-zBp3x;
zSQqs}Q2N-#m9`T5x6+=Yp(V<Gz(0_}wmVgr8q;EoQPi6fLcgX;((YRG(P@;4?cjHw
z_4hRle!`oDN}cbOT*VzsLb}Zdq^V94ZM}tgV@Cchqk@Ypm>|qID6tspBUfoM43#d~
z_kXwR@N`9G>5!x~jeCgXzlLJFPI}*+^HFx+q}w#_121>S<nyiILFx6Fg``<qX?$}2
zO)u<E%vWLy6S<UbP-l-qp=zDb+mh^^q-LfjZ97E9lZ<lujk^;m_Wb($?>@`=h`sgg
z<=_jnx$lX1jy}bR(&syZk24&<1b)rh1pJ_HI24z|`Ubpl_`_r}-!*r{op#(8q{*+2
zE$5YPCF?Du96l)bDDzdFjRrfVAoVkA9Bgn=v7&|hJ8nzb>Bngj$y5nxILpSDsB#NG
z$?CamBT_9?>Q@0MA67{8_IwnIDz5&{7#D*|g{W6vPn;fD#0$ey2$xajZb`?fSyjD%
zVt2aPwl%yszCRp7t9r%%^<9ee)ZtL%o_=^&9U4|m5?msliD3WVFo}HXEBD+aW2S7S
zp7V~TZPB&vttfSfHfz~&gBjN6y8SEY7tJ5m!9VDcaSdv)ea~4$%jF;25k!k#l%R#0
zIA3+?cT(~Z=H0hTKJVGGB4#=>sI}%DdiT7}Of#|#5%FB3q~A~iZGSBwO2nHZ+6e8w
z$Ly$Tvjs&2RVI~53_|WvI*CHXf6D&l4}k7oZfDTBOL!$|e{(Jfr`dd~qA#C0ota@V
zDUoUDxrX&XU^Jo;@J39~k({SM5B1}1h6AsT1rp_ASw5dN<S_o#DE5m@#~Pu=1n|Sj
z+f_TQJ}kTbVYHMQ15Sq|EvWr3_a><<T%09icHfZ=4CiVwn@$|`ijK2!1AITKL0856
z)i^E|F_wuV=z`J3njg-w5^0r*|50n!<VWwsc8gu#DcT<}2Vg^{>$j-e&NDpDk$9(~
zUYkl;B%8(6799aeX6Mk%3@K|-SK07lxclEV_XlaxX6DZH5iiIX9~8C5E!ZodF_Bim
zfR#+hu!LG-`q$Al!vM*(kd$+HgR<P3XXcDOjLQ(%5&p4<ntGC78T_crMz5wIP?8|9
zR9I&)>MKk71~0|l6Eenawp=UdElT9~HB{ar1X<9j8vb;qAJAdiHU-W~m%cW#3u%ns
z_7saRi(liC=lC*~px9j<Qy38^u^pdAoeD`y93q%98UEF9ela!Y)?rRybj@y4!^1=8
z11+<Foq5!&wGt$QSzLc9DY8>KbQzTO(Hn1)R;fU6*QoeT>PDXJelOv;v8ZT%B<xgF
zwoWiS=RDh8_R58Xk?J>FWNS%t6fwE~s`<7x!Rq$CCn|AdaVlU~6)>&NS43V{Ap2AD
zsjegY&~M8Bym{VojMNN1=qGs4VYRHEi1hYQpd!JJLqB$ZPXCqI=r^sH&h~>OrDLwg
zwAPL02SeDTt=N<@F7xI7aaXDvV$S4G+G18bP|Oa|{IoAc4t-y7I&5Jr87wlXJK?@Z
zb|;!RrDc2_)#wC;u|<BaT5+G_-{Z<{sO0+f12K&)%=bVMzqn^ewn}x)cG*+BsPfFV
zOw1LZyX>L}-oct{=u$ptzY8H9mn7uiC{6W=L;XJhctD50268P1KyzYH2eZJ|8cUHV
zT;obAVEBA&kDD+-TjZ|5JTvHNvq8I<ra0*_eiD}yiv(KMA0p}K^W_nf&z3Rjs8Va9
zH-0(IwrX^@uq%n=aL>hU5f%<PTp#ZW`RSrF&3RE<;&xpKoqB*j*p}q!Tgplr8%>1g
zxN<6w0sg>Qz)oAFy4=o~GI_TZ+G^1*<&&vc{TJ<)*unv28)_-YVt4rYNeg@%v3eSp
zTg~-|UB|dIFW3yJ@7{<s+J8W96B12dLTVqI&y}T75l^#4^j6-3tO}#BMbNYe+{(*=
zKbb~sG0oO$OL87_dQmeO?2-+g@-1VR+95;rxC=)kCNE69q|Qc@b|;tM35i6zDYl?&
zwx0>JS8{+`nalow3-_o3^w@2#M_8FOtwJ4c3#sqMxx;lJ&Gg%ff##5NK!#|`I#DIb
z_+j230rDxlm4(2cOeUHS%iVYal+3)3t7=X$Q&0$bZ7us=SF=vqzOtOsIfHipwa=v8
z$dj1QN3<Jb2V0f9{A)qxD!hX0!YB-d(PsO^rg|)qcesO*9@`y=QthZX<Z!cVc%iPM
zN|HTgL2MN|O~;#hU;GO&)OM;j%2C%Ggql-zoR@w99KDa;vo)7HsvTl$#_nl2LKue;
z`_1EdE85Mm0Y&I9_5VPonon%Koc)0p2cmX28m2p?*q(ZjXIbtp_z0xo-iq8LG}7Ki
zY9WgsXslErPyAw*ppsOE81uR&fJaO=v<L8ai8{1*h^=*(g{iBoX--v3hfck?k|Xs#
zWQyi;r4m-NxNMCrCha;tz6E#3Bpw~E(yp;EQ!Nu{I{MB-?QJx`S8#Pcutnd$mj#FW
zB+h96ax!w8@OT}kg-rfKZ8WEXW5hQL>X=CGj{uVdAhFqOL*D}aa9d)InYLD57GWj>
ze+?&cQ@|6vf@i7@H*+p#F2-h$+F{aeW0qxMsd~hr!#!VV*V7<76-r(_&%Rq8RX#G`
zEg}&FDTsvaY`H|FNW*;`xk-pTh15hApQ%<_&WrmKr330i6eAqWCELgB`Zho};BOD5
zY7g$bIM3cyrjaCmKRbJhkSjUc?g@*Qt3G#WDq{4M=fi*D+qA3r5as4=81d(D6>aG@
zTR=vdQ^yevAfWd*5-xGLeaTZiQR=%rkjDEx<ThdQ3sM^yXjZzDtdAHwlGliQ=?rBI
zr#aFe3g^nSbT9D7J1->`3EhHr7<MLu>`J<;TqM89y?807<X)q+ePv7?4A0aLkuBO)
z<l2!0J?<Rtf0dYtYe6Quoh)#9IVoLw1=ln4-{w1JE9QQZN?!{>D(@i;IBtt@ameA)
ztGKKeM^Ug0*@w;O>PUxpJb#pmw)y6Fz@MjLmGc}vlLnH^z8#cHH{1M`pqa~%ZCnw|
zfttsiJ`}M<Y4fpd+BN)lt{quD&iyXh?ZQU6pq%ys$U+N6DldO@TSjXQiA}i^C;FgQ
zBV~T0!{vk2Mq@(W6nPG}i>Q)h5c@jO9iEn%l5M>M>OwPJ9I4Dx!0^?np;Pi}T*155
zyiCpKHpARkewv@|DMtDETf{C3;jU;m3>zh#b~~7L=Fn(-_6J`7jXj-i9hW%VX5{e&
zYTef3L8JlaZKOq?GNe`-@t=@aMQ+*|Q6(oTqc{$85@wMO6LU1;24E2>^d3xfa}Kg$
zt2|PTPQSn0!a=TYCT}yn`CQH8&PSEw+KFh?F5%^sm>m>CygA&1N<vJaaZ-sXj(I;|
zQ>R<UB@VZLqr(-j45^hyyb)rmB|JgpGX<4Qrpq4tdn5g03(bWVLXC21RFe*};bbz%
zEuf2B)-Zy2h$kA>s)y!r=gP%h7}N2T&(Vz96}*feE2R-<4);AJE$gW;(=6s`&=OoJ
z5=U@}!zIsdn$&sOu%k#r-e4W>m!W%)`Mm3G_lauRTN%d{ws%HL`Soppqrg%UrsH2a
zMTC>dz?ZE`U~qJJguHe?uk<GUHJ6)-d6e6943<^9fm$1b+~dsQDxvX9wt)<Dr|@l3
zc=i=F<{X#loFB2PLGSnVlKSo}q!C~1&hQwWXOP+%$&oN)-Nlo@7u{6uL}Ghwz5&<!
z4QuWF5~^o0f_fCU#$WKxar4ycLA;9-LayQmBB$#*7^vIs593&M)cLZ&hTzg5@#S!L
z1zOY@W|it?bIvCov$f+bF;A|0u&Y5%%O=Tv_gbVOe;T(*=*;>Csi6^sTPrc=8ipwg
zr9mc<>(sV(M2AYN4Sob#)Bxg7qL$@X$hquEXGg7Hq%{lR!s(pS6Z*~47P+G_r?^XA
z!LaJ6vly{U42Ua-`>G=8dnL>!sl-$f`vYs_R&I{q4u?zcJW4uTq#^%i7HX4hpes^K
z>r)tRt~s@wmC*)~_<Bl~vZstKsuPCwW4>>BZX}c@)Sozawb&%=Oa@vcr{BK|HjOdZ
zIFeU>N^@<Io3RM7SuMIFn01sn+wL?T@#JuKDgJgf%pxm<2e`M|-1Am&hr=C0PX2(p
z^7TO)^Dl6lWC!mcH8q^?>fatA7G1`;QzG;|WYL3}!!4ZDXHgmrEv_?3OE=$vFfd6t
znp3`=>ir<;6uE@0`~$IpE3{j=ZABTAO^~=ZrlqHjl;Cv*i+FOlYXa>#9cGR>)gsA@
z2kq~B3%DU@s>x^zp*CM5jrmU8Hrc@xq^5@PbxDN9a%X8_Ey?U_+aU^$zddmiv^;Xr
z$veZn9+#cTK#MN%`wKar5%bte?(Kp8qqSA;h~9|p%De?<q@zI<C+QLzapZ7U2b$C2
zE|4+ik}Gd@91Ufk<igD%+~9CqlgD+i+?TN&E^d=-A$2WMTSNIc(qapF4p-=^Y<0L;
z7d5|w7MMyGaJ(xr(S@DKz^8?r`|GTET;C&?@oLbd%{<lPE}x4TUzYYF(qKDHnj>0k
z@#Ao>QMN{&fSF>RNb<s$g}BjT18#7*3&_(d_uV_B!mJIzZIVsk%cuUAY19mReo9ow
z&K5>fz#s71oefUB?D9xu{;qPN8m#P>PmxPFy%V<zi!!uTZmQf}dSl8y!5eU=`0ygc
z4&V_t4tKrMnsqQc%q7NL%lX7c_l7tU+~9D@lPW1Mfb|w^OUglX{*2VxAcj_5#R*Gz
zX_%mnt;l)@b9YhWQp|>P<$^<*Ow1EACI}l&<dmKwmz9tLOa^xcszaLQanmucEq8e&
z)`T#gL2NyrcyYKtDdOfMH^8irygyd4gzy4vvG<0AbzI<Zds}e019l?~du%vd&+n0%
zt8v)SYD;+AHs^@yNOHG}Qu#@6Gim~d!_YK>Da7NhaI5@9faFp4aptHJ)#F-{oeJ>G
zZQM$99IClo$=e3TjQ=g>pxaH&T+9VNpLlV&GXrfIxE5xEMRlT^ZW|rze@O;?VZMtV
z!wn%>s63@p<c_+r9>-VOpf<@q{)n}OuJG%-46`MXfMtw7ju6#xi87$0@Y^nx9f%27
ztYIYeBm7O(D6^3>2klaWm20geGf;S;8CM%-jFu|b+YM7->8zMZY4ATsPY>h7;VLWA
zW<Uchph-D6pV;i=2*?rje7H2frri9Tj5X|cqBhA+ZpLbIfcIE-Tf%d=XNamu!d9o@
zC!&7=vFQQkK+C1urNhzNgGdu@j3>Ri=&!Jn%z*F*{sra<^Hq<V)f0R~4&dc-+<~`;
zA737a*k&>D;c(wkPN-lx=hf>IJc%iv4X^pwm={v}9Cy2rINT+2-^FscU)!fKjt)|j
z1H8#MZRW9`u!>~TwIRz6Uegr{!R1mf;_7IOlkVnBLpiF)tz^AJf!THq_Xxj@p3`6!
z=1uG#cBaZg;%565#KVaThx?@>9=aSRp)8h|^4;Rz+XO*OcTzEG@vRqFaJZY1#{Esy
zCfQ3Dq&A;85qSewhnP0&vfB%yDt54NubKyL0*7BNgqGVr20U)ktGu~N3s$!5aeZ4-
zxz%W^dE6E0h>c5bhC1^29Odt}+d*77TxA<<`s*;uqyCmNY5AUYA~C3CCYtRe+>6B>
z$>S+$u2|z9OAgmF|4WoMf4PTay1Bf~n+>8GwpwV<q33ujN%<my$0E>xpy}?FzfidK
zS>AwFQ;%E1k>~;P@EGoCLE3c9=l1S^*t!b}P{$sXqXmc!g%Sr2_pf~e?U)2KJE9KY
zui|~=iYN?&dHVm=Trc4+aMkTPx$lm}8hP9%+0CL~5t{rK*SfRIIWoNB(EDLT1_8h2
zk0UfZgcqUZwp&cEytq4|)X?>u5!KQMaku1vT*<9QlL?x~%|KOvxD9vk@wkMaRLLgd
zz~K@R9iYu+S8#XT6hzs&-NLQrdZ{ID>Ey{22EH1Thc)uJO|qRHf3V!*w*(=pMZ6`h
zFlsKDM9<)7fo_X@EfZXDQ|dunzGc;pH=;Rts_Ya`_Z`UEEM7H|^ppn6F*D{Q_t=L!
z`bb16P$%{s?g2%Q?pmP9(f38}ZSp?R83@y~K4hksF2{|1r*Vz#<i3pMa50aYoZ+Tp
z)>{0&(7=giDeLa$R8jqi1o2e-ONse71Fo?TT(GKMi2SyRO;@g9Pl0+r$j=cD0K?CL
z+i^~o>T@S!8bSNLSW2!~?0o>Sd8UYYhkG#4h~%?@=0>I?ZjPW$^P@Eqrde;Im;QsB
z<uR4q-4lryF}M(G=xxm=XAf6fYVbQi3uigp>x6r&WU{p(LmASDt9&*KT5j@Gx~Yuc
zB2<QPJ#L{Yf>B#yQRz|Pfo|NI4ANG)6NX|o@HAWlu*kk!FxzI1Sa-O&tpbfWA82g!
zK%|<tz>OV$>+#$V?xkbD!7Z5{_sBWiR@;$=zMwsBqZ}bkK9fOC8Xzt(mz$MCxVPFx
z8P`SlXPzsO#$4rdaLSDSbdR(LdW&%Bmc|{`B6W?+6Ays$G=Fi|X1wNd=VBh^rd^3^
z0ap0RiL5{@y1pOn=3C?9KpU<Dnp$p+SP(plLt&a^@Y@nM9km3+;VzJi{zOa2el>EV
z9HQt`sn&jR$m7`xFmht!j6C#W^G?mMX$KZLbOyd*qlN;x{^e}uX5Ofls<BhGxmI<j
z6qfTZTQ6Fs`CQca?t{1{Aj!`kMfsW-ekKzqc_Gk(7LNh#OjRf4d}4hp+`tV1wyXTj
z4CG?Flc!Ob)ZCZ}NJIa>^Kl#H7#%AmTDxD_KR*{><k`f?S>i+!MU@+1A^M!hl7Au%
zyUJPMl1Ez!sCSS>{BbQ;7rBfObdyZsR;AMt)!{Dek9m~)hzp{pUb+#nK~luD!+k8!
zfVQ^+jf~z1;);Reo^(0@<if?bCnFb{FwV*phBfwOm`!q&UUN-1cJ4s(O^BJ31HVef
zA8!`bEp@Ikv^MA=9>5xR%17XWn^4~ol{+A&7|R{j9L?iaFt;yE@bYckC4al_+8TG(
zSi}|%G;jFGJk8htaDrHNxT}@JCSJ;oPzvjW!ld_OUio%}#M{NagdQ=HNFGJmgAlC2
zFT-q-)0|;O+Wp&Ww6Bea*g2V&Sv!wHeb1?O-CV^Qca<l>cYV6k$XnDPAbYr!KeAf1
z@=lCxW#1Zps)9+H%f%J@yc#o$he>|?7PBR?#IVCXmgVszKM%C8Jiv}jw8uh*bpkns
zpGKn>nL?gJNu6^)*68E5$#K>Lg=Rl}<(1%<`aTJ;^m3lGi&#*b3~pci24`apyvjUq
z$>g$=cM`7Dnk{fs<oa^UYE_qOU3V(L4g8a)2{Sd1+f(xTpCPNaBHIC&zt2Q$hCKI1
ztNqqda?W1_HLqf^zr9A-S#D%q39pY{`7M5l<SCpZnO3IJ;i_~y^;AGBSB58gxddS8
zJ4kd5BT)H%;d>Ivb37aWE^Z&JfmhiDF1h^*D=`O-ayox#^HqmiTV^?fkis?GI~mP;
zWNJsb!lQo^G(9ysN4clE<!)G1T93kd;48nvE}?|7?_75)z%l83Dl;JE`BQBuZ!mcX
zB`?8d{TpfU&&F+3RA|=hZEhRCZdN}`6yk7ca3JfXPq<o1#*a@WBv`wH90|N=dIsWM
zfZir_5>lSw4sEt}L8uO52tr=xCn8Pkq%Cq$^*&RO4FSUQ?h(|ELhF%O4^PQgO01NZ
zbKZA#jQZOEO&OUCn%SahH%)m0XGkhn-H0{#F&0nG<TnKc1z$w8?yG`=b%q~*0buMz
zzO;;W&?l@>FT0|8xmz*j`5#=Ik2;Q}t!!u%I`{AgR~5nF46rG-j^Rd6^_`}<+>xCT
z+c>r0XIxtl;76>xWgKleCdaPp3%Qu6kS~@aeck;R2Y5VIP;aqRPyo)<ZH|8A`QxXw
zW-<b6@DI6Mt<MyTF0Bt!sAMk0+_^%4Ts>WdmUEN=9)#OOg-oo$S9wKTq)PJ{#AxTm
zg2!!j6Mt}b?ovH&Id{Jf%<2oc)#*1ybGf52qo>Y$5ZM?wd~qpiHU_J#a<1jL{CD6}
zP@|$D^@Y5T#K3+NpOMN${gcu$JCy%tTRGI>@&)3UpgG(>;5I6DfS5Z8RIX+G@jhV@
zBtTV|T1Wz{!B_bnzR{UXZ<a2#p;72G@4z43Z0&*&|AY+ATJGEz%xSO;^G;3Er;x3I
z$;>W@)ka{TQw_)F=a-=tRRaj^i}o<!(7i{1)^?WAbeWYM$H>i7NgAxf9R#rV9kskA
zuJ~Fu2{IajU-y<+qp#5%UN-d^v2hU5nwKJ1p;~jf+%zn3CUWoirOeT!rxv#5-z74~
z-cPXY!GN`h6~-ZE9quuxIng)58eX!E7Y9ar7-EIa<jIo^VntivZpCd>3;}VtG(?ak
zsdjrCQ5hsGZn|U`I){`kSmUp97rbmLIJLrt#0)kt;8gzj<`!!ggi3H+?u#qA5(GVm
zYOCC_m`4rMZb7z(2)0ErO#zGc1$MXECiuCygKQ`7gEc!iA9=<7Iy7#9-f5H!FhdjW
zZnzG&DgUk}C0Ch`>sUF<dkG66gKWb_$r)JVukj?f=q6+6wkT%okBtlzO={X2w+1D4
z%IAARP#?|XW})tU%)vH@a7MdQLi-wf8*LjvOUka{#*h%6iS`)83{(qVJY^e$<#3PN
zAj}XeWI-bHtH`Bu=|JVqb_FUwE|6(4O9ea(Y5={B+uw#(*}=GHxABL#NX=*9uS7`N
zr*IWNC~DqP&F7|K?tQHN2-hNleESh%H8F`%hx;SUjB=<|a*gu&Xb(Z`Fk5-zG9^Q%
z&>|C$;WjF^cobsx#OPU@I>Pw%RwQwIZyPHABbEuMY=%dxtEpaN=J4nbqA}LOm9c`S
zd>P|-^=X-=9p%o&jP_2zO4nJBM^++M5|ueloL%F?60Zv<kH!~N@-|-Xb>+r`D`~fg
z>?liq8_nT9gxaVW19XbJlc(?aw6F}a|0<S&G|y}-6VNar>D`mMixD<7%NAA$#yC5_
zO7*xE+zS|RUgYb*w%69U^CfQu8q#s@H`qpT;>4?SC2NyD-Tp&|a{Tr>0L<Z1WtJ-L
z0@n^XrZ{B?ImVGZ-AnrzYwU3w6>Dq)*nJ*Rx@Wy+o+B)ST%&<2OThUbmJMjYBbA%e
zP37saqj0lEG|Y8cLIdVdn}siyGf-1|^bW?1SDyOaFQ_*0!+yz%kUNjIi*6U9Hr642
zVPzl-V>>_x?QXmKH-2bC15YHsy$EaUW8ylceRPFbehJU;ZxLRPAwj*<@B@`S3$ctq
zV;{V1HP7ofTLjo_;bze==V>RowS_41%0Azff}94kHJ6Kez4ZY^i}=SYl0p}q`jUp(
zA0UF*SjTt|Vm$ePx4#=~@80-fkfmT6w6Sk=xME7U+G^r$Rk|3&uY4Em*ZcpNNY8N+
zbrt;d>u#b&x=7q7uRvSlR+d5R0>D}PD$P+H?y`xPYHz1*z%qz)B_;NnP1M4|5SwKT
zR#Tk>;&2P-Z8ffhvM=Ux;6@Q^_J}p~#ja9nbDo4O$h1j<7g%%f7GWVB?3#L#KgF^G
zm18D$zEd2UQSnF;4s>>@=5mod?zYX`z_P?7ZH>EP5oSZ1;h4jPk}B_WS7^<$<2^H+
zE;vnflJ6mB79{{P%#a+P1_?1oS$Fp(*4T?<e&U=d5REk&!^+6g=Nl<1qvb+ntWmSX
zsGu!nG%kXdoj8}6@IuLC&QW3fOQNAJtJGX>0h098%lufhL0PJ6n%W7orHlSy)fDy@
zN*3K|qBjH^gv7&Whhg^4@;$(6NTjB}ocozGZSLB*g3Q5-CDT!l_zr34fBF+{t74El
zA(JMJUuFDpgRqQYWDO&G<C+JO9R#@@UUo}*1UcJ;C}h-`kRclCoSoWHE?3{j1dsAl
z8uS^Z`KHl*5L>$RGHZrVBYFJVbF|hRDvvVDhTw%zn!bc%_ztp9Y%?W*{p2{2P<Dpy
z%gGZa`E4{C`vSF5F-aT9oJkVV`x$@ScAlt=<oU{IkGG-rORy|K<M?gx!c%CRZES@B
zEEEoQj<&|FWhr`^W$h)r8YMPgq`Iig#gaO&hV<BE!47&zt_3=2vDeF*H=(H->`p6n
z7Mkrlh1g)!#F6|rK9?nua5v<wcB$;+)#z{$c?d9L=8{zpYmf0}VZ;mFWV1tjcr}(O
zXlyibQEeujTZMwsuHy6ugu`8+UCQ<ELfTgrgx0lKtSt-MVlD_vkI31;-pl36OKGb$
zV=0NYTIj$jf5Pvuw)>nyux|Bf7jT(+vV@n@?Csb1q9d`yC6eF%E!x<lHY!GG0huq0
zcuQR0RAC|H1#6NGF%GjnM>7VMmrRsCo-Sr$>|Ohh;_)ul^Y(FPJrk_t3MY5aQyQcX
zMQmxWTmL0t0gp<SHdN2|JCvSBcP0O@RROg32yY$s6JRr9hYPX1EA8ynxPwkqlFE2Z
zHe(HaqwaNp#8Uv%Wlk0EOywEjZPXTI!0nKUIDlmgIwlHFqD%LT*wUA4)_0wFz$-M5
zTZMF#yN<8v)@GRIt>$8SsG(VAhkyTQ$wl@!tpTI7Esx~M%0F#PkDfYrxz~FUuF{9y
zd?3{8uHwdMQa16`x*G|{Yh|w`8Ex!kbtU7ADG<4-GOntrc!@W_w%s*!HQDb^GEw>>
zOQsw(o_$3;<TbkVR4$J8)Ds=KXGr6;qg-z{%s8}*&7?H={v*k=+h!fL$}gTA@}D!5
z{~`?Imn1ormWY-a+zEa;B(Rcf`l?sV{m=_Gb!nVJqX{HU+tVLw?7x-`+KMy&4>DVl
zr+_7XAr2TkiJa2eaqGDcmO1E%!>)s<TcQ1IXqc^xc|knn1-i#ALsEM@dp@sD32F0H
zr?tF)Dq>q7DFzR{F#eB02TkZ=VOp3@<#6S{O>c(Kh)DXUYd#+R39yl`1SXPQMg#Wp
zc^`U6GUZJ}g@h>2mVKts#{N#!M#U~5hf7q5s#%(U;wy2}$=<6Cr=86nM>7bO&u5t^
zo=W)Prgn9Lf$8Eg-?3Ado)RCtf!MN|doQ(hCw*TTv#s6c!3O^3d6EUB>x=XH0d(X)
z+9HTF$*XfC_7h+u{HwJ-pL!3RAFL<)UerJtOzyf5ll=CbXk*{#a8<Sfrpj!x++m%+
z+$z=-wk?3<lH+I=p<!lInOd_g2?*_F{zkyCSL&-=ZWeG8G~@0ochFNBOu<ZPkoes(
z;h=vc`P)h3wJK*uzE9euvX<0c_qLf`J&VMRa|_2s_C^Dg`C{H{(EBs4NtkHm6*j2=
zYwX`dZB;CD1!STu<OV8>mHFr!xgEP}f5x(iAZChJ1%YGF<9e<E4111#MW_(ziqL&C
zxUO{6RLzz2!PK6*@D=`uzx9gb5BJonn?A<iuPw<gIr4?L7J8Z9^s&l+cn1FounB%B
zly5sxk*(qGC;M)}?ajD{zMRRX61@m*?C(WwRZIh!Cv(Zn%Supwzfj>YnXX&xs6LuW
z==|A4>7CWN&yJSaOG5fxfN|GT8dPJYG`RjWUagXQEKqxNDe4Ktt-Jw0RWg5MM_tEp
zig7Bw5z60Ipk@t9(z7gir_zY(3ID}^1Z?3Weu%RAcE^v4zc!Y{R9!&AOiR-fp2Nj#
zRE#qjGEI`JnatGD;t;q#wz;K_Xf~noiwRL>PfK<3v!iJ?lavA&`0PT><<=n`<-VT5
ztyQAtPgZ0iwl%T&yR6~9K{hNpQ%_USgmLFBk-R;Oldg3n>H4mFuuwE{d7C-Fw+niH
zAxI9{m~-A7iI&y_U4BLzeAHIOHUrl}rpY>Pz^b?uvZ*}VhUzyzgk}^ve98TAx{});
z-qEp>95+axRht1ruj^nG^LP8;jOIqHchMtoCt~g^_bU9#V5mzUl>4<NW3@^y<LnvJ
z4`GGXcIX}4P3{r$-|-&+JNSZY5>(HQ{Z3EeD|0sz0ksy{ZGqF!27dr*t74o>AamqS
zZtzT&u#nD5c+t|%HdKGmJ~Xq?c)?8hs(Y|QE!uu&fyQ3XB7~*(_yFIN_SYTDaLmR=
zUZFX7sbpNikO^812XWmg=JtpBYDWqU`@?<c4}cxi@eG2VS^2B@yUr$3RyRT*)-p*p
z1QBoW8y#*4EnkGpk@SWf<B#`=OCkGj%j{5dx1v+eAm2psP1Q+onhi~}pALTjjD2>l
z=5eud8obDto@%b$d&ydixybEtZTK+vki4_gZn2hEa9VS|Wa&wGM=6V!>&x4Eg-*tQ
z0BnG354Dg0<=@(&Ru|XM*FtG;hc@=BF>f8jKC2*8WIlI^d$PC`GWI>hpEFM_nqg?X
zV@9Q;3B8Cp-yVqr`*{Q~`rE6tD?(LyNJ1DHe8G@8nw&%yYMjiz_q8!Twr{4~Po(N;
z3Knud*JqBeN9tl6k4uFjX`zuW{x0+f03B}P`CRI6tN8}AAvRxWqexQ{GBsWH>wc`k
z|Mm>bR>c93`Efhh^kFS<Zf`3rWIW!>etobEBgif@9=G*8(zF>d>T#Q&`Xpfdcb00a
z+)}3Im^rqkbF0-!+d-W_6!Uz1$bLG)&s`(=14GrTVBXB3y#1Q)D>o@;jvdI`n3<pe
z!!q@FXv0G1{saFBKxQ}35_UoMlYNr!M-7;M#AIZ1k<UOA&Mm`iR6GDW$s<n%Gi}!6
z!a|ZJA)aT2b1{}>1UX`+{8Sn{YNJxUy>uA>F@QYnD3_l*4bCeMaRY=~b<@1eJj_7f
zUZa)qeO_|iJZi31sovaNjt@Rfny996w00q`t6nCn&>{E_04`tf4*z$M1#XSN-%6&t
zX}~nKw!MO<VOECNsJNi-2FUzK9*bS9ts(Jo*l^|GYq9Z-MT?*-Jf1jVO0PiG0bXKD
z<D6jJv)cd`P*ba|a&raOH=x|xk-K`Gtmn!#qyHu3&mT#CF?EnuAMQR~Vn^+i=5h5X
zrH^ER0h;OF);ojwp-=H208D;;k7EOBfB@f6HpXU9VpM5Ij7IkObR^#JqqZt8I1@5C
zmT)hoKP@h037M%dv%zSbf}e={KkV7f05u!x3_BX<3};;rFoC>M?I^brEmtnLR!P$}
zXVX9WX%O4$(bF@z8PKPA_13*OlwJ**AiFD`+<zgY(2kYp4*({A<rn}B4)F_wRT@*^
znul0Tx@@Ewp2G#WhK5GhXCQMU_om!tvA`n@*|a5@C3>E|6DK|%Yoh!VHK+wMrq*Fv
zracd^fgMHKBDVr!G5}U{vj#NRQyMJdANkr(x+a3<?ZnN!GA%Uy;j_I`$X8_Z?9TMU
z3cVWt0YHQ^{P}d(M39qelk7oc17@_P6I{elRB?Py!{dI))R;$>H>@Y)0`aR<rlm6l
zE<d1|hYnv6sXpqiaxCg!=xp2qu!0gjrNK_5cx4~o8+Fz0;CRRJ@8H-;LXzfgvod)H
z2T9H9wJpulTiP)6JiCEHMIO5l{{g__mrC}~=cpSdd;{4m(RmG>L=xPWC3`O<6>a!`
zte-`z5f3a-nQkgGFR+UhvRjaFUSu_Q$~ZLp2y%+48cZWI;|g2Su{p)0s~~1j7R+gY
zlSXL64DNn$UtMKlq}6a=S-KC^sxW~Yyffp*h{mbupv}kFwhyK$;1^1<;Q_$m*gp2i
ztNY1<ynT;HYuIC%A;fYf$$tHP@xTK417@q@h78EWxLwg-t7F{?xm{e!FyfQ!$kW$u
zE1H4m9KYO54U(x?!=jk>xSmB|JD>*)NWoKgUd63d4?T;}MAYahD19~A<mvnc!=(mI
zyVOID8#2sXG*g(UAKuOYty0d#e*kd!jy>$^eljx>lkyV(#&#n{q>{x=mh5cw`){#^
z-;bKSBW~ydnis3N;SJ(a5{VT|u%iLVHfSmz2k3bOQ5QigVtQ9OAq66X5|o~*6R6*U
z+00!6CN|N$&kAlzU3<vXHnlUj$0p-98-;qWR~6(3@xE$MroO!87pjwR9{vM>0{fjT
zw+<8y@Qk^hYeb<9eOhF{{vg`$Z^3L;9I+fUEs_U>mDh5ExRfzo+cuS-L^F{fcbW?E
z8?DZeF&-q)WYs!=C6rWXJ{K!qc`|q3G&Oyh+P(8SIr&PH*lCtpZe}{~=571Ytcz8b
ztEUYnWKBDb^nwZv=aye>cm%BS9a|=42Q2#T9(cbsqC?F`_S<+HhQHp7*{V3AFGOz0
zSIm1twg9pL5i^)(OYqChST+*EQ>JP_k4?Obqq6OZNE#%Gkg5-)><AV@J}ze61zhLS
zUB3i7VTe;bp(XqYFpPVU*z9&@vmWb1tscCw(@A@C6BSyY<2F12R{75dM;QI0?I#PY
z;wC%v*W(^?c;_80`}J99<9`gZRdL0gkU24zdq;hfSP`fLbxC$Kpbwgngz$=)8YHM5
z*N#JKN9m9bu!ZbgEnc|}DW!q$`P+E4N@%Vn?#nW{KPyc?U3p_T_a*Uq-lo7LHBcE?
zW{YLIza4Jw5@k<2o&d}I`h(#cI=%DYFBgQmKg_)i)d&L`03e;64KK&CE$aF40cc93
z*DzTsY+2%^>i}X2sDktwr+tHFCOUQIt_`belP-2N&slDK3}6j;dQO81r0A*31t|^m
zNTRm(PsGjjECq|^a6dR%(5M8uPKHQ-CbeA%EYyhU|HOX+FgO;O*Ks@OK9KJb(|yoL
zfKk>KxM_GpkJ+j?<9Cn=F|USu>>@s0YfseN?MeJmjAti0JIvi8qgy%NIEc(^a~s4S
zbRCTH63E8^tmJOJwi>EM6U`ZFa|fjAq7(DEr}Cp$3Y+BVs?<6|EQ>No-@*1SkO>9I
zKnpHK=F@r`%lUN>eJS5fu`At1=x(=>8q<Qr9W0lA@Bc5_xWA0qtT>|uXg(wg_I0ed
zsfWeI5V5}Hw!}^KN3)X<-ZE7MHJUav4sJ5E?F+GoJUxq071B}e`eEE^wbosd`4ylU
zX6V9FZMgd}4*}9idpsoB;7C!KLv@W0Z(FHNpqr1`@d%*sL1>5U0O?Eld}8@JSJQc!
zcWyNHRH<Uh64|fcffo$06th|J#%$1hNS>5p)?WeZL3%7^OD?;XXoeEPK2ufbni)5{
z${x>5Q1q03E7y;-ul#yPu5}Dqq<N)*w(TqT(KmLvdM+u~fEu*A8I7Cb-imCRs(af-
zLf33aue0s2e>8&2S?yLCa~e^(LaH0w0}<bD?|j-$YDLmte+g~K8)cMv415YQdF<j&
zt!u>Eoyo)+YzZ`NYKOqx#}iG}p|`q9>1{^?oo3O60E@^j)m(0E5t7Tjg8ycmrd`#s
z=Z2Z5i=L){uhg^j5@37gd5A2^D9&%S3MS!`lLs1d`7btDKPG$B-pB{~+Y6=o!95J5
z!@1b$yc>N<vF4_&5C-f<8}UYm%jN$-lSc_R*g?DrlrY@d`xlQcyU=VU$om6K)j?Ij
zwM9_NaT3y2156@Mn?n6n0+l{6=Wwf)s!CUTm!;#M@+GG)ReybPC!Wm4SV-4U*0iAE
z`IDJHmaer(P$-k4H*GL|T#oG}ouS?b^0RN~QcjPabT$s!h%R(E@5XXcYCGAl{}ye)
z{~etp?AT!|Wb!B^PYd((MLf<u$Qp2tY~Cm?FQOSsDCTx9JF073vtoX3#pJDAtds`5
zx!HxA>he$XlTat-L~Zq)mD!T_xfD~4>F61u{3b&+DrvA+FI4K<X<~~iTMQo?<#j9v
zxV|+dtm;OzOKi$Z6t0c(q0;00NC*zec*FfZX0zgvD?yV-Ia$iE{tAe57?5S#rm{UA
z_iyIv&|5vnjgvcQJ+Iyfu!>!}^i&}$XR=AwPUkwGK@+v<4AYW&>X{O_Z|BXYKVhyh
zo}OggVR%!$OK@hEn<kfBX@}L@L7k>A<rhV@$GpF789XBhFx;_no0I7JWzvT&XX1@E
zX0zfG(A+^DnOat$GC)$<L$u)M+7t1DXD&g$Kg(Plx~j{SxY$(=Fg^=l7CD9LR-wN}
z7<~$4HNRTA0OCZfYgj#XCq9Pzwsg+TW}C8-CU9IBxdGI2;&ND_EC#-cca6htj=c%p
zPnPKkH<2=jzI0F1Y}DMrlsw%@adV}=k2u<ht%_4bSNJLP4jn5s+g;*f=;axE@+2-p
zG#H&@Ca<8hS06H4S{MZqQXm<Vv-7k?E;EOtNj7uiW)hlcqD)ztD9zNjsl83OTYzV>
zbd%ZKqvkN^R{ysaYng~dg);fk4vV*oU*9GMA`;*RWY=~%&B>6a1oLiWWjdk(o=ELU
zy8nE5V?6`2UGd4lwV>I9`;PiJKv0an{n?{A{5YP)gkbWGu@_yn@C5;5idAa>hEb^R
zEAPq&S&|sOTuy8KiqK4}w=bG@(pH*_xj`<yMoYEB>!Cs#;XgJ+_qI#qB5M}xu*KYM
z<Q>3%^5z)7fa_5srsgU>wne&TSe+cusifx<(!Q<-UWoDs4oaTKEEj_&4;mrE`s=;o
zFnFrsv(T0%%=`+?WI{N0mbqH=P&Wx}X<}69wFF`sMP-`HEoB}$m}1)nT;b#n`VF4+
zG)v7(({t|j=gN6r0MWcO;GVY0Br$I23q;>E-QV^X%TO8ds2#R$FUJ81rT}SBTn^2&
zq2`|Gp^fqkZXh5Ev><8i+>7uA`cBMd#VaiVx;Z{yb{Y3-5a0?b5gpF5Cu+PKp3Q^+
zNIn>b`iR+*{5MK;2H8fXzONi1pex7A&v9$je7H89Ew*r!J5KwN(foTx&q+6<hdK%C
zKb5>#PkK8>?sC(~AKPN;HuHt({8q555ep0;8@p4qP2}d<PR0^@L~VnNC&dhv-dV$Q
zxJT_dGK@DM`Nw^}V&xdOhLytr5;sL-3CyJifbtHS(S&lnxnq%LYNDADF@G8r!s!n}
ztfNYco~q45ik>=$e>GK)2kj=8%dKTc?FZ(uZ^{PfCzMU*;h~$#Q|NCs)l(yQ=W`2X
z(Rr*bX6^vH`TewMzD#$xiY6rScW7Y2Xw62)*qSc8DKW9-rm{MQ(iLx%-^6TJ90Qv?
z$dp>i^0><Y<q+!|Z%Y%pmf@LA2qw2k+NpV8c=AHA$Ekk-SVuvzw#pT$(?dC*D-4@7
zR1-eV7;1j4m@-sL!nbHBZ_96}C3oxdWzaNzG%LYS{g&q9p-oL!IY5V<wivk+e9C_f
zgJe~5ImF+32Z#Qrgh|?f545r1ex!uy(%*joZ<H@aY*suo3p9Dq>{_e~m#?i5m(w$R
ze+`wcNAc_?geT3_qJ{c^#Z9a-p#vzcZl^9iRSL2vA)6oM9#pi@*NY2G&o;WoQ%A1S
zMJHa)TL`Z$qi>mgJe~n_ys$!<Y<bHT6L$u#0BAgfJ&=*Dm%t>st$Kp6VvcQEk4@>T
zqnt@8APzEOv*Mb*8$h#1EjMoJQn5N+8*-&%xjj(?1&D?d!e!=a(Ii7%<Hpmjvd7c?
z*)0GAsnqtB{o9cQme=$5i$`jAdM28Q1x+2JdA>!wOR&iuK|<qvE>2D%C3WiN1r^Gq
z`wDyP+cDUEw0V|Hhqw$9I=?*f5=I9tTshUI;Hh?W&qVtBe!L-$7YzdYITJK_<ngbs
z1Ja#zA@0bgprRM>EGLA`CSM)fsym(Bj59IFipu~NlA}jYRU<`D-NR35Fhbw7>krM<
z)JczVp30ALJ_n@%LzB|I-j$c!4J?$!oNsKgZU<rC)0TG@?%^b|mM|LI?pj#-9Qj2k
z5BlRtvR|L@5!wh>+H>bK9_jiFWbUAW%FGAn0YE_{j9`g91JfJLa>C8XWHnl=yGZdA
ztE`ZGF2F=`^^^wH6%dmGu=+G^tvYFku}jlIlTL>vn(Ld!Jx5&uPgB6<{`C3Y8&}<X
z?^TdOnG}6uk8wN57pxu{E7c?JqAjt)rN;X)eN}^-XGcN<a`(f+<^P-TM))escEvdm
zQK10U+@Ki9EgI^L?AdR<7%z!(C<n}Da#3}J#>9^ThRUYb05-C-PQR5~?=M9KaskW>
z_)aQQ*KHEYHYI2hKmwhr<fc*;H6Xk4l;7TPZ-ASHg)&LXw#BZU=73=bZJi?3CoY3Z
zPcZ*HQ!_jC;Hg9s8IUC{;XV>?e1C~~DQqXX5j1^}G<|-Sy20kb;&NzIkvM~{TqE$T
zCzLHFvtG4Uca@zJFL#PTpq&t12ctO5QgS#UcLJt!CzP(b8uA4G-H1f}@OC2igIykw
zt7ZiGMgD!e6?c2@^?wu<%4Fq}_L#NP{LScs!&Yu6daOXTj5+shC(hPRJ^-40W}ugS
z<+3R&T!%NlWq7S>0Ca)PAbzg;#TDXmlISgMfNPck&w9crFj<YZYUGqXH=v@)py?1R
zDb$W~>&iloa?35`IC$t9Znb*oo|G3zFl@5+DZZ%uHTOx?F@o)7b^iTFkGyv8y|<qK
zTiMl3#;Z0NweuLgsK>?nmhRh4;zdR2d4%Ls`WTTqk1TLINdExh@S4<~Z{Q?&VRHyK
zQ2BMhZT^HAf|o%nbVRhDP|Vgt+qsNCkLyV}A7Ccg*}C*p@W@~N50YoQ4{~djpo=tS
zvhH8B($f^o<SNQ%f^q>vsPp@ezWeUG#rOX9H(u{7IT`yOezwV^qkw_KjfeAFUFwPZ
znZ#t!VTMWCke>wH$Yg+d(G0O!4S^{yL*|g2YOcri0peC@g0(bzj&V;%G@uZ^G^@$o
zLRG+sqf7=tAUYVqqufe0r9qYEgZ+h&??;ls-=a^~qM?>`GC1>X35=~8B3HLa@+<uN
z-+Wi$ts4V{nvDY>w3&|=Lh1tc)bFFs@erS^$tDZ$5}%ZQ#U<1PJE7eWBEKiUv>fyq
z-ssw@rWKFe37SXps<~H#E&>!pCqAo*UW^&E56^-^IkbiXKFw{XPVn(?rN2I{mOKlv
zl)@6t!R}Io>+|(Hy3#ogHebL!`wzMA6Y;k+U3G$cd#K9=uSnG_f}N#){~_XT4;}Dt
z;1|l|?$_)w=BQD>m!6jD7PpZ|C2Ikn%qhNt8X?w3`cU#~^2fptA`Wh&!!=18*i=G}
z=jxb?6hJ|(h?UqBEYZQ<Orf8C9N>0HMVhG-e7xNbBDC!fF_m0xQCnA&yFJ9;D*pjy
zZ1s7GU#;$%S6v*wRXI{y-g<j;RUjV*rSSkzQ0L!&g!tRT%Im3AhPHVh+Y@vjMe28x
z$zVj6LX8WcBz69_+=3$2Kv8lv3?+vo<E3-%PC>lfeMNjJ{W!tHu*rnXn9Sss_p}xl
z)Qi}hoaVe3JR9ONb?jLF0aRROG6(`W%Jo&%=mE=ni0GsKZ`m9NxA)_A=j5PfqyFF8
z4%Ge|Ujee;pQUOPK~A3EzlV6+Bk!mohUQne{bDvv0f*wSep=Vnbg#IPmc+CGB1<iA
zQCgjQ@u}nsgRQR!lO~V@T=@Xh*?2?y6<?sH5d%_T^9kK4WJ>n|(nz-<p>;ONUwGEz
zS&@iUt5$I;5}%n2bWXb#U@UoBN`rUbKB%1iZ!gww>6R6Xzi!0uxwUGlCkPlyLpR$F
z)&9dwZdA+k)8wiXK~9B#_rZ4*e|vCWz}=Eo{@G;THeY2=_NyrKRcJr0i;r7#^eJB`
zUaU8{j+#gDld3&hz8l%m>Q*75Hs2PjjcI@+o&uXu$Q)YD`s;ImC2k8MRbVy{2}tWr
zcxEJK|Ni~#W~xtCd}T7wY0+;Zz*_Q(6mxk?2_7Oz$hYe`4*XU5FoUbdgWOc*!4!B)
zlwguMi?n~X<wXs&cn~HhE~dQNf0(%2cLVO$pGWVWZZMgQ?~s!w>>ObZ7xj8f^q_$Q
z0M*76t>N2q?j_$@KF4Al3%%|Sm~UC&jqGs?X{j49{|A~<3dka*iuGsy9Y@MSi--Mu
z{*GrzFfQxW$*>|?CIiW!8Ta$-s{nf`t?}<B2bxDqiTf$m_m!n{9CU2Kt5px($&S`y
zrB-k!gw&35)rcUs!0+EjcasnM{dK|E!YmW#3cc=d+J2oP#NoaiCowkd>5(kplObkO
zc+*+bEK{X|*HxNZUEux~Z)A^IXh#EP-Zs#*q9_>nYnbZvkUO?hh_TqzjN9-G3CfYn
z4Ry`5Oa@+Vp1BxiGUzC`biWorRJ5J^JDB63NbV?iHGd0F(~H*_%Y6%6igbAE+fnD=
zcR*?BJBPL4Yz^=_Wa{P4TQ8UQ|AqEbL5F)j|I%vgK+J0z;B{(ZsG;mEx$`{wO$!Nj
zXc{8<z_a=PLmSu=56d^BL9-P!uTb?1<`LZefPy*`W3fvY;u1Vdg0pj{!K|)jGFTC}
znXA$+hZv0FagXj*JS=grxz+k2w{jQA=IV3bb=+EYnik@2XLjOEhzpRi6!?4<HU78g
zQhu*;{W$DZ;tpVU4*M_~w##Bqb#=AxFxt=Q4mUpZE<9T50DxrY#P#8}QnLLNYMj!y
z7zU9L<q7g@<d@LKwNdm!8sOAIrb^}#cO^jWfv!R9iYHo)XiH{zD)It|rmP<yA(=+p
zDU@c)_xtxAefNm!VTmKk(SxV_rE-g0U*v7uFtm<e!BzH2Ns}u)g6s;vp9)<Z-Di|i
z3o<b_N&QEZ3^$zb102`YZO|R=R+A^%?qw)+-H@<6!XRp2`>mCkA%O^pXUPY`oQyWC
zCr&hmD9dsOY<8hrg3LcdHc*K!kYutlAt(O_(V9%Lvc4N=JyBicN+<MiJuR+Y$2S*Z
zEr-fA4_icnrHb?%2mV62<hj#_@oLp-qO#|<Vj}Obu)}o7AvA=Ye*YV)(nUQ9X_b4#
z{dn4a(X!eQwr$w3!Q&Y<FIaPIhZ`UH3KWt_HfD%a;}QdtDSP@xIy3Z?kU~zNE0($D
zzp0Y=Fxs%5_-j1M`#3{;*!~*LdRjmIn$9hNlDZOu;oppuXCa<7ndEP;zG~P~Zx$q)
zEJhhVgJ&(f=n+KrE?xJ6>ZX+H9+w>uz-8?<+&IrJ1HD7KaqE4TRI!odm-+Y6<?Wkq
z)K8M6@{%xC{i<K1X0$qQoJM+dT&MyFw!@8&d<6>h+yWAAZD=)lwU5%NVUc-{n@GPY
zA9tF9HmWC1JSAO=MlOcUFl6pz%LPG7I*C|}U7Ha@5ben<-`5kkY_EFU_+8_AJUowE
ztG%7+DGk&u*KA#WsxER57R2V&yh<hT6XagENv_Zc>gxQviMxGwH~T$Q5F*&_dp8J6
z(H*BvTS6<2>~Q1e{8o*ag6s(2ZEO<Rc~uuHKQYO?;yT?nvmhSyJ=&<A_ySEDx*_sB
zY>pvQWjX6s$Mb-<zLw-}P^N`zWIQ?_!80fc=7$AI^;#b9=ePlGxZl_oaw>>NrB`Hj
zRA?@?g4oXX3jHj%MDAAZC24Zi9XM60xJa_|Yj*D^H*b&b_xr2a$&h&OTfOnTnmnKF
zBzYaW)=PSf>Tov$gmGeoR!fy<dNJUBQ<o=Lwo~T6>U^1lSbEuff&4|@F=&H&;>0HD
zS~TME%!N%eg=CUs<`X{`P*QtxjJv?53wfiW>v4Cl39U>IHGn5>W0e)!-)?9M1@!)p
z_D@~+qM|g!km%Vi%=GGWfsC+78t}zZNJ+W>Al*$q5b(D}oW1d@*tJ<x6;)%U{4kHy
z<%0SzPN)u-D_Rm;kW<uU0KL2p%>2rE%3bvH`<XABZf09Jq}qWtsEr}Y76DE)WQwe1
z{q<GIOWR!V5r_<S<;I2bap+Buc51}zVy<|8jML&IBU7N;#=*UiT>U7whMaZg>RE;A
zYI1?bSI^j<GhNl^kg@{h*ZBPh>EZ1jUf@3APDW*}|2WE~N;sK5hz~?m8`I&UX!g5<
z4rJR3B6-o5X%Xbv*!868vU`yo<(YtFs0_|Tyo1~5aIG;2Hr3GdFYKc?NKr&n8Ios1
ziUWu?CB?-dyPZAMU1i&HHn@X%57xJXyzm7sA(+E}=wSGQw{mObavHqc&rCv|W`B|?
z!+_j8|DL_X-6~lMs+d89DmNI`W@NO@l(3(!zxx@9&HWRrkoV>zn3!82Pcx)Jy_g0;
z1r73jtN0l?B1jxg3YU)!PQDXsNCQlgu0|sY9e|;mWMNXr%xwA_KvBuyOp-FBY(cat
zDSloxQm;)f)!{Db$f<H1a8^A#ppLZO(shUCachc|rEhj|(B;bMVEC>+6<k9vK&k_R
zQfr!};ON1?^0rLy@ztjpRc6pC#OM`y9;dZ2R#QiFxC>A$%pD9SPc!5^jF~)|riiXm
zo{ck2l|9mHao+5PHKGA3;zSfXdbEEEG~eWqNs>9uY=9IsfEbQl`%LW$5$#Hj4}+-<
z+G`#+zSp=-`h~r)(W^fZ+7{dMH3wT=uKYVUPxrW0l39e#hShK6gD^QYA!Pykr&$X2
z?**hA>}NPP?|VPm7OHS~42ixO|Ddt7E1JW_v$Ci&oaj7_0i>eM+G5zLKK0qCrSGB-
znz<lJClZO<yBe4wdaQ$zM!*2I?r6a2PS&5VhlpAbxfHKN)Bp_3lL|>Hd+8@Fn!;~9
zpW`YdzN8yLc4bJ2ayUWVi-O?vW4IoM(nq}BXf5~4k>r;6_t3-JBL~Fyh&MlL^p=%)
zb+nC>@bABo+O%bEeSU&f60)5|5gG+K2k=R@k{Jyb3?_jAt0K=Pg<Ht(*9B`p100sG
zMk5-)Nrz6E%s&gH_b9}6Cd!}w^LYr-vZT3Lua3GE1c_{nY5HF9nrZ_yCb`nkK1%f~
zLPaFny+oIyQga-b=BXvzEJB`?C67q`ZUj4u{C=8{;cX>NfoM&B!9t_jc(04LWfDH3
z$wvA<$*w<AN$c<}ElMPeBM<T*z(?8HJ&2{32mifxNgGh%?MO1L1@c)7JiCzwRKaYj
z=SB>e4V!jyiODc89zG1%Z&78KX4uq_?TD5o&rUsO`XK6Y7pL3QUe_=(lb8TKc3=hX
z=HzRaaBC{)zx7}$&UIEUTmi*%fx@Liw%7Rgymgf9Chzh4cZn_#8y?>F*!fko?UJyF
zhTg1ZT@_V8DvGcA6-!Jfk1-%;f#*hMr<O-P8ux+<A3_%?^0hx5F)v>n?OH^WNU3c@
ziufKE6sb&uiEO!^mm2k`DUGSxF0#7D^{y}%mKcjX>eF7yI4V**^hGT_0^J_WX&`%)
z%R0&EC--}iWY_w4)5F`N0Ew*E)*4kNIW^iQN%-}9A_Sb+bPcx+c_@Yb6gRprR9A5Y
z;Akj`DQ1>UEWM=Of4xLJFVGu?D=gF=Gqp=xD+@SBn3gJsN<GZZkP(2QIxJS~XQ2&(
zQ)eOCl~w+&WfalQac7yi#}b=d{V?4%tKx+d73xR1yNJMYLGWm|NKSgnH+`T%W%^E+
z`?1Ihm+CifmBU-6^b6(Hs|{l~S7t}sASvq0fN^kg5FCelv5mIoC@sl##w8FP<EvO*
znoFk6+K5XYzY}H?r}Kw}%%+$p8T;kMoEr%RxcRn&A2;<pM0T$OiT9g}?tpGYv@7ep
zt7Re_ta;q{U*q<?keEjy--d!Nw~Tn$!eEYrGRdRd$k*<xACvl}NQ(Ua14LNrtv8gW
z3H+_k0K7m$zi?hWe?zpbk&?HPRA>IxqDJR@fKgoBINbi^0ft=f8~hBbOR4^v!7JtK
z8T_B5Z|snz3=530)ZnP6HDZQj;mkv!6C+Df*#{C%rHM;n0Rv!qxk3v*gdhJ!E0)k?
z4)wT@tX{FrpsZ8x2n!2gpyxEGqkAQKFcohzn#XG!>(ykf-0wu7Wbr+!D_xX{L^@6}
z+}>VtEZVk6d7o;|j{#hh+J{hFp<R)YPSbn^^cHN&Ypf2X8_I?Or>}3~DkPJLDGOPG
zJZ~Y4rAB4EjA`^q6+eZ<aH{!{%Anh2bF5w~i)1pQRbf%qMXlTnb&)$75>*zvBq^bs
z4{ZXR#pYCKX@hF=i4&{Pqo*n)_m$5I_HEi}az9a@?EGr~p0~-_?OS{N{wmR%#2rSR
z(rvyAlJEuidM8a<-RE^s+ds8lV!Yhfr1$CPK{lwyGy9W92C^0^Y3$YWD67f^gFm-E
zlsaYd^=KrVq$@xVqI#K(Ejte>D|Mz~M9UEsOO~SD)yJezO=yrb(QEl2CI)D&3VqxQ
zFr)k;&BK<Lg#X)L$~>{)a_Mqfiy;?CecgaEzyI*tRO!O+uPtJ3>rft9VwALOO>wl1
zQ02FzIw=>xL~eXF)?X8xGdz2l1CCHO$~sTkDVR0yVu|CloNM)7A?i)ZEctpgQV-zO
zplq6ajcGeKLdqIVY<QITgFycFHKtV|@(QhAlD5VbMo7dmOH`GQRvRFOq-POQBR30z
z`^rrDP%f`MtL(eAS}*nGNQ!Ix2aXVTtLQlH5V%`kN5d#Uw}j1Kuc{`%x7vTPT4cP0
zvko8|%2OblQ>$2=Sx7dND>)|;>uxpv$))sKp?vkHe1l;>8uImMBmyHDb0diH>|z?v
z$&j+ri5>ODsd$esFl`E#zo^TeIrJ#TJI1Eugf4(CaEatY+RMzttPm=7LFGJhmRlYa
zSk4pqH)Ede_psFWBH8Zu?<GnXM@X6iK^)jt!<)B5Gox*NDsMbW>XUr7nI5oM<_F0R
znx2hNiK$tDPbU42*_S2!b2!ROgWqgJO1C0OeLji>sUXMQG;q>kr#rr4dZ~l;=i5Op
z#S4u?5Yr!1M+KdS)LOQlr!I1h?y$rK3rX|Hx%JF~Jr@EjDYsZV%B?1P06E3Mqg=^b
zxj1YuuG@2v1WUcM*Y7VE)#Y+SL!Rf7V~zu>=<(y?^Gx-@-z^n-aF~OZXD9H9$}m?Y
zAva_rhr?-+Cr&iwm<5d~)DY#@xzSyXn1!9jF`Od)``TlWvU(CrGJ2^q&3l+Oh0m*M
zHB&R`v%6w2Mx))wK(h5VnJjGHJ#pgAgAh~Nt~uD6s_=h9f}L%ns>c5|Rl3-_N4(m8
zrk~+FwBIHBF5l2#DbLc)<~m`!rMRi}&KaJq(DY^??e|BST}gLt#Ca%Rs-IMxW=t4s
zA=a`I%ZwC$FD|bUGrS};3BnGtsa(UHhd?i6>ilduZnwjam?mWlOVp|^RoA#Z<1v{*
z;#j3=S>(Q8chc--J6;AD(@uR+TSE4g3-y2d3nX(ISS0X1xrf}mJ#x_Rud5M!`jsw5
zz0vd4DBGOMv5zN{`m|&(znHvhA#Unz2QAM|=p|T)x_~DlF|<w<JTPHPSnw3x&R$_*
zPpreYc(!z6i+nvAF{CH^B`pjZ1Heqby&klkM8fa9J*?F@`7(?fgLZQkt!&FQH7R{o
z9LlwvL?e{R|5rtWzj^FVh&7c~Y95xJl<GPd{yLG&gbfrF`}ZH9!cvNj3l4967Z^^)
zmqyp#f~cW5o$i+DilfrSZgb4+?4|h(@O6rT&#}5OkGw*PvL~xt8}gHC#sn)nV(SrY
z>6h~?RHP9@E(Sh|<mio^qU>BqS@e3_Tx<GEC5Q%PAOE{dt!@W(jk`4dlG4)@V&wY5
zwYt#5{x2cclv|}a*b1UFm9Gn7)JUc@kS4dHb~nvZ@Xr3-yn7s!vkl$t!ky7Hwh-3N
zrxm)Dz53!&_K|GCwkV}XfjL2=7SM%x-71&(+d7zr+Lk^cznN$`&}GJFh}Lw>LPZ*3
z@I3HYWb397#zM+Ur2;M%JZ{o1M0>K8WonJvtWaHU(>N1)Y(iSqUirVj32nIV8qm?9
zp2DCuJN)1Na`Dj@9@T#TZnC<4H{fmSssx|jbe&O8G>evv)#In{)e0?;?2KK0zuYnI
zudpOI?uSNQfPz5T-Ixc7P}X=k<R?{sYefS03`~QvP>)7fs7u_!Lc#GFwIcSh1gNk9
z7O$qZcmdO%>_xjQ)jdP?xbs>{x7&rZCv($$rA-MBhPV72k>4Wh)LkqM<}3`lTsa*K
z2@1>oZ@fu&llS>+%LK7fPhVry5v@);5*-7p&!=-~g+|Sj>x=^BD$8G`<We7X(D3Y}
zJ$XBx$4|LTnZWKxV#CG>q9Y0YO&YH?hm{Nqz?ql^RW4tTM%bJj81?)zo-ZZjkmQba
z%(?J#NLgwUj!v?5bx8&m5Xb+hR=RUP)#F-ul3d4l(xl<a|4pjj^dIke0Wj4RlxPmN
zjBMnFNKchXsy&)xXTa(Y5qEn?NmC#ybGl(N^80h6VO$2BK`#Kby&9MXtUhY*%N*nW
zpM!R1C+*4A`9+YlW^<TH`FvzUxdM2t{C6S0*=dR8_i|K=S|Tp55%Uc6`Er%Tg-Au7
zPLJ$JfXl>1>1ie<Z+F$9+LPTJKSite0M+BhQ8I&W<od#VvQ7SdMALsd)*mw4Wb3*Y
zG&x3gmHuzZoCapd_xtye!`q{~l~uK9Bir!scJlX@^_g&ZS=)y+c@;>fQ0@7=T+`C`
ztK;ObqzOI!0bQdwpV^V6q#K!{1>uAx$E7dkAZ>aE+b~V)x%k$Bj~;)}u4M>}V^_%j
zpAl0bg(X=C3+Vqorad`;c8=>Au6kVWgm}rlF^n{aoZOEwZ2JcG5+H<J-R0(!BaMon
z^pr4Bk0o;R{k!)QcYEY5zrRWps&$Xy2F|eg4jUAUJ!+6}nlKF?gFNj;M~Tt?tEsZ%
zXXCL8v1yP}fS1{m`GR#x7_Ti2`OO}dBc^&_3IhG~Ckr)cgiYF++SZ=v=!|}fIS<|f
zdC^UzTakvla{_w0T3^Z#z3%<TsUCNtM8jQ3LdfK>ozeIMkl8;^-$$+_m(I2a_m#_q
zLOt@7R`~sIk=^72`vOG^;uoG?YPik!C}tWo3;g49^%l#SlD&~rs=jj<({rUaO%%Qf
za^M*g&;{ls&?_;!FU!qDOsx(5P5MY#k)^u`)2cqVP?1L1%<+1Eug-9y*L<3bo~;Y;
z9HhJ^Q^}^XgwQ!=(kX}75N!4o)#Jv;{fWiF+Y_h%z-avOFHeO`I=RJ~hpi!kin+lY
z2Q_vb<pyTO!z4|?p*?|Oaz*EDhEc1}{>@QSVl%HBt<b1vfl93rXj@#Gpk;O;STn0v
z+(ZKQCQ*PhLH_n}W>?Z38mQg25BW_pFM9hY$hV;LzcI}UF|%7EI{nEgYa2?UB?S#6
zW&34A37!b#veEZ+iEf@b{t`^!HdEVH2C2rmn--)YixvH><l8yT|K;}}Aq)NJwvgOi
zEYbh1<~YD*dx3w?KAK|wO<oo(l?Nvo^}v`_j@b~O{pXPSwCX48ZL>Amk*Y9Vo9_T+
z|9gL&<SPh}ID*(TC=D%p>xM+bh&7Z|288@(v-wK#%V1NeF$*y5>ZpZ^G{T_AQ0f9s
z-&jVUInk>=Q3$GL%3nM=KwPHBGX!qgLEN3MfXzd}CJddWdffW@sj<h@;O<u!e)~T=
z3o`Q*>p~dC#N`(2QdHH&$Va(K`h<OCb^Ff2-F|<m$ln@f1)Ay>cbl_{Rw(5L=?>BS
zZ9OIHqIZso3SSjZxl%_3qwYoYdW6-N+sOjA7ATi?XUGD#*>vkCPN<e;_?p>>6_VyG
zQ$4`qmDzN=xLRN$RB4{Ask{hOFkM!IVytw`1#-BESA%V6zC`WsIWaEu*qs;-z2$UB
z(EbCZR{-XoTy2v@J+TP>+g}9?_yiJ|65pXoZ}$X#J5S)w|7^G&(fboeOh?RERTAma
zhh@7%d)29nOxRG$*HC>0q;(T3Odt>DV917U^3%-Tq*riZ5>vh>LKWy~R=yQh4#Y7<
z9Zx(LH%IesA*s2x#kp*;$8$$EO`9f?EXbxCeaydumbenx=zCxqle4T2X~tsh6{i)m
zr7=LlU>aVc{Qu5?9;k$<ndJrZ^pS1k?KMGR477da+%muaF!8oW_6JrXf(@Nl4TBPz
z_H;?Is_#Bl?`;f|?+@)VP%YyFKm1^L?dju>V}F+>jASAZkl7XTSx$Eff?UE0OF(Zq
zLfLZ@rfvOfD5=(nJjs(af4fv!Ze^$w9$PJ$l1)W#*&-Pr6{#LX(tkQUh0emCF|Em2
zc7&=Zch>R;^^f7q&do>*$O32FhmbC~c^yOuqqt1-utmhaih?-}ig0oo6#4xJh|<NI
zhXOxZD)`Y?40qMeeZXdWfwD%`Oc=aGx<B%@jr>yfqU_KIAAAs=L}<;LHO|?ZGc+Y<
zBw4*7pPk6;Dpg_%D0va4G1ZGaQd2B6p#!P_%V7&OX~clBdI(Psy0I}yjb|5S-p;Ay
zFNE(06;Bh*%z@T+PD}<&Y1D-_rM=eg^J6!)GfAl8CGj$UhIPRQA5H_zK-u})E!<k-
zakEQxkBgDhAiu)Dk6s0Ob9cbdMUkZQ3>R@%x#iXGDz!qZ*&Cb!vMXxU-W9#hRI5BN
zU%@dua}F9^0m?5jaXqt}=wd_^6reFH<VX8a4QDGSO(RjQ%Zlr7B!VU*v}r%HkNTfd
zx2W>*f+enxE<@OHc&CBl+S`%Rm%}7#TB6#L^L!E(%h@+e?fWJcZU96RIy?1J{_k*j
zC;V*-WEQH^_mQ*f{kzs;@RV{GLbDVc1#J6mzTK$hDb4LO5>x!Bu0Rqmv(_P?cWjN<
zoHH?pSws&|As<ax&g>t0gB<#1m=XG;=Fiw7K((*`S*b}Q_35U$+t8r6Vb7^MdLm0H
z69fkIfmERdIWzH20M+*_RAY()kA*d7u-5yNQy2|)HLVtqI6D%qbB&2k_{(lciq;+a
zzH&K9Oq*90Jjw+n^fo3t@Uw5cL)`6tzrR`}1azO#X-Cu3_Sj}2ruf&ZYEJ3&-&^Vs
z+Re~AERR5P*2N@kNqUh5phF(^{(UZN`c!!#G~|rRwk@{Oh742-lTb-$ghiW)nd*c;
zqi5(E>pE2}nVDr?L+~PZ3#=AYC%nD*lb#z<Z7CYO8~*OvGff?UX(sPRxq^_0DRZyY
zzwW$oBVa1h;&?PY+5-LG;N7|iN-O+_g2GaTqFtQnhPNTN+GHK3Q8#smU%gGXKYS(S
zS|39<4xZ}en1wk^Yw`w}(N6qHu9g?=(L!K%jtu=(IvaGe(ufZ*4QzefsF}C{EkCPw
zS@?!-@>Vs5LiEZ@XF&E1B3MWTO{cm-ys3P#RKhTK@nd+C5+-V6U}+aADzql{lSRhO
zj0B*<Psbp0k-qry*O7D9kfYo>Xh2FBJL>#<iEQ$_Z|w#gnoKiH>U2e9iiYTLnVP0x
z6KId#7+u^8yieabek3mHV<KgN=Rsx%Rhsg*VG&a_kg|i7Hr)HG*l^%nB`&ZL7|rxx
zsYQ`HDC!;fa?z}|ORy3?7gUv0S`T53AHy`IXi+~tY|0#U7zTqPHC#j=x;9t-?;!Kp
z$`9RlA7nbJ(C-LQ?-<N!P@Qk~EO&dpE-dBO6q`A$HayCkVuMY{aIlEhr)e5fd_l|(
z?N}TfiMAeg_7jtIBnCYT^3mphV)hWt!U4=#;CnRmFsU`!aa?F+RXH2g$aYz%Nh4vT
zrEC7SzrhRDMLXzunJ8$HeyoaljQbF1b0ldJsfbAEFosgjb2xr>y=FC^p$-J>E`oaq
zc}<eKAoJ4OkQr%*7C>85N*rwPmM(ZwQz@<XAEt-52ln`@iv;d^^-`lY_kHv~*ajho
zUp-v=?G@%aA(ZW<b)owQ5SGPB$_*oWlNiRSpj6d;nLU(C^+TXN8k&))E!olb4ztpT
z*HNu3o&?0A%OuU+jz~57bIMip;GcC1K4@NokG%-0O%hpcX9~`SP)#X%Y>epa#p+mO
zE{dhRlXQoKyd+HeMye-%xsSas7bHi!BkHdqnu9q(>8ToMSZ#n^0Y^>T?YsMxGzFr)
zn~sM1I&Zk;R$4FhE!n#j-UIci(OzW=z;Yrm{kYhqD_LI7gKe0z1zf0gLVNV4Q1?!=
z^3AujWshrSR%+6SPOGk(yPY?l@sX3a(ycpT_HX(zi;>FOYKeFItm{!+TZ$exM4VQ)
z)RZ2*u@j@vTzySw8}Ll$N%zH!EgJySQklMwOv96dN4e0P26-j^y$9*xt+FK}*tyyG
zU?-y{Ux8=@R`^jpSv#p8sO^j%sZe{c3LJp;;2BODn8VOW5}1T>2e!YZlD8sZT#e14
zzuF#lvc~1VsD>89l00srqo#4>oyyKY^?WWl`>zvSzz}`xwaK754Hp{QYE)B-Dv@6G
zBsF)0cj3@j2}v2H8PWVUR$i<3g6^VZYoWBNN=1ntO~pCS2(qJCcejW9{#~MV@mceX
z8hq-lSmSSz$N#8S=mALAG0-w!`{DZ3@tuZzn2FHE^O=2=Pj(HepbOknLVwk3q6Q4I
ze#A7iZLzD!<0j_l%c-`U+n>GFN3vFQ7?C505qLQbQmF)*IEWpQG4wM`Q;IHc7__gm
zzUctzE*GG!aJ}9|RhD|=-zxw!Q*a--wu=5+zm!`eQvLQ-)%bVQECqXa2TWCPczZ`b
zqmBJG`@TjReTy6#t4@RW1G<exp_Y@WT9mUP$W?It)fj{dPK*HQ?+kj8*-53QUSgI+
z)?g$|0mztnsA+Id{N6%U8lg04t}Smf7xU$f2CDjGJ4IF_`WW!sM__MDP)#Yy6dN?K
zm+rtuS$XChq}5`2jbfM8?zn0jdj<=Vue(_4GJ`Icdn-3Px5mGR#!4O8?XMLHOTA>6
zrl6Hegf33}N7bA-i7j&^CPxoWhN|oPd@nd?Sk9xq@27)4+=1Oo^yawm4NzrcXbQl7
zqy{VcSZT#YsJ6DnLRA`38KceWD@3=~JKpaT&t`-&!N-=tszzsTMjFbPmzWCUh~d7G
zJ~ks_C0u!+Qrk=3wca6jK-L6>`qAw!@_JVgJjyL*9%<|he28Qzc=zyuz-m~qU$glF
z!>+$<oAoB5u!d#?=_{Y5AmDC`v^Z~3&V~^F0@0<3U8ukH!eo^=nk}ST%h`VqV`Hd)
zPnu|=1`JYAZS9xytkk6ug(3P~pn>8`pIx6(m3~BqBUCaw6I8iQv}VR(Ty9A_io_p{
z+L+L3y7o2{D}rjBMtQyWVsyy2OCeKKzJ8QjK|E)^o<*p(!uZ&%sLp?Y2ur=SKk%sn
zk<!Hoqeh-rh|xj>Rxh9xYX3N-vsh@m$>5tS0Y=Ao+GY{-u>+;#^Ze#@W;apu6d9Su
z+R$H}fe<lOglcU+TdGSV9#4}#n!C+3oLK7fKrY?16JClJX?3rH-FE3j?!hfG+E9HQ
z)s$SoVB;=Ws*8Wc%mpDYQjff|5_FoV?<41ChyU9kGBi8e@83<+6ddvU>qIM$&4w?A
z&E_CA&?=wN`Xr=02I(gT+4?IAJXq@W%^<DA*d<}E^2BBJ0DX8iyQAn<pHv2jMEcaT
zgIEFVKsC3YtW>2DkEWxd0LoMw;3gV#CqBld`fzM9*2`ep{C&txI0HSsE;~_e$qg{N
zfU3EY$KUXRwEH+6txMj%0WeMFmT9*~s|yu-%P!M}Fv`Q#^s)=9{CnOehqrI;@%t+U
zKm5=&My>09n%os*bdJ2L*60*KCo$30s4L<A)@N<m<$hAAC;?2;BSqA?&;wjw=q^_4
zg`^6zth{CqcmvhomWWGighSJbTC~){p3s{oomE-TDxq$zy69m3{RUWpG;U~m#DCv~
zYD%u)9!3|m)$eRsditCLu}`+V1QEi>->L5_6LH2J!5jx=p|6JJe*c@q-yYl_Sl$*2
zZfZPXxW3s?f!I7NtQ<otH2-Qq53$hmFVz;BP@<k`)G_hIG<u8!Q!u`k*-zP(rZ(!Y
z54{{n&yZ(XddI#P)!>RPB~WO@qvZuMvsszoRWoG@<u7tXAA=RBUOtZy)k8HUcW{8&
z2krHZ|Eb`SiXNzmbB_I#3Yn|2HO&S!yGGFC22HT2&i@8YQ*bcwpLdA1t4}iAgV}`H
zI4g`(E40yquvA2bVGvix|6NQo)8d~w-AlR_a4VefNa*e{O#=d4V>9Ub6RO2MWu-0+
zo=y|ANj%*!-58TQRF5l+0}#c-KMsq!Xi2tKGFylL*Z-lKl1o_4?1Wx=XxnH*!6P@(
zy$-os{{1Y(r&I(Zf5;41uK(MgpF^?~`1jH*1#bb4D_5^HYT9_L(`l=eKT0dq4w6Nf
zMRvZ{MHS#YHa_12e|FNCqCzXOrL?#$=);`oaQYGmR_(eZ^k@5;I_Wd!R8*V$+)`Z{
zI>YtV?EsVCoUA5D6Utv~uM&LhUf8{Y_GDLiL74fU9S2$YBH7)O-3vqX0UKm;z?|kn
z^nNKiaxP%L$}Q5CYt^On-`dfxzoIm^%D?9@QM!0%uisxTnglN~YFMX7U81yd_;OWn
z;{4Tseqm9pOLLi!pZ48uDN$TZ(24|1EjtPH;TCr?yJ`msC8&l*D4!PkvqKRgl&`_H
zx^pa5reV`@QI<M;PcnZ-&`aIE6F#OnWCE<UEUMg$)HEYBRM|Bfd$^2a_JJoMRm&i>
z!XS5|i|B|eZA1C&#%BOiR<6FLrRohi`oG^f<bRtAOYPaMM>8{dxufB3vP<0Ui4*Gm
zy#>z#`h-PZjrMv{3C>dx;Mv$w_Lhc*OaR4s)-k&(hraKDkH*8ct`?Cxh=dXN?8db^
zOLb|`q_)u(OABU5e7)JTs=9zkQ&|g~V*j19q6=j{t!*$_%Ne+)<Q}-)Fn5tQZf#sF
zsW;cAuE}Ss!v`tS_mPXq!h-4*9(Y&for8XVU6sJyzS!5OS)-q~sa+;H{)U=8xd)&-
znB?lRm~dgK0MEm&rN%Ziv}FP8!<>*lzu-tMoL58RLX+ru-)KwixCz(r;y4MT&9s@X
z2ffOL!1Y;EEb^o(BEhLw#()Y;o)&(fk+KEXmfXXY+<s_1PaC<}L#0N}0nW9nYyPp3
z9Ss^ni5@*g&m~LB-#DoG+rxqXS|U2GTxlrueXU*1GRgDT)B1Ec6(W7fqF8$`sVjj-
z^pLJ$Xuic2-O1+P3|L^;aQ0gu4V*8B2BX~;`m^-9=5lkvHTCFRf@*jb-K|unAu~r`
zC$*JbCw1ORA6KDZ8O`WY$M(1{4g?k0bT%<SZOmJunv$FNJHH=N+v+E|vn0pPZm=V!
zLOAjd$jp_aI}?(iC8y>s)!iQ1yW3wbI#4^WpHZV`?mK2*v&`_4x}&?=im+6vz74Pw
zdcH`ow&02pIxkb6uK6&3+nwWY$&P&mctbgC?||OCZ_O$e#M`)*cZa3QG*}Xv&(cl;
z7h5=ud3pyu04f#Q5tSfd3$((t!L{qSs=N)ZDY=TrMIA9zJAL=|=VzLT4u7__cQ)Mj
z9ANIs(T^vqbBS*`ax~y>_h?y#IIJ^jQj4Cpwh7MHAFDMw=_)`ku*faacazNoOT~F6
zK8==Uf|c5Hy31USAYZ71PobOI5jP=C(G}PB4qK{B!$r%n>h-2yYDIherd_~zixQDz
z2A-89(OT0rF0L)PiV9(z#IT9l5Ds+TiCX(?oBQX|Z4ed1ow`~f<&C2U1MYU0z*?Wa
zz-V35>}8vq1m$z}Q5kC`O+lV65n@JI%ICZF0!QsAT6CpPma%wy1e~BX;k*~l>QLb!
zdVo9InylOhxW;#*rOGr|#%go*sM5L<)fRqe-1b^vNI;Qb^Z9ky+hoEBQtxF-nAKl!
zZOL6M6m~_@cx@Cj(jz4=qss`}`{&DdK&OtyVGg&nsED`CLK$rsEcMVX+nWUA6dJYC
ze3g~M+uUlcOY+UcCi`xK-ARpgx@OQ|C79yH;?2zdGAE(zyE9ao`Xrj1e3+${T=WB~
z@%_P4Wg0GX=tP}4d#%!oRs>_t-$tKXaZCVx*JEd+zZ#h8RTb)J<4M|uYD+Eyl(;ZN
zBg|ciavkZSF|Tg}Ok(=JvRD)?z_yEwn$v8QBMlPs!&X|MCLG;fG1<DituvwHSWi<w
zo*}s<y+Ad$ahx8bCu!i^OIL*atSYTH+fqYj<C@>khLH`8h@pdd8tumSto+jRG#a!{
z7<N%mE7*KK7w9wS!fue~Pq@b9HXvP*GI5FKaVNtPnm9v-GhMV^m^wpYJ9RHL?03B&
zt1mTbPTHr=v`0v#dR#yKN=U;Q6zHq|a#M%58?OQ0-ivwqlP78t@YC!b%OP`P9mq-*
zLjA3$mzh&!7PsNrAOG@1BWwl)hVrJ0Uuidf3rk9C%;cPM!O~SDpB@>pKVX=X#Q?gi
zJa;dyF}aNwKz-4%m%hk#QSj({PIc1X_W<UxJVjiz5D<vFZiZn%=qt#9p0a#*I(?~1
zw-PI*hRrHZq6r;Gg$8p0Q&rys3d{eI-D5Omfmo(MBlKqn(Mp)r|EmYC0lq!NT5TFI
z34^_7{;YT8&(IiQBZkwxVt`$37j5hT69;uBrg#yqF}aTa0sBAbaWmZ_uYC6}j`h+n
zGaxfrb~fl5q@k|VlixYk7(VmW=$S!VAZ=lxZ?M;zNK+7CW&CF<P#H|)|9ite&GEOY
zqA0kF!`^77srz`A_yX4gcUh}VgJ#M{p*?w(g<tCa%r2l|<<Px7_EO`1pgwDVC4<Jp
zxW?o<ei{iKfhlt|m%GB+l|3ZdIjTqU)&Gg2pkS;v6o{X9i<52PP(;InTc^EZp^f>K
z+SzS|8KDcG@2-XsoUG7~JV{xDK_5;$gWYG_$-7Mrw4-0k2>snO8VzYJ5#D-a8?;oJ
zhRvgucwISo9es$!*9-E9$E{&ckaqw>;Cly*5!smB$42l7G}q*ny$jM@5Ii;0;g0$|
z130H~xXSRh<CI4oZVHR+%hej)Xr+<COHw9xldo}G6ugbl2MHJ*#ED%~Cp)mD$lB1~
zZBA=p&EJkWf@_4=TB=P$=Gu?y_vIlgKi7VTA9##QRpe{gp^<CFr4hO|0EheC3h)S|
zr0V<1i=%(khP;s_=A+lIgHCG<RvB)Xe)KP=Tf(5Xnx^6sD`^UL)@bgw#MD(FpRc2f
zCA+bqf<VylF!p$4L+?v!gzfGvMu?b7{s*oRUg?5&`IuzHnFhW2qLp7<Q%H7CD#dpU
zsztlc_XCUU=U7}$^f<%J81xNZ5waw`YMrm6(N{CT*+wH-|Bz8LnvH%V8V!l$zi&`!
zny$m;o2Ug)C~Gdb4<Nk!5HNZu9!R2UGKMnRk+l8`yW411h-z>*_YeJHdPcO!TE|bo
zHN&qm#6>n@K*qO5-Fd)@3VzF5>DiE2p__^-``Ll=>!7;m2XM{FjchRt;$hKul<skd
zc9a-IELQw4DxLNHqwB$wTR58x_XI9o6P0E}vifvdp&?dQx4FeyPGE3aR+W{Loiv_k
zL$4ezgT1n*-puZ{Lekk4;J~yyL-qcs<i$LT**B5xu)$oyMrPkXjr;R`E3Z?_)%R!d
z3!U(4+B%p{A+mysJ29tno!EA!=5d$Ikr_oCUW`&_ee%yK(Ah1FIem;;@u%p#Hbjs!
zR;|#3Yo%I8snC@!@=Wd~0~J@}1XW-j7<zaTyW0xLmR}WER^*9LiK&+Ka=pc~A><dv
zV}|-`jqpkB!OnI941+i3x@`J9i!DqI+~CCSwG$WT@vO!*CwBsilnh~UhURjYHjmOq
z;BTVXUmuu^1@ie`Fid{Zu16Fb5z0SQt@sWXnr&Dpg?g+MSkqVSox7d1oT$@e3VC#v
z1O07VPR|tsgIYAgewaSNVr^G07bBbEht{goFlqV{uS+fc^rcjA3J{b>(`S^hKkzi5
zxK2Be?a7^(9)`A~SLiwzQF$dzd^V~bR(Csij#IeDaM$kAny9ux=j+GRgT1+?8dZ;c
zJxxKmNq>8<m9!?YN5VMzstOE&7|2OjRSdkgp%IpW2}NS6#jD81XstR8llx1#U3$Bf
z-%ib;$G8BoIMLhR=0)P-#v_}POOY6ej)OFho0T4gquiwEcGypQF9OeUzW-<MyaVH?
zu|K}HV<&MOCr<BidhfkE)#-_sP(wR<4}qf`gc3rpp{D?$B#?xZb??1%+)?kig9Gk&
zbPkT*i+|oxnVt2HMjA;o>s@{R0%v#UNqRGHBt5;aZ(_(wAw}*sK?jzj8Ga*2rHjle
zw0T>X&r~<Lxp#Ux={W8Kix*SAW%S-*-gD(vbBZ9&4NTS;46+}YSGSB*2=+y#62wgV
ztF1cqT%MnwUj{dcto^IpYI$q2<<;g0_NOq#*73)2dcJa7$20le?y;t(-+f1@o^l7%
zLfPLwTnd<de>pIy4UIs9DVcaRnXS-;@5sUE&;`<o1*KzXPe2j+4%VusF6nq=MZoXI
zOa$vwe2r-<*c*57nG=mHx9-(lT-Dpw!rfVGX$)A+l~5pPmes`s`%}15Vs9v>FF_G^
zNxwGse!?d6-R`kwUf6RD#ZxY1;qH;gyKOw=1z7c@&D^_aAKM`)s6gSig1(@y#udjn
z={4a%61ZoESbtJunt9*B;_~$8)Q$`M;nA8I>r(kz^MY7+{NZdqbE1!-`)E!_9^tyi
zVNg`L&f3EYK+e4R2M({WxRzLd3R`RjTu*X3p5$7-y9g!M?H<!ORI<gw1Gmi&WqqG8
zIeFXk7x>&i{wnIHc1sFzxGiT*COb36Nv8=15*C6NRLX+^iw>A~UKQK?*0(tDhrvEF
zXNf6KhTw`VAM%+KeY`_?h=%JTZGjvR&E5qlO;vCH0V^FSvHldc{Cd94v4~5;5qF)F
z5+C6aaGQSpkvzX>7az*_m%`<!Sx2zc)N4Q8;&^Csu}lG*N`cS!Y`f^IDFnA+C{z2#
z9X9X1TE=+mGpsAF)y$x*DR0Kup9DK3WyM_uU`Y;b$G(xubDhb>mTScbFd42gPvba=
z_>TR)V227@F0nrvW9H$Q+oPlXpJAl<6}P(#a>Bl6O<ZgL){uq!E_K^tNHJXO?mdD2
zncae{e3UCyPgqC_#lfwqjyX%%&;hInEunqUAoO1u?P(3jlYtr~ZNWX8&UOI51!oI(
z$rt#{i8fedb*|yLP><WdU0!MJW_fj1?}0>l5*2VMfX5uPCy8?rcjzTyGEaQ*#n6tm
zF)ftYC*AM1y^!tDptJ6wePoBAtP;&`i>*^Cj4X7_Q^JS#U_E&eZJayZy!&!$w6`2;
z0jtA?1krw)9V<AGW8EOwB@3f0U7e3(S_l=8_<}1Nz2jbRms3;_&9YilHl9rjB5DHe
z=lwW_BQ9|*u7lxV#i0Jjx!r4!_q;8=>hA8LRt;nR9kSl3^Sm<<B&MIrQ^zqt6^Joc
z%6Gb(ML}HyRCZcNdnVv)LgF}>a?qFaIvDuFv8yyg7Mop|l6M3<Wys<%ijWMQ$J)Dm
z*UPE5IAn{-ZnSbu^W(S=3-+imCY5hIQWoPv7$Z1KvodgbxFjE4Qnu6JQoBRS6m%7R
zXwfbo!dfMRc=QHy@=&y`rC4eT<gt*w6Zx!Qs_YaK;x!JD-9URZ5@I-R(*fM5OZi%p
zv{$fKzQ$)yR56QbdaH4<^{*1R5NyuYSfBa>MU_dl)VG)(iBkcWo}qYM**k#ux9GXC
z)a{M~{Jtx&+|P+2RZeg4xosunMo{Tu(D6J+Z}X4{UtK9<p^Ha{I_DqZM6Wgen`2=I
z%8wHy=Y1eAoI*7Xa+jg1)g0|Eof9&lkDf)M-SPrHd!mUK-(&CIe{o&0?IpFeXM?h|
z-423qkneu8tEhm>K<9}l;I3W7b<moLUaz^`bCB;QA$M96@{HwaFS>0ZWZM*AP~tAy
z$8{)bu;?vgr3>FMI@OSfql>nVyOOrx1*xhv$W*JPf6*}{s`OpUbQ0K%e+u@?wVd`u
z4GI11b^R_|<&7}+!~31W-Ri8?U$%$73);CQNaF@vg8^BIC%H>GU!NHm@R{ht2{vim
z{8Y0qJ$`y9BYU}R9O6A-Ph3}?LKoR(DB9LBp1eJJrel5)X0!)425qibyITp}Z<&`8
zghBi}1sKAq5#;$=uw#DV;JR4r<}SNkynySn8{lz!itNZt%Om1jLT1;di*%@Phifn(
z@e`M$h&w0bs;UgU-kk+*cOGPG#W^99-g{s8iQA?D-gpR{f}4LL{nNT7SQV&>zHC0=
zPp3QO72!tD^-N)|-4*7YSYVlz62ujTpN2OmXM2{2mX)-sh@b#$Dzx3joTsi9fgH(t
ziiiuI5DkR4@!LaPA*urIqkN+Q>D&uXa_91{S<x|}`BKLmbi4N;-<}c5#ODPUz_ZP=
zF~FcD`>7w+Ey=Ayl`aU!+e7liM9y=ct(Wd#@n<S+0n}T}d$9oIi<Z-u88O_5aN~z_
zU4Q<Ef?e|!F4fkkp<M<~Cx6Lz@wGrVh^Cfkh2?frs3p*-3b;+T2-<knPvz3q)8QdT
zJK8wI^KqE0D>t<$E)^~t6TjaI?1@XDeo}`(S1D*<{N~}1Wk8~X1aLp3QGPt`K0-eh
zgO?rZem{DA;7^a#49Va*1?cA_(cW3eX;4&<di-x(o&4PluFFq3+-Q{!g{iQL%}<3`
z0=-3$Gqn~3r7cXsrKd9bNw3v5Lc7o~k7v~WFgfB{YN$^;H(X>2^59vVE^JD^Ml$iq
zThek-NdCxov$txxf!l$$+<1p83H=CEhZzoHof`Pl@iT;M;BFM{orgIMiV8Z^^LFz)
zd;>ooN?y|lLV{yN1gXA<TfTsc@TAtn_xr|kjR&G_|5YgDrcD#_i>9<+tOa)Mzt_0k
ze~^lO*u3O@VNyEf&6ARWMVkqWm6nv~g{2rPU0fJa#34%P3D%RR&@T84CUhitj<J-j
zHvIH#&64$;HI&6a8J#=3-+C$hj=!Hd#ko>I#I2!lJ8Qv%gDrlZzkRKZANa-t6W0YV
zE3cE9J(V1|blu?wxBCzB?J3Ya0k?=4U>bfJ&*p75Rw<}ql_|Kvfz5@mr9H@(nn$hF
zaL~LXp#(0&@`7RUc&V7Jo};4O^Q@>-jbdi;qe6O`uM%L}o%9I=Q1F1Ts(c_gF<nRt
zTNxF-LiRK>{dGx${+uOSNoW@cC{b7CcK;!!G~Xh-+%^JIvJ!O85c<b-OS1D(xMev1
zsj=s#=o1AB03O4cNBjA{PnmaRE*OCl>b~DQGw`RAz{(SE$>Q@xJLo4%I4z2Nt`XJO
zd}j1}1b84tiAT8kK{~e^oS81Fjjf6T(=s5844IB1?&=A$wsN%;kOcw1o_NXYZg(Ky
zgZslprC>J{rs#Cm6V%V?mXy`t)nvv>7po^q8vNElFA(IW(9YrdZYT6*1$EL2<fg!%
zPSW;Y4EKv2I+Y3b&|g>b85H?U`uESGI(rYFCCNuE!zc!vUn2+}?4N4<aZzn-W&HaO
zd}D%Wqfc^W-BFs_*(AfCdJJ~E|H6xd@bP*RPq;0`b)|~vkADK@NE-T9Lh>4rFGanI
z`y`<+t6A5ReVqe;8if9p37k!`QC5)5&zuHDI{hb#?Co<otpSgMI-2Kzr8ur{Sl};D
z5ZTOD#Y!$MC!N^EYf#9YAtNnfeCS|))30uKV7TzfOR!58GCZVPkXwwxZ8hUJAHG(?
zsJAAP+0FxbdJy(+Gr|0pUXstZ+Ynnj0b6*RG+els@>&$(3=>-vHjDEx{FPv>tC}L>
z=2=S&1twGeD72leijUIx1_jf1G@j*->?`OuF^LQOzdO9;Km6%Qw>vOA*a}l5rX5fH
zjBZJ82@bb3#{mL({KRNaJ_ULO-l^7~gj`POP7rS!7=(unso{M<?$%_pOH(rM1JPdk
zET=`0&Rc@}`xQQO60fPZS}MlmG+JdfKRa9h<tPrgO&`9<H!3=VaKv3BC?5;c&Ge1E
z<COon-GgDk2G|?-JWc<MZh@{+kjuK7%v)Wd)dTbjywhpxOL->kC3Ghk1%@5;8w2Mu
zJywHw%bTHmooFvT6zy+iR*3HKrXHLISu5URvO#brrCI9QVbL6Ln|Vr<<WCwtmFsO!
z{pg`V`$@AD=;2?w-GT1%0X%@&wkwYaUpC5>YN%t(m3lmyPu>C;^$I+m-h}?l(oR`4
zFpPph12@haoX~HNrK0`x*V}kaiga>Bclo<h_zXI^l76iPsCd?r+!kkfM0vn%dgwe}
zSAn!k!x49ez*D)Y{vTXqnsS-`klP*TCS`DTv+`2<Cv*!6OVRAMoTh+kAfkMy6$AAO
z=r>KL6Z$g;y!kLJ>KnJup<Fe0a)xk6y_MIZh^Kp==sxGotXKnfH|l7z334ru5@Ic@
zXb-qezg@#QFo+I4al{SEDdu2!hX3cr5I&K<-R&N9jdZY_JNpLu2XspcQKgHTe8x%_
zTPLYX22iiSOZ|#D{TcHP&8(r%4TTs^V~qi}a7*BcPmbWVC<=JwchQ~ByODoZ1AV?c
ze25U9ASc3yMbrn}X1ej7AwZ<A!y&h;kU9u4)BL|>abo_cXc4j2!0$h-0j-Z8NdI_l
z36?2nV3a91(z0e-6aw`M=;xGutjB_3AdJGpgMlsF`d#ARV0o)LM+F}X@Ag%k7VT-I
zj=1Puk+7-^O7p6K>*w|3J8=68V1}MOl_KEh`f5KluKCF}l<=vz{qMTngO2kUXnOM8
z$LXKXEhwl$;kF`|?VJ141dML02kI4g$I^abBB@WoVAL>__%bZ%#{mVeRlFspdI(?K
z{2S@!RY1I=yS?dOoEA-iCk1J0p20j2(nrtIepCfqjZA)r(TM5407cwo{E`MS3()@9
z)sJ3A`ru6AN@C$n_DP`K=if;GbZ$unn%<T&sucJ#B+FH_4xnBE!<_P7LZ9Z>TV|dF
zajfCDX98oo^R}u)w6p$a0<THY!9vj;{~K?r+F<Z_pi+s<w9NNAdYb<?Rlo&&vqgZ*
z_=#<UC%J2RAImY?&-hOiG>_N*;G&!cmb=}7PLk9XH2NH#++@6YOOn?L$=&VL=B)?o
z6?lhPe-yIeh<T?%)d-e-bVHzrFS>2Hn<d;^U*$F_IvDk?@UBneG-)9?o?k}gm0*rb
z%CTDSQ2{rAxdNO<W3axJ+nei$z)ZQF$8#qbFyda&)7(Omt%EO50PRg3&+u#xMpr4Q
zqgOcxJj7YVCQ?XYT~GF;6M8k*GV3Im=N1M2Hqe~+wv-=bWQ=(2D_)bLhS?v9?s{$o
z;=ADa1saD0kCX<|YT4;3;0Ex`{i6hUjh}&IaKxR!vBag7(@5{^@k~UuXU`f(_;{B~
z-gUbR9pD<ckT`q?{j<3RS=Bh+GH%}bR&yu8Mg~x?fMI@nBB59Ft?T0jV^Ah)4-Vxm
z;(i%=M!3Un<uxgK_?z&~e~r_k&ajMBC51!6s-z8sIquQ3RKN}7lQ)I<jmHz4xEMv;
z)yr-FiYBD(FRicvkJ#Sbq%ZVxy91?DJP;NU+D$lKVo8-=Sc*}FFP(dfFhYQO1q}PQ
zClc0^b3nYUWSHQNH2gT&O<vEvpuFl^(H?t~&@wm?j_A&B`iA%QxP7MO5nCOYgGow5
z$oNTk8(TMj5+!T8cm<y2+N?A;2xUwS2pq8;siddMF)zE_fiijbWzfphGw2`8Eh$9N
zwuW`{cKb=T1~LNa2s}H3bVA$+X+0ShbR<-xZNU?ULjcRY=w9JtnsAr>=45W8qKF5D
z_y0@0tCqv|gTyJSh+A&Gs{EVqCbn{JK1GP@cswb(q`@RR=K|WyLOW#V7>DeFb)>It
zbGrkj@%>gft69PDU~WM^mMNfFCJN+^6K#xQWCHaHyd$kY3fVyF*<$AP<edgJkDkCB
z{?u{tPAf<SG)icDukZnQn|FobPavC*M#jLGS#IgcD&Pk5^^1LkIFHBEc{qx=>lbxp
z{&qX<oADkkMcKgNdkC*>F;lYL?m;=62~Ss~-a}A#v!tdT9ld2;O&-ENgpmr=E1<70
z<vE3vPhQ->x}NMa+@dMKoEhAUx8f&QDr1U`bHs0Prt;df6J~o*IVM<DE;9ds3b-NY
zmn^_{{7lf-mD{tHv(mmbz~kw#JH)Vc?MV9SdtbZVgTi?altxYH%CmQyi3(jX=Sm%V
zT+~}w1OW94R*a_oLd;51-@+w+7Fk4t<Os8Tf*I$FcUw^plBi*`_%YxuIOVxV^G`~N
zX5h@`RoPX*4MpAsBAmz1M4UafXfV_EuvTO$y^F^adcX3%74d{Gdm~ImsP19du=5z6
z$}K3;D_t;t^O6kv9uRT#0OxNR>J_dbjtcvbY&Fbf*9qFd?eLs%zbz3ZMixB?AA_b`
zUXwcC%kYwJ_4=p+ZfFWF7U4b3bksEs=FuNn^z_%ZrDk|M19zE>+)bwwzCQ09w>wZI
z>4QM4j^~jnz;zrO%NgX&{oFZ8Wt!?hy@ILqeR2w^bK#acVG*tcw-^$pfW8NR31v@(
zaKEiq%OcFA2p@%}3wi6*oLvi?lxowXh&;zt0oRN*qTWuE*JYrPJDfUSd6bp}+Wa3A
z%!f9ExJq3aAt%0m`vGpAc42rXw*adYuoTDFIHY6>0)cu3Y4qQS-A3qLI3b`ZSBuzd
z`1Jv->04&}S-k5$%WYKj(V;>7IP~H*>O7W52l*9J1zb~pK7ODG4{B!2EIiBY*NN&I
z$vEwjIJR?17Iu>G2yvbRSAf>^oy+h{4koJroxH89U=!gx^hf&24$%PAE0{(9jkXsP
zy4S}3t<Ui5Fy1n(9hortZQ-uFkK3qdWbg~Z2ZFocl;;c(aOu`zh?^uT;1a0aYdsWH
zKqV7DOQ;Sn%tqT%7m~;J0n*Fc(2Z_)AV2rOwrnQVy|<zquO=7LWj^T4<{tZq0_qh^
zVK`a-CsOxXrI>`^)W9D{=K#1HHsBTUzRPV?baGhyNL29J6nhcyR63QDBEqtb3b;ga
z1UQg3V7jD%H=W}1+6VnRK+jr??SY-7pGj)vDng$pft|vW_Om>agDFGdmT`9L^PR1d
zUJO9Jf_V(-f47tRw~{^HUSPQPTyRSfbM~niFWz}oqMc2O#E-?b+(tbK9wBt;A0_6G
z8x?RZ*f>Lg3;F3b4{zm;uqqIkt{uDR;_+;v7~Kt|0?StlR~vJT?@Hi8;po*YPvjtS
zuuMS>W2K87HwhZ~hym&q%(MO^qCLrhGr^k>lX}GEfxjL*L9=Hye{Rxj@$UO5w^31x
z_`#^-Q;}(Aej`hEADH8YDuAH^t`+}XDZ+>R48oJ#4D#-9A1y_BQu8++q8Z(zOGrO<
zNtxR{XcJiSYv5TNg)TD7(B^G@aW>mmcPZKMAfR5s6o#bF%Sk<4&azAgIL+|uaHEDl
z-g>_h?!8~}p9_v!&JaEtO&@R@HL;Q9^$>ixy5&EpfNRMY?+WlCjl{_);;vgxI#n^=
z|B+P*9?vYg(LJy$k??C>Qr+%BJKUZMtl#+*{o}YLSfwDJG2HrwrVzR`DuH?hvlz}u
z-9hSMic;?_Fx0j}sfhed+b-UJxrG9wnVsUt<6qoHEw5lm@XM<=Syfg6mxhBA1bC6g
z;*}`oF6?Bs6V@F)M&jt7ME9f;3SkU>S-i@pTwVu;$EMy)-vuqm#hbS^EXO>X*?zXD
z@s1eUuVOwA)SfiIg=J^!S<XZsG$?PiU8)(h+@3T@AZLqrU{Shb(aBojqD@VoFXOgq
zHF%iNNuK04gkDuv0hf+z1h|n#Hym-j<4r!It&~k}{*MzF9!9=1Nmo7l9=AJ?g@0}Z
zGxkNqk_lEGud5WW7M8k#_oRH}(P1I**{KZQAtoSD2&=SUMc}Wun+LM~>CV{^k>J7%
zb+{BQk&wgo$rNs@HZ_`V&9)>b^r~{X_?AT^zrVP`dO)ZMC_S|(boF=b-@14#&fvD-
z9@1uWd@E8BnhL81rSaq@=OC4W#%e~Dg6D>G5H!>g#4_Nq(;3#2iTTNJJ(;PbwK3R(
z`R#fEV^t;Ig&$Kc#K))N$7BPyQHem-s)p{cLoS%(28(itZ&<|AO@Je5Ox4c_wQso+
ztZkKz@p#(a#PT%KAnrT9|GC>8NW*XN<ZWVC=GN<EW@AwxI*|{Z{liIp7^Nhvhua_w
zU%7@fK43enf#p>6^NRz2K7NI${oD3O#5?h;{ANWtgZ?6ZRETSURE$0hVkq4!d_H&x
zl^g#mzFiT^KQ0g@{xNY5j<^eg^PPJ5i?OfnZ6Vnmn&(!K4jfH<IQ*+U9=Q|Py5dIm
z*6Wm`*=>0t<2TP`sG$@!BrO8rb|U>(;z;$S;K^vV_2jLF-v<YRSSntbahwD%=0Els
z_1r3cRDQXF+p1x8X4%J~$P1O&EWTY4Or@y9b!~gD!|Te%Vn$uHJ>DhFPq_zK9!H3K
zt|wh~k=q?;!F%bQfuUE}X*;3>7nWiwsnE>DlLU=#L=guRua>balWrw-GpKjb$X4~s
za7wH5au9D>H7{Ed|FU>DKF#{F3M>99eq8qQ=ht~a#HCy}%MKB7#WyRmnZrM3fNr=B
zhBr0f&;7K&#5T`#nI1<0EG1p__8;8tKy!W>0c=d5JPj3+%q$db8)_N9`n;&2jVxk;
zldfm^3Q4cPS7BrS_E6gpCehSvvmil+9}nWUOCckb?H(qD)Q}tt%70g}tttoX<9;Tg
zT@lT3{Ml}R0n>5B9f((g;iF_lzXX=Yk&#8D(o>!Tue#lXCLCC++1GQ9{g(TDIkhO>
z)-s;Fec}qzVdkhMuHO={5W_H;B<dCTva7Z6VG#)OJvJ)v_q%{C<+%cymoMIrKjBt9
zSNOS1{Lq-|H(jz9U};smo0yhoV4b^wB6oEXnibi+DN547(|-nvxT~hYH~3iem#bKw
zM?pNbxijIaW8QMR2Sc%IBXnqDu>>nBYEZl_WGblO^QG|%&O{_LfjcfqV)zbGuOJh|
z+d7u<Ib@8tU_IGOa&k(Rd?4PF%lOSwG!y$L@naKGP~yUGzWL@C`0vgC`61b?1h6wp
ztMZu@d^$)4Tz0;BT9i-eng;7&255iy|3@3>4p@ig0O_jj2f5vWEy;n|+FN;!0+lwP
za9hMEQ?Oa76oe)Xx+BZ(7x6rh4~`Mj02xLn4yHeh;Xf_iM@AN5dv3E78pnPiesCK5
z8n2PO_?-}+N++fV?g0^(@{O@DXuVAZTsz#lm^2~`B+OflLhdxUt~|@16M7eWR*8|z
z&B|(M-0XG-8u*|Dnze|d!M?m=6mFTy;Wu;7p9GC&q|pW*U|Yhl_tpMVQdeh#C5T$4
zv(fh%F3=0uBqF~}hBJ#g$)NCTkT5)@hVi*+f9OxWyPYtM{q_SNrb|M|0UlqCBCZO!
z_Sn8akXQ8{if6gw`)Pk^KhJyW5p9&pm=a5ZIE%E$wdpapJ5Xm66knKr7DsDy%Fy(-
zhA}t!>D65Y4Q0duvkVrotS1xo3bLwMo>h=r4QJg31Di&fU7y8N3C{csf8w+PAz^%)
z0(65GzWb}`$NrOPYE|qEu&P{7=e}7DhQ#LV|Hx=n6!5vQ^5lbY#9a#>EeVO|z~E8O
zTDKvP=SY*>#MCd{?m@^g(4t*d+P@^~aAB!z#==rQ6>iOd>&c02tv`w(Z^1(`38o?1
zV^F&t02Y)-38=n#v4jQXT$Xneg#{gD1gBx}#|KUzf9@gk0{S!Hvxd@x;ZY(u#|^cH
zt)St}38L~^7o?+*o6$*oL-rNn?4L4L)${<4q>}Fc$r9?PvGRrw*phg){Q%fNC%;zu
ze7V)=C=lz(+wDYY!>FbcnBT7M!tfoUUV$$Qq>$G!dGsTO3&6UlYX!XRT0C!U@%vr;
zb}4jDlQ2f_gO$JWuUmfdVpF>=hnbmlE^J&?Rsq*OJ2ne)ti;i4P{^G*(&Jg>L)Ccv
z5tmWw#=zCb6Rw)R)#d*C&sJD2^Z3g++E`eMx~iNp-flTj(D+3lBY-=u>BaITqFw=7
zPiD#=zr|3l6iG^x^`z-|Sb{?n%g!j6=_*6aTdM<>L=pFXyv)q5c%WlITPqD#ngxXc
z3d6tNU-<I#)uLQ08LumQCwX@G2S%T^)i54$F>nFts#70wwfjZ_E2iJg(Z1{&ym_0;
zxEOG&N^mh{40J{&F`nCq-3{iq4NT{wA2H6aL5)eTh+Tjz84fMLE`<T}T~_-n@_4$@
zeezgSyY2zc9NJ_A5OEu{y_7JnJ=7ZL%d+G~V#o><aUaUd3LGZ?UM}m#WFVu62Npkc
ztK;5>lka4Xruj0naThUecOQ6MiSU^N^9t6oypj<03VfM$ESV+<!v$i;ffICn1T;{B
z=6ut)4B`$7I;6}9PM+{4<tNWFvuo%s@Ytc9<APP?8vom-3b=gy<pNQOi4*5*50q06
zHr5qs5jM9R&EBec)|K~=6mU8|{BKvf?O|~F4l8zWw5$l1O)h6VLv?PNph1gBVCMWp
zmi1(^UO~2<^<>|rhAV(scSfp!2KJS)Rw=5|x*~w<Bn;H|Z_s|yT=1ap17OlhyN?Ur
zH*0(<;PO*qHYlvL*JQqZXk>hb!=+5M@Qm!dfppc$%boAC0$2z4BJwJv1(m3CO7j`N
zxlYuOMIybSm=#-Q5>c<f2j1}O+2ZZFhF4j5C|JnQy&%D-KN~H=GKG;9G8UET*=KqL
zy+0^`(MapkaPH(&`UL{`Bg@GN60z$ujzx1exFd<H1GAP-GH_8#;a#0|&hF#?`Xjt<
z{2w@4lv#i}rlH*W(}5g%K+tGKCP^@1o~Z_ZELpu7JZ)&};Xw>3NHG(ESu7$7X2gFZ
z!K;4~V3?vM=eRo~yw^114t+v%YT882EWE1hYI`CD0m>zS!4)Wup#6bL9C8bIvZrQ~
zuKI+GB{mbjhGmn7@yHZp<8WJBY5i#f_p6h)B;d&#?+BJJQRx*h>PcK>xWZ^)RXS4^
zmkE1ixb-vvhABeuv5e88$9%)EA9w)K*5HN0Dm7Vuceg>2!54c6i*c{zx%iYzV+Gil
z%qc{FsHtFjWEnWRc?{vQJvM&iP*44F4Y=ZFp3U1#l)~Lu$XbnSfv}1t5lP=Qc23?1
z*DLV(&N0?+23D<3F)@IJ8ShGP>!a#5P7)m?j1~jmm|M00ZfH?@bS7Mot8lkLk-~Rx
z3URMZIHA)&HgFLx6L00#Fg>)4JiniG;Y3GzsXhrV(eS7g_^Pl>0c*HjsbmU>bOzFQ
z-T_SC60cX_yV4kMR{^sGNQisd%2=a(U6pi{#!Lz0#ejLmsg&#Lm{yfD!5r7R<c5L{
z0jF|-_<A-Dxo9i56i?}jcr*>pBW*UHSSq`N{tl0sj60p94Y_#2U(Kqhw2gm&BAO&9
zr9s?&XhAx$&u!@y824{IZRcrbEf-QaQHp0jCc-jBNO~1X88TY(%q{D_g>8-tYEJz%
zT&n7}ezyOC)3;)`fRV|?Q`*J~n4VmWsy#N8act#oI)-%lO(yCYg4hJ}IM>*>-{&j9
zr;{rfv&imRt&ZLj>9`mk2V(lx3B*pfrB@Jq02ic9uMl$N{X7|-y;X!|3KLTPDPzoN
z`F^9hW$mwI+s6e;2JgGsoXFzacllnz<M7aAm*92fy4--l^21m?z`&thq|N4zCGz^_
ztW<D~p1Ypsu)hxXLN;T(?V$=wSpe5<r!Xzto^+TzUSO~oE4QQ>E&&zig=k`){Jjj{
zX3FSRFe78ks5y^dSn?LIOiWn-1Kbbq{^n|XB8(Th6UN61!`NT}gT{K0-<gZc7*_EJ
z_oa3tSP=X2=Tf@m<r}r1Z=1S{!}3gg^0vl&VLdyyv1OT%=eG+=YKvIn;py9DbC|xi
zoH$^%^a^~349hSHP_<~Oh*mC@;oIL3=0FM&xLSfXvm?Q>9@l}@Hd^1-R+YbVvpEq*
z-gUP9YMya$N^!`oLF>xp=r6R}2BEn7IFb=w33Gtjo8XUM$YHjx1Rt3qQ~}9te#Tb@
zKj6<>V|z@ZgxDD%tj%Z3Dm#WaV7BxMd_Kcj+xXeQusNiY<kX0F?PkhESf(J*_C6^C
zM+vc(Xfjw;rp{*dD;cPOE0#Z>Z_}@?3m%+YJjtyA5jGP?+#1TFVj;Qvbb=KV&l24s
zQ~QBmKAuOWpa8#qR1oI(HFYglFz+9#a!9R!x&TYr;_b;ti9=>bufXS9V7LU_S6(Qj
zw#?I_JzIn6$g;u?=ent}LoVLkev9_Vsit1VX^yxqHYPGz$)swA2$AlYtLG~h!{=6j
z*g8k;skOv&gVh30oB#Cw5bZZRcC~M9^JGci(l-B4Ha^1~@W*|R+Zl_fBBuQU5Y|?*
zeQhOi$n5DA95U8!Y-`6b6XNd@=hZs@Bds_p1hHAh&{6UyvS~vPf@uKl(>S}P@xLy%
zCNlZ*0=AQke%gjqg)P-fPZfcgT^^q0R`I9^tsrH3^r{!t6OThx$$s~9*qT*@UOegv
zWs~uFp}-`Db4M}{MAR`7M70$Y*_Lg|+2;223Vg;i`V^p{HP^Jj9t*dK@@WGni!e=L
z#W7L_j}EeBi6?_+PBpEI=hVIIVq+qe7qeMiYFp^x$;`*K9c!z=pYqWksyRwe`5q=|
z8VnXAX;8NuKErQ#fWy*qd<wb1d^I^oFNe__mtn*`X)^05L?N(Dv6r!o(<$UZv!z!M
zl%L#TnVpSgGlY0_FjXSd0u`2Y{zc00QDJ4<arJEbxW1Qucds##%MrG1r#9x}qeqfj
zxNd=k`x*;4)|DTMC!I|F1NXkk&p&`)irHY_#^xD4Zat}NGG1s0XlYf?U%)g1(Mc>6
zo6le?<J8Au)NJV$99>~FO`t%Kr;QXHN~Kxg6bsxtzG`J!+$kk&tIApba;+^9&1q>2
z4s{n{fbuK#NCM|>c+%I%Q+n#y=_Hd5a<%@)15?4zOy;R{k&9&tstNJ704w9x!LG{j
zJ!~pwsnF>S!|imoV!#v0qh?R9z-LUK?+goH3DE`UktgV;HnLBIZ3-F=OBp~KEKTch
z3V7eIqIL9=uU%_QMDy|99@PFs3b=v$lMNtAH>(iM>FQWZE(P*D>3Czz#!8OHZva2i
zck{FM&GS{D&D(}T^M`k_zRz8l3%jank2-lv!N7GOsP$v}+N{0AQM0F4;4_xCNCxZ4
z-myX&DyO8&9YSnV(9qtsMP+N-;*NtWkhHG;satJ{biSqbr?$Px&oDixAV~v!XsChu
z&8j7bo+BC6uA|+C-wTsBcOS5CTfky^zWGaqUV^K!O#77fpBE^Z0t$LSv4Y-gUmJ9Y
zIBJ!)^a^}F;~orr6__NZAg9Qi8uNG?A+{;#a4Xk{#<r8SRb}dwg|}R4N)+(SB3gf%
zW|B6AsK#f6s^Ky+&Q~tySy#So9AW!zT&ay?+HaMjZ(q-0S6&%zZ_C<Ih-`g}7pWKK
zHy(b}>s?0M?a@mz47c-!uzhbNao959urcZt_?{eRunopr;+_XJqoq`I{P9vD#wjRS
zC1VgNps_9S6m3_lhBo55)Rd^;ChOsXtR@P1`||Y6pmOjReKEC+a9+j|Vx^8#Z)I)p
z+f%?dm!8F8lOAp>3Hn!McrUxI7(L*#cOBRKq+Y`~Yl}WoY_8ePCTlCgw?J0Cf<uOc
z^3Kq<ab`v^G3g&N?(3#Ag&3!xrTw!~hS3r#;}TBL+@AK>xpZl^DCXC9(`a3)ZI9<j
zqm+#g1U1%yNnd6*`a?aTB7`NoNb|w?)W0ybcOoeJk+h3vH94E6zDJ2(7bKv%RF63V
zpVg5|926@U&v?jnG|@$URV~JY4nqxcyS9a<t)v|@5w<B<5Ll2${5YSZy=qbxR?C*M
z=AwZ7GM@U7<MyYC166@f<u>MkXIefAP4zh(*;Bq$l7+9lN88d@wu5hUO69O6GY98N
z)tEoHbM#EI8dT}x$aa661&?czNJG?vH31mcY`c@So>1*kM!f>xGsgOe@MQ1|F>RG|
zPk%B-jCBfnu97p9WbUIhZt~`GhE?Sk-DpY_aftd<?&Oomk2HJ&rm-5lOcmgYh82XW
z{+8TIIv6tLCc0+sho3+0Mh;5?G#bn+M(32^WT{GB$^oQCkI)|1s_2C|SQCIT?Pq{R
z!7wm#4W*3v$<IzTT%|uSZi1M$o+Ral{zQmepn{Flq>LpQ+R`R*lh0vz+02X7MCFxk
z8vyz14r;F&dM;_CvUEuURC+2GZ{^l-Y~?<5Bgv?#ms_{-e^Wby4_{^93ZD;40XGsh
zZ+-eqzY<S^FC7Yv1rKcM4v#vfK}~=(MooZ(o#df|FN4hLk*S8O^jib=1ca<7dp3L}
z<$iuuh;a%=<kaURLSIX4?&($Z+bQol-x4R7;_>YJz-=QSv#3wyZrMW|t9<<=3_PA%
zjki2=cnT~NGpg^ksP*zSoTjAA;IJS|-;^dCYRksc`~We7Cv{Uhuk}B%S5x09(M9Zd
z5N=nmu>P!pWb)X-qiYSUDf7<_G+ZSGST|QpW2eZump>L`oq~~da`d_hRCc1bZrY{V
zY=N$Tctq;Z|Jg4h5MSiB8ITXCH_Q^x+f5p)LcHkO*a+sdS>-6?))sMW<u0E@vg(nS
z2#tFrL;Fn6<>Vw*GC4?uufE(o`JkW}H@+Op6g+ue;3o7~ttMdi(9MW)2EbyD%Q`cD
zao|Jb!2@~a4F%*+wcu&vdU9X5fjiX13N|*#xsz+y3UeuhF;~ujnsXk5adDF_1kYfa
zSx>FgEpdRi!Cl*Hd6?vcy`4`zc0<UcrB{2buL1!!7v~UB>sEx|$s5`ej2dA&$=$si
zd?Myvj*I)M@Io<RmQ<jhj?&NP&K+(rG)a@0S)m?_Eg1q&->zeLbJw`RBHmV7j$CMr
zdQSb<0`mlk0!YeDQ73R+W2l@FHRHFlnXH?00(d&nOnM@4iu(fYh=sqpZ3|=<_0H5x
zazbc;rU8twMffkJJo(DEkt`hfV<<O4HQeL3a9lSNZ{9W#Hg7X=s~hwei>q7Mx!6v{
z!YClN7c8F4I{S~^P98n<y2rYId)Syv-UXT`X5?bF%DIUPg;=MsLod=Yn|SgV&6|0N
z_86lnYg*@MLmVNXBmQu}ZDSy}ZJ-{!ONh0nvMcdauL3UPRniFAS#s$dl2O}QR7rXN
z0I1_QeyROy28a&UkW>nE8HXDDQgK@-nF8?O7E>26a_Eu)r?&&GKWiZAO7iHzcw5i9
zp8TXSmmIwgh*?keTp{NcJ|f0Cg)K(CA!k%WLtQ8k5<Bq{?Xg^AeIB<U;u4iN8M@-+
zLvGsx`0W{DKntWZxin&aQDacZ%`QZ<T-HiI1~!v2R@&`0w&&yp;O|q(Cy2@9R3O7i
zo*J-qjl~T1F9><yc9{0$7NRs0Idom_wYgw>9eMcB;skS&{CLAv2H4Y5FylT+cW|;8
z^Az?-lr*d%VYV)ICa5_@Ax-&?lMQi#px5{W+okvg^TXG)qZi+vJY@Q*+y<m+fd4>S
zWh@j#O@sKretZ(D6nLJqSOF(ehgZWh%~!(%le6)sCYq=eB&nl8Em#ZV*%;=c`wx?c
z554#?9>4YZjQhyl?P)2Pai^qBva{5>iM#NKm@$%I!@M~c(kdCar|~O=OImbAw^GNm
z%0u(=B2sRWf%#-jgKC^-RG$ZO<BIUQaw&(V!M<^%_xL%bKWpuH5w5Ov_@n(R1)RJk
zZQkbSvs-=5d0V=viC~I5i?*91pZ1I3^p=>39*PW$@q_Eh)y(V3#`2rpfO+c~wG_-q
zIU?oO{q1@&<|%B`cCVC?4Z#xxT^DmET}rED;8Z&t;hz&j^u>CL`VEe-r)8p#8OIUF
zEW21Qxl{)JgiB8mOGj97EwMQJxy^0(coUq9oNTefN2CbL6qK2(0%exry2(|zQP+}A
z+ICL&KfTktP<L~LGk!j-m&m+7`Ui^vEVk)uM!f>h0Jy)LDyYGd6w80IzOq6xr^y-G
z798nd%e=U0r-Lbw<t@<QP(vJ{SIEwY85Ab36+c~0JASb}$&*}ME26QnPMc(8W~1Y*
z4Rv(2v_nHw5gN3!32wDb+<C<QHL~z(avedYpi-A9$i`>f?jhd}^MyXXTRU^$^mab;
za`M?n$s-6~_}Jg=jCEjouNAtU?0H?%eVZ!CJ_QH&{4Qy94SZ$WzPXf22Bkkb(GF*L
z&9pb_-*($J$oRgr0~kxJgW)T#!SN^$jB!>Cj$=Hfr$&c<YYC(W$Itt+@IrAt!8Z$V
z>l*MJ_}T4AR+fPWIAis~$fVOG&>72_D*&f@$s>pcu$26<mIUb)!1_|_28(HM=Uh3r
z>}P@sU@7>xQO@uhxz@gYv`Pjw5fgEb5VpGq-}Hss<^f)~j&=b1pG3|{D%FKyOF)Fx
z>tOIm8tgu<Bhjw5$64gl5GlbqUxe-Ee7(4`zUF+=0_#2-r#-@1<z6F^p>TS;ggL)<
zfyD@-L^ft03$0h+6%=pV$T|f0h#316ylj#*zyX}gVIH-T!I$#e;S47c`(vEj<{|2-
zhj8#R;=pC;)%;-*;#^z-v4$t)K0q?+;`=y$S)Z4e63#Hy;M2y{`lr^@^jLyQRMzOS
z5N7|TFmFlCC5zwsa^c{ZZ@!z6YPe26xSnjiph8DGNw@2#tml^%l34tmq#;Ipu$9li
zxu?-78AQeu_xDGw`eSprNE%#1e<t#F;>hW{p^as5eYO?{E1q@bbIcNt#&G<oFAFae
z*O`APQx~GI#~*u|_zn=jK<y!(M%}-WNjo@sT+3eQa+uW^+Feh6Zh+xBa6NgwsBqR*
z(!KhrAo~>jY?K>u4{#eusbml?h5q^YfuchmsdC#&$ob=~jRl-{Cwc7j!VpDZi580i
zG!`+RkqlsYsCC&9%Q=2A8`q(%EjRy^-k^qZG`-z-9`!V+3rJLEEz%!RBn^hizZ0nw
z1`xxn1{kg<S2D+2sd@#?FM@xQbf>C1Dq+MzNrSBMBzY%|21+G^?003h!zq^0^vD27
zmCc!XgE}*_*JSdOOg|7*2Le<Mu9%3#b8YeX@D`@rV4;mlqzb<X<eR?;<l`OQ#$tVo
zcQk{~ch;Wc%c##hM;>vDZEueD-a#J2%qp<@P{Cff+o)GCKyZF?H(BxaSysIVg-m{u
zG|WxE{3ymiN+p9&WVORN%*!DdY5QZCXd1lUmRi$b3Hg*py<Uz9j<YUi$Fr4tG(OP6
z*!aC1zm<tAB9pXJv#{L_cnbAA)#j}ZD6JH=&&im1Fx;*mVg2DC+E|Su9Gn{F;g_mc
z;PE8Lx=H^m$Uub{hRG_byvw9|9W#_l29lcL9RHd?-6fYCblX_SpQuef<|^Xo<>=W{
zWuWv=DUNT&%(ZR<I9ETxIr}t@-^s%jpsUJEKa^R3n^CJ5mb!+?-Tg#$-c;Na7;k4Y
zf3@@MXUL<7+>CwQM6O<eXSB3Ke}W8Dh+?9w(ujuy8Az#Q;H>_Ucs^&^YPr>Ib0N>1
zL2Gf$f?G+$rwikvIc;Vk)^)GoD1>pvap3x6H{1UWpD!P!LDd$TFSY3J2#tmK_3+*W
z@ofI?K}UneS${AB88Z{avc&_~3)J0YF^XBxqin1vOVumzc&?XqgKidOp+Xe0ikmc5
z2r`gT$)J@-T+50G2I4yYpW6llex{Z*@FYA-96w!I7S%e*#Ot#ZA{M3`dCtGhmdvA4
z;A_xj3d}#GZ$&riF9?Zt3W@gyySO&K+3Fbyv!%Q?>cLtHKQ-8$-^$f1Xnq@%b<E-_
z>P;VoV@Q*feVi?bm_w&z(5h7oUa;<kAcllX>8UE}1l-hZ2Z<wy>tHm(;*NRvFI60p
z2EN_n9^m+PUIj9u+I(?4ClA|RjW=%(XE2W{U~-gBal683yJ{YDpokrJGkF*@^T2v?
zE&KFVu3mx1Gh5cJd5<Uy6$0sWRMvP4dtyx5Orc~@??|aiITZA;?u1}wT<W&fkb?WD
zZC-RL@tIhR_dsjlPAQd0fK>3rwVb31r0+rN2Zqj~O@nJe4=n|Dk-aM9t(K1CVdn4p
zp6p*f*J>Q$YZHYUN-&c33OwGgWZjvfEK~@kldSUp?~Af9ZYqtELF+w@`?nNZ-7@Gp
zw+)B9L)7RAq|NEXA<WV>4eG!|F;hR)$||HLf_yAMP)V2>)#;Tku$aNlp6r{qm{r;%
zJ)}r|<gyaZZ~G^*f7fz{9<G%%*eIqVSFgY`TUxwT1wzA=CuEKId-Mf~ETB>{sFHTb
zNiJ{L@0VBIwjI&(%&QsOA16NE0=7coWJIr%n8Q<h$_6<6*Avc><mk${HMoxB9vhRi
zK%y>DIUXqkEvEM*Oe%5Vq?t@Oza`WMGvUy7sd@z-&sbS^<d>^NnWzxWow5eKE>)C?
zlQ)-HuLw2#BC8=%;V2H*=BC%&wjS`wb<{<HhMq)x#FgMZ)5a1I!18bqu5vQsW|p9Z
z;(Ef#q=58lea-nKmP!|)0B2){asEo{VdM-LZ<&SWn;{qM_F<Q*FJ(`64?06FSg*k2
z$&fZlI4H_Qg>d3-kTvT65N0BklEL?~+98v>?PRiI22XR_e#qbRscjxXe8y$w;&t3Q
zIJ4ACPgN4XDw1+sSgOGMEib!9uLX^#w<qx*&jf`PNLuv~#Y7m#mZsRqPEJ2yF_P$g
zji5GRMv%T!-!+2QlRf)n-HtyC%jr^xXTuM&#{Fx1+mj)nQZi_Ti^}{Jr*8_A(o@gS
z?;xD{1o1hiOB$f#*A+Mj7dSG@#aYMo<{>^aThEo!(+i%sgnK}n8LK_mr-=Beu&3Qf
zl$~tj%bh1#4JE8u(qJQ9YMt>~qV)<qG3Uv;7e5naqCyJi{3dJU8-%@SO}li5HpwB~
zIE7&%8cWY^0X=iGEG11=&Zkezy@vRx%hx3hN(#ZB%29M9l~xo)E-oxpO;}OE8Ptt+
z<>+G%ohM*Co9Uy?rP87xQ8{HW47V#L+DJ1Sz0Ybai><c>%-CSO7SbyaH+Q^P){Xc&
z@1BN2GU>90zUf#|CdN(jUadu3(iEpyw&b8-Znv?9){>6P-*menfRFQOLqyVK@+3DO
zhqHz%@QRg#roDAMk_I$X;pud~`L18FE>n<?7b_=oPJZsrzYP8tIFl+Y>o9CdN{3<0
zYiBKN$Zm_FEP$g_XyYv{&3G-*dIcWOEz<5or8yt=tdchPqUv9GJafF)Y7brFZ6a;1
zE`z<o`sSx_Nf=9@eue0Nh^T2$*+SAF5C4U9NQW0aX^Su^%ETYiPu?CqG}5}!1medu
zci&T}=EHis6_;8QG3YE%2D1=fGjW#n!*bvl**L^~bcNwsvB*$i^&Dd^k#-OMTa=9o
zX-t+^xoDm+BWHSV^FMQmN(OmfN^6L4_6h45k7rr9NE$pzzov0A`I%RVXPQ;;5U#$8
zTgd(hrJ?|*L|2+WrL(aRePcC_w>O-{H-O_ntu$1gDk%z%2KAi_!`KWv%e38Zw;D{8
zY-dMu>Nvx-I<JQDR+L_W$8)Z<JFrBUjS6|pkQS&uSR~5En2Fvk{u_v>WKi<8tcHl@
zc2WHTIQap$8w7dgIBR183oar)^z!sWHx=N}O(9kYsNhi%GQA+4-c}JJdIc^ySzn0u
zHy&AFqh3QG&%mnY6*1ud+f0l2qd`a*$UDZ)w>RHrF__sE^|t4?zQu-XB`<@P3Y*`0
zwn@AFj&>Dhq(UM|(mdb?VcQ<DGrd=7`+CG1O<F_5va5}CgPCZv-|Z$rews>ca(nV~
z4<86ZbJ|S2nA^akX%Lz$U8TT$&AM1$>dw_a)s}DQ9@O6wksib_?Fm1N?{~wPesE9J
zySz<|jjvy8IhqX|+Ydo=1Sk(AaR2ryc}ELw5@w`ADl??HK$E!h4RgJ>Y732(gw(0*
zRx!urKMxdwviIC>7U1)Rw6EE*+x8G2eHHjTY-1i+*uY|Wb$KGUa#4Bv=6P$i`3g#a
zkYF{Q1aIT?@3d<I`wrD0pRYaRQ~7>6T<HuoWxeUPcAUnYZ8e-Z&`a!O*ljZ|(Ii88
zpy@(dt}#*Gt@oHXD-}}dRV>X3J{Bi7Hp#mcytoo>n37hok9)VU9x<>WTr>@Q)Fw|{
zLwx#W>FL1L;4Q157_Tdr62HoVUg4_5ylQiH8Ll%~p%<1~!#8Bp?=$LdWWm3KV<>Y)
zuY-gI-BzIKZ5KOV&#)ZM9QdAAZu!ZUoNK&TXSkj$Qod=gwEIrYZ(9#3|CHti{~KX_
zc{<{zdau-OrCP!*lOOiE%J*}wL7KC|?WRHAp+B3@^Fq?|FEc>W0M1vk@m6k~psm~z
zv`}0{$PcK&SzL`(cyfIOXWis?{u|VB-yIMC1w7}aIf{#<!yF`Umv(l(zV?vSaMr>X
zBO7A#zD>r`Z*f3M!aH7|xNNnwyY8lld_Rj=-jL=9O?*ct0-3wa`?T?y7lN<CyXchE
zN~h2L-R<T<=1?b}Zh3_G3@p&sl?!2tI*xrg>=kl@$wtRVa52eH<lrc;iy1t%oo}ex
zj{i%`Zo3gaG!r5-Q8{iBN|u^v>-+sI#}h4zklx8nxxsj~4qoBw$w|@*IyQZCvN$sp
z@);t{6Po@fZdJMceD9;$>nrKL32P;T2ZZ%SNIK@Z-9X5@GiXijw2@Xtr~%ArvrEzH
zZfyzYR&EIj=MAOi2hIwxDo|r7UUPoNPO<#}&bu#Uw?Rd?xLMkxURWi;@L(v4w=?aP
zLz?`o<#<*ab|Bce(0H{JSeRpifR-bq$+I;zogvUng?!qEegFu8UZ>oW_REfa$bUx>
zrXxOIxxA)u(m0JvuYiIc;Ua19pBJcY?nkbQn~S${(fl$8pN6fmvr~uBXU~N4_62zJ
zHsF-WY`$1H{sog7<}bky4Ah?WX<QcxH-^IuB<~!1H^JRcS&b(u3tDSu>Ei<93Vyrg
zz}T?@*OM#d-EIr4udWC$4$Jd~4c1quW|j9T?H!ghw<!zLIqru7`@x*mAN+1@iW59Q
zU7v6Px!R*ok9lyTwFs{(+fZHuWa9*^I`i@f0lUcc)%dU1@C{JsKIVOfwC87PPkS2@
zv0+L=JG7c?Qwb@_vbdBFu0+(^61gz0C%0K5em%MU5qY<oT2F3;JTA{4&J<^5!UFFu
z%cO{gcjdLkKE<-9w+M-=6>OYFZSr|Hke-G)<$B14Il|?*21St#^|j`SEBbmhVUk>=
zZ{C*U$N0^hG6m<?5PGZ*erOO_dv(fVWRtWA2C%ggZ54ctTYit_fWmlNXGh}VR^ynq
zoej;METr|I36IIU&;BLwy+Gj<ZSI!l5Wid@&dkKc8y?Uelx3tlC`3kz%lx#$xq|d7
zj=J4iz>j&;Xie_CmH0%=!!kao+G92@jX^B<8Jg@Wybny6A?wOT0c*~aIm`KwciF!{
z<uQ9|5B!dN*9sTrEQSGWa5w7@hvG)d5iM+JF;ev0+ueA%1<>5Fb_#QtP$=&<`<XML
zK;aG>B_63cQJ|gcy<Tm4Lp+N4N|>Dw`bA&|(C|~3XyyJwe_G+t5#m#^S`UBlFSznk
zJzMfrCYG~pFkgPm#LBph4Y<(75$YF+&?KB?)nC`bXFRN#FK`FZHDc$(__f~N5y6;s
z)<c>LhsyjUHGxAx*Mmoe*Hf2GvnEbnsRPF!EecUwE^+fuV8o3}^Lh^jtS*}Hp}fX0
z^Zh}Q$&OSU^SRrN1~eQ?t#-QbO5%W4;v}a!C`PX@`Ia&~X>rzZrMUxT7wB~y^-3#O
zuCQ(dff2`2^w%i=CliqbtGEn*x9EXnZ@sf^{=y2&5zR##1mq`z33nRb3ER#A=FaDD
zJEpzN^<;ZztQ29uN%GvHN#Lq-hcxf02mJRJaaB3<9f_@B#Em1BD=u=o)sO?%Qrqk$
zJ{fcL>WWox=d}>0Fw;J3i*R8nlK1G-X}yl)7S2@AUR3)W{&G`o(!7xpaQm)-Em=Ik
zp5oxF&6Y!&16M3cZ7E6J(ZhJbdBEPewkmU&ATc9VN#M3-HpugfUj$}O#l?G%E45rz
z&ddpuW#!wF#WkIQm}H6TSS<Yd)nH1KV-xQtJ{&XkkPA=cX5xHh!t!tc4QS>{T86F&
zP~^oQOQfEuhvtQE=z8m~o;j$xzt`K^%LlDRXMyO|l8p?u&Q3;K3-*qP9SBNHgXN`G
zh!iB2cpj+fLy<2A3a8m2(KSS#4oX?!&7_#u{MY2Xqm$I_7T9h^%3gQ7^^k?MA=i_%
z?HSUDmgsZOJdiAvU5&zHt(B%h7XC6R(Ms36ZNMjQpWS9N-3Ky<e!1bZ3sAJ3*PrW}
zuG4)MY)HmDo4wcPY4U&ujw!Jkjv0>|OQOY$h88ar(0t4d^6smqKZ`U};W&$B>g`-6
z(9rH{PQKMY$t@!<Bh~yYu{~5Ac4vAE8FuN9Zg&9S1^V(Q)5*`sVm)e>fdH#VNb*Cs
zOkaOCKRc4IYu)Qhl*i8D8;0Y*XXvU-_|O+u6V)BYp%;gV)Nfls^xaN&g=RA0m{!@^
zzTG?4c)^L#;yEJgSof`$c2_kOa@O-!xXl20&e8PaMFI_N@AaM*u(W7KVS~g5Q838W
zc-zdt6W#3q%saQzn%r|aaY(atC4oAS(3Fkypa?}Q=!#|3;S;|#`lm8DlZD@5dX4?=
zN^N@ELExDb7wD6Y;_Vc>tFsS3N%R9h6>v~%ZB@JQ1x>uCLW`Gh?j9I<U)CMf)bvJ*
zNJABFFzyq1{?T-dKtnsO@}8<~<XWA)`#@rY$b9)~dw~tM%ayOX)&WK?7;9}T<Tm1n
zX4m3P)-t#@T&rsug#3zL4w6vVK2tw=TZdPtci+#~{VAoa{q%s>yS#NrTU`0yyK0He
zUx*z@tc3!`3l`e0vn5vGd$OPLierGuEA5&bl0Gs|OB}Mkz9QUN@~K1*5jn^0vC4aq
zRu91{Iq{z|-ysMD$yvL{wsLnmAei5_jHfku<DJAIEz%c$OThAQ4i+LPX&G{}OK_o!
zQuBS@Vm;oLqPMsM8~a%sOJa+S4Apg`TX)5a_>pLOyRy6Wr$cj+#Z4XH1a-D*jrleP
z>D<C4@N`>3y=Dxm6Mq|F9u#S*!Yy8t=psLg+{aD!de71xu~vsL^D87a$&7=XMG{2P
z=Wi}_Kq%g!jwIcNlE+k65vqsDQ>gesV{NduMHQ}ek!zkTm8WYN6zflLyW5YDlV7mY
zOE2<W)NQ7t!cyK|c3&Lkk+an`iqJ9#d!;cyL1irlErd4Psy%7SKSbX_0o)ylipkN4
z)Cr-;TxCz{dhgZ#hiR_m7EYtX`O2S$S^8kl55gpSs=g2PQI}O@xp95FwLTk6TTAe|
za$pKgHqFV~EF5hc>+r{(IM&)o5<P78(HEWhuInnj@R=stZ=9WmTiwph0|rZbTE1<E
z=K00OOZJ2|uMv41$dmG&(0j*-RB3I6gLId<3?f#!aj4h3wVrNO>1~;f3gWXz2Z(H?
z5H8x~U<Z)6j(VltyNNiWx#f5(w;Uee!LhX%J%{sg73NCwc$-;-r?<M|-yP@kb$GAy
zKC;_Id-$&GBHad|a68v_h2LRhg=CF9__n2=++rh0v}gb-G$J$$X^5@$4N4vtX{o|h
zQeTniC?b^%Jf1#Y@8#MuqP0w0UENO-n-$2ZoTo_S5POS5&9~wkY89b2lkXx9DHbqj
zYy|1anfYk-xL#B8%fu=Lb@}G2Ao_Ws#(ca!`5@<si|05_gS>CI45Hi2fpv(z>w4NQ
z$k69e>v)+9*D^}TXB14CVZ7wvb-?QNop?JSkc5}S-7_s|-P`;MBT_??NF@VLzYOnX
z+TBNUpOwq6J@v~^`68Pqmj8x}Qg8zGx^nDc;)s^&MWJ9o)fb0rGc)mjH<<rKW{LhO
z6mE|m;(VTY`TB=*E!!PpVo_bG4Etq5VlA|hHPE0FYrC3rY0xF%DtLzN46l&15p%1A
z=C_lC+NyAwPBNWEY{VU!;q~tHPid%f72o<;YRi5-7?zV;%$S4UN^L(i#nd5X*p=k1
zTzz(0TcB;_=3z+#Or`lopMGAbu~M%Tn!(r2vuR`sh_phPpuQ8(YVwSMwtr-{wGyAN
z0G2+fvRBN}x7m2fF7P#BoqelAG2~?t_lXI=ZMHT*(Ta$dS>sWtl7Yw5f2`MgxBq!d
zRopH6FA}wK?-2SbA%zTit!Lv&YLn+~Bn@b0VXYoA!Ji7t4B@t%aBi#uf4Qa*9~e3#
zjjM~3p8gMa?>xh0feZAUio-2O{=&r+cQD$gue4X}!gs3il3kWVyT$5NcWD%GkC>w7
zw~<DCrc8eksbt{s#7y=cqlwbj(cN)5lJ-`TlUqZr`Q&YKTF=Z^)Nd!TXA{RWGh1I1
zhLhCHdOhA&5x%Myt!l*K_L)S^OjRM}QTa@8oJ6#m?2WfSIiK?^#ode6FKXCCkTK^Q
zM>h^`-+H_9c7YK}sS10zp+2UNj9jT1p{Ij9GrZniNBqxL>X+XC{#WRB?we)1gf>Vn
zwIZ9&1AQXvwjIRb)KBF$!ZOL#AePoun|~<}Z{9Xk<KoJ@IrGaG3R)Yg6FcFON}KMe
z(8cO`3DzGsVbBzc`xePX*{tR0yF2KjouJ|K#I7f&zA45FLZcM<B9fgleMYE~fmS8v
zgl8;fGeNxcny~Z6S6te<M4&rd`gc)H=i~kRsIzN^t|5-5UL~plR(s4VZvLNQ^DNff
zfOTj6Y{{BYTs^zyK4E=xHkTnzGI~0i-45e;OBnN*^*xJ~C2H*zyYO9aENvb?9%fbZ
zjd}}Y>J>CKeYr@iwTkc{@mZN(BUH)26Fb4{J<&hMtz%H>$}OrA(2ySn4{m*hZ+ndp
z&~g#{r-0h#VZ_1A%+~8*z|y+erG%mgS^A=LIX+T$D(6w4$zO=;nNJ0;aY|!!28y>l
zWw~||RT%*}Xv}hK&Tk(GDkFuqZ$}BfgWnV91|bN)GyV!8Trc+!iAW`bW|n%rT5&(3
zD1A#ZUwzefasN+Vef1i#jc|}#<sXrvV<WZ6=iE;m%3M8$nu`X3LC2Msadd8mvovk;
zIDz4|nFW02I74DGini%#_J1Yee2P0YI|of~Z63aTBB+2@+ojNS+a)?eBUP`U>60;H
ztyP2%SIKl7u}TIWPy8J3vG?UNN8J6*U){EiJ(1|0<}bDGrJXI$NElN)Y*|Tba?Hl<
zq_ND`w{lB~iWd56avk2hePknNY1+M_`-RUOM@U|RN+OQ#VE<QEpGR?{X4lZYOqsHC
zxbdp(=0V%(MXab8By~Oclf~8+C|WD0$#fmDN(Rj@tP8!~GyJJC46DjM-w^QSY15{y
zp*H-7=1-3hYP&0RoF-AKlZ8)TptiZ^bHvfqH)b1ZOlyx7>oNs;VX2|L`8xA%@n!tN
zzj)t5EPBgRqRC4>Xbq@F=eKOua`gH78m~GVzAMa05xkx(Q?H<@NzHE~nyclmDvQlk
z_N-jv^=hXE=+~Sk1pmf69|FEITKYTu^W|bKcAJqxj<E3aYj0}h;Ng3SwWq4|b>-Sn
z2S+mXN>uf@aKh0&d|7W@N6YAx7sU$Kh^E~r6m3@y<@lKtn%guJ9|oenvyB|wV@#ip
zoq|@v`8uHmon`73G&Q9PHdhg5Tqo6i#3~sy-@NJGb9VaYFIEz{hzCs7PSYMWz^OtW
zwybzm?f_Hs<ayLKpGbZ-m*c~=RV`;j+0{7S>KW~SI-Rc*C%h%6Pp;-OOD=s;xSh|l
z1=?phxpXI>2<D*I*sLw(I~*)3kE&vcE?PZQrd~l)Q%!5hq*K`C45<zzR>{EQ>9pSK
zy|j^9MC7UdVlUqsS@EFM5vC`P`Z)h&azUb8UDKed*!WLXcs02Jiy1sNnPdCWPu?4n
zdgLGBn~$0_XDtj_3llkh=KAe4w<+41r%)&{A!q?(_#9~bEc?fXLn2qNpy}mQvF0km
zkj+wENNio@W-`3q^Zm8W^Jxmv>=1nM)=8FADoR$2il?^u5OHEupi3GQ1o#0~>cizR
ze7+-x_&P7)E{Pq|V#6amh>2YZ16Ia*j-t;oZEmIsmMA&7(QddsdT6}y!bps7JzqDp
zATB|oFEsO$V0#te$m&n!deI4D&FwT}o%h<O{ZkkUF$1xeZnd;|{{Q5TF)i<H=t67r
zggwNOt<aZ_3*dt~Pmi~ic+26+>3m&BpJ`_cKI3FD2CXJ%4B`2i6*SQji%ZnoJPhRX
z1#edLht@CQT-gXF@iDp1&`6!<plHo3lj}xel?*&!bLrMb8d3UIDS{@2Ij2Y-WLokc
zqBVKkLgLtF72@ovYJb{#b_M?b3LI`POylde$xr_%w>$3Qvrh^`uuQ=i(+mg-W?f1X
zEb(EWBHQsc=q~Sp%wH~4{I;3Ha($s;kYIZiVM;%_jwDvepqXx7?=g4y=eQQD$|tu%
z4K!)2k~_%M{Qdy7$%&T{hgTQFZLIRu=!?vm*e$kjicNeeHzT!~H~9>dK>S)%SZaAZ
z&v}|>pQj0ywP@IAvmje=U!w6YZ;!+ZI*L{r5mB~|z>jKv8#OGGys9ktbdYD@Jg@hm
zL;kEr(zefY3k6@cm9tN7f+al*=_?W3OMKWC>g&pg`f3zz_iW?quK0yD4)nzV(bF(K
z+IPo=rFhn3JC36$<QSlA%upgdh}(m%oC3{XEm|8QX^&h-cv-N$ig0H2uX4RfYz2&F
zMti**p75_G5+=E=qI8~<blV&zTe)vdqcyqf+NX)n+mfJoTa2qK@8{H;xWu9JRP*@E
z6wCPeDBccD;rX4bse&acVp3gf{aF*PGENKIk6#7t7p}!5yv|q<%S9Wk2xkV#^(L`O
z2F=8b@_J8rwvi~2EBKO;Kwr7TOwFfnQ=8mvBJqivT@?^+EA<7B+1<H1YVg}XIMfv%
zaM>x8VYsf;NUn6Fb9U0i$^vwpy3VFjK{Gvrjx4P}4d}>Ye<-RYyTLO&hp!Z^k9nWV
zbtu6~1|H93f8{oRUTV3?B$rwkE~+@zwvvNj?ixpH@)EM7fv*;3OX<?Mk8ny(^cv@2
zM~vpPRTv#na<4bIhy)wMsX}FTF4_aIDa6;zV?n3P+QGw28G?%^dpt?|Bs)QgXp0r$
zjv!raQ$){kJ+U*r-ZTA)Gi4#~#_QE9V`y%bJkZpfOKtMTEyM?}b}F~N6i;t&O1Az<
z5?dsv#~Aq^pRs~S8i@*BEE&y{D>dv`s#uwernjYe)*lYdp^ZVB@*~sG{G6*NLh*!T
z9|-@d+6vL6{#UL~{n$8Fu*C^;z1}}u=wC?;aXa4G+4={flbGpwaz~n$?;ELSBAv)u
zxw%D+jrv4s7}xfr=h{YRyWyAXxy%*Af@NrWo5Ho4eAjNOU|ECWt?jcwK3{NsXT1H)
zb#^!;m6BcHalr?M6|Dlv5x1$SmuQQZul9P+^=GQK6e5o>5dy({_^s@*rsKc8X(jVw
z_8g#k4DXrC*E79Ocf1o0wBs|Go0xX9QK5^KJhgn=q&!G9Mp;N0h)MR#$bq1h__$f9
z5+zqxgrfaX$qt~_lcST=zeskhAB5}6c3k51Ub(ZerKZ<~qOTNT9Q&2^a5=)m)Fv;a
z5izG%NC?Tu^W5lz3_hcI={*$94X1PMC#Ri47b{Wa<SM&L1<jlv^j<Y+GHk*Oo)(0p
zjpX`LO?!o#tY{q!|F>k<`at*@h~(xuuJ?NX-D}(n5?r%9@>p=b<gunD?>cImCtqdp
z7`|aLU#BFylTr2;!Gf)9^jQsK)v}&Er6Pu2PgUu{SB%oitL-Nz`&I^B9Mz&s=W0S|
z3MG&J4ps0XdXcM++l+Vx(DfN!@6G<KnZRV_usYlruGIc4d$cL(L2dGbBuRtAeBBWf
zU+Y!}(5|bCCngrnZZo(l{l~^phDv;d%YL-=9X>AT;%JI4eyJel64_&4B;002>!Ih%
zvi*y5i!B8G)_A@5>}}MG*!z5sjS_y9NF+t}9s(^JhSQqd^-8l6M$cW@m#Z_<r9WB;
za9Pel-<c@h&Y*wmX-VAdJE$UMHWDgmsI-3=$QQgM(gU?&k@$73b0c=>6=A`szf1P7
z4;BlzxmWYOwqb|A&?8)=dS1m_I);afq``|%Q`<Z_^iw#4Qx)h0S2wkVS7M_BskD11
za0&Bn_#<7U%*2&ATP8Wuvngmj056FT5Wjr3P5Q{6CER93t0GahhyBo7xXtmyn<MUt
zwaqWi;FjDk{0b3Ea=3)tuWq0<IdN6XhwvSVoZFyZxhol*&1bzmdZ3fH-sxN_A1jW~
zMan89R8UGIWo<@c&@S!T^{^2V*5$93T=BL!-nzPduLuJ=$e!aiO%ZSOIR71&?LTPH
zd@pYo|N9ZlHRZC$o01D=Q`>y=1BPet!#DGFL7Mvqlkajo%P$#;0<D<O^D{liQU=OA
zTsfH|Ir*uZgTieRteu=OpRbf>NY0Wy>c3IHWhx?<QL^`OKfYIZWpPjQ9M^mLtyS95
zz6rvAJ+j$cA$h<l`R-ooQz^af3U~^y?a$Z#d);ohAD%5#8^n!Al`d9ul|b!wCtak>
zN8z@%m}7c-C^!p!{9<XvE<B#=r4RZg60BCVI-ZyAXzz(Px`Y4h{^|Y~=uPTK5F=d&
zOCNDMK6;DR<W4=&LwIRVzQ!N-w%e`N_%~lG7@4*lttR*6I+Sw9<8+ZSrylLza-0S7
z`GVg{mZDa0Z9$uGgY+XCr%A9{(F*yiY)@<YK>S9oXJPY=cXm!~u{TxxZ$~;qU;SSC
zm{U<QE{@jbb^ddo_n*Mm@F8wD81nwBeC=SO7m8C$sbvyFF<?1en9RiCww|Msqwi3V
z{z**o9N3H{BY2t-nlWd~9`c{B6>qhob+TW!vo+PFinn^qqUM|L=G(pA5#pDuBcAiO
zOCNJOww*$2^4jxn-^kbKuGh*g^+L&8qU($k=r#hy+u2-IB4$zMO8F|#?6#CAIoTI{
zPIwe*24}UCkgS(~M*S)YW-D4JoexWQw>Ko1oru(@S3A5T774^pcdhP&k*}$vXac7K
z<MXe$-B!p9>T}5aEL@2KRSHjDZ@atp(#6Tr8dNwrmnYm_Ff7P`iKrQqsMkd3S^Amu
zF<0x!iU6b+z-anLhMdnzbkd=N+Q?<+!~aPibvk+r*AEZDTDMyX`OU$s`q-%`Os(Tm
z5@~lkWt_|^Myts+JmL1K;B?*;)Q(j=%`jt-^g;jm3K@1QS}*eFxQ*vYcs1>fPQfqb
z)I^O+CO_)#aa2qJrwD;HX|Bi=gur)??564r!j&#24YdBWIm@r0i<3D;Xf?Se+xpYy
z+!`!j*B7;8L3~I9`B*J~)VD}5ThW^7EPo%jDPMx!UD2($#JvKwt(c|qN1cvm<+d~T
zJ+~VO_+VuhxeX1VI}+jZ&g7cjF1(I1PGT9p#(b`Ldr$Bg+x}=Ft5+gVLrhpBU8l6^
zbO~lFS~>D_m75B=D%_Yb7(G@NsVXiuxI0`V4c5z;ylBK`yWKX(uMXBAjY&ZF1z(AO
zT9pEy4~N@e?Mya~wDbd*FO?x-iOkbR{(AE77fG;N(du!a{?2Y0(o`eSlV!TJM|MQ>
z{A=<Do`&ByaIJfqvf&Z8TLyWaOQ45|Hhq_%gu)p-v%=1^DRZUrOHjD2Ea3^ahp!wN
z!VFOFV!VVm>e27WA9qz>N)d{rz4CqUkPO2IpbW;@<7NDO#4|2DYC$wL)dug~31Icp
zZnp~ZIQ97_e#T%`pdnnV$rs;587B)--Q?;*o^Wd>v<XiVi=W{RbRcnE=@lqK)3#c^
z_m#^qJaz_JJsT_I=Odn^Ve$u_im!xk^AG>Q?KVL=IhaR364gzf%eCe+_gUI7*?{70
z1CLHYGiDl4$y#&P@U$i*-^d?$rB|RZ#es<1bfy%`QIS<I=UL5Y<@PWsu-wF1+rmJn
zwEwu>9Kc8AGO`y!lhhsO5pu~C44Oh2B(snTUqdz5(OaMIkEX`71*M<`t7{MYME=l!
zx<staibx{CfmP+EU_ogiBrbqYne{U2tVRK`dmI>g8tz>!s!2B=aJwy#&C5hJ$r@bW
zf89_Xz1WUtJVqHM%c{gAOZl!}OR%T27IBw%<!Dk1hQB0#=zo!Na99y3Bsq{d^^25<
zo6rG1Xx667NM?+DIt>0={@By-#oJ;Ubh~tQQ%a5((;h02D3I67cY=mC+!ofMa9hT8
z6v*d$fc$<i7o>o-<7$<G*FSV%><5XnR}qmo@YdIKh7`*?qDqh6WL0;{7SrUPNTlNs
zcj>8t<J@io<jq_WBSS|rE}OiBt9ayq^C^R5Hj1{5wS3Xm_e3Wvqd>!i6>;t4gedao
zb3~b|h*+L;z!BvXI_o|LJ#S`lm1&P&R^IHu;M4H*HC*jTy!H*ZTL5_fW(h*+W(+{?
zKYt9*&rCj+GDv2XAX%WgQqE+ljn*#+V?o<^S{6XO1BHH?z9ub_D-;@?<X3rY`n6F`
zDnW1b$XV>597{woJzNg0Hu7xc{>5$U5u=3-j3w<CqIyhAxYk`qK1CTMt8k@@yd1u8
z>!T?M5(CcL3%arY?8N9#6l1F*!jZ3J(2SfS2cGFD<c@PLFEqmV*oon%!Dfa`?{Jx>
ze|VDEfgupv4sG79U&&MBG$G|MWsJ<iDtu*}(e~&$bhh<br!`POwXV3{l@1L5H>xUt
zf{r5&xMR~wIkr!l2cJBn`^&jN#FM<^|C|_qYu-B7a$_$9$GdGdVyEztF=s4#&zwAj
z=V#I{rVNt#Sf-$oH{NccE)0>X9WS26pP+HI6T|<R_*27*2&J<V`?&v=lrZ0JJ~|gM
zSk46^pQ&pc7=IcncCea0Cih#njRq90bgtmR5G+%`wR!6~l`=+VR-w(?`ur@;czX>)
zejJ$MF5qfoGY>lA0D{j9D<T>Plnk1Yl-jfw725HtWo4UWgo~uXoh-GIV&mltiBs|0
z&(cPw1u?P6+cUUMFvs<w4w5)GnRoBjcbLsaaAWhm$;8~`ga`a8Y0FFzp*WE=-}Em@
z>M5Pl(S}xE8EOep!BgQ<dTPTIYMbwH+g8Xor%D`{AQID1yj{j62|ZvpWsEGqo41t(
zoZ)uwm5ir+dT0$@WoM@WvGR{jc)%x;Hp~=}O42?j{PHD9Wua2^6B25YYm=U*I#BqI
zhBu$0Gx*YQktw*^IaMIfR8(QjJ0OMUcQ)P68g45%WeS>M&Nyxd%3n;d-_BE<*>PBE
z-$F%n(zeP8$NWZ?`Q6ZSXw6Jnmxy>eI^h8{{Ex!eZeNDUD)<YXoO{O`yau`XXfBz8
zGiYTBa*;|wV-@GgTc2;8japbh7i_)l!_5nSa>NJv*tJg)#W<m4(A0E@>&2YFWb`Z=
z?_lkL2xDWpBR*iw?P+8~2fXgKg^+)Ac4S~QQu-qo=gT7+Lm45n@^G$HHE*=_-Ex{O
zTY)avFq<u%=ZFt{qVx(BHgH7AK$1kRpP^V3)b9PM@N7Qlh!a?I??Qr=_d4@(Xw7El
z^dS?+uZHfubSO{t@S$fMp^TB0Xm(qi&mC_!*<A(zO}5p|lkfe-2_N`H?cXYF(J|i%
z|7?0ymi_TqK`5OopCqbDE_1{Qtoh8e4*b>sa@#h@d0dBJ*+^S~UMG{d3QO&vEi6@r
zWeWH=Zx8gcZ8In)x6Z~l+dEXzMV&@e*u|OCK{;b(9a)USPo-pmG9yt&+-qMr;s%zy
zJvP*?->6gEwhQdNbx>SSw>COB8G>tY3GVLh2^QR412edLaEIU?Lht|yHn<0OC%C%@
zNw7O4zr5!?-?{bGIbYqXd;hppF?9FtUcGwt+Ut3C&!+qQJI_wfOHV`rV7Kde-LOp(
zCWjz?8IHPR*n$=5>Q~RCndA8(@0pTVzK+pK`WDy_->l+*@gdZz!xJvV?0&@q@&m$z
z(NMB1N4VFzc=m*TNA6%EgyOdOhO^x$jlja#&7av8{vVzvG(g9$HK4cKxwFu#h1MX5
zfpE}!Q(I!szmBNoRI7-21f8bU9X}gpIq}iLf{OwJs`YfA3Qn-G{6?)z7vYM_0%f1e
z4ltrlC!EJ#>(gmc?4JLu_yC4ZkXB*?qrr_2iU+kRzAZ@EY5^X62cZJ5uEN+!o3Dqz
z7gw8{ZuwLTP<FC{-blAoVNsf3)+{9Ag|ab_89>y3Q(xCmU+@QFLkc55Eqe%um}PRF
zwcco(=K=QD6okThrm)EOhR)sSehE~9rQr<3Z#b-Fk|r!(_k2KQtqhW9#+1#K2_x=^
zOqBry%@`clQO6e%>&p@c`+BM>=d8%Lg>XpVtqa6%-K|~CTuA>Ar`!en()t0OAK~l7
z!z@>m;?E}j-g|#8Wuq9L8=9k9?ftq*uA9@mfHT&(pRvKundfd4BnUud{JCXYoE}W<
z2|F7(7J5KOWe&zIb$K)FkJINKmxg`j_yNCo8YZXIu?JfTe?mZdYD1yINo^8G-W1XA
zOAd_H-o@_rXSR~<DHo0A1w1i7SJlD~jOS~Y)gFGdU`$YOw`&36P5#k%m;Sde&xb6u
zD<eJUUMSz(OPCBpbsWj+1-<<hoG(|30J8f04!!J0>pJ*ux2ps-bf!Z&tWa>~;^@~$
zf!IN-(`K%#9BCp-l+ri#xL-WIwLb|l@eytosM5^u$Fs@_+T?``yw57(hki-gW9=EU
z8@N+ny=CxnJ%XQGKT;qBu2*pG;v)VQZFk^;GxNAGI-VLDeS@`di__J%BleME)XQlt
zwf#@u6%jjyREN|lV=nRKn~x1au!t~oBT02^d*quHK25eJO15HLEsj!Q_x7nnqi*Vm
zKaxejP!E)JE;2wLg?rU}IN(8IM%sSI1VvY3BkF=0zyv;?N_xwrK68^zALyQFG$#z0
z(D!Igvd=?Lw~m~41e%>$H|tP}&hAF~wrbXR(D75&SzXo^=<{fh$3WULB1BviOB7Z&
zM_y;l>Qda#Qu$rTA@s7Q`$;)l>Fmqm&}g<1?U3N*9^>9XNk+8f5I8Zf|7^VaT1}>}
zijYZ-{KLdIvo2{@DF6w+4GBl&kMxGeog`j;%Dj+Bx}qYrGEV!~c2fFb$-8T{uTB}X
z)DzgcORg(V&2^1-ehHA^rkuO2zPerzXY`74Dj<xi`q@=(|8h2^njSQJ>uv4|-B0g_
z<7f3K;R5lHchQ{F;~DcboN@J3ue7cTsRe0qNj;md0@aQ&z|B`5oLh)_Uw9s1<q(hw
z8Z%n>4AFO%^%uZ)mdC%sr_hmF?m1$gp?AOesmn=(10)T7{6<gKDrw2t7}p`#FjA5#
zLp}+18zAY7+94T=dl7jpR<9l?L^~e3fR)8aO}S{;@<v58*pzUO4P2?(dnXQMkuTZ%
zzDj3=a$3~o^TyWOlyFpH?+w)t(EB5kwPq!(Yd^Xv>c#QcH=W*%+zHadnbT;}_u+oY
z@G<5y=}0AW7_s-=<(L`4QNGHbNyI(B8DbYTd|68}dDd73DW5`-=DYUaOp^>oSP{_L
z?Zl2N&4)gR&|52)sjd!ohOq1-Y`!9yqbj8uN-Mq`*-W{WcorwPjX_;SR1*GHl|)Yi
zETC2T-kGU_>WdeKMhBs^wOjLgnr!`OtQqma?3}nm;zUy@qj(uMXnqs6IYa+VCmGmx
zM=e#LPVuo;_pwGuwtk5{Y>u`iA#&I9rYV;HqUjtc%rjYmuUm1!l0|<ZkuXwRET7}`
z&bF|>XRe`75XqV3#fp!hMF3NGGRpwGdSksyWN|F{ILTsbhrh^vn(U#<$v$xYZaqzq
zw>H7ssR&7vE3IO`+kx#@>Pq&-v)P+(9i&I$yh3;m_aj{U$Pv;vgg^7kPx`Xo{ptWZ
zz*TbIf%2VM-t4My;*KkzBPkneUM7A|QfFe>KVsdfF-~&Oi**)RLn9-7<@T93@s_eu
zU+N9>Toz^x2ZD|U-FMCHv#<r)%J&(JxN>0yy36XugbNWPKZ8e0EEzs#yeSgcnM{74
z>?^Y#-lS?O-``iXgblq)l=a<oNtIMBl{}X?zWa<5#Crt2y|?(5fhy2P@E(+dXSM-$
zV@_FJEmQR6?<`3Zbg-23#`boywEXEI)a++b<CCClx%)50R21*2QF9zs3filmhv`+M
z4l~!d7W^1qaKhw3i0a#lLBK{aR2q}e7DbBkK}ovSpzCA0pW^RrRX%UXuDf}*ll^g7
zhd<3|ZS|@(s5xm%pUjOY(8uusIcMdCGaA&}rN`?kbj50xjy*6R`#(Tx%;TmI(7dD*
zCYd#)ILrK9M{3<cDGMn|UC^ync~p-JD6>$qoPoVJn;bg>G)2+9YdkLeNUsXB#9xqC
z52zGGHR{8hU1{QT)yvr4Z;6hLRW9>a7B>w2Okwz#-Z8@OJ{gBE4^{}v+Z9husCZw*
zM{u4N1YUa%mvzwMp&wHKm&z~}+mZxR^~&0W-iUSQe82^3Z9S>zm+(&3I#t1Oi9=dL
zuHep!Vy{Da<@gtjQK#9mYFDA=tq*!~JGGp|2aq{)^<C4Y_h`gzlYZ@!NoQX%a^V^9
zF+gN;_%pb60q6LGxvpc(4_m5gxZ^{O_QWn{tSJNF5dvZ-{5Ta#iK{)w!CSOnA?i+G
z$BG5S7|CN^Keo{m;_3(vvF(jc)nrO@;0WF{=AkvUMAjsO_1jW6mCQGJVhRFF;<S&}
zrH9)u-8vE%LsV_`r3K71`F8QKO7@S9i<qTbc|#9CCrSCx!4;BDD~=4WqeI-EyR$E;
zlwqxZFuGF%I|4#Fqsy`sUf)+#L*-O<L;ne_Cein6__htwy#(5d|E9wk`|#0>18$tc
zzT^us&T8l?h`3lD%8E#8;_U+0^`fh&z}Ac0#szI@F6V4D!{efHsb8w(RE29g$K*Te
zbCmHUAxd7M9&TCtE^&(2f=e%B$>bFLgE_?Tk~fAIU>_X3cYS_dQ@>CQe>wW1*TWwv
zRpp~Z$F~<F_57=q{1Xe<vnT}>9;w4AeznMjvkbJ58)@f|3zC#i{3N|KUPREFxZSmY
z;T#%{PY7~S;l+R0A2%o(@vpzoujRo78nQUnfPE9-qO@Lk7<h)f=UO#cwpVHl<@3AG
zWL!c}3R<{xTBNUm;gJ3GD)8h@o`EsZW9JmDQaz&bL%jq=KsnltCt#<~{>|(QzRlQU
zsz;}UL7T9wOH}seZB?|lC)0j$)$Y%I7@%&=AVzC{zz7X?!XC-1B436Zw=29g8f}|-
zM~~bXaEgxOk9Py@TtCR)_pVD2s7<G!A{CLkOz}!N>}x{=Y+F~>4iC+qe|L#z5lh))
zK%jhIfQN>&jO2F4%JBH6&i0OL<;ao&hgA8Ua$OP9`2qgMCNI4umQs!`tyUs$r_Hq$
zt#43n)Tg4(%t;yVE;Dpf<&&c4@fIH3I>8KMjbC&Pk2WsB@ytRepMpaqOq3$bmC;Q*
zRFJ-N`SSxCq8dvi2(IKyZiaMDRzGwuRp_o>*E!ma$h3H7CWd_kDJBOvcpuoj7wDj&
zXKcAZdeHc2f9FxMpr}rVAxQ1zh5R6}7|7$Q6KK_tNK&uAS@qy#)zZZh1IGUpH=7kB
zPi(u@kOad4!2>Phq0nXejDG*(jdUb3w85|Q(Y;>#)$2TDO2=F&E%XkgO8&9pD+9-F
zMR!vrl7_64&+c<(a_EpIddqrE+_VRjC3h9*F3S5VCM7bM3<$Sfu8yubTqoKGZj(4b
zIQ!QZm+_l?PNT{_xYy17rB^set|tNqq@VA0uMRcyA(~;iZuT`7`AKK&ML5z6-zgug
zy?0?)_QXnlJgCHa-#O$hFsso;|0qk?IIt9QkHIdF%#NS}>uOU+)bOa<JE|H)CX>9U
zPPG|tW{x?oCIUkvtTf%CW`qiTy+g|s>FTB_{qb46ov%vByL3M#l<K7usWPm_&ytw#
zB?7qZUGQN`K{;BM!BLcE?;qiBbP1m=n;n089?#E>%C@YD!smG)m}?U?4?XaRyhHSO
zTa{Lm?&VntycO-bf<^<FZ_^8@%+&&o<)P08DQ|5sZt*x3P$SjCo`O3f!1@6tE?q|(
zr`S-e#@8(l+qXT;1BrjvEfFU&-euuupocrHQ!LfbuKOQq4a<f~`fR4pBysbyofnUB
z;4%_jU-}o0R#7EkV&yi2FdWaXzOs+}fWeQ8a*L;31Sd$C^gJJ527eQ6m})H93(*MH
z97Q|fu05qO(a4`9mDn!S0K3a$<liaDEH}+nWpjw7tahqWL*tfZuzi&}z|lSYGG0)9
zjY#@t;!Nx7F?jfq--QxmR_lsIGXs&h`yNXq1F`MUt%+B6Z15Eq-7((4O*pqbku8GM
zLRTu^ERqi~tE$qLEkrM01ta~jRm{DJ@`ON^Fon$wH?p2npTVAtLjOnNBnwuCKdDm_
ztwbKk=u_tXL3c9L>52ehdYH8K_KsCh`zmEcsW&a*g>=3{D2ljnf8{1HSw&jn@m?^Q
zCPCe#^BIKin3CegI&$G2<2{S*UBtk>#DiX?;w>GVxil(EW>yy&I9E4q-GTL#&1eqA
z;42o2TCiwu__@2T-(zP*G#%9$r%Ja$TTeQp3=K%&anOd$ren$+;@trcqM)u3>ve{P
zV))r)20TX`Yx9p?2JP~+;w<NW^;vjobaHlXe!~v)9#$DVR_tgEOX^VX#XaFWrh=Ig
z*>t;oW_>(e{w=px|Md&93+U?3TbS_~_f`~x_I^f6pUo8|96K#Kc!yZzFso)^Vu7Uu
zK08!kLp2HTJfZ)`V3s>p_rsT*#^`Io*&nNI4}lya+evv6_}t%MJCBmfzlNW-zx5;Y
z^iNqRSD~|h@e8A^m-Bp253QE@jc8J4MV%8rfmh6i5-b5>MOl9UONRZ6N1ntwuoH+x
zlOE%1#$r=)IgKRgru+K`Fho4hcon&Au=@O(9c?<0uo*sVk+ig(0|~wDxIXdj*Dp$l
z9;lz7%?jb=GZ$hpA~NT({)N!*`VZDkCxM#Yh?k;1hUZ5IElc1)iH`0rQ_^?^p<VTj
zo+0RATwBN*N8=*w5afBV*{UuiQ$c)mdN{TgP4qmmBL8`O2=ss&{qDEt{c9RQQ4x$k
zn>U|Bj<o0qY`iPeXkTKZrV36satZYttdCJsC3eK((Ry2kE*up|V25M@A9v1gq5s(Q
zy}5jNcoQ9x3fa!e6XiMmDc|)K3=zvS-o|EEmZynzeI+9V#+~6x`*@zrpLX_DZMt8?
zxv6Bz8oVV6pCJ^&A!51SsVZR(%xM@rVp;tVhHSN$zUjt^1LXOh9C7L+<L6=*$D%RI
zMX;%!7AIFn;?l`3vOGU|6spR(bfTUplrui6ir7b~&(k0jC%P!&Dy{|bZWoap`Kc4$
zW)2ZbFHi~Q_ALvp7a=0s<fAd-hm~DS-ap<Xw~6zC@R>lriZLgDrmntRmB}HY3Efze
zL85>hl(cZPL%vh_QK;~jJY?ac%9r)}w7^`-FnCm<92bL0av2*!2XdW>)$oNQGxM}r
z?;*~ZBp9qzMet_~3@|#YbJH1d4L#-_H#)?zNf?Mgl(>xNi8NNVkf$3*s=TgB>_}TS
zP)5we&ooN1kJhv#py^fF`YWMFCS!Wd&Y<9fs#tx?#al?`NYH7d;K5Tk>F61HjA(sU
zJh!iYD}XwNViN7P{}Ho)@4f!o!KAJcW>7!+jihz5YrxQFnX@{>_I|yUqopM<Khg_j
z;B~f9Zq}Y#84i%<JwC7v)%rMzm6)-aK=e7nVl;PlR-^UH3D4Z;%5wH0W>qJ~H1WT_
z0^>Dy=~VK=^Tk@x%K2CPI?*{6cbaB&Y+qx3%Q`EM7VLPBAW34o<^%PO0wwHIm9rdU
z+G4)hBbu+1&RWigla>`0n{>M28o&W)MAFl2TykKs1YQwGGo)8oTVydD7?NMiHf6sx
z9{M6px6XoA{<-jjS%<&0msp)zh)S?ir089sbL}UuzMmF!%bJmCOF74G)j#`gbU$st
zpZhy6fis~N83R=vBXU&o&vd%ULwC7{@2wyVe6E1cd&gQwv*bd;y!tEhKCfm(NNmP*
ze8CRp%+32`COhGFCUt$0hM?Ew4G!>)5X*@l`FSsUEVpB~7qPS6PLPN`Ms@P-<w5om
zINX5rM_4;7$eTyd#b@YqcSAp{(z3|4n8yLF&cul<1&i4LQR$bMkI9a&3m3gRldwr_
z*H8QT)?-yDQiJrIeumwrBrbtNd}pjpRH90_DX7e!Rk-|q7;8PnSE1z8ZG@MxVTCLd
zt9%((+)a1!YW?i~`IC`8z7K=DXNDSnjFgvyRlEM08+QFzr*W+23x27OPJXB?E)?r@
zW1*N}-qge^`v?!Ec+cr083vrs4w33ki_9Y>GZnf~(0x?Z_vq0yeeC_4MIW0MW}GMV
zqJlG0d~6(ipfAbBP^trc;u@DU!K&TDbjUtq<4=?;`tUB3>RRS?)rjNgm?h{jK<wp}
zs}cl`-<2|h?!S#tfEPwy7YWuF7l%v}OZp5kl}bb3^-Sti=)cFWUs4D6+!^fVcP5?t
zfg$R7#^#4sBa6h$^Bek9-Z9dc?n{T7nGkHW&sADSj)4nqD8|`%Xx!pI_uBzFu_&)`
zpPsoCV*<1~qaNE@1mh}8n=klCQ!rAburRt;F~pFg*57>~Fjtcbf3{$2CyR6YUVL10
zDz$!0Nn`5cR6)Md<urqyo^;lW6!FrHNNMq-XzeVXVzsaly4ZD<)Q<u1#}1>zExdtD
z?)*E~!aIwjx2%t+$rpDyr-Cb4-nkb-EGzUGIGe(S31x55buW9@Mr_SAHyvWR9OS=S
z8BHOc4=+$LM{lojD%H%O^x;Eyh-r+kvwhSx_(b%}!?DsjYY7$JVK9WWm2I}UW%5V_
zhtSbb$gwvGt07$wJY7-a*Q;EDbeIyACAYZRe4~~c*QP|Qc3Mj0>3u=HPq^ezC(9ev
zb0}zFz#L!qwhNDc$bLv^V3<)p$A+zW@vxLa-BV+~ZH2cDd$T2g$VuXCZ#EGn*(lcE
z^Y&M@Vslnz>}~J-<-4%Lg6nJTlsf14Fz<>yS}hW}PJa?MaWv6jx$BZOm4zyoCAEEG
ztka7=ZaG$B5onTcNxESTBf8}yoi;Sc6~y!Kgz!x~cWn_vd|0kiBxJi=f4e&;wM{yl
zPNj3B2rOG@YmgUy<?iayCoe;5n(HTUwspifYLQ!4hL=-ZF+yG4(q_cf-ANBW-rW0H
zkb2LssnAA{GNIm#f07*Ke%p7t)Bdu9aoWsffsd9r8xDwd`wHYEa$9d8NIO>qJMCQE
zkD4C{AQeH_#BKQEX;kPoe<YogD>Py3MX;<nZsW(ke|s-+j%g!If+sb3Hfuk1QHo-}
zT#-!_$!bsXF54wXYxcRh`C#s06ZM*7lbUVZi(C)cV)V>ubCczh%wHhCMLl62<sr9o
z_A`_7gG~MK1tX#2iUHveMkf0gj_%uK2Z$WwkBZW5Q#wv926;j6%ZgqdRS-(JgROtK
zd+yL(whL7WK-ZV2%2T|)CMYIP@^C5`*(rQ!vFJ`NfwrBnDk?N1Mluwf{XE8E)r}2#
z%fvcrmG|R_%0Iz9_*x^ziS{LLgFC|*o2zsM$M=ad2fZm*xEBJRkU}d{FCx;sRG~>@
z7Z@TF^NNFBRArHSj|ML(L$Ae%e%@sdkQ$17M&#CP$)KZ_`#6YdLc@SRKCi#3B{}~s
z3*?poBCB!!S-(0ebo_e%9u{)1FHC5U>ipiREA*1t+y+Sc0Je4IJ{H&^ng(t7E2+(*
znOpy0(pca#^l1M)k)NoitPyNH=#gDY_RZg0gSMo1{p-43wet5gT1m+D0Cr<j53K8v
zSkHE0i)c$3nDb86)%=`<LPT?<X9O;xuj4!Cbl2%}@^Sak{ueu!1TIO>$yH2zm@C$S
z<p`<5TszIZaL0&gwSu+zOD$vQ-Ut+4Z3Qm|m--ekz%yf-4LSzhr?^P%Adr8dU5=dj
zf>X7s;8g};++uZTh5>FMH^*&#i%nJ|GP=veGRM>woQ}0t6=chQ!|=O_maU)7y4lu#
zj$5j<m_;@uWNlu%G-tGiH+rS)0I6!C4<)4#Oa#*0Kg-8X@K&&@E~89CG*7OJ3%P{X
zIy+j2bG;YS^cqdfer?oy8ddQC)iM#f{o7AC=!x#aQO((SGm7Hd;r4h&N?N0U`0V9%
z(qH?cM^^@RPm^UDGOvLt#mO1F@Uu76jrs0kJyUwKX#WME%5|F55r6tQkDznm>SFhd
zT9MNyn2a-HOUK)AuSL=f#@07dd<6Iu4wqf~Jim~dOb3+|z{0N4OBR@1)9Kwu8=PHt
z_L1!f`YH~&jd6yVR+@HYFcICtZBft;`Ce=u?T&$%G>qbo_7|jHs^;gww<A3Mh-gft
z41FCoS{5sNJOvwzDX|f&$O}%@DhoR-=eT61d?oxWfCy-)>aMy8>CM#8<KjBgI38QJ
z)RO+-(kfUEB^}=TFy2Qrmn4+?s+UXv@UBj+^3rR)oGM0$o|FF;_F+XNdHQ>$Wwe7r
z(u$p_YouOMXf>7+;o{@MzG=5<w5*iyMWsC7IJkN3w71_Ybh6=A6lyeAh>5)=+!iUE
z=C+K=7U-RR&bw{VC}U=5XV|;zz<-mb-#)ryxRhgVE@<WL{;WO<x0(Xo)&nQvP*>AZ
z1C&{H)?e*Z&JqcbXSTO04YLV?nnlwI(wIw`!1~bjd9m&&QI_yIdlSREkKRDXTR9Un
zpDbeORoDu>U!jfplnEMcvV>EQ43M%V4NT-CvbPkVT<tjnVHrl0Dff{27yIb|eU~Xh
zS6LFLlW&%nr2cP(9Ewosd72ntP4rO$ZEsTZ2m?_(^6J|f3($U^x1ecW*3oC-#4WyZ
zi<R^x!Q;Y*;1idT=2F1opUU)#`s5v#N+K?RnzcRr&dc=;1;r)~X(rvit|6}aiLJsK
zHaN63mZRxh`&N53Wyi}cVtYg1rF?)iMl}0=NcA$W^J@OkO441vi7OI3vNv0N%dns7
zhTtxrMagBsgmg_&(R|iSGA1d^W+pj({qB>}egj|;BIlpeL9sK(Od=xuv%$$iuez*r
zhg6gUq-9i0nj{R>Yv!%1mGn{LAzzu79%?p*^5S?)ISVkC$W3Z_*%}hOEQ+k(u9sc5
ztaYt9b>N1Je=P?V=59Z(I{i8V;fY=d3r#Q2y~c(L(m#T6b(b!$Sr{zRb0Uj2B(@2V
ztoTd@v30uC070)W|7^X{=RfDA8fFl2Ri|`%Z3EieVpfJuu-a768wv*)6z8e?tsCoR
zosOdcnjUQTMH@@45c_Q0IK9FA&v!ktfwzp8`haB{jrFLo#mWaeEvJRey&q<W6~MO0
zZ%2`x`i4!%VdW0%Q_e6R`#&Mm%-h<U)|!rcyHcB1Ul&e+4>-Q~?)?&%bTw1MM!8-r
z0Q<}3Psi-Ntp3(oPM(yGwCE;O(Tkc+x8F->OOYrFkMDmyiTa#LhQ<{xb=BscqSGH@
zMRVQ3)<ox1LYJyUZ=Kb6d7w6mu-ee!KbL>Z*-KjO%XWS~QXVOL+()^LDZ!$4?duDj
zhv!4Sa!b~+<tvbd=4M&fb$a*sd1;u(H;~^~nQ-o;mTcJVg{(E594n>PW4V255Pf8p
zeq5I9z_L}TE!nb*?t-<>`?_}qCQ+PzwqR^>k+p;k_Tcy7BE;R8dT+^Xax^j1pZC7x
z)n;L9VpyexXCY^+d9`HEej;L_>D0TKfM^z)Zh(7=35y@kH;a!%C`CzDQ>Vwj$k}kM
zjy}Ukb&XLU(3j6z;>}{&VP5_IHb(B{aSc{=8LWu-DlCJ+Y-uJ76m*fRGX_T@X^*=n
z4`Wf_eFEDN%mtE)n<_?*V=cKM{mMd{nz=S^8tv%F`eMbsJ)=`G_!lSnLn&zPgu?u!
z4YXt+*Ej7*1CM%3yN)L{TB8W$4jt%I<yt#CZrqR4s~+n)#_n&#>;oHzH!O>-VB@WQ
zvm3AXo84n{hRcBmXvZ7Q%$qo{_$mwQspuJq*IyVsKP5u$KeHg+zy_l9UA7&dxWe_=
z9h<2+oWWb=Ica5<!HBRwV7o^3PGx<}c_!A!I*4y;$U_gQya*5+*whX1Z!S1KO-tVQ
z1k`{}`&U{M7@I{WKlmOJ>5o>z-8>IOx#<GB;`eBH8QA#K+8-$?0esdiU7ZErvTBXO
zeVEDn<-RWy{nI787ro&t(xQ(&E9^~tV*`ozR5jp6ya*0yx`m*6daw(j2YSBrU>74m
zq~O>NDG-IPqD+I=Y$$P3i1BNm&PSmLgTnZr2aToqH_D|}FsBhwCvV)%vMo4;OC3I3
z1bBzaijtgGbGRDGme9hS#@w-xmEN*jp0FtI3%-5DWnTn6MI;RFL9-BiKzI2P;8!(H
ztEYTKwAHa+!m->Tjh0z<yf0_|&I=7-R8nual;}FMvf%}44vNy3S%qz#d~|cwn(;ir
zaz`QB+639V`_p0Ie9N3-zE4{^n-x=G@|0albM0wr=y2+IxpU~5LPw>=jCp<WkU7l>
zxKVj9;9j5kd@=5Gt%NDi@7Zo~;Ihf$DCqy8g6y>D!79?5^B4qSV5o@R2I20kQo6@L
zsgYhOtRlfhgfdU3_Wp?1mg)}7HL;c-9)=uAL71c0MHLwantSCNH!I=lQMWw86goK0
zB;O%8ma*s&Kj>?7y=k9q`Iq_^9$1Ee7}~<T`;9jdBm4U>xfg>8hzT<~P-Z;;Y!S=d
z5&@ZRZDkB)sur$Qt3h`*50z<TUm<7>3Q}&ingId7bf??xOBj*f8ON4NqPy#Db0=l(
z5M!$!E`J6Da;Z(Xs!b)siI0^IGHAr{s5dcgq*{AdNxg6={;p-fi$Or-Ui`f#FZ-T@
z(9agCB72vps>?Ci(n1F!a*MNwn#*3o^1!ZK&>W2#ZM`tP7~o!gyk4uU4DsEk6CCMG
zp7o{MNiv^9m{i5Wfad1oce0C$Ou2xGjl@c)N&i4Us9&f15~2pj`VN*dBEH+H*f|ue
zeRC03z<Id-Y`i&pZo13{=AA{lYu9p71p)F0Qa}C)<J)a6nWb6Jc9O06&w!4J{+p~;
zJ>4>BbDQsm3x=QxUyvHHqc>Dp)E0~RQpV|N*g)6${FIjO(Sj@rp!WOhX2k<ZYw|@f
zyWP~i^VBpfjAqO77ro4{R!d{*p+w&8ikF@QeF)WuziLzs7%}V?(C2Dxt5x|XjI$CU
zEzh9_k1dOirRMjjXjCQN{Z;XEvCu&8e18g$)F3L0dLUVLVF(2S2a?XUJDXZ|054&D
zE|lm8ny&=gxn;p+BQ0`9Lq$AKRFiKlsK7!Fnc>y_VGC@v0W0>rQTyn*Fk!|P@2xw0
z)ym&n8U-(5w!w2E$U~h!kU?nr;$#(8QG4}FH+rdh3Ky1w<22O1`DjiZ)Y=q*d5*?1
z_Q|#dG<Z^c0M}WN3n9sDjEO<BPl759+JQ%oeBE-`&%VDOF!r;Fkky+9H5FCJ)D9u>
zqo>|5%YfL1-|oDXdK0VaEMoAuYNalZ;%yPJNYxyFeGwfE0&?(A!`clyR|_#Z*HVw(
zvO>ktN6`M9vGKR$@#gY%V*L;DxH(zo4zEKRS;%X=ju&^NXA4h~!Jzl~46dXOy$6K|
z$N~5U_FX}7#kQ~#M*_2%JdziQW~LDw@$Y1Ln-+pbg+5mxBRA|fErGsAmq)SA@I5*I
zgbobshtZS8!}iOisY?LAF=X6tmpPK;kMo~>0>F%o*Debevmo?g(zcyw&RSZ{P91xC
zc4aq{e9plpN0uosam~LJF`Cpecoxqn<ME5qmoUfs(`K{vvJ!))@-vL*oG1OQC)*@v
zZ%F|sE;>oRvyE%3R@X9c*Tk1T0P%#Ct**n2<1Lo*X>I_&WxxGW#L(v@H|Ez#fi6jH
zRf3al3qN0ZU+xAHtGjeHfwwKUMGOY{>&0|gbkcOHmsHA0`Q!6r1^bsahvxjt)szu1
zm_UPrlgHI@1B26Dh)&uTF}<>&!u>Vz{Sv^t!YY~=D*3l>J#YaSO=bn|^cg9cG{r@*
z$XU`+s=5yzyZ&l%IAVr|JCSiMBNJ11C&-uT02uW*Z^rG+j)Z@R7WX2PgROdAlP=Ys
z&|NA3#JNFMR7$FG!1lFLG7YQpjdtAq2mqj6uX@Uas8(4R1px3k*11nW+^2_@iZyYQ
zSzowSdm#b<Z0wemTn@CQ2S|W+nbf_`W`m4M7BT>U^RZbv339t#@)~+U<=Tonuu0N@
z4*)1^ENr81B>Gi)fCy;+{`|JQsIJTwnp|F4wj!zTnx=*WkdHO4^G`M#Xckux000T2
zN9S&jKCWK@fa2$dclc%POQjXK06^Z^ECIr?wrc?ZV11t{y-cdE^$Za3J)?XX2~6gi
z008u%p5J|5#FgGBgaMoes>Z=x>$(O405@Ibl^$sj*3vRKKszt^l*Os7yaE*fc-(F6
zDr?u!LIea<K3}ZsjcT^|h64bg4*T}qH~W@~89@8=n>;q0g}XL&RfNhJFEVP(fIJpg
zAOQgWgb%X#7j;)aSAOV~sj>cJgkwWjc4&GI4#@zh?@9qpE+A^1yHz(n2LSHM2S1B8
zVANwzTL1v7?%84H*^t*4)6&q4|76vok>`q#D*^xj-x(8Ufn6^+)rABgCyzw*N%mYN
ztt1r&06M-NjlS4Ea=Yw<0U*EckK#aCG}#Y?17I*wkqwjEr{b1|p#sFln!hkEH7|)8
z30ndH?~2UN!uAl3H7~=VZ9ZW_liHUa&}6ZF0e1a<2P^<XpOLp91L8X+i2xvPf0e7u
zY_Ek=A`1kF#k=ljsID63lhOhJ;_iE8%-cs%`|Qvbu%d72p=TqKLWf5&<|c-MbX|gk
z3=os6Sr}JXt}+Dz0I69&HhdMgj()*jt^xqaahT4T$cs_aRM2VGuj5LAD3{720L12)
z{4T<q%UdLb=>PzUBA<b^z$Pu>m(cWHQ!^GkARth0c6xAOcz+xKz|aI)wxl30M(lS$
zGltUsC4&nVM^ln80P-OvZ`YH&<|X$QFJb^7crhy%O6*FJU;tvfxQk@`hQf#dhowh2
z-ZP>&pat06*~Q7i1oV`$H+>7_;Rdn+pAwuLyu5sT|0?GBr<k3MpOc&aU&XwCi@Di&
zxjFw9bN>}0Bm`uYu?M>V|0Z~V>`#(Z{}l5A*`Eablj8%j^Zm|=hyYntOk7+noWQ>u
zs+ib-U7+o_|KqZ@vgun3vp;g>K_*rfoIrNYKcaqTp>m;G{uccw&j;jT`?owdko`$V
zRp3)!(jG3dYAz-&7QcHFw{x&IVFR-NQ~h_A1IW(tuj(pJ_GW4pE<in~mQpf6R&@&x
z7a;5JZY2KsEBVh~d7!~l4}Wd@r2ms`pRA$o>0t3ROsn6YP8LujvHwv}(ZbxuM8e(!
z+QE|!yc}#mE;eqcBvwhNDWMgefjs|=P1VBL-qp#>!Wqc>S6wjJ9$JC-kGia~PWG-2
zzxz{zcIjjSc6Km<_GRV?6$UMlvT(C8vrv_lc+&FU6nzr^S5X-oJLpV6C(I6NAt?(p
zdvmD93Kn217i%EzAC;jk|M4P^tXl1UFp(?<NFE|W{e?tukXc-U@T&Nl8UkM>#TZ*2
zf^{?}LSVQ_kktIFkCmYB1pX9#6Z;&uVKc+ba5{W5{*W%EbIsVYF-px~`oz_BddRkf
zk$SJ*kT>hRUQ{HhvY<3+g8yYDu_*gOucV7$63-0*P8m8aNxqNE6v03`nnCVhpwPR7
zS*OdUwX&VKBq5K%*60ylq#eTh1|K&K@J8ATFV}<dv$IKF*>iS?zlgw$POGoa5C3Sc
zP)LN&1410=6|+%a@N(SwgCun>fcJod!s?-*q1sW2)lGSuKcj>~>#YDxt`bcGnLy@h
ze~aYaJH-lmLLMpkbg$Kjb?vDD*RNe@73Umm@)ky0S^KrSpuU>#+pb@BHSI}71U&Y)
zzQ4ZO<wA~j9r2pc(vfzXd26d+HxP=Q{^on5F3$|8uZJyuJi}Rlh8ZpEP1v#c?ZDgA
z>>t4U_~=ZbDeZ%m>%1|4Dy>-~QWB(e#zE0}e;$&&boEsQ6?W<QO35#eQp>3%X9e{y
zSyr2wG`qRK(t;zJOpQDiufKuLzH0BiQpVm7uk0ovX1rS|yb*tX3V-QUfBnG|eKw}T
zhwe7>T;{R4b$^xNNZfdQLrLq(Xl(Z}aL49O7y2>-<uerOooECr{^+c6Ph9~!Ir>mL
zfrMCD>sO;A&I2V?h60NcTx1gLY$kJy#NboPFuR)69<2^;cI;Hy;%s*ZBqWV57m}<2
zXh#|((gK9N9fd6y13Xe)5p)e{T@l4InQ|ja0mI4841%n}p%eW*@_5zomVMS%8($A5
zj){_$aiXi|q$T8rJMe6G^{+I;((7+s_pVuxEUorVSZE~6x3-c+yTwzH_L%NxzUB0k
zLpLP&I$}gMe(t0tfM*a$=WyWb+%7N0;-INZfvclnYpFRao096*Tdn5>`BAD@)>&Ie
zd|o)=xSUtnG@(Rwog=JEi&VLQnW7s*K4qq^$n4Eq(CDzkj8#3-$QKwAtOaBVExD=U
zDYPqGw`H1;m*#%eLYsj)KQB2%-JPa5GZd^nuQ#IJ2o$#ft(LMkzFM|kh({w*wPh>^
zMPsT?WFPU?t_m({;wDNpoA_B5@)tf=eBt$jaa%Q!;Y;@Lp)R(dDN1kboQ&y^wr2wN
z4)jbRkWzx}I^z2sk}S9^xvb%>q?UfA%so76F{{z-b@-fj`6TsMm=>2_7R(b&s_~NZ
zAEPX35ntbMmNrCo5Q+}pN(p>x>gho(AvqJ7w110vVwGvhXOSZJK8eFLg-(6DqlHdH
zgsi4${!<@)dcO2EC>6&h{qjpQIB1E4sRnn-%C_D<-1P@<F-MRcew8n==ou%`j*(vx
ze^gbyM14L3D@=`t15L1sYKGOOs%>=Ak%8oAHSy-y`jswUX={BX+7Bx<WB5lg9XvZ&
z10Skhmz#p&h-%abd?rY@rM)lGM0ZaIR`AhDS2+UgqKq8s8d_+<lsGd7Bp%~_x-n9O
zzVp+X4dI0W!&_JNbl)>~C`~rz0n2d5^bc`$MIgWa#kV1F%}i3I2T>w*^6%c100xq0
z<meVMY4b*ai1!_7&j+5lj#mvzzmDt5M-|8_kM3_h1eLk)X$9;|UhUF-*V|euR2t!R
ztR*)?`f#0wGni{|e8xFf@m49kO)snAI;~u<_A>(bV;R%3eq;{hm7*#_v50M4#=Dl=
zZ`waYF^%#WetxQp+%WZv<E`)=(@vBXj?4$dkUY4n{m?BbYcBV>5=joUO{6b-Eq{G6
zlg6;n)N`xO=|CrNOu;deUdz1w?o2lGx{3!Ys_Z>y<DpsE%Ny0Y`;Wp{kyo!eCN|zi
zE;}LZo;cUOCYs?Xw$A^KT38hxsN&{$hPWqK6Q*IKMn7waga4f>&)ShE`|xAdx<IOg
zNsQ=3oZ+LFzC~aJo=5oC0bu2#G_B~(BreG#fRX*x(i1}cXCCl7vOhrpI~UKtaQ!!`
zJQeEw8-$5JAr6pL&DGT9H>4@pfNg=Ss!!;w2jt}CWZ~oB<K+T!a`Li3Me*_hxj8wZ
zDPBHKASX8$3kMG;-xIb;*gKg+Vdf9!u|1WD|9dB9E;jaHXfHrk4ORI+A9U6(E)LED
ztgP<t?ktw}PA)cJ3l|nMdl0MBUsz-{^E9<^va+*xb~bVHWVNw(VK)B_dCYFEc3=x9
z6H^;I8y6c3XZn8t(BLmt^FFbOzYzErtN&1vzue?^DF={M(Zt2c<_WDi*jU&(pd))?
zIBY=Xf6qbzoaOhR)T~X+ZNOGQ-ha`Lf5^e_g1;U9Q|oUJlJ<7?PHGM&W>Dn)56EVf
zaRvV|%Wrn|Pv&nMDSHr<HvP6I`;#?QO~6p9@nqg7%>MKHL@C&w%2?Rhd3m^a*`S)U
zu=DWoaPV^dPV%vF@^e6$*HcCIKNUIHxuF%H)`89(v>G>55(@{kDK{S<$5TBesB9=7
zfN~Y+ggXCj!}j-wi-(VolM_l!SlHN@**W;R**Q3%oCum@W9H@H<7VUG;rhpl++4rC
z0!q!G_JK-qadNfz^YQPD>No58YqbA1(S#Bzs6+l`fB%(f@&kX*{vUGqUzq0qE7b9~
zPyHR}Uw8aJqK>@(Fz$b&j(=!1>+c)c8OZk!ll(uUj=#nKRrG&L9sf|+f2WS+8pB|0
zb_};Z5Skn^MST}VNna1?<7Z!Z80NKH7S!T>ihbo*wemJZ5n8*>r_Y5X$O5ldzf*B8
zzig6!Wg}^J<aIaCdHa(n&KaH|p}ky#Kt^{Tg5&_tk)VpOQ_ki1?Jf<^kr!}ew{Pw;
zItcSBlaR+Ljp)>ytdZ?g9I^PV`~#?sHqRfcK_O@3L3RAv#2!IJB@<=IZ-pqvEiUW}
z$x&q&CIjC*>BFcj!&<G?$cl{)5)N@d(KylE;`=X>jW*cY{C8159bM(|4mNz1+#(eU
z<Y@bgguJ%%U<C$$AR1>~6#}<#`(87_rpBrjQyvV59#wRk1sEb`2Cqg{Ti2rae8=<M
z9ji4$^SU=c8AYSYAABhWimn?sLQI#b(zWTXiQJ+NRkcwwR$Bq`BnOJ>Zf5D(eCteq
zUhh6YqnmEr{)$jAu25f{|3I13sV_F~e%*o32?LA7KmKS~)7luHa>IOItuGR5$jum=
za6PY{_ISeCXzH8UnS3)|?zhk{Q}*GI_1I$Gj`L8$^#l*ua?%}v_2k_NAZhuVHkllw
z-Injc%zXl<LV77>PBd>)uskR>WU#B?Vjs|jSqCe5l6a((rI4tD#gLSGIXH?tnKHCg
zDkzS6cex~RTl{i-Pb2D#i=F8WslR=aPa0<0m0@~^Qq1&0F{|V)4XJ{<9#1{RyNSJT
zW4!Tb7BLdb0k6xWzZEvud<E007)q!gg(GlXF(w?)2Czt*;U+V|%ceMYB>S6XOuGag
z2BcINwEC&p2y1OLd(dkegomN5f3pp;=Zmi9oSv<`2g4e9#(du^U#N9<)D$ewp7opZ
zkI+nPULW$p))mkd?Pt);O%8EO)UWM*c@ywUqDM=a7b2>M83XvgLC3!jNIX0|e-Y#N
zee>k`deAWVPf+K3inD+3hQGJ%|AQz34Y~h>vA-QY75we+|3{JkCW`#~bNPP<MV|2O
zzrY3uJMi~(|9=TKelNECb%#Ix_j`Q*!PcG%*`Vyp#M$D{6-5mh4P6~ZaVHxSJ4JQq
z;s_Y}#Q(%tSmn*3YY#Rqp3HJjEX3Ii>T)Jvm#0=wFb}13Pp$}M0P6M{V4L5|1bqKO
z*?-*g_j1qwkv__97ETT(&d$sd_IBp~1Fim`-GA2V58gp1@vm0@KL7tCEB#9=RSPRu
zI}_+C$$!^e{7;eLe=!&T|9Urb{nzmE-<-aGDfYCO<O=#9==Fz}{wIU+|5>v84}<+?
zPya{L_}i_1&*A^XxA^~Xh5w`!JKG<g@*i6L_O`!T{qLv;JKG;$g*N@yvX!suAUKE(
zqxk|?q%aJbEv^QuO1+@8I}bhi3NE_kliWA$9{$s7?k4$+PpV9T^Swidkr9wfHIUcn
zx;t+vqR@d?K8eD{GQBbLp%->R)}G-{$zXeKIihbci$jTFc|1!58n{uS5{~C!%Q9Kv
zItTo3_DVqq!?ES9b&BDcEw!R-0cT7R!N!D*Vm~O4%7_ELA?wWwOnHk|!fjV>IM=oF
z_0Xf{%b+GE1GBgU!%JThca-ipNWse(O=C;cl7!@~-So%dUNV!Mn+MX$dr+p(DbmA=
zlOGPS%%||c762=wzudJaZ6uSur=~ukPmj1TnK&@v!`w#SIls#lI+06-cMf@_BQCGX
zP+#BRMpFU`n#;0enOv~l*?NP~#MueUKF($l)&DM(Ue2P+zS00=ZQJx{tCD3~P)Ft{
z8wD&L_E8Zp=m(+_O<lf$%FP`t&(6}j{|cOZPp<Ueo1=flj(^QjbjveioauYMhviIf
zH%lwa6UNMWJ2z)LaxpA&f?>MUaDAsVz)!4A#5XLM81OhSn7E*p@^`ujxTqN9@OmW$
zy6C`i*|Ks8J@uNH^V%d`@}|e@<-_2yjmO(#%N3vP7XIbt>ju$WUKk7jc_4QH%&(e)
z*F&JMD-Q^>LeBuA;O%!h7b|+pH+-SW8!L*{V0{ti?#bzT0}!I|c4D=aLbhM$^|ld=
zwhv71q&rW=sX9U=KwCBDI?8I)sLJluaL6-{Hkg2nJ>F#@5QDo0Az9M~ceAMX!;}Sz
zQ29O~AQpdPV;CXIl1a{&Yu&Y36d5q9+~9`M(}sKvi(GAk0ZV>O{g6$$aG147KcQ5&
zYwP2t_kh&y_62(c2D$;~Dyj!z?j-{sK(~Wc9OHTCXf4(qh8;jCE!_4PadwS0?7$zn
zt3gxcS>2lB9AfOMStSxA$PFVPZ&AybyFSX3EY}rZMI5spD;kkE$a}4}L9gB1A*%)Z
z2i)wt%y!s%n%Vd!)@$Qq{!=rDfS(o>*!5!Y3SBEy4fgdbTMq!QRZddaxWJ85aU0ez
zrv@{tRQ~XIfxYQ8c-xj+BWt8D+so_GnFwHF+a>9ODn;OYo=G}Tb7B~6&FjBDW)opR
z%xJee<+BdscA$IZkmyY1Br673F?-RvZ)VIp7uE(^rCr4?b|`Wl-BJo-D+Y9(UevrZ
z>X1~Za|YFs#u0?cmOP(YPs!|1?$BE$Q0UCf%j6F^=+aq?TtsR|@(Mbuhp?`4wn0w}
zglwF=-BxsyJ7!qz**FKh0G*<o$`S-7JK$sm42%u$(pzF;oRN5MoVc(d#a-v$?B{ko
zUkt->N%BnbjSwEiH&@<V^pKfYeRfK9%2~Wl%e`jmfpmxb@B&pzZ47%?c?f-;<j_92
z<fh~iX$a~1U241N2c)Yov(=Y;L>0kAt8l069`K|=MPtd<#2I0&7M7eS>A7FD)=sqD
z*u7~XIZa`r$)G;ckq7AMk@~rdUTlaPUAl|6VeM)+{b&LCt7dn?Xb<rGyYIkv+$ONG
zVUV?xqf^71=Zk3W?V3KRW~a)hj5j2Af<keChjY3}tYT#UL~G1O+<Oe+h}iWL_8(e5
zlxg~K*k2TemY5NyXF68$u<4z;vtG#Zbdp*)dt}`@pgThk5o$=S=dGV?rd*_eJ!?T3
zbxU#gOF@{AnGdUOsxEI3g%!=|LM9E7Pzm!E#r5A=|LI3ywph06TfF);s@=&0p&2i3
z2!{`!C3x^ut|BO|i)^yB4c4eD|A*cU^Ko^gY0aqc8`MT%Oy|m@IOmu|4T5mE?zrqO
zF%=t&jM<$6KWCDSsU_R%w5_2o1(XZY3;GM%Z6;?Jf9KCbcvaGN8N**B=jjib57iD+
z4^tP-j}4BU4YzkL4u0}H_=mK1;&xh_M322(WIe<d!N_EHdmuhUxD|(>3w3<9K;-o9
z@GXu+%{R(3GV#fQE##!a=uxjB0ZWw`Gcs(aoTcUsuF5%NC~kc9!xoMi`8b${>A**f
zvi))SYTASBmU4OOt0)r5q3zAQAN2IxXsy+wT|GmXCJM3Io18Xdudgq*4Njjq69W%<
zPQ5il#pePIjb+T3Zk~A~%mT265?668DfAJpK6U{5cD@Z0#L0Hzvl|g0-L{{k6C01o
zMN8kOi3SOF2>lQo3*7Ud@_<*evI@Kv!_|M*3O{OAO1A-CAM_OUAsRN}rC_x~2ww`!
zt-!;R47~_+{Sx7s^@!*D91J6?^TMa6IojJFr=>I6SlM~DV?GU5Gw{;b1k9{G!u_Q!
zuo?hI8-U{t>kLU&Ama&yl(B22M|*x3QCK=kL)Y(*Zs(?m=ASifCWzzj-nhA?+s0<<
z`M{snQ`xJ3sP!S4EbMzb(+Dd2EKGneuQy3rnm4IXN+tq$Kp5G}*zXGk1k1=#@P>F1
zy{@aN3KEDw9!tN&>A}nkPqG!d>GeTz*Nh8K*k|u<eO##n<A%`Rs6$Z80jY!L3S!Ju
zJPI1|4gcDN<2={fj=D<dfF-)cdxNIM878LT_VRl&Q72RTs5fzRe@i@LFh^Q;6J|7Q
zWgr;}aT<g9DKVsdWp$?obx3S>D}{}-%K4OUF;2FlGv5_uThv_-t~ah}qO@)Oym1h5
z>gq%b`b|@jd*wimFayVyMFI7mx?>fc30@D1>9`yp&hr~z!?-+Ku!dv*d%9ENL2_gU
zMA|T}Oy<39Jf7_4U;CuyqWrj83P+mbi>B+P6se?>raY5fL$Bj%P7^pEx8w#zCiVre
z_AN<@58jxdDP=IrB2o|Y@Hr~Lg`SWk*>UL!&<VZk)T8@s%9qein-(Nljg-#(WuADE
z!+h^hF(?yhZScscA1)Ejs!y1qon<~m96wa|T|YvT@hMOa28US47$5dyq~J7`JR0F5
zmJ%AJu(gS5P?3`T3*kbO(+}2^<8%2R5uoqdHs>L{tb9Ap@dJY`ez`D&Y>sklA<emO
zGQfMt05^;W1fJ|b9e!cq<@9T+AC-A%O2!GDD(FP8n7V%5e0QCtwcg6OEA+VhjpgL(
z7;)ku_<K!<-Mm0yp11A0q?ni+!W;c0!ii=Z<km||q42KWj2rN7MNcT62YzdTd`_@X
z^1Tn|`yhG63;k;8SBA-1EjD1zoQ%FgJcp(8?qj)bfp|d}%AjGz4Z`;kDZi|%9QQxW
zv5?KVES(FR3_dsdK9O&l3Z8>&8Z6&}kv>8j+I^dkA)F=FRe3<DBj=Sw9E$nzTbAW|
z4%f>w&P&>F(GSLxH4iszcQ(N{pHuccWVUPM;4*pl;N*n)+d^LN$vaQ3!1M%|_ZqR5
zr)N~Isr_1kfq9nWl1B)3UrkXcENIU95YC1%N`Jh8>(W*z`)z_JNr7cdvALrQNoM0~
z_IJJySm^$g;xsooJSd9+?z%J4Heaq49VA_Nzc6sdFc+uS5IgDKZO9K278M-)*nZiw
zsVO$4;UATD{A=<@fcxno3^Uv5<D^g*m`sF+-)E>B(fPD+`)&@6%)LKnX}PV88NJp6
ziHGe?QkY6oUO53htviW=8(|V2PspQ3<kaK>Jf<0SdEj<DUdzw7O?FAx5sw@4poYm!
zrp5*j-PTNIIF8g~Be(ts>LoQE_WCYubu=<w$4Q!>?|Gu%UZI9<@e*uw)Q1N1e?f@u
zO-k?d2Q^6E_gAuiH(jG3l0$31vC`UdXXR(h2qQWRGq#G0q(~bFedl^<gEl|aZ1YwR
zJd7%@rVJJcSQfLl(`Bol7tgBGzZD)&p~xgU(;g0mV|zpHFkSI-k<T&}fj2gL&OxlV
zuCvDxwFy%SF0=COqDJ%rAzB(hy9O^oS5@9kp$aZk@-Dt9K`t(i^b0^+Qcp)${JN-C
zT<k!q2<@E>sIOu&TOjyAyJ_U3>!zf~P`e}Q($}!}=4R;8G03V2nQ+=>_y9SAXH+35
z;UUKeiTo}d>+PP#RbgL@yHyF>QME6u#0G$Q0_6FP^xD)$F&ctyjNp|4us2uI_$Uvz
zYrwDA<(AU7rFTcNvBVwjFdNQBRfz7$yB`2HDW&w0PSYNWjtv!rqmV5n9mM$^33H<{
z`4`l+EU@#kYxkU*Vj7i%WE=7&^q+8CRF5S#VVL=`toV)eHG;528Z;)yJYcm=G`_{d
z;HbjEM!tI;G8H(WK;sOLFYDkhAD7>B<KH&%!iPFXe=kZ?qoAEvb8c(BpW0Ow&PAGn
zy5yj7^P6qmxutfT31!FR(Jy+-F_^oH)!Y<8lNj@#sMh(m`B!zBiSSy;s8@yuZ8Sn`
z0waR+qWnGvE;($Y+{51a{)YAZjl@d>tghu_Jg0F$^aJ}a5pl9JvIf6O>Bh#_Uaw`a
z;8tqin{>5br^G#1b@*yd{eHUTCGtxHi60$(m@eU_o5(h=^Tc<)IV2)VzD({h4S4pA
z<E(^+oIoZHK*<j~M%A8jqjw$e*^9oEwAW4zlZmIwCW`#UhJpv_HW9tMt*0mY0wz6L
z>-tCeJ~pz)oxpmcG__47Y4QH#?AT;KWgwa8$$j~2ch-it$F~b2+7Io4B#c_ebB?zI
zwi#o$@gb>gLKezA*YZ4>_diEuue-=B$bMdN)j_uXIIV;`<~9f}N6bDacF@j{&mZ$M
zTl@+RNU6HVsWE4oF3#z#kh#w9mAbOPdlj&QLFK3-eoB&#7NQ`7DTZy-#_ax4W0sw=
zcB{4Sd88qGq#-!c&|{>WO`H@-lCDk)2Mt?{Tef10W_JBU#F2J)h{4epv}FW|^n_pX
zLVj2A@6ne_h{ko0_78$;$BL;po@H>1ffZh&=HS2mb#<f_G6FID`A{$WpxzMNauk^y
zQu*B13V3WmGV>lm=>GypK)1gNaTGcL1WXxZ1VoG&bp8cGD+Hi5l&COj?4fjJQ-fsa
zYRK#5$EyTq41)sSSdy+|DDLCp1cQR)fOwp=#$#^W5?9F6#@o<AOF?olXcp=QLS~`i
zsjd9r2q}+%N`fMpdQu+lL&y(x-B9s(5WS%#X$ErcbHZ|Yyl8yfN9xG6cjHUj4}b`+
z|J9-+|DWzgD3aWd+>PGM>U$Y?8Gn#_oj)kNCB7XKhAEB8IQKkdx_gCZh4*gHYo5;|
zpGQwel-FJRy(p^3^a4Gu^FPg<#-n%wh<GdE8IHtdUF7+9Vi8{~77=3+1|l&MW7N3b
zhMwCq%78{24DBUP07#ejK%~eHp~?=S%7joUH<K3!-^a*Hh!q}0Yk>)L*xyo&z4d4c
zx*4s;Vxb)sgF<-!E=qPyXF4#V)ahqzdaLWKtMBM+I%#+auHa&WyJyC|N<WNuFy;V<
z2K$31*t955i79^~-4A0>-@Y}~nCf_;q%R>!zYk*;{$qs;{ZKIV?Bm~Vf9$q9o`eUy
z-~amkvsb_H#xs-SJ9l1LH|@~vhd-Y=?*~tA@*e&8>zxfRzV_V4sl5pWPRM=11~Ber
zVCz06M45bB9s>!mryKirg+msZyig24LK_(c@4&L8jHQJZm*p~lJjTY$VqBS;RFzN|
z0*|Q^YBPm2y(T_9T}hblkxKFfp4$3)y+iN7li%^C{-&o^Kb+}9eq{1XIW?dTR@bZS
zVB>mYX_UDxaHBrgH$8BRy4<&3-Q>GF`eRk*Ook$zOHtjd0P%exnNuQt4?^OVQeh2#
z7(W|oN6&#Unr%tAmmKb<>T#yn<4m!qix+zqPcd&ckr^T+Vy+RKLj~thq3cj#ahkI2
zGz4iqjqsD6*-y?&Z|M<ggZ+1h--qq6KLB{ZTwOeROGO)eFpnLX4vHUnetag=)Ww!N
zPZGN5&?&OmxPmzg#tzI};KD}2UcCJRgcVby5c+k24t@{>5l9J=Md=Bxg%8bJ{pvHT
zs;>2UT#MV*&z-Z`*P8hHm1XbDn>qcCE!k5a{VWIX3_Z4?<&Krxd{3cetESztZk@UJ
zty#OLPkFLu{3rJv%KrTeqAf%)$I`iW%(qpz{{T>O=d72>_^3QZ9LmCZT1qxMrzJ<(
zIZsQ;X6>{TM9T1JDNw;BigrC2V3C#_EqPi>w6w*7r$L#mJg)3e-d4D4nQPS_vWy3l
zH&A#+;A9sgV0ogd?=Y;7VOT~5NKsjVIfxDd5$jf4Eg7&ZJ_NiYvu$YRevXr^g2HOq
z5gf9uRZ!p?s$R%#u%D$0R#CEASd*v`wrGeDgG=>Q1FYzoh(Y9Jat;Pg?jz@*z3w)+
zna=lLi3}!k;|w9|I{gcsiVgit-Pt;$mP~SO?S`Hi7V`s5)9`d-75@NGbD!<@)M9S?
zf#s^IWr}*#GHgLX9l1m!Mh1M0<x?zIt+HlxtzxBXm7*Bl_Nb-2qY-BQ{R1*si>!fF
zMwLHlFa|^qcdkP}`oWuTwq|SKlpizuE?o2D>^98G9_pM&_yo}p6WsG44lh_<FP%;g
zEnSppP$k7hpo>hz3KGamwL=drnUJH<P$IGqB9NCViym6KLUg{#L3FY&<w6Gl#G|c}
z;e|1`9QXTU9wNeA8q3CGsv80!goQm-E-64c77;Fl;}ELCB-MEsa~Z;9$~;sEYP1|4
zSzfTI;9>6z-k&QUDZh`3k~icok1$d%u9vGF3ls)(8r>`VJznoSZq4WR`rMj|*^T8T
z9kJY7-N^0MEI-V5YQM(9_X#V);>9vZ_lzm}&H8Hnex23-A50}gnMw$PkRC!IhpB|N
zn4Z^Q4bb32nDYAXcJKX9%%$*B=5h&pX~Nh>qz@g3CIkO42R^w$?3v*($^j~ZsPusg
zn=tD9E82ADH<-zI6aEB)84d9J1gsgR$N$9t*o}9z?%aI+=F%Pap^rQFk6QP@At)}n
z_slOl;TnC@J%^upeD|pO0Q%pTvr8vu&;I(Y2X>zz9AyN?FF%$;1)v-;2eA5mnvRXp
zmIq8{v_uCeanLB)g+>Y6KB1+XA`?BDat@-Y$hJwMT$E{r8Z3lUAOoYNaZ81&inW+1
zR}}ZDavXw`PR^p{i5?H?1gC;jq6MjW63p8YM?N^B|H8qorVjmZ6Tz(>^TKeDVEG4y
z2bmK+<IH)?bYZ$U*E8K*BHj|aOI#oONc<pR2qu}>5}Rl6<YBNlBT#}i2&AFJOqvPO
zV31ypRuS%J6uwV%$2KC;oIXP$aKPS_Geju|vr=7{m0GM*%+evyF@wVoczQq4ef2FB
zn6ve_ym3m^amtwEl*Pu|V69bDADj}rIk-B=2C4ZMq@x%NkaL3p($ioYD&CXnvNUWt
z)*baaY@tSl86KuQo{>X|K<mz>u+0I5bO|*tc!5YV57BgzMZnPe5xE9^-O!LZzb8~N
zY~F+`$KQaid~H^1=dH)q{V{v;M|Ypv`DtgrQTL5p^xQMIt$2|g>z><dM6WBp`NOp4
z>_2|9spEDy9Ik{rezyIM3!gT<*x2^eqp!Y-M|3KdZ2|5Dpn?UK`>+aG{D(wV!oq_v
znqCO9lA<nV7(@ng6xI0{6w$=R(qF(Rj7(DyQ;#<{!`0XT3cK^fI8r~;w6Jc(nU0bA
zSz;~dcsPhISZmbUiXSF8Z%x9_1BMrpeLbFjQ<=S+vmL|xY6qA*{&qKeZs+EQvYzbu
zw%_lBU&FVaBp!jWm}<h9YJwmMdND%|fS6;dM<^Q>LV4QB*A~(JN?P`C^t`ez-krX9
zIJNAHC?&<Z_9Jw^%ptrU^tuG9qz!3W+NTr5DWaS_*0mp@`(+Mir>9emx{@}eLl@b6
zs{*3&o<y)>y9JH!+0&DV^IU1%qsECwK^+HY_EEn<Mk73e(5B`X8U&z?T8JTyM3OVk
zQA`(2GsS*|9PX!A^i!JlU-S=L>U<y;N=I#Nmk(k;?FjF5gtt3#lKLVvNATzGPwFsm
z!73t^<hJBYKb1Ou`lJ`1&$$`C7p%;8!1)oj(yt}}%L2m!!_r?UU-jaoUT_sy1y{05
z#D%U!$}Q@O;5}dy+{~^Q*Sgjz>(zUM?-_4;Jw=#(?2efcvN6p{vgu)_2~P=^nF@%9
zfP%ZRwI}R0(heJmJ8UFQ*a&5!@x`x8P-;iBKqh}s#yKd{#cMK)HOs`jMuR}pHKet{
z2dr?P5M?kS%3wm2!GspKFpz0Ovn+oxZ7imZ#k8?_vEMPoO~2(w{w=-Va%3A7Xw;!`
zrc1tcY0sY8COU{jqssFdD%YA8Ed&c2|D#f5e_%RYQ=PZ29OW6{8n3S#&*{#9;M@f_
ze)0ODujkF*aBueP#~)|UK5)bOd9&}jd*-Z-1BPuGyLS7|J66BIM9UtXyY-XfTW3B}
zR&jXaYdHYnq5FRZ$IV`M=agw1)?LVr*fQ$*HFvzY-SNi}%8p}sxb*<gFsUTTaQH)Z
zNhKgHlQyN(flG9eazLj#IN2{Cke||K2`!Vhn4~IMqKmi#y5sC?z1To*7SQto^i(&e
z!+uvGR!&j|R!z=Q{0`ZYmI9}(Qi9+igJQTrohwGjsK~fV<C?qBJ<83v-99iHLTX5=
zy1|c!L_aDbHaMBQ!<nW&R7&)r^M{e2P@_&H?We!!azu3N#6^wIDyJ%+L5cdm-1X9X
z{mZQ?yWhyF9uT=UU?nF7u20TnZVb$i%u23^tcq`r+!KF1up{zX<m<o}=2_EwdElwQ
z&Hyu@Y&wrhh_;x-v=vI2yjdC_<(@)R!x*_Ge1Ehpwp&Rj3LP3NbjYXB@$wY5!&>0V
zH@nC%lV+FG>>|?IxKvHtQb9BTD~MG9iVi7CM=8-3{6-fY8J2;JEtyN`2utcb4dp4Q
zOG$JjHE3E0n;QR3CG64)uRt}`B}7W&Ex_dCF{ryR4JncMDfKMa8CW@W?5fdyVc&!E
z_g#R(oA-Czw&H)EdHECc?vIx&+r4Aus%>zrzT&29SO0E-5}Gg%ioZJ!^~bY+&VHBu
zGP~!M*O}@k_8oq5GZxjDN^Z`M5kBNT1Vh2~;2+lYY(h5!iA1VKt#S``4+{-S3@IKm
zZ0Lk>?iFS3K&lL;rSgJwSxuyG?ZDK8P-DTQ#Dua5!x|^d2+c^%EL$2`QLw1^uF$&3
z=7M_?8`5F7KH3eKu|(|4T1hY0Xcuw`frIF3Fc1t!2U`aYVB|ug=nsHqW<dsJ+TjRL
zf)4Jhyt-HupwNcyv^0J66`<I&RV(hLFTe^{JKO=H=&9EF{^iB^cnKuYQ<h}bz?yKw
z^_y)yVMIqK(c7Ck&UBu{)_(`6?C5C1sCu$P@2GD&iDxCRGY}V1iVQhnS=31z>{rFu
zW8JT>r=}VeCyQ9*_j%YVv$$Us&$G#*;^Go~bUzPB^kIVmzfLvxk~H+?=Mc}98?kp^
zxou42_Bqdfx9Iw(YK!)4iI)}BOjvZ+OWB=AzRs@t@I&~6ze670(6G1a`|OMV`&stx
z?Dqr5O<w_j2CeVmJ&UHkx9@j@$NSW5;Er+qS1!DI!&GbGT<h84lV<;J?bEP+>!hY9
zI;U>dq9vD)hU)z<z@k@vpPlvf-?LBcXt{mPC#x5I{?Jc;f96xDLG#_WcfOnb?2qr1
zmxST9cRxCC-Mce4K78etU*Y-BbppUOa_v9>Zd5=_!|xrZ-G$b?S^B->%d!EMNT=XM
ze*@3jUWfca=WJdm@}y*mra<=*<&}`^UrD*7OgU(PI;m-!i+Vm}nO=vMlAB(i!UBb%
zThpmm;Jem5@IB?2h+MakDic&O;AmN?_tIyHv!!NzBeO++n|qT#q@UJZBG(8fpwaql
zSBw5P<!|cW+!Cv>D(hxkvc$2hqPj(15EKlHydppV$P;VS>um~(4>uu(A$5LI$C#|*
z!)HlxjuYcN!?&RYmIOrQD+@t{+Mx@JDVOC@OfW-Wt{crBWskGW78bH?5L&L$$|2#n
z!fa8XLiTk{I4Ypk!WsbyKhQq<ZHP+dF#h4c5XRm}Snucnq58TA#^yS`1OIK{dS)`%
z_T11jM7NX+8@06?^uveUhYxSy>@8+O!&_WqhquJXOl)XnHAWQLbEmQC`#s@Jjc^gM
zSO5Db39Dd|Nig07lP=)}237qUHGKL~=M&pLhX4E6kfK->*M4pYd@VZ&O@t30xb@z9
zh}UCg?n`bd_dd2tzuh|x%`HIC7LPoM9h|bJ5Xc05)M;P=SW>VCtSi_89_L<Seyko~
zTGhAIW8h@L-wF)3r@$yEV9NPYqdaC74pk@kuJ=y}&*tV8+~&E*^EmUE`|;Rz_#E19
zeCYN9ABgBaJ;GwV_-uD+EtQdjOKWuvKsJgEG$tBnB|WWO1JWiIW|6`mqA?}P?SnEk
z%+jU^F;Wu~SRuU>!|`d8DR;q^*$Beou^obeyj5mU*CK8raUiS$ErLPHDlj|n6jxzB
zA*2ZtC!B<^akll1%d<cKyd(SDCtigE-}nQpxa{?+H-50=&y(kWvHsaVA=LZZ^FM<(
z{pNExe%Fb2du)C1ne4X@9L#>T={3T&pTbl-5mT)O3Sijsn1yhl7%PZld^7a82E<@n
zF8gm$va?oE{=p<zNd3@~N%VS2rg6j&ts#U|LJ28SSfJDK(5b$vQ+cSHG%94~Lqcb%
z&Om{DIOtp}rIWVYKU!%(D6j8gs40Hg<WN_@r>U+pL%etPZqr4_KK}LYHE_Armx&4@
zFLEL)vV1rc2_fDkE3ztM<{a<^ya9%fGQkA&xN#8@V+k0LjRdiKGnsPySqq!0j6|Pc
zAQ-@=FLI+~D$ytJ{>OH4;wkvgmnPocxMcCj6%QP_E4vHUKJeq-gGW4a<H()a_qcX{
z!L>JJj~;#@o82+B&(6NR2Y>ba7yl@a<7a;cTel?h)dgBDKhMQQQ4j#blEIgyxC@8^
z!L~}>Q!R{Rt}$g(MRG)CC1kTS>c68HCjFns@?5JVb=B~8)Ga@#%4L)CIGG>T5p-NB
zYMwcHaZIrqQm2!l#e?Ec<bThw#TTApG8aB%)^Y7Sv-K}$)t$IUuVcbpi=U8zMOGNm
zelxU00`)-(c~<^Uidncf|Fmsb#F58hXo;K8w-Nw1pSS4qLIgxaVuE}6Uru9#d#bAK
zZI52|wzSONCR6sdAZ~9%5j&PxuIkk$w}pF^V;B?j<@>=_&;r;>V1d!#I5-VBkBKX{
z0EV+Y%48fv`SJa$Grr$A<9pW9ZKh7y(KGBvjot8b;N*tgYcS_-YFxOeuCt3X5?3>&
zbLUfKR2i?oL0BIixrZ@sl;e@(z#WzX5zE9mAew~LqZh1%fb3ypC=xJqP?-NS5}f@v
zg5v)ZL4DC=&pDZCGS?5kfqsK~_qUyd8$SvFui^gbOwdxqau@CZqNU>+7V)6C$PGoe
zYES`-M+*ZS35S*vNb!(nPE!~OKqN{oHxMNxyLj>hE}irmYuM-Zk)vEXAm0D{vwiP8
z+lAIkQWJ=Kp#IPy{n)WXBtVnN*y9VFRE0u;P7qH^hL$WXIa-RC#aT%LA<Cy2o{ST6
zU(^O<S_+P`K%&4_A&oF`P%&jswMGk0VE}Yv0v0hPlLsePqX50gK{Nq)fQ}|uDxfz4
zyfY#6vVb@nGG{8!P)=4~S7$#=Q#Wh@w2WG-0n$Vtii+$~WxeuCJe0~XWthg4u_?8}
z-M~y@m#WL$8&uJSII&jk>mG%MGlK+69HCz2mLElrF%Jt5i`$tO1m1%*x4RdId>n^F
zY%KQTL=1|`b=q~%!s>@8N?6lURkvFw^VIBF<3XNwv>m9h_ioM<+hA`iphz-R$86<G
zHZ5hf3%c6z1G}LMABEcRMuWgHp(yQ8BN>?50v+mYXu^JzYv$H)nDWr}J;r62l)_kZ
zInz`Z>Lh4M^%lGr>9%{a3F|R<p!9Cv2-a?hKC@vJRcG)9>*yENmY)D6cOGNuM_6_J
zh-xjvTNK<@irYw#=lfl5nbhWEJ|FB$)VeDYH14ynU#+`OKML;cfot=zolGOvd%(gb
zVweF!&RCEH`}TtgBWb`SG#-V;a8j>8xCTyv+`;UGSF;UV`}yx4xO(&x%!PA9*muv@
zuqV!&gu0%@Qn?UQmjqwSM}je`o!UzyJuaG8;q_OGAtgXvXvD36Arb46rXXUiQbYp7
zh!TsCB#10S87ScvjtD0;mPD&ep648n#u5Cdtd6ru6U$yJP3fb_bU_o_T+OZpt~D;s
zC3cA)g^C}V?4jaL{XbZc%@P2cSKIzww9A)uW1X3%OdXwMtg}*<sdw6p6B7lsyRc@;
z(iyf1`~V3H?N^Ly(ZmIwgT~&yh#1Fn*eY5>YVmU)+Bc+DwEEa!pIV_PTuW5DePImt
zu|ZOsq@d+W)(UPP{&~s%nSEXi7T90`2K@y5ewV-2@m6&sP8$WPAZDF-?w@>%LG5o{
z$l?iK%dW<gz2^KHl7WVG+E2L;fEz?%z#1OWpilStqQPjCWp&o)3c8}~j^IA`n{Fl;
z3`LPyU>T#lqk>kXfoqVi*T)-Eyc2^{LK7m_NAC$fhV*cpVLWk{<ag9Izcc54LTOY`
z_|qn_hw~{-G^K@1nBd4W!H)A#;A_gd1jnBwkSVOEJTS7R02XLe3TYG<G<tC@O)$XD
zc%mvV;Jb0SaI8!5y{P&&b<OsOf6aozDzH~4wlPt>s1Dpu2UUH5QH`()45q=2u<yHY
z$V;u+eXk$Qwr~F>Ecos3VRZRd5Bw_oTl5Z`4}bJV_Q!uXp540lmvG`wv;W8*h1D>+
z2fBWc{oK}m*-lJnDhPqoR(ysr&xeNV!+n$VNj}!4#4$$%!4Of%far0C^pYHfeKc5_
z7Rl%uG|DBDF%<Q@KsjUeAWtqv%m~DPk&sG<Or=An(jim-pMpD2HA<dp{#|zqcbDIe
z03WF@w1+l7td8<VbT<;^p-OEWn-M6HFfiPu&!VyiN8I>e<2Tv2vm4=UuRYatZSQs2
zySa9^XU4wy2eX}>FEeoS>dANdRboMG!@O!I9>WkQLIbRX$K{5ezOjjgGsXFZ*fgSY
zl9mE3i!tF*>{4xa8`c9Hz~umVVE?qo6RF1A(|d|astvMVP*Sbuw_1LS+kdyGAZ@qf
z<MsTOv|Gb4kaAxWyT%;rnjD)STO=)WFW2spH)@ZlJG3_Kl>19f$FkitG@oH;hNeiK
zC`v>EGVdWdRa{7t0>MZ)9wa@^TRw*@KbeGJ5G0ByT7*KH<`&})Zgh9gpT#VexaZUE
zCwV8wl6R(+C+_}g@~}KlhJ|l3ix(8HDQ1d`La3Wlo?=Mo|B4~}f90#m%eMa~?LJR@
z;gg}f-9#j39#JxxPP|iFNpqv@)F={{CdhM%IS=wmt|g0>R;%d)49@_<0O3L^JKdO%
zM#8lQ=CmICb6c@my~u}uh4|OSIvWW#=5u7QrR7aBJrPF6Bt=Z>+fQsmn-0IX;+^+L
zl#ahPcjk@pH(lQ&G5n8k+g%TjeB{||FRp#mFPA_0Q9-JB<Sp5Su=l#n{ar%mElgFv
z<wIxF49Cg2FWJ9v?}J|G7Y9H|-gldJoVYYD8>BH1>aP#eGD1t$@x&_*;BtVN1JESg
z%P*!@AX-9NPGhFAi<u=Xn<}YcYGVVLVZyZqg9`^04=EYTGzyaot}ngY>rN8nA#+^p
z04WDZJ3xs8B<b|q2iri(0n!doLXdC>flAeMF)C(CQhl}R<e=2x%8BNL<oMK$uDR+w
z_e|f6&~n!bb%nM{zomF_YCW^bb+@`nyH~%f_|DXW>ciT@{&-%6?vY4)qUnf~E`w<R
z$|4@NPwzCCf%$;iV|n!MD2k>6YL9qH3Z}RKNBE!ZMvM25;_(1OnR~|Y)HdN?e$zy=
zsVY0{Z`A6MDt4<bE)gq;M@4~W8N|a>aS^V=HgdE_#3HDEKjx(!0nmdwWT>{HLlcgM
z&2RzS0(sa5TP$}Ea!Yb++~aE`$GtB(G%9t4(4;gdgJneAx!s6FMbB7;<eFuXJ_$RR
zL#Z)Az4v$oVA?~JCUUUHAwy4>Z_hK1P;0pNv`Kjv^2rQ|zULi1j-1PTdvt6O6324p
z3>gJXXT;?OG1y34$_p=&8SK78iO$<Ej;i|P{Sd_^G*m`2&GH^1zb_bIgOsRvEIZSa
z_p4KWx$5Q@$Bv$SS@y;;b7tNC-4CDr=X$PP+qt7<TWx>%al@Jw>(Bq_t?b_(gTK{p
zy7&6477rRcD;b=c>G$l6n}0Ta&U<U!_uRL3(x|Gcd8L=_U3$yW#Y?^-l+_E%(RS+l
z{mcsUlz$1d<f(-({5LzFrxw2OAMAXCKpcwW*#~s7meht8?=fv(=YHOVsFK7fA>0e|
z*~O<U7v+y)o;iN!n7e;+xa0+gD`ssoi(FCM_gHt!7ta<}GEX*rLHM98GB2^wNun0<
zcpz`KfZddha_Y{V=l+K8zYS}0MR){!P_g8+*1$H1Z;NbzU}pfU#ntR(;t=*4ajEt^
zcS;i!fDDq5%S%2-a`+sq#K75o<mr8B<Y?xoOEX8*(LmDLte(_TZ88JU42%w-=D>o$
zngA2{4+=)wl%edH4YHX}rnAL}?BK85B}Qa6Z?D>7MD7wJa+9B^=NH9@?QR>PV?C|A
zrqNMPRg4U1f>lOdajU_KupOv1*ycB;XU~7|tL(W2Zw%eJ>Z5&J`-NSfW-mN@A5_0$
zMqSwb`raGffIdP)00>KoZh=;kxNFun6>Ue7+g60GA`$-1d;`<fKs8cA$7M8nz}tQj
z%9rWLu#~JBS|TNXnw_4c*{N#w`ScE$>wnPdvNPd6u&A4(45W=RPdZc!`Wm&KzM)}Y
zs4>hlG}HjDHyS+GhxA9qM>UjZnpHZCgfsqXu38zy4N`{t$8qD7N&e~FbY-4@3AaSK
z&98BO;xzDx7=MvSG>dxjAv~dpdf}s1oMEwP&I_W*$@p<4)valY&+GB{1Hn)T>-Tkg
zI1n<)R`D2QYfbcvk_kA3u!ZJ>5QI2UjQc}Azdz(rBq{FqV9;YInr7;TPuC5Pq=+Fu
zrx`j%QQRet3F(?9Nur2wpF$pwVE{1_3`X=TB{&9{K*6OS|17}4G5bv70}qGW;61x+
zb)zW~9?^*{_0CARGc<DWj6q*?=@^ckPSgt$WpIAjrW?`SYQJ=Y@oR%yKYSP$b%!0O
zdx6b(4V&=>Hsg1DWD*j$ZTl3iET^_TAZwZOo&Yzl*`rvTMb=qhoL$rey3Dw4R1d4X
z)ReFCdho_uh0S>qxq$Gg>}_uyFOKw=VesqUj7r9OeDU+_O$W2@mIy&#_HB&U^^ZLC
zmty9#&PevJf4irZc?Fw(O`FXbL(e};bmwbwr`Q;K1t<mm&~~drQl;{+8YwSR%gbxk
zzW#pE0p-KWo7ATAx$2zq=3blB^<|F-o`~#F{iROuqlB*7A<*;T7fbhr50)MdA1(cj
z|I<=&Pymv=5t44ikN0>khO=r2`xr%_!eC)2Q&C=B%hpy5W3R55AU0-ZigPkcl?}?<
z%0JbAW{iH-ZpiAD#nr(+314VR+0A9BELQ2Rci-=R+MRQAPrF}rf9q!4T>(2cT|49^
zR75xpp(`sv)<3vu3WA#_DGKg1p)fb~ZMfYrCfJ5vwA4@qReB%t#bN^J>N*%)BKL_g
zuCl56)b5@mJBmmcJ6Xv<Oijw@Q;A~2H}i_rUv0iw%o5I4OtOMVno+TB{!(+~4@7Wa
zi1w@45fjC2Xp-eFu}CJlneLT-HO<u$Lx9M9tYCfQ0B5KLnC@LmJs|O9b+6h(wP<TC
ztR)MKta;?pK^oEwrb0!PRD-Cb45yMZqRQge`J+54<m-9F`>0U#+3D3(e!8jEK+~c4
z5H%NQniNlMLEcSG2b$Bt_wL_i020Q$(AF_B86E2lbh%MS7uTltVdnGC38y}psqg5_
zoU~Vcbe+4<R?nP7cR)3MnuZD%+CgrjYxJYvn(7ie1N90-m5+em?+XNzX@(cv$WArD
z2QhWi56pe_wV{izu9^4AELb&o<Lc!FEuou^-M#U}(Yh2YdMy^b;qc9q`^=v+`<ZmX
zo#ThRbl1qWBYkc)Qk;@+>T!AF!qCEdhFepw>ACFm`MWOf4?iu9>7^qouWp_+>hfEO
z7BV__is``A6oG#`0D{;$E}~9II*<}AHCpPlG-#R6J*{@H)}ZEs#QnbjFo5;MTtX<u
zx}e)Hh-9h-ItK#HWFf2Wa7hR3$OmuQdfefrKIBL8REA0lEQ}5G4h)X<jtw?@n}biF
zCz!|8=k(_yil~O=xo8eEm%Bw-psrD$SN2N#<h_a#P}VDdMvS{?igvTMT4OXwXd>N<
z#w40?x3++--~>1gB%o<7aIudu+;vA(X+%@-Q0Z6f7Ad_IMX7#t#-WyPthJPYid~sP
zEE6!tw%i%4e^~_WphctOeW}7`5hQ~aL1B0`K{6O2SA@f2eu~F_ipPG6$Nu7@0xT5j
z1thqs&qyYx36$#y_WDD5w9q?ReYi{IveEP+;x;YHFTJF><^3CR>!LFx3ucj%i)YkU
z>P;u{A61XBQtV`p!JwU$n$Nv(RA7RBOx>=6Z(sQ&`;SFm-M#Y<g|CKJPu%$8bL-~b
z2k#2*KMD(={4zvqU)>g+cjM3B|LBc7FlQcuap^eLJPc3(U$<7uh*eW+wK_=UYJ4@Z
z>(My*I^WpXEHs^)Ax-l&#|{;Kz<ucbH2k^ubKkeYzl1+8I8m4@3=|e-B6Wef$neO5
z!YzeDPgJb-3=BXu>Tonz9pW1nyI!84&Qd?;zYLs%XWTmUGj5lzfhe9@1IT{N^+Jw;
zN`U>;HBd$7^Sk|Y7E^}i9B?TTlu#r{>H0AP>V{=B8*2=<&?1;?$7~G`VUY%9vxLhS
zJi&8=MsE$OaFTg6++-dNCwO5vK?(v`&6JRqc<kjL_DTeb4W43w8qW5b)7OQg!f_!d
zumnFw35*b@^h5cX5Vz@y;tUlKLWJT>I9@%vo32T$AF5t<b`#7^3+t#^rFUlPPUbaF
z@-u3klpNxbPt;tJm4g*g*gbu)|BS<{KfGn`2X{6<T)C&yeEF88Ki+=ZvTf_1+I;@m
zry;Xx%$3M}ZV2+c_s-AW{N%mEL~akqayyPWjUQvjQ&zAL#QbPH)5JAN<6SeDdECv?
z443F9!X`gdC#~xUR1l*H=AMtabH1|?wzp?MxOePI&xpvCu`!;>;p<{kJ@X?|W6Stu
z{<G+8NCyF^slnjr08#FlKup`BZ`F~mv(cC=fOhmEp%N<Ts2xnFO2-8KkQcLspp&nE
z$pTj@u7Z||<sMc0RcA4cN(43;d6isBDk-mSQK1?sBw^E3x|(eF6Y*9E3j;*tPNw;Y
zRW>ut$M-27=*5CnTwd+WwN3Rl2Qa(MdyLMz%`0Mb#%bz0nfHE|+87z?t2&A6Fb<qu
z*xk?|;naL;TwUkFI;tsqoHd_BVl8smg6%i<2?=V0zywWc=b8U$ulVM`SJ`i&?++hB
zH@t94-hJ1!&7Gg1F-rdlcdy(5Cj_5ug@urT3M|cjmi?!0zS=$;KD2(|?B|Kh@nUpX
z!@UoJu*{14B&dZe!@a^*ctQ9H<w<piDn`^&wIzHg%!bLZT9Lx)0#RiYEha-h%J{r2
z!vpzgAN1wCbPT-~n@=90gBet8)qw>JdJxh$%bwo-t7*I?6DzFV0$|u8)El-`OufKI
zZQxRB0~Zl`1{Hbh_q)80(3kfS677rvU(lRU;zgvZ55Tjb@N2LgB*0lHgHR@OwmZQQ
zpWzv-wNt9=$aFLjBe{;QqpT&1Z3iy5e7eC)0xx2HMwdKMVDMTLVx_u#?OK?@^th<X
zNY+%<RQDs!3e2YooA#5XPrILf+8eoZ>9v!i{rg-u=;%@A@y!e8RS&t|^CNjk^9`FX
z%*2#;Rdx*XHKx2cD2KnWnq4l=SK&(eu5}Ie@lrv!pu&~*RU~U&eSO!shWI834X)X)
zbMoK)?w-ktk}Hx|lw4b~rDAJ^&^OVytiEE1Ye-^n*|@~GvN^)E#I&;JiZvCVl$=U@
zll->C2nKk68`{-c8uJQN6zeAFMFsI1a0na&SVKjtES-zRG<k4QOpycrs#I0?MXKL9
z8F1fQC3KlwDik^vgnG~lHV4-P*$O-*XnY0b#zD%BgI(M>NVzdt&OvLxwz)AmiY)KQ
zbK{^L0;j+^ht|(ovnl2*(O?P`6;fm>q{viAk*Towb?vBjT+3-}p;oVr!kUKth5^c}
zHA<segy4!+L=*R8<j(fGERFJJEu5)Xk|69kGx8#tF3h{N^zIy*vS>=aXUS@(llffM
zleULoAr|35l2}7^#1cDSm2l}`O_f2tR_X4U-ZNiy^%=Ni)y9w;E^Yb!>6?Ci?`tcb
zpYi*xKmGc#=U1)VzH`O0?G2GJsXo&u_G`HZ)_wXYgqt5-b7AiHN0+_Cl>hqB>+k*i
z&7Tvh-2eb{ih64vIsgKgr2N5Zx_Ff;)G4-x8O*e+EUoef!_`62Pz)c#L7>Gr!RL|{
zN9HQdbdxBCRZhJHDaoqpTb+~OAqfVkzztY5J*t$JJ~FWqu}ln_C`Bz3DMF5uXgHj{
zFTqD9ntCYd3M7(RMfcC{qv;4EscWgMx^Hz$;B){j2y6|s1abj3fP8eSeRN8Fbn<;E
zJ3g!9UY#cIRWUL4o&YQjCFNrZ=d2**7PK=Ye%CEZd(H|_4uL3pK-70O(m!-`sJr5}
zFq2Ok!O)pY5g?z%OeC{Gme_b~KH=uwLdwl6QK*WTLjYoTuLT*hR-YuC*lT8uq(P^i
z_Zu5pZ$Gs3mEo<o%o}}g9oOFZ-GfcfJ=r-0ZQF3$*!xy>9>m;XBc9wkl5YeA_<|Ki
z@<q2#K2224dm=A5M&t!&`J)Z6M6?x9KastJl9oIz1zO^hI~`TJ(@ALUbP`%S?G%5k
zE|QcSTJp3MXbEkCy~;^m$={g(^v(mQH@Ytw{!!8vX{*#C9g>bqrzHVMh0+3Pjr4TB
z>V%Y&<U$GS?*fY$i6;SVs|UU7?GW%B&&s@z;sE<JyOnKW53wg${t$bbMSwNgV|b4x
z>9=(H*{<nl>GZQQxj#z<1?vb3)^VHCe#!(D*pcGDBEh0Mx`Y-_bp|>f9YW}fy8Es#
z{djAt{0yG&jjgS%>|c%^J@04J=RYA-if5Dgp5(`&H}~0@PF=2h(E(T@*m~P*DCkVt
ztDEyMRVerg{6vY-)W30Oc}7ym6Z1}_QFZ{y0hs(sD1Q8S=2jVbc+;Dx7D*t|Q&KGv
zl?rb?9IZ&u3Tqv%;aQer`F_$+mP_$H<Ocax<`(%A=FhzFJP(t6T1bhte1EB49i=w1
zjeLX9D6L|bbB{@H^1op};!pBl3IE{#Df&IK%rOj$cwUes5${N%m=buOAn**!ra0Nh
zak7l3n-w9RN{+Y#T`nNAZBVl$j-^hXB9ZJ3HmNnH+u`~xSebLtL3B|D;j&i@r-1Db
zMYPiPgrXFLSg)uDqcBO~X}5Y))<83|fSu?@F$8!hgP<lJptdFmE9xH;LuYmu3}mI9
zo>v!00A%4=5&*$QU6&^i>+8W<lBz>iTH|eqzJfu}#X7N$p=I8Wst%W6p|p-cQb;BF
z9oYD@S7lqWR8deXi3J69JW13osKuKPcAIpwE0JG&O_OsLf=q_SCHdT;-3gipvO7RF
zpY7Ibd3!_m6uQ~va*}(9nMrQt`ILpCFM#jn^VQLU1a)_Z$jN`*6}1nCO^vqC<YL&y
z&Id7I6@*DBV04EsewCdIU;iw-Z8g_^;WgNjUD`Pv6|Trm!nl7YCV+l4b8>{GcIRW4
z@UDEeWH(NA33sv=8g}PJm+&8ZNfAf64b6`1*Wb>Ptgf-Qy?Wc*B0G!HN?|dnafRH|
z+;NT_g^SZ1Q^+mg)^ItF#d1YPj4f)&m8i(^V?FO_01tuF7?rxoo$oKooq}$1$3`n#
zLlyJtsS~Wp<(%+Mp8bH4?4|67@E_vb%4b&6y?_0XDY&zhCRy5g0H4O%WD@=90PyBn
ziry{1!v+ioC~$@^<^WL#h&Vujv*01-08s~sIDq0reN+c<JAmc@UPph_9l+xNh68vV
zHAHs+j{_JEpgPGrq61*2^*d{XORY|^C)tzIAA_Hp+=tv*69q*xDTSh@#4yQtjQ118
zPk?+f64vEoDYzxIHHA{aV8or;VnBnX?t>6@9Z)|jbszZXQm_0na10^pL{O*`fqGaC
zCxNA#D*-lH@sQXp?SUd|D77UDqx1&Rt{X(@4Wh)2Wsn<0sg@F@-liyFR#aVzD&$sC
z$C(=?cPIs@DoHP&q|7c!nO!mkj{!(rYp4(qmd8+*SMYBvkNRCfAg>c$aIB{@mX9h&
zHcGl}E?AsugUj|LhF+>6Q~7AyvU;~l`&A<s_d98vWZ@z}3@a>4N09fj81w}-wT|kf
z_`GSKVnm@w^*gGQWApwuK}+5*LF2<gx}cJ3R@C_Fu48TM^ZeYUj}+ei&QmY$Nlw0E
z!4F#-reC{u0Gobj<dhp4+F#w*S%Q9a<CFmpJ=ggN+P!Sq=*J)E{5Y>se}O3}0C!nl
zj^Vv%yWXb%nfcOtnmOy`St2KkFv>00;iLMo(1}nk#G0bd?F)FYMh*FZDyweA?I5k&
zp*VLw7LTFg5Y?hXRHJrLUD`!;X;+sn?V@bNRYZ@-uNdO-QDm-MB<f6&!$oyzvW(B7
zvdcx)br-~cu8|?awkn8T9XcIC3qo5%EuljpHpHMRe}LjmfZ|YqVoxAt=dv0`KE?V!
zs?+knsMAI_b(+m{w?mfaU)A%GLAnmG>tid}XQ+yONkhh7C`d!r7-Kpv>evC^kYrI7
zWQNz%2JenSP4?swhAeDYNQ5XwjJ)f<8&+(1=9W*Jw~f~2*7A8*FMfedKl19}1ta>b
z>RgQ0-!%Wq2jA<YD@X?APO&9;=2Z}eukZ8I*YtSpb>(#R^(kuxfx@)GBgkQ8D1Ws$
zfo~LN@pDA6S|8vU5U2?a)`xqB2L^{GbCad(^d?VJ;JVO!ZoV{KpYNF;m>#+n`X!!I
zCo$u=aq=YPMrH;#L%vawgE3YxFr(@oKR@F{)W5g9)EFv`QX4x;QAg-{0hvI3oq2CQ
zQSI`{j;EbuM|-(=J|U6<hb(t-s=Ai|fuIYfzz7%LWzqXM=2qm0`NU0zVK+q=w;f%k
zNaHRBikrA*Je0A}U;>Cy?4XXYJpZ8F643WK01MxaFeU`33oZXjIl9gb^o|f$S^i~m
z-7!I5m}$alR@0^U;bc}4pD58}q_Nys=?3lwi6!a^Im%04=>YOCc<63=4|?wIU;G{h
zZu`qU$Fm&=c5hg}d(T}Pb|Wt=xo>IqkDW*UatDk<^}ToB`}Hs0eFt}TLv{|Ez*yk{
zarm&cMA3Wbm+QlIw%%+pQK4C;Bn$fZ`xIPNu)y46iUWcJqSpkki8hLpl*z%#(YfM0
zWsW{SI4^q0eBbwJ=+nsi@sqxj@e^jw3?$i%p7GbP1N0&6HTp#TbJt%AvbxJ~Gl5u)
z$g4oi?E>zwgAic{A;S4|eGC;Jlc6qKa<jZfW=)C~rj^fv_`-70#E6iS72#M4U3vWW
zTMlJ{+ch*pVhQwCp{l$a+;)K5&hQifhp;jYx55^98nT739*%+xq(&xT5Rgh3NF@xU
zcnGN{91^BN<1XY-YJNi+y2T8iL}0>&L;HnbcQ2_eT&Sz%%*l%`7(2j%6`~Hx7o3Hv
zSh_6qI`Sak_tC|{B?i-N#y31S;KA7&kIlX1_-zyK?`b^0blFQUELprOJBRzprZHnS
z=N^4Fd;Xql2Xvlio;z~*-4EY==eI<ox(l;}H}Sk1;4^DPr5EZfOtRJNKz1xUlU>5{
zk|9c>q<RfW1&jz?bi#lvm2MHCSY&#k7ZqLdN=5r6i~rq&(WOa#ZyDWKE>DT-5;<)<
zG5BuQ%1F=9!~e;NaZ+zOv*;wrz`#RR>%0mI=x=Xu(^Ujbi^!5Nd-QAvrhxh7UC&%G
zr+(7^TyfP^m;H|~&Zf65yn4V3B}40*7j=Gs`&^$p#q7c((~H3p(suFM%1)S;rQP18
zV*}}Kua2>SVh2b%K#>C^9Dux>$68Ij5k<bD0n#<npyCNdGm2J9_etxDpZC60@dl$x
z!AL0BYk0*+K`x5MBc%6%a%i$RS(+?Qc1>0$t8>M<(p-72Ypya^ZB4h9Xe7a`xU6sS
zM7hy5Jw3g2NpeZ?n&KbGPbv?VK2q^eujk|)%CjZUmF`LZA{{7oG|eIhNIF2V1LU8V
zcOHRv9*TD!lP9Y5XO<^kJ5el2DKZ-|(|*>~vmip8u|?qu8p;aShew5{gkKFG4f9&K
zFnn|Pc$h5=-ycTdpI{8|V|=7h63a&p*U3^A9UjBBGt?njLV9SAFHlXRC%W6HhOp=4
zf*T7^LCi0(c8&n`k9^_yK)$fN1dZ5OPgh|CMvB9hH&oq+oL)n{@FBY-R2`;oPYs*o
z%&<w$3R7D=OyeA+70-P;ngoR0cl)RZqqrPjXm70cSUD^w_ax_+JE_Cv_B&#D0(?z}
zu$*KckgJqOXb%!4<<-r74)sCxeb)3reMlgv7=&yUmg2i<4?eQr;6(aGv89mo&7@dp
z7HgCXX|(T}N&UY>Wl7VQy3nOic~3B1WUUn)cN_)b-ubvq)4~yFx=9_(tTP>pMmlK-
znan~Gz3Ha#c97U^hP-TYAx%Ocb{olvBpW*oA)keS^%<+AM?A^-D$<7T(Y-pu7pZ0x
zNTos)ay@Vn_u<`yI~fH<NmUWc<R~mHkz_u@MnR!oKs28WaXQ!qRh7##YuBy?-PkDc
zRyAF$xa8G-CFzo$sHVDazkf@##9xw2Pkq+)yS2M-Te++z^@BGb8+B#>@(0GQ`pHD2
zMOi#&<=jA^GP>^dM<&d9bJfw0;pMS;i)IYEJQ+&$8Mb!h(B-9tnX7M`6}oQnb^VgD
z0<T<Lb>+&*6Q92RWx`vFbKjwI?lBOAh2%YdS?6sOS?6V3S?3*QHo!Z8OqW8YiMQ&I
zH5LPF!Vo}3l_3KHx|GpmEHfFGrWb)Cs9qw*WLu0WFeiwErNPa@0%47?MPLC|ezpoN
z!Xe?9z|*B8`86bGD6-P`sL`|uTcghd`Bf$7DDDxpiild`qRVSnw$doHqq!gi`|g_g
zFV;O4Y#n(o^T{)HG}_x)M}(SDRi(e(EipY6v?IPG&}8(Z@71HZhe(fHTX(~a73<dR
z*}K=9DUEM?TEAk(GicgoDBPI6cXQ_tMpQ(I_XYFn6XgHYz&j6s2nmP!gVo6N2FTKa
z(^lBytIl{~vFHsb&>L`J0cPOw162XXehE0rN1)4o38X?nVrWFD6%(ZPOVC4uJY88z
zK`Ok0U6xDGmk;;kqX0o_*3uQ&DjBj|5FQG`;K&G>*b-v2L{3N0g2>iLOC%RzNwNuv
zQP8PWlzecaOOTSc8=KNG>4d~ejv$q~1Zh4lA=79Cxg(XI617?+8U&C=hA(lz<URfW
zZl2gemCRRto%6a3Ow18hcdMF8QX0wfY;2;iN))J~5e39RDKB4(RTX?@K7L=4ra7cR
zN{W36%+#;^@PD2irMp^P#!X|!+;>^)ldV_JA62s$J=nSD-rhsUjJ<y&sy+V+p3w-2
z_~03pQD3q)^}GDLB;0vVnw{_|(l{G+ga-0XvaT21owg_`AiZ1GP>>UWEb@?-0VjzZ
zL|idlM^~Bo^oaiH5sZ~YhagWI-Cx5&P-N7~M5L)kt%U8~YLOHO-*gY&!u(by-We&L
zs0O9Dph~7xl&S^+T;RP=tlLX_Rs$0kno<TzrL<fNYUHcIP<aBJfEvXHX(pVB=7@8o
zW#CqLD_SltlWvtazzt|UbGNWj+$8-7JSsgPzYLy{e**RkyX3dQFXT_ahw@*+pXKx5
zj9h^qM-G92Tnf^1KY0|eWQnspfocv9PPOx*WBfei(E-tiEsdrJ11cHFSdcoZsghBl
zwTR;s7s)dFG=s+m|BhsiWI!cJajm8A(vk&HOi8j&l4QUjl(I8cIa$WqAx%H!1zBPM
z<SG@Y6p5B)No&ZfxnXp##jW8GhapQckp+ufU;l=nWk)33+0@w-33Z%ovJ(SpyL`?@
z?WJo&Nw$4H!|mdy`<w8b98hl+gs)_8{OQS5VJP$01KFF{bmzKRH;-G2Hri1O9sq7X
z#xxH%h2)y%G0nFBXppc#u|4g?ZAblFoE;`Y)J@yXLHo76qD-ffmgn<p7tT5U!gF@g
zvn_}{PJ`IhAn<ut<9GHO8Es_OX(}|&=EEr$E_zwIy+GdMtPT{r8thk8$xf2A{XQ0|
zp%>*FPB{UY{EO%e({9d7pwFBT*=Kt$k`Q^j<Qdy{BiPxSeBSE%fWD)cwO^t|GLlTi
zZaCEHwqsU@tV#kI7TuQ(1_A{u;*i%c%BTuY*OnO&u`+AOd9S1`iwyDtw<G#TNAwTq
zlJR_^HAMkO<VP{T^TBeqOh(rjlZ^We#xU)7&gS0^$vOaeFQz3GCaU#VfgK{U_7@gc
zv%DgC`KT23a4cYXm*jGb9vyfYpAZwHt^#*4ND1X)#$63+gaP7Z?m^5@-V#QL!(9Wl
zp~f|yN!oRudBSvYmS;J?LRcam;M=u*p1<?wrBats3QE-ycd1t5sr2;+{XDmd>%~Wz
zN0b-fcC_8~ys{VU<J;Z8WIy6RmQJy!v@bnp_;XUsMHibXwA6V!9oN?8sCOn$+fmuA
zu^wQEf|wGtl$)5bZh=vul2Y4pA6fl~Oi(e2mQ!0*g+4DYyNtA)F~+gi$&-y6jg`hG
zLpEd<6D*kydt&}Ir@b<BrqW*bqMsyRTie5bQOn2BTz7$!WLd=MEb9hIbQ`{h10Jlj
z4zp&;n%n%jA&916csv<S@Nt~r#`By~-9A-yi-x9UWYLFDCkgO*b^;I-Jglf0id&`K
z^I$nj-n&8gi$^2tJ!RinU4_jm$<1WcHu!=io1<iSv%FeHavK_NNuvySv$5JBOE|_`
zE}etTGzP+84)nrac-DJ%Ce?$(BhEB6g|Hrr{|F~)3jOEg_dIJdX!(E0eHYw%9r+QM
z{D!v_j%{dFO~pj7<xXH*=LB%)j<tebnu+Q7MAzH)8i%)3kEL&BIJQe5uMxu)iLt|5
zs%W~Um^-mcFzs4TevLd?ymxFLwgT|AF(){-Tj)iuxEu6G?e?9zF5Y!ske+AcPVA9Q
z)&%|YiS_xVfFJDh)Pf59BXKz|iIp`v&Wnt_sEMwhzf}AFZy&;vDM$7OX-+;<!ocC#
zgY7%&*{U4}p02rk->ccygFDK8i&^v&CyjT|O`VUvdj!oq{|Q>T_rg)ks}tEV%r}@<
zN6<WM1%>Ry2|KfuYH_sG*nD8+j8$nn^k`UxmWq9Z?c$@QYO7g_6R@#p)XrAH@@hkY
z?9&(*6ANn|-o<+@k7l|o#nh<nsD&#tkxwI`BayI9Hq;A2nNxI+79)wipIP%`wWYoZ
z+N&~Ssg{N`v$R*WP6|PhJOMT2DRGr3C2C)#uUg}N%y5-@O1)PH8a<8PM*keo9Pb?e
za(=10+*sjT;lE4WWNh|q_TKG#RNn4-O+RR~`@WXH^!;7!)c@(r#o`WA2zXtwD60+9
z)@h6u?&`knCGm8vQt78@ijFA~3-Pee>rHuNAKuXvOmZogjE!*FOO_(Icya*{(_^SI
z_IeD(+ED#o4UdK8YeVBKSG~vbpedf$J;>7ruiB@<A}}~AlO{S^mZ|hoMk&l_C8r<-
zAF-#BBtfJ4)~LA>lOG<uPV$~BEc?m(Awv3@lVS3IB03@=y@Ns^M9c?5gG3P!yGNeM
zo0rM@k~$I7mK)=A2;=lYY;m0euG}fu9ix4@&-V4Jm5ch-y2%R~{Iy1YNoylffB{w~
zFg9O`wIJgyvGbk!(G?|mrGotLfMn5X-(?kbR|kzW=gQ81<I_x0Vdl@R*&DAc?zM74
zb#~Scy|g$wPb*+cJ0H7c?aHNS-uYj?dR60CK>u437k+%!k%zWT(dzy#{(tSA3tUxI
zzQ_OjarQZ22%;z|a8M8*q$p-)nj8@DK`DwNn4^|x8kJ7iW12>fW4=;*S&o_c8Y@G)
z9-$1eJJ>jBT4~b_o60GB&XiL&PBmjD`~LoGuYEXfQL^cN?)}`)!M^*y*V^m-{I3Vm
z(Ifss+oq4Y_F(x+;lQ2WZ9j8E40$dQe<f5AK7>E_;D(VjB!<4*{@q<MB<+JgQKg2o
z;=iva38-(;B)x*-z;JgW-Qg;x5@j(>P%G(fMoT20zKw2$+e(<TA#2$$+>ZnAgF&De
zbdYw}fa^dJo8fjB`$ZVDIUFG?XoAN}vs}gI8N|2BwV$Sgb$H*Te?(i10dzCWo8hlc
zC+g2`;AfRlNvmPM7T>4BZXIL^%p37O5&nA1_Xzh2YR?iFu<wp=mdX5f)n25_^$PO?
z<fRm0jsS}gM<HZBD1e*RkU3znvY(bH`^`=G4oM3T|6;ZWxl#^8I1BMT3;t4JUV!%w
zNQVI#4LX5t>NXmnwxJgwGm!uBR=&Z0n!$Mv<_YPSX*w4xjRm0~&i@1{>HzZ-$cT`%
zIa%OfxYn2akmaBw7_GiWH|tlEg7SLQ^$BSVS{|3vd*CX)j7Gw&Ae}|5y>(O^Pq+7*
z;10nxXmDq6clY27?jBqQ2mwNHcXx;2?(PJ4f;$9vxI=#TdCqyyIqzBPu66%lR(EyP
zu3fvTXBOYxU7rebOXSop_HPK6VeJVV7W&gzcdm(52=~;Y9=Gq;RlYxP9$GqQdsyf<
z!TAbk1~I?VE{WoWi$ArIJRWBL;HZV8m(-;?cHFG?^AI?6LE3!C@Pc~6@yjm45o`>e
z_P=9m9Bo>Q-~9gG;gMxU&ct9{;cKf?s)^t+v7t-!iGylxp1ea1#EvJD3hb9O7=mBp
z6nFKg8?~@7Qc!K3R0bH-uo~YWCXv5jY|e^#iKlMV(=5R*eYX}IMzh4Qog41qQO;D)
zT%_*VbmzfaF4CO}?%96nw#BwwGz=Q^4p|Ok5PxLEIeC#Cr)nt95?h~+oK{ls-}krB
zso(Yq0yz0<Lg)LyZ{yc)L9du`d)IF}Zq!o_LwSn~3zK@BFg(EJNyL#YKS1a#nSO|4
zvta8^Gt!M@F@;2)-kW4T5pLFd4RNeHof(-Wa2-TlftlF?^w$JE<S<HhJr#*on5|q7
zhga|q?y1L_^YcfrJ~!!Ay3QS8C0du>Cx^yCR+Jy=p8G^N=NwnHSDA=(0Lz{uh50v^
zLRg$i@0&{30MVI2jf#ztbZx@b42Js9Pwz%BOzR4Di@!wX;?mo6z|=Ss0}n2geZ5f+
zsZh4~9w3efngp_VY@r!ukH#9X1n*}(wYMX3k7m?xr_mBU1F)G11-6f)T%FZZo$5d7
zES=2Kc#J064kKD-y%NQM=<l&X{;r?Dax7--!F<f@d-}?PPhY)MdJp{R{V|J*BysU%
z`j^58(a9ycd5g0QOM?NZ;gM#lYGzz8GLo<V9Cv7oFp{m_s}Skjw^BRUb#&{GH9+|0
zXgubF)K*aSnK7Y+cO<7g`8sIWeQqVEFGVLzuJskZakMb%jMv}EDtM6u{AB5kuGOL{
zqSr^4>-^Lm_j;``PO1Y#mPqW-D{<Uq%ZwwyA(3&G)EUeota65wTay5^Y5VsCa^jP^
zzWvCbuoz8pVnDRM%hpb(oEx~|<h>lMS|Kl-2Z+ZL+45dcwD?x^4P-Zp6Rm8$Q+T0#
z|CiyJ0mHIYQBz%wG*kuD`L;cdkc(c!w4y?RhiL~4$!LcL;W)p@4D^$4&k3UWB3g}w
zF$A`*6e|wy1cAiFeZv<E^ur=|L5$tDNh1)3_+J1L`xpb3ZPtY0lEh2<H`5Zvgb%ue
zw!*lIo$Fi*h)*tPm)GRZ3=i|@Ve+!fyHOUe7^Blm>f3t?VMjujxncDxts{}F^f(?9
zv*j$VEVsnvF;k7<xRC~gX5O10nl%&)`Et|LJM97yw<tD&FfCq_zFxU!jDfzDgbnat
zm;(79$BcmAU7${x?1<|)o<vYdqG9G#(K>GMY-c1U(QCJCCdjFS0%tJfQ{ww6CI>{4
z_GA)t;978HY13<QAF!57y$_Ik!T+aib2}#rWSSlJ#T8!*uiJ|AUkm0`X5<XiTBMW_
z=M7xpYmb|?vAaw|48GP(GAzC@V^z03z>Jn!eiMLuNt|SOFe#aI%{pn5j(%{SVSj2m
z73Gx<e2s<E$N`CA)EZrti@OVgp)zh{5$0p(VFF>E2)?90YL~dC%CJc^$dwAEm^w1!
z_43%06nMks^AxvZdjbVra|Qc-tH${dnl-BpYn#8-e?vax1&FnL_sO<lu~x3QNBJI@
za_uv`nw7W~nE`uw?nASE*6BKev|3KwhKNmej6+(AT(wvnl_Hv06R^tj6Tj8S7cp?l
za##RUL$c<E{?aMQ`s+oV)(F>XZW@y$DDg-mxejS*6Rtl=(srdmm7tvNIQI91p{t9S
zuV;h`JL~JBZVDrmk7rO^E)yWq)my0k`8^?W^bq~d%Aefn8)M<;aY#XooySjoTDCv5
zX(dN<qxyzFg#5A-C4geS4QQ$ZX1MZq`Q-m}n;~98_>#<fl5S?+#$m2rYUxPr$_rN?
z6lB4iYu?50kirjZ!ED?bV9%6pJ(p?q9ezesr^ix+;MlWb5my|D$Bt!r(&;m~Co~Dd
zHHI>1==Q}#Hf=m(J*?5J^!t756E_eLceJBhv4nrr0u*#@<2r&pxI755;4;DAem6)q
z_@N%@q-NabsJ3PxreKBZLE`K(@ctG4D&5~eaN$;vC{e_slmrG>GCRmbII=9r$C2R`
zrVB6Z)4KUrDi)ORKoFv9QX4_DKXq%vw^ih*NR0Fsn6rlN_O<TM*AcbChw&$d4XO{<
zgMUKkUkmjqA5N`*u3q>yqp$q9?SLHJD||(|C)>7ad?kE2^?Pc&ejYVRvWI2r1QG70
z3c;@te+~0*#jJ&?`qL3&=)IlhvaiUPs^|Np1fOn7J9V(b&otPQZvBIp{^Y?%f@dDz
z^_i1O^ahD=iWaskSs-8y2M+kCYY}cNJ7X?N{lImJ<UA~^8EFPgxHiugl%bik7l{;a
z6|=P&YGymCEaR<tL1<Dw#%mPw>_6wx&yyVoKjm6_!Cnr@l9d~`<KQH7V)e0m0VDk8
z8F@}36)#EWn-StA^KOO3sEZ4(TZbPAc~@-E{+N60qs|1Lacc6kkJV-0c(kCA!dRS~
ztAl`7Djh`+-kvU~3c%_1y5ID~=j6Q4_k5Oe;;}|)#B9oHmkC~j*HcbcU(H6x4w`VR
zT@Q(HY+d(1)h`ZluczBi%$f5j1(8JfxK;gG67j82zHONPeLT?hLODjA+p5Hj;vDO=
zPZ@?Y`8p={m3tTj=jz12u3E5%Hym)!{nevp196b`1*S<)tLt(3>DCe72iYm?CB;F9
zjK;cxpLdzzXir2?EIIhgpZ5xareFO?u#ewyF1w6bOZ7h2hiE0vH$6aI5<H_h?0+2_
z_PGLYtUvmTS<;x^&bYR_@g%p<UGO6-IxG6t<9<KCz-8E%L<csJV}^-rL)<<4Uq>Ei
zBTxPd)7B&}f)p3r!w{p{dS00*yIgAoj#QUE!CK_Edj+^uET|C!Alxn|*i8m(bCDgM
zv#pH0pgQb0y4$Gb1+Sr2!M@A*U!g|50uuWI7m_oQnNm$8vJK<K{pT;CH^E$`TBDDr
zOH!V~8TQa*be6zgAMHJwT+jsHm$h0M9a%(!hB<HIa`vgd`(Z9Gy&dkV;5Navkz=%#
z={OJ9LntzDj03B+Nciyio4ug{T~C!`QLV?Mv3-uDtutuTIgh}5+v&&j-BQPOr|)T7
z_Ne3c<K7R!0PWOJm&`V*M~dwaDS1o~)nVzDRa+uWY22BNCP$R+#7s92WtSh<{H=%_
zQ4*Pk@7a{~dz!{|mG^so>AvnVuJUA#{5lKpieCcnS6_EaJ-+8|j~k}3{{7KqKer*P
zG7I^Tt`BdGAH9)16Z6HcdVDO5EGp1hKBz-RfVVn3Fg%I)Xlq~3Z$X2Nv)FbN7}Zcx
z`Gc+B!UKCj5BwTnUxwLMvO(*b{IQPP^Z>++;2rd6G1-|)NcBaRK48uzO>!;uNIby)
zqixm-dA!}~glhY8(9P1f3*c;A$=J7-YFJ|+#GxJ3A$tn81+hwu548NOwlZGsc4|=E
zR@CGS-nG+02l741DCp)9TfTZ?w(QxGhk*+Y_<pcP*9<>boi=@&+prj<Si5G(`PCKS
zn3?uq2<`Xy6Iz-&vBV1Z=Ylzs2xKY5&0j{7uY{cw*D-di8QBl+S5-B5n@~PlW?X*!
zBa8}p-mp|Z&6BsFZn)+1wm_%ji4m8Jh1`DLONvnumw~C9P&YI<Qu=-v3pl!BJmVVU
z#R>+Qo_@|@&Jd5$<IV=4Zk~EW;<<ull2?ko#|e_k?_x*RcaUpU?aYO;mzjAj>+i~Z
z$0Xm+4Vy(k8D|Vx|L%+Oh1AqY%_XqpdY5dl+VgXZMdRDYtc8%!XO83gP3%D~f)a*T
z^9(=GqM;q4K;0(Bm&*km#AJxM!6%03bC|MP&N3V4^(ccK<vT=xk(B|`lNV_yzNPzk
z_X^@Y@z-1N+Y#q;uNZpN@ykm>^{qys^#f~WGda?3-PL}erSx;6a~-Y|Y9_nJ81~kN
zWUY9Z8)bjHaGa%>FsetIqo)0DmKApSM*Usdo)xi4#gIM^y(XV9-3Qs3wQG3!Is0r~
zTdJ$gY+U;fL0pN#3w(Ap<Jk=P)?c|wG0jClu8vd;5g_$_CKiWjiC4s_N9tL_vHD&$
z5rij#Q$1$EuO8mys|OFCR(G0`55p>><~&m(?uV`A3f@=fPcwVjTCd1`sF2OVkvh<l
zS6xl)ZjXt%R-_>{V!3LbFGe$+TaVy%cRefM_~|>fr2pXr6_klmfo&<_nH_YXsnbw(
zhTQ1$os|aT0FP!oErXKC+SxI^bA>;xxrsc>%XBj4hx?KNC=`S{sXE=)^yI8{({}$f
z<PCZKg`oi8bz%n!bNnb9UB7+F<t6y8d0E2y`y`HWUsJ*gDx3^2l7Ri?v|~Hn#*DQM
zKW&lfApf`D8UE?SQW=8&_lc}x>pyQWZ-fNHbDaeSFuceVXr?K~&u_9Aq`l{WlH@D+
z+p&OEO)>EbYbD0=;=#5=qg7FwjBB<AoqZS1OTrT#XkhJ+DJ4!(6W<O<2Yr0n$2-D>
z4(NI?@beL8IkX+Vh0QweIsCUB^Yp{``l!d;V={*N-RAOY!Xw*$5M^dpF{u~(na&Rv
zDaWD=+A|df9!ZXjRj0=xd-a!2e!yuDsIVlM&8JWop1X%bbi#|+`-=2V9_D+wByYam
zs$#OWbT&aXNMv~3QO6iKL6d%~G47VR1L0XVJ7ME-(}ts?5W~vg&Qyqp=c!nroKgU2
zc*^#2bDSvmXGm@IH8>e!m)T0YRxQGG5lNXb*77AL9lyV~8;6El+jwAK>RiNR17&8>
zAdOOlJr>kNd%k$EoCXR0KIdV1?IIbwWEdTw82FTmE8nG!zmEzoB(-?(0al!IZ9->c
zV4p%_i@bKcqlR?Mh4nHD1h_M{l1#GV-og*D5=@&MJ2s5`V#L`#QQh{EU><XQVqNiV
z`1rc&d0%|ton0G5cDBD5b9Ra+UqEn8eiszjD61-6{t0H-g>wM`MMj-<pN{CRB8CI`
z#4@F^68FkUfmhS7j)r{f;w9WrsK#kP=lSc|i>8vL>dsb%S)HJpMrm4a8<Fho1JwPG
z7&n{3kt!zkoG6ZAuWG%II?QK|f@kF&QqvQ2_oHOi{I+)8d<Wki)hoE;D%*`-=D_6c
zfXdNC;AIx#yIz;b?XM>O`H#uVJN#0jE3g%Lg`!<c9KnX1KPn;kNUv?@jP2_z?m|u1
zlNh~@XI}zAX$3c%KE;Y<m5A5Ln$r_`H%nhYLG7J;@=GppV@}^)xt;0Sotz3=nMS-&
z&xEzbvUL&a7)YN}&*uNM;gg(hJMf?M5O$v4!oS`;w5KlU(++UGFnaW@5`!?@Jkem*
zU5whKdP2I{5l)N%D-j&8MdjZKDerL_p$`}ek`MW3R8u3a{~S%aZ5q5fF(aOxNBzpe
zEQ4-PB{uZMKiTGOgiS%YERA9;I|2UW{iJ2rwch9HMHMeh#VG2Y(Bio<(4ED)b4ymi
z$^g63l^zlw0~0P18hZxQ&J@tWWBok-h;Xb2s#z5SG=K3HzK@=!S+_t=NU5u^sZqZV
zgE_z`!a4*XT!{jSV~$|wa#0}T5}HtU{Yx(OzIrP#<{#mu95jb`HjfJla)r1$guyhm
z=MU&=&5Tj^^3{hoG9W{>)~Al&2KNCsJujo$Zf%X@lyrM#0hlgQAm5&ZL-m*S9g>c%
zUJ%9U6kS=HZ5@F1i|^8*waA3a-W0^u7KmAH?J>hHJyIA}e0{pyt7P?xiu%{omOJw7
z*D3IGcbJAYaHnn6+q||b^?8hNmAf3*$a?cB&-Y~_4BL;|-Dh=k%`@B2he7Ypv?`Ff
zeYN|Z>@)3)Bb<sZ({b3{ICGm?@b{9KF68<=+`z|#V<|-DjAQAE+2z#{X^|fJ<3)fY
zL!Xa)Kh9m)a$_w+o|R?wbxP`l)-(Ls_Z?*7y>eO=Qv%NEr1cqZu5h$Al&!<$x#!ke
z@7tdEVXHESy`0Jtt<E=ZNq7d=t$+WK9DLR}_rmD%UK+6=jI84;2;ufWb2U!?eqInZ
zfPMY$TCJm@pCn&Thz~p1dx$WPMN;a#;wH*i21UHcJ328QTf5dnC`_86oJE#AK%-|1
zZ&%;CRc3}qb1U(ofE}jztSfwM{<o7r>Be=frs}2lkHWr{t8{jSkgBL#(sM>1;y!Ib
zaVO&Kb$?3*{g~z*^`I5ok=-ki1M|`=rwT6*SO2EGx}?}!Rk!wK0$sNc*H~`3f>=lK
zhIivUQn?xSXAPmAB1Br|k0DOL&OL73hMSbNB~EL1HZg^Iv`awZmVQ>ExY1ghcCR0c
zLfY-;B>fTRi-$b^rGx6<OA~q{i`K|Feh)lLWvlOiMV#x>=$Frkq({qRVU41WUo+6$
zl1UA3@mG**c9B_vTA}n{eWCQfk<SUtCO6!>1vTn^JIcNW`DPg=9#Icl6N|f76x>LZ
z=T}<zG{@ie;k~p$NIad!$$xslirm6#^(FW5e1ei|P>R+&5w&oMWqve3iqsWzh6nWQ
zFN(3iQ*YV_FMUeOyvf>H#fG;>`xH)baU+nrO+avfDILe-PmSzx5K?`#)=&2ACWcq^
zx<>TlVYI%n>`%}y-}Jt(6TvWs2t;AC3fQ%W$BDt;vl4e!jaZP*Q6<ynNg|YgI01&U
zi)#87gvCB34amI8INLJ(%KMyCT&W|cPe3V`#BA6d0FUwi_25;M`U$6ep8`2&U`U>}
zPYLE#U;o;c!AFu&#qF17xsHo=>+Lm8?Wr?Tk@juLmDm|$d1-<s`{YsSFO?GGE!Nx`
zFRLLq22sA)^EBvsf1a#q69)Jj7WZ*TpPxiCe)E390aU*7Fg2Z?4q+V@!P+8f)tr<q
zrE?#BmdV3^Y4h^Dm&=OAnLuJjkb}APzwSgkT`<E=f<5fi*bG&)*0@&E&uatDvXYkA
zx6-KMR@Q`J_)><=Zpkuuj9JL;qBNudExC`Jl1*3X24a9rbtX26a)Kj+MWg(SwsrM`
zCOQ-#j*O58*bsHhizyg}2neBBB+IR7qf*sr*7<o$9-5RAn$Hq?PLTzl#p{MgBR<Pt
zL-oaIJgYo+Kjio*uU4z=J{*5I45}rXc`yHr_9~zxnB{TE!sx^Y9+46(ia$oDQsl<^
z<K1n>!$<K_-vXp4XiER<ER?i&cGnZ`{Y8>Zbw8*&%-^f=hnR;wFjikPX8bzjb@!6=
zhLwJ-EO~)sbqh|sLb~5PA=3wc|1(wDvRTh?mMFMLhRTS_=Zc@q@k|>Wmbz3NP7Ubf
z_Guue9F!{ymMAFP+6|tTw@bgzBKu@dw#!L_hxv`hfP?vuE0n$DAnM0=1VZn!;y3Uh
zV`lw-t2qRCLK0I$eZ0P=6;sXqSRpfVZq}fNTKrf{B=f|6ZAz-Ib_;(W@(>dROA<?h
zTJl&D(;Bx5u@3KJL}E<B_GdM}T{9j3h`mOq*oB&xDFcrLF$^NM>$y|uXl7i^bWIbg
zIu*qej<Ix~jWjb){^P~!{&haGFr?hB<WjuG26E)}(9!f~{iPB~!)?hWZ`6%&V#{0l
z0Rq9P)09X~pS)FP-nF}EbysrmCx;>H+ou)%+MgojdH&3$*=66)O)+Ui<!gQ_&5-%d
zurdcIQ?tBx#OYJqwvlRJ6g;}lmh9PD&rzk?6BG3dONejmW@f?N9_`D0h;P(pW*(SQ
z>HBR{QRPXXuS2H^LVQC5G?8IS_&ZeN2^Q;>Eu=%_ypZOFF+@=9oQm$*o879gWWzgf
z5F>{tm6vE+&7b8#tTbIICw+34*HEsg=aQK@a0pg%D4k*8Bv#Y4;xyVc*$bG=P3M)=
zjPvm}2mfa3QAiT{M4W9YROp86s|9$mnEZrIdq>IqyO|B$r^8)hEBSqOrwKD^+Pm*k
z<M3Hi^vS&^WQKUGzj7DyPWw8>@8+dXwq?Vle@I8-6|81viBZwy#*9+b3D()lidB{K
zm0QIXrN4$f%nRmHlktkQDYj*zD}O+h^6;H47PAkpZl<+u;N(@fNB(qR;WGSAMzvW;
zPZ+CvB@&&Fo+%f~h0erGO@yUYTq7TNSgxjBU75b73Qz1MC|jg_{xBb~y4Db5?VLZX
zgPK~-+h$KmfBkW==)7|`uofRWheL~NHQpicHrc=X00h!h-ANxYD!kQz7j4^t-|PV#
z_2eNWfqt#ASYovHpy}ClU+d{Zcds0b$s}zPnKT^^__%s{k;5O%S))?adwu%>_#_R*
zRpA@X+T&L272nd!KkVJaJMCTE5(|D!-r3E$;k?(=h>w9k(VdL{W8}s!{*oX*TdPsy
zcIOwwNL!@yppW+&%~(@?USY$E=dXpoJ7SKMEuo;bt)Z=il_ONp7TDquDil#bI&mtw
zVi6f=4*A>EehUz^xTzS8WNlgfwh{1GicD~gh?NYB+0?i3-5gnr#mW{o(&0wcv)vJX
z3#6Y~q?EN8bbm#gHU!ei$kMc*oM@eERr%{64^G%_vWN?az66*(X`Kc8sX>c>@*D1*
z5~A!#3eJc2ix(flkaeY@im$wIbffV#SJtkUB`8Z9CFr?X`n@tW^$kB?voY6X=gc7p
z`_gS=+&?&ZRk@mK$g!c{aUS|*gE1a@MO;h?XQM(^EWn|V?$}OJ+)D2>V&?Nk0gzP<
zjuY!7Ms$_%7=jbn4998v?5xzty)ZXn2jL$W8vw;6ErX^IhZ0AUMnO#!5W6Wsg*P=c
zl@*&$Mk#OU9Ba@N%wyIP%mc%Tb9dBi{wg;jt*B7~o1l=M#L4i<UPfjO!2Idw@eSVj
z``7ECA>M+7i=geV2^>2Q#cY~-oD51StPEgi=O<2&fzDugP{v>;Y{B+vR<MV$tgGCW
z{75<eK0#8VBhb$Bda`@uArotU%0M>}i{pbPDXc5r0DG-3M&{$?UN)hIZ$zo!0Q(H*
z=U(xgaGZqWKS~M*QNami>N;XMZ3+hq#ehQF(c`Y1bChFD!3JZ7+IWT;vNnK&w2T4?
z!k@y7MgE$5j0a3#EBGUedm5k9P6Z<Cc!mpAq%xiSZKa2_Wm>!3yVm5UIbW<hzuC0q
z#?Eqc&%S$~KMdfVNEjQ8P?UwUB$b6ptgixMi0n9R3LO$4G?rW$w6|xIyy!>tezwLi
zurusOoxoH9#R8n&?Vi^u^Y2O<d|ce>Hf2?ImBfp&rD$<Wji_;X-+QEUW#?fxV=AIz
z<qsMJ##DS>Fa-Y)`R*k{?=6~*+g`{g^byi9Wd2bx#F73Jgh<D)Y2<`P^32&cV8ru3
z;Ew(~MfSe{yhNqN-b&u6V_=l*{~f~yuBYnZ<ZNmyZD(fx7mN!=j#+}yNFE5(!Y1}c
zrZfmlif;tnH&h$7ny4!HT-C+F!N%0~4K2_7m&y9p(;K<X(bB=$-VuT8AJ!KW*!E|8
zNog^8Lx=yMynz{S8VKy{90*JrZxC1TA1C`8af=y&70mbqA^;Hn!sWn3H!%42FZC0M
zz`~6H=DEH#V&z6)djmMJv4bzOFte~Dypa;$VD_wk|K85PHdqh<ZxI3j{%wT$Z*wpu
z_MfU?!~fCn?TCZrA0x~N+~B4_1a@u&jyJ{|2N&4HThCwvU^3X-(O*Bn2L62v?)#ss
ztl*=!E`V>uJ}|iMtp=DL_BKp5aPgagw;}y)2tIyu`k#hCaFhQ89D9r3zhGAX!HxS*
z5oUUexPqZAnA`hbxq1>dhUQM-DE_S?B4Ymr5N3Ge-!ibVzCm!o{elr^?BEWWgx^?u
z&R{pV{srE12GfPXfnbt$Hng!c7Pd3DF$KHABx>j&Wol_|0j>+4941xpa#4Tdx&G|~
zOhf}OvA+PWzlg&B7k<a}pW%1lI?iASGZWZ3XHzlLzYsqrIa51xXA7`5|3()7o5<xI
zJECyJjQ0K31A)oV4}CdUHIEh@g4Cr;{OZrU2!5LAB8;Yk9Q#N%->=h*KjKCTo1WS5
z_HI*y<oBtfJNmn9EzyC*pu8T3um~~P76B6#`1KY`QlI8Fq8dJEd&QvOo773<MNfu{
z1`|HHbBc=7r^zXogbp#qDpcMt*FGKct^5&NR3|iYIfE$@?uRNlRJ;Pq{K08Gb{qnW
zj|a}NMn3#6=@RH6S|VWtd_)pQ)Js2eZGd^DAC3l`+3}!#4VlnpT|2k`JX^Lioc2hJ
zldERrP@A&FvXUTQWW`A9DD|0GO)^ZEK;OgkakcPiL?0{Eq|)814ek0`mNd@n5<X@1
zi|RnLuNtwjNjDj>t_02y{n#=I=IZ%U{SB%IC?!f_QjDlHR;%sk7&Jwzgs5#3Q7kUl
z@6VhZ=UI@iG0pP9ED3={*t|T6XS+<Rj#jCXQFu~I!*^W6lCi)U`fPR)blvB!7VK)x
zn>hJV1WR^0;M?JG(0C|EW>6-B>j3UF#AWuzSh`z1D)@i4e#5lfyBCP@+Ut}5{$<4d
zcJuygx&H4n{dODuT_pdW=@TsvA@$jMeRCMr9b<KAQ#3SKGY5ky2PizK_rK6E9Yp%@
z5Mg1E<)aB{5s|T^TUL+Typ9sI<~K}toQbBW>Bfd9twT7kVII=Yo^QBe8ENNA_q@+C
zSDv-4&uVU#tSj4Yv>#PBe@JCpY!3OVymYtPo<C|B<oy^lJKSD5CT#G3M(><ArgvtA
z;ei^-5Q}scU3a>;Y6`qO@PvC{5kvWM&qigoj`q@&Qe^#U_fBqtkv<CIURjKP?K`O9
z+hP-R?2g*VWaYFvR&jz9AqiH@*ERAPKZ}T=v6<De?fx&qX#`4iHq4RR3PnCED3{Tk
z_h>a3#7_zLKR+*geu@9Nchg|>>x30%fmngUR3uTvb+Ts{(e7JY>SPd@g+RB_y2Y@j
z)drXbSw0BZJ<#^mw^7tJs3lR3OO|gDH9=FZXVlm8d&`RvVrepl`o_`1w-6nl?(_vg
zNnQy1DJYD~5U=&L@t^Haf;ZJ*-n-#@J*}_Q5R>3{@)@aqrFE@zBj(_s-5UC^%D086
z%9?TUn(cP~s1T~?@LAjBzSd;)F#5i$ihqjMl_FxTij|wwQ0^x50P1K1eh6!>AvYog
z2SS{RN)lEJo4?f`g1m|^;ksz&aBXvcXT!gAX4xxpPEm)qAjsbH-d&AW_s<t&%Z>65
zhNk#h8(ERzxoY=%*xgn1eURAn{=Qk3`kkT^`fV#u;Hw;MYyQWkeD&8nSts7Qnn{K1
z1dJqm0Dpq#LFC;9E~v}H!=r~4gO}W$8~_MI6rth*h$UckX?QDF#d9mLJ3(;%>Nhbp
zwH}jy{s3Gw*&(Yv`n_eaJYr(UgtgYRKQq19l$bkNT%6WnIA7WZM8&ui^)s!;MCfRV
z5>&rTFhyN`bj{8leRdtC3UP9CU*kn8wf13&5IqJ=`^s!bjKurHsOha$ZK>>Zel-5R
zlWM>0W}Vq#ACeg<DPpPas`V{MQsn?~+2$lMZL=sZAXim3A+1_zD6XT8&1TwGyh88k
zV(W~e@EBy~{E(u79^+Of^Gi{(^*yR{mcqlqeo!un#H!prt7vO0--^|}cneCQIHsv1
z%3<Q6;H-U9Uyr0$b75~WS5P3VIh75=ftA4Ma&jetqo$`&<<-k*M{$DZ7qXk<!hsaG
zq*x4*P|K@R@&KqKUN`lhUt5m%-_?h9s_&V{Wi0Mr->&I67BU0_W4NkIC=C09krmrD
zwpGq}%)1*~yDlXt?0r3Fsu3BtT*swHJZZ^YghV>V({nP5k^l#F(nDBy<hc^41T(y}
zKVy$3TlWf?*4aMP_Zk(d*6D~XQZ}Grv*@PtNFJArqbCA5))>E!lJu6OW0%H_)dlzw
z48Rr>ap6>CP6?xbtlRA7lAH~Q9d`xqA#->_-#VHTTu3k5<{;rL0=Tz&Waroqdp7b7
zX_#{Yc#veZei<blTi!)!b0oPP3yfsC7#R;+O~Xvp<J?+^Cg`%}ksLo*b&~mmG0h5G
z1JUf=Z%2&(Dz?lfCBBN}`8mO7{Mli@`0E-XQF@RBGA`8e<xfu{^|P|aW{-31Ju5f-
zc4STOGK0DES*Fa3$1YP{_nWkD=aG?a?Ng7ci80p84V-ZmrE*~(b=#_2dF<{c<(Z5%
z<j%y4VLo)*1@l(YxpD+nh5z(U(vFDq-S)p!eQnO;E3f*}JGviM0i^oAGY&WEyrFyc
znUj8EBgC9NTz05qu7$H<Xx?`#Wz<v@=^1-rHF)K$I;}5z(`=heYj<VAJL=x=NMRz`
z?O`!TH1M0nIM(A%FVe(qC1I`3YX3<L1Y6E@sP1ru{qmX;-~IHGLY1Cq!4)dpDjIJD
zlMf#+S7sjtE6*#w(NuC@i=-4<g0YX|jN1n8_P*gmUbW*;car6MehKI6i-$wHuC3$U
z?wkms$fV;IFL^<)Jz2B56k1TF)`=)!lE8yrtYwnH{G*AZ#RQ^Ti==jwtE@AquevR^
z;DjzXdA5zkVQyKPRI#y10d6!C3m`1de=b$2>@Sgrsb9Ieq_lf9{i<MgpV3Y2<MWkC
zV~6PKsit{A^UxEx6ap%kjVFoC>cdB5g!OQm&iPY2^P?#4*Ei1~9Gt?yph$(_A5wke
zr4EpwFEQG4NNl7P=b1(&R-3w7*}oBHVXlvKhwL-B!!DHsIUoP%aa-j@+c#N_VqPWJ
z$*Z76#5kv47~FM<*7Pc`gPgKbYdaHlxFpN4{(OE~K%dAuT;ca3P@U?*0O3o9<E1hd
zZIM5Q<ML44Oa|>1x_9IwiWX9(MxOih1zv`Z1|cmI_wn46&o$|sg<J_9+Y!blCo&Xa
zkdY}60TM4>`Vg_{S&2#chsE$NmuvXu(fd5BFXzA+Q7O=RbHO6j+-E|jBoC0hT~}G!
z%3=+$kx_6~mx;l0L2p?JRBkm}BA*I=`@gqVy;!x6andS>QEX_m!Yus<w0*31jZxqB
z_UGBS>gKEG)?%+j6q-LCRQ3|W3cZ>Q;~2BWQx6NleaLk>6-<Z-pXnNTnacHmv!x9@
zRfQex_Fbwv*{19L@pG;x+FTZ%Ws;HZ9fQt-!s#p|95=jf^Dk@?DT)Sm_;zzPqt{cX
zYDe2groD)t50+g|zlo4LB_d8p%tJ9m{vg=lHypK&m$X7y3tdc5#$_S1?Rs+YS8UwQ
zuRsb%IGpZd%F>x>)(Yj!r{L$WZ_v1XSzBcbjiI&vX%>*5;for*nP)EK+J(k^tWt%9
zS@4^T7<4g&OyE;ed3!??{i2x(O57Q7f2~PdhhX0-TRdJboY)&5r>~yd?1d6GrK+$*
zm;wZ_em7OBI7jtLnHtzL<>YuMci{H^s&6Bp$LA~jffy7tfq-g`|3~l(9N=eagp%9b
zv<EJtm-{;`P37*UrbE|?WvkdAd0x(C_Ow*(o-x&lliHKH@&4)hgodpOLPvO4XQVFz
zc|1v#dM+sM&z!?8&q~3ndG@pNim%uBnBKe{>PZDtaUY@E_>wyKIqN;HagZ{@W(Gz@
zlD-Sl@d8U{u%fN@C}6a2@zfv2dI6`qDyFxIdwgfPI33FVl40$T-)B?9K9w_L`V>!N
zz<x*2gp(QXn_BDWEYP3mn4n%7aOtwMdxx^YDXkPyv%%Ezl3yy3+oLiAa^gL5nnO1+
z6)S&%z1$8pyRzAwed=$U+XKj#zewF|eklPz8};WEy7?(*l;HE^92mF9J&i;I>-z3O
zVMM<8tBn{NRxR{_Vkd1$UGV(-wUldQi&hW>Pgwgk-Dhj>B&)v54w!_?4r*25Us+q9
zs8VvTZ&jPWi~q*aqRlf|xF;dx*yrt3UuX))49AaR>VA>Yo}l`=E>xEldk-}N+lkm2
z3i{TJd!<SgAfV>Y1d(nz2>hM-Gi}>VwLD7n%YFxCM84fv)Nqvo-H-b}(Ph8r`_~aY
zN+nu`hJL><M!3LnelXCajf*XRU|%?TMamGo1+J}d_^1~Wf2wD%XwB>UT+WB~QtuaD
zhnorKi9`Q7X~D9{O#89mGmOBwKFC_iUKAU=i)g_DtgyCe(_*)V3YI^iTw96<B;)PX
zng5gYa--r6Mv29SszuZcD)o#<Q;Nh2qUopbs7-1;ncNIpVeGThP}<F1z3rntMzgQ4
zV?RH?<jBGAyjMfL)1&MV)*74KPN~Y63xQ;AU;yPFjA9h3W?W@-5hzuBTVsA$SIL+a
z=+r9IJk#g|zl>qpJPjhn`I3J-V2LY<hx9~+nLC<|TZOrf8&hPDxQ@^H9<NEJKyHH;
z*>YE>T_2`oBa(lzZ+}&DBuIt(C!W-fD1$FV1`Kn-u7Ac%_Rzb8;;dvjg|gXx5qIJd
zyLLEFg;>FUeTanhpxlI5Bg#2ziO-0{-KfGZ1R`63_hH&|U-iiYtc@pR2TwM28asfs
zK0gDrDd#s(_BEGVQ9a&&YN+CbOklk?DSdH%Uh&0CxX65rSemBvu|rvdKd=p_W3|Au
zv4-JoI3p2^DnXKikqPumh?em67jA*eRK|xS{_$cSXK@vqGLT)GRw<OutQ_zi-9Kfp
z&O?qz{KL~8!`25!Xz`y5lZN-_`mJ;NUT&GRXFK_9ZrRnz9p-D=$KJY#g4pM6p9@up
zkXvvrWYRbFzK23b*+Nc*aP;R|oVE$kS3Rpq!#WJ$)ASFg7*SXsGP>lQb_)zo{b78X
z_=)PM-`ybD$)*eO${23^yP->ez#vjY4McUv^<F?Sb6q-JQ#W*i#BRD+>@i{;w1T$+
zJy<0Wiv>>g$m!kDU1MP@r~OQqu(U69elDl5>p<mj=bas{++u9-EY<W-ZPkoinrRjw
zsM9}{W6_phx0=~!Pcoj%nq{UzcX<~jYLTUm@rN<G-G7{@^V6tbYn)i!u*AN$c-35F
zmp;3MtqD(x1%=nZZ{!OGFR#H$l`=KTT|!|60ii0Jh^elki9O}Sah=bl`QO{jvz-v%
zaSuT}<lAY;o_L_#JiYUxW&i0GQ?F6Jei%Lk>a=3*@ou-c{%BCoai#%z_0zk`%}<?R
z8V$DGyOH<-k~#9eeQkjWvXuY$bZ(PyejQfh9IIFE-F?IO^#x<EwA;SWvt5@25qfkY
z0J?Q?P?0K}@2mEw<8L3y6Lw_E83RKl51@yLJSq_yA-E|85&5RE#9m}5JZMm~1*F)l
z^eUn|v;_3Wt^AM(`ues<+@*z47DS)x>ehR;?X?qV#hcqy0M6ebQ%Nx*+1*zePuf}2
zy1B1%agyYZ6)f$SfX(4!F50DI<yI@;QKX|99szH0JQvzE6#%D#%ZcjC0RF9w%(?rZ
zA=Z{r3EQISHA#;Ye&pJOS>!(0>YC`-1hV;O*i(ja`I-TDVhitu?!(lC(9&xUq~r2W
z?IrgVQoQ7@iMI#0nLF_1zS14*^ny|!ugWIFVM2*jsv1M9DS}se{cF)~=+PmwURnDi
zRVvcNNl`KGRypCRIhByESod`e%7x7l_^E@J6)T=h5&BYlfDV+fFKicEl^bq-D%Cp-
zfVkI;r`L|{J2q^u1KK89vQN^9LSD*6pXDnqYPK0y#X6V*hu33UHYHKyP|l16TlInY
zFn{!8TR<@0Zq@O;A~)1cjz{M;_b{usk{|OST`fDCKE&oDO%C|^zB{>Y!e{Px<M1(U
zaU%c9bxPJJ%BYo#Lo-gB;#%`GQK%AZP$2X*d;qcdN48kn1VIt<7L5{Zcj_6LJQ@+h
zHByQkl+lk3R(UK9?Nerp=gR~{q!r7%Gr*GzynUstdyCc|v)W1Ou84^D#bfKq{N2LH
zJ$T~2jb`LUN%H>h6nhUyI#rV-wN^}L1n5SvzQFa-t>;i`S@3Ue!)><7l}ZoLph?+$
z#~kPWt%Gt$IQgYh7rZGlBv9Uog7=X8Ca2gDnPKi{G^niFq6AI;xe+znmuQ^Vf6V}G
zUZv>|@+SIcg>3XvO53*Eou<!YM%vPagn#5=N{|T%^H}TKcS33t1z7vP|9(XJjd+)|
zxSJ(~Nv@myg5*fE1Kxt1Dq<Qd3)Zodc?a#<4;10&kDo&t#GcPo6j|?<@EEkom-1TC
z4bAiNO~8jvQ!*yh9nqSpIw|{-WhN0~d!MVA>b@J*sZVqe@3dAZB|J?jYbS=bSn!^9
z`9tZc`|=@mRdXQUW(4Q7@b)i3RpzT2kNZwgryeMiPYd+*Y~&QiH)9j8cPkCqA^F)`
zab!X9r`AA$`ctzy$a)6X;0Zndy}AE7rFMJE_w^E3%Le!N9<786fsMi_V#q_)Yoc0X
zM_mnmn?4r_3ukCb8(fZ;KD~o#wtT;aVcdSB2X^%v4)b}w|50@q_Vh738wNL|VGr#$
zH)Z6*&4<*HtGWUkqJHZmqC#b)7|5}{HW?T=@0b(^yRUau347@IyjRfv$HC{Iv~x&m
zlRe1muc#F_0J2c6!hmC;=vxv*&0w3(J600dJBS6yFphpaG9)6ZuVTL~Z|uim#LcP*
zr#qZPg<;>pcA~-n-{Zr2e!T0SWFJeq&8u4b;K~_*uT3-K5S?Y3<(ifIe$E&F$Gd{}
z;P%GH5S`A9tTqvo^Z9h0>(RtU0SF;m6{>{GL8M3G<iy%Kt{ThNovwe@=M?zU`n6t(
z8!#)bGH$*QoE(eV$aj>VKYz3uX)CpLH{g9p)rMRrxw?<H?X|av)vjwowcxG2`31Qg
ziCP()!C*V-U0xJkzw_SqRn%twQwvAx#M#O1jn`vCZPfbm*@+?GrgAcd|CW4l8Y6Gz
z(te8Ui@j5Vsr`@AgO2x+R9x`?UA^LZQ+fZTUj2vI`lfOlIfK=6u=@GGOX-TPrj8DV
zPEHIW_BJMeYybZ*sB{0-&Hfib9RQZF|1GF<fJItPuz(IkU`1ei8y?%6h|K~11R}6;
zzp3J2Y5Yw<=LBoLV6_}9X}{HC|62<z68}}dS(x9%X%=QSa6MM;H@%pJ8LZ8NjetwR
zR&>AuF!x(20DR8<W|9S53v82>4J?}fy~522)|=mScvf&rumdb_$~Y@n?qvlZflFEb
zmV)~Mmx7giR(6)RQg+t2x?F!t+1bE?`P<-G!D{oH4*z#hU~!#|<;@Q^aAE*l3YPo9
z17iiBv%X2mY^)q_rC_1`t&|fiz5lKI*XMsMuz`JM<M>+_95)^C@n0eSpB5b86a)90
zCv4nrp0I*-{I{^NfwKy4Q38N_e)HsQgaB~=0PuLhrQoo=#p%rx0N4uvI6(m}WqY&E
z#rY<Cg5wLe2fhmK8}N6efWISU|0iPs9w`7EHSjgCociYd+hhU2_5gol3-}vb0C-~G
zO2HHMH?Hh|;|lm|mmM5e_P=pu{~Omg@4*uZjw}1$sIdPNm48aXQDNtJ^P3%<82Bev
z?BGlXxIWk$cFs57*}-0eul$n?0Y`@W?>un-od;HM#s-MM4W5U;sf4#>!u(bn0Pgv}
zq%z)y^xyBU|238IUv8-XF`>Z<UNsDC;2^QEg2%za!v5CrzY-c;;3;Ez>*6iD!NB%*
z_J2=kfb${$V?yJvs{Nl68sNzN$58%vnfq;>{GT#6Fm^d)g&FDl*(GNCiXQzrX;lp~
z)Nn$#?v+rX_qzf00>20hzT{AkN1lh8<r5h63sTt*3fb$+^Jy0O(xQ$%?lcRmtvI8C
zBhZLnuh1TinoKBHpbOQ@_fY+kX0FWB`FO?w!1(M2$suu{JMa?72MW6sA})E*iHIw7
z#zyVPPz+RTFufPWktvN*TMv~ohQI1#(ti#V8?%cX&^(^@^raVgRd{M;q5#y0uo^}<
z13_8G)5#_N^omR<nIqF0ahtp?0rSidBYuhcx%zS&4HJY?@j@ybCF@d>N<A~$QO4Ei
zGk%2o!9yNV=7%s!CJ2A5KNY>VRC<S30N0i<8^7|b2`r8na?BVO>av=I+oUcL#suR9
z0jeV=@FvNGnDm%D&fTtAz{n$2J%5-<J4881+UgGh?U>o&H&!QuV*4?%Bqk?HJwK8n
ztS8YuE8de@53pObNmlXOCD^Mx`|j){8Cu$Er=31DIQ?D=_p_Ts7{IZh*EYn2V*sS3
z1XD{pefS<#geTmH-G(v6$aYQn%T~J~-xC<<Fw$i6-u`3cE61H`&isz<uIc6GEmP3+
z6VZSFwfK88{%bw|?~CB=OXvSw1Si_wpW|m!*3b6dlVkG#J}1Xw`AtUljZj5dK!ieE
zjDnRyjDioH?BG{~kgo7&3N~``&6p2~<7l~5j<^@iNMl|Xo+C7Kz>0z$0OL_JzLQ62
zT7i!9xYusO?c+xtlHKy7(I=Lw$MfU1^|s9CV{<`bFXI66fPE>54e9OgF+}29C>pJS
z88RXuPx;6SIwU?;rsSxWtx0o0w(%9kJz&YK);x(LnSn_k(d*p_rO1`#r_}k%5tlL@
z38~*$A`*di+U7K|Id^g*-QLVT+KUO2BXSons}?~uYT`yzVpq}hVnRoZtSM3DK7Ky8
zFb~j<x&R!wg}~3|AKZYyoYKcD%UdJa(r>GHIuht1UDR2g9?6Y%ZtF0kI^bF>z9mM4
zK@*Q6qeBFK@e_d}-W)j!X?)?Rcunf_F!Z8wE6~~Fl!%jfJfJ3L)H&FG@X#X0;CHog
z4*S?zq`TKO5+rB9DlWhAeBBOGl5(CQ6EL%bBE~e?D{1bq)=vA=>Ug-453ICLV>dT$
z!TYB5at9oXuooz@(s`UJt`oQCtRxK}cd01dYyqp$GJ~53U0nt&a~5F{2ynQSh$tv2
zr--Mjcl*@2ER>Ygl#}{QBTs#ag8UAzG3HF1^MnkDmcc8=Yd4NQnkE~vsdED96<~Oq
z0L$^+SB#t4FW^UtXd(yp-X34NPJfDV3UXr01bXRP2c3){G_$TsbGka>tV#lE2~KbV
z)?EpF2hE%kq_E9#GFg-c=6UF5f30A<ezd7wmALkQdDPVi<liSA*hURThBFB1M6(Fw
zeeG^a^6&6$rJ%LHr(Ygk9s3UCO{mc2rfDM6=h_|gyxBJ1kVBtWE5_zKeUHk>#YI8V
zNt`3*r1b3<?uc^JF21p;7S$-2Y6<%Q_pLnL`r_l!3A-!iyhR;+n&PB|zX6IiyZ2NN
z8{tVzUo;+?C9dEy$pXw_zzUu<rMy1BzeVAENc<@!%=OhzO#U_@!I|u>rb&;ibWZ1t
zu@qIuJQ2(7`pR`|_K{ZQ;zW8Z`&5<8Qr%rpW=B*zKjU2W@YpYeh}@xGVlI)-j6Vqa
z0kvBv@xibSUp8EKsxKHd)PA~*moX5;;SU-4I6aqW3?q+Y`_$F=6HCz~3%Xr8?)M=r
z!v)%os@saHF>c|YllG2Y*J3Q{M;>DO;Yr!uFM6vk_q=?uRx=*&8imErkYeBgHr&_A
zzm#LRrgFSKbUk3nX8N*@O_^)nJ1eY^>$uqfwVG{)^YYkR=C<2vInK{NZ+%mPUJOS4
zB$wQpx6iHWa;rV466QT_ARsn(58aIp`P}G}ugjGk7wTKB-4WTDBqFly5SILnMfZy9
z`mX<3$xnfVM-4?I7qsNm`)H>;_XyGv{0*6Sd49@Ya5YQE3F;rdz$M;+QK+IPb6Kj*
zHx%*DwK41Fzoi(%MEMQIr+ku6jzK$>DtKV}{!D}pX#jrgOg2TkUsQH7gfXDbK!K&2
z5ZyE^{0m*E*ZNYbTW_n){8J1AYHJ)}-BbEgM#fE}#8ymU*e`a(VXM*aTjc~P>d-I+
z0#%E+i)j33ZuUG*7rP8LGSd4g99zGF)Nu@5=+xb$PI@Cxlb1Stqx8!%J(*uT1p?Bs
z<9nD$zD`J&>YCJupL%B%%wL`7r@MHS;+(-Fywr7Z`PRiH7yn^Fw0c+u4*S-oANX9(
zTtLe>Jh2`UIS08cY*5T1tPl|Lxh9DnyQe)YEUl4EFMC->2GuEQX6kC`7;ClDWS!`>
zWIxCr30`R=rf$WkDBKeArbk<ql}rQN@T()ud^poJ@FIhrl(1*x*Ru@IjeTDCknLvy
z2@5unrwZk8@Wr|+&(4lbeuz)jUcT}I^D*2}sfJdv@|%nU`Dq7hD^==SucX@<QU$2d
zX%9h+QPAwPoH$&G<vo(8g8I!npw+o)9q6uP4q6v4iOt=?9FIyG_ST8kDXdg|j+u1}
zkCTxS<kuy`AE+Rc*N`8B43`P#1wl9Y#Ce`F-?%?_>-4J%B83F^JAPJtIb?jw{Q^it
zC0?s%;jy0^-Ol1>>$nr4wmPI|;KaqhGTs|qUf;GTP@!Aw#-n5>b2Nez(F!Bn&c4CL
zUI-vP++Z}HB?88K<sIf(8rxrAw0)?*Pw>r1zS?e^cI!LyHam}%aZR6p+6;Rb=GSk#
z00XBkb7}}xIoh=AqcY>8JAs-%pPVNWB6N>CWq$l&R1i~iW44e0JXFO$mDMk{)VOxU
zSa}_v+bT+F;f=ra_D=bF^e>L#=%Ade?bv*MLRJzFc82@nS&Lr`y^Apef8`itdtG*S
zr&Y7H1>M&bI-o2sm&Q-0r}Ky~*DebrkVaoC>50+R&b(l6sL`n6?3N*d)NOYhv-};Z
z6GvTg&G<Cj!zY|RZ`zaPr<>y#=V8J6V`!tYWa1>^FkzcC718&wD<~5={W-N&!`B|n
z7o2*~T>dT@T8}96@-2`qA+MmrZAPmz@wiN}Li508SJw4}UnzpfTDym5i*F9Eq;?5b
z(RsPvZsjH*D+zr|@IH;U?183$c}&6Hpq(lFx4%!;_j6&`ewND*zRk)HYpRdy%K_`N
z6Z{&$=}Cj%1uxgLFTmO7%Jv5}`DJ3gGoHtB!L}Ea9V@jEafk|f*0LPOCXenEk*9tS
z37FFI+Tz`E<bsA0jXAMfjWb@&3_UzTW95*1(Z&29@F)5w+CP<scGd)^y{{sRrDgUv
z`wrXh>1+bKysd@(PI!vQj-q>m{bakbamFy>_z&=$mIof0R%5sL!keHMoFH~#yi9D_
ztDvmsAk+`*2c{7tMuF7#qM-aL4$?x0x$npG8NAn<{T1%Arx{q*9LEf+IKKUV217RQ
z;X`r0Q;ue0`&z{2f9b34{uapcYb00XlK#NU*PlHWsBv$mDf1P-usF2aph#y57rRuH
znycnZ&8(FZSB|kN>vat{mi3p{^15aTG1J?}p1*yJ3rW9ft0RW%e#=?qUI6+JDcUpt
zxO_@#SgW<AS-S}s<0$NQxTnoLwJ9lHSM5pUy8Ctq9Vbd=vx~`fhcxz?@U}o@-K7V-
zrMq?QEe=P%o>JN(1{sxnNLr^Gk2?<=GMg7mtOTB}_&}+uad8Wrl_SQKgKcf5<z>sj
zfZK4AdW++C9a}+ev+BwTejh3iez%ilc;zi*CrVH$6j!CwG?fHCQZz=q>}T41l{=``
zGl^|HPHJqIzG8;qkExD{mE$9Bm;=O4KG~lgg97QsXQVe`{}B6vvJfsyNp#?My+rGA
zBPcByCp$vs={#S`F7YeZhx9EgoE2=c9|t>`JgII9?)j);ZsQg#1npkx`b_a&)QnDV
zii^*Weaxp$Nje;LLaeBTx!Qy=Q0_@9N-4(+TVG~#>Q_b{b@W#>l4?BcZHH3KdzOp@
z>=^~?XatYWiLh{x=jQShZ|&-iEh{zcOGYPvwP$@UM3Lo>ws&P2At7t>GydqhneZHC
zeBr-ilBC*L=k{;<Nl=MrHzJPD@OB#e13jFucTQ@Lz1uI(FCTB()Ex9(#qL75n=aW{
zcbPPsV%P#xZ*T(o;>w50J==4Z+Kc!1jZseq;gQEdHd;w4@s<EHQ@n8ZG=~bGK2m34
z7_o-OFDS-P&mRVGLPQ0wfbiEs8Gm*_u+Pm1!}X3h?o+?~V3D%zsiLF8?deN2d3jDd
zeq<fxuD%Lfj}?be_L|YuDG=MI&c91xbuE1{$aqS|C|8!qckMj3HBRI6$@^kNTqS#u
zw|^#dXFG5e)g1k>gHb_eCpAq1+o!L)?*Aawp2UVuFN9qc$yy@BA6L)*vzZX?qxP~F
zPnB08T8qUajRQ>skyBC`Y&m)*WbLXn0v>`glk>IAebl9T(R5Mz$pE8^kev+sU}*AF
zIo}Nx&Ieu#DtqTPSi<*UC|h7X5v^1tf(Cz)7J*x|{`N!I8JTN#0A{YYwjAYc6KS9k
z5$X?*-qYD03%YXDptK%~xU>+SclRf218Sbujh-%bA5ZL#ukA%&BE1tYCHo^U!YFhk
z4(IWtiN+@wpU1D;7Al8up?NU%@UOEm&20;QpFL)u!Vl$Ld_axb)PdkQt&oM@hU)P_
zXV=s)B%Eu9cN`vUw6r0vLYYIJJQFjh(@sQ<>E4)3HXPumkld8+|FKUrHy2y7k>x5n
z0Za??ez9q^X&_P^ob(AjbGcwqIfm)i0>2F846h-5E``Qv33B=(;Nfr0yuTzAX=VH8
zYFHu@n7_G_3867zI}i|yPa3pseZq$vhzVko?%v{-rtjuNh^9c9<3H!Qxnh@oj}RET
zP3q?T=h0N6d{d!+ga?Ts%^&cNNQhz2p$*|!Eqn5&kakemC9M<<kRIV5=A7~V+6lyA
zxiJxSU&IM%`_Z8F&hG!A?XH93YW98MBf;I>-Q6v?LvVK|NN|TFxVyW%I|O$K?(XjH
zaEI)(@4KJ<?Dy2Ey7v}U^T(Psv$}iM%rL*t`gSKO!S=h`_#w>2x)Mx*;cno?wZP|i
z2X%BmrR0B_@^_u{f0^ogW_~}6K|m=DK)>hD8<)6)^qAhT%-@DsZa!*W$FDdec%~<d
z3?oP-dBL)en5e`7(}Z1I$=aU_zswC%=>gA@!`!8wS!!j&rge+~fj-l!;~A1FKP>>O
z+6He&e0okHRf6241|weeYN{r^ZiRS`-DQoDu@>&p!FK}U=gE_Whpi;JbKUyh%5S9$
zbC)5YK9DafW5_CKNjefB>>V|kzeO2CE;q1%MCiXhlSsHisL}(x9AfGm3ripk#JqtM
z{ym-)YW(v#Djl|NXA?)(vQm+fXOKJ0Q0_)%0RM<Y%7tz3@GID*DY;_=`?|!>BArn1
z1268eaPJNv0&eKctnG;cqrPoptW-T&WPi;VI(13*Rvrr%vPn-AQ;DYIL5iTE>xvv2
zVy-PTMe5ToUXHpIhDajvglRg>x7>S-6cn#nT=LP+_&~-x&<QBt7=CmtwteHc%yDar
z3a>v#|E`9<wV`5oHT=baWSa?y4|5T(KXi?6hchg=Gfm7eIu$XINt_>U@nFe%P};gT
z>sc(e5t$e6Gu4hOMx9#xSH^Rh0AAI>*uKy6`W`0Mkv!zHUHW4L6)=&{K=HF}df*q?
z&xZH#DLB%>7D4chzVB$ib6W~|>v^b0_)5+-{p(UUXet6mMPfL|)fpPQY<jY{$sZbV
z0OBrg)uUZ48!8Vm%h`FQ!uMc)M{C=~Vfp?nS?dbL#0YWFsm|?9dt~&PA%=4hmyDyz
z6;Q7K<w@r~?YbuB@I%|bT5?17T8P82QzT}1jy}h&TcvVDaX0=~lBeo|AoJN5)m~_F
zjB7P$mVTWdyvpPcsIAit7R;7zDZ8eTxGu5uyhfzPcw0RiJ$L>|65BwdrwbS()?xDa
zcN<tfMf?_PR!ZA^;jhTyg~}N=Q$p7Pp6PuV=xIJR+7Lc6MqE@r7ZFhf!y?zI3F5PE
zKy6=xO*XhP%S_EgydJ@3-!;;*P7zez3oZqbB~g6Bjf3_Fy~}L7A4PyYE)t56Zb?OX
zL*L|TL>o3d&j~NiN<lP#fM>x=fLYevA%(L;GHZ<D5js4=4E7NaQFuy|U!S9ptc%yU
zp(GFLQ6v`)yy}H-<7k5)LNav*s7kX>9Fs!rn|?nPmnzRn)E`kr4qjl=C=qQ%zCVID
zjDpWyi+B^OV~7rp3$y`0qq$+oAc#rz{#I#<_)~df1rkphA6)j+7!d!FHu%lu_H1)b
z_byN~X6z{x-kJ*Q+qF`bPc$h|nVy8G4I~L!P-2<haKBf1W*jtz_A9E@Z`1`uf6(&?
zbYi8dJFxjeRBe`<dDz#*Z}&CPp7_o%#@DYqB!ug)>6g^T5{0Ozj<W5J3IXqfq##dn
zpu~Rq3ol3)%_6Q$aXSZAO-d!~j=CWv^|TbXUEa_7<Jftea*?+FMHoN#KuohF#zcN;
zhwyp-;IP1C8sQ77Ms*nS(rxdh6^Z^-fn!f5yl1iV$v+9f!^&^<C$a5}D@4`p*pTUz
z6rkFJ&9o!~&RS>5d|-E`zV4*MEjwo6MfIQy?Mds*w0Lu+5(B(Oh3YDgK3qSD;<dva
z^(ooj5q*cAWn11Zfe6@^tSopTvD=<G{Iw?KUi}r^@H5I7ge}<lCq+_kiJC9-N_x5H
zJ_=n+W|FvTn9qHty>MXMxS^a+bfIK*ZOV<Yem@J$i*7A@GtgGNF5eQ`7#m{4Yk}B4
z=cx-3A3SDf$a#Uj#mW-h*`f6Dd&AD1+22d%BE~AG-4)%t&+ysFfR?))(QjK_up8J)
zr+n2SniuWu#?1nA_Qj;kq#!@%H?*%5ccN(zT`~G@Bk1o-ic*JYy`)z}^Zo7l+xZV~
zV;l<*dq;yjsJA1rkhI>3p}qQz6Q;zg>%0?K1+(K@12`aCMV6Nmd_r>+3!r`QAZK(4
z7E*}EB%zESZ^#$zV0{axohpQ=71o5kPKx=x7`H#NvwSef7K6ZV80?`mDY@X)zdLqr
zG9_FUfgQZ}AcnOgs7Q6L&z5=bgM6<2jvr2Ov|{|_scq61Azcj|6@)-xeZx-o#Uuhk
z7N`RF@Wo^v$Q&@G{Aaq2+`DKSAYRE5YL@MAr=gM0eBlT`q3m)}&muYNs=G)}eTtIK
zUEPfQ>}@2PFF4|DZPc2Q-@lSc)3EgnHzN)A@#wj}%F~vfNi3Gfa|Fc6+o<?K36%C`
z$E`Qi!BP$Qh&690@MARxy_NN@)a<NxU7hH=y%t<Oj*4Eji6+0YNH0O=Yg^)1JH9G<
zQ~9V>OFJh&`{<l?6dTvn+$CN~H>3E!(bTa<Jj*jj@CrHhyvb^kuGo#$w@Q1ayl~`Z
zn#2Ex+TjN({IhoWe<V$Sh=!Au0pNQ2{}<^EfOLEmF8>>BVgXRWU$BWCU;`i6^#94y
zKl}zDOMkK;fN;PE>3jeKfZG6+0Z3VVY~lbE-vN%m0q}!=!KOdp@&}ukKSqoRkdpX-
zh!6T;0$|Hu3F@Qn{||!tvoD}X{~=u;Ps;@8$OlP%z|^1P1Hk8F>t9idjq6X-{|%+s
z{<PsADE09S%zz*V0CE6y1L!6Iq5gtW09XNR{ex0}qA37!0kjuDN&q$jfX!d1>Q9IN
zMpggV_ur}NA71zGR0YV9e6Y<Ql=`45K)wV(Re)jsIOd<NfYJU7VEwU?zX2A@AFBFy
z!1~jYzX2BO2Wb5BsDA@2fExl(>fZtD&uITUV6psx!M_0(pdSEw`gg$kLtuXctUrBZ
z`v5G!5dm!i^bXK-ra#!l2EZ=B{U0s;$5y~zfW**$U@gG009yg9#R=Gx5per4ek>dx
zk7fS@lAM5Z{4eAM0KI>Z7uTOR2p2#CK92iw{&4}$GJt^n;}re_rXPs+@yGJ#?E2Si
z&z}eX{X^h?24esFeg7X#j0tei|1vRvbuuxre)RnRu8Dn&)n82PLpJ}}oBy6eJ|OU~
z9HJ95ZsW@c+keh08nK#9428%IMI@U}Znr=XehN%z$DN1tB@1HByQ^SzPJ+<e-pYqv
z&$A4lW`2~```Wj{z_h`kzlSxg4ScS<*daRVx1;+S<a&#3KPCLoE%WGv+8DfoLe&G`
zr@}=Bt9$(b^s}6YS)7Y>p6b>8YIyC;flD0sZ!Fsi8qA>VsO~oXi3JeoMoaC?L~ElX
z{5vme59(t2$Qn_Ye3(i7V!pO3P&q#Xm1?%A(wITaY_`&BG^H`=wfXaZ`Q4~(&kHH~
z3#AoG1{(({lE$N~lHh3)`{pU-$q;ME=BXlYeb4)(Xc%1OD^Z-;4Noi`#GIFgvMUi-
z4(*H)PHGw4kR)a)8Okh@rwKe&prk=+9wkIVs+h11+pRc?>m()jdKCv5R1?z>yo~Zb
zuYDo12_%VW)|P&8wSH!+nu!@ht{`JLuZ=Z#+t~MHs|KSRo;$t<F`gwqNn0w*4WUL8
z+0$gYc@0|8J_-3BzLh?l>VNbS0xlN#_m}WA*+V;CWo}^Jf$wuc_KJuo5(u2|&bLVs
z_$+&-Ux?5F-@j|ap&_FAN2LmdOlp}bN<~1XgmAM^OHn3~TUt0LC)1nCs-@2JYn(eO
zY^L2eX6|!+3b~!TNp^c5e0^-VTN`gLYr9|idWzDE6dmz1h@vv=B>r%7zal@kAZW0L
zjfIYD_Ho1S8*%An(e;Q(9}q?}_AYLm4hzOEh9~~lccNjOU@PL<L|Tc4mX-D3!Qk0&
z%{c8S61Qsvr0|B%&q!Qu7F@~px7cywRJ9>9LZtBV&=Q{y>9If8%`7cG>6(2ti<ov8
z%Mz71l-l5Dhu?N~@oETkIY}AhIXirkp>9%eQjW822o~j_!R%ECK7_Grz4_FPEQ@!z
z*Z=$kdviVQvAno=%<GmI{pzNLL!o<qx^KIlxi4?~oHdMC_jWaRMM5Kn>l`5yIp|5;
zf7<?V6n9duOLs;leiEv?{}7@W;o)%mJ7>slZJICUSaUxgw=}&`e{Y6Mr52K>zwRA(
z={~nBWN%F_NjO0i!==rIaBrZFo^B;Um?IMo#;xDnlILE*K)58(?5H->I|>?lOqW6H
zarJB8z;*^dYU0d`F|7d{W_0P7JJ9XJa;>py{~Gscv_r`mgq|f%4h|O{9<8q!U-<(2
z9v>ea+)+JWJONPDgf)MUW7v1SFK73a4nk8?UCS>1v=UOa=ZOnap{Ib8O9p3dkqFH(
zVcCs)!D9&~a;*rNoKtiOE*!I<ya?|amQdVDGzpSs%8ov*mMz5FyPe<0hJK9hC62E!
z#}{9#x7pk9m!YRGO~gpcd;4z@qh#f(Uu-Ov9+OcOZJyuMaBN}auJ6Ynd$0`|@ATqV
zbBxc#XSw)04<6t#Of8JEag2w++N}Kq9V4)DPk6f-m0fX00(G$pXu54C;g37yxpedh
zcFj+-!$%}E_ABD5$QD3c(yA(PN*n5{x5v({q?bB)f6XvlM_Xu-;0L*rojz1IK;fKc
zDpuTUvUzWoSOxC2+>B1j$tl&cy!6jL%UO9<({PRXZ0Yv+wPcg*jiw<%jMg%G@R<_i
zXePMXr@Nu|6&WWJXu2^UM^8sub8b#@b5a>w*eS?~B&>$!j&a3#&n~!@mz8mna^75w
z;RTwCd{XB7p;B!(F3nT5e4;IWb<}w`_hv<8g*Uf{b@K2=Au!CV`edvrF7A0bljd=*
zgRS@lJ!!iWu0z+SoHyBn`c2GJS+&%F*kx|~+c&kjIZW#p`K(5g@RNKl9;NhJXDs7n
z2h)4uy;n<Jt(u$q+Yxzsl->$1^jHUC3WmF3gaxyePOqV7GntWvgD<zTs}+^1W-r!>
zJ;sS#`I|;<1Z*OgTnhf#XeV(sVNBg%Cj2Ys`YzhQdW-o30gp%J)=$?$mHu{W)1`Vr
zVXM0Kyd<UNR!f$V@b9~UuM~7nSPB=PFR_K&nM_mj^@e>%5|ll4BIBRJysDHsJkO^-
z^E)1WI`cb^6FBuYKDPR;<D05PKD)IC`{g_$OC5>@2B$fjWR{0k`5XnC8k5JZn&`I{
z0e;1N;Fi^KuwN>tZ>u_k&({SKD;+bP^)4_^ix=CoNtZB;IjQVmo!4fG?LwWNhl7DI
z?~?-dO@YS)ilWyP?!0ffz{MoP@C#rVq6k_}ho+$Qs<5hOV~d95<7|_5vo_leq~~76
zMqMvipUxxlcH*qMl28#D`Dm@4XaZZ%uN<VQVQF$&?k*fghUd_o+00XXg51DwlM3gX
zbiW$H<DID|CB%|oPWyr|=$tKe4J4?>#pSe`;>}NX2(%ur&K2sqVrIJ6e-n9WYJ6+n
z@w^SV4o&>klATpk1JrreZrh})>s}7*yy|W|5J4i2eVn>jbldNrgC<r_-uuJ6Akj@m
z{b%bf;dLkXSDx0Vh`Pd&2oqyGhGYfSJA1*QrC&kX^GwbC{!{&d=m|Q@3hz#R4-jFC
zE4#uxjg6S(*q|UFvrgCZ@mMYM<vOA!vty;Ec`{gg%%ev3HJSRf@R>;8W+n|R?PTUH
zZe)8?awq0xn-R|5oKMb}6Zg&vG++W06Rj&b9nRX)t_6=hX<(Ux@eiw8GkNRDp7p=&
z{+bF(imOS3>%xPVR2U)0gx%Jmc#34?tv8<CD>{_kd-e#2!#mDsvfpdr{*7hW(#_GW
zc%nS+-&!8nbzrSimb`y4zX_6|{R<#F5w;z8$9Vk9Yb>+bby4GM1ODV#+jmasaL^Nt
zoC{1NCH{9lXkjP4@zFQKklwUCyacwBo_QoRBxaK0foj1$`O=<-^BFZ)Q^;?da{OH1
zh<Vaw3uv~adL^{5SMkU|!JLIat*xJ6&i1PEMWx%Xg735|v%B0pR0&yZ7IuEEj_mJY
z;|5^b8{&_#z&gVYIZ=9t=GHt`*4d=AKFP)=e3f2W!tU63aJY`iunm{DC`})zi|qBW
z>3rAfeizp3MfPc9+rJ%}>0_~G4^_&rhfdGy<>vHc0^;W0_VfaA^C?h7V5kJod;2xE
z*kCEvH`Y`PHa)kqTZ!d8c>M$undwDpZDx65bY1qy!gkJ<@DP^L%1NBfNW)%YsAhT{
z(ydcUFj2_hbAf6q*(0|Ss3De0C&=~*BTcR`_>D7LE<GV~;oVDr<k!5^+wrA%qH$g&
ztvX_xsq%;)gJq~3t(2$vWJtFQt}`FOqp5=G-SFM7hex;S+Mc=Df)kB6?eoLQUzR4v
zBqy-_`d+2g2&#@8%TQ)|ezvA?K~*mZI{YtMr`Fawk1JI4IbS#zG-j==_JY-TrLi0{
zA~Kd>23Ga#HZ3JgkKpYaoY1{jNcqi&-iYV(Z7yj{$>w;C)!A994IQ;GeQJ*nUips;
z)iSk|y=S`|N{;7{yh%t#%*Hj@*m@nf->>Ypxf_}MG4OTny{S?GD{d1jU&*rwV4NOX
zrP3_esih=c_rS>YmY#F1&+j2XJ|uiv6`h%Q?nw=#VIK5ps4gna+_i%t31OZqe-jpX
ztfh}D0|^)9=-0wm6Fa(;$0pUyL#OiHdxL3uw@UR@o>FUji8ushi4nK~y26}xvLIe1
z)5wz7Q>HPhR|hL0JntRGmeP$Fz|>r{2d`J(QwUwSlV*IqHd~%iq&04L^;M<X6;Ox~
zV!v7}@KWTx`Gw+?Vg>Ov+l&NGDK9`9@|DE`1~4nmNHLf_34u8`40fj+|HK3C4jY;!
zU{*>!(B#5;k4yv(ug>>mO+Q*Gp~oUjNnO*tZ@;HO?SSjme^m_L()!TYXAlnzMh}7(
zgL}AZ#=G>_$*axh{v!DL+JW?_w7zTNbscNut{|p&+tRE|><zlg&!U4-`IS51^Id?F
zF{u@@BCik(mghv|V}``8`Ldr~rZ3$Jum$NJ%f7?m_in1RP_9bmy@V@k{Z%h}t>yXR
z3Lb#~LsGS>&!Z#q)4#MP(WZDWp_e!(<M<y(=yqGF-c^%Us~j)}6#6R%>bA|6X$xpC
z0(m?u<K88(OeZSZQ?V^kMQ=_+!-tbJ453XV`!sch?}>LtG#^P#G|Gfl14~eSeV__f
z1(x^tsnL<C1ZgPDNm(AqQ_382hYaD{nbIh$c-CX5<H%OBs0c+Lctn%0SJwr=X{rfu
zn9yU}igzKtz?lP$JOCH0W-0cme|l_(w*Io5JVlhN!NVkX$Pv>q;uxd%-EJ&O;3yNU
zp6|<mC7TzST&Jh$uh#1yFW(*-Hx~jul3DqFyu^YO&df?t&5+XPkssp4rAsoXD58ut
z>*mh=f?tf-yQ^l0n`XIs!{0@{UGc$J>XG*f^f`~sJR;E+l{w7SHG^tKZAmuRcZNO<
zRBRIiSEqqx>-)Ovl;Vh_Ng3U>?r#q>rbm}*LVVH`Fy8ZqMde2%QiL4FK2OB&f8ldb
zfe@`k>9-gVFhPP)#n3ja?C@2W`dBoa%SXCHv&_reC1cU0jF>{w!(yp?5Gy3?`>9_r
zu=z5?lyBp#Eb_C$W_f4BOA?(#sNFzF*LD+5IjgQ`d_T-`)qI%Pi9jy!=~8v$1sHT<
zlx^N8@D8MB4Pk?BfufA#Jn}9Aj|k=te=){Zbd8g{uIB1<f@$zGQKj-Jc#}C*Uh(O;
zw^Yh6l)2_%T;gs#hqH|_>UKE7d5b}lfmH4LTB7q3Ok0I<^wysRSTs)(ttoYb55Lww
z3>fl-2BTZT#-54e0$oXjbs2)Jks%v)i1IG@JDW$kPUVF5sAI($+xc$M)yyswh1vP;
z)wsZ}5vHG<5>e#Bc{HBp;5J9cs1rQuNU7}E^goQUc6O^wyTJ6rf*ofKkPWhw=&stC
zQ7;h$@+U)|r012XP~E#4)$r*vCEG3Q-nb$#>Wm(%baGnh47d9B^*e@~*9Wp;t_OKr
zoi8RW;iv=y5;XKZTm@_WgiHwR+h86?o5$4{1{e2GTe>T@EGF3Jv4yChixrQBVxtIz
zs$J~;sizwB-5jRx%XaeZ{_7*a*5>m?Ps&_~R}k2h+e1qH1rNR=bbI;cZ>f*hn&>b)
zmUZD>eEN2q#GakB66`KeSiQ(f`ScpIYS=%W^^EvvCQN~L3{)6)+nL!FlSC%WT8|>*
zIjnOFa?uOp7gk96R~s<+UWpt}odTI6YUm$C_8`=)23q143c_N8UJnm_7QDF);7&EI
zK9@z!<?>DM!}bfUOfY#N)n14}M{{iQZ>^wu)!qM444|iNr)qc2UyAHn(=_DjPm_o~
z35#o8$y)R2ldrlWyY*&yC%i3`^`uzJ$fkbrmgvF5A!(O1*)mv&Mga@9&3a>`>(`Kb
zqU%bghe#EKQ-^`gf>r+EE?a>Ht_XY28@{<NO#6o82FVMzw@yg#rqla~TeIJhjrFp8
z5&E9(`~pMHb4X?%H@@92bj11aC`xG-8#n{K80;}Ag?~lCs=gF#PxmN+w?m01`UZJ)
zpY=kwD2*}6k%8M>cv1T(+;W=9D+_jx2$qIZ-EhNb4CxBGQhulM8Sgynb+}<`@4NaL
zh-mJrwy16v=BgZb*NcDv{PXy<Nas<m|KSYb)Aqdx`H}dP$bv!50~sCao552|b{!TN
zj-jV`^A>rpepcK%yI1eVox%HEG{-ygnl1wox=t=DV_=7*4=~i;xeS3pxDaV9r8qUW
zP)J2kVZ}}thQg-{#GjPDJc3v+D$}wLv6wnMeJ})5=nF%oia;uqOozm7z8a=^Kx5$R
ziqZ1^VGxgmI=Y{^6p`ry#&6O1DAo8se?>Kvuw_cIw-W$qMlWMQ+Al9O4M>t^>jv&M
zmvCc`*H|n6eP5F%znmnyeXmV@#lhNO!Mz}XX5~GtveLn#sYBV$0G`+j8e+qK#i9P5
ziBt(}MS<qR1%9j61!_+`I>#s4Zk}0Ur%4o~xR|EMW;Lc4nk-D!$OE5b4*w!W|6Hzb
z(dqq`p3`S_G|(Tnmlck-b%S=*!;>qt0+(sv&u#nQhZMq4oCqExs3u!cgfK<f$QkBV
zc7Sz=`C`s^cEX>p$4?1vV@T%4`23kaY!z-L+C0EDx)zP$3S`fQd0vv(GiJC8{}Gh$
z%Ed7BOlj8&Ic_~6<6(47gaWaUxtF#I&lxaHU87RUuEs(-JHg!?p)=u~x*&nXLm%Vd
zr#KC-pJy7(kharS2blDFxub-djUnvP=hRlf*;l;&?)mHJ+&xb<m+n&R2qQGtI(dPZ
zF>t%vx@bT`$$2=O9N*W){X^27r^o_MLfoC-T%uCee}OElt9S*;*cQcXpe?*pocG~I
z0o&?BV8NtyQGEe5&GyckJHxjQ<K6%fVmebR$%7d@SLkrCiHiRIdK%-F=s3s}<?{)m
zuG+KCTUwCXHFOoO3(Hp3Yz&?m-4nqS_$wmx88Ckqe3Q8o1uzba-1H;9lP)*3bB_Qo
zC9Q7<xA3GDo~BmgI^*bhJYX(Bi*4Juv6tm(m-n^a#g}2!*VKa9wy8Isf^i?~t@BrZ
zst2_^KYWW#JjL{wh;=5f%Vn~zYM$^8y4~C8jAmi(D~~6>R{{C;VAU;ByZDE&ho|%6
zNXN(f8;>V7lxF~91U(aAi$LYI?ta8&#5t!^K)1l3^e%sfRs4r)(ML7>pVgxOBg2q2
zF}85B{(nRm|F{7Ezab3PkIVl5IRVv2UIrio|C*HnNXAF#<6lMNAK4D}f3u2@kjdYJ
zF@K&9P`Uq$KLD!B|K$(=8g%(nacBPbpbH>4@=sIvm!Qj^YV+Uq;6Dak{?UU!dhjtC
zA7=9*1Ru3}mVb}9{KE|ZrRl#!T>fas-y$v?|1sk7XM!w1-JRn<M_m3q=5IpqQJ?;s
z5ODp`gny5?{E6oLO$h!d&EJIJPa8gjfb)+9d{p=WCIm1H7C@+o9Uuklj7-q%fJv{|
z|74^%IRF~<ui=(I{r<0T%g4|GO8bAtj`3rh|5D5UxcBdGhW}YD|DWgo|4%9ZW4^9G
z@fJY40r8fP0sOyP%KzW-g#Vha3((7d>CJyz%V+waw!hZ$O=4sLwR}YXdw&1KL*i~s
z2^=Vm5=9lmNrL!0Abo^hMWzHM7#lqnn<>)zPkYn9J;t$PaZ3t^&E;cVIEJx#PwN!m
z3+$Yc&0*TuNq3bk4t=23?agT=e>UloBM6(cM8}cI@(bBr*<`1Rvo(AZkKrinw3wbA
zozI5X9-s5>0qR#0^UH#6(Z88mm^TGV$+FTa{xa{q2tKMeuy6RoeuoubECQN*S>jvx
z;g2|4TEUV1s!zbVHb=B2OZ0~3oL+l{A-wGHUNsv%m}Z9gaiWS6o`G>@5{vl73&G|=
z@P|%QOX=bYKbGmy5-(ra`F(<{!Nhi$r{0)<zDFKxNxGgS6ww*#Bf*_Ns+@7>+>(!9
zC)PR`+_<iCUOO!<bv{N`<?5(ByZ{w!l&}B&WAz{Y`Oj17zaRV$X8P;kpSD4{DvQo>
zcpurUrq`p?II_3I%5h6mko);niA?<<4MBn|g~Eh_gglan>N7C~LIMM!Y$9wzQiuk|
z<%Ti@;p|r!utwDW7H8N0D}?4MIAnzI@cCWk_7oB1;9>0fE%W>_!|~y^_;kkpXr@@n
z$rh4{xMl)5X2^ZF`!ND=iIY1f6#{ZH`Dj_k5y#&6oiX7HN%T`=X+@hwLBo9vlSnp1
z@RP_`3X_xj0NS~>_zovX25@Z@VlySVKP4B^<%~v0vd?x^gP9T1JtCT1hx1sx(xKj=
z8j7qZ>?PnncO$PGMiZjRBg8nD89jmAw_|Dk2tnRd$}L$Z1Ttt|!Qhb4FNNNuK<ieo
zkmK9RPd|gm9t}KGEFfOPO&B5St71{51!_3wBE_PF1oZQGieu06DY4~`HAwRnVP&(B
zWCXD|%1sdtU~b0`g<3+{kL7FgpV)WSC4I69CVhRV!$Qnahvl=dZkk`1W)JRTlM|E}
z;j*h~0}7^i9v<Pnno`fQ1*+E%1#)I7HA9|4isPhi_ivQqL`&oAk6IH7&GAl6QoQr|
zQ=b%}*(7XU@m@jg72x=!cqS+~zN*m|7`Fu2<igR)y}=0GPZ{kP5h<4QYI~v6g=Ymj
z;;nv$s|(jPi7u1!Qsb+5SACCTJrc$`n6`RKL#v6N+Lj99R~C?oEe_Z1cYTy^W!7*L
zN<X2QB$#@anY>|zF??Qduxxi1-=}*bc_N_t^m+&p945pweW2<dp_^TKh+|RRo<v_@
zXZ|Rf(2M&UEVzTDPck%5^h(PSSWGK)jXq0ur!VXzyX^+n_}b+tD^dehT0gPM!V2#h
z@cW@a8e#`xN9Sr8TImhQjfV=3IYmBl+UAMov=CHA^wq5_L}zrb>Ulx9O!!JlPfCE&
zbXRqkB45erk=s+?F!$zsQ0&r?YE>qbXj#12-+A)bF{nM;_Rz!B1ay)14)VGN{x07*
zS}|`@v8_(m9k9X*K3QdKrV@0#!7$sf_imMYYs)a}><&+TpG)Jp<T}pN^b^iRI^)cF
z4z$D#x_RIB4Q-qM(t57XM4-0Mmv=<=V4WYTd(~(s_;;ip(QRGros^O<c@n~T%yr!2
zE%^4D)T?x>zH<m0`&o|aPl1lgPjafesBYhR)x1UShRd%6A5r>Bn&M#Myob$AVsea3
zuVzDM?2c5OTA$2rn^enW=a1^gWu#?Ce*2vMK6)vP^sM#N)q`=Ihm~!?ig8V17e03}
zfY<dG(G!p4IrwBsltEVOc;kUssvmDf+8U-aW?GeR#nl>Wt&dPOdJ>5V+)tQ1;nJu~
z9UfaC#gb<-Wp5E)2P5E-r<UiE=aO%9;8u1Lw+dLT*N;~+gH|t)>31T=&<Nq8(-r&U
z_m_m1;+JGk*jn_`8x?d)4jP<zia4ENoTL0B+lyKaFI8)`^)K?pg{+dH^T_qur<T^G
zciECGaEvO+swr#iUSBKBf@xv+T)s3$q6V@ps4bC;QiU!uk&-g`cQe^@>>1#y_BARK
zKQl5I@Dg~1CTzv=rzu@i>RybSc@#&rNrbXV2B;`=7bUkbI8lyEV@wgL4s69y>>SUi
z<r^=-f2~tpqBu3_F;7&cm5sxX3-<cmFf}l7k8_Cc43{dtyvW3!^qPTI-FMS~N)l-_
zQl!34OZB^3tZLg2e}Zn<vE`@tT@U!=^G)-)0h#h6-iZ=T`9RoN7QzC-0jbh0gTbn?
zdTwzQb7}T@BT}P#y}DUwHU74~V8tx_1bsnQ2!@4leCi?RYbd|k{pZ|(t{Cs5)N<Z3
z&peDnE_DNSlRC6x8+08%v}>li9jsor6Z^6o!i5;mvLosgk?F(xD)(c@%C{`<Qtw#)
zKwZ#t$%Ik48nLn<)o-ZNBM;57YeuD2@C;9nb{Xf}sdA?`V71k(36ZzoWORxuR2qw0
zX9S9$>%F7ynB9S}Uy16tAW52H*0LB5AWZvLdKK8wvN}K~?=4$YOQJKgH)%7Ds!dt+
z2LiE3k^?mpgxnDf`2>9H?Qos9?4MBDMo7^^k#vIZMvDrO?K6H(X)*dX)}ZIf1kR4-
z<YKyD;!uu?d*IL1;j5P7dAVou|EP1Cth8G2XJ$uodi|U@=~&13y+j?wRG$OxrwLu`
zJG5INGYy;()d|zZtbu=k0y3PUfFZKUv)CbM{^AwOf{|k$hvB_c7R;jd4KeQaL7q8#
z3bdEeWME@bnd@R|4hBv>)|34s_<H>f_A9W%mI8Xpa1d|)HXoTV11&zY>qKWx_s_S-
z*DHI5!69ce6VtrbDaCZEA$X7Vyk5TtPAw}LN9D{x$gi&I<`Unc`mCmuMH4Vh5_xEj
zaCOzv)c}jvwsQs!q$@=;)@uo+&;Q5^VHt77bIM8D{vCrKm$sOjH=s8)trDYw*QcBo
zdrIlT{p)!oEkc#uLWZsT>u?$y{5ca6K2`TuQBKs&9b-n$Ve8sqTwT?D%6nDXwAnAZ
zY5_+nKYasu0>>eThYAX^^gsC`UG;Mxr>dWPAqP>kdfXrn{+)dg$FZiNdKT`GaEb4_
zTX$7F-KJtxGBSc36Z_S^rp@Xhe#}DG9{xI@RTK%EKIPJ~r;U6v%!r);uH2s0q>-b{
zrhcl9+hx#k|E4%m&11Ki?N>M?#}eIj|C(p7Gk3@^NuV0Tc}6NBN8GY0k854FL37VC
ze?g0f4fA_Nu^`??{1o*OHuc1fC1kaI8fdv><E*mBqP6){mw31MF2Opi8JB!<>(XXD
zXCRjuo3>71aj@;h)Iw@Z>h?CDwL3&#A`f=I8c%E+8Pr%xu}QG3!VKeGK>}wa$=UC;
zv=j2LetK212Ag7pq;($pVrm(X!CSn_Tn*ASVfTYvAkdpm+J~RzOVTl?KfkdV5wdA>
zA@*Gq8*E(34TSx^(+rqrQ-`>A96MK;E|U}Qarp%I4gdM-cU-YpNP_8Wglp8XWMT=C
z0ODQC>RK6X1#!V<lG2S`Q4q$SF@se+IOlOWJYrB}3E^@vo38`W+m11RSE(i+D;&~!
z4AbmelWzeTYb?dQ&UXBftDFZRg*(W&2J+ycVWopmtP7IMQf`~6+I+{iuQHie8oq6`
zduBCe57#sUTr>kRCC+giGgvj{xISXPGX<(>#v$FFVJj0*NJ&V^28l7G+}zX*@QdLu
zsVyD~q4G1%;<Mw3e{fO%nrjJtU1t*<8rt8rU`uXgsy`awN+c{?4AXUoXdMqj;3DxB
zI~T$>zEQK2jNhhUWBrsKtp*G_Gx259QJHmyO~!gQQO1G0Y%GBN5b7{E;OVNR)34#k
zLzT>xMs;2vv35b9vQ(reCC#cYi5x+T$wtvB6^$YpZM!s;j2x~KM|C<b<kt~<6E%J`
zwNw68lJ7uKjNoJ{S?!>dd5?ib@Suvw&mg_UVTrtCP>Zk%tN0fS)#w0u_!Uh4M{4g4
zv?TKd`rt=arBdasL*bIGSgOIi2h6@?wpogy=cG{DZvocE4q6=yXSDbxd<wiZwMkNl
z4H?~P9lv&hc7j+vnK&^EaqXX}BBcbPg)IWV3gufhvuat2Xgy}^@a}a5X!s?R*9ecr
zqBYCZ$M{}F;T7_FmyhxdyXQIQ-NtGT^QkT~R3cc?$1`tO_CNCP*2~Tcs8oJg|M~tF
zVK#G`5U)UE#6AgrN;a~5wcNEnl)x%2CLv~Ss%-ij#OcSb^Q_g8QAqeH3Qj7O$&f_}
zmGElOnwguZH<LP@LGEN?wW=ZBf)ttM?6MZI71&R3|DQFI8R}XQhVa*ZqUe4qa!_Wu
zJsM3EOR9)#!_2%?(OiP|4{8P|hcw74efwlJy$3g9C@>t0vTo#9LOQE4Rpz(^v%yQv
zB$44YbKZJ9R|~;L%2RILIz0D5sY>{r>ct7Ob92lpN@?&RRf;tv?BuFW&1qDceryFk
zZ$SBei-C`KK8GIbfVB>PL#rRm9X_^q3<$JeOwQ}tXgA49C3(I$I8%(F&sTeJ=xmlZ
zc`stL$F?)HYa<LDa_@Qaj`d)}d?iXw&h8wI_BBQve|YEuJKb~n#^@pMCa;1a#X-eU
za$kKrC1&E=GGvuNr9Q%@M>eW>^qYfG3AfKYd1p#&LUhSwf>0v{H!KH}L{=3wutc=D
zguGE|nzsu(Sw%ED>);3<>aB3?3@Q>AwXCXd7<m^oUsxed75xNCla?V`Ac`joA?i(u
zl8D6(0ft;M<*0gxseemGP5TgIdvL4?rT%OQrM}(<XGh(tPhRq}diMzIY`4S5;1P^n
zE``<N;o*oqhADCG21KEhtWKZz*PUi#Yk?kqDvU<Yxr>rDa|Fi&1(-{Qem-Z6P9M07
zcj?*Vq1$eEESfqUtI#_vMQJvt-Ck{ThDL#_Lrw}RijQP>Uogqko6Rd>H#1=c@fq{{
z@1|1i#@4ftRvvF@Ppxk0O9l!*b4_!{Fm#OA3KOyU-c`a?dh5xIska<|UagA^6)CCF
zbBt)blp{O6FHuL5L!D~cid|_lO2vwnqR3AtLohH5O^m?`F>FJrH<hGhR8*<A6bOnv
zLlG6S5_hCxaiku|We+ud7^IC-*O`hkMA?Fi+Tqa@lr><Y!B%k>t~o!S?;Mg@=&-Wc
z?xJLgV)*<HiD-LK(3KF81zNtN%@~xgc7d%6u((OlJ`*N{N2DY3P^d<P9}Be3d^tGI
z9(IVFwJ&#mHWF_#;M{X=l@5{S7GzWsCx+Oa8*_R#%j4n*9xdlWPs&hkdp-2a`*~SB
zt(33n0$0$F2b>Q0Zw~__lq+YcnbxcG``aTE)1<w!j8zTIYJ7#o7^<2<*LPr1(2c~a
z+b-78JW+9jXhMt6M5)=W>%3K!^@?&5*Ir0gY(p3Vs?Q57C<IN%ebS|S$`NL2un)xb
zMJ*>&S8sFrhdnT79fhX5)9rJ!jXEjnsAd&K=DJK4vL=QpBz7{7i0i4*j}13lL@3uf
zqQxwPSGyAd9#s+DRMGgBxe~A9@*Nw3qEHxQ645C2!Gb78<V%*wK8zOr!%-7NUeGAR
z@xv3t{JT*1N$i?Gg}U`ADe+?`%2IM3v~Qr`;R~}Cj2%3^^ycPMsD|j15@qBeOAE=&
z8R(098P1#gNFtrkeVB*2@1LW!FQp?kAq;bx8F70``MOx@lLc9fOqWb4O6u7ruHP6l
z5b<8@e|ApgK8y6(vut5t(H>3h2|RnITgRsIMuU;ql(ac5s<7Co-8<rU4BQu=>$PvU
z_r!k1kE_8a(CM&vJ`=~^qRB=zk{^%?$`QFU$I)QA3)v9Fp}P;PXtYtugk1W%h_i%k
z%Pw9Wnjcyhk~Qho7;rY{JkWu9V?W3vcpmU#{zSye%EZgG<f{>R=O>ElCoX{FMW`9E
zw}iFUC^At6Se`7Lf|QrGhPsSi2D(<1+4v+vno|Fj#Q%q!{R5nnR6%Bo!^=zpWf29g
zbY8Rvm#U+OlrbskYR)I|rKVmbU)i|d_PMd*fz?$HEA2{8V~4H9l~WwNiziTU42%P0
zSlDO$J%$9nC|kibZp=ASRvGP^58X92m$wl0PV;e&#F@v!9xzfOS7TXU@~U4rt>IDo
zrZ#8jFd?y`eO(Jvjkqow)PDwqm|NHfr@B6pc&f~V?Dg<QDPr2PhH*reQ#JUB<Tv-J
zf17Vz?W4^Rn3FrzHV0xy89kJ6LDMYu;U5}e@_c)~pzF))lcGqr?%e0`61Pnq%~|8_
zC$5)^{N;F5C3$!ij>5n|Z)#<A_8Q4se@4Jb+3LmcnDO{p61rH=!GO>2i9he(T3vk7
z$-Tkf3ukToV?vtvrxb4jb!c7hR(+ioyk>h%k+XEVNp(IFR7qL#hW_AYFRvpag<7&@
zH9D&b3zcBZP#-G4UBb=`2-%pn;z=fO&+LXkdc8xa30gsyC1&99>I$EJ=f{oRuuZ{(
z+^b{o*3%*5-kT%BKz(#b3ya(P47G}8j{B_hZPrtK$<i#hQ}t5NC$#h**S@y{loKeN
zWM;R$=B*taI!*}eP-3A$b#UrfhgK3eCO=!ztp%TmCN*UwerW5{SD|r^<k>qkm;c7v
zigI8X&^TgFG`1P`l=0}UBio@mEk?B6>-rt>n{oK}XqixdZ8CweWpc(t?@#33#2}g3
zxU!_JSi`1QNM^gQ=ZB?9Wk^VeP{F|!H-tefD@P$=7c$gkq52MlX{yEDDEOHhQc@yI
zX(Fl+1Yj1eQ`!}d;5^eZarEe!`F={{KsP*iqSJi&pP8akbfeC&JPibGo_^dQOzmDc
zdOXEACQsoVx*fW=#Na1hD%j}@e|r|_BPky!OYd739^WMN7HCXBA>ysp(eghv{9*}0
zI1U)b85Wn!9dnywBmch0@Zf+Tn5pLaDUk^@NP5GolDp*NYif4Ac6|r2nDgnp8zx~>
zosH)@+oA7M8eHx2X!9)sVVR5uFL5Iy?2dC1O8D(r4_hk7UNOp-op~oACOACu24izb
zRBTDLm`gj=$xpp^$;KHbs+wp4i!}+!Bi#axCD<5tihfkI$}mvyre6^DLWm+s>h&o+
zsg;p!w-rMrCF#_^eyx+dZP;c%q`|2L18WuPZt@fs7WNYakv4+liO^xEpPQf>9En2x
z4NJTp`iY2Yb0!WKMR#*$Y3Iy05>e=gMwEuFU0!Jb7Mp1uZdXmMO~vEgymiK9Anb?A
zNQ#$p-|a@lW^KZ2Lgj3A)$+YjUN)-uy&L^on3v^S_Bg`iu=JE!2`W}$zeXPRaW6lL
zk)_qWBu*XN-m{P<U0_~E>A4oXzh{Yei5I%1SNBWGjoPW(wVu!n*k1e+b1g1W9V2H#
zD5VsWC>(R&JlPC|1eC!LDu&)^WA=*Q6GxemA*W|;O6ck^^D;M!z3FeO)b0n<KFeoR
z5kqxUJpWPZ*?4p(_fqWTiN}rkvd;VAM3+ZzbNz_hc^#MYwt1aKT`7&xI`DOAJ+D&_
z@8tH|&2lXqf|Zu|Oyq>^?+SjGnii!L+x+nw-3y#f1udWB9Y{)hO#NrYsRa`*5Iuq%
z&4TcW<Nd<mqlGl{ad?x-QTEgm>at*K)al$3+(Qk6^>CZ16jP9!Iql7Mx+KV^r0B`7
z>A2Nn5~{?k4(yP~tZAb`mL2Egy!CK6t{@lvUbzFX@Z-kmSkkadZu%oiZ_u|mmr&yb
z5J4o+uc4uOQ+h?jtHk(Adn&0)OPfz}U;@KNRkZJQlvE#9!Sa_q^^C&Yl9XurlgM5d
zrz=Fw<s96tM9Lh5cLIu@r_M)fl5(hX@&?<otqmB+d`@1NZk|!;SR928!X`X?&qF<l
z^XYn(k8bi3nk%G|&ouFyd5`Ymw3O&XE9}dOA7UmZH_?WA6lJK24=Zw_x_7$cgv<;|
zBw-XuXongmZldDiPz$Np`eOMQcKV9|Kc7wM2Q`t}Xpi3xJZhcuPwWHe4P5#w8mxam
z2`6x9g~~=;lJdY9@&@05c)&gr2K3!<P^jgvCX?s8SxJIfT&{54_I6(>o7DcYN=O~8
zc_!c2NUj%<Chy^X95)jr^InEE%h+1sXt0mY{Mm<;QB)nW;@}3`aDe%UCo7-bpVV)d
zL}T*VUi8XU6@@2#G~zV_tXf?%SY9rg`N=Op0_#!<wLsbUlUiTxLkNFC%$Vj&Xiyj)
z>gUrHKX$1}y{|)qKTA&wsmk5OrPr15&&{g~pSJBTiO(cIZ=`%-C(I`{5kBCfV#xcI
zo<mmX=SMBYOE92xVO}I~Z>?$QAeB`880spe30#;#y5M8@vZCD=$KBwEXU5D#W9TG<
zME2a9MQW50omWLQY$v)U9CVp=l=N1OKZA2Dm|vaIo%2)Odn)KQ&twbcHeg`MU#YTJ
zF6h4Vr~g20i7THjGq^xv>-kpCcyYbMWALrJ&kO^sPr*B@sKaG(IU2oe$y>+(GOh-4
z#t(+U&5_k?U!fc!@JoG%K|+ax(1H!YZfk=Lz%nDT=p<?PLP^h#lz6{9+ChuF)yS|T
zO1saKnzu6twn!>luQ)_46edYLdB_>KUoJNrSv&<qWQsFl_az*w_bp50J#Td>Mw}wk
zqoR|JgCatTaJlV_dfItZZ*jPP<8Pnfq;p=!3@@L%Plu`)&kMxP6(e-fpWPdC4|b&q
zCU5%o&_k6%arBAC%0>hiEDZ81(6TFr7_u)KLNog>G&S{5H89QL(9Hj++t!{Lj@vWu
z*Lgw@*}JE@<})DbN?6I#&e3KEQw1U8#bRGX!{H)oA+=PR8KZ2bx0IY&D)Lnr$W;!h
z5#!3a%84s#dceT}#j(t9gmgB9JQ2YWJv;^d8X|thlZaB^H-}=kQiqFj&q(S1Ny|dy
z{hMb~xWVLD5GB#HIz20HDl|!&|0~QiabD`O?=;FZL$&PlYCZ=7bi;~0OsJYRUi+o=
zYA{q_?NcPxxeEi&#O0h(dwkS5wtBK%2#m*$Z^pt1aYcxF<uE#(98E$933dK(kUW_Z
zCxN9OGOn=Tq=JGVdbxZY4R=b@57<y79uwH<>OCLR!n&l^1_>4(8`C|O#=*1a?Lniy
zxmxGJr5zzV%3i|Q*B*Sv?-08RzM08hqYcs;X<k-Cee-73O|mEjI@Q)~GY7R!zcHEJ
zyO8GIrVTD3!}WqiU+<QDzj`Wlhjy?GB=^PUj}oATa)9fWV%I$H3@N3nG8g8Qf$1Ax
zBnLc+O@5<E=XJX>rNKJX$(+C*m52eyS`aJ0`l?*{J69sBJ5Ge{NSZa+ODd7%99zFB
zO(b|2KIQur3}PmPdn2pFxyWO1r)ib|Bl0)k*dHUXVW3i7*U(jPPBNRfkWWZD)=Tmj
zIdmX%ph`bHW`Z3VuFj^xCs{Kh8dP)PDY|i@-=Z4A=ZJm*KeGKQ%S!Vh*7^Bj<#(=1
zanxb~mmDPq=|ap0e!AZG40|N>d>!ZZ#N=1|<sNc}0U{lUd+nf7)=yxI*RaepjK&S~
zO2hBQsZ(7ajS=f=^TlnWmZTkgQ~zcJ1RKPUN`#71iB?BKcLKLgU<H#S*v<%7$4Ka1
zG;=H*>X*;z5B^I#FZdG(c;{m+`7$oh>mr#mhP}v0E>uk7(?Wx&(8x&XSM~QFpegtC
z{q-1M;tyxWWuDk?YDHE>aS+ELLcsQrl<@PouAqK*(YI)5$wv~V=XrPD$B}zUUTR{a
z33|^Ky))~BA9?B?^f<0Tyh?v*y<+Oit>E6Utb3LEET_#Lq!;E^F1D!TDf+o$<ojY&
z7x;$znm}FVh)IOo`w!WhS6~yK2{|%|r8*e>lQ*|~u#L>nmL&550R(So!gtHTo5;@E
zPKRFzz>s__ghxwaHFdJ@=yeE)2qzG8c3z-I-vxicE+Gg#5@uIUU{$1Q3pCjjF+l0y
z4LqL__^QK{hOu4aT*!lOeTTJ%(6J!|HEH%NuuI=PCi}uMPglVLOzrrDoqf-6ZD*f;
zBzCT_Yyo@jYmU)^mgTvcy_U)upDUVqmWU8sZM*S=o~2E%J^$do^R+umWwk%Wx-8o2
z;vTI9UI%vKJ8jDWa0`Kx+{~PyeB>16E@ODiyHxH>>gV(Bhoz{1OUgj~o)y-m6}jZ3
zk;#qK1z(#DMm$5c+;X1y)2KcocZtE<sJI+l!;%)AcWtt}kQN<H(r&ZK4E@tLUOBFo
z{nw?NclbP)nNwDjO@<lamWa!hzInex$`Mdp;E)?reW)lC=UTYEuj-{1AR25rD4n={
z!oDg9XjG@lIU=zT_EN%6p8%^Fy3FUiB`zpv`aZU-qRPrWIxL9Qk+u200&m><Mw}Fg
zn;mG&>p)L@Z@<gaHfvf1QxV**I=ch%_|XIY2J?XU<jV97X&tA@3;h|?inXf0vht~#
z{?*eT|5F=DRwmyKYiXc&iu;j?{O~=x&3fP3Pp1&?GN`c3WpSJBrtlr-h;y$WS9}&6
zZyp9bZ{#Nz-YLdq$1;QngQ9rPusk(tHnZ~j;ob#p`R8o$2Ohg>w{1&eUZIEBuO`-s
zZ-o8ni}i&K&(>Ia@;}<*MuN{ne|RZ7P0I9StTGJecvVNrp*nxBORajVD6lBHuk_U0
zJ^td2cnp6f;w2ql?pS_BR4%&Svzz|rXo4HQ#jc<c#5iRz?dDzeOLZqwr9IzYio9D(
zkRS_kR0O78zyaT@L*jWbb6|Q#(vjeXUQI(XvRGDmbU!3gn0iKU*CCRPz*biXAsLeU
zg=n=htv6|zsXy_P*XIM2ed|g2tIOnoFJ;t5p1)u_-8SraVBN|vYRoa1ThtC1jk}I#
z*3jPoOZn!!kUzC?1)Xse_V9a&Uy?5%PpYEmnBGA)(-?NVVIOZ(I$D90f62Y^fqGrf
zKE9GH%g$BT!-aL5L@mV6hp0+Wg?xNCq;B`#$weJ?`m~M1@DiLmaXE14Zp~9Zx0LM?
zScQSx{R^*8y(0SuWTjHWu|T#J*Ad|w`_usByWhDI{wtv#LxFQmGOsy-i7SEMd!X}f
z<RoCZE-)*};zvrplFNbY-lpjVjD!8aAO>)B;L=w_3snJ=p`z`3UY!&{hFlEf=&=XQ
zFK^%L?}6fn<-bHRqrCNC)F}_=?_N<JtTLToF~4RE#9IwVMJnXK<SzImlmcc~9PZO6
zcn>Ry!@g*ocFa#M7~$?_-_SiEd6-d6$<u`rIEJ1v`iu>P52IpHia0jwa$%nnPH>9}
zze_%h;kioqgbj3ly=UXqj*;5}_SE?t`tAPhs@?f^`e3{HiK2h#7%Y?W+J)LbZ4F}T
zWrjmcQ+WA@*dgP~g|lYw+_4AYd<cG1lZUoOuPTtr_Z-@sKtYGk9YFBF2q4ej-*Zu?
ztc#wxCeXd<H=^D?ErW%;4E!+r?gM_+;@jv@adY;CfAZcjvh<NPNO(9vcATF@KF%iz
zIu6Gm@cM=i_euzQYoeQS+PFaGP&iNilU`&~ir_t!!xv}Tp^lltOi+He)t!Sw{{BwS
z@BJ@0t{pf|-$HKVd+zt&^L*a%^t~}a)u0|Zroe;(`F-VWrZUZ*51{9=GyVAHIbZBT
zFs?k4h(WIXZqSI^23`c!z`rHm%ZN86kszLPRd%3?x7D_iWI+HYT@CeQzo6{?$gn$s
zz=sb%R=-=ktZ*I=yi^9_QlZ?QOhg!u_^LX*8+C-V{{2OsGCh}uKZBXeRRex-ZU|W8
zd^3ta&lui~_NqVRN|>u<s6J&x#b*E4PrcvrpT|AM5L_kQfbR|<J@+nA*JGXaYWe1^
z$Lqe+aj7Nae<eBhbb9OfRF<yxBk_C3OJxHnpV=oJu(D5?XLJuZx(_9hTWPo0<wQr?
zf;ZC+B83H=@CFF{x1>|#geM@c*i}T<?3B*AncRpK;%m#D-dPHgSvYVV%<z}?0=E0;
zx$Ue10{c8rw)=&^-fx)+pa_I7+(2~Chi(%dpF4!z7#=J?Z-S<2LTi3^MFaBUyanG9
z20nQ%1P9FoJ=mveVk)%ndS|SPdM4TD4161(x=s^#(>dw@&C=X-$m!r4M|@|8`@PRF
zkzp3z`SOkomqs?06M(yM-8MXVdU9QBmIl=4`8LuCwLxQ&zXp{#Mfzg?P}9A?_m(T@
z-{B?k5c|7H2{rC{Y{h4{o#kFnkN|c67wEw_Z%bU}wP**(vjoR7waGLrVL#9bKAd<m
z$7JSq72oE9UWc!3b3#wk!LM$FSGE(K&8p_{8m}jptY;+oZe3HT6AR#F_k?gh5BX=k
z@b@LYtB&fz2zJI+2#`Y-xSQYOY*F2l4h(Pg5BY7+9c_u3W|3#@^6!P0o%{sfO(=IA
zl6Vgq_pLhW3JETxFZHe*e5`*Ju20gf^<J_(60c1&K=pcTmA%wDjh~PA8nuB<7_Gi)
z>Ziji?H!zh&3(;6;G4IbcW2pJGNc9_292}Mhh2!4(XY2VvnLMY`_hqoZo8)xXX_nv
zh2$gkau!;}<sR;HKCM=(bCK_Z*m3WGvqf&wL8)b(wU>C)T)1ZcuKf@gm3;85`MVEl
z7%TuN`ZLN!YDM$d?m5PTZbJ3-l|zN6$UD4~mkYn%g(qMLk00F-F2D8m7=)tKkspnm
zv-Li<;{C7Mz66@e?rq;ZhF8culsT0%55`0kMTSylO@>S%Q#gi7nPn*ROez@?84saQ
z=92jsL&Y)WIELf@9PeAd&+)F``mb-TkG1x8F8AK|-uE7!$6D^|n)w=K#cP>0kdI$q
z)h#?7S7|nUTr^L=cm;Y}DlOYL2me>6iv!BuOw=p#$U+}Npwr;s`bhMg9O<VPrsr*X
zvTdm~pav&poBP>VDP$4Xtfw^~M;wV;wcPUj)+Aioo`K%-55*gs<n>>BS2ZHe!C)Up
z9Y=ovl4f{5K`(2eJ;*cOOKOG7J6_uE2<FhCvWSI}8V$lzu*gRZpO&~Y9I{_~N7RDt
zf)jCvrF#_WEa}%Swv2j4R;&6yNgSNlH4LxJ*Av@7QhD5ouB*ITO|7!x(sJ|V&Or3-
zPSWc-w(qhut^r*2(ld4V&jdk2nohVf>G>;V?2PhuqkG_E*})ZD>($On>KF7L&Q=3$
z>gWc8%oI9jSm}MaCL=>tZA|Tzg5{{P!poN4$;;&GfGx9$sfkr74%)O4@#S;!?(u=0
z5(|8myb440n+5CXLy}ZqTht5A4Ti!2?d(U2trgACnxO;7g3_EgJ3mE+Ru`8HdIaDU
zzrzldZcM?7%d0XlSq@sJLKBtgq@X~?IPfXe$pa(jF8JqY-+0lLcxE!u>TN0eSm}$9
zNOlk?O7$*RCxMQqRDq=u3FyUW`XeiZeOQSt9ATRct%0TA4hlG%F#C-#k6a1$kZXD6
zNTnNnUhW>IKj8M0U{Be?=(;>#c8?HJW{y~Rq)UqikwwX^Uu2@wp9r;{tQ@2n6A2Gd
z9ok5E!gXW2(-mEc%5gk4;HAsQL|6(rJ@|s54qluqctLkZeoT6f4~y2=KDhA<v*q`=
zu<MHmRVR!V65W(eee{XiC7Y{WdI3**htp0f<l8A*=X@a0^`M3OxXy@rMEa)`4HGwR
z*SQ<(iH-bH?TT9Y^5Z9Sjv^)x6R#Y&+Gg1uwbF`yBORT#0o~^N0<`(^TC`YCG0^6=
zre7#Nz5j(X-82^Gb9h#0EQ)Dz_(dmdLSAtCW-7zZtOxB4Dpj3ps(n~G5xVy&49+@H
z2!E}9TP-ZZxbsQ*<%(u+zq{LxtbC3e<$QjA0;_r>6E%3-Awnirxf`)DJ~T<Vwz{dG
z$F_7>vs!O`b3Tkd)wxWI1ZJs|)>Z$o+-v<ok=Xw}l>uMPVT0M`#CA^If?uy3z&S~G
zJn|8WzBW~aa^#)8k-}9Jq<moF?wcz|CgO%ntlex3jVfxtGfXD_@*5ttn~g9ycUHg`
z^_jD2o588E+54b}Ws3BURN4zY-ZRZA%ZQ1c`w9Y?A=bsoA7z3o4yS$mG>Lybn_Ss>
z7<>L2>RwUziM8(rb)t0UXW)ZYt8;YC*(AE&A7v)hL0HQpYc*EA$C`?Qa1H4(iME+U
zYZFHwULxe86;?px3`dINn<01e_PjAFI7Sbi_cgjMJjGrK?R_`z)P$$P>A>>pv=RK+
zj2Rej=GnJ?yN%84=tejxNHai+ZdC9uh&R2BYhr0LG@m1;Q^qK)xk}+QzZC0M*htyC
zBi)+4+_ybMvmCO5obaqui!*wI$#I3F+TDS#t3CK!x7ogRWo$V~xQJ$`Xb|M&vtNa@
z98SB%PoOr3U0}qFdc=v0;k8#+Z_)T0J;7WX=5&8!9Ufv>=jkDc%^2BY+etmeW&S=r
zVrj<f9e!4g)^DP7Y5g_qv)lbe?1LVjyyTJ!m9sp9tS~cScGc~J0#1?AA#=AwCrOER
zQtq*vx3<_nsG+~p-h;p5_@Gov<3l?J?;~hjYu{$;x9*QDA-R_zV*0$XG5+vHMXPev
z^qIM^?eUJHtzTg^IO0c7SJUS7hO=9d?@#9MjB36d5cPhWobr`5o#Y_k<$;MBuOKOH
zBk^790^jgPsgwK|y|#1?4(6s372Im@rt8KJYSk*~U#fUsm1CF%%;$_9(CjU<uWyUK
z#;*BdrhV~%Ojs1W?@B-#aa2dor1zIahx~=yp}UZoteu6CR4)q-MV<^BEXHcM^^Sg{
zJf0}hVdulURfZApcX+yE5!3h3)6Jj39Pi@y0+a1Gl=@DSW-B$#P3=dRtKXw@n9o@7
z_7aQ-&$o4;OtHaJdX2Z56frQGYQW97QPaoahg_st)Em>uptpUJNQzh&z1TO0llf6)
z_*3{t6LHE6|25)^$f;_M%v5Guj!VO<EE}wHVxxBJ{Pi}{T;<j)Fz|b4qQ&}aFX8!m
zQxGoF!-=u;Y?+%umou8im7@hL#v49w2(}DVVH`w$-`1Pqyz`2LPQh5LI-^PX@3-Cj
zj4gX`RHTN+%Q|?$na6}}{6c0VbkjFvmLSb1ZdLV(W9dXYVq1_Fcj}cWEoKJMR-Yc>
znV>RRC8^Gc>WZW;>ow%4gIhIi<8ia8gVGz-c{;0@#XI%5?eVd?&y`cxk}|Q>!doGB
z%CkSlDos*i-r}3nRadG7Ns;qLjcbyoYu9#6#22m$`4%DXW)9J9t_Za&_0IHu;72^g
zGJeF#hJH4&t@)Y#(Z#|d|6aXRZ8qjzV0i++S984r7N3u0QgW^lZ|&Xb5?-eN{DgMA
z!Iq<NmV=*!AY3aV1Osmyda5HuuRJBjnI~WB@C_M#@_f5!iO6ymyv<-!mbA%wHHs;p
zbE{TjJ<fU}Rd8}xenF&;;g>kSD}T|j<S4(e^dh=#iC|B)q#L=ToC`KN8lkVyv<WA9
z`V*_`M5%BA1fBI1E?ul?<Bu_t7$IybN=&Pt+Z)>Pb}?mIOHFz`vn2!D$iMBg{%l91
zpLO-L56diDeFRhWNoNKrTE*~HoI#zy{VJn-XqSXb9-9RYDKDA_HUdOTX&uGPeR!r5
z^aEGfdQLC|1#mKWCHgHcd5wbfPgrgUIhtv!xdw5HMAkG03}F0u2`o51??6bS?i2ke
z{nK3x>qdS7@f#v<jBt%A`E_kxBvP~pi<Ok$meOk3xR&*s@7aMN#O)tf@bq+Pv4Tc^
zi3|mv`gMoYb-tjUH(kjvV*Q|EcAmdjb!+<vGYJ|Kl|FxSiSUS6-L!mor?%p@>WO!Q
zYE|_#J3_?kHEzeAm8I?+6@0I#_A_<D+~<95#k_yixf<1oH-{G8&fh6}zsls>ss+5W
zgyji%nsfSEYI#M!<!Z~ZCV4({zkrL)@Kp{EcATxcI~|AZeShcUBE2_J*!2KrMq7TO
z^XL>SanmG-aMg;gxFvdA@)=>=sWaWfZPnLiatA+Ss+_Kuiudl8uT5Uk!P}?s?8J8(
z`P5YdA6&N#wqDwRu!}Y4h-Wa7n_a_^NsqlQtJ2lTh<~Cs?~C!|tBMPEt<e5ZaufG~
zw8%9Oq1a8Aqt)PlT2_^1+jOCbgXEp`)@|Bz<=2RRr!|l7*TiA@c*3l_i=y<Xy2Nc8
zbk>l$qup2K`3nN#4#ypy-!`s(kluTbjpbn1+thKyL*aa}fVZifgvTqKdTT?HA_<4C
z!iNK0c$T%+=eaA?mbn+tsSTdRwjV^q4k7B;t&6U6xX@2n@&&Lxjtrn#PT$&&R+;Ry
z_w^(;5QK12bx7tRS>g{KLNt>gHtHQgg*3Wh6eqVWiD_Mwr&amJsyvCE;?4RbH_{Eo
z{^0Lm+%m_kv&!p-?|52-yFFQQD(kaMF}^p_U?$~Wjgbc}q_8&m7UnSZ$K89~K@Vvk
zcN0YQs_SCFqsN)MWc?rdC4F2nw3g%l5{j^zJW$(v&$6-8bL(eu`_8d<s7?9~SMUR;
z8&(cKN;qDP;faEq+bX1*=K5<w6T**;XVsQYtjKNc1pc~{VV2fiq<&J-<u5P7Id@Vs
z>cja31&%jMxOZ#H8Ioe#$~~WAV@P^E_jDzC==|k78Zbox!K(7#83u|cohF6v-P%$A
zNyJerE~zqlIqV=lU-h!3)oV2CqfJkFaN}4*DvcHYDFt2eRr;)lVp%Q6NIS%}EZ*AL
z)AByuVHT_Z`ybb_eBnE%<u)FK&gu4?IU+Z`jQa`a(ZNW?=j1KvXsb^PmvNnxsuMmb
zE*7gb+I^L!olq8}smVMjG}+<YJH*L1Y?(7N9E-i4UXz-40VCn;oK_!OQQ_6LOh2#M
zr02HDJm|1ylbp3YpSxuBkzRrYc`7?lG4Oo->wpLBj`<u^!qL-(%iq4SDB61o@!Wr+
z*&21tOT<@{%KfA!Ui8Cdk^G`?Zu(lEvgU*Dk}*auk}Xj|azeOER?Nj*D5_^LMqDz`
z1?OORO}j*E^0Zb`p~o$|=q=E31_`1+i_KP4_nVJ`CNEDR1Wn&<PTkcmT&^{uKQk4t
zWuPdQIe5p)RO?`<F=A$w>&Qz7W|of?SzAZleRvc~S<WLSk{`Wg9Gf<Nv-)WK3vN(I
z<nX%xP>S&wN7-dZ;>GB95lvJ4%Xg+Es%x0a<Y(hE&SvyZ&2b;yn6qQ9_$IG*S5n5}
zh?b#Lsm?TC8{_fVNm(^+(=MTJ&NgapnwL~GmCVW?9T|6(;R#5(Vdz#jQewQuG+ty|
zLbpOHv@O@1Q5DBYCCjknCS(}BRNmr8GeHF<G$D1(2a~YnFb$C?>&TGHKWD{*<BGU=
z%)f?*YKu>~qGPT`dq$*abZ79mTB@Z-i)ONPg_xK<T3f4K9trw!!a_Dl^t*9k=J8Bx
z;(YEQZyDFxW#Oj*iW-x*OwDLl3O-BPTo4gcdmqMWaxAWnI+Nj(3GL12)X*;hy6}^m
zXDlA2#LL9W;m-Y9W-9~u*FnZFW^Xc;ou@N^E)Pwi1{fMH6Hdh)C|Ek402+mwx?LC5
z|I~NzV1ngxxDtnt3dbFvDdO>x@-6h;>0{uypNC9oY@Rtks8SLCu#wLY4))bfi{U!V
zbmFN*rL$Yvh^f6+id<>x)79th(X3~EbQGHMO%(!A`9=KhST#$6VXe8stR;6(a*9Ws
zl(uMgsces`E!U~XWyU^f%k?go?Wb#_M`H({(XE;{<p-Ast}%}ErfikgUbJ_lR>O(f
zvPX;u$EP`a%m`55P2zlb9z+uZCg$4pr034aa9-SEgYm4Q3sMbE0(tL&<vJ^KH@fn3
zP6^Odeaw(Qv-vhuM^C5PPRv%vjSnAGG0@c7aWf)T6%ng?DgG8tdRu=`cS&aB`fE9n
z0#j47g0;okXHjRPbXJmMf5zmh^@zVrN<EpW>GQ-eG!B8}UDEDD;NAL%a^CcqL>0Eg
zersKFh*{}bc3m!SiG*oIX1A0y>)XdK1W*r1SZ`~;STxsQXC9>W3V74gb~Crdbnp>)
z>Gs(&I$XpNqY%6g=Mi7iYS*Z+3y<6dBN!w;moQyEaE#jNFg*@Qi>3Ex+_K2|#CV7b
zS)cSdI9o*M*Vr>&a>1yjjQUQmRcq@<U61}=ug@5%;PRQ7Tm)vb3*89{CRC8CY!;!5
zW6x-`;>iUM>Uq7sB)OoEJlZf$9l|Ii;^Ia3cU3>mN&ZBxyvJH-wM0<MbmXEwhA~p9
zfn2yuF|#wGgvML~8V~<nQL~4TKas2AphgyUIn>L4s<C1g_7_jn>8WOBsk9hT3iaKG
z$pv*JyNf#$xd_NsugW~Da(Uy(W%i(HvCHf%3BguqCUPP34<ewRE`RT^n&Tnrus}(w
z8AnEEMX#ZTp%Y$1_kE62p^A8gEL^-A#(Dm(=tGRjpU4#~D4SC#V$7DCT+nHWqXg)+
zvM&q+gINc7wO{0GR^7jtT=G?0=W<>~*qn|UZ+CSNDJ_X^TiB6vwW7?ZE4koImtc#e
z%y%w#m4Wt`0~P@NH7yrN;3>@~Y6La#2PkzclQ5MEm3u)~Y}UPG&16KPM^YNRK=Hh=
zl&qOxp<|DSeW(3*-9q(Pp<HHzXT{l|<L>$E7UB3JDu*NMCpa??7EsL}s_!^7k$>{&
zqK1&0Z+tWR^%9%c{T;_VY!1o2Il~J+eOZB#=j<%%#oE2M4+e4cp=NXH)`<)K+c#d;
z4#4Y2+t!F@^FFX`NOsXVP$$rwKB*E-n?vmplW>3eOB#1}o8L)==mRJ(E^aP$jTp|G
zddb{v<z+Q|+J{DUeHhl)5cxBKWr+MJ2Jb4gUsCPocOHfcgwTG&r<L;=ipld@(c3xc
zKW)qL^aFzq@>B(mx>%~~u5KItckN`7PkP*c9f_Ppg(vrxw68sqLF5gjF;6(@dM@=`
zv6W$~OnjLX8IZ?sRzONfX<s`mCfmNIR#TSPLu`UZxM~oL0t_qZg*To@T$KC7<)C^K
zJ4BM~k2+O+A&MYW$kGy6b_vnVbshI)1;p}XFj*(q%ljwCd4^xE8*zR*gW8+4&%$!&
z%bm+Ct+3+xU&5#0vjpvKjn{q!*%t>F=B`;@?R?$YiN2a{gKbjzqS9xP{9yIw=Jc9h
zO|ntr^W6FB`HRn7=rm*c9I!Hl7u`$V`Nxi2)2rZc{W-au8%XjAb6va5e4!5e%b^7+
zR~Y|e{a)6kL*uOwVPqlvJc13%21cKk&8y3kFpNX@IKV>^)jz4-e0>EfceC}}HyIML
zcx20YLep+SZ_=J+=aNSM(Iw|4)eWl`S8qN#aoAb3(%`ueGW?>?P*F~s9Xp;dnNoPn
z_LD@>ccJ$+G4V!d|EHcA)umr@qJAB!l&j5q-umTy_=tY6QBhe|eE0hIOL;3fLkDYO
z8e`5@6rQyee?Q@5YG|ll{`9_N`Qw&M&fueM9ZMH&e5>^^4kN*5M}NgnKCc~mY+plE
z%8>qI<m1dg^R}kyJj;_)A3qM}fOPGj55@V&*7zRNGyeY3{=(0PG7OIF>R{~|y5>)f
zEe&A}X$K~oL0Tl&6UEtP5NR1+ZtWBL9X#Ae+hoI^-17OVZ_zj9@(^ODfe(e?^Ykkq
zU3`lP@Jh3+xZZ~6-m;hG-5*BY2o3$|!QEOCcI1G6>a&&(jccRBy{CJ^kK8vu&2ril
zqG<kpL7pp~Q-&)(5VEkd2)*_+`OT_n@howfzhha!hIk;OquPG_Sh8m;EF{~mn<j01
zvF%lropHy6`}YHQnwfA2{)kOtb^&e$pr%f<A-E;LyH}=xe>YDfe3H4fFf(VokYaMF
z*TBHc+(*+?u6pqK2^Fmy%{8U=qnFOkp-XkVJ(!(e#8q5u8#=la_prRp#;vyKxf7(f
zIBERJrd=4f5S{QVoinfa4_zx1ZR4qOJX7kZ|4!t7|0NcWuU_gYjWwB6oo%x1veQ>C
z+bGE$XdTx~aO{qrx~J^$BId?v*L!Y!^cp%f7ji3H&gCM#hjZ*-9kuBE?AAG;MB*Gk
z98EWWfO*)-TdzlW48y0S6K6J#T`sl~*)bVQ(=wWC7cia^1~Dju6T6JeuK<61G3B(D
zp1D<exy|&K$MvdiW<)yjgSykV2XxA6s5^-{nuXmGOWE(X64rCJ(4AI{mIua!q({0^
z<RUwJ*pAEEZEZoYk`-Ngx6P)@&?;!r<7M1|@x3tBUm8<l#Rx~oj=`+=W$#noA7Lw~
zt`O_4yYHOaUTJzg37^LM7hTZGEini8unNK%x2unB-^MTwF9;Bnq^9na7hgF!YaWzp
z^I1X9NL3Ydn6&DxDfyHc^MjSff%Sk?Oyx-sQEur&Rh=&8FY%2Xs-el;@%<^J0MqEd
zB_sd;>sYF}+F3j7idddE`oBrb2LpN6<lNQ&l9vw$63PGM<s$)^LGm|bH~Sk9pWG$$
zB{T6t0Tx^!mmWyz-py?%r)MJpn&91({oPb_fTI`4`QDXQ1n6lIWUIdu;DO&Fc8M&>
z)Uo6wdmt-+SMP9F?vU*1w?`DfRZBMgZBFK{B{w1aCS!YZ!T+Ay?+o7mFeCieWbnNq
z|JO`#1dzuLWP&3A-Ao`s8}LF-LjRo!js%j}|08q=0S5J7gbsn|{j1R7-?_)T8O486
z!O1+h<heir`NuyXnf#RuLJ&xRV)zgIn-KyAh)@0jfAhk^kN}7CACw$iat~w*;XmMS
z{!uttYxEELdpARous`7Ly6v_nGxz>B-OWbd9qj*T4`liO?FtM-0ej@P?LVNB5{vxb
zOLW27=7t-KypG*<H(<k%r(ysQHt$xu^uh+@Z9@ikH9QT-u~&D#1IS9kSyWVhckAVP
z<0cD83`|zv{QU(HLjVNDaIu?WWQ?p*iGoAKc7H48w2S>?`49HD-7W@3?6U*I_P2#V
zq5JHhXw+T|3P(ZEu)P>C95@=j4?}?e1%vKyi$Lxh3mA#o-xdW%@AUyjA<+nmxj}$U
z3)wplFc=M(?QKiOP~iP`XvAI&1c3mWtDwDpApj2qgd#2ghJYgX+ChQnA;J4G%J@M6
zmJ7;xkTDd64<PoylqvcH)&sQP4g#eZGkM)8_X`<AQmhAn!6{+|0x%?$!Ur7C1BOwy
zMS!4?f5BiBYY7At5X+^Q2Lc2`QuqKAXHjs9_`v{?TS_|s1Nh1J^aloRH!$VChrv)l
zQ1{q@U;wi=<+{Ov7{DpwOvaFV_Yeq<1i>i#BV%xi*aH|6zOOA90jC%X5L1Boe((6m
zaRyPG4>Cp>XJEU4V0&W#jE{U8_VfqrdpH=i7X$17()WFBp(w;YzfcrvKL)Us@9_ab
zfDiyX%w7x)-25<#vkG9qowmmgV7>t;WBvt0?_H1Gd4Tthc^9L&Uv@EywIpLOiuE94
z0E5fku>jQmD2lxc*pU}$pB<Rutdi{jA?Lkzz@CIq#D#1JhwhCFfT2JXdz_3xVEg={
z0paJpJ^(x5n-W8VK>vb4_G6UK1wbnSi3Cyj0OkRRR`2xz0rUze_AdDhqA2bSKyLwx
zK<vFE03X03l_CZZC~(jzG2lj|xF^977;pwD?V!M00>#`QfRr@lUV}j45Q;qs^oKz1
z_W?#AC}RLa!YS7S0)v3Td(Q{?ISqnQ#tMc+QryL4I~a7I58x3+xrczG1-u3P&*wh5
zEdov%0|48%9>5a{wD;_j+XA=5zW$J~{eF=YclK^u)PBDxisup84tQz!j}LcOYdeP<
zt}NuYCPO=)8vq{>pr~!&?Cj1$eoqA6=g&IbbY}UZ4dCW(?drb!PDJhs4X|iQN}kr!
GWchzChcz4k

literal 0
HcmV?d00001

diff --git a/Templates/Diagram_It_Webinar_Series/IoT - Wearable Device.xml b/Templates/Diagram_It_Webinar_Series/IoT - Wearable Device.xml
new file mode 100644
index 0000000..78e0669
--- /dev/null
+++ b/Templates/Diagram_It_Webinar_Series/IoT - Wearable Device.xml	
@@ -0,0 +1,25945 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project ref="iot-wearable-device" name="IoT - Wearable Device" isSyncing="false" tags="" modelUpdated="2024-04-24 15:33:14" workflowState="" locked="false">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjg2MyIgZHk9IjExMjYiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIwIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNi40LjAiIGlySXJpdXNSaXNrVmVyc2lvbj0iNC4yNy4zIj48cm9vdD48bXhDZWxsIGlkPSIwIi8+PG14Q2VsbCBpZD0iMSIgc3R5bGU9IiIgcGFyZW50PSIwIi8+PG14Q2VsbCBpZD0iMyIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNDM1IiB5PSIyMjIiIHdpZHRoPSIxMjY3IiBoZWlnaHQ9IjQyMyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iaU9TIERldmljZSBDbGllbnQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzazt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0wO3JlY3Vyc2l2ZVJlc2l6ZT0xO2FsaWduPWNlbnRlcjthcmNTaXplPTkwO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFORFV6TkNBd0xqVXdOemMwTWtNd0xqWTFOREkxTmlBd0xqUTJNRFF4T0NBd0xqWTNOVFk1T0NBd0xqUXlORGMxTWlBd0xqY3hPRGs1TmlBd0xqTTVPRFExTTBNd0xqWTVORGM0SURBdU16WXpOelU1SURBdU5qVTRNVFF5SURBdU16UTBOamMzSURBdU5qQTVPRFEzSURBdU16UXdPVGs1UXpBdU5UWTBNVElnTUM0ek16Y3pPVEVnTUM0MU1UUXdPU0F3TGpNMk56WTBOU0F3TGpRNU5UYzNNU0F3TGpNMk56WTBOVU13TGpRM05qUXhNaUF3TGpNMk56WTBOU0F3TGpRek1qRTBNaUF3TGpNME1qSTBPQ0F3TGpNNU56TXdPQ0F3TGpNME1qSTBPRU13TGpNeU5UUXlNU0F3TGpNME16TTFPQ0F3TGpJME9UQXlNeUF3TGpNNU9UVTJOQ0F3TGpJME9UQXlNeUF3TGpVeE16a3hOME13TGpJME9UQXlNeUF3TGpVME56Y3hJREF1TWpVMU1UazVJREF1TlRneU5qRXpJREF1TWpZM05UVWdNQzQyTVRnMU5UZERNQzR5T0RRd05qVWdNQzQyTmpVNE9DQXdMak0wTXpZd01TQXdMamM0TVRneklEQXVOREExTnpBMElEQXVOemM1T1RVMlF6QXVORE00TVRjNElEQXVOemM1TVRreklEQXVORFl4TVRRMklEQXVOelUyT1RFNUlEQXVOVEF6TkRBMElEQXVOelUyT1RFNVF6QXVOVFEwTkRFeklEQXVOelUyT1RFNUlEQXVOVFkxTmpRMklEQXVOemM1T1RVMklEQXVOakF4T0RZM0lEQXVOemM1T1RVMlF6QXVOalkwTlRJMklEQXVOemM1TURVMElEQXVOekU0TXpjeUlEQXVOamN6TmpVeUlEQXVOek0wTURVMElEQXVOakkyTVRnNVF6QXVOalV3TURJMElEQXVOVGcyTlRZNElEQXVOalUwTlRNMElEQXVOVEV3TVRjZ01DNDJOVFExTXpRZ01DNDFNRGMzTkRKV01DNDFNRGMzTkRKYVRUQXVOVGd4TmpBMklEQXVNamsyTVRBMFF6QXVOakUyTnpnMklEQXVNalUwTXpNeUlEQXVOakV6TlRrMElEQXVNakUyTXpBMklEQXVOakV5TlRVeklEQXVNakF5TmpNM1F6QXVOVGd4TkRZM0lEQXVNakEwTkRReElEQXVOVFExTlRJeklEQXVNakl6T0NBd0xqVXlOVEExTkNBd0xqSTBOell3TVVNd0xqVXdNalV3TWlBd0xqSTNNekV6TmlBd0xqUTRPVEkwT1NBd0xqTXdORGN3T0NBd0xqUTVNakE1TkNBd0xqTTBNRE13TlVNd0xqVXlOVFkzT0NBd0xqTTBNamczTXlBd0xqVTFOak0wT0NBd0xqTXlOVFU1TlNBd0xqVTRNVFl3TmlBd0xqSTVOakV3TkZZd0xqSTVOakV3TkZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQzTVRBMU5EY2lJR2hsYVdkb2REMGlNQzQzTVRBMU5EY2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakV6TlRrNE5pQXdMakV6TmpFd09Da2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tOyIgaWQ9IjYiPjxteENlbGwgc3R5bGU9ImlyLnJlZj02NTQzZDYxNS0yYjNlLTQzMmItYTcyZC03ZTNiNzY5NDE1NDc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9aW9zLWRldmljZS1jbGllbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtyZWN1cnNpdmVSZXNpemU9MDthbGlnbj1sZWZ0O2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0OCIgeT0iNjEiIHdpZHRoPSI0MjAiIGhlaWdodD0iMzE5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI1NiIgdmFsdWU9IklvVCBPcGVyYXRpbmcgU3lzdGVtIC0+IFdpLUZpIHBvcnQiIHN0eWxlPSJpci5yZWY9YzM3NmI0YzktNzAyMy00N2U0LTk2NGUtZmNjZTQ4MTQ4ZjViO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI2IiBzb3VyY2U9IjUiIHRhcmdldD0iMTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJJb1QgT3BlcmF0aW5nIFN5c3RlbSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO3ZlcnRpY2FsQWxpZ249dG9wO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTA7cmVjdXJzaXZlUmVzaXplPTE7YWxpZ249Y2VudGVyO2FyY1NpemU9OTA7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNNE1EUTNOaUF3TGpjeE5qWTNPRU13TGpNMU56ZzNNU0F3TGpjeU5UVTNNeUF3TGpNek1qY3dPQ0F3TGpjek1EQXlNU0F3TGpNd05EazROaUF3TGpjek1EQXlNVU13TGpJM056STJNeUF3TGpjek1EQXlNU0F3TGpJMU1qRWdNQzQzTWpVMU56TWdNQzR5TWprME9UWWdNQzQzTVRZMk56aERNQzR5TURZNE9URWdNQzQzTURjM09ETWdNQzR4T0Rnek16a2dNQzQyT1RVNU1qTWdNQzR4TnpNNE16Z2dNQzQyT0RFd09UaERNQzR4TlRrek16Y2dNQzQyTmpZeU56TWdNQzR4TkRjeE9ESWdNQzQyTkRnMk9UUWdNQzR4TXpjek56SWdNQzQyTWpnek5qTkRNQzR4TWpjMU5qTWdNQzQyTURnd016RWdNQzR4TWpBMU1qWWdNQzQxT0RjeU56WWdNQzR4TVRZeU5qRWdNQzQxTmpZd09UaERNQzR4TVRFNU9UWWdNQzQxTkRRNU1Ua2dNQzR4TURrNE5qTWdNQzQxTWpJNE9UTWdNQzR4TURrNE5qTWdNQzQxTURBd01rTXdMakV3T1RnMk15QXdMalEzTnpFME55QXdMakV4TVRrNU5pQXdMalExTlRFeU1TQXdMakV4TmpJMk1TQXdMalF6TXprME0wTXdMakV5TURVeU5pQXdMalF4TWpjMk5DQXdMakV5TnpVMk15QXdMak01TWpBd09TQXdMakV6TnpNM01pQXdMak0zTVRZM04wTXdMakUwTnpFNE1pQXdMak0xTVRNME5pQXdMakUxT1RNek55QXdMak16TXpjMk55QXdMakUzTXpnek9DQXdMak14T0RrME1rTXdMakU0T0RNek9TQXdMak13TkRFeE55QXdMakl3TmpnNU1TQXdMakk1TWpJMU55QXdMakl5T1RRNU5pQXdMakk0TXpNMk1rTXdMakkxTWpFZ01DNHlOelEwTmpjZ01DNHlOemN5TmpNZ01DNHlOekF3TWlBd0xqTXdORGs0TmlBd0xqSTNNREF5UXpBdU16TXlOekE0SURBdU1qY3dNRElnTUM0ek5UYzROekVnTUM0eU56UTBOamNnTUM0ek9EQTBOellnTUM0eU9ETXpOakpETUM0ME1ETXdPQ0F3TGpJNU1qSTFOeUF3TGpReU1UWXpNeUF3TGpNd05ERXhOeUF3TGpRek5qRXpOQ0F3TGpNeE9EazBNa013TGpRMU1EWXpOU0F3TGpNek16YzJOeUF3TGpRMk1qYzVJREF1TXpVeE16UTJJREF1TkRjeU5UazVJREF1TXpjeE5qYzNRekF1TkRneU5EQTVJREF1TXpreU1EQTVJREF1TkRnNU5EUTJJREF1TkRFeU56WTBJREF1TkRrek56RXhJREF1TkRNek9UUXpRekF1TkRrM09UYzJJREF1TkRVMU1USXhJREF1TlRBd01UQTRJREF1TkRjM01UUTNJREF1TlRBd01UQTRJREF1TlRBd01ESkRNQzQxTURBeE1EZ2dNQzQxTWpJNE9UTWdNQzQwT1RjNU56WWdNQzQxTkRRNU1Ua2dNQzQwT1RNM01URWdNQzQxTmpZd09UaERNQzQwT0RrME5EWWdNQzQxT0RjeU56WWdNQzQwT0RJME1Ea2dNQzQyTURnd016RWdNQzQwTnpJMU9Ua2dNQzQyTWpnek5qTkRNQzQwTmpJM09TQXdMalkwT0RZNU5DQXdMalExTURZek5TQXdMalkyTmpJM015QXdMalF6TmpFek5DQXdMalk0TVRBNU9FTXdMalF5TVRZek15QXdMalk1TlRreU15QXdMalF3TXpBNElEQXVOekEzTnpneklEQXVNemd3TkRjMklEQXVOekUyTmpjNFdrMHdMakkwTmpFeU9TQXdMalkxTVRnM01VTXdMakkyTXpFNE9TQXdMalkyTVRZeE15QXdMakk0TWpnd09DQXdMalkyTmpRNE5TQXdMak13TkRrNE5pQXdMalkyTmpRNE5VTXdMak15TnpFMk5DQXdMalkyTmpRNE5TQXdMak0wTmpjNE1pQXdMalkyTVRRd01pQXdMak0yTXpnME1pQXdMalkxTVRJek5rTXdMak00TURrd01pQXdMalkwTURZME55QXdMak01TkRFeU5DQXdMall5TmpnNElEQXVOREF6TlRBM0lEQXVOakE1T1RNM1F6QXVOREV5T0RrZ01DNDFPVEk1T1RVZ01DNDBNVGszTVRNZ01DNDFOelUwTVRZZ01DNDBNak01TnpnZ01DNDFOVGN5TURORE1DNDBNamcyTnlBd0xqVXpPRFUyTlNBd0xqUXpNVEF4TmlBd0xqVXhPVFV3TkNBd0xqUXpNVEF4TmlBd0xqVXdNREF5UXpBdU5ETXhNREUySURBdU5EYzVOamc1SURBdU5ESTROamNnTUM0ME5qQXlNRFFnTUM0ME1qTTVOemdnTUM0ME5ERTFOamRETUM0ME1UazNNVE1nTUM0ME1qSTFNRFlnTUM0ME1USTRPU0F3TGpRd05EY3hOaUF3TGpRd016VXdOeUF3TGpNNE9ERTVOME13TGpNNU5ERXlOQ0F3TGpNM01UWTNOeUF3TGpNNE1Ea3dNaUF3TGpNMU9EVTBOaUF3TGpNMk16ZzBNaUF3TGpNME9EZ3dORU13TGpNME5qYzRNaUF3TGpNek9EWXpPQ0F3TGpNeU56RTJOQ0F3TGpNek16VTFOaUF3TGpNd05EazROaUF3TGpNek16VTFOa013TGpJNE1qZ3dPQ0F3TGpNek16VTFOaUF3TGpJMk16RTRPU0F3TGpNek9EZzFJREF1TWpRMk1USTVJREF1TXpRNU5EUkRNQzR5TWprd05qa2dNQzR6TlRrMk1EVWdNQzR5TVRVNE5EZ2dNQzR6TnpNeE5pQXdMakl3TmpRMk5TQXdMak01TURFd00wTXdMakU1TnpBNE1pQXdMalF3TnpBME5pQXdMakU1TURBME5TQXdMalF5TkRnek5pQXdMakU0TlRNMU15QXdMalEwTXpRM00wTXdMakU0TVRBNE9DQXdMalEyTVRZNE55QXdMakUzT0RrMU5pQXdMalE0TURVek5pQXdMakUzT0RrMU5pQXdMalV3TURBeVF6QXVNVGM0T1RVMklEQXVOVEl3TXpVeUlEQXVNVGd4TURnNElEQXVOVFF3TURRNElEQXVNVGcxTXpVeklEQXVOVFU1TVRBNVF6QXVNVGt3TURRMUlEQXVOVGMzTnpRMklEQXVNVGszTURneUlEQXVOVGsxTXpJMElEQXVNakEyTkRZMUlEQXVOakV4T0RRMFF6QXVNakUxT0RRNElEQXVOakk0TXpZeklEQXVNakk1TURZNUlEQXVOalF4TnpBMUlEQXVNalEyTVRJNUlEQXVOalV4T0RjeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOek0yT1RZMElEQXVOek13TURJeFF6QXVOamszTXlBd0xqY3pNREF5TVNBd0xqWTJNamsyTnlBd0xqY3lNRFE1SURBdU5qTXpPVFkxSURBdU56QXhOREk1UXpBdU5qQTBPVFl6SURBdU5qZ3hPVFExSURBdU5UZzBPVEU0SURBdU5qVTFORGN5SURBdU5UY3pPREk1SURBdU5qSXlNREE1VERBdU5qTTJOVEkwSURBdU5UazVNVE0yUXpBdU5qUTFPVEEzSURBdU5qRTVPRGt4SURBdU5qVTVOVFUxSURBdU5qTTJOREV4SURBdU5qYzNORFk0SURBdU5qUTROamswUXpBdU5qazFNemd4SURBdU5qWXdOVFUxSURBdU56RTJNRFkySURBdU5qWTJORGcxSURBdU56TTVOVEl6SURBdU5qWTJORGcxUXpBdU56WTBNallnTUM0Mk5qWTBPRFVnTUM0M09ETTROemtnTUM0Mk5qQTFOVFVnTUM0M09UZ3pPQ0F3TGpZME9EWTVORU13TGpneE16TXdOeUF3TGpZek5qZ3pOQ0F3TGpneU1EYzNNU0F3TGpZeE9UZzVNU0F3TGpneU1EYzNNU0F3TGpVNU56ZzJOa013TGpneU1EYzNNU0F3TGpVNE9EVTBOeUF3TGpneE9EWXpPQ0F3TGpVNE1EQTNOaUF3TGpneE5ETTNNeUF3TGpVM01qUTFNVU13TGpneE1EVXpOU0F3TGpVMk5EUXdNeUF3TGpnd05qQTFOaUF3TGpVMU56Z3pPQ0F3TGpnd01Ea3pPU0F3TGpVMU1qYzFOVU13TGpjNU5UZ3lNU0F3TGpVME56WTNNaUF3TGpjNE56a3pJREF1TlRReU5UZzVJREF1TnpjM01qWTRJREF1TlRNM05UQTJRekF1TnpZMk5qQTJJREF1TlRNeUlEQXVOelUzTmpRNUlEQXVOVEkzT1RjMklEQXVOelV3TXprNUlEQXVOVEkxTkRNMFF6QXVOelF6TlRjMUlEQXVOVEl5TkRZNUlEQXVOek16TXpNNUlEQXVOVEU0TmpVM0lEQXVOekU1TmpreElEQXVOVEV6T1RrNFF6QXVOekF5TmpNeElEQXVOVEE0TURZNElEQXVOamc1T0RNMklEQXVOVEF6TkRBNUlEQXVOamd4TXpBMklEQXVOVEF3TURKRE1DNDJOekkzTnpZZ01DNDBPVFkyTXpFZ01DNDJOakUwTnpRZ01DNDBPVEV4TWpVZ01DNDJORGMwSURBdU5EZ3pOVEF4UXpBdU5qTXpOelV5SURBdU5EYzFORFV6SURBdU5qSXpNekF6SURBdU5EWTNOakUzSURBdU5qRTJNRFV5SURBdU5EVTVPVGt5UXpBdU5qQTVNakk0SURBdU5EVXhPVFEwSURBdU5qQXpNRFEwSURBdU5EUXhOVFkzSURBdU5UazNORGs1SURBdU5ESTRPRFpETUM0MU9URTVOVFVnTUM0ME1UWXhOVElnTUM0MU9Ea3hPRE1nTUM0ME1ERTVOak1nTUM0MU9Ea3hPRE1nTUM0ek9EWXlPVEZETUM0MU9Ea3hPRE1nTUM0ek5UTTJOelVnTUM0Mk1ERTVOemdnTUM0ek1qWXhORE1nTUM0Mk1qYzFOamdnTUM0ek1ETTJPVFJETUM0Mk5UTXhOVGNnTUM0eU9ERXlORFFnTUM0Mk9EYzVNVGNnTUM0eU56QXdNaUF3TGpjek1UZzBOaUF3TGpJM01EQXlRekF1TnpZNE5USTFJREF1TWpjd01ESWdNQzQzT1RnMU9UTWdNQzR5Tnpnd05qY2dNQzQ0TWpJd05TQXdMakk1TkRFMk0wTXdMamcwTlRrek5DQXdMak14TURJMU9TQXdMamcyTVRreU9DQXdMak16TVRZME9TQXdMamczTURBek1TQXdMak0xT0RNek5Vd3dMamd3T0RZeE5pQXdMak0zT0RZMk5rTXdMamd3TWpZME5TQXdMak0yTlRFeE1pQXdMamM1TWpZeU1pQXdMak0xTkRNeE1TQXdMamMzT0RVME55QXdMak0wTmpJMk0wTXdMamMyTkRrZ01DNHpNemMzT1RFZ01DNDNORGMyTWpZZ01DNHpNek0xTlRZZ01DNDNNalkzTWpnZ01DNHpNek0xTlRaRE1DNDNNRFUwTURNZ01DNHpNek0xTlRZZ01DNDJPRGcxTlRjZ01DNHpNemd5TVRVZ01DNDJOell4T0RnZ01DNHpORGMxTXpSRE1DNDJOalF5TkRZZ01DNHpOVFk0TlRJZ01DNDJOVGd5TnpVZ01DNHpOams1T0RNZ01DNDJOVGd5TnpVZ01DNHpPRFk1TWpaRE1DNDJOVGd5TnpVZ01DNHpPVGd6TmpJZ01DNDJOakk1TmpjZ01DNDBNRGcxTWpnZ01DNDJOekl6TlNBd0xqUXhOelF5TTBNd0xqWTRNVGN6TXlBd0xqUXlOak14T0NBd0xqWTVNVFUwTWlBd0xqUXpNamc0TkNBd0xqY3dNVGMzT0NBd0xqUXpOekV4T1VNd0xqY3hNakF4TkNBd0xqUTBNVE0xTlNBd0xqY3lOelU0TVNBd0xqUTBOekEzTXlBd0xqYzBPRFEzT1NBd0xqUTFOREkzTkVNd0xqYzJNVEkzTkNBd0xqUTFPRGt6TXlBd0xqYzNNRFkxTnlBd0xqUTJNalV6TkNBd0xqYzNOall5T0NBd0xqUTJOVEEzTlVNd0xqYzRNekF5TmlBd0xqUTJOekU1TXlBd0xqYzVNakU1TlNBd0xqUTNNVEF3TlNBd0xqZ3dOREV6TnlBd0xqUTNOalV4TWtNd0xqZ3hOakEzT1NBd0xqUTRNakF4T0NBd0xqZ3lOVEkwT1NBd0xqUTROekV3TVNBd0xqZ3pNVFkwTmlBd0xqUTVNVGMyUXpBdU9ETTRNRFEwSURBdU5EazFPVGsySURBdU9EUTFOVEE0SURBdU5UQXhPVEkySURBdU9EVTBNRE0zSURBdU5UQTVOVFZETUM0NE5qSTFOamNnTUM0MU1UY3hOelVnTUM0NE5qZzVOalVnTUM0MU1qVXdNVEVnTUM0NE56TXlNeUF3TGpVek16QTFPVU13TGpnM056a3lNU0F3TGpVME1EWTRNeUF3TGpnNE1UYzJJREF1TlRVd01qRTBJREF1T0RnME56UTFJREF1TlRZeE5qVkRNQzQ0T0RneE5UY2dNQzQxTnpJMk5qTWdNQzQ0T0RrNE5qTWdNQzQxT0RRMU1qTWdNQzQ0T0RrNE5qTWdNQzQxT1RjeU0wTXdMamc0T1RnMk15QXdMall6T0RjMElEQXVPRGMxTlRjMklEQXVOamN4TXpVMklEQXVPRFEzSURBdU5qazFNRGMyUXpBdU9ERTROREkxSURBdU56RTRNemN5SURBdU56Z3hOelEySURBdU56TXdNREl4SURBdU56TTJPVFkwSURBdU56TXdNREl4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16WTNOVEV6SURBdU5EZzJOREUxUXpBdU16YzBNakl5SURBdU5Ea3pNVEkwSURBdU16Z3dNREUxSURBdU5UQXhNalFnTUM0ek9EUTBNamtnTUM0MU1EazROamxETUM0ek9EY3lOVGdnTUM0MU1UVTBNREVnTUM0ek9EVXdOamdnTUM0MU1qSXhOemtnTUM0ek56azFNellnTUM0MU1qVXdNRGhETUM0ek56UXdNRFFnTUM0MU1qYzRNemNnTUM0ek5qY3lNallnTUM0MU1qVTJORGNnTUM0ek5qUXpPVGNnTUM0MU1qQXhNVFZETUM0ek5qRXdNalFnTUM0MU1UTTFNVGtnTUM0ek5UWTFPVGtnTUM0MU1EY3pNaUF3TGpNMU1UWXdNeUF3TGpVd01qTXlORU13TGpNeU5EWTRNU0F3TGpRM05UUXdNaUF3TGpJNE1UQXpJREF1TkRjMU5EQXlJREF1TWpVME1UQTRJREF1TlRBeU16STBRekF1TWpRNE9EYzJJREF1TlRBM05UVTJJREF1TWpRME5qTWdNQzQxTVRNME16UWdNQzR5TkRFek5Ua2dNQzQxTVRrNE9UbERNQzR5TXpnMU5UVWdNQzQxTWpVME5EUWdNQzR5TXpFM09EY2dNQzQxTWpjMk5qVWdNQzR5TWpZeU5ESWdNQzQxTWpRNE5rTXdMakl5TURZNU9DQXdMalV5TWpBMU5pQXdMakl4T0RRM055QXdMalV4TlRJNE9DQXdMakl5TVRJNE1TQXdMalV3T1RjME5FTXdMakl5TlRZeU5DQXdMalV3TVRFMU9TQXdMakl6TVRJM05DQXdMalE1TXpNek9DQXdMakl6T0RFNU9DQXdMalE0TmpReE5VTXdMakkzTXprd055QXdMalExTURjd05TQXdMak16TVRnd05DQXdMalExTURjd05TQXdMak0yTnpVeE15QXdMalE0TmpReE5WcE5NQzR6TkRRME5qSWdNQzQxTWpBd05qbERNQzR6TkRrMk5EUWdNQzQxTWpVeU5URWdNQzR6TlRNNE9UTWdNQzQxTXpFMU9UUWdNQzR6TlRZNE5USWdNQzQxTXpnek5EVkRNQzR6TlRrek5EVWdNQzQxTkRRd016WWdNQzR6TlRZM05UUWdNQzQxTlRBMk56RWdNQzR6TlRFd05qTWdNQzQxTlRNeE5qUkRNQzR6TkRVek56SWdNQzQxTlRVMk5UZ2dNQzR6TXpnM016Y2dNQzQxTlRNd05qWWdNQzR6TXpZeU5ETWdNQzQxTkRjek56WkRNQzR6TXpRek9ETWdNQzQxTkRNeE16RWdNQzR6TXpFM01ETWdNQzQxTXpreE15QXdMak15T0RVMU15QXdMalV6TlRrM09VTXdMak14TkRNMUlEQXVOVEl4TnpjM0lEQXVNamt4TXpJMElEQXVOVEl4TnpjM0lEQXVNamMzTVRJeUlEQXVOVE0xT1RjNVF6QXVNamN6T1RreUlEQXVOVE01TVRBNUlEQXVNamN4TkRNM0lEQXVOVFF5T1RReElEQXVNalk1TlRZZ01DNDFORGN5TXpKRE1DNHlOamN3TmprZ01DNDFOVEk1TWpRZ01DNHlOakEwTXpZZ01DNDFOVFUxTVRrZ01DNHlOVFEzTkRRZ01DNDFOVE13TWpoRE1DNHlORGt3TlRJZ01DNDFOVEExTXpnZ01DNHlORFkwTlRZZ01DNDFORE01TURRZ01DNHlORGc1TkRjZ01DNDFNemd5TVRKRE1DNHlOVEU1TVRjZ01DNDFNekUwTWpRZ01DNHlOVFl3TXpZZ01DNDFNalV5TkRZZ01DNHlOakV5TVRJZ01DNDFNakF3TmpsRE1DNHlPRFF5TURFZ01DNDBPVGN3T0RFZ01DNHpNakUwTnpRZ01DNDBPVGN3T0RFZ01DNHpORFEwTmpJZ01DNDFNakF3TmpsYVRUQXVNemszTVRVNElEQXVORFU1TXpBMlF6QXVOREF5T0RjeklEQXVORFkxTURJeElEQXVOREE0TWpZeElEQXVORGN4TlRRZ01DNDBNVEk1TlRFZ01DNDBOemd6TXpaRE1DNDBNVFkwT0RFZ01DNDBPRE0wTlNBd0xqUXhOVEU1TmlBd0xqUTVNRFExTmlBd0xqUXhNREE0TXlBd0xqUTVNems0TlVNd0xqUXdORGsyT1NBd0xqUTVOelV4TkNBd0xqTTVOemsyTXlBd0xqUTVOakl6SURBdU16azBORE0wSURBdU5Ea3hNVEUzUXpBdU16a3dORGs1SURBdU5EZzFOREUySURBdU16ZzFPVGM1SURBdU5EYzVPVFEySURBdU16Z3hNalE0SURBdU5EYzFNakUyUXpBdU16TTNOamcxSURBdU5ETXhOalV6SURBdU1qWTNNRFUxSURBdU5ETXhOalV6SURBdU1qSXpORGt4SURBdU5EYzFNakUyUXpBdU1qRTVJREF1TkRjNU56QTNJREF1TWpFME5USTFJREF1TkRnMU1UZ2dNQzR5TVRBME16WWdNQzQwT1RFd056TkRNQzR5TURZNE9UUWdNQzQwT1RZeE56Z2dNQzR4T1RrNE9EVWdNQzQwT1RjME5EWWdNQzR4T1RRM09DQXdMalE1TXprd05FTXdMakU0T1RZM05TQXdMalE1TURNMk15QXdMakU0T0RRd055QXdMalE0TXpNMU15QXdMakU1TVRrME9TQXdMalEzT0RJME9FTXdMakU1TmpjMk5DQXdMalEzTVRNd09DQXdMakl3TWpBNElEQXVORFkwT0RBNElEQXVNakEzTlRneElEQXVORFU1TXpBMlF6QXVNalU1T1RNeElEQXVOREEyT1RVMklEQXVNelEwT0RBNElEQXVOREEyT1RVMklEQXVNemszTVRVNElEQXVORFU1TXpBMldrMHdMak14TkRNNE5DQXdMalUxTURreFF6QXVNekl3T1RjNElEQXVOVFUzTlRBMElEQXVNekl3T1RjNElEQXVOVFk0TVRrMklEQXVNekUwTXpnMElEQXVOVGMwTnpreFF6QXVNekEzTnpnNUlEQXVOVGd4TXpnMklEQXVNamszTURrM0lEQXVOVGd4TXpnMklEQXVNamt3TlRBeUlEQXVOVGMwTnpreFF6QXVNamd6T1RBM0lEQXVOVFk0TVRrMklEQXVNamd6T1RBM0lEQXVOVFUzTlRBMElEQXVNamt3TlRBeUlEQXVOVFV3T1RGRE1DNHlPVGN3T1RjZ01DNDFORFF6TVRVZ01DNHpNRGMzT0RrZ01DNDFORFF6TVRVZ01DNHpNVFF6T0RRZ01DNDFOVEE1TVZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tOyIgaWQ9IjUiPjxteENlbGwgc3R5bGU9ImlyLnJlZj04ZWZmOGNhNi1lZmE0LTQ0MjAtOTY5Ni03MGYwNDExZGY3YTk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9aW90LW9wZXJhdGluZy1zeXN0ZW07dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtyZWN1cnNpdmVSZXNpemU9MDthbGlnbj1sZWZ0O2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMCIgeT0iMzgiIHdpZHRoPSIyMDgiIGhlaWdodD0iMjQyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IklvVCBNb2JpbGUgQXBwbGljYXRpb24iIHN0eWxlPSJpci5yZWY9ZjU0M2VhZjQtZjEyMC00OTA4LTkwZWUtMDE1MTVmOGUxM2FkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWlvdC1tb2JpbGUtYXBwbGljYXRpb247aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpOVFl5TlRRZ01DNHhNVFU1TmpkRE1DNHpNRE15TXpVZ01DNHhNVFU1TmpjZ01DNHlOakF5TlRRZ01DNHhOVGc1TkRjZ01DNHlOakF5TlRRZ01DNHlNVEU1TmpaV01DNDNPRGM1TmpSRE1DNHlOakF5TlRRZ01DNDROREE1T0RNZ01DNHpNRE15TXpVZ01DNDRPRE01TmpRZ01DNHpOVFl5TlRRZ01DNDRPRE01TmpSSU1DNDJORFF5TlRSRE1DNDJPVGN5TnpNZ01DNDRPRE01TmpRZ01DNDNOREF5TlRRZ01DNDROREE1T0RNZ01DNDNOREF5TlRRZ01DNDNPRGM1TmpSV01DNHlNVEU1TmpaRE1DNDNOREF5TlRRZ01DNHhOVGc1TkRjZ01DNDJPVGN5TnpNZ01DNHhNVFU1TmpjZ01DNDJORFF5TlRRZ01DNHhNVFU1TmpkSU1DNHpOVFl5TlRSYVRUQXVNek15TWpVMElEQXVNVGs1T1RZMlF6QXVNek15TWpVMElEQXVNVGcyTnpFeUlEQXVNelF5T1RrNUlEQXVNVGMxT1RZMklEQXVNelUyTWpVMElEQXVNVGMxT1RZMlNEQXVOalEwTWpVMFF6QXVOalUzTlRBNUlEQXVNVGMxT1RZMklEQXVOalk0TWpVMElEQXVNVGcyTnpFeUlEQXVOalk0TWpVMElEQXVNVGs1T1RZMlZqQXVOekkzT1RZMFF6QXVOalk0TWpVMElEQXVOelF4TWpFNUlEQXVOalUzTlRBNUlEQXVOelV4T1RZMElEQXVOalEwTWpVMElEQXVOelV4T1RZMFNEQXVNelUyTWpVMFF6QXVNelF5T1RrNUlEQXVOelV4T1RZMElEQXVNek15TWpVMElEQXVOelF4TWpFNUlEQXVNek15TWpVMElEQXVOekkzT1RZMFZqQXVNVGs1T1RZMldrMHdMalEzTWpJMU5DQXdMamcwTnprMk0wTXdMalExTmpjNUlEQXVPRFEzT1RZeklEQXVORFEwTWpVMElEQXVPRE0xTkRJM0lEQXVORFEwTWpVMElEQXVPREU1T1RZelF6QXVORFEwTWpVMElEQXVPREEwTlNBd0xqUTFOamM1SURBdU56a3hPVFkwSURBdU5EY3lNalUwSURBdU56a3hPVFkwU0RBdU5USTRNalUwUXpBdU5UUXpOekU0SURBdU56a3hPVFkwSURBdU5UVTJNalUwSURBdU9EQTBOU0F3TGpVMU5qSTFOQ0F3TGpneE9UazJNME13TGpVMU5qSTFOQ0F3TGpnek5UUXlOeUF3TGpVME16Y3hPQ0F3TGpnME56azJNeUF3TGpVeU9ESTFOQ0F3TGpnME56azJNMGd3TGpRM01qSTFORm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFUzTnpRMElEQXVORFUzTURZNFF6QXVOVFl6TnpBNElEQXVORFl6TURNeUlEQXVOVFk0T0RVM0lEQXVORGN3TWpRM0lEQXVOVGN5TnpnZ01DNDBOemM1TVRoRE1DNDFOelV5T1RVZ01DNDBPREk0TXpVZ01DNDFOek16TkRnZ01DNDBPRGc0TmlBd0xqVTJPRFF6TVNBd0xqUTVNVE0zTkVNd0xqVTJNelV4TkNBd0xqUTVNemc0T1NBd0xqVTFOelE0T1NBd0xqUTVNVGswTWlBd0xqVTFORGszTkNBd0xqUTROekF5TlVNd0xqVTFNVGszTlNBd0xqUTRNVEUyTWlBd0xqVTBPREEwTWlBd0xqUTNOVFkxTWlBd0xqVTBNell3TWlBd0xqUTNNVEl4TVVNd0xqVXhPVFkzTVNBd0xqUTBOekkzT1NBd0xqUTRNRGczSURBdU5EUTNNamM1SURBdU5EVTJPVE01SURBdU5EY3hNakV4UXpBdU5EVXlNamc1SURBdU5EYzFPRFl5SURBdU5EUTROVEUwSURBdU5EZ3hNRGcySURBdU5EUTFOakEzSURBdU5EZzJPRE16UXpBdU5EUXpNVEUwSURBdU5Ea3hOell5SURBdU5ETTNNRGs0SURBdU5Ea3pOek0ySURBdU5ETXlNVGNnTUM0ME9URXlORE5ETUM0ME1qY3lORElnTUM0ME9EZzNOU0F3TGpReU5USTJOeUF3TGpRNE1qY3pOQ0F3TGpReU56YzJJREF1TkRjM09EQTJRekF1TkRNeE5qSWdNQzQwTnpBeE56VWdNQzQwTXpZMk5ETWdNQzQwTmpNeU1qTWdNQzQwTkRJM09UY2dNQzQwTlRjd05qaERNQzQwTnpRMU16a2dNQzQwTWpVek1qWWdNQzQxTWpZd01ESWdNQzQwTWpVek1qWWdNQzQxTlRjM05EUWdNQzQwTlRjd05qaGFUVEF1TlRNM01qVTBJREF1TkRnMk9UZzBRekF1TlRReE9EWXhJREF1TkRreE5Ua3hJREF1TlRRMU5qTTNJREF1TkRrM01qSTVJREF1TlRRNE1qWTNJREF1TlRBek1qTkRNQzQxTlRBME9EUWdNQzQxTURneU9Ea2dNQzQxTkRneE9DQXdMalV4TkRFNE5pQXdMalUwTXpFeU1TQXdMalV4TmpRd00wTXdMalV6T0RBMk15QXdMalV4T0RZeUlEQXVOVE15TVRZMUlEQXVOVEUyTXpFMklEQXVOVEk1T1RRNUlEQXVOVEV4TWpVM1F6QXVOVEk0TWprMUlEQXVOVEEzTkRnMElEQXVOVEkxT1RFeklEQXVOVEF6T1RJM0lEQXVOVEl6TVRFeUlEQXVOVEF4TVRJM1F6QXVOVEV3TkRnNElEQXVORGc0TlRBeklEQXVORGt3TURJZ01DNDBPRGcxTURNZ01DNDBOemN6T1RZZ01DNDFNREV4TWpkRE1DNDBOelEyTVRRZ01DNDFNRE01TURrZ01DNDBOekl6TkRNZ01DNDFNRGN6TVRZZ01DNDBOekEyTnpVZ01DNDFNVEV4TWpsRE1DNDBOamcwTmpFZ01DNDFNVFl4T0RrZ01DNDBOakkxTmpRZ01DNDFNVGcwT1RZZ01DNDBOVGMxTURRZ01DNDFNVFl5T0RKRE1DNDBOVEkwTkRVZ01DNDFNVFF3TmpnZ01DNDBOVEF4TXpnZ01DNDFNRGd4TnpJZ01DNDBOVEl6TlRJZ01DNDFNRE14TVRKRE1DNDBOVFE1T1RJZ01DNDBPVGN3TnpnZ01DNDBOVGcyTlRNZ01DNDBPVEUxT0RZZ01DNDBOak15TlRRZ01DNDBPRFk1T0RSRE1DNDBPRE0yT0RrZ01DNDBOalkxTlNBd0xqVXhOamd5SURBdU5EWTJOVFVnTUM0MU16Y3lOVFFnTUM0ME9EWTVPRFJhVFRBdU5UZzBNRGsxSURBdU5ETXlPVGN5UXpBdU5UZzVNVGMxSURBdU5ETTRNRFV5SURBdU5Ua3pPVFkwSURBdU5EUXpPRFEzSURBdU5UazRNVE16SURBdU5EUTVPRGc0UXpBdU5qQXhNamN4SURBdU5EVTBORE16SURBdU5qQXdNVEk1SURBdU5EWXdOall4SURBdU5UazFOVGd6SURBdU5EWXpOems0UXpBdU5Ua3hNRE00SURBdU5EWTJPVE0xSURBdU5UZzBPREVnTUM0ME5qVTNPVFFnTUM0MU9ERTJOek1nTUM0ME5qRXlORGhETUM0MU56Z3hOellnTUM0ME5UWXhPREVnTUM0MU56UXhOVGdnTUM0ME5URXpNVGtnTUM0MU5qazVOVE1nTUM0ME5EY3hNVFJETUM0MU16RXlNeUF3TGpRd09ETTVNU0F3TGpRMk9EUTBOeUF3TGpRd09ETTVNU0F3TGpReU9UY3lOQ0F3TGpRME56RXhORU13TGpReU5UY3pNeUF3TGpRMU1URXdOaUF3TGpReU1UYzFOQ0F3TGpRMU5UazNNU0F3TGpReE9ERXlJREF1TkRZeE1qRkRNQzQwTVRRNU56SWdNQzQwTmpVM05EZ2dNQzQwTURnM05ERWdNQzQwTmpZNE56UWdNQzQwTURReU1ETWdNQzQwTmpNM01qWkRNQzR6T1RrMk5qVWdNQzQwTmpBMU56Z2dNQzR6T1RnMU16a2dNQzQwTlRRek5EY2dNQzQwTURFMk9EY2dNQzQwTkRrNE1VTXdMalF3TlRrMk55QXdMalEwTXpZMElEQXVOREV3TmpreUlEQXVORE0zT0RZeUlEQXVOREUxTlRneUlEQXVORE15T1RjeVF6QXVORFl5TVRFMklEQXVNemcyTkRNNElEQXVOVE0zTlRZeUlEQXVNemcyTkRNNElEQXVOVGcwTURrMUlEQXVORE15T1RjeVdrMHdMalV4TURVeE9DQXdMalV4TkRNNU9VTXdMalV4TmpNNElEQXVOVEl3TWpZeElEQXVOVEUyTXpnZ01DNDFNamszTmpVZ01DNDFNVEExTVRnZ01DNDFNelUyTWpkRE1DNDFNRFEyTlRZZ01DNDFOREUwT0RrZ01DNDBPVFV4TlRJZ01DNDFOREUwT0RrZ01DNDBPRGt5T1NBd0xqVXpOVFl5TjBNd0xqUTRNelF5T0NBd0xqVXlPVGMyTlNBd0xqUTRNelF5T0NBd0xqVXlNREkyTVNBd0xqUTRPVEk1SURBdU5URTBNems1UXpBdU5EazFNVFV5SURBdU5UQTROVE0ySURBdU5UQTBOalUySURBdU5UQTROVE0ySURBdU5URXdOVEU0SURBdU5URTBNems1V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TVNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNHlOQ0lnYUdWcFoyaDBQU0l3TGpJME1EQXdNaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TXpnd016Y3hJREF1TXpRNU9UYzJLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjU5IiB5PSI3OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNCIgdmFsdWU9IkJsdWV0b290aCBwb3J0IC0+IElvVCBNb2JpbGUgQXBwbGljYXRpb24iIHN0eWxlPSJpci5yZWY9OTBiNjQzZTctMGU3NC00MGMyLWIyYTMtZTc4Yzg4NGMwYzUwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNiIgc291cmNlPSI5IiB0YXJnZXQ9IjEyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMjE0IiB5PSIyMzkiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iQmx1ZXRvb3RoIHBvcnQiIHN0eWxlPSJpci5yZWY9MjA0YmVmMTgtNmE0NS00Y2EwLTg2YzctNGE5ZjMwNWZjYmJmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUJMVUVUT09USC1QT1JUO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpJMk4xOHlNalk0TVNraVBqeHdZWFJvSUdROUlrMHdMakUzTkRNeE5pQXdMakl4TWpnMk5rTXdMakUzTkRNeE5pQXdMakU1TVRjeE1TQXdMakU1TVRRMk55QXdMakUzTkRVMk1TQXdMakl4TWpZeU1pQXdMakUzTkRVMk1VZ3dMamM0TnpJeE1VTXdMamd3T0RNMk5pQXdMakUzTkRVMk1TQXdMamd5TlRVeE5pQXdMakU1TVRjeE1TQXdMamd5TlRVeE5pQXdMakl4TWpnMk5sWXdMamM0TnpRMU5VTXdMamd5TlRVeE5pQXdMamd3T0RZeElEQXVPREE0TXpZMklEQXVPREkxTnpZZ01DNDNPRGN5TVRFZ01DNDRNalUzTmtnd0xqSXhNall5TWtNd0xqRTVNVFEyTnlBd0xqZ3lOVGMySURBdU1UYzBNekUySURBdU9EQTROakVnTUM0eE56UXpNVFlnTUM0M09EYzBOVFZXTUM0eU1USTROalphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVNVGd6TVRBMUlEQXVNakl3TmpKRE1DNHhPRE14TURVZ01DNHlNREF3TXpZZ01DNHhPVGszT1RJZ01DNHhPRE16TlNBd0xqSXlNRE0zTmlBd0xqRTRNek0xU0RBdU56YzVORE0xUXpBdU9EQXdNREU1SURBdU1UZ3pNelVnTUM0NE1UWTNNRFVnTUM0eU1EQXdNellnTUM0NE1UWTNNRFVnTUM0eU1qQTJNbFl3TGpjM09UWTNPVU13TGpneE5qY3dOU0F3TGpnd01ESTJNeUF3TGpnd01EQXhPU0F3TGpneE5qazFJREF1TnpjNU5ETTFJREF1T0RFMk9UVklNQzR5TWpBek56WkRNQzR4T1RrM09USWdNQzQ0TVRZNU5TQXdMakU0TXpFd05TQXdMamd3TURJMk15QXdMakU0TXpFd05TQXdMamMzT1RZM09WWXdMakl5TURZeVdpSWdabWxzYkQwaWQyaHBkR1VpSUdacGJHd3RiM0JoWTJsMGVUMGlNQzQ0SWk4K1BIQmhkR2dnWkQwaVRUQXVORGMwTnpZNUlEQXVNamt4TVRjM1F6QXVORGd4TURnZ01DNHlPRGd5TnpVZ01DNDBPRGcxTURNZ01DNHlPRGt6TVRRZ01DNDBPVE0zTnpZZ01DNHlPVE00TXpaTU1DNDJNVGd5TnlBd0xqUXdNRFl3TlVNd0xqWXlNakkwTXlBd0xqUXdOREF4TWlBd0xqWXlORFV4TkNBd0xqUXdPRGs1T0NBd0xqWXlORFEzTmlBd0xqUXhOREl6TWtNd0xqWXlORFF6T1NBd0xqUXhPVFEyTnlBd0xqWXlNakE1TnlBd0xqUXlORFF4T1NBd0xqWXhPREEzTlNBd0xqUXlOemMyT1V3d0xqVXlOemM0TkNBd0xqVXdNams0TjB3d0xqWXhPREEzT0NBd0xqVTNPREl6TVVNd0xqWXlNakE1T1NBd0xqVTRNVFU0TWlBd0xqWXlORFEwSURBdU5UZzJOVE0xSURBdU5qSTBORGMySURBdU5Ua3hOemRETUM0Mk1qUTFNVE1nTUM0MU9UY3dNRFVnTUM0Mk1qSXlOREVnTUM0Mk1ERTVPU0F3TGpZeE9ESTJOaUF3TGpZd05UTTVOMHd3TGpRNU16YzNNaUF3TGpjeE1qRXdOa013TGpRNE9EUTVPU0F3TGpjeE5qWXlOaUF3TGpRNE1UQTNOeUF3TGpjeE56WTJNeUF3TGpRM05EYzJOaUF3TGpjeE5EYzJNVU13TGpRMk9EUTFOaUF3TGpjeE1UZzFPU0F3TGpRMk5EUXhNeUF3TGpjd05UVTBPQ0F3TGpRMk5EUXhNeUF3TGpZNU9EWXdNMVl3TGpVMU5UYzNPRXd3TGpRd05EWTFOeUF3TGpZd05UVTFPRU13TGpNNU56RXhJREF1TmpFeE9EUTFJREF1TXpnMU9EazJJREF1TmpFd09ESTBJREF1TXpjNU5qQTVJREF1TmpBek1qYzNRekF1TXpjek16SXlJREF1TlRrMU56TWdNQzR6TnpRek5EUWdNQzQxT0RRMU1UWWdNQzR6T0RFNE9TQXdMalUzT0RJeU9Vd3dMalEyTkRReE15QXdMalV3T1RRNE0xWXdMalE1TmpRM09Vd3dMak00TVRnNE9DQXdMalF5Tnpjd09FTXdMak0zTkRNME1pQXdMalF5TVRReUlEQXVNemN6TXpJeklEQXVOREV3TWpBMUlEQXVNemM1TmpFeElEQXVOREF5TmpaRE1DNHpPRFU0T1RrZ01DNHpPVFV4TVRRZ01DNHpPVGN4TVRNZ01DNHpPVFF3T1RRZ01DNDBNRFEyTlRrZ01DNDBNREF6T0RKTU1DNDBOalEwTVRNZ01DNDBOVEF4TnpkV01DNHpNRGN6TXpaRE1DNDBOalEwTVRNZ01DNHpNREF6T0RrZ01DNDBOamcwTlRjZ01DNHlPVFF3TnprZ01DNDBOelEzTmprZ01DNHlPVEV4TnpkYVRUQXVOVEF3TURBeklEQXVORGM1T0RNMVREQXVOVGM1TVRReklEQXVOREV6T1RBM1REQXVORGs1T1RneklEQXVNelEyTURFNFZqQXVORGM1T0RFNVREQXVOVEF3TURBeklEQXVORGM1T0RNMVdrMHdMalE1T1RrNU9TQXdMalV5TmpFek0wd3dMalE1T1RrNE15QXdMalV5TmpFME4xWXdMalkxT1Rrek5Vd3dMalUzT1RFME1TQXdMalU1TWpBNE5Vd3dMalE1T1RrNU9TQXdMalV5TmpFek0xb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejQ4TDJjK1BHUmxabk0rUEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUY4eU1qWTNYekl5TmpneElqNDhjbVZqZENCM2FXUjBhRDBpTUM0NE9DSWdhR1ZwWjJoMFBTSXdMamc0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05qQXdOVGcySURBdU1EWXdNRFU0TmlraUx6NDhMMk5zYVhCUVlYUm9Qand2WkdWbWN6NDhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjYiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjc4IiB5PSIxODgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTUiIHZhbHVlPSJJb1QgTW9iaWxlIEFwcGxpY2F0aW9uIC0+IEJsdWV0b290aCBwb3J0IiBzdHlsZT0iaXIucmVmPWQzMGRmNGJmLTc4NmYtNDY3NC05ODJlLTViNGYwMmM5M2IwZDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjYiIHNvdXJjZT0iMTIiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjI0MiIgeT0iMTc0Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJXaS1GaSBwb3J0IiBzdHlsZT0iaXIucmVmPTE5Y2RkMmZiLTRjOTQtNGJiMi1iN2I4LTNkMDhlMWU2MGUzZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1XSS1GSS1QT1JUO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpJMk4xOHlNamcxTWlraVBqeHdZWFJvSUdROUlrMHdMakUzTkRNeE5pQXdMakl4TWpnMk5rTXdMakUzTkRNeE5pQXdMakU1TVRjeE1TQXdMakU1TVRRMk55QXdMakUzTkRVMk1TQXdMakl4TWpZeU1pQXdMakUzTkRVMk1VZ3dMamM0TnpJeE1VTXdMamd3T0RNMk5pQXdMakUzTkRVMk1TQXdMamd5TlRVeE5pQXdMakU1TVRjeE1TQXdMamd5TlRVeE5pQXdMakl4TWpnMk5sWXdMamM0TnpRMU5VTXdMamd5TlRVeE5pQXdMamd3T0RZeElEQXVPREE0TXpZMklEQXVPREkxTnpZZ01DNDNPRGN5TVRFZ01DNDRNalUzTmtnd0xqSXhNall5TWtNd0xqRTVNVFEyTnlBd0xqZ3lOVGMySURBdU1UYzBNekUySURBdU9EQTROakVnTUM0eE56UXpNVFlnTUM0M09EYzBOVFZXTUM0eU1USTROalphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVNVGd6TVRBMUlEQXVNakl3TmpKRE1DNHhPRE14TURVZ01DNHlNREF3TXpZZ01DNHhPVGszT1RJZ01DNHhPRE16TlNBd0xqSXlNRE0zTmlBd0xqRTRNek0xU0RBdU56YzVORE0xUXpBdU9EQXdNREU1SURBdU1UZ3pNelVnTUM0NE1UWTNNRFVnTUM0eU1EQXdNellnTUM0NE1UWTNNRFVnTUM0eU1qQTJNbFl3TGpjM09UWTNPVU13TGpneE5qY3dOU0F3TGpnd01ESTJNeUF3TGpnd01EQXhPU0F3TGpneE5qazFJREF1TnpjNU5ETTFJREF1T0RFMk9UVklNQzR5TWpBek56WkRNQzR4T1RrM09USWdNQzQ0TVRZNU5TQXdMakU0TXpFd05TQXdMamd3TURJMk15QXdMakU0TXpFd05TQXdMamMzT1RZM09WWXdMakl5TURZeVdpSWdabWxzYkQwaWQyaHBkR1VpSUdacGJHd3RiM0JoWTJsMGVUMGlNQzQ0SWk4K1BIQmhkR2dnWkQwaVRUQXVNemM0TnpBNUlEQXVNekkzTnpJNVREQXVNell4T0RFMklEQXVNalEzTWpnMlNEQXVNemMzTWpFMVREQXVNemcxT1RRNUlEQXVNamt5TlRZMFF6QXVNemcyTVRjNUlEQXVNamt6TnprZ01DNHpPRFl6TnlBd0xqSTVORGc0TVNBd0xqTTROalV5TkNBd0xqSTVOVGd6T1VNd0xqTTROalkzTnlBd0xqSTVOamM1TnlBd0xqTTROamd4TVNBd0xqSTVOemcxSURBdU16ZzJPVEkySURBdU1qazRPVGs1UXpBdU16ZzNNRGM1SURBdU1qazNPVEkzSURBdU16ZzNNamN4SURBdU1qazJPRGN6SURBdU16ZzNOVEF4SURBdU1qazFPRE01UXpBdU16ZzNOek1nTUM0eU9UUTNOallnTUM0ek9EYzVPVGdnTUM0eU9UTTJOelVnTUM0ek9EZ3pNRFVnTUM0eU9USTFOalJNTUM0ek9UazNNemtnTUM0eU5EY3lPRFpJTUM0ME1USTBPVFZNTUM0ME1qTTVPRGNnTUM0eU9USTFNRFpETUM0ME1qUXlPVE1nTUM0eU9UTTFOemtnTUM0ME1qUTFORElnTUM0eU9UUTJNeklnTUM0ME1qUTNNelFnTUM0eU9UVTJOamRETUM0ME1qUTVNalVnTUM0eU9UWTNNREVnTUM0ME1qVXdPVGdnTUM0eU9UYzNOVFFnTUM0ME1qVXlOVEVnTUM0eU9UZzRNamRETUM0ME1qVTBNRFFnTUM0eU9UYzNPVE1nTUM0ME1qVTFOVGNnTUM0eU9UWTNPVGNnTUM0ME1qVTNNVEVnTUM0eU9UVTRNemxETUM0ME1qVTVNRElnTUM0eU9UUTRORE1nTUM0ME1qWXdPVFFnTUM0eU9UTTRNamdnTUM0ME1qWXlPRFVnTUM0eU9USTNPVFJNTUM0ME16VTBNakVnTUM0eU5EY3lPRFpJTUM0ME5UQTNOak5NTUM0ME16TXpOVE1nTUM0ek1qYzNNamxJTUM0ME1UazROVXd3TGpRd056QTVOQ0F3TGpJM09UUTJNME13TGpRd05qZ3lOaUF3TGpJM09EVTBOQ0F3TGpRd05qVTVOaUF3TGpJM056WTJNeUF3TGpRd05qUXdOQ0F3TGpJM05qZ3lRekF1TkRBMk1qVXhJREF1TWpjMU9UYzNJREF1TkRBMk1EazRJREF1TWpjMU1EQXhJREF1TkRBMU9UUTFJREF1TWpjek9EbERNQzQwTURVM05UTWdNQzR5TnpVd016a2dNQzQwTURVMU5qSWdNQzR5TnpZd01UWWdNQzQwTURVek55QXdMakkzTmpneVF6QXVOREExTWpFM0lEQXVNamMzTmpJMUlEQXVOREExTURJMUlEQXVNamM0TkRnMklEQXVOREEwTnprMklEQXVNamM1TkRBMlREQXVNemt5TXpJM0lEQXVNekkzTnpJNVNEQXVNemM0TnpBNVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQanh3WVhSb0lHUTlJazB3TGpRMk5EQTFOQ0F3TGpNeU56Y3lPVll3TGpJMk9UQXdOa2d3TGpRM09EUXhPRll3TGpNeU56Y3lPVWd3TGpRMk5EQTFORnBOTUM0ME56RXlNellnTUM0eU5qRTJOVEZETUM0ME5qZzVNemdnTUM0eU5qRTJOVEVnTUM0ME5qWTVORFlnTUM0eU5qQTRNamNnTUM0ME5qVXlOaUF3TGpJMU9URTRRekF1TkRZek5qRXpJREF1TWpVM05EazFJREF1TkRZeU56a2dNQzR5TlRVMU1ETWdNQzQwTmpJM09TQXdMakkxTXpJd05VTXdMalEyTWpjNUlEQXVNalV3T1RBMklEQXVORFl6TmpFeklEQXVNalE0T1RVeklEQXVORFkxTWpZZ01DNHlORGN6TkRSRE1DNDBOalk1TURjZ01DNHlORFUyT1RjZ01DNDBOamc0T1RrZ01DNHlORFE0TnpNZ01DNDBOekV5TXpZZ01DNHlORFE0TnpORE1DNDBOek0yTkRrZ01DNHlORFE0TnpNZ01DNDBOelUyTmlBd0xqSTBOVFkzTnlBd0xqUTNOekkyT1NBd0xqSTBOekk0TmtNd0xqUTNPRGczT0NBd0xqSTBPRGc1TlNBd0xqUTNPVFk0TWlBd0xqSTFNRGcyT0NBd0xqUTNPVFk0TWlBd0xqSTFNekl3TlVNd0xqUTNPVFk0TWlBd0xqSTFOVFUwTVNBd0xqUTNPRGcxT1NBd0xqSTFOelV6TXlBd0xqUTNOekl4TWlBd0xqSTFPVEU0UXpBdU5EYzFOakF6SURBdU1qWXdPREkzSURBdU5EY3pOakV4SURBdU1qWXhOalV4SURBdU5EY3hNak0ySURBdU1qWXhOalV4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBqeHdZWFJvSUdROUlrMHdMalE1TmpRNE5DQXdMak13TURZd09GWXdMakk0TmpnM05VZ3dMalV5TmpJME4xWXdMak13TURZd09FZ3dMalE1TmpRNE5Gb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejQ4Y0dGMGFDQmtQU0pOTUM0MU5ETTROVFlnTUM0ek1qYzNNamxXTUM0eU5EY3lPRFpJTUM0MU9UY3pOVll3TGpJMk1UUXlNVWd3TGpVMU9EY3pPRll3TGpJM09URXhPVWd3TGpVNE16UTBOVll3TGpJNU16STFNMGd3TGpVMU9EY3pPRll3TGpNeU56Y3lPVWd3TGpVME16ZzFObG9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OGNHRjBhQ0JrUFNKTk1DNDJNRGt6T0RRZ01DNHpNamMzTWpsV01DNHlOamt3TURaSU1DNDJNak0zTkRsV01DNHpNamMzTWpsSU1DNDJNRGt6T0RSYVRUQXVOakUyTlRZMklEQXVNall4TmpVeFF6QXVOakUwTWpZNElEQXVNall4TmpVeElEQXVOakV5TWpjMklEQXVNall3T0RJM0lEQXVOakV3TlRreElEQXVNalU1TVRoRE1DNDJNRGc1TkRRZ01DNHlOVGMwT1RVZ01DNDJNRGd4TWlBd0xqSTFOVFV3TXlBd0xqWXdPREV5SURBdU1qVXpNakExUXpBdU5qQTRNVElnTUM0eU5UQTVNRFlnTUM0Mk1EZzVORFFnTUM0eU5EZzVOVE1nTUM0Mk1UQTFPVEVnTUM0eU5EY3pORFJETUM0Mk1USXlNemdnTUM0eU5EVTJPVGNnTUM0Mk1UUXlNeUF3TGpJME5EZzNNeUF3TGpZeE5qVTJOaUF3TGpJME5EZzNNME13TGpZeE9EazRJREF1TWpRME9EY3pJREF1TmpJd09Ua3hJREF1TWpRMU5qYzNJREF1TmpJeU5pQXdMakkwTnpJNE5rTXdMall5TkRJd09DQXdMakkwT0RnNU5TQXdMall5TlRBeE15QXdMakkxTURnMk9DQXdMall5TlRBeE15QXdMakkxTXpJd05VTXdMall5TlRBeE15QXdMakkxTlRVME1TQXdMall5TkRFNE9TQXdMakkxTnpVek15QXdMall5TWpVME1pQXdMakkxT1RFNFF6QXVOakl3T1RNeklEQXVNall3T0RJM0lEQXVOakU0T1RReElEQXVNall4TmpVeElEQXVOakUyTlRZMklEQXVNall4TmpVeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQanhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01WOHlNalkzWHpJeU9EVXlLU0krUEhCaGRHZ2daRDBpVFRBdU5qUXlPVEk1SURBdU5UUTBOak0wUXpBdU5qVTNOamd6SURBdU5UVTVNemc0SURBdU5qY3dOREl5SURBdU5UYzNNak0zSURBdU5qZ3dNVEkzSURBdU5UazJNakV6UXpBdU5qZzJNelE1SURBdU5qQTRNemMzSURBdU5qZ3hOVE15SURBdU5qSXpNamd5SURBdU5qWTVNelkzSURBdU5qSTVOVEF6UXpBdU5qVTNNakF6SURBdU5qTTFOekkxSURBdU5qUXlNams0SURBdU5qTXdPVEE0SURBdU5qTTJNRGMzSURBdU5qRTROelEwUXpBdU5qSTROalU0SURBdU5qQTBNak01SURBdU5qRTRPVEk0SURBdU5Ua3dOakEzSURBdU5qQTNPVFF5SURBdU5UYzVOakl4UXpBdU5UUTROek01SURBdU5USXdOREUzSURBdU5EVXlOelVnTUM0MU1qQTBNVGNnTUM0ek9UTTFORFlnTUM0MU56azJNakZETUM0ek9ESXdOREVnTUM0MU9URXhNallnTUM0ek56STNNRE1nTUM0Mk1EUXdOVEVnTUM0ek5qVTFNVEVnTUM0Mk1UZ3lOamxETUM0ek5Ua3pORFFnTUM0Mk16QTBOakVnTUM0ek5EUTBOakVnTUM0Mk16VXpORFlnTUM0ek16SXlOamtnTUM0Mk1qa3hOemxETUM0ek1qQXdOemNnTUM0Mk1qTXdNVElnTUM0ek1UVXhPVElnTUM0Mk1EZ3hNamtnTUM0ek1qRXpOVGtnTUM0MU9UVTVNemRETUM0ek16QTVNRGdnTUM0MU56Y3dOVGtnTUM0ek5ETXpNelFnTUM0MU5UazROaUF3TGpNMU9EVTFPU0F3TGpVME5EWXpORU13TGpRek56QTROaUF3TGpRMk5qRXdPQ0F3TGpVMk5EUXdNeUF3TGpRMk5qRXdPQ0F3TGpZME1qa3lPU0F3TGpVME5EWXpORnBOTUM0MU9USXlOQ0F3TGpZeE9EWTBNME13TGpZd016WXpOU0F3TGpZek1EQXpPQ0F3TGpZeE1qazNPU0F3TGpZME16azROeUF3TGpZeE9UUTROQ0F3TGpZMU9EZ3pNME13TGpZeU5EazJPQ0F3TGpZM01UTTBOeUF3TGpZeE9USTJPQ0F3TGpZNE5Ua3pOeUF3TGpZd05qYzFOQ0F3TGpZNU1UUXlNVU13TGpVNU5ESTBJREF1TmprMk9UQTFJREF1TlRjNU5qUTVJREF1TmpreE1qQTJJREF1TlRjME1UWTJJREF1TmpjNE5qa3hRekF1TlRjd01EYzFJREF1TmpZNU16VTJJREF1TlRZME1UZ3hJREF1TmpZd05UVTRJREF1TlRVM01qVXpJREF1TmpVek5qTkRNQzQxTWpZd01qSWdNQzQyTWpJek9Ua2dNQzQwTnpVek9EWWdNQzQyTWpJek9Ua2dNQzQwTkRReE5UVWdNQzQyTlRNMk0wTXdMalF6TnpJM01pQXdMalkyTURVeE15QXdMalF6TVRZMU5DQXdMalkyT0RrMElEQXVOREkzTlRJMklEQXVOamM0TXpjMVF6QXVOREl5TURRNUlEQXVOamt3T0RreUlEQXVOREEzTkRZeUlEQXVOamsyTlRrNUlEQXVNemswT1RRMUlEQXVOamt4TVRJeVF6QXVNemd5TkRJM0lEQXVOamcxTmpRMUlEQXVNemMyTnpJZ01DNDJOekV3TlRnZ01DNHpPREl4T1RjZ01DNDJOVGcxTkVNd0xqTTRPRGN5T1NBd0xqWTBNell4TWlBd0xqTTVOemM0TmlBd0xqWXpNREF5TmlBd0xqUXdPVEUyT1NBd0xqWXhPRFkwTTBNd0xqUTFPVGN5TWlBd0xqVTJPREE1SURBdU5UUXhOamcySURBdU5UWTRNRGtnTUM0MU9USXlOQ0F3TGpZeE9EWTBNMXBOTUM0M01EZ3hNaUF3TGpRNE5UQXlNa013TGpjeU1EWTROeUF3TGpRNU56VTRPU0F3TGpjek1qVXpOU0F3TGpVeE1Ua3lOU0F3TGpjME1qZzBPU0F3TGpVeU5qZzNRekF1TnpVd05qRWdNQzQxTXpneE1UUWdNQzQzTkRjM09EWWdNQzQxTlRNMU1qSWdNQzQzTXpZMU5ERWdNQzQxTmpFeU9ETkRNQzQzTWpVeU9UWWdNQzQxTmprd05EUWdNQzQzTURrNE9Ea2dNQzQxTmpZeU1Ua2dNQzQzTURJeE1qZ2dNQzQxTlRRNU56UkRNQzQyT1RNME56Y2dNQzQxTkRJME16a2dNQzQyT0RNMU16VWdNQzQxTXpBME1TQXdMalkzTXpFek15QXdMalV5TURBd09FTXdMalUzTnpNek5TQXdMalF5TkRJeE1TQXdMalF5TWpBeE5pQXdMalF5TkRJeE1TQXdMak15TmpJeE9DQXdMalV5TURBd09FTXdMak14TmpNME15QXdMalV5T1RnNE5DQXdMak13TmpVd01TQXdMalUwTVRreE9TQXdMakk1TnpVeElEQXVOVFUwT0RjNVF6QXVNamc1TnpJeUlEQXVOVFkyTVRBMUlEQXVNamMwTXpBNElEQXVOVFk0T0RreklEQXVNall6TURneElEQXVOVFl4TVRBMVF6QXVNalV4T0RVMUlEQXVOVFV6TXpFM0lEQXVNalE1TURZNElEQXVOVE0zT1RBeklEQXVNalUyT0RVMklEQXVOVEkyTmpjMlF6QXVNalkzTkRRMUlEQXVOVEV4TkRFeklEQXVNamM1TVRNMElEQXVORGszTVRJZ01DNHlPVEV5TXpJZ01DNDBPRFV3TWpKRE1DNDBNRFl6TlRJZ01DNHpOams1TURJZ01DNDFPVEk1T1RrZ01DNHpOams1TURJZ01DNDNNRGd4TWlBd0xqUTROVEF5TWxwTk1DNDFNall3T1RVZ01DNDJPRFkwTmpKRE1DNDFOREExT1RjZ01DNDNNREE1TmpRZ01DNDFOREExT1RjZ01DNDNNalEwTnpjZ01DNDFNall3T1RVZ01DNDNNemc1TnpsRE1DNDFNVEUxT1RNZ01DNDNOVE0wT0RFZ01DNDBPRGd3T0NBd0xqYzFNelE0TVNBd0xqUTNNelUzT0NBd0xqY3pPRGszT1VNd0xqUTFPVEEzTmlBd0xqY3lORFEzTnlBd0xqUTFPVEEzTmlBd0xqY3dNRGsyTkNBd0xqUTNNelUzT0NBd0xqWTROalEyTWtNd0xqUTRPREE0SURBdU5qY3hPVFlnTUM0MU1URTFPVE1nTUM0Mk56RTVOaUF3TGpVeU5qQTVOU0F3TGpZNE5qUTJNbG9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OEwyYytQQzluUGp4a1pXWnpQanhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpJMk4xOHlNamcxTWlJK1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K1BDOWpiR2x3VUdGMGFENDhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhYekl5TmpkZk1qSTROVElpUGp4eVpXTjBJSGRwWkhSb1BTSXdMalE1TnprM05pSWdhR1ZwWjJoMFBTSXdMak0yTXprd05pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNalV3T1RjM0lEQXVNemswTnpjMUtTSXZQand2WTJ4cGNGQmhkR2crUEM5a1pXWnpQand2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI4MCIgeT0iMjgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJSb3V0ZXIiIHN0eWxlPSJpci5yZWY9ZjM2MmRmZTktNjlhNS00NmU4LTk3MTctZDBlYmJhMzE0ODhlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELVJPVVRFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNRjh5TkRVM1h6SXpNVFEzS1NJK1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF4WHpJME5UZGZNak14TkRjcElqNDhjR0YwYUNCa1BTSk5NQzR6TVRZeU5EY2dNQzR5T0Rjd016bERNQzR6TVRVME9URWdNQzR5T1RVeU5qa2dNQzR6TVRFM09EWWdNQzR6TURJNU5Ea2dNQzR6TURVNE1UTWdNQzR6TURnMk5qRk1NQzR6TlRNM05UY2dNQzQwTkRBek9EVk1NQzR6TWpneE9TQXdMalEwT1RZNU1Vd3dMakk0TURJME5pQXdMak14TnprMk5rTXdMakkyTnpFNE1pQXdMak14TnpBM05TQXdMakkxTlRFMk1pQXdMak13T0RjeE1TQXdMakkxTURReE55QXdMakk1TlRZM01rTXdMakkwTWpnM09TQXdMakkzTkRrMk15QXdMakkxTmpjd015QXdMakkxTVRZNU1TQXdMakk0TURVMElEQXVNalE1T1RZMFF6QXVNamt4T1RZMUlEQXVNalE1TVRNMUlEQXVNekF6TXpRMUlEQXVNalUwTlRRNElEQXVNekE1T1RJMklEQXVNall6T0RjNVF6QXVNekUwTnpVNElEQXVNamN3TlRneklEQXVNekUzTURBeklEQXVNamM0T0RBNUlEQXVNekUyTWpRM0lEQXVNamczTURNNVdpSWdabWxzYkQwaUl6QkNRVEJDTnlJdlBqeHdZWFJvSUdROUlrMHdMalV5T1RZMU55QXdMakk0TkRJNU4wTXdMalV5TmpFek1pQXdMakk1TVRjM01pQXdMalV5TURBeU15QXdMakk1TnpjeU1TQXdMalV4TWpRMU55QXdMak13TVRBME5sWXdMalEwTVRJeU5FZ3dMalE0TlRJME9WWXdMak13TVRBME5rTXdMalEzTXpJM09DQXdMakk1TlRjME1TQXdMalEyTkRnME5DQXdMakk0TXpjMk9TQXdMalEyTkRnME5DQXdMakkyT1RnNU5FTXdMalEyTkRnME5DQXdMakkwTnpnMU5pQXdMalE0TlRjNU15QXdMakl6TURjeE5TQXdMalV3T0RjNE5DQXdMakl6TnpJME5VTXdMalV4T1Rnd015QXdMakkwTURNM015QXdMalV5T0RZME5TQXdMakkwT1RNMU1pQXdMalV6TVRZek9DQXdMakkyTURNM01VTXdMalV6TXpnNE5pQXdMakkyT0RNeU5DQXdMalV6TXpFNE1pQXdMakkzTmpneU1pQXdMalV5T1RZMU55QXdMakk0TkRJNU4xb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NDhjR0YwYUNCa1BTSk5NQzQzTkRBeE16SWdNQzR6TURjME5EaERNQzQzTXpReU5qTWdNQzR6TVRNeU5qY2dNQzQzTWpZME9EZ2dNQzR6TVRZM05qZ2dNQzQzTVRneU5ERWdNQzR6TVRjek1EUk1NQzQyTnpBeU9UY2dNQzQwTkRrd01qbE1NQzQyTkRRM015QXdMalF6T1RjeU0wd3dMalk1TWpZM05DQXdMak13TnprNU9VTXdMalk0TXpJek9TQXdMakk1T0RreE9TQXdMalkzT1RRd09DQXdMakk0TkRjNE5TQXdMalk0TkRFMU5DQXdMakkzTVRjME5rTXdMalk1TVRZNU1TQXdMakkxTVRBek55QXdMamN4TnpJMElEQXVNalF5TURrMUlEQXVOek0yTmpFZ01DNHlOVFl3T1RWRE1DNDNORFU0T1RVZ01DNHlOakk0TURNZ01DNDNOVEV4TXpNZ01DNHlOelF5TmpVZ01DNDNOVEF4TnpjZ01DNHlPRFUyTkRORE1DNDNORGsxTmprZ01DNHlPVE00T0RVZ01DNDNORFl3TURFZ01DNHpNREUyTXlBd0xqYzBNREV6TWlBd0xqTXdOelEwT0ZvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TWpVMk16UTRJREF1TmpZNE9UUTFRekF1TWpVNE1EYzJJREF1TmpnME56WTVJREF1TWpjeE5EYzVJREF1TmprM01EYzFJREF1TWpnM056WTBJREF1TmprM01EYzFRekF1TXpBd01qUTRJREF1TmprM01EYzFJREF1TXpFeE1EUXpJREF1TmpnNU9ETTRJREF1TXpFMk1UYzVJREF1TmpjNU16STVTREF1TXpBMU5qVTNRekF1TWpnNE1UQTRJREF1TmpjNU16STVJREF1TWpjeE5ESTBJREF1TmpjMU5qSXhJREF1TWpVMk16UTRJREF1TmpZNE9UUTFXaUlnWm1sc2JEMGlJekJDUVRCQ055SXZQanh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDNNVEE1TXpnZ01DNDJOemt5T1RoRE1DNDNNVFl3TnpZZ01DNDJPRGs0TURnZ01DNDNNalk0TnpFZ01DNDJPVGN3TkRRZ01DNDNNemt6TlRjZ01DNDJPVGN3TkRSRE1DNDNOVFUyTXlBd0xqWTVOekEwTkNBd0xqYzJPVEF5T0NBd0xqWTRORGMxTnlBd0xqYzNNRGMyTnlBd0xqWTJPRGswTlVNd0xqYzFOVGN3TnlBd0xqWTNOVFl3TWlBd0xqY3pPVEEwT0NBd0xqWTNPVEk1T0NBd0xqY3lNVFV5TXlBd0xqWTNPVEk1T0Vnd0xqY3hNRGt6T0ZvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TnpnNE56RWdNQzQwTmpFME5UbElNQzR5TXpjM09ETkRNQzR5TWpJME16WWdNQzQwTmpFME5Ua2dNQzR5TURrNU9UUWdNQzQwTnpNNUlEQXVNakE1T1RrMElEQXVORGc1TWpRNFZqQXVOakkwTnpJeVF6QXVNakE1T1RrMElEQXVOalF3TURZNUlEQXVNakl5TkRNMUlEQXVOalV5TlRFeElEQXVNak0zTnpneklEQXVOalV5TlRFeFNEQXVOemc0TnpBNVF6QXVPREEwTURVM0lEQXVOalV5TlRFeElEQXVPREUyTkRrNUlEQXVOalF3TURZNUlEQXVPREUyTkRrNUlEQXVOakkwTnpJeVZqQXVORGc1TWpRNFF6QXVPREUyTkRrNUlEQXVORGN6T1NBd0xqZ3dOREExTnlBd0xqUTJNVFExT1NBd0xqYzRPRGN4SURBdU5EWXhORFU1V2swd0xqSXpOemM0TXlBd0xqUXpOVEExT1VNd0xqSXdOemcxTlNBd0xqUXpOVEExT1NBd0xqRTRNelU1TkNBd0xqUTFPVE15SURBdU1UZ3pOVGswSURBdU5EZzVNalE0VmpBdU5qSTBOekl5UXpBdU1UZ3pOVGswSURBdU5qVTBOalVnTUM0eU1EYzROVFVnTUM0Mk56ZzVNVEVnTUM0eU16YzNPRE1nTUM0Mk56ZzVNVEZJTUM0M09EZzNNRGxETUM0NE1UZzJNemNnTUM0Mk56ZzVNVEVnTUM0NE5ESTRPVGtnTUM0Mk5UUTJOU0F3TGpnME1qZzVPU0F3TGpZeU5EY3lNbFl3TGpRNE9USTBPRU13TGpnME1qZzVPU0F3TGpRMU9UTXlJREF1T0RFNE5qTTRJREF1TkRNMU1EVTVJREF1TnpnNE56RWdNQzQwTXpVd05UbElNQzR5TXpjM09ETmFJaUJtYVd4c1BTSWpNRUpCTUVJM0lpOCtQR05wY21Oc1pTQmplRDBpTUM0MU9UUTRORFVpSUdONVBTSXdMalUxTnpJME55SWdjajBpTUM0d01qSTFOemc1SWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEdWc2JHbHdjMlVnWTNnOUlqQXVOalkzTVRFaUlHTjVQU0l3TGpVMU56STBOeUlnY25nOUlqQXVNREl5TlRjNUlpQnllVDBpTUM0d01qSTFOemc1SWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEdWc2JHbHdjMlVnWTNnOUlqQXVOek01TXpjMklpQmplVDBpTUM0MU5UY3lORGNpSUhKNFBTSXdMakF5TWpVM09TSWdjbms5SWpBdU1ESXlOVGM0T1NJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGp4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZNE16WWdNQzQxTlRjeE5URkRNQzR5TlRZNE16WWdNQzQxTkRjME16RWdNQzR5TmpRM01UWWdNQzQxTXprMU5URWdNQzR5TnpRME16WWdNQzQxTXprMU5URklNQzQwTWpjNU56TkRNQzQwTXpjMk9UTWdNQzQxTXprMU5URWdNQzQwTkRVMU56TWdNQzQxTkRjME16RWdNQzQwTkRVMU56TWdNQzQxTlRjeE5URkRNQzQwTkRVMU56TWdNQzQxTmpZNE56RWdNQzQwTXpjMk9UTWdNQzQxTnpRM05URWdNQzQwTWpjNU56TWdNQzQxTnpRM05URklNQzR5TnpRME16WkRNQzR5TmpRM01UWWdNQzQxTnpRM05URWdNQzR5TlRZNE16WWdNQzQxTmpZNE56RWdNQzR5TlRZNE16WWdNQzQxTlRjeE5URmFJaUJtYVd4c1BTSWpNRUpCTUVJM0lpOCtQQzluUGp3dlp6NDhaR1ZtY3o0OFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6STBOVGRmTWpNeE5EY2lQanh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K1BDOWpiR2x3VUdGMGFENDhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhYekkwTlRkZk1qTXhORGNpUGp4eVpXTjBJSGRwWkhSb1BTSXdMamc0SWlCb1pXbG5hSFE5SWpBdU9EZ2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEyTURBMU9EWWdNQzR3TmpBd05UZzJLU0l2UGp3dlkyeHBjRkJoZEdnK1BDOWtaV1p6UGp3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NTUiIHk9IjU4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkdlbmVyaWMgaGFyZHdhcmUiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qSTJOMTh5TXpBME5Da2lQanh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDNNVEV5TkRZZ01DNHpPVGN5TVRkRE1DNDNNVFV3TXpRZ01DNHpPVGN5TVRjZ01DNDNNVGd4TmpZZ01DNDBNREF3TXlBd0xqY3hPRFkxT0NBd0xqUXdNelk0TTB3d0xqY3hPRGN5TnlBd0xqUXdORFk1TjB3d0xqY3hPRGN6TlNBd0xqUXlOemc0TlVNd0xqY3pNek00TnlBd0xqUXpNRGcyTWlBd0xqYzBORGt5TmlBd0xqUTBNalF3TmlBd0xqYzBOemt3TWlBd0xqUTFOekExT0V3d0xqYzNNVEE0T0NBd0xqUTFOekExTmtNd0xqYzNOVEl4T1NBd0xqUTFOekExTmlBd0xqYzNPRFUyT0NBd0xqUTJNRFF3TlNBd0xqYzNPRFUyT0NBd0xqUTJORFV6TjBNd0xqYzNPRFUyT0NBd0xqUTJPRE15TXlBd0xqYzNOVGMxTXlBd0xqUTNNVFExTXlBd0xqYzNNakV3TWlBd0xqUTNNVGswT1V3d0xqYzNNVEE0T0NBd0xqUTNNakF4TjBnd0xqYzBPRFkxVmpBdU5EZzVORGRJTUM0M056RXdPRGhETUM0M056UTROellnTUM0ME9EazBOeUF3TGpjM09EQXdOQ0F3TGpRNU1qSTROU0F3TGpjM09EVWdNQzQwT1RVNU16Vk1NQzQzTnpnMU5qZ2dNQzQwT1RZNU5VTXdMamMzT0RVMk9DQXdMalV3TURjek5pQXdMamMzTlRjMU15QXdMalV3TXpnMk5pQXdMamMzTWpFd01pQXdMalV3TkRNMk1rd3dMamMzTVRBNE9DQXdMalV3TkRRek1VZ3dMamMwT0RZMVZqQXVOVEl4T0RnelNEQXVOemN4TURnNFF6QXVOemMwT0RjMklEQXVOVEl4T0RneklEQXVOemM0TURBMElEQXVOVEkwTmprNElEQXVOemM0TlNBd0xqVXlPRE0wT1V3d0xqYzNPRFUyT0NBd0xqVXlPVE0yTkVNd0xqYzNPRFUyT0NBd0xqVXpNVGMxTWlBd0xqYzNOelExTVNBd0xqVXpNemczT0NBd0xqYzNOVGN3TnlBd0xqVXpOVEkwT0VNd0xqYzNORFk0TlNBd0xqVXpOakExTVNBd0xqYzNNelEwT1NBd0xqVXpOalU1TWlBd0xqYzNNakV3TWlBd0xqVXpOamMzTmt3d0xqYzNNVEE0T0NBd0xqVXpOamcwTkV3d0xqYzBOemc1T0NBd0xqVXpOamcxTWtNd0xqYzBORGt5TXlBd0xqVTFNVFVnTUM0M016TXpPRE1nTUM0MU5qTXdNemdnTUM0M01UZzNNelVnTUM0MU5qWXdNVE5NTUM0M01UZzNNamNnTUM0MU9Ea3lNRE5ETUM0M01UZzNNamNnTUM0MU9UTXpNelFnTUM0M01UVXpOemdnTUM0MU9UWTJPRFFnTUM0M01URXlORFlnTUM0MU9UWTJPRFJETUM0M01EYzBOaklnTUM0MU9UWTJPRFFnTUM0M01EUXpNeUF3TGpVNU16ZzNJREF1TnpBek9ETTRJREF1TlRrd01qRTRUREF1TnpBek56Y2dNQzQxT0RreU1ETldNQzQxTmpZM05UTklNQzQyT0RZek1EWk1NQzQyT0RZek1UUWdNQzQxT0RreU1ETkRNQzQyT0RZek1UUWdNQzQxT1RJNU9URWdNQzQyT0RNMU1ESWdNQzQxT1RZeE1Ua2dNQzQyTnprNE5USWdNQzQxT1RZMk1UVk1NQzQyTnpnNE16TWdNQzQxT1RZMk9EUkRNQzQyTnpVd05Ea2dNQzQxT1RZMk9EUWdNQzQyTnpFNU1UY2dNQzQxT1RNNE55QXdMalkzTVRReU5TQXdMalU1TURJeE9Fd3dMalkzTVRNMU5pQXdMalU0T1RJd00wd3dMalkzTVRNME5TQXdMalUyTmpjMU0wZ3dMalkxTXpsV01DNDFPRGt5TURORE1DNDJOVE01SURBdU5Ua3lPVGt4SURBdU5qVXhNRGc1SURBdU5UazJNVEU1SURBdU5qUTNORE00SURBdU5UazJOakUxVERBdU5qUTJOREl6SURBdU5UazJOamcwUXpBdU5qUXlOak0xSURBdU5UazJOamcwSURBdU5qTTVOVEF6SURBdU5Ua3pPRGNnTUM0Mk16a3dNVEVnTUM0MU9UQXlNVGhNTUM0Mk16ZzVORE1nTUM0MU9Ea3lNRE5NTUM0Mk16ZzVORGNnTUM0MU5qWXdNVGRETUM0Mk1qUXlPU0F3TGpVMk16QTBOQ0F3TGpZeE1qYzBNeUF3TGpVMU1UUTVPQ0F3TGpZd09UYzJPQ0F3TGpVek5qZzBNa3d3TGpVNE5qVTRNaUF3TGpVek5qZzBORU13TGpVNE1qUTFNU0F3TGpVek5qZzBOQ0F3TGpVM09URXdNaUF3TGpVek16UTVOU0F3TGpVM09URXdNaUF3TGpVeU9UTTJORU13TGpVM09URXdNaUF3TGpVeU5UVTNPQ0F3TGpVNE1Ua3hOeUF3TGpVeU1qUTBPQ0F3TGpVNE5UVTJOeUF3TGpVeU1UazFNa3d3TGpVNE5qVTRNaUF3TGpVeU1UZzRNMHd3TGpZd09UQXlJREF1TlRJeE9EY3pWakF1TlRBME5ERTVUREF1TlRnMk5UZ3lJREF1TlRBME5ETXhRekF1TlRneU56azBJREF1TlRBME5ETXhJREF1TlRjNU5qWTJJREF1TlRBeE5qRTJJREF1TlRjNU1UY2dNQzQwT1RjNU5qVk1NQzQxTnpreE1ESWdNQzQwT1RZNU5VTXdMalUzT1RFd01pQXdMalE1TXpFMk5DQXdMalU0TVRreE55QXdMalE1TURBek5DQXdMalU0TlRVMk55QXdMalE0T1RVek9Fd3dMalU0TmpVNE1pQXdMalE0T1RRM1REQXVOakE1TURJZ01DNDBPRGswTmxZd0xqUTNNakF3T0V3d0xqVTROalU0TWlBd0xqUTNNakF4TjBNd0xqVTRNamM1TkNBd0xqUTNNakF4TnlBd0xqVTNPVFkyTmlBd0xqUTJPVEl3TWlBd0xqVTNPVEUzSURBdU5EWTFOVFV4VERBdU5UYzVNVEF5SURBdU5EWTBOVE0zUXpBdU5UYzVNVEF5SURBdU5EWXdOelV4SURBdU5UZ3hPVEUzSURBdU5EVTNOakl4SURBdU5UZzFOVFkzSURBdU5EVTNNVEkxVERBdU5UZzJOVGd5SURBdU5EVTNNRFUyVERBdU5qQTVOemN5SURBdU5EVTNNRFEzUXpBdU5qRXlOelV4SURBdU5EUXlNemsySURBdU5qSTBNamswSURBdU5ETXdPRFUzSURBdU5qTTRPVFEzSURBdU5ESTNPRGd6VERBdU5qTTRPVFF6SURBdU5EQTBOamszUXpBdU5qTTRPVFF6SURBdU5EQXdOVFkySURBdU5qUXlNamt5SURBdU16azNNakUzSURBdU5qUTJOREl6SURBdU16azNNakUzUXpBdU5qVXdNakE0SURBdU16azNNakUzSURBdU5qVXpNek01SURBdU5EQXdNRE1nTUM0Mk5UTTRNekVnTUM0ME1ETTJPRE5NTUM0Mk5UTTVJREF1TkRBME5qazNWakF1TkRJM01USTJTREF1TmpjeE16UTFUREF1TmpjeE16VTJJREF1TkRBME5qazNRekF1TmpjeE16VTJJREF1TkRBd09UQTVJREF1TmpjME1UWTRJREF1TXprM056YzVJREF1TmpjM09ERTRJREF1TXprM01qZzFUREF1TmpjNE9ETXpJREF1TXprM01qRTNRekF1TmpneU5qSXhJREF1TXprM01qRTNJREF1TmpnMU56VXpJREF1TkRBd01ETWdNQzQyT0RZeU5EVWdNQzQwTURNMk9ETk1NQzQyT0RZek1UUWdNQzQwTURRMk9UZE1NQzQyT0RZek1EWWdNQzQwTWpjeE1qWklNQzQzTURNM04xWXdMalF3TkRZNU4wTXdMamN3TXpjM0lEQXVOREF4TWpVMUlEQXVOekEyTURreklEQXVNems0TXpVMUlEQXVOekE1TWpVNUlEQXVNemszTkRnMFREQXVOekV3TWpNeUlEQXVNemszTWpnMVREQXVOekV4TWpRMklEQXVNemszTWpFM1drMHdMalkwTnpRNElEQXVORFEwTWpJelF6QXVOak0xTlRVeElEQXVORFEwTWpJeklEQXVOakkxT0RneElEQXVORFV6T0RrMElEQXVOakkxT0RneElEQXVORFkxT0RJMFZqQXVOVEk0TWpJelF6QXVOakkxT0RneElEQXVOVFF3TVRVMElEQXVOak0xTlRVeElEQXVOVFE1T0RJMElEQXVOalEzTkRnZ01DNDFORGs0TWpSSU1DNDNNRGs0T0RGRE1DNDNNakU0TURrZ01DNDFORGs0TWpRZ01DNDNNekUwT0NBd0xqVTBNREUxTkNBd0xqY3pNVFE0SURBdU5USTRNakl6VmpBdU5EWTFPREkwUXpBdU56TXhORGdnTUM0ME5UTTRPVFFnTUM0M01qRTRNRGtnTUM0ME5EUXlNak1nTUM0M01EazRPREVnTUM0ME5EUXlNak5JTUM0Mk5EYzBPRnBOTUM0Mk56ZzNNeUF3TGpRMk9ESTNNVU13TGpZNU5EWXpNeUF3TGpRMk9ESTNNU0F3TGpjd056VXlOeUF3TGpRNE1URTJOU0F3TGpjd056VXlOeUF3TGpRNU56QTNRekF1TnpBM05USTNJREF1TlRFeU9UYzJJREF1TmprME5qTXpJREF1TlRJMU9EY3hJREF1TmpjNE56TWdNQzQxTWpVNE56RkRNQzQyTmpJNE1qTWdNQzQxTWpVNE56RWdNQzQyTkRrNU1qa2dNQzQxTVRJNU56WWdNQzQyTkRrNU1qa2dNQzQwT1Rjd04wTXdMalkwT1RreU9TQXdMalE0TVRFMk5TQXdMalkyTWpneU15QXdMalEyT0RJM01TQXdMalkzT0RjeklEQXVORFk0TWpjeFdrMHdMalkzT0RjeklEQXVORGd5TmpkRE1DNDJOekEzTnpZZ01DNDBPREkyTnlBd0xqWTJORE16SURBdU5EZzVNVEU1SURBdU5qWTBNek1nTUM0ME9UY3dOME13TGpZMk5ETXpJREF1TlRBMU1ESTBJREF1Tmpjd056YzJJREF1TlRFeE5EY3hJREF1TmpjNE56TWdNQzQxTVRFME56RkRNQzQyT0RZMk9DQXdMalV4TVRRM01TQXdMalk1TXpFeU55QXdMalV3TlRBeU5DQXdMalk1TXpFeU55QXdMalE1TnpBM1F6QXVOamt6TVRJM0lEQXVORGc1TVRFNUlEQXVOamcyTmpnZ01DNDBPREkyTnlBd0xqWTNPRGN6SURBdU5EZ3lOamRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpFMk5qazVNaUF3TGpJek16RTNNVU13TGpFMk5qazVNaUF3TGpJeU5UZzRNU0F3TGpFM01qa3dNaUF3TGpJeE9UazNNU0F3TGpFNE1ERTVNaUF3TGpJeE9UazNNVWd3TGpJd016WTFPVU13TGpJeU16a3dPU0F3TGpJeE9UazNNU0F3TGpJME1ETXlOaUF3TGpJek5qTTROeUF3TGpJME1ETXlOaUF3TGpJMU5qWXpOMVl3TGpNeE16Z3pOMGd3TGpneE9UWTFPVU13TGpnek9Ua3dPU0F3TGpNeE16Z3pOeUF3TGpnMU5qTXlOaUF3TGpNek1ESTFOQ0F3TGpnMU5qTXlOaUF3TGpNMU1EVXdORll3TGpZME16Z3pOME13TGpnMU5qTXlOaUF3TGpZMk5EQTRPQ0F3TGpnek9Ua3dPU0F3TGpZNE1EVXdOQ0F3TGpneE9UWTFPU0F3TGpZNE1EVXdORWd3TGpJME1ETXlObFl3TGpjMk1URTNNVU13TGpJME1ETXlOaUF3TGpjMk9EUTJNU0F3TGpJek5EUXhOaUF3TGpjM05ETTNNU0F3TGpJeU56RXlOaUF3TGpjM05ETTNNVU13TGpJeE9UZ3pOU0F3TGpjM05ETTNNU0F3TGpJeE16a3lOaUF3TGpjMk9EUTJNU0F3TGpJeE16a3lOaUF3TGpjMk1URTNNVll3TGpJMU5qWXpOME13TGpJeE16a3lOaUF3TGpJMU1EazJOeUF3TGpJd09UTXlPU0F3TGpJME5qTTNNU0F3TGpJd016WTFPU0F3TGpJME5qTTNNVWd3TGpFNE1ERTVNa013TGpFM01qa3dNaUF3TGpJME5qTTNNU0F3TGpFMk5qazVNaUF3TGpJME1EUTJNU0F3TGpFMk5qazVNaUF3TGpJek16RTNNVnBOTUM0eU5EQXpNallnTUM0Mk5UUXhNRFJJTUM0NE1UazJOVGxETUM0NE1qVXpNamtnTUM0Mk5UUXhNRFFnTUM0NE1qazVNallnTUM0Mk5EazFNRGNnTUM0NE1qazVNallnTUM0Mk5ETTRNemRXTUM0ek5UQTFNRFJETUM0NE1qazVNallnTUM0ek5EUTRNelFnTUM0NE1qVXpNamtnTUM0ek5EQXlNemNnTUM0NE1UazJOVGtnTUM0ek5EQXlNemRJTUM0eU5EQXpNalpXTUM0Mk5UUXhNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpJNE9EVTROU0F3TGpZMk56SXpOa013TGpJNU16UTBOU0F3TGpZMk56SXpOaUF3TGpJNU56TTROU0F3TGpZM01URTNOaUF3TGpJNU56TTROU0F3TGpZM05qQXpObFl3TGpjeE1USXpOa013TGpJNU56TTROU0F3TGpjeE5qQTVOaUF3TGpNd01UTXlOU0F3TGpjeU1EQXpOaUF3TGpNd05qRTROU0F3TGpjeU1EQXpOa2d3TGpVeU5qRTROVU13TGpVek1UQTBOU0F3TGpjeU1EQXpOaUF3TGpVek5EazROU0F3TGpjeE5qQTVOaUF3TGpVek5EazROU0F3TGpjeE1USXpObFl3TGpZM05qQXpOa013TGpVek5EazROU0F3TGpZM01URTNOaUF3TGpVek9Ea3lOU0F3TGpZMk56SXpOaUF3TGpVME16YzROU0F3TGpZMk56SXpOa013TGpVME9EWTBOU0F3TGpZMk56SXpOaUF3TGpVMU1qVTROU0F3TGpZM01URTNOaUF3TGpVMU1qVTROU0F3TGpZM05qQXpObFl3TGpjeE1USXpOa013TGpVMU1qVTROU0F3TGpjeU5UZ3hOeUF3TGpVME1EYzJOU0F3TGpjek56WXpOaUF3TGpVeU5qRTROU0F3TGpjek56WXpOa2d3TGpNd05qRTROVU13TGpJNU1UWXdOU0F3TGpjek56WXpOaUF3TGpJM09UYzROU0F3TGpjeU5UZ3hOeUF3TGpJM09UYzROU0F3TGpjeE1USXpObFl3TGpZM05qQXpOa013TGpJM09UYzROU0F3TGpZM01URTNOaUF3TGpJNE16Y3lOU0F3TGpZMk56SXpOaUF3TGpJNE9EVTROU0F3TGpZMk56SXpObG9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TmpRNU5ESTFJREF1TmpVNE5EUTNRekF1TmpVME1qZzFJREF1TmpVNE5EUTNJREF1TmpVNE1qSTFJREF1TmpZeU16ZzNJREF1TmpVNE1qSTFJREF1TmpZM01qUTNWakF1TnpFeE1qUTNRekF1TmpVNE1qSTFJREF1TnpFMk1UQTNJREF1TmpZeU1UWTFJREF1TnpJd01EUTNJREF1TmpZM01ESTFJREF1TnpJd01EUTNTREF1TnpneE5ESTFRekF1TnpnMk1qZzFJREF1TnpJd01EUTNJREF1Tnprd01qSTFJREF1TnpFMk1UQTNJREF1Tnprd01qSTFJREF1TnpFeE1qUTNWakF1TmpZM01qUTNRekF1Tnprd01qSTFJREF1TmpZeU16ZzNJREF1TnprME1UWTFJREF1TmpVNE5EUTNJREF1TnprNU1ESTFJREF1TmpVNE5EUTNRekF1T0RBek9EZzFJREF1TmpVNE5EUTNJREF1T0RBM09ESTFJREF1TmpZeU16ZzNJREF1T0RBM09ESTFJREF1TmpZM01qUTNWakF1TnpFeE1qUTNRekF1T0RBM09ESTFJREF1TnpJMU9ESTRJREF1TnprMk1EQTFJREF1TnpNM05qUTNJREF1TnpneE5ESTFJREF1TnpNM05qUTNTREF1TmpZM01ESTFRekF1TmpVeU5EUTFJREF1TnpNM05qUTNJREF1TmpRd05qSTFJREF1TnpJMU9ESTRJREF1TmpRd05qSTFJREF1TnpFeE1qUTNWakF1TmpZM01qUTNRekF1TmpRd05qSTFJREF1TmpZeU16ZzNJREF1TmpRME5UWTFJREF1TmpVNE5EUTNJREF1TmpRNU5ESTFJREF1TmpVNE5EUTNXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGp4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TnpnNE1UWWdNQzQwTVRRNE1URkRNQzR5TnpnNE1UWWdNQzQwTURjMU1qRWdNQzR5T0RRM01qWWdNQzQwTURFMk1URWdNQzR5T1RJd01UWWdNQzQwTURFMk1URklNQzQwTnpNNE9ETkRNQzQwT0RFeE56TWdNQzQwTURFMk1URWdNQzQwT0Rjd09ETWdNQzQwTURjMU1qRWdNQzQwT0Rjd09ETWdNQzQwTVRRNE1URkRNQzQwT0Rjd09ETWdNQzQwTWpJeE1ERWdNQzQwT0RFeE56TWdNQzQwTWpnd01URWdNQzQwTnpNNE9ETWdNQzQwTWpnd01URklNQzR5T1RJd01UWkRNQzR5T0RRM01qWWdNQzQwTWpnd01URWdNQzR5TnpnNE1UWWdNQzQwTWpJeE1ERWdNQzR5TnpnNE1UWWdNQzQwTVRRNE1URmFUVEF1TWpjeU9UUTVJREF1TkRreE1EYzRRekF1TWpjeU9UUTVJREF1TkRnek56ZzRJREF1TWpjNE9EVTVJREF1TkRjM09EYzRJREF1TWpnMk1UUTVJREF1TkRjM09EYzRTREF1TXpjME1UUTVRekF1TXpneE5ETTVJREF1TkRjM09EYzRJREF1TXpnM016UTVJREF1TkRnek56ZzRJREF1TXpnM016UTVJREF1TkRreE1EYzRRekF1TXpnM016UTVJREF1TkRrNE16WTRJREF1TXpneE5ETTVJREF1TlRBME1qYzRJREF1TXpjME1UUTVJREF1TlRBME1qYzRTREF1TWpnMk1UUTVRekF1TWpjNE9EVTVJREF1TlRBME1qYzRJREF1TWpjeU9UUTVJREF1TkRrNE16WTRJREF1TWpjeU9UUTVJREF1TkRreE1EYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGp4amFYSmpiR1VnWTNnOUlqQXVNekEzTmpRMUlpQmplVDBpTUM0Mk1EWTVOakVpSUhJOUlqQXVNREl5SWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BHVnNiR2x3YzJVZ1kzZzlJakF1TXpjM09UVTNJaUJqZVQwaU1DNDJNRFk1TmpFaUlISjRQU0l3TGpBeU1pSWdjbms5SWpBdU1ESXlJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEdOcGNtTnNaU0JqZUQwaU1DNDBORGczTlRnaUlHTjVQU0l3TGpZd05qazJNU0lnY2owaU1DNHdNaklpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TVRZMU5USTNJREF1TlRVelF6QXVNVFkxTlRJM0lEQXVOVFF6TWpnZ01DNHhOek0wTURjZ01DNDFNelUwSURBdU1UZ3pNVEkzSURBdU5UTTFORWd3TGpJek5Ua3lOMVl3TGpVMU0wd3dMakU0TXpFeU55QXdMalUxTTFZd0xqWXpNakpJTUM0eU16VTVNamRXTUM0Mk5EazRTREF1TVRnek1USTNRekF1TVRjek5EQTNJREF1TmpRNU9DQXdMakUyTlRVeU55QXdMalkwTVRreU1TQXdMakUyTlRVeU55QXdMall6TWpKV01DNDFOVE5hSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BDOW5QanhrWldaelBqeGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNakkyTjE4eU16QTBOQ0krUEhKbFkzUWdkMmxrZEdnOUlqQXVPRGdpSUdobGFXZG9kRDBpTUM0NE9DSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRFl3TURVNE5pQXdMakEyTURBMU9EWXBJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD0xOyIgaWQ9IjciPjxteENlbGwgc3R5bGU9ImlyLnJlZj0xNzkxYzNiOC1hNTFjLTQ1YzItODZhZi0xYzQ3OWYzM2JkYzg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR0VORVJJQy1IQVJEV0FSRTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY4NiIgeT0iMzMiIHdpZHRoPSI1MzkiIGhlaWdodD0iMzYzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzOCIgdmFsdWU9IklvVCBBcHBsaWNhdGlvbiAtPiBFbWJlZGRlZCBTdG9yYWdlIiBzdHlsZT0iaXIucmVmPTc2ZDlmZGM4LWI3MzktNDkwMS04MWJjLTUxYzgwZmI0NDEwNjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0wO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjI1O2VudHJ5WT0wLjkzMztlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjciIHNvdXJjZT0iNCIgdGFyZ2V0PSIzNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjE3OCIgeT0iMTYxIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNCIgdmFsdWU9IklvVCBBcHBsaWNhdGlvbiIgc3R5bGU9ImlyLnJlZj05YzRiNmRjMi00ZDRiLTQ4MWYtYmZmNS05NmE2MjQ3ZWRhMWU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9aW90LWFwcGxpY2F0aW9uO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZETUM0Mk9UTXhPVGtnTUM0Mk56VXdOelFnTUM0M01ETXlOek1nTUM0Mk5qVXdNREVnTUM0M01UVTJPVGtnTUM0Mk5qVXdNREZETUM0M01qZ3hNalVnTUM0Mk5qVXdNREVnTUM0M016Z3hPVGtnTUM0Mk56VXdOelFnTUM0M016Z3hPVGtnTUM0Mk9EYzFNREZETUM0M016Z3hPVGtnTUM0Mk9UazVNamNnTUM0M01qZ3hNalVnTUM0M01UQXdNREVnTUM0M01UVTJPVGtnTUM0M01UQXdNREZETUM0M01ETXlOek1nTUM0M01UQXdNREVnTUM0Mk9UTXhPVGtnTUM0Mk9UazVNamNnTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qTXpNVEkxSURBdU5qTTROamMzUXpBdU5qTXpNVEkxSURBdU5qSXdNRE0zSURBdU5qUTRNak0xSURBdU5qQTBPVEkzSURBdU5qWTJPRGMxSURBdU5qQTBPVEkzU0RBdU56WTBNemMxUXpBdU56Z3pNREUxSURBdU5qQTBPVEkzSURBdU56azRNVEkxSURBdU5qSXdNRE0zSURBdU56azRNVEkxSURBdU5qTTROamMzVmpBdU56TTJNVGMzUXpBdU56azRNVEkxSURBdU56VTBPREUySURBdU56Z3pNREUxSURBdU56WTVPVEkzSURBdU56WTBNemMxSURBdU56WTVPVEkzU0RBdU5qWTJPRGMxUXpBdU5qUTRNak0xSURBdU56WTVPVEkzSURBdU5qTXpNVEkxSURBdU56VTBPREUySURBdU5qTXpNVEkxSURBdU56TTJNVGMzVmpBdU5qTTROamMzV2swd0xqYzJNRFk1T1NBd0xqWTROelV3TVVNd0xqYzJNRFk1T1NBd0xqWTJNalkwT0NBd0xqYzBNRFUxTWlBd0xqWTBNalV3TVNBd0xqY3hOVFk1T1NBd0xqWTBNalV3TVVNd0xqWTVNRGcwTmlBd0xqWTBNalV3TVNBd0xqWTNNRFk1T1NBd0xqWTJNalkwT0NBd0xqWTNNRFk1T1NBd0xqWTROelV3TVVNd0xqWTNNRFk1T1NBd0xqY3hNak0xTkNBd0xqWTVNRGcwTmlBd0xqY3pNalV3TVNBd0xqY3hOVFk1T1NBd0xqY3pNalV3TVVNd0xqYzBNRFUxTWlBd0xqY3pNalV3TVNBd0xqYzJNRFk1T1NBd0xqY3hNak0xTkNBd0xqYzJNRFk1T1NBd0xqWTROelV3TVZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDNNVFUyTWpVZ01DNDVNRE13TlRKRE1DNDRNelEzTVRFZ01DNDVNRE13TlRJZ01DNDVNekV5TlNBd0xqZ3dOalV4TXlBd0xqa3pNVEkxSURBdU5qZzNOREkzUXpBdU9UTXhNalVnTUM0MU5qZ3pOQ0F3TGpnek5EY3hNU0F3TGpRM01UZ3dNaUF3TGpjeE5UWXlOU0F3TGpRM01UZ3dNa013TGpVNU5qVXpPU0F3TGpRM01UZ3dNaUF3TGpVZ01DNDFOamd6TkNBd0xqVWdNQzQyT0RjME1qZERNQzQxSURBdU9EQTJOVEV6SURBdU5UazJOVE01SURBdU9UQXpNRFV5SURBdU56RTFOakkxSURBdU9UQXpNRFV5V2swd0xqYzNOVFV5TWlBd0xqVTBOekUxUXpBdU56YzBOemMzSURBdU5UUXhOalU1SURBdU56Y3dNRGNnTUM0MU16YzBNamNnTUM0M05qUXpOelVnTUM0MU16YzBNamRNTUM0M05qSTRORGdnTUM0MU16YzFNamxNTUM0M05qRXpPRFFnTUM0MU16YzRNamxETUM0M05UWTJNak1nTUM0MU16a3hNemdnTUM0M05UTXhNalVnTUM0MU5ETTBPVGtnTUM0M05UTXhNalVnTUM0MU5EZzJOemRXTUM0MU9ESTBNVEpJTUM0M01qWTROa3d3TGpjeU5qZzNOU0F3TGpVME9EWTNOMHd3TGpjeU5qYzNNaUF3TGpVME56RTFRekF1TnpJMk1ESTNJREF1TlRReE5qVTVJREF1TnpJeE16SWdNQzQxTXpjME1qY2dNQzQzTVRVMk1qVWdNQzQxTXpjME1qZE1NQzQzTVRRd09UZ2dNQzQxTXpjMU1qbERNQzQzTURnMk1EY2dNQzQxTXpneU56UWdNQzQzTURRek56VWdNQzQxTkRJNU9ERWdNQzQzTURRek56VWdNQzQxTkRnMk56ZE1NQzQzTURRek5pQXdMalU0TWpReE1rZ3dMalkzT0RFeU5WWXdMalUwT0RZM04wd3dMalkzT0RBeU1pQXdMalUwTnpFMVF6QXVOamMzTWpjM0lEQXVOVFF4TmpVNUlEQXVOamN5TlRjZ01DNDFNemMwTWpjZ01DNDJOalk0TnpVZ01DNDFNemMwTWpkRE1DNDJOakEyTmpJZ01DNDFNemMwTWpjZ01DNDJOVFUyTWpVZ01DNDFOREkwTmpRZ01DNDJOVFUyTWpVZ01DNDFORGcyTnpkTU1DNDJOVFUyTXpJZ01DNDFPRE0xTlRGRE1DNDJNek0xT1RNZ01DNDFPRGd3TWpFZ01DNDJNVFl5TXpJZ01DNDJNRFV6TnpjZ01DNDJNVEUzTlRNZ01DNDJNamMwTVRKTU1DNDFOelk0TnpVZ01DNDJNamMwTWpkTU1DNDFOelV6TkRnZ01DNDJNamMxTWpsRE1DNDFOams0TlRjZ01DNDJNamd5TnpRZ01DNDFOalUyTWpVZ01DNDJNekk1T0RFZ01DNDFOalUyTWpVZ01DNDJNemcyTnpkTU1DNDFOalUzTWpnZ01DNDJOREF5TURORE1DNDFOalkwTnpNZ01DNDJORFUyT1RRZ01DNDFOekV4T0NBd0xqWTBPVGt5TnlBd0xqVTNOamczTlNBd0xqWTBPVGt5TjB3d0xqWXhNRFl5TlNBd0xqWTBPVGt4TWxZd0xqWTNOakUyTWt3d0xqVTNOamczTlNBd0xqWTNOakUzTjB3d0xqVTNOVE0wT0NBd0xqWTNOakkzT1VNd0xqVTJPVGcxTnlBd0xqWTNOekF5TkNBd0xqVTJOVFl5TlNBd0xqWTRNVGN6TVNBd0xqVTJOVFl5TlNBd0xqWTROelF5TjB3d0xqVTJOVGN5T0NBd0xqWTRPRGsxTTBNd0xqVTJOalEzTXlBd0xqWTVORFEwTkNBd0xqVTNNVEU0SURBdU5qazROamMzSURBdU5UYzJPRGMxSURBdU5qazROamMzVERBdU5qRXdOakkxSURBdU5qazROall5VmpBdU56STBPVEV5VERBdU5UYzJPRGMxSURBdU56STBPVEkzVERBdU5UYzFNelE0SURBdU56STFNREk1UXpBdU5UWTVPRFUzSURBdU56STFOemMwSURBdU5UWTFOakkxSURBdU56TXdORGd4SURBdU5UWTFOakkxSURBdU56TTJNVGMzUXpBdU5UWTFOakkxSURBdU56UXlNemtnTUM0MU56QTJOaklnTUM0M05EYzBNamNnTUM0MU56WTROelVnTUM0M05EYzBNamRNTUM0Mk1URTNOU0F3TGpjME56UXlOa013TGpZeE5qSXlOQ0F3TGpjMk9UUTJPU0F3TGpZek16VTRPQ0F3TGpjNE5qZ3pNU0F3TGpZMU5UWXpNaUF3TGpjNU1UTXdNMHd3TGpZMU5UWXlOU0F3TGpneU5qRTNOMHd3TGpZMU5UY3lPQ0F3TGpneU56Y3dNME13TGpZMU5qUTNNeUF3TGpnek16RTVOQ0F3TGpZMk1URTRJREF1T0RNM05ESTNJREF1TmpZMk9EYzFJREF1T0RNM05ESTNUREF1TmpZNE5EQXlJREF1T0RNM016STBRekF1Tmpjek9Ea3pJREF1T0RNMk5UYzVJREF1TmpjNE1USTFJREF1T0RNeE9EY3lJREF1TmpjNE1USTFJREF1T0RJMk1UYzNWakF1TnpreU5ERXlTREF1TnpBME16Wk1NQzQzTURRek56VWdNQzQ0TWpZeE56ZE1NQzQzTURRME56Z2dNQzQ0TWpjM01ETkRNQzQzTURVeU1qTWdNQzQ0TXpNeE9UUWdNQzQzTURrNU15QXdMamd6TnpReU55QXdMamN4TlRZeU5TQXdMamd6TnpReU4wd3dMamN4TnpFMU1pQXdMamd6TnpNeU5FTXdMamN5TWpZME15QXdMamd6TmpVM09TQXdMamN5TmpnM05TQXdMamd6TVRnM01pQXdMamN5TmpnM05TQXdMamd5TmpFM04wd3dMamN5TmpnMklEQXVOemt5TkRFeVNEQXVOelV6TVRJMVZqQXVPREkyTVRjM1REQXVOelV6TWpJNElEQXVPREkzTnpBelF6QXVOelV6T1RjeklEQXVPRE16TVRrMElEQXVOelU0TmpnZ01DNDRNemMwTWpjZ01DNDNOalF6TnpVZ01DNDRNemMwTWpkRE1DNDNOekExT0RnZ01DNDRNemMwTWpjZ01DNDNOelUyTWpVZ01DNDRNekl6T1NBd0xqYzNOVFl5TlNBd0xqZ3lOakUzTjB3d0xqYzNOVFl6TXlBd0xqYzVNVE5ETUM0M09UYzJOalVnTUM0M09EWTRNalFnTUM0NE1UVXdNaUF3TGpjMk9UUTNNU0F3TGpneE9UUTVOeUF3TGpjME56UXpPVXd3TGpnMU5ETTNOU0F3TGpjME56UXlOMHd3TGpnMU5Ua3dNaUF3TGpjME56TXlORU13TGpnMk1UTTVNeUF3TGpjME5qVTNPU0F3TGpnMk5UWXlOU0F3TGpjME1UZzNNaUF3TGpnMk5UWXlOU0F3TGpjek5qRTNOMHd3TGpnMk5UVXlNaUF3TGpjek5EWTFRekF1T0RZME56YzNJREF1TnpJNU1UVTVJREF1T0RZd01EY2dNQzQzTWpRNU1qY2dNQzQ0TlRRek56VWdNQzQzTWpRNU1qZElNQzQ0TWpBMk1qVldNQzQyT1RnMk56ZElNQzQ0TlRRek56Vk1NQzQ0TlRVNU1ESWdNQzQyT1RnMU56UkRNQzQ0TmpFek9UTWdNQzQyT1RjNE1qa2dNQzQ0TmpVMk1qVWdNQzQyT1RNeE1qSWdNQzQ0TmpVMk1qVWdNQzQyT0RjME1qZE1NQzQ0TmpVMU1qSWdNQzQyT0RVNVF6QXVPRFkwTnpjM0lEQXVOamd3TkRBNUlEQXVPRFl3TURjZ01DNDJOell4TnpjZ01DNDROVFF6TnpVZ01DNDJOell4TnpkSU1DNDRNakEyTWpWV01DNDJORGs1TWpkSU1DNDROVFF6TnpWTU1DNDROVFU1TURJZ01DNDJORGs0TWpSRE1DNDROakV6T1RNZ01DNDJORGt3TnprZ01DNDROalUyTWpVZ01DNDJORFF6TnpJZ01DNDROalUyTWpVZ01DNDJNemcyTnpkRE1DNDROalUyTWpVZ01DNDJNekkwTmpRZ01DNDROakExT0RnZ01DNDJNamMwTWpjZ01DNDROVFF6TnpVZ01DNDJNamMwTWpkTU1DNDRNVGsxSURBdU5qSTNORE5ETUM0NE1UVXdNamdnTUM0Mk1EVXpPVEVnTUM0M09UYzJOeUF3TGpVNE9EQXpJREF1TnpjMU5qTXpJREF1TlRnek5UVTBUREF1TnpjMU5qSTFJREF1TlRRNE5qYzNUREF1TnpjMU5USXlJREF1TlRRM01UVmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNVEEyT1RNZ01DNDBOVEkzT1RaRE1DNDNPVFF5T0RjZ01DNDBNakl6TkRFZ01DNDNOek0wTWpVZ01DNHpPVE0zT1RJZ01DNDNORGsxTXpJZ01DNHpOams0T1RoRE1DNDJNVEkyTkRjZ01DNHlNek13TVRRZ01DNHpPVEEzTVRRZ01DNHlNek13TVRRZ01DNHlOVE00TWprZ01DNHpOams0T1RoRE1DNHlNamN5T0RnZ01DNHpPVFkwTXprZ01DNHlNRFUyTWpnZ01DNDBNalkwTWlBd0xqRTRPRGs0TXlBd0xqUTFPVE15TjBNd0xqRTNPREl6TXlBd0xqUTRNRFU0SURBdU1UZzJOelEzSURBdU5UQTJOVEkwSURBdU1qQTRJREF1TlRFM01qYzBRekF1TWpJNU1qVXpJREF1TlRJNE1ESTBJREF1TWpVMU1UazNJREF1TlRFNU5UQTVJREF1TWpZMU9UUTNJREF1TkRrNE1qVTJRekF1TWpjNE5EZzBJREF1TkRjek5EY3hJREF1TWprME56WXhJREF1TkRVd09UUXlJREF1TXpFME9ERTJJREF1TkRNd09EZzJRekF1TkRFNE1ERTVJREF1TXpJM05qZ3pJREF1TlRnMU16UXlJREF1TXpJM05qZ3pJREF1TmpnNE5UUTFJREF1TkRNd09EZzJRekF1Tmprd01ERTVJREF1TkRNeU16WWdNQzQyT1RFME9DQXdMalF6TXpnMk1pQXdMalk1TWpreU9DQXdMalF6TlRNNE9VTXdMamN3TURRek5pQXdMalF6TkRjeE9TQXdMamN3T0RBMElEQXVORE0wTXpjMklEQXVOekUxTnpJeklEQXVORE0wTXpjMlF6QXVOelE1TXpBNUlEQXVORE0wTXpjMklEQXVOemd4TXpZM0lEQXVORFF3T1RFNElEQXVPREV3TmpreklEQXVORFV5TnprMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzNNamswSURBdU5qQXlNekF5UXpBdU5EWTNOemdnTUM0Mk1qZzVNalVnTUM0ME5qSTFPVGdnTUM0Mk5UYzJNRGdnTUM0ME5qSTFPVGdnTUM0Mk9EYzFNREpETUM0ME5qSTFPVGdnTUM0Mk9UYzBNak1nTUM0ME5qTXhOamtnTUM0M01EY3lNVEVnTUM0ME5qUXlOemtnTUM0M01UWTRNelZETUM0ME5qQTNOalFnTUM0M01UUTBPVFVnTUM0ME5UYzBNamNnTUM0M01URTNOelFnTUM0ME5UUXpNallnTUM0M01EZzJOek5ETUM0ME1qa3dORFlnTUM0Mk9ETXpPVFFnTUM0ME1qa3dORFlnTUM0Mk5ESTBNRGdnTUM0ME5UUXpNallnTUM0Mk1UY3hNamxETUM0ME5qRXdOalFnTUM0Mk1UQXpPU0F3TGpRMk9Ea3hPU0F3TGpZd05UUTBPQ0F3TGpRM056STVOQ0F3TGpZd01qTXdNbG9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TmprNElEQXVORFU0T0RaRE1DNDFOelUxTkRZZ01DNDBOek00TXpZZ01DNDFORGMyT0RjZ01DNDBPVFV4TURRZ01DNDFNalV3TXpJZ01DNDFNakV3TXpWRE1DNDBPREl3TVRZZ01DNDFNVE0zTkRJZ01DNDBNell5TXpjZ01DNDFNalkyT1RZZ01DNDBNRE13TXpjZ01DNDFOVGs0T1RaRE1DNHpPVEV3TXpjZ01DNDFOekU0T1RVZ01DNHpPREV5TkRZZ01DNDFPRFkxT0RRZ01DNHpOelF3TkRrZ01DNDJNRE13TTBNd0xqTTJORFV3TWlBd0xqWXlORGcxSURBdU16TTVNRGMwSURBdU5qTTBOems1SURBdU16RTNNalUwSURBdU5qSTFNalV4UXpBdU1qazFORE0xSURBdU5qRTFOekEwSURBdU1qZzFORGcySURBdU5Ua3dNamMySURBdU1qazFNRE16SURBdU5UWTRORFUyUXpBdU16QTJORElnTUM0MU5ESTBNelFnTUM0ek1qSXlNRGdnTUM0MU1UZzNOU0F3TGpNME1qQTFJREF1TkRrNE9UQTRRekF1TkRFek56Y2dNQzQwTWpjeE9EY2dNQzQxTWpFM05UZ2dNQzQwTVRNNE16Z2dNQzQyTURZNU9DQXdMalExT0RnMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9USXpOekVnTUM0ek16ZzVNekpETUM0NU1EVTNNeUF3TGpNeE1qZzRNU0F3TGpnNE5UQTNPQ0F3TGpJNE56ZzVNU0F3TGpnMk16RTNNU0F3TGpJMk5UazRORU13TGpZMk1qUTVOeUF3TGpBMk5UTXhJREF1TXpNM01UUWdNQzR3TmpVek1TQXdMakV6TmpRMk5pQXdMakkyTlRrNE5FTXdMakV4TlRNM055QXdMakk0TnpBM015QXdMakE1TlRBd01EZ2dNQzR6TVRFNU9Ea2dNQzR3TnpZMU5ETXhJREF1TXpNNE5UazFRekF1TURZeU9UWTNNeUF3TGpNMU9ERTJOQ0F3TGpBMk56Z3lOVGdnTUM0ek9EVXdNek1nTUM0d09EY3pPVFE1SURBdU16azROakE1UXpBdU1UQTJPVFkwSURBdU5ERXlNVGcxSURBdU1UTXpPRE16SURBdU5EQTNNekkySURBdU1UUTNOREE1SURBdU16ZzNOelUzUXpBdU1UWXpNRGd5SURBdU16WTFNVFkwSURBdU1UZ3dNak01SURBdU16UTBNVGcySURBdU1UazNORFV6SURBdU16STJPVGN5UXpBdU16WTBORFExSURBdU1UVTVPVGdnTUM0Mk16VXhPVElnTUM0eE5UazVPQ0F3TGpnd01qRTRNeUF3TGpNeU5qazNNa013TGpneU1ETXhOU0F3TGpNME5URXdOQ0F3TGpnek56WTBOU0F3TGpNMk5qQTNNaUF3TGpnMU1qY3lOaUF3TGpNNE56a3lNME13TGpnMk5qSTFOQ0F3TGpRd056VXlOU0F3TGpnNU16RXhNaUF3TGpReE1qUTBPQ0F3TGpreE1qY3hNeUF3TGpNNU9Ea3hPVU13TGprek1qTXhOU0F3TGpNNE5UTTVNU0F3TGprek56SXpPQ0F3TGpNMU9EVXpNeUF3TGpreU16Y3hJREF1TXpNNE9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprek56VWlJR2hsYVdkb2REMGlNQzQ1TXpjMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNekV5TlNBd0xqQXpNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxODQiIHk9IjIxOCIgd2lkdGg9IjEwNSIgaGVpZ2h0PSIxMDEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgiIHZhbHVlPSJCbHVldG9vdGggcG9ydCIgc3R5bGU9ImlyLnJlZj1jNzdlYmQ3Ni1jNmM1LTRlZmMtOGNlNy0xMjk0MGI4YTIwZjk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQkxVRVRPT1RILVBPUlQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCMmFXVjNRbTk0UFNJd0lEQWdNU0F4SWlCbWFXeHNQU0p1YjI1bElpQjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaVBqeHpkSGxzWlQ0Z0lDQWdMbWxqYjI0dFptbHNiQ0I3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095QWdJQ0I5UEM5emRIbHNaVDQ4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQmZNakkyTjE4eU1qWTRNU2tpUGp4d1lYUm9JR1E5SWswd0xqRTNORE14TmlBd0xqSXhNamcyTmtNd0xqRTNORE14TmlBd0xqRTVNVGN4TVNBd0xqRTVNVFEyTnlBd0xqRTNORFUyTVNBd0xqSXhNall5TWlBd0xqRTNORFUyTVVnd0xqYzROekl4TVVNd0xqZ3dPRE0yTmlBd0xqRTNORFUyTVNBd0xqZ3lOVFV4TmlBd0xqRTVNVGN4TVNBd0xqZ3lOVFV4TmlBd0xqSXhNamcyTmxZd0xqYzROelExTlVNd0xqZ3lOVFV4TmlBd0xqZ3dPRFl4SURBdU9EQTRNelkySURBdU9ESTFOellnTUM0M09EY3lNVEVnTUM0NE1qVTNOa2d3TGpJeE1qWXlNa013TGpFNU1UUTJOeUF3TGpneU5UYzJJREF1TVRjME16RTJJREF1T0RBNE5qRWdNQzR4TnpRek1UWWdNQzQzT0RjME5UVldNQzR5TVRJNE5qWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEhCaGRHZ2daRDBpVFRBdU1UZ3pNVEExSURBdU1qSXdOakpETUM0eE9ETXhNRFVnTUM0eU1EQXdNellnTUM0eE9UazNPVElnTUM0eE9ETXpOU0F3TGpJeU1ETTNOaUF3TGpFNE16TTFTREF1TnpjNU5ETTFRekF1T0RBd01ERTVJREF1TVRnek16VWdNQzQ0TVRZM01EVWdNQzR5TURBd016WWdNQzQ0TVRZM01EVWdNQzR5TWpBMk1sWXdMamMzT1RZM09VTXdMamd4Tmpjd05TQXdMamd3TURJMk15QXdMamd3TURBeE9TQXdMamd4TmprMUlEQXVOemM1TkRNMUlEQXVPREUyT1RWSU1DNHlNakF6TnpaRE1DNHhPVGszT1RJZ01DNDRNVFk1TlNBd0xqRTRNekV3TlNBd0xqZ3dNREkyTXlBd0xqRTRNekV3TlNBd0xqYzNPVFkzT1ZZd0xqSXlNRFl5V2lJZ1ptbHNiRDBpZDJocGRHVWlJR1pwYkd3dGIzQmhZMmwwZVQwaU1DNDRJaTgrUEhCaGRHZ2daRDBpVFRBdU5EYzBOelk1SURBdU1qa3hNVGMzUXpBdU5EZ3hNRGdnTUM0eU9EZ3lOelVnTUM0ME9EZzFNRE1nTUM0eU9Ea3pNVFFnTUM0ME9UTTNOellnTUM0eU9UTTRNelpNTUM0Mk1UZ3lOeUF3TGpRd01EWXdOVU13TGpZeU1qSTBNeUF3TGpRd05EQXhNaUF3TGpZeU5EVXhOQ0F3TGpRd09EazVPQ0F3TGpZeU5EUTNOaUF3TGpReE5ESXpNa013TGpZeU5EUXpPU0F3TGpReE9UUTJOeUF3TGpZeU1qQTVOeUF3TGpReU5EUXhPU0F3TGpZeE9EQTNOU0F3TGpReU56YzJPVXd3TGpVeU56YzROQ0F3TGpVd01qazROMHd3TGpZeE9EQTNPQ0F3TGpVM09ESXpNVU13TGpZeU1qQTVPU0F3TGpVNE1UVTRNaUF3TGpZeU5EUTBJREF1TlRnMk5UTTFJREF1TmpJME5EYzJJREF1TlRreE56ZERNQzQyTWpRMU1UTWdNQzQxT1Rjd01EVWdNQzQyTWpJeU5ERWdNQzQyTURFNU9TQXdMall4T0RJMk5pQXdMall3TlRNNU4wd3dMalE1TXpjM01pQXdMamN4TWpFd05rTXdMalE0T0RRNU9TQXdMamN4TmpZeU5pQXdMalE0TVRBM055QXdMamN4TnpZMk15QXdMalEzTkRjMk5pQXdMamN4TkRjMk1VTXdMalEyT0RRMU5pQXdMamN4TVRnMU9TQXdMalEyTkRReE15QXdMamN3TlRVME9DQXdMalEyTkRReE15QXdMalk1T0RZd00xWXdMalUxTlRjM09Fd3dMalF3TkRZMU55QXdMall3TlRVMU9FTXdMak01TnpFeElEQXVOakV4T0RRMUlEQXVNemcxT0RrMklEQXVOakV3T0RJMElEQXVNemM1TmpBNUlEQXVOakF6TWpjM1F6QXVNemN6TXpJeUlEQXVOVGsxTnpNZ01DNHpOelF6TkRRZ01DNDFPRFExTVRZZ01DNHpPREU0T1NBd0xqVTNPREl5T1V3d0xqUTJORFF4TXlBd0xqVXdPVFE0TTFZd0xqUTVOalEzT1V3d0xqTTRNVGc0T0NBd0xqUXlOemN3T0VNd0xqTTNORE0wTWlBd0xqUXlNVFF5SURBdU16Y3pNekl6SURBdU5ERXdNakExSURBdU16YzVOakV4SURBdU5EQXlOalpETUM0ek9EVTRPVGtnTUM0ek9UVXhNVFFnTUM0ek9UY3hNVE1nTUM0ek9UUXdPVFFnTUM0ME1EUTJOVGtnTUM0ME1EQXpPREpNTUM0ME5qUTBNVE1nTUM0ME5UQXhOemRXTUM0ek1EY3pNelpETUM0ME5qUTBNVE1nTUM0ek1EQXpPRGtnTUM0ME5qZzBOVGNnTUM0eU9UUXdOemtnTUM0ME56UTNOamtnTUM0eU9URXhOemRhVFRBdU5UQXdNREF6SURBdU5EYzVPRE0xVERBdU5UYzVNVFF6SURBdU5ERXpPVEEzVERBdU5EazVPVGd6SURBdU16UTJNREU0VmpBdU5EYzVPREU1VERBdU5UQXdNREF6SURBdU5EYzVPRE0xV2swd0xqUTVPVGs1T1NBd0xqVXlOakV6TTB3d0xqUTVPVGs0TXlBd0xqVXlOakUwTjFZd0xqWTFPVGt6TlV3d0xqVTNPVEUwTVNBd0xqVTVNakE0TlV3d0xqUTVPVGs1T1NBd0xqVXlOakV6TTFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NDhMMmMrUEdSbFpuTStQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNRjh5TWpZM1h6SXlOamd4SWo0OGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0NJZ2FHVnBaMmgwUFNJd0xqZzRJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpBd05UZzJJREF1TURZd01EVTROaWtpTHo0OEwyTnNhWEJRWVhSb1Bqd3ZaR1ZtY3o0OEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNSIgeT0iMjA5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM5IiB2YWx1ZT0iRW1iZWRkZWQgU3RvcmFnZSAtPiBJb1QgQXBwbGljYXRpb24iIHN0eWxlPSJpci5yZWY9ODM1YTM2ODUtMTRmZS00MGU5LTk5MjQtNmI2YmRiNzM0NjBiO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjc1O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNzU7ZW50cnlZPTA7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNyIgc291cmNlPSIzNCIgdGFyZ2V0PSI0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzA3IiB5PSIxNTEiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI0MCIgdmFsdWU9IkVtYmVkZGVkIFN0b3JhZ2UgLT4gT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9MGRiYjY4MmEtMDY4MC00OTg3LWI3NGEtNmViMjA2Yzc0MmVjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNyIgc291cmNlPSIzNCIgdGFyZ2V0PSIzNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjM0NSIgeT0iMzgiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNCIgdmFsdWU9IkVtYmVkZGVkIFN0b3JhZ2UiIHN0eWxlPSJpci5yZWY9NTI1ODU5ODYtZTEwYS00YTU5LWJmNTEtOTEwZjc2ZGJkNmU1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0ZGMzMzMztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtYmVkZGVkLXN0b3JhZ2U7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQU1nQUFBRElDQVlBQUFDdFdLNmVBQUJxakVsRVFWUjQydTJkZjl6MmR6bi9yei82WTMvMHh4NlA5dERTTUFxamZRa2hoQWhSR0lycEI4T2lxRXlTcGNuU2FQM0FNQmxLaTFHU2ZsbFpESGRaM0JTTkZpc3JkNnlNTnQzVnlxcFY1L2Z6L0xpZTkrTzFZOGY3YzE3WDNYMXY5MzNkMS9sNGZCN25lWjNYNS96OGVIK08zOGZyT0k2TmpkM1hZWHV0VnFzVHB1MCswM2JHdEoyN3VWMHdiUmR2Ym5zMnR5dW5iVi9aM3JENXY4dGovMmR0SHVPY2FYdll0TjE3Mm83ZlhlbmQxNUhNQk1kTjI2blRkdHEwbmIxSnlIdW5iZi9xdG50ZFAyMVhUTnRGMC9iNGFYdmd0SjB5YlhmWWZVSzdyOXVhSVk3ZlpJWUxwKzJxMVpIOXVubFRPNTAvYmZlZnRqdnVQc0hkMTZGbWlEdHVFdGV6Tm9udGFIN2R2S25kenB1Mis2TDlkcC93N3V0Z21PS2VtMFMwZDVPb2R1cnJwazAvQjUvbTdydFBmdmUxeEJRbmJkcnZWNjZPM1JkK3pDTUpMdXhTeE81TEI1dG8wR1U3WEZNY2pHWjU4YWF2dGV2b0g0T01jYi9OYU5PTnU3eXdwUWdaQVlsNzcxTE96bWFLTzJ4cWl4MXZRbjM4NHgrLzFkOTE2MzZ6aGYzd1YwN2JwYWFkeHhnazZxN1o2VXpoOXJHUGZld0FjZnZkUnovNjBRUGZkMHhROTEvREtGZnVNc3JPOEMvT21yWnJqd1U3YUVUWU1nWHZ5U0F3VEdXUTNLL3VQM2hkdlNsOGR2MlVvNGd4anQ5a2pPdU9OVk9xRW5yZGIvLysvYXZYdk9ZMXExLzZwVjlhUGVFSlQxajkxbS85MXVxYWE2NDV3QXdmL3ZDSFZ6ZmZmUE4yR01RWDJ2bk0zYnpLa2M4Y1o5N0dFSS9ibkJrNnM2Z3lCeStJKzZhYmJscTkrOTN2WHYzcG4vN3A2aG5QZU1icU83L3pPMWVubm5ycTZqTSs0ek5XSjU5ODh1b3VkN25MNml1KzRpdFd2L2lMdjdoNjYxdmZlaXZtU0xOc2k2OXJkMDJ2STVNeDdyV1oxTnZ4NWxNU0xRU3RxZVRyUXgvNjBPcnRiMy83NmxXdmV0WHE2VTkvK3VxTU04NVlmYzNYZk0zcW52ZTg1N3g5d1JkOHdlcmU5NzczNnN1Ly9NdFhYL3pGWDd6NndpLzh3dFhuZi83bnI3N2xXNzVsOVlJWHZHRDFILy94SC9NeDJUN3lrWS9jU29Nc09mcnh1bXczOFhqa21GTVg3dVFjUnZvRk1BUkVLNU1vOGZsdTM3NTlxMWUrOHBXcnB6M3RhYXZ2L3U3dlhuM3BsMzdwekJCZjhpVmZzcnJQZmU0emIxLzVsVjg1YXd3M21NVFBNQXVNZ3BiNXd6Lzh3OVY3My92ZW9UK3pMaUlXdVpSemQ4MnUyNDg1SHJhVC9ZeEttRXIwOUMwKzhJRVByUDd5TC85eVpvcHYvZFp2WFgzTzUzek82ck0vKzdOWFgvUkZYelFUUFV6eDFWLzkxZk5ubU9PcnZ1cXJEakNMLytjZERmTzFYL3UxczJiQi9QcmN6LzNjMVZsbm5iWDZ4My84eDZHSnR3MUd3VCs1L3k3RjNuYU1jY29tSkdMSE8rRHBEL0NDU2Q3M3Z2ZXQvdVZmL21YMW5PYzhaemFmUHUvelBtOTE5N3ZmZlg2LzE3M3VOV3NGVFNnWmduYzJtRVJONHViLytQN0x2dXpMWm9iQzdMcmIzZTQyYTVWZitaVmZXZjNYZi8zWExVeTVVY1JyemV0bHdIbDJLZmp3TXNmWk84bWMyb29KQTJIKzkzLy85K3JLSzYrY2ZZUWYrWkVmT2VCVFlCSWxBMGpvTW9LYnpESGErRCthUk1iaW5iOHh6ejdyc3o1cmRmcnBwNi8rNkkvK2FMNk95cncxdjdMbUJYTGhqRjFLUHZTTWNjS200N2ZqTklRT2NjMUxvQ25lK01ZM3JwNy8vT2ZQVEhHLys5MXYxaEwzdU1jOVp2OGlDUnlwbjFwQ1h3TmlyeG9qdHpTMS9DeURxRTM0SGtZayt2WERQL3pEcTcvKzY3OWUvZS8vL3U4QkJpRW9rQXl5UldhNWVMYzI1ZEF4eDMyT3RtVGZFbkZVdjZLYUp2L3pQLyt6dXV5eXkxYVBmZXhqVi9lOTczMW5jd2ZHd054SjRrN0Nya3dnc2J2UGlFSFNZUjl0NmNqajI4QTQ1NTEzM3VxZDczem4veFdZYkFZS0RDMVhqYmp3b3RqczFGMEtQMFpOcWhHVFNEZ1FGcC9KVlZ4Ly9mV3paUDZwbi9xcDJWbkdmRUppd3hUOFhTWDl5SnhhTXFOR0RMVEVHRENEREtKRzRacE9PZVdVT1N6ODZsZS9lblhqalRjZTBINWQ3bVNOSnRrMXVZNDFrMnFVTTBpQytlQUhQempuRzY2NDRvclZNNS81ekRtMGlvTk5CQXJtd01TQkFkQWdFbXYxR2FxZnNjNlVxdi9maXRiZ1hUTXRUVEIrajZuMy8vN2YvMXM5N25HUG15TnBob1dYb0NvTHpMSnJjdTFrazJxcllWRE1KNkFldi96THY3ejZ3Ui84d1puUXNlOWhDaVF6VWpxMVFwcEpOUXExRmFib2lMOGVmNnZhSkpuRWE0R3BZUkkweTgvOTNNK3QzdmEydHgwd3RkUW0yd2dINzVwY1cyQ08wNDlHazZxR1BaTUlJSkovL2RkL1hmMzJiLy8yNnFFUGZlak1CR3c0MmthUDFCWVNvZ1FvZ2FibVdJcEtaVEt3bWtqSklFbnNIUU9sYzEvMzgvd3doZWZpWG1BVUFnbC84QWQvTUp1TjNudjFTOVpvRWt5dSsrNXlRczhjWisyRTZCUytCWFk1bWUyWHZleGxxOGM4NWpFekFYMzZwMy82YkpaZ1BobDVJbHlibWlDSnI1cFIxYnhhMnRJODZoaWttbDdkVnBteUpoamRQQWNNampiOGxFLzVsRG5hOVEvLzhBOXp0Q3MxeWhZalhBaklCKzF5eEMyWjQxbEhFMUsyKzk0RTNzdGYvdkxWazU3MHBOVURIdkNBMlhRaXUwMzBCMktEaU5pNmtLeEVPV0tBZE16WG1WWkxQa2FlWngyemRlZEpzNnVhWHJ4amR1SEVjNTgvLy9NL3YzckxXOTV5SUNDeHhDRGxPNWprckYzRytMOWlwb3R2NzdxSjBmOUhRTUhVRnU5NHh6dG1wbmppRTUrNCtyWnYrN2FaNlBBbjBCcG1zMlVNTklQdkVtZEdvNVlJVm8yajJkUnBsQ1Q2Tk0rcVpuQS96YVNxVlphMFZXZWFwVk52eEl2d05KRzQwMDQ3YmZWN3YvZDdjNlN1VzlzMTJ1VzhZNWs1N3JnSlA3amRzdGVkVnFqK1JCZVpldi83MzcvYXMyZlA2cWQvK3FkbmdqZWlveFExRXkyeFFZaVp6Sk00M1pKb3Q2TkJrcmtxUVhjWjlYb3N0Vmt5VTJXNHpzd2I1VW5Tck5PVTVIdTA2RU1lOHBEVjNyMTcyN1hPWEVxalhTNDY1Z3F5TmxHNFY5eWVEdlZTZlFVUExLSGtnQVJoQ2pMYnYvQUx2N0Q2bnUvNW5sbENmdVpuZnViTUdCQUVEbXJpb0hTK0srRUxJS3dNSTdHbmhzbmZwSU84eEVUdW4vNkhuLzF0NTRUbjcvTmNIbXRkbEN2dk85LzVQUm9WSHd5b1BjREtmL3UzZnp0Z2RsbWtWWkVFNWZYaVl3WVZ2Sm5qdVBwSXdUOTFKcFloU3N5QzE3Lys5YXZuUGU5NXEwYy8rdEdyci8vNnJ6K0FnY0tNa0RBbGFvaWlFbmhsRUJtbjdpT0JqaGhuWFZaOGxQdElSdkgzRXE3L3E3K1I4TlV1Nnhpa01wdmhhbXRPaEs2SUNuandneCs4ZXVFTFh6aXZMK3NzazZ4eDRLL1k4VXl5YVZiZExwcWp3d3QxZGk4Skw1aUNzQ3dSS094K0hqTE9KdzlaWXRhZnFHWkxaNkowWWRyMFE5TFBxTWVxK1krYVJWK0tkcVg1bElSZkNiNXFrc3pZMTN6TUtPS1YrK2J4WlE0MzlrR1RzRDN5a1k5Y3ZmYTFyNTNEd2hrUzdrTERvVW51c0ZPWkE0ZjgwdHRMYTZqR3Uxd0YvNk1LNzVKTExwbUJnVHhnL0FxMGhjREFsUElWSURnaStFckFTV1RwSUZjZm9OTXVsWkVxZzJTK3BNTnNlUTZJTk0ydXZLYXFhZExmV05KZTVsenFjVWYraVg0YVpiOHd5bE9mK3RRNTJDRnpXUGN5S1BlOWFLY3l5Q1dIMGtSYXltU1BvT1F1dkJnbzZoeW8xMzdLVTU2eSt1WnYvdWE1VUlqSWk1cENMZEZGaWpybVdJcENMVW5oSlFMc3RGQW1HRWNhSklrM3RVVks4eVdDVm9QVTBIQjNyWm1Zck5Hc1BIYitqZUNCU1dBUUlEWkV1NmlJSkZ5ZW1maUI0MzdlVG1PT0N3NEh2bWtyT1l2Y0Y2WUFEdkhuZi83bnEyYzk2MW1yQnozb1FiUHBoRzJNR1pXT2JLY3BPbE9uKzd6T0wraE1ueVM2R3QzcW1DYXZkYXQrU1RLTnZrZVgvRnZLc2xlenFwcDlWVnZVUUVIK2JUa3dmK09iRU8wNjg4d3o1d2doeWRZMVBzbFpPNFU1empwVVdxT0xtUzgxUXZNMzExNTc3YXdwTHJqZ2dobnVvZVNDT1hqQStCa1NaR2ZYYjhXL1NQTm9GS0pOcGx1WHZSNlpXSjJ6dngzbXlGRHhrbWFzSUVrMVFnZUFyREFWdFlVK1J6WHg4djlHdi9qTTg4QzA1WmcwbkNEeG1qNWtob0tuN2VqUHVHL1dqUjhTQjN2VUFLMHIrVFEwKzgvLy9NOXp5U2hOREhnUWdnTFRCOGljUU9ZbVJpV3E3cmZFQkowWlV2TWY2d2g0eVp4TFgySTdrYTFSeUhpZHo1T2g0eTc3WHgzNU5LZHE4VmJWTGgyVG9WblFKbHdMZmlIb1o3RmQyV2xsZXVZM0g3WFlyZFgvTllpKytWQXlTR1dHbENnNDJ1UXEzdld1ZDgyQXVSLzRnUitZRjF1b1J6WXZTRWM1ZlkyYW4xZ24wZXZ2L08xSUs4Z1lGYjYrbEJpczVoM242eUpMNjQ3VitVTDFXcmZMSU5YOHFnNDVRa2xmWTFSbllwUXIvN2EySHJPTEpoS1BldFNqWm13WEpuSVQ1YnJ4cUVNQlR4ZDg0cUhzT0ZMTnA0eEd2ZWM5NzFtOStjMXZYcjNvUlMrYU8zR0FnY0o4d3RsbXNTRW9UQ2dKTXdrNTM2dm1HRW4vVHFyWDMzVEVtNS9YbGNLT3ppR1JJbUdOcmxYRTcxWTB5S2pjdG02amV4cEJUZEsvcWM2NVc5VWczbzlyVXBuSWlDTHZOTCtqd1IxNWt4S3l2K3FvcVNmWkRPZGUvb2tBQWtkMnB5L1VMQzB6NmQ5RUZkNjNmL3Uzend1STVGRWlwWm1Ta2owWm9vTjlMREZJL2UwNllreFRLazJTRGxXN3ptZmhIVUxDaHpyLy9QTlhqM2pFSTI3RktCMzhaS3QrU1pwQ28veklPaXhXUFVZMXQycmtMTFZHMWU1WkY4LzFZUVdnVVFpc1lIYUo3WXJrN3NWSEM0T2N1NDFXbGJkZ2hvUWJkTDZGOWRxZ1piL2hHNzVoamo2eGNCQktSbjkwZ2xOU2o4S3kyOTA2Skd6blNIZkF4SnBRNjQ1YkNkVDlZQVJDb2E5NHhTdm03aUovKzdkL3Uvcis3Ly8rQXhXSUVsUXRzS3FFWFczL3FxRzZxRnFhWDBzWjljb2dGZjNiTVZidXk1YWFwbU5HbmpYMy9QQ0hQM3hlQTJsbnM2SGVHVWU4MzBGMFlic01rblhhQ1RtZ1l3WW1GQ0EzMUt1NUN1RFVPTnVZVG1DZ3FOdE9hY3Yzd0VJNmRHcU4vQndzbzFSSHV6cTliZ2x2OTMvSklGMVFBQ0xnL3RqOEhvSWhzLy9zWno5N2JqNTk0WVVYcnM0NTU1eDVYelJuQ29TdXNLb3lTSWF3YTNoNVZNWXJBOWU4U1dwR2lUczErUWpjMk9HMmxxRDZDQW12eXlaNVFPcEo4bTdtdUk1Y2Z3Uy9ZeUxxNjVaaTExc1o3QUtqWEhmZGRhdlh2ZTUxYy9meEgvcWhINW9KSHZ3VEdpT1RlQmw5U2lMVTc5aXFwa2lDcnViVzBtOUczL0VPMDdMVlkwbklmT1lhVXlvclBYL2lKMzVpOVdkLzltY3pUSnlPaWZiUUJVNlB3d3FqOFA1ZDMvVmRzNi9GLy9DOTBLcHFrNlVpcWRSa0thblgxWUtzTXhjenRGdUx0V29Tc2pydGhwQ1g5czAxNG5zMENVeUNpWTNaaFdZOUl2MFIvSTdwd2k3ZlltUGpOdkZIQmhWTjhkem5QdmRBSHlna294aW85QjhnUEJtZ1lwdVdDTDJHZGtlTXNiUjF0UlJkYVd5Vnlxa0pkRXhCQXNQNFNFYk5oKy80anUrWUh6YkpNcnFHSUNHNVY1aUEvUWxBOEh0K0EzUHdONk1NRUNoLzhSZC9NVE9PU2M5cTduU2gzazRUTERuMW5VbmxQbXFOdW4rTlhOVndyNlpoTmJ0R3lPSGN4M1hrbnFueko5OTEwMDAzWFh4RStoMVZFMlFsV2RkS244K1VwdjdPNy96TzZ2dSs3L3ZtbStabURmTjE0ZFFLRnR5cTFGK0NqWFNtVnBwSWVaNmxzRzluTW5WK0VROFZhWThtSUhPY2NIR2NVQUlQMUpvOCtjbFBYdjNrVC83a2ZDeE1DckJMbi9acG56YTNCUVZxai9Ra3gzUFJSUmZOUlZ0QU5jajdmTk0zZmROOGpzeVhkTDdCQ0k1U3NWZzFHbGROdHNvSUZWWEF2WTNnTmNrOE5TUmNOVWc5WjVwei9KWXVrRVM4ME1BVFhaMXhwRERIdlVqWWRNeGhPQzdqMXRRcFkwTGhiRC8rOFkrZkNZY2JZK05Hay9DelJEVUp0cFBzU3pEelVaUnFLZC9SNVVVNjMyVXBWS3pOcmwva1E4WS9RbFBpWDlFZ21tcEU5a1ZMUU5qM3YvLzlaMGFoSFJESG9jNmIzOEl3ZEEvaGVHZ09pT0Vidi9FYjUvQTJhM24yMldldmZ1ekhmbXcrUGd5bFdjcStWamhtbVd5YVdSM0N0L29jWGJZOTYwRE1qS2RQbHVmc1RLNzZYZlY5UnRmWEFTSHRLL3pKbi96SkNJa2JKeFAxcENQQnRIckRxTCtzbitsQ2ppTkYveVJNQm14bmJ0NTVGWFlZWDJjcXJkdXFRN3dkQnVuMkg5VnVkNXFwU3pKQzdHejZUa3JyNy8zZTc1MmQ3Ti85M2QrZC9Rd0NFREFGNjRHZ29CazFuOUdtYUEwaWRjQmt5QUg4MHovOTB3eXU1RnlhWEJ3WHJZRy9nbWxLRUFQQ0FxNkJIOGQ2cTVXN1pnNmRTYVAycTFHdkxpRllJMjhaRWN2SVd1ZXcxMGhXaDFNYk5hRG9mSk0wWHljVDlHVzNONE04Y2xSOGhBYkJmUHJqUC83ajFjLys3TS9PRFpDdExqTjJyeStSMHIvVEZDT3RVUW0vU3U5Ui9tSTdUbnRYUTk2RmNtdDVLOTloUW1IMi9QcXYvL29zNmZVTkh2akFCODdCQitvaDhMY3dMeUZncXU1NHlEeGdpQnpHZ2xIUUpqQVJFU3hNS0lRTURFRmVBSVpDdzZBeCtBME14YkZZODcvN3U3K2JrNmd3Q1owUTllZEdoTmFGZWRjMWlLaStSV2RDVmFjK2ZZOEtPK25nS0VuOFcybVJxbG0zaWUyNi8rM0ZIQ2RNRExHL05qTEFyTUpoSkpsRjNCNDdtWWNIY1hEeE90bWRXWlJtRll5VFcvb0NYU1JKTXlhMVNDWDBycVBJaUVuY3YydTRZR2JlL0lSVG0yemp3OE9FNkYveWtwZXNycnJxcXJtdEtLV20vSVl3TllTdFk4NjZzRVpvalljOTdHRnp0OFcvK3F1L21zdDZMU3ppbkdnZEhIQ1lpdnB1bUFkL3hGa2dPT3lzTS92ajM4QWdJSmJSSWpBWDE4TTFjajZkV3A1RGh5aXVlSzJ1N3FRU3RwSS9mWjZ1N3FReVNNMndkMmpnRVdOMCs3Q3VIbTlUR0Y4elBiZmJ2aEp4WW95THN3OFU2di9paXkrZUh5QUxnWDNNUTFTYThqQlEvMGFma25CbGdpVGswVGJLZ0V1NGVmenFZRytWUVFRbHBvYXJZRVUySkQxRWh5RGdlek8vUEJ5Y2I1Z0NoeHVUaUp3RlpoVE1nS2JBVG9ZcFdLZVRUanBwWGh0S2UvL21iLzVtTnFQbzZ2NTFYL2QxTStHemozNEU3ekRZWGU5NjF6bThpWVppZjRxT1dHKzd2Nk4xeUxhendWemNpMzRlR3N4anBZOVhnWlpkVSt4OFQ4S3Q5ZXVWMkVmRW5iVXBYZFJyM2UrN3JIOWx1dW43YzI5VDVwaVk0ajZrK25Fd21Wbng0ei8rNDNNYzNwcGpIYVlrN0U0YjZIZU16S21xSFpZNmd4Z2xrckE3YzZzenM1YTBTUFVwc21zSkQ0QjcvdFZmL2RYWmpDRWtpeG1KUkZmcTQyUlRmdzJ4d2h3d0JJNHprU2RoOXhBdGE0Yi9BRUxnM0hQUG5kK0pYa0hJTUFoYWg4Z1Z2NGZCK0EzWFFnTUpaaEZTMy9MaUY3OTR6aTd6ZjVPcFBBK2gvZnlXKy9qTjMvek51VmZWUzEvNjB0bVp0dy93T2t4WCtpWFZuNmhhWXJ0aDI4NThHbW1SSmRPck1vWkJnMGtZM0RUUnhXMHpNM0hQbmoxM3VPU1NTNjRpV2dLQlFCQTJNVEEwVzZWdk1rUktlNUdwUzA3M3V2eUc5citTc0FzSDEvMlgvSkdPZ1Zoa2lNMzZFUjFCdENWYWsrRXlFQnkrQWVlSDRDRlN3NDRnVXRFU0VDMmpBNjYrK3VwNXd3eGk3VEI1V0VlUUFtZ2oxaFhpOWZjZ2s0bDBvVEg0RzZiaEdvaGU4VDBiRVM0WUZET0xFREFiSmhqbjVEZGNFNElNUnNJdnhQemo3elJ6cWovUmxReG5NNGVSczUzSFNLM1V0VEd0djYwMUpWblRYcjgzZ2xieFc3a0YwdUN5MjRSQnBvZDNscUZERmc0eklIc3N1VldOa2M1NE1zaUlLYnBRYjJXeUJQS05jaHhMREpJU3NVYlFaRjRXbUFRVURqSk90L2ZPNHFNRklES2tQYkYzQ0piZlE1aWYrcW1mT2pNRnhBa1RJTm5SQ0J5SHZBOFJMSngzRW9NNDR1d25JY01BYUF6TU1NNkpId01PRGFMbW1pUjZyaCttNFJqQ2NEZ3ZUSWJmd1c4NW51UFpNUHU0Vm9RYlRFV0xVQmhURFlYcHAwL1RNVVpYNDE2alR0VXY2WmhwbE5lb1ROUTU3VmxvVmZGbitiZjdDay9aRERrZjNoSFZrOU56NG5UU0cvVXAwblNxeEY1OWg4Njhxa3cwOGh1Mm0rSHVycUZMTXFaUGthbytaL2JoRUJOMHdNOTYwNXZlTkVlZllCQ2tQc3lDUTR5UXdJU0N1Smc5anZUSGxLR0xPOGVEUWRqd015QktDSmZvRmU5OFp4NElJb1dZT2E0RlF3UTdTQVRDVEhSYTRmY3dWSnBkZk9ZZGh1SmFNUGZJc2RCL0NzYmxtREFWMTRBcEJ6UEJyRndiRE1WNTBIN01TeWZhbFVSbGtpL0R2c2xBQ1ZYSnhGOFNlUWQxMzhyd25sRzcweTRLbGxHMWV2NzQvYldIMVdHZkRuNWVsY1Exd3JUa1lGZEc2ckxXMVZsUHpOVlNrckQrZndtRm0zL0Q2RHJYMnVRUWlGQnl0QUxFK1d1Lzltc3owWlBodGthQjhDcGFBbk1HQW9YWUlGQWNiSUlXK0NiNENSd0hEUUtCWnVLUTd3bkw4aG5peEovRG5FTGFvMFZnQkNKYk9Ob3dCcjI1SUdDUFpWZDFFNEpFYldCZ3RCUkRQZ252a2xqa25Qd0dVdzh0d2ZYQ01MeGJaNEdXb3JNSUNVd3o4WlZCYWlsdWRjYVRFVEpwT0lvNHJkdnFYSkpSK0pmekdERHBjanpsZkdjZUx1WTRmdHIyWjlSalhjU3AweGhML2tZU3VhT0pxeTh4Q3ZFbWc0NllvNE9rUTR5WUtiLy8rNzgvdzZjWmFJTlUxKzlBMGhKeUpVeUt6MEhTVFdmYm5sbWFNUkFyazJjNUJnU1BCaUdTQmVQQlVCQXA1aGVFQ29HaU5UZ09qamxhQ29haUk3d2dSQk9CRUFIWHhEV2pOZmllM3pCckJJSUd4TWgrYWdpdUZYTUtac0Z4NTMrY3krYlNNSWJSTWJRSkVUQ3VsUTJObGMwc09KZk5GU3F4ci9ORHNySEVra08rRG5lMUxzU2JwbFU5Zm5OZGhIMFBmVyt0NlNiUFRYTklQMk5rVW8yMnBTaFVyUkUzeXJYVTM3Ym1ManJtOE5nbTNoSmN4enZFQm5vV2dpTnNTcDJGeEtGVHJKU0cwUGdieURsVG9vZ2dRVkJJYy90bzhYdWtQa1NLaVlZSlJGaVcvem1oRnNiaW1EQVBFQkVZQ2FjZFV3ZUdoRUROcHJQQmdKcDJNQUIxSWVSWEFEVkM0QnhQVTgxOGlDMC9ZVVorUXdpWmFibjRJTjRmYTRCeno3Vmk5c0hnRUJQSHdXVGtlamtXKzJlOVNtZEtkWURHa2JtekJEbXBZZURxMzlRSVdJVzdWSE91WWNvekRyWDJPQTd0b2QvaGhsVFRsaCtaT3ZYN0NoeE1SdXNnNjZsNWx1ckEweS9xVEMwV21KQXIwbGI3RmlJa1lzVEFUQkN4NUN4KzVtZCtaaVltQ1VpaVErcXo4Umt6Q0ljWjZNemxsMTgrSitRNEo4ZER1NWdZaGFoTkFpTE42ZTNMTUIwaVdmd2ZBdVRCWVRiQlNPUXJlT2Y2SUdxTHdUVDNOQ1BRWkRBVjF5eWdrZVBBaURycWFBa2phREFoZmd3SlNMUWs4QlljZSsrUDMzQy9odW01WHRZU1ZESERPb25Rb1dtOGpscG5zcFUyUVVzUWtRd05WL3hWTlp1RTFkZE1mbzFlZGIyRFk5K3JEeldEbkZVZGJVMmc2bENQR0tUNkdUSld4eUFIQXplcFlkN0toQkErZGpZYmlUditCd0ZDMVBnTkVBeDVDOHdiQ0FFQ2c1bUlVaEVWRXFiQk80Uk1GQWlHZ2tEWmg0WG5OeEFiVWh2Q1ZBUGh5T1BEb0tYUU9FU3dPSitaY3ZaVCswQ2sraGpDY25Mai8xdzcwQlZNUXhnSzRzWDA0bjZJck1IZ0VJL2FCek9SNnlSWlNZNkY2K2JldURhWUdZYlFOMkdEU1dBK2NpeG9WWUNsM0c4NnhGMXo3WTQ1dW5tS1ZRTVlnY29BeVNpcm50R3E3ZFM5MThqWElZdG9vVDBtQXI2dVJwMUdZZHRSSktrajVHNW1SdjE5Ri8zcWZCMlJuTTc4RTcycWo0RlBRTU5rOGdEZ21TQlFTM2IxSDh4ZlFOd1FIZ1NOR1lXMmdIbllWeE1OelNQaWx2UGpXL0E5a2gyTkpETnhQVVM0K0o0TjFDM0VCNEZhR2VseERTSGI4Tm1BZ1RCdzN2bWZwaGZ2Tmx6alBKaGFKRzlwZDRTcEJxTnpQeHlmNitXZTJkQlk3RStBZ2M4TTRtU05EQXlZNDBHb3FGbUJ1WEIrODE2Y1U3TnJuWU85Tk9xdGFwQUVPVlp0VUtzVmwwQ1RYZmRJMTNEemYxY2VGdTNSTWNpb0VVTG5xQ2NPcTB2dUxjRklPa2RlUHdWaXhING00Z1NCNmxpeUdFaHdIamhSSUtKUzJPQktYU1FuSm9rMnQwazRwQzFKUUNRL0VoOEp6T0pDSEVoWmJYM2VUenp4eFBsY09QcnZmdmU3WitReTBTT09CeUZEcEZ3bkRJVVRqY2FDc0kxRTJkWEQzRXN5aUxIODNHUSttRWtHaDhDSlhIR3RYRGV3Rlh3THpnRWpjby9jbStCR29tZVluR2dJeTVyUlB1eVBadUdhTU0xWUo3U1ZFVGNZaVBYRFh5TGFKUnA3cXdOQk00U3JWSy81RTdWRUhhblE0YlpHaU9UNmU3OExCdm5FdFFqZS9yUmRNOHBscE1hbzFYU2owdGVSajlEQnhkTjV6eExXWkNwaDVUaTIrQVJVSm1McmsyT3dWbHRKWjJLVGE0SXhXQ3lrSktIWTFDZ3NKS1lXVWhOaVFNSVNiczNzT0dhUXM4eGhBcHhjd3NEbUxIRGlJU0NsTXZ0cjhzQllFTFVtVkQ3TTZwaFdlOXA5WFdQK0Q1RkN5QWdHTnV0RE1LMDArekNqekxOd2oyeUVyRWxhd2t5RXBna1VjSDZ1bWV2VjNPSjZDVEx3RG1QUXZwVXUrUFFmNDVwRUdBaEdYWnA5bUdIYnpJVFhSZzJqS0ZWWGhaaCtTOVUydFY0K0JjKzA3Zm1FR0dSeXdrK3ZDTnNSeW5YMGZRZE83Q0RxbFVrU3JwSkF1cFF5U2x3VzRFZC85RWRuNHFSdWduQWxrU2xOTEFpSWh3dGg2M1JEdEpnaG1DTzBFRUxxY2p5SWc5K0lkb1hJdVFZZFlDSTlFQlNNeFNJamNka2ZVd1V0eFhWWUtjajFjazRsUGtUcHVHZWxXVEpCRW9HTVV5RVhWUW82ZDRQamN2MW9TMHc2UThKb0Q2NEg3YUxRTUFDQmhvR2gwS3k4RXhMV0wrR2QreFYweWp2Q2hSQTJ6RVRTa25VdzRwWlo2M1dOOFdwVGlPcHNXMVZZQzdHcUNWWlJ3bDBVclBiYXFoQ1Y2WnJ2L1lsb2tFczc1M3VySWQxMUVhM3VmM1lwcVNGYmJzcDY3VXN2dlhTV2ttZ09ieHBIbWtnUnNCRGU4UTBnWGg2eXRqc0VhcVFHNllyRVJIc1FoY0l2Z1VBRUQwSllTRjBqVjBoVENJcHprMUZuaGdnK2hlUFhZRGdXSFlhQ2tMSm0zUFBuS0lWdW9JM0VvQjlpVFg1RnFYWU00OHh5OHlkbTVuSFlpYlNCL1NLQ0JTTndiL29Rckx2UlNNNXJzaE1RSnZmS1dvb0U0QnBZSTRTRWlVdnVWODBvWTR2aXJqQ1VVYzE3Tng2aHEwRFVIS3Z0a1VhaDQ3cFdYYVJyK3QrRkI4c2NKMHlMZDNPSGtkb3FNM1FWZCs2bmRzZ0tOUGVUOEJNU3drT0VtSEZDYVdwTUhnQ2IzcXBFOHdSS2FleGx6Q2lnRmlUaEFCVHlNSDNZVnZZSkI4ZC80VHo4RGdMU0FkWlBZSkZoUGhKcE9NTmtuOUZTWENQRUp2eERDV3pOaHlaYndqZEduUTJ0WVVBTDRSdlFMUktmUlFtZDVrRXhGVzdoMUl2ZzVYdTBCalVoQ0FNQ0ZWdy8rM0NQaHFCbEpyN2pONWlIYUZiYXVBSmI0UnBjRTYrRisrYmVXR1B1Rzhaam5Ra0pJOGpFZEtYV0grVXBFaXFTKzNVYW9QTkhxbGxWc1ZsVmM1VHQrb05LSE9LY2R6N0hWckxuMWF6cXNGb0phRXkvSTlVMG0wVkltREJJYkhJSU9NQThSSWhiZ3JlaWpvZk5RM053NUovOHlaL004Rzc4RWdnRUFyUzR5S1pyWXArd3M3a0d0TlFiM3ZDR21RRnNlbzJFUkV2QkpFaGx6bzFHY1pwckRjbW01S29tZ2FhaGt0Ly9jeDZnOElSVmNmVFprT1JPemhVRE5ZcjlKMEhZVnd0aWhmblpSQUt3VGpDRVVIck5LUDdHbCtHK0VRSXdFMEtKKzRYaE5WRlpYNWlMWS9BZDZ3QUNBT3lYMTJ6SGtiVC91NEtwTHZsWENibXJPY21JVnExNTc3VFNpREUzVGNQdE8rc1RFYjhoZllDUmViVGtmOVF0OHlaWmdLU1pnV3JIZjhBVW9LMm85cTJxbFVnTkR3TWlzb1NYQjhaeFlTRExMTmw0T1BnQk9LSXdGWnNTUHgxWEhqUVBtZThnVUh3TEVtbzBTNmFGRE9hRUlXQUl5R1FkbXhHcVd2aVROblpLUG9rRnd1VTZJRjZ1SFdsckFST01CM0Z5clJBb3dvQVFyWGtSR2JHcnFhZ2pCVVFPV1BuSXRiTmVtRkVJRDB3b012Rm9XWDZEa0dBZk5ETm9BRGFlQWI5bmZjejhjMTlxVjg2QkJ1WTZXVHY4T2o1and0b0F6eEIyTjhTbjYvUmVDNkZHZzRCR0RleGtuSUhHdU5XKzA3RmV2RjN0Y2FwUm8rMW9qNjRmbE16Q3NYQWcrU3dzUXdhUmtMQjNrVVQwZHlKSmhmVGltSnBRRUtPWUl4ODBqQUloWTNiaFI4QmtOcS9tdDBoOUhqaVNrOXlENFZsQ25EQWN4MkovcjRla0h5RmRFMnRFc25Sc2RmakZYcGxvN0dBTnRUWTdJMUJJYVlDRW1vb3dpc2VHQUxsT2hBQ1NtMzNWamhBZG9WakQyaU1idnM0cjF5blhKOE5jUlJBUjlVTVlrRmxubllUUklEQU1LbkJONUhoNEo4R0tKc2FuUWZod1BOYUJaNGpQeHpYam8vRFpaOEQxR2RyT3RScVpQUXJQVEFZbTBYZFJyR3E2WmRmNHpteXJmdEgwL1UzVHZaNndIZHpWK1puNDI2NURuc3lTenJmMUZTeGdQbWdYQm1LRUtDMENJa0hGd3NJSVBDU2ttRTYyNER1aVZoQVpHQ3BzZHNLeVJwZXNzUkJPUWI2Q1l4Q0owUnpBYkpOaCtRMmFDR0tCU0dFaTY3MlJoRDQ0eloyYTBjMkh3Q1l6S1FuNW0vdm5uQlF0c2RIUHl2Q3FSTVgxaW4vaSt0RjBNQXVCQWJvSGtwdXBBMnd5NWw5ekNabXA1dHE1TjY2Qk5XYTlrZnpjYTlhdTRJdXBOYmdITkFtTWhEQ0NRVUFNODF5TjdsbHpJakNTWjhZekpkTEZBQ01FbnY1VU5uM1RIRTFUTExWeFpZUzZUNGZSU2hPMDY5NlNrYk00N2lPM1kxNWRtM0R3VWIxRzlUMjZKbXErYzNGSUpCNEljWFJLZG5uUUdlSGhPQkNvcGFvd0ZVa3Qvc2ZmbUJxWktJTjVZQ3FjV3VMK21GT1lLQkFXRXRlSWp0bDFIaHdTamhBbEpoekVDUnBXOUtvbUU3LzFIU0tSSVRUM1RISjE0NDlUZXFNeElVWnpOWmJBNHRBQytiQndpV3cxditIODNKOGF5aVFmOTQxMnhDVENwd0lOZ1BuRC9sbjFtSTU3bW5mNmRuelduT082RUZLc0IvZlB1U0JxM2trTXNyYWlpVms3bmdtWUw2NlZkWWFwb0EzV3lldTB6TmQycU53bmpBRkQ0ZXhqT3FZSktNNnNHekM2bEh5c0xZazZKSEdOOG5uT3pOV1Yzc0ZYYklrNUprSy8zeExVWTZuSlFpYnVhbGlUdjFsNGNoVklUa3dwQjkyWXVNb0dCVHlVTzkvNXp2TkNreDMrei8vOHp6bXlnazlndUpZSHd6bVYrcGdnL0U4VENnTGs0VXM0N00vM0pQNnNBR1FqYjhELzlHRTRoaWplVk92WjlVL0NxeVdsYmpBdEVwL3J4cHpTeE9DNFhEUFNGQk1QUWhVT3ozbXp5eURyeUZvUWZZUFlyRjVFeUVEWUdjRlRNaWNCZHRDTE5Mc01VRURrQ0FMdUJRZWJkY2JNeGJGblhkU2dyQk9tS2lZaGF3MERvVzBRQk95TE9laHhPU2ZDQ2taU1c3SHVvb01OalJ2bFMyMDhtcUZZc1dDMS9xVDZKZW1MZFB2VmMyMnBibjNhNlRram1NaVNNeTVIaXpiRldST1p5c2xkWUlnVzRtUmo0U0JzRTFPaVVKV2dmSWRwQVlOZ1BpRTVDYTlDVUphcG10RTIrNHZHNFRmWTFreXhSWG9oS1VYVzhvNW00Z0VqbVNGY2lVQUhQSjN0cm83QmQ0aVNhMmZMdGpQY0oyWWNJVS9DeTBURmlINlpGOUdQVWlnWVNjb0hhUkdRZmdEM0RGT3hYcndMYXVRKzBKNFFvMlpMMSsrMm1pUThENW5MbW5qeUdtVFcwVlNzTlZFL2hKcmExTnlKZURXaVdXZ1c3aEhNR211TlQ1akJDNjZQNjBVUVFOU1lpNXdMMmtBNDhYK2hOVFY3bmhueVducWJTZFRPekRVeU9ocm8wMEhocDJPZXN4WHphbC9GVGxWUVlXM1hZeVNLQlVlUzBMQU1FNHAzVENBYkxyTzQ3TWVpSU5tNWFjcEVXVkFrTHZGNkcwR1lRMEJpd1ZUQ0o1Q2szQXdoUnV4a0dFSzROc2ZoZjBndEhqU1NtM2ZNQW9kMnFoM2NqR2laZTZsWld6VkZCY2hwNHVFbmNVMCtRSTZQUkNYZ2dMYmp1c2xGb0xrZ0RtY2ttZ2dVMHA1Z09oK2NKb2kxSXdvT3JobmloSGp4dmZidjN6OFhXNkZoYkU3bk1XbzVzUVNVSVdrSkZDWkdjQ25FTlAwME9mRURLU2xXb09pNGcwRkRDSUJHSUxqQnNleUg1cWJ3TW5sSi95K3VHM1F6VEdaK3hlczBDS0VwTktwRzdMU0NuVnF5ZjFlYXhCMWVhL1A1N2xtblBVN09xTk9vWGp3akVEcnhuSng5VWYrV3FDTDVoWHdJM0dPQlhEd2VNcHFBYUJXT0hNTWFNYjh3bVV4S1FjU2NBOGJCMU9EY1BDak9pVTNMQStHelVTYXVDZk1EYWNnRFI3TENaREpJTm5WV1kzU2hXU05zbWNGTkprQ2lReGhna3FpWk1PS21aR1kvQ0ZndFpYT0VhcXBKQkJrVWtUR3pXN3JYS21DU3p6QWZUakRFeWJWd0RaelA0L05ianF2SmxyaW5SQWliV09RY21IMnNQK1lTMXdOUnc1Q3NJWUtINzAzS2NxODQ3OWJYdzZDaWZ0T2Y0MW5yNDNGdThGejRmbXhjTjR6bzJxbzV1MFlRUzFXRjZXL1Vtdm51TndsbmliVythYkZtZmZybkdha1p1aGtYL0I4VDZqZCs0emZtRzhWY1Nld04wZ0VZQXNUSk96Nkc1bzBKTjMwSXBCRHFGMVdPOUFFdkJPQ1AzeWloZFA3RVUrRm9JNkhSRFAvKzcvOCsxMzRERlJHaW9hUExkVU9nN0d0eVVJbmNkU3F2OHk2VXZKcEUrbFRtRkxoUEhqQUV5a2JZVkJ0Yy80aHoyZGFITmZEY05SNXZoajBacEdhZzh6cDF1REVkSVU2MEw4VEpaNDZoZHN4TytWbGtsQXpvLzlUQVJnbGRhNTRiSWQzWHZ2YTFzOG1LYjRKNVpOU1AzME1EckxYRmFHcEtoQk1ST3NLLytrdU9LVUJMb1dWNUorQ2dId3BUNmZNa3ZtdGQ0N21NaEhYaDd3bzlVVERVL05HMDNYZUpRUzVKMHlvWlJEOENWQ3RoVlFnVEo1U2tFTC9SUkZIU21TbVgwSEhTY01veGszSTRJL3NoaFdBbUhqVE1oNlpBU3lDOVRPU1pjQkxXampPSkNZV21zaHNILzJmcmJIMU5Hck83RmV0VHNVS2FIMFNia05CSWE1a0VJc0lYRUpPRTFJU3BuY3dxRTFWdzRWSnR4R2ljUWkwNFNqQWoxNE4yZ2pqeGUvZ2ZmaHpud3IrRGNTSENIQ2RSaDkwa29mQ3U4T0kzM2t1YXJBQVZlWlltU3ROZnRQQ0s5WWRoZ2N0QUoxZ0ZtSmdRditYRzBBYlhqU2EyL1NySDVIZUU3cUV6VGUxdWxGdlZITFVsNnFnTFNrYjNCazNtemx0aWtPc1NHaUtqdUtEY0NLWUx2Z0xxSEVjVUJyRUF4L3dEa2dlcGI1a3FkanFaYVV3Um1Bb204R0hZQUNGajQ1aGgvQTN4NHl4Q2lNYk1PUzdFWUgwSDBnMkpoQlJUYXB1dDFyWk9oN3VibDhGK2R2SEljQzNNUVZ0UGFqendwNUNJaG80dGR1SzhiRDVrN3FtYmxaN0RLdXNjampvdnNDWmJ1OUhMK25RSlVMUzdDbUZZU25zWk5VSGRPaElhWWRFMVVNaUpWR25pYU1wWlNzQzlZMFlSaVVKemNaK0NPUEVGMlRnSFRNRHpRWE1vdk9oa2o2WVE0bS9aZ0UzdStNeTlZSkVBQzNJV0pVeVZKUUZkV0xlT1Z4aEZ0cEpCS2kwb0lEYTE5OTRSYzV6U3RlYXhtNGFxSFRVS3RJQkZoekJaUEJaU1hJNWRNSXo3Y3l3ZUdHWVFESVhrUjdycHFNcFFMQlFhQXllUTM0RzF3b1RDMlNmMnoyS2xodUNtTUo4TURoaGhTYlJuUnFPeWVVTVNtZWFYNWtWS1ppUW4wZ3lCUUI0QzdXZTRXRkNpRVRqTm1ady8yRTI4cllqVy9MNTJZY25wdkxXME5mdFdLUXhZRzU0WDY4djZzZGFZd2dpb1VUK3ArbmRDNlRtMmE1M3pGZTBpei9jY216WEMwZGFNRWdpS2RrVzRvVjBKeWxpQ3JGL0N1eWdGbmlYUUdyUWVtb3JOd3JkMHBKZGFDTlhhODFwWnVPVFloMmwyODBTemQrd1k1SkVkZzJUalpyV0lEcmtkT3BBSU9GcmtOcHh3cEMzT2dsc25iVE5saUYzZlFvbmk0dklaUnhQTmhKWkMrdkNnV1dUUnVpNnlvVjQrMnhPNEVoRDMwSFV1ZDErT2l5L0JBN0ZDVGp3WERpdGFDbTNGaGkxZHg2QnB0dFU2bGE3WmRoSjd6dEJZR3MwOGFwRFE1VG00RHM2Smo2Qm1oVUFWTHZwbjFvL0lZR3VhcmQyaWVZVkFSOWFBNXdOY0JrUUNTVmNzQ1VQV1BDZnVIVUhETlhGK3pDKytJM0JESUllUXNKQWQ3bzlyWnIyNVpwaUR3SUQ1RXEvZkFFVTM4RWNhemVkYk83R01HanhrUzZQcHUxdVBUSmhNcVJjdVBWZ2ZscWFSdGlvWGpiUkF5cE5nd3BSQ0VsZ2pyaS9nRUJrMnBJOWFBcWVQL1oyRnJSYUFHTkZTU0NHSUUxdVZCYlo3dWM1K3AxcHJwVmxIZUJBSUR3Qy9pQkFwMXc1emkvMHkrNjZVNTloSVV6UHJOY21VV3FEcnFOS05YVjVxYnBjdFVldnNrMHJBR1pLMi9vUm5DSEVLeCtlNllYaUg5ckMyYWJvWS9hbTVueHB1OXBranhNaEpJY0RRSUx6ajcxaEJxWU12UTlrRERNR0h1VXFUT2dRcUlYL0R4dUs2RUZRaUMrektndm5GdGNOQW1sMVpQbENqZzB1RGdtcWdwSTZtbSs3NS9FNkQ3SzhKd2RvWnBEcVQrZ3hJS3N3b0ZneHpoTmc0RHBoY2IwZHlUUkgreGd6QXZzZm14QzlCVld2M0dnWTJvODRHVTNFK29sekUwR0VxR3hOM2crNFQyNk1XekRvQk5weDlqdU4xVzNxcnVXWDhYNmtvUEw0bUVrY3pDaE9hWHNkUmR3dzFtcHhiVGJCUnA1Q01TQmxpMVRlQjZBaXBJdTB4WGZsc0JqL25hblFhS3MwVlM0elpUNnNBeWM4NzUxRFRxRzJzM3VROCtDWXdFdVkyYTQ1QVFsczRUczdaaXpyOC9BMDlzTy9mLy8zZno5ZE5QUkFDbWQ5STZCa0V5YlpBQ3ZUYVRMdEM1bXRlNUZZTkhjaC8xR1lJWFdsczEraU5pME1LaU9URUo4SGVORE51bENNSDN2TTdJQlBjT0hrVHBBcC9jK0htU3h4RjVrSlpJa3RVaEJtSE5FRkRDbHFZVk1PMUtZMnpTNGJkR21FdTdIWE1FYTRaVTR2anNZOXpPeExabWhvcG95WlZNM1J6enlzalpCZzlJVHRMODl0dGlWUG5zOWVSenNtUTdHdkNsZnRqdmZFREVRUjhSaGlJQXRBeFh4by9rTnJHU0dIYSthd2JuVkpnRkJpQlZxcEVvMFE1d0Z4Y2gva3BISGZNTXBFUU1MVjFKanh2R0F3dGFQMlBtZ3J6Uy9NMlE3elNzSG1yQk0xMjNWUXFrMFJFNytaYkZGRk5EK24rWGJaODFNa3d2M2ZCbEphcVJnaVhjQ0RvVDVDZmhFVVRtTWpDSU1HUklFZ0VtTXlXbkdvU0NWL1ZDeE94V0VoN3BCQk9zNDYrZmtEWFlqUlZxcHJQYXpFM29VbUlCT05hY1JZeEc0bmFHQ2F1dlp4R3BsRm5uaTUxbWUvVzI5L1VqcEYxbjI3WXBlaG9udy9YRHpNaXdDQk1pQlNwejI5RVNMc1crcGdqUWxLREd0elE0YmIzTDc4amVtV3ZYMEs4NUlkRVZVUDROVUNDNll3Mkk2QkFpeVg3RTV0Z1JJQVJTc2U4Z21aNFB1WmhOUDlNZEthdjJYVmVySENUcnVCczgvdFRVb004dW5QUTY0T3JmYWl5enNFOGcwNHVmZ09oT3V4N1NqRUo5L0dRVE9aWm5NTytFQ3RTZysrUWJtQjZrQlk2elNhWVlDb2VNcXFkRFp0YWZKV0VMeUhYYVZMVkFYVkJqT0ZyQjdNdnFwKzZCNjZkZTNBd1RwMmJzVFRmY05UcnF4TTJJNjFSbmZTbEpoZExMWERFYzlsYVNGL0YrZzhJRDMrQUhBZUpXM05GSTl4UzVsQWtVRGFJbG1lRXB1YzU4c3pSVkR3ejYyNnlTWjBOOW5nT0JHSXduN0FRY1BpSmxrSVBWajdLVU9abitCNExnTjl4N1ZnaVB0TVUzRjNVYnRRQXUzUk9lV0F5eUlXWlFYZFUybWlnWlRjSE1HSFhuQVFHSVZyQkFtSG44NW5GMTFtejJzMmFhTlFyaVVLd09SQW5KaFNhUWtDZk5TQkdNVnhzSGd6cUY4ZVBiTHlkeVd0ZW9jNEhyN0JwR1FkcHA5bUhZNGhKSW56Q0JlL0N0dXNHZ05hY1JwcGJXWmpXTlRYb1pwN1Vmc1ZkbHJtaVhyUERpNFNISmtIS2t6ZUJPREZoc2kvQXVwbUNPWWZEeGc0SUx4eDIxbzEzNkVtejFWbnYxcndnNFBCWDhWdXhDa0Frc09aY2w0Z0VzL29HR3pnV05BQmQ4ZHlwN1NIWXcyKzBKTExoM2xMaXNGWmh4dmI0QkNoZVZ2dmdyaHRGMEEyOTFJZmdJbUVHZkJGOEUyeE9iRkUwaHpVSE5tY1dzY29Od0NBVzhMQklPTzVjZzhrd0hXWVhpZ1huTjVoeGRCcWhNYk1STkxPd1hmS3RScDM4TEphTHNDaFNqd2RNY2d6MXI4TXJmTVJqNS96d3JreWdhb3djZDl4cGhXNy9aTUljN2xOekpWWEthNGNicXRYMEZReklob25MbW1YemJKdGhwSE8rbEtTVHlGaHpmUTNQYlFOdE5yUUNxQVI4RTlaWHZCWnJpUytvNlFlRE9jL1JRSWs1SjBjOEl3Z1JZZ2hnckEydW4zdkowSHNtR1pmYWtuYWgzMm03S0RYSXRhTUlWdGNrcm1vTllTVVNYcmFzRWVhQUJFQjZFTzBDMTBPR0hFSVVDb0swd0NIRGJNTG14R0VXT20ya3hYRUZBZ0l0UGtMNjhHQlpMTExmSE1lZ1FJWURPemhIYnVZSXJNdlE0ZVBCOEg4ZUF2QUpDcTZzZ2M5QlBKMW02TXl3N1BVMW1sc3ljdHB6SHFNZ3h5NEJtbFdOK0hlWWpRZ1NpQXFKcm9DQ0VQRUJFV0NFdlZsemlBdEdxbDFFUmpYbDJRR1M4eUc4MEZCRzB2aE1XSmpJR2UySGlGenlHYzBobWxvejJyQXk5SUttc1R5WTBnRVF4aklLNXlTL2h2REZXdUVkb2F3cHB5YVJGcnVCb1oyUEZVeDBoY3h4eDlHZ3phN3RaNkpPUi9QSWpScHBsMnJuUS9qZ3VGQ0xoR29KMmJKL0pnbXRSak04eVFMYlNBRm9OOGRRU21qenNsQThZRGJyU3pnbmpKSXcreVRLcFdHVlpxVU5NL00zV0N6TVAreGtyaDlDUzBCaERjZm1NTkhSTEpOdVBMVU9jaDFwM1dtWG5KQ1ZzSENGbFlsYUVNL1VuNk5sOFFmUmloSzB4VllTcHdTZVRSWnFzN1ZhaU9TN3dvWGpTc2hHMFdBOEJCZytBd1NQT1lWMUlkYk9FSy9XQWI0SnYyTi9Pc3hnL3JIK2FKcTBKdEtrY3VvV1dYbDhJSVFaSmlOMGtGV01YVkZWYzIvWHl5RDNyQUJGbTdkVjU3dzY4cFZCcXAyZDZvdi9FMEVoRWdYQjAyVUViWUxHTUVPcU0ybk9oSnRGRmNNWUpDREJGY0ZVamp0alh5V1ZvOHNjU1lZbUlma0hNYU95VFo2bFRaOG1WamZxbVAzVlhFU3owRkpvS3p0NDhOdWNONUp0TjlOY0hmVWNUbk0xTmJGbTBXaW9hTlUram5JdytHRllXc2dNcGlyYWp6WG5IZFNEZm9aTW9obWpXYUlQazNYakNYak1zbFdkZGRZQ000ZW0zeVJna2VpYWR0eVhjMVB3Uy9nTUlXSjY2YmdieGRSUDRqbXoxdmJ6d2ljbE5DeU15U2lhZVRaaCtOQVZnUjc4S25KdG1PMkp5NnY0czRxMDBDeGphQlFNY25yVkhyVVdwRE81dW5CbGw0RlA1NUhqb3NiRjZXaENHZjR6MUtpcHcrS3prQkNqdFI5c2FBMFRkenhZajhHaXNzZ3doSjFPY1BpQmtlQkhRRGc1dFNwajVYWFlUc0xDdVI1SERhQ2xPSDUyYnN3d2FVSk5sZ2FKMWp4VDlVZHFhTGp6VXpUcmVKZ1FuclhmRGdCU2czQ3RtQ0I4ei9WanZ4dTUwNHpzQnRGMDlua1hEVFRNaWcvQk5kREtsUTFUbFA4YmFkUjN5MGdVeklHcFRjVW9sWXhjbjgwcjdCTUdRd2xUTXJybGM3Y2RrL2c0MW9Na05BeUZRTUN2d2pTRGxybk9ETW9raURRWnlIdWFQdDhiQmptblZoREtJTmtHdE91dXVHNXNzMzlubWFjbjU5MmlLWmlGbkFNaFZkdnMyRktIODdOb0p2TXdwM2p3cW1BREErWTE3TlBFd3JBUlBXT2hZRVlXTWl2TGNrWkpuVktWaFZOMlBVazR2OUlhWnFFQkJGcE8xUEZXOGh5am5FbHQ4cDM3WlFPMmxPQ1lsY0RSc2UyUm1rQXlyTXhVc2t2d0dSVTB4SzYyWDNKb2s1QmtEb1dhUk0vOTI4cVZ5Q0ltbGNLTTlUTHBhMGRIMXMrQnB3aXpmZnYyelNZNDk2T0RibE03YzFIOERsK1czMkUrRVJMbUdYTk5qb0ZBQ0NNUW9BTXNFRkhCQm9NcTQ2Y3BxYld6ZWM4UG0ydlFVM3NJMys1cXoydXA3Vlo2N2RaeHpVNWVFcFdMUk9EaFlncXg4WENSMXBwUWdnT1ZVaFlEa1RCQ1MrRHdZLzc0ZnhzNTJHUk9aNThiaHhuRmVvbTg3WnozMnNYUHFJOVNrR3ZuWVNDSkFUclM2QTRURUNrSUEydVdWUUx2MXFjYkg1ZStuNHdzck1ja1hkYUZRQWlZZjVoUEVDZmFsbnZXT2ZYYU5XWFRhVlhyWlgxTWJidmo5NDVrdytUQkh5RFNtSFVoRUswQkZoeG5pTk1TQmYxQ1RXQjlQSzZUNjRXeHpQQnpQeUlZY3BxdjZBYnVIOU1MODRsY0ZUUkFORk9FdFcxWFhTZWhOMnJVV2pSVmEwbWlYL0k1TU1qRnRjdzJUYXlhRHhrNTgxMlNzUnQ5WUNzaHBSK0xRWkVNdGowTDVZeStST25LVEhZY3g3WWwwNDNEeklZRXg0eGdYMjdZdklwMTNHZ2JhdCtSVERBVkM0dlpaZzFMZFlickJGY1gwUHZUSWVVNnVXWTBsUzFSU2JyVjNFWFZCalU4cTJEcWNqWnFPUnhQSkNhWUpFeEcvczRCbjZ3ajE4TTdhMkZCV2pZOXFGMEtVek1rUkQvbmRtaE9tZFJsM1JCa09NMDR6OWo3VmdMS0JQcEFac2xoSUtLTkJBcndUZEFxMmZVUllZY21WdXB6UHdZTDBCYUNIUVhKRXBWanZmRkpqRjdDSUhacHNWN0hSR2gyVU1tOFI1cForbDJsVHVUY2pZbnJYMnhpTUlrZjUwNUgzYjlIMDJ2WHRTR3RCT0gvV0Vpa2psMzV4RU54OGVSTElPeEVBd3QzUityb2owQ1UySnVZWWRyVk1vYWdSeGFMNjRTcE1FUG95MFhMVFVGdlNmdzFYNUdBUVAwWGsyNzhqY2JBTjBGYWN2MFFybzZ5cHFKTTJKbGNTY0ErQjk2VHVmaE0wSUVJRkdZSTVnaUU2aVF0S3kzVGxGVlM2MEIzTlNVNTBpejlpaXlKMW96VjRVZVFvVUhRVmhBbzVvMElDVXVreFZPWnErTFpPSzJMTmtoWURKWUdpNkJRTzNFZlRnSzJGUzN3RXpTUytURDdEdWhYc2Y0SVRZR3RxUlZ5Y0U3dG5xSmxrMjJjc3NuZTlQMnpZSkE5K2huVlVUZWlsVkd0T2pUVGdUUkxjMFFxd0RGYmpnclBUbWVQUllOaFNDZ2g4WWw4MmJQS0lpejc4d283NGZjVVhCbGExRzdWTk1HVVMwbVBqVXhFeERpNUMxUVpwQU1HeXVqV01tUnROOFRCWndnSm53cjdHczJWM2V0ekhiT3hkZTAwNG5vaFJJaEVJU2t4b1FoOWduUGpHb1gyNktUcVh4amtxT1crRllaU2s1ZmNEMnVMTUVIYTYxZVpwM0FpcnFCRGF6WTBQd1VlV2tCbVpNc0tWTjVaRzU2SGdpdzd6TE4rYkt3TEdENkVBUUlOQjk2eVhXYzRzcDZzRGUrT3JPaHdWNk1KdUxXeU14RVZtMHgyTVVERlBhTThTTTdycUxDSWRmbVNVZlNyMnZ6R3lYUDJIdWNFdUVabUhKT0N4VUdDR0MzU0w4bVpmYWhpYnBER2ROakhNSUtvWFJmRFhBa3FuWWdJanF3bHYybHFqSXFZS3J4Y1UwdXR4UVBpSFRQTG1SeGNQeHFPZGF1SlJZOGpVNUNmd0VsRk1NRDBXYzhPUWZFZDEwNVVCeUpPQnExSnV3UnFwdWJJNkdMdGtNNjVFSGlDRFlIR0UzeXdVRXdKYlZtekNUMEVFMy9EQUR3ckJCSG5zMkVGdmhyWGJrTnNub0ZPdFQyMjFEYWFYdHd2NjJhOUNWcUwrM2Jtb21hM1BxRmF0TTRpcksyRHVoa2lxVzJ5UDhHMHo4d2cxM1R6QjVkZ0p0VWN5M0VHT1k0NVJ4eU1USzZzV3BSWWtCU1lGRXA3RmdxaWt5bTBNKzNPemtKekxLU3JGVzZZSTRUN05CZVVyam5iejA0cm1DdnNqMjFQZGpmOWtpNlJtQ0hnbWt6amQwaE14d2RnSS9NWkxXSVZYMGFpTkdrdzFXQU9vbENZSW1TYU1kZVV6QkNHMms3Y0U5OTFYVkpxRWplWjJudVFxQnczYmRZZERjRjEyMjhBNGtUVHFyMU4waGxTZDZ3YnBoWU9NeVlVNzRSV05ZdjFCM1dLK2F6VHpYM1R6UWFtZFBJdTU0QXVoSjdJVlBndTFyWExCS1lGYW5qYWlKdkk1dEZRMFZwaFduSWpsK09rNzZzRVB4cVlxU05aQ1Q4LzY0UjN5Y1Z1UG1ITkE5anhBdFV0amd2cFk0OG0xWGlPQStCQlk0TkM2TmpHSnBVd1F3eHpXc09RWTQ4aERFTE1TSHVJRXVKRVVpRkZhN0ZTQlRqbWVtUWhGc2VFR1hTYXNaVzVEeE5RMXNkQU9OcS8zQVAzNlBWRG5Gdy92N09WcHhFOVRRa3hWYlZ4UVZkZW5GbDNUVUdjWnFiK2NoN3VsL05ZSTRPV1l0MnQyMEJvYUxvaFZJU0cyT2FWMzVDTTA0Umk0MTQ0dDBMSUNrUFdYVk9LZWhUQys3UVRvdmNBUW9GMTFZL1JpZWM3MXNnd2JqYllHK0dwRkdEU0NOZmlySm5PQkt1ejJUZTNQWFJ5djc3NkhaWDR1d20xSStlODVrQkc1dGdJMDJVa0loTTNQRGhNS0I0UzlpdXRMbm5YaDlFT3g5bUhJQ0ZPaDhWbzN3b2J5WG5qdkJQOXdMWkgwb05YNGgxSmxYN0p5QS94bm1VY0djUjhqOStaRkdQOVlBQktYb25jMmFHUmE4R1dkdEFOa3BPTnRURXkxL1hTeWpMVER2bWJzZjJzdHNOVVFTaFFvWWNwaGFiUVhMUTNzdHFRZHhHNG1LUTJneER5WWVremE0K3c0ZGdJQnY3UHZabnZNS091T2NvNU1DbFpjNDZKQm9IQjBDZytVeEVTbXQ1c1dZOVN5MmU3TGlaMTNhcTJxR3RUT3MyL1lTTjlpMDZUWkgrc3lpQnBobFdza2Z2VW5FbzF0VEpobHcvV3NLS1JDeFlWalVCbUhHblBPMzhidm5NL0hyS1JIS1VWeVVjaUlUaDl3QmUwM1RrbVVzeTVoanhnVkxrbVNNNFlUTWlNS3R1MXEwM1pKRFRqL1h6bTl4QUE1b2Q5YkNFa3IxK05tTlZ0RW10WGIrL0RUa0JrQmtFeUwyU3dRc2VkUWpPSUhPSmtRK1BDb0JLa1hXYUV4VVBrL0IvL0RyK0tTQm81SDU1dHdueUV4M0FPblcrZWk0MEdNYnZVNUh6UDJvTnhZKzBSREFnM25vKzVEZ016bWF2Skx2YmRRSjNha3plamRkbnlxSnNvWENlQlRlLzdObXJ1WTVUbjBHRkhIYk9OQ0w4enkwYmQ0ZXVzOVFxeHlIWkRuSk5vRnVvYmFjTURSbzJyUllSYkc5YlZSZ2E2VGEwQWN6WHdUWGpJUmoxMEluWGtPYWRqQUlpMWN4N1VQbWFHV2lGekJYbnRNb3dhSmMwQWZrdWRDZGNMazNMdDNJZTliM1BJalRIOGJKOVUremxWeUx5YVN1UXk1OFBNNHh6WTk0NjQxaHpsYjRnUys5Nm1kMm5DT0dMTkFJQXdFcTlicVc5RGJoSFhKdXJFVlhFTS9ERjZEdENIRjQyRktXYWkxWTd5MElpT3Y1V0NGZitWZ013VVNEVzNVMzFGbjBVbVhIUDBkdnFSTW5kMGM5eTNrWENTQkNxT0lsb3lSekpXcllHb1RqbjdWeWUvTWtkRnQyWlV3WnZUaEJMdzV1QjdLOVJzYTZPdDc5Qjc3R3lrSkE0bkR4bkpiUmhZU2Nmdk1TTWdUcTREd2tKU01uZWRxQmpuemJoNjlpWDJYcEpKRWxzbG9CSHR4SFZqMWhGMElOdHZQNitNeWRkaXJvdytWWWU3WnZ5dHU2ZXREclg3WEQ4RlVYWVBzUWJEWTlyMFRxRkNnQVF6RThMTzBkVkVvbUFtdEFHbUVaOUZUdnRidFk2UkpkWUlVNWhRTjlFb3Jna2ZqM1BLV1BvMC9qNmJNYVJmbFNIcDJpV3lqZ2pQa0swQzFtZlR0VjFOcGlzWXZXczNxaG1WeEYrbGZkMFMwdDBOOCt6YW1OYklWN2QvbHZTNmp4RWNOUmZmWXdvd05Zb0haZFFGU1MwbWl3ZVY4L1pRNTVoUi9GNjcyS3k3Y1g2a0lFUkNnZ29Od29iVTU3ZUdsVE81VjB0bjg2SEoyQmI1OEJzaVUyeXNoWjNhc3h0NTFvSjA5ZTRKTWNrNWdSN0RZVGVHU0dGMENOUEJRbHdMeEdtQ0RnSjE1QVQ3b0cyWmJndENBVDlKTUtDZFRCTGdpWmJBUCtFekVVT1lBVWJNM21MNEl2WnFSbU1obk96QWFhUXA0Ui9ad0M2alV6SkZGNGJQUGdPalVRZlZqK3oyYXpyVnpCcGsveEtEVkltZlJKOU1zbVNpYlhWK2VzZEFHWTJ4U2t4MTdnZ0FvQ1owaDZmMEVtd1V6cVRtaXRMWjQvTTNKcFI5ZDlFb0VJWVAxQmFkTUJSU0ZFbVB0RXhZdnI1SjJyVzFPakUxaU5ndlE2dHF0NUVwa1VuVkd2SEw1dFVRSHFGdDNyWFBPVGJTSGszRnRST3RRdXBEdU9acDlDMkVoVmpUVHpnYUJLNE51ZEc4TUxQVHVqU2hqRWhaK21vRHVSdHV1R0hPZ3hCUkZLREk4ektoYkgyT2plVjhucG03NllaMzFpUnpIUURiZFU2c1Ruak5ZVlVobDM4SFZ1dEtmSkI5blROZWlUenJGZHhmWmpMYlhuK3pUdnRVSkd1R2h6dlRTOGJKYUJHMk1Xb2Izd0pWanJURTRUT1VLa2pQREMwUGh3ZkRReVcwU1A5YWlyY3cxOHcxYVA5elBweFQ3dDBLTnlKYytCSVFYNDQ3cXc5VzA0ZDc0bDF0NVdETHJDRVoxWHRVUVpWei9kQm8xTHZjZE5OTmN5UUtocERwTEpkVlczRk1XL0p3elpoNE1KV1JLeU5DOWp0bVl4ODJTNTVaTys2Zk5iSTBtV3NoYjRLUVFWT1JSNEt4T0k2QkVNMDNFNEVkK3FCRzJyb09tRlZ6cEZQZE5RYXZmWkZyY0tOT3I1S3UxSkNiLzk4ek00aEVuaEQzTHZTYlRGRzFUUkp4RnlwZVNrSW1rcmptU1RyTmsvQnNwQlhTSGltUHRPU2hHcmNYUkdkN0dFdDErUTBNQW5MWWtRdVlCMWxGYUMyMFpvUmxvd0R1SUVvY1RoS1pkWnBxMVI2WnhZZndrTzRRMkZMTG9CUVEyVmpiNmtqV2wrc2xYQXl1Q1EyS3RPZmNhaWdGZ2s2ek0xVWdZSnFJNDV2UTVJSnJWeU9MalVQUzQ4aHpQSm1DMytLSDhiMkViNXRZeHkvd0ROQzY2ZU1KSVRJYVZac2pKSUYzTlVUZEFNNk1WTlhKdG15MWNyUk9HKzRZcUJ0TlBtMTdacWhKTWtqVkNKVXBSa3pRbVVtZGFkYjVLcldLc2V1aTBwbG1MaHlmQ1EvYVRsOVVLVVFKMDJCZW1BUGhvWEV1ekNvSUZpZWVCOHpEdHdqSGJLNG1rYVlRWVVxaVdrQkJJRXBDbC9nL2xxZG1LeVNaaGdkR09KcndMc04ycU1YSFQ4b3hZZG1BSVRQMDNKTzlvTEx6T211R1BZOFc0ZjZBKzZNUlRJcmFxRTBUUjE5RmpCVnRja2dTMGtBQnpXUGVRWWRieGtJd1dOQkVUVGhkN3ZGTmNOSkY2d29OWW8xaGZnZXQybWFvWTRpYW05Qzhxb1ZNcVZWcXA1YXMxMGxtc2I2bFEwQ2tzNStJN1dTZzdLMXdBSXNsZ2RyUDFVaFZwMFd5M3ZwZ0dXUXAzMkkvMlJGakpJTm9meHFOOG9IeG1SQXFENU5XK3VDSlNCcWFwQko3eFhtZEFPV0lNWTZIQklTWTFEaUdXMGxBUW93UUp1OHdGd3lwdHRMUmQ3SEZGQkVTQmZoSDdnQWZDV2tyZzNjOXNmZ3RSSW1HSUJLRkNZVlpWMEdZTUpwRXlURk1wbkpPVEUrdVRiZ0gzOFBNTUN1K2x5YVVYZG10empTeEo2UUVBbWN0dVg0WWkzd1NKaTNNYTRjWGZSdUx5TEliWmRkVHEwcnhUS3FtTTI1ZXd3eDRBajVyTFU4ZCtsbkJwdFVrUzc4bnoxZit2aGdUNjJXcEVhb2Ywam5obzJoVmwwK3Bma1g2RWwxRVRIVG1VdFpkNHNwdUtrWXhlRkJJTTdMakVCaVNIcWxONk5KOGc3QnN3NUthSWRqcmFBZ2tKU0Zlb21LQzgvUm4wRkpFeHRnNHR6Ri9yaGVpNXRyMGM5andXV0FtaUl5TlhBNndFcEc0RUdLMkVMSXNsUDBjVmMyR2ZROURlRDNXeXpqUDNBMG14cWRDV3dIcHQ5ZXdDVDJZaWV0RXUwTGtGaVNwQ1J3Q1pMWWJJc0tuZ0xGSU1NSlVhQkNFaWhsMzgwZ0dPaEtmMW8xeXJxWm9oclZIVGZQOHphaGJmZ3Faa2I4aEkrWG9pSHJlRkx6VCt3VXd5TVZWNGxkSHZZdHNWZk1Jd2s1VExQMlVMZ2ZTYVpyODN5anFsVWxJdFUxS0V4Z0FRdkpCWW9Md2NKSDJsdkVLWFJBbUxqb1l6WUFwUVNTRzNBRm1DRTVvQXZ2c3RKS1RYdEZPZEYzQk40RW9rZFFlM3h3Q1VwM3J3cFRqSHN3eVp6L1pKQ3hNS0VLbk1Bb1NuM2QrNzZBYTd5RnJaU0I0d3ROY08yVUMxS2NqR0RROUxHQ0NJYndIUTd6NE5JUjNFUTVFeHF3elFYaHdmVncvakFYRElVaU1FbnE5RnBMVnZFVWRqMTJyRi9PN3JxMXE1NmpYQVoxMTNFVTNpazFHTWh5ZWMyODZjMnpUWVQvM0ZnelNhUkVUaENuUms3aXRCNm4raXhDSTFDYTE2S3ByRkpGbTJtZzJ1OGROMUhEMjVOTDg0S0hhd0k3L0VjV1JZRG1PKytwRVFyeEtlVGFxNVNBS3c3TFpwalJibGFLdEFOMEJIOEdKUi9PSWp0VW5zRU84WVZMK1IxZ1ZNeERZakJCeGN5YmNFOWZOUFdEdVdkdU5md0JEdU01ZW0wTm91SDRZQ3FFQWcrRTNjWTNtUzZ6WHlBRkFNRGdCQzY2ZGpwYVlVZmc5TUk4d0g4K2pUNlk1bVVHSzJ0d2g1eTEySXlGcTVHclV0Nnd5VW9VMGRTTW1qUHJWMEhzWENVc3pMWDBlR2VUY3FqSFNhYzVrb0U1TU1oS2Fvd011SnZHdTB4YlZKRnNLRDNmNWxWd0VvMXY2RGs1Skl2ZkJBMFhDVW1jQ0lhQmxuTWZuR0RnWUFyc2N6VUh1dzFvVFVjWTZ0QndYSXVNN2lCQm1zc0xSSWlOOW9oeVRabUtTNDZPaElNcTllL2ZPL2dtTUlQUEpVQklvakVIWk1QZExTSnR5VjZyMC9JMG1vQ08yMFdLY0EyRmdsdHJ4Y0dLL3VHK096ejNEVUZ3L1VCQ0tzekRWc2pPS2VEZC9sNzJ5dWtac25ZblZKZmk2L01hby9XclZGTm56b0pwYStpMFpJcGRoMHVxb2ZsTDZSZFAvemdEdS9yRE85NmlFbTZhTmYrdlFwOVJQRGVMZndzY3piRHNLQlM5cGo5b090VUphNmd6c2JDRUVzZGthaDVwcWlKSm9GQnBHNkxiUkh4dlk4UTdFSHI4RHFVcXRBdzJla2RRNUh4QzdIa2x2NXhXdVN4U3h1UmVuM0FyQUkrOENVZUo4WTk1QW5HU2JsZlNpZkFVYzJpZ05VNUZLUmE2ZmpldkJ0TkpVaEprNVowTDdNYW5RcURBaHRlU0V0bmtXYWdYV0M2RkExaHRtNFoyMXRINm1UbXBLZ2s4Sm5BU2NUblp0a3lwQloyODFvVHFwQ1dvTnk2aHhlTlV3dFJhbTAwYmRjTlRhQUhEYTdnT0QzR3Zrbk5jY1JacGMxUnpyc3V4ZFhxVnJMN1FVT3E3NWttUzBwV3JGWEZBalZraDJ6QStrUGNTSldRTlJaN01CaUZJSWh0SVMyQWFOSGtDeXdseVlWRnlyazY2RWZOdU1HU0tGT1pEZ01CWmFBblBINlZnUUpkZk8vOWt3WjVEWVhLc1o3Z3cxV3dMQWZTSGhZU2czN2dVdDRaeVU5RThjYzhkeHVRZTZyOUN2aWc0cy9OYU9KSUlqOWMvVVdMWWZUVnlVVG0yVjNsb0tpZTVPeWQ2Vk51UnpxZzU4S1gyOWxXbFU2L296RTE1N0lDUVRaK01OdTkybjFlUmMrYzJHR1NmQUlNZVA4Rklad1VyTjBJV0JhOHVnTG05U3MrMWQxbjRwRkt6RDMrVlZhaWVWWEd3WEdrbXJwSVF4aU9RNGVzRU1kQmIzODdkRFNHRW11NjdBWkh4dkJFckdjaklTa2g1VEI5Z0dUQVZSSXZYUkdoWWUyWWhaVThVWmZueFBib0t3S2prTHpMeEVCYUNwdUc3OEpkNjVGNUc0WnNWejVKMW1GL2VBK1VkeWs0MTdZRzBNeWVib1o1a3RSeXgzeEZ2YkkyVVkxdWRTY3hkTFVTZWZjdzNMNnNPa2MxNFpzWVA0MUs2Vk5jbFl0VlBaWjMvT0o3eXVScDlTUTR4QWgxM0d2Zk5uUmhDV3BhM0w3TXNnV2RhN1ZPK2VEeUtIOHVRQUdKc3NrSWttZWdVRDZHdEljSGFEdEppSlNBNkVaVVJMYVdzSktOb0VBa1pxTzkyWFhBaFJOZk1ZWnUzTkhXaU84VHUwam5VWG1JSDRlVG1QM0FTZ2pJWEc0cGc0NklTME9aOGRRc3htdzB4RXhxekx4NVNTcVdvU3JUclR0VDFuRXJab2dVVFBWdTJkbWVvS0o2bElna1JLNVBVc0RUck5RRUR0VXRsbDB6Tmkxa1hMTnYrM055ZE03Umt4U09ZZWt1Z3plbFhEdTZPd2NacHB1WFVNWmR1aHppbFBFNnd6N3hMeFd5ZEI2YUJtcUJlemhVeTNOU05JV0NOREpzSnNDQ0MyQ0llWnhVU3pnUFlsdHlFRHN1RzNXRlBOUnFZYlU4aEJwRFlzU0RRcjcyVE9ZU2FnTUJ5WDJndDhrK3kyN20rNURvOUhpSnE2ZWdDRE1CWk1ZaWRGazZkMmllUTRCZ0VNZmVwdzUwaUhORitTZUR2SWZiYlBxVnFqZG91cFJVNFZxRm5iTHRYRVluV3lQVTYxTHVyK0ZmMmJsYUJWT0JEZFRRMXkwWWhCc2s1a2xLdW96bm1uUlNCNGN5VWpaSENOa0ZYRzBPR3ZXbTNKb1UvYk0rdFhMSTdoZVBnSFNIcUlFYUpFOHVPSUM4bUdXV3lRVEtpWS9BZkhBR29DNFBFREgvakFUSnhvbHV4T2IrUkxVME9DNW1IZ2JCUDlNdHZOcGpsa3ZRaEJCZndtSE94RUVvdUV0WkVheDhCOHNrb1F3Q1lNUW1oWTNKUk92R0ZuUG5QL0NZK3BqbTNXNVdTUHJwcUVTNDJmU2R3Nmw2WG1yRG9FUWZWcmN2WmdWbkdtSnVxQ05wVUp1akVTbmZrVmFZMnpEekRJOU1WWk5ibVhIVXBHQU1icWpIZUp3dFFJYXAwbE02d0RNc29ZbmVhcERTU3E3MU45azhUYUtIa2MzdUxJYVQ0THk4NVIxamtHbWQvQUlFU0VnSS9nYjVBeDE3RTM1eUFzSEtaaVE3UGdXekMvRHhnSlFFbStzNU9nbmRBenhBNWo4VnVZRnVhQmNleE82WFdoWlRnLy9ndE1CWUNUK3pVYjNrVnMxQnBkWjhrNjkyWFV6VCsxZE00cVNST244d2xHemJvMTZXcG0yMnZXT2hpTjNsN1h2YithYzVWSnBKSHBHazVMRSt1Qkl4TXBtYVZyS0pjSnd3UTRqaGlrbWtLZDFxbmFvSFA0UitESlVhQWhtU1hEaXRhQkc0V3hmeFdTSG9rT0k0Z1FUb2NhcVUyV0htSmtBMStWcy9oTXlCbmQwcXlEK1NqQ0FnWkQyQlVHNHp2M3liYVpSckw0bTFBeSsyc0dha0ladGVLelNGdzJ3N1MyOUtuaDJRVDRkVU5HRTlrNm1xL1l3VFM2RXVwYVNsM0hXcWZqM1hXMjcvYXZDT2l1dDFYWC9LOGJocW9peU5tRzA3TS9OU2RNblRKeXdLcy9rTkFTSytPc20xaW5RVG96YmFtbVpLUmhhclNzZTRpcFpUcE5rMkZLSkw3WUpoc1d3RGc0N3NBdjN2T2U5OHk0S0NjejZWeHpMR3N1OEM4Z05tZi91VDdtWWl4bXd1R0htZkFaWUR5aVNVVFdiQTZoSXk2V3kycEJma05pVVNnTStROStsNG5PekhvYlpCajFnVXJ6S2lzM2EzRlNOMW0zSTdJUmczVFBwR3FqTGt1ZVdyOG1EYnRCcHQ2Yk9iZnNIMUMzaWhaUEZJRFA5dVNUVHo3dUZyUFNwd1BmV0VPMGxZZzdwenVaeUcwckRESWEydE9OWXVpWU44OVRzVjVMU2M3VUptbmZDbDR6MDB5VUIvZ0Y0VmxnSkNDQ3M0dUtnMzdzK3FFWkJaRVNDYU56Q1lCQi9BSzFEczQxN3pBVGZnWCtobkI1Zm10WnE2YWM0RDg3dUdOQ0NZTWhZZ1dEV01xYlphY3BQV3ZJTldjY2RpMk1xaFpaR2x0ZHh6V2tnNTErUVMydFRxRldJMUtqWjlPWmRqWGZsY0dFYnF5Mng4eW1JeWFTYzdEczlIN1ZSbjFOUDdvMHMrS2RDVFFLM2JyZmtoL1NhWkRxWXl5MUcrcWdNSG0rMGJXT3VxblV6dk5wa3lKSmNMakZOWkZESUxLRnhNOU80VWFITkkrUS9KaGttRTlNd3lMVERSS1g4TENWZVBvbG1sTlc2L0Uva25jazh4Z2RSa2hZSjV5TmEwUDdrUGtuRndKejJkWS9vZDVjKzZpYlpkZHlxV3NiT3hyc1V4bXVRbjNTejBtaXp5UmpWby9tNUFDUDdYTmM4aC9TVjZpTVZMVkVwZ1VTSTJnOXZHSDNmSisyQzIvRklEanFvNFRkVm5JYlhiaTJobTA3VFpTZFVpcithNlNOUnFaZ2QvN2E5VEhCbHFQbTJrcGtva0FRSTlsdUVvdElLMnBHc29lc1RyRE9QQTQwVVRHVGltejZHTm1QeTkvYTRJQnFQQkM0Wk9ycDV3dVRjVzVOSmV2Z0hRUWpoRjNJZG9Zdk80bGZwWHhYeFZqUkM3V2w3TktNK0l4QTFaeEh3a2hxclg1ZW83NVRqVUIyUU1aYXQ5OEpncXhTelVaNm1xNnVyUmFCMzAzUDVyUmJNVWlkVmJoZEJxblo4cEVHR1pscU5WeTdsRlBwR0dEcEduTWh1eUt2eWlEaXBRUThHcm15a0loSUY2MkE2QUNDZHJCcG11aGVBSVMySjRJNUlBUW5KbG5DcTJsazFSME1ncFp5VGpnTVJtN0Z4aE9HZFlXcVpLNmgxc0YzWTZZN1I3c2JxOWYxQktpUnFOSDByRG9ueHV0eW5FT0ZpVGh3MUd1eWZDRmhLeDB6ZHBHeGpHcm1zN2UxcTB3ZzdpNFpKRDl2TXNqeEc5MkxEaWRKbkoxMFRxS3V1WTJjSzlJNTRoMU9xeWIzbHVZbGpreXZ5bWlqZ3ErYVhPek1oWlJPOW5YVmZHS0RhRUhSVXRkTlJBa2ZCWFBNMm11WVFQd1V2N1haQVk0LzVoY2hZZndTb2xJOERPMWdISHFIWE5xUG1Qdkp0a0JWbWh1QjZreXBORHZ6dnRLR0h5RVJVakJXbjZMRHdZMHkzZXVpV2hsUnEzaTdhdWJWZTZoTVVndnkzRDgxdlg2ZERKTGZ4L3VWRzZPWHczUlMybS9IdDZoSTNoRlJkeHBpeWRmcFJzUXRNVXJISkYzaDEyam9UeTV3bWwwc0xKS2VaQno1Q3pzODJzWEQ3b1pXNU5sUmhRMnRZcU5tR2o3UWJNR20wU0tKcmFmV0Q5S3ByeHFoVnRoMUlleWEwQjBOQnUwMGhyOTMvNHdFSmtOMkRKWUU3SHFuODF5NzJHUlNjbW0yWXpKaGFyVzBFakphSjBTL01vWkZjOGtvWlh2V2tFR21HM3BreHlEcktnNjc1ZzViTmRHV2lyVkdHZmxxcnFXSnRnN3cyS0VBbHFvWC9leWk0NCtRakNNVFR0MEVaYWc0ekphMDZyam41RmlJZ0p3SmRSeUVhaW5yaGNIQVJEbnJXNG1XL2ttMkhhM1RlTk5XcjFLM0cxWTBHaDVxNW5qVVc4RElrb25KS3JYek54a2RTc2FxWWVTRUxuWDFIZlU2UFdiNk1iVWdyM1p6VDZLWEthb3pua0VRdCtuNyt3OFpaRkx6cDZUNWxObnZyZ05qOTcrUjFtQmZrbTJZRXNsOE9hbXFSdEE2RTZxR2s1Y1lwRHFlbzhaNG85cVM2dUFiSytmY01BV2hXajdiOElEL2dkamwrNXlhNWZkQVMyQXFvbVBrTllTbUdKck5rY3lacGVaYWpPOVhoRUJLNzVHNVdFMUhHYWRxMVZyM1h3bDR5YkhQcGdvMWFKT0F4V3pLb2ZtV3hENUtVaWJLMS93VDM5dE5NU2NqcDdid081bEdqV0wwc2V4NzgyUkczM0ZqNlRVdDJIVTF1alN5OTd0eTIyb081VEd5d2xEZnhZV3BPWmpPdDZqaDVHcmFyWVBOWndTckpoN3JROVZwOU9GSldKa1pGN2FPYndJc25hNGZILzd3aCtjY0NDQkdIcHdsdER3Z1FyVGtWM2duRjJKU1NtZmRURzVITEdueWRPWlUxNld5T3M0VmI1U2Q0VHNiZnQzYzloUXVHZkdxYTE0SG1sWnRrbWlOT2tLandreDhKa0psQkpWV2hxaWF3cjVjNlpSbmk5VE43L2R1ckh0Tko3OGt5MmxIa3J6Mnpxb2gyVkVSVmo2MExqZFN6N2RkZnlQUDYrSXZkWmdmbVpHamtkaGRtU1ovb3hWdzNpbmxKUWRDbU5aTXR5RmVvUi9aeVIwSldCc1NqS0FkM1pUY21vQWJoVzFySnhnRlZqS2t4SnpDYk5RbXRpdG9HeUd1ZlU4ZlMwRlpuMDBLcEVSSzVQWGFwVDZqVUNPVHljMFF1UTBFMC85d24rbjc4OVl5eUhTeHAyMlhRRk5iYkNWdmtRUlpJMW1kLzdOVkJ1bHlINk9oUUtNQlFSSktwMVZTc3FZL1lMVWlpRnFIOFFDaHg4ZXdnVnIyRms1b1F3ZS9HR1d0TzhUcWtzTmRJMXpkYkpmTy9rOFRzNDdTNnhLUW94QndSdE1xOUgxVVlsMFpJczNiTEVQTzZGUG1NNG8vY1FzR2tTR3NuRXptMnZSZDdybVdRYVlMdXNOMEE5Y3ZFZWRTVzlLdU5Xa0hXbFF5ZDdpdjdXaU4wY2lHcFJxU1VWNGxOVThTd1Nnem56MlVNSnVjdU92R2NaellxdGFwUTRVNjIzKzBkVG1OVVg1ajFHYXBOdFpJcDdvbUIvVUxhMENnWnE1SGVLMzhuZjZIdmtwRmpGZWhwYzlsSCthcytMU0tNM01iYVVyVnlGUXlpL2trUVo3dVAzMS81Y1pXWDlQT0YzYjIrcExUWE1PM1czR3dFL2pvM3pXdmt0cGtpVm1yMWhsMW9oL2xXUEo0Nlh2VUlFRFdwV1N0aHhXRkJoNTRzT0N6SE5uUUVYTXliQ1hTVWJ2VlRnTjJ5SURhYUx6bW1qcWZvUVB4NVc4NnRIVTk5aWlobDExR2N1MnFwV0FDTWV0ZFVoTlVoenNUZi9tLzZwUDRQejluTi8vTkVYbVAzektEVENlNHR4TloxMkd3dXJEckNGeVlFU3dKVCtiSXYydTU3UWdhWDY5ajFKR2xtazVabDdMRUtFczl2TG9hZU0ybWJKZFR0VmQxYm10ZjRuWDlqL1AzV1lKYzBjMTFnRkhGUG5YK1dHV1lycnQrRGUxMm5UTXIzcXFhWENPa3VCV1BtY1JMaHpzWnBtYkNLNFA0Ry8yT3JMdjNIQ1IxTjBjNDNQell4ejcycEkzdHZLYURYNjI5UEVMWWRsMVBLckszTTdsa2dLcE5LaWFyeThWVWN5MDFUNFhEZDhPQXV0ek1xTTYrWXd6UG1RVkZTU2daclZucURsUHJhRVlWa2gyWXNFc0Nqa3pNWko1a2dBeDdKOXdqMTZzaWZUdUJVVTI2Q2dISmZFajFEV1Z3dytINkFwVkIwb2VvVEpLZlpaQTB1M1RJaldMWmRoYkc0QnFvSHIzaWlpc3UyOWp1YXpyZ09WNmN0dlBTRktxdXVyQ1cyOG9RRW5ObGhrcEEyM0hVSmR3OGZrcW5lcDFkVjVhbEtWcHFubG80Vm4yQnBjRkRHVjd0YWxTNkNGRksxeEhUalFqWTQxUVRlTlF5cVpvLzFlUWJqZEhyZkorTVJubk9LalJ0VXlTSU03VkNFbmFIbVVxelNnYXEyZkhVT2h5UDBvUzczT1V1ODdrWng4ZkFwUTk5NkVPcjZmV3diVFBJZE5FbmVVSVRXVnRwenBEU08xRzV1VGlkSTk2Tlg2am0wS2dYVjVwcXFaV1NNU3VqalVDWFhlV2l4NWRCMGg3MzJGMXBiNmNSc3JkWU4xTmxIWU5VSjN0VTc5SXhaYjIvT3Nnb3MrcHBkamtJcU5aMjVEWFdOYTB0WW4wdU5xZXc4NlIxR1BvSDFheGFsdzJ2RUpMVUpqcjM0Tm5vSmVDa1huQjB2RDcrOFkrdlB2clJqOTQ0ZlR4dTQyQmUwOFh1eVl0Q2t5UUIxMUVKWFUxR2RjNjdaRjhORVZkbThudDltR1N5cXFVazVPNzh1WDgzQzZXR25sTkNjbHo2YW5WbW51Y2IxYWpVaUZnRlRuYTVvczZmNktKcG5RWlo2alhXTlFJYzVZZGt6RFFscSticHJJb01sR1JpTHlFMVJwSFNOUExkM21UcGo5U0VYL1ZOTW9PdVZuS2dLTVZtWU45STRNb1liQi83Mk1mWUx0NDQyTmQwd2pNclROaFcvU09ZU2ZVTlJneFNtYUQ3WEdQcFpKOHJnOVQ4eWFpR3ZacC9iaGtVcUwrRElTc0VKcE9uMWJmb2dKM1p1N2o2R1IzYWVRUi9HYzErckxOYkt0eDdaR1oyT1l2S0hKMURYNituOC9mU0gzTStvMkhha1U4aGc5VHZyTitvMFNmTnJab3R0OTBxZEFyK2pSb2J5cVluVFRFenhNMDMzenkvd3lDYnIvc2ROSU5NTjNuY2RPTHIwdW5oSm0xbmcwUk5abkRSSktMcW9DZWpqTGIwVlpiTXJTNGFOc3I4cDExZGZhSDBoMnI0TVJuYTgxcUhYODI4M0wvK3JzSTRSbEQ4VWEvaUxzK1RjK2hyTGlOL0k0Tm1LTFltQ2J2SVhXZFNkWDVQOWlmdytFTDlLeU5raEVtYWtzaFRDMlR5THYrWFhTeHRqaUZxbHpvYmVwWHhtU3BRMnF1Ky8vM3ZWMHVzUHZLUmp4eGdFaGxrMnE3YytFUmYwOFdja3pka0Mzd3VuZ1dCU1pTMG5lYW9mNjlqbEtYLzF3ckZKZTNRSlJKSDBiVmF0RFZDSE5kN1RDSm1EVmdMR1hDcE84dFNicVlMSzQ4aVhOWEhxQVN2UUtnOWM3T3BXamZiSlgyYW1pU3NqS3FnVVdQWXdiTHpHWkpCTXZ6YU9kZHFELzJTTkxuOHJmNEZ6amQvZzMrakl5VU13RXVOd1FaenlDQ2FXQWZsbk5jWDFWWFRSZTJ2MlVtZEtTTmNFa2duK2F0VVhhZEZPdUx0Zkk1UjlHbUVHZXR5TFg0bmszZEJoNnFsdHRLQ3RRc3pkeUhtNmx4M3ZsQUh3ZS9hR2kwVm5OWGd3dEpNK3pvSnJJT091SWFXeWFicHBBQ3RKbEVpYnF0cFZCbEpoc2hqcUZIMEx6Z1hxR282VWNJWU1FQTQzek5qeUF6NkhPR0RYRE45dk1QR29YaE5GMzV1VlkycU9jcy9POEpQYzJZN1crZlRWQWQvSk1tNzY2aWQ2VHRUTENOVjY1REVvenI0VWJDaXc0aU5jR0NqWnVEVlRLdGFyWXRNMWVTYzk3aWtxYm9oU1oyZzRITkNQclFzS2lpd2htR1RjZEtzeW1pVXByelFFSjEyU2dvb1YrYWRIZ0gwSWFZeE9KTzkwcS9Jei9VOVhtZHNIS29YV21SaWhwdGtpT3hibTdaZzVpQ1dZQ1pMMnlnaG1NZE53a2tpV2RKUVhUSnlpZWlYOWhtWlRHaWhwVjdGbVc4WU5ibnJZUHdkZzNRTTFlVmF1dVlabzdaTE5jcW5ka3Nmdy9xT3hEVFZzbFY3ZW1VVVNwcXBabFV5VVFJTEU0b09ROXoxcm5lZFo3VlFsc3c0Q1lhemFqTFY5OVFXdnBmWHRZZE1ld1NUWENBemRJWHVUbDB5Yzd0ZDdWSE5ucTcyZlFtSFZjT3I2WVRuTmdvL1oydlRFWk50dFVuM1ZnUkVwOEZxTjVkMXpTcEdXcVhXWTR5SzNWS1QxdkI4WnJxejQzb0NCMnVQNEE3L2xCRW5HU2ZOcW1TUzdBTm1jd3A4REw2akxTeU1nZG1rUmtqL0lqVkVtbFdONXVCMTFzYWhmdDNqSHZjNGNickptNm9mVWhNellyaTJ5aEJWNm8rSXF3dkgxa2hSMVNZcCtTcGhka1RiNVVlNjM0NUtqak54dUdTbWRYWDJTdmFsc3VVTXJYYlJydFRDQ1JJY2xTVFVmRThYZXM2UmRoMXN2S3ZnUzFOSlRlTFl0aXhha3NIUzlISjREMXFEOHpPQml4cWJEMzd3Zzdjd2w0eEdsYWpVTGZZWk1NZDFCNTBZM0s0V3lkNU8yVitJRzdWWWFhUkpLc0duYjdBa3dkT21ybEt3ODFkcXlIZ3JnWUdSRmx2SElGdEZIcS9MNUkvcVdrWjRycTdjb0d0eTBkMW5oZEtJRnNqQ0pKOXpKKzFIVEpKT2RZZkU5VmhxQ3h4dlIycFRza3lIZXFaNjBUbS8raEtWOEJmOGpOdEdlNFN6ZnZlSlFXNnU3VktxRFdwQ3lPcTBmRWd5aklTZGtyOUdpU3J6cEpUdm9DdHB3eWVScFAwOENpY3ZFWElYUGg2MUpPcVNoNk5TNWE1dVpna2ZsaEdtcFdiZHFjbHk3UkxSN0xHTTRHWHo1dlFEbHJxQzFNM29VMDNrMVgxRU9xY1poZGFnYlBtU1N5NlpaMEZTdXF3Wk5mQWpEdWExZjlxTzN6aWNyK21tejJ0YU5kNGlUSmRxR096TmtwU3YvYlR5NFNVQlpMUHNsSFFKWVI5QlhHUzZEaHZXU2RXbEZrZlZGS3ZIVGZPbjNuTVgrdTdNdk81K011cVY5ek1DV1ZhbVQvK3JtcHFzb1VqWDZtZDJNUE9PU1dTT0RoTlZFMzR5RHFoYTZ2bHBpVVE5L3ladzhJQnpYVExlaCtKMTVzYmhmcEZkbjI1OFgxZXgxYlZhc1R0NVo3Skl2RFZFcThRWC81VFNyaEoyU3NWSzJEV3YwVG5nSXlrL2Nsbzc1aG5aOTZOUWRkZnNlNTJ2azJqWUpQWlJtOVdPS2ZOY05xeVRjSFc2dTRLamprRkdtcVJDUnZJN3gwTFE5QnVHcE1QOXExNzFxcmxYV09Zb0RzSnMyc3ByNzhadDlhSjNxWXVFeE1sdTVMbDRpYmkwcnFURFQxV2ZJa0dITlFwVmlUb2xadFZFWFJIVmRrTE9OY2w0TUUyN0s0TjAybWhrYW8yYytlMzBLcTZKV2lzZ0pkZ09ORmg5aHRRTVM2YVd6bmo2SzJiV1lRcG0xWFArYzg4OWQvWGExNzUyRHRYV2lGT05SaDJpRjZHdmUyM2NscTlwQVM0MXE1bFZXbWxxWmRHTFVZenNabEZWZmNjTUhhTmt0S1l5V0ZkL3NsMU1XTFhkcTIvVUJSN1dhYUZxbmkxRjdVWVJzSzVCM3loWldpRTJPWkdLYmlwWlA5RTUyMzdPMEt3SndBNUJtMXBDTEJiUDMxN0VuSisrd3lCcWlVaWhNZkF6TUt0cW1QWXd2QzdjdUsxZjA4MmZUTmpYQldOUnFtT1hDUitsRVB0M1RkeTYvRVYxdmp1aTc2b0t1eXgrQjNrWm9ZMHIvS1JxcnZTcGxxb251N0R5VWpmNnFxMjY1RjJIN2VvaWI5aytGRC9RanZBVlBDZ0QxQVJlbDhqcnRFbk5keWdvNlVkTWNvOXJZTTdLdGRkZWV3c3pxbUtrYXBUcUVETE1kWWZkTVY5WGRaaUwyMFcxY21IdFRKRXRMZXRXR2FRelZaWXdXeDNoZHd5emprRTZUV0d3d1BPc1M0Z3VtVlJMM1ZrNmpUSUtLSFROTThoMkorR0tqK3JnSDhKQ0VsMmJ2a05ON0kzNjNHSk5ZRXJ4VGcwR2pFRWY0aVQ2Q2hwTVovd3dPT1dIQnBCNHNDL0dWRTFTNlpxS3hzekdYRFVPbmt4amk4MGt0SFNrTzh4VVI0RFZHUjBsR212bWVDbkRQY3JMVk9hdDViMVZlOVRRODdyV3F0MTFKek5XYlNaSU5HRWdZcGQ4QmhLNmpGQWpVZWxZZDBuQUdzTDFzNGhhb2xGc1dCSDBLbjcxcTE5OXdQSHVJQ0Exc2JlRnpQZkJ2cTdZdUwxZmQ3clRuZTVuczJZYk45ZkY3aUloYWhoK1YwT2pOVmRSZlkrdGFJV3RNTWhJK21kZXByWlFyZnNhZXE3bzRKRkoxU1gwdW1LeldvV1lhOEE1L2Rzb24vMmowdW11U1QxTllSa2xpWDZkQXk1ajhGdTcySk8vT09HRUUrYnpBVFcvNnFxcjVzU2VESkRtVTJkQ0hXWUd3VEUvWmVOSWVFMk8yRVhDQklBSXJHc0pXVE9zU0QySk1oOStsZG9wUFVmWitZcklIVUh1MTRFYTB6SHZ3c0hWa1UvRXNJMjZQVWJIT0ZVNytuZEYwdWF4cmIzSlRpUzFLWE0yUDZobVVvSUZsNWlnL2k4UnRmeVAzQVdPTitkZzZNK2IzdlNtdVNBSjRzYnhIaFFuM2RZTWN2YkdrZko2eWxPZWN0eXBwNTU2SlJva3RjY29FMXNmSk85T0tLM216SFlLcWthUWlpNFFzSzZpY1YwZFM1NnJWa0dPUUpaTDVseUYwblQxSjM0MjQ2MkpZNEZTK25valRaRFBZSVNpN2N3dnRBU013VHVqNFppTDhwYTN2T1VXOVJkcWk0NHhidVBYWlJ0SDJ1djg4OCsvKzkzdWRyY2JnUXp3NEJLTzRzUExlZUcxakZmMWI4V2I0NVVyTVkxQ3dLTkNyUzVYc1pUUnJyYi9VcTZpbHZwV0I3cUNNanVtVHhoSTFWYWFiMGFrbkgrUllmVVJEbXBkQ0xmbU9hckdNRlNMYndGR0N1WTQ4OHd6NTNIWWIzdmIyK2J3YkFVTkhzWkkxSFplUU5sUDJEZ1NYODk3M3ZOT0orN05vbmFtbFlNb3UrNTRKaDE1dDVmVEtFVGJtVlZiaGRlUG5QaVJscW9tVk5md29lWkxSbTJPRWwzY3RTcEtIeXpiNXpnYXVtdXphUXVkcGF4MkpYNjNOTDlrQ3R2eVlDclRRd3JtWUdBUW5ldVpGNTl3ODdwMXpuY0hLanlNTHk3dVBodEg4bXRheUl0NGtKUkVxcmJWRGp3TXh5anJUS1pLNTIrY2ZCNldwYnhwcGxScG5GSlpqRkp0U2plQ3RZL01ucEZmVTUxazY4K3I5cWh0aUNyY1BpTnZOVnljeDdQK29tYW5jODdGa3Fib0lPZ3BsR29lUk9DZ25VSDRURVNLc2RSVTdFbmcrQmUxbFBVd1I2S09UcjlqOUFKci8rcFh2L3BLSGo1UkRoYzlrWnhDcU5QVVN2c1hKbUUvbmZlYUlPdytwL1E5bUc0cTJ5M3NXcW84VEcyUkRGS2Q4bHJBWlRNRkUzdjZGNXFnb3dsS0k3T3EvcitHM3JPL0ZQa0xHSVByeGZHR01aSVJNaG8xcXIyNG5SbmtzbzJqNVRYWnAzZmZ1M2Z2all3WUk1dWFTU3FsbUE4OXMrMmFXT25nd3lSZFNGWWJQYzJjYk91ekxscFZFMy9icllEc2ZJN1JuSk91SlZGV1hqcXV1RFpXeTV6UlZqUkU1MnRVK0U4MjF1YjRSS01RWkR3cjVpWlNnMEc3bkhWRlNVZVlCamx5L1k3UmE1STRwNy83M2UrZUo4REtKTUpTT3VSdkIxSFJES3NScmt6QTBVd3VjVm5yektRbDh5azdkYXlMa2xWdE1zSkNkZGx1LzA0enF1c1BsVDVETWttTlZtVTFYaGV5clVOazJJOVdPVERHZ3g3MG9OV0xYdlNpMVhYWFhUZWJUN1VvNlFneW40NWV2MlBCM0RvYmFmUzR4ejF1ZmlBU3ZRTVVjUVJUazlUUWNOWXlaMy9nYkR6Z1o3UUF6TEtPR1dwa3FhSjhhOFJwbEl6czBNZHFvZzRpbjlFcTdzT0t2ZXcxVnFIazFVK29MVHByUmp6TjJRb2s1SjMxeHVuR0Q2UXJDRkJ6bVNMN1NHM0g4VDRDWHFkdkhNMnZhWUV2QUhidzFLYytkYlp6MmRJSHFUVWw2YnduQWNoSWx2TFdZVGZwOUc0bFo5S1pTWFUyeWNqMDZ2SXRYZjZraG5BdFRPcE1JM0ZxTlFTYldxUkwvS1hteVRhZHFWVmdETnB4c2kvQ0Npakk5ZGRmZjZ2UTdDaXgxOVY4SHlHdnN6WjJ3bXRhMUJjVElzVEd0Uk5lNWtDcWZWeFJ3UktQRllyWkhaMTNzdFkxY1pkRFBFZDl0YnFjeHRKb3VacnB6emFrTmFtWHg4NFozbll6cjAzVERObDJabGJ0TTFVN2dpU0RDQU5oN1Z4cjF1ZnBUMy82Nm5XdmU5MGNxdTBZWXBUWU93STFocTluYmV5VUZ6MklKdFY5T1RDRVY3emlGZlBEUTlWWEg2U0dJVHNHeVFLc2hIWUl3K2hNcktXNmllcXNtOG11TmZBMU1UaktxS3NwOUM5TXVKa2tUVEJuZGpLdk1JOWFrK0YrTmVmaFJLdjBNMlFNcnVuWnozNzI2aDN2ZU1jY3FsMHltNDVnRTZwN1hieXgwMTdUVGQxeGN0ejNZdU8rOHBXdm5COG1OUU0rOEJydXJTMU9Pek1NNGtpQ1QrYkluc0hkckk4Umxpb2pZMm9NdDNYRlhBWVBoSnJYMWtoRzg5THg3clREQ0NSWW1ja2tJWnY0cUR2ZitjN3pmVHozdWM5ZEVTU3BVSkN0UktPTzhOZkxEbm5UdHlPSVNVNmNHT1JxbU9TS0s2NlluV28wU1VMaEs0TklXT1pHS21JMUo4ZU9FbnNWRzVXK1JXcUFDcGlzKzJkSU9VMHFPeWFLajZxUThhV21CL1Z6TFY2cTJlL2NPSlkxR0RBTVVCRG1zMU9Ea1hrTEllZWpYTVpSeENCWElHZzNkdkpydXNHVHB3ZDFIUS9pclc5OTYrcWhEMzNvQVFmU01zMVJHRGo3dHViLzFTUWpHRXJuT0hjNHFsRmZybzZaWkNpMGhTaUJycnRMTWtFMzB6dk5xdFFvcVIzeU8ydThNYU5ZTjh5NUp6N3hpWFBYd1J0dXVLRjFyTGVUeXppQ1gxZmZicFdCdHdlVG9FbDRJUFJBZXN4akhqUG5Tbmp3aVFqT1dkWVNUNDF5U1d6WjlyUnFqVm9Ea21aVDdTd3lNci95R0dpTXpIYlhFRzNXV2xUNGVOVXVWU3RrYWJKTWxYWGhNTVluZmRJbnpYL1RkZkROYjM3emdScU1yY0xMajhMWEZVZGRJdkJRbUZ1MFl1SHVzWlhCL1ZCOFk3SXJJU2t3amZYVVMrT0FNWEc2K1I0ZCtyYjZGclVXSkJrb1lTQnNSb2xHalEvU3YwaC9JUk9DTWxnMlVhdU9lUUk0QVhvQ0JPVjN6M3ptTStldTVyVktyM3Z0QU9hNGRNZWJWV3NjOTh0NWNJUWZlZkF3QW5INzdJcFNoOFozMmZnY0VXZUVxL2JPcXY1RWx3aXMrQ29qVWpyZVhmNWkxSnUySnV4a0FxZTZkbFY5R2RreWh3R3pQT1FoRDVuRDVHOS8rOXR2MGJrYzJMbkp2UjM0dW1USE91VGJDUUdUSitFQjB3NkdlZ01JQldsWnc3OFYzRmlaSktOZTl1SEtpVWxkeFdJSFg3ZmNWYWU3Rm5xbGhNL2dRUjBDVXpWS01uMDNnODkzSWxMY1Avcys0aEdQbUVQamhHcHJscnRXN2UydzF3VWJ1NjliWnR5RlV3T0JjSzYxa3RROFFzNG9NYnZlTVlwOXVOSmtTdWZiV1I0bUhXVWNTMW16ejFkdGdqZWFuTlFOdGM5R0NhTkpyV29XN28wWkdQZ1pkQjNjdTNmdjZyM3ZmZStCeVVrSkNkbmhESExXTGtmMFRISzJvVWpDd0dnQkpDbjJkenJDZk80cUU3dldtQkJmb253N2NLTEp2YXpZeTFhY28rSDBTMjMvNnh3KzJ4MVZjMG9maXlJenZudkNFNTZ3ZXVNYjMzaWd4dHNlVWxuT09rcjQ3WURYemJkcm01NmpCUVhNY0hjZU9NMEFIdjd3aDg4SlJSbkNkKzM0a2JubC95QStpTlJPOHpsaVd2UEw5dnZadURrTGs3b2hsRFVmMC9ralZZUElJUHpHY2NXOFArQUJENWloSUs5Ly9lc1BkRFd2Z01FUmFQQjJydjArbEM4YXZOMXZsd08yNXBmY25SRzlyQnJSR3V6d2swNDZhU1ppQ1JMQ1QxelR5QjlKQWhhckpGNHBSeFhuYkwzMEdWSmJWS0JoSFRuV0RhbE1IOFFtQ3pBOG12SDAwMDlmUGYvNXp6OFFxdDFxMTQ5dERJczVXbDZYRTlYY3BmenRNY2x4azNTOENBbjV6bmUrY3pZOWFINnNVNXhvNE03RXlyOGhTc3cwdFlTL1M3Tk5oc2xPa0pwR3RWdjlxSE5rZGRZVFIyVU9BNytLR295WHYvemxjMkxQK1Jmci9JZ2RHcVhDcERyM21JOVVIUXFUQzdBZGtIbXdSblJPcWRucU5IKzZMZWZwMVc0cW1aeXIrQ2cxaTU4elk5N1ZjQ1NqY1F5WUVxYUFRUmxBK1pyWHZPYkFISXgxU05xYXk5aGhyMTJUNmxDOUtPR2RpT2hLSEZmUXFiYlRyK1pNNWtzNkI5N09IUWtPVEEzUU5YRk8vOExQRllHY2RSc2NuKzl3dWpHanlKODg2VWxQbW1zdzBCZzYyd2tlWERkQmFRY3l4NjVKZFRoTXJvbWdMa0w2dnZTbEw1MmRhNGd3RzBIb1pGZVRLeUVyUktwa2tpVkViVGNBcHBheGVoNk82WVFtcmdubXBRYmpHYzk0eHV4NHYrOTk3N3RGTktxcjlUNUdYcnNtMWVGK1RVUjJ2MG1UWEVQeEQ0UjVwenZkcVUwbWRnd0NjVnNEbm1EQVdzcGFlOVRXWEVZeWtkL2plQU0zQjJiL25PYzhaNTZEWVhPMVpJeFJPZXN4OEhyRDZyWWVZbk1zYTVOcE8rZU5iM3pqVFlSdmNkNjdSblNWU1NCbTBiY1pXY3IzZFF3aVkxaW9aRVRxd1E5KzhPb0ZMM2pCSEZCSTA2Z0x6eDdDb1pSSHc0dkJtWS9jMVJxM0Q2T2NmTTAxMTF6NnFFYzk2a0NpcmZvS1JxNnkxNVpWZmhWTzNwVzFKb1A0UGNmaWZEQWRYVnRlOHBLWHpLamtDZ0hwL0ljZGx0aGJXL2wzektGd2o4VFhaTTZjTmpuQyswaThFZUhLL0laaFhiUHhXUVpibmZQTVphVC9ZZlFMMzRKUUxZbkdKei81eVhPMmYvLysvYmRLNk4wR0k4V085TmRWcTZPMUZjOU9mZTNidCsrNHB6M3RhZWZkNVM1M3VabnNkT0tsZE9DRm1kZlMxU3huclUwUVlESk11Qk5QUEhIKzdmbm5uejhuOWdCV2loMWpPOHhUa282VzE0M2dxSGJOcVNQNDlkem5QdmZ1a3hhNVlHS1NtMnFMSEdlUjJNV3dHeldXQXlzeG8zQzhnWUxRN2gvSGU1MS9jWXhxRC95TTgzWkR0MGZSNjc3M3ZlK0premwwd2NRWU45bXNUaE1yUVltMTlKWDZDK0RtL0k4YWpFc3V1V1IydkVkbHExdnhMM1l3dyt6ZkROc2V2MHR4UitscjBnREhULzdIdVJOejdCZTBDSVBrYkc5YjVWRDJ5OTlubjMzMjNIa0ZqVkdyOXJhQ29EMEdOTWgxbTZiVWNic1V0b01ZWmRJZTUwem0xWFdZV09aRE1LTmdEUHdORW50QXpXKzg4Y1lETlJoTERaeVBzZXozakIzZFpZeWRiM29kTjJtT015ZkcySVBKaFJsRll1OWQ3M3JYTFlpNmZ0NEJ0ZDJmU1BhYnV2RFRkNTN2WSt5MVo4K2VrMjY0NFlaekpvSy9PcXYwMWpISE1aVDVQbXMzajdIN21sOGYrY2hIN2oweHg0VVRvMXkvNUh6dmNBWmh6c2I1MDNicUxrWHN2dG9YWnNURUtLZE5qSExKcGpPNjB4bGszN1E5WnhkNnZ2czZXSVk1QlN6Ulp1ZVYvVHVBUVdCNm1QOE1vRHE3VDNqM2RhZ1o1cDZidHZtbG01bmpveUZYOGNKTndPQXB1MDl3OTNWN2FKZ0hiakxOUmRPMlI5UHNkdkFmTHB1MkM2ZnQwZE4yLzEwTnNmczZraG5uZU9vZnB1MWhtOW5taXplM2wyMHkwWjVOKzMvZnBwU3ZyK3MzLzNkTjdQL2l6V1BnTTV5ekdYcEZvOTF4ZDhVUHordi9BN25BWGNLUHQ1QUtBQUFBQUVsRlRrU3VRbUNDO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxOTQiIHk9IjM1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQxIiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UgLT4gRW1iZWRkZWQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1jNzQxMTI4YS01OWIwLTQwMDEtOWUzMC04MGQ5ZTRmYjdjNWY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTA7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MTtlbnRyeVk9MC43NTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI3IiBzb3VyY2U9IjM1IiB0YXJnZXQ9IjM0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzQ2IiB5PSIxMjIiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNSIgdmFsdWU9Ik90aGVyIGRhdGFiYXNlIiBzdHlsZT0iaXIucmVmPTgyM2VlZDhlLTc5YjQtNDMyNC05ZWI1LWJkZmMxMmVkZjJhYjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1vdGhlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TURFMU5pQXdMalF4TlRrMU5rTXdMalk0TnpreU1TQXdMalF4TlRrMU5pQXdMamcwTURFMU5pQXdMak0wTURjM05pQXdMamcwTURFMU5pQXdMakkwTnprMU5rTXdMamcwTURFMU5pQXdMakUxTlRFek5pQXdMalk0TnpreU1TQXdMakEzT1RrMU5qRWdNQzQxTURBeE5UWWdNQzR3TnprNU5UWXhRekF1TXpFeU16a3hJREF1TURjNU9UVTJNU0F3TGpFMk1ERTFOaUF3TGpFMU5URXpOaUF3TGpFMk1ERTFOaUF3TGpJME56azFOa013TGpFMk1ERTFOaUF3TGpNME1EYzNOaUF3TGpNeE1qTTVNU0F3TGpReE5UazFOaUF3TGpVd01ERTFOaUF3TGpReE5UazFObHBOTUM0M05qa3dPVFlnTUM0ME1qTXdPVFpETUM0M09UUTNOemdnTUM0ME1UQTJNek1nTUM0NE1UZzJOelFnTUM0ek9UUTROVGNnTUM0NE5EQXhOVFlnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0NE5EQXhOVFlnTUM0NE5EUTNOellnTUM0Mk9EYzVNakVnTUM0NU1UazVOVFlnTUM0MU1EQXhOVFlnTUM0NU1UazVOVFpETUM0ek1USXpPVEVnTUM0NU1UazVOVFlnTUM0eE5qQXhOVFlnTUM0NE5EUTNOellnTUM0eE5qQXhOVFlnTUM0M05URTVOVFpXTUM0ek56WXhPREpETUM0eE9ERTJNemtnTUM0ek9UUTROVGNnTUM0eU1EVTFNelFnTUM0ME1UQTJNek1nTUM0eU16RXlNVFlnTUM0ME1qTXdPVFpETUM0ek1ETXpPREVnTUM0ME5UZzNNVElnTUM0ek9UZzBPVFlnTUM0ME56ZzVOVFlnTUM0MU1EQXhOVFlnTUM0ME56ZzVOVFpETUM0Mk1ERTRNVFlnTUM0ME56ZzVOVFlnTUM0Mk9UWTVNekVnTUM0ME5UZzNNVElnTUM0M05qa3dPVFlnTUM0ME1qTXdPVFphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0MDkiIHk9IjMzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM3IiB2YWx1ZT0iU2Vuc29yIC0+IElvVCBBcHBsaWNhdGlvbiIgc3R5bGU9ImlyLnJlZj0zNjI4NGJhNi1kZTI2LTQ0ZGItOWM3NC1hZmIzOWE3MmIwY2E7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTA7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI3IiBzb3VyY2U9IjM2IiB0YXJnZXQ9IjQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzNiIgdmFsdWU9IlNlbnNvciIgc3R5bGU9ImlyLnJlZj05MjQ2ZDg2MC1kYjMyLTQxOWMtOGZlNi1lOGZhMmVlZTE0YTA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtU0VOU09SO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpJMk4xOHlNall4TmlraVBqeHdZWFJvSUdROUlrMHdMakkyTVRReE9DQXdMalkzTlRBeU9VTXdMakkzTnpNNElEQXVOamt5TmpFeElEQXVNamsyTmprZ01DNDNNRGMzT1RFZ01DNHpNVGN5TVRrZ01DNDNNVGt6TlRaRE1DNHpNekF6TnprZ01DNDNNalkzTnlBd0xqTTBOalV3TkNBd0xqY3lNVEF5T1NBd0xqTTFNekl6TlNBd0xqY3dOalV6TkVNd0xqTTFPVGsyTnlBd0xqWTVNakF6T1NBd0xqTTFORGMxTlNBd0xqWTNOREkzT0NBd0xqTTBNVFU1TlNBd0xqWTJOamcyTkVNd0xqTXlOVGt3TXlBd0xqWTFPREF5TkNBd0xqTXhNVEUxTkNBd0xqWTBOalF6SURBdU1qazVNalk1SURBdU5qTXpNek01UXpBdU1qTTFNakU0SURBdU5UWXlOemtnTUM0eU16VXlNVGdnTUM0ME5EZzBNRGdnTUM0eU9Ua3lOamtnTUM0ek56YzROa013TGpNeE1UY3hOaUF3TGpNMk5ERTFJREF1TXpJMU5qazVJREF1TXpVek1ESXpJREF1TXpReE1EZ3hJREF1TXpRME5EVXpRekF1TXpVME1qY3lJREF1TXpNM01UQTBJREF1TXpVNU5UVTJJREF1TXpFNU16WTVJREF1TXpVeU9EZzBJREF1TXpBME9EUXhRekF1TXpRMk1qRXlJREF1TWprd016RXlJREF1TXpNd01URXhJREF1TWpnME5Ea3lJREF1TXpFMk9USWdNQzR5T1RFNE5ERkRNQzR5T1RZME9UY2dNQzR6TURNeU1Ua2dNQzR5TnpjNE9TQXdMak14T0RBeU5pQXdMakkyTVRReE9DQXdMak16TmpFMk9VTXdMakUzTmpRMk1pQXdMalF5T1RjME15QXdMakUzTmpRMk1pQXdMalU0TVRRMU5pQXdMakkyTVRReE9DQXdMalkzTlRBeU9WcE5NQzR6TkRFME9EWWdNQzQyTVRRMk1qZERNQzR6TlRNNE1UUWdNQzQyTWpneU1EWWdNQzR6TmpnNU1EVWdNQzQyTXprek5DQXdMak00TkRrMk5pQXdMalkwTnpBNU1rTXdMak01T0RVd05TQXdMalkxTXpZeU5pQXdMalF4TkRJNUlEQXVOalEyT0RNMUlEQXVOREl3TWpJeUlEQXVOak14T1RJelF6QXVOREkyTVRVMUlEQXVOakUzTURFZ01DNDBNVGs1T0RrZ01DNDFPVGsyTWpRZ01DNDBNRFkwTlNBd0xqVTVNekE1UXpBdU16azJNelV4SURBdU5UZzRNakUxSURBdU16ZzJPRE15SURBdU5UZ3hNVGt5SURBdU16YzVNek0zSURBdU5UY3lPVE0yUXpBdU16UTFOVFE1SURBdU5UTTFOekl4SURBdU16UTFOVFE1SURBdU5EYzFNemd5SURBdU16YzVNek0zSURBdU5ETTRNVFkzUXpBdU16ZzJOemcwSURBdU5ESTVPVFkwSURBdU16azFPVEF4SURBdU5ESXpNamN4SURBdU5EQTJNVEE0SURBdU5ERTRNelV4UXpBdU5ERTVOalVnTUM0ME1URTRNalVnTUM0ME1qVTRNalFnTUM0ek9UUTBORElnTUM0ME1UazRPVGtnTUM0ek56azFNalpETUM0ME1UTTVOek1nTUM0ek5qUTJNVEVnTUM0ek9UZ3hPVElnTUM0ek5UYzRNU0F3TGpNNE5EWTFJREF1TXpZME16TTJRekF1TXpZNE5TQXdMak0zTWpFeUlEQXVNelV6T0RBeElEQXVNemd5T1RFeUlEQXVNelF4TkRnMklEQXVNemsyTkRjMlF6QXVNamcyTnpreklEQXVORFUyTnpFM0lEQXVNamcyTnpreklEQXVOVFUwTXpnMklEQXVNelF4TkRnMklEQXVOakUwTmpJM1drMHdMakU1TmpreU5TQXdMamMxTWpjeE1rTXdMakl4TURVeU1TQXdMamMyTnpZNE9DQXdMakl5TmpBek1TQXdMamM0TVRnd05pQXdMakkwTWpFNU9TQXdMamM1TkRBNU4wTXdMakkxTkRNMk5DQXdMamd3TXpNME5TQXdMakkzTVRBek15QXdMamM1T1RrM09TQXdMakkzT1RReU9TQXdMamM0TmpVM09VTXdMakk0TnpneU5pQXdMamMzTXpFNElEQXVNamcwTnpjZ01DNDNOVFE0TWlBd0xqSTNNall3TlNBd0xqYzBOVFUzTWtNd0xqSTFPVEEwTXlBd0xqY3pOVEkyTXlBd0xqSTBOakF5T1NBd0xqY3lNelF4TnlBd0xqSXpORGMzTmlBd0xqY3hNVEF5TWtNd0xqRXpNVEV6TlNBd0xqVTVOamcyTnlBd0xqRXpNVEV6TlNBd0xqUXhNVGM0TmlBd0xqSXpORGMzTmlBd0xqSTVOell6TVVNd0xqSTBOVFEySURBdU1qZzFPRFl6SURBdU1qVTRORGdnTUM0eU56UXhNelVnTUM0eU56STFNRElnTUM0eU5qTTBNakZETUM0eU9EUTJORGNnTUM0eU5UUXhOREVnTUM0eU9EYzJOaklnTUM0eU16VTNOek1nTUM0eU56a3lNemNnTUM0eU1qSXpPVFpETUM0eU56QTRNVEVnTUM0eU1Ea3dNVGdnTUM0eU5UUXhNelVnTUM0eU1EVTJPVGNnTUM0eU5ERTVPU0F3TGpJeE5EazNOME13TGpJeU5UUTNOeUF3TGpJeU56VTVOU0F3TGpJeE1EQXhNeUF3TGpJME1UVXlOQ0F3TGpFNU5qa3lOU0F3TGpJMU5UazBRekF1TURjeU16YzVNaUF3TGpNNU16RXlJREF1TURjeU16YzVNaUF3TGpZeE5UVXpNaUF3TGpFNU5qa3lOU0F3TGpjMU1qY3hNbG9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OGNHRjBhQ0JrUFNKTk1DNDNNemd3T1RRZ01DNDJOelV3TWpsRE1DNDNNakl4TXpJZ01DNDJPVEkyTVRFZ01DNDNNREk0TWpJZ01DNDNNRGMzT1RFZ01DNDJPREl5T1RNZ01DNDNNVGt6TlRaRE1DNDJOamt4TXpNZ01DNDNNalkzTnlBd0xqWTFNekF3TnlBd0xqY3lNVEF5T1NBd0xqWTBOakkzTmlBd0xqY3dOalV6TkVNd0xqWXpPVFUwTlNBd0xqWTVNakF6T1NBd0xqWTBORGMxTnlBd0xqWTNOREkzT0NBd0xqWTFOemt4TnlBd0xqWTJOamcyTkVNd0xqWTNNell3T1NBd0xqWTFPREF5TkNBd0xqWTRPRE0xT0NBd0xqWTBOalF6SURBdU56QXdNalF6SURBdU5qTXpNek01UXpBdU56WTBNamswSURBdU5UWXlOemtnTUM0M05qUXlPVFFnTUM0ME5EZzBNRGdnTUM0M01EQXlORE1nTUM0ek56YzROa013TGpZNE56YzVOaUF3TGpNMk5ERTFJREF1Tmpjek9ERXpJREF1TXpVek1ESXpJREF1TmpVNE5ETWdNQzR6TkRRME5UTkRNQzQyTkRVeU5DQXdMak16TnpFd05DQXdMall6T1RrMU5pQXdMak14T1RNMk9TQXdMalkwTmpZeU9DQXdMak13TkRnME1VTXdMalkxTXpJNU9TQXdMakk1TURNeE1pQXdMalkyT1RRd01TQXdMakk0TkRRNU1pQXdMalk0TWpVNU1TQXdMakk1TVRnME1VTXdMamN3TXpBeE5TQXdMak13TXpJeE9TQXdMamN5TVRZeU1pQXdMak14T0RBeU5pQXdMamN6T0RBNU5DQXdMak16TmpFMk9VTXdMamd5TXpBMUlEQXVOREk1TnpReklEQXVPREl6TURVZ01DNDFPREUwTlRZZ01DNDNNemd3T1RRZ01DNDJOelV3TWpsYVRUQXVOalU0TURJMklEQXVOakUwTmpJM1F6QXVOalExTmprNElEQXVOakk0TWpBMklEQXVOak13TmpBM0lEQXVOak01TXpRZ01DNDJNVFExTkRZZ01DNDJORGN3T1RKRE1DNDJNREV3TURjZ01DNDJOVE0yTWpZZ01DNDFPRFV5TWpJZ01DNDJORFk0TXpVZ01DNDFOemt5T0RrZ01DNDJNekU1TWpORE1DNDFOek16TlRjZ01DNDJNVGN3TVNBd0xqVTNPVFV5TXlBd0xqVTVPVFl5TkNBd0xqVTVNekEyTVNBd0xqVTVNekE1UXpBdU5qQXpNVFl4SURBdU5UZzRNakUxSURBdU5qRXlOamdnTUM0MU9ERXhPVElnTUM0Mk1qQXhOelVnTUM0MU56STVNelpETUM0Mk5UTTVOak1nTUM0MU16VTNNakVnTUM0Mk5UTTVOak1nTUM0ME56VXpPRElnTUM0Mk1qQXhOelVnTUM0ME16Z3hOamRETUM0Mk1USTNNamdnTUM0ME1qazVOalFnTUM0Mk1ETTJNVEVnTUM0ME1qTXlOekVnTUM0MU9UTTBNRFFnTUM0ME1UZ3pOVEZETUM0MU56azROaklnTUM0ME1URTRNalVnTUM0MU56TTJPRGNnTUM0ek9UUTBORElnTUM0MU56azJNVE1nTUM0ek56azFNalpETUM0MU9EVTFNemdnTUM0ek5qUTJNVEVnTUM0Mk1ERXpNaUF3TGpNMU56Z3hJREF1TmpFME9EWXlJREF1TXpZME16TTJRekF1TmpNeE1ERXlJREF1TXpjeU1USWdNQzQyTkRVM01URWdNQzR6T0RJNU1USWdNQzQyTlRnd01qWWdNQzR6T1RZME56WkRNQzQzTVRJM01UZ2dNQzQwTlRZM01UY2dNQzQzTVRJM01UZ2dNQzQxTlRRek9EWWdNQzQyTlRnd01qWWdNQzQyTVRRMk1qZGFUVEF1T0RBeU5UZzNJREF1TnpVeU56RXlRekF1TnpnNE9Ua2dNQzQzTmpjMk9EZ2dNQzQzTnpNME9ERWdNQzQzT0RFNE1EWWdNQzQzTlRjek1UTWdNQzQzT1RRd09UZERNQzQzTkRVeE5EY2dNQzQ0TURNek5EVWdNQzQzTWpnME56a2dNQzQzT1RrNU56a2dNQzQzTWpBd09ESWdNQzQzT0RZMU56bERNQzQzTVRFMk9EWWdNQzQzTnpNeE9DQXdMamN4TkRjME1pQXdMamMxTkRneUlEQXVOekkyT1RBM0lEQXVOelExTlRjeVF6QXVOelF3TkRZNUlEQXVOek0xTWpZeklEQXVOelV6TkRneUlEQXVOekl6TkRFM0lEQXVOelkwTnpNMklEQXVOekV4TURJeVF6QXVPRFk0TXpjM0lEQXVOVGsyT0RZM0lEQXVPRFk0TXpjM0lEQXVOREV4TnpnMklEQXVOelkwTnpNMklEQXVNamszTmpNeFF6QXVOelUwTURVeUlEQXVNamcxT0RZeklEQXVOelF4TURNeUlEQXVNamMwTVRNMUlEQXVOekkzTURFZ01DNHlOak0wTWpGRE1DNDNNVFE0TmpVZ01DNHlOVFF4TkRFZ01DNDNNVEU0TkRrZ01DNHlNelUzTnpNZ01DNDNNakF5TnpVZ01DNHlNakl6T1RaRE1DNDNNamczTURFZ01DNHlNRGt3TVRnZ01DNDNORFV6TnpjZ01DNHlNRFUyT1RjZ01DNDNOVGMxTWpJZ01DNHlNVFE1TnpkRE1DNDNOelF3TXpVZ01DNHlNamMxT1RVZ01DNDNPRGswT1RnZ01DNHlOREUxTWpRZ01DNDRNREkxT0RjZ01DNHlOVFU1TkVNd0xqa3lOekV6TWlBd0xqTTVNekV5SURBdU9USTNNVE15SURBdU5qRTFOVE15SURBdU9EQXlOVGczSURBdU56VXlOekV5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBqeGxiR3hwY0hObElHTjRQU0l3TGpRNU9UWTRPQ0lnWTNrOUlqQXVOVEE1TkRVeklpQnllRDBpTUM0d056Y3pNalEySWlCeWVUMGlNQzR3Tnpjek1qUTJJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qSTJOMTh5TWpZeE5pSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDExIiB5PSIyMTEiIHdpZHRoPSI4NiIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTgiIHZhbHVlPSJFeHRlcm5hbCBWaWRlbyBpbnRlcmZhY2UiIHN0eWxlPSJpci5yZWY9MzU2ODAyZWItZTVkNy00ODllLWIzMjUtOGNhMWIwYWNjODk4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjMiIHk9IjUwIiB3aWR0aD0iMTIyIiBoZWlnaHQ9IjQzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1OSIgdmFsdWU9IlVTQiBwb3J0IiBzdHlsZT0iaXIucmVmPThlZTQ4NWI4LTYyNTQtNGEyZC1hMDVlLTMzOWEyN2FhYmFmZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1VU0ItUE9SVDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qSTJOMTh5TWpnek5pa2lQanh3WVhSb0lHUTlJazB3TGpFM05ETXhOaUF3TGpJeE1qZzJOa013TGpFM05ETXhOaUF3TGpFNU1UY3hNU0F3TGpFNU1UUTJOeUF3TGpFM05EVTJNU0F3TGpJeE1qWXlNaUF3TGpFM05EVTJNVWd3TGpjNE56SXhNVU13TGpnd09ETTJOaUF3TGpFM05EVTJNU0F3TGpneU5UVXhOaUF3TGpFNU1UY3hNU0F3TGpneU5UVXhOaUF3TGpJeE1qZzJObFl3TGpjNE56UTFOVU13TGpneU5UVXhOaUF3TGpnd09EWXhJREF1T0RBNE16WTJJREF1T0RJMU56WWdNQzQzT0RjeU1URWdNQzQ0TWpVM05rZ3dMakl4TWpZeU1rTXdMakU1TVRRMk55QXdMamd5TlRjMklEQXVNVGMwTXpFMklEQXVPREE0TmpFZ01DNHhOelF6TVRZZ01DNDNPRGMwTlRWV01DNHlNVEk0TmpaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TVRnek1UQTFJREF1TWpJd05qSkRNQzR4T0RNeE1EVWdNQzR5TURBd016WWdNQzR4T1RrM09USWdNQzR4T0RNek5TQXdMakl5TURNM05pQXdMakU0TXpNMVNEQXVOemM1TkRNMVF6QXVPREF3TURFNUlEQXVNVGd6TXpVZ01DNDRNVFkzTURVZ01DNHlNREF3TXpZZ01DNDRNVFkzTURVZ01DNHlNakEyTWxZd0xqYzNPVFkzT1VNd0xqZ3hOamN3TlNBd0xqZ3dNREkyTXlBd0xqZ3dNREF4T1NBd0xqZ3hOamsxSURBdU56YzVORE0xSURBdU9ERTJPVFZJTUM0eU1qQXpOelpETUM0eE9UazNPVElnTUM0NE1UWTVOU0F3TGpFNE16RXdOU0F3TGpnd01ESTJNeUF3TGpFNE16RXdOU0F3TGpjM09UWTNPVll3TGpJeU1EWXlXaUlnWm1sc2JEMGlkMmhwZEdVaUlHWnBiR3d0YjNCaFkybDBlVDBpTUM0NElpOCtQSEJoZEdnZ1pEMGlUVEF1TlRreE1ETTRJREF1TWpVNE5qSTBRekF1TlRreE9UQTVJREF1TWpVNU1EWWdNQzQxT1RJek5EUWdNQzR5TlRrM09UUWdNQzQxT1RJek5EUWdNQzR5TmpBNE1qaERNQzQxT1RJek5EUWdNQzR5TmpFNE5qSWdNQzQxT1RFNU1Ea2dNQzR5TmpJMU9UWWdNQzQxT1RFd016Z2dNQzR5TmpNd016Sk1NQzQxTmpRNU1pQXdMakkzT0Rjd01rTXdMalUyTkRRNE5TQXdMakkzT0RrM05DQXdMalUyTkRBMUlEQXVNamM1TVRFZ01DNDFOak0yTVRVZ01DNHlOemt4TVVNd0xqVTJNekV5TlNBd0xqSTNPVEV4SURBdU5UWXlOamtnTUM0eU56a3dNREVnTUM0MU5qSXpNRGtnTUM0eU56ZzNPRFJETUM0MU5qRTBNemdnTUM0eU56Z3lOQ0F3TGpVMk1UQXdNeUF3TGpJM056UTNPQ0F3TGpVMk1UQXdNeUF3TGpJM05qUTVPVll3TGpJMk5qQTFNVWd3TGpRNU1EazNOVU13TGpRNU1qazRPQ0F3TGpJMk9USXdOeUF3TGpRNU5USTBOaUF3TGpJM016WTVOaUF3TGpRNU56YzBPU0F3TGpJM09UVXhPRU13TGpRNU9EWXlJREF1TWpneE5UTXlJREF1TkRrNU1qZzJJREF1TWpnek1ESTRJREF1TkRrNU56UTVJREF1TWpnME1EQTNRekF1TlRBd01qRXhJREF1TWpnME9UZzNJREF1TlRBd09EWTBJREF1TWpnMk16SWdNQzQxTURFM01EZ2dNQzR5T0Rnd01EZERNQzQxTURJMU5URWdNQzR5T0RrMk9UTWdNQzQxTURNeU9EVWdNQzR5T1RBNU56SWdNQzQxTURNNU1URWdNQzR5T1RFNE5ETkRNQzQxTURRMU16Y2dNQzR5T1RJM01UTWdNQzQxTURVeU56SWdNQzR5T1RNMk16Z2dNQzQxTURZeE1UVWdNQzR5T1RRMk1UaERNQzQxTURZNU5UZ2dNQzR5T1RVMU9UY2dNQzQxTURjNE1UVWdNQzR5T1RZek1EUWdNQzQxTURnMk9EWWdNQzR5T1RZM05FTXdMalV3T1RVMU5pQXdMakk1TnpFM05TQXdMalV4TURRMU5DQXdMakk1TnpNNU15QXdMalV4TVRNM09TQXdMakk1TnpNNU0wZ3dMalV4T1RJeE5WWXdMakk0T1RVMU4wTXdMalV4T1RJeE5TQXdMakk0T0RjNU5pQXdMalV4T1RRMU9TQXdMakk0T0RFM0lEQXVOVEU1T1RRNUlEQXVNamczTmpoRE1DNDFNakEwTXprZ01DNHlPRGN4T1NBd0xqVXlNVEEyTlNBd0xqSTROamswTmlBd0xqVXlNVGd5TmlBd0xqSTROamswTmtnd0xqVTBOemswTkVNd0xqVTBPRGN3TmlBd0xqSTROamswTmlBd0xqVTBPVE16TVNBd0xqSTROekU1SURBdU5UUTVPREl4SURBdU1qZzNOamhETUM0MU5UQXpNVEVnTUM0eU9EZ3hOeUF3TGpVMU1EVTFOaUF3TGpJNE9EYzVOaUF3TGpVMU1EVTFOaUF3TGpJNE9UVTFOMVl3TGpNeE5UWTNOVU13TGpVMU1EVTFOaUF3TGpNeE5qUXpOeUF3TGpVMU1ETXhNU0F3TGpNeE56QTJNeUF3TGpVME9UZ3lNU0F3TGpNeE56VTFNa013TGpVME9UTXpNU0F3TGpNeE9EQTBNaUF3TGpVME9EY3dOaUF3TGpNeE9ESTROeUF3TGpVME56azBOQ0F3TGpNeE9ESTROMGd3TGpVeU1UZ3lOa013TGpVeU1UQTJOU0F3TGpNeE9ESTROeUF3TGpVeU1EUXpPU0F3TGpNeE9EQTBNaUF3TGpVeE9UazBPU0F3TGpNeE56VTFNa013TGpVeE9UUTFPU0F3TGpNeE56QTJNeUF3TGpVeE9USXhOU0F3TGpNeE5qUXpOeUF3TGpVeE9USXhOU0F3TGpNeE5UWTNOVll3TGpNd056ZzBTREF1TlRFeE16YzVRekF1TlRBNU5qTTRJREF1TXpBM09EUWdNQzQxTURjNU56Z2dNQzR6TURjMU5qZ2dNQzQxTURZME1ERWdNQzR6TURjd01qUkRNQzQxTURRNE1qTWdNQzR6TURZME56a2dNQzQxTURNME16VWdNQzR6TURVNE5DQXdMalV3TWpJek9DQXdMak13TlRFd05rTXdMalV3TVRBME1TQXdMak13TkRNM01TQXdMalE1T1RneE55QXdMak13TXpJMk9TQXdMalE1T0RVMk5TQXdMak13TVRoRE1DNDBPVGN6TVRRZ01DNHpNREF6TXpFZ01DNDBPVFl6TURjZ01DNHlPVGt3TnprZ01DNDBPVFUxTkRVZ01DNHlPVGd3TkRaRE1DNDBPVFEzT0RRZ01DNHlPVGN3TVRJZ01DNDBPVE00TnpJZ01DNHlPVFUwTmpFZ01DNDBPVEk0TVRFZ01DNHlPVE16T1RORE1DNDBPVEUzTlNBd0xqSTVNVE15TmlBd0xqUTVNRGszTlNBd0xqSTRPVGMyTVNBd0xqUTVNRFE0TlNBd0xqSTRPRGRETUM0ME9EazVPVFVnTUM0eU9EYzJNemtnTUM0ME9Ea3lNelFnTUM0eU9EVTVPVE1nTUM0ME9EZ3lJREF1TWpnek56WXpRekF1TkRnMk9UUTRJREF1TWpnd09EYzVJREF1TkRnMU9UUXlJREF1TWpjNE5qWXhJREF1TkRnMU1UZ2dNQzR5TnpjeE1URkRNQzQwT0RRME1UZ2dNQzR5TnpVMU5pQXdMalE0TXpRek9TQXdMakkzTXpjNU1pQXdMalE0TWpJME1pQXdMakkzTVRnd05rTXdMalE0TVRBME5TQXdMakkyT1RneE9TQXdMalEzT1Rnek5DQXdMakkyT0RNMk5DQXdMalEzT0RZeElEQXVNalkzTkRNNVF6QXVORGMzTXpnMUlEQXVNalkyTlRFMElEQXVORGMyTVRJZ01DNHlOall3TlRFZ01DNDBOelE0TVRVZ01DNHlOall3TlRGSU1DNDBORFUwTXpKRE1DNDBORFF5TXpVZ01DNHlOekEyTWpJZ01DNDBOREUzTlRrZ01DNHlOelF6TnpZZ01DNDBNemd3TURVZ01DNHlOemN6TVRWRE1DNDBNelF5TlRFZ01DNHlPREF5TlRNZ01DNDBNams1TnprZ01DNHlPREUzTWpJZ01DNDBNalV4T1RFZ01DNHlPREUzTWpKRE1DNDBNVGswTWpNZ01DNHlPREUzTWpJZ01DNDBNVFEwT1RrZ01DNHlOemsyT0RJZ01DNDBNVEEwTVRnZ01DNHlOelUyTURGRE1DNDBNRFl6TXpjZ01DNHlOekUxTWlBd0xqUXdOREk1TnlBd0xqSTJOalU1TmlBd0xqUXdOREk1TnlBd0xqSTJNRGd5T0VNd0xqUXdOREk1TnlBd0xqSTFOVEEySURBdU5EQTJNek0zSURBdU1qVXdNVE0ySURBdU5ERXdOREU0SURBdU1qUTJNRFUxUXpBdU5ERTBORGs1SURBdU1qUXhPVGMwSURBdU5ERTVOREl6SURBdU1qTTVPVE0wSURBdU5ESTFNVGt4SURBdU1qTTVPVE0wUXpBdU5ESTVPVGM1SURBdU1qTTVPVE0wSURBdU5ETTBNalV4SURBdU1qUXhOREF6SURBdU5ETTRNREExSURBdU1qUTBNelF4UXpBdU5EUXhOelU1SURBdU1qUTNNamM1SURBdU5EUTBNak0xSURBdU1qVXhNRE0wSURBdU5EUTFORE15SURBdU1qVTFOakEwU0RBdU5EVXpPVEpETUM0ME5UVXlNallnTUM0eU5UVTJNRFFnTUM0ME5UWTBPVEVnTUM0eU5UVXhORElnTUM0ME5UYzNNVFlnTUM0eU5UUXlNVGRETUM0ME5UZzVOQ0F3TGpJMU16STVNaUF3TGpRMk1ERTFNU0F3TGpJMU1UZ3pOaUF3TGpRMk1UTTBPQ0F3TGpJME9UZzFRekF1TkRZeU5UUTFJREF1TWpRM09EWTBJREF1TkRZek5USTBJREF1TWpRMk1EazJJREF1TkRZME1qZzJJREF1TWpRME5UUTFRekF1TkRZMU1EUTRJREF1TWpReU9UazFJREF1TkRZMk1EVTBJREF1TWpRd056YzNJREF1TkRZM016QTJJREF1TWpNM09Ea3pRekF1TkRZNE16UWdNQzR5TXpVMk5qTWdNQzQwTmpreE1ERWdNQzR5TXpRd01UY2dNQzQwTmprMU9URWdNQzR5TXpJNU5UWkRNQzQwTnpBd09ERWdNQzR5TXpFNE9UVWdNQzQwTnpBNE5UWWdNQzR5TXpBek15QXdMalEzTVRreE55QXdMakl5T0RJMk0wTXdMalEzTWprM09DQXdMakl5TmpFNU5TQXdMalEzTXpnNUlEQXVNakkwTmpRMElEQXVORGMwTmpVeElEQXVNakl6TmpGRE1DNDBOelUwTVRNZ01DNHlNakkxTnpZZ01DNDBOelkwTWlBd0xqSXlNVE15TlNBd0xqUTNOelkzTVNBd0xqSXhPVGcxTmtNd0xqUTNPRGt5TXlBd0xqSXhPRE00TnlBd0xqUTRNREUwTnlBd0xqSXhOekk0TlNBd0xqUTRNVE0wTkNBd0xqSXhOalUxUXpBdU5EZ3lOVFF4SURBdU1qRTFPREUySURBdU5EZ3pPVEk1SURBdU1qRTFNVGMySURBdU5EZzFOVEEySURBdU1qRTBOak15UXpBdU5EZzNNRGcwSURBdU1qRTBNRGc0SURBdU5EZzROelEwSURBdU1qRXpPREUySURBdU5Ea3dORGcxSURBdU1qRXpPREUyU0RBdU5EazVNakU0UXpBdU5UQXdNell4SURBdU1qRXdOekUxSURBdU5UQXlNalkxSURBdU1qQTRNVGs0SURBdU5UQTBPVE14SURBdU1qQTJNalkzUXpBdU5UQTNOVGs0SURBdU1qQTBNek0xSURBdU5URXdOakUzSURBdU1qQXpNelk1SURBdU5URXpPVGt4SURBdU1qQXpNelk1UXpBdU5URTRNelEwSURBdU1qQXpNelk1SURBdU5USXlNRFEwSURBdU1qQTBPRGt6SURBdU5USTFNRGt4SURBdU1qQTNPVFJETUM0MU1qZ3hNemdnTUM0eU1UQTVPRGNnTUM0MU1qazJOaklnTUM0eU1UUTJPRGNnTUM0MU1qazJOaklnTUM0eU1Ua3dORU13TGpVeU9UWTJNaUF3TGpJeU16TTVNeUF3TGpVeU9ERXpPQ0F3TGpJeU56QTVNeUF3TGpVeU5UQTVNU0F3TGpJek1ERTBRekF1TlRJeU1EUTBJREF1TWpNek1UZzNJREF1TlRFNE16UTBJREF1TWpNME56RWdNQzQxTVRNNU9URWdNQzR5TXpRM01VTXdMalV4TURZeE55QXdMakl6TkRjeElEQXVOVEEzTlRrNElEQXVNak16TnpRMUlEQXVOVEEwT1RNeElEQXVNak14T0RFelF6QXVOVEF5TWpZMUlEQXVNakk1T0RneElEQXVOVEF3TXpZeElEQXVNakkzTXpZMUlEQXVORGs1TWpFNElEQXVNakkwTWpZelNEQXVORGt3TkRnMVF6QXVORGc1TlRZZ01DNHlNalF5TmpNZ01DNDBPRGcyTmpJZ01DNHlNalEwT0RFZ01DNDBPRGMzT1RJZ01DNHlNalE1TVRaRE1DNDBPRFk1TWpFZ01DNHlNalV6TlRFZ01DNDBPRFl3TmpRZ01DNHlNall3TlRrZ01DNDBPRFV5TWpFZ01DNHlNamN3TXpoRE1DNDBPRFF6TnpjZ01DNHlNamd3TVRnZ01DNDBPRE0yTkRNZ01DNHlNamc1TkRNZ01DNDBPRE13TVRjZ01DNHlNams0TVRORE1DNDBPREl6T1RFZ01DNHlNekEyT0RRZ01DNDBPREUyTlRjZ01DNHlNekU1TmpNZ01DNDBPREE0TVRNZ01DNHlNek0yTkRsRE1DNDBOems1TnlBd0xqSXpOVE16TmlBd0xqUTNPVE14TnlBd0xqSXpOalkyT1NBd0xqUTNPRGcxTlNBd0xqSXpOelkwT1VNd0xqUTNPRE01TWlBd0xqSXpPRFl5T0NBd0xqUTNOemN5TmlBd0xqSTBNREV5TkNBd0xqUTNOamcxTlNBd0xqSTBNakV6T0VNd0xqUTNORE0xTWlBd0xqSTBOemsySURBdU5EY3lNRGswSURBdU1qVXlORFE1SURBdU5EY3dNRGd4SURBdU1qVTFOakEwU0RBdU5UWXhNREF6VmpBdU1qUTFNVFUzUXpBdU5UWXhNREF6SURBdU1qUTBNVGM0SURBdU5UWXhORE00SURBdU1qUXpOREUySURBdU5UWXlNekE1SURBdU1qUXlPRGN5UXpBdU5UWXpNVGM1SURBdU1qUXlNekk0SURBdU5UWTBNRFVnTUM0eU5ESXpOVFVnTUM0MU5qUTVNaUF3TGpJME1qazFORXd3TGpVNU1UQXpPQ0F3TGpJMU9EWXlORm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OGNHRjBhQ0JrUFNKTk1DNDJPVGsyT1RRZ01DNDBNVGN5TXpaSU1DNHpNREF3TVRKRE1DNHlPREl6TmpFZ01DNDBNVGN5T0RrZ01DNHlOalUwTkRnZ01DNDBNalF6TWpRZ01DNHlOVEk1TmpjZ01DNDBNelk0TURWRE1DNHlOREEwT0RZZ01DNDBORGt5T0RZZ01DNHlNek0wTlRFZ01DNDBOall4T1RrZ01DNHlNek16T1RnZ01DNDBPRE00TlZZd0xqWXhOekEzTjBNd0xqSXpNelExTVNBd0xqWXpORGN5T0NBd0xqSTBNRFE0TmlBd0xqWTFNVFkwTVNBd0xqSTFNamsyTnlBd0xqWTJOREV5TWtNd0xqSTJOVFEwT0NBd0xqWTNOall3TXlBd0xqSTRNak0yTVNBd0xqWTRNell6T0NBd0xqTXdNREF4TWlBd0xqWTRNelk1TVVnd0xqWTVPVFk1TkVNd0xqY3hOek0wTlNBd0xqWTRNell6T0NBd0xqY3pOREkxT0NBd0xqWTNOall3TXlBd0xqYzBOamN6T1NBd0xqWTJOREV5TWtNd0xqYzFPVEl5SURBdU5qVXhOalF4SURBdU56WTJNalUxSURBdU5qTTBOekk0SURBdU56WTJNekE0SURBdU5qRTNNRGMzVmpBdU5EZ3pPRFZETUM0M05qWXlOVFVnTUM0ME5qWXhPVGtnTUM0M05Ua3lNaUF3TGpRME9USTROaUF3TGpjME5qY3pPU0F3TGpRek5qZ3dOVU13TGpjek5ESTFPQ0F3TGpReU5ETXlOQ0F3TGpjeE56TTBOU0F3TGpReE56STRPU0F3TGpZNU9UWTVOQ0F3TGpReE56SXpObFl3TGpReE56SXpObHBOTUM0eU9ETXpOVGtnTUM0ME9ETTROVU13TGpJNE16TXpOaUF3TGpRNE1UWTFOeUF3TGpJNE16YzFNaUF3TGpRM09UUTRNU0F3TGpJNE5EVTRNU0F3TGpRM056UTFNVU13TGpJNE5UUXhJREF1TkRjMU5ESWdNQzR5T0RZMk16WWdNQzQwTnpNMU56WWdNQzR5T0RneE9EY2dNQzQwTnpJd01qVkRNQzR5T0RrM016Z2dNQzQwTnpBME56UWdNQzR5T1RFMU9ESWdNQzQwTmpreU5EZ2dNQzR5T1RNMk1UTWdNQzQwTmpnME1UbERNQzR5T1RVMk5ETWdNQzQwTmpjMU9TQXdMakk1TnpneE9TQXdMalEyTnpFM05DQXdMak13TURBeE1pQXdMalEyTnpFNU4wZ3dMalk1T1RZNU5FTXdMamN3TVRnNE55QXdMalEyTnpFM05DQXdMamN3TkRBMk15QXdMalEyTnpVNUlEQXVOekEyTURrMElEQXVORFk0TkRFNVF6QXVOekE0TVRJMElEQXVORFk1TWpRNElEQXVOekE1T1RZNUlEQXVORGN3TkRjMElEQXVOekV4TlRJZ01DNDBOekl3TWpWRE1DNDNNVE13TnpFZ01DNDBOek0xTnpZZ01DNDNNVFF5T1RZZ01DNDBOelUwTWlBd0xqY3hOVEV5TlNBd0xqUTNOelExTVVNd0xqY3hOVGsxTkNBd0xqUTNPVFE0TVNBd0xqY3hOak0zSURBdU5EZ3hOalUzSURBdU56RTJNelE0SURBdU5EZ3pPRFZXTUM0MU5UQTBOalJJTUM0eU9ETXpOVGxXTUM0ME9ETTROVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0OEwyYytQR1JsWm5NK1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01GOHlNalkzWHpJeU9ETTJJajQ4Y21WamRDQjNhV1IwYUQwaU1DNDRPQ0lnYUdWcFoyaDBQU0l3TGpnNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOakF3TlRnMklEQXVNRFl3TURVNE5pa2lMejQ4TDJOc2FYQlFZWFJvUGp3dlpHVm1jejQ4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIxIiB5PSIxMDYiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjEiIHZhbHVlPSJXaS1GaSBwb3J0IC0+IFJvdXRlciIgc3R5bGU9ImlyLnJlZj1iOTdlZTY5Zi01NjViLTQ4YWMtYmUyNS1jZjNmYjYzMWQ3NDg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9IjE4IiB0YXJnZXQ9IjE5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTYiIHZhbHVlPSJCbHVldG9vdGggcG9ydCAtPiBCbHVldG9vdGggcG9ydCIgc3R5bGU9ImlyLnJlZj05ZGM2MzVhYi00ZTQ4LTQ1ODYtYWEwNS0xNmYxMWRkNzQ5M2U7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9IjgiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjYxNSIgeT0iMjUyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJCbHVldG9vdGggcG9ydCAtPiBCbHVldG9vdGggcG9ydCIgc3R5bGU9ImlyLnJlZj0wYzA4NWIxNC03MWQwLTQyMGYtOTExMC0wOGZjM2M1MGI4ODc7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9IjkiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjYyNCIgeT0iMzIyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTAwNDIxLWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MS0yIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNDIwIiB5PSItMzUyIiB3aWR0aD0iODc0IiBoZWlnaHQ9IjUyMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQVdTIEFjY291bnQgRW52aXJvbm1lbnQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzazt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0wO3JlY3Vyc2l2ZVJlc2l6ZT0xO2FsaWduPWNlbnRlcjthcmNTaXplPTkwO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEVnTUVnd1ZqRklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzJOekkwSURBdU5qZ3dNekF6U0RBdU1UVTVPVEV5VmpBdU5qTXdPRGM0UXpBdU1UVTVPRE16SURBdU5UY3lOakExSURBdU1UYzVNekl5SURBdU5URTFPVGt6SURBdU1qRTFNalUySURBdU5EY3dNVEU1UXpBdU1qVXhNVGc1SURBdU5ESTBNalExSURBdU16QXhORGcwSURBdU16a3hOelkzSURBdU16VTRNRGM0SURBdU16YzNPRGt4VERBdU16WXpPVE01SURBdU16YzJORFkxVERBdU16WTVNekkxSURBdU16YzVNekUyUXpBdU16ZzNNemM0SURBdU16ZzRPVGd4SURBdU5EQTNOVE0zSURBdU16azBNRE00SURBdU5ESTRNREUwSURBdU16azBNRE00UXpBdU5EUTRORGt4SURBdU16azBNRE00SURBdU5EWTROalV4SURBdU16ZzRPVGd4SURBdU5EZzJOekEwSURBdU16YzVNekUyVERBdU5Ea3lNRGc1SURBdU16YzJORFkxVERBdU5EazNPVFVnTUM0ek56YzRPVEZETUM0MU5EZzRNVGdnTUM0ek9UQTFNRGdnTUM0MU9UUTNNamtnTUM0ME1UZ3hJREF1TmpJNU56UTBJREF1TkRVM01EazRUREF1TmpBMk15QXdMalEzT0RNeU5VTXdMalUzTmpZd09DQXdMalEwTlRVMU5TQXdMalV6T0RFeE5pQXdMalF5TWpBeE9TQXdMalE1TlRReE5pQXdMalF4TURVeU5FTXdMalEzTkRJd09DQXdMalF5TURnZ01DNDBOVEE1TkRjZ01DNDBNall4TXprZ01DNDBNamN6T0RFZ01DNDBNall4TXpsRE1DNDBNRE00TVRRZ01DNDBNall4TXprZ01DNHpPREExTlRRZ01DNDBNakE0SURBdU16VTVNelExSURBdU5ERXdOVEkwUXpBdU16RXhNREl4SURBdU5ESXpOelF6SURBdU1qWTRNemMwSURBdU5EVXlORFl6SURBdU1qTTNPVFV6SURBdU5Ea3lNamN5UXpBdU1qQTNOVE16SURBdU5UTXlNRGdnTUM0eE9URXdNak1nTUM0MU9EQTNOellnTUM0eE9UQTVOaUF3TGpZek1EZzNPRll3TGpZME9EWXlTREF1TkRjMk1EbE1NQzQwTnpZM01qUWdNQzQyT0RBek1ETmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5ESTNOak0xSURBdU5ESTFNREUxUXpBdU5EQXpOek00SURBdU5ESTFNRGcySURBdU16Z3dNakEzSURBdU5ERTVNVFE1SURBdU16VTVNakEwSURBdU5EQTNOelE0UXpBdU16TXhNemswSURBdU16a3lOVGMzSURBdU16QTVOREk1SURBdU16WTROVGMwSURBdU1qazJOemMzSURBdU16TTVOVE5ETUM0eU9EUXhNalFnTUM0ek1UQTBPRFlnTUM0eU9ERTFNRFVnTUM0eU56Z3dOVFVnTUM0eU9Ea3pNek1nTUM0eU5EY3pOVFpETUM0eU9UY3hOaklnTUM0eU1UWTJOVGdnTUM0ek1UUTVPVEVnTUM0eE9EazBORElnTUM0ek5EQXdNRFlnTUM0eE56QXdNRFJETUM0ek5qVXdNakVnTUM0eE5UQTFOallnTUM0ek9UVTNPVGdnTUM0eE5EQXdNVFVnTUM0ME1qYzBOemNnTUM0eE5EQXdNVFZETUM0ME5Ua3hOVFlnTUM0eE5EQXdNVFVnTUM0ME9EazVNek1nTUM0eE5UQTFOallnTUM0MU1UUTVORGdnTUM0eE56QXdNRFJETUM0MU16azVOak1nTUM0eE9EazBORElnTUM0MU5UYzNPVE1nTUM0eU1UWTJOVGdnTUM0MU5qVTJNakVnTUM0eU5EY3pOVFpETUM0MU56TTBORGtnTUM0eU56Z3dOVFVnTUM0MU56QTRNeUF3TGpNeE1EUTROaUF3TGpVMU9ERTNOeUF3TGpNek9UVXpRekF1TlRRMU5USTFJREF1TXpZNE5UYzBJREF1TlRJek5UWWdNQzR6T1RJMU56Y2dNQzQwT1RVM05TQXdMalF3TnpjME9GWXdMalF3TnpjME9FTXdMalEzTkRneE1pQXdMalF4T1RBeU1pQXdMalExTVRReE5TQXdMalF5TkRrMU5DQXdMalF5TnpZek5TQXdMalF5TlRBeE5WcE5NQzQwTWpjMk16VWdNQzR4TnpVMk56SkRNQzQwTURNeU9Ea2dNQzR4TnpVeU1EVWdNQzR6TnprME9USWdNQzR4T0RJNU15QXdMak0yTURBMk1TQXdMakU1TnpZd05rTXdMak0wTURZeklEQXVNakV5TWpneklEQXVNekkyTmpreUlEQXVNak16TURZeElEQXVNekl3TkRneElEQXVNalUyTmpBM1F6QXVNekUwTWpjeElEQXVNamd3TVRVMElEQXVNekUyTVRRNElEQXVNekExTVRBMElEQXVNekkxT0RFeklEQXVNekkzTkRVMVF6QXVNek0xTkRjM0lEQXVNelE1T0RBM0lEQXVNelV5TXpZNUlEQXVNelk0TWpZMUlEQXVNemN6TnpjNElEQXVNemM1T0RZM1F6QXVNemt3TVRRMUlEQXVNemc0TmpRMUlEQXVOREE0TkRJNUlEQXVNemt6TWpNNElEQXVOREkzTURBeUlEQXVNemt6TWpNNFF6QXVORFExTlRjMElEQXVNemt6TWpNNElEQXVORFl6T0RVNElEQXVNemc0TmpRMUlEQXVORGd3TWpJMklEQXVNemM1T0RZM1F6QXVOVEF4TlRNZ01DNHpOamd6TVRJZ01DNDFNVGd6TmlBd0xqTTBPVGsyTmlBd0xqVXlPREEwTVNBd0xqTXlOemMwTmtNd0xqVXpOemN5TVNBd0xqTXdOVFV5TmlBd0xqVXpPVFk1TlNBd0xqSTRNRGN3TnlBd0xqVXpNelkxSURBdU1qVTNNak0yUXpBdU5USTNOakExSURBdU1qTXpOelkwSURBdU5URXpPRGc0SURBdU1qRXlPVGczSURBdU5EazBOamM0SURBdU1UazRNakE1UXpBdU5EYzFORFk1SURBdU1UZ3pORE1nTUM0ME5URTROekVnTUM0eE56VTBPVGNnTUM0ME1qYzJNelVnTUM0eE56VTJOekpXTUM0eE56VTJOekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN6TkRJMklEQXVPRFl3TURRNFREQXVOVEEwT0RneklEQXVOell5TnpneVZqQXVOVFk0TURreFREQXVOamN6TkRJMklEQXVORGN3T0RJMVREQXVPRFF4T1RZNUlEQXVOVFk0TURreFZqQXVOell5TnpneVREQXVOamN6TkRJMklEQXVPRFl3TURRNFdrMHdMalV6TmpVMk5DQXdMamMwTkRRd05rd3dMalkzTXpReU5pQXdMamd5TXpZeE0wd3dMamd4TURJNE9DQXdMamMwTkRRd05sWXdMalU0TlRrNU1rd3dMalkzTXpReU5pQXdMalV3TmpjNE5Vd3dMalV6TmpVMk5DQXdMalU0TlRrNU1sWXdMamMwTkRRd05sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56TTFOak1nTUM0Mk9ETTJOemRNTUM0MU1USTVNemtnTUM0MU9URXdNRFJNTUM0MU1qZzNPQ0F3TGpVMk16VTVPVXd3TGpZM016VTJNeUF3TGpZME56QTRNMHd3TGpneE9ETTBOaUF3TGpVMk16VTVPVXd3TGpnek5ERTROeUF3TGpVNU1UQXdORXd3TGpZM016VTJNeUF3TGpZNE16WTNOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJPRGt6T1RZZ01DNDJOalUxTWpkSU1DNDJOVGMzTVRWV01DNDROREU0TkRKSU1DNDJPRGt6T1RaV01DNDJOalUxTWpkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN4TURjaUlIa3hQU0l4TGpJd056RTFJaUI0TWowaU1TNHlNRGN4TVNJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSTBNNE5URXhRaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtZNU9UQXdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207IiBpZD0idGVtcGxhdGUtMTAwNDIxLWZhYzg5ZjQxLTVmNGItNDliOC1iMmIxLTJjZGJmNjE2NjM5ZC0xMSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWZhYzg5ZjQxLTVmNGItNDliOC1iMmIxLTJjZGJmNjE2NjM5ZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hbWF6b24td2ViLXNlcnZpY2VzLWVudmlyb25tZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cmVjdXJzaXZlUmVzaXplPTA7YWxpZ249bGVmdDthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9InRlbXBsYXRlLTEwMDQyMS1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTEtMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOCIgeT0iMzkiIHdpZHRoPSI4MTUiIGhlaWdodD0iNDQ3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IkFXUyBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJpci5yZWY9ZGEyMWU1MWItZmYyZS00NzcyLTgwZjUtNjAwZDdmZWVhZmZhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELVdBRjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qazVOemtnTUM0Mk5UQTJPVGxNTUM0Mk5URXhNak1nTUM0Mk5qazFOVFpNTUM0NE1UQTFOVElnTUM0NE1qZzVPRGxNTUM0NE1qazBNRGdnTUM0NE1UQXhNekpNTUM0Mk5qazVOemtnTUM0Mk5UQTJPVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVGc1TlRFeElEQXVNVGN3TVRBNVREQXVNVGN3TmpVMElEQXVNVGc0T1RZMVREQXVNelEzTXpNNElEQXVNelkxTmpRM1REQXVNelkyTVRrMUlEQXVNelEyTnpreFREQXVNVGc1TlRFeElEQXVNVGN3TVRBNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNd05EQXpNaUF3TGpZM056STRPRXd3TGpJeE1EWTVNeUF3TGpjM01EWXpUREF1TWpJNU5UVWdNQzQzT0RrME9EZE1NQzR6TWpJNE9EZ2dNQzQyT1RZeE5EVk1NQzR6TURRd016SWdNQzQyTnpjeU9EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56Y3dOekEzSURBdU1qRXdOakUzVERBdU5qYzNNelk0SURBdU16QXpPVFUxVERBdU5qazJNakkwSURBdU16SXlPREV4VERBdU56ZzVOVFl6SURBdU1qSTVORGN6VERBdU56Y3dOekEzSURBdU1qRXdOakUzV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamd6TXpNeE55QXdMalE0Tmpjek5WWXdMalV4TXpRd01rZ3dMamd3TmpZMU1VTXdMamd3TkRJeU1pQXdMalUzTXpRM0lEQXVOemcwTURNNElEQXVOak14TkRjZ01DNDNORGcyTlRFZ01DNDJPREF3TmpoTU1DNDNNamN3TlRFZ01DNDJOalF6TXpWRE1DNDNOVGt3TmpNZ01DNDJNakF6TURZZ01DNDNOemN6TkRFZ01DNDFOamMzT1RNZ01DNDNOemsxT0RRZ01DNDFNVE0wTURKSU1DNDNOVEk1TVRkV01DNDBPRFkzTXpWSU1DNDNOemsxT0RSRE1DNDNOemN5TmpNZ01DNDBNekkwT0RJZ01DNDNOVGc1T0RrZ01DNHpPREF4TVRrZ01DNDNNamN3TlRFZ01DNHpNell5TURKTU1DNDNORGcyTlRFZ01DNHpNakF3TmpoRE1DNDNPRE01TkRNZ01DNHpOamcyT1RnZ01DNDRNRFF3TXpRZ01DNDBNalkyT1RVZ01DNDRNRFl6T0RRZ01DNDBPRFkzTXpWSU1DNDRNek16TVRkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmpnd01EWTRJREF1TWpVeE16a3lUREF1TmpZME16TTFJREF1TWpjeU9Ua3lRekF1TmpJd016QTJJREF1TWpRd09UZ2dNQzQxTmpjM09UTWdNQzR5TWpJM01ESWdNQzQxTVRNME1ESWdNQzR5TWpBME5UbFdNQzR5TkRjeE1qWklNQzQwT0RZM016VldNQzR5TWpBME5UbERNQzQwTXpJME9ESWdNQzR5TWpJM09DQXdMak00TURFeE9TQXdMakkwTVRBMU5DQXdMak16TmpJd01pQXdMakkzTWprNU1rd3dMak15TURBMk9DQXdMakkxTVRNNU1rTXdMak0yT0RZNU9DQXdMakl4TmpFZ01DNDBNalkyT1RVZ01DNHhPVFl3TURrZ01DNDBPRFkzTXpVZ01DNHhPVE0yTlRsV01DNHhOalk1T1RKSU1DNDFNVE0wTURKV01DNHhPVE0yTlRsRE1DNDFOek0wTkRJZ01DNHhPVFl3TURrZ01DNDJNekUwTXprZ01DNHlNVFl4SURBdU5qZ3dNRFk0SURBdU1qVXhNemt5VmpBdU1qVXhNemt5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalk0TURBMk9DQXdMamMwT0RZMU1VTXdMall6TVRRek9TQXdMamM0TXprME15QXdMalUzTXpRME1pQXdMamd3TkRBek5DQXdMalV4TXpRd01pQXdMamd3TmpNNE5GWXdMamd6TXpBMU1VZ3dMalE0Tmpjek5WWXdMamd3TmpNNE5FTXdMalF5TmpZNU5TQXdMamd3TkRBek5DQXdMak0yT0RZNU9DQXdMamM0TXprME15QXdMak15TURBMk9DQXdMamMwT0RZMU1Vd3dMak16TlRnd01pQXdMamN5TnpBMU1VTXdMak0zT1Rnek1TQXdMamMxT1RBMk15QXdMalF6TWpNME5DQXdMamMzTnpNME1TQXdMalE0Tmpjek5TQXdMamMzT1RVNE5GWXdMamMxTWpreE9FZ3dMalV4TXpRd01sWXdMamMzT1RVNE5FTXdMalUyTnpZMU5TQXdMamMzTnpJMk15QXdMall5TURBeE9DQXdMamMxT0RrNE9TQXdMalkyTXprek5TQXdMamN5TnpBMU1Vd3dMalk0TURBMk9DQXdMamMwT0RZMU1Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU1qQTBOVGtnTUM0MU1UTTBNREpETUM0eU1qSTNPQ0F3TGpVMk56WTFOU0F3TGpJME1UQTFOQ0F3TGpZeU1EQXhPQ0F3TGpJM01qazVNaUF3TGpZMk16a3pOVXd3TGpJMU1UTTVNaUF3TGpZNE1EQTJPRU13TGpJeE5qRWdNQzQyTXpFME16a2dNQzR4T1RZd01Ea2dNQzQxTnpNME5ESWdNQzR4T1RNMk5Ua2dNQzQxTVRNME1ESklNQzR4TmpZNU9USldNQzQwT0RZM016VklNQzR4T1RNMk5UbERNQzR4T1RZd01Ea2dNQzQwTWpZMk9UVWdNQzR5TVRZeElEQXVNelk0TmprNElEQXVNalV4TXpreUlEQXVNekl3TURZNFREQXVNamN5T1RreUlEQXVNek0xT0RBeVF6QXVNalF3T1RnZ01DNHpOems0TXpFZ01DNHlNakkzTURJZ01DNDBNekl6TkRRZ01DNHlNakEwTlRrZ01DNDBPRFkzTXpWSU1DNHlORGN4TWpaV01DNDFNVE0wTURKSU1DNHlNakEwTlRsYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpJd05EYzVJREF1TkRFMU9EUXhRekF1TmpFNE5UVWdNQzQwTVRRNE1UUWdNQzQyTVRZek9UZ2dNQzQwTVRReU56Y2dNQzQyTVRReU1USWdNQzQwTVRReU56ZERNQzQyTVRJd01qWWdNQzQwTVRReU56Y2dNQzQyTURrNE56UWdNQzQwTVRRNE1UUWdNQzQyTURjNU5EVWdNQzQwTVRVNE5ERkRNQzQyTURVNU56Z2dNQzQwTVRZNE5ETWdNQzQyTURReU9TQXdMalF4T0RNeE9DQXdMall3TXpBek5DQXdMalF5TURFek0wTXdMall3TVRjM055QXdMalF5TVRrME9DQXdMall3TURrNU1TQXdMalF5TkRBME55QXdMall3TURjME5TQXdMalF5TmpJME1VTXdMalU1T1RreU5pQXdMalF6TkRNM01TQXdMalU1T0RVME5TQXdMalEwTWpRek5TQXdMalU1TmpZeE1pQXdMalExTURNM05VTXdMalU1TXpRNE5TQXdMalF4T0RBNU9DQXdMalU0TWpBd05TQXdMak00TnpFNU5DQXdMalUyTXpNd01TQXdMak0yTURjd05FTXdMalUwTkRVNU55QXdMak16TkRJeE5TQXdMalV4T1RNeE5TQXdMak14TXpBMU5TQXdMalE0T1RrME5TQXdMakk1T1RNd09VTXdMalEzTVRreU9DQXdMakk0TlRVMU55QXdMalExTURneklEQXVNamMyTkRBMElEQXVOREk0TkRjNUlEQXVNamN5TmpReVF6QXVOREkxTlRrNElEQXVNamN5TVRZeUlEQXVOREl5TmpRZ01DNHlOekkyTkRFZ01DNDBNakF3TlRrZ01DNHlOelF3TURaRE1DNDBNVGMwTnpjZ01DNHlOelV6TnlBd0xqUXhOVFF4TkNBd0xqSTNOelUwTkNBd0xqUXhOREU0T0NBd0xqSTRNREU1TkVNd0xqUXhNamsyTVNBd0xqSTRNamcwTkNBd0xqUXhNall6T1NBd0xqSTROVGd5TXlBd0xqUXhNekkyT1NBd0xqSTRPRFkzTkVNd0xqUXhNemtnTUM0eU9URTFNalVnTUM0ME1UVTBORGtnTUM0eU9UUXdPU0F3TGpReE56WTNPU0F3TGpJNU5UazNOVU13TGpRek1UVTVOeUF3TGpNd09UVTVJREF1TkRReE9EQTJJREF1TXpJMk5UTTFJREF1TkRRM016TTJJREF1TXpRMU1qQXpRekF1TkRVeU9EWTNJREF1TXpZek9EY3hJREF1TkRVek5UTTFJREF1TXpnek5qUXpJREF1TkRRNU1qYzVJREF1TkRBeU5qUXhRekF1TkRNek9ERXlJREF1TXpneU1qUXlJREF1TkRBNU1qYzVJREF1TXpVM09EUXlJREF1TXpnd01qRXlJREF1TXpVM09EUXlRekF1TXpjNE1EWXlJREF1TXpVM09EUTFJREF1TXpjMU9UUTFJREF1TXpVNE16WTRJREF1TXpjME1EUXlJREF1TXpVNU16WTNRekF1TXpjeU1UTTRJREF1TXpZd016WTFJREF1TXpjd05UQTBJREF1TXpZeE9EQTVJREF1TXpZNU1qYzVJREF1TXpZek5UYzFRekF1TXpZNE1EUXhJREF1TXpZMU16WTFJREF1TXpZM01qWWdNQzR6TmpjME16RWdNQzR6Tmpjd01EUWdNQzR6TmprMU9UTkRNQzR6TmpZM05EZ2dNQzR6TnpFM05UUWdNQzR6Tmpjd01qWWdNQzR6TnpNNU5EVWdNQzR6TmpjNE1USWdNQzR6TnpVNU56VkRNQzR6TnpVMU5EVWdNQzR6T1RVNE5ESWdNQzR6T1RBNE56a2dNQzQwTlRVeE56VWdNQzR6Tmprd01USWdNQzQwT0RrMU56UkRNQzR6TmpjMU5EVWdNQzQwT1RFM01EZ2dNQzR6TmpZek5EVWdNQzQwT1RNNE5ERWdNQzR6TmpVd01USWdNQzQwT1RZeE1EaERNQzR6TlRBME5Ea2dNQzQxTWpJMk9EUWdNQzR6TkRZeE9USWdNQzQxTlRNMk9UVWdNQzR6TlRNd05UUWdNQzQxT0RNeU1USkRNQzR6TlRrNU1UY2dNQzQyTVRJM01qa2dNQzR6TnpjME1UZ2dNQzQyTXpnMk9ERWdNQzQwTURJeU1USWdNQzQyTlRZeE1EZERNQzQwTWpneU5EWWdNQzQyTnpNM016VWdNQzQwTlRZME9Ea2dNQzQyT0RjNE5UWWdNQzQwT0RZeU1USWdNQzQyT1RneE1EZERNQzQwT0RjMk5qVWdNQzQyT1RnMk16UWdNQzQwT0RreE9Ua2dNQzQyT1RnNU1EVWdNQzQwT1RBM05EVWdNQzQyT1RnNU1EZElNQzQwT1RNMU5EVkRNQzQxTVRFeU56a2dNQzQyT1Rjek1EY2dNQzQyTXpFNU5EVWdNQzQyT0RFM01EY2dNQzQyTlRZMk1USWdNQzQxT0RVNU56UkRNQzQyT1RBM05EVWdNQzQwTlRVNU56VWdNQzQyTWpNME1USWdNQzQwTVRjME5ERWdNQzQyTWpBME56a2dNQzQwTVRVNE5ERmFUVEF1TkRjeE1UUTFJREF1TmpZek9UY3pRekF1TkRVeU5EWTFJREF1TmpVMk1EUXlJREF1TkRNME5qQXpJREF1TmpRMk16QTNJREF1TkRFM09ERXlJREF1TmpNME9UQTNRekF1TXprNE16STRJREF1TmpJeE1qYzNJREF1TXpnME5UWTRJREF1TmpBd09USTNJREF1TXpjNU1UYzRJREF1TlRjM056WTNRekF1TXpjek56ZzRJREF1TlRVME5qQTRJREF1TXpjM01UUTRJREF1TlRNd01qY3pJREF1TXpnNE5qRXlJREF1TlRBNU5EUXhUREF1TXpreE9ERXlJREF1TlRBek9UYzBRekF1TkRFME16UTFJREF1TkRZNE56YzBJREF1TkRBM09ERXlJREF1TkRJd056YzFJREF1TkRBd056UTFJREF1TXpreE56QTRRekF1TkRFNE1Ua3lJREF1TkRBMU1EazBJREF1TkRNeU5qTTNJREF1TkRJeE9Ua3hJREF1TkRRek1UUTFJREF1TkRReE16QTRRekF1TkRRME1qazBJREF1TkRRek5qWTFJREF1TkRRMk1URXpJREF1TkRRMU5qTXhJREF1TkRRNE16Y3pJREF1TkRRMk9UWkRNQzQwTlRBMk16UWdNQzQwTkRneU9Ea2dNQzQwTlRNeU16WWdNQzQwTkRnNU1qSWdNQzQwTlRVNE5UUWdNQzQwTkRnM09FTXdMalExT0RRM015QXdMalEwT0RZek55QXdMalEyTURrNU1TQXdMalEwTnpjeU5pQXdMalEyTXpBNU5DQXdMalEwTmpFMlF6QXVORFkxTVRrM0lEQXVORFEwTlRrMElEQXVORFkyTnpreUlEQXVORFF5TkRReUlEQXVORFkzTmpjNUlEQXVORE01T1RjMVF6QXVORGMxT0RRMUlEQXVOREU1T0RBeUlEQXVORGM1TmpnMUlEQXVNems0TVRNNUlEQXVORGM0T1RVZ01DNHpOell6T0RsRE1DNDBOemd5TVRVZ01DNHpOVFEyTXpnZ01DNDBOekk1TWpFZ01DNHpNek15T0RRZ01DNDBOak0wTVRJZ01DNHpNVE0zTURsRE1DNDBPREF6TkRZZ01DNHpNak0xTWlBd0xqUTVNemc0TWlBd0xqTXpPREkyTlNBd0xqVXdNakl4TWlBd0xqTTFOVGszTlVNd0xqVXlNVEUwTlNBd0xqTTVOVEUzTlNBd0xqVXhOamczT1NBd0xqUTBPVE13T0NBd0xqUTVNVEkzT1NBd0xqUTVOakV3T0VNd0xqUTJORGs0SURBdU5UUTNPVE0zSURBdU5EVTNPRFE0SURBdU5qQTNNemsxSURBdU5EY3hNVFExSURBdU5qWXpPVGN6V2swd0xqWXpNVEUwTlNBd0xqVTNPVFUzTkVNd0xqWXhNelkzT1NBd0xqWTBOelUzTkNBd0xqVXpNRE0wTlNBd0xqWTJOamMzTXlBd0xqVXdNRFEzT1NBd0xqWTNNVFEwUXpBdU5Ea3pNamM1SURBdU5qUTFOVGMwSURBdU5EYzVNREV5SURBdU5UY3pNekEzSURBdU5URTBOakV5SURBdU5UQTRNalF4UXpBdU5UTTVOVEE0SURBdU5EWTBPRFk1SURBdU5UUTJOVE0zSURBdU5ERXpOVEE0SURBdU5UTTBNakV5SURBdU16WTFNRFF5UXpBdU5UVTRNelExSURBdU16a3pNekE0SURBdU5UYzROakV5SURBdU5ETTNPVGMxSURBdU5UWTNPREV5SURBdU5UQTBPVEE0UXpBdU5UWTNNemt6SURBdU5UQTNOVGMwSURBdU5UWTNOemswSURBdU5URXdNekExSURBdU5UWTRPVFlnTUM0MU1USTNNemxETUM0MU56QXhNamNnTUM0MU1UVXhOek1nTUM0MU56SXdNRFVnTUM0MU1UY3hPVFVnTUM0MU56UXpORFlnTUM0MU1UZzFNemxETUM0MU56WTJPRGNnTUM0MU1UazRPRE1nTUM0MU56a3pPQ0F3TGpVeU1EUTROU0F3TGpVNE1qQTNJREF1TlRJd01qWTFRekF1TlRnME56WWdNQzQxTWpBd05EVWdNQzQxT0Rjek1pQXdMalV4T1RBeE5DQXdMalU0T1RReE1pQXdMalV4TnpNd09FTXdMall3TmpjNE55QXdMalV3TURRME1TQXdMall4T0RRNE15QXdMalEzT0RVNE55QXdMall5TWpnM09TQXdMalExTkRjM05VTXdMall6TlRZM09TQXdMalEzTXpNd09DQXdMalkwT1RBeE1pQXdMalV4TURjM05DQXdMall6TVRJM09TQXdMalUzT1RVM05FZ3dMall6TVRFME5Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4c2FXNWxZWEpIY21Ga2FXVnVkQ0JwWkQwaWNHRnBiblF3WDJ4cGJtVmhjaUlnZURFOUlpMHdMakl3TnpBMk55SWdlVEU5SWpFdU1qQTNNRGNpSUhneVBTSXhMakl3TnpJaUlIa3lQU0l0TUM0eU1EY3lJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqUWtRd09ERTJJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpFaUlITjBiM0F0WTI5c2IzSTlJaU5HUmpVeU5USWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xMDA0MjEtZmFjODlmNDEtNWY0Yi00OWI4LWIyYjEtMmNkYmY2MTY2MzlkLTExIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjU4NCIgeT0iMzIzIiB3aWR0aD0iMTYxIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJBV1MgVlBDIChWaXJ0dWFsIFByaXZhdGUgQ2xvdWQpIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSWpSVE5HUTBaRElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RVNU5DQXdMall5TUROSU1DNHlPVGt5TnpORE1DNHlNall5TURZZ01DNDJNakF6SURBdU1UY3dNelFnTUM0MU56RTFJREF1TVRZMk5qQTJJREF1TlRBME5ETXpRekF1TVRZMk5qQTJJREF1TlRBeE5qTXpJREF1TVRZMk5qQTJJREF1TkRrNE5ETXpJREF1TVRZMk5qQTJJREF1TkRrMU1qTXpRekF1TVRZMU5EY3hJREF1TkRZM05EQTRJREF1TVRjek9EQTNJREF1TkRRd01ESXhJREF1TVRrd01qVXhJREF1TkRFM05UUTJRekF1TWpBMk5qazFJREF1TXprMU1EY3hJREF1TWpNd01qYzJJREF1TXpjNE9ETTVJREF1TWpVM01UUWdNQzR6TnpFMVF6QXVNalUzTVRRZ01DNHpOamM1SURBdU1qVTNNVFFnTUM0ek5qUTBNek1nTUM0eU5UY3hOQ0F3TGpNMk1EZ3pNME13TGpJMU56Z3hNaUF3TGpNeU5Ea3pOeUF3TGpJMk9UQTVOQ0F3TGpJNU1EQTBOQ0F3TGpJNE9UVTJNeUF3TGpJMk1EVTBPVU13TGpNeE1EQXpNeUF3TGpJek1UQTFOQ0F3TGpNek9EYzNOQ0F3TGpJd09ESTNOeUF3TGpNM01qRTJOaUF3TGpFNU5UQTRPVU13TGpRd05UVTFPQ0F3TGpFNE1Ua2dNQzQwTkRJeE1EWWdNQzR4TnpnNE9TQXdMalEzTnpJd05pQXdMakU0TmpRek4wTXdMalV4TWpNd05pQXdMakU1TXprNE5DQXdMalUwTkRNNE55QXdMakl4TVRjMU1TQXdMalUyT1RRd05pQXdMakl6TnpWRE1DNDFPRFk0TlRVZ01DNHlOVFEzTnlBd0xqWXdNVEF6T0NBd0xqSTNOVEExTVNBd0xqWXhNVEkzTXlBd0xqSTVOek0yTjBNd0xqWXlOVGt3TWlBd0xqSTROVFl4TkNBd0xqWTBOREV3T0NBd0xqSTNPVEl4TmlBd0xqWTJNamczTXlBd0xqSTNPVEl6TTBNd0xqY3dNVFUwSURBdU1qYzVNak16SURBdU56UXlPRGN6SURBdU16QTJPRE16SURBdU56UTVOamN6SURBdU16WTRNME13TGpjNE1qVXpJREF1TXpjME9DQXdMamd4TWpFM015QXdMak01TWpNMUlEQXVPRE16TmpjeklEQXVOREU0TURNelREQXVPREV5TnpRZ01DNDBNelEwTXpORE1DNDNPVEkzTnpVZ01DNDBNVEUxT1RJZ01DNDNOalV5T1RjZ01DNHpPVFkyTkRjZ01DNDNNelV5TnpNZ01DNHpPVEl6UXpBdU56TXlNamN6SURBdU16a3hPREU1SURBdU56STVOVEkySURBdU16a3dNekkzSURBdU56STNORGtnTUM0ek9EZ3dOekpETUM0M01qVTBOVE1nTUM0ek9EVTRNVGNnTUM0M01qUXlORGNnTUM0ek9ESTVNelFnTUM0M01qUXdOek1nTUM0ek56azVRekF1TnpJeE1EQTJJREF1TXpJNE9ETXpJREF1TmpreE1UUWdNQzR6TURVNUlEQXVOall5T0RjeklEQXVNekExT1VNd0xqWTFNems1TnlBd0xqTXdOVGs0TWlBd0xqWTBOVEkySURBdU16QTRNVElnTUM0Mk16Y3pORGtnTUM0ek1USXhORFZETUM0Mk1qazBNemNnTUM0ek1UWXhOeUF3TGpZeU1qVTJOaUF3TGpNeU1UazNOQ0F3TGpZeE56STNNeUF3TGpNeU9URkRNQzQyTVRVNE5ERWdNQzR6TXpFd01Ea2dNQzQyTVRNNU1qSWdNQzR6TXpJME9Ua2dNQzQyTVRFM01UY2dNQzR6TXpNME1UTkRNQzQyTURrMU1UTWdNQzR6TXpRek1qZ2dNQzQyTURjeE1ETWdNQzR6TXpRMk16UWdNQzQyTURRM05DQXdMak16TkRORE1DNDJNREl6TmpZZ01DNHpNek01TXpjZ01DNDJNREF4TXpVZ01DNHpNekk1TkRFZ01DNDFPVGd5T0RFZ01DNHpNekUwTVRaRE1DNDFPVFkwTWpjZ01DNHpNams0T1NBd0xqVTVOVEF4T1NBd0xqTXlOemc1TWlBd0xqVTVOREl3TmlBd0xqTXlOVFl6TTBNd0xqVTROVEEzT1NBd0xqSTVPVGN4TkNBd0xqVTNNREkzTXlBd0xqSTNOakUyTWlBd0xqVTFNRGczTXlBd0xqSTFOamRETUM0MU1qazFOelFnTUM0eU16UTNPRGNnTUM0MU1ESXlPRFlnTUM0eU1UazJORElnTUM0ME56STBNaklnTUM0eU1UTXhOak5ETUM0ME5ESTFOVGtnTUM0eU1EWTJPRE1nTUM0ME1URTBORGNnTUM0eU1Ea3hOVFlnTUM0ek9ESTVPRElnTUM0eU1qQXlOekZETUM0ek5UUTFNVGNnTUM0eU16RXpPRGNnTUM0ek1qazVOak1nTUM0eU5UQTJOVElnTUM0ek1USXpPVE1nTUM0eU56VTJOVFJETUM0eU9UUTRNalFnTUM0ek1EQTJOVFlnTUM0eU9EVXdNVGtnTUM0ek16QXlPRFlnTUM0eU9EUXlNRFlnTUM0ek5qQTRNek5ETUM0eU9EUXlNalVnTUM0ek5qY3lNRE1nTUM0eU9EUTFPREVnTUM0ek56TTFOamdnTUM0eU9EVXlOek1nTUM0ek56azVRekF1TWpnMU5UazBJREF1TXpnek1EZ3lJREF1TWpnME56WXhJREF1TXpnMk1qY3pJREF1TWpneU9USTFJREF1TXpnNE9Ea3lRekF1TWpneE1Ea2dNQzR6T1RFMU1URWdNQzR5Tnpnek56UWdNQzR6T1RNek9ETWdNQzR5TnpVeU56TWdNQzR6T1RReE5qZERNQzR5TkRVd01EWWdNQzQwTURFMk16TWdNQzR4T1RNNU5DQXdMalF5TkRnek15QXdMakU1TXprMElEQXVORGsxTWpNelF6QXVNVGt6T0RBMklEQXVORGszTmpNeElEQXVNVGt6T0RBMklEQXVOVEF3TURNMUlEQXVNVGt6T1RRZ01DNDFNREkwTXpORE1DNHhPVFk0TnpNZ01DNDFOVFUzTmpjZ01DNHlOREUxTkNBd0xqVTVNell6TXlBd0xqTXdNRFl3TmlBd0xqVTVNell6TTBnd0xqUTROekkzTTB3d0xqUTROVGswSURBdU5qSXdNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOekkwTlRFZ01DNDRNVFk0TURWRE1DNDFNVFF6TVRnZ01DNDRNVFk0TURVZ01DNDFNVEkwTlRFZ01DNDJNemt3TnpFZ01DNDFNVEkwTlRFZ01DNDJNemN6TXpoV01DNDBOelV3TnpGRE1DNDFNVEkwTkRJZ01DNDBOekl6TkRjZ01DNDFNVE15TmpnZ01DNDBOamsyT0RVZ01DNDFNVFE0TVRnZ01DNDBOamMwTkRWRE1DNDFNVFl6TmpjZ01DNDBOalV5TURRZ01DNDFNVGcxTmpZZ01DNDBOak0wT1RJZ01DNDFNakV4TVRnZ01DNDBOakkxTXpoTU1DNDJOamMzT0RVZ01DNDBNRGd5TnpGRE1DNDJOekE0TURRZ01DNDBNRGN5TURRZ01DNDJOelF3T1RnZ01DNDBNRGN5TURRZ01DNDJOemN4TVRnZ01DNDBNRGd5TnpGTU1DNDRNak0zT0RVZ01DNDBOakkxTXpoRE1DNDRNall6TXpjZ01DNDBOak0wT1RJZ01DNDRNamcxTXpVZ01DNDBOalV5TURRZ01DNDRNekF3T0RVZ01DNDBOamMwTkRWRE1DNDRNekUyTXpRZ01DNDBOamsyT0RVZ01DNDRNekkwTmlBd0xqUTNNak0wTnlBd0xqZ3pNalExTVNBd0xqUTNOVEEzTVZZd0xqWTBOek16T0VNd0xqZ3pNalExTVNBd0xqWTBPVEEzTVNBd0xqZ3pNRFU0TlNBd0xqZ3hOamd3TlNBd0xqWTNNalExTVNBd0xqZ3hOamd3TlZwTk1DNDFNemt4TVRnZ01DNDBPRFEwTURWV01DNDJNemN6TXpoRE1DNDFNemt4TVRnZ01DNDJORE0yTURVZ01DNDFOREE1T0RVZ01DNDNPVEF4TXpnZ01DNDJOekkwTlRFZ01DNDNPVEF4TXpoRE1DNDRNRE01TVRnZ01DNDNPVEF4TXpnZ01DNDRNRFUzT0RVZ01DNDJOVE15TURVZ01DNDRNRFUzT0RVZ01DNDJORGN6TXpoV01DNDBPRFEwTURWTU1DNDJOekkwTlRFZ01DNDBNelE1TXpoTU1DNDFNemt4TVRnZ01DNDBPRFEwTURWYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpjeU5ETTVJREF1TnpZMk9USTBRekF1TlRnM05qTTVJREF1TnpZMk9USTBJREF1TlRZMk9ETTVJREF1TmpVNU16STBJREF1TlRZMU56Y3pJREF1TmpVME56a3hRekF1TlRZMU5qUXhJREF1TmpVek9UazJJREF1TlRZMU5qUXhJREF1TmpVek1UZzFJREF1TlRZMU56Y3pJREF1TmpVeU16a3hWakF1TlRFME1qVTRRekF1TlRZMU56Y2dNQzQxTVRFMU9EY2dNQzQxTmpZMU5qa2dNQzQxTURnNU56Z2dNQzQxTmpnd05qY2dNQzQxTURZM05qZERNQzQxTmprMU5qVWdNQzQxTURRMU5UWWdNQzQxTnpFMk9USWdNQzQxTURJNE5EWWdNQzQxTnpReE56TWdNQzQxTURFNE5UaE1NQzQyTmpjMU1EWWdNQzQwTmpVd05UaERNQzQyTnpBMk56UWdNQzQwTmpNM09UWWdNQzQyTnpReU1EVWdNQzQwTmpNM09UWWdNQzQyTnpjek56TWdNQzQwTmpVd05UaE1NQzQzTnpBM01EWWdNQzQxTURFNE5UaERNQzQzTnpNeE9EY2dNQzQxTURJNE5EWWdNQzQzTnpVek1UUWdNQzQxTURRMU5UWWdNQzQzTnpZNE1USWdNQzQxTURZM05qZERNQzQzTnpnek1Ea2dNQzQxTURnNU56Z2dNQzQzTnpreE1Ea2dNQzQxTVRFMU9EY2dNQzQzTnpreE1EWWdNQzQxTVRReU5UaFdNQzQyTlRJek9URkRNQzQzTnpreE56SWdNQzQyTlRNeE9TQXdMamMzT1RFM01pQXdMalkxTXprNU1pQXdMamMzT1RFd05pQXdMalkxTkRjNU1VTXdMamMzT0RBek9TQXdMalkxT1RNeU5DQXdMamMxTnpJek9TQXdMamMyTmpreU5DQXdMalkzTWpRek9TQXdMamMyTmpreU5GcE5NQzQxT1RJME16a2dNQzQyTlRFd05UaERNQzQxT1RRMU56TWdNQzQyTmpFeE9URWdNQzQyTVRNMk16a2dNQzQzTkRBeU5UZ2dNQzQyTnpJME16a2dNQzQzTkRBeU5UaERNQzQzTXpFeU16a2dNQzQzTkRBeU5UZ2dNQzQzTlRBek1EWWdNQzQyTmpFek1qUWdNQzQzTlRJME16a2dNQzQyTlRFd05UaFdNQzQxTWpNek1qUk1NQzQyTnpJME16a2dNQzQwT1RFNE5UaE1NQzQxT1RJME16a2dNQzQxTWpNek1qUldNQzQyTlRFd05UaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6UkVNamRCT0NJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalFURTJOa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO3N0cm9rZVdpZHRoPTE7IiBpZD0iMjMiPjxteENlbGwgc3R5bGU9ImlyLnJlZj05NDc1MTYwNC1mY2Y3LTQ2M2EtYjYwMy1iNmZhZDRjNWQwZjA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9dnBjO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9InRlbXBsYXRlLTEwMDQyMS1mYWM4OWY0MS01ZjRiLTQ5YjgtYjJiMS0yY2RiZjYxNjYzOWQtMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzYiIHk9IjYxIiB3aWR0aD0iNzQ4IiBoZWlnaHQ9IjI0NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMjYiIHZhbHVlPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIC0+IEFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkiIHN0eWxlPSJpci5yZWY9ODg4NTM3NTAtMGYwNC00NmZkLTkzMTAtYzljNDk4ZDgwMGY3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMjMiIHNvdXJjZT0iMjQiIHRhcmdldD0iMjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzNDYiIHk9IjM0Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjQiIHZhbHVlPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBzdHlsZT0iaXIucmVmPTg3ZGMwNjZhLTNiNGQtNDM5Yy1hMDAyLWRkNDI0YWJmODdmZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lYzI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNRFkyTWpnZ01DNDFNems1TlRsSU1DNDNNems1TmpGV01DNDFNVE15T1ROSU1DNDRNRFkyTWpoV01DNHhPVE15T1ROSU1DNDBPRFkyTWpoV01DNHlOVGs1TlRsSU1DNDBOVGs1TmpGV01DNHhPVE15T1RORE1DNDBOVGs1TmpFZ01DNHhPRFl5TWlBd0xqUTJNamMzSURBdU1UYzVORE0zSURBdU5EWTNOemN4SURBdU1UYzBORE0yUXpBdU5EY3lOemN5SURBdU1UWTVORE0xSURBdU5EYzVOVFUxSURBdU1UWTJOakkySURBdU5EZzJOakk0SURBdU1UWTJOakkyU0RBdU9EQTJOakk0UXpBdU9ERXpOeUF3TGpFMk5qWXlOaUF3TGpneU1EUTRNeUF3TGpFMk9UUXpOU0F3TGpneU5UUTROQ0F3TGpFM05EUXpOa013TGpnek1EUTROU0F3TGpFM09UUXpOeUF3TGpnek16STVOQ0F3TGpFNE5qSXlJREF1T0RNek1qazBJREF1TVRrek1qa3pWakF1TlRFek1qa3pRekF1T0RNek1qazBJREF1TlRJd016WTFJREF1T0RNd05EZzFJREF1TlRJM01UUTRJREF1T0RJMU5EZzBJREF1TlRNeU1UUTVRekF1T0RJd05EZ3pJREF1TlRNM01UVWdNQzQ0TVRNM0lEQXVOVE01T1RVNUlEQXVPREEyTmpJNElEQXVOVE01T1RVNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVeE16RTNJREF1T0RNek1qazBTREF1TVRrek1UY3hRekF1TVRnMk1EazRJREF1T0RNek1qazBJREF1TVRjNU16RTFJREF1T0RNd05EZzFJREF1TVRjME16RTBJREF1T0RJMU5EZzBRekF1TVRZNU16RXpJREF1T0RJd05EZ3pJREF1TVRZMk5UQTBJREF1T0RFek55QXdMakUyTmpVd05DQXdMamd3TmpZeU4xWXdMalE0TmpZeU9FTXdMakUyTmpVd05DQXdMalEzT1RVMU5TQXdMakUyT1RNeE15QXdMalEzTWpjM01pQXdMakUzTkRNeE5DQXdMalEyTnpjM01VTXdMakUzT1RNeE5TQXdMalEyTWpjM0lEQXVNVGcyTURrNElEQXVORFU1T1RZeElEQXVNVGt6TVRjeElEQXVORFU1T1RZeFNEQXVNalU1T0RNM1ZqQXVORGcyTmpJNFNEQXVNVGt6TVRjeFZqQXVPREEyTmpJM1NEQXVOVEV6TVRkV01DNDNNems1TmpGSU1DNDFNems0TXpaV01DNDRNRFkyTWpkRE1DNDFNems0TXpZZ01DNDRNVE0zSURBdU5UTTNNREkzSURBdU9ESXdORGd6SURBdU5UTXlNREkySURBdU9ESTFORGcwUXpBdU5USTNNREkxSURBdU9ETXdORGcxSURBdU5USXdNalF5SURBdU9ETXpNamswSURBdU5URXpNVGNnTUM0NE16TXlPVFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekV6TWpnNUlEQXVNemM1T1RVMVZqQXVNelV6TWpnNFNEQXVOamN6TWpnNVF6QXVOamN5TnpRZ01DNHpORFl6T1RnZ01DNDJOamszTlRRZ01DNHpNems1TXlBd0xqWTJORGcyTnlBd0xqTXpOVEEwTTBNd0xqWTFPVGs0SURBdU16TXdNVFUySURBdU5qVXpOVEV5SURBdU16STNNVGNnTUM0Mk5EWTJNaklnTUM0ek1qWTJNakZXTUM0eU9EWTJNakZJTUM0Mk1UazVOVFZXTUM0ek1qWTJNakZJTUM0MU56azVOVFZXTUM0eU9EWTJNakZJTUM0MU5UTXlPRGhXTUM0ek1qWTJNakZJTUM0MU1UTXlPRGhXTUM0eU9EWTJNakZJTUM0ME9EWTJNakpXTUM0ek1qWTJNakZJTUM0ME5EWTJNakZXTUM0eU9EWTJNakZJTUM0ME1UazVOVFZXTUM0ek1qWTJNakZJTUM0ek56azVOVFZXTUM0eU9EWTJNakZJTUM0ek5UTXlPRGhXTUM0ek1qWTJNakZETUM0ek5EWXpPVGdnTUM0ek1qY3hOeUF3TGpNek9Ua3pJREF1TXpNd01UVTJJREF1TXpNMU1EUXpJREF1TXpNMU1EUXpRekF1TXpNd01UVTJJREF1TXpNNU9UTWdNQzR6TWpjeE55QXdMak0wTmpNNU9DQXdMak15TmpZeU1TQXdMak0xTXpJNE9FZ3dMakk0TmpZeU1WWXdMak0zT1RrMU5VZ3dMak15TmpZeU1WWXdMalF4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalEwTmpZeU1VZ3dMak15TmpZeU1WWXdMalE0TmpZeU1rZ3dMakk0TmpZeU1WWXdMalV4TXpJNE9FZ3dMak15TmpZeU1WWXdMalUxTXpJNE9FZ3dMakk0TmpZeU1WWXdMalUzT1RrMU5VZ3dMak15TmpZeU1WWXdMall4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalkwTmpZeU1rZ3dMak15TmpZeU1VTXdMak15TnpFM0lEQXVOalV6TlRFeElEQXVNek13TVRVMklEQXVOalU1T1RnZ01DNHpNelV3TkRNZ01DNDJOalE0TmpkRE1DNHpNems1TXlBd0xqWTJPVGMxTkNBd0xqTTBOak01T0NBd0xqWTNNamMwSURBdU16VXpNamc0SURBdU5qY3pNamc1VmpBdU56RXpNamc1U0RBdU16YzVPVFUxVmpBdU5qY3pNamc1U0RBdU5ERTVPVFUxVmpBdU56RXpNamc1U0RBdU5EUTJOakl4VmpBdU5qY3pNamc1U0RBdU5EZzJOakl5VmpBdU56RXpNamc1U0RBdU5URXpNamc0VmpBdU5qY3pNamc1U0RBdU5UVXpNamc0VmpBdU56RXpNamc1U0RBdU5UYzVPVFUxVmpBdU5qY3pNamc1U0RBdU5qRTVPVFUxVmpBdU56RXpNamc1U0RBdU5qUTJOakl5VmpBdU5qY3pNamc1UXpBdU5qVXpOVEV5SURBdU5qY3lOelFnTUM0Mk5UazVPQ0F3TGpZMk9UYzFOQ0F3TGpZMk5EZzJOeUF3TGpZMk5EZzJOME13TGpZMk9UYzFOQ0F3TGpZMU9UazRJREF1TmpjeU56UWdNQzQyTlRNMU1URWdNQzQyTnpNeU9Ea2dNQzQyTkRZMk1qSklNQzQzTVRNeU9EbFdNQzQyTVRrNU5UVklNQzQyTnpNeU9EbFdNQzQxTnprNU5UVklNQzQzTVRNeU9EbFdNQzQxTlRNeU9EaElNQzQyTnpNeU9EbFdNQzQxTVRNeU9EaElNQzQzTVRNeU9EbFdNQzQwT0RZMk1qSklNQzQyTnpNeU9EbFdNQzQwTkRZMk1qRklNQzQzTVRNeU9EbFdNQzQwTVRrNU5UVklNQzQyTnpNeU9EbFdNQzR6TnprNU5UVklNQzQzTVRNeU9EbGFUVEF1TmpRMk5qSXlJREF1TmpRME1qSXlRekF1TmpRMk5qSXlJREF1TmpRME9EVTRJREF1TmpRMk16WTVJREF1TmpRMU5EWTVJREF1TmpRMU9URTVJREF1TmpRMU9URTVRekF1TmpRMU5EWTVJREF1TmpRMk16WTVJREF1TmpRME9EVTVJREF1TmpRMk5qSXlJREF1TmpRME1qSXlJREF1TmpRMk5qSXlTREF1TXpVMU5qZzRRekF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVME5EUXhJREF1TmpRMk16WTVJREF1TXpVek9Ua3hJREF1TmpRMU9URTVRekF1TXpVek5UUXhJREF1TmpRMU5EWTVJREF1TXpVek1qZzRJREF1TmpRME9EVTRJREF1TXpVek1qZzRJREF1TmpRME1qSXlWakF1TXpVMU5qZzRRekF1TXpVek1qZzRJREF1TXpVMU1EVXhJREF1TXpVek5UUXhJREF1TXpVME5EUXhJREF1TXpVek9Ua3hJREF1TXpVek9Ua3hRekF1TXpVME5EUXhJREF1TXpVek5UUXhJREF1TXpVMU1EVXhJREF1TXpVek1qZzRJREF1TXpVMU5qZzRJREF1TXpVek1qZzRTREF1TmpRME1qSXlRekF1TmpRME9EVTVJREF1TXpVek1qZzRJREF1TmpRMU5EWTVJREF1TXpVek5UUXhJREF1TmpRMU9URTVJREF1TXpVek9Ua3hRekF1TmpRMk16WTVJREF1TXpVME5EUXhJREF1TmpRMk5qSXlJREF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVMU5qZzRWakF1TmpRME1qSXlXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01pSWdlVEU5SWpFdU1qQTNNaUlnZURJOUlqRXVNakEzTURjaUlIa3lQU0l0TUM0eU1EY3dOamNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlORE9EVXhNVUlpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaR09Ua3dNQ0l2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTUyIiB5PSI0OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9IkFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkgLT4gQVdTIEEySSAoQXVnbWVudGVkIEFJKSIgc3R5bGU9ImlyLnJlZj04OTAxM2UyZC04YzRkLTQ5NDYtOTcxYy02MmU4ZDk1MWMyNzA7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyMyIgc291cmNlPSIyNSIgdGFyZ2V0PSIyOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI1IiB2YWx1ZT0iQVdTIFJEUyAoUmVsYXRpb25hbCBEYXRhYmFzZSBTZXJ2aWNlKSIgc3R5bGU9ImlyLnJlZj1lMGJkOWZiNS1mMWYzLTRkMzktODJlZi1kMDEzMDVlZGQzZDQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cmRzO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTkRZd01ETWdNQzR6TnpZME56bERNQzQyTkRZd01ETWdNQzR6TXpjNE1UTWdNQzQxTnpBeE16Y2dNQzR6TVRrNU5EWWdNQzQwT1Rrek16Y2dNQzR6TVRrNU5EWkRNQzQwTWpnMU16Y2dNQzR6TVRrNU5EWWdNQzR6TlRJMk55QXdMak16TnpneE15QXdMak0xTWpZM0lEQXVNemMyTkRjNVF6QXVNelV5TmpFeUlEQXVNemM0TkRFeklEQXVNelV5T0RNM0lEQXVNemd3TXpRMElEQXVNelV6TXpNM0lEQXVNemd5TWpFelZqQXVOakl5T0RjNVF6QXVNelV5TmpjZ01DNDJOakk0TnprZ01DNDBNamcyTnlBd0xqWTNPVGswTlNBd0xqVXdNREF3TXlBd0xqWTNPVGswTlVNd0xqVTNNVE16TnlBd0xqWTNPVGswTlNBd0xqWTBOalkzSURBdU5qWXlNelExSURBdU5qUTJOamNnTUM0Mk1qTTJOemxXTUM0ek56WTBOemxJTUM0Mk5EWXdNRE5hVFRBdU5EazVOakF6SURBdU16UTJOelEyUXpBdU5UYzNNek0zSURBdU16UTJOelEySURBdU5qRTVOakF6SURBdU16WTNPVFEySURBdU5qRTVOakF6SURBdU16YzJOakV6UXpBdU5qRTVOakF6SURBdU16ZzFNamM1SURBdU5UYzNOakF6SURBdU5EQTJORGM1SURBdU5EazVOakF6SURBdU5EQTJORGM1UXpBdU5ESXhOakF6SURBdU5EQTJORGM1SURBdU16YzVOakF6SURBdU16ZzFOREV6SURBdU16YzVOakF6SURBdU16YzJOakV6UXpBdU16YzVOakF6SURBdU16WTNPREV6SURBdU5ESXhPRGNnTUM0ek5EWTNORFlnTUM0ME9UazJNRE1nTUM0ek5EWTNORFphVFRBdU5qRTVOakF6SURBdU5qSXpPREV5UXpBdU5qRTVOakF6SURBdU5qTXlNelExSURBdU5UYzNORGNnTUM0Mk5UTTBNVElnTUM0ME9UazJNRE1nTUM0Mk5UTTBNVEpETUM0ME1qRTNNemNnTUM0Mk5UTTBNVElnTUM0ek56azJNRE1nTUM0Mk16SXpORFVnTUM0ek56azJNRE1nTUM0Mk1qTTRNVEpXTUM0MU9ERTJOemxETUM0ME1EYzNNemNnTUM0MU9UY3dNVElnTUM0ME5UUTVNemNnTUM0Mk1EUXpORFVnTUM0ME9UazJNRE1nTUM0Mk1EUXpORFZETUM0MU5EUXlOeUF3TGpZd05ETTBOU0F3TGpVNU1UQTNJREF1TlRrM01UUTFJREF1TmpFNU5qQXpJREF1TlRneU1EYzVWakF1TmpJek9ERXlXazB3TGpZeE9UWXdNeUF3TGpVME56azBOa013TGpZeE9UWXdNeUF3TGpVMU5qUTNPU0F3TGpVM056WXdNeUF3TGpVM056Z3hNaUF3TGpRNU9UWXdNeUF3TGpVM056Z3hNa013TGpReU1UWXdNeUF3TGpVM056Z3hNaUF3TGpNM09UWXdNeUF3TGpVMU5qUTNPU0F3TGpNM09UWXdNeUF3TGpVME56azBOa2d3TGpNNE1EQXdNMVl3TGpRNU56QXhNa013TGpRd09ERXpOeUF3TGpVeE1qSXhNaUF3TGpRMU5UTXpOeUF3TGpVeE9UVTBOaUF3TGpVd01EQXdNeUF3TGpVeE9UVTBOa013TGpVME5EWTNJREF1TlRFNU5UUTJJREF1TlRreE5EY2dNQzQxTVRJek5EWWdNQzQyTWpBd01ETWdNQzQwT1RjeU56bE1NQzQyTVRrMk1ETWdNQzQxTkRjNU5EWmFUVEF1TmpFNU5qQXpJREF1TkRZek1ERXpRekF1TmpFNU5qQXpJREF1TkRjeE5qYzVJREF1TlRjM05qQXpJREF1TkRrek1ERXlJREF1TkRrNU5qQXpJREF1TkRrek1ERXlRekF1TkRJeE5qQXpJREF1TkRrek1ERXlJREF1TXpjNU5qQXpJREF1TkRjeE5qYzVJREF1TXpjNU5qQXpJREF1TkRZek1ERXpTREF1TXpnd01EQXpWakF1TkRFeE1ERXpRekF1TkRBNE5EQXpJREF1TkRJMk1EYzVJREF1TkRVMU1EY2dNQzQwTXpNd01UTWdNQzQxTURBd01ETWdNQzQwTXpNd01UTkRNQzQxTkRRNU16Y2dNQzQwTXpNd01UTWdNQzQxT1RJeE16Y2dNQzQwTWpVNE1UTWdNQzQyTWpBd01ETWdNQzQwTVRBME56bE1NQzQyTVRrMk1ETWdNQzQwTmpNd01UTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qRXlNRGt6SURBdU9EQTJPRWd3TGpJNU9UazFPVll3TGpnek16UTJOa2d3TGpFM09UazFPVU13TGpFM05qUXlNeUF3TGpnek16UTJOaUF3TGpFM016QXpNaUF3TGpnek1qQTJNU0F3TGpFM01EVXpNU0F3TGpneU9UVTJNVU13TGpFMk9EQXpNU0F3TGpneU56QTJNU0F3TGpFMk5qWXlOaUF3TGpneU16WTJPU0F3TGpFMk5qWXlOaUF3TGpneU1ERXpNMVl3TGpjd01ERXpNMGd3TGpFNU16STVNMVl3TGpjNE56Y3pNMHd3TGpJNU16STVNeUF3TGpZNE56ZzJOa3d3TGpNeE1UazFPU0F3TGpjd05qWTJOa3d3TGpJeE1qQTVNeUF3TGpnd05qaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ETXpNek14SURBdU56QXdNVE14VmpBdU9ESXdNVE14UXpBdU9ETXpNek14SURBdU9ESXpOalkzSURBdU9ETXhPVEkySURBdU9ESTNNRFU1SURBdU9ESTVOREkySURBdU9ESTVOVFU1UXpBdU9ESTJPVEkxSURBdU9ETXlNRFlnTUM0NE1qTTFNelFnTUM0NE16TTBOalFnTUM0NE1UazVPVGdnTUM0NE16TTBOalJJTUM0Mk9UazVPVGhXTUM0NE1EWTNPVGhJTUM0M09EYzROalJNTUM0Mk9Ea3pNekVnTUM0M01EYzVPVGhNTUM0M01EZ3hNekVnTUM0Mk9Ea3pNekZNTUM0NE1EWTJOalFnTUM0M09EYzNNekZXTUM0M01EQXhNekZJTUM0NE16TXpNekZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPRE16TXpNeElEQXVNVGd3TWpBMFZqQXVNekF3TWpBMFNEQXVPREEyTmpZMFZqQXVNakV5TWpBMFREQXVOekE0TVRNeElEQXVNekV3TnpNNFREQXVOamc1TXpNeElEQXVNamt4T1RNNFREQXVOemczTnpNeElEQXVNVGt6TlRNM1NEQXVOams1T1RrNFZqQXVNVFkyT0RkSU1DNDRNVGs1T1RoRE1DNDRNak0xTXpRZ01DNHhOalk0TnlBd0xqZ3lOamt5TlNBd0xqRTJPREkzTlNBd0xqZ3lPVFF5TmlBd0xqRTNNRGMzTlVNd0xqZ3pNVGt5TmlBd0xqRTNNekkzTmlBd0xqZ3pNek16TVNBd0xqRTNOalkyTnlBd0xqZ3pNek16TVNBd0xqRTRNREl3TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TVRFNU5Ua2dNQzR5T1RNek1EUk1NQzR5T1RNeU9UTWdNQzR6TVRFNU56Rk1NQzR4T1RNeU9UTWdNQzR5TVRJeE1EUldNQzR5T1RrNE16ZElNQzR4TmpZMk1qWldNQzR4TnprNE16ZERNQzR4TmpZMk1qWWdNQzR4TnpZek1ERWdNQzR4Tmpnd016RWdNQzR4TnpJNU1TQXdMakUzTURVek1TQXdMakUzTURRd09VTXdMakUzTXpBek1pQXdMakUyTnprd09TQXdMakUzTmpReU15QXdMakUyTmpVd05DQXdMakUzT1RrMU9TQXdMakUyTmpVd05FZ3dMakk1T1RrMU9WWXdMakU1TXpFM01VZ3dMakl4TWpBNU0wd3dMak14TVRrMU9TQXdMakk1TXpNd05Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU9UVTBPVEVnTUM0Mk1UazFNRE5ETUM0eU1UUXdNalVnTUM0MU9UQXhOeUF3TGpFMk56TTFPQ0F3TGpVME5UTTJPU0F3TGpFMk56TTFPQ0F3TGpRNU5qY3dNa013TGpFMk56TTFPQ0F3TGpRME9EQXpOU0F3TGpJeE5EQXlOU0F3TGpRd016TTJPQ0F3TGpJNU5UUTVNU0F3TGpNM016a3dNVXd3TGpNd05EVTFOeUF3TGpNNU9EazJPRU13TGpJek5UTTFPQ0F3TGpReU16a3dNaUF3TGpFNU5EQXlOU0F3TGpRMk1EUXpOU0F3TGpFNU5EQXlOU0F3TGpRNU5qY3dNa013TGpFNU5EQXlOU0F3TGpVek1qazJPU0F3TGpJek5UTTFPQ0F3TGpVMk9UVXdNeUF3TGpNd05EVTFOeUF3TGpVNU5EUXpOMHd3TGpJNU5UUTVNU0F3TGpZeE9UVXdNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJPVGN4TXpJZ01DNDJNakkwTkV3d0xqWTRPRFU1T1NBd0xqVTVOekV3TjBNd0xqYzJNalU1T1NBd0xqVTNNakUzTXlBd0xqZ3dOamN6TWlBd0xqVXpORFUzTXlBd0xqZ3dOamN6TWlBd0xqUTVOamN3TmtNd0xqZ3dOamN6TWlBd0xqUTFPRGd6T1NBd0xqYzJNalU1T1NBd0xqUXlNVEl6T1NBd0xqWTRPRFU1T1NBd0xqTTVOakUzTWt3d0xqWTVOekV6TWlBd0xqTTNNRGszTWtNd0xqYzRNelkyTlNBd0xqUXdNREF6T1NBd0xqZ3pNek01T1NBd0xqUTBOakUzTWlBd0xqZ3pNek01T1NBd0xqUTVOamN3TmtNd0xqZ3pNek01T1NBd0xqVTBOekkwSURBdU56Z3pOalkxSURBdU5Ua3pNVEEzSURBdU5qazNNVE15SURBdU5qSXlORFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3dOamNpSUhreFBTSXhMakl3TnpBM0lpQjRNajBpTVM0eU1EY3lJaUI1TWowaUxUQXVNakEzTWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6SkZNamRCUkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5USTNSa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjU4IiB5PSI1MyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMSIgdmFsdWU9IkFXUyBBMkkgKEF1Z21lbnRlZCBBSSkgLT4gQVdTIEVDMiAoRWxhc3RpYyBDb21wdXRlIENsb3VkKSIgc3R5bGU9ImlyLnJlZj0wMjVhYjFmMi1mNjE1LTQzOGUtYTQwYS0zZjg4YzYzNDNkN2E7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyMyIgc291cmNlPSIyOCIgdGFyZ2V0PSIyNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iQVdTIEEySSAoQXVnbWVudGVkIEFJKSIgc3R5bGU9ImlyLnJlZj1jNjIwNmZiYy0yYWRhLTRkMGYtODZiNi02NmFhZjA4ZTk3YjI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQTJJO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3WHpFMU16WmZNalF6TlRjaUlITjBlV3hsUFNKdFlYTnJMWFI1Y0dVNllXeHdhR0VpSUcxaGMydFZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpSUhnOUlqQWlJSGs5SWpBaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlQaVlqZUdFN1BHTnBjbU5zWlNCamVEMGlNQzQxSWlCamVUMGlNQzQxSWlCeVBTSXdMalVpSUdacGJHdzlJbUpzWVdOcklpOCtKaU40WVRzOEwyMWhjMnMrSmlONFlUczhaeUJ0WVhOclBTSjFjbXdvSTIxaGMyc3dYekUxTXpaZk1qUXpOVGNwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DQXdTREZXTUM0NU9UazVPVGxJTUZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeVh6RTFNelpmTWpRek5UY3BJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qWXdNekV5SURBdU9ESTFNRFkyUXpBdU5qVTJORFl5SURBdU56YzJOVEkySURBdU5qTXdORGt6SURBdU56TXlNRFUySURBdU5Ua3dOVGN6SURBdU56QTJPRGsyUXpBdU5UWTRORGt6SURBdU5qa3lPVGsySURBdU5UUXpNVGN6SURBdU5qZzFOak0zSURBdU5URTNNek16SURBdU5qZzFOakkzUXpBdU5EUXlNakV6SURBdU5qZzFOakkzSURBdU16Z3dNemcwSURBdU56UTNNVEUySURBdU16YzBNelkwSURBdU9ESTFNRFkyU0RBdU5qWXdNekV5V2swd0xqVXhOell3TXlBd0xqWTJNRFl5TjBNd0xqVTJNRFU0TXlBd0xqWTJNRFl5TnlBd0xqVTVOVFV6TXlBd0xqWXlOVFkyTnlBd0xqVTVOVFV5TXlBd0xqVTRNalk1TjBNd0xqVTVOVFV5TXlBd0xqVXpPVGN4TnlBd0xqVTJNRFUzTXlBd0xqVXdORGMxTnlBd0xqVXhOell3TXlBd0xqVXdORGMxTjBNd0xqUTNORFl5TXlBd0xqVXdORGMxTnlBd0xqUXpPVFkyTXlBd0xqVXpPVGN4TnlBd0xqUXpPVFkyTXlBd0xqVTRNalk1TjBNd0xqUXpPVFkyTXlBd0xqWXlOVFkzTnlBd0xqUTNORFl5TXlBd0xqWTJNRFl6TnlBd0xqVXhOell3TXlBd0xqWTJNRFl5TjFwTk1DNDJPRFU0TURJZ01DNDRNemMxTmpaRE1DNDJPRFU0TURJZ01DNDRORFEwTmpZZ01DNDJPREF5TVRJZ01DNDROVEF3TmpZZ01DNDJOek16TURJZ01DNDROVEF3TmpaSU1DNHpOakV6T0RSRE1DNHpOVFEwTnpRZ01DNDROVEF3TmpZZ01DNHpORGc0T0RRZ01DNDRORFEwTmpZZ01DNHpORGc0T0RRZ01DNDRNemMxTmpaRE1DNHpORGc0T0RRZ01DNDNOVGs0TURZZ01DNHpPVFk1TmpNZ01DNDJPVE0zTlRZZ01DNDBOak0wTmpNZ01DNDJOekF3TnpkRE1DNDBNelF5TWpNZ01DNDJOVEU1TURjZ01DNDBNVFEyTmpNZ01DNDJNVGsxTnpjZ01DNDBNVFEyTmpNZ01DNDFPREkyT1RkRE1DNDBNVFEyTmpNZ01DNDFNalU1TXpjZ01DNDBOakE0TXpNZ01DNDBOemszTlRjZ01DNDFNVGMyTURNZ01DNDBOemszTlRkRE1DNDFOelF6TlRNZ01DNDBOemszTlRjZ01DNDJNakExTXpNZ01DNDFNalU1TWpjZ01DNDJNakExTWpNZ01DNDFPREkyT1RkRE1DNDJNakExTWpNZ01DNDJNVGsyTURjZ01DNDJNREE1TXpNZ01DNDJOVEU1TXpjZ01DNDFOekUyT0RNZ01DNDJOekF4TVRkRE1DNDFPREk0T0RNZ01DNDJOelF4TURjZ01DNDFPVE0yT1RNZ01DNDJOemt6TURjZ01DNDJNRE01TURNZ01DNDJPRFUzTkRkRE1DNDJOVFEwTVRJZ01DNDNNVGMxT0RZZ01DNDJPRFU0TURJZ01DNDNOelUzTlRZZ01DNDJPRFU0TURJZ01DNDRNemMxTmpaV01DNDRNemMxTmpaYVRUQXVNalUyTWpnMElEQXVOVEUwTkRFM1REQXVNalk1TVRVMElEQXVOVE0xT0RVM1REQXVNelF5TXpjMElEQXVORGt4T1RJM1REQXVNemczT0RBeklEQXVOVEU1TXprM1REQXVOREF3TnpNeklEQXVORGs0TURBM1REQXVNelV3T0RFMElEQXVORFkzT0RBM1REQXVNelV3T0RJMElEQXVOREV6T0RrM1REQXVORE15TURJeklEQXVNelkzTXpJM1F6QXVORE0xT1RJeklEQXVNelkxTVRBM0lEQXVORE00TXpFeklEQXVNell3T1RZM0lEQXVORE00TXpFeklEQXVNelUyTkRrM1ZqQXVNak0zTXpVNFNEQXVOREV6TXpFelZqQXVNelE1TWpVM1REQXVNek00TlRFMElEQXVNemt5TVRRM1REQXVNall6TXpFMElEQXVNelV3TVRrM1ZqQXVNalUyTVRrNFREQXVNek00TXpFMElEQXVNakV4TkRZNFZqQXVNams1T0RVM1NEQXVNell6TXpFMFZqQXVNVGsyTlRVNFREQXVOREUzTmpVeklEQXVNVFkwTVRRNFREQXVOVEF3T0RFeklEQXVNakEwTVRRNFZqQXVORFE1T0RVM1NEQXVOVEkxT0RFelZqQXVNVGsyTWpjNFF6QXVOVEkxT0RFeklEQXVNVGt4TkRjNElEQXVOVEl6TURZeklEQXVNVGczTURnNElEQXVOVEU0TnpNeklEQXVNVGcxTURFNFREQXVOREl5TkRNeklEQXVNVE00TnpBNFF6QXVOREU0TmpNeklEQXVNVE0yT0RrNElEQXVOREUwTWpJeklEQXVNVE0zTURrNElEQXVOREV3TmpBeklEQXVNVE01TWpJNFREQXVNalEwTkRFMElEQXVNak00TXpVNFF6QXVNalF3TmpNMElEQXVNalF3TmpFNElEQXVNak00TXpFMElEQXVNalEwTmprNElEQXVNak00TXpFMElEQXVNalE1TURrNFZqQXVNelF6TnprM1REQXVNVFU0TmpjMElEQXVNemMxTmpRM1F6QXVNVFV6T1RNMElEQXVNemMzTlRRM0lEQXVNVFV3T0RNMElEQXVNemd5TVRBM0lEQXVNVFV3T0RFMElEQXVNemczTWpBM1REQXVNVFV3TURJMElEQXVOVGMyT1RJM1F6QXVNVFV3TURFMElEQXVOVGd4TWpRM0lEQXVNVFV5TWpJMElEQXVOVGcxTWpjM0lEQXVNVFUxT0RnMElEQXVOVGczTlRjM1REQXVNak00TXpFMElEQXVOak01TVRjM1ZqQXVOekl5TkRZMlF6QXVNak00TXpFMElEQXVOekkyTXprMklEQXVNalF3TVRjMElEQXVOek13TVRBMklEQXVNalF6TXpJMElEQXVOek15TkRVMlREQXVNekE1TURnMElEQXVOemd4TnprMlREQXVNekkwTURnMElEQXVOell4TnprMlREQXVNall6TXpFMElEQXVOekUyTWpFMlZqQXVOak15TWpVM1F6QXVNall6TXpFMElEQXVOak13T1RZM0lEQXVNall6TVRJMElEQXVOakk1TnpBM0lEQXVNall5TnpNMElEQXVOakk0TlRBM1REQXVNek0wT1RNMElEQXVOVGcxTVRrM1REQXVNekl5TURZMElEQXVOVFl6TnpVM1REQXVNalF4T0RJMElEQXVOakV4T0RrM1REQXVNVGMxTURVMElEQXVOVGN3TURjM1REQXVNVGMxTXpNMElEQXVOVEF3TURZM1REQXVNalV5TnpFMElEQXVORFV6TmpRM1REQXVNak01T0RNMElEQXVORE15TWpBM1REQXVNVGMxTkRZMElEQXVORGN3T0RJM1REQXVNVGMxTnpjMElEQXVNemsxTnpJM1REQXVNalEwTkRJMElEQXVNelk0TWpjM1REQXVNekkxT0RJMElEQXVOREV6TmprM1REQXVNekkxT0RFMElEQXVORGN5TnpFM1REQXVNalUyTWpnMElEQXVOVEUwTkRFM1drMHdMalkwTmpjeE1pQXdMalV5T0Rnd04wTXdMalkxTVRBd01pQXdMalV4TkRZeE55QXdMalkxTXpFM01pQXdMalV3TURFeE55QXdMalkxTXpFM01pQXdMalE0TlRjeU4wTXdMalkxTXpFM01pQXdMalF4T1RneE55QXdMall3T1RBMU15QXdMak0yTVRNM055QXdMalUwTlRnNE15QXdMak0wTXpZeE4wd3dMalV6T1RFeU15QXdMak0yTnpZNU4wTXdMalU1TVRVME15QXdMak00TWpRek55QXdMall5T0RFM015QXdMalF6TURrM055QXdMall5T0RFM015QXdMalE0TlRjeU4wTXdMall5T0RFM015QXdMalE1TnpZMk55QXdMall5TmpNMk15QXdMalV3T1RjeU55QXdMall5TWpjNE15QXdMalV5TVRVM04wd3dMalkwTmpjeE1pQXdMalV5T0Rnd04xcE5NQzQ0TlRBd01ESWdNQzQxTkRVME1qZE1NQzQ0TURJNE1ESWdNQzQyTmpnNU1UZERNQzQ0TURFMU9ESWdNQzQyTnpJeE5EY2dNQzQzT1Rrd09ESWdNQzQyTnpRM01EY2dNQzQzT1RVNE9ESWdNQzQyTnpZd01UZERNQzQzT1RJMk9USWdNQzQyTnpjek1qY2dNQzQzT0RreE1qSWdNQzQyTnpjeU5qY2dNQzQzT0RVNU9ESWdNQzQyTnpVNE5UZE1NQzQzTkRVME56SWdNQzQyTlRjMU9UZERNQzQzTkRNM01ESWdNQzQyTmpBME16Y2dNQzQzTkRJd01qSWdNQzQyTmpNeE5qY2dNQzQzTkRBek9ESWdNQzQyTmpVNE1qZERNQzQzTWpreU9ESWdNQzQyT0RNNU1UWWdNQzQzTVRrMk9USWdNQzQyT1RrMU5UWWdNQzQyT1RjNE5qSWdNQzQzTVRZd05EWk1NQzQyT0RJNE1ESWdNQzQyT1RZd056WkRNQzQzTURBNE5qSWdNQzQyT0RJME5EWWdNQzQzTURnMU1ESWdNQzQyTmprNU9EY2dNQzQzTVRrd09ESWdNQzQyTlRJM05UZERNQzQzTWpJMU1USWdNQzQyTkRjeE9EY2dNQzQzTWpZeE5ESWdNQzQyTkRFeU5UY2dNQzQzTXpBek9ESWdNQzQyTXpRNE5UZERNQzQzTXpNM09ESWdNQzQyTWprM05UY2dNQzQzTkRBek5qSWdNQzQyTWpjNE5qY2dNQzQzTkRVNU5USWdNQzQyTXpBek56ZE1NQzQzT0RReE56SWdNQzQyTkRjMk1UZE1NQzQ0TWpFNU1USWdNQzQxTkRnNE56ZE1NQzQzT0RFM05USWdNQzQxTXpZeE1UZERNQzQzTnpVNU1USWdNQzQxTXpReU5UY2dNQzQzTnpJeU56SWdNQzQxTWpnME5UY2dNQzQzTnpNeE5qSWdNQzQxTWpJek9UZERNQzQzTnpjMk1USWdNQzQwT1RJd05UY2dNQzQzTnpZM05USWdNQzQwTmpFeE9UY2dNQzQzTnpBMk16SWdNQzQwTXpBMk1UZERNQzQzTmprME16SWdNQzQwTWpRMk1qY2dNQzQzTnpJM05ESWdNQzQwTVRnMk16Y2dNQzQzTnpnME5qSWdNQzQwTVRZME56ZE1NQzQ0TVRjM01ESWdNQzQwTURFMk1UZE1NQzQzTnpRME5USWdNQzR6TURVeE1UZE1NQzQzTXpjeU1ESWdNQzR6TWpRME9UZERNQzQzTXpFM05USWdNQzR6TWpjek1EY2dNQzQzTWpVeE1qSWdNQzR6TWpVM09UY2dNQzQzTWpFME5qSWdNQzR6TWpBNU1UZERNQzQzTURJM016SWdNQzR5T1RZeE1EZ2dNQzQyT0RBeU5USWdNQzR5TnpRNE9EZ2dNQzQyTlRRMk1qSWdNQzR5TlRjNE56aERNQzQyTkRrMU16SWdNQzR5TlRRME9EZ2dNQzQyTkRjMk16SWdNQzR5TkRjNU1UZ2dNQzQyTlRBeE5USWdNQzR5TkRJek1qaE1NQzQyTmpjME1ESWdNQzR5TURNNU5EaE1NQzQxTmpjMU1qTWdNQzR4TmpVNU1EaE1NQzQxTlRNd01UTWdNQzR4T1RrNU1EaE1NQzQxTXpBd01UTWdNQzR4T1RBd09UaE1NQzQxTkRreU5UTWdNQzR4TkRVd05EaERNQzQxTlRFNE9UTWdNQzR4TXpnNE56Z2dNQzQxTlRnNU5UTWdNQzR4TXpVNE9EZ2dNQzQxTmpVeU1ETWdNQzR4TXpneU5qaE1NQzQyT0RnMk9ESWdNQzR4T0RVeU9UaERNQzQyT1RFNE9USWdNQzR4T0RZMU16Z2dNQzQyT1RRME5qSWdNQzR4T0Rrd01UZ2dNQzQyT1RVM09ESWdNQzR4T1RJeU1EaERNQzQyT1Rjd09USWdNQzR4T1RVek9EZ2dNQzQyT1Rjd05ESWdNQzR4T1RnNU5qZ2dNQzQyT1RVMk16SWdNQzR5TURJeE1EaE1NQzQyTnpjeU1qSWdNQzR5TkRNd09UaERNQzQyT1RnM01qSWdNQzR5TlRnMU16Z2dNQzQzTVRnd05qSWdNQzR5TnpZM09EZ2dNQzQzTXpRNE56SWdNQzR5T1RjMU1UaE1NQzQzTnpRMk5USWdNQzR5TnpZNE1UaERNQzQzTnpjM01qSWdNQzR5TnpVeU16Z2dNQzQzT0RFeU9ESWdNQzR5TnpRNU56Z2dNQzQzT0RRMU16SWdNQzR5TnpZeE1EaERNQzQzT0RjM09ESWdNQzR5TnpjeU1qZ2dNQzQzT1RBME1qSWdNQzR5TnprMk5UZ2dNQzQzT1RFNE1qSWdNQzR5T0RJM09UaE1NQzQ0TkRVNU16SWdNQzQwTURNME9UZERNQzQ0TkRjek5ESWdNQzQwTURZMk16Y2dNQzQ0TkRjek9USWdNQzQwTVRBeU1qY2dNQzQ0TkRZd056SWdNQzQwTVRNME1EZERNQzQ0TkRRM05ESWdNQzQwTVRZMU9EY2dNQzQ0TkRJeE9ESWdNQzQwTVRrd09EY2dNQzQ0TXpnNU5qSWdNQzQwTWpBeU9UZE1NQzQzT1Rjd05USWdNQzQwTXpZeE5qZERNQzQ0TURFek9USWdNQzQwTmpJMU56Y2dNQzQ0TURJeE16SWdNQzQwT0RreE5UY2dNQzQzT1RreU5USWdNQzQxTVRVME5EZE1NQzQ0TkRJeE1ESWdNQzQxTWprd05UZERNQzQ0TkRVek9USWdNQzQxTXpBeE1EY2dNQzQ0TkRnd056SWdNQzQxTXpJME5EY2dNQzQ0TkRrMU56SWdNQzQxTXpVMU5EZERNQzQ0TlRFd056SWdNQzQxTXpnMk5EY2dNQzQ0TlRFeU1USWdNQzQxTkRJeU16Y2dNQzQ0TlRBd01ESWdNQzQxTkRVME1qZFdNQzQxTkRVME1qZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWEpmTVRVek5sOHlORE0xTnlJZ2VERTlJakFpSUhreFBTSXdMams1T1RrNU9TSWdlREk5SWpBdU9UazVPVGs1SWlCNU1qMGlMVFF1TnpZNE16ZGxMVEEzSWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJak1EVTFSalJGSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlNMU5rTXdRVGNpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjMwMCIgeT0iMTAxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI5IiB2YWx1ZT0iQVdTIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSAtPiBBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBzdHlsZT0iaXIucmVmPWU0ZjZiZDE1LTFmYTctNDg2Zi1hMzRjLWNjMGQ0ZGNiNzY0ZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9InRlbXBsYXRlLTEwMDQyMS1mYWM4OWY0MS01ZjRiLTQ5YjgtYjJiMS0yY2RiZjYxNjYzOWQtMTEiIHNvdXJjZT0iMjAiIHRhcmdldD0iMjQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IkFXUyBDbG91ZFRyYWlsIiBzdHlsZT0iaXIucmVmPTE0MjcxZTExLTU0YWQtNGY2OC1hYzdhLTA4MTY3ZTEwZTQ3Yjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1jbG91ZHRyYWlsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTXprNE16VWdNQzQwTmpZMk16bERNQzQzTXprM01UWWdNQzQwTlRBME1UUWdNQzQzTXpRMk5qVWdNQzQwTXpRMk1Ea2dNQzQzTWpVek5UUWdNQzQwTWpFek1qRkRNQzQzTVRZd05ETWdNQzQwTURnd016TWdNQzQzTURJNU1USWdNQzR6T1RjNE9TQXdMalk0Tnpjd01pQXdMak01TWpJek9VTXdMalkzTmpJd01pQXdMak00T0RReU5pQXdMalkyTXprMU1TQXdMak00TnpRMU15QXdMalkxTVRrNU15QXdMak00T1RRd00wTXdMalkwTURBek5pQXdMak01TVRNMU5DQXdMall5T0RjeU9DQXdMak01TmpFMk9TQXdMall4T1RBek5pQXdMalF3TXpRek9VTXdMall4TURNME1TQXdMak00TkRRNE5DQXdMalU1T0RNek1TQXdMak0yTnpJek5pQXdMalU0TXpVMk9TQXdMak0xTWpVd05rTXdMalUyTURrMk9TQXdMak15T1RJM05pQXdMalV6TVRneE55QXdMak14TXpRNU9DQXdMalV3TURBeElEQXVNekEzTWpjNVF6QXVORFk0TWpBeUlEQXVNekF4TURZeElEQXVORE0xTWpVMUlEQXVNekEwTmprNElEQXVOREExTlRjZ01DNHpNVGMzTURaRE1DNHpOemM1TVRjZ01DNHpNekExT1RnZ01DNHpOVFEwTXpVZ01DNHpOVEE1T1NBd0xqTXpOemM1TkNBd0xqTTNOalUyTkVNd0xqTXlNVEUxTkNBd0xqUXdNakV6TnlBd0xqTXhNakF5TWlBd0xqUXpNVGcyTnlBd0xqTXhNVFF6TnlBd0xqUTJNak0zTWxZd0xqUTJPVFUzTWtNd0xqSTVOVEl5TmlBd0xqUTNORFEyTWlBd0xqSTRNRE0ySURBdU5EZ3pNREU1SURBdU1qWTNPVGc1SURBdU5EazBOVGhETUM0eU5UVTJNVGtnTUM0MU1EWXhOREVnTUM0eU5EWXdOemNnTUM0MU1qQXpPVFVnTUM0eU5EQXhNRFFnTUM0MU16WXlNemxJTUM0eU5qa3hOME13TGpJM05USTROaUF3TGpVeU5EazRNU0F3TGpJNE16YzJPU0F3TGpVeE5URTRNaUF3TGpJNU5EQXpOU0F3TGpVd056VXhPRU13TGpNd05ETXdNU0F3TGpRNU9UZzFNeUF3TGpNeE5qRXdOU0F3TGpRNU5EVXdOQ0F3TGpNeU9EWXpOeUF3TGpRNU1UZ3pPVU13TGpNek1UVTNJREF1TkRreE1EZ3pJREF1TXpNME1UVTVJREF1TkRnNU16VWdNQzR6TXpVNU56Y2dNQzQwT0RZNU1qZERNQzR6TXpjM09UUWdNQzQwT0RRMU1ETWdNQzR6TXpnM016TWdNQzQwT0RFMU16TWdNQzR6TXpnMk16Y2dNQzQwTnpnMU1EVk1NQzR6TXpjMU55QXdMalEyTVRVM01rTXdMak16T0RNNU5DQXdMalF6TmpRM09TQXdMak0wTmpBM05TQXdMalF4TWpBNU1TQXdMak0xT1RjM09DQXdMak01TVRBMU5FTXdMak0zTXpRNE1TQXdMak0zTURBeE55QXdMak01TWpZNE5DQXdMak0xTXpFek5TQXdMalF4TlRNd015QXdMak0wTWpJek9VTXdMalEwTURFNU9DQXdMak16TVRNME1TQXdMalEyTnpneU9TQXdMak15T0RNeElEQXVORGswTkRrMElEQXVNek16TlRVelF6QXVOVEl4TVRZZ01DNHpNemczT1RVZ01DNDFORFUxT0RZZ01DNHpOVEl3TmpFZ01DNDFOalExTURNZ01DNHpOekUxTnpKRE1DNDFPREV4TkRrZ01DNHpPRGcwTWpnZ01DNDFPVE0zTXpVZ01DNDBNRGc0TlRZZ01DNDJNREV6TURNZ01DNDBNekV6TURWRE1DNDJNREl4TWpZZ01DNDBNek0xT0RJZ01DNDJNRE0xTlRRZ01DNDBNelUxT1RJZ01DNDJNRFUwTXpNZ01DNDBNemN4TVRsRE1DNDJNRGN6TVRJZ01DNDBNemcyTkRZZ01DNDJNRGsxTnpJZ01DNDBNemsyTXpJZ01DNDJNVEU1TmprZ01DNDBNems1TnpKRE1DNDJNVFF6TXpJZ01DNDBOREF6TURZZ01DNDJNVFkzTkRJZ01DNDBOQ0F3TGpZeE9EazBOeUF3TGpRek9UQTROa013TGpZeU1URTFNU0F3TGpRek9ERTNNU0F3TGpZeU16QTNJREF1TkRNMk5qZ3hJREF1TmpJME5UQXpJREF1TkRNME56Y3lRekF1TmpNd05UZzBJREF1TkRJMk5UVTFJREF1TmpNNU1UQTBJREF1TkRJd05EWTVJREF1TmpRNE9EUTVJREF1TkRFM016aERNQzQyTlRnMU9UUWdNQzQwTVRReU9USWdNQzQyTmprd05qVWdNQzQwTVRRek5Ua2dNQzQyTnpnM05qa2dNQzQwTVRjMU56SkRNQzQzTURBM05qa2dNQzQwTWpRNU1EVWdNQzQzTVRNek1ESWdNQzQwTkRZek56SWdNQzQzTVRNek1ESWdNQzQwTnpVME16bERNQzQzTVRJM05qSWdNQzQwTnpnNU1ERWdNQzQzTVRNMk1EWWdNQzQwT0RJME16WWdNQzQzTVRVMk5USWdNQzQwT0RVeU9ERkRNQzQzTVRjMk9UZ2dNQzQwT0RneE1qVWdNQzQzTWpBM09ERWdNQzQwT1RBd05TQXdMamN5TkRJek5pQXdMalE1TURZek9VTXdMamMwT0RjMk9TQXdMalE1TkRrd05TQXdMamd3TmpFd01pQXdMalV4TVRrM01pQXdMamd3TmpFd01pQXdMalUzT1RrM01rTXdMamd3TmpFd01pQXdMalkyTVRFM01TQXdMamN5TmpFd01pQXdMalkyT1Rjd05TQXdMamN5TXpjd01pQXdMalkyT1RrM01VZ3dMalEwTnpBek5sWXdMalk1TmpZek9FZ3dMamN5TlRRek5rTXdMamMyTWpjMk9TQXdMalk1TXpNd05TQXdMamd6TXpFMk9DQXdMalkyTkRZek9DQXdMamd6TXpFMk9DQXdMalUzT1RrM01rTXdMamd6TXpFMk9DQXdMalV4TWpNM01pQXdMamM0TmpjMk9TQXdMalEzTnpVM01pQXdMamN6T1Rnek5TQXdMalEyTmpZek9WcE5NQzR4T1RNeE55QXdMalk1TmpZek9FZ3dMakUyTmpVd05GWXdMalkyT1RrM01VZ3dMakU1TXpFM1ZqQXVOamsyTmpNNFdrMHdMak14TXpFM0lEQXVOamsyTmpNNFNEQXVNakU1T0RNM1ZqQXVOalk1T1RjeFNEQXVNekV6TVRkV01DNDJPVFkyTXpoYVRUQXVOREU1T0RNMklEQXVOamsyTmpNNFNEQXVNek01T0RNM1ZqQXVOalk1T1RjeFNEQXVOREU1T0RNMlZqQXVOamsyTmpNNFdrMHdMakk1T1Rnek55QXdMalkwTXpNd05VZ3dMakUzT1Rnek4xWXdMall4TmpZek9FZ3dMakk1T1Rnek4xWXdMalkwTXpNd05WcE5NQzQxTlRNeE5qa2dNQzQyTkRNek1EVklNQzR6T1RNeE4xWXdMall4TmpZek9FZ3dMalUxTXpFMk9WWXdMalkwTXpNd05WcE5NQzQwTVRrNE16WWdNQzQxT0RrNU56SklNQzR6TXprNE16ZFdNQzQxTmpNek1EVklNQzQwTVRrNE16WldNQzQxT0RrNU56SmFUVEF1TXpFek1UY2dNQzQxT0RrNU56SklNQzR5TURZMU1EUldNQzQxTmpNek1EVklNQzR6TVRNeE4xWXdMalU0T1RrM01scE5NQzR6TmpZMU1ETWdNQzQyTkRNek1EVklNQzR6TWpZMU1ETldNQzQyTVRZMk16aElNQzR6TmpZMU1ETldNQzQyTkRNek1EVmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwSXdNRGcwUkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrWTBSamhDSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTEwMDQyMS1mYWM4OWY0MS01ZjRiLTQ5YjgtYjJiMS0yY2RiZjYxNjYzOWQtMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjUiIHk9IjMxNCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMCIgdmFsdWU9IlRydXN0ZWQgUGFydG5lciIgc3R5bGU9ImlyLnJlZj01MzEzMTVhNy00MWEyLTQwZWQtYWI4Ny0yMmMzYTRjM2M3ZmY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTg1NSIgeT0iMTg2IiB3aWR0aD0iMzE2IiBoZWlnaHQ9IjQ5NiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iT3V0IE9mIFNjb3BlIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSTJOQ0lnYUdWcFoyaDBQU0kyTkNJZ2RtbGxkMEp2ZUQwaU1DQXdJRFkwSURZMElpQm1hV3hzUFNKdWIyNWxJajRtSTNoaE96eHpkSGxzWlQ0bUkzaGhPeUFnSUNBdWFXTnZiaTFtYVd4c0lIc21JM2hoT3lBZ0lDQWdJQ0FnWm1sc2JEb2dJekV4UVRoRFJqc21JM2hoT3lBZ0lDQjlKaU40WVRzOEwzTjBlV3hsUGlZamVHRTdQSEJoZEdnZ1pEMGlUVE14TGprNU9UZ2dPUzQxT1RZNU1rTXpPQzR3TXpRZ09TNDFPVFk1TWlBME15NDFNVEVnTVRFdU9UZ3lOaUEwTnk0MU16a3hJREUxTGpnMk1qRkRORGN1TmpVMElERTFMamswTVRjZ05EY3VOell6TVNBeE5pNHdNekkxSURRM0xqZzJOVElnTVRZdU1UTTBOa00wTnk0NU5qY3pJREUyTGpJek5qY2dORGd1TURVNE1TQXhOaTR6TkRVNElEUTRMakV6TnpZZ01UWXVORFl3TlVNMU1pNHdNVGN6SURJd0xqUTRPRGtnTlRRdU5EQXlPU0F5TlM0NU5qVTVJRFUwTGpRd01qa2dNekpETlRRdU5EQXlPU0EwTkM0ek56TWdORFF1TXpjeU55QTFOQzQwTURNeUlETXhMams1T1RnZ05UUXVOREF6TWtNeE9TNDJNalk1SURVMExqUXdNeklnT1M0MU9UWTJPQ0EwTkM0ek56TWdPUzQxT1RZMk9DQXpNa001TGpVNU5qWTRJREU1TGpZeU56RWdNVGt1TmpJMk9TQTVMalU1TmpreUlETXhMams1T1RnZ09TNDFPVFk1TWxwTk5EWXVNRFl6SURJeExqSTNNalpNTWpFdU1qY3lOQ0EwTmk0d05qTXlRekkwTGpJME56a2dORGd1TXpNMk5DQXlOeTQ1TmpZeUlEUTVMalk0TmpjZ016RXVPVGs1T0NBME9TNDJPRFkzUXpReExqYzJOemtnTkRrdU5qZzJOeUEwT1M0Mk9EWTFJRFF4TGpjMk9ERWdORGt1TmpnMk5TQXpNa00wT1M0Mk9EWTFJREk0TGpFeU56Z2dORGd1TkRReU1TQXlOQzQxTkRZeElEUTJMak16TVRNZ01qRXVOak16TWt3ME5pNHdOak1nTWpFdU1qY3lObHBOTXpFdU9UazVPQ0F4TkM0ek1UTTBRekl5TGpJek1UY2dNVFF1TXpFek5DQXhOQzR6TVRNeElESXlMakl6TWlBeE5DNHpNVE14SURNeVF6RTBMak14TXpFZ016WXVNRE16TnlBeE5TNDJOak0wSURNNUxqYzFNaUF4Tnk0NU16WTJJRFF5TGpjeU56Vk1OREl1TnpJM01pQXhOeTQ1TXpZNVF6TTVMamMxTVRjZ01UVXVOall6TnlBek5pNHdNek0wSURFMExqTXhNelFnTXpFdU9UazVPQ0F4TkM0ek1UTTBXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO3N0cm9rZVdpZHRoPTE7IiBpZD0iNTciPjxteENlbGwgc3R5bGU9ImlyLnJlZj1jZjI2MDcwZi1hZDhhLTQ5MWItYTViYy05ZDY0MDY0OTk2Y2Y7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3V0LW9mLXNjb3BlO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI3IiB5PSIxOTAiIHdpZHRoPSIyNTIiIGhlaWdodD0iMjQ0IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzMiIgdmFsdWU9ImlPUyBBcHAgU3RvcmUiIHN0eWxlPSJpci5yZWY9MGY3MDZlZWYtMWI3My00NzMxLThlMDctNTMwYTdmOWY1NzMwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0ZGMzMzMztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWlvcy1hcHAtc3RvcmU7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQU1nQUFBRElDQVlBQUFDdFdLNmVBQUFyY2tsRVFWUjQydTE5Q1hnVTE1V3Vac1kyR0xRdlNPcXFrdlV5ZmhrU3M3MFhKM0Ztdk1YT2ZKN0pNbmFTZVIvZlBETFA4NTZUNTh4a0Vvd2RHMk5oSkNNV3NSaUJNV1kxTW1CQWlFV0FFRUpzd29BUmZtRGpoRGpZSmpaZ2JCT01iYUhlcXF1cXBmUE9yVzVKclZLdDNiZGIzZXA3disvL3FxdnFydWVjLzU1emErdU1ESmJpbGdDZ0VIRW40bUZFWlJpMWlMb3cyc0k0ZzdpZ3dhbnd1UU1SK1JlRTY2aEFURUxjZ2NobGttWXBhZE85YlRCODNDa1lNL1pVOE1HeHA3dW1qbjh6V0RmdVRhVjkzSnZCRHR3Q2JzTlFJclphQkhYT0JYVmdtUGNhNHRpNDA4SGw0MDkzUFRIbWRQQUhZMDlMb3pQYTRBYW1JWllTbXNyUFFLN3JaUEJCVjN0d0tkZXVuSFdkVkNDSm9iaE9kcDNCN2R6U041UUhpdG9nazJtUUphcUpHQlV4TGpTeUJZZ3ovUXl3UFl4NEduazdiY0lvN2FVbmxXcStYYm0zSEwwZjB6QkxqaFAzdWp5aHRGMnBSdU5zUnlpOVJCaDZFSEdjYmVnSksvZ1RnVnVaNWxreUpzVko0TG1UeWhPcWx4aTZoTERDTWU2RS9LanJOQlF5aTJBcGc0UVlwZTNCU2E0VFNndENRVURLb1QwdTlZcWxKNVN0cnRlREQ3S0ZmanA2aXhQSy9hajhPalFFVDBxU0lwRjRYYm5tT2hGY3loMlg3MkNXTTVRVHpvU2x4OUZidkk0aDFPdXE0cE1iSjVLdkRmUXFiYXBYWVdsb0VZTTdIbndZRlhzK0pZaVJHampEaURJVTFoY241TW1vek12TW9PT0djMlR5WWV1VTFDSkdidWt4Sk1aeDVRb0NHQklCOU03SDVVZllmWlVrVDBSSnFMQU9ackNEaEdQRVc3UFFLK2xTNlhINWRsUk9Pd0lZa2dJdDdNWmprb1JUcnFQQnBhZ1FoUmxsMGtGRVZMS3dhOUM4Um5BU0t1QUtNOFFreDlIZytkS2p5Z1BNWWhPMXptaVRScnVPS3NjUXdKQlNhT1RhZ0djV0hFOXlIRk9tb3FBVlptd3BDdy8zV3ZCaFpzblV2UVlVb25CYlhLK2hrQmxTSDBlQ2RlemRGR3JrVU81RW9WNW1oalcwd0wybW5DMXVrOFl3QzQrRkhLOWhTUFVhaGxUTW9JWXFXTWdWZFVoMUJFT3FJOFFkeHd0eUF1cVU0OUEvT1FFeWtDRytzaC9RSGd1NUhJVlVSekNraWtwcHN1YTMzcjVza0RjYXczRGFoaHlGOGNvNnYyVVRNdEtXVXlMYWtJRTd3a0l1TzVkd0o3cmFaQVVCREdrSkQ5K20zTXVZb0hmanIwMmV6QXlFZ1V5UXBZZWxuekpHOVBjY0MxVGhISTRRMU9HSTdXSE5NVHV3VTlkaEcyMloxYU9GazNxZGpPT3d3YmpzanUyd2pmb1BtL1RUcm56YUxPclFrNTkrR1lWTW1Jd1piWENENjVCY1oyaHdER21OMGphcE9tMjVRYTVhdUE0cGphb3dEa1VJNWxDU3drbi9Ec2V4M2NNMjJ6MmNZTGtjcHR4dXVKN1NRL0x5dEhzaFMzMEs5N0I4TEduSndKQlVLRDJrYkUyYnA0TFZleHlINUhQcTRBOUdDT0tnaGFBT0d1UTdhSkpmcjh4QkczVWVjbmhjMjlaQkcrUFJLK3NVUm0zRlVtYzBmYkRieDRNT3loNGM0RkdPRFhtU3FHSFZRZlFjQjNVRXg4QmdnZEtEeXRhaEcyNlJCZmxCcVlrcG1pRW1raHpBTmNsUVROeEJlWVByQUE2U2dTRkdsQjRZWWxlM3VBTnlMUTNCY0NtaVFNNW1IbzRaZS9RazJUOUU3cE9RZ2JqMjQ2QVlFZ0l1eGRybm9qK3ZvQ2RKN1R2dXBhM1NwR1JUWUNJTWpaVEZpUUdLVzJVWTFScmFsclRTNjFOcHVON0l1a3VUUkxheEVDU0svaXY4Z1JSOWRvdmJyOXpQdGNxS2l4aEcyRGk0SGlOcDFRaWxWU09nVmdQQnRZYnIwTllaYVh5UmRiY08zT2MwYlhGNnZ5UGFpV3lQYTQzb2IvZzNGMUUvajhodmtTR3pXWVk4M0g0RkY1VmZiMVBncnc4cVVCZytUczV6ZWtiUzJyOWVsNDVjQ3ZyVnJjQnRhdDF5cU80OVdQZmUvbVBSams5WFJ2czFZMmsxTU9CV1RYOGlaZEk2Y0F3RHhxSnRYMGVQaGdUUmswc2ZQTVd0S2ZZVWNGRXpsTGhhcFN0Y2hBQUhDRTVubjdQNGJYWE9xRDY5ZHJWMWNBWjFjemI2M0hQOHh0MW91QmdmTC8yd0N5NzZ1cUVua1YrZmlBRHJQdXFDcjZKQjM5U0VNLzQrODNGbzZ4N1dGQ0xnaTJyZEFGMTkxY09WY04xZlB5ekREYnNIMXUweXFadXpNVGJPUkI2Y3d6Sm00RXhrNFRMcE0yN1Bwczc3Sk9SeWJxdDhnSE1vYUx0Q05oQ1FiV09uRFo2RU9QdENSbDl6UGdnZE1waW1UZ1ZneVFkQmRiWXZickdXQzZrN0M3MUQxYnZXZGJ1eDdsVVhnM0FUa3FSNG43Myt1MndRZ0xOQkxMczY1R3pXYmFmZGZ2djc1THJVdUZQZXFsUzY5cWtkamdrdWkyTTAyb2dWUEtLVWhEZElqZzA0Z3dlN3dYYXF2OXdGaFVpU2toYmora25kaEJ3ckxnVDdlUXl6UlBMdHU5b05lYzE5ZFNlRHJEaUh1bk5GbytkV09ibGYzK1ZhY04yeFQxYTRKRk5JUEVISU1mV2RJRVNUbHFIaDM3eGJVb25tMGlIZjhGMFN6SHczdXJwci94U0U3RDNKUjQ0NHd5TWs2M3Frbkt3N1duRGRRV2F0bElka0sxOHhlb0FKaDJRUW83TmhDSFFCL095MEF0bE5BK3ZPeFdQZlBhYW9ZVk0waVhpeis0NHFVTkE4RlBUaEFIdVRjVDFDL3FTbUJkY2R1Z1ltNmV6cm5aTTBrRTIyUnZWSUJnWXVtUmkvWkZDSFdmOUR5R3FTWU01N1ViSWpuRDcyZDhOZk5VcFFzcmQvM3pOMlNQQ0h6dTZZNnQ2TVlWeG0yRVBwajFlMnFTZlpRa2VTZ1N6dDZNbU9yaVNUU1V1M3o4bTFIa0hQVWNrUkJTY01NaVMydllGd0lYS1JJS2Uvak0ySVNlbjU3d2NoYTNkb1hLUmVZdFNQbmxGc3J6dU0wbnVlYnJnRnlWRVNUMW0wSkZyMnNqMGJhRW1TOVlqUUxOK09IVklHMjJBVGplSTlFdnpOZmhtdUJtSzA0bkNvTmZhZ0RBVklqRUtzOXhhczMrcUtsWjFFNnZoMm13ejVTR1EremZTRDhIQjcvZnpnWDlMZEs1M2ltaU02MWh3QmJhZWJkZkkwRzVUVDJ6Y3FxM2U4MmFRZHZUN1o2VjlFdmlJMDVHL2krc090eEU0UWtyWiszQVhaTzlGN1lMaTE5bUlYbFRwOUdQMTk3eGl1WjNhRkNhSWRuNUZ1OWthaG43MDI5TGJYd0NhYzJJVlJXUjNnbUJzSDk2cFZzL3lvTGNNY2dpakdXZmxyclRKOEtWR3haWFZSL1E5SFpMaGpuNFNMZmpxazgrSUMvenZFZzVCMVNKcnFTZGdUR0p5L1huQTFRU0Yyb0NOZENlSkNENUszTy9hRmRHUnEvNklMOXYyWlhuMlhmTjFxdUZheUp6MTFwR0tQZEg1UTNrVEVodXU0UFdvSDBoWWpNQnlxZlQ4SXlabzJYOExGUDRadGZKcnJ5ZFVzVlNiWWV5aDNjaGhpcEJWNkJCNXhiQlI2a0R0d0hTSjFKUjg1U0plK2ordVBnbDJhZnV1TUl3MGc4cnNTOVorSjVKNUhrM1EyN1FoaWdHejBJcHMvU2o2R0hMemFCWVZJanRMZFRFY0VydDFTUzBMNHdUY0ZKak9CaDhBajhqR0VtYkJmQnFVN2VjaEJ1bkxmRVFYeUcwTjlaTHJxSlVsOC82SzZ2Tmxid3UyV1BCeVpsUmhVOElqaFd5VllkajU1dkVqTGxTNFl0aTNBOUtQRkx1bHlYQmZzMkVBMUUvUkFGR01vazd0ZGdrL0Z3U2NIdWV4TStsUzBrK2xGRDY3ZDhpUHg4UjZOa0lzRTZlQjJxVXhrMENCN213UlB2SzBNYXFoRm1sNXdMZ2laMjNwblRJYUJPQitYYjJ1NWRrbVZUTGpHY09HTVBhSkJndmJQQjQ4aDc3cTdvV2lIQkNVN21UN01RZms1TFJLM2NUdkQzbU5uQkhvYWpOemZxWE5NRHp0MTlzM0s3dFJwMjZoZG8zWjJHdFJqMUNlejhwbzhBZ216Y09iK3A2TUt5SU93SENFUE52N3lsQUlqdDRiNllrdEdabnJjWlNMdm5RN3J0Wkw5VGdOWjc0cENYL1pzOUJ6ZEsxZTdBcE4xQjhqUUR6eGkyQllKdGd6Q1pkL2oxN3BnWkVPb0Qwd1gxcUIyUmF1OERvWmorSEJGcmJqUm9FR254NjN5TlRvWWJLUG1kNk9EZWhwTnlwbU5xZEg0V0Q0dTF2L2JYZ2s4Q1Z5TWtLYnVPeVJEM2phTHNUYWF5THZSZW15bXNtMjBrSnVWM25ZNnNLRkdLclp6aG83M2FFVHYwYWdqUkFaRFpPTk1YblZXU1JoQlZwMFBxbTB5MlR1RGEwZXNYb1RjTlcrVXpuTTc0dHpaSGNrc3lJRGpNc1hvUlVweFROY0M4ZmNpUHVUaHJlU3lMcmJKSjFvMk8xSkUvNGIxeTIyeFhibmFMazFVSys5RklBekpBZlRLQkJ6bU44dHJWbDgwZlhXYVQvOTNia01BL3VkeEdZTGQ4VjJZUC9XV0RObGJBaFRHYmxmT2dSanRJVkd3MmEvdC9qdWl2ekc0STlEVUo0U2hBQ2xoNVYzYkE1Q3hNUUJ2ZlJrL2huemc2WWFiNndOUXNqMlZaSmhjL2VLM0I1WkcrY1N1dTVEYkhsQTRJbndHeDBEQlF3SE83UGZzbDlVWGwyZ25jaW41WDQ3aHdydysxQmFUZWRTNEZ0V05RMzRiTHM2WjhHSWpDYzVRTjZJWGVmazgvWGRHV2o3cGdtRWJRMjB3V2NlR3FCYnJybTNpS1k0ODhNWVFFN0kyQitDQkF6SW9GRytOWEpjQTdtbVZvUURYT1R5VGNlellHdGpxN0VzbE82UXhUSEN4ZzRRK043MGFnRzJYNk40NFhQekhvT285bUl5cFFYUnRjaGM2OFI1emtWWEFFRDE0UkM1Nmp4OGVscWsrZXRJaGRjTlhNS3dxMmhKcWc4bWFHaDYxZi9WcWErQXlFMWhzS01YdzU0YjFBZmhEQjkycldMODRJVVB1cHY1RVpQS21nbU0yeVNIZXo2RnlvOExXS01zbFd4c1VrSTFHL0o5djBMMFA4dTcxYmloQXIxUkN2RWU0blpHdmlsQllueG95aVZxM0NkSTV5dFQ2dlhYWGxzRHFJU0hzUVFJeFhHS3daYWpVNnpJOWRnU0NBUCs0WDFhSlI5cHhJWEp3SGZKTDlDamYzQ05CL3FZKzBqQkVDNm5DMm9NMEJDNXc1TTdzbG5DaHlOOE5Pc2ZOMEdEaldJT04zMDd5T2UxZmc0TyttL1VuWWo4VEYrWnJLSDhPYU4vSFhmQVhhMFZ3aGR2TFJYSjhhM2ZvcTNYMUh3WWhDOXQwbWVtcHdZWWVuT3BYVzlacHVTMDJkTnhnTG12TGNXMXhZRWNOQWZOSFQwbzJpK1V4RFRETndTUHkwSEMvalRPNlFuVmhEbkFiZWNZTFBaT0Fpc3hEYjNITFZnbis3Ty96VUQ4NktFUE9xMHdITVVJa1Q2OGJlNDh0NHNOY2ZVU0IrakNNOXJkWW5LL1h3RWtac3phMldPelhhODZabGQ5aWt0Y3NqOEU0UitMQ3ZPVXkzY3U2TDd5andMQjFJcFNTOVFlMk1XSmRBTFpydnQ5Nyt2TXVsWnl1ZXB0amNxSURQVDBhMVZsdllZVDFGcnF5VTNlOVNWdDJ4MlV3RG42emFQeXZ1ZHhtYWNNQVlURFlBdkVlMlJzQzhHOUg1WmovdGlBeW5YZDNReG5XWGZCcVh4di85N2ordSs5UGtUY0trYUE4MDBmMDJDeFdHeS9RNndOWG1KQ2lBNW5kYzlCNGYwLzU0Y1JmSEpjaGMzM0lNNUEyY3JHTmR3emErREJNcGxHYm1ENmloOVN1VDQ1TjBtaHVNMkVRUXpUSXdyQ242aTI2VHlXKzhWazM1RzhJRWNPRkdGNG53dFJUNW4rc3MrSWNlcEYxVEI4eFFDbHEwUGtMTjI1VDRGRW1uT2hRaUxGL0FScnk1NVJma0xvVEYvdkVLNUUyaWpERUdvWUV1ZVF4WDk5NFpJQ3ZiSkZVWWpIZFJBZGhvODVmSm5DYnhNMGNjYzBNam5Fekd1NjY5NE5Ba3g2N0x3VWg4eFVSWE9UK0JpSVB3Nng3a1RBQkcxZVBUMTd0Z2hGMTZIVTJoc295SFRtRGE1TTRWOCtEZEREaE9JTnF1QmpPM05Va1VTVUg4VVQ4SmhFS04vUVpPQ0hMcW5QMlE3aWZIRUR2czQ0UkpFcjAvNkREaEVheG5DTlBoMjRNWjdENnJVTHN2NjlXTEViOERnejhUYU1OVytYMElBNnNMeHBFempRWTl1U2g0Ylo5UXUreXJ2cW5ubS9qT21KdFgxK0pKOGhmTDhJblh2czBQUHRsRjVSc0VLSGtWUjBETUpQYkpwdnkzR1FpNTAxRzhyZVdhV2hmdEtsYmtiSWQ5SjVUK3IxRU5YNWI0SUgrR1NJckVTbUNkbjJEQnpJeloyRm85YitQeUZUWEhlYzZ1cUVJdzZtU1Y4UHRJRWFob2QrMkxlQzRybWR3UVorNWx0UVJMN2tIaHF6ZXgyNlRSdmNTWk95MndLODRvaEFHMnlqRkdiMEVRNkNMYnJvTDgwZGVrOEpHSFdxSGJQUFhpZkNUVmltcVVPMnI5YmpBWDhmMDVSUmpHZ0kvNkNOSVEyQXBFNG9ENEl3K2JJMGZReUc2ejF1OTlpa3V6RjlHVW1qYXl5R1hkMDlHZHdsNTNYdEJ1R2tOMDVsamdtd05QTkZMa0hFTmdSYWlkQVo3SURQeWJRMEIrTXhQejN1SXlMWDdtM0JOVXpld1BYSnMyUitpSTRoYjdvYTdkd2VnY0IzVG14T00yeHBZSGtFUThUSVRpbjNjc0VxRUhSZm9lbzhWN3lpcTk5QnJMd2REcm0wZkJHUHdURjF3RS9iWnRaN3B6alpCR3NUUUMxUW92OHh4NUVFdElqd0dTeEJqL2R2R2dQcEZRNXJ2ZXZ3WFhNZ1dvYWZnZGRyTXdoQnBmd3dmeEphdy9uL0dOVXh1RHdHWkhpMHhybDY4MWtPUUNZd2c5bENLWVVyV2FoRStwUGpmNktTbXljZGx5RjVqYkx6WjJHWnJqRitNL3hJWDdQbEk3bEd2TUQzYUlzZ1c5YXBoTGlISVJKVWdKRVpsTUVVbUd1b3YydWhlMW4zdmVqZU13UENuNUJYOU52bDFJUSt5OVlQWVE3cHBKMlYxREV5WDFnZ1Q1QTVDa0FwR0VITVFJeDJGNGM4dHVQM1VTL2MxMmtrSFpNaXhNRm9TR2kzK1hld3hYYWNFTUw0K0FBVXZoOGJFZEd0SmtFbUVJS3NaUWF3eFlxVUlTMzVIOTJuZDVvdEJHTDRDNjMvRmdpRG9RVWdZUmlPOStwNENtU3V0MjJRRVVRbFNRUWhTTjQ0OEIvK0t5R0NBZkRUUU83WUdvSVBpMDdwKzlCNTM3d2pQNWladGszTWt6L2ViSkNydFNyaVVJWFhscm1aNk5RUGhCS1pLUXBDdDR6WWJFS1JPczlVZXE3T1I1eFdkMzY4NFBGOW4wTFpWMzE2eGFOTkdHUUh4Vjh0RTJIdVI3bVhkbDg3S01IeTV2NzhjRFdSYmpJdnJyMjRJVUd2NzFGWDBYQzhaRU5PdTNPekNTbWRPMnFtejBVY2p1Nml6WVFNRENiS0FFS1JOSlloV1VRd3E4bkFCL2VObVNaMTVhYVVydm03NHl2b0FGQkh2WWFNUExrUXU5dU5QMStsMGdueXI2NWR0TW1TdnROZCtPb0p3Z2tSWGZRUWhUNCt1RFdlSS9GMm5PYWFYendoMU9uWG8vYWJSeGxxTDhuWE95NWFnQWQvNGtoL09mazczSXd6L2pzWkpESDVBK3laOXpNYjh0Vy9UV3dPUjEzTUxNWFFzWGhNbWliWVBlbnF6b3g4N09yUFNVNTFETzdUU3YxRjlKblZFRXVUOHVFMEI1NE5LQStUZ0RQdllVYnBmUjN6bkN6Uk1qUDlMWDNiV2wzd2t5SGR3SGVTbnhCSHkydTY4TnhYSVdjSDByQWZDQ1V3SENFRXVNSUlNQkRGaUFiZHVpZTVsM2U5dUQ2akc3clEveEpzTlgrYUg4OWZwOVllRWpiZTlLa0xCS3FadkE0SzBFWUpjRzBlZTF5Y3pHb01LZmkweFJoK3NPMGQzWVg3b2NoZjh4UXQrY0VYWnA1dVJJTk5lbDZtK3ZkaDhJUWdqc0Y2bTkvNGduQ0RYTXdoQm9JOGdURkE4SW4rRkgrN2VKbEw5MjRMUHhXNFlTejQwdlNyVVJqUjljNjN4UTlFcVAzeEEwWXVRVU9zbnpSTGtMdmZiNkpjLzRicUl2cnlmQmtFdWhBaENYc3hCNFhQa2VTQjFxd2RSODFzME9PNDMzSGZlaHQ5eEcvcjdabTBPUkJiT3FFMGYwdlVlaTg4b01QSWxJZ014b2svMitzVkhqQ1hycFpBWG9mcDVvVDkzUWRGS1A1U3UxdXFvYjhzYnl0ZHUzKzNxM3E1K3Jmb2gyc3lycndmQ0NSMkNtQTNPV2hDOEkyRTVxOTlKZWExU2VKdDFFdVBOUmdQOHQxWUp1bWwrSGJHakc4cHhWaXBlWlQxdTNvSWdMalRpUWpUbVUxZnBYbG1iZGx5R2tjdk1KakhSbHQ0RzZzZ1pvV0t4aitqS2k3cGx4b2NJY2xrbHlIanlGQ21aUFJCRzI1N2ZSdUIxd0JtVTE4dG4xSVpSUFhwMTZ2M1dHd2R2VUo4TERUZ0hDZkxITHlpL1JudEFVcjJTT29sWXlNNVNsbXRDZmZ4cGswVDFFNmVYT3J2VitvdFhXc3VTdDJFRFJ1WHQ2dEdxRHF2NmVCTTU2dTFyNnlPYzZQRWdIV1NIdHhpZzFUSE9wRkhlcEZPOERRT3gwdzh6b3ZFV1JPbEI1b3MrbUhtU2J2aHlHbWY2M0dVaDh0bWRoSGdMSlpMZkk1ZjZZUi9sbDdiV25nM0M4QmQ4dG5Sa05oRnhGc1pxWjVJMG15UzRLQ1ppemdaQitJRUVPYU5lNXUwbHlDcC8zMWI3TzZ4Z2JsVUkvVHEvU3BNdkluKy9lclZsOU1xdWpxaERXOWFxalZXYXZxL1czOWRUUUJFdXpGMHJSYXF2MFpJWi9wNkdBT1MvMUw4dm5ON1dTTzZSL1E0ZkUzQy9BT3NjdTE2aytqY0xuVkkzakY0blF1RnlBK05lRldGRUJ2cmhWdW5vd2tESFZqYWdlMTd2bktZZm5OMzhHajFFSGgrL1h1eTl6SHVCN0pnT3lNYWdrd0d4OUhQRUMzNVkvMGU2WDBmYy9yNmllbzk0alRjSDYxN3lsa0sxendjdkJTSHJSWlRseXRUUXVSTzlPN0dQU0lLMERTREl5akMweDZ3cVhta3ozeXFEK2xkR1VTNUdDSWc4TklpNzZnTjB2NDZJbnFoc0ZjN0dMOFhQTUlweHBzL0J2bjlFK2ROREQrMEtRTzZMVWZScEpVVmREVEpCd3dRSlBZczFucndVdE5LZmxuQmhhRVdNNGVqSDlPSjVZcTQxYjhnd1lvbUcvTFNCZFdmald1VFhoK2d1Mk4vL29odEtsdnNRL3JTMUM4S0pIb0kwOWlQSWlqQWlmNi9RT2FmRkNvUGZSbm1ONmx4aFVjNXVHMGJ0YVpDTm9kWC9hcEdvenNEdmY5a0ZlV2k0M0FxTkRGZFFVSjZtUGdFeHZOWVBiLzZaN21YZnA0L0pNSEtKRHdRclBSanBKVnBkeFZxV0xrRnExUmVtVklMb0tYT0lvM1I1Q085L1NYZGgvdk5XQ1hKZUNCbHZ2TWRBMmlCay9OR09BSWdVWDNqOHpOY05ZK3BFS0ZybVQwdmJDQk9rTWtRUTh1WWFjYWZwQkJUQ3NFVStlUDRVM2N1NkJ5NEdrUnkraEk2RmtHVGtZajgwdkV2M3N1LzZkeFM0NmZrSXcwa2oreUNjNkNGSVpUb1NwQkJuM1RGMWZyanFvL3QxeFB2cVJjZ2ozaVBCNHlsWVNwUWFnT3NVWHd2MllPUjV6MllSQ2wvMHA1MTloQW55TUNISXBIUWt5QTBML2REMEo3b2ZZVmo2bGd5WnRZTTNwbXowSWhYSDZLNm4yajhKd3JDRlB1RFNreUIzRW9MY1BwNTgwWTljamh6aUVCQmxpTnpGUHZqbWVqL1ZtRDNZM1kxMWl6QUtaL0t5NWFHMmFNTE8yRXB3cGk5R2ZFN3haaWQ1b3ZtZnRrdVF2NFQrbU95T2JUQkFPSUdwa0JBa04xa0kwaU13MTdLUW9vbXgwVVFCaGo2WmkveVFoWEgxdVMrNnFCclJidzRFNEM5cmZKQ0ZIb1FZVStFTG9XM2U0cjU5MGo2WjVVa2Y3Q0liNnl0WTBqZUdZa1RwTW4zakl2dDVtUGVmZHdhb1BxcFB3dERDSlRpMlJhR3g1T0lZeURqNzlYTnhDT1I0enVKUXY3VmpJZWR5YTBQYjdMQ2NpcGFHZE8xNk1ia0lNNzdPMzlIMzhlcTE0aFdlWEswWUJBamg3U2hjMkdZVEllTENtUWhwN0JvUnZyVXVBSCs3SVFCL0Y0bFhEYlpHaURoL0ovNytKazRHTTQ3UlhaaC9lTDBieHF6Mnd6MVkvOTBiTlcxcituY1g3dCs3MFQ1SWZYZEcxUEhmMTRwd3kwdEVWajdWNklqY0l1VkpETzNHK1Q1NC9STzZsMzFyVHNyd0RaUmRqeHp2anVqalBSdEQ0N29yb3I5M21ZeUZiTzhPaitsYjZ3TXdGc2RVdGl5a2UwSkNNZ2tNbGozMkFEblI5M2ZRNDllS2JZUFZFZTdGMEl4MDYwby9URDRvdytHTFhYREozYTJHQ1dUQjJVa1I1UFZaQW9XdTdhaXpOYW5YSzNmand0YTZEejQ1bE5jdTNCRjFmaWwydzZYT0xqaUVjbnI2aUF5amtaZzVPQnNYbzNmaVh3ek5mbmtZUXQ2UGkyc3Z4WG1BeUt5enB4K1NmaDk3WkVDMkhybi9PSDFoMmZUS1NRN1ZRM1JNZEUxMDNuYXBDNTVxazFWYklKNlgyTVpnMmVYNGw4VzZQZy95c3JoY0ZXNmlnVFBGelF0ODhDKzdKTGhNK1hHSmRFbFNzQnZtdGN0UVNrSzYycEJjUzlHcjNEalBCeHZmQ2Fia21ENzFkTU9rM1FISVhSU3lFWE03OHNYRk5zZXY4VS90SThnYS8yVHpobjAyT3VUVDJUY3VSMmFIRVVpT2FVY2s2ak42T3FZTEdPYU5JKytLUE84REY1S2xDTmNNWDEzaGh5L0UxSng0Z21nVFR4NldjTDNvUTF2eFdkaVprVjA2T2RiZlhpZXM5VDNZOXkrM2Ezdy80SmZpeVFId0cvelcyM2VHWEJ6NHozQ1dDRExIUVhYbXZXK2pDTmtvMjFJa3lMRDVYbmoyTlRsbHgwTkk4dkFlQ1VtUGE5V283UzI2Y3VQV1NHUDYvcU53cFRTNjkrUUxPZ1ZlTU5sL1FXZmZyQzVFRWNiSVgxL2xoMDg4akIyMDA4Y1lxbzRtRDJBdThrSXhrcVNrMWdmdmZwNjZMcHA4VFg4c2VYSjVpWVZkNnRtb0RWczB5bnR2SFF6djkxL3BlTkRUbXpHT0VCQ1o4MzB3OWJERXJEbE82VzN5RnVOQ0RMWFFxRWJPODhMRXh0U1dkZVZSR2JJWHhOODJJM0EyUTV2NEpiNm1oQkNFaEZlb3ZOY3ZCNWtseHpIOXBqVUFJM0VpS2tadm5ZWGJJeGVWbEIzTC8vdWtTdzNKaGNRUlpLa09RWENoVHR4WW5PRkNoWlVqU2E1NldYZ1Z6M1FPdzZwUmkwTHl6c0haOTI5ZThxdVhXVk14a2N2QXQ1SjdQTFh4dDA4Q1lVbkVBcjBuY2JYZUNRbG9XSTJKYjhNWTJTMHhnc1F6RWVsK3YxNkUvSENvTmFMR0M2LzhMalVYN09RZXlqaGNoNVFtaUNEbHRSMjVHWHFKWCt6clFFQS9MTkhaMTJLeDVyZFJXUVNIZ3lTendlYytScEI0cC9rbkpNaWVqNHQxOUNRbGkwSVQxRWVkcVNmM0RyRmI5WUM5QkxGcmIwc3NiSGF4N3JFekdVWUpNMjBkUUpBNG9IQ2hGMzUvbGQzOGlIZHErVk1RY2hmMGtTT3p4Z2ZUVXZEaXlCK3ZkYWsya3dqYjVHdjlDd3dKd2kzMlBXcS9JcFA5V3VOeVJGRWo1bnBoMlNtWldYQ2NFNW1FaWttSVZkdm52UXNYZU5WRmJ5cWxGYWRsdUJsdFJ0RGFXNjIxdmRrNkgybWZpNzBQR0JMRXRkQTl1cmZoT0NJZjNmN2ZyZld6TytnSm1IbEx5SjMxUlNHNUV3UExRUy95WUwyWVV1TzQ5eFUvRWp2K2RvbFFpcFpCWm9aWlFoWmQ2UzJ3eUVIbGl3eCtHeUI3cmcrV3ZNRzhTRHpUNng5MTZScFdGczdHemUrbnhtWGYycE15Wk5kNDQwdU1SYjFlcGozREt2R0wvQnZVQW5GR0ticitmSnpORG43STdvZkVLNjEvVzRIY212NXlGeEFGODMwd2JybGYvVU9mWkw0SzEzWUJDVDQvWkN1SnNFbHVrYS9ha2lBb3dBY1QwUm1WSkF0Q3M5azZWS1NIM1Zpbm5xYnNreUN2SmtRS3JleHowWU0vZjBLbStqMHRXc2tyaGNpZE04Y0xKUXNTWTRzcVFXcTlFeXdKa2xFRk4vRFArNjRoSUJIZ1VBQWpxcjN3OSt0RjJJdHUvek52dC9vL2ZISXc5QTRDZzMyUWgvdUl3UlA0TVhvZC81SWZpaGZveTUwWVh2WWMrcGQ5U1cxTyswM2VweUd2UDVOUERiWCtTWUVITm9nd2NwWVh1SVdKc1VFVkMwMHU3dzRJczU3M0xVMVl4OExJeHpnemN6YVpNYnh3eDJvUkpqWUU0T2M3QS9ETHBnRDhPOEdlTUpvaW9IZk1ESHRNNm5GYTFtbVpQUlpqMkJQRE9NUG5mOVVjVUwzR2svc2xlR2l6cU1yUzBNZ1dFWUo0NFQvMjBIWGQxOURJZjdFN0FQOW5wOEdZSS9hSmJoL0J2Qk1iUkxoempWOGxMYkdCUExMbVNMRDlDWXU4VDlnbUNQZTgvdzUrb2NxcXhJSmNzOGVZYzlROEgrVGg3SlpETUJ2RE1Kc2dudWptbWYxQmptWE5HcGczZTNhb2JyTE5KWmpUaHh6TitkNzhGdjNKbWQxWDNxeWZQWFhuNkpRbEdKQjNqbjVlM1hiQ1l5M0FFSXF6a0xlQWhqRVM1ZlBHeC9RdUp4THY5Y3RkQWZqTDZkNWUyV25IMm50c1Rsait1QjJGb2FCci9pRFlYQWdLTjgvUFp6aEovRUwvdVVIcXJDTUk0Um15bER5WU55OUVycUthRUVhRjkwdm1lOVc4WmMrSDh5L3MyNlk3aUpFK3RFbkVrSXhlcUVVZXVSL3pJdXBnWG9pRVNTK0hCYjZXREtkSldPQ3JJRE42VWdNSFY0Z3o1YzNQZVZYUE0yNlpYM1hWLzdCT2hCOWdIUHU5T2hHK3VjSVBaWmh2Qk9iSnhObXl1Q1pFRnM1UlcxNUllbG5FZ0pIb2FldC9UL2V5YjkxYkNneXI4b0tRQ2pKWTZKM2ttQ0RFNVpnYmlWZHpqSVlST1d1amFLNFhibHZxaHcxdksvQ0hxMTN3aGI5N3dGOFlrTVhmcGV0ZDBQU3VvcTVwdm9JeldoWVNwV1NlWHJ0ZW5iYU4ydmZhN0xmWG9wMW81ZVExYWR0K1hVSjRraG16MUtjdTdHa2w4dVR3UFMvN3NXNnZpUzY5RG1UcVJDNk95bnJLcXpRdlI5a09zK1o3MjNnU25wakNGK041TzJYMDY4aDR4Z1BON3ptYitRS1lmV203REZrelBWQXcyeHRGMzdUOThzVXdiaDhGV1VYYnovNzdXZWhGS2c3UVhiQ2YvcVFMYnByaEJXNmVUbjhXT0pXcEx5NzJ4TTMzMVdWRW01QmRqOFJIWWJFakg0MzdiZ3luQWxGRUJ1UWZiRC9GT1BtSDYvMlFYYTJud1BTQ2dNWmFncUZuTVhxU1R5bCtYWVpjd3YzcEpqL2t6Y0kya25Uc3FQdjdveVlJY1QzOFBPOFZuaGhRc2dBSFZZckt6RVBEUHZkWlY0dzNwTHJoTjAwUzVQU1FKQmt4MzJhZStiRzNsWXR5bUZnZkFJbmlIZmFybm01Vlg4VnprMUt1WnpKaVRjSThYS3dubWRIa1lEanc4eDBCS2dva055VWYyeE5RallPZmw5N2cwSkJ2Zk5ZRHh5L1NmWXEwK3JBRTJjOGw1WmdueFV3UThuWVZYK1B0NEdzc0dxdUpnUGE0V1JtenNqcjVSODMyd0Yvand2SVRpbmVBeWMydGJ5enpRY2tjRzMzWDlyUEc1SGlOQTluVVdNalZUcmthZyswOGl6d1IrWW93SExwN2xWLzkraUd0Uk40ZUhiL1VEMFd6VGZSY1kyRWpSdU90c1RGMjNmWjg1OGxUSXhrMEVqL1BWOWxQeVlPRU1oellzT2tlV1BJNjNhZUE5NzBmaEt3cUQzQnpCMytNZ3c2VXdZM1R2YkQ1ZDNRdit6YWNWZUNtNlc0UTVpWEhPREdrZmppRFZpcXZRaTh5MXl0cUJUbGdmNjdtdU40eEhZWDB5MnVRVDBBVVZudmdPOHY5NEE3UXZCd0pjT2NLSCtUTnREWWMwN0hYeEhCc2JuU0dyTHMxYThzbVJxRVgrVnF0VDMwdWpsWWk2NXFITm9pNGR2U291cVRXOTdrT3o0ZmtmWm1hOStoZGk5UjRhL3NaL0NCZ09IcVBwbk4wWjdZbHh5VVlPY016a05CcGpzeEtEenpUU3ZleTc0bExRY2lwOUlKcnppQ1ByOFk3T1lOMktwL3ZMVkc5eUNBTnFnQm4rUCt4TWJyTHVrYnBpcnNML2l1NXhEbWJFVUlMMVlnUjczNUdiOEZPbmpiK3plNEE1RHdYaWdnR2FXeFhvcjR4YU9sRjVxQVhDUXN1a1hDaEFkLzBqSWVxc2tqNmo1MEJ5SzVNL0hoU0FtaE1PZWhGZnJ5Tzd1dTVIM2QyUXhaNjdKTHFRUnJYN0RoNGo5N0YrdHpPVzdFUkpaRURRbEpDTGhyeHorcEZkUWFpbFM1MWRFSFc5QkQ1aExtTUVIcmdFQ09mOWNCUmltOTlrbFZOUlV0QUpZbVErREYxa1BWMFJqd1ROOHRUemM5V21aZ1FsT0tDc2FES0N4OThRVy9CU01LMDc2N0VoWGxsNHNhUnFpakUwUFpyejN2QlRmSGZjOGszMFZ5NFdDZTZUZWg0NXZnZXlZaDNJdkViTjl0N0lSRURFbVlUY25qZzJ5LzRxTDRhMnZnSEJVWk9aOFp2RjVub1JWWlIvc0RHRDlmNjFZa3ZjZVB3dEdja0tnbXpmQS8yTm14bkZwaWw4enR5TzB1L0xrS1E3R2U5OEorTjlLN3Jra3VYRTJwOWZjcVpwZW1EMVRobUdZekx5ZGl0enMxeVVPZHNCMzJZWlUvdVdwbVVvQmU1QlVPVVN4MzBacWs1NU05eG5yVXhOaXU1bU5sV0h4UzAyZHN6RXBtd0UwMzlCQmtIQ0FpeVRuaitLTDNMalV1d3JwdW5lVlR5eGJ2L1F3Vmx4SXRVZUdCcXN3UzBLTExoVFJsMTYwblFHSFMrMWg3M1VHdXVXTTVYZThYZVRsUkh3TzR4N2JsWkVmdTRGUkRacUpnRlIrZ1E1TU12dXNDRnN5RTNVOU9XR2FvTnRucDVqTVpkYmRKV3RVTmxtOG5VU2RscWszSUd4L05tZU9GTlNxL25ibmhUNlNOSXRRMFpWZHZRajc2OHI4UjlZVzRZYWxYN0tneUZUZ2s1R1AvK3ZJSE9wY1pIdDRrcTRZUTQ5M2tvZ3Nnc0J3MzZvVG8vbGZVZ0NiR0lMdUxlOTFrVUhraU02WEg0V2I3enVoMmJHWWJWQUNMenpleC9qQ2lsc05JTDM2aU5mWkYrOG1JUUNwRnNycGsyK3FFOVhxM1R2MWpHYkpSL3BrbmJrZmxuMnVoanRjVllxaDJNSWJ4UFBDOGh5WTZ6c2QrdC9jYzF1QTU4MWtHL2pHekY1RGRYN1R1V01kaUplODU3ZjUvaVBQMlZhQXA3ZVYzUGVhRUFsZkoyREI5Y0p2ZFA3bnJSRDNsWWorQ29qd3lSdWhJUUJUakozRFl2dHRkelA3N2VEYU1xUFZENlhIVDlzQW5GVmVVZW5aRU1DWTF1ZWFqem5vaEJlRFFEMHY2MmozeWNhZjUraFIvRUtKUkNQTStDTm5UbnozZ2N0NnMvRm8vTmZXOE03WGx0OXNmc3ZEZUdjWnFmejhYUTZOZU5nYWh1M0pJUEF2N3JSbEd0UXpDVWw5a1liQjZyZGsvTlNKYWtobHJQZWM0Z0lGNFkvcFFINWtmeDN4Yk5mMVJneEZRTXJhcmkxN2QwQTRleXZPbEpEMng4MDNtb3RlRzBERGYrMWgzZlBzNTB0MlFrVytJck8yL0Z6bm5pT2ZETXA5MHcrNEQ5UzQzMWJ5bFFNc01McFpYTXFHbkRoVExOZThZTkt4eThtN01jOCtaWGhNckdzVytYTWJRcXpFakdKRHpubWNpVG1UcE80RkN3V1VpU0g3L3NoMk1mQmxWM1BUQ2s2b2IzUCt1Q1gyOFhvUkNWVVRJamZ2MUpkNUNKSng5RDE1KzlLc0xwajdwMFF5N3k0WVpUSHdYaFh6RlB6clF3T2VMWEo2V3N5bjFuUmpJbm9RclhJM0ZXVEQ3T1hNVDR2N2ZjQjVVdEFWalZMc01heE55REVreGM1MWZ6Wk1kZkdReFZvWEFyRDBuaXdvbm9JWnk0cXZkTHFpNklUbWEyQnVCSHEvMVFQQ1BrYmJoNDkrZTVKRnAzbUs1SHFuQTlRb3pUQ2xYUm5VZFBCYVVvOUFKVVRENFNJZmRwQkc3enBwRmpiaWg1MXFCc1ZSUjlTQ1ZVRFU1Wm5CUlZtWk9KaStpZ1J4ZDUwOXptK3FDS0pGeDNtSzVIS25FOWtnQ2pFQXgrTXd3ZWhEQnBFcWlQNUYxM0dJWmFNM0E5b2gzSURKc0RuaEdGa0daRVFGdFB0TzNPTUNtck9TY1lsWS9ZQ2lidENySElZVWFVZVdiWUt5dk1pRUlQMGVoeGhubC9CZjIya24vZFllaEpacmluUmhxdU1LTy9JUXNHeC9nRVE0anlYRElnV2hrbVV1NUNmUFV6TVNPVkU3SysxbzV5aFFRYnF0MjJCQWQ5RUFhUkpNbEMxc1MyR2NmWFp4UHFTWjcxYkVXQVFCWnJFZHRJQ0JIUUh1Tk44dk02ZFFwUnRpSG85RkV3S0t2WGhsR2J2TTIrOFRiSHpsdVVOK3ViMVZpZDFtT2xHOEZBN3J5SnJPM0lTWGpXdlNCanlLUXF1QUVIZGtDd2FYQ0NoYUQxQkM4WTFNSGJWQlp2VVRkdnc4RHNHTHRnbzM3QkFaRjRCNFp1TmpId052b25PTkNERlhudDZFd3d0QXR2WGNaUVMwVlZuMlVLMHozdFBIa0hnRHcwR0FHOVk5cnpna05vNitTanFKTjNrTS9PZVQ2S1BFNzNuY2dyWHZsNEM5bEZJOWVJTW8zVVAvcVdQUGRJdkNVNEE1d1RvakQ0VkFCUGdkaXh0RWR6Z2htTWZ0ckFNVExSWmd6bFZGN1ZVWTREdlNKVWhBY2R1YTNRRVVxRmdiQXFUTXBhMVRsZEozK0Z5VG05YmZnM1g2SC8yN1MvUnUxcnhzUlg2QmhaUkI2K3drSk9abTFVT095WG1XejE1Rnhoa25lNlNSc1YrdTNpV004TjJwdUJDU2ZKMHgzbFpNQzZTa3NTOElOY25xRWZqcVhjalVBYTRSWU92SjBwbjhGOG92RTJEZm13eW5UaFBzMXpRSGdHaGNIQW9FSFpNKzROUTNaQjd1UVNNRC9Oc3pXdXdwNldBSVdxYmJpSFNCdEpVUDgwVDIwR1N4RjMzRkVncXZDaWhqc01UeHdSNy9vOUNScERjcmRSOXN3UXVVTk9PNVU5N1o3YVg4QmFHQ2xDbThjZEplelVUNk1OdDQwMjdOWVRheHVlR003RnFvc0I1eFgrNmM1SmpBbG1udVJwejBUaGFiY0hBUXhwaFN2b09lNW5ETER6N05iVG5iZVdUZTA4dzR3bVhkQjVvUHhKYndtemZFZVhnV0c0OEZUbmNtRXFDcEJocUVMaG4vSlVzaXRWc1laY1V6SGtZc1kwMUhDbDdDa1dVdEVOdVpoUkRSR3drQ3ArSWRkVEtHQ0dWQVVMcWVKK0tSamRNZ3I2UERPMmxNTXA0YW5ydHpNTFRwUTMrYTJuUW5qU0xTS0FJYW5SVWZaYno2UE1hd3dHVWNoVHdVKzZtNWdSSmkzcVhFK2syVk80U1htbDY3ZnVCMUVaRjVoQkpnM09sazFOMFUveERPbXc2OG5PYWlTTGdnQ0dRWUduN0luT3lTeWNTdVpMd2xNNmI4WDFTUzBxUzJRR216QjBrTW1KWGJwTkpZK0N5aEllUjZJOGdVUjVBcFhJRUE5MDhJOTdLc3NmUzVOWFlZY2tVVkI1UklsRW1jeWdxZUVLQ2FWSVdNc3NiQWdSQlQxS0JWRXVNL0NvY1o0Ukl3MFc4L3dVOXlQQ0ZIZWI4RGdxbmNFS0N2KzR1d2tubDRsczhaMW1pWHZLenhPdmdnWndqcnBoVFVtQThjYTNqVlBFVzdEN0dDeUZ5UEo0NXgzQ0ZNOVNOTHBycXVHbEp5NmpkNTByL01Zemhsa0VTL3FKZkVkNGl2dkJzaW51RGJpOWtnYWt1RkQydUh0MTJlUHMwWE9Xb2xtelBPRWVYVGI1K3FQOFkrNnR3bVB1RG1GS0orRFdBSjFoR0ozVCt4MDJWSEpzaXNGNWJUN2RlanZOKzlGVGRyTDdDaUUvNHVIeXh6ckttWVpab2h1S1BkWXhvV3hLNTJRTVJaclE4RHdEamJUVFlOL3N1QjJTMldsRE4xK0hNTGx6Yzlsa3o2T0U3RXlETENVMGpaM21IajNobWM0ZlRKamVPWGw4UmVmeUNkUGRiZU9udTYvZ0ZoSURUOC8yTXJiYk1yN0NzeFIvLzJyOGpNNEhKbFF4RDhGU2tpWUF5RVhjanBpRXFFVFVoZEdJYUF2alFoZ2RBLzloSEs2Rno1MlB5TDgxWE1kcVJBVmlJbUlDSXBOSlBEN3Avd09OZ0YrMVBsdUErd0FBQUFCSlJVNUVya0pnZ2c9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjU3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijc2IiB5PSI3MyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9ImlPUyBBcHAgU3RvcmUgLT4gSW9UIE1vYmlsZSBBcHBsaWNhdGlvbiIgc3R5bGU9ImlyLnJlZj02Y2ExNzM1ZC0yYjkxLTRmMmEtYWVmOC1lMjJmYzk2YTQ0MWE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIzMiIgdGFyZ2V0PSIxMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iUm91dGVyIC0+IEFXUyBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJpci5yZWY9ZTEzODc0Y2YtYTZhYS00ZjVlLWJmNGUtODM3MGVhNTZlNWUwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxOSIgdGFyZ2V0PSIyMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkNvbW1vbiBWdWxucyIgaWQ9IjQyIj48bXhDZWxsIHN0eWxlPSIiIHBhcmVudD0iMCIgdmlzaWJsZT0iMCIvPjwvb2JqZWN0PjxteENlbGwgaWQ9IjQzIiB2YWx1ZT0iV2VhayBvciBIYXJkIENvZGVkIFBhc3N3b3JkcyIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyOTUiIHk9IjYyNyIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDQiIHZhbHVlPSJJbnNlY3VyZSBOZXR3b3JrcyIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0NCIgeT0iNDAwIiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0NSIgdmFsdWU9Ikluc2VjdXJlIEVjb3N5c3RlbSBJbnRlcmZhY2VzIiBzdHlsZT0icm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9I2I4NTQ1MDtzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jZjhjZWNjO2ZvbnRTdHlsZT0xIiBwYXJlbnQ9IjQyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ijg2IiB5PSI1NDciIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ2IiB2YWx1ZT0iSW5zZWN1cmUgVXBkYXRlIE1lY2hhbmlzbXMiIHN0eWxlPSJyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSNmOGNlY2M7Zm9udFN0eWxlPTEiIHBhcmVudD0iNDIiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNDMzIiB5PSI2MjkiIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ3IiB2YWx1ZT0iT3V0ZGF0ZWQgQ29tcG9uZW50cyIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1NzUiIHk9IjYyNyIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDgiIHZhbHVlPSJMYWNrIG9mIFByb3BlciBQcml2YWN5IENvbnRyb2xzIiBzdHlsZT0icm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9I2I4NTQ1MDtzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jZjhjZWNjO2ZvbnRTdHlsZT0xIiBwYXJlbnQ9IjQyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ijc3NSIgeT0iMjcyIiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OSIgdmFsdWU9Ikluc2VjdXJlIERhdGEgVHJhbnNmZXIgb3IgU3RvcmFnZSIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMzciIHk9IjE3OCIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTAiIHZhbHVlPSJJbXByb3BlciBEZXZpY2UgTWFuYWdlbWVudCIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMzI1IiB5PSI2MjIiIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUxIiB2YWx1ZT0iSW5zZWN1cmUgRGVmYXVsdCBTZXR0aW5ncyIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMTgyIiB5PSI2MjAiIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUyIiB2YWx1ZT0iTGFjayBvZiBQaHlzaWNhbCBIYXJkZW5pbmciIHN0eWxlPSJyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSNmOGNlY2M7Zm9udFN0eWxlPTEiIHBhcmVudD0iNDIiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTQ0IiB5PSI2MzUiIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUzIiB2YWx1ZT0iTGFjayBvZiBQcm9wZXIgUHJpdmFjeSBDb250cm9scyIgc3R5bGU9InJvdW5kZWQ9MDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3N0cm9rZUNvbG9yPSNiODU0NTA7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9I2Y4Y2VjYztmb250U3R5bGU9MSIgcGFyZW50PSI0MiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0NjIiIHk9Ii0yNDQiIHdpZHRoPSIxMjAiIGhlaWdodD0iNjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjU0IiB2YWx1ZT0iSW5zZWN1cmUgVXBkYXRlIE1lY2hhbmlzbXMiIHN0eWxlPSJyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSNmOGNlY2M7Zm9udFN0eWxlPTEiIHBhcmVudD0iNDIiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTQ2MSIgeT0iNjE4IiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1NSIgdmFsdWU9Ik91dGRhdGVkIENvbXBvbmVudHMiIHN0eWxlPSJyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSNmOGNlY2M7Zm9udFN0eWxlPTEiIHBhcmVudD0iNDIiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTU2MiIgeT0iNTM4IiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="60"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="trusted-partner" uuid="531315a7-41a2-40ed-ab87-22c3a4c3c7ff" name="Trusted Partner" desc="Vetted and trusted partner" trustRating="80"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Protected Health Information" desc="Relates to the past, present, or future physical or mental health or &#13;&#10;condition of an individual; the provision of health care to an individual; &#13;&#10;or the past, present, or future payment for the provision of health care to &#13;&#10;an individual." identifier="">
+      <classification name="Personally Identifiable Information" desc="&#10;                Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity.&#10;                " confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings>
+    <setting name="features.remove.not.applying.countermeasures.from.model" value="true" canOverride="true" type="BOOLEAN" groupName="GENERAL"/>
+    <setting name="general.issue.tracker.default.profile" value="" canOverride="false" type="TEXT" groupName="ISSUE_TRACKER"/>
+    <issueTrackers>
+      <jira>
+        <fields/>
+      </jira>
+    </issueTrackers>
+  </settings>
+  <dataflows>
+    <dataflow name="AWS A2I (Augmented AI) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="025ab1f2-f615-438e-a40a-3f88c6343d7a" source="ac3afbbd-0bc5-41d2-8e58-3531973737bb" target="8f81cb4f-d85b-4cee-96fb-8a273d8636bd">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Bluetooth port -&gt; Bluetooth port" ref="0c085b14-71d0-420f-9110-08fc3c50b887" source="75352eeb-eed3-4da3-bc40-f7bc879b1bfe" target="cf25d1a3-167a-4a8a-89f3-09152b0291cc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Embedded Storage -&gt; Other database" ref="0dbb682a-0680-4987-b74a-6eb206c742ec" source="6195b120-d6d5-407c-9dbd-136f9f4833fb" target="375e500c-8224-4ff1-b3a9-8dcb9da062dc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Sensor -&gt; IoT Application" ref="36284ba6-de26-44db-9c74-afb39a72b0ca" source="e6a9e3e2-8bd8-4ffd-8a55-beedcaa1f75e" target="036adfeb-40aa-49e3-9879-19a9303f9ead">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="iOS App Store -&gt; IoT Mobile Application" ref="6ca1735d-2b91-4f2a-aef8-e22fc96a441a" source="7bd64aec-f5c0-4c05-96bb-d723e1bcbcea" target="d0fdc25d-5d11-4e1f-af10-16a726654f57">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="IoT Application -&gt; Embedded Storage" ref="76d9fdc8-b739-4901-81bc-51c80fb44106" source="036adfeb-40aa-49e3-9879-19a9303f9ead" target="6195b120-d6d5-407c-9dbd-136f9f4833fb">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Embedded Storage -&gt; IoT Application" ref="835a3685-14fe-40e9-9924-6b6bdb73460b" source="6195b120-d6d5-407c-9dbd-136f9f4833fb" target="036adfeb-40aa-49e3-9879-19a9303f9ead">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS EC2 (Elastic Compute Cloud) -&gt; AWS RDS (Relational Database Service)" ref="88853750-0f04-46fd-9310-c9c498d800f7" source="8f81cb4f-d85b-4cee-96fb-8a273d8636bd" target="f4661e7d-e24f-45d6-9704-3ba6e1a8aec4">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS RDS (Relational Database Service) -&gt; AWS A2I (Augmented AI)" ref="89013e2d-8c4d-4946-971c-62e8d951c270" source="f4661e7d-e24f-45d6-9704-3ba6e1a8aec4" target="ac3afbbd-0bc5-41d2-8e58-3531973737bb">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Bluetooth port -&gt; IoT Mobile Application" ref="90b643e7-0e74-40c2-b2a3-e78c884c0c50" source="75352eeb-eed3-4da3-bc40-f7bc879b1bfe" target="d0fdc25d-5d11-4e1f-af10-16a726654f57">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Bluetooth port -&gt; Bluetooth port" ref="9dc635ab-4e48-4586-aa05-16f11dd7493e" source="cf25d1a3-167a-4a8a-89f3-09152b0291cc" target="75352eeb-eed3-4da3-bc40-f7bc879b1bfe">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Wi-Fi port -&gt; Router" ref="b97ee69f-565b-48ac-be25-cf3fb631d748" source="c49d2e8c-310a-4618-9e97-40382c616251" target="a8e21836-69ca-4ed3-96b7-4b152a3a3a36">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="IoT Operating System -&gt; Wi-Fi port" ref="c376b4c9-7023-47e4-964e-fcce48148f5b" source="098d813e-0ed5-4bb8-8f6a-58d4a2a3a4e8" target="c49d2e8c-310a-4618-9e97-40382c616251">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Other database -&gt; Embedded Storage" ref="c741128a-59b0-4001-9e30-80d9e4fb7c5f" source="375e500c-8224-4ff1-b3a9-8dcb9da062dc" target="6195b120-d6d5-407c-9dbd-136f9f4833fb">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="IoT Mobile Application -&gt; Bluetooth port" ref="d30df4bf-786f-4674-982e-5b4f02c93b0d" source="d0fdc25d-5d11-4e1f-af10-16a726654f57" target="75352eeb-eed3-4da3-bc40-f7bc879b1bfe">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Router -&gt; AWS WAF (Web Application Firewall)" ref="e13874cf-a6aa-4f5e-bf4e-8370ea56e5e0" source="a8e21836-69ca-4ed3-96b7-4b152a3a3a36" target="d74ae0ed-f971-47f6-8964-41c7ccc4cc09">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS WAF (Web Application Firewall) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="e4f6bd15-1fa7-486f-a34c-cc0d4dcb764f" source="d74ae0ed-f971-47f6-8964-41c7ccc4cc09" target="8f81cb4f-d85b-4cee-96fb-8a273d8636bd">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields>
+    <customField ref="project-epic-id" value=""/>
+  </customFields>
+  <components>
+    <component uuid="ce2ff4c5-0ddd-4703-a5eb-f7e1406838cf" diagramComponentId="c6206fbc-2ada-4d0f-86b6-66aaf08e97b2" ref="ac3afbbd-0bc5-41d2-8e58-3531973737bb" name="AWS A2I (Augmented AI)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="c7533c7a-9081-435d-9260-c5602f5e07b7" componentDefinitionRef="CD-A2I" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AWS-A2I1" name="Control access to AWS Augmented AI (A2I)" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Control access to AWS Augmented AI (A2I)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; When using Amazon Augmented AI (Amazon A2I) to create a human review workflow for your ML/AI application, you create and configure resources in Amazon SageMaker such as a human workforce and worker task templates. To configure and start a human loop, you either integrate Amazon A2I with other AWS services such as Amazon Textract or Amazon Rekognition, or use the Amazon Augmented AI Runtime API. To create a human review workflow and start a human loop, you must attach certain policies to your AWS Identity and Access Management (IAM) role or user.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; - When you start a human loop using image input data on or after January 12th, 2020, you must add a CORS header policy to the Amazon S3 bucket that contains your input data.&lt;/p&gt; 
+&lt;p&gt;- When you create a flow definition, you need to provide a role that grants Amazon A2I permission to access Amazon S3 both for reading objects that are rendered in a human task UI and for writing the results of the human review.&lt;br&gt; This role must also have a trust policy attached to give SageMaker permission to assume the role. This allows Amazon A2I to perform actions in accordance with permissions that you attach to the role.&lt;/p&gt; 
+&lt;p&gt;- To create and start human loops, you either use an API operation from a built-in task type (such as DetectModerationLabel or AnalyzeDocument) or the Amazon A2I Runtime API operation StartHumanLoop in a custom ML application. You need to attach the AmazonAugmentedAIFullAccess managed policy to the IAM user that invokes these API operations to grant permission to these services to use Amazon A2I operations. &lt;br&gt; This policy does not grant permission to invoke the API operations of the AWS service associated with built-in task types. For example, AmazonAugmentedAIFullAccess does not grant permission to call the Amazon Rekognition DetectModerationLabel API operation or Amazon Textract AnalyzeDocument API operation. You can use the more general policy, AmazonAugmentedAIIntegratedAPIAccess, to grant these permissions.&lt;/p&gt; 
+&lt;p&gt;- To preview your custom worker task UI template, you need an IAM role with permissions to read Amazon S3 objects that get rendered on your user interface.&lt;/p&gt; 
+&lt;p&gt;For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Permissions and Security in Amazon Augmented AI" url="https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-permissions-security.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.265">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-A2I1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-A2I1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a13a6e0f-809b-49e0-b3e1-31ac7cc25b2a" diagramComponentId="fac89f41-5f4b-49b8-b2b1-2cdbf616639d" ref="7593ee1f-6a32-4907-a5f7-b7ef2c02801c" name="AWS Account Environment" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="AWS-Logging-3.3" name="Audit logs are accesible" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The audit logs are not encrypted and they can be accessed by attackers and obtain sensitive data
+                        in clear text.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.5" name="Brute force attempts on the Amazon management console cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The failure connection attempts (brute force) must be audited and monitored and the
+                        correspondent personnel must be alerted and informed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.12" name="Changes in the network configuration cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The changes in the network configurations (NACLs, route and gateway tables) are not detected
+                        because the monitorization and alerts of the network configuration are not configured to detect
+                        these changes.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.4" name="Changes in the security configurations can be not detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Monitoring and alerting for security configurations are not configured and changes cannot be
+                        detected.&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.10" name="Changes in the security groups cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the security groups must be audited and monitored and the correspondent
+                        personnel must approve these changes. If the situation is not the correct, attackers can access
+                        to security systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.656">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="cloudwatch-misconfig" name="Cloudwatch is misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.3" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login to the console without using the Multi-factor Authentication (MFA) and they are not
+                        detected. The connection without the MFA must be audited and monitored, the correct security
+                        group must be informed and they must validate this connection.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.1" name="Non-auditable API calls in all regions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The API call to the resources is not audited and the actions are not recorded into the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.835">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.8" name="Non-centrality audit logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The audit logs are not stored in a central system. Therefore, the audit logs cannot be
+                        exploited correctly by the security personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-1.21" name="The access keys are generated when the setup of the users is started" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The system doesn't require additional steps to create access keys, the access keys are
+                        generating when the process to create an user is starting. The problem is that these keys can be
+                        in use somewhere in the organization and maybe these keys are not necessary for the user.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EXPIRATION-DATE" name="The password expiration is not established" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator account is not configured. The security question to recover or reset the
+                        password and the authentication method are not configured.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.9" name="The security policies are exposed in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not configured and the security configurations are exposed for the
+                        attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.7" name="Unaudited connections with the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The connections with the applications and with the databases cannot be audited and not
+                        detected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.9" name="Unaudited resources changes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the applications and in the databases and these changes are not detected and
+                        not audited.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.12" name="Apply an AWS Managed Config Rule for EIPs attached to EC2 instances within VPC" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources. You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Description": "Checks whether all EIP addresses allocated to a VPC are attached to 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    EC2 instances or in-use ENIs.", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ConfigRuleName": "eip-attached", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Source": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Owner": "AWS", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "SourceIdentifier": "EIP_ATTACHED" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Scope": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ComplianceResourceTypes": [ 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "AWS::EC2::EIP" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    ] 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe config rules" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"/>
+            <reference name="Put config rule" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/put-config-rule.html"/>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for a Config Rule that checks whether all EIP addresses allocated to a VPC are attached to EC2 instances or in-use ENIs:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'EIP_ATTACHED']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.3-2.4" name="Apply an IAM Role for Amazon EC2 Tier" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      } 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Web tier EC2 instances, check if and which IAM instance profile they have attached, and note the name of the instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-instances --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Reservations[*].Instances[*].{IamInstanceProfile:IamInstanceProfile, InstanceId:InstanceId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.1-2.2" name="Apply IAM Policy for EC2 IAM Roles for tier" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles defined with AWS Identity Access Management. An IAM policy is a document that formally states one or more permissions using the following structure:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Actions: what actions are allowed (each AWS service has its own set of actions)&lt;/li&gt; 
+  &lt;li&gt;Resources: which resources will be affected by the action&lt;/li&gt; 
+  &lt;li&gt;Effect: what effect will be when the subject (user/group/roles) requests access Policies are documents that are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;b&gt;Remediation&lt;/b&gt;: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM managed policy for Web tier instances, and note the policy ARN:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-policy --policy-name &amp;lt;iam_policy_name&amp;gt; --policy-document file://policy 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the IAM policy created to the Web tier IAM role:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --rolename &amp;lt;web_tier_iam_role&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="Get policy version" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html"/>
+            <reference name="List attached role policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-role-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check managed policies attached to the IAM role, and note the policies ARN:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-attached-role-policies --role-name &amp;lt;web_tier_iam_role&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the version of the IAM policies attached to the IAM role:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --query "Policy.DefaultVersionId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the document policy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;iam_policy_arn&amp;gt; --version-id &amp;lt;iam_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select the user.&lt;/li&gt; 
+   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ol&gt;Create a Group and add a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
+  &lt;li&gt;Click Create Group.&lt;/li&gt; 
+  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.15" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-attached-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
+  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
+  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
+  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
+  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
+  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
+  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
+                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
+                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
+                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
+                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
+                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
+                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
+                            ALLOW.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.291">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.5-2.6" name="Configure AutoScaling Group Launch Configuration for Tier to use a customer created IAM Role" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  *Note: references to Web tier are also applicable to App tier. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the Web tier IAM instance profile :&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if your Web tier autoscaling group is using a launch configuration with an IAM instance profile configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query "LaunchConfigurations[*].IamInstanceProfile" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM1" name="Configure contact email and telephone details on AWS accounts" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.&lt;/p&gt;&lt;p&gt;An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, next to Account Settings, choose Edit.&lt;/li&gt;&lt;li&gt;Next to the field that you need to update, choose Edit.&lt;/li&gt;&lt;li&gt;After you have entered your changes, choose Save changes.&lt;/li&gt;&lt;li&gt;After you have made your changes, choose Done.&lt;/li&gt;&lt;li&gt;To edit your contact information, under Contact Information, choose Edit.&lt;/li&gt;&lt;li&gt;For the fields that you want to change, type your updated information, and then choose Update.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, review and verify the current details.&lt;/li&gt;&lt;li&gt;Under Contact Information, review and verify the current details.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.11" name="Configure password expiration" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Change access keys regularly, and make sure that all IAM users in your account do as well. That way, if an access key is compromised without your knowledge, you limit how long the credentials can be used to access your resources. Credential reports can be used to determine how long access keys have been active for. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;Select the user you wish to rotate the key for.&lt;/li&gt; 
+  &lt;li&gt;Under access keys click &amp;quot;Create Access Key&amp;quot; (do not touch the existing key yet).&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Download credentials&amp;quot; or &amp;quot;Show credentials&amp;quot; so that you have a record of them.&lt;/li&gt; 
+  &lt;li&gt;Update any applications with the new credentials and test (we recommend to leave a few days or a week for testing).&lt;/li&gt; 
+  &lt;li&gt;Once complete complete 1-4 above and for the key which needs rotating click &amp;quot;Make Inactive | Delete&amp;quot; and click &amp;quot;Deactive&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Once you are confident you will no longer need the key (wait several more days) repeat 1-4 and select &amp;quot;Delete&amp;quot; for the inactive key.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.14" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Check the access keys created time: aws iam get-credential-report --query
+                            'Content' --output text | base64 -D | awk -F, '{print $1,$9,$10,$14,$15}'&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each access_key_1_active and access_key_9_active that is set to True ensure
+                            the created date is within the last 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.1" name="Configure the security challenge questions within the AWS Account" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When an AWS account is initially created it is configured with a top level account known as the &amp;quot;root&amp;quot; account that has full administration access to all resources. In the event that the password or MFA device associated with this account is lost AWS support may recover it by asking you to answer the security questions. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;For each question:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select an appropriate question.&lt;/li&gt; 
+   &lt;li&gt;Enter an appropriate answer.&lt;/li&gt; 
+   &lt;li&gt;Follow the above process for all 3 questions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;Click Update when complete.&lt;/li&gt; 
+  &lt;li&gt;We recommend to store the questions and answers in a secure location such as a safe where they can be used in case recovery is required.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether questions and answers have been saved.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.7" name="Create a Cloudwatch Alarm and its action for the &quot;VPC Flow Logs&quot; metric filter" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt;
+   A Cloudwatch alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The Cloudwatch Alarm will trigger a notification being sent to the administrators every time the "REJECT packets" specified threshold is reached. The alarm should be created for the "VPC Flow Logs" metric, and the action should have a SNS topic configured.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch alarm for the VPC Flow Logs metric, and configure an Alarm Action:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws cloudwatch put-metric-alarm --alarm-name &amp;lt;vpc_flow_log_alarm_name&amp;gt; --alarm-actions &amp;lt;sns_topic_arn&amp;gt; --metric-name &amp;lt;vpc_flow_log_metric_name&amp;gt; --namespace LogMetrics --statistic &amp;lt;desired_statistic&amp;gt; --period &amp;lt;desired_period&amp;gt; --evaluation-periods &amp;lt;desired_evaluation_periods&amp;gt; --threshold &amp;lt;desired_threshold&amp;gt; --comparison-operator &amp;lt;desired_operator&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe alarms" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"/>
+            <reference name="Put metric alarm" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html"/>
+          </references>
+          <standards>
+            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Cloudwatch alarms configured for the VPC Flow Logs metric, and check if an Alarm Action is configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch describe-alarms --query "MetricAlarms[?MetricName =='&amp;lt;vpc_flow_log_metric_name&amp;gt;'].{MetricName:MetricName,AlarmActions:AlarmActions,AlarmName:AlarmName}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.6" name="Create a log metric filter for the Cloudwatch group assigned to the &quot;VPC Flow Logs&quot;" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Description:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  This recommendation builds upon the Foundation benchmark recommendation: "Ensure VPC Flow Logging is Enabled in all Applicable Regions"&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  VPC flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. VPC flow logs can capture accepted traffic, rejected traffic, or all traffic.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Metric filters can be used to express how the service would extract metric observations from ingested events and transform them to data points in a CloudWatch metric. Metric filters are assigned to log groups, and all of the filters assigned to a log group are applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A metric filter should be created for counting how many IP packets are rejected in the VPC flow logs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a metric filter for the Cloudwatch Log group assigned to the "VPC Flow Logs":&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs put-metric-filter --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; --filter-name &amp;lt;vpc_flow_log_filter_name&amp;gt; --filter-pattern "{ $.errorCode =\"AccessDenied\" }" --metric-transformations metricName= &amp;lt;vpc_flow_log_metric_name&amp;gt;,metricNamespace=LogMetrics,metricValue=1 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"/>
+            <reference name="Filter log events" url="https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html"/>
+            <reference name="Put metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html"/>
+          </references>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface to check if the log metric filter: 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws logs describe-metric-filters --region &amp;lt;application_region&amp;gt; --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.7" name="Create an IAM group for administration purposes" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and should have administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new IAM group for administration purposes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-group --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attach the Admin policy to the administration IAM group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam attach-group-policy --policy-arn &amp;lt;admin_policy_arn&amp;gt; --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The name of the IAM admin group name should be known prior to auditing this recommendation. For a sample admin policy arn see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Attach group policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-group-policy.html"/>
+            <reference name="Create groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-group.html"/>
+            <reference name="List groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM groups created for administration purposes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-groups --query "Groups[?GroupName == '&amp;lt;iam_admin_group_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.8" name="Create an IAM policy that allows admin privileges for all services used" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A policy is a document that formally states one or more permissions.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies apply only to identities (users, groups, and roles) - not resources. You must ensure that you have an IAM managed policy created with admin permissions for all the AWS services used by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create an IAM managed admin policy for all AWS services used:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-policy --policy-name &amp;lt;admin_policy_name&amp;gt; --policy-document file://policy 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The admin policy should be defined prior to auditing and remediating this recommendation. For a sample admin policy see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM admin policies and note the policy ARN and DefaultVersionId:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-policies --query "Policies[?PolicyName == '&amp;lt;admin_policy_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If the policy exists, check the policy document:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;admin_policy_arn&amp;gt; --version-id &amp;lt;admin_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.20" name="Create an IAM role for managing incidents with AWS" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>WS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br /&gt;Using the Amazon unified command line interface, create an IAM role for managing incidents with AWS: 
+&lt;br /&gt; 
+&lt;br /&gt;Create a trust relationship policy document that allows &amp;lt;iam_user&amp;gt; to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: 
+&lt;br /&gt; 
+&lt;br /&gt;{ 
+&lt;br /&gt;&amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
+&lt;br /&gt;&amp;quot;Statement&amp;quot;: [{ 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Principal&amp;quot;: { 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;AWS&amp;quot;: &amp;quot;&amp;lt;iam_user&amp;gt;&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }, 
+&lt;br /&gt;&amp;nbsp; &amp;quot;Action&amp;quot;: &amp;quot;sts:AssumeRole&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }] 
+&lt;br /&gt;} 
+&lt;br /&gt; 
+&lt;br /&gt;Create the IAM role using the above trust policy: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam create-role --role-name &amp;lt;aws_support_iam_role&amp;gt; --assume-role-policy-document file:///tmp/TrustPolicy.json 
+&lt;br /&gt; 
+&lt;br /&gt;Attach 'AWSSupportAccess' managed policy to the created IAM role: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --role-name &amp;lt;aws_support_iam_role&amp;gt; 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: list entities for policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html"/>
+            <reference name="Amazon docs: managed policies and inline policies" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"/>
+            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.17" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the &amp;quot;Arn&amp;quot; element value: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-policies --query &amp;quot;Policies[?PolicyName == 'AWSSupportAccess']&amp;quot; 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;Check if the 'AWSSupportAccess' is attached to any IAM user, group or role: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-entities-for-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; 
+            &lt;span style=" , Arial;"&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-3" name="Create AWS Organizations change alerts" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;organizations_changes&amp;gt;` --metric-transformations metricName= `&amp;lt;organizations_changes&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;organizations_changes&amp;gt;` --metric-name `&amp;lt;organizations_changes&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.15" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.418">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.8" name="Create billing alerts to identify unusual spend" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>By setting billing alarms you can monitor your AWS spend and be alerted if it exceeds certain thresholds thus protecting you from accruing unnecessary charges. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the Receive Billing Alerts check box.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Choose Save preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia). The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, under "Metrics", choose "Billing".&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of billing metrics, select the check box next to Currency USD, for the metric named EstimatedCharges. Define the alarm as follows:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If you want the alarm to trigger as soon as you go over the free tier, set "When my total AWS charges for the month exceed" to $.01. This means that you'll receive a notification as soon as you incur a charge. Otherwise, set it to the amount you want to trigger the alarm, and you will be notified when you go over that amount.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose the "New list" link next to the "send a notification to" box.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;When prompted, enter your email address or choose your Amazon SNS notification from the drop down.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose "Create Alarm".&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;In the "Confirm new email addresses" dialog box, confirm the email address or choose "I will do it later". If you don't confirm the email address now, the alarm remains in the Pending confirmation status until you do so, and does not send an alert. To view the status of your alarm, choose "Alarms" in the navigation panel.&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management
+                            console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the &amp;quot;Receive Billing Alerts&amp;quot; check box is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia).
+                            The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, under &amp;quot;Alarms&amp;quot;, check for one called
+                            &amp;quot;Billing&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on the alert if it exists and select the checkbox in the first column.&lt;/li&gt;
+                            &lt;li&gt;In the preview pane check that the &amp;quot;EstimatedCharges&amp;quot; threshold
+                            is set to the correct value and that the &amp;quot;Actions&amp;quot; is send an alarm to a
+                            valid email address.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.421">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.4" name="Create cloudtrail configuration changes alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is changes to
+                        cloudtrail. Since cloudtrail is the actual utility logging API calls it's security is paramount
+                        to ensuring that this continues. Therefore alerting on changes to cloudtrail activity can
+                        prevent a malicious user switching off the logging in order to carry out untracked activities.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&amp;nbsp;&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;aws
+                        logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) ||
+                        ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName =
+                            DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.4-5.5" name="Create Cloudwatch Log Group for tier" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS CloudWatch Log groups define groups of log streams that share the same retention, monitoring, and access control settings. Each log stream has to belong to one log group.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch log group for the Web tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs create-log-group --log-group-name &amp;lt;web_tier_log_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html"/>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs describe-log-groups --query "logGroups[?logGroupName =='&amp;lt;web_tier_log_group&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.421">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.6" name="Create IAM Policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is management IAM policy changes. IAM manages authorization and authentication controls with AWS and therefore it is vital that unauthorized changes are detected. Enabling monitoring of these changes ensures that these policies remain intact and as desired. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for IAM policy changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=Delete UserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=P utUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=Cr eatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)| |($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUs erPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above:aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource
+                            = kms.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))} }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.3" name="Create management console login alerts when MFA is not used" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is login on the
+                        console without MFA. Since logging on at the console should be restricted to only those users
+                        with an active MFA this alert will highlight those with password only access. This helps to
+                        capture weaker login procedures (password only) as they occur.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login without MFA: aws logs
+                        put-metric-filter --log-group-name &amp;lt;cloudwatch-logs-group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{
+                        $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot; }'&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot;
+                            }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.5" name="Create management console login failure alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is management
+                        console login failures. The management console is the AWS account GUI where administration
+                        activity is performed and is therefore a primary target for brute force attempts. To identify
+                        these attempts alerts for login failures should be enabled as this can highlight suspicious
+                        activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login failures: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = ConsoleLogin)
+                        &amp;amp;&amp;amp; ($.errorMessage = &amp;quot;Failed authentication&amp;quot;) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = ConsoleLogin) &amp;amp;&amp;amp; ($.errorMessage = \&amp;quot;Failed
+                            authentication\&amp;quot;) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-2" name="Create network gateways change alerts" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for network gateways changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;network_gw_changes_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;network_gw_changes_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;network_gw_changes_alarm&amp;gt;` --metric-name `&amp;lt;network_gw_changes_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.12" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.12" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.418">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.2" name="Create root account usage alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is usage of the
+                        root account. This account should not be used on a day to day basis due to its full unrestricted
+                        privilege therefore usage should be by exception. Monitoring this usage should capture any
+                        suspicious activity used on the account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws logs
+                        describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy NOT
+                        EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy
+                            NOT EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.419">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.8" name="Create s3 bucket policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is S3 bucket policy changes. S3 bucket policies are a resource based policy that provide authorizations on S3 buckets. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Making sure that their integrity remains intact is vital in ensuring the data within the S3 bucket remains secure and authorizations intact. Therefore s3 bucket policy changes should be alerted upon 
+ &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a metric filter that checks for S3 Bucket policy changes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;value&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS topic for notifications:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns create-topic --name &amp;lt;topic_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) ||
+                            ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName =
+                            PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName =
+                            DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName =
+                            DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.10" name="Create security group change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is security group changes. Security groups are analogous to firewalls and therefore protect inbound and outbound access to &amp;amp; from AWS resources such as ec2 instances and RDS databases (amongst other things. Therefore alerting on changes to security groups helps ensure that the resources protected by them are not exposed.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for security group changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
+                            AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName
+                            = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName =
+                            DeleteSecurityGroup)}&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.418">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-1" name="Create unauthorized API calls alerts" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information, but gracefully fail if they don't have permissions.&lt;/p&gt;&lt;p&gt;If an excessive number of alerts are being generated then an organization may wish to consider adding read access to the limited IAM user permissions simply to quiet the alerts.&lt;/p&gt;&lt;p&gt;In some cases doing this may allow the users to actually view some areas of the system - any additional access given should be reviewed for alignment with the original limited IAM user intent.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for unauthorized API calls and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;unauthorized_api_calls_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.sourceIPAddress!="delivery.logs.amazonaws.com") || ($.eventName!="HeadBucket") }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;unauthorized_api_calls_alarm&amp;gt;` --metric-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.415">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.13" name="Create VPC gateway change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC gateway
+                        changes. VPC gateways are used as a means of sending traffic outside of a VPC (ie to the
+                        internet) and are vital in ensuring traffic flows to the correct destination. Therefore alerting
+                        on changes to VPC gateways ensuring traffic continues to flow as expected via the correct
+                        gateway.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC gateway changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateCustomerGateway)
+                        || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||
+                        ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName =
+                        DetachInternetGateway) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.14" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.14" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) ||
+                            ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) ||
+                            ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.419">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.11" name="Create VPC NACL change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC NACL
+                        changes. Network Access Control Lists (NACLS) control inbound and outbound access to &amp;amp;
+                        from AWS subnets and work like packet filters to protect the network. Therefore alerting on
+                        changes to NACLS helps ensure that the subnets protected by them are not exposed.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for NACL changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateNetworkAcl) ||
+                        ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =
+                        DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName =
+                        ReplaceNetworkAclAssociation) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.11" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) ||
+                            ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName =
+                            ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.418">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.12" name="Create VPC route table change alerts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC route
+                        table changes. VPC route tables provide a means of routing network traffic between subnets and
+                        via gateways and ensures traffic flows via the correct path. Therefore alerting on changes to
+                        route tables ensuring traffic continues to flow as expected.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC route table changes: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateRoute)
+                        || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =
+                        ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute)
+                        || ($.eventName = DisassociateRouteTable) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.13" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.13" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName
+                            = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName =
+                            DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.418">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.6-5.7" name="Define a retention period for Cloudwatch log group in tier" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Retention period should be used to specify how long log events are kept in CloudWatch Logs. Expired log events get deleted automatically. Just like metric filters, retention settings are also assigned to log groups, and the retention assigned to a log group is applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Put a retention policy for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-retention-policy --log-group-name &amp;lt;web_tier_log_group&amp;gt; --retention-indays &amp;lt;log_retention_period&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  If the retention period is not configured then logs will be retained indefinitely with increasing cost. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+            <reference name="Put retention policy" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-retention-policy.html"/>
+          </references>
+          <standards>
+            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group, and check for the presence of "retentionInDays" element:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs describe-log-groups --query "logGroups[?logGroupName == 
+   &lt;/div&gt; 
+   &lt;div&gt;
+     '&amp;lt;web_tier_log_group&amp;gt;']" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.421">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM2" name="Disable credentials unused after 45 days" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to manage Unused Password (IAM user console access)&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select user whose Console last sign-in is greater than 45 days&lt;/li&gt;&lt;li&gt;Click Security credentials&lt;/li&gt;&lt;li&gt;In section Sign-in credentials, Console password click Manage&lt;/li&gt;&lt;li&gt;Under Console Access select Disable 10.Click Apply&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Perform the following to deactivate Access Keys:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have been used and&lt;ol&gt;&lt;li&gt;Click on Make Inactive&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have not been used and&lt;ol&gt;&lt;li&gt;Click the X to Delete&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.12" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine if unused credentials exist:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click the Settings (gear) icon.&lt;/li&gt;&lt;li&gt;Select Console last sign-in, Access key last used, and Access Key Id&lt;/li&gt;&lt;li&gt;Click on Close&lt;/li&gt;&lt;li&gt;Check and ensure that Console last sign-in is less than 45 days ago.&lt;ol&gt;&lt;li&gt;Note - Never means the user has never logged in.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Check and ensure that Access key age is less than 45 days and that Access key last used does not say None&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Download Credential Report:&lt;/p&gt;&lt;p&gt;1. Run the following commands:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam generate-credential-report&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure unused credentials do not exist:&lt;/p&gt;&lt;p&gt;2. For each user having password_enabled set to TRUE , ensure password_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When password_enabled is set to TRUE and password_last_used is set to No_Information , ensure password_last_changed is less than 45 days ago.&lt;/p&gt;&lt;p&gt;3. For each user having an access_key_1_active or access_key_2_active to TRUE , ensure the corresponding access_key_n_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When a user having an access_key_x_active (where x is 1 or 2) to TRUE and corresponding access_key_x_last_used_date is set to N/A', ensure access_key_x_last_rotated` is less than 45 days ago.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.21" name="Do not setup access keys during initial user setup for all IAM users that have a console password" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials, it also generates unnecessary management work in auditing and rotating these keys. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation: &lt;/b&gt; 
+&lt;br /&gt;Perform the following to delete access keys that do not pass the audit. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Login to the AWS Management Console.Click Services.&lt;/li&gt; 
+ &lt;li&gt;Click IAM&lt;/li&gt; 
+ &lt;li&gt;Click on Users.Click on Security Credentials.&lt;/li&gt; 
+ &lt;li&gt;As an Administrator.&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;br /&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; As an IAM User&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Via CLI:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;aws iam delete-access-key&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ol&gt; 
+&lt;span style="font-weight: bold;"&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.11" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform the following to determine if access keys are rotated as prescribed: 
+            &lt;br /&gt; 
+            &lt;ol&gt; 
+             &lt;li&gt;Login to the AWS Management Console&lt;/li&gt; 
+             &lt;li&gt;Click Services&lt;/li&gt; 
+             &lt;li&gt;Click IAM&lt;/li&gt; 
+             &lt;li&gt;Click on a User&lt;/li&gt; 
+             &lt;li&gt;Compare the user creation date to the key 1 creation date.&lt;/li&gt; 
+             &lt;li&gt;For any that match, the key was created during initial user setup.&lt;/li&gt; 
+            &lt;/ol&gt;Keys that were created at the same time as the user profile and do not have a last used date should be deleted. 
+            &lt;br /&gt; 
+            &lt;br /&gt;Via the CLI: 
+            &lt;br /&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam generate-credential-report 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;br /&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;The output of this command will produce a table similar to the following:&amp;nbsp;&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_ 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               key_2_active,access_key_2_last_used_date 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               elise,false,true,2015-04-16T15:14:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               brandon,true,true,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               rakesh,false,false,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               helene,false,true,2015-11-18T17:47:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;For any user having access_key_last_used_date set to N/A , ensure that access key is deleted&lt;/li&gt; 
+            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.288">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
+                        creates a digest for each log file it writes to S3. These digests can then be used to determine
+                        if a log has been modified since being written
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.3.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails&amp;nbsp;
+                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.291">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM6" name="Enable IAM Access Analyzer for all regions" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable IAM Access analyzer for IAM policies about all resources in each region.&lt;/p&gt;&lt;p&gt;IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM Access Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to enable IAM Access analyzer for IAM policies:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;Choose Access analyzer.&lt;/li&gt;&lt;li&gt;Choose Create analyzer.&lt;/li&gt;&lt;li&gt;On the Create analyzer page, confirm that the Region displayed is the Region where you want to enable Access Analyzer.&lt;/li&gt;&lt;li&gt;Enter a name for the analyzer. Optional as it will generate a name for you automatically.&lt;/li&gt;&lt;li&gt;Add any tags that you want to apply to the analyzer. Optional.&lt;/li&gt;&lt;li&gt;Choose Create Analyzer.&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer create-analyzer --analyzer-name &amp;lt;NAME&amp;gt; --type &amp;lt;ACCOUNT|ORGANIZATION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat this command above for each active region. Note: The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.20" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.20" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/&lt;/li&gt;&lt;li&gt;Choose Access analyzer&lt;/li&gt;&lt;li&gt;Click 'Analyzers'&lt;/li&gt;&lt;li&gt;Ensure that at least one analyzer is present&lt;/li&gt;&lt;li&gt;Ensure that the STATUS is set to Active&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run the following command:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer list-analyzers | grep status&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that at least one Analyzer the status is set to ACTIVE&lt;/p&gt;&lt;p&gt;3. Repeat the steps above for each active region.&lt;/p&gt;&lt;p&gt;If an Access analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.6" name="Enable S3 Bucket logging" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>S3 Bucket Access Logging generates log files that contain access records for each request made
+                        to an S3 bucket. By enabling this it is possible to capture events relating to the objects
+                        within that bucket thus helping to capture potential security issues or identifying threats. It
+                        is recommended to enable S3 bucket logging on any S3 bucket that contains sensitive data and
+                        stored the logs in a separate bucket for security analysis.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                        &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&lt;/li&gt;
+                        &lt;li&gt;Click on Properties in the top right of the console.&lt;/li&gt;
+                        &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                        &lt;li&gt;Click on the &amp;quot;Enabled&amp;quot; checkbox.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Bucket&amp;quot; to store the logs.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Prefix&amp;quot; for the logs.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                            &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on Properties in the top right of the console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Enabled&amp;quot; is checked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.5" name="Encrypt CloudTrail logs using KMS" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon
+                        server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security
+                        layer that is directly manageable, you can instead use server-side encryption with AWS
+                        KMS-managed
+                        keys (SSE-KMS) for your CloudTrail log files. This provides several advantages:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across
+                        all regions.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail
+                        log files.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can assign permissions for the key to the users in your organization according to
+                        your requirements.&lt;/li&gt;
+                        &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now
+                        need to meet two conditions:&amp;nbsp;&lt;/li&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;you must have S3 read permission on the bucket, and&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;you must be granted decrypt permission by the CMK policy.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ul&gt;Because S3 automatically decrypts the log files for requests from users authorized to
+                        use the CMK, SSE-KMS encryption for CloudTrail log files is backward compatible with existing
+                        applications that read CloudTrail log data.&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select CloudTrail from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on a Trail.&lt;/li&gt;
+                        &lt;li&gt;Under the S3 section click on the edit button.&lt;/li&gt;
+                        &lt;li&gt;Click Advanced.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Encrypt Log Files&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Create a new KMS key&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;In &amp;quot;KMS key&amp;quot; type a name for your key.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt; 
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="3.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails
+                            &lt;/blockquote&gt;Check that KMS is enabled if the &amp;quot;KmsKeyId&amp;quot; property is
+                            set.
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.291">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.9" name="Enforce employee lifecycle policies" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Regular reviews of accounts on the system should be conducted to ensure that stale accounts
+                        cannot be abused either by those former employees using them or compromised by attackers.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;At least every 90 days complete the following:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                        &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;
+                        &lt;li&gt;Click on Users.&lt;/li&gt;
+                        &lt;li&gt;For any user that should no longer exist:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;select the user,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;User Actions&amp;quot;,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Ensure all users are valid users.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM4" name="Ensure IAM policies that allow full &quot;*:*&quot; administrative privileges are not attached" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.&lt;/p&gt;&lt;p&gt;Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.&lt;/p&gt;&lt;p&gt;IAM policies that have a statement with "Effect": "Allow" with "Action": "*" over "Resource": "*" should be removed.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the navigation pane, click Policies and then search for the policy name found in the audit step.&lt;/li&gt;&lt;li&gt;Select the policy that needs to be deleted.&lt;/li&gt;&lt;li&gt;In the policy action menu, select first Detach&lt;/li&gt;&lt;li&gt;Select all Users, Groups, Roles that have this policy attached&lt;/li&gt;&lt;li&gt;Click Detach Policy&lt;/li&gt;&lt;li&gt;In the policy action menu, select Detach&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges as found in the audit step:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Lists all IAM users, groups, and roles that the specified managed policy is attached to. aws iam list-entities-for-policy --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Users: aws iam detach-user-policy --user-name &amp;lt;iam_user&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Groups: aws iam detach-group-policy --group-name &amp;lt;iam_group&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name &amp;lt;iam_role&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.16" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine what policies are created: From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Run the following to get a list of IAM policies: aws iam list-policies --only-attached --output text&lt;/li&gt;&lt;li&gt;For each policy returned, run the following command to determine if any policies is allowing full administrative privileges on the account: aws iam get-policy-version --policy-arn &amp;lt;policy_arn&amp;gt; --version-id &amp;lt;version&amp;gt;&lt;/li&gt;&lt;li&gt;In output ensure policy should not have any Statement block with "Effect": "Allow" and Action set to "*" and Resource set to "*"&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-Network-1" name="Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL to remediate, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Click Edit inbound rules&lt;/li&gt;&lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click Delete to remove the offending inbound rule&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="5.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to determine if the account is configured as prescribed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Note: A Port value of ALL or a port range such as 0-1024 are inclusive of port 22, 3389, and other remote server administration ports&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.134">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM3" name="Ensure there is only one active access key available for any single IAM user" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/li&gt;&lt;li&gt;In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.&lt;/li&gt;&lt;li&gt;If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.&lt;/li&gt;&lt;li&gt;Repeat steps no. 3 - 7 for each IAM user in your AWS account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/p&gt;&lt;p&gt;2. Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user&lt;/p&gt;&lt;p&gt;Note - the command does not return any output:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam update-access-key --access-key-id &amp;lt;access-key-id&amp;gt; --status Inactive --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.&lt;/p&gt;&lt;p&gt;4. Repeat steps no. 1 - 3 for each IAM user in your AWS account.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.13" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;Under Access Keys section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Repeat steps no. 3 - 5 for each IAM user in your AWS account.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-users command to list all IAM users within your account:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-users --query "Users[*].UserName"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all your IAM user names.&lt;/p&gt;&lt;p&gt;2. Run list-access-keys command using the IAM user name list to return the current status of each access key associated with the selected IAM user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata ("Username", "AccessKeyId", "Status", "CreateDate") for each access key on that user account.&lt;/p&gt;&lt;p&gt;3. Check the Status property value for each key returned to determine each keys current state. If the Status property value for more than one IAM access key is set to Active, the user access configuration does not adhere to this recommendation, refer to the remediation below.&lt;/p&gt;&lt;p&gt;Repeat steps no. 2 and 3 for each IAM user in your AWS account.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.8" name="Export EC2 OS logs to cloudwatch logs" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudwatch logs is an AWS service that allows you to send logs from an EC2 instance to
+                        cloudwatch via an agent installed locally on the machine. The logs are then stored centrally
+                        within cloudwatch logs and metric alerts can be configured so that security incidents can be
+                        reported to the security team. It is recommended to enable cloudwatch log monitoring on all EC2
+                        servers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Follow the directions provided in &amp;quot;http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html&amp;quot;
+                        to install and enable Cloudwatch Logs on a new EC2 instance.
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select Cloudwatch from the services menu.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Logs&amp;quot;.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on your log group.&lt;/li&gt;
+                            &lt;li&gt;Click on your log stream.&lt;/li&gt;
+                            &lt;li&gt;Ensure event data is being captured as per the logs on your machine.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.8-5.9" name="Install an agent for AWS Cloudwatch Logs within AutoScaling Group for tier" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use CloudWatch Logs to monitor, store and access log files from an Amazon EC2 instance (application or system data). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  With CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics). For example, you could set an alarm on the number of errors that occur in your system logs or view graphs of web request latency from your application logs. Log data can be stored and accessed for as long as you need using highly durable, lowcost storage so you don't have to worry about filling up hard drives. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A Cloudwatch agent needs to run within the Guest Operating System of each EC2 instance you wish to ship logs from. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a sample agent configuration file for Amazon Linux and save it as a text file (for example, awslogs.cfg) either on the AMI's filesystem, in a publicly accessible http/https location, or an Amazon S3 location (for example, s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt;):&lt;/li&gt; 
+ &lt;/ul&gt; 
+  [general] 
+  state_file = /var/awslogs/state/agent-state 
+  [/var/log/messages] 
+  file = /var/log/messages 
+  log_group_name = /var/log/messages 
+  log_stream_name = {instance_id} 
+  datetime_format = %b %d %H:%M:%S 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new Web tier Autoscaling Launch Configuration with UserData populated for installing Cloudwatch Logs agent:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create and save locally a file containing the UserData, for example /tmp/UserData.txt:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     #!/bin/bashcurl https://s3.amazonaws.com/awscloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agentsetup.py./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Note: You can install the CloudWatch Logs agent by specifying the us-east-1, uswest-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, or sa-east-1 regions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; -- user-data file:///tmp/UserData.txt 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="EC2 New Instance CWL" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html"/>
+          </references>
+          <standards>
+            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Cloudwatch Logs agent is installed through UserData in the Web tier Autoscaling Launch Configuration:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt;--query "LaunchConfigurations[*].UserData" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Output should be similar with:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    #!/bin/bash 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agent-setup.py ./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:56.421">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
+                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
+                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
+                        account activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
+                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
+                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
+                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
+                        &lt;li&gt;Click Allow.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
+                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
+                            is set to a recent time (ie within the latest day or so).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:54.291">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.1" name="Launch EC2 instances into a VPC" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACLs) and routing. However, the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is recommended to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure. &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Launch Instance".&lt;/li&gt;&lt;li&gt;Complete the wizard until step 3. At this point, ensure a VPC ID is selected for the "Network" option, choose an appropriate "Subnet" and "Auto-assign Public IP" option.&lt;/li&gt;&lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;NB: If you want to migrate an already running instance you will need to convert the image into an AMI and then launch a new instance using the AMI and placing in a VPC, as per the steps above&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Instances" from the left hand menu.&lt;/li&gt;&lt;li&gt;For each instance in the list:&lt;ul&gt;&lt;li&gt;select the instance&lt;/li&gt;&lt;li&gt;in the preview pane confirm the instance has a "VPC ID". If a hyphen "-" is shown then your instance is running in EC2-Classic mode.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM7" name="Manage IAM users centrally via identity federation or AWS Organizations for multi-account environments" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;The remediation procedure will vary based on the individual organization's implementation of identity federation and/or AWS Organizations with the acceptance criteria that no non-service IAM users, and non-root accounts, are present outside the account providing centralized IAM user management.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.21" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For multi-account AWS environments with an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine the master account for identity federation or IAM user management&lt;/li&gt;&lt;li&gt;Login to that account through the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Identity providers&lt;/li&gt;&lt;li&gt;Verify the configuration&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Then..., determine all accounts that should not have local users present. For each account...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For multi-account AWS environments implementing AWS Organizations without an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.2" name="Register a Security contact for your AWS account" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>AWS will occasionally send security advisories and alerts to the account holder. By default this will go to the email address that the account is registered under. However if a security contact is specified these alerts will be sent here instead. Therefore this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Security&amp;quot; section complete the requested contact information.&lt;/li&gt; 
+  &lt;li&gt;Click update when complete.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether a contact has been set for &amp;quot;Security&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM5" name="Remove expired SSL/TLS certificates stored in AWS IAM" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To delete Expired Certificate run following command by replacing &amp;lt;CERTIFICATE_NAME&amp;gt; with the name of the certificate to delete:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam delete-server-certificate --server-certificate-name &amp;lt;CERTIFICATE_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;When the preceding command is successful, it does not return any output.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.19" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.19" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Getting the certificates expiration information via AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run list-server-certificates command to list all the IAM-stored server certificates:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-server-certificates&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc):&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ "ServerCertificateMetadataList": [ { "ServerCertificateId": "EHDGFRW7EJFYTE88D", "ServerCertificateName": "MyServerCertificate", "Expiration": "2018-07-10T23:59:59Z", "Path": "/", "Arn": "arn:aws:iam::012345678910:server-certificate/MySSLCertificate", "UploadDate": "2018-06-10T11:56:08Z" } ] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Verify the ServerCertificateName and Expiration parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ { "ServerCertificateMetadataList": [] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This means that there are no expired certificates, It DOES NOT mean that no certificates exist.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:55.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:40:57.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-AWS" issueId="" issueLink="" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails are not properly protected, an attacker could gain access to the system,
+                                modify the status of the resources or exfiltrate sensitive data without being noticed.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AWS RESOURCE LOGGING" name="AWS Resource Logging" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" issueId="" issueLink="" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" issueId="" issueLink="" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-ACCESS-ROOT-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" issueId="" issueLink="" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-1.21">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                    <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="CLOUDWATCH METRIC ALERTS" name="Cloudwatch Metric Alerts" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK-AWS" issueId="" issueLink="" name="Sensitive data is compromised through undetected network access" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain undetected access to the network systems and the changes of the attackers
+                                could not be audited or detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.12">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" issueId="" issueLink="" name="Attackers gain undetected access to the security system configurations" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.10">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED_ACCESS_SYSTEMS_AWS" issueId="" issueLink="" name="Attackers access to the systems without being detected" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain access to the systems and they are not detected and the changes of the
+                                attackers could not be detected and audited.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                    <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.5">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="cloudwatch-misconfig">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="VIRTUAL PRIVATE CLOUD (VPC) NETWORK" name="Virtual Private Cloud (VPC) Network" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized network access" state="Expose" source="TEMPLATE" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                    <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="e6e38fd0-9bf2-4e2c-896f-d21a209922c5" diagramComponentId="14271e11-54ad-4f68-ac7a-08167e10e47b" ref="56f16625-662b-42ea-814c-28d79181452b" name="AWS CloudTrail" desc="" library="Hydras-AWS-Foundation" parentComponentRef="7593ee1f-6a32-4907-a5f7-b7ef2c02801c" componentDefinitionRef="cloudtrail" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.014">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="16" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
+  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
+  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
+  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
+  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
+  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
+  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
+                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
+                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
+                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
+                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
+                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
+                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
+                            ALLOW.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL4" name="Configure IAM Access Analyzer to generate IAM policies based on access activity found" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;To generate a policy in the AWS Management Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM Console, and in the navigation pane choose Roles.&lt;/li&gt;&lt;li&gt;Choose a role to analyze.&lt;/li&gt;&lt;li&gt;Under Generate policy based on CloudTrail events, choose Generate policy.&lt;/li&gt;&lt;li&gt;In the Generate policy page, you select the time window for which IAM Access Analyzer will review the CloudTrail logs to create the policy.&lt;/li&gt;&lt;li&gt;If you are using this feature for the first time: for Select trail, you select the trail you want IAM Access Analyzer to review, select Create and use a new service role, then choose Generate policy. If you have existing service roles, you select Use an existing service role, select a role from the available options, and choose Generate policy.&lt;/li&gt;&lt;li&gt;After the policy is ready, you see a notification on the role page. To review the permissions, choose View generated policy.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;(Optional) To customize the policy&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;For some services, on the Generated policy page, you can review a summary of the services and associated actions in the generated policy.&lt;/li&gt;&lt;li&gt;You can also look at all services used and select the permissions that your application requires.&lt;/li&gt;&lt;li&gt;Next, you review the policy and specify resource-level permissions by replacing placeholders with the resource ARN your application uses. Resource placeholders make it easier for you to specify fine-grained permissions that restrict access to specific resources. This helps you follow security best practices and enables you to specify the exact resources to which you want to grant access, thereby restricting access to just a sub-set of the resources.&lt;/li&gt;&lt;li&gt;On the Customize generated policy page, after you are done customizing the policy, choose Next to review the policy.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;To create and attach the policy&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;On the Review and create as a customer managed policy page, update the policy name according to your company's best practices, and review the permission summary. Optionally, you can add a description to define the intent of policy.&lt;/li&gt;&lt;li&gt;Choose Create and attach, to attach the policy to the application role.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Using IAM Access Analyzer" url="https://aws.amazon.com/blogs/security/iam-access-analyzer-makes-it-easier-to-implement-least-privilege-permissions-by-generating-iam-policies-based-on-access-activity/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;To generate and view policies programmatically&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;You can use the following IAM Access Analyzer APIs to request and retrieve policies:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;start-policy-generation: Generates policy for an IAM user or role. Call this API first to start policy generation. Specify the time period for which IAM Access Analyzer should review your CloudTrail logs.&lt;/li&gt;&lt;li&gt;get-generated-policy: Call this API to retrieve and view the generated policy.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For more information, see Generate policies based on access activity in the AWS IAM User Guide.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
+            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
+            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
+          </references>
+          <standards>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
+                            then your bucket has no versioning enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL1" name="Control access to Amazon CloudTrail resources" issueId="" issueLink="" platform="" cost="0" risk="16" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Control access to Amazon CloudTrail resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. CloudTrail supports specific actions and resources. There are no CloudTrail service-specific condition keys that can be used in the Condition element of policy statements.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following shows an example of a permissions policy.&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:GetEventSelectors" ], "Resource": [ "arn:aws:cloudtrail:us-east-2:123456789012:trail/My-First-Trail" ] } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Limit access to the AWSCloudTrail_FullAccess policy&lt;/p&gt; 
+&lt;p&gt;Users with the AWSCloudTrail_FullAccess policy have the ability to disable or reconfigure the most sensitive and important auditing functions in their AWS accounts. This policy is not intended to be shared or applied broadly to users and roles in your AWS account. Limit application of this policy to as few individuals as possible, those you expect to act as AWS account administrators.&lt;/p&gt; 
+&lt;p&gt;For further information please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CloudTrail Identity-Based Policy Examples" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/security_iam_id-based-policy-examples.html"/>
+            <reference name="Identity and Access Management for AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/security-iam.html"/>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+          </references>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
+                        creates a digest for each log file it writes to S3. These digests can then be used to determine
+                        if a log has been modified since being written
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.3.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails&amp;nbsp;
+                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL3" name="Enable Logging Insights Events for CloudTrail" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Logging Insights Events for CloudTrail&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; AWS CloudTrail Insights helps AWS users identify and respond to unusual activity associated with write API calls by continuously analyzing CloudTrail management events.&lt;br&gt; CloudTrail Insights continuously monitors CloudTrail write management events, and uses mathematical models to determine the normal levels of API and service event activity for an account. CloudTrail Insights identifies behavior that is outside normal patterns, generates Insights events, and delivers those events to a /CloudTrail-Insight folder in the chosen destination S3 bucket for your trail. You can also access and view Insights events in the AWS Management Console for CloudTrail. For more information about how to access and view Insights events in the console and by using the AWS CLI, see Viewing CloudTrail Insights Events in this guide.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Logging Insights events with the AWS Management Console&lt;br&gt; Enable CloudTrail Insights events on an existing trail. By default, Insights events are not enabled.&lt;/p&gt; 
+&lt;p&gt;In the left navigation pane of the CloudTrail console, open the Trails page, and choose a trail name.&lt;/p&gt; 
+&lt;p&gt;In Insights events choose Edit.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Additional charges apply for logging Insights events. For CloudTrail pricing, see AWS CloudTrail Pricing.&lt;/p&gt; 
+&lt;p&gt;In Event type, select Insights events. You must be logging Write management events to log Insights events.&lt;/p&gt; 
+&lt;p&gt;Choose Update trail to save your changes.&lt;/p&gt; 
+&lt;p&gt;It can take up to 36 hours for CloudTrail to deliver the first Insights events, if unusual activity is detected.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Logging Insights Events for Trails" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To view whether your trail is logging Insights events, run the get-insight-selectors command.&lt;/p&gt;
+
+	&lt;p&gt;aws cloudtrail get-insight-selectors -trail-name TrailName&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
+                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
+                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
+                        account activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
+                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
+                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
+                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
+                        &lt;li&gt;Click Allow.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
+                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
+                            is set to a recent time (ie within the latest day or so).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="16" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br /&gt; 
+&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br /&gt; 
+&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
+&lt;br /&gt;Remediation 
+&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.1.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
+                            has no MFA delete enabled.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Partly-Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL1" mitigation="34"/>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL1" mitigation="34"/>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="DATA-DELETED-EASY-AWS" issueId="" issueLink="" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                    <countermeasure ref="aws-tier-3.11" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                <countermeasure ref="aws-tier-3.11" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" issueId="" issueLink="" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL3" mitigation="25"/>
+                    <countermeasure ref="AWS-CLOUDTRAIL4" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL3" mitigation="25"/>
+                <countermeasure ref="AWS-CLOUDTRAIL4" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized network access" state="Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b6ab1b82-3d58-48c8-95e7-1a4c3bc42fe7" diagramComponentId="87dc066a-3b4d-439c-a002-dd424abf87ff" ref="8f81cb4f-d85b-4cee-96fb-8a273d8636bd" name="AWS EC2 (Elastic Compute Cloud)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="c7533c7a-9081-435d-9260-c5602f5e07b7" componentDefinitionRef="ec2" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
+          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.147">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.145">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.147">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
+                        To avoid this, access to the network must be as restricted as possible, so that only the
+                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
+  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 allocate-address --domain vpc 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
+            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
+          </references>
+          <standards>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon Unified CLI: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    A list of approved AMIs must be maintained by the organization. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
+  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface:: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each NAT gateway is created in a specific Availability Zone and implemented with 
+  redundancy in that zone. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   and/or 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
+            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
+  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
+  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
+  are engineered to be isolated from failures in other Availability Zones. By launching 
+  instances in separate Availability Zones, you can protect your applications from the failure 
+  of a single location. AWS assigns a unique ID to each subnet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
+  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
+  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
+  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
+  Some AWS regions have more than 2 availability zones and it is recommended to use more 
+  than 2 where possible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The port for these inbound rules would depend on the Database engine used and the 
+  configured port. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The default values are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
+  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
+  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When we create a default VPC, AWS does the following to set it up: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
+  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
+  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  Label this Default VPC "Do Not Use". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
+  set a label to remind others not to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
+            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
+            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
+            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
+          </references>
+          <standards>
+            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Copy snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
+            <reference name="Create snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
+            <reference name="Create volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
+            <reference name="Delete volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
+            <reference name="Describe volumes" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
+            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" name="Ensure that the EC2 instances are managed by the systems manager" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances. Additional configuration is needed in Systems Manager for patch deployment to managed EC2 instances.&lt;/p&gt;&lt;p&gt;If you use EC2 instances managed by Systems Manager to collect inventory for your cardholder data environment (CDE), make sure that the instances are managed by Systems Manager. Using Systems Manager can help to maintain an inventory of system components that are in scope for PCI DSS.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For systems that are in scope for PCI DSS, before you install vendor patches in a production environment, you should test and validate them. After you deploy patches, validate security settings and controls to ensure that deployed patches have not affected the security of the CDE. If you use EC2 instances managed by Systems Manager to patch managed instances in your CDE, ensure that the instances are managed by Systems Manager. Systems Manager deploys system patches, which helps to protect system components and software from known vulnerabilities.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;You can use the Systems Manager quick setup to set up Systems Manager to manage your EC2 instances.&lt;/p&gt;&lt;p&gt;To determine whether your instances can support Systems Manager associations, see Systems Manager prerequisites in the &lt;i&gt;AWS Systems Manager User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To ensure EC2 instances are managed by Systems Manager&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Quick setup&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;On the configuration screen, keep the default options.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Set up Systems Manager&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
+                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
+                        every 90 days (or immediately if security patches become available) to avoid undue exposure
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;For linux instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
+                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
+            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
+            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
+                        (ingress/egress) on the default security group in order to force the use of least privilege via
+                        custom created security groups.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
+                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
+                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
+                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the default security group.&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
+                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Default Value&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The prescribed value is the default value. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
+            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
+            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
+          </references>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-images --owners self --filters 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    ImageId:ImageId, Public:Public}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="49" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.874">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references>
+              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0 and ::/0" issueId="" issueLink="" platform="" cost="1" risk="31" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        ALL TCP or ALL ports to avoid undue server exposure.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be edited or removed.&lt;/li&gt;
+                        &lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0 or ::/0, or, B) Click Delete to remove the offending inbound rule.&lt;/li&gt;
+                        &lt;li&gt;Click Save rules.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="5.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="5.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="31" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt; 
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 22</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="31" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="4.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 3389</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-1" name="VPC default security group should prohibit inbound and outbound traffic" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a service that is in scope for PCI DSS is associated with the default security group, the default rules for the security group will allow all outbound traffic. The rules also allow all inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.&lt;/p&gt;&lt;p&gt;You should change the default security group rules setting to restrict inbound and outbound traffic. Using the default might violate the requirement to allow only necessary traffic to and from the CDE.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To create new security groups and assign them to your resources&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;. View the default security groups details to see the resources that are assigned to them.&lt;/li&gt;&lt;li&gt;Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;After you assign the new security groups to the resources, remove the inbound and outbound rules from the default security groups. This ensures that the default security groups are not used.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To remove the rules from the default security group&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select a default security group, and choose the &lt;strong&gt;Inbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit inbound rules&lt;/strong&gt;. Then delete all of the inbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;li&gt;Select a default security group and choose the &lt;strong&gt;Outbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit outbound rules&lt;/strong&gt;. Then delete all of the outbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ssrf-threat" issueId="" issueLink="" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="AWS-CF-DOS" issueId="" issueLink="" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="OWASP A10:2017" issueId="" issueLink="" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized access to data on EC2 instances" state="Partly-Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="VOLUMES-NOT-ENCRYPTED">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONNECTION" issueId="" issueLink="" name="Attackers gain unauthorized connection to the resources" state="Partly-Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.10" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.11" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.12" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.16" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.24" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.25" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.31" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="5"/>
+                    <countermeasure ref="aws-tier-6.9" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-02">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-03">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="5"/>
+                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="5"/>
+                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.10" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.11" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.12" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.14-6.15" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.16" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.20-6.23" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.24" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.25" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.31" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="5"/>
+                <countermeasure ref="aws-tier-6.9" mitigation="5"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="65102a67-86b7-4776-973f-3de56f980851" diagramComponentId="e0bd9fb5-f1f3-4d39-82ef-d01305edd3d4" ref="f4661e7d-e24f-45d6-9704-3ba6e1a8aec4" name="AWS RDS (Relational Database Service)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="c7533c7a-9081-435d-9260-c5602f5e07b7" componentDefinitionRef="rds" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="database-publically-accesible" name="Database is publically accesible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Everyone can access the RDS database and obtain the data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-notification-incident" name="No notification when an incident occurs" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no notifications when a security incident occurs. Therefore, we do not know when an
+                        attacker gains access to our systems and/or security systems
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-access-control-onrds" name="Not access control on RDS databases" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no access control mechanisms on the RDS database resources and any user can gain access
+                        to them and exfiltrate the data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NOT_BACKUP_POLICIES" name="Not backup retention policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no data backup retention policies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.236">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-RDS-02" name="Assign to IAM roles the permissions for RDS instances" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The following AWS managed policies, which you can attach to users in your account, are
+                        specific to Amazon RDS:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;AmazonRDSReadOnlyAccess:&lt;/b&gt; Grants read-only access to all Amazon RDS
+                        resources for the root AWS account.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;&lt;b&gt;AmazonRDSFullAccess:&lt;/b&gt; Grants full access to all Amazon RDS resources
+                        for the root AWS account.&lt;/li&gt;
+                        &lt;/ul&gt;You can also create custom IAM policies that allow users to access the required
+                        Amazon RDS API actions and resources. You can attach these custom policies to the IAM users or
+                        groups that require those permissions.
+                        &lt;br /&gt;
+                        &lt;br /&gt;The permissions above shall be assigned to roles or groups:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The roles or groups only do calls to the API to get information, the
+                        AmazonRDSReadOnlyAccess permission shall be assigned.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The roles or groups who are responsible of managing the RDS instances shall be
+                        assigned the AmazonRDSFullAccess permission.&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Review the IAM roles and groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all roles or groups have got the AmazonRDSReadOnlyAccess permission.&lt;/li&gt;
+                            &lt;li&gt;Check that only the appropriate personnel have got AmazonRDSFullAccess permissions
+                            to manage the RDS instances.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.34" name="Configure RDS database to leverage the Data Tier Security Group" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+  Customers can deploy RDS databases within a VPC through the configuration of: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
+  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
+  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
+  &lt;li&gt;Network access to the managed Data-Tier must be tightly controlled using Security Groups for RDS and non local accessibility of the DB instance.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each non-compliant DB instance, and configure it to use the Data Tier Security Group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --vpc-security-group-ids &amp;lt;data_tier_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are configured to use the Data Tier
+                            Security Group:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{VpcSecurityGroups:VpcSecurityGroups,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.30" name="Do not allow the RDS database to be publically accessible" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt;Customers can deploy RDS databases within a VPC through the configuration of: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
+  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
+  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each publicly accessible DB instance, and make it private:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --no-publicly-accessible 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.3.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="6.30" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are publicly available:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{PubliclyAccessible:PubliclyAccessible,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.6" name="Enable Auto Minor Version Upgrade on RDS" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair.&lt;/p&gt; 
+&lt;p&gt;There are 6 database engines available for customers to run their database workloads on:&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+ &lt;li&gt;MySQL&lt;/li&gt; 
+ &lt;li&gt;MariaDB&lt;/li&gt; 
+ &lt;li&gt;Oracle&lt;/li&gt; 
+ &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+ &lt;li&gt;PostgreSQL&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;If the database engine used by your application supports it, ensure that the RDS Instances have Auto Minor Version Upgrade Enabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt; 
+&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Modify each DB instance with auto-minor-version-upgrade set to False, and enable auto-minor-version-upgrade:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --auto-minor-version-upgrade&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="2.3.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances have Auto Minor Version Upgrade enabled:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{AutoMinorVersionUpgrade:AutoMinorVersionUpgrade,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.4" name="Enable encryption at rest for Databases running on RDS" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon RDS instances and snapshots can be encrypted at rest by enabling the encryption option on the Amazon RDS DB instance. Data that is encrypted at rest includes the underlying storage for a DB instance, its automated backups, read replicas, and snapshots. Encryption at rest should be enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Perform a snapshot of the DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds create-db-snapshot --db-snapshot-identifier db_snapshot --db-instance-identifier your_db_instance 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Confirm created snapshot is available (once snapshot process has completed):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-snapshots --query 'DBSnapshots[*].{DBSnapshotIdentifier:DBSnapshotIdentifier, DBInstanceIdentifier:DBInstanceIdentifier, Snapshotstatus:Status}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all KMS Customer Managed Keys:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws kms list-aliases 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Copy to source RDS snapshot (from previous step) to a destination snapshot which will be encrypted:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt;
+   aws rds copy-db-snapshot --source-db-snapshot-identifier db_snapshot&amp;nbsp; --target-db-snapshot-identifier encrypted_db_snapshot --kms-key-id data_tier_kms_key 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Restore a snapshot to the target DB instance(from previous step) with the same values as original db instance with additional encrypted storage values:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds restore-db-instance-from-db-snapshot --db-instance-identifier your_db_instance --db-snapshot-identifier encrypted_db_snapshot 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: copy db snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/rds/copy-db-snapshot.html"/>
+            <reference name="Amazon docs: copy snapshot" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html"/>
+            <reference name="Amazon docs: create db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html"/>
+            <reference name="Amazon docs: create db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-snapshot.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-snapshots.html"/>
+            <reference name="Amazon docs: encryption" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all current RDS instances and review the encryption status of the DB
+                            instance:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws rds describe-db-instances --query 'DBInstances[*].{DBName:DBName,
+                            EncryptionEnabled:StorageEncrypted, CMK:KmsKeyId}'
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.4" name="Enable event subscriptions for DataBase security on RDS" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Relational Database Services offers customers a managed database engine solution
+                        for hosting customer created databases which can allow for a reduction in operational burden on
+                        customers.&lt;/p&gt;
+                        &lt;p&gt;RDS event subscriptions provide notification of selected event changes at a DB security
+                        group level.&lt;/p&gt;
+                        &lt;p&gt;Event subscriptions are designed to provide incident notification of events which may
+                        affect the network availability of the RDS instance.&lt;/p&gt;
+                        &lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt;
+                        &lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a new event subscription for DB Security Group events:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;aws rds create-event-subscription --subscription-name rds_event_subscription
+                        --sns-topic-arn
+                        sns_topic_arn
+                        --source-type db-security-group --event-categories rds_events
+                        --source-ids events_source_ids --enabled&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified CLI:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-security-group&amp;quot;
+                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-event-subscriptions --query
+                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
+                            EventCategoriesList:EventCategoriesList}'
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
+                            reported on
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
+                            instances)
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.3" name="Enable Event subscriptions for Instance level events on RDS" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  AWS Relational Database Services offers customers a managed database engine solution for hosting customer created databases which can allow for a reduction in operational burden on customers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  RDS event subscriptions provide notification of selected event changes at DataBase engine level such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Deletion&lt;/li&gt; 
+  &lt;li&gt;Failure&lt;/li&gt; 
+  &lt;li&gt;Failover&lt;/li&gt; 
+  &lt;li&gt;Low Storage&lt;/li&gt; 
+  &lt;li&gt;Maintenance&lt;/li&gt; 
+ &lt;/ul&gt; 
+  Event subscriptions are designed to provide incident notification of events which may affect the availability of a RDS database instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new event subscription for DB instance level events:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds create-event-subscription --subscription-name &amp;lt;rds_event_subscription&amp;gt; --sns-topic-arn sns_topic_arn --source-type &amp;lt;db-instance&amp;gt; --event-categories &amp;lt;rds_events&amp;gt; --source-ids &amp;lt;events_source_ids&amp;gt; --enabled 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create event subscription" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-event-subscription.html"/>
+            <reference name="Amazon docs: describe event subcriptions" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-event-subscriptions.html"/>
+            <reference name="Amazon docs: user event messages" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages"/>
+          </references>
+          <standards>
+            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified CLI:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-instance&amp;quot;
+                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-event-subscriptions --query
+                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
+                            EventCategoriesList:EventCategoriesList}'
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
+                            reported on
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
+                            instances)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.5" name="Enable Multi-AZ on RDS" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Provides AWS managed high availability of the Database Tier across 2 availability zones within a region through asynchronous replication at the data layer. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each no-multi-az DB instance, and make it Multi-AZ enabled:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --multi-az 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are Multi-AZ enabled:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{MultiAZ:MultiAZ,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.8" name="Set Backup retention policy on RDS" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Provides a managed backup function of the RDS Database, it is possible to define the backup window and retention period of the backup. Each customer should have a retention policy set for the type of data being stored. It is recommended to set this to at least 7. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Possible values are from 0 to 35 days. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each DB instance with a Backup Retention Period of 0, and set a desired Backup Retention Period in days (recommended value = 7):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --backup-retention-period &amp;lt;backup_retention_period&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances have a Backup Retention Period set (0 =
+                            there is no backup retention in place, 7 = there are 7 daily backups retained):&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{BackupRetentionPeriod:BackupRetentionPeriod,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-RDS-01" name="Use SSL to Encrypt the connection to a DB Instance" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Use SSL from your application to encrypt a connection to a DB instance running MySQL, MariaDB,
+                        Amazon Aurora, SQL Server, Oracle, or PostgreSQL. Each DB engine has its own process for
+                        implementing SSL. To learn how to implement SSL for your particular DB instance, please see link
+                        provided in &amp;quot;References&amp;quot; section.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the SSL protocol is used to encrypt the data in transit.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:42.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ACCESS-TO-DATA-AWS" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
+                <countermeasure ref="aws-tier-1.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" issueId="" issueLink="" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="NOT_BACKUP_POLICIES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.6" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.6" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" issueId="" issueLink="" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="no-notification-incident">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-4.3" mitigation="50"/>
+                    <countermeasure ref="aws-tier-4.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-4.3" mitigation="50"/>
+                <countermeasure ref="aws-tier-4.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="database-publically-accesible">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.30" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="no-access-control-onrds">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.34" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.5" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.30" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.34" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="191e7093-f70a-4598-9ec4-0cd8e6098003" diagramComponentId="94751604-fcf7-463a-b603-b6fad4c5d0f0" ref="c7533c7a-9081-435d-9260-c5602f5e07b7" name="AWS VPC (Virtual Private Cloud)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="7593ee1f-6a32-4907-a5f7-b7ef2c02801c" componentDefinitionRef="vpc" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
+            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before you begin, make sure of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
+  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
+  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
+  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
+  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
+  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test end-to-end connectivity 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon EC2 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On the dashboard, choose Launch Instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Choose an instance type, and then choose Next: Configure Instance Details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ping 10.0.0.4 
+&lt;/div&gt; 
+&lt;div&gt;
+  Pinging 10.0.0.4 with 32 bytes of data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ping statistics for 10.0.0.4: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Approximate round trip times in milliseconds: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use SSH or RDP to connect to your instances in the VPC. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;div&gt;
+  Control access to VPC resources with IAM identities and policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Control access to VPC resources by using: 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Identities: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authentication is how you sign in to AWS using your identity credentials. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Identity-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Resource-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Access control lists (ACLs): 
+&lt;/div&gt; 
+&lt;div&gt;
+  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="29" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Creating CloudWatch alarms to monitor a NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm for outbound traffic through the NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm to monitor port allocation errors 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for VPC endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route traffic to an Amazon VPC interface endpoint 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console and open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the right pane, choose the endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the Route 53 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Hosted Zones. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create Record Set. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specify the following values: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose A - IPv4 address. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Yes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias Target 
+&lt;/div&gt; 
+&lt;div&gt;
+  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Different accounts - Enter the value that you got in step 1 of this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Routing Policy 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Evaluate Target Health 
+&lt;/div&gt; 
+&lt;div&gt;
+  Accept the default value of No. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="29" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="29" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable VPC Traffic Mirroring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content inspection 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Threat monitoring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Troubleshooting 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your traffic mirror resources using any of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.178">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="31" state="Recommended" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network ACLs for VPC as an additional layer of security 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following are the parts of a network ACL rule: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Source. [Inbound rules only] The source of the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow/Deny. Whether to allow or deny the specified traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the navigation pane, choose Network ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select a Network ACL to see details. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="31" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;div&gt;
+  Use VPC endpoint policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your endpoint policy can be like any IAM policy; however, take note of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="31" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                <countermeasure ref="AWS-VPC1" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ACCESS-TO-DATA-AWS" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC7" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" issueId="" issueLink="" name="Exploitation of insufficient logging and monitoring" state="Partly-Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" issueId="" issueLink="" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" issueId="" issueLink="" name="Attackers gain unauthorized network access" state="Partly-Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3258a993-8806-462a-bad4-acf3c84e7503" diagramComponentId="da21e51b-ff2e-4772-80f5-600d7feeaffa" ref="d74ae0ed-f971-47f6-8964-41c7ccc4cc09" name="AWS WAF (Web Application Firewall)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="7593ee1f-6a32-4907-a5f7-b7ef2c02801c" componentDefinitionRef="CD-WAF" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AWS-WAF1" name="Control access to AWS WAF resources" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Control access to AWS WAF resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles). &lt;br&gt; Policies that are attached to an IAM identity are known as identity-based policies, and policies that are attached to a resource are known as resource-based policies. AWS WAF supports only identity-based policies.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Using identity-based policies (IAM policies) for AWS WAF&lt;/p&gt; 
+&lt;p&gt;The following shows an example of a permissions policy:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2019-07-29", "Statement": [ { "Sid": "CreateFunctionPermissions", "Effect": "Allow", "Action": [ "wafv2:ListWebACLs", "wafv2:GetWebACL", "cloudwatch:ListMetrics", "wafv2:GetSampledRequests" ], "Resource": "*" }, { "Sid": "PermissionToPassAnyRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::account-id:role/*" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Overview of managing access permissions to your AWS WAF resources" url="https://docs.aws.amazon.com/waf/latest/developerguide/access-control-overview.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.665">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:38.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" issueId="" issueLink="" name="Attackers gain unauthorized access to the control of the environment" state="Mitigate" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="2a5ab363-99ce-406b-b85e-6144ead85682" diagramComponentId="204bef18-6a45-4ca0-86c7-4a9f305fcbbf" ref="75352eeb-eed3-4da3-bc40-f7bc879b1bfe" name="Bluetooth port" desc="" library="IR-Hardware-Components" parentComponentRef="57f3c399-34a3-4da3-ad31-ffa68abf92da" componentDefinitionRef="CD-BLUETOOTH-PORT" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.862">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.861">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.862">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.764">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1ebe1483-bbe1-4970-99c4-adb8cb4231b8" diagramComponentId="c77ebd76-c6c5-4efc-8ce7-12940b8a20f9" ref="cf25d1a3-167a-4a8a-89f3-09152b0291cc" name="Bluetooth port" desc="" library="IR-Hardware-Components" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="CD-BLUETOOTH-PORT" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.179">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.179">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ed142721-4982-4986-8c16-02d9056f87f8" diagramComponentId="52585986-e10a-4a59-bf51-910f76dbd6e5" ref="6195b120-d6d5-407c-9dbd-136f9f4833fb" name="Embedded Storage" desc="" library="IR-Dataflows" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="embedded-storage" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:42.087">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.542">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.541">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.408">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.406">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.407">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.408">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:18:24.407">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should be used in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.992">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
+          <threats>
+            <threat ref="CAPEC-66" issueId="" issueLink="" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Dataflows" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="9833a18f-2988-4a44-bc2b-801adbae209d" diagramComponentId="356802eb-e5d7-489e-b325-8ca1b0acc898" ref="237d4260-8555-4f51-bd66-a126e10fae2c" name="External Video interface" desc="" library="CS-Default" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="empty-component" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="b8e291e4-241e-4f98-8580-adccfc382cb2" diagramComponentId="1791c3b8-a51c-45c2-86af-1c479f33bdc8" ref="eea9d511-2e18-4019-a530-8dbb142a431f" name="Generic hardware" desc="" library="IR-Hardware-Components" parentComponentRef="" componentDefinitionRef="CD-GENERIC-HARDWARE" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.487">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.487">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.486">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.487">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.487">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.327">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:34.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="048f13ac-4bd7-4652-9bab-7042048fedff" diagramComponentId="0f706eef-1b73-4731-8e07-530a7f9f5730" ref="7bd64aec-f5c0-4c05-96bb-d723e1bcbcea" name="iOS App Store" desc="" library="iot-security-compliance-framework" parentComponentRef="3fd51d0d-e64d-427a-8f35-b2e1a64584f8" componentDefinitionRef="ios-app-store" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="trusted-partner"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.685">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="IOT2.4.14.1" name="All the production test and calibration software is erased, removed or secured before the product is dispatched from the factory" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="THREAT" priority="">
+          <desc>&lt;p&gt;All the production test and calibration software used during manufacture is erased, removed or secured before the product is dispatched from the factory.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The product should have all of the production test and calibration software used during manufacture erased, removed or secured before the product is dispatched from the factory. This is to prevent alteration of the product post manufacture when using authorized production software, for example, hacking of the RF characteristics for greater RF &lt;span class="caps"&gt;ERP&lt;/span&gt;. Where such functionality is required in a service center, it should be erased or removed upon completion of any servicing activities.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Erase, remove or secure all the production test and calibration software used during manufacture, before the product is dispatched from the factory.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE" issueId="" issueLink="" name="Attackers try to take advantage of a wide attack surface" state="Not Applicable" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1f560e24-7d90-4305-9945-f2f57f78f3f2" diagramComponentId="6543d615-2b3e-432b-a72d-7e3b76941547" ref="57f3c399-34a3-4da3-ad31-ffa68abf92da" name="iOS Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="ios-device-client" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
+                        common that they deserve a special kingdom of their own. As with "API Abuse", there
+                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
+                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
+                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
+                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
+                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
+                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
+                        without restricting how much is copied. Other variants exist, but the existence of a classic
+                        overflow strongly suggests that the programmer is not considering even the most basic of
+                        security protections.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.901">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
+              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software provides an Applications Programming Interface (API) or similar interface for
+                        interaction with external actors, but the interface includes a dangerous method or function that
+                        is not properly restricted.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
+                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
+                        leverage them to obtain information about the app.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
+                        attackers can leverage them to obtain information about the app.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.904">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application can be deployed with active debugging code that can create unintended entry
+                        points.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
+                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For Android:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For iOS:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the set of protocol handlers are deactivated.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.11" name="Avoid usage of third-party keyboards when writing sensitive data" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Verify that the app prevents usage of custom third-party keyboards whenever sensitive data is entered.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:36.724">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the exceptions are well-designed and are catched and handled well.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-3 - Checking for Weaknesses in Third Party Libraries" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0042/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CODE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; or &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.520">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-2 - Testing Enforced Updating" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0036/"/>
+          </references>
+          <standards>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-CODE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.519">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
+&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
+&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing Local Storage for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0001/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing the Device-Access-Security Policy" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0012/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-STORAGE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app verifies the mobile device complies with the minimum
+                            device-access-security policy.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.520">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the application denies access to the session when the exceptions appear.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Search in the code the following instruction:
+                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
+                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;For iOS:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
+                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
+                            setJavaScriptEnabled:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [conf setPreferences:pref]; _webView = [[WKWebView
+                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
+                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [_webView loadRequest:request];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [self.view addSubview:_webView]; }
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Embedded Services" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0004/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Notifications" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0005/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether the Keyboard Cache Is Disabled for Text Input Fields" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0006/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Backups for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0009/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Logs for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0003/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Memory for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0011/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+            <standard ref="MASVS-STORAGE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the clipboard is disabled when sensitive data is used.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.6-IOS-UIWEBVIEW" name="Disable the UIWebView for iOS platform" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>UIWebView is deprecated and should not be used. Make sure that either WKWebView or SafariViewController are used to embed web content:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;WKWebView is the appropriate choice for extending app functionality, controlling displayed content (i.e., prevent the user from navigating to arbitrary URLs) and customizing. SafariViewController should be used to provide a generalized web viewing experience. Note that SafariViewController shares cookies and other website data with Safari.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;WKWebView comes with several security advantages over UIWebView:&amp;nbsp;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;The JavaScriptEnabled property can be used to completely disable JavaScript in the WKWebView. This prevents all script injection flaws.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;The JavaScriptCanOpenWindowsAutomatically can be used to prevent JavaScript from opening new windows, such as pop-ups.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;The hasOnlySecureContent property can be used to verify resources loaded by the WebView are retrieved through encrypted connections.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;WKWebView implements out-of-process rendering, so memory corruption bugs won't affect the main app process.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that UIWebView is not used to embed web content.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:36.725">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
+                        Android O and the behavior of MAC addresses have changed in Android N.
+
+                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
+                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
+                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
+                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
+                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
+                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
+                        they request the Build.Serial.
+                    </desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
+                            authenticate).&lt;/li&gt;
+                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;ol&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;exit the current user&lt;/li&gt;
+                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
+                            shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
+                            working properly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Log Class&lt;/li&gt; 
+ &lt;li&gt;Logger Class&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
+&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;NSLog Method&lt;/li&gt; 
+ &lt;li&gt;printf-like function&lt;/li&gt; 
+ &lt;li&gt;NSAssert-like function&lt;/li&gt; 
+ &lt;li&gt;Macro&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.520">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all executable files and libraries belonging to the app are encrypted or
+                            packed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that sensitive data is not stored in plain text.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.520">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.520">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.6" name="Ensure that no sensitive stored data has been exposed via IPC mechanisms" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Inter Process Communication (IPC) allows processes to send each other messages and data. For processes that need to communicate with each other, there are different ways to implement IPC on iOS:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;XPC Services: XPC is a structured, asynchronous library that provides basic interprocess communication. It is managed by launchd. It is the most secure and flexible implementation of IPC on iOS and should be the preferred method. It runs in the most restricted environment possible: sandboxed with no root privilege escalation and minimal file system access and network access. Two different APIs are used with XPC Services:&lt;ul&gt;&lt;li&gt;NSXPCConnection API&lt;/li&gt;&lt;li&gt;XPC Services API&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Mach Ports: All IPC communication ultimately relies on the Mach Kernel API. Mach Ports allow local communication (intra-device communication) only. They can be implemented either natively or via Core Foundation (CFMachPort) and Foundation (NSMachPort) wrappers.&lt;/li&gt;&lt;li&gt;NSFileCoordinator: The class NSFileCoordinator can be used to manage and send data to and from apps via files that are available on the local file system to various processes. NSFileCoordinator methods run synchronously, so your code will be blocked until they stop executing. That's convenient because you don't have to wait for an asynchronous block callback, but it also means that the methods block the running thread.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;No sensitive data should be exposed via IPC mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;For Android:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The first step is to look at AndroidManifest.xml to detect content providers exposed by the app. You can identify content providers by the &amp;lt;provider&amp;gt; element. Complete the following steps:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Determine whether the value of the export tag (android:exported) is "true". Even if it is not, the tag will be set to "true" automatically if an &amp;lt;intent-filter&amp;gt; has been defined for the tag. If the content is meant to be accessed only by the app itself, set android:exported to "false". If not, set the flag to "true" and define proper read/write permissions.&lt;/li&gt;&lt;li&gt;Determine whether the data is being protected by a permission tag (android:permission). Permission tags limit exposure to other apps.&lt;/li&gt;&lt;li&gt;Determine whether the android:protectionLevel attribute has the value signature. This setting indicates that the data is intended to be accessed only by apps from the same enterprise (i.e., signed with the same key). To make the data accessible to other apps, apply a security policy with the &amp;lt;permission&amp;gt; element and set a proper android:protectionLevel. If you use android:permission, other applications must declare corresponding &amp;lt;uses-permission&amp;gt; elements in their manifests to interact with your content provider. You can use the android:grantUriPermissions attribute to grant more specific access to other apps; you can limit access with the &amp;lt;grant-uri-permission&amp;gt; element.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Inspect the source code to understand how the content provider is meant to be used. Search for the following keywords:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;android.content.ContentProvider&lt;/li&gt;&lt;li&gt;android.database.Cursor&lt;/li&gt;&lt;li&gt;android.database.sqlite&lt;/li&gt;&lt;li&gt;.query&lt;/li&gt;&lt;li&gt;.update&lt;/li&gt;&lt;li&gt;.delete&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;To avoid SQL injection attacks within the app, use parameterized query methods, such as query, update, and delete. Be sure to properly sanitize all method arguments; for example, the selection argument could lead to SQL injection if it is made up of concatenated user input.&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If you expose a content provider, determine whether parameterized &lt;a href="https://developer.android.com/reference/android/content/ContentProvider.html#query%28android.net.Uri%2C%20java.lang.String%5B%5D%2C%20java.lang.String%2C%20java.lang.String%5B%5D%2C%20java.lang.String%29"&gt;query methods&lt;/a&gt; (query, update, and delete) are being used to prevent SQL injection. If so, make sure all their arguments are properly sanitized.&lt;/p&gt;&lt;p&gt;We will use the vulnerable password manager app &lt;a href="https://github.com/mwrlabs/drozer/releases/download/2.3.4/sieve.apk"&gt;Sieve&lt;/a&gt; as an example of a vulnerable content provider.&lt;/p&gt;&lt;h4&gt;Inspect the Android Manifest&lt;/h4&gt;&lt;p&gt;Identify all defined &amp;lt;provider&amp;gt; elements:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.DBContentProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".DBContentProvider"&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;lt;path-permission&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:path="/Keys"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:readPermission="com.mwr.example.sieve.READ_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:writePermission="com.mwr.example.sieve.WRITE_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; /&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;/provider&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.FileBackupProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".FileBackupProvider"&lt;/p&gt;&lt;p&gt;/&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;As shown in the AndroidManifest.xml above, the application exports two content providers. Note that one path ("/Keys") is protected by read and write permissions.&lt;/p&gt;&lt;h4&gt;Inspect the source code&lt;/h4&gt;&lt;p&gt;Inspect the query function in the DBContentProvider.java file to determine whether any sensitive information is being leaked:&lt;/p&gt;&lt;p&gt;Example in Java:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;public Cursor query(final Uri uri, final String[] array, final String s, final String[] array2, final String s2) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final int match = this.sUriMatcher.match(uri);&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final SQLiteQueryBuilder sqLiteQueryBuilder = new SQLiteQueryBuilder();&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Passwords");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Key");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, (String)null, (String)null, s2);&lt;/p&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Example in Kotlin:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;fun query(uri: Uri?, array: Array&amp;lt;String?&amp;gt;?, s: String?, array2: Array&amp;lt;String?&amp;gt;?, s2: String?): Cursor {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val match: Int = this.sUriMatcher.match(uri)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val sqLiteQueryBuilder = SQLiteQueryBuilder()&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Passwords"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Key"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, null as String?, null as String?, s2)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Here we see that there are actually two paths, "/Keys" and "/Passwords", and the latter is not being protected in the manifest and is therefore vulnerable.&lt;/p&gt;&lt;p&gt;When accessing a URI, the query statement returns all passwords and the path Passwords/. We will address this in the "Dynamic Analysis" section and show the exact URI that is required.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;h4&gt;Testing Content Providers&lt;/h4&gt;&lt;p&gt;To dynamically analyze an application's content providers, first enumerate the attack surface: pass the app's package name to the Drozer module app.provider.info:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.info -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Package: com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path Permissions:&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path: /Keys&lt;/p&gt;&lt;p&gt;&amp;nbsp;Type: PATTERN_LITERAL&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: com.mwr.example.sieve.READ_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: com.mwr.example.sieve.WRITE_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In this example, two content providers are exported. Both can be accessed without permission, except for the /Keys path in the DBContentProvider. With this information, you can reconstruct part of the content URIs to access the DBContentProvider (the URIs begin with content://).&lt;/p&gt;&lt;p&gt;To identify content provider URIs within the application, use Drozer's scanner.provider.finduris module. This module guesses paths and determines accessible content URIs in several ways:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.finduris -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/Keys&lt;/p&gt;&lt;p&gt;Accessible content URIs:&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Once you have a list of accessible content providers, try to extract data from each provider with the app.provider.query module:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --vertical&lt;/p&gt;&lt;p&gt;_id: 1&lt;/p&gt;&lt;p&gt;service: Email&lt;/p&gt;&lt;p&gt;username: incognitoguy50&lt;/p&gt;&lt;p&gt;password: PSFjqXIMVa5NJFudgDuuLVgJYFD+8w== (Base64 - encoded)&lt;/p&gt;&lt;p&gt;email: incognitoguy50@gmail.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can also use Drozer to insert, update, and delete records from a vulnerable content provider:&lt;/p&gt;&lt;p&gt;Insert record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.insert content://com.vulnerable.im/messages&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string date 1331763850325&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string type 0&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer _id 7&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Update record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.update content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args assisted_gps_enabled&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer value 0&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Delete record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.delete content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args my_setting&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;SQL Injection in Content Providers&lt;/h4&gt;&lt;p&gt;The Android platform promotes SQLite databases for storing user data. Because these databases are based on SQL, they may be vulnerable to SQL injection. You can use the Drozer module app.provider.query to test for SQL injection by manipulating the projection and selection fields that are passed to the content provider:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "' FROM Passwords" (code 1): , while compiling: SELECT ' FROM Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --selection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "')" (code 1): , while compiling: SELECT * FROM Passwords WHERE (')
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If an application is vulnerable to SQL Injection, it will return a verbose error message. SQL Injection on Android may be used to modify or query data from the vulnerable content provider. In the following example, the Drozer module app.provider.query is used to list all the database tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "*&lt;/p&gt;&lt;p&gt;FROM SQLITE_MASTER WHERE type='table';--"&lt;/p&gt;&lt;p&gt;| type &amp;nbsp;| name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | tbl_name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | rootpage | sql &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;|&lt;/p&gt;&lt;p&gt;| table | android_metadata | android_metadata | 3 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 4 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 5 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;SQL Injection may also be used to retrieve data from otherwise protected tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "* FROM Key;--"&lt;/p&gt;&lt;p&gt;| Password | pin |&lt;/p&gt;&lt;p&gt;| thisismypassword | 9876 |&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can automate these steps with the scanner.provider.injection module, which automatically finds vulnerable content providers within an app:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.injection -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Injection in Projection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;p&gt;Injection in Selection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/
+&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;File System Based Content Providers&lt;/h4&gt;&lt;p&gt;Content providers can provide access to the underlying filesystem. This allows apps to share files (the Android sandbox normally prevents this). You can use the Drozer modules app.provider.read and app.provider.download to read and download files, respectively, from exported file-based content providers. These content providers are susceptible to directory traversal, which allows otherwise protected files in the target application's sandbox to be read.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.download content://com.vulnerable.app.FileProvider/../../../../../../../../data/data/com.vulnerable.app/database.db /home/user/database.db
+Written 24488 bytes
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Use the scanner.provider.traversal module to automate the process of finding content providers that are susceptible to directory traversal:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.traversal -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Vulnerable Providers:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note that adb can also be used to query content providers:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;$ adb shell content query --uri content://com.owaspomtg.vulnapp.provider.CredentialProvider/credentials&lt;/p&gt;&lt;p&gt;Row: 0 id=1, username=admin, password=StrongPwd&lt;/p&gt;&lt;p&gt;Row: 1 id=2, username=test, password=test&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;For iOS:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following section summarizes keywords that you should look for to identify IPC implementations within iOS source code.&lt;/p&gt;&lt;h4&gt;XPC Services&lt;/h4&gt;&lt;p&gt;Several classes may be used to implement the NSXPCConnection API:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSXPCConnection&lt;/li&gt;&lt;li&gt;NSXPCInterface&lt;/li&gt;&lt;li&gt;NSXPCListener&lt;/li&gt;&lt;li&gt;NSXPCListenerEndpoint&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;You can set security attributes for the connection. The attributes should be verified.&lt;/p&gt;&lt;p&gt;Check for the following two files in the Xcode project for the XPC Services API (which is C-based):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;xpc.h&lt;/li&gt;&lt;li&gt;connection.h&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;Mach Ports&lt;/h4&gt;&lt;p&gt;Keywords to look for in low-level implementations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;mach_port_t&lt;/li&gt;&lt;li&gt;mach_msg_*&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Keywords to look for in high-level implementations (Core Foundation and Foundation wrappers):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CFMachPort&lt;/li&gt;&lt;li&gt;CFMessagePort&lt;/li&gt;&lt;li&gt;NSMachPort&lt;/li&gt;&lt;li&gt;NSMessagePort&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;NSFileCoordinator&lt;/h4&gt;&lt;p&gt;Keywords to look for:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSFileCoordinator&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Verify IPC mechanisms with static analysis of the iOS source code. No iOS tool is currently available to verify IPC usage.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
+                        including stealthy responses that don't simply terminate the app.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the app implements multiple different responses to tampering, debugging and
+                            emulation, including stealthy responses that don't simply terminate the app.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Data Encryption on the Network" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0019/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Endpoint Identify Verification" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0021/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the Security Provider" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0023/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the TLS Settings" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0020/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-NETWORK-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
+                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
+                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
+                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
+                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
+                        the goal of protecting against memory patches applied during runtime. This includes unwanted
+                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
+                        well as rogue code loaded into process memory.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;div&gt;
+                        Integrity can be verified either by:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
+                        values.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
+                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
+                            responds accordingly.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
+                        the app is running inside an emulator, the app shall terminate the session.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
+                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
+                        is detected, the app shall force termination of the session.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Launch the app systematically with various apps and frameworks installed, such as the
+                            following:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
+                        features can be preventive or reactive. As the name implies, preventive anti-debugging
+                        techniques prevent the debugger from attaching in the first place, while reactive techniques
+                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
+                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
+                        combine multiple methods of prevention and detection which operate on different API layers and
+                        are distributed throughout the app.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
+                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
+                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
+                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
+                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
+                            or other sources);&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
+                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Remove the debugging code, log verbose errors or debugging messages in the production version.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
+                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>- Produce a JavaScript payload.
+                            - Inject it into the file that the app is requesting. The injection could be done either
+                            through a MITM attack or by directly modifying the file in case it is stored on external
+                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
+                            exploitation payload) which is able to install a full agent, injecting a limited agent into
+                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
+                            - Check that only the JavaScript provided with the app is allowed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>As a general rule of thumb, as little explanative information as possible should be provided
+                        along with the compiled code. Some metadata such as debugging information, line numbers and
+                        descriptive function or method names make the binary or bytecode easier to understand for the
+                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
+                        discarded without impacting the functionality of the app.
+
+                        This data shall be removed from the release version or shall be obfuscated in order to be
+                        inaccessible to the reverse engineer.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Symbols are usually stripped during the build process, so you need the compiled byte-code
+                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
+                            nm binary in your Android NDK and export it (or create an alias).
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            export $NM =
+                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            To display debug symbols:
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ $NM -a
+                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
+                            libfoo.so: no symbols&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;To display dynamic symbols:
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            $ $NM -D libfoo.so&amp;nbsp;
+                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
+                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
+                            Adding this flag causes gcc to discard the function names while still preserving the names
+                            of functions declared as JNIEXPORT.&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            Check if the following was added to build.gradle:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
+                            binutils and can be installed via Homebrew on Mac OS X.
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+          </references>
+          <standards>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android applications:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
+                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
+                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
+                            permissions needed by the application.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
+  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This kind of vulnerability occurs in a number of ways: 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Make Sure That Free Security Features Are Activated" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0044/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Memory Corruption Bugs" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0043/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Implicit Intents" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0026/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Local Storage for Input Validation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0002/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Object Persistence" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0034/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for Injection Flaws" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0025/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for URL Loading in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0027/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CODE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
+                            gain access to the system.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app is correctly signed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T19:24:35.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-122-MOBILE" issueId="" issueLink="" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>If the mobile application requests permissions or access to components that are not
+                                strictly needed by the application, then users can lose trust in the security of the
+                                application with an associated impact on the trust placed in the application provider.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                <countermeasure ref="MASVS-8.1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-133" issueId="" issueLink="" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker attempts to invoke all common switches and options in the target
+                                application for the purpose of discovering weaknesses in the target. For example, in
+                                some applications, adding the --debug switch causes debugging information to be
+                                displayed, which can sometimes reveal sensitive processing or configuration information
+                                to an attacker.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This attack differs from other forms of API abuse in that the attacker is blindly
+                                attempting to invoke options in the hope that one of them will work rather than
+                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
+                                with the published options of a targeted application this attack method may still be
+                                fruitful as it might discover unpublicized functionality.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-489">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-656">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MEMORY-LEAKAGE">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="OUTDATED-LIBRARIES">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-188" issueId="" issueLink="" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of an object, resource,
+                                or system by using a variety of analysis techniques to effectively determine how the
+                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
+                                duplicate the function, or a part of the function, of an object in order to duplicate or
+                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
+                                or software, although the methodology and techniques involved in each type of analysis
+                                differ widely. When adversaries are reverse engineering software, methodologies fall
+                                into two broad categories, 'white box' and 'black box.' White box techniques involve
+                                methods which can be applied to a piece of software when an executable or some other
+                                compiled object can be directly subjected to analysis, revealing at least a portion of
+                                its machine instructions that can be observed upon execution.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                'Black Box' methods involve interacting with the software indirectly, in the absence of
+                                the ability to measure, instrument, or analyze an executable object directly. Such
+                                analysis typically involves interacting with the software at the boundaries of where the
+                                software interfaces with a larger execution environment, such as input-output vectors,
+                                libraries, or APIs.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="MASVS-EMULATION-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                <countermeasure ref="MASVS-8.7" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="sec-vuln-dev-process" issueId="" issueLink="" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="7k-CWE-ErrorH" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Errors and error handling represent a class of API. Errors related to error handling
+                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
+                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-388">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                <countermeasure ref="MASVS-7.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="ACCESS-WEBVIEW" issueId="" issueLink="" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker employs forceful browsing to access portions of a website that are
+                                otherwise unreachable through direct URL entry.
+
+                                Usually, a front controller or similar design pattern is employed to protect access to
+                                portions of a web application.
+
+                                Forceful browsing enables an attacker to access information, perform privileged
+                                operations and otherwise reach sections of the web application that have been improperly
+                                protected.
+                            </desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-749">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                    <countermeasure ref="MASVS-6.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-83">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                    <countermeasure ref="MASVS-6.6-IOS-UIWEBVIEW" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                <countermeasure ref="MASVS-6.11" mitigation="20"/>
+                <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                <countermeasure ref="MASVS-6.6-IOS-UIWEBVIEW" mitigation="20"/>
+                <countermeasure ref="MASVS-6.7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-1" issueId="" issueLink="" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                <countermeasure ref="MASVS-4.9" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-120">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a4acbe8d-0231-404c-aace-56de7fe5c070" diagramComponentId="9c4b6dc2-4d4b-481f-bff5-96a6247eda1e" ref="036adfeb-40aa-49e3-9879-19a9303f9ead" name="IoT Application" desc="" library="iot-security-compliance-framework" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="iot-application" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-592" name="Authentication Bypass Issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly perform authentication, allowing it to be bypassed through various methods.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-592: Authentication Bypass Issues" url="https://cwe.mitre.org/data/definitions/592.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.898">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.264">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-209" name="Information Exposure Through an Error Message" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software generates an error message that includes sensitive information about its environment, users, or associated data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;This sensitive information may be valuable on its own (such as a password), or it may be useful for launching other deadlier attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.591">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-209: Information Exposure Through an Error Message" url="https://cwe.mitre.org/data/definitions/209.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.329">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.899">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NO-PASSWORD-CHANGE" name="Lack of password change facility" state="0" impact="100" issueId="" issueLink="">
+          <desc>When the application does not offer a password change facility, a compromise of the current user password will lead to an attacker having persistent access to the account.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.899">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
+          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNPATCHED-PRODUCT" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches and updates are not applied in a timely manner then a product (e.g. Operating System, Software or Mobile App) or a system could be vulnerable to known security issues. These issues could be leveraged by an attacker to gain access to the system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.591">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-307" name="The application does not implement anti-automation mechanisms to prevent automated long-time sustained probes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
+
+This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, to compromise program logic (such as limiting humans to a single vote), or for other purposes. For example, an authentication routine might not limit the number of times an attacker can guess a password, or a website might conduct a poll but only expect humans to vote a maximum of once a day.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.265">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-254-PROD" name="The product lacks key security features" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-400" name="Uncontrolled Resource Consumption ('Resource Exhaustion')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly restrict the size or amount of resources that are requested or
+                        influenced by an actor, which can be used to consume more resources than intended.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.900">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')" url="https://cwe.mitre.org/data/definitions/400.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.899">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="IOT2.4.13.3" name="All product related web servers have their web server HTTP trace and trace methods disabled" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All product related web servers have their webserver HTTP trace and trace methods disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP trace method is normally used to return the full HTTP request back to the requesting client for proxy-debugging purposes. However, servers supporting the HTTP trace method are subject to cross-site scripting (XSS) attacks when used in conjunction with various weaknesses in browsers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Disable web servers' HTTP trace and trace methods. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, regarding an Apache2.0 server: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Modify the security.conf file located under /etc/apache2/conf.d/security and set the Track option to Off. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use curl to verify if HTTP TRACE was disabled in the server: 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;curl -v -X TRACE http://www.yourserver.com 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test HTTP Methods" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.14.1" name="All the production test and calibration software is erased, removed or secured before the product is dispatched from the factory" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All the production test and calibration software used during manufacture is erased, removed or secured before the product is dispatched from the factory.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The product should have all of the production test and calibration software used during manufacture erased, removed or secured before the product is dispatched from the factory. This is to prevent alteration of the product post manufacture when using authorized production software, for example, hacking of the RF characteristics for greater RF &lt;span class="caps"&gt;ERP&lt;/span&gt;. Where such functionality is required in a service center, it should be erased or removed upon completion of any servicing activities.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Erase, remove or secure all the production test and calibration software used during manufacture, before the product is dispatched from the factory.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.18" name="All the related servers and network elements prevent anonymous/guest access except for read only access to public information" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Read only access must be granted only for public information, so servers and network elements have to prevent all anonymous/guest access in order to prevent a potential theft or disclosure of sensitive information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>When you have identified an application interface, for example a Cisco router web interface or a WebLogic administrator portal, check that the known usernames and passwords for these devices do not result in successful authentication. To do this you can consult the manufacturer's documentation or, even simpler, you can find common credentials using a search engine or one of the sites or tools listed in the Reference section.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Default Credentials" url="https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/02-Testing_for_Default_Credentials"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.16" name="All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Passwords must be securely stored using only strong and approved cryptographic algorithms. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the product securely stores any passwords using an industry standard cryptographic algorithm. For example, see FIPS 140 or OWASP Password Storage Cheat Sheet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP - Password Storage Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"/>
+            <reference name="Security Requirements for Cryptographic Modules" url="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.17" name="All the related servers and network elements support access control measures" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements support access control measures to restrict access to sensitive information or system processes to privileged accounts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sensitive information or system processes must be protected by means of access control measures implemented on servers and network elements. It is very important that users, devices, and systems be verified, authenticated and authorized before access to such critical data is granted, in order to prevent a potential theft or disclosure of sensitive information or system processes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all the related servers and network elements support access control measures. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NCSC CAF guidance - B.2 Identity and access control" url="https://www.ncsc.gov.uk/collection/caf/caf-principles-and-guidance/b-2-identity-and-access-control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Testing for role/privilege manipulation&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In every portion of the application where a user can create information in the database (e.g., making a payment, adding a contact, or sending a message), receive information (account statement, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record this functionality. The tester should try to access such functions as a different user in order to check if it is possible to access a function that should not be permitted for the user's role/privilege (but might be permitted as another user).&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://wiki.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.2" name="Any product related web servers have their webserver identification options switched off" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Any product related web servers have their webserver identification options (e.g. Apache or Linux) switched off. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When a web server is showing the world its type and possibly its version number, it allows attackers to launch targeted attacks against this specific web server and version. In addition, if the version of the web server is known to be vulnerable to a specific exploit, an attacker would just need to use the exploit as part of their attack. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Switch off the webserver identification options.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, to limit the information provided by an Apache server, modify the /etc/httpd/conf/httpd.conf file and change the following two lines: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ServerSignature Off 
+&lt;/div&gt; 
+&lt;div&gt;
+  ServerTokens Prod 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Save the file, exit, and restart your Apache web server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check what information the web sever is currently revealing. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, for an Apache server run: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  curl --head localhost 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you receive a response with a line similar to: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Server: Apache/2.2.15 (CentOS) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Then the web server is revealing too much information and should be reconfigured so that the output is: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Server: Apache 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references>
+              <reference name="Fingerprint Web Server" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.5" name="Any product's port(s) that are not required for normal operation should be restricted or disabled" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If the product has any virtual port(s) that are not required for normal operation, they are only allowed to communicate with authorized and authenticated entities or are securely disabled when shipped.&lt;/p&gt; 
+&lt;p&gt; Where a port is used for field diagnostics, the port input commands are deactivated and the output provides no information which could compromise the device, such as credentials, memory addresses or function names. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have 80 or 443 open, or otherwise users will not be able to connect to use the web server. Thus, taking into account that every open port increases the attack surface, any product's port(s) that are not required for normal operation should be restricted or disabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Restrict or disable any port(s) that are not required for normal operation.&lt;/p&gt; 
+&lt;p&gt; Deactivate port input for port(s) that are used for field diagnostics and ensure their output provides no information which could compromise the device.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2014-I3 Insecure Network Services" url="https://www.owasp.org/index.php/Top_10_2014-I3_Insecure_Network_Services"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Checking for Insecure Network Services includes:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Determining if insecure network services exist by reviewing your device for open ports using a port scanner.&lt;/li&gt; 
+ &lt;li&gt;As open ports are identified, each can be tested using any number of automated tools that look for DoS vulnerabilities, vulnerabilities related to &lt;span class="caps"&gt;UDP&lt;/span&gt; services and vulnerabilities related to buffer overflow and fuzzing attacks.&lt;/li&gt; 
+ &lt;li&gt;Reviewing network ports to ensure they are absolutely necessary and if there are any ports being exposed to the internet using UPnP.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.22" name="Input data validation should be maintained in accordance with industry practiced methods" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Input data validation should be maintained in accordance with industry practiced methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The failure to properly validate inputs is one of the most common software security weaknesses, specifically for web applications. This weakness leads to almost all of the major vulnerabilities in applications, such as cross site scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system attacks and buffer overflows. Input data should never be trusted, and therefore software should ensure that input data is strongly typed, has correct syntax, and that it is within length boundaries and contains only permitted characters or that numbers are correctly signed and within range boundaries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that input data validation is maintained in accordance with industry practiced methods as per NIST Special Publication 800-53 SI-10 (please see reference URL). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - SI-10 INFORMATION INPUT VALIDATION" url="https://nvd.nist.gov/800-53/Rev4/control/SI-10"/>
+            <reference name="OWASP Proactive Controls - C5 - Validate all inputs" url="https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all areas that accept user data properly handle unexpected data such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;special characters (examples: &amp;lt; &amp;gt; $ % &amp;amp;)&lt;/li&gt; 
+  &lt;li&gt;values other than the default items (e.g. letters if the URL argument is normally a number)&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Testing Scope&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; Input Form Fields 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; Hidden Variables 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; URL Parameters 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Desired System Behavior&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Whenever unexpected data is received by the application, the application will gracefully handle the situation and not return a stack trace or display detailed system information to the user. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Invalid form data should result in a message shown to the user explaining how to complete the form correctly. Unexpected data in hidden fields or the URL should result in more generic messages such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;i&gt;&amp;nbsp;The requested operation could not be performed.&lt;/i&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Input Validation testing" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/"/>
+              <reference name="WebAppSec/Secure Coding QA Checklist" url="https://wiki.mozilla.org/WebAppSec/Secure_Coding_QA_Checklist"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.33" name="Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed. These can include, but are not limited to, locations on the heap, the stack, and statically-allocated storage.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="ISO/IEC TR 24772:2013" url="https://www.iso.org/standard/61457.html"/>
+            <reference name="MEM03-C. Clear sensitive information stored in reusable resources" url="https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.33" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.2" name="Software images are digitally signed by the organization's approved signing authority. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where remote software upgrade can be supported by the device, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. A Certificate authority (CA) acts as a trusted third party, trusted both by the software author and by the device to verify the entity's identity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, for remote software upgrades, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting Software Integrity through code signing" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925977"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.4" name="Software images should be encrypted whilst being transferred to a device. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If remote software upgrades are supported by a device, software images should be encrypted whilst being transferred to it.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Data transmitted over a public network can be intercepted by unauthorized parties. A secure file transfer adds security features to the transmission by encrypting the file to preserve its confidentiality and integrity. This prevents eavesdroppers on the networks between the systems from accessing the file contents and reading or modifying them, necessitating the use of encryption for software images that are used for remote software upgrades.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Utilize encrypted protocols wherever possible to protect all data in transit. Where protocol encryption is not possible, consider encrypting data before the transfer.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Guide for Interconnecting Information Technology Systems" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.4" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.21" name="Software uses certificate pinning or public/private key equivalent for TCP/IP or UDP/IP connections" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the device software communicates with a product related webserver or application over &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP, the device software uses certificate pinning or public/private key equivalent, where appropriate.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Secure connections are a cornerstone for client/server communication. Users, developers, and applications expect end-to-end security for their secure channels, but some secure channels are not meeting this expectation. Specifically, channels built using well known protocols can be vulnerable to a number of attacks. For example, traditional certificate validation protects against many types of man-in-the-middle (&lt;span class="caps"&gt;MITM&lt;/span&gt;) attacks, but it doesn't prevent all of them.&lt;/p&gt; 
+&lt;p&gt;Certificate pinning can still prevent the interception of a program's network traffic. Pinning is the process of associating a host with their expected X509 certificate or public key, which can be added to an application during development, or it can be added upon first encountering the certificate or public key.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the device software uses certificate pinning or a public/private key equivalent for &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP connections.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate and Public Key Pinning" url="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What_Is_Pinning"/>
+            <reference name="Pinning Cheat Sheet" url="https://www.owasp.org/index.php/Pinning_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.21" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.450">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.26" name="Support for partially downloading updates is provided" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Support for partially downloading updates is provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions to a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially downloading updates may be provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially downloading updates.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.450">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.25" name="Support for partially installing updates is provided" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Support for partially installing updates is provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions into a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially installing updates may be provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially installing updates.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.450">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.15" name="The maximum permissible number of failed login attempts follows the recommendations of 3GPP TS33.117" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If web services allow users to enter passwords as many times as they want, an attacker may try to exploit this by using scripts that enter different combinations until the password cracks. To prevent this, the number of failed login attempts per user should be limited, for example, to 5 failed attempts, locking the user out as a result. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.15" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Refer to the following test case in the 3GPP TS 33.117 document:&amp;nbsp;&amp;nbsp; 
+&lt;div&gt;
+  Test Name: TC_FAILED_LOGIN_ATTEMPTS&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.689">
+              <output/>
+            </source>
+            <references>
+              <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.16" name="The product allows an authorized factory reset of the device's authorization information" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows an authorized factory reset of the device's authorization information.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The devices are often authorized to an account, based on license agreements with service providers. The device should have the option to be deauthorized and reset in case the user no longer wants to use it or if the user wants to authorize the device to another account.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows an authorized factory reset of the device's authorization information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.12" name="The product allows the factory issued or OEM login accounts to be disabled, erased or renamed" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts should be disabled, erased or renamed. This is to avoid the type of attacks where factory default logins and passwords are published on the web, which allows attackers to mount very simple scanning and dictionary attacks on devices.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed when installed or commissioned.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.8" name="The product has protection against software reverting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product has protection against reverting the software to an earlier and potentially less secure version.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both Operating System and individual software programs. Updates can apply a wide range of revisions into a system such as adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, the product should have protection to prevent software reverting to an earlier, out-of-date and probably insecure version.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product has mechanisms against software reverting.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.452">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.11" name="The product only allows controlled user account access" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product only allows controlled user account access. Access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Product should not allow any unjustified anonymous or guest access in order to prevent potential theft or disclosure of sensitive information, therefore only controlled user account access should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product only allows controlled user account access and access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The best way to find out if an application has failed to properly restrict function level access is to verify every application function:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Does the UI show navigation to unauthorized functions?&lt;/li&gt; 
+ &lt;li&gt;Are server side authentication or authorization checks missing?&lt;/li&gt; 
+ &lt;li&gt;Are server side checks done that solely rely on information provided by the attacker?&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Using a proxy, browse your application with a privileged role. Then revisit restricted pages using a less privileged role. If the server responses are alike, you're probably vulnerable. Some testing proxies directly support this type of analysis.&lt;/p&gt; 
+&lt;p&gt;You can also check the access control implementation in the code. Try following a single privileged request through the code and verifying the authorization pattern. Then search the codebase to find where that pattern is not being followed.&lt;/p&gt; 
+&lt;p&gt; Automated tools are unlikely to find these problems.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.949">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.7" name="The product related web servers have repeated renegotiation of TLS connections disabled" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The product related web servers have repeated renegotiation of TLS connections disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generally, a TLS renegotiation is a process that allows changing the details of a handshake after a connection is made with the server and it occurs when the session expires on either side and data continues to be sent. This means either that the session has simply expired due to timeout, or that a peer wants to change the cipher suite or wants to request a peer certificate and hasn't done so yet.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the case of web services, the server encrypts traffic using TLS, but allows a client to renegotiate the connection after the initial handshake. If the server does not&amp;nbsp; limit the number of renegotiations for a single TLS connection, then a client may open several simultaneous connections and repeatedly renegotiate them, which may exhaust the server's resources and lead to a Denial of Service (DoS) condition. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that web servers have repeated renegotiation of TLS connections disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tips for Securing SSL Renegotiation" url="https://www.mcafee.com/blogs/enterprise/tips-securing-ssl-renegotiation/"/>
+            <reference name="Transport Layer Security (TLS) Renegotiation Indication Extension" url="https://tools.ietf.org/html/rfc5746"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The following example demonstrates how to check if client-initiated renegotiation is supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -connect example.com:443 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Once the connection is established, the server will wait for us to type the next command. We can write the following two lines in order to initiate a renegotiation by specifying R in the second line, followed by enter or return. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -connect host:port 
+&lt;/div&gt; 
+&lt;div&gt;
+  HEAD / HTTP/1.0 
+&lt;/div&gt; 
+&lt;div&gt;
+  R 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;Enter or Return key&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A system that does not support client-initiated renegotiation will return an error and end the connection or the connection will time out. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  RENEGOTIATING 
+&lt;/div&gt; 
+&lt;div&gt;
+  write:errno=104 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A system that supports client-initiated renegotiation will keep the connection active and respond to further commands.&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="Manually Testing SSL/TLS Weaknesses" url="https://www.contextis.com/us/blog/manually-testing-ssl-tls-weaknesses"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.6" name="The product/system enforces passwords to be compliant with 3GPP TS33.117 or similar recommendations" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Password entry follows industry standard practice such recommendations of the 3GPP TS33.117 Password policy. [ref. 1] or &lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3] on password length, characters from the groupings and special characters.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A key concern when using passwords for authentication is password strength. A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means. The main characteristics that define a strong password are length, complexity and topology (the pattern that a password is written).&lt;/p&gt; 
+&lt;p&gt;Passwords should not be vulnerable to dictionary attack, which is a type of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product/system enforces passwords to be compliant with 3GPP TS33.117 or similar (&lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3]) recommendations to include: At least eight characters in length, characters from the groupings: alpha, numeric and special characters and should not be vulnerable to dictionary attack.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Catalogue of general security assurance requirements" url="https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2928"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="Password strategies that can help your organisation remain secure" url="https://www.ncsc.gov.uk/guidance/password-collection"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [3] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.5" name="The product will not allow new passwords containing the user account name with which the user account is associated" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product will not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Weak passwords are a serious threat to computer security, and specifically the guessable ones should be forbidden through organizational policy and suitable technical measures. Using the user account name as password or part of a password is completely insecure and makes a brute-force attack against the login interface much easier.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product does not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Authentication Cheat Sheet" url="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"/>
+            <reference name="Testing for Default or Guessable User Account (OWASP-AT-003)" url="https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [2] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.8" name="The related servers have unused IP ports disabled" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The related servers have unused IP ports disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have ports 80 or 443 open, or otherwise users will not be able to connect to use the web server. However, taking into account that every open port increases the attack surface, any related servers' port(s) that are not used should be disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Disable the servers' unused IP ports.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - CM-7 LEAST FUNCTIONALITY" url="https://nvd.nist.gov/800-53/Rev4/control/CM-7"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  For example, the following command will look up, with a TCP connect scan, all open ports on IP 192.168.1.100 and will try to determine what services are bound to them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  nmap -PN -sT -sV -p0-65535 192.168.1.100 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Enumerate Applications on Webserver" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.24" name="The software has been designed to fail safely" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The software has been designed to meet the safety requirements identified in the risk assessment, i.e. in the case of unexpected invalid inputs, or erroneous software operations, the product does not become dangerous or compromise the security of other connected systems.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software is expected to fail, but when it does it has to be in a safe way and security controls and settings must remain in effect. The confidentiality and integrity of a system should remain intact even if availability has been lost. Attackers must not be permitted to gain access rights to privileged objects during a failure when those objects are normally inaccessible. Upon failing, a system that reveals sensitive information about the failure to potential attackers could supply additional knowledge to launch an attack.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software has been designed to fail safely. This typically involves several things:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Secure defaults (default is to deny access).&lt;/li&gt; 
+ &lt;li&gt;Upon failure, undo changes and restore a secure state.&lt;/li&gt; 
+ &lt;li&gt;Always check return values for failure.&lt;/li&gt; 
+ &lt;li&gt;In conditional code/filters make sure that there is a default case that does the right thing.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Failing Securely" url="https://www.us-cert.gov/bsi/articles/knowledge/principles/failing-securely"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.24" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.450">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.4" name="Web servers' TLS certificate(s) are signed by trusted CAs, are within their validity period and processes are in place for their renewal" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the product related web servers' TLS certificate(s) are signed by trusted Certificate Authorities, are within their validity period and processes are in place for their renewal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The server validation component of TLS provides authentication between the server and the client via digital certificates. These certificates commonly include: 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Issuer: The entity that verified the information and issued the certificate (Certificate Authority). 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Valid to: The expiration date after which the certificate is no longer valid. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Signature algorithm: The algorithm used to create the signature (keys) and prove its integrity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  As mentioned above, the Certificate Authority (CA) is an entity that issues digital certificates and acts as a trusted third party, trusted both by the client and by the server, and which verifies the server's identity. Therefore, all web server certificates must be signed by a trusted Certificate Authority. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Expired or untrusted certificates that users usually ignore are an issue, as they are taken advantage of by attackers to expose users to DNS spoofing or Man-in-the-middle attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the web servers' TLS certificates are signed by trusted certificate authorities, their validity period has not elapsed, and that processes are in place for their renewal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Transport Layer Protection Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using OpenSSL, we can gather the server and intermediate certificates sent by a server using the following command: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -showcerts -connect example.com:443 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references>
+              <reference name="TLS/SSL Certificate Validity – Client and Server" url="https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_Transport_Layer_Security.html"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.30" name="When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; To implement certain control capabilities into a system, you'll want to remotely reset the device so as to achieve a known-good state and recover from errors and implement new configuration changes. You may also want to be able to reset the device to a factory default configuration, which is useful when you want to decommission a device or as a more invasive way to recover from unknown error conditions.&lt;/p&gt; 
+&lt;p&gt;Lastly, issuing a command to update or reload firmware is very important in order maintain security of the remote device, implement feature enhancements, and patch bugs.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; When a device cannot verify authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Code of Practice for Consumer IoT Security" url="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/971440/Code_of_Practice_for_Consumer_IoT_Security_October_2018_V2.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.29" name="Where a device cannot verify the authenticity of updates itself, only local updates are permitted" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a device cannot verify the authenticity of updates itself (e.g. due to a lack of cryptographic capabilities), only local update by a physically present user is permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. This process is used for remote updates too, where devices can verify the signature to confirm that the package is authentic and complete. For this reason, if a device cannot verify the authenticity of updates itself, only local updates should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; If the device cannot verify the authenticity of updates, permit local updates only.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Top 10 2014-I9 Insecure Software/Firmware" url="https://www.owasp.org/index.php/Top_10_2014-I9_Insecure_Software/Firmware"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.450">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.20" name="Where a Product or Service includes a critical functionality, the service's infrastructure shall incorporate protection against DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a Product or Service includes any safety-critical or life-impacting functionality, the service's infrastructure shall incorporate protection against Distributed Denial of Service (DDoS) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Denial of Service (DoS) attack focuses on making a resource (site, application, server, etc.) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may stop being available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles the resources it uses. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Distributed Denial of Service (DDoS) attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. The exploited machines can include computers and other networked resources such as IoT devices.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the services' infrastructure incorporates protection against Distributed Denial of Service (DDoS) attacks, such as dropping of traffic or sink-holing (please see NIST 800-53 SC-5, reference URL [1]). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - SC-5 DENIAL OF SERVICE PROTECTION" url="https://nvd.nist.gov/800-53/Rev4/control/SC-5"/>
+            <reference name="OWASP Denial Of Service Attacks" url="https://owasp.org/www-community/attacks/Denial_of_Service"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.20" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Denial of Service" url="https://wiki.owasp.org/index.php/Testing_for_Denial_of_Service"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.21" name="Where a Product or Service includes critical functionality, the services' infrastructure shall incorporate redundancy to ensure service continuity and availability" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a Product or Service includes any safety-critical or life-impacting functionality, the services' infrastructure must incorporate redundancy to ensure service continuity and availability. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Since Web Services are susceptible to Denial of Service (DoS) attacks, it is important to replicate data and applications in a robust manner. Replication and redundancy can ensure access to critical data in the event of a failure. It will also enable the system to react in a coordinated way to deal with disruptions. Therefore, Web Services must be designed to include redundancy of critical functions, ensuring diversity among those critical functions implemented.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that, where a Product or Service includes a safety-critical or life-impacting functionality, the services' infrastructure incorporates redundancy to ensure service continuity and availability. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - Guide to Secure Web Services" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-95.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.690">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.9" name="Where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a product related to a webserver encrypts communications using TLS and requests a client certificate, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In a traditional TLS handshake, the client authenticates the server, and the server doesn't know too much about the client. TLS Client Authentication is useful in cases where a server is keeping track of its numerous clients, as in IoT with millions of installs exchanging secure information. For example, an IoT company can issue a unique client certificate per device, and then limit the connections to their IoT infrastructure to only their devices by blocking connections where the client doesn't present a certificate signed by the company's Certificate Authority (CA). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that, where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Client Authentication During SSL Handshake" url="https://docs.oracle.com/cd/E19424-01/820-4811/aakhe/index.html"/>
+            <reference name="OWASP - TLS Client Authentication" url="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that only users whose certificates are signed by the trusted certificate authority can successfully authenticate with the server using client certificates.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:42.691">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.3" name="Where a UI password is used for login authentication, the factory issued or reset password is unique to each device in the product family" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a user interface password is used for login authentication, the factory issued or reset password is unique to each device in the product family.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial user interface password or factory reset password is unique to each device in the product family. If a password-less authentication is used the same principles of uniqueness apply.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.15" name="Where passwords are entered on a UI, the actual pass phrase is obscured by default" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily the protection against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stolen, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.2" name="Where the product has a secure source of time there is a method of validating its integrity" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the product has a secure source of time there is a method of validating its integrity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network Time Protocol (&lt;span class="caps"&gt;NTP&lt;/span&gt;) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, &lt;span class="caps"&gt;NTP&lt;/span&gt; is one of the oldest Internet protocols in current use. &lt;span class="caps"&gt;NTP&lt;/span&gt;sec is a fork implementation of &lt;span class="caps"&gt;NTP&lt;/span&gt; that has been systematically security-hardened.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the product has a secure source of time there is a method of validating its integrity such as &lt;span class="caps"&gt;NTP&lt;/span&gt;sec (please see reference &lt;span class="caps"&gt;URL&lt;/span&gt; [1]).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NTPsec project - a secure, hardened, and improved implementation of Network Time Protocol derived from NTP" url="https://www.ntpsec.org/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.17" name="Where the product  has the ability to remotely recover from an attack, it should rely on a known good state, to enable safe recovery and updating of the device" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;The ability to remotely recover from these situations should rely on a known good state, such as locally storing a known good version to enable safe recovery and updating of the device. This will avoid denial of service and costly recalls or maintenance visits, whilst managing the risk of potential takeover of the device by an attacker subverting update or other network communications mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Ensuring Software Integrity in IoT Devices" url="https://www.omicsonline.org/open-access/ensuring-software-integrity-in-iot-devices-2165-7866-1000217.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:41.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-control" name="Access control" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-37" issueId="" issueLink="" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION AND AUTHORIZATION" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-307">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="NO-PASSWORD-CHANGE">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
+                <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112-USERNAME" issueId="" issueLink="" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Attackers could perform a brute force attack against the login function by choosing a
+                                simple password that users are likely to use for the site, and that meets the site's
+                                password policy.
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
+                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
+                                through pure brute force means. &amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This type of attack cannot be defended against using an account lockout policy because
+                                each username is only attempted once.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-122" issueId="" issueLink="" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1548.001" url="https://attack.mitre.org/techniques/T1548/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.002" url="https://attack.mitre.org/techniques/T1548/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.003" url="https://attack.mitre.org/techniques/T1548/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.004" url="https://attack.mitre.org/techniques/T1548/004"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
+                <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-130" issueId="" issueLink="" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1499.003" url="https://attack.mitre.org/techniques/T1499/003"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="network-rate-limit" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CWE-256" issueId="" issueLink="" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>A compromise of the storage system medium itself (device, server or database) could
+                                allow attackers full access to the data
+                                stored, including authentication credentials such as passwords.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-257">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-151" issueId="" issueLink="" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1036.001" url="https://attack.mitre.org/techniques/T1036/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.002" url="https://attack.mitre.org/techniques/T1036/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.003" url="https://attack.mitre.org/techniques/T1036/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.004" url="https://attack.mitre.org/techniques/T1036/004"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.005" url="https://attack.mitre.org/techniques/T1036/005"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.006" url="https://attack.mitre.org/techniques/T1036/006"/>
+                <reference name="Mitre ATT&amp;CK Technique T1036.007" url="https://attack.mitre.org/techniques/T1036/007"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-592">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-20" issueId="" issueLink="" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE" issueId="" issueLink="" name="Attackers try to take advantage of a wide attack surface" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
+                    <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                    <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
+                <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="OWASP A6:2017" issueId="" issueLink="" name="Attackers attempt to exploit unpatched flaws to gain unauthorized access or knowledge of the system" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
+                <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
+                <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-607" issueId="" issueLink="" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-400">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-94" issueId="" issueLink="" name="Man in the Middle Attack" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>	&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.4" mitigation="100"/>
+                    <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.4" mitigation="100"/>
+                <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-157" issueId="" issueLink="" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE-OPEN-PORTS" issueId="" issueLink="" name="Attackers try to retrieve banner information through the open ports to discover potential vulnerabilities" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or another service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
+                    <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
+                <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="read-or-post-data" name="Read or Post data" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-137" issueId="" issueLink="" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&amp;amp;). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&amp;amp;new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="device-operation" name="Device operation" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-209">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNPATCHED-PRODUCT">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
+                    <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
+                    <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
+                    <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="update-process" name="Update Process" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-122-UPDATE-PROCESS" issueId="" issueLink="" name="An adversary is able to exploit the update process of the device to escalate its privileges" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
+                <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-157" issueId="" issueLink="" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6a202cff-2ea3-4a31-8c95-1f2c32e4b724" diagramComponentId="f543eaf4-f120-4908-90ee-01515f8e13ad" ref="d0fdc25d-5d11-4e1f-af10-16a726654f57" name="IoT Mobile Application" desc="" library="iot-security-compliance-framework" parentComponentRef="098d813e-0ed5-4bb8-8f6a-58d4a2a3a4e8" componentDefinitionRef="iot-mobile-application" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CSD-ADM-OPEN" name="Access to the administration interfaces is open to untrusted parties" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application does not restrict access to administration interfaces to untrusted parties. 
+This fact could allow an attacker to chain vulnerabilities in order to gain unauthorized access to the system. </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.738">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.273">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.272">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NO-PASSWORD-CHANGE" name="Lack of password change facility" state="0" impact="100" issueId="" issueLink="">
+          <desc>When the application does not offer a password change facility, a compromise of the current user password will lead to an attacker having persistent access to the account.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.273">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-916" name="Password hashes can be reverted over a reasonable period of time" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort to make password cracking attacks infeasible or expensive. Many password storage mechanisms compute a hash and store the hash, instead of storing the original password in plaintext. In this design, authentication involves accepting an incoming password, computing its hash, and comparing it to the stored hash.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Many hash algorithms are designed to execute quickly with minimal overhead, even cryptographic hashes. However, this efficiency is a problem for password storage, because it can reduce an attacker's workload for brute-force password cracking. If an attacker can obtain the hashes through some other method (such as SQL injection on a database that stores hashes), then the attacker can store the hashes offline and use various techniques to crack the passwords by computing hashes efficiently. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing (such as cloud computing) and GPU, ASIC, or FPGA hardware. In such a scenario, an efficient hash algorithm helps the attacker. There are several properties of a hash scheme that are relevant to its strength against an offline, massively-parallel attack:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The amount of CPU time required to compute the hash (&amp;quot;stretching&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The amount of memory required to compute the hash (&amp;quot;memory-hard&amp;quot; operations)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Including a random value, along with the password, as input to the hash computation (&amp;quot;salting&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Given a hash, there is no known way of determining a password that produces this hash value, other than by guessing possible passwords (&amp;quot;one-way&amp;quot; hashing)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Relative to the number of all possible hashes that can be generated by the scheme, there is a low likelihood of producing the same hash for multiple different inputs (&amp;quot;collision resistance&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Note that the security requirements for the software may vary depending on the environment and the value of the passwords. Different schemes might not provide all of these properties, yet may still provide sufficient security for the environment. Conversely, a solution might be very strong in preserving one property, which still being very weak for an attack against another property, or it might not be able to significantly reduce the efficiency of a massively-parallel attack. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-916" url="https://cwe.mitre.org/data/definitions/916.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
+          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.273">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SOCI-ENG-SS" name="Shoulder surfing attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attacks leveraging social engineering such as monitoring the keyboard entry by the user or collecting her personal information to verify whether it is used as a password or forms part of the password.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.273">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-254-PROD" name="The product lacks key security features" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.739">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="IOT2.4.11.3" name="Any related databases or files are either tamper resistant or restricted in their access" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The mobile application ensures that any related databases or files are either tamper resistant or restricted in their access.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Anti-tamper software is software which makes it harder for an attacker to modify it. Attackers can tamper with or install a backdoor on an app, re-sign it and publish the malicious version to third-party app marketplaces. Such attacks typically target popular apps and financial apps.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Employ anti-tamper and tamper-detection techniques to prevent illegitimate applications from executing. For example use checksums, digital signatures and other validation mechanisms to help detect file tampering. Upon detection of tampering, databases or files are re-initialized.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Impact:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Anti-tampering technology typically makes the software somewhat larger and also has a performance impact.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Android application development guidance" url="https://www.ncsc.gov.uk/guidance/application-development-guidance-introduction"/>
+            <reference name="Implement Anti-tamper Techniques" url="https://books.nowsecure.com/secure-mobile-development/en/coding-practices/anti-tamper-techniques.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.11.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.11.4" name="Application communicates with product related remote server(s) or device over a secure connection" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the application communicates with a product related remote server(s) or device it does so over a secure connection.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Secure connections are a cornerstone for a client/server communication. Cryptographic protocols such as Transport Layer Security (&lt;span class="caps"&gt;TLS&lt;/span&gt;) are used to prevent eavesdropping and tampering. Therefore the application should always communicate over a secure connection.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the application communicates with the product related remote server(s) or device over a secure connection such as a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection using certificate pinning.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate and Public Key Pinning" url="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What_Is_Pinning"/>
+            <reference name="The Transport Layer Security (TLS) Protocol Version 1.2" url="https://tools.ietf.org/html/rfc5246"/>
+            <reference name="Using TLS to protect data" url="https://www.ncsc.gov.uk/guidance/tls-external-facing-services"/>
+          </references>
+          <standards>
+            <standard ref="2.4.11.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.4" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.11.6" name="Pass phrase is obscured by default where entered on a UI" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default to prevent the capture of passwords.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily to protect against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stealing them, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.11.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.6" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CSD-ADM-TRUST" name="Restrict access to administrative interfaces" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict access to administrative interfaces to trusted actors from trusted locations to reduce the application attack surface and likelihood of compromise.&lt;/p&gt; 
+&lt;p&gt;Restrict administrative access to specific networks or hosts.&lt;/p&gt; 
+&lt;div&gt;
+  Use strong authentication for privileged access, for example a 2FA. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+          </references>
+          <standards>
+            <standard ref="2.4.10.13" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.13" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Try to access the administrative interface from an untrusted location. For example, if you are using a Wordpress &lt;span class="caps"&gt;CMS&lt;/span&gt; you should restrict access to /wp-admin which should not be available from the internet but only from trusted networks or IP addresses.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-312-ENCRYPT" name="Store sensitive data in a cryptographically secure (system provided) store" issueId="" issueLink="" platform="" cost="1" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications storing or caching data locally are at risk of attack and compromise the data. Most mobile devices and operating systems offer built in APIs to store data in their encrypted stores, such as the Keychain on iOS. These stores are ultimately encrypted using a key derived from the device passcode and require the user to set a passcode.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However, they do not enforce the quality of the passcode, nor is it possible to determine the quality of the passcode (and therefore, ultimately the key) from within the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Data should not be stored locally unless there is an explicit requirement to do so. This includes restricting thumbnails or screenshots of pages in the application that contain private data.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Data that must be stored on the client side must be held in a cryptographically secure store.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Use OS provided stores to protect private data on the client side, acknowledging that the residual risk from users with weak passwords may affect that data.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Do not store highly sensitive/financial data on the client-side without implementing a provably strong cryptographic process. For example, it should be encrypted using a key derived from an independent password where the strength of this password can be verified.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
+          </references>
+          <standards>
+            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify which points of the component are storing sensitive data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the storage routines and verify they are using OS APIs which are built on
+                            top of secure storage components.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.16" name="The product allows an authorized factory reset of the device's authorization information" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows an authorized factory reset of the device's authorization information.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The devices are often authorized to an account, based on license agreements with service providers. The device should have the option to be deauthorized and reset in case the user no longer wants to use it or if the user wants to authorize the device to another account.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows an authorized factory reset of the device's authorization information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.12" name="The product allows the factory issued or OEM login accounts to be disabled, erased or renamed" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts should be disabled, erased or renamed. This is to avoid the type of attacks where factory default logins and passwords are published on the web, which allows attackers to mount very simple scanning and dictionary attacks on devices.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed when installed or commissioned.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.11" name="The product only allows controlled user account access" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product only allows controlled user account access. Access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Product should not allow any unjustified anonymous or guest access in order to prevent potential theft or disclosure of sensitive information, therefore only controlled user account access should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product only allows controlled user account access and access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The best way to find out if an application has failed to properly restrict function level access is to verify every application function:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Does the UI show navigation to unauthorized functions?&lt;/li&gt; 
+ &lt;li&gt;Are server side authentication or authorization checks missing?&lt;/li&gt; 
+ &lt;li&gt;Are server side checks done that solely rely on information provided by the attacker?&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Using a proxy, browse your application with a privileged role. Then revisit restricted pages using a less privileged role. If the server responses are alike, you're probably vulnerable. Some testing proxies directly support this type of analysis.&lt;/p&gt; 
+&lt;p&gt;You can also check the access control implementation in the code. Try following a single privileged request through the code and verifying the authorization pattern. Then search the codebase to find where that pattern is not being followed.&lt;/p&gt; 
+&lt;p&gt; Automated tools are unlikely to find these problems.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.6" name="The product/system enforces passwords to be compliant with 3GPP TS33.117 or similar recommendations" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Password entry follows industry standard practice such recommendations of the 3GPP TS33.117 Password policy. [ref. 1] or &lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3] on password length, characters from the groupings and special characters.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A key concern when using passwords for authentication is password strength. A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means. The main characteristics that define a strong password are length, complexity and topology (the pattern that a password is written).&lt;/p&gt; 
+&lt;p&gt;Passwords should not be vulnerable to dictionary attack, which is a type of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product/system enforces passwords to be compliant with 3GPP TS33.117 or similar (&lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3]) recommendations to include: At least eight characters in length, characters from the groupings: alpha, numeric and special characters and should not be vulnerable to dictionary attack.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Catalogue of general security assurance requirements" url="https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2928"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="Password strategies that can help your organisation remain secure" url="https://www.ncsc.gov.uk/guidance/password-collection"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [3] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.5" name="The product will not allow new passwords containing the user account name with which the user account is associated" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product will not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Weak passwords are a serious threat to computer security, and specifically the guessable ones should be forbidden through organizational policy and suitable technical measures. Using the user account name as password or part of a password is completely insecure and makes a brute-force attack against the login interface much easier.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product does not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Authentication Cheat Sheet" url="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"/>
+            <reference name="Testing for Default or Guessable User Account (OWASP-AT-003)" url="https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [2] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-20" name="Validate all input data sent to exported activities, intents or content providers" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. This affects all application platforms, including mobile. All data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+ Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot; &lt;/p&gt;
+
+ Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data. While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright. Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server. 
+
+ This validation and sanitization must be performed in context. For example, data sent to an &lt;span class="caps"&gt;SQL&lt;/span&gt; database must be escaped for &lt;span class="caps"&gt;SQL&lt;/span&gt; special characters whereas data sent as part of a shell command must be escaped for shell special characters.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify exported activities, intents and content providers.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria).&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters.&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt; 
+ &lt;li&gt;Check the code to look for input validation methods and input restrictions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Test that they are effective by fuzzing the identified features.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Tools such as&amp;nbsp;&lt;a href="https://labs.mwrinfosecurity.com/tools/drozer/"&gt;Drozer&lt;/a&gt;&amp;nbsp;can help with this task.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.3" name="Where a UI password is used for login authentication, the factory issued or reset password is unique to each device in the product family" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a user interface password is used for login authentication, the factory issued or reset password is unique to each device in the product family.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial user interface password or factory reset password is unique to each device in the product family. If a password-less authentication is used the same principles of uniqueness apply.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.11.1" name="Where a UI password is used for login authentication, the initial password or factory reset password is unique to each device" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where an application's user interface password is used for login authentication, the initial password or factory reset password is unique to each device in the product family.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial password or factory reset password is unique to each device in the product family.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
+          </references>
+          <standards>
+            <standard ref="2.4.11.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.1" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.15" name="Where passwords are entered on a UI, the actual pass phrase is obscured by default" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily the protection against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stolen, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.2" name="Where the product has a secure source of time there is a method of validating its integrity" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the product has a secure source of time there is a method of validating its integrity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network Time Protocol (&lt;span class="caps"&gt;NTP&lt;/span&gt;) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, &lt;span class="caps"&gt;NTP&lt;/span&gt; is one of the oldest Internet protocols in current use. &lt;span class="caps"&gt;NTP&lt;/span&gt;sec is a fork implementation of &lt;span class="caps"&gt;NTP&lt;/span&gt; that has been systematically security-hardened.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the product has a secure source of time there is a method of validating its integrity such as &lt;span class="caps"&gt;NTP&lt;/span&gt;sec (please see reference &lt;span class="caps"&gt;URL&lt;/span&gt; [1]).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NTPsec project - a secure, hardened, and improved implementation of Network Time Protocol derived from NTP" url="https://www.ntpsec.org/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.17" name="Where the product  has the ability to remotely recover from an attack, it should rely on a known good state, to enable safe recovery and updating of the device" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;The ability to remotely recover from these situations should rely on a known good state, such as locally storing a known good version to enable safe recovery and updating of the device. This will avoid denial of service and costly recalls or maintenance visits, whilst managing the risk of potential takeover of the device by an attacker subverting update or other network communications mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Ensuring Software Integrity in IoT Devices" url="https://www.omicsonline.org/open-access/ensuring-software-integrity-in-iot-devices-2165-7866-1000217.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:40.153">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ADMINISTRATION SERVICE" name="Administration service" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CSD-ADM-IFACE" issueId="" issueLink="" name="Attackers gain access to the system through an unprotected administration interface" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Administrative interfaces grant access to sensitive operations that can typically
+                                affect key security mechanisms, like modifying credentials and adding/removing user
+                                accounts.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSD-ADM-OPEN">
+                  <countermeasures>
+                    <countermeasure ref="CSD-ADM-TRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-ADM-TRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION AND AUTHORIZATION" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CWE-256" issueId="" issueLink="" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>A compromise of the storage system medium itself (device, server or database) could
+                                allow attackers full access to the data
+                                stored, including authentication credentials such as passwords.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-257">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-1-ANDROID" issueId="" issueLink="" name="Malicious applications gain access to unauthorized data or perform unauthorized actions" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>	&lt;p&gt;Attackers could use malicious mobile applications to attack legitimate applications that export their components improperly. The attacks and consequences of improperly exporting a component may depend on the exported component: If access to an exported Activity is not restricted, any application will be able to launch the activity. 
+ This may allow a malicious application to gain access to sensitive information, modify the internal state of the application, or trick a user into interacting with the victim application whilst believing they are still interacting with the malicious application. If access to an exported Service is not restricted, any application may start and bind to the Service. &lt;/p&gt;
+
+ Depending on the exposed functionality, this may allow a malicious application to perform unauthorized actions, gain access to sensitive information, or corrupt the internal state of the application. If access to a Content Provider is not restricted to only the expected applications, then malicious applications might be able to access the sensitive data. Note that in Android before 4.2, the Content Provider is automatically exported unless it has been explicitly declared as &lt;span class="caps"&gt;NOT&lt;/span&gt; exported.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-20" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-20" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112-MOBILE" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks against the mobile application's user interface" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions. The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since elimination of patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.11.1" mitigation="50"/>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.11.1" mitigation="50"/>
+                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-122-MOBILE-INTEGRITY" issueId="" issueLink="" name="An adversary is able to exploit the integrity of the Mobile Application" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.11.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.11.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-403" issueId="" issueLink="" name="Attackers try to convince a target into performing actions or divulging confidential information in their benefit, often resulting in access to computer systems or facilities" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attack patterns within this category focus on the manipulation and exploitation of people. The techniques defined by each pattern are used to convince a target into performing actions or divulging confidential information that benefit the adversary, often resulting in access to computer systems or facilities. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access. In most cases, the adversary never comes face-to-face with the victim.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SOCI-ENG-SS">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.11.6" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.11.6" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CSD-AUTH-HASH" issueId="" issueLink="" name="Attackers gain access to user accounts by accessing the password database" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker with access to the plain, readable credential database would have access
+                                to the system as any of those users.&amp;nbsp;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-916">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="NO-PASSWORD-CHANGE">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112-USERNAME" issueId="" issueLink="" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Attackers could perform a brute force attack against the login function by choosing a
+                                simple password that users are likely to use for the site, and that meets the site's
+                                password policy.
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
+                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
+                                through pure brute force means. &amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This type of attack cannot be defended against using an account lockout policy because
+                                each username is only attempted once.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-122" issueId="" issueLink="" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1548.001" url="https://attack.mitre.org/techniques/T1548/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.002" url="https://attack.mitre.org/techniques/T1548/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.003" url="https://attack.mitre.org/techniques/T1548/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.004" url="https://attack.mitre.org/techniques/T1548/004"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-130" issueId="" issueLink="" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1499.003" url="https://attack.mitre.org/techniques/T1499/003"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="network-rate-limit" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                    <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" issueId="" issueLink="" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="mobile-user-interface" name="Mobile user interface" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.11.6" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.11.6" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="SENSITIVE READ OR POST DATA" name="Sensitive Read or Post data" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-157" issueId="" issueLink="" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.11.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.11.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-167" issueId="" issueLink="" name="Sensitive Data stored on the client could be accessed by an attacker" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a client application for the presence of sensitive information.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This information may be stored in configuration files, embedded within the application itself, or stored in other ways. Sensitive information may include long-term keys, passwords, credit card or financial information, and other private material that the client uses in its interactions with the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While servers are (hopefully) protected by professional security administrators, most users may be less skilled at protecting their data. As a result, the user client may represent a weak link that an attacker could exploit directly. If an attacker can gain access to a client installation, they may be able to detect and lift sensitive information that could be leveraged directly (such as financial information), or allow the attacker to subvert future communication between the client and the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;In some cases, it may not even be necessary to gain access to another user's installation - if all instances of the client software are embedded with the same sensitive information (for example, long term keys for communication with the server), then the attacker must simply find a way to gain their own copy of the client in order to perform this attack.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="50" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CWE-312-ENCRYPT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-312-ENCRYPT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CWE-94" issueId="" issueLink="" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="access-control" name="Access control" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-37" issueId="" issueLink="" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="8e72658a-b134-4714-848a-82866972b669" diagramComponentId="8eff8ca6-efa4-4420-9696-70f0411df7a9" ref="098d813e-0ed5-4bb8-8f6a-58d4a2a3a4e8" name="IoT Operating System" desc="" library="iot-security-compliance-framework" parentComponentRef="57f3c399-34a3-4da3-ad31-ffa68abf92da" componentDefinitionRef="iot-operating-system" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.097">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.393">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-708" name="Incorrect Ownership Assignment" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software assigns an owner to a resource, but the owner is outside of the intended control sphere.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.006">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-708: Incorrect Ownership Assignment" url="https://cwe.mitre.org/data/definitions/708.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.533">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NO-PASSWORD-CHANGE" name="Lack of password change facility" state="0" impact="100" issueId="" issueLink="">
+          <desc>When the application does not offer a password change facility, a compromise of the current user password will lead to an attacker having persistent access to the account.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.097">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
+          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNPATCHED-PRODUCT" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches and updates are not applied in a timely manner then a product (e.g. Operating System, Software or Mobile App) or a system could be vulnerable to known security issues. These issues could be leveraged by an attacker to gain access to the system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-485" name="The application does not define isolated boundaries (Insufficient Encapsulation)" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The application does not sufficiently encapsulate critical data or functionality.
+                        &lt;/div&gt;
+                        &lt;p&gt;Encapsulation is about drawing strong boundaries. In a web browser, this might mean
+                        ensuring that your mobile code cannot be abused by other mobile code. On the server, it might
+                        mean differentiating between validated data and unvalidated data, between one user's data and
+                        another's, or between data that users are allowed to see and data that they are not.&lt;/p&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Identify boundaries on the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Make sure that the application adequately enforces access control across those
+                            boundaries. &amp;nbsp;For example, does it require some form of authentication at the
+                            boundary? &amp;nbsp;Or does it prevent access across the boundary entirely?&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.006">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-254-PROD" name="The product lacks key security features" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.096">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.098">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.976">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.5" name="Alerting on unauthorized changes" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If an unauthorized change is detected, the device should alert the user/administrator to the issue and should not connect to wider networks than those necessary to perform the alerting function.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; IoT device software should be verified using secure boot mechanisms. When an unauthorized change is detected, the device should alert operators to the issue. The issue notification should not result in connections to wider networks than necessary to deliver the alert.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, if an unauthorized change is detected, the device alerts the user/administrator to the issue and doesn't connect to wider networks than those necessary to perform the alerting function.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10-2017 A3-Sensitive Data Exposure" url="https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.5" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.7.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.12" name="All network communication keys are stored securely, in accordance with industry standards" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All network communication keys are stored securely, in accordance with industry standards such as &lt;span class="caps"&gt;FIPS&lt;/span&gt; 140, or similar.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network communication keys should be securely stored in accordance with industry standards. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that cryptographic keys for update integrity protection and confidentiality are securely managed in accordance with industry standards such as &lt;span class="caps"&gt;FIPS&lt;/span&gt; or 140-2.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Requirements for Cryptographic Modules" url="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.12" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.7" name="All OS command line access to the most privileged accounts has been removed from the operating system" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All OS command line access to the most privileged accounts has been removed from the Operating System.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The most privileged account or "superuser" of the device's OS is a special user account used for system administration, capable of making unrestricted and potentially adverse system-wide changes. Due to this, it is often recommended that no one use the "superuser" as their normal user account, and any access from the command line should be removed.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Remove all OS command line access from the most privileged accounts of the Operating System.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.880">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.10" name="All the applicable security features supported by the OS are enabled" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All the applicable security features supported by the Operating System are enabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Operating System security features are essential to ensure OS security and to prevent various types of malicious actions and attacks such as malware, viruses, etc. Therefore all the applicable security features should be enabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Enable all the applicable security features supported by the Operating System such as updates, anti-spyware and anti-virus protection, etc.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MacOS Security. Built right in" url="https://www.apple.com/macos/security/"/>
+            <reference name="Overview of Linux Kernel Security Features" url="https://www.linux.com/learn/overview-linux-kernel-security-features"/>
+            <reference name="Windows 10 Enterprise Security" url="https://docs.microsoft.com/en-us/windows/security/"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.6.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.6.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.3" name="Any unintended packet forwarding function should be blocked" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;For products with one or more network interfaces, any unintended packet forwarding function should be blocked.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Forwarding refers to the router-local action of transferring the packet from an input link interface to the appropriate output link interface. When applications allow user input to forward requests between different parts of the site, the application must check that the user is authorized to access the &lt;span class="caps"&gt;URL&lt;/span&gt;, to perform the functions it provides, and that it is an appropriate &lt;span class="caps"&gt;URL&lt;/span&gt; request. If the application fails to perform these checks, an attacker-crafted &lt;span class="caps"&gt;URL&lt;/span&gt; may pass the application's access control check and then forward the attacker to an administrative function that is not normally permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that any unintended packet forwarding function is blocked to stop undesirable communication paths.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2013-A10-Unvalidated Redirects and Forwards" url="https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards"/>
+            <reference name="Unvalidated Redirects and Forwards Cheat Sheet" url="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The best way to find out if an application has any unvalidated redirects or forwards is to:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Review the code for all redirect or forward uses (called transfer in .NET). For each use, identify if the target &lt;span class="caps"&gt;URL&lt;/span&gt; is included in any parameter values. If the target &lt;span class="caps"&gt;URL&lt;/span&gt; isn't validated against a whitelist, you are vulnerable.&lt;/li&gt; 
+ &lt;li&gt;Also, spider the site to see if it generates any redirects (&lt;span class="caps"&gt;HTTP&lt;/span&gt; response codes 300-307, typically 302). Look at the parameters supplied prior to the redirect to see if they appear to be a target &lt;span class="caps"&gt;URL&lt;/span&gt; or a piece of such a &lt;span class="caps"&gt;URL&lt;/span&gt;. If so, change the &lt;span class="caps"&gt;URL&lt;/span&gt; target and observe whether the site redirects to the new target.&lt;/li&gt; 
+ &lt;li&gt;If the code is unavailable, check all parameters to see if they look like part of a redirect or forward &lt;span class="caps"&gt;URL&lt;/span&gt; destination and test those that do.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.9" name="Applications are operated at the lowest privilege level possible" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Applications are operated at the lowest privilege level possible. 	Rationale: Applications follow the principle of the least privilege in every module (such as processes, users, etc.), which means that they must be able to access only the information and resources that are necessary for their legitimate purpose. Doing this minimizes the amount of damage caused if an attacker successfully exploits any known or future vulnerability. Remediation: Configure the Operating System to operate applications at the lowest privilege level possible.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Principle_of_Least_Privilege" url="https://www.owasp.org/index.php/Category:Access_Control#Principle_of_Least_Privilege"/>
+          </references>
+          <standards>
+            <standard ref="2.4.6.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.6.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.6.9" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.880">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.24" name="As far as reasonably possible, devices should remain operating and locally functional in the case of a loss of network connection and should recover cleanly in the case of restoration of a loss of power" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;As far as reasonably possible, devices should remain operating and locally functional in the case of a loss of network connection and should recover cleanly in the case of restoration of a loss of power. Devices should be able to return to a network in a sensible state and in an orderly fashion, rather than in a massive scale reconnect.&lt;/p&gt;
+
+	&lt;p&gt;Continuous operation ensures that devices provide basic functionality without relying on other systems or networks. It is important to note here that a device should only be required to supply basic features when the network is inaccessible. Devices should provide continuous operation if the network or the Internet is inaccessible. Manual controls where needed, either physical buttons - or digital - on the device itself.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.24" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.7.24" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.24" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.3" name="A software update package is verified by the device before the update process begins" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A software update package has its digital signature, signing certificate and signing certificate chain verified by the device before the update process begins.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. The Certificate Authority (CA) acts as a trusted third party, trusted both by the software author and by the device, and verifies the entity's identity. A chain of trust is established by validating each certificate from the end entity to the root certificate.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the device verifies the digital signature, the signing certificate and the signing certificate chain of a software update before the update process begins.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How certificate chains work" url="https://knowledge.digicert.com/solution/SO16297.html"/>
+            <reference name="Microsoft Trusted Root Certificate: Program Requirements" url="https://technet.microsoft.com/en-us/library/cc751157.aspx"/>
+            <reference name="Understanding An SSL Certificate Chain" url="https://comodosslstore.com/resources/what-is-an-ssl-certificate-chain-and-why-should-i-follow-it/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.3" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.976">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.4" name="Files and directories are set to appropriate access privileges" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Files and directories are set to appropriate access privileges on a need-to-access basis.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Most Operating Systems have methods to assign permissions or access rights to specific users or groups. These permissions control the ability of the users to view, change, navigate, and execute the contents of the file system. Therefore, files and directories should be set to appropriate access privileges according to the principle of the least privilege.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Set files, directories and persistent data to the minimum access privileges required to function correctly.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The principle of least privilege" url="https://www.owasp.org/index.php/Least_privilege"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.17" name="If there is a loss of communication, it should not compromise the integrity of the device" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If there is a loss of communications, it should not compromise the integrity of the device.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A device is expected to lose communication periodically, but when it does it should be in a safe way and all security controls and settings should remain in effect. The integrity of a system should remain intact even if the network connection has been lost. Therefore, the device's integrity should be ensured regardless of whether or not it is connected to a network. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, if there is a loss of communication, it does not compromise the integrity of the device.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.17" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.7.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.3" name="OS accounts or logins have been disabled or eliminated at the end of the development process" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All unnecessary accounts or logins have been disabled or removed from the software at the end of the software development process. E.g. Development or debug accounts.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Interactive Operating System accounts have been used during the software development process and in most cases have high privileges. This gives them access to critical resources and consequently they can be exploitable if they remain active after the development process. Therefore, any interactive accounts or logins should be disabled or eliminated at the end of the software development process.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Disable or remove all interactive Operating System accounts or logins at the end of the development process.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.8" name="OS kernel and its functions are prevented from being called by external product level interfaces and unauthorized applications" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product's OS kernel and its functions are prevented from being called by external product level interfaces and unauthorized applications.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The kernel is a computer program that is the core of a computer's Operating System, with complete control over everything in the system. Therefore only internal calls should be allowed and only from authorized applications in order to minimize the exposed attack surface.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Configure the product's OS kernel and its functions to prevent it being called by external product level interfaces and unauthorized applications.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.6.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.6.8" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.880">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.5" name="Password file(s) ownership and access/write permissions are set to the most privileged account of the device's OS" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If passwords must absolutely be stored in a local file, then password file(s) are owned by - and are only accessible to - and writable by the most privileged account of the device's OS.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The most privileged account or "superuser" of the devices' OS is a special user account used for system administration, capable of making unrestricted and potentially adverse system-wide changes. Due to this, it is often recommended that no-one use the "superuser" as their normal user account.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;According to the principle of least privilege, most users and applications run under an ordinary account to perform their work, and must be able to access only the information and resources that are necessary for their legitimate purpose. Thus, if a user only needs to be able to view a particular file, that user should have read-only access to it and should not be able to write to that file. Therefore all files that contain critical or sensitive data, like the password file(s), should have their ownership and access/write permissions set to the most privileged account of the device's OS.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Set ownership and access/write permissions for password file(s) to most privileged account of the device's OS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The principle of least privilege" url="https://www.owasp.org/index.php/Least_privilege"/>
+          </references>
+          <standards>
+            <standard ref="2.4.6.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.6.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
+ &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
+ &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
+&lt;/ul&gt; </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.975">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.12" name="The OS implements a separation architecture to separate trusted and untrusted applications" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;The trusted execution environment, or &lt;span class="caps"&gt;TEE&lt;/span&gt;, is an isolated area on the main processor of a device that is separated from the main operating system. It ensures that data is stored, processed and protected in a trusted environment. &lt;span class="caps"&gt;TEE&lt;/span&gt; provides protection for any connected "thing" by enabling end-to-end security, protected execution of authenticated code, confidentiality, authenticity, privacy, system integrity and data access rights.&lt;/p&gt;
+
+	&lt;p&gt;It is already used widely in complex devices, such as smartphones, tablets and set-top boxes, and also by manufacturers of constrained chipsets and IoT devices in sectors such as industrial automation, automotive and healthcare, who are now recognizing its value in protecting connected things.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Trusted Execution Environment Provisioning (TEEP) Architecture" url="https://tools.ietf.org/id/draft-ietf-teep-architecture-01.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.6.12" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.11" name="The OS is separated from the application(s) and is only accessible via defined secure interfaces" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Operating System is separated from the application(s) and is only accessible via defined secure interfaces.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Every device that is to be operated by an individual requires a user interface, usually referred to as a shell. The shell is the outermost layer around the Operating System kernel and is used to access its services, including file management, process management (running and terminating applications), batch processing, and the operating system monitoring and configuration.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the Operating System is separated from the application(s) and is only accessible via defined secure interfaces.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Operating System Structure" url="https://ycpcs.github.io/cs420-fall2014/lectures/lecture4_operating_system_structure.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.16" name="The product allows an authorized factory reset of the device's authorization information" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows an authorized factory reset of the device's authorization information.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The devices are often authorized to an account, based on license agreements with service providers. The device should have the option to be deauthorized and reset in case the user no longer wants to use it or if the user wants to authorize the device to another account.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows an authorized factory reset of the device's authorization information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.12" name="The product allows the factory issued or OEM login accounts to be disabled, erased or renamed" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts should be disabled, erased or renamed. This is to avoid the type of attacks where factory default logins and passwords are published on the web, which allows attackers to mount very simple scanning and dictionary attacks on devices.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed when installed or commissioned.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.382">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.1" name="The product has measures to prevent unauthenticated software and files being loaded onto it or to limit their permissions" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product has measures to prevent unauthenticated software and files being loaded onto it. In the event that the product is intended to allow unauthenticated software, such software should only be run with limited permissions and/or sandbox.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The product should have software execution control to limit which software applications and services are able to run on the Operating System and to control the exposed attack surface of the system by reducing the number of potential vulnerabilities.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software execution control is used in combination with an administrator defined set of rules, that define which software a non-privileged user is able to execute. These rules can be based on:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Software's properties e.g. name, signature, etc.&lt;/li&gt; 
+ &lt;li&gt;More generic rules e.g. permitting execution of files based on their storage location on the system.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;In the event that the product is intended to allow unauthenticated software, such software should only be run with limited permissions and/or sandbox (security mechanism which executes the software in a restricted operating system environment).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Software Execution Control: CPA SC" url="https://www.ncsc.gov.uk/files/CPA-SC_Software_Execution_Control_2-3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.1" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.1" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.976">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.11" name="The product only allows controlled user account access" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product only allows controlled user account access. Access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Product should not allow any unjustified anonymous or guest access in order to prevent potential theft or disclosure of sensitive information, therefore only controlled user account access should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product only allows controlled user account access and access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The best way to find out if an application has failed to properly restrict function level access is to verify every application function:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Does the UI show navigation to unauthorized functions?&lt;/li&gt; 
+ &lt;li&gt;Are server side authentication or authorization checks missing?&lt;/li&gt; 
+ &lt;li&gt;Are server side checks done that solely rely on information provided by the attacker?&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Using a proxy, browse your application with a privileged role. Then revisit restricted pages using a less privileged role. If the server responses are alike, you're probably vulnerable. Some testing proxies directly support this type of analysis.&lt;/p&gt; 
+&lt;p&gt;You can also check the access control implementation in the code. Try following a single privileged request through the code and verifying the authorization pattern. Then search the codebase to find where that pattern is not being followed.&lt;/p&gt; 
+&lt;p&gt; Automated tools are unlikely to find these problems.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.381">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.1" name="The product prevents unauthorized connections to itself or other devices the product is connected to" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product prevents unauthorized connections to itself or other devices the product is connected to.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A significant vulnerability is networked system accessibility. Because by definition IoT systems are connected to the Internet, attacks can be conducted remotely, either by direct access to networked control interfaces, or by downloading malware to devices. Due to this, the product should prevent unauthorized connections to itself or other devices the product is connected to, for example by means of firewalls.&lt;/p&gt; 
+&lt;p&gt;A firewall is software used to maintain the security of a private network and block unauthorized access to or from private networks and are often employed to prevent unauthorized Web users or malware from gaining access to private networks connected to the Internet.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product prevents unauthorized connections to itself or other devices the product is connected to. For example, there is a firewall on each interface and internet layer protocol.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Guidelines on Firewalls and Firewall Policy" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901083"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.1" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.6.13" name="The product's OS kernel is designed so that each component runs with the minimal security capabilities required (e.g. a microkernel architecture)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Monolithic kernels are large in size and the structure - or lack of structure - makes them difficult to change and maintain without affecting other parts of the kernel. The microkernel approach is based on the idea of only placing essential core real-time operating system functions in the kernel, and another functionality is designed in modules that communicate through the kernel via minimal, well-defined interfaces. The microkernel approach results in easily reconfigurable systems without the need to rebuild the kernel.&lt;/p&gt;
+
+	&lt;p&gt;Modern mainstream operating systems (OSs) are designed for functionality, speed and ease of development. With the increase of functionality and support for more diverse hardware, their size and complexity keeps growing. These OSs have a monolithic structure, with most services contained in the kernel, i.e. the part of the system that is executed in the privileged mode of the hardware. The result is an explosive growth of the amount of privileged code.&lt;/p&gt;
+
+	&lt;p&gt;Any code executing in privileged mode can bypass security and is therefore inherently part of a system's trusted computing base (&lt;span class="caps"&gt;TCB&lt;/span&gt;). Hence, we are experiencing a rapid growth of the &lt;span class="caps"&gt;TCB&lt;/span&gt; of mainstream OSs. As almost all code is buggy, and the number of bugs grows with the size of the code base, this &lt;span class="caps"&gt;TCB&lt;/span&gt; growth is bound to lead to a growth in the number of vulnerabilities.&lt;/p&gt;
+
+	&lt;p&gt;The microkernel design, with its ability to reduce the &lt;span class="caps"&gt;TCB&lt;/span&gt; size, contains faults and encapsulates untrusted components, and therefore is, in terms of security, superior to monolithic systems.&lt;/p&gt;
+
+	&lt;p&gt;Examples of microkernel architectures are: Mach, L4, &lt;span class="caps"&gt;QNX&lt;/span&gt;, &lt;span class="caps"&gt;MINIX&lt;/span&gt;, &lt;span class="caps"&gt;IBM&lt;/span&gt; K42.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Jury Is In: Monolithic OS Design Is Flawed" url="https://dl.acm.org/doi/10.1145/3265723.3265733"/>
+          </references>
+          <standards>
+            <standard ref="2.4.6.13" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.6" name="The product/system enforces passwords to be compliant with 3GPP TS33.117 or similar recommendations" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Password entry follows industry standard practice such recommendations of the 3GPP TS33.117 Password policy. [ref. 1] or &lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3] on password length, characters from the groupings and special characters.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A key concern when using passwords for authentication is password strength. A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means. The main characteristics that define a strong password are length, complexity and topology (the pattern that a password is written).&lt;/p&gt; 
+&lt;p&gt;Passwords should not be vulnerable to dictionary attack, which is a type of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product/system enforces passwords to be compliant with 3GPP TS33.117 or similar (&lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3]) recommendations to include: At least eight characters in length, characters from the groupings: alpha, numeric and special characters and should not be vulnerable to dictionary attack.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Catalogue of general security assurance requirements" url="https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2928"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="Password strategies that can help your organisation remain secure" url="https://www.ncsc.gov.uk/guidance/password-collection"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [3] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.5" name="The product will not allow new passwords containing the user account name with which the user account is associated" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product will not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Weak passwords are a serious threat to computer security, and specifically the guessable ones should be forbidden through organizational policy and suitable technical measures. Using the user account name as password or part of a password is completely insecure and makes a brute-force attack against the login interface much easier.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product does not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Authentication Cheat Sheet" url="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"/>
+            <reference name="Testing for Default or Guessable User Account (OWASP-AT-003)" url="https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [2] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.27" name="Update mechanisms must not interfere with performance expectations" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where real-time expectations of performance are present, update mechanisms must not interfere with meeting these expectations.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software update mechanisms may reduce the device's performance when running simultaneously with other processes.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that update mechanisms are not interfering with performance expectations, e.g. by running update processes at low priority.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Best practices for software updates in Configuration Manager" url="https://docs.microsoft.com/en-us/sccm/sum/plan-design/software-updates-best-practices"/>
+            <reference name="Ubuntu Software Updates" url="https://wiki.ubuntu.com/SoftwareUpdates"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:43.976">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.21" name="When a factory reset is leveraged the device should warn that the secure operation may be compromised unless updated" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a factory reset is leveraged the device should warn that the secure operation may be compromised unless updated.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both Operating System and individual software programs. Updates can apply a wide range of revisions on a system such as adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For that reason, after a factory reset, the device may be reverted to an earlier, out-of-date and possibly insecure version and should be updated again to ensure its secure operation.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that if a factory reset is applied the device warns that the secure operation may be compromised unless updated.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.21" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.21" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.3" name="Where a UI password is used for login authentication, the factory issued or reset password is unique to each device in the product family" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a user interface password is used for login authentication, the factory issued or reset password is unique to each device in the product family.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial user interface password or factory reset password is unique to each device in the product family. If a password-less authentication is used the same principles of uniqueness apply.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.15" name="Where passwords are entered on a UI, the actual pass phrase is obscured by default" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily the protection against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stolen, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.382">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.14" name="Where the CoAP protocol is used, it is protected by a DTLS connection with no known cipher vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the CoAP protocol is used, it is protected by a &lt;span class="caps"&gt;DTLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Constrained Application Protocol (CoAP) is a service layer protocol that is intended for use in resource-constrained internet devices, such as wireless sensor network nodes. CoAP is designed to easily translate to &lt;span class="caps"&gt;HTTP&lt;/span&gt; for simplified integration with the web, whilst also meeting specialized requirements such as multicast support, very low overhead, and simplicity, which are extremely important for IoT.&lt;/p&gt; 
+&lt;p&gt;Because CoAP is built on top of &lt;span class="caps"&gt;UDP&lt;/span&gt; not &lt;span class="caps"&gt;TCP&lt;/span&gt;, &lt;span class="caps"&gt;SSL&lt;/span&gt;/TLS are not available to provide security. Datagram Transport Layer Security (&lt;span class="caps"&gt;DTLS&lt;/span&gt;) provides the same assurances as &lt;span class="caps"&gt;TLS&lt;/span&gt; but for transfers of data over &lt;span class="caps"&gt;UDP&lt;/span&gt;.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, where the CoAP protocol is used, it is protected by a &lt;span class="caps"&gt;DTLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MQTT and CoAP, IoT Protocols" url="https://www.eclipse.org/community/eclipse_newsletter/2014/february/article2.php"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.14" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.13" name="Where the MQTT protocol is used, it is protected by a TLS connection with no known cipher vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt; 
+                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; &lt;span class="caps"&gt;MQTT&lt;/span&gt; (Message Queue Telemetry Transport), is a very lightweight and widely used messaging and information exchange protocol for IoT devices throughout the world. The &lt;span class="caps"&gt;MQTT&lt;/span&gt; communication can be encrypted using &lt;span class="caps"&gt;TLS&lt;/span&gt; / &lt;span class="caps"&gt;SSL&lt;/span&gt; protocols, ensuring a secure and safe communication.&lt;/p&gt; 
+                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="MQTT Version 3.1.1 Plus Errata 01" url="https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/mqtt-v3.1.1.html"/>
+            <reference name="MQTT and CoAP, IoT Protocols" url="https://www.eclipse.org/community/eclipse_newsletter/2014/february/article2.php"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:45.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.2" name="Where the product has a secure source of time there is a method of validating its integrity" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the product has a secure source of time there is a method of validating its integrity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network Time Protocol (&lt;span class="caps"&gt;NTP&lt;/span&gt;) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, &lt;span class="caps"&gt;NTP&lt;/span&gt; is one of the oldest Internet protocols in current use. &lt;span class="caps"&gt;NTP&lt;/span&gt;sec is a fork implementation of &lt;span class="caps"&gt;NTP&lt;/span&gt; that has been systematically security-hardened.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the product has a secure source of time there is a method of validating its integrity such as &lt;span class="caps"&gt;NTP&lt;/span&gt;sec (please see reference &lt;span class="caps"&gt;URL&lt;/span&gt; [1]).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NTPsec project - a secure, hardened, and improved implementation of Network Time Protocol derived from NTP" url="https://www.ntpsec.org/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.17" name="Where the product  has the ability to remotely recover from an attack, it should rely on a known good state, to enable safe recovery and updating of the device" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;The ability to remotely recover from these situations should rely on a known good state, such as locally storing a known good version to enable safe recovery and updating of the device. This will avoid denial of service and costly recalls or maintenance visits, whilst managing the risk of potential takeover of the device by an attacker subverting update or other network communications mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Ensuring Software Integrity in IoT Devices" url="https://www.omicsonline.org/open-access/ensuring-software-integrity-in-iot-devices-2165-7866-1000217.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-09T18:42:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION AND AUTHORIZATION" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="VULN-SERVICE" issueId="" issueLink="" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1190" url="https://attack.mitre.org/techniques/T1190"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" issueId="" issueLink="" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-180" issueId="" issueLink="" name="An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.1" mitigation="50"/>
+                <countermeasure ref="IOT2.4.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="SERVER-ATTACK" issueId="" issueLink="" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>If attackers compromise the server that hosts the service or data, then the data and
+                                the service itself could be at risk of compromise. The server could be compromised
+                                through any of the services that it exposes.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNNECESSARY-SERVICES">
+                  <countermeasures>
+                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="NO-PASSWORD-CHANGE">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112-USERNAME" issueId="" issueLink="" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Attackers could perform a brute force attack against the login function by choosing a
+                                simple password that users are likely to use for the site, and that meets the site's
+                                password policy.
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
+                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
+                                through pure brute force means. &amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This type of attack cannot be defended against using an account lockout policy because
+                                each username is only attempted once.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-122" issueId="" issueLink="" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1548.001" url="https://attack.mitre.org/techniques/T1548/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.002" url="https://attack.mitre.org/techniques/T1548/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.003" url="https://attack.mitre.org/techniques/T1548/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.004" url="https://attack.mitre.org/techniques/T1548/004"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-130" issueId="" issueLink="" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1499.003" url="https://attack.mitre.org/techniques/T1499/003"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="network-rate-limit" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CWE-256" issueId="" issueLink="" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>A compromise of the storage system medium itself (device, server or database) could
+                                allow attackers full access to the data
+                                stored, including authentication credentials such as passwords.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-257">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-122-OS" issueId="" issueLink="" name="An adversary is able to exploit Operating System features of the target that should be reserved for privileged users" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.6.13" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-708">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.6.5" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.6.11" mitigation="12"/>
+                    <countermeasure ref="IOT2.4.6.3" mitigation="12"/>
+                    <countermeasure ref="IOT2.4.6.4" mitigation="12"/>
+                    <countermeasure ref="IOT2.4.6.7" mitigation="13"/>
+                    <countermeasure ref="IOT2.4.6.8" mitigation="13"/>
+                    <countermeasure ref="IOT2.4.6.9" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.6.11" mitigation="12"/>
+                <countermeasure ref="IOT2.4.6.13" mitigation="12"/>
+                <countermeasure ref="IOT2.4.6.3" mitigation="12"/>
+                <countermeasure ref="IOT2.4.6.4" mitigation="12"/>
+                <countermeasure ref="IOT2.4.6.5" mitigation="13"/>
+                <countermeasure ref="IOT2.4.6.7" mitigation="13"/>
+                <countermeasure ref="IOT2.4.6.8" mitigation="13"/>
+                <countermeasure ref="IOT2.4.6.9" mitigation="13"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="update-process" name="Update Process" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="OWASP A6:2017" issueId="" issueLink="" name="Attackers attempt to exploit unpatched flaws to gain unauthorized access or knowledge of the system" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.27" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.27" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="access-control" name="Access control" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-37" issueId="" issueLink="" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="OWASP A6:2017-OS" issueId="" issueLink="" name="Exploitation of Operating System security misconfiguration" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.6.10" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-485">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.6.11" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.6.12" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.6.10" mitigation="33"/>
+                <countermeasure ref="IOT2.4.6.11" mitigation="33"/>
+                <countermeasure ref="IOT2.4.6.12" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                    <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="OWASP A6:2017" issueId="" issueLink="" name="Attackers attempt to exploit unpatched flaws to gain unauthorized access or knowledge of the system" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNPATCHED-PRODUCT">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.21" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.21" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE" issueId="" issueLink="" name="Attackers try to take advantage of a wide attack surface" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.1" mitigation="50"/>
+                    <countermeasure ref="IOT2.4.7.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.1" mitigation="50"/>
+                <countermeasure ref="IOT2.4.7.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="IOT-INSUF-SEC" issueId="" issueLink="" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.17" mitigation="50"/>
+                    <countermeasure ref="IOT2.4.7.24" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.17" mitigation="50"/>
+                <countermeasure ref="IOT2.4.7.24" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-157" issueId="" issueLink="" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.14" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.5" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.13" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.13" mitigation="33"/>
+                <countermeasure ref="IOT2.4.7.14" mitigation="34"/>
+                <countermeasure ref="IOT2.4.7.5" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-37" issueId="" issueLink="" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.12" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.12" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d0623bd3-f98a-44a1-83fb-5f072a000896" diagramComponentId="823eed8e-79b4-4324-9eb5-bdfc12edf2ab" ref="375e500c-8224-4ff1-b3a9-8dcb9da062dc" name="Other database" desc="" library="CS-Default" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="other" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets>
+        <asset name="Protected Health Information" accessType="10"/>
+        <asset name="Protected Health Information" accessType="40"/>
+        <asset name="Protected Health Information" accessType="50"/>
+      </assets>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.237">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.654">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.382">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.893">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-524" name="Information Exposure Through Caching" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application uses a cache to maintain a pool of objects, threads, connections, pages, or
+                        passwords to minimize the time it takes to access them or the resources to which they connect.
+                        If implemented improperly, these caches can allow access to unauthorized information or cause a
+                        denial of service vulnerability.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.894">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-524: Information Exposure Through Caching" url="https://cwe.mitre.org/data/definitions/524.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-485-PREPROD" name="Production data used in pre-production system" state="0" impact="100" issueId="" issueLink="">
+          <desc>Production data used in pre-production system might not be properly protected as applications
+                        in pre-production are not usually well tested. pre-production environments usually lack the
+                        strong Countermeasures that are set for production environments.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.238">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-485: Production data used in pre-production system" url="https://cwe.mitre.org/data/definitions/485.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-226" name="Sensitive information is not cleared from memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not fully clear previously used information in a data structure, file, or
+                        other resource, before making that resource available to a party in another control sphere.
+
+                        This typically results from new data that is not as long as the old data, which leaves portions
+                        of the old data still available. Equivalent errors can occur in other situations where the
+                        length of data is variable but the associated data structure is not. If memory is not cleared
+                        after use, it may allow unintended actors to read the data when the memory is reallocated.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.894">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-226: Sensitive information is not cleared from memory" url="https://cwe.mitre.org/data/definitions/226.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.
+          </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.238">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.599">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="86" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-524" name="Clear caches of sensitive data" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications storing or caching data locally are at risk of attack and compromise of that data. Local temporary storage, thumbnail images, and configuration files often contain excerpts of sensitive information that may be left on the device during or after the application is used.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure all temporary files, caches, and storage are purged after use and when the application is closed.&lt;/li&gt;&lt;li&gt;Do not allow the application to cache sensitive information outside of the OS provided secure stores.&lt;/li&gt;&lt;li&gt;Use OS controls to restrict thumbnails of the application in cases where sensitive information is displayed.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check the application for the use of caching.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify they are periodically emptied.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.789">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
+  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
+  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.1" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.5A" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.6" supportedStandardRef="swift-cscf"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.088">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-485-PREPROD" name="Ensure personal and other sensitive data is not exposed in pre-production environments" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Pre-production environments should not expose personally identifiable information (PII) or other sensitive information. Often, such environments are populated with production data for testing or other purposes. &amp;nbsp;Security weaknesses, either in the software or controls around access to pre-production systems, can unnecessarily expose sensitive data. This is often a breach of legal and commercial requirements, including various governmental data protection standards and privacy acts, and industry regulations such as those required by the Payments Card Industry (PCI).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Where test data is derived from production data, the following must be observed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Data masking or obfuscation techniques must be leveraged to anonymize the data used in pre-production. &amp;nbsp;For example, all but the start and end of a credit card number must be removed/replaced&lt;/li&gt;&lt;li&gt;No real personally identifiable information (PII) or other sensitive data should be present in pre-production environments. &amp;nbsp;For example, names, dates of birth, and other personal information must be removed, randomized, or replaced.&lt;/li&gt;&lt;li&gt;Only data that has been processed and anonymized should be transferred into pre-production; ideally representative test data should be generated rather than relying on obfuscated production data.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the data used on the pre-production environment is not duplicated from production.&lt;/li&gt;&lt;li&gt;Where production data is modified for use in pre-production, review the transformations applied to ensure all PII and other sensitive data is removed, obfuscated, or otherwise scrubbed.&lt;/li&gt;&lt;li&gt;Verify that pre-production data is not real, and does not constitute PII data.&lt;/li&gt;&lt;li&gt;Consider use of 'canaries' or other deliberately injected values in production to perform random searches in pre-production environments for data that has been inappropriately migrated or used.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
+                        practice and required minimum key lengths depend on the scenarios listed below.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
+            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
+            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
+                            &lt;br /&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
+                            bits&lt;/li&gt;
+                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:31.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="identify-sensitive-data" name="Identify the processed and stored sensitive data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a mechanism or procedures to identify all created and processed data by the application and classify it to determine which level of sensitivity each piece of data belongs to. Each data category can then be mapped to security rules necessary for each level of sensitivity. Therefore, we should create a policy explaining how sensitive data should be managed and processed.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;For example, public marketing information that is not sensitive may be categorized as public data which is fine to place on the public website. Credit card numbers may be classified as private user data which may need to be encrypted whilst stored or in transit.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify all sensitive data created and processed by the application has been identified, and ensure that a policy is in place detailing how to best to deal with this data.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.789">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
+          &lt;br /&gt;&lt;br /&gt;
+          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA. 
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+          </references>
+          <standards>
+            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                &lt;ol&gt;
+                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
+                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Overwrite memory with zeros or random data before release.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
+                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
+                            soon as they are not needed anymore.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:23:30.787">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="86" state="Recommended" owner="jrabe@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-115" issueId="" issueLink="" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1548.001" url="https://attack.mitre.org/techniques/T1548/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.002" url="https://attack.mitre.org/techniques/T1548/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.003" url="https://attack.mitre.org/techniques/T1548/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.004" url="https://attack.mitre.org/techniques/T1548/004"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" issueId="" issueLink="" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="VULN-SERVICE" issueId="" issueLink="" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1190" url="https://attack.mitre.org/techniques/T1190"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" issueId="" issueLink="" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="BACKUP-COMPROMISE" issueId="" issueLink="" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
+                                that data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                    <countermeasure ref="store-backups-securely" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                <countermeasure ref="store-backups-securely" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" issueId="" issueLink="" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="HOST-COMPROMISE" issueId="" issueLink="" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If sensitive data is stored or processed on the host, then should the host itself be
+                                compromised by an attacker, the confidentiality and/or the integrity of the data would
+                                also be at risk.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="PRE-PROD" issueId="" issueLink="" name="Sensitive data is exposed to unauthorised personnel in a pre-production environment" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Pre-production environments are usually available to a wide group of developers and
+                                testers who may not be authorized to view sensitive production data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-485-PREPROD">
+                  <countermeasures>
+                    <countermeasure ref="CWE-485-PREPROD" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-485-PREPROD" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-204" issueId="" issueLink="" name="An attacker examines a target application's cache for sensitive information in order to get at sensitive data" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker examines a target application's cache for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-226">
+                  <countermeasures>
+                    <countermeasure ref="CWE-226" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-524">
+                  <countermeasures>
+                    <countermeasure ref="CWE-524" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-226" mitigation="50"/>
+                <countermeasure ref="CWE-524" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-115" issueId="" issueLink="" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1548.001" url="https://attack.mitre.org/techniques/T1548/001"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.002" url="https://attack.mitre.org/techniques/T1548/002"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.003" url="https://attack.mitre.org/techniques/T1548/003"/>
+                <reference name="Mitre ATT&amp;CK Technique T1548.004" url="https://attack.mitre.org/techniques/T1548/004"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-37" issueId="" issueLink="" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="identify-sensitive-data" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-sensitive-data" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-158" issueId="" issueLink="" name="Sensitive data is compromised through network sniffing attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker monitoring network traffic between nodes of a public or multicast network.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic.&lt;/li&gt;&lt;li&gt;The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="70"/>
+                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="74d45fef-532c-46f7-9423-79a00a7ebfcb" diagramComponentId="cf26070f-ad8a-491b-a5bc-9d64064996cf" ref="3fd51d0d-e64d-427a-8f35-b2e1a64584f8" name="Out Of Scope" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="out-of-scope" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="trusted-partner"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="9b46ce04-3bf7-47d0-8423-ea2667d26cfa" diagramComponentId="f362dfe9-69a5-46e8-9717-d0ebba31488e" ref="a8e21836-69ca-4ed3-96b7-4b152a3a3a36" name="Router" desc="" library="IR-Network-Components" parentComponentRef="" componentDefinitionRef="CD-ROUTER" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.902">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.903">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ROUTER3" name="Limit Unnecessary Lateral Communications" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit Unnecessary Lateral Communications&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Allowing unfiltered peer-to-peer communications, including workstation-to-workstation, creates serious vulnerabilities and can allow a network intruder's access to spread easily to multiple systems. Once an intruder establishes an effective beachhead within the network, unfiltered lateral communications allow the intruder to create backdoors throughout the network. Backdoors help the intruder maintain persistence within the network and hinder defenders' efforts to contain and eradicate the intruder.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; - Restrict communications using host-based firewall rules to deny the flow of packets from other hosts in the network. The firewall rules can be created to filter on a host device, user, program, or internet protocol (IP) address to limit access from services and systems.&lt;br&gt; - Implement a VLAN access control list (VACL), a filter that controls access to and from VLANs. VACL filters should be created to deny packets the ability to flow to other VLANs.&lt;br&gt; - Logically segregate the network using physical or virtual separation, allowing network administrators to isolate critical devices onto network segments.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that you limit Unnecessary Lateral Communications&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.824">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-ROUTER2" name="Protect routers by controlling access lists for remote administration" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Protect routers by controlling access lists for remote administration&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; An access-control list is a list of permissions associated with a system resource. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.&lt;br&gt; Specifically for routers, an ACL is a list of permit or deny rules detailing what can or can't enter or leave the interface of a router. Every packet that attempts to enter or leave a router must be tested against each rule in the ACL until a match is found. If no match is found, then it will be denied.&lt;br&gt; It is highly recommended to protect routers by controlling access lists for remote administration.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Follow your device's guidelines to implement ACLs for remote administration.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that routers are protected by controlling access lists for remote administration.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.824">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-ROUTER1" name="Setup a strong combination of credentials" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Setup a strong combination of credentials (username/password) for the web interface of the router&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Having a strong combination of credentials can prevent unauthorized users from finding these credentials and gaining access to the web interface of the router.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; 1. Use a non-common username. For instance, avoid using common usernames, such as admin.&lt;/p&gt; 
+&lt;p&gt;2. The password length must be at least 12 characters.&lt;/p&gt; 
+&lt;p&gt;3. The complexity of the password is important. Use at least one digit, one lower-case character, one upper-case character, and one special character.&lt;/p&gt; 
+&lt;p&gt;4. The pair of username/password is unique. This means that these credentials cannot be used to gain access to any other application, say an email address.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that the credentials are strong and are not used in another application.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:41.823">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="CAPEC-16" issueId="" issueLink="" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references>
+                <reference name="Mitre ATT&amp;CK Technique T1110.001" url="https://attack.mitre.org/techniques/T1110/001"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="C-ROUTER1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ROUTER1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="CAPEC-1" issueId="" issueLink="" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="C-ROUTER2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ROUTER2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="T-WIDE-ATTACK-SURFACE" issueId="" issueLink="" name="Attackers try to take advantage of a wide attack surface" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Network-Components" editable="true">
+              <desc>	&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNNECESSARY-SERVICES">
+                  <countermeasures>
+                    <countermeasure ref="C-ROUTER3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ROUTER3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="8e7fe80e-5580-444d-9fd5-a1bf530f74d1" diagramComponentId="9246d860-db32-419c-8fe6-e8fa2eee14a0" ref="e6a9e3e2-8bd8-4ffd-8a55-beedcaa1f75e" name="Sensor" desc="" library="IR-Hardware-Components" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="CD-SENSOR" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.015">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.015">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:41.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:40.897">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:40.895">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:40.896">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:40.897">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T21:42:40.897">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="80c87caf-41c2-4eed-a449-cf3cf4c740c7" diagramComponentId="8ee485b8-6254-4a2d-a05e-339a27aabaff" ref="e148c09c-55cb-4b04-ba4b-e20911a1dbad" name="USB port" desc="" library="IR-Hardware-Components" parentComponentRef="eea9d511-2e18-4019-a530-8dbb142a431f" componentDefinitionRef="CD-USB-PORT" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.411">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.407">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-24T15:32:49.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="38ce062a-f5d4-4ee9-b338-4cec971269e4" diagramComponentId="19cdd2fb-4c94-4bb2-b7b8-3d08e1e60e3e" ref="c49d2e8c-310a-4618-9e97-40382c616251" name="Wi-Fi port" desc="" library="IR-Hardware-Components" parentComponentRef="57f3c399-34a3-4da3-ad31-ffa68abf92da" componentDefinitionRef="CD-WI-FI-PORT" generatedByRules="false" persistent="false">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings>
+        <issueTrackers>
+          <jira>
+            <fields/>
+          </jira>
+        </issueTrackers>
+      </settings>
+      <weaknesses>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.859">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-FIRMWARE-NOT-UPDATED" name="The firmware of the device is outdated" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The version of the firmware installed on a hardware device is not the latest version available.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-633" name="Weaknesses that Affect Memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category affect memory
+                        resources.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" name="Ensure that purpose-built/custom chipsets are not used if possible" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Custom chipsets continue to anchor a great deal of the hardware within corporate data centers or in high-end desktops. Because these purpose-built chips are tailored for niche purposes, manufacturer security reviews are not nearly as intense as those conducted for chips that are to be installed in much larger groups of devices. Over time, hackers find vulnerabilities in these chips, causing the manufacturer to scramble to find a patch.&lt;/p&gt;&lt;p&gt;When possible avoid using custom chipsets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.736">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" name="Protect local access to the device" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In many cases IoT, IIoT and smart building hardware can be accessed locally though a managed Ethernet or serial interface. If these connections aren't locked down -- from both a configuration and physical sense -- a bad actor may be able to compromise a company's infrastructure by tampering with these devices while visiting the office, warehouse or manufacturing plant.&lt;/p&gt;&lt;p&gt;Ensure that the local connections to these devices are protected enough to avoid physical attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+        <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" name="Update system firmware to latest version" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There's a set of steps to follow in order to update the firmware of a device:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know the model of your device and what firmware it uses&lt;/li&gt;&lt;li&gt;Check if there is a firmware update available for your device&lt;/li&gt;&lt;li&gt;Prepare your device for the firmware update&lt;ul&gt;&lt;li&gt;Read the &lt;strong&gt;Readme&lt;/strong&gt; file that is distributed with the new firmware update&lt;/li&gt;&lt;li&gt;Always use a &lt;strong&gt;reliable power supply&lt;/strong&gt; for your device during the firmware update process&lt;/li&gt;&lt;li&gt;If you use a computer to update a device's firmware, make sure that the computer has &lt;strong&gt;no third-party antivirus&lt;/strong&gt; running on it&lt;/li&gt;&lt;li&gt;If you're going to update the firmware on a device using a USB memory stick or any other kind of external memory, make sure that you use a memory stick of good quality&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Backup the current firmware from your device&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to do a firmware update for any kind of device" url="https://www.digitalcitizen.life/how-update-firmware-any-device-6-steps/"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="2.7" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.2" supportedStandardRef="swift-cscf"/>
+            <standard ref="6.3" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.3A" supportedStandardRef="swift-cscf"/>
+            <standard ref="7.4A" supportedStandardRef="swift-cscf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that the latest version of the firmware has been successfully installed by checking that the installed version is the same as the latest version.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2024-04-12T20:06:37.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+          <settings>
+            <issueTrackers>
+              <jira>
+                <fields/>
+              </jira>
+            </issueTrackers>
+          </settings>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Hardware-Components">
+          <threats>
+            <threat ref="T-FIRMWARE-EXPLOIT" issueId="" issueLink="" name="Attackers can perform malicious activity due to a vulnerability in the firmware of the device" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A device has a vulnerability that is used by malicious actors to exploit the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="W-FIRMWARE-NOT-UPDATED">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-UPDATE-FIRMWARE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="insecure-default-configuration" issueId="" issueLink="" name="Attackers gain access to credentials via insecure default configurations" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to sensitive data using known vulnerabilities in the default configuration. These configurations are not secure enough for production environments.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" issueId="" issueLink="" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-PROTECT-LOCAL-ACCESS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-100" issueId="" issueLink="" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-633">
+                  <countermeasures>
+                    <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HARDWARE-CUSTOM-CHIPSET" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+            <threat ref="CAPEC-112" issueId="" issueLink="" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="jrabe@iriusrisk.com" library="IR-Hardware-Components" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+              <settings>
+                <issueTrackers>
+                  <jira>
+                    <fields/>
+                  </jira>
+                </issueTrackers>
+              </settings>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+  <threadFixScans/>
+</project>

From fb7647ffcbef5501959920623f8e98c2c8c935b2 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 17:18:08 -0400
Subject: [PATCH 02/28] Add files via upload

---
 Integrations/Templates_Manager/Readme.md      | 28 +++++++++
 Integrations/Templates_Manager/config.py      | 12 ++++
 Integrations/Templates_Manager/setup.py       | 20 ++++++
 .../Templates_Manager/templates_manager.py    | 61 +++++++++++++++++++
 4 files changed, 121 insertions(+)
 create mode 100644 Integrations/Templates_Manager/Readme.md
 create mode 100644 Integrations/Templates_Manager/config.py
 create mode 100644 Integrations/Templates_Manager/setup.py
 create mode 100644 Integrations/Templates_Manager/templates_manager.py

diff --git a/Integrations/Templates_Manager/Readme.md b/Integrations/Templates_Manager/Readme.md
new file mode 100644
index 0000000..9007e04
--- /dev/null
+++ b/Integrations/Templates_Manager/Readme.md
@@ -0,0 +1,28 @@
+# Purpose
+
+The purpose of this script is to collect templates from a GitHub repo, download those locally to a local repo and then post those to the IriusRisk API. 
+
+# Installation
+
+Run the setup.py script to install the script dependencies
+
+```python
+python .\setup.py install
+```
+
+Update the config.py file with the required variables: 
+```python
+# API URL and Token
+url = "https://insert_your_domain.iriusrisk.com/api/v2/templates/import"
+api_token = 'insert_your_api_token'
+
+# GitHub
+repo_url = "insert_your_repo_root_url"
+repo_sub_folder = "insert_your_sub_folder_if_needed"
+```
+
+# Execute the download and import of templates
+
+```python
+python .\templates_manager.py 
+```
\ No newline at end of file
diff --git a/Integrations/Templates_Manager/config.py b/Integrations/Templates_Manager/config.py
new file mode 100644
index 0000000..88674c3
--- /dev/null
+++ b/Integrations/Templates_Manager/config.py
@@ -0,0 +1,12 @@
+
+
+# API URL and Token
+url = "https:/your_url.iriusrisk.com/api/v2/templates/import"
+api_token = 'your_api_key'
+
+
+
+# GitHub
+repo_url = "https://github.com/iriusrisk/IriusRisk-Central.git"
+
+repo_sub_folder = "Templates"
\ No newline at end of file
diff --git a/Integrations/Templates_Manager/setup.py b/Integrations/Templates_Manager/setup.py
new file mode 100644
index 0000000..050293a
--- /dev/null
+++ b/Integrations/Templates_Manager/setup.py
@@ -0,0 +1,20 @@
+from setuptools import setup, find_packages
+
+setup(
+    name='templates_manager',
+    version='1.0',
+    packages=find_packages(),
+    install_requires=[
+        'certifi>=2024.2.2',
+        'charset-normalizer>=3.3.2',
+        'gitdb>=4.0.11',
+        'GitPython>=3.1.43',
+        'idna>=3.7',
+        'pip>=22.3.1',
+        'requests>=2.31.0',
+        'setuptools>=65.5.1',
+        'smmap>=5.0.1',
+        'urllib3>=2.2.1',
+        'wheel>=0.38.4'
+    ],
+)
diff --git a/Integrations/Templates_Manager/templates_manager.py b/Integrations/Templates_Manager/templates_manager.py
new file mode 100644
index 0000000..7aa47f6
--- /dev/null
+++ b/Integrations/Templates_Manager/templates_manager.py
@@ -0,0 +1,61 @@
+from git import Repo
+import requests
+import os
+import config
+
+# Set up the path for cloning
+repo_path = os.path.join(os.getcwd(), "cloned_repo")
+repo_url = config.repo_url
+
+# Clone the repository if the directory doesn't exist
+if not os.path.exists(repo_path):
+    os.makedirs(repo_path)
+    Repo.clone_from(repo_url, repo_path)
+    print("Repository cloned successfully.")
+    print("Working on importing templates now...")
+else:
+    print("Directory already exists and is assumed to contain the necessary files.")
+    print("Working on importing templates now...")
+
+def get_files(directory, extension):
+    for root, dirs, files in os.walk(directory):
+        for file in files:
+            if file.endswith(extension):
+                yield os.path.join(root, file)
+
+# Define the directory where the Templates folder is located
+templates_dir = os.path.join(repo_path, config.repo_sub_folder)
+
+# Example usage: finding all XML files in the Templates directory
+files_to_process = list(get_files(templates_dir, ".xml"))
+
+# API URL and Token
+url = config.url
+api_token = config.api_token
+
+# Iterate over each XML file and send it
+for file_path in files_to_process:
+    with open(file_path, 'rb') as f:
+        # Use the filename (without extension) as the name
+        file_name = os.path.basename(file_path)
+        file_base_name = os.path.splitext(file_name)[0]
+
+        # Define the payload
+        files = {
+            'file': (file_name, f, 'application/xml'),
+            'name': (None, file_base_name.replace("-"," ").capitalize()),  # Using the filename without extension as the name
+            'referenceId': (None, file_base_name.lower())  # You may modify 'referenceId' as needed
+        }
+
+        headers = {
+            'Accept': 'application/hal+json',
+            'api-token': api_token
+        }
+
+        # Send the request
+        response = requests.post(url, headers=headers, files=files)
+
+        if response.status_code == 200:
+            print(file_base_name, "Successfully Imported!!!")
+        else:
+            print(f"File: {file_name}, Status Code: {response.status_code}, Response: {response.text}")

From e3dabd763b551697d7f67c467b12ccf691238c1d Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:13:14 -0400
Subject: [PATCH 03/28] Create Submitted_Templates

---
 Templates/Submitted_Templates | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 Templates/Submitted_Templates

diff --git a/Templates/Submitted_Templates b/Templates/Submitted_Templates
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/Templates/Submitted_Templates
@@ -0,0 +1 @@
+

From 145789a5c7afdc9b0379c8ba1ea746215cbaf4b7 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:13:39 -0400
Subject: [PATCH 04/28] Delete Templates/Submitted_Templates

---
 Templates/Submitted_Templates | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 Templates/Submitted_Templates

diff --git a/Templates/Submitted_Templates b/Templates/Submitted_Templates
deleted file mode 100644
index 8b13789..0000000
--- a/Templates/Submitted_Templates
+++ /dev/null
@@ -1 +0,0 @@
-

From d43ab2ae8ae1f5809f33ce8386d980337b00fa9e Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:15:45 -0400
Subject: [PATCH 05/28] Create README.MD

---
 Templates/Submitted_Templates/README.MD | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 Templates/Submitted_Templates/README.MD

diff --git a/Templates/Submitted_Templates/README.MD b/Templates/Submitted_Templates/README.MD
new file mode 100644
index 0000000..5f51e2c
--- /dev/null
+++ b/Templates/Submitted_Templates/README.MD
@@ -0,0 +1,3 @@
+# PURPOSE
+
+These files were submitted by community members for usage by the at large IriusRisk enterprise or community

From 485b7b693d37d6f13e942af7079f43fd83c6cd02 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:17:32 -0400
Subject: [PATCH 06/28] Delete
 Templates/3-tier-web-application-and-api-behind-load-balancer.xml

---
 ...plication-and-api-behind-load-balancer.xml | 531 ------------------
 1 file changed, 531 deletions(-)
 delete mode 100644 Templates/3-tier-web-application-and-api-behind-load-balancer.xml

diff --git a/Templates/3-tier-web-application-and-api-behind-load-balancer.xml b/Templates/3-tier-web-application-and-api-behind-load-balancer.xml
deleted file mode 100644
index 83139f8..0000000
--- a/Templates/3-tier-web-application-and-api-behind-load-balancer.xml
+++ /dev/null
@@ -1,531 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="3 Tier Web Application and API behind load balancer" name="3 Tier Web Application and API behind load balancer" tags="Community">
-  <desc>&lt;p&gt;Web Server/Application&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjc3MiIgZHk9IjE3MDciIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS4yLjAiPgogIDxyb290PgogICAgPG14Q2VsbCBpZD0iMCIvPgogICAgPG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+CiAgICA8bXhDZWxsIGlkPSI5IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMjQ2IiB5PSItNCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIzNTEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzIiB2YWx1ZT0iV2ViIENsaWVudCIgc3R5bGU9ImlyLnJlZj1hM2M2NzMxYy0zNTNjLTRiNTMtODFkMS1iMzU4YmVlNjFhZGM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjcwIiB5PSIyMDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjI1IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQiIHN0eWxlPSJpci5yZWY9ZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vYmlsZS1kZXZpY2UtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TlRBMk1qY2dNQzR4TWprMk16bERNQzR5T1RnME1qTWdNQzR4TWprMk16a2dNQzR5TlRZeE1EUWdNQzR4TnpFNU5UZ2dNQzR5TlRZeE1EUWdNQzR5TWpReE5qRldNQzQzT1RFeU9UZERNQzR5TlRZeE1EUWdNQzQ0TkRNMU1ERWdNQzR5T1RnME1qTWdNQzQ0T0RVNE1pQXdMak0xTURZeU55QXdMamc0TlRneVNEQXVOak0wTVRrMlF6QXVOamcyTXprNUlEQXVPRGcxT0RJZ01DNDNNamczTVRrZ01DNDRORE0xTURFZ01DNDNNamczTVRrZ01DNDNPVEV5T1RkV01DNHlNalF4TmpGRE1DNDNNamczTVRrZ01DNHhOekU1TlRnZ01DNDJPRFl6T1RrZ01DNHhNamsyTXprZ01DNDJNelF4T1RZZ01DNHhNamsyTXpsSU1DNHpOVEEyTWpkYVRUQXVNekkyT1RrMklEQXVNakV5TXpRMlF6QXVNekkyT1RrMklEQXVNVGs1TWprMUlEQXVNek0zTlRjMklEQXVNVGc0TnpFMUlEQXVNelV3TmpJM0lEQXVNVGc0TnpFMVNEQXVOak0wTVRrMlF6QXVOalEzTWpRM0lEQXVNVGc0TnpFMUlEQXVOalUzT0RJM0lEQXVNVGs1TWprMUlEQXVOalUzT0RJM0lEQXVNakV5TXpRMlZqQXVOek15TWpJeFF6QXVOalUzT0RJM0lEQXVOelExTWpjeElEQXVOalEzTWpRM0lEQXVOelUxT0RVeElEQXVOak0wTVRrMklEQXVOelUxT0RVeFNEQXVNelV3TmpJM1F6QXVNek0zTlRjMklEQXVOelUxT0RVeElEQXVNekkyT1RrMklEQXVOelExTWpjeElEQXVNekkyT1RrMklEQXVOek15TWpJeFZqQXVNakV5TXpRMldrMHdMalEyTkRnME1pQXdMamcxTURNM05FTXdMalEwT1RZeE5pQXdMamcxTURNM05DQXdMalF6TnpJM015QXdMamd6T0RBeklEQXVORE0zTWpjeklEQXVPREl5T0RBMFF6QXVORE0zTWpjeklEQXVPREEzTlRjNElEQXVORFE1TmpFMklEQXVOemsxTWpNMUlEQXVORFkwT0RReUlEQXVOemsxTWpNMVNEQXVOVEU1T1RoRE1DNDFNelV5TURZZ01DNDNPVFV5TXpVZ01DNDFORGMxTlNBd0xqZ3dOelUzT0NBd0xqVTBOelUxSURBdU9ESXlPREEwUXpBdU5UUTNOVFVnTUM0NE16Z3dNeUF3TGpVek5USXdOaUF3TGpnMU1ETTNOQ0F3TGpVeE9UazRJREF1T0RVd016YzBTREF1TkRZME9EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EQXdNalEwTVRReElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI5IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjEwIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzUiIHk9Ii0zNSIgd2lkdGg9Ijc5NSIgaGVpZ2h0PSI0MjkiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyOSIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UgLSZndDsgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YWZkMmNiMjMtZWQ3Mi00ODhkLWFkOTktY2ZmZDEzOGY1ZDU4O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTAiIHNvdXJjZT0iNyIgdGFyZ2V0PSI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cmVzdC1mdWxsLXdlYi1zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTROakU0TWlBd0xqSTBPVE0wTmtNd0xqTTROakU0TWlBd0xqSXpOVGc0TkNBd0xqTTVOekE1TlNBd0xqSXlORGszTVNBd0xqUXhNRFUxTnlBd0xqSXlORGszTVVnd0xqVTRPVE13TjBNd0xqWXdNamMyT1NBd0xqSXlORGszTVNBd0xqWXhNelk0TWlBd0xqSXpOVGc0TkNBd0xqWXhNelk0TWlBd0xqSTBPVE0wTmtNd0xqWXhNelk0TWlBd0xqSTJNamd3T0NBd0xqWXdNamMyT1NBd0xqSTNNemN5TVNBd0xqVTRPVE13TnlBd0xqSTNNemN5TVVnd0xqUXhNRFUxTjBNd0xqTTVOekE1TlNBd0xqSTNNemN5TVNBd0xqTTROakU0TWlBd0xqSTJNamd3T0NBd0xqTTROakU0TWlBd0xqSTBPVE0wTmxwTk1DNDBNVEExTlRjZ01DNDFPREkwTnpGRE1DNHpPVGN3T1RVZ01DNDFPREkwTnpFZ01DNHpPRFl4T0RJZ01DNDFPVE16T0RRZ01DNHpPRFl4T0RJZ01DNDJNRFk0TkRaRE1DNHpPRFl4T0RJZ01DNDJNakF6TURjZ01DNHpPVGN3T1RVZ01DNDJNekV5TWpFZ01DNDBNVEExTlRjZ01DNDJNekV5TWpGSU1DNDFNekk1TlRORE1DNDFNelkyTkRjZ01DNDJNVE0xTVRNZ01DNDFORE0yT0RZZ01DNDFPVGN3TXpJZ01DNDFOVE16T0NBd0xqVTRNalEzTVVnd0xqUXhNRFUxTjFwTk1DNDJORFl4T0RJZ01DNDFNakU1TjFZd0xqRTVNalEzTVVNd0xqWTBOakU0TWlBd0xqRTJOVFUwTnlBd0xqWXlORE0xTlNBd0xqRTBNemN5TVNBd0xqVTVOelF6TVNBd0xqRTBNemN5TVVnd0xqUXdNalF6TVVNd0xqTTNOVFV3TnlBd0xqRTBNemN5TVNBd0xqTTFNelk0TWlBd0xqRTJOVFUwTnlBd0xqTTFNelk0TWlBd0xqRTVNalEzTVZZd0xqWTBOelEzUXpBdU16VXpOamd5SURBdU5qYzBNemswSURBdU16YzFOVEEzSURBdU5qazJNakl4SURBdU5EQXlORE14SURBdU5qazJNakl4U0RBdU5UTTBOelEyUXpBdU5UTTVOVE01SURBdU56RTBNVFF5SURBdU5UUTNPREF4SURBdU56TXdOalEySURBdU5UVTROelkxSURBdU56UTBPVGN4U0RBdU5EQXlORE14UXpBdU16UTROVGcwSURBdU56UTBPVGN4SURBdU16QTBPVE15SURBdU56QXhNekU0SURBdU16QTBPVE15SURBdU5qUTNORGRXTUM0eE9USTBOekZETUM0ek1EUTVNeklnTUM0eE16ZzJNak1nTUM0ek5EZzFPRFFnTUM0d09UUTVOekEzSURBdU5EQXlORE14SURBdU1EazBPVGN3TjBnd0xqVTVOelF6TVVNd0xqWTFNVEkzT1NBd0xqQTVORGszTURjZ01DNDJPVFE1TXpJZ01DNHhNemcyTWpNZ01DNDJPVFE1TXpJZ01DNHhPVEkwTnpGV01DNDFNakl4TmpWRE1DNDJPRFk0TkRNZ01DNDFNakEzTVRFZ01DNDJOemcxTVRJZ01DNDFNVGs1TlRJZ01DNDJOekF3TURRZ01DNDFNVGs1TlRKRE1DNDJOakU0T0RNZ01DNDFNVGs1TlRJZ01DNDJOVE01TWpRZ01DNDFNakEyTkRNZ01DNDJORFl4T0RJZ01DNDFNakU1TjFwTk1DNHpPRFl4T0RJZ01DNDFNRGt6TkRaRE1DNHpPRFl4T0RJZ01DNDBPVFU0T0RRZ01DNHpPVGN3T1RVZ01DNDBPRFE1TnpFZ01DNDBNVEExTlRjZ01DNDBPRFE1TnpGSU1DNDFPRGt6TURkRE1DNDJNREkzTmprZ01DNDBPRFE1TnpFZ01DNDJNVE0yT0RJZ01DNDBPVFU0T0RRZ01DNDJNVE0yT0RJZ01DNDFNRGt6TkRaRE1DNDJNVE0yT0RJZ01DNDFNakk0TURnZ01DNDJNREkzTmprZ01DNDFNek0zTWlBd0xqVTRPVE13TnlBd0xqVXpNemN5U0RBdU5ERXdOVFUzUXpBdU16azNNRGsxSURBdU5UTXpOeklnTUM0ek9EWXhPRElnTUM0MU1qSTRNRGdnTUM0ek9EWXhPRElnTUM0MU1Ea3pORFphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16ZzRPREVnTUM0M01EVXdORGRJTUM0M01EQTNPVFJETUM0Mk9UUTFPVFVnTUM0M016YzNOaUF3TGpZNE1qRTRNU0F3TGpjMk1EQXlPQ0F3TGpZMk9UZ3pPQ0F3TGpjMk1EQXlPRU13TGpZMU56ZzJPQ0F3TGpjMk1EQXlPQ0F3TGpZME5UZ3pNaUF3TGpjek9UQTRPU0F3TGpZek9UUTJNU0F3TGpjd056azVNVXd3TGpZek9EZzRNU0F3TGpjd05UQTBOMGd3TGpjd01EYzVORWd3TGpZek9EZzRNVnBOTUM0MU9EQTBPVGdnTUM0M01EVXdORGhNTUM0Mk1qTTFOVE1nTUM0M01EVXdORFpETUM0Mk1qY3lNREVnTUM0M01qVTROamdnTUM0Mk16TXpPRE1nTUM0M05ETTFPRE1nTUM0Mk5ERTBOelVnTUM0M05UVTVPRU13TGpZeE5UZzBOeUF3TGpjME9EUXhNU0F3TGpVNU5EVXhNU0F3TGpjek1EZzJOQ0F3TGpVNE1UazJNU0F3TGpjd056Z3pOMHd3TGpVNE1EUTVPQ0F3TGpjd05UQTBPRnBOTUM0M01UWXhNaklnTUM0M01EVXdORFpNTUM0M05Ua3hOemdnTUM0M01EVXdORGhETUM0M05EWTROalVnTUM0M01qazBORFFnTUM0M01qUTROVFFnTUM0M05EZ3hNRGtnTUM0Mk9UZ3lNVEVnTUM0M05UVTVOemRETUM0M01EVTNOVFlnTUM0M05EUTBJREF1TnpFeE5qUXpJREF1TnpJNE1qQXhJREF1TnpFMU16VTVJREF1TnpBNU1UWTNUREF1TnpFMk1USXlJREF1TnpBMU1EUTJUREF1TnpVNU1UYzRJREF1TnpBMU1EUTRUREF1TnpFMk1USXlJREF1TnpBMU1EUTJXazB3TGpjeE9URTFNU0F3TGpZME1EQTBOMHd3TGpjMk56ZzFJREF1TmpRd01EUXhRekF1TnpZNU1UWXlJREF1TmpRMk5UQTBJREF1TnpZNU9EVXhJREF1TmpVek1Ua3pJREF1TnpZNU9EVXhJREF1TmpZd01EUXpRekF1TnpZNU9EVXhJREF1Tmpjd05EazNJREF1TnpZNE1qUTNJREF1Tmpnd05UYzFJREF1TnpZMU1qY3pJREF1Tmprd01EUTNTREF1TnpFNE1qUTNRekF1TnpFNU15QXdMalk0TURRM01TQXdMamN4T1RnMU1pQXdMalkzTURReElEQXVOekU1T0RVeUlEQXVOall3TURRelF6QXVOekU1T0RVeUlEQXVOalUxTlNBd0xqY3hPVGMwTmlBd0xqWTFNVEF4TmlBd0xqY3hPVFV6T0NBd0xqWTBOall3TlV3d0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4VERBdU56RTVNVFV4SURBdU5qUXdNRFEzV2swd0xqVTNNVGd5TlNBd0xqWTBNREEwTVV3d0xqWXlNRFV5TkNBd0xqWTBNREEwTjBNd0xqWXlNREEyTWlBd0xqWTBOalUwTmlBd0xqWXhPVGd5TXlBd0xqWTFNekl5T1NBd0xqWXhPVGd5TXlBd0xqWTJNREEwTTBNd0xqWXhPVGd5TXlBd0xqWTJPRE16TnlBd0xqWXlNREUzTmlBd0xqWTNOalF6TlNBd0xqWXlNRGcxTnlBd0xqWTROREkwTlV3d0xqWXlNVFF5T0NBd0xqWTVNREEwTjBnd0xqVTNORFF3TWtNd0xqVTNNVFF5T0NBd0xqWTRNRFUzTlNBd0xqVTJPVGd5TkNBd0xqWTNNRFE1TnlBd0xqVTJPVGd5TkNBd0xqWTJNREEwTTBNd0xqVTJPVGd5TkNBd0xqWTFNekU1TXlBd0xqVTNNRFV4TXlBd0xqWTBOalV3TkNBd0xqVTNNVGd5TlNBd0xqWTBNREEwTVZwTk1DNDJNelUxT1RNZ01DNDJOREF3TkRGSU1DNDNNRFF3T0RKRE1DNDNNRFExT0RRZ01DNDJORFkwT1RjZ01DNDNNRFE0TlRJZ01DNDJOVE14T0RZZ01DNDNNRFE0TlRJZ01DNDJOakF3TkRORE1DNDNNRFE0TlRJZ01DNDJOamcwTWlBd0xqY3dORFExTXlBd0xqWTNOalUwTkNBd0xqY3dNemN4TkNBd0xqWTRORE13TVV3d0xqY3dNekE1TnlBd0xqWTVNREEwT0Vnd0xqWXpOalUzT0VNd0xqWXpOVFEwTnlBd0xqWTRNRFU1SURBdU5qTTBPREl6SURBdU5qY3dOVEUwSURBdU5qTTBPREl6SURBdU5qWXdNRFF6UXpBdU5qTTBPREl6SURBdU5qVTBPU0F3TGpZek5EazNOQ0F3TGpZME9UZzFNaUF3TGpZek5USTJNU0F3TGpZME5Ea3lOa3d3TGpZek5UVTVNeUF3TGpZME1EQTBNVWd3TGpjd05EQTRNa2d3TGpZek5UVTVNMXBOTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNRekF1TnpJNE16Z3pJREF1TlRjek1ERTNJREF1TnpVeU5qSXpJREF1TlRrMU56Z3pJREF1TnpZek5UVTFJREF1TmpJMU1EUk1NQzQzTVRjMk5EY2dNQzQyTWpVd05ETkRNQzQzTVRRME9USWdNQzQyTURBNE56UWdNQzQzTURnd09ESWdNQzQxT0RBeE1UY2dNQzQyT1RreU9DQXdMalUyTlRneFREQXVOams0TWpBeElEQXVOVFkwTVRBM1REQXVOams1TWpnZ01DNDFOalU0TVZwTk1DNDJOREF5TlRZZ01DNDFOalEwTnpaTU1DNDJOREUwTnpRZ01DNDFOalF4TURoRE1DNDJNekkyTmpZZ01DNDFOemMyTURNZ01DNDJNall4TWlBd0xqVTVOek01T1NBd0xqWXlNalkwTkNBd0xqWXlNRFkwTlV3d0xqWXlNakF5T0NBd0xqWXlOVEEwTTB3d0xqVTNOakV5SURBdU5qSTFNRFJETUM0MU9EWTVNRFVnTUM0MU9UWXhOemdnTUM0Mk1UQTJOQ0F3TGpVM016WXpNeUF3TGpZME1ESTFOaUF3TGpVMk5EUTNOa3d3TGpZME1UUTNOQ0F3TGpVMk5ERXdPRXd3TGpZME1ESTFOaUF3TGpVMk5EUTNObHBOTUM0Mk5qazRNemdnTUM0MU5qQXdOVGxETUM0Mk9ETXdNalVnTUM0MU5qQXdOVGtnTUM0Mk9UWXlPVE1nTUM0MU9EVTBOellnTUM0M01ERTVOemNnTUM0Mk1qRTRPVE5NTUM0M01ESTBORFVnTUM0Mk1qVXdOREZJTUM0Mk16Y3lNME13TGpZME1qWXlOQ0F3TGpVNE5qazBPU0F3TGpZMU5qSTNNeUF3TGpVMk1EQTFPU0F3TGpZMk9UZ3pPQ0F3TGpVMk1EQTFPVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenh5WldOMElIZzlJakF1TVRrNU9UVXhJaUI1UFNJd0xqZ3lPVGsxTmlJZ2QybGtkR2c5SWpBdU5qQXlOallpSUdobGFXZG9kRDBpTUM0eE5ESXlNemNpSUhKNFBTSXdMakEzTVRFeE9EUWlJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakkzTlRFMUlEQXVPVFV5TWpFelF6QXVNalkyT1RFZ01DNDVOVEl3TlRNZ01DNHlOakEwTXlBd0xqazBPVFUzTXlBd0xqSTFOVGN4SURBdU9UUTBOemN6UXpBdU1qVXhNRGNnTUM0NU5EQXdOVFFnTUM0eU5EZzNOU0F3TGprek16RTNOQ0F3TGpJME9EYzFJREF1T1RJME1UTTBWakF1T1RFMk5qazBRekF1TWpRNE56VWdNQzQ1TVRNNU56UWdNQzR5TkRneU15QXdMamt4TVRnMU5DQXdMakkwTnpFNUlEQXVPVEV3TXpNMFF6QXVNalEyTVRVZ01DNDVNRGczTXpRZ01DNHlORFEyTnlBd0xqa3dOemt6TkNBd0xqSTBNamMxSURBdU9UQTNPVE0wU0RBdU1qTTVPVGxXTUM0NE9UVXpNelZJTUM0eU5ESTNOVU13TGpJME5EWTNJREF1T0RrMU16TTFJREF1TWpRMk1UVWdNQzQ0T1RRMU16VWdNQzR5TkRjeE9TQXdMamc1TWprek5VTXdMakkwT0RJeklEQXVPRGt4TXpNMUlEQXVNalE0TnpVZ01DNDRPRGt5TVRVZ01DNHlORGczTlNBd0xqZzROalUzTlZZd0xqZzNPVEkxTlVNd0xqSTBPRGMxSURBdU9EY3dNakUxSURBdU1qVXhNRGNnTUM0NE5qTXpNelVnTUM0eU5UVTNNU0F3TGpnMU9EWXhOVU13TGpJMk1EUXpJREF1T0RVek9EazFJREF1TWpZMk9URWdNQzQ0TlRFME1UWWdNQzR5TnpVeE5TQXdMamcxTVRFM05sWXdMamcyTXpjM05VTXdMakkyTmpreElEQXVPRFkwTWpVMUlEQXVNall5TnprZ01DNDROamcyT1RVZ01DNHlOakkzT1NBd0xqZzNOekE1TlZZd0xqZzROVE0zTlVNd0xqSTJNamM1SURBdU9Ea3dOREUxSURBdU1qWXhPVFVnTUM0NE9UUXlNVFVnTUM0eU5qQXlOeUF3TGpnNU5qYzNOVU13TGpJMU9EWTNJREF1T0RrNU1qVTBJREF1TWpVMk1qTWdNQzQ1TURBNE9UUWdNQzR5TlRJNU5TQXdMamt3TVRZNU5FTXdMakkxT1RVeElEQXVPVEF6TXpjMElEQXVNall5TnprZ01DNDVNRGc0TVRRZ01DNHlOakkzT1NBd0xqa3hPREF4TkZZd0xqa3lOakk1TkVNd0xqSTJNamM1SURBdU9UTTBPRFUwSURBdU1qWTJPVEVnTUM0NU16a3lPVFFnTUM0eU56VXhOU0F3TGprek9UWXhORll3TGprMU1qSXhNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlPVEF4TlRZZ01DNDVNelkyTVRSV01DNDROVEkyTVRaSU1DNHpNamN6TlRaRE1DNHpNemN3TXpZZ01DNDROVEkyTVRZZ01DNHpORFF3TXpZZ01DNDROVFV3TVRVZ01DNHpORGd6TlRZZ01DNDROVGs0TVRWRE1DNHpOVEkzTlRZZ01DNDROalEyTVRVZ01DNHpOVFE1TlRZZ01DNDROekEzTXpVZ01DNHpOVFE1TlRZZ01DNDROemd4TnpWRE1DNHpOVFE1TlRZZ01DNDRPRE16TnpVZ01DNHpOVE0wTnpZZ01DNDRPRGd5TlRVZ01DNHpOVEExTVRZZ01DNDRPVEk0TVRWRE1DNHpORGMxTlRZZ01DNDRPVGN6TnpVZ01DNHpORE15TnpZZ01DNDVNREEwT1RRZ01DNHpNemMyTnpZZ01DNDVNREl4TnpSTU1DNHpOVFEwTnpZZ01DNDVNelkyTVRSSU1DNHpNemd5TnpaTU1DNHpNakl3TnpZZ01DNDVNRE0zTXpSSU1DNHpNRFExTlRaV01DNDVNelkyTVRSSU1DNHlPVEF4TlRaYVRUQXVNekEwTlRVMklEQXVPRGt3TURVMVNEQXVNekkzTlRrMlF6QXVNek14T1RFMklEQXVPRGt3TURVMUlEQXVNek0xTURjMklEQXVPRGc0T1RNMUlEQXVNek0zTURjMklEQXVPRGcyTmprMVF6QXVNek01TURjMklEQXVPRGcwTkRVMUlEQXVNelF3TURjMklEQXVPRGd4TmpFMUlEQXVNelF3TURjMklEQXVPRGM0TVRjMVF6QXVNelF3TURjMklEQXVPRGMwT0RFMUlEQXVNek01TVRFMklEQXVPRGN5TURFMUlEQXVNek0zTVRrMklEQXVPRFk1TnpjMVF6QXVNek0xTWpjMklEQXVPRFkzTkRVMUlEQXVNek15TURjMklEQXVPRFkyTWprMUlEQXVNekkzTlRrMklEQXVPRFkyTWprMVNEQXVNekEwTlRVMlZqQXVPRGt3TURVMVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNM01qTXdOQ0F3TGprek5qWXhORll3TGpnMU1qWXhOa2d3TGpReU56QXlORll3TGpnMk5qRTNOVWd3TGpNNE5qY3dORll3TGpnNE5qUTFOVWd3TGpReE1UVTBORll3TGprd01EQXhORWd3TGpNNE5qY3dORll3TGpreU16QTFORWd3TGpReU9UWTJORll3TGprek5qWXhORWd3TGpNM01qTXdORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBOekkzTnpnZ01DNDVNemd3TlRSRE1DNDBOalV3T1RnZ01DNDVNemd3TlRRZ01DNDBOVGcwTlRnZ01DNDVNell4TXpRZ01DNDBOVEk0TlRnZ01DNDVNekl5T1RSRE1DNDBORGN6TXpnZ01DNDVNamd6TnpRZ01DNDBORE0wTVRnZ01DNDVNak13TlRRZ01DNDBOREV3T1RnZ01DNDVNVFl6TXpSTU1DNDBOVFEwTVRnZ01DNDVNVEUwTVRSRE1DNDBOVFl4TnpnZ01DNDVNVFV6TXpRZ01DNDBOVGcyT1RnZ01DNDVNVGcwT1RRZ01DNDBOakU1TnpnZ01DNDVNakE0T1RSRE1DNDBOalV5TlRnZ01DNDVNak15TVRRZ01DNDBOamt3TVRnZ01DNDVNalF6TnpRZ01DNDBOek15TlRnZ01DNDVNalF6TnpSRE1DNDBOemMyTlRnZ01DNDVNalF6TnpRZ01DNDBPREV4TXpnZ01DNDVNak16TnpRZ01DNDBPRE0yT1RnZ01DNDVNakV6TnpSRE1DNDBPRFl6TXpnZ01DNDVNVGt6TnpRZ01DNDBPRGMyTlRnZ01DNDVNVFkwT1RRZ01DNDBPRGMyTlRnZ01DNDVNVEkzTXpSRE1DNDBPRGMyTlRnZ01DNDVNVEV5TVRRZ01DNDBPRGN5T1RnZ01DNDVNRGs0TVRRZ01DNDBPRFkxTnpnZ01DNDVNRGcxTXpSRE1DNDBPRFU0TlRnZ01DNDVNRGN4TnpRZ01DNDBPRFV3TVRnZ01DNDVNRFl3TlRRZ01DNDBPRFF3TlRnZ01DNDVNRFV4TnpSRE1DNDBPRE14TnpnZ01DNDVNRFF5T1RRZ01DNDBPREU0TVRnZ01DNDVNRE0wTVRRZ01DNDBOems1TnpnZ01DNDVNREkxTXpSRE1DNDBOemd4TXpnZ01DNDVNREUyTlRRZ01DNDBOelkxTnpnZ01DNDVNREE1TnpRZ01DNDBOelV5T1RnZ01DNDVNREEwT1RSRE1DNDBOelF3TVRnZ01DNDRPVGs1TXpRZ01DNDBOekl4TXpnZ01DNDRPVGt5TlRRZ01DNDBOamsyTlRnZ01DNDRPVGcwTlRSRE1DNDBOalkwTlRnZ01DNDRPVGN6TXpVZ01DNDBOak01TnpnZ01DNDRPVFkwTlRVZ01DNDBOakl5TVRnZ01DNDRPVFU0TVRWRE1DNDBOakExTXpnZ01DNDRPVFV4TnpVZ01DNDBOVGd6TXpnZ01DNDRPVFF4TXpVZ01DNDBOVFUyTVRnZ01DNDRPVEkyT1RWRE1DNDBOVEk1TnpnZ01DNDRPVEV4TnpVZ01DNDBOVEE1TXpnZ01DNDRPRGsyTlRVZ01DNDBORGswT1RnZ01DNDRPRGd4TXpWRE1DNDBORGd4TXpnZ01DNDRPRFkyTVRVZ01DNDBORFk0T1RnZ01DNDRPRFEyTVRVZ01DNDBORFUzTnpnZ01DNDRPREl4TXpWRE1DNDBORFEzTXpnZ01DNDROemsxTnpVZ01DNDBORFF5TVRnZ01DNDROelkzTnpVZ01DNDBORFF5TVRnZ01DNDROek0zTXpWRE1DNDBORFF5TVRnZ01DNDROamN6TXpVZ01DNDBORFkyT1RnZ01DNDROakU1TnpVZ01DNDBOVEUyTlRnZ01DNDROVGMyTlRWRE1DNDBOVFkyTVRnZ01DNDROVE16TXpZZ01DNDBOak16TXpnZ01DNDROVEV4TnpZZ01DNDBOekU0TVRnZ01DNDROVEV4TnpaRE1DNDBOemc0TlRnZ01DNDROVEV4TnpZZ01DNDBPRFEyT1RnZ01DNDROVEk0TlRZZ01DNDBPRGt6TXpnZ01DNDROVFl5TVRWRE1DNDBPVE01TnpnZ01DNDROVGswT1RVZ01DNDBPVGN3T1RnZ01DNDROak00TVRVZ01DNDBPVGcyT1RnZ01DNDROamt4TnpWTU1DNDBPRFUzTXpnZ01DNDROek0wT1RWRE1DNDBPRE14TnpnZ01DNDROamMzTXpVZ01DNDBOemd5TVRnZ01DNDROalE0TlRVZ01DNDBOekE0TlRnZ01DNDROalE0TlRWRE1DNDBOamN3T1RnZ01DNDROalE0TlRVZ01DNDBOalF4TXpnZ01DNDROalUyTlRVZ01DNDBOakU1TnpnZ01DNDROamN5TlRWRE1DNDBOVGs0T1RnZ01DNDROamczTnpVZ01DNDBOVGc0TlRnZ01DNDROekE1TnpVZ01DNDBOVGc0TlRnZ01DNDROek00TlRWRE1DNDBOVGc0TlRnZ01DNDROelUzTnpVZ01DNDBOVGsyTlRnZ01DNDROemMwT1RVZ01DNDBOakV5TlRnZ01DNDROemt3TVRWRE1DNDBOakk1TXpnZ01DNDRPREExTXpVZ01DNDBOalEyT1RnZ01DNDRPREUyT1RVZ01DNDBOalkxTXpnZ01DNDRPREkwT1RWRE1DNDBOamcwTlRnZ01DNDRPRE15TVRVZ01DNDBOekV5TlRnZ01DNDRPRFF4TnpVZ01DNDBOelE1TXpnZ01DNDRPRFV6TnpWRE1DNDBOemN6TXpnZ01DNDRPRFl5TlRVZ01DNDBOemt4TXpnZ01DNDRPRFk1TXpVZ01DNDBPREF6TXpnZ01DNDRPRGMwTVRWRE1DNDBPREUyTVRnZ01DNDRPRGM0TVRVZ01DNDBPRE16TnpnZ01DNDRPRGcxTXpVZ01DNDBPRFUyTVRnZ01DNDRPRGsxTnpWRE1DNDBPRGM0TlRnZ01DNDRPVEEyTVRVZ01DNDBPRGsyTVRnZ01DNDRPVEUxTnpVZ01DNDBPVEE0T1RnZ01DNDRPVEkwTlRWRE1DNDBPVEl4TnpnZ01DNDRPVE15TlRVZ01DNDBPVE0yTVRnZ01DNDRPVFF6TnpVZ01DNDBPVFV5TVRnZ01DNDRPVFU0TVRWRE1DNDBPVFk0T1RnZ01DNDRPVGN5TlRVZ01DNDBPVGd4TnpnZ01DNDRPVGczTnpRZ01DNDBPVGt3TlRnZ01DNDVNREF6TnpSRE1DNDBPVGs1TXpnZ01DNDVNREU0T1RRZ01DNDFNREEyT1RnZ01DNDVNRE0zTXpRZ01DNDFNREV6TXpnZ01DNDVNRFU0T1RSRE1DNDFNREU1TnpnZ01DNDVNRGM1TnpRZ01DNDFNREl5T1RnZ01DNDVNVEF5TlRRZ01DNDFNREl5T1RnZ01DNDVNVEkzTXpSRE1DNDFNREl5T1RnZ01DNDVNakExTnpRZ01DNDBPVGswT1RnZ01DNDVNalkzTnpRZ01DNDBPVE00T1RnZ01DNDVNekV6TXpSRE1DNDBPRGd6TnpnZ01DNDVNelU0TVRRZ01DNDBPREV6TXpnZ01DNDVNemd3TlRRZ01DNDBOekkzTnpnZ01DNDVNemd3TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVeU1ESWdNQzQ0TmpZME1UVldNQzQ1TXpZMk1UUklNQzQxTXpjMk1sWXdMamcyTmpReE5VZ3dMalV4TXpjMFZqQXVPRFV5TmpFMlNEQXVOVGMxT1ZZd0xqZzJOalF4TlVnd0xqVTFNakF5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TlRRek5TQXdMamc0TnpVek5WWXdMamt6TmpZeE5FZ3dMalU1TVRNNU5WWXdMamc0TnpVek5VZ3dMalU0TWpVeE5WWXdMamczTlRJNU5VZ3dMalU1TVRNNU5WWXdMamcyTlRZNU5VTXdMalU1TVRNNU5TQXdMamcxTmpBeE5TQXdMalU1TmpJek5TQXdMamcxTVRFM05pQXdMall3TlRreE5TQXdMamcxTVRFM05rTXdMall4TURjNU5TQXdMamcxTVRFM05pQXdMall4TlRFeE5TQXdMamcxTWpFek5pQXdMall4T0RnM05TQXdMamcxTkRBMU5WWXdMamcyTlRVM05VTXdMall4TlRVNU5TQXdMamcyTkRJeE5TQXdMall4TWpZM05TQXdMamcyTXpVek5TQXdMall4TURFeE5TQXdMamcyTXpVek5VTXdMall3TmprNU5TQXdMamcyTXpVek5TQXdMall3TlRRek5TQXdMamcyTlRFek5TQXdMall3TlRRek5TQXdMamcyT0RNek5WWXdMamczTlRJNU5VZ3dMall4T0RnM05WWXdMamc0TnpVek5VZ3dMall3TlRRek5Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qWXpOVFFnTUM0NU16WTJNVFJXTUM0NU16QTNNelJETUM0Mk5qSTFNVFFnTUM0NU16VTJNVFFnTUM0Mk5UY3hOVFFnTUM0NU16Z3dOVFFnTUM0Mk5UQXlOelFnTUM0NU16Z3dOVFJETUM0Mk5ETTROelFnTUM0NU16Z3dOVFFnTUM0Mk16ZzJNelFnTUM0NU16WXdOVFFnTUM0Mk16UTFOVFFnTUM0NU16SXdOVFJETUM0Mk16QTBOelFnTUM0NU1qYzVOelFnTUM0Mk1qZzBNelFnTUM0NU1qRTFOelFnTUM0Mk1qZzBNelFnTUM0NU1USTROVFJXTUM0NE56VXlPVFZJTUM0Mk5ESTBOelJXTUM0NU1UQXpNelJETUM0Mk5ESTBOelFnTUM0NU1UazROVFFnTUM0Mk5EWXpNVFFnTUM0NU1qUTJNVFFnTUM0Mk5UTTVPVFFnTUM0NU1qUTJNVFJETUM0Mk5qSXlNelFnTUM0NU1qUTJNVFFnTUM0Mk5qWXpOVFFnTUM0NU1UazVNelFnTUM0Mk5qWXpOVFFnTUM0NU1UQTFOelJXTUM0NE56VXlPVFZJTUM0Mk9EQXpPVFJXTUM0NU16WTJNVFJJTUM0Mk5qWXpOVFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOams1TURBNUlEQXVPVE0yTmpFMFZqQXVPRFUyTlRjMVREQXVOekV6TURRNUlEQXVPRFE1T1RjMlZqQXVPVE0yTmpFMFNEQXVOams1TURBNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjeU56UTVJREF1T1RVeU1qRXpWakF1T1RNNU5qRTBRekF1TnpNMU9ERWdNQzQ1TXpreU1UUWdNQzQzTXprNU55QXdMamt6TkRjM05DQXdMamN6T1RrM0lEQXVPVEkyTWprMFZqQXVPVEU0TURFMFF6QXVOek01T1RjZ01DNDVNRGc0TVRRZ01DNDNORE15TlNBd0xqa3dNek0zTkNBd0xqYzBPVGd4SURBdU9UQXhOamswUXpBdU56UTJOVE1nTUM0NU1EQTRPVFFnTUM0M05EUXdOU0F3TGpnNU9USTFOQ0F3TGpjME1qTTNJREF1T0RrMk56YzFRekF1TnpRd056Y2dNQzQ0T1RReU1UVWdNQzQzTXprNU55QXdMamc1TURReE5TQXdMamN6T1RrM0lEQXVPRGcxTXpjMVZqQXVPRGMzTURrMVF6QXVOek01T1RjZ01DNDROamcyT1RVZ01DNDNNelU0TVNBd0xqZzJOREkxTlNBd0xqY3lOelE1SURBdU9EWXpOemMxVmpBdU9EVXhNVGMyUXpBdU56TTFOek1nTUM0NE5URTBNVFlnTUM0M05ESXlNU0F3TGpnMU16a3pOU0F3TGpjME5qa3pJREF1T0RVNE56TTFRekF1TnpVeE5qVWdNQzQ0TmpNME5UVWdNQzQzTlRRd01TQXdMamczTURJNU5TQXdMamMxTkRBeElEQXVPRGM1TWpVMVZqQXVPRGcyTlRjMVF6QXVOelUwTURFZ01DNDRPRGt5TVRVZ01DNDNOVFExTXlBd0xqZzVNVE16TlNBd0xqYzFOVFUzSURBdU9Ea3lPVE0xUXpBdU56VTJOakVnTUM0NE9UUTFNelVnTUM0M05UZ3dPU0F3TGpnNU5UTXpOU0F3TGpjMk1EQXhJREF1T0RrMU16TTFTREF1TnpZeU5qVldNQzQ1TURjNU16UklNQzQzTmpBd01VTXdMamMxT0RBNUlEQXVPVEEzT1RNMElEQXVOelUyTmpFZ01DNDVNRGczTXpRZ01DNDNOVFUxTnlBd0xqa3hNRE16TkVNd0xqYzFORFV6SURBdU9URXhPRFUwSURBdU56VTBNREVnTUM0NU1UTTVOelFnTUM0M05UUXdNU0F3TGpreE5qWTVORll3TGpreU5ERXpORU13TGpjMU5EQXhJREF1T1RNek1UYzBJREF1TnpVeE5qVWdNQzQ1TkRBd05UUWdNQzQzTkRZNU15QXdMamswTkRjM00wTXdMamMwTWpJeElEQXVPVFE1TlRjeklEQXVOek0xTnpNZ01DNDVOVEl3TlRNZ01DNDNNamMwT1NBd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpjNElpQm9aV2xuYUhROUlqQXVOemdpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpFd09UZzJNeUF3TGpBek1EQXlPVE1wSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjI1OSIgeT0iMjAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9NGEwY2NmYzUtNjg0Mi00YjUwLWJkODgtZjUyMWFlZjE2NmE0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTAiIHNvdXJjZT0iNiIgdGFyZ2V0PSI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtJmd0OyBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxMCIgc291cmNlPSI4IiB0YXJnZXQ9IjQiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iV2ViIFNlcnZpY2UgLSZndDsgT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzM7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxMCIgc291cmNlPSI4IiB0YXJnZXQ9IjExIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNCIgdmFsdWU9IldlYiBTZXJ2aWNlIC0mZ3Q7IE1pY3Jvc29mdCBBenVyZSBTZXJ2aWNlIEJ1cyBNZXNzYWdpbmciIHN0eWxlPSJpci5yZWY9NmQ0ODZmMjItOWQ1NS00NDc5LTgyM2UtNDc4NWQzMzdkYmNiO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iOCIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI0IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMTYiIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0mZ3Q7IFJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YTRiMDBhZmYtNzI1NS00ZGJmLWEzN2UtMjNkMmUzZDIwZjc3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iMjciIHRhcmdldD0iNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwOCIgeT0iMTIwLjc0MTkzNTQ4Mzg3MDk4IiBhcz0ic291cmNlUG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkxvYWQgQmFsYW5jZXIgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDYzYjg4YWMtNjI1MS00ODE2LTllNzYtMmFjZmRlNGJhY2QyO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iMjciIHRhcmdldD0iNiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwOCIgeT0iMTcwLjMyMjU4MDY0NTE2MTIyIiBhcz0ic291cmNlUG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyMyIgdmFsdWU9Ik1pY3Jvc29mdCBBenVyZSBTZXJ2aWNlIEJ1cyBNZXNzYWdpbmciIHN0eWxlPSJpci5yZWY9ZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1JQ1JPU09GVC1BWlVSRS1TRVItQlVTLU1TRztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RTNNRGxmTWpVeU5UTXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMakU1TXprNU5pQXdMakl3TnpjMk5FZ3dMakkwTXpjNE0xWXdMak0wTlRVME5rTXdMakkwTXpjNE15QXdMak0wT0RVeE5DQXdMakkwTWpZd015QXdMak0xTVRNMk1TQXdMakkwTURVd05DQXdMak0xTXpRMlF6QXVNak00TkRBMUlEQXVNelUxTlRVNUlEQXVNak0xTlRVNUlEQXVNelUyTnpNNElEQXVNak15TlRrZ01DNHpOVFkzTXpoSU1DNHhPRE14T0RsRE1DNHhPREF5TWpFZ01DNHpOVFkzTXpnZ01DNHhOemN6TnpRZ01DNHpOVFUxTlRrZ01DNHhOelV5TnpVZ01DNHpOVE0wTmtNd0xqRTNNekUzTmlBd0xqTTFNVE0yTVNBd0xqRTNNVGs1TnlBd0xqTTBPRFV4TkNBd0xqRTNNVGs1TnlBd0xqTTBOVFUwTmxZd0xqSXlPVGMyTWtNd0xqRTNNVGs1TnlBd0xqSXlNemt5T0NBd0xqRTNORE14TlNBd0xqSXhPRE16TXlBd0xqRTNPRFEwSURBdU1qRTBNakEzUXpBdU1UZ3lOVFkySURBdU1qRXdNRGd4SURBdU1UZzRNVFl4SURBdU1qQTNOelkwSURBdU1Ua3pPVGsySURBdU1qQTNOelkwVmpBdU1qQTNOelkwV2lJZ1ptbHNiRDBpSXprNU9UazVPU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDFJaUJrUFNKTk1DNHhPVE01T1RZZ01DNHlNRGMzTmpSSU1DNHlORE0zT0ROV01DNHpORFUxTkRaRE1DNHlORE0zT0RNZ01DNHpORGcxTVRRZ01DNHlOREkyTURNZ01DNHpOVEV6TmpFZ01DNHlOREExTURRZ01DNHpOVE0wTmtNd0xqSXpPRFF3TlNBd0xqTTFOVFUxT1NBd0xqSXpOVFUxT1NBd0xqTTFOamN6T0NBd0xqSXpNalU1SURBdU16VTJOek00U0RBdU1UZ3pNVGc1UXpBdU1UZ3dNakl4SURBdU16VTJOek00SURBdU1UYzNNemMwSURBdU16VTFOVFU1SURBdU1UYzFNamMxSURBdU16VXpORFpETUM0eE56TXhOellnTUM0ek5URXpOakVnTUM0eE56RTVPVGNnTUM0ek5EZzFNVFFnTUM0eE56RTVPVGNnTUM0ek5EVTFORFpXTUM0eU1qazNOakpETUM0eE56RTVPVGNnTUM0eU1qTTVNamdnTUM0eE56UXpNVFVnTUM0eU1UZ3pNek1nTUM0eE56ZzBOQ0F3TGpJeE5ESXdOME13TGpFNE1qVTJOaUF3TGpJeE1EQTRNU0F3TGpFNE9ERTJNU0F3TGpJd056YzJOQ0F3TGpFNU16azVOaUF3TGpJd056YzJORll3TGpJd056YzJORm9pSUdacGJHdzlJaU01T1RrNU9Ua2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMxTmpNME9DQXdMakl3TnpjMk5FZ3dMamd3TmpFek5FTXdMamd4TVRrMk9TQXdMakl3TnpjMk5DQXdMamd4TnpVMk5DQXdMakl4TURBNE1TQXdMamd5TVRZNUlEQXVNakUwTWpBM1F6QXVPREkxT0RFMUlEQXVNakU0TXpNeklEQXVPREk0TVRNeklEQXVNakl6T1RJNElEQXVPREk0TVRNeklEQXVNakk1TnpZeVZqQXVNelExTlRRMlF6QXVPREk0TVRNeklEQXVNelE0TlRFMElEQXVPREkyT1RVMElEQXVNelV4TXpZeElEQXVPREkwT0RVMUlEQXVNelV6TkRaRE1DNDRNakkzTlRZZ01DNHpOVFUxTlRrZ01DNDRNVGs1TURrZ01DNHpOVFkzTXpnZ01DNDRNVFk1TkRFZ01DNHpOVFkzTXpoSU1DNDNOamN4TlRSRE1DNDNOalF5TlRNZ01DNHpOVFkyTXpnZ01DNDNOakUxTURRZ01DNHpOVFUwTVRVZ01DNDNOVGswT0RnZ01DNHpOVE16TWpaRE1DNDNOVGMwTnpJZ01DNHpOVEV5TXpnZ01DNDNOVFl6TkRZZ01DNHpORGcwTkRnZ01DNDNOVFl6TkRnZ01DNHpORFUxTkRaV01DNHlNRGMzTmpSYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMxTmpNME9DQXdMakl3TnpjMk5FZ3dMamd3TmpFek5FTXdMamd4TVRrMk9TQXdMakl3TnpjMk5DQXdMamd4TnpVMk5DQXdMakl4TURBNE1TQXdMamd5TVRZNUlEQXVNakUwTWpBM1F6QXVPREkxT0RFMUlEQXVNakU0TXpNeklEQXVPREk0TVRNeklEQXVNakl6T1RJNElEQXVPREk0TVRNeklEQXVNakk1TnpZeVZqQXVNelExTlRRMlF6QXVPREk0TVRNeklEQXVNelE0TlRFMElEQXVPREkyT1RVMElEQXVNelV4TXpZeElEQXVPREkwT0RVMUlEQXVNelV6TkRaRE1DNDRNakkzTlRZZ01DNHpOVFUxTlRrZ01DNDRNVGs1TURrZ01DNHpOVFkzTXpnZ01DNDRNVFk1TkRFZ01DNHpOVFkzTXpoSU1DNDNOamN4TlRSRE1DNDNOalF5TlRNZ01DNHpOVFkyTXpnZ01DNDNOakUxTURRZ01DNHpOVFUwTVRVZ01DNDNOVGswT0RnZ01DNHpOVE16TWpaRE1DNDNOVGMwTnpJZ01DNHpOVEV5TXpnZ01DNDNOVFl6TkRZZ01DNHpORGcwTkRnZ01DNDNOVFl6TkRnZ01DNHpORFUxTkRaV01DNHlNRGMzTmpSYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qZ3hNalVnTUM0eU1qazNOakpXTUM0eU56Z3dNRFZNTUM0eE56SXdNalFnTUM0eU56Z3dNRFZXTUM0eU1qazNOakpETUM0eE56SXdNalFnTUM0eU1qTTVNamdnTUM0eE56UXpORElnTUM0eU1UZ3pNeklnTUM0eE56ZzBOamNnTUM0eU1UUXlNRGRETUM0eE9ESTFPVE1nTUM0eU1UQXdPREVnTUM0eE9EZ3hPRGdnTUM0eU1EYzNOalFnTUM0eE9UUXdNak1nTUM0eU1EYzNOalJNTUM0NE1EWTFNVElnTUM0eU1EYzNOalJETUM0NE1USXlPQ0F3TGpJd056ZzJOU0F3TGpneE56YzNOaUF3TGpJeE1ESXlOeUF3TGpneU1UZ3hPU0F3TGpJeE5ETTBNa013TGpneU5UZzJNU0F3TGpJeE9EUTFOaUF3TGpneU9ERXlOaUF3TGpJeU16azVOQ0F3TGpneU9ERXlOU0F3TGpJeU9UYzJNbFl3TGpJeU9UYzJNbG9pSUdacGJHdzlJaU01TkRrME9UUWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakU0TXpJMUlEQXVOalF4T0RRMlNEQXVNak16TURNMlF6QXVNak0yTURBMUlEQXVOalF4T0RRMklEQXVNak00T0RVeElEQXVOalF6TURJMUlEQXVNalF3T1RVZ01DNDJORFV4TWpSRE1DNHlORE13TkRrZ01DNDJORGN5TWpNZ01DNHlORFF5TWprZ01DNDJOVEF3TnlBd0xqSTBOREl5T1NBd0xqWTFNekF6T0ZZd0xqYzVNVGszTjBnd0xqRTVOREExTmtNd0xqRTVNVEUyTnlBd0xqYzVNVGszTnlBd0xqRTRPRE13TmlBd0xqYzVNVFF3T0NBd0xqRTROVFl6TnlBd0xqYzVNRE13TWtNd0xqRTRNamsyT0NBd0xqYzRPVEU1TnlBd0xqRTRNRFUwTXlBd0xqYzROelUzTmlBd0xqRTNPRFVnTUM0M09EVTFNelJETUM0eE56UXpOelVnTUM0M09ERTBNRGdnTUM0eE56SXdOVGNnTUM0M056VTRNVE1nTUM0eE56SXdOVGNnTUM0M05qazVOemhXTUM0Mk5UUXhPVFpETUM0eE56RTRPVFFnTUM0Mk5USTJNeklnTUM0eE56SXdOak1nTUM0Mk5URXdOVEVnTUM0eE56STFOVElnTUM0Mk5EazFOVGRETUM0eE56TXdOREVnTUM0Mk5EZ3dOaklnTUM0eE56TTROQ0F3TGpZME5qWTROeUF3TGpFM05EZzVOaUF3TGpZME5UVXlNa013TGpFM05UazFNaUF3TGpZME5ETTFOeUF3TGpFM056STBNaUF3TGpZME16UXlOeUF3TGpFM09EWTRNU0F3TGpZME1qYzVORU13TGpFNE1ERXlJREF1TmpReU1UWWdNQzR4T0RFMk56Y2dNQzQyTkRFNE16Y2dNQzR4T0RNeU5TQXdMalkwTVRnME5sWXdMalkwTVRnME5sb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JRzl3WVdOcGRIazlJakF1TlNJZ1pEMGlUVEF1TVRnek1qVWdNQzQyTkRFNE5EWklNQzR5TXpNd016WkRNQzR5TXpZd01EVWdNQzQyTkRFNE5EWWdNQzR5TXpnNE5URWdNQzQyTkRNd01qVWdNQzR5TkRBNU5TQXdMalkwTlRFeU5FTXdMakkwTXpBME9TQXdMalkwTnpJeU15QXdMakkwTkRJeU9TQXdMalkxTURBM0lEQXVNalEwTWpJNUlEQXVOalV6TURNNFZqQXVOemt4T1RjM1NEQXVNVGswTURVMlF6QXVNVGt4TVRZM0lEQXVOemt4T1RjM0lEQXVNVGc0TXpBMklEQXVOemt4TkRBNElEQXVNVGcxTmpNM0lEQXVOemt3TXpBeVF6QXVNVGd5T1RZNElEQXVOemc1TVRrM0lEQXVNVGd3TlRReklEQXVOemczTlRjMklEQXVNVGM0TlNBd0xqYzROVFV6TkVNd0xqRTNORE0zTlNBd0xqYzRNVFF3T0NBd0xqRTNNakExTnlBd0xqYzNOVGd4TXlBd0xqRTNNakExTnlBd0xqYzJPVGszT0ZZd0xqWTFOREU1TmtNd0xqRTNNVGc1TkNBd0xqWTFNall6TWlBd0xqRTNNakEyTXlBd0xqWTFNVEExTVNBd0xqRTNNalUxTWlBd0xqWTBPVFUxTjBNd0xqRTNNekEwTVNBd0xqWTBPREEyTWlBd0xqRTNNemcwSURBdU5qUTJOamczSURBdU1UYzBPRGsySURBdU5qUTFOVEl5UXpBdU1UYzFPVFV5SURBdU5qUTBNelUzSURBdU1UYzNNalF5SURBdU5qUXpOREkzSURBdU1UYzROamd4SURBdU5qUXlOemswUXpBdU1UZ3dNVElnTUM0Mk5ESXhOaUF3TGpFNE1UWTNOeUF3TGpZME1UZ3pOeUF3TGpFNE16STFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOelkzTWpFMUlEQXVOalF4T0RRMlNEQXVPREUzTURBeVF6QXVPREU1T1RjZ01DNDJOREU0TkRZZ01DNDRNakk0TVRjZ01DNDJORE13TWpVZ01DNDRNalE1TVRZZ01DNDJORFV4TWpSRE1DNDRNamN3TVRVZ01DNDJORGN5TWpNZ01DNDRNamd4T1RRZ01DNDJOVEF3TnlBd0xqZ3lPREU1TkNBd0xqWTFNekF6T0ZZd0xqYzJPRGd5UXpBdU9ESTRNVGswSURBdU56YzBOalUxSURBdU9ESTFPRGMzSURBdU56Z3dNalVnTUM0NE1qRTNOVEVnTUM0M09EUXpOelZETUM0NE1UYzJNalVnTUM0M09EZzFNREVnTUM0NE1USXdNeUF3TGpjNU1EZ3hPU0F3TGpnd05qRTVOU0F3TGpjNU1EZ3hPVWd3TGpjMU5qUXdPRll3TGpZMU5ERTVOa013TGpjMU5qSTBPQ0F3TGpZMU1qWTJOQ0F3TGpjMU5qUXdOaUF3TGpZMU1URXhOU0F3TGpjMU5qZzNNaUF3TGpZME9UWTBOME13TGpjMU56TXpPQ0F3TGpZME9ERTNPU0F3TGpjMU9ERXdNeUF3TGpZME5qZ3lNaUF3TGpjMU9URXhOeUF3TGpZME5UWTJNME13TGpjMk1ERXpNU0F3TGpZME5EVXdOQ0F3TGpjMk1UTTNOQ0F3TGpZME16VTJOaUF3TGpjMk1qYzJPQ0F3TGpZME1qa3hRekF1TnpZME1UWXhJREF1TmpReU1qVXpJREF1TnpZMU5qYzFJREF1TmpReE9Ea2dNQzQzTmpjeU1UVWdNQzQyTkRFNE5EWldNQzQyTkRFNE5EWmFJaUJtYVd4c1BTSWpPVGs1T1RrNUlpOCtKaU40WVRzOGNHRjBhQ0J2Y0dGamFYUjVQU0l3TGpVaUlHUTlJazB3TGpjMk56SXhOU0F3TGpZME1UZzBOa2d3TGpneE56QXdNa013TGpneE9UazNJREF1TmpReE9EUTJJREF1T0RJeU9ERTNJREF1TmpRek1ESTFJREF1T0RJME9URTJJREF1TmpRMU1USTBRekF1T0RJM01ERTFJREF1TmpRM01qSXpJREF1T0RJNE1UazBJREF1TmpVd01EY2dNQzQ0TWpneE9UUWdNQzQyTlRNd016aFdNQzQzTmpnNE1rTXdMamd5T0RFNU5DQXdMamMzTkRZMU5TQXdMamd5TlRnM055QXdMamM0TURJMUlEQXVPREl4TnpVeElEQXVOemcwTXpjMVF6QXVPREUzTmpJMUlEQXVOemc0TlRBeElEQXVPREV5TURNZ01DNDNPVEE0TVRrZ01DNDRNRFl4T1RVZ01DNDNPVEE0TVRsSU1DNDNOVFkwTURoV01DNDJOVFF4T1RaRE1DNDNOVFl5TkRnZ01DNDJOVEkyTmpRZ01DNDNOVFkwTURZZ01DNDJOVEV4TVRVZ01DNDNOVFk0TnpJZ01DNDJORGsyTkRkRE1DNDNOVGN6TXpnZ01DNDJORGd4TnprZ01DNDNOVGd4TURNZ01DNDJORFk0TWpJZ01DNDNOVGt4TVRjZ01DNDJORFUyTmpORE1DNDNOakF4TXpFZ01DNDJORFExTURRZ01DNDNOakV6TnpRZ01DNDJORE0xTmpZZ01DNDNOakkzTmpnZ01DNDJOREk1TVVNd0xqYzJOREUyTVNBd0xqWTBNakkxTXlBd0xqYzJOVFkzTlNBd0xqWTBNVGc1SURBdU56WTNNakUxSURBdU5qUXhPRFEyVmpBdU5qUXhPRFEyV2lJZ1ptbHNiRDBpSXprNU9UazVPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TVRjeE9UazNJREF1TnpZNU9UazBWakF1TnpJeE56VXlTREF1T0RJNE1EazVWakF1TnpZNU9UazBRekF1T0RJNE1EazVJREF1TnpjMU9ESTRJREF1T0RJMU56Z3hJREF1TnpneE5ESXpJREF1T0RJeE5qVTJJREF1TnpnMU5UUTVRekF1T0RFM05UTWdNQzQzT0RrMk56UWdNQzQ0TVRFNU16VWdNQzQzT1RFNU9USWdNQzQ0TURZeElEQXVOemt4T1RreVNEQXVNVGt6T1RrMlF6QXVNVGc0TVRZeElEQXVOemt4T1RreUlEQXVNVGd5TlRZMklEQXVOemc1TmpjMElEQXVNVGM0TkRRZ01DNDNPRFUxTkRsRE1DNHhOelF6TVRVZ01DNDNPREUwTWpNZ01DNHhOekU1T1RjZ01DNDNOelU0TWpnZ01DNHhOekU1T1RjZ01DNDNOams1T1RSV01DNDNOams1T1RSYUlpQm1hV3hzUFNJak9UUTVORGswSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU9USTBPQ0F3TGpNMk1ETTFNbFl3TGpZek1qYzVPVXd3TGpRNU56WXdNeUF3TGpRNU5qWTVOMHd3TGpJNU1qUTRJREF1TXpZd016VXlXaUlnWm1sc2JEMGlJek15UWtWRVJDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF5TmpneElEQXVNell3TkRFMlREQXVORGszTlRVNUlEQXVORGsyTnpaTU1DNDNNREk1TWpRZ01DNDJNekkyTVRoRE1DNDNNREkwTXpnZ01DNDJNamN5TnpFZ01DNDNNREkyT0RFZ01DNHpOVFUxTlRVZ01DNDNNREkyT0RFZ01DNHpOakEwTVRaYUlpQm1hV3hzUFNJak1UazRRVUl6SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME9UWTROelVnTUM0ME9UWTRNalpNTUM0eU9USTBPQ0F3TGpZek1qWTRPRWd3TGpjd01qUTROVll3TGpZek1qUTBOVXd3TGpRNU5qZzNOU0F3TGpRNU5qZ3lObG9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF3WDJ4cGJtVmhjbDh4TnpBNVh6STFNalV6S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qa3lORGdnTUM0ek5qQXpOVEpJTUM0M01ESTNNalpNTUM0ME9UazNPU0F3TGpVeE9UYzROVU13TGpRNU9EVTJOaUF3TGpVeU1EY3hNaUF3TGpRNU56QTNNeUF3TGpVeU1USXhNeUF3TGpRNU5UVXpOeUF3TGpVeU1USXhNME13TGpRNU5EQXdNaUF3TGpVeU1USXhNeUF3TGpRNU1qVXdPQ0F3TGpVeU1EY3hNaUF3TGpRNU1USTROQ0F3TGpVeE9UYzROVXd3TGpJNU1qUTRJREF1TXpZd016VXlXaUlnWm1sc2JEMGlJelV3UlRaR1JpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhKZk1UY3dPVjh5TlRJMU15SWdlREU5SWpBdU5EazNOakEwSWlCNU1UMGlNQzQwT1RZNE1qWWlJSGd5UFNJd0xqUTVOell3TkNJZ2VUSTlJakF1TmpNeU9UTXhJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqTURBMVFrRXhJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU1qWWlJSE4wYjNBdFkyOXNiM0k5SWlNd01EVTRPVVFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDFNeUlnYzNSdmNDMWpiMnh2Y2owaUl6QXdORVk1TUNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMamdpSUhOMGIzQXRZMjlzYjNJOUlpTXdNRE5HTjBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUl6QXdNekEyTnlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVGN3T1Y4eU5USTFNeUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9EQXdNREVpSUdobGFXZG9kRDBpTUM0NE9EQXdNREVpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBMk1EQTFPRFlnTUM0d05qQXdOVGcyS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NDUiIHk9IjI4MyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMjciIHZhbHVlPSJMb2FkIEJhbGFuY2VyIiBzdHlsZT0iaXIucmVmPTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1MT0FELUJBTEFOQ0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01GOHlORFUzWHpJek1qQXdLU0krUEhCaGRHZ2daRDBpVFRBdU16VXdPRE15SURBdU1qYzVOVGMxUXpBdU16VTNOVEF4SURBdU1qQTJNRFV6SURBdU5ERTVOams0SURBdU1UUTRORE00SURBdU5EazFORFFnTUM0eE5EZzBNemhETUM0MU56RXhPRElnTUM0eE5EZzBNemdnTUM0Mk16TXpOemtnTUM0eU1EWXdOVE1nTUM0Mk5EQXdORGdnTUM0eU56azFOelZJTUM0Mk5ETTVORU13TGpjd01EUXpPU0F3TGpJM09UVTNOU0F3TGpjME5qSTBJREF1TXpJMU1EYzNJREF1TnpRMk1qUWdNQzR6T0RFeU1EWkRNQzQzTkRZeU5DQXdMalF6TnpNek5pQXdMamN3TURRek9TQXdMalE0TWpnek55QXdMalkwTXprMElEQXVORGd5T0RNM1NEQXVNelEyT1RSRE1DNHlPVEEwTkRFZ01DNDBPREk0TXpjZ01DNHlORFEyTkNBd0xqUXpOek16TmlBd0xqSTBORFkwSURBdU16Z3hNakEyUXpBdU1qUTBOalFnTUM0ek1qVXdOemNnTUM0eU9UQTBOREVnTUM0eU56azFOelVnTUM0ek5EWTVOQ0F3TGpJM09UVTNOVWd3TGpNMU1EZ3pNbHBOTUM0ME9UVTBOQ0F3TGpFNE1USXlNa013TGpRek16UTNOQ0F3TGpFNE1USXlNaUF3TGpNNE16STBJREF1TWpNeE1USTNJREF1TXpnek1qUWdNQzR5T1RJMk9EaFdNQzR5T1RVNU5qZERNQzR6T0RNeU5DQXdMak13TlRBeUlEQXVNemMxT0RVeklEQXVNekV5TXpVNUlEQXVNelkyTnpRZ01DNHpNVEl6TlRsSU1DNHpORFk1TkVNd0xqTXdPRFkyTnlBd0xqTXhNak0xT1NBd0xqSTNOelkwSURBdU16UXpNVGd6SURBdU1qYzNOalFnTUM0ek9ERXlNRFpETUM0eU56YzJOQ0F3TGpReE9USXlPU0F3TGpNd09EWTJOeUF3TGpRMU1EQTFNeUF3TGpNME5qazBJREF1TkRVd01EVXpTREF1TmpRek9UUkRNQzQyT0RJeU1UTWdNQzQwTlRBd05UTWdNQzQzTVRNeU5DQXdMalF4T1RJeU9TQXdMamN4TXpJMElEQXVNemd4TWpBMlF6QXVOekV6TWpRZ01DNHpORE14T0RNZ01DNDJPREl5TVRNZ01DNHpNVEl6TlRrZ01DNDJORE01TkNBd0xqTXhNak0xT1Vnd0xqWXlOREUwUXpBdU5qRTFNREkzSURBdU16RXlNelU1SURBdU5qQTNOalFnTUM0ek1EVXdNaUF3TGpZd056WTBJREF1TWprMU9UWTNWakF1TWpreU5qZzRRekF1TmpBM05qUWdNQzR5TXpFeE1qY2dNQzQxTlRjME1EWWdNQzR4T0RFeU1qSWdNQzQwT1RVME5DQXdMakU0TVRJeU1sb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NDhjR0YwYUNCa1BTSk5NQzQwT1RFd05DQXdMalEyTlRJek4wZ3dMalV3T0RZMFZqQXVOalkzTmpNM1NEQXVORGt4TURSV01DNDBOalV5TXpkYUlpQm1hV3hzUFNJak1FSkJNRUkzSWk4K1BIQmhkR2dnWkQwaVRUQXVNamszTkRRZ01DNDFPRGcwTXpkRE1DNHlPVGMwTkNBd0xqVTRNelUzTnlBd0xqTXdNVE00SURBdU5UYzVOak0zSURBdU16QTJNalFnTUM0MU56azJNemRETUM0ek1URXhJREF1TlRjNU5qTTNJREF1TXpFMU1EUWdNQzQxT0RNMU56Y2dNQzR6TVRVd05DQXdMalU0T0RRek4xWXdMalkyTnpZek4wTXdMak14TlRBMElEQXVOamN5TkRrNElEQXVNekV4TVNBd0xqWTNOalF6TnlBd0xqTXdOakkwSURBdU5qYzJORE0zUXpBdU16QXhNemdnTUM0Mk56WTBNemNnTUM0eU9UYzBOQ0F3TGpZM01qUTVPQ0F3TGpJNU56UTBJREF1TmpZM05qTTNWakF1TlRnNE5ETTNXaUlnWm1sc2JEMGlJekJDUVRCQ055SXZQanh3WVhSb0lHUTlJazB3TGpZNU16UTBJREF1TlRnNE5ETTNRekF1Tmprek5EUWdNQzQxT0RNMU56Y2dNQzQyT1Rjek9DQXdMalUzT1RZek55QXdMamN3TWpJMElEQXVOVGM1TmpNM1F6QXVOekEzTVNBd0xqVTNPVFl6TnlBd0xqY3hNVEEwSURBdU5UZ3pOVGMzSURBdU56RXhNRFFnTUM0MU9EZzBNemRXTUM0Mk5qYzJNemRETUM0M01URXdOQ0F3TGpZM01qUTVPQ0F3TGpjd056RWdNQzQyTnpZME16Y2dNQzQzTURJeU5DQXdMalkzTmpRek4wTXdMalk1TnpNNElEQXVOamMyTkRNM0lEQXVOamt6TkRRZ01DNDJOekkwT1RnZ01DNDJPVE0wTkNBd0xqWTJOell6TjFZd0xqVTRPRFF6TjFvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JrUFNKTk1DNDNNREl5TkNBd0xqVTNPVFl6TjFZd0xqVTVOekl6TjBnd0xqTXdOakkwVmpBdU5UYzVOak0zU0RBdU56QXlNalJhSWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMakkxTXpRMElEQXVOamcxTWpNM1ZqQXVOemt3T0RNM1NEQXVNelU1TURSV01DNDJPRFV5TXpkSU1DNHlOVE0wTkZwTk1DNHlORFEyTkNBd0xqWTJOell6TjBNd0xqSXpPVGM0SURBdU5qWTNOak0zSURBdU1qTTFPRFFnTUM0Mk56RTFOemNnTUM0eU16VTROQ0F3TGpZM05qUXpOMVl3TGpjNU9UWXpOME13TGpJek5UZzBJREF1T0RBME5EazRJREF1TWpNNU56Z2dNQzQ0TURnME16Y2dNQzR5TkRRMk5DQXdMamd3T0RRek4wZ3dMak0yTnpnMFF6QXVNemN5TnlBd0xqZ3dPRFF6TnlBd0xqTTNOalkwSURBdU9EQTBORGs0SURBdU16YzJOalFnTUM0M09UazJNemRXTUM0Mk56WTBNemRETUM0ek56WTJOQ0F3TGpZM01UVTNOeUF3TGpNM01qY2dNQzQyTmpjMk16Y2dNQzR6TmpjNE5DQXdMalkyTnpZek4wZ3dMakkwTkRZMFdpSWdabWxzYkQwaUl6QkNRVEJDTnlJdlBqeHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EazBOQ0F3TGpZNE5USXpOMVl3TGpjNU1EZ3pOMGd3TGpjMU5UQTBWakF1TmpnMU1qTTNTREF1TmpRNU5EUmFUVEF1TmpRd05qUWdNQzQyTmpjMk16ZERNQzQyTXpVM09DQXdMalkyTnpZek55QXdMall6TVRnMElEQXVOamN4TlRjM0lEQXVOak14T0RRZ01DNDJOelkwTXpkV01DNDNPVGsyTXpkRE1DNDJNekU0TkNBd0xqZ3dORFE1T0NBd0xqWXpOVGM0SURBdU9EQTRORE0zSURBdU5qUXdOalFnTUM0NE1EZzBNemRJTUM0M05qTTRORU13TGpjMk9EY2dNQzQ0TURnME16Y2dNQzQzTnpJMk5DQXdMamd3TkRRNU9DQXdMamMzTWpZMElEQXVOems1TmpNM1ZqQXVOamMyTkRNM1F6QXVOemN5TmpRZ01DNDJOekUxTnpjZ01DNDNOamczSURBdU5qWTNOak0zSURBdU56WXpPRFFnTUM0Mk5qYzJNemRJTUM0Mk5EQTJORm9pSUdacGJHdzlJaU13UWtFd1FqY2lMejQ4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVORGs1T0RRZ01DNDNPVEE0TXpkTU1DNDFOakE0TURnZ01DNDJPRFV5TXpkSU1DNDBNemc0TnpKTU1DNDBPVGs0TkNBd0xqYzVNRGd6TjFwTk1DNDBPVEl5TVRrZ01DNDRNVEk0TXpkRE1DNDBPVFUyTURZZ01DNDRNVGczTURRZ01DNDFNRFF3TnpRZ01DNDRNVGczTURRZ01DNDFNRGMwTmpFZ01DNDRNVEk0TXpkTU1DNDFPRE0yTnpFZ01DNDJPREE0TXpkRE1DNDFPRGN3TlRnZ01DNDJOelE1TnpFZ01DNDFPREk0TWpRZ01DNDJOamMyTXpjZ01DNDFOell3TlNBd0xqWTJOell6TjBnd0xqUXlNell6UXpBdU5ERTJPRFUxSURBdU5qWTNOak0zSURBdU5ERXlOakl5SURBdU5qYzBPVGN4SURBdU5ERTJNREE1SURBdU5qZ3dPRE0zVERBdU5Ea3lNakU1SURBdU9ERXlPRE0zV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGp3dlp6NDhaR1ZtY3o0OFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6STBOVGRmTWpNeU1EQWlQanh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9Ijk3IiB5PSI5OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMTUiIHZhbHVlPSJXZWIgQ2xpZW50IC0mZ3Q7IExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9MTg3MGE3YzAtMWQ5ZC00OGVhLTgwMDgtMGUzZmZlMWQ0MDYxO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbnRyeVg9MDtlbnRyeVk9MC43NTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIxIiBzb3VyY2U9IjMiIHRhcmdldD0iMjciIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCB4PSIyMDUiIHk9IjEyMy44NTAyMDI0MjkxNDk3IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNiIgdmFsdWU9Ik1vYmlsZSBEZXZpY2UgQ2xpZW50IC0mZ3Q7IExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9Mjg1NGQ0OGYtM2NhZi00NzVkLTk4OGItOGI1OTViODdmNDYwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgc291cmNlPSIyNSIgdGFyZ2V0PSIyNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwNSIgeT0iMTA4Ljg4MTE3NDg5OTg2NjQ0IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgPC9yb290Pgo8L214R3JhcGhNb2RlbD4K</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Web Client -&gt; Load Balancer" ref="1870a7c0-1d9d-48ea-8008-0e3ffe1d4061" source="a076c1e1-f412-473c-85af-2bc811522b81" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other database" ref="1d56ec2a-8a66-4fe3-9293-a379a44704eb" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Mobile Device Client -&gt; Load Balancer" ref="2854d48f-3caf-475d-988b-8b595b87f460" source="84938d4c-4d32-4de6-a1be-c852de621214" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other data store" ref="2b0b8f3f-64fc-4915-97b8-d21e0dbe6633" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; Web Service" ref="4a0ccfc5-6842-4b50-bd88-f521aef166a4" source="6466e1cd-f115-44bf-9962-548b27fca47a" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="6d486f22-9d55-4479-823e-4785d337dbcb" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Load Balancer -&gt; RESTful Web Service" ref="a4b00aff-7255-4dbf-a37e-23d2e3d20f77" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="RESTful Web Service -&gt; Web Service" ref="afd2cb23-ed72-488d-ad99-cffd138f5d58" source="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Load Balancer -&gt; Web Application - Server side" ref="d63b88ac-6251-4816-9e76-2acfde4bacd2" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="6466e1cd-f115-44bf-9962-548b27fca47a">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="b36abde1-f1d7-4b65-9cf1-74bd1bf678ac" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.480">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jamesrabe@outlook.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.273">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="598c7abe-3b72-4a85-9510-d8df88d6b473" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="73e59e3e-c7d5-4ed3-b6cf-557591cbefe3" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="22330e4d-e9d5-4518-b8a0-387832c7ba89" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="415e1aea-f929-46f4-b7bb-d5cd25c6238a" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.397">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jamesrabe@outlook.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
-&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
-&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
-&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
-&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
-&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
-          </references>
-          <standards>
-            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1a0d321c-3a44-4f54-990a-50e5632acbc9" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="aeb45ed7-5b3e-4dbd-b49c-5f40915df150" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="a718bf82-090d-428f-b632-db46f0a27c23" diagramComponentId="7ef03c40-e025-445c-9ef6-3ac910aac821" ref="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" name="Load Balancer" desc="" library="IR-Network-Components" parentComponentRef="" componentDefinitionRef="CD-LOAD-BALANCER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.907">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-LOAD-BALANCER2" name="Enable all access logs for Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jamesrabe@outlook.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable all access logs for Load Balancers&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Logging should be configured to meet your organizational security and privacy policies. Enabling detailed logging to include information about events, event sources, timestamps, and users may assist in incident response activities.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable all access logs for Load Balancers.&lt;/p&gt; 
-&lt;p&gt;Please see Reference links for more information and examples.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Logging with Load Balancer" url="https://www.ibm.com/docs/en/was-zos/9.0.5?topic=SS7K4U_9.0.5/com.ibm.websphere.edge.doc/lb/tprf_log.htm"/>
-            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that the access logs are created when a user is visiting the load balancer.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.852">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-LOAD-BALANCER1" name="Use SSL Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jamesrabe@outlook.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use SSL Load Balancers&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; An SSL load balancer is a load balancer that also performs encryption and decryption of data transported via HTTPS, which uses the Secure Sockets Layer (SSL) protocol or its successor, the Transport Layer Security (TLS) protocol, to secure HTTP data as it crosses the network. Encryption of sensitive information protects against potential attackers and man-in-the-middle attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; An SSL load balancer acts as the server-side SSL endpoint for connections with clients, meaning that it performs the decryption of requests and encryption of responses that the web or application server would otherwise have to do. The process varies somewhat depending on the security of the network between the load balancer and server:&lt;/p&gt; 
-&lt;p&gt;- If the load balancer and server are on the same secured network (generally this means being behind a firewall), the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and forward the request to the server in the clear (unencrypted). It encrypts the server's response before returning it to the client.&lt;br&gt; - If the network between the load balancer and server is not secure, the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and re-encrypt the request before forwarding it to the server. The process is reversed for the response from server to client.&lt;/p&gt; 
-&lt;p&gt;Offloading the decryption and encryption process, which is computationally intensive, frees web and application servers to perform the work they are designed for, which speeds content delivery and improves the overall user experience. If the network between load balancer and servers is secure, you only need to install and manage the SSL certificates on the load balancer instead of every web and application server. This significantly reduces administrative overhead if the group of servers is large.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What Is an SSL Load Balancer?" url="https://www.nginx.com/resources/glossary/ssl-load-balancer/#:~:text=An%20SSL%20load%20balancer%20is,as%20it%20crosses%20the%20network."/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that you are using an SSL load balancer.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.851">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="IR-Network-Components">
-          <threats>
-            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="IR-Network-Components" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="IR-Network-Components">
-          <threats>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="IR-Network-Components" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="11be6883-6c1c-4400-af6a-baa210f2f619" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-  </components>
-</template>

From fcaf3a4fc34edeb10b483083069b16e75baffbc8 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:17:55 -0400
Subject: [PATCH 07/28] Delete Templates/README.md

---
 Templates/README.md | 30 ------------------------------
 1 file changed, 30 deletions(-)
 delete mode 100644 Templates/README.md

diff --git a/Templates/README.md b/Templates/README.md
deleted file mode 100644
index 36952dc..0000000
--- a/Templates/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-## Templates
-Templates are common architectures that can be resused as an IriusRisk project, or be added as a part of a project. Take the following steps:
-
-1. Dowload the rquired template file (.xml format)
-2. Go to to your IriusRisk instance
-3. Go to Templates
-4. Click Import Template and select the .xml file
-5. Click the Import button.
-
-### Template List
-* 3-tier-web-application-and-api-behind-load-balancer.xml
-* aws-environment-template.xml
-* aws-siem-and-cloudwatch.xml
-* aws-simple-infrastructure-with-waf.xml
-* aws-web-application-remote-access-web-ui-access.xml
-* azure-general-network-architecture.xml
-* azure-mqtt-client-to-azure-functions-and-web-backend.xml
-* external-user-access-through-vpn.xml
-* gcp-cloud-architecture.xml
-* generic-web-service.xml
-* kubernetes-deployment.xml
-* llm-template-template.xml
-* mobile-client-to-kubernetes-cluster-with-istio.xml
-* nwe-autorizacion-de-operaciones.xml
-* README.md
-* sample-system-template.xml
-* simple-3-tier-web-application.xml
-* simple-web-app.xml
-* st-generator-form-template.xml
-* sap-hana-on-gcp.xml
\ No newline at end of file

From 16c086a00b4a9a1811525bee08bc2f68da8e08b0 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:18:16 -0400
Subject: [PATCH 08/28] Delete Templates/aws-environment-template.xml

---
 Templates/aws-environment-template.xml | 21475 -----------------------
 1 file changed, 21475 deletions(-)
 delete mode 100644 Templates/aws-environment-template.xml

diff --git a/Templates/aws-environment-template.xml b/Templates/aws-environment-template.xml
deleted file mode 100644
index ed5a169..0000000
--- a/Templates/aws-environment-template.xml
+++ /dev/null
@@ -1,21475 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="aws-environment-template" name="aws-environment template" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjA2MiIgZHk9Ijc2OSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjEuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjIiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMTEwIiB5PSIzNSIgd2lkdGg9Ijk5MSIgaGVpZ2h0PSI1NDEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyMCIgdmFsdWU9IldBRiIgc3R5bGU9ImlyLnJlZj04MWE0OWFlMC1hOWQwLTRhMDktYTk0YS05ODA0YTFjMmJmZDI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyMSIgeT0iMjQwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJWUEMgLSBWaXJ0dWFsIFByaXZhdGUgQ2xvdWQiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNJalJUTkdRMFpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPRFU1TkNBd0xqWXlNRE5JTUM0eU9Ua3lOek5ETUM0eU1qWXlNRFlnTUM0Mk1qQXpJREF1TVRjd016UWdNQzQxTnpFMUlEQXVNVFkyTmpBMklEQXVOVEEwTkRNelF6QXVNVFkyTmpBMklEQXVOVEF4TmpNeklEQXVNVFkyTmpBMklEQXVORGs0TkRNeklEQXVNVFkyTmpBMklEQXVORGsxTWpNelF6QXVNVFkxTkRjeElEQXVORFkzTkRBNElEQXVNVGN6T0RBM0lEQXVORFF3TURJeElEQXVNVGt3TWpVeElEQXVOREUzTlRRMlF6QXVNakEyTmprMUlEQXVNemsxTURjeElEQXVNak13TWpjMklEQXVNemM0T0RNNUlEQXVNalUzTVRRZ01DNHpOekUxUXpBdU1qVTNNVFFnTUM0ek5qYzVJREF1TWpVM01UUWdNQzR6TmpRME16TWdNQzR5TlRjeE5DQXdMak0yTURnek0wTXdMakkxTnpneE1pQXdMak15TkRrek55QXdMakkyT1RBNU5DQXdMakk1TURBME5DQXdMakk0T1RVMk15QXdMakkyTURVME9VTXdMak14TURBek15QXdMakl6TVRBMU5DQXdMak16T0RjM05DQXdMakl3T0RJM055QXdMak0zTWpFMk5pQXdMakU1TlRBNE9VTXdMalF3TlRVMU9DQXdMakU0TVRrZ01DNDBOREl4TURZZ01DNHhOemc0T1NBd0xqUTNOekl3TmlBd0xqRTROalF6TjBNd0xqVXhNak13TmlBd0xqRTVNems0TkNBd0xqVTBORE00TnlBd0xqSXhNVGMxTVNBd0xqVTJPVFF3TmlBd0xqSXpOelZETUM0MU9EWTROVFVnTUM0eU5UUTNOeUF3TGpZd01UQXpPQ0F3TGpJM05UQTFNU0F3TGpZeE1USTNNeUF3TGpJNU56TTJOME13TGpZeU5Ua3dNaUF3TGpJNE5UWXhOQ0F3TGpZME5ERXdPQ0F3TGpJM09USXhOaUF3TGpZMk1qZzNNeUF3TGpJM09USXpNME13TGpjd01UVTBJREF1TWpjNU1qTXpJREF1TnpReU9EY3pJREF1TXpBMk9ETXpJREF1TnpRNU5qY3pJREF1TXpZNE0wTXdMamM0TWpVeklEQXVNemMwT0NBd0xqZ3hNakUzTXlBd0xqTTVNak0xSURBdU9ETXpOamN6SURBdU5ERTRNRE16VERBdU9ERXlOelFnTUM0ME16UTBNek5ETUM0M09USTNOelVnTUM0ME1URTFPVElnTUM0M05qVXlPVGNnTUM0ek9UWTJORGNnTUM0M016VXlOek1nTUM0ek9USXpRekF1TnpNeU1qY3pJREF1TXpreE9ERTVJREF1TnpJNU5USTJJREF1TXprd016STNJREF1TnpJM05Ea2dNQzR6T0Rnd056SkRNQzQzTWpVME5UTWdNQzR6T0RVNE1UY2dNQzQzTWpReU5EY2dNQzR6T0RJNU16UWdNQzQzTWpRd056TWdNQzR6TnprNVF6QXVOekl4TURBMklEQXVNekk0T0RNeklEQXVOamt4TVRRZ01DNHpNRFU1SURBdU5qWXlPRGN6SURBdU16QTFPVU13TGpZMU16azVOeUF3TGpNd05UazRNaUF3TGpZME5USTJJREF1TXpBNE1USWdNQzQyTXpjek5Ea2dNQzR6TVRJeE5EVkRNQzQyTWprME16Y2dNQzR6TVRZeE55QXdMall5TWpVMk5pQXdMak15TVRrM05DQXdMall4TnpJM015QXdMak15T1RGRE1DNDJNVFU0TkRFZ01DNHpNekV3TURrZ01DNDJNVE01TWpJZ01DNHpNekkwT1RrZ01DNDJNVEUzTVRjZ01DNHpNek0wTVRORE1DNDJNRGsxTVRNZ01DNHpNelF6TWpnZ01DNDJNRGN4TURNZ01DNHpNelEyTXpRZ01DNDJNRFEzTkNBd0xqTXpORE5ETUM0Mk1ESXpOallnTUM0ek16TTVNemNnTUM0Mk1EQXhNelVnTUM0ek16STVOREVnTUM0MU9UZ3lPREVnTUM0ek16RTBNVFpETUM0MU9UWTBNamNnTUM0ek1qazRPU0F3TGpVNU5UQXhPU0F3TGpNeU56ZzVNaUF3TGpVNU5ESXdOaUF3TGpNeU5UWXpNME13TGpVNE5UQTNPU0F3TGpJNU9UY3hOQ0F3TGpVM01ESTNNeUF3TGpJM05qRTJNaUF3TGpVMU1EZzNNeUF3TGpJMU5qZERNQzQxTWprMU56UWdNQzR5TXpRM09EY2dNQzQxTURJeU9EWWdNQzR5TVRrMk5ESWdNQzQwTnpJME1qSWdNQzR5TVRNeE5qTkRNQzQwTkRJMU5Ua2dNQzR5TURZMk9ETWdNQzQwTVRFME5EY2dNQzR5TURreE5UWWdNQzR6T0RJNU9ESWdNQzR5TWpBeU56RkRNQzR6TlRRMU1UY2dNQzR5TXpFek9EY2dNQzR6TWprNU5qTWdNQzR5TlRBMk5USWdNQzR6TVRJek9UTWdNQzR5TnpVMk5UUkRNQzR5T1RRNE1qUWdNQzR6TURBMk5UWWdNQzR5T0RVd01Ua2dNQzR6TXpBeU9EWWdNQzR5T0RReU1EWWdNQzR6TmpBNE16TkRNQzR5T0RReU1qVWdNQzR6TmpjeU1ETWdNQzR5T0RRMU9ERWdNQzR6TnpNMU5qZ2dNQzR5T0RVeU56TWdNQzR6TnprNVF6QXVNamcxTlRrMElEQXVNemd6TURneUlEQXVNamcwTnpZeElEQXVNemcyTWpjeklEQXVNamd5T1RJMUlEQXVNemc0T0RreVF6QXVNamd4TURrZ01DNHpPVEUxTVRFZ01DNHlOemd6TnpRZ01DNHpPVE16T0RNZ01DNHlOelV5TnpNZ01DNHpPVFF4TmpkRE1DNHlORFV3TURZZ01DNDBNREUyTXpNZ01DNHhPVE01TkNBd0xqUXlORGd6TXlBd0xqRTVNemswSURBdU5EazFNak16UXpBdU1Ua3pPREEySURBdU5EazNOak14SURBdU1Ua3pPREEySURBdU5UQXdNRE0xSURBdU1Ua3pPVFFnTUM0MU1ESTBNek5ETUM0eE9UWTROek1nTUM0MU5UVTNOamNnTUM0eU5ERTFOQ0F3TGpVNU16WXpNeUF3TGpNd01EWXdOaUF3TGpVNU16WXpNMGd3TGpRNE56STNNMHd3TGpRNE5UazBJREF1TmpJd00xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56STBOVEVnTUM0NE1UWTRNRFZETUM0MU1UUXpNVGdnTUM0NE1UWTRNRFVnTUM0MU1USTBOVEVnTUM0Mk16a3dOekVnTUM0MU1USTBOVEVnTUM0Mk16Y3pNemhXTUM0ME56VXdOekZETUM0MU1USTBORElnTUM0ME56SXpORGNnTUM0MU1UTXlOamdnTUM0ME5qazJPRFVnTUM0MU1UUTRNVGdnTUM0ME5qYzBORFZETUM0MU1UWXpOamNnTUM0ME5qVXlNRFFnTUM0MU1UZzFOallnTUM0ME5qTTBPVElnTUM0MU1qRXhNVGdnTUM0ME5qSTFNemhNTUM0Mk5qYzNPRFVnTUM0ME1EZ3lOekZETUM0Mk56QTRNRFFnTUM0ME1EY3lNRFFnTUM0Mk56UXdPVGdnTUM0ME1EY3lNRFFnTUM0Mk56Y3hNVGdnTUM0ME1EZ3lOekZNTUM0NE1qTTNPRFVnTUM0ME5qSTFNemhETUM0NE1qWXpNemNnTUM0ME5qTTBPVElnTUM0NE1qZzFNelVnTUM0ME5qVXlNRFFnTUM0NE16QXdPRFVnTUM0ME5qYzBORFZETUM0NE16RTJNelFnTUM0ME5qazJPRFVnTUM0NE16STBOaUF3TGpRM01qTTBOeUF3TGpnek1qUTFNU0F3TGpRM05UQTNNVll3TGpZME56TXpPRU13TGpnek1qUTFNU0F3TGpZME9UQTNNU0F3TGpnek1EVTROU0F3TGpneE5qZ3dOU0F3TGpZM01qUTFNU0F3TGpneE5qZ3dOVnBOTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZXTUM0Mk16Y3pNemhETUM0MU16a3hNVGdnTUM0Mk5ETTJNRFVnTUM0MU5EQTVPRFVnTUM0M09UQXhNemdnTUM0Mk56STBOVEVnTUM0M09UQXhNemhETUM0NE1ETTVNVGdnTUM0M09UQXhNemdnTUM0NE1EVTNPRFVnTUM0Mk5UTXlNRFVnTUM0NE1EVTNPRFVnTUM0Mk5EY3pNemhXTUM0ME9EUTBNRFZNTUM0Mk56STBOVEVnTUM0ME16UTVNemhNTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TkRNNUlEQXVOelkyT1RJMFF6QXVOVGczTmpNNUlEQXVOelkyT1RJMElEQXVOVFkyT0RNNUlEQXVOalU1TXpJMElEQXVOVFkxTnpjeklEQXVOalUwTnpreFF6QXVOVFkxTmpReElEQXVOalV6T1RrMklEQXVOVFkxTmpReElEQXVOalV6TVRnMUlEQXVOVFkxTnpjeklEQXVOalV5TXpreFZqQXVOVEUwTWpVNFF6QXVOVFkxTnpjZ01DNDFNVEUxT0RjZ01DNDFOalkxTmprZ01DNDFNRGc1TnpnZ01DNDFOamd3TmpjZ01DNDFNRFkzTmpkRE1DNDFOamsxTmpVZ01DNDFNRFExTlRZZ01DNDFOekUyT1RJZ01DNDFNREk0TkRZZ01DNDFOelF4TnpNZ01DNDFNREU0TlRoTU1DNDJOamMxTURZZ01DNDBOalV3TlRoRE1DNDJOekEyTnpRZ01DNDBOak0zT1RZZ01DNDJOelF5TURVZ01DNDBOak0zT1RZZ01DNDJOemN6TnpNZ01DNDBOalV3TlRoTU1DNDNOekEzTURZZ01DNDFNREU0TlRoRE1DNDNOek14T0RjZ01DNDFNREk0TkRZZ01DNDNOelV6TVRRZ01DNDFNRFExTlRZZ01DNDNOelk0TVRJZ01DNDFNRFkzTmpkRE1DNDNOemd6TURrZ01DNDFNRGc1TnpnZ01DNDNOemt4TURrZ01DNDFNVEUxT0RjZ01DNDNOemt4TURZZ01DNDFNVFF5TlRoV01DNDJOVEl6T1RGRE1DNDNOemt4TnpJZ01DNDJOVE14T1NBd0xqYzNPVEUzTWlBd0xqWTFNems1TWlBd0xqYzNPVEV3TmlBd0xqWTFORGM1TVVNd0xqYzNPREF6T1NBd0xqWTFPVE15TkNBd0xqYzFOekl6T1NBd0xqYzJOamt5TkNBd0xqWTNNalF6T1NBd0xqYzJOamt5TkZwTk1DNDFPVEkwTXprZ01DNDJOVEV3TlRoRE1DNDFPVFExTnpNZ01DNDJOakV4T1RFZ01DNDJNVE0yTXprZ01DNDNOREF5TlRnZ01DNDJOekkwTXprZ01DNDNOREF5TlRoRE1DNDNNekV5TXprZ01DNDNOREF5TlRnZ01DNDNOVEF6TURZZ01DNDJOakV6TWpRZ01DNDNOVEkwTXprZ01DNDJOVEV3TlRoV01DNDFNak16TWpSTU1DNDJOekkwTXprZ01DNDBPVEU0TlRoTU1DNDFPVEkwTXprZ01DNDFNak16TWpSV01DNDJOVEV3TlRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b20iIGlkPSIzIj4KICAgICAgPG14Q2VsbCBzdHlsZT0iaXIucmVmPWY5ZjM1NmI3LWQzNWUtNDA1Yy1iNDIzLTE2NjVmMTE0OGU3Yztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj12cGM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIxMjgiIHk9IjM4IiB3aWR0aD0iODQ4IiBoZWlnaHQ9IjQ1MiIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUzMgLSBTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPTA4YmRlY2E0LTY5MjMtNDA4OC04ZDg2LWI1YTY5MWJlODgzNTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1zMztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01DNDVPVGs1T1RWSU1WWXdXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RFNU1EVXhJREF1TlRNME1UZzRRekF1T0RFMU1UZzBJREF1TlRFek1qVTFJREF1TnpreE5EVXhJREF1TkRrNE5EVTFJREF1TnpjMU1UZzBJREF1TkRnM09USXlRekF1TnpZNU9UZzBJREF1TkRnME5UZzVJREF1TnpVMU56RTRJREF1TkRjNU1qVTFJREF1TnpVME5URTRJREF1TkRjME5UZzVRekF1TnpVME5ETTJJREF1TkRjeE1qVWdNQzQzTlRRNE9EWWdNQzQwTmpjNU1Ua2dNQzQzTlRVNE5URWdNQzQwTmpRM01qSk1NQzQzTmpreE9EUWdNQzR6TmpnNE5UWkRNQzQzTnpNd05URWdNQzR6TkRBM01qSWdNQzQzTnpZM09EUWdNQzR6TVRJMU9Ea2dNQzQzT0RBMk5URWdNQzR5T0RRME5UWkRNQzQzT0RReE1UZ2dNQzR5TlRnMU9Ea2dNQzQzTnpFM01UZ2dNQzR5TkRFeU5UWWdNQzQzTlRBMk5URWdNQzR5TWpZM01qTkRNQzQzTURjM01UZ2dNQzR4T1RZNU9Ea2dNQzQyTlRFM01UZ2dNQzR4T0RRNU9TQXdMall3TVRFNE5DQXdMakUzTmpjeU0wTXdMalV6TnpneE1TQXdMakUyTmpNM05pQXdMalEzTXpNMk5TQXdMakUyTkRJM0lEQXVOREE1TkRVeElEQXVNVGN3TkRVMlF6QXVNelV4T1RZMklEQXVNVGMwTmpjMElEQXVNamsxTlRRMklEQXVNVGc0TVRneklEQXVNalF5TXpnMElEQXVNakV3TkRVMlF6QXVNakV6T0RVeElEQXVNakl6TnpnNUlEQXVNVGMyTlRFNElEQXVNalEwTlRnNUlEQXVNVGd4TVRnMElEQXVNamd3T1RnNVF6QXVNVGswTlRFNElEQXVNemc1TWpVMklEQXVNakV3TWpVeElEQXVORGszTWpVMUlEQXVNakkwTnpnMElEQXVOakExTXpnNFF6QXVNak14TkRVeElEQXVOalUwT0RVMUlEQXVNak00TVRFNElEQXVOekEwTXpJeElEQXVNalEwTnpnMElEQXVOelV6TnpnNFF6QXVNalExT0RZZ01DNDNOak0wTWlBd0xqSTBPVFEySURBdU56Y3lOVGs0SURBdU1qVTFNakU1SURBdU56Z3dNemswUXpBdU1qWXdPVGM0SURBdU56ZzRNVGtnTUM0eU5qZzJPVE1nTUM0M09UUXpNamdnTUM0eU56YzFPRFFnTUM0M09UZ3hPRGhETUM0ek1UZzVNVGdnTUM0NE1qQTFPRGdnTUM0ek56QXhNVGdnTUM0NE1qWTVPRGdnTUM0ME1UWXlOVEVnTUM0NE16RXlOVFJETUM0ME56YzFPRE1nTUM0NE16WTNPVFFnTUM0MU16a3pPRElnTUM0NE16UXdOVGdnTUM0MU9UazVPRFFnTUM0NE1qTXhNakZETUM0Mk16Z3pPRFFnTUM0NE1UWXdOVFFnTUM0M01EazROVEVnTUM0NE1EUTBOVFFnTUM0M01UVTVPRFFnTUM0M05UWTBOVFJETUM0M01qTTFPRFFnTUM0Mk9UWTVPRGdnTUM0M016RTVPRFFnTUM0Mk16YzFNakVnTUM0M016azVPRFFnTUM0MU56Z3hPRGhNTUM0M05ESTVNVGdnTUM0MU5qQXdOVFZETUM0M05qUTJOVEVnTUM0MU5qVXlOVFVnTUM0NE1qWTJOVEVnTUM0MU56WXpNaklnTUM0NE1Ua3dOVEVnTUM0MU16UXhPRGhhVFRBdU5EZ3dOalV4SURBdU1Ua3pNemc1UXpBdU5UWXdOalV4SURBdU1Ua3pNemc1SURBdU5qVXlNalV4SURBdU1qQXlORFUySURBdU56SXpPVGcwSURBdU1qUXhPVEl6UXpBdU56TTFNRFV4SURBdU1qUTRNRFUySURBdU56WXdOemcwSURBdU1qWXhOemc1SURBdU56VXpNRFV4SURBdU1qYzRNRFUyUXpBdU56UTFNekU0SURBdU1qazBNekl6SURBdU56SXhNekU0SURBdU16QXlORFUySURBdU56QTJOalV4SURBdU16QTRNekl5UXpBdU5qZzFOekE0SURBdU16RTJNRFU1SURBdU5qWTBNVGNnTUM0ek1qSXdOemdnTUM0Mk5ESXlOVEVnTUM0ek1qWXpNakpETUM0MU5EY3dOelFnTUM0ek5EVXhOellnTUM0ME5Ea3pNamtnTUM0ek5EY3lNRGNnTUM0ek5UTTBOVEVnTUM0ek16SXpNakpETUM0ek1UQXhOVGdnTUM0ek1qYzROVGdnTUM0eU5qZ3dORFFnTUM0ek1UVTFNaklnTUM0eU1qa3hPRFFnTUM0eU9UVTVNak5ETUM0eU1UazFPRFFnTUM0eU9UQTBOVFlnTUM0eU1ETTNNVGdnTUM0eU9EQTFPRGtnTUM0eU1EZ3hNVGdnTUM0eU5qYzFNak5ETUM0eU1URTJNRE1nTUM0eU5qQTFNRElnTUM0eU1UY3dOelFnTUM0eU5UUTJOaUF3TGpJeU16ZzFNU0F3TGpJMU1EY3lNME13TGpJMU16RXpOeUF3TGpJek1UZzRPU0F3TGpJNE5UY3dNeUF3TGpJeE9EY3lOeUF3TGpNeE9UZzFNU0F3TGpJeE1Ua3lNME13TGpNM01qVXdOeUF3TGpFNU9USTRNaUF3TGpReU5qVWdNQzR4T1RNd05Ua2dNQzQwT0RBMk5URWdNQzR4T1RNek9EbFdNQzR4T1RNek9EbGFUVEF1TmpnNU56RTRJREF1TnpVMU16ZzRRekF1TmpnM056RTRJREF1Tnpjd09UZzRJREF1TmpZeE9UZzBJREF1TnpjNE56SXhJREF1TmpRNU56RTRJREF1Tnpnek1USXhRekF1TmpJME1qVXhJREF1TnpreE5qUWdNQzQxT1RjNU9ESWdNQzQzT1RjMU16Y2dNQzQxTnpFek1UZ2dNQzQ0TURBM01qRkRNQzQxTVRJeE5UWWdNQzQ0TURnMU9EY2dNQzQwTlRJeU1UTWdNQzQ0TURnMU9EY2dNQzR6T1RNd05URWdNQzQ0TURBM01qRkRNQzR6TlRVNU9UWWdNQzQzT1RjNE5EWWdNQzR6TVRrNE1USWdNQzQzT0Rnd016RWdNQzR5T0RZek9EUWdNQzQzTnpFM09EaERNQzR5T0RFNE16WWdNQzQzTmprNE1URWdNQzR5TnpjNU15QXdMamMyTmpZd05TQXdMakkzTlRFd015QXdMamMyTWpVelF6QXVNamN5TWpjM0lEQXVOelU0TkRVMklEQXVNamN3TmpReklEQXVOelV6TmpjeklEQXVNamN3TXpnMElEQXVOelE0TnpJeFF6QXVNalUzTURVeElEQXVOalF5T1RnNElEQXVNalF4T0RVeElEQXVOVE0zTWpVMUlEQXVNakkzTlRnMElEQXVORE14TlRJeVREQXVNakV5TVRFNElEQXVNekUyT0RVMlF6QXVNalF5TkRJNUlEQXVNek16TlRnM0lEQXVNamMxTXpJNUlEQXVNelExTVRJMElEQXVNekE1TkRVeElEQXVNelV3T1RnNVF6QXVNelExT1RrNElEQXVNelU0TkRJM0lEQXVNemd6TURJeUlEQXVNell6TWpneklEQXVOREl3TWpVeElEQXVNelkxTlRJeVF6QXVORGt6TXpFMUlEQXVNemN3TnpVNElEQXVOVFkyTnpRNUlEQXVNelkyTmpneElEQXVOak00TnpnMElEQXVNelV6TXpnNVF6QXVOamMzTVRZM0lEQXVNelEzT0RZNElEQXVOekUwTWpRMklEQXVNek0xTkRrMElEQXVOelE0TWpVeElEQXVNekUyT0RVMlREQXVOekU1T1RnMElEQXVOVEkyTVRnNFF6QXVOalV5TkRFNElEQXVOVEF6T1RJNElEQXVOVGcyTkRBMklEQXVORGMzTWpBeklEQXVOVEl5TXpnMElEQXVORFEyTVRnNVF6QXVOVEU1TlRjMUlEQXVORFExTVRFM0lEQXVOVEUyT0RVMklEQXVORFF6T0RJMElEQXVOVEUwTWpVeElEQXVORFF5TXpJeVF6QXVOVEV3TmpVeElEQXVORE01TmpVMUlEQXVOVEV4TlRnMElEQXVORFF3T1RnNUlEQXVOVEE1T0RVeElEQXVORE0yT0RVMVF6QXVOVEEyTlRFNElEQXVOREk1TWpVMUlEQXVOVEExTnpFNElEQXVOREl6TlRJeUlEQXVORGs0TmpVeElEQXVOREUzTWpVMVF6QXVORGswT0RNMklEQXVOREUwTWlBd0xqUTVNRE16TWlBd0xqUXhNakV5TXlBd0xqUTROVFV6TVNBd0xqUXhNVEl3TlVNd0xqUTRNRGN6SURBdU5ERXdNamczSURBdU5EYzFOemM0SURBdU5ERXdOVFUySURBdU5EY3hNVEExSURBdU5ERXhPVGc0UXpBdU5EWTJORE14SURBdU5ERXpOREl4SURBdU5EWXlNVGM1SURBdU5ERTFPVGMwSURBdU5EVTROekUzSURBdU5ERTVOREkwUXpBdU5EVTFNalUySURBdU5ESXlPRGMxSURBdU5EVXlOamtnTUM0ME1qY3hNVGtnTUM0ME5URXlORElnTUM0ME16RTNPRGhETUM0ME5EazNPVFVnTUM0ME16WTBOVGNnTUM0ME5EazFNU0F3TGpRME1UUXdPQ0F3TGpRMU1EUXhNeUF3TGpRME5qSXhNa013TGpRMU1UTXhOaUF3TGpRMU1UQXhOaUF3TGpRMU16TTNPU0F3TGpRMU5UVXlOaUF3TGpRMU5qUXlNaUF3TGpRMU9UTTFNVU13TGpRMU9UUTJOaUF3TGpRMk16RTNOU0F3TGpRMk16TTVPQ0F3TGpRMk5qRTVPU0F3TGpRMk56ZzNOaUF3TGpRMk9ERTFOME13TGpRM01qTTFOQ0F3TGpRM01ERXhOaUF3TGpRM056STBNeUF3TGpRM01EazFJREF1TkRneU1URTRJREF1TkRjd05UZzVRekF1TkRnMk56RTBJREF1TkRZNU9ESTJJREF1TkRreE1UazBJREF1TkRZNE5EZ3lJREF1TkRrMU5EVXhJREF1TkRZMk5UZzVRekF1TlRBd05qVXhJREF1TkRZME9UZzVJREF1TlRBd05qVXhJREF1TkRZMU1qVTFJREF1TlRBMk1URTRJREF1TkRZM056ZzVRekF1TlRjd09UWXlJREF1TkRrNU5EQTRJREF1TmpNM056WTJJREF1TlRJMk9EUXlJREF1TnpBMk1URTRJREF1TlRRNU9USXlRekF1TnpFMk16ZzBJREF1TlRVek1qVTFJREF1TnpFMk1qVXhJREF1TlRRNU9USXlJREF1TnpFMk1qVXhJREF1TlRVNE5EVTFRekF1TnpFMU9ERTRJREF1TlRZME9UUTNJREF1TnpFME9UY3lJREF1TlRjeE5EQTBJREF1TnpFek56RTRJREF1TlRjM056ZzRUREF1TnpBMU1UZzBJREF1TmpReE16ZzRUREF1TmpnNU56RTRJREF1TnpVMU16ZzRXazB3TGpRNE16azROQ0F3TGpRME1EQTFOVU13TGpRNE16azROQ0F3TGpRME16WTFOU0F3TGpRM09Ea3hPQ0F3TGpRME16STFOU0F3TGpRM056VTROQ0F3TGpRME1EazRPVU13TGpRM05qSTFNU0F3TGpRek9EY3lNaUF3TGpRNE16azROQ0F3TGpRek5EazRPU0F3TGpRNE16azROQ0F3TGpRME1EQTFOVnBOTUM0M05EWTJOVEVnTUM0MU16TXpPRGhNTUM0M05UQTJOVEVnTUM0MU1ETTVNakpETUM0M05qTTVPRFFnTUM0MU1URTFNaklnTUM0M09EWTJOVEVnTUM0MU1qSTVPRGdnTUM0M09USTJOVEVnTUM0MU16Z3hPRGhETUM0M056azFPRFFnTUM0MU5ETTFNaklnTUM0M05UZzVNVGdnTUM0MU16WTBOVFVnTUM0M05EWTJOVEVnTUM0MU16TXpPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3dOamNpSUhreFBTSXhMakl3TnpBMklpQjRNajBpTVM0eU1EY3dOaUlnZVRJOUlpMHdMakl3TnpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekZDTmpZd1JpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOa05CUlRORklpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJd0xqazVPVGs1TlNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI3MjEiIHk9IjMxMyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNSIgdmFsdWU9IkxhbWJkYSBGdW5jdGlvbiIgc3R5bGU9ImlyLnJlZj02MzQzNjA1MS03OTdlLTRjYTctOWE3MC1kZGYzYTZjNGVmMWE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXdzLWxhbWJkYS1mdW5jdGlvbjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTFNVEVnTUM0NE16TXlPVWd3TGpZME1qSTBORU13TGpZek9UY3pNU0F3TGpnek16STRNeUF3TGpZek56STNNU0F3TGpnek1qVTJOaUF3TGpZek5URTBPQ0F3TGpnek1USXlNVU13TGpZek16QXlOU0F3TGpneU9UZzNOeUF3TGpZek1UTXlOU0F3TGpneU56azFPU0F3TGpZek1ESTBOQ0F3TGpneU5UWTVUREF1TXprM09UYzNJREF1TXpNNU9UVTVTREF1TWprNU56RkRNQzR5T1RZeE56UWdNQzR6TXprNU5Ua2dNQzR5T1RJM09ETWdNQzR6TXpnMU5UUWdNQzR5T1RBeU9ESWdNQzR6TXpZd05UTkRNQzR5T0RjM09ESWdNQzR6TXpNMU5UTWdNQzR5T0RZek56Y2dNQzR6TXpBeE5qSWdNQzR5T0RZek56Y2dNQzR6TWpZMk1qVldNQzR4TnprNU5UbERNQzR5T0RZek56Y2dNQzR4TnpZME1qTWdNQzR5T0RjM09ESWdNQzR4TnpNd016SWdNQzR5T1RBeU9ESWdNQzR4TnpBMU16RkRNQzR5T1RJM09ETWdNQzR4Tmpnd016RWdNQzR5T1RZeE56UWdNQzR4TmpZMk1qWWdNQzR5T1RrM01TQXdMakUyTmpZeU5rZ3dMalV3TlRBME5FTXdMalV3TnpVMU55QXdMakUyTmpZek15QXdMalV4TURBeE55QXdMakUyTnpNMUlEQXVOVEV5TVRRZ01DNHhOamcyT1RWRE1DNDFNVFF5TmpRZ01DNHhOekF3TkNBd0xqVXhOVGsyTXlBd0xqRTNNVGsxTnlBd0xqVXhOekEwTkNBd0xqRTNOREl5Tmt3d0xqYzBPREkwTlNBd0xqWTFPVGsxT0Vnd0xqZ3dOalV4TVVNd0xqZ3hNREEwT0NBd0xqWTFPVGsxT0NBd0xqZ3hNelF6T1NBd0xqWTJNVE0yTWlBd0xqZ3hOVGt6T1NBd0xqWTJNemcyTTBNd0xqZ3hPRFEwSURBdU5qWTJNell6SURBdU9ERTVPRFExSURBdU5qWTVOelUxSURBdU9ERTVPRFExSURBdU5qY3pNamt4VmpBdU9ERTVPVFUzUXpBdU9ERTVPRFExSURBdU9ESXpORGt6SURBdU9ERTRORFFnTUM0NE1qWTRPRFVnTUM0NE1UVTVNemtnTUM0NE1qa3pPRFZETUM0NE1UTTBNemtnTUM0NE16RTRPRFlnTUM0NE1UQXdORGdnTUM0NE16TXlPU0F3TGpnd05qVXhNU0F3TGpnek16STVXazB3TGpZMU1EWTBOQ0F3TGpnd05qWXlORWd3TGpjNU16RTNPRll3TGpZNE5qWXlORWd3TGpjek9UZzBOVU13TGpjek56TXpNU0F3TGpZNE5qWXhOeUF3TGpjek5EZzNNU0F3TGpZNE5Ua2dNQzQzTXpJM05EZ2dNQzQyT0RRMU5UVkRNQzQzTXpBMk1qVWdNQzQyT0RNeU1TQXdMamN5T0RreU5TQXdMalk0TVRJNU15QXdMamN5TnpnME5TQXdMalkzT1RBeU5Fd3dMalE1TmpZME5DQXdMakU1TXpJNU0wZ3dMak14TXpFM04xWXdMak14TXpJNU1rZ3dMalF3TmpVeE1VTXdMalF3T1RBeU5DQXdMak14TXpJNU9TQXdMalF4TVRRNE5DQXdMak14TkRBeE5pQXdMalF4TXpZd055QXdMak14TlRNMk1VTXdMalF4TlRjeklEQXVNekUyTnpBMklEQXVOREUzTkRNZ01DNHpNVGcyTWpNZ01DNDBNVGcxTVRFZ01DNHpNakE0T1RKTU1DNDJOVEEyTkRRZ01DNDRNRFkyTWpSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZMk1qUTVJREF1T0RNek16WTRTREF1TVRreU9URTJRekF1TVRrd05qVWdNQzQ0TXpNek56TWdNQzR4T0RnME1pQXdMamd6TWpnZ01DNHhPRFkwTXpjZ01DNDRNekUzTURORE1DNHhPRFEwTlRRZ01DNDRNekEyTURjZ01DNHhPREkzT0RNZ01DNDRNamt3TWpNZ01DNHhPREUxT0RJZ01DNDRNamN4TURGRE1DNHhPREF6TURrZ01DNDRNalV4TXpRZ01DNHhOemsxTnpjZ01DNDRNakk0TmpVZ01DNHhOemswTmlBd0xqZ3lNRFV5TkVNd0xqRTNPVE0wTXlBd0xqZ3hPREU0TXlBd0xqRTNPVGcwTlNBd0xqZ3hOVGcxTXlBd0xqRTRNRGt4TmlBd0xqZ3hNemMyT0V3d0xqTTJNakkwT1NBd0xqUXpORGsyT0VNd0xqTTJNek16SURBdU5ETXlOams1SURBdU16WTFNREk1SURBdU5ETXdOemd5SURBdU16WTNNVFV6SURBdU5ESTVORE0zUXpBdU16WTVNamMySURBdU5ESTRNRGt6SURBdU16Y3hOek0ySURBdU5ESTNNemMxSURBdU16YzBNalE1SURBdU5ESTNNelk0VmpBdU5ESTNNelk0UXpBdU16YzJOelE0SURBdU5ESTNNell6SURBdU16YzVNVGs0SURBdU5ESTRNRFl4SURBdU16Z3hNeklnTUM0ME1qa3pPREZETUM0ek9ETTBOREVnTUM0ME16QTNNREVnTUM0ek9EVXhORGtnTUM0ME16STFPVEVnTUM0ek9EWXlORGtnTUM0ME16UTRNelZNTUM0ME56TXdORGtnTUM0Mk1UTXpOamhETUM0ME56TTVNak1nTUM0Mk1UVXhOemNnTUM0ME56UXpOellnTUM0Mk1UY3hOaUF3TGpRM05ETTNOaUF3TGpZeE9URTJPRU13TGpRM05ETTNOaUF3TGpZeU1URTNOeUF3TGpRM016a3lNeUF3TGpZeU16RTJJREF1TkRjek1EUTVJREF1TmpJME9UWTRUREF1TXpjNE16Z3lJREF1T0RJME9UWTRRekF1TXpjM05ERXhJREF1T0RJM05EQTNJREF1TXpjMU56UXlJREF1T0RJNU5UQTJJREF1TXpjek5UZzBJREF1T0RNeFF6QXVNemN4TkRJMUlEQXVPRE15TkRrMElEQXVNelk0T0RjMElEQXVPRE16TXpFNElEQXVNelkyTWpRNUlEQXVPRE16TXpZNFdrMHdMakl4TkRJME9TQXdMamd3Tmpjd01rZ3dMak0xTnpnME9Vd3dMalEwTmpJME9TQXdMall5TURBek5Vd3dMak0zTkRNNE1pQXdMalEzTVRNMk9Fd3dMakl4TkRJME9TQXdMamd3Tmpjd01sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4c2FXNWxZWEpIY21Ga2FXVnVkQ0JwWkQwaWNHRnBiblF3WDJ4cGJtVmhjaUlnZURFOUlpMHdMakl3TnpJaUlIa3hQU0l4TGpJd056SWlJSGd5UFNJeExqSXdOekEzSWlCNU1qMGlMVEF1TWpBM01EWTNJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqUXpnMU1URkNJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpFaUlITjBiM0F0WTI5c2IzSTlJaU5HUmprNU1EQWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzIxIiB5PSI0MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNiIgdmFsdWU9IkVMQiAtIEVsYXN0aWMgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0yYTg5YzQ4OC0xNmYwLTQ2NTktODdkMi04NWU0MTM2ZDcyNjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bG9hZC1iYWxhbmNlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qQTBOelFnTUM0MU1UTXlOME13TGpZMk16Z3lOQ0F3TGpVek16Z3pOaUF3TGpZM05EYzVOQ0F3TGpVMU1qTTRPQ0F3TGpZNU1USWdNQzQxTmpVeU16UkRNQzQzTURjMk1EY2dNQzQxTnpnd09DQXdMamN5T0RJME9DQXdMalU0TkRJNElEQXVOelE1TURFM0lEQXVOVGd5TmtNd0xqYzJPVGM0TnlBd0xqVTRNRGt4T1NBd0xqYzRPVEUyTXlBd0xqVTNNVFE0TWlBd0xqZ3dNekk1SURBdU5UVTJNVFkxUXpBdU9ERTNOREU0SURBdU5UUXdPRFE0SURBdU9ESTFNall5SURBdU5USXdOemMwSURBdU9ESTFNall5SURBdU5EazVPVE0yUXpBdU9ESTFNall5SURBdU5EYzVNRGs1SURBdU9ERTNOREU0SURBdU5EVTVNREkxSURBdU9EQXpNamtnTUM0ME5ETTNNRGhETUM0M09Ea3hOak1nTUM0ME1qZ3pPVEVnTUM0M05qazNPRGNnTUM0ME1UZzVOVE1nTUM0M05Ea3dNVGNnTUM0ME1UY3lOek5ETUM0M01qZ3lORGdnTUM0ME1UVTFPVElnTUM0M01EYzJNRGNnTUM0ME1qRTNPVElnTUM0Mk9URXlJREF1TkRNME5qTTRRekF1TmpjME56azBJREF1TkRRM05EZzFJREF1TmpZek9ESTBJREF1TkRZMk1ETTJJREF1TmpZd05EYzBJREF1TkRnMk5qQXpTREF1TlRZeE1EQTRRekF1TlRVNU5EWTFJREF1TkRZeU1EVTBJREF1TlRVek1USXpJREF1TkRNNE1EUTFJREF1TlRReU16UXhJREF1TkRFMU9UTTJUREF1TmpZeU16UXhJREF1TXpFME5EWTVRekF1TmpjM01EWTJJREF1TXpJMk1USXpJREF1TmprMU16RXhJREF1TXpNeU5ETTBJREF1TnpFME1Ea2dNQzR6TXpJek4wTXdMamN6TWpnMk9TQXdMak16TWpNd055QXdMamMxTVRBM0lEQXVNekkxT0RjeElEQXVOelkxTnpFMklEQXVNekUwTVRFNFF6QXVOemd3TXpZeElEQXVNekF5TXpZMElEQXVOemt3TlRnMElEQXVNamcxT1RnNElEQXVOemswTnpFeUlEQXVNalkzTmpZNFF6QXVOems0T0RRZ01DNHlORGt6TkRnZ01DNDNPVFkyTWprZ01DNHlNekF4TnlBd0xqYzRPRFEwSURBdU1qRXpNamN4UXpBdU56Z3dNalVnTUM0eE9UWXpOeklnTUM0M05qWTFOamdnTUM0eE9ESTNOVElnTUM0M05EazJNekVnTUM0eE56UTJORU13TGpjek1qWTVOU0F3TGpFMk5qVXlPU0F3TGpjeE16VXdOeUF3TGpFMk5EUXdOU0F3TGpZNU5USXdOaUF3TGpFMk9EWXhOME13TGpZM05qa3dOaUF3TGpFM01qZ3lPU0F3TGpZMk1EVTNOeUF3TGpFNE16RXlOeUF3TGpZME9EZzVJREF1TVRrM09ESTNRekF1TmpNM01qQTBJREF1TWpFeU5USTJJREF1TmpNd09EVXlJREF1TWpNd056VTNJREF1TmpNd09EYzBJREF1TWpRNU5UTTJRekF1TmpNd056RTRJREF1TWpZMU5qTTJJREF1TmpNMU16WWdNQzR5T0RFME1UY2dNQzQyTkRReU1EZ2dNQzR5T1RRNE5qbE1NQzQxTWpneU1EZ2dNQzR6T1RJMk1ETkRNQzQxTURVeE56Y2dNQzR6TlRnd09UZ2dNQzQwTnpFMk5UZ2dNQzR6TXpFNU1UY2dNQzQwTXpJMk1ETWdNQzR6TVRjNU1qZERNQzR6T1RNMU5EZ2dNQzR6TURNNU16Z2dNQzR6TlRFd01qa2dNQzR6TURJNE9ERWdNQzR6TVRFek1qZ2dNQzR6TVRRNU1UUkRNQzR5TnpFMk1qY2dNQzR6TWpZNU5EY2dNQzR5TXpZNE5Ea2dNQzR6TlRFME16RWdNQzR5TVRJeE16TWdNQzR6T0RRM05EbERNQzR4T0RjME1UWWdNQzQwTVRnd05qY2dNQzR4TnpRd056SWdNQzQwTlRnME5URWdNQzR4TnpRd056SWdNQzQwT1RrNU16WkRNQzR4TnpRd056SWdNQzQxTkRFME1qRWdNQzR4T0RjME1UWWdNQzQxT0RFNE1EWWdNQzR5TVRJeE16TWdNQzQyTVRVeE1qUkRNQzR5TXpZNE5Ea2dNQzQyTkRnME5ERWdNQzR5TnpFMk1qY2dNQzQyTnpJNU1qWWdNQzR6TVRFek1qZ2dNQzQyT0RRNU5UaERNQzR6TlRFd01qa2dNQzQyT1RZNU9URWdNQzR6T1RNMU5EZ2dNQzQyT1RVNU16VWdNQzQwTXpJMk1ETWdNQzQyT0RFNU5EVkRNQzQwTnpFMk5UZ2dNQzQyTmpjNU5UVWdNQzQxTURVeE56Y2dNQzQyTkRFM056UWdNQzQxTWpneU1EZ2dNQzQyTURjeU4wd3dMalkwTkRJd09DQXdMamN3TlRBd00wTXdMall6TlRNMklEQXVOekU0TkRVMUlEQXVOak13TnpFNElEQXVOek0wTWpNM0lEQXVOak13T0RjMElEQXVOelV3TXpNM1F6QXVOak13T0RZM0lEQXVOelk1TURnZ01DNDJNemN5TVRrZ01DNDNPRGN5TnpFZ01DNDJORGc0T1RFZ01DNDRNREU1TXpaRE1DNDJOakExTmpRZ01DNDRNVFkyTURFZ01DNDJOelk0TmpjZ01DNDRNalk0TnpFZ01DNDJPVFV4TXpRZ01DNDRNekV3TmpoRE1DNDNNVE0wTURFZ01DNDRNelV5TmpVZ01DNDNNekkxTlRJZ01DNDRNek14TkNBd0xqYzBPVFExTlNBd0xqZ3lOVEEwUXpBdU56WTJNelU0SURBdU9ERTJPVFF4SURBdU56Z3dNREV5SURBdU9EQXpNelEySURBdU56ZzRNVGcySURBdU56ZzJORGM1UXpBdU56azJNellnTUM0M05qazJNVElnTUM0M09UZzFOamtnTUM0M05UQTBOekVnTUM0M09UUTBOVE1nTUM0M016SXhPRFZETUM0M09UQXpNellnTUM0M01UTTRPVGtnTUM0M09EQXhNemNnTUM0Mk9UYzFOVElnTUM0M05qVTFNalFnTUM0Mk9EVTRNVFJETUM0M05UQTVNVEVnTUM0Mk56UXdOemNnTUM0M016STNORGNnTUM0Mk5qYzJORFlnTUM0M01UUXdNRFFnTUM0Mk5qYzFOekZETUM0Mk9UVXlOakVnTUM0Mk5qYzBPVFlnTUM0Mk56Y3dORGNnTUM0Mk56TTNPRE1nTUM0Mk5qSXpOREVnTUM0Mk9EVTBNRE5NTUM0MU5ESXpOREVnTUM0MU9ETTVNelpETUM0MU5UTXhNak1nTUM0MU5qRTRNamdnTUM0MU5UazBOalVnTUM0MU16YzRNVGtnTUM0MU5qRXdNRGdnTUM0MU1UTXlOMGd3TGpZMk1EUTNORnBOTUM0M05ESXdOelFnTUM0ME5ETTJOamxETUM0M05UTXlNRGtnTUM0ME5ETTJORE1nTUM0M05qUXhJREF1TkRRMk9USXhJREF1Tnpjek16Y3hJREF1TkRVek1EZzNRekF1TnpneU5qUXhJREF1TkRVNU1qVTBJREF1TnpnNU9EYzBJREF1TkRZNE1ETXlJREF1TnprME1UVXpJREF1TkRjNE16RXhRekF1TnprNE5ETXlJREF1TkRnNE5Ua2dNQzQzT1RrMU5qVWdNQzQwT1RrNU1EZ2dNQzQzT1RjME1Ea2dNQzQxTVRBNE16RkRNQzQzT1RVeU5UTWdNQzQxTWpFM05UVWdNQzQzT0RrNU1EVWdNQzQxTXpFM09UTWdNQzQzT0RJd05ERWdNQzQxTXprMk56VkRNQzQzTnpReE56Z2dNQzQxTkRjMU5UZ2dNQzQzTmpReE5USWdNQzQxTlRJNU15QXdMamMxTXpJek5DQXdMalUxTlRFeE1rTXdMamMwTWpNeE5pQXdMalUxTnpJNU5DQXdMamN6TURrNU5TQXdMalUxTmpFNE55QXdMamN5TURjd05pQXdMalUxTVRrek0wTXdMamN4TURReE55QXdMalUwTnpZM09DQXdMamN3TVRZeU1pQXdMalUwTURRMk5pQXdMalk1TlRRek15QXdMalV6TVRJeFF6QXVOamc1TWpRMElEQXVOVEl4T1RVMElEQXVOamcxT1RReElEQXVOVEV4TURjZ01DNDJPRFU1TkRFZ01DNDBPVGs1TXpaRE1DNDJPRFU1TkRFZ01DNDBPRFV3TXpZZ01DNDJPVEU0TlRFZ01DNDBOekEzTkRVZ01DNDNNREl6TnpRZ01DNDBOakF4T1RkRE1DNDNNVEk0T1RjZ01DNDBORGsyTkRnZ01DNDNNamN4TnpVZ01DNDBORE0zTURVZ01DNDNOREl3TnpRZ01DNDBORE0yTmpsV01DNDBORE0yTmpsYVRUQXVOekUwTXpReElEQXVNVGt6TWpZNVF6QXVOekkxTkRjZ01DNHhPVE15TmprZ01DNDNNell6TkRnZ01DNHhPVFkxTmprZ01DNDNORFUyTURFZ01DNHlNREkzTlRKRE1DNDNOVFE0TlRRZ01DNHlNRGc1TXpRZ01DNDNOakl3TmpZZ01DNHlNVGMzTWpJZ01DNDNOall6TWpVZ01DNHlNamd3TURORE1DNDNOekExT0RNZ01DNHlNemd5T0RVZ01DNDNOekUyT1RnZ01DNHlORGsxT1RnZ01DNDNOamsxTWpjZ01DNHlOakExTVRORE1DNDNOamN6TlRVZ01DNHlOekUwTWpnZ01DNDNOakU1T1RjZ01DNHlPREUwTlRNZ01DNDNOVFF4TWpnZ01DNHlPRGt6TWpKRE1DNDNORFl5TlRrZ01DNHlPVGN4T1RJZ01DNDNNell5TXpNZ01DNHpNREkxTlNBd0xqY3lOVE14T0NBd0xqTXdORGN5TVVNd0xqY3hORFF3TXlBd0xqTXdOamc1TXlBd0xqY3dNekE1SURBdU16QTFOemM0SURBdU5qa3lPREE1SURBdU16QXhOVEpETUM0Mk9ESTFNamNnTUM0eU9UY3lOakVnTUM0Mk56TTNOQ0F3TGpJNU1EQTBPU0F3TGpZMk56VTFOeUF3TGpJNE1EYzVOa013TGpZMk1UTTNOQ0F3TGpJM01UVTBNeUF3TGpZMU9EQTNOQ0F3TGpJMk1EWTJOQ0F3TGpZMU9EQTNOQ0F3TGpJME9UVXpOa013TGpZMU9EQTNOQ0F3TGpJek5EWXhNeUF3TGpZMk5EQXdNaUF3TGpJeU1ETXdNU0F3TGpZM05EVTFOQ0F3TGpJd09UYzBPVU13TGpZNE5URXdOeUF3TGpFNU9URTVOeUF3TGpZNU9UUXhPQ0F3TGpFNU16STJPU0F3TGpjeE5ETTBNU0F3TGpFNU16STJPVnBOTUM0M01UUXpOREVnTUM0Mk9UUXlNRE5ETUM0M01qVTBOelVnTUM0Mk9UUXlNRE1nTUM0M016WXpOVGtnTUM0Mk9UYzFNRGNnTUM0M05EVTJNVFVnTUM0M01ETTJPVFZETUM0M05UUTROekVnTUM0M01EazRPRFFnTUM0M05qSXdPRE1nTUM0M01UZzJOemtnTUM0M05qWXpNemNnTUM0M01qZzVOamxETUM0M056QTFPVElnTUM0M016a3lOVGdnTUM0M056RTJPVGdnTUM0M05UQTFOemdnTUM0M05qazFNVGNnTUM0M05qRTBPVFpETUM0M05qY3pNelVnTUM0M056STBNVFVnTUM0M05qRTVOak1nTUM0M09ESTBOQ0F3TGpjMU5EQTRJREF1Tnprd016QTBRekF1TnpRMk1UazRJREF1TnprNE1UWTNJREF1TnpNMk1UWWdNQzQ0TURNMU1UWWdNQzQzTWpVeU16WWdNQzQ0TURVMk56SkRNQzQzTVRRek1UTWdNQzQ0TURjNE1qZ2dNQzQzTURJNU9UVWdNQzQ0TURZMk9UUWdNQzQyT1RJM01UWWdNQzQ0TURJME1UVkRNQzQyT0RJME16Y2dNQzQzT1RneE16WWdNQzQyTnpNMk5Ua2dNQzQzT1RBNU1EUWdNQzQyTmpjME9USWdNQzQzT0RFMk16TkRNQzQyTmpFek1qWWdNQzQzTnpJek5qSWdNQzQyTlRnd05EZ2dNQzQzTmpFME56RWdNQzQyTlRnd056UWdNQzQzTlRBek16ZERNQzQyTlRneE1TQXdMamN6TlRRek55QXdMalkyTkRBMU15QXdMamN5TVRFMU9TQXdMalkzTkRZd01pQXdMamN4TURZek5rTXdMalk0TlRFMUlEQXVOekF3TVRFeklEQXVOams1TkRReElEQXVOamswTWpBeklEQXVOekUwTXpReElEQXVOamswTWpBeldrMHdMak0yT0RJd09DQXdMalkyTmpZd00wTXdMak16TlRJME5DQXdMalkyTmpZd015QXdMak13TXpBeU1TQXdMalkxTmpneU9DQXdMakkzTlRZeE15QXdMall6T0RVeE5VTXdMakkwT0RJd05TQXdMall5TURJd01TQXdMakl5TmpnME1pQXdMalU1TkRFM01TQXdMakl4TkRJeU9DQXdMalUyTXpjeE4wTXdMakl3TVRZeE15QXdMalV6TXpJMk15QXdMakU1T0RNeE15QXdMalE1T1RjMU1TQXdMakl3TkRjME5DQXdMalEyTnpReU1VTXdMakl4TVRFM05DQXdMalF6TlRBNU1TQXdMakl5TnpBME9DQXdMalF3TlRNNU5DQXdMakkxTURNMU55QXdMak00TWpBNE5VTXdMakkzTXpZMk5TQXdMak0xT0RjM05pQXdMak13TXpNMk15QXdMak0wTWprd015QXdMak16TlRZNU15QXdMak16TmpRM01rTXdMak0yT0RBeU15QXdMak16TURBME1TQXdMalF3TVRVek5DQXdMak16TXpNME1TQXdMalF6TVRrNE9DQXdMak0wTlRrMU5rTXdMalEyTWpRME15QXdMak0xT0RVM01TQXdMalE0T0RRM01pQXdMak0zT1Rrek15QXdMalV3TmpjNE5pQXdMalF3TnpNME1VTXdMalV5TlRFZ01DNDBNelEzTkRrZ01DNDFNelE0TnpRZ01DNDBOalk1TnpNZ01DNDFNelE0TnpRZ01DNDBPVGs1TXpaRE1DNDFNelE0TURRZ01DNDFORFF4TVRjZ01DNDFNVGN5TWpJZ01DNDFPRFkwTmprZ01DNDBPRFU1T0RFZ01DNDJNVGMzTVVNd0xqUTFORGMwSURBdU5qUTRPVFV4SURBdU5ERXlNemc1SURBdU5qWTJOVE16SURBdU16WTRNakE0SURBdU5qWTJOakF6VmpBdU5qWTJOakF6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI3MiIgeT0iMTg5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJFQzIgLSBFbGFzdGljIENvbXB1dGUgQ2xvdWQiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTJNamdnTUM0MU16azVOVGxJTUM0M016azVOakZXTUM0MU1UTXlPVE5JTUM0NE1EWTJNamhXTUM0eE9UTXlPVE5JTUM0ME9EWTJNamhXTUM0eU5UazVOVGxJTUM0ME5UazVOakZXTUM0eE9UTXlPVE5ETUM0ME5UazVOakVnTUM0eE9EWXlNaUF3TGpRMk1qYzNJREF1TVRjNU5ETTNJREF1TkRZM056Y3hJREF1TVRjME5ETTJRekF1TkRjeU56Y3lJREF1TVRZNU5ETTFJREF1TkRjNU5UVTFJREF1TVRZMk5qSTJJREF1TkRnMk5qSTRJREF1TVRZMk5qSTJTREF1T0RBMk5qSTRRekF1T0RFek55QXdMakUyTmpZeU5pQXdMamd5TURRNE15QXdMakUyT1RRek5TQXdMamd5TlRRNE5DQXdMakUzTkRRek5rTXdMamd6TURRNE5TQXdMakUzT1RRek55QXdMamd6TXpJNU5DQXdMakU0TmpJeUlEQXVPRE16TWprMElEQXVNVGt6TWprelZqQXVOVEV6TWprelF6QXVPRE16TWprMElEQXVOVEl3TXpZMUlEQXVPRE13TkRnMUlEQXVOVEkzTVRRNElEQXVPREkxTkRnMElEQXVOVE15TVRRNVF6QXVPREl3TkRneklEQXVOVE0zTVRVZ01DNDRNVE0zSURBdU5UTTVPVFU1SURBdU9EQTJOakk0SURBdU5UTTVPVFU1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV4TXpFM0lEQXVPRE16TWprMFNEQXVNVGt6TVRjeFF6QXVNVGcyTURrNElEQXVPRE16TWprMElEQXVNVGM1TXpFMUlEQXVPRE13TkRnMUlEQXVNVGMwTXpFMElEQXVPREkxTkRnMFF6QXVNVFk1TXpFeklEQXVPREl3TkRneklEQXVNVFkyTlRBMElEQXVPREV6TnlBd0xqRTJOalV3TkNBd0xqZ3dOall5TjFZd0xqUTROall5T0VNd0xqRTJOalV3TkNBd0xqUTNPVFUxTlNBd0xqRTJPVE14TXlBd0xqUTNNamMzTWlBd0xqRTNORE14TkNBd0xqUTJOemMzTVVNd0xqRTNPVE14TlNBd0xqUTJNamMzSURBdU1UZzJNRGs0SURBdU5EVTVPVFl4SURBdU1Ua3pNVGN4SURBdU5EVTVPVFl4U0RBdU1qVTVPRE0zVmpBdU5EZzJOakk0U0RBdU1Ua3pNVGN4VmpBdU9EQTJOakkzU0RBdU5URXpNVGRXTUM0M016azVOakZJTUM0MU16azRNelpXTUM0NE1EWTJNamRETUM0MU16azRNellnTUM0NE1UTTNJREF1TlRNM01ESTNJREF1T0RJd05EZ3pJREF1TlRNeU1ESTJJREF1T0RJMU5EZzBRekF1TlRJM01ESTFJREF1T0RNd05EZzFJREF1TlRJd01qUXlJREF1T0RNek1qazBJREF1TlRFek1UY2dNQzQ0TXpNeU9UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56RXpNamc1SURBdU16YzVPVFUxVmpBdU16VXpNamc0U0RBdU5qY3pNamc1UXpBdU5qY3lOelFnTUM0ek5EWXpPVGdnTUM0Mk5qazNOVFFnTUM0ek16azVNeUF3TGpZMk5EZzJOeUF3TGpNek5UQTBNME13TGpZMU9UazRJREF1TXpNd01UVTJJREF1TmpVek5URXlJREF1TXpJM01UY2dNQzQyTkRZMk1qSWdNQzR6TWpZMk1qRldNQzR5T0RZMk1qRklNQzQyTVRrNU5UVldNQzR6TWpZMk1qRklNQzQxTnprNU5UVldNQzR5T0RZMk1qRklNQzQxTlRNeU9EaFdNQzR6TWpZMk1qRklNQzQxTVRNeU9EaFdNQzR5T0RZMk1qRklNQzQwT0RZMk1qSldNQzR6TWpZMk1qRklNQzQwTkRZMk1qRldNQzR5T0RZMk1qRklNQzQwTVRrNU5UVldNQzR6TWpZMk1qRklNQzR6TnprNU5UVldNQzR5T0RZMk1qRklNQzR6TlRNeU9EaFdNQzR6TWpZMk1qRkRNQzR6TkRZek9UZ2dNQzR6TWpjeE55QXdMak16T1RreklEQXVNek13TVRVMklEQXVNek0xTURReklEQXVNek0xTURRelF6QXVNek13TVRVMklEQXVNek01T1RNZ01DNHpNamN4TnlBd0xqTTBOak01T0NBd0xqTXlOall5TVNBd0xqTTFNekk0T0Vnd0xqSTROall5TVZZd0xqTTNPVGsxTlVnd0xqTXlOall5TVZZd0xqUXhPVGsxTlVnd0xqSTROall5TVZZd0xqUTBOall5TVVnd0xqTXlOall5TVZZd0xqUTROall5TWtnd0xqSTROall5TVZZd0xqVXhNekk0T0Vnd0xqTXlOall5TVZZd0xqVTFNekk0T0Vnd0xqSTROall5TVZZd0xqVTNPVGsxTlVnd0xqTXlOall5TVZZd0xqWXhPVGsxTlVnd0xqSTROall5TVZZd0xqWTBOall5TWtnd0xqTXlOall5TVVNd0xqTXlOekUzSURBdU5qVXpOVEV4SURBdU16TXdNVFUySURBdU5qVTVPVGdnTUM0ek16VXdORE1nTUM0Mk5qUTROamRETUM0ek16azVNeUF3TGpZMk9UYzFOQ0F3TGpNME5qTTVPQ0F3TGpZM01qYzBJREF1TXpVek1qZzRJREF1Tmpjek1qZzVWakF1TnpFek1qZzVTREF1TXpjNU9UVTFWakF1Tmpjek1qZzVTREF1TkRFNU9UVTFWakF1TnpFek1qZzVTREF1TkRRMk5qSXhWakF1Tmpjek1qZzVTREF1TkRnMk5qSXlWakF1TnpFek1qZzVTREF1TlRFek1qZzRWakF1Tmpjek1qZzVTREF1TlRVek1qZzRWakF1TnpFek1qZzVTREF1TlRjNU9UVTFWakF1Tmpjek1qZzVTREF1TmpFNU9UVTFWakF1TnpFek1qZzVTREF1TmpRMk5qSXlWakF1Tmpjek1qZzVRekF1TmpVek5URXlJREF1TmpjeU56UWdNQzQyTlRrNU9DQXdMalkyT1RjMU5DQXdMalkyTkRnMk55QXdMalkyTkRnMk4wTXdMalkyT1RjMU5DQXdMalkxT1RrNElEQXVOamN5TnpRZ01DNDJOVE0xTVRFZ01DNDJOek15T0RrZ01DNDJORFkyTWpKSU1DNDNNVE15T0RsV01DNDJNVGs1TlRWSU1DNDJOek15T0RsV01DNDFOems1TlRWSU1DNDNNVE15T0RsV01DNDFOVE15T0RoSU1DNDJOek15T0RsV01DNDFNVE15T0RoSU1DNDNNVE15T0RsV01DNDBPRFkyTWpKSU1DNDJOek15T0RsV01DNDBORFkyTWpGSU1DNDNNVE15T0RsV01DNDBNVGs1TlRWSU1DNDJOek15T0RsV01DNHpOems1TlRWSU1DNDNNVE15T0RsYVRUQXVOalEyTmpJeUlEQXVOalEwTWpJeVF6QXVOalEyTmpJeUlEQXVOalEwT0RVNElEQXVOalEyTXpZNUlEQXVOalExTkRZNUlEQXVOalExT1RFNUlEQXVOalExT1RFNVF6QXVOalExTkRZNUlEQXVOalEyTXpZNUlEQXVOalEwT0RVNUlEQXVOalEyTmpJeUlEQXVOalEwTWpJeUlEQXVOalEyTmpJeVNEQXVNelUxTmpnNFF6QXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUwTkRReElEQXVOalEyTXpZNUlEQXVNelV6T1RreElEQXVOalExT1RFNVF6QXVNelV6TlRReElEQXVOalExTkRZNUlEQXVNelV6TWpnNElEQXVOalEwT0RVNElEQXVNelV6TWpnNElEQXVOalEwTWpJeVZqQXVNelUxTmpnNFF6QXVNelV6TWpnNElEQXVNelUxTURVeElEQXVNelV6TlRReElEQXVNelUwTkRReElEQXVNelV6T1RreElEQXVNelV6T1RreFF6QXVNelUwTkRReElEQXVNelV6TlRReElEQXVNelUxTURVeElEQXVNelV6TWpnNElEQXVNelUxTmpnNElEQXVNelV6TWpnNFNEQXVOalEwTWpJeVF6QXVOalEwT0RVNUlEQXVNelV6TWpnNElEQXVOalExTkRZNUlEQXVNelV6TlRReElEQXVOalExT1RFNUlEQXVNelV6T1RreFF6QXVOalEyTXpZNUlEQXVNelUwTkRReElEQXVOalEyTmpJeUlEQXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUxTmpnNFZqQXVOalEwTWpJeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbSIgaWQ9IjciPgogICAgICA8bXhDZWxsIHN0eWxlPSJpci5yZWY9Mzk4Nzc4M2ItMGQ1OC00MmJkLThhMjYtNGE3MmJiY2M3NTZlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVjMjt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjIwMCIgeT0iNDAiIHdpZHRoPSI0MDkiIGhlaWdodD0iMTc1IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjkiIHZhbHVlPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSAoQ1MtRGVmYXVsdCkiIHN0eWxlPSJpci5yZWY9ZDIwYjNmNDktN2I2YS00ZGMyLWE1ZWYtY2JhOGU1MTViMTcxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjIzMyIgeT0iMTUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCIgaXIuc291cmNlU3R5bGU9ImNvbnRhaW5lcj11bmRlZmluZWQ7cm91bmRlZD0xO2FyY1NpemU9OTA7cGVyaW1ldGVyPXVuZGVmaW5lZDtyZWN1cnNpdmVSZXNpemU9dW5kZWZpbmVkO3ZlcnRpY2FsQWxpZ249dG9wO3N0cm9rZVdpZHRoPXVuZGVmaW5lZDtzdHJva2VDb2xvcj0jMjBDOUUzO2ZvbnRTaXplPTEyO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7YWxpZ249Y2VudGVyO3RleHREaXJlY3Rpb249dW5kZWZpbmVkO3NwYWNpbmdUb3A9dW5kZWZpbmVkO3NwYWNpbmdMZWZ0PXVuZGVmaW5lZDthc3BlY3Q9dW5kZWZpbmVkO2Rhc2hlZD11bmRlZmluZWQ7Zm9udFN0eWxlPXVuZGVmaW5lZDtvdXRsaW5lQ29ubmVjdD11bmRlZmluZWQ7c2hhcGU9dW5kZWZpbmVkO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tIiBpZD0iOCI+CiAgICAgIDxteENlbGwgc3R5bGU9ImlyLnJlZj1kNmIwNTBhZC00MGE4LTQwMDYtYTM4ZS05M2ZkOWYzNWNiMjc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iMjAwIiB5PSIyNjQiIHdpZHRoPSI0MTEiIGhlaWdodD0iMTY2IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgKENTLURlZmF1bHQpIiBzdHlsZT0iaXIucmVmPWFlZDg2MDE1LTE4YzEtNGE4NC05ZGFmLTJmZWIyMGJmMTI5Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItYXBwbGljYXRpb24tc2VydmVyLXNpZGU7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVU13TGpNMk5UZzFNeUF3TGpJNE1qYzRNaUF3TGpNM09EY3lOU0F3TGpJMk9Ua3hNU0F3TGpNNU5EWXdNeUF3TGpJMk9Ua3hNVWd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJMk9Ua3hNU0F3TGpZek5ERTROaUF3TGpJNE1qYzRNaUF3TGpZek5ERTROaUF3TGpJNU9EWTJNVU13TGpZek5ERTROaUF3TGpNeE5EVXpPU0F3TGpZeU1UTXhOQ0F3TGpNeU56UXhNU0F3TGpZd05UUXpOaUF3TGpNeU56UXhNVWd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56UXhNU0F3TGpNMk5UZzFNeUF3TGpNeE5EVXpPU0F3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVnBOTUM0ek9UUTJNRE1nTUM0Mk9URTFOemhETUM0ek56ZzNNalVnTUM0Mk9URTFOemdnTUM0ek5qVTROVE1nTUM0M01EUTBOU0F3TGpNMk5UZzFNeUF3TGpjeU1ETXlPRU13TGpNMk5UZzFNeUF3TGpjek5qSXdOaUF3TGpNM09EY3lOU0F3TGpjME9UQTNPQ0F3TGpNNU5EWXdNeUF3TGpjME9UQTNPRWd3TGpVMU1EQXhPVll3TGpZNU1UVTNPRWd3TGpNNU5EWXdNMXBOTUM0Mk1qQXpOVEVnTUM0Mk1qazVNVEZJTUM0Mk1EUTFOalZETUM0MU9UY3hORFFnTUM0Mk1qazVNVEVnTUM0MU9UQXdOamdnTUM0Mk16RXpPVE1nTUM0MU9ETTJNVGtnTUM0Mk16UXdOemhJTUM0ek9UUTJNRE5ETUM0ek56ZzNNalVnTUM0Mk16UXdOemdnTUM0ek5qVTROVE1nTUM0Mk1qRXlNRFlnTUM0ek5qVTROVE1nTUM0Mk1EVXpNamhETUM0ek5qVTROVE1nTUM0MU9EazBORGtnTUM0ek56ZzNNalVnTUM0MU56WTFOemdnTUM0ek9UUTJNRE1nTUM0MU56WTFOemhJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTFOemdnTUM0Mk16UXhPRFlnTUM0MU9EazBORGtnTUM0Mk16UXhPRFlnTUM0Mk1EVXpNamhETUM0Mk16UXhPRFlnTUM0Mk1UVTNORFVnTUM0Mk1qZzJORFlnTUM0Mk1qUTROamdnTUM0Mk1qQXpOVEVnTUM0Mk1qazVNVEZhVFRBdU5qY3lOVEU1SURBdU5qSTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUxTURBeE9WWXdMamczTlRNMk5rTXdMalUxTURBeE9TQXdMamczT0RBME1pQXdMalUxTURJeE1pQXdMamc0TURZM01pQXdMalUxTURVNE5DQXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1qazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056YzFNalFnTUM0Mk5qSTNNa3d3TGpjM09UazFPU0F3TGpZMk1qYzRPRU13TGpnd01UY3pOaUF3TGpZMk5EQXdOU0F3TGpneE9URTJPQ0F3TGpZNE1UUXpOeUF3TGpneU1ETTROaUF3TGpjd016RTVPRXd3TGpneU1EUTFNeUF3TGpjd05UWXpNMVl3TGpnMU56UTRNa3d3TGpneU1ETTROaUF3TGpnMU9Ua3hOME13TGpneE9URTJPQ0F3TGpnNE1UWTNPQ0F3TGpnd01UY3pOeUF3TGpnNU9URXhJREF1TnpjNU9UYzFJREF1T1RBd016STRUREF1TnpjM05UUWdNQzQ1TURBek9UWklNQzQyTWpVMk56ZERNQzQyTURJM09UUWdNQzQ1TURBek9UWWdNQzQxT0RRd09UUWdNQzQ0T0RJME9EUWdNQzQxT0RJNE16SWdNQzQ0TlRrNU1UZE1NQzQxT0RJM05qUWdNQzQ0TlRjME9ESldNQzQzTURVMk16TkRNQzQxT0RJM05qUWdNQzQyT0RJM05TQXdMall3TURZM05DQXdMalkyTkRBMUlEQXVOakl6TWpReUlEQXVOall5TnpnNFREQXVOakkxTmpjM0lEQXVOall5TnpKSU1DNDNOemMxTWpSYVRUQXVOemswTURJNUlEQXVOekk0TnpReFNEQXVOakE1TVRnNFREQXVOakE1TVRjeUlEQXVPRFUzTkRneVF6QXVOakE1TVRjeUlEQXVPRFkyTURJNElEQXVOakUxTmpZM0lEQXVPRGN6TURVMklEQXVOakl6T1RnNUlEQXVPRGN6T1RBeFREQXVOakkxTmpjM0lEQXVPRGN6T1RnM1NEQXVOemMzTlRSTU1DNDNOemt5TWpnZ01DNDROek01TURGRE1DNDNPRFk1T1RZZ01DNDROek14TVRNZ01DNDNPVE14TnpFZ01DNDROalk1TXpjZ01DNDNPVE01TmlBd0xqZzFPVEUzVERBdU56azBNRFExSURBdU9EVTNORGd5VERBdU56azBNREk1SURBdU56STROelF4V2swd0xqWTNPRFE1TXlBd0xqYzBPRFUwTjBNd0xqWTRNelV3TnlBd0xqYzBPRFUwTnlBd0xqWTROelkxSURBdU56VXlNamN6SURBdU5qZzRNekEySURBdU56VTNNVEEzVERBdU5qZzRNemszSURBdU56VTRORFZXTUM0NE5UQTRPRU13TGpZNE9ETTVOeUF3TGpnMU5UZzVNeUF3TGpZNE5EWTNNU0F3TGpnMk1EQXpOeUF3TGpZM09UZ3pOeUF3TGpnMk1EWTVNMHd3TGpZM09EUTVNeUF3TGpnMk1EYzRNMGd3TGpZek1qSTNPVU13TGpZeU56STJOaUF3TGpnMk1EYzRNeUF3TGpZeU16RXlNaUF3TGpnMU56QTFOeUF3TGpZeU1qUTJOaUF3TGpnMU1qSXlORXd3TGpZeU1qTTNOaUF3TGpnMU1EZzRWakF1TnpVNE5EVkRNQzQyTWpJek56WWdNQzQzTlRNME16Y2dNQzQyTWpZeE1ESWdNQzQzTkRreU9UTWdNQzQyTXpBNU16VWdNQzQzTkRnMk16aE1NQzQyTXpJeU56a2dNQzQzTkRnMU5EZElNQzQyTnpnME9UTmFUVEF1TmpZNE5Ua2dNQzQzTmpnek5UUklNQzQyTkRJeE9ESldNQzQ0TkRBNU56ZElNQzQyTmpnMU9WWXdMamMyT0RNMU5GcE5NQzQzTlRjM01UZ2dNQzQzT0RneE9UbERNQzQzTmpNeE9EY2dNQzQzT0RneE9Ua2dNQzQzTmpjMk1qRWdNQzQzT1RJMk16TWdNQzQzTmpjMk1qRWdNQzQzT1RneE1ETkRNQzQzTmpjMk1qRWdNQzQ0TURNeE1UWWdNQzQzTmpNNE9UWWdNQzQ0TURjeU5pQXdMamMxT1RBMk1pQXdMamd3TnpreE5Vd3dMamMxTnpjeE9DQXdMamd3T0RBd05rZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamd3T0RBd05pQXdMamN3TVRZMU9TQXdMamd3TXpVM01pQXdMamN3TVRZMU9TQXdMamM1T0RFd00wTXdMamN3TVRZMU9TQXdMamM1TXpBNE9TQXdMamN3TlRNNE5DQXdMamM0T0RrME5pQXdMamN4TURJeE9DQXdMamM0T0RJNVREQXVOekV4TlRZeUlEQXVOemc0TVRrNVNEQXVOelUzTnpFNFdrMHdMamMzTURreU1pQXdMamMwT0RVME4wTXdMamMzTmpNNU1pQXdMamMwT0RVME55QXdMamM0TURneU5TQXdMamMxTWprNE1TQXdMamM0TURneU5TQXdMamMxT0RRMVF6QXVOemd3T0RJMUlEQXVOell6TkRZMElEQXVOemMzTVNBd0xqYzJOell3TnlBd0xqYzNNakkyTmlBd0xqYzJPREkyTTB3d0xqYzNNRGt5TWlBd0xqYzJPRE0xTkVnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqYzJPRE0xTkNBd0xqY3dNVFkxT1NBd0xqYzJNemt5SURBdU56QXhOalU1SURBdU56VTRORFZETUM0M01ERTJOVGtnTUM0M05UTTBNemNnTUM0M01EVXpPRFFnTUM0M05Ea3lPVE1nTUM0M01UQXlNVGdnTUM0M05EZzJNemhNTUM0M01URTFOaklnTUM0M05EZzFORGRJTUM0M056QTVNakphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyMzciIHk9IjciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1iY2JlMDVhYy0xNDM4LTRiZDAtOTU1Ni0yYTVmMWZhMWZmM2Q7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzE4IiB5PSIxODEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICA8L3Jvb3Q+CjwvbXhHcmFwaE1vZGVsPgo=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows/>
-  <customFields/>
-  <components>
-    <component uuid="50630844-5d1b-4c74-ab2d-a70fe9cce782" diagramComponentId="bcbe05ac-1438-4bd0-9556-2a5f1fa1ff3d" ref="f6a29fea-6f54-4111-aa03-9360ddb31bb7" name="PostgreSQL" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.684">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="fc9771a8-3261-40fc-9e57-bd2eeb0d5c49" diagramComponentId="81a49ae0-a9d0-4a09-a94a-9804a1c2bfd2" ref="b15b943c-ed71-4eca-a2a7-55863dd9c0af" name="WAF" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-WAF">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-AWS-WAF1" name="Control access to AWS WAF resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Control access to AWS WAF resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles). &lt;br&gt; Policies that are attached to an IAM identity are known as identity-based policies, and policies that are attached to a resource are known as resource-based policies. AWS WAF supports only identity-based policies.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Using identity-based policies (IAM policies) for AWS WAF&lt;/p&gt; 
-&lt;p&gt;The following shows an example of a permissions policy:&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2019-07-29", "Statement": [ { "Sid": "CreateFunctionPermissions", "Effect": "Allow", "Action": [ "wafv2:ListWebACLs", "wafv2:GetWebACL", "cloudwatch:ListMetrics", "wafv2:GetSampledRequests" ], "Resource": "*" }, { "Sid": "PermissionToPassAnyRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::account-id:role/*" } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Overview of managing access permissions to your AWS WAF resources" url="https://docs.aws.amazon.com/waf/latest/developerguide/access-control-overview.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.353">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
-&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
-&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
-&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
-&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
-            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="5beb999f-60f3-4910-877b-12a09c778a14" diagramComponentId="d20b3f49-7b6a-4dc2-a5ef-cba8e515b171" ref="717fd1b3-7962-479e-8662-af5e05f9aa49" name="Web Application - Server side (CS-Default)" desc="" library="" parentComponentRef="c60259f7-8d4d-4dfb-a7ac-5f17f1db9fcf" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.130">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.353">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.988">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.807">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.748">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.809">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.200">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.300">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.453">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.306">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f9faeea5-d0ed-4a44-8402-ac458db729a0" diagramComponentId="08bdeca4-6923-4088-8d86-b5a691be8835" ref="9c8ed27d-59fa-4f00-87e6-6fcf94c8dd3f" name="S3 - Simple Storage Service" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
-          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
-                        for an MFA.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
-            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
-            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
-          </references>
-          <standards>
-            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
-                            then your bucket has no versioning enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-3" name="Enable cross-region replication on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enabling cross-Region replication on S3 buckets ensures that multiple versions of the data are available in different distinct Regions. This allows you to store data at even greater distances, minimize latency, increase operational efficiency, and protect against DDoS and data corruption events.&lt;/p&gt;&lt;p&gt;This is one method used to implement system hardening configuration.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;To enable S3 bucket replication&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon S3 console at https://console.aws.amazon.com/s3/.&lt;/li&gt;&lt;li&gt;Choose the S3 bucket that does not have cross-region replication enabled.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Management&lt;/strong&gt;, then choose &lt;strong&gt;Replication&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Add rule&lt;/strong&gt;. If versioning is not already enabled, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose your source bucket - &lt;strong&gt;Entire bucket&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose your destination bucket. If versioning is not already enabled on the destination bucket for your account, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose an IAM role. For more information on setting up permissions for replication, see the &lt;i&gt;Amazon Simple Storage Service User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Enter a rule name, choose &lt;strong&gt;Enabled&lt;/strong&gt; for the status, then choose &lt;strong&gt;Next&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Save&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:39:59.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
-&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
-&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
-            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
-&lt;/div&gt; 
-&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
-            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
- &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
- &lt;/ul&gt; If data in transit is kept unencrypted: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
- &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Version":"2012-10-17", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Id":"PutObjPolicy", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Statement":{ 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Effect":"Deny", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Principal":"*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Action":"s3:PutObject", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Condition":{ 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;} 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;} 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
-            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
-            <reference name="Using Server-side Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api list-buckets --output table
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            ...
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;{
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Effect": "Deny",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Principal": "*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Action": "s3:PutObject",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Condition": {
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
-  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
-  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
-  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
-  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
-  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;br&gt; 
-&lt;br&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
-            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
-            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
-            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
-                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            ./prowler -c extra73
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
-              <output/>
-            </source>
-            <references>
-              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; {&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; "Statement":[&lt;/i&gt; 
-   &lt;i&gt;{&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Condition":{&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;div&gt; 
-       &lt;i&gt;"Bool":&lt;/i&gt; 
-      &lt;/div&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;}&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;i&gt;}&lt;/i&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; }&lt;/i&gt; 
-     &lt;i&gt;]&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt;} &lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
-                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
-                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br /&gt; 
-&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br /&gt; 
-&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
-&lt;br /&gt;Remediation 
-&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
-                            has no MFA delete enabled.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-3" mitigation="25"/>
-                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                <countermeasure ref="AWS-S3-3" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6279ea03-a531-45ab-8f16-0da8eb96bd2d" diagramComponentId="d6b050ad-40a8-4006-a38e-93fd9f35cb27" ref="a5f31feb-0210-47cd-b98c-c4baa599857e" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="ec2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
-          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.966">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
-                        To avoid this, access to the network must be as restricted as possible, so that only the
-                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
-  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 allocate-address --domain vpc 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
-            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
-          </references>
-          <standards>
-            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon Unified CLI: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
-          </references>
-          <standards>
-            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    A list of approved AMIs must be maintained by the organization. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
-  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface:: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each NAT gateway is created in a specific Availability Zone and implemented with 
-  redundancy in that zone. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   and/or 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
-            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
-  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
-  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
-  are engineered to be isolated from failures in other Availability Zones. By launching 
-  instances in separate Availability Zones, you can protect your applications from the failure 
-  of a single location. AWS assigns a unique ID to each subnet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
-  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
-  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
-  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
-  Some AWS regions have more than 2 availability zones and it is recommended to use more 
-  than 2 where possible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The port for these inbound rules would depend on the Database engine used and the 
-  configured port. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The default values are: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
-  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
-  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When we create a default VPC, AWS does the following to set it up: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
-  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
-  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-  Label this Default VPC "Do Not Use". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
-  set a label to remind others not to use it. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
-            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
-            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
-            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
-          </references>
-          <standards>
-            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Copy snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
-            <reference name="Create snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
-            <reference name="Create volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
-            <reference name="Delete volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
-            <reference name="Describe volumes" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
-            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" name="Ensure that the EC2 instances are managed by the systems manager" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances. Additional configuration is needed in Systems Manager for patch deployment to managed EC2 instances.&lt;/p&gt;&lt;p&gt;If you use EC2 instances managed by Systems Manager to collect inventory for your cardholder data environment (CDE), make sure that the instances are managed by Systems Manager. Using Systems Manager can help to maintain an inventory of system components that are in scope for PCI DSS.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For systems that are in scope for PCI DSS, before you install vendor patches in a production environment, you should test and validate them. After you deploy patches, validate security settings and controls to ensure that deployed patches have not affected the security of the CDE. If you use EC2 instances managed by Systems Manager to patch managed instances in your CDE, ensure that the instances are managed by Systems Manager. Systems Manager deploys system patches, which helps to protect system components and software from known vulnerabilities.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;You can use the Systems Manager quick setup to set up Systems Manager to manage your EC2 instances.&lt;/p&gt;&lt;p&gt;To determine whether your instances can support Systems Manager associations, see Systems Manager prerequisites in the &lt;i&gt;AWS Systems Manager User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To ensure EC2 instances are managed by Systems Manager&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Quick setup&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;On the configuration screen, keep the default options.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Set up Systems Manager&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.315">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
-                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
-                        every 90 days (or immediately if security patches become available) to avoid undue exposure
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;For linux instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
-                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
-            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
-            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
-          </references>
-          <standards>
-            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
-                        (ingress/egress) on the default security group in order to force the use of least privilege via
-                        custom created security groups.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
-                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
-                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
-                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the default security group.&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
-                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Default Value&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt;
-   The prescribed value is the default value. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
-            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
-            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
-          </references>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-images --owners self --filters 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    ImageId:ImageId, Public:Public}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.795">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references>
-              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        ALL TCP or ALL ports to avoid undue server exposure.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt; 
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 22</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 3389</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-1" name="VPC default security group should prohibit inbound and outbound traffic" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If a service that is in scope for PCI DSS is associated with the default security group, the default rules for the security group will allow all outbound traffic. The rules also allow all inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.&lt;/p&gt;&lt;p&gt;You should change the default security group rules setting to restrict inbound and outbound traffic. Using the default might violate the requirement to allow only necessary traffic to and from the CDE.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To create new security groups and assign them to your resources&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;. View the default security groups details to see the resources that are assigned to them.&lt;/li&gt;&lt;li&gt;Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;After you assign the new security groups to the resources, remove the inbound and outbound rules from the default security groups. This ensures that the default security groups are not used.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To remove the rules from the default security group&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select a default security group, and choose the &lt;strong&gt;Inbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit inbound rules&lt;/strong&gt;. Then delete all of the inbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;li&gt;Select a default security group and choose the &lt;strong&gt;Outbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit outbound rules&lt;/strong&gt;. Then delete all of the outbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="VOLUMES-NOT-ENCRYPTED">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-02">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-03">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
-                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="0ac902c0-a3a4-40e9-9030-94f08137abe2" diagramComponentId="3987783b-0d58-42bd-8a26-4a72bbcc756e" ref="c60259f7-8d4d-4dfb-a7ac-5f17f1db9fcf" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="ec2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
-          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.838">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.227">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
-                        To avoid this, access to the network must be as restricted as possible, so that only the
-                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
-  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 allocate-address --domain vpc 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
-            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
-          </references>
-          <standards>
-            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon Unified CLI: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
-          </references>
-          <standards>
-            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    A list of approved AMIs must be maintained by the organization. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
-  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface:: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each NAT gateway is created in a specific Availability Zone and implemented with 
-  redundancy in that zone. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   and/or 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
-            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
-  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
-  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
-  are engineered to be isolated from failures in other Availability Zones. By launching 
-  instances in separate Availability Zones, you can protect your applications from the failure 
-  of a single location. AWS assigns a unique ID to each subnet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
-  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
-  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
-  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
-  Some AWS regions have more than 2 availability zones and it is recommended to use more 
-  than 2 where possible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The port for these inbound rules would depend on the Database engine used and the 
-  configured port. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The default values are: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
-  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
-  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When we create a default VPC, AWS does the following to set it up: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
-  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
-  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-  Label this Default VPC "Do Not Use". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
-  set a label to remind others not to use it. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
-            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
-            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
-            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
-          </references>
-          <standards>
-            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Copy snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
-            <reference name="Create snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
-            <reference name="Create volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
-            <reference name="Delete volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
-            <reference name="Describe volumes" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
-            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" name="Ensure that the EC2 instances are managed by the systems manager" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances. Additional configuration is needed in Systems Manager for patch deployment to managed EC2 instances.&lt;/p&gt;&lt;p&gt;If you use EC2 instances managed by Systems Manager to collect inventory for your cardholder data environment (CDE), make sure that the instances are managed by Systems Manager. Using Systems Manager can help to maintain an inventory of system components that are in scope for PCI DSS.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For systems that are in scope for PCI DSS, before you install vendor patches in a production environment, you should test and validate them. After you deploy patches, validate security settings and controls to ensure that deployed patches have not affected the security of the CDE. If you use EC2 instances managed by Systems Manager to patch managed instances in your CDE, ensure that the instances are managed by Systems Manager. Systems Manager deploys system patches, which helps to protect system components and software from known vulnerabilities.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;You can use the Systems Manager quick setup to set up Systems Manager to manage your EC2 instances.&lt;/p&gt;&lt;p&gt;To determine whether your instances can support Systems Manager associations, see Systems Manager prerequisites in the &lt;i&gt;AWS Systems Manager User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To ensure EC2 instances are managed by Systems Manager&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Quick setup&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;On the configuration screen, keep the default options.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Set up Systems Manager&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
-                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
-                        every 90 days (or immediately if security patches become available) to avoid undue exposure
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;For linux instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
-                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
-            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
-            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
-          </references>
-          <standards>
-            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
-                        (ingress/egress) on the default security group in order to force the use of least privilege via
-                        custom created security groups.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
-                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
-                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
-                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the default security group.&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
-                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Default Value&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt;
-   The prescribed value is the default value. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
-            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
-            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
-          </references>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-images --owners self --filters 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    ImageId:ImageId, Public:Public}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.083">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.084">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.084">
-              <output/>
-            </source>
-            <references>
-              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        ALL TCP or ALL ports to avoid undue server exposure.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt; 
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 22</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 3389</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-1" name="VPC default security group should prohibit inbound and outbound traffic" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If a service that is in scope for PCI DSS is associated with the default security group, the default rules for the security group will allow all outbound traffic. The rules also allow all inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.&lt;/p&gt;&lt;p&gt;You should change the default security group rules setting to restrict inbound and outbound traffic. Using the default might violate the requirement to allow only necessary traffic to and from the CDE.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To create new security groups and assign them to your resources&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;. View the default security groups details to see the resources that are assigned to them.&lt;/li&gt;&lt;li&gt;Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;After you assign the new security groups to the resources, remove the inbound and outbound rules from the default security groups. This ensures that the default security groups are not used.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To remove the rules from the default security group&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select a default security group, and choose the &lt;strong&gt;Inbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit inbound rules&lt;/strong&gt;. Then delete all of the inbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;li&gt;Select a default security group and choose the &lt;strong&gt;Outbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit outbound rules&lt;/strong&gt;. Then delete all of the outbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="VOLUMES-NOT-ENCRYPTED">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-02">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-03">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
-                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="eb2a6979-bf61-4c54-aa25-0a91ec8f7177" diagramComponentId="f9f356b7-d35e-405c-b423-1665f1148e7c" ref="358252c4-3454-41c0-a725-ff1c4193ca9e" name="VPC - Virtual Private Cloud" desc="" library="" parentComponentRef="" componentDefinitionRef="vpc">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Being highly selective in peering routing tables is a very effective way of minimizing the
-                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
-            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before you begin, make sure of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
-  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
-  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
-  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
-  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
-  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test end-to-end connectivity 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon EC2 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On the dashboard, choose Launch Instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Choose an instance type, and then choose Next: Configure Instance Details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ping 10.0.0.4 
-&lt;/div&gt; 
-&lt;div&gt;
-  Pinging 10.0.0.4 with 32 bytes of data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ping statistics for 10.0.0.4: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Approximate round trip times in milliseconds: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use SSH or RDP to connect to your instances in the VPC. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control access to VPC resources with IAM identities and policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Control access to VPC resources by using: 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Identities: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authentication is how you sign in to AWS using your identity credentials. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Identity-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Resource-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Access control lists (ACLs): 
-&lt;/div&gt; 
-&lt;div&gt;
-  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Creating CloudWatch alarms to monitor a NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm for outbound traffic through the NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm to monitor port allocation errors 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
-              <output/>
-            </source>
-            <references>
-              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for VPC endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route traffic to an Amazon VPC interface endpoint 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console and open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the right pane, choose the endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the Route 53 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Hosted Zones. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create Record Set. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specify the following values: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose A - IPv4 address. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Yes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias Target 
-&lt;/div&gt; 
-&lt;div&gt;
-  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Different accounts - Enter the value that you got in step 1 of this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Routing Policy 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Evaluate Target Health 
-&lt;/div&gt; 
-&lt;div&gt;
-  Accept the default value of No. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
-                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
-                        incidents that may be occurring across the network.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Select a VPC.&lt;/li&gt;
-                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
-                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select a VPC.&lt;/li&gt;
-                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable VPC Traffic Mirroring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content inspection 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Threat monitoring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Troubleshooting 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your traffic mirror resources using any of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
-              <output/>
-            </source>
-            <references>
-              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
-&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
-&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
-&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
-&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
-            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.447">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Via CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review routing tables of peered VPCs for whether they route
-                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
-                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
-                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
-                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
-                            is as specific as desired.&lt;br /&gt;
-                            &lt;blockquote&gt;
-                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
-                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
-                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
-  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-   &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
-                            test/dev/prod).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network ACLs for VPC as an additional layer of security 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following are the parts of a network ACL rule: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Source. [Inbound rules only] The source of the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow/Deny. Whether to allow or deny the specified traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the navigation pane, choose Network ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select a Network ACL to see details. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use VPC endpoint policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your endpoint policy can be like any IAM policy; however, take note of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                <countermeasure ref="AWS-VPC1" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC7" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3edc2e5f-e2ef-4833-844c-2a847adcace5" diagramComponentId="63436051-797e-4ca7-9a70-ddf3a6c4ef1a" ref="76a20665-1544-491d-9631-538160faaac9" name="Lambda Function" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="aws-lambda-function">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-VPC-IP-ADDRESS-DEPLETION-WEAKNESS" name="AWS VPC IP address depletion" state="0" impact="100" issueId="" issueLink="">
-          <desc>Organizations that deploy AWS Lambda functions in VPC (Virtual Private Cloud) environments should also pay attention to the potential exhaustion of IP addresses in the VPC subnet.  
- An attacker might cause a denial of service scenario by forcing more and more function instances to execute, and deplete the VPC subnet from available IP addresses.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.140">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W10" name="All Lambda functions have the same permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>Setting of permissions is done at the function level. Because there could be many functions, the job of configuring permissions on each one is all too often ignored or forgotten, leading to security weak spots.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.492">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-592" name="Authentication Bypass Issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly perform authentication, allowing it to be bypassed through various methods.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.944">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-592: Authentication Bypass Issues" url="https://cwe.mitre.org/data/definitions/592.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W12" name="Containers aren't monitored" state="0" impact="100" issueId="" issueLink="">
-          <desc>Monitoring is needed to understand the relationships between all of the objects across a virtual environment's topology, recognize the difference between inconsequential anomalies and actual performance problems. This will show you the root cause and recommended actions for remediation. This way, you can understand what needs your attention, and how to narrow a problem to the relevant components.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W4" name="Data in transit is sent using a weak encryption algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>When the SSL/TLS service is present this is good but does introduce complexities that must be overcome:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;SSL/TLS protocols, ciphers, keys and renegotiation must be properly configured.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Certificate validity must be ensured.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W3" name="Data in transit was sent via an unencrypted protocol" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data must be protected when it is transmitted through the network. Currently the security best practice is to send any data over an encrypted channel. As a rule of thumb if data must be protected when it is stored, this data must also be protected during transmission.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of sensitive data include:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Information used in authentication (e.g. Credentials, PINs, Session identifiers, Tokens, Cookies...)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Information protected by laws, regulations or specific organizational policy (e.g. Credit Cards, Customers data)&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W20" name="DynamoDB APIs are vulnerable to XSS" state="0" impact="100" issueId="" issueLink="">
-          <desc>DynamoDB is a NoSQL database and as such is schemaless. NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W8" name="Environment variables are not stored securely" state="0" impact="100" issueId="" issueLink="">
-          <desc>Environment variables were stored in plain text configuration files and stored in the code repository</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W15" name="Functions consume too much memory" state="0" impact="100" issueId="" issueLink="">
-          <desc>Default limits and poor configuration can lead to successful DDoS attacks.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W16" name="Functions don't have a rate limit or aren't throttled" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker can try to freeze the system with huge amounts of requests. 
- If your concurrency limits are set and high, an attacker can still execute a lot of requests and it will cost you a lot of money. It's important to set some limits on services or functions.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W14" name="Functions have poor concurrency limits" state="0" impact="100" issueId="" issueLink="">
-          <desc>If your concurrency limits are too small, scaling will not be as flexible as you would like. If your concurrency limits are too high, DoS could be a problem.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W17" name="Functions take too long to execute" state="0" impact="100" issueId="" issueLink="">
-          <desc>The function is taken too long to execute. This could be because the function is doing too much or recursive patterns are used.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W13" name="Functions use vulnerable dependencies" state="0" impact="100" issueId="" issueLink="">
-          <desc>Dependency management is a widespread problem in development. Developers may be unaware that third-party libraries or frameworks can contain vulnerabilities and those vulnerabilities are being constantly detected.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.436">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W22" name="Messages exposed to end users reveal information about serverless functions and the logic used" state="0" impact="100" issueId="" issueLink="">
-          <desc>Messages to end users must only contain general information and not leak data relating to software implementation or the underlying technology.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W19" name="No validation for asynchronous events" state="0" impact="100" issueId="" issueLink="">
-          <desc>Lambda can handle several different event types that can trigger a serverless function. These event types don't necessarily need to be HTTP requests (e.g. S3, SNS, SES, CloudWatch Events, etc.). This increases the potential attack surface and introduces complexities to secure the serverless functions.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W1" name="Sensitive stored information was not encrypted at rest" state="0" impact="100" issueId="" issueLink="">
-          <desc>Because sensitive information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is used and decode the information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W2" name="The Data Store is directly exposed to the internet" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data Stores are accessible by the public internet with no - or weak - authentication.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W11" name="The container has processes, pieces of code or temporary files lingering around" state="0" impact="100" issueId="" issueLink="">
-          <desc>Container lifetime is important, but also the correct execution and cleanup of your functions. If the container has lingering temporary files or - for example - static data in memory, an attacker could steal this information and leverage it for building a more destructive attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W9" name="The function takes untrusted input" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developers should avoid writing code that passes user-controlled input to dangerous functions. This is one of the basics of secure programming. Whenever a function has the capability to execute a dangerous action, it should either not receive user input, or the user-controlled data should be sanitized in order to prevent a malicious user from breaking the intended functionality.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W18" name="The retry mechanism of asynchronous sources are not configured correctly" state="0" impact="100" issueId="" issueLink="">
-          <desc>Asynchronous events (e.g. S3, SNS, SES, CloudWatch Events, etc.) uses queues before invoking, so retry behavior must be taken in account.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W6" name="Unused functions are more risk from a security standpoint as they are often not maintained" state="0" impact="100" issueId="" issueLink="">
-          <desc>Unused functions are mostly unmaintained. Therefore code may not be regularly reviewed. And because the code isn't under your attention, this can impose a security risk, especially if the functionality of your application changes over time.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W5" name="Unused functions have vulnerable dependencies because they were never updated" state="0" impact="100" issueId="" issueLink="">
-          <desc>Unused functions remain mostly unpatched. So if dependencies have vulnerabilities, this might not catch your attention and could create a security weak point.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W21" name="Verbose error messages are left in the code and are not removed before moving to production" state="0" impact="100" issueId="" issueLink="">
-          <desc>Error messages or debugging information must be removed before moving to the production/release branch. This type of information gives an attacker additional insight on the internal working of the application/functions and on the technology used.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-LAMBDA-W7" name="Your AWS credentials were stored in a code repositories such as GitHub" state="0" impact="100" issueId="" issueLink="">
-          <desc>Monitoring is needed to understand the relationships between all of the objects across a virtual environment's topology and recognize the difference between inconsequential anomalies and actual performance problems. 
- This will identify root causes and recommended actions for remediation. This way, you can understand what needs your attention, and how to narrow down a problem to the relevant components.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Click on Users.&lt;/li&gt; 
-  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Select the user.&lt;/li&gt; 
-   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ol&gt;Create a Group and add a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
-  &lt;li&gt;Click Create Group.&lt;/li&gt; 
-  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
-  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
-                            --output text&lt;/li&gt;
-                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-attached-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C20" name="Change the default memory usage to the amount of memory the function really needs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Specify the amount of memory you want to allocate for your Lambda function. CloudWatch logs can contain memory usage on each function execution. Set the default memory usage to the amount of memory that the function really needs. By default, it set to of 1024 MB.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Update the memory size of your functions using the following AWS CLI command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda update-function-configuration --function-name myfunction --memory-size 256&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;In the example, we change the amount memory for the function to 256 MB.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
-            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
-            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the AWS Lambda console at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Choose a function.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Settings are on the first page shown.&lt;/li&gt; 
- &lt;li&gt;Check that each function has got the really necessary amount of memory.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C26" name="Configurate the retry settings of asynchronous sources" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Any Lambda function invoked asynchronously is retried twice before the event is discarded. If the retries fail and you're unsure why, use Dead Letter Queues (DLQ) to direct unprocessed events to an Amazon SQS queue or an Amazon SNS topic to analyze the failure.&lt;/p&gt; 
-&lt;p&gt;AWS Lambda directs events that cannot be processed to the specified Amazon SNS topic or Amazon SQS queue. Functions that don't specify a DLQ will discard events after they have exhausted their retries. For more information about retry policies, see AWS Lambda Retry Behavior.&lt;/p&gt; 
-&lt;p&gt;You configure a DLQ by specifying the Amazon Resource Name TargetArn value on the Lambda function's DeadLetterConfig parameter.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Update the timeout of your functions using the following AWS CLI command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda update-function-configuration --function-name myfunction --dead-letter-config (structure)&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;A dead letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see Dead Letter Queues in the references.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
- &lt;p&gt; TargetArn=string&lt;/p&gt; 
- &lt;p&gt; JSON Syntax:&lt;/p&gt; 
- &lt;p&gt;{ "TargetArn": "string"&lt;/p&gt; 
- &lt;p&gt; }&lt;/p&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Retry Behavior" url="https://docs.aws.amazon.com/lambda/latest/dg/retries-on-errors.html"/>
-            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
-            <reference name="Dead Letter Queue" url="https://docs.aws.amazon.com/lambda/latest/dg/dlq.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Use AWS CLI and use the following command to view the timeout limit per function:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check all function and verify that they have got set a well the timeout limit.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C12" name="Configure IAM Role statements on a per-function basis" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;You should spend time crafting suitable, minimal roles for each of your functions. This leverages the principle of least privilege. If you are using the API Gateway, you can also set Lambda authorizers. A Lambda function should do one specific task, so ensure the following model is followed: One function, one use case, one permission.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt; Remediation: &lt;br /&gt;&lt;/b&gt; UsingAWSConsole: &lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Login to theAWSManagement Console.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Navigate to the Lambda dashboard at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the navigation panel, underAWSLambda section, choose Functions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Choose the Lambda function that you want to examine then click on the function name to access its configuration page.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Select the Configuration tab then click the Execution role to expand the panel with theIAMrole that defines the permissions for the selected function.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Copy the name of theIAMexecution role currently available in the Existing role drop-down list.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Now navigate to theIAMdashboard at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the left navigation panel, choose Roles.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Paste the name of the execution role copied at step no. 6 in the Search box and press Enter.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Click on the AmazonIAMexecution role returned as the result.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;On theIAMrole configuration page, select the Permissions tab from the bottom panel.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Click on the attachedIAMpolicy name available within Policy name column to access the policy document (JSONformat).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Include inside the {}JSONpanel, the policy document defined for the selectedIAMexecution role.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Add the Action and Resource elements&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;and their current values, if the element values are set to "*"&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;and the Effect is set to "Allow",the selected Amazon Lambda function has admin privileges (we have to restrict the admin privileges in the Amazon Lambda function)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Repeat step no. 12 and 13 to add otherIAMpolicies attached to the selected execution role.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Repeat steps no. 4 - 16 to add theIAMexecution role permissions for other Amazon Lambda functions created within the current region.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Change theAWSregion from the navigation bar and repeat the process for the other regions.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;UsingAWSConsole:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Login to theAWSManagement Console.&lt;/li&gt; 
- &lt;li&gt;Navigate to the Lambda dashboard at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the navigation panel, underAWSLambda section, choose Functions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Choose the Lambda function that you want to examine then click on the function name to access its configuration page.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Select the Configuration tab then click the Execution role to expand the panel with theIAMrole that defines the permissions for the selected function.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Copy the name of theIAMexecution role currently available in the Existing role drop-down list.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Now navigate to theIAMdashboard at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the left navigation panel, choose Roles.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Paste the name of the execution role copied at step no. 6 in the Search box and press Enter.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Click on the AmazonIAMexecution role returned as the result.&lt;/li&gt; 
- &lt;li&gt;On theIAMrole configuration page, select the Permissions tab from the bottom panel.&lt;/li&gt; 
- &lt;li&gt;Click on the attachedIAMpolicy name available within Policy name column to access the policy document (JSONformat).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Inside the {}JSONpanel, verify the policy document defined for the selectedIAMexecution role. Identify Action and Resource elements and their current values. If the element values are set to "*" and the Effect is set to "Allow",the selected Amazon Lambda function has admin privileges&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&amp;nbsp;Repeat step no. 12 and 13 to verify otherIAMpolicies attached to the selected execution role.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Repeat steps no. 4 - 15 to verify theIAMexecution role permissions for other Amazon Lambda functions created within the current region.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Change theAWSregion from the navigation bar and repeat the process for the other regions.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.336">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.17" name="Configure TLS1.1+ for CloudFront to Origin connection" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  CloudFront can connect to your origin using only HTTP, only HTTPS, or to connect by matching the protocol used by the viewer. Our recommendation is to use HTTPS only. In 
-  this case you can choose which SSL\TLS protocols CloudFront is allowed to use when 
-  establishing an HTTPS connection to your origin. Ensure that you are using only TLS1.1+ as 
-  the SSL\TLS protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For configuring Origin SSL protocols first save locally the current distribution config:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Edit and replace "OriginSslProtocols" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "OriginSslProtocols": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    &amp;nbsp;"Items": [ 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "TLSv1.1", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "TLSv1.2" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    ], 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Quantity": 2 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    }, 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon Cloudfront New Origin Security Features" url="https://aws.amazon.com/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin-security-features/"/>
-            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="1.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the "OriginSslProtocols" used by application Cloudfront distributions (only TLSv1.1 and TLSv1.2 should be present):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, OriginSslProtocols:Origins.Items[*].CustomOriginConfig.OriginSslProtocols.Items[*]}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C11" name="Enable and set up Request Validation in API Gateway" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To perform the API Gateway basic validation, we have to enable and set up the Request Validation in the API Gateway.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To enable basic validation, you specify validation rules in a request validator, add the validator to the API's map of request validators, and assign the validator to individual API methods.&lt;/p&gt; 
-&lt;p&gt;To set up a basic validation, we have some possibilities to configure it:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;by Importing OpenAPI Definition&lt;/li&gt; 
- &lt;li&gt;using the API Gateway REST API&lt;/li&gt; 
- &lt;li&gt;using the API Gateway Console&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Using the API Gateway Console:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The API Gateway console lets you set up the basic request validation on a method using one of the three validators:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Validate body: This is the body-only validator.&lt;/li&gt; 
-  &lt;li&gt;Validate query string parameters and headers: This is the parameters-only validator.&lt;/li&gt; 
-  &lt;li&gt;Validate body, query string parameters, and headers: This validator is for both body and parameters validation.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;When you choose one of the above validators to enable it on an API method, the API Gateway console will add the validator to the API's RequestValidators map, if the validator has not already been added to the validators map of the API. To enable a request validator on a method:&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the API Gateway console, if not already logged in.&lt;/li&gt; 
-  &lt;li&gt;Create a new or choose an existing API.&lt;/li&gt; 
-  &lt;li&gt;Create a new or choose an existing resource of the API.&lt;/li&gt; 
-  &lt;li&gt;Create a new or choose an existing method the resource.&lt;/li&gt; 
-  &lt;li&gt;Choose Method Request.&lt;/li&gt; 
-  &lt;li&gt;Choose the pencil icon of Request Validator under Settings.&lt;/li&gt; 
-  &lt;li&gt;Choose Validate body, Validate query string parameters and headers or Validate body, query string parameters, and headers from the Request Validator drop-down list and then choose the check mark icon to save your choice.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;For more information see the references.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify in the code if input parameters for functions are validated&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
-&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
-&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
-            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C16" name="Ensure it only exists one user to access to the API gateway" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The API gateway sits between the Lambda functions and the user. You must create an API gateway user that only has the ability to communicate with Lambda functions. It can only communicate between your internal perimeter. If the user is manipulated to send from a source other than theAPIgateway, access should be denied. You can also set Lambda authorizers in the API Gateway. &lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; Configure the Lambda authorizers on API methods: &lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the API Gateway console.&lt;/li&gt; 
- &lt;li&gt;Create an API method and choose Authorizers under that API.&lt;/li&gt; 
- &lt;li&gt;Give the permissions to access to the Lambda Functions only to one user.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Set Up an IAM to Invoke Lambda Functions" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-lambda.html#api-as-lambda-proxy-setup-iam-role-policies"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify that Lambda authorizers are configured on API methods:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the API Gateway console.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Select each existing API and choose Authorizers under that API.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Check that it exist only one API gateway user with the permissions to access to the Lambda Functions.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" name="Ensure that each Lambda Function has got at least one VPC subnet in each Availability Zone" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;By specifying subnets in each of the Availability Zones, your Lambda function can run in another Availability Zone if one goes down or runs out of IP addresses.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Review each function and verify that each function has got at least one associated subnet Id in different Availability Zone with the following command:&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt;aws lambda get-function --function-name&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;If there is any function without associated Subnet Id per Availability Zone, we can update the Lambda function and assign a subnet from a specific Availability Zone with the following command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda update-function-configuration --function-name --vpc-config &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. For more information, see VPC Settings .&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
- &lt;p&gt;SubnetIds=string,string,SecurityGroupIds=string,string&lt;/p&gt; 
- &lt;p&gt; JSON Syntax:&lt;/p&gt; 
- &lt;p&gt;{ "SubnetIds": ["string", ...], "SecurityGroupIds": ["string", ...]&lt;/p&gt; 
- &lt;p&gt; }&lt;/p&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda get function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function.html#output"/>
-            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
-            <reference name="Configuring a Lambda Function to Access Resources in an Amazon VPC" url="https://docs.aws.amazon.com/lambda/latest/dg/vpc.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that all Lambda functions have got at least one associate VPN subnet per Availability Zone with the following command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C8" name="Ensure that sensitive data is not commited to the repository" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create the mechanisms to ensure that sensitive data, such personal data or credentials is not uploaded to a repository. There are different ways to implement it. One of them is with the git pre-commit hooks, this way is described in the references.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Preventing AWS credential leaks in Git with pre-commit" url="https://www.unixdaemon.net/cloud/preventing-aws-creds-in-git-with-pre-commit/"/>
-            <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that there is not any sensitive data in the code from a repository.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C29" name="Ensure that sensitive data is not saved into logs files" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Review periodically all logs to ensure that sensitive data is not presented in the logs files.&lt;/p&gt;
-
-	&lt;p&gt;AWS introduces a new security service Macie recognizing sensitive data such as personally identifiable information (PII) or intellectual property, and provides you with dashboards and alerts that give visibility into how this data is being accessed or moved.&lt;/p&gt;
-
-	&lt;p&gt;You can also use the Amazon Macie service to classify all data and find if there is sensitive data in the logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CloudWatch user guide" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html"/>
-            <reference name="AWS Macie" url="https://aws.amazon.com/macie/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify if the log files don't contain sensitive data.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" name="Ensure that the access control through API is centralized" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The access control, authentication and authorization procedures through API shall be centralized. To implement it into Lambda functions, we have got the two options:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication as well as information described by headers, paths, query strings, stage variables, or context variables request parameters.&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;TOKEN type Lambda authorizers grant a caller permissions to invoke a given request using an authorization token passed in a header. The token could be, for example, an OAuth token.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;REQUEST type Lambda authorizers grant a caller permissions to invoke a given request using request parameters, including headers, query strings, stage variables, or context parameters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; Create an API Gateway Lambda Authorizer Lambda Function:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Before creating an API Gateway Lambda authorizer, you must first create the AWS Lambda function that implements the logic to authorize and, if necessary, to authenticate the caller. You can do so in the Lambda console, using the code template available from the API Gateway Lambda Authorizer blueprint.&lt;/li&gt; 
- &lt;li&gt;To grant IAM principals in the account that owns the API permission to call authorizer:create or create-authorizer to control the Lambda function used in your Lambda authorizer, you can create the following IAM policy.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt;
-    { 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;quot;Statement&amp;quot;: [ 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Action&amp;quot;: [ 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;apigateway:POST&amp;quot; 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Resource&amp;quot;: [ 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;arn:aws:apigateway:region::/restapis/restapi_id/authorizers&amp;quot; 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; //Create Authorizer operation is allowed only with the following Lambda function 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Condition&amp;quot;: { 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;StringEquals&amp;quot;: { 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;apigateway:AuthorizerUri&amp;quot;: &amp;quot;arn:aws:lambda:region:account-id:function:lambda-function-name&amp;quot; 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    &amp;nbsp; &amp;nbsp; ] 
-  &lt;/blockquote&gt; 
-  &lt;blockquote&gt;
-    } 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;p&gt;&lt;/p&gt; 
- &lt;p&gt;Create a Lambda Function for a Lambda Authorizer of the TOKEN type&lt;br /&gt;&lt;/p&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;In the code editor of the Lambda console, enter the following Node.js code as an example of the API Gateway Lambda authorizer of the TOKEN type.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;p&gt;&lt;/p&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;p&gt;// A simple TOKEN authorizer example to demonstrate how to use an authorization token&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// to allow or deny a request. In this example, the caller named 'user' is allowed to invoke&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// a request if the client-supplied token value is 'allow'. The caller is not allowed to invoke&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// the request if the token value is 'deny'. If the token value is 'Unauthorized', the function&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// returns the 'Unauthorized' error with an HTTP status code of 401. For any other token value,&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// the authorizer returns an 'Invalid token' error.&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
-   &lt;p&gt;exports.handler =&amp;nbsp; function(event, context, callback) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var token = event.authorizationToken;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; switch (token.toLowerCase()) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'allow':&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generatePolicy('user', 'Allow', event.methodArn));&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'deny':&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generatePolicy('user', 'Deny', event.methodArn));&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'unauthorized':&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Unauthorized&amp;quot;);&amp;nbsp; &amp;nbsp;// Return a 401 Unauthorized response&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default:&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Error: Invalid token&amp;quot;);&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
-   &lt;p&gt;};&lt;/p&gt; 
-   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
-   &lt;p&gt;// Help function to generate an IAM policy&lt;/p&gt; 
-   &lt;p&gt;var generatePolicy = function(principalId, effect, resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.principalId = principalId;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (effect &amp;amp;&amp;amp; resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var policyDocument = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Version = '2012-10-17';&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement = [];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var statementOne = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Action = 'execute-api:Invoke';&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Effect = effect;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Resource = resource;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement[0] = statementOne;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; authResponse.policyDocument = policyDocument;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Optional output with custom properties of the String, Number or Boolean type.&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.context = {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;stringKey&amp;quot;: &amp;quot;stringval&amp;quot;,&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;numberKey&amp;quot;: 123,&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;booleanKey&amp;quot;: true&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; };&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; return authResponse;&lt;/p&gt; 
-   &lt;p&gt;}&lt;/p&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;p&gt;Create a Lambda Function of a Lambda Authorizer of the REQUEST type&lt;br /&gt;&lt;/p&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;In the code editor of the Lambda console, enter the following Node.js code for a simplified Lambda function as an example of the API Gateway Lambda authorizers of the REQUEST type.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;p&gt;&lt;/p&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;p&gt;exports.handler = function(event, context, callback) {&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; console.log('Received event:', JSON.stringify(event, null, 2));&lt;/p&gt; 
-   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // A simple REQUEST authorizer example to demonstrate how to use request&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // parameters to allow or deny a request. In this example, a request is&amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // authorized if the client-supplied HeaderAuth1 header, QueryString1 query parameter,&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // stage variable of StageVar1 and the accountId in the request context all match&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // specified values of 'headerValue1', 'queryValue1', 'stageValue1', and&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // '123456789012', respectively.&lt;/p&gt; 
-   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Retrieve request parameters from the Lambda function input:&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var headers = event.headers;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var queryStringParameters = event.queryStringParameters;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var pathParameters = event.pathParameters;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var stageVariables = event.stageVariables;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var requestContext = event.requestContext;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Parse the input for the parameter values&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var tmp = event.methodArn.split(':');&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var apiGatewayArnTmp = tmp[5].split('/');&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var awsAccountId = tmp[4];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var region = tmp[3];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var restApiId = apiGatewayArnTmp[0];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var stage = apiGatewayArnTmp[1];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var method = apiGatewayArnTmp[2];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var resource = '/'; // root resource&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (apiGatewayArnTmp[3]) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; resource += apiGatewayArnTmp[3];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Perform authorization to return the Allow policy for correct parameters and&amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // the 'Unauthorized' error, otherwise.&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var condition = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; condition.IpAddress = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (headers.HeaderAuth1 === &amp;quot;headerValue1&amp;quot;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; queryStringParameters.QueryString1 === &amp;quot;queryValue1&amp;quot;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; stageVariables.StageVar1 === &amp;quot;stageValue1&amp;quot;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; requestContext.accountId === &amp;quot;123456789012&amp;quot;) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generateAllow('me', event.methodArn));&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&amp;nbsp; else {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Unauthorized&amp;quot;);&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
-   &lt;p&gt;}&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;// Help function to generate an IAM policy&lt;/p&gt; 
-   &lt;p&gt;var generatePolicy = function(principalId, effect, resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Required output:&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.principalId = principalId;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (effect &amp;amp;&amp;amp; resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var policyDocument = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Version = '2012-10-17'; // default version&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement = [];&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var statementOne = {};&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Action = 'execute-api:Invoke'; // default action&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Effect = effect;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Resource = resource;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement[0] = statementOne;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; authResponse.policyDocument = policyDocument;&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Optional output with custom properties of the String, Number or Boolean type.&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.context = {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;stringKey&amp;quot;: &amp;quot;stringval&amp;quot;,&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;numberKey&amp;quot;: 123,&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;booleanKey&amp;quot;: true&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; };&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; return authResponse;&lt;/p&gt; 
-   &lt;p&gt;}&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;var generateAllow = function(principalId, resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; return generatePolicy(principalId, 'Allow', resource);&lt;/p&gt; 
-   &lt;p&gt;}&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
-   &lt;p&gt;var generateDeny = function(principalId, resource) {&lt;/p&gt; 
-   &lt;p&gt;&amp;nbsp; &amp;nbsp; return generatePolicy(principalId, 'Deny', resource);&lt;/p&gt; 
-   &lt;p&gt;}&lt;/p&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;div&gt; 
-  &lt;p&gt;Amazon Cognito&lt;/p&gt; 
-  &lt;p&gt;&lt;/p&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;To create and configure an Amazon Cognito user pool for your API, you perform the following tasks:&lt;/li&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Use the Amazon Cognito console, CLI/SDK, or API to create a user pool-or use one that's owned by another AWS account.&lt;/li&gt; 
-    &lt;li&gt;Use the API Gateway console, CLI/SDK, or API to create an API Gateway authorizer with the chosen user pool.&lt;/li&gt; 
-    &lt;li&gt;Use the API Gateway console, CLI/SDK, or API to enable the authorizer on selected API methods.&lt;/li&gt; 
-   &lt;/ol&gt; 
-   &lt;li&gt;To call any API methods with a user pool enabled, your API clients perform the following tasks:&lt;/li&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Use the Amazon Cognito CLI/SDK or API to sign a user in to the chosen user pool, and obtain an identity token or access token.&lt;/li&gt; 
-    &lt;li&gt;Use a client-specific framework to call the deployed API Gateway API and supply the appropriate token in the Authorization header.&lt;/li&gt; 
-   &lt;/ol&gt; 
-  &lt;/ul&gt; 
-  &lt;p&gt;&lt;/p&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Control Access to a REST API Using Amazon Cognito User Pools as Authorizer" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html"/>
-            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that access control mechanisms for the API are centralized.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.900">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C14" name="Ensure that there is no user in production with the permission to delete permission on any service" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure that there is no user in production that can delete services, functions and perhaps even data. This will ensure that nobody deletes items by accident. If delete actions are required in production, ensure that you have proper guidelines in place to prevent accidental deletion.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To view a function's resource-based policy, use the get-policy command.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-policy --function-name my-function --output text&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;For versions and aliases, append the version number or alias to the function name.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-policy --function-name my-function:PROD&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;To remove permissions from your function, use remove-permission.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda remove-permission --function-name example --statement-id sns&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;Use the get-layer-version-policy command to view the permissions on a layer, and remove-layer-version-permission to remove statements from the policy.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-layer-version-policy --layer-name my-layer --version-number 3 --output text&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt;aws lambda remove-layer-version-permission --layer-name my-layer --version-number 3 --statement-id engineering-org&lt;/p&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use the following command to view the remove permission over a certain function:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-layer-version-policy --layer-name my-layer --version-number 3 --output text&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;Verify that the command above doesn't show the permissions defined with "Action": ["lambda:DeleteFunction"]&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" name="Ensure that your VPC Lambda subnet has enough IP addresses to scale" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The subnets you specify should have sufficient available IP addresses to match the number of ENIs. If your VPC does not have sufficient ENIs or subnet IPs, your Lambda function will not scale as requests increase, and you will see an increase in invocation errors with EC2 error types like EC2ThrottledException. For asynchronous invocation, if you see an increase in errors without corresponding CloudWatch Logs, invoke the Lambda function synchronously in the console to get the error responses. &lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Review each function and verify that each function has got at least one associated subnet Id with the following command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;If there is any function without associated Subnet Id, we can update the function and assign a subnet with the following command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda update-function-configuration --function-name --vpc-config &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. For more information, see VPC Settings .&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
- &lt;p&gt;SubnetIds=string,string,SecurityGroupIds=string,string&lt;/p&gt; 
- &lt;p&gt; JSON Syntax:&lt;/p&gt; 
- &lt;p&gt;{ "SubnetIds": ["string", ...], "SecurityGroupIds": ["string", ...]&lt;/p&gt; 
- &lt;p&gt; }&lt;/p&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda get function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function.html#output"/>
-            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
-            <reference name="Configuring a Lambda Function to Access Resources in an Amazon VPC" url="https://docs.aws.amazon.com/lambda/latest/dg/vpc.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that all functions have got at least one associate VPN subnet with the following command:&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable AWS Log integrity for the application generated logs, such as storing logs on write-once media, forwarding a copy of the logs to a centralized SIEM or generating message digests for each log file.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;AWS Management Console:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;To enable log file integrity validation with the CloudTrail console, choose Yes for the Enable log file validation option when you create or update a trail. By default, this feature is enabled for new trails.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
- &lt;li&gt;AWS CLI:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;To enable log file integrity validation with the AWS CLI, use the --enable-log-file-validation option with the create-trail or update-trail commands.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;To disable log file integrity validation, use the --no-enable-log-file-validation option.&lt;/li&gt; 
-  &lt;li&gt;For example:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;p&gt;aws cloudtrail update-trail --name your-trail-name --enable-log-file-validation&lt;/p&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;CloudTrail API:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;To enable log file integrity validation with the CloudTrail API, set the EnableLogFileValidation request parameter to true when calling CreateTrail or UpdateTrail.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI describe trails" url="https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/describe-trails.html"/>
-            <reference name="Enabling Log File Integrity Validation for CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the AWS Logs Integrity is enabled if the output of the following command in the AWS CLI has got the variable "LogFileValidationEnabled" set to true.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws cloudtrail describe-trails&lt;/p&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C5" name="Ensure you store your encryption keys in a Key Management System" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Verify that you are using the Key Management Service. You can see a list of your customer managed keys in the AWS Management Console.&lt;br /&gt; To view your CMKs (console): &lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the left navigation pane, choose Encryption keys.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For Region, choose the appropriate AWS Region. Do not use the region selector in the navigation bar (top right corner). The console shows all the CMKs in your AWS account in the chosen region, including customer-managed and AWS managed CMKs. The page displays the alias, key ID, status, and creation date for each CMK.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;If you need to create a CMK:&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the AWS Management Console and open the AWS Key Management Service (AWS KMS) console at https://console.aws.amazon.com/kms.&lt;/li&gt; 
- &lt;li&gt;To change the AWS Region, use the Region selector in the upper-right corner of the page.&lt;/li&gt; 
- &lt;li&gt;In the navigation pane, choose Customer managed keys.&lt;/li&gt; 
- &lt;li&gt;Choose Create key.&lt;/li&gt; 
- &lt;li&gt;Type an alias for the CMK. The alias name cannot begin with aws/. The aws/ prefix is reserved by Amazon Web Services to represent AWS managed CMKs in your account.&lt;/li&gt; 
- &lt;li&gt;An alias is a display name that you can use to identify the CMK. We recommend that you choose an alias that indicates the type of data you plan to protect or the application you plan to use with the CMK.&lt;/li&gt; 
- &lt;li&gt;Aliases are required when you create a CMK in the AWS Management Console. They are optional when you use the CreateKey operation.&lt;/li&gt; 
- &lt;li&gt;(Optional) Type a description for the CMK.&lt;/li&gt; 
- &lt;li&gt;We recommend that you choose a description that explains the type of data you plan to protect or the application you plan to use with the CMK.&lt;/li&gt; 
- &lt;li&gt;Choose Next.&lt;/li&gt; 
- &lt;li&gt;(Optional) Type a tag key and an optional tag value. To add more than one tag to the CMK, choose Add tag.&lt;/li&gt; 
- &lt;li&gt;When you add tags to your AWS resources, AWS generates a cost allocation report with usage and costs aggregated by tags. For information about tagging CMKs, see Tagging Keys.&lt;/li&gt; 
- &lt;li&gt;Choose Next.&lt;/li&gt; 
- &lt;li&gt;Select the IAM users and roles that can administer the CMK.&lt;/li&gt; 
- &lt;li&gt;(Optional) To prevent the selected IAM users and roles from deleting this CMK, in the Key deletion section at the bottom of the page, clear the Allow key administrators to delete this key check box.&lt;/li&gt; 
- &lt;li&gt;Choose Next.&lt;/li&gt; 
- &lt;li&gt;Select the IAM users and roles that can use the CMK for cryptographic operations.&lt;/li&gt; 
- &lt;li&gt;(Optional) You can allow other AWS accounts to use this CMK for cryptographic operations. To do so, in the Other AWS accounts section at the bottom of the page, choose Add another AWS account and enter the AWS account identification number of an external account. To add multiple external accounts, repeat this step.&lt;/li&gt; 
- &lt;li&gt;Choose Next.&lt;/li&gt; 
- &lt;li&gt;Review the key policy document that was created from your choices. You can edit it, too.&lt;/li&gt; 
- &lt;li&gt;Choose Finish to create the CMK.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Key management service documentation" url="https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that you are using the Key Management Service. To view a list of your customer managed keys in the AWS Management Console.&lt;/li&gt; 
- &lt;li&gt;To view your CMKs (console):&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
-  &lt;li&gt;In the left navigation pane, choose Encryption keys.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;For Region, choose the appropriate AWS Region. Do not use the region selector in the navigation bar (top right corner). The console shows all the CMKs in your AWS account in the chosen region, including customer-managed and AWS managed CMKs. The page displays the alias, key ID, status, and creation date for each CMK.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" name="Increase log reports with serverless-specific information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Organizations adopting serverless architectures, are encouraged to augment log reports with serverless-specific information such as:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Logging of API access keys related to successful/failed logins (authentication)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Attempts to invoke serverless functions with inadequate permissions (authorizations)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Successful/failed deployment of new serverless functions or configurations (change)&lt;/li&gt; 
- &lt;li&gt;Changes to function permissions or execution roles (change)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Changes to files or access permissions on relevant cloud storage services (change)&lt;/li&gt; 
- &lt;li&gt;Changes in function trigger definitions (change)&lt;/li&gt; 
- &lt;li&gt;Anomalous interaction or irregular flow between serverless functions (change)&lt;/li&gt; 
- &lt;li&gt;Changes to 3rd party dependencies (modules, libraries or APIs)&lt;/li&gt; 
- &lt;li&gt;Outbound connections initiated by serverless functions (network)&lt;/li&gt; 
- &lt;li&gt;Execution of serverless functions or access to data from an external 3rd party account not related to the main account to which the serverless application belongs (resource access)&lt;/li&gt; 
- &lt;li&gt;Serverless function execution timeouts (failure reports)&lt;/li&gt; 
- &lt;li&gt;Concurrent serverless function execution limits reached (failure reports)&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Organizations are also encouraged to adopt serverless application logic/code runtime tracing and debugging facilities in order to gain better understanding of the overall system and data flow. For example: AWS X-Ray&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; To log more actions with the CloudTrail, we only have to create a trail as following:&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Create a trail. By default, when you create a trail in a region in the CloudTrail console, the trail applies to all regions.&lt;/li&gt; 
- &lt;li&gt;Create an Amazon S3 bucket or specify an existing bucket where you want the log files delivered. By default, log files from all regions in your account are delivered to the bucket that you specify.&lt;/li&gt; 
- &lt;li&gt;Configure your trail to log read-only, write-only, or all management events, and all or a subset of data events. By default, trails log all management events and no data events.&lt;/li&gt; 
- &lt;li&gt;Create an Amazon SNS topic to receive notifications when log files are delivered. Delivery notifications from all regions are sent to the topic that you specify.&lt;/li&gt; 
- &lt;li&gt;Configure CloudWatch Logs to receive your logs from CloudTrail so that you can monitor for specific log events.&lt;/li&gt; 
- &lt;li&gt;Change the encryption method for your log files from server-side encryption with Amazon S3-managed encryption keys (SSE-S3) to server-side encryption with AWS KMS-managed keys (SSE-KMS).&lt;/li&gt; 
- &lt;li&gt;Turn on integrity validation for log files. This enables the delivery of digest files that you can use to validate the integrity of log files after CloudTrail has delivered them.&lt;/li&gt; 
- &lt;li&gt;Add tags (custom key-value pairs) to your trail.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI describe trails" url="https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/describe-trails.html"/>
-            <reference name="AWS Lambda Metrics and Dimensions - CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html"/>
-            <reference name="AWS-X-Ray" url="https://aws.amazon.com/xray/"/>
-            <reference name="Creating a Trail For Your AWS Account" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html"/>
-            <reference name="Logging AWS Lambda API Calls by Using AWS CloudTrail" url="https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html"/>
-            <reference name="Logging AWS Serverless Application Repository API Calls with AWS CloudTrail" url="https://docs.aws.amazon.com/serverlessrepo/latest/devguide/logging-using-cloudtrail.html"/>
-            <reference name="Troubleshooting &amp; Monitoring Lambda-based Apps with CloudWatch" url="https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the new logs are included in CloudTrail, we can get all trails with the following command: &lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; aws cloudtrail describe-trails&lt;/p&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C17" name="Limit the lifetime of your containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure that your containers and functions lifecycles are handled correctly and no lingering processes exist.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Use CloudWatch metrics to view the number of tasks in your services that are in the RUNNING state and set a CloudWatch alarm for this metric to alert you if the number of running tasks in your service falls below a specified value.&lt;/p&gt; 
-&lt;p&gt; To view the number of running tasks in a service&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
- &lt;li&gt;On the navigation pane, choose Metrics.&lt;/li&gt; 
- &lt;li&gt;On the All metrics tab, choose ECS.&lt;/li&gt; 
- &lt;li&gt;Choose ClusterName, ServiceName and then choose any metric (either CPUUtilization or MemoryUtilization) that corresponds to the service to view running tasks in.&lt;/li&gt; 
- &lt;li&gt;On the Graphed metrics tab, change Period to 1 Minute and Statistic to Sample Count.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To create a CloudWatch alarm on a metric&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
- &lt;li&gt;On the left navigation, choose Alarms, Create Alarm.&lt;/li&gt; 
- &lt;li&gt;In the CloudWatch Metrics by Category section, choose ECS Metrics &amp;gt; ClusterName.&lt;/li&gt; 
- &lt;li&gt;On the Modify Alarm page, choose the MemoryReservation metric for the default cluster and choose Next.&lt;/li&gt; 
- &lt;li&gt;In the Alarm Threshold section, enter a name and description for your alarm.&lt;/li&gt; 
- &lt;li&gt;Set the threshold and time period requirement to MemoryReservation greater than 75% for 1 period.&lt;/li&gt; 
- &lt;li&gt;Configure a notification to send when the alarm is triggered. You can also choose to delete the notification if you don't want to configure one now.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CloudWatch metrics" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html#available_cloudwatch_metrics"/>
-            <reference name="Tutorial: Scaling container instances with CloudWatch alarms" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch_alarm_autoscaling.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check CloudWatch data on containers and services that are in the RUNNING state.&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
- &lt;li&gt;On the navigation pane, choose Metrics.&lt;/li&gt; 
- &lt;li&gt;On the All metrics tab, choose ECS.&lt;/li&gt; 
- &lt;li&gt;Choose ClusterName, ServiceName and then choose any metric (either CPUUtilization or MemoryUtilization) that corresponds to the service to view running tasks in.&lt;/li&gt; 
- &lt;li&gt;On the Graphed metrics tab, change Period to 1 Minute and Statistic to Sample Count.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt; 
-&lt;p&gt;The following AWS managed policies, which you can attach to users in your account, are specific to CloudWatch Logs:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;CloudWatchLogsFullAccess - Grants full access to CloudWatch Logs.&lt;/li&gt; 
- &lt;li&gt;CloudWatchLogsReadOnlyAccess - Grants read-only access to CloudWatch Logs.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;By default, all user shall only have got the managed policy "CloudWatchLogsReadOnlyAccess", and only few users shall have got the managed policy "CloudWatchLogsFullAccess".&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Go to the AWS CLI.&lt;/li&gt; 
- &lt;li&gt;List all users, with the following command:&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws iam list-users&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Run the following command per user to ensure that only the desired users have got the managed policy "CloudWatchLogsFullAccess" and the other users the managed policy "CloudWatchLogsReadOnlyAccess", to do it run the following command per username:&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws iam list-attached-user-policies --user-name [userName]&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;If there is at least user with the managed policy "CloudWatchLogsFullAccess" and it shall not be allowed, we have to change the managed policy for these users.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Run the following command per each user to remove the managed policy:&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws iam delete-user-policy --user-name [userName] --policy-name CloudWatchLogsFullAccess&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Run the following command per each user to add a new managed policy:&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess --user-name [userName]&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI assign policy to user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-user-policy.html"/>
-            <reference name="AWS CLI list policies per user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-user-policies.html"/>
-            <reference name="AWS CLI list users" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"/>
-            <reference name="AWS CLI remove policy per user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-policy.html"/>
-            <reference name="AWS Managed (Predefined) Policies for CloudWatch Logs" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html#managed-policies-cwl"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Go to the AWS CLI.&lt;/li&gt; 
- &lt;li&gt;List all users, with the following command: aws iam list-users&lt;/li&gt; 
- &lt;li&gt;Run the following command per user and check that only the desired users have got the managed policy "CloudWatchLogsFullAccess" and the other users the managed policy "CloudWatchLogsReadOnlyAccess", to do it run the following command per username: aws iam list-attached-user-policies --user-name [userName]&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C18" name="Monitor the containers for processes hanging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use CloudWatch to monitor the containers and the processes&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Before your container instances can send log data to CloudWatch Logs, you must create an IAM policy to allow your container instances to use the CloudWatch Logs APIs, and then you must attach that policy to ecsInstanceRole.&lt;/p&gt; 
-&lt;p&gt;To create the ECS-CloudWatchLogs IAM policy&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
- &lt;li&gt;In the navigation pane, choose Policies.&lt;/li&gt; 
- &lt;li&gt;Choose Create policy, JSON.&lt;/li&gt; 
- &lt;li&gt;Enter the following policy:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:&lt;strong&gt;:*:&lt;/strong&gt;" ] } ]}&lt;/li&gt; 
- &lt;li&gt;Choose Review policy.&lt;/li&gt; 
- &lt;li&gt;On the Review policy page, enter ECS-CloudWatchLogs for the Name and choose Create policy.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To attach the ECS-CloudWatchLogs policy to ecsInstanceRole&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
- &lt;li&gt;In the navigation pane, choose Roles.&lt;/li&gt; 
- &lt;li&gt;Choose ecsInstanceRole. If the role does not exist, follow the procedures in Amazon ECS Container Instance IAM Role to create the role.&lt;/li&gt; 
- &lt;li&gt;Choose Permissions, Attach policy.&lt;/li&gt; 
- &lt;li&gt;To narrow the available policies to attach, for Filter, type ECS-CloudWatchLogs.&lt;/li&gt; 
- &lt;li&gt;Check the box to the left of the ECS-CloudWatchLogs policy and choose Attach policy.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To install the CloudWatch Logs agent:&lt;br /&gt; Run the following command to install the CloudWatch Logs agent.&lt;br /&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt; sudo yum install -y awslogs&lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;To configure the CloudWatch Logs agent:&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Back up the existing CloudWatch Logs agent configuration file: sudo mv /etc/awslogs/awslogs.conf /etc/awslogs/awslogs.conf.bak&lt;/li&gt; 
- &lt;li&gt;Create a blank configuration file: sudo touch /etc/awslogs/awslogs.conf&lt;/li&gt; 
- &lt;li&gt;Open the /etc/awslogs/awslogs.conf file with a text editor, and copy the example file above into it.&lt;/li&gt; 
- &lt;li&gt;Install the jq JSON query utility: sudo yum install -y jq&lt;/li&gt; 
- &lt;li&gt;Query the Amazon ECS introspection API to find the cluster name and set it to an environment variable: cluster=$(curl -s http://localhost:51678/v1/metadata | jq -r '. | .Cluster')&lt;/li&gt; 
- &lt;li&gt;Replace the {cluster} placeholders in the file with the value of the environment variable you set in the previous step: sudo sed -i -e "s/{cluster}/$cluster/g" /etc/awslogs/awslogs.conf&lt;/li&gt; 
- &lt;li&gt;Query the Amazon ECS introspection API operation to find the container instance ID and set it to an environment variable: container_instance_id=$(curl -s http://localhost:51678/v1/metadata | jq -r '. | .ContainerInstanceArn' | awk -F/ '{print $2}' )&lt;/li&gt; 
- &lt;li&gt;Replace the {container_instance_id} placeholders in the file with the value of the environment variable you set in the previous step: sudo sed -i -e "s/{container_instance_id}/$container_instance_id/g" /etc/awslogs/awslogs.conf&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To configure the CloudWatch Logs agent Region:&lt;br /&gt; By default, the CloudWatch Logs agent sends data to the us-east-1 region. To send your data to a different region, such as the Region in which your cluster is located, you can set the Region in the /etc/awslogs/awscli.conf file.&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the /etc/awslogs/awscli.conf file with a text editor.&lt;/li&gt; 
- &lt;li&gt;In the [default] section, replace us-east-1 with the Region from which to view log data.&lt;/li&gt; 
- &lt;li&gt;Save the file and exit your text editor.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To start the CloudWatch Logs agent&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Start the CloudWatch Logs agent with the following command.&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Linux: sudo service awslogs start&lt;/li&gt; 
-  &lt;li&gt;Amazon Linux 2: sudo systemctl start awslogsd&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure that the CloudWatch Logs agent starts at every system boot with the following command.&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Linux: sudo chkconfig awslogs on&lt;/li&gt; 
-  &lt;li&gt;Amazon Linux 2: sudo systemctl enable awslogsd.service&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon ECS CloudWatch Metrics" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html"/>
-            <reference name="Using CloudWatch Logs with Container Instances" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that each container throws their logs and follow the next steps to do it.&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
- &lt;li&gt;In the left navigation pane, choose Logs.&lt;/li&gt; 
- &lt;li&gt;You should see the log groups you configured in Configuring and Starting the CloudWatch Logs Agent.&lt;/li&gt; 
- &lt;li&gt;Choose a log group to view.&lt;/li&gt; 
- &lt;li&gt;Choose a log stream to view. The streams are identified by the cluster name and container instance ID that sent the logs.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C2" name="Not expose your data stores directly to internet" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When using S3 buckets ensure you disable public read access, unless you are using the bucket for storing images or a static website. Ensure data stores are properly protected with firewall settings and gateways. Create specific internal users to access the data store and ensure that only those users can access the data store.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; To set ACL access permissions for an S3 bucket: &lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the Bucket name list, choose the name of the bucket that you want to set permissions for.&lt;/li&gt; 
- &lt;li&gt;Choose Permissions .&lt;/li&gt; 
- &lt;li&gt;You can manage bucket access permissions for the following: Owner access, Access for other AWS accounts, Public access or S3 log delivery group.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How Do I Set ACL Bucket Permissions?" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-bucket-permissions.html"/>
-            <reference name="Identifying Public Buckets Using Bucket Permissions Check" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/bucket-permissions-check.html"/>
-            <reference name="S3 Access Control List (ACL) Overview" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the access permissions for an S3 bucket: &lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;In the Bucket name list, choose the name of the bucket that you want to set permissions for.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Choose Permissions.&lt;/li&gt; 
- &lt;li&gt;Check that the permissions are defined well.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-937" name="Regularly check for known vulnerabilities in the dependencies of your project" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Vulnerabilities in common popular and shared libraries are published and recorded in a number of
-                        online databases and services, including the MITRE CVE and CWE databases.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Perform regular checks for published vulnerabilities in third party components and the
-                        IDE.&lt;/li&gt;
-                        &lt;li&gt;Test and apply appropriate recommended patches and mitigations.&lt;/li&gt;
-                        &lt;li&gt;Use subscription threat intelligence and alerting services to ensure timely
-                        notification of possible threats&lt;/li&gt;
-                        &lt;li&gt;Use automated vulnerability scanning tools to identify and test for security threats
-                        to the project.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Common Vulnerabilities and Exposures (CVE) Database" url="https://cve.mitre.org/"/>
-            <reference name="Common Weakness Enumeration (CWE) Database" url="https://cwe.mitre.org"/>
-            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
-            <reference name="OWASP Dependency-Check" url="https://www.owasp.org/index.php/OWASP_Dependency_Check"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1.14.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.SC-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Ensure a process is in place to regularly check for vulnerabilities in software
-                            components and libraries. Sources should include:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Vendor notifications&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Threat intelligence feeds&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Vulnerability scanning.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Verify that processes exist to respond to vulnerabilities to research, test, and
-                            deploy appropriate patches.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            The following tools can help in automating dependencies checks:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.owasp.org/index.php/OWASP_Dependency_Check"&gt;OWASP
-                            Dependency Check&lt;/a&gt;&amp;nbsp;for Java and .NET.&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="http://retirejs.github.io/retire.js/"&gt;Retire.js&lt;/a&gt;&amp;nbsp;with
-                            support to scan several different of the most popular JS libraries and frameworks.&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://nodesecurity.io/opensource"&gt;nodesecurity.io&lt;/a&gt;&amp;nbsp;which
-                            focuses on node packages and libraries' security.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.443">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C7" name="Review and remove unused functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Review the current Lambda Functions and remove those unused functions from the system.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To list all functions:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Go to the AWS CLI, and write the following command:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws list-functions&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review all functions search those unused functions.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;To remove a certain function:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Go to the AWS CLI, and write the following command:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt; aws delete-function -function-name &lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Delete function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/delete-function.html"/>
-            <reference name="AWS CLI List functions" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/list-functions.html"/>
-            <reference name="Automating the discovery of unused AWS Lambda functions" url="https://aws.amazon.com/blogs/mt/automating-the-discovery-of-unused-aws-lambda-functions/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Write the following command in the AWS CLI and check that all listed functions are not unused functions:&amp;nbsp;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;p&gt;aws list-functions&lt;/p&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.443">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C22" name="Set a concurrency limits for your functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Lambda provides a concurrent execution limit control at both the account level and the function level. By default, AWS Lambda limits the total concurrent executions across all functions within a given region to 1000. The function level concurrent execution limit is by default enforced against the sum of the concurrent executions of all functions.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To set a concurrency limit for your Lambda function using the AWS CLI, do the following:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Use the PutFunctionConcurrency operation and pass in the function name and concurrency limit you want allocated to this function:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt; aws lambda put-function-concurrency --function-name function-name --reserved-concurrent-executions limit value&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Managing Concurrency" url="https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html"/>
-            <reference name="Set Concurrency Limits on Individual AWS Lambda Functions" url="https://aws.amazon.com/about-aws/whats-new/2017/11/set-concurrency-limits-on-individual-aws-lambda-functions/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Use AWS CLI and use the following command to view the concurrency limit per function:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check all function and verify that they have got set a well the concurrency limit.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; {&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; "Statement":[&lt;/i&gt; 
-   &lt;i&gt;{&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Condition":{&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;div&gt; 
-       &lt;i&gt;"Bool":&lt;/i&gt; 
-      &lt;/div&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;}&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;i&gt;}&lt;/i&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; }&lt;/i&gt; 
-     &lt;i&gt;]&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt;} &lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
-                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
-                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C25" name="Set time-outs on invocations of functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To prevent your Lambda function from running indefinitely, you specify a timeout. You shall set this value based on your expected execution time. The default for functions created in the console is 3 seconds. To ensure that you write clean code also verify that the termination criteria are met every time to prevent endless or long invocations.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Update the timeout of your functions using the following AWS CLI command:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws lambda update-function-configuration --function-name myfunction --timeout 3&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;In the example, we change the timeout limit to 3 seconds&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
-            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
-            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Use AWS CLI and use the following command to view the timeout limit per function:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check all function and verify that they have got set a well the timeout limit.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C9" name="Store your environment variables in a secure place" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Plain text environment variables should not be pushed to code repositories. You can use KMS to encrypt environment variables.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Step 1: Create the Lambda Function (If you've already created the Lambda function, skip this step)&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Sign in to the AWS Management Console and open the AWS Lambda console at https://console.aws.amazon.com/lambda/.&lt;/li&gt; 
- &lt;li&gt;Choose Create a Lambda function.&lt;/li&gt; 
- &lt;li&gt;In Select blueprint, choose the Author from scratch button.&lt;/li&gt; 
- &lt;li&gt;In Basic information, do the following:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;In Name, specify your Lambda function name.&lt;/li&gt; 
-  &lt;li&gt;In Role, choose Choose an existing role.&lt;/li&gt; 
-  &lt;li&gt;In Existing role, choose lambda_basic_execution.&lt;/li&gt; 
-  &lt;li&gt;Note: If the policy of the execution role does not have the decrypt permission, you will need add it.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Choose Create function.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Step 2: Configure the Lambda Function&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Under Configuration, specify the Runtime of your choice.&lt;/li&gt; 
- &lt;li&gt;Under the Lambda function code section you can take advantage of the Edit code inline option to replace the Lambda function handler code with your custom code.&lt;/li&gt; 
- &lt;li&gt;Note the Triggers tab. Under the Triggers page, you can optionally choose a service that automatically triggers your Lambda function by choosing the Add trigger button and then choosing the gray box with ellipses (...) to display a list of available services. For this example, do not configure a trigger and choose Configuration.&lt;/li&gt; 
- &lt;li&gt;Note the Monitoring tab. This page will provide immediate CloudWatch metrics for your Lambda function invocations, as well as links to other helpful guides, including Using AWS X-Ray.&lt;/li&gt; 
- &lt;li&gt;Expand the Environment variables section.&lt;/li&gt; 
- &lt;li&gt;Enter your key-value pair. Expand the Encryption configuration section. Note that Lambda provides a default service key under KMS key to encrypt at rest which encrypts your information after it has been uploaded. If the information you provided is sensitive, you can additionally check the Enable helpers for encryption in transit checkbox and supply a custom key. This masks the value you entered and results in a call to AWS KMS to encrypt the value and return it as Ciphertext. If you haven't created a KMS key for your account, you will be provided a link to the AWS IAM console to create one. The account must have have encrypt and decrypt permissions for that key. Note that the Encrypt button toggles to Decrypt after you choose it. This affords you the option to update the information. Once you have done that, choose the Encrypt button.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Environment Variables" url="https://docs.aws.amazon.com/lambda/latest/dg/env_variables.html#env_encrypt"/>
-            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1. Under Configuration, specify the Runtime of your choice.&lt;br /&gt;
-2. Expand the Environment variables section.&lt;br /&gt;
-3. Check that the Environment variables are configured well in this section.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C23" name="Use a profiler tool to improve the application" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When using a profiler tool, the execution of your functions are monitored. It will reveal which functions are called, number of invocations, execution times, memory usage and CPU use.&lt;/p&gt;
-
-	&lt;p&gt;You can use it to find and identify bottlenecks and address them. Therefore, you shall use a profiler tool to improve the time of use, memory usage and CPU usage of the function.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
-            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
-            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that a profiler tool is used to improve the Lambda function.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-LAMBDA-C24" name="Use the API gateway Plans to throttle incoming API calls or rate limit the requests" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Throttling or rate limiting will limit the rate of transactions passing through the API Gateway. When limits are exceeded the API gateway will respond with a HTTP response error code. There are several possibilities to set throttling but the use of an API key and usage plan is a best practice.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;In the Amazon API Gateway main navigation pane, choose Usage Plans, and then choose Create.&lt;/li&gt; 
- &lt;li&gt;Under Create Usage Plan, do the following:&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;For Name, type a name for your plan (for example, Plan_A).&lt;/li&gt; 
-  &lt;li&gt;For Description, type a description for your plan.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select Enable throttling, and set Rate (for example, 100) and Burst (for example, 200).&lt;/li&gt; 
-  &lt;li&gt;Choose Enable quota, and set its limit (for example, 5000) for a selected time interval (for example, Month).&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;li&gt;To add a stage to the plan, do the following in the Associated API Stages pane:&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Choose Add API Stage.&lt;/li&gt; 
-  &lt;li&gt;Choose an API (for example, PetStore) from the API drop-down list.&lt;/li&gt; 
-  &lt;li&gt;Choose a stage (for example, Stage_1) from the Stage drop-down list.&lt;/li&gt; 
-  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;li&gt;To configure method throttling, do the following:&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Choose Configure Method Throttling.&lt;/li&gt; 
-  &lt;li&gt;Choose Add Resource/Method.&lt;/li&gt; 
-  &lt;li&gt;Choose the resource from the Resource drop-down menu.&lt;/li&gt; 
-  &lt;li&gt;Choose the method from the Method drop-down menu.&lt;/li&gt; 
-  &lt;li&gt;Set Rate (requests per second) (for example, 100) and Burst (for example, 200).&lt;/li&gt; 
-  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
-  &lt;li&gt;Choose Close.&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;li&gt;To add a key to the plan, do the following in the API Keys tab:&lt;/li&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;To use an existing key, choose Add API Key to Usage Plan.&lt;/li&gt; 
-  &lt;li&gt;For Name, type a name for the key you want to add (for example, MyFirstKey).&lt;/li&gt; 
-  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;As needed, repeat the preceding steps to add other existing API keys to this usage plan.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS API gateway Limits" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html"/>
-            <reference name="Create and Use Usage Plans with API Keys" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html"/>
-            <reference name="Create, Configure, and Test Usage Plans Using the API Gateway CLI and REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-rest-api.html"/>
-            <reference name="Create, Configure, and Test Usage Plans with the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.html"/>
-            <reference name="Throttle API Requests for Better Throughput" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Check that all API Gateway Plans are configured well.&lt;/li&gt; 
- &lt;li&gt;Go to the API Gateway main navigation pane, choose Usage Plans.&lt;/li&gt; 
- &lt;li&gt;Choose a usage plan from the list of usage plans.&lt;/li&gt; 
- &lt;li&gt;From within the specified plan, choose API Keys.&lt;/li&gt; 
- &lt;li&gt;Choose an API key, and then choose Usage to view Subscriber's Traffic from the plan you're monitoring, and verify that all works well&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL-GENERIC" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received shall be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies, or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms, these can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;/p&gt; 
-&lt;p&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one end of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/p&gt; 
-&lt;p&gt;As such, all data received must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria.&lt;/p&gt; 
-&lt;p&gt; Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."&lt;br /&gt; Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&lt;/p&gt; 
-&lt;p&gt; While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&lt;/p&gt; 
-&lt;p&gt; Validate all data received from the client, including values such as HTTP headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Input Validation Cheat Sheet" url="https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet"/>
-            <reference name="OWASP Testing for Input Validation" url="https://www.owasp.org/index.php/Testing_for_Input_Validation"/>
-          </references>
-          <standards>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify all data input points for the application, for example:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt; 
- &lt;li&gt;API calls&lt;/li&gt; 
- &lt;li&gt;HTTP Headers&lt;/li&gt; 
- &lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the whitelists (for example with a regular expression) before being processed.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;To test data validation:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;A number of tools can be used to aid in testing: &lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Directly with your browser and with the Developer Tools&lt;/li&gt; 
- &lt;li&gt;Use a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt; 
- &lt;li&gt;Use a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="AWS-LAMBDA-T13" name="Attackers gain access to a Lambda function through a Cross-site scripting attack on the DynamoDB API" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Through a Cross-site scripting attack an attacker retrieves credentials. The parameters weren't validated, resulting in an injection of code to retrieve sensitive data such as as credentials.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL-GENERIC" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LAMBDA-T4" name="Attackers gain access to the AWS account through leaked credentials" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;By storing your account information or environment variables in a "public" resource or storing them as plain text, attackers can find that information. Attackers will scan GitHub repositories or scrape/crawl files on your resources to find this kind of information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C8" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W8">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C9" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C8" mitigation="50"/>
-                <countermeasure ref="AWS-LAMBDA-C9" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-592">
-                  <countermeasures>
-                    <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W10">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C12" mitigation="25"/>
-                    <countermeasure ref="AWS-LAMBDA-C16" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C12" mitigation="25"/>
-                <countermeasure ref="AWS-LAMBDA-C16" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-233" name="Privilege Escalation" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W10">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C12" mitigation="33"/>
-                    <countermeasure ref="AWS-LAMBDA-C14" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C12" mitigation="33"/>
-                <countermeasure ref="AWS-LAMBDA-C14" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="AWS-LAMBDA-T12" name="Attackers force to increase the Amazon billing through overloading the resources" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;One of the principles of Lambda functions is that you pay for the amount of time your code is running. This pushes the developer to write efficient code. Efficient code should also be limited in execution time. An attacker could try to force services to overload resources and push the boundaries.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W16">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="20"/>
-                    <countermeasure ref="AWS-LAMBDA-C24" mitigation="20"/>
-                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="20"/>
-                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W19">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="20"/>
-                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C11" mitigation="20"/>
-                <countermeasure ref="AWS-LAMBDA-C22" mitigation="20"/>
-                <countermeasure ref="AWS-LAMBDA-C24" mitigation="20"/>
-                <countermeasure ref="AWS-LAMBDA-C25" mitigation="20"/>
-                <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="50"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="50"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W14">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W15">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C20" mitigation="13"/>
-                    <countermeasure ref="AWS-LAMBDA-C23" mitigation="13"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W16">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
-                    <countermeasure ref="AWS-LAMBDA-C24" mitigation="13"/>
-                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
-                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W17">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W18">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-VPC-IP-ADDRESS-DEPLETION-WEAKNESS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" mitigation="12"/>
-                    <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C20" mitigation="13"/>
-                <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
-                <countermeasure ref="AWS-LAMBDA-C23" mitigation="13"/>
-                <countermeasure ref="AWS-LAMBDA-C24" mitigation="13"/>
-                <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
-                <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
-                <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" mitigation="12"/>
-                <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LAMBDA-T15" name="Lambda function is compromised through a code injection attack" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;When input validation is non-existent or not strong, malicious code can be injected through the input parameters. This may compromise the complete application and data stores.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W9">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
-                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
-                <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LAMBDA-T5" name="Lambda function is exploited by a non-HTTP event through code injection" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;A Lambda function can be triggered by a non-HTTP event (e.g. S3, SNS, SES, CloudWatch Events, etc.). When input validation is non-existing or not strong, malicious code can be injected through the input parameters. This may lead to complete compromise of the application and data stores.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W9">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
-                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
-                <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LAMBDA-T9" name="Lambda functions are accessible through an unclean container" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Cloud providers run your functions in a container. Because you want your function to execute as fast and efficient as possible, the containers are kept warm. This means that a container will be persistent for a while after a function is executed. This could leave room for a successful attack on the container.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W11">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C17" mitigation="25"/>
-                    <countermeasure ref="AWS-LAMBDA-C20" mitigation="25"/>
-                    <countermeasure ref="AWS-LAMBDA-C23" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W12">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C18" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C17" mitigation="25"/>
-                <countermeasure ref="AWS-LAMBDA-C18" mitigation="25"/>
-                <countermeasure ref="AWS-LAMBDA-C20" mitigation="25"/>
-                <countermeasure ref="AWS-LAMBDA-C23" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-94" name="Man in the Middle Attack" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C5" mitigation="33"/>
-                    <countermeasure ref="aws-tier-1.17" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C5" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="34"/>
-                <countermeasure ref="aws-tier-1.17" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="MONITORING AND LOGGING" name="Monitoring and Logging" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" mitigation="33"/>
-                    <countermeasure ref="AWS-LOGS-INTEGRITY" mitigation="34"/>
-                    <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" mitigation="33"/>
-                <countermeasure ref="AWS-LOGS-INTEGRITY" mitigation="34"/>
-                <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="PATCHING" name="Patching" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="AWS-LAMBDA-T3" name="Attackers exploit an unused function to enter the system" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;A &amp;quot;problem&amp;quot; with serverless architecture is that you don't pay for functions that aren't used. This means that your unused functions will not appear on your bill. If the unused functions become forgotten, they can become a threat. Those functions will not be updated or patched.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W5">
-                  <countermeasures>
-                    <countermeasure ref="CWE-937" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W6">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C7" mitigation="50"/>
-                <countermeasure ref="CWE-937" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LAMBDA-T10" name="Lambda functions are compromised through exploiting vulnerable dependencies" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Functions often use third-party libraries or frameworks. These dependencies can be vulnerable and new vulnerabilities are regularly disclosed. As soon as a vulnerability is registered in the CVE database, attackers will try to exploit the vulnerability within hours using automated exploits.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W13">
-                  <countermeasures>
-                    <countermeasure ref="CWE-937" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-937" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="SENSITIVE INFORMATION IN DATA STORES" name="Sensitive information in data stores" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="AWS-LAMBDA-T1" name="Sensitive information is leaked from data stores" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Sensitive information is exfiltrated from a data store because there is no encryption applied or the server was misconfigured&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="SENSITIVE INFORMATION IN LOGS" name="Sensitive information in logs" desc="" library="aws-lambda">
-          <threats>
-            <threat ref="AWS-LAMBDA-T14" name="Sensitive data is leaked through non-sanitized debugging/logging statements" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
-              <desc>&lt;p&gt;Whilst logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships, ensuring sensitive user data and system information are not exposed to potential attackers.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-LAMBDA-W21">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-LAMBDA-W22">
-                  <countermeasures>
-                    <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="a60c094b-6d79-4aa6-8633-72e2cfab0ca2" diagramComponentId="aed86015-18c1-4a84-9daf-2feb20bf1293" ref="d5c97dad-ac42-4bda-b803-765e1e0f65e4" name="Web Application - Server side (CS-Default)" desc="" library="" parentComponentRef="a5f31feb-0210-47cd-b98c-c4baa599857e" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.453">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.710">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.453">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.785">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.871">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.662">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.241">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.326">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.887">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.945">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.326">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.324">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="81419837-f1a6-48b5-afc1-a2f9b3061ab9" diagramComponentId="2a89c488-16f0-4659-87d2-85e4136d7268" ref="b67b25bc-867e-4095-abfd-1e05c2ab31a3" name="ELB - Elastic Load Balancer" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="load-balancer">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
-          <desc>We do not have our resources current status and as a result lose control of some resources,
-                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.002">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;br&gt; 
-&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;br&gt; 
-&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
-&lt;br&gt; 
-&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;br&gt; 
-&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
-&lt;br&gt; 
-&lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;br&gt; 
-&lt;br&gt; Using the Amazon unified command line interface: 
-&lt;ul&gt; 
- &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
-  &lt;blockquote&gt;
-    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-  &lt;/blockquote&gt; &lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.625">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div style=""&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;div style=""&gt;
-    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
-                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
-                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
-                        engineered to be isolated from failures in other Availability Zones. By launching instances in
-                        separate Availability Zones, you can protect your applications from the failure of a single
-                        location. AWS assigns a unique ID to each subnet.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
-                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
-                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
-                        in a VPC, the CIDR blocks of the subnets must not overlap.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
-                        where possible.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
-                        fault tolerance and high availability from the perspective of resource deployment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-subnet --vpc-id application_vpc
-                        --cidr-block desired_cidr
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-tags --resources web_tier_elb_subnet1
-                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  OR 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  When an internal load balancer is created, it receives a public DNS name with the following form: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   internal-name-123456789.region.elb.amazonaws.com 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
-          </references>
-          <standards>
-            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The SG associated with the App tier ELB should allow connectivity from the security group
-                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
-                        the application design.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
-                        ELB:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
-                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; },
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
-                        --ip-permissions file:///PathTo/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This is required for both the configured port and protocol for the listener on the back-end
-                        instance and the port and protocol used for the health check.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
-                        security group rules that allow traffic for the specific application protocol and ports by
-                        referencing as source the security group associated with the App tier ELB.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
-                        element from Audit procedure):&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
-                        App tier ELB security group as the source of the connections:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
-                        --protocol tcp --port specific_port
-                        --source-group app_tier_elb_security_group
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
-                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
-                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
-                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.716">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-          </references>
-          <standards>
-            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;quot;AccessLog&amp;quot;: { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
-            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
-            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
-          </references>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Via Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all ELB's:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
-            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
-            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
-            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
-            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
-            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
-          </references>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-server-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For Amazon Certificate Manager users: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm list-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
-                        establishing a new connection supporting the Server Order Preference option. When this option is
-                        selected, the load balancer selects the first cipher in its list that is in the client's list of
-                        ciphers.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
-                        &lt;br /&gt;To enable Server Order Preference:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Click Save. &lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  In order to use HTTPS, an SSL\TLS certificate must be attached. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   "OriginProtocolPolicy": "https-only", 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
-                            distributions (it should be set as https-only):&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
-                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
-  &lt;div style=""&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; }, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     ] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the security group id from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;div&gt;
-    Using the Amazon unified command line interface: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt; 
-    &lt;div&gt;
-      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
-                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
-                        through the use of a unique random session key, and therefore prevents the decoding of captured
-                        data, even if the secret long-term key is compromised.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
-                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
-                            Cryptography (ECDHE) cipher suites.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.13" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.17" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.19" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.21" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.22" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.1" mitigation="8"/>
-                    <countermeasure ref="aws-tier-3.14" mitigation="8"/>
-                    <countermeasure ref="aws-tier-3.15" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.18" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.26" mitigation="8"/>
-                    <countermeasure ref="aws-tier-6.5" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-9" mitigation="4"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                <countermeasure ref="C-AWS-SRA-9" mitigation="4"/>
-                <countermeasure ref="aws-tier-3.1" mitigation="8"/>
-                <countermeasure ref="aws-tier-3.14" mitigation="8"/>
-                <countermeasure ref="aws-tier-3.15" mitigation="8"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.13" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.17" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.18" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.19" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.21" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.22" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.26" mitigation="8"/>
-                <countermeasure ref="aws-tier-6.5" mitigation="8"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails in the resources are not enabled or not protected, attackers could gain
-                                access to the system and modify or delete data from the resources and the changes are
-                                not detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="unknown-resource-status">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From d01cba9f84da5681d2a9145681b19806f6d74eb1 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:19:00 -0400
Subject: [PATCH 09/28] Delete Templates/aws-siem-and-cloudwatch.xml

---
 Templates/aws-siem-and-cloudwatch.xml | 17267 ------------------------
 1 file changed, 17267 deletions(-)
 delete mode 100644 Templates/aws-siem-and-cloudwatch.xml

diff --git a/Templates/aws-siem-and-cloudwatch.xml b/Templates/aws-siem-and-cloudwatch.xml
deleted file mode 100644
index d48d86d..0000000
--- a/Templates/aws-siem-and-cloudwatch.xml
+++ /dev/null
@@ -1,17267 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="AWS - SIEM and CloudWatch" name="AWS - SIEM and CloudWatch" tags="Community">
-  <desc>&lt;p&gt;Hosted Application with SIEM/CloudWatch&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIwIiBpckRyYXdpb1ZlcnNpb249IjMuMC4zLVNOQVBTSE9UIj48cm9vdD48bXhDZWxsIGlkPSIwIi8+PG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+PG14Q2VsbCBpZD0iMyIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMTA3MS4wIiB5PSItNC4wIiB3aWR0aD0iMTc5LjAiIGhlaWdodD0iMTc2LjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MDE0YmFkYWMtMzc0Zi00ZDg5LThjMjctNDI1MzBlY2Q5NDdlOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjQ2Ljc1IiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNzQyLjAiIHk9Ii0yNC4wIiB3aWR0aD0iNTE1LjAiIGhlaWdodD0iNTE2LjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCAtPiBPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1jMDEzMDE0OS01YzMxLTQxNjUtYjZlMi0yMmNjNTgzMzliZGQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkVsYXN0aWNzZWFyY2ggLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1lMTM1MWJlZS0yN2QyLTQ2YzctYmI4OS02ZjI5MmZhZjM5Zjg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCIgc3R5bGU9ImlyLnJlZj05OTUyMjA0ZS03ZTJjLTQ0MGMtOTUwNS01NGMxYzFmNTVlODE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWxhc3RpY3NlYXJjaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1EQXdPREVnTUM0ek5qTXlPREZJTUM0eE9EQXdPREZETUM0eE56WTFORFVnTUM0ek5qTXlPREVnTUM0eE56TXhOVFFnTUM0ek5qUTJPRFlnTUM0eE56QTJOVE1nTUM0ek5qY3hPRFpETUM0eE5qZ3hOVE1nTUM0ek5qazJPRGNnTUM0eE5qWTNORGdnTUM0ek56TXdOemdnTUM0eE5qWTNORGdnTUM0ek56WTJNVFZXTUM0NE1ETXlPREZETUM0eE5qWTNORGdnTUM0NE1EWTRNVGNnTUM0eE5qZ3hOVE1nTUM0NE1UQXlNRGtnTUM0eE56QTJOVE1nTUM0NE1USTNNRGxETUM0eE56TXhOVFFnTUM0NE1UVXlNU0F3TGpFM05qVTBOU0F3TGpneE5qWXhOQ0F3TGpFNE1EQTRNU0F3TGpneE5qWXhORWd3TGpNd01EQTRNVU13TGpNd016WXhPQ0F3TGpneE5qWXhOQ0F3TGpNd056QXdPU0F3TGpneE5USXhJREF1TXpBNU5UQTVJREF1T0RFeU56QTVRekF1TXpFeU1ERWdNQzQ0TVRBeU1Ea2dNQzR6TVRNME1UVWdNQzQ0TURZNE1UY2dNQzR6TVRNME1UVWdNQzQ0TURNeU9ERldNQzR6TnpZMk1UVkRNQzR6TVRNME1UVWdNQzR6TnpNd056Z2dNQzR6TVRJd01TQXdMak0yT1RZNE55QXdMak13T1RVd09TQXdMak0yTnpFNE5rTXdMak13TnpBd09TQXdMak0yTkRZNE5pQXdMak13TXpZeE9DQXdMak0yTXpJNE1TQXdMak13TURBNE1TQXdMak0yTXpJNE1WcE5NQzR5T0RZM05EZ2dNQzQzT0RrNU5EaElNQzR4T1RNME1UVldNQzR6T0RrNU5EaElNQzR5T0RZM05EaFdNQzQzT0RrNU5EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU9EQXpNelkyUXpBdU5EZzJOelUxSURBdU9EQTJPVEF6SURBdU5EZzFNelVnTUM0NE1UQXlPVFFnTUM0ME9ESTRORGtnTUM0NE1USTNPVFJETUM0ME9EQXpORGtnTUM0NE1UVXlPVFVnTUM0ME56WTVOVGNnTUM0NE1UWTNJREF1TkRjek5ESXhJREF1T0RFMk4wZ3dMak0xTXpReU1VTXdMak0wT1RnNE5TQXdMamd4TmpjZ01DNHpORFkwT1RRZ01DNDRNVFV5T1RVZ01DNHpORE01T1RNZ01DNDRNVEkzT1RSRE1DNHpOREUwT1RNZ01DNDRNVEF5T1RRZ01DNHpOREF3T0RnZ01DNDRNRFk1TURNZ01DNHpOREF3T0RnZ01DNDRNRE16TmpaV01DNDFOek16TmpSRE1DNHpORFEwTWpNZ01DNDFPVGd4TkRVZ01DNHpOVE0wTnpZZ01DNDJNakU0TmpRZ01DNHpOalkzTlRVZ01DNDJORE15TXpKV01DNDNPRGs1U0RBdU5EWXdNRGc0VmpBdU56SXdNRE15UXpBdU5EWTROek14SURBdU56SXpOams0SURBdU5EYzNOalEzSURBdU56STJOamcxSURBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU56STRPVFkyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE0TmpjMU5TQXdMakk1TmpZMU9WWXdMak0wTXpnMU9VTXdMalEzTnpZek1pQXdMak0wTmpNeE1pQXdMalEyT0RjeE5pQXdMak0wT1RRM055QXdMalEyTURBNE9DQXdMak0xTXpNeU5WWXdMak13T1RrNU1rZ3dMak0yTmpjMU5WWXdMalF5T1RrNU1rTXdMak0xTXpRM05pQXdMalExTVRNMU9TQXdMak0wTkRReU15QXdMalEzTlRBM09DQXdMak0wTURBNE9DQXdMalE1T1RnMU9WWXdMakk1TmpZMU9VTXdMak0wTURBNE9DQXdMakk1TXpFeU1pQXdMak0wTVRRNU15QXdMakk0T1Rjek1TQXdMak0wTXprNU15QXdMakk0TnpJelF6QXVNelEyTkRrMElEQXVNamcwTnpNZ01DNHpORGs0T0RVZ01DNHlPRE16TWpVZ01DNHpOVE0wTWpFZ01DNHlPRE16TWpWSU1DNDBOek0wTWpGRE1DNDBOelk1TlRjZ01DNHlPRE16TWpVZ01DNDBPREF6TkRrZ01DNHlPRFEzTXlBd0xqUTRNamcwT1NBd0xqSTROekl6UXpBdU5EZzFNelVnTUM0eU9EazNNekVnTUM0ME9EWTNOVFVnTUM0eU9UTXhNaklnTUM0ME9EWTNOVFVnTUM0eU9UWTJOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TkRJNElEQXVOek01TlRkV01DNDNPRGs1TjBnd0xqVTBNREE1TkZZd0xqY3pOall6TjBNd0xqVXpNVEUzTmlBd0xqY3pOalkyTmlBd0xqVXlNakkyTnlBd0xqY3pOakE0TnlBd0xqVXhNelF5T0NBd0xqY3pORGt3TTFZd0xqZ3dNek13TTBNd0xqVXhNelF5T0NBd0xqZ3dOamcwSURBdU5URTBPRE15SURBdU9ERXdNak14SURBdU5URTNNek16SURBdU9ERXlOek15UXpBdU5URTVPRE16SURBdU9ERTFNak15SURBdU5USXpNakkxSURBdU9ERTJOak0zSURBdU5USTJOell4SURBdU9ERTJOak0zU0RBdU5qUTJOell4UXpBdU5qVXdNamszSURBdU9ERTJOak0zSURBdU5qVXpOamc1SURBdU9ERTFNak15SURBdU5qVTJNVGc1SURBdU9ERXlOek15UXpBdU5qVTROamtnTUM0NE1UQXlNekVnTUM0Mk5qQXdPVFFnTUM0NE1EWTROQ0F3TGpZMk1EQTVOQ0F3TGpnd016TXdNMVl3TGpjMk5qSXpOMHd3TGpZek16UXlPQ0F3TGpjek9UVTNXazB3TGpZME5qYzJNU0F3TGpFM05qWXpOa2d3TGpVeU5qYzJNVU13TGpVeU16SXlOU0F3TGpFM05qWXpOaUF3TGpVeE9UZ3pNeUF3TGpFM09EQTBNU0F3TGpVeE56TXpNeUF3TGpFNE1EVTBNVU13TGpVeE5EZ3pNaUF3TGpFNE16QTBNU0F3TGpVeE16UXlPQ0F3TGpFNE5qUXpNeUF3TGpVeE16UXlPQ0F3TGpFNE9UazJPVll3TGpNek9ETTJPVU13TGpVeU1qSTJOaUF3TGpNek56RTNOQ0F3TGpVek1URTNOaUF3TGpNek5qVTVOU0F3TGpVME1EQTVOQ0F3TGpNek5qWXpObFl3TGpNek5qWXpObFl3TGpJd016TXdNa2d3TGpZek16UXlPRll3TGpNMU9UazJPVU13TGpZME1qYzNJREF1TXpZME9URTNJREF1TmpVeE5qZzVJREF1TXpjd05qSTFJREF1TmpZd01EazBJREF1TXpjM01ETTJWakF1TVRrd016WTVRekF1TmpZd01UUTRJREF1TVRnNE5UZzFJREF1TmpVNU9EUXpJREF1TVRnMk9EQTRJREF1TmpVNU1UazNJREF1TVRnMU1UUTBRekF1TmpVNE5UVXhJREF1TVRnek5EZ2dNQzQyTlRjMU56Y2dNQzR4T0RFNU5qSWdNQzQyTlRZek16TWdNQzR4T0RBMk9ERkRNQzQyTlRVd09TQXdMakUzT1RRd01TQXdMalkxTXpZd01pQXdMakUzT0RNNE1pQXdMalkxTVRrMU9DQXdMakUzTnpZNE9FTXdMalkxTURNeE15QXdMakUzTmprNU15QXdMalkwT0RVME5pQXdMakUzTmpZek5TQXdMalkwTmpjMk1TQXdMakUzTmpZek5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qQXhNREVnTUM0eU5ETXlPRFpJTUM0M01EQXhNREZETUM0Mk9UWTFOalVnTUM0eU5ETXlPRFlnTUM0Mk9UTXhOek1nTUM0eU5EUTJPVEVnTUM0Mk9UQTJOek1nTUM0eU5EY3hPVEZETUM0Mk9EZ3hOeklnTUM0eU5EazJPVElnTUM0Mk9EWTNOamdnTUM0eU5UTXdPRE1nTUM0Mk9EWTNOamdnTUM0eU5UWTJNVGxXTUM0ME1ERXhOVEpETUM0Mk9UY3dORGdnTUM0ME1USXlOVEVnTUM0M01EVTVPVGNnTUM0ME1qUTFNVElnTUM0M01UTTBNelFnTUM0ME16YzJPRFpXTUM0eU5qazVOVE5JTUM0NE1EWTNOamhXTUM0Mk56azVOVEpNTUM0NE16TTBNelFnTUM0M01EWTJNVGhXTUM0eU5UWTJNVGxETUM0NE16TTBNelFnTUM0eU5UTXdPRE1nTUM0NE16SXdNamtnTUM0eU5EazJPVElnTUM0NE1qazFNamtnTUM0eU5EY3hPVEZETUM0NE1qY3dNamdnTUM0eU5EUTJPVEVnTUM0NE1qTTJNemNnTUM0eU5ETXlPRFlnTUM0NE1qQXhNREVnTUM0eU5ETXlPRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREUzTURjMElEQXVOekk0TmpnelREQXVOamszTURjMElEQXVOakE0TmpnelF6QXVOekUwTWpFeElEQXVOVGN4TXpVZ01DNDNNVGMxTXpJZ01DNDFNamt4TkRRZ01DNDNNRFkwTkRZZ01DNDBPRGsxT1RGRE1DNDJPVFV6TlRrZ01DNDBOVEF3TXpjZ01DNDJOekExT0RZZ01DNDBNVFUzTURZZ01DNDJNelkxTkRJZ01DNHpPVEkzTVRsRE1DNDJNREkwT1RnZ01DNHpOamszTXpFZ01DNDFOakV6T1RZZ01DNHpOVGsxT0RJZ01DNDFNakExTmpVZ01DNHpOalF3T0VNd0xqUTNPVGN6TkNBd0xqTTJPRFUzTnlBd0xqUTBNVGd5T0NBd0xqTTROelF6SURBdU5ERXpOakEwSURBdU5ERTNNamMzUXpBdU16ZzFNemdnTUM0ME5EY3hNak1nTUM0ek5qZzJOek1nTUM0ME9EWXdNalFnTUM0ek5qWTBOaklnTUM0MU1qY3dOREpETUM0ek5qUXlOVElnTUM0MU5qZ3dOakVnTUM0ek56WTJPQ0F3TGpZd09EVXpNU0F3TGpRd01UVXpNeUF3TGpZME1USXpPVU13TGpReU5qTTROU0F3TGpZM016azBOaUF3TGpRMk1qQTBOaUF3TGpZNU5qYzJOQ0F3TGpVd01qRTFOeUF3TGpjd05UWXlORU13TGpVME1qSTJPQ0F3TGpjeE5EUTROQ0F3TGpVNE5ESXlNeUF3TGpjd09EZ3hNU0F3TGpZeU1EVTBJREF1TmpnNU5qRTJUREF1TnpNNE5UUWdNQzQ0TURjME9ETkRNQzQzTkRnNU16Y2dNQzQ0TVRjNE9UY2dNQzQzTmpNd05EUWdNQzQ0TWpNM05UVWdNQzQzTnpjM05pQXdMamd5TXpjMk4wTXdMamM1TWpRM05TQXdMamd5TXpjNElEQXVPREEyTlRreklEQXVPREUzT1RRMklEQXVPREUzTURBM0lEQXVPREEzTlRRNVF6QXVPREkzTkRJeElEQXVOemszTVRVeklEQXVPRE16TWpjNUlEQXVOemd6TURRMUlEQXVPRE16TWpreElEQXVOelk0TXpORE1DNDRNek16TURRZ01DNDNOVE0yTVRVZ01DNDRNamMwTnlBd0xqY3pPVFE1TnlBd0xqZ3hOekEzTkNBd0xqY3lPVEE0TTFZd0xqY3lPRFk0TTFwTk1DNHpPVE15TURjZ01DNDFNelkwTVRaRE1DNHpPVE15TURjZ01DNDFNRGMwTURnZ01DNDBNREU0TURrZ01DNDBOemt3TlRJZ01DNDBNVGM1TWpVZ01DNDBOVFE1TXpKRE1DNDBNelF3TkRFZ01DNDBNekE0TVRNZ01DNDBOVFk1TkRjZ01DNDBNVEl3TVRVZ01DNDBPRE0zTkRjZ01DNDBNREE1TVRSRE1DNDFNVEExTkRZZ01DNHpPRGs0TVRNZ01DNDFOREF3TXpZZ01DNHpPRFk1TURnZ01DNDFOamcwT0RjZ01DNHpPVEkxTmpoRE1DNDFPVFk1TXpjZ01DNHpPVGd5TWpjZ01DNDJNak13TnpFZ01DNDBNVEl4T1RVZ01DNDJORE0xT0RNZ01DNDBNekkzTURkRE1DNDJOalF3T1RRZ01DNDBOVE15TVRrZ01DNDJOemd3TmpNZ01DNDBOemt6TlRJZ01DNDJPRE0zTWpJZ01DNDFNRGM0TURORE1DNDJPRGt6T0RFZ01DNDFNell5TlRNZ01DNDJPRFkwTnpjZ01DNDFOalUzTkRNZ01DNDJOelV6TnpZZ01DNDFPVEkxTkRORE1DNDJOalF5TnpVZ01DNDJNVGt6TkRNZ01DNDJORFUwTnpZZ01DNDJOREl5TkRrZ01DNDJNakV6TlRjZ01DNDJOVGd6TmpWRE1DNDFPVGN5TXpnZ01DNDJOelEwT0RFZ01DNDFOamc0T0RFZ01DNDJPRE13T0RNZ01DNDFNems0TnpRZ01DNDJPRE13T0RORE1DNDFNREE1TnpVZ01DNDJPRE13T0RNZ01DNDBOak0yTnlBd0xqWTJOell6SURBdU5ETTJNVFkxSURBdU5qUXdNVEkxUXpBdU5EQTROalU1SURBdU5qRXlOaklnTUM0ek9UTXlNRGNnTUM0MU56VXpNVFFnTUM0ek9UTXlNRGNnTUM0MU16WTBNVFphVFRBdU56azRNVFFnTUM0M09EZ3lPRE5ETUM0M09USTNNVGtnTUM0M09UTTJOek1nTUM0M09EVXpPRFVnTUM0M09UWTJPVGdnTUM0M056YzNOQ0F3TGpjNU5qWTVPRU13TGpjM01EQTVOU0F3TGpjNU5qWTVPQ0F3TGpjMk1qYzJNU0F3TGpjNU16WTNNeUF3TGpjMU56TTBJREF1TnpnNE1qZ3pUREF1TmpRek56UWdNQzQyTnpRMk9ETkRNQzQyTlRrek1qVWdNQzQyTmpJNU1Ea2dNQzQyTnpJNE5ETWdNQzQyTkRnMk1qVWdNQzQyT0RNM05DQXdMall6TWpReE5rd3dMamM1T0RRd055QXdMamMwTnpZeE5rTXdMamd3TXpjMU15QXdMamMxTXpBMUlEQXVPREEyTnpJNElEQXVOell3TXpneUlEQXVPREEyTmpjNElEQXVOelk0TURBMVF6QXVPREEyTmpJNElEQXVOemMxTmpJM0lEQXVPREF6TlRVNElEQXVOemd5T1RJZ01DNDNPVGd4TkNBd0xqYzRPREk0TTFZd0xqYzRPREk0TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RBNE16a2dNQzQxT1RrNU1EZERNQzQwTnpFMU5ESWdNQzQxT1RNeU5UVWdNQzQwTmpNMk5qSWdNQzQxT0RRNE1pQXdMalExTnpZMU9DQXdMalUzTlRBNU1rTXdMalExTVRZMU5TQXdMalUyTlRNMk5DQXdMalEwTnpZME9DQXdMalUxTkRVek9DQXdMalEwTlRnM01TQXdMalUwTXpJME5rTXdMalEwTkRBNU5DQXdMalV6TVRrMU5DQXdMalEwTkRVNE15QXdMalV5TURReU1TQXdMalEwTnpNd09TQXdMalV3T1RNeE9VTXdMalExTURBek5TQXdMalE1T0RJeE9DQXdMalExTkRrME15QXdMalE0TnpjM0lEQXVORFl4TnpRNElEQXVORGM0TlRnMVF6QXVORFk0TlRVeklEQXVORFk1TkNBd0xqUTNOekV4T0NBd0xqUTJNVFkyTVNBd0xqUTROamswTkNBd0xqUTFOVGd5UXpBdU5EazJOemN4SURBdU5EUTVPVGM0SURBdU5UQTNOall4SURBdU5EUTJNVFV5SURBdU5URTRPVGd5SURBdU5EUTBOVFl5UXpBdU5UTXdNekF5SURBdU5EUXlPVGN6SURBdU5UUXhPREkySURBdU5EUXpOalV6SURBdU5UVXlPRGd4SURBdU5EUTJOVFl5UXpBdU5UWXpPVE0xSURBdU5EUTVORGN5SURBdU5UYzBNekF4SURBdU5EVTBOVFV6SURBdU5UZ3pNemN5SURBdU5EWXhOVEE1VERBdU5UWTNOVEExSURBdU5EZ3lPVGMxUXpBdU5UWXhNakk0SURBdU5EYzRNekkzSURBdU5UVTBNRGszSURBdU5EYzBPVFlnTUM0MU5EWTFNVGdnTUM0ME56TXdOamRETUM0MU16ZzVOQ0F3TGpRM01URTNOQ0F3TGpVek1UQTJNeUF3TGpRM01EYzVNeUF3TGpVeU16TXpOeUF3TGpRM01UazBORU13TGpVeE5UWXhNU0F3TGpRM016QTVOaUF3TGpVd09ERTRPQ0F3TGpRM05UYzFOeUF3TGpVd01UUTVNU0F3TGpRM09UYzNPRU13TGpRNU5EYzVOQ0F3TGpRNE16YzVPQ0F3TGpRNE9EazFOQ0F3TGpRNE9UQTVPQ0F3TGpRNE5ETXdOU0F3TGpRNU5UTTNOVU13TGpRM09UWTFOaUF3TGpVd01UWTFNaUF3TGpRM05qSTVJREF1TlRBNE56Z3pJREF1TkRjME16azNJREF1TlRFMk16WXlRekF1TkRjeU5UQTBJREF1TlRJek9UUWdNQzQwTnpJeE1qSWdNQzQxTXpFNE1UY2dNQzQwTnpNeU56UWdNQzQxTXprMU5ETkRNQzQwTnpRME1qVWdNQzQxTkRjeU5qZ2dNQzQwTnpjd09EY2dNQzQxTlRRMk9USWdNQzQwT0RFeE1EZ2dNQzQxTmpFek9EbERNQzQwT0RVeE1qZ2dNQzQxTmpnd09EWWdNQzQwT1RBME1qZ2dNQzQxTnpNNU1qVWdNQzQwT1RZM01EVWdNQzQxTnpnMU56Uk1NQzQwT0RBNE16a2dNQzQxT1RrNU1EZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjeUlpQjVNajBpTFRBdU1qQTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTEuMCIgeT0iMjUxLjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIC0+IEVsYXN0aWNzZWFyY2giIHN0eWxlPSJpci5yZWY9ZDJiMDBiZDAtMzczMi00MGYyLTg5NDgtMmJkNjA5M2ZjNmRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNyIgc291cmNlPSIxMCIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjQiIHZhbHVlPSJFQzIgLSBFbGFzdGljIENvbXB1dGUgQ2xvdWQgLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj00NTZlZjNiNC1kODc0LTRiZTktOTNkMS01NzdiM2RmMjI0YzA7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjEwIiB0YXJnZXQ9IjIzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjEiIHZhbHVlPSJPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1kMDc3ZjJjZS04ZjUxLTRlZWQtYjllOC0yOWMzM2MxYzkwMWU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9czM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNQzQ1T1RrNU9UVklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTVNRFV4SURBdU5UTTBNVGc0UXpBdU9ERTFNVGcwSURBdU5URXpNalUxSURBdU56a3hORFV4SURBdU5EazRORFUxSURBdU56YzFNVGcwSURBdU5EZzNPVEl5UXpBdU56WTVPVGcwSURBdU5EZzBOVGc1SURBdU56VTFOekU0SURBdU5EYzVNalUxSURBdU56VTBOVEU0SURBdU5EYzBOVGc1UXpBdU56VTBORE0ySURBdU5EY3hNalVnTUM0M05UUTRPRFlnTUM0ME5qYzVNVGtnTUM0M05UVTROVEVnTUM0ME5qUTNNakpNTUM0M05qa3hPRFFnTUM0ek5qZzROVFpETUM0M056TXdOVEVnTUM0ek5EQTNNaklnTUM0M056WTNPRFFnTUM0ek1USTFPRGtnTUM0M09EQTJOVEVnTUM0eU9EUTBOVFpETUM0M09EUXhNVGdnTUM0eU5UZzFPRGtnTUM0M056RTNNVGdnTUM0eU5ERXlOVFlnTUM0M05UQTJOVEVnTUM0eU1qWTNNak5ETUM0M01EYzNNVGdnTUM0eE9UWTVPRGtnTUM0Mk5URTNNVGdnTUM0eE9EUTVPU0F3TGpZd01URTROQ0F3TGpFM05qY3lNME13TGpVek56Z3hNU0F3TGpFMk5qTTNOaUF3TGpRM016TTJOU0F3TGpFMk5ESTNJREF1TkRBNU5EVXhJREF1TVRjd05EVTJRekF1TXpVeE9UWTJJREF1TVRjME5qYzBJREF1TWprMU5UUTJJREF1TVRnNE1UZ3pJREF1TWpReU16ZzBJREF1TWpFd05EVTJRekF1TWpFek9EVXhJREF1TWpJek56ZzVJREF1TVRjMk5URTRJREF1TWpRME5UZzVJREF1TVRneE1UZzBJREF1TWpnd09UZzVRekF1TVRrME5URTRJREF1TXpnNU1qVTJJREF1TWpFd01qVXhJREF1TkRrM01qVTFJREF1TWpJME56ZzBJREF1TmpBMU16ZzRRekF1TWpNeE5EVXhJREF1TmpVME9EVTFJREF1TWpNNE1URTRJREF1TnpBME16SXhJREF1TWpRME56ZzBJREF1TnpVek56ZzRRekF1TWpRMU9EWWdNQzQzTmpNME1pQXdMakkwT1RRMklEQXVOemN5TlRrNElEQXVNalUxTWpFNUlEQXVOemd3TXprMFF6QXVNall3T1RjNElEQXVOemc0TVRrZ01DNHlOamcyT1RNZ01DNDNPVFF6TWpnZ01DNHlOemMxT0RRZ01DNDNPVGd4T0RoRE1DNHpNVGc1TVRnZ01DNDRNakExT0RnZ01DNHpOekF4TVRnZ01DNDRNalk1T0RnZ01DNDBNVFl5TlRFZ01DNDRNekV5TlRSRE1DNDBOemMxT0RNZ01DNDRNelkzT1RRZ01DNDFNemt6T0RJZ01DNDRNelF3TlRnZ01DNDFPVGs1T0RRZ01DNDRNak14TWpGRE1DNDJNemd6T0RRZ01DNDRNVFl3TlRRZ01DNDNNRGs0TlRFZ01DNDRNRFEwTlRRZ01DNDNNVFU1T0RRZ01DNDNOVFkwTlRSRE1DNDNNak0xT0RRZ01DNDJPVFk1T0RnZ01DNDNNekU1T0RRZ01DNDJNemMxTWpFZ01DNDNNems1T0RRZ01DNDFOemd4T0RoTU1DNDNOREk1TVRnZ01DNDFOakF3TlRWRE1DNDNOalEyTlRFZ01DNDFOalV5TlRVZ01DNDRNalkyTlRFZ01DNDFOell6TWpJZ01DNDRNVGt3TlRFZ01DNDFNelF4T0RoYVRUQXVORGd3TmpVeElEQXVNVGt6TXpnNVF6QXVOVFl3TmpVeElEQXVNVGt6TXpnNUlEQXVOalV5TWpVeElEQXVNakF5TkRVMklEQXVOekl6T1RnMElEQXVNalF4T1RJelF6QXVOek0xTURVeElEQXVNalE0TURVMklEQXVOell3TnpnMElEQXVNall4TnpnNUlEQXVOelV6TURVeElEQXVNamM0TURVMlF6QXVOelExTXpFNElEQXVNamswTXpJeklEQXVOekl4TXpFNElEQXVNekF5TkRVMklEQXVOekEyTmpVeElEQXVNekE0TXpJeVF6QXVOamcxTnpBNElEQXVNekUyTURVNUlEQXVOalkwTVRjZ01DNHpNakl3TnpnZ01DNDJOREl5TlRFZ01DNHpNall6TWpKRE1DNDFORGN3TnpRZ01DNHpORFV4TnpZZ01DNDBORGt6TWprZ01DNHpORGN5TURjZ01DNHpOVE0wTlRFZ01DNHpNekl6TWpKRE1DNHpNVEF4TlRnZ01DNHpNamM0TlRnZ01DNHlOamd3TkRRZ01DNHpNVFUxTWpJZ01DNHlNamt4T0RRZ01DNHlPVFU1TWpORE1DNHlNVGsxT0RRZ01DNHlPVEEwTlRZZ01DNHlNRE0zTVRnZ01DNHlPREExT0RrZ01DNHlNRGd4TVRnZ01DNHlOamMxTWpORE1DNHlNVEUyTURNZ01DNHlOakExTURJZ01DNHlNVGN3TnpRZ01DNHlOVFEyTmlBd0xqSXlNemcxTVNBd0xqSTFNRGN5TTBNd0xqSTFNekV6TnlBd0xqSXpNVGc0T1NBd0xqSTROVGN3TXlBd0xqSXhPRGN5TnlBd0xqTXhPVGcxTVNBd0xqSXhNVGt5TTBNd0xqTTNNalV3TnlBd0xqRTVPVEk0TWlBd0xqUXlOalVnTUM0eE9UTXdOVGtnTUM0ME9EQTJOVEVnTUM0eE9UTXpPRGxXTUM0eE9UTXpPRGxhVFRBdU5qZzVOekU0SURBdU56VTFNemc0UXpBdU5qZzNOekU0SURBdU56Y3dPVGc0SURBdU5qWXhPVGcwSURBdU56YzROekl4SURBdU5qUTVOekU0SURBdU56Z3pNVEl4UXpBdU5qSTBNalV4SURBdU56a3hOalFnTUM0MU9UYzVPRElnTUM0M09UYzFNemNnTUM0MU56RXpNVGdnTUM0NE1EQTNNakZETUM0MU1USXhOVFlnTUM0NE1EZzFPRGNnTUM0ME5USXlNVE1nTUM0NE1EZzFPRGNnTUM0ek9UTXdOVEVnTUM0NE1EQTNNakZETUM0ek5UVTVPVFlnTUM0M09UYzRORFlnTUM0ek1UazRNVElnTUM0M09EZ3dNekVnTUM0eU9EWXpPRFFnTUM0M056RTNPRGhETUM0eU9ERTRNellnTUM0M05qazRNVEVnTUM0eU56YzVNeUF3TGpjMk5qWXdOU0F3TGpJM05URXdNeUF3TGpjMk1qVXpRekF1TWpjeU1qYzNJREF1TnpVNE5EVTJJREF1TWpjd05qUXpJREF1TnpVek5qY3pJREF1TWpjd016ZzBJREF1TnpRNE56SXhRekF1TWpVM01EVXhJREF1TmpReU9UZzRJREF1TWpReE9EVXhJREF1TlRNM01qVTFJREF1TWpJM05UZzBJREF1TkRNeE5USXlUREF1TWpFeU1URTRJREF1TXpFMk9EVTJRekF1TWpReU5ESTVJREF1TXpNek5UZzNJREF1TWpjMU16STVJREF1TXpRMU1USTBJREF1TXpBNU5EVXhJREF1TXpVd09UZzVRekF1TXpRMU9UazRJREF1TXpVNE5ESTNJREF1TXpnek1ESXlJREF1TXpZek1qZ3pJREF1TkRJd01qVXhJREF1TXpZMU5USXlRekF1TkRrek16RTFJREF1TXpjd056VTRJREF1TlRZMk56UTVJREF1TXpZMk5qZ3hJREF1TmpNNE56ZzBJREF1TXpVek16ZzVRekF1TmpjM01UWTNJREF1TXpRM09EWTRJREF1TnpFME1qUTJJREF1TXpNMU5EazBJREF1TnpRNE1qVXhJREF1TXpFMk9EVTJUREF1TnpFNU9UZzBJREF1TlRJMk1UZzRRekF1TmpVeU5ERTRJREF1TlRBek9USTRJREF1TlRnMk5EQTJJREF1TkRjM01qQXpJREF1TlRJeU16ZzBJREF1TkRRMk1UZzVRekF1TlRFNU5UYzFJREF1TkRRMU1URTNJREF1TlRFMk9EVTJJREF1TkRRek9ESTBJREF1TlRFME1qVXhJREF1TkRReU16SXlRekF1TlRFd05qVXhJREF1TkRNNU5qVTFJREF1TlRFeE5UZzBJREF1TkRRd09UZzVJREF1TlRBNU9EVXhJREF1TkRNMk9EVTFRekF1TlRBMk5URTRJREF1TkRJNU1qVTFJREF1TlRBMU56RTRJREF1TkRJek5USXlJREF1TkRrNE5qVXhJREF1TkRFM01qVTFRekF1TkRrME9ETTJJREF1TkRFME1pQXdMalE1TURNek1pQXdMalF4TWpFeU15QXdMalE0TlRVek1TQXdMalF4TVRJd05VTXdMalE0TURjeklEQXVOREV3TWpnM0lEQXVORGMxTnpjNElEQXVOREV3TlRVMklEQXVORGN4TVRBMUlEQXVOREV4T1RnNFF6QXVORFkyTkRNeElEQXVOREV6TkRJeElEQXVORFl5TVRjNUlEQXVOREUxT1RjMElEQXVORFU0TnpFM0lEQXVOREU1TkRJMFF6QXVORFUxTWpVMklEQXVOREl5T0RjMUlEQXVORFV5TmprZ01DNDBNamN4TVRrZ01DNDBOVEV5TkRJZ01DNDBNekUzT0RoRE1DNDBORGszT1RVZ01DNDBNelkwTlRjZ01DNDBORGsxTVNBd0xqUTBNVFF3T0NBd0xqUTFNRFF4TXlBd0xqUTBOakl4TWtNd0xqUTFNVE14TmlBd0xqUTFNVEF4TmlBd0xqUTFNek0zT1NBd0xqUTFOVFV5TmlBd0xqUTFOalF5TWlBd0xqUTFPVE0xTVVNd0xqUTFPVFEyTmlBd0xqUTJNekUzTlNBd0xqUTJNek01T0NBd0xqUTJOakU1T1NBd0xqUTJOemczTmlBd0xqUTJPREUxTjBNd0xqUTNNak0xTkNBd0xqUTNNREV4TmlBd0xqUTNOekkwTXlBd0xqUTNNRGsxSURBdU5EZ3lNVEU0SURBdU5EY3dOVGc1UXpBdU5EZzJOekUwSURBdU5EWTVPREkySURBdU5Ea3hNVGswSURBdU5EWTRORGd5SURBdU5EazFORFV4SURBdU5EWTJOVGc1UXpBdU5UQXdOalV4SURBdU5EWTBPVGc1SURBdU5UQXdOalV4SURBdU5EWTFNalUxSURBdU5UQTJNVEU0SURBdU5EWTNOemc1UXpBdU5UY3dPVFl5SURBdU5EazVOREE0SURBdU5qTTNOelkySURBdU5USTJPRFF5SURBdU56QTJNVEU0SURBdU5UUTVPVEl5UXpBdU56RTJNemcwSURBdU5UVXpNalUxSURBdU56RTJNalV4SURBdU5UUTVPVEl5SURBdU56RTJNalV4SURBdU5UVTRORFUxUXpBdU56RTFPREU0SURBdU5UWTBPVFEzSURBdU56RTBPVGN5SURBdU5UY3hOREEwSURBdU56RXpOekU0SURBdU5UYzNOemc0VERBdU56QTFNVGcwSURBdU5qUXhNemc0VERBdU5qZzVOekU0SURBdU56VTFNemc0V2swd0xqUTRNems0TkNBd0xqUTBNREExTlVNd0xqUTRNems0TkNBd0xqUTBNelkxTlNBd0xqUTNPRGt4T0NBd0xqUTBNekkxTlNBd0xqUTNOelU0TkNBd0xqUTBNRGs0T1VNd0xqUTNOakkxTVNBd0xqUXpPRGN5TWlBd0xqUTRNems0TkNBd0xqUXpORGs0T1NBd0xqUTRNems0TkNBd0xqUTBNREExTlZwTk1DNDNORFkyTlRFZ01DNDFNek16T0RoTU1DNDNOVEEyTlRFZ01DNDFNRE01TWpKRE1DNDNOak01T0RRZ01DNDFNVEUxTWpJZ01DNDNPRFkyTlRFZ01DNDFNakk1T0RnZ01DNDNPVEkyTlRFZ01DNDFNemd4T0RoRE1DNDNOemsxT0RRZ01DNDFORE0xTWpJZ01DNDNOVGc1TVRnZ01DNDFNelkwTlRVZ01DNDNORFkyTlRFZ01DNDFNek16T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTJJaUI0TWowaU1TNHlNRGN3TmlJZ2VUSTlJaTB3TGpJd056QTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpGQ05qWXdSaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTmtOQlJUTkZJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXdMams1T1RrNU5TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMTkuMCIgeT0iMjUxLjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIzIiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj04NjcwMTY2ZS1kYzM2LTRmNTItYmVhNi00NTQ1ZTk5OTJjODg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMTkuMCIgeT0iNjUuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBdXRvc2NhbGluZyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMS4zIiB5PSIwLjQ1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNzAuMCIgeT0iLTM4LjAiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJBUEkgLSBJL08gLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPTI0MDkwY2IxLTBjYjYtNDU1ZC05ZDE3LTNjMTFiYTcwODQ4NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iOSIgdGFyZ2V0PSIxMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkiIHZhbHVlPSJBUEkgLSBJL08iIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZETUM0Mk5ETTVORE1nTUM0NE1qQXdPREVnTUM0Mk5ERXhPRGdnTUM0NE1Ua3hPVFFnTUM0Mk16ZzVNREVnTUM0NE1UYzFNemRETUM0Mk16Y3hOemdnTUM0NE1UWXpNU0F3TGpZek5UYzNNU0F3TGpneE5EWTVNU0F3TGpZek5EYzVOeUF3TGpneE1qZ3hNME13TGpZek16Z3lOQ0F3TGpneE1Ea3pOU0F3TGpZek16TXhNU0F3TGpnd09EZzFNeUF3TGpZek16TXdNU0F3TGpnd05qY3pOMVl3TGpFNU16UXdORU13TGpZek16TXhJREF1TVRreE1USTFJREF1TmpNek9UQTBJREF1TVRnNE9EZzNJREF1TmpNMU1ESTBJREF1TVRnMk9UQXpRekF1TmpNMk1UUTBJREF1TVRnME9URTVJREF1TmpNM056VTFJREF1TVRnek1qVTFJREF1TmpNNU56QXhJREF1TVRneU1EY3hRekF1TmpReE5qWTVJREF1TVRnd056azNJREF1TmpRek9UTTNJREF1TVRnd01EWTFJREF1TmpRMk1qYzRJREF1TVRjNU9UUTRRekF1TmpRNE5qRTVJREF1TVRjNU9ETXhJREF1TmpVd09UUTVJREF1TVRnd016TXpJREF1TmpVek1ETTBJREF1TVRneE5EQTBUREF1T0RJMk16WTNJREF1TWpZMk1EY3hRekF1T0RJNE5Ua3hJREF1TWpZM01UWWdNQzQ0TXpBME5qZ2dNQzR5TmpnNE5EY2dNQzQ0TXpFM09EWWdNQzR5TnpBNU5ETkRNQzQ0TXpNeE1EVWdNQzR5TnpNd016a2dNQzQ0TXpNNE1UUWdNQzR5TnpVME5qRWdNQzQ0TXpNNE16UWdNQzR5TnpjNU16ZFdNQzQzTkRreE16ZERNQzQ0TXpNNU56Y2dNQzQzTlRJd05qRWdNQzQ0TXpNeE5UUWdNQzQzTlRRNU5URWdNQzQ0TXpFME9URWdNQzQzTlRjek5qRkRNQzQ0TWprNE1qZ2dNQzQzTlRrM056RWdNQzQ0TWpjME1Ua2dNQzQzTmpFMU5qWWdNQzQ0TWpRMk16UWdNQzQzTmpJME56Rk1NQzQyTlRFek1ERWdNQzQ0TWpBd056RkRNQzQyTkRrM09UY2dNQzQ0TWpBeU9EY2dNQzQyTkRneU56RWdNQzQ0TWpBeU9EY2dNQzQyTkRZM05qY2dNQzQ0TWpBd056RmFUVEF1TmpZd01UQXhJREF1TWpFME9EY3hWakF1TnpnNE1qQTBUREF1T0RBMk56WTNJREF1TnpNNU5UTTNWakF1TWpnMk1qQTBUREF1TmpZd01UQXhJREF1TWpFME9EY3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTFNelF6TXlBd0xqZ3lNREEzUXpBdU16VXlNREUzSURBdU9ESXdNall6SURBdU16VXdOVGd5SURBdU9ESXdNall6SURBdU16UTVNVFkySURBdU9ESXdNRGRNTUM0eE56VTRNek1nTUM0M05qSTBOME13TGpFM016QTNNeUF3TGpjMk1UVTBNeUF3TGpFM01EWTVNeUF3TGpjMU9UY3pOeUF3TGpFMk9UQTFOaUF3TGpjMU56TXpRekF1TVRZM05ERTVJREF1TnpVME9USXlJREF1TVRZMk5qRTBJREF1TnpVeU1EUTFJREF1TVRZMk56WTJJREF1TnpRNU1UTTNWakF1TWpjM09UTTNRekF1TVRZMk56ZzJJREF1TWpjMU5EWXhJREF1TVRZM05EazFJREF1TWpjek1ETTVJREF1TVRZNE9ERTBJREF1TWpjd09UUXpRekF1TVRjd01UTXpJREF1TWpZNE9EUTNJREF1TVRjeU1EQTVJREF1TWpZM01UWWdNQzR4TnpReU16TWdNQzR5TmpZd056Rk1NQzR6TkRjMU5qWWdNQzR4T0RFME1EUkRNQzR6TkRrMk5URWdNQzR4T0RBek16TWdNQzR6TlRFNU9ERWdNQzR4TnprNE16RWdNQzR6TlRRek1qSWdNQzR4TnprNU5EaERNQzR6TlRZMk5qTWdNQzR4T0RBd05qVWdNQzR6TlRnNU16SWdNQzR4T0RBM09UY2dNQzR6TmpBNE9Ua2dNQzR4T0RJd056RkRNQzR6TmpJNE1qRWdNQzR4T0RNeU56RWdNQzR6TmpRME1EVWdNQzR4T0RRNU5ESWdNQzR6TmpVMU1ERWdNQzR4T0RZNU1qVkRNQzR6TmpZMU9UZ2dNQzR4T0RnNU1EZ2dNQzR6TmpjeE56RWdNQzR4T1RFeE16Z2dNQzR6TmpjeE5qWWdNQzR4T1RNME1EUldNQzQ0TURZM016ZERNQzR6TmpjeE5UWWdNQzQ0TURnNE5USWdNQzR6TmpZMk5ETWdNQzQ0TVRBNU16VWdNQzR6TmpVMk55QXdMamd4TWpneE0wTXdMak0yTkRZNU5pQXdMamd4TkRZNU1TQXdMak0yTXpJNE9TQXdMamd4TmpNeElEQXVNell4TlRZMklEQXVPREUzTlRNM1F6QXVNelU1TWpNMElEQXVPREU1TXpBMUlEQXVNelUyTXpVM0lEQXVPREl3TWpBeUlEQXVNelV6TkRNeklEQXVPREl3TURkV01DNDRNakF3TjFwTk1DNHhPVE0wTXpNZ01DNDNOREF3TjB3d0xqTTBNREVnTUM0M09EZzNNemRXTUM0eU1UVTBNRFJNTUM0eE9UTTBNek1nTUM0eU9EY3dNRFJXTUM0M05EQXdOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek15TnpJZ01DNHpOalkyTXpKSU1DNDFPVE15TnpKV01DNHpNems1TmpaSU1DNDJNek15TnpKV01DNHpOalkyTXpKYVRUQXVOVFV6TWpjeUlEQXVNelkyTmpNeVNEQXVOVEV6TWpjeVZqQXVNek01T1RZMlNEQXVOVFV6TWpjeVZqQXVNelkyTmpNeVdrMHdMalEzTXpJM01pQXdMak0yTmpZek1rZ3dMalF6TXpJM01sWXdMak16T1RrMk5rZ3dMalEzTXpJM01sWXdMak0yTmpZek1scE5NQzR6T1RNeU56RWdNQzR6TmpZMk16SklNQzR6TlRNeU56RldNQzR6TXprNU5qWklNQzR6T1RNeU56RldNQzR6TmpZMk16SmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qTXpNamN5SURBdU5qWXdNRGc1U0RBdU5Ua3pNamN5VmpBdU5qTXpOREl6U0RBdU5qTXpNamN5VmpBdU5qWXdNRGc1V2swd0xqVTFNekkzTWlBd0xqWTJNREE0T1Vnd0xqVXhNekkzTWxZd0xqWXpNelF5TTBnd0xqVTFNekkzTWxZd0xqWTJNREE0T1ZwTk1DNDBOek15TnpJZ01DNDJOakF3T0RsSU1DNDBNek15TnpKV01DNDJNek0wTWpOSU1DNDBOek15TnpKV01DNDJOakF3T0RsYVRUQXVNemt6TWpjeElEQXVOall3TURnNVNEQXVNelV6TWpjeFZqQXVOak16TkRJelNEQXVNemt6TWpjeFZqQXVOall3TURnNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRME1UVXlJREF1TlRRMU9UTk1NQzR6T1RFek9EWWdNQzQxTURNeE0wTXdMak00T1RreU15QXdMalV3TVRnM09DQXdMak00T0RjME9DQXdMalV3TURNeU5DQXdMak00TnprME1pQXdMalE1T0RVM05VTXdMak00TnpFek5pQXdMalE1TmpneU5pQXdMak00TmpjeE9TQXdMalE1TkRreU15QXdMak00TmpjeE9TQXdMalE1TWprNU4wTXdMak00TmpjeE9TQXdMalE1TVRBM01TQXdMak00TnpFek5pQXdMalE0T1RFMk9DQXdMak00TnprME1pQXdMalE0TnpReE9FTXdMak00T0RjME9DQXdMalE0TlRZMk9TQXdMak00T1RreU15QXdMalE0TkRFeE5TQXdMak01TVRNNE5pQXdMalE0TWpnMk0wd3dMalEwTVRNNE5pQXdMalEwTURBMk0wd3dMalExT0RjeUlEQXVORFl3TXpOTU1DNDBNakExT0RZZ01DNDBPVE16T1RkTU1DNDBOVGczTWlBd0xqVXlOakEyTTB3d0xqUTBNVFV5SURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFU0TnpJMklEQXVOVFExT1ROTU1DNDFOREV6T1RNZ01DNDFNalUyTmpOTU1DNDFOemsxTWpVZ01DNDBPVE16T1RkTU1DNDFOREV5TmlBd0xqUTJNRGcyTTB3d0xqVTFPRFU1TXlBd0xqUTBNREEyTTB3d0xqWXdPRGN5TlNBd0xqUTRNamN6UXpBdU5qRXdNVGc0SURBdU5EZ3pPVGd5SURBdU5qRXhNell6SURBdU5EZzFOVE0ySURBdU5qRXlNVFk1SURBdU5EZzNNamcxUXpBdU5qRXlPVGMxSURBdU5EZzVNRE0wSURBdU5qRXpNemt5SURBdU5Ea3dPVE00SURBdU5qRXpNemt5SURBdU5Ea3lPRFl6UXpBdU5qRXpNemt5SURBdU5EazBOemc1SURBdU5qRXlPVGMxSURBdU5EazJOamt6SURBdU5qRXlNVFk1SURBdU5EazRORFF5UXpBdU5qRXhNell6SURBdU5UQXdNVGt4SURBdU5qRXdNVGc0SURBdU5UQXhOelExSURBdU5qQTROekkxSURBdU5UQXlPVGszVERBdU5UVTROekkySURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEV6TmpnNUlEQXVOREUzTWpJMlREQXVORFl3TmpreklEQXVOVGN6T1RjMVREQXVORGcxT1RVMUlEQXVOVGd5TlRFMVREQXVOVE00T1RVeElEQXVOREkxTnpZM1REQXVOVEV6TmpnNUlEQXVOREUzTWpJMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3hNU0lnZURJOUlqRXVNakEzTVRVaUlIa3lQU0l0TUM0eU1EY3hNRGNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlNMFJESTNRVGdpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBFeE5qWkdSaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTM1MWNlOTNhLTUzY2QtNDFlNy1iNmZkLWE3ZWZmYzk5N2FjMzsiIHBhcmVudD0iNCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyNC4wIiB5PSI2NC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPWNhOWJiMzM2LTVmMGItNDQ2MS1iMTU2LTE2YWVlZWMxNjE0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iMTIiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkNsb3VkV2F0Y2giIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1jbG91ZHdhdGNoO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTVRrNU9EZ2dNQzQyTXprNU5UTklNQzR5TnpNek1qRkRNQzR5TlRnME9EVWdNQzQyTXprMk5qWWdNQzR5TkRRd01EZ2dNQzQyTXpVek16TWdNQzR5TXpFME5UVWdNQzQyTWpjME1rTXdMakl4TVRJME5TQXdMall4TlRBek9TQXdMakU1TkRZeklEQXVOVGszTlRneklEQXVNVGd6TWpZeElEQXVOVGMyTnpnM1F6QXVNVGN4T0RreklEQXVOVFUxT1RreElEQXVNVFkyTVRZM0lEQXVOVE15TlRneUlEQXVNVFkyTmpVMUlEQXVOVEE0T0RnMlF6QXVNVFkxTWprNUlEQXVORGd4TnpRZ01DNHhOek14TURjZ01DNDBOVFE1TWpZZ01DNHhPRGc0TWpVZ01DNDBNekkzTlRKRE1DNHlNRFExTkRNZ01DNDBNVEExTnpnZ01DNHlNamN5TlRnZ01DNHpPVFF6TXlBd0xqSTFNek15TVNBd0xqTTROall5UXpBdU1qVXpNekl4SURBdU16Z3pNVFV6SURBdU1qVXpNekl4SURBdU16YzVOamcySURBdU1qVXpNekl4SURBdU16YzJNakpETUM0eU5UUXdOVElnTUM0ek5ESXpORFFnTUM0eU5qUXhPVEVnTUM0ek1Ea3pNemdnTUM0eU9ESTJNRFFnTUM0eU9EQTRPVFJETUM0ek1ERXdNVGdnTUM0eU5USTBOU0F3TGpNeU5qazRJREF1TWpJNU5qZzRJREF1TXpVM05UZzRJREF1TWpFMU1UVXpRekF1TXprd05EZzJJREF1TWpBd05UazRJREF1TkRJM01EY3lJREF1TVRrMk5UTTVJREF1TkRZeU16WWdNQzR5TURNMU0wTXdMalE1TnpZME9DQXdMakl4TURVeU1TQXdMalV5T1RreU15QXdMakl5T0RJeU1pQXdMalUxTkRjNE9DQXdMakkxTkRJeVF6QXVOVGN4TlRBeUlEQXVNamN4TWpReUlEQXVOVGcxTURRNElEQXVNamt4TVRBNUlEQXVOVGswTnpnNElEQXVNekV5T0RnMlF6QXVOakE0TmpneUlEQXVNekF4TmpjeUlEQXVOakkxT1RrNElEQXVNamsxTlRVMUlEQXVOalF6T0RVMElEQXVNamsxTlRVelF6QXVOamd3TVRJeElEQXVNamsxTlRVeklEQXVOekl3T1RJeElEQXVNekl6TURJZ01DNDNNamd6T0RjZ01DNHpPRE15T0RaRE1DNDNOakkyTlRRZ01DNHpPVEUwTWlBd0xqZ3pNekExTkNBd0xqUXhPVFF5SURBdU9ETXpNRFUwSURBdU5URXdNRGcyUXpBdU9ETTBNakU1SURBdU5UTXlOemt5SURBdU9ESTRPVEE1SURBdU5UVTFNell4SURBdU9ERTNOelEwSURBdU5UYzFNVFkyUXpBdU9EQTJOVGM1SURBdU5UazBPVGN4SURBdU56a3dNREUzSURBdU5qRXhNVGsySURBdU56WTVPVGczSURBdU5qSXhPVFV6VERBdU56VTJOalUwSURBdU5UazROakpETUM0M056STBORFFnTUM0MU9UQXdPQ0F3TGpjNE5UUTNNU0F3TGpVM056SXhOaUF3TGpjNU5ESXdPU0F3TGpVMk1UVXpOVU13TGpnd01qazBOeUF3TGpVME5UZzFOQ0F3TGpnd056QXpNeUF3TGpVeU9EQXdOeUF3TGpnd05UazROeUF3TGpVeE1EQTROa013TGpnd05UazROeUF3TGpRek1UWTROaUF3TGpjME1UQTFOQ0F3TGpReE1qSXlJREF1TnpFeU5qVTBJREF1TkRBM05ESkRNQzQzTVRBNU1TQXdMalF3TnpFd09TQXdMamN3T1RJME5TQXdMalF3TmpRMU5DQXdMamN3TnpjMU55QXdMalF3TlRRNU1rTXdMamN3TmpJMk9TQXdMalF3TkRVek1TQXdMamN3TkRrNE55QXdMalF3TXpJNE1pQXdMamN3TXprNE55QXdMalF3TVRneVF6QXVOekF5TURNeUlEQXVNems1TURJM0lEQXVOekF4TWpJeElEQXVNemsxTlRreUlEQXVOekF4TnpJeElEQXVNemt5TWpKRE1DNDJPVGM0TlRRZ01DNHpORE00TWlBd0xqWTJPVFU0TnlBd0xqTXlNakl5SURBdU5qUXpNRFUwSURBdU16SXlNakpETUM0Mk16UTJNRFFnTUM0ek1qSXlPVFVnTUM0Mk1qWXlPVElnTUM0ek1qUXpOemNnTUM0Mk1UZzRNRFVnTUM0ek1qZ3lPVFZETUM0Mk1URXpNVGNnTUM0ek16SXlNVE1nTUM0Mk1EUTROamNnTUM0ek16YzROVFFnTUM0MU9UazVPRGdnTUM0ek5EUTNOVE5ETUM0MU9UZzFOVGtnTUM0ek5EWTNNRGdnTUM0MU9UWTJNallnTUM0ek5EZ3lNemdnTUM0MU9UUXpPVFFnTUM0ek5Ea3hOemRETUM0MU9USXhOak1nTUM0ek5UQXhNVGNnTUM0MU9EazNNVGNnTUM0ek5UQTBNekVnTUM0MU9EY3pNakVnTUM0ek5UQXdPRFpETUM0MU9EUTVNeklnTUM0ek5EazNNVElnTUM0MU9ESTJPU0F3TGpNME9EWTVOaUF3TGpVNE1EZ3pOU0F3TGpNME56RTBOa013TGpVM09EazRJREF1TXpRMU5UazJJREF1TlRjM05UZ2dNQzR6TkRNMU55QXdMalUzTmpjNE9DQXdMak0wTVRJNE5rTXdMalUyT0RBNU5DQXdMak14TlRZNU5TQXdMalUxTXpjNUlEQXVNamt5TXpjeElEQXVOVE0wT1RJeElEQXVNamN6TURKRE1DNDFNVE00TWpVZ01DNHlOVEV4TWprZ01DNDBPRFkxTXpFZ01DNHlNell5TWpRZ01DNDBOVFkzTVNBd0xqSXpNRE14TTBNd0xqUXlOamc0T1NBd0xqSXlORFF3TVNBd0xqTTVOVGszTXlBd0xqSXlOemMyTlNBd0xqTTJPREV5TVNBd0xqSXpPVGsxTTBNd0xqTTBNalF6T0NBd0xqSTFNalEwTmlBd0xqTXlNRFkxTkNBd0xqSTNNVGN4TmlBd0xqTXdOVEV5TWlBd0xqSTVOVFk0TkVNd0xqSTRPVFU1SURBdU16RTVOalV5SURBdU1qZ3dPRGs1SURBdU16UTNOREEzSURBdU1qYzVPVGc0SURBdU16YzFPVFV6UXpBdU1qZ2dNQzR6T0RJeE1ESWdNQzR5T0RBek5UWWdNQzR6T0RneU5EUWdNQzR5T0RFd05UVWdNQzR6T1RRek5UTkRNQzR5T0RFME9EWWdNQzR6T1RjM016TWdNQzR5T0RBMk1EZ2dNQzQwTURFeE5TQXdMakkzT0RVNU9TQXdMalF3TXprd01rTXdMakkzTmpVNU1TQXdMalF3TmpZMU5DQXdMakkzTXpZd05TQXdMalF3T0RVek15QXdMakkzTURJMU5TQXdMalF3T1RFMU0wTXdMakkwTnpVNUlEQXVOREV6TnpnMUlEQXVNakkzTXpReklEQXVOREkyTkRBeUlEQXVNakV6TVRrNElEQXVORFEwTnpBMlF6QXVNVGs1TURVMElEQXVORFl6TURFeElEQXVNVGt4T1RVeklEQXVORGcxTnpnMklEQXVNVGt6TVRnNElEQXVOVEE0T0RnMlF6QXVNVGt5TmpJNElEQXVOVEk0TURrM0lEQXVNVGszTVRnMklEQXVOVFEzTVRFZ01DNHlNRFl6T1RNZ01DNDFOak01TnpsRE1DNHlNVFUyTURFZ01DNDFPREE0TkRnZ01DNHlNamt4TWpnZ01DNDFPVFE1TmpZZ01DNHlORFUxT0RnZ01DNDJNRFE0T0RaRE1DNHlOVE00T0NBd0xqWXhNREU1TWlBd0xqSTJNelEzT1NBd0xqWXhNekVnTUM0eU56TXpNakVnTUM0Mk1UTXlPRFpJTUM0ME1UazVPRGhXTUM0Mk16azVOVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU0TkRrMUlEQXVOekU1T1RjM1REQXVOekl6T0RJNElEQXVOakkwT1RGRE1DNDNNemMwTURNZ01DNDFPVFEwTWlBd0xqY3pPVGMyTVNBd0xqVTJNREV4TWlBd0xqY3pNRFE0TlNBd0xqVXlPREExTWtNd0xqY3lNVEl3T0NBd0xqUTVOVGs1TVNBd0xqY3dNRGc1TlNBd0xqUTJPREkwTXlBd0xqWTNNekV6TnlBd0xqUTBPVGN4TWtNd0xqWTBOVE0zT0NBd0xqUXpNVEU0TVNBd0xqWXhNVGsyTWlBd0xqUXlNekEyTWlBd0xqVTNPRGM1TlNBd0xqUXlOamM0T0VNd0xqVTBOVFl5T1NBd0xqUXpNRFV4TlNBd0xqVXhORGcwT0NBd0xqUTBOVGcwT0NBd0xqUTVNVGc1TkNBd0xqUTNNREEzTjBNd0xqUTJPRGswSURBdU5EazBNekEySURBdU5EVTFNamt5SURBdU5USTFPRGN4SURBdU5EVXpNell5SURBdU5UVTVNVGxETUM0ME5URTBNeklnTUM0MU9USTFNU0F3TGpRMk1UTTBOU0F3TGpZeU5UUXpPU0F3TGpRNE1UTTBPQ0F3TGpZMU1qRTFOa013TGpVd01UTTFNU0F3TGpZM09EZzNNeUF3TGpVek1ERTFOaUF3TGpZNU56WTFPQ0F3TGpVMk1qWTNNU0F3TGpjd05URTRPVU13TGpVNU5URTROU0F3TGpjeE1qY3hPU0F3TGpZeU9UTXhOaUF3TGpjd09EVXhNaUF3TGpZMU9UQXlPQ0F3TGpZNU16TXhUREF1TnpVeU16WXhJREF1TnpnMk5qUXpRekF1TnpZeE1qWTJJREF1TnprMU16TWdNQzQzTnpNeU5UWWdNQzQ0TURBeE1qVWdNQzQzT0RVMk9UVWdNQzQzT1RrNU56ZERNQzQzT1RFNE16WWdNQzQ0TURBd05qSWdNQzQzT1RjNU16SWdNQzQzT1RnNU1qY2dNQzQ0TURNMk16RWdNQzQzT1RZMk16aERNQzQ0TURrek16RWdNQzQzT1RRek5TQXdMamd4TkRVeE9TQXdMamM1TURrMU1pQXdMamd4T0RnNU5TQXdMamM0TmpZME0wTXdMamd5TXpJM01TQXdMamM0TWpJMU15QXdMamd5Tmpjek5DQXdMamMzTnpBMElEQXVPREk1TURnMElEQXVOemN4TXpBMVF6QXVPRE14TkRNMUlEQXVOelkxTlRZNUlEQXVPRE15TmpJMklEQXVOelU1TkRJMUlEQXVPRE15TlRnNUlEQXVOelV6TWpJM1F6QXVPRE15TlRVeElEQXVOelEzTURJNElEQXVPRE14TWpnM0lEQXVOelF3T0RrNUlEQXVPREk0T0RZNElEQXVOek0xTVRreVF6QXVPREkyTkRRNUlEQXVOekk1TkRnMUlEQXVPREl5T1RJeklEQXVOekkwTXpFMElEQXVPREU0TkRrMUlEQXVOekU1T1RjM1drMHdMalU1TkRZeU9DQXdMalk0TWpJME0wTXdMalUzTVRrM05TQXdMalk0TWpJME15QXdMalUwT1Rnek1pQXdMalkzTlRVeU5pQXdMalV6TURrNU55QXdMalkyTWprME1VTXdMalV4TWpFMk1pQXdMalkxTURNMU5pQXdMalE1TnpRNE1pQXdMall6TWpRMk9DQXdMalE0T0RneE15QXdMall4TVRVMFF6QXVORGd3TVRRMElEQXVOVGt3TmpFeUlEQXVORGMzT0RjMklEQXVOVFkzTlRneklEQXVORGd5TWprMUlEQXVOVFExTXpZMlF6QXVORGcyTnpFMUlEQXVOVEl6TVRRNElEQXVORGszTmpJeklEQXVOVEF5TnpRZ01DNDFNVE0yTkRFZ01DNDBPRFkzTWpORE1DNDFNamsyTlRrZ01DNDBOekEzTURVZ01DNDFOVEF3TmpZZ01DNDBOVGszT1RjZ01DNDFOekl5T0RRZ01DNDBOVFV6TnpkRE1DNDFPVFExTURFZ01DNDBOVEE1TlRnZ01DNDJNVGMxTXlBd0xqUTFNekl5TmlBd0xqWXpPRFExT0NBd0xqUTJNVGc1TlVNd0xqWTFPVE00TmlBd0xqUTNNRFUyTkNBd0xqWTNOekkzTkNBd0xqUTROVEkwTkNBd0xqWTRPVGcxT1NBd0xqVXdOREEzT1VNd0xqY3dNalEwTkNBd0xqVXlNamt4TXlBd0xqY3dPVEUyTVNBd0xqVTBOVEExTnlBd0xqY3dPVEUyTVNBd0xqVTJOemN4UXpBdU56QTVNVFl4SURBdU5UazRNRGcySURBdU5qazNNRGswSURBdU5qSTNNakU0SURBdU5qYzFOakUxSURBdU5qUTROamszUXpBdU5qVTBNVE0ySURBdU5qY3dNVGMySURBdU5qSTFNREEwSURBdU5qZ3lNalF6SURBdU5UazBOakk0SURBdU5qZ3lNalF6V2swd0xqYzVPVGsyTVNBd0xqYzJOek14UXpBdU56azJNRGN6SURBdU56Y3dPVGsxSURBdU56a3dPVEU1SURBdU56Y3pNRFVnTUM0M09EVTFOakVnTUM0M056TXdOVU13TGpjNE1ESXdOQ0F3TGpjM016QTFJREF1TnpjMU1EVWdNQzQzTnpBNU9UVWdNQzQzTnpFeE5qRWdNQzQzTmpjek1Vd3dMalk0TWpNMk1TQXdMalkzT0RVeFF6QXVOamt6TWpBMUlEQXVOamN3TURBeklEQXVOekF5TnpNZ01DNDJOVGs1TXpnZ01DNDNNVEEyTWpnZ01DNDJORGcyTkROTU1DNDNPVGs1TmpFZ01DNDNNemcxTVVNd0xqZ3dNemMwSURBdU56UXlNelV4SURBdU9EQTFPRFUzSURBdU56UTNOVEl5SURBdU9EQTFPRFUzSURBdU56VXlPVEZETUM0NE1EVTROVGNnTUM0M05UZ3lPVGdnTUM0NE1ETTNOQ0F3TGpjMk16UTJPU0F3TGpjNU9UazJNU0F3TGpjMk56TXhXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWXpNVFF4TVNBd0xqVXdOVGN4T1V3d0xqWXhOVFUwTlNBd0xqVXlOekU0TlVNd0xqWXdPRFF3T0NBd0xqVXlNVGc1T0NBd0xqVTVPVGcyTkNBd0xqVXhPRGcwTkNBd0xqVTVNRGs1TWlBd0xqVXhPRFF4UXpBdU5UZ3lNVElnTUM0MU1UYzVOellnTUM0MU56TXpNVGtnTUM0MU1qQXhPREVnTUM0MU5qVTNJREF1TlRJME56UTNRekF1TlRVNE1EZ3hJREF1TlRJNU16RXpJREF1TlRVeE9UZzNJREF1TlRNMk1ETTBJREF1TlRRNE1UZzJJREF1TlRRME1EWXlRekF1TlRRME16ZzFJREF1TlRVeU1Ea2dNQzQxTkRNd05Ea2dNQzQxTmpFd05qUWdNQzQxTkRRek5EWWdNQzQxTmprNE5URkRNQzQxTkRVd09EWWdNQzQxTnpVNE1Ua2dNQzQxTkRjd05ERWdNQzQxT0RFMU56SWdNQzQxTlRBd09URWdNQzQxT0RZM05UVkRNQzQxTlRNeE5ERWdNQzQxT1RFNU16Y2dNQzQxTlRjeU1qRWdNQzQxT1RZME5DQXdMalUyTWpBM09TQXdMalU1T1RrNE5Fd3dMalUwTmpjME5pQXdMall5TURjNE5FTXdMalV6TVRnM05DQXdMall3T1RNME5TQXdMalV5TWpBNE5pQXdMalU1TWpVeU5TQXdMalV4T1RRNE9TQXdMalUzTXprME5FTXdMalV4TmpnNU1TQXdMalUxTlRNMk1pQXdMalV5TVRZNU1TQXdMalV6TmpVd015QXdMalV6TWpnMU5pQXdMalV5TVRReU5FTXdMalUwTkRBeU1TQXdMalV3TmpNME5pQXdMalUyTURZMU9DQXdMalE1TmpJMU1pQXdMalUzT1RFNE9TQXdMalE1TXpNeE5VTXdMalU1TnpjeUlEQXVORGt3TXpjNElEQXVOakUyTmpZMElEQXVORGswT0RNeUlEQXVOak14T1RRMElEQXVOVEExTnpFNVNEQXVOak14TkRFeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3dOeUlnZURJOUlqRXVNakEzTURjaUlIa3lQU0l0TUM0eU1EY3dOamNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlOQ01EQTRORVFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaR05FWTRRaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTEyYzcyZWM3LTliODctNDM2ZS1iMTkwLTY5ZjA1NjU0YTBhZjsiIHBhcmVudD0iNCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyNC4wIiB5PSIyMDkuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjkiIHZhbHVlPSJBV1MgQWNjb3VudCBFbnZpcm9ubWVudCIgc3R5bGU9ImlyLnJlZj1jMWExMjc2Zi00MTFhLTRhZWItODE4Yy1hNGI2MDUxMTJjNTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRFZ01FZ3dWakZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGMyTnpJMElEQXVOamd3TXpBelNEQXVNVFU1T1RFeVZqQXVOak13T0RjNFF6QXVNVFU1T0RNeklEQXVOVGN5TmpBMUlEQXVNVGM1TXpJeUlEQXVOVEUxT1RreklEQXVNakUxTWpVMklEQXVORGN3TVRFNVF6QXVNalV4TVRnNUlEQXVOREkwTWpRMUlEQXVNekF4TkRnMElEQXVNemt4TnpZM0lEQXVNelU0TURjNElEQXVNemMzT0RreFREQXVNell6T1RNNUlEQXVNemMyTkRZMVREQXVNelk1TXpJMUlEQXVNemM1TXpFMlF6QXVNemczTXpjNElEQXVNemc0T1RneElEQXVOREEzTlRNM0lEQXVNemswTURNNElEQXVOREk0TURFMElEQXVNemswTURNNFF6QXVORFE0TkRreElEQXVNemswTURNNElEQXVORFk0TmpVeElEQXVNemc0T1RneElEQXVORGcyTnpBMElEQXVNemM1TXpFMlREQXVORGt5TURnNUlEQXVNemMyTkRZMVREQXVORGszT1RVZ01DNHpOemM0T1RGRE1DNDFORGc0TVRnZ01DNHpPVEExTURnZ01DNDFPVFEzTWprZ01DNDBNVGd4SURBdU5qSTVOelEwSURBdU5EVTNNRGs0VERBdU5qQTJNeUF3TGpRM09ETXlOVU13TGpVM05qWXdPQ0F3TGpRME5UVTFOU0F3TGpVek9ERXhOaUF3TGpReU1qQXhPU0F3TGpRNU5UUXhOaUF3TGpReE1EVXlORU13TGpRM05ESXdPQ0F3TGpReU1EZ2dNQzQwTlRBNU5EY2dNQzQwTWpZeE16a2dNQzQwTWpjek9ERWdNQzQwTWpZeE16bERNQzQwTURNNE1UUWdNQzQwTWpZeE16a2dNQzR6T0RBMU5UUWdNQzQwTWpBNElEQXVNelU1TXpRMUlEQXVOREV3TlRJMFF6QXVNekV4TURJeElEQXVOREl6TnpReklEQXVNalk0TXpjMElEQXVORFV5TkRZeklEQXVNak0zT1RVeklEQXVORGt5TWpjeVF6QXVNakEzTlRNeklEQXVOVE15TURnZ01DNHhPVEV3TWpNZ01DNDFPREEzTnpZZ01DNHhPVEE1TmlBd0xqWXpNRGczT0ZZd0xqWTBPRFl5U0RBdU5EYzJNRGxNTUM0ME56WTNNalFnTUM0Mk9EQXpNRE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOREkzTmpNMUlEQXVOREkxTURFMVF6QXVOREF6TnpNNElEQXVOREkxTURnMklEQXVNemd3TWpBM0lEQXVOREU1TVRRNUlEQXVNelU1TWpBMElEQXVOREEzTnpRNFF6QXVNek14TXprMElEQXVNemt5TlRjM0lEQXVNekE1TkRJNUlEQXVNelk0TlRjMElEQXVNamsyTnpjM0lEQXVNek01TlRORE1DNHlPRFF4TWpRZ01DNHpNVEEwT0RZZ01DNHlPREUxTURVZ01DNHlOemd3TlRVZ01DNHlPRGt6TXpNZ01DNHlORGN6TlRaRE1DNHlPVGN4TmpJZ01DNHlNVFkyTlRnZ01DNHpNVFE1T1RFZ01DNHhPRGswTkRJZ01DNHpOREF3TURZZ01DNHhOekF3TURSRE1DNHpOalV3TWpFZ01DNHhOVEExTmpZZ01DNHpPVFUzT1RnZ01DNHhOREF3TVRVZ01DNDBNamMwTnpjZ01DNHhOREF3TVRWRE1DNDBOVGt4TlRZZ01DNHhOREF3TVRVZ01DNDBPRGs1TXpNZ01DNHhOVEExTmpZZ01DNDFNVFE1TkRnZ01DNHhOekF3TURSRE1DNDFNems1TmpNZ01DNHhPRGswTkRJZ01DNDFOVGMzT1RNZ01DNHlNVFkyTlRnZ01DNDFOalUyTWpFZ01DNHlORGN6TlRaRE1DNDFOek0wTkRrZ01DNHlOemd3TlRVZ01DNDFOekE0TXlBd0xqTXhNRFE0TmlBd0xqVTFPREUzTnlBd0xqTXpPVFV6UXpBdU5UUTFOVEkxSURBdU16WTROVGMwSURBdU5USXpOVFlnTUM0ek9USTFOemNnTUM0ME9UVTNOU0F3TGpRd056YzBPRll3TGpRd056YzBPRU13TGpRM05EZ3hNaUF3TGpReE9UQXlNaUF3TGpRMU1UUXhOU0F3TGpReU5EazFOQ0F3TGpReU56WXpOU0F3TGpReU5UQXhOVnBOTUM0ME1qYzJNelVnTUM0eE56VTJOekpETUM0ME1ETXlPRGtnTUM0eE56VXlNRFVnTUM0ek56azBPVElnTUM0eE9ESTVNeUF3TGpNMk1EQTJNU0F3TGpFNU56WXdOa013TGpNME1EWXpJREF1TWpFeU1qZ3pJREF1TXpJMk5qa3lJREF1TWpNek1EWXhJREF1TXpJd05EZ3hJREF1TWpVMk5qQTNRekF1TXpFME1qY3hJREF1TWpnd01UVTBJREF1TXpFMk1UUTRJREF1TXpBMU1UQTBJREF1TXpJMU9ERXpJREF1TXpJM05EVTFRekF1TXpNMU5EYzNJREF1TXpRNU9EQTNJREF1TXpVeU16WTVJREF1TXpZNE1qWTFJREF1TXpjek56YzRJREF1TXpjNU9EWTNRekF1TXprd01UUTFJREF1TXpnNE5qUTFJREF1TkRBNE5ESTVJREF1TXprek1qTTRJREF1TkRJM01EQXlJREF1TXprek1qTTRRekF1TkRRMU5UYzBJREF1TXprek1qTTRJREF1TkRZek9EVTRJREF1TXpnNE5qUTFJREF1TkRnd01qSTJJREF1TXpjNU9EWTNRekF1TlRBeE5UTWdNQzR6Tmpnek1USWdNQzQxTVRnek5pQXdMak0wT1RrMk5pQXdMalV5T0RBME1TQXdMak15TnpjME5rTXdMalV6TnpjeU1TQXdMak13TlRVeU5pQXdMalV6T1RZNU5TQXdMakk0TURjd055QXdMalV6TXpZMUlEQXVNalUzTWpNMlF6QXVOVEkzTmpBMUlEQXVNak16TnpZMElEQXVOVEV6T0RnNElEQXVNakV5T1RnM0lEQXVORGswTmpjNElEQXVNVGs0TWpBNVF6QXVORGMxTkRZNUlEQXVNVGd6TkRNZ01DNDBOVEU0TnpFZ01DNHhOelUwT1RjZ01DNDBNamMyTXpVZ01DNHhOelUyTnpKV01DNHhOelUyTnpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmpjek5ESTJJREF1T0RZd01EUTRUREF1TlRBME9EZ3pJREF1TnpZeU56Z3lWakF1TlRZNE1Ea3hUREF1Tmpjek5ESTJJREF1TkRjd09ESTFUREF1T0RReE9UWTVJREF1TlRZNE1Ea3hWakF1TnpZeU56Z3lUREF1Tmpjek5ESTJJREF1T0RZd01EUTRXazB3TGpVek5qVTJOQ0F3TGpjME5EUXdOa3d3TGpZM016UXlOaUF3TGpneU16WXhNMHd3TGpneE1ESTRPQ0F3TGpjME5EUXdObFl3TGpVNE5UazVNa3d3TGpZM016UXlOaUF3TGpVd05qYzROVXd3TGpVek5qVTJOQ0F3TGpVNE5UazVNbFl3TGpjME5EUXdObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOek0xTmpNZ01DNDJPRE0yTnpkTU1DNDFNVEk1TXprZ01DNDFPVEV3TURSTU1DNDFNamczT0NBd0xqVTJNelU1T1V3d0xqWTNNelUyTXlBd0xqWTBOekE0TTB3d0xqZ3hPRE0wTmlBd0xqVTJNelU1T1V3d0xqZ3pOREU0TnlBd0xqVTVNVEF3TkV3d0xqWTNNelUyTXlBd0xqWTRNelkzTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT0Rrek9UWWdNQzQyTmpVMU1qZElNQzQyTlRjM01UVldNQzQ0TkRFNE5ESklNQzQyT0Rrek9UWldNQzQyTmpVMU1qZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeE1EY2lJSGt4UFNJeExqSXdOekUxSWlCNE1qMGlNUzR5TURjeE1TSWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTTROVEV4UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrWTVPVEF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0LjAiIHk9IjM1NC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IlVzZXIgLSBXZWIgVUkgLT4gQVdTIEFQSSBHYXRld2F5IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj1iZTE3ZDA1My1iZTc0LTRkYjEtOTVmNC0wMmE3ZmJhODY2M2M7aXIudGFncz1Mb2dpbiBDcmVkZW50aWFscztpci5hc3NldHM9UGVyc29uYWxseSBJZGVudGlmaWFibGUgSW5mb3JtYXRpb247IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNSIgdGFyZ2V0PSI5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMTU5LjAiIHk9IjIzNi4wIiB3aWR0aD0iMzQzLjAiIGhlaWdodD0iMjAyLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIgLT4gU0lFTSBUZWFtIiBzdHlsZT0iaXIucmVmPWUzMTJlZGNmLWVjZjEtNGM3My04ZmI0LTdkZDk1ZThiMDZkYTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTE7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxOSIgc291cmNlPSIxNyIgdGFyZ2V0PSIyNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE3IiB2YWx1ZT0iSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1pbnRlcm5hbC1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVU13TGpNMk5UZzFNeUF3TGpJNE1qYzRNeUF3TGpNM09EY3lOU0F3TGpJMk9Ua3hNU0F3TGpNNU5EWXdNeUF3TGpJMk9Ua3hNVWd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJMk9Ua3hNU0F3TGpZek5ERTROaUF3TGpJNE1qYzRNeUF3TGpZek5ERTROaUF3TGpJNU9EWTJNVU13TGpZek5ERTROaUF3TGpNeE5EVXpPU0F3TGpZeU1UTXhOQ0F3TGpNeU56UXhNU0F3TGpZd05UUXpOaUF3TGpNeU56UXhNVWd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56UXhNU0F3TGpNMk5UZzFNeUF3TGpNeE5EVXpPU0F3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNNU5EWXdNeUF3TGpZNU1UVTNPRU13TGpNM09EY3lOU0F3TGpZNU1UVTNPQ0F3TGpNMk5UZzFNeUF3TGpjd05EUTFJREF1TXpZMU9EVXpJREF1TnpJd016STRRekF1TXpZMU9EVXpJREF1TnpNMk1qQTJJREF1TXpjNE56STFJREF1TnpRNU1EYzRJREF1TXprME5qQXpJREF1TnpRNU1EYzRTREF1TlRjd01ERTVWakF1TmpreE5UYzRTREF1TXprME5qQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpNd01qRTRJREF1TmpFNU9URXhTREF1TmpBd01ERTVRekF1TlRnNU1qWXpJREF1TmpFNU9URXhJREF1TlRjNU9ESTVJREF1TmpJMU5UY3lJREF1TlRjME5UTXpJREF1TmpNME1EYzRTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1EYzRJREF1TXpZMU9EVXpJREF1TmpJeE1qQTJJREF1TXpZMU9EVXpJREF1TmpBMU16STRRekF1TXpZMU9EVXpJREF1TlRnNU5EVWdNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5TQXdMall6TkRFNE5pQXdMall3TlRNeU9FTXdMall6TkRFNE5pQXdMall4TURZMU1TQXdMall6TWpjMElEQXVOakUxTmpNMklEQXVOak13TWpFNElEQXVOakU1T1RFeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TlRFNUlEQXVOakU1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVM01EQXhPVll3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNVGs1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek0wTXpFZ01DNDJOVEF3TWpSRE1DNDJNVFV3TWpFZ01DNDJOVEF3TWpRZ01DNDJNREF3T1RnZ01DNDJOalExTnpVZ01DNDJNREF3T1RnZ01DNDJPREkxTWpSV01DNDRPVGt4T1RGRE1DNDJNREF3T1RnZ01DNDVNRFV4TnpRZ01DNDJNRFV3TnpJZ01DNDVNVEF3TWpRZ01DNDJNVEV5TURrZ01DNDVNVEF3TWpSSU1DNDJORFExTkRKV01DNDROVFU0TlRoRE1DNDJORFExTkRJZ01DNDRORGs0TnpVZ01DNDJORGsxTVRZZ01DNDRORFV3TWpRZ01DNDJOVFUyTlRNZ01DNDRORFV3TWpSSU1DNDNORFExTkRGRE1DNDNOVEEyTnpjZ01DNDRORFV3TWpRZ01DNDNOVFUyTlRJZ01DNDRORGs0TnpVZ01DNDNOVFUyTlRJZ01DNDROVFU0TlRoV01DNDVNVEF3TWpSSU1DNDNPRGc1T0RWRE1DNDNPVFV4TWpFZ01DNDVNVEF3TWpRZ01DNDRNREF3T1RZZ01DNDVNRFV4TnpRZ01DNDRNREF3T1RZZ01DNDRPVGt4T1RGV01DNDNPVEE0TlRoRE1DNDRNREF3T1RZZ01DNDNOekk1TURrZ01DNDNPRFV4TnpJZ01DNDNOVGd6TlRnZ01DNDNOalkzTmpNZ01DNDNOVGd6TlRoSU1DNDNOVFUyTlRKV01DNDJPREkxTWpSRE1DNDNOVFUyTlRJZ01DNDJOalExTnpVZ01DNDNOREEzTWpnZ01DNDJOVEF3TWpRZ01DNDNNakl6TVRrZ01DNDJOVEF3TWpSSU1DNDJNek0wTXpGYVRUQXVOalkyTnpZMElEQXVOekEwTVRreFF6QXVOalkyTnpZMElEQXVOekV3TVRjMElEQXVOall4TnpnNUlEQXVOekUxTURJMElEQXVOalUxTmpVeklEQXVOekUxTURJMFF6QXVOalE1TlRFMklEQXVOekUxTURJMElEQXVOalEwTlRReUlEQXVOekV3TVRjMElEQXVOalEwTlRReUlEQXVOekEwTVRreFF6QXVOalEwTlRReUlEQXVOams0TWpBNElEQXVOalE1TlRFMklEQXVOamt6TXpVNElEQXVOalUxTmpVeklEQXVOamt6TXpVNFF6QXVOall4TnpnNUlEQXVOamt6TXpVNElEQXVOalkyTnpZMElEQXVOams0TWpBNElEQXVOalkyTnpZMElEQXVOekEwTVRreFdrMHdMalkyTmpjMk5DQXdMamMxT0RNMU9FTXdMalkyTmpjMk5DQXdMamMyTkRNME1TQXdMalkyTVRjNE9TQXdMamMyT1RFNU1TQXdMalkxTlRZMU15QXdMamMyT1RFNU1VTXdMalkwT1RVeE5pQXdMamMyT1RFNU1TQXdMalkwTkRVME1pQXdMamMyTkRNME1TQXdMalkwTkRVME1pQXdMamMxT0RNMU9FTXdMalkwTkRVME1pQXdMamMxTWpNM05TQXdMalkwT1RVeE5pQXdMamMwTnpVeU5DQXdMalkxTlRZMU15QXdMamMwTnpVeU5FTXdMalkyTVRjNE9TQXdMamMwTnpVeU5DQXdMalkyTmpjMk5DQXdMamMxTWpNM05TQXdMalkyTmpjMk5DQXdMamMxT0RNMU9GcE5NQzQyTmpZM05qUWdNQzQ0TVRJMU1qUkRNQzQyTmpZM05qUWdNQzQ0TVRnMU1EZ2dNQzQyTmpFM09Ea2dNQzQ0TWpNek5UZ2dNQzQyTlRVMk5UTWdNQzQ0TWpNek5UaERNQzQyTkRrMU1UWWdNQzQ0TWpNek5UZ2dNQzQyTkRRMU5ESWdNQzQ0TVRnMU1EZ2dNQzQyTkRRMU5ESWdNQzQ0TVRJMU1qUkRNQzQyTkRRMU5ESWdNQzQ0TURZMU5ERWdNQzQyTkRrMU1UWWdNQzQ0TURFMk9URWdNQzQyTlRVMk5UTWdNQzQ0TURFMk9URkRNQzQyTmpFM09Ea2dNQzQ0TURFMk9URWdNQzQyTmpZM05qUWdNQzQ0TURZMU5ERWdNQzQyTmpZM05qUWdNQzQ0TVRJMU1qUmFUVEF1TnpFeE1qQTRJREF1TnpBME1Ua3hRekF1TnpFeE1qQTRJREF1TnpFd01UYzBJREF1TnpBMk1qTXpJREF1TnpFMU1ESTBJREF1TnpBd01EazNJREF1TnpFMU1ESTBRekF1Tmprek9UWWdNQzQzTVRVd01qUWdNQzQyT0RnNU9EWWdNQzQzTVRBeE56UWdNQzQyT0RnNU9EWWdNQzQzTURReE9URkRNQzQyT0RnNU9EWWdNQzQyT1RneU1EZ2dNQzQyT1RNNU5pQXdMalk1TXpNMU9DQXdMamN3TURBNU55QXdMalk1TXpNMU9FTXdMamN3TmpJek15QXdMalk1TXpNMU9DQXdMamN4TVRJd09DQXdMalk1T0RJd09DQXdMamN4TVRJd09DQXdMamN3TkRFNU1WcE5NQzQzTVRFeU1EZ2dNQzQzTlRnek5UaERNQzQzTVRFeU1EZ2dNQzQzTmpRek5ERWdNQzQzTURZeU16TWdNQzQzTmpreE9URWdNQzQzTURBd09UY2dNQzQzTmpreE9URkRNQzQyT1RNNU5pQXdMamMyT1RFNU1TQXdMalk0T0RrNE5pQXdMamMyTkRNME1TQXdMalk0T0RrNE5pQXdMamMxT0RNMU9FTXdMalk0T0RrNE5pQXdMamMxTWpNM05TQXdMalk1TXprMklEQXVOelEzTlRJMElEQXVOekF3TURrM0lEQXVOelEzTlRJMFF6QXVOekEyTWpNeklEQXVOelEzTlRJMElEQXVOekV4TWpBNElEQXVOelV5TXpjMUlEQXVOekV4TWpBNElEQXVOelU0TXpVNFdrMHdMamN4TVRJd09DQXdMamd4TWpVeU5FTXdMamN4TVRJd09DQXdMamd4T0RVd09DQXdMamN3TmpJek15QXdMamd5TXpNMU9DQXdMamN3TURBNU55QXdMamd5TXpNMU9FTXdMalk1TXprMklEQXVPREl6TXpVNElEQXVOamc0T1RnMklEQXVPREU0TlRBNElEQXVOamc0T1RnMklEQXVPREV5TlRJMFF6QXVOamc0T1RnMklEQXVPREEyTlRReElEQXVOamt6T1RZZ01DNDRNREUyT1RFZ01DNDNNREF3T1RjZ01DNDRNREUyT1RGRE1DNDNNRFl5TXpNZ01DNDRNREUyT1RFZ01DNDNNVEV5TURnZ01DNDRNRFkxTkRFZ01DNDNNVEV5TURnZ01DNDRNVEkxTWpSYVRUQXVOelUxTmpVeUlEQXVPREV5TlRJMFF6QXVOelUxTmpVeUlEQXVPREU0TlRBNElEQXVOelV3TmpjM0lEQXVPREl6TXpVNElEQXVOelEwTlRReElEQXVPREl6TXpVNFF6QXVOek00TkRBMElEQXVPREl6TXpVNElEQXVOek16TkRNZ01DNDRNVGcxTURnZ01DNDNNek0wTXlBd0xqZ3hNalV5TkVNd0xqY3pNelF6SURBdU9EQTJOVFF4SURBdU56TTROREEwSURBdU9EQXhOamt4SURBdU56UTBOVFF4SURBdU9EQXhOamt4UXpBdU56VXdOamMzSURBdU9EQXhOamt4SURBdU56VTFOalV5SURBdU9EQTJOVFF4SURBdU56VTFOalV5SURBdU9ERXlOVEkwV2swd0xqY3pNelF6SURBdU9URXdNREkwVmpBdU9EWTJOamt4U0RBdU56RXhNalkwVmpBdU9URXdNREkwU0RBdU56TXpORE5hVFRBdU5qZzVNRFF5SURBdU9URXdNREkwVmpBdU9EWTJOamt4U0RBdU5qWTJOelkwVmpBdU9URXdNREkwU0RBdU5qZzVNRFF5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9ZGE1OGY0NzMtMDk4My00YTM1LWFlZDgtZTlmYzBkNmY0ZGRlOyIgcGFyZW50PSIxOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMDguNSIgeT0iNDYuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjciIHZhbHVlPSJTSUVNIFRlYW0iIHN0eWxlPSJpci5yZWY9YjMzNTIwOGYtMmVjMy00NjZmLWFiNzYtNTFmOWRhNTkwNDA2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIxOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0Mi4wIiB5PSI0Ni4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTUzYmEyZDQ3LWNmMTctNGFiZC04NzM2LTQyMGJlODBlODY0Mztpci50YWdzPUFsZXJ0czsiIHBhcmVudD0iMSIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iVGhpcyBUaHJlYXQgTW9kZWwgY292ZXJzIGEgaG9zdGVkIGFwcGxpY2F0aW9uLCB0aGF0IGEgdXNlciBhY2Nlc3NlcyB2aWEuIGEgVUkuICZsdDticj4mbHQ7YnI+QSBTSUVNIHRlYW0gKG9uLXByZW1pc2UpIGlzIGFibGUgdG8gbW9uaXRvciB0aGUgaGVhbHRoIG9mIHRoZSBhcHBsaWNhdGlvbiB2aWEuIHRoZSBDbG91ZHdhdGNoIHNlcnZpY2UuIiBzdHlsZT0ic2hhcGU9bm90ZTtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE0O3NpemU9MjA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I2ZmZjJjYztzdHJva2VDb2xvcj0jZDZiNjU2O2ZvbnRDb2xvcj0jNjY2NjAwOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMjk4LjAiIHk9Ii0yLjAiIHdpZHRoPSIxOTMuMCIgaGVpZ2h0PSIxNjUuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVlBDIC0gQ3VzdG9tZXIgSW5zdGFuY2UiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNJalJUTkdRMFpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPRFU1TkNBd0xqWXlNRE5JTUM0eU9Ua3lOek5ETUM0eU1qWXlNRFlnTUM0Mk1qQXpJREF1TVRjd016UWdNQzQxTnpFMUlEQXVNVFkyTmpBMklEQXVOVEEwTkRNelF6QXVNVFkyTmpBMklEQXVOVEF4TmpNeklEQXVNVFkyTmpBMklEQXVORGs0TkRNeklEQXVNVFkyTmpBMklEQXVORGsxTWpNelF6QXVNVFkxTkRjeElEQXVORFkzTkRBNElEQXVNVGN6T0RBM0lEQXVORFF3TURJeElEQXVNVGt3TWpVeElEQXVOREUzTlRRMlF6QXVNakEyTmprMUlEQXVNemsxTURjeElEQXVNak13TWpjMklEQXVNemM0T0RNNUlEQXVNalUzTVRRZ01DNHpOekUxUXpBdU1qVTNNVFFnTUM0ek5qYzVJREF1TWpVM01UUWdNQzR6TmpRME16TWdNQzR5TlRjeE5DQXdMak0yTURnek0wTXdMakkxTnpneE1pQXdMak15TkRrek55QXdMakkyT1RBNU5DQXdMakk1TURBME5DQXdMakk0T1RVMk15QXdMakkyTURVME9VTXdMak14TURBek15QXdMakl6TVRBMU5DQXdMak16T0RjM05DQXdMakl3T0RJM055QXdMak0zTWpFMk5pQXdMakU1TlRBNE9VTXdMalF3TlRVMU9DQXdMakU0TVRrZ01DNDBOREl4TURZZ01DNHhOemc0T1NBd0xqUTNOekl3TmlBd0xqRTROalF6TjBNd0xqVXhNak13TmlBd0xqRTVNems0TkNBd0xqVTBORE00TnlBd0xqSXhNVGMxTVNBd0xqVTJPVFF3TmlBd0xqSXpOelZETUM0MU9EWTROVFVnTUM0eU5UUTNOeUF3TGpZd01UQXpPQ0F3TGpJM05UQTFNU0F3TGpZeE1USTNNeUF3TGpJNU56TTJOME13TGpZeU5Ua3dNaUF3TGpJNE5UWXhOQ0F3TGpZME5ERXdPQ0F3TGpJM09USXhOaUF3TGpZMk1qZzNNeUF3TGpJM09USXpNME13TGpjd01UVTBJREF1TWpjNU1qTXpJREF1TnpReU9EY3pJREF1TXpBMk9ETXpJREF1TnpRNU5qY3pJREF1TXpZNE0wTXdMamM0TWpVeklEQXVNemMwT0NBd0xqZ3hNakUzTXlBd0xqTTVNak0xSURBdU9ETXpOamN6SURBdU5ERTRNRE16VERBdU9ERXlOelFnTUM0ME16UTBNek5ETUM0M09USTNOelVnTUM0ME1URTFPVElnTUM0M05qVXlPVGNnTUM0ek9UWTJORGNnTUM0M016VXlOek1nTUM0ek9USXpRekF1TnpNeU1qY3pJREF1TXpreE9ERTVJREF1TnpJNU5USTJJREF1TXprd016STNJREF1TnpJM05Ea2dNQzR6T0Rnd056SkRNQzQzTWpVME5UTWdNQzR6T0RVNE1UY2dNQzQzTWpReU5EY2dNQzR6T0RJNU16UWdNQzQzTWpRd056TWdNQzR6TnprNVF6QXVOekl4TURBMklEQXVNekk0T0RNeklEQXVOamt4TVRRZ01DNHpNRFU1SURBdU5qWXlPRGN6SURBdU16QTFPVU13TGpZMU16azVOeUF3TGpNd05UazRNaUF3TGpZME5USTJJREF1TXpBNE1USWdNQzQyTXpjek5Ea2dNQzR6TVRJeE5EVkRNQzQyTWprME16Y2dNQzR6TVRZeE55QXdMall5TWpVMk5pQXdMak15TVRrM05DQXdMall4TnpJM015QXdMak15T1RGRE1DNDJNVFU0TkRFZ01DNHpNekV3TURrZ01DNDJNVE01TWpJZ01DNHpNekkwT1RrZ01DNDJNVEUzTVRjZ01DNHpNek0wTVRORE1DNDJNRGsxTVRNZ01DNHpNelF6TWpnZ01DNDJNRGN4TURNZ01DNHpNelEyTXpRZ01DNDJNRFEzTkNBd0xqTXpORE5ETUM0Mk1ESXpOallnTUM0ek16TTVNemNnTUM0Mk1EQXhNelVnTUM0ek16STVOREVnTUM0MU9UZ3lPREVnTUM0ek16RTBNVFpETUM0MU9UWTBNamNnTUM0ek1qazRPU0F3TGpVNU5UQXhPU0F3TGpNeU56ZzVNaUF3TGpVNU5ESXdOaUF3TGpNeU5UWXpNME13TGpVNE5UQTNPU0F3TGpJNU9UY3hOQ0F3TGpVM01ESTNNeUF3TGpJM05qRTJNaUF3TGpVMU1EZzNNeUF3TGpJMU5qZERNQzQxTWprMU56UWdNQzR5TXpRM09EY2dNQzQxTURJeU9EWWdNQzR5TVRrMk5ESWdNQzQwTnpJME1qSWdNQzR5TVRNeE5qTkRNQzQwTkRJMU5Ua2dNQzR5TURZMk9ETWdNQzQwTVRFME5EY2dNQzR5TURreE5UWWdNQzR6T0RJNU9ESWdNQzR5TWpBeU56RkRNQzR6TlRRMU1UY2dNQzR5TXpFek9EY2dNQzR6TWprNU5qTWdNQzR5TlRBMk5USWdNQzR6TVRJek9UTWdNQzR5TnpVMk5UUkRNQzR5T1RRNE1qUWdNQzR6TURBMk5UWWdNQzR5T0RVd01Ua2dNQzR6TXpBeU9EWWdNQzR5T0RReU1EWWdNQzR6TmpBNE16TkRNQzR5T0RReU1qVWdNQzR6TmpjeU1ETWdNQzR5T0RRMU9ERWdNQzR6TnpNMU5qZ2dNQzR5T0RVeU56TWdNQzR6TnprNVF6QXVNamcxTlRrMElEQXVNemd6TURneUlEQXVNamcwTnpZeElEQXVNemcyTWpjeklEQXVNamd5T1RJMUlEQXVNemc0T0RreVF6QXVNamd4TURrZ01DNHpPVEUxTVRFZ01DNHlOemd6TnpRZ01DNHpPVE16T0RNZ01DNHlOelV5TnpNZ01DNHpPVFF4TmpkRE1DNHlORFV3TURZZ01DNDBNREUyTXpNZ01DNHhPVE01TkNBd0xqUXlORGd6TXlBd0xqRTVNemswSURBdU5EazFNak16UXpBdU1Ua3pPREEySURBdU5EazNOak14SURBdU1Ua3pPREEySURBdU5UQXdNRE0xSURBdU1Ua3pPVFFnTUM0MU1ESTBNek5ETUM0eE9UWTROek1nTUM0MU5UVTNOamNnTUM0eU5ERTFOQ0F3TGpVNU16WXpNeUF3TGpNd01EWXdOaUF3TGpVNU16WXpNMGd3TGpRNE56STNNMHd3TGpRNE5UazBJREF1TmpJd00xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56STBOVEVnTUM0NE1UWTRNRFZETUM0MU1UUXpNVGdnTUM0NE1UWTRNRFVnTUM0MU1USTBOVEVnTUM0Mk16a3dOekVnTUM0MU1USTBOVEVnTUM0Mk16Y3pNemhXTUM0ME56VXdOekZETUM0MU1USTBORElnTUM0ME56SXpORGNnTUM0MU1UTXlOamdnTUM0ME5qazJPRFVnTUM0MU1UUTRNVGdnTUM0ME5qYzBORFZETUM0MU1UWXpOamNnTUM0ME5qVXlNRFFnTUM0MU1UZzFOallnTUM0ME5qTTBPVElnTUM0MU1qRXhNVGdnTUM0ME5qSTFNemhNTUM0Mk5qYzNPRFVnTUM0ME1EZ3lOekZETUM0Mk56QTRNRFFnTUM0ME1EY3lNRFFnTUM0Mk56UXdPVGdnTUM0ME1EY3lNRFFnTUM0Mk56Y3hNVGdnTUM0ME1EZ3lOekZNTUM0NE1qTTNPRFVnTUM0ME5qSTFNemhETUM0NE1qWXpNemNnTUM0ME5qTTBPVElnTUM0NE1qZzFNelVnTUM0ME5qVXlNRFFnTUM0NE16QXdPRFVnTUM0ME5qYzBORFZETUM0NE16RTJNelFnTUM0ME5qazJPRFVnTUM0NE16STBOaUF3TGpRM01qTTBOeUF3TGpnek1qUTFNU0F3TGpRM05UQTNNVll3TGpZME56TXpPRU13TGpnek1qUTFNU0F3TGpZME9UQTNNU0F3TGpnek1EVTROU0F3TGpneE5qZ3dOU0F3TGpZM01qUTFNU0F3TGpneE5qZ3dOVnBOTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZXTUM0Mk16Y3pNemhETUM0MU16a3hNVGdnTUM0Mk5ETTJNRFVnTUM0MU5EQTVPRFVnTUM0M09UQXhNemdnTUM0Mk56STBOVEVnTUM0M09UQXhNemhETUM0NE1ETTVNVGdnTUM0M09UQXhNemdnTUM0NE1EVTNPRFVnTUM0Mk5UTXlNRFVnTUM0NE1EVTNPRFVnTUM0Mk5EY3pNemhXTUM0ME9EUTBNRFZNTUM0Mk56STBOVEVnTUM0ME16UTVNemhNTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TkRNNUlEQXVOelkyT1RJMFF6QXVOVGczTmpNNUlEQXVOelkyT1RJMElEQXVOVFkyT0RNNUlEQXVOalU1TXpJMElEQXVOVFkxTnpjeklEQXVOalUwTnpreFF6QXVOVFkxTmpReElEQXVOalV6T1RrMklEQXVOVFkxTmpReElEQXVOalV6TVRnMUlEQXVOVFkxTnpjeklEQXVOalV5TXpreFZqQXVOVEUwTWpVNFF6QXVOVFkxTnpjZ01DNDFNVEUxT0RjZ01DNDFOalkxTmprZ01DNDFNRGc1TnpnZ01DNDFOamd3TmpjZ01DNDFNRFkzTmpkRE1DNDFOamsxTmpVZ01DNDFNRFExTlRZZ01DNDFOekUyT1RJZ01DNDFNREk0TkRZZ01DNDFOelF4TnpNZ01DNDFNREU0TlRoTU1DNDJOamMxTURZZ01DNDBOalV3TlRoRE1DNDJOekEyTnpRZ01DNDBOak0zT1RZZ01DNDJOelF5TURVZ01DNDBOak0zT1RZZ01DNDJOemN6TnpNZ01DNDBOalV3TlRoTU1DNDNOekEzTURZZ01DNDFNREU0TlRoRE1DNDNOek14T0RjZ01DNDFNREk0TkRZZ01DNDNOelV6TVRRZ01DNDFNRFExTlRZZ01DNDNOelk0TVRJZ01DNDFNRFkzTmpkRE1DNDNOemd6TURrZ01DNDFNRGc1TnpnZ01DNDNOemt4TURrZ01DNDFNVEUxT0RjZ01DNDNOemt4TURZZ01DNDFNVFF5TlRoV01DNDJOVEl6T1RGRE1DNDNOemt4TnpJZ01DNDJOVE14T1NBd0xqYzNPVEUzTWlBd0xqWTFNems1TWlBd0xqYzNPVEV3TmlBd0xqWTFORGM1TVVNd0xqYzNPREF6T1NBd0xqWTFPVE15TkNBd0xqYzFOekl6T1NBd0xqYzJOamt5TkNBd0xqWTNNalF6T1NBd0xqYzJOamt5TkZwTk1DNDFPVEkwTXprZ01DNDJOVEV3TlRoRE1DNDFPVFExTnpNZ01DNDJOakV4T1RFZ01DNDJNVE0yTXprZ01DNDNOREF5TlRnZ01DNDJOekkwTXprZ01DNDNOREF5TlRoRE1DNDNNekV5TXprZ01DNDNOREF5TlRnZ01DNDNOVEF6TURZZ01DNDJOakV6TWpRZ01DNDNOVEkwTXprZ01DNDJOVEV3TlRoV01DNDFNak16TWpSTU1DNDJOekkwTXprZ01DNDBPVEU0TlRoTU1DNDFPVEkwTXprZ01DNDFNak16TWpSV01DNDJOVEV3TlRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b20iIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZGZiMjYzMWYtZDk1OS00YTE5LWFjZTQtNjJmYjU1MmI2NzczO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE0MS4wIiB5PSIzNy4wIiB3aWR0aD0iMzQwLjAiIGhlaWdodD0iMzkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCIgaWQ9IjEwIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NjMwZjhkN2YtYWI1Mi00NGM5LTk4NzUtZWY5Yzk3OWNkNGU1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9ODQ7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVjMjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTJNamdnTUM0MU16azVOVGxJTUM0M016azVOakZXTUM0MU1UTXlPVE5JTUM0NE1EWTJNamhXTUM0eE9UTXlPVE5JTUM0ME9EWTJNamhXTUM0eU5UazVOVGxJTUM0ME5UazVOakZXTUM0eE9UTXlPVE5ETUM0ME5UazVOakVnTUM0eE9EWXlNaUF3TGpRMk1qYzNJREF1TVRjNU5ETTNJREF1TkRZM056Y3hJREF1TVRjME5ETTJRekF1TkRjeU56Y3lJREF1TVRZNU5ETTFJREF1TkRjNU5UVTFJREF1TVRZMk5qSTJJREF1TkRnMk5qSTRJREF1TVRZMk5qSTJTREF1T0RBMk5qSTRRekF1T0RFek55QXdMakUyTmpZeU5pQXdMamd5TURRNE15QXdMakUyT1RRek5TQXdMamd5TlRRNE5DQXdMakUzTkRRek5rTXdMamd6TURRNE5TQXdMakUzT1RRek55QXdMamd6TXpJNU5DQXdMakU0TmpJeUlEQXVPRE16TWprMElEQXVNVGt6TWprelZqQXVOVEV6TWprelF6QXVPRE16TWprMElEQXVOVEl3TXpZMUlEQXVPRE13TkRnMUlEQXVOVEkzTVRRNElEQXVPREkxTkRnMElEQXVOVE15TVRRNVF6QXVPREl3TkRneklEQXVOVE0zTVRVZ01DNDRNVE0zSURBdU5UTTVPVFU1SURBdU9EQTJOakk0SURBdU5UTTVPVFU1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV4TXpFM0lEQXVPRE16TWprMFNEQXVNVGt6TVRjeFF6QXVNVGcyTURrNElEQXVPRE16TWprMElEQXVNVGM1TXpFMUlEQXVPRE13TkRnMUlEQXVNVGMwTXpFMElEQXVPREkxTkRnMFF6QXVNVFk1TXpFeklEQXVPREl3TkRneklEQXVNVFkyTlRBMElEQXVPREV6TnlBd0xqRTJOalV3TkNBd0xqZ3dOall5TjFZd0xqUTROall5T0VNd0xqRTJOalV3TkNBd0xqUTNPVFUxTlNBd0xqRTJPVE14TXlBd0xqUTNNamMzTWlBd0xqRTNORE14TkNBd0xqUTJOemMzTVVNd0xqRTNPVE14TlNBd0xqUTJNamMzSURBdU1UZzJNRGs0SURBdU5EVTVPVFl4SURBdU1Ua3pNVGN4SURBdU5EVTVPVFl4U0RBdU1qVTVPRE0zVmpBdU5EZzJOakk0U0RBdU1Ua3pNVGN4VmpBdU9EQTJOakkzU0RBdU5URXpNVGRXTUM0M016azVOakZJTUM0MU16azRNelpXTUM0NE1EWTJNamRETUM0MU16azRNellnTUM0NE1UTTNJREF1TlRNM01ESTNJREF1T0RJd05EZ3pJREF1TlRNeU1ESTJJREF1T0RJMU5EZzBRekF1TlRJM01ESTFJREF1T0RNd05EZzFJREF1TlRJd01qUXlJREF1T0RNek1qazBJREF1TlRFek1UY2dNQzQ0TXpNeU9UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56RXpNamc1SURBdU16YzVPVFUxVmpBdU16VXpNamc0U0RBdU5qY3pNamc1UXpBdU5qY3lOelFnTUM0ek5EWXpPVGdnTUM0Mk5qazNOVFFnTUM0ek16azVNeUF3TGpZMk5EZzJOeUF3TGpNek5UQTBNME13TGpZMU9UazRJREF1TXpNd01UVTJJREF1TmpVek5URXlJREF1TXpJM01UY2dNQzQyTkRZMk1qSWdNQzR6TWpZMk1qRldNQzR5T0RZMk1qRklNQzQyTVRrNU5UVldNQzR6TWpZMk1qRklNQzQxTnprNU5UVldNQzR5T0RZMk1qRklNQzQxTlRNeU9EaFdNQzR6TWpZMk1qRklNQzQxTVRNeU9EaFdNQzR5T0RZMk1qRklNQzQwT0RZMk1qSldNQzR6TWpZMk1qRklNQzQwTkRZMk1qRldNQzR5T0RZMk1qRklNQzQwTVRrNU5UVldNQzR6TWpZMk1qRklNQzR6TnprNU5UVldNQzR5T0RZMk1qRklNQzR6TlRNeU9EaFdNQzR6TWpZMk1qRkRNQzR6TkRZek9UZ2dNQzR6TWpjeE55QXdMak16T1RreklEQXVNek13TVRVMklEQXVNek0xTURReklEQXVNek0xTURRelF6QXVNek13TVRVMklEQXVNek01T1RNZ01DNHpNamN4TnlBd0xqTTBOak01T0NBd0xqTXlOall5TVNBd0xqTTFNekk0T0Vnd0xqSTROall5TVZZd0xqTTNPVGsxTlVnd0xqTXlOall5TVZZd0xqUXhPVGsxTlVnd0xqSTROall5TVZZd0xqUTBOall5TVVnd0xqTXlOall5TVZZd0xqUTROall5TWtnd0xqSTROall5TVZZd0xqVXhNekk0T0Vnd0xqTXlOall5TVZZd0xqVTFNekk0T0Vnd0xqSTROall5TVZZd0xqVTNPVGsxTlVnd0xqTXlOall5TVZZd0xqWXhPVGsxTlVnd0xqSTROall5TVZZd0xqWTBOall5TWtnd0xqTXlOall5TVVNd0xqTXlOekUzSURBdU5qVXpOVEV4SURBdU16TXdNVFUySURBdU5qVTVPVGdnTUM0ek16VXdORE1nTUM0Mk5qUTROamRETUM0ek16azVNeUF3TGpZMk9UYzFOQ0F3TGpNME5qTTVPQ0F3TGpZM01qYzBJREF1TXpVek1qZzRJREF1Tmpjek1qZzVWakF1TnpFek1qZzVTREF1TXpjNU9UVTFWakF1Tmpjek1qZzVTREF1TkRFNU9UVTFWakF1TnpFek1qZzVTREF1TkRRMk5qSXhWakF1Tmpjek1qZzVTREF1TkRnMk5qSXlWakF1TnpFek1qZzVTREF1TlRFek1qZzRWakF1Tmpjek1qZzVTREF1TlRVek1qZzRWakF1TnpFek1qZzVTREF1TlRjNU9UVTFWakF1Tmpjek1qZzVTREF1TmpFNU9UVTFWakF1TnpFek1qZzVTREF1TmpRMk5qSXlWakF1Tmpjek1qZzVRekF1TmpVek5URXlJREF1TmpjeU56UWdNQzQyTlRrNU9DQXdMalkyT1RjMU5DQXdMalkyTkRnMk55QXdMalkyTkRnMk4wTXdMalkyT1RjMU5DQXdMalkxT1RrNElEQXVOamN5TnpRZ01DNDJOVE0xTVRFZ01DNDJOek15T0RrZ01DNDJORFkyTWpKSU1DNDNNVE15T0RsV01DNDJNVGs1TlRWSU1DNDJOek15T0RsV01DNDFOems1TlRWSU1DNDNNVE15T0RsV01DNDFOVE15T0RoSU1DNDJOek15T0RsV01DNDFNVE15T0RoSU1DNDNNVE15T0RsV01DNDBPRFkyTWpKSU1DNDJOek15T0RsV01DNDBORFkyTWpGSU1DNDNNVE15T0RsV01DNDBNVGs1TlRWSU1DNDJOek15T0RsV01DNHpOems1TlRWSU1DNDNNVE15T0RsYVRUQXVOalEyTmpJeUlEQXVOalEwTWpJeVF6QXVOalEyTmpJeUlEQXVOalEwT0RVNElEQXVOalEyTXpZNUlEQXVOalExTkRZNUlEQXVOalExT1RFNUlEQXVOalExT1RFNVF6QXVOalExTkRZNUlEQXVOalEyTXpZNUlEQXVOalEwT0RVNUlEQXVOalEyTmpJeUlEQXVOalEwTWpJeUlEQXVOalEyTmpJeVNEQXVNelUxTmpnNFF6QXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUwTkRReElEQXVOalEyTXpZNUlEQXVNelV6T1RreElEQXVOalExT1RFNVF6QXVNelV6TlRReElEQXVOalExTkRZNUlEQXVNelV6TWpnNElEQXVOalEwT0RVNElEQXVNelV6TWpnNElEQXVOalEwTWpJeVZqQXVNelUxTmpnNFF6QXVNelV6TWpnNElEQXVNelUxTURVeElEQXVNelV6TlRReElEQXVNelUwTkRReElEQXVNelV6T1RreElEQXVNelV6T1RreFF6QXVNelUwTkRReElEQXVNelV6TlRReElEQXVNelUxTURVeElEQXVNelV6TWpnNElEQXVNelUxTmpnNElEQXVNelV6TWpnNFNEQXVOalEwTWpJeVF6QXVOalEwT0RVNUlEQXVNelV6TWpnNElEQXVOalExTkRZNUlEQXVNelV6TlRReElEQXVOalExT1RFNUlEQXVNelV6T1RreFF6QXVOalEyTXpZNUlEQXVNelUwTkRReElEQXVOalEyTmpJeUlEQXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUxTmpnNFZqQXVOalEwTWpJeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1My4wIiB5PSI2NS4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="API - I/O -&gt; EC2 - Elastic Compute Cloud" ref="24090cb1-0cb6-455d-9d17-3c11ba708487" source="329646f1-38b8-4996-93e4-1e342f0bafb3" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="EC2 - Elastic Compute Cloud -&gt; PostgreSQL" ref="456ef3b4-d874-4be9-93d1-577b3df224c0" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="CloudWatch -&gt; Internal Logging Server" ref="53ba2d47-cf17-4abd-8736-420be80e8643" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d">
-      <assets/>
-      <tags>
-        <tag tag="Alerts"/>
-      </tags>
-    </dataflow>
-    <dataflow name="User - Web UI -&gt; AWS API Gateway" ref="be17d053-be74-4db1-95f4-02a7fba8663c" source="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" target="329646f1-38b8-4996-93e4-1e342f0bafb3">
-      <assets>
-        <asset name="Personally Identifiable Information"/>
-      </assets>
-      <tags>
-        <tag tag="Login Credentials"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Elasticsearch -&gt; Overflow / Cold Storage" ref="c0130149-5c31-4165-b6e2-22cc58339bdd" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="85488534-b4b9-4b7f-837b-1d895fd6a673">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="CloudWatch -&gt; EC2 - Elastic Compute Cloud" ref="ca9bb336-5f0b-4461-b156-16aeeec16146" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="EC2 - Elastic Compute Cloud -&gt; Elasticsearch" ref="d2b00bd0-3732-40f2-8948-2bd6093fc6dc" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="458aeca6-65f5-4791-a48c-3d18d76a02b5">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Elasticsearch -&gt; PostgreSQL" ref="e1351bee-27d2-46c7-bb89-6f292faf39f8" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Internal Logging Server -&gt; SIEM Team" ref="e312edcf-ecf1-4c73-8fb4-7dd95e8b06da" source="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" target="315742d3-3d9e-4a0c-909c-78f3885e8607">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="945c328f-b4db-4023-ac59-e5b71bd01a69" diagramComponentId="b335208f-2ec3-466f-ab76-51f9da590406" ref="315742d3-3d9e-4a0c-909c-78f3885e8607" name="SIEM Team" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                <countermeasure ref="CWE-327" mitigation="33"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f8a89be1-7b94-4500-ae4c-fc7fdb05ea4b" diagramComponentId="8670166e-dc36-4f52-bea6-4545e9992c88" ref="794c99e8-a31a-4592-93a6-618a207a7aaa" name="PostgreSQL" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6b0c61f2-8966-4122-b600-8ba5cf4e8602" diagramComponentId="9952204e-7e2c-440c-9505-54c1c1f55e81" ref="458aeca6-65f5-4791-a48c-3d18d76a02b5" name="Elasticsearch" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="elasticsearch">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.231">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.213">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.219">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.238">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.202">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-ELASTICSEARCH1" name="Control access to Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Control access to Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service offers several ways of controlling access to domains by supporting three types of access policies:&lt;br&gt; - Resource-based Policies&lt;br&gt; - Identity-based Policies&lt;br&gt; - IP-based Policies&lt;/p&gt; 
-&lt;p&gt;Fine-grained access control offers additional ways of controlling access to your data on Amazon Elasticsearch Service. For example, depending on who makes the request, you might want a search to return results from only one index. You might want to hide certain fields in your documents or exclude certain documents altogether. Fine-grained access control offers the following features:&lt;br&gt; - Role-based access control&lt;br&gt; - Security at the index, document, and field level&lt;br&gt; - Kibana multi-tenancy&lt;br&gt; - HTTP basic authentication for Elasticsearch and Kibana&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To configure access policies (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain that you want to update.&lt;/p&gt; 
-&lt;p&gt;4. Choose Actions and Modify access policy.&lt;/p&gt; 
-&lt;p&gt;5. Edit the access policy JSON, or use the dropdown list to choose a preconfigured option.&lt;/p&gt; 
-&lt;p&gt;6. Choose Submit.&lt;/p&gt; 
-&lt;p&gt;Enabling Fine-Grained Access Control&lt;/p&gt; 
-&lt;p&gt;Enable fine-grained access control using the console, AWS CLI, or configuration API. The console offers the simplest experience while creating a new domain.&lt;/p&gt; 
-&lt;p&gt;In the Fine-grained access control section, enable or disable fine-grained access control:&lt;/p&gt; 
-&lt;p&gt;- If you want to use IAM for user management, choose Set IAM role as master user and specify the ARN for an IAM role.&lt;/p&gt; 
-&lt;p&gt;- If you want to use the internal user database, choose Create a master user and specify a user name and password.&lt;/p&gt; 
-&lt;p&gt;Whichever option you choose, the master user can access all indices in the cluster and all Elasticsearch APIs.&lt;/p&gt; 
-&lt;p&gt;If you disable fine-grained access control, you can still control access to your domain by placing it within a VPC, applying a restrictive access policy, or both. You must enable node-to-node encryption and encryption at rest to use fine-grained access control.&lt;/p&gt; 
-&lt;p&gt;Here are the requirements for enabling fine-grained access control:&lt;/p&gt; 
-&lt;p&gt;- Elasticsearch 6.7 or later&lt;br&gt; - Encryption of data at rest and node-to-node encryption enabled&lt;br&gt; - Require HTTPS for all traffic to the domain enabled&lt;/p&gt; 
-&lt;p&gt;You can't enable fine-grained access control on existing domains, only new ones. After you enable fine-grained access control, you can't disable it.&lt;/p&gt; 
-&lt;p&gt;For more information and examples about different types of policies and access control, please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; If you enabled VPC access for your domain, you can't configure an IP-based policy. Instead, you can use security groups to control which IP addresses can access the domain.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Creating and Managing Amazon Elasticsearch Service Domains" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html"/>
-            <reference name="Identity and Access Management in Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH7" name="Create alerts for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Configure alerts in Amazon Elasticsearch Service (Amazon ES) to get notified when data from one or more Elasticsearch indices meets certain conditions. &lt;br&gt; For example, you might want to receive an email if your application logs more than five HTTP 503 errors in one hour, or you might want to page a developer if no new documents have been indexed in the last 20 minutes.&lt;br&gt; Alerting requires Elasticsearch version 6.2 or later.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To get started with alerting&lt;/p&gt; 
-&lt;p&gt;1. Choose Alerting from the Kibana main menu.&lt;/p&gt; 
-&lt;p&gt;2. Set up a destination for the alert. Choose between Slack, Amazon Chime, a custom webhook, or Amazon SNS. As you might imagine, notifications require connectivity to the destination. For example, your Amazon ES domain must be able to connect to the internet to notify a Slack channel or send a custom webhook to a third-party server.&lt;/p&gt; 
-&lt;p&gt;3. Create a monitor in one of three ways: visually, using a query, or using an anomaly detector.&lt;/p&gt; 
-&lt;p&gt;4. Define a condition to trigger the monitor.&lt;/p&gt; 
-&lt;p&gt;5. (Optional) Add one or more actions to the monitor.&lt;/p&gt; 
-&lt;p&gt;Tip&lt;br&gt; After an action successfully sends a message, secure access to that message. If your domain contains sensitive data, consider using triggers without actions and periodically checking Kibana for alerts.&lt;/p&gt; 
-&lt;p&gt;For further information and Recommended CloudWatch Alarms please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Alerting for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/alerting.html"/>
-            <reference name="Recommended CloudWatch Alarms" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/cloudwatch-alarms.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have created alerts for Amazon Elasticsearch.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH6" name="Enable all logs for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable all logs for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES exposes four Elasticsearch logs through Amazon CloudWatch Logs: error logs, search slow logs, index slow logs, and audit logs. Search slow logs, index slow logs, and error logs are useful for troubleshooting performance and stability issues. Audit logs track user activity for compliance purposes. &lt;br&gt; All the logs are disabled by default.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Log Publishing (Console)&lt;/p&gt; 
-&lt;p&gt;The Amazon ES console is the simplest way to enable the publishing of logs to CloudWatch.&lt;/p&gt; 
-&lt;p&gt;To enable log publishing to CloudWatch (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
-&lt;p&gt;4. On the Logs tab, choose Setup for the log you want.&lt;/p&gt; 
-&lt;p&gt;5. Create a CloudWatch log group, or choose an existing one.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; If you plan to enable multiple logs, AWS recommends publishing each to its own log group. This separation makes the logs easier to scan.&lt;/p&gt; 
-&lt;p&gt;6. Choose an access policy that contains the appropriate permissions, or create a policy using the JSON that the console provides:&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com" }, "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Resource": "cw_log_group_arn" } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Important&lt;br&gt; CloudWatch Logs supports 10 resource policies per Region. If you plan to enable logs for several Amazon ES domains, you should create and reuse a broader policy that includes multiple log groups to avoid reaching this limit.&lt;/p&gt; 
-&lt;p&gt;7. Choose Enable.&lt;/p&gt; 
-&lt;p&gt;Audit Log Kibana UI&lt;/p&gt; 
-&lt;p&gt;After you enable audit logs, configure them to match your needs.&lt;/p&gt; 
-&lt;p&gt;1. Open Kibana, and choose Security.&lt;/p&gt; 
-&lt;p&gt;2. Choose Audit logs.&lt;/p&gt; 
-&lt;p&gt;3. Choose Enable audit logging.&lt;/p&gt; 
-&lt;p&gt;The Kibana UI offers full control of audit log settings under General settings and Compliance settings.&lt;/p&gt; 
-&lt;p&gt;Setting Elasticsearch Logging Thresholds for Slow Logs&lt;/p&gt; 
-&lt;p&gt;After you enable the publishing of slow logs to CloudWatch, you still must specify logging thresholds for each Elasticsearch index. These thresholds define precisely what should be logged and at which log level.&lt;/p&gt; 
-&lt;p&gt;You specify these settings through the Elasticsearch REST API:&lt;/p&gt; 
-&lt;p&gt;PUT elasticsearch_domain_endpoint/index/_settings&lt;br&gt; { "index.search.slowlog.threshold.query.warn": "5s", "index.search.slowlog.threshold.query.info": "2s"&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; The status of your domain changes from Active to Processing. The status must return to Active before log publishing is enabled. This change typically takes 30 minutes, but can take longer depending on your domain configuration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Audit Logs for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/audit-logs.html"/>
-            <reference name="Configuring Elasticsearch Logs" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createdomain-configure-slow-logs.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Observe the logs&lt;/p&gt;
-
-	&lt;p&gt;1. Open the CloudWatch console.&lt;br /&gt;
-2. In the navigation pane, choose Log groups.&lt;br /&gt;
-3. Choose the log group that you specified while enabling logs. Within the log group, Amazon ES creates a log stream for each node in your domain.&lt;br /&gt;
-4. In Log streams, choose Search all.&lt;br /&gt;
-5. For the read and write events, see the corresponding logs. You can expect a delay of 5 seconds before the log appears.&lt;/p&gt;
-
-
-	&lt;p&gt;Testing slow logs&lt;/p&gt;
-
-	&lt;p&gt;To test that slow logs are publishing successfully, consider starting with very low values to verify that logs appear in CloudWatch, and then increase the thresholds to more useful levels.&lt;/p&gt;
-
-	&lt;p&gt;If the logs don't appear, check the following:&lt;/p&gt;
-
-	&lt;p&gt;- Does the CloudWatch log group exist? Check the CloudWatch console.&lt;/p&gt;
-
-	&lt;p&gt;- Does Amazon ES have permissions to write to the log group? Check the Amazon ES console.&lt;/p&gt;
-
-	&lt;p&gt;- Is the Amazon ES domain configured to publish to the log group? Check the Amazon ES console, use the AWS CLI describe-elasticsearch-domain-config option, or call DescribeElasticsearchDomainConfig using one of the SDKs.&lt;/p&gt;
-
-	&lt;p&gt;- Are the Elasticsearch logging thresholds low enough that your requests are exceeding them? To review your thresholds for an index, use the following command:&lt;/p&gt;
-
-	&lt;p&gt;GET elasticsearch_domain_endpoint/index/_settings?pretty&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH5" name="Enable dedicated master nodes for production Amazon Elasticsearch domains" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable dedicated master nodes for production Amazon Elasticsearch domains&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service uses dedicated master nodes to increase cluster stability. A dedicated master node performs cluster management tasks, but does not hold data or respond to data upload requests. AWS recommends that you add three dedicated master nodes to each production Amazon ES domain. Never choose an even number of dedicated master nodes.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; When creating and managing Amazon ES domains:&lt;/p&gt; 
-&lt;p&gt;- Enable dedicated master nodes. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. AWS recommends three dedicated master nodes for production domains.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; You can choose different instance types for your dedicated master nodes and data nodes. For example, you might select general purpose or storage-optimized instances for your data nodes, but compute-optimized instances for your dedicated master nodes.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Dedicated Master Nodes" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that dedicated master nodes option is enabled and three dedicated master nodes are used for each domain.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.818">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH4" name="Enable encryption of data at rest for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable encryption of data at rest for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES domains offer encryption of data at rest, a security feature that helps prevent unauthorized access to your data. The feature uses AWS Key Management Service (AWS KMS) to store and manage your encryption keys and the Advanced Encryption Standard algorithm with 256-bit keys (AES-256) to perform the encryption. If enabled, the feature encrypts the following aspects of a domain:&lt;/p&gt; 
-&lt;p&gt;- All indices (including those in UltraWarm storage)&lt;br&gt; - Elasticsearch logs&lt;br&gt; - Swap files&lt;br&gt; - All other data in the application directory&lt;br&gt; - Automated snapshots&lt;/p&gt; 
-&lt;p&gt;The following are not encrypted when you enable encryption of data at rest, but you can take additional steps to protect them:&lt;/p&gt; 
-&lt;p&gt;- Manual snapshots: You currently can't use KMS master keys to encrypt manual snapshots. You can, however, use server-side encryption with S3-managed keys or customer master keys (CMKs) to encrypt the bucket you use as a snapshot repository.&lt;br&gt; - Slow logs and error logs: If you publish logs and want to encrypt them, you can encrypt their CloudWatch Logs log group using the same AWS KMS master key as the Amazon ES domain.&lt;/p&gt; 
-&lt;p&gt;Amazon ES supports only symmetric customer master keys, not asymmetric ones.&lt;/p&gt; 
-&lt;p&gt;Regardless of whether encryption at rest is enabled, all domains automatically encrypt custom packages using AES-256 and Amazon ES-managed keys.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Encryption of Data at Rest&lt;/p&gt; 
-&lt;p&gt;Encryption of data at rest on new domains requires Elasticsearch 5.1 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
-&lt;p&gt;To use the Amazon ES console to configure encryption of data at rest, you must have read permissions to AWS KMS, such as the following identity-based policy:&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:List*", "kms:Describe*" ], "Resource": "*" } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;If you want to use a master key other than (Default) aws/es, you must also have permissions to create grants for the key. These permissions typically take the form of a resource-based policy that you specify when you create the key.&lt;/p&gt; 
-&lt;p&gt;If you want to keep your key exclusive to Amazon ES, you can add the kms:ViaService condition to that key policy:&lt;/p&gt; 
-&lt;p&gt;"Condition": { "StringEquals": { "kms:ViaService": "es.us-west-1.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Warning&lt;br&gt; If you delete the key that you used to encrypt a domain, the domain becomes inaccessible. The Amazon ES team can't help you recover your data. AWS KMS deletes master keys only after a waiting period of at least seven days, so the Amazon ES team might contact you if they detect that your domain is at risk.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; - Automatic key rotation preserves the properties of your AWS KMS master keys, so the rotation has no effect on your ability to access your Elasticsearch data. Encrypted Amazon ES domains don't support manual key rotation, which involves creating a new master key and updating any references to the old key. &lt;br&gt; - Certain instance types don't support encryption of data at rest.&lt;br&gt; - Domains that encrypt data at rest use a different repository name for their automated snapshots.&lt;br&gt; - Encrypting an Amazon ES domain requires a grant, and each encryption key has a limit of 500 grants per principal. This limit means that the maximum number of Amazon ES domains that you can encrypt using a single key is 500. Currently, Amazon ES supports a maximum of 100 domains per account (per Region), so this grant limit is of no consequence. If the domain limit per account increases, however, the grant limit might become relevant.&lt;br&gt; If you need to encrypt more than 500 domains at that time, you can create additional keys. Keys are regional, not global, so if you operate in more than one AWS Region, you already need multiple keys.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Encryption of Data at Rest for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To ensure that encryption of data at rest for Amazon Elasticsearch is enabled (from console):&lt;/p&gt;
-
-	&lt;p&gt;1. Sign In to the Console.&lt;br /&gt;
-2. Go to Amazon Elasticsearch dashboard.&lt;br /&gt;
-3. Ensure that Encryption at rest is set to Enabled on the selected domain&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH9" name="Enable Node-to-node Encryption for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Node-to-node Encryption for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES.&lt;/p&gt; 
-&lt;p&gt;Each Amazon ES domain-regardless of whether the domain uses VPC access-resides within its own, dedicated VPC. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure. By default, however, traffic within the VPC is unencrypted. Node-to-node encryption enables TLS 1.2 encryption for all communications within the VPC.&lt;/p&gt; 
-&lt;p&gt;If you send data to Amazon ES over HTTPS, node-to-node encryption helps ensure that your data remains encrypted as Elasticsearch distributes (and redistributes) it throughout the cluster. If data arrives unencrypted over HTTP, Amazon ES encrypts it after it reaches the cluster. You can require that all traffic to the domain arrive over HTTPS using the console, AWS CLI, or configuration API.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Node-to-node Encryption&lt;/p&gt; 
-&lt;p&gt;Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
-&lt;p&gt;Alternatively, you can use the AWS CLI or configuration API.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; After you configure a domain to use node-to-node encryption, you can't disable the setting. Instead, you can take a manual snapshot of the encrypted domain, create another domain, migrate your data, and delete the old domain.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Node-to-node Encryption for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Node-to-node Encryption for Amazon Elasticsearch is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.855">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH8" name="Set up Anomaly Detection for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Set up Anomaly Detection for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Anomaly detection in Amazon Elasticsearch Service (Amazon ES) automatically detects anomalies in your Elasticsearch data in near-real time by using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream. The algorithm computes an anomaly grade and confidence score value for each incoming data point. Anomaly detection uses these values to differentiate an anomaly from normal variations in your data.&lt;br&gt; You can pair the anomaly detection plugin with the Alerting for Amazon Elasticsearch Service plugin to notify you as soon as an anomaly is detected.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Anomaly detection requires Elasticsearch 7.4 or later. All instance types support anomaly detection except for t2.micro and t2.small.&lt;/p&gt; 
-&lt;p&gt;Getting Started with Anomaly Detection&lt;/p&gt; 
-&lt;p&gt;To get started, choose Anomaly Detection in Kibana.&lt;/p&gt; 
-&lt;p&gt;Step 1: Create a Detector&lt;/p&gt; 
-&lt;p&gt;A detector is an individual anomaly detection task. You can create multiple detectors, and all the detectors can run simultaneously, with each analyzing data from different sources.&lt;/p&gt; 
-&lt;p&gt;Step 2: Add Features to Your Detector&lt;/p&gt; 
-&lt;p&gt;A feature is the field in your index that you check for anomalies. A detector can discover anomalies across one or more features. You must choose one of the following aggregations for each feature: average(), sum(), count(), min(), or max().&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; The count() aggregation method is only available in Elasticsearch version 7.7 and later. For version 7.4, use a custom expression like the following:&lt;/p&gt; 
-&lt;p&gt;{ "aggregation_name": { "value_count": { "field": "field_name" } }&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;The aggregation method determines what constitutes an anomaly. For example, if you choose min(), the detector focuses on finding anomalies based on the minimum values of your feature. If you choose average(), the detector finds anomalies based on the average values of your feature. You can add a maximum of five features per detector.&lt;/p&gt; 
-&lt;p&gt;You can configure the following optional settings (available in 7.7 and later):&lt;/p&gt; 
-&lt;p&gt;- Category field - Categorize or slice your data with a dimension like IP address, product ID, country code, and so on.&lt;/p&gt; 
-&lt;p&gt;- Window size - Set the number of aggregation intervals from your data stream to consider in a detection window.&lt;/p&gt; 
-&lt;p&gt;After you set up your features, preview sample anomalies and adjust the feature settings if necessary.&lt;/p&gt; 
-&lt;p&gt;Step 3: Observe the Results&lt;/p&gt; 
-&lt;p&gt;- Live anomalies - displays the live anomaly results for the last 60 intervals. For example, if the interval is set to 10, it shows the results for the last 600 minutes. This chart refreshes every 30 seconds.&lt;/p&gt; 
-&lt;p&gt;- Anomaly history - plots the anomaly grade with the corresponding measure of confidence.&lt;/p&gt; 
-&lt;p&gt;- Feature breakdown - plots the features based on the aggregation method. You can vary the date-time range of the detector.&lt;/p&gt; 
-&lt;p&gt;- Anomaly occurrence - shows the Start time, End time, Data confidence, and Anomaly grade for each anomaly detected.&lt;/p&gt; 
-&lt;p&gt;If you set the category field, you see an additional Heat map chart that correlates results for anomalous entities. Choose a filled rectangle to see a more detailed view of the anomaly.&lt;/p&gt; 
-&lt;p&gt;Step 4: Set Up Alerts&lt;br&gt; To create a monitor to send you notifications when any anomalies are detected, choose Set up alerts. The plugin redirects you to the Add monitor page where you can configure an alert.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Anomaly Detection for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ad.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Anomaly Detection for Amazon Elasticsearch has been properly configured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.846">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH3" name="Update Service Software for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Update Service Software for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES regularly releases system software updates that add features or otherwise improve your domains.&lt;br&gt; The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge.&lt;br&gt; Each notification includes details about the service software update. The notification severity is Informational if the update is optional and High if it's required. Consider the following when deciding whether to update your domain:&lt;br&gt; - If you take no action on required updates, Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation, Amazon ES sends notifications when it starts the update and when the update is complete.&lt;br&gt; - If you start an update manually, Amazon ES doesn't send a notification when it starts the update, only when the update is complete.&lt;br&gt; Manually updating your domain lets you take advantage of new features more quickly.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Service software updates differ from Elasticsearch version upgrades.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To request a service software update (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
-&lt;p&gt;4. For Service software release, follow the documentation link to compare your current version to the latest version. Then choose Update.&lt;/p&gt; 
-&lt;p&gt;To request a service software update (AWS CLI and AWS SDKs)&lt;/p&gt; 
-&lt;p&gt;You can use the following commands to see if an update is available, check upgrade eligibility, and request an update:&lt;/p&gt; 
-&lt;p&gt;describe-elasticsearch-domain (DescribeElasticsearchDomain)&lt;/p&gt; 
-&lt;p&gt;start-elasticsearch-service-software-update (StartElasticsearchServiceSoftwareUpdate)&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Consider starting the update at a low traffic time.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Service Software Updates" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Service Software for Amazon Elasticsearch has been updated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH2" name="Upgrade Amazon Elasticsearch to the latest version" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Upgrade Amazon Elasticsearch to the latest version&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; To get the new Elasticsearch features, bug fixes and security updates, upgrade Elasticsearch to the latest version.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Elasticsearch version upgrades differ from service software updates.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The upgrade process consists of three steps:&lt;/p&gt; 
-&lt;p&gt;1. Pre-upgrade checks - Amazon ES performs a series of checks for issues that can block an upgrade and doesn't proceed to the next step unless these checks succeed.&lt;/p&gt; 
-&lt;p&gt;2. Snapshot - Amazon ES takes a snapshot of the Elasticsearch cluster and doesn't proceed to the next step unless the snapshot succeeds. If the upgrade fails, Amazon ES uses this snapshot to restore the cluster to its original state.&lt;/p&gt; 
-&lt;p&gt;3. Upgrade - Amazon ES starts the upgrade, which can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;/p&gt; 
-&lt;p&gt;Starting an Upgrade&lt;/p&gt; 
-&lt;p&gt;The upgrade process is irreversible and can't be paused or canceled. During an upgrade, you can't make configuration changes to the domain. Before starting an upgrade, double-check that you want to proceed. You can use these same steps to perform the pre-upgrade check without actually starting an upgrade.&lt;/p&gt; 
-&lt;p&gt;If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;/p&gt; 
-&lt;p&gt;To upgrade a domain to a later version of Elasticsearch (console)&lt;/p&gt; 
-&lt;p&gt;1. Take a manual snapshot of your domain. This snapshot serves as a backup that you can restore on a new domain if you want to return to using the prior Elasticsearch version.&lt;/p&gt; 
-&lt;p&gt;2. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;3. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;4. In the navigation pane, under My domains, choose the domain that you want to upgrade.&lt;/p&gt; 
-&lt;p&gt;5. Choose Actions and Upgrade domain.&lt;/p&gt; 
-&lt;p&gt;6. For Operation, choose Upgrade, Submit, and Continue.&lt;/p&gt; 
-&lt;p&gt;7. Return to the Overview tab and choose Upgrade status to monitor the state of the upgrade.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;br&gt; Upgrade can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;br&gt; Amazon ES offers in-place Elasticsearch upgrades for domains that run versions 5.1 and later. If you use services like Amazon Kinesis Data Firehose or Amazon CloudWatch Logs to stream data to Amazon ES, check that these services support the newer version of Elasticsearch before migrating.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Upgrading Elasticsearch" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use the following operation to identify the right Elasticsearch version for your domain:&lt;/p&gt;
-
-	&lt;p&gt;get-compatible-elasticsearch-versions (GetCompatibleElasticsearchVersions)&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.789">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
-                <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
-                <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
-                <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-5.1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="c799276d-dd32-409a-9153-fa3453715d65" diagramComponentId="da58f473-0983-4a35-aed8-e9fc0d6f4dde" ref="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" name="Internal Logging Server" desc="" library="" parentComponentRef="" componentDefinitionRef="internal-server">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
-          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
-                        to known security issues. These issues could be used by an attacker to gain access to the
-                        system.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.510">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Vendors and other maintainers of software release patches in response to security flaws and
-                        other bugs in their products.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
-                        failures or exploitation.&lt;/li&gt;
-                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
-                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
-                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
-                        the flaw.&lt;/li&gt;
-                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
-                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
-                            security and other patches.&lt;/li&gt;
-                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
-                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
-                            taking into account the associated risk.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
- &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
- &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
-&lt;/ul&gt; </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:43.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
-          <threats>
-            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers compromise the server that hosts the service or data, then the data and
-                                the service itself could be at risk of compromise. The server could be compromised
-                                through any of the services that it exposes.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="UNNECESSARY-SERVICES">
-                  <countermeasures>
-                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNPATCHED-SERVER">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="9cce7724-8f70-4ccd-a332-aad82e968eb0" diagramComponentId="351ce93a-53cd-41e7-b6fd-a7effc997ac3" ref="329646f1-38b8-4996-93e4-1e342f0bafb3" name="API - I/O" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.747">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of a command using
-                    externally-influenced input from an upstream component, but it does not
-                    neutralize or incorrectly neutralizes special elements that could modify the
-                    intended command when it is sent to a downstream
-                    component.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:50.102">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:49.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-12-10T16:38:53.139">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Choose a minimum TLS version for a custom domain in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create a custom domain, you specify the security policy for it. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:38:45.299">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control and manage access to a REST API in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use the following mechanisms for authentication and authorization: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. IAM tags can be used together with IAM policies to control access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-18T15:20:51.952">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for API endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:49:02.306">
-              <output/>
-            </source>
-            <references>
-              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:29:43.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:47:51.718">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a REST API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Do one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create an API and deploy it to a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Logs/Tracing in the Stage Editor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable execution logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable CloudWatch Logs under CloudWatch Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Error or Info from the dropdown menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If desired, choose Enable Detailed CloudWatch Metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable access logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable Access Logging under Custom Access Logging. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable execution logging and access logging independent of each other. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test your logging setup&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:45:18.275">
-              <output/>
-            </source>
-            <references>
-              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
-              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Monitor REST API execution with Amazon CloudWatch metrics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can access CloudWatch using any of the following methods: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon CloudWatch console 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS CLI&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  CloudWatch API 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose the name of the API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Under the selected API, choose Dashboard. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Use From and To to enter the date range. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:46:32.717">
-              <output/>
-            </source>
-            <references>
-              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable payload compression by using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API or create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Another way is to use AWS CLI to create a new API and enable compression. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose a REST API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. In the Resources pane, choose the method you want to test. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For additional options you may need to specify, contact the API owner. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Choose Test. The following information will be displayed: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
-   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
-   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
-   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
-   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
-   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:33:00.030">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If you choose to enable caching for a REST API, you can enable cache encryption. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To configure API caching for individual methods using the console: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Go to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stages list for the API, expand the stage and choose a method in the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Override for this method in Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:28:19.444">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable request validation in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test basic request validation using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following steps describe how to test basic request validation in the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test the request validation on a method using TestInvoke in the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  While signed in to the API Gateway console, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Resources for the API that you've configured a request validators map for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a method for which you have enabled the request validation with a specified request validator. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Method Execution, in the Client box, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Invalid request body" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the request parameters aren't valid, the following error message returns: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:41:53.285">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content-Type: application/json 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: apigateway.us-east-1.amazonaws.com 
-&lt;/div&gt; 
-&lt;div&gt;
-  X-Amz-Date: 20170603T200400Z 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authorization: AWS4-HMAC-SHA256 Credential=... 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "patchOperations" : [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; } 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; ] 
-&lt;/div&gt; 
-&lt;div&gt;
-  }&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of update-stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to remove the old certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of delete-client-certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate in the console for a previously deployed API, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the main navigation pane, choose Client Certificates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Client Certificates pane, choose Generate Client Certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the API for which you want to use the client certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages under the selected API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To save the settings, choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need to redeploy the API for the changes to take effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:31:36.166">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up a stage for a REST API 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a new stage 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the APIs navigation pane, choose Stages under an API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Stages navigation pane, choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Optionally, enter a stage description for Stage description. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To see your Stages follow the steps below: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the APIs pane, choose the API, and then choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the Stages pane, choose the name of the stage. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:34:49.306">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To get started with AWS Secrets Manager: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identify your secrets and locate where they are used in your applications. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update your applications to retrieve secrets from Secrets Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.983">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:20:17.914">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can do this by: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
-  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:18:21.424">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose an API method. In Client, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. From Client Certificate, choose Test to invoke the method request. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:30:05.704">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-77">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f52df292-c406-4958-b0d0-14657076bd42" diagramComponentId="630f8d7f-ab52-44c9-9875-ef9c979cd4e5" ref="f4049c60-9be6-471e-8885-753b7ce5c14d" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="ec2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
-          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:38:28.834">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.070">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:54:10.678">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:34:35.371">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
-                        To avoid this, access to the network must be as restricted as possible, so that only the
-                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
-  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 allocate-address --domain vpc 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
-            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
-          </references>
-          <standards>
-            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:31:03.095">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:44:34.594">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon Unified CLI: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
-          </references>
-          <standards>
-            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:30:24.393">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    A list of approved AMIs must be maintained by the organization. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:46:26.599">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
-  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:57:31.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:40:33.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:37:32.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface:: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:46:34.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each NAT gateway is created in a specific Availability Zone and implemented with 
-  redundancy in that zone. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   and/or 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
-            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:34:03.576">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
-  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
-  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
-  are engineered to be isolated from failures in other Availability Zones. By launching 
-  instances in separate Availability Zones, you can protect your applications from the failure 
-  of a single location. AWS assigns a unique ID to each subnet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
-  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
-  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
-  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
-  Some AWS regions have more than 2 availability zones and it is recommended to use more 
-  than 2 where possible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:27:41.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The port for these inbound rules would depend on the Database engine used and the 
-  configured port. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The default values are: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
-  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
-  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:04:42.704">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When we create a default VPC, AWS does the following to set it up: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
-  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
-  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-  Label this Default VPC "Do Not Use". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
-  set a label to remind others not to use it. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
-            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
-            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
-            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
-          </references>
-          <standards>
-            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:52:45.279">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Copy snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
-            <reference name="Create snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
-            <reference name="Create volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
-            <reference name="Delete volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
-            <reference name="Describe volumes" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
-            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T17:12:03.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
-                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
-                        every 90 days (or immediately if security patches become available) to avoid undue exposure
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;For linux instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
-                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:49:36.275">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
-            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
-            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
-          </references>
-          <standards>
-            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:17:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:10:24.664">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:00:55.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
-                        (ingress/egress) on the default security group in order to force the use of least privilege via
-                        custom created security groups.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
-                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
-                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
-                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the default security group.&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
-                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Default Value&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt;
-   The prescribed value is the default value. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
-            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
-            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
-          </references>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-images --owners self --filters 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    ImageId:ImageId, Public:Public}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T12:25:04.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:14:01.280">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.436">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.451">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.460">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.475">
-              <output/>
-            </source>
-            <references>
-              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        ALL TCP or ALL ports to avoid undue server exposure.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt; 
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 22</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 3389</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="VOLUMES-NOT-ENCRYPTED">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-02">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-03">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="150e5fa6-078f-47ac-98b8-939d88a61936" diagramComponentId="d077f2ce-8f51-4eed-b9e8-29c33c1c901e" ref="85488534-b4b9-4b7f-837b-1d895fd6a673" name="Overflow / Cold Storage" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
-          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
-                        for an MFA.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T13:16:12.065">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.595">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.792">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
-            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
-            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
-          </references>
-          <standards>
-            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
-                            then your bucket has no versioning enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.388">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.402">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
-&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
-&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt; 
-</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
-            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
-&lt;/div&gt; 
-&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
-            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T15:40:07.036">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
- &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
- &lt;/ul&gt; If data in transit is kept unencrypted: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
- &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Version":"2012-10-17", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Id":"PutObjPolicy", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Statement":{ 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Effect":"Deny", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Principal":"*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Action":"s3:PutObject", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Condition":{ 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;} 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;} 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
-            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
-            <reference name="Using Server-side Encryption" url="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api list-buckets --output table
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            ...
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;{
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Effect": "Deny",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Principal": "*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Action": "s3:PutObject",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Condition": {
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T11:46:08.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
-  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
-  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
-  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
-  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
-  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;br&gt; 
-&lt;br&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
-            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
-            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
-            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
-                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            ./prowler -c extra73
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T14:10:10.879">
-              <output/>
-            </source>
-            <references>
-              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; {&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; "Statement":[&lt;/i&gt; 
-   &lt;i&gt;{&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Condition":{&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;div&gt; 
-       &lt;i&gt;"Bool":&lt;/i&gt; 
-      &lt;/div&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;}&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;i&gt;}&lt;/i&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; }&lt;/i&gt; 
-     &lt;i&gt;]&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt;} &lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
-                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
-                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.943">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.957">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br /&gt; 
-&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br /&gt; 
-&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
-&lt;br /&gt;Remediation 
-&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
-                            has no MFA delete enabled.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="393453ad-c739-44c3-a9b8-2a9f46195d08" diagramComponentId="12c72ec7-9b87-436e-b190-69f05654a0af" ref="8bf78537-3cdd-4c79-88be-e341adba0b30" name="CloudWatch" desc="" library="" parentComponentRef="" componentDefinitionRef="cloudwatch">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.027">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.042">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-CLOUDWATCH7" name="Connect to CloudWatch using Interface VPC Endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Connect to CloudWatch using Interface VPC Endpoints&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; If you use Amazon Virtual Private Cloud (Amazon VPC) to host your AWS resources, you can establish a private connection between your VPC, CloudWatch, and CloudWatch Synthetics. You can use these connections to enable CloudWatch and CloudWatch Synthetics to communicate with your resources on your VPC without going through the public internet.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Creating a VPC Endpoint for CloudWatch&lt;/p&gt; 
-&lt;p&gt;To start using CloudWatch with your VPC, create an interface VPC endpoint for CloudWatch. The service name to choose is com.amazonaws.region.monitoring.&lt;/p&gt; 
-&lt;p&gt;You do not need to change the settings for CloudWatch. CloudWatch calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch, and you already have metrics flowing to CloudWatch from resources located on your VPC, these metrics begin flowing through the interface VPC endpoint by default.&lt;/p&gt; 
-&lt;p&gt;Controlling Access to Your CloudWatch VPC Endpoint&lt;/p&gt; 
-&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, Amazon VPC attaches a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
-&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
-&lt;p&gt;To edit the VPC endpoint policy for CloudWatch&lt;/p&gt; 
-&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
-&lt;p&gt;3. If you have not already created the endpoint for CloudWatch, choose Create Endpoint. Select com.amazonaws.region.monitoring, and then choose Create endpoint.&lt;/p&gt; 
-&lt;p&gt;4. Select the com.amazonaws.region.monitoring endpoint, and then choose the Policy tab.&lt;/p&gt; 
-&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
-&lt;p&gt;Creating a VPC Endpoint for CloudWatch Synthetics&lt;/p&gt; 
-&lt;p&gt;To start using CloudWatch Synthetics with your VPC, create an interface VPC endpoint for CloudWatch Synthetics. The service name to choose is com.amazonaws.region.synthetics. For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.&lt;/p&gt; 
-&lt;p&gt;You do not need to change the settings for CloudWatch Synthetics. CloudWatch Synthetics communicates with other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch Synthetics, and you already have an interface endpoint for Amazon S3, CloudWatch Synthetics begins communicating with Amazon S3 through the interface VPC endpoint by default.&lt;/p&gt; 
-&lt;p&gt;Controlling Access to Your CloudWatch Synthetics VPC Endpoint&lt;/p&gt; 
-&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, we attach a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
-&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
-&lt;p&gt;To edit the VPC endpoint policy for CloudWatch Synthetics&lt;/p&gt; 
-&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
-&lt;p&gt;3. If you have not already created the endpoint for CloudWatch Synthetics, choose Create Endpoint. Select com.amazonaws.region.synthetics and then choose Create endpoint.&lt;/p&gt; 
-&lt;p&gt;4. Select the com.amazonaws.region.synthetics endpoint and then choose the Policy tab.&lt;/p&gt; 
-&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
-&lt;p&gt;The following are the general steps for setting up an interface endpoint:&lt;/p&gt; 
-&lt;p&gt;1. Choose the VPC in which to create the interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service to which you're connecting.&lt;/p&gt; 
-&lt;p&gt;2. Choose a subnet in your VPC to use the interface endpoint. We create an endpoint network interface in the subnet. You can specify more than one subnet in different Availability Zones (as supported by the service) to help ensure that your interface endpoint is resilient to Availability Zone failures. In that case, we create an endpoint network interface in each subnet that you specify.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; An endpoint network interface is a requester-managed network interface. You can view it in your account, but you cannot manage it yourself. For more information, see Elastic Network Interfaces.&lt;/p&gt; 
-&lt;p&gt;3. Specify the security groups to associate with the endpoint network interface. The security group rules control the traffic to the endpoint network interface from resources in your VPC. If you do not specify a security group, we associate the default security group for the VPC.&lt;/p&gt; 
-&lt;p&gt;4. (Optional, AWS services and AWS Marketplace Partner services only) Enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.&lt;/p&gt; 
-&lt;p&gt;Important&lt;br&gt; Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.&lt;/p&gt; 
-&lt;p&gt;Private DNS is enabled in the other subnets which are in the same VPC and Availability Zone or Local Zone.&lt;/p&gt; 
-&lt;p&gt;5. When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.&lt;/p&gt; 
-&lt;p&gt;6. After you create the interface endpoint, it's available to use when it's accepted by the service provider. The service provider must configure the service to accept requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using CloudWatch and CloudWatch Synthetics with Interface VPC Endpoints" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Viewing your interface endpoint&lt;br /&gt;
-After you've created an interface endpoint, you can view information about it using the Console or the Command line.&lt;/p&gt;
-
-	&lt;p&gt;To view information about an interface endpoint using the console:&lt;/p&gt;
-
-	&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Endpoints and select your interface endpoint.&lt;/p&gt;
-
-	&lt;p&gt;3. To view information about the interface endpoint, choose Details. The DNS Names field displays the DNS names to use to access the service.&lt;/p&gt;
-
-	&lt;p&gt;4. To view the subnets in which the interface endpoint has been created, and the ID of the endpoint network interface in each subnet, choose Subnets.&lt;/p&gt;
-
-	&lt;p&gt;5. To view the security groups that are associated with the endpoint network interface, choose Security Groups.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH1" name="Control access to Amazon CloudWatch resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Control access to Amazon CloudWatch resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles), and some services (such as AWS Lambda) also support attaching permissions policies to resources.&lt;br&gt; Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. CloudWatch supports only identity-based policies.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following shows an example of a permissions policy.&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", &lt;a&gt;Statement&lt;/a&gt; &lt;a&gt;Effect&lt;/a&gt;"Allow", &lt;a&gt;Action&lt;/a&gt;"cloudwatch:GetMetricStatistics","cloudwatch:ListMetrics"], &lt;a&gt;Resource&lt;/a&gt;"*", &lt;a&gt;Condition&lt;/a&gt; &lt;a&gt;Bool&lt;/a&gt; &lt;a&gt;aws:SecureTransport&lt;/a&gt;"true" } } } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;This sample policy has one statement that grants permissions to a group for two CloudWatch actions (cloudwatch:GetMetricStatistics, and cloudwatch:ListMetrics), but only if the group uses SSL with the request (&lt;a&gt;aws:SecureTransport&lt;/a&gt;"true").&lt;/p&gt; 
-&lt;p&gt;For further information please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Overview of Managing Access Permissions to Your CloudWatch Resources" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-access-control-overview-cw.html"/>
-            <reference name="Sharing CloudWatch Dashboards" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-identity-based-access-control-cw.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.270">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.1" name="Create a SNS topic for sending out notifications from Cloudtwatch Alarms" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  For the Cloudwatch alarms and Auto-Scaling Groups to be able to send out notifications, a SNS topic should be created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  When using Amazon SNS, you (as the owner) create a topic and control access to it by defining policies that determine which publishers and subscribers can communicate with the topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Cloudwatch alarms and certain actions inside Auto-Scaling Groups needs to be sent out to administrators, in order to be acted upon. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a new topic, and note the topic-arn value:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a subscription to the new topic:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: sns get topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/get-topic-attributes.html"/>
-            <reference name="Amazon docs: sns list subscriptions by topic" url="https://docs.aws.amazon.com/cli/latest/reference/sns/list-subscriptions-by-topic.html"/>
-            <reference name="Amazon docs: sns set topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/create-topic.html"/>
-            <reference name="Amazon docs: sns subscribe" url="https://docs.aws.amazon.com/cli/latest/reference/sns/subscribe.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all cloudwatch alarms and filter by alarm action (review &amp;quot;AlarmActions&amp;quot;: []):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch describe-alarms --query 'MetricAlarms[*].{AlarmName:AlarmName, AlarmActions:AlarmActions, Dimensions:Dimensions}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List SNS topic attributes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns list-topic-attributes --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List SNS topic subscriptions (endpoint which receives messages captured by the SNS topic):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.328">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH4" name="Create CloudWatch Alarms based on Anomaly Detection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create CloudWatch Alarms based on Anomaly Detection&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; When you enable anomaly detection for a metric, CloudWatch applies statistical and machine learning algorithms. These algorithms continuously analyze metrics of systems and applications, determine normal baselines, and surface anomalies with minimal user intervention.&lt;br&gt; You can create an alarm based on CloudWatch anomaly detection, which mines past metric data and creates a model of expected values. The expected values take into account the typical hourly, daily, and weekly patterns in the metric.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alarm based on anomaly detection&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Alarms, Create Alarm.&lt;/p&gt; 
-&lt;p&gt;3. Choose Select Metric and do one of the following:&lt;/p&gt; 
-&lt;p&gt;- Choose the service namespace that contains the metric that you want. To narrow the choices, continue choosing options as they appear. When a list of metrics appears, select the check box next to the metric that you want.&lt;/p&gt; 
-&lt;p&gt;- In the search box, enter the name of a metric, dimension, or resource ID and press Enter. Then choose one of the results and continue until a list of metrics appears. Select the check box next to the metric that you want.&lt;/p&gt; 
-&lt;p&gt;4. Choose the Graphed metrics tab.&lt;/p&gt; 
-&lt;p&gt;a. Under Statistic , choose one of the statistics or predefined percentiles, or specify a custom percentile (for example, p95.45).&lt;/p&gt; 
-&lt;p&gt;b. Under Period, choose the evaluation period for the alarm. When evaluating the alarm, each period is aggregated into one data point. For anomaly detection alarms, the value must be one minute or longer.&lt;/p&gt; 
-&lt;p&gt;You can also choose whether the y-axis legend appears on the left or right while you're creating the alarm. This preference is used only while you're creating the alarm.&lt;/p&gt; 
-&lt;p&gt;c. Choose Select metric.&lt;/p&gt; 
-&lt;p&gt;The Specify metric and conditions page appears, showing a graph and other information about the metric and statistic you have selected.&lt;/p&gt; 
-&lt;p&gt;5. Under Conditions, specify the following:&lt;/p&gt; 
-&lt;p&gt;a. Choose Anomaly detection.&lt;/p&gt; 
-&lt;p&gt;If the model for this metric and statistic already exists, CloudWatch displays the anomaly detection band in the sample graph at the top of the screen. If the model does not already exist, the model will be generated when you finish creating the alarm. It takes up to 15 minutes for the actual anomaly detection band generated by the model to appear in the graph. Before that, the band you see is an approximation of the anomaly detection band. To see the graph in a longer time frame, choose Edit at the top right of the page.&lt;/p&gt; 
-&lt;p&gt;b. For Whenever metric is, specify whether the metric must be greater than, lower than, or outside (in either direction) the band to trigger the alarm.&lt;/p&gt; 
-&lt;p&gt;c. For Anomaly detection threshold, choose the number to use for the anomaly detection threshold. A higher number creates a thicker band of "normal" values that is more tolerant of metric changes, and a lower number creates a thinner band that will go to ALARM state with smaller metric deviations. The number does not have to be a whole number.&lt;/p&gt; 
-&lt;p&gt;d. Choose Additional configuration. For Datapoints to alarm, specify how many evaluation periods (data points) must be in the ALARM state to trigger the alarm. If the two values here match, you create an alarm that goes to ALARM state if that many consecutive periods are breaching.&lt;/p&gt; 
-&lt;p&gt;To create an M out of N alarm, specify a lower number for the first value than you specify for the second value. For more information, see Evaluating an Alarm.&lt;/p&gt; 
-&lt;p&gt;e. For Missing data treatment, choose how to have the alarm behave when some data points are missing. For more information, see Configuring How CloudWatch Alarms Treat Missing Data.&lt;/p&gt; 
-&lt;p&gt;f. If the alarm uses a percentile as the monitored statistic, a Percentiles with low samples box appears. Use it to choose whether to evaluate or ignore cases with low sample rates. If you choose ignore (maintain alarm state), the current alarm state is always maintained when the sample size is too low. For more information, see Percentile-Based CloudWatch Alarms and Low Data Samples.&lt;/p&gt; 
-&lt;p&gt;6. Choose Next.&lt;/p&gt; 
-&lt;p&gt;7. Under Notification, select an SNS topic to notify when the alarm is in ALARM state, OK state, or INSUFFICIENT_DATA state.&lt;/p&gt; 
-&lt;p&gt;To have the alarm send multiple notifications for the same alarm state or for different alarm states, choose Add notification.&lt;/p&gt; 
-&lt;p&gt;To have the alarm not send notifications, choose Remove.&lt;/p&gt; 
-&lt;p&gt;8. To have the alarm perform EC2 actions when it changes state or create a Systems Manager OpsItem when it goes into ALARM state, choose the appropriate button and choose the alarm state and action to perform.&lt;/p&gt; 
-&lt;p&gt;9. When finished, choose Next.&lt;/p&gt; 
-&lt;p&gt;10. Enter a name and description for the alarm. The name must contain only ASCII characters. Then choose Next.&lt;/p&gt; 
-&lt;p&gt;11. Under Preview and create, confirm that the information and conditions are what you want, then choose Create alarm.&lt;/p&gt; 
-&lt;p&gt;Modifying an Anomaly Detection Model&lt;/p&gt; 
-&lt;p&gt;Once you have created an alarm, you can adjust the anomaly detection model. You can exclude certain time periods from being used in the model creation. It is critical that you exclude unusual events such as system outages, deployments, and holidays from the training data. You can also specify whether to adjust the model for daylight savings time changes.&lt;/p&gt; 
-&lt;p&gt;To adjust the anomaly detection model for an alarm&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Alarms.&lt;/p&gt; 
-&lt;p&gt;3. Choose the name of the alarm. Use the search box to find the alarm if necessary.&lt;/p&gt; 
-&lt;p&gt;4. Choose View in metrics.&lt;/p&gt; 
-&lt;p&gt;5. In the lower part of the screen, choose Edit model.&lt;/p&gt; 
-&lt;p&gt;6. To exclude a time period from being used to produce the model, choose Add another time range to exclude from training. Then select or enter the days and times to exclude from training, and choose Apply.&lt;/p&gt; 
-&lt;p&gt;7. If the metric is sensitive to daylight savings time changes, select the appropriate time zone in the Metric timezone box.&lt;/p&gt; 
-&lt;p&gt;8. Choose Update.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Using anomaly detection models for alarms incurs charges on your AWS account.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Creating a CloudWatch Alarm Based on Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Anomaly_Detection_Alarm.html"/>
-            <reference name="Using CloudWatch Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have created Anomaly Detection alarms properly.&lt;/p&gt;
-
-	&lt;p&gt;After you create a model, it constantly updates itself, using the latest data from the metric.&lt;/p&gt;
-
-	&lt;p&gt;After you enable anomaly detection on a metric, you can choose to exclude specified time periods of the metric from being used to train the model. This way, you can exclude deployments or other unusual events from being used for model training, ensuring the most accurate model is created.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH2" name="Follow the security best practices for CloudWatch Synthetics Canaries" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Follow the security best practices for CloudWatch Synthetics Canaries&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries follow the same routes and perform the same actions as a customer, which makes it possible for you to continually verify your customer experience even when you don't have any customer traffic on your applications.&lt;br&gt; However, there are several security issues that you should consider when creating and running canaries in Synthetics. AWS recommends to follow the undermentioned security best practices.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following sections explain security issues that you should consider when creating and running canaries in Synthetics.&lt;/p&gt; 
-&lt;p&gt;Use Secure Connections&lt;/p&gt; 
-&lt;p&gt;Because canary code and the results from canary test runs can contain sensitive information, do not have your canary connect to endpoints over unencrypted connections. Always use encrypted connections, such as those that begin with https://.&lt;/p&gt; 
-&lt;p&gt;Canary Naming Considerations&lt;/p&gt; 
-&lt;p&gt;The Amazon Resource Name (ARN) of a canary is included in the user-agent header as a part of outbound calls made from the Puppeteer-driven Chromium browser that is included as a part of the CloudWatch Synthetics wrapper library. This helps identify CloudWatch Synthetics canary traffic and relate it back to the canaries that are making calls.&lt;/p&gt; 
-&lt;p&gt;The canary ARN includes the canary name. Choose canary names that do not reveal proprietary information.&lt;/p&gt; 
-&lt;p&gt;Additionally, be sure to point your canaries only at websites and endpoints that you control.&lt;/p&gt; 
-&lt;p&gt;Secrets in Canary Code&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you don't include secrets, such as access keys or database credentials, in your canary source code.&lt;/p&gt; 
-&lt;p&gt;Permissions Considerations&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you restrict access to resources that are created or used by CloudWatch Synthetics. Use tight permissions on the Amazon S3 buckets where canaries store test run results and other artifacts, such as logs and screenshots.&lt;/p&gt; 
-&lt;p&gt;Similarly, keep tight permissions on the locations where your canary source code is stored, so that no user accidentally or maliciously deletes the Lambda layers or Lambda functions used for the canary.&lt;/p&gt; 
-&lt;p&gt;To help make sure you run the canary code you intend, you can use object versioning on the Amazon S3 bucket where your canary code is stored. Then when you specify this code to run as a canary, you can include the object versionId as part of the path, as in the following examples:&lt;/p&gt; 
-&lt;p&gt;https://bucket.s3.amazonaws.com/path/object.zip?versionId=version-id&lt;br&gt; https://s3.amazonaws.com/bucket/path/object.zip?versionId=version-id&lt;br&gt; https://bucket.s3-region.amazonaws.com/path/object.zip?versionId=version-id&lt;/p&gt; 
-&lt;p&gt;Stack Traces and Exception Messages&lt;/p&gt; 
-&lt;p&gt;By default, CloudWatch Synthetics canaries capture any exception thrown by your canary script, no matter whether the script is custom or is from a blueprint. CloudWatch Synthetics logs both the exception message and the stack trace to three locations:&lt;/p&gt; 
-&lt;p&gt;- Back into the CloudWatch Synthetics service to speed up debugging when you describe test runs&lt;/p&gt; 
-&lt;p&gt;- Into CloudWatch Logs according to the configuration that your Lambda functions are created with&lt;/p&gt; 
-&lt;p&gt;- Into the Synthetics log file, which is a plaintext file that is uploaded to the Amazon S3 location specified by the value you set for the resultsLocation of the canary&lt;/p&gt; 
-&lt;p&gt;If you want to send and store less information, you can capture exceptions before they return to the CloudWatch Synthetics wrapper library.&lt;/p&gt; 
-&lt;p&gt;Scope Your IAM Roles Narrowly&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you do not configure your canary to visit potentially malicious URLs or endpoints. Pointing your Canary to untrusted or unknown websites or endpoints could expose your Lambda function code to malicious user's scripts. Assuming a malicious website can break out of Chromium, it could have access to your Lambda code in a similar way to if you connected to it using an internet browser.&lt;/p&gt; 
-&lt;p&gt;Run your Lambda function with an IAM execution role that has scoped-down permissions. This way, if your Lambda function is compromised by a malicious script, it is limited in the actions it can take when running as your canary's AWS account.&lt;/p&gt; 
-&lt;p&gt;When you use the CloudWatch console to create a canary, it is created with a scoped-down IAM execution role.&lt;/p&gt; 
-&lt;p&gt;Header Logging&lt;/p&gt; 
-&lt;p&gt;By default, canary header logging logs only the request URL, response code, and response status. Within your canary script, you can customize the logging to log more or less information.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Considerations for Synthetics Canaries" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/servicelens_canaries_security.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are following security best practices for CloudWatch Synthetics Canaries.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.279">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.355">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH6" name="Use CloudWatch Agent to collect system-level metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use CloudWatch Agent to collect system-level metrics&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The unified CloudWatch agent enables you to do the following:&lt;/p&gt; 
-&lt;p&gt;- Collect internal system-level metrics from Amazon EC2 instances across operating systems. The metrics can include in-guest metrics, in addition to the metrics for EC2 instances. The additional metrics that can be collected are listed in Metrics Collected by the CloudWatch Agent.&lt;/p&gt; 
-&lt;p&gt;- Collect system-level metrics from on-premises servers. These can include servers in a hybrid environment as well as servers not managed by AWS.&lt;/p&gt; 
-&lt;p&gt;- Retrieve custom metrics from your applications or services using the StatsD and collectd protocols. StatsD is supported on both Linux servers and servers running Windows Server. collectd is supported only on Linux servers.&lt;/p&gt; 
-&lt;p&gt;- Collect logs from Amazon EC2 instances and on-premises servers, running either Linux or Windows Server.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Installation Process Overview&lt;/p&gt; 
-&lt;p&gt;You can download and install the CloudWatch agent manually using the command line, or you can integrate it with SSM. The general flow of installing the CloudWatch agent using either method is as follows:&lt;/p&gt; 
-&lt;p&gt;1. Create IAM roles or users that enable the agent to collect metrics from the server and optionally to integrate with AWS Systems Manager.&lt;/p&gt; 
-&lt;p&gt;2. Download the agent package.&lt;/p&gt; 
-&lt;p&gt;3. Modify the CloudWatch agent configuration file and specify the metrics that you want to collect.&lt;/p&gt; 
-&lt;p&gt;4. Install and start the agent on your servers. As you install the agent on an EC2 instance, you attach the IAM role that you created in step 1. As you install the agent on an on-premises server, you specify a named profile that contains the credentials of the IAM user that you created in step 1.&lt;/p&gt; 
-&lt;p&gt;For further information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Please follow Reference URL to check for Supported Operating Systems.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Collecting Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify That the CloudWatch Agent Is Running&lt;/p&gt;
-
-	&lt;p&gt;You can query the CloudWatch agent to find whether it's running or stopped. You can use AWS Systems Manager to do this remotely. You can also use the command line, but only to check the local server.&lt;/p&gt;
-
-	&lt;p&gt;To query the status of the CloudWatch agent using Run Command&lt;/p&gt;
-
-	&lt;p&gt;1. Open the Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Run Command.&lt;/p&gt;
-
-	&lt;p&gt;&lt;del&gt;or&lt;/del&gt;&lt;/p&gt;
-
-	&lt;p&gt;If the AWS Systems Manager home page opens, scroll down and choose Explore Run Command.&lt;/p&gt;
-
-	&lt;p&gt;3. Choose Run command.&lt;/p&gt;
-
-	&lt;p&gt;4. In the Command document list, choose the button next to AmazonCloudWatch-ManageAgent.&lt;/p&gt;
-
-	&lt;p&gt;5. In the Action list, choose status.&lt;/p&gt;
-
-	&lt;p&gt;6. For Optional Configuration Source choose default and keep Optional Configuration Location blank.&lt;/p&gt;
-
-	&lt;p&gt;7. In the Target area, choose the instance to check.&lt;/p&gt;
-
-	&lt;p&gt;8. Choose Run.&lt;/p&gt;
-
-	&lt;p&gt;If the agent is running, the output resembles the following.&lt;/p&gt;
-
-	&lt;p&gt;{
-       "status": "running",
-       "starttime": "2017-12-12T18:41:18",
-       "version": "1.73.4"&lt;br /&gt;
-}&lt;/p&gt;
-
-	&lt;p&gt;If the agent is stopped, the "status" field displays "stopped".&lt;/p&gt;
-
-
-	&lt;p&gt;To query the status of the CloudWatch agent locally using the command line&lt;/p&gt;
-
-	&lt;p&gt;- On a Linux server, enter the following:&lt;/p&gt;
-
-	&lt;p&gt;sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status&lt;/p&gt;
-
-	&lt;p&gt;- On a server running Windows Server, enter the following in PowerShell as an administrator:&lt;/p&gt;
-
-	&lt;p&gt;&amp;amp; $Env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1 -m ec2 -a status&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.303">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH5" name="Use CloudWatch metric streams" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use CloudWatch metric streams&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use metric streams to continually stream CloudWatch metrics to a destination of your choice, with near-real-time delivery and low latency. Supported destinations include AWS destinations such as Amazon Simple Storage Service and several third-party service provider destinations.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to use the CloudWatch console to set up a metric stream to another AWS service&lt;/p&gt; 
-&lt;p&gt;When you use the console to set up a metric stream, you have the option of choosing the Quick S3 Setup. This method works well if want the final output as JSON or to be queried by Amazon Athena. If you want the final format to be Parquet format or Optimized Row Columnar (ORC), you should create your own Kinesis Data Firehose delivery stream and choose Select an existing Firehose owned by your account instead of choosing Quick S3 Setup.&lt;/p&gt; 
-&lt;p&gt;To set up a metric stream to an AWS service&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Streams, Create stream.&lt;/p&gt; 
-&lt;p&gt;3. Choose the CloudWatch metric namespaces to include in the metric stream.&lt;/p&gt; 
-&lt;p&gt;- To include all or most of your metric namespaces in the metric stream, choose All metrics.&lt;/p&gt; 
-&lt;p&gt;Then, if you want to exclude some metric namespaces from the stream, choose Exclude metric namespaces and select the namespaces to exclude.&lt;/p&gt; 
-&lt;p&gt;- To include only a few metric namespaces in the metric stream, choose Selected namespaces and then select the namespaces to include.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt; 
-&lt;p&gt;4. Choose one of the following:&lt;/p&gt; 
-&lt;p&gt;- For a quick setup, choose Quick S3 setup. CloudWatch will create all necessary resources including the Kinesis Data Firehose delivery stream and the necessary IAM roles. The default format for this option is JSON, but you can change the format later in this procedure.&lt;/p&gt; 
-&lt;p&gt;- To use a Kinesis Data Firehose delivery stream that already exists, choose Select an existing Firehose owned by your account. The Kinesis Data Firehose delivery stream must be in the same account. The default format for this option is OpenTelemetry, but you can change the format later in this procedure.&lt;/p&gt; 
-&lt;p&gt;Then select the Kinesis Data Firehose delivery stream to use under Select your Kinesis Data Firehose delivery stream.&lt;/p&gt; 
-&lt;p&gt;5. (Optional) If you're using Quick S3 Setup, you can choose Select existing resources to use an existing S3 bucket or existing IAM roles instead of having CloudWatch create new ones for you.&lt;/p&gt; 
-&lt;p&gt;6. (Optional) If you're using Select an existing Firehose owned by your account, you can choose Select existing service role to use an existing IAM role instead of having CloudWatch create a new one for you.&lt;/p&gt; 
-&lt;p&gt;7. (Optional) To change the output format from the default format for your scenario, choose Change output format. The supported formats are JSON and OpenTelemetry 0.7.0.&lt;/p&gt; 
-&lt;p&gt;8. (Optional) Customize the name of the new metric stream under Metric stream name.&lt;/p&gt; 
-&lt;p&gt;9. Choose Create metric stream.&lt;/p&gt; 
-&lt;p&gt;Setting up a metric stream to a third-party solution&lt;/p&gt; 
-&lt;p&gt;To set up a CloudWatch metric stream to stream metrics to a third-party solution, follow the instructions provided by that third-party provider.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Metric stream operation and maintenance" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-operation.html"/>
-            <reference name="Using metric streams" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metric-Streams.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Metric streams are always in one of two states, Running or Stopped.&lt;/p&gt;
-
-	&lt;p&gt;Running - The metric stream is running correctly. There might not be any metric data streamed to the destination because of the filters on the stream.&lt;/p&gt;
-
-	&lt;p&gt;Stopped - The metric stream has been explicitly stopped by someone, and not because of an error. It might be useful to stop your stream to temporarily pause the streaming of data without deleting the stream.&lt;/p&gt;
-
-	&lt;p&gt;If you stop and restart a metric stream, the metric data that was published to CloudWatch while the metric stream was stopped is not backfilled to the metric stream.&lt;/p&gt;
-
-	&lt;p&gt;If you change the output format of a metric stream, in certain cases you might see a small amount of metric data written to the destination in both the old format and the new format. To avoid this situation, you can create a new Kinesis Data Firehose delivery stream with the same configuration as your current one, then change to the new Kinesis Data Firehose delivery stream and change the output format at the same time. This way, the Kinesis records with different output format are stored on Amazon S3 in separate objects. Later, you can direct the traffic back to the original Kinesis Data Firehose delivery stream and delete the second delivery stream.&lt;/p&gt;
-
-	&lt;p&gt;To view, edit, stop, and start your metric streams&lt;/p&gt;
-
-	&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Streams.&lt;/p&gt;
-
-	&lt;p&gt;The list of streams appears, and the Status column displays whether each stream is running or stopped.&lt;/p&gt;
-
-	&lt;p&gt;3. To stop or start a metric stream, select the stream and choose Stop or Start.&lt;/p&gt;
-
-	&lt;p&gt;4. To see the details about a metric stream, select the stream and choose View details.&lt;/p&gt;
-
-	&lt;p&gt;5. To change the stream's output format, filters, destination Kinesis Data Firehose stream, or roles, choose Edit and make the changes that you want.&lt;/p&gt;
-
-	&lt;p&gt;If you change the filters, there might be some gaps in the metric data during the transition.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.316">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
-                    <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
-                    <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
-                    <countermeasure ref="aws-tier-4.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
-                <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
-                <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
-                <countermeasure ref="aws-tier-4.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
-                    <countermeasure ref="AWS-VPC5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
-                <countermeasure ref="AWS-VPC5" mitigation="34"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6752527a-61a6-45fd-b5e1-38cd8d0c5ae6" diagramComponentId="c1a1276f-411a-4aeb-818c-a4b605112c51" ref="88ead499-6db6-4ecb-96d9-363b587ed0d5" name="AWS Account Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-Logging-3.3" name="Audit logs are accesible" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The audit logs are not encrypted and they can be accessed by attackers and obtain sensitive data
-                        in clear text.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.5" name="Brute force attempts on the Amazon management console cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>The failure connection attempts (brute force) must be audited and monitored and the
-                        correspondent personnel must be alerted and informed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.12" name="Changes in the network configuration cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The changes in the network configurations (NACLs, route and gateway tables) are not detected
-                        because the monitorization and alerts of the network configuration are not configured to detect
-                        these changes.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.4" name="Changes in the security configurations can be not detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Monitoring and alerting for security configurations are not configured and changes cannot be
-                        detected.&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.10" name="Changes in the security groups cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes in the security groups must be audited and monitored and the correspondent
-                        personnel must approve these changes. If the situation is not the correct, attackers can access
-                        to security systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="cloudwatch-misconfig" name="Cloudwatch is misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T13:52:40.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.3" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login to the console without using the Multi-factor Authentication (MFA) and they are not
-                        detected. The connection without the MFA must be audited and monitored, the correct security
-                        group must be informed and they must validate this connection.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:15.193">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.1" name="Non-auditable API calls in all regions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The API call to the resources is not audited and the actions are not recorded into the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.8" name="Non-centrality audit logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The audit logs are not stored in a central system. Therefore, the audit logs cannot be
-                        exploited correctly by the security personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator account is not configured. The security question to recover or reset the
-                        password and the authentication method are not configured.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:26.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-1.21" name="The access keys are generated when the setup of the users is started" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The system doesn't require additional steps to create access keys, the access keys are
-                        generating when the process to create an user is starting. The problem is that these keys can be
-                        in use somewhere in the organization and maybe these keys are not necessary for the user.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Being highly selective in peering routing tables is a very effective way of minimizing the
-                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EXPIRATION-DATE" name="The password expiration is not established" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.9" name="The security policies are exposed in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not configured and the security configurations are exposed for the
-                        attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.7" name="Unaudited connections with the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The connections with the applications and with the databases cannot be audited and not
-                        detected.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.9" name="Unaudited resources changes" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes in the applications and in the databases and these changes are not detected and
-                        not audited.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.685">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.12" name="Apply an AWS Managed Config Rule for EIPs attached to EC2 instances within VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources. You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Description": "Checks whether all EIP addresses allocated to a VPC are attached to 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    EC2 instances or in-use ENIs.", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "ConfigRuleName": "eip-attached", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Source": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Owner": "AWS", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "SourceIdentifier": "EIP_ATTACHED" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    }, 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Scope": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "ComplianceResourceTypes": [ 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "AWS::EC2::EIP" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    ] 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    } 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    } 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe config rules" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"/>
-            <reference name="Put config rule" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/put-config-rule.html"/>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for a Config Rule that checks whether all EIP addresses allocated to a VPC are attached to EC2 instances or in-use ENIs:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'EIP_ATTACHED']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:48:26.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.3-2.4" name="Apply an IAM Role for Amazon EC2 Tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      { 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Version": "2012-10-17", 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Statement": [ 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Effect": "Allow", 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Principal": { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        "Service": "ec2.amazonaws.com" 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       }, 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Action": "sts:AssumeRole" 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      ] 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      } 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
-            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
-            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-          </references>
-          <standards>
-            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all the Web tier EC2 instances, check if and which IAM instance profile they have attached, and note the name of the instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-instances --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Reservations[*].Instances[*].{IamInstanceProfile:IamInstanceProfile, InstanceId:InstanceId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:47:29.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.1-2.2" name="Apply IAM Policy for EC2 IAM Roles for tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles defined with AWS Identity Access Management. An IAM policy is a document that formally states one or more permissions using the following structure:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Actions: what actions are allowed (each AWS service has its own set of actions)&lt;/li&gt; 
-  &lt;li&gt;Resources: which resources will be affected by the action&lt;/li&gt; 
-  &lt;li&gt;Effect: what effect will be when the subject (user/group/roles) requests access Policies are documents that are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;b&gt;Remediation&lt;/b&gt;: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Using the Amazon unified command line interface: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      { 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Version": "2012-10-17", 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Statement": [ 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Effect": "Allow", 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Principal": { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        "Service": "ec2.amazonaws.com" 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       }, 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Action": "sts:AssumeRole" 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      ] 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an IAM managed policy for Web tier instances, and note the policy ARN:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-policy --policy-name &amp;lt;iam_policy_name&amp;gt; --policy-document file://policy 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the IAM policy created to the Web tier IAM role:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --rolename &amp;lt;web_tier_iam_role&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
-            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
-            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
-            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
-            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
-            <reference name="Get policy version" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html"/>
-            <reference name="List attached role policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-role-policies.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check managed policies attached to the IAM role, and note the policies ARN:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-attached-role-policies --role-name &amp;lt;web_tier_iam_role&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the version of the IAM policies attached to the IAM role:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --query "Policy.DefaultVersionId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the document policy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy-version --policy-arn &amp;lt;iam_policy_arn&amp;gt; --version-id &amp;lt;iam_policy_version&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:34:12.746">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Click on Users.&lt;/li&gt; 
-  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Select the user.&lt;/li&gt; 
-   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ol&gt;Create a Group and add a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
-  &lt;li&gt;Click Create Group.&lt;/li&gt; 
-  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
-  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
-                            --output text&lt;/li&gt;
-                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-attached-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
-  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
-  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
-  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
-  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
-  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
-  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
-                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
-                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
-                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
-                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
-                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
-                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
-                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
-                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
-                            ALLOW.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.703">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.5-2.6" name="Configure AutoScaling Group Launch Configuration for Tier to use a customer created IAM Role" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  *Note: references to Web tier are also applicable to App tier. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the Web tier IAM instance profile :&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-          </references>
-          <standards>
-            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if your Web tier autoscaling group is using a launch configuration with an IAM instance profile configured:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query "LaunchConfigurations[*].IamInstanceProfile" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:55:23.427">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM1" name="Configure contact email and telephone details on AWS accounts" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.&lt;/p&gt;&lt;p&gt;An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, next to Account Settings, choose Edit.&lt;/li&gt;&lt;li&gt;Next to the field that you need to update, choose Edit.&lt;/li&gt;&lt;li&gt;After you have entered your changes, choose Save changes.&lt;/li&gt;&lt;li&gt;After you have made your changes, choose Done.&lt;/li&gt;&lt;li&gt;To edit your contact information, under Contact Information, choose Edit.&lt;/li&gt;&lt;li&gt;For the fields that you want to change, type your updated information, and then choose Update.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, review and verify the current details.&lt;/li&gt;&lt;li&gt;Under Contact Information, review and verify the current details.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.232">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.11" name="Configure password expiration" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Change access keys regularly, and make sure that all IAM users in your account do as well. That way, if an access key is compromised without your knowledge, you limit how long the credentials can be used to access your resources. Credential reports can be used to determine how long access keys have been active for. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Click on Users.&lt;/li&gt; 
-  &lt;li&gt;Select the user you wish to rotate the key for.&lt;/li&gt; 
-  &lt;li&gt;Under access keys click &amp;quot;Create Access Key&amp;quot; (do not touch the existing key yet).&lt;/li&gt; 
-  &lt;li&gt;Click &amp;quot;Download credentials&amp;quot; or &amp;quot;Show credentials&amp;quot; so that you have a record of them.&lt;/li&gt; 
-  &lt;li&gt;Update any applications with the new credentials and test (we recommend to leave a few days or a week for testing).&lt;/li&gt; 
-  &lt;li&gt;Once complete complete 1-4 above and for the key which needs rotating click &amp;quot;Make Inactive | Delete&amp;quot; and click &amp;quot;Deactive&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Once you are confident you will no longer need the key (wait several more days) repeat 1-4 and select &amp;quot;Delete&amp;quot; for the inactive key.&lt;/li&gt; 
- &lt;/ol&gt; 
-  &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Check the access keys created time: aws iam get-credential-report --query
-                            'Content' --output text | base64 -D | awk -F, '{print $1,$9,$10,$14,$15}'&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each access_key_1_active and access_key_9_active that is set to True ensure
-                            the created date is within the last 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Gov-1.1" name="Configure the security challenge questions within the AWS Account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When an AWS account is initially created it is configured with a top level account known as the &amp;quot;root&amp;quot; account that has full administration access to all resources. In the event that the password or MFA device associated with this account is lost AWS support may recover it by asking you to answer the security questions. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
-  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Click on Edit.&lt;/li&gt; 
-  &lt;li&gt;For each question:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Select an appropriate question.&lt;/li&gt; 
-   &lt;li&gt;Enter an appropriate answer.&lt;/li&gt; 
-   &lt;li&gt;Follow the above process for all 3 questions.&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;Click Update when complete.&lt;/li&gt; 
-  &lt;li&gt;We recommend to store the questions and answers in a secure location such as a safe where they can be used in case recovery is required.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
-                            &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Confirm whether questions and answers have been saved.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.7" name="Create a Cloudwatch Alarm and its action for the &quot;VPC Flow Logs&quot; metric filter" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt;
-   A Cloudwatch alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The Cloudwatch Alarm will trigger a notification being sent to the administrators every time the "REJECT packets" specified threshold is reached. The alarm should be created for the "VPC Flow Logs" metric, and the action should have a SNS topic configured.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a Cloudwatch alarm for the VPC Flow Logs metric, and configure an Alarm Action:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws cloudwatch put-metric-alarm --alarm-name &amp;lt;vpc_flow_log_alarm_name&amp;gt; --alarm-actions &amp;lt;sns_topic_arn&amp;gt; --metric-name &amp;lt;vpc_flow_log_metric_name&amp;gt; --namespace LogMetrics --statistic &amp;lt;desired_statistic&amp;gt; --period &amp;lt;desired_period&amp;gt; --evaluation-periods &amp;lt;desired_evaluation_periods&amp;gt; --threshold &amp;lt;desired_threshold&amp;gt; --comparison-operator &amp;lt;desired_operator&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe alarms" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"/>
-            <reference name="Put metric alarm" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html"/>
-          </references>
-          <standards>
-            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all the Cloudwatch alarms configured for the VPC Flow Logs metric, and check if an Alarm Action is configured:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch describe-alarms --query "MetricAlarms[?MetricName =='&amp;lt;vpc_flow_log_metric_name&amp;gt;'].{MetricName:MetricName,AlarmActions:AlarmActions,AlarmName:AlarmName}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:51:42.064">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.6" name="Create a log metric filter for the Cloudwatch group assigned to the &quot;VPC Flow Logs&quot;" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Description:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  This recommendation builds upon the Foundation benchmark recommendation: "Ensure VPC Flow Logging is Enabled in all Applicable Regions"&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  VPC flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. VPC flow logs can capture accepted traffic, rejected traffic, or all traffic.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Metric filters can be used to express how the service would extract metric observations from ingested events and transform them to data points in a CloudWatch metric. Metric filters are assigned to log groups, and all of the filters assigned to a log group are applied to their log streams.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A metric filter should be created for counting how many IP packets are rejected in the VPC flow logs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a metric filter for the Cloudwatch Log group assigned to the "VPC Flow Logs":&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs put-metric-filter --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; --filter-name &amp;lt;vpc_flow_log_filter_name&amp;gt; --filter-pattern "{ $.errorCode =\"AccessDenied\" }" --metric-transformations metricName= &amp;lt;vpc_flow_log_metric_name&amp;gt;,metricNamespace=LogMetrics,metricValue=1 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"/>
-            <reference name="Filter log events" url="https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html"/>
-            <reference name="Put metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html"/>
-          </references>
-          <standards>
-            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface to check if the log metric filter: 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws logs describe-metric-filters --region &amp;lt;application_region&amp;gt; --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:48:32.261">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.7" name="Create an IAM group for administration purposes" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
-  An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and should have administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a new IAM group for administration purposes:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam create-group --group-name &amp;lt;iam_admin_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attach the Admin policy to the administration IAM group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam attach-group-policy --policy-arn &amp;lt;admin_policy_arn&amp;gt; --group-name &amp;lt;iam_admin_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The name of the IAM admin group name should be known prior to auditing this recommendation. For a sample admin policy arn see recommendation 2.1. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Attach group policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-group-policy.html"/>
-            <reference name="Create groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-group.html"/>
-            <reference name="List groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the IAM groups created for administration purposes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-groups --query "Groups[?GroupName == '&amp;lt;iam_admin_group_name&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:59:51.981">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.8" name="Create an IAM policy that allows admin privileges for all services used" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A policy is a document that formally states one or more permissions.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies apply only to identities (users, groups, and roles) - not resources. You must ensure that you have an IAM managed policy created with admin permissions for all the AWS services used by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create an IAM managed admin policy for all AWS services used:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam create-policy --policy-name &amp;lt;admin_policy_name&amp;gt; --policy-document file://policy 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The admin policy should be defined prior to auditing and remediating this recommendation. For a sample admin policy see recommendation 2.1. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
-            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
-            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
-          </references>
-          <standards>
-            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the IAM admin policies and note the policy ARN and DefaultVersionId:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-policies --query "Policies[?PolicyName == '&amp;lt;admin_policy_name&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If the policy exists, check the policy document:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy-version --policy-arn &amp;lt;admin_policy_arn&amp;gt; --version-id &amp;lt;admin_policy_version&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:02:44.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-1.20" name="Create an IAM role for managing incidents with AWS" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>WS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support. 
-&lt;br /&gt; 
-&lt;br /&gt; 
-&lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;br /&gt;Using the Amazon unified command line interface, create an IAM role for managing incidents with AWS: 
-&lt;br /&gt; 
-&lt;br /&gt;Create a trust relationship policy document that allows &amp;lt;iam_user&amp;gt; to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: 
-&lt;br /&gt; 
-&lt;br /&gt;{ 
-&lt;br /&gt;&amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
-&lt;br /&gt;&amp;quot;Statement&amp;quot;: [{ 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Principal&amp;quot;: { 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;AWS&amp;quot;: &amp;quot;&amp;lt;iam_user&amp;gt;&amp;quot; 
-&lt;br /&gt;&amp;nbsp; }, 
-&lt;br /&gt;&amp;nbsp; &amp;quot;Action&amp;quot;: &amp;quot;sts:AssumeRole&amp;quot; 
-&lt;br /&gt;&amp;nbsp; }] 
-&lt;br /&gt;} 
-&lt;br /&gt; 
-&lt;br /&gt;Create the IAM role using the above trust policy: 
-&lt;br /&gt; 
-&lt;br /&gt;aws iam create-role --role-name &amp;lt;aws_support_iam_role&amp;gt; --assume-role-policy-document file:///tmp/TrustPolicy.json 
-&lt;br /&gt; 
-&lt;br /&gt;Attach 'AWSSupportAccess' managed policy to the created IAM role: 
-&lt;br /&gt; 
-&lt;br /&gt;aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --role-name &amp;lt;aws_support_iam_role&amp;gt; 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
-            <reference name="Amazon docs: list entities for policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html"/>
-            <reference name="Amazon docs: list policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
-            <reference name="Amazon docs: managed policies and inline policies" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"/>
-          </references>
-          <standards>
-            <standard ref="1.17" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: 
-            &lt;br /&gt; 
-            &lt;div&gt; 
-             &lt;ul&gt; 
-              &lt;li&gt;List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the &amp;quot;Arn&amp;quot; element value: &lt;/li&gt; 
-             &lt;/ul&gt; 
-            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-policies --query &amp;quot;Policies[?PolicyName == 'AWSSupportAccess']&amp;quot; 
-            &lt;br /&gt; 
-            &lt;div&gt; 
-             &lt;ul&gt; 
-              &lt;li&gt;Check if the 'AWSSupportAccess' is attached to any IAM user, group or role: &lt;/li&gt; 
-             &lt;/ul&gt; 
-            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-entities-for-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; 
-            &lt;span style=" , Arial;"&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.026">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-3" name="Create AWS Organizations change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;organizations_changes&amp;gt;` --metric-transformations metricName= `&amp;lt;organizations_changes&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;organizations_changes&amp;gt;` --metric-name `&amp;lt;organizations_changes&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.15" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.359">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.8" name="Create billing alerts to identify unusual spend" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By setting billing alarms you can monitor your AWS spend and be alerted if it exceeds certain thresholds thus protecting you from accruing unnecessary charges. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select the Receive Billing Alerts check box.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Choose Save preferences.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia). The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;On the navigation pane, under "Metrics", choose "Billing".&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the list of billing metrics, select the check box next to Currency USD, for the metric named EstimatedCharges. Define the alarm as follows:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If you want the alarm to trigger as soon as you go over the free tier, set "When my total AWS charges for the month exceed" to $.01. This means that you'll receive a notification as soon as you incur a charge. Otherwise, set it to the amount you want to trigger the alarm, and you will be notified when you go over that amount.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Choose the "New list" link next to the "send a notification to" box.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;When prompted, enter your email address or choose your Amazon SNS notification from the drop down.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Choose "Create Alarm".&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;In the "Confirm new email addresses" dialog box, confirm the email address or choose "I will do it later". If you don't confirm the email address now, the alarm remains in the Pending confirmation status until you do so, and does not send an alert. To view the status of your alarm, choose "Alarms" in the navigation panel.&lt;/li&gt; 
- &lt;/ol&gt; &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management
-                            console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the &amp;quot;Receive Billing Alerts&amp;quot; check box is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia).
-                            The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the navigation pane, under &amp;quot;Alarms&amp;quot;, check for one called
-                            &amp;quot;Billing&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on the alert if it exists and select the checkbox in the first column.&lt;/li&gt;
-                            &lt;li&gt;In the preview pane check that the &amp;quot;EstimatedCharges&amp;quot; threshold
-                            is set to the correct value and that the &amp;quot;Actions&amp;quot; is send an alarm to a
-                            valid email address.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.4" name="Create cloudtrail configuration changes alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is changes to
-                        cloudtrail. Since cloudtrail is the actual utility logging API calls it's security is paramount
-                        to ensuring that this continues. Therefore alerting on changes to cloudtrail activity can
-                        prevent a malicious user switching off the logging in order to carry out untracked activities.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&amp;nbsp;&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;aws
-                        logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                        ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) ||
-                        ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
-                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.5" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName =
-                            DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.4-5.5" name="Create Cloudwatch Log Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  AWS CloudWatch Log groups define groups of log streams that share the same retention, monitoring, and access control settings. Each log stream has to belong to one log group.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a Cloudwatch log group for the Web tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs create-log-group --log-group-name &amp;lt;web_tier_log_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html"/>
-            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for your Web tier Cloudwatch log group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs describe-log-groups --query "logGroups[?logGroupName =='&amp;lt;web_tier_log_group&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:24:18.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.6" name="Create IAM Policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is management IAM policy changes. IAM manages authorization and authentication controls with AWS and therefore it is vital that unauthorized changes are detected. Enabling monitoring of these changes ensures that these policies remain intact and as desired. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a metric filter that checks for IAM policy changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=Delete UserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=P utUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=Cr eatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)| |($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUs erPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above:aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
- &lt;/ol&gt; &lt;br /&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource
-                            = kms.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))} }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.3" name="Create management console login alerts when MFA is not used" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is login on the
-                        console without MFA. Since logging on at the console should be restricted to only those users
-                        with an active MFA this alert will highlight those with password only access. This helps to
-                        capture weaker login procedures (password only) as they occur.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for console login without MFA: aws logs
-                        put-metric-filter --log-group-name &amp;lt;cloudwatch-logs-group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{
-                        $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot; }'&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
-                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot;
-                            }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.5" name="Create management console login failure alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is management
-                        console login failures. The management console is the AWS account GUI where administration
-                        activity is performed and is therefore a primary target for brute force attempts. To identify
-                        these attempts alerts for login failures should be enabled as this can highlight suspicious
-                        activity.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for console login failures: aws logs
-                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = ConsoleLogin)
-                        &amp;amp;&amp;amp; ($.errorMessage = &amp;quot;Failed authentication&amp;quot;) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = ConsoleLogin) &amp;amp;&amp;amp; ($.errorMessage = \&amp;quot;Failed
-                            authentication\&amp;quot;) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-2" name="Create network gateways change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for network gateways changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;network_gw_changes_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;network_gw_changes_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;network_gw_changes_alarm&amp;gt;` --metric-name `&amp;lt;network_gw_changes_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.12" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.2" name="Create root account usage alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is usage of the
-                        root account. This account should not be used on a day to day basis due to its full unrestricted
-                        privilege therefore usage should be by exception. Monitoring this usage should capture any
-                        suspicious activity used on the account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws logs
-                        describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                        $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy NOT
-                        EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&lt;/li&gt;
-                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
-                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy
-                            NOT EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.8" name="Create s3 bucket policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is S3 bucket policy changes. S3 bucket policies are a resource based policy that provide authorizations on S3 buckets. 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Making sure that their integrity remains intact is vital in ensuring the data within the S3 bucket remains secure and authorizations intact. Therefore s3 bucket policy changes should be alerted upon 
- &lt;br /&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a metric filter that checks for S3 Bucket policy changes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;value&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an SNS topic for notifications:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns create-topic --name &amp;lt;topic_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.8" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
-                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) ||
-                            ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName =
-                            PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName =
-                            DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName =
-                            DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.10" name="Create security group change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is security group changes. Security groups are analogous to firewalls and therefore protect inbound and outbound access to &amp;amp; from AWS resources such as ec2 instances and RDS databases (amongst other things. Therefore alerting on changes to security groups helps ensure that the resources protected by them are not exposed.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a metric filter that checks for security group changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
-                            AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName
-                            = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName =
-                            DeleteSecurityGroup)}&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-1" name="Create unauthorized API calls alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information, but gracefully fail if they don't have permissions.&lt;/p&gt;&lt;p&gt;If an excessive number of alerts are being generated then an organization may wish to consider adding read access to the limited IAM user permissions simply to quiet the alerts.&lt;/p&gt;&lt;p&gt;In some cases doing this may allow the users to actually view some areas of the system - any additional access given should be reviewed for alignment with the original limited IAM user intent.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for unauthorized API calls and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;unauthorized_api_calls_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.sourceIPAddress!="delivery.logs.amazonaws.com") || ($.eventName!="HeadBucket") }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;unauthorized_api_calls_alarm&amp;gt;` --metric-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.329">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.13" name="Create VPC gateway change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC gateway
-                        changes. VPC gateways are used as a means of sending traffic outside of a VPC (ie to the
-                        internet) and are vital in ensuring traffic flows to the correct destination. Therefore alerting
-                        on changes to VPC gateways ensuring traffic continues to flow as expected via the correct
-                        gateway.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for VPC gateway changes: aws logs put-metric-filter
-                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
-                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateCustomerGateway)
-                        || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||
-                        ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName =
-                        DetachInternetGateway) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.14" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) ||
-                            ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) ||
-                            ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.11" name="Create VPC NACL change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC NACL
-                        changes. Network Access Control Lists (NACLS) control inbound and outbound access to &amp;amp;
-                        from AWS subnets and work like packet filters to protect the network. Therefore alerting on
-                        changes to NACLS helps ensure that the subnets protected by them are not exposed.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for NACL changes: aws logs put-metric-filter
-                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
-                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateNetworkAcl) ||
-                        ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =
-                        DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName =
-                        ReplaceNetworkAclAssociation) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) ||
-                            ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName =
-                            ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.12" name="Create VPC route table change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC route
-                        table changes. VPC route tables provide a means of routing network traffic between subnets and
-                        via gateways and ensures traffic flows via the correct path. Therefore alerting on changes to
-                        route tables ensuring traffic continues to flow as expected.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for VPC route table changes: aws logs
-                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateRoute)
-                        || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =
-                        ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute)
-                        || ($.eventName = DisassociateRouteTable) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.13" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName
-                            = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName =
-                            DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.6-5.7" name="Define a retention period for Cloudwatch log group in tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Retention period should be used to specify how long log events are kept in CloudWatch Logs. Expired log events get deleted automatically. Just like metric filters, retention settings are also assigned to log groups, and the retention assigned to a log group is applied to their log streams.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Put a retention policy for your Web tier Cloudwatch log group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs put-retention-policy --log-group-name &amp;lt;web_tier_log_group&amp;gt; --retention-indays &amp;lt;log_retention_period&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  If the retention period is not configured then logs will be retained indefinitely with increasing cost. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
-            <reference name="Put retention policy" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-retention-policy.html"/>
-          </references>
-          <standards>
-            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for your Web tier Cloudwatch log group, and check for the presence of "retentionInDays" element:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs describe-log-groups --query "logGroups[?logGroupName == 
-   &lt;/div&gt; 
-   &lt;div&gt;
-     '&amp;lt;web_tier_log_group&amp;gt;']" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:28:27.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM2" name="Disable credentials unused after 45 days" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to manage Unused Password (IAM user console access)&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select user whose Console last sign-in is greater than 45 days&lt;/li&gt;&lt;li&gt;Click Security credentials&lt;/li&gt;&lt;li&gt;In section Sign-in credentials, Console password click Manage&lt;/li&gt;&lt;li&gt;Under Console Access select Disable 10.Click Apply&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Perform the following to deactivate Access Keys:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have been used and&lt;ol&gt;&lt;li&gt;Click on Make Inactive&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have not been used and&lt;ol&gt;&lt;li&gt;Click the X to Delete&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to determine if unused credentials exist:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click the Settings (gear) icon.&lt;/li&gt;&lt;li&gt;Select Console last sign-in, Access key last used, and Access Key Id&lt;/li&gt;&lt;li&gt;Click on Close&lt;/li&gt;&lt;li&gt;Check and ensure that Console last sign-in is less than 45 days ago.&lt;ol&gt;&lt;li&gt;Note - Never means the user has never logged in.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Check and ensure that Access key age is less than 45 days and that Access key last used does not say None&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Download Credential Report:&lt;/p&gt;&lt;p&gt;1. Run the following commands:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam generate-credential-report&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure unused credentials do not exist:&lt;/p&gt;&lt;p&gt;2. For each user having password_enabled set to TRUE , ensure password_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When password_enabled is set to TRUE and password_last_used is set to No_Information , ensure password_last_changed is less than 45 days ago.&lt;/p&gt;&lt;p&gt;3. For each user having an access_key_1_active or access_key_2_active to TRUE , ensure the corresponding access_key_n_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When a user having an access_key_x_active (where x is 1 or 2) to TRUE and corresponding access_key_x_last_used_date is set to N/A', ensure access_key_x_last_rotated` is less than 45 days ago.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.245">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-1.21" name="Do not setup access keys during initial user setup for all IAM users that have a console password" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials, it also generates unnecessary management work in auditing and rotating these keys. 
-&lt;br /&gt; 
-&lt;br /&gt; 
-&lt;b&gt;Remediation: &lt;/b&gt; 
-&lt;br /&gt;Perform the following to delete access keys that do not pass the audit. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Login to the AWS Management Console.Click Services.&lt;/li&gt; 
- &lt;li&gt;Click IAM&lt;/li&gt; 
- &lt;li&gt;Click on Users.Click on Security Credentials.&lt;/li&gt; 
- &lt;li&gt;As an Administrator.&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;br /&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; As an IAM User&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Via CLI:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;aws iam delete-access-key&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ol&gt; 
-&lt;span style="font-weight: bold;"&gt;&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform the following to determine if access keys are rotated as prescribed: 
-            &lt;br /&gt; 
-            &lt;ol&gt; 
-             &lt;li&gt;Login to the AWS Management Console&lt;/li&gt; 
-             &lt;li&gt;Click Services&lt;/li&gt; 
-             &lt;li&gt;Click IAM&lt;/li&gt; 
-             &lt;li&gt;Click on a User&lt;/li&gt; 
-             &lt;li&gt;Compare the user creation date to the key 1 creation date.&lt;/li&gt; 
-             &lt;li&gt;For any that match, the key was created during initial user setup.&lt;/li&gt; 
-            &lt;/ol&gt;Keys that were created at the same time as the user profile and do not have a last used date should be deleted. 
-            &lt;br /&gt; 
-            &lt;br /&gt;Via the CLI: 
-            &lt;br /&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:&lt;/li&gt; 
-            &lt;/ul&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               aws iam generate-credential-report 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;br /&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;The output of this command will produce a table similar to the following:&amp;nbsp;&lt;/li&gt; 
-            &lt;/ul&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_ 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               key_2_active,access_key_2_last_used_date 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               elise,false,true,2015-04-16T15:14:00+00:00,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               brandon,true,true,N/A,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               rakesh,false,false,N/A,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               helene,false,true,2015-11-18T17:47:00+00:00,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;For any user having access_key_last_used_date set to N/A , ensure that access key is deleted&lt;/li&gt; 
-            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.039">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.058">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
-                        creates a digest for each log file it writes to S3. These digests can then be used to determine
-                        if a log has been modified since being written
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.2" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail describe-trails&amp;nbsp;
-                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM6" name="Enable IAM Access Analyzer for all regions" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable IAM Access analyzer for IAM policies about all resources in each region.&lt;/p&gt;&lt;p&gt;IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM Access Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to enable IAM Access analyzer for IAM policies:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;Choose Access analyzer.&lt;/li&gt;&lt;li&gt;Choose Create analyzer.&lt;/li&gt;&lt;li&gt;On the Create analyzer page, confirm that the Region displayed is the Region where you want to enable Access Analyzer.&lt;/li&gt;&lt;li&gt;Enter a name for the analyzer. Optional as it will generate a name for you automatically.&lt;/li&gt;&lt;li&gt;Add any tags that you want to apply to the analyzer. Optional.&lt;/li&gt;&lt;li&gt;Choose Create Analyzer.&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer create-analyzer --analyzer-name &amp;lt;NAME&amp;gt; --type &amp;lt;ACCOUNT|ORGANIZATION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat this command above for each active region. Note: The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.20" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/&lt;/li&gt;&lt;li&gt;Choose Access analyzer&lt;/li&gt;&lt;li&gt;Click 'Analyzers'&lt;/li&gt;&lt;li&gt;Ensure that at least one analyzer is present&lt;/li&gt;&lt;li&gt;Ensure that the STATUS is set to Active&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run the following command:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer list-analyzers | grep status&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that at least one Analyzer the status is set to ACTIVE&lt;/p&gt;&lt;p&gt;3. Repeat the steps above for each active region.&lt;/p&gt;&lt;p&gt;If an Access analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.6" name="Enable S3 Bucket logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>S3 Bucket Access Logging generates log files that contain access records for each request made
-                        to an S3 bucket. By enabling this it is possible to capture events relating to the objects
-                        within that bucket thus helping to capture potential security issues or identifying threats. It
-                        is recommended to enable S3 bucket logging on any S3 bucket that contains sensitive data and
-                        stored the logs in a separate bucket for security analysis.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
-                        &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&lt;/li&gt;
-                        &lt;li&gt;Click on Properties in the top right of the console.&lt;/li&gt;
-                        &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
-                        &lt;li&gt;Click on the &amp;quot;Enabled&amp;quot; checkbox.&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Target Bucket&amp;quot; to store the logs.&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Target Prefix&amp;quot; for the logs.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
-                            &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on Properties in the top right of the console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;Enabled&amp;quot; is checked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
-                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
-                        incidents that may be occurring across the network.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Select a VPC.&lt;/li&gt;
-                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
-                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select a VPC.&lt;/li&gt;
-                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.5" name="Encrypt CloudTrail logs using KMS" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon
-                        server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security
-                        layer that is directly manageable, you can instead use server-side encryption with AWS
-                        KMS-managed
-                        keys (SSE-KMS) for your CloudTrail log files. This provides several advantages:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across
-                        all regions.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail
-                        log files.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You can assign permissions for the key to the users in your organization according to
-                        your requirements.&lt;/li&gt;
-                        &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now
-                        need to meet two conditions:&amp;nbsp;&lt;/li&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;you must have S3 read permission on the bucket, and&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;you must be granted decrypt permission by the CMK policy.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ul&gt;Because S3 automatically decrypts the log files for requests from users authorized to
-                        use the CMK, SSE-KMS encryption for CloudTrail log files is backward compatible with existing
-                        applications that read CloudTrail log data.&amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select CloudTrail from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Trails&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on a Trail.&lt;/li&gt;
-                        &lt;li&gt;Under the S3 section click on the edit button.&lt;/li&gt;
-                        &lt;li&gt;Click Advanced.&lt;/li&gt;
-                        &lt;li&gt;Set &amp;quot;Encrypt Log Files&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Set &amp;quot;Create a new KMS key&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;In &amp;quot;KMS key&amp;quot; type a name for your key.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt; 
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail describe-trails
-                            &lt;/blockquote&gt;Check that KMS is enabled if the &amp;quot;KmsKeyId&amp;quot; property is
-                            set.
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.9" name="Enforce employee lifecycle policies" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Regular reviews of accounts on the system should be conducted to ensure that stale accounts
-                        cannot be abused either by those former employees using them or compromised by attackers.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
-                        &lt;br /&gt;At least every 90 days complete the following:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                        &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;
-                        &lt;li&gt;Click on Users.&lt;/li&gt;
-                        &lt;li&gt;For any user that should no longer exist:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;select the user,&lt;/li&gt;
-                        &lt;li&gt;click &amp;quot;User Actions&amp;quot;,&lt;/li&gt;
-                        &lt;li&gt;click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
-                            --output text&lt;/li&gt;
-                            &lt;li&gt;Ensure all users are valid users.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM4" name="Ensure IAM policies that allow full &quot;*:*&quot; administrative privileges are not attached" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.&lt;/p&gt;&lt;p&gt;Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.&lt;/p&gt;&lt;p&gt;IAM policies that have a statement with "Effect": "Allow" with "Action": "*" over "Resource": "*" should be removed.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the navigation pane, click Policies and then search for the policy name found in the audit step.&lt;/li&gt;&lt;li&gt;Select the policy that needs to be deleted.&lt;/li&gt;&lt;li&gt;In the policy action menu, select first Detach&lt;/li&gt;&lt;li&gt;Select all Users, Groups, Roles that have this policy attached&lt;/li&gt;&lt;li&gt;Click Detach Policy&lt;/li&gt;&lt;li&gt;In the policy action menu, select Detach&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges as found in the audit step:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Lists all IAM users, groups, and roles that the specified managed policy is attached to. aws iam list-entities-for-policy --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Users: aws iam detach-user-policy --user-name &amp;lt;iam_user&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Groups: aws iam detach-group-policy --group-name &amp;lt;iam_group&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name &amp;lt;iam_role&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to determine what policies are created: From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Run the following to get a list of IAM policies: aws iam list-policies --only-attached --output text&lt;/li&gt;&lt;li&gt;For each policy returned, run the following command to determine if any policies is allowing full administrative privileges on the account: aws iam get-policy-version --policy-arn &amp;lt;policy_arn&amp;gt; --version-id &amp;lt;version&amp;gt;&lt;/li&gt;&lt;li&gt;In output ensure policy should not have any Statement block with "Effect": "Allow" and Action set to "*" and Resource set to "*"&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.271">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Network-1" name="Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL to remediate, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Click Edit inbound rules&lt;/li&gt;&lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click Delete to remove the offending inbound rule&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to determine if the account is configured as prescribed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Note: A Port value of ALL or a port range such as 0-1024 are inclusive of port 22, 3389, and other remote server administration ports&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.373">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM3" name="Ensure there is only one active access key available for any single IAM user" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/li&gt;&lt;li&gt;In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.&lt;/li&gt;&lt;li&gt;If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.&lt;/li&gt;&lt;li&gt;Repeat steps no. 3 - 7 for each IAM user in your AWS account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/p&gt;&lt;p&gt;2. Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user&lt;/p&gt;&lt;p&gt;Note - the command does not return any output:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam update-access-key --access-key-id &amp;lt;access-key-id&amp;gt; --status Inactive --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.&lt;/p&gt;&lt;p&gt;4. Repeat steps no. 1 - 3 for each IAM user in your AWS account.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;Under Access Keys section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Repeat steps no. 3 - 5 for each IAM user in your AWS account.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-users command to list all IAM users within your account:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-users --query "Users[*].UserName"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all your IAM user names.&lt;/p&gt;&lt;p&gt;2. Run list-access-keys command using the IAM user name list to return the current status of each access key associated with the selected IAM user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata ("Username", "AccessKeyId", "Status", "CreateDate") for each access key on that user account.&lt;/p&gt;&lt;p&gt;3. Check the Status property value for each key returned to determine each keys current state. If the Status property value for more than one IAM access key is set to Active, the user access configuration does not adhere to this recommendation, refer to the remediation below.&lt;/p&gt;&lt;p&gt;Repeat steps no. 2 and 3 for each IAM user in your AWS account.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.8" name="Export EC2 OS logs to cloudwatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudwatch logs is an AWS service that allows you to send logs from an EC2 instance to
-                        cloudwatch via an agent installed locally on the machine. The logs are then stored centrally
-                        within cloudwatch logs and metric alerts can be configured so that security incidents can be
-                        reported to the security team. It is recommended to enable cloudwatch log monitoring on all EC2
-                        servers.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Follow the directions provided in &amp;quot;http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html&amp;quot;
-                        to install and enable Cloudwatch Logs on a new EC2 instance.
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select Cloudwatch from the services menu.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Logs&amp;quot;.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on your log group.&lt;/li&gt;
-                            &lt;li&gt;Click on your log stream.&lt;/li&gt;
-                            &lt;li&gt;Ensure event data is being captured as per the logs on your machine.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.8-5.9" name="Install an agent for AWS Cloudwatch Logs within AutoScaling Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use CloudWatch Logs to monitor, store and access log files from an Amazon EC2 instance (application or system data). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  With CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics). For example, you could set an alarm on the number of errors that occur in your system logs or view graphs of web request latency from your application logs. Log data can be stored and accessed for as long as you need using highly durable, lowcost storage so you don't have to worry about filling up hard drives. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A Cloudwatch agent needs to run within the Guest Operating System of each EC2 instance you wish to ship logs from. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a sample agent configuration file for Amazon Linux and save it as a text file (for example, awslogs.cfg) either on the AMI's filesystem, in a publicly accessible http/https location, or an Amazon S3 location (for example, s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt;):&lt;/li&gt; 
- &lt;/ul&gt; 
-  [general] 
-  state_file = /var/awslogs/state/agent-state 
-  [/var/log/messages] 
-  file = /var/log/messages 
-  log_group_name = /var/log/messages 
-  log_stream_name = {instance_id} 
-  datetime_format = %b %d %H:%M:%S 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new Web tier Autoscaling Launch Configuration with UserData populated for installing Cloudwatch Logs agent:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create and save locally a file containing the UserData, for example /tmp/UserData.txt:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     #!/bin/bashcurl https://s3.amazonaws.com/awscloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agentsetup.py./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Note: You can install the CloudWatch Logs agent by specifying the us-east-1, uswest-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, or sa-east-1 regions.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; -- user-data file:///tmp/UserData.txt 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="EC2 New Instance CWL" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html"/>
-          </references>
-          <standards>
-            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the Cloudwatch Logs agent is installed through UserData in the Web tier Autoscaling Launch Configuration:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt;--query "LaunchConfigurations[*].UserData" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Output should be similar with:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    #!/bin/bash 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agent-setup.py ./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:37:37.654">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
-                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
-                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
-                        account activity.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
-                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
-                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
-                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
-                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
-                        &lt;li&gt;Click Allow.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
-                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
-                            is set to a recent time (ie within the latest day or so).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.1" name="Launch EC2 instances into a VPC" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACLs) and routing. However, the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is recommended to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure. &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Launch Instance".&lt;/li&gt;&lt;li&gt;Complete the wizard until step 3. At this point, ensure a VPC ID is selected for the "Network" option, choose an appropriate "Subnet" and "Auto-assign Public IP" option.&lt;/li&gt;&lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;NB: If you want to migrate an already running instance you will need to convert the image into an AMI and then launch a new instance using the AMI and placing in a VPC, as per the steps above&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Instances" from the left hand menu.&lt;/li&gt;&lt;li&gt;For each instance in the list:&lt;ul&gt;&lt;li&gt;select the instance&lt;/li&gt;&lt;li&gt;in the preview pane confirm the instance has a "VPC ID". If a hyphen "-" is shown then your instance is running in EC2-Classic mode.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM7" name="Manage IAM users centrally via identity federation or AWS Organizations for multi-account environments" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;The remediation procedure will vary based on the individual organization's implementation of identity federation and/or AWS Organizations with the acceptance criteria that no non-service IAM users, and non-root accounts, are present outside the account providing centralized IAM user management.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.21" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For multi-account AWS environments with an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine the master account for identity federation or IAM user management&lt;/li&gt;&lt;li&gt;Login to that account through the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Identity providers&lt;/li&gt;&lt;li&gt;Verify the configuration&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Then..., determine all accounts that should not have local users present. For each account...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For multi-account AWS environments implementing AWS Organizations without an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Via CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review routing tables of peered VPCs for whether they route
-                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
-                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
-                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
-                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
-                            is as specific as desired.&lt;br /&gt;
-                            &lt;blockquote&gt;
-                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
-                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
-                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Gov-1.2" name="Register a Security contact for your AWS account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS will occasionally send security advisories and alerts to the account holder. By default this will go to the email address that the account is registered under. However if a security contact is specified these alerts will be sent here instead. Therefore this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
-  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt; 
-  &lt;li&gt;Click on Edit.&lt;/li&gt; 
-  &lt;li&gt;In the &amp;quot;Security&amp;quot; section complete the requested contact information.&lt;/li&gt; 
-  &lt;li&gt;Click update when complete.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
-                            &lt;li&gt;Click account name on the top right of the management console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt;
-                            &lt;li&gt;Confirm whether a contact has been set for &amp;quot;Security&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM5" name="Remove expired SSL/TLS certificates stored in AWS IAM" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To delete Expired Certificate run following command by replacing &amp;lt;CERTIFICATE_NAME&amp;gt; with the name of the certificate to delete:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam delete-server-certificate --server-certificate-name &amp;lt;CERTIFICATE_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;When the preceding command is successful, it does not return any output.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.19" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Getting the certificates expiration information via AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run list-server-certificates command to list all the IAM-stored server certificates:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-server-certificates&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc):&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ "ServerCertificateMetadataList": [ { "ServerCertificateId": "EHDGFRW7EJFYTE88D", "ServerCertificateName": "MyServerCertificate", "Expiration": "2018-07-10T23:59:59Z", "Path": "/", "Arn": "arn:aws:iam::012345678910:server-certificate/MySSLCertificate", "UploadDate": "2018-06-10T11:56:08Z" } ] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Verify the ServerCertificateName and Expiration parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ { "ServerCertificateMetadataList": [] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This means that there are no expired certificates, It DOES NOT mean that no certificates exist.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
-  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-   &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
-                            test/dev/prod).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.071">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUDITABLE-CHANGES-AWS" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails are not properly protected, an attacker could gain access to the system,
-                                modify the status of the resources or exfiltrate sensitive data without being noticed.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-ACCESS-ROOT-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM5" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM6" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM7" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM2" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM3" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.9">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM1" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-IAM1" mitigation="10"/>
-                <countermeasure ref="AWS-IAM2" mitigation="10"/>
-                <countermeasure ref="AWS-IAM3" mitigation="10"/>
-                <countermeasure ref="AWS-IAM4" mitigation="10"/>
-                <countermeasure ref="AWS-IAM5" mitigation="10"/>
-                <countermeasure ref="AWS-IAM6" mitigation="10"/>
-                <countermeasure ref="AWS-IAM7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-1.21">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
-                    <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.7" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.8" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
-                <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.7" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.8" mitigation="8"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AWS RESOURCE LOGGING" name="AWS Resource Logging" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails in the resources are not enabled or not protected, attackers could gain
-                                access to the system and modify or delete data from the resources and the changes are
-                                not detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
-                    <countermeasure ref="aws-tier-4.6" mitigation="16"/>
-                    <countermeasure ref="aws-tier-4.7" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.9">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
-                <countermeasure ref="aws-tier-4.6" mitigation="16"/>
-                <countermeasure ref="aws-tier-4.7" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="CLOUDWATCH METRIC ALERTS" name="Cloudwatch Metric Alerts" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED_ACCESS_SYSTEMS_AWS" name="Attackers access to the systems without being detected" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers gain access to the systems and they are not detected and the changes of the
-                                attackers could not be detected and audited.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
-                    <countermeasure ref="aws-tier-4.8" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.5">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="cloudwatch-misconfig">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
-                    <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
-                    <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
-                <countermeasure ref="aws-tier-4.8" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.10">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK-AWS" name="Sensitive data is compromised through undetected network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers gain undetected access to the network systems and the changes of the attackers
-                                could not be audited or detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.12">
-                  <countermeasures>
-                    <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
-                    <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
-                    <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
-                <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
-                <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="VIRTUAL PRIVATE CLOUD (VPC) NETWORK" name="Virtual Private Cloud (VPC) Network" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-Network-1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                    <countermeasure ref="aws-tier-5.12" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-Network-1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                <countermeasure ref="aws-tier-5.12" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="2ec0fe5e-c8aa-4a77-8019-35d62fd4b0ae" diagramComponentId="dfb2631f-d959-4a19-ace4-62fb552b6773" ref="bb23eb31-51d2-42fd-9350-d4db18531e34" name="VPC - Customer Instance" desc="" library="" parentComponentRef="" componentDefinitionRef="vpc">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.110">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.115">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.119">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.129">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Being highly selective in peering routing tables is a very effective way of minimizing the
-                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
-            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before you begin, make sure of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
-  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
-  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
-  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
-  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
-  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test end-to-end connectivity 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon EC2 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On the dashboard, choose Launch Instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Choose an instance type, and then choose Next: Configure Instance Details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ping 10.0.0.4 
-&lt;/div&gt; 
-&lt;div&gt;
-  Pinging 10.0.0.4 with 32 bytes of data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ping statistics for 10.0.0.4: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Approximate round trip times in milliseconds: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use SSH or RDP to connect to your instances in the VPC. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:31:55.971">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control access to VPC resources with IAM identities and policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Control access to VPC resources by using: 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Identities: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authentication is how you sign in to AWS using your identity credentials. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Identity-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Resource-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Access control lists (ACLs): 
-&lt;/div&gt; 
-&lt;div&gt;
-  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.899">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Creating CloudWatch alarms to monitor a NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm for outbound traffic through the NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm to monitor port allocation errors 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:58:07.550">
-              <output/>
-            </source>
-            <references>
-              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for VPC endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route traffic to an Amazon VPC interface endpoint 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console and open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the right pane, choose the endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the Route 53 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Hosted Zones. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create Record Set. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specify the following values: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose A - IPv4 address. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Yes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias Target 
-&lt;/div&gt; 
-&lt;div&gt;
-  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Different accounts - Enter the value that you got in step 1 of this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Routing Policy 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Evaluate Target Health 
-&lt;/div&gt; 
-&lt;div&gt;
-  Accept the default value of No. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:39:59.223">
-              <output/>
-            </source>
-            <references>
-              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:54:35.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
-                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
-                        incidents that may be occurring across the network.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Select a VPC.&lt;/li&gt;
-                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
-                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select a VPC.&lt;/li&gt;
-                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable VPC Traffic Mirroring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content inspection 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Threat monitoring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Troubleshooting 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your traffic mirror resources using any of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T13:00:52.965">
-              <output/>
-            </source>
-            <references>
-              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
-&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
-&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
-&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
-&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
-            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.909">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Via CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review routing tables of peered VPCs for whether they route
-                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
-                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
-                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
-                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
-                            is as specific as desired.&lt;br /&gt;
-                            &lt;blockquote&gt;
-                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
-                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
-                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
-  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-   &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
-                            test/dev/prod).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To get started with AWS Secrets Manager: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identify your secrets and locate where they are used in your applications. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update your applications to retrieve secrets from Secrets Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.969">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network ACLs for VPC as an additional layer of security 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following are the parts of a network ACL rule: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Source. [Inbound rules only] The source of the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow/Deny. Whether to allow or deny the specified traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the navigation pane, choose Network ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select a Network ACL to see details. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:43:47.241">
-              <output/>
-            </source>
-            <references>
-              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use VPC endpoint policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your endpoint policy can be like any IAM policy; however, take note of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:41:32.102">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.653">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                <countermeasure ref="AWS-VPC1" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                <countermeasure ref="AWS-VPC7" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="a92a46be-78b8-44e6-ac61-fb61382dfbc2" diagramComponentId="014badac-374f-4d89-8c27-42530ecd947e" ref="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" name="User - Web UI" desc="" library="" parentComponentRef="" componentDefinitionRef="web-ui">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.752">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software includes web functionality (such as a web widget)
-                        from another domain, which causes it to operate within the domain of the
-                        software, potentially granting total access and control of the software to the
-                        untrusted source.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-18T14:51:05.701">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.862">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.944">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:20:27.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.807">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component's end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:25:46.844">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Review periodically all assets which are accessed by the application and ensure that these
-                        assets are hosted by the application. If this is not the case and there are assets in external
-                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
-                        from external providers or CDNs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
-          </references>
-          <standards>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all assets are hosted by the application, and not by external providers.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T11:44:50.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform=".NET" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.033">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only request the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-09-30T09:11:03.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-30T15:19:22.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.974">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.007">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Web applications typically make extensive use of 3rd party web resources such as
-                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
-                                repositories, or even Content Delivery Networks that host these libraries, then they
-                                could gain access to applications that use this content.
-                                &lt;div&gt;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-830">
-                  <countermeasures>
-                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
-                <countermeasure ref="WEB-CSP" mitigation="33"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                <countermeasure ref="CWE-327" mitigation="33"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From ed09969954968421a19ed5e46386f87ede2c5c67 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:19:15 -0400
Subject: [PATCH 10/28] Delete Templates/aws-simple-infrastructure-with-waf.xml

---
 .../aws-simple-infrastructure-with-waf.xml    | 219 ------------------
 1 file changed, 219 deletions(-)
 delete mode 100644 Templates/aws-simple-infrastructure-with-waf.xml

diff --git a/Templates/aws-simple-infrastructure-with-waf.xml b/Templates/aws-simple-infrastructure-with-waf.xml
deleted file mode 100644
index cbfeb7b..0000000
--- a/Templates/aws-simple-infrastructure-with-waf.xml
+++ /dev/null
@@ -1,219 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="AWS - Simple infrastructure with WAF" name="AWS - Simple infrastructure with WAF" tags="Community">
-  <desc>&lt;p&gt;AWS Template&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTIzNiIgZHk9IjQyNCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjUuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDgiIHk9IjM2MCIgd2lkdGg9IjY5MSIgaGVpZ2h0PSI1NDgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBBY2NvdW50IEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRFZ01FZ3dWakZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGMyTnpJMElEQXVOamd3TXpBelNEQXVNVFU1T1RFeVZqQXVOak13T0RjNFF6QXVNVFU1T0RNeklEQXVOVGN5TmpBMUlEQXVNVGM1TXpJeUlEQXVOVEUxT1RreklEQXVNakUxTWpVMklEQXVORGN3TVRFNVF6QXVNalV4TVRnNUlEQXVOREkwTWpRMUlEQXVNekF4TkRnMElEQXVNemt4TnpZM0lEQXVNelU0TURjNElEQXVNemMzT0RreFREQXVNell6T1RNNUlEQXVNemMyTkRZMVREQXVNelk1TXpJMUlEQXVNemM1TXpFMlF6QXVNemczTXpjNElEQXVNemc0T1RneElEQXVOREEzTlRNM0lEQXVNemswTURNNElEQXVOREk0TURFMElEQXVNemswTURNNFF6QXVORFE0TkRreElEQXVNemswTURNNElEQXVORFk0TmpVeElEQXVNemc0T1RneElEQXVORGcyTnpBMElEQXVNemM1TXpFMlREQXVORGt5TURnNUlEQXVNemMyTkRZMVREQXVORGszT1RVZ01DNHpOemM0T1RGRE1DNDFORGc0TVRnZ01DNHpPVEExTURnZ01DNDFPVFEzTWprZ01DNDBNVGd4SURBdU5qSTVOelEwSURBdU5EVTNNRGs0VERBdU5qQTJNeUF3TGpRM09ETXlOVU13TGpVM05qWXdPQ0F3TGpRME5UVTFOU0F3TGpVek9ERXhOaUF3TGpReU1qQXhPU0F3TGpRNU5UUXhOaUF3TGpReE1EVXlORU13TGpRM05ESXdPQ0F3TGpReU1EZ2dNQzQwTlRBNU5EY2dNQzQwTWpZeE16a2dNQzQwTWpjek9ERWdNQzQwTWpZeE16bERNQzQwTURNNE1UUWdNQzQwTWpZeE16a2dNQzR6T0RBMU5UUWdNQzQwTWpBNElEQXVNelU1TXpRMUlEQXVOREV3TlRJMFF6QXVNekV4TURJeElEQXVOREl6TnpReklEQXVNalk0TXpjMElEQXVORFV5TkRZeklEQXVNak0zT1RVeklEQXVORGt5TWpjeVF6QXVNakEzTlRNeklEQXVOVE15TURnZ01DNHhPVEV3TWpNZ01DNDFPREEzTnpZZ01DNHhPVEE1TmlBd0xqWXpNRGczT0ZZd0xqWTBPRFl5U0RBdU5EYzJNRGxNTUM0ME56WTNNalFnTUM0Mk9EQXpNRE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOREkzTmpNMUlEQXVOREkxTURFMVF6QXVOREF6TnpNNElEQXVOREkxTURnMklEQXVNemd3TWpBM0lEQXVOREU1TVRRNUlEQXVNelU1TWpBMElEQXVOREEzTnpRNFF6QXVNek14TXprMElEQXVNemt5TlRjM0lEQXVNekE1TkRJNUlEQXVNelk0TlRjMElEQXVNamsyTnpjM0lEQXVNek01TlRORE1DNHlPRFF4TWpRZ01DNHpNVEEwT0RZZ01DNHlPREUxTURVZ01DNHlOemd3TlRVZ01DNHlPRGt6TXpNZ01DNHlORGN6TlRaRE1DNHlPVGN4TmpJZ01DNHlNVFkyTlRnZ01DNHpNVFE1T1RFZ01DNHhPRGswTkRJZ01DNHpOREF3TURZZ01DNHhOekF3TURSRE1DNHpOalV3TWpFZ01DNHhOVEExTmpZZ01DNHpPVFUzT1RnZ01DNHhOREF3TVRVZ01DNDBNamMwTnpjZ01DNHhOREF3TVRWRE1DNDBOVGt4TlRZZ01DNHhOREF3TVRVZ01DNDBPRGs1TXpNZ01DNHhOVEExTmpZZ01DNDFNVFE1TkRnZ01DNHhOekF3TURSRE1DNDFNems1TmpNZ01DNHhPRGswTkRJZ01DNDFOVGMzT1RNZ01DNHlNVFkyTlRnZ01DNDFOalUyTWpFZ01DNHlORGN6TlRaRE1DNDFOek0wTkRrZ01DNHlOemd3TlRVZ01DNDFOekE0TXlBd0xqTXhNRFE0TmlBd0xqVTFPREUzTnlBd0xqTXpPVFV6UXpBdU5UUTFOVEkxSURBdU16WTROVGMwSURBdU5USXpOVFlnTUM0ek9USTFOemNnTUM0ME9UVTNOU0F3TGpRd056YzBPRll3TGpRd056YzBPRU13TGpRM05EZ3hNaUF3TGpReE9UQXlNaUF3TGpRMU1UUXhOU0F3TGpReU5EazFOQ0F3TGpReU56WXpOU0F3TGpReU5UQXhOVnBOTUM0ME1qYzJNelVnTUM0eE56VTJOekpETUM0ME1ETXlPRGtnTUM0eE56VXlNRFVnTUM0ek56azBPVElnTUM0eE9ESTVNeUF3TGpNMk1EQTJNU0F3TGpFNU56WXdOa013TGpNME1EWXpJREF1TWpFeU1qZ3pJREF1TXpJMk5qa3lJREF1TWpNek1EWXhJREF1TXpJd05EZ3hJREF1TWpVMk5qQTNRekF1TXpFME1qY3hJREF1TWpnd01UVTBJREF1TXpFMk1UUTRJREF1TXpBMU1UQTBJREF1TXpJMU9ERXpJREF1TXpJM05EVTFRekF1TXpNMU5EYzNJREF1TXpRNU9EQTNJREF1TXpVeU16WTVJREF1TXpZNE1qWTFJREF1TXpjek56YzRJREF1TXpjNU9EWTNRekF1TXprd01UUTFJREF1TXpnNE5qUTFJREF1TkRBNE5ESTVJREF1TXprek1qTTRJREF1TkRJM01EQXlJREF1TXprek1qTTRRekF1TkRRMU5UYzBJREF1TXprek1qTTRJREF1TkRZek9EVTRJREF1TXpnNE5qUTFJREF1TkRnd01qSTJJREF1TXpjNU9EWTNRekF1TlRBeE5UTWdNQzR6Tmpnek1USWdNQzQxTVRnek5pQXdMak0wT1RrMk5pQXdMalV5T0RBME1TQXdMak15TnpjME5rTXdMalV6TnpjeU1TQXdMak13TlRVeU5pQXdMalV6T1RZNU5TQXdMakk0TURjd055QXdMalV6TXpZMUlEQXVNalUzTWpNMlF6QXVOVEkzTmpBMUlEQXVNak16TnpZMElEQXVOVEV6T0RnNElEQXVNakV5T1RnM0lEQXVORGswTmpjNElEQXVNVGs0TWpBNVF6QXVORGMxTkRZNUlEQXVNVGd6TkRNZ01DNDBOVEU0TnpFZ01DNHhOelUwT1RjZ01DNDBNamMyTXpVZ01DNHhOelUyTnpKV01DNHhOelUyTnpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmpjek5ESTJJREF1T0RZd01EUTRUREF1TlRBME9EZ3pJREF1TnpZeU56Z3lWakF1TlRZNE1Ea3hUREF1Tmpjek5ESTJJREF1TkRjd09ESTFUREF1T0RReE9UWTVJREF1TlRZNE1Ea3hWakF1TnpZeU56Z3lUREF1Tmpjek5ESTJJREF1T0RZd01EUTRXazB3TGpVek5qVTJOQ0F3TGpjME5EUXdOa3d3TGpZM016UXlOaUF3TGpneU16WXhNMHd3TGpneE1ESTRPQ0F3TGpjME5EUXdObFl3TGpVNE5UazVNa3d3TGpZM016UXlOaUF3TGpVd05qYzROVXd3TGpVek5qVTJOQ0F3TGpVNE5UazVNbFl3TGpjME5EUXdObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOek0xTmpNZ01DNDJPRE0yTnpkTU1DNDFNVEk1TXprZ01DNDFPVEV3TURSTU1DNDFNamczT0NBd0xqVTJNelU1T1V3d0xqWTNNelUyTXlBd0xqWTBOekE0TTB3d0xqZ3hPRE0wTmlBd0xqVTJNelU1T1V3d0xqZ3pOREU0TnlBd0xqVTVNVEF3TkV3d0xqWTNNelUyTXlBd0xqWTRNelkzTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT0Rrek9UWWdNQzQyTmpVMU1qZElNQzQyTlRjM01UVldNQzQ0TkRFNE5ESklNQzQyT0Rrek9UWldNQzQyTmpVMU1qZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeE1EY2lJSGt4UFNJeExqSXdOekUxSWlCNE1qMGlNUzR5TURjeE1TSWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTTROVEV4UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrWTVPVEF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjEzIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NWExZWQ2NjMtNWUzYS00NDIwLWIyY2QtZmUyZDI2ODMxZDFkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFtYXpvbi13ZWItc2VydmljZXMtZW52aXJvbm1lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzQiIHk9IjQxIiB3aWR0aD0iNjE1IiBoZWlnaHQ9IjQ5NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iQVdTIFZQQyAoVmlydHVhbCBQcml2YXRlIENsb3VkKSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtjb250YWluZXI9MDtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0xO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9NDczZWVkZTctYjk2Mi00YWQyLTg3ZDYtZGZhNzJjZTllZjM3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iMzMiIHdpZHRoPSI1MjQiIGhlaWdodD0iMjEzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkgLT4gQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgc3R5bGU9ImlyLnJlZj1kMzliNTJkOS1iNGI4LTQzY2ItODBhNS1jOGM1NDVjOGExMWE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC4yNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxNSIgc291cmNlPSIxNiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjMwMiIgeT0iNzguNSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkiIGlkPSIxNiI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWM4OWJmYWQwLWI4OGQtNDQ2Zi1hMjYzLWUzNjc1YjZhYTNjZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lYzI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNRFkyTWpnZ01DNDFNems1TlRsSU1DNDNNems1TmpGV01DNDFNVE15T1ROSU1DNDRNRFkyTWpoV01DNHhPVE15T1ROSU1DNDBPRFkyTWpoV01DNHlOVGs1TlRsSU1DNDBOVGs1TmpGV01DNHhPVE15T1RORE1DNDBOVGs1TmpFZ01DNHhPRFl5TWlBd0xqUTJNamMzSURBdU1UYzVORE0zSURBdU5EWTNOemN4SURBdU1UYzBORE0yUXpBdU5EY3lOemN5SURBdU1UWTVORE0xSURBdU5EYzVOVFUxSURBdU1UWTJOakkySURBdU5EZzJOakk0SURBdU1UWTJOakkyU0RBdU9EQTJOakk0UXpBdU9ERXpOeUF3TGpFMk5qWXlOaUF3TGpneU1EUTRNeUF3TGpFMk9UUXpOU0F3TGpneU5UUTROQ0F3TGpFM05EUXpOa013TGpnek1EUTROU0F3TGpFM09UUXpOeUF3TGpnek16STVOQ0F3TGpFNE5qSXlJREF1T0RNek1qazBJREF1TVRrek1qa3pWakF1TlRFek1qa3pRekF1T0RNek1qazBJREF1TlRJd016WTFJREF1T0RNd05EZzFJREF1TlRJM01UUTRJREF1T0RJMU5EZzBJREF1TlRNeU1UUTVRekF1T0RJd05EZ3pJREF1TlRNM01UVWdNQzQ0TVRNM0lEQXVOVE01T1RVNUlEQXVPREEyTmpJNElEQXVOVE01T1RVNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVeE16RTNJREF1T0RNek1qazBTREF1TVRrek1UY3hRekF1TVRnMk1EazRJREF1T0RNek1qazBJREF1TVRjNU16RTFJREF1T0RNd05EZzFJREF1TVRjME16RTBJREF1T0RJMU5EZzBRekF1TVRZNU16RXpJREF1T0RJd05EZ3pJREF1TVRZMk5UQTBJREF1T0RFek55QXdMakUyTmpVd05DQXdMamd3TmpZeU4xWXdMalE0TmpZeU9FTXdMakUyTmpVd05DQXdMalEzT1RVMU5TQXdMakUyT1RNeE15QXdMalEzTWpjM01pQXdMakUzTkRNeE5DQXdMalEyTnpjM01VTXdMakUzT1RNeE5TQXdMalEyTWpjM0lEQXVNVGcyTURrNElEQXVORFU1T1RZeElEQXVNVGt6TVRjeElEQXVORFU1T1RZeFNEQXVNalU1T0RNM1ZqQXVORGcyTmpJNFNEQXVNVGt6TVRjeFZqQXVPREEyTmpJM1NEQXVOVEV6TVRkV01DNDNNems1TmpGSU1DNDFNems0TXpaV01DNDRNRFkyTWpkRE1DNDFNems0TXpZZ01DNDRNVE0zSURBdU5UTTNNREkzSURBdU9ESXdORGd6SURBdU5UTXlNREkySURBdU9ESTFORGcwUXpBdU5USTNNREkxSURBdU9ETXdORGcxSURBdU5USXdNalF5SURBdU9ETXpNamswSURBdU5URXpNVGNnTUM0NE16TXlPVFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekV6TWpnNUlEQXVNemM1T1RVMVZqQXVNelV6TWpnNFNEQXVOamN6TWpnNVF6QXVOamN5TnpRZ01DNHpORFl6T1RnZ01DNDJOamszTlRRZ01DNHpNems1TXlBd0xqWTJORGcyTnlBd0xqTXpOVEEwTTBNd0xqWTFPVGs0SURBdU16TXdNVFUySURBdU5qVXpOVEV5SURBdU16STNNVGNnTUM0Mk5EWTJNaklnTUM0ek1qWTJNakZXTUM0eU9EWTJNakZJTUM0Mk1UazVOVFZXTUM0ek1qWTJNakZJTUM0MU56azVOVFZXTUM0eU9EWTJNakZJTUM0MU5UTXlPRGhXTUM0ek1qWTJNakZJTUM0MU1UTXlPRGhXTUM0eU9EWTJNakZJTUM0ME9EWTJNakpXTUM0ek1qWTJNakZJTUM0ME5EWTJNakZXTUM0eU9EWTJNakZJTUM0ME1UazVOVFZXTUM0ek1qWTJNakZJTUM0ek56azVOVFZXTUM0eU9EWTJNakZJTUM0ek5UTXlPRGhXTUM0ek1qWTJNakZETUM0ek5EWXpPVGdnTUM0ek1qY3hOeUF3TGpNek9Ua3pJREF1TXpNd01UVTJJREF1TXpNMU1EUXpJREF1TXpNMU1EUXpRekF1TXpNd01UVTJJREF1TXpNNU9UTWdNQzR6TWpjeE55QXdMak0wTmpNNU9DQXdMak15TmpZeU1TQXdMak0xTXpJNE9FZ3dMakk0TmpZeU1WWXdMak0zT1RrMU5VZ3dMak15TmpZeU1WWXdMalF4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalEwTmpZeU1VZ3dMak15TmpZeU1WWXdMalE0TmpZeU1rZ3dMakk0TmpZeU1WWXdMalV4TXpJNE9FZ3dMak15TmpZeU1WWXdMalUxTXpJNE9FZ3dMakk0TmpZeU1WWXdMalUzT1RrMU5VZ3dMak15TmpZeU1WWXdMall4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalkwTmpZeU1rZ3dMak15TmpZeU1VTXdMak15TnpFM0lEQXVOalV6TlRFeElEQXVNek13TVRVMklEQXVOalU1T1RnZ01DNHpNelV3TkRNZ01DNDJOalE0TmpkRE1DNHpNems1TXlBd0xqWTJPVGMxTkNBd0xqTTBOak01T0NBd0xqWTNNamMwSURBdU16VXpNamc0SURBdU5qY3pNamc1VmpBdU56RXpNamc1U0RBdU16YzVPVFUxVmpBdU5qY3pNamc1U0RBdU5ERTVPVFUxVmpBdU56RXpNamc1U0RBdU5EUTJOakl4VmpBdU5qY3pNamc1U0RBdU5EZzJOakl5VmpBdU56RXpNamc1U0RBdU5URXpNamc0VmpBdU5qY3pNamc1U0RBdU5UVXpNamc0VmpBdU56RXpNamc1U0RBdU5UYzVPVFUxVmpBdU5qY3pNamc1U0RBdU5qRTVPVFUxVmpBdU56RXpNamc1U0RBdU5qUTJOakl5VmpBdU5qY3pNamc1UXpBdU5qVXpOVEV5SURBdU5qY3lOelFnTUM0Mk5UazVPQ0F3TGpZMk9UYzFOQ0F3TGpZMk5EZzJOeUF3TGpZMk5EZzJOME13TGpZMk9UYzFOQ0F3TGpZMU9UazRJREF1TmpjeU56UWdNQzQyTlRNMU1URWdNQzQyTnpNeU9Ea2dNQzQyTkRZMk1qSklNQzQzTVRNeU9EbFdNQzQyTVRrNU5UVklNQzQyTnpNeU9EbFdNQzQxTnprNU5UVklNQzQzTVRNeU9EbFdNQzQxTlRNeU9EaElNQzQyTnpNeU9EbFdNQzQxTVRNeU9EaElNQzQzTVRNeU9EbFdNQzQwT0RZMk1qSklNQzQyTnpNeU9EbFdNQzQwTkRZMk1qRklNQzQzTVRNeU9EbFdNQzQwTVRrNU5UVklNQzQyTnpNeU9EbFdNQzR6TnprNU5UVklNQzQzTVRNeU9EbGFUVEF1TmpRMk5qSXlJREF1TmpRME1qSXlRekF1TmpRMk5qSXlJREF1TmpRME9EVTRJREF1TmpRMk16WTVJREF1TmpRMU5EWTVJREF1TmpRMU9URTVJREF1TmpRMU9URTVRekF1TmpRMU5EWTVJREF1TmpRMk16WTVJREF1TmpRME9EVTVJREF1TmpRMk5qSXlJREF1TmpRME1qSXlJREF1TmpRMk5qSXlTREF1TXpVMU5qZzRRekF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVME5EUXhJREF1TmpRMk16WTVJREF1TXpVek9Ua3hJREF1TmpRMU9URTVRekF1TXpVek5UUXhJREF1TmpRMU5EWTVJREF1TXpVek1qZzRJREF1TmpRME9EVTRJREF1TXpVek1qZzRJREF1TmpRME1qSXlWakF1TXpVMU5qZzRRekF1TXpVek1qZzRJREF1TXpVMU1EVXhJREF1TXpVek5UUXhJREF1TXpVME5EUXhJREF1TXpVek9Ua3hJREF1TXpVek9Ua3hRekF1TXpVME5EUXhJREF1TXpVek5UUXhJREF1TXpVMU1EVXhJREF1TXpVek1qZzRJREF1TXpVMU5qZzRJREF1TXpVek1qZzRTREF1TmpRME1qSXlRekF1TmpRME9EVTVJREF1TXpVek1qZzRJREF1TmpRMU5EWTVJREF1TXpVek5UUXhJREF1TmpRMU9URTVJREF1TXpVek9Ua3hRekF1TmpRMk16WTVJREF1TXpVME5EUXhJREF1TmpRMk5qSXlJREF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVMU5qZzRWakF1TmpRME1qSXlXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01pSWdlVEU5SWpFdU1qQTNNaUlnZURJOUlqRXVNakEzTURjaUlIa3lQU0l0TUM0eU1EY3dOamNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlORE9EVXhNVUlpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaR09Ua3dNQ0l2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE0OCIgeT0iNTciIHdpZHRoPSI5OCIgaGVpZ2h0PSI4Ny41IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkiIHN0eWxlPSJpci5yZWY9MDM5NGFjMDEtZjdkYi00MjUyLWJiNjYtZDNlYTZjYzk5NzA1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXMzO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTUM0NU9UazVPVFZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU1TURVeElEQXVOVE0wTVRnNFF6QXVPREUxTVRnMElEQXVOVEV6TWpVMUlEQXVOemt4TkRVeElEQXVORGs0TkRVMUlEQXVOemMxTVRnMElEQXVORGczT1RJeVF6QXVOelk1T1RnMElEQXVORGcwTlRnNUlEQXVOelUxTnpFNElEQXVORGM1TWpVMUlEQXVOelUwTlRFNElEQXVORGMwTlRnNVF6QXVOelUwTkRNMklEQXVORGN4TWpVZ01DNDNOVFE0T0RZZ01DNDBOamM1TVRrZ01DNDNOVFU0TlRFZ01DNDBOalEzTWpKTU1DNDNOamt4T0RRZ01DNHpOamc0TlRaRE1DNDNOek13TlRFZ01DNHpOREEzTWpJZ01DNDNOelkzT0RRZ01DNHpNVEkxT0RrZ01DNDNPREEyTlRFZ01DNHlPRFEwTlRaRE1DNDNPRFF4TVRnZ01DNHlOVGcxT0RrZ01DNDNOekUzTVRnZ01DNHlOREV5TlRZZ01DNDNOVEEyTlRFZ01DNHlNalkzTWpORE1DNDNNRGMzTVRnZ01DNHhPVFk1T0RrZ01DNDJOVEUzTVRnZ01DNHhPRFE1T1NBd0xqWXdNVEU0TkNBd0xqRTNOamN5TTBNd0xqVXpOemd4TVNBd0xqRTJOak0zTmlBd0xqUTNNek0yTlNBd0xqRTJOREkzSURBdU5EQTVORFV4SURBdU1UY3dORFUyUXpBdU16VXhPVFkySURBdU1UYzBOamMwSURBdU1qazFOVFEySURBdU1UZzRNVGd6SURBdU1qUXlNemcwSURBdU1qRXdORFUyUXpBdU1qRXpPRFV4SURBdU1qSXpOemc1SURBdU1UYzJOVEU0SURBdU1qUTBOVGc1SURBdU1UZ3hNVGcwSURBdU1qZ3dPVGc1UXpBdU1UazBOVEU0SURBdU16ZzVNalUySURBdU1qRXdNalV4SURBdU5EazNNalUxSURBdU1qSTBOemcwSURBdU5qQTFNemc0UXpBdU1qTXhORFV4SURBdU5qVTBPRFUxSURBdU1qTTRNVEU0SURBdU56QTBNekl4SURBdU1qUTBOemcwSURBdU56VXpOemc0UXpBdU1qUTFPRFlnTUM0M05qTTBNaUF3TGpJME9UUTJJREF1TnpjeU5UazRJREF1TWpVMU1qRTVJREF1Tnpnd016azBRekF1TWpZd09UYzRJREF1TnpnNE1Ua2dNQzR5TmpnMk9UTWdNQzQzT1RRek1qZ2dNQzR5TnpjMU9EUWdNQzQzT1RneE9EaERNQzR6TVRnNU1UZ2dNQzQ0TWpBMU9EZ2dNQzR6TnpBeE1UZ2dNQzQ0TWpZNU9EZ2dNQzQwTVRZeU5URWdNQzQ0TXpFeU5UUkRNQzQwTnpjMU9ETWdNQzQ0TXpZM09UUWdNQzQxTXprek9ESWdNQzQ0TXpRd05UZ2dNQzQxT1RrNU9EUWdNQzQ0TWpNeE1qRkRNQzQyTXpnek9EUWdNQzQ0TVRZd05UUWdNQzQzTURrNE5URWdNQzQ0TURRME5UUWdNQzQzTVRVNU9EUWdNQzQzTlRZME5UUkRNQzQzTWpNMU9EUWdNQzQyT1RZNU9EZ2dNQzQzTXpFNU9EUWdNQzQyTXpjMU1qRWdNQzQzTXprNU9EUWdNQzQxTnpneE9EaE1NQzQzTkRJNU1UZ2dNQzQxTmpBd05UVkRNQzQzTmpRMk5URWdNQzQxTmpVeU5UVWdNQzQ0TWpZMk5URWdNQzQxTnpZek1qSWdNQzQ0TVRrd05URWdNQzQxTXpReE9EaGFUVEF1TkRnd05qVXhJREF1TVRrek16ZzVRekF1TlRZd05qVXhJREF1TVRrek16ZzVJREF1TmpVeU1qVXhJREF1TWpBeU5EVTJJREF1TnpJek9UZzBJREF1TWpReE9USXpRekF1TnpNMU1EVXhJREF1TWpRNE1EVTJJREF1TnpZd056ZzBJREF1TWpZeE56ZzVJREF1TnpVek1EVXhJREF1TWpjNE1EVTJRekF1TnpRMU16RTRJREF1TWprME16SXpJREF1TnpJeE16RTRJREF1TXpBeU5EVTJJREF1TnpBMk5qVXhJREF1TXpBNE16SXlRekF1TmpnMU56QTRJREF1TXpFMk1EVTVJREF1TmpZME1UY2dNQzR6TWpJd056Z2dNQzQyTkRJeU5URWdNQzR6TWpZek1qSkRNQzQxTkRjd056UWdNQzR6TkRVeE56WWdNQzQwTkRrek1qa2dNQzR6TkRjeU1EY2dNQzR6TlRNME5URWdNQzR6TXpJek1qSkRNQzR6TVRBeE5UZ2dNQzR6TWpjNE5UZ2dNQzR5Tmpnd05EUWdNQzR6TVRVMU1qSWdNQzR5TWpreE9EUWdNQzR5T1RVNU1qTkRNQzR5TVRrMU9EUWdNQzR5T1RBME5UWWdNQzR5TURNM01UZ2dNQzR5T0RBMU9Ea2dNQzR5TURneE1UZ2dNQzR5TmpjMU1qTkRNQzR5TVRFMk1ETWdNQzR5TmpBMU1ESWdNQzR5TVRjd056UWdNQzR5TlRRMk5pQXdMakl5TXpnMU1TQXdMakkxTURjeU0wTXdMakkxTXpFek55QXdMakl6TVRnNE9TQXdMakk0TlRjd015QXdMakl4T0RjeU55QXdMak14T1RnMU1TQXdMakl4TVRreU0wTXdMak0zTWpVd055QXdMakU1T1RJNE1pQXdMalF5TmpVZ01DNHhPVE13TlRrZ01DNDBPREEyTlRFZ01DNHhPVE16T0RsV01DNHhPVE16T0RsYVRUQXVOamc1TnpFNElEQXVOelUxTXpnNFF6QXVOamczTnpFNElEQXVOemN3T1RnNElEQXVOall4T1RnMElEQXVOemM0TnpJeElEQXVOalE1TnpFNElEQXVOemd6TVRJeFF6QXVOakkwTWpVeElEQXVOemt4TmpRZ01DNDFPVGM1T0RJZ01DNDNPVGMxTXpjZ01DNDFOekV6TVRnZ01DNDRNREEzTWpGRE1DNDFNVEl4TlRZZ01DNDRNRGcxT0RjZ01DNDBOVEl5TVRNZ01DNDRNRGcxT0RjZ01DNHpPVE13TlRFZ01DNDRNREEzTWpGRE1DNHpOVFU1T1RZZ01DNDNPVGM0TkRZZ01DNHpNVGs0TVRJZ01DNDNPRGd3TXpFZ01DNHlPRFl6T0RRZ01DNDNOekUzT0RoRE1DNHlPREU0TXpZZ01DNDNOams0TVRFZ01DNHlOemM1TXlBd0xqYzJOall3TlNBd0xqSTNOVEV3TXlBd0xqYzJNalV6UXpBdU1qY3lNamMzSURBdU56VTRORFUySURBdU1qY3dOalF6SURBdU56VXpOamN6SURBdU1qY3dNemcwSURBdU56UTROekl4UXpBdU1qVTNNRFV4SURBdU5qUXlPVGc0SURBdU1qUXhPRFV4SURBdU5UTTNNalUxSURBdU1qSTNOVGcwSURBdU5ETXhOVEl5VERBdU1qRXlNVEU0SURBdU16RTJPRFUyUXpBdU1qUXlOREk1SURBdU16TXpOVGczSURBdU1qYzFNekk1SURBdU16UTFNVEkwSURBdU16QTVORFV4SURBdU16VXdPVGc1UXpBdU16UTFPVGs0SURBdU16VTROREkzSURBdU16Z3pNREl5SURBdU16WXpNamd6SURBdU5ESXdNalV4SURBdU16WTFOVEl5UXpBdU5Ea3pNekUxSURBdU16Y3dOelU0SURBdU5UWTJOelE1SURBdU16WTJOamd4SURBdU5qTTROemcwSURBdU16VXpNemc1UXpBdU5qYzNNVFkzSURBdU16UTNPRFk0SURBdU56RTBNalEySURBdU16TTFORGswSURBdU56UTRNalV4SURBdU16RTJPRFUyVERBdU56RTVPVGcwSURBdU5USTJNVGc0UXpBdU5qVXlOREU0SURBdU5UQXpPVEk0SURBdU5UZzJOREEySURBdU5EYzNNakF6SURBdU5USXlNemcwSURBdU5EUTJNVGc1UXpBdU5URTVOVGMxSURBdU5EUTFNVEUzSURBdU5URTJPRFUySURBdU5EUXpPREkwSURBdU5URTBNalV4SURBdU5EUXlNekl5UXpBdU5URXdOalV4SURBdU5ETTVOalUxSURBdU5URXhOVGcwSURBdU5EUXdPVGc1SURBdU5UQTVPRFV4SURBdU5ETTJPRFUxUXpBdU5UQTJOVEU0SURBdU5ESTVNalUxSURBdU5UQTFOekU0SURBdU5ESXpOVEl5SURBdU5EazROalV4SURBdU5ERTNNalUxUXpBdU5EazBPRE0ySURBdU5ERTBNaUF3TGpRNU1ETXpNaUF3TGpReE1qRXlNeUF3TGpRNE5UVXpNU0F3TGpReE1USXdOVU13TGpRNE1EY3pJREF1TkRFd01qZzNJREF1TkRjMU56YzRJREF1TkRFd05UVTJJREF1TkRjeE1UQTFJREF1TkRFeE9UZzRRekF1TkRZMk5ETXhJREF1TkRFek5ESXhJREF1TkRZeU1UYzVJREF1TkRFMU9UYzBJREF1TkRVNE56RTNJREF1TkRFNU5ESTBRekF1TkRVMU1qVTJJREF1TkRJeU9EYzFJREF1TkRVeU5qa2dNQzQwTWpjeE1Ua2dNQzQwTlRFeU5ESWdNQzQwTXpFM09EaERNQzQwTkRrM09UVWdNQzQwTXpZME5UY2dNQzQwTkRrMU1TQXdMalEwTVRRd09DQXdMalExTURReE15QXdMalEwTmpJeE1rTXdMalExTVRNeE5pQXdMalExTVRBeE5pQXdMalExTXpNM09TQXdMalExTlRVeU5pQXdMalExTmpReU1pQXdMalExT1RNMU1VTXdMalExT1RRMk5pQXdMalEyTXpFM05TQXdMalEyTXpNNU9DQXdMalEyTmpFNU9TQXdMalEyTnpnM05pQXdMalEyT0RFMU4wTXdMalEzTWpNMU5DQXdMalEzTURFeE5pQXdMalEzTnpJME15QXdMalEzTURrMUlEQXVORGd5TVRFNElEQXVORGN3TlRnNVF6QXVORGcyTnpFMElEQXVORFk1T0RJMklEQXVORGt4TVRrMElEQXVORFk0TkRneUlEQXVORGsxTkRVeElEQXVORFkyTlRnNVF6QXVOVEF3TmpVeElEQXVORFkwT1RnNUlEQXVOVEF3TmpVeElEQXVORFkxTWpVMUlEQXVOVEEyTVRFNElEQXVORFkzTnpnNVF6QXVOVGN3T1RZeUlEQXVORGs1TkRBNElEQXVOak0zTnpZMklEQXVOVEkyT0RReUlEQXVOekEyTVRFNElEQXVOVFE1T1RJeVF6QXVOekUyTXpnMElEQXVOVFV6TWpVMUlEQXVOekUyTWpVeElEQXVOVFE1T1RJeUlEQXVOekUyTWpVeElEQXVOVFU0TkRVMVF6QXVOekUxT0RFNElEQXVOVFkwT1RRM0lEQXVOekUwT1RjeUlEQXVOVGN4TkRBMElEQXVOekV6TnpFNElEQXVOVGMzTnpnNFREQXVOekExTVRnMElEQXVOalF4TXpnNFREQXVOamc1TnpFNElEQXVOelUxTXpnNFdrMHdMalE0TXprNE5DQXdMalEwTURBMU5VTXdMalE0TXprNE5DQXdMalEwTXpZMU5TQXdMalEzT0RreE9DQXdMalEwTXpJMU5TQXdMalEzTnpVNE5DQXdMalEwTURrNE9VTXdMalEzTmpJMU1TQXdMalF6T0RjeU1pQXdMalE0TXprNE5DQXdMalF6TkRrNE9TQXdMalE0TXprNE5DQXdMalEwTURBMU5WcE5NQzQzTkRZMk5URWdNQzQxTXpNek9EaE1NQzQzTlRBMk5URWdNQzQxTURNNU1qSkRNQzQzTmpNNU9EUWdNQzQxTVRFMU1qSWdNQzQzT0RZMk5URWdNQzQxTWpJNU9EZ2dNQzQzT1RJMk5URWdNQzQxTXpneE9EaERNQzQzTnprMU9EUWdNQzQxTkRNMU1qSWdNQzQzTlRnNU1UZ2dNQzQxTXpZME5UVWdNQzQzTkRZMk5URWdNQzQxTXpNek9EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEySWlCNE1qMGlNUzR5TURjd05pSWdlVEk5SWkwd0xqSXdOekEzTWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RkNOall3UmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5rTkJSVE5GSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l3TGprNU9UazVOU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI5NyIgeT0iNjEuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjcwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IlBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9ODViMGZlOGMtYTVkZC00NTIyLWEyNmUtNGFhZjQ5YTcwM2I2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQxMyIgeT0iNTUuNzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjUiIHZhbHVlPSJBV1MgV0FGIChXZWIgQXBwbGljYXRpb24gRmlyZXdhbGwpIC0+IEFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkiIHN0eWxlPSJpci5yZWY9ZmY3NGUzZjktNDU4Yi00NmVlLThiZjMtMjc3MmM2ZjA2YzRkO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuMTI5O2VudHJ5WT0wLjI2OTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjE1IiBzb3VyY2U9IjIzIiB0YXJnZXQ9IjE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJBV1MgV0FGIChXZWIgQXBwbGljYXRpb24gRmlyZXdhbGwpIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1mM2MzOTk3Zi03YWU3LTRhMDktYmZlZS05ZWNiM2RkMDY2Yjc7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIxIiB5PSI1OC41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBWUEMgRGl2aXNpb24gQiIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtjb250YWluZXI9MDtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0xO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgaWQ9IjI4Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YTRjMDY3MzQtZjAxMy00OWFlLTkwOGMtYjkwNDFmNDRjNmU5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iMjU4IiB3aWR0aD0iNTI0IiBoZWlnaHQ9IjIxMyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMjkiIHZhbHVlPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIC0+IEFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkiIHN0eWxlPSJpci5yZWY9OWUwOWMwMjgtZGY2OS00M2Q4LThjYjktMjBhYzA1NWNhN2I0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMjgiIHNvdXJjZT0iMzAiIHRhcmdldD0iMzEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzMDIiIHk9Ijc4LjUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBpZD0iMzAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1lZjU3MGRhNS03OWQxLTQ2M2MtYWM1MS1lODEzMDEzOGEyNWU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNDgiIHk9IjU3IiB3aWR0aD0iOTgiIGhlaWdodD0iODcuNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzEiIHZhbHVlPSJBV1MgUzMgKFNpbXBsZSBTdG9yYWdlIFNlcnZpY2UpIiBzdHlsZT0iaXIucmVmPTc2OTAzMjAxLWI4NWEtNDY2Ny05ZDY1LTZjYzJhZGFkMmZkNDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1zMztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01DNDVPVGs1T1RWSU1WWXdXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RFNU1EVXhJREF1TlRNME1UZzRRekF1T0RFMU1UZzBJREF1TlRFek1qVTFJREF1TnpreE5EVXhJREF1TkRrNE5EVTFJREF1TnpjMU1UZzBJREF1TkRnM09USXlRekF1TnpZNU9UZzBJREF1TkRnME5UZzVJREF1TnpVMU56RTRJREF1TkRjNU1qVTFJREF1TnpVME5URTRJREF1TkRjME5UZzVRekF1TnpVME5ETTJJREF1TkRjeE1qVWdNQzQzTlRRNE9EWWdNQzQwTmpjNU1Ua2dNQzQzTlRVNE5URWdNQzQwTmpRM01qSk1NQzQzTmpreE9EUWdNQzR6TmpnNE5UWkRNQzQzTnpNd05URWdNQzR6TkRBM01qSWdNQzQzTnpZM09EUWdNQzR6TVRJMU9Ea2dNQzQzT0RBMk5URWdNQzR5T0RRME5UWkRNQzQzT0RReE1UZ2dNQzR5TlRnMU9Ea2dNQzQzTnpFM01UZ2dNQzR5TkRFeU5UWWdNQzQzTlRBMk5URWdNQzR5TWpZM01qTkRNQzQzTURjM01UZ2dNQzR4T1RZNU9Ea2dNQzQyTlRFM01UZ2dNQzR4T0RRNU9TQXdMall3TVRFNE5DQXdMakUzTmpjeU0wTXdMalV6TnpneE1TQXdMakUyTmpNM05pQXdMalEzTXpNMk5TQXdMakUyTkRJM0lEQXVOREE1TkRVeElEQXVNVGN3TkRVMlF6QXVNelV4T1RZMklEQXVNVGMwTmpjMElEQXVNamsxTlRRMklEQXVNVGc0TVRneklEQXVNalF5TXpnMElEQXVNakV3TkRVMlF6QXVNakV6T0RVeElEQXVNakl6TnpnNUlEQXVNVGMyTlRFNElEQXVNalEwTlRnNUlEQXVNVGd4TVRnMElEQXVNamd3T1RnNVF6QXVNVGswTlRFNElEQXVNemc1TWpVMklEQXVNakV3TWpVeElEQXVORGszTWpVMUlEQXVNakkwTnpnMElEQXVOakExTXpnNFF6QXVNak14TkRVeElEQXVOalUwT0RVMUlEQXVNak00TVRFNElEQXVOekEwTXpJeElEQXVNalEwTnpnMElEQXVOelV6TnpnNFF6QXVNalExT0RZZ01DNDNOak0wTWlBd0xqSTBPVFEySURBdU56Y3lOVGs0SURBdU1qVTFNakU1SURBdU56Z3dNemswUXpBdU1qWXdPVGM0SURBdU56ZzRNVGtnTUM0eU5qZzJPVE1nTUM0M09UUXpNamdnTUM0eU56YzFPRFFnTUM0M09UZ3hPRGhETUM0ek1UZzVNVGdnTUM0NE1qQTFPRGdnTUM0ek56QXhNVGdnTUM0NE1qWTVPRGdnTUM0ME1UWXlOVEVnTUM0NE16RXlOVFJETUM0ME56YzFPRE1nTUM0NE16WTNPVFFnTUM0MU16a3pPRElnTUM0NE16UXdOVGdnTUM0MU9UazVPRFFnTUM0NE1qTXhNakZETUM0Mk16Z3pPRFFnTUM0NE1UWXdOVFFnTUM0M01EazROVEVnTUM0NE1EUTBOVFFnTUM0M01UVTVPRFFnTUM0M05UWTBOVFJETUM0M01qTTFPRFFnTUM0Mk9UWTVPRGdnTUM0M016RTVPRFFnTUM0Mk16YzFNakVnTUM0M016azVPRFFnTUM0MU56Z3hPRGhNTUM0M05ESTVNVGdnTUM0MU5qQXdOVFZETUM0M05qUTJOVEVnTUM0MU5qVXlOVFVnTUM0NE1qWTJOVEVnTUM0MU56WXpNaklnTUM0NE1Ua3dOVEVnTUM0MU16UXhPRGhhVFRBdU5EZ3dOalV4SURBdU1Ua3pNemc1UXpBdU5UWXdOalV4SURBdU1Ua3pNemc1SURBdU5qVXlNalV4SURBdU1qQXlORFUySURBdU56SXpPVGcwSURBdU1qUXhPVEl6UXpBdU56TTFNRFV4SURBdU1qUTRNRFUySURBdU56WXdOemcwSURBdU1qWXhOemc1SURBdU56VXpNRFV4SURBdU1qYzRNRFUyUXpBdU56UTFNekU0SURBdU1qazBNekl6SURBdU56SXhNekU0SURBdU16QXlORFUySURBdU56QTJOalV4SURBdU16QTRNekl5UXpBdU5qZzFOekE0SURBdU16RTJNRFU1SURBdU5qWTBNVGNnTUM0ek1qSXdOemdnTUM0Mk5ESXlOVEVnTUM0ek1qWXpNakpETUM0MU5EY3dOelFnTUM0ek5EVXhOellnTUM0ME5Ea3pNamtnTUM0ek5EY3lNRGNnTUM0ek5UTTBOVEVnTUM0ek16SXpNakpETUM0ek1UQXhOVGdnTUM0ek1qYzROVGdnTUM0eU5qZ3dORFFnTUM0ek1UVTFNaklnTUM0eU1qa3hPRFFnTUM0eU9UVTVNak5ETUM0eU1UazFPRFFnTUM0eU9UQTBOVFlnTUM0eU1ETTNNVGdnTUM0eU9EQTFPRGtnTUM0eU1EZ3hNVGdnTUM0eU5qYzFNak5ETUM0eU1URTJNRE1nTUM0eU5qQTFNRElnTUM0eU1UY3dOelFnTUM0eU5UUTJOaUF3TGpJeU16ZzFNU0F3TGpJMU1EY3lNME13TGpJMU16RXpOeUF3TGpJek1UZzRPU0F3TGpJNE5UY3dNeUF3TGpJeE9EY3lOeUF3TGpNeE9UZzFNU0F3TGpJeE1Ua3lNME13TGpNM01qVXdOeUF3TGpFNU9USTRNaUF3TGpReU5qVWdNQzR4T1RNd05Ua2dNQzQwT0RBMk5URWdNQzR4T1RNek9EbFdNQzR4T1RNek9EbGFUVEF1TmpnNU56RTRJREF1TnpVMU16ZzRRekF1TmpnM056RTRJREF1Tnpjd09UZzRJREF1TmpZeE9UZzBJREF1TnpjNE56SXhJREF1TmpRNU56RTRJREF1Tnpnek1USXhRekF1TmpJME1qVXhJREF1TnpreE5qUWdNQzQxT1RjNU9ESWdNQzQzT1RjMU16Y2dNQzQxTnpFek1UZ2dNQzQ0TURBM01qRkRNQzQxTVRJeE5UWWdNQzQ0TURnMU9EY2dNQzQwTlRJeU1UTWdNQzQ0TURnMU9EY2dNQzR6T1RNd05URWdNQzQ0TURBM01qRkRNQzR6TlRVNU9UWWdNQzQzT1RjNE5EWWdNQzR6TVRrNE1USWdNQzQzT0Rnd016RWdNQzR5T0RZek9EUWdNQzQzTnpFM09EaERNQzR5T0RFNE16WWdNQzQzTmprNE1URWdNQzR5TnpjNU15QXdMamMyTmpZd05TQXdMakkzTlRFd015QXdMamMyTWpVelF6QXVNamN5TWpjM0lEQXVOelU0TkRVMklEQXVNamN3TmpReklEQXVOelV6TmpjeklEQXVNamN3TXpnMElEQXVOelE0TnpJeFF6QXVNalUzTURVeElEQXVOalF5T1RnNElEQXVNalF4T0RVeElEQXVOVE0zTWpVMUlEQXVNakkzTlRnMElEQXVORE14TlRJeVREQXVNakV5TVRFNElEQXVNekUyT0RVMlF6QXVNalF5TkRJNUlEQXVNek16TlRnM0lEQXVNamMxTXpJNUlEQXVNelExTVRJMElEQXVNekE1TkRVeElEQXVNelV3T1RnNVF6QXVNelExT1RrNElEQXVNelU0TkRJM0lEQXVNemd6TURJeUlEQXVNell6TWpneklEQXVOREl3TWpVeElEQXVNelkxTlRJeVF6QXVORGt6TXpFMUlEQXVNemN3TnpVNElEQXVOVFkyTnpRNUlEQXVNelkyTmpneElEQXVOak00TnpnMElEQXVNelV6TXpnNVF6QXVOamMzTVRZM0lEQXVNelEzT0RZNElEQXVOekUwTWpRMklEQXVNek0xTkRrMElEQXVOelE0TWpVeElEQXVNekUyT0RVMlREQXVOekU1T1RnMElEQXVOVEkyTVRnNFF6QXVOalV5TkRFNElEQXVOVEF6T1RJNElEQXVOVGcyTkRBMklEQXVORGMzTWpBeklEQXVOVEl5TXpnMElEQXVORFEyTVRnNVF6QXVOVEU1TlRjMUlEQXVORFExTVRFM0lEQXVOVEUyT0RVMklEQXVORFF6T0RJMElEQXVOVEUwTWpVeElEQXVORFF5TXpJeVF6QXVOVEV3TmpVeElEQXVORE01TmpVMUlEQXVOVEV4TlRnMElEQXVORFF3T1RnNUlEQXVOVEE1T0RVeElEQXVORE0yT0RVMVF6QXVOVEEyTlRFNElEQXVOREk1TWpVMUlEQXVOVEExTnpFNElEQXVOREl6TlRJeUlEQXVORGs0TmpVeElEQXVOREUzTWpVMVF6QXVORGswT0RNMklEQXVOREUwTWlBd0xqUTVNRE16TWlBd0xqUXhNakV5TXlBd0xqUTROVFV6TVNBd0xqUXhNVEl3TlVNd0xqUTRNRGN6SURBdU5ERXdNamczSURBdU5EYzFOemM0SURBdU5ERXdOVFUySURBdU5EY3hNVEExSURBdU5ERXhPVGc0UXpBdU5EWTJORE14SURBdU5ERXpOREl4SURBdU5EWXlNVGM1SURBdU5ERTFPVGMwSURBdU5EVTROekUzSURBdU5ERTVOREkwUXpBdU5EVTFNalUySURBdU5ESXlPRGMxSURBdU5EVXlOamtnTUM0ME1qY3hNVGtnTUM0ME5URXlORElnTUM0ME16RTNPRGhETUM0ME5EazNPVFVnTUM0ME16WTBOVGNnTUM0ME5EazFNU0F3TGpRME1UUXdPQ0F3TGpRMU1EUXhNeUF3TGpRME5qSXhNa013TGpRMU1UTXhOaUF3TGpRMU1UQXhOaUF3TGpRMU16TTNPU0F3TGpRMU5UVXlOaUF3TGpRMU5qUXlNaUF3TGpRMU9UTTFNVU13TGpRMU9UUTJOaUF3TGpRMk16RTNOU0F3TGpRMk16TTVPQ0F3TGpRMk5qRTVPU0F3TGpRMk56ZzNOaUF3TGpRMk9ERTFOME13TGpRM01qTTFOQ0F3TGpRM01ERXhOaUF3TGpRM056STBNeUF3TGpRM01EazFJREF1TkRneU1URTRJREF1TkRjd05UZzVRekF1TkRnMk56RTBJREF1TkRZNU9ESTJJREF1TkRreE1UazBJREF1TkRZNE5EZ3lJREF1TkRrMU5EVXhJREF1TkRZMk5UZzVRekF1TlRBd05qVXhJREF1TkRZME9UZzVJREF1TlRBd05qVXhJREF1TkRZMU1qVTFJREF1TlRBMk1URTRJREF1TkRZM056ZzVRekF1TlRjd09UWXlJREF1TkRrNU5EQTRJREF1TmpNM056WTJJREF1TlRJMk9EUXlJREF1TnpBMk1URTRJREF1TlRRNU9USXlRekF1TnpFMk16ZzBJREF1TlRVek1qVTFJREF1TnpFMk1qVXhJREF1TlRRNU9USXlJREF1TnpFMk1qVXhJREF1TlRVNE5EVTFRekF1TnpFMU9ERTRJREF1TlRZME9UUTNJREF1TnpFME9UY3lJREF1TlRjeE5EQTBJREF1TnpFek56RTRJREF1TlRjM056ZzRUREF1TnpBMU1UZzBJREF1TmpReE16ZzRUREF1TmpnNU56RTRJREF1TnpVMU16ZzRXazB3TGpRNE16azROQ0F3TGpRME1EQTFOVU13TGpRNE16azROQ0F3TGpRME16WTFOU0F3TGpRM09Ea3hPQ0F3TGpRME16STFOU0F3TGpRM056VTROQ0F3TGpRME1EazRPVU13TGpRM05qSTFNU0F3TGpRek9EY3lNaUF3TGpRNE16azROQ0F3TGpRek5EazRPU0F3TGpRNE16azROQ0F3TGpRME1EQTFOVnBOTUM0M05EWTJOVEVnTUM0MU16TXpPRGhNTUM0M05UQTJOVEVnTUM0MU1ETTVNakpETUM0M05qTTVPRFFnTUM0MU1URTFNaklnTUM0M09EWTJOVEVnTUM0MU1qSTVPRGdnTUM0M09USTJOVEVnTUM0MU16Z3hPRGhETUM0M056azFPRFFnTUM0MU5ETTFNaklnTUM0M05UZzVNVGdnTUM0MU16WTBOVFVnTUM0M05EWTJOVEVnTUM0MU16TXpPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3dOamNpSUhreFBTSXhMakl3TnpBMklpQjRNajBpTVM0eU1EY3dOaUlnZVRJOUlpMHdMakl3TnpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekZDTmpZd1JpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOa05CUlRORklpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJd0xqazVPVGs1TlNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOTciIHk9IjYxLjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI3MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzIiIHZhbHVlPSJQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPWIyMjAzNmJjLWQyYmYtNGNhMi1iODhjLTRiNGQ4ZmYwNTJmYTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1wb3N0Z3Jlc3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWkRNQzQ0TXprMk5qZ2dNQzR6TkRBM056WWdNQzQyT0RjME16TWdNQzQwTVRVNU5UWWdNQzQwT1RrMk5qZ2dNQzQwTVRVNU5UWkRNQzR6TVRFNU1ETWdNQzQwTVRVNU5UWWdNQzR4TlRrMk5qZ2dNQzR6TkRBM056WWdNQzR4TlRrMk5qZ2dNQzR5TkRjNU5UWkRNQzR4TlRrMk5qZ2dNQzR4TlRVeE16WWdNQzR6TVRFNU1ETWdNQzR3TnprNU5UWXhJREF1TkRrNU5qWTRJREF1TURjNU9UVTJNVU13TGpZNE56UXpNeUF3TGpBM09UazFOakVnTUM0NE16azJOamdnTUM0eE5UVXhNellnTUM0NE16azJOamdnTUM0eU5EYzVOVFphVFRBdU9ETTVOalk0SURBdU16YzJNVGd5UXpBdU9ERTRNVGcySURBdU16azBPRFUzSURBdU56azBNamt4SURBdU5ERXdOak16SURBdU56WTROakE0SURBdU5ESXpNRGsyUXpBdU5qazJORFF6SURBdU5EVTROekV5SURBdU5qQXhNekk0SURBdU5EYzRPVFUySURBdU5EazVOalk0SURBdU5EYzRPVFUyUXpBdU16azRNREE0SURBdU5EYzRPVFUySURBdU16QXlPRGt6SURBdU5EVTROekV5SURBdU1qTXdOekk0SURBdU5ESXpNRGsyUXpBdU1qQTFNRFEySURBdU5ERXdOak16SURBdU1UZ3hNVFVnTUM0ek9UUTROVGNnTUM0eE5UazJOamdnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0eE5UazJOamdnTUM0NE5EUTNOellnTUM0ek1URTVNRE1nTUM0NU1UazVOVFlnTUM0ME9UazJOamdnTUM0NU1UazVOVFpETUM0Mk9EYzBNek1nTUM0NU1UazVOVFlnTUM0NE16azJOamdnTUM0NE5EUTNOellnTUM0NE16azJOamdnTUM0M05URTVOVFpXTUM0ek56WXhPREphVFRBdU5UZzBOelkwSURBdU5URTVPVGM0U0RBdU5UZzNNVGc0UXpBdU5qRXlORFE1SURBdU5USXdNVGMzSURBdU5qUXlOVGt4SURBdU5USTNOREUwSURBdU5qWTBPRFkxSURBdU5UVTFPRGsxUXpBdU5qWTNOekF6SURBdU5UVTVOVEUwSURBdU5qWTVPVEkzSURBdU5UWTRNVGMzSURBdU5qWTVOell4SURBdU5UZ3dNVEk0UXpBdU5qWTVOVFl4SURBdU5Ua3lNRGM0SURBdU5qWTNNamc0SURBdU5qQTNNVFkxSURBdU5qWXpNREExSURBdU5qSXpPREV5UXpBdU5qVTFNREExSURBdU5qVTBOek0wSURBdU5qUXdNREF4SURBdU5qa3hJREF1TmpFNU1UZzNJREF1TnpJek56aE1NQzQyTVRjeU9UVWdNQzQzTWpFek9VTXdMall5TlRFMk15QXdMamN3T0RNeU9DQXdMall5TmpZeU15QXdMalk1TlRBeE5pQXdMall5TmpBeU5pQXdMalk0TWpsRE1DNDJNalUzTlRJZ01DNDJOemN6SURBdU5qSTFNVEV6SURBdU5qY3hPVEF6SURBdU5qSTBOVEF6SURBdU5qWTJOelkyUXpBdU5qSXpOekE1SURBdU5qWXdNRGN5SURBdU5qSXlPVFkzSURBdU5qVXpPREU1SURBdU5qSXpNVFUxSURBdU5qUTRNVEk0UXpBdU5qSXpNelEwSURBdU5qUXlNREl5SURBdU5qSTBNVFE0SURBdU5qTTJOamswSURBdU5qSTBPVFEzSURBdU5qTXhOREF5UXpBdU5qSTFPVFl5SURBdU5qSTBOalk1SURBdU5qSTJPVFk0SURBdU5qRTNPVGsxSURBdU5qSTJOamtnTUM0Mk1EazROVFJNTUM0Mk1qWTNPRGtnTUM0Mk1EazJNemhETUM0Mk1qY3dOVFVnTUM0Mk1EZzFNallnTUM0Mk1qY3dNaklnTUM0Mk1EYzROemtnTUM0Mk1qWTVPRGdnTUM0Mk1EY3lORGhETUM0Mk1qWTVNRFVnTUM0Mk1EVTVPRGNnTUM0Mk1qWTJOek1nTUM0Mk1EUTNOelVnTUM0Mk1qWXpNalVnTUM0Mk1ETXpNekZETUM0Mk1qVTJNamdnTUM0Mk1EQTBOaUF3TGpZeU5ETTVPU0F3TGpVNU5qYzFPQ0F3TGpZeU1qVTNOQ0F3TGpVNU1qTTNOME13TGpZeE56YzBOeUF3TGpVNE1EazNJREF1TmpFeE5ESTVJREF1TlRjd01qVTFJREF1TmpBek56ZzFJREF1TlRZd05UQTVRekF1TlRreU56Z3hJREF1TlRRMk5ETTFJREF1TlRjM01UWXpJREF1TlRNeU16STNJREF1TlRVMk5EZ3lJREF1TlRJek1UWTFRekF1TlRZMU56Z3lJREF1TlRJeE1UYzRJREF1TlRjMU1qVTFJREF1TlRJd01URXhJREF1TlRnME56WTBJREF1TlRFNU9UYzRXazB3TGpRMk16TXlJREF1TlRNNU1EZ3lRekF1TkRjek9Ua3hJREF1TlRNd01qQXlJREF1TkRnNE1EWTNJREF1TlRJME1qYzNJREF1TlRBM05qZzFJREF1TlRJME1qSTNWakF1TlRJME1qWklNQzQxTURrMU9UUkRNQzQxTlRFek1pQXdMalV5TkRrME1TQXdMalUzT0RNeU5DQXdMalUwTmpBNE5pQXdMalU1TlRBd05TQXdMalUyTnpReE5FTXdMall3TWpBeU15QXdMalUzTmpNM015QXdMall3Tnpnek15QXdMalU0TmpJeE55QXdMall4TWpJNE15QXdMalU1TmpZNU1rTXdMall4TWprNE9DQXdMalU1T0RNMk5TQXdMall4TXpNMk5pQXdMalU1T1RVNE1TQXdMall4TXpjek9TQXdMall3TURjNE1rTXdMall4TXpnNE5DQXdMall3TVRJME9TQXdMall4TkRBeU9TQXdMall3TVRjeE5DQXdMall4TkRFNU1pQXdMall3TWpJd01rTXdMalU1TkRVd055QXdMall3TURJeE1TQXdMalU0TVRNNU5TQXdMall3TXpjMk15QXdMalUzTXpreU5pQXdMall4TWpNeU4wTXdMalUyTlRRNU5TQXdMall5TVRrM0lEQXVOVFkxT1RjMklEQXVOak0xTmpRM0lEQXVOVFk1TWpZeUlEQXVOalE0T0RVNFF6QXVOVGN5TlRZMUlEQXVOall5TURnMklEQXVOVGM0T1RJeUlEQXVOamMxTmpZeklEQXVOVGcwTnpZMElEQXVOamcyT0RZM1F6QXVOVGczTXpJM0lEQXVOamt4TnpjeklEQXVOVGc1TnpnM0lEQXVOamsyTWpBM0lEQXVOVGt4T0RReklEQXVOams1T1RGTU1DNDFPVEkyT0RFZ01DNDNNREUwTWpOTU1DNDFPVFk1TkRjZ01DNDNNRGswTkVNd0xqVTVPVGN6SURBdU56RTJNREl5SURBdU5qQXpORFUxSURBdU56SXlNVFkySURBdU5qQTRNREF4SURBdU56STNOamhNTUM0Mk1USXdNelFnTUM0M016TXdOelJETUM0Mk1UQTRNak1nTUM0M016TTBNak1nTUM0Mk1Ea3pORFVnTUM0M016TTVNRFFnTUM0Mk1EYzNOamdnTUM0M016UTJNVGhETUM0Mk1EUTJNVFVnTUM0M016WXdORFVnTUM0Mk1EQTVOalFnTUM0M016ZzJPRFFnTUM0MU9UZzJNRFlnTUM0M05ETkRNQzQxT1RZek1UWWdNQzQzTkRjeE9Ua2dNQzQxT1RVeU5UUWdNQzQzTlRJM01Ea2dNQzQxT1RVMU9EWWdNQzQzTlRrNE9FTXdMalU1TkRnMU5TQXdMamMyT1RNNUlEQXVOVGc0T0RFMElEQXVPREU1T1RNZ01DNDFPRFU0TVNBd0xqZ3pOek0xTjBNd0xqVTRNemd3TVNBd0xqZzBPRGs1TWlBd0xqVTRNRFkyTlNBd0xqZzFOalU1TkNBd0xqVTNOVFF4T1NBd0xqZzJNakExTkVNd0xqVTNNREUxT0NBd0xqZzJOelV4TlNBd0xqVTJNakk1TVNBd0xqZzNNVE14TmlBd0xqVTBPVFUwTkNBd0xqZzNOREExTkVNd0xqVXpORGd6T1NBd0xqZzNOekl3T0NBd0xqVXlOamM0T1NBd0xqZzNOREExTkNBd0xqVXlNVEUzT1NBd0xqZzJPVE0wTVVNd0xqVXhOVFUyT1NBd0xqZzJORFl4SURBdU5URXlORFkxSURBdU9EVTNOalUySURBdU5URXdNelF4SURBdU9EVXlNelExUXpBdU5UQTVOamt6SURBdU9EVXdOelV4SURBdU5UQTROamdnTUM0NE5EWXdNemdnTUM0MU1EYzVOamNnTUM0NE16azRORGRETUM0MU1EY3lOVFFnTUM0NE16TTJNemtnTUM0MU1EWTJPRGtnTUM0NE1qVTNOeklnTUM0MU1EWXpNRGdnTUM0NE1UWTRORE5ETUM0MU1EVTFNelFnTUM0M09UWXhOeUF3TGpVd05UUTJNeUF3TGpjM05UUTNPQ0F3TGpVd05qQTVNU0F3TGpjMU5EZ3dNVU13TGpVd05qRXhPQ0F3TGpjMU5EQTRNeUF3TGpVd05qQXdOU0F3TGpjMU16TTJOeUF3TGpVd05UYzFPU0F3TGpjMU1qWTVNME13TGpVd05UVXlOeUF3TGpjMU1UQTFJREF1TlRBMU1USTVJREF1TnpRNU5EVTJJREF1TlRBME5UZ3hJREF1TnpRM09UYzVRekF1TlRBeU5EY3pJREF1TnpReU16TTJJREF1TkRrNE5UY3pJREF1TnpNM016a2dNQzQwT1RJNE9UWWdNQzQzTXpVd016TkRNQzQwT1RFd016Y2dNQzQzTXpReU16WWdNQzQwT0RjNU1UY2dNQzQzTXpJNU1EZ2dNQzQwT0RNNU16TWdNQzQzTXpNeU5Fd3dMalE0TVRjNU1pQXdMamN6TXpZM01rTXdMalE0TXpNeE1pQXdMamN5TnprM0lEQXVORGcxTVRRMklEQXVOekl5TXpVM0lEQXVORGczTWpnM0lEQXVOekUyT0RVNVF6QXVORGc0TVRNMklEQXVOekUwTlRjeklEQXVORGc1TWpBMklEQXVOekV5TVRjMklEQXVORGt3TXpjZ01DNDNNRGsxTmpoRE1DNDBPVFk1TXpJZ01DNDJPVFE0TmpJZ01DNDFNRFkwT0RrZ01DNDJOek0wTkRVZ01DNDBPVFkxTmpVZ01DNDJNamMxTTBNd0xqUTVOREV5TkNBd0xqWXhOakkzTnlBd0xqUTROelF3TXlBd0xqWXdPRGcxT0NBd0xqUTNPVEkzSURBdU5qQTFOekExUXpBdU5EY3hNVE0zSURBdU5qQXlOVFV4SURBdU5EWXlNVFU0SURBdU5qQXpNVFE0SURBdU5EVXpPREkySURBdU5qQTFNRFUzUXpBdU5EUTFORGswSURBdU5qQTJPVGd6SURBdU5ETTNOekVnTUM0Mk1UQXpNRElnTUM0ME16RTNPRFVnTUM0Mk1UTTJNakpNTUM0ME16RTFOamdnTUM0Mk1UTTNOVFZETUM0ME16SXpORGdnTUM0Mk1ETTNNamtnTUM0ME16UXpNak1nTUM0MU9EZzVOVGdnTUM0ME5EQXdPRE1nTUM0MU56TTJPRGhETUM0ME5EUTVNamtnTUM0MU5qQTRNalVnTUM0ME5USXpNVFVnTUM0MU5EZ3lOaUF3TGpRMk16TXlJREF1TlRNNU1EZ3lXazB3TGpNNU1URXpOeUF3TGpVeU5USTNNMHd3TGpNNU56UTBOQ0F3TGpVeU5UQTVUREF1TkRBek56TTBJREF1TlRJMU1qVTJRekF1TkRJek16SWdNQzQxTWpZeU1Ua2dNQzQwTkRFME1URWdNQzQxTXpFek16RWdNQzQwTlRFMk1ESWdNQzQxTXpRMk9ETkRNQzQwTkRFeU1qZ2dNQzQxTkRRNE5ERWdNQzQwTXpRek1EY2dNQzQxTlRjek9Ea2dNQzQwTWprMk5pQXdMalUyT1Rjek9FTXdMalF5TXpFME9TQXdMalU0Tnpjd01pQXdMalF4T1RneU5DQXdMall3TmpZNElEQXVOREU1T0RNMElEQXVOakkxTnpnNFREQXVOREU1T0RVZ01DNDJNalU0T0RkV01DNDJNalU1TjFZd0xqWXlOakk0TmtNd0xqUXhPVGcxSURBdU5qSTNPVEk1SURBdU5ERTVPVGMzSURBdU5qTXdNREUySURBdU5ESXdNVE0xSURBdU5qTXlOakV6UXpBdU5ESXdNekk1SURBdU5qTTFPREV6SURBdU5ESXdOVGNnTUM0Mk16azNPRFlnTUM0ME1qQTJPQ0F3TGpZME5EWTFPVU13TGpReU1EZzNPU0F3TGpZMU16Y3lNU0F3TGpReU1EWTBPQ0F3TGpZMk5URTVJREF1TkRFNE9UTTRJREF1TmpjM05EVTJRekF1TkRFM05URTVJREF1TmpnM01EazJJREF1TkRFNE5UUTVJREF1TmprMk9UTTRJREF1TkRJeE9UTXpJREF1TnpBMk1EYzFRekF1TkRJMU16RTVJREF1TnpFMU1qRXlJREF1TkRNd09UUTVJREF1TnpJek16VWdNQzQwTXpnek1EY2dNQzQzTWprM016aERNQzQwTWpjNU16Z2dNQzQzTkRBM05TQXdMalF4TnpreE9DQXdMamMxTWpBNE5pQXdMalF3T0RJMk5TQXdMamMyTXpjelF6QXVOREF5T1RjZ01DNDNOekF3T0RjZ01DNHpPVGcyTXprZ01DNDNOekl4TmpJZ01DNHpPVFV3TXpjZ01DNDNOekl6TWpoRE1DNHpPVEUwTlRJZ01DNDNOekkwTnpjZ01DNHpPRGMxTURJZ01DNDNOekEzTURFZ01DNHpPREk1TlRRZ01DNDNOall6TURORE1DNHpOek01TWpVZ01DNDNOVGMxTURZZ01DNHpOalEwTVRRZ01DNDNNemc1TVRjZ01DNHpOVFkxTmpRZ01DNDNNVGMxTlRaRE1DNHpORGczTXlBd0xqWTVOakU1TlNBd0xqTTBNakl3TnlBd0xqWTNNakF4TWlBd0xqTXpOell3T1NBd0xqWTFNVFEyTkVNd0xqTXpNams1TlNBd0xqWXpNRGt4TmlBd0xqTXpNRE13TmlBd0xqWXhNell5TWlBd0xqTXlPVGs1TVNBd0xqWXdOelEwTjBNd0xqTXlPRE0yTkNBd0xqVTNORGd6TXlBd0xqTXpOVGd6TkNBd0xqVTFOVEV6TWlBd0xqTTBOekU0TmlBd0xqVTBNekV4TlVNd0xqTTFPRFV5TWlBd0xqVXpNVEE1T0NBd0xqTTNORE0zTXlBd0xqVXlOakl6TlNBd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTFwTk1DNDFPREl6TURnZ01DNDJNVGsyTVRORE1DNDFPRFUyTWpnZ01DNDJNVFU0TVRNZ01DNDFPVEU1TlRFZ01DNDJNVEk1TURnZ01DNDJNRE15TWpFZ01DNDJNVEkzTlRsRE1DNDJNRGN6TWpjZ01DNDJNVEkzTmpFZ01DNDJNVEUwTXlBd0xqWXhNekF5T0NBd0xqWXhOVFV3TXlBd0xqWXhNelUxTlVNd0xqWXhOVE00TkNBd0xqWXhPRGMyT0NBd0xqWXhORFk0TnlBd0xqWXlNelU0TnlBd0xqWXhNemswTWlBd0xqWXlPRGN6TjBNd0xqWXhNekV5TmlBd0xqWXpORE0zTnlBd0xqWXhNakkxTWlBd0xqWTBNRFF4TXlBd0xqWXhNakF4T0NBd0xqWTBOemM1TmtNd0xqWXhNVGMzT1NBd0xqWTFOVEF6TVNBd0xqWXhNalkxTkNBd0xqWTJNakl4TWlBd0xqWXhNelV4T1NBd0xqWTJPVE14TlVNd0xqWXhOREE1T0NBd0xqWTNOREEzTkNBd0xqWXhORFkzTXlBd0xqWTNPRGM1T1NBd0xqWXhORGt3TlNBd0xqWTRNelE0TVVNd0xqWXhOVE0xTkNBd0xqWTVNamt3T0NBd0xqWXhORFUzTXlBd0xqY3dNVGsxTkNBd0xqWXhNREl3T1NBd0xqY3hNVEUyTmtNd0xqWXdPVEUzT1NBd0xqY3dPVE0wSURBdU5qQTRNVFkzSURBdU56QTNNemd4SURBdU5qQTNNalUwSURBdU56QTFNVFUzUXpBdU5qQTJNemMySURBdU56QXpNRE0xSURBdU5qQTFNREEySURBdU56QXdOVGc1SURBdU5qQXpNVFk1SURBdU5qazNNekE1VERBdU5qQXlOREEzSURBdU5qazFPVFEyUXpBdU5qQXdNaUF3TGpZNU1UazNPU0F3TGpVNU56UTJNaUF3TGpZNE56QTVPU0F3TGpVNU5EWTBJREF1TmpneE5qY3lRekF1TlRnNE9UazNJREF1Tmpjd09ETTBJREF1TlRneU9UZzRJREF1TmpVM056ZzRJREF1TlRnd01EZzBJREF1TmpRMk1USkRNQzQxTnpjeE5qTWdNQzQyTXpRME5qZ2dNQzQxTnpjMk1URWdNQzQyTWpVd01EZ2dNQzQxT0RJek1EZ2dNQzQyTVRrMk1UTmFUVEF1TkRVMk16TXlJREF1TmpFMU9EazJRekF1TkRVNU5qZzBJREF1TmpFMU1URXhJREF1TkRZek1URXpJREF1TmpFME5qazVJREF1TkRZMk5UVTNJREF1TmpFME5qWTNRekF1TkRZNU5URTJJREF1TmpFME5qQXlJREF1TkRjeU5EWXpJREF1TmpFMU1EYzBJREF1TkRjMU1qVXpJREF1TmpFMk1EWXhRekF1TkRnd01qTXlJREF1TmpFM09UZzNJREF1TkRnek9EVWdNQzQyTWpFME1EWWdNQzQwT0RVMk56Y2dNQzQyTWprNE56RkRNQzQwT1RRNU1UWWdNQzQyTnpJMk1qSWdNQzQwT0RjME5DQXdMalk0T1RBM015QXdMalE0TURjMk5TQXdMamN3TXpjMU9VTXdMalEzT1RNM01TQXdMamN3TmpneU9DQXdMalEzT0RBeE1TQXdMamN3T1RneUlEQXVORGMyT0RRM0lEQXVOekV5T1RVNFF6QXVORGMwTlRJeklEQXVOekU1TVRneUlEQXVORGN5TVRrNUlEQXVOekkxTURreElEQXVORGN3TnpnNUlEQXVOek13T1RFM1F6QXVORFEyTlRnNUlEQXVOek13T0RnMElEQXVOREkxT1RreUlEQXVOekEzTXpneElEQXVOREk1T1RVNElEQXVOamM0T1RrNVF6QXVORE14TnpnMUlEQXVOalkxT1RNM0lEQXVORE15TURFMklEQXVOalV6T0RjeElEQXVORE14T0RFM0lEQXVOalEwTkRGRE1DNDBNekUyTnpNZ01DNDJNemd4TkRRZ01DNDBNekV6T0NBd0xqWXpNek16TXlBd0xqUXpNVEU1TWlBd0xqWXpNREl6TmtNd0xqUXpNVEV5TVNBd0xqWXlPVEEySURBdU5ETXhNRFkxSURBdU5qSTRNVE14SURBdU5ETXhNRE0zSURBdU5qSTNORFkwVERBdU5ETXhOREF5SURBdU5qSTNNVE15UXpBdU5ETXpNakl4SURBdU5qSTFOekEySURBdU5ETTFNVFU1SURBdU5qSTBORFFnTUM0ME16Y3hPVFVnTUM0Mk1qTXpORGhETUM0ME5ETXlNVFFnTUM0Mk1qQXdNalVnTUM0ME5EazJOVEVnTUM0Mk1UYzFNVGtnTUM0ME5UWXpNeklnTUM0Mk1UVTRPVFphVFRBdU5UazROemc1SURBdU5qRTRNRFV6U0RBdU5UazNPVFpXTUM0Mk1UZ3dNRE5NTUM0MU9UVXpNRFFnTUM0Mk1UZ3lNVGxETUM0MU9USTROalFnTUM0Mk1UZzFPRFFnTUM0MU9UQTNNRFlnTUM0Mk1Ua3lORGdnTUM0MU9Ea3hNVElnTUM0Mk1qQXhORFJETUM0MU9EZ3pOelVnTUM0Mk1qQTFNVElnTUM0MU9EYzNNVFVnTUM0Mk1qRXdNVGtnTUM0MU9EY3hOekVnTUM0Mk1qRTJNemhNTUM0MU9EWTJNRE1nTUM0Mk1qSTJNamhNTUM0MU9EWTBOek1nTUM0Mk1qTTNOak5ETUM0MU9EWTJNaUF3TGpZeU5EVTBPU0F3TGpVNE5qazRNeUF3TGpZeU5USTNPQ0F3TGpVNE56VXlJREF1TmpJMU9EY3hRekF1TlRnM056Z3hJREF1TmpJMk1UZzRJREF1TlRnNE1EWXhJREF1TmpJMk5EZzVJREF1TlRnNE16VTVJREF1TmpJMk56Y3lRekF1TlRnNE56WTRJREF1TmpJM01UWWdNQzQxT0RreU1Ea2dNQzQyTWpjMU1UUWdNQzQxT0RrMk56Y2dNQzQyTWpjNE1qbERNQzQxT1RFMk5UY2dNQzQyTWpreU1pQXdMalU1TkRBNElEQXVOakk1T0RJNUlEQXVOVGsyTkRneUlEQXVOakk1TlRNNVF6QXVOVGs0T1RVZ01DNDJNamt4TVRJZ01DNDJNREV5TURVZ01DNDJNamM0TnpRZ01DNDJNREk0T0RrZ01DNDJNall3TWtNd0xqWXdNek15TVNBd0xqWXlOVFUzTmlBd0xqWXdNemN4TmlBd0xqWXlOVEE1TnlBd0xqWXdOREEyT0NBd0xqWXlORFU0T0VNd0xqWXdORE13TXlBd0xqWXlOREkwT0NBd0xqWXdORFV4T1NBd0xqWXlNemc1TlNBd0xqWXdORGN4TkNBd0xqWXlNelV6UXpBdU5qQTFNVEkxSURBdU5qSXlPRFU0SURBdU5qQTFNekk0SURBdU5qSXlNRGM0SURBdU5qQTFNamsxSURBdU5qSXhNamxNTUM0Mk1EVXpNVElnTUM0Mk1qRXhOVGRNTUM0Mk1EUTRPRE1nTUM0Mk1qQXhNVEpNTUM0Mk1EUXdOamNnTUM0Mk1Ua3pNekZETUM0Mk1ETTNOek1nTUM0Mk1Ua3hNemdnTUM0Mk1ETTBOVEVnTUM0Mk1UZzVOeUF3TGpZd016QTVPU0F3TGpZeE9EZ3lOVU13TGpZd01qWTVOU0F3TGpZeE9EWTFPU0F3TGpZd01qSTFOU0F3TGpZeE9EVXlOU0F3TGpZd01UYzNOeUF3TGpZeE9EUXhPRU13TGpZd01UQTVOaUF3TGpZeE9ESTFNU0F3TGpZd01ETXpOaUF3TGpZeE9ERTBOQ0F3TGpVNU9UVXhPU0F3TGpZeE9EQTRPRU13TGpVNU9USTRJREF1TmpFNE1EY3lJREF1TlRrNU1ETTNJREF1TmpFNE1EWXhJREF1TlRrNE56ZzVJREF1TmpFNE1EVXpXazB3TGpRM01Ea3lNaUF3TGpZeU1UQTFOMHd3TGpRMk9ERTJOaUF3TGpZeU1EZzBNa3d3TGpRMk9ERTBPU0F3TGpZeU1Ea3dPRU13TGpRMk5qUXlOU0F3TGpZeU1EZ3lNU0F3TGpRMk5EWTVPU0F3TGpZeU1UQTBOaUF3TGpRMk16QTFOQ0F3TGpZeU1UVTNNa013TGpRMk1UWXhJREF1TmpJeU1EZzJJREF1TkRZd01UTXpJREF1TmpJek1ERTJJREF1TkRVNU9EZzBJREF1TmpJME9EQTRRekF1TkRVNU56YzRJREF1TmpJMU9ETTJJREF1TkRZd01ERTNJREF1TmpJMk9EY2dNQzQwTmpBMU5qVWdNQzQyTWpjM05EWkRNQzQwTmpFd09EUWdNQzQyTWpnM05ESWdNQzQwTmpFM05ETWdNQzQyTWprMk5Ua2dNQzQwTmpJMU1qTWdNQzQyTXpBME5qaERNQzQwTmpRek5UVWdNQzQyTXpJME56Z2dNQzQwTmpZNE1TQXdMall6TXpneE1TQXdMalEyT1RRNU5DQXdMall6TkRJMU1rTXdMalEzTWpFeE9TQXdMall6TkRVM05TQXdMalEzTkRjM01TQXdMall6TXprd05pQXdMalEzTmpreklEQXVOak15TXpjM1F6QXVORGMzT0RJMElEQXVOak14TnpnZ01DNDBOemcyTWpRZ01DNDJNekV3TlRNZ01DNDBOemt6TURNZ01DNDJNekF5TVRsRE1DNDBOems1TlRZZ01DNDJNamsxTURVZ01DNDBPREF6T0RrZ01DNDJNamcyTVRnZ01DNDBPREExTkRnZ01DNDJNamMyTmpORE1DNDBPREExTnpJZ01DNDJNamMwTWprZ01DNDBPREExTnpRZ01DNDJNamN4T1RRZ01DNDBPREExTlRRZ01DNDJNalk1TmpGRE1DNDBPREExTXpFZ01DNDJNalkyT0RrZ01DNDBPREEwTnpjZ01DNDJNalkwTWlBd0xqUTRNRE01TkNBd0xqWXlOakUxT1VNd0xqUTRNREkwSURBdU5qSTFOamN6SURBdU5EYzVPVGczSURBdU5qSTFNakkxSURBdU5EYzVOalV4SURBdU5qSTBPRFF5UXpBdU5EYzVNRE0xSURBdU5qSTBNVEU1SURBdU5EYzRNamcySURBdU5qSXpOVEl5SURBdU5EYzNORFEwSURBdU5qSXpNRGd5UXpBdU5EYzFOekU0SURBdU5qSXlNRGcySURBdU5EY3pORFl4SURBdU5qSXhOREEySURBdU5EY3dPVEl5SURBdU5qSXhNRFUzV2swd0xqWXhPRFE1SURBdU56UXlOek0wVERBdU5qRTROVFFnTUM0M05ESTNNVGhETUM0Mk1qQXlNRE1nTUM0M05EUXdPU0F3TGpZeU1qQTJJREF1TnpRMU1Ua3lJREF1TmpJME1EVXhJREF1TnpRMk1ESXhRekF1TmpNeU1EWTRJREF1TnpRNU16SXpJREF1TmpRMU1UUTJJREF1TnpVd05qQXlJREF1TmpZNE1qWTJJREF1TnpRMU9ESXhRekF1TmpZek5UWTBJREF1TnpRNU9UVTBJREF1TmpVNE1qa3pJREF1TnpVek16a3hJREF1TmpVeU5qRTJJREF1TnpVMk1ESTVRekF1TmpRMU5qazBJREF1TnpVNU1qUTVJREF1TmpNeU5qWTFJREF1TnpZeE56SXlJREF1TmpJeU1EYzFJREF1TnpZeE9ETTRRekF1TmpFMk56WTBJREF1TnpZeE9USXhJREF1TmpFeUlEQXVOell4TXpVM0lEQXVOakE1TVRZeUlEQXVOell3TkRrMFF6QXVOakE0TWpnM0lEQXVOell3TWpReElEQXVOakEzTkRVM0lEQXVOelU1T0RRNUlEQXVOakEyTnpBM0lEQXVOelU1TXpNeVF6QXVOakEyTkRReElEQXVOelV6TlRjeUlEQXVOakEzTXpNM0lEQXVOelV3TVRnMklEQXVOakE0TXpneUlEQXVOelE0TWpjNFF6QXVOakE1TWpJMklEQXVOelEyTmpRNUlEQXVOakV3TmpNNElEQXVOelExTXpnMUlEQXVOakV5TXpVZ01DNDNORFEzTWpaRE1DNDJNVE15TnpZZ01DNDNORFF6TVRjZ01DNDJNVFF5T1RrZ01DNDNORFF3TWpJZ01DNDJNVFUwTXpVZ01DNDNORE0yT1RWRE1DNDJNVFl6TnpJZ01DNDNORE0wTWpVZ01DNDJNVGN6T0RjZ01DNDNORE14TXpJZ01DNDJNVGcwT1NBd0xqYzBNamN6TkZwTk1DNDBPRFE0T1RjZ01DNDNORFF5TnpoSU1DNDBPRFV5TkRWV01DNDNORFF6TVRGRE1DNDBPRFl3TVRJZ01DNDNORFEwTURZZ01DNDBPRFkzTmpjZ01DNDNORFExT0RJZ01DNDBPRGMwT1RRZ01DNDNORFE0TXpaRE1DNDBPRGM0T0RJZ01DNDNORFE1TnpFZ01DNDBPRGd5TmpFZ01DNDNORFV4TWpnZ01DNDBPRGcyTXpFZ01DNDNORFV6TURkRE1DNDBPVEEwTWpNZ01DNDNORFl3TlRRZ01DNDBPVEk1TmpNZ01DNDNORGczTWpZZ01DNDBPVFF4TWpRZ01DNDNOVEU0TTBNd0xqUTVOVEkzSURBdU56VTBPVE16SURBdU5EazFNVEl4SURBdU56VTNPREl5SURBdU5Ea3pOekkzSURBdU56VTVOemhETUM0ME9EVTJORE1nTUM0M056RXhNVFlnTUM0ME56WXhOallnTUM0M056VTBPREVnTUM0ME5qY3dOVFFnTUM0M056Y3dOREZETUM0ME5UYzVORElnTUM0M056ZzFPRFVnTUM0ME5Ea3lNVElnTUM0M056Y3dOREVnTUM0ME5ETTVJREF1TnpjMU56RTBRekF1TkRReU1ESTFJREF1TnpjMU1qTXlJREF1TkRNNU56QXhJREF1TnpjME16VXpJREF1TkRNM09Ea3lJREF1Tnpjek16VTNRekF1TkRNM01UWXhJREF1TnpjeU9UYzFJREF1TkRNM01qRXlJREF1TnpjeU9EYzJJREF1TkRNMk56TWdNQzQzTnpJME56ZERNQzQwTXpneU1qUWdNQzQzTnpFM05qTWdNQzQwTkRBME5qVWdNQzQzTnpBNE9EUWdNQzQwTkRRek9ESWdNQzQzTnpBd09EZERNQzQwTlRZM05EY2dNQzQzTmpjMU5EZ2dNQzQwTmpJNU16Z2dNQzQzTmpVMU1qTWdNQzQwTmpjM01ERWdNQzQzTmpFM016bERNQzQwTnpBMk1UTWdNQzQzTlRrME1UVWdNQzQwTnpJMU1ERWdNQzQzTlRZNU9UTWdNQzQwTnpRNE5EZ2dNQzQzTlRNNU9ETkRNQzQwTnpZek5ERWdNQzQzTlRJd05qZ2dNQzQwTnpnd01pQXdMamMwT1RreE5TQXdMalE0TURJMk5pQXdMamMwTnpNNU9FTXdMalE0TWpjek9DQXdMamMwTkRZMklEQXVORGcwTURFMklEQXVOelEwTXpZeElEQXVORGcwT0RrM0lEQXVOelEwTWpjNFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0MTMiIHk9IjU1Ljc1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iQVdTIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSAtPiBBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBzdHlsZT0iaXIucmVmPWZhM2U5YTc2LTc5NDYtNDY3OC1hNzdjLWU5YTNlMmFlYzdmZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjEyOTtlbnRyeVk9MC4yNjk7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyOCIgc291cmNlPSIzNCIgdGFyZ2V0PSIzMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM0IiB2YWx1ZT0iQVdTIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSIgc3R5bGU9ImlyLnJlZj1lZjdhZmRjZS0zZmQ1LTQ0OTgtODRiZi1mNDBkYzI0MTI4YjA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMSIgeT0iNTguNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzNSIgdmFsdWU9IkhSIiBzdHlsZT0idGV4dDtodG1sPTE7cmVzaXphYmxlPTA7ZWRpdGFibGU9MDtkZWxldGFibGU9MDtjb25uZWN0YWJsZT0wO3BvaW50cz1bXTtpci50eXBlPUNPTVBPTkVOVF9UQUc7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxLjMiIHk9IjAuNDUiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTUiIHk9IjM2MCIgd2lkdGg9IjE0OSIgaGVpZ2h0PSIzMzUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik91dCBPZiBTY29wZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW91dC1vZi1zY29wZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJMk5DSWdhR1ZwWjJoMFBTSTJOQ0lnZG1sbGQwSnZlRDBpTUNBd0lEWTBJRFkwSWlCbWFXeHNQU0p1YjI1bElqNG1JM2hoT3p4emRIbHNaVDRtSTNoaE95QWdJQ0F1YVdOdmJpMW1hV3hzSUhzbUkzaGhPeUFnSUNBZ0lDQWdabWxzYkRvZ0l6RXhRVGhEUmpzbUkzaGhPeUFnSUNCOUppTjRZVHM4TDNOMGVXeGxQaVlqZUdFN1BIQmhkR2dnWkQwaVRUTXhMams1T1RnZ09TNDFPVFk1TWtNek9DNHdNelFnT1M0MU9UWTVNaUEwTXk0MU1URWdNVEV1T1RneU5pQTBOeTQxTXpreElERTFMamcyTWpGRE5EY3VOalUwSURFMUxqazBNVGNnTkRjdU56WXpNU0F4Tmk0d016STFJRFEzTGpnMk5USWdNVFl1TVRNME5rTTBOeTQ1TmpjeklERTJMakl6TmpjZ05EZ3VNRFU0TVNBeE5pNHpORFU0SURRNExqRXpOellnTVRZdU5EWXdOVU0xTWk0d01UY3pJREl3TGpRNE9Ea2dOVFF1TkRBeU9TQXlOUzQ1TmpVNUlEVTBMalF3TWprZ016SkROVFF1TkRBeU9TQTBOQzR6TnpNZ05EUXVNemN5TnlBMU5DNDBNRE15SURNeExqazVPVGdnTlRRdU5EQXpNa014T1M0Mk1qWTVJRFUwTGpRd016SWdPUzQxT1RZMk9DQTBOQzR6TnpNZ09TNDFPVFkyT0NBek1rTTVMalU1TmpZNElERTVMall5TnpFZ01Ua3VOakkyT1NBNUxqVTVOamt5SURNeExqazVPVGdnT1M0MU9UWTVNbHBOTkRZdU1EWXpJREl4TGpJM01qWk1NakV1TWpjeU5DQTBOaTR3TmpNeVF6STBMakkwTnprZ05EZ3VNek0yTkNBeU55NDVOall5SURRNUxqWTROamNnTXpFdU9UazVPQ0EwT1M0Mk9EWTNRelF4TGpjMk56a2dORGt1TmpnMk55QTBPUzQyT0RZMUlEUXhMamMyT0RFZ05Ea3VOamcyTlNBek1rTTBPUzQyT0RZMUlESTRMakV5TnpnZ05EZ3VORFF5TVNBeU5DNDFORFl4SURRMkxqTXpNVE1nTWpFdU5qTXpNa3cwTmk0d05qTWdNakV1TWpjeU5scE5NekV1T1RrNU9DQXhOQzR6TVRNMFF6SXlMakl6TVRjZ01UUXVNekV6TkNBeE5DNHpNVE14SURJeUxqSXpNaUF4TkM0ek1UTXhJRE15UXpFMExqTXhNekVnTXpZdU1ETXpOeUF4TlM0Mk5qTTBJRE01TGpjMU1pQXhOeTQ1TXpZMklEUXlMamN5TnpWTU5ESXVOekkzTWlBeE55NDVNelk1UXpNNUxqYzFNVGNnTVRVdU5qWXpOeUF6Tmk0d016TTBJREUwTGpNeE16UWdNekV1T1RrNU9DQXhOQzR6TVRNMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMjEiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03Y2I4N2VjMS1lMDllLTQxZWEtOTkyNC03Y2IxNTc4N2I0MTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3V0LW9mLXNjb3BlO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjEyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEyIiB5PSI0MCIgd2lkdGg9IjEyNiIgaGVpZ2h0PSIyNjciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9YzI1YTg0N2YtMmYyZS00Nzc2LWE2ODEtMGFmZTM2ZWI3YTQyOyIgcGFyZW50PSIyMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNy41IiB5PSI3OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNCIgdmFsdWU9IkdlbmVyaWMgQ2xpZW50IC0+IEFXUyBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuMTY4O2VudHJ5WT0wLjI3NDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTEwODM5NTc4LTdhMjYtNDNiMS05YTcyLTU4MmQ0Y2E0Zjk3NDtpci50YWdzPVBvcnQgNDQzLFRMUzsiIHBhcmVudD0iMSIgc291cmNlPSIyMiIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjIwMiIgeT0iNTExIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjciIHZhbHVlPSJHZW5lcmljIENsaWVudCAtPiBBV1MgQWNjb3VudCBFbnZpcm9ubWVudCIgc3R5bGU9ImlyLnJlZj03ZTRkNjNhMS1hMjdkLTQ0ODQtYjQ0MC1jZGRhZjQzOTdlNDE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC4wMDE7ZW50cnlZPTAuMTYyO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgc291cmNlPSIyMiIgdGFyZ2V0PSIxMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets>
-    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
-      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="Generic Client -&gt; AWS WAF (Web Application Firewall)" ref="10839578-7a26-43b1-9a72-582d4ca4f974" source="5d4241cb-f507-4801-bce7-9fddeb295c9b" target="cc0f6f94-1d00-460d-9770-ca34b35bf4ae">
-      <assets/>
-      <tags>
-        <tag tag="Port 443"/>
-        <tag tag="TLS"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; AWS Account Environment" ref="7e4d63a1-a27d-4484-b440-cddaf4397e41" source="5d4241cb-f507-4801-bce7-9fddeb295c9b" target="b6e6ff98-a72c-4bfb-ae01-c6987520c15e">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS EC2 (Elastic Compute Cloud) -&gt; AWS S3 (Simple Storage Service)" ref="9e09c028-df69-43d8-8cb9-20ac055ca7b4" source="7becc80b-902f-48f2-9a79-2cee1f8c6c8e" target="264938b2-0327-4077-9242-58aa381563f7">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS EC2 (Elastic Compute Cloud) -&gt; AWS S3 (Simple Storage Service)" ref="d39b52d9-b4b8-43cb-80a5-c8c545c8a11a" source="10a6d491-1de3-4e75-ac59-b04533518e9c" target="5ddc7008-c98a-4ab4-914e-3889c47874d0">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS WAF (Web Application Firewall) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="fa3e9a76-7946-4678-a77c-e9a3e2aec7ff" source="99f36fa6-c259-43bb-b805-74ca5ad05ffd" target="7becc80b-902f-48f2-9a79-2cee1f8c6c8e">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS WAF (Web Application Firewall) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="ff74e3f9-458b-46ee-8bf3-2772c6f06c4d" source="cc0f6f94-1d00-460d-9770-ca34b35bf4ae" target="10a6d491-1de3-4e75-ac59-b04533518e9c">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="6857e855-7501-4dec-9d14-04da6700e2cc" diagramComponentId="5a1ed663-5e3a-4420-b2cd-fe2d26831d1d" ref="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" name="AWS Account Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="dfb2890f-3147-4003-81e0-0969e3dcc04b" diagramComponentId="ef570da5-79d1-463c-ac51-e8130138a25e" ref="7becc80b-902f-48f2-9a79-2cee1f8c6c8e" name="AWS EC2 (Elastic Compute Cloud)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="ec2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="6e649c56-0865-4823-94be-206b30c7da6a" diagramComponentId="85b0fe8c-a5dd-4522-a26e-4aaf49a703b6" ref="d7b34c8c-822f-4170-ba02-b2cee8c08249" name="PostgreSQL" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="4fa37b71-ca5f-4c16-ab4c-6fe44516251e" diagramComponentId="473eede7-b962-4ad2-87d6-dfa72ce9ef37" ref="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" name="AWS VPC (Virtual Private Cloud)" desc="" library="" parentComponentRef="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" componentDefinitionRef="vpc">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="55f1cadb-cd32-4614-976d-d83164ba5c60" diagramComponentId="0394ac01-f7db-4252-bb66-d3ea6cc99705" ref="5ddc7008-c98a-4ab4-914e-3889c47874d0" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Credit Card Data" accessType="10"/>
-        <asset name="Credit Card Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="76ce4171-394f-408f-8f94-62a191605bd3" diagramComponentId="a4c06734-f013-49ae-908c-b9041f44c6e9" ref="56b8349f-2c06-496e-a379-fb91a0144298" name="AWS VPC Division B" desc="" library="" parentComponentRef="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" componentDefinitionRef="vpc">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="b49e8846-3572-4024-b716-71e5b0365e4d" diagramComponentId="c25a847f-2f2e-4776-a681-0afe36eb7a42" ref="5d4241cb-f507-4801-bce7-9fddeb295c9b" name="Generic Client" desc="" library="" parentComponentRef="f9fa7542-689c-422f-a121-97602b6a8440" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets>
-        <asset name="Credit Card Data" accessType="40"/>
-      </assets>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="e03cf0c0-6368-40bc-9a4a-83de4ef69c18" diagramComponentId="b22036bc-d2bf-4ca2-b88c-4b4d8ff052fa" ref="ec96a34a-2c41-4f14-8304-4a43c9fc4b4f" name="PostgreSQL" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="7ea13731-e5c5-4460-9e1e-dc5ec0016a83" diagramComponentId="c89bfad0-b88d-446f-a263-e3675b6aa3cd" ref="10a6d491-1de3-4e75-ac59-b04533518e9c" name="AWS EC2 (Elastic Compute Cloud)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="ec2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Credit Card Data" accessType="10"/>
-        <asset name="Credit Card Data" accessType="20"/>
-        <asset name="Credit Card Data" accessType="40"/>
-        <asset name="Credit Card Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="0bc19a69-6117-4e22-b453-bafcd928c1b3" diagramComponentId="ef7afdce-3fd5-4498-84bf-f40dc24128b0" ref="99f36fa6-c259-43bb-b805-74ca5ad05ffd" name="AWS WAF (Web Application Firewall)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="CD-WAF">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="e7ad2639-a9d9-4d9a-b23a-30f596a6e449" diagramComponentId="7cb87ec1-e09e-41ea-9924-7cb15787b411" ref="f9fa7542-689c-422f-a121-97602b6a8440" name="Out Of Scope" desc="" library="" parentComponentRef="" componentDefinitionRef="out-of-scope">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="4007a097-0b22-4580-845a-58f0284596cc" diagramComponentId="76903201-b85a-4667-9d65-6cc2adad2fd4" ref="264938b2-0327-4077-9242-58aa381563f7" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="597b6e8c-2ea1-4926-9ece-3ffee5a35b67" diagramComponentId="f3c3997f-7ae7-4a09-bfee-9ecb3dd066b7" ref="cc0f6f94-1d00-460d-9770-ca34b35bf4ae" name="AWS WAF (Web Application Firewall)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="CD-WAF">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Credit Card Data" accessType="40"/>
-        <asset name="Credit Card Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-  </components>
-</template>

From 61d0fc6109d1d2da38d0ce7f1fa74820c92a9947 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:20:39 -0400
Subject: [PATCH 11/28] Delete
 Templates/aws-web-application-remote-access-web-ui-access.xml

---
 ...pplication-remote-access-web-ui-access.xml | 29169 ----------------
 1 file changed, 29169 deletions(-)
 delete mode 100644 Templates/aws-web-application-remote-access-web-ui-access.xml

diff --git a/Templates/aws-web-application-remote-access-web-ui-access.xml b/Templates/aws-web-application-remote-access-web-ui-access.xml
deleted file mode 100644
index 1110bb2..0000000
--- a/Templates/aws-web-application-remote-access-web-ui-access.xml
+++ /dev/null
@@ -1,29169 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="two-examples-template" name="AWS - Web Application (Remote Access + Web UI Access)" tags="Community">
-  <desc>&lt;p&gt;This project shows &lt;strong&gt;two&lt;/strong&gt; simple threat models:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;One that is remotely accessed by a user&lt;/li&gt;
- &lt;li&gt;Another that builds on this by having external monitoring made available to a Security team via. their SIEM.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Made by &lt;a target="_blank"&gt;Jonny Tennyson&lt;/a&gt;&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjM4OCIgZHk9IjE3MzciIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS40LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMDY4IiB5PSIyNiIgd2lkdGg9IjE3OSIgaGVpZ2h0PSIxNzYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MDE0YmFkYWMtMzc0Zi00ZDg5LThjMjctNDI1MzBlY2Q5NDdlOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjQ2Ljc1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii03NDIiIHk9Ii0zOCIgd2lkdGg9IjYyMCIgaGVpZ2h0PSI1OTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBBY2NvdW50IEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0iaXIucmVmPWMxYTEyNzZmLTQxMWEtNGFlYi04MThjLWE0YjYwNTExMmM1MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hbWF6b24td2ViLXNlcnZpY2VzLWVudmlyb25tZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEVnTUVnd1ZqRklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzJOekkwSURBdU5qZ3dNekF6U0RBdU1UVTVPVEV5VmpBdU5qTXdPRGM0UXpBdU1UVTVPRE16SURBdU5UY3lOakExSURBdU1UYzVNekl5SURBdU5URTFPVGt6SURBdU1qRTFNalUySURBdU5EY3dNVEU1UXpBdU1qVXhNVGc1SURBdU5ESTBNalExSURBdU16QXhORGcwSURBdU16a3hOelkzSURBdU16VTRNRGM0SURBdU16YzNPRGt4VERBdU16WXpPVE01SURBdU16YzJORFkxVERBdU16WTVNekkxSURBdU16YzVNekUyUXpBdU16ZzNNemM0SURBdU16ZzRPVGd4SURBdU5EQTNOVE0zSURBdU16azBNRE00SURBdU5ESTRNREUwSURBdU16azBNRE00UXpBdU5EUTRORGt4SURBdU16azBNRE00SURBdU5EWTROalV4SURBdU16ZzRPVGd4SURBdU5EZzJOekEwSURBdU16YzVNekUyVERBdU5Ea3lNRGc1SURBdU16YzJORFkxVERBdU5EazNPVFVnTUM0ek56YzRPVEZETUM0MU5EZzRNVGdnTUM0ek9UQTFNRGdnTUM0MU9UUTNNamtnTUM0ME1UZ3hJREF1TmpJNU56UTBJREF1TkRVM01EazRUREF1TmpBMk15QXdMalEzT0RNeU5VTXdMalUzTmpZd09DQXdMalEwTlRVMU5TQXdMalV6T0RFeE5pQXdMalF5TWpBeE9TQXdMalE1TlRReE5pQXdMalF4TURVeU5FTXdMalEzTkRJd09DQXdMalF5TURnZ01DNDBOVEE1TkRjZ01DNDBNall4TXprZ01DNDBNamN6T0RFZ01DNDBNall4TXpsRE1DNDBNRE00TVRRZ01DNDBNall4TXprZ01DNHpPREExTlRRZ01DNDBNakE0SURBdU16VTVNelExSURBdU5ERXdOVEkwUXpBdU16RXhNREl4SURBdU5ESXpOelF6SURBdU1qWTRNemMwSURBdU5EVXlORFl6SURBdU1qTTNPVFV6SURBdU5Ea3lNamN5UXpBdU1qQTNOVE16SURBdU5UTXlNRGdnTUM0eE9URXdNak1nTUM0MU9EQTNOellnTUM0eE9UQTVOaUF3TGpZek1EZzNPRll3TGpZME9EWXlTREF1TkRjMk1EbE1NQzQwTnpZM01qUWdNQzQyT0RBek1ETmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5ESTNOak0xSURBdU5ESTFNREUxUXpBdU5EQXpOek00SURBdU5ESTFNRGcySURBdU16Z3dNakEzSURBdU5ERTVNVFE1SURBdU16VTVNakEwSURBdU5EQTNOelE0UXpBdU16TXhNemswSURBdU16a3lOVGMzSURBdU16QTVOREk1SURBdU16WTROVGMwSURBdU1qazJOemMzSURBdU16TTVOVE5ETUM0eU9EUXhNalFnTUM0ek1UQTBPRFlnTUM0eU9ERTFNRFVnTUM0eU56Z3dOVFVnTUM0eU9Ea3pNek1nTUM0eU5EY3pOVFpETUM0eU9UY3hOaklnTUM0eU1UWTJOVGdnTUM0ek1UUTVPVEVnTUM0eE9EazBORElnTUM0ek5EQXdNRFlnTUM0eE56QXdNRFJETUM0ek5qVXdNakVnTUM0eE5UQTFOallnTUM0ek9UVTNPVGdnTUM0eE5EQXdNVFVnTUM0ME1qYzBOemNnTUM0eE5EQXdNVFZETUM0ME5Ua3hOVFlnTUM0eE5EQXdNVFVnTUM0ME9EazVNek1nTUM0eE5UQTFOallnTUM0MU1UUTVORGdnTUM0eE56QXdNRFJETUM0MU16azVOak1nTUM0eE9EazBORElnTUM0MU5UYzNPVE1nTUM0eU1UWTJOVGdnTUM0MU5qVTJNakVnTUM0eU5EY3pOVFpETUM0MU56TTBORGtnTUM0eU56Z3dOVFVnTUM0MU56QTRNeUF3TGpNeE1EUTROaUF3TGpVMU9ERTNOeUF3TGpNek9UVXpRekF1TlRRMU5USTFJREF1TXpZNE5UYzBJREF1TlRJek5UWWdNQzR6T1RJMU56Y2dNQzQwT1RVM05TQXdMalF3TnpjME9GWXdMalF3TnpjME9FTXdMalEzTkRneE1pQXdMalF4T1RBeU1pQXdMalExTVRReE5TQXdMalF5TkRrMU5DQXdMalF5TnpZek5TQXdMalF5TlRBeE5WcE5NQzQwTWpjMk16VWdNQzR4TnpVMk56SkRNQzQwTURNeU9Ea2dNQzR4TnpVeU1EVWdNQzR6TnprME9USWdNQzR4T0RJNU15QXdMak0yTURBMk1TQXdMakU1TnpZd05rTXdMak0wTURZeklEQXVNakV5TWpneklEQXVNekkyTmpreUlEQXVNak16TURZeElEQXVNekl3TkRneElEQXVNalUyTmpBM1F6QXVNekUwTWpjeElEQXVNamd3TVRVMElEQXVNekUyTVRRNElEQXVNekExTVRBMElEQXVNekkxT0RFeklEQXVNekkzTkRVMVF6QXVNek0xTkRjM0lEQXVNelE1T0RBM0lEQXVNelV5TXpZNUlEQXVNelk0TWpZMUlEQXVNemN6TnpjNElEQXVNemM1T0RZM1F6QXVNemt3TVRRMUlEQXVNemc0TmpRMUlEQXVOREE0TkRJNUlEQXVNemt6TWpNNElEQXVOREkzTURBeUlEQXVNemt6TWpNNFF6QXVORFExTlRjMElEQXVNemt6TWpNNElEQXVORFl6T0RVNElEQXVNemc0TmpRMUlEQXVORGd3TWpJMklEQXVNemM1T0RZM1F6QXVOVEF4TlRNZ01DNHpOamd6TVRJZ01DNDFNVGd6TmlBd0xqTTBPVGsyTmlBd0xqVXlPREEwTVNBd0xqTXlOemMwTmtNd0xqVXpOemN5TVNBd0xqTXdOVFV5TmlBd0xqVXpPVFk1TlNBd0xqSTRNRGN3TnlBd0xqVXpNelkxSURBdU1qVTNNak0yUXpBdU5USTNOakExSURBdU1qTXpOelkwSURBdU5URXpPRGc0SURBdU1qRXlPVGczSURBdU5EazBOamM0SURBdU1UazRNakE1UXpBdU5EYzFORFk1SURBdU1UZ3pORE1nTUM0ME5URTROekVnTUM0eE56VTBPVGNnTUM0ME1qYzJNelVnTUM0eE56VTJOekpXTUM0eE56VTJOekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN6TkRJMklEQXVPRFl3TURRNFREQXVOVEEwT0RneklEQXVOell5TnpneVZqQXVOVFk0TURreFREQXVOamN6TkRJMklEQXVORGN3T0RJMVREQXVPRFF4T1RZNUlEQXVOVFk0TURreFZqQXVOell5TnpneVREQXVOamN6TkRJMklEQXVPRFl3TURRNFdrMHdMalV6TmpVMk5DQXdMamMwTkRRd05rd3dMalkzTXpReU5pQXdMamd5TXpZeE0wd3dMamd4TURJNE9DQXdMamMwTkRRd05sWXdMalU0TlRrNU1rd3dMalkzTXpReU5pQXdMalV3TmpjNE5Vd3dMalV6TmpVMk5DQXdMalU0TlRrNU1sWXdMamMwTkRRd05sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56TTFOak1nTUM0Mk9ETTJOemRNTUM0MU1USTVNemtnTUM0MU9URXdNRFJNTUM0MU1qZzNPQ0F3TGpVMk16VTVPVXd3TGpZM016VTJNeUF3TGpZME56QTRNMHd3TGpneE9ETTBOaUF3TGpVMk16VTVPVXd3TGpnek5ERTROeUF3TGpVNU1UQXdORXd3TGpZM016VTJNeUF3TGpZNE16WTNOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJPRGt6T1RZZ01DNDJOalUxTWpkSU1DNDJOVGMzTVRWV01DNDROREU0TkRKSU1DNDJPRGt6T1RaV01DNDJOalUxTWpkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN4TURjaUlIa3hQU0l4TGpJd056RTFJaUI0TWowaU1TNHlNRGN4TVNJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSTBNNE5URXhRaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtZNU9UQXdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMjkiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1jMWExMjc2Zi00MTFhLTRhZWItODE4Yy1hNGI2MDUxMTJjNTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI4IiB5PSI0MCIgd2lkdGg9IjU2OCIgaGVpZ2h0PSI1MzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjkiIHZhbHVlPSJBUEkgLSBJL08iIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZETUM0Mk5ETTVORE1nTUM0NE1qQXdPREVnTUM0Mk5ERXhPRGdnTUM0NE1Ua3hPVFFnTUM0Mk16ZzVNREVnTUM0NE1UYzFNemRETUM0Mk16Y3hOemdnTUM0NE1UWXpNU0F3TGpZek5UYzNNU0F3TGpneE5EWTVNU0F3TGpZek5EYzVOeUF3TGpneE1qZ3hNME13TGpZek16Z3lOQ0F3TGpneE1Ea3pOU0F3TGpZek16TXhNU0F3TGpnd09EZzFNeUF3TGpZek16TXdNU0F3TGpnd05qY3pOMVl3TGpFNU16UXdORU13TGpZek16TXhJREF1TVRreE1USTFJREF1TmpNek9UQTBJREF1TVRnNE9EZzNJREF1TmpNMU1ESTBJREF1TVRnMk9UQXpRekF1TmpNMk1UUTBJREF1TVRnME9URTVJREF1TmpNM056VTFJREF1TVRnek1qVTFJREF1TmpNNU56QXhJREF1TVRneU1EY3hRekF1TmpReE5qWTVJREF1TVRnd056azNJREF1TmpRek9UTTNJREF1TVRnd01EWTFJREF1TmpRMk1qYzRJREF1TVRjNU9UUTRRekF1TmpRNE5qRTVJREF1TVRjNU9ETXhJREF1TmpVd09UUTVJREF1TVRnd016TXpJREF1TmpVek1ETTBJREF1TVRneE5EQTBUREF1T0RJMk16WTNJREF1TWpZMk1EY3hRekF1T0RJNE5Ua3hJREF1TWpZM01UWWdNQzQ0TXpBME5qZ2dNQzR5TmpnNE5EY2dNQzQ0TXpFM09EWWdNQzR5TnpBNU5ETkRNQzQ0TXpNeE1EVWdNQzR5TnpNd016a2dNQzQ0TXpNNE1UUWdNQzR5TnpVME5qRWdNQzQ0TXpNNE16UWdNQzR5TnpjNU16ZFdNQzQzTkRreE16ZERNQzQ0TXpNNU56Y2dNQzQzTlRJd05qRWdNQzQ0TXpNeE5UUWdNQzQzTlRRNU5URWdNQzQ0TXpFME9URWdNQzQzTlRjek5qRkRNQzQ0TWprNE1qZ2dNQzQzTlRrM056RWdNQzQ0TWpjME1Ua2dNQzQzTmpFMU5qWWdNQzQ0TWpRMk16UWdNQzQzTmpJME56Rk1NQzQyTlRFek1ERWdNQzQ0TWpBd056RkRNQzQyTkRrM09UY2dNQzQ0TWpBeU9EY2dNQzQyTkRneU56RWdNQzQ0TWpBeU9EY2dNQzQyTkRZM05qY2dNQzQ0TWpBd056RmFUVEF1TmpZd01UQXhJREF1TWpFME9EY3hWakF1TnpnNE1qQTBUREF1T0RBMk56WTNJREF1TnpNNU5UTTNWakF1TWpnMk1qQTBUREF1TmpZd01UQXhJREF1TWpFME9EY3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTFNelF6TXlBd0xqZ3lNREEzUXpBdU16VXlNREUzSURBdU9ESXdNall6SURBdU16VXdOVGd5SURBdU9ESXdNall6SURBdU16UTVNVFkySURBdU9ESXdNRGRNTUM0eE56VTRNek1nTUM0M05qSTBOME13TGpFM016QTNNeUF3TGpjMk1UVTBNeUF3TGpFM01EWTVNeUF3TGpjMU9UY3pOeUF3TGpFMk9UQTFOaUF3TGpjMU56TXpRekF1TVRZM05ERTVJREF1TnpVME9USXlJREF1TVRZMk5qRTBJREF1TnpVeU1EUTFJREF1TVRZMk56WTJJREF1TnpRNU1UTTNWakF1TWpjM09UTTNRekF1TVRZMk56ZzJJREF1TWpjMU5EWXhJREF1TVRZM05EazFJREF1TWpjek1ETTVJREF1TVRZNE9ERTBJREF1TWpjd09UUXpRekF1TVRjd01UTXpJREF1TWpZNE9EUTNJREF1TVRjeU1EQTVJREF1TWpZM01UWWdNQzR4TnpReU16TWdNQzR5TmpZd056Rk1NQzR6TkRjMU5qWWdNQzR4T0RFME1EUkRNQzR6TkRrMk5URWdNQzR4T0RBek16TWdNQzR6TlRFNU9ERWdNQzR4TnprNE16RWdNQzR6TlRRek1qSWdNQzR4TnprNU5EaERNQzR6TlRZMk5qTWdNQzR4T0RBd05qVWdNQzR6TlRnNU16SWdNQzR4T0RBM09UY2dNQzR6TmpBNE9Ua2dNQzR4T0RJd056RkRNQzR6TmpJNE1qRWdNQzR4T0RNeU56RWdNQzR6TmpRME1EVWdNQzR4T0RRNU5ESWdNQzR6TmpVMU1ERWdNQzR4T0RZNU1qVkRNQzR6TmpZMU9UZ2dNQzR4T0RnNU1EZ2dNQzR6TmpjeE56RWdNQzR4T1RFeE16Z2dNQzR6TmpjeE5qWWdNQzR4T1RNME1EUldNQzQ0TURZM016ZERNQzR6TmpjeE5UWWdNQzQ0TURnNE5USWdNQzR6TmpZMk5ETWdNQzQ0TVRBNU16VWdNQzR6TmpVMk55QXdMamd4TWpneE0wTXdMak0yTkRZNU5pQXdMamd4TkRZNU1TQXdMak0yTXpJNE9TQXdMamd4TmpNeElEQXVNell4TlRZMklEQXVPREUzTlRNM1F6QXVNelU1TWpNMElEQXVPREU1TXpBMUlEQXVNelUyTXpVM0lEQXVPREl3TWpBeUlEQXVNelV6TkRNeklEQXVPREl3TURkV01DNDRNakF3TjFwTk1DNHhPVE0wTXpNZ01DNDNOREF3TjB3d0xqTTBNREVnTUM0M09EZzNNemRXTUM0eU1UVTBNRFJNTUM0eE9UTTBNek1nTUM0eU9EY3dNRFJXTUM0M05EQXdOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek15TnpJZ01DNHpOalkyTXpKSU1DNDFPVE15TnpKV01DNHpNems1TmpaSU1DNDJNek15TnpKV01DNHpOalkyTXpKYVRUQXVOVFV6TWpjeUlEQXVNelkyTmpNeVNEQXVOVEV6TWpjeVZqQXVNek01T1RZMlNEQXVOVFV6TWpjeVZqQXVNelkyTmpNeVdrMHdMalEzTXpJM01pQXdMak0yTmpZek1rZ3dMalF6TXpJM01sWXdMak16T1RrMk5rZ3dMalEzTXpJM01sWXdMak0yTmpZek1scE5NQzR6T1RNeU56RWdNQzR6TmpZMk16SklNQzR6TlRNeU56RldNQzR6TXprNU5qWklNQzR6T1RNeU56RldNQzR6TmpZMk16SmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qTXpNamN5SURBdU5qWXdNRGc1U0RBdU5Ua3pNamN5VmpBdU5qTXpOREl6U0RBdU5qTXpNamN5VmpBdU5qWXdNRGc1V2swd0xqVTFNekkzTWlBd0xqWTJNREE0T1Vnd0xqVXhNekkzTWxZd0xqWXpNelF5TTBnd0xqVTFNekkzTWxZd0xqWTJNREE0T1ZwTk1DNDBOek15TnpJZ01DNDJOakF3T0RsSU1DNDBNek15TnpKV01DNDJNek0wTWpOSU1DNDBOek15TnpKV01DNDJOakF3T0RsYVRUQXVNemt6TWpjeElEQXVOall3TURnNVNEQXVNelV6TWpjeFZqQXVOak16TkRJelNEQXVNemt6TWpjeFZqQXVOall3TURnNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRME1UVXlJREF1TlRRMU9UTk1NQzR6T1RFek9EWWdNQzQxTURNeE0wTXdMak00T1RreU15QXdMalV3TVRnM09DQXdMak00T0RjME9DQXdMalV3TURNeU5DQXdMak00TnprME1pQXdMalE1T0RVM05VTXdMak00TnpFek5pQXdMalE1TmpneU5pQXdMak00TmpjeE9TQXdMalE1TkRreU15QXdMak00TmpjeE9TQXdMalE1TWprNU4wTXdMak00TmpjeE9TQXdMalE1TVRBM01TQXdMak00TnpFek5pQXdMalE0T1RFMk9DQXdMak00TnprME1pQXdMalE0TnpReE9FTXdMak00T0RjME9DQXdMalE0TlRZMk9TQXdMak00T1RreU15QXdMalE0TkRFeE5TQXdMak01TVRNNE5pQXdMalE0TWpnMk0wd3dMalEwTVRNNE5pQXdMalEwTURBMk0wd3dMalExT0RjeUlEQXVORFl3TXpOTU1DNDBNakExT0RZZ01DNDBPVE16T1RkTU1DNDBOVGczTWlBd0xqVXlOakEyTTB3d0xqUTBNVFV5SURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFU0TnpJMklEQXVOVFExT1ROTU1DNDFOREV6T1RNZ01DNDFNalUyTmpOTU1DNDFOemsxTWpVZ01DNDBPVE16T1RkTU1DNDFOREV5TmlBd0xqUTJNRGcyTTB3d0xqVTFPRFU1TXlBd0xqUTBNREEyTTB3d0xqWXdPRGN5TlNBd0xqUTRNamN6UXpBdU5qRXdNVGc0SURBdU5EZ3pPVGd5SURBdU5qRXhNell6SURBdU5EZzFOVE0ySURBdU5qRXlNVFk1SURBdU5EZzNNamcxUXpBdU5qRXlPVGMxSURBdU5EZzVNRE0wSURBdU5qRXpNemt5SURBdU5Ea3dPVE00SURBdU5qRXpNemt5SURBdU5Ea3lPRFl6UXpBdU5qRXpNemt5SURBdU5EazBOemc1SURBdU5qRXlPVGMxSURBdU5EazJOamt6SURBdU5qRXlNVFk1SURBdU5EazRORFF5UXpBdU5qRXhNell6SURBdU5UQXdNVGt4SURBdU5qRXdNVGc0SURBdU5UQXhOelExSURBdU5qQTROekkxSURBdU5UQXlPVGszVERBdU5UVTROekkySURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEV6TmpnNUlEQXVOREUzTWpJMlREQXVORFl3TmpreklEQXVOVGN6T1RjMVREQXVORGcxT1RVMUlEQXVOVGd5TlRFMVREQXVOVE00T1RVeElEQXVOREkxTnpZM1REQXVOVEV6TmpnNUlEQXVOREUzTWpJMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3hNU0lnZURJOUlqRXVNakEzTVRVaUlIa3lQU0l0TUM0eU1EY3hNRGNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlNMFJESTNRVGdpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBFeE5qWkdSaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTM1MWNlOTNhLTUzY2QtNDFlNy1iNmZkLWE3ZWZmYzk5N2FjMzsiIHBhcmVudD0iMjkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTUiIHk9IjcxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iQ2xvdWRXYXRjaCIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWNsb3Vkd2F0Y2g7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNVGs1T0RnZ01DNDJNems1TlROSU1DNHlOek16TWpGRE1DNHlOVGcwT0RVZ01DNDJNemsyTmpZZ01DNHlORFF3TURnZ01DNDJNelV6TXpNZ01DNHlNekUwTlRVZ01DNDJNamMwTWtNd0xqSXhNVEkwTlNBd0xqWXhOVEF6T1NBd0xqRTVORFl6SURBdU5UazNOVGd6SURBdU1UZ3pNall4SURBdU5UYzJOemczUXpBdU1UY3hPRGt6SURBdU5UVTFPVGt4SURBdU1UWTJNVFkzSURBdU5UTXlOVGd5SURBdU1UWTJOalUxSURBdU5UQTRPRGcyUXpBdU1UWTFNams1SURBdU5EZ3hOelFnTUM0eE56TXhNRGNnTUM0ME5UUTVNallnTUM0eE9EZzRNalVnTUM0ME16STNOVEpETUM0eU1EUTFORE1nTUM0ME1UQTFOemdnTUM0eU1qY3lOVGdnTUM0ek9UUXpNeUF3TGpJMU16TXlNU0F3TGpNNE5qWXlRekF1TWpVek16SXhJREF1TXpnek1UVXpJREF1TWpVek16SXhJREF1TXpjNU5qZzJJREF1TWpVek16SXhJREF1TXpjMk1qSkRNQzR5TlRRd05USWdNQzR6TkRJek5EUWdNQzR5TmpReE9URWdNQzR6TURrek16Z2dNQzR5T0RJMk1EUWdNQzR5T0RBNE9UUkRNQzR6TURFd01UZ2dNQzR5TlRJME5TQXdMak15TmprNElEQXVNakk1TmpnNElEQXVNelUzTlRnNElEQXVNakUxTVRVelF6QXVNemt3TkRnMklEQXVNakF3TlRrNElEQXVOREkzTURjeUlEQXVNVGsyTlRNNUlEQXVORFl5TXpZZ01DNHlNRE0xTTBNd0xqUTVOelkwT0NBd0xqSXhNRFV5TVNBd0xqVXlPVGt5TXlBd0xqSXlPREl5TWlBd0xqVTFORGM0T0NBd0xqSTFOREl5UXpBdU5UY3hOVEF5SURBdU1qY3hNalF5SURBdU5UZzFNRFE0SURBdU1qa3hNVEE1SURBdU5UazBOemc0SURBdU16RXlPRGcyUXpBdU5qQTROamd5SURBdU16QXhOamN5SURBdU5qSTFPVGs0SURBdU1qazFOVFUxSURBdU5qUXpPRFUwSURBdU1qazFOVFV6UXpBdU5qZ3dNVEl4SURBdU1qazFOVFV6SURBdU56SXdPVEl4SURBdU16SXpNRElnTUM0M01qZ3pPRGNnTUM0ek9ETXlPRFpETUM0M05qSTJOVFFnTUM0ek9URTBNaUF3TGpnek16QTFOQ0F3TGpReE9UUXlJREF1T0RNek1EVTBJREF1TlRFd01EZzJRekF1T0RNME1qRTVJREF1TlRNeU56a3lJREF1T0RJNE9UQTVJREF1TlRVMU16WXhJREF1T0RFM056UTBJREF1TlRjMU1UWTJRekF1T0RBMk5UYzVJREF1TlRrME9UY3hJREF1Tnprd01ERTNJREF1TmpFeE1UazJJREF1TnpZNU9UZzNJREF1TmpJeE9UVXpUREF1TnpVMk5qVTBJREF1TlRrNE5qSkRNQzQzTnpJME5EUWdNQzQxT1RBd09DQXdMamM0TlRRM01TQXdMalUzTnpJeE5pQXdMamM1TkRJd09TQXdMalUyTVRVek5VTXdMamd3TWprME55QXdMalUwTlRnMU5DQXdMamd3TnpBek15QXdMalV5T0RBd055QXdMamd3TlRrNE55QXdMalV4TURBNE5rTXdMamd3TlRrNE55QXdMalF6TVRZNE5pQXdMamMwTVRBMU5DQXdMalF4TWpJeUlEQXVOekV5TmpVMElEQXVOREEzTkRKRE1DNDNNVEE1TVNBd0xqUXdOekV3T1NBd0xqY3dPVEkwTlNBd0xqUXdOalExTkNBd0xqY3dOemMxTnlBd0xqUXdOVFE1TWtNd0xqY3dOakkyT1NBd0xqUXdORFV6TVNBd0xqY3dORGs0TnlBd0xqUXdNekk0TWlBd0xqY3dNems0TnlBd0xqUXdNVGd5UXpBdU56QXlNRE15SURBdU16azVNREkzSURBdU56QXhNakl4SURBdU16azFOVGt5SURBdU56QXhOekl4SURBdU16a3lNakpETUM0Mk9UYzROVFFnTUM0ek5ETTRNaUF3TGpZMk9UVTROeUF3TGpNeU1qSXlJREF1TmpRek1EVTBJREF1TXpJeU1qSkRNQzQyTXpRMk1EUWdNQzR6TWpJeU9UVWdNQzQyTWpZeU9USWdNQzR6TWpRek56Y2dNQzQyTVRnNE1EVWdNQzR6TWpneU9UVkRNQzQyTVRFek1UY2dNQzR6TXpJeU1UTWdNQzQyTURRNE5qY2dNQzR6TXpjNE5UUWdNQzQxT1RrNU9EZ2dNQzR6TkRRM05UTkRNQzQxT1RnMU5Ua2dNQzR6TkRZM01EZ2dNQzQxT1RZMk1qWWdNQzR6TkRneU16Z2dNQzQxT1RRek9UUWdNQzR6TkRreE56ZERNQzQxT1RJeE5qTWdNQzR6TlRBeE1UY2dNQzQxT0RrM01UY2dNQzR6TlRBME16RWdNQzQxT0Rjek1qRWdNQzR6TlRBd09EWkRNQzQxT0RRNU16SWdNQzR6TkRrM01USWdNQzQxT0RJMk9TQXdMak0wT0RZNU5pQXdMalU0TURnek5TQXdMak0wTnpFME5rTXdMalUzT0RrNElEQXVNelExTlRrMklEQXVOVGMzTlRnZ01DNHpORE0xTnlBd0xqVTNOamM0T0NBd0xqTTBNVEk0TmtNd0xqVTJPREE1TkNBd0xqTXhOVFk1TlNBd0xqVTFNemM1SURBdU1qa3lNemN4SURBdU5UTTBPVEl4SURBdU1qY3pNREpETUM0MU1UTTRNalVnTUM0eU5URXhNamtnTUM0ME9EWTFNekVnTUM0eU16WXlNalFnTUM0ME5UWTNNU0F3TGpJek1ETXhNME13TGpReU5qZzRPU0F3TGpJeU5EUXdNU0F3TGpNNU5UazNNeUF3TGpJeU56YzJOU0F3TGpNMk9ERXlNU0F3TGpJek9UazFNME13TGpNME1qUXpPQ0F3TGpJMU1qUTBOaUF3TGpNeU1EWTFOQ0F3TGpJM01UY3hOaUF3TGpNd05URXlNaUF3TGpJNU5UWTRORU13TGpJNE9UVTVJREF1TXpFNU5qVXlJREF1TWpnd09EazVJREF1TXpRM05EQTNJREF1TWpjNU9UZzRJREF1TXpjMU9UVXpRekF1TWpnZ01DNHpPREl4TURJZ01DNHlPREF6TlRZZ01DNHpPRGd5TkRRZ01DNHlPREV3TlRVZ01DNHpPVFF6TlRORE1DNHlPREUwT0RZZ01DNHpPVGMzTXpNZ01DNHlPREEyTURnZ01DNDBNREV4TlNBd0xqSTNPRFU1T1NBd0xqUXdNemt3TWtNd0xqSTNOalU1TVNBd0xqUXdOalkxTkNBd0xqSTNNell3TlNBd0xqUXdPRFV6TXlBd0xqSTNNREkxTlNBd0xqUXdPVEUxTTBNd0xqSTBOelU1SURBdU5ERXpOemcxSURBdU1qSTNNelF6SURBdU5ESTJOREF5SURBdU1qRXpNVGs0SURBdU5EUTBOekEyUXpBdU1UazVNRFUwSURBdU5EWXpNREV4SURBdU1Ua3hPVFV6SURBdU5EZzFOemcySURBdU1Ua3pNVGc0SURBdU5UQTRPRGcyUXpBdU1Ua3lOakk0SURBdU5USTRNRGszSURBdU1UazNNVGcySURBdU5UUTNNVEVnTUM0eU1EWXpPVE1nTUM0MU5qTTVOemxETUM0eU1UVTJNREVnTUM0MU9EQTRORGdnTUM0eU1qa3hNamdnTUM0MU9UUTVOallnTUM0eU5EVTFPRGdnTUM0Mk1EUTRPRFpETUM0eU5UTTRPQ0F3TGpZeE1ERTVNaUF3TGpJMk16UTNPU0F3TGpZeE16RWdNQzR5TnpNek1qRWdNQzQyTVRNeU9EWklNQzQwTVRrNU9EaFdNQzQyTXprNU5UTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTRORGsxSURBdU56RTVPVGMzVERBdU56SXpPREk0SURBdU5qSTBPVEZETUM0M016YzBNRE1nTUM0MU9UUTBNaUF3TGpjek9UYzJNU0F3TGpVMk1ERXhNaUF3TGpjek1EUTROU0F3TGpVeU9EQTFNa013TGpjeU1USXdPQ0F3TGpRNU5UazVNU0F3TGpjd01EZzVOU0F3TGpRMk9ESTBNeUF3TGpZM016RXpOeUF3TGpRME9UY3hNa013TGpZME5UTTNPQ0F3TGpRek1URTRNU0F3TGpZeE1UazJNaUF3TGpReU16QTJNaUF3TGpVM09EYzVOU0F3TGpReU5qYzRPRU13TGpVME5UWXlPU0F3TGpRek1EVXhOU0F3TGpVeE5EZzBPQ0F3TGpRME5UZzBPQ0F3TGpRNU1UZzVOQ0F3TGpRM01EQTNOME13TGpRMk9EazBJREF1TkRrME16QTJJREF1TkRVMU1qa3lJREF1TlRJMU9EY3hJREF1TkRVek16WXlJREF1TlRVNU1UbERNQzQwTlRFME16SWdNQzQxT1RJMU1TQXdMalEyTVRNME5TQXdMall5TlRRek9TQXdMalE0TVRNME9DQXdMalkxTWpFMU5rTXdMalV3TVRNMU1TQXdMalkzT0RnM015QXdMalV6TURFMU5pQXdMalk1TnpZMU9DQXdMalUyTWpZM01TQXdMamN3TlRFNE9VTXdMalU1TlRFNE5TQXdMamN4TWpjeE9TQXdMall5T1RNeE5pQXdMamN3T0RVeE1pQXdMalkxT1RBeU9DQXdMalk1TXpNeFREQXVOelV5TXpZeElEQXVOemcyTmpRelF6QXVOell4TWpZMklEQXVOemsxTXpNZ01DNDNOek15TlRZZ01DNDRNREF4TWpVZ01DNDNPRFUyT1RVZ01DNDNPVGs1TnpkRE1DNDNPVEU0TXpZZ01DNDRNREF3TmpJZ01DNDNPVGM1TXpJZ01DNDNPVGc1TWpjZ01DNDRNRE0yTXpFZ01DNDNPVFkyTXpoRE1DNDRNRGt6TXpFZ01DNDNPVFF6TlNBd0xqZ3hORFV4T1NBd0xqYzVNRGsxTWlBd0xqZ3hPRGc1TlNBd0xqYzROalkwTTBNd0xqZ3lNekkzTVNBd0xqYzRNakkxTXlBd0xqZ3lOamN6TkNBd0xqYzNOekEwSURBdU9ESTVNRGcwSURBdU56Y3hNekExUXpBdU9ETXhORE0xSURBdU56WTFOVFk1SURBdU9ETXlOakkySURBdU56VTVOREkxSURBdU9ETXlOVGc1SURBdU56VXpNakkzUXpBdU9ETXlOVFV4SURBdU56UTNNREk0SURBdU9ETXhNamczSURBdU56UXdPRGs1SURBdU9ESTRPRFk0SURBdU56TTFNVGt5UXpBdU9ESTJORFE1SURBdU56STVORGcxSURBdU9ESXlPVEl6SURBdU56STBNekUwSURBdU9ERTRORGsxSURBdU56RTVPVGMzV2swd0xqVTVORFl5T0NBd0xqWTRNakkwTTBNd0xqVTNNVGszTlNBd0xqWTRNakkwTXlBd0xqVTBPVGd6TWlBd0xqWTNOVFV5TmlBd0xqVXpNRGs1TnlBd0xqWTJNamswTVVNd0xqVXhNakUyTWlBd0xqWTFNRE0xTmlBd0xqUTVOelE0TWlBd0xqWXpNalEyT0NBd0xqUTRPRGd4TXlBd0xqWXhNVFUwUXpBdU5EZ3dNVFEwSURBdU5Ua3dOakV5SURBdU5EYzNPRGMySURBdU5UWTNOVGd6SURBdU5EZ3lNamsxSURBdU5UUTFNelkyUXpBdU5EZzJOekUxSURBdU5USXpNVFE0SURBdU5EazNOakl6SURBdU5UQXlOelFnTUM0MU1UTTJOREVnTUM0ME9EWTNNak5ETUM0MU1qazJOVGtnTUM0ME56QTNNRFVnTUM0MU5UQXdOallnTUM0ME5UazNPVGNnTUM0MU56SXlPRFFnTUM0ME5UVXpOemRETUM0MU9UUTFNREVnTUM0ME5UQTVOVGdnTUM0Mk1UYzFNeUF3TGpRMU16SXlOaUF3TGpZek9EUTFPQ0F3TGpRMk1UZzVOVU13TGpZMU9UTTROaUF3TGpRM01EVTJOQ0F3TGpZM056STNOQ0F3TGpRNE5USTBOQ0F3TGpZNE9UZzFPU0F3TGpVd05EQTNPVU13TGpjd01qUTBOQ0F3TGpVeU1qa3hNeUF3TGpjd09URTJNU0F3TGpVME5UQTFOeUF3TGpjd09URTJNU0F3TGpVMk56Y3hRekF1TnpBNU1UWXhJREF1TlRrNE1EZzJJREF1TmprM01EazBJREF1TmpJM01qRTRJREF1TmpjMU5qRTFJREF1TmpRNE5qazNRekF1TmpVME1UTTJJREF1Tmpjd01UYzJJREF1TmpJMU1EQTBJREF1TmpneU1qUXpJREF1TlRrME5qSTRJREF1TmpneU1qUXpXazB3TGpjNU9UazJNU0F3TGpjMk56TXhRekF1TnprMk1EY3pJREF1Tnpjd09UazFJREF1Tnprd09URTVJREF1Tnpjek1EVWdNQzQzT0RVMU5qRWdNQzQzTnpNd05VTXdMamM0TURJd05DQXdMamMzTXpBMUlEQXVOemMxTURVZ01DNDNOekE1T1RVZ01DNDNOekV4TmpFZ01DNDNOamN6TVV3d0xqWTRNak0yTVNBd0xqWTNPRFV4UXpBdU5qa3pNakExSURBdU5qY3dNREF6SURBdU56QXlOek1nTUM0Mk5UazVNemdnTUM0M01UQTJNamdnTUM0Mk5EZzJORE5NTUM0M09UazVOakVnTUM0M016ZzFNVU13TGpnd016YzBJREF1TnpReU16VXhJREF1T0RBMU9EVTNJREF1TnpRM05USXlJREF1T0RBMU9EVTNJREF1TnpVeU9URkRNQzQ0TURVNE5UY2dNQzQzTlRneU9UZ2dNQzQ0TURNM05DQXdMamMyTXpRMk9TQXdMamM1T1RrMk1TQXdMamMyTnpNeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZek1UUXhNU0F3TGpVd05UY3hPVXd3TGpZeE5UVTBOU0F3TGpVeU56RTROVU13TGpZd09EUXdPQ0F3TGpVeU1UZzVPQ0F3TGpVNU9UZzJOQ0F3TGpVeE9EZzBOQ0F3TGpVNU1EazVNaUF3TGpVeE9EUXhRekF1TlRneU1USWdNQzQxTVRjNU56WWdNQzQxTnpNek1Ua2dNQzQxTWpBeE9ERWdNQzQxTmpVM0lEQXVOVEkwTnpRM1F6QXVOVFU0TURneElEQXVOVEk1TXpFeklEQXVOVFV4T1RnM0lEQXVOVE0yTURNMElEQXVOVFE0TVRnMklEQXVOVFEwTURZeVF6QXVOVFEwTXpnMUlEQXVOVFV5TURrZ01DNDFORE13TkRrZ01DNDFOakV3TmpRZ01DNDFORFF6TkRZZ01DNDFOams0TlRGRE1DNDFORFV3T0RZZ01DNDFOelU0TVRrZ01DNDFORGN3TkRFZ01DNDFPREUxTnpJZ01DNDFOVEF3T1RFZ01DNDFPRFkzTlRWRE1DNDFOVE14TkRFZ01DNDFPVEU1TXpjZ01DNDFOVGN5TWpFZ01DNDFPVFkwTkNBd0xqVTJNakEzT1NBd0xqVTVPVGs0TkV3d0xqVTBOamMwTmlBd0xqWXlNRGM0TkVNd0xqVXpNVGczTkNBd0xqWXdPVE0wTlNBd0xqVXlNakE0TmlBd0xqVTVNalV5TlNBd0xqVXhPVFE0T1NBd0xqVTNNemswTkVNd0xqVXhOamc1TVNBd0xqVTFOVE0yTWlBd0xqVXlNVFk1TVNBd0xqVXpOalV3TXlBd0xqVXpNamcxTmlBd0xqVXlNVFF5TkVNd0xqVTBOREF5TVNBd0xqVXdOak0wTmlBd0xqVTJNRFkxT0NBd0xqUTVOakkxTWlBd0xqVTNPVEU0T1NBd0xqUTVNek14TlVNd0xqVTVOemN5SURBdU5Ea3dNemM0SURBdU5qRTJOalkwSURBdU5EazBPRE15SURBdU5qTXhPVFEwSURBdU5UQTFOekU1U0RBdU5qTXhOREV4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNRFkzSWlCNU1UMGlNUzR5TURjd055SWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5DTURBNE5FUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHTkVZNFFpSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MTJjNzJlYzctOWI4Ny00MzZlLWIxOTAtNjlmMDU2NTRhMGFmOyIgcGFyZW50PSIyOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1NSIgeT0iMjc0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlZQQyAtIEN1c3RvbWVyIEluc3RhbmNlIiBpci5zb3VyY2VTdHlsZT0iY29udGFpbmVyPXVuZGVmaW5lZDtyb3VuZGVkPTE7YXJjU2l6ZT05MDtwZXJpbWV0ZXI9dW5kZWZpbmVkO3JlY3Vyc2l2ZVJlc2l6ZT11bmRlZmluZWQ7dmVydGljYWxBbGlnbj10b3A7c3Ryb2tlV2lkdGg9dW5kZWZpbmVkO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTI7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDthbGlnbj1jZW50ZXI7dGV4dERpcmVjdGlvbj11bmRlZmluZWQ7c3BhY2luZ1RvcD11bmRlZmluZWQ7c3BhY2luZ0xlZnQ9dW5kZWZpbmVkO2FzcGVjdD11bmRlZmluZWQ7ZGFzaGVkPXVuZGVmaW5lZDtmb250U3R5bGU9dW5kZWZpbmVkO291dGxpbmVDb25uZWN0PXVuZGVmaW5lZDtzaGFwZT11bmRlZmluZWQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSWpSVE5HUTBaRElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RVNU5DQXdMall5TUROSU1DNHlPVGt5TnpORE1DNHlNall5TURZZ01DNDJNakF6SURBdU1UY3dNelFnTUM0MU56RTFJREF1TVRZMk5qQTJJREF1TlRBME5ETXpRekF1TVRZMk5qQTJJREF1TlRBeE5qTXpJREF1TVRZMk5qQTJJREF1TkRrNE5ETXpJREF1TVRZMk5qQTJJREF1TkRrMU1qTXpRekF1TVRZMU5EY3hJREF1TkRZM05EQTRJREF1TVRjek9EQTNJREF1TkRRd01ESXhJREF1TVRrd01qVXhJREF1TkRFM05UUTJRekF1TWpBMk5qazFJREF1TXprMU1EY3hJREF1TWpNd01qYzJJREF1TXpjNE9ETTVJREF1TWpVM01UUWdNQzR6TnpFMVF6QXVNalUzTVRRZ01DNHpOamM1SURBdU1qVTNNVFFnTUM0ek5qUTBNek1nTUM0eU5UY3hOQ0F3TGpNMk1EZ3pNME13TGpJMU56Z3hNaUF3TGpNeU5Ea3pOeUF3TGpJMk9UQTVOQ0F3TGpJNU1EQTBOQ0F3TGpJNE9UVTJNeUF3TGpJMk1EVTBPVU13TGpNeE1EQXpNeUF3TGpJek1UQTFOQ0F3TGpNek9EYzNOQ0F3TGpJd09ESTNOeUF3TGpNM01qRTJOaUF3TGpFNU5UQTRPVU13TGpRd05UVTFPQ0F3TGpFNE1Ua2dNQzQwTkRJeE1EWWdNQzR4TnpnNE9TQXdMalEzTnpJd05pQXdMakU0TmpRek4wTXdMalV4TWpNd05pQXdMakU1TXprNE5DQXdMalUwTkRNNE55QXdMakl4TVRjMU1TQXdMalUyT1RRd05pQXdMakl6TnpWRE1DNDFPRFk0TlRVZ01DNHlOVFEzTnlBd0xqWXdNVEF6T0NBd0xqSTNOVEExTVNBd0xqWXhNVEkzTXlBd0xqSTVOek0yTjBNd0xqWXlOVGt3TWlBd0xqSTROVFl4TkNBd0xqWTBOREV3T0NBd0xqSTNPVEl4TmlBd0xqWTJNamczTXlBd0xqSTNPVEl6TTBNd0xqY3dNVFUwSURBdU1qYzVNak16SURBdU56UXlPRGN6SURBdU16QTJPRE16SURBdU56UTVOamN6SURBdU16WTRNME13TGpjNE1qVXpJREF1TXpjME9DQXdMamd4TWpFM015QXdMak01TWpNMUlEQXVPRE16TmpjeklEQXVOREU0TURNelREQXVPREV5TnpRZ01DNDBNelEwTXpORE1DNDNPVEkzTnpVZ01DNDBNVEUxT1RJZ01DNDNOalV5T1RjZ01DNHpPVFkyTkRjZ01DNDNNelV5TnpNZ01DNHpPVEl6UXpBdU56TXlNamN6SURBdU16a3hPREU1SURBdU56STVOVEkySURBdU16a3dNekkzSURBdU56STNORGtnTUM0ek9EZ3dOekpETUM0M01qVTBOVE1nTUM0ek9EVTRNVGNnTUM0M01qUXlORGNnTUM0ek9ESTVNelFnTUM0M01qUXdOek1nTUM0ek56azVRekF1TnpJeE1EQTJJREF1TXpJNE9ETXpJREF1TmpreE1UUWdNQzR6TURVNUlEQXVOall5T0RjeklEQXVNekExT1VNd0xqWTFNems1TnlBd0xqTXdOVGs0TWlBd0xqWTBOVEkySURBdU16QTRNVElnTUM0Mk16Y3pORGtnTUM0ek1USXhORFZETUM0Mk1qazBNemNnTUM0ek1UWXhOeUF3TGpZeU1qVTJOaUF3TGpNeU1UazNOQ0F3TGpZeE56STNNeUF3TGpNeU9URkRNQzQyTVRVNE5ERWdNQzR6TXpFd01Ea2dNQzQyTVRNNU1qSWdNQzR6TXpJME9Ua2dNQzQyTVRFM01UY2dNQzR6TXpNME1UTkRNQzQyTURrMU1UTWdNQzR6TXpRek1qZ2dNQzQyTURjeE1ETWdNQzR6TXpRMk16UWdNQzQyTURRM05DQXdMak16TkRORE1DNDJNREl6TmpZZ01DNHpNek01TXpjZ01DNDJNREF4TXpVZ01DNHpNekk1TkRFZ01DNDFPVGd5T0RFZ01DNHpNekUwTVRaRE1DNDFPVFkwTWpjZ01DNHpNams0T1NBd0xqVTVOVEF4T1NBd0xqTXlOemc1TWlBd0xqVTVOREl3TmlBd0xqTXlOVFl6TTBNd0xqVTROVEEzT1NBd0xqSTVPVGN4TkNBd0xqVTNNREkzTXlBd0xqSTNOakUyTWlBd0xqVTFNRGczTXlBd0xqSTFOamRETUM0MU1qazFOelFnTUM0eU16UTNPRGNnTUM0MU1ESXlPRFlnTUM0eU1UazJORElnTUM0ME56STBNaklnTUM0eU1UTXhOak5ETUM0ME5ESTFOVGtnTUM0eU1EWTJPRE1nTUM0ME1URTBORGNnTUM0eU1Ea3hOVFlnTUM0ek9ESTVPRElnTUM0eU1qQXlOekZETUM0ek5UUTFNVGNnTUM0eU16RXpPRGNnTUM0ek1qazVOak1nTUM0eU5UQTJOVElnTUM0ek1USXpPVE1nTUM0eU56VTJOVFJETUM0eU9UUTRNalFnTUM0ek1EQTJOVFlnTUM0eU9EVXdNVGtnTUM0ek16QXlPRFlnTUM0eU9EUXlNRFlnTUM0ek5qQTRNek5ETUM0eU9EUXlNalVnTUM0ek5qY3lNRE1nTUM0eU9EUTFPREVnTUM0ek56TTFOamdnTUM0eU9EVXlOek1nTUM0ek56azVRekF1TWpnMU5UazBJREF1TXpnek1EZ3lJREF1TWpnME56WXhJREF1TXpnMk1qY3pJREF1TWpneU9USTFJREF1TXpnNE9Ea3lRekF1TWpneE1Ea2dNQzR6T1RFMU1URWdNQzR5Tnpnek56UWdNQzR6T1RNek9ETWdNQzR5TnpVeU56TWdNQzR6T1RReE5qZERNQzR5TkRVd01EWWdNQzQwTURFMk16TWdNQzR4T1RNNU5DQXdMalF5TkRnek15QXdMakU1TXprMElEQXVORGsxTWpNelF6QXVNVGt6T0RBMklEQXVORGszTmpNeElEQXVNVGt6T0RBMklEQXVOVEF3TURNMUlEQXVNVGt6T1RRZ01DNDFNREkwTXpORE1DNHhPVFk0TnpNZ01DNDFOVFUzTmpjZ01DNHlOREUxTkNBd0xqVTVNell6TXlBd0xqTXdNRFl3TmlBd0xqVTVNell6TTBnd0xqUTROekkzTTB3d0xqUTROVGswSURBdU5qSXdNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOekkwTlRFZ01DNDRNVFk0TURWRE1DNDFNVFF6TVRnZ01DNDRNVFk0TURVZ01DNDFNVEkwTlRFZ01DNDJNemt3TnpFZ01DNDFNVEkwTlRFZ01DNDJNemN6TXpoV01DNDBOelV3TnpGRE1DNDFNVEkwTkRJZ01DNDBOekl6TkRjZ01DNDFNVE15TmpnZ01DNDBOamsyT0RVZ01DNDFNVFE0TVRnZ01DNDBOamMwTkRWRE1DNDFNVFl6TmpjZ01DNDBOalV5TURRZ01DNDFNVGcxTmpZZ01DNDBOak0wT1RJZ01DNDFNakV4TVRnZ01DNDBOakkxTXpoTU1DNDJOamMzT0RVZ01DNDBNRGd5TnpGRE1DNDJOekE0TURRZ01DNDBNRGN5TURRZ01DNDJOelF3T1RnZ01DNDBNRGN5TURRZ01DNDJOemN4TVRnZ01DNDBNRGd5TnpGTU1DNDRNak0zT0RVZ01DNDBOakkxTXpoRE1DNDRNall6TXpjZ01DNDBOak0wT1RJZ01DNDRNamcxTXpVZ01DNDBOalV5TURRZ01DNDRNekF3T0RVZ01DNDBOamMwTkRWRE1DNDRNekUyTXpRZ01DNDBOamsyT0RVZ01DNDRNekkwTmlBd0xqUTNNak0wTnlBd0xqZ3pNalExTVNBd0xqUTNOVEEzTVZZd0xqWTBOek16T0VNd0xqZ3pNalExTVNBd0xqWTBPVEEzTVNBd0xqZ3pNRFU0TlNBd0xqZ3hOamd3TlNBd0xqWTNNalExTVNBd0xqZ3hOamd3TlZwTk1DNDFNemt4TVRnZ01DNDBPRFEwTURWV01DNDJNemN6TXpoRE1DNDFNemt4TVRnZ01DNDJORE0yTURVZ01DNDFOREE1T0RVZ01DNDNPVEF4TXpnZ01DNDJOekkwTlRFZ01DNDNPVEF4TXpoRE1DNDRNRE01TVRnZ01DNDNPVEF4TXpnZ01DNDRNRFUzT0RVZ01DNDJOVE15TURVZ01DNDRNRFUzT0RVZ01DNDJORGN6TXpoV01DNDBPRFEwTURWTU1DNDJOekkwTlRFZ01DNDBNelE1TXpoTU1DNDFNemt4TVRnZ01DNDBPRFEwTURWYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpjeU5ETTVJREF1TnpZMk9USTBRekF1TlRnM05qTTVJREF1TnpZMk9USTBJREF1TlRZMk9ETTVJREF1TmpVNU16STBJREF1TlRZMU56Y3pJREF1TmpVME56a3hRekF1TlRZMU5qUXhJREF1TmpVek9UazJJREF1TlRZMU5qUXhJREF1TmpVek1UZzFJREF1TlRZMU56Y3pJREF1TmpVeU16a3hWakF1TlRFME1qVTRRekF1TlRZMU56Y2dNQzQxTVRFMU9EY2dNQzQxTmpZMU5qa2dNQzQxTURnNU56Z2dNQzQxTmpnd05qY2dNQzQxTURZM05qZERNQzQxTmprMU5qVWdNQzQxTURRMU5UWWdNQzQxTnpFMk9USWdNQzQxTURJNE5EWWdNQzQxTnpReE56TWdNQzQxTURFNE5UaE1NQzQyTmpjMU1EWWdNQzQwTmpVd05UaERNQzQyTnpBMk56UWdNQzQwTmpNM09UWWdNQzQyTnpReU1EVWdNQzQwTmpNM09UWWdNQzQyTnpjek56TWdNQzQwTmpVd05UaE1NQzQzTnpBM01EWWdNQzQxTURFNE5UaERNQzQzTnpNeE9EY2dNQzQxTURJNE5EWWdNQzQzTnpVek1UUWdNQzQxTURRMU5UWWdNQzQzTnpZNE1USWdNQzQxTURZM05qZERNQzQzTnpnek1Ea2dNQzQxTURnNU56Z2dNQzQzTnpreE1Ea2dNQzQxTVRFMU9EY2dNQzQzTnpreE1EWWdNQzQxTVRReU5UaFdNQzQyTlRJek9URkRNQzQzTnpreE56SWdNQzQyTlRNeE9TQXdMamMzT1RFM01pQXdMalkxTXprNU1pQXdMamMzT1RFd05pQXdMalkxTkRjNU1VTXdMamMzT0RBek9TQXdMalkxT1RNeU5DQXdMamMxTnpJek9TQXdMamMyTmpreU5DQXdMalkzTWpRek9TQXdMamMyTmpreU5GcE5NQzQxT1RJME16a2dNQzQyTlRFd05UaERNQzQxT1RRMU56TWdNQzQyTmpFeE9URWdNQzQyTVRNMk16a2dNQzQzTkRBeU5UZ2dNQzQyTnpJME16a2dNQzQzTkRBeU5UaERNQzQzTXpFeU16a2dNQzQzTkRBeU5UZ2dNQzQzTlRBek1EWWdNQzQyTmpFek1qUWdNQzQzTlRJME16a2dNQzQyTlRFd05UaFdNQzQxTWpNek1qUk1NQzQyTnpJME16a2dNQzQwT1RFNE5UaE1NQzQxT1RJME16a2dNQzQxTWpNek1qUldNQzQyTlRFd05UaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6UkVNamRCT0NJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalFURTJOa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tIiBpZD0iNyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWRmYjI2MzFmLWQ5NTktNGExOS1hY2U0LTYyZmI1NTJiNjc3Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj12cGM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMjkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTk1IiB5PSI4NyIgd2lkdGg9IjM0MCIgaGVpZ2h0PSIzOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCAtPiBPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1jMDEzMDE0OS01YzMxLTQxNjUtYjZlMi0yMmNjNTgzMzliZGQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkVsYXN0aWNzZWFyY2ggLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1lMTM1MWJlZS0yN2QyLTQ2YzctYmI4OS02ZjI5MmZhZjM5Zjg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCIgc3R5bGU9ImlyLnJlZj05OTUyMjA0ZS03ZTJjLTQ0MGMtOTUwNS01NGMxYzFmNTVlODE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWxhc3RpY3NlYXJjaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1EQXdPREVnTUM0ek5qTXlPREZJTUM0eE9EQXdPREZETUM0eE56WTFORFVnTUM0ek5qTXlPREVnTUM0eE56TXhOVFFnTUM0ek5qUTJPRFlnTUM0eE56QTJOVE1nTUM0ek5qY3hPRFpETUM0eE5qZ3hOVE1nTUM0ek5qazJPRGNnTUM0eE5qWTNORGdnTUM0ek56TXdOemdnTUM0eE5qWTNORGdnTUM0ek56WTJNVFZXTUM0NE1ETXlPREZETUM0eE5qWTNORGdnTUM0NE1EWTRNVGNnTUM0eE5qZ3hOVE1nTUM0NE1UQXlNRGtnTUM0eE56QTJOVE1nTUM0NE1USTNNRGxETUM0eE56TXhOVFFnTUM0NE1UVXlNU0F3TGpFM05qVTBOU0F3TGpneE5qWXhOQ0F3TGpFNE1EQTRNU0F3TGpneE5qWXhORWd3TGpNd01EQTRNVU13TGpNd016WXhPQ0F3TGpneE5qWXhOQ0F3TGpNd056QXdPU0F3TGpneE5USXhJREF1TXpBNU5UQTVJREF1T0RFeU56QTVRekF1TXpFeU1ERWdNQzQ0TVRBeU1Ea2dNQzR6TVRNME1UVWdNQzQ0TURZNE1UY2dNQzR6TVRNME1UVWdNQzQ0TURNeU9ERldNQzR6TnpZMk1UVkRNQzR6TVRNME1UVWdNQzR6TnpNd056Z2dNQzR6TVRJd01TQXdMak0yT1RZNE55QXdMak13T1RVd09TQXdMak0yTnpFNE5rTXdMak13TnpBd09TQXdMak0yTkRZNE5pQXdMak13TXpZeE9DQXdMak0yTXpJNE1TQXdMak13TURBNE1TQXdMak0yTXpJNE1WcE5NQzR5T0RZM05EZ2dNQzQzT0RrNU5EaElNQzR4T1RNME1UVldNQzR6T0RrNU5EaElNQzR5T0RZM05EaFdNQzQzT0RrNU5EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU9EQXpNelkyUXpBdU5EZzJOelUxSURBdU9EQTJPVEF6SURBdU5EZzFNelVnTUM0NE1UQXlPVFFnTUM0ME9ESTRORGtnTUM0NE1USTNPVFJETUM0ME9EQXpORGtnTUM0NE1UVXlPVFVnTUM0ME56WTVOVGNnTUM0NE1UWTNJREF1TkRjek5ESXhJREF1T0RFMk4wZ3dMak0xTXpReU1VTXdMak0wT1RnNE5TQXdMamd4TmpjZ01DNHpORFkwT1RRZ01DNDRNVFV5T1RVZ01DNHpORE01T1RNZ01DNDRNVEkzT1RSRE1DNHpOREUwT1RNZ01DNDRNVEF5T1RRZ01DNHpOREF3T0RnZ01DNDRNRFk1TURNZ01DNHpOREF3T0RnZ01DNDRNRE16TmpaV01DNDFOek16TmpSRE1DNHpORFEwTWpNZ01DNDFPVGd4TkRVZ01DNHpOVE0wTnpZZ01DNDJNakU0TmpRZ01DNHpOalkzTlRVZ01DNDJORE15TXpKV01DNDNPRGs1U0RBdU5EWXdNRGc0VmpBdU56SXdNRE15UXpBdU5EWTROek14SURBdU56SXpOams0SURBdU5EYzNOalEzSURBdU56STJOamcxSURBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU56STRPVFkyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE0TmpjMU5TQXdMakk1TmpZMU9WWXdMak0wTXpnMU9VTXdMalEzTnpZek1pQXdMak0wTmpNeE1pQXdMalEyT0RjeE5pQXdMak0wT1RRM055QXdMalEyTURBNE9DQXdMak0xTXpNeU5WWXdMak13T1RrNU1rZ3dMak0yTmpjMU5WWXdMalF5T1RrNU1rTXdMak0xTXpRM05pQXdMalExTVRNMU9TQXdMak0wTkRReU15QXdMalEzTlRBM09DQXdMak0wTURBNE9DQXdMalE1T1RnMU9WWXdMakk1TmpZMU9VTXdMak0wTURBNE9DQXdMakk1TXpFeU1pQXdMak0wTVRRNU15QXdMakk0T1Rjek1TQXdMak0wTXprNU15QXdMakk0TnpJelF6QXVNelEyTkRrMElEQXVNamcwTnpNZ01DNHpORGs0T0RVZ01DNHlPRE16TWpVZ01DNHpOVE0wTWpFZ01DNHlPRE16TWpWSU1DNDBOek0wTWpGRE1DNDBOelk1TlRjZ01DNHlPRE16TWpVZ01DNDBPREF6TkRrZ01DNHlPRFEzTXlBd0xqUTRNamcwT1NBd0xqSTROekl6UXpBdU5EZzFNelVnTUM0eU9EazNNekVnTUM0ME9EWTNOVFVnTUM0eU9UTXhNaklnTUM0ME9EWTNOVFVnTUM0eU9UWTJOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TkRJNElEQXVOek01TlRkV01DNDNPRGs1TjBnd0xqVTBNREE1TkZZd0xqY3pOall6TjBNd0xqVXpNVEUzTmlBd0xqY3pOalkyTmlBd0xqVXlNakkyTnlBd0xqY3pOakE0TnlBd0xqVXhNelF5T0NBd0xqY3pORGt3TTFZd0xqZ3dNek13TTBNd0xqVXhNelF5T0NBd0xqZ3dOamcwSURBdU5URTBPRE15SURBdU9ERXdNak14SURBdU5URTNNek16SURBdU9ERXlOek15UXpBdU5URTVPRE16SURBdU9ERTFNak15SURBdU5USXpNakkxSURBdU9ERTJOak0zSURBdU5USTJOell4SURBdU9ERTJOak0zU0RBdU5qUTJOell4UXpBdU5qVXdNamszSURBdU9ERTJOak0zSURBdU5qVXpOamc1SURBdU9ERTFNak15SURBdU5qVTJNVGc1SURBdU9ERXlOek15UXpBdU5qVTROamtnTUM0NE1UQXlNekVnTUM0Mk5qQXdPVFFnTUM0NE1EWTROQ0F3TGpZMk1EQTVOQ0F3TGpnd016TXdNMVl3TGpjMk5qSXpOMHd3TGpZek16UXlPQ0F3TGpjek9UVTNXazB3TGpZME5qYzJNU0F3TGpFM05qWXpOa2d3TGpVeU5qYzJNVU13TGpVeU16SXlOU0F3TGpFM05qWXpOaUF3TGpVeE9UZ3pNeUF3TGpFM09EQTBNU0F3TGpVeE56TXpNeUF3TGpFNE1EVTBNVU13TGpVeE5EZ3pNaUF3TGpFNE16QTBNU0F3TGpVeE16UXlPQ0F3TGpFNE5qUXpNeUF3TGpVeE16UXlPQ0F3TGpFNE9UazJPVll3TGpNek9ETTJPVU13TGpVeU1qSTJOaUF3TGpNek56RTNOQ0F3TGpVek1URTNOaUF3TGpNek5qVTVOU0F3TGpVME1EQTVOQ0F3TGpNek5qWXpObFl3TGpNek5qWXpObFl3TGpJd016TXdNa2d3TGpZek16UXlPRll3TGpNMU9UazJPVU13TGpZME1qYzNJREF1TXpZME9URTNJREF1TmpVeE5qZzVJREF1TXpjd05qSTFJREF1TmpZd01EazBJREF1TXpjM01ETTJWakF1TVRrd016WTVRekF1TmpZd01UUTRJREF1TVRnNE5UZzFJREF1TmpVNU9EUXpJREF1TVRnMk9EQTRJREF1TmpVNU1UazNJREF1TVRnMU1UUTBRekF1TmpVNE5UVXhJREF1TVRnek5EZ2dNQzQyTlRjMU56Y2dNQzR4T0RFNU5qSWdNQzQyTlRZek16TWdNQzR4T0RBMk9ERkRNQzQyTlRVd09TQXdMakUzT1RRd01TQXdMalkxTXpZd01pQXdMakUzT0RNNE1pQXdMalkxTVRrMU9DQXdMakUzTnpZNE9FTXdMalkxTURNeE15QXdMakUzTmprNU15QXdMalkwT0RVME5pQXdMakUzTmpZek5TQXdMalkwTmpjMk1TQXdMakUzTmpZek5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qQXhNREVnTUM0eU5ETXlPRFpJTUM0M01EQXhNREZETUM0Mk9UWTFOalVnTUM0eU5ETXlPRFlnTUM0Mk9UTXhOek1nTUM0eU5EUTJPVEVnTUM0Mk9UQTJOek1nTUM0eU5EY3hPVEZETUM0Mk9EZ3hOeklnTUM0eU5EazJPVElnTUM0Mk9EWTNOamdnTUM0eU5UTXdPRE1nTUM0Mk9EWTNOamdnTUM0eU5UWTJNVGxXTUM0ME1ERXhOVEpETUM0Mk9UY3dORGdnTUM0ME1USXlOVEVnTUM0M01EVTVPVGNnTUM0ME1qUTFNVElnTUM0M01UTTBNelFnTUM0ME16YzJPRFpXTUM0eU5qazVOVE5JTUM0NE1EWTNOamhXTUM0Mk56azVOVEpNTUM0NE16TTBNelFnTUM0M01EWTJNVGhXTUM0eU5UWTJNVGxETUM0NE16TTBNelFnTUM0eU5UTXdPRE1nTUM0NE16SXdNamtnTUM0eU5EazJPVElnTUM0NE1qazFNamtnTUM0eU5EY3hPVEZETUM0NE1qY3dNamdnTUM0eU5EUTJPVEVnTUM0NE1qTTJNemNnTUM0eU5ETXlPRFlnTUM0NE1qQXhNREVnTUM0eU5ETXlPRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREUzTURjMElEQXVOekk0TmpnelREQXVOamszTURjMElEQXVOakE0TmpnelF6QXVOekUwTWpFeElEQXVOVGN4TXpVZ01DNDNNVGMxTXpJZ01DNDFNamt4TkRRZ01DNDNNRFkwTkRZZ01DNDBPRGsxT1RGRE1DNDJPVFV6TlRrZ01DNDBOVEF3TXpjZ01DNDJOekExT0RZZ01DNDBNVFUzTURZZ01DNDJNelkxTkRJZ01DNHpPVEkzTVRsRE1DNDJNREkwT1RnZ01DNHpOamszTXpFZ01DNDFOakV6T1RZZ01DNHpOVGsxT0RJZ01DNDFNakExTmpVZ01DNHpOalF3T0VNd0xqUTNPVGN6TkNBd0xqTTJPRFUzTnlBd0xqUTBNVGd5T0NBd0xqTTROelF6SURBdU5ERXpOakEwSURBdU5ERTNNamMzUXpBdU16ZzFNemdnTUM0ME5EY3hNak1nTUM0ek5qZzJOek1nTUM0ME9EWXdNalFnTUM0ek5qWTBOaklnTUM0MU1qY3dOREpETUM0ek5qUXlOVElnTUM0MU5qZ3dOakVnTUM0ek56WTJPQ0F3TGpZd09EVXpNU0F3TGpRd01UVXpNeUF3TGpZME1USXpPVU13TGpReU5qTTROU0F3TGpZM016azBOaUF3TGpRMk1qQTBOaUF3TGpZNU5qYzJOQ0F3TGpVd01qRTFOeUF3TGpjd05UWXlORU13TGpVME1qSTJPQ0F3TGpjeE5EUTROQ0F3TGpVNE5ESXlNeUF3TGpjd09EZ3hNU0F3TGpZeU1EVTBJREF1TmpnNU5qRTJUREF1TnpNNE5UUWdNQzQ0TURjME9ETkRNQzQzTkRnNU16Y2dNQzQ0TVRjNE9UY2dNQzQzTmpNd05EUWdNQzQ0TWpNM05UVWdNQzQzTnpjM05pQXdMamd5TXpjMk4wTXdMamM1TWpRM05TQXdMamd5TXpjNElEQXVPREEyTlRreklEQXVPREUzT1RRMklEQXVPREUzTURBM0lEQXVPREEzTlRRNVF6QXVPREkzTkRJeElEQXVOemszTVRVeklEQXVPRE16TWpjNUlEQXVOemd6TURRMUlEQXVPRE16TWpreElEQXVOelk0TXpORE1DNDRNek16TURRZ01DNDNOVE0yTVRVZ01DNDRNamMwTnlBd0xqY3pPVFE1TnlBd0xqZ3hOekEzTkNBd0xqY3lPVEE0TTFZd0xqY3lPRFk0TTFwTk1DNHpPVE15TURjZ01DNDFNelkwTVRaRE1DNHpPVE15TURjZ01DNDFNRGMwTURnZ01DNDBNREU0TURrZ01DNDBOemt3TlRJZ01DNDBNVGM1TWpVZ01DNDBOVFE1TXpKRE1DNDBNelF3TkRFZ01DNDBNekE0TVRNZ01DNDBOVFk1TkRjZ01DNDBNVEl3TVRVZ01DNDBPRE0zTkRjZ01DNDBNREE1TVRSRE1DNDFNVEExTkRZZ01DNHpPRGs0TVRNZ01DNDFOREF3TXpZZ01DNHpPRFk1TURnZ01DNDFOamcwT0RjZ01DNHpPVEkxTmpoRE1DNDFPVFk1TXpjZ01DNHpPVGd5TWpjZ01DNDJNak13TnpFZ01DNDBNVEl4T1RVZ01DNDJORE0xT0RNZ01DNDBNekkzTURkRE1DNDJOalF3T1RRZ01DNDBOVE15TVRrZ01DNDJOemd3TmpNZ01DNDBOemt6TlRJZ01DNDJPRE0zTWpJZ01DNDFNRGM0TURORE1DNDJPRGt6T0RFZ01DNDFNell5TlRNZ01DNDJPRFkwTnpjZ01DNDFOalUzTkRNZ01DNDJOelV6TnpZZ01DNDFPVEkxTkRORE1DNDJOalF5TnpVZ01DNDJNVGt6TkRNZ01DNDJORFUwTnpZZ01DNDJOREl5TkRrZ01DNDJNakV6TlRjZ01DNDJOVGd6TmpWRE1DNDFPVGN5TXpnZ01DNDJOelEwT0RFZ01DNDFOamc0T0RFZ01DNDJPRE13T0RNZ01DNDFNems0TnpRZ01DNDJPRE13T0RORE1DNDFNREE1TnpVZ01DNDJPRE13T0RNZ01DNDBOak0yTnlBd0xqWTJOell6SURBdU5ETTJNVFkxSURBdU5qUXdNVEkxUXpBdU5EQTROalU1SURBdU5qRXlOaklnTUM0ek9UTXlNRGNnTUM0MU56VXpNVFFnTUM0ek9UTXlNRGNnTUM0MU16WTBNVFphVFRBdU56azRNVFFnTUM0M09EZ3lPRE5ETUM0M09USTNNVGtnTUM0M09UTTJOek1nTUM0M09EVXpPRFVnTUM0M09UWTJPVGdnTUM0M056YzNOQ0F3TGpjNU5qWTVPRU13TGpjM01EQTVOU0F3TGpjNU5qWTVPQ0F3TGpjMk1qYzJNU0F3TGpjNU16WTNNeUF3TGpjMU56TTBJREF1TnpnNE1qZ3pUREF1TmpRek56UWdNQzQyTnpRMk9ETkRNQzQyTlRrek1qVWdNQzQyTmpJNU1Ea2dNQzQyTnpJNE5ETWdNQzQyTkRnMk1qVWdNQzQyT0RNM05DQXdMall6TWpReE5rd3dMamM1T0RRd055QXdMamMwTnpZeE5rTXdMamd3TXpjMU15QXdMamMxTXpBMUlEQXVPREEyTnpJNElEQXVOell3TXpneUlEQXVPREEyTmpjNElEQXVOelk0TURBMVF6QXVPREEyTmpJNElEQXVOemMxTmpJM0lEQXVPREF6TlRVNElEQXVOemd5T1RJZ01DNDNPVGd4TkNBd0xqYzRPREk0TTFZd0xqYzRPREk0TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RBNE16a2dNQzQxT1RrNU1EZERNQzQwTnpFMU5ESWdNQzQxT1RNeU5UVWdNQzQwTmpNMk5qSWdNQzQxT0RRNE1pQXdMalExTnpZMU9DQXdMalUzTlRBNU1rTXdMalExTVRZMU5TQXdMalUyTlRNMk5DQXdMalEwTnpZME9DQXdMalUxTkRVek9DQXdMalEwTlRnM01TQXdMalUwTXpJME5rTXdMalEwTkRBNU5DQXdMalV6TVRrMU5DQXdMalEwTkRVNE15QXdMalV5TURReU1TQXdMalEwTnpNd09TQXdMalV3T1RNeE9VTXdMalExTURBek5TQXdMalE1T0RJeE9DQXdMalExTkRrME15QXdMalE0TnpjM0lEQXVORFl4TnpRNElEQXVORGM0TlRnMVF6QXVORFk0TlRVeklEQXVORFk1TkNBd0xqUTNOekV4T0NBd0xqUTJNVFkyTVNBd0xqUTROamswTkNBd0xqUTFOVGd5UXpBdU5EazJOemN4SURBdU5EUTVPVGM0SURBdU5UQTNOall4SURBdU5EUTJNVFV5SURBdU5URTRPVGd5SURBdU5EUTBOVFl5UXpBdU5UTXdNekF5SURBdU5EUXlPVGN6SURBdU5UUXhPREkySURBdU5EUXpOalV6SURBdU5UVXlPRGd4SURBdU5EUTJOVFl5UXpBdU5UWXpPVE0xSURBdU5EUTVORGN5SURBdU5UYzBNekF4SURBdU5EVTBOVFV6SURBdU5UZ3pNemN5SURBdU5EWXhOVEE1VERBdU5UWTNOVEExSURBdU5EZ3lPVGMxUXpBdU5UWXhNakk0SURBdU5EYzRNekkzSURBdU5UVTBNRGszSURBdU5EYzBPVFlnTUM0MU5EWTFNVGdnTUM0ME56TXdOamRETUM0MU16ZzVOQ0F3TGpRM01URTNOQ0F3TGpVek1UQTJNeUF3TGpRM01EYzVNeUF3TGpVeU16TXpOeUF3TGpRM01UazBORU13TGpVeE5UWXhNU0F3TGpRM016QTVOaUF3TGpVd09ERTRPQ0F3TGpRM05UYzFOeUF3TGpVd01UUTVNU0F3TGpRM09UYzNPRU13TGpRNU5EYzVOQ0F3TGpRNE16YzVPQ0F3TGpRNE9EazFOQ0F3TGpRNE9UQTVPQ0F3TGpRNE5ETXdOU0F3TGpRNU5UTTNOVU13TGpRM09UWTFOaUF3TGpVd01UWTFNaUF3TGpRM05qSTVJREF1TlRBNE56Z3pJREF1TkRjME16azNJREF1TlRFMk16WXlRekF1TkRjeU5UQTBJREF1TlRJek9UUWdNQzQwTnpJeE1qSWdNQzQxTXpFNE1UY2dNQzQwTnpNeU56UWdNQzQxTXprMU5ETkRNQzQwTnpRME1qVWdNQzQxTkRjeU5qZ2dNQzQwTnpjd09EY2dNQzQxTlRRMk9USWdNQzQwT0RFeE1EZ2dNQzQxTmpFek9EbERNQzQwT0RVeE1qZ2dNQzQxTmpnd09EWWdNQzQwT1RBME1qZ2dNQzQxTnpNNU1qVWdNQzQwT1RZM01EVWdNQzQxTnpnMU56Uk1NQzQwT0RBNE16a2dNQzQxT1RrNU1EZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjeUlpQjVNajBpTFRBdU1qQTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTEiIHk9IjI1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOCIgdmFsdWU9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCAtPiBFbGFzdGljc2VhcmNoIiBzdHlsZT0iaXIucmVmPWQyYjAwYmQwLTM3MzItNDBmMi04OTQ4LTJiZDYwOTNmYzZkYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjciIHNvdXJjZT0iMTAiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0IiB2YWx1ZT0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIC0+IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9NDU2ZWYzYjQtZDg3NC00YmU5LTkzZDEtNTc3YjNkZjIyNGMwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNyIgc291cmNlPSIxMCIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iT3ZlcmZsb3cgLyBDb2xkIFN0b3JhZ2UiIHN0eWxlPSJpci5yZWY9ZDA3N2YyY2UtOGY1MS00ZWVkLWI5ZTgtMjljMzNjMWM5MDFlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXMzO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTUM0NU9UazVPVFZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU1TURVeElEQXVOVE0wTVRnNFF6QXVPREUxTVRnMElEQXVOVEV6TWpVMUlEQXVOemt4TkRVeElEQXVORGs0TkRVMUlEQXVOemMxTVRnMElEQXVORGczT1RJeVF6QXVOelk1T1RnMElEQXVORGcwTlRnNUlEQXVOelUxTnpFNElEQXVORGM1TWpVMUlEQXVOelUwTlRFNElEQXVORGMwTlRnNVF6QXVOelUwTkRNMklEQXVORGN4TWpVZ01DNDNOVFE0T0RZZ01DNDBOamM1TVRrZ01DNDNOVFU0TlRFZ01DNDBOalEzTWpKTU1DNDNOamt4T0RRZ01DNHpOamc0TlRaRE1DNDNOek13TlRFZ01DNHpOREEzTWpJZ01DNDNOelkzT0RRZ01DNHpNVEkxT0RrZ01DNDNPREEyTlRFZ01DNHlPRFEwTlRaRE1DNDNPRFF4TVRnZ01DNHlOVGcxT0RrZ01DNDNOekUzTVRnZ01DNHlOREV5TlRZZ01DNDNOVEEyTlRFZ01DNHlNalkzTWpORE1DNDNNRGMzTVRnZ01DNHhPVFk1T0RrZ01DNDJOVEUzTVRnZ01DNHhPRFE1T1NBd0xqWXdNVEU0TkNBd0xqRTNOamN5TTBNd0xqVXpOemd4TVNBd0xqRTJOak0zTmlBd0xqUTNNek0yTlNBd0xqRTJOREkzSURBdU5EQTVORFV4SURBdU1UY3dORFUyUXpBdU16VXhPVFkySURBdU1UYzBOamMwSURBdU1qazFOVFEySURBdU1UZzRNVGd6SURBdU1qUXlNemcwSURBdU1qRXdORFUyUXpBdU1qRXpPRFV4SURBdU1qSXpOemc1SURBdU1UYzJOVEU0SURBdU1qUTBOVGc1SURBdU1UZ3hNVGcwSURBdU1qZ3dPVGc1UXpBdU1UazBOVEU0SURBdU16ZzVNalUySURBdU1qRXdNalV4SURBdU5EazNNalUxSURBdU1qSTBOemcwSURBdU5qQTFNemc0UXpBdU1qTXhORFV4SURBdU5qVTBPRFUxSURBdU1qTTRNVEU0SURBdU56QTBNekl4SURBdU1qUTBOemcwSURBdU56VXpOemc0UXpBdU1qUTFPRFlnTUM0M05qTTBNaUF3TGpJME9UUTJJREF1TnpjeU5UazRJREF1TWpVMU1qRTVJREF1Tnpnd016azBRekF1TWpZd09UYzRJREF1TnpnNE1Ua2dNQzR5TmpnMk9UTWdNQzQzT1RRek1qZ2dNQzR5TnpjMU9EUWdNQzQzT1RneE9EaERNQzR6TVRnNU1UZ2dNQzQ0TWpBMU9EZ2dNQzR6TnpBeE1UZ2dNQzQ0TWpZNU9EZ2dNQzQwTVRZeU5URWdNQzQ0TXpFeU5UUkRNQzQwTnpjMU9ETWdNQzQ0TXpZM09UUWdNQzQxTXprek9ESWdNQzQ0TXpRd05UZ2dNQzQxT1RrNU9EUWdNQzQ0TWpNeE1qRkRNQzQyTXpnek9EUWdNQzQ0TVRZd05UUWdNQzQzTURrNE5URWdNQzQ0TURRME5UUWdNQzQzTVRVNU9EUWdNQzQzTlRZME5UUkRNQzQzTWpNMU9EUWdNQzQyT1RZNU9EZ2dNQzQzTXpFNU9EUWdNQzQyTXpjMU1qRWdNQzQzTXprNU9EUWdNQzQxTnpneE9EaE1NQzQzTkRJNU1UZ2dNQzQxTmpBd05UVkRNQzQzTmpRMk5URWdNQzQxTmpVeU5UVWdNQzQ0TWpZMk5URWdNQzQxTnpZek1qSWdNQzQ0TVRrd05URWdNQzQxTXpReE9EaGFUVEF1TkRnd05qVXhJREF1TVRrek16ZzVRekF1TlRZd05qVXhJREF1TVRrek16ZzVJREF1TmpVeU1qVXhJREF1TWpBeU5EVTJJREF1TnpJek9UZzBJREF1TWpReE9USXpRekF1TnpNMU1EVXhJREF1TWpRNE1EVTJJREF1TnpZd056ZzBJREF1TWpZeE56ZzVJREF1TnpVek1EVXhJREF1TWpjNE1EVTJRekF1TnpRMU16RTRJREF1TWprME16SXpJREF1TnpJeE16RTRJREF1TXpBeU5EVTJJREF1TnpBMk5qVXhJREF1TXpBNE16SXlRekF1TmpnMU56QTRJREF1TXpFMk1EVTVJREF1TmpZME1UY2dNQzR6TWpJd056Z2dNQzQyTkRJeU5URWdNQzR6TWpZek1qSkRNQzQxTkRjd056UWdNQzR6TkRVeE56WWdNQzQwTkRrek1qa2dNQzR6TkRjeU1EY2dNQzR6TlRNME5URWdNQzR6TXpJek1qSkRNQzR6TVRBeE5UZ2dNQzR6TWpjNE5UZ2dNQzR5Tmpnd05EUWdNQzR6TVRVMU1qSWdNQzR5TWpreE9EUWdNQzR5T1RVNU1qTkRNQzR5TVRrMU9EUWdNQzR5T1RBME5UWWdNQzR5TURNM01UZ2dNQzR5T0RBMU9Ea2dNQzR5TURneE1UZ2dNQzR5TmpjMU1qTkRNQzR5TVRFMk1ETWdNQzR5TmpBMU1ESWdNQzR5TVRjd056UWdNQzR5TlRRMk5pQXdMakl5TXpnMU1TQXdMakkxTURjeU0wTXdMakkxTXpFek55QXdMakl6TVRnNE9TQXdMakk0TlRjd015QXdMakl4T0RjeU55QXdMak14T1RnMU1TQXdMakl4TVRreU0wTXdMak0zTWpVd055QXdMakU1T1RJNE1pQXdMalF5TmpVZ01DNHhPVE13TlRrZ01DNDBPREEyTlRFZ01DNHhPVE16T0RsV01DNHhPVE16T0RsYVRUQXVOamc1TnpFNElEQXVOelUxTXpnNFF6QXVOamczTnpFNElEQXVOemN3T1RnNElEQXVOall4T1RnMElEQXVOemM0TnpJeElEQXVOalE1TnpFNElEQXVOemd6TVRJeFF6QXVOakkwTWpVeElEQXVOemt4TmpRZ01DNDFPVGM1T0RJZ01DNDNPVGMxTXpjZ01DNDFOekV6TVRnZ01DNDRNREEzTWpGRE1DNDFNVEl4TlRZZ01DNDRNRGcxT0RjZ01DNDBOVEl5TVRNZ01DNDRNRGcxT0RjZ01DNHpPVE13TlRFZ01DNDRNREEzTWpGRE1DNHpOVFU1T1RZZ01DNDNPVGM0TkRZZ01DNHpNVGs0TVRJZ01DNDNPRGd3TXpFZ01DNHlPRFl6T0RRZ01DNDNOekUzT0RoRE1DNHlPREU0TXpZZ01DNDNOams0TVRFZ01DNHlOemM1TXlBd0xqYzJOall3TlNBd0xqSTNOVEV3TXlBd0xqYzJNalV6UXpBdU1qY3lNamMzSURBdU56VTRORFUySURBdU1qY3dOalF6SURBdU56VXpOamN6SURBdU1qY3dNemcwSURBdU56UTROekl4UXpBdU1qVTNNRFV4SURBdU5qUXlPVGc0SURBdU1qUXhPRFV4SURBdU5UTTNNalUxSURBdU1qSTNOVGcwSURBdU5ETXhOVEl5VERBdU1qRXlNVEU0SURBdU16RTJPRFUyUXpBdU1qUXlOREk1SURBdU16TXpOVGczSURBdU1qYzFNekk1SURBdU16UTFNVEkwSURBdU16QTVORFV4SURBdU16VXdPVGc1UXpBdU16UTFPVGs0SURBdU16VTROREkzSURBdU16Z3pNREl5SURBdU16WXpNamd6SURBdU5ESXdNalV4SURBdU16WTFOVEl5UXpBdU5Ea3pNekUxSURBdU16Y3dOelU0SURBdU5UWTJOelE1SURBdU16WTJOamd4SURBdU5qTTROemcwSURBdU16VXpNemc1UXpBdU5qYzNNVFkzSURBdU16UTNPRFk0SURBdU56RTBNalEySURBdU16TTFORGswSURBdU56UTRNalV4SURBdU16RTJPRFUyVERBdU56RTVPVGcwSURBdU5USTJNVGc0UXpBdU5qVXlOREU0SURBdU5UQXpPVEk0SURBdU5UZzJOREEySURBdU5EYzNNakF6SURBdU5USXlNemcwSURBdU5EUTJNVGc1UXpBdU5URTVOVGMxSURBdU5EUTFNVEUzSURBdU5URTJPRFUySURBdU5EUXpPREkwSURBdU5URTBNalV4SURBdU5EUXlNekl5UXpBdU5URXdOalV4SURBdU5ETTVOalUxSURBdU5URXhOVGcwSURBdU5EUXdPVGc1SURBdU5UQTVPRFV4SURBdU5ETTJPRFUxUXpBdU5UQTJOVEU0SURBdU5ESTVNalUxSURBdU5UQTFOekU0SURBdU5ESXpOVEl5SURBdU5EazROalV4SURBdU5ERTNNalUxUXpBdU5EazBPRE0ySURBdU5ERTBNaUF3TGpRNU1ETXpNaUF3TGpReE1qRXlNeUF3TGpRNE5UVXpNU0F3TGpReE1USXdOVU13TGpRNE1EY3pJREF1TkRFd01qZzNJREF1TkRjMU56YzRJREF1TkRFd05UVTJJREF1TkRjeE1UQTFJREF1TkRFeE9UZzRRekF1TkRZMk5ETXhJREF1TkRFek5ESXhJREF1TkRZeU1UYzVJREF1TkRFMU9UYzBJREF1TkRVNE56RTNJREF1TkRFNU5ESTBRekF1TkRVMU1qVTJJREF1TkRJeU9EYzFJREF1TkRVeU5qa2dNQzQwTWpjeE1Ua2dNQzQwTlRFeU5ESWdNQzQwTXpFM09EaERNQzQwTkRrM09UVWdNQzQwTXpZME5UY2dNQzQwTkRrMU1TQXdMalEwTVRRd09DQXdMalExTURReE15QXdMalEwTmpJeE1rTXdMalExTVRNeE5pQXdMalExTVRBeE5pQXdMalExTXpNM09TQXdMalExTlRVeU5pQXdMalExTmpReU1pQXdMalExT1RNMU1VTXdMalExT1RRMk5pQXdMalEyTXpFM05TQXdMalEyTXpNNU9DQXdMalEyTmpFNU9TQXdMalEyTnpnM05pQXdMalEyT0RFMU4wTXdMalEzTWpNMU5DQXdMalEzTURFeE5pQXdMalEzTnpJME15QXdMalEzTURrMUlEQXVORGd5TVRFNElEQXVORGN3TlRnNVF6QXVORGcyTnpFMElEQXVORFk1T0RJMklEQXVORGt4TVRrMElEQXVORFk0TkRneUlEQXVORGsxTkRVeElEQXVORFkyTlRnNVF6QXVOVEF3TmpVeElEQXVORFkwT1RnNUlEQXVOVEF3TmpVeElEQXVORFkxTWpVMUlEQXVOVEEyTVRFNElEQXVORFkzTnpnNVF6QXVOVGN3T1RZeUlEQXVORGs1TkRBNElEQXVOak0zTnpZMklEQXVOVEkyT0RReUlEQXVOekEyTVRFNElEQXVOVFE1T1RJeVF6QXVOekUyTXpnMElEQXVOVFV6TWpVMUlEQXVOekUyTWpVeElEQXVOVFE1T1RJeUlEQXVOekUyTWpVeElEQXVOVFU0TkRVMVF6QXVOekUxT0RFNElEQXVOVFkwT1RRM0lEQXVOekUwT1RjeUlEQXVOVGN4TkRBMElEQXVOekV6TnpFNElEQXVOVGMzTnpnNFREQXVOekExTVRnMElEQXVOalF4TXpnNFREQXVOamc1TnpFNElEQXVOelUxTXpnNFdrMHdMalE0TXprNE5DQXdMalEwTURBMU5VTXdMalE0TXprNE5DQXdMalEwTXpZMU5TQXdMalEzT0RreE9DQXdMalEwTXpJMU5TQXdMalEzTnpVNE5DQXdMalEwTURrNE9VTXdMalEzTmpJMU1TQXdMalF6T0RjeU1pQXdMalE0TXprNE5DQXdMalF6TkRrNE9TQXdMalE0TXprNE5DQXdMalEwTURBMU5WcE5NQzQzTkRZMk5URWdNQzQxTXpNek9EaE1NQzQzTlRBMk5URWdNQzQxTURNNU1qSkRNQzQzTmpNNU9EUWdNQzQxTVRFMU1qSWdNQzQzT0RZMk5URWdNQzQxTWpJNU9EZ2dNQzQzT1RJMk5URWdNQzQxTXpneE9EaERNQzQzTnprMU9EUWdNQzQxTkRNMU1qSWdNQzQzTlRnNU1UZ2dNQzQxTXpZME5UVWdNQzQzTkRZMk5URWdNQzQxTXpNek9EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEySWlCNE1qMGlNUzR5TURjd05pSWdlVEk5SWkwd0xqSXdOekEzTWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RkNOall3UmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5rTkJSVE5GSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l3TGprNU9UazVOU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMjE5IiB5PSIyNTEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPTg2NzAxNjZlLWRjMzYtNGY1Mi1iZWE2LTQ1NDVlOTk5MmM4ODtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1wb3N0Z3Jlc3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWkRNQzQ0TXprMk5qZ2dNQzR6TkRBM056WWdNQzQyT0RjME16TWdNQzQwTVRVNU5UWWdNQzQwT1RrMk5qZ2dNQzQwTVRVNU5UWkRNQzR6TVRFNU1ETWdNQzQwTVRVNU5UWWdNQzR4TlRrMk5qZ2dNQzR6TkRBM056WWdNQzR4TlRrMk5qZ2dNQzR5TkRjNU5UWkRNQzR4TlRrMk5qZ2dNQzR4TlRVeE16WWdNQzR6TVRFNU1ETWdNQzR3TnprNU5UWXhJREF1TkRrNU5qWTRJREF1TURjNU9UVTJNVU13TGpZNE56UXpNeUF3TGpBM09UazFOakVnTUM0NE16azJOamdnTUM0eE5UVXhNellnTUM0NE16azJOamdnTUM0eU5EYzVOVFphVFRBdU9ETTVOalk0SURBdU16YzJNVGd5UXpBdU9ERTRNVGcySURBdU16azBPRFUzSURBdU56azBNamt4SURBdU5ERXdOak16SURBdU56WTROakE0SURBdU5ESXpNRGsyUXpBdU5qazJORFF6SURBdU5EVTROekV5SURBdU5qQXhNekk0SURBdU5EYzRPVFUySURBdU5EazVOalk0SURBdU5EYzRPVFUyUXpBdU16azRNREE0SURBdU5EYzRPVFUySURBdU16QXlPRGt6SURBdU5EVTROekV5SURBdU1qTXdOekk0SURBdU5ESXpNRGsyUXpBdU1qQTFNRFEySURBdU5ERXdOak16SURBdU1UZ3hNVFVnTUM0ek9UUTROVGNnTUM0eE5UazJOamdnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0eE5UazJOamdnTUM0NE5EUTNOellnTUM0ek1URTVNRE1nTUM0NU1UazVOVFlnTUM0ME9UazJOamdnTUM0NU1UazVOVFpETUM0Mk9EYzBNek1nTUM0NU1UazVOVFlnTUM0NE16azJOamdnTUM0NE5EUTNOellnTUM0NE16azJOamdnTUM0M05URTVOVFpXTUM0ek56WXhPREphVFRBdU5UZzBOelkwSURBdU5URTVPVGM0U0RBdU5UZzNNVGc0UXpBdU5qRXlORFE1SURBdU5USXdNVGMzSURBdU5qUXlOVGt4SURBdU5USTNOREUwSURBdU5qWTBPRFkxSURBdU5UVTFPRGsxUXpBdU5qWTNOekF6SURBdU5UVTVOVEUwSURBdU5qWTVPVEkzSURBdU5UWTRNVGMzSURBdU5qWTVOell4SURBdU5UZ3dNVEk0UXpBdU5qWTVOVFl4SURBdU5Ua3lNRGM0SURBdU5qWTNNamc0SURBdU5qQTNNVFkxSURBdU5qWXpNREExSURBdU5qSXpPREV5UXpBdU5qVTFNREExSURBdU5qVTBOek0wSURBdU5qUXdNREF4SURBdU5qa3hJREF1TmpFNU1UZzNJREF1TnpJek56aE1NQzQyTVRjeU9UVWdNQzQzTWpFek9VTXdMall5TlRFMk15QXdMamN3T0RNeU9DQXdMall5TmpZeU15QXdMalk1TlRBeE5pQXdMall5TmpBeU5pQXdMalk0TWpsRE1DNDJNalUzTlRJZ01DNDJOemN6SURBdU5qSTFNVEV6SURBdU5qY3hPVEF6SURBdU5qSTBOVEF6SURBdU5qWTJOelkyUXpBdU5qSXpOekE1SURBdU5qWXdNRGN5SURBdU5qSXlPVFkzSURBdU5qVXpPREU1SURBdU5qSXpNVFUxSURBdU5qUTRNVEk0UXpBdU5qSXpNelEwSURBdU5qUXlNREl5SURBdU5qSTBNVFE0SURBdU5qTTJOamswSURBdU5qSTBPVFEzSURBdU5qTXhOREF5UXpBdU5qSTFPVFl5SURBdU5qSTBOalk1SURBdU5qSTJPVFk0SURBdU5qRTNPVGsxSURBdU5qSTJOamtnTUM0Mk1EazROVFJNTUM0Mk1qWTNPRGtnTUM0Mk1EazJNemhETUM0Mk1qY3dOVFVnTUM0Mk1EZzFNallnTUM0Mk1qY3dNaklnTUM0Mk1EYzROemtnTUM0Mk1qWTVPRGdnTUM0Mk1EY3lORGhETUM0Mk1qWTVNRFVnTUM0Mk1EVTVPRGNnTUM0Mk1qWTJOek1nTUM0Mk1EUTNOelVnTUM0Mk1qWXpNalVnTUM0Mk1ETXpNekZETUM0Mk1qVTJNamdnTUM0Mk1EQTBOaUF3TGpZeU5ETTVPU0F3TGpVNU5qYzFPQ0F3TGpZeU1qVTNOQ0F3TGpVNU1qTTNOME13TGpZeE56YzBOeUF3TGpVNE1EazNJREF1TmpFeE5ESTVJREF1TlRjd01qVTFJREF1TmpBek56ZzFJREF1TlRZd05UQTVRekF1TlRreU56Z3hJREF1TlRRMk5ETTFJREF1TlRjM01UWXpJREF1TlRNeU16STNJREF1TlRVMk5EZ3lJREF1TlRJek1UWTFRekF1TlRZMU56Z3lJREF1TlRJeE1UYzRJREF1TlRjMU1qVTFJREF1TlRJd01URXhJREF1TlRnME56WTBJREF1TlRFNU9UYzRXazB3TGpRMk16TXlJREF1TlRNNU1EZ3lRekF1TkRjek9Ua3hJREF1TlRNd01qQXlJREF1TkRnNE1EWTNJREF1TlRJME1qYzNJREF1TlRBM05qZzFJREF1TlRJME1qSTNWakF1TlRJME1qWklNQzQxTURrMU9UUkRNQzQxTlRFek1pQXdMalV5TkRrME1TQXdMalUzT0RNeU5DQXdMalUwTmpBNE5pQXdMalU1TlRBd05TQXdMalUyTnpReE5FTXdMall3TWpBeU15QXdMalUzTmpNM015QXdMall3Tnpnek15QXdMalU0TmpJeE55QXdMall4TWpJNE15QXdMalU1TmpZNU1rTXdMall4TWprNE9DQXdMalU1T0RNMk5TQXdMall4TXpNMk5pQXdMalU1T1RVNE1TQXdMall4TXpjek9TQXdMall3TURjNE1rTXdMall4TXpnNE5DQXdMall3TVRJME9TQXdMall4TkRBeU9TQXdMall3TVRjeE5DQXdMall4TkRFNU1pQXdMall3TWpJd01rTXdMalU1TkRVd055QXdMall3TURJeE1TQXdMalU0TVRNNU5TQXdMall3TXpjMk15QXdMalUzTXpreU5pQXdMall4TWpNeU4wTXdMalUyTlRRNU5TQXdMall5TVRrM0lEQXVOVFkxT1RjMklEQXVOak0xTmpRM0lEQXVOVFk1TWpZeUlEQXVOalE0T0RVNFF6QXVOVGN5TlRZMUlEQXVOall5TURnMklEQXVOVGM0T1RJeUlEQXVOamMxTmpZeklEQXVOVGcwTnpZMElEQXVOamcyT0RZM1F6QXVOVGczTXpJM0lEQXVOamt4TnpjeklEQXVOVGc1TnpnM0lEQXVOamsyTWpBM0lEQXVOVGt4T0RReklEQXVOams1T1RGTU1DNDFPVEkyT0RFZ01DNDNNREUwTWpOTU1DNDFPVFk1TkRjZ01DNDNNRGswTkVNd0xqVTVPVGN6SURBdU56RTJNREl5SURBdU5qQXpORFUxSURBdU56SXlNVFkySURBdU5qQTRNREF4SURBdU56STNOamhNTUM0Mk1USXdNelFnTUM0M016TXdOelJETUM0Mk1UQTRNak1nTUM0M016TTBNak1nTUM0Mk1Ea3pORFVnTUM0M016TTVNRFFnTUM0Mk1EYzNOamdnTUM0M016UTJNVGhETUM0Mk1EUTJNVFVnTUM0M016WXdORFVnTUM0Mk1EQTVOalFnTUM0M016ZzJPRFFnTUM0MU9UZzJNRFlnTUM0M05ETkRNQzQxT1RZek1UWWdNQzQzTkRjeE9Ua2dNQzQxT1RVeU5UUWdNQzQzTlRJM01Ea2dNQzQxT1RVMU9EWWdNQzQzTlRrNE9FTXdMalU1TkRnMU5TQXdMamMyT1RNNUlEQXVOVGc0T0RFMElEQXVPREU1T1RNZ01DNDFPRFU0TVNBd0xqZ3pOek0xTjBNd0xqVTRNemd3TVNBd0xqZzBPRGs1TWlBd0xqVTRNRFkyTlNBd0xqZzFOalU1TkNBd0xqVTNOVFF4T1NBd0xqZzJNakExTkVNd0xqVTNNREUxT0NBd0xqZzJOelV4TlNBd0xqVTJNakk1TVNBd0xqZzNNVE14TmlBd0xqVTBPVFUwTkNBd0xqZzNOREExTkVNd0xqVXpORGd6T1NBd0xqZzNOekl3T0NBd0xqVXlOamM0T1NBd0xqZzNOREExTkNBd0xqVXlNVEUzT1NBd0xqZzJPVE0wTVVNd0xqVXhOVFUyT1NBd0xqZzJORFl4SURBdU5URXlORFkxSURBdU9EVTNOalUySURBdU5URXdNelF4SURBdU9EVXlNelExUXpBdU5UQTVOamt6SURBdU9EVXdOelV4SURBdU5UQTROamdnTUM0NE5EWXdNemdnTUM0MU1EYzVOamNnTUM0NE16azRORGRETUM0MU1EY3lOVFFnTUM0NE16TTJNemtnTUM0MU1EWTJPRGtnTUM0NE1qVTNOeklnTUM0MU1EWXpNRGdnTUM0NE1UWTRORE5ETUM0MU1EVTFNelFnTUM0M09UWXhOeUF3TGpVd05UUTJNeUF3TGpjM05UUTNPQ0F3TGpVd05qQTVNU0F3TGpjMU5EZ3dNVU13TGpVd05qRXhPQ0F3TGpjMU5EQTRNeUF3TGpVd05qQXdOU0F3TGpjMU16TTJOeUF3TGpVd05UYzFPU0F3TGpjMU1qWTVNME13TGpVd05UVXlOeUF3TGpjMU1UQTFJREF1TlRBMU1USTVJREF1TnpRNU5EVTJJREF1TlRBME5UZ3hJREF1TnpRM09UYzVRekF1TlRBeU5EY3pJREF1TnpReU16TTJJREF1TkRrNE5UY3pJREF1TnpNM016a2dNQzQwT1RJNE9UWWdNQzQzTXpVd016TkRNQzQwT1RFd016Y2dNQzQzTXpReU16WWdNQzQwT0RjNU1UY2dNQzQzTXpJNU1EZ2dNQzQwT0RNNU16TWdNQzQzTXpNeU5Fd3dMalE0TVRjNU1pQXdMamN6TXpZM01rTXdMalE0TXpNeE1pQXdMamN5TnprM0lEQXVORGcxTVRRMklEQXVOekl5TXpVM0lEQXVORGczTWpnM0lEQXVOekUyT0RVNVF6QXVORGc0TVRNMklEQXVOekUwTlRjeklEQXVORGc1TWpBMklEQXVOekV5TVRjMklEQXVORGt3TXpjZ01DNDNNRGsxTmpoRE1DNDBPVFk1TXpJZ01DNDJPVFE0TmpJZ01DNDFNRFkwT0RrZ01DNDJOek0wTkRVZ01DNDBPVFkxTmpVZ01DNDJNamMxTTBNd0xqUTVOREV5TkNBd0xqWXhOakkzTnlBd0xqUTROelF3TXlBd0xqWXdPRGcxT0NBd0xqUTNPVEkzSURBdU5qQTFOekExUXpBdU5EY3hNVE0zSURBdU5qQXlOVFV4SURBdU5EWXlNVFU0SURBdU5qQXpNVFE0SURBdU5EVXpPREkySURBdU5qQTFNRFUzUXpBdU5EUTFORGswSURBdU5qQTJPVGd6SURBdU5ETTNOekVnTUM0Mk1UQXpNRElnTUM0ME16RTNPRFVnTUM0Mk1UTTJNakpNTUM0ME16RTFOamdnTUM0Mk1UTTNOVFZETUM0ME16SXpORGdnTUM0Mk1ETTNNamtnTUM0ME16UXpNak1nTUM0MU9EZzVOVGdnTUM0ME5EQXdPRE1nTUM0MU56TTJPRGhETUM0ME5EUTVNamtnTUM0MU5qQTRNalVnTUM0ME5USXpNVFVnTUM0MU5EZ3lOaUF3TGpRMk16TXlJREF1TlRNNU1EZ3lXazB3TGpNNU1URXpOeUF3TGpVeU5USTNNMHd3TGpNNU56UTBOQ0F3TGpVeU5UQTVUREF1TkRBek56TTBJREF1TlRJMU1qVTJRekF1TkRJek16SWdNQzQxTWpZeU1Ua2dNQzQwTkRFME1URWdNQzQxTXpFek16RWdNQzQwTlRFMk1ESWdNQzQxTXpRMk9ETkRNQzQwTkRFeU1qZ2dNQzQxTkRRNE5ERWdNQzQwTXpRek1EY2dNQzQxTlRjek9Ea2dNQzQwTWprMk5pQXdMalUyT1Rjek9FTXdMalF5TXpFME9TQXdMalU0Tnpjd01pQXdMalF4T1RneU5DQXdMall3TmpZNElEQXVOREU1T0RNMElEQXVOakkxTnpnNFREQXVOREU1T0RVZ01DNDJNalU0T0RkV01DNDJNalU1TjFZd0xqWXlOakk0TmtNd0xqUXhPVGcxSURBdU5qSTNPVEk1SURBdU5ERTVPVGMzSURBdU5qTXdNREUySURBdU5ESXdNVE0xSURBdU5qTXlOakV6UXpBdU5ESXdNekk1SURBdU5qTTFPREV6SURBdU5ESXdOVGNnTUM0Mk16azNPRFlnTUM0ME1qQTJPQ0F3TGpZME5EWTFPVU13TGpReU1EZzNPU0F3TGpZMU16Y3lNU0F3TGpReU1EWTBPQ0F3TGpZMk5URTVJREF1TkRFNE9UTTRJREF1TmpjM05EVTJRekF1TkRFM05URTVJREF1TmpnM01EazJJREF1TkRFNE5UUTVJREF1TmprMk9UTTRJREF1TkRJeE9UTXpJREF1TnpBMk1EYzFRekF1TkRJMU16RTVJREF1TnpFMU1qRXlJREF1TkRNd09UUTVJREF1TnpJek16VWdNQzQwTXpnek1EY2dNQzQzTWprM016aERNQzQwTWpjNU16Z2dNQzQzTkRBM05TQXdMalF4TnpreE9DQXdMamMxTWpBNE5pQXdMalF3T0RJMk5TQXdMamMyTXpjelF6QXVOREF5T1RjZ01DNDNOekF3T0RjZ01DNHpPVGcyTXprZ01DNDNOekl4TmpJZ01DNHpPVFV3TXpjZ01DNDNOekl6TWpoRE1DNHpPVEUwTlRJZ01DNDNOekkwTnpjZ01DNHpPRGMxTURJZ01DNDNOekEzTURFZ01DNHpPREk1TlRRZ01DNDNOall6TURORE1DNHpOek01TWpVZ01DNDNOVGMxTURZZ01DNHpOalEwTVRRZ01DNDNNemc1TVRjZ01DNHpOVFkxTmpRZ01DNDNNVGMxTlRaRE1DNHpORGczTXlBd0xqWTVOakU1TlNBd0xqTTBNakl3TnlBd0xqWTNNakF4TWlBd0xqTXpOell3T1NBd0xqWTFNVFEyTkVNd0xqTXpNams1TlNBd0xqWXpNRGt4TmlBd0xqTXpNRE13TmlBd0xqWXhNell5TWlBd0xqTXlPVGs1TVNBd0xqWXdOelEwTjBNd0xqTXlPRE0yTkNBd0xqVTNORGd6TXlBd0xqTXpOVGd6TkNBd0xqVTFOVEV6TWlBd0xqTTBOekU0TmlBd0xqVTBNekV4TlVNd0xqTTFPRFV5TWlBd0xqVXpNVEE1T0NBd0xqTTNORE0zTXlBd0xqVXlOakl6TlNBd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTFwTk1DNDFPREl6TURnZ01DNDJNVGsyTVRORE1DNDFPRFUyTWpnZ01DNDJNVFU0TVRNZ01DNDFPVEU1TlRFZ01DNDJNVEk1TURnZ01DNDJNRE15TWpFZ01DNDJNVEkzTlRsRE1DNDJNRGN6TWpjZ01DNDJNVEkzTmpFZ01DNDJNVEUwTXlBd0xqWXhNekF5T0NBd0xqWXhOVFV3TXlBd0xqWXhNelUxTlVNd0xqWXhOVE00TkNBd0xqWXhPRGMyT0NBd0xqWXhORFk0TnlBd0xqWXlNelU0TnlBd0xqWXhNemswTWlBd0xqWXlPRGN6TjBNd0xqWXhNekV5TmlBd0xqWXpORE0zTnlBd0xqWXhNakkxTWlBd0xqWTBNRFF4TXlBd0xqWXhNakF4T0NBd0xqWTBOemM1TmtNd0xqWXhNVGMzT1NBd0xqWTFOVEF6TVNBd0xqWXhNalkxTkNBd0xqWTJNakl4TWlBd0xqWXhNelV4T1NBd0xqWTJPVE14TlVNd0xqWXhOREE1T0NBd0xqWTNOREEzTkNBd0xqWXhORFkzTXlBd0xqWTNPRGM1T1NBd0xqWXhORGt3TlNBd0xqWTRNelE0TVVNd0xqWXhOVE0xTkNBd0xqWTVNamt3T0NBd0xqWXhORFUzTXlBd0xqY3dNVGsxTkNBd0xqWXhNREl3T1NBd0xqY3hNVEUyTmtNd0xqWXdPVEUzT1NBd0xqY3dPVE0wSURBdU5qQTRNVFkzSURBdU56QTNNemd4SURBdU5qQTNNalUwSURBdU56QTFNVFUzUXpBdU5qQTJNemMySURBdU56QXpNRE0xSURBdU5qQTFNREEySURBdU56QXdOVGc1SURBdU5qQXpNVFk1SURBdU5qazNNekE1VERBdU5qQXlOREEzSURBdU5qazFPVFEyUXpBdU5qQXdNaUF3TGpZNU1UazNPU0F3TGpVNU56UTJNaUF3TGpZNE56QTVPU0F3TGpVNU5EWTBJREF1TmpneE5qY3lRekF1TlRnNE9UazNJREF1Tmpjd09ETTBJREF1TlRneU9UZzRJREF1TmpVM056ZzRJREF1TlRnd01EZzBJREF1TmpRMk1USkRNQzQxTnpjeE5qTWdNQzQyTXpRME5qZ2dNQzQxTnpjMk1URWdNQzQyTWpVd01EZ2dNQzQxT0RJek1EZ2dNQzQyTVRrMk1UTmFUVEF1TkRVMk16TXlJREF1TmpFMU9EazJRekF1TkRVNU5qZzBJREF1TmpFMU1URXhJREF1TkRZek1URXpJREF1TmpFME5qazVJREF1TkRZMk5UVTNJREF1TmpFME5qWTNRekF1TkRZNU5URTJJREF1TmpFME5qQXlJREF1TkRjeU5EWXpJREF1TmpFMU1EYzBJREF1TkRjMU1qVXpJREF1TmpFMk1EWXhRekF1TkRnd01qTXlJREF1TmpFM09UZzNJREF1TkRnek9EVWdNQzQyTWpFME1EWWdNQzQwT0RVMk56Y2dNQzQyTWprNE56RkRNQzQwT1RRNU1UWWdNQzQyTnpJMk1qSWdNQzQwT0RjME5DQXdMalk0T1RBM015QXdMalE0TURjMk5TQXdMamN3TXpjMU9VTXdMalEzT1RNM01TQXdMamN3TmpneU9DQXdMalEzT0RBeE1TQXdMamN3T1RneUlEQXVORGMyT0RRM0lEQXVOekV5T1RVNFF6QXVORGMwTlRJeklEQXVOekU1TVRneUlEQXVORGN5TVRrNUlEQXVOekkxTURreElEQXVORGN3TnpnNUlEQXVOek13T1RFM1F6QXVORFEyTlRnNUlEQXVOek13T0RnMElEQXVOREkxT1RreUlEQXVOekEzTXpneElEQXVOREk1T1RVNElEQXVOamM0T1RrNVF6QXVORE14TnpnMUlEQXVOalkxT1RNM0lEQXVORE15TURFMklEQXVOalV6T0RjeElEQXVORE14T0RFM0lEQXVOalEwTkRGRE1DNDBNekUyTnpNZ01DNDJNemd4TkRRZ01DNDBNekV6T0NBd0xqWXpNek16TXlBd0xqUXpNVEU1TWlBd0xqWXpNREl6TmtNd0xqUXpNVEV5TVNBd0xqWXlPVEEySURBdU5ETXhNRFkxSURBdU5qSTRNVE14SURBdU5ETXhNRE0zSURBdU5qSTNORFkwVERBdU5ETXhOREF5SURBdU5qSTNNVE15UXpBdU5ETXpNakl4SURBdU5qSTFOekEySURBdU5ETTFNVFU1SURBdU5qSTBORFFnTUM0ME16Y3hPVFVnTUM0Mk1qTXpORGhETUM0ME5ETXlNVFFnTUM0Mk1qQXdNalVnTUM0ME5EazJOVEVnTUM0Mk1UYzFNVGtnTUM0ME5UWXpNeklnTUM0Mk1UVTRPVFphVFRBdU5UazROemc1SURBdU5qRTRNRFV6U0RBdU5UazNPVFpXTUM0Mk1UZ3dNRE5NTUM0MU9UVXpNRFFnTUM0Mk1UZ3lNVGxETUM0MU9USTROalFnTUM0Mk1UZzFPRFFnTUM0MU9UQTNNRFlnTUM0Mk1Ua3lORGdnTUM0MU9Ea3hNVElnTUM0Mk1qQXhORFJETUM0MU9EZ3pOelVnTUM0Mk1qQTFNVElnTUM0MU9EYzNNVFVnTUM0Mk1qRXdNVGtnTUM0MU9EY3hOekVnTUM0Mk1qRTJNemhNTUM0MU9EWTJNRE1nTUM0Mk1qSTJNamhNTUM0MU9EWTBOek1nTUM0Mk1qTTNOak5ETUM0MU9EWTJNaUF3TGpZeU5EVTBPU0F3TGpVNE5qazRNeUF3TGpZeU5USTNPQ0F3TGpVNE56VXlJREF1TmpJMU9EY3hRekF1TlRnM056Z3hJREF1TmpJMk1UZzRJREF1TlRnNE1EWXhJREF1TmpJMk5EZzVJREF1TlRnNE16VTVJREF1TmpJMk56Y3lRekF1TlRnNE56WTRJREF1TmpJM01UWWdNQzQxT0RreU1Ea2dNQzQyTWpjMU1UUWdNQzQxT0RrMk56Y2dNQzQyTWpjNE1qbERNQzQxT1RFMk5UY2dNQzQyTWpreU1pQXdMalU1TkRBNElEQXVOakk1T0RJNUlEQXVOVGsyTkRneUlEQXVOakk1TlRNNVF6QXVOVGs0T1RVZ01DNDJNamt4TVRJZ01DNDJNREV5TURVZ01DNDJNamM0TnpRZ01DNDJNREk0T0RrZ01DNDJNall3TWtNd0xqWXdNek15TVNBd0xqWXlOVFUzTmlBd0xqWXdNemN4TmlBd0xqWXlOVEE1TnlBd0xqWXdOREEyT0NBd0xqWXlORFU0T0VNd0xqWXdORE13TXlBd0xqWXlOREkwT0NBd0xqWXdORFV4T1NBd0xqWXlNemc1TlNBd0xqWXdORGN4TkNBd0xqWXlNelV6UXpBdU5qQTFNVEkxSURBdU5qSXlPRFU0SURBdU5qQTFNekk0SURBdU5qSXlNRGM0SURBdU5qQTFNamsxSURBdU5qSXhNamxNTUM0Mk1EVXpNVElnTUM0Mk1qRXhOVGRNTUM0Mk1EUTRPRE1nTUM0Mk1qQXhNVEpNTUM0Mk1EUXdOamNnTUM0Mk1Ua3pNekZETUM0Mk1ETTNOek1nTUM0Mk1Ua3hNemdnTUM0Mk1ETTBOVEVnTUM0Mk1UZzVOeUF3TGpZd016QTVPU0F3TGpZeE9EZ3lOVU13TGpZd01qWTVOU0F3TGpZeE9EWTFPU0F3TGpZd01qSTFOU0F3TGpZeE9EVXlOU0F3TGpZd01UYzNOeUF3TGpZeE9EUXhPRU13TGpZd01UQTVOaUF3TGpZeE9ESTFNU0F3TGpZd01ETXpOaUF3TGpZeE9ERTBOQ0F3TGpVNU9UVXhPU0F3TGpZeE9EQTRPRU13TGpVNU9USTRJREF1TmpFNE1EY3lJREF1TlRrNU1ETTNJREF1TmpFNE1EWXhJREF1TlRrNE56ZzVJREF1TmpFNE1EVXpXazB3TGpRM01Ea3lNaUF3TGpZeU1UQTFOMHd3TGpRMk9ERTJOaUF3TGpZeU1EZzBNa3d3TGpRMk9ERTBPU0F3TGpZeU1Ea3dPRU13TGpRMk5qUXlOU0F3TGpZeU1EZ3lNU0F3TGpRMk5EWTVPU0F3TGpZeU1UQTBOaUF3TGpRMk16QTFOQ0F3TGpZeU1UVTNNa013TGpRMk1UWXhJREF1TmpJeU1EZzJJREF1TkRZd01UTXpJREF1TmpJek1ERTJJREF1TkRVNU9EZzBJREF1TmpJME9EQTRRekF1TkRVNU56YzRJREF1TmpJMU9ETTJJREF1TkRZd01ERTNJREF1TmpJMk9EY2dNQzQwTmpBMU5qVWdNQzQyTWpjM05EWkRNQzQwTmpFd09EUWdNQzQyTWpnM05ESWdNQzQwTmpFM05ETWdNQzQyTWprMk5Ua2dNQzQwTmpJMU1qTWdNQzQyTXpBME5qaERNQzQwTmpRek5UVWdNQzQyTXpJME56Z2dNQzQwTmpZNE1TQXdMall6TXpneE1TQXdMalEyT1RRNU5DQXdMall6TkRJMU1rTXdMalEzTWpFeE9TQXdMall6TkRVM05TQXdMalEzTkRjM01TQXdMall6TXprd05pQXdMalEzTmpreklEQXVOak15TXpjM1F6QXVORGMzT0RJMElEQXVOak14TnpnZ01DNDBOemcyTWpRZ01DNDJNekV3TlRNZ01DNDBOemt6TURNZ01DNDJNekF5TVRsRE1DNDBOems1TlRZZ01DNDJNamsxTURVZ01DNDBPREF6T0RrZ01DNDJNamcyTVRnZ01DNDBPREExTkRnZ01DNDJNamMyTmpORE1DNDBPREExTnpJZ01DNDJNamMwTWprZ01DNDBPREExTnpRZ01DNDJNamN4T1RRZ01DNDBPREExTlRRZ01DNDJNalk1TmpGRE1DNDBPREExTXpFZ01DNDJNalkyT0RrZ01DNDBPREEwTnpjZ01DNDJNalkwTWlBd0xqUTRNRE01TkNBd0xqWXlOakUxT1VNd0xqUTRNREkwSURBdU5qSTFOamN6SURBdU5EYzVPVGczSURBdU5qSTFNakkxSURBdU5EYzVOalV4SURBdU5qSTBPRFF5UXpBdU5EYzVNRE0xSURBdU5qSTBNVEU1SURBdU5EYzRNamcySURBdU5qSXpOVEl5SURBdU5EYzNORFEwSURBdU5qSXpNRGd5UXpBdU5EYzFOekU0SURBdU5qSXlNRGcySURBdU5EY3pORFl4SURBdU5qSXhOREEySURBdU5EY3dPVEl5SURBdU5qSXhNRFUzV2swd0xqWXhPRFE1SURBdU56UXlOek0wVERBdU5qRTROVFFnTUM0M05ESTNNVGhETUM0Mk1qQXlNRE1nTUM0M05EUXdPU0F3TGpZeU1qQTJJREF1TnpRMU1Ua3lJREF1TmpJME1EVXhJREF1TnpRMk1ESXhRekF1TmpNeU1EWTRJREF1TnpRNU16SXpJREF1TmpRMU1UUTJJREF1TnpVd05qQXlJREF1TmpZNE1qWTJJREF1TnpRMU9ESXhRekF1TmpZek5UWTBJREF1TnpRNU9UVTBJREF1TmpVNE1qa3pJREF1TnpVek16a3hJREF1TmpVeU5qRTJJREF1TnpVMk1ESTVRekF1TmpRMU5qazBJREF1TnpVNU1qUTVJREF1TmpNeU5qWTFJREF1TnpZeE56SXlJREF1TmpJeU1EYzFJREF1TnpZeE9ETTRRekF1TmpFMk56WTBJREF1TnpZeE9USXhJREF1TmpFeUlEQXVOell4TXpVM0lEQXVOakE1TVRZeUlEQXVOell3TkRrMFF6QXVOakE0TWpnM0lEQXVOell3TWpReElEQXVOakEzTkRVM0lEQXVOelU1T0RRNUlEQXVOakEyTnpBM0lEQXVOelU1TXpNeVF6QXVOakEyTkRReElEQXVOelV6TlRjeUlEQXVOakEzTXpNM0lEQXVOelV3TVRnMklEQXVOakE0TXpneUlEQXVOelE0TWpjNFF6QXVOakE1TWpJMklEQXVOelEyTmpRNUlEQXVOakV3TmpNNElEQXVOelExTXpnMUlEQXVOakV5TXpVZ01DNDNORFEzTWpaRE1DNDJNVE15TnpZZ01DNDNORFF6TVRjZ01DNDJNVFF5T1RrZ01DNDNORFF3TWpJZ01DNDJNVFUwTXpVZ01DNDNORE0yT1RWRE1DNDJNVFl6TnpJZ01DNDNORE0wTWpVZ01DNDJNVGN6T0RjZ01DNDNORE14TXpJZ01DNDJNVGcwT1NBd0xqYzBNamN6TkZwTk1DNDBPRFE0T1RjZ01DNDNORFF5TnpoSU1DNDBPRFV5TkRWV01DNDNORFF6TVRGRE1DNDBPRFl3TVRJZ01DNDNORFEwTURZZ01DNDBPRFkzTmpjZ01DNDNORFExT0RJZ01DNDBPRGMwT1RRZ01DNDNORFE0TXpaRE1DNDBPRGM0T0RJZ01DNDNORFE1TnpFZ01DNDBPRGd5TmpFZ01DNDNORFV4TWpnZ01DNDBPRGcyTXpFZ01DNDNORFV6TURkRE1DNDBPVEEwTWpNZ01DNDNORFl3TlRRZ01DNDBPVEk1TmpNZ01DNDNORGczTWpZZ01DNDBPVFF4TWpRZ01DNDNOVEU0TTBNd0xqUTVOVEkzSURBdU56VTBPVE16SURBdU5EazFNVEl4SURBdU56VTNPREl5SURBdU5Ea3pOekkzSURBdU56VTVOemhETUM0ME9EVTJORE1nTUM0M056RXhNVFlnTUM0ME56WXhOallnTUM0M056VTBPREVnTUM0ME5qY3dOVFFnTUM0M056Y3dOREZETUM0ME5UYzVORElnTUM0M056ZzFPRFVnTUM0ME5Ea3lNVElnTUM0M056Y3dOREVnTUM0ME5ETTVJREF1TnpjMU56RTBRekF1TkRReU1ESTFJREF1TnpjMU1qTXlJREF1TkRNNU56QXhJREF1TnpjME16VXpJREF1TkRNM09Ea3lJREF1Tnpjek16VTNRekF1TkRNM01UWXhJREF1TnpjeU9UYzFJREF1TkRNM01qRXlJREF1TnpjeU9EYzJJREF1TkRNMk56TWdNQzQzTnpJME56ZERNQzQwTXpneU1qUWdNQzQzTnpFM05qTWdNQzQwTkRBME5qVWdNQzQzTnpBNE9EUWdNQzQwTkRRek9ESWdNQzQzTnpBd09EZERNQzQwTlRZM05EY2dNQzQzTmpjMU5EZ2dNQzQwTmpJNU16Z2dNQzQzTmpVMU1qTWdNQzQwTmpjM01ERWdNQzQzTmpFM016bERNQzQwTnpBMk1UTWdNQzQzTlRrME1UVWdNQzQwTnpJMU1ERWdNQzQzTlRZNU9UTWdNQzQwTnpRNE5EZ2dNQzQzTlRNNU9ETkRNQzQwTnpZek5ERWdNQzQzTlRJd05qZ2dNQzQwTnpnd01pQXdMamMwT1RreE5TQXdMalE0TURJMk5pQXdMamMwTnpNNU9FTXdMalE0TWpjek9DQXdMamMwTkRZMklEQXVORGcwTURFMklEQXVOelEwTXpZeElEQXVORGcwT0RrM0lEQXVOelEwTWpjNFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIxOSIgeT0iNjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj02MzBmOGQ3Zi1hYjUyLTQ0YzktOTg3NS1lZjljOTc5Y2Q0ZTU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT04NDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnRhZ3M9QXV0b3NjYWxpbmc7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTMiIHk9IjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iQXV0b3NjYWxpbmciIHN0eWxlPSJ0ZXh0O2h0bWw9MTtyZXNpemFibGU9MDtlZGl0YWJsZT0wO2RlbGV0YWJsZT0wO2Nvbm5lY3RhYmxlPTA7cG9pbnRzPVtdO2lyLnR5cGU9Q09NUE9ORU5UX1RBRzthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTcwIiB5PSItMzgiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJBUEkgLSBJL08gLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPTI0MDkwY2IxLTBjYjYtNDU1ZC05ZDE3LTNjMTFiYTcwODQ4NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI5IiBzb3VyY2U9IjkiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPWNhOWJiMzM2LTVmMGItNDQ2MS1iMTU2LTE2YWVlZWMxNjE0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI5IiBzb3VyY2U9IjEyIiB0YXJnZXQ9IjEwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTMiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIC0+IEFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9YmUxN2QwNTMtYmU3NC00ZGIxLTk1ZjQtMDJhN2ZiYTg2NjNjO2lyLnRhZ3M9TG9naW4gQ3JlZGVudGlhbHM7aXIuYXNzZXRzPVBlcnNvbmFsbHkgSWRlbnRpZmlhYmxlIEluZm9ybWF0aW9uOyIgcGFyZW50PSIxIiBzb3VyY2U9IjUiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMTE1OSIgeT0iMjM2IiB3aWR0aD0iMzQzIiBoZWlnaHQ9IjIwMiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjgiIHZhbHVlPSJJbnRlcm5hbCBMb2dnaW5nIFNlcnZlciAtPiBTSUVNIFRlYW0iIHN0eWxlPSJpci5yZWY9ZTMxMmVkY2YtZWNmMS00YzczLThmYjQtN2RkOTVlOGIwNmRhO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjE5IiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJJbnRlcm5hbCBMb2dnaW5nIFNlcnZlciIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWludGVybmFsLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE15QXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE15QXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak01TkRZd015QXdMalk1TVRVM09FTXdMak0zT0RjeU5TQXdMalk1TVRVM09DQXdMak0yTlRnMU15QXdMamN3TkRRMUlEQXVNelkxT0RVeklEQXVOekl3TXpJNFF6QXVNelkxT0RVeklEQXVOek0yTWpBMklEQXVNemM0TnpJMUlEQXVOelE1TURjNElEQXVNemswTmpBeklEQXVOelE1TURjNFNEQXVOVGN3TURFNVZqQXVOamt4TlRjNFNEQXVNemswTmpBeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak13TWpFNElEQXVOakU1T1RFeFNEQXVOakF3TURFNVF6QXVOVGc1TWpZeklEQXVOakU1T1RFeElEQXVOVGM1T0RJNUlEQXVOakkxTlRjeUlEQXVOVGMwTlRNeklEQXVOak0wTURjNFNEQXVNemswTmpBelF6QXVNemM0TnpJMUlEQXVOak0wTURjNElEQXVNelkxT0RVeklEQXVOakl4TWpBMklEQXVNelkxT0RVeklEQXVOakExTXpJNFF6QXVNelkxT0RVeklEQXVOVGc1TkRVZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTlNBd0xqWXpOREU0TmlBd0xqWXdOVE15T0VNd0xqWXpOREU0TmlBd0xqWXhNRFkxTVNBd0xqWXpNamMwSURBdU5qRTFOak0ySURBdU5qTXdNakU0SURBdU5qRTVPVEV4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qY3lOVEU1SURBdU5qRTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUzTURBeE9WWXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1UazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16TTBNekVnTUM0Mk5UQXdNalJETUM0Mk1UVXdNakVnTUM0Mk5UQXdNalFnTUM0Mk1EQXdPVGdnTUM0Mk5qUTFOelVnTUM0Mk1EQXdPVGdnTUM0Mk9ESTFNalJXTUM0NE9Ua3hPVEZETUM0Mk1EQXdPVGdnTUM0NU1EVXhOelFnTUM0Mk1EVXdOeklnTUM0NU1UQXdNalFnTUM0Mk1URXlNRGtnTUM0NU1UQXdNalJJTUM0Mk5EUTFOREpXTUM0NE5UVTROVGhETUM0Mk5EUTFORElnTUM0NE5EazROelVnTUM0Mk5EazFNVFlnTUM0NE5EVXdNalFnTUM0Mk5UVTJOVE1nTUM0NE5EVXdNalJJTUM0M05EUTFOREZETUM0M05UQTJOemNnTUM0NE5EVXdNalFnTUM0M05UVTJOVElnTUM0NE5EazROelVnTUM0M05UVTJOVElnTUM0NE5UVTROVGhXTUM0NU1UQXdNalJJTUM0M09EZzVPRFZETUM0M09UVXhNakVnTUM0NU1UQXdNalFnTUM0NE1EQXdPVFlnTUM0NU1EVXhOelFnTUM0NE1EQXdPVFlnTUM0NE9Ua3hPVEZXTUM0M09UQTROVGhETUM0NE1EQXdPVFlnTUM0M056STVNRGtnTUM0M09EVXhOeklnTUM0M05UZ3pOVGdnTUM0M05qWTNOak1nTUM0M05UZ3pOVGhJTUM0M05UVTJOVEpXTUM0Mk9ESTFNalJETUM0M05UVTJOVElnTUM0Mk5qUTFOelVnTUM0M05EQTNNamdnTUM0Mk5UQXdNalFnTUM0M01qSXpNVGtnTUM0Mk5UQXdNalJJTUM0Mk16TTBNekZhVFRBdU5qWTJOelkwSURBdU56QTBNVGt4UXpBdU5qWTJOelkwSURBdU56RXdNVGMwSURBdU5qWXhOemc1SURBdU56RTFNREkwSURBdU5qVTFOalV6SURBdU56RTFNREkwUXpBdU5qUTVOVEUySURBdU56RTFNREkwSURBdU5qUTBOVFF5SURBdU56RXdNVGMwSURBdU5qUTBOVFF5SURBdU56QTBNVGt4UXpBdU5qUTBOVFF5SURBdU5qazRNakE0SURBdU5qUTVOVEUySURBdU5qa3pNelU0SURBdU5qVTFOalV6SURBdU5qa3pNelU0UXpBdU5qWXhOemc1SURBdU5qa3pNelU0SURBdU5qWTJOelkwSURBdU5qazRNakE0SURBdU5qWTJOelkwSURBdU56QTBNVGt4V2swd0xqWTJOamMyTkNBd0xqYzFPRE0xT0VNd0xqWTJOamMyTkNBd0xqYzJORE0wTVNBd0xqWTJNVGM0T1NBd0xqYzJPVEU1TVNBd0xqWTFOVFkxTXlBd0xqYzJPVEU1TVVNd0xqWTBPVFV4TmlBd0xqYzJPVEU1TVNBd0xqWTBORFUwTWlBd0xqYzJORE0wTVNBd0xqWTBORFUwTWlBd0xqYzFPRE0xT0VNd0xqWTBORFUwTWlBd0xqYzFNak0zTlNBd0xqWTBPVFV4TmlBd0xqYzBOelV5TkNBd0xqWTFOVFkxTXlBd0xqYzBOelV5TkVNd0xqWTJNVGM0T1NBd0xqYzBOelV5TkNBd0xqWTJOamMyTkNBd0xqYzFNak0zTlNBd0xqWTJOamMyTkNBd0xqYzFPRE0xT0ZwTk1DNDJOalkzTmpRZ01DNDRNVEkxTWpSRE1DNDJOalkzTmpRZ01DNDRNVGcxTURnZ01DNDJOakUzT0RrZ01DNDRNak16TlRnZ01DNDJOVFUyTlRNZ01DNDRNak16TlRoRE1DNDJORGsxTVRZZ01DNDRNak16TlRnZ01DNDJORFExTkRJZ01DNDRNVGcxTURnZ01DNDJORFExTkRJZ01DNDRNVEkxTWpSRE1DNDJORFExTkRJZ01DNDRNRFkxTkRFZ01DNDJORGsxTVRZZ01DNDRNREUyT1RFZ01DNDJOVFUyTlRNZ01DNDRNREUyT1RGRE1DNDJOakUzT0RrZ01DNDRNREUyT1RFZ01DNDJOalkzTmpRZ01DNDRNRFkxTkRFZ01DNDJOalkzTmpRZ01DNDRNVEkxTWpSYVRUQXVOekV4TWpBNElEQXVOekEwTVRreFF6QXVOekV4TWpBNElEQXVOekV3TVRjMElEQXVOekEyTWpNeklEQXVOekUxTURJMElEQXVOekF3TURrM0lEQXVOekUxTURJMFF6QXVOamt6T1RZZ01DNDNNVFV3TWpRZ01DNDJPRGc1T0RZZ01DNDNNVEF4TnpRZ01DNDJPRGc1T0RZZ01DNDNNRFF4T1RGRE1DNDJPRGc1T0RZZ01DNDJPVGd5TURnZ01DNDJPVE01TmlBd0xqWTVNek0xT0NBd0xqY3dNREE1TnlBd0xqWTVNek0xT0VNd0xqY3dOakl6TXlBd0xqWTVNek0xT0NBd0xqY3hNVEl3T0NBd0xqWTVPREl3T0NBd0xqY3hNVEl3T0NBd0xqY3dOREU1TVZwTk1DNDNNVEV5TURnZ01DNDNOVGd6TlRoRE1DNDNNVEV5TURnZ01DNDNOalF6TkRFZ01DNDNNRFl5TXpNZ01DNDNOamt4T1RFZ01DNDNNREF3T1RjZ01DNDNOamt4T1RGRE1DNDJPVE01TmlBd0xqYzJPVEU1TVNBd0xqWTRPRGs0TmlBd0xqYzJORE0wTVNBd0xqWTRPRGs0TmlBd0xqYzFPRE0xT0VNd0xqWTRPRGs0TmlBd0xqYzFNak0zTlNBd0xqWTVNemsySURBdU56UTNOVEkwSURBdU56QXdNRGszSURBdU56UTNOVEkwUXpBdU56QTJNak16SURBdU56UTNOVEkwSURBdU56RXhNakE0SURBdU56VXlNemMxSURBdU56RXhNakE0SURBdU56VTRNelU0V2swd0xqY3hNVEl3T0NBd0xqZ3hNalV5TkVNd0xqY3hNVEl3T0NBd0xqZ3hPRFV3T0NBd0xqY3dOakl6TXlBd0xqZ3lNek0xT0NBd0xqY3dNREE1TnlBd0xqZ3lNek0xT0VNd0xqWTVNemsySURBdU9ESXpNelU0SURBdU5qZzRPVGcySURBdU9ERTROVEE0SURBdU5qZzRPVGcySURBdU9ERXlOVEkwUXpBdU5qZzRPVGcySURBdU9EQTJOVFF4SURBdU5qa3pPVFlnTUM0NE1ERTJPVEVnTUM0M01EQXdPVGNnTUM0NE1ERTJPVEZETUM0M01EWXlNek1nTUM0NE1ERTJPVEVnTUM0M01URXlNRGdnTUM0NE1EWTFOREVnTUM0M01URXlNRGdnTUM0NE1USTFNalJhVFRBdU56VTFOalV5SURBdU9ERXlOVEkwUXpBdU56VTFOalV5SURBdU9ERTROVEE0SURBdU56VXdOamMzSURBdU9ESXpNelU0SURBdU56UTBOVFF4SURBdU9ESXpNelU0UXpBdU56TTROREEwSURBdU9ESXpNelU0SURBdU56TXpORE1nTUM0NE1UZzFNRGdnTUM0M016TTBNeUF3TGpneE1qVXlORU13TGpjek16UXpJREF1T0RBMk5UUXhJREF1TnpNNE5EQTBJREF1T0RBeE5qa3hJREF1TnpRME5UUXhJREF1T0RBeE5qa3hRekF1TnpVd05qYzNJREF1T0RBeE5qa3hJREF1TnpVMU5qVXlJREF1T0RBMk5UUXhJREF1TnpVMU5qVXlJREF1T0RFeU5USTBXazB3TGpjek16UXpJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TnpFeE1qWTBWakF1T1RFd01ESTBTREF1TnpNek5ETmFUVEF1TmpnNU1EUXlJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TmpZMk56WTBWakF1T1RFd01ESTBTREF1TmpnNU1EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1kYTU4ZjQ3My0wOTgzLTRhMzUtYWVkOC1lOWZjMGQ2ZjRkZGU7IiBwYXJlbnQ9IjE5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIwOC41IiB5PSI0NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IlNJRU0gVGVhbSIgc3R5bGU9ImlyLnJlZj1iMzM1MjA4Zi0yZWMzLTQ2NmYtYWI3Ni01MWY5ZGE1OTA0MDY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z2VuZXJpYy1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHlOVFl6TXpjZ01DNDJPVFF5T1RKRE1DNHlOREUwTnlBd0xqWTVOREk1TWlBd0xqSXlOemc0TmlBd0xqWTRPRGd3TXlBd0xqSXhOelV3TWlBd0xqWTNPVGMwTTBNd0xqSXhNVGt4SURBdU5qYzBPRFkwSURBdU1qQTNNalEySURBdU5qWTRPVFE1SURBdU1qQXpPREVnTUM0Mk5qSXlPVGhETUM0eE9UazJNalFnTUM0Mk5UUXhPVFVnTUM0eE9UY3lOakVnTUM0Mk5EUTVPVGtnTUM0eE9UY3lOakVnTUM0Mk16VXlOVEZXTUM0eU9ERXhOamhETUM0eE9UY3lOakVnTUM0eU5EZzFOaUF3TGpJeU16Y3hJREF1TWpJeU1USTNJREF1TWpVMk16TTNJREF1TWpJeU1USTNUREF1TmpNME5EUTNJREF1TWpJeU1USTNUREF1TlRrMU5qQTNJREF1TVRZek1EZzJUREF1TWpVMk16TTNJREF1TVRZek1EZzJRekF1TVRreE1EZ3pJREF1TVRZek1EZzJJREF1TVRNNE1UZzBJREF1TWpFMU9UVXpJREF1TVRNNE1UZzBJREF1TWpneE1UWTRWakF1TmpNMU1qVXhRekF1TVRNNE1UZzBJREF1TmpRNE16Y3pJREF1TVRRd016STJJREF1TmpZd09UazJJREF1TVRRME1qYzVJREF1TmpjeU56ZzVRekF1TVRVd01UUTVJREF1Tmprd01qazRJREF1TVRZd01ERXpJREF1TnpBMU9UYzRJREF1TVRjeU56a2dNQzQzTVRnM05EZERNQzR4T1RReE56SWdNQzQzTkRBeE1UWWdNQzR5TWpNM01TQXdMamMxTXpNek15QXdMakkxTmpNek55QXdMamMxTXpNek0wZ3dMak0zTkRjNE4xWXdMamd4TXpBd05Vd3dMakk0TmpJeU9TQXdMamd4TXpBd05VTXdMakkyT1RreE5pQXdMamd4TXpBd05pQXdMakkxTmpZNU1TQXdMamd5TmpJeU1pQXdMakkxTmpZNU1TQXdMamcwTWpVeU5rTXdMakkxTmpZNU1TQXdMamcxT0RneklEQXVNalk1T1RFMklEQXVPRGN5TURRMklEQXVNamcyTWpNZ01DNDROekl3TkRaTU1DNDJPVGsxTkNBd0xqZzNNakEwTTBNd0xqY3hOVGcxTkNBd0xqZzNNakEwTXlBd0xqY3lPVEEzT1NBd0xqZzFPRGd5TmlBd0xqY3lPVEEzT1NBd0xqZzBNalV5TWtNd0xqY3lPVEEzT0NBd0xqZ3lOakl4T1NBd0xqY3hOVGcxTXlBd0xqZ3hNekF3TWlBd0xqWTVPVFUwSURBdU9ERXpNREF5VERBdU5qRXdPVGN5SURBdU9ERXpNREF6VmpBdU56VXpNek16U0RBdU56STRPVFV6UXpBdU56UXlPRFV6SURBdU56VXpNek16SURBdU56VTJNVGt6SURBdU56VXdPVE0wSURBdU56WTROVGdnTUM0M05EWTFNamRETUM0NE1EY3dOelVnTUM0M016STRNelVnTUM0NE16WXpOekVnTUM0Mk9UazNOVGNnTUM0NE5EUTNNRFlnTUM0Mk5Ua3dORGxETUM0NE5EWXlPQ0F3TGpZMU1UTTJNaUF3TGpnME56RXdOeUF3TGpZME16UXdNeUF3TGpnME56RXdOeUF3TGpZek5USTFNVll3TGpJNE1URTJOME13TGpnME56RXdOeUF3TGpJeE5UazFNeUF3TGpjNU5ESXdOeUF3TGpFMk16QTROaUF3TGpjeU9EazFNeUF3TGpFMk16QTROa2d3TGpVNU5UWXdOMHd3TGpZek5EUTBOeUF3TGpJeU1qRXlOMGd3TGpjeU9EazFNME13TGpjMk1UVTRJREF1TWpJeU1USTNJREF1TnpnNE1ETWdNQzR5TkRnMU5pQXdMamM0T0RBeklEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVOemc0TURNZ01DNDJORFE1T1RrZ01DNDNPRFUyTmpZZ01DNDJOVFF4T1RVZ01DNDNPREUwT0NBd0xqWTJNakk1T0VNd0xqYzNOREk0T1NBd0xqWTNOakl4T0NBd0xqYzJNVGN5TVNBd0xqWTROamt4TXlBd0xqYzBOalV5TVNBd0xqWTVNVFl6TjBNd0xqYzBNRGszTVNBd0xqWTVNek0yTWlBd0xqY3pOVEEzTVNBd0xqWTVOREk1TWlBd0xqY3lPRGsxTXlBd0xqWTVOREk1TWtnd0xqSTFOak16TjFwTk1DNDBNek00TmpRZ01DNDRNVE13TURSTU1DNDFOVEU0T1RVZ01DNDRNVE13TUROV01DNDNOVE16TXpOSU1DNDBNek00TmpSV01DNDRNVE13TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TURBeU5EUXhOREVnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQyIiB5PSI0NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTUzYmEyZDQ3LWNmMTctNGFiZC04NzM2LTQyMGJlODBlODY0Mztpci50YWdzPUFsZXJ0czsiIHBhcmVudD0iMSIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iVGhpcyBUaHJlYXQgTW9kZWwgY292ZXJzIGEgaG9zdGVkIGFwcGxpY2F0aW9uLCB0aGF0IGEgdXNlciBhY2Nlc3NlcyB2aWEuIGEgVUkuICZsdDticj4mbHQ7YnI+QSBTSUVNIHRlYW0gKG9uLXByZW1pc2UpIGlzIGFibGUgdG8gbW9uaXRvciB0aGUgaGVhbHRoIG9mIHRoZSBhcHBsaWNhdGlvbiB2aWEuIHRoZSBDbG91ZHdhdGNoIHNlcnZpY2UuIiBzdHlsZT0ic2hhcGU9bm90ZTtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE0O3NpemU9MjA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I2ZmZjJjYztzdHJva2VDb2xvcj0jZDZiNjU2O2ZvbnRDb2xvcj0jNjY2NjAwOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMjk1IiB5PSItODgiIHdpZHRoPSIxOTMiIGhlaWdodD0iMTY1IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMTE3NyIgeT0iLTcyMiIgd2lkdGg9IjE0NSIgaGVpZ2h0PSIxNTEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiB2YWx1ZT0iVXNlciIgc3R5bGU9ImlyLnJlZj0wOGFlMjQxZi0wNGViLTRkZDYtYjYxYS1mMGM1NjAwOTJiODc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW5kLXVzZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpNalkwTkRnZ01DNHpOREU1TXpORE1DNHpNalkwTkRnZ01DNHlOVFU0TXpNZ01DNHpPVFl5TkRZZ01DNHhPRFl3TXpVZ01DNDBPREl6TkRZZ01DNHhPRFl3TXpWRE1DNDFOamcwTkRZZ01DNHhPRFl3TXpVZ01DNDJNemd5TkRRZ01DNHlOVFU0TXpNZ01DNDJNemd5TkRRZ01DNHpOREU1TXpORE1DNDJNemd5TkRRZ01DNDBNamd3TXpJZ01DNDFOamcwTkRZZ01DNDBPVGM0TXlBd0xqUTRNak0wTmlBd0xqUTVOemd6UXpBdU16azJNalEySURBdU5EazNPRE1nTUM0ek1qWTBORGdnTUM0ME1qZ3dNeklnTUM0ek1qWTBORGdnTUM0ek5ERTVNek5hVFRBdU5EZ3lNelEySURBdU1qSTFNREE1UXpBdU5ERTNOemN4SURBdU1qSTFNREE1SURBdU16WTFOREl6SURBdU1qYzNNelU0SURBdU16WTFOREl6SURBdU16UXhPVE16UXpBdU16WTFOREl6SURBdU5EQTJOVEEzSURBdU5ERTNOemN4SURBdU5EVTRPRFUySURBdU5EZ3lNelEySURBdU5EVTRPRFUyUXpBdU5UUTJPVEl4SURBdU5EVTRPRFUySURBdU5UazVNalk1SURBdU5EQTJOVEEzSURBdU5UazVNalk1SURBdU16UXhPVE16UXpBdU5UazVNalk1SURBdU1qYzNNelU0SURBdU5UUTJPVEl4SURBdU1qSTFNREE1SURBdU5EZ3lNelEySURBdU1qSTFNREE1V2swd0xqSXpNamt4SURBdU5qSTJOREk0UXpBdU1qTXlPVEV4SURBdU5UZzVPREk1SURBdU1qWXlOVGd4SURBdU5UWXdNVGc1SURBdU1qazVNVFkxSURBdU5UWXdNVGc1U0RBdU5qWTFOVEk1UXpBdU5qZzRPRFV6SURBdU5UWXdNVGc1SURBdU56QTVNelk0SURBdU5UY3lNak0zSURBdU56SXhNVGMwSURBdU5Ua3dORFUyUXpBdU56QTVNalV5SURBdU5UZzNPRFEzSURBdU5qazJPRFk0SURBdU5UZzJORGN5SURBdU5qZzBNVFl6SURBdU5UZzJORGN5UXpBdU5qWXhNVFUySURBdU5UZzJORGN5SURBdU5qTTVNakEwSURBdU5Ua3dPVGd4SURBdU5qRTVNVE01SURBdU5UazVNVFl6U0RBdU1qazVNVFkxUXpBdU1qZzBNRGt4SURBdU5UazVNVFl6SURBdU1qY3hPRGcwSURBdU5qRXhNemNnTUM0eU56RTRPRFFnTUM0Mk1qWTBNamhXTUM0Mk16Z3hNemRETUM0eU56RTRPRFFnTUM0Mk9EQTVNak1nTUM0eU9UTXdPU0F3TGpjeE16QTVOQ0F3TGpNeU9UZzRNU0F3TGpjek5UUTVNa013TGpNMk56UTBOU0F3TGpjMU9ETTJNU0F3TGpReU1UQTBNeUF3TGpjM01EWTFJREF1TkRneU16UTJJREF1Tnpjd05qVkRNQzQwT1RJMU1Ua2dNQzQzTnpBMk5TQXdMalV3TWpRNE1TQXdMamMzTURNeE1pQXdMalV4TWpFNU1pQXdMamMyT1RZME0wTXdMalV4TXpBeU1TQXdMamM0TWprMk55QXdMalV4TlRNMk5TQXdMamM1TlRnNE1pQXdMalV4T1RBMU1pQXdMamd3T0RJeE5rTXdMalV3TnpBeU1pQXdMamd3T1RFMU9TQXdMalE1TkRjMk1TQXdMamd3T1RZeU5TQXdMalE0TWpNME5pQXdMamd3T1RZeU5VTXdMalF4TmpZMU1pQXdMamd3T1RZeU5TQXdMak0xTlRJM05TQXdMamM1TmpVNE1TQXdMak13T1RZeE5DQXdMamMyT0RjNE0wTXdMakkyTXpFNElEQXVOelF3TlRFMElEQXVNak15T1RFZ01DNDJPVFkyT0RZZ01DNHlNekk1TVNBd0xqWXpPREV6TjFZd0xqWXlOalF5T0ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzROREF4TXlBd0xqY3dOVGsyTjB3d0xqYzRNRGs1TVNBd0xqY3dORGc1TWt3d0xqYzFOVFEwSURBdU5qVTJPVGcwUXpBdU56UTFOall5SURBdU5qTTROalVnTUM0M01qWTFOelFnTUM0Mk1qY3hPVGNnTUM0M01EVTNPVFVnTUM0Mk1qY3hPVGRJTUM0Mk5ERTBOak5ETUM0Mk1UY3lORFVnTUM0Mk1qY3hPVGNnTUM0MU9UVTNORFVnTUM0Mk5ESTJPVFFnTUM0MU9EZ3dPRFlnTUM0Mk5qVTJOamxNTUM0MU56VTVNRGtnTUM0M01ESXlNREpETUM0MU5UVXpPU0F3TGpjeE1EZzBNeUF3TGpVME1UVXdOQ0F3TGpjek1UQTNPU0F3TGpVME1UVXdOQ0F3TGpjMU5EQTFNVll3TGpjM09URXhNVU13TGpVME1UVXdOQ0F3TGpjNU5UQTROQ0F3TGpVMU1UQXhNeUF3TGpnd09EZ3pOaUF3TGpVMk5EWTNPQ0F3TGpneE5UQXhOa013TGpVMk9ETTJNU0F3TGpnek5qRTNJREF1TlRnMk9ERXlJREF1T0RVeU1qVTBJREF1TmpBNU1ESXhJREF1T0RVeU1qVTBRekF1TmpJNU9UazBJREF1T0RVeU1qVTBJREF1TmpRM05qRTNJREF1T0RNM09UQTVJREF1TmpVeU5qRTBJREF1T0RFNE5EazJTREF1TnpRMU5EY3pRekF1TnpVd05EWTVJREF1T0RNM09UQTVJREF1TnpZNE1Ea3pJREF1T0RVeU1qVTBJREF1TnpnNU1EWTJJREF1T0RVeU1qVTBRekF1T0RFeE1qYzBJREF1T0RVeU1qVTBJREF1T0RJNU56STJJREF1T0RNMk1UY2dNQzQ0TXpNME1Ea2dNQzQ0TVRVd01UWkRNQzQ0TkRjd056UWdNQzQ0TURnNE16WWdNQzQ0TlRZMU9ETWdNQzQzT1RVd09EUWdNQzQ0TlRZMU9ETWdNQzQzTnpreE1URldNQzQzTnpFME9EZERNQzQ0TlRZMU9ETWdNQzQzTkRjMk9EUWdNQzQ0TkRFMk1EUWdNQzQzTWpZME5UWWdNQzQ0TVRreE56Z2dNQzQzTVRnME56aE1NQzQzT0RVeE9UZ2dNQzQzTURZek9EbFdNQzQzTURVNU5qZElNQzQzT0RRd01UTmFUVEF1TmpBNU5ETTNJREF1TmpjeU56ZzJRekF1TmpFME1ETXlJREF1TmpVNU1EQXhJREF1TmpJMk9UTXlJREF1TmpRNU56QXpJREF1TmpReE5EWXpJREF1TmpRNU56QXpTREF1TmpZMU1qZzFWakF1TnpBMU9UWTNTREF1TlRrNE16YzNUREF1TmpBNU5ETTNJREF1TmpjeU56ZzJXazB3TGpjMU5qQTFPQ0F3TGpjd05UazJOMGd3TGpZNE56YzVNVll3TGpZME9UY3dNMGd3TGpjd05UYzVOVU13TGpjeE9ESTJNeUF3TGpZME9UY3dNeUF3TGpjeU9UY3hOU0F3TGpZMU5qVTNOQ0F3TGpjek5UVTRNaUF3TGpZMk56VTNOVXd3TGpjMU5qQTFPQ0F3TGpjd05UazJOMXBOTUM0MU9EWTFNVFVnTUM0NE1EY3lORE5ETUM0MU9EWTFNVFVnTUM0M09UUTRNVE1nTUM0MU9UWTFPVEVnTUM0M09EUTNNemNnTUM0Mk1Ea3dNakVnTUM0M09EUTNNemRETUM0Mk1qRTBOU0F3TGpjNE5EY3pOeUF3TGpZek1UVXlOaUF3TGpjNU5EZ3hNeUF3TGpZek1UVXlOaUF3TGpnd056STBNME13TGpZek1UVXlOaUF3TGpneE9UWTNNaUF3TGpZeU1UUTFJREF1T0RJNU56UTVJREF1TmpBNU1ESXhJREF1T0RJNU56UTVRekF1TlRrMk5Ua3hJREF1T0RJNU56UTVJREF1TlRnMk5URTFJREF1T0RFNU5qY3lJREF1TlRnMk5URTFJREF1T0RBM01qUXpXazB3TGpjNE9UQTJOaUF3TGpjNE5EY3pOME13TGpnd01UUTVOaUF3TGpjNE5EY3pOeUF3TGpneE1UVTNNaUF3TGpjNU5EZ3hNeUF3TGpneE1UVTNNaUF3TGpnd056STBNME13TGpneE1UVTNNaUF3TGpneE9UWTNNaUF3TGpnd01UUTVOaUF3TGpneU9UYzBPU0F3TGpjNE9UQTJOaUF3TGpneU9UYzBPVU13TGpjM05qWXpOaUF3TGpneU9UYzBPU0F3TGpjMk5qVTJJREF1T0RFNU5qY3lJREF1TnpZMk5UWWdNQzQ0TURjeU5ETkRNQzQzTmpZMU5pQXdMamM1TkRneE15QXdMamMzTmpZek5pQXdMamM0TkRjek55QXdMamM0T1RBMk5pQXdMamM0TkRjek4xb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0M05qZ2lJR2hsYVdkb2REMGlNQzQzTmpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPRE01T0NBd0xqRXlNelkxTnlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNDgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjcuNSIgeT0iMzAuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OSIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTg2MyIgeT0iLTg4OCIgd2lkdGg9IjY3MyIgaGVpZ2h0PSI1MDgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYwIiB2YWx1ZT0iQVdTIENsb3VkRnJvbnQgLT4gQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9ODE0N2YyMTAtNjgyMy00Y2ZjLWIwOTQtMmQ5YmU4MTY3YmE0O2lyLnRhZ3M9aHR0cHM6IDQ0MzsiIHBhcmVudD0iNDkiIHNvdXJjZT0iNTEiIHRhcmdldD0iNTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MSIgdmFsdWU9IkFXUyBDbG91ZEZyb250IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Y2YtY2xvdWRmcm9udDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1UVXlOVFVnTUM0NE1EZzROak5NTUM0MU9URTFNakVnTUM0M09UWTFPVGRETUM0Mk1EUXhOamtnTUM0M056STFORFFnTUM0Mk1UUXpNVEVnTUM0M05EY3lOVFlnTUM0Mk1qRTNPRGdnTUM0M01qRXhNMHd3TGpZME56TTRPQ0F3TGpjeU9EVTVOME13TGpZek9UUXlPQ0F3TGpjMU5qTTNNeUF3TGpZeU9EWTJNaUF3TGpjNE16STJOeUF3TGpZeE5USTFOU0F3TGpnd09EZzJNMVl3TGpnd09EZzJNMXBOTUM0Mk5EQXdOVFVnTUM0MU5qUTNNME13TGpZek5UUTBNaUF3TGpRNU1EQTNNU0F3TGpZeE1USXdNeUF3TGpReE56azFNeUF3TGpVMk9UYzRPQ0F3TGpNMU5UWTJNMHd3TGpVNU1qQTFOU0F3TGpNME1URXpRekF1TmpNMk1EWTVJREF1TkRBM01qVTVJREF1TmpZeE9ESTNJREF1TkRnek9EUTBJREF1TmpZMk56SXhJREF1TlRZek1UTk1NQzQyTkRBd05UVWdNQzQxTmpRM00xcE5NQzQwTmpReE9EZ2dNQzR5TkRJNU9UWkRNQzQwTkRRNE16Y2dNQzR5TWpnMU5EVWdNQzQwTWpReU1Ua2dNQzR5TVRVNE56SWdNQzQwTURJMU9EZ2dNQzR5TURVeE0wd3dMalF4TkRjeU1TQXdMakU0TVRNNU5rTXdMalF6TnpjME9DQXdMakU1TWpjeU5pQXdMalExT1Rjd05DQXdMakl3TmpFeE5DQXdMalE0TURNeU1TQXdMakl5TVRNNU4wd3dMalEyTkRFNE9DQXdMakkwTWprNU5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56TXlOU0F3TGpVNU9EWTBOME13TGpVek1URTJOQ0F3TGpVMU5qZzBOeUF3TGpRNE1ESTROQ0F3TGpVeU5EazJNaUF3TGpReU5ETXhOaUF3TGpVd05UTXhORXd3TGpRek1qVTRNeUF3TGpRM09UazRRekF1TkRreU1Ua2dNQzQxTURBNU1ESWdNQzQxTkRZek9URWdNQzQxTXpRNE16UWdNQzQxT1RFeU5TQXdMalUzT1RNeE5Fd3dMalUzTXpJMUlEQXVOVGs0TmpRM1dpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZNE16RTNNU0F3TGpjMU56ZzNORU13TGpZM09ESXpOeUF3TGpjME5EVTBNU0F3TGpZM01qWXpOeUF3TGpjek1qSTNOQ0F3TGpZMk5qVXdOQ0F3TGpjeE9UZzNORXd3TGpZNU1ETTNNU0F3TGpjd09EQXdPRU13TGpZNU5qazBOeUF3TGpjeU1UQXpOaUF3TGpjd01qZzJOaUF3TGpjek5ETTROaUF3TGpjd09ERXdOQ0F3TGpjME9EQXdPRXd3TGpZNE16RTNNU0F3TGpjMU56ZzNORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNRGMyTlRRZ01DNDRNVFV5TXpKTU1DNDFPVGt4TWpFZ01DNDNPVEF3TXpKRE1DNDJNekV3TmpNZ01DNDNOemt5TmpjZ01DNDJOakE1TlRJZ01DNDNOak14TnpNZ01DNDJPRGMxTWpFZ01DNDNOREkwTXpKTU1DNDNNRE01TWpFZ01DNDNOak0wT1RoRE1DNDJOelE1T0RRZ01DNDNPRFl3TlRZZ01DNDJOREkwTXpVZ01DNDRNRE0xTkRnZ01DNDJNRGMyTlRRZ01DNDRNVFV5TXpKV01DNDRNVFV5TXpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TVRnek9EWTRJREF1TkRrek0wd3dMakUzTnpjek5DQXdMalEyTnpRek0wTXdMakl3TnpJNU9TQXdMalEyTURFNU1pQXdMakl6TnpVMk9TQXdMalExTmpJeE15QXdMakkyT0RBd01TQXdMalExTlRVMk5rd3dMakkyT0RZMk9DQXdMalE0TWpJek0wTXdMakkwTURBNE1pQXdMalE0TWpneE9DQXdMakl4TVRZME5pQXdMalE0TmpVeU9TQXdMakU0TXpnMk9DQXdMalE1TXpOV01DNDBPVE16V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF3TWpJNE15QXdMalF3T0RRMlREQXVNemM1T0RneklEQXVNemt6T1RJM1F6QXVNems1TkRVMUlEQXVNell5TVRNNUlEQXVOREl6TlRjNElEQXVNek16TXprZ01DNDBOVEUwT0RNZ01DNHpNRGcxT1RSTU1DNDBOamt3T0RNZ01DNHpNamczTWpkRE1DNDBORE13TWpRZ01DNHpOVEU0T0RNZ01DNDBNakExTVRZZ01DNHpOemczTkRrZ01DNDBNREl5T0RNZ01DNDBNRGcwTmxZd0xqUXdPRFEyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TURZeE9TQXdMakkxTURRelREQXVOVGt4TlRVeklEQXVNakkxTXpZMFF6QXVOakV4TmpJeUlEQXVNakUzT0RRZ01DNDJNekl5TmpjZ01DNHlNVEU1TlRRZ01DNDJOVE15T0RZZ01DNHlNRGMzTmpSTU1DNDJOVGd5TVRrZ01DNHlNelEwTTBNd0xqWXpPRFl3T0NBd0xqSXpPREUxTWlBd0xqWXhPVE0wTVNBd0xqSTBNelV3TXlBd0xqWXdNRFl4T1NBd0xqSTFNRFF6VmpBdU1qVXdORE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNek0yTnpVM0lEQXVOemcyTmpWRE1DNHpNVFE1TmpZZ01DNDNNell3TnpVZ01DNHpNRE16TWpNZ01DNDJPREUzTVRNZ01DNHpNREkwT1NBd0xqWXlOalkxUXpBdU16QXlPVE15SURBdU5qQTFORE15SURBdU16QTFOekEwSURBdU5UZzBNekk0SURBdU16RXdOelUzSURBdU5UWXpOekUyUXpBdU16RXhOamtnTUM0MU5Ua3dOU0F3TGpNeE1qYzFOeUF3TGpVMU5ESTFJREF1TXpFek5qa2dNQzQxTkRrek1UWk1NQzR6TkRBek5UY2dNQzQxTlRRMU1UWkRNQzR6TXprME1qUWdNQzQxTlRrMU9ETWdNQzR6TXpnek5UY2dNQzQxTmpRek9ETWdNQzR6TXpjME1qUWdNQzQxTmpreE9ETkRNQzR6TXpJM05qVWdNQzQxT0Rnd01ERWdNQzR6TXpBeE56SWdNQzQyTURjeU55QXdMak15T1RZNUlEQXVOakkyTmpWRE1DNHpNekF5T1RVZ01DNDJOemd6T0NBd0xqTTBNVEEzT0NBd0xqY3lPVFE0TlNBd0xqTTJNVFF5TkNBd0xqYzNOekExVERBdU16TTJOelUzSURBdU56ZzJOalZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF3TURnZ01DNDRNek15TlRoRE1DNDBNVEUyTnpVZ01DNDRNek15TlRnZ01DNHpNalk0T1RFZ01DNDNPVGd4TXprZ01DNHlOalF6TnprZ01DNDNNelUyTWpkRE1DNHlNREU0TmpjZ01DNDJOek14TVRVZ01DNHhOalkzTkRnZ01DNDFPRGd6TXlBd0xqRTJOamMwT0NBd0xqUTVPVGt5TlVNd0xqRTJOamMwT0NBd0xqUTVNekV5TlNBd0xqRTJOamMwT0NBd0xqUTROalU1TVNBd0xqRTJOelF4TlNBd0xqUTNPVGM1TVVNd0xqRTNNVFV6TmlBd0xqUXhNVFUzTVNBd0xqRTVOalV5TnlBd0xqTTBOakkyTmlBd0xqSXpPVEF3TXlBd0xqSTVNamN5TkVNd0xqSTRNVFEzT1NBd0xqSXpPVEU0TVNBd0xqTXpPVE00TmlBd0xqRTVPVGs1SURBdU5EQTBPRGd4SURBdU1UZ3dORFU0UXpBdU5EUTNOalExSURBdU1UWTNOek01SURBdU5Ea3lOVEkzSURBdU1UWXpOek0wSURBdU5UTTJPRFkzSURBdU1UWTROamd4UXpBdU5UZ3hNakE0SURBdU1UY3pOakk1SURBdU5qSTBNVEEwSURBdU1UZzNOREkzSURBdU5qWXpNREV6SURBdU1qQTVNalU0UXpBdU56RXhNRE01SURBdU1qTTJNVGczSURBdU56VXhOalEzSURBdU1qYzBOVGt6SURBdU56Z3hNakE0SURBdU16SXhNRFEyUXpBdU9ERXdOelk1SURBdU16WTNORGs0SURBdU9ESTRNell6SURBdU5ESXdOVFVnTUM0NE16STBNVGNnTUM0ME56VTBOakZETUM0NE16WTBOekVnTUM0MU16QXpOek1nTUM0NE1qWTROaUF3TGpVNE5UUXpNeUF3TGpnd05EUTBNaUF3TGpZek5UY3lORU13TGpjNE1qQXlOQ0F3TGpZNE5qQXhOQ0F3TGpjME56UTVOeUF3TGpjeU9UazJPQ0F3TGpjd016azBOaUF3TGpjMk16WTFPRU13TGpZME5UUTNNU0F3TGpnd09EWXdOQ0F3TGpVM016Z3pNeUF3TGpnek16QTJNU0F3TGpVd01EQTRJREF1T0RNek1qVTRWakF1T0RNek1qVTRXazB3TGpVd01EQTRJREF1TVRrek1qVTRRekF1TkRjd016Z3lJREF1TVRrek16VTBJREF1TkRRd09EWXlJREF1TVRrM09EUTNJREF1TkRFeU5EZ3hJREF1TWpBMk5Ua3hRekF1TXpVeU1qZzRJREF1TWpJME5UVXpJREF1TWprNU1EWXlJREF1TWpZd05UWTNJREF1TWpZd01EQXlJREF1TXpBNU56WXlRekF1TWpJd09UUXlJREF1TXpVNE9UVTNJREF1TVRrM09UTXhJREF1TkRFNE9UWWdNQzR4T1RRd09ERWdNQzQwT0RFMk5UaERNQzR4T1RRd09ERWdNQzQwT0RjNU1qVWdNQzR4T1RNME1UVWdNQzQwT1RNNU1qVWdNQzR4T1RNME1UVWdNQzQwT1RrNU1qVkRNQzR4T1RNME1UVWdNQzQxT0RFeU5UZ2dNQzR5TWpVM01qUWdNQzQyTlRreU5pQXdMakk0TXpJek5TQXdMamN4TmpjM01VTXdMak0wTURjME5pQXdMamMzTkRJNE1pQXdMalF4T0RjME9DQXdMamd3TmpVNU1TQXdMalV3TURBNElEQXVPREEyTlRreFF6QXVOVE16TnpVZ01DNDRNRFkyTkRRZ01DNDFOamN4T1NBd0xqZ3dNVEExTlNBd0xqVTVPVEF4TXlBd0xqYzVNREExT0VNd0xqWXpNVEF4SURBdU56YzVNekkySURBdU5qWXdPVFE0SURBdU56WXpNak1nTUM0Mk9EYzFORFlnTUM0M05ESTBOVGhETUM0M016Z3hNalFnTUM0M01ETXpNakVnTUM0M056VXlJREF1TmpRNU16VWdNQzQzT1RNMU9EZ2dNQzQxT0Rnd09UbERNQzQ0TVRFNU56WWdNQzQxTWpZNE5EZ2dNQzQ0TVRBM05UUWdNQzQwTmpFek9ERWdNQzQzT1RBd09UVWdNQzQwTURBNE5UaERNQzQzTmprME16WWdNQzR6TkRBek16VWdNQzQzTXpBek56TWdNQzR5T0RjM09EVWdNQzQyTnpnek56RWdNQzR5TlRBMU5qRkRNQzQyTWpZek55QXdMakl4TXpNek55QXdMalUyTkRBek1pQXdMakU1TXpNd01pQXdMalV3TURBNElEQXVNVGt6TWpVNFZqQXVNVGt6TWpVNFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVek1qUTFOU0F3TGpNME5UWTNNa013TGpVeU1EYzJOeUF3TGpNME5UWTNNaUF3TGpVd09UTTBNaUF3TGpNME1qSXdOU0F3TGpRNU9UWXlOaUF3TGpNek5UY3dPVU13TGpRNE9Ua3dPU0F3TGpNeU9USXhNaUF3TGpRNE1qTXpPU0F3TGpNeE9UazNPU0F3TGpRM056ZzNNaUF3TGpNd09URTNPVU13TGpRM016UXdOU0F3TGpJNU9ETTNPQ0F3TGpRM01qSTBOQ0F3TGpJNE5qUTVOU0F3TGpRM05EVXpNeUF3TGpJM05UQXpNME13TGpRM05qZ3lNeUF3TGpJMk16VTNNaUF3TGpRNE1qUTJNaUF3TGpJMU16QTBOeUF3TGpRNU1EY3pOaUF3TGpJME5EYzVNa013TGpRNU9UQXhJREF1TWpNMk5UTTNJREF1TlRBNU5UUTNJREF1TWpNd09USXlJREF1TlRJeE1ERTBJREF1TWpJNE5qVTRRekF1TlRNeU5EZ2dNQzR5TWpZek9UUWdNQzQxTkRRek5qRWdNQzR5TWpjMU9ETWdNQzQxTlRVeE5USWdNQzR5TXpJd056UkRNQzQxTmpVNU5ESWdNQzR5TXpZMU5qVWdNQzQxTnpVeE5UZ2dNQzR5TkRReE5UWWdNQzQxT0RFMk16SWdNQzR5TlRNNE9EZERNQzQxT0RneE1EWWdNQzR5TmpNMk1UZ2dNQzQxT1RFMU5EZ2dNQzR5TnpVd05URWdNQzQxT1RFMU1qSWdNQzR5T0RZM016bERNQzQxT1RFMU1qSWdNQzR5T1RRME9TQXdMalU0T1RrNU15QXdMak13TWpFMk5DQXdMalU0TnpBeU15QXdMak13T1RNeU0wTXdMalU0TkRBMU15QXdMak14TmpRNE1pQXdMalUzT1RjZ01DNHpNakk1T0RRZ01DNDFOelF5TVRRZ01DNHpNamcwTlRoRE1DNDFOamczTWpjZ01DNHpNek01TXpNZ01DNDFOakl5TVRRZ01DNHpNemd5TnpFZ01DNDFOVFV3TkRrZ01DNHpOREV5TWpWRE1DNDFORGM0T0RNZ01DNHpORFF4TnprZ01DNDFOREF5TURZZ01DNHpORFUyT1NBd0xqVXpNalExTlNBd0xqTTBOVFkzTWxZd0xqTTBOVFkzTWxwTk1DNDFNekkwTlRVZ01DNHlOVFF6TXpsRE1DNDFNall3TkRjZ01DNHlOVFF6TXprZ01DNDFNVGszT0RNZ01DNHlOVFl5TXprZ01DNDFNVFEwTlRVZ01DNHlOVGszT1RsRE1DNDFNRGt4TWpjZ01DNHlOak16TmlBd0xqVXdORGszTkNBd0xqSTJPRFF5SURBdU5UQXlOVEl4SURBdU1qYzBNelJETUM0MU1EQXdOamtnTUM0eU9EQXlOaUF3TGpRNU9UUXlPQ0F3TGpJNE5qYzNOU0F3TGpVd01EWTNPQ0F3TGpJNU16QTJRekF1TlRBeE9USTRJREF1TWprNU16UTFJREF1TlRBMU1ERTBJREF1TXpBMU1URTRJREF1TlRBNU5UUTFJREF1TXpBNU5qUTVRekF1TlRFME1EYzJJREF1TXpFME1UZ3hJREF1TlRFNU9EUTVJREF1TXpFM01qWTJJREF1TlRJMk1UTTBJREF1TXpFNE5URTNRekF1TlRNeU5ERTVJREF1TXpFNU56WTNJREF1TlRNNE9UTTBJREF1TXpFNU1USTFJREF1TlRRME9EVTBJREF1TXpFMk5qY3pRekF1TlRVd056YzBJREF1TXpFME1qSXhJREF1TlRVMU9ETTFJREF1TXpFd01EWTRJREF1TlRVNU16azFJREF1TXpBME56UkRNQzQxTmpJNU5UVWdNQzR5T1RrME1URWdNQzQxTmpRNE5UVWdNQzR5T1RNeE5EY2dNQzQxTmpRNE5UVWdNQzR5T0RZM016bERNQzQxTmpRNE5UVWdNQzR5TnpneE5EWWdNQzQxTmpFME5ESWdNQzR5TmprNU1EVWdNQzQxTlRVek5qVWdNQzR5TmpNNE1qbERNQzQxTkRreU9Ea2dNQzR5TlRjM05UTWdNQzQxTkRFd05EZ2dNQzR5TlRRek16a2dNQzQxTXpJME5UVWdNQzR5TlRRek16bFdNQzR5TlRRek16bGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16VXdOVGN4SURBdU5UTXhOekE0UXpBdU16TTRPRGc0SURBdU5UTXhOekE0SURBdU16STNORFk0SURBdU5USTRNalF6SURBdU16RTNOelUxSURBdU5USXhOelV6UXpBdU16QTRNRFF4SURBdU5URTFNall6SURBdU16QXdORGN4SURBdU5UQTJNRE00SURBdU1qazJJREF1TkRrMU1qUTFRekF1TWpreE5USTVJREF1TkRnME5EVXlJREF1TWprd016WWdNQzQwTnpJMU56VWdNQzR5T1RJMk16a2dNQzQwTmpFeE1UaERNQzR5T1RRNU1UZ2dNQzQwTkRrMk5pQXdMak13TURVME5DQXdMalF6T1RFek5TQXdMak13T0Rnd05DQXdMalF6TURnM05FTXdMak14TnpBMk5TQXdMalF5TWpZeE5DQXdMak15TnpVNE9TQXdMalF4TmprNE9DQXdMak16T1RBME55QXdMalF4TkRjd09VTXdMak0xTURVd05TQXdMalF4TWpReklEQXVNell5TXpneElEQXVOREV6TmlBd0xqTTNNekUzTkNBd0xqUXhPREEzUXpBdU16Z3pPVFkzSURBdU5ESXlOVFF4SURBdU16a3pNVGt5SURBdU5ETXdNVEV5SURBdU16azVOamd6SURBdU5ETTVPREkxUXpBdU5EQTJNVGN6SURBdU5EUTVOVE01SURBdU5EQTVOak0zSURBdU5EWXdPVFU1SURBdU5EQTVOak0zSURBdU5EY3lOalF4UXpBdU5EQTVOakF5SURBdU5EZzRNamsySURBdU5EQXpNelk0SURBdU5UQXpNams1SURBdU16a3lNams0SURBdU5URTBNelk0UXpBdU16Z3hNakk1SURBdU5USTFORE00SURBdU16WTJNakkxSURBdU5UTXhOamN5SURBdU16VXdOVGN4SURBdU5UTXhOekE0V2swd0xqTTFNRFUzTVNBd0xqUTBNREkwTVVNd0xqTTBOREUyTWlBd0xqUTBNREkwTVNBd0xqTXpOemc1T0NBd0xqUTBNakUwTVNBd0xqTXpNalUzSURBdU5EUTFOekF4UXpBdU16STNNalF5SURBdU5EUTVNall4SURBdU16SXpNRGc1SURBdU5EVTBNekl5SURBdU16SXdOak0zSURBdU5EWXdNalF5UXpBdU16RTRNVGcxSURBdU5EWTJNVFl5SURBdU16RTNOVFF6SURBdU5EY3lOamMzSURBdU16RTROemt6SURBdU5EYzRPVFl5UXpBdU16SXdNRFF6SURBdU5EZzFNalEzSURBdU16SXpNVEk1SURBdU5Ea3hNRElnTUM0ek1qYzJOaUF3TGpRNU5UVTFNVU13TGpNek1qRTVNaUF3TGpVd01EQTRNaUF3TGpNek56azJOU0F3TGpVd016RTJPQ0F3TGpNME5ESTFJREF1TlRBME5ERTRRekF1TXpVd05UTTFJREF1TlRBMU5qWTVJREF1TXpVM01EUTVJREF1TlRBMU1ESTNJREF1TXpZeU9UY2dNQzQxTURJMU56VkRNQzR6TmpnNE9TQXdMalV3TURFeU1pQXdMak0zTXprMUlEQXVORGsxT1RjZ01DNHpOemMxTVNBd0xqUTVNRFkwTVVNd0xqTTRNVEEzSURBdU5EZzFNekV6SURBdU16Z3lPVGN4SURBdU5EYzVNRFE1SURBdU16Z3lPVGN4SURBdU5EY3lOalF4UXpBdU16Z3pNREEySURBdU5EWTRNelkwSURBdU16Z3lNVGswSURBdU5EWTBNVEl5SURBdU16Z3dOVGd4SURBdU5EWXdNVFpETUM0ek56ZzVOamtnTUM0ME5UWXhPVGdnTUM0ek56WTFPRGdnTUM0ME5USTFPVFVnTUM0ek56TTFOellnTUM0ME5EazFOVGhETUM0ek56QTFOak1nTUM0ME5EWTFNakVnTUM0ek5qWTVPQ0F3TGpRME5ERXhNU0F3TGpNMk16QXpNU0F3TGpRME1qUTJOa013TGpNMU9UQTRNeUF3TGpRME1EZ3lNU0F3TGpNMU5EZzBPQ0F3TGpRek9UazNOQ0F3TGpNMU1EVTNNU0F3TGpRek9UazNORll3TGpRME1ESTBNVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORE0yTnpNZ01DNDNNREkyTURoRE1DNDJNekU1TnprZ01DNDNNREkyTXpRZ01DNDJNakExTkRFZ01DNDJPVGt4T0RrZ01DNDJNVEE0TURjZ01DNDJPVEkzTURsRE1DNDJNREV3TnpNZ01DNDJPRFl5TWprZ01DNDFPVE0wT0RJZ01DNDJOemN3TURVZ01DNDFPRGc1T1RRZ01DNDJOall5TURaRE1DNDFPRFExTURjZ01DNDJOVFUwTURnZ01DNDFPRE16TWpZZ01DNDJORE0xTWlBd0xqVTROVFl3TVNBd0xqWXpNakExUXpBdU5UZzNPRGMySURBdU5qSXdOVGM1SURBdU5Ua3pOVEEwSURBdU5qRXdNRFF5SURBdU5qQXhOemN6SURBdU5qQXhOemN6UXpBdU5qRXdNRFF5SURBdU5Ua3pOVEEwSURBdU5qSXdOVGM1SURBdU5UZzNPRGMySURBdU5qTXlNRFE1SURBdU5UZzFOakF4UXpBdU5qUXpOVEU1SURBdU5UZ3pNekkySURBdU5qVTFOREEySURBdU5UZzBOVEEzSURBdU5qWTJNakExSURBdU5UZzRPVGswUXpBdU5qYzNNREF6SURBdU5Ua3pORGd5SURBdU5qZzJNakkzSURBdU5qQXhNRGN6SURBdU5qa3lOekEzSURBdU5qRXdPREEzUXpBdU5qazVNVGczSURBdU5qSXdOVFF4SURBdU56QXlOak15SURBdU5qTXhPVGdnTUM0M01ESTJNRFlnTUM0Mk5ETTJOelJETUM0M01ESTJNRFlnTUM0Mk5Ua3pNRFFnTUM0Mk9UWXpPVGNnTUM0Mk56UXlPVFFnTUM0Mk9EVXpORFVnTUM0Mk9EVXpORFpETUM0Mk56UXlPVE1nTUM0Mk9UWXpPVGtnTUM0Mk5Ua3pNRE1nTUM0M01ESTJNRGdnTUM0Mk5ETTJOek1nTUM0M01ESTJNRGhXTUM0M01ESTJNRGhhVFRBdU5qUXpOamN6SURBdU5qRXhNamN6UXpBdU5qTTNNalU1SURBdU5qRXhNalEzSURBdU5qTXdPVGd5SURBdU5qRXpNVEkwSURBdU5qSTFOak0ySURBdU5qRTJOalk1UXpBdU5qSXdNamtnTUM0Mk1qQXlNVE1nTUM0Mk1UWXhNVGNnTUM0Mk1qVXlOalFnTUM0Mk1UTTJORFFnTUM0Mk16RXhPREpETUM0Mk1URXhOekVnTUM0Mk16Y3hJREF1TmpFd05URXhJREF1TmpRek5qRTVJREF1TmpFeE56UTJJREF1TmpRNU9URXlRekF1TmpFeU9UZ3hJREF1TmpVMk1qQTJJREF1TmpFMk1EVTJJREF1TmpZeE9Ua3lJREF1TmpJd05UZ3lJREF1TmpZMk5UTTNRekF1TmpJMU1UQTRJREF1TmpjeE1EZ3hJREF1TmpNd09EZ3hJREF1TmpjME1UZ2dNQzQyTXpjeE5qa2dNQzQyTnpVME5ESkRNQzQyTkRNME5UZ2dNQzQyTnpZM01ETWdNQzQyTkRrNU56a2dNQzQyTnpZd05qa2dNQzQyTlRVNU1EY2dNQzQyTnpNMk1rTXdMalkyTVRnek5TQXdMalkzTVRFM01pQXdMalkyTmprd015QXdMalkyTnpBeE9TQXdMalkzTURRM0lEQXVOall4TmpnNFF6QXVOamMwTURNMklEQXVOalUyTXpVM0lEQXVOamMxT1RNNUlEQXVOalV3TURnM0lEQXVOamMxT1RNNUlEQXVOalF6TmpjMFF6QXVOamMxT1RNNUlEQXVOak0xTVRBeklEQXVOamN5TlRRMElEQXVOakkyT0RneUlEQXVOalkyTkRrM0lEQXVOakl3T0RGRE1DNDJOakEwTkRrZ01DNDJNVFEzTXpjZ01DNDJOVEl5TkRJZ01DNDJNVEV6TURnZ01DNDJORE0yTnpNZ01DNDJNVEV5TnpOV01DNDJNVEV5TnpOYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN4TkRjaUlIa3hQU0l4TGpJd056RXhJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056RXdOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci5yZWY9NzM3ZDdhM2MtOWFlNy00YzM3LThmZjctNmM3NjM3ZmVlZDBhOyIgcGFyZW50PSI0OSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2OSIgeT0iMjkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1OSIgdmFsdWU9IkFXUyBBUEkgR2F0ZXdheSAtPiBBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj01YmFkZjk3NC1hZWViLTRiYjAtOWZkZS1hZjYwMzMxM2Q2M2E7aXIudGFncz1odHRwczogNDQzOyIgcGFyZW50PSI0OSIgc291cmNlPSI1MiIgdGFyZ2V0PSI1OCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUyIiB2YWx1ZT0iQVdTIEFQSSBHYXRld2F5IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFkzTmpjZ01DNDRNakF3TnpGRE1DNDJORE01TkRNZ01DNDRNakF3T0RFZ01DNDJOREV4T0RnZ01DNDRNVGt4T1RRZ01DNDJNemc1TURFZ01DNDRNVGMxTXpkRE1DNDJNemN4TnpnZ01DNDRNVFl6TVNBd0xqWXpOVGMzTVNBd0xqZ3hORFk1TVNBd0xqWXpORGM1TnlBd0xqZ3hNamd4TTBNd0xqWXpNemd5TkNBd0xqZ3hNRGt6TlNBd0xqWXpNek14TVNBd0xqZ3dPRGcxTXlBd0xqWXpNek13TVNBd0xqZ3dOamN6TjFZd0xqRTVNelF3TkVNd0xqWXpNek14SURBdU1Ua3hNVEkxSURBdU5qTXpPVEEwSURBdU1UZzRPRGczSURBdU5qTTFNREkwSURBdU1UZzJPVEF6UXpBdU5qTTJNVFEwSURBdU1UZzBPVEU1SURBdU5qTTNOelUxSURBdU1UZ3pNalUxSURBdU5qTTVOekF4SURBdU1UZ3lNRGN4UXpBdU5qUXhOalk1SURBdU1UZ3dOemszSURBdU5qUXpPVE0zSURBdU1UZ3dNRFkxSURBdU5qUTJNamM0SURBdU1UYzVPVFE0UXpBdU5qUTROakU1SURBdU1UYzVPRE14SURBdU5qVXdPVFE1SURBdU1UZ3dNek16SURBdU5qVXpNRE0wSURBdU1UZ3hOREEwVERBdU9ESTJNelkzSURBdU1qWTJNRGN4UXpBdU9ESTROVGt4SURBdU1qWTNNVFlnTUM0NE16QTBOamdnTUM0eU5qZzRORGNnTUM0NE16RTNPRFlnTUM0eU56QTVORE5ETUM0NE16TXhNRFVnTUM0eU56TXdNemtnTUM0NE16TTRNVFFnTUM0eU56VTBOakVnTUM0NE16TTRNelFnTUM0eU56YzVNemRXTUM0M05Ea3hNemRETUM0NE16TTVOemNnTUM0M05USXdOakVnTUM0NE16TXhOVFFnTUM0M05UUTVOVEVnTUM0NE16RTBPVEVnTUM0M05UY3pOakZETUM0NE1qazRNamdnTUM0M05UazNOekVnTUM0NE1qYzBNVGtnTUM0M05qRTFOallnTUM0NE1qUTJNelFnTUM0M05qSTBOekZNTUM0Mk5URXpNREVnTUM0NE1qQXdOekZETUM0Mk5EazNPVGNnTUM0NE1qQXlPRGNnTUM0Mk5EZ3lOekVnTUM0NE1qQXlPRGNnTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZhVFRBdU5qWXdNVEF4SURBdU1qRTBPRGN4VmpBdU56ZzRNakEwVERBdU9EQTJOelkzSURBdU56TTVOVE0zVmpBdU1qZzJNakEwVERBdU5qWXdNVEF4SURBdU1qRTBPRGN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0xTXpRek15QXdMamd5TURBM1F6QXVNelV5TURFM0lEQXVPREl3TWpZeklEQXVNelV3TlRneUlEQXVPREl3TWpZeklEQXVNelE1TVRZMklEQXVPREl3TURkTU1DNHhOelU0TXpNZ01DNDNOakkwTjBNd0xqRTNNekEzTXlBd0xqYzJNVFUwTXlBd0xqRTNNRFk1TXlBd0xqYzFPVGN6TnlBd0xqRTJPVEExTmlBd0xqYzFOek16UXpBdU1UWTNOREU1SURBdU56VTBPVEl5SURBdU1UWTJOakUwSURBdU56VXlNRFExSURBdU1UWTJOelkySURBdU56UTVNVE0zVmpBdU1qYzNPVE0zUXpBdU1UWTJOemcySURBdU1qYzFORFl4SURBdU1UWTNORGsxSURBdU1qY3pNRE01SURBdU1UWTRPREUwSURBdU1qY3dPVFF6UXpBdU1UY3dNVE16SURBdU1qWTRPRFEzSURBdU1UY3lNREE1SURBdU1qWTNNVFlnTUM0eE56UXlNek1nTUM0eU5qWXdOekZNTUM0ek5EYzFOallnTUM0eE9ERTBNRFJETUM0ek5EazJOVEVnTUM0eE9EQXpNek1nTUM0ek5URTVPREVnTUM0eE56azRNekVnTUM0ek5UUXpNaklnTUM0eE56azVORGhETUM0ek5UWTJOak1nTUM0eE9EQXdOalVnTUM0ek5UZzVNeklnTUM0eE9EQTNPVGNnTUM0ek5qQTRPVGtnTUM0eE9ESXdOekZETUM0ek5qSTRNakVnTUM0eE9ETXlOekVnTUM0ek5qUTBNRFVnTUM0eE9EUTVORElnTUM0ek5qVTFNREVnTUM0eE9EWTVNalZETUM0ek5qWTFPVGdnTUM0eE9EZzVNRGdnTUM0ek5qY3hOekVnTUM0eE9URXhNemdnTUM0ek5qY3hOallnTUM0eE9UTTBNRFJXTUM0NE1EWTNNemRETUM0ek5qY3hOVFlnTUM0NE1EZzROVElnTUM0ek5qWTJORE1nTUM0NE1UQTVNelVnTUM0ek5qVTJOeUF3TGpneE1qZ3hNME13TGpNMk5EWTVOaUF3TGpneE5EWTVNU0F3TGpNMk16STRPU0F3TGpneE5qTXhJREF1TXpZeE5UWTJJREF1T0RFM05UTTNRekF1TXpVNU1qTTBJREF1T0RFNU16QTFJREF1TXpVMk16VTNJREF1T0RJd01qQXlJREF1TXpVek5ETXpJREF1T0RJd01EZFdNQzQ0TWpBd04xcE5NQzR4T1RNME16TWdNQzQzTkRBd04wd3dMak0wTURFZ01DNDNPRGczTXpkV01DNHlNVFUwTURSTU1DNHhPVE0wTXpNZ01DNHlPRGN3TURSV01DNDNOREF3TjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpNeU56SWdNQzR6TmpZMk16SklNQzQxT1RNeU56SldNQzR6TXprNU5qWklNQzQyTXpNeU56SldNQzR6TmpZMk16SmFUVEF1TlRVek1qY3lJREF1TXpZMk5qTXlTREF1TlRFek1qY3lWakF1TXpNNU9UWTJTREF1TlRVek1qY3lWakF1TXpZMk5qTXlXazB3TGpRM016STNNaUF3TGpNMk5qWXpNa2d3TGpRek16STNNbFl3TGpNek9UazJOa2d3TGpRM016STNNbFl3TGpNMk5qWXpNbHBOTUM0ek9UTXlOekVnTUM0ek5qWTJNekpJTUM0ek5UTXlOekZXTUM0ek16azVOalpJTUM0ek9UTXlOekZXTUM0ek5qWTJNekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TWpjeUlEQXVOall3TURnNVNEQXVOVGt6TWpjeVZqQXVOak16TkRJelNEQXVOak16TWpjeVZqQXVOall3TURnNVdrMHdMalUxTXpJM01pQXdMalkyTURBNE9VZ3dMalV4TXpJM01sWXdMall6TXpReU0wZ3dMalUxTXpJM01sWXdMalkyTURBNE9WcE5NQzQwTnpNeU56SWdNQzQyTmpBd09EbElNQzQwTXpNeU56SldNQzQyTXpNME1qTklNQzQwTnpNeU56SldNQzQyTmpBd09EbGFUVEF1TXprek1qY3hJREF1TmpZd01EZzVTREF1TXpVek1qY3hWakF1TmpNek5ESXpTREF1TXprek1qY3hWakF1TmpZd01EZzVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBNVFV5SURBdU5UUTFPVE5NTUM0ek9URXpPRFlnTUM0MU1ETXhNME13TGpNNE9Ua3lNeUF3TGpVd01UZzNPQ0F3TGpNNE9EYzBPQ0F3TGpVd01ETXlOQ0F3TGpNNE56azBNaUF3TGpRNU9EVTNOVU13TGpNNE56RXpOaUF3TGpRNU5qZ3lOaUF3TGpNNE5qY3hPU0F3TGpRNU5Ea3lNeUF3TGpNNE5qY3hPU0F3TGpRNU1qazVOME13TGpNNE5qY3hPU0F3TGpRNU1UQTNNU0F3TGpNNE56RXpOaUF3TGpRNE9URTJPQ0F3TGpNNE56azBNaUF3TGpRNE56UXhPRU13TGpNNE9EYzBPQ0F3TGpRNE5UWTJPU0F3TGpNNE9Ua3lNeUF3TGpRNE5ERXhOU0F3TGpNNU1UTTROaUF3TGpRNE1qZzJNMHd3TGpRME1UTTROaUF3TGpRME1EQTJNMHd3TGpRMU9EY3lJREF1TkRZd016Tk1NQzQwTWpBMU9EWWdNQzQwT1RNek9UZE1NQzQwTlRnM01pQXdMalV5TmpBMk0wd3dMalEwTVRVeUlEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVNE56STJJREF1TlRRMU9UTk1NQzQxTkRFek9UTWdNQzQxTWpVMk5qTk1NQzQxTnprMU1qVWdNQzQwT1RNek9UZE1NQzQxTkRFeU5pQXdMalEyTURnMk0wd3dMalUxT0RVNU15QXdMalEwTURBMk0wd3dMall3T0RjeU5TQXdMalE0TWpjelF6QXVOakV3TVRnNElEQXVORGd6T1RneUlEQXVOakV4TXpZeklEQXVORGcxTlRNMklEQXVOakV5TVRZNUlEQXVORGczTWpnMVF6QXVOakV5T1RjMUlEQXVORGc1TURNMElEQXVOakV6TXpreUlEQXVORGt3T1RNNElEQXVOakV6TXpreUlEQXVORGt5T0RZelF6QXVOakV6TXpreUlEQXVORGswTnpnNUlEQXVOakV5T1RjMUlEQXVORGsyTmpreklEQXVOakV5TVRZNUlEQXVORGs0TkRReVF6QXVOakV4TXpZeklEQXVOVEF3TVRreElEQXVOakV3TVRnNElEQXVOVEF4TnpRMUlEQXVOakE0TnpJMUlEQXVOVEF5T1RrM1REQXVOVFU0TnpJMklEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRFek5qZzVJREF1TkRFM01qSTJUREF1TkRZd05qa3pJREF1TlRjek9UYzFUREF1TkRnMU9UVTFJREF1TlRneU5URTFUREF1TlRNNE9UVXhJREF1TkRJMU56WTNUREF1TlRFek5qZzVJREF1TkRFM01qSTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01EWTNJaUI1TVQwaU1TNHlNRGN4TVNJZ2VESTlJakV1TWpBM01UVWlJSGt5UFNJdE1DNHlNRGN4TURjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTBSREkzUVRnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwRXhOalpHUmlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPWE3MzcxMzU5LTU5MDgtNDViNC04NWE4LTE2MjFlNTBmOGRjZDsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjkiIHk9IjM5NSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJBV1MgRWxhc3RpQ2FjaGUgZm9yIFJlZGlzIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtRUxBU1RJQ0FDSEUtRk9SLVJFRElTO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh0WVhOcklHbGtQU0p0WVhOck1GOHlNelkwWHpJek1UUXlJaUJ6ZEhsc1pUMGliV0Z6YXkxMGVYQmxPbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0OFkybHlZMnhsSUdONFBTSXdMalVpSUdONVBTSXdMalVpSUhJOUlqQXVOU0lnWm1sc2JEMGlZbXhoWTJzaUx6NDhMMjFoYzJzK1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1GOHlNelkwWHpJek1UUXlLU0krUEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdYekl6TmpSZk1qTXhORElwSWo0OGNHRjBhQ0JrUFNKTk1TNHdNREF3TXlBd1NETXVNRFV4TnpabExUQTFWakZJTVM0d01EQXdNMVl3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5WHpJek5qUmZNak14TkRJcElpOCtQSEJoZEdnZ1pEMGlUVEF1TlRBd01ETTBJREF1T0RBME5qRkRNQzQwTVRBM05ESWdNQzQ0TURRMk1TQXdMak15TURFM05TQXdMamM0TURjNU9TQXdMak15TURFM05TQXdMamN6TlRRME5GWXdMalF5T1RRME0wZ3dMak0wT0RVeU1sWXdMamN6TlRRME5FTXdMak0wT0RVeU1pQXdMamMwT1RZeE55QXdMalF3TVRrMU5TQXdMamMzTmpFeU1TQXdMalE1T1RnNU1pQXdMamMzTmpFeU1VTXdMalU1TnpneU9TQXdMamMzTmpFeU1TQXdMalkxTVRRd05DQXdMamMwT1RFNU1pQXdMalkxTVRRd05DQXdMamN6TlRRME5GWXdMalF5T1RRME0wZ3dMalkzT1RjMU1WWXdMamN6TlRRME5FTXdMalk0TURFM05pQXdMamM0TURjNU9TQXdMalU0T1RZd09TQXdMamd3TkRZeElEQXVOVEF3TURNMElEQXVPREEwTmpGYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGp4d1lYUm9JR1E5SWswd0xqUXhNakUxTlNBd0xqVTVNalU0TVVNd0xqTTFNamt4TVNBd0xqVTRNRGd4TnlBd0xqTXlNRE14TWlBd0xqVTFPVEV6TWlBd0xqTXlNRE14TWlBd0xqVXpNVFE1TkVnd0xqTTBPRFkxT1VNd0xqTTBPRFkxT1NBd0xqVXpOemN6SURBdU16WTFOVEkxSURBdU5UVTBNekV6SURBdU5ERTNPREkxSURBdU5UWTBOalpNTUM0ME1USXhOVFVnTUM0MU9USTFPREZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQanh3WVhSb0lHUTlJazB3TGpZd05ESXdOQ0F3TGpVNE9EYzFORXd3TGpVNU56STJJREF1TlRZeE5FTXdMall6TmprME5TQXdMalUxTVRNek55QXdMalkxTVRZNE5TQXdMalV6TnpjeklEQXVOalV4TmpnMUlEQXVOVE14TkRrMFNEQXVOamd3TURNeFF6QXVOamd3TURNeElEQXVOVFUyTURFMElEQXVOalV6TVRBeUlEQXVOVGMyTkRJeklEQXVOakEwTWpBMElEQXVOVGc0TnpVMFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0OGNHRjBhQ0JrUFNKTk1DNDFNREF3TXpnZ01DNDBPVGcxT0VNd0xqUXhNRFl3TlNBd0xqUTVPRFU0SURBdU16SXdNRE00SURBdU5EYzBPVEV4SURBdU16SXdNRE00SURBdU5ESTVOREUxUXpBdU16SXdNRE00SURBdU16Z3pPVEU1SURBdU5ERXdOakExSURBdU16WXdNVEEzSURBdU5UQXdNRE00SURBdU16WXdNVEEzUXpBdU5UZzVORGN5SURBdU16WXdNVEEzSURBdU5qYzVPRGszSURBdU16Z3pPVEU1SURBdU5qYzVPRGszSURBdU5ESTVOREUxUXpBdU5qYzVPRGszSURBdU5EYzBPVEV4SURBdU5UZzVOakV6SURBdU5EazROVGdnTUM0MU1EQXdNemdnTUM0ME9UZzFPRnBOTUM0MU1EQXdNemdnTUM0ek9EZzFPVFpETUM0ME1ERTVOVGtnTUM0ek9EZzFPVFlnTUM0ek5EZzFNallnTUM0ME1UVTFNalVnTUM0ek5EZzFNallnTUM0ME1qazBNVFZETUM0ek5EZzFNallnTUM0ME5ETXpNRFFnTUM0ME1ESXlORE1nTUM0ME56QXlNelFnTUM0MU1EQXdNemdnTUM0ME56QXlNelJETUM0MU9UYzRNelFnTUM0ME56QXlNelFnTUM0Mk5URTBNRGtnTUM0ME5ETXpNRFFnTUM0Mk5URTBNRGtnTUM0ME1qazBNVFZETUM0Mk5URTBNRGtnTUM0ME1UVTFNalVnTUM0MU9UZ3lOVGtnTUM0ek9EZzFPVFlnTUM0MU1EQXdNemdnTUM0ek9EZzFPVFpXTUM0ek9EZzFPVFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQanh3WVhSb0lHUTlJazB3TGpVd01EQXpPQ0F3TGpnd05EVXlOME13TGpReE1EWXdOU0F3TGpnd05EVXlOeUF3TGpNeU1EQXpPQ0F3TGpjNE1EY3hOaUF3TGpNeU1EQXpPQ0F3TGpjek5UTTJNVll3TGpZek16TXhORU13TGpNeU1EQXpPQ0F3TGpZeU9UVTFOU0F3TGpNeU1UVXpNU0F3TGpZeU5UazFJREF1TXpJME1UZzVJREF1TmpJek1qa3lRekF1TXpJMk9EUTNJREF1TmpJd05qTTBJREF1TXpNd05EVXlJREF1TmpFNU1UUXhJREF1TXpNME1qRXhJREF1TmpFNU1UUXhRekF1TXpNM09UY2dNQzQyTVRreE5ERWdNQzR6TkRFMU56VWdNQzQyTWpBMk16UWdNQzR6TkRReU16TWdNQzQyTWpNeU9USkRNQzR6TkRZNE9URWdNQzQyTWpVNU5TQXdMak0wT0RNNE5DQXdMall5T1RVMU5TQXdMak0wT0RNNE5DQXdMall6TXpNeE5FTXdMak0wT0RNNE5DQXdMall6T1RVMUlEQXVNelkxTXpreUlEQXVOalUyTVRNeklEQXVOREUzTlRVZ01DNDJOalkyTWpGTU1DNDBNVEU0T0RFZ01DNDJPVFE1TmpoRE1DNHpPRGsyTnpZZ01DNDJPVEV4TmpnZ01DNHpOamd5TXpNZ01DNDJPRE0zT1RjZ01DNHpORGd6T0RRZ01DNDJOek14TkRGV01DNDNNelUzT0RkRE1DNHpORGd6T0RRZ01DNDNORGs1TmlBd0xqUXdNVGsxT1NBd0xqYzNOalEyTkNBd0xqVXdNREF6T0NBd0xqYzNOalEyTkVNd0xqVTVPREV4TnlBd0xqYzNOalEyTkNBd0xqWTFNVFF3T1NBd0xqYzBPVFV6TlNBd0xqWTFNVFF3T1NBd0xqY3pOVGM0TjFZd0xqWTNNalUzTkVNd0xqWXpOalV6TWlBd0xqWTRNRGcyTXlBd0xqWXlNRFUwTWlBd0xqWTROamszTWlBd0xqWXdNemt5T0NBd0xqWTVNRGN4Tmt3d0xqVTVOams0TXlBd0xqWTJNekl4T1VNd0xqWXpOalkyT1NBd0xqWTFNekUxTmlBd0xqWTFNVFF3T1NBd0xqWXpPVFUxSURBdU5qVXhOREE1SURBdU5qTXpNekUwUXpBdU5qVXhOREE1SURBdU5qSTVOVFUxSURBdU5qVXlPVEF5SURBdU5qSTFPVFVnTUM0Mk5UVTFOaUF3TGpZeU16STVNa013TGpZMU9ESXhPQ0F3TGpZeU1EWXpOQ0F3TGpZMk1UZ3lNeUF3TGpZeE9URTBNU0F3TGpZMk5UVTRNaUF3TGpZeE9URTBNVU13TGpZMk9UTTBNU0F3TGpZeE9URTBNU0F3TGpZM01qazBOaUF3TGpZeU1EWXpOQ0F3TGpZM05UWXdOQ0F3TGpZeU16STVNa013TGpZM09ESTJNaUF3TGpZeU5UazFJREF1TmpjNU56VTFJREF1TmpJNU5UVTFJREF1TmpjNU56VTFJREF1TmpNek16RTBWakF1TnpNMU16WXhRekF1Tmpnd01ETTVJREF1Tnpnd056RTJJREF1TlRnNU5qRXpJREF1T0RBME5USTNJREF1TlRBd01ETTRJREF1T0RBME5USTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NDhjR0YwYUNCa1BTSk5NQzQwTkRBeU1UWWdNQzQzTWpVNE1qVldNQzQxTXprNE56SklNQzQxTURnNU5UWkRNQzQxTWpRNE16RWdNQzQxTXprd09DQXdMalUwTURRd05DQXdMalUwTkRRd05pQXdMalUxTWpRMk9DQXdMalUxTkRjMU5FTXdMalUxTnpnNU9TQXdMalUxT1RnNE15QXdMalUyTWpFMk5DQXdMalUyTmpFeE9DQXdMalUyTkRrM05pQXdMalUzTXpBek9FTXdMalUyTnpjNE9DQXdMalUzT1RrMU9DQXdMalUyT1RBNE1TQXdMalU0TnpRd01TQXdMalUyT0RjMk9DQXdMalU1TkRnMk5FTXdMalUyT1RBME1TQXdMall3TmpBMU5TQXdMalUyTlRneU1TQXdMall4TnpBMU15QXdMalUxT1RVMU5TQXdMall5TmpNeU9VTXdMalUxTWpreE5pQXdMall6TlRZeE15QXdMalUwTXpZeU9TQXdMalkwTWpZM055QXdMalV6TWprd09TQXdMalkwTmpVNU4wd3dMalU0TURNNUlEQXVOekkxT1RZM1NEQXVOVFE0TURjMVREQXVOVEExTlRVMUlEQXVOalV5TWpZMlNEQXVORGN5TmpjelZqQXVOekkxT1RZM1REQXVORFF3TWpFMklEQXVOekkxT0RJMVdrMHdMalEzTWpZM015QXdMall5TmpZeE0wZ3dMalV3TkRnME5rTXdMalV3T1RBME1TQXdMall5TnpJd015QXdMalV4TXpNeE55QXdMall5TmpneElEQXVOVEUzTXpNMElEQXVOakkxTkRZMlF6QXVOVEl4TXpVeUlEQXVOakkwTVRJeUlEQXVOVEkxTURBeklEQXVOakl4T0RZeklEQXVOVEkzT1RrNUlEQXVOakU0T0RZM1F6QXVOVE13T1RrMElEQXVOakUxT0RjeUlEQXVOVE16TWpVeklEQXVOakV5TWpJeElEQXVOVE0wTlRrM0lEQXVOakE0TWpBelF6QXVOVE0xT1RReElEQXVOakEwTVRnMUlEQXVOVE0yTXpNMElEQXVOVGs1T1RFZ01DNDFNelUzTkRRZ01DNDFPVFUzTVRWRE1DNDFNell6T1RVZ01DNDFPVEUxT0RNZ01DNDFNell3TnpRZ01DNDFPRGN6TlRjZ01DNDFNelE0TURnZ01DNDFPRE16TnpGRE1DNDFNek0xTkRFZ01DNDFOemt6T0RVZ01DNDFNekV6TmpRZ01DNDFOelUzTkRrZ01DNDFNamcwTkRnZ01DNDFOekkzTlRGRE1DNDFNalUxTXpJZ01DNDFOamszTlRJZ01DNDFNakU1TlRnZ01DNDFOamMwTnpRZ01DNDFNVGd3TURrZ01DNDFOall3T1RkRE1DNDFNVFF3TmlBd0xqVTJORGN5SURBdU5UQTVPRFEwSURBdU5UWTBNamd5SURBdU5UQTFOamszSURBdU5UWTBPREUzU0RBdU5EY3lOamN6VmpBdU5qSTJOakV6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejQ4Y0dGMGFDQmtQU0pOTUM0NE1qWTNNREVnTUM0eU5UWXdOakpETUM0NE16QXlNemNnTUM0eU5UWXdOaklnTUM0NE16TTJNamdnTUM0eU5UUTJOVGNnTUM0NE16WXhNamtnTUM0eU5USXhOVGRETUM0NE16ZzJNamtnTUM0eU5EazJOVFlnTUM0NE5EQXdNelFnTUM0eU5EWXlOalVnTUM0NE5EQXdNelFnTUM0eU5ESTNNamxXTUM0eU1UTTFNamxETUM0NE5EQXdNelFnTUM0eU1EazVPVElnTUM0NE16ZzJNamtnTUM0eU1EWTJNREVnTUM0NE16WXhNamtnTUM0eU1EUXhNREZETUM0NE16TTJNamdnTUM0eU1ERTJJREF1T0RNd01qTTNJREF1TWpBd01UazFJREF1T0RJMk56QXhJREF1TWpBd01UazFTREF1TVRjek16WTRRekF1TVRZNU9ETXhJREF1TWpBd01UazFJREF1TVRZMk5EUWdNQzR5TURFMklEQXVNVFl6T1RNNUlEQXVNakEwTVRBeFF6QXVNVFl4TkRNNUlEQXVNakEyTmpBeElEQXVNVFl3TURNMElEQXVNakE1T1RreUlEQXVNVFl3TURNMElEQXVNakV6TlRJNVZqQXVNalF5TlRrMVF6QXVNVFl3TURNMElEQXVNalEyTVRNeUlEQXVNVFl4TkRNNUlEQXVNalE1TlRJeklEQXVNVFl6T1RNNUlEQXVNalV5TURJelF6QXVNVFkyTkRRZ01DNHlOVFExTWpRZ01DNHhOams0TXpFZ01DNHlOVFU1TWprZ01DNHhOek16TmpnZ01DNHlOVFU1TWpsRE1DNHhPREEyT1RrZ01DNHlOVFkyTWpjZ01DNHhPRGMxTURjZ01DNHlOakF3TXpNZ01DNHhPVEkwTmpFZ01DNHlOalUwT0RKRE1DNHhPVGMwTVRZZ01DNHlOekE1TXpFZ01DNHlNREF4TmpFZ01DNHlOemd3TXpFZ01DNHlNREF4TmpFZ01DNHlPRFV6T1RWRE1DNHlNREF4TmpFZ01DNHlPVEkzTmlBd0xqRTVOelF4TmlBd0xqSTVPVGcySURBdU1Ua3lORFl4SURBdU16QTFNekE1UXpBdU1UZzNOVEEzSURBdU16RXdOelU0SURBdU1UZ3dOams1SURBdU16RTBNVFkwSURBdU1UY3pNelk0SURBdU16RTBPRFl5UXpBdU1UWTVPRE14SURBdU16RTBPRFl5SURBdU1UWTJORFFnTUM0ek1UWXlOamNnTUM0eE5qTTVNemtnTUM0ek1UZzNOamRETUM0eE5qRTBNemtnTUM0ek1qRXlOamdnTUM0eE5qQXdNelFnTUM0ek1qUTJOVGtnTUM0eE5qQXdNelFnTUM0ek1qZ3hPVFZXTUM0MU5qQXhPVFZETUM0eE5qQXdNelFnTUM0MU5qTTNNeklnTUM0eE5qRTBNemtnTUM0MU5qY3hNak1nTUM0eE5qTTVNemtnTUM0MU5qazJNak5ETUM0eE5qWTBOQ0F3TGpVM01qRXlOQ0F3TGpFMk9UZ3pNU0F3TGpVM016VXlPU0F3TGpFM016TTJPQ0F3TGpVM016VXlPVWd3TGpJNU16TTJPRll3TGpVME5qZzJNa2d3TGpJME1EQXpORll3TGpVek16VXlPVWd3TGpJNU16TTJPRll3TGpVd05qZzJNa2d3TGpJeU5qY3dNVU13TGpJeU16RTJOU0F3TGpVd05qZzJNaUF3TGpJeE9UYzNNeUF3TGpVd09ESTJOeUF3TGpJeE56STNNeUF3TGpVeE1EYzJOME13TGpJeE5EYzNNaUF3TGpVeE16STJPQ0F3TGpJeE16TTJPQ0F3TGpVeE5qWTFPU0F3TGpJeE16TTJPQ0F3TGpVeU1ERTVOVll3TGpVME5qZzJNa2d3TGpFNE5qY3dNVll3TGpNek9UYzVOVU13TGpFNU9ETTBOaUF3TGpNek5qSTBOeUF3TGpJd09EVTBNaUF3TGpNeU9UQTFNU0F3TGpJeE5UYzRPQ0F3TGpNeE9USTJPVU13TGpJeU16QXpNeUF3TGpNd09UUTROeUF3TGpJeU5qazBOQ0F3TGpJNU56WXpOU0F3TGpJeU5qazBOQ0F3TGpJNE5UUTJNa013TGpJeU5qazBOQ0F3TGpJM016STRPU0F3TGpJeU16QXpNeUF3TGpJMk1UUXpOeUF3TGpJeE5UYzRPQ0F3TGpJMU1UWTFOVU13TGpJd09EVTBNaUF3TGpJME1UZzNNeUF3TGpFNU9ETTBOaUF3TGpJek5EWTNOeUF3TGpFNE5qY3dNU0F3TGpJek1URXlPVll3TGpJeU5qZzJNa2d3TGpneE16TTJPRll3TGpJek1USTJNa013TGpnd01UZzVNeUF3TGpJek5EazFNaUF3TGpjNU1UZzROaUF3TGpJME1qRTROeUF3TGpjNE5EYzROeUF3TGpJMU1Ua3lOME13TGpjM056WTRPQ0F3TGpJMk1UWTJPQ0F3TGpjM016ZzJNeUF3TGpJM016UXdPU0F3TGpjM016ZzJNeUF3TGpJNE5UUTJNa013TGpjM016ZzJNeUF3TGpJNU56VXhOU0F3TGpjM056WTRPQ0F3TGpNd09USTFOaUF3TGpjNE5EYzROeUF3TGpNeE9EazVOa013TGpjNU1UZzROaUF3TGpNeU9EY3pOeUF3TGpnd01UZzVNeUF3TGpNek5UazNNaUF3TGpneE16TTJPQ0F3TGpNek9UWTJNbFl3TGpVME5qZzJNa2d3TGpnd01EQXpORll3TGpVeU1ERTVOVU13TGpnd01EQXpOQ0F3TGpVeE5qWTFPU0F3TGpjNU9EWXlPU0F3TGpVeE16STJPQ0F3TGpjNU5qRXlPU0F3TGpVeE1EYzJOME13TGpjNU16WXlPQ0F3TGpVd09ESTJOeUF3TGpjNU1ESXpOeUF3TGpVd05qZzJNaUF3TGpjNE5qY3dNU0F3TGpVd05qZzJNa2d3TGpjd05qY3dNVll3TGpVek16VXlPVWd3TGpjM016TTJPRll3TGpVME5qZzJNa2d3TGpjd05qY3dNVll3TGpVM016VXlPVWd3TGpneU5qY3dNVU13TGpnek1ESXpOeUF3TGpVM016VXlPU0F3TGpnek16WXlPQ0F3TGpVM01qRXlOQ0F3TGpnek5qRXlPU0F3TGpVMk9UWXlNME13TGpnek9EWXlPU0F3TGpVMk56RXlNeUF3TGpnME1EQXpOQ0F3TGpVMk16Y3pNaUF3TGpnME1EQXpOQ0F3TGpVMk1ERTVOVll3TGpNeU9ERTVOVU13TGpnME1EQXpOQ0F3TGpNeU5EWTFPU0F3TGpnek9EWXlPU0F3TGpNeU1USTJPQ0F3TGpnek5qRXlPU0F3TGpNeE9EYzJOME13TGpnek16WXlPQ0F3TGpNeE5qSTJOeUF3TGpnek1ESXpOeUF3TGpNeE5EZzJNaUF3TGpneU5qY3dNU0F3TGpNeE5EZzJNa013TGpneE9UUTVOQ0F3TGpNeE5EQXlJREF1T0RFeU9EUTRJREF1TXpFd05UWWdNQzQ0TURnd01qUWdNQzR6TURVeE5FTXdMamd3TXpJd01TQXdMakk1T1RjeUlEQXVPREF3TlRNMklEQXVNamt5TnpFNElEQXVPREF3TlRNMklEQXVNamcxTkRZeVF6QXVPREF3TlRNMklEQXVNamM0TWpBMklEQXVPREF6TWpBeElEQXVNamN4TWpBMElEQXVPREE0TURJMElEQXVNalkxTnpnMFF6QXVPREV5T0RRNElEQXVNall3TXpZMElEQXVPREU1TkRrMElEQXVNalUyT1RBMElEQXVPREkyTnpBeElEQXVNalUyTURZeVZqQXVNalUyTURZeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0OGNHRjBhQ0JrUFNKTk1DNDBPVE16TmpjZ01DNHpNek0wTVRoV01DNHlOalkzTlRGRE1DNDBPVE16TmpjZ01DNHlOak15TVRVZ01DNDBPVEU1TmpNZ01DNHlOVGs0TWpRZ01DNDBPRGswTmpJZ01DNHlOVGN6TWpORE1DNDBPRFk1TmpJZ01DNHlOVFE0TWpNZ01DNDBPRE0xTnlBd0xqSTFNelF4T0NBd0xqUTRNREF6TkNBd0xqSTFNelF4T0Vnd0xqTTROamN3TVVNd0xqTTRNekUyTkNBd0xqSTFNelF4T0NBd0xqTTNPVGMzTXlBd0xqSTFORGd5TXlBd0xqTTNOekkzTXlBd0xqSTFOek15TTBNd0xqTTNORGMzTWlBd0xqSTFPVGd5TkNBd0xqTTNNek0yTnlBd0xqSTJNekl4TlNBd0xqTTNNek0yTnlBd0xqSTJOamMxTVZZd0xqTTBOamMxTVVnd0xqUXdNREF6TkZZd0xqSTRNREE0TlVnd0xqUTJOamN3TVZZd0xqTXpNelF4T0Vnd0xqUTVNek0yTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrUEhCaGRHZ2daRDBpVFRBdU5qSTJOams1SURBdU16UTJOelV4VmpBdU1qWTJOelV4UXpBdU5qSTJOams1SURBdU1qWXpNakUxSURBdU5qSTFNamswSURBdU1qVTVPREkwSURBdU5qSXlOemt6SURBdU1qVTNNekl6UXpBdU5qSXdNamt6SURBdU1qVTBPREl6SURBdU5qRTJPVEF5SURBdU1qVXpOREU0SURBdU5qRXpNelkxSURBdU1qVXpOREU0U0RBdU5USXdNRE15UXpBdU5URTJORGsySURBdU1qVXpOREU0SURBdU5URXpNVEEwSURBdU1qVTBPREl6SURBdU5URXdOakEwSURBdU1qVTNNekl6UXpBdU5UQTRNVEF6SURBdU1qVTVPREkwSURBdU5UQTJOams1SURBdU1qWXpNakUxSURBdU5UQTJOams1SURBdU1qWTJOelV4VmpBdU16TXpOREU0U0RBdU5UTXpNelkxVmpBdU1qZ3dNRGcxU0RBdU5qQXdNRE15VmpBdU16UTJOelV4U0RBdU5qSTJOams1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejQ4Y0dGMGFDQmtQU0pOTUM0M01EWTJPVGNnTUM0ME5UTTBNVGhXTUM0ME9EQXdPRFZJTUM0M05EWTJPVGRETUM0M05UQXlNek1nTUM0ME9EQXdPRFVnTUM0M05UTTJNalFnTUM0ME56ZzJPQ0F3TGpjMU5qRXlOU0F3TGpRM05qRTNPVU13TGpjMU9EWXlOU0F3TGpRM016WTNPU0F3TGpjMk1EQXpJREF1TkRjd01qZzRJREF1TnpZd01ETWdNQzQwTmpZM05URldNQzR5TmpZM05URkRNQzQzTmpBd015QXdMakkyTXpJeE5TQXdMamMxT0RZeU5TQXdMakkxT1RneU5DQXdMamMxTmpFeU5TQXdMakkxTnpNeU0wTXdMamMxTXpZeU5DQXdMakkxTkRneU15QXdMamMxTURJek15QXdMakkxTXpReE9DQXdMamMwTmpZNU55QXdMakkxTXpReE9FZ3dMalkxTXpNMk0wTXdMalkwT1RneU55QXdMakkxTXpReE9DQXdMalkwTmpRek5pQXdMakkxTkRneU15QXdMalkwTXprek5TQXdMakkxTnpNeU0wTXdMalkwTVRRek5TQXdMakkxT1RneU5DQXdMalkwTURBeklEQXVNall6TWpFMUlEQXVOalF3TURNZ01DNHlOalkzTlRGV01DNHpOakF3T0RWSU1DNDJOalkyT1RkV01DNHlPREF3T0RWSU1DNDNNek16TmpOV01DNDBOVE0wTVRoSU1DNDNNRFkyT1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGp4d1lYUm9JR1E5SWswd0xqSTJOamN3TXlBd0xqSTRNREE0TlVnd0xqTXpNek0yT1ZZd0xqTTJNREE0TlVnd0xqTTJNREF6TmxZd0xqSTJOamMxTVVNd0xqTTJNREF6TmlBd0xqSTJNekl4TlNBd0xqTTFPRFl6TVNBd0xqSTFPVGd5TkNBd0xqTTFOakV6TVNBd0xqSTFOek15TTBNd0xqTTFNell6SURBdU1qVTBPREl6SURBdU16VXdNak01SURBdU1qVXpOREU0SURBdU16UTJOekF6SURBdU1qVXpOREU0U0RBdU1qVXpNelk1UXpBdU1qUTVPRE16SURBdU1qVXpOREU0SURBdU1qUTJORFF5SURBdU1qVTBPREl6SURBdU1qUXpPVFF4SURBdU1qVTNNekl6UXpBdU1qUXhORFF4SURBdU1qVTVPREkwSURBdU1qUXdNRE0ySURBdU1qWXpNakUxSURBdU1qUXdNRE0ySURBdU1qWTJOelV4VmpBdU5EWTJOelV4UXpBdU1qUXdNRE0ySURBdU5EY3dNamc0SURBdU1qUXhORFF4SURBdU5EY3pOamM1SURBdU1qUXpPVFF4SURBdU5EYzJNVGM1UXpBdU1qUTJORFF5SURBdU5EYzROamdnTUM0eU5EazRNek1nTUM0ME9EQXdPRFVnTUM0eU5UTXpOamtnTUM0ME9EQXdPRFZJTUM0eU9UTXpOamxXTUM0ME5UTTBNVGhJTUM0eU5qWTNNRE5XTUM0eU9EQXdPRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQand2Wno0OEwyYytQR1JsWm5NK1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5WHpJek5qUmZNak14TkRJaUlIZ3hQU0l0TUM0eU1EY3hOamtpSUhreFBTSXhMakl3TnpJaUlIZ3lQU0l4TGpJd056RWlJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajQ4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqTWtVeU4wRkVJaTgrUEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5USTNSa1pHSWk4K1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0OFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6SXpOalJmTWpNeE5ESWlQanh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI1NSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWY3MjRmNjU3LTdiNTUtNGE5NC1iMjM1LTI5NWE3OGQwNGIzYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1FTEFTVElDQUNIRS1GT1ItUkVESVM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjQ5IiB5PSIyOS41IiB3aWR0aD0iMjI1IiBoZWlnaHQ9IjQxMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNTciIHZhbHVlPSJBV1MgRWxhc3RpQ2FjaGUiIHN0eWxlPSJpci5yZWY9NGVkMTlhYmYtZDVjYy00YzJmLTlhNTUtYjc5ZGM2YmEyMWUzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVsYXN0aWNhY2hlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURBeU1UTWdNQzR6TlRrNU9EVkRNQzQwTVRBM05EWWdNQzR6TlRrNU9EVWdNQzR6TVRrNU5EWWdNQzR6T0RNek1Ua2dNQzR6TVRrNU5EWWdNQzQwTWpjNU9EVldNQzQzTXpFNU9EVkRNQzR6TVRrNU5EWWdNQzQzTnpZMk5USWdNQzQwTVRBek5EWWdNQzQzT1RrNU9EVWdNQzQwT1RrNE1UTWdNQzQzT1RrNU9EVkRNQzQxT0RreU9DQXdMamM1T1RrNE5TQXdMalkzT1RrME5pQXdMamMzTmpZMU1pQXdMalkzT1RrME5pQXdMamN6TVRrNE5WWXdMalF5TnprNE5VTXdMalkzT1RrME5pQXdMak00TXpNeE9TQXdMalU0T1RReE15QXdMak0xT1RrNE5TQXdMalV3TURJeE15QXdMak0xT1RrNE5WcE5NQzQxTURBeU1UTWdNQzQzTnpNek1UbERNQzQwTURFd01UTWdNQzQzTnpNek1Ua2dNQzR6TkRZMk1UTWdNQzQzTkRZMk5USWdNQzR6TkRZMk1UTWdNQzQzTXpFNU9EVldNQzQyTmpjNE5USkRNQzR6TnprNU5EWWdNQzQyT0RneE1Ua2dNQzQwTXprNU5EWWdNQzQyT1RnMk5USWdNQzQwT1RrNE1UTWdNQzQyT1RnMk5USkRNQzQxTlRrMk9DQXdMalk1T0RZMU1pQXdMall4T1RneE15QXdMalk0T0RFeE9TQXdMalkxTWpnNElEQXVOalkzT1RnMVZqQXVOek14T1RnMVF6QXVOalV6TWpnZ01DNDNORFkyTlRJZ01DNDFPVGt4TkRZZ01DNDNOek16TVRrZ01DNDFNREF5TVRNZ01DNDNOek16TVRsYVRUQXVOVEF3TWpFeklEQXVOamN4T1RnMVF6QXVOREF4TURFeklEQXVOamN4T1RnMUlEQXVNelEzTURFeklEQXVOalExTXpFNUlEQXVNelEzTURFeklEQXVOak13TmpVeVZqQXVOVFkyTmpVeVF6QXVNemd3TXpRMklEQXVOVGcyTnpnMUlEQXVORFF3TXpRMklEQXVOVGszTXpFNUlEQXVOVEF3TWpFeklEQXVOVGszTXpFNVF6QXVOVFl3TURnZ01DNDFPVGN6TVRrZ01DNDJNakF5TVRNZ01DNDFPRFkzT0RVZ01DNDJOVE15T0NBd0xqVTJOalkxTWxZd0xqWXpNRFkxTWtNd0xqWTFNekk0SURBdU5qUTBOalV5SURBdU5UazVNVFEySURBdU5qY3hPVGcxSURBdU5UQXdNakV6SURBdU5qY3hPVGcxV2swd0xqVXdNREl4TXlBd0xqVTNNRFkxTWtNd0xqUXdNVEF4TXlBd0xqVTNNRFkxTWlBd0xqTTBOekF4TXlBd0xqVTBNems0TlNBd0xqTTBOekF4TXlBd0xqVXlPVE14T1ZZd0xqUTJOVEU0TlVNd0xqTTRNRE0wTmlBd0xqUTROVFExTWlBd0xqUTBNRE0wTmlBd0xqUTVOVGs0TlNBd0xqVXdNREl4TXlBd0xqUTVOVGs0TlVNd0xqVTJNREE0SURBdU5EazFPVGcxSURBdU5qSXdNakV6SURBdU5EZzFORFV5SURBdU5qVXpNamdnTUM0ME5qVXhPRFZXTUM0MU1qa3pNVGxETUM0Mk5UTXlPQ0F3TGpVME16TXhPU0F3TGpVNU9URTBOaUF3TGpVM01EWTFNaUF3TGpVd01ESXhNeUF3TGpVM01EWTFNbHBOTUM0MU1EQXlNVE1nTUM0ME5qa3pNVGxETUM0ME1ERXdNVE1nTUM0ME5qa3pNVGtnTUM0ek5EWTJNVE1nTUM0ME5ERTVPRFVnTUM0ek5EWTJNVE1nTUM0ME1qYzVPRFZETUM0ek5EWTJNVE1nTUM0ME1UTTVPRFVnTUM0ek9UazVORFlnTUM0ek9EWTJOVElnTUM0ME9UazRNVE1nTUM0ek9EWTJOVEpETUM0MU9UazJPQ0F3TGpNNE5qWTFNaUF3TGpZMU16STRJREF1TkRFek9UZzFJREF1TmpVek1qZ2dNQzQwTWpjNU9EVkRNQzQyTlRNeU9DQXdMalEwTVRrNE5TQXdMalU1T1RFME5pQXdMalEyT1RNeE9TQXdMalV3TURJeE15QXdMalEyT1RNeE9WWXdMalEyT1RNeE9Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qWTNNREVnTUM0eU5UVTRNVGhETUM0NE16QXlNemNnTUM0eU5UVTRNVGdnTUM0NE16TTJNamdnTUM0eU5UUTBNVE1nTUM0NE16WXhNamtnTUM0eU5URTVNVE5ETUM0NE16ZzJNamtnTUM0eU5EazBNVElnTUM0NE5EQXdNelFnTUM0eU5EWXdNakVnTUM0NE5EQXdNelFnTUM0eU5ESTBPRFZXTUM0eU1UTXlPRFZETUM0NE5EQXdNelFnTUM0eU1EazNORGdnTUM0NE16ZzJNamtnTUM0eU1EWXpOVGNnTUM0NE16WXhNamtnTUM0eU1ETTROVFpETUM0NE16TTJNamdnTUM0eU1ERXpOVFlnTUM0NE16QXlNemNnTUM0eE9UazVOVEVnTUM0NE1qWTNNREVnTUM0eE9UazVOVEZJTUM0eE56TXpOamhETUM0eE5qazRNekVnTUM0eE9UazVOVEVnTUM0eE5qWTBOQ0F3TGpJd01UTTFOaUF3TGpFMk16a3pPU0F3TGpJd016ZzFOa013TGpFMk1UUXpPU0F3TGpJd05qTTFOeUF3TGpFMk1EQXpOQ0F3TGpJd09UYzBPQ0F3TGpFMk1EQXpOQ0F3TGpJeE16STROVll3TGpJME1qTTFNVU13TGpFMk1EQXpOQ0F3TGpJME5UZzROeUF3TGpFMk1UUXpPU0F3TGpJME9USTNPU0F3TGpFMk16a3pPU0F3TGpJMU1UYzNPVU13TGpFMk5qUTBJREF1TWpVME1qZ2dNQzR4TmprNE16RWdNQzR5TlRVMk9EUWdNQzR4TnpNek5qZ2dNQzR5TlRVMk9EUkRNQzR4T0RBMk9Ua2dNQzR5TlRZek9ETWdNQzR4T0RjMU1EY2dNQzR5TlRrM09Ea2dNQzR4T1RJME5qRWdNQzR5TmpVeU16aERNQzR4T1RjME1UWWdNQzR5TnpBMk9EY2dNQzR5TURBeE5qRWdNQzR5TnpjM09EY2dNQzR5TURBeE5qRWdNQzR5T0RVeE5URkRNQzR5TURBeE5qRWdNQzR5T1RJMU1UWWdNQzR4T1RjME1UWWdNQzR5T1RrMk1UWWdNQzR4T1RJME5qRWdNQzR6TURVd05qVkRNQzR4T0RjMU1EY2dNQzR6TVRBMU1UTWdNQzR4T0RBMk9Ua2dNQzR6TVRNNU1pQXdMakUzTXpNMk9DQXdMak14TkRZeE9FTXdMakUyT1Rnek1TQXdMak14TkRZeE9DQXdMakUyTmpRMElEQXVNekUyTURJeklEQXVNVFl6T1RNNUlEQXVNekU0TlRJelF6QXVNVFl4TkRNNUlEQXVNekl4TURJMElEQXVNVFl3TURNMElEQXVNekkwTkRFMUlEQXVNVFl3TURNMElEQXVNekkzT1RVeFZqQXVOVFU1T1RVeFF6QXVNVFl3TURNMElEQXVOVFl6TkRnM0lEQXVNVFl4TkRNNUlEQXVOVFkyT0RjNUlEQXVNVFl6T1RNNUlEQXVOVFk1TXpjNVF6QXVNVFkyTkRRZ01DNDFOekU0T0NBd0xqRTJPVGd6TVNBd0xqVTNNekk0TkNBd0xqRTNNek0yT0NBd0xqVTNNekk0TkVnd0xqSTVNek0yT0ZZd0xqVTBOall4T0Vnd0xqSTBNREF6TkZZd0xqVXpNekk0TkVnd0xqSTVNek0yT0ZZd0xqVXdOall4T0Vnd0xqSXlOamN3TVVNd0xqSXlNekUyTlNBd0xqVXdOall4T0NBd0xqSXhPVGMzTXlBd0xqVXdPREF5TXlBd0xqSXhOekkzTXlBd0xqVXhNRFV5TTBNd0xqSXhORGMzTWlBd0xqVXhNekF5TXlBd0xqSXhNek0yT0NBd0xqVXhOalF4TlNBd0xqSXhNek0yT0NBd0xqVXhPVGsxTVZZd0xqVTBOall4T0Vnd0xqRTROamN3TVZZd0xqTXpPVFUxTVVNd0xqRTVPRE0wTmlBd0xqTXpOakF3TXlBd0xqSXdPRFUwTWlBd0xqTXlPRGd3TnlBd0xqSXhOVGM0T0NBd0xqTXhPVEF5TlVNd0xqSXlNekF6TXlBd0xqTXdPVEkwTWlBd0xqSXlOamswTkNBd0xqSTVOek01TVNBd0xqSXlOamswTkNBd0xqSTROVEl4T0VNd0xqSXlOamswTkNBd0xqSTNNekEwTlNBd0xqSXlNekF6TXlBd0xqSTJNVEU1TXlBd0xqSXhOVGM0T0NBd0xqSTFNVFF4TVVNd0xqSXdPRFUwTWlBd0xqSTBNVFl5T1NBd0xqRTVPRE0wTmlBd0xqSXpORFF6TXlBd0xqRTROamN3TVNBd0xqSXpNRGc0TkZZd0xqSXlOall4T0Vnd0xqZ3hNek0yT0ZZd0xqSXpNVEF4T0VNd0xqZ3dNVGc1TXlBd0xqSXpORGN3TnlBd0xqYzVNVGc0TmlBd0xqSTBNVGswTXlBd0xqYzRORGM0TnlBd0xqSTFNVFk0TTBNd0xqYzNOelk0T0NBd0xqSTJNVFF5TXlBd0xqYzNNemcyTXlBd0xqSTNNekUyTlNBd0xqYzNNemcyTXlBd0xqSTROVEl4T0VNd0xqYzNNemcyTXlBd0xqSTVOekkzTVNBd0xqYzNOelk0T0NBd0xqTXdPVEF4TWlBd0xqYzRORGM0TnlBd0xqTXhPRGMxTWtNd0xqYzVNVGc0TmlBd0xqTXlPRFE1TWlBd0xqZ3dNVGc1TXlBd0xqTXpOVGN5T0NBd0xqZ3hNek0yT0NBd0xqTXpPVFF4T0ZZd0xqVTBOall4T0Vnd0xqZ3dNREF6TkZZd0xqVXhPVGsxTVVNd0xqZ3dNREF6TkNBd0xqVXhOalF4TlNBd0xqYzVPRFl5T1NBd0xqVXhNekF5TXlBd0xqYzVOakV5T1NBd0xqVXhNRFV5TTBNd0xqYzVNell5T0NBd0xqVXdPREF5TXlBd0xqYzVNREl6TnlBd0xqVXdOall4T0NBd0xqYzROamN3TVNBd0xqVXdOall4T0Vnd0xqY3dOamN3TVZZd0xqVXpNekk0TkVnd0xqYzNNek0yT0ZZd0xqVTBOall4T0Vnd0xqY3dOamN3TVZZd0xqVTNNekk0TkVnd0xqZ3lOamN3TVVNd0xqZ3pNREl6TnlBd0xqVTNNekk0TkNBd0xqZ3pNell5T0NBd0xqVTNNVGc0SURBdU9ETTJNVEk1SURBdU5UWTVNemM1UXpBdU9ETTROakk1SURBdU5UWTJPRGM1SURBdU9EUXdNRE0wSURBdU5UWXpORGczSURBdU9EUXdNRE0wSURBdU5UVTVPVFV4VmpBdU16STNPVFV4UXpBdU9EUXdNRE0wSURBdU16STBOREUxSURBdU9ETTROakk1SURBdU16SXhNREkwSURBdU9ETTJNVEk1SURBdU16RTROVEl6UXpBdU9ETXpOakk0SURBdU16RTJNREl6SURBdU9ETXdNak0zSURBdU16RTBOakU0SURBdU9ESTJOekF4SURBdU16RTBOakU0UXpBdU9ERTVORGswSURBdU16RXpOemMySURBdU9ERXlPRFE0SURBdU16RXdNekUySURBdU9EQTRNREkwSURBdU16QTBPRGsyUXpBdU9EQXpNakF4SURBdU1qazVORGMySURBdU9EQXdOVE0ySURBdU1qa3lORGN6SURBdU9EQXdOVE0ySURBdU1qZzFNakU0UXpBdU9EQXdOVE0ySURBdU1qYzNPVFl5SURBdU9EQXpNakF4SURBdU1qY3dPVFU1SURBdU9EQTRNREkwSURBdU1qWTFOVE01UXpBdU9ERXlPRFE0SURBdU1qWXdNVEU1SURBdU9ERTVORGswSURBdU1qVTJOallnTUM0NE1qWTNNREVnTUM0eU5UVTRNVGhXTUM0eU5UVTRNVGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGt6TWpreElEQXVNek16TWprMlZqQXVNalkyTmpJNVF6QXVORGt6TWpreElEQXVNall6TURreklEQXVORGt4T0RnMklEQXVNalU1TnpBeUlEQXVORGc1TXpnMklEQXVNalUzTWpBeFF6QXVORGcyT0RnMUlEQXVNalUwTnpBeElEQXVORGd6TkRrMElEQXVNalV6TWprMklEQXVORGM1T1RVNElEQXVNalV6TWprMlNEQXVNemcyTmpJMFF6QXVNemd6TURnNElEQXVNalV6TWprMklEQXVNemM1TmprM0lEQXVNalUwTnpBeElEQXVNemMzTVRrMklEQXVNalUzTWpBeFF6QXVNemMwTmprMklEQXVNalU1TnpBeUlEQXVNemN6TWpreElEQXVNall6TURreklEQXVNemN6TWpreElEQXVNalkyTmpJNVZqQXVNelEyTmpJNVNEQXVNems1T1RVNFZqQXVNamM1T1RZelNEQXVORFkyTmpJMFZqQXVNek16TWprMlNEQXVORGt6TWpreFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZeU5qY3hOQ0F3TGpNME5qWXlPVll3TGpJMk5qWXlPVU13TGpZeU5qY3hOQ0F3TGpJMk16QTVNeUF3TGpZeU5UTXdPU0F3TGpJMU9UY3dNaUF3TGpZeU1qZ3dPU0F3TGpJMU56SXdNVU13TGpZeU1ETXdPQ0F3TGpJMU5EY3dNU0F3TGpZeE5qa3hOeUF3TGpJMU16STVOaUF3TGpZeE16TTRNU0F3TGpJMU16STVOa2d3TGpVeU1EQTBOME13TGpVeE5qVXhNU0F3TGpJMU16STVOaUF3TGpVeE16RXlJREF1TWpVME56QXhJREF1TlRFd05qRTVJREF1TWpVM01qQXhRekF1TlRBNE1URTVJREF1TWpVNU56QXlJREF1TlRBMk56RTBJREF1TWpZek1Ea3pJREF1TlRBMk56RTBJREF1TWpZMk5qSTVWakF1TXpNek1qazJTREF1TlRNek16Z3hWakF1TWpjNU9UWXpTREF1TmpBd01EUTNWakF1TXpRMk5qSTVTREF1TmpJMk56RTBXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3dOalk0TVNBd0xqUTFNekk1TmxZd0xqUTNPVGsyTTBnd0xqYzBOalk0TVVNd0xqYzFNREl4T0NBd0xqUTNPVGsyTXlBd0xqYzFNell3T1NBd0xqUTNPRFUxT0NBd0xqYzFOakV3T1NBd0xqUTNOakExTjBNd0xqYzFPRFl4SURBdU5EY3pOVFUzSURBdU56WXdNREUxSURBdU5EY3dNVFkxSURBdU56WXdNREUxSURBdU5EWTJOakk1VmpBdU1qWTJOakk1UXpBdU56WXdNREUxSURBdU1qWXpNRGt6SURBdU56VTROakVnTUM0eU5UazNNRElnTUM0M05UWXhNRGtnTUM0eU5UY3lNREZETUM0M05UTTJNRGtnTUM0eU5UUTNNREVnTUM0M05UQXlNVGdnTUM0eU5UTXlPVFlnTUM0M05EWTJPREVnTUM0eU5UTXlPVFpJTUM0Mk5UTXpORGhETUM0Mk5EazRNVElnTUM0eU5UTXlPVFlnTUM0Mk5EWTBNaUF3TGpJMU5EY3dNU0F3TGpZME16a3lJREF1TWpVM01qQXhRekF1TmpReE5ERTVJREF1TWpVNU56QXlJREF1TmpRd01ERTFJREF1TWpZek1Ea3pJREF1TmpRd01ERTFJREF1TWpZMk5qSTVWakF1TXpVNU9UWXpTREF1TmpZMk5qZ3hWakF1TWpjNU9UWXpTREF1TnpNek16UTRWakF1TkRVek1qazJTREF1TnpBMk5qZ3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqSTJOalkxTnlBd0xqSTNPVGsyTTBnd0xqTXpNek15TkZZd0xqTTFPVGsyTTBnd0xqTTFPVGs1VmpBdU1qWTJOakk1UXpBdU16VTVPVGtnTUM0eU5qTXdPVE1nTUM0ek5UZzFPRFlnTUM0eU5UazNNRElnTUM0ek5UWXdPRFVnTUM0eU5UY3lNREZETUM0ek5UTTFPRFVnTUM0eU5UUTNNREVnTUM0ek5UQXhPVE1nTUM0eU5UTXlPVFlnTUM0ek5EWTJOVGNnTUM0eU5UTXlPVFpJTUM0eU5UTXpNalJETUM0eU5EazNPRGNnTUM0eU5UTXlPVFlnTUM0eU5EWXpPVFlnTUM0eU5UUTNNREVnTUM0eU5ETTRPVFVnTUM0eU5UY3lNREZETUM0eU5ERXpPVFVnTUM0eU5UazNNRElnTUM0eU16azVPU0F3TGpJMk16QTVNeUF3TGpJek9UazVJREF1TWpZMk5qSTVWakF1TkRZMk5qSTVRekF1TWpNNU9Ua2dNQzQwTnpBeE5qVWdNQzR5TkRFek9UVWdNQzQwTnpNMU5UY2dNQzR5TkRNNE9UVWdNQzQwTnpZd05UZERNQzR5TkRZek9UWWdNQzQwTnpnMU5UZ2dNQzR5TkRrM09EY2dNQzQwTnprNU5qTWdNQzR5TlRNek1qUWdNQzQwTnprNU5qTklNQzR5T1RNek1qUldNQzQwTlRNeU9UWklNQzR5TmpZMk5UZFdNQzR5TnprNU5qTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeUlpQjVNVDBpTVM0eU1EY3lJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpKRk1qZEJSQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTlRJM1JrWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNTUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjcuNSIgeT0iMjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjU2IiB2YWx1ZT0iQVdTIEVsYXN0aUNhY2hlIiBzdHlsZT0iaXIucmVmPWU5NWUyYjg3LTc4ZGQtNDY5MS1hYmJlLTczMDVjNTJiZTc4MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbGFzdGljYWNoZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1EQXlNVE1nTUM0ek5UazVPRFZETUM0ME1UQTNORFlnTUM0ek5UazVPRFVnTUM0ek1UazVORFlnTUM0ek9ETXpNVGtnTUM0ek1UazVORFlnTUM0ME1qYzVPRFZXTUM0M016RTVPRFZETUM0ek1UazVORFlnTUM0M056WTJOVElnTUM0ME1UQXpORFlnTUM0M09UazVPRFVnTUM0ME9UazRNVE1nTUM0M09UazVPRFZETUM0MU9Ea3lPQ0F3TGpjNU9UazROU0F3TGpZM09UazBOaUF3TGpjM05qWTFNaUF3TGpZM09UazBOaUF3TGpjek1UazROVll3TGpReU56azROVU13TGpZM09UazBOaUF3TGpNNE16TXhPU0F3TGpVNE9UUXhNeUF3TGpNMU9UazROU0F3TGpVd01ESXhNeUF3TGpNMU9UazROVnBOTUM0MU1EQXlNVE1nTUM0M056TXpNVGxETUM0ME1ERXdNVE1nTUM0M056TXpNVGtnTUM0ek5EWTJNVE1nTUM0M05EWTJOVElnTUM0ek5EWTJNVE1nTUM0M016RTVPRFZXTUM0Mk5qYzROVEpETUM0ek56azVORFlnTUM0Mk9EZ3hNVGtnTUM0ME16azVORFlnTUM0Mk9UZzJOVElnTUM0ME9UazRNVE1nTUM0Mk9UZzJOVEpETUM0MU5UazJPQ0F3TGpZNU9EWTFNaUF3TGpZeE9UZ3hNeUF3TGpZNE9ERXhPU0F3TGpZMU1qZzRJREF1TmpZM09UZzFWakF1TnpNeE9UZzFRekF1TmpVek1qZ2dNQzQzTkRZMk5USWdNQzQxT1RreE5EWWdNQzQzTnpNek1Ua2dNQzQxTURBeU1UTWdNQzQzTnpNek1UbGFUVEF1TlRBd01qRXpJREF1TmpjeE9UZzFRekF1TkRBeE1ERXpJREF1TmpjeE9UZzFJREF1TXpRM01ERXpJREF1TmpRMU16RTVJREF1TXpRM01ERXpJREF1TmpNd05qVXlWakF1TlRZMk5qVXlRekF1TXpnd016UTJJREF1TlRnMk56ZzFJREF1TkRRd016UTJJREF1TlRrM016RTVJREF1TlRBd01qRXpJREF1TlRrM016RTVRekF1TlRZd01EZ2dNQzQxT1Rjek1Ua2dNQzQyTWpBeU1UTWdNQzQxT0RZM09EVWdNQzQyTlRNeU9DQXdMalUyTmpZMU1sWXdMall6TURZMU1rTXdMalkxTXpJNElEQXVOalEwTmpVeUlEQXVOVGs1TVRRMklEQXVOamN4T1RnMUlEQXVOVEF3TWpFeklEQXVOamN4T1RnMVdrMHdMalV3TURJeE15QXdMalUzTURZMU1rTXdMalF3TVRBeE15QXdMalUzTURZMU1pQXdMak0wTnpBeE15QXdMalUwTXprNE5TQXdMak0wTnpBeE15QXdMalV5T1RNeE9WWXdMalEyTlRFNE5VTXdMak00TURNME5pQXdMalE0TlRRMU1pQXdMalEwTURNME5pQXdMalE1TlRrNE5TQXdMalV3TURJeE15QXdMalE1TlRrNE5VTXdMalUyTURBNElEQXVORGsxT1RnMUlEQXVOakl3TWpFeklEQXVORGcxTkRVeUlEQXVOalV6TWpnZ01DNDBOalV4T0RWV01DNDFNamt6TVRsRE1DNDJOVE15T0NBd0xqVTBNek14T1NBd0xqVTVPVEUwTmlBd0xqVTNNRFkxTWlBd0xqVXdNREl4TXlBd0xqVTNNRFkxTWxwTk1DNDFNREF5TVRNZ01DNDBOamt6TVRsRE1DNDBNREV3TVRNZ01DNDBOamt6TVRrZ01DNHpORFkyTVRNZ01DNDBOREU1T0RVZ01DNHpORFkyTVRNZ01DNDBNamM1T0RWRE1DNHpORFkyTVRNZ01DNDBNVE01T0RVZ01DNHpPVGs1TkRZZ01DNHpPRFkyTlRJZ01DNDBPVGs0TVRNZ01DNHpPRFkyTlRKRE1DNDFPVGsyT0NBd0xqTTROalkxTWlBd0xqWTFNekk0SURBdU5ERXpPVGcxSURBdU5qVXpNamdnTUM0ME1qYzVPRFZETUM0Mk5UTXlPQ0F3TGpRME1UazROU0F3TGpVNU9URTBOaUF3TGpRMk9UTXhPU0F3TGpVd01ESXhNeUF3TGpRMk9UTXhPVll3TGpRMk9UTXhPVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNalkzTURFZ01DNHlOVFU0TVRoRE1DNDRNekF5TXpjZ01DNHlOVFU0TVRnZ01DNDRNek0yTWpnZ01DNHlOVFEwTVRNZ01DNDRNell4TWprZ01DNHlOVEU1TVRORE1DNDRNemcyTWprZ01DNHlORGswTVRJZ01DNDROREF3TXpRZ01DNHlORFl3TWpFZ01DNDROREF3TXpRZ01DNHlOREkwT0RWV01DNHlNVE15T0RWRE1DNDROREF3TXpRZ01DNHlNRGszTkRnZ01DNDRNemcyTWprZ01DNHlNRFl6TlRjZ01DNDRNell4TWprZ01DNHlNRE00TlRaRE1DNDRNek0yTWpnZ01DNHlNREV6TlRZZ01DNDRNekF5TXpjZ01DNHhPVGs1TlRFZ01DNDRNalkzTURFZ01DNHhPVGs1TlRGSU1DNHhOek16TmpoRE1DNHhOams0TXpFZ01DNHhPVGs1TlRFZ01DNHhOalkwTkNBd0xqSXdNVE0xTmlBd0xqRTJNemt6T1NBd0xqSXdNemcxTmtNd0xqRTJNVFF6T1NBd0xqSXdOak0xTnlBd0xqRTJNREF6TkNBd0xqSXdPVGMwT0NBd0xqRTJNREF6TkNBd0xqSXhNekk0TlZZd0xqSTBNak0xTVVNd0xqRTJNREF6TkNBd0xqSTBOVGc0TnlBd0xqRTJNVFF6T1NBd0xqSTBPVEkzT1NBd0xqRTJNemt6T1NBd0xqSTFNVGMzT1VNd0xqRTJOalEwSURBdU1qVTBNamdnTUM0eE5qazRNekVnTUM0eU5UVTJPRFFnTUM0eE56TXpOamdnTUM0eU5UVTJPRFJETUM0eE9EQTJPVGtnTUM0eU5UWXpPRE1nTUM0eE9EYzFNRGNnTUM0eU5UazNPRGtnTUM0eE9USTBOakVnTUM0eU5qVXlNemhETUM0eE9UYzBNVFlnTUM0eU56QTJPRGNnTUM0eU1EQXhOakVnTUM0eU56YzNPRGNnTUM0eU1EQXhOakVnTUM0eU9EVXhOVEZETUM0eU1EQXhOakVnTUM0eU9USTFNVFlnTUM0eE9UYzBNVFlnTUM0eU9UazJNVFlnTUM0eE9USTBOakVnTUM0ek1EVXdOalZETUM0eE9EYzFNRGNnTUM0ek1UQTFNVE1nTUM0eE9EQTJPVGtnTUM0ek1UTTVNaUF3TGpFM016TTJPQ0F3TGpNeE5EWXhPRU13TGpFMk9UZ3pNU0F3TGpNeE5EWXhPQ0F3TGpFMk5qUTBJREF1TXpFMk1ESXpJREF1TVRZek9UTTVJREF1TXpFNE5USXpRekF1TVRZeE5ETTVJREF1TXpJeE1ESTBJREF1TVRZd01ETTBJREF1TXpJME5ERTFJREF1TVRZd01ETTBJREF1TXpJM09UVXhWakF1TlRVNU9UVXhRekF1TVRZd01ETTBJREF1TlRZek5EZzNJREF1TVRZeE5ETTVJREF1TlRZMk9EYzVJREF1TVRZek9UTTVJREF1TlRZNU16YzVRekF1TVRZMk5EUWdNQzQxTnpFNE9DQXdMakUyT1Rnek1TQXdMalUzTXpJNE5DQXdMakUzTXpNMk9DQXdMalUzTXpJNE5FZ3dMakk1TXpNMk9GWXdMalUwTmpZeE9FZ3dMakkwTURBek5GWXdMalV6TXpJNE5FZ3dMakk1TXpNMk9GWXdMalV3TmpZeE9FZ3dMakl5Tmpjd01VTXdMakl5TXpFMk5TQXdMalV3TmpZeE9DQXdMakl4T1RjM015QXdMalV3T0RBeU15QXdMakl4TnpJM015QXdMalV4TURVeU0wTXdMakl4TkRjM01pQXdMalV4TXpBeU15QXdMakl4TXpNMk9DQXdMalV4TmpReE5TQXdMakl4TXpNMk9DQXdMalV4T1RrMU1WWXdMalUwTmpZeE9FZ3dMakU0Tmpjd01WWXdMak16T1RVMU1VTXdMakU1T0RNME5pQXdMak16TmpBd015QXdMakl3T0RVME1pQXdMak15T0Rnd055QXdMakl4TlRjNE9DQXdMak14T1RBeU5VTXdMakl5TXpBek15QXdMak13T1RJME1pQXdMakl5TmprME5DQXdMakk1TnpNNU1TQXdMakl5TmprME5DQXdMakk0TlRJeE9FTXdMakl5TmprME5DQXdMakkzTXpBME5TQXdMakl5TXpBek15QXdMakkyTVRFNU15QXdMakl4TlRjNE9DQXdMakkxTVRReE1VTXdMakl3T0RVME1pQXdMakkwTVRZeU9TQXdMakU1T0RNME5pQXdMakl6TkRRek15QXdMakU0Tmpjd01TQXdMakl6TURnNE5GWXdMakl5TmpZeE9FZ3dMamd4TXpNMk9GWXdMakl6TVRBeE9FTXdMamd3TVRnNU15QXdMakl6TkRjd055QXdMamM1TVRnNE5pQXdMakkwTVRrME15QXdMamM0TkRjNE55QXdMakkxTVRZNE0wTXdMamMzTnpZNE9DQXdMakkyTVRReU15QXdMamMzTXpnMk15QXdMakkzTXpFMk5TQXdMamMzTXpnMk15QXdMakk0TlRJeE9FTXdMamMzTXpnMk15QXdMakk1TnpJM01TQXdMamMzTnpZNE9DQXdMak13T1RBeE1pQXdMamM0TkRjNE55QXdMak14T0RjMU1rTXdMamM1TVRnNE5pQXdMak15T0RRNU1pQXdMamd3TVRnNU15QXdMak16TlRjeU9DQXdMamd4TXpNMk9DQXdMak16T1RReE9GWXdMalUwTmpZeE9FZ3dMamd3TURBek5GWXdMalV4T1RrMU1VTXdMamd3TURBek5DQXdMalV4TmpReE5TQXdMamM1T0RZeU9TQXdMalV4TXpBeU15QXdMamM1TmpFeU9TQXdMalV4TURVeU0wTXdMamM1TXpZeU9DQXdMalV3T0RBeU15QXdMamM1TURJek55QXdMalV3TmpZeE9DQXdMamM0Tmpjd01TQXdMalV3TmpZeE9FZ3dMamN3Tmpjd01WWXdMalV6TXpJNE5FZ3dMamMzTXpNMk9GWXdMalUwTmpZeE9FZ3dMamN3Tmpjd01WWXdMalUzTXpJNE5FZ3dMamd5Tmpjd01VTXdMamd6TURJek55QXdMalUzTXpJNE5DQXdMamd6TXpZeU9DQXdMalUzTVRnNElEQXVPRE0yTVRJNUlEQXVOVFk1TXpjNVF6QXVPRE00TmpJNUlEQXVOVFkyT0RjNUlEQXVPRFF3TURNMElEQXVOVFl6TkRnM0lEQXVPRFF3TURNMElEQXVOVFU1T1RVeFZqQXVNekkzT1RVeFF6QXVPRFF3TURNMElEQXVNekkwTkRFMUlEQXVPRE00TmpJNUlEQXVNekl4TURJMElEQXVPRE0yTVRJNUlEQXVNekU0TlRJelF6QXVPRE16TmpJNElEQXVNekUyTURJeklEQXVPRE13TWpNM0lEQXVNekUwTmpFNElEQXVPREkyTnpBeElEQXVNekUwTmpFNFF6QXVPREU1TkRrMElEQXVNekV6TnpjMklEQXVPREV5T0RRNElEQXVNekV3TXpFMklEQXVPREE0TURJMElEQXVNekEwT0RrMlF6QXVPREF6TWpBeElEQXVNams1TkRjMklEQXVPREF3TlRNMklEQXVNamt5TkRjeklEQXVPREF3TlRNMklEQXVNamcxTWpFNFF6QXVPREF3TlRNMklEQXVNamMzT1RZeUlEQXVPREF6TWpBeElEQXVNamN3T1RVNUlEQXVPREE0TURJMElEQXVNalkxTlRNNVF6QXVPREV5T0RRNElEQXVNall3TVRFNUlEQXVPREU1TkRrMElEQXVNalUyTmpZZ01DNDRNalkzTURFZ01DNHlOVFU0TVRoV01DNHlOVFU0TVRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrek1qa3hJREF1TXpNek1qazJWakF1TWpZMk5qSTVRekF1TkRrek1qa3hJREF1TWpZek1Ea3pJREF1TkRreE9EZzJJREF1TWpVNU56QXlJREF1TkRnNU16ZzJJREF1TWpVM01qQXhRekF1TkRnMk9EZzFJREF1TWpVME56QXhJREF1TkRnek5EazBJREF1TWpVek1qazJJREF1TkRjNU9UVTRJREF1TWpVek1qazJTREF1TXpnMk5qSTBRekF1TXpnek1EZzRJREF1TWpVek1qazJJREF1TXpjNU5qazNJREF1TWpVME56QXhJREF1TXpjM01UazJJREF1TWpVM01qQXhRekF1TXpjME5qazJJREF1TWpVNU56QXlJREF1TXpjek1qa3hJREF1TWpZek1Ea3pJREF1TXpjek1qa3hJREF1TWpZMk5qSTVWakF1TXpRMk5qSTVTREF1TXprNU9UVTRWakF1TWpjNU9UWXpTREF1TkRZMk5qSTBWakF1TXpNek1qazJTREF1TkRrek1qa3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWXlOamN4TkNBd0xqTTBOall5T1ZZd0xqSTJOall5T1VNd0xqWXlOamN4TkNBd0xqSTJNekE1TXlBd0xqWXlOVE13T1NBd0xqSTFPVGN3TWlBd0xqWXlNamd3T1NBd0xqSTFOekl3TVVNd0xqWXlNRE13T0NBd0xqSTFORGN3TVNBd0xqWXhOamt4TnlBd0xqSTFNekk1TmlBd0xqWXhNek00TVNBd0xqSTFNekk1Tmtnd0xqVXlNREEwTjBNd0xqVXhOalV4TVNBd0xqSTFNekk1TmlBd0xqVXhNekV5SURBdU1qVTBOekF4SURBdU5URXdOakU1SURBdU1qVTNNakF4UXpBdU5UQTRNVEU1SURBdU1qVTVOekF5SURBdU5UQTJOekUwSURBdU1qWXpNRGt6SURBdU5UQTJOekUwSURBdU1qWTJOakk1VmpBdU16TXpNamsyU0RBdU5UTXpNemd4VmpBdU1qYzVPVFl6U0RBdU5qQXdNRFEzVmpBdU16UTJOakk1U0RBdU5qSTJOekUwV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamN3TmpZNE1TQXdMalExTXpJNU5sWXdMalEzT1RrMk0wZ3dMamMwTmpZNE1VTXdMamMxTURJeE9DQXdMalEzT1RrMk15QXdMamMxTXpZd09TQXdMalEzT0RVMU9DQXdMamMxTmpFd09TQXdMalEzTmpBMU4wTXdMamMxT0RZeElEQXVORGN6TlRVM0lEQXVOell3TURFMUlEQXVORGN3TVRZMUlEQXVOell3TURFMUlEQXVORFkyTmpJNVZqQXVNalkyTmpJNVF6QXVOell3TURFMUlEQXVNall6TURreklEQXVOelU0TmpFZ01DNHlOVGszTURJZ01DNDNOVFl4TURrZ01DNHlOVGN5TURGRE1DNDNOVE0yTURrZ01DNHlOVFEzTURFZ01DNDNOVEF5TVRnZ01DNHlOVE15T1RZZ01DNDNORFkyT0RFZ01DNHlOVE15T1RaSU1DNDJOVE16TkRoRE1DNDJORGs0TVRJZ01DNHlOVE15T1RZZ01DNDJORFkwTWlBd0xqSTFORGN3TVNBd0xqWTBNemt5SURBdU1qVTNNakF4UXpBdU5qUXhOREU1SURBdU1qVTVOekF5SURBdU5qUXdNREUxSURBdU1qWXpNRGt6SURBdU5qUXdNREUxSURBdU1qWTJOakk1VmpBdU16VTVPVFl6U0RBdU5qWTJOamd4VmpBdU1qYzVPVFl6U0RBdU56TXpNelE0VmpBdU5EVXpNamsyU0RBdU56QTJOamd4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakkyTmpZMU55QXdMakkzT1RrMk0wZ3dMak16TXpNeU5GWXdMak0xT1RrMk0wZ3dMak0xT1RrNVZqQXVNalkyTmpJNVF6QXVNelU1T1RrZ01DNHlOak13T1RNZ01DNHpOVGcxT0RZZ01DNHlOVGszTURJZ01DNHpOVFl3T0RVZ01DNHlOVGN5TURGRE1DNHpOVE0xT0RVZ01DNHlOVFEzTURFZ01DNHpOVEF4T1RNZ01DNHlOVE15T1RZZ01DNHpORFkyTlRjZ01DNHlOVE15T1RaSU1DNHlOVE16TWpSRE1DNHlORGszT0RjZ01DNHlOVE15T1RZZ01DNHlORFl6T1RZZ01DNHlOVFEzTURFZ01DNHlORE00T1RVZ01DNHlOVGN5TURGRE1DNHlOREV6T1RVZ01DNHlOVGszTURJZ01DNHlNems1T1NBd0xqSTJNekE1TXlBd0xqSXpPVGs1SURBdU1qWTJOakk1VmpBdU5EWTJOakk1UXpBdU1qTTVPVGtnTUM0ME56QXhOalVnTUM0eU5ERXpPVFVnTUM0ME56TTFOVGNnTUM0eU5ETTRPVFVnTUM0ME56WXdOVGRETUM0eU5EWXpPVFlnTUM0ME56ZzFOVGdnTUM0eU5EazNPRGNnTUM0ME56azVOak1nTUM0eU5UTXpNalFnTUM0ME56azVOak5JTUM0eU9UTXpNalJXTUM0ME5UTXlPVFpJTUM0eU5qWTJOVGRXTUM0eU56azVOak5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3lJaUI1TVQwaU1TNHlNRGN5SWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6SkZNamRCUkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5USTNSa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjU1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY3LjUiIHk9IjczIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYxIiB2YWx1ZT0iQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSAtPiBBV1MgRWxhc3RpQ2FjaGUgZm9yIFJlZGlzIiBzdHlsZT0iaXIucmVmPTUwNTAxNGYyLWEwY2QtNGFhMC1iMTAyLWNjNTk4MGUxMzhkODtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQ5IiBzb3VyY2U9IjU4IiB0YXJnZXQ9IjU1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTgiIHZhbHVlPSJBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bG9hZC1iYWxhbmNlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qQTBOelFnTUM0MU1UTXlOME13TGpZMk16Z3lOQ0F3TGpVek16Z3pOaUF3TGpZM05EYzVOQ0F3TGpVMU1qTTRPQ0F3TGpZNU1USWdNQzQxTmpVeU16UkRNQzQzTURjMk1EY2dNQzQxTnpnd09DQXdMamN5T0RJME9DQXdMalU0TkRJNElEQXVOelE1TURFM0lEQXVOVGd5TmtNd0xqYzJPVGM0TnlBd0xqVTRNRGt4T1NBd0xqYzRPVEUyTXlBd0xqVTNNVFE0TWlBd0xqZ3dNekk1SURBdU5UVTJNVFkxUXpBdU9ERTNOREU0SURBdU5UUXdPRFE0SURBdU9ESTFNall5SURBdU5USXdOemMwSURBdU9ESTFNall5SURBdU5EazVPVE0yUXpBdU9ESTFNall5SURBdU5EYzVNRGs1SURBdU9ERTNOREU0SURBdU5EVTVNREkxSURBdU9EQXpNamtnTUM0ME5ETTNNRGhETUM0M09Ea3hOak1nTUM0ME1qZ3pPVEVnTUM0M05qazNPRGNnTUM0ME1UZzVOVE1nTUM0M05Ea3dNVGNnTUM0ME1UY3lOek5ETUM0M01qZ3lORGdnTUM0ME1UVTFPVElnTUM0M01EYzJNRGNnTUM0ME1qRTNPVElnTUM0Mk9URXlJREF1TkRNME5qTTRRekF1TmpjME56azBJREF1TkRRM05EZzFJREF1TmpZek9ESTBJREF1TkRZMk1ETTJJREF1TmpZd05EYzBJREF1TkRnMk5qQXpTREF1TlRZeE1EQTRRekF1TlRVNU5EWTFJREF1TkRZeU1EVTBJREF1TlRVek1USXpJREF1TkRNNE1EUTFJREF1TlRReU16UXhJREF1TkRFMU9UTTJUREF1TmpZeU16UXhJREF1TXpFME5EWTVRekF1TmpjM01EWTJJREF1TXpJMk1USXpJREF1TmprMU16RXhJREF1TXpNeU5ETTBJREF1TnpFME1Ea2dNQzR6TXpJek4wTXdMamN6TWpnMk9TQXdMak16TWpNd055QXdMamMxTVRBM0lEQXVNekkxT0RjeElEQXVOelkxTnpFMklEQXVNekUwTVRFNFF6QXVOemd3TXpZeElEQXVNekF5TXpZMElEQXVOemt3TlRnMElEQXVNamcxT1RnNElEQXVOemswTnpFeUlEQXVNalkzTmpZNFF6QXVOems0T0RRZ01DNHlORGt6TkRnZ01DNDNPVFkyTWprZ01DNHlNekF4TnlBd0xqYzRPRFEwSURBdU1qRXpNamN4UXpBdU56Z3dNalVnTUM0eE9UWXpOeklnTUM0M05qWTFOamdnTUM0eE9ESTNOVElnTUM0M05EazJNekVnTUM0eE56UTJORU13TGpjek1qWTVOU0F3TGpFMk5qVXlPU0F3TGpjeE16VXdOeUF3TGpFMk5EUXdOU0F3TGpZNU5USXdOaUF3TGpFMk9EWXhOME13TGpZM05qa3dOaUF3TGpFM01qZ3lPU0F3TGpZMk1EVTNOeUF3TGpFNE16RXlOeUF3TGpZME9EZzVJREF1TVRrM09ESTNRekF1TmpNM01qQTBJREF1TWpFeU5USTJJREF1TmpNd09EVXlJREF1TWpNd056VTNJREF1TmpNd09EYzBJREF1TWpRNU5UTTJRekF1TmpNd056RTRJREF1TWpZMU5qTTJJREF1TmpNMU16WWdNQzR5T0RFME1UY2dNQzQyTkRReU1EZ2dNQzR5T1RRNE5qbE1NQzQxTWpneU1EZ2dNQzR6T1RJMk1ETkRNQzQxTURVeE56Y2dNQzR6TlRnd09UZ2dNQzQwTnpFMk5UZ2dNQzR6TXpFNU1UY2dNQzQwTXpJMk1ETWdNQzR6TVRjNU1qZERNQzR6T1RNMU5EZ2dNQzR6TURNNU16Z2dNQzR6TlRFd01qa2dNQzR6TURJNE9ERWdNQzR6TVRFek1qZ2dNQzR6TVRRNU1UUkRNQzR5TnpFMk1qY2dNQzR6TWpZNU5EY2dNQzR5TXpZNE5Ea2dNQzR6TlRFME16RWdNQzR5TVRJeE16TWdNQzR6T0RRM05EbERNQzR4T0RjME1UWWdNQzQwTVRnd05qY2dNQzR4TnpRd056SWdNQzQwTlRnME5URWdNQzR4TnpRd056SWdNQzQwT1RrNU16WkRNQzR4TnpRd056SWdNQzQxTkRFME1qRWdNQzR4T0RjME1UWWdNQzQxT0RFNE1EWWdNQzR5TVRJeE16TWdNQzQyTVRVeE1qUkRNQzR5TXpZNE5Ea2dNQzQyTkRnME5ERWdNQzR5TnpFMk1qY2dNQzQyTnpJNU1qWWdNQzR6TVRFek1qZ2dNQzQyT0RRNU5UaERNQzR6TlRFd01qa2dNQzQyT1RZNU9URWdNQzR6T1RNMU5EZ2dNQzQyT1RVNU16VWdNQzQwTXpJMk1ETWdNQzQyT0RFNU5EVkRNQzQwTnpFMk5UZ2dNQzQyTmpjNU5UVWdNQzQxTURVeE56Y2dNQzQyTkRFM056UWdNQzQxTWpneU1EZ2dNQzQyTURjeU4wd3dMalkwTkRJd09DQXdMamN3TlRBd00wTXdMall6TlRNMklEQXVOekU0TkRVMUlEQXVOak13TnpFNElEQXVOek0wTWpNM0lEQXVOak13T0RjMElEQXVOelV3TXpNM1F6QXVOak13T0RZM0lEQXVOelk1TURnZ01DNDJNemN5TVRrZ01DNDNPRGN5TnpFZ01DNDJORGc0T1RFZ01DNDRNREU1TXpaRE1DNDJOakExTmpRZ01DNDRNVFkyTURFZ01DNDJOelk0TmpjZ01DNDRNalk0TnpFZ01DNDJPVFV4TXpRZ01DNDRNekV3TmpoRE1DNDNNVE0wTURFZ01DNDRNelV5TmpVZ01DNDNNekkxTlRJZ01DNDRNek14TkNBd0xqYzBPVFExTlNBd0xqZ3lOVEEwUXpBdU56WTJNelU0SURBdU9ERTJPVFF4SURBdU56Z3dNREV5SURBdU9EQXpNelEySURBdU56ZzRNVGcySURBdU56ZzJORGM1UXpBdU56azJNellnTUM0M05qazJNVElnTUM0M09UZzFOamtnTUM0M05UQTBOekVnTUM0M09UUTBOVE1nTUM0M016SXhPRFZETUM0M09UQXpNellnTUM0M01UTTRPVGtnTUM0M09EQXhNemNnTUM0Mk9UYzFOVElnTUM0M05qVTFNalFnTUM0Mk9EVTRNVFJETUM0M05UQTVNVEVnTUM0Mk56UXdOemNnTUM0M016STNORGNnTUM0Mk5qYzJORFlnTUM0M01UUXdNRFFnTUM0Mk5qYzFOekZETUM0Mk9UVXlOakVnTUM0Mk5qYzBPVFlnTUM0Mk56Y3dORGNnTUM0Mk56TTNPRE1nTUM0Mk5qSXpOREVnTUM0Mk9EVTBNRE5NTUM0MU5ESXpOREVnTUM0MU9ETTVNelpETUM0MU5UTXhNak1nTUM0MU5qRTRNamdnTUM0MU5UazBOalVnTUM0MU16YzRNVGtnTUM0MU5qRXdNRGdnTUM0MU1UTXlOMGd3TGpZMk1EUTNORnBOTUM0M05ESXdOelFnTUM0ME5ETTJOamxETUM0M05UTXlNRGtnTUM0ME5ETTJORE1nTUM0M05qUXhJREF1TkRRMk9USXhJREF1Tnpjek16Y3hJREF1TkRVek1EZzNRekF1TnpneU5qUXhJREF1TkRVNU1qVTBJREF1TnpnNU9EYzBJREF1TkRZNE1ETXlJREF1TnprME1UVXpJREF1TkRjNE16RXhRekF1TnprNE5ETXlJREF1TkRnNE5Ua2dNQzQzT1RrMU5qVWdNQzQwT1RrNU1EZ2dNQzQzT1RjME1Ea2dNQzQxTVRBNE16RkRNQzQzT1RVeU5UTWdNQzQxTWpFM05UVWdNQzQzT0RrNU1EVWdNQzQxTXpFM09UTWdNQzQzT0RJd05ERWdNQzQxTXprMk56VkRNQzQzTnpReE56Z2dNQzQxTkRjMU5UZ2dNQzQzTmpReE5USWdNQzQxTlRJNU15QXdMamMxTXpJek5DQXdMalUxTlRFeE1rTXdMamMwTWpNeE5pQXdMalUxTnpJNU5DQXdMamN6TURrNU5TQXdMalUxTmpFNE55QXdMamN5TURjd05pQXdMalUxTVRrek0wTXdMamN4TURReE55QXdMalUwTnpZM09DQXdMamN3TVRZeU1pQXdMalUwTURRMk5pQXdMalk1TlRRek15QXdMalV6TVRJeFF6QXVOamc1TWpRMElEQXVOVEl4T1RVMElEQXVOamcxT1RReElEQXVOVEV4TURjZ01DNDJPRFU1TkRFZ01DNDBPVGs1TXpaRE1DNDJPRFU1TkRFZ01DNDBPRFV3TXpZZ01DNDJPVEU0TlRFZ01DNDBOekEzTkRVZ01DNDNNREl6TnpRZ01DNDBOakF4T1RkRE1DNDNNVEk0T1RjZ01DNDBORGsyTkRnZ01DNDNNamN4TnpVZ01DNDBORE0zTURVZ01DNDNOREl3TnpRZ01DNDBORE0yTmpsV01DNDBORE0yTmpsYVRUQXVOekUwTXpReElEQXVNVGt6TWpZNVF6QXVOekkxTkRjZ01DNHhPVE15TmprZ01DNDNNell6TkRnZ01DNHhPVFkxTmprZ01DNDNORFUyTURFZ01DNHlNREkzTlRKRE1DNDNOVFE0TlRRZ01DNHlNRGc1TXpRZ01DNDNOakl3TmpZZ01DNHlNVGMzTWpJZ01DNDNOall6TWpVZ01DNHlNamd3TURORE1DNDNOekExT0RNZ01DNHlNemd5T0RVZ01DNDNOekUyT1RnZ01DNHlORGsxT1RnZ01DNDNOamsxTWpjZ01DNHlOakExTVRORE1DNDNOamN6TlRVZ01DNHlOekUwTWpnZ01DNDNOakU1T1RjZ01DNHlPREUwTlRNZ01DNDNOVFF4TWpnZ01DNHlPRGt6TWpKRE1DNDNORFl5TlRrZ01DNHlPVGN4T1RJZ01DNDNNell5TXpNZ01DNHpNREkxTlNBd0xqY3lOVE14T0NBd0xqTXdORGN5TVVNd0xqY3hORFF3TXlBd0xqTXdOamc1TXlBd0xqY3dNekE1SURBdU16QTFOemM0SURBdU5qa3lPREE1SURBdU16QXhOVEpETUM0Mk9ESTFNamNnTUM0eU9UY3lOakVnTUM0Mk56TTNOQ0F3TGpJNU1EQTBPU0F3TGpZMk56VTFOeUF3TGpJNE1EYzVOa013TGpZMk1UTTNOQ0F3TGpJM01UVTBNeUF3TGpZMU9EQTNOQ0F3TGpJMk1EWTJOQ0F3TGpZMU9EQTNOQ0F3TGpJME9UVXpOa013TGpZMU9EQTNOQ0F3TGpJek5EWXhNeUF3TGpZMk5EQXdNaUF3TGpJeU1ETXdNU0F3TGpZM05EVTFOQ0F3TGpJd09UYzBPVU13TGpZNE5URXdOeUF3TGpFNU9URTVOeUF3TGpZNU9UUXhPQ0F3TGpFNU16STJPU0F3TGpjeE5ETTBNU0F3TGpFNU16STJPVnBOTUM0M01UUXpOREVnTUM0Mk9UUXlNRE5ETUM0M01qVTBOelVnTUM0Mk9UUXlNRE1nTUM0M016WXpOVGtnTUM0Mk9UYzFNRGNnTUM0M05EVTJNVFVnTUM0M01ETTJPVFZETUM0M05UUTROekVnTUM0M01EazRPRFFnTUM0M05qSXdPRE1nTUM0M01UZzJOemtnTUM0M05qWXpNemNnTUM0M01qZzVOamxETUM0M056QTFPVElnTUM0M016a3lOVGdnTUM0M056RTJPVGdnTUM0M05UQTFOemdnTUM0M05qazFNVGNnTUM0M05qRTBPVFpETUM0M05qY3pNelVnTUM0M056STBNVFVnTUM0M05qRTVOak1nTUM0M09ESTBOQ0F3TGpjMU5EQTRJREF1Tnprd016QTBRekF1TnpRMk1UazRJREF1TnprNE1UWTNJREF1TnpNMk1UWWdNQzQ0TURNMU1UWWdNQzQzTWpVeU16WWdNQzQ0TURVMk56SkRNQzQzTVRRek1UTWdNQzQ0TURjNE1qZ2dNQzQzTURJNU9UVWdNQzQ0TURZMk9UUWdNQzQyT1RJM01UWWdNQzQ0TURJME1UVkRNQzQyT0RJME16Y2dNQzQzT1RneE16WWdNQzQyTnpNMk5Ua2dNQzQzT1RBNU1EUWdNQzQyTmpjME9USWdNQzQzT0RFMk16TkRNQzQyTmpFek1qWWdNQzQzTnpJek5qSWdNQzQyTlRnd05EZ2dNQzQzTmpFME56RWdNQzQyTlRnd056UWdNQzQzTlRBek16ZERNQzQyTlRneE1TQXdMamN6TlRRek55QXdMalkyTkRBMU15QXdMamN5TVRFMU9TQXdMalkzTkRZd01pQXdMamN4TURZek5rTXdMalk0TlRFMUlEQXVOekF3TVRFeklEQXVOams1TkRReElEQXVOamswTWpBeklEQXVOekUwTXpReElEQXVOamswTWpBeldrMHdMak0yT0RJd09DQXdMalkyTmpZd00wTXdMak16TlRJME5DQXdMalkyTmpZd015QXdMak13TXpBeU1TQXdMalkxTmpneU9DQXdMakkzTlRZeE15QXdMall6T0RVeE5VTXdMakkwT0RJd05TQXdMall5TURJd01TQXdMakl5TmpnME1pQXdMalU1TkRFM01TQXdMakl4TkRJeU9DQXdMalUyTXpjeE4wTXdMakl3TVRZeE15QXdMalV6TXpJMk15QXdMakU1T0RNeE15QXdMalE1T1RjMU1TQXdMakl3TkRjME5DQXdMalEyTnpReU1VTXdMakl4TVRFM05DQXdMalF6TlRBNU1TQXdMakl5TnpBME9DQXdMalF3TlRNNU5DQXdMakkxTURNMU55QXdMak00TWpBNE5VTXdMakkzTXpZMk5TQXdMak0xT0RjM05pQXdMak13TXpNMk15QXdMak0wTWprd015QXdMak16TlRZNU15QXdMak16TmpRM01rTXdMak0yT0RBeU15QXdMak16TURBME1TQXdMalF3TVRVek5DQXdMak16TXpNME1TQXdMalF6TVRrNE9DQXdMak0wTlRrMU5rTXdMalEyTWpRME15QXdMak0xT0RVM01TQXdMalE0T0RRM01pQXdMak0zT1Rrek15QXdMalV3TmpjNE5pQXdMalF3TnpNME1VTXdMalV5TlRFZ01DNDBNelEzTkRrZ01DNDFNelE0TnpRZ01DNDBOalk1TnpNZ01DNDFNelE0TnpRZ01DNDBPVGs1TXpaRE1DNDFNelE0TURRZ01DNDFORFF4TVRjZ01DNDFNVGN5TWpJZ01DNDFPRFkwTmprZ01DNDBPRFU1T0RFZ01DNDJNVGMzTVVNd0xqUTFORGMwSURBdU5qUTRPVFV4SURBdU5ERXlNemc1SURBdU5qWTJOVE16SURBdU16WTRNakE0SURBdU5qWTJOakF6VmpBdU5qWTJOakF6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPWMxNGFhYjUxLWRmZWYtNGMzMi1iZDU5LTkyNTllYTRhZGYwNDsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjkiIHk9IjE5MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MyIgdmFsdWU9IlNDVyBVc2VyIC0+IEFXUyBDbG91ZEZyb250IiBzdHlsZT0iaXIucmVmPTJjNjRkZGNjLWFkYTctNDdkMi1iMmJkLThiNjIzM2U5NzQ2OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNTAiIHRhcmdldD0iNTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1NCIgdmFsdWU9IlNDVyBVc2VyIC0+IEFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj01YTc0OWExYS0wNDAzLTQ3N2YtOGNiMy1iYmZmNDRhMGQ5MTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjUwIiB0YXJnZXQ9IjUyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNjIiIHZhbHVlPSJUaGlzIGJhc2ljIFRocmVhdCBNb2RlbCBkZXNjcmliZXMgYW4gQVdTIGhvc3RlZCBhcHBsaWNhdGlvbiB0aGF0IGEgdXNlciBhY2Nlc3NlcyByZW1vdGVseS4iIHN0eWxlPSJzaGFwZT1ub3RlO3N0cm9rZVdpZHRoPTI7Zm9udFNpemU9MTQ7c2l6ZT0yMDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jZmZmMmNjO3N0cm9rZUNvbG9yPSNkNmI2NTY7Zm9udENvbG9yPSM2NjY2MDA7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTEyNDkiIHk9Ii05MTQiIHdpZHRoPSIxOTMiIGhlaWdodD0iMTEyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="API - I/O -&gt; EC2 - Elastic Compute Cloud" ref="24090cb1-0cb6-455d-9d17-3c11ba708487" source="329646f1-38b8-4996-93e4-1e342f0bafb3" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="SCW User -&gt; AWS CloudFront" ref="2c64ddcc-ada7-47d2-b2bd-8b6233e97469" source="5fabbae7-9089-4bc6-beb9-9a432631c9d2" target="55881b84-57b2-495d-b21c-84c5fea0db1c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="EC2 - Elastic Compute Cloud -&gt; PostgreSQL" ref="456ef3b4-d874-4be9-93d1-577b3df224c0" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS ELB (Elastic Load Balancer) -&gt; AWS ElastiCache for Redis" ref="505014f2-a0cd-4aa0-b102-cc5980e138d8" source="f594eb8d-5453-4e6c-89aa-5d4ada78530e" target="ac6b58c4-31d2-491c-8e25-ef787e9af4ae">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="CloudWatch -&gt; Internal Logging Server" ref="53ba2d47-cf17-4abd-8736-420be80e8643" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d">
-      <assets/>
-      <tags>
-        <tag tag="Alerts"/>
-      </tags>
-    </dataflow>
-    <dataflow name="SCW User -&gt; AWS API Gateway" ref="5a749a1a-0403-477f-8cb3-bbff44a0d911" source="5fabbae7-9089-4bc6-beb9-9a432631c9d2" target="cb3c3a00-6887-4025-a440-4c5298fb2b0d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS API Gateway -&gt; AWS ELB (Elastic Load Balancer)" ref="5badf974-aeeb-4bb0-9fde-af603313d63a" source="cb3c3a00-6887-4025-a440-4c5298fb2b0d" target="f594eb8d-5453-4e6c-89aa-5d4ada78530e">
-      <assets/>
-      <tags>
-        <tag tag="https: 443"/>
-      </tags>
-    </dataflow>
-    <dataflow name="AWS CloudFront -&gt; AWS ELB (Elastic Load Balancer)" ref="8147f210-6823-4cfc-b094-2d9be8167ba4" source="55881b84-57b2-495d-b21c-84c5fea0db1c" target="f594eb8d-5453-4e6c-89aa-5d4ada78530e">
-      <assets/>
-      <tags>
-        <tag tag="https: 443"/>
-      </tags>
-    </dataflow>
-    <dataflow name="User - Web UI -&gt; AWS API Gateway" ref="be17d053-be74-4db1-95f4-02a7fba8663c" source="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" target="329646f1-38b8-4996-93e4-1e342f0bafb3">
-      <assets>
-        <asset name="Personally Identifiable Information"/>
-      </assets>
-      <tags>
-        <tag tag="Login Credentials"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Elasticsearch -&gt; Overflow / Cold Storage" ref="c0130149-5c31-4165-b6e2-22cc58339bdd" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="85488534-b4b9-4b7f-837b-1d895fd6a673">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="CloudWatch -&gt; EC2 - Elastic Compute Cloud" ref="ca9bb336-5f0b-4461-b156-16aeeec16146" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="EC2 - Elastic Compute Cloud -&gt; Elasticsearch" ref="d2b00bd0-3732-40f2-8948-2bd6093fc6dc" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="458aeca6-65f5-4791-a48c-3d18d76a02b5">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Elasticsearch -&gt; PostgreSQL" ref="e1351bee-27d2-46c7-bb89-6f292faf39f8" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Internal Logging Server -&gt; SIEM Team" ref="e312edcf-ecf1-4c73-8fb4-7dd95e8b06da" source="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" target="315742d3-3d9e-4a0c-909c-78f3885e8607">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="794e4f2f-b0d4-4f89-80ca-518da7b3b7d0" diagramComponentId="737d7a3c-9ae7-4c37-8ff7-6c7637feed0a" ref="55881b84-57b2-495d-b21c-84c5fea0db1c" name="AWS CloudFront" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="cf-cloudfront">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.291">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.292">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PROOF-DOS" name="There are no proofs of a DoS" state="0" impact="100" issueId="" issueLink="">
-          <desc>System is not configured to alert system administrators that a denial of service attack is happening or happened.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.292">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-3.12" name="Configure HTTP to HTTPS Redirects with a CloudFront Viewer Protocol Policy" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Configure the Viewer Protocol Policy for your CloudFront cache to redirect HTTP requests to HTTPS requests or to require that viewers use only the HTTPS protocol to access your objects in the CloudFront cache. You should also configure one or more cache behaviors in the same distribution to allow both HTTP and HTTPS, so you can require HTTPS for some objects but not for others. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  In order to use HTTPS, a SSL\TLS certificate must be attached. This depends on your data classification policy and needs to be configured according to your encryption policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For configuring "ViewerProtocolPolicy" first save locally the current distribution config:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Edit and replace "ViewerProtocolPolicy" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "ViewerProtocolPolicy": "redirect-to-https", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="3.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the "ViewerProtocolPolicy" used by application Cloudfront distributions (it should be set as redirect-to-https):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, ViewerProtocolPolicy:DefaultCacheBehavior.ViewerProtocolPolicy}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.187">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.17" name="Configure TLS1.1+ for CloudFront to Origin connection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  CloudFront can connect to your origin using only HTTP, only HTTPS, or to connect by matching the protocol used by the viewer. Our recommendation is to use HTTPS only. In 
-  this case you can choose which SSL\TLS protocols CloudFront is allowed to use when 
-  establishing an HTTPS connection to your origin. Ensure that you are using only TLS1.1+ as 
-  the SSL\TLS protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For configuring Origin SSL protocols first save locally the current distribution config:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Edit and replace "OriginSslProtocols" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "OriginSslProtocols": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    &amp;nbsp;"Items": [ 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "TLSv1.1", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "TLSv1.2" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    ], 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Quantity": 2 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    }, 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon Cloudfront New Origin Security Features" url="https://aws.amazon.com/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin-security-features/"/>
-            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="1.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the "OriginSslProtocols" used by application Cloudfront distributions (only TLSv1.1 and TLSv1.2 should be present):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, OriginSslProtocols:Origins.Items[*].CustomOriginConfig.OriginSslProtocols.Items[*]}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.3" name="Enable AWS Cloudfront logging" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, for example, .html, .css, .php, image, and media files, to end users. CloudFront delivers your content through a worldwide network of edge locations. When an end user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so content is delivered with the best possible performance. If the content is already in that edge location, CloudFront delivers it immediately. If the content is not currently in that edge location, CloudFront retrieves it from a customer defined Origin, such as AWS S3, AWS ELB or EC2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For enabling logging first save locally the current distribution config:&lt;/li&gt; 
- &lt;/ul&gt; 
-  aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Edit and replace "Logging" element in /tmp/cf-distribution.json with the below section: "Logging": { "Bucket": "&amp;lt;s3_bucket_name&amp;gt;", "Prefix": "cloudfrontlogs", "Enabled": true, "IncludeCookies": false },&lt;/li&gt; 
-  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag"&lt;/li&gt; 
-  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution-config.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all Cloudfront distributions and identify your application Distribution and Origin IDs. Note the "Id:" element:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;span style="white-space:pre"&gt; &lt;/span&gt;aws cloudfront list-distributions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Using the distribution Id from the previous step display the distribution settings, and check if the "Enabled" element is True or False:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;span style="white-space:pre"&gt; &lt;/span&gt;aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig.Logging" 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.4" name="Enable Geo-Restriction within Cloudfront Distribution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront is a web service that speeds up distribution of your static and dynamic 
-  web content, for example, .html, .css, .php, image, and media files, to end users. CloudFront 
-  delivers your content through a worldwide network of edge locations. When an end user 
-  requests content that you're serving with CloudFront, the user is routed to the edge 
-  location that provides the lowest latency, so content is delivered with the best possible 
-  performance. If the content is already in that edge location, CloudFront delivers it 
-  immediately. If the content is not currently in that edge location, CloudFront retrieves it 
-  from a customer defined Origin, such as AWS S3, AWS ELB or EC2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For enabling GeoRestrictions first save locally the current distribution config: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Edit the GeoRestrictions section in /tmp/cf-distribution.json with the desired configuration (similar to the below sample):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Restrictions": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     "GeoRestriction": { 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt;
-      "RestrictionType": "&amp;lt;blacklist|whitelist&amp;gt;", 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt;
-      &amp;nbsp;"Quantity": 3, 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt;
-      &amp;nbsp;"Items": ["&amp;lt;country_code_1&amp;gt;", "&amp;lt;country_code_2&amp;gt;"] 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    }, 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt;&amp;nbsp; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="6.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Check if geo restrictions are enabled on your application CloudFront distribution:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws cloudfront get-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "Distribution.DistributionConfig.Restrictions.GeoRestriction" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-7" name="Prevent viewer requests from bypassing the CDN and accessing the origin content directly" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When you deliver web content through a CDN such as CloudFront, a best practice is to prevent viewer requests from bypassing the CDN and accessing your origin content directly. For more information, see the blog post How to enhance Amazon CloudFront origin security with AWS WAF and AWS Secrets Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-            <reference name="How to enhance Amazon CloudFront origin security with AWS WAF and AWS Secrets Manager" url="https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the CDN is not bypassed by auditing the logs.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-7" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SRA-7" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PROOF-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.3" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.17" mitigation="25"/>
-                    <countermeasure ref="aws-tier-3.12" mitigation="25"/>
-                    <countermeasure ref="aws-tier-6.4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.17" mitigation="25"/>
-                <countermeasure ref="aws-tier-3.12" mitigation="25"/>
-                <countermeasure ref="aws-tier-5.3" mitigation="25"/>
-                <countermeasure ref="aws-tier-6.4" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="dc781d65-f874-4a58-84d7-f84a402edb24" diagramComponentId="4ed19abf-d5cc-4c2f-9a55-b79dc6ba21e3" ref="8eac4034-fa71-4753-938c-c147a01a52cb" name="AWS ElastiCache" desc="" library="Hydras-AWS-Foundation" parentComponentRef="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" componentDefinitionRef="elasticache">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.754">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.527">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE8" name="Apply any updates of type security for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Apply any updates of type security for AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You control when to apply an update, regardless of the recommendation. At a minimum, AWS strongly recommends that you apply any updates of type security to ensure that your clusters are always up-to-date with current security patches. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can apply the service updates using one of the following console options. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Console for Redis or Memcached 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose this to view Update Status for individual clusters, and then choose Apply, View, or Stop for the service updates. If a service update is available, the console displays a banner at the top of the page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you choose Apply Now, you can choose to apply the service update to all or a subset of the applicable clusters in this workflow. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you choose Dismiss, the console stops displaying the banner for that console session. However, the banner reappears the next time that you refresh your session. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  On the Apply Updates Now page, you can use these options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Auto-Update after Due Date: If this attribute is yes, after the Recommended apply by Date has passed, ElastiCache schedules clusters yet to be updated in the appropriate maintenance window. Updates are applied along with other applicable updates. You can continue to apply the updates until the update expiration date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If this attribute is no and you don't apply the self-service update before it expires, ElastiCache doesn't automatically apply the service update for you. If your cluster is part of one or more ElastiCache-supported compliance programs and isn't updated, it remains out of compliance until the next cumulative update becomes available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - The Nodes Updated ratio value for your cluster and the Estimated Update Time value help you plan your maintenance schedule. If service updates exceed the estimated time constraints for your business flows, you can stop updates and reapply them at a later date. For more information, see Stopping the Self-Service Updates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If you choose to apply the service updates to any or all available clusters, choose Confirm. If you choose this, you then view the Service Updates page, where you can monitor the status of your service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If you choose Cancel, you can explore further options, as explained following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  On the ElastiCache dashboard, you can check Update Status for each of your Redis clusters, as shown following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update Status displays one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - update available: An update is available to apply to this cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - not-applied: An update is available but not yet applied. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - scheduling: The update date is being scheduled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - scheduled: The update date has been scheduled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - waiting-to-start: The update process will soon begin. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - in-progress: The update is being applied to this cluster, rendering it unavailable for the duration of the value in Estimated Update Time. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - stopping: An in-progress update has been interrupted before completion. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - stopped: The update has been terminated. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you stop an in-progress update on a cluster, some nodes might be updated while others are not. The stopping process doesn't roll back any changes to already updated nodes. You can reapply the update to those nodes that still have an available status at your convenience if the update doesn't have an Expired status. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - complete: The update has been successfully applied. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - up to date: The cluster doesn't have any outstanding active service updates and your cluster is compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Service Updates List 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view the list of individual service updates and their status, along with other information, choose the Service Updates List tab. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Service Updates List, you can view the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Name: A unique identifier for the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Status: The status of the update, which is one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- complete: The update has been applied and all clusters are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- cancelled: The update has been canceled and is no longer necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- expired: The update is no longer available to apply. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Severity: The priority of applying the update: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- important: We recommend that you apply this update as soon as your business flow allows (within 30 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Type: For this version, only security updates are supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Release Date: When the update is released and available to apply on your Redis fleet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Recommended Apply By Date: ElastiCache guidance date to apply the updates by. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choosing an individual update provides additional details, including the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Description: Provides details on the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Expiration Date: The date when the service update expires and no longer is available. Any updates that aren't applied before their expiration date are cumulatively rolled into the next update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Important 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you apply updates of type security as soon as you can. Doing this helps ensure that your Redis clusters are always up-to-date with the latest security patches and are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view the list of individual service updates in relation to the applicable clusters, choose the Service Update Status tab. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Service Updates Status list, you can view the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Name: Detailed information about the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Cluster Name: The list of your Redis clusters that are eligible for the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Nodes Updated: The ratio of individual nodes within a specific cluster that were updated or remain available for the specific service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Severity: The priority of applying the update: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- important: We recommend that you apply this update as soon as you can (within 30 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Type: For this version, only security updates are supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Status: The status of the update, which is one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- complete: The update has been applied and all Redis clusters are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- canceled: The update has been canceled and is no longer necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- expired: The update is no longer available to apply. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update SLA Met: This reflects whether your cluster is compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- yes: All available updates have been applied to this cluster and available nodes by the apply-by date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  -- no: The service update might have been applied successfully to one or more nodes, but other nodes within the cluster still have an available status. This typically happens when a service update is applied and then stopped. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you stop the progress of a service update on a cluster, any nodes that are already updated have a complete status. Any nodes that have an In Progress or Stopping status revert to a Stopped status, and the Service Update SLA Met status changes to no. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- N/A: The replication group was created after the recommended apply-by date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Cluster Status Modified Date: The latest date that the cluster was modified with a service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Show Previous Updates check box, if selected, displays a list of previous updates that are no longer available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Managing the Service Updates -  Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/managing-updates.html"/>
-            <reference name="Managing the Service Updates - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/managing-updates.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that any updates of type security are applied for AWS ElastiCache.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.466">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE1" name="Control access to AWS ElastiCache using IAM policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control access to AWS ElastiCache using IAM policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can have valid credentials to authenticate your requests, but unless you have permissions you cannot create or access Amazon ElastiCache resources. For example, you must have permissions to create an ElastiCache cache cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following shows an example of a permissions policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;"Version": "2012-10-17", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;"Statement": [{ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowClusterPermissions", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateCacheCluster", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateReplicationGroup", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:DescribeCacheClusters", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:ModifyCacheCluster", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:RebootCacheCluster"], 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}, 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;{ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowUserToPassRole", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ "iam:PassRole" ], 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;] 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The policy has two statements: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. The first statement grants permissions for the Amazon ElastiCache actions (elasticache:CreateCacheCluster, elasticache:DescribeCacheClusters, elasticache:ModifyCacheCluster, and elasticache:RebootCacheCluster) on any cache cluster owned by the account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. The second statement grants permissions for the IAM action (iam:PassRole) on IAM roles. The wildcard character (*) at the end of the Resource value means that the statement allows permission for the iam:PassRole action on any IAM role. To limit this permission to a specific role, replace the wildcard character (*) in the resource ARN with the specific role name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The policy doesn't specify the Principal element because in an identity-based policy you don't specify the principal who gets the permission. When you attach policy to a user, the user is the implicit principal. When you attach a permissions policy to an IAM role, the principal identified in the role's trust policy gets the permissions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using Identity-Based Policies (IAM Policies) for Amazon ElastiCache" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.IdentityBasedPolicies.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE10" name="Enable AWS SNS Notifications for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable AWS SNS Notifications for AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When significant events happen for a cluster, ElastiCache sends notification to a specific Amazon SNS topic. Examples include a failure to add a node, success in adding a node, the modification of a security group, and others. By monitoring for key events, you can know the current state of your clusters and, depending upon the event, be able to take corrective action. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Adding an Amazon SNS Topic (Console) 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following procedure shows you how to add an Amazon SNS topic for a cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  This process can also be used to modify the Amazon SNS topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To add or modify an Amazon SNS topic for a cluster (Console) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the AWS Management Console and open the ElastiCache console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In Clusters, choose the cluster for which you want to add or modify an Amazon SNS topic ARN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4 In Modify Cluster under Topic for SNS Notification, choose the SNS topic you want to add, or choose Manual ARN input and type the ARN of the Amazon SNS topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Managing ElastiCache Amazon SNS Notifications - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/ECEvents.SNS.html"/>
-            <reference name="Managing ElastiCache Amazon SNS Notifications - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ECEvents.SNS.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
-            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE9" name="Use CloudWatch alarms with AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use CloudWatch alarms with AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  ElastiCache provides metrics that enable you to monitor your clusters. You can access these metrics through CloudWatch. ElastiCache provides both host-level metrics (for example, CPU usage) and metrics that are specific to the cache engine software (for example, cache gets and cache misses). These metrics are measured and published for each Cache node in 60-second intervals. 
-&lt;/div&gt; 
-&lt;div&gt;
-  By setting CloudWatch alarms on certain key metrics, you will be notified if your cache cluster's performance starts to degrade. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitoring CloudWatch Cluster and Node Metrics (Console) 
-&lt;/div&gt; 
-&lt;div&gt;
-  To gather CPU utilization statistics for a cache cluster 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the AWS Management Console and open the ElastiCache console at https://console.aws.amazon.com/elasticache/. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the cache nodes you want to view metrics for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting more than 20 nodes disables viewing metrics on the console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  a. On the Cache Clusters page of the AWS Management Console, click the name of one or more cache clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The detail page for the cache cluster appears. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  b. Click the Nodes tab at the top of the window. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  c. On the Nodes tab of the detail window, select the cache nodes that you want to view metrics for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A list of available CloudWatch Metrics appears at the bottom of the console window. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  d. Click on the CPU Utilization metric. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CloudWatch console will open, displaying your selected metrics. You can use the Statistic and Period drop-down list boxes and Time Range tab to change the metrics being displayed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring Use with CloudWatch Metrics - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheMetrics.html"/>
-            <reference name="Monitoring Use with CloudWatch Metrics - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheMetrics.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To test your rule that triggers on an API call, you have to trigger it with its Specific operation as defined into the Cloudwatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  In CloudWatch Events, it is possible to create rules that lead to infinite loops, where a rule is fired repeatedly. For example, a rule might detect that ACLs have changed on an S3 bucket, and trigger software to change them to the desired state. If the rule is not written carefully, the subsequent change to the ACLs fires the rule again, creating an infinite loop. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To prevent this, write the rules so that the triggered actions do not re-fire the same rule. For example, your rule could fire only if ACLs are found to be in a bad state, instead of after any change. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An infinite loop can quickly cause higher than expected charges. AWS recommends that you use budgeting, which alerts you when charges exceed your specified limit. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
-              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail PDF" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
-                    <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
-                <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1291b3e1-bf0b-497b-9387-b8053fe67f69" diagramComponentId="b335208f-2ec3-466f-ab76-51f9da590406" ref="315742d3-3d9e-4a0c-909c-78f3885e8607" name="SIEM Team" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                <countermeasure ref="CWE-327" mitigation="33"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1eb0e3d1-7d8a-413c-bce4-1c51579945b6" diagramComponentId="c14aab51-dfef-4c32-bd59-9259ea4adf04" ref="f594eb8d-5453-4e6c-89aa-5d4ada78530e" name="AWS ELB (Elastic Load Balancer)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="load-balancer">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
-          <desc>We do not have our resources current status and as a result lose control of some resources,
-                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;br&gt; 
-&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;br&gt; 
-&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
-&lt;br&gt; 
-&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;br&gt; 
-&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
-&lt;br&gt; 
-&lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;br&gt; 
-&lt;br&gt; Using the Amazon unified command line interface: 
-&lt;ul&gt; 
- &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
-  &lt;blockquote&gt;
-    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-  &lt;/blockquote&gt; &lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div style=""&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;div style=""&gt;
-    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
-                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
-                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
-                        engineered to be isolated from failures in other Availability Zones. By launching instances in
-                        separate Availability Zones, you can protect your applications from the failure of a single
-                        location. AWS assigns a unique ID to each subnet.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
-                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
-                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
-                        in a VPC, the CIDR blocks of the subnets must not overlap.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
-                        where possible.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
-                        fault tolerance and high availability from the perspective of resource deployment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-subnet --vpc-id application_vpc
-                        --cidr-block desired_cidr
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-tags --resources web_tier_elb_subnet1
-                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  OR 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  When an internal load balancer is created, it receives a public DNS name with the following form: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   internal-name-123456789.region.elb.amazonaws.com 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
-          </references>
-          <standards>
-            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The SG associated with the App tier ELB should allow connectivity from the security group
-                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
-                        the application design.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
-                        ELB:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
-                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; },
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
-                        --ip-permissions file:///PathTo/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This is required for both the configured port and protocol for the listener on the back-end
-                        instance and the port and protocol used for the health check.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
-                        security group rules that allow traffic for the specific application protocol and ports by
-                        referencing as source the security group associated with the App tier ELB.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
-                        element from Audit procedure):&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
-                        App tier ELB security group as the source of the connections:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
-                        --protocol tcp --port specific_port
-                        --source-group app_tier_elb_security_group
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
-                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
-                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
-                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-          </references>
-          <standards>
-            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;quot;AccessLog&amp;quot;: { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
-            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
-            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
-          </references>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Via Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all ELB's:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
-            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
-            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
-            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
-            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
-            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
-          </references>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-server-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For Amazon Certificate Manager users: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm list-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
-                        establishing a new connection supporting the Server Order Preference option. When this option is
-                        selected, the load balancer selects the first cipher in its list that is in the client's list of
-                        ciphers.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
-                        &lt;br /&gt;To enable Server Order Preference:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Click Save. &lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  In order to use HTTPS, an SSL\TLS certificate must be attached. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   "OriginProtocolPolicy": "https-only", 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
-                            distributions (it should be set as https-only):&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
-                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
-  &lt;div style=""&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; }, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     ] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the security group id from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;div&gt;
-    Using the Amazon unified command line interface: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt; 
-    &lt;div&gt;
-      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
-                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
-                        through the use of a unique random session key, and therefore prevents the decoding of captured
-                        data, even if the secret long-term key is compromised.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
-                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
-                            Cryptography (ECDHE) cipher suites.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.13" mitigation="9"/>
-                    <countermeasure ref="aws-tier-6.17" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.19" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.21" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.22" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.1" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.14" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.15" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.18" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.26" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.5" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.1" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.14" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.15" mitigation="7"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.13" mitigation="9"/>
-                <countermeasure ref="aws-tier-6.17" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.18" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.19" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.21" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.22" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.26" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.5" mitigation="7"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails in the resources are not enabled or not protected, attackers could gain
-                                access to the system and modify or delete data from the resources and the changes are
-                                not detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="unknown-resource-status">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="ca5c76bb-4bee-4a37-b807-3cab139cd499" diagramComponentId="8670166e-dc36-4f52-bea6-4545e9992c88" ref="794c99e8-a31a-4592-93a6-618a207a7aaa" name="PostgreSQL" desc="" library="CS-Default" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-            <implementation platform="Java">
-              <desc>
-                                ClN0cmluZyBzZWxlY3RTdGF0ZW1lbnQgPSAiU0VMRUNUICogRlJPTSBVc2VyIFdIRVJFIHVzZXJJZCA9ID8gIjsKUHJlcGFyZWRTdGF0ZW1lbnQgcHJlcFN0bXQgPSBjb24ucHJlcGFyZVN0YXRlbWVudChzZWxlY3RTdGF0ZW1lbnQpOwpwcmVwU3RtdC5zZXRTdHJpbmcoMSwgdXNlcklkKTsKUmVzdWx0U2V0IHJzID0gcHJlcFN0bXQuZXhlY3V0ZVF1ZXJ5KCk7Cg==
-                            </desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="50f3c51c-b1e1-4c4f-a363-2f611369ea35" diagramComponentId="f724f657-7b55-4a94-b235-295a78d04b3c" ref="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" name="AWS ElastiCache for Redis" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="CD-ELASTICACHE-FOR-REDIS">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.571">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-ELASTICACHE2-REDIS" name="Authenticate users with Redis AUTH or RBAC" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Authenticate users with Redis AUTH or RBAC 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Redis authentication tokens enable Redis to require a token (password) before allowing clients to run commands, thereby improving data security. Instead of authenticating users with the Redis AUTH command, in Amazon ElastiCache for Redis 6.x you can use a feature called Role-Based Access Control (RBAC). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying Redis AUTH to an ElastiCache for Redis Cluster 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can require that users enter a token on a token-protected Redis server. To do this, include the parameter --auth-token (API: AuthToken) with the correct token when you create your replication group or cluster. Also include it in all subsequent commands to the replication group or cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying RBAC to a Replication Group for ElastiCache for Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To use ElastiCache for Redis RBAC, you take the following steps: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Create one or more users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Create a user group and add users to the group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Assign the user group to a replication group that has in-transit encryption enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Authenticating Users with Role-Based Access Control (RBAC)" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html"/>
-            <reference name="Authenticating Users with the Redis AUTH Command" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that you use Redis AUTH or RBAC for enhanced security.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.465">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE7-REDIS" name="Enable AOF in AWS ElastiCache for Redis" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable Append Only Files (AOF) in AWS ElastiCache for Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  By default, the data in a Redis node on ElastiCache resides only in memory and isn't persistent. If a node is rebooted, or if the underlying physical server experiences a hardware failure, the data in the cache is lost. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you require data durability, you can enable the Redis append-only file feature (AOF). When this feature is enabled, the node writes all of the commands that change cache data to an append-only file. When a node is rebooted and the cache engine starts, the AOF is "replayed." The result is a warm Redis cache with all of the data intact. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AOF is disabled by default. To enable AOF for a cluster running Redis, you must create a parameter group with the appendonly parameter set to yes. You then assign that parameter group to your cluster. You can also modify the appendfsync parameter to control how often Redis writes to the AOF file. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When using AOF, keep the following in mind: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - To improve performance, consider enabling RDB snapshots on a designated persistence only secondary node. Then, disable both RDB snapshots and AOF on the primary node and all other secondary nodes. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - To improve performance, set the value of the appendfsync parameter to everysec or no to write to disk every second or as needed. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - AOF is supported only for use with Redis versions 2.8.21 and earlier. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - AOF is subject to the limitations described at Mitigating failures: Redis Append Only Files (AOF). 
-&lt;/div&gt; 
-&lt;div&gt;
-  - AOF isn't supported for cache.t1.micro and cache.t2.* nodes, or Multi-AZ replication groups. For nodes of these types, the appendonly parameter value is ignored. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Manual backups using AOF is a suitable option for maintaining a high level of data persistence at a relatively low cost by using the functionality that is native to Redis versions 2.8.21 and earlier. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Performance impact - Low to high. AOF performance impact is highly correlated with the associated appendfsync parameter value, which controls how often the AOF output buffer is written to disk. The more frequently the output buffer is written to disk, the greater the impact on performance. Choosing the always option for this parameter causes the buffer to be flushed every time the cache data is modified. Therefore, this option isn't recommended. Because the AOF file can grow quickly, it's a best practice to verify your disk space requirements. Another performance consideration for AOF is the time required to replay an AOF file. You might need several minutes to populate the Redis nodes with the cache data. During this time, your application can satisfy queries only for uncached data by directly querying your database. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Append Only Files (AOF) in ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/RedisAOF.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that AOF is enabled in AWS ElastiCache for Redis.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE6-REDIS" name="Enable automatic backups on AWS ElastiCache clusters running Redis" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable automatic backips on AWS ElastiCache clusters running Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon ElastiCache clusters running Redis can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all of the data in the cluster. All backups are written to Amazon Simple Storage Service (Amazon S3), which provides durable storage. At any time, you can restore your data by creating a new Redis cluster and populating it with data from a backup. With ElastiCache, you can manage backups using the AWS Management Console, the AWS Command Line Interface (AWS CLI), and the ElastiCache API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable or disable automatic backups on an existing Redis cluster or replication group by modifying it using the ElastiCache console, the AWS CLI, or the ElastiCache API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Using the AWS Management Console 
-&lt;/div&gt; 
-&lt;div&gt;
-  To modify a cluster (console) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the AWS Management Console and open the ElastiCache console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. From the list in the upper-right corner, choose the AWS Region where the cluster that you want to modify is located. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the navigation pane, choose the engine running on the cluster that you want to modify. 
-&lt;/div&gt; 
-&lt;div&gt;
-  A list of the chosen engine's clusters appears. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. In the list of clusters, for the cluster that you want to modify, choose its name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Choose Actions and then choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Modify Cluster window appears. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. In the Modify Cluster window, make the modifications that you want. 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Apply Immediately box applies only to node type and engine version modifications. To apply changes immediately, choose the Apply Immediately check box. If this box is not chosen, node type and engine version modifications are applied during the next maintenance window. Other modifications, such as changing the maintenance window, are applied immediately. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable or disable automatic backups when creating a Redis cluster or replication group using the ElastiCache console, the AWS CLI, or the ElastiCache API. You can enable automatic backups when you create a Redis cluster by checking the Enable Automatic Backups box in the Advanced Redis Settings section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Performance Impact of Backups 
-&lt;/div&gt; 
-&lt;div&gt;
-  The backup process depends upon which Redis version you're running. Beginning with Redis 2.8.22, the process is forkless. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Backup and Restore for ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Enable Automatic Backups box is checked in the Advanced Redis Settings section.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE5-REDIS" name="Enable AWS ElastiCache at-rest encryption for Redis" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable AWS ElastiCache at-rest encryption for Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  ElastiCache for Redis at-rest encryption is an optional feature to increase data security by encrypting on-disk data. When enabled on a replication group, it encrypts the following aspects: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Disk during sync, backup and swap operations 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Backups stored in Amazon S3 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want to enable at-rest encryption, you must meet the following conditions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Your cluster or replication group must be running Redis 3.2.6, 4.0.10 or later. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Your cluster or replication group must be created in a VPC based on Amazon VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, you can also use AUTH and the AUTH token (password) needed to perform operations on this cluster or replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable ElastiCache at-rest encryption when you create a Redis replication group by setting the parameter AtRestEncryptionEnabled to true. You can't enable at-rest encryption on existing replication groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable at-rest encryption when you create an ElastiCache for Redis replication group. You can do so using the AWS Management Console, the AWS CLI, or the ElastiCache API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When creating a replication group, you can pick one of the following options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Default - This option uses service managed encryption at rest. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Customer managed CMK - This option allows you to provide the Key ID/ARN from AWS KMS for encryption at rest. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enabling At-Rest Encryption on an Existing Redis Cluster 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can only enable at-rest encryption when you create a Redis replication group. If you have an existing replication group on which you want to enable at-rest encryption, do the following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable at-rest encryption on an existing replication group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Create a manual backup of your existing replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Create a new replication group by restoring from the backup. On the new replication group, enable at-rest encryption.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Update the endpoints in your application to point to the new replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Delete the old replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enabling At-Rest Encryption Using the AWS Management Console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable at-rest encryption when creating a replication group using the AWS Management Console, make the following selections: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose Redis as your engine. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Choose version 3.2.6, 4.0.10 or later as your engine version. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Choose Yes from the Encryption at-rest list. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because there is some processing needed to encrypt and decrypt the data, enabling at-rest encryption can have a performance impact during these operations. You should benchmark your data with and without at-rest encryption to determine the performance impact for your use cases. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="At-Rest Encryption in ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/at-rest-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that AWS ElastiCache at-rest encryption for Redis is enabled when creating a replication group.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE3-REDIS" name="Enable AWS ElastiCache in-transit encryption for Redis" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable AWS ElastiCache in-transit encryption for Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To help keep your data secure, Amazon ElastiCache and Amazon EC2 provide mechanisms to guard against unauthorized access of your data on the server. By providing in-transit encryption capability, ElastiCache gives you a tool you can use to help protect your data when it is moving from one location to another. For example, you might move data from a primary node to a read replica node within a replication group, or between your replication group and your application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want to enable in-transit encryption, you must meet the following conditions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Your cluster or replication group must be running Redis 3.2.6, 4.0.10 or later. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Your cluster or replication group must be created in a VPC based on Amazon VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, you can also use AUTH and the AUTH token (password) needed to perform operations on this cluster or replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable in-transit encryption when you create an ElastiCache for Redis replication group using the AWS Management Console, the AWS CLI, or the ElastiCache API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enabling In-Transit Encryption on an Existing Cluster 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can only enable in-transit encryption when you create a Redis replication group. If you have an existing replication group on which you want to enable in-transit encryption, do the following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable in-transit encryption for an existing Redis replication group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Create a manual backup of the replication group. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Create a new replication group by restoring from the backup setting the engine version to 3.2.6, 4.0.10 and later, and the parameter TransitEncryptionEnabled to true (CLI: --transit-encryption-enabled). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Update the endpoints in your application to the new replication group's endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Delete the old replication group. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enabling In-Transit Encryption Using the AWS Management Console 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable in-transit encryption when creating a replication group using the AWS Management Console, make the following selections: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose Redis as your engine. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Choose engine version 3.2.6, 4.0.10 or later. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Choose Yes from the Encryption in-transit list. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because of the processing required to encrypt and decrypt the data at the endpoints, implementing in-transit encryption can reduce performance. Benchmark in-transit encryption compared to no encryption on your own data to determine its impact on performance for your implementation. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="ElastiCache for Redis In-Transit Encryption (TLS)" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that AWS ElastiCache in-transit encryption for Redis is enabled when creating a replication group.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE4-REDIS" name="Enable Multi-AZ in AWS ElastiCache for Redis" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable Multi-AZ in AWS ElastiCache for Redis 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  In certain cases, ElastiCache for Redis detects and replaces a primary node. These cases include certain types of planned maintenance and the unlikely event of a primary node or Availability Zone failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This replacement results in some downtime for the cluster. If you have Multi-AZ enabled on the cluster, the downtime is minimized. In this case, the role of primary node fails over to one of the read replicas. There's no need to create and provision a new primary node. This failover and replica promotion ensure that you can resume writing to the new primary as soon as promotion is complete. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable Multi-AZ using the ElastiCache console when you create a new Redis cluster or by modifying an existing Redis cluster with replication. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-AZ is enabled by default on Redis (cluster mode enabled) clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Important 
-&lt;/div&gt; 
-&lt;div&gt;
-  ElastiCache will automatically enable Multi-AZ only if the cluster contains at least one replica in a different Availability Zone from the primary in all shards. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When creating a Cluster Mode Disabled Cluster (Console) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Number of replicas, choose the number of read replicas that you want for this cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If you choose to have one or more replicas, the Multi-AZ check box is available. AWS strongly suggests that you enable Multi-AZ, which helps ensure your eligibility for service level agreement (SLA) compliance. If you enter 0, the Multi-AZ check box is not enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Minimizing Downtime in ElastiCache for Redis with Multi-AZ" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Multi-AZ is enabled in AWS ElastiCache for Redis.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="redis" name="Redis" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE3-REDIS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE3-REDIS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE2-REDIS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE2-REDIS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE4-REDIS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE4-REDIS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE6-REDIS" mitigation="50"/>
-                    <countermeasure ref="AWS-ELASTICACHE7-REDIS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE6-REDIS" mitigation="50"/>
-                <countermeasure ref="AWS-ELASTICACHE7-REDIS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE5-REDIS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE5-REDIS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="5160f03a-545b-46a5-9108-ce52631e57bd" diagramComponentId="9952204e-7e2c-440c-9505-54c1c1f55e81" ref="458aeca6-65f5-4791-a48c-3d18d76a02b5" name="Elasticsearch" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="elasticsearch">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.231">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.213">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.219">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.238">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.202">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-ELASTICSEARCH1" name="Control access to Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Control access to Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service offers several ways of controlling access to domains by supporting three types of access policies:&lt;br&gt; - Resource-based Policies&lt;br&gt; - Identity-based Policies&lt;br&gt; - IP-based Policies&lt;/p&gt; 
-&lt;p&gt;Fine-grained access control offers additional ways of controlling access to your data on Amazon Elasticsearch Service. For example, depending on who makes the request, you might want a search to return results from only one index. You might want to hide certain fields in your documents or exclude certain documents altogether. Fine-grained access control offers the following features:&lt;br&gt; - Role-based access control&lt;br&gt; - Security at the index, document, and field level&lt;br&gt; - Kibana multi-tenancy&lt;br&gt; - HTTP basic authentication for Elasticsearch and Kibana&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To configure access policies (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain that you want to update.&lt;/p&gt; 
-&lt;p&gt;4. Choose Actions and Modify access policy.&lt;/p&gt; 
-&lt;p&gt;5. Edit the access policy JSON, or use the dropdown list to choose a preconfigured option.&lt;/p&gt; 
-&lt;p&gt;6. Choose Submit.&lt;/p&gt; 
-&lt;p&gt;Enabling Fine-Grained Access Control&lt;/p&gt; 
-&lt;p&gt;Enable fine-grained access control using the console, AWS CLI, or configuration API. The console offers the simplest experience while creating a new domain.&lt;/p&gt; 
-&lt;p&gt;In the Fine-grained access control section, enable or disable fine-grained access control:&lt;/p&gt; 
-&lt;p&gt;- If you want to use IAM for user management, choose Set IAM role as master user and specify the ARN for an IAM role.&lt;/p&gt; 
-&lt;p&gt;- If you want to use the internal user database, choose Create a master user and specify a user name and password.&lt;/p&gt; 
-&lt;p&gt;Whichever option you choose, the master user can access all indices in the cluster and all Elasticsearch APIs.&lt;/p&gt; 
-&lt;p&gt;If you disable fine-grained access control, you can still control access to your domain by placing it within a VPC, applying a restrictive access policy, or both. You must enable node-to-node encryption and encryption at rest to use fine-grained access control.&lt;/p&gt; 
-&lt;p&gt;Here are the requirements for enabling fine-grained access control:&lt;/p&gt; 
-&lt;p&gt;- Elasticsearch 6.7 or later&lt;br&gt; - Encryption of data at rest and node-to-node encryption enabled&lt;br&gt; - Require HTTPS for all traffic to the domain enabled&lt;/p&gt; 
-&lt;p&gt;You can't enable fine-grained access control on existing domains, only new ones. After you enable fine-grained access control, you can't disable it.&lt;/p&gt; 
-&lt;p&gt;For more information and examples about different types of policies and access control, please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; If you enabled VPC access for your domain, you can't configure an IP-based policy. Instead, you can use security groups to control which IP addresses can access the domain.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Creating and Managing Amazon Elasticsearch Service Domains" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html"/>
-            <reference name="Identity and Access Management in Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH7" name="Create alerts for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Configure alerts in Amazon Elasticsearch Service (Amazon ES) to get notified when data from one or more Elasticsearch indices meets certain conditions. &lt;br&gt; For example, you might want to receive an email if your application logs more than five HTTP 503 errors in one hour, or you might want to page a developer if no new documents have been indexed in the last 20 minutes.&lt;br&gt; Alerting requires Elasticsearch version 6.2 or later.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To get started with alerting&lt;/p&gt; 
-&lt;p&gt;1. Choose Alerting from the Kibana main menu.&lt;/p&gt; 
-&lt;p&gt;2. Set up a destination for the alert. Choose between Slack, Amazon Chime, a custom webhook, or Amazon SNS. As you might imagine, notifications require connectivity to the destination. For example, your Amazon ES domain must be able to connect to the internet to notify a Slack channel or send a custom webhook to a third-party server.&lt;/p&gt; 
-&lt;p&gt;3. Create a monitor in one of three ways: visually, using a query, or using an anomaly detector.&lt;/p&gt; 
-&lt;p&gt;4. Define a condition to trigger the monitor.&lt;/p&gt; 
-&lt;p&gt;5. (Optional) Add one or more actions to the monitor.&lt;/p&gt; 
-&lt;p&gt;Tip&lt;br&gt; After an action successfully sends a message, secure access to that message. If your domain contains sensitive data, consider using triggers without actions and periodically checking Kibana for alerts.&lt;/p&gt; 
-&lt;p&gt;For further information and Recommended CloudWatch Alarms please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Alerting for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/alerting.html"/>
-            <reference name="Recommended CloudWatch Alarms" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/cloudwatch-alarms.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have created alerts for Amazon Elasticsearch.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH6" name="Enable all logs for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable all logs for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES exposes four Elasticsearch logs through Amazon CloudWatch Logs: error logs, search slow logs, index slow logs, and audit logs. Search slow logs, index slow logs, and error logs are useful for troubleshooting performance and stability issues. Audit logs track user activity for compliance purposes. &lt;br&gt; All the logs are disabled by default.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Log Publishing (Console)&lt;/p&gt; 
-&lt;p&gt;The Amazon ES console is the simplest way to enable the publishing of logs to CloudWatch.&lt;/p&gt; 
-&lt;p&gt;To enable log publishing to CloudWatch (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
-&lt;p&gt;4. On the Logs tab, choose Setup for the log you want.&lt;/p&gt; 
-&lt;p&gt;5. Create a CloudWatch log group, or choose an existing one.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; If you plan to enable multiple logs, AWS recommends publishing each to its own log group. This separation makes the logs easier to scan.&lt;/p&gt; 
-&lt;p&gt;6. Choose an access policy that contains the appropriate permissions, or create a policy using the JSON that the console provides:&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com" }, "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Resource": "cw_log_group_arn" } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Important&lt;br&gt; CloudWatch Logs supports 10 resource policies per Region. If you plan to enable logs for several Amazon ES domains, you should create and reuse a broader policy that includes multiple log groups to avoid reaching this limit.&lt;/p&gt; 
-&lt;p&gt;7. Choose Enable.&lt;/p&gt; 
-&lt;p&gt;Audit Log Kibana UI&lt;/p&gt; 
-&lt;p&gt;After you enable audit logs, configure them to match your needs.&lt;/p&gt; 
-&lt;p&gt;1. Open Kibana, and choose Security.&lt;/p&gt; 
-&lt;p&gt;2. Choose Audit logs.&lt;/p&gt; 
-&lt;p&gt;3. Choose Enable audit logging.&lt;/p&gt; 
-&lt;p&gt;The Kibana UI offers full control of audit log settings under General settings and Compliance settings.&lt;/p&gt; 
-&lt;p&gt;Setting Elasticsearch Logging Thresholds for Slow Logs&lt;/p&gt; 
-&lt;p&gt;After you enable the publishing of slow logs to CloudWatch, you still must specify logging thresholds for each Elasticsearch index. These thresholds define precisely what should be logged and at which log level.&lt;/p&gt; 
-&lt;p&gt;You specify these settings through the Elasticsearch REST API:&lt;/p&gt; 
-&lt;p&gt;PUT elasticsearch_domain_endpoint/index/_settings&lt;br&gt; { "index.search.slowlog.threshold.query.warn": "5s", "index.search.slowlog.threshold.query.info": "2s"&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; The status of your domain changes from Active to Processing. The status must return to Active before log publishing is enabled. This change typically takes 30 minutes, but can take longer depending on your domain configuration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Audit Logs for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/audit-logs.html"/>
-            <reference name="Configuring Elasticsearch Logs" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createdomain-configure-slow-logs.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Observe the logs&lt;/p&gt;
-
-	&lt;p&gt;1. Open the CloudWatch console.&lt;br /&gt;
-2. In the navigation pane, choose Log groups.&lt;br /&gt;
-3. Choose the log group that you specified while enabling logs. Within the log group, Amazon ES creates a log stream for each node in your domain.&lt;br /&gt;
-4. In Log streams, choose Search all.&lt;br /&gt;
-5. For the read and write events, see the corresponding logs. You can expect a delay of 5 seconds before the log appears.&lt;/p&gt;
-
-
-	&lt;p&gt;Testing slow logs&lt;/p&gt;
-
-	&lt;p&gt;To test that slow logs are publishing successfully, consider starting with very low values to verify that logs appear in CloudWatch, and then increase the thresholds to more useful levels.&lt;/p&gt;
-
-	&lt;p&gt;If the logs don't appear, check the following:&lt;/p&gt;
-
-	&lt;p&gt;- Does the CloudWatch log group exist? Check the CloudWatch console.&lt;/p&gt;
-
-	&lt;p&gt;- Does Amazon ES have permissions to write to the log group? Check the Amazon ES console.&lt;/p&gt;
-
-	&lt;p&gt;- Is the Amazon ES domain configured to publish to the log group? Check the Amazon ES console, use the AWS CLI describe-elasticsearch-domain-config option, or call DescribeElasticsearchDomainConfig using one of the SDKs.&lt;/p&gt;
-
-	&lt;p&gt;- Are the Elasticsearch logging thresholds low enough that your requests are exceeding them? To review your thresholds for an index, use the following command:&lt;/p&gt;
-
-	&lt;p&gt;GET elasticsearch_domain_endpoint/index/_settings?pretty&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH5" name="Enable dedicated master nodes for production Amazon Elasticsearch domains" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable dedicated master nodes for production Amazon Elasticsearch domains&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service uses dedicated master nodes to increase cluster stability. A dedicated master node performs cluster management tasks, but does not hold data or respond to data upload requests. AWS recommends that you add three dedicated master nodes to each production Amazon ES domain. Never choose an even number of dedicated master nodes.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; When creating and managing Amazon ES domains:&lt;/p&gt; 
-&lt;p&gt;- Enable dedicated master nodes. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. AWS recommends three dedicated master nodes for production domains.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; You can choose different instance types for your dedicated master nodes and data nodes. For example, you might select general purpose or storage-optimized instances for your data nodes, but compute-optimized instances for your dedicated master nodes.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Dedicated Master Nodes" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that dedicated master nodes option is enabled and three dedicated master nodes are used for each domain.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.818">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH4" name="Enable encryption of data at rest for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable encryption of data at rest for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES domains offer encryption of data at rest, a security feature that helps prevent unauthorized access to your data. The feature uses AWS Key Management Service (AWS KMS) to store and manage your encryption keys and the Advanced Encryption Standard algorithm with 256-bit keys (AES-256) to perform the encryption. If enabled, the feature encrypts the following aspects of a domain:&lt;/p&gt; 
-&lt;p&gt;- All indices (including those in UltraWarm storage)&lt;br&gt; - Elasticsearch logs&lt;br&gt; - Swap files&lt;br&gt; - All other data in the application directory&lt;br&gt; - Automated snapshots&lt;/p&gt; 
-&lt;p&gt;The following are not encrypted when you enable encryption of data at rest, but you can take additional steps to protect them:&lt;/p&gt; 
-&lt;p&gt;- Manual snapshots: You currently can't use KMS master keys to encrypt manual snapshots. You can, however, use server-side encryption with S3-managed keys or customer master keys (CMKs) to encrypt the bucket you use as a snapshot repository.&lt;br&gt; - Slow logs and error logs: If you publish logs and want to encrypt them, you can encrypt their CloudWatch Logs log group using the same AWS KMS master key as the Amazon ES domain.&lt;/p&gt; 
-&lt;p&gt;Amazon ES supports only symmetric customer master keys, not asymmetric ones.&lt;/p&gt; 
-&lt;p&gt;Regardless of whether encryption at rest is enabled, all domains automatically encrypt custom packages using AES-256 and Amazon ES-managed keys.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Encryption of Data at Rest&lt;/p&gt; 
-&lt;p&gt;Encryption of data at rest on new domains requires Elasticsearch 5.1 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
-&lt;p&gt;To use the Amazon ES console to configure encryption of data at rest, you must have read permissions to AWS KMS, such as the following identity-based policy:&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:List*", "kms:Describe*" ], "Resource": "*" } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;If you want to use a master key other than (Default) aws/es, you must also have permissions to create grants for the key. These permissions typically take the form of a resource-based policy that you specify when you create the key.&lt;/p&gt; 
-&lt;p&gt;If you want to keep your key exclusive to Amazon ES, you can add the kms:ViaService condition to that key policy:&lt;/p&gt; 
-&lt;p&gt;"Condition": { "StringEquals": { "kms:ViaService": "es.us-west-1.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Warning&lt;br&gt; If you delete the key that you used to encrypt a domain, the domain becomes inaccessible. The Amazon ES team can't help you recover your data. AWS KMS deletes master keys only after a waiting period of at least seven days, so the Amazon ES team might contact you if they detect that your domain is at risk.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; - Automatic key rotation preserves the properties of your AWS KMS master keys, so the rotation has no effect on your ability to access your Elasticsearch data. Encrypted Amazon ES domains don't support manual key rotation, which involves creating a new master key and updating any references to the old key. &lt;br&gt; - Certain instance types don't support encryption of data at rest.&lt;br&gt; - Domains that encrypt data at rest use a different repository name for their automated snapshots.&lt;br&gt; - Encrypting an Amazon ES domain requires a grant, and each encryption key has a limit of 500 grants per principal. This limit means that the maximum number of Amazon ES domains that you can encrypt using a single key is 500. Currently, Amazon ES supports a maximum of 100 domains per account (per Region), so this grant limit is of no consequence. If the domain limit per account increases, however, the grant limit might become relevant.&lt;br&gt; If you need to encrypt more than 500 domains at that time, you can create additional keys. Keys are regional, not global, so if you operate in more than one AWS Region, you already need multiple keys.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Encryption of Data at Rest for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To ensure that encryption of data at rest for Amazon Elasticsearch is enabled (from console):&lt;/p&gt;
-
-	&lt;p&gt;1. Sign In to the Console.&lt;br /&gt;
-2. Go to Amazon Elasticsearch dashboard.&lt;br /&gt;
-3. Ensure that Encryption at rest is set to Enabled on the selected domain&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH9" name="Enable Node-to-node Encryption for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Node-to-node Encryption for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES.&lt;/p&gt; 
-&lt;p&gt;Each Amazon ES domain-regardless of whether the domain uses VPC access-resides within its own, dedicated VPC. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure. By default, however, traffic within the VPC is unencrypted. Node-to-node encryption enables TLS 1.2 encryption for all communications within the VPC.&lt;/p&gt; 
-&lt;p&gt;If you send data to Amazon ES over HTTPS, node-to-node encryption helps ensure that your data remains encrypted as Elasticsearch distributes (and redistributes) it throughout the cluster. If data arrives unencrypted over HTTP, Amazon ES encrypts it after it reaches the cluster. You can require that all traffic to the domain arrive over HTTPS using the console, AWS CLI, or configuration API.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling Node-to-node Encryption&lt;/p&gt; 
-&lt;p&gt;Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
-&lt;p&gt;Alternatively, you can use the AWS CLI or configuration API.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; After you configure a domain to use node-to-node encryption, you can't disable the setting. Instead, you can take a manual snapshot of the encrypted domain, create another domain, migrate your data, and delete the old domain.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Node-to-node Encryption for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Node-to-node Encryption for Amazon Elasticsearch is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.855">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH8" name="Set up Anomaly Detection for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Set up Anomaly Detection for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Anomaly detection in Amazon Elasticsearch Service (Amazon ES) automatically detects anomalies in your Elasticsearch data in near-real time by using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream. The algorithm computes an anomaly grade and confidence score value for each incoming data point. Anomaly detection uses these values to differentiate an anomaly from normal variations in your data.&lt;br&gt; You can pair the anomaly detection plugin with the Alerting for Amazon Elasticsearch Service plugin to notify you as soon as an anomaly is detected.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Anomaly detection requires Elasticsearch 7.4 or later. All instance types support anomaly detection except for t2.micro and t2.small.&lt;/p&gt; 
-&lt;p&gt;Getting Started with Anomaly Detection&lt;/p&gt; 
-&lt;p&gt;To get started, choose Anomaly Detection in Kibana.&lt;/p&gt; 
-&lt;p&gt;Step 1: Create a Detector&lt;/p&gt; 
-&lt;p&gt;A detector is an individual anomaly detection task. You can create multiple detectors, and all the detectors can run simultaneously, with each analyzing data from different sources.&lt;/p&gt; 
-&lt;p&gt;Step 2: Add Features to Your Detector&lt;/p&gt; 
-&lt;p&gt;A feature is the field in your index that you check for anomalies. A detector can discover anomalies across one or more features. You must choose one of the following aggregations for each feature: average(), sum(), count(), min(), or max().&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; The count() aggregation method is only available in Elasticsearch version 7.7 and later. For version 7.4, use a custom expression like the following:&lt;/p&gt; 
-&lt;p&gt;{ "aggregation_name": { "value_count": { "field": "field_name" } }&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;The aggregation method determines what constitutes an anomaly. For example, if you choose min(), the detector focuses on finding anomalies based on the minimum values of your feature. If you choose average(), the detector finds anomalies based on the average values of your feature. You can add a maximum of five features per detector.&lt;/p&gt; 
-&lt;p&gt;You can configure the following optional settings (available in 7.7 and later):&lt;/p&gt; 
-&lt;p&gt;- Category field - Categorize or slice your data with a dimension like IP address, product ID, country code, and so on.&lt;/p&gt; 
-&lt;p&gt;- Window size - Set the number of aggregation intervals from your data stream to consider in a detection window.&lt;/p&gt; 
-&lt;p&gt;After you set up your features, preview sample anomalies and adjust the feature settings if necessary.&lt;/p&gt; 
-&lt;p&gt;Step 3: Observe the Results&lt;/p&gt; 
-&lt;p&gt;- Live anomalies - displays the live anomaly results for the last 60 intervals. For example, if the interval is set to 10, it shows the results for the last 600 minutes. This chart refreshes every 30 seconds.&lt;/p&gt; 
-&lt;p&gt;- Anomaly history - plots the anomaly grade with the corresponding measure of confidence.&lt;/p&gt; 
-&lt;p&gt;- Feature breakdown - plots the features based on the aggregation method. You can vary the date-time range of the detector.&lt;/p&gt; 
-&lt;p&gt;- Anomaly occurrence - shows the Start time, End time, Data confidence, and Anomaly grade for each anomaly detected.&lt;/p&gt; 
-&lt;p&gt;If you set the category field, you see an additional Heat map chart that correlates results for anomalous entities. Choose a filled rectangle to see a more detailed view of the anomaly.&lt;/p&gt; 
-&lt;p&gt;Step 4: Set Up Alerts&lt;br&gt; To create a monitor to send you notifications when any anomalies are detected, choose Set up alerts. The plugin redirects you to the Add monitor page where you can configure an alert.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Anomaly Detection for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ad.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Anomaly Detection for Amazon Elasticsearch has been properly configured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.846">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH3" name="Update Service Software for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Update Service Software for Amazon Elasticsearch&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Amazon ES regularly releases system software updates that add features or otherwise improve your domains.&lt;br&gt; The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge.&lt;br&gt; Each notification includes details about the service software update. The notification severity is Informational if the update is optional and High if it's required. Consider the following when deciding whether to update your domain:&lt;br&gt; - If you take no action on required updates, Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation, Amazon ES sends notifications when it starts the update and when the update is complete.&lt;br&gt; - If you start an update manually, Amazon ES doesn't send a notification when it starts the update, only when the update is complete.&lt;br&gt; Manually updating your domain lets you take advantage of new features more quickly.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Service software updates differ from Elasticsearch version upgrades.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To request a service software update (console)&lt;/p&gt; 
-&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
-&lt;p&gt;4. For Service software release, follow the documentation link to compare your current version to the latest version. Then choose Update.&lt;/p&gt; 
-&lt;p&gt;To request a service software update (AWS CLI and AWS SDKs)&lt;/p&gt; 
-&lt;p&gt;You can use the following commands to see if an update is available, check upgrade eligibility, and request an update:&lt;/p&gt; 
-&lt;p&gt;describe-elasticsearch-domain (DescribeElasticsearchDomain)&lt;/p&gt; 
-&lt;p&gt;start-elasticsearch-service-software-update (StartElasticsearchServiceSoftwareUpdate)&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Consider starting the update at a low traffic time.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Service Software Updates" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Service Software for Amazon Elasticsearch has been updated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICSEARCH2" name="Upgrade Amazon Elasticsearch to the latest version" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Upgrade Amazon Elasticsearch to the latest version&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; To get the new Elasticsearch features, bug fixes and security updates, upgrade Elasticsearch to the latest version.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Elasticsearch version upgrades differ from service software updates.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The upgrade process consists of three steps:&lt;/p&gt; 
-&lt;p&gt;1. Pre-upgrade checks - Amazon ES performs a series of checks for issues that can block an upgrade and doesn't proceed to the next step unless these checks succeed.&lt;/p&gt; 
-&lt;p&gt;2. Snapshot - Amazon ES takes a snapshot of the Elasticsearch cluster and doesn't proceed to the next step unless the snapshot succeeds. If the upgrade fails, Amazon ES uses this snapshot to restore the cluster to its original state.&lt;/p&gt; 
-&lt;p&gt;3. Upgrade - Amazon ES starts the upgrade, which can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;/p&gt; 
-&lt;p&gt;Starting an Upgrade&lt;/p&gt; 
-&lt;p&gt;The upgrade process is irreversible and can't be paused or canceled. During an upgrade, you can't make configuration changes to the domain. Before starting an upgrade, double-check that you want to proceed. You can use these same steps to perform the pre-upgrade check without actually starting an upgrade.&lt;/p&gt; 
-&lt;p&gt;If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;/p&gt; 
-&lt;p&gt;To upgrade a domain to a later version of Elasticsearch (console)&lt;/p&gt; 
-&lt;p&gt;1. Take a manual snapshot of your domain. This snapshot serves as a backup that you can restore on a new domain if you want to return to using the prior Elasticsearch version.&lt;/p&gt; 
-&lt;p&gt;2. Sign In to the Console.&lt;/p&gt; 
-&lt;p&gt;3. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
-&lt;p&gt;4. In the navigation pane, under My domains, choose the domain that you want to upgrade.&lt;/p&gt; 
-&lt;p&gt;5. Choose Actions and Upgrade domain.&lt;/p&gt; 
-&lt;p&gt;6. For Operation, choose Upgrade, Submit, and Continue.&lt;/p&gt; 
-&lt;p&gt;7. Return to the Overview tab and choose Upgrade status to monitor the state of the upgrade.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;br&gt; Upgrade can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;br&gt; Amazon ES offers in-place Elasticsearch upgrades for domains that run versions 5.1 and later. If you use services like Amazon Kinesis Data Firehose or Amazon CloudWatch Logs to stream data to Amazon ES, check that these services support the newer version of Elasticsearch before migrating.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Upgrading Elasticsearch" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use the following operation to identify the right Elasticsearch version for your domain:&lt;/p&gt;
-
-	&lt;p&gt;get-compatible-elasticsearch-versions (GetCompatibleElasticsearchVersions)&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.789">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
-                <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
-                    <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
-                <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
-                <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-5.1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="0e2135b9-d234-486d-822f-928bca46b59c" diagramComponentId="da58f473-0983-4a35-aed8-e9fc0d6f4dde" ref="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" name="Internal Logging Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="internal-server">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
-          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
-                        to known security issues. These issues could be used by an attacker to gain access to the
-                        system.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.510">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Vendors and other maintainers of software release patches in response to security flaws and
-                        other bugs in their products.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
-                        failures or exploitation.&lt;/li&gt;
-                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
-                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
-                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
-                        the flaw.&lt;/li&gt;
-                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
-                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
-                            security and other patches.&lt;/li&gt;
-                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
-                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
-                            taking into account the associated risk.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
- &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
- &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
-&lt;/ul&gt; </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:43.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
-          <threats>
-            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers compromise the server that hosts the service or data, then the data and
-                                the service itself could be at risk of compromise. The server could be compromised
-                                through any of the services that it exposes.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="UNNECESSARY-SERVICES">
-                  <countermeasures>
-                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNPATCHED-SERVER">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="b72c4d08-d532-40ca-9d4d-682929663006" diagramComponentId="351ce93a-53cd-41e7-b6fd-a7effc997ac3" ref="329646f1-38b8-4996-93e4-1e342f0bafb3" name="API - I/O" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="api-gateway">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.747">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of a command using
-                    externally-influenced input from an upstream component, but it does not
-                    neutralize or incorrectly neutralizes special elements that could modify the
-                    intended command when it is sent to a downstream
-                    component.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:50.102">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:49.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-12-10T16:38:53.139">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Choose a minimum TLS version for a custom domain in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create a custom domain, you specify the security policy for it. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:38:45.299">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control and manage access to a REST API in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use the following mechanisms for authentication and authorization: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. IAM tags can be used together with IAM policies to control access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-18T15:20:51.952">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for API endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:49:02.306">
-              <output/>
-            </source>
-            <references>
-              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-              <reference name="Routing traffic to an Amazon API Gateway API by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:29:43.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:47:51.718">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a REST API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Do one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create an API and deploy it to a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Logs/Tracing in the Stage Editor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable execution logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable CloudWatch Logs under CloudWatch Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Error or Info from the dropdown menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If desired, choose Enable Detailed CloudWatch Metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable access logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable Access Logging under Custom Access Logging. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable execution logging and access logging independent of each other. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test your logging setup&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:45:18.275">
-              <output/>
-            </source>
-            <references>
-              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
-              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Monitor REST API execution with Amazon CloudWatch metrics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can access CloudWatch using any of the following methods: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon CloudWatch console 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS CLI&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  CloudWatch API 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose the name of the API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Under the selected API, choose Dashboard. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Use From and To to enter the date range. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:46:32.717">
-              <output/>
-            </source>
-            <references>
-              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable payload compression by using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API or create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Another way is to use AWS CLI to create a new API and enable compression. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose a REST API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. In the Resources pane, choose the method you want to test. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For additional options you may need to specify, contact the API owner. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Choose Test. The following information will be displayed: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
-   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
-   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
-   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
-   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
-   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:33:00.030">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If you choose to enable caching for a REST API, you can enable cache encryption. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To configure API caching for individual methods using the console: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Go to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stages list for the API, expand the stage and choose a method in the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Override for this method in Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:28:19.444">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable request validation in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Enable request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test basic request validation using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following steps describe how to test basic request validation in the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test the request validation on a method using TestInvoke in the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  While signed in to the API Gateway console, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Resources for the API that you've configured a request validators map for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a method for which you have enabled the request validation with a specified request validator. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Method Execution, in the Client box, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Invalid request body" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the request parameters aren't valid, the following error message returns: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:41:53.285">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Required" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content-Type: application/json 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: apigateway.us-east-1.amazonaws.com 
-&lt;/div&gt; 
-&lt;div&gt;
-  X-Amz-Date: 20170603T200400Z 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authorization: AWS4-HMAC-SHA256 Credential=... 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "patchOperations" : [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; } 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; ] 
-&lt;/div&gt; 
-&lt;div&gt;
-  }&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of update-stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to remove the old certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of delete-client-certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate in the console for a previously deployed API, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the main navigation pane, choose Client Certificates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Client Certificates pane, choose Generate Client Certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the API for which you want to use the client certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages under the selected API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To save the settings, choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need to redeploy the API for the changes to take effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:31:36.166">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up a stage for a REST API 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a new stage 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the APIs navigation pane, choose Stages under an API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Stages navigation pane, choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Optionally, enter a stage description for Stage description. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To see your Stages follow the steps below: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the APIs pane, choose the API, and then choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the Stages pane, choose the name of the stage. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:34:49.306">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To get started with AWS Secrets Manager: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identify your secrets and locate where they are used in your applications. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update your applications to retrieve secrets from Secrets Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.983">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:20:17.914">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can do this by: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
-  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:18:21.424">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose an API method. In Client, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. From Client Certificate, choose Test to invoke the method request. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:30:05.704">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-              <reference name="Test invoke to verify the client certificate configuration" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-77">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6b097766-0b12-4b58-9847-8ef48e085739" diagramComponentId="e95e2b87-78dd-4691-abbe-7305c52be781" ref="46ce1e88-97c9-4162-b67f-b64b5af527c6" name="AWS ElastiCache" desc="" library="Hydras-AWS-Foundation" parentComponentRef="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" componentDefinitionRef="elasticache">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE8" name="Apply any updates of type security for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Apply any updates of type security for AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You control when to apply an update, regardless of the recommendation. At a minimum, AWS strongly recommends that you apply any updates of type security to ensure that your clusters are always up-to-date with current security patches. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can apply the service updates using one of the following console options. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Console for Redis or Memcached 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose this to view Update Status for individual clusters, and then choose Apply, View, or Stop for the service updates. If a service update is available, the console displays a banner at the top of the page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you choose Apply Now, you can choose to apply the service update to all or a subset of the applicable clusters in this workflow. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you choose Dismiss, the console stops displaying the banner for that console session. However, the banner reappears the next time that you refresh your session. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  On the Apply Updates Now page, you can use these options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Auto-Update after Due Date: If this attribute is yes, after the Recommended apply by Date has passed, ElastiCache schedules clusters yet to be updated in the appropriate maintenance window. Updates are applied along with other applicable updates. You can continue to apply the updates until the update expiration date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If this attribute is no and you don't apply the self-service update before it expires, ElastiCache doesn't automatically apply the service update for you. If your cluster is part of one or more ElastiCache-supported compliance programs and isn't updated, it remains out of compliance until the next cumulative update becomes available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - The Nodes Updated ratio value for your cluster and the Estimated Update Time value help you plan your maintenance schedule. If service updates exceed the estimated time constraints for your business flows, you can stop updates and reapply them at a later date. For more information, see Stopping the Self-Service Updates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If you choose to apply the service updates to any or all available clusters, choose Confirm. If you choose this, you then view the Service Updates page, where you can monitor the status of your service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If you choose Cancel, you can explore further options, as explained following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  On the ElastiCache dashboard, you can check Update Status for each of your Redis clusters, as shown following. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update Status displays one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - update available: An update is available to apply to this cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - not-applied: An update is available but not yet applied. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - scheduling: The update date is being scheduled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - scheduled: The update date has been scheduled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - waiting-to-start: The update process will soon begin. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - in-progress: The update is being applied to this cluster, rendering it unavailable for the duration of the value in Estimated Update Time. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - stopping: An in-progress update has been interrupted before completion. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - stopped: The update has been terminated. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you stop an in-progress update on a cluster, some nodes might be updated while others are not. The stopping process doesn't roll back any changes to already updated nodes. You can reapply the update to those nodes that still have an available status at your convenience if the update doesn't have an Expired status. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - complete: The update has been successfully applied. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - up to date: The cluster doesn't have any outstanding active service updates and your cluster is compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Applying the Service Updates Using the Service Updates List 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view the list of individual service updates and their status, along with other information, choose the Service Updates List tab. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Service Updates List, you can view the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Name: A unique identifier for the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Status: The status of the update, which is one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- complete: The update has been applied and all clusters are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- cancelled: The update has been canceled and is no longer necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- expired: The update is no longer available to apply. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Severity: The priority of applying the update: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- important: We recommend that you apply this update as soon as your business flow allows (within 30 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Type: For this version, only security updates are supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Release Date: When the update is released and available to apply on your Redis fleet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Recommended Apply By Date: ElastiCache guidance date to apply the updates by. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choosing an individual update provides additional details, including the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Description: Provides details on the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Expiration Date: The date when the service update expires and no longer is available. Any updates that aren't applied before their expiration date are cumulatively rolled into the next update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Important 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you apply updates of type security as soon as you can. Doing this helps ensure that your Redis clusters are always up-to-date with the latest security patches and are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view the list of individual service updates in relation to the applicable clusters, choose the Service Update Status tab. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Service Updates Status list, you can view the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Name: Detailed information about the service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Cluster Name: The list of your Redis clusters that are eligible for the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Nodes Updated: The ratio of individual nodes within a specific cluster that were updated or remain available for the specific service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Severity: The priority of applying the update: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- important: We recommend that you apply this update as soon as you can (within 30 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Update Type: For this version, only security updates are supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update Status: The status of the update, which is one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- complete: The update has been applied and all Redis clusters are compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- canceled: The update has been canceled and is no longer necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- expired: The update is no longer available to apply. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Service Update SLA Met: This reflects whether your cluster is compliant. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- yes: All available updates have been applied to this cluster and available nodes by the apply-by date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  -- no: The service update might have been applied successfully to one or more nodes, but other nodes within the cluster still have an available status. This typically happens when a service update is applied and then stopped. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you stop the progress of a service update on a cluster, any nodes that are already updated have a complete status. Any nodes that have an In Progress or Stopping status revert to a Stopped status, and the Service Update SLA Met status changes to no. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;-- N/A: The replication group was created after the recommended apply-by date. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Cluster Status Modified Date: The latest date that the cluster was modified with a service update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Show Previous Updates check box, if selected, displays a list of previous updates that are no longer available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Managing the Service Updates -  Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/managing-updates.html"/>
-            <reference name="Managing the Service Updates - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/managing-updates.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that any updates of type security are applied for AWS ElastiCache.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.004">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE1" name="Control access to AWS ElastiCache using IAM policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control access to AWS ElastiCache using IAM policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can have valid credentials to authenticate your requests, but unless you have permissions you cannot create or access Amazon ElastiCache resources. For example, you must have permissions to create an ElastiCache cache cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following shows an example of a permissions policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;"Version": "2012-10-17", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;"Statement": [{ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowClusterPermissions", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateCacheCluster", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateReplicationGroup", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:DescribeCacheClusters", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:ModifyCacheCluster", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:RebootCacheCluster"], 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}, 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;{ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowUserToPassRole", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ "iam:PassRole" ], 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp;] 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The policy has two statements: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. The first statement grants permissions for the Amazon ElastiCache actions (elasticache:CreateCacheCluster, elasticache:DescribeCacheClusters, elasticache:ModifyCacheCluster, and elasticache:RebootCacheCluster) on any cache cluster owned by the account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. The second statement grants permissions for the IAM action (iam:PassRole) on IAM roles. The wildcard character (*) at the end of the Resource value means that the statement allows permission for the iam:PassRole action on any IAM role. To limit this permission to a specific role, replace the wildcard character (*) in the resource ARN with the specific role name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The policy doesn't specify the Principal element because in an identity-based policy you don't specify the principal who gets the permission. When you attach policy to a user, the user is the implicit principal. When you attach a permissions policy to an IAM role, the principal identified in the role's trust policy gets the permissions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using Identity-Based Policies (IAM Policies) for Amazon ElastiCache" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.IdentityBasedPolicies.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE10" name="Enable AWS SNS Notifications for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable AWS SNS Notifications for AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When significant events happen for a cluster, ElastiCache sends notification to a specific Amazon SNS topic. Examples include a failure to add a node, success in adding a node, the modification of a security group, and others. By monitoring for key events, you can know the current state of your clusters and, depending upon the event, be able to take corrective action. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Adding an Amazon SNS Topic (Console) 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following procedure shows you how to add an Amazon SNS topic for a cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  This process can also be used to modify the Amazon SNS topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To add or modify an Amazon SNS topic for a cluster (Console) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the AWS Management Console and open the ElastiCache console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In Clusters, choose the cluster for which you want to add or modify an Amazon SNS topic ARN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4 In Modify Cluster under Topic for SNS Notification, choose the SNS topic you want to add, or choose Manual ARN input and type the ARN of the Amazon SNS topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Choose Modify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Managing ElastiCache Amazon SNS Notifications - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/ECEvents.SNS.html"/>
-            <reference name="Managing ElastiCache Amazon SNS Notifications - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ECEvents.SNS.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
-            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.006">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-ELASTICACHE9" name="Use CloudWatch alarms with AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use CloudWatch alarms with AWS ElastiCache 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  ElastiCache provides metrics that enable you to monitor your clusters. You can access these metrics through CloudWatch. ElastiCache provides both host-level metrics (for example, CPU usage) and metrics that are specific to the cache engine software (for example, cache gets and cache misses). These metrics are measured and published for each Cache node in 60-second intervals. 
-&lt;/div&gt; 
-&lt;div&gt;
-  By setting CloudWatch alarms on certain key metrics, you will be notified if your cache cluster's performance starts to degrade. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitoring CloudWatch Cluster and Node Metrics (Console) 
-&lt;/div&gt; 
-&lt;div&gt;
-  To gather CPU utilization statistics for a cache cluster 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the AWS Management Console and open the ElastiCache console at https://console.aws.amazon.com/elasticache/. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the cache nodes you want to view metrics for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting more than 20 nodes disables viewing metrics on the console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  a. On the Cache Clusters page of the AWS Management Console, click the name of one or more cache clusters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The detail page for the cache cluster appears. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  b. Click the Nodes tab at the top of the window. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  c. On the Nodes tab of the detail window, select the cache nodes that you want to view metrics for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A list of available CloudWatch Metrics appears at the bottom of the console window. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  d. Click on the CPU Utilization metric. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CloudWatch console will open, displaying your selected metrics. You can use the Statistic and Period drop-down list boxes and Time Range tab to change the metrics being displayed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring Use with CloudWatch Metrics - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheMetrics.html"/>
-            <reference name="Monitoring Use with CloudWatch Metrics - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheMetrics.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To test your rule that triggers on an API call, you have to trigger it with its Specific operation as defined into the Cloudwatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  In CloudWatch Events, it is possible to create rules that lead to infinite loops, where a rule is fired repeatedly. For example, a rule might detect that ACLs have changed on an S3 bucket, and trigger software to change them to the desired state. If the rule is not written carefully, the subsequent change to the ACLs fires the rule again, creating an infinite loop. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To prevent this, write the rules so that the triggered actions do not re-fire the same rule. For example, your rule could fire only if ACLs are found to be in a bad state, instead of after any change. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An infinite loop can quickly cause higher than expected charges. AWS recommends that you use budgeting, which alerts you when charges exceed your specified limit. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
-              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail PDF" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.256">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.006">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
-                    <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
-                <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="9e24a1d1-e6a8-4fee-937c-2f6fe8375aa1" diagramComponentId="630f8d7f-ab52-44c9-9875-ef9c979cd4e5" ref="f4049c60-9be6-471e-8885-753b7ce5c14d" name="EC2 - Elastic Compute Cloud" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="ec2">
-      <tags>
-        <tag tag="Autoscaling"/>
-      </tags>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
-          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:38:28.834">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.070">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:54:10.678">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:34:35.371">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
-                        To avoid this, access to the network must be as restricted as possible, so that only the
-                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
-  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 allocate-address --domain vpc 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
-            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
-          </references>
-          <standards>
-            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:31:03.095">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:44:34.594">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon Unified CLI: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
-          </references>
-          <standards>
-            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:30:24.393">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt; 
-  &lt;div&gt;
-    A list of approved AMIs must be maintained by the organization. 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:46:26.599">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
-  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Additional properties can be defined through the launch configuration such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Instance Type&lt;/li&gt; 
-  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
-  &lt;li&gt;IAM Role&lt;/li&gt; 
-  &lt;li&gt;Security Groups&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:57:31.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:40:33.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:37:32.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface:: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:46:34.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each NAT gateway is created in a specific Availability Zone and implemented with 
-  redundancy in that zone. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   and/or 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
-            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:34:03.576">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
-  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
-  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
-  are engineered to be isolated from failures in other Availability Zones. By launching 
-  instances in separate Availability Zones, you can protect your applications from the failure 
-  of a single location. AWS assigns a unique ID to each subnet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
-  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
-  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
-  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
-  Some AWS regions have more than 2 availability zones and it is recommended to use more 
-  than 2 where possible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:27:41.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The port for these inbound rules would depend on the Database engine used and the 
-  configured port. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The default values are: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
-  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
-  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
-  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:04:42.704">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  When we create a default VPC, AWS does the following to set it up: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
-  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
-  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
-  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-  Label this Default VPC "Do Not Use". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
-  set a label to remind others not to use it. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
-            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
-            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
-            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
-          </references>
-          <standards>
-            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon Unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:52:45.279">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Copy snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
-            <reference name="Create snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
-            <reference name="Create volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
-            <reference name="Delete volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
-            <reference name="Describe volumes" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
-            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T17:12:03.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
-                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
-                        every 90 days (or immediately if security patches become available) to avoid undue exposure
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;For linux instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
-                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
-                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A route table contains a set of rules, called routes, that are used to determine where 
-  network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the 
-  routing for the subnet. A subnet can only be associated with one route table at a time, but 
-  you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:49:36.275">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App and Data tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
-            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
-            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
-          </references>
-          <standards>
-            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:17:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:10:24.664">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
-  can assign the instance to up to five security groups. Security groups act at the instance 
-  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
-  assigned to a different set of security groups. If you don't specify a particular group at 
-  launch time, the instance is automatically assigned to the default security group for the 
-  VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a 
-  separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:00:55.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
-                        (ingress/egress) on the default security group in order to force the use of least privilege via
-                        custom created security groups.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
-                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
-                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
-                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the default security group.&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
-                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Default Value&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt;
-   The prescribed value is the default value. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
-            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
-            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
-          </references>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-images --owners self --filters 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    ImageId:ImageId, Public:Public}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T12:25:04.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:14:01.280">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.436">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.451">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.460">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.475">
-              <output/>
-            </source>
-            <references>
-              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        ALL TCP or ALL ports to avoid undue server exposure.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt; 
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 22</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
-                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
-                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
-                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the security group.&lt;/li&gt;
-                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
-                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
-                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
-                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
-                            of 0.0.0.0/0.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
-                            port 3389</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="VOLUMES-NOT-ENCRYPTED">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
-                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
-                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
-                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-02">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-NET-03">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
-                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
-                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
-                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
-                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="bcf6d830-8260-48e3-a96d-c509e58b5789" diagramComponentId="d077f2ce-8f51-4eed-b9e8-29c33c1c901e" ref="85488534-b4b9-4b7f-837b-1d895fd6a673" name="Overflow / Cold Storage" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
-          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
-                        for an MFA.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T13:16:12.065">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.595">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.792">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
-            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
-            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
-          </references>
-          <standards>
-            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
-                            then your bucket has no versioning enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.388">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.402">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
-&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
-&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt; 
-</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
-            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
-&lt;/div&gt; 
-&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
-            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T15:40:07.036">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
- &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
- &lt;/ul&gt; If data in transit is kept unencrypted: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
- &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Version":"2012-10-17", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Id":"PutObjPolicy", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Statement":{ 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Effect":"Deny", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Principal":"*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Action":"s3:PutObject", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Condition":{ 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;} 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;} 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
-            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
-            <reference name="Using Server-side Encryption" url="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api list-buckets --output table
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            ...
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;{
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Effect": "Deny",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Principal": "*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Action": "s3:PutObject",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Condition": {
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T11:46:08.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
-  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
-  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
-  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
-  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
-  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;br&gt; 
-&lt;br&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
-            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
-            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
-            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
-                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            ./prowler -c extra73
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T14:10:10.879">
-              <output/>
-            </source>
-            <references>
-              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; {&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; "Statement":[&lt;/i&gt; 
-   &lt;i&gt;{&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Condition":{&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;div&gt; 
-       &lt;i&gt;"Bool":&lt;/i&gt; 
-      &lt;/div&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;}&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;i&gt;}&lt;/i&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; }&lt;/i&gt; 
-     &lt;i&gt;]&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt;} &lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
-                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
-                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.943">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.957">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br /&gt; 
-&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br /&gt; 
-&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
-&lt;br /&gt;Remediation 
-&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
-                            has no MFA delete enabled.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
-                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="29b3dab5-6ff0-4719-a871-637e3a1e8e5b" diagramComponentId="12c72ec7-9b87-436e-b190-69f05654a0af" ref="8bf78537-3cdd-4c79-88be-e341adba0b30" name="CloudWatch" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="cloudwatch">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.027">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.042">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AWS-CLOUDWATCH7" name="Connect to CloudWatch using Interface VPC Endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Connect to CloudWatch using Interface VPC Endpoints&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; If you use Amazon Virtual Private Cloud (Amazon VPC) to host your AWS resources, you can establish a private connection between your VPC, CloudWatch, and CloudWatch Synthetics. You can use these connections to enable CloudWatch and CloudWatch Synthetics to communicate with your resources on your VPC without going through the public internet.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Creating a VPC Endpoint for CloudWatch&lt;/p&gt; 
-&lt;p&gt;To start using CloudWatch with your VPC, create an interface VPC endpoint for CloudWatch. The service name to choose is com.amazonaws.region.monitoring.&lt;/p&gt; 
-&lt;p&gt;You do not need to change the settings for CloudWatch. CloudWatch calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch, and you already have metrics flowing to CloudWatch from resources located on your VPC, these metrics begin flowing through the interface VPC endpoint by default.&lt;/p&gt; 
-&lt;p&gt;Controlling Access to Your CloudWatch VPC Endpoint&lt;/p&gt; 
-&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, Amazon VPC attaches a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
-&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
-&lt;p&gt;To edit the VPC endpoint policy for CloudWatch&lt;/p&gt; 
-&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
-&lt;p&gt;3. If you have not already created the endpoint for CloudWatch, choose Create Endpoint. Select com.amazonaws.region.monitoring, and then choose Create endpoint.&lt;/p&gt; 
-&lt;p&gt;4. Select the com.amazonaws.region.monitoring endpoint, and then choose the Policy tab.&lt;/p&gt; 
-&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
-&lt;p&gt;Creating a VPC Endpoint for CloudWatch Synthetics&lt;/p&gt; 
-&lt;p&gt;To start using CloudWatch Synthetics with your VPC, create an interface VPC endpoint for CloudWatch Synthetics. The service name to choose is com.amazonaws.region.synthetics. For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.&lt;/p&gt; 
-&lt;p&gt;You do not need to change the settings for CloudWatch Synthetics. CloudWatch Synthetics communicates with other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch Synthetics, and you already have an interface endpoint for Amazon S3, CloudWatch Synthetics begins communicating with Amazon S3 through the interface VPC endpoint by default.&lt;/p&gt; 
-&lt;p&gt;Controlling Access to Your CloudWatch Synthetics VPC Endpoint&lt;/p&gt; 
-&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, we attach a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
-&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
-&lt;p&gt;To edit the VPC endpoint policy for CloudWatch Synthetics&lt;/p&gt; 
-&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
-&lt;p&gt;3. If you have not already created the endpoint for CloudWatch Synthetics, choose Create Endpoint. Select com.amazonaws.region.synthetics and then choose Create endpoint.&lt;/p&gt; 
-&lt;p&gt;4. Select the com.amazonaws.region.synthetics endpoint and then choose the Policy tab.&lt;/p&gt; 
-&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
-&lt;p&gt;The following are the general steps for setting up an interface endpoint:&lt;/p&gt; 
-&lt;p&gt;1. Choose the VPC in which to create the interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service to which you're connecting.&lt;/p&gt; 
-&lt;p&gt;2. Choose a subnet in your VPC to use the interface endpoint. We create an endpoint network interface in the subnet. You can specify more than one subnet in different Availability Zones (as supported by the service) to help ensure that your interface endpoint is resilient to Availability Zone failures. In that case, we create an endpoint network interface in each subnet that you specify.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; An endpoint network interface is a requester-managed network interface. You can view it in your account, but you cannot manage it yourself. For more information, see Elastic Network Interfaces.&lt;/p&gt; 
-&lt;p&gt;3. Specify the security groups to associate with the endpoint network interface. The security group rules control the traffic to the endpoint network interface from resources in your VPC. If you do not specify a security group, we associate the default security group for the VPC.&lt;/p&gt; 
-&lt;p&gt;4. (Optional, AWS services and AWS Marketplace Partner services only) Enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.&lt;/p&gt; 
-&lt;p&gt;Important&lt;br&gt; Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.&lt;/p&gt; 
-&lt;p&gt;Private DNS is enabled in the other subnets which are in the same VPC and Availability Zone or Local Zone.&lt;/p&gt; 
-&lt;p&gt;5. When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.&lt;/p&gt; 
-&lt;p&gt;6. After you create the interface endpoint, it's available to use when it's accepted by the service provider. The service provider must configure the service to accept requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using CloudWatch and CloudWatch Synthetics with Interface VPC Endpoints" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Viewing your interface endpoint&lt;br /&gt;
-After you've created an interface endpoint, you can view information about it using the Console or the Command line.&lt;/p&gt;
-
-	&lt;p&gt;To view information about an interface endpoint using the console:&lt;/p&gt;
-
-	&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Endpoints and select your interface endpoint.&lt;/p&gt;
-
-	&lt;p&gt;3. To view information about the interface endpoint, choose Details. The DNS Names field displays the DNS names to use to access the service.&lt;/p&gt;
-
-	&lt;p&gt;4. To view the subnets in which the interface endpoint has been created, and the ID of the endpoint network interface in each subnet, choose Subnets.&lt;/p&gt;
-
-	&lt;p&gt;5. To view the security groups that are associated with the endpoint network interface, choose Security Groups.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH1" name="Control access to Amazon CloudWatch resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Control access to Amazon CloudWatch resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles), and some services (such as AWS Lambda) also support attaching permissions policies to resources.&lt;br&gt; Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. CloudWatch supports only identity-based policies.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following shows an example of a permissions policy.&lt;/p&gt; 
-&lt;p&gt;{ "Version": "2012-10-17", &lt;a&gt;Statement&lt;/a&gt; &lt;a&gt;Effect&lt;/a&gt;"Allow", &lt;a&gt;Action&lt;/a&gt;"cloudwatch:GetMetricStatistics","cloudwatch:ListMetrics"], &lt;a&gt;Resource&lt;/a&gt;"*", &lt;a&gt;Condition&lt;/a&gt; &lt;a&gt;Bool&lt;/a&gt; &lt;a&gt;aws:SecureTransport&lt;/a&gt;"true" } } } ]&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;This sample policy has one statement that grants permissions to a group for two CloudWatch actions (cloudwatch:GetMetricStatistics, and cloudwatch:ListMetrics), but only if the group uses SSL with the request (&lt;a&gt;aws:SecureTransport&lt;/a&gt;"true").&lt;/p&gt; 
-&lt;p&gt;For further information please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Overview of Managing Access Permissions to Your CloudWatch Resources" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-access-control-overview-cw.html"/>
-            <reference name="Sharing CloudWatch Dashboards" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-identity-based-access-control-cw.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.270">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.1" name="Create a SNS topic for sending out notifications from Cloudtwatch Alarms" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  For the Cloudwatch alarms and Auto-Scaling Groups to be able to send out notifications, a SNS topic should be created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  When using Amazon SNS, you (as the owner) create a topic and control access to it by defining policies that determine which publishers and subscribers can communicate with the topic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Cloudwatch alarms and certain actions inside Auto-Scaling Groups needs to be sent out to administrators, in order to be acted upon. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a new topic, and note the topic-arn value:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a subscription to the new topic:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: sns get topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/get-topic-attributes.html"/>
-            <reference name="Amazon docs: sns list subscriptions by topic" url="https://docs.aws.amazon.com/cli/latest/reference/sns/list-subscriptions-by-topic.html"/>
-            <reference name="Amazon docs: sns set topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/create-topic.html"/>
-            <reference name="Amazon docs: sns subscribe" url="https://docs.aws.amazon.com/cli/latest/reference/sns/subscribe.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all cloudwatch alarms and filter by alarm action (review &amp;quot;AlarmActions&amp;quot;: []):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch describe-alarms --query 'MetricAlarms[*].{AlarmName:AlarmName, AlarmActions:AlarmActions, Dimensions:Dimensions}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List SNS topic attributes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns list-topic-attributes --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List SNS topic subscriptions (endpoint which receives messages captured by the SNS topic):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.328">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH4" name="Create CloudWatch Alarms based on Anomaly Detection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create CloudWatch Alarms based on Anomaly Detection&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; When you enable anomaly detection for a metric, CloudWatch applies statistical and machine learning algorithms. These algorithms continuously analyze metrics of systems and applications, determine normal baselines, and surface anomalies with minimal user intervention.&lt;br&gt; You can create an alarm based on CloudWatch anomaly detection, which mines past metric data and creates a model of expected values. The expected values take into account the typical hourly, daily, and weekly patterns in the metric.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alarm based on anomaly detection&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Alarms, Create Alarm.&lt;/p&gt; 
-&lt;p&gt;3. Choose Select Metric and do one of the following:&lt;/p&gt; 
-&lt;p&gt;- Choose the service namespace that contains the metric that you want. To narrow the choices, continue choosing options as they appear. When a list of metrics appears, select the check box next to the metric that you want.&lt;/p&gt; 
-&lt;p&gt;- In the search box, enter the name of a metric, dimension, or resource ID and press Enter. Then choose one of the results and continue until a list of metrics appears. Select the check box next to the metric that you want.&lt;/p&gt; 
-&lt;p&gt;4. Choose the Graphed metrics tab.&lt;/p&gt; 
-&lt;p&gt;a. Under Statistic , choose one of the statistics or predefined percentiles, or specify a custom percentile (for example, p95.45).&lt;/p&gt; 
-&lt;p&gt;b. Under Period, choose the evaluation period for the alarm. When evaluating the alarm, each period is aggregated into one data point. For anomaly detection alarms, the value must be one minute or longer.&lt;/p&gt; 
-&lt;p&gt;You can also choose whether the y-axis legend appears on the left or right while you're creating the alarm. This preference is used only while you're creating the alarm.&lt;/p&gt; 
-&lt;p&gt;c. Choose Select metric.&lt;/p&gt; 
-&lt;p&gt;The Specify metric and conditions page appears, showing a graph and other information about the metric and statistic you have selected.&lt;/p&gt; 
-&lt;p&gt;5. Under Conditions, specify the following:&lt;/p&gt; 
-&lt;p&gt;a. Choose Anomaly detection.&lt;/p&gt; 
-&lt;p&gt;If the model for this metric and statistic already exists, CloudWatch displays the anomaly detection band in the sample graph at the top of the screen. If the model does not already exist, the model will be generated when you finish creating the alarm. It takes up to 15 minutes for the actual anomaly detection band generated by the model to appear in the graph. Before that, the band you see is an approximation of the anomaly detection band. To see the graph in a longer time frame, choose Edit at the top right of the page.&lt;/p&gt; 
-&lt;p&gt;b. For Whenever metric is, specify whether the metric must be greater than, lower than, or outside (in either direction) the band to trigger the alarm.&lt;/p&gt; 
-&lt;p&gt;c. For Anomaly detection threshold, choose the number to use for the anomaly detection threshold. A higher number creates a thicker band of "normal" values that is more tolerant of metric changes, and a lower number creates a thinner band that will go to ALARM state with smaller metric deviations. The number does not have to be a whole number.&lt;/p&gt; 
-&lt;p&gt;d. Choose Additional configuration. For Datapoints to alarm, specify how many evaluation periods (data points) must be in the ALARM state to trigger the alarm. If the two values here match, you create an alarm that goes to ALARM state if that many consecutive periods are breaching.&lt;/p&gt; 
-&lt;p&gt;To create an M out of N alarm, specify a lower number for the first value than you specify for the second value. For more information, see Evaluating an Alarm.&lt;/p&gt; 
-&lt;p&gt;e. For Missing data treatment, choose how to have the alarm behave when some data points are missing. For more information, see Configuring How CloudWatch Alarms Treat Missing Data.&lt;/p&gt; 
-&lt;p&gt;f. If the alarm uses a percentile as the monitored statistic, a Percentiles with low samples box appears. Use it to choose whether to evaluate or ignore cases with low sample rates. If you choose ignore (maintain alarm state), the current alarm state is always maintained when the sample size is too low. For more information, see Percentile-Based CloudWatch Alarms and Low Data Samples.&lt;/p&gt; 
-&lt;p&gt;6. Choose Next.&lt;/p&gt; 
-&lt;p&gt;7. Under Notification, select an SNS topic to notify when the alarm is in ALARM state, OK state, or INSUFFICIENT_DATA state.&lt;/p&gt; 
-&lt;p&gt;To have the alarm send multiple notifications for the same alarm state or for different alarm states, choose Add notification.&lt;/p&gt; 
-&lt;p&gt;To have the alarm not send notifications, choose Remove.&lt;/p&gt; 
-&lt;p&gt;8. To have the alarm perform EC2 actions when it changes state or create a Systems Manager OpsItem when it goes into ALARM state, choose the appropriate button and choose the alarm state and action to perform.&lt;/p&gt; 
-&lt;p&gt;9. When finished, choose Next.&lt;/p&gt; 
-&lt;p&gt;10. Enter a name and description for the alarm. The name must contain only ASCII characters. Then choose Next.&lt;/p&gt; 
-&lt;p&gt;11. Under Preview and create, confirm that the information and conditions are what you want, then choose Create alarm.&lt;/p&gt; 
-&lt;p&gt;Modifying an Anomaly Detection Model&lt;/p&gt; 
-&lt;p&gt;Once you have created an alarm, you can adjust the anomaly detection model. You can exclude certain time periods from being used in the model creation. It is critical that you exclude unusual events such as system outages, deployments, and holidays from the training data. You can also specify whether to adjust the model for daylight savings time changes.&lt;/p&gt; 
-&lt;p&gt;To adjust the anomaly detection model for an alarm&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Alarms.&lt;/p&gt; 
-&lt;p&gt;3. Choose the name of the alarm. Use the search box to find the alarm if necessary.&lt;/p&gt; 
-&lt;p&gt;4. Choose View in metrics.&lt;/p&gt; 
-&lt;p&gt;5. In the lower part of the screen, choose Edit model.&lt;/p&gt; 
-&lt;p&gt;6. To exclude a time period from being used to produce the model, choose Add another time range to exclude from training. Then select or enter the days and times to exclude from training, and choose Apply.&lt;/p&gt; 
-&lt;p&gt;7. If the metric is sensitive to daylight savings time changes, select the appropriate time zone in the Metric timezone box.&lt;/p&gt; 
-&lt;p&gt;8. Choose Update.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Using anomaly detection models for alarms incurs charges on your AWS account.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Creating a CloudWatch Alarm Based on Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Anomaly_Detection_Alarm.html"/>
-            <reference name="Using CloudWatch Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have created Anomaly Detection alarms properly.&lt;/p&gt;
-
-	&lt;p&gt;After you create a model, it constantly updates itself, using the latest data from the metric.&lt;/p&gt;
-
-	&lt;p&gt;After you enable anomaly detection on a metric, you can choose to exclude specified time periods of the metric from being used to train the model. This way, you can exclude deployments or other unusual events from being used for model training, ensuring the most accurate model is created.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH2" name="Follow the security best practices for CloudWatch Synthetics Canaries" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Follow the security best practices for CloudWatch Synthetics Canaries&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries follow the same routes and perform the same actions as a customer, which makes it possible for you to continually verify your customer experience even when you don't have any customer traffic on your applications.&lt;br&gt; However, there are several security issues that you should consider when creating and running canaries in Synthetics. AWS recommends to follow the undermentioned security best practices.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following sections explain security issues that you should consider when creating and running canaries in Synthetics.&lt;/p&gt; 
-&lt;p&gt;Use Secure Connections&lt;/p&gt; 
-&lt;p&gt;Because canary code and the results from canary test runs can contain sensitive information, do not have your canary connect to endpoints over unencrypted connections. Always use encrypted connections, such as those that begin with https://.&lt;/p&gt; 
-&lt;p&gt;Canary Naming Considerations&lt;/p&gt; 
-&lt;p&gt;The Amazon Resource Name (ARN) of a canary is included in the user-agent header as a part of outbound calls made from the Puppeteer-driven Chromium browser that is included as a part of the CloudWatch Synthetics wrapper library. This helps identify CloudWatch Synthetics canary traffic and relate it back to the canaries that are making calls.&lt;/p&gt; 
-&lt;p&gt;The canary ARN includes the canary name. Choose canary names that do not reveal proprietary information.&lt;/p&gt; 
-&lt;p&gt;Additionally, be sure to point your canaries only at websites and endpoints that you control.&lt;/p&gt; 
-&lt;p&gt;Secrets in Canary Code&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you don't include secrets, such as access keys or database credentials, in your canary source code.&lt;/p&gt; 
-&lt;p&gt;Permissions Considerations&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you restrict access to resources that are created or used by CloudWatch Synthetics. Use tight permissions on the Amazon S3 buckets where canaries store test run results and other artifacts, such as logs and screenshots.&lt;/p&gt; 
-&lt;p&gt;Similarly, keep tight permissions on the locations where your canary source code is stored, so that no user accidentally or maliciously deletes the Lambda layers or Lambda functions used for the canary.&lt;/p&gt; 
-&lt;p&gt;To help make sure you run the canary code you intend, you can use object versioning on the Amazon S3 bucket where your canary code is stored. Then when you specify this code to run as a canary, you can include the object versionId as part of the path, as in the following examples:&lt;/p&gt; 
-&lt;p&gt;https://bucket.s3.amazonaws.com/path/object.zip?versionId=version-id&lt;br&gt; https://s3.amazonaws.com/bucket/path/object.zip?versionId=version-id&lt;br&gt; https://bucket.s3-region.amazonaws.com/path/object.zip?versionId=version-id&lt;/p&gt; 
-&lt;p&gt;Stack Traces and Exception Messages&lt;/p&gt; 
-&lt;p&gt;By default, CloudWatch Synthetics canaries capture any exception thrown by your canary script, no matter whether the script is custom or is from a blueprint. CloudWatch Synthetics logs both the exception message and the stack trace to three locations:&lt;/p&gt; 
-&lt;p&gt;- Back into the CloudWatch Synthetics service to speed up debugging when you describe test runs&lt;/p&gt; 
-&lt;p&gt;- Into CloudWatch Logs according to the configuration that your Lambda functions are created with&lt;/p&gt; 
-&lt;p&gt;- Into the Synthetics log file, which is a plaintext file that is uploaded to the Amazon S3 location specified by the value you set for the resultsLocation of the canary&lt;/p&gt; 
-&lt;p&gt;If you want to send and store less information, you can capture exceptions before they return to the CloudWatch Synthetics wrapper library.&lt;/p&gt; 
-&lt;p&gt;Scope Your IAM Roles Narrowly&lt;/p&gt; 
-&lt;p&gt;AWS recommends that you do not configure your canary to visit potentially malicious URLs or endpoints. Pointing your Canary to untrusted or unknown websites or endpoints could expose your Lambda function code to malicious user's scripts. Assuming a malicious website can break out of Chromium, it could have access to your Lambda code in a similar way to if you connected to it using an internet browser.&lt;/p&gt; 
-&lt;p&gt;Run your Lambda function with an IAM execution role that has scoped-down permissions. This way, if your Lambda function is compromised by a malicious script, it is limited in the actions it can take when running as your canary's AWS account.&lt;/p&gt; 
-&lt;p&gt;When you use the CloudWatch console to create a canary, it is created with a scoped-down IAM execution role.&lt;/p&gt; 
-&lt;p&gt;Header Logging&lt;/p&gt; 
-&lt;p&gt;By default, canary header logging logs only the request URL, response code, and response status. Within your canary script, you can customize the logging to log more or less information.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Considerations for Synthetics Canaries" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/servicelens_canaries_security.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are following security best practices for CloudWatch Synthetics Canaries.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.279">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.355">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH6" name="Use CloudWatch Agent to collect system-level metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use CloudWatch Agent to collect system-level metrics&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The unified CloudWatch agent enables you to do the following:&lt;/p&gt; 
-&lt;p&gt;- Collect internal system-level metrics from Amazon EC2 instances across operating systems. The metrics can include in-guest metrics, in addition to the metrics for EC2 instances. The additional metrics that can be collected are listed in Metrics Collected by the CloudWatch Agent.&lt;/p&gt; 
-&lt;p&gt;- Collect system-level metrics from on-premises servers. These can include servers in a hybrid environment as well as servers not managed by AWS.&lt;/p&gt; 
-&lt;p&gt;- Retrieve custom metrics from your applications or services using the StatsD and collectd protocols. StatsD is supported on both Linux servers and servers running Windows Server. collectd is supported only on Linux servers.&lt;/p&gt; 
-&lt;p&gt;- Collect logs from Amazon EC2 instances and on-premises servers, running either Linux or Windows Server.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Installation Process Overview&lt;/p&gt; 
-&lt;p&gt;You can download and install the CloudWatch agent manually using the command line, or you can integrate it with SSM. The general flow of installing the CloudWatch agent using either method is as follows:&lt;/p&gt; 
-&lt;p&gt;1. Create IAM roles or users that enable the agent to collect metrics from the server and optionally to integrate with AWS Systems Manager.&lt;/p&gt; 
-&lt;p&gt;2. Download the agent package.&lt;/p&gt; 
-&lt;p&gt;3. Modify the CloudWatch agent configuration file and specify the metrics that you want to collect.&lt;/p&gt; 
-&lt;p&gt;4. Install and start the agent on your servers. As you install the agent on an EC2 instance, you attach the IAM role that you created in step 1. As you install the agent on an on-premises server, you specify a named profile that contains the credentials of the IAM user that you created in step 1.&lt;/p&gt; 
-&lt;p&gt;For further information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Please follow Reference URL to check for Supported Operating Systems.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Collecting Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify That the CloudWatch Agent Is Running&lt;/p&gt;
-
-	&lt;p&gt;You can query the CloudWatch agent to find whether it's running or stopped. You can use AWS Systems Manager to do this remotely. You can also use the command line, but only to check the local server.&lt;/p&gt;
-
-	&lt;p&gt;To query the status of the CloudWatch agent using Run Command&lt;/p&gt;
-
-	&lt;p&gt;1. Open the Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Run Command.&lt;/p&gt;
-
-	&lt;p&gt;&lt;del&gt;or&lt;/del&gt;&lt;/p&gt;
-
-	&lt;p&gt;If the AWS Systems Manager home page opens, scroll down and choose Explore Run Command.&lt;/p&gt;
-
-	&lt;p&gt;3. Choose Run command.&lt;/p&gt;
-
-	&lt;p&gt;4. In the Command document list, choose the button next to AmazonCloudWatch-ManageAgent.&lt;/p&gt;
-
-	&lt;p&gt;5. In the Action list, choose status.&lt;/p&gt;
-
-	&lt;p&gt;6. For Optional Configuration Source choose default and keep Optional Configuration Location blank.&lt;/p&gt;
-
-	&lt;p&gt;7. In the Target area, choose the instance to check.&lt;/p&gt;
-
-	&lt;p&gt;8. Choose Run.&lt;/p&gt;
-
-	&lt;p&gt;If the agent is running, the output resembles the following.&lt;/p&gt;
-
-	&lt;p&gt;{
-       "status": "running",
-       "starttime": "2017-12-12T18:41:18",
-       "version": "1.73.4"&lt;br /&gt;
-}&lt;/p&gt;
-
-	&lt;p&gt;If the agent is stopped, the "status" field displays "stopped".&lt;/p&gt;
-
-
-	&lt;p&gt;To query the status of the CloudWatch agent locally using the command line&lt;/p&gt;
-
-	&lt;p&gt;- On a Linux server, enter the following:&lt;/p&gt;
-
-	&lt;p&gt;sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status&lt;/p&gt;
-
-	&lt;p&gt;- On a server running Windows Server, enter the following in PowerShell as an administrator:&lt;/p&gt;
-
-	&lt;p&gt;&amp;amp; $Env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1 -m ec2 -a status&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.303">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDWATCH5" name="Use CloudWatch metric streams" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use CloudWatch metric streams&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use metric streams to continually stream CloudWatch metrics to a destination of your choice, with near-real-time delivery and low latency. Supported destinations include AWS destinations such as Amazon Simple Storage Service and several third-party service provider destinations.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to use the CloudWatch console to set up a metric stream to another AWS service&lt;/p&gt; 
-&lt;p&gt;When you use the console to set up a metric stream, you have the option of choosing the Quick S3 Setup. This method works well if want the final output as JSON or to be queried by Amazon Athena. If you want the final format to be Parquet format or Optimized Row Columnar (ORC), you should create your own Kinesis Data Firehose delivery stream and choose Select an existing Firehose owned by your account instead of choosing Quick S3 Setup.&lt;/p&gt; 
-&lt;p&gt;To set up a metric stream to an AWS service&lt;/p&gt; 
-&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
-&lt;p&gt;2. In the navigation pane, choose Streams, Create stream.&lt;/p&gt; 
-&lt;p&gt;3. Choose the CloudWatch metric namespaces to include in the metric stream.&lt;/p&gt; 
-&lt;p&gt;- To include all or most of your metric namespaces in the metric stream, choose All metrics.&lt;/p&gt; 
-&lt;p&gt;Then, if you want to exclude some metric namespaces from the stream, choose Exclude metric namespaces and select the namespaces to exclude.&lt;/p&gt; 
-&lt;p&gt;- To include only a few metric namespaces in the metric stream, choose Selected namespaces and then select the namespaces to include.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt; 
-&lt;p&gt;4. Choose one of the following:&lt;/p&gt; 
-&lt;p&gt;- For a quick setup, choose Quick S3 setup. CloudWatch will create all necessary resources including the Kinesis Data Firehose delivery stream and the necessary IAM roles. The default format for this option is JSON, but you can change the format later in this procedure.&lt;/p&gt; 
-&lt;p&gt;- To use a Kinesis Data Firehose delivery stream that already exists, choose Select an existing Firehose owned by your account. The Kinesis Data Firehose delivery stream must be in the same account. The default format for this option is OpenTelemetry, but you can change the format later in this procedure.&lt;/p&gt; 
-&lt;p&gt;Then select the Kinesis Data Firehose delivery stream to use under Select your Kinesis Data Firehose delivery stream.&lt;/p&gt; 
-&lt;p&gt;5. (Optional) If you're using Quick S3 Setup, you can choose Select existing resources to use an existing S3 bucket or existing IAM roles instead of having CloudWatch create new ones for you.&lt;/p&gt; 
-&lt;p&gt;6. (Optional) If you're using Select an existing Firehose owned by your account, you can choose Select existing service role to use an existing IAM role instead of having CloudWatch create a new one for you.&lt;/p&gt; 
-&lt;p&gt;7. (Optional) To change the output format from the default format for your scenario, choose Change output format. The supported formats are JSON and OpenTelemetry 0.7.0.&lt;/p&gt; 
-&lt;p&gt;8. (Optional) Customize the name of the new metric stream under Metric stream name.&lt;/p&gt; 
-&lt;p&gt;9. Choose Create metric stream.&lt;/p&gt; 
-&lt;p&gt;Setting up a metric stream to a third-party solution&lt;/p&gt; 
-&lt;p&gt;To set up a CloudWatch metric stream to stream metrics to a third-party solution, follow the instructions provided by that third-party provider.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Metric stream operation and maintenance" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-operation.html"/>
-            <reference name="Using metric streams" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metric-Streams.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Metric streams are always in one of two states, Running or Stopped.&lt;/p&gt;
-
-	&lt;p&gt;Running - The metric stream is running correctly. There might not be any metric data streamed to the destination because of the filters on the stream.&lt;/p&gt;
-
-	&lt;p&gt;Stopped - The metric stream has been explicitly stopped by someone, and not because of an error. It might be useful to stop your stream to temporarily pause the streaming of data without deleting the stream.&lt;/p&gt;
-
-	&lt;p&gt;If you stop and restart a metric stream, the metric data that was published to CloudWatch while the metric stream was stopped is not backfilled to the metric stream.&lt;/p&gt;
-
-	&lt;p&gt;If you change the output format of a metric stream, in certain cases you might see a small amount of metric data written to the destination in both the old format and the new format. To avoid this situation, you can create a new Kinesis Data Firehose delivery stream with the same configuration as your current one, then change to the new Kinesis Data Firehose delivery stream and change the output format at the same time. This way, the Kinesis records with different output format are stored on Amazon S3 in separate objects. Later, you can direct the traffic back to the original Kinesis Data Firehose delivery stream and delete the second delivery stream.&lt;/p&gt;
-
-	&lt;p&gt;To view, edit, stop, and start your metric streams&lt;/p&gt;
-
-	&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, choose Streams.&lt;/p&gt;
-
-	&lt;p&gt;The list of streams appears, and the Status column displays whether each stream is running or stopped.&lt;/p&gt;
-
-	&lt;p&gt;3. To stop or start a metric stream, select the stream and choose Stop or Start.&lt;/p&gt;
-
-	&lt;p&gt;4. To see the details about a metric stream, select the stream and choose View details.&lt;/p&gt;
-
-	&lt;p&gt;5. To change the stream's output format, filters, destination Kinesis Data Firehose stream, or roles, choose Edit and make the changes that you want.&lt;/p&gt;
-
-	&lt;p&gt;If you change the filters, there might be some gaps in the metric data during the transition.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.316">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
-                    <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
-                    <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
-                    <countermeasure ref="aws-tier-4.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
-                <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
-                <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
-                <countermeasure ref="aws-tier-4.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
-                    <countermeasure ref="AWS-VPC5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
-                <countermeasure ref="AWS-VPC5" mitigation="34"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="bf5398d4-336a-4832-bfe2-db51e7e9e20c" diagramComponentId="a7371359-5908-45b4-85a8-1621e50f8dcd" ref="cb3c3a00-6887-4025-a440-4c5298fb2b0d" name="AWS API Gateway" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="api-gateway">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.413">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.927">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of a command using
-                    externally-influenced input from an upstream component, but it does not
-                    neutralize or incorrectly neutralizes special elements that could modify the
-                    intended command when it is sent to a downstream
-                    component.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.415">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.716">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Choose a minimum TLS version for a custom domain in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create a custom domain, you specify the security policy for it. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control and manage access to a REST API in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use the following mechanisms for authentication and authorization: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. IAM tags can be used together with IAM policies to control access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for API endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-              <reference name="Routing traffic to an Amazon API Gateway API by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a REST API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Do one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create an API and deploy it to a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Logs/Tracing in the Stage Editor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable execution logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable CloudWatch Logs under CloudWatch Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Error or Info from the dropdown menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If desired, choose Enable Detailed CloudWatch Metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable access logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable Access Logging under Custom Access Logging. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable execution logging and access logging independent of each other. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test your logging setup&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
-              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Monitor REST API execution with Amazon CloudWatch metrics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can access CloudWatch using any of the following methods: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon CloudWatch console 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS CLI&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  CloudWatch API 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose the name of the API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Under the selected API, choose Dashboard. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Use From and To to enter the date range. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable payload compression by using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API or create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Another way is to use AWS CLI to create a new API and enable compression. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose a REST API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. In the Resources pane, choose the method you want to test. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For additional options you may need to specify, contact the API owner. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Choose Test. The following information will be displayed: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
-   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
-   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
-   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
-   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
-   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If you choose to enable caching for a REST API, you can enable cache encryption. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To configure API caching for individual methods using the console: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Go to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stages list for the API, expand the stage and choose a method in the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Override for this method in Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable request validation in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Enable request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test basic request validation using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following steps describe how to test basic request validation in the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test the request validation on a method using TestInvoke in the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  While signed in to the API Gateway console, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Resources for the API that you've configured a request validators map for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a method for which you have enabled the request validation with a specified request validator. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Method Execution, in the Client box, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Invalid request body" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the request parameters aren't valid, the following error message returns: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.725">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content-Type: application/json 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: apigateway.us-east-1.amazonaws.com 
-&lt;/div&gt; 
-&lt;div&gt;
-  X-Amz-Date: 20170603T200400Z 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authorization: AWS4-HMAC-SHA256 Credential=... 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "patchOperations" : [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; } 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; ] 
-&lt;/div&gt; 
-&lt;div&gt;
-  }&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of update-stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to remove the old certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of delete-client-certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate in the console for a previously deployed API, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the main navigation pane, choose Client Certificates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Client Certificates pane, choose Generate Client Certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the API for which you want to use the client certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages under the selected API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To save the settings, choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need to redeploy the API for the changes to take effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up a stage for a REST API 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a new stage 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the APIs navigation pane, choose Stages under an API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Stages navigation pane, choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Optionally, enter a stage description for Stage description. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To see your Stages follow the steps below: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the APIs pane, choose the API, and then choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the Stages pane, choose the name of the stage. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.249">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can do this by: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
-  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose an API method. In Client, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. From Client Certificate, choose Test to invoke the method request. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-              <reference name="Test invoke to verify the client certificate configuration" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.245">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-77">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="45e29082-ac55-486b-91c5-96cf1cf7e024" diagramComponentId="c1a1276f-411a-4aeb-818c-a4b605112c51" ref="88ead499-6db6-4ecb-96d9-363b587ed0d5" name="AWS Account Environment" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-Logging-3.3" name="Audit logs are accesible" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The audit logs are not encrypted and they can be accessed by attackers and obtain sensitive data
-                        in clear text.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.5" name="Brute force attempts on the Amazon management console cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>The failure connection attempts (brute force) must be audited and monitored and the
-                        correspondent personnel must be alerted and informed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.12" name="Changes in the network configuration cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The changes in the network configurations (NACLs, route and gateway tables) are not detected
-                        because the monitorization and alerts of the network configuration are not configured to detect
-                        these changes.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.4" name="Changes in the security configurations can be not detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Monitoring and alerting for security configurations are not configured and changes cannot be
-                        detected.&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.10" name="Changes in the security groups cannot be detected" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes in the security groups must be audited and monitored and the correspondent
-                        personnel must approve these changes. If the situation is not the correct, attackers can access
-                        to security systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="cloudwatch-misconfig" name="Cloudwatch is misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T13:52:40.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Monitoring-4.3" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login to the console without using the Multi-factor Authentication (MFA) and they are not
-                        detected. The connection without the MFA must be audited and monitored, the correct security
-                        group must be informed and they must validate this connection.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:15.193">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.1" name="Non-auditable API calls in all regions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The API call to the resources is not audited and the actions are not recorded into the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.8" name="Non-centrality audit logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The audit logs are not stored in a central system. Therefore, the audit logs cannot be
-                        exploited correctly by the security personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator account is not configured. The security question to recover or reset the
-                        password and the authentication method are not configured.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:26.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-1.21" name="The access keys are generated when the setup of the users is started" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The system doesn't require additional steps to create access keys, the access keys are
-                        generating when the process to create an user is starting. The problem is that these keys can be
-                        in use somewhere in the organization and maybe these keys are not necessary for the user.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Being highly selective in peering routing tables is a very effective way of minimizing the
-                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EXPIRATION-DATE" name="The password expiration is not established" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.9" name="The security policies are exposed in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not configured and the security configurations are exposed for the
-                        attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.7" name="Unaudited connections with the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The connections with the applications and with the databases cannot be audited and not
-                        detected.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.9" name="Unaudited resources changes" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes in the applications and in the databases and these changes are not detected and
-                        not audited.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.685">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.12" name="Apply an AWS Managed Config Rule for EIPs attached to EC2 instances within VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources. You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Description": "Checks whether all EIP addresses allocated to a VPC are attached to 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    EC2 instances or in-use ENIs.", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "ConfigRuleName": "eip-attached", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Source": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Owner": "AWS", 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "SourceIdentifier": "EIP_ATTACHED" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    }, 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "Scope": { 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "ComplianceResourceTypes": [ 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    "AWS::EC2::EIP" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    ] 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    } 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    } 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe config rules" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"/>
-            <reference name="Put config rule" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/put-config-rule.html"/>
-            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
-          </references>
-          <standards>
-            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for a Config Rule that checks whether all EIP addresses allocated to a VPC are attached to EC2 instances or in-use ENIs:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'EIP_ATTACHED']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:48:26.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.3-2.4" name="Apply an IAM Role for Amazon EC2 Tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      { 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Version": "2012-10-17", 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Statement": [ 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Effect": "Allow", 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Principal": { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        "Service": "ec2.amazonaws.com" 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       }, 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Action": "sts:AssumeRole" 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      ] 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      } 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
-            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
-            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
-            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-          </references>
-          <standards>
-            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all the Web tier EC2 instances, check if and which IAM instance profile they have attached, and note the name of the instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-instances --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Reservations[*].Instances[*].{IamInstanceProfile:IamInstanceProfile, InstanceId:InstanceId}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:47:29.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.1-2.2" name="Apply IAM Policy for EC2 IAM Roles for tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles defined with AWS Identity Access Management. An IAM policy is a document that formally states one or more permissions using the following structure:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Actions: what actions are allowed (each AWS service has its own set of actions)&lt;/li&gt; 
-  &lt;li&gt;Resources: which resources will be affected by the action&lt;/li&gt; 
-  &lt;li&gt;Effect: what effect will be when the subject (user/group/roles) requests access Policies are documents that are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;b&gt;Remediation&lt;/b&gt;: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    *Note: references to Web tier are also applicable to App tier 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    Using the Amazon unified command line interface: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      { 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Version": "2012-10-17", 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      "Statement": [ 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Effect": "Allow", 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Principal": { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        "Service": "ec2.amazonaws.com" 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       }, 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       "Action": "sts:AssumeRole" 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      ] 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If doesn't exist, create an IAM managed policy for Web tier instances, and note the policy ARN:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam create-policy --policy-name &amp;lt;iam_policy_name&amp;gt; --policy-document file://policy 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the IAM policy created to the Web tier IAM role:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --rolename &amp;lt;web_tier_iam_role&amp;gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
-            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
-            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
-            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
-            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
-            <reference name="Get policy version" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html"/>
-            <reference name="List attached role policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-role-policies.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check managed policies attached to the IAM role, and note the policies ARN:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-attached-role-policies --role-name &amp;lt;web_tier_iam_role&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the version of the IAM policies attached to the IAM role:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --query "Policy.DefaultVersionId" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the document policy:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy-version --policy-arn &amp;lt;iam_policy_arn&amp;gt; --version-id &amp;lt;iam_policy_version&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:34:12.746">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Click on Users.&lt;/li&gt; 
-  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Select the user.&lt;/li&gt; 
-   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ol&gt;Create a Group and add a user: 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
-  &lt;li&gt;Click Create Group.&lt;/li&gt; 
-  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
-  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
-                            --output text&lt;/li&gt;
-                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-attached-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws iam list-user-policies --user-name user
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
-  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
-  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
-  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
-  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
-  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
-  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
-                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
-                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
-                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
-                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
-                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
-                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
-                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
-                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
-                            ALLOW.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.703">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.5-2.6" name="Configure AutoScaling Group Launch Configuration for Tier to use a customer created IAM Role" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  *Note: references to Web tier are also applicable to App tier. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration for the Web tier using the Web tier IAM instance profile :&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
-          </references>
-          <standards>
-            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if your Web tier autoscaling group is using a launch configuration with an IAM instance profile configured:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query "LaunchConfigurations[*].IamInstanceProfile" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:55:23.427">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM1" name="Configure contact email and telephone details on AWS accounts" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.&lt;/p&gt;&lt;p&gt;An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, next to Account Settings, choose Edit.&lt;/li&gt;&lt;li&gt;Next to the field that you need to update, choose Edit.&lt;/li&gt;&lt;li&gt;After you have entered your changes, choose Save changes.&lt;/li&gt;&lt;li&gt;After you have made your changes, choose Done.&lt;/li&gt;&lt;li&gt;To edit your contact information, under Contact Information, choose Edit.&lt;/li&gt;&lt;li&gt;For the fields that you want to change, type your updated information, and then choose Update.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, review and verify the current details.&lt;/li&gt;&lt;li&gt;Under Contact Information, review and verify the current details.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.232">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.11" name="Configure password expiration" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Change access keys regularly, and make sure that all IAM users in your account do as well. That way, if an access key is compromised without your knowledge, you limit how long the credentials can be used to access your resources. Credential reports can be used to determine how long access keys have been active for. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Click on Users.&lt;/li&gt; 
-  &lt;li&gt;Select the user you wish to rotate the key for.&lt;/li&gt; 
-  &lt;li&gt;Under access keys click &amp;quot;Create Access Key&amp;quot; (do not touch the existing key yet).&lt;/li&gt; 
-  &lt;li&gt;Click &amp;quot;Download credentials&amp;quot; or &amp;quot;Show credentials&amp;quot; so that you have a record of them.&lt;/li&gt; 
-  &lt;li&gt;Update any applications with the new credentials and test (we recommend to leave a few days or a week for testing).&lt;/li&gt; 
-  &lt;li&gt;Once complete complete 1-4 above and for the key which needs rotating click &amp;quot;Make Inactive | Delete&amp;quot; and click &amp;quot;Deactive&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Once you are confident you will no longer need the key (wait several more days) repeat 1-4 and select &amp;quot;Delete&amp;quot; for the inactive key.&lt;/li&gt; 
- &lt;/ol&gt; 
-  &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Check the access keys created time: aws iam get-credential-report --query
-                            'Content' --output text | base64 -D | awk -F, '{print $1,$9,$10,$14,$15}'&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each access_key_1_active and access_key_9_active that is set to True ensure
-                            the created date is within the last 90 days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Gov-1.1" name="Configure the security challenge questions within the AWS Account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When an AWS account is initially created it is configured with a top level account known as the &amp;quot;root&amp;quot; account that has full administration access to all resources. In the event that the password or MFA device associated with this account is lost AWS support may recover it by asking you to answer the security questions. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
-  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Click on Edit.&lt;/li&gt; 
-  &lt;li&gt;For each question:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Select an appropriate question.&lt;/li&gt; 
-   &lt;li&gt;Enter an appropriate answer.&lt;/li&gt; 
-   &lt;li&gt;Follow the above process for all 3 questions.&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;Click Update when complete.&lt;/li&gt; 
-  &lt;li&gt;We recommend to store the questions and answers in a secure location such as a safe where they can be used in case recovery is required.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
-                            &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Confirm whether questions and answers have been saved.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.7" name="Create a Cloudwatch Alarm and its action for the &quot;VPC Flow Logs&quot; metric filter" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;div&gt;
-   A Cloudwatch alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The Cloudwatch Alarm will trigger a notification being sent to the administrators every time the "REJECT packets" specified threshold is reached. The alarm should be created for the "VPC Flow Logs" metric, and the action should have a SNS topic configured.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a Cloudwatch alarm for the VPC Flow Logs metric, and configure an Alarm Action:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws cloudwatch put-metric-alarm --alarm-name &amp;lt;vpc_flow_log_alarm_name&amp;gt; --alarm-actions &amp;lt;sns_topic_arn&amp;gt; --metric-name &amp;lt;vpc_flow_log_metric_name&amp;gt; --namespace LogMetrics --statistic &amp;lt;desired_statistic&amp;gt; --period &amp;lt;desired_period&amp;gt; --evaluation-periods &amp;lt;desired_evaluation_periods&amp;gt; --threshold &amp;lt;desired_threshold&amp;gt; --comparison-operator &amp;lt;desired_operator&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe alarms" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"/>
-            <reference name="Put metric alarm" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html"/>
-          </references>
-          <standards>
-            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all the Cloudwatch alarms configured for the VPC Flow Logs metric, and check if an Alarm Action is configured:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch describe-alarms --query "MetricAlarms[?MetricName =='&amp;lt;vpc_flow_log_metric_name&amp;gt;'].{MetricName:MetricName,AlarmActions:AlarmActions,AlarmName:AlarmName}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:51:42.064">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.6" name="Create a log metric filter for the Cloudwatch group assigned to the &quot;VPC Flow Logs&quot;" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Description:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  This recommendation builds upon the Foundation benchmark recommendation: "Ensure VPC Flow Logging is Enabled in all Applicable Regions"&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  VPC flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. VPC flow logs can capture accepted traffic, rejected traffic, or all traffic.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Metric filters can be used to express how the service would extract metric observations from ingested events and transform them to data points in a CloudWatch metric. Metric filters are assigned to log groups, and all of the filters assigned to a log group are applied to their log streams.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A metric filter should be created for counting how many IP packets are rejected in the VPC flow logs.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a metric filter for the Cloudwatch Log group assigned to the "VPC Flow Logs":&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs put-metric-filter --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; --filter-name &amp;lt;vpc_flow_log_filter_name&amp;gt; --filter-pattern "{ $.errorCode =\"AccessDenied\" }" --metric-transformations metricName= &amp;lt;vpc_flow_log_metric_name&amp;gt;,metricNamespace=LogMetrics,metricValue=1 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"/>
-            <reference name="Filter log events" url="https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html"/>
-            <reference name="Put metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html"/>
-          </references>
-          <standards>
-            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface to check if the log metric filter: 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws logs describe-metric-filters --region &amp;lt;application_region&amp;gt; --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:48:32.261">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.7" name="Create an IAM group for administration purposes" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;: 
-&lt;div&gt; 
- &lt;br&gt; 
-  An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and should have administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a new IAM group for administration purposes:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam create-group --group-name &amp;lt;iam_admin_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attach the Admin policy to the administration IAM group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam attach-group-policy --policy-arn &amp;lt;admin_policy_arn&amp;gt; --group-name &amp;lt;iam_admin_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Impact&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The name of the IAM admin group name should be known prior to auditing this recommendation. For a sample admin policy arn see recommendation 2.1. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Attach group policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-group-policy.html"/>
-            <reference name="Create groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-group.html"/>
-            <reference name="List groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the IAM groups created for administration purposes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-groups --query "Groups[?GroupName == '&amp;lt;iam_admin_group_name&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:59:51.981">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-2.8" name="Create an IAM policy that allows admin privileges for all services used" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A policy is a document that formally states one or more permissions.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies apply only to identities (users, groups, and roles) - not resources. You must ensure that you have an IAM managed policy created with admin permissions for all the AWS services used by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create an IAM managed admin policy for all AWS services used:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam create-policy --policy-name &amp;lt;admin_policy_name&amp;gt; --policy-document file://policy 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;br&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The admin policy should be defined prior to auditing and remediating this recommendation. For a sample admin policy see recommendation 2.1. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
-            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
-            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
-          </references>
-          <standards>
-            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the IAM admin policies and note the policy ARN and DefaultVersionId:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-policies --query "Policies[?PolicyName == '&amp;lt;admin_policy_name&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;If the policy exists, check the policy document:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam get-policy-version --policy-arn &amp;lt;admin_policy_arn&amp;gt; --version-id &amp;lt;admin_policy_version&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:02:44.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-1.20" name="Create an IAM role for managing incidents with AWS" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>WS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support. 
-&lt;br /&gt; 
-&lt;br /&gt; 
-&lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;br /&gt;Using the Amazon unified command line interface, create an IAM role for managing incidents with AWS: 
-&lt;br /&gt; 
-&lt;br /&gt;Create a trust relationship policy document that allows &amp;lt;iam_user&amp;gt; to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: 
-&lt;br /&gt; 
-&lt;br /&gt;{ 
-&lt;br /&gt;&amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
-&lt;br /&gt;&amp;quot;Statement&amp;quot;: [{ 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Principal&amp;quot;: { 
-&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;AWS&amp;quot;: &amp;quot;&amp;lt;iam_user&amp;gt;&amp;quot; 
-&lt;br /&gt;&amp;nbsp; }, 
-&lt;br /&gt;&amp;nbsp; &amp;quot;Action&amp;quot;: &amp;quot;sts:AssumeRole&amp;quot; 
-&lt;br /&gt;&amp;nbsp; }] 
-&lt;br /&gt;} 
-&lt;br /&gt; 
-&lt;br /&gt;Create the IAM role using the above trust policy: 
-&lt;br /&gt; 
-&lt;br /&gt;aws iam create-role --role-name &amp;lt;aws_support_iam_role&amp;gt; --assume-role-policy-document file:///tmp/TrustPolicy.json 
-&lt;br /&gt; 
-&lt;br /&gt;Attach 'AWSSupportAccess' managed policy to the created IAM role: 
-&lt;br /&gt; 
-&lt;br /&gt;aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --role-name &amp;lt;aws_support_iam_role&amp;gt; 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
-            <reference name="Amazon docs: list entities for policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html"/>
-            <reference name="Amazon docs: list policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
-            <reference name="Amazon docs: managed policies and inline policies" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"/>
-            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
-            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
-          </references>
-          <standards>
-            <standard ref="1.17" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface: 
-            &lt;br /&gt; 
-            &lt;div&gt; 
-             &lt;ul&gt; 
-              &lt;li&gt;List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the &amp;quot;Arn&amp;quot; element value: &lt;/li&gt; 
-             &lt;/ul&gt; 
-            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-policies --query &amp;quot;Policies[?PolicyName == 'AWSSupportAccess']&amp;quot; 
-            &lt;br /&gt; 
-            &lt;div&gt; 
-             &lt;ul&gt; 
-              &lt;li&gt;Check if the 'AWSSupportAccess' is attached to any IAM user, group or role: &lt;/li&gt; 
-             &lt;/ul&gt; 
-            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-entities-for-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; 
-            &lt;span style=" , Arial;"&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.026">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-3" name="Create AWS Organizations change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;organizations_changes&amp;gt;` --metric-transformations metricName= `&amp;lt;organizations_changes&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;organizations_changes&amp;gt;` --metric-name `&amp;lt;organizations_changes&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.15" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.359">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.8" name="Create billing alerts to identify unusual spend" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By setting billing alarms you can monitor your AWS spend and be alerted if it exceeds certain thresholds thus protecting you from accruing unnecessary charges. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select the Receive Billing Alerts check box.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Choose Save preferences.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia). The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;On the navigation pane, under "Metrics", choose "Billing".&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the list of billing metrics, select the check box next to Currency USD, for the metric named EstimatedCharges. Define the alarm as follows:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If you want the alarm to trigger as soon as you go over the free tier, set "When my total AWS charges for the month exceed" to $.01. This means that you'll receive a notification as soon as you incur a charge. Otherwise, set it to the amount you want to trigger the alarm, and you will be notified when you go over that amount.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Choose the "New list" link next to the "send a notification to" box.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;When prompted, enter your email address or choose your Amazon SNS notification from the drop down.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Choose "Create Alarm".&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;In the "Confirm new email addresses" dialog box, confirm the email address or choose "I will do it later". If you don't confirm the email address now, the alarm remains in the Pending confirmation status until you do so, and does not send an alert. To view the status of your alarm, choose "Alarms" in the navigation panel.&lt;/li&gt; 
- &lt;/ol&gt; &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management
-                            console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the &amp;quot;Receive Billing Alerts&amp;quot; check box is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia).
-                            The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the navigation pane, under &amp;quot;Alarms&amp;quot;, check for one called
-                            &amp;quot;Billing&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on the alert if it exists and select the checkbox in the first column.&lt;/li&gt;
-                            &lt;li&gt;In the preview pane check that the &amp;quot;EstimatedCharges&amp;quot; threshold
-                            is set to the correct value and that the &amp;quot;Actions&amp;quot; is send an alarm to a
-                            valid email address.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.4" name="Create cloudtrail configuration changes alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is changes to
-                        cloudtrail. Since cloudtrail is the actual utility logging API calls it's security is paramount
-                        to ensuring that this continues. Therefore alerting on changes to cloudtrail activity can
-                        prevent a malicious user switching off the logging in order to carry out untracked activities.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&amp;nbsp;&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;aws
-                        logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                        ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) ||
-                        ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
-                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.5" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName =
-                            DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.4-5.5" name="Create Cloudwatch Log Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  AWS CloudWatch Log groups define groups of log streams that share the same retention, monitoring, and access control settings. Each log stream has to belong to one log group.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a Cloudwatch log group for the Web tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs create-log-group --log-group-name &amp;lt;web_tier_log_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html"/>
-            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for your Web tier Cloudwatch log group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs describe-log-groups --query "logGroups[?logGroupName =='&amp;lt;web_tier_log_group&amp;gt;']" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:24:18.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.6" name="Create IAM Policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is management IAM policy changes. IAM manages authorization and authentication controls with AWS and therefore it is vital that unauthorized changes are detected. Enabling monitoring of these changes ensures that these policies remain intact and as desired. 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a metric filter that checks for IAM policy changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=Delete UserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=P utUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=Cr eatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)| |($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUs erPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above:aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
- &lt;/ol&gt; &lt;br /&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource
-                            = kms.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))} }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.3" name="Create management console login alerts when MFA is not used" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is login on the
-                        console without MFA. Since logging on at the console should be restricted to only those users
-                        with an active MFA this alert will highlight those with password only access. This helps to
-                        capture weaker login procedures (password only) as they occur.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for console login without MFA: aws logs
-                        put-metric-filter --log-group-name &amp;lt;cloudwatch-logs-group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{
-                        $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot; }'&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
-                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot;
-                            }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.5" name="Create management console login failure alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is management
-                        console login failures. The management console is the AWS account GUI where administration
-                        activity is performed and is therefore a primary target for brute force attempts. To identify
-                        these attempts alerts for login failures should be enabled as this can highlight suspicious
-                        activity.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for console login failures: aws logs
-                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = ConsoleLogin)
-                        &amp;amp;&amp;amp; ($.errorMessage = &amp;quot;Failed authentication&amp;quot;) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = ConsoleLogin) &amp;amp;&amp;amp; ($.errorMessage = \&amp;quot;Failed
-                            authentication\&amp;quot;) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-2" name="Create network gateways change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for network gateways changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;network_gw_changes_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;network_gw_changes_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;network_gw_changes_alarm&amp;gt;` --metric-name `&amp;lt;network_gw_changes_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.12" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.2" name="Create root account usage alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is usage of the
-                        root account. This account should not be used on a day to day basis due to its full unrestricted
-                        privilege therefore usage should be by exception. Monitoring this usage should capture any
-                        suspicious activity used on the account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws logs
-                        describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                        $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy NOT
-                        EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&lt;/li&gt;
-                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
-                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.3" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy
-                            NOT EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.8" name="Create s3 bucket policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is S3 bucket policy changes. S3 bucket policies are a resource based policy that provide authorizations on S3 buckets. 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Making sure that their integrity remains intact is vital in ensuring the data within the S3 bucket remains secure and authorizations intact. Therefore s3 bucket policy changes should be alerted upon 
- &lt;br /&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a metric filter that checks for S3 Bucket policy changes:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;value&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an SNS topic for notifications:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns create-topic --name &amp;lt;topic_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.8" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
-                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) ||
-                            ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName =
-                            PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName =
-                            DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName =
-                            DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.10" name="Create security group change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is security group changes. Security groups are analogous to firewalls and therefore protect inbound and outbound access to &amp;amp; from AWS resources such as ec2 instances and RDS databases (amongst other things. Therefore alerting on changes to security groups helps ensure that the resources protected by them are not exposed.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Create a metric filter that checks for security group changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
-  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
-                            AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName
-                            = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName =
-                            DeleteSecurityGroup)}&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Monitoring-1" name="Create unauthorized API calls alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information, but gracefully fail if they don't have permissions.&lt;/p&gt;&lt;p&gt;If an excessive number of alerts are being generated then an organization may wish to consider adding read access to the limited IAM user permissions simply to quiet the alerts.&lt;/p&gt;&lt;p&gt;In some cases doing this may allow the users to actually view some areas of the system - any additional access given should be reviewed for alignment with the original limited IAM user intent.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for unauthorized API calls and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;unauthorized_api_calls_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.sourceIPAddress!="delivery.logs.amazonaws.com") || ($.eventName!="HeadBucket") }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;unauthorized_api_calls_alarm&amp;gt;` --metric-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.329">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.13" name="Create VPC gateway change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC gateway
-                        changes. VPC gateways are used as a means of sending traffic outside of a VPC (ie to the
-                        internet) and are vital in ensuring traffic flows to the correct destination. Therefore alerting
-                        on changes to VPC gateways ensuring traffic continues to flow as expected via the correct
-                        gateway.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for VPC gateway changes: aws logs put-metric-filter
-                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
-                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateCustomerGateway)
-                        || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||
-                        ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName =
-                        DetachInternetGateway) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.14" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
-                            ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) ||
-                            ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) ||
-                            ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.11" name="Create VPC NACL change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC NACL
-                        changes. Network Access Control Lists (NACLS) control inbound and outbound access to &amp;amp;
-                        from AWS subnets and work like packet filters to protect the network. Therefore alerting on
-                        changes to NACLS helps ensure that the subnets protected by them are not exposed.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for NACL changes: aws logs put-metric-filter
-                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
-                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateNetworkAcl) ||
-                        ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =
-                        DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName =
-                        ReplaceNetworkAclAssociation) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) ||
-                            ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName =
-                            ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.12" name="Create VPC route table change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is VPC route
-                        table changes. VPC route tables provide a means of routing network traffic between subnets and
-                        via gateways and ensures traffic flows via the correct path. Therefore alerting on changes to
-                        route tables ensuring traffic continues to flow as expected.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Create a metric filter that checks for VPC route table changes: aws logs
-                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
-                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateRoute)
-                        || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =
-                        ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute)
-                        || ($.eventName = DisassociateRouteTable) }'&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
-                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
-                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.13" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
-                            &amp;quot;{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName
-                            = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName =
-                            DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
-                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.6-5.7" name="Define a retention period for Cloudwatch log group in tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Retention period should be used to specify how long log events are kept in CloudWatch Logs. Expired log events get deleted automatically. Just like metric filters, retention settings are also assigned to log groups, and the retention assigned to a log group is applied to their log streams.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Put a retention policy for your Web tier Cloudwatch log group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws logs put-retention-policy --log-group-name &amp;lt;web_tier_log_group&amp;gt; --retention-indays &amp;lt;log_retention_period&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  If the retention period is not configured then logs will be retained indefinitely with increasing cost. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
-            <reference name="Put retention policy" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-retention-policy.html"/>
-          </references>
-          <standards>
-            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the Amazon unified command line interface:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Search for your Web tier Cloudwatch log group, and check for the presence of "retentionInDays" element:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws logs describe-log-groups --query "logGroups[?logGroupName == 
-   &lt;/div&gt; 
-   &lt;div&gt;
-     '&amp;lt;web_tier_log_group&amp;gt;']" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:28:27.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM2" name="Disable credentials unused after 45 days" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to manage Unused Password (IAM user console access)&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select user whose Console last sign-in is greater than 45 days&lt;/li&gt;&lt;li&gt;Click Security credentials&lt;/li&gt;&lt;li&gt;In section Sign-in credentials, Console password click Manage&lt;/li&gt;&lt;li&gt;Under Console Access select Disable 10.Click Apply&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Perform the following to deactivate Access Keys:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have been used and&lt;ol&gt;&lt;li&gt;Click on Make Inactive&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have not been used and&lt;ol&gt;&lt;li&gt;Click the X to Delete&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to determine if unused credentials exist:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click the Settings (gear) icon.&lt;/li&gt;&lt;li&gt;Select Console last sign-in, Access key last used, and Access Key Id&lt;/li&gt;&lt;li&gt;Click on Close&lt;/li&gt;&lt;li&gt;Check and ensure that Console last sign-in is less than 45 days ago.&lt;ol&gt;&lt;li&gt;Note - Never means the user has never logged in.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Check and ensure that Access key age is less than 45 days and that Access key last used does not say None&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Download Credential Report:&lt;/p&gt;&lt;p&gt;1. Run the following commands:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam generate-credential-report&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure unused credentials do not exist:&lt;/p&gt;&lt;p&gt;2. For each user having password_enabled set to TRUE , ensure password_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When password_enabled is set to TRUE and password_last_used is set to No_Information , ensure password_last_changed is less than 45 days ago.&lt;/p&gt;&lt;p&gt;3. For each user having an access_key_1_active or access_key_2_active to TRUE , ensure the corresponding access_key_n_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When a user having an access_key_x_active (where x is 1 or 2) to TRUE and corresponding access_key_x_last_used_date is set to N/A', ensure access_key_x_last_rotated` is less than 45 days ago.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.245">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-1.21" name="Do not setup access keys during initial user setup for all IAM users that have a console password" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials, it also generates unnecessary management work in auditing and rotating these keys. 
-&lt;br /&gt; 
-&lt;br /&gt; 
-&lt;b&gt;Remediation: &lt;/b&gt; 
-&lt;br /&gt;Perform the following to delete access keys that do not pass the audit. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Login to the AWS Management Console.Click Services.&lt;/li&gt; 
- &lt;li&gt;Click IAM&lt;/li&gt; 
- &lt;li&gt;Click on Users.Click on Security Credentials.&lt;/li&gt; 
- &lt;li&gt;As an Administrator.&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;br /&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; As an IAM User&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Via CLI:&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;aws iam delete-access-key&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ol&gt; 
-&lt;span style="font-weight: bold;"&gt;&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform the following to determine if access keys are rotated as prescribed: 
-            &lt;br /&gt; 
-            &lt;ol&gt; 
-             &lt;li&gt;Login to the AWS Management Console&lt;/li&gt; 
-             &lt;li&gt;Click Services&lt;/li&gt; 
-             &lt;li&gt;Click IAM&lt;/li&gt; 
-             &lt;li&gt;Click on a User&lt;/li&gt; 
-             &lt;li&gt;Compare the user creation date to the key 1 creation date.&lt;/li&gt; 
-             &lt;li&gt;For any that match, the key was created during initial user setup.&lt;/li&gt; 
-            &lt;/ol&gt;Keys that were created at the same time as the user profile and do not have a last used date should be deleted. 
-            &lt;br /&gt; 
-            &lt;br /&gt;Via the CLI: 
-            &lt;br /&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:&lt;/li&gt; 
-            &lt;/ul&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               aws iam generate-credential-report 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;br /&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;The output of this command will produce a table similar to the following:&amp;nbsp;&lt;/li&gt; 
-            &lt;/ul&gt; 
-            &lt;blockquote&gt; 
-             &lt;blockquote&gt;
-               user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_ 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               key_2_active,access_key_2_last_used_date 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               elise,false,true,2015-04-16T15:14:00+00:00,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               brandon,true,true,N/A,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               rakesh,false,false,N/A,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               helene,false,true,2015-11-18T17:47:00+00:00,false,N/A 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 
-             &lt;/blockquote&gt; 
-             &lt;blockquote&gt;
-               anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A 
-             &lt;/blockquote&gt; 
-            &lt;/blockquote&gt; 
-            &lt;ul&gt; 
-             &lt;li&gt;For any user having access_key_last_used_date set to N/A , ensure that access key is deleted&lt;/li&gt; 
-            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.039">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.058">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
-                        creates a digest for each log file it writes to S3. These digests can then be used to determine
-                        if a log has been modified since being written
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.2" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail describe-trails&amp;nbsp;
-                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM6" name="Enable IAM Access Analyzer for all regions" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable IAM Access analyzer for IAM policies about all resources in each region.&lt;/p&gt;&lt;p&gt;IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM Access Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to enable IAM Access analyzer for IAM policies:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;Choose Access analyzer.&lt;/li&gt;&lt;li&gt;Choose Create analyzer.&lt;/li&gt;&lt;li&gt;On the Create analyzer page, confirm that the Region displayed is the Region where you want to enable Access Analyzer.&lt;/li&gt;&lt;li&gt;Enter a name for the analyzer. Optional as it will generate a name for you automatically.&lt;/li&gt;&lt;li&gt;Add any tags that you want to apply to the analyzer. Optional.&lt;/li&gt;&lt;li&gt;Choose Create Analyzer.&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer create-analyzer --analyzer-name &amp;lt;NAME&amp;gt; --type &amp;lt;ACCOUNT|ORGANIZATION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat this command above for each active region. Note: The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.20" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/&lt;/li&gt;&lt;li&gt;Choose Access analyzer&lt;/li&gt;&lt;li&gt;Click 'Analyzers'&lt;/li&gt;&lt;li&gt;Ensure that at least one analyzer is present&lt;/li&gt;&lt;li&gt;Ensure that the STATUS is set to Active&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run the following command:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer list-analyzers | grep status&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that at least one Analyzer the status is set to ACTIVE&lt;/p&gt;&lt;p&gt;3. Repeat the steps above for each active region.&lt;/p&gt;&lt;p&gt;If an Access analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.6" name="Enable S3 Bucket logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>S3 Bucket Access Logging generates log files that contain access records for each request made
-                        to an S3 bucket. By enabling this it is possible to capture events relating to the objects
-                        within that bucket thus helping to capture potential security issues or identifying threats. It
-                        is recommended to enable S3 bucket logging on any S3 bucket that contains sensitive data and
-                        stored the logs in a separate bucket for security analysis.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
-                        &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&lt;/li&gt;
-                        &lt;li&gt;Click on Properties in the top right of the console.&lt;/li&gt;
-                        &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
-                        &lt;li&gt;Click on the &amp;quot;Enabled&amp;quot; checkbox.&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Target Bucket&amp;quot; to store the logs.&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Target Prefix&amp;quot; for the logs.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
-                            &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on Properties in the top right of the console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;Enabled&amp;quot; is checked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
-                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
-                        incidents that may be occurring across the network.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Select a VPC.&lt;/li&gt;
-                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
-                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select a VPC.&lt;/li&gt;
-                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.5" name="Encrypt CloudTrail logs using KMS" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon
-                        server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security
-                        layer that is directly manageable, you can instead use server-side encryption with AWS
-                        KMS-managed
-                        keys (SSE-KMS) for your CloudTrail log files. This provides several advantages:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across
-                        all regions.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail
-                        log files.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;You can assign permissions for the key to the users in your organization according to
-                        your requirements.&lt;/li&gt;
-                        &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now
-                        need to meet two conditions:&amp;nbsp;&lt;/li&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;you must have S3 read permission on the bucket, and&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;you must be granted decrypt permission by the CMK policy.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ul&gt;Because S3 automatically decrypts the log files for requests from users authorized to
-                        use the CMK, SSE-KMS encryption for CloudTrail log files is backward compatible with existing
-                        applications that read CloudTrail log data.&amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select CloudTrail from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Trails&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on a Trail.&lt;/li&gt;
-                        &lt;li&gt;Under the S3 section click on the edit button.&lt;/li&gt;
-                        &lt;li&gt;Click Advanced.&lt;/li&gt;
-                        &lt;li&gt;Set &amp;quot;Encrypt Log Files&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Set &amp;quot;Create a new KMS key&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;In &amp;quot;KMS key&amp;quot; type a name for your key.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt; 
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail describe-trails
-                            &lt;/blockquote&gt;Check that KMS is enabled if the &amp;quot;KmsKeyId&amp;quot; property is
-                            set.
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.9" name="Enforce employee lifecycle policies" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Regular reviews of accounts on the system should be conducted to ensure that stale accounts
-                        cannot be abused either by those former employees using them or compromised by attackers.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
-                        &lt;br /&gt;At least every 90 days complete the following:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                        &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;
-                        &lt;li&gt;Click on Users.&lt;/li&gt;
-                        &lt;li&gt;For any user that should no longer exist:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;select the user,&lt;/li&gt;
-                        &lt;li&gt;click &amp;quot;User Actions&amp;quot;,&lt;/li&gt;
-                        &lt;li&gt;click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
-                            --output text&lt;/li&gt;
-                            &lt;li&gt;Ensure all users are valid users.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM4" name="Ensure IAM policies that allow full &quot;*:*&quot; administrative privileges are not attached" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.&lt;/p&gt;&lt;p&gt;Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.&lt;/p&gt;&lt;p&gt;IAM policies that have a statement with "Effect": "Allow" with "Action": "*" over "Resource": "*" should be removed.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the navigation pane, click Policies and then search for the policy name found in the audit step.&lt;/li&gt;&lt;li&gt;Select the policy that needs to be deleted.&lt;/li&gt;&lt;li&gt;In the policy action menu, select first Detach&lt;/li&gt;&lt;li&gt;Select all Users, Groups, Roles that have this policy attached&lt;/li&gt;&lt;li&gt;Click Detach Policy&lt;/li&gt;&lt;li&gt;In the policy action menu, select Detach&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges as found in the audit step:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Lists all IAM users, groups, and roles that the specified managed policy is attached to. aws iam list-entities-for-policy --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Users: aws iam detach-user-policy --user-name &amp;lt;iam_user&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Groups: aws iam detach-group-policy --group-name &amp;lt;iam_group&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name &amp;lt;iam_role&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following to determine what policies are created: From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Run the following to get a list of IAM policies: aws iam list-policies --only-attached --output text&lt;/li&gt;&lt;li&gt;For each policy returned, run the following command to determine if any policies is allowing full administrative privileges on the account: aws iam get-policy-version --policy-arn &amp;lt;policy_arn&amp;gt; --version-id &amp;lt;version&amp;gt;&lt;/li&gt;&lt;li&gt;In output ensure policy should not have any Statement block with "Effect": "Allow" and Action set to "*" and Resource set to "*"&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.271">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-Network-1" name="Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL to remediate, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Click Edit inbound rules&lt;/li&gt;&lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click Delete to remove the offending inbound rule&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to determine if the account is configured as prescribed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Note: A Port value of ALL or a port range such as 0-1024 are inclusive of port 22, 3389, and other remote server administration ports&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.373">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM3" name="Ensure there is only one active access key available for any single IAM user" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/li&gt;&lt;li&gt;In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.&lt;/li&gt;&lt;li&gt;If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.&lt;/li&gt;&lt;li&gt;Repeat steps no. 3 - 7 for each IAM user in your AWS account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/p&gt;&lt;p&gt;2. Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user&lt;/p&gt;&lt;p&gt;Note - the command does not return any output:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam update-access-key --access-key-id &amp;lt;access-key-id&amp;gt; --status Inactive --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.&lt;/p&gt;&lt;p&gt;4. Repeat steps no. 1 - 3 for each IAM user in your AWS account.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;Under Access Keys section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Repeat steps no. 3 - 5 for each IAM user in your AWS account.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-users command to list all IAM users within your account:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-users --query "Users[*].UserName"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all your IAM user names.&lt;/p&gt;&lt;p&gt;2. Run list-access-keys command using the IAM user name list to return the current status of each access key associated with the selected IAM user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata ("Username", "AccessKeyId", "Status", "CreateDate") for each access key on that user account.&lt;/p&gt;&lt;p&gt;3. Check the Status property value for each key returned to determine each keys current state. If the Status property value for more than one IAM access key is set to Active, the user access configuration does not adhere to this recommendation, refer to the remediation below.&lt;/p&gt;&lt;p&gt;Repeat steps no. 2 and 3 for each IAM user in your AWS account.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.8" name="Export EC2 OS logs to cloudwatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudwatch logs is an AWS service that allows you to send logs from an EC2 instance to
-                        cloudwatch via an agent installed locally on the machine. The logs are then stored centrally
-                        within cloudwatch logs and metric alerts can be configured so that security incidents can be
-                        reported to the security team. It is recommended to enable cloudwatch log monitoring on all EC2
-                        servers.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Follow the directions provided in &amp;quot;http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html&amp;quot;
-                        to install and enable Cloudwatch Logs on a new EC2 instance.
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select Cloudwatch from the services menu.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Logs&amp;quot;.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click on your log group.&lt;/li&gt;
-                            &lt;li&gt;Click on your log stream.&lt;/li&gt;
-                            &lt;li&gt;Ensure event data is being captured as per the logs on your machine.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.8-5.9" name="Install an agent for AWS Cloudwatch Logs within AutoScaling Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can use CloudWatch Logs to monitor, store and access log files from an Amazon EC2 instance (application or system data). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  With CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics). For example, you could set an alarm on the number of errors that occur in your system logs or view graphs of web request latency from your application logs. Log data can be stored and accessed for as long as you need using highly durable, lowcost storage so you don't have to worry about filling up hard drives. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A Cloudwatch agent needs to run within the Guest Operating System of each EC2 instance you wish to ship logs from. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
-  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   *Note: references to Web tier are also applicable to App tier. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a sample agent configuration file for Amazon Linux and save it as a text file (for example, awslogs.cfg) either on the AMI's filesystem, in a publicly accessible http/https location, or an Amazon S3 location (for example, s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt;):&lt;/li&gt; 
- &lt;/ul&gt; 
-  [general] 
-  state_file = /var/awslogs/state/agent-state 
-  [/var/log/messages] 
-  file = /var/log/messages 
-  log_group_name = /var/log/messages 
-  log_stream_name = {instance_id} 
-  datetime_format = %b %d %H:%M:%S 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new Web tier Autoscaling Launch Configuration with UserData populated for installing Cloudwatch Logs agent:&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create and save locally a file containing the UserData, for example /tmp/UserData.txt:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     #!/bin/bashcurl https://s3.amazonaws.com/awscloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agentsetup.py./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Note: You can install the CloudWatch Logs agent by specifying the us-east-1, uswest-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, or sa-east-1 regions.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt;
-     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; -- user-data file:///tmp/UserData.txt 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-            <reference name="EC2 New Instance CWL" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html"/>
-          </references>
-          <standards>
-            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the Cloudwatch Logs agent is installed through UserData in the Web tier Autoscaling Launch Configuration:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt;--query "LaunchConfigurations[*].UserData" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Output should be similar with:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    #!/bin/bash 
-  &lt;/div&gt; 
-  &lt;div&gt;
-    curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agent-setup.py ./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:37:37.654">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
-                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
-                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
-                        account activity.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
-                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
-                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
-                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
-                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
-                        &lt;li&gt;Click Allow.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
-                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
-                            is set to a recent time (ie within the latest day or so).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.1" name="Launch EC2 instances into a VPC" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACLs) and routing. However, the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is recommended to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure. &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Launch Instance".&lt;/li&gt;&lt;li&gt;Complete the wizard until step 3. At this point, ensure a VPC ID is selected for the "Network" option, choose an appropriate "Subnet" and "Auto-assign Public IP" option.&lt;/li&gt;&lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;NB: If you want to migrate an already running instance you will need to convert the image into an AMI and then launch a new instance using the AMI and placing in a VPC, as per the steps above&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Instances" from the left hand menu.&lt;/li&gt;&lt;li&gt;For each instance in the list:&lt;ul&gt;&lt;li&gt;select the instance&lt;/li&gt;&lt;li&gt;in the preview pane confirm the instance has a "VPC ID". If a hyphen "-" is shown then your instance is running in EC2-Classic mode.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM7" name="Manage IAM users centrally via identity federation or AWS Organizations for multi-account environments" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;The remediation procedure will vary based on the individual organization's implementation of identity federation and/or AWS Organizations with the acceptance criteria that no non-service IAM users, and non-root accounts, are present outside the account providing centralized IAM user management.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.21" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For multi-account AWS environments with an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine the master account for identity federation or IAM user management&lt;/li&gt;&lt;li&gt;Login to that account through the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Identity providers&lt;/li&gt;&lt;li&gt;Verify the configuration&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Then..., determine all accounts that should not have local users present. For each account...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For multi-account AWS environments implementing AWS Organizations without an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Via CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review routing tables of peered VPCs for whether they route
-                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
-                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
-                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
-                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
-                            is as specific as desired.&lt;br /&gt;
-                            &lt;blockquote&gt;
-                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
-                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
-                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Gov-1.2" name="Register a Security contact for your AWS account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS will occasionally send security advisories and alerts to the account holder. By default this will go to the email address that the account is registered under. However if a security contact is specified these alerts will be sent here instead. Therefore this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
-  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt; 
-  &lt;li&gt;Click on Edit.&lt;/li&gt; 
-  &lt;li&gt;In the &amp;quot;Security&amp;quot; section complete the requested contact information.&lt;/li&gt; 
-  &lt;li&gt;Click update when complete.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.2" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
-                            &lt;li&gt;Click account name on the top right of the management console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt;
-                            &lt;li&gt;Confirm whether a contact has been set for &amp;quot;Security&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-IAM5" name="Remove expired SSL/TLS certificates stored in AWS IAM" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To delete Expired Certificate run following command by replacing &amp;lt;CERTIFICATE_NAME&amp;gt; with the name of the certificate to delete:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam delete-server-certificate --server-certificate-name &amp;lt;CERTIFICATE_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;When the preceding command is successful, it does not return any output.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.19" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Getting the certificates expiration information via AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run list-server-certificates command to list all the IAM-stored server certificates:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-server-certificates&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc):&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ "ServerCertificateMetadataList": [ { "ServerCertificateId": "EHDGFRW7EJFYTE88D", "ServerCertificateName": "MyServerCertificate", "Expiration": "2018-07-10T23:59:59Z", "Path": "/", "Arn": "arn:aws:iam::012345678910:server-certificate/MySSLCertificate", "UploadDate": "2018-06-10T11:56:08Z" } ] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Verify the ServerCertificateName and Expiration parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ { "ServerCertificateMetadataList": [] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This means that there are no expired certificates, It DOES NOT mean that no certificates exist.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
-  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-   &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
-                            test/dev/prod).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.071">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUDITABLE-CHANGES-AWS" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails are not properly protected, an attacker could gain access to the system,
-                                modify the status of the resources or exfiltrate sensitive data without being noticed.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-ACCESS-ROOT-01">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM5" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM6" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM7" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM2" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM3" mitigation="10"/>
-                    <countermeasure ref="AWS-IAM4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.9">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="AWS-IAM1" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-IAM1" mitigation="10"/>
-                <countermeasure ref="AWS-IAM2" mitigation="10"/>
-                <countermeasure ref="AWS-IAM3" mitigation="10"/>
-                <countermeasure ref="AWS-IAM4" mitigation="10"/>
-                <countermeasure ref="AWS-IAM5" mitigation="10"/>
-                <countermeasure ref="AWS-IAM6" mitigation="10"/>
-                <countermeasure ref="AWS-IAM7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-1.21">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
-                    <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.7" mitigation="8"/>
-                    <countermeasure ref="aws-tier-2.8" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
-                <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.7" mitigation="8"/>
-                <countermeasure ref="aws-tier-2.8" mitigation="8"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AWS RESOURCE LOGGING" name="AWS Resource Logging" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails in the resources are not enabled or not protected, attackers could gain
-                                access to the system and modify or delete data from the resources and the changes are
-                                not detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
-                    <countermeasure ref="aws-tier-4.6" mitigation="16"/>
-                    <countermeasure ref="aws-tier-4.7" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Logging-3.9">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
-                <countermeasure ref="aws-tier-4.6" mitigation="16"/>
-                <countermeasure ref="aws-tier-4.7" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="CLOUDWATCH METRIC ALERTS" name="Cloudwatch Metric Alerts" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED_ACCESS_SYSTEMS_AWS" name="Attackers access to the systems without being detected" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers gain access to the systems and they are not detected and the changes of the
-                                attackers could not be detected and audited.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
-                    <countermeasure ref="aws-tier-4.8" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.5">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="cloudwatch-misconfig">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
-                    <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
-                    <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
-                <countermeasure ref="aws-tier-4.8" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
-                <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.10">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Monitoring-4.4">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK-AWS" name="Sensitive data is compromised through undetected network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers gain undetected access to the network systems and the changes of the attackers
-                                could not be audited or detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Monitoring-4.12">
-                  <countermeasures>
-                    <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
-                    <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
-                    <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
-                <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
-                <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="VIRTUAL PRIVATE CLOUD (VPC) NETWORK" name="Virtual Private Cloud (VPC) Network" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="AWS-Network-1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                    <countermeasure ref="aws-tier-5.12" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-Network-1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
-                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                <countermeasure ref="aws-tier-5.12" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="53209bc4-bd2a-432a-913b-53da5d5022e1" diagramComponentId="08ae241f-04eb-4dd6-b61a-f0c560092b87" ref="5fabbae7-9089-4bc6-beb9-9a432631c9d2" name="User" desc="" library="unece-wp-29-csms" parentComponentRef="" componentDefinitionRef="end-user">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CSMS-4.3.4-15.2" name="Defined security procedures are not followed" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; &lt;b&gt;Defined security procedures&lt;/b&gt; are not followed&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.617">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.4-15.1" name="Social engineering" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; Innocent victim (e.g. owner, operator or maintenance engineer) being &lt;b&gt;tricked into taking an action&lt;/b&gt; to&lt;b&gt; &lt;/b&gt;unintentionally load malware or enable an attack&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.617">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSMS-M19" name="Define security procedures" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Organizations shall ensure security procedures are defined and followed including logging of actions and access related to the management of the security functions&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53 PS-1 Personnel Security Policy and Procedures" url="https://nvd.nist.gov/800-53/Rev4/control/PS-1"/>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M19" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.525">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M18" name="Define user roles and access privileges" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Measures shall be implemented for defining and controlling user roles and access privileges, based on the principle of least access privilege&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Role Definitions" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/01-Test_Role_Definitions"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M18" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.526">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
-          <threats>
-            <threat ref="CSMS-4.3.4-15" name="Unintended human actions carried out from outside of vehicles" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" editable="true">
-              <desc>This threat include: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Legitimate actors are able to take actions that would unwittingly facilitate a cyber-attack&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CSMS-4.3.4-15.1">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M18" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CSMS-4.3.4-15.2">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M19" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSMS-M18" mitigation="50"/>
-                <countermeasure ref="CSMS-M19" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="01389eec-4ec1-4d9e-bde9-f91bf903a3ab" diagramComponentId="dfb2631f-d959-4a19-ace4-62fb552b6773" ref="bb23eb31-51d2-42fd-9350-d4db18531e34" name="VPC - Customer Instance" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="vpc">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.110">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.115">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.119">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.129">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Being highly selective in peering routing tables is a very effective way of minimizing the
-                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards>
-            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
-            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before you begin, make sure of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
-  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
-  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
-  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
-  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
-  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test end-to-end connectivity 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon EC2 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On the dashboard, choose Launch Instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Choose an instance type, and then choose Next: Configure Instance Details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ping 10.0.0.4 
-&lt;/div&gt; 
-&lt;div&gt;
-  Pinging 10.0.0.4 with 32 bytes of data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt;
-  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ping statistics for 10.0.0.4: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Approximate round trip times in milliseconds: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use SSH or RDP to connect to your instances in the VPC. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:31:55.971">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control access to VPC resources with IAM identities and policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Control access to VPC resources by using: 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Identities: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authentication is how you sign in to AWS using your identity credentials. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Identity-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Resource-based policies: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Access control lists (ACLs): 
-&lt;/div&gt; 
-&lt;div&gt;
-  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.899">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Creating CloudWatch alarms to monitor a NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm for outbound traffic through the NAT gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To create an alarm to monitor port allocation errors 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the CloudWatch console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Alarms, Create Alarm. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose NAT Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure the alarm as follows, and choose Create Alarm when you are done: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Actions, select an existing notification list or choose New list to create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:58:07.550">
-              <output/>
-            </source>
-            <references>
-              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for VPC endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To route traffic to an Amazon VPC interface endpoint 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console and open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the right pane, choose the endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the Route 53 console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the navigation pane, choose Hosted Zones. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create Record Set. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specify the following values: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose A - IPv4 address. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Yes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alias Target 
-&lt;/div&gt; 
-&lt;div&gt;
-  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Different accounts - Enter the value that you got in step 1 of this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Routing Policy 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Evaluate Target Health 
-&lt;/div&gt; 
-&lt;div&gt;
-  Accept the default value of No. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:39:59.223">
-              <output/>
-            </source>
-            <references>
-              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:54:35.989">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
-                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
-                        incidents that may be occurring across the network.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Select a VPC.&lt;/li&gt;
-                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
-                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
-                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
-                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
-                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select a VPC.&lt;/li&gt;
-                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
-                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable VPC Traffic Mirroring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content inspection 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Threat monitoring 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Troubleshooting 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can create, access, and manage your traffic mirror resources using any of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T13:00:52.965">
-              <output/>
-            </source>
-            <references>
-              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
-&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
-&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
-&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
-&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
-            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.909">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Via CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
-          </references>
-          <standards>
-            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review routing tables of peered VPCs for whether they route
-                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
-                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
-                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
-                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
-                            is as specific as desired.&lt;br /&gt;
-                            &lt;blockquote&gt;
-                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
-                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
-                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
-  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
- &lt;/ol&gt; 
-   &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
-                            test/dev/prod).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To get started with AWS Secrets Manager: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identify your secrets and locate where they are used in your applications. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update your applications to retrieve secrets from Secrets Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.969">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network ACLs for VPC as an additional layer of security 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following are the parts of a network ACL rule: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Source. [Inbound rules only] The source of the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow/Deny. Whether to allow or deny the specified traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Open the Amazon VPC console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the navigation pane, choose Network ACLs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select a Network ACL to see details. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:43:47.241">
-              <output/>
-            </source>
-            <references>
-              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use VPC endpoint policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your endpoint policy can be like any IAM policy; however, take note of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:41:32.102">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.653">
-              <output/>
-            </source>
-            <references>
-              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
-                <countermeasure ref="AWS-VPC1" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                <countermeasure ref="AWS-VPC7" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC8" mitigation="33"/>
-                <countermeasure ref="AWS-VPC9" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-VPC3" mitigation="17"/>
-                <countermeasure ref="AWS-VPC4" mitigation="17"/>
-                <countermeasure ref="AWS-VPC5" mitigation="17"/>
-                <countermeasure ref="AWS-VPC6" mitigation="17"/>
-                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
-                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="899a22b7-e9b1-4ad0-a88b-8c529d2fe7fa" diagramComponentId="014badac-374f-4d89-8c27-42530ecd947e" ref="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" name="User - Web UI" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-ui">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.752">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software includes web functionality (such as a web widget)
-                        from another domain, which causes it to operate within the domain of the
-                        software, potentially granting total access and control of the software to the
-                        untrusted source.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-18T14:51:05.701">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-07T14:11:14.917">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.862">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.944">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:20:27.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.807">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component's end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:25:46.844">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Review periodically all assets which are accessed by the application and ensure that these
-                        assets are hosted by the application. If this is not the case and there are assets in external
-                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
-                        from external providers or CDNs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
-          </references>
-          <standards>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all assets are hosted by the application, and not by external providers.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T11:44:50.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform=".NET" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-            <implementation platform="Spring MVC">
-              <desc>
-                                CkluIHdlYi54bWwKCjxjb250ZXh0LXBhcmFtPgogICAgPHBhcmFtLW5hbWU+ZGVmYXVsdEh0bWxFc2NhcGU8L3BhcmFtLW5hbWU+CiAgICA8cGFyYW0tdmFsdWU+dHJ1ZTwvcGFyYW0tdmFsdWU+CjwvY29udGV4dC1wYXJhbT4=
-                            </desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.033">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only request the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-09-30T09:11:03.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-30T15:19:22.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.974">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.007">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-07T14:11:14.845">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Web applications typically make extensive use of 3rd party web resources such as
-                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
-                                repositories, or even Content Delivery Networks that host these libraries, then they
-                                could gain access to applications that use this content.
-                                &lt;div&gt;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-830">
-                  <countermeasures>
-                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
-                <countermeasure ref="WEB-CSP" mitigation="33"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                <countermeasure ref="CWE-327" mitigation="33"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 09b79de74abf22f20dcfcdc92b709fbd18195365 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:20:54 -0400
Subject: [PATCH 12/28] Delete Templates/azure-general-network-architecture.xml

---
 .../azure-general-network-architecture.xml    | 12271 ----------------
 1 file changed, 12271 deletions(-)
 delete mode 100644 Templates/azure-general-network-architecture.xml

diff --git a/Templates/azure-general-network-architecture.xml b/Templates/azure-general-network-architecture.xml
deleted file mode 100644
index 87ae44d..0000000
--- a/Templates/azure-general-network-architecture.xml
+++ /dev/null
@@ -1,12271 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="azure-general-network-architecture" name="Azure - General Network Architecture" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjI0OCIgZHk9IjEwODIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC42LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHVibGljIiBzdHlsZT0iaXIucmVmPTYzNzZkNTNlLTY0NjEtNDEyYi04ZTA0LTdiM2ZlMmIzOTdkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMzUyIiB5PSItMzEiIHdpZHRoPSIxMjE3IiBoZWlnaHQ9IjU5OSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQXp1cmUgRW52aXJvbm1lbnQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtZW52aXJvbm1lbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTROekEyTWlBd0xqRTJOalV3TkVnd0xqWXdNakl6TWt3d0xqTTNPRGczTWlBd0xqZ3lPRE13T0VNd0xqTTNOalUzTmlBd0xqZ3pOVEV4SURBdU16Y3lNakEwSURBdU9EUXhNREl4SURBdU16WTJNemN5SURBdU9EUTFNakE0UXpBdU16WXdOVFFnTUM0NE5Ea3pPVFFnTUM0ek5UTTFOREVnTUM0NE5URTJORFlnTUM0ek5EWXpOaklnTUM0NE5URTJORFpJTUM0eE56ZzVNVEZETUM0eE56TTBOeklnTUM0NE5URTJORGNnTUM0eE5qZ3hNVEVnTUM0NE5UQXpOVElnTUM0eE5qTXlOeklnTUM0NE5EYzROamxETUM0eE5UZzBNek1nTUM0NE5EVXpPRFlnTUM0eE5UUXlOVFFnTUM0NE5ERTNPRGNnTUM0eE5URXdPRElnTUM0NE16Y3pOamxETUM0eE5EYzVNU0F3TGpnek1qazFNU0F3TGpFME5UZ3pOaUF3TGpneU56ZzBNU0F3TGpFME5UQXpNU0F3TGpneU1qUTJNa013TGpFME5ESXlOaUF3TGpneE56QTRNeUF3TGpFME5EY3hNeUF3TGpneE1UVTVJREF1TVRRMk5EVXlJREF1T0RBMk5ETTJUREF1TXpVME5UVXpJREF1TVRnNU9EUXlRekF1TXpVMk9EUTVJREF1TVRnek1EUWdNQzR6TmpFeU1qRWdNQzR4TnpjeE1qa2dNQzR6Tmpjd05UTWdNQzR4TnpJNU5ESkRNQzR6TnpJNE9EVWdNQzR4TmpnM05UWWdNQzR6TnprNE9ETWdNQzR4TmpZMU1EUWdNQzR6T0Rjd05qSWdNQzR4TmpZMU1EUmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT1RrMk5UY2dNQzQyTVRBek5USklNQzR6TlRnME5EZERNQzR6TlRVeU56Y2dNQzQyTVRBek5USWdNQzR6TlRJeE9DQXdMall4TVRNd05pQXdMak0wT1RVMU9TQXdMall4TXpBNVF6QXVNelEyT1RNNElEQXVOakUwT0RjMElEQXVNelEwT1RFMElEQXVOakUzTkRBMUlEQXVNelF6TnpVeUlEQXVOakl3TXpVMVF6QXVNelF5TlRnNUlEQXVOakl6TXpBMUlEQXVNelF5TXpReElEQXVOakkyTlRNMklEQXVNelF6TURRZ01DNDJNamsyTWpsRE1DNHpORE0zTXpnZ01DNDJNekkzTWpFZ01DNHpORFV6TlRJZ01DNDJNelUxTXpJZ01DNHpORGMyTnlBd0xqWXpOelk1TlV3d0xqVTJOamt5TWlBd0xqZzBNak15T0VNd0xqVTNNek13TkNBd0xqZzBPREk0TkNBd0xqVTRNVGN3T0NBd0xqZzFNVFU1TnlBd0xqVTVNRFF6TnlBd0xqZzFNVFU1TjBnd0xqYzRNell6TkV3d0xqWTVPVFkxTnlBd0xqWXhNRE0xTWxvaUlHWnBiR3c5SWlNd01EYzRSRFFpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNNE56RTBNU0F3TGpFMk5qVXdORU13TGpNM09UZzROQ0F3TGpFMk5qUTNOeUF3TGpNM01qZ3dPQ0F3TGpFMk9EYzNJREF1TXpZMk9UUTNJREF1TVRjek1EVkRNQzR6TmpFd09EWWdNQzR4Tnpjek1qa2dNQzR6TlRZM05EWWdNQzR4T0RNek55QXdMak0xTkRVMk1pQXdMakU1TURJNVREQXVNVFEyTnpnMklEQXVPREExT0RjNFF6QXVNVFEwT1RNZ01DNDRNVEV3TlNBd0xqRTBORE0wTnlBd0xqZ3hOalU1TkNBd0xqRTBOVEE0TnlBd0xqZ3lNakF6T1VNd0xqRTBOVGd5TmlBd0xqZ3lOelE0TkNBd0xqRTBOemcyTnlBd0xqZ3pNalkzTVNBd0xqRTFNVEF6TlNBd0xqZ3pOekUyTVVNd0xqRTFOREl3TXlBd0xqZzBNVFkxTVNBd0xqRTFPRFF3TnlBd0xqZzBOVE14TVNBd0xqRTJNekk0T1NBd0xqZzBOemd6TTBNd0xqRTJPREUzTWlBd0xqZzFNRE0xTkNBd0xqRTNNelU1SURBdU9EVXhOall6SURBdU1UYzVNRGcxSURBdU9EVXhOalE0U0RBdU16VXdPRFpETUM0ek5UY3lOaUF3TGpnMU1EVXdOU0F3TGpNMk16STBNU0F3TGpnME56WTRNeUF3TGpNMk9ERTVNaUF3TGpnME16UTNNVU13TGpNM016RTBOQ0F3TGpnek9USTFPU0F3TGpNM05qZzRPQ0F3TGpnek16Z3dPU0F3TGpNM09UQTBNeUF3TGpneU56WTNOa3d3TGpReU1EUTNNeUF3TGpjd05UVTNORXd3TGpVMk9EUTNOU0F3TGpnME16WXhNVU13TGpVM05EWTNOaUF3TGpnME9EYzBNeUF3TGpVNE1qUTFOaUF3TGpnMU1UVTRNaUF3TGpVNU1EVXdOU0F3TGpnMU1UWTBPVWd3TGpjNE1qazRPRXd3TGpZNU9EVTJOU0F3TGpZeE1EUk1NQzQwTlRJME5qUWdNQzQyTVRBME5UVk1NQzQyTURNd09UUWdNQzR4TmpZMU1EUklNQzR6T0RjeE5ERmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNVjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmpFM09EVWdNQzR4T0RrNE1EWkRNQzQyTlRrME9UTWdNQzR4T0RNd01UVWdNQzQyTlRVeE1qZ2dNQzR4TnpjeE1UTWdNQzQyTkRrek1EWWdNQzR4TnpJNU16TkRNQzQyTkRNME9ETWdNQzR4TmpnM05UTWdNQzQyTXpZME9UWWdNQzR4TmpZMU1EUWdNQzQyTWprek1qZ2dNQzR4TmpZMU1EUklNQzR6T0RrMU1qWkRNQzR6T1RZMk9UVWdNQzR4TmpZMU1EUWdNQzQwTURNMk9ESWdNQzR4TmpnM05UTWdNQzQwTURrMU1EVWdNQzR4TnpJNU16TkRNQzQwTVRVek1qZ2dNQzR4TnpjeE1UTWdNQzQwTVRrMk9UTWdNQzR4T0RNd01UVWdNQzQwTWpFNU9EWWdNQzR4T0RrNE1EWk1NQzQyTXpBd09Ua2dNQzQ0TURZME16VkRNQzQyTXpFNE16Z2dNQzQ0TVRFMU9EZ2dNQzQyTXpJek1qVWdNQzQ0TVRjd09ESWdNQzQyTXpFMU1Ua2dNQzQ0TWpJME5rTXdMall6TURjeE5DQXdMamd5Tnpnek9TQXdMall5T0RZek9TQXdMamd6TWprME9TQXdMall5TlRRMk55QXdMamd6TnpNMk9FTXdMall5TWpJNU5TQXdMamcwTVRjNE5pQXdMall4T0RFeE55QXdMamcwTlRNNE5TQXdMall4TXpJM09DQXdMamcwTnpnMk9VTXdMall3T0RRek9TQXdMamcxTURNMU1pQXdMall3TXpBM09DQXdMamcxTVRZME55QXdMalU1TnpZek9TQXdMamcxTVRZME9FZ3dMamd6TnpRME1VTXdMamcwTWpnNElEQXVPRFV4TmpRM0lEQXVPRFE0TWpReElEQXVPRFV3TXpVeUlEQXVPRFV6TURnZ01DNDRORGM0TmpsRE1DNDROVGM1TVRrZ01DNDRORFV6T0RZZ01DNDROakl3T1RjZ01DNDROREUzT0RZZ01DNDROalV5TmprZ01DNDRNemN6TmpoRE1DNDROamcwTkRFZ01DNDRNekk1TkRrZ01DNDROekExTVRVZ01DNDRNamM0TXprZ01DNDROekV6TWlBd0xqZ3lNalEyUXpBdU9EY3lNVEkxSURBdU9ERTNNRGd4SURBdU9EY3hOak0zSURBdU9ERXhOVGc0SURBdU9EWTVPRGs0SURBdU9EQTJORE0xVERBdU5qWXhOemcxSURBdU1UZzVPREEyV2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERKZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXdMalEyTlRRNE5pSWdlVEU5SWpBdU1qRTNNamMxSWlCNE1qMGlNQzR5TkRJd01qa2lJSGt5UFNJd0xqZzNOelF5TWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RXhORUU0UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EWTJPVUpESWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzQxTXpVek55SWdlVEU5SWpBdU5USTBPVElpSUhneVBTSXdMalE0TXpZM09TSWdlVEk5SWpBdU5UUXlNems0SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXOXdZV05wZEhrOUlqQXVNeUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqQTNNVElpSUhOMGIzQXRiM0JoWTJsMGVUMGlNQzR5SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVNekl4SWlCemRHOXdMVzl3WVdOcGRIazlJakF1TVNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMall5TXpFaUlITjBiM0F0YjNCaFkybDBlVDBpTUM0d05TSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMVzl3WVdOcGRIazlJakFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWElpSUhneFBTSXdMalV3TmpjMk1TSWdlVEU5SWpBdU1UazRNREUxSWlCNE1qMGlNQzQzTlRJd05EWWlJSGt5UFNJd0xqZzFNVFV4TnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6TkRRMEpHTkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1qZzVNa1JHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1T0RRMk1UVWlJR2hsYVdkb2REMGlNQzQ1T0RRMk1URWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakF4TlRNNE1Ea2dNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnprMU5UWTVJaUJvWldsbmFIUTlJakF1TnprMU5UWTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR4TURrNU9EVWdNQzR4TURrNE5qTXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjMiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zZjZhNGJkYS0yYTc1LTQyYmUtYTY3Zi1kZTNmNmQxYWJiNjE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWVudmlyb25tZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjMiIHk9IjM1IiB3aWR0aD0iMTE3NyIgaGVpZ2h0PSI1MzYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkF6dXJlIFZOZXQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVk5FVDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RXlNVE5mTWpFMk56Z3BJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkyTURjeE15QXdMalUwT1RZNU9FTXdMalk0T0RJMU55QXdMalUwT1RZNU9DQXdMamN4TURVNE55QXdMalV5TnpNMk9TQXdMamN4TURVNE55QXdMalE1T1RneU5VTXdMamN4TURVNE55QXdMalEzTWpJNElEQXVOamc0TWpVM0lEQXVORFE1T1RVeElEQXVOall3TnpFeklEQXVORFE1T1RVeFF6QXVOak16TVRZNUlEQXVORFE1T1RVeElEQXVOakV3T0RRZ01DNDBOekl5T0NBd0xqWXhNRGcwSURBdU5EazVPREkxUXpBdU5qRXdPRFFnTUM0MU1qY3pOamtnTUM0Mk16TXhOamtnTUM0MU5EazJPVGdnTUM0Mk5qQTNNVE1nTUM0MU5EazJPVGhhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWEpmTVRJeE0xOHlNVFkzT0NraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNVFV6TWlBd0xqVTBPVGt6T1VNd0xqVXlPVEEzTmlBd0xqVTBPVGt6T1NBd0xqVTFNVFF3TkNBd0xqVXlOell4TVNBd0xqVTFNVFF3TkNBd0xqVXdNREEyTjBNd0xqVTFNVFF3TkNBd0xqUTNNalV5TkNBd0xqVXlPVEEzTmlBd0xqUTFNREU1TlNBd0xqVXdNVFV6TWlBd0xqUTFNREU1TlVNd0xqUTNNems0T1NBd0xqUTFNREU1TlNBd0xqUTFNVFkySURBdU5EY3lOVEkwSURBdU5EVXhOallnTUM0MU1EQXdOamRETUM0ME5URTJOaUF3TGpVeU56WXhNU0F3TGpRM016azRPU0F3TGpVME9Ua3pPU0F3TGpVd01UVXpNaUF3TGpVME9Ua3pPVm9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF4WDJ4cGJtVmhjbDh4TWpFelh6SXhOamM0S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16UXlPRFF6SURBdU5UUTVPVE01UXpBdU16Y3dNemc0SURBdU5UUTVPVE01SURBdU16a3lOekUzSURBdU5USTNOakV4SURBdU16a3lOekUzSURBdU5UQXdNRFkzUXpBdU16a3lOekUzSURBdU5EY3lOVEkwSURBdU16Y3dNemc0SURBdU5EVXdNVGsxSURBdU16UXlPRFF6SURBdU5EVXdNVGsxUXpBdU16RTFNams0SURBdU5EVXdNVGsxSURBdU1qa3lPVFk1SURBdU5EY3lOVEkwSURBdU1qa3lPVFk1SURBdU5UQXdNRFkzUXpBdU1qa3lPVFk1SURBdU5USTNOakV4SURBdU16RTFNams0SURBdU5UUTVPVE01SURBdU16UXlPRFF6SURBdU5UUTVPVE01V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERKZmJHbHVaV0Z5WHpFeU1UTmZNakUyTnpncElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOemt3TnpZZ01DNDJPVGsxTmpOTU1DNHpOVEExTXprZ01DNDNNamd4T0VNd0xqTTBPREV5TXlBd0xqY3pNRFl3TWlBd0xqTTBORGcwTkNBd0xqY3pNVGsyTmlBd0xqTTBNVFF5TkNBd0xqY3pNVGszTVVNd0xqTXpPREF3TXlBd0xqY3pNVGszTlNBd0xqTXpORGN5SURBdU56TXdOakl4SURBdU16TXlNams0SURBdU56STRNakExVERBdU1USXhNREU0SURBdU5URTNOVEUxUXpBdU1URTJNVGMwSURBdU5URXlOamcwSURBdU1URXpORFEzSURBdU5UQTJNVEkySURBdU1URXpORE0zSURBdU5EazVNamcxUXpBdU1URXpOREk0SURBdU5Ea3lORFF6SURBdU1URTJNVE0ySURBdU5EZzFPRGM0SURBdU1USXdPVFkzSURBdU5EZ3hNRE16VERBdU1UUTVOVEExSURBdU5EVXlOREUyVERBdU16YzVNRFVnTUM0Mk9ERXpNakpETUM0ek9ERTBOek1nTUM0Mk9ETTNNemdnTUM0ek9ESTRNellnTUM0Mk9EY3dNVFlnTUM0ek9ESTROREVnTUM0Mk9UQTBNemRETUM0ek9ESTRORFlnTUM0Mk9UTTROVGdnTUM0ek9ERTBPVEVnTUM0Mk9UY3hOREVnTUM0ek56a3dOellnTUM0Mk9UazFOak5XTUM0Mk9UazFOak5hSWlCbWFXeHNQU0lqTlRCRk5rWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TkRZd05EY2dNQzR5TnpJMU16Vk1NQzR6TnpRMk5qVWdNQzR6TURFd056SkRNQzR6Tnpjd09EY2dNQzR6TURNME9EZ2dNQzR6TnpnME5TQXdMak13TmpjMk5pQXdMak0zT0RRMU5TQXdMak14TURFNE4wTXdMak0zT0RRMklEQXVNekV6TmpBNElEQXVNemMzTVRBMklEQXVNekUyT0RreElEQXVNemMwTmprZ01DNHpNVGt6TVROTU1DNHhORGt4TWpJZ01DNDFORFUxTURkTU1DNHhNakExTURVZ01DNDFNVFk1TjBNd0xqRXhOVFkyTVNBd0xqVXhNakV6T1NBd0xqRXhNamt6TkNBd0xqVXdOVFU0TVNBd0xqRXhNamt5TkNBd0xqUTVPRGMwUXpBdU1URXlPVEUxSURBdU5Ea3hPRGs0SURBdU1URTFOakl6SURBdU5EZzFNek16SURBdU1USXdORFUwSURBdU5EZ3dORGc1VERBdU16STNPREEySURBdU1qY3lOVFl4UXpBdU16TXdNakl5SURBdU1qY3dNVE01SURBdU16TXpOVEF4SURBdU1qWTROemMxSURBdU16TTJPVEl5SURBdU1qWTROemRETUM0ek5EQXpORElnTUM0eU5qZzNOalVnTUM0ek5ETTJNalVnTUM0eU56QXhNaUF3TGpNME5qQTBOeUF3TGpJM01qVXpOVll3TGpJM01qVXpOVm9pSUdacGJHdzlJaU14TkRrd1JFWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamcxTURVNE5pQXdMalExTWpFME9Fd3dMamczT1RFeU15QXdMalE0TURjMk5rTXdMamc0TXprMU5DQXdMalE0TlRZeElEQXVPRGcyTmpZeklEQXVORGt5TVRjMklEQXVPRGcyTmpVeklEQXVORGs1TURFM1F6QXVPRGcyTmpReklEQXVOVEExT0RVNUlEQXVPRGd6T1RFM0lEQXVOVEV5TkRFM0lEQXVPRGM1TURjeUlEQXVOVEUzTWpRNFREQXVOalkzTnprMElEQXVOekkzT1RReFF6QXVOalkxTXpjeUlEQXVOek13TXpVMklEQXVOall5TURrZ01DNDNNekUzTVNBd0xqWTFPRFkyT1NBd0xqY3pNVGN3TmtNd0xqWTFOVEkwT0NBd0xqY3pNVGN3TVNBd0xqWTFNVGsyT1NBd0xqY3pNRE16TnlBd0xqWTBPVFUxTkNBd0xqY3lOemt4TlV3d0xqWXlNVEF4TnlBd0xqWTVPVEk1T0VNd0xqWXhPRFl3TVNBd0xqWTVOamczTlNBd0xqWXhOekkwTnlBd0xqWTVNelU1TXlBd0xqWXhOekkxTWlBd0xqWTVNREUzTWtNd0xqWXhOekkxTnlBd0xqWTROamMxTVNBd0xqWXhPRFl5SURBdU5qZ3pORGN5SURBdU5qSXhNRFF5SURBdU5qZ3hNRFUzVERBdU9EVXdOVGcySURBdU5EVXlNVFE0VmpBdU5EVXlNVFE0V2lJZ1ptbHNiRDBpSXpVd1JUWkdSaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RjNU1UTTBJREF1TlRFMk9ERk1NQzQ0TlRBMU1UY2dNQzQxTkRVek5EaE1NQzQyTWpRNU5EY2dNQzR6TVRreE5EaERNQzQyTWpJMU16SWdNQzR6TVRZM01qWWdNQzQyTWpFeE56Y2dNQzR6TVRNME5ETWdNQzQyTWpFeE9ESWdNQzR6TVRBd01qTkRNQzQyTWpFeE9EY2dNQzR6TURZMk1ESWdNQzQyTWpJMU5URWdNQzR6TURNek1qTWdNQzQyTWpRNU56TWdNQzR6TURBNU1EZE1NQzQyTlRNNE9UVWdNQzR5TnpJd05qWkRNQzQyTlRZek1UY2dNQzR5TmprMk5URWdNQzQyTlRrMklEQXVNalk0TWprMklEQXVOall6TURJeElEQXVNalk0TXpBeFF6QXVOalkyTkRReElEQXVNalk0TXpBMklEQXVOalk1TnpJZ01DNHlOamsyTmprZ01DNDJOekl4TXpZZ01DNHlOekl3T1RKTU1DNDROemswT1NBd0xqUTRNREF5TlVNd0xqZzRORE15TVNBd0xqUTRORGcyT1NBd0xqZzROekF5T1NBd0xqUTVNVFF6TkNBd0xqZzROekF5SURBdU5EazRNamMyUXpBdU9EZzNNREVnTUM0MU1EVXhNVGdnTUM0NE9EUXlPRE1nTUM0MU1URTJOelVnTUM0NE56azBNemtnTUM0MU1UWTFNRGRNTUM0NE56a3hNelFnTUM0MU1UWTRNVm9pSUdacGJHdzlJaU14TkRrd1JFWWlMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeVh6RXlNVE5mTWpFMk56Z2lJSGd4UFNJd0xqWXlOVFUwTXlJZ2VURTlJakF1TkRZME9ETTJJaUI0TWowaU1DNDJPVFl4TlRJaUlIa3lQU0l3TGpVek5USTBPQ0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpnMlJEWXpNeUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTlVVNU5qSTBJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREZmYkdsdVpXRnlYekV5TVROZk1qRTJOemdpSUhneFBTSXdMak0zT0RVM01pSWdlVEU5SWpBdU5EZ3lORFFpSUhneVBTSXdMalEwT0RZMU1TSWdlVEk5SWpBdU5UVXlPVFE1SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJak9EWkVOak16SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlNMVJUazJNalFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWEpmTVRJeE0xOHlNVFkzT0NJZ2VERTlJakF1TWpFNU9EYzNJaUI1TVQwaU1DNDBPREkwTkNJZ2VESTlJakF1TWpnNU9UVTJJaUI1TWowaU1DNDFOVEk1TlRJaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTROa1EyTXpNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUl6VkZPVFl5TkNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVEl4TTE4eU1UWTNPQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9DSWdhR1ZwWjJoMFBTSXdMamc0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05qQXdOVGcySURBdU1EWXdNRFU0TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWZkMTY3ZDM3LTQzN2YtNGQ4Ny1hYmUwLTAwY2ZjMDFlOTY5ZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVk5FVDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE2NyIgeT0iMjIiIHdpZHRoPSI5OTEiIGhlaWdodD0iNDgyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyMiIgdmFsdWU9IlN1Ym5ldCAxIC0+IEF6dXJlIExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9YjZiNTRiYWYtN2Q3My00ZmM2LTg1ZDYtNDJlMTcwYWFiZjA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNSIgc291cmNlPSI2IiB0YXJnZXQ9IjE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzE2IiB5PSIxMjQiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJTdWJuZXQgMSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjYiPjxteENlbGwgc3R5bGU9ImlyLnJlZj00ZTZhYzgxNC1kN2FjLTQ4MTAtYjFkNC03ZDE5OWU0ZjE3MjA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDMiIHk9IjM5IiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjM3MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTAiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1mMmJkMmMwNC0zMGYzLTQ4ZjItOTk1OC03YzY4NjM4YjBhZjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzMiIgeT0iMjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIzIiB2YWx1ZT0iU3VibmV0IDIgLT4gQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj1iNWY4MGE3Ny1mN2Q2LTQ3NzQtOWYzZS05ZWRjOThkMGU1MDY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI1IiBzb3VyY2U9IjciIHRhcmdldD0iMTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI2NDQiIHk9IjEyNSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlN1Ym5ldCAyIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTg0NzA4ZDEwLWYwYmEtNGMwZS1hOWEyLWUyNDk0ZmY1YzUzZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNjMiIHk9IjM1IiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjM3NSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1iY2U1NzYzMi1hMDg1LTQ1OGUtYmMzZC04NjU3MDkxYjg4NjQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzMCIgeT0iMjMzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE2IiB2YWx1ZT0iQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj1lZjZlMTI1YS1kNThiLTRjODYtOGY1Ny0wNzUwZDE0NTNiM2Q7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TURrNU16QTVOaUF3TGpRNE5EQXdPRXd3TGpRMk9EZzNNU0F3TGpBeU5UQTJOemRETUM0ME56RTVNamtnTUM0d01qRTVNalE1SURBdU5EYzFOVGcySURBdU1ERTVOREkyT1NBd0xqUTNPVFl5TmlBd0xqQXhOemN5TVRKRE1DNDBPRE0yTmpZZ01DNHdNVFl3TVRVMUlEQXVORGc0TURBM0lEQXVNREUxTVRNMk55QXdMalE1TWpNNU1pQXdMakF4TlRFek5qZERNQzQwT1RZM056Y2dNQzR3TVRVeE16WTNJREF1TlRBeE1URTRJREF1TURFMk1ERTFOU0F3TGpVd05URTFPQ0F3TGpBeE56Y3lNVEpETUM0MU1Ea3hPVGdnTUM0d01UazBNalk1SURBdU5URXlPRFUxSURBdU1ESXhPVEkwT1NBd0xqVXhOVGt4TXlBd0xqQXlOVEEyTnpkTU1DNDVOelE0TlRNZ01DNDBPRFF3TURoRE1DNDVOemM1T1RZZ01DNDBPRGN3TmpZZ01DNDVPREEwT1RRZ01DNDBPVEEzTWpNZ01DNDVPREl4T1RrZ01DNDBPVFEzTmpORE1DNDVPRE01TURVZ01DNDBPVGc0TURNZ01DNDVPRFEzT0RRZ01DNDFNRE14TkRRZ01DNDVPRFEzT0RRZ01DNDFNRGMxTWpsRE1DNDVPRFEzT0RRZ01DNDFNVEU1TVRRZ01DNDVPRE01TURVZ01DNDFNVFl5TlRVZ01DNDVPREl4T1RrZ01DNDFNakF5T1RWRE1DNDVPREEwT1RRZ01DNDFNalF6TXpVZ01DNDVOemM1T1RZZ01DNDFNamM1T1RJZ01DNDVOelE0TlRNZ01DNDFNekV3TlV3d0xqVXhOVE0yTmlBd0xqazVNRFV6TjBNd0xqVXdPVEl6TVNBd0xqazVOalUxTVNBd0xqVXdNRGs0TXlBd0xqazVPVGt4T1NBd0xqUTVNak01TWlBd0xqazVPVGt4T1VNd0xqUTRNemd3TVNBd0xqazVPVGt4T1NBd0xqUTNOVFUxTXlBd0xqazVOalUxTVNBd0xqUTJPVFF4T0NBd0xqazVNRFV6TjB3d0xqQXdPVGt6TURrMklEQXVOVE14TURWRE1DNHdNRFkzT0RneUlEQXVOVEkzT1RreUlEQXVNREEwTWprd01pQXdMalV5TkRNek5TQXdMakF3TWpVNE5EVWdNQzQxTWpBeU9UVkRNQzR3TURBNE56ZzRNRElnTUM0MU1UWXlOVFVnTUNBd0xqVXhNVGt4TkNBd0lEQXVOVEEzTlRJNVF6QWdNQzQxTURNeE5EUWdNQzR3TURBNE56ZzRNRElnTUM0ME9UZzRNRE1nTUM0d01ESTFPRFExSURBdU5EazBOell6UXpBdU1EQTBNamt3TWlBd0xqUTVNRGN5TXlBd0xqQXdOamM0T0RJZ01DNDBPRGN3TmpZZ01DNHdNRGs1TXpBNU5pQXdMalE0TkRBd09GWXdMalE0TkRBd09Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall4TWpRNE5TQXdMakl6TkRJM04wd3dMalE1TmpVeE9TQXdMakV4T0RnMU9VTXdMalE1TlRNeE5pQXdMakV4TnpjNE15QXdMalE1TXpjMU9DQXdMakV4TnpFNE9DQXdMalE1TWpFME15QXdMakV4TnpFNE9FTXdMalE1TURVeU9DQXdMakV4TnpFNE9DQXdMalE0T0RrM0lEQXVNVEUzTnpneklEQXVORGczTnpZM0lEQXVNVEU0T0RVNVREQXVNemN4T0RBeElEQXVNak0wTWpjM1F6QXVNemN3TnpNMElEQXVNak0wT1RrMUlEQXVNelk1T1RVMElEQXVNak0yTURZM0lEQXVNelk1TlRrNElEQXVNak0zTXpBelF6QXVNelk1TWpReUlEQXVNak00TlRNNUlEQXVNelk1TXpNMElEQXVNak01T0RZeElEQXVNelk1T0RVMklEQXVNalF4TURNM1F6QXVNemN3TXpjNUlEQXVNalF5TWpFeUlEQXVNemN4TWprNUlEQXVNalF6TVRZMklEQXVNemN5TkRVMUlEQXVNalF6TnpNeFF6QXVNemN6TmpFeElEQXVNalEwTWprMUlEQXVNemMwT1RJNUlEQXVNalEwTkRNMElEQXVNemMyTVRjM0lEQXVNalEwTVRJelNEQXVORFEwTURBMlF6QXVORFEwTnprMklEQXVNalEwTVRJeklEQXVORFExTlRjNUlEQXVNalEwTWpjNUlEQXVORFEyTXpBNUlEQXVNalEwTlRneFF6QXVORFEzTURNNUlEQXVNalEwT0RnMElEQXVORFEzTnpBeUlEQXVNalExTXpJM0lEQXVORFE0TWpZeElEQXVNalExT0RnMVF6QXVORFE0T0RJZ01DNHlORFkwTkRRZ01DNDBORGt5TmpNZ01DNHlORGN4TURnZ01DNDBORGsxTmpVZ01DNHlORGM0TXpoRE1DNDBORGs0TmpnZ01DNHlORGcxTmpnZ01DNDBOVEF3TWpNZ01DNHlORGt6TlNBd0xqUTFNREF5TXlBd0xqSTFNREUwVmpBdU16VTVOVFF4UXpBdU5EVXdNREl6SURBdU16WXhNVE0zSURBdU5EVXdOalUzSURBdU16WXlOalkzSURBdU5EVXhOemcySURBdU16WXpOemsyUXpBdU5EVXlPVEUwSURBdU16WTBPVEkwSURBdU5EVTBORFExSURBdU16WTFOVFU0SURBdU5EVTJNRFFnTUM0ek5qVTFOVGhJTUM0MU1qZ3lORFZETUM0MU1qazROREVnTUM0ek5qVTFOVGdnTUM0MU16RXpOeklnTUM0ek5qUTVNalFnTUM0MU16STFJREF1TXpZek56azJRekF1TlRNek5qSTVJREF1TXpZeU5qWTNJREF1TlRNME1qWXpJREF1TXpZeE1UTTNJREF1TlRNME1qWXpJREF1TXpVNU5UUXhWakF1TWpVd01UUkRNQzQxTXpReU5qTWdNQzR5TkRrek5TQXdMalV6TkRReE9DQXdMakkwT0RVMk9DQXdMalV6TkRjeU1TQXdMakkwTnpnek9FTXdMalV6TlRBeU15QXdMakkwTnpFd09DQXdMalV6TlRRMk5pQXdMakkwTmpRME5DQXdMalV6TmpBeU5TQXdMakkwTlRnNE5VTXdMalV6TmpVNE5DQXdMakkwTlRNeU55QXdMalV6TnpJME55QXdMakkwTkRnNE5DQXdMalV6TnprM055QXdMakkwTkRVNE1VTXdMalV6T0Rjd055QXdMakkwTkRJM09TQXdMalV6T1RRNE9TQXdMakkwTkRFeU15QXdMalUwTURJNElEQXVNalEwTVRJelNEQXVOakE0TVRBNVF6QXVOakE1TXpVM0lEQXVNalEwTkRNMElEQXVOakV3TmpjMUlEQXVNalEwTWprMUlEQXVOakV4T0RNeElEQXVNalF6TnpNeFF6QXVOakV5T1RnM0lEQXVNalF6TVRZMklEQXVOakV6T1RBM0lEQXVNalF5TWpFeUlEQXVOakUwTkRNZ01DNHlOREV3TXpkRE1DNDJNVFE1TlRJZ01DNHlNems0TmpFZ01DNDJNVFV3TkRRZ01DNHlNemcxTXprZ01DNDJNVFEyT0RnZ01DNHlNemN6TURORE1DNDJNVFF6TXpJZ01DNHlNell3TmpjZ01DNDJNVE0xTlRJZ01DNHlNelE1T1RVZ01DNDJNVEkwT0RVZ01DNHlNelF5TnpkV01DNHlNelF5TnpkYUlpQm1hV3hzUFNJalFqUkZRek0ySWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU1UZzNPRElnTUM0ek56Y3dNVGRNTUM0eE1ETTVNU0F3TGpRNU16VXpRekF1TVRBeU9EY3lJREF1TkRrME5qUXpJREF1TVRBeU1qazFJREF1TkRrMk1UQTVJREF1TVRBeU1qazFJREF1TkRrM05qTXlRekF1TVRBeU1qazFJREF1TkRrNU1UVTFJREF1TVRBeU9EY3lJREF1TlRBd05qSXhJREF1TVRBek9URWdNQzQxTURFM016Vk1NQzR5TVRnM09ESWdNQzQyTVRjeE5UTkRNQzR5TVRrMk1qTWdNQzQyTVRnd05EWWdNQzR5TWpBM01UY2dNQzQyTVRnMk5qRWdNQzR5TWpFNU1UZ2dNQzQyTVRnNU1UVkRNQzR5TWpNeE1UZ2dNQzQyTVRreE5qa2dNQzR5TWpRek5qZ2dNQzQyTVRrd05TQXdMakl5TlRRNU9TQXdMall4T0RVM05FTXdMakl5TmpZeU9TQXdMall4T0RBNU9DQXdMakl5TnpVNE9DQXdMall4TnpJNE9DQXdMakl5T0RJME5TQXdMall4TmpJMU1VTXdMakl5T0Rrd01pQXdMall4TlRJeE5TQXdMakl5T1RJeU55QXdMall4TkRBd015QXdMakl5T1RFM05TQXdMall4TWpjM04xWXdMalUwTlRRNU5VTXdMakl5T1RFM05TQXdMalUwTXpnNU9TQXdMakl5T1Rnd09TQXdMalUwTWpNMk9TQXdMakl6TURrek9DQXdMalUwTVRJMFF6QXVNak15TURZMklEQXVOVFF3TVRFeUlEQXVNak16TlRrM0lEQXVOVE01TkRjNElEQXVNak0xTVRreUlEQXVOVE01TkRjNFNEQXVNelEwTlRrMFF6QXVNelExTXpZeElEQXVOVE01TkRneUlEQXVNelEyTVRJZ01DNDFNemt6TWpRZ01DNHpORFk0TWpJZ01DNDFNemt3TVRaRE1DNHpORGMxTWpRZ01DNDFNemczTURnZ01DNHpORGd4TlRNZ01DNDFNemd5TlRVZ01DNHpORGcyTmprZ01DNDFNemMyT0RoRE1DNHpORGt4T0RVZ01DNDFNemN4TWlBd0xqTTBPVFUzTmlBd0xqVXpOalExTVNBd0xqTTBPVGd4TmlBd0xqVXpOVGN5TTBNd0xqTTFNREExTmlBd0xqVXpORGs1TkNBd0xqTTFNREUwTVNBd0xqVXpOREl5TkNBd0xqTTFNREEyTkNBd0xqVXpNelEyTVZZd0xqUTJNVEkxTmtNd0xqTTFNRFV5TWlBd0xqUTJNRFE0T1NBd0xqTTFNRGM0TlNBd0xqUTFPVFl5TWlBd0xqTTFNRGd6TVNBd0xqUTFPRGN6UXpBdU16VXdPRGMySURBdU5EVTNPRE00SURBdU16VXdOekF5SURBdU5EVTJPVFE0SURBdU16VXdNekkxSURBdU5EVTJNVE01UXpBdU16UTVPVFEzSURBdU5EVTFNekk1SURBdU16UTVNemMzSURBdU5EVTBOakkxSURBdU16UTROalkwSURBdU5EVTBNRGcyUXpBdU16UTNPVFV4SURBdU5EVXpOVFE0SURBdU16UTNNVEUzSURBdU5EVXpNVGt6SURBdU16UTJNak0xSURBdU5EVXpNRFV4U0RBdU1qTTJPRE16UXpBdU1qTTJNRGN4SURBdU5EVXpNVEk0SURBdU1qTTFNeUF3TGpRMU16QTBNeUF3TGpJek5EVTNNaUF3TGpRMU1qZ3dNME13TGpJek16ZzBOQ0F3TGpRMU1qVTJNeUF3TGpJek16RTNOQ0F3TGpRMU1qRTNNaUF3TGpJek1qWXdOeUF3TGpRMU1UWTFOa013TGpJek1qQXpPU0F3TGpRMU1URTBJREF1TWpNeE5UZzNJREF1TkRVd05URXhJREF1TWpNeE1qYzRJREF1TkRRNU9EQTVRekF1TWpNd09UY2dNQzQwTkRreE1EY2dNQzR5TXpBNE1UTWdNQzQwTkRnek5EZ2dNQzR5TXpBNE1UWWdNQzQwTkRjMU9ERldNQzR6T0RFek9UTkRNQzR5TXpFek9UY2dNQzR6TnprM09UY2dNQzR5TXpFek1Ua2dNQzR6Tnpnd016WWdNQzR5TXpBMk1ERWdNQzR6TnpZME9UaERNQzR5TWprNE9ETWdNQzR6TnpRNU5Ua2dNQzR5TWpnMU9ETWdNQzR6TnpNM05qa2dNQzR5TWpZNU9EY2dNQzR6TnpNeE9EaERNQzR5TWpVek9URWdNQzR6TnpJMk1EZ2dNQzR5TWpNMk15QXdMak0zTWpZNE5TQXdMakl5TWpBNU1pQXdMak0zTXpRd00wTXdMakl5TURVMU15QXdMak0zTkRFeU1TQXdMakl4T1RNMk1pQXdMak0zTlRReU1TQXdMakl4T0RjNE1pQXdMak0zTnpBeE4xb2lJR1pwYkd3OUlpTkNORVZETXpZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzNNREUyTnlBd0xqWXhOekF3TkV3d0xqZzROalk0SURBdU5UQXhNRE01UXpBdU9EZzNOekU0SURBdU5EazVPVEkxSURBdU9EZzRNamsxSURBdU5EazRORFU1SURBdU9EZzRNamsxSURBdU5EazJPVE0yUXpBdU9EZzRNamsxSURBdU5EazFOREUwSURBdU9EZzNOekU0SURBdU5Ea3pPVFE0SURBdU9EZzJOamdnTUM0ME9USTRNelJNTUM0M056QXhOamNnTUM0ek56WTROamxETUM0M05qa3pNRFFnTUM0ek56WXhOVFVnTUM0M05qZ3lOVGtnTUM0ek56VTJPVFlnTUM0M05qY3hOU0F3TGpNM05UVTBORU13TGpjMk5qQTBNU0F3TGpNM05UTTVNaUF3TGpjMk5Ea3hNU0F3TGpNM05UVTFNaUF3TGpjMk16ZzRPQ0F3TGpNM05qQXdOME13TGpjMk1qZzJOU0F3TGpNM05qUTJNaUF3TGpjMk1UazRPU0F3TGpNM056RTVNeUF3TGpjMk1UTTFPU0F3TGpNM09ERXhPRU13TGpjMk1EY3lPU0F3TGpNM09UQTBNeUF3TGpjMk1ETTJPU0F3TGpNNE1ERXlOaUF3TGpjMk1ETXlNU0F3TGpNNE1USTBOVll3TGpRME9UWXlRekF1TnpZd016STBJREF1TkRVd016ZzNJREF1TnpZd01UWTNJREF1TkRVeE1UUTJJREF1TnpVNU9EVTVJREF1TkRVeE9EUTRRekF1TnpVNU5UVWdNQzQwTlRJMU5TQXdMamMxT1RBNU9DQXdMalExTXpFNElEQXVOelU0TlRNZ01DNDBOVE0yT1RWRE1DNDNOVGM1TmpNZ01DNDBOVFF5TVRFZ01DNDNOVGN5T1RNZ01DNDBOVFEyTURJZ01DNDNOVFkxTmpVZ01DNDBOVFE0TkRKRE1DNDNOVFU0TXpjZ01DNDBOVFV3T0RNZ01DNDNOVFV3TmpjZ01DNDBOVFV4TmpjZ01DNDNOVFF6TURRZ01DNDBOVFV3T1Vnd0xqWTBORGt3TWtNd0xqWTBOREV6TlNBd0xqUTFOVEE0TnlBd0xqWTBNek0zTmlBd0xqUTFOVEkwTkNBd0xqWTBNalkzTkNBd0xqUTFOVFUxTWtNd0xqWTBNVGszTWlBd0xqUTFOVGcyTVNBd0xqWTBNVE0wTXlBd0xqUTFOak14TXlBd0xqWTBNRGd5TnlBd0xqUTFOamc0TVVNd0xqWTBNRE14TVNBd0xqUTFOelEwT0NBd0xqWXpPVGt5SURBdU5EVTRNVEU0SURBdU5qTTVOamdnTUM0ME5UZzRORFpETUM0Mk16azBOQ0F3TGpRMU9UVTNOQ0F3TGpZek9UTTFOU0F3TGpRMk1ETTBOQ0F3TGpZek9UUXpNaUF3TGpRMk1URXdOMVl3TGpVek16TXhNa013TGpZek9UTTFOU0F3TGpVek5EQTNOU0F3TGpZek9UUTBJREF1TlRNME9EUTJJREF1TmpNNU5qZ2dNQzQxTXpVMU56UkRNQzQyTXprNU1pQXdMalV6TmpNd01pQXdMalkwTURNeE1TQXdMalV6TmprM01pQXdMalkwTURneU55QXdMalV6TnpVek9VTXdMalkwTVRNME15QXdMalV6T0RFd05pQXdMalkwTVRrM01pQXdMalV6T0RVMU9TQXdMalkwTWpZM05DQXdMalV6T0RnMk4wTXdMalkwTXpNM05pQXdMalV6T1RFM05pQXdMalkwTkRFek5TQXdMalV6T1RNek15QXdMalkwTkRrd01pQXdMalV6T1RNeU9VZ3dMamMxTkRNd05FTXdMamMxTlRnNU9TQXdMalV6T1RNeU9TQXdMamMxTnpReklEQXVOVE01T1RZeklEQXVOelU0TlRVNElEQXVOVFF4TURreVF6QXVOelU1TmpnM0lEQXVOVFF5TWpJZ01DNDNOakF6TWpFZ01DNDFORE0zTlRFZ01DNDNOakF6TWpFZ01DNDFORFV6TkRaV01DNDJNVE14TnpWRE1DNDNOakEwTlRrZ01DNDJNVFF5TkRjZ01DNDNOakE0T0RRZ01DNDJNVFV5TmpJZ01DNDNOakUxTlNBd0xqWXhOakV4TTBNd0xqYzJNakl4TnlBd0xqWXhOamsyTkNBd0xqYzJNekVnTUM0Mk1UYzJNaUF3TGpjMk5ERXdOeUF3TGpZeE9EQXhNa013TGpjMk5URXhOU0F3TGpZeE9EUXdOQ0F3TGpjMk5qSXdPU0F3TGpZeE9EVXhOeUF3TGpjMk56STNOU0F3TGpZeE9ETTBRekF1TnpZNE16UXlJREF1TmpFNE1UWXlJREF1TnpZNU16UWdNQzQyTVRjM01ERWdNQzQzTnpBeE5qY2dNQzQyTVRjd01EUldNQzQyTVRjd01EUmFJaUJtYVd4c1BTSWpRalJGUXpNMklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFV3TnpJZ01DNDFNRGM0TURoRE1DNDJORFV5TkRnZ01DNDBOemt6TlRFZ01DNDJNemMwTmpRZ01DNDBOVEUwTVRFZ01DNDJNakkxT1RrZ01DNDBNamN4TkRSRE1DNDJNRGMzTXpRZ01DNDBNREk0TnpnZ01DNDFPRFl6T0NBd0xqTTRNekkxSURBdU5UWXdPVFE1SURBdU16Y3dORGM1UXpBdU5UTTFOVEU0SURBdU16VTNOekE0SURBdU5UQTNNREl5SURBdU16VXlNekF5SURBdU5EYzROamdnTUM0ek5UUTROekZETUM0ME5UQXpNemtnTUM0ek5UYzBOREVnTUM0ME1qTXlPQ0F3TGpNMk56ZzRNeUF3TGpRd01EVTJJREF1TXpnMU1ERTVRekF1TXpjM09EUWdNQzQwTURJeE5UVWdNQzR6TmpBek5qUWdNQzQwTWpVek1ETWdNQzR6TlRBeE1EVWdNQzQwTlRFNE5EZERNQzR6TXprNE5EWWdNQzQwTnpnek9URWdNQzR6TXpjeU1UUWdNQzQxTURjeU56VWdNQzR6TkRJMU1EVWdNQzQxTXpVeU16ZERNQzR6TkRjM09UWWdNQzQxTmpNeE9UZ2dNQzR6TmpBM09Ua2dNQzQxT0RreE1qTWdNQzR6T0RBd05EY2dNQzQyTVRBd09EUkRNQzR6T1RreU9UVWdNQzQyTXpFd05EVWdNQzQwTWpRd01pQXdMalkwTmpJd055QXdMalExTVRRek1TQXdMalkxTXpnMU9GWXdMamN3TlRneU0wTXdMalF6TWpnd05TQXdMamN4TlRRME55QXdMalF4TnprMU15QXdMamN6TVRBME9TQXdMalF3T1RJMU9DQXdMamMxTURFeU5rTXdMalF3TURVMk1pQXdMamMyT1RJd01pQXdMak01T0RVeU55QXdMamM1TURZME5pQXdMalF3TXpRM09TQXdMamd4TVRBeE4wTXdMalF3T0RRek1pQXdMamd6TVRNNE9TQXdMalF5TURBNE5DQXdMamcwT1RVd05pQXdMalF6TmpVMk5pQXdMamcyTWpRMk1VTXdMalExTXpBME9TQXdMamczTlRReE55QXdMalEzTXpRd05pQXdMamc0TWpRMklEQXVORGswTXpjeElEQXVPRGd5TkRaRE1DNDFNVFV6TXpZZ01DNDRPREkwTmlBd0xqVXpOVFk1TXlBd0xqZzNOVFF4TnlBd0xqVTFNakUzTlNBd0xqZzJNalEyTVVNd0xqVTJPRFkxT0NBd0xqZzBPVFV3TmlBd0xqVTRNRE14SURBdU9ETXhNemc1SURBdU5UZzFNall5SURBdU9ERXhNREUzUXpBdU5Ua3dNakUwSURBdU56a3dOalEySURBdU5UZzRNVGM1SURBdU56WTVNakF5SURBdU5UYzVORGcwSURBdU56VXdNVEkyUXpBdU5UY3dOemc0SURBdU56TXhNRFE1SURBdU5UVTFPVE0ySURBdU56RTFORFEzSURBdU5UTTNNekV4SURBdU56QTFPREl6VmpBdU5qVXhNVEl6UXpBdU5UWTRNVGcySURBdU5qUXhPREV4SURBdU5UazFNamcySURBdU5qSXlPRGt5SURBdU5qRTBOalkySURBdU5UazNNVEUyUXpBdU5qTTBNRFEzSURBdU5UY3hNelF4SURBdU5qUTBOams1SURBdU5UUXdNRFUwSURBdU5qUTFNRGN5SURBdU5UQTNPREE0VmpBdU5UQTNPREE0V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TWpreE1pQXdMalU1TlRZNE4wTXdMalUwTVRnMU15QXdMalU1TlRZNE55QXdMalU0TVRVeU9DQXdMalUxTmpBeE15QXdMalU0TVRVeU9DQXdMalV3TnpBM01rTXdMalU0TVRVeU9DQXdMalExT0RFek1TQXdMalUwTVRnMU15QXdMalF4T0RRMU55QXdMalE1TWpreE1pQXdMalF4T0RRMU4wTXdMalEwTXprM01TQXdMalF4T0RRMU55QXdMalF3TkRJNU55QXdMalExT0RFek1TQXdMalF3TkRJNU55QXdMalV3TnpBM01rTXdMalF3TkRJNU55QXdMalUxTmpBeE15QXdMalEwTXprM01TQXdMalU1TlRZNE55QXdMalE1TWpreE1pQXdMalU1TlRZNE4xb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RJek9USWlJSGt4UFNJeExqRXdNVEF6SWlCNE1qMGlNQzQwT1RJek9USWlJSGt5UFNJdE1DNHdOREExTnpNeklpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpOVVU1TmpJMElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TURJaUlITjBiM0F0WTI5c2IzSTlJaU0xUmprM01qUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJemMyUWtNeVJDSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTkiIHk9IjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlN1Ym5ldCAzIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iOCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTMzODhkYzgxLThkZDItNDA1Mi1hZDZjLTBiYjA5OTQwZTViZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MDYiIHk9IjM1IiB3aWR0aD0iMjQzIiBoZWlnaHQ9IjM3MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTIiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1lZjEyNmViMi1jMzU1LTRhMmItYTc5NS0xZjJkMGY4ZjU4NmM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzNyIgeT0iMjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE3IiB2YWx1ZT0iQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0yZDMxODAxZS0yNjUwLTQ5MzQtYmVjMC1jNGM3OTBlZWQ2NzQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TURrNU16QTVOaUF3TGpRNE5EQXdPRXd3TGpRMk9EZzNNU0F3TGpBeU5UQTJOemRETUM0ME56RTVNamtnTUM0d01qRTVNalE1SURBdU5EYzFOVGcySURBdU1ERTVOREkyT1NBd0xqUTNPVFl5TmlBd0xqQXhOemN5TVRKRE1DNDBPRE0yTmpZZ01DNHdNVFl3TVRVMUlEQXVORGc0TURBM0lEQXVNREUxTVRNMk55QXdMalE1TWpNNU1pQXdMakF4TlRFek5qZERNQzQwT1RZM056Y2dNQzR3TVRVeE16WTNJREF1TlRBeE1URTRJREF1TURFMk1ERTFOU0F3TGpVd05URTFPQ0F3TGpBeE56Y3lNVEpETUM0MU1Ea3hPVGdnTUM0d01UazBNalk1SURBdU5URXlPRFUxSURBdU1ESXhPVEkwT1NBd0xqVXhOVGt4TXlBd0xqQXlOVEEyTnpkTU1DNDVOelE0TlRNZ01DNDBPRFF3TURoRE1DNDVOemM1T1RZZ01DNDBPRGN3TmpZZ01DNDVPREEwT1RRZ01DNDBPVEEzTWpNZ01DNDVPREl4T1RrZ01DNDBPVFEzTmpORE1DNDVPRE01TURVZ01DNDBPVGc0TURNZ01DNDVPRFEzT0RRZ01DNDFNRE14TkRRZ01DNDVPRFEzT0RRZ01DNDFNRGMxTWpsRE1DNDVPRFEzT0RRZ01DNDFNVEU1TVRRZ01DNDVPRE01TURVZ01DNDFNVFl5TlRVZ01DNDVPREl4T1RrZ01DNDFNakF5T1RWRE1DNDVPREEwT1RRZ01DNDFNalF6TXpVZ01DNDVOemM1T1RZZ01DNDFNamM1T1RJZ01DNDVOelE0TlRNZ01DNDFNekV3TlV3d0xqVXhOVE0yTmlBd0xqazVNRFV6TjBNd0xqVXdPVEl6TVNBd0xqazVOalUxTVNBd0xqVXdNRGs0TXlBd0xqazVPVGt4T1NBd0xqUTVNak01TWlBd0xqazVPVGt4T1VNd0xqUTRNemd3TVNBd0xqazVPVGt4T1NBd0xqUTNOVFUxTXlBd0xqazVOalUxTVNBd0xqUTJPVFF4T0NBd0xqazVNRFV6TjB3d0xqQXdPVGt6TURrMklEQXVOVE14TURWRE1DNHdNRFkzT0RneUlEQXVOVEkzT1RreUlEQXVNREEwTWprd01pQXdMalV5TkRNek5TQXdMakF3TWpVNE5EVWdNQzQxTWpBeU9UVkRNQzR3TURBNE56ZzRNRElnTUM0MU1UWXlOVFVnTUNBd0xqVXhNVGt4TkNBd0lEQXVOVEEzTlRJNVF6QWdNQzQxTURNeE5EUWdNQzR3TURBNE56ZzRNRElnTUM0ME9UZzRNRE1nTUM0d01ESTFPRFExSURBdU5EazBOell6UXpBdU1EQTBNamt3TWlBd0xqUTVNRGN5TXlBd0xqQXdOamM0T0RJZ01DNDBPRGN3TmpZZ01DNHdNRGs1TXpBNU5pQXdMalE0TkRBd09GWXdMalE0TkRBd09Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall4TWpRNE5TQXdMakl6TkRJM04wd3dMalE1TmpVeE9TQXdMakV4T0RnMU9VTXdMalE1TlRNeE5pQXdMakV4TnpjNE15QXdMalE1TXpjMU9DQXdMakV4TnpFNE9DQXdMalE1TWpFME15QXdMakV4TnpFNE9FTXdMalE1TURVeU9DQXdMakV4TnpFNE9DQXdMalE0T0RrM0lEQXVNVEUzTnpneklEQXVORGczTnpZM0lEQXVNVEU0T0RVNVREQXVNemN4T0RBeElEQXVNak0wTWpjM1F6QXVNemN3TnpNMElEQXVNak0wT1RrMUlEQXVNelk1T1RVMElEQXVNak0yTURZM0lEQXVNelk1TlRrNElEQXVNak0zTXpBelF6QXVNelk1TWpReUlEQXVNak00TlRNNUlEQXVNelk1TXpNMElEQXVNak01T0RZeElEQXVNelk1T0RVMklEQXVNalF4TURNM1F6QXVNemN3TXpjNUlEQXVNalF5TWpFeUlEQXVNemN4TWprNUlEQXVNalF6TVRZMklEQXVNemN5TkRVMUlEQXVNalF6TnpNeFF6QXVNemN6TmpFeElEQXVNalEwTWprMUlEQXVNemMwT1RJNUlEQXVNalEwTkRNMElEQXVNemMyTVRjM0lEQXVNalEwTVRJelNEQXVORFEwTURBMlF6QXVORFEwTnprMklEQXVNalEwTVRJeklEQXVORFExTlRjNUlEQXVNalEwTWpjNUlEQXVORFEyTXpBNUlEQXVNalEwTlRneFF6QXVORFEzTURNNUlEQXVNalEwT0RnMElEQXVORFEzTnpBeUlEQXVNalExTXpJM0lEQXVORFE0TWpZeElEQXVNalExT0RnMVF6QXVORFE0T0RJZ01DNHlORFkwTkRRZ01DNDBORGt5TmpNZ01DNHlORGN4TURnZ01DNDBORGsxTmpVZ01DNHlORGM0TXpoRE1DNDBORGs0TmpnZ01DNHlORGcxTmpnZ01DNDBOVEF3TWpNZ01DNHlORGt6TlNBd0xqUTFNREF5TXlBd0xqSTFNREUwVmpBdU16VTVOVFF4UXpBdU5EVXdNREl6SURBdU16WXhNVE0zSURBdU5EVXdOalUzSURBdU16WXlOalkzSURBdU5EVXhOemcySURBdU16WXpOemsyUXpBdU5EVXlPVEUwSURBdU16WTBPVEkwSURBdU5EVTBORFExSURBdU16WTFOVFU0SURBdU5EVTJNRFFnTUM0ek5qVTFOVGhJTUM0MU1qZ3lORFZETUM0MU1qazROREVnTUM0ek5qVTFOVGdnTUM0MU16RXpOeklnTUM0ek5qUTVNalFnTUM0MU16STFJREF1TXpZek56azJRekF1TlRNek5qSTVJREF1TXpZeU5qWTNJREF1TlRNME1qWXpJREF1TXpZeE1UTTNJREF1TlRNME1qWXpJREF1TXpVNU5UUXhWakF1TWpVd01UUkRNQzQxTXpReU5qTWdNQzR5TkRrek5TQXdMalV6TkRReE9DQXdMakkwT0RVMk9DQXdMalV6TkRjeU1TQXdMakkwTnpnek9FTXdMalV6TlRBeU15QXdMakkwTnpFd09DQXdMalV6TlRRMk5pQXdMakkwTmpRME5DQXdMalV6TmpBeU5TQXdMakkwTlRnNE5VTXdMalV6TmpVNE5DQXdMakkwTlRNeU55QXdMalV6TnpJME55QXdMakkwTkRnNE5DQXdMalV6TnprM055QXdMakkwTkRVNE1VTXdMalV6T0Rjd055QXdMakkwTkRJM09TQXdMalV6T1RRNE9TQXdMakkwTkRFeU15QXdMalUwTURJNElEQXVNalEwTVRJelNEQXVOakE0TVRBNVF6QXVOakE1TXpVM0lEQXVNalEwTkRNMElEQXVOakV3TmpjMUlEQXVNalEwTWprMUlEQXVOakV4T0RNeElEQXVNalF6TnpNeFF6QXVOakV5T1RnM0lEQXVNalF6TVRZMklEQXVOakV6T1RBM0lEQXVNalF5TWpFeUlEQXVOakUwTkRNZ01DNHlOREV3TXpkRE1DNDJNVFE1TlRJZ01DNHlNems0TmpFZ01DNDJNVFV3TkRRZ01DNHlNemcxTXprZ01DNDJNVFEyT0RnZ01DNHlNemN6TURORE1DNDJNVFF6TXpJZ01DNHlNell3TmpjZ01DNDJNVE0xTlRJZ01DNHlNelE1T1RVZ01DNDJNVEkwT0RVZ01DNHlNelF5TnpkV01DNHlNelF5TnpkYUlpQm1hV3hzUFNJalFqUkZRek0ySWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU1UZzNPRElnTUM0ek56Y3dNVGRNTUM0eE1ETTVNU0F3TGpRNU16VXpRekF1TVRBeU9EY3lJREF1TkRrME5qUXpJREF1TVRBeU1qazFJREF1TkRrMk1UQTVJREF1TVRBeU1qazFJREF1TkRrM05qTXlRekF1TVRBeU1qazFJREF1TkRrNU1UVTFJREF1TVRBeU9EY3lJREF1TlRBd05qSXhJREF1TVRBek9URWdNQzQxTURFM016Vk1NQzR5TVRnM09ESWdNQzQyTVRjeE5UTkRNQzR5TVRrMk1qTWdNQzQyTVRnd05EWWdNQzR5TWpBM01UY2dNQzQyTVRnMk5qRWdNQzR5TWpFNU1UZ2dNQzQyTVRnNU1UVkRNQzR5TWpNeE1UZ2dNQzQyTVRreE5qa2dNQzR5TWpRek5qZ2dNQzQyTVRrd05TQXdMakl5TlRRNU9TQXdMall4T0RVM05FTXdMakl5TmpZeU9TQXdMall4T0RBNU9DQXdMakl5TnpVNE9DQXdMall4TnpJNE9DQXdMakl5T0RJME5TQXdMall4TmpJMU1VTXdMakl5T0Rrd01pQXdMall4TlRJeE5TQXdMakl5T1RJeU55QXdMall4TkRBd015QXdMakl5T1RFM05TQXdMall4TWpjM04xWXdMalUwTlRRNU5VTXdMakl5T1RFM05TQXdMalUwTXpnNU9TQXdMakl5T1Rnd09TQXdMalUwTWpNMk9TQXdMakl6TURrek9DQXdMalUwTVRJMFF6QXVNak15TURZMklEQXVOVFF3TVRFeUlEQXVNak16TlRrM0lEQXVOVE01TkRjNElEQXVNak0xTVRreUlEQXVOVE01TkRjNFNEQXVNelEwTlRrMFF6QXVNelExTXpZeElEQXVOVE01TkRneUlEQXVNelEyTVRJZ01DNDFNemt6TWpRZ01DNHpORFk0TWpJZ01DNDFNemt3TVRaRE1DNHpORGMxTWpRZ01DNDFNemczTURnZ01DNHpORGd4TlRNZ01DNDFNemd5TlRVZ01DNHpORGcyTmprZ01DNDFNemMyT0RoRE1DNHpORGt4T0RVZ01DNDFNemN4TWlBd0xqTTBPVFUzTmlBd0xqVXpOalExTVNBd0xqTTBPVGd4TmlBd0xqVXpOVGN5TTBNd0xqTTFNREExTmlBd0xqVXpORGs1TkNBd0xqTTFNREUwTVNBd0xqVXpOREl5TkNBd0xqTTFNREEyTkNBd0xqVXpNelEyTVZZd0xqUTJNVEkxTmtNd0xqTTFNRFV5TWlBd0xqUTJNRFE0T1NBd0xqTTFNRGM0TlNBd0xqUTFPVFl5TWlBd0xqTTFNRGd6TVNBd0xqUTFPRGN6UXpBdU16VXdPRGMySURBdU5EVTNPRE00SURBdU16VXdOekF5SURBdU5EVTJPVFE0SURBdU16VXdNekkxSURBdU5EVTJNVE01UXpBdU16UTVPVFEzSURBdU5EVTFNekk1SURBdU16UTVNemMzSURBdU5EVTBOakkxSURBdU16UTROalkwSURBdU5EVTBNRGcyUXpBdU16UTNPVFV4SURBdU5EVXpOVFE0SURBdU16UTNNVEUzSURBdU5EVXpNVGt6SURBdU16UTJNak0xSURBdU5EVXpNRFV4U0RBdU1qTTJPRE16UXpBdU1qTTJNRGN4SURBdU5EVXpNVEk0SURBdU1qTTFNeUF3TGpRMU16QTBNeUF3TGpJek5EVTNNaUF3TGpRMU1qZ3dNME13TGpJek16ZzBOQ0F3TGpRMU1qVTJNeUF3TGpJek16RTNOQ0F3TGpRMU1qRTNNaUF3TGpJek1qWXdOeUF3TGpRMU1UWTFOa013TGpJek1qQXpPU0F3TGpRMU1URTBJREF1TWpNeE5UZzNJREF1TkRVd05URXhJREF1TWpNeE1qYzRJREF1TkRRNU9EQTVRekF1TWpNd09UY2dNQzQwTkRreE1EY2dNQzR5TXpBNE1UTWdNQzQwTkRnek5EZ2dNQzR5TXpBNE1UWWdNQzQwTkRjMU9ERldNQzR6T0RFek9UTkRNQzR5TXpFek9UY2dNQzR6TnprM09UY2dNQzR5TXpFek1Ua2dNQzR6Tnpnd016WWdNQzR5TXpBMk1ERWdNQzR6TnpZME9UaERNQzR5TWprNE9ETWdNQzR6TnpRNU5Ua2dNQzR5TWpnMU9ETWdNQzR6TnpNM05qa2dNQzR5TWpZNU9EY2dNQzR6TnpNeE9EaERNQzR5TWpVek9URWdNQzR6TnpJMk1EZ2dNQzR5TWpNMk15QXdMak0zTWpZNE5TQXdMakl5TWpBNU1pQXdMak0zTXpRd00wTXdMakl5TURVMU15QXdMak0zTkRFeU1TQXdMakl4T1RNMk1pQXdMak0zTlRReU1TQXdMakl4T0RjNE1pQXdMak0zTnpBeE4xb2lJR1pwYkd3OUlpTkNORVZETXpZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzNNREUyTnlBd0xqWXhOekF3TkV3d0xqZzROalk0SURBdU5UQXhNRE01UXpBdU9EZzNOekU0SURBdU5EazVPVEkxSURBdU9EZzRNamsxSURBdU5EazRORFU1SURBdU9EZzRNamsxSURBdU5EazJPVE0yUXpBdU9EZzRNamsxSURBdU5EazFOREUwSURBdU9EZzNOekU0SURBdU5Ea3pPVFE0SURBdU9EZzJOamdnTUM0ME9USTRNelJNTUM0M056QXhOamNnTUM0ek56WTROamxETUM0M05qa3pNRFFnTUM0ek56WXhOVFVnTUM0M05qZ3lOVGtnTUM0ek56VTJPVFlnTUM0M05qY3hOU0F3TGpNM05UVTBORU13TGpjMk5qQTBNU0F3TGpNM05UTTVNaUF3TGpjMk5Ea3hNU0F3TGpNM05UVTFNaUF3TGpjMk16ZzRPQ0F3TGpNM05qQXdOME13TGpjMk1qZzJOU0F3TGpNM05qUTJNaUF3TGpjMk1UazRPU0F3TGpNM056RTVNeUF3TGpjMk1UTTFPU0F3TGpNM09ERXhPRU13TGpjMk1EY3lPU0F3TGpNM09UQTBNeUF3TGpjMk1ETTJPU0F3TGpNNE1ERXlOaUF3TGpjMk1ETXlNU0F3TGpNNE1USTBOVll3TGpRME9UWXlRekF1TnpZd016STBJREF1TkRVd016ZzNJREF1TnpZd01UWTNJREF1TkRVeE1UUTJJREF1TnpVNU9EVTVJREF1TkRVeE9EUTRRekF1TnpVNU5UVWdNQzQwTlRJMU5TQXdMamMxT1RBNU9DQXdMalExTXpFNElEQXVOelU0TlRNZ01DNDBOVE0yT1RWRE1DNDNOVGM1TmpNZ01DNDBOVFF5TVRFZ01DNDNOVGN5T1RNZ01DNDBOVFEyTURJZ01DNDNOVFkxTmpVZ01DNDBOVFE0TkRKRE1DNDNOVFU0TXpjZ01DNDBOVFV3T0RNZ01DNDNOVFV3TmpjZ01DNDBOVFV4TmpjZ01DNDNOVFF6TURRZ01DNDBOVFV3T1Vnd0xqWTBORGt3TWtNd0xqWTBOREV6TlNBd0xqUTFOVEE0TnlBd0xqWTBNek0zTmlBd0xqUTFOVEkwTkNBd0xqWTBNalkzTkNBd0xqUTFOVFUxTWtNd0xqWTBNVGszTWlBd0xqUTFOVGcyTVNBd0xqWTBNVE0wTXlBd0xqUTFOak14TXlBd0xqWTBNRGd5TnlBd0xqUTFOamc0TVVNd0xqWTBNRE14TVNBd0xqUTFOelEwT0NBd0xqWXpPVGt5SURBdU5EVTRNVEU0SURBdU5qTTVOamdnTUM0ME5UZzRORFpETUM0Mk16azBOQ0F3TGpRMU9UVTNOQ0F3TGpZek9UTTFOU0F3TGpRMk1ETTBOQ0F3TGpZek9UUXpNaUF3TGpRMk1URXdOMVl3TGpVek16TXhNa013TGpZek9UTTFOU0F3TGpVek5EQTNOU0F3TGpZek9UUTBJREF1TlRNME9EUTJJREF1TmpNNU5qZ2dNQzQxTXpVMU56UkRNQzQyTXprNU1pQXdMalV6TmpNd01pQXdMalkwTURNeE1TQXdMalV6TmprM01pQXdMalkwTURneU55QXdMalV6TnpVek9VTXdMalkwTVRNME15QXdMalV6T0RFd05pQXdMalkwTVRrM01pQXdMalV6T0RVMU9TQXdMalkwTWpZM05DQXdMalV6T0RnMk4wTXdMalkwTXpNM05pQXdMalV6T1RFM05pQXdMalkwTkRFek5TQXdMalV6T1RNek15QXdMalkwTkRrd01pQXdMalV6T1RNeU9VZ3dMamMxTkRNd05FTXdMamMxTlRnNU9TQXdMalV6T1RNeU9TQXdMamMxTnpReklEQXVOVE01T1RZeklEQXVOelU0TlRVNElEQXVOVFF4TURreVF6QXVOelU1TmpnM0lEQXVOVFF5TWpJZ01DNDNOakF6TWpFZ01DNDFORE0zTlRFZ01DNDNOakF6TWpFZ01DNDFORFV6TkRaV01DNDJNVE14TnpWRE1DNDNOakEwTlRrZ01DNDJNVFF5TkRjZ01DNDNOakE0T0RRZ01DNDJNVFV5TmpJZ01DNDNOakUxTlNBd0xqWXhOakV4TTBNd0xqYzJNakl4TnlBd0xqWXhOamsyTkNBd0xqYzJNekVnTUM0Mk1UYzJNaUF3TGpjMk5ERXdOeUF3TGpZeE9EQXhNa013TGpjMk5URXhOU0F3TGpZeE9EUXdOQ0F3TGpjMk5qSXdPU0F3TGpZeE9EVXhOeUF3TGpjMk56STNOU0F3TGpZeE9ETTBRekF1TnpZNE16UXlJREF1TmpFNE1UWXlJREF1TnpZNU16UWdNQzQyTVRjM01ERWdNQzQzTnpBeE5qY2dNQzQyTVRjd01EUldNQzQyTVRjd01EUmFJaUJtYVd4c1BTSWpRalJGUXpNMklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFV3TnpJZ01DNDFNRGM0TURoRE1DNDJORFV5TkRnZ01DNDBOemt6TlRFZ01DNDJNemMwTmpRZ01DNDBOVEUwTVRFZ01DNDJNakkxT1RrZ01DNDBNamN4TkRSRE1DNDJNRGMzTXpRZ01DNDBNREk0TnpnZ01DNDFPRFl6T0NBd0xqTTRNekkxSURBdU5UWXdPVFE1SURBdU16Y3dORGM1UXpBdU5UTTFOVEU0SURBdU16VTNOekE0SURBdU5UQTNNREl5SURBdU16VXlNekF5SURBdU5EYzROamdnTUM0ek5UUTROekZETUM0ME5UQXpNemtnTUM0ek5UYzBOREVnTUM0ME1qTXlPQ0F3TGpNMk56ZzRNeUF3TGpRd01EVTJJREF1TXpnMU1ERTVRekF1TXpjM09EUWdNQzQwTURJeE5UVWdNQzR6TmpBek5qUWdNQzQwTWpVek1ETWdNQzR6TlRBeE1EVWdNQzQwTlRFNE5EZERNQzR6TXprNE5EWWdNQzQwTnpnek9URWdNQzR6TXpjeU1UUWdNQzQxTURjeU56VWdNQzR6TkRJMU1EVWdNQzQxTXpVeU16ZERNQzR6TkRjM09UWWdNQzQxTmpNeE9UZ2dNQzR6TmpBM09Ua2dNQzQxT0RreE1qTWdNQzR6T0RBd05EY2dNQzQyTVRBd09EUkRNQzR6T1RreU9UVWdNQzQyTXpFd05EVWdNQzQwTWpRd01pQXdMalkwTmpJd055QXdMalExTVRRek1TQXdMalkxTXpnMU9GWXdMamN3TlRneU0wTXdMalF6TWpnd05TQXdMamN4TlRRME55QXdMalF4TnprMU15QXdMamN6TVRBME9TQXdMalF3T1RJMU9DQXdMamMxTURFeU5rTXdMalF3TURVMk1pQXdMamMyT1RJd01pQXdMak01T0RVeU55QXdMamM1TURZME5pQXdMalF3TXpRM09TQXdMamd4TVRBeE4wTXdMalF3T0RRek1pQXdMamd6TVRNNE9TQXdMalF5TURBNE5DQXdMamcwT1RVd05pQXdMalF6TmpVMk5pQXdMamcyTWpRMk1VTXdMalExTXpBME9TQXdMamczTlRReE55QXdMalEzTXpRd05pQXdMamc0TWpRMklEQXVORGswTXpjeElEQXVPRGd5TkRaRE1DNDFNVFV6TXpZZ01DNDRPREkwTmlBd0xqVXpOVFk1TXlBd0xqZzNOVFF4TnlBd0xqVTFNakUzTlNBd0xqZzJNalEyTVVNd0xqVTJPRFkxT0NBd0xqZzBPVFV3TmlBd0xqVTRNRE14SURBdU9ETXhNemc1SURBdU5UZzFNall5SURBdU9ERXhNREUzUXpBdU5Ua3dNakUwSURBdU56a3dOalEySURBdU5UZzRNVGM1SURBdU56WTVNakF5SURBdU5UYzVORGcwSURBdU56VXdNVEkyUXpBdU5UY3dOemc0SURBdU56TXhNRFE1SURBdU5UVTFPVE0ySURBdU56RTFORFEzSURBdU5UTTNNekV4SURBdU56QTFPREl6VmpBdU5qVXhNVEl6UXpBdU5UWTRNVGcySURBdU5qUXhPREV4SURBdU5UazFNamcySURBdU5qSXlPRGt5SURBdU5qRTBOalkySURBdU5UazNNVEUyUXpBdU5qTTBNRFEzSURBdU5UY3hNelF4SURBdU5qUTBOams1SURBdU5UUXdNRFUwSURBdU5qUTFNRGN5SURBdU5UQTNPREE0VmpBdU5UQTNPREE0V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TWpreE1pQXdMalU1TlRZNE4wTXdMalUwTVRnMU15QXdMalU1TlRZNE55QXdMalU0TVRVeU9DQXdMalUxTmpBeE15QXdMalU0TVRVeU9DQXdMalV3TnpBM01rTXdMalU0TVRVeU9DQXdMalExT0RFek1TQXdMalUwTVRnMU15QXdMalF4T0RRMU55QXdMalE1TWpreE1pQXdMalF4T0RRMU4wTXdMalEwTXprM01TQXdMalF4T0RRMU55QXdMalF3TkRJNU55QXdMalExT0RFek1TQXdMalF3TkRJNU55QXdMalV3TnpBM01rTXdMalF3TkRJNU55QXdMalUxTmpBeE15QXdMalEwTXprM01TQXdMalU1TlRZNE55QXdMalE1TWpreE1pQXdMalU1TlRZNE4xb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RJek9USWlJSGt4UFNJeExqRXdNVEF6SWlCNE1qMGlNQzQwT1RJek9USWlJSGt5UFNJdE1DNHdOREExTnpNeklpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpOVVU1TmpJMElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TURJaUlITjBiM0F0WTI5c2IzSTlJaU0xUmprM01qUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJemMyUWtNeVJDSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTciIHk9IjQxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iQXp1cmUgQXBwbGljYXRpb24gR2F0ZXdheSAtPiBTdWJuZXQgMSIgc3R5bGU9ImlyLnJlZj02ZjU2YTJlNC00ZTNhLTQ3NjQtYjc4MC03Njc0NDQ5ZjAyNDQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIzIiBzb3VyY2U9IjQiIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJBenVyZSBBcHBsaWNhdGlvbiBHYXRld2F5IiBzdHlsZT0iaXIucmVmPWY1ZmU2YjIzLTdiZDAtNGUwMC04ZjM2LTY4ODgwNzk5NTRlNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtYXBwbGljYXRpb24tZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNRGMyT0RrZ01DNDVPVGs1T1RKRE1DNDBPRFF3TlRnZ01DNDVPVGs1T1RJZ01DNDBOakEwTWpjZ01DNDVPVEF4TkRVZ01DNDBOREkzTURRZ01DNDVOekkwTWpKTU1DNHdOREk1TlRBeElEQXVOVGN5TmpjeFF6QXVNREkxTWpJM0lEQXVOVFUwT1RRNElEQXVNREUxTXpnd09TQXdMalV6TVRNeE55QXdMakF4TlRNNE1Ea2dNQzQxTURjMk9EWkRNQzR3TVRVek9EQTVJREF1TkRnME1EVTJJREF1TURJMU1qSTNJREF1TkRZd05ESTFJREF1TURReU9UVXdNU0F3TGpRME1qY3dNa3d3TGpRME1qY3dOQ0F3TGpBME1qazFRekF1TkRZd05ESTNJREF1TURJMU1qSTNJREF1TkRnME1EVTRJREF1TURFMU16Z3dPU0F3TGpVd056WTRPU0F3TGpBeE5UTTRNRGxETUM0MU16RXpNVGtnTUM0d01UVXpPREE1SURBdU5UVTBPVFVnTUM0d01qVXlNamNnTUM0MU56STJOek1nTUM0d05ESTVOVXd3TGprM05ETTVOaUF3TGpRME5EWTNNVU13TGprNU1qRXhPU0F3TGpRMk1qTTVOQ0F4TGpBd01UazNJREF1TkRnME1EVTJJREV1TURBeE9UY2dNQzQxTURrMk5UVkRNUzR3TURFNU55QXdMalV6TXpJNE5pQXdMams1TWpFeE9TQXdMalUxTmpreE55QXdMamszTkRNNU5pQXdMalUzTkRZMFREQXVOVGN5TmpjeklEQXVPVGN5TkRJeVF6QXVOVFUwT1RVZ01DNDVPVEF4TkRVZ01DNDFNekV6TVRrZ01DNDVPVGs1T1RJZ01DNDFNRGMyT0RrZ01DNDVPVGs1T1RKYUlpQm1hV3hzUFNJak4wWkNRVEF3SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1EQTVNRFFnTUM0ek9ERXpNamhETUM0MU56TXpOelFnTUM0ME1ESXpOemtnTUM0MU5EQTVOakVnTUM0ME1USTJNVGtnTUM0MU1EZzNORFFnTUM0ME1USTJNVGxETUM0ME5qTXdOVGdnTUM0ME1USTJNVGtnTUM0ME1UYzRPRFFnTUM0ek9USXhJREF1TXpnNE1ERXhJREF1TXpVek1EVkRNQzR6TXpjd01EZ2dNQzR5T0RZME5URWdNQzR6TkRrMU9URWdNQzR4T1RFeUlEQXVOREUyTXpBNElEQXVNVFF3TVRVNFF6QXVORFF6T0RFNUlEQXVNVEU0T1RnNUlEQXVORGMyTWpreElEQXVNVEE0T0RnM0lEQXVOVEE0TkRRNUlEQXVNVEE0T0RnM1F6QXVOVFUwTVRNMUlEQXVNVEE0T0RnM0lEQXVOVGs1TXpJNUlEQXVNVEk1TkRBMklEQXVOakk1TVRneUlEQXVNVFk0TkRjMVF6QXVOamd3TWpBMUlEQXVNak0xTURrMElEQXVOalkzTkRnMElEQXVNek13TXpZMUlEQXVOakF3T1RBMElEQXVNemd4TXpJNFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVNVFVpSUdROUlrMHdMalUzTWpZM015QXdMakEwTWprMVF6QXVOVFUwT1RVZ01DNHdNalV5TWpjZ01DNDFNekV6TVRrZ01DNHdNVFV6T0RBNUlEQXVOVEEzTmpnNUlEQXVNREUxTXpnd09VTXdMalE0TkRBMU9DQXdMakF4TlRNNE1Ea2dNQzQwTmpBME1qY2dNQzR3TWpVeU1qY2dNQzQwTkRJM01EUWdNQzR3TkRJNU5Vd3dMakEwTWprMU1ERWdNQzQwTkRJM01ESkRNQzR3TWpVeU1qY2dNQzQwTmpBME1qVWdNQzR3TVRVek9EQTVJREF1TkRnME1EVTJJREF1TURFMU16Z3dPU0F3TGpVd056WTROa013TGpBeE5UTTRNRGtnTUM0MU16RXpNVGNnTUM0d01qVXlNamNnTUM0MU5UUTVORGdnTUM0d05ESTVOVEF4SURBdU5UY3lOamN4VERBdU1qWTVOREV5SURBdU56azVNVE14VERBdU5qazJOek0xSURBdU1UWTNNREV4VERBdU5UY3lOamN6SURBdU1EUXlPVFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEEzTmpVMUlEQXVPVEV6TkRVM1REQXVOak0zTmpJMElEQXVOemd6TkRnNFNEQXVOVFExTURkV01DNHpPVEkxTnpoSU1DNDBOamd5TjFZd0xqYzRNelE0T0Vnd0xqTTNOelk0Tmt3d0xqVXdOelkxTlNBd0xqa3hNelExTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RrNU16Y2dNQzQyTnpRM01ERldNQzQwT1RBNE9UUk1NQzQzTWpVNE56Z2dNQzQxTlRRNU5UTk1NQzQxTlRrMU9UWWdNQzR6T0RnMk56Sk1NQzQxTURNNU1EWWdNQzQwTkRRek5qRk1NQzQyTnpBeE9EZ2dNQzQyTVRBMk5ETk1NQzQyTURZeE1qa2dNQzQyTnpRM01ERklNQzQzT0RrNU16ZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qSTFPRE1nTUM0Mk56VTBOakpJTUM0ME1EazJNVGRNTUM0ek5EVTFOemdnTUM0Mk1URTBNak5NTUM0MU1UWTFNallnTUM0ME5EQTBOelZNTUM0ME5qQTRNVGNnTUM0ek9EUTNOalpNTUM0eU9EazROamtnTUM0MU5UVTNNVFJNTUM0eU1qVTRNeUF3TGpRNU1UWTNOVll3TGpZM05UUTJNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFPRGczTVRFZ01DNHpOalV6T1RsRE1DNDFOalE0TkRRZ01DNHpPRE0yTlRRZ01DNDFNelkzTWpNZ01DNHpPVEkxTXpVZ01DNDFNRGc0SURBdU16a3lOVE0xUXpBdU5EWTVNVGM1SURBdU16a3lOVE0xSURBdU5ESTVPVGt4SURBdU16YzBOelV6SURBdU5EQTBNVEUxSURBdU16UXdPRGd5UXpBdU16VTVPRGcySURBdU1qZ3pNVEkwSURBdU16Y3dOemsySURBdU1qQXdOVE0xSURBdU5ESTROalV5SURBdU1UVTJNalkzUXpBdU5EVXlOVEU1SURBdU1UTTNPVEV6SURBdU5EZ3dOalU1SURBdU1USTVNVFVnTUM0MU1EZzFORFFnTUM0eE1qa3hOVU13TGpVME9ERTJOQ0F3TGpFeU9URTFJREF1TlRnM016VXlJREF1TVRRMk9UTXpJREF1TmpFek1qSTRJREF1TVRnd09ESXpRekF1TmpVM05EazJJREF1TWpNNE5UZ2dNQzQyTkRZME5qZ2dNQzR6TWpFeE9TQXdMalU0T0RjeE1TQXdMak0yTlRNNU9Wb2lJR1pwYkd3OUlpTTFPVUkwUkRraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVTJORFV5TVNBd0xqSTRNems0T1VNd0xqVTNOREE1TWlBd0xqSTVOalEzTkNBd0xqVTVNVGcxTkNBd0xqSTVPRGN4T1NBd0xqWXdOREkySURBdU1qZzVNamcyUXpBdU5qQTBPVEVnTUM0eU9EZzNPVFFnTUM0Mk1EVTBNRE1nTUM0eU9EZ3hPRE1nTUM0Mk1EVTVPVE1nTUM0eU9EYzJOVEpETUM0Mk1UZzJPVFVnTUM0eU9UWTFPVElnTUM0Mk1qYzBPVGNnTUM0ek1ESTFJREF1TmpNeU5EWWdNQzR6TURVNE5qZERNQzQyTXpNNU16Y2dNQzR6TURJd05qWWdNQzQyTXpRNU5ERWdNQzR5T1RnME1EUWdNQzQyTXpVNU9EVWdNQzR5T1RRMU9ETkRNQzQyTXpBM05EY2dNQzR5T1RBMk9EUWdNQzQyTWpNMk16Z2dNQzR5T0RVeU1TQXdMall4TXpNM09DQXdMakkzTmpsRE1DNDJNVFkzTkRVZ01DNHlOamd3TlRnZ01DNDJNVFUyT0RJZ01DNHlOVGMzTWlBd0xqWXdPVFV6T0NBd0xqSTBPVFkwTmtNd0xqWXdNRGN6TmlBd0xqSXpPREkyTkNBd0xqVTROVEUxT1NBd0xqSXpOVE0yT1NBd0xqVTNNams0T1NBd0xqSTBNak01T1VNd0xqVTFPVFUzT1NBd0xqSXpNRE0yTnlBd0xqVTBORGd5T1NBd0xqSXhOalUyTXlBd0xqVXlPVEk1TWlBd0xqSXdNVEV5TkVNd0xqVTNOelUzTnlBd0xqRTNOVEUxSURBdU5qRXhPRGd4SURBdU1UYzRPVFV4SURBdU5qRXhPRGd4SURBdU1UYzRPVFV4UXpBdU5qQTJNVFV4SURBdU1UY3hOalExSURBdU5UazVOek14SURBdU1UWTFNalExSURBdU5Ua3lPRGM0SURBdU1UVTVORGMxUXpBdU5UY3lOVEUySURBdU1UVTJNekkxSURBdU5UUXdPRGt4SURBdU1UVTJOamM1SURBdU5UQTBOek0ySURBdU1UYzFPRGs1VERBdU5UQTBOekUySURBdU1UYzFPRGM1UXpBdU5Ea3lOalkwSURBdU1UWXpNamMySURBdU5EZ3dOREUySURBdU1UUTVOelEzSURBdU5EWTNPVE14SURBdU1UTTFNalUwUXpBdU5EWXhPVFkwSURBdU1UTTNNVFkwSURBdU5EVTJNVEUxSURBdU1UTTVOVEkzSURBdU5EVXdORGd6SURBdU1UUXlNelF6UXpBdU5EVTVOams1SURBdU1UVTNOREkzSURBdU5EY3lNVEExSURBdU1UY3lOak1nTUM0ME9EWXdOamNnTUM0eE9EYzBOemhETUM0ME9EWXdPRGNnTUM0eE9EYzFNVGNnTUM0ME9EWXhNallnTUM0eE9EYzFNemNnTUM0ME9EWXhOallnTUM0eE9EYzFOelpETUM0ME56UTFNRGdnTUM0eE9UVTNNamtnTUM0ME5qRTFOU0F3TGpJd05qWXhPQ0F3TGpRME9UVTNOeUF3TGpJeE9USTJNVU13TGpRME9EQTBNU0F3TGpJeU1EZzVOU0F3TGpRME5qVTROQ0F3TGpJeU1qVXpJREF1TkRRMU1UUTNJREF1TWpJME1UWTBRekF1TkRNM09UazRJREF1TWpJeU5qWTNJREF1TkRNd05EYzJJREF1TWpJek1UQXhJREF1TkRJek5EUTJJREF1TWpJMU5qUXhRekF1TkRFeE5URXlJREF1TVRrNU9UQXpJREF1TkRFeU5EYzNJREF1TVRjNU1qSTNJREF1TkRFME16WTRJREF1TVRZNE5UY3pRekF1TkRBNU1UZzRJREF1TVRjME1EQTRJREF1TkRBME16UTBJREF1TVRjNU5qazVJREF1TkRBd01UZzVJREF1TVRnMU56ZzBRekF1TXprM01EYzRJREF1TVRrNE5UQTFJREF1TXprMk1Ua3lJREF1TWpFMk9EVTRJREF1TkRBMU16ZzRJREF1TWpNNE9UY3pRekF1TXprME56VTBJREF1TWpVeU9EazFJREF1TXprME1qUXlJREF1TWpjeU5qSTJJREF1TkRBMU16WTRJREF1TWpnM01UazVRekF1TkRBMk1qazBJREF1TWpnNE5DQXdMalF3TnpJM09DQXdMakk0T1RVeU1pQXdMalF3T0RNeU1pQXdMakk1TURZd05VTXdMalF3TXpRM09DQXdMak13TnpFeU55QXdMalF3TVRJNU1pQXdMak15TXpBM09DQXdMalF3TURZeU1pQXdMak16TmpjMk5FTXdMalF3TVRnMk15QXdMak16T0RRMU55QXdMalF3TVRnMk15QXdMak16T1Rnek5pQXdMalF3TXpFd05DQXdMak0wTVRRNVF6QXVOREE1TkRJMUlEQXVNelE1TlRneklEQXVOREUzTXpZeElEQXVNelUyTkRFM0lEQXVOREkxTURJeElEQXVNell5TmtNd0xqUXlOREEzTmlBd0xqTTBPREV3TnlBd0xqUXlOVEVnTUM0ek1qWTNOREVnTUM0ME16UXdOaUF3TGpNd01qWTNOME13TGpRME1ESTBNeUF3TGpNd016RTBPU0F3TGpRME5qVXlOU0F3TGpNd01qRTJOU0F3TGpRMU1qUXhNeUF3TGpJNU9UY3dNME13TGpRMU5UYzRJREF1TXpBeU5qYzNJREF1TkRVNU16QTFJREF1TXpBMU5qY2dNQzQwTmpNd09EWWdNQzR6TURnM01qSkRNQzQwTnpZd01EUWdNQzR6TVRnNU5qSWdNQzQwT0RnNU1ETWdNQzR6TWpZNU1UZ2dNQzQxTURFME5qY2dNQzR6TXpNeE9FTXdMalV3TURneE55QXdMak16T1RVNElEQXVOVEF5TkRFeUlEQXVNelEyTWpFMklEQXVOVEEyTlRZM0lEQXVNelV4TnpGRE1DNDFNVFUwTkRnZ01DNHpOak14TnpFZ01DNDFNekU0T1RFZ01DNHpOalV6TVRnZ01DNDFORE16TlRJZ01DNHpOVFkxTlRWRE1DNDFORFUzTXpVZ01DNHpOVFEzTWpNZ01DNDFORGMyTWpVZ01DNHpOVEkxTVRnZ01DNDFORGt4T0RFZ01DNHpOVEF4TlRWRE1DNDFOamsyT0RFZ01DNHpOVFEzTWpNZ01DNDFPRGMxT0RFZ01DNHpOVFUxTXpFZ01DNDJNREE0TlRRZ01DNHpOVFUxTXpGRE1DNDJNREk0T0RJZ01DNHpOVFUxTXpFZ01DNDJNVEl6TVRVZ01DNHpOREkyT1RFZ01DNDJNVGMzTXlBd0xqTXpORGN6TmtNd0xqWXdPVFkxTmlBd0xqTXpOalF5T1NBd0xqVTROVFkzTVNBd0xqTXpPVGN4T0NBd0xqVTFNamt5TXlBd0xqTXpNRE13TlVNd0xqVTFNakV6TlNBd0xqTXlOall5TWlBd0xqVTFNRFl4T1NBd0xqTXlNekExT0NBd0xqVTBPREU1TmlBd0xqTXhPVGcyT0VNd0xqVXpPVGc0TmlBd0xqTXdPRGsxT1NBd0xqVXlORFkyTkNBd0xqTXdOalU1TlNBd0xqVXhNek15TVNBd0xqTXhNemt3TVVNd0xqVXdNVGt6T1NBd0xqTXdOemN4T0NBd0xqUTVNREF3TmlBd0xqSTVPVGszT1NBd0xqUTNOemN4T0NBd0xqSTVNREkxTVVNd0xqUTNOVEl6TmlBd0xqSTRPREk0TWlBd0xqUTNNamcxTkNBd0xqSTROak16TWlBd0xqUTNNRFUxSURBdU1qZzBNell6UXpBdU5EYzRNRGN5SURBdU1qY3lOVEk0SURBdU5EYzRPRFlnTUM0eU5UY3pORFVnTUM0ME56SXlNalFnTUM0eU5EUTFPRFZETUM0ME56TTNOQ0F3TGpJME16QTJPU0F3TGpRM05USXhOeUF3TGpJME1UVTNNaUF3TGpRM05qZ3hNaUF3TGpJME1EQTNOVU13TGpRNE9EazRNaUF3TGpJeU9EWTVNeUF3TGpVd01EUTBNeUF3TGpJeE9UVTVOU0F3TGpVeE1URTFOU0F3TGpJeE1qSTVRekF1TlRFd056SXlJREF1TWpFeE9EazJJREF1TlRFd016STRJREF1TWpFeE5EWXpJREF1TlRBNU9URTFJREF1TWpFeE1EWTVRekF1TlRFd016UTRJREF1TWpFeE5EWXpJREF1TlRFd056UXlJREF1TWpFeE9EYzJJREF1TlRFeE1UYzFJREF1TWpFeU1qZERNQzQxTVRFeE56VWdNQzR5TVRJeU55QXdMalV4TVRFM05TQXdMakl4TWpJM0lEQXVOVEV4TVRVMUlEQXVNakV5TWpkRE1DNDFNamMxT1RnZ01DNHlNamMwTnpJZ01DNDFORFV3TWpZZ01DNHlOREU0T0RjZ01DNDFOakUxTkRnZ01DNHlOVFEzTmpaRE1DNDFOVGN4T1RZZ01DNHlOalF3TWpFZ01DNDFOVGM0T0RVZ01DNHlOelV6TURVZ01DNDFOalExTWpFZ01DNHlPRE01T0RsYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TVNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ERTFNemd3T1NBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzYiIHk9IjM3NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOSIgdmFsdWU9IkF6dXJlIEROUyAoRG9tYWluIE5hbWUgU3lzdGVtKSAtPiBBenVyZSBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJpci5yZWY9YTkxN2M4ZTgtYWM2My00NDUzLWJmMzMtYjQ5YTYwOGU1ZThmO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMyIgc291cmNlPSI5IiB0YXJnZXQ9IjEzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMTU2IiB5PSIxOTUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iQXp1cmUgRE5TIChEb21haW4gTmFtZSBTeXN0ZW0pIiBzdHlsZT0iaXIucmVmPWRlNjQ1NTAxLTk3Y2MtNDIwYy05YzgzLTlmYTMyYzRhOWRhMjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtRE5TO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFeU5EQmZNakkzTmpjcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOalU0TkNBd0xqZ3pNRFkyTmtNd0xqWTJPVEl5TXlBd0xqZzVPRE01TmlBd0xqVTFPRFV6TlNBd0xqa3lPRFkwT0NBd0xqUTBPRGczSURBdU9URTBOelkzUXpBdU16TTVNakEwSURBdU9UQXdPRGczSURBdU1qTTVOVFEwSURBdU9EUTBNREV4SURBdU1UY3hPREUwSURBdU56VTJOalV4UXpBdU1UQTBNRGcwSURBdU5qWTVNamt4SURBdU1EY3pPRE14TnlBd0xqVTFPRFl3TXlBd0xqQTROemN4TWpJZ01DNDBORGc1TXpoRE1DNHhNREUxT1RNZ01DNHpNemt5TnpNZ01DNHhOVGcwTmprZ01DNHlNemsyTVRRZ01DNHlORFU0TWprZ01DNHhOekU0T0RSTU1DNHlOVEF5TkRFZ01DNHhOamc1TkRORE1DNHpNemd4TURJZ01DNHhNRE16TlRrZ01DNDBORGd5TnpRZ01DNHdOelV3TlRFeElEQXVOVFUyT0RZNElEQXVNRGt3TVRVMk5FTXdMalkyTlRRMk1pQXdMakV3TlRJMk1pQXdMamMyTXpjeU5pQXdMakUyTWpVMk15QXdMamd6TURNMU15QXdMakkwT1RZek5VTXdMamc1TmprNElEQXVNek0yTnpBNElEQXVPVEkyTmlBd0xqUTBOalV6TkNBd0xqa3hNamM1SURBdU5UVTFNME13TGpnNU9EazRNU0F3TGpZMk5EQTJOaUF3TGpnME1qZzFOaUF3TGpjMk16QXdOU0F3TGpjMU5qVTROQ0F3TGpnek1EWTJOaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmY21Ga2FXRnNYekV5TkRCZk1qSTNOamNwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1ERXlNRFVnTUM0eE1qUXlOamhETUM0ME1qWTJOVFFnTUM0eE1qUXlOamdnTUM0ek5UTTNOemNnTUM0eE5EWXpOelVnTUM0eU9URTNPU0F3TGpFNE56YzVNME13TGpJeU9UZ3dNeUF3TGpJeU9USXhNU0F3TGpFNE1UUTVJREF1TWpnNE1EZ3hJREF1TVRVeU9UWWdNQzR6TlRZNU5UZERNQzR4TWpRME16RWdNQzQwTWpVNE16UWdNQzR4TVRZNU5qWWdNQzQxTURFMk1qTWdNQzR4TXpFMU1TQXdMalUzTkRjME1rTXdMakUwTmpBMU5TQXdMalkwTnpnMk1TQXdMakU0TVRrMU5DQXdMamN4TlRBeU5TQXdMakl6TkRZM0lEQXVOelkzTnpSRE1DNHlPRGN6T0RZZ01DNDRNakEwTlRZZ01DNHpOVFExTkRrZ01DNDROVFl6TlRZZ01DNDBNamMyTmpnZ01DNDROekE1UXpBdU5UQXdOemczSURBdU9EZzFORFEwSURBdU5UYzJOVGMySURBdU9EYzNPVGdnTUM0Mk5EVTBOVElnTUM0NE5EazBOVU13TGpjeE5ETXlPU0F3TGpneU1Ea3lNU0F3TGpjM016RTVPQ0F3TGpjM01qWXdPQ0F3TGpneE5EWXhOeUF3TGpjeE1EWXlNVU13TGpnMU5qQXpOU0F3TGpZME9EWXpOQ0F3TGpnM09ERTBNaUF3TGpVM05UYzFOaUF3TGpnM09ERTBNaUF3TGpVd01USXdOVU13TGpnM09EQXhNaUF3TGpRd01USTNOU0F3TGpnek9ESTFPQ0F3TGpNd05UUTNOU0F3TGpjMk56VTVOaUF3TGpJek5EZ3hNME13TGpZNU5qa3pOU0F3TGpFMk5ERTFNaUF3TGpZd01URXpOU0F3TGpFeU5ETTVOeUF3TGpVd01USXdOU0F3TGpFeU5ESTJPRll3TGpFeU5ESTJPRnBOTUM0M05UTTJOQ0F3TGpJMU1USXlNVU13TGpjeU1EYzNOQ0F3TGpJMk9UY3hNaUF3TGpZNE5USXhOQ0F3TGpJNE1qazBOQ0F3TGpZME9ESTFOQ0F3TGpJNU1EUXpORU13TGpZek5UUTJOQ0F3TGpJME16RTNNU0F3TGpZeE5EYzBOaUF3TGpFNU9EUXlNU0F3TGpVNE5qazROQ0F3TGpFMU9EQTRPVU13TGpZMU1EQXpOeUF3TGpFM016SXpNaUF3TGpjd056WTVPU0F3TGpJd05UUTFOU0F3TGpjMU16WTBJREF1TWpVeE1qSXhWakF1TWpVeE1qSXhXazB3TGpVd01USXdOU0F3TGpFME5UTTBOVU13TGpVeE9URXdOaUF3TGpFME5UTXpNaUF3TGpVek5qazNOeUF3TGpFME5qZ3dPQ0F3TGpVMU5EWXpNeUF3TGpFME9UYzFObFl3TGpFME9UYzFOa013TGpVNU1EUTROQ0F3TGpFNU1qUXpOU0F3TGpZeE5qRXpNaUF3TGpJME1qY3lOaUF3TGpZeU9UWXlPQ0F3TGpJNU5qZ3dOa013TGpVME1UTXhOeUF3TGpNeE1qazROeUF3TGpRMU1EZ2dNQzR6TVRJNU9EY2dNQzR6TmpJME9EZ2dNQzR5T1RZNE1EWkRNQzR6TnpVNU5EZ2dNQzR5TkRNM09USWdNQzQwTURFeU5UUWdNQzR4T1RRMU1pQXdMalF6TmpVd015QXdMakUxTWpZNU4xWXdMakUxTWpZNU4wTXdMalExTnpnd05DQXdMakUwT0RJNU5pQXdMalEzT1RRMklEQXVNVFExT0RNMUlEQXVOVEF4TWpBMUlEQXVNVFExTXpRMVZqQXVNVFExTXpRMVdrMHdMalF3TXpFM01pQXdMakUxT0RBNE9VTXdMak0zTlRBM015QXdMakU1T0RBd01TQXdMak0xTkRBeE9DQXdMakkwTWpRek1pQXdMak0wTURreU1TQXdMakk0T1RRMU5FTXdMak13TnpneE1pQXdMakk0TWpjek1pQXdMakkzTmpJek5pQXdMakkyT1Rrek5TQXdMakkwTnpjNE9TQXdMakkxTVRjeE1VTXdMakk1TURjMUlEQXVNakEzTnpZeElEQXVNelEwTWpRZ01DNHhOelUxTXpJZ01DNDBNRE14TnpJZ01DNHhOVGd3T0RsV01DNHhOVGd3T0RsYVRUQXVNalF5TXprNElEQXVOelEyTWpnNFF6QXVNalk0T1RNeUlEQXVOekk0TlRreElEQXVNams0TlRFeklEQXVOekUxT1RZZ01DNHpNamsyTkRjZ01DNDNNRGt3TXpaRE1DNHpOREU0TURJZ01DNDNOVGMzTkNBd0xqTTJORE0zT1NBd0xqZ3dNekl5T0NBd0xqTTVOVGd4T1NBd0xqZzBNak0yTVVNd0xqTXpOekkwTXlBd0xqZ3lOREV4TnlBd0xqSTRORE00T0NBd0xqYzVNVEF4T1NBd0xqSTBNak01T0NBd0xqYzBOakk0T0ZZd0xqYzBOakk0T0ZwTk1DNDFOVFkxT1RRZ01DNDROVFF4TWpWRE1DNDFNemd5TXprZ01DNDROVFkxT0RFZ01DNDFNVGszTVRjZ01DNDROVGMxTmpVZ01DNDFNREV5TURVZ01DNDROVGN3TmpaRE1DNDBOemMwT0RNZ01DNDROVGN4TWpNZ01DNDBOVE00TWpJZ01DNDROVFEyTlRnZ01DNDBNekEyTWpFZ01DNDRORGszTVRORE1DNHpPRGsxT1RNZ01DNDRNRGszTVRjZ01DNHpOakV4TkRJZ01DNDNOVGcyTURjZ01DNHpORGczTmpNZ01DNDNNREkyTmpORE1DNDBORE00TlRrZ01DNDJPRE15T1RNZ01DNDFOREU0T0RVZ01DNDJPRE15T1RNZ01DNDJNelk1T0RFZ01DNDNNREkyTmpORE1DNDJNalF6TWpnZ01DNDNOVGczTWpFZ01DNDFPVFUxTWprZ01DNDRNRGs0TkRNZ01DNDFOVFF4TkRNZ01DNDRORGszTVROTU1DNDFOVFkxT1RRZ01DNDROVFF4TWpWYVRUQXVOVGt5TXpjMklEQXVPRFEyTWpneVF6QXVOakkwTnpnMElEQXVPREEyTURreElEQXVOalEzT0RnMUlEQXVOelU1TWpFNUlEQXVOall3TURFNElEQXVOekE1TURNMlF6QXVOamswTmpreElEQXVOekUzTVRjMUlEQXVOekkzT0RBMElEQXVOek13T1RFM0lEQXVOelU0TURVeElEQXVOelE1TnpFNVF6QXVOekV5TmpZNUlEQXVOemsyTURBNElEQXVOalUxTXpBMklEQXVPREk0TnpZeklEQXVOVGt5TXpjMklEQXVPRFEwTXpJeFZqQXVPRFEyTWpneVdrMHdMalkyTkRreUlEQXVOamc0TkRRNVF6QXVOalk0T0RReElEQXVOamN3T0RBeklEQXVOamN5TWpjeklEQXVOalV5TmpZM0lEQXVOamMwTnpJeklEQXVOak16TlRWTU1DNDJOVEl4TnpZZ01DNDJNemc1TkRKRE1DNDJORGszTWpVZ01DNDJOVFF4TXpjZ01DNDJORGN5TnpRZ01DNDJOamt6TXpJZ01DNDJORE00TkRNZ01DNDJPRE0xTkRkRE1DNDFORFV6TlRRZ01DNDJOak0wTlNBd0xqUTBNemd5TVNBd0xqWTJNelExSURBdU16UTFNek15SURBdU5qZ3pOVFEzUXpBdU16UXhPVEF4SURBdU5qY3dNekV6SURBdU16TTVORFVnTUM0Mk5UWXdPVGdnTUM0ek16WTVPVGtnTUM0Mk5ERXpPVE5ETUM0ek16WTNOaklnTUM0Mk16azVNeklnTUM0ek16WTNOaklnTUM0Mk16ZzBORElnTUM0ek16WTVPVGtnTUM0Mk16WTVPREZNTUM0ek1UUTBOVElnTUM0Mk16QTJNRGxETUM0ek1UUXhPQ0F3TGpZek5URTRJREF1TXpFME1UZ2dNQzQyTXprM05qTWdNQzR6TVRRME5USWdNQzQyTkRRek16UkRNQzR6TVRRME5USWdNQzQyTmpBd01Ua2dNQzR6TVRrNE5EUWdNQzQyTnpRM01qUWdNQzR6TWpJM09EVWdNQzQyT0RnNU16bERNQzR5T0RjNE1Ea2dNQzQyT1RZMk16Y2dNQzR5TlRRMU5qZ2dNQzQzTVRBM05qVWdNQzR5TWpRM05USWdNQzQzTXpBMk1ETkRNQzR4TnpBMk56UWdNQzQyTmpVM01qVWdNQzR4TkRFMU1EZ2dNQzQxT0RNMk9EWWdNQzR4TkRJME9UY2dNQzQwT1RreU16RkRNQzR4TkRNME9EVWdNQzQwTVRRM056WWdNQzR4TnpRMU5qSWdNQzR6TXpNME5ESWdNQzR5TXpBeE5ETWdNQzR5TmprNE5EZERNQzR5TmpFek1UY2dNQzR5T0RrNU1UUWdNQzR5T1RVNE5UVWdNQzR6TURReE9UUWdNQzR6TXpJd09UZ2dNQzR6TVRJd01ERkRNQzR6TWpnMk5qY2dNQzR6TWpNM05qVWdNQzR6TWpVM01qWWdNQzR6TXpZMU1Ea2dNQzR6TWpNeU56VWdNQzR6TkRreU5UUkRNQzR6TWpBNE1qUWdNQzR6TmpFNU9UZ2dNQzR6TWpNeU56VWdNQzR6TmpFMU1EZ2dNQzR6TVRrek5UUWdNQzR6Tmpjek9Vd3dMak0wTWpNNU1TQXdMak0yTVRrNU9GWXdMak0xTXpZMk5VTXdMak0wTlRNek1pQXdMak0wTURreU1TQXdMak0wT0RJM015QXdMak15T0RZMk55QXdMak0xTVRjd05DQXdMak14Tmprd00wTXdMalF3TVRBd01pQXdMak15TlRrME55QXdMalExTVRFZ01DNHpNams0T0RrZ01DNDFNREV5TURVZ01DNHpNamcyTmpkRE1DNDFORFk1TWpRZ01DNHpNamcyTmpVZ01DNDFPVEkxTkRRZ01DNHpNalF6T1RnZ01DNDJNemMwTnpFZ01DNHpNVFU1TWpKRE1DNDJOREE1TURJZ01DNHpNamt4TlRjZ01DNDJORFF6TXpNZ01DNHpORE16TnpJZ01DNDJORGN5TnpRZ01DNHpOVGMxT0RkTU1DNDJOams0TWpJZ01DNHpOakk1TnpoRE1DNDJOall5TWpjZ01DNHpORFV6TXpJZ01DNDJOakl6TURZZ01DNHpNamc1T1RRZ01DNDJOVGd3TlRnZ01DNHpNVE01TmpKRE1DNDJPVGMzT0RnZ01DNHpNRFV5TkRFZ01DNDNNelU0TlRRZ01DNHlPVEF4T0NBd0xqYzNNRGM1TmlBd0xqSTJPVE0xTjBNd0xqZ3lOelF3TXlBd0xqTXpNelExTWlBd0xqZzFPRGc0T0NBd0xqUXhOVGczTnlBd0xqZzFPVFF5T1NBd0xqVXdNVE00T1VNd0xqZzFPVGszSURBdU5UZzJPVEF5SURBdU9ESTVOVEk1SURBdU5qWTVOekU0SURBdU56Y3pOek0zSURBdU56TTBOVEkwUXpBdU56UXdNemMxSURBdU56RXlOekE1SURBdU56QXpOVGt6SURBdU5qazJOak00SURBdU5qWTBPVElnTUM0Mk9EWTVOemhXTUM0Mk9EZzBORGxhSWlCbWFXeHNQU0lqTlVWQk1FVkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TkRBNU5qa2dNQzQwTURNeU1qaERNQzR5TlRrNElEQXVOREF3TlRJNUlEQXVNamM0T0RBMElEQXVNems1TWpFNUlEQXVNamszT0RJNElEQXVNems1TXpBMlF6QXVNekkzT1RnMUlEQXVNemsyT0RrMklEQXVNelUzT1RNMklEQXVOREEyTURBeklEQXVNemd4TmpRMklEQXVOREkwTnprMVF6QXVNemt4TURVNElEQXVORE0wTVRRMklEQXVNems0TkRjMUlEQXVORFExTXpFZ01DNDBNRE0wTkRZZ01DNDBOVGMyTVRGRE1DNDBNRGcwTVRjZ01DNDBOams1TVRJZ01DNDBNVEE0TXprZ01DNDBPRE13T1RRZ01DNDBNVEExTmpZZ01DNDBPVFl6TlRsRE1DNDBNVEV6TVRjZ01DNDFNVEV3T0RnZ01DNDBNRGt3TlRJZ01DNDFNalU0TVRVZ01DNDBNRE01TVRFZ01DNDFNemsyTXpoRE1DNHpPVGczTmprZ01DNDFOVE0wTmpFZ01DNHpPVEE0TlRrZ01DNDFOall3T0RnZ01DNHpPREEyTmpZZ01DNDFOelkzTkRaRE1DNHpOVFV6TXpFZ01DNDFPVGd5TURrZ01DNHpNakkyTWlBd0xqWXdPRGt6TnlBd0xqSTRPVFE1TlNBd0xqWXdOalkwTmtNd0xqSTNNekV5TkNBd0xqWXdOamN5TXlBd0xqSTFOamMyTVNBd0xqWXdOVGt3TlNBd0xqSTBNRFEzT1NBd0xqWXdOREU1Tmt3d0xqSTBNRGsyT1NBd0xqUXdNekl5T0ZwTk1DNHlOamM1TWpnZ01DNDFPRFl3TlRsRE1DNHlOelk1TURNZ01DNDFPRFkyTnpnZ01DNHlPRFU1TVRFZ01DNDFPRFkyTnpnZ01DNHlPVFE0T0RjZ01DNDFPRFl3TlRsRE1DNHpNRFk0TWpNZ01DNDFPRGMwTVRJZ01DNHpNVGc1TVNBd0xqVTROakF6T1NBd0xqTXpNREl6T1NBd0xqVTRNakEwTkVNd0xqTTBNVFUyT0NBd0xqVTNPREEwT1NBd0xqTTFNVGcwTWlBd0xqVTNNVFV6TlNBd0xqTTJNREk0T1NBd0xqVTJNams1TkVNd0xqTTJPRGN6TmlBd0xqVTFORFExTXlBd0xqTTNOVEV6TlNBd0xqVTBOREV3TmlBd0xqTTNPVEF3TkNBd0xqVXpNamN6TkVNd0xqTTRNamczTXlBd0xqVXlNVE0yTWlBd0xqTTROREV4TWlBd0xqVXdPVEkySURBdU16Z3lOakkySURBdU5EazNNek01UXpBdU16Z3pOak14SURBdU5EZzJNamN6SURBdU16Z3lNVEUxSURBdU5EYzFNVEl5SURBdU16YzRNVGt4SURBdU5EWTBOekkxUXpBdU16YzBNalkySURBdU5EVTBNekk1SURBdU16WTRNRE0ySURBdU5EUTBPVFUzSURBdU16VTVPVFk1SURBdU5ETTNNekUxUXpBdU16VXhPVEF5SURBdU5ESTVOamN5SURBdU16UXlNakE0SURBdU5ESXpPVFU0SURBdU16TXhOakUwSURBdU5ESXdOa013TGpNeU1UQXlNU0F3TGpReE56STBNeUF3TGpNd09UZ3dOU0F3TGpReE5qTXpNU0F3TGpJNU9EZ3dPQ0F3TGpReE56a3pNME13TGpJNE9EVTBJREF1TkRFMk9UQTNJREF1TWpjNE1UazJJREF1TkRFMk9UQTNJREF1TWpZM09USTRJREF1TkRFM09UTXpWakF1TlRnMk1EVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBOVE0zTkNBd0xqWXdORGM1TjFZd0xqTTVPRFF6T0Vnd0xqUTNOREk1TTB3d0xqVTBNRFEyTmlBd0xqVXdNVE0zTWtNd0xqVTFORE14TVNBd0xqVXlNamt6TkNBd0xqVTJOamMxTlNBd0xqVTBOVE0yTkNBd0xqVTNOemN4T0NBd0xqVTJPRFV5TlVNd0xqVTNOVEkyTnlBd0xqVTBNVEEzTmlBd0xqVTNORGMzTnlBd0xqVXhOakEzTnlBd0xqVTNORGMzTnlBd0xqUTRNemN5TmxZd0xqTTVPRFF6T0Vnd0xqVTVPVEk0TlZZd0xqWXdORGM1TjBnd0xqVTNNak15Tmt3d0xqVXdOell5TlNBd0xqVXdNVE0zTWtNd0xqUTVNelF4SURBdU5EYzRNek0wSURBdU5EYzVOamcxSURBdU5EVXlNelUySURBdU5EWTRPVEF4SURBdU5ETXlOelE1UXpBdU5EWTRPVEF4SURBdU5EVTROekk0SURBdU5EWTRPVEF4SURBdU5EZ3hOelkySURBdU5EWTRPVEF4SURBdU5URTRNRE00VmpBdU5qQTJNalk0VERBdU5EUTFNemMwSURBdU5qQTBOemszV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkwTWprd05pQXdMalUzTWpRek4wTXdMalkxTnpjNU9TQXdMalU0TVRBM055QXdMalkzTkRjd05TQXdMalU0TlRZME1TQXdMalk1TVRreU1pQXdMalU0TlRZM01rTXdMamN4T1RNM01pQXdMalU0TlRZM01pQXdMamN6TlRBMU55QXdMalUzTVRRMU55QXdMamN6TlRBMU55QXdMalUxTURNNFF6QXVOek0xTURVM0lEQXVOVEk1TXpBeklEQXVOekkwTWpjeklEQXVOVEU1T1RrZ01DNDJPVFl6TXpRZ01DNDFNRGsyT1RaRE1DNDJOamd6T1RRZ01DNDBPVGswTURNZ01DNDJOREUwTXpVZ01DNDBPREF5T0RZZ01DNDJOREUwTXpVZ01DNDBOVEE0TnpaRE1DNDJOREU1TURrZ01DNDBOREkyT1RrZ01DNDJORFF3TlRjZ01DNDBNelEzTURZZ01DNDJORGMzTkRjZ01DNDBNamN6T1RORE1DNDJOVEUwTXpZZ01DNDBNakF3T0NBd0xqWTFOalU0T1NBd0xqUXhNell3TXlBd0xqWTJNamc0TmlBd0xqUXdPRE0yTkVNd0xqWTJPVEU0TWlBd0xqUXdNekV5TlNBd0xqWTNOalE0TnlBd0xqTTVPVEl6TlNBd0xqWTRORE0wT1NBd0xqTTVOamt6TmtNd0xqWTVNakl4TVNBd0xqTTVORFl6TmlBd0xqY3dNRFEyTVNBd0xqTTVNemszTnlBd0xqY3dPRFU0T0NBd0xqTTVORGs1TjBNd0xqY3lORE0xSURBdU16azBOVFV4SURBdU56TTVPVGc0SURBdU16azNPVEUwSURBdU56VTBNVGN6SURBdU5EQTBPREF4VERBdU56UTJNek14SURBdU5ESTJPRFU0UXpBdU56TTBNekUySURBdU5ESXdNamd6SURBdU56SXdPREV6SURBdU5ERTJPVEE0SURBdU56QTNNVEU0SURBdU5ERTNNRFUxUXpBdU5qYzROamc0SURBdU5ERTNNRFUxSURBdU5qWTNPVEEwSURBdU5ETXpOeklnTUM0Mk5qYzVNRFFnTUM0ME5EYzVNelZETUM0Mk5qYzVNRFFnTUM0ME5qSXhOU0F3TGpZNE1EWTBPU0F3TGpRM05qZzFOU0F3TGpjd09UQTNPQ0F3TGpRNE56WXpPVU13TGpjek56VXdPQ0F3TGpRNU9EUXlNaUF3TGpjMk1qQXhOaUF3TGpVeE9EQXlPU0F3TGpjMk1qQXhOaUF3TGpVME9EUXhPVU13TGpjMk1qQXhOaUF3TGpVM09EZ3dPU0F3TGpjek9EUTRPQ0F3TGpZd056Y3lPU0F3TGpZNE9UUTNNaUF3TGpZd056Y3lPVU13TGpZM01URXpPQ0F3TGpZd056a3pNeUF3TGpZMU16QTJOaUF3TGpZd016TTNNeUF3TGpZek56QXlOQ0F3TGpVNU5EUTVOVXd3TGpZME1qa3dOaUF3TGpVM01qUXpOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eHlZV1JwWVd4SGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gzSmhaR2xoYkY4eE1qUXdYekl5TnpZM0lpQmplRDBpTUNJZ1kzazlJakFpSUhJOUlqRWlJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCbmNtRmthV1Z1ZEZSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVEV4TlNBd0xqVXhNVE15TXlrZ2MyTmhiR1VvTUM0ME1UWTJORElwSWo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNHhPQ0lnYzNSdmNDMWpiMnh2Y2owaUl6VkZRVEJGUmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4TDNKaFpHbGhiRWR5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01GOHhNalF3WHpJeU56WTNJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpnNE1qSTVPQ0lnYUdWcFoyaDBQU0l3TGpnNE1qSTVPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01URTVOaUF3TGpBMk1EQTFPRFlwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNCIgeT0iNTUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjAiIHZhbHVlPSJBenVyZSBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkgLT4gQXp1cmUgQXBwbGljYXRpb24gR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj00MzU1OGRlYi1jMzMzLTRjMWUtYjE0Ni1jZWExYzVjZjA3YTA7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC45MTE7ZW50cnlZPTAuMjg5O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMyIgc291cmNlPSIxMyIgdGFyZ2V0PSI0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMTUyIiB5PSIzNTciLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IkF6dXJlIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSIgc3R5bGU9ImlyLnJlZj02ZDRhNmJkMi00MTQzLTRlNzctYmYyZi0zMTdiMmQ4ZjMyODM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdBRjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNE1Ea3pJREF1TnpZek5UQXlRekF1TmpJMk1UQTNJREF1T0RFNU16VTRJREF1TlRNME9UTXhJREF1T0RRME5ETXlJREF1TkRRME5UQTJJREF1T0RNek1qUXhRekF1TXpVME1EZ3lJREF1T0RJeU1EVXhJREF1TWpjeE56WTVJREF1TnpjMU5UQTJJREF1TWpFMU5UY3hJREF1TnpBek56ZzNRekF1TVRVNU16Y3pJREF1TmpNeU1EWTRJREF1TVRNek9EWTFJREF1TlRReE1ERXlJREF1TVRRME5qSTFJREF1TkRVd05UTTJRekF1TVRVMU16ZzBJREF1TXpZd01EVTVJREF1TWpBeE5UTTNJREF1TWpjM05USTJJREF1TWpjeU9UZzNJREF1TWpJd09UZzNUREF1TWpjM01ETTJJREF1TWpFMk9UTTRRekF1TXpRNU5UZ3lJREF1TVRZeE9UazRJREF1TkRRd09EazVJREF1TVRNM09UUTRJREF1TlRNeE1EazJJREF1TVRVd01ESTJRekF1TmpJeE1qa3pJREF1TVRZeU1UQTBJREF1TnpBek1EWTFJREF1TWpBNU16TXhJREF1TnpVNE5qQXlJREF1TWpneE5ESXlRekF1T0RFME1UTTRJREF1TXpVek5URXlJREF1T0RNNE9UUXhJREF1TkRRME5qSTNJREF1T0RJM05qQTRJREF1TlRNME9USkRNQzQ0TVRZeU56VWdNQzQyTWpVeU1UUWdNQzQzTmprM01qTWdNQzQzTURjek56TWdNQzQyT1Rnd09UTWdNQzQzTmpNMU1ESmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjl5WVdScFlXd3BJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBek56Y2dNQzQxTmpFMU1qTkRNQzR5TURjM016a2dNQzQxT1RZd01Ua2dNQzR4T1RZNU1qZ2dNQzQyTXpFeE5UWWdNQzR4T0RjNU9EZ2dNQzQyTmpZM09EbE1NQzR5TVRJeU9DQXdMamN3TXpJeU4wd3dMakl6TmpVM01pQXdMamN5TnpVeE9VTXdMakkwTlRJME9TQXdMalkzT0RVMk15QXdMakkyTURJeE9DQXdMall6TURrek5DQXdMakk0TVRFd055QXdMalU0TlRneE5rTXdMakkxT0RjMU1pQXdMalU0TkRVM05pQXdMakl6TnpReUlEQXVOVGMyTURReklEQXVNakl3TXpjM0lEQXVOVFl4TlRJeldpSWdabWxzYkQwaUl6Z3pRamxHT1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qWXdPRFkwSURBdU16YzBOek0xUXpBdU1qUTNNVFUzSURBdU16TTJOelV4SURBdU1qTTNOalUwSURBdU1qazNNemM1SURBdU1qTXlOVEl6SURBdU1qVTNNekkwUXpBdU1qRTFORGsxSURBdU1qYzBNemsySURBdU1qQXdOVFEySURBdU1qa3pOREl4SURBdU1UZzNPVGc0SURBdU16RTBNREExUXpBdU1Ua3lNalEySURBdU16UTNNak0xSURBdU1qQXdOQ0F3TGpNM09UZzBPU0F3TGpJeE1qSTRJREF1TkRFeE1UY3pRekF1TWpJME56VTFJREF1TXprME56STVJREF1TWpReE5UZzBJREF1TXpneU1UQTJJREF1TWpZd09EWTBJREF1TXpjME56TTFWakF1TXpjME56TTFXaUlnWm1sc2JEMGlJemd6UWpsR09TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNamszTXpBeUlEQXVOVGc1TnpFNVF6QXVNelUzTmpjMElEQXVOVGc1TnpFNUlEQXVOREEyTmpFMUlEQXVOVFF3TnpjNElEQXVOREEyTmpFMUlEQXVORGd3TkRBM1F6QXVOREEyTmpFMUlEQXVOREl3TURNMUlEQXVNelUzTmpjMElEQXVNemN4TURrMElEQXVNamszTXpBeUlEQXVNemN4TURrMFF6QXVNak0yT1RNZ01DNHpOekV3T1RRZ01DNHhPRGM1T0RnZ01DNDBNakF3TXpVZ01DNHhPRGM1T0RnZ01DNDBPREEwTURkRE1DNHhPRGM1T0RnZ01DNDFOREEzTnpnZ01DNHlNelk1TXlBd0xqVTRPVGN4T1NBd0xqSTVOek13TWlBd0xqVTRPVGN4T1ZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5ReFgyeHBibVZoY2lraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTFPVEkyT0NBd0xqWTRNamM0TVVNd0xqUTFPVGcxTVNBd0xqWTJNelEwT0NBd0xqUTJOams0T1NBd0xqWTBORGc0T0NBd0xqUTNPVFV4TVNBd0xqWXpNREUwT0VNd0xqUTBNVFl4TkNBd0xqWXhNRFE1TmlBd0xqUXdOek0zTmlBd0xqVTRORFEzTlNBd0xqTTNPREk1TlNBd0xqVTFNekl5TTBNd0xqTTJNVGszT1NBd0xqVTNNREUySURBdU16UXdOekl4SURBdU5UZ3hORGs0SURBdU16RTNOVFkySURBdU5UZzFOakV5UXpBdU16TTJOemcwSURBdU5qQTFOVGMxSURBdU16VTNNRFUySURBdU5qSTBORGsySURBdU16YzRNamsxSURBdU5qUXlNamswUXpBdU5EQXlPREkxSURBdU5qWXlNamMySURBdU5ETXdNRGswSURBdU5qYzROak0zSURBdU5EVTVNalk0SURBdU5qa3dPRGM0VmpBdU5qZ3lOemd4V2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFME16VTJJREF1Tmprd09EVTRRekF1TmpjMk1qUTFJREF1Tmprd09ESTBJREF1TmpNNE1qUTJJREF1TmpnMk56VXlJREF1TmpBd09Ua3pJREF1TmpjNE56RXhWakF1TmpneU56WkRNQzQyTURFd055QXdMalk1TVRnd05pQXdMalU1T1RNeE55QXdMamN3TURjM05DQXdMalU1TlRnek9DQXdMamN3T1RFeU5FTXdMalU1TWpNMU9TQXdMamN4TnpRM05DQXdMalU0TnpJeU55QXdMamN5TlRBek5DQXdMalU0TURjMUlEQXVOek14TXpRNVF6QXVOakkyTURjNUlEQXVOelF3TURnNUlEQXVOamN5TXpZeklEQXVOelF5T0RFeUlEQXVOekU0TkRBMUlEQXVOek01TkRRM1F6QXVOek0wTlRrNUlEQXVOekl6TWpVZ01DNDNOVEEzT1RRZ01DNDNNRE13TURVZ01DNDNOalk1T0RrZ01DNDJPRFk0TURsRE1DNDNORGsyTnprZ01DNDJPVEF6TWpjZ01DNDNNeklnTUM0Mk9URTJPRGNnTUM0M01UUXpOVFlnTUM0Mk9UQTROVGhXTUM0Mk9UQTROVGhhSWlCbWFXeHNQU0lqT0ROQ09VWTVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTVRFNU1pQXdMak16TkRRMVF6QXVOVGcyTVRrNElEQXVNamszTmpRMUlEQXVOalkzT0RreElEQXVNamM0TWpZZ01DNDNOVEEzT0RjZ01DNHlOemMzTjBNd0xqY3pNelUySURBdU1qVTFPRGd6SURBdU56RXpNRGM1SURBdU1qTTJOelk0SURBdU5qa3dNRFU0SURBdU1qSXhNRGc1UXpBdU5qSTBOamMzSURBdU1qSTFOemsySURBdU5UWXdORFV6SURBdU1qUXdPREkzSURBdU5EazVOemMwSURBdU1qWTFOakkwUXpBdU5EZzFPRGd6SURBdU1qY3hOVFE1SURBdU5EY3lNell6SURBdU1qYzRNekE1SURBdU5EVTVNamc0SURBdU1qZzFPRFkzUXpBdU5ESTROalkzSURBdU1qUTVNell5SURBdU5EQXhOVFUySURBdU1qRXdNRFV5SURBdU16YzRNekUySURBdU1UWTRORFUzUXpBdU16WTFNek00SURBdU1UWTVNelU1SURBdU16VXlPREF5SURBdU1UY3pOVE00SURBdU16UXhPRGM0SURBdU1UZ3dOakF6UXpBdU16WTJORFEzSURBdU1qSTBPRGN6SURBdU16azBPRGs1SURBdU1qWTJPRGMwSURBdU5ESTJPRGs1SURBdU16QTJNVEZETUM0ek9UUXhNRElnTUM0ek1qUTNNaklnTUM0ek5qUXhNVE1nTUM0ek5EYzRPVFVnTUM0ek16YzRNeUF3TGpNM05Ea3pOME13TGpNMU9UVXdNaUF3TGpNNE5EQTNNU0F3TGpNM056ZzJOaUF3TGpNNU9UWXhJREF1TXprd05EWXhJREF1TkRFNU5EY3lRekF1TkRFek1qTTRJREF1TXprMU9EUXlJREF1TkRNNU1URTFJREF1TXpjMU5ERXpJREF1TkRZM016ZzFJREF1TXpVNE56UXlRekF1TlRFeU5ETWdNQzQwTURjeU56VWdNQzQxTmpJMk5qTWdNQzQwTlRBM01qRWdNQzQyTVRjeE9ETWdNQzQwT0RneU9UaERNQzQyTWpFeU5EUWdNQzQwTnpJM05UZ2dNQzQyTWprMk56UWdNQzQwTlRnM01EZ2dNQzQyTkRFME56VWdNQzQwTkRjNE1USkRNQzQxT1RVME5qZ2dNQzQwTVRNek56WWdNQzQxTlRJeE5UY2dNQzR6TnpVME56a2dNQzQxTVRFNU1pQXdMak16TkRRMVZqQXVNek0wTkRWYUlpQm1hV3hzUFNJak9ETkNPVVk1SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk9UUXdOVEVnTUM0MU9ERXdPVE5ETUM0M016WTFNelVnTUM0MU9ERXdPVE1nTUM0M056QTVOelVnTUM0MU5EWTJOVE1nTUM0M056QTVOelVnTUM0MU1EUXhOamxETUM0M056QTVOelVnTUM0ME5qRTJPRFlnTUM0M016WTFNelVnTUM0ME1qY3lORFlnTUM0Mk9UUXdOVEVnTUM0ME1qY3lORFpETUM0Mk5URTFOamNnTUM0ME1qY3lORFlnTUM0Mk1UY3hNallnTUM0ME5qRTJPRFlnTUM0Mk1UY3hNallnTUM0MU1EUXhOamxETUM0Mk1UY3hNallnTUM0MU5EWTJOVE1nTUM0Mk5URTFOamNnTUM0MU9ERXdPVE1nTUM0Mk9UUXdOVEVnTUM0MU9ERXdPVE5hSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpNMk5EZ2dNQzQxTlRZNE1ETkRNQzQ0TVRrMklEQXVOVFV5TnpVMElEQXVPREUxTlRVeElEQXVOVFV5TnpVMElEQXVPREV4TlRBeklEQXVOVFE0TnpBMlF6QXVPREEzTkRVMElEQXVOVFEwTmpVM0lEQXVPREF6TkRBMUlEQXVOVFEwTmpVM0lEQXVOems1TXpVM0lEQXVOVFF3TmpBNFNEQXVOemsxTXpBNFREQXVOemd6TVRZeUlEQXVOVE15TlRFeFNEQXVOemM1TVRFelREQXVOelkyT1RZNElEQXVOVEkwTkRFMFF6QXVOell6T0RVZ01DNDFNemt5TWprZ01DNDNOVFV4TlRJZ01DNDFOVEl5TnpVZ01DNDNOREkyTnpZZ01DNDFOakE0TlRGRE1DNDNORFkzTWpRZ01DNDFOalE1SURBdU56VXdOemN6SURBdU5UWTBPU0F3TGpjMU9EZzNJREF1TlRZNE9UUTVTREF1TnpZeU9URTVRekF1TnpZMk9UWTRJREF1TlRjeU9UazNJREF1TnpjeE1ERTJJREF1TlRjeU9UazNJREF1TnpjMU1EWTFJREF1TlRjM01EUTJRekF1TnpnM01qRXhJREF1TlRnMU1UUXpJREF1TnprNU16VTNJREF1TlRnNU1Ua3hJREF1T0RFeE5UQXpJREF1TlRrM01qZzVRekF1T0RFMU5UVXhJREF1TlRnMU1UUXpJREF1T0RFNU5pQXdMalUyT0RrME9TQXdMamd5TXpZME9DQXdMalUxTmpnd00xb2lJR1pwYkd3OUlpTTRNMEk1UmpraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqSTVOek13TWlBd0xqVTRPVGN4T1VNd0xqTTFOelkzTkNBd0xqVTRPVGN4T1NBd0xqUXdOall4TlNBd0xqVTBNRGMzT0NBd0xqUXdOall4TlNBd0xqUTRNRFF3TjBNd0xqUXdOall4TlNBd0xqUXlNREF6TlNBd0xqTTFOelkzTkNBd0xqTTNNVEE1TkNBd0xqSTVOek13TWlBd0xqTTNNVEE1TkVNd0xqSXpOamt6SURBdU16Y3hNRGswSURBdU1UZzNPVGc0SURBdU5ESXdNRE0xSURBdU1UZzNPVGc0SURBdU5EZ3dOREEzUXpBdU1UZzNPVGc0SURBdU5UUXdOemM0SURBdU1qTTJPVE1nTUM0MU9EazNNVGtnTUM0eU9UY3pNRElnTUM0MU9EazNNVGxhSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTXpJeE5qUWdNQzQzTlRVMk1UVkRNQzQxTnpJME1USWdNQzQzTlRVMk1UVWdNQzQyTURVd016a2dNQzQzTWpJNU9EY2dNQzQyTURVd016a2dNQzQyT0RJM016bERNQzQyTURVd016a2dNQzQyTkRJME9URWdNQzQxTnpJME1USWdNQzQyTURrNE5qTWdNQzQxTXpJeE5qUWdNQzQyTURrNE5qTkRNQzQwT1RFNU1UY2dNQzQyTURrNE5qTWdNQzQwTlRreU9TQXdMalkwTWpRNU1TQXdMalExT1RJNUlEQXVOamd5TnpNNVF6QXVORFU1TWprZ01DNDNNakk1T0RjZ01DNDBPVEU1TVRjZ01DNDNOVFUyTVRVZ01DNDFNekl4TmpRZ01DNDNOVFUyTVRWYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek5EVTVNemNnTUM0MU5qRTFNak5JTUM0NE16VTRNVGhETUM0NE5ETTVNVFlnTUM0MU5qRTFNak1nTUM0NE5UWXdOakVnTUM0MU5qazJNakVnTUM0NE5UWXdOakVnTUM0MU56YzNNVGhXTUM0NE16WTRNekpETUM0NE5UVTNNVGtnTUM0NE5ESXdPRGdnTUM0NE5UTTBOellnTUM0NE5EY3dOQ0F3TGpnME9UYzFNU0F3TGpnMU1EYzJOVU13TGpnME5qQXlOeUF3TGpnMU5EUTVJREF1T0RReE1EYzFJREF1T0RVMk56TXpJREF1T0RNMU9ERTRJREF1T0RVM01EYzFTREF1TXpRMU9UTTNRekF1TXpReE1USTRJREF1T0RVMk5EZzFJREF1TXpNMk56UXhJREF1T0RVME1ETTNJREF1TXpNek56RTBJREF1T0RVd01qVTBRekF1TXpNd05qZzRJREF1T0RRMk5EY3hJREF1TXpJNU1qWXlJREF1T0RReE5qVXpJREF1TXpJNU56UXlJREF1T0RNMk9ETXlWakF1TlRneE56WTNRekF1TXpJNU1qWXlJREF1TlRjMk9UUTJJREF1TXpNd05qZzRJREF1TlRjeU1USTRJREF1TXpNek56RTBJREF1TlRZNE16UTFRekF1TXpNMk56UXhJREF1TlRZME5UWXlJREF1TXpReE1USTRJREF1TlRZeU1URXpJREF1TXpRMU9UTTNJREF1TlRZeE5USXpWakF1TlRZeE5USXpXaUlnWm1sc2JEMGlJemd5TVRBeE1DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGsxTnpnM0lEQXVOVGt6TnpWSU1DNHpOVEF3TXpkV01DNDJOVGcxTWpsSU1DNDBPVFUzT0RkV01DNDFPVE0zTlZvaUlHWnBiR3c5SWlORk5qSXpNak1pTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZMk5UYzJPU0F3TGpVNU16YzFTREF1TlRJd01ESldNQzQyTlRnMU1qbElNQzQyTmpVM05qbFdNQzQxT1RNM05Wb2lJR1pwYkd3OUlpTkdSamN6T0RFaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNVGcwT1NBd0xqVTVNemMxU0RBdU5qZzJNRGsyVmpBdU5qVTROVEk1U0RBdU9ETXhPRFE1VmpBdU5Ua3pOelZhSWlCbWFXeHNQU0lqUlRZeU16SXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTVRBM05qY2dNQzQyTnpnM01URklNQzR6TlRBd016ZFdNQzQzTkRNME9USklNQzQwTVRBM05qZFdNQzQyTnpnM01URmFJaUJtYVd4c1BTSWpSVFl5TXpJeklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNekUzTWpVZ01DNDJOemczTVRGSU1DNDNOekE1T1RaV01DNDNORE0wT1RKSU1DNDRNekUzTWpWV01DNDJOemczTVRGYUlpQm1hV3hzUFNJalJrWTNNemd4SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU9EQTJPRGdnTUM0Mk56ZzNNVEZJTUM0ME16UTVNemRXTUM0M05ETTBPVEpJTUM0MU9EQTJPRGhXTUM0Mk56ZzNNVEZhSWlCbWFXeHNQU0lqUmtZM016Z3hJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTkRZMk9Ua2dNQzQyTnpnM01URklNQzQyTURBNU5USldNQzQzTkRNME9USklNQzQzTkRZMk9UbFdNQzQyTnpnM01URmFJaUJtYVd4c1BTSWpSVFl5TXpJeklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPVFUzT0RjZ01DNDNOak0yTnpKSU1DNHpOVEF3TXpkV01DNDRNamcwTkRoSU1DNDBPVFUzT0RkV01DNDNOak0yTnpKYUlpQm1hV3hzUFNJalJUWXlNekl6SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qVTNOamtnTUM0M05qTTJOekpJTUM0MU1qQXdNbFl3TGpneU9EUTBPRWd3TGpZMk5UYzJPVll3TGpjMk16WTNNbG9pSUdacGJHdzlJaU5HUmpjek9ERWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamd6TVRnME9TQXdMamMyTXpZM01rZ3dMalk0TmpBNU5sWXdMamd5T0RRME9FZ3dMamd6TVRnME9WWXdMamMyTXpZM01sb2lJR1pwYkd3OUlpTkZOakl6TWpNaUx6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BISmhaR2xoYkVkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmNtRmthV0ZzSWlCamVEMGlNQ0lnWTNrOUlqQWlJSEk5SWpFaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUJuY21Ga2FXVnVkRlJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5EZzFPVEk1SURBdU5Ea3lNVEE1S1NCelkyRnNaU2d3TGpNME16ZzROaWtpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRTRNeUlnYzNSdmNDMWpiMnh2Y2owaUl6VkZRVEJGUmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4TDNKaFpHbGhiRWR5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzR5T1RneE9UTWlJSGt4UFNJd0xqVTVNelkwTmlJZ2VESTlJakF1TWprMk9UTTNJaUI1TWowaU1DNDBNek16TmpJaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRRME5EUTBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzR4TWpNaUlITjBiM0F0WTI5c2IzSTlJaU5FTjBRM1JEY2lMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0ME1qRWlJSE4wYjNBdFkyOXNiM0k5SWlORlFrVkNSVUlpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDNNVFlpSUhOMGIzQXRZMjlzYjNJOUlpTkdPRVk0UmpnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkRSa05HUXlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNyIgeT0iMjI1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii02MjUiIHk9IjE4OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIxODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE1IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJpci5yZWY9MTg2ZDBjZmItZGIwZS00YmUxLWE3NzEtNjJiZjAxY2VkZGNjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIxNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJHZW5lcmljIENsaWVudCAtPiBBenVyZSBETlMgKERvbWFpbiBOYW1lIFN5c3RlbSkiIHN0eWxlPSJpci5yZWY9ZWU4OGZlMzUtOWVmYi00Y2Y4LTgxYmYtZTI2YzU5Y2ZmNjVhO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9IjE1IiB0YXJnZXQ9IjkiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Azure WAF (Web Application Firewall) -&gt; Azure Application Gateway" ref="43558deb-c333-4c1e-b146-cea1c5cf07a0" source="803627c9-d7fe-43f3-8bc1-571442c87223" target="ed384e04-bede-4c28-9efe-7662cd1d6253">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Azure Application Gateway -&gt; Subnet 1" ref="6f56a2e4-4e3a-4764-b780-7674449f0244" source="ed384e04-bede-4c28-9efe-7662cd1d6253" target="93915a63-309d-4fd5-8cf8-1e8c346f3dac">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Azure DNS (Domain Name System) -&gt; Azure WAF (Web Application Firewall)" ref="a917c8e8-ac63-4453-bf33-b49a608e5e8f" source="f72549b9-c513-41ed-9eb7-63730d128139" target="803627c9-d7fe-43f3-8bc1-571442c87223">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Subnet 2 -&gt; Azure Load Balancer" ref="b5f80a77-f7d6-4774-9f3e-9edc98d0e506" source="70317d76-9d27-4914-b512-80a1d22080b1" target="fe531998-3fcc-461c-922d-8541f758ab35">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Subnet 1 -&gt; Azure Load Balancer" ref="b6b54baf-7d73-4fc6-85d6-42e170aabf06" source="93915a63-309d-4fd5-8cf8-1e8c346f3dac" target="c8ab2ca0-1ed2-4c22-8e96-76ed382f4049">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; Azure DNS (Domain Name System)" ref="ee88fe35-9efb-4cf8-81bf-e26c59cff65a" source="a482191d-3ddd-4a7f-8a98-da175dac0d97" target="f72549b9-c513-41ed-9eb7-63730d128139">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="c4f49ef5-fbeb-41da-b36a-c2a7c33d2be4" diagramComponentId="3f6a4bda-2a75-42be-a67f-de3f6d1abb61" ref="2b860f59-c9c6-479c-9a92-08cadbd9128a" name="Azure Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-LOGS03" name="Audit logs can be deleted" state="0" impact="100" issueId="" issueLink="">
-          <desc>There is no external backups of log records. If logs are deleted, there is no way to recover
-                        them.ed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are typically introduced during the
-                        configuration of the software.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.813">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            More information: Doc MS Azure
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.616">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-LOGS02" name="Non-auditable connections to the web application" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The status connection or failed attempts cannot be audited because they are not recorded into
-                        the logs.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Detailed error messages&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-LOGS01" name="Non-auditable resource changes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The Diagnostic Logs are not activated and configured. Therefore, the changes or the access to
-                        the resources are not recorded into the logs.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that &amp;quot;Application Logging (Filesystem)&amp;quot; and &amp;quot;Application
-                            Logging (Blob)&amp;quot; are enabled.&lt;/li&gt;
-                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
-                            are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator account is not configured. The security question to recover or reset the
-                        password and the authentication method are not configured.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON06" name="Undetected brute force attempts on MS Azure management console" state="0" impact="100" issueId="" issueLink="">
-          <desc>The failure connection attempts (brute force) must be audited and monitored and correspondent
-                        personnel must be alerted and informed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when several console login failure attempts
-                            occur.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON05" name="Undetected changes in data encryption configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes on the database encryption must be audited and monitored. When there are changes
-                        on the database encryption, the security group must be alerted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the Transparent Data Encryption is
-                            disabled.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON07" name="Undetected changes in network configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Changes in network configurations (NACLs, route and gateway tables) are not detected because
-                        monitoring and alerting on the network is not configured to detect these changes.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC NACL changes.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC route table changes.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC gateway changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON01" name="Undetected changes in security configurations" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Monitoring and alerting for security configurations are not configured and changes cannot be
-                        detected.&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration
-                            changes.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the security policy changes.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the recommended configuration changes.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when activity alerts changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON04" name="Undetected changes in security groups" state="0" impact="100" issueId="" issueLink="">
-          <desc>The changes in security groups must be traced and monitored and the correspondent personnel
-                        must approve these changes. If the situation is not the correct, attackers can access to
-                        security systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the security groups or security group
-                            configurations change.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.339">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.736">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A08" name="Configure a strong security challenge questions for the user account" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        Activate and configure the security challenge question and the possibility of resetting the
-                        password by confirming the user's identity is allowed. Make sure that the security confirmation
-                        measures match the security criteria. Otherwise, it could make a weak confirmation and allow the&amp;nbsp;password
-                        reset to malicious users.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation: &amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Choose the security confirmation measures that match the security criteria and click
-                        &amp;quot;Save&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;ol&gt;
-                        &lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Azure AD self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-getting-started"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Configure the password expiration to force after a determinate time, the password code shall be
-                        changed for the users.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
-                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
-                        PowerShell. With the following command as the example:&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
-                        days. The users receive notification 14 days prior to that expiry.
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        More information:&amp;nbsp;
-                        &lt;a
-                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                        MS Azure&lt;/a&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;More information:
-                            &lt;a
-                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                            MS Azure&lt;/a&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A02" name="Configure the security challenge questions for the administrator account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Activate and configure the security challenge question and the possibility of resetting the password by confirming the user's identity is allowed. In case of being an owner account of the subscription that has full administration access, it is necessary to do this, as a security measure that this password is lost. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The security confirmation measures will depend on those specified by the Active Directory administrator. Make sure that the security confirmation measures match the security criteria. Otherwise, it could make a weak confirmation and allow the password reset to malicious users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Using the console:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;ol&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;Open https://aka.ms/ssprsetup and Log into the account.&lt;/li&gt; 
-   &lt;li&gt;Respond to security measures.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Once all needed controls are finished, click on accept.&lt;/li&gt; 
-  &lt;/ol&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Using the portal:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-   &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-   &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt; 
-   &lt;li&gt;Choose the security confirmation measures that match the security criteria and click &amp;quot;Save&amp;quot;.&lt;/li&gt; 
-  &lt;/ol&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Azure AD self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-getting-started"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Using the portal:
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are filled
-                            and enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M04" name="Create alerts due of Transparent Data Encryption Deletion" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes of
-                        Transparent Data Encryption to the correspondent personnel. It's vital that these unauthorized
-                        changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the Transparent Data Encryption is
-                            disabled.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.206">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M12" name="Create alerts for changes in security groups and in security groups configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
-                        the security groups or in security groups configurations to the correspondent personnel. It's
-                        vital that these unauthorized changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the security groups or security group
-                            configurations change.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M02" name="Create alerts for security policy changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the Management
-                        Security Policies changes to the correspondent personnel. It's vital that these unauthorized
-                        changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the security policy changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M08" name="Create alerts for VPC gateway changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
-                        the VPC gateway tables to the correspondent personnel. It's vital that these unauthorized
-                        changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;VPC gateways are used as a means of sending traffic outside of VPC (i.e. to the
-                        Internet) and are vital in ensuring traffic flows to correct destination. Therefore alerting on
-                        changes to VPC gateways ensuring traffic continues to flow as expected via the correct gateway.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC gateway changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M06" name="Create alerts for VPC NACL changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
-                        the Network Access Control Lists (NACLs) to the correspondent personnel. It's vital that these
-                        unauthorized changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The Network Access Control Lists (NACLs) control inbound and outbound access to &amp;amp; from
-                        MS Azure subnets and work like packet filters to protect the network. Therefore alerting on
-                        changes to NACLs help ensure that the subnets protected by them are not exposed.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC NACL changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M07" name="Create alerts for VPC route table changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
-                        the VPC route tables to the correspondent personnel. It's vital that these unauthorized changes
-                        are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        VPC route table provides a means of routing network traffic between subnets and via gateways and
-                        ensures traffic flows via the correct path. Therefore alerting on changes to route tables
-                        ensuring the traffic continues to flow as expected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when the VPC route table changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M03" name="Create alerts to detect changes in the recommendation configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
-                        the recommendation configurations to the correspondent personnel. It's vital that these
-                        unauthorized changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to alert when the recommended configuration changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M09" name="Create alerts to detect changes on activity alerts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the alert
-                        modifications to the correspondent personnel. It's vital that these unauthorized changes are
-                        detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when activity alerts&amp;nbsp;changes.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M10" name="Create alerts to notify a bad usage of the root account" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the usage of the
-                        root accounts to the correspondent personnel. It's vital that these unauthorized changes are
-                        detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M11" name="Create alerts to notify about the console login without MFA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for Activity Log changes to monitor, audit and notify about the user's login into
-                        the console without Multi-factor Authentication to the correspondent personnel. It's vital that
-                        these unauthorized changes are detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M05" name="Create alerts to notify the console login failure attempts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Create alerts for the Activity Logs changes to monitor, audit and notify about the console login
-                        failure attempts to the correspondent personnel. It's vital that these unauthorized changes are
-                        detected.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
-                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when several&amp;nbsp;console login failure
-                            attempts occur.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD19" name="Create a resource lock administrator role" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Given the resource lock functionality is outside of standard Role Based Access Control(RBAC), it would be prudent to create a resource lock administrator role to prevent inadvertent unlocking of resources.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;By adding this role is you can have specific permissions granted for managing just resource locks rather than needing to provide the wide owner or contributor role reducing the risk of the user being able to do unintentional damage.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Azure Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Azure portal, open a subscription or resource group where you want the custom role to be assignable.&lt;/li&gt;&lt;li&gt;Select Access control (IAM)&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Select Add custom role`.&lt;/li&gt;&lt;li&gt;In the Custom Role Name field enter Resource Lock Administrator&lt;/li&gt;&lt;li&gt;In the Description field enter Can Administer Resource Locks&lt;/li&gt;&lt;li&gt;For Baseline permissions select Start from scratch&lt;/li&gt;&lt;li&gt;Click next&lt;/li&gt;&lt;li&gt;In the Permissions tab select Add permissions&lt;/li&gt;&lt;li&gt;In the Search for a permission box, type in Microsoft.Authorization/locks to search for permissions.&lt;/li&gt;&lt;li&gt;Select the check box next to the permission called Microsoft.Authorization/locks&lt;/li&gt;&lt;li&gt;Click add&lt;/li&gt;&lt;li&gt;Click Review+create&lt;/li&gt;&lt;li&gt;Click Create&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Assign the newly created role to the appropriate user. Using PowerShell: Below is a power shell definition for a resource lock administrator role created at an Azure Management group level&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Import-Module Az.Accounts Connect-AzAccount $role = Get-AzRoleDefinition "User Access Administrator" $role.Id = $null $role.Name = "Resource Lock Administrator" $role.Description = "Can Administer Resource Locks" $role.Actions.Clear() $role.Actions.Add("Microsoft.Authorization/locks/*") $role.AssignableScopes.Clear() * Scope at the Management group level Management group $role.AssignableScopes.Add("/providers/Microsoft.Management/managementGroups/MG-Name") New-AzRoleDefinition -Role $role Get-AzureRmRoleDefinition "Resource Lock Administrator"&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.23" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Azure Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Azure portal, open a subscription or resource group where you want the view assigned roles.&lt;/li&gt;&lt;li&gt;Select Access control (IAM)&lt;/li&gt;&lt;li&gt;Select Roles&lt;/li&gt;&lt;li&gt;Search for the custom role named &amp;lt;role_name&amp;gt; Ex. from remediation "Resource Lock Administrator"&lt;/li&gt;&lt;li&gt;Ensure that the role is assigned the appropriate user/users&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L03" name="Enable Detailed error messages" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Enable the detailed error information for HTTP status codes that indicate a failure (status code
-                        400 or greater) is saved into the logs files. This may contain information that can help
-                        determine why the server returned the error code.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                        &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                        &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Enable the &amp;quot;Detailed error messages&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Push &amp;quot;Save&amp;quot; to save the changes.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Detailed error messages&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.052">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
-  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
-                            are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.582">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N08" name="Isolate Azure resources into separate VNets by function" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Place the resources into separate VNets according to their use (production, development, test).
-                        Placing such resources accordingly ensures that a resource of a higher security level is not
-                        exposed by the security settings of a lower labeled VNet.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
-                        &lt;li&gt;Migrate or move it to the correct Vnet.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Azure Virtual Network" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
-                            &lt;li&gt;Check that the resources are into the correct Vnet.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.582">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.738">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.738">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNAUDITABLE-CHANGES-AZURE" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>If audit trails are not properly protected, an attacker could gain access to the
-                                system, modify the status of resources or exfiltrate sensitive data without being
-                                noticed.</desc>
-              <riskRating confidentiality="25" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-LOGS01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-L01" mitigation="20"/>
-                    <countermeasure ref="AZ-L02" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-LOGS02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-L03" mitigation="20"/>
-                    <countermeasure ref="AZ-L04" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-LOGS03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-L05" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-L01" mitigation="20"/>
-                <countermeasure ref="AZ-L02" mitigation="20"/>
-                <countermeasure ref="AZ-L03" mitigation="20"/>
-                <countermeasure ref="AZ-L04" mitigation="20"/>
-                <countermeasure ref="AZ-L05" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-ACCESS-ROOT-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A02" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A01" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A01" mitigation="25"/>
-                <countermeasure ref="AZ-A02" mitigation="25"/>
-                <countermeasure ref="AZ-A03" mitigation="25"/>
-                <countermeasure ref="AZ-A04" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                    <countermeasure ref="AZ-A08" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZ-A08" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="30"/>
-                    <countermeasure ref="AZ-A11" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="30"/>
-                <countermeasure ref="AZ-A11" mitigation="30"/>
-                <countermeasure ref="AZ-A12" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-16">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD19" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD19" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG ACTIVITY ALERTS" name="Log Activity alerts" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-SYSTEMS" name="Attackers access the systems without being detected" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected and consequently, changes made by attackers can not be audited or detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="25" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M10" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M11" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON05">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M04" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON06">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M05" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-M04" mitigation="20"/>
-                <countermeasure ref="AZ-M05" mitigation="20"/>
-                <countermeasure ref="AZ-M10" mitigation="20"/>
-                <countermeasure ref="AZ-M11" mitigation="20"/>
-                <countermeasure ref="AZ-M12" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Attackers could gain undetected access to the security system configurations and
-                                changes made by attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-MON01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M01" mitigation="25"/>
-                    <countermeasure ref="AZ-M02" mitigation="25"/>
-                    <countermeasure ref="AZ-M03" mitigation="25"/>
-                    <countermeasure ref="AZ-M09" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-M01" mitigation="25"/>
-                <countermeasure ref="AZ-M02" mitigation="25"/>
-                <countermeasure ref="AZ-M03" mitigation="25"/>
-                <countermeasure ref="AZ-M09" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-MON07">
-                  <countermeasures>
-                    <countermeasure ref="AZ-M06" mitigation="40"/>
-                    <countermeasure ref="AZ-M07" mitigation="30"/>
-                    <countermeasure ref="AZ-M08" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-M06" mitigation="40"/>
-                <countermeasure ref="AZ-M07" mitigation="30"/>
-                <countermeasure ref="AZ-M08" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N08" mitigation="50"/>
-                    <countermeasure ref="AZ-N09" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N08" mitigation="50"/>
-                <countermeasure ref="AZ-N09" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="d88aac13-8af9-45f8-9416-e5f6189461f0" diagramComponentId="84708d10-f0ba-4c0e-a9a2-e2494ff5c53f" ref="70317d76-9d27-4914-b512-80a1d22080b1" name="Subnet 2" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="efc2c6b2-6c06-46b5-ae9d-986b1c580372" diagramComponentId="f5fe6b23-7bd0-4e00-8f36-6888079954e7" ref="ed384e04-bede-4c28-9efe-7662cd1d6253" name="Azure Application Gateway" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="microsoft-azure-application-gateway">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not adequately configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.917">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW7" name="Configure end-to-end encryption with TLS for Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Configure end-to-end encryption with TLS for Azure Application Gateway&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Encrypt all sensitive information in transit by configuring end-to-end encryption with TLS for your Azure Application Gateways.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a new application gateway with end-to-end TLS&lt;/p&gt; 
-&lt;p&gt;To create a new application gateway with end-to-end TLS encryption, you will need to first enable TLS termination while creating a new application gateway. This action enables TLS encryption for communication between the client and application gateway. Then, you will need to put on the Safe Recipients list the certificates for the backend servers in the HTTP settings. This configuration enables TLS encryption for communication between the application gateway and the backend servers. That accomplishes end-to-end TLS encryption.&lt;/p&gt; 
-&lt;p&gt;Add authentication/root certificates of backend servers&lt;/p&gt; 
-&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
-&lt;p&gt;2. Select HTTP settings from the left-side menu. Azure automatically created a default HTTP setting, appGatewayBackendHttpSettings, when you created the application gateway.&lt;/p&gt; 
-&lt;p&gt;3. Select appGatewayBackendHttpSettings.&lt;/p&gt; 
-&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Backend authentication certificates or Trusted root certificates appears.&lt;/p&gt; 
-&lt;p&gt;5. Select Create new.&lt;/p&gt; 
-&lt;p&gt;6. In the Name field, enter a suitable name.&lt;/p&gt; 
-&lt;p&gt;7. Select the certificate file in the Upload CER certificate box.&lt;/p&gt; 
-&lt;p&gt;For Standard and WAF (v1) application gateways, you should upload the public key of your backend server certificate in .cer format.&lt;/p&gt; 
-&lt;p&gt;For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the backend server certificate in .cer format. If the backend certificate is issued by a well-known certificate authority (CA), you can select the Use Well Known CA Certificate check box, and then you do not have to upload a certificate.&lt;/p&gt; 
-&lt;p&gt;8. Select Save.&lt;/p&gt; 
-&lt;p&gt;Enable end-to-end TLS for an existing application gateway&lt;/p&gt; 
-&lt;p&gt;To configure an existing application gateway with end-to-end TLS encryption, you must first enable TLS termination in the listener. This action enables TLS encryption for communication between the client and the application gateway. Then, put those certificates for backend servers in the HTTP settings on the Safe Recipients list. This configuration enables TLS encryption for communication between the application gateway and the backend servers. That accomplishes end-to-end TLS encryption.&lt;/p&gt; 
-&lt;p&gt;You will need to use a listener with the HTTPS protocol and a certificate for enabling TLS termination. You can either use an existing listener that meets those conditions or create a new listener. If you choose the former option, you can ignore the following "Enable TLS termination in an existing application gateway" section and move directly to the "Add authentication/trusted root certificates for backend servers" section.&lt;/p&gt; 
-&lt;p&gt;If you choose the latter option, apply the steps in the following procedure.&lt;/p&gt; 
-&lt;p&gt;Enable TLS termination in an existing application gateway&lt;/p&gt; 
-&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
-&lt;p&gt;2. Select Listeners from the left-side menu.&lt;/p&gt; 
-&lt;p&gt;3. Select either Basic or Multi-site listener depending on your requirements.&lt;/p&gt; 
-&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Certificate appears.&lt;/p&gt; 
-&lt;p&gt;5. Upload the PFX certificate you intend to use for TLS termination between the client and the application gateway.&lt;/p&gt; 
-&lt;p&gt;Note: For testing purposes, you can use a self-signed certificate. However, this is not advised for production workloads, because they are harder to manage and are not completely secure. &lt;/p&gt; 
-&lt;p&gt;6. Add other required settings for the Listener, depending on your requirements.&lt;/p&gt; 
-&lt;p&gt;7. Select OK to save.&lt;/p&gt; 
-&lt;p&gt;Add authentication/trusted root certificates of backend servers&lt;/p&gt; 
-&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
-&lt;p&gt;2. Select HTTP settings from the left-side menu. You can either put certificates in an existing backend HTTP setting on the Safe Recipients list or create a new HTTP setting. (In the next step, the certificate for the default HTTP setting, appGatewayBackendHttpSettings, is added to the Safe Recipients list.)&lt;/p&gt; 
-&lt;p&gt;3. Select appGatewayBackendHttpSettings.&lt;/p&gt; 
-&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Backend authentication certificates or Trusted root certificates appears.&lt;/p&gt; 
-&lt;p&gt;5. Select Create new.&lt;/p&gt; 
-&lt;p&gt;6. In the Name field, enter a suitable name.&lt;/p&gt; 
-&lt;p&gt;7. Select the certificate file in the Upload CER certificate box.&lt;/p&gt; 
-&lt;p&gt;For Standard and WAF (v1) application gateways, you should upload the public key of your backend server certificate in .cer format.&lt;/p&gt; 
-&lt;p&gt;For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the backend server certificate in .cer format. If the backend certificate is issued by a well-known CA, you can select the Use Well Known CA Certificate check box, and then you do not have to upload a certificate.&lt;/p&gt; 
-&lt;p&gt;8. Select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure end-to-end TLS by using Application Gateway with the portal" url="https://docs.microsoft.com/en-us/azure/application-gateway/end-to-end-ssl-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that end-to-end encryption is enabled for all Azure Application Gateways.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Custom rules that you create 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a policy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
-&lt;/div&gt; 
-&lt;div&gt;
-  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Association tab, enter one of the following settings, then select Add: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select Review + create, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
-            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test the application gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Find the public IP address for the application gateway on its Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Copy the public IP address, and then paste it into the address bar of your browser. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable and use Traffic Analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Visualize network activity across your Azure subscriptions and identify hot spots. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Pinpoint network misconfigurations leading to failed connections in your network. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable Network Watcher 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select a network security group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable flow log settings 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling flow log settings, you must complete the following tasks: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register the Azure Insights provider, if it's not already registered for your subscription: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  New-AzStorageAccount ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Location westcentralus ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -SkuName Standard_LRS ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Kind StorageV2 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the following options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Select On for Status 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Select On for Traffic Analytics Status. 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View traffic analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
-&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
-&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
-&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
-&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW4" name="Enable DDoS Standard protection on your Azure VNets associated with Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable DDoS Standard protection on your Azure Virtual Networks Enable DDoS Standard protection on your Azure VNets associated with Application Gateway&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Enable DDoS Standard protection on your Azure Virtual Networks associated with your production instances of Azure Application Gateway to guard against DDoS attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;3. Select Create.&lt;/p&gt; 
-&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
-&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
-&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you do not have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
-
-  &lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
-
-  &lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
-2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
-3. Select your DDoS protection plan from the list.&lt;/p&gt;
-
-  &lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW3" name="Enable diagnostic settings for Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable diagnostic settings for Application Gateway&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Activity logging is automatically enabled for every Resource Manager resource. You must enable access and performance logging to start collecting the data available through those logs.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable logging through the Azure portal&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, find your resource and select Diagnostic settings.&lt;/p&gt; 
-&lt;p&gt;For Application Gateway, three logs are available:&lt;br&gt; - Access log&lt;br&gt; - Performance log&lt;br&gt; - Firewall log&lt;/p&gt; 
-&lt;p&gt;2. To start collecting data, select Turn on diagnostics.&lt;/p&gt; 
-&lt;p&gt;3. The Diagnostics settings page provides the settings for the diagnostic logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the diagnostic logs.&lt;/p&gt; 
-&lt;p&gt;4. Type a name for the settings, confirm the settings, and select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Back-end health and diagnostic logs for Application Gateway" url="https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;View and analyze the access, performance, and firewall logs&lt;/p&gt;
-
-  &lt;p&gt;Azure Monitor logs can collect the counter and event log files from your Blob storage account. It includes visualizations and powerful search capabilities to analyze your logs.&lt;/p&gt;
-
-  &lt;p&gt;You can also connect to your storage account and retrieve the JSON log entries for access and performance logs. After you download the JSON files, you can convert them to CSV and view them in Excel, Power BI, or any other data-visualization tool.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW6" name="Enable HTTPS/SSL for trusted certificates when deploying Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable HTTPS/SSL for trusted certificates when deploying Application Gateway&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Deploy Azure Application Gateway for web applications with HTTPS/SSL enabled for trusted certificates.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a self-signed certificate&lt;/p&gt; 
-&lt;p&gt;In this section, you use New-SelfSignedCertificate to create a self-signed certificate. You upload the certificate to the Azure portal when you create the listener for the application gateway.&lt;/p&gt; 
-&lt;p&gt;On your local computer, open a Windows PowerShell window as an administrator. Run the following command to create the certificate:&lt;/p&gt; 
-&lt;p&gt;New-SelfSignedCertificate ` -certstorelocation cert:\localmachine\my ` -dnsname www.contoso.com&lt;/p&gt; 
-&lt;p&gt;You should see something like this response:&lt;/p&gt; 
-&lt;p&gt;PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\my&lt;/p&gt; 
-&lt;p&gt;Thumbprint Subject&lt;br&gt; ----- ----&lt;br&gt; E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 CN=www.contoso.com&lt;/p&gt; 
-&lt;p&gt;Use Export-PfxCertificate with the Thumbprint that was returned to export a pfx file from the certificate. Make sure your password is 4 - 12 characters long:&lt;/p&gt; 
-&lt;p&gt;$pwd = ConvertTo-SecureString -String  -Force -AsPlainText&lt;br&gt; Export-PfxCertificate ` -cert cert:\localMachine\my\E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 ` -FilePath c:\appgwcert.pfx ` -Password $pwd&lt;/p&gt; 
-&lt;p&gt;Create an application gateway&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource on the left menu of the Azure portal. The New window appears.&lt;/p&gt; 
-&lt;p&gt;2. Select Networking and then select Application Gateway in the Featured list.&lt;/p&gt; 
-&lt;p&gt;Basics tab&lt;/p&gt; 
-&lt;p&gt;1. On the Basics tab, enter these values for the following application gateway settings:&lt;/p&gt; 
-&lt;p&gt;- Resource group: Select myResourceGroupAG for the resource group. If it does not exist, select Create new to create it.&lt;/p&gt; 
-&lt;p&gt;- Application gateway name: Enter myAppGateway for the name of the application gateway.&lt;/p&gt; 
-&lt;p&gt;2. For Azure to communicate between the resources that you create, it needs a virtual network. You can either create a new virtual network or use an existing one. In this example, you will create a new virtual network at the same time that you create the application gateway. Application Gateway instances are created in separate subnets. You create two subnets in this example: one for the application gateway, and another for the backend servers.&lt;/p&gt; 
-&lt;p&gt;Under Configure virtual network, create a new virtual network by selecting Create new. In the Create virtual network window that opens, enter the following values to create the virtual network and two subnets:&lt;/p&gt; 
-&lt;p&gt;- Name: Enter myVNet for the name of the virtual network.&lt;/p&gt; 
-&lt;p&gt;- Subnet name (Application Gateway subnet): The Subnets grid will show a subnet named Default. Change the name of this subnet to myAGSubnet.&lt;br&gt; The application gateway subnet can contain only application gateways. No other resources are allowed.&lt;/p&gt; 
-&lt;p&gt;- Subnet name (backend server subnet): In the second row of the Subnets grid, enter myBackendSubnet in the Subnet name column.&lt;/p&gt; 
-&lt;p&gt;- Address range (backend server subnet): In the second row of the Subnets Grid, enter an address range that does not overlap with the address range of myAGSubnet. For example, if the address range of myAGSubnet is 10.0.0.0/24, enter 10.0.1.0/24 for the address range of myBackendSubnet.&lt;/p&gt; 
-&lt;p&gt;Select OK to close the Create virtual network window and save the virtual network settings.&lt;/p&gt; 
-&lt;p&gt;3. On the Basics tab, accept the default values for the other settings and then select Next: Frontends.&lt;/p&gt; 
-&lt;p&gt;Frontends tab&lt;/p&gt; 
-&lt;p&gt;1. On the Frontends tab, verify Frontend IP address type is set to Public.&lt;br&gt; You can configure the Frontend IP to be Public or Private as per your use case. In this example, you will choose a Public Frontend IP.&lt;/p&gt; 
-&lt;p&gt;Note: For the Application Gateway v2 SKU, you can only choose Public frontend IP configuration. Private frontend IP configuration is currently not enabled for this v2 SKU.&lt;/p&gt; 
-&lt;p&gt;2. Choose Create new for the Public IP address and enter myAGPublicIPAddress for the public IP address name, and then select OK.&lt;/p&gt; 
-&lt;p&gt;3. Select Next: Backends.&lt;/p&gt; 
-&lt;p&gt;Backends tab&lt;/p&gt; 
-&lt;p&gt;The backend pool is used to route requests to the backend servers that serve the request. Backend pools can be composed of NICs, virtual machine scale sets, public IPs, internal IPs, fully qualified domain names (FQDN), and multi-tenant backends like Azure App Service. In this example, you will create an empty backend pool with your application gateway and then add backend targets to the backend pool.&lt;/p&gt; 
-&lt;p&gt;1. On the Backends tab, select +Add a backend pool.&lt;/p&gt; 
-&lt;p&gt;2. In the Add a backend pool window that opens, enter the following values to create an empty backend pool:&lt;/p&gt; 
-&lt;p&gt;- Name: Enter myBackendPool for the name of the backend pool.&lt;br&gt; - Add backend pool without targets: Select Yes to create a backend pool with no targets. You will add backend targets after creating the application gateway.&lt;/p&gt; 
-&lt;p&gt;3. In the Add a backend pool window, select Add to save the backend pool configuration and return to the Backends tab.&lt;/p&gt; 
-&lt;p&gt;4. On the Backends tab, select Next: Configuration.&lt;/p&gt; 
-&lt;p&gt;Configuration tab&lt;/p&gt; 
-&lt;p&gt;On the Configuration tab, you will connect the frontend and backend pool you created using a routing rule.&lt;/p&gt; 
-&lt;p&gt;1. Select Add a rule in the Routing rules column.&lt;/p&gt; 
-&lt;p&gt;2. In the Add a routing rule window that opens, enter myRoutingRule for the Rule name.&lt;/p&gt; 
-&lt;p&gt;3. A routing rule requires a listener. On the Listener tab within the Add a routing rule window, enter the following values for the listener:&lt;/p&gt; 
-&lt;p&gt;- Listener name: Enter myListener for the name of the listener.&lt;br&gt; - Frontend IP: Select Public to choose the public IP you created for the frontend.&lt;br&gt; - Protocol: Select HTTPS.&lt;br&gt; - Port: Verify 443 is entered for the port.&lt;/p&gt; 
-&lt;p&gt;Under HTTPS Certificate:&lt;/p&gt; 
-&lt;p&gt;- PFX certificate file - Browse to and select the c:\appgwcert.pfx file that you create earlier.&lt;/p&gt; 
-&lt;p&gt;- Certificate name - Type mycert1 for the name of the certificate.&lt;/p&gt; 
-&lt;p&gt;- Password - Type your password.&lt;/p&gt; 
-&lt;p&gt;Accept the default values for the other settings on the Listener tab, then select the Backend targets tab to configure the rest of the routing rule.&lt;/p&gt; 
-&lt;p&gt;4. On the Backend targets tab, select myBackendPool for the Backend target.&lt;/p&gt; 
-&lt;p&gt;5. For the HTTP setting, select Create new to create a new HTTP setting. The HTTP setting will determine the behavior of the routing rule. In the Add an HTTP setting window that opens, enter myHTTPSetting for the HTTP setting name. Accept the default values for the other settings in the Add an HTTP setting window, then select Add to return to the Add a routing rule window.&lt;/p&gt; 
-&lt;p&gt;6. On the Add a routing rule window, select Add to save the routing rule and return to the Configuration tab.&lt;/p&gt; 
-&lt;p&gt;7. Select Next: Tags and then Next: Review + create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Configure an application gateway with TLS termination using the Azure portal" url="https://docs.microsoft.com/en-us/azure/application-gateway/create-ssl-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the application gateway&lt;/p&gt;
-
-  &lt;p&gt;1. Select All resources, and then select myAGPublicIPAddress.&lt;/p&gt;
-
-  &lt;p&gt;2. In the address bar of your browser, type https://&lt;your application gateway IP address&gt;.&lt;/p&gt;
-
-  &lt;p&gt;To accept the security warning if you used a self-signed certificate, select Details (or Advanced on Chrome) and then go on to the webpage.&lt;/p&gt;
-
-  &lt;p&gt;Your secured IIS website is then displayed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-NSG-FLOW-LOGS" name="Enable NSG flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable NSG flow logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable NSG flow log&lt;/p&gt; 
-&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
-&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
-&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
-&lt;p&gt;The storage account may take around minute to create. Do not continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
-&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
-&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
-&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
-&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
-&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
-&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
-&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that NSG flow logs are enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable WAF logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable logging through the Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. In the Azure portal, find your resource and select Diagnostic settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Application Gateway, three logs are available: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Access log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Performance log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Firewall log 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. To start collecting data, select Turn on diagnostics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Type a name for the settings, confirm the settings, and select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that all WAF logs are enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-CRED-SCAN" name="Implement Credential Scanner to identify credentials within code" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement Credential Scanner to identify credentials within code&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Prerequisites:&lt;br&gt; 1. You are using the Azure DevOps Build system.&lt;br&gt; 2. The Microsoft Security Code Analysis Extension installed in your account.&lt;br&gt; Setup:&lt;br&gt; 1. Open your team project from your Azure DevOps Account.&lt;br&gt; 2. Navigate to the Build tab under Build and Release&lt;br&gt; 3. Select the Build Definition into which you wish to add the CredScan build task.&lt;br&gt; - New - Click New and follow the steps detailed to create a new Build Definition.&lt;br&gt; - Edit - Select the Build Definition. On the subsequent page, click Edit to begin editing the Build Definition.&lt;br&gt; 4. Click + to navigate to the Add Tasks pane.&lt;br&gt; 5. Find the CredScan build task either from the list or using the search box and then click Add.&lt;br&gt; 6. The Run CredScan build task should now be a part of the Build Definition.&lt;/p&gt; 
-&lt;p&gt;Customizing the CredScan Build Task:&lt;br&gt; 1. Click the task Run CredScan to see the different options available within.&lt;br&gt; 2. Available options include&lt;br&gt; Output Format - TSV/ CSV/ SARIF/ PREfast&lt;br&gt; Tool Version (Recommended: Latest)&lt;br&gt; Scan Folder - The folder in your repository to scan&lt;br&gt; Searchers File Type - Options to locate the searchers file used for scanning.&lt;br&gt; Suppressions File - A JSON file can be used for suppressing issues in the output log (more details in the Resources section).&lt;br&gt; (New) Verbose Output - self explanatory&lt;br&gt; Batch Size - The number of concurrent threads used to run Credential Scanners in parallel. Defaults to 20 (Value must be in the range of 1 to 2147483647).&lt;br&gt; (New) Match Timeout - The amount of time to spend attempting a searcher match before abandoning the check.&lt;br&gt; (New) File Scan Read Buffer Size - Buffer size while reading content in bytes. (Defaults to 524288)&lt;br&gt; (New) Maximum File Scan Read Bytes - Maximum number of bytes to read from a given file during content analysis. (Defaults to 104857600)&lt;br&gt; Run this task (under Control Options) - Specifies when the task should run. Choose "Custom conditions" to specify more complex conditions.&lt;/p&gt; 
-&lt;p&gt;*Version - Build task version within Azure DevOps. Not frequently used.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Getting started with Credential Scanner (CredScan)" url="https://secdevtools.azurewebsites.net/helpcredscan.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Credential Scanner is implemented&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
-&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APPROVED-LOCATIONS" name="Manage Azure resources from only approved locations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Manage Azure resources from only approved locations 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use Conditional Access Named Locations to allow access from only specific logical groupings of IP address ranges or countries/regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Prerequisites 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - An Azure AD tenant. Sign up for a free trial. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - A user, who is a global administrator for the tenant. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - An IP range that is established and credible in your organization. The IP range needs to be in Classless Interdomain Routing (CIDR) format. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure named locations 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the left pane, select Azure Active Directory, then select Conditional Access from the Security section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Conditional Access page, select Named locations and select New location. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Fill out the form on the new page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In the Name box, type a name for your named location. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In the IP ranges box, type the IP range in CIDR format. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Click Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Configure named locations in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that you have configured named locations in your Azure environment.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
-  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
-  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
-  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
-  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
-  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
-  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
-  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
-                            subscription.&lt;/li&gt;
-                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
-                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
-&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
-&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
-&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
-&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
-&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
-&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
-&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
-&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
-&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
-&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
-&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
-&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
-&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
-&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
-&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
-&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
-            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW5" name="Use Azure app registration to interact with Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure app registration to interact with Application Gateway&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use an Azure app registration (service principal) to retrieve a token that can be used to interact with your Azure Application Gateways via API calls.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Client registration&lt;/p&gt; 
-&lt;p&gt;To register a client that accesses an Azure Resource Manager REST API, see Reference URL. The article shows you how to:&lt;/p&gt; 
-&lt;p&gt;- Register the client application with Azure AD.&lt;br&gt; - Set permission requests to allow the client to access the Azure Resource Manager API.&lt;br&gt; - Configure Azure Resource Manager Role-Based Access Control (RBAC) settings for authorizing the client.&lt;/p&gt; 
-&lt;p&gt;If your client accesses an API other than an Azure Resource Manager API, refer to:&lt;/p&gt; 
-&lt;p&gt;- Register an application with the Microsoft identity platform&lt;br&gt; - Register the client application with Azure AD, in the "Register an application" section.&lt;br&gt; - Create a secret key (if you are registering a web client), in the "Add credentials" section.&lt;br&gt; - Configure an application to expose a web API&lt;br&gt; - Add permissions to your web API, exposing them as scopes&lt;br&gt; - Configure a client application to access a web API&lt;br&gt; - Add permission requests as required by the scopes defined for the API, in the "Add permissions to access your web API" section.&lt;/p&gt; 
-&lt;p&gt;Now that you have completed registration of your client application, move on to your client code where you create the REST request and handle the response.&lt;/p&gt; 
-&lt;p&gt;Acquire an access token&lt;/p&gt; 
-&lt;p&gt;After you have a valid client registration, you have two ways to integrate with Azure AD to acquire an access token:&lt;/p&gt; 
-&lt;p&gt;- Platform- and language-neutral OAuth2 service endpoints, which we use in this article. The instructions provided in this section assume nothing about your client's platform or language/script when you use the Azure AD OAuth endpoints. The only requirement is that you can send/receive HTTPS requests to/from Azure AD, and parse the response message.&lt;br&gt; - The platform- and language-specific Microsoft Authentication Libraries (MSAL), which is beyond the scope of this article. The libraries provide asynchronous wrappers for the OAuth2 endpoint requests, and robust token-handling features such as caching and refresh token management. For more information, see the Overview of Microsoft Authentication Library (MSAL).&lt;/p&gt; 
-&lt;p&gt;The two Azure AD endpoints that you use to authenticate your client and acquire an access token are referred to as the OAuth2 /authorize and /token endpoints. How you use them depends on your application's registration and the type of OAuth2 authorization grant flow you need to support your application at run-time. For the purposes of this article, we assume that your client uses one of the following authorization grant flows: authorization code or client credentials. To acquire an access token used in the remaining sections, follow the instructions for the flow that best matches your scenario.&lt;/p&gt; 
-&lt;p&gt;Authorization code grant (interactive clients)&lt;/p&gt; 
-&lt;p&gt;This grant is used by both web and native clients, requiring credentials from a signed-in user in order to delegate resource access to the client application. It uses the /authorize endpoint to obtain an authorization code (in response to user sign-in/consent), followed by the /token endpoint to exchange the authorization code for an access token.&lt;/p&gt; 
-&lt;p&gt;1. First, your client needs to request an authorization code from Azure AD. For details on the format of the HTTPS GET request to the /authorize endpoint, and example request/response messages, see Request an authorization code. The URI contains the following query-string parameters, which are specific to your client application:&lt;/p&gt; 
-&lt;p&gt;- client_id: A GUID that was assigned to your client application during registration, also known as an application ID.&lt;/p&gt; 
-&lt;p&gt;- redirect_uri: A URL-encoded version of one of the reply/redirect URIs, specified during registration of your client application. The value you pass must match your registration value exactly.&lt;/p&gt; 
-&lt;p&gt;- resource: A URL-encoded identifier URI that's specified by the REST API you are calling. Web/REST APIs (also known as resource applications) can expose one or more application ID URIs in their configuration. For example:&lt;/p&gt; 
-&lt;p&gt;- Azure Resource Manager provider (and classic deployment model) APIs use https://management.core.windows.net/.&lt;br&gt; - For any other resources, see the API documentation or the resource application's configuration in the Azure portal.&lt;/p&gt; 
-&lt;p&gt;The request to the /authorize endpoint first triggers a sign-in prompt to authenticate the user. The response you get back is delivered as a redirect (302) to the URI that you specified in redirect_uri. The response header message contains a location field, containing the redirect URI followed by a code query parameter. The code parameter contains the authorization code that you need for step 2.&lt;/p&gt; 
-&lt;p&gt;2. Next, your client needs to redeem the authorization code for an access token. Because this is a POST request, you package your application-specific parameters in the request body. In addition to some of the previously mentioned parameters (along with other new ones), you will pass:&lt;/p&gt; 
-&lt;p&gt;- code: This query parameter contains the authorization code that you obtained in step 1.&lt;/p&gt; 
-&lt;p&gt;- client_secret: You need this parameter only if your client is configured as a web application. This is the same secret/key value that you generated earlier, in client registration.&lt;/p&gt; 
-&lt;p&gt;Client credentials grant (non-interactive clients)&lt;/p&gt; 
-&lt;p&gt;This grant is used only by web clients, allowing the application to access resources directly (no user delegation) using the client's credentials, which are provided at registration time. The grant is typically used by non-interactive clients (no UI) that run as a service or daemon. It requires only the /token endpoint to acquire an access token.&lt;/p&gt; 
-&lt;p&gt;The client/resource interactions for this grant are similar to step 2 of the authorization code grant.&lt;/p&gt; 
-&lt;p&gt;Assemble the request message&lt;/p&gt; 
-&lt;p&gt;Most programming languages or frameworks and scripting environments make it easy to assemble and send the request message. They typically provide a web/HTTP class or API that abstracts the creation or formatting of the request, making it easier to write the client code (the HttpWebRequest class in the .NET Framework, for example). For brevity, and because most of the task is handled for you, this section covers only the important elements of the request.&lt;/p&gt; 
-&lt;p&gt;Request URI&lt;/p&gt; 
-&lt;p&gt;Because sensitive information is being transmitted and received, all REST requests require the HTTPS protocol for the URI scheme, giving the request and response a secure channel. The information (that is, the Azure AD authorization code, access/bearer token, and sensitive request/response data) is encrypted by a lower transport layer, ensuring the privacy of the messages.&lt;/p&gt; 
-&lt;p&gt;The remainder of your service's request URI (the host, resource path, and any required query-string parameters) are determined by its related REST API specification. For example, Azure Resource Manager provider APIs use https://management.azure.com/, and Azure classic deployment model uses https://management.core.windows.net/. Both require an api-version query-string parameter.&lt;/p&gt; 
-&lt;p&gt;Request header&lt;/p&gt; 
-&lt;p&gt;The request URI is bundled in the request message header, along with any additional fields required by your service's REST API specification and the HTTP specification. Your request might require the following common header fields:&lt;/p&gt; 
-&lt;p&gt;- Authorization: Contains the OAuth2 bearer token to secure the request, as acquired earlier from Azure AD.&lt;br&gt; - Content-Type: Typically set to "application/json" (name/value pairs in JSON format), and specifies the MIME type of the request body.&lt;br&gt; - Host: The domain name or IP address of the server where the REST service endpoint is hosted.&lt;/p&gt; 
-&lt;p&gt;Request body&lt;/p&gt; 
-&lt;p&gt;As mentioned earlier, the request message body is optional, depending on the specific operation you are requesting and its parameter requirements. If it's required, the API specification for the service you are requesting also specifies the encoding and format.&lt;/p&gt; 
-&lt;p&gt;The request body is separated from the header by an empty line, formatted in accordance with the Content-Type header field. An example of an "application/json" formatted body would appear as follows:&lt;/p&gt; 
-&lt;p&gt;{ "": ""&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure REST API reference" url="https://docs.microsoft.com/en-us/rest/api/azure/"/>
-            <reference name="Quickstart: Register an application with the Microsoft identity platform" url="https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Send the request&lt;/p&gt;
-
-  &lt;p&gt;Now that you have the service's request URI and have created the related request message header and body, you are ready to send the request to the REST service endpoint.&lt;/p&gt;
-
-  &lt;p&gt;For example, you might send an HTTPS GET request method for an Azure Resource Manager provider by using request header fields that are similar to the following (note that the request body is empty):&lt;/p&gt;
-
-  &lt;p&gt;GET /subscriptions?api-version=2014-04-01-preview HTTP/1.1&lt;br /&gt;
-Authorization: Bearer &lt;bearer-token&gt;&lt;br /&gt;
-Host: management.azure.com&lt;/p&gt;
-
-  &lt;p&gt;&lt;no body&gt;&lt;/p&gt;
-
-  &lt;p&gt;And you might send an HTTPS PUT request method for an Azure Resource Manager provider, by using request header and body fields similar to the following example:&lt;/p&gt;
-
-  &lt;p&gt;PUT /subscriptions/.../resourcegroups/ExampleResourceGroup?api-version=2016-02-01  HTTP/1.1&lt;br /&gt;
-Authorization: Bearer &lt;bearer-token&gt;&lt;br /&gt;
-Content-Length: 29&lt;br /&gt;
-Content-Type: application/json&lt;br /&gt;
-Host: management.azure.com&lt;/p&gt;
-
-  &lt;p&gt;{
-  "location": "West US"&lt;br /&gt;
-}&lt;/p&gt;
-
-  &lt;p&gt;After you make the request, the response message header and optional body are returned.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-GW1" name="Use Azure Key Vault to securely store Application Gateway certificates" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Key Vault to securely store Application Gateway certificates&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure Key Vault is a platform-managed secret store that you can use to safeguard secrets, keys, and SSL certificates. Azure Application Gateway supports integration with Key Vault for server certificates that are attached to HTTPS-enabled listeners. This support is limited to the Application Gateway v2 SKU.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Application Gateway integration with Key Vault requires a three-step configuration process:&lt;/p&gt; 
-&lt;p&gt;1. Create a user-assigned managed identity&lt;/p&gt; 
-&lt;p&gt;You create or reuse an existing user-assigned managed identity, which Application Gateway uses to retrieve certificates from Key Vault on your behalf. For more information, see Create, list, delete, or assign a role to a user-assigned managed identity using the Azure portal. This step creates a new identity in the Azure Active Directory tenant. The identity is trusted by the subscription that's used to create the identity.&lt;/p&gt; 
-&lt;p&gt;2. Configure your key vault&lt;/p&gt; 
-&lt;p&gt;You then either import an existing certificate or create a new one in your key vault. The certificate will be used by applications that run through the application gateway. In this step, you can also use a key vault secret that's stored as a password-less, base-64 encoded PFX file. We recommend using a certificate type because of the auto-renewal capability that's available with certificate type objects in the key vault. After you have created a certificate or a secret, you define access policies in the key vault to allow the identity to be granted get access to the secret.&lt;/p&gt; 
-&lt;p&gt;Important: Application Gateway currently requires Key Vault to allow access from all networks in order to leverage the integration. It does not support Key Vault integration when Key Vault is set to only allow private endpoints and select networks access. Support for private and select networks is in the works for full integration of Key Vault with Application Gateway.&lt;/p&gt; 
-&lt;p&gt;Note: If you deploy the application gateway via an ARM template, either by using the Azure CLI or PowerShell, or via an Azure application deployed from the Azure portal, the SSL certificate is stored in the key vault as a base64-encoded PFX file. You must complete the steps in Use Azure Key Vault to pass secure parameter value during deployment.&lt;br&gt; It is particularly important to set enabledForTemplateDeployment to true. The certificate may be password-less or it may have a password. In the case of a certificate with a password, the following example shows a possible configuration for the sslCertificates entry in the properties for the ARM template configuration for an app gateway. The values of appGatewaySSLCertificateData and appGatewaySSLCertificatePassword are looked up from the key vault as described in the section Reference secrets with dynamic ID. Follow the references backward from parameters('secretName') to see how the lookup happens. If the certificate is pass-wordless, omit the password entry.&lt;/p&gt; 
-&lt;p&gt;"sslCertificates": [ { "name": "appGwSslCertificate", "properties": { "data": "[parameters('appGatewaySSLCertificateData')]", "password": "[parameters('appGatewaySSLCertificatePassword')]" } }&lt;br&gt; ]&lt;/p&gt; 
-&lt;p&gt;3. Configure the application gateway&lt;/p&gt; 
-&lt;p&gt;After you complete the two preceding steps, you can set up or modify an existing application gateway to use the user-assigned managed identity.&lt;br&gt; You can also configure the HTTP listener's TLS/SSL certificate to point to the complete URI of the Key Vault certificate or secret ID.&lt;/p&gt; 
-&lt;p&gt;To see how to backup customer managed certificates within Azure Key Vault, please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Backup-AzureKeyVaultCertificate" url="https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/backup-azurekeyvaultcertificate?view=azurermps-6.13.0"/>
-            <reference name="TLS termination with Key Vault certificates" url="https://docs.microsoft.com/en-us/azure/application-gateway/key-vault-certs"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Application Gateway is integrated with Azure Key Vault.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
-&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="34"/>
-                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="34"/>
-                <countermeasure ref="AZ-A04" mitigation="33"/>
-                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                <countermeasure ref="AZURE-SSO" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VM01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-V02" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-V02" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-APP-GW1" mitigation="50"/>
-                    <countermeasure ref="AZURE-CRED-SCAN" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-APP-GW1" mitigation="50"/>
-                <countermeasure ref="AZURE-CRED-SCAN" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="11"/>
-                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="11"/>
-                    <countermeasure ref="AZ-L01" mitigation="11"/>
-                    <countermeasure ref="AZ-L05" mitigation="11"/>
-                    <countermeasure ref="AZ-M01" mitigation="11"/>
-                    <countermeasure ref="AZURE-APP-GW3" mitigation="11"/>
-                    <countermeasure ref="AZURE-MONITOR6" mitigation="11"/>
-                    <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="12"/>
-                    <countermeasure ref="AZURE-SENTINEL" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="11"/>
-                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="11"/>
-                <countermeasure ref="AZ-L01" mitigation="11"/>
-                <countermeasure ref="AZ-L05" mitigation="11"/>
-                <countermeasure ref="AZ-M01" mitigation="11"/>
-                <countermeasure ref="AZURE-APP-GW3" mitigation="11"/>
-                <countermeasure ref="AZURE-MONITOR6" mitigation="11"/>
-                <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="12"/>
-                <countermeasure ref="AZURE-SENTINEL" mitigation="11"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N01" mitigation="14"/>
-                    <countermeasure ref="AZURE-APP-GW4" mitigation="14"/>
-                    <countermeasure ref="AZURE-APP-GW5" mitigation="14"/>
-                    <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="15"/>
-                    <countermeasure ref="AZURE-WAF-GW" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-NON-IDENTIFY">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-TAGS" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="15"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N01" mitigation="14"/>
-                <countermeasure ref="AZ-N09" mitigation="15"/>
-                <countermeasure ref="AZURE-APP-GW4" mitigation="14"/>
-                <countermeasure ref="AZURE-APP-GW5" mitigation="14"/>
-                <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="15"/>
-                <countermeasure ref="AZURE-TAGS" mitigation="14"/>
-                <countermeasure ref="AZURE-WAF-GW" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-APP-GW6" mitigation="50"/>
-                    <countermeasure ref="AZURE-APP-GW7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-APP-GW6" mitigation="50"/>
-                <countermeasure ref="AZURE-APP-GW7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="d00dd004-6dab-4a06-80d9-8b2a69722f17" diagramComponentId="2d31801e-2650-4934-bec0-c4c790eed674" ref="fe531998-3fcc-461c-922d-8541f758ab35" name="Azure Load Balancer" desc="" library="" parentComponentRef="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" componentDefinitionRef="microsoft-azure-load-balancer">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not adequately configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.608">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-04" name="Unauthorized connection attempts on Azure resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Azure resources is most likely to be receiving an
-                        attack. To avoid this, access to the network must be as restricted as possible using Network
-                        Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Network security groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select the Network Security Group (NSG) for your virtual machine and click on
-                            &amp;quot;Inbound security rules&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is a rule to deny the inbound access from a blacklisted IP
-                            address or range to a designated port or port range.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.608">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.885">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable and use Traffic Analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Visualize network activity across your Azure subscriptions and identify hot spots. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Pinpoint network misconfigurations leading to failed connections in your network. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable Network Watcher 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select a network security group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable flow log settings 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling flow log settings, you must complete the following tasks: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register the Azure Insights provider, if it's not already registered for your subscription: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  New-AzStorageAccount ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Location westcentralus ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -SkuName Standard_LRS ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Kind StorageV2 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the following options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Select On for Status 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Select On for Traffic Analytics Status. 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View traffic analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;3. Select Create.&lt;/p&gt; 
-&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
-&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
-&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
-
-	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
-
-	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
-2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
-3. Select your DDoS protection plan from the list.&lt;/p&gt;
-
-	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
-&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
-&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
-&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
-&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-NSG-LOGS" name="Enable Network Security Group flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Network Security Group (NSG) flow logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. &lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to enable NSG flow log&lt;/p&gt; 
-&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
-&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
-&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
-&lt;p&gt;The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
-&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
-&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
-&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
-&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
-&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
-&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
-&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Download flow log&lt;/p&gt;
-
-	&lt;p&gt;1. From Network Watcher, in the portal, select NSG flow logs under LOGS.&lt;/p&gt;
-
-	&lt;p&gt;2. Select You can download flow logs from configured storage accounts.&lt;/p&gt;
-
-	&lt;p&gt;3. Select the storage account that you configured in step 2 of Enable NSG flow log (Remediation section).&lt;/p&gt;
-
-	&lt;p&gt;4. Under Blob service, select Containers, and then select the insights-logs-networksecuritygroupflowevent container.&lt;/p&gt;
-
-	&lt;p&gt;5. In the container, navigate the folder hierarchy until you get to a PT1H.json file. Log files are written to a folder hierarchy that follows the following naming convention: https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json&lt;/p&gt;
-
-	&lt;p&gt;6. Select ... to the right of the PT1H.json file and select Download.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing&lt;/p&gt;
-
-  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
-
-  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SECURE-CONFIG" name="Establish secure configurations with Azure Policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Establish secure configurations for Azure Traffic Manager&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.&lt;/p&gt; 
-&lt;p&gt;Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.&lt;/p&gt; 
-&lt;p&gt;All Azure Policy data and objects are encrypted at rest.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Define and implement standard security configurations for Azure Traffic Manager with Azure Policy&lt;/p&gt; 
-&lt;p&gt;1. Use Azure Policy to put restrictions on the type of resources that can be created in your and in customer subscriptions using the following built-in policy definitions:&lt;br&gt; - Not allowed resource types&lt;br&gt; - Allowed resource types&lt;br&gt; You can also create custom Azure Policy definitions to restrict more granular resource settings.&lt;/p&gt; 
-&lt;p&gt;2. Use built-in Azure Policy definitions as well as Azure Policy aliases in the "Microsoft.Network" namespace to create custom policies to alert, audit, and enforce system configurations. Additionally, develop a process and pipeline for managing policy exceptions.&lt;/p&gt; 
-&lt;p&gt;3. Use Azure Policy [audit], [deny], and [deploy if not exist] to automatically enforce configurations for your Azure resources.&lt;/p&gt; 
-&lt;p&gt;4. You can use recommendations from Azure Security Center or built-in Azure Policies, such as:&lt;br&gt; - There should be more than one owner assigned to your subscription&lt;br&gt; - Deprecated accounts with owner permissions should be removed from your subscription&lt;br&gt; - External accounts with owner permissions should be removed from your subscription&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; It is important to validate a new policy works as intended before allowing it to change or block work. The validation must ensure only the intended resources are determined to be non-compliant and no compliant resources are incorrectly included (known as a false positive) in the results.&lt;br&gt; For this reason, your policy definitions should be as tightly defined and focused on the resources and the properties you need to evaluate for compliance as possible.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create and manage policies to enforce compliance" url="https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage"/>
-            <reference name="Understand Azure Policy effects" url="https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;The recommended approach to validating a new policy definition is by following these steps:&lt;/p&gt;
-
-	&lt;p&gt;- Tightly define your policy&lt;br /&gt;
-- Audit your existing resources&lt;br /&gt;
-- Audit new or updated resource requests&lt;br /&gt;
-- Deploy your policy to resources&lt;br /&gt;
-- Continuous monitoring&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
-&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER3" name="Integrate Azure Firewall with Azure Standard Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Integrate Azure Firewall with Azure Standard Load Balancer&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can integrate an Azure Firewall into a virtual network with an Azure Standard Load Balancer (either public or internal).&lt;br&gt; Explicitly define internet connectivity and valid source IPs through outbound rules and network security groups with your Load Balancer to use Microsoft's threat intelligence for protecting your web applications.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The preferred design is to integrate an internal load balancer with your Azure firewall, as this is a much simpler design. You can use a public load balancer if you already have one deployed and you want to keep it in place. However, you need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;/p&gt; 
-&lt;p&gt;Public load balancer&lt;/p&gt; 
-&lt;p&gt;With a public load balancer, the load balancer is deployed with a public frontend IP address.&lt;/p&gt; 
-&lt;p&gt;Asymmetric routing&lt;/p&gt; 
-&lt;p&gt;Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.&lt;/p&gt; 
-&lt;p&gt;Fix the routing issue&lt;/p&gt; 
-&lt;p&gt;When you deploy an Azure Firewall into a subnet, one step is to create a default route for the subnet directing packets through the firewall's private IP address located on the AzureFirewallSubnet.&lt;br&gt; When you introduce the firewall into your load balancer scenario, you want your Internet traffic to come in through your firewall's public IP address. From there, the firewall applies its firewall rules and NATs the packets to your load balancer's public IP address. This is where the problem occurs. Packets arrive on the firewall's public IP address, but return to the firewall via the private IP address (using the default route). To avoid this problem, create an additional host route for the firewall's public IP address. Packets going to the firewall's public IP address are routed via the Internet. This avoids taking the default route to the firewall's private IP address.&lt;/p&gt; 
-&lt;p&gt;Internal load balancer&lt;/p&gt; 
-&lt;p&gt;With an internal load balancer, the load balancer is deployed with a private frontend IP address.&lt;br&gt; There's no asymmetric routing issue with this scenario. The incoming packets arrive at the firewall's public IP address, get translated to the load balancer's private IP address, and then returns to the firewall's private IP address using the same return path.&lt;br&gt; So, you can deploy this scenario similar to the public load balancer scenario, but without the need for the firewall public IP address host route.&lt;/p&gt; 
-&lt;p&gt;Note: The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Additional security&lt;/p&gt; 
-&lt;p&gt;To further enhance the security of your load-balanced scenario, you can use network security groups (NSGs).&lt;br&gt; For example, you can create an NSG on the backend subnet where the load-balanced virtual machines are located. Allow incoming traffic originating from the firewall IP address/port.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;br&gt; The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Integrate Azure Firewall with Azure Standard Load Balancer" url="https://docs.microsoft.com/en-us/azure/firewall/integrate-lb"/>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Firewall is integrated with Azure Standard Load Balancer.&lt;br /&gt;
-Test the firewall to confirm that it works as expected, following the testing steps for firewall deployment.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER1" name="Maintain an inventory of administrative accounts for Azure Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure role-based access control (Azure RBAC) allows you to manage access to Azure resources such as your Load Balancer through role assignments. Assign these roles to users, groups service principals, and managed identities.&lt;br&gt; Inventory Pre-defined and built-in roles for certain resources with tools like Azure CLI, Azure PowerShell or the Azure portal.&lt;br&gt; It is highly recommended by Microsoft to maintain an inventory of administrative accounts.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure built-in roles" url="https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
-&lt;p&gt;Version control workflow&lt;/p&gt; 
-&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
-&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-JIT-VM-ACCESS" name="Secure your management ports with just-in-time VM access" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure your management ports with just-in-time (JIT) VM access&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. All of your virtual machines are potential targets for an attack. When a VM is successfully compromised, it's used as the entry point to attack further resources within your environment.&lt;/p&gt; 
-&lt;p&gt;As with all cybersecurity prevention techniques, your goal should be to reduce the attack surface. In this case, that means having fewer open ports, especially management ports.&lt;br&gt; Your legitimate users also use these ports, so it's not practical to keep them closed.&lt;br&gt; To solve this dilemma, Azure Security Center offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to Enable JIT on your VMs from Azure Security Center&lt;/p&gt; 
-&lt;p&gt;From Security Center, you can enable and configure the JIT VM access.&lt;/p&gt; 
-&lt;p&gt;1. Open the Azure Defender dashboard and from the advanced protection area, select Just-in-time VM access.&lt;/p&gt; 
-&lt;p&gt;The Just-in-time VM access page opens with your VMs grouped into the following tabs:&lt;/p&gt; 
-&lt;p&gt;a. Configured - VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:&lt;br&gt; i. The number of approved JIT requests in the last seven days&lt;br&gt; ii. The last access date and time&lt;br&gt; iii. The connection details configured&lt;br&gt; iv. The last user&lt;/p&gt; 
-&lt;p&gt;b. Not configured - VMs without JIT enabled, but that can support JIT. Microsoft recommends that you enable JIT for these VMs.&lt;/p&gt; 
-&lt;p&gt;c. Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons:&lt;br&gt; i. Missing network security group (NSG) - JIT requires an NSG to be configured&lt;br&gt; ii. Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models.&lt;br&gt; iii. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.&lt;/p&gt; 
-&lt;p&gt;2. From the Not configured tab, mark the VMs to protect with JIT and select Enable JIT on VMs.&lt;/p&gt; 
-&lt;p&gt;The JIT VM access page opens listing the ports that Security Center recommends protecting:&lt;/p&gt; 
-&lt;p&gt;- 22 - SSH&lt;br&gt; - 3389 - RDP&lt;br&gt; - 5985 - WinRM&lt;br&gt; - 5986 - WinRM&lt;/p&gt; 
-&lt;p&gt;To accept the default settings, select Save.&lt;/p&gt; 
-&lt;p&gt;3. To customize the JIT options:&lt;/p&gt; 
-&lt;p&gt;- Add custom ports with the Add button.&lt;br&gt; - Modify one of the default ports, by selecting it from the list.&lt;/p&gt; 
-&lt;p&gt;For each port (custom and default) the Add port configuration pane offers the following options:&lt;/p&gt; 
-&lt;p&gt;- Protocol- The protocol that is allowed on this port when a request is approved&lt;br&gt; - Allowed source IPs- The IP ranges that are allowed on this port when a request is approved&lt;br&gt; - Maximum request time- The maximum time window during which a specific port can be opened&lt;/p&gt; 
-&lt;p&gt;a. Set the port security to your needs.&lt;/p&gt; 
-&lt;p&gt;b. Select OK.&lt;/p&gt; 
-&lt;p&gt;4. Select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure your management ports with just-in-time access" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time"/>
-            <reference name="Understanding just-in-time (JIT) VM access" url="https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Audit JIT access activity in Security Center&lt;/p&gt;
-
-	&lt;p&gt;You can gain insights into VM activities using log search. To view the logs:&lt;/p&gt;
-
-	&lt;p&gt;1. From Just-in-time VM access, select the Configured tab.&lt;/p&gt;
-
-	&lt;p&gt;2. For the VM that you want to audit, open the ellipsis menu at the end of the row.&lt;/p&gt;
-
-	&lt;p&gt;3. Select Activity Log from the menu.&lt;/p&gt;
-
-	&lt;p&gt;4. The activity log provides a filtered view of previous operations for that VM along with time, date, and subscription.&lt;/p&gt;
-
-	&lt;p&gt;To download the log information, select Download as CSV.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-RESOURCE1" name="Set resource locks for mission critical Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to CanNotDelete or ReadOnly to achieve this purpose.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.&lt;/li&gt;&lt;li&gt;ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;For each of the mission critical resource, click on Locks&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Give the lock a name and a description, then select the type, CanNotDelete or ReadOnly as appropriate&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To lock a resource, provide the name of the resource, its resource type, and its resource group name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock create --name &amp;lt;LockName&amp;gt; --lock-type &amp;lt;CanNotDelete/Read-only&amp;gt; --resource-group &amp;lt;resourceGroupName&amp;gt; --resource-name &amp;lt;resourceName&amp;gt; --resource-type &amp;lt;resourceType&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="cis-azure-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;Click on Locks&lt;/li&gt;&lt;li&gt;Ensure the lock is defined with name and description, type as CanNotDelete or ReadOnly as appropriate.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Review the list of all locks set currently:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock list --resource-group &amp;lt;resourcegroupname&amp;gt; --resource-name &amp;lt;resourcename&amp;gt; --namespace &amp;lt;Namespace&amp;gt; --resource-type &amp;lt;type&amp;gt; --parent ""&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
-  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
-  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
-  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
-  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
-                            subscription.&lt;/li&gt;
-                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
-                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER2" name="Upgrade Azure Public Load Balancers from Basic to Standard" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Upgrade Azure Public Load Balancers from Basic to Standard&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Azure offers two types of Load Balancer offerings, Standard and Basic. &lt;/p&gt;
-
-	&lt;p&gt;Standard Load Balancer is secure by default and part of your virtual network. The virtual network is a private and isolated network. This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource.&lt;br /&gt;
-Basic Load Balancer is open to the internet by default.&lt;/p&gt;
-
-	&lt;p&gt;Using a Standard Load Balancer is recommended for your production workloads and typically the Basic Load Balancer is only used for testing since the basic type is open to connections from the internet by default, and doesn't require network security groups for operation.&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-There are two stages in an upgrade:&lt;/p&gt;
-
-	&lt;p&gt;1. Change IP allocation method from Dynamic to Static.&lt;br /&gt;
-2. Run the PowerShell script to complete the upgrade and traffic migration.&lt;/p&gt;
-
-	&lt;p&gt;There are different scripts to support upgrade for Public (External) Load Balancers, Private (Internal) where no outbound connection is required and Private (Internal) where outbound connection is required.&lt;br /&gt;
-For more information please see the Reference URLs. &lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-It usually take about 5-10 minutes for the script to finish and it could take longer depending on the complexity of your Load Balancer configuration. Therefore, keep the downtime in mind and plan for failover if necessary.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Upgrade Azure Internal Load Balancer - Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-internalbasic-to-publicstandard"/>
-            <reference name="Upgrade Azure Internal Load Balancer- No Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basicinternal-standard"/>
-            <reference name="Upgrade Azure Public Load Balancer" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basic-standard"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using Standard Load Balancers for your production workloads.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
-&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
-&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
-&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
-&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
-&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
-&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
-&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
-&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
-&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
-&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
-&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
-&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
-&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
-&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
-&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
-&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
-            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
-&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="25"/>
-                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A01" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A01" mitigation="25"/>
-                <countermeasure ref="AZ-A03" mitigation="25"/>
-                <countermeasure ref="AZ-A04" mitigation="25"/>
-                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
-                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
-                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                <countermeasure ref="AZURE-SSO" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VM01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-V02" mitigation="33"/>
-                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-                    <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-V02" mitigation="33"/>
-                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-                <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
-                <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                    <countermeasure ref="AZ-L01" mitigation="33"/>
-                    <countermeasure ref="AZ-L05" mitigation="33"/>
-                    <countermeasure ref="AZ-M01" mitigation="25"/>
-                    <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
-                    <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
-                    <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                <countermeasure ref="AZ-L01" mitigation="33"/>
-                <countermeasure ref="AZ-L05" mitigation="33"/>
-                <countermeasure ref="AZ-M01" mitigation="25"/>
-                <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
-                <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
-                <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
-                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
-                    <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
-                    <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-NON-IDENTIFY">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-TAGS" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N09" mitigation="12"/>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
-                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
-                <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
-                <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
-                <countermeasure ref="AZURE-TAGS" mitigation="11"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="539accc4-a293-4c64-821a-0ac0be0f651b" diagramComponentId="f2bd2c04-30f3-48f2-9958-7c68638b0af8" ref="266e0b13-2a57-4c2d-9ae6-6363fd4c5c7b" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="93915a63-309d-4fd5-8cf8-1e8c346f3dac" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.278">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.192">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.192">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="984e4d5c-6e77-4caf-b74b-09d691e8cc33" diagramComponentId="bce57632-a085-458e-bc3d-8657091b8864" ref="00541527-3e92-4c4c-a95f-ac62c6355616" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="70317d76-9d27-4914-b512-80a1d22080b1" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.854">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.644">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.645">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="2309a8ff-5fd8-4734-8f8e-9b25b321ffc2" diagramComponentId="4e6ac814-d7ac-4810-b1d4-7d199e4f1720" ref="93915a63-309d-4fd5-8cf8-1e8c346f3dac" name="Subnet 1" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="215c2163-29c5-4003-a75c-095c16dd7a91" diagramComponentId="6d4a6bd2-4143-4e77-bf2f-317b2d8f3283" ref="803627c9-d7fe-43f3-8bc1-571442c87223" name="Azure WAF (Web Application Firewall)" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-WAF">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.953">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Custom rules that you create 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a policy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
-&lt;/div&gt; 
-&lt;div&gt;
-  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Association tab, enter one of the following settings, then select Add: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select Review + create, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
-            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test the application gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Find the public IP address for the application gateway on its Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Copy the public IP address, and then paste it into the address bar of your browser. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.928">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-WAF-GW" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-WAF-GW" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="66e076eb-cdee-4e3f-9c6a-9c641004f5e3" diagramComponentId="186d0cfb-db0e-4be1-a771-62bf01ceddcc" ref="a482191d-3ddd-4a7f-8a98-da175dac0d97" name="Generic Client" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.437">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.622">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.538">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.401">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="bdc666b1-550d-497b-b2db-54000dc85c90" diagramComponentId="ef6e125a-d58b-4c86-8f57-0750d1453b3d" ref="c8ab2ca0-1ed2-4c22-8e96-76ed382f4049" name="Azure Load Balancer" desc="" library="" parentComponentRef="70317d76-9d27-4914-b512-80a1d22080b1" componentDefinitionRef="microsoft-azure-load-balancer">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not adequately configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.501">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-04" name="Unauthorized connection attempts on Azure resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to Azure resources is most likely to be receiving an
-                        attack. To avoid this, access to the network must be as restricted as possible using Network
-                        Access Control Lists for blacklisting.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Network security groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select the Network Security Group (NSG) for your virtual machine and click on
-                            &amp;quot;Inbound security rules&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is a rule to deny the inbound access from a blacklisted IP
-                            address or range to a designated port or port range.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.501">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.764">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable and use Traffic Analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Visualize network activity across your Azure subscriptions and identify hot spots. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Pinpoint network misconfigurations leading to failed connections in your network. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable Network Watcher 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select a network security group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable flow log settings 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling flow log settings, you must complete the following tasks: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register the Azure Insights provider, if it's not already registered for your subscription: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  New-AzStorageAccount ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Location westcentralus ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -SkuName Standard_LRS ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Kind StorageV2 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the following options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Select On for Status 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Select On for Traffic Analytics Status. 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View traffic analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;3. Select Create.&lt;/p&gt; 
-&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
-&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
-&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
-
-	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
-
-	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
-2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
-3. Select your DDoS protection plan from the list.&lt;/p&gt;
-
-	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
-&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
-&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
-&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
-&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-NSG-LOGS" name="Enable Network Security Group flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Network Security Group (NSG) flow logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. &lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to enable NSG flow log&lt;/p&gt; 
-&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
-&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
-&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
-&lt;p&gt;The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
-&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
-&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
-&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
-&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
-&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
-&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
-&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Download flow log&lt;/p&gt;
-
-	&lt;p&gt;1. From Network Watcher, in the portal, select NSG flow logs under LOGS.&lt;/p&gt;
-
-	&lt;p&gt;2. Select You can download flow logs from configured storage accounts.&lt;/p&gt;
-
-	&lt;p&gt;3. Select the storage account that you configured in step 2 of Enable NSG flow log (Remediation section).&lt;/p&gt;
-
-	&lt;p&gt;4. Under Blob service, select Containers, and then select the insights-logs-networksecuritygroupflowevent container.&lt;/p&gt;
-
-	&lt;p&gt;5. In the container, navigate the folder hierarchy until you get to a PT1H.json file. Log files are written to a folder hierarchy that follows the following naming convention: https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json&lt;/p&gt;
-
-	&lt;p&gt;6. Select ... to the right of the PT1H.json file and select Download.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing&lt;/p&gt;
-
-  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
-
-  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SECURE-CONFIG" name="Establish secure configurations with Azure Policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Establish secure configurations for Azure Traffic Manager&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.&lt;/p&gt; 
-&lt;p&gt;Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.&lt;/p&gt; 
-&lt;p&gt;All Azure Policy data and objects are encrypted at rest.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Define and implement standard security configurations for Azure Traffic Manager with Azure Policy&lt;/p&gt; 
-&lt;p&gt;1. Use Azure Policy to put restrictions on the type of resources that can be created in your and in customer subscriptions using the following built-in policy definitions:&lt;br&gt; - Not allowed resource types&lt;br&gt; - Allowed resource types&lt;br&gt; You can also create custom Azure Policy definitions to restrict more granular resource settings.&lt;/p&gt; 
-&lt;p&gt;2. Use built-in Azure Policy definitions as well as Azure Policy aliases in the "Microsoft.Network" namespace to create custom policies to alert, audit, and enforce system configurations. Additionally, develop a process and pipeline for managing policy exceptions.&lt;/p&gt; 
-&lt;p&gt;3. Use Azure Policy [audit], [deny], and [deploy if not exist] to automatically enforce configurations for your Azure resources.&lt;/p&gt; 
-&lt;p&gt;4. You can use recommendations from Azure Security Center or built-in Azure Policies, such as:&lt;br&gt; - There should be more than one owner assigned to your subscription&lt;br&gt; - Deprecated accounts with owner permissions should be removed from your subscription&lt;br&gt; - External accounts with owner permissions should be removed from your subscription&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; It is important to validate a new policy works as intended before allowing it to change or block work. The validation must ensure only the intended resources are determined to be non-compliant and no compliant resources are incorrectly included (known as a false positive) in the results.&lt;br&gt; For this reason, your policy definitions should be as tightly defined and focused on the resources and the properties you need to evaluate for compliance as possible.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create and manage policies to enforce compliance" url="https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage"/>
-            <reference name="Understand Azure Policy effects" url="https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;The recommended approach to validating a new policy definition is by following these steps:&lt;/p&gt;
-
-	&lt;p&gt;- Tightly define your policy&lt;br /&gt;
-- Audit your existing resources&lt;br /&gt;
-- Audit new or updated resource requests&lt;br /&gt;
-- Deploy your policy to resources&lt;br /&gt;
-- Continuous monitoring&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
-&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER3" name="Integrate Azure Firewall with Azure Standard Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Integrate Azure Firewall with Azure Standard Load Balancer&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can integrate an Azure Firewall into a virtual network with an Azure Standard Load Balancer (either public or internal).&lt;br&gt; Explicitly define internet connectivity and valid source IPs through outbound rules and network security groups with your Load Balancer to use Microsoft's threat intelligence for protecting your web applications.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; The preferred design is to integrate an internal load balancer with your Azure firewall, as this is a much simpler design. You can use a public load balancer if you already have one deployed and you want to keep it in place. However, you need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;/p&gt; 
-&lt;p&gt;Public load balancer&lt;/p&gt; 
-&lt;p&gt;With a public load balancer, the load balancer is deployed with a public frontend IP address.&lt;/p&gt; 
-&lt;p&gt;Asymmetric routing&lt;/p&gt; 
-&lt;p&gt;Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.&lt;/p&gt; 
-&lt;p&gt;Fix the routing issue&lt;/p&gt; 
-&lt;p&gt;When you deploy an Azure Firewall into a subnet, one step is to create a default route for the subnet directing packets through the firewall's private IP address located on the AzureFirewallSubnet.&lt;br&gt; When you introduce the firewall into your load balancer scenario, you want your Internet traffic to come in through your firewall's public IP address. From there, the firewall applies its firewall rules and NATs the packets to your load balancer's public IP address. This is where the problem occurs. Packets arrive on the firewall's public IP address, but return to the firewall via the private IP address (using the default route). To avoid this problem, create an additional host route for the firewall's public IP address. Packets going to the firewall's public IP address are routed via the Internet. This avoids taking the default route to the firewall's private IP address.&lt;/p&gt; 
-&lt;p&gt;Internal load balancer&lt;/p&gt; 
-&lt;p&gt;With an internal load balancer, the load balancer is deployed with a private frontend IP address.&lt;br&gt; There's no asymmetric routing issue with this scenario. The incoming packets arrive at the firewall's public IP address, get translated to the load balancer's private IP address, and then returns to the firewall's private IP address using the same return path.&lt;br&gt; So, you can deploy this scenario similar to the public load balancer scenario, but without the need for the firewall public IP address host route.&lt;/p&gt; 
-&lt;p&gt;Note: The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Additional security&lt;/p&gt; 
-&lt;p&gt;To further enhance the security of your load-balanced scenario, you can use network security groups (NSGs).&lt;br&gt; For example, you can create an NSG on the backend subnet where the load-balanced virtual machines are located. Allow incoming traffic originating from the firewall IP address/port.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;br&gt; The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Integrate Azure Firewall with Azure Standard Load Balancer" url="https://docs.microsoft.com/en-us/azure/firewall/integrate-lb"/>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Firewall is integrated with Azure Standard Load Balancer.&lt;br /&gt;
-Test the firewall to confirm that it works as expected, following the testing steps for firewall deployment.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER1" name="Maintain an inventory of administrative accounts for Azure Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure role-based access control (Azure RBAC) allows you to manage access to Azure resources such as your Load Balancer through role assignments. Assign these roles to users, groups service principals, and managed identities.&lt;br&gt; Inventory Pre-defined and built-in roles for certain resources with tools like Azure CLI, Azure PowerShell or the Azure portal.&lt;br&gt; It is highly recommended by Microsoft to maintain an inventory of administrative accounts.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure built-in roles" url="https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
-&lt;p&gt;Version control workflow&lt;/p&gt; 
-&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
-&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-JIT-VM-ACCESS" name="Secure your management ports with just-in-time VM access" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure your management ports with just-in-time (JIT) VM access&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. All of your virtual machines are potential targets for an attack. When a VM is successfully compromised, it's used as the entry point to attack further resources within your environment.&lt;/p&gt; 
-&lt;p&gt;As with all cybersecurity prevention techniques, your goal should be to reduce the attack surface. In this case, that means having fewer open ports, especially management ports.&lt;br&gt; Your legitimate users also use these ports, so it's not practical to keep them closed.&lt;br&gt; To solve this dilemma, Azure Security Center offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to Enable JIT on your VMs from Azure Security Center&lt;/p&gt; 
-&lt;p&gt;From Security Center, you can enable and configure the JIT VM access.&lt;/p&gt; 
-&lt;p&gt;1. Open the Azure Defender dashboard and from the advanced protection area, select Just-in-time VM access.&lt;/p&gt; 
-&lt;p&gt;The Just-in-time VM access page opens with your VMs grouped into the following tabs:&lt;/p&gt; 
-&lt;p&gt;a. Configured - VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:&lt;br&gt; i. The number of approved JIT requests in the last seven days&lt;br&gt; ii. The last access date and time&lt;br&gt; iii. The connection details configured&lt;br&gt; iv. The last user&lt;/p&gt; 
-&lt;p&gt;b. Not configured - VMs without JIT enabled, but that can support JIT. Microsoft recommends that you enable JIT for these VMs.&lt;/p&gt; 
-&lt;p&gt;c. Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons:&lt;br&gt; i. Missing network security group (NSG) - JIT requires an NSG to be configured&lt;br&gt; ii. Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models.&lt;br&gt; iii. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.&lt;/p&gt; 
-&lt;p&gt;2. From the Not configured tab, mark the VMs to protect with JIT and select Enable JIT on VMs.&lt;/p&gt; 
-&lt;p&gt;The JIT VM access page opens listing the ports that Security Center recommends protecting:&lt;/p&gt; 
-&lt;p&gt;- 22 - SSH&lt;br&gt; - 3389 - RDP&lt;br&gt; - 5985 - WinRM&lt;br&gt; - 5986 - WinRM&lt;/p&gt; 
-&lt;p&gt;To accept the default settings, select Save.&lt;/p&gt; 
-&lt;p&gt;3. To customize the JIT options:&lt;/p&gt; 
-&lt;p&gt;- Add custom ports with the Add button.&lt;br&gt; - Modify one of the default ports, by selecting it from the list.&lt;/p&gt; 
-&lt;p&gt;For each port (custom and default) the Add port configuration pane offers the following options:&lt;/p&gt; 
-&lt;p&gt;- Protocol- The protocol that is allowed on this port when a request is approved&lt;br&gt; - Allowed source IPs- The IP ranges that are allowed on this port when a request is approved&lt;br&gt; - Maximum request time- The maximum time window during which a specific port can be opened&lt;/p&gt; 
-&lt;p&gt;a. Set the port security to your needs.&lt;/p&gt; 
-&lt;p&gt;b. Select OK.&lt;/p&gt; 
-&lt;p&gt;4. Select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure your management ports with just-in-time access" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time"/>
-            <reference name="Understanding just-in-time (JIT) VM access" url="https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Audit JIT access activity in Security Center&lt;/p&gt;
-
-	&lt;p&gt;You can gain insights into VM activities using log search. To view the logs:&lt;/p&gt;
-
-	&lt;p&gt;1. From Just-in-time VM access, select the Configured tab.&lt;/p&gt;
-
-	&lt;p&gt;2. For the VM that you want to audit, open the ellipsis menu at the end of the row.&lt;/p&gt;
-
-	&lt;p&gt;3. Select Activity Log from the menu.&lt;/p&gt;
-
-	&lt;p&gt;4. The activity log provides a filtered view of previous operations for that VM along with time, date, and subscription.&lt;/p&gt;
-
-	&lt;p&gt;To download the log information, select Download as CSV.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-RESOURCE1" name="Set resource locks for mission critical Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to CanNotDelete or ReadOnly to achieve this purpose.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.&lt;/li&gt;&lt;li&gt;ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;For each of the mission critical resource, click on Locks&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Give the lock a name and a description, then select the type, CanNotDelete or ReadOnly as appropriate&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To lock a resource, provide the name of the resource, its resource type, and its resource group name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock create --name &amp;lt;LockName&amp;gt; --lock-type &amp;lt;CanNotDelete/Read-only&amp;gt; --resource-group &amp;lt;resourceGroupName&amp;gt; --resource-name &amp;lt;resourceName&amp;gt; --resource-type &amp;lt;resourceType&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="cis-azure-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;Click on Locks&lt;/li&gt;&lt;li&gt;Ensure the lock is defined with name and description, type as CanNotDelete or ReadOnly as appropriate.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Review the list of all locks set currently:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock list --resource-group &amp;lt;resourcegroupname&amp;gt; --resource-name &amp;lt;resourcename&amp;gt; --namespace &amp;lt;Namespace&amp;gt; --resource-type &amp;lt;type&amp;gt; --parent ""&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
-  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
-  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
-  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
-  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
-                            subscription.&lt;/li&gt;
-                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
-                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-LOAD-BALANCER2" name="Upgrade Azure Public Load Balancers from Basic to Standard" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Upgrade Azure Public Load Balancers from Basic to Standard&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Azure offers two types of Load Balancer offerings, Standard and Basic. &lt;/p&gt;
-
-	&lt;p&gt;Standard Load Balancer is secure by default and part of your virtual network. The virtual network is a private and isolated network. This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource.&lt;br /&gt;
-Basic Load Balancer is open to the internet by default.&lt;/p&gt;
-
-	&lt;p&gt;Using a Standard Load Balancer is recommended for your production workloads and typically the Basic Load Balancer is only used for testing since the basic type is open to connections from the internet by default, and doesn't require network security groups for operation.&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-There are two stages in an upgrade:&lt;/p&gt;
-
-	&lt;p&gt;1. Change IP allocation method from Dynamic to Static.&lt;br /&gt;
-2. Run the PowerShell script to complete the upgrade and traffic migration.&lt;/p&gt;
-
-	&lt;p&gt;There are different scripts to support upgrade for Public (External) Load Balancers, Private (Internal) where no outbound connection is required and Private (Internal) where outbound connection is required.&lt;br /&gt;
-For more information please see the Reference URLs. &lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-It usually take about 5-10 minutes for the script to finish and it could take longer depending on the complexity of your Load Balancer configuration. Therefore, keep the downtime in mind and plan for failover if necessary.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Upgrade Azure Internal Load Balancer - Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-internalbasic-to-publicstandard"/>
-            <reference name="Upgrade Azure Internal Load Balancer- No Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basicinternal-standard"/>
-            <reference name="Upgrade Azure Public Load Balancer" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basic-standard"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using Standard Load Balancers for your production workloads.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
-&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
-&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
-&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
-&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
-&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
-&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
-&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
-&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
-&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
-&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
-&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
-&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
-&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
-&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
-&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
-&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
-            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
-&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="25"/>
-                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A01" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A01" mitigation="25"/>
-                <countermeasure ref="AZ-A03" mitigation="25"/>
-                <countermeasure ref="AZ-A04" mitigation="25"/>
-                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
-                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
-                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
-                <countermeasure ref="AZURE-SSO" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-04">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VM01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-V02" mitigation="33"/>
-                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-                    <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-V02" mitigation="33"/>
-                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-                <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
-                <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                    <countermeasure ref="AZ-L01" mitigation="33"/>
-                    <countermeasure ref="AZ-L05" mitigation="33"/>
-                    <countermeasure ref="AZ-M01" mitigation="25"/>
-                    <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
-                    <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
-                    <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                <countermeasure ref="AZ-L01" mitigation="33"/>
-                <countermeasure ref="AZ-L05" mitigation="33"/>
-                <countermeasure ref="AZ-M01" mitigation="25"/>
-                <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
-                <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
-                <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
-                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
-                    <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
-                    <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
-                    <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-NON-IDENTIFY">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-TAGS" mitigation="11"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N09" mitigation="12"/>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
-                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
-                <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
-                <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
-                <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
-                <countermeasure ref="AZURE-TAGS" mitigation="11"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="aa4f28fb-ddc0-4895-b84d-e35b27ba71f4" diagramComponentId="de645501-97cc-420c-9c83-9fa32c4a9da2" ref="f72549b9-c513-41ed-9eb7-63730d128139" name="Azure DNS (Domain Name System)" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-DNS">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.050">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-ADMIN-INV" name="Maintain an inventory of administrative accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintain an inventory of administrative accounts&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure AD has built-in roles that must be explicitly assigned and are queryable. Use the Azure AD PowerShell module to perform ad hoc queries to discover accounts that are members of administrative groups.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get-AzureADDirectoryRole" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0"/>
-            <reference name="Get-AzureADDirectoryRoleMember" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrolemember?view=azureadps-2.0"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.024">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADMIN-INV" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADMIN-INV" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="804ced73-ae5a-41b2-af9e-2c3ab0778132" diagramComponentId="3388dc81-8dd2-4052-ad6c-0bb09940e5bf" ref="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" name="Subnet 3" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="f204c630-7b80-4c89-8a60-75745f86a084" diagramComponentId="ef126eb2-c355-4a2b-a795-1f2d0f8f586c" ref="b0159b26-8d10-41ed-bf52-4e8759635810" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.844">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.813">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6f44195d-4146-4d17-b40a-c7625ee38350" diagramComponentId="fd167d37-437f-4d87-abe0-00cfc01e969d" ref="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" name="Azure VNet" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-VNET">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security policies are not adequately configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.343">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.148">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable and use Traffic Analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Visualize network activity across your Azure subscriptions and identify hot spots. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Pinpoint network misconfigurations leading to failed connections in your network. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable Network Watcher 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select a network security group 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable flow log settings 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Before enabling flow log settings, you must complete the following tasks: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register the Azure Insights provider, if it's not already registered for your subscription: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  New-AzStorageAccount ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Location westcentralus ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -SkuName Standard_LRS ` 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; -Kind StorageV2 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Select the following options: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Select On for Status 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Select On for Traffic Analytics Status. 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View traffic analytics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;3. Select Create.&lt;/p&gt; 
-&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
-&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
-&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
-&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
-&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
-
-	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
-
-	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
-2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
-3. Select your DDoS protection plan from the list.&lt;/p&gt;
-
-	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-SECURITY-CENTER4" name="Enable Azure Defender" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Defender&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Azure Defender provides security alerts and advanced threat protection for virtual machines, SQL databases, containers, web applications, your network, and more.&lt;/p&gt;
-
-	&lt;p&gt;When you enable Azure Defender from the Pricing and settings area of Azure Security Center, the following Defender plans are all enabled simultaneously and provide comprehensive defenses for the compute, data, and service layers of your environment:&lt;/p&gt;
-
-	&lt;p&gt;- Azure Defender for servers&lt;br /&gt;
-- Azure Defender for App Service&lt;br /&gt;
-- Azure Defender for Storage&lt;br /&gt;
-- Azure Defender for SQL&lt;br /&gt;
-- Azure Defender for Kubernetes&lt;br /&gt;
-- Azure Defender for container registries&lt;br /&gt;
-- Azure Defender for Key Vault&lt;br /&gt;
-- Azure Defender for Resource Manager&lt;br /&gt;
-- Azure Defender for DNS&lt;/p&gt;
-
-	&lt;p&gt;Each plan in Azure Defender is priced separately and can be individually set to on or off. For example, you might want to turn off Azure Defender for App Service on subscriptions that don't have an associated Azure App Service plan.&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-To enable Azure Defender on one subscription:&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's main menu, select Pricing &amp;amp; settings.&lt;br /&gt;
-2. Select the subscription or workspace that you want to protect.&lt;br /&gt;
-3. Select Azure Defender on to upgrade.&lt;br /&gt;
-4. Select Save.&lt;/p&gt;
-
-	&lt;p&gt;Tip: You'll notice that each plan in Azure Defender is priced separately and can be individually set to on or off. For example, you might want to turn off Azure Defender for App Service on subscriptions that don't have an associated Azure App Service plan.&lt;/p&gt;
-
-
-	&lt;p&gt;To enable Azure Defender on multiple subscriptions or workspaces:&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's sidebar, select Getting started.&lt;/p&gt;
-
-	&lt;p&gt;The Upgrade tab lists subscriptions and workspaces eligible for onboarding.&lt;/p&gt;
-
-	&lt;p&gt;2. From the Select subscriptions and workspaces to enable Azure Defender on list, select the subscriptions and workspaces to upgrade and select Upgrade to enable Azure Defender.&lt;/p&gt;
-
-	&lt;p&gt;- If you select subscriptions and workspaces that aren't eligible for trial, the next step will upgrade them and charges will begin.&lt;br /&gt;
-- If you select a workspace that's eligible for a free trial, the next step will begin a trial.&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Introduction to Azure Defender" url="https://docs.microsoft.com/en-us/azure/security-center/azure-defender"/>
-            <reference name="Quickstart: Enable Azure Defender" url="https://docs.microsoft.com/en-us/azure/security-center/enable-azure-defender"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="2.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DP-3" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="ES-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="IM-8" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To ensure that Azure Defender is enabled from Azure portal&lt;/p&gt;
-
-	&lt;p&gt;1. Go to Security Center&lt;br /&gt;
-2. Select Pricing &amp;amp; settings blade&lt;br /&gt;
-3. Click on the subscription name&lt;br /&gt;
-4. Select the Azure Defender plans blade&lt;br /&gt;
-5. Review the chosen pricing tier. For the desired resource type Plan should be set to On.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-NSG-FLOW-LOGS" name="Enable NSG flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable NSG flow logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable NSG flow log&lt;/p&gt; 
-&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
-&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
-&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
-&lt;p&gt;The storage account may take around minute to create. Do not continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
-&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
-&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
-&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
-&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
-&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
-&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
-&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that NSG flow logs are enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AZURE-VNET2" name="Enable packet capture for VPN gateways" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable packet capture for VPN gateways&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use VPN Gateway's packet capture in addition to commonly available packet capture tools to record network packets.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To set up packet capture in Azure portal&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Go to Virtual network gateway setup.&lt;/p&gt; 
-&lt;p&gt;3. Select VPN Gateway Packet Capture from the left-nav menu.&lt;/p&gt; 
-&lt;p&gt;4. Click Start Packet Capture.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure packet capture for VPN gateways" url="https://docs.microsoft.com/en-us/azure/vpn-gateway/packet-capture"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that packet capture for VPN gateways is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Licensing requirements&lt;/p&gt;
-
-  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
-
-  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
-- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
-
-  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
-
-  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
-- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
-When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
-
-  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AZURE-VNET1" name="Enable resource logs for NSGs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable resource logs for NSGs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; When you enable logging for an NSG, you can gather the following types of resource log information:&lt;br&gt; - Event: Entries are logged for which NSG rules are applied to VMs, based on MAC address.&lt;br&gt; - Rule counter: Contains entries for how many times each NSG rule is applied to deny or allow traffic. The status for these rules is collected every 300 seconds.&lt;br&gt; Resource logs are only available for NSGs deployed through the Azure Resource Manager deployment model. You cannot enable resource logging for NSGs deployed through the classic deployment model. &lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to enable resource logs for NSG from Azure Portal&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the portal.&lt;/p&gt; 
-&lt;p&gt;2. Select All services, then type network security groups. When Network security groups appear in the search results, select it.&lt;/p&gt; 
-&lt;p&gt;3. Select the NSG you want to enable logging for.&lt;/p&gt; 
-&lt;p&gt;4. Under MONITORING, select Diagnostics logs, and then select Turn on diagnostics.&lt;/p&gt; 
-&lt;p&gt;5. Under Diagnostics settings, enter, or select the following information, and then select Save:&lt;/p&gt; 
-&lt;p&gt;- Name: A name of your choosing. For example: myNsgDiagnostics&lt;br&gt; - Archive to a storage account, Stream to an event hub, and Send to Log Analytics: You can select as many destinations as you choose.&lt;br&gt; - LOG: Select either, or both log categories.&lt;/p&gt; 
-&lt;p&gt;6. View and analyze logs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Resource logging for a network security group" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;View and analyze logs&lt;br /&gt;
-To learn how to view resource log data, see Azure platform logs overview. If you send diagnostics data to:&lt;/p&gt;
-
-	&lt;p&gt;Azure Monitor logs: You can use the network security group analytics solution for enhanced insights. The solution provides visualizations for NSG rules that allow or deny traffic, per MAC address, of the network interface in a virtual machine.&lt;br /&gt;
-Azure Storage account: Data is written to a PT1H.json file. You can find the:&lt;br /&gt;
-Event log in the following path: insights-logs-networksecuritygroupevent/resourceId=/SUBSCRIPTIONS/[ID]/RESOURCEGROUPS/[RESOURCE-GROUP-NAME-FOR-NSG]/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/[NSG NAME]/y=[YEAR]/m=[MONTH/d=[DAY]/h=[HOUR]/m=[MINUTE]&lt;br /&gt;
-Rule counter log in the following path: insights-logs-networksecuritygrouprulecounter/resourceId=/SUBSCRIPTIONS/[ID]/RESOURCEGROUPS/[RESOURCE-GROUP-NAME-FOR-NSG]/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/[NSG NAME]/y=[YEAR]/m=[MONTH/d=[DAY]/h=[HOUR]/m=[MINUTE]&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing&lt;/p&gt;
-
-  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
-
-  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt;
-   Use encryption to protect traffic on external and public networks as it is critical for data protection 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Rationale: 
- &lt;/div&gt; 
- &lt;div&gt;
-   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Remediation: 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Use a valid TLS/SSL certificate for custom domains. 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Redirect HTTP to HTTPs 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enforce FTPS 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enable client certificates 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Impact: 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
-            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
-            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
-            <reference name="Security in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test HTTPS 
-&lt;/div&gt; 
-&lt;div&gt;
-  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references>
-              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-CRED-SCAN" name="Implement Credential Scanner to identify credentials within code" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement Credential Scanner to identify credentials within code&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Prerequisites:&lt;br&gt; 1. You are using the Azure DevOps Build system.&lt;br&gt; 2. The Microsoft Security Code Analysis Extension installed in your account.&lt;br&gt; Setup:&lt;br&gt; 1. Open your team project from your Azure DevOps Account.&lt;br&gt; 2. Navigate to the Build tab under Build and Release&lt;br&gt; 3. Select the Build Definition into which you wish to add the CredScan build task.&lt;br&gt; - New - Click New and follow the steps detailed to create a new Build Definition.&lt;br&gt; - Edit - Select the Build Definition. On the subsequent page, click Edit to begin editing the Build Definition.&lt;br&gt; 4. Click + to navigate to the Add Tasks pane.&lt;br&gt; 5. Find the CredScan build task either from the list or using the search box and then click Add.&lt;br&gt; 6. The Run CredScan build task should now be a part of the Build Definition.&lt;/p&gt; 
-&lt;p&gt;Customizing the CredScan Build Task:&lt;br&gt; 1. Click the task Run CredScan to see the different options available within.&lt;br&gt; 2. Available options include&lt;br&gt; Output Format - TSV/ CSV/ SARIF/ PREfast&lt;br&gt; Tool Version (Recommended: Latest)&lt;br&gt; Scan Folder - The folder in your repository to scan&lt;br&gt; Searchers File Type - Options to locate the searchers file used for scanning.&lt;br&gt; Suppressions File - A JSON file can be used for suppressing issues in the output log (more details in the Resources section).&lt;br&gt; (New) Verbose Output - self explanatory&lt;br&gt; Batch Size - The number of concurrent threads used to run Credential Scanners in parallel. Defaults to 20 (Value must be in the range of 1 to 2147483647).&lt;br&gt; (New) Match Timeout - The amount of time to spend attempting a searcher match before abandoning the check.&lt;br&gt; (New) File Scan Read Buffer Size - Buffer size while reading content in bytes. (Defaults to 524288)&lt;br&gt; (New) Maximum File Scan Read Bytes - Maximum number of bytes to read from a given file during content analysis. (Defaults to 104857600)&lt;br&gt; Run this task (under Control Options) - Specifies when the task should run. Choose "Custom conditions" to specify more complex conditions.&lt;/p&gt; 
-&lt;p&gt;*Version - Build task version within Azure DevOps. Not frequently used.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Getting started with Credential Scanner (CredScan)" url="https://secdevtools.azurewebsites.net/helpcredscan.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Credential Scanner is implemented&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N08" name="Isolate Azure resources into separate VNets by function" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Place the resources into separate VNets according to their use (production, development, test).
-                        Placing such resources accordingly ensures that a resource of a higher security level is not
-                        exposed by the security settings of a lower labeled VNet.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
-                        &lt;li&gt;Migrate or move it to the correct Vnet.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Azure Virtual Network" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
-                            &lt;li&gt;Check that the resources are into the correct Vnet.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADMIN-INV" name="Maintain an inventory of administrative accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintain an inventory of administrative accounts&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure AD has built-in roles that must be explicitly assigned and are queryable. Use the Azure AD PowerShell module to perform ad hoc queries to discover accounts that are members of administrative groups.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
-&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get-AzureADDirectoryRole" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0"/>
-            <reference name="Get-AzureADDirectoryRoleMember" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrolemember?view=azureadps-2.0"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APPROVED-LOCATIONS" name="Manage Azure resources from only approved locations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Manage Azure resources from only approved locations 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use Conditional Access Named Locations to allow access from only specific logical groupings of IP address ranges or countries/regions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Prerequisites 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - An Azure AD tenant. Sign up for a free trial. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - A user, who is a global administrator for the tenant. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - An IP range that is established and credible in your organization. The IP range needs to be in Classless Interdomain Routing (CIDR) format. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure named locations 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the left pane, select Azure Active Directory, then select Conditional Access from the Security section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Conditional Access page, select Named locations and select New location. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Fill out the form on the new page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In the Name box, type a name for your named location. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In the IP ranges box, type the IP range in CIDR format. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Click Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Configure named locations in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that you have configured named locations in your Azure environment.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
-&lt;p&gt;Version control workflow&lt;/p&gt; 
-&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
-&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
-  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
-  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
-  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
-&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
-&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
-&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
-&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
-&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
-  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
-  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
-   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0 is are blocked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N03" name="Use Network Security Groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure
-                        resources. Set the limit inbound access to port 3389 (Remote Desk Protocol) to IP addresses that
-                        require this access to avoid undue exposure to risk.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                        &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt;
-                        &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;:&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Allow RDP port traffic just to/from IPs that require the access.&lt;/li&gt;
-                        &lt;li&gt;Otherwise, remove all rules that allow port 3389 traffic.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that the traffic through the
-                            port 3389 is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
-&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADMIN-INV" mitigation="50"/>
-                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADMIN-INV" mitigation="50"/>
-                <countermeasure ref="AZURE-MANAGED-ID" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VM01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-CRED-SCAN" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-CRED-SCAN" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="INSUFFICIENT-LOGGING-MONITORING" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="14"/>
-                    <countermeasure ref="AZURE-AD10" mitigation="14"/>
-                    <countermeasure ref="AZURE-MONITOR6" mitigation="14"/>
-                    <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="14"/>
-                    <countermeasure ref="AZURE-SECURITY-CENTER4" mitigation="14"/>
-                    <countermeasure ref="C-AZURE-VNET1" mitigation="15"/>
-                    <countermeasure ref="C-AZURE-VNET2" mitigation="15"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="14"/>
-                <countermeasure ref="AZURE-AD10" mitigation="14"/>
-                <countermeasure ref="AZURE-MONITOR6" mitigation="14"/>
-                <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="14"/>
-                <countermeasure ref="AZURE-SECURITY-CENTER4" mitigation="14"/>
-                <countermeasure ref="C-AZURE-VNET1" mitigation="15"/>
-                <countermeasure ref="C-AZURE-VNET2" mitigation="15"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N01" mitigation="9"/>
-                    <countermeasure ref="AZ-N02" mitigation="9"/>
-                    <countermeasure ref="AZ-N03" mitigation="9"/>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="9"/>
-                    <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="9"/>
-                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="9"/>
-                    <countermeasure ref="AZURE-FIREWALL3" mitigation="9"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="9"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-NON-IDENTIFY">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-TAGS" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N08" mitigation="9"/>
-                    <countermeasure ref="AZ-N09" mitigation="9"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N01" mitigation="9"/>
-                <countermeasure ref="AZ-N02" mitigation="9"/>
-                <countermeasure ref="AZ-N03" mitigation="9"/>
-                <countermeasure ref="AZ-N08" mitigation="9"/>
-                <countermeasure ref="AZ-N09" mitigation="9"/>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="9"/>
-                <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="9"/>
-                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="9"/>
-                <countermeasure ref="AZURE-FIREWALL3" mitigation="9"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="9"/>
-                <countermeasure ref="AZURE-TAGS" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 966fc26960bb3c5f092b5b4dc91db51b0f2df8fe Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:21:10 -0400
Subject: [PATCH 13/28] Delete
 Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml

---
 ...ent-to-azure-functions-and-web-backend.xml | 7855 -----------------
 1 file changed, 7855 deletions(-)
 delete mode 100644 Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml

diff --git a/Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml b/Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml
deleted file mode 100644
index 39209bb..0000000
--- a/Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml
+++ /dev/null
@@ -1,7855 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="Azure - MQTT Client to Azure Functions and Web backend" name="Azure - MQTT Client to Azure Functions and Web backend" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIxIiBpckRyYXdpb1ZlcnNpb249IjMuMS4wIj48cm9vdD48bXhDZWxsIGlkPSIwIi8+PG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+PG14Q2VsbCBpZD0iMiIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTU0MS4wIiB5PSI0NjMuMCIgd2lkdGg9IjU5Mi4wIiBoZWlnaHQ9IjQzNS4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iTWljcm9zb2Z0IFNRTCBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9YWNkMmFiMmEtNjJkYS00ZDZkLWJhZDItYTZhYTIwMDM0NTdlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc29mdC1zcWwtc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRnd056aERNQzQ0TXprMk5qZ2dNQzR6TkRBNE9UZ2dNQzQyT0RjME16TWdNQzQwTVRZd056Z2dNQzQwT1RrMk5qZ2dNQzQwTVRZd056aERNQzR6TVRFNU1ETWdNQzQwTVRZd056Z2dNQzR4TlRrMk5qZ2dNQzR6TkRBNE9UZ2dNQzR4TlRrMk5qZ2dNQzR5TkRnd056aERNQzR4TlRrMk5qZ2dNQzR4TlRVeU5UZ2dNQzR6TVRFNU1ETWdNQzR3T0RBd056Z3hJREF1TkRrNU5qWTRJREF1TURnd01EYzRNVU13TGpZNE56UXpNeUF3TGpBNE1EQTNPREVnTUM0NE16azJOamdnTUM0eE5UVXlOVGdnTUM0NE16azJOamdnTUM0eU5EZ3dOemhhVFRBdU9ETTVOalk0SURBdU16YzJNekEwUXpBdU9ERTRNVGcySURBdU16azBPVGM1SURBdU56azBNamt4SURBdU5ERXdOelUxSURBdU56WTROakE0SURBdU5ESXpNakU0UXpBdU5qazJORFF6SURBdU5EVTRPRE0wSURBdU5qQXhNekk0SURBdU5EYzVNRGM0SURBdU5EazVOalk0SURBdU5EYzVNRGM0UXpBdU16azRNREE0SURBdU5EYzVNRGM0SURBdU16QXlPRGt6SURBdU5EVTRPRE0wSURBdU1qTXdOekk0SURBdU5ESXpNakU0UXpBdU1qQTFNRFEySURBdU5ERXdOelUxSURBdU1UZ3hNVFVnTUM0ek9UUTVOemtnTUM0eE5UazJOamdnTUM0ek56WXpNRFJXTUM0M05USXdOemhETUM0eE5UazJOamdnTUM0NE5EUTRPVGdnTUM0ek1URTVNRE1nTUM0NU1qQXdOemdnTUM0ME9UazJOamdnTUM0NU1qQXdOemhETUM0Mk9EYzBNek1nTUM0NU1qQXdOemdnTUM0NE16azJOamdnTUM0NE5EUTRPVGdnTUM0NE16azJOamdnTUM0M05USXdOemhXTUM0ek56WXpNRFJhVFRBdU5UQTROek1nTUM0MU1qRXlOemRETUM0MU1EYzFOamdnTUM0MU1qRXhNakVnTUM0ME9EZzRNekVnTUM0MU1qYzROellnTUM0ME56WTNORFFnTUM0MU16STNPRFJETUM0ME5qQTBNeklnTUM0MU16azBNemNnTUM0ME5EYzNOalVnTUM0MU5EVTNOekVnTUM0ME16azVOVE1nTUM0MU5URXlOVGxETUM0ME16YzBNelVnTUM0MU5UTXdORFFnTUM0ME16UXpOaklnTUM0MU5UWXdNVGtnTUM0ME16TXlNVElnTUM0MU5UYzNNRGRNTUM0ME16TXdNVFlnTUM0MU5UZ3dNVFJNTUM0ME16STRNamNnTUM0MU5UZ3pPRFJETUM0ME16STJNVGNnTUM0MU5UZzVNVE1nTUM0ME16STFNU0F3TGpVMU9UVTBOaUF3TGpRek1qVXhJREF1TlRZd01UYzVUREF1TkRNeU5qZ3lJREF1TlRZd016UXhRekF1TkRNeU56STRJREF1TlRZd09UQTJJREF1TkRNeU9EWXpJREF1TlRZeE5UUXpJREF1TkRNek1UUTBJREF1TlRZeU1qTTVRekF1TkRNek9ETWdNQzQxTmpNNU1qY2dNQzQwTXpVNE16Y2dNQzQxTmpVNU9EVWdNQzQwTXpneE1EVWdNQzQxTmpnd09UZERNQzQwTXpneE1EVWdNQzQxTmpnd09UY2dNQzQwTmpFMU9UUWdNQzQxT1RFd01EUWdNQzQwTmpRME5ETWdNQzQxT1RReU56ZERNQzQwTnpjME1qZ2dNQzQyTURreU5qY2dNQzQwT0RNd056WWdNQzQyTWpRd05EY2dNQzQwT0RNMk1EUWdNQzQyTkRRME1qRkRNQzQwT0RNNU1qRWdNQzQyTlRjMU1URWdNQzQwT0RFME5DQXdMalkyT1RBeE9DQXdMalEzTlRJMk5DQXdMalk0TWpNM05FTXdMalEyTkRJNE5TQXdMamN3TmpNek5pQXdMalEwTVRZNE1TQXdMamN6TWpVNU1pQXdMalF3TlRrME55QXdMamMyTVRrek9Vd3dMalF3TlRFeE5TQXdMamMyTWpZd01rTXdMalF3TXpNMU55QXdMamMyTXprNU15QXdMalF3TVRJME9TQXdMamMyTlRnNE15QXdMak01T1RFMU15QXdMamMyTnprd04wTXdMak01TmpFMU5DQXdMamMzTURnZ01DNHpPVE14T0RFZ01DNDNOek01TmpRZ01DNHpPVEV5T0RjZ01DNDNOell6TWpaRE1DNHpPRFkwT0RJZ01DNDNPREl6TkRNZ01DNHpPREkyT0RNZ01DNDNPRGczTWprZ01DNHpPREV3TkRZZ01DNDNPVE0yTXpsRE1DNHpOemd4TkRNZ01DNDRNREkxTURnZ01DNHpOemsxTmpnZ01DNDRNVEUwT0NBd0xqTTROVEUyTkNBd0xqZ3hPVGMyTjBNd0xqTTVNak0wTWlBd0xqZ3pNRE15TXlBd0xqUXdOalkwTnlBd0xqZzBNVEE1TWlBd0xqUXlNek15TlNBd0xqZzBPRFF5TjBNd0xqUXpNVGd5TkNBd0xqZzFNakUzTnlBd0xqUTBOakV5T1NBd0xqZzFOams0SURBdU5EVTJPRGsySURBdU9EVTVOamN4UXpBdU5EYzBOemc1SURBdU9EWTBNakV4SURBdU5UQTVOREUxSURBdU9EWTVNVElnTUM0MU1qZzBOamtnTUM0NE5qazROVGhETUM0MU16SXpNaklnTUM0NE56QXdNVGNnTUM0MU16azFOemtnTUM0NE5qazVOemNnTUM0MU16azFOemtnTUM0NE5qazVOemRETUM0MU16azFOemtnTUM0NE5qazVOemNnTUM0MU5ERXdPRFFnTUM0NE5qTTVORGNnTUM0MU5EUTFNVFlnTUM0NE5UWTVNalpETUM0MU5EUTFNVFlnTUM0NE5UWTVNallnTUM0MU5UZzROeklnTUM0NE1Ua3dPU0F3TGpVMk5EY3pNaUF3TGpjNU9UazNPVXd3TGpVMk5UazJPQ0F3TGpjNU5UazJPRU13TGpVM01Ea3lOU0F3TGpjM09Ua3dOaUF3TGpVM01qazVOQ0F3TGpjM016SWdNQzQxTnpRMU56a2dNQzQzTkRrNU56aERNQzQxTnpZeU5ERWdNQzQzTWpVMk56SWdNQzQxTnpZeE5ERWdNQzQzTWpNNE5EY2dNQzQxTnpVNE5EUWdNQzQzTVRnME5qUk1NQzQxTnpVNE1UVWdNQzQzTVRjNU5EbERNQzQxTnpVek5DQXdMamN3T0RRME9TQXdMalUzTkRRNU5TQXdMamN3TURjME1TQXdMalUzTXpFM055QXdMalk1TXpFNU5Fd3dMalUzTWprM01TQXdMalk1TVRVNFF6QXVOakUxTXpneklEQXVOamM0T1RneUlEQXVOall5TWpneElEQXVOalkzTlRrM0lEQXVOamt6TXpZMUlEQXVOall5T0RReVREQXVOams0TVRZNElEQXVOall5TVRBMFREQXVOamszTkRNZ01DNDJOakE1TkRORE1DNDJPVE15TURjZ01DNDJOVFF6T1RjZ01DNDJPVEF6TURRZ01DNDJOVEF6TXpJZ01DNDJPRFk0TVRrZ01DNDJORFl3TURSRE1DNDJOelkyT0RVZ01DNDJNek0wTkRJZ01DNDJOalF6T0RrZ01DNDJNak15TlRVZ01DNDJORGt6TkRNZ01DNDJNVFE0TVVNd0xqWXlPRFkxTXlBd0xqWXdNekkxTVNBd0xqWXdNVGc1TVNBd0xqVTVOREl5TlNBd0xqVTJPREF3TlNBd0xqVTROelV5TVV3d0xqVTFOREEzTlNBd0xqVTROVXd3TGpVek5qRTRPQ0F3TGpVNE1qQTROMHd3TGpVek5URXlNaUF3TGpVNE1ERTRORU13TGpVeU9EZzVNeUF3TGpVMk9USXdOU0F3TGpVeU1qQXpNaUF3TGpVMU5UVTROaUF3TGpVeE9EQXlNU0F3TGpVME5qUXdNa3d3TGpVeE5UY3hNU0F3TGpVME1EZzFRekF1TlRFek5EazRJREF1TlRNMU1qWTVJREF1TlRFeE5UTTJJREF1TlRJNU5UVXpJREF1TlRFd016RXpJREF1TlRJMU1UTXlRekF1TlRBNU5ERTNJREF1TlRJeE5UUXlJREF1TlRBNU16RWdNQzQxTWpFek15QXdMalV3T0RjeklEQXVOVEl4TWpjM1drMHdMalEwTnpjME1pQXdMalUzTVRFNU5rd3dMalEwTmpVNE1TQXdMalUzTURnME9Vd3dMalEwT1RFMk55QXdMalUzTWprd04wTXdMalEyTURRMk15QXdMalU0TVRjM05DQXdMalEzTURJeU9DQXdMalU1TWpnd05pQXdMalEzTmpRd01pQXdMall3TXpZM09FTXdMalEzTnpBNE9TQXdMall3TkRnNU15QXdMalEzTnpZMk9TQXdMall3TlRjNU1pQXdMalEzTnpjeU1pQXdMall3TlRjek9FTXdMalEzTnpjM05pQXdMall3TlRjek9DQXdMalEzTnpJME55QXdMall3TXpZeU55QXdMalEzTmpVMk1pQXdMall3TVRFME5Vd3dMalEzTXpRd05pQXdMalU1TURRM04wTXdMalEzTVRRd01TQXdMalU0TXprMU1pQXdMalEyT1RJNU5DQXdMalUzTnpReElEQXVORFk1TURZM0lEQXVOVGMzTVRnelREQXVORFk0TWpZMElEQXVOVGMyT1RjeVREQXVORFl6TWpBM0lEQXVOVGMxTmpVeVREQXVORFUyTWpRZ01DNDFOek00TURWTU1DNDBORGcxT0RjZ01DNDFOekUwT0RKTU1DNDBORGMzTkRJZ01DNDFOekV4T1RaYVRUQXVORGMxTXprNUlEQXVOVGM0TlRBeFREQXVORGN5TlRRNUlEQXVOVGM0TURJNFREQXVORGN5TlRFeElEQXVOVGM0TURNNFREQXVORGN6TlRVeklEQXVOVGd3TkRBeFF6QXVORGMzTVRReUlEQXVOVGc0TURVMUlEQXVORGd4TVNBd0xqVTVPRGt5T1NBd0xqUTRNeUF3TGpZd05qSTJOVXd3TGpRNE16VTRNaUF3TGpZd09ESTNNVXd3TGpRNE5qUXpNU0F3TGpZd05UUTNNME13TGpRNE9UUXlOQ0F3TGpZd01qUTRNaUF3TGpRNU16TXpJREF1TlRrNU1qSTRJREF1TkRrM056RTFJREF1TlRrMk1EYzBUREF1TlRBeE16WTVJREF1TlRrek5UUTBRekF1TlRBek5qa3hJREF1TlRreE9UWXhJREF1TlRFd056RXlJREF1TlRnM056a3lJREF1TlRFeU5EVXpJREF1TlRnMk9EazFUREF1TlRFek9EZ2dNQzQxT0RVNU9UZE1NQzQxTVRNeU5qSWdNQzQxT0RVM09ESk1NQzQxTVRBM05qTWdNQzQxT0RVek1VTXdMalV3TURRM01TQXdMalU0TXpVMk9TQXdMalE0TkRNM015QXdMalU0TURVd09DQXdMalEzTlRNNU9TQXdMalUzT0RVd01WcE5NQzQxTVRneU5Ua2dNQzQxT0RZM016ZE1NQzQxTVRnM055QXdMalU0Tnpjek5Vd3dMalV5TURFMU9TQXdMalU1TWpVNU5VTXdMalV5TWpFeE1pQXdMall3TURJME9TQXdMalV5TXpBeElEQXVOakE0TnprNUlEQXVOVEl5TmprMElEQXVOakUyTnpkTU1DNDFNakl6TnpVZ01DNDJNakV6TVV3d0xqVXlNakl4T1NBd0xqWXlNVGd6Tmt3d0xqVXhPVFEzTkNBd0xqWXlNRGswVERBdU5UQTJNRFF5SURBdU5qRTJPRGxNTUM0ME9UWTNOemNnTUM0Mk1UUXlNelZETUM0ME9USXlPU0F3TGpZeE16QXlNaUF3TGpRNE9EWTBPU0F3TGpZeE1Ua3hOQ0F3TGpRNE9EWTBPU0F3TGpZeE1UZ3dOME13TGpRNE9EWTBPU0F3TGpZeE1UUTVNU0F3TGpRNU5URTVNeUF3TGpZd05EazBOeUF3TGpRNU56azVNaUF3TGpZd01qUTJOVU13TGpVd016TXlNU0F3TGpVNU56YzJOeUF3TGpVeE56YzROQ0F3TGpVNE5qVTNOeUF3TGpVeE9ESTFPU0F3TGpVNE5qY3pOMXBOTUM0MU5UTTJNak1nTUM0MU9USTNOVE5ETUM0MU5ETTNOVE1nTUM0MU9UQTROVE1nTUM0MU1qSXdOaUF3TGpVNE56RXdOU0F3TGpVeU1Ua3dNaUF3TGpVNE56STJORXd3TGpVeU1qVXpOU0F3TGpVNE9EazFNME13TGpVeU5qSXpJREF1TlRrM05UQTBJREF1TlRJNE1qTTJJREF1TmpBM05qTTRJREF1TlRJNE1qTTJJREF1TmpFM05qWTNUREF1TlRJNE16UXhJREF1TmpJeE1EUTFUREF1TlRNek16VTJJREF1TmpFM056Y3lRekF1TlRRek5qUTRJREF1TmpFd09URXhJREF1TlRVek9Ua3pJREF1TmpBMU1qWXpJREF1TlRZM09USTRJREF1TlRrNE9UZ3lUREF1TlRjeE5UazJJREF1TlRrM01qTXpRekF1TlRjeU1qSTNJREF1TlRrMk9EZzJJREF1TlRjeU5ERXhJREF1TlRrMk56RXhJREF1TlRjeU1qVTJJREF1TlRrMk5qVTVRekF1TlRjeE5qSXpJREF1TlRrMk16azJJREF1TlRZd09UWXhJREF1TlRrME1UYzRJREF1TlRVek5qSXpJREF1TlRreU56VXpXazB3TGpVM09EQXdPU0F3TGpVNU9ETTBPVU13TGpVM09ERTJOeUF3TGpVNU9EVXdOeUF3TGpVM056UTRJREF1TmpBeU56Z3lJREF1TlRjMk9EUTNJREF1TmpBMU16RTFRekF1TlRjME9UUTNJREF1TmpFek1UZ3hJREF1TlRZNU9ESTRJREF1TmpJME9EUTJJREF1TlRZek5UUTNJREF1TmpNMU9ESTFUREF1TlRZeE16STVJREF1TmpNNU5ERTBUREF1TlRVNE1UWXpJREF1TmpNM056STBRekF1TlRVeU1EUWdNQzQyTXpReE16VWdNQzQxTkRVd056TWdNQzQyTXpBM05UY2dNQzQxTXpjME56SWdNQzQyTWpjMU9EbE1NQzQxTXpVM016Z2dNQzQyTWpZNE5rd3dMalV6TXpRMk1TQXdMall5TlRnME9VTXdMalV6TXpBNU1TQXdMall5TlRVek1TQXdMalUxTURBNE55QXdMall4TkRJNE9TQXdMalUxT1RBMk1TQXdMall3T0Rrd05FTXdMalUyTmpFNE55QXdMall3TkRVM055QXdMalUzTnpjNU55QXdMalU1T0RFek55QXdMalUzT0RBd09TQXdMalU1T0RNME9WcE5NQzQxT1RjeE1UWWdNQzQyTURNd09UaE1NQzQxT1RJMU5UWWdNQzQyTURFM09EaE1NQzQxT0RJd01pQXdMalU1T0RrNE1rTXdMalU0TVRreU15QXdMalU1T0RrNE1pQXdMalU0TVRneU5TQXdMalU1T1RJNE1pQXdMalU0TVRjMU15QXdMalU1T1RjME5rTXdMalU0TVRjd055QXdMall3TURBek5pQXdMalU0TVRZM01TQXdMall3TURNNUlEQXVOVGd4TmpVZ01DNDJNREEzTnpWRE1DNDFPREEzTlRNZ01DNDJNVEUwTXprZ01DNDFOemN4TVRJZ01DNDJNak01TkRnZ01DNDFOekUwTmpVZ01DNDJNelU1TTBNd0xqVTNNVEV3T0NBd0xqWXpOalk1T0NBd0xqVTNNRGM1TXlBd0xqWXpOek01TmlBd0xqVTNNRFU0T1NBd0xqWXpOemc0T0VNd0xqVTNNRFFnTUM0Mk16Z3pORE1nTUM0MU56QXpNRFVnTUM0Mk16ZzJNak1nTUM0MU56QXpOVFlnTUM0Mk16ZzJNak5NTUM0MU56TXpOalFnTUM0Mk16YzBOakZETUM0MU9USXhNRElnTUM0Mk1qazROaUF3TGpZeE1UVXlOaUF3TGpZeU16ZzBNeUF3TGpZek5ESXlNaUF3TGpZeE9EWXhOMHd3TGpZek5qa3hNeUF3TGpZeE56azRNMHd3TGpZek16QTJJREF1TmpFMk1qUXlRekF1TmpJek56Y3lJREF1TmpFeU1ERTVJREF1TmpBNU5USWdNQzQyTURZM09UVWdNQzQxT1RjeE1UWWdNQzQyTURNd09UaGFUVEF1TkRreU9UYzFJREF1TmpJeU16WTJUREF1TkRrM09ETXpJREF1TmpJek5qTXhRekF1TlRBek9EUTVJREF1TmpJMU16SXhJREF1TlRFMk5qSXpJREF1TmpJNU5UazFJREF1TlRFMk5qSXpJREF1TmpJNU9URXlUREF1TlRFME9UZzJJREF1TmpNeE16Y3hUREF1TlRFek5URWdNQzQyTXpJMk5UZERNQzQxTURZMU9UWWdNQzQyTXpnME1URWdNQzQwT1RrNU5EVWdNQzQyTkRRME9DQXdMalE1TVRrM05DQXdMalkxTWpFNE5rd3dMalE0TnpRNE9DQXdMalkxTmpNd05FTXdMalE0TnpNNE1TQXdMalkxTmpNd05DQXdMalE0TnpNeU9TQXdMalkxTlRrNE55QXdMalE0TnpNNE1TQXdMalkxTlRVMk5FTXdMalE0T0RVNU5pQXdMalkwTmpZNU55QXdMalE0T0RNek15QXdMall6TlRJNU5pQXdMalE0TmpZME15QXdMall5TXpjek5rd3dMalE0TmpVek5pQXdMall5TWpjMk4wd3dMalE0TmpNNElEQXVOakl3T1RSRE1DNDBPRFkwT0RNZ01DNDJNakE0TXpjZ01DNDBPRGsyTnpRZ01DNDJNakUxTlNBd0xqUTVNamszTlNBd0xqWXlNak0yTmxwTk1DNDJNemt4TnpRZ01DNDJNak0wTmpWTU1DNDJOREExTlRZZ01DNDJNakV3T1RoRE1DNDJOREEwTlRFZ01DNDJNakE1T1RFZ01DNDJNek0yTkRJZ01DNDJNakk1TkRRZ01DNDJNamN5TlRRZ01DNDJNalE1TlRGRE1DNDJNVFV3TmpFZ01DNDJNamcyT1RrZ01DNDFPVGc0TURZZ01DNDJNelExTURVZ01DNDFPRFk0TnpZZ01DNDJNemt6TmpGRE1DNDFPREF3TmpjZ01DNDJOREl4TURZZ01DNDFOekV3T1RVZ01DNDJORFU1TlRnZ01DNDFOekV3T1RVZ01DNDJORFl4TVRkTU1DNDFOekl4TlRFZ01DNDJORGN3TVROTU1DNDFOell3TlRZZ01DNDJOVEF4T0RGRE1DNDFPRFEwTkRnZ01DNDJOVGN4TkRrZ01DNDFPVEUxTWpJZ01DNDJOalE1TURnZ01DNDFPVGMwTXpNZ01DNDJOek0zTnpWTU1DNDFPVGc1TVRFZ01DNDJOelU0T0RWTU1DNDJNREV3TURRZ01DNDJOek16TURKTU1DNDJNREk0TVRnZ01DNDJOekV3TXpGTU1DNDJNVFkyTkRZZ01DNDJOVE0xTlRsRE1DNDJNamN4TlNBd0xqWTBNRE0yTkNBd0xqWXpNVGM1TmlBd0xqWXpORE0wTmlBd0xqWXpORGsyTWlBd0xqWXlPVGd3TjB3d0xqWXpPVEUzTkNBd0xqWXlNelEyTlZwTk1DNDJORFEyTWpFZ01DNDJNakl4TlROTU1DNDJORFUwTURNZ01DNDJNakkwTWpaTU1DNDJORGMyTWprZ01DNDJNak0yTXpGRE1DNDJOakEwTlRZZ01DNDJNekE1TmpjZ01DNDJOek13TVRnZ01DNDJOREEwTVRZZ01DNDJPREk1TkRFZ01DNDJOVEF4TWpoRE1DNDJPRFUzTkNBd0xqWTFNamczTXlBd0xqWTVNalkxTkNBd0xqWTJNREExTWlBd0xqWTVNalUwTnlBd0xqWTJNREV3TTB3d0xqWTROekkyT1NBd0xqWTJNRFV5TjBNd0xqWTJOVEEwT1NBd0xqWTJNakl4TnlBd0xqWXpOalU1T1NBd0xqWTJOamt4TXlBd0xqWXdPVEkxTnlBd0xqWTNNelV4VERBdU5qQTFOalkzSURBdU5qYzBNekF5UXpBdU5qQTFOVFl5SURBdU5qYzBNekF5SURBdU5qQTNOaklnTUM0Mk56SXlORFFnTUM0Mk1UQXlNRGtnTUM0Mk5qazNOalJETUM0Mk1qWXlOVE1nTUM0Mk5UUXlPVGNnTUM0Mk16TTFPVEVnTUM0Mk5EUTFNelFnTUM0Mk5ESXlORFlnTUM0Mk1qY3hNVFJNTUM0Mk5EUTJNakVnTUM0Mk1qSXhOVE5hVFRBdU5UTTVPRFE0SURBdU5qUXdNVFV5UXpBdU5UTTBOamMySURBdU5qTTNOVFkySURBdU5USTNPREV6SURBdU5qTTBNelEySURBdU5USTNNRGN6SURBdU5qTTBNVGc0UXpBdU5USTJPVEUzSURBdU5qTTBNVGc0SURBdU5USTJOekExSURBdU5qTTBOekUzSURBdU5USTJORGsxSURBdU5qTTFOVEE0UXpBdU5USTBNek1nTUM0Mk5EVTFPRGdnTUM0MU1qQTFNamtnTUM0Mk5UVTVNelFnTUM0MU1UVTNOemtnTUM0Mk5qUTFPRGxETUM0MU1UUXpOVE1nTUM0Mk5qY3hOellnTUM0MU1UUXpNREVnTUM0Mk5qY3pPRGtnTUM0MU1UUTFNVE1nTUM0Mk5qY3pPRGxNTUM0MU1Ua3lNRGtnTUM0Mk5qUTFPRGxETUM0MU1qZ3dOemdnTUM0Mk5Ua3lNRGNnTUM0MU16WTFOelVnTUM0Mk5UUTFNRGtnTUM0MU5EWTBPVGtnTUM0Mk5EazFORGhETUM0MU5EazJNVElnTUM0Mk5EZ3dNVFlnTUM0MU5USXhORFVnTUM0Mk5EWTJPVGNnTUM0MU5USXdPVFFnTUM0Mk5EWTJORFZNTUM0MU5Ea3hOamdnTUM0Mk5EVXdNREZNTUM0MU16azRORGdnTUM0Mk5EQXhOVEphVFRBdU5USXdNakV5SURBdU5qTTFORFUxUXpBdU5USXdNemNnTUM0Mk16VTJNVE1nTUM0MU1UZzFOellnTUM0Mk5ESXhNRFlnTUM0MU1UYzBOamNnTUM0Mk5EVTJOREpETUM0MU1UVXpNRE1nTUM0Mk5USXpORFFnTUM0MU1URTJOaklnTUM0Mk5qQTNNemNnTUM0MU1EZ3hNalVnTUM0Mk5qY3dOekZNTUM0MU1EWTROallnTUM0Mk5qa3lOVEZNTUM0MU1EVXpNamNnTUM0Mk56RTVNamRNTUM0MU1EUXdNRGNnTUM0Mk56UXdNemhNTUM0MU1ERXdOVE1nTUM0Mk56RXhPRGxNTUM0ME9Ua3hNRElnTUM0Mk5qa3pOelZETUM0ME9UYzNPVGtnTUM0Mk5qZ3lNakVnTUM0ME9UWTFOVFVnTUM0Mk5qY3lNemtnTUM0ME9UVXlOelVnTUM0Mk5qWXpOVGxNTUM0ME9UTXlPRElnTUM0Mk5qVXdPRFZNTUM0ME9URXlNellnTUM0Mk5qTTVOVFpNTUM0ME9EZzNNREVnTUM0Mk5qSTBPRU13TGpRNE9EY3dNU0F3TGpZMk1qQTFOaUF3TGpRNU56Y3lOaUF3TGpZMU16ZzNOaUF3TGpVd05EWTBNU0F3TGpZME56azJOVXd3TGpVeE16QTROaUF3TGpZME1EazJOME13TGpVeE5UVXpOaUF3TGpZek9EazRPQ0F3TGpVeE56YzROeUF3TGpZek56SXdOaUF3TGpVeE9UQTNPU0F3TGpZek5qSXpNa013TGpVeE9UYzJOaUF3TGpZek5UY3hOQ0F3TGpVeU1ERTRNaUF3TGpZek5UUXlOQ0F3TGpVeU1ESXhNaUF3TGpZek5UUTFOVnBOTUM0MU5qUTNOaklnTUM0Mk5UUTBNRFJNTUM0MU5qSXhOellnTUM0Mk5USTNNVFJNTUM0MU5qQXpNamdnTUM0Mk5UVTFOalJETUM0MU5URXhORFFnTUM0Mk5qa3pOREVnTUM0MU16ZzNPVElnTUM0Mk9ETTBPRGNnTUM0MU1qUTROVGNnTUM0Mk9UWXpNVEpNTUM0MU1qQTJNVFVnTUM0M01EQXlOREpNTUM0MU1UazROak1nTUM0M01ERXdOVEpNTUM0MU1pQXdMamN3TVRBMk5Fd3dMalV5TkRZME55QXdMalk1T1RReU4wTXdMalUwTmpRME5pQXdMalk1TVRRd05TQXdMalUyTlRFeklEQXVOamcxTkRNNUlEQXVOVGc1TXpBMklEQXVOamM0TnpNMlREQXVOVGt6TlRnZ01DNDJOemMxTWpOTU1DNDFPVEk1TkRjZ01DNDJOelk0TXpaRE1DNDFPVEUzT0RVZ01DNDJOelUxTnlBd0xqVTROVGszT1NBd0xqWTNNRE0wTkNBd0xqVTRNamszTWlBd0xqWTJOemcyTWtNd0xqVTNOell6T1NBd0xqWTJNek0zTmlBd0xqVTNNRFkzTXlBd0xqWTFPREkxTnlBd0xqVTJORGMyTWlBd0xqWTFORFF3TkZwTk1DNDFOVEV4TkRRZ01DNDJOVFUwTlRsTU1DNDFORGcxSURBdU5qVTVNelU1VERBdU5UTTVOamc0SURBdU5qY3hOVEExUXpBdU5UTTBOVEUxSURBdU5qYzRNelkySURBdU5USTFNek14SURBdU5qZzVPRGN6SURBdU5URTRPVGszSURBdU5qazNNelkzVERBdU5URXpPVGcxSURBdU56QXpNVEl5VERBdU5URXpPRGMySURBdU56QXlPVGd4VERBdU5URXpOems0SURBdU56QXlNek0yVERBdU5URXpOemN6SURBdU56QXhNVFk1UXpBdU5URXpOemN6SURBdU5qazBOemd4SURBdU5URXlNVE0ySURBdU5qZzNPVGN5SURBdU5UQTVNamczSURBdU5qZ3lNVFk0UXpBdU5UQTRNRGN5SURBdU5qYzVOek01SURBdU5UQTNPRFlnTUM0Mk56a3hOVGdnTUM0MU1EZ3hNalVnTUM0Mk56ZzRPVFZETUM0MU1EZzNNaUF3TGpZM09ETTJNaUF3TGpVeE5ETTFNeUF3TGpZM05UQTNJREF1TlRJd09EWTBJREF1TmpjeE16ZzVUREF1TlRNME1UazVJREF1TmpZME1ERkRNQzQxTkRBM05EVWdNQzQyTmpBMU1qY2dNQzQxTlRBNU9ETWdNQzQyTlRVek5UUWdNQzQxTlRFeE5EUWdNQzQyTlRVME5UbGFUVEF1TkRnM01UY3hJREF1Tmpjek1Ua3pUREF1TkRnME5ESTFJREF1TmpjeE9ESXlRekF1TkRnME16SWdNQzQyTnpFNE1qSWdNQzQwT0RNM09URWdNQzQyTnpJNU9EUWdNQzQwT0RNek55QXdMalkzTkRVeE0wd3dMalE0TURnMk9TQXdMalk0TVRFNU4wd3dMalEzT0Rrek55QXdMalk0TlRVME5VTXdMalEzTnpBNE9TQXdMalk0T1RNNU9DQXdMalEzTlRNME9DQXdMalk1TWpRd09DQXdMalEzTVRnMk15QXdMalk1Tnpjek9VTXdMalEzTVRNek5pQXdMalk1T0RVek1TQXdMalEzTVRRNU15QXdMalk1T0RReU5DQXdMalEzTmpFek9TQXdMalk1TkRjeU9VTXdMalE0TURVM05DQXdMalk1TVRFNU15QXdMalE0T0RFM015QXdMalk0TlRRek9TQXdMalE1TXpFNE55QXdMalk0TVRnMU1Vd3dMalE1TlRJNE15QXdMalk0TURJME4wd3dMalE1TmpBeU15QXdMalkzT1RZeE5Vd3dMalE1TmpJME9DQXdMalkzT1RNeE9FTXdMalE1TXpVMU55QXdMalkzTnpFZ01DNDBPVEExTkRrZ01DNDJOelV3TkRJZ01DNDBPRGN4TnpFZ01DNDJOek14T1ROYVRUQXVOVEF5TWpFMElEQXVOamcxTnpVM1REQXVOVEF5TkRNNElEQXVOamcxT0RNelREQXVOVEF5TnpFZ01DNDJPRFl4TWpOTU1DNDFNRFF4T0RjZ01DNDJPRGd5TkRKTU1DNDFNRFF5TVRrZ01DNDJPRGd5T1VNd0xqVXdOekl5TnlBd0xqWTVNamMzTmlBd0xqVXdPVFUxSURBdU5qazROemswSURBdU5URXdNVE15SURBdU56QXpOalZNTUM0MU1UQXlNemNnTUM0M01EUTNNRGRNTUM0MU1ETXdNRFlnTUM0M01EYzFNRE5ETUM0ME9UQXdOelFnTUM0M01USTFNVGNnTUM0ME56Z3hORFlnTUM0M01UYzBPQ0F3TGpRM01EQTJPQ0F3TGpjeU1URTNNMHd3TGpRMk1USTFOQ0F3TGpjeU5UTTVPRU13TGpRMU9EWTJPQ0F3TGpjeU5qY3hOaUF3TGpRMU5qVTFOaUF3TGpjeU56Y3hPU0F3TGpRMU5qVTFOaUF3TGpjeU56WTJOVXd3TGpRMk1ERTVOeUF3TGpjeU5Ea3lNVU13TGpRM05UazRNU0F3TGpjeE16UTJOeUF3TGpRNE9UWTFNU0F3TGpjd01Ea3dOU0F3TGpRNU9UZzVNU0F3TGpZNE9ETTBORXd3TGpVd01EUTROaUF3TGpZNE56WXpNa3d3TGpVd01qRXdPQ0F3TGpZNE5UYzFOMGd3TGpVd01qSXhORnBOTUM0ME9EUXhNU0F3TGpZNU9EazFNa013TGpRNE5qVXhNU0F3TGpZNU5qVXlJREF1TkRnNU5UWXhJREF1Tmprek1UZzRJREF1TkRreE5qUXlJREF1Tmprd056azBRekF1TkRrek1USTRJREF1TmpnNU1EZzBJREF1TkRrME1USWdNQzQyT0RjNE5TQXdMalE1TkRBek1pQXdMalk0TnpjMk1rTXdMalE1TXpneU1pQXdMalk0TnpVMUlEQXVORGMxT1RJNUlEQXVOams1TmprZ01DNDBOamd4TnlBd0xqY3dOVEk0TjBNd0xqUTJOVEkyTlNBd0xqY3dOek0wTlNBd0xqUTJORGc1TlNBd0xqY3dOemN4TlNBd0xqUTJNamc1TVNBd0xqY3hNRE13TVV3d0xqUTFPRFk0TnlBd0xqY3hOVFUxVERBdU5EVXpOelU0SURBdU56SXhNVEl4VERBdU5EUTVORFk1SURBdU56STFOemswUXpBdU5EUTROakU0SURBdU56STJOek14SURBdU5EUTRNak0ySURBdU56STNNVFk0SURBdU5EUTRNVEUwSURBdU56STNNelF5UXpBdU5EUTRNRE1nTUM0M01qYzBOaklnTUM0ME5EZ3dOeUF3TGpjeU56UTFOaUF3TGpRME9ERTJOQ0F3TGpjeU56UXdNa3d3TGpRME9UWTNOeUF3TGpjeU5qUTBOVXd3TGpRMU1UTXpJREF1TnpJMU16azRRekF1TkRZek9EUWdNQzQzTVRjME9DQXdMalEzTXpreU15QXdMamN3T1RNMU1TQXdMalE0TkRFeElEQXVOams0T1RVeVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI1LjAiIHk9IjE0MC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI2IiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIEZ1bmN0aW9ucyAtPiBNaWNyb3NvZnQgU1FMIFNlcnZlciIgc3R5bGU9ImlyLnJlZj0wZDkxZTY0MC1mODUyLTRjYjEtYWY0OC05MTdlMzMwNjcxZmU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyIiBzb3VyY2U9IjQiIHRhcmdldD0iMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJNaWNyb3NvZnQgQXp1cmUgRnVuY3Rpb25zIiBzdHlsZT0iaXIucmVmPTMzODJmN2M0LWM4OWMtNGRiYS1iZmUyLTViOGNlZTM2MzUzNDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtZnVuY3Rpb25zO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek16TXdNU0F3TGpZNU5qSTBOa3d3TGpNd05qQTVPU0F3TGpjeU16SXpNME13TGpNd016Z3dNeUF3TGpjeU5UVXpOaUF3TGpNd01EWTROeUF3TGpjeU5qZ3pNaUF3TGpJNU56UXpOU0F3TGpjeU5qZ3pOME13TGpJNU5ERTRNeUF3TGpjeU5qZzBNU0F3TGpJNU1UQTJNeUF3TGpjeU5UVTFOQ0F3TGpJNE9EYzJNU0F3TGpjeU16STFPRXd3TGpBNE9EZzJNREVnTUM0MU1qTTVNalJETUM0d09EUXlOak00SURBdU5URTVNelFnTUM0d09ERTJOelkxSURBdU5URXpNVEU1SURBdU1EZ3hOalkzTXlBd0xqVXdOall5T0VNd0xqQTRNVFkxT0RFZ01DNDFNREF4TXpjZ01DNHdPRFF5TWpjNElEQXVORGt6T1RBNUlEQXVNRGc0T0RFeE1TQXdMalE0T1RNeE1rd3dMakV4TlRnMU1pQXdMalEyTWpFNU5Vd3dMak16TXpFeE5TQXdMalkzT0RnME0wTXdMak16TlRReE9DQXdMalk0TVRFek9TQXdMak16TmpjeE5DQXdMalk0TkRJMU5pQXdMak16TmpjeE9TQXdMalk0TnpVd04wTXdMak16TmpjeU15QXdMalk1TURjMU9TQXdMak16TlRRek5pQXdMalk1TXpnM09TQXdMak16TXpFMElEQXVOamsyTVRneFREQXVNek16TURFZ01DNDJPVFl5TkRaYUlpQm1hV3hzUFNJak5UQkZOa1pHSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1ERTRPVFFnTUM0eU9USXhNRFJNTUM0ek1qZzVOemtnTUM0ek1Ua3hNVEpETUM0ek16RXlPRElnTUM0ek1qRTBNRGdnTUM0ek16STFOemdnTUM0ek1qUTFNalVnTUM0ek16STFPRElnTUM0ek1qYzNOelpETUM0ek16STFPRGNnTUM0ek16RXdNamdnTUM0ek16RXpJREF1TXpNME1UUTRJREF1TXpJNU1EQTBJREF1TXpNMk5EVk1NQzR4TVRVMU5qUWdNQzQxTlRBME9USk1NQzR3T0RnME5EWXpJREF1TlRJek5EVXlRekF1TURnek9EVWdNQzQxTVRnNE5qa2dNQzR3T0RFeU5qSTNJREF1TlRFeU5qUTNJREF1TURneE1qVXpOU0F3TGpVd05qRTFOa013TGpBNE1USTBORE1nTUM0ME9UazJOalVnTUM0d09ETTRNVFFnTUM0ME9UTTBNemNnTUM0d09EZ3pPVGMwSURBdU5EZzRPRFJNTUM0eU9EUTJNakVnTUM0eU9USXdOalJETUM0eU9EWTVNak1nTUM0eU9EazNPU0F3TGpJNU1EQXpJREF1TWpnNE5URTRJREF1TWprek1qWTJJREF1TWpnNE5USTFRekF1TWprMk5UQXlJREF1TWpnNE5UTXpJREF1TWprNU5qQXpJREF1TWpnNU9ERTVJREF1TXpBeE9EazBJREF1TWpreU1UQTBWakF1TWpreU1UQTBXaUlnWm1sc2JEMGlJekUwT1RCRVJpSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPRFkzT1RJZ01DNDBOakl4TlRoTU1DNDRPVFE1TWpnZ01DNDBPRGt5TkRORE1DNDRPVGsxTVRJZ01DNDBPVE00TXprZ01DNDVNREl3T0RFZ01DNDFNREF3TmpnZ01DNDVNREl3TnpJZ01DNDFNRFkxTlRsRE1DNDVNREl3TmpNZ01DNDFNVE13TlNBd0xqZzVPVFEzTmlBd0xqVXhPVEkzTWlBd0xqZzVORGczT1NBd0xqVXlNemcxTlV3d0xqWTVORGszT0NBd0xqY3lNekU1TTBNd0xqWTVNalkzTmlBd0xqY3lOVFE0T1NBd0xqWTRPVFUxTmlBd0xqY3lOamMzTmlBd0xqWTROak13TkNBd0xqY3lOamMzTVVNd0xqWTRNekExTWlBd0xqY3lOamMyTnlBd0xqWTNPVGt6TmlBd0xqY3lOVFEzTVNBd0xqWTNOelkwSURBdU56SXpNVFk0VERBdU5qVXdOell4SURBdU5qazJNakV6UXpBdU5qUTRORFkxSURBdU5qa3pPVEV4SURBdU5qUTNNVGM0SURBdU5qa3dOemt4SURBdU5qUTNNVGd5SURBdU5qZzNOVE01UXpBdU5qUTNNVGczSURBdU5qZzBNamczSURBdU5qUTRORGd6SURBdU5qZ3hNVGN4SURBdU5qVXdOemcySURBdU5qYzRPRGMxVERBdU9EWTRNREUzSURBdU5EWXlNalUyVERBdU9EWTNPVElnTUM0ME5qSXhOVGhhSWlCbWFXeHNQU0lqTlRCRk5rWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0T1RVeE55QXdMalV5TXpNMU1rd3dMamcyT0RBNE5TQXdMalUxTURNMk1Vd3dMalkxTkRZME15QXdMak16TmpNeE5rTXdMalkxTWpNME55QXdMak16TkRBeE5DQXdMalkxTVRBMklEQXVNek13T0RrMElEQXVOalV4TURZMUlEQXVNekkzTmpReVF6QXVOalV4TURZNUlEQXVNekkwTXpreElEQXVOalV5TXpZMklEQXVNekl4TWpjMElEQXVOalUwTmpZNElEQXVNekU0T1RjNFREQXVOamd4TnpVeklEQXVNamt4T1RkRE1DNDJPRFF3TlRVZ01DNHlPRGsyTnpRZ01DNDJPRGN4TnpZZ01DNHlPRGd6T0RjZ01DNDJPVEEwTWpjZ01DNHlPRGd6T1RGRE1DNDJPVE0yTnprZ01DNHlPRGd6T1RZZ01DNDJPVFkzT1RVZ01DNHlPRGsyT1RJZ01DNDJPVGt3T1RFZ01DNHlPVEU1T1RSTU1DNDRPVFV6TVRZZ01DNDBPRGczTnpORE1DNDRPVGs0T1RrZ01DNDBPVE16TmprZ01DNDVNREkwTmprZ01DNDBPVGsxT1RnZ01DNDVNREkwTmlBd0xqVXdOakE0T1VNd0xqa3dNalExTVNBd0xqVXhNalU0SURBdU9EazVPRFkwSURBdU5URTRPREF5SURBdU9EazFNalkzSURBdU5USXpNemcxVERBdU9EazFNVGNnTUM0MU1qTXpOVEphSWlCbWFXeHNQU0lqTVRRNU1FUkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTmpjeE9UVWdNQzQxTkRnNU1qbElNQzR6TURJek9UWkRNQzR6TURBd09EUWdNQzQxTkRrd01UZ2dNQzR5T1RjNE1qZ2dNQzQxTkRneE9UZ2dNQzR5T1RZeE1USWdNQzQxTkRZMk5EVkRNQzR5T1RRek9UWWdNQzQxTkRVd09URWdNQzR5T1RNek5UVWdNQzQxTkRJNU1qa2dNQzR5T1RNeU1UTWdNQzQxTkRBMk1UaERNQzR5T1RNeU1UUWdNQzQxTXprME1qRWdNQzR5T1RNME9UY2dNQzQxTXpneU5ESWdNQzR5T1RRd016a2dNQzQxTXpjeE56Uk1NQzQwT1RFMk1qTWdNQzR4TkRZeU16RkRNQzQwT1RJME5qUWdNQzR4TkRRM01UVWdNQzQwT1RNM01EVWdNQzR4TkRNME5Ua2dNQzQwT1RVeU1USWdNQzR4TkRJMk1ERkRNQzQwT1RZM01UZ2dNQzR4TkRFM05ETWdNQzQwT1RnME16RWdNQzR4TkRFek1UVWdNQzQxTURBeE5qUWdNQzR4TkRFek5qUklNQzQyT1RVd09EUkRNQzQyT1Rjek9UY2dNQzR4TkRFeU56WWdNQzQyT1RrMk5UTWdNQzR4TkRJd09UWWdNQzQzTURFek5qa2dNQzR4TkRNMk5EbERNQzQzTURNd09EVWdNQzR4TkRVeU1ESWdNQzQzTURReE1qWWdNQzR4TkRjek5qVWdNQzQzTURReU5qZ2dNQzR4TkRrMk56VkRNQzQzTURReU5USWdNQzR4TlRFek5ERWdNQzQzTURNMk9EY2dNQzR4TlRJNU5UUWdNQzQzTURJMk5qRWdNQzR4TlRReU5qZE1NQzQwTnpBMk16a2dNQzQwTmpBeE1qVklNQzQyT1RZNU1qRkRNQzQyT1RreU16UWdNQzQwTmpBd016WWdNQzQzTURFME9TQXdMalEyTURnMU5pQXdMamN3TXpJd05pQXdMalEyTWpRd09VTXdMamN3TkRreU1pQXdMalEyTXprMk15QXdMamN3TlRrMk1pQXdMalEyTmpFeU5TQXdMamN3TmpFd05TQXdMalEyT0RRek5rTXdMamN3TmpBM0lEQXVORGN3TlRReklEQXVOekExTWpFeklEQXVORGN5TlRVeklEQXVOekF6TnpFM0lEQXVORGMwTURNNFREQXVNekkzTmprM0lEQXVPRFkxTWpFeFF6QXVNekkwTVRZeElEQXVPRFkzTXpJeklEQXVNams1TURRMElEQXVPRGc0TVRZNUlEQXVNekV4TXpVZ01DNDROVFkxTXpKTU1DNDBOamN4T1RVZ01DNDFORGc1TWpsYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gyeHBibVZoY2lJZ2VERTlJakF1TkRrM056Z2lJSGt4UFNJd0xqZzJPRE00SWlCNE1qMGlNQzQwT1RjM09DSWdlVEk5SWpBdU1UTTFOVGt4SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJalJrVkJNVEZDSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVNamcwSWlCemRHOXdMV052Ykc5eVBTSWpSa1ZCTlRGQklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TlRRM0lpQnpkRzl3TFdOdmJHOXlQU0lqUmtWQ01ERTRJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU9DSWdjM1J2Y0MxamIyeHZjajBpSTBaR1F6TXhOQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtaRU56QkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVPRFEyTVRVaUlHaGxhV2RvZEQwaU1DNDVPRFEyTVRFaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0lEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIyMi4wIiB5PSI0OS4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI3My4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IldlYiBDbGllbnQgLT4gTWljcm9zb2Z0IEF6dXJlIEFjdGl2ZSBEaXJlY3RvcnkiIHN0eWxlPSJpci5yZWY9NzRmMTRkMWItYjM5MC00Mjk4LTkxYWYtNzgwZWJmYzMxYTMzO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMiIgc291cmNlPSI3IiB0YXJnZXQ9IjEyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNyIgdmFsdWU9IldlYiBDbGllbnQiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MmRiODc3OGItNDg1Yy00YjA3LWJlNjEtZmY4NjQzNTk3ZWRkOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQwMS4wIiB5PSI4Ni4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFBvd2VyIEJJIiBzdHlsZT0iaXIucmVmPTcyNWE1NGZhLTM0ZjYtNDQxOC1hOTcxLWM5Mzg3ZjIxNzE4ZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtUE9XRVItQkk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTmpjeE5Ea2dNQzR4TURRd01EUklNQzQxTlRZeU1UWkRNQzQxTXpnd056a2dNQzR4TURRd01EUWdNQzQxTWpNek56WWdNQzR4TVRnM01EY2dNQzQxTWpNek56WWdNQzR4TXpZNE5EUldNQzQ0TmpZNE9UVkRNQzQxTWpNek56WWdNQzQ0T0RVd016SWdNQzQxTXpnd056a2dNQzQ0T1RrM016VWdNQzQxTlRZeU1UWWdNQzQ0T1RrM016VklNQzQzTmpjeE5EbERNQzQzT0RVeU9EWWdNQzQ0T1RrM016VWdNQzQzT1RrNU9Ea2dNQzQ0T0RVd016SWdNQzQzT1RrNU9Ea2dNQzQ0TmpZNE9UVldNQzR4TXpZNE5EUkRNQzQzT1RrNU9Ea2dNQzR4TVRnM01EY2dNQzQzT0RVeU9EWWdNQzR4TURRd01EUWdNQzQzTmpjeE5Ea2dNQzR4TURRd01EUmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhaeUJtYVd4MFpYSTlJblZ5YkNnalptbHNkR1Z5TUY5a0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemN3T0RZZ01DNDROalk0TXpsV01DNDRPVGsyTnpoSU1DNDJNRFF5TkRaSU1DNHpPVE16TVRORE1DNHpOelV4TnpjZ01DNDRPVGsyTnpnZ01DNHpOakEwTnpRZ01DNDRPRFE1TnpVZ01DNHpOakEwTnpRZ01DNDROalk0TXpsV01DNHpNelV3T0RaRE1DNHpOakEwTnpRZ01DNHpNVFk1TkRrZ01DNHpOelV4TnpjZ01DNHpNREl5TkRZZ01DNHpPVE16TVRNZ01DNHpNREl5TkRaSU1DNDJNRFF5TkRaRE1DNDJNakl6T0RNZ01DNHpNREl5TkRZZ01DNDJNemN3T0RZZ01DNHpNVFk1TkRrZ01DNDJNemN3T0RZZ01DNHpNelV3T0RaV01DNDROalk0TXpsYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1WOXNhVzVsWVhJcElpOCtKaU40WVRzOEwyYytKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TkRjMk5qZzJJREF1T0RZMk9UYzRWakF1T0RrNU9ERTRTREF1TkRRek9EUTJTREF1TWpNeU9URXpRekF1TWpFME56YzJJREF1T0RrNU9ERTRJREF1TWpBd01EY3pJREF1T0RnMU1URTFJREF1TWpBd01EY3pJREF1T0RZMk9UYzRWakF1TlRNME56a3pRekF1TWpBd01EY3pJREF1TlRFMk5qVTJJREF1TWpFME56YzJJREF1TlRBeE9UVXpJREF1TWpNeU9URXpJREF1TlRBeE9UVXpTREF1TkRRek9EUTJRekF1TkRZeE9UZ3pJREF1TlRBeE9UVXpJREF1TkRjMk5qZzJJREF1TlRFMk5qVTJJREF1TkRjMk5qZzJJREF1TlRNME56a3pWakF1T0RZMk9UYzRXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREpmYkdsdVpXRnlLU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4Wm1sc2RHVnlJR2xrUFNKbWFXeDBaWEl3WDJRaUlIZzlJakF1TXpZd05EYzBJaUI1UFNJdE1DNDJOekEwTlRRaUlIZHBaSFJvUFNJMExqRTJOelF4SWlCb1pXbG5hSFE5SWpRdU5EZzRNak1pSUdacGJIUmxjbFZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJZ1kyOXNiM0l0YVc1MFpYSndiMnhoZEdsdmJpMW1hV3gwWlhKelBTSnpVa2RDSWo0bUkzaGhPenhtWlVac2IyOWtJR1pzYjI5a0xXOXdZV05wZEhrOUlqQWlJSEpsYzNWc2REMGlRbUZqYTJkeWIzVnVaRWx0WVdkbFJtbDRJaTgrSmlONFlUczhabVZEYjJ4dmNrMWhkSEpwZUNCcGJqMGlVMjkxY21ObFFXeHdhR0VpSUhSNWNHVTlJbTFoZEhKcGVDSWdkbUZzZFdWelBTSXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXhNamNnTUNJZ2NtVnpkV3gwUFNKb1lYSmtRV3h3YUdFaUx6NG1JM2hoT3p4bVpVOW1abk5sZENCa2VEMGlNUzQ1TkRVMElpQmtlVDBpTUM0NU56STNJaTgrSmlONFlUczhabVZIWVhWemMybGhia0pzZFhJZ2MzUmtSR1YyYVdGMGFXOXVQU0l3TGprM01qY2lMejRtSTNoaE96eG1aVU52YlhCdmMybDBaU0JwYmpJOUltaGhjbVJCYkhCb1lTSWdiM0JsY21GMGIzSTlJbTkxZENJdlBpWWplR0U3UEdabFEyOXNiM0pOWVhSeWFYZ2dkSGx3WlQwaWJXRjBjbWw0SWlCMllXeDFaWE05SWpBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBdU1EVXpJREFpTHo0bUkzaGhPenhtWlVKc1pXNWtJRzF2WkdVOUltNXZjbTFoYkNJZ2FXNHlQU0pDWVdOclozSnZkVzVrU1cxaFoyVkdhWGdpSUhKbGMzVnNkRDBpWldabVpXTjBNVjlrY205d1UyaGhaRzkzSWk4K0ppTjRZVHM4Wm1WQ2JHVnVaQ0J0YjJSbFBTSnViM0p0WVd3aUlHbHVQU0pUYjNWeVkyVkhjbUZ3YUdsaklpQnBiakk5SW1WbVptVmpkREZmWkhKdmNGTm9ZV1J2ZHlJZ2NtVnpkV3gwUFNKemFHRndaU0l2UGlZamVHRTdQQzltYVd4MFpYSStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXdMalkyTVRZNE15SWdlVEU5SWpBdU1UQTBNREEwSWlCNE1qMGlNQzQyTmpFMk9ETWlJSGt5UFNJd0xqZzVPVGN6TlNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwVkNRa0l4TkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalFqSTFOREF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RnM09DSWdlVEU5SWpBdU16QXlNalEySWlCNE1qMGlNQzQwT1RnM09DSWdlVEk5SWpBdU9EazVOamM0SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJalJqbEZOVGd6SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlORVJUazRNREFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWElpSUhneFBTSXdMak16T0RNM09TSWdlVEU5SWpBdU5UQXhPVFV6SWlCNE1qMGlNQzR6TXpnek56a2lJSGt5UFNJd0xqZzVPVGd4T0NJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwWTVSVFk0UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJqTkRSRE15SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI3NC4wIiB5PSIyMDguMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iODIuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTIiIHZhbHVlPSJNaWNyb3NvZnQgQXp1cmUgQWN0aXZlIERpcmVjdG9yeSIgc3R5bGU9ImlyLnJlZj0wYjdkYjIxZC00NTlhLTRjZDUtODg2Ny00NWVkN2I1Y2RjNDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWFjdGl2ZS1kaXJlY3Rvcnk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TnpBMU5qYzNJREF1TlRjeU5qSTNUREF1TlRBek56azRJREF1T0RVek56ZzRUREF1T1RRME5qZzNJREF1TlRjeE5UTXpUREF1T1RrNU9UTTFJREF1TmpNMk1EaE1NQzQxTURNM09UZ2dNQzQ1TlRVMU16Rk1NQzR3TVRVek1UazRJREF1TmpNMk1EaE1NQzR3TnpBMU5qYzNJREF1TlRjeU5qSTNXaUlnWm1sc2JEMGlJelV3UlRaR1JpSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVEF6TXpNeklEQXVOVE0yTlRaTU1DNDFNRE0zTkRJZ01DNHdOVGsxTnpBelREQXVPVEV5TXpVM0lEQXVOVE0zTVRBM1REQXVOVEF6TnpReUlEQXVOemsxTWprMFREQXVNVEF6TXpNeklEQXVOVE0yTlRaYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRBek56UXlJREF1TURVNU5UY3dNMVl3TGpjNU5USTVORXd3TGpFd016TXpNeUF3TGpVek5qVTJUREF1TlRBek56UXlJREF1TURVNU5UY3dNMW9pSUdacGJHdzlJaU0xTUVVMlJrWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TXpjNE5DQXdMakExT1RVM01ETldNQzQzT1RVeU9UUk1NQzQ1TVRJMElEQXVOVE0zTVRBM1REQXVOVEF6TnpnMElEQXVNRFU1TlRjd00xb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TXpjNE5DQXdMalF6T1RZNU4wd3dMamt4TWpRZ01DNDFNemN3TmpSTU1DNDFNRE0zT0RRZ01DNDNPVFV5TlRGV01DNDBNemsyT1RkYUlpQm1hV3hzUFNJak5UTkNNVVV3SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1ETTNORElnTUM0M09UVXlOVEZNTUM0eE1ETXpNek1nTUM0MU16WTFNVGRNTUM0MU1ETTNORElnTUM0ME16azJPVGRXTUM0M09UVXlOVEZhSWlCbWFXeHNQU0lqT1VORlFrWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURNM09EUWdNQzQ1TlRVMU16Rk1NQzQ1T1RrNU1qRWdNQzQyTXpZd09Fd3dMamswTkRZM015QXdMalUzTVRVek0wd3dMalV3TXpjNE5DQXdMamcxTXpjNE9GWXdMamsxTlRVek1Wb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXhYMnhwYm1WaGNpa2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTUM0M05EQXdPVElpSUhreFBTSXdMamN5TnpRMk5TSWdlREk5SWpBdU5EZzJPREk1SWlCNU1qMGlNQzR5TkRjM05DSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekU1T0RoRU9TSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpraUlITjBiM0F0WTI5c2IzSTlJaU0xTkVGRlJqQWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNVjlzYVc1bFlYSWlJSGd4UFNJd0xqWXpNVEl6TnlJZ2VURTlJakF1TlRnM09UUXpJaUI0TWowaU1DNDRNRFl5TnpraUlIa3lQU0l3TGpnNE9UZzVNU0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMakVpSUhOMGIzQXRZMjlzYjNJOUlpTTFORUZGUmpBaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzR5T1NJZ2MzUnZjQzFqYjJ4dmNqMGlJelJHUVVKRlJTSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpVeElpQnpkRzl3TFdOdmJHOXlQU0lqTkRGQk1rVTVJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU56UWlJSE4wYjNBdFkyOXNiM0k5SWlNeVFUa3pSVEFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDRPQ0lnYzNSdmNDMWpiMnh2Y2owaUl6RTVPRGhFT1NJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRXhJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TVRVek1UazRJREF1TURFMU16Z3dPU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0MzAuMCIgeT0iMjI0LjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTE1MC4wIiB5PSI1OTAuMCIgYXM9InRhcmdldFBvaW50Ii8+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xODEuMCIgeT0iNTczLjAiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNTQzLjAiIHk9IjIyNC4wIiB3aWR0aD0iNTM5LjAiIGhlaWdodD0iMTgwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwIiB2YWx1ZT0iTVFUVCBDbGllbnQiIHN0eWxlPSJpci5yZWY9N2Y5ZTA2NzYtZjllYy00MDNiLWIwYzYtN2RkZTZjYWE2MWEwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1xdHQtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0kyTkNJZ2FHVnBaMmgwUFNJMk5DSWdkbWxsZDBKdmVEMGlNQ0F3SURZMElEWTBJaUJtYVd4c1BTSnViMjVsSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk5ERXVNekEyTlNBeU1DNDNPVEF5VERNNExqSXdOallnTWpVdU5EZ3hNVU16T1M0NU1UazJJREkzTGpFeE16RWdOREF1T1Rrd05pQXlPUzQwTVRReElEUXdMams1T1RZZ016RXVPVFkzTVV3ME5DNDFNRGsySURNeUxqVTNNekZETkRVdU1EazVJRE14TGpJek55QTBOaTR4TlRVMElETXdMakUyTVRZZ05EY3VORGd3T0NBeU9TNDFORGczUXpRNExqZ3dOak1nTWpndU9UTTFOeUExTUM0ek1EazRJREk0TGpneU56SWdOVEV1TnpBNU5TQXlPUzR5TkRNMFF6VXpMakV3T1RNZ01qa3VOalU1TnlBMU5DNHpNRGt5SURNd0xqVTNNakVnTlRVdU1EZzBNeUF6TVM0NE1EazRRelUxTGpnMU9UUWdNek11TURRM05DQTFOaTR4TlRZMklETTBMalV5TlRNZ05UVXVPVEl3TVNBek5TNDVOall6UXpVMUxqWTRNelVnTXpjdU5EQTNOQ0ExTkM0NU1qazJJRE00TGpjeE1qY2dOVE11TnprNU5TQXpPUzQyTXpjMlF6VXlMalkyT1RRZ05EQXVOVFl5TlNBMU1TNHlOREE0SURReExqQTBNellnTkRrdU56Z3hOQ0EwTUM0NU9UQTJRelE0TGpNeU1qRWdOREF1T1RNM05TQTBOaTQ1TXpJeElEUXdMak0xTkRFZ05EVXVPRGN5TWlBek9TNHpORGsyUXpRMExqZ3hNaklnTXpndU16UTFNU0EwTkM0eE5UUTVJRE0yTGprNE9EVWdORFF1TURJek5pQXpOUzQxTXpReFREUXdMalV4TXpZZ016UXVPVEk0TVVNek9TNDNOekEzSURNM0xqQTNPVFVnTXpndU1qUXlPQ0F6T0M0NE56RWdNell1TWpNMU5pQXpPUzQ1TkRReFRETTNMalUyTnpZZ05EUXVNREUxTVVNek9TNHdNalF5SURRekxqa3hNRElnTkRBdU5EWTVJRFEwTGpNME1ESWdOREV1TmpNeE1pQTBOUzR5TWpRMFF6UXlMamM1TXpRZ05EWXVNVEE0TmlBME15NDFPVE16SURRM0xqTTROak1nTkRNdU9EZ3dPU0EwT0M0NE1UaERORFF1TVRZNE5TQTFNQzR5TkRrM0lEUXpMamt5TkNBMU1TNDNNemN5SURRekxqRTVNelFnTlRNdU1EQXhOa00wTWk0ME5qSTNJRFUwTGpJMk5pQTBNUzR5T1RZZ05UVXVNakl3TlNBek9TNDVNVEU1SURVMUxqWTROak5ETXpndU5USTNPU0ExTmk0eE5USWdNemN1TURJeE5DQTFOaTR3T1RjZ016VXVOamMxSURVMUxqVXpNVFZETXpRdU16STROaUExTkM0NU5qWWdNek11TWpNME55QTFNeTQ1TWpnNUlETXlMalU1T0RJZ05USXVOakUwTmtNek1TNDVOakUzSURVeExqTXdNRE1nTXpFdU9ESTJOU0EwT1M0M09UZzVJRE15TGpJeE56Y2dORGd1TXpreVF6TXlMall3T1NBME5pNDVPRFV4SURNekxqVWdORFV1TnpZNU1TQXpOQzQzTWpNMklEUTBMamszTWpGTU16TXVNemc0TmlBME1DNDRPVEl4UXpNeExqYzJOVElnTkRFdU1UUTJOaUF6TUM0eE1ETWdOREF1T1RVeE1TQXlPQzQxT0RJNUlEUXdMak15TjBNeU55NHdOakk0SURNNUxqY3dNamtnTWpVdU56UXlPQ0F6T0M0Mk56TTVJREkwTGpjMk5qWWdNemN1TXpVeU1Vd3hPUzQ0TmpFMklETTVMamN4TmpGRE1qQXVNVGMxTVNBME1TNHhOREkwSURFNUxqazFOellnTkRJdU5qTTBNU0F4T1M0eU5EazVJRFF6TGpreE1UVkRNVGd1TlRReU15QTBOUzR4T0RrZ01UY3VNemt6SURRMkxqRTJORFVnTVRZdU1ERTNOU0EwTmk0Mk5UVXlRekUwTGpZME1qRWdORGN1TVRRMU9TQXhNeTR4TXpRNUlEUTNMakV4T0RFZ01URXVOemM0TkNBME5pNDFOemRETVRBdU5ESXlJRFEyTGpBek5Ua2dPUzR6TURrME9DQTBOUzR3TVRnM0lEZ3VOalE1TXprZ05ETXVOekUyTVVNM0xqazRPVEk1SURReUxqUXhNelFnTnk0NE1qWTVOU0EwTUM0NU1UUTNJRGd1TVRreU9DQXpPUzQxTURBNVF6Z3VOVFU0TmpVZ016Z3VNRGczTVNBNUxqUXlOelUySURNMkxqZzFOVE1nTVRBdU5qTTJOeUF6Tmk0d016WXpRekV4TGpnME5UZ2dNelV1TWpFM015QXhNeTR6TVRJeElETTBMamcyTnpRZ01UUXVOell3TnlBek5TNHdOVEl5UXpFMkxqSXdPVE1nTXpVdU1qTTNJREUzTGpVME1EZ2dNelV1T1RRek9DQXhPQzQxTURVMklETTNMakEwTURGTU1qTXVOREEwTmlBek5DNDJOemt4UXpJeUxqa3pPVFVnTXpNdU1UZzJPU0F5TWk0NE56RXhJRE14TGpVNU9UUWdNak11TWpBMk1pQXpNQzR3TnpJNFF6SXpMalUwTVRNZ01qZ3VOVFEyTWlBeU5DNHlOamd6SURJM0xqRXpNeklnTWpVdU16RTFOaUF5TlM0NU56TXhUREl5TGpVeE1EWWdNakl1TkRVeE1VTXlNUzR4T0RReElESXpMakEyTVRnZ01Ua3VOamd3TXlBeU15NHhOamMzSURFNExqSTRNVE1nTWpJdU56UTRPVU14Tmk0NE9ESXpJREl5TGpNek1ESWdNVFV1Tmpnek9TQXlNUzQwTVRVMklERTBMamt4TVNBeU1DNHhOelkyUXpFMExqRXpPQ0F4T0M0NU16YzJJREV6TGpnME16VWdNVGN1TkRVNU1pQXhOQzR3T0RJMklERTJMakF4T0RWRE1UUXVNekl4TnlBeE5DNDFOemM1SURFMUxqQTNPQ0F4TXk0eU56TTVJREUyTGpJd09UY2dNVEl1TXpVeFF6RTNMak0wTVRVZ01URXVOREk0SURFNExqYzNNU0F4TUM0NU5EazJJREl3TGpJek1ETWdNVEV1TURBMU1rTXlNUzQyT0RrMUlERXhMakEyTURrZ01qTXVNRGM0TlNBeE1TNDJORFk0SURJMExqRXpOallnTVRJdU5qVXpNME15TlM0eE9UUTRJREV6TGpZMU9UY2dNalV1T0RRNU5pQXhOUzR3TVRjMUlESTFMamszT0RNZ01UWXVORGN5TWtNeU5pNHhNRGNnTVRjdU9USTJPU0F5TlM0M01EQTNJREU1TGpNM09EVWdNalF1T0RNMU5pQXlNQzQxTlRVeFRESTNMalkyTnpZZ01qUXVNVEV3TVVNeU9DNDVOVEUySURJekxqUXdNakVnTXpBdU5ESTNOaUF5TXk0d01EQXhJRE14TGprNU9UWWdNak11TURBd01VTXpNeTR6TWpVMklESXpMakF3TURFZ016UXVOVGcxTmlBeU15NHlPRGd4SURNMUxqY3hPVFlnTWpNdU9EQTBNVXd6T0M0Mk1UazJJREU1TGpReE5UWkRNemt1TkRJeU15QXlNQzR3TVRVeElEUXdMak15T0RVZ01qQXVORGd6T0NBME1TNHpNRFkxSURJd0xqYzVNREphVFRJeUxqRXlNRGtnTVRrdU1USXhORU15TVM0MU5UZ3pJREU1TGpZNE5DQXlNQzQzT1RVeklESXdMakF3TURFZ01Ua3VPVGs1TmlBeU1DNHdNREF4UXpFNUxqSXdOQ0F5TUM0d01EQXhJREU0TGpRME1Ea2dNVGt1TmpnMElERTNMamczT0RNZ01Ua3VNVEl4TkVNeE55NHpNVFUzSURFNExqVTFPRGdnTVRZdU9UazVOaUF4Tnk0M09UVTNJREUyTGprNU9UWWdNVGN1TURBd01VTXhOaTQ1T1RrMklERTJMakl3TkRRZ01UY3VNekUxTnlBeE5TNDBOREUwSURFM0xqZzNPRE1nTVRRdU9EYzRPRU14T0M0ME5EQTVJREUwTGpNeE5qSWdNVGt1TWpBMElERTBMakF3TURFZ01Ua3VPVGs1TmlBeE5DNHdNREF4UXpJd0xqYzVOVE1nTVRRdU1EQXdNU0F5TVM0MU5UZ3pJREUwTGpNeE5qSWdNakl1TVRJd09TQXhOQzQ0TnpnNFF6SXlMalk0TXpVZ01UVXVORFF4TkNBeU1pNDVPVGsySURFMkxqSXdORFFnTWpJdU9UazVOaUF4Tnk0d01EQXhRekl5TGprNU9UWWdNVGN1TnprMU55QXlNaTQyT0RNMUlERTRMalUxT0RnZ01qSXVNVEl3T1NBeE9TNHhNakUwV2swek5pNHlOREl5SURNMkxqSTBNamRETXpVdU1URTNJRE0zTGpNMk56a2dNek11TlRrd09TQXpPQzR3TURBeElETXhMams1T1RZZ016Z3VNREF3TVVNek1DNDBNRGd6SURNNExqQXdNREVnTWpndU9EZ3lNaUF6Tnk0ek5qYzVJREkzTGpjMU55QXpOaTR5TkRJM1F6STJMall6TVRjZ016VXVNVEUzTlNBeU5TNDVPVGsySURNekxqVTVNVFFnTWpVdU9UazVOaUF6TWk0d01EQXhRekkxTGprNU9UWWdNekF1TkRBNE9DQXlOaTQyTXpFM0lESTRMamc0TWpjZ01qY3VOelUzSURJM0xqYzFOelJETWpndU9EZ3lNaUF5Tmk0Mk16SXlJRE13TGpRd09ETWdNall1TURBd01TQXpNUzQ1T1RrMklESTJMakF3TURGRE16TXVOVGt3T1NBeU5pNHdNREF4SURNMUxqRXhOeUF5Tmk0Mk16SXlJRE0yTGpJME1qSWdNamN1TnpVM05FTXpOeTR6TmpjMUlESTRMamc0TWpjZ016Y3VPVGs1TmlBek1DNDBNRGc0SURNM0xqazVPVFlnTXpJdU1EQXdNVU16Tnk0NU9UazJJRE16TGpVNU1UUWdNemN1TXpZM05TQXpOUzR4TVRjMUlETTJMakkwTWpJZ016WXVNalF5TjFwTk1UWXVNVEl3T1NBek9DNDROemc0UXpFMkxqWTRNelVnTXprdU5EUXhOQ0F4Tmk0NU9UazJJRFF3TGpJd05EUWdNVFl1T1RrNU5pQTBNUzR3TURBeFF6RTJMams1T1RZZ05ERXVOemsxTnlBeE5pNDJPRE0xSURReUxqVTFPRGdnTVRZdU1USXdPU0EwTXk0eE1qRTBRekUxTGpVMU9ETWdORE11TmpnMElERTBMamM1TlRNZ05EUXVNREF3TVNBeE15NDVPVGsySURRMExqQXdNREZETVRNdU1qQTBJRFEwTGpBd01ERWdNVEl1TkRRd09TQTBNeTQyT0RRZ01URXVPRGM0TXlBME15NHhNakUwUXpFeExqTXhOVGNnTkRJdU5UVTRPQ0F4TUM0NU9UazJJRFF4TGpjNU5UY2dNVEF1T1RrNU5pQTBNUzR3TURBeFF6RXdMams1T1RZZ05EQXVNakEwTkNBeE1TNHpNVFUzSURNNUxqUTBNVFFnTVRFdU9EYzRNeUF6T0M0NE56ZzRRekV5TGpRME1Ea2dNemd1TXpFMk1TQXhNeTR5TURRZ016Z3VNREF3TVNBeE15NDVPVGsySURNNExqQXdNREZETVRRdU56azFNeUF6T0M0d01EQXhJREUxTGpVMU9ETWdNemd1TXpFMk1TQXhOaTR4TWpBNUlETTRMamczT0RoYVRUUXdMakV5TURrZ05EY3VPRGM0T0VNME1DNDJPRE0xSURRNExqUTBNVFFnTkRBdU9UazVOaUEwT1M0eU1EUTBJRFF3TGprNU9UWWdOVEF1TURBd01VTTBNQzQ1T1RrMklEVXdMamM1TlRjZ05EQXVOamd6TlNBMU1TNDFOVGc0SURRd0xqRXlNRGtnTlRJdU1USXhORU16T1M0MU5UZ3pJRFV5TGpZNE5DQXpPQzQzT1RVeklEVXpMakF3TURFZ016Y3VPVGs1TmlBMU15NHdNREF4UXpNM0xqSXdOQ0ExTXk0d01EQXhJRE0yTGpRME1Ea2dOVEl1TmpnMElETTFMamczT0RNZ05USXVNVEl4TkVNek5TNHpNVFUzSURVeExqVTFPRGdnTXpRdU9UazVOaUExTUM0M09UVTNJRE0wTGprNU9UWWdOVEF1TURBd01VTXpOQzQ1T1RrMklEUTVMakl3TkRRZ016VXVNekUxTnlBME9DNDBOREUwSURNMUxqZzNPRE1nTkRjdU9EYzRPRU16Tmk0ME5EQTVJRFEzTGpNeE5qRWdNemN1TWpBMElEUTNMakF3TURFZ016Y3VPVGs1TmlBME55NHdNREF4UXpNNExqYzVOVE1nTkRjdU1EQXdNU0F6T1M0MU5UZ3pJRFEzTGpNeE5qRWdOREF1TVRJd09TQTBOeTQ0TnpnNFdrMDFNaTR4TWpBNUlETTNMakV5TVRSRE5URXVOVFU0TXlBek55NDJPRFFnTlRBdU56azFNeUF6T0M0d01EQXhJRFE1TGprNU9UWWdNemd1TURBd01VTTBPUzR5TURRZ016Z3VNREF3TVNBME9DNDBOREE1SURNM0xqWTROQ0EwTnk0NE56Z3pJRE0zTGpFeU1UUkRORGN1TXpFMU55QXpOaTQxTlRnNElEUTJMams1T1RZZ016VXVOemsxTnlBME5pNDVPVGsySURNMUxqQXdNREZETkRZdU9UazVOaUF6TkM0eU1EUTBJRFEzTGpNeE5UY2dNek11TkRReE5DQTBOeTQ0TnpneklETXlMamczT0RoRE5EZ3VORFF3T1NBek1pNHpNVFl4SURRNUxqSXdOQ0F6TWk0d01EQXhJRFE1TGprNU9UWWdNekl1TURBd01VTTFNQzQzT1RVeklETXlMakF3TURFZ05URXVOVFU0TXlBek1pNHpNVFl4SURVeUxqRXlNRGtnTXpJdU9EYzRPRU0xTWk0Mk9ETTFJRE16TGpRME1UUWdOVEl1T1RrNU5pQXpOQzR5TURRMElEVXlMams1T1RZZ016VXVNREF3TVVNMU1pNDVPVGsySURNMUxqYzVOVGNnTlRJdU5qZ3pOU0F6Tmk0MU5UZzRJRFV5TGpFeU1Ea2dNemN1TVRJeE5Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5ORFFnTWpFdU1UazVPVU0wT0M0NU56QTJJREl4TGpFNU9Ua2dOVE1nTVRjdU1UY3dOU0ExTXlBeE1pNHlRelV6SURjdU1qSTVNemtnTkRndU9UY3dOaUF6TGpFNU9UazFJRFEwSURNdU1UazVPVFZETXprdU1ESTVOQ0F6TGpFNU9UazFJRE0xSURjdU1qSTVNemtnTXpVZ01USXVNa016TlNBeE55NHhOekExSURNNUxqQXlPVFFnTWpFdU1UazVPU0EwTkNBeU1TNHhPVGs1V2swek9TNDRJRGt1TmpjNU9UWkRNemt1T0NBNExqYzFNakV5SURRd0xqVTFNaklnTnk0NU9UazVOaUEwTVM0ME9DQTNMams1T1RrMlNEUTJMalV5UXpRM0xqUTBOemdnTnk0NU9UazVOaUEwT0M0eUlEZ3VOelV5TVRJZ05EZ3VNaUE1TGpZM09UazJWakV6TGpBMFF6UTRMaklnTVRNdU9UWTNPQ0EwTnk0ME5EYzRJREUwTGpjeUlEUTJMalV5SURFMExqY3lTRFEwTGpVME56Sk1OREl1TVRNeklERTJMak15T1RSRE5ESXVNREEwTVNBeE5pNDBNVFV6SURReExqZ3pPRFFnTVRZdU5ESXpOQ0EwTVM0M01ERTRJREUyTGpNMU1ETkROREV1TlRZMU15QXhOaTR5TnpjeUlEUXhMalE0SURFMkxqRXpORGtnTkRFdU5EZ2dNVFV1T1RoV01UUXVOekpETkRBdU5UVXlNaUF4TkM0M01pQXpPUzQ0SURFekxqazJOemdnTXprdU9DQXhNeTR3TkZZNUxqWTNPVGsyV2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzMi4wIiB5PSIzNy4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTI1OC4wIiB5PSIzNTYuMCIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iLTI2My4wIiB5PSI1MDcuMCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets>
-    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="Microsoft Azure Functions -&gt; Microsoft SQL Server" ref="0d91e640-f852-4cb1-af48-917e330671fe" source="7ea65cc3-7318-4575-96b2-20d7ef22b32d" target="1de050a1-bf02-45ee-b386-bb404f067e9f">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Client -&gt; Microsoft Azure Active Directory" ref="74f14d1b-b390-4298-91af-780ebfc31a33" source="4146a845-163b-4da1-8a49-7e4081ae6ce9" target="f6372a8d-42ab-4572-80a1-edd76f49b5d1">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="6c5a8227-71d8-4261-bbf7-9b8397cd9520" diagramComponentId="7f9e0676-f9ec-403b-b0c6-7dde6caa61a0" ref="a5e77e93-52aa-43c6-b3e5-6f2ecfcbfe77" name="MQTT Client" desc="" library="" parentComponentRef="" componentDefinitionRef="mqtt-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="auth-cred-client-unprotected" name="Authentication credentials unprotected on the client side" state="0" impact="100" issueId="" issueLink="">
-          <desc>Client side has insufficiently protected credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.&amp;nbsp;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.629">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="mqtt-client-dos" name="MQTT client does not present  protective measures against denial-of-service (DoS) attacks" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                    MQTT client does not have measures to protect from excessively high message frequency on subscribed topics. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.629">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="mqtt-client-authz" name="MQTT client don't authorize commands coming from IoT applications" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="enforce-app-id-validation-mqtt-client" name="Enforce Application ID validation in the MQTT client" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    Application ID validation is an extra level of security between the IoT application and the device to ensure that no fake application can send commands to the device. This mechanism can be used both as startup security and as a communication security mechanism. By using this scheme, the device stores the unique ID of the IoT application and validates it when it processes the commands that are coming from the IoT application. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    If the IoT application sends an invalid unique ID with a command, the command is ignored by the device. If the device has storage capability, the IoT application unique ID can be encrypted and stored. In that case, the unique ID request is not necessary after every restart. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Enforce Application ID validation in the MQTT client 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Securing IoT devices and gateways" url="https://developer.ibm.com/technologies/iot/articles/iot-trs-secure-iot-solutions1/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="input-val-mqtt-clients" name="Implement Input Validation on MQTT clients" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    It's a good pattern to always validate inputs, no matter how trusted the environment is. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Your MQTT clients should at least validate the following: 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;ul&gt; 
-                    &lt;li&gt;&lt;b&gt;MQTT topics&lt;/b&gt;: Did the client receive messages on topics the client did not subscribe to? In such a case your application should ignore the message. If you are using wildcard subscriptions, only process messages on topics you know the client can interpret.&lt;/li&gt; 
-                    &lt;li&gt;&lt;b&gt;MQTT message payload&lt;/b&gt;: The payload of MQTT messages is always binary. The structure of the data in the payload is typically defined on the application level. Always make sure you can parse the actual message. So if you are expecting a JSON payload but the actual payload is in XML, your parser will probably have a hard time interpreting the messages. So always validate if your application can handle the input, otherwise malicious MQTT clients could craft MQTT packets that your subscribers can't handle.&lt;/li&gt; 
-                    &lt;/ul&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Your MQTT Applications: Are they resilient enough?" url="https://www.hivemq.com/blog/are-your-mqtt-applications-resilient-enough/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.812">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="mqtt-client-throttling" name="Implement MQTT throttling on the client-side" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Most MQTT client applications are not designed for handling huge amounts of MQTT messages per second. It's important to know your client's load limitations and then throttle the message ingestion rate to a limit that doesn't overwhelm your client. Such an implementation typically stops to read from the socket as soon as a specific bytes per second or messages per second rate threshold is exceeded. So even if the broker tries to send lots of messages, TCP backpressure mechanisms take effect and your client won't be overwhelmed. If this is not possible with your client library, you should think about implementing load shedding, which means you throw away messages that you can't handle. This is not optimal but certainly better than constantly crashing your client. 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Throttle the message ingestion rate to a limit that doesn't overwhelm your client. 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Throttling MQTT Data" url="https://mqtt.cool/throttling-mqtt-data/"/>
-            <reference name="Your MQTT Applications: Are they resilient enough?" url="https://www.hivemq.com/blog/are-your-mqtt-applications-resilient-enough/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="limit-mqtt-messages-sizes" name="Set a limit for MQTT message sizes" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    MQTT defines a maximum message size of 256MB. In most MQTT deployment scenarios, messages are often smaller than a kilobyte. If you are familiar with your usage scenario and you know the maximum message size that can occur, it makes sense to decrease the maximum allowed message size to that limit. If no limit is set, it is possible for malicious MQTT clients to send large messages (which can result in excessive memory consumption and unneeded bandwidth usage). 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Limit the maximum message size on a global and per-client basis. 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
-                        &lt;ul&gt; 
-                        &lt;li&gt;Use a client to send and receive data over MQTT.&lt;br&gt;&lt;/li&gt; 
-                        &lt;li&gt;Increase the message size of the data in a development/testing environment to test the presence of maximum message size thresholds. &lt;br&gt;&lt;/li&gt; 
-                        &lt;li&gt;Verify that when the MQTT broker receives a message that exceeds that threshold, it drops the packet.&lt;/li&gt; 
-                        &lt;/ul&gt; 
-                        &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
-              <output/>
-            </source>
-            <references>
-              <reference name="MQTT Client and Mosquitto Broker Message Restrictions" url="https://www.ibm.com/docs/en/mapms/1_cloud?topic=messaging-restrictions-limitations"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="irrevocable-secure-boot" name="The product's processor system has an irrevocable Secure Boot process" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    The product's processor system has an irrevocable Secure Boot process, to provide assurance that it's running code that hasn't been compromised. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Rationale:&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Secure boot is a UEFI (Unified Extensible Firmware Interface) process where the Operating System boot images and code are authenticated against the hardware before they are allowed to be used in the boot process. This way, it ensures that the boot and Operating System software is the intended manufacturer version and hasn't been tampered by malware or other malicious third parties. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;div&gt;
-                    In essence, the manufacturer stores their private key very securely and never reveals it to anyone. When a device is manufactured, the public key associated with the private key is placed in secure storage on the device. The bootloader code is developed using a secure development process and then a cryptographic hash of it is digitally signed with the manufacturer's private key. Whenever bootloader firmware is to be installed on the device, the hash signature is checked against the embedded public key on the device to confirm that it is a genuine hash value from that manufacturer. The firmware code is then hashed again and compared with the signed hash. If this matches (which indicates the firmware code hasn't been altered), only then will the new firmware get installed. 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Thereafter, whenever the device boots, the installed bootloader is again verified before being allowed to run. Cryptographic functions for these purposes and storage of keys can be provided by dedicated chips or modules such a Secure Access Modules (SAM) or Trusted Platform Modules (TPM). 
-                    &lt;/div&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation:&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    The product's processor system has to be set up beforehand in such a way that it only authenticates code generated using trusted security credentials. 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Device Secure Boot" url="https://www.iotsecurityfoundation.org/best-practice-guide-articles/device-secure-boot/"/>
-            <reference name="Secure boot" url="https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot"/>
-            <reference name="The whys and hows of secure boot" url="https://www.embedded.com/the-whys-and-hows-of-secure-boot/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="data-integrity-checks" name="Use data integrity checks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    Use data integrity checks with stamps as a good addition to message encryption. Even if the attacker can decrypt the message (and encrypt it after modification), the integrity check still fails if the message was altered. Especially if you use MQTT without TLS, data integrity checks add an additional layer of security. 
-                    &lt;br&gt; 
-                    &lt;br&gt;MQTT PUBLISH packets can contain a digital signature/MAC/checksum that verifies the contents of the packet. This calculated stamp is typically added to the payload (for example, at the beginning of the payload). The receiver of the packet can verify the integrity of the data by recalculating/validating the stamp. This validation assures that the message was not tampered with by a malicious third party. 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Use data integrity checks with stamps. 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="MQTT Message Data Integrity - MQTT Security Fundamentals" url="https://www.hivemq.com/blog/mqtt-security-fundamentals-mqtt-message-data-integrity/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
-                        &lt;li&gt;Review the project documentation and use exploratory testing looking for parts of the application/system (components i.e. For example, input fields, databases or logs) that move, store or handle data/information.&lt;/li&gt; 
-                        &lt;li&gt;For each identified component determine what type of data/information is logically acceptable and what types the application/system should guard against. Also, consider who according to the business logic is allowed to insert, update and delete data/information and in each component.&lt;/li&gt; 
-                        &lt;li&gt;Attempt to insert, update or edit delete the data/information values with invalid data/information into each component (i.e. input, database, or log) by users that should not be allowed per the business logic workflow.&lt;/li&gt; 
-                        &lt;/ul&gt; 
-                        &lt;br&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test Integrity Checks" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/03-Test_Integrity_Checks"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="iot-hardware-protect-creds" name="Use hardware security solutions to protect sensitive information on IoT devices" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>IoT devices need an efficient secure processor to store its identity and handle authentication, and to store public and private encryption keys, and to store keys and run hashing algorithms for verifying software signatures to be able to verify software signatures. 
-                    &lt;div&gt; 
-                    &lt;div&gt;
-                    Likely candidates for hardware security solutions to protect sensitive data in IoT devices include PUF (Physically Unclonable Functions), TPM (Trusted Platform Module), HSM (Hardware Security Module) and TrustZone.&amp;nbsp; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;ul&gt; 
-                    &lt;li&gt; PUF uses random patterns in the silicon to differentiate chips from each other and creates a unique random number. This generated random number is used to seed a strong device ID and cryptographic keys to create a hardware root of trust.&lt;/li&gt; 
-                    &lt;li&gt;Security co-processors are physically separate chips offering true isolation of private keys. A TPM offers isolation and facilities for the secure generation of cryptographic keys, and limitation of their use, and true random number generation. It also includes capabilities such as remote attestation and sealed storage. However, these powerful security capabilities come at price, usually moving deployment to higher end IoT devices.&amp;nbsp;&lt;/li&gt; 
-                    &lt;li&gt;A Hardware Security Module (HSM) is another physically separate chip and likely at a lower cost compared to a TPM. Like the TPM, it safeguards and manages digital keys for strong authentication and provides crypto processing. An HSM traditionally comes in the form of a large plug-in card or a separate external device attaching to the protected device, making it somewhat less suited to an IoT device. Depending upon the perceived and likely threat vectors, an HSM may provide an effective solution.&lt;/li&gt; 
-                    &lt;li&gt;Trust Zone is another single chip solution segregating execution space into secure and insecure worlds. Insecure apps are not allowed to access security-critical assets. Those same security critical assets are isolated from tampering. Like a TPM, cost moves it to higher-end devices.&lt;/li&gt; 
-                    &lt;/ul&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Use&amp;nbsp;hardware security solutions (like PUF, TPM, HSM or Trust Zone) to protect sensitive data in IoT devices. 
-                    &lt;/div&gt; 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Device security" url="https://cloud.google.com/iot/docs/concepts/device-security"/>
-            <reference name="Protecting the IoT with Secure Hardware" url="https://www.digikey.com/en/articles/techzone/2017/mar/protecting-the-iot-with-secure-hardware"/>
-            <reference name="Securing Edge Nodes" url="https://realtimelogic.com/downloads/docs/IoT-Security-Solutions.pdf"/>
-            <reference name="What is an IoT Hardware Secure Element?" url="https://cerberus-laboratories.com/blog/iot_hsms/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="mqtt-payload-encryption" name="Use MQTT payload encryption" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                    TLS provides security on the network layer while MQTT payload encryption provides security on the application layer, so they can be used in conjunction without conflict. MQTT payload encryption only solves the problem of protecting application messages from eavesdroppers or untrusted MQTT clients (if no authentication mechanism is in place). An attacker can still replay the message or modify parts of the message, such as the topic, if there is no secure communication channel over TLS. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    MQTT Payload encryption is the encryption of application-specific data on the application level (typically, the MQTT PUBLISH packet payload or the CONNECT LWT payload). This approach allows end-to-end encryption of application data even on untrusted environments. While the message metadata such as the MQTT Topic stays intact, the payload of the message gets encrypted. This type of encryption is not defined in the MQTT specification and is completely application specific. 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Only the payload data (private sensor information) of the message needs to be encrypted. The message fields of MQTT PUBLISH messages are not changed. The payload information is binary, so no special encoding mechanism is required while it transmits the message. Also, no specific changes are required on the broker side because the MQTT message format remains the same. Only the application that is interpreting the message payload needs to decrypt the message to understand the content. 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Advantages of Payload Encryption: 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;ul&gt; 
-                    &lt;li&gt;Complete end-to-end message security.&lt;/li&gt; 
-                    &lt;li&gt;Adds another layer of security for applications that are transmitting highly sensitive data.&lt;/li&gt; 
-                    &lt;li&gt;Appropriate in situations where TLS cannot be used.&lt;br&gt;&lt;/li&gt; 
-                    &lt;/ul&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Disadvantages of Payload Encryption: 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;ul&gt; 
-                    &lt;li&gt;Might not be possible to implement in devices with very low resources.&lt;/li&gt; 
-                    &lt;li&gt;Messages can still be modified by attacker if a secured communication channel is not used.&lt;br&gt; &lt;/li&gt; 
-                    &lt;/ul&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;br&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt; 
-                    &lt;b&gt;Remediation&lt;/b&gt; 
-                    &lt;/div&gt; 
-                    &lt;div&gt;
-                    Use payload encryption if you can't use TLS but still don't want to send your application data in plain text. Payload encryption provides an additional layer of security since all your application data is secured. 
-                    &lt;br&gt; 
-                    &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Securing IoT data over the network" url="https://developer.ibm.com/technologies/iot/articles/iot-trs-secure-iot-solutions2/"/>
-            <reference name="Securing MQTT Systems - MQTT Security Fundamentals" url="https://www.hivemq.com/blog/mqtt-security-fundamentals-payload-encryption/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
-                        &lt;ul&gt; 
-                        &lt;li&gt;Use a standard packet sniffing tool such as Wireshark to inspect MQTT traffic.&lt;/li&gt; 
-                        &lt;/ul&gt; 
-                        &lt;/div&gt; 
-                        &lt;div&gt; 
-                        &lt;ul&gt; 
-                        &lt;li&gt;Check that MQTT PUBLISH messages are encrypted (not visible in clear text).&lt;/li&gt; 
-                        &lt;/ul&gt; 
-                        &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.815">
-              <output/>
-            </source>
-            <references>
-              <reference name="Examination of vulnerabilities in Message Queuing Telemetry Transport (MQTT) in IoT Systems and implementation of countermeasures" url="https://www.researchgate.net/publication/338335323_Examination_of_vulnerabilities_in_Message_Queuing_Telemetry_Transport_MQTT_in_IoT_Systems_and_implementation_of_countermeasures"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.7.13" name="Where the MQTT protocol is used, it is protected by a TLS connection with no known cipher vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt; 
-                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; &lt;span class="caps"&gt;MQTT&lt;/span&gt; (Message Queue Telemetry Transport), is a very lightweight and widely used messaging and information exchange protocol for IoT devices throughout the world. The &lt;span class="caps"&gt;MQTT&lt;/span&gt; communication can be encrypted using &lt;span class="caps"&gt;TLS&lt;/span&gt; / &lt;span class="caps"&gt;SSL&lt;/span&gt; protocols, ensuring a secure and safe communication.&lt;/p&gt; 
-                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="MQTT Version 3.1.1 Plus Errata 01" url="https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/mqtt-v3.1.1.html"/>
-            <reference name="MQTT and CoAP, IoT Protocols" url="https://www.eclipse.org/community/eclipse_newsletter/2014/february/article2.php"/>
-          </references>
-          <standards>
-            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.815">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION AND AUTHORIZATION" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="mqtt-client-fake-app" name="An attacker can simulate a fake application to send commands to the MQTT client" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An attacker can simulate a fake application to send commands to the MQTT client to get sensitive data or to change their configuration.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="mqtt-client-authz">
-                  <countermeasures>
-                    <countermeasure ref="enforce-app-id-validation-mqtt-client" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="enforce-app-id-validation-mqtt-client" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="cred-extract-mqtt-client" name="Attackers can extract authentication credentials from the client and use them to log in to the MQTT broker" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;div&gt;
-                            An attacker who manages to extract the X.509 certificate/private key pair from a device can use the certificate/key for either eavesdropping on the communication or for exploiting an IoT solution. A unique certificate per device makes it possible to disable the exploited certificate/key by using a revocation list; however, this requires that the IoT solution can detect the exploitation in the first place. A solution that uses the same certificate/key in all devices has lost all integrity if someone manages to extract it from any single device. 
-                            &lt;/div&gt; 
-                            &lt;div&gt; 
-                            &lt;br&gt; 
-                            &lt;/div&gt; 
-                            &lt;div&gt;
-                            The complexity associated with extracting the certificate/key from a device greatly depends on the type of device and the components used in that device. A device based on a high-level operating system where the certificate/key is stored in a file system on an external flash memory module makes it much easier for a hacker to extract than a certificate/key for a device using internal microcontroller flash memory and where the JTAG fuse has been blown. 
-                            &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="RSA Keys Found in IoT Medical Devices, Implants Prone to Attack" url="https://healthitsecurity.com/news/rsa-keys-found-in-iot-medical-devices-implants-prone-to-attack"/>
-              </references>
-              <weaknesses>
-                <weakness ref="auth-cred-client-unprotected">
-                  <countermeasures>
-                    <countermeasure ref="iot-hardware-protect-creds" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="iot-hardware-protect-creds" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="firmware-update-mqtt" name="An attacker can change the firmware update link over MQTT in such way that the victim devices install malicious firmware" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An attacker who has already known the data packets by sniffing the traffic can modify the data in transit. One of the interesting scenarios happens when attacker identifies someone who sends a link to download a firmware update for some devices over MQTT. The attacker can change the link in such way that the victim devices install malicious firmware that transforms them into botnets.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="irrevocable-secure-boot" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="irrevocable-secure-boot" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="mqtt-client-dos" name="An attacker can overload MQTT clients due to too high message frequency on subscribed topics" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An attacker can send a large volume of dataset messages with the goal of overwhelming the subscriber, the middleware or dependent components such as CPU, TCP/IP stack, operating system, or the file system.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="mqtt-client-dos">
-                  <countermeasures>
-                    <countermeasure ref="data-integrity-checks" mitigation="25"/>
-                    <countermeasure ref="input-val-mqtt-clients" mitigation="25"/>
-                    <countermeasure ref="limit-mqtt-messages-sizes" mitigation="25"/>
-                    <countermeasure ref="mqtt-client-throttling" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="data-integrity-checks" mitigation="25"/>
-                <countermeasure ref="input-val-mqtt-clients" mitigation="25"/>
-                <countermeasure ref="limit-mqtt-messages-sizes" mitigation="25"/>
-                <countermeasure ref="mqtt-client-throttling" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.7.13" mitigation="50"/>
-                    <countermeasure ref="mqtt-payload-encryption" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.7.13" mitigation="50"/>
-                <countermeasure ref="mqtt-payload-encryption" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="fbd62900-0f33-4040-acb1-a8126c416d6c" diagramComponentId="2db8778b-485c-4b07-be61-ff8643597edd" ref="4146a845-163b-4da1-8a49-7e4081ae6ce9" name="Web Client" desc="" library="" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions>
-        <question ref="client.authentication.building.yes" answer="true" manuallyModified="false"/>
-        <question ref="client.ssl" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.no" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="40"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.193">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.013">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.029">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.660">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.035">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.041">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.055">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.061">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.067">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.216">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.082">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
-          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
-
-If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:42.000">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".
- 
-</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintencionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.097">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.050">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.075">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.117">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.132">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.152">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:04:13.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.193">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.206">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt; 
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.219">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Overwrite memory with zeros or random data before release.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
-          </references>
-          <standards>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
-                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
-                            soon as they are not needed anymore.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:04:13.538">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.617">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.234">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.255">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.275">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.334">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.346">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.361">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.372">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.596">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>If the component handles credentials and it does not do a proper clean-up of them in
-                                memory, they could be accessed by an attacker by inspecting the memory or reading
-                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-255">
-                  <countermeasures>
-                    <countermeasure ref="CWE-226" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-226" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-602">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
-                <countermeasure ref="CWE-327" mitigation="33"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="66fb8a74-3310-4d9f-94f8-2c3fb6ad12eb" diagramComponentId="3382f7c4-c89c-4dba-bfe2-5b8cee363534" ref="7ea65cc3-7318-4575-96b2-20d7ef22b32d" name="Microsoft Azure Functions" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-functions">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Personally Identifiable Information" accessType="40"/>
-        <asset name="Personally Identifiable Information" accessType="50"/>
-        <asset name="Customer Data" accessType="40"/>
-        <asset name="Customer Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.901">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.911">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of a command using
-                    externally-influenced input from an upstream component, but it does not
-                    neutralize or incorrectly neutralizes special elements that could modify the
-                    intended command when it is sent to a downstream
-                    component.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.916">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.926">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.931">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.944">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.935">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            More information: Doc MS Azure
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.950">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.954">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.330">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Configure the password expiration to force after a determinate time, the password code shall be
-                        changed for the users.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
-                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
-                        PowerShell. With the following command as the example:&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
-                        days. The users receive notification 14 days prior to that expiry.
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        More information:&amp;nbsp;
-                        &lt;a
-                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                        MS Azure&lt;/a&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;More information:
-                            &lt;a
-                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                            MS Azure&lt;/a&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.337">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Custom rules that you create 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a policy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
-&lt;/div&gt; 
-&lt;div&gt;
-  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Association tab, enter one of the following settings, then select Add: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select Review + create, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
-            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test the application gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Find the public IP address for the application gateway on its Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Copy the public IP address, and then paste it into the address bar of your browser. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.366">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Disable anonymous access 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow only authenticated requests 
-&lt;/div&gt; 
-&lt;div&gt;
-  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.375">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FUNCTIONS1" name="Disable remote debugging" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Disable remote debugging for Azure Functions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remote debugging for Azure Functions requires certain inbound ports to be opened. Denying the access to these inbound ports, will help you reduce the possibility of a security breach. Ensure that your Azure Functions have remote debugging disabled in order to enhance security and protect them from unauthorized access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Make sure that remote debugging is disabled, except when you are actively debugging your functions. You can disable remote debugging in the General Settings tab of your function app Configuration in the portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Securing Azure Functions" url="https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that your Azure Functions have remote debugging disabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.385">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.392">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.400">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.407">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.415">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable WAF logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable logging through the Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. In the Azure portal, find your resource and select Diagnostic settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Application Gateway, three logs are available: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Access log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Performance log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Firewall log 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. To start collecting data, select Turn on diagnostics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Type a name for the settings, confirm the settings, and select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that all WAF logs are enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.425">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt;
-   Use encryption to protect traffic on external and public networks as it is critical for data protection 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Rationale: 
- &lt;/div&gt; 
- &lt;div&gt;
-   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Remediation: 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Use a valid TLS/SSL certificate for custom domains. 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Redirect HTTP to HTTPs 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enforce FTPS 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enable client certificates 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Impact: 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
-            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
-            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test HTTPS 
-&lt;/div&gt; 
-&lt;div&gt;
-  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.433">
-              <output/>
-            </source>
-            <references>
-              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FUNCTIONS3" name="Function code must validate any data received from a trigger or input binding" issueId="" issueLink="" platform="" cost="0" risk="88" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Function code must validate any data received from a trigger or input binding 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The triggers and bindings used by your functions don't provide any additional data validation. Your code must validate any data received from a trigger or input binding. If an upstream service is compromised, you don't want unvalidated inputs flowing through your functions. For example, if your function stores data from an Azure Storage queue in a relational database, you must validate the data and parameterize your commands to avoid SQL injection attacks.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't assume that the data coming into your function has already been validated or sanitized. It's also a good idea to verify that the data being written to output bindings is valid. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Implement a data validation procedure for the data coming into your functions. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Securing Azure Functions" url="https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that your code validates any data received from a trigger or input binding.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.455">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.463">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.471">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-FUNCTIONS2" name="Restrict CORS access to Azure Functions" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Restrict CORS access to Azure Functions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Functions supports cross-origin resource sharing (CORS). CORS is configured in the portal and through the Azure CLI. The CORS allowed origins list applies at the function app level. With CORS enabled, responses include the Access-Control-Allow-Origin header. 
-&lt;/div&gt; 
-&lt;div&gt;
-  To prevent malicious code execution on the client, modern browsers block requests from web applications to resources running in a separate domain. Cross-origin resource sharing (CORS) lets an Access-Control-Allow-Origin header declare which origins are allowed to call endpoints on your function app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you configure the Allowed origins list for your function app, the Access-Control-Allow-Origin header is automatically added to all responses from HTTP endpoints in your function app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When the wild-card (*) is used, all other domains are ignored. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the az functionapp cors add command to add a domain to the allowed origins list. The following example adds the contoso.com domain: 
-&lt;/div&gt; 
-&lt;div&gt;
-  az functionapp cors add --name &amp;lt;FUNCTION_APP_NAME&amp;gt; \ 
-&lt;/div&gt; 
-&lt;div&gt;
-  --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; \ 
-&lt;/div&gt; 
-&lt;div&gt;
-  --allowed-origins https://contoso.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the az functionapp cors show command to list the current allowed origins. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Manage your function app" url="https://docs.microsoft.com/en-us/azure/azure-functions/functions-how-to-use-azure-function-app-settings"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that CORS access is restricted.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Secure application secrets 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
-  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
-  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
-  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.492">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-API-MANAGEMENT" name="Use Azure API Management (APIM) to authenticate requests" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Azure API Management (APIM) to authenticate requests 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  APIM provides a variety of API security options for incoming requests. With APIM in place, you can configure your function app to accept requests only from the IP address of your APIM instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Management authentication policies 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authenticate with Basic 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy statement 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-basic username="username" password="password" /&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Example 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-basic username="testuser" password="testpassword" /&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authenticate with client certificate 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the authentication-certificate policy to authenticate with a backend service using client certificate. The certificate needs to be installed into API Management first and is identified by its thumbprint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy statement 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-certificate thumbprint="thumbprint" certificate-id="resource name"/&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Examples 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In this example, the client certificate is identified by its thumbprint: 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-certificate thumbprint="CA06F56B258B7A0D4F2B05470939478651151984" /&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In this example, the client certificate is identified by the resource name: 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-certificate certificate-id="544fe9ddf3b8f30fb490d90f" /&amp;gt;&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - In this example, the client certificate is set in the policy rather than retrieved from the built-in certificate store: 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-certificate body="@(context.Variables.GetValueOrDefault&amp;lt;byte[]&amp;gt;("byteCertificate"))" password="optional-certificate-password" /&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authenticate with managed identity 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Both system-assigned identity and any of the multiple user-assigned identity can be used to request token. If client-id is not provided system-assigned identity is assumed. If the client-id variable is provided token is requested for that user-assigned identity from Azure Active Directory 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy statement 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-managed-identity resource="resource" client-id="clientid of user-assigned identity" output-token-variable-name="token-variable" ignore-error="true|false"/&amp;gt;&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Example 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use managed identity to authenticate with a backend service 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-managed-identity resource="https://graph.microsoft.com"/&amp;gt;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-managed-identity resource="https://management.azure.com/"/&amp;gt; &amp;lt;!--Azure Resource Manager--&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;authentication-managed-identity resource="https://vault.azure.net"/&amp;gt; &amp;lt;!--Azure Key Vault--&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="API Management authentication policies" url="https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that you use an APIM authentication option to authenticate requests.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
-  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
-  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
-   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0 is are blocked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.507">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="50"/>
-                <countermeasure ref="AZ-A04" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="34"/>
-                    <countermeasure ref="AZURE-API-MANAGEMENT" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="34"/>
-                <countermeasure ref="AZURE-API-MANAGEMENT" mitigation="33"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZ-A12" mitigation="20"/>
-                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="25"/>
-                    <countermeasure ref="AZ-L01" mitigation="25"/>
-                    <countermeasure ref="AZ-L05" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
-                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="25"/>
-                <countermeasure ref="AZ-L01" mitigation="25"/>
-                <countermeasure ref="AZ-L05" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-77">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-FUNCTIONS3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-FUNCTIONS3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N01" mitigation="20"/>
-                    <countermeasure ref="AZ-N02" mitigation="16"/>
-                    <countermeasure ref="AZURE-FUNCTIONS1" mitigation="16"/>
-                    <countermeasure ref="AZURE-FUNCTIONS2" mitigation="16"/>
-                    <countermeasure ref="AZURE-WAF-GW" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N01" mitigation="20"/>
-                <countermeasure ref="AZ-N02" mitigation="16"/>
-                <countermeasure ref="AZ-N09" mitigation="16"/>
-                <countermeasure ref="AZURE-FUNCTIONS1" mitigation="16"/>
-                <countermeasure ref="AZURE-FUNCTIONS2" mitigation="16"/>
-                <countermeasure ref="AZURE-WAF-GW" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="81b84ddb-d1b0-4331-865b-cd3146e6b3af" diagramComponentId="acd2ab2a-62da-4d6d-bad2-a6aa2003457e" ref="1de050a1-bf02-45ee-b386-bb404f067e9f" name="Microsoft SQL Server" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-sql-server">
-      <tags/>
-      <questions>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
-        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Personally Identifiable Information" accessType="10"/>
-        <asset name="Personally Identifiable Information" accessType="50"/>
-        <asset name="Customer Data" accessType="10"/>
-        <asset name="Customer Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
-                        data transmission. For example, network traffic can often be sniffed by any attacker who has
-                        access to a network interface. This significantly lowers the difficulty of exploitation by
-                        attackers.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:15.646">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-19T07:31:57.124">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
-
-An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-25T21:10:35.879">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-25T21:47:09.132">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.
-          </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-04T15:57:14.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.312">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="91" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T09:28:58.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="62" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
-  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
-  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
-  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-29T10:47:33.932">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="62" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:15.675">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Data stored on the server or the client must be protected by encryption (data
-                        &lt;i&gt;at rest&lt;/i&gt;).
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
-                        be used to protect the data.&lt;/li&gt;
-                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
-                        storage.&lt;/li&gt;
-                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
-                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
-                        to a bespoke implementation).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:17.905">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
-          &lt;br /&gt;&lt;br /&gt;
-          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA. 
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                &lt;ol&gt;
-                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
-                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:48:40.303">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="42" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server)&lt;/li&gt;
-                        &lt;li&gt;Origin, with this field we mark if the logs are provided by a trusted or untrusted
-                        source.&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs)&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc)&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that, at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc) .&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-24T13:07:20.403">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.335">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
- &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
- &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
- &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
-  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;b&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
- &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
- &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
- &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
- &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
- &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
- &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
- &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt; 
- &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
- &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
-&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
-&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
-&lt;ul&gt; 
- &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
- &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
- &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
- &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
- &lt;li&gt;at least 10 characters&lt;/li&gt; 
- &lt;li&gt;at most 128 characters&lt;/li&gt; 
-&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-10T12:00:36.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="91" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="42" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-24T13:05:33.389">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised though attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.
-                            </desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                    <countermeasure ref="CWE-662" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                <countermeasure ref="CWE-662" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319-AUTH">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNRESTRICTED-NETWORK">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
-                                that data.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-                    <countermeasure ref="store-backups-securely" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-                <countermeasure ref="store-backups-securely" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
-              <desc>If sensitive data is stored or processed on the host, then should the host itself be
-                                compromised by an attacker, the confidentiality and/or the integrity of the data would
-                                also be at risk.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="0c92d868-d9e8-464c-9f86-2bf0491811d2" diagramComponentId="0b7db21d-459a-4cd5-8867-45ed7b5cdc43" ref="f6372a8d-42ab-4572-80a1-edd76f49b5d1" name="Microsoft Azure Active Directory" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-active-directory">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are typically introduced during the
-                        configuration of the software.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-DATA-01" name="Sensitive data are accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data are not encrypted and the sensitive data is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="no-alerts-access" name="There is no alert for unauthorized access" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There is no alert to notify about unauthorized access to the resources, and this access is not logged.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.496">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.280">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD1" name="Block legacy authentication for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Block legacy authentication for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; To give your users easy access to your cloud apps, Azure Active Directory (Azure AD) supports a broad variety of authentication protocols including legacy authentication. Legacy authentication is a term that refers to an authentication request made by:&lt;br&gt; - Older Office clients that do not use modern authentication (for example, Office 2010 client)&lt;br&gt; - Any client that uses legacy mail protocols such as IMAP/SMTP/POP3&lt;br&gt; Today, the majority of all compromising sign-in attempts come from legacy authentication. Legacy authentication does not support multi-factor authentication (MFA). Even if you have an MFA policy enabled on your directory, a bad actor can authenticate using a legacy protocol and bypass MFA. The best way to protect your account from malicious authentication requests made by legacy protocols is to block these attempts altogether.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Follow the steps below in order to block legacy authentication in your directory&lt;/p&gt;&lt;p&gt;Identify legacy authentication use&lt;/p&gt;&lt;p&gt;Before you can block legacy authentication in your directory, you need to first understand if your users have apps that use legacy authentication and how it affects your overall directory. Azure AD sign-in logs can be used to understand if you are using legacy authentication.&lt;/p&gt;&lt;p&gt;1. Navigate to the Azure portal &amp;gt; Azure Active Directory &amp;gt; Sign-ins.&lt;br&gt; 2. Add the Client App column if it is not shown by clicking on Columns &amp;gt; Client App.&lt;br&gt; 3. Filter by Client App &amp;gt; check all the Legacy Authentication Clients options presented.&lt;br&gt; 4. Filter by Status &amp;gt; Success.&lt;br&gt; 5. Expand your date range if necessary using the Date filter.&lt;/p&gt;&lt;p&gt;Filtering will only show you successful sign-in attempts that were made by the selected legacy authentication protocols. Clicking on each individual sign-in attempt will show you additional details. The Client App column or the Client App field under the Basic Info tab after selecting an individual row of data will indicate which legacy authentication protocol was used. These logs will indicate which users are still depending on legacy authentication and which applications are using legacy protocols to make authentication requests. For users that do not appear in these logs and are confirmed to not be using legacy authentication, implement a Conditional Access policy or enable the Baseline policy: block legacy authentication for these users only.&lt;/p&gt;&lt;p&gt;Moving away from legacy authentication&lt;/p&gt;&lt;p&gt;Once you have a better idea of who is using legacy authentication in your directory and which applications depend on it, the next step is upgrading your users to use modern authentication. Modern authentication is a method of identity management that offers more secure user authentication and authorization. If you have an MFA policy in place on your directory, modern authentication ensures that the user is prompted for MFA when required. It is the more secure alternative to legacy authentication protocols.&lt;/p&gt;&lt;p&gt;This section gives a step-by-step overview on how to update your environment to modern authentication. Read through the steps below before enabling a legacy authentication blocking policy in your organization.&lt;/p&gt;&lt;p&gt;Step 1: Enable modern authentication in your directory&lt;/p&gt;&lt;p&gt;The first step in enabling modern authentication is making sure your directory supports modern authentication. Modern authentication is enabled by default for directories created on or after August 1, 2017. If your directory was created prior to this date, you will need to manually enable modern authentication for your directory using the following steps:&lt;/p&gt;&lt;p&gt;1. Check to see if your directory already supports modern authentication by running Get-CsOAuthConfiguration from the Skype for Business Online PowerShell module.&lt;br&gt; 2. If your command returns an empty OAuthServers property, then Modern Authentication is disabled. Update the setting to enable modern authentication using Set-CsOAuthConfiguration. If your OAuthServers property contains an entry, you are good to go.&lt;/p&gt;&lt;p&gt;Be sure to complete this step before moving forward. It is critical that your directory configurations are changed first because they dictate which protocol will be used by all Office clients. Even if you are using Office clients that support modern authentication, they will default to using legacy protocols if modern authentication is disabled on your directory.&lt;/p&gt;&lt;p&gt;Step 2: Office applications&lt;/p&gt;&lt;p&gt;Once you have enabled modern authentication in your directory, you can start updating applications by enabling modern authentication for Office clients. Office 2016 or later clients support modern authentication by default. No extra steps are required.&lt;/p&gt;&lt;p&gt;If you are using Office 2013 Windows clients or older, Azure recommends upgrading to Office 2016 or later. Even after completing the prior step of enabling modern authentication in your directory, the older Office applications will continue to use legacy authentication protocols. If you are using Office 2013 clients and are unable to immediately upgrade to Office 2016 or later, follow the steps in the following article to Enable Modern Authentication for Office 2013 on Windows devices. To help protect your account while you are using legacy authentication, Azure recommends using strong passwords across your directory. Check out Azure AD password protection to ban weak passwords across your directory.&lt;/p&gt;&lt;p&gt;Office 2010 does not support modern authentication. You will need to upgrade any users with Office 2010 to a more recent version of Office. Azure recommends upgrading to Office 2016 or later, as it blocks legacy authentication by default.&lt;/p&gt;&lt;p&gt;If you are using macOS, Azure recommends upgrading to Office for Mac 2016 or later. If you are using the native mail client, you will need to have macOS version 10.14 or later on all devices.&lt;/p&gt;&lt;p&gt;Step 3: Exchange and SharePoint&lt;/p&gt;&lt;p&gt;For Windows-based Outlook clients to use modern authentication, Exchange Online must be modern authentication enabled as well. If modern authentication is disabled for Exchange Online, Windows-based Outlook clients that support modern authentication (Outlook 2013 or later) will use basic authentication to connect to Exchange Online mailboxes.&lt;/p&gt;&lt;p&gt;SharePoint Online is enabled for modern authentication default. For directories created after August 1, 2017, modern authentication is enabled by default in Exchange Online. However, if you had previously disabled modern authentication or are you using a directory created prior to this date, follow the steps in the "Enable modern authentication in Exchange Online" in Reference Url.&lt;/p&gt;&lt;p&gt;Step 4: Skype for Business&lt;/p&gt;&lt;p&gt;To prevent legacy authentication requests made by Skype for Business, it is necessary to enable modern authentication for Skype for Business Online. For directories created after August 1, 2017, modern authentication for Skype for Business is enabled by default.&lt;/p&gt;&lt;p&gt;Azure suggests you transition to Microsoft Teams, which supports modern authentication by default. However, if you are unable to migrate at this time, you will need to enable modern authentication for Skype for Business Online so that Skype for Business clients start using modern authentication.&lt;/p&gt;&lt;p&gt;In addition to enabling modern authentication for Skype for Business Online, Azure recommends enabling modern authentication for Exchange Online when enabling modern authentication for Skype for Business. This process will help synchronize the state of modern authentication in Exchange Online and Skype for Business online and will prevent multiple sign-in prompts for Skype for Business clients.&lt;/p&gt;&lt;p&gt;Step 5: Using mobile devices&lt;br&gt; Applications on your mobile device need to block legacy authentication as well. Azure recommends using Outlook for Mobile. Outlook for Mobile supports modern authentication by default and will satisfy other MFA baseline protection policies.&lt;/p&gt;&lt;p&gt;In order to use the native iOS mail client, you will need to be running iOS version 11.0 or later to ensure the mail client has been updated to block legacy authentication.&lt;/p&gt;&lt;p&gt;Step 6: On-premises clients&lt;/p&gt;&lt;p&gt;If you are a hybrid customer using Exchange Server on-premises and Skype for Business on-premises, both services will need to be updated to enable modern authentication. When using modern authentication in a hybrid environment, you are still authenticating users on-premises. The story of authorizing their access to resources (files or emails) changes.&lt;/p&gt;&lt;p&gt;Before you can begin enabling modern authentication on-premises, please be sure that you have met the pre-requisites. You are now ready to enable modern authentication on-premises.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blocking legacy authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-block-legacy-authentication"/>
-            <reference name="Enable or disable modern authentication for Outlook in Exchange Online" url="https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To check if your users have apps that use legacy authentication, follow again the steps of "Identify legacy authentication use" section:&lt;/p&gt;      &lt;p&gt;1. Navigate to the Azure portal &gt; Azure Active Directory &gt; Sign-ins.&lt;br /&gt;  2. Add the Client App column if it is not shown by clicking on Columns &gt; Client App.&lt;br /&gt;  3. Filter by Client App &gt; check all the Legacy Authentication Clients options presented.&lt;br /&gt;  4. Filter by Status &gt; Success.&lt;br /&gt;  5. Expand your date range if necessary using the Date filter.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD18" name="Configure Azure Active Directory settings" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure Active Directory.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of methods required to reset' is set to '2'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0"&lt;/li&gt;&lt;li&gt;Ensure that 'Notify users on password resets?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can register applications' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guest user permissions are limited' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Members can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guests can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create security groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that no custom subscription owner roles are created&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;ol&gt;&lt;li&gt;Go to Users&lt;ol&gt;&lt;li&gt;Go to Password reset&lt;ol&gt;&lt;li&gt;Go to Authentication methods&lt;ol&gt;&lt;li&gt;Set the Number of methods required to reset to 2&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Registration&lt;ol&gt;&lt;li&gt;Set the Number of days before users are asked to re-confirm their authentication information to your organization defined frequency&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Notification&lt;ol&gt;&lt;li&gt;Set Notify users on password resets? to Yes&lt;/li&gt;&lt;li&gt;Set Notify all admins when other admins reset their password? to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to All Users&lt;ol&gt;&lt;li&gt;Click on Multi-Factor Authentication button on the top bar&lt;/li&gt;&lt;li&gt;Click on service settings&lt;/li&gt;&lt;li&gt;Disable Allow users to remember multi-factor authentication on devices they trust&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to User settings&lt;ol&gt;&lt;li&gt;Click on Manage how end users launch and view their applications&lt;ol&gt;&lt;li&gt;Set Users can consent to apps accessing company data on their behalf to No&lt;/li&gt;&lt;li&gt;Set Users can add gallery apps to their Access Panel to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Set Users can register applications to No&lt;/li&gt;&lt;li&gt;Set Restrict access to Azure AD administration portal to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to External Identities&lt;ol&gt;&lt;li&gt;Go to External collaboration settings&lt;ol&gt;&lt;li&gt;Set Guest users permissions are limited to Yes&lt;/li&gt;&lt;li&gt;Set Members can invite to No&lt;/li&gt;&lt;li&gt;Set Guests can invite to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Groups&lt;ol&gt;&lt;li&gt;Go to General in setting&lt;ol&gt;&lt;li&gt;Ensure that Restrict user ability to access groups features in the Access Pane is set to No&lt;/li&gt;&lt;li&gt;Set Users can create security groups in Azure Portals to No&lt;/li&gt;&lt;li&gt;Set Owners can manage group membership requests in the Access Panel to No&lt;/li&gt;&lt;li&gt;Set Users can create Microsoft 365 groups in Azure Portals to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Devices&lt;ol&gt;&lt;li&gt;Go to Device settings&lt;ol&gt;&lt;li&gt;Set Require Multi-Factor Auth to join devices to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.10" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.10" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.11" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.13" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.13" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.14" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.14" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.15" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.15" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.16" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.17" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.17" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.18" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.19" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.20" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.21" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.22" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.22" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.23" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.23" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="GS-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="IM-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD12" name="Configure Azure Monitor logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Configure Azure Monitor logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure Monitor logs allows you to query data to find particular events, analyze trends, and perform correlation across various data sources. You can also set up alerts on your query. With the integration of Azure AD activity logs in Azure Monitor logs, you can now perform tasks like:&lt;/p&gt; 
-&lt;p&gt;- Compare your Azure AD sign-in logs against security logs published by Azure Security Center&lt;br&gt; - Troubleshoot performance bottlenecks on your application's sign-in page by correlating application performance data from Azure Application Insights.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Using this feature requires an Azure AD Premium P1 or P2 license.&lt;/p&gt; 
-&lt;p&gt;Send logs to Azure Monitor&lt;/p&gt; 
-&lt;p&gt;1.Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Azure Active Directory &amp;gt; Diagnostic settings -&amp;gt; Add diagnostic setting. You can also select Export Settings from the Audit Logs or Sign-ins page to get to the diagnostic settings configuration page.&lt;/p&gt; 
-&lt;p&gt;3. In the Diagnostic settings menu, select the Send to Log Analytics workspace check box, and then select Configure.&lt;/p&gt; 
-&lt;p&gt;4. Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.&lt;/p&gt; 
-&lt;p&gt;5. Do either or both of the following:&lt;/p&gt; 
-&lt;p&gt;- To send audit logs to the Log Analytics workspace, select the AuditLogs check box.&lt;br&gt; - To send sign-in logs to the Log Analytics workspace, select the SignInLogs check box.&lt;/p&gt; 
-&lt;p&gt;6. Select Save to save the setting.&lt;/p&gt; 
-&lt;p&gt;7. After about 15 minutes, verify that events are streamed to your Log Analytics workspace.&lt;/p&gt; 
-&lt;p&gt;Navigate to the Log Analytics workspace&lt;/p&gt; 
-&lt;p&gt;- Sign in to the Azure portal.&lt;br&gt; - Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace. The workspace will open with a default query.&lt;/p&gt; 
-&lt;p&gt;Alert on Azure AD activity log data&lt;/p&gt; 
-&lt;p&gt;You can also set up alerts on your query. For example, to configure an alert when more than 10 applications have been used in the last week:&lt;/p&gt; 
-&lt;p&gt;1. From the workspace, select Set alert to open the Create rule page.&lt;/p&gt; 
-&lt;p&gt;2. Select the default alert criteria created in the alert and update the Threshold in the default metric to 10.&lt;/p&gt; 
-&lt;p&gt;3. Enter a name and description for the alert, and choose the severity level. For our example, we could set it to Informational.&lt;/p&gt; 
-&lt;p&gt;4. Select the Action Group that will be alerted when the signal occurs. You can choose to notify your team via email or text message, or you could automate the action using webhooks, Azure functions or logic apps. Learn more about creating and managing alert groups in the Azure portal.&lt;/p&gt; 
-&lt;p&gt;5. Once you have configured the alert, select Create alert to enable it.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Analyze Azure AD activity logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics#alert-on-azure-ad-activity-log-data"/>
-            <reference name="Integrate Azure AD logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Monitor logs are configured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD4" name="Create an organization specific custom banned password list" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create an organization specific custom banned password list&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, the Azure Active Directory (Azure AD) custom banned password list let you add specific strings to evaluate and block. A password change request fails if there is a match in the custom banned password list.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Note: To complete this guide, you need a working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.&lt;/p&gt; 
-&lt;p&gt;Configure custom banned passwords&lt;/p&gt; 
-&lt;p&gt;To enable the custom banned password list and add entries to it, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, then choose Security from the menu on the left-hand side.&lt;/p&gt; 
-&lt;p&gt;3. Under the Manage menu header, select Authentication methods, then Password protection.&lt;/p&gt; 
-&lt;p&gt;4. Set the option for Enforce custom list to Yes.&lt;/p&gt; 
-&lt;p&gt;5. Add strings to the Custom banned password list, one string per line. The following considerations and limitations apply to the custom banned password list:&lt;/p&gt; 
-&lt;p&gt;- The custom banned password list can contain up to 1000 terms.&lt;br&gt; - The custom banned password list is case-insensitive.&lt;br&gt; - The custom banned password list considers common character substitution, such as o and 0, or a and @.&lt;br&gt; - The minimum string length is four characters, and the maximum is 16 characters.&lt;/p&gt; 
-&lt;p&gt;Specify your own custom passwords to ban.&lt;/p&gt; 
-&lt;p&gt;6. Leave the option for Enable password protection on Windows Server Active Directory to No.&lt;/p&gt; 
-&lt;p&gt;7. To enable the custom banned passwords and your entries, select Save.&lt;/p&gt; 
-&lt;p&gt;It may take several hours for updates to the custom banned password list to be applied.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Configure custom banned passwords for Azure Active Directory password protection" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test custom banned password list&lt;/p&gt;
-
-  &lt;p&gt;To see the custom banned password list in action, try to change the password to a variation of one that you added in the Remediation section. When Azure AD tries to process the password change, the password is matched against an entry in the custom banned password list. An error is then displayed to the user.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD3" name="Designate more than one global administrator in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Designate more than one global administrator in Azure AD&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you cannot sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts cannot be used. Azure recommends that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create emergency access accounts&lt;/p&gt; 
-&lt;p&gt;Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.&lt;/p&gt; 
-&lt;p&gt;When configuring these accounts, the following requirements must be met:&lt;/p&gt; 
-&lt;p&gt;- The emergency access accounts should not be associated with any individual user in the organization. Make sure that your accounts are not connected with any employee-supplied mobile phones, hardware tokens that travel with individual employees, or other employee-specific credentials. This precaution covers instances where an individual employee is unreachable when the credential is needed. It is important to ensure that any registered devices are kept in a known, secure location that has multiple means of communicating with Azure AD.&lt;br&gt; - The authentication mechanism used for an emergency access account should be distinct from that used by your other administrative accounts, including other emergency access accounts. For example, if your normal administrator sign-in is via on-premises MFA, then Azure AD MFA would be a different mechanism. However if Azure AD MFA is your primary part of authentication for your administrative accounts, then consider a different approach for these, such as using Conditional Access with a third-party MFA provider via Custom controls.&lt;br&gt; - The device or credential must not expire or be in scope of automated cleanup due to lack of use.&lt;br&gt; - You should make the Global Administrator role assignment permanent for your emergency access accounts.&lt;/p&gt; 
-&lt;p&gt;Exclude at least one account from phone-based multi-factor authentication&lt;/p&gt; 
-&lt;p&gt;To reduce the risk of an attack resulting from a compromised password, Azure AD recommends that you require multi-factor authentication for all individual users. This group includes administrators and all others (for example, financial officers) whose compromised account would have a significant impact.&lt;/p&gt; 
-&lt;p&gt;However, at least one of your emergency access accounts should not have the same multi-factor authentication mechanism as your other non-emergency accounts. This includes third-party multi-factor authentication solutions. If you have a Conditional Access policy to require multi-factor authentication for every administrator for Azure AD and other connected software as a service (SaaS) apps, you should exclude emergency access accounts from this requirement, and configure a different mechanism instead. Additionally, you should make sure the accounts do not have a per-user multi-factor authentication policy.&lt;/p&gt; 
-&lt;p&gt;Exclude at least one account from Conditional Access policies&lt;/p&gt; 
-&lt;p&gt;During an emergency, you do not want a policy to potentially block your access to fix an issue. At least one emergency access account should be excluded from all Conditional Access policies.&lt;/p&gt; 
-&lt;p&gt;In addition you have to store the credentials for emergency access accounts safely and monitor sign-in and audit log activity.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Manage emergency access accounts in Azure AD" url="https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have at least two emergency access accounts.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD8" name="Disable end-user consent to applications" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Disable end-user consent to applications&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The admin consent workflow gives admins a secure way to grant access to applications that require admin approval so end users do not expose corporate data. Microsoft recommends disabling future user consent operations to help reduce your surface area and mitigate this risk.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To configure user consent settings through the Azure portal:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a Global Administrator.&lt;br&gt; 2. Select Azure Active Directory &amp;gt; Enterprise applications &amp;gt; Consent and permissions &amp;gt; User consent settings.&lt;br&gt; 3. Under User consent for applications, select "Do not allow user consent" &lt;br&gt; 4. Select Save to save your settings.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure how end-users consent to applications" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that end-user consent to applications is disabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD11" name="Enable Azure AD Identity Protection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Active Directory Identity Protection&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Identity Protection is a tool that allows organizations to accomplish three key tasks:&lt;/p&gt;
-
-  &lt;p&gt;- Automate the detection and remediation of identity-based risks.&lt;br /&gt;
-- Investigate risks using data in the portal.&lt;br /&gt;
-- Export risk detection data to third-party utilities for further analysis.&lt;/p&gt;
-
-  &lt;p&gt;Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.&lt;/p&gt;
-
-  &lt;p&gt;The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Using this feature requires an Azure AD Premium P2 license.&lt;/p&gt;
-
-  &lt;p&gt;Then in the Azure portal under Azure Active Directory &gt; Security &gt; Identity Protection you can:&lt;/p&gt;
-
-  &lt;p&gt;- Configure the MFA registration policy&lt;br /&gt;
-- Configure risk policies&lt;br /&gt;
-- Configure notifications&lt;/p&gt;
-
-  &lt;p&gt;For more information please see Reference URLs.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Active Directory Identity Protection notifications" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications"/>
-            <reference name="How To: Configure and enable risk policies" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies"/>
-            <reference name="How To: Configure the Azure AD Multi-Factor Authentication registration policy" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy"/>
-            <reference name="What is Identity Protection?" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Active Directory Identity Protection is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD5" name="Enable combined security information registration in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable combined security information registration in Azure AD&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.&lt;br&gt; Note: Starting on August 15th 2020, all new Azure AD tenants will be automatically enabled for combined registration. Starting on December 14th 2020, all Azure AD tenants with one user will be automatically enabled for combined registration.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To enable combined registration, complete these steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a user administrator or global administrator.&lt;/p&gt; 
-&lt;p&gt;2. Go to Azure Active Directory &amp;gt; User settings &amp;gt; Manage user feature preview settings.&lt;/p&gt; 
-&lt;p&gt;3. Under Users can use the combined security information registration experience, choose to enable for a Selected group of users or for All users.&lt;/p&gt; 
-&lt;p&gt;Create a policy to require registration from a trusted location&lt;/p&gt; 
-&lt;p&gt;Complete the following steps to create a policy that applies to all selected users that attempt to register using the combined registration experience, and blocks access unless they are connecting from a location marked as trusted network:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;/p&gt; 
-&lt;p&gt;2. Select + New policy.&lt;/p&gt; 
-&lt;p&gt;3. Enter a name for this policy, such as Combined Security Info Registration on Trusted Networks.&lt;/p&gt; 
-&lt;p&gt;4. Under Assignments, select Users and groups. Choose the users and groups you want this policy to apply to, then select Done.&lt;/p&gt; 
-&lt;p&gt;Warning: Users must be enabled for combined registration.&lt;/p&gt; 
-&lt;p&gt;5. Under Cloud apps or actions, select User actions. Check Register security information, then select Done.&lt;/p&gt; 
-&lt;p&gt;6. Under Conditions &amp;gt; Locations, configure the following options:&lt;br&gt; a. Configure Yes.&lt;br&gt; b. Include Any location.&lt;br&gt; c. Exclude All trusted locations.&lt;/p&gt; 
-&lt;p&gt;7. Select Done on the Locations window, then select Done on the Conditions window.&lt;/p&gt; 
-&lt;p&gt;8. Under Access controls &amp;gt; Grant, choose Block access, then Select.&lt;/p&gt; 
-&lt;p&gt;9. Set Enable policy to On.&lt;/p&gt; 
-&lt;p&gt;10. To finalize the policy, select Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable combined security information registration in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that combined security information registration is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD14" name="Enable device based Conditional Access" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable device based Conditional Access&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Improve security and user experiences with device-based Conditional Access. This control ensures users can only access from devices that meet your standards for security and compliance. These devices are also known as managed devices. Managed devices can be Intune compliant or Hybrid Azure AD joined devices.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Managed devices&lt;/p&gt; 
-&lt;p&gt;In simple terms, managed devices are devices that are under some sort of organizational control. In Azure AD, the prerequisite for a managed device is that it has been registered with Azure AD. Registering a device creates an identity for the device in form of a device object. This object is used by Azure to track status information about a device. As an Azure AD administrator, you can already use this object to toggle (enable/disable) the state of a device.&lt;/p&gt; 
-&lt;p&gt;To get a device registered with Azure AD, you have three options:&lt;/p&gt; 
-&lt;p&gt;- Azure AD registered devices - to get a personal device registered with Azure AD&lt;br&gt; - Azure AD joined devices - to get an organizational Windows 10 device that is not joined to an on-premises AD registered with Azure AD.&lt;br&gt; - Hybrid Azure AD joined devices - to get a Windows 10 or supported down-level device that is joined to an on-premises AD registered with Azure AD.&lt;/p&gt; 
-&lt;p&gt;To become a managed device, a registered device must be either a Hybrid Azure AD joined device or a device that has been marked as compliant.&lt;/p&gt; 
-&lt;p&gt;Require Hybrid Azure AD joined devices&lt;/p&gt; 
-&lt;p&gt;In your Conditional Access policy, you can select Require Hybrid Azure AD joined device to state that the selected cloud apps can only be accessed using a managed device.&lt;/p&gt; 
-&lt;p&gt;This setting only applies to Windows 10 or down-level devices such as Windows 7 or Windows 8 that are joined to an on-premises AD. You can only register these devices with Azure AD using a Hybrid Azure AD join, which is an automated process to get a Windows 10 device registered.&lt;/p&gt; 
-&lt;p&gt;What makes a Hybrid Azure AD joined device a managed device? For devices that are joined to an on-premises AD, it is assumed that the control over these devices is enforced using management solutions such as Configuration Manager or group policy (GP) to manage them. Because there is no method for Azure AD to determine whether any of these methods has been applied to a device, requiring a hybrid Azure AD joined device is a relatively weak mechanism to require a managed device. It is up to you as an administrator to judge whether the methods that are applied to your on-premises domain-joined devices are strong enough to constitute a managed device if such a device is also a Hybrid Azure AD joined device.&lt;/p&gt; 
-&lt;p&gt;Require device to be marked as compliant&lt;/p&gt; 
-&lt;p&gt;The option to require a device to be marked as compliant is the strongest form to request a managed device.&lt;/p&gt; 
-&lt;p&gt;This option requires a device to be registered with Azure AD, and also to be marked as compliant by:&lt;br&gt; - Intune&lt;br&gt; - A third-party mobile device management (MDM) system that manages Windows 10 devices via Azure AD integration. Third-party MDM systems for device OS types other than Windows 10 are not supported.&lt;/p&gt; 
-&lt;p&gt;For a device that is marked as compliant, you can assume that:&lt;br&gt; - The mobile devices your workforce uses to access company data are managed&lt;br&gt; - Mobile apps your workforce uses are managed&lt;br&gt; - Your company information is protected by helping to control the way your workforce accesses and shares it&lt;br&gt; - The device and its apps are compliant with company security requirements&lt;/p&gt; 
-&lt;p&gt;Scenario: Require device enrollment for iOS and Android devices&lt;/p&gt; 
-&lt;p&gt;In this scenario, Contoso has decided that all mobile access to Microsoft 365 resources must use an enrolled device. All of their users already sign in with Azure AD credentials and have licenses assigned to them that include Azure AD Premium P1 or P2 and Microsoft Intune.&lt;/p&gt; 
-&lt;p&gt;Organizations must complete the following steps in order to require the use of an enrolled mobile device.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;br&gt; 3. Select New policy.&lt;br&gt; 4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.&lt;br&gt; 5. Under Assignments, select Users and groups&lt;br&gt; a. Under Include, select All users or the specific Users and groups you wish to apply this policy to.&lt;br&gt; b. Select Done.&lt;br&gt; 6. Under Cloud apps or actions &amp;gt; Include, select Office 365.&lt;br&gt; 7. Under Conditions, select Device platforms.&lt;br&gt; a. Set Configure to Yes.&lt;br&gt; b. Include Android and iOS.&lt;br&gt; 8. Under Access controls &amp;gt; Grant, select the following options:&lt;br&gt; - Require device to be marked as compliant&lt;br&gt; 9. Confirm your settings and set Enable policy to On.&lt;br&gt; 10. Select Create to create and enable your policy.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How To: Require managed devices for cloud app access with Conditional Access" url="https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices#require-hybrid-azure-ad-joined-devices"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that device based Conditional Access is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD16" name="Enable Microsoft's password guidance" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Microsoft's password guidance&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Password Guidance provides Microsoft's recommendations for password management based on current research and lessons from their own experience as one of the largest Identity Providers (IdPs) in the world. It covers recommendations for end users and identity administrators.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Download and enforce Microsoft's password guidance in your organization.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Password Guidance" url="https://www.microsoft.com/en-us/research/publication/password-guidance/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Microsoft's password guidance is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD7" name="Enable password writeback for SSPR if using hybrid identities" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable password writeback for SSPR if using hybrid identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; With Azure Active Directory (Azure AD) self-service password reset (SSPR), users can update their password or unlock their account using a web browser. In a hybrid environment where Azure AD is connected to an on-premises Active Directory Domain Services (AD DS) environment, this scenario can cause passwords to be different between the two directories.&lt;/p&gt; 
-&lt;p&gt;Password writeback can be used to synchronize password changes in Azure AD back to your on-premises AD DS environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Azure AD.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;/p&gt; 
-&lt;p&gt;Enable password writeback for SSPR&lt;/p&gt; 
-&lt;p&gt;Note: Before proceeding to the following steps, make sure you have enabled password writeback to Azure AD Connect first.&lt;/p&gt; 
-&lt;p&gt;With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.&lt;/p&gt; 
-&lt;p&gt;To enable password writeback in SSPR, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using a global administrator account.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, select Password reset, then choose On-premises integration.&lt;/p&gt; 
-&lt;p&gt;3. Set the option for Write back passwords to your on-premises directory? to Yes.&lt;/p&gt; 
-&lt;p&gt;4. Set the option for Allow users to unlock accounts without resetting their password? to Yes.&lt;/p&gt; 
-&lt;p&gt;5. When ready, select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Enable Azure Active Directory self-service password reset writeback to an on-premises environment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback#enable-password-writeback-for-sspr"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that password writeback for SSPR is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards>
-            <standard ref="1.1.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.1.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.1.3" supportedStandardRef="cis-azure-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Licensing requirements&lt;/p&gt;
-
-  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
-
-  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
-- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
-
-  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
-
-  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
-- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
-When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
-
-  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD2" name="Enable Security defaults for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Security defaults for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; Managing security can be difficult with common identity-related attacks like password spray, replay, and phishing becoming more and more popular. Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:&lt;/p&gt;&lt;p&gt;- Requiring all users to register for Azure AD Multi-Factor Authentication.&lt;br&gt; - Requiring administrators to perform multi-factor authentication.&lt;br&gt; - Blocking legacy authentication protocols.&lt;br&gt; - Requiring users to perform multi-factor authentication when necessary.&lt;br&gt; - Protecting privileged activities like access to the Azure portal.&lt;/p&gt;&lt;p&gt;Note: If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Enabling security defaults&lt;br&gt; To enable security defaults in your directory:&lt;/p&gt;&lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Properties.&lt;br&gt; 3. Select Manage security defaults.&lt;br&gt; 4. Set the Enable security defaults toggle to Yes.&lt;br&gt; 5. Select Save.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; Warning: Before you enable security defaults, make sure your administrators are not using older authentication protocols.&lt;/p&gt;&lt;p&gt;Who should use Conditional Access instead of Security defaults?&lt;br&gt; - If you are an organization currently using Conditional Access policies to bring signals together, to make decisions, and enforce organizational policies, security defaults are probably not right for you.&lt;br&gt; - If you are an organization with Azure Active Directory Premium licenses, security defaults are probably not right for you.&lt;br&gt; - If your organization has complex security requirements you should consider Conditional Access.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What are security defaults?" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults"/>
-          </references>
-          <standards>
-            <standard ref="1.1.1" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.1.1" supportedStandardRef="cis-azure-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To ensure that Security defaults are enabled:&lt;/p&gt;      &lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br /&gt;  2. Browse to Azure Active Directory &gt; Properties.&lt;br /&gt;  3. Select Manage security defaults.&lt;br /&gt;  4. Check that the Enable security defaults toggle is set to Yes.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD6" name="Enable self-service password reset (SSPR)" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable self-service password reset (SSPR)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Self-Service Password Reset (SSPR) is an Azure Active Directory (AD) feature that enables users to reset their passwords without contacting IT staff for help. The users can quickly unblock themselves and continue working no matter where they are or time of day. By allowing the employees to unblock themselves, your organization can reduce the non-productive time and high support costs for most common password-related issues.&lt;/p&gt; 
-&lt;p&gt;SSPR has the following key capabilities:&lt;/p&gt; 
-&lt;p&gt;- Self-service allows end users to reset their expired or non-expired passwords without contacting an administrator or helpdesk for support.&lt;br&gt; - Password Writeback allows management of on-premises passwords and resolution of account lockout though the cloud.&lt;br&gt; - Password management activity reports give administrators insight into password reset and registration activity occurring in their organization.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; This is how configure SSPR for a set of users in a test group. In the following example, the group SSPR-Test-Group is used. Provide your own Azure AD group as needed:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, then choose Password reset from the menu on the left-hand side.&lt;/p&gt; 
-&lt;p&gt;3. From the Properties page, under the option Self service password reset enabled, choose Select group&lt;/p&gt; 
-&lt;p&gt;4. Browse for and select your Azure AD group, such as SSPR-Test-Group, then choose Select.&lt;/p&gt; 
-&lt;p&gt;5. To enable SSPR for the select users, select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Plan an Azure Active Directory self-service password reset deployment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment"/>
-            <reference name="Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test self-service password reset&lt;/p&gt;
-
-  &lt;p&gt;With SSPR enabled and configured, test the SSPR process with a user that's part of the group you selected in the Remediation section, such as Test-SSPR-Group. In the following example, the testuser account is used. Provide your own user account that's part of the group you enabled for SSPR in the Remediation section.&lt;/p&gt;
-
-  &lt;p&gt;Note: When you test self-service password reset, use a non-administrator account. By default, admins are enabled for self-service password reset and are required to use two authentication methods to reset their password. For more information, see Administrator reset policy differences.&lt;/p&gt;
-
-  &lt;p&gt;1. To see the manual registration process, open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/ssprsetup. Users should be directed to this registration portal when they next sign-in.&lt;/p&gt;
-
-  &lt;p&gt;2. Sign in with a non-administrator test user, such as testuser, and register your authentication methods contact information.&lt;/p&gt;
-
-  &lt;p&gt;3. Once complete, select the button marked Looks good and close the browser window.&lt;/p&gt;
-
-  &lt;p&gt;4. Open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/sspr.&lt;/p&gt;
-
-  &lt;p&gt;5. Enter your non-administrator test users' account information, such as testuser, the characters from the CAPTCHA, and then select Next.&lt;/p&gt;
-
-  &lt;p&gt;6. Follow the verification steps to reset your password. When complete, you should receive an e-mail notification that your password was reset.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD17" name="Ensure there are no Azure Active Directory guest users if they are not needed" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.&lt;/p&gt;&lt;p&gt;Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.&lt;/p&gt;&lt;p&gt;Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely leading to a potential vulnerability.&lt;/p&gt;&lt;p&gt;Guest users should be review on a monthly basis to ensure that inactive and unneeded accounts are removed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Until you have a business need to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Delete all "Guest" users that are no longer required or are inactive.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;It is good practice to use a dynamic group to manage guest users. To create the dynamic group:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the Active Directory blade in the Azure Portal&lt;/li&gt;&lt;li&gt;Select the &lt;i&gt;Groups &lt;/i&gt;item&lt;/li&gt;&lt;li&gt;Create new&lt;/li&gt;&lt;li&gt;Type of &lt;i&gt;dynamic&lt;/i&gt;&lt;/li&gt;&lt;li&gt;Use the following dynamic selection rule. "(user.userType -eq "Guest")"&lt;/li&gt;&lt;li&gt;Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="PA-3" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Ensure that guest users listed are still required (USER TYPE = Guest)&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az ad user list --query "[?userType=='Guest']"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure all users listed are not inactive and still required.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using PowerShell&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Connect-AzureAD (Only needs to be performed once within the PowerShell session) Get-AzureADUser |Where-Object {$_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD9" name="Integrate supported SaaS applications from the gallery to Azure AD and enable SSO" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Integrate supported SaaS applications from the gallery to Azure AD and enable Single sign on (SSO)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure AD has a gallery that contains thousands of pre-integrated applications. Some of the applications your organization uses are probably in the gallery accessible directly from the Azure portal. Provide access to corporate SaaS applications remotely and securely with improved user experience (SSO).&lt;/p&gt; 
-&lt;p&gt;After integrating supported SaaS applications, you can automatically create user identities and roles in the cloud (SaaS) applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change, increasing your organization's security.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
-&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
-&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
-&lt;p&gt;3. In the Enterprise applications pane, select New application.&lt;/p&gt; 
-&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
-&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
-&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
-&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on.&lt;/p&gt; 
-&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
-&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
-&lt;p&gt;You have finished adding an application.&lt;/p&gt; 
-&lt;p&gt;How to set up automatic provisioning to an application&lt;/p&gt; 
-&lt;p&gt;For pre-integrated applications listed in the gallery, step-by-step guidance is available for setting up automatic provisioning. Please follow Reference URL for more details.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
-            <reference name="What is automated SaaS app user provisioning in Azure AD?" url="https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing supported SaaS applications integration&lt;/p&gt;
-
-  &lt;p&gt;Azure recommends using a non-production environment to test the steps in the description section.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD13" name="Secure legacy apps with Azure Active Directory" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure legacy apps with Azure Active Directory&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Publish and protect your on-premises and cloud legacy authentication applications by connecting them to Azure AD with your existing application delivery controller or network.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; You can protect your on-premises and cloud legacy authentication applications by connecting them to Azure Active Directory (AD) with:&lt;/p&gt; 
-&lt;p&gt;- Azure AD Application Proxy&lt;/p&gt; 
-&lt;p&gt;- Your existing application delivery controllers and networks&lt;/p&gt; 
-&lt;p&gt;- Virtual Private Network (VPN) and Software-Defined Perimeter (SDP) applications&lt;/p&gt; 
-&lt;p&gt;You can bridge the gap and strengthen your security posture across all applications with Azure AD capabilities like Azure AD Conditional Access and Azure AD Identity Protection.&lt;/p&gt; 
-&lt;p&gt;For more details please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure hybrid access: Secure legacy apps with Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/secure-hybrid-access"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your on-premises and cloud legacy authentication applications are secured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD15" name="Use Azure AD B2B to invite guest users" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure AD B2B to invite guest users&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Azure Active Directory (Azure AD) business-to-business (B2B) collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with guest users from any other organization, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources. Developers can use Azure AD business-to-business APIs to customize the invitation process or write applications like self-service sign-up portals.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Invite guest users from the Azure AD portal&lt;/p&gt;
-
-  &lt;p&gt;As an administrator, you can add guest users to your organization in the Azure portal.&lt;/p&gt;
-
-  &lt;p&gt;- Create a new guest user in Azure AD, similar to how you'd add a new user.&lt;br /&gt;
-- Assign guest users to apps or groups.&lt;br /&gt;
-- Send an invitation email that contains a redemption link, or send a direct link to an app you want to share.&lt;br /&gt;
-- Guest users follow a few simple redemption steps to sign in.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is guest user access in Azure Active Directory B2B?" url="https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure AD B2B is used to invite guest users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="50"/>
-                <countermeasure ref="AZ-A04" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD1" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD16" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD2" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD4" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD6" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD7" mitigation="13"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="12"/>
-                <countermeasure ref="AZURE-AD1" mitigation="12"/>
-                <countermeasure ref="AZURE-AD16" mitigation="13"/>
-                <countermeasure ref="AZURE-AD2" mitigation="12"/>
-                <countermeasure ref="AZURE-AD4" mitigation="13"/>
-                <countermeasure ref="AZURE-AD6" mitigation="13"/>
-                <countermeasure ref="AZURE-AD7" mitigation="13"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD3" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZURE-AD3" mitigation="20"/>
-                <countermeasure ref="AZURE-AD5" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-16">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD18" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD18" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
-                                ports or security network configurations.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="no-alerts-access">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-DATA-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD8" mitigation="50"/>
-                    <countermeasure ref="AZURE-AD9" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD8" mitigation="50"/>
-                <countermeasure ref="AZURE-AD9" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-L01" mitigation="20"/>
-                    <countermeasure ref="AZ-L05" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD10" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD11" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-L01" mitigation="20"/>
-                <countermeasure ref="AZ-L05" mitigation="20"/>
-                <countermeasure ref="AZURE-AD10" mitigation="20"/>
-                <countermeasure ref="AZURE-AD11" mitigation="20"/>
-                <countermeasure ref="AZURE-AD12" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD13" mitigation="34"/>
-                    <countermeasure ref="AZURE-AD14" mitigation="33"/>
-                    <countermeasure ref="AZURE-AD15" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD13" mitigation="34"/>
-                <countermeasure ref="AZURE-AD14" mitigation="33"/>
-                <countermeasure ref="AZURE-AD15" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="17e1d146-ddd1-4fc7-8ee9-55fc9686f318" diagramComponentId="725a54fa-34f6-4418-a971-c9387f21718e" ref="550afa96-7bf8-47f9-81ba-151e8ff38483" name="Microsoft Azure Power BI" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-POWER-BI">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.114">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-AZURE-POWER-BI1" name="Connect Power BI tenant to a Private link endpoint" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Connect Power BI tenant to a Private link endpoint 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure networking provides the Azure Private Link feature that enables Power BI to provide secure access via Azure Networking private endpoints. With Azure Private Link and private endpoints, data traffic is sent privately using Microsoft's backbone network infrastructure, and thus the data doesn't traverse the Internet. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Private endpoints ensure that Power BI users use the Microsoft private network backbone when going to resources in the Power BI service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Power BI, you can configure and use an endpoint that enables your organization to access Power BI privately. To configure private endpoints you must be a Power BI administrator, and have permissions in Azure to create and configure resources such as Virtual Machines (VMs) and Virtual Networks (V-Net). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps that enable you to securely access Power BI from private endpoints are: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Enable private endpoints for Power BI 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Create a Power BI resource in the Azure portal 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Create a virtual network 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Create a virtual machine (VM) 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Create a private endpoint 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Connect to a VM using Remote Desktop (RDP) 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Access Power BI privately from the virtual machine 
-&lt;/div&gt; 
-&lt;div&gt;
-  8. Disable public access for Power BI 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For more information about each step, please see Refernce URL. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are a few considerations to keep in mind while working with private endpoints in Power BI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Any use of external images or themes are not available when using a private link environment. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - If Internet access is disabled, and if the dataset or dataflow is connecting to a Power BI dataset or dataflow as a data source, the connection will fail. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Usage metrics do not work when private endpoints are enabled. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Publish to Web is not supported when you enable Azure Private Link in Power BI. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Email subscriptions are not supported when you enable Block Public Internet Access in Power BI. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Microsoft Information Protection (MIP) does not currently support Private Links. This means that in Power BI Desktop running in an isolated network, the Sensitivity button will be grayed out, label information will not appear, and decryption of .pbix files will fail. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - To enable these capabilities in Power BI Desktop, admins can configure Service Tags for the underlying services that support MIP, EOP and AIP. Please make sure you understand the implications of using Service Tags in a Private Links isolated network. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Gateways enabled for Power BI private endpoints will not work properly with non-Power BI scenarios. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Private endpoints for accessing Power BI" url="https://docs.microsoft.com/en-us/power-bi/admin/service-security-private-links"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that your Power BI tenant is connected to a Private link endpoint and public internet access is disabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.083">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="C-AZURE-POWER-BI1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AZURE-POWER-BI1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 0211b8ac3a1d363f12b8b759fa8e18fb1970e277 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:21:29 -0400
Subject: [PATCH 14/28] Delete Templates/external-user-access-through-vpn.xml

---
 .../external-user-access-through-vpn.xml      | 19104 ----------------
 1 file changed, 19104 deletions(-)
 delete mode 100644 Templates/external-user-access-through-vpn.xml

diff --git a/Templates/external-user-access-through-vpn.xml b/Templates/external-user-access-through-vpn.xml
deleted file mode 100644
index ea7d356..0000000
--- a/Templates/external-user-access-through-vpn.xml
+++ /dev/null
@@ -1,19104 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="External user access through VPN" name="External user access through VPN" tags="Community">
-  <desc>&lt;p&gt;Remote Access Management&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTM4OCIgZHk9IjEwMDIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIxIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC41LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iQnVzaW5lc3MgQXBwIEhvc3RpbmciIHN0eWxlPSJpci5yZWY9ZmFmNjFkZDgtN2VhYi00YWMyLTkzYzgtYzQyZmQxZTg2MDQwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzhDOEM4Qztjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7c2tldGNoPTE7Z2xhc3M9MDtzaGFkb3c9MDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0MDEiIHk9Ii03NSIgd2lkdGg9IjY1MSIgaGVpZ2h0PSIzODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJCYWNrLWVuZCBzZXJ2ZXIiIHN0eWxlPSJpci5yZWY9MDE5M2VkODMtMzE5Mi00MDhkLTkzZDItZjIwNTM4MDk1Y2Y2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWJhY2stZW5kLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0ek9EQTFNemNnTUM0ek16azNORFJETUM0ek9EQTFNemNnTUM0ek1qWTBPRGtnTUM0ek9URXlPRElnTUM0ek1UVTNORFFnTUM0ME1EUTFNemNnTUM0ek1UVTNORFJJTUM0MU9EQTFNemRETUM0MU9UTTNPVElnTUM0ek1UVTNORFFnTUM0Mk1EUTFNemNnTUM0ek1qWTBPRGtnTUM0Mk1EUTFNemNnTUM0ek16azNORFJETUM0Mk1EUTFNemNnTUM0ek5USTVPVGtnTUM0MU9UTTNPVElnTUM0ek5qTTNORFFnTUM0MU9EQTFNemNnTUM0ek5qTTNORFJJTUM0ME1EUTFNemRETUM0ek9URXlPRElnTUM0ek5qTTNORFFnTUM0ek9EQTFNemNnTUM0ek5USTVPVGtnTUM0ek9EQTFNemNnTUM0ek16azNORFJhVFRBdU5EQTBOVE0zSURBdU5qWTNOelEwUXpBdU16a3hNamd5SURBdU5qWTNOelEwSURBdU16Z3dOVE0zSURBdU5qYzRORGc1SURBdU16Z3dOVE0zSURBdU5qa3hOelEwUXpBdU16Z3dOVE0zSURBdU56QTBPVGs1SURBdU16a3hNamd5SURBdU56RTFOelEwSURBdU5EQTBOVE0zSURBdU56RTFOelEwU0RBdU5URTBOVGsyUXpBdU5URTNORGszSURBdU5qazROek14SURBdU5USXlPVFkwSURBdU5qZ3lOVGswSURBdU5UTXdOVGczSURBdU5qWTNOelEwU0RBdU5EQTBOVE0zV2swd0xqVTJOelV5TmlBd0xqWXhPVGMwTkVnd0xqUXdORFV6TjBNd0xqTTVNVEk0TWlBd0xqWXhPVGMwTkNBd0xqTTRNRFV6TnlBd0xqWXdPRGs1T1NBd0xqTTRNRFV6TnlBd0xqVTVOVGMwTkVNd0xqTTRNRFV6TnlBd0xqVTRNalE0T1NBd0xqTTVNVEk0TWlBd0xqVTNNVGMwTkNBd0xqUXdORFV6TnlBd0xqVTNNVGMwTkVnd0xqVTRNRFV6TjBNd0xqVTVNek0xTlNBd0xqVTNNVGMwTkNBd0xqWXdNemd5TnlBd0xqVTRNVGM1TXlBd0xqWXdORFV3TXlBd0xqVTVORFEwTWtNd0xqVTVNVEF6TnlBd0xqWXdNVEl4TXlBd0xqVTNPRFl3T1NBd0xqWXdPVGMwT0NBd0xqVTJOelV5TmlBd0xqWXhPVGMwTkZwTk1DNDJNelkxTXpnZ01DNDFPREl5T0RSV01DNHlPRE0zTkRSRE1DNDJNelkxTXpnZ01DNHlOVGN5TXpVZ01DNDJNVFV3TkRjZ01DNHlNelUzTkRRZ01DNDFPRGcxTXpjZ01DNHlNelUzTkRSSU1DNHpPVFkxTXpkRE1DNHpOekF3TWpnZ01DNHlNelUzTkRRZ01DNHpORGcxTXpjZ01DNHlOVGN5TXpVZ01DNHpORGcxTXpjZ01DNHlPRE0zTkRSV01DNDNNekUzTkRSRE1DNHpORGcxTXpjZ01DNDNOVGd5TlRRZ01DNHpOekF3TWpnZ01DNDNOemszTkRRZ01DNHpPVFkxTXpjZ01DNDNOemszTkRSSU1DNDFNVFl3TVRaRE1DNDFNVGszTXpJZ01DNDNPVFk0TmpnZ01DNDFNall3TnlBd0xqZ3hNekF4TlNBd0xqVXpORFU0TnlBd0xqZ3lOemMwTkVnd0xqTTVOalV6TjBNd0xqTTBNelV4TnlBd0xqZ3lOemMwTkNBd0xqTXdNRFV6TnlBd0xqYzRORGMyTXlBd0xqTXdNRFV6TnlBd0xqY3pNVGMwTkZZd0xqSTRNemMwTkVNd0xqTXdNRFV6TnlBd0xqSXpNRGN5TlNBd0xqTTBNelV4TnlBd0xqRTROemMwTkNBd0xqTTVOalV6TnlBd0xqRTROemMwTkVnd0xqVTRPRFV6TjBNd0xqWTBNVFUxTnlBd0xqRTROemMwTkNBd0xqWTRORFV6TnlBd0xqSXpNRGN5TlNBd0xqWTRORFV6TnlBd0xqSTRNemMwTkZZd0xqVTNOamMyTmtNd0xqWTRNamc1TlNBd0xqVTNOamN4T1NBd0xqWTRNVEkwTmlBd0xqVTNOalk1TlNBd0xqWTNPVFU1TWlBd0xqVTNOalk1TlVNd0xqWTJORGN3TnlBd0xqVTNOalk1TlNBd0xqWTFNREkzTlNBd0xqVTNPRFl6T0NBd0xqWXpOalV6T0NBd0xqVTRNakk0TkZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzROREkxTnlBd0xqY3dOVGsyTjB3d0xqYzRNVEl6TlNBd0xqY3dORGc1TWt3d0xqYzFOVFk0TkNBd0xqWTFOams0TkVNd0xqYzBOVGt3TmlBd0xqWXpPRFkxSURBdU56STJPREU0SURBdU5qSTNNVGszSURBdU56QTJNRE01SURBdU5qSTNNVGszU0RBdU5qUXhOekEzUXpBdU5qRTNORGtnTUM0Mk1qY3hPVGNnTUM0MU9UVTVPRGtnTUM0Mk5ESTJPVFFnTUM0MU9EZ3pNeUF3TGpZMk5UWTJPVXd3TGpVM05qRTFNeUF3TGpjd01qSXdNa013TGpVMU5UWXpOQ0F3TGpjeE1EZzBNeUF3TGpVME1UYzBPQ0F3TGpjek1UQTNPU0F3TGpVME1UYzBPQ0F3TGpjMU5EQTFNVll3TGpjM09URXhNVU13TGpVME1UYzBPQ0F3TGpjNU5UQTROQ0F3TGpVMU1USTFOeUF3TGpnd09EZ3pOaUF3TGpVMk5Ea3lNaUF3TGpneE5UQXhOa013TGpVMk9EWXdOU0F3TGpnek5qRTNJREF1TlRnM01EVTNJREF1T0RVeU1qVTBJREF1TmpBNU1qWTFJREF1T0RVeU1qVTBRekF1TmpNd01qTTRJREF1T0RVeU1qVTBJREF1TmpRM09EWXhJREF1T0RNM09UQTVJREF1TmpVeU9EVTRJREF1T0RFNE5EazJTREF1TnpRMU56RTNRekF1TnpVd056RTBJREF1T0RNM09UQTVJREF1TnpZNE16TTNJREF1T0RVeU1qVTBJREF1TnpnNU16RWdNQzQ0TlRJeU5UUkRNQzQ0TVRFMU1Ua2dNQzQ0TlRJeU5UUWdNQzQ0TWprNU55QXdMamd6TmpFM0lEQXVPRE16TmpVeklEQXVPREUxTURFMlF6QXVPRFEzTXpFNElEQXVPREE0T0RNMklEQXVPRFUyT0RJM0lEQXVOemsxTURnMElEQXVPRFUyT0RJM0lEQXVOemM1TVRFeFZqQXVOemN4TkRnM1F6QXVPRFUyT0RJM0lEQXVOelEzTmpnMElEQXVPRFF4T0RRNElEQXVOekkyTkRVMklEQXVPREU1TkRJeUlEQXVOekU0TkRjNFREQXVOemcxTkRReUlEQXVOekEyTXpnNVZqQXVOekExT1RZM1NEQXVOemcwTWpVM1drMHdMall3T1RZNE1TQXdMalkzTWpjNE5rTXdMall4TkRJM05pQXdMalkxT1RBd01TQXdMall5TnpFM055QXdMalkwT1Rjd015QXdMalkwTVRjd055QXdMalkwT1Rjd00wZ3dMalkyTlRVeU9WWXdMamN3TlRrMk4wZ3dMalU1T0RZeU1Vd3dMall3T1RZNE1TQXdMalkzTWpjNE5scE5NQzQzTlRZek1ESWdNQzQzTURVNU5qZElNQzQyT0Rnd016VldNQzQyTkRrM01ETklNQzQzTURZd016bERNQzQzTVRnMU1EY2dNQzQyTkRrM01ETWdNQzQzTWprNU5Ua2dNQzQyTlRZMU56UWdNQzQzTXpVNE1qWWdNQzQyTmpjMU56Vk1NQzQzTlRZek1ESWdNQzQzTURVNU5qZGFUVEF1TlRnMk56VTVJREF1T0RBM01qUXpRekF1TlRnMk56VTVJREF1TnprME9ERXpJREF1TlRrMk9ETTFJREF1TnpnME56TTNJREF1TmpBNU1qWTFJREF1TnpnME56TTNRekF1TmpJeE5qazFJREF1TnpnME56TTNJREF1TmpNeE56Y3hJREF1TnprME9ERXpJREF1TmpNeE56Y3hJREF1T0RBM01qUXpRekF1TmpNeE56Y3hJREF1T0RFNU5qY3lJREF1TmpJeE5qazFJREF1T0RJNU56UTVJREF1TmpBNU1qWTFJREF1T0RJNU56UTVRekF1TlRrMk9ETTFJREF1T0RJNU56UTVJREF1TlRnMk56VTVJREF1T0RFNU5qY3lJREF1TlRnMk56VTVJREF1T0RBM01qUXpXazB3TGpjNE9UTXhJREF1TnpnME56TTNRekF1T0RBeE56UWdNQzQzT0RRM016Y2dNQzQ0TVRFNE1UWWdNQzQzT1RRNE1UTWdNQzQ0TVRFNE1UWWdNQzQ0TURjeU5ETkRNQzQ0TVRFNE1UWWdNQzQ0TVRrMk56SWdNQzQ0TURFM05DQXdMamd5T1RjME9TQXdMamM0T1RNeElEQXVPREk1TnpRNVF6QXVOemMyT0RneElEQXVPREk1TnpRNUlEQXVOelkyT0RBMElEQXVPREU1TmpjeUlEQXVOelkyT0RBMElEQXVPREEzTWpRelF6QXVOelkyT0RBMElEQXVOemswT0RFeklEQXVOemMyT0RneElEQXVOemcwTnpNM0lEQXVOemc1TXpFZ01DNDNPRFEzTXpkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnpZNElpQm9aV2xuYUhROUlqQXVOelk0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0eE1EZzJORE1nTUM0eE1qTTJOVGNwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtza2V0Y2g9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyODkiIHk9IjE1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iV2ViIFNlcnZpY2UgLT4gQmFjay1lbmQgc2VydmVyIiBzdHlsZT0iaXIucmVmPWRmNzUzN2U2LTllZjQtNDBmNy1iZjQyLTM2ODBjMTVjNjY5OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIzIiBzb3VyY2U9IjciIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjciIHZhbHVlPSJXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj04ODg3MmNkOC04MWYwLTQ1MTgtYmI1OS1lM2VkNzhjNTZmMDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd055QXdMamcyTmpRM0lEQXVOVFk1TXpNMklEQXVPRGd6TXpZM1NEQXVNemcxTURFNVF6QXVNekl4TlRBM0lEQXVPRGd6TXpZM0lEQXVNamN3TURJZ01DNDRNekU0TnprZ01DNHlOekF3TWlBd0xqYzJPRE0yTjFZd0xqSXpNVFk1T1VNd0xqSTNNREF5SURBdU1UWTRNVGczSURBdU16SXhOVEEzSURBdU1URTJOams1SURBdU16ZzFNREU1SURBdU1URTJOams1U0RBdU5qRTFNREpETUM0Mk56ZzFNek1nTUM0eE1UWTJPVGtnTUM0M016QXdNaUF3TGpFMk9ERTROeUF3TGpjek1EQXlJREF1TWpNeE5qazVWakF1TmpJd05qQXhRekF1TnpJd05EVTVJREF1TmpFNE9EYzVJREF1TnpFd05qRXlJREF1TmpFM09UZ2dNQzQzTURBMU5UWWdNQzQyTVRjNU9FTXdMalk1TURrNU9TQXdMall4TnprNElEQXVOamd4TmpNeUlEQXVOakU0TnpreUlEQXVOamN5TlRJZ01DNDJNakF6TlRGYVRUQXVNelkxT0RVeklEQXVOakExTkRWRE1DNHpOalU0TlRNZ01DNDFPRGsxTnpFZ01DNHpOemczTWpVZ01DNDFOelkzSURBdU16azBOakF6SURBdU5UYzJOMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpVM05qY2dNQzQyTXpReE9EWWdNQzQxT0RrMU56RWdNQzQyTXpReE9EWWdNQzQyTURVME5VTXdMall6TkRFNE5pQXdMall5TVRNeU9DQXdMall5TVRNeE5DQXdMall6TkRJZ01DNDJNRFUwTXpZZ01DNDJNelF5U0RBdU16azBOakF6UXpBdU16YzROekkxSURBdU5qTTBNaUF3TGpNMk5UZzFNeUF3TGpZeU1UTXlPQ0F3TGpNMk5UZzFNeUF3TGpZd05UUTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJRekF1TnpJNE1qSTBJREF1T0Rjek1UWTVJREF1TnpFek5UZ3hJREF1T0RrNU5ETTBJREF1TmprNU1ESXlJREF1T0RrNU5ETTBRekF1TmpnME9UQXpJREF1T0RrNU5ETTBJREF1Tmpjd056QTNJREF1T0RjME56TTNJREF1TmpZek1Ua3pJREF1T0RNNE1EVTRUREF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJTREF1TmpZeU5UQTRXazB3TGpVNU16WTBOQ0F3TGpnek5EVTROa3d3TGpZME5EUXlPQ0F3TGpnek5EVTRORU13TGpZME9EY3pNU0F3TGpnMU9URTBNeUF3TGpZMU5qQXlNeUF3TGpnNE1EQXpOeUF3TGpZMk5UVTJOeUF3TGpnNU5EWTJRekF1TmpNMU16TTVJREF1T0RnMU56TXlJREF1TmpFd01UY3pJREF1T0RZMU1ETTFJREF1TlRrMU16Y2dNQzQ0TXpjNE56Wk1NQzQxT1RNMk5EUWdNQzQ0TXpRMU9EWmFUVEF1TnpVek5qRTFJREF1T0RNME5UZzBUREF1T0RBME16azVJREF1T0RNME5UZzJRekF1TnpnNU9EYzJJREF1T0RZek16WWdNQzQzTmpNNU1UUWdNQzQ0T0RVek56VWdNQzQzTXpJME9EZ2dNQzQ0T1RRMk5UVkRNQzQzTkRFek9EZ2dNQzQ0T0RFd01ERWdNQzQzTkRnek16SWdNQzQ0TmpFNE9UUWdNQzQzTlRJM01UVWdNQzQ0TXprME5EVk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUk1NQzQ0TURRek9Ua2dNQzQ0TXpRMU9EWk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUmFUVEF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhRekF1T0RFMk1UYzJJREF1TnpZMU5UTTBJREF1T0RFMk9UZzVJREF1Tnpjek5ESTBJREF1T0RFMk9UZzVJREF1TnpneE5UQTBRekF1T0RFMk9UZzVJREF1Tnprek9ETXpJREF1T0RFMU1EazNJREF1T0RBMU56SXhJREF1T0RFeE5UZzVJREF1T0RFMk9Ea3pTREF1TnpVMk1USXlRekF1TnpVM016WTBJREF1T0RBMU5UazRJREF1TnpVNE1ERTBJREF1Tnprek56TXlJREF1TnpVNE1ERTBJREF1TnpneE5UQTBRekF1TnpVNE1ERTBJREF1TnpjMk1UUTJJREF1TnpVM09EZzVJREF1Tnpjd09EVTJJREF1TnpVM05qUTBJREF1TnpZMU5qVTBUREF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhUREF1TnpVM01UZzRJREF1TnpVM09URTRXazB3TGpVNE16UXhOQ0F3TGpjMU56a3hNVXd3TGpZME1EZzFOaUF3TGpjMU56a3hPRU13TGpZME1ETXhJREF1TnpZMU5UZzBJREF1TmpRd01ESTVJREF1Tnpjek5EWTJJREF1TmpRd01ESTVJREF1TnpneE5UQTBRekF1TmpRd01ESTVJREF1TnpreE1qZzJJREF1TmpRd05EUTJJREF1T0RBd09ETTNJREF1TmpReE1qUTRJREF1T0RFd01EUTVUREF1TmpReE9USXlJREF1T0RFMk9Ea3pTREF1TlRnMk5EVTFRekF1TlRneU9UUTJJREF1T0RBMU56SXhJREF1TlRneE1EVTFJREF1Tnprek9ETXpJREF1TlRneE1EVTFJREF1TnpneE5UQTBRekF1TlRneE1EVTFJREF1Tnpjek5ESTBJREF1TlRneE9EWTNJREF1TnpZMU5UTTBJREF1TlRnek5ERTBJREF1TnpVM09URXhXazB3TGpZMU9EWXpJREF1TnpVM09URXlTREF1TnpNNU5ERXpRekF1TnpRd01EQTJJREF1TnpZMU5USTNJREF1TnpRd016SXlJREF1Tnpjek5ERTJJREF1TnpRd016SXlJREF1TnpneE5UQTBRekF1TnpRd016SXlJREF1TnpreE16ZzBJREF1TnpNNU9EVXhJREF1T0RBd09UWTJJREF1TnpNNE9UYzVJREF1T0RFd01URTFUREF1TnpNNE1qVXlJREF1T0RFMk9Ea3pTREF1TmpVNU56a3hRekF1TmpVNE5EVTRJREF1T0RBMU56TTRJREF1TmpVM056SXhJREF1Tnprek9EVTBJREF1TmpVM056SXhJREF1TnpneE5UQTBRekF1TmpVM056SXhJREF1TnpjMU5ETTRJREF1TmpVM09EazVJREF1TnpZNU5EZzBJREF1TmpVNE1qTTRJREF1TnpZek5qY3pUREF1TmpVNE5qTWdNQzQzTlRjNU1USklNQzQzTXprME1UTklNQzQyTlRnMk0xcE5NQzQzTXpNM05Ea2dNQzQyTnpBek5UaE1NQzQzTXpJME56Y2dNQzQyTmpnek5VTXdMamMyT0RBM055QXdMalkzT0RnMU9TQXdMamM1TmpZMk9DQXdMamN3TlRjeElEQXVPREE1TlRZeUlEQXVOelF3TWpFNVREQXVOelUxTkRFMElEQXVOelF3TWpJeVF6QXVOelV4TmpreUlEQXVOekV4TnpFMUlEQXVOelEwTVRNeUlEQXVOamczTWpNeklEQXVOek16TnpRNUlEQXVOamN3TXpVNFREQXVOek15TkRjM0lEQXVOalk0TXpWTU1DNDNNek0zTkRrZ01DNDJOekF6TlRoYVRUQXVOalkwTVRNZ01DNDJOamczT0RSTU1DNDJOalUxTmpZZ01DNDJOamd6TlVNd0xqWTFOVEUzT0NBd0xqWTROREkyTnlBd0xqWTBOelExTnlBd0xqY3dOell4TmlBd0xqWTBNek0xTmlBd0xqY3pOVEF6TkV3d0xqWTBNall6SURBdU56UXdNakl5VERBdU5UZzRORGd4SURBdU56UXdNakU1UXpBdU5qQXhNakF4SURBdU56QTJNVGMySURBdU5qSTVNVGs0SURBdU5qYzVOVGcwSURBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVXd3TGpZMk5ERXpJREF1TmpZNE56ZzBXazB3TGpZNU9UQXlNaUF3TGpZMk16VTNORU13TGpjeE5EVTNOeUF3TGpZMk16VTNOQ0F3TGpjek1ESXlOaUF3TGpZNU16VTFNeUF3TGpjek5qa3pJREF1TnpNMk5UQTJUREF1TnpNM05EZ3pJREF1TnpRd01qRTVTREF1TmpZd05UWXhRekF1TmpZMk9USXpJREF1TmprMU1qa3hJREF1Tmpnek1ESXlJREF1TmpZek5UYzBJREF1TmprNU1ESXlJREF1TmpZek5UYzBXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU1pSWdhR1ZwWjJoMFBTSXdMamt5SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05EQXdNemt4SURBdU1EUXdNRE01TVNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYzIiB5PSIyNzIiIHdpZHRoPSI2OCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJJbnRlcm5hbCBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9NzBmYmI0M2MtODUzOC00ZDJjLTlkYWMtMTdlMWExNzNkODgyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWludGVybmFsLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE15QXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE15QXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak01TkRZd015QXdMalk1TVRVM09FTXdMak0zT0RjeU5TQXdMalk1TVRVM09DQXdMak0yTlRnMU15QXdMamN3TkRRMUlEQXVNelkxT0RVeklEQXVOekl3TXpJNFF6QXVNelkxT0RVeklEQXVOek0yTWpBMklEQXVNemM0TnpJMUlEQXVOelE1TURjNElEQXVNemswTmpBeklEQXVOelE1TURjNFNEQXVOVGN3TURFNVZqQXVOamt4TlRjNFNEQXVNemswTmpBeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak13TWpFNElEQXVOakU1T1RFeFNEQXVOakF3TURFNVF6QXVOVGc1TWpZeklEQXVOakU1T1RFeElEQXVOVGM1T0RJNUlEQXVOakkxTlRjeUlEQXVOVGMwTlRNeklEQXVOak0wTURjNFNEQXVNemswTmpBelF6QXVNemM0TnpJMUlEQXVOak0wTURjNElEQXVNelkxT0RVeklEQXVOakl4TWpBMklEQXVNelkxT0RVeklEQXVOakExTXpJNFF6QXVNelkxT0RVeklEQXVOVGc1TkRVZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTlNBd0xqWXpOREU0TmlBd0xqWXdOVE15T0VNd0xqWXpOREU0TmlBd0xqWXhNRFkxTVNBd0xqWXpNamMwSURBdU5qRTFOak0ySURBdU5qTXdNakU0SURBdU5qRTVPVEV4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qY3lOVEU1SURBdU5qRTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUzTURBeE9WWXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1UazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16TTBNekVnTUM0Mk5UQXdNalJETUM0Mk1UVXdNakVnTUM0Mk5UQXdNalFnTUM0Mk1EQXdPVGdnTUM0Mk5qUTFOelVnTUM0Mk1EQXdPVGdnTUM0Mk9ESTFNalJXTUM0NE9Ua3hPVEZETUM0Mk1EQXdPVGdnTUM0NU1EVXhOelFnTUM0Mk1EVXdOeklnTUM0NU1UQXdNalFnTUM0Mk1URXlNRGtnTUM0NU1UQXdNalJJTUM0Mk5EUTFOREpXTUM0NE5UVTROVGhETUM0Mk5EUTFORElnTUM0NE5EazROelVnTUM0Mk5EazFNVFlnTUM0NE5EVXdNalFnTUM0Mk5UVTJOVE1nTUM0NE5EVXdNalJJTUM0M05EUTFOREZETUM0M05UQTJOemNnTUM0NE5EVXdNalFnTUM0M05UVTJOVElnTUM0NE5EazROelVnTUM0M05UVTJOVElnTUM0NE5UVTROVGhXTUM0NU1UQXdNalJJTUM0M09EZzVPRFZETUM0M09UVXhNakVnTUM0NU1UQXdNalFnTUM0NE1EQXdPVFlnTUM0NU1EVXhOelFnTUM0NE1EQXdPVFlnTUM0NE9Ua3hPVEZXTUM0M09UQTROVGhETUM0NE1EQXdPVFlnTUM0M056STVNRGtnTUM0M09EVXhOeklnTUM0M05UZ3pOVGdnTUM0M05qWTNOak1nTUM0M05UZ3pOVGhJTUM0M05UVTJOVEpXTUM0Mk9ESTFNalJETUM0M05UVTJOVElnTUM0Mk5qUTFOelVnTUM0M05EQTNNamdnTUM0Mk5UQXdNalFnTUM0M01qSXpNVGtnTUM0Mk5UQXdNalJJTUM0Mk16TTBNekZhVFRBdU5qWTJOelkwSURBdU56QTBNVGt4UXpBdU5qWTJOelkwSURBdU56RXdNVGMwSURBdU5qWXhOemc1SURBdU56RTFNREkwSURBdU5qVTFOalV6SURBdU56RTFNREkwUXpBdU5qUTVOVEUySURBdU56RTFNREkwSURBdU5qUTBOVFF5SURBdU56RXdNVGMwSURBdU5qUTBOVFF5SURBdU56QTBNVGt4UXpBdU5qUTBOVFF5SURBdU5qazRNakE0SURBdU5qUTVOVEUySURBdU5qa3pNelU0SURBdU5qVTFOalV6SURBdU5qa3pNelU0UXpBdU5qWXhOemc1SURBdU5qa3pNelU0SURBdU5qWTJOelkwSURBdU5qazRNakE0SURBdU5qWTJOelkwSURBdU56QTBNVGt4V2swd0xqWTJOamMyTkNBd0xqYzFPRE0xT0VNd0xqWTJOamMyTkNBd0xqYzJORE0wTVNBd0xqWTJNVGM0T1NBd0xqYzJPVEU1TVNBd0xqWTFOVFkxTXlBd0xqYzJPVEU1TVVNd0xqWTBPVFV4TmlBd0xqYzJPVEU1TVNBd0xqWTBORFUwTWlBd0xqYzJORE0wTVNBd0xqWTBORFUwTWlBd0xqYzFPRE0xT0VNd0xqWTBORFUwTWlBd0xqYzFNak0zTlNBd0xqWTBPVFV4TmlBd0xqYzBOelV5TkNBd0xqWTFOVFkxTXlBd0xqYzBOelV5TkVNd0xqWTJNVGM0T1NBd0xqYzBOelV5TkNBd0xqWTJOamMyTkNBd0xqYzFNak0zTlNBd0xqWTJOamMyTkNBd0xqYzFPRE0xT0ZwTk1DNDJOalkzTmpRZ01DNDRNVEkxTWpSRE1DNDJOalkzTmpRZ01DNDRNVGcxTURnZ01DNDJOakUzT0RrZ01DNDRNak16TlRnZ01DNDJOVFUyTlRNZ01DNDRNak16TlRoRE1DNDJORGsxTVRZZ01DNDRNak16TlRnZ01DNDJORFExTkRJZ01DNDRNVGcxTURnZ01DNDJORFExTkRJZ01DNDRNVEkxTWpSRE1DNDJORFExTkRJZ01DNDRNRFkxTkRFZ01DNDJORGsxTVRZZ01DNDRNREUyT1RFZ01DNDJOVFUyTlRNZ01DNDRNREUyT1RGRE1DNDJOakUzT0RrZ01DNDRNREUyT1RFZ01DNDJOalkzTmpRZ01DNDRNRFkxTkRFZ01DNDJOalkzTmpRZ01DNDRNVEkxTWpSYVRUQXVOekV4TWpBNElEQXVOekEwTVRreFF6QXVOekV4TWpBNElEQXVOekV3TVRjMElEQXVOekEyTWpNeklEQXVOekUxTURJMElEQXVOekF3TURrM0lEQXVOekUxTURJMFF6QXVOamt6T1RZZ01DNDNNVFV3TWpRZ01DNDJPRGc1T0RZZ01DNDNNVEF4TnpRZ01DNDJPRGc1T0RZZ01DNDNNRFF4T1RGRE1DNDJPRGc1T0RZZ01DNDJPVGd5TURnZ01DNDJPVE01TmlBd0xqWTVNek0xT0NBd0xqY3dNREE1TnlBd0xqWTVNek0xT0VNd0xqY3dOakl6TXlBd0xqWTVNek0xT0NBd0xqY3hNVEl3T0NBd0xqWTVPREl3T0NBd0xqY3hNVEl3T0NBd0xqY3dOREU1TVZwTk1DNDNNVEV5TURnZ01DNDNOVGd6TlRoRE1DNDNNVEV5TURnZ01DNDNOalF6TkRFZ01DNDNNRFl5TXpNZ01DNDNOamt4T1RFZ01DNDNNREF3T1RjZ01DNDNOamt4T1RGRE1DNDJPVE01TmlBd0xqYzJPVEU1TVNBd0xqWTRPRGs0TmlBd0xqYzJORE0wTVNBd0xqWTRPRGs0TmlBd0xqYzFPRE0xT0VNd0xqWTRPRGs0TmlBd0xqYzFNak0zTlNBd0xqWTVNemsySURBdU56UTNOVEkwSURBdU56QXdNRGszSURBdU56UTNOVEkwUXpBdU56QTJNak16SURBdU56UTNOVEkwSURBdU56RXhNakE0SURBdU56VXlNemMxSURBdU56RXhNakE0SURBdU56VTRNelU0V2swd0xqY3hNVEl3T0NBd0xqZ3hNalV5TkVNd0xqY3hNVEl3T0NBd0xqZ3hPRFV3T0NBd0xqY3dOakl6TXlBd0xqZ3lNek0xT0NBd0xqY3dNREE1TnlBd0xqZ3lNek0xT0VNd0xqWTVNemsySURBdU9ESXpNelU0SURBdU5qZzRPVGcySURBdU9ERTROVEE0SURBdU5qZzRPVGcySURBdU9ERXlOVEkwUXpBdU5qZzRPVGcySURBdU9EQTJOVFF4SURBdU5qa3pPVFlnTUM0NE1ERTJPVEVnTUM0M01EQXdPVGNnTUM0NE1ERTJPVEZETUM0M01EWXlNek1nTUM0NE1ERTJPVEVnTUM0M01URXlNRGdnTUM0NE1EWTFOREVnTUM0M01URXlNRGdnTUM0NE1USTFNalJhVFRBdU56VTFOalV5SURBdU9ERXlOVEkwUXpBdU56VTFOalV5SURBdU9ERTROVEE0SURBdU56VXdOamMzSURBdU9ESXpNelU0SURBdU56UTBOVFF4SURBdU9ESXpNelU0UXpBdU56TTROREEwSURBdU9ESXpNelU0SURBdU56TXpORE1nTUM0NE1UZzFNRGdnTUM0M016TTBNeUF3TGpneE1qVXlORU13TGpjek16UXpJREF1T0RBMk5UUXhJREF1TnpNNE5EQTBJREF1T0RBeE5qa3hJREF1TnpRME5UUXhJREF1T0RBeE5qa3hRekF1TnpVd05qYzNJREF1T0RBeE5qa3hJREF1TnpVMU5qVXlJREF1T0RBMk5UUXhJREF1TnpVMU5qVXlJREF1T0RFeU5USTBXazB3TGpjek16UXpJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TnpFeE1qWTBWakF1T1RFd01ESTBTREF1TnpNek5ETmFUVEF1TmpnNU1EUXlJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TmpZMk56WTBWakF1T1RFd01ESTBTREF1TmpnNU1EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEyNiIgeT0iMjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyMSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC4yNjU7ZW50cnlZPTAuMTI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzaGFkb3c9MDtsYWJlbEJhY2tncm91bmRDb2xvcj1ub25lO2xhYmVsQm9yZGVyQ29sb3I9bm9uZTtmb250Q29sb3I9I0ZGRkZGRjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtzdHJva2VXaWR0aD0yO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jYjlkMGU2OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijk5IiB0YXJnZXQ9IjciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHg9Ii0wLjExMDgiIHk9IjEzIiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCBhcz0ib2Zmc2V0Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iIiBzdHlsZT0iZm9udENvbG9yPSM0NjQ5NUQ7dmVydGljYWxBbGlnbj10b3A7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbFBvc2l0aW9uPWNlbnRlcjthbGlnbj1jZW50ZXI7aHRtbD0xO291dGxpbmVDb25uZWN0PTA7ZmlsbENvbG9yPSNCMkM5QUI7c3Ryb2tlQ29sb3I9Izc4OEFBMztncmFkaWVudERpcmVjdGlvbj1ub3J0aDtzdHJva2VXaWR0aD0yO3NoYXBlPW14Z3JhcGgubmV0d29ya3MuZmlyZXdhbGw7c2tldGNoPTE7cm91bmRlZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ3IiB5PSIyOSIgd2lkdGg9Ijg3IiBoZWlnaHQ9IjgzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzAwNkVBRjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9IzFiYTFlMjsiIHBhcmVudD0iMyIgc291cmNlPSI5NyIgdGFyZ2V0PSIxOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ0IiB2YWx1ZT0iTERBUCBEaXJlY3RvcnkiIHN0eWxlPSJpci5yZWY9NDI1YWI0ZjAtMzBhMi00MWJjLWJjZWYtODk0MDJmNWEyY2I1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWxkYXAtZGlyZWN0b3J5O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqTXhNak01TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVOamczT1RJeElEQXVNRGM1T1RVMk1TQXdMamcwTURFMU5pQXdMakUxTlRFek5pQXdMamcwTURFMU5pQXdMakkwTnprMU5sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalEwTlRFME15QXdMamMwTVRFelF6QXVORFF3TURJeklEQXVOelF6TmpZeklEQXVORE0wTURVZ01DNDNORFEyTWpNZ01DNDBNamN6TlRZZ01DNDNORFF3TXpaRE1DNDBNakExTVRJZ01DNDNORE16TWpVZ01DNDBNVE0zTWpFZ01DNDNOREkxTnlBd0xqUXdOams0TXlBd0xqYzBNVGMzUXpBdU5EQTNOREVnTUM0M016TTFOVFlnTUM0ME1EYzNOalVnTUM0M01qVTBOREVnTUM0ME1EZ3dOU0F3TGpjeE56UXlNME13TGpRd09ESTBOU0F3TGpjd09UWXhPU0F3TGpRd09ETTNPQ0F3TGpjd01Ua3dNeUF3TGpRd09EUTFJREF1TmprME1qYzJRekF1TkRBNE5ERTBJREF1TmpnMk9ESTNJREF1TkRBNE16UXpJREF1TmpjNU5EWTNJREF1TkRBNE1qTTJJREF1TmpjeU1UazJRekF1TkRBNE1EUXhJREF1TmpZMU1EZzFJREF1TkRBM09ERWdNQzQyTlRnd05EVWdNQzQwTURjMU5ETWdNQzQyTlRFd056WkRNQzQwTVRRMU1USWdNQzQyTlRJeU5qY2dNQzQwTWpFMU1EY2dNQzQyTlRNME1qTWdNQzQwTWpnMU15QXdMalkxTkRVME0wTXdMalF6TXprNU5pQXdMalkxTlRNM0lEQXVORE00T1RBeklEQXVOalUzTURVZ01DNDBORE14T1RZZ01DNDJOVGsxT0RORE1DNDBORGMxTVRZZ01DNDJOakl4TVRZZ01DNDBOVEV5TlNBd0xqWTJOVFV3TXlBd0xqUTFORE0zSURBdU5qWTVOemsyUXpBdU5EVTNORGtnTUM0Mk56UXdNellnTUM0ME5UazVORE1nTUM0Mk56ZzJNak1nTUM0ME5qRTJOU0F3TGpZNE16WXpOa013TGpRMk16TTFOaUF3TGpZNE9EY3dNeUF3TGpRMk5ETXhOaUF3TGpZNU5ESXlNeUF3TGpRMk5EVTFOaUF3TGpjd01ESXlNME13TGpRMk5EY3hOaUF3TGpjd05UWTVJREF1TkRZME1qRWdNQzQzTVRBNU5ETWdNQzQwTmpJNU9ETWdNQzQzTVRVNU9ETkRNQzQwTmpFNE16WWdNQzQzTWpFeE1ETWdNQzQwTlRrNE5qTWdNQzQzTWpVNU5UWWdNQzQwTlRjd016WWdNQzQzTXpBMU4wTXdMalExTkRNeE5pQXdMamN6TlRFd015QXdMalExTURNeE5pQXdMamN6T0RZeU15QXdMalEwTlRFME15QXdMamMwTVRFeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFk1TURrZ01DNDJPVFl5TlVNd0xqVTNNVE00TXlBd0xqY3dNalF3TVNBd0xqVTNNelkyTnlBd0xqY3dPRFkxSURBdU5UYzFPVFF6SURBdU56RTBPVGsyUXpBdU5UWTVPREkzSURBdU56RTFOVFkxSURBdU5UWXpOamswSURBdU56RTJNRGs1SURBdU5UVTNOVFF6SURBdU56RTJOVGsyUXpBdU5UVXhNemt5SURBdU56RTJPVGczSURBdU5UUTFNak15SURBdU56RTNNelV5SURBdU5UTTVNRFl6SURBdU56RTNOamxETUM0MU5ERXpNakVnTUM0M01URXdNRFVnTUM0MU5ETTJNVFFnTUM0M01EUTBNVGtnTUM0MU5EVTVORE1nTUM0Mk9UYzVNME13TGpVME9ETXlOU0F3TGpZNU1UWXhPU0F3TGpVMU1EYzBNeUF3TGpZNE5UUXdOU0F3TGpVMU16RTVOaUF3TGpZM09USTVRekF1TlRVMU1Ea2dNQzQyTnpRME9TQXdMalUxTmpZeElEQXVOamN3TlRReklEQXVOVFUzTmpVZ01DNDJOamN6TVRaRE1DNDFOVGcyT1NBd0xqWTNNRGd4SURBdU5UWXdNVFUySURBdU5qYzBOVGNnTUM0MU5qSXdNak1nTUM0Mk56ZzJNak5ETUM0MU5qUXpPRGNnTUM0Mk9EUTBNREVnTUM0MU5qWTNORE1nTUM0Mk9UQXlOellnTUM0MU5qa3dPU0F3TGpZNU5qSTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBeE5ETTJJREF1TmpZeE5qbERNQzQyT1RnMk16WWdNQzQyTmpZMU55QXdMalk1TkRJek5pQXdMalkyT1RneU15QXdMalk0T0RJMk15QXdMalkzTVRRM05rTXdMalk0TXpFNU5pQXdMalkzTWpnMk15QXdMalkzT0RFeU1TQXdMalkzTkRJeU15QXdMalkzTXpBek5pQXdMalkzTlRVMU5rTXdMalkyTnpnNU9DQXdMalkzTmpnM01pQXdMalkyTWpjME15QXdMalkzT0RFMk1TQXdMalkxTnpVM0lEQXVOamM1TkRJelF6QXVOalUzT0RFNElEQXVOamN6TVRZMUlEQXVOalU0TVRBeklEQXVOalkyT1RjNUlEQXVOalU0TkRJeklEQXVOall3T0RZelF6QXVOalU0T0RVZ01DNDJOVFE1TWpVZ01DNDJOVGt6TXprZ01DNDJORGt3TmpjZ01DNDJOVGs0T1NBd0xqWTBNekk1UXpBdU5qWTBPRE15SURBdU5qUXhPRE15SURBdU5qWTVOelEzSURBdU5qUXdNek01SURBdU5qYzBOak0ySURBdU5qTTRPREZETUM0Mk56azBOVFFnTUM0Mk16Y3hPVElnTUM0Mk9EUXlOVFFnTUM0Mk16VTFNeUF3TGpZNE9UQXpOaUF3TGpZek16Z3lNME13TGpZNU5UQXpOaUF3TGpZek1UVTFOaUF3TGpZNU9URTNJREF1TmpNeE56RTJJREF1TnpBeE5UY2dNQzQyTXpRME1VTXdMamN3TkRFd015QXdMall6TnpBM05pQXdMamN3TlRNMU5pQXdMalkwTURnNUlEQXVOekExTXpneklEQXVOalExT1RnelF6QXVOekExTkRZeklEQXVOalV4TkRVZ01DNDNNRFF4T0RNZ01DNDJOVFkzTlRZZ01DNDNNREUwTXpZZ01DNDJOakUyT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESkRNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR4TmpBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQ0TkRBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TWprd09UQXpJREF1TnpJME9UZERNQzR5T1RBMk5UUWdNQzQzTWpreE15QXdMakk1TURRd05TQXdMamN6TXpJME5TQXdMakk1TURFMU5pQXdMamN6TnpNeE5rTXdMakk1TmpJNUlEQXVOek00TlRBM0lEQXVNekF5TkRVZ01DNDNNems0TkRFZ01DNHpNRGcyTXpZZ01DNDNOREV6TVRaRE1DNHpNVFE0TkRFZ01DNDNOREk1T0RjZ01DNHpNakV3TkRVZ01DNDNORFEzTXlBd0xqTXlOekkxSURBdU56UTJOVFF6UXpBdU16TXpORGtnTUM0M05EZzBNU0F3TGpNek9UYzBOeUF3TGpjMU1ETXdNeUF3TGpNME5qQXlNeUF3TGpjMU1qSXlNME13TGpNMU1qTXpOQ0F3TGpjMU5ERTBNeUF3TGpNMU9EWTRNU0F3TGpjMU5qQTBOU0F3TGpNMk5UQTJNeUF3TGpjMU56a3pRekF1TXpZMU56YzBJREF1TnpRNU9URXlJREF1TXpZMk5ETXlJREF1TnpReE9UZ3pJREF1TXpZM01ETTJJREF1TnpNME1UUXpRekF1TXpZeU1qQXhJREF1TnpNek1EUXhJREF1TXpVM05EQXhJREF1TnpNeE9UTWdNQzR6TlRJMk16WWdNQzQzTXpBNE1VTXdMak0wTnpnNUlEQXVOekk1TnpBM0lEQXVNelF6TVRZeElEQXVOekk0TmpBMUlEQXVNek00TkRVZ01DNDNNamMxTURORE1DNHpNek0zTnpRZ01DNDNNalkwTlRRZ01DNHpNamt3T1RnZ01DNDNNalUwTkRFZ01DNHpNalEwTWpNZ01DNDNNalEwTmpORE1DNHpNVGszT0RNZ01DNDNNak0xT1RJZ01DNHpNVFV4TlRJZ01DNDNNakkzT1RJZ01DNHpNVEExTXlBd0xqY3lNakEyTTBNd0xqTXhNRGcyTnlBd0xqY3hNelEzTmlBd0xqTXhNVEUyTVNBd0xqY3dORFkwTVNBd0xqTXhNVFF4SURBdU5qazFOVFUyUXpBdU16RXhOVE0wSURBdU5qZzJNREkzSURBdU16RXhOak15SURBdU5qYzJNelEzSURBdU16RXhOekF6SURBdU5qWTJOVEUyUXpBdU16RXhOekF6SURBdU5qVTJOalVnTUM0ek1URTJPRFVnTUM0Mk5EWTROeklnTUM0ek1URTJOU0F3TGpZek56RTRNME13TGpNeE1UVTVOaUF3TGpZeU56YzNPU0F3TGpNeE1UVXlOU0F3TGpZeE9EVXlOU0F3TGpNeE1UUXpOaUF3TGpZd09UUXlNME13TGpNd05EYzFNaUF3TGpZd056WXlOeUF3TGpJNU9EQTNOaUF3TGpZd05UZ3dOU0F3TGpJNU1UUXhJREF1TmpBek9UVTJUREF1TWpreE5EWXpJREF1TmpJd016Tk1NQzR5T1RFMU55QXdMall6TnprNE0wTXdMakk1TVRZd05TQXdMalkwTkRJME1TQXdMakk1TVRZMUlEQXVOalV3TmpBMUlEQXVNamt4TnpBeklEQXVOalUzTURjMlF6QXVNamt4TnpNNElEQXVOall6TmpFNUlEQXVNamt4TnpZMUlEQXVOamN3TVRJMUlEQXVNamt4TnpneklEQXVOamMyTlRrMlF6QXVNamt4T0RBeElEQXVOamd5T0RjeUlEQXVNamt4TnpreUlEQXVOamc1TURBMUlEQXVNamt4TnpVMklEQXVOamswT1RrMlF6QXVNamt4TmpnMUlEQXVOekF3TmpNeUlEQXVNamt4TlRrMklEQXVOekEyTURRMUlEQXVNamt4TkRrZ01DNDNNVEV5TXpaRE1DNHlPVEV6TVRJZ01DNDNNVFl3TURFZ01DNHlPVEV4TVRZZ01DNDNNakExTnprZ01DNHlPVEE1TURNZ01DNDNNalE1TjFwTk1DNDBNRFEwTnpZZ01DNDJNekUwTlVNd0xqTTVPREk1SURBdU5qTXdNakExSURBdU16a3lNVE1nTUM0Mk1qZzVNalVnTUM0ek9EVTVPVFlnTUM0Mk1qYzJNVU13TGpNNE5qSTBOU0F3TGpZek1qWTBNU0F3TGpNNE5qUTJOeUF3TGpZek56WTVJREF1TXpnMk5qWXpJREF1TmpReU56VTJRekF1TXpnMk9EUXhJREF1TmpRM09UTWdNQzR6T0RZNU9USWdNQzQyTlRNeE16a2dNQzR6T0RjeE1UWWdNQzQyTlRnek9ETkRNQzR6T0RjeU1EVWdNQzQyTmpNMk9Ua2dNQzR6T0RjeU56WWdNQzQyTmprd05Ua2dNQzR6T0Rjek15QXdMalkzTkRRMk0wTXdMak00TnpNeklEQXVOamM1T1RNNUlEQXVNemczTXpFeUlEQXVOamcxTkRVZ01DNHpPRGN5TnpZZ01DNDJPVEE1T1RaRE1DNHpPRGN4TnlBd0xqWTVOall6TWlBd0xqTTROekF6TmlBd0xqY3dNak13TXlBd0xqTTROamczTmlBd0xqY3dPREF4UXpBdU16ZzJOall6SURBdU56RXpPREExSURBdU16ZzJOREExSURBdU56RTVOalUwSURBdU16ZzJNVEF6SURBdU56STFOVFUyUXpBdU16ZzFOelEzSURBdU56TXhOVFEzSURBdU16ZzFNek00SURBdU56TTNOVGt5SURBdU16ZzBPRGMySURBdU56UXpOamxETUM0ek9EUXpORE1nTUM0M05EazVNVElnTUM0ek9ETTNORGNnTUM0M05UWXlNRFVnTUM0ek9ETXdPU0F3TGpjMk1qVTNRekF1TXpnNU5EVTBJREF1TnpZek56azJJREF1TXprMU9USTFJREF1TnpZME9Ea2dNQzQwTURJMU1ETWdNQzQzTmpVNE5VTXdMalF3T1RJMU9DQXdMamMyTmpVNU5pQXdMalF4TmpBM05pQXdMamMyTnpJMk15QXdMalF5TWprMU5pQXdMamMyTnpnMVF6QXVORE15TmpZeklEQXVOelk0TlRReklEQXVORFF4TkRZeklEQXVOelkzTlRneklEQXVORFE1TXpBeklEQXVOelkxTURjMlF6QXVORFUzTVRrMklEQXVOell5TlRFMklEQXVORFl6TlRjZ01DNDNOVGc1T1RZZ01DNDBOamcwTWpNZ01DNDNOVFEwT1VNd0xqUTNNekU1TmlBd0xqYzBPVGd5TXlBd0xqUTNOekE1SURBdU56UTBORE0ySURBdU5EZ3dNRGMySURBdU56TTRNek5ETUM0ME9ETXhORE1nTUM0M016SXhORE1nTUM0ME9EVXhOeUF3TGpjeU5UazFOaUF3TGpRNE5qSXhJREF1TnpFNU56ZERNQzQwT0Rjek15QXdMamN4TXpZNUlEQXVORGczTnpneklEQXVOekEzTlRVMklEQXVORGczTlRFMklEQXVOekF4TkRJelF6QXVORGczTVRrMklEQXVOamswT0RrZ01DNDBPRFl4TXlBd0xqWTRPRGM0TXlBd0xqUTRORE14TmlBd0xqWTRNekExUXpBdU5EZ3lOVGd6SURBdU5qYzNNamtnTUM0ME56azVNVFlnTUM0Mk56RTROU0F3TGpRM05qTTBNeUF3TGpZMk5qY3dNME13TGpRM01qZzNOaUF3TGpZMk1UVXdNeUF3TGpRMk9EWXpOaUF3TGpZMU5qZzVJREF1TkRZek56VTJJREF1TmpVeU9EWXpRekF1TkRVNE9EYzJJREF1TmpRNE9ERWdNQzQwTlRJNU5UWWdNQzQyTkRVeU1TQXdMalEwTlRrME15QXdMalkwTWpBek5rTXdMalF6T0RrNE15QXdMall6T0RneElEQXVORE14TkRFZ01DNDJNelkwTXpZZ01DNDBNak14TkRNZ01DNDJNelE1TjBNd0xqUXhOamt3TXlBd0xqWXpNemd4TkNBd0xqUXhNRFk0TVNBd0xqWXpNalkwTVNBd0xqUXdORFEzTmlBd0xqWXpNVFExV2swd0xqVTROekUwTXlBd0xqYzFNRFU1TmtNd0xqVTRPRFl4T0NBd0xqYzFOVGMzSURBdU5Ua3dNRGcxSURBdU56WXdPVGczSURBdU5Ua3hOVFF6SURBdU56WTJNalZETUM0MU9UZzRPRFVnTUM0M05qVXpOemtnTUM0Mk1EWXpNRGNnTUM0M05qUTBNREVnTUM0Mk1UTTRNU0F3TGpjMk16TXhOa013TGpZeE1qRTFOaUF3TGpjMU56TXdOeUF3TGpZeE1EUTROU0F3TGpjMU1UTTJNU0F3TGpZd09EYzVOaUF3TGpjME5UUTNOa013TGpZd056QTFOQ0F3TGpjek9UY3pOQ0F3TGpZd05USTVOQ0F3TGpjek5EQTBOU0F3TGpZd016VXhOaUF3TGpjeU9EUXhRekF1TmpBeE56TTRJREF1TnpJeU9URTJJREF1TlRrNU9UUXpJREF1TnpFM05EZzFJREF1TlRrNE1UTWdNQzQzTVRJeE1UWkRNQzQxT1RZek1UWWdNQzQzTURZNE5UUWdNQzQxT1RRMU1ETWdNQzQzTURFMk56SWdNQzQxT1RJMk9TQXdMalk1TmpVM1F6QXVOVGt3T0RjMklEQXVOamt4TlRjMElEQXVOVGc1TURZeklEQXVOamcyTmpVNUlEQXVOVGczTWpVZ01DNDJPREU0TWpORE1DNDFPRFUwTXpZZ01DNDJOemN3T1RRZ01DNDFPRE0yTURVZ01DNDJOekkwTXpZZ01DNDFPREUzTlRZZ01DNDJOamM0TlVNd0xqVTNPVGt3TnlBd0xqWTJNek00TnlBd0xqVTNPREF6TWlBd0xqWTFPRGszT1NBd0xqVTNOakV6SURBdU5qVTBOakl6UXpBdU5UYzBNVGt5SURBdU5qVXdNemMwSURBdU5UY3lNakVnTUM0Mk5EWXhOakVnTUM0MU56QXhPRE1nTUM0Mk5ERTVPRE5ETUM0MU5qRTRPVGdnTUM0Mk5ESTJOellnTUM0MU5UTTFPVFlnTUM0Mk5ETXpNelFnTUM0MU5EVXlOellnTUM0Mk5ETTVOVFpETUM0MU5ETXhOemdnTUM0Mk5EZzBNellnTUM0MU5ERXhNVFlnTUM0Mk5USTVNelFnTUM0MU16a3dPU0F3TGpZMU56UTFRekF1TlRNM01URTJJREF1TmpZeU1EY3lJREF1TlRNMU1UWXhJREF1TmpZMk56TTVJREF1TlRNek1qSXpJREF1TmpjeE5EVkRNQzQxTXpFek1qRWdNQzQyTnpZek1ETWdNQzQxTWprME1qY2dNQzQyT0RFeU1TQXdMalV5TnpVME15QXdMalk0TmpFM1F6QXVOVEkxTmpjMklEQXVOamt4TWprZ01DNDFNak00TVRnZ01DNDJPVFkwTnpJZ01DNDFNakU1TnlBd0xqY3dNVGN4TmtNd0xqVXlNREV5TVNBd0xqY3dOekE0TlNBd0xqVXhPREk1SURBdU56RXlOVEkxSURBdU5URTJORGMySURBdU56RTRNRE0yUXpBdU5URTBOamd4SURBdU56SXpOamtnTUM0MU1USTRPVFFnTUM0M01qa3pPVFlnTUM0MU1URXhNVFlnTUM0M016VXhOVFpETUM0MU1Ea3pOVFlnTUM0M05ERXdOREVnTUM0MU1EYzJNVFFnTUM0M05EWTVOemtnTUM0MU1EVTRPU0F3TGpjMU1qazNRekF1TlRBME1qQXhJREF1TnpVNU1EWTNJREF1TlRBeU5USXhJREF1TnpZMU1qRWdNQzQxTURBNE5TQXdMamMzTVRNNU5rTXdMalV3T0RjNU5pQXdMamMzTVRNM09TQXdMalV4TmpZeElEQXVOemN4TWpneElEQXVOVEkwTWprZ01DNDNOekV4TURORE1DNDFNalUyTURVZ01DNDNOalUyTkRVZ01DNDFNalk1TlRZZ01DNDNOakF5TWpNZ01DNDFNamd6TkRNZ01DNDNOVFE0TXpaRE1DNDFNamszT0RNZ01DNDNORGsxTXprZ01DNDFNekV5TkRFZ01DNDNORFF5T0RVZ01DNDFNekkzTVRZZ01DNDNNemt3TnpaRE1DNDFOREV3TnpJZ01DNDNNemcyTmpjZ01DNDFORGswTURFZ01DNDNNemd4T1RZZ01DNDFOVGMzTURNZ01DNDNNemMyTmpORE1DNDFOalU1T0RjZ01DNDNNemN3TURVZ01DNDFOelF5TmpNZ01DNDNNell5TmpjZ01DNDFPREkxTXlBd0xqY3pOVFExUXpBdU5UZzBNRGMySURBdU56UXdORFExSURBdU5UZzFOakUwSURBdU56UTFORGswSURBdU5UZzNNVFF6SURBdU56VXdOVGsyV2swd0xqWXpORE14TmlBd0xqYzBNRGszUXpBdU5qTTBNVEF6SURBdU56UTNNRGcxSURBdU5qTXpPRFl6SURBdU56VXpNall6SURBdU5qTXpOVGsySURBdU56VTVOVEF6UXpBdU5qUXhNVGNnTUM0M05UYzNPVFlnTUM0Mk5EZzNOeUF3TGpjMU5qQXpOaUF3TGpZMU5qTTVOaUF3TGpjMU5ESXlNME13TGpZMU5qVXpPQ0F3TGpjME5UQXpNaUF3TGpZMU5qWTJNeUF3TGpjek5UazBOeUF3TGpZMU5qYzNJREF1TnpJMk9UZERNQzQyTlRZNE5Ua2dNQzQzTVRneE55QXdMalkxTmprMk5TQXdMamN3T1RRM05pQXdMalkxTnpBNUlEQXVOekF3T0RsRE1DNDJOakl5TVNBd0xqWTVPVGN4TmlBd0xqWTJOek14TWlBd0xqWTVPRFV5TlNBd0xqWTNNak01TmlBd0xqWTVOek14TmtNd0xqWTNOelE0TVNBd0xqWTVOakE1SURBdU5qZ3lOVFEzSURBdU5qazBPRFl6SURBdU5qZzNOVGsySURBdU5qa3pOak0yUXpBdU5qazBOREl6SURBdU5qa3hPVFUySURBdU56QXdNekUySURBdU5qZzVORFVnTUM0M01EVXlOellnTUM0Mk9EWXhNVFpETUM0M01UQXlNU0F3TGpZNE1qZ3pOaUF3TGpjeE5ERTRNeUF3TGpZM09EY3pJREF1TnpFM01qSXpJREF1Tmpjek5qbERNQzQzTWpBeU5qTWdNQzQyTmpnMU55QXdMamN5TWpNNU5pQXdMalkyTXpBM05pQXdMamN5TXpVNU5pQXdMalkxTnpBMVF6QXVOekkwTnpFMklEQXVOalV3TnpNZ01DNDNNalV3TXpZZ01DNDJORFF3TVNBd0xqY3lORFl4SURBdU5qTTNNamxETUM0M01qUXlPU0F3TGpZek1EVTBNeUF3TGpjeU16UTVJREF1TmpJMU1qTTJJREF1TnpJeU1UTWdNQzQyTWpFeU9VTXdMamN5TURrd015QXdMall4TnpZNUlEQXVOekU1TURFZ01DNDJNVFV4TURNZ01DNDNNVFl6T1RZZ01DNDJNVE16TjBNd0xqY3hNemM0TXlBd0xqWXhNVFUxTmlBd0xqY3hNREkyTXlBd0xqWXhNRGt4TmlBd0xqY3dOVGd6TmlBd0xqWXhNVE0wTTBNd0xqY3dNVE00TXlBd0xqWXhNVFkyTXlBd0xqWTVOVGs1TmlBd0xqWXhNekEzTmlBd0xqWTRPVFl5TXlBd0xqWXhOVFV6UXpBdU5qZ3hPVEkxSURBdU5qRTRNelUySURBdU5qYzBNVGMwSURBdU5qSXhNVEl4SURBdU5qWTJNemNnTUM0Mk1qTTRNak5ETUM0Mk5UZzBNak1nTUM0Mk1qWXpOalVnTUM0Mk5UQXpOakVnTUM0Mk1qZzRNVGtnTUM0Mk5ESXhPRE1nTUM0Mk16RXhPRE5ETUM0Mk5ERXpORGNnTUM0Mk16VTFOelFnTUM0Mk5EQTFOVFlnTUM0Mk5EQXdNVGtnTUM0Mk16azRNU0F3TGpZME5EVXhOa013TGpZek9URTNJREF1TmpRNU1UYzBJREF1TmpNNE5UZ3pJREF1TmpVek9UQXpJREF1TmpNNE1EVWdNQzQyTlRnM01ETkRNQzQyTXpjMk1EVWdNQzQyTmpNMk5EVWdNQzQyTXpjeE9UWWdNQzQyTmpnMk5TQXdMall6TmpneU15QXdMalkzTXpjeE5rTXdMall6TmpVeU1TQXdMalkzT0Rrd055QXdMall6TmpJek5pQXdMalk0TkRFMU1pQXdMall6TlRrM0lEQXVOamc1TkRWRE1DNDJNelUzTlRZZ01DNDJPVFE0T1NBd0xqWXpOVFUyTVNBd0xqY3dNRE00TXlBd0xqWXpOVE00TXlBd0xqY3dOVGt6UXpBdU5qTTFNakExSURBdU56RXhOakF4SURBdU5qTTFNRE0ySURBdU56RTNNekkxSURBdU5qTTBPRGMySURBdU56SXpNVEF6UXpBdU5qTTBOams0SURBdU56STRPVGczSURBdU5qTTBOVEV5SURBdU56TTBPVFF6SURBdU5qTTBNekUySURBdU56UXdPVGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOSIgeT0iMjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkzIiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0NCIgeT0iNTkuNSIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5NCIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSM2YzhlYmY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYzsiIHBhcmVudD0iMyIgc291cmNlPSIyOCIgdGFyZ2V0PSI5MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNTc0IiB5PSItNC4zNTYzNjExNDkxMTA4NTMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9Ijg0My41MDAwMDAwMDAwMDA1IiB5PSItMy42MTkwMTUwNDc4Nzk2NTY4IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTciIHZhbHVlPSJSIiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSMwMDZFQUY7ZmlsbENvbG9yPSMxYmExZTI7Zm9udFNpemU9MTU7Zm9udENvbG9yPSNmZmZmZmY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTI5IiB5PSIxOTYiIHdpZHRoPSIxOSIgaGVpZ2h0PSIyMiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTgiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSMxYmExZTI7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iMjgiIHRhcmdldD0iOTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjUzOC40NzM5MDM5NjY1OTY5IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNTg2Ljg3NDczOTAzOTY2NjEiIHk9IjE5MCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7cmVjdXJzaXZlUmVzaXplPTA7dmVydGljYWxBbGlnbj10b3A7YWxpZ249cmlnaHQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM0NjQ5NUQ7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzk0IiB5PSIxMiIgd2lkdGg9IjI0OSIgaGVpZ2h0PSIyNjciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik9UIiBpZD0iMjAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0xMjBhOWEwNy1iZWExLTRlMmYtYjhmMy01ZTQyMzkwZTJkZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9aW90LWFwcGxpY2F0aW9uO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZETUM0Mk9UTXhPVGtnTUM0Mk56VXdOelFnTUM0M01ETXlOek1nTUM0Mk5qVXdNREVnTUM0M01UVTJPVGtnTUM0Mk5qVXdNREZETUM0M01qZ3hNalVnTUM0Mk5qVXdNREVnTUM0M016Z3hPVGtnTUM0Mk56VXdOelFnTUM0M016Z3hPVGtnTUM0Mk9EYzFNREZETUM0M016Z3hPVGtnTUM0Mk9UazVNamNnTUM0M01qZ3hNalVnTUM0M01UQXdNREVnTUM0M01UVTJPVGtnTUM0M01UQXdNREZETUM0M01ETXlOek1nTUM0M01UQXdNREVnTUM0Mk9UTXhPVGtnTUM0Mk9UazVNamNnTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qTXpNVEkxSURBdU5qTTROamMzUXpBdU5qTXpNVEkxSURBdU5qSXdNRE0zSURBdU5qUTRNak0xSURBdU5qQTBPVEkzSURBdU5qWTJPRGMxSURBdU5qQTBPVEkzU0RBdU56WTBNemMxUXpBdU56Z3pNREUxSURBdU5qQTBPVEkzSURBdU56azRNVEkxSURBdU5qSXdNRE0zSURBdU56azRNVEkxSURBdU5qTTROamMzVmpBdU56TTJNVGMzUXpBdU56azRNVEkxSURBdU56VTBPREUySURBdU56Z3pNREUxSURBdU56WTVPVEkzSURBdU56WTBNemMxSURBdU56WTVPVEkzU0RBdU5qWTJPRGMxUXpBdU5qUTRNak0xSURBdU56WTVPVEkzSURBdU5qTXpNVEkxSURBdU56VTBPREUySURBdU5qTXpNVEkxSURBdU56TTJNVGMzVmpBdU5qTTROamMzV2swd0xqYzJNRFk1T1NBd0xqWTROelV3TVVNd0xqYzJNRFk1T1NBd0xqWTJNalkwT0NBd0xqYzBNRFUxTWlBd0xqWTBNalV3TVNBd0xqY3hOVFk1T1NBd0xqWTBNalV3TVVNd0xqWTVNRGcwTmlBd0xqWTBNalV3TVNBd0xqWTNNRFk1T1NBd0xqWTJNalkwT0NBd0xqWTNNRFk1T1NBd0xqWTROelV3TVVNd0xqWTNNRFk1T1NBd0xqY3hNak0xTkNBd0xqWTVNRGcwTmlBd0xqY3pNalV3TVNBd0xqY3hOVFk1T1NBd0xqY3pNalV3TVVNd0xqYzBNRFUxTWlBd0xqY3pNalV3TVNBd0xqYzJNRFk1T1NBd0xqY3hNak0xTkNBd0xqYzJNRFk1T1NBd0xqWTROelV3TVZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDNNVFUyTWpVZ01DNDVNRE13TlRKRE1DNDRNelEzTVRFZ01DNDVNRE13TlRJZ01DNDVNekV5TlNBd0xqZ3dOalV4TXlBd0xqa3pNVEkxSURBdU5qZzNOREkzUXpBdU9UTXhNalVnTUM0MU5qZ3pOQ0F3TGpnek5EY3hNU0F3TGpRM01UZ3dNaUF3TGpjeE5UWXlOU0F3TGpRM01UZ3dNa013TGpVNU5qVXpPU0F3TGpRM01UZ3dNaUF3TGpVZ01DNDFOamd6TkNBd0xqVWdNQzQyT0RjME1qZERNQzQxSURBdU9EQTJOVEV6SURBdU5UazJOVE01SURBdU9UQXpNRFV5SURBdU56RTFOakkxSURBdU9UQXpNRFV5V2swd0xqYzNOVFV5TWlBd0xqVTBOekUxUXpBdU56YzBOemMzSURBdU5UUXhOalU1SURBdU56Y3dNRGNnTUM0MU16YzBNamNnTUM0M05qUXpOelVnTUM0MU16YzBNamRNTUM0M05qSTRORGdnTUM0MU16YzFNamxNTUM0M05qRXpPRFFnTUM0MU16YzRNamxETUM0M05UWTJNak1nTUM0MU16a3hNemdnTUM0M05UTXhNalVnTUM0MU5ETTBPVGtnTUM0M05UTXhNalVnTUM0MU5EZzJOemRXTUM0MU9ESTBNVEpJTUM0M01qWTROa3d3TGpjeU5qZzNOU0F3TGpVME9EWTNOMHd3TGpjeU5qYzNNaUF3TGpVME56RTFRekF1TnpJMk1ESTNJREF1TlRReE5qVTVJREF1TnpJeE16SWdNQzQxTXpjME1qY2dNQzQzTVRVMk1qVWdNQzQxTXpjME1qZE1NQzQzTVRRd09UZ2dNQzQxTXpjMU1qbERNQzQzTURnMk1EY2dNQzQxTXpneU56UWdNQzQzTURRek56VWdNQzQxTkRJNU9ERWdNQzQzTURRek56VWdNQzQxTkRnMk56ZE1NQzQzTURRek5pQXdMalU0TWpReE1rZ3dMalkzT0RFeU5WWXdMalUwT0RZM04wd3dMalkzT0RBeU1pQXdMalUwTnpFMVF6QXVOamMzTWpjM0lEQXVOVFF4TmpVNUlEQXVOamN5TlRjZ01DNDFNemMwTWpjZ01DNDJOalk0TnpVZ01DNDFNemMwTWpkRE1DNDJOakEyTmpJZ01DNDFNemMwTWpjZ01DNDJOVFUyTWpVZ01DNDFOREkwTmpRZ01DNDJOVFUyTWpVZ01DNDFORGcyTnpkTU1DNDJOVFUyTXpJZ01DNDFPRE0xTlRGRE1DNDJNek0xT1RNZ01DNDFPRGd3TWpFZ01DNDJNVFl5TXpJZ01DNDJNRFV6TnpjZ01DNDJNVEUzTlRNZ01DNDJNamMwTVRKTU1DNDFOelk0TnpVZ01DNDJNamMwTWpkTU1DNDFOelV6TkRnZ01DNDJNamMxTWpsRE1DNDFOams0TlRjZ01DNDJNamd5TnpRZ01DNDFOalUyTWpVZ01DNDJNekk1T0RFZ01DNDFOalUyTWpVZ01DNDJNemcyTnpkTU1DNDFOalUzTWpnZ01DNDJOREF5TURORE1DNDFOalkwTnpNZ01DNDJORFUyT1RRZ01DNDFOekV4T0NBd0xqWTBPVGt5TnlBd0xqVTNOamczTlNBd0xqWTBPVGt5TjB3d0xqWXhNRFl5TlNBd0xqWTBPVGt4TWxZd0xqWTNOakUyTWt3d0xqVTNOamczTlNBd0xqWTNOakUzTjB3d0xqVTNOVE0wT0NBd0xqWTNOakkzT1VNd0xqVTJPVGcxTnlBd0xqWTNOekF5TkNBd0xqVTJOVFl5TlNBd0xqWTRNVGN6TVNBd0xqVTJOVFl5TlNBd0xqWTROelF5TjB3d0xqVTJOVGN5T0NBd0xqWTRPRGsxTTBNd0xqVTJOalEzTXlBd0xqWTVORFEwTkNBd0xqVTNNVEU0SURBdU5qazROamMzSURBdU5UYzJPRGMxSURBdU5qazROamMzVERBdU5qRXdOakkxSURBdU5qazROall5VmpBdU56STBPVEV5VERBdU5UYzJPRGMxSURBdU56STBPVEkzVERBdU5UYzFNelE0SURBdU56STFNREk1UXpBdU5UWTVPRFUzSURBdU56STFOemMwSURBdU5UWTFOakkxSURBdU56TXdORGd4SURBdU5UWTFOakkxSURBdU56TTJNVGMzUXpBdU5UWTFOakkxSURBdU56UXlNemtnTUM0MU56QTJOaklnTUM0M05EYzBNamNnTUM0MU56WTROelVnTUM0M05EYzBNamRNTUM0Mk1URTNOU0F3TGpjME56UXlOa013TGpZeE5qSXlOQ0F3TGpjMk9UUTJPU0F3TGpZek16VTRPQ0F3TGpjNE5qZ3pNU0F3TGpZMU5UWXpNaUF3TGpjNU1UTXdNMHd3TGpZMU5UWXlOU0F3TGpneU5qRTNOMHd3TGpZMU5UY3lPQ0F3TGpneU56Y3dNME13TGpZMU5qUTNNeUF3TGpnek16RTVOQ0F3TGpZMk1URTRJREF1T0RNM05ESTNJREF1TmpZMk9EYzFJREF1T0RNM05ESTNUREF1TmpZNE5EQXlJREF1T0RNM016STBRekF1Tmpjek9Ea3pJREF1T0RNMk5UYzVJREF1TmpjNE1USTFJREF1T0RNeE9EY3lJREF1TmpjNE1USTFJREF1T0RJMk1UYzNWakF1TnpreU5ERXlTREF1TnpBME16Wk1NQzQzTURRek56VWdNQzQ0TWpZeE56ZE1NQzQzTURRME56Z2dNQzQ0TWpjM01ETkRNQzQzTURVeU1qTWdNQzQ0TXpNeE9UUWdNQzQzTURrNU15QXdMamd6TnpReU55QXdMamN4TlRZeU5TQXdMamd6TnpReU4wd3dMamN4TnpFMU1pQXdMamd6TnpNeU5FTXdMamN5TWpZME15QXdMamd6TmpVM09TQXdMamN5TmpnM05TQXdMamd6TVRnM01pQXdMamN5TmpnM05TQXdMamd5TmpFM04wd3dMamN5TmpnMklEQXVOemt5TkRFeVNEQXVOelV6TVRJMVZqQXVPREkyTVRjM1REQXVOelV6TWpJNElEQXVPREkzTnpBelF6QXVOelV6T1RjeklEQXVPRE16TVRrMElEQXVOelU0TmpnZ01DNDRNemMwTWpjZ01DNDNOalF6TnpVZ01DNDRNemMwTWpkRE1DNDNOekExT0RnZ01DNDRNemMwTWpjZ01DNDNOelUyTWpVZ01DNDRNekl6T1NBd0xqYzNOVFl5TlNBd0xqZ3lOakUzTjB3d0xqYzNOVFl6TXlBd0xqYzVNVE5ETUM0M09UYzJOalVnTUM0M09EWTRNalFnTUM0NE1UVXdNaUF3TGpjMk9UUTNNU0F3TGpneE9UUTVOeUF3TGpjME56UXpPVXd3TGpnMU5ETTNOU0F3TGpjME56UXlOMHd3TGpnMU5Ua3dNaUF3TGpjME56TXlORU13TGpnMk1UTTVNeUF3TGpjME5qVTNPU0F3TGpnMk5UWXlOU0F3TGpjME1UZzNNaUF3TGpnMk5UWXlOU0F3TGpjek5qRTNOMHd3TGpnMk5UVXlNaUF3TGpjek5EWTFRekF1T0RZME56YzNJREF1TnpJNU1UVTVJREF1T0RZd01EY2dNQzQzTWpRNU1qY2dNQzQ0TlRRek56VWdNQzQzTWpRNU1qZElNQzQ0TWpBMk1qVldNQzQyT1RnMk56ZElNQzQ0TlRRek56Vk1NQzQ0TlRVNU1ESWdNQzQyT1RnMU56UkRNQzQ0TmpFek9UTWdNQzQyT1RjNE1qa2dNQzQ0TmpVMk1qVWdNQzQyT1RNeE1qSWdNQzQ0TmpVMk1qVWdNQzQyT0RjME1qZE1NQzQ0TmpVMU1qSWdNQzQyT0RVNVF6QXVPRFkwTnpjM0lEQXVOamd3TkRBNUlEQXVPRFl3TURjZ01DNDJOell4TnpjZ01DNDROVFF6TnpVZ01DNDJOell4TnpkSU1DNDRNakEyTWpWV01DNDJORGs1TWpkSU1DNDROVFF6TnpWTU1DNDROVFU1TURJZ01DNDJORGs0TWpSRE1DNDROakV6T1RNZ01DNDJORGt3TnprZ01DNDROalUyTWpVZ01DNDJORFF6TnpJZ01DNDROalUyTWpVZ01DNDJNemcyTnpkRE1DNDROalUyTWpVZ01DNDJNekkwTmpRZ01DNDROakExT0RnZ01DNDJNamMwTWpjZ01DNDROVFF6TnpVZ01DNDJNamMwTWpkTU1DNDRNVGsxSURBdU5qSTNORE5ETUM0NE1UVXdNamdnTUM0Mk1EVXpPVEVnTUM0M09UYzJOeUF3TGpVNE9EQXpJREF1TnpjMU5qTXpJREF1TlRnek5UVTBUREF1TnpjMU5qSTFJREF1TlRRNE5qYzNUREF1TnpjMU5USXlJREF1TlRRM01UVmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNVEEyT1RNZ01DNDBOVEkzT1RaRE1DNDNPVFF5T0RjZ01DNDBNakl6TkRFZ01DNDNOek0wTWpVZ01DNHpPVE0zT1RJZ01DNDNORGsxTXpJZ01DNHpOams0T1RoRE1DNDJNVEkyTkRjZ01DNHlNek13TVRRZ01DNHpPVEEzTVRRZ01DNHlNek13TVRRZ01DNHlOVE00TWprZ01DNHpOams0T1RoRE1DNHlNamN5T0RnZ01DNHpPVFkwTXprZ01DNHlNRFUyTWpnZ01DNDBNalkwTWlBd0xqRTRPRGs0TXlBd0xqUTFPVE15TjBNd0xqRTNPREl6TXlBd0xqUTRNRFU0SURBdU1UZzJOelEzSURBdU5UQTJOVEkwSURBdU1qQTRJREF1TlRFM01qYzBRekF1TWpJNU1qVXpJREF1TlRJNE1ESTBJREF1TWpVMU1UazNJREF1TlRFNU5UQTVJREF1TWpZMU9UUTNJREF1TkRrNE1qVTJRekF1TWpjNE5EZzBJREF1TkRjek5EY3hJREF1TWprME56WXhJREF1TkRVd09UUXlJREF1TXpFME9ERTJJREF1TkRNd09EZzJRekF1TkRFNE1ERTVJREF1TXpJM05qZ3pJREF1TlRnMU16UXlJREF1TXpJM05qZ3pJREF1TmpnNE5UUTFJREF1TkRNd09EZzJRekF1Tmprd01ERTVJREF1TkRNeU16WWdNQzQyT1RFME9DQXdMalF6TXpnMk1pQXdMalk1TWpreU9DQXdMalF6TlRNNE9VTXdMamN3TURRek5pQXdMalF6TkRjeE9TQXdMamN3T0RBMElEQXVORE0wTXpjMklEQXVOekUxTnpJeklEQXVORE0wTXpjMlF6QXVOelE1TXpBNUlEQXVORE0wTXpjMklEQXVOemd4TXpZM0lEQXVORFF3T1RFNElEQXVPREV3TmpreklEQXVORFV5TnprMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzNNamswSURBdU5qQXlNekF5UXpBdU5EWTNOemdnTUM0Mk1qZzVNalVnTUM0ME5qSTFPVGdnTUM0Mk5UYzJNRGdnTUM0ME5qSTFPVGdnTUM0Mk9EYzFNREpETUM0ME5qSTFPVGdnTUM0Mk9UYzBNak1nTUM0ME5qTXhOamtnTUM0M01EY3lNVEVnTUM0ME5qUXlOemtnTUM0M01UWTRNelZETUM0ME5qQTNOalFnTUM0M01UUTBPVFVnTUM0ME5UYzBNamNnTUM0M01URTNOelFnTUM0ME5UUXpNallnTUM0M01EZzJOek5ETUM0ME1qa3dORFlnTUM0Mk9ETXpPVFFnTUM0ME1qa3dORFlnTUM0Mk5ESTBNRGdnTUM0ME5UUXpNallnTUM0Mk1UY3hNamxETUM0ME5qRXdOalFnTUM0Mk1UQXpPU0F3TGpRMk9Ea3hPU0F3TGpZd05UUTBPQ0F3TGpRM056STVOQ0F3TGpZd01qTXdNbG9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TmprNElEQXVORFU0T0RaRE1DNDFOelUxTkRZZ01DNDBOek00TXpZZ01DNDFORGMyT0RjZ01DNDBPVFV4TURRZ01DNDFNalV3TXpJZ01DNDFNakV3TXpWRE1DNDBPREl3TVRZZ01DNDFNVE0zTkRJZ01DNDBNell5TXpjZ01DNDFNalkyT1RZZ01DNDBNRE13TXpjZ01DNDFOVGs0T1RaRE1DNHpPVEV3TXpjZ01DNDFOekU0T1RVZ01DNHpPREV5TkRZZ01DNDFPRFkxT0RRZ01DNHpOelF3TkRrZ01DNDJNRE13TTBNd0xqTTJORFV3TWlBd0xqWXlORGcxSURBdU16TTVNRGMwSURBdU5qTTBOems1SURBdU16RTNNalUwSURBdU5qSTFNalV4UXpBdU1qazFORE0xSURBdU5qRTFOekEwSURBdU1qZzFORGcySURBdU5Ua3dNamMySURBdU1qazFNRE16SURBdU5UWTRORFUyUXpBdU16QTJORElnTUM0MU5ESTBNelFnTUM0ek1qSXlNRGdnTUM0MU1UZzNOU0F3TGpNME1qQTFJREF1TkRrNE9UQTRRekF1TkRFek56Y2dNQzQwTWpjeE9EY2dNQzQxTWpFM05UZ2dNQzQwTVRNNE16Z2dNQzQyTURZNU9DQXdMalExT0RnMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9USXpOekVnTUM0ek16ZzVNekpETUM0NU1EVTNNeUF3TGpNeE1qZzRNU0F3TGpnNE5UQTNPQ0F3TGpJNE56ZzVNU0F3TGpnMk16RTNNU0F3TGpJMk5UazRORU13TGpZMk1qUTVOeUF3TGpBMk5UTXhJREF1TXpNM01UUWdNQzR3TmpVek1TQXdMakV6TmpRMk5pQXdMakkyTlRrNE5FTXdMakV4TlRNM055QXdMakk0TnpBM015QXdMakE1TlRBd01EZ2dNQzR6TVRFNU9Ea2dNQzR3TnpZMU5ETXhJREF1TXpNNE5UazFRekF1TURZeU9UWTNNeUF3TGpNMU9ERTJOQ0F3TGpBMk56Z3lOVGdnTUM0ek9EVXdNek1nTUM0d09EY3pPVFE1SURBdU16azROakE1UXpBdU1UQTJPVFkwSURBdU5ERXlNVGcxSURBdU1UTXpPRE16SURBdU5EQTNNekkySURBdU1UUTNOREE1SURBdU16ZzNOelUzUXpBdU1UWXpNRGd5SURBdU16WTFNVFkwSURBdU1UZ3dNak01SURBdU16UTBNVGcySURBdU1UazNORFV6SURBdU16STJPVGN5UXpBdU16WTBORFExSURBdU1UVTVPVGdnTUM0Mk16VXhPVElnTUM0eE5UazVPQ0F3TGpnd01qRTRNeUF3TGpNeU5qazNNa013TGpneU1ETXhOU0F3TGpNME5URXdOQ0F3TGpnek56WTBOU0F3TGpNMk5qQTNNaUF3TGpnMU1qY3lOaUF3TGpNNE56a3lNME13TGpnMk5qSTFOQ0F3TGpRd056VXlOU0F3TGpnNU16RXhNaUF3TGpReE1qUTBPQ0F3TGpreE1qY3hNeUF3TGpNNU9Ea3hPVU13TGprek1qTXhOU0F3TGpNNE5UTTVNU0F3TGprek56SXpPQ0F3TGpNMU9EVXpNeUF3TGpreU16Y3hJREF1TXpNNE9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprek56VWlJR2hsYVdkb2REMGlNQzQ1TXpjMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNekV5TlNBd0xqQXpNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE1NSIgeT0iMTU0IiB3aWR0aD0iNzgiIGhlaWdodD0iNTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI2IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gSW9UIEFwcGxpY2F0aW9uIChpb3Qtc2VjdXJpdHktY29tcGxpYW5jZS1mcmFtZXdvcmspIiBzdHlsZT0iaXIucmVmPTQ4OTY2OTNhLTQ2YWYtNGM2Yy1hYzhkLTRkYjhlYTAxN2RmYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jNzg4QUEzO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7IiBwYXJlbnQ9IjIxIiBzb3VyY2U9IjI1IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU2VjdXJlIEdhdGV3YXkiIGlkPSIyNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTkwZjI5MDNjLTk0MmYtNDU1Ni05MDVhLTM5MWEzMjhhMjM3Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtza2V0Y2g9MTsiIHBhcmVudD0iMjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjMuNSIgeT0iMTQ1LjUiIHdpZHRoPSI4MSIgaGVpZ2h0PSI3NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzgiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSM3ODhBQTM7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjIxIiBzb3VyY2U9Ijk1IiB0YXJnZXQ9IjI1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzIiIHZhbHVlPSIiIHN0eWxlPSJmb250Q29sb3I9IzQ2NDk1RDt2ZXJ0aWNhbEFsaWduPXRvcDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsUG9zaXRpb249Y2VudGVyO2FsaWduPWNlbnRlcjtodG1sPTE7b3V0bGluZUNvbm5lY3Q9MDtmaWxsQ29sb3I9I0IyQzlBQjtzdHJva2VDb2xvcj0jNzg4QUEzO2dyYWRpZW50RGlyZWN0aW9uPW5vcnRoO3N0cm9rZVdpZHRoPTI7c2hhcGU9bXhncmFwaC5uZXR3b3Jrcy5maXJld2FsbDtza2V0Y2g9MTtyb3VuZGVkPTE7IiBwYXJlbnQ9IjIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIwLjUiIHk9IjE4IiB3aWR0aD0iODciIGhlaWdodD0iODMiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk1IiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmOyIgcGFyZW50PSIyMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1MiIgeT0iMTEyIiB3aWR0aD0iMTkiIGhlaWdodD0iMjIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk2IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIyMSIgc291cmNlPSIzMiIgdGFyZ2V0PSI5NSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iODg3IiB5PSI0Ny4wMDAwMDAwMDAwMDAyMyIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iODg3IiB5PSI4Mi41IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMzciIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSM2YzhlYmY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYztzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iOTMiIHRhcmdldD0iMzIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5OSIgdmFsdWU9IkQiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmb250U2l6ZT0xNTtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxODkiIHk9IjE3OCIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMjIiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuMjY1O2VudHJ5WT0wLjEyNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7c2hhZG93PTA7bGFiZWxCYWNrZ3JvdW5kQ29sb3I9bm9uZTtsYWJlbEJvcmRlckNvbG9yPW5vbmU7Zm9udENvbG9yPSNGRkZGRkY7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNiOWQwZTY7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9I2RiZWFmNzsiIHBhcmVudD0iMyIgc291cmNlPSIyOCIgdGFyZ2V0PSI5OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgeD0iLTAuMTEwOCIgeT0iMTMiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjUzNi45OTA1OTEwMTY1NDg1IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNjgyLjAyIiB5PSIyMDciIGFzPSJ0YXJnZXRQb2ludCIvPjxteFBvaW50IGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSNiOWQwZTY7ZmlsbENvbG9yPSNkYmVhZjc7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM4QzhDOEM7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xNzQiIHk9IjE0MCIgd2lkdGg9IjQxMiIgaGVpZ2h0PSIzMDUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO3N0cm9rZUNvbG9yPSM5OUNDRkY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYzt0YXJnZXRQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjE0IiBzb3VyY2U9IjMwIiB0YXJnZXQ9IjExIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE0IiB2YWx1ZT0iQXp1cmUgQUQgLT4gV1ZEIiBzdHlsZT0iaXIucmVmPTJiNDM1MDkyLTQ1ZWQtNDMwNC1iNDJlLTg5MTQwNjJlMDVkZDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7bGFiZWxCYWNrZ3JvdW5kQ29sb3I9bm9uZTtsYWJlbEJvcmRlckNvbG9yPW5vbmU7Zm9udENvbG9yPSNGRkZGRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7ZmlsbENvbG9yPSMxYmExZTI7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7IiBwYXJlbnQ9IjE0IiBzb3VyY2U9IjExIiB0YXJnZXQ9IjEwOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjg4IiB5PSIxMjciIGFzPSJzb3VyY2VQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgdmFsdWU9IkF6dXJlIEFEIiBzdHlsZT0iaXIucmVmPTc0ZWJmNjdmLWQ3YmMtNDAxMC1hMzQwLWY5MWVmZGJmZGIzODtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSNFNkU2RTY7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtYWN0aXZlLWRpcmVjdG9yeTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHdOekExTmpjM0lEQXVOVGN5TmpJM1REQXVOVEF6TnprNElEQXVPRFV6TnpnNFREQXVPVFEwTmpnM0lEQXVOVGN4TlRNelREQXVPVGs1T1RNMUlEQXVOak0yTURoTU1DNDFNRE0zT1RnZ01DNDVOVFUxTXpGTU1DNHdNVFV6TVRrNElEQXVOak0yTURoTU1DNHdOekExTmpjM0lEQXVOVGN5TmpJM1dpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UQXpNek16SURBdU5UTTJOVFpNTUM0MU1ETTNORElnTUM0d05UazFOekF6VERBdU9URXlNelUzSURBdU5UTTNNVEEzVERBdU5UQXpOelF5SURBdU56azFNamswVERBdU1UQXpNek16SURBdU5UTTJOVFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF6TnpReUlEQXVNRFU1TlRjd00xWXdMamM1TlRJNU5Fd3dMakV3TXpNek15QXdMalV6TmpVMlREQXVOVEF6TnpReUlEQXVNRFU1TlRjd00xb2lJR1pwYkd3OUlpTTFNRVUyUmtZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNemM0TkNBd0xqQTFPVFUzTUROV01DNDNPVFV5T1RSTU1DNDVNVEkwSURBdU5UTTNNVEEzVERBdU5UQXpOemcwSURBdU1EVTVOVGN3TTFvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5Rd1gyeHBibVZoY2lraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNemM0TkNBd0xqUXpPVFk1TjB3d0xqa3hNalFnTUM0MU16Y3dOalJNTUM0MU1ETTNPRFFnTUM0M09UVXlOVEZXTUM0ME16azJPVGRhSWlCbWFXeHNQU0lqTlROQ01VVXdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURNM05ESWdNQzQzT1RVeU5URk1NQzR4TURNek16TWdNQzQxTXpZMU1UZE1NQzQxTURNM05ESWdNQzQwTXprMk9UZFdNQzQzT1RVeU5URmFJaUJtYVd4c1BTSWpPVU5GUWtaR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNRE0zT0RRZ01DNDVOVFUxTXpGTU1DNDVPVGs1TWpFZ01DNDJNell3T0V3d0xqazBORFkzTXlBd0xqVTNNVFV6TTB3d0xqVXdNemM0TkNBd0xqZzFNemM0T0ZZd0xqazFOVFV6TVZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5ReFgyeHBibVZoY2lraUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQzTkRBd09USWlJSGt4UFNJd0xqY3lOelEyTlNJZ2VESTlJakF1TkRnMk9ESTVJaUI1TWowaU1DNHlORGMzTkNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RTVPRGhFT1NJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMamtpSUhOMGIzQXRZMjlzYjNJOUlpTTFORUZGUmpBaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1WOXNhVzVsWVhJaUlIZ3hQU0l3TGpZek1USXpOeUlnZVRFOUlqQXVOVGczT1RReklpQjRNajBpTUM0NE1EWXlOemtpSUhreVBTSXdMamc0T1RnNU1TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRWlJSE4wYjNBdFkyOXNiM0k5SWlNMU5FRkZSakFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNHlPU0lnYzNSdmNDMWpiMnh2Y2owaUl6UkdRVUpGUlNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMalV4SWlCemRHOXdMV052Ykc5eVBTSWpOREZCTWtVNUlpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TnpRaUlITjBiM0F0WTI5c2IzSTlJaU15UVRrelJUQWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0NE9DSWdjM1J2Y0MxamIyeHZjajBpSXpFNU9EaEVPU0l2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFeElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNVFV6TVRrNElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xO2ZpbGxTdHlsZT1hdXRvOyIgcGFyZW50PSIxNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOTYiIHk9IjIzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iIiBzdHlsZT0ic2tldGNoPTE7cG9pbnRlckV2ZW50cz0xO3NoYWRvdz0wO2Rhc2hlZD0wO2h0bWw9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj0jMjZGOEZGO2xhYmVsUG9zaXRpb249Y2VudGVyO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207b3V0bGluZUNvbm5lY3Q9MDt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1jZW50ZXI7c2hhcGU9bXhncmFwaC5vZmZpY2UuY2xvdWRzLm9mZmljZV8zNjU7Zm9udENvbG9yPSM0NjQ5NUQ7cm91bmRlZD0xO2dyYWRpZW50Q29sb3I9bm9uZTsiIHBhcmVudD0iMTQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTYzIiB5PSIxOTUiIHdpZHRoPSIxMDEiIGhlaWdodD0iNjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlNhYVMgKFNhbGVzIEZvcmNlLCBBcmliYSwgSW50ZWxleCwgZXRjKSIgaWQ9IjUzIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9MDdmNzk4NTEtZTQ0ZS00MDY5LWI0YjQtZGY2ODkzZTk3OTBlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc29mdC1henVyZS13ZWItYXBwcztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOamc0TWpRZ01DNDROREl4TWpkRE1DNDJPREF4TVRnZ01DNDVNVEE0T1RrZ01DNDFOamMzTWpZZ01DNDVOREUyTVRjZ01DNDBOVFl6TnpNZ01DNDVNamMxTWpORE1DNHpORFV3TVRrZ01DNDVNVE0wTWprZ01DNHlORE00TWpVZ01DNDROVFUyTnpjZ01DNHhOelV3TlRJZ01DNDNOalk1TnpKRE1DNHhNRFl5TnprZ01DNDJOemd5TmpnZ01DNHdOelUxTmpBNUlEQXVOVFkxT0RjMklEQXVNRGc1TmpVMU1TQXdMalExTkRVeU0wTXdMakV3TXpjME9TQXdMak0wTXpFMk9TQXdMakUyTVRVd01TQXdMakkwTVRrM05pQXdMakkxTURJd055QXdMakUzTXpJd00wd3dMakkxTkRZNE5pQXdMakUzTURJeE4wTXdMak0wTXprZ01DNHhNRE0yTWpRZ01DNDBOVFUzTmpnZ01DNHdOelE0TnprNElEQXVOVFkyTURNMElEQXVNRGt3TWpFM05rTXdMalkzTmpNZ01DNHhNRFUxTlRVZ01DNDNOell3TnpZZ01DNHhOak0zTXprZ01DNDRORE0zTWpnZ01DNHlOVEl4TlRKRE1DNDVNVEV6T0RFZ01DNHpOREExTmpVZ01DNDVOREUwTlRjZ01DNDBOVEl3T0RFZ01DNDVNamMwTXpVZ01DNDFOakkxTWpKRE1DNDVNVE0wTVRNZ01DNDJOekk1TmpJZ01DNDROVFkwTWpRZ01DNDNOek0wTWpVZ01DNDNOamc0TWpRZ01DNDROREl4TWpjaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5Rd1gzSmhaR2xoYkNraUx6NG1JM2hoT3p4d1lYUm9JRzl3WVdOcGRIazlJakF1TmlJZ1pEMGlUVEF1TXprME5UZzBJREF1TkRFNU5UTkRNQzQxTVRReU5Ea2dNQzR6TURVM01Ua2dNQzQyTnpJNU1ETWdNQzR5TkRFNU56SWdNQzQ0TXpnd05EWWdNQzR5TkRFek5EaERNQzQ0TVRZek5UTWdNQzR5TVRRMU1UTWdNQzQzT1RFME5EY2dNQzR4T1RBME5ETWdNQzQzTmpNNE9EY2dNQzR4TmprMk56aERNQzQyT0RNMU5EY2dNQzR4TnpRMk16UWdNQzQyTURRMk1qVWdNQzR4T1RNeE5EUWdNQzQxTXpBME5pQXdMakl5TkRReU5rTXdMalExTkRFd01TQXdMakkxTnpJeU5TQXdMak00TlRBMk1pQXdMak13TkRrME15QXdMak15TnpNNU15QXdMak0yTkRjNE1VTXdMak0xTlRFeE1TQXdMak0zTlRNd01pQXdMak0zT0RZNE1pQXdMak01TkRVd09DQXdMak01TkRVNE5DQXdMalF4T1RVelZqQXVOREU1TlROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDJJaUJrUFNKTk1DNHhPRFE1T0RjZ01DNDFPRGs0TkRSRE1DNHhOamM0T0RnZ01DNDJNekl4T0RVZ01DNHhOVFF3TnpjZ01DNDJOelUzT0RFZ01DNHhORE0yTnpjZ01DNDNNakF5TkRWRE1DNHhOVEk0TmpZZ01DNDNNell5TVRrZ01DNHhOak14TnpnZ01DNDNOVEUxTWpFZ01DNHhOelExTXpVZ01DNDNOall3TXpSRE1DNHhPRE0wT1RRZ01DNDNOemMwT0RJZ01DNHhPVEU1TlRVZ01DNDNPRGM1TXpRZ01DNHlNREU1TURrZ01DNDNPVGd6T0RaRE1DNHlNVE01TXpVZ01DNDNNemt4TkRZZ01DNHlNekU1TkRVZ01DNDJPREV5T0NBd0xqSTFOVFkyTWlBd0xqWXlOVFkzT1VNd0xqSXlPVEE1TlNBd0xqWXlNRGt6TmlBd0xqSXdORFV4TkNBd0xqWXdPRFEzTWlBd0xqRTRORGs0TnlBd0xqVTRPVGcwTkZZd0xqVTRPVGcwTkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVTFJaUJrUFNKTk1DNHlNek00TmpZZ01DNHpOak00TlRaRE1DNHlNVFl6TURJZ01DNHpNVFkzTWpFZ01DNHlNRFEzTmpRZ01DNHlOamMxTlRjZ01DNHhPVGsxTWpRZ01DNHlNVGMxTWpsRE1DNHhOemcyTXpjZ01DNHlNemswTmpZZ01DNHhOakF5TnpNZ01DNHlOak0yTnpNZ01DNHhORFEzTnpVZ01DNHlPRGsyT1RkRE1DNHhOVEF6T1RRZ01DNHpNekF3TURRZ01DNHhOVGs0T1RRZ01DNHpOamsyTnpRZ01DNHhOek14TkRVZ01DNDBNRGd4TlRORE1DNHhPRGczTkRFZ01DNHpPRGM0T1RJZ01DNHlNRGs0TVRFZ01DNHpOekkxTWpFZ01DNHlNek00TmpZZ01DNHpOak00TlRaV01DNHpOak00TlRaYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU56azFOVE1nTUM0Mk1qYzNNRGRETUM0ek5UUTFPVFVnTUM0Mk1qYzNNRGNnTUM0ME1UVTBNamtnTUM0MU5qWTROelFnTUM0ME1UVTBNamtnTUM0ME9URTRNekpETUM0ME1UVTBNamtnTUM0ME1UWTNPU0F3TGpNMU5EVTVOU0F3TGpNMU5UazFOeUF3TGpJM09UVTFNeUF3TGpNMU5UazFOME13TGpJd05EVXhNU0F3TGpNMU5UazFOeUF3TGpFME16WTNOeUF3TGpReE5qYzVJREF1TVRRek5qYzNJREF1TkRreE9ETXlRekF1TVRRek5qYzNJREF1TlRZMk9EYzBJREF1TWpBME5URXhJREF1TmpJM056QTNJREF1TWpjNU5UVXpJREF1TmpJM056QTNXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREZmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDFOU0lnWkQwaVRUQXVORGMzTmpRNElEQXVOelF3TWpVMVF6QXVORGMzTmpZMklEQXVOekk0TkRVMklEQXVORGd3TURVMUlEQXVOekUyTnpneUlEQXVORGcwTmpjeUlEQXVOekExT1RJMFF6QXVORGc1TWpnNUlEQXVOamsxTURZMUlEQXVORGsyTURRZ01DNDJPRFV5TkRVZ01DNDFNRFExTWpRZ01DNDJOemN3TkRaRE1DNDBOVGcyTXprZ01DNDJOVEU0T1RZZ01DNDBNVFl5T1RVZ01DNDJNakEzTmpZZ01DNHpOemcyTURNZ01DNDFPRFEwTnpORE1DNHpOVGc1TURjZ01DNDJNRFUzT0RFZ01DNHpNekk1TWprZ01DNDJNakF5TlRNZ01DNHpNRFEwTkRNZ01DNDJNalUzT0RKRE1DNHpNalk0T1RjZ01DNDJORGczTmpjZ01DNHpOVEV3TVRrZ01DNDJOekF3TmpFZ01DNHpOelkyTVRJZ01DNDJPRGswT0RsRE1DNDBNRGcwTnprZ01DNDNNVE0xTlRNZ01DNDBOREkyTlRjZ01DNDNNelF6T1RNZ01DNDBOemcyTkRNZ01DNDNOVEUzTURORE1DNDBOemd3TmpVZ01DNDNORGM1TVRJZ01DNDBOemMzTXpNZ01DNDNORFF3T0RnZ01DNDBOemMyTkRnZ01DNDNOREF5TlRWYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalUxSWlCa1BTSk5NQzQzT1RFeU9USWdNQzQzTlRBMU5EWkRNQzQzTkRVd05DQXdMamMxTURVM05DQXdMalk1T0RrME1pQXdMamMwTlRJeU9TQXdMalkxTXpreU15QXdMamN6TkRZeE9VTXdMalkxTkRFMk9TQXdMamN6TmpRek5pQXdMalkxTkRFMk9TQXdMamN6T0RJM055QXdMalkxTXpreU15QXdMamMwTURBNU5FTXdMalkxTXprMU55QXdMamMxTVRVME5DQXdMalkxTVRjek1pQXdMamMyTWpnNE9TQXdMalkwTnpNM055QXdMamMzTXpRM09VTXdMalkwTXpBeU1TQXdMamM0TkRBMk9TQXdMall6TmpZeUlEQXVOemt6TmprMklEQXVOakk0TlRRZ01DNDRNREU0TVVNd0xqWTRORFUxTlNBd0xqZ3hNamt3T0NBd0xqYzBNVGMwTWlBd0xqZ3hOamt5TVNBd0xqYzVPRGMxT0NBd0xqZ3hNemMxTlVNd0xqZ3lNRGczTlNBd0xqYzVNemMxTVNBd0xqZzBNRGN6TmlBd0xqYzNNVE00TnlBd0xqZzFOems0TmlBd0xqYzBOekEyTWtNd0xqZ3pOVGcwTVNBd0xqYzBPVFV5SURBdU9ERXpOVGN5SURBdU56VXdOamd6SURBdU56a3hNamt5SURBdU56VXdOVFEyV2lJZ1ptbHNiRDBpSTBZeVJqSkdNaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRZMU9EZzVJREF1T0RJNE56azBRekF1TmpFME9ERTRJREF1T0RJNE56azBJREF1TmpVME5EZ3pJREF1TnpnNU1UTXhJREF1TmpVME5EZ3pJREF1TnpRd01qQXpRekF1TmpVME5EZ3pJREF1TmpreE1qYzFJREF1TmpFME9ERTRJREF1TmpVeE5qRXhJREF1TlRZMU9EZzVJREF1TmpVeE5qRXhRekF1TlRFMk9UWWdNQzQyTlRFMk1URWdNQzQwTnpjeU9UVWdNQzQyT1RFeU56VWdNQzQwTnpjeU9UVWdNQzQzTkRBeU1ETkRNQzQwTnpjeU9UVWdNQzQzT0RreE16RWdNQzQxTVRZNU5pQXdMamd5T0RjNU5DQXdMalUyTlRnNE9TQXdMamd5T0RjNU5Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXlYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU55SWdaRDBpVFRBdU5qYzBOelUzSURBdU5UQTBNVGd5UXpBdU5qYzVNVFV4SURBdU5EZzBOekUwSURBdU5qZzVPREUzSURBdU5EWTNNakkzSURBdU56QTFNVEUzSURBdU5EVTBOREV4UXpBdU5qSXpNVFkxSURBdU16azBPRE0wSURBdU5UUTROalF4SURBdU16STFOalUzSURBdU5EZ3pNVE00SURBdU1qUTRNelU1UXpBdU5EUTBPVFkxSURBdU1qQXpOVE1nTUM0ME1URTJNRElnTUM0eE5UUTRNaUF3TGpNNE16VTVOaUF3TGpFd016QXlOME13TGpNMk5UQXdOaUF3TGpFd09EWXdNU0F3TGpNME5qZzJPU0F3TGpFeE5UVTRPU0F3TGpNeU9UTTBOaUF3TGpFeU16a3pNVU13TGpNMU9UTXhOeUF3TGpFNE1ETXlOU0F3TGpNNU5URTROeUF3TGpJek16TTNPU0F3TGpRek5qTTFNeUF3TGpJNE1qSXdNME13TGpVd05qTXlNU0F3TGpNMk5UYzROQ0F3TGpVNE5qUXdNaUF3TGpRME1ETTBPU0F3TGpZM05EYzFOeUF3TGpVd05ERTRNbFl3TGpVd05ERTRNbG9pSUdacGJHdzlJaU5HTWtZeVJqSWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMyTnpJNE5pQXdMall4TlRFek4wTXdMamd4T1RJek9TQXdMall4TlRFek55QXdMamcyTVRNMU5TQXdMalUzTXpBeU1TQXdMamcyTVRNMU5TQXdMalV5TVRBMk9VTXdMamcyTVRNMU5TQXdMalEyT1RFeE55QXdMamd4T1RJek9TQXdMalF5TnpBd01pQXdMamMyTnpJNE5pQXdMalF5TnpBd01rTXdMamN4TlRNek5DQXdMalF5TnpBd01pQXdMalkzTXpJeE9DQXdMalEyT1RFeE55QXdMalkzTXpJeE9DQXdMalV5TVRBMk9VTXdMalkzTXpJeE9DQXdMalUzTXpBeU1TQXdMamN4TlRNek5DQXdMall4TlRFek55QXdMamMyTnpJNE5pQXdMall4TlRFek4xb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXpYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU5UVWlJR1E5SWswd0xqa3lOVEE1TkNBd0xqVTRORFF6T0V3d0xqa3dOelkzTkNBd0xqVTNOVGszTjB3d0xqZzVNamMwTXlBd0xqVTJPREF4TkVnd0xqZzRPVGMxTjB3d0xqZzNOamd4TmlBd0xqVTFOelUyTWtnd0xqZzNNek16TWt3d0xqZzFOemt3TXlBd0xqVTBOell3TjBNd0xqZzFNalUxT1NBd0xqVTJOVGt6TkNBd0xqZzBNVE0zTXlBd0xqVTRNakF4TXlBd0xqZ3lOakExSURBdU5Ua3pNemszUXpBdU9ETXlNREl5SURBdU5UazNNemM1SURBdU9ETTRORGt6SURBdU5qQXdPRFl6SURBdU9EUTBPVFl6SURBdU5qQTBNelEzVERBdU9EUTRPVFExSURBdU5qQTJPRE0yVERBdU9EWTJNelkwSURBdU5qRTJNamt5VERBdU9UQTVNVFk0SURBdU5qTTROamxETUM0NU1UVXhPVGtnTUM0Mk1qQTJNVFVnTUM0NU1qQXdNakVnTUM0Mk1ESXhOVGdnTUM0NU1qTTJNREVnTUM0MU9ETTBORE5NTUM0NU1qVXdPVFFnTUM0MU9EUTBNemhhSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TnprMU5UTWdNQzQyTWpjM01EZERNQzR6TlRRMU9UVWdNQzQyTWpjM01EY2dNQzQwTVRVME1qa2dNQzQxTmpZNE56UWdNQzQwTVRVME1qa2dNQzQwT1RFNE16SkRNQzQwTVRVME1qa2dNQzQwTVRZM09TQXdMak0xTkRVNU5TQXdMak0xTlRrMU55QXdMakkzT1RVMU15QXdMak0xTlRrMU4wTXdMakl3TkRVeE1TQXdMak0xTlRrMU55QXdMakUwTXpZM055QXdMalF4TmpjNUlEQXVNVFF6TmpjM0lEQXVORGt4T0RNeVF6QXVNVFF6TmpjM0lEQXVOVFkyT0RjMElEQXVNakEwTlRFeElEQXVOakkzTnpBM0lEQXVNamM1TlRVeklEQXVOakkzTnpBM1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREUmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFkxT0RnNUlEQXVPREk0TnprMFF6QXVOakUwT0RFNElEQXVPREk0TnprMElEQXVOalUwTkRneklEQXVOemc1TVRNeElEQXVOalUwTkRneklEQXVOelF3TWpBelF6QXVOalUwTkRneklEQXVOamt4TWpjMUlEQXVOakUwT0RFNElEQXVOalV4TmpFeElEQXVOVFkxT0RnNUlEQXVOalV4TmpFeFF6QXVOVEUyT1RZZ01DNDJOVEUyTVRFZ01DNDBOemN5T1RVZ01DNDJPVEV5TnpVZ01DNDBOemN5T1RVZ01DNDNOREF5TURORE1DNDBOemN5T1RVZ01DNDNPRGt4TXpFZ01DNDFNVFk1TmlBd0xqZ3lPRGM1TkNBd0xqVTJOVGc0T1NBd0xqZ3lPRGM1TkZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5RMVgyeHBibVZoY2lraUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BISmhaR2xoYkVkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmNtRmthV0ZzSWlCamVEMGlNQ0lnWTNrOUlqQWlJSEk5SWpFaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUJuY21Ga2FXVnVkRlJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5UQTVNRGt5SURBdU5UQTNOakUxS1NCelkyRnNaU2d3TGpReU16QTRNU2tpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRTRJaUJ6ZEc5d0xXTnZiRzl5UFNJak5VVkJNRVZHSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlNd01EYzRSRFFpTHo0bUkzaGhPend2Y21Ga2FXRnNSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTVY5c2FXNWxZWElpSUhneFBTSXdMakk0TURVME9DSWdlVEU5SWpBdU5qTXhNVGt4SWlCNE1qMGlNQzR5Tnprd05UVWlJSGt5UFNJd0xqUXpORFU1TlNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTkRRME5EUXlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrTkdRMFpESWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERKZmJHbHVaV0Z5SWlCNE1UMGlNQzQxTmpVNE9Ea2lJSGt4UFNJd0xqZ3lPRGM1TkNJZ2VESTlJakF1TlRZMU9EZzVJaUI1TWowaU1DNDJOVEl4TURraUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRRME5EUTBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkRSa05HUXlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5RelgyeHBibVZoY2lJZ2VERTlJakF1TnpZM01qZzJJaUI1TVQwaU1DNDJNVFEyTXpraUlIZ3lQU0l3TGpjMk56STROaUlnZVRJOUlqQXVOREkzTURBeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRME5EUTBORElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdRMFpEUmtNaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME5GOXNhVzVsWVhJaUlIZ3hQU0l3TGpJNE1EVTBPQ0lnZVRFOUlqQXVOak14TVRreElpQjRNajBpTUM0eU56a3dOVFVpSUhreVBTSXdMalF6TkRVNU5TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJME5EUTBORFF5SXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpSa05HUTBaRElpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREVmZiR2x1WldGeUlpQjRNVDBpTUM0MU5qVTRPRGtpSUhreFBTSXdMamd5T0RjNU5DSWdlREk5SWpBdU5UWTFPRGc1SWlCNU1qMGlNQzQyTlRJeE1Ea2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5EUTBORFEwTWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpEUmtOR1F5SXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01UVXpPREE1SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjE0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI1IiB5PSIxNzAiIHdpZHRoPSIxMDciIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEwOSIgdmFsdWU9IldWRCIgc3R5bGU9ImlyLnJlZj0zMmEwODVlZi1iNjg3LTQ3N2MtYTYwZi0xMWEwY2U3ODk5NDE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2dyYWRpZW50Q29sb3I9I2ZmZmZmZjsiIHBhcmVudD0iMTQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzA0IiB5PSIxODAuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzOSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNDQ0U1RkY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RiZWFmNztzaGFwZT1mbGV4QXJyb3c7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDkiIHRhcmdldD0iMzAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjE1OC45MjcyNTE3MzIxMDE3IiB5PSI1NC41IiBhcz0ic291cmNlUG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNTIiIHZhbHVlPSJQdWJsaWMiIHN0eWxlPSJpci5yZWY9NjM3NmQ1M2UtNjQ2MS00MTJiLThlMDQtN2IzZmUyYjM5N2RlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM0NjQ5NUQ7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI2MCIgeT0iLTc1IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjUxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVlBOIEdhdGV3YXkiIGlkPSI0NyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPThjODQxYjY2LTkzYjMtNDhjMy1hOWExLWI0MTkwZDY2YTQ2Mjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVlBOLUdXO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOemN3TURnMUlEQXVORGcyTURJM1NEQXVOekkxTmpBeFZqQXVNelV3TnprNFF6QXVOekkxT1RnM0lEQXVNamczTWpnMElEQXVOekF5TXpVeUlEQXVNakkxT1RFeklEQXVOalU1TXpJZ01DNHhOemcyT0RoRE1DNDJNemt4T1RNZ01DNHhOVFUxTkRVZ01DNDJNVFF5TURZZ01DNHhNemNnTUM0MU9EWXdPVElnTUM0eE1qUXpNemxETUM0MU5UYzVOemtnTUM0eE1URTJOemdnTUM0MU1qYzBNVEVnTUM0eE1EVXlNRFFnTUM0ME9UWTFNU0F3TGpFd05UTTJOa013TGpRMk5UTXdPU0F3TGpFd05EazBPQ0F3TGpRek5ETTVOeUF3TGpFeE1USTVOeUF3TGpRd05UazFOaUF3TGpFeU16azJOME13TGpNM056VXhOaUF3TGpFek5qWXpOeUF3TGpNMU1qSTBNaUF3TGpFMU5UTXhOeUF3TGpNek1Ua3lJREF1TVRjNE5qZzRRekF1TWpnNE5UZzJJREF1TWpJMU56TXhJREF1TWpZME9UQTFJREF1TWpnM01qSXpJREF1TWpZMU5qTTVJREF1TXpVd056azRWakF1TkRnMk1ESTNTREF1TWpJNU5qQTNRekF1TWpJeE5UQXpJREF1TkRnMk1UUWdNQzR5TVRNM05qSWdNQzQwT0Rrek5qZ2dNQzR5TURnd016RWdNQzQwT1RVd01qVkRNQzR5TURJeU9Ua2dNQzQxTURBMk9ESWdNQzR4T1Rrd01qa2dNQzQxTURnek1qSWdNQzR4T1RnNU1UUWdNQzQxTVRZek1qRldNQzQ0TmpjMU5qVkRNQzR4T1Rrd01qa2dNQzQ0TnpVMU5qVWdNQzR5TURJeU9Ua2dNQzQ0T0RNeU1EUWdNQzR5TURnd016RWdNQzQ0T0RnNE5qRkRNQzR5TVRNM05qSWdNQzQ0T1RRMU1UZ2dNQzR5TWpFMU1ETWdNQzQ0T1RjM05EY2dNQzR5TWprMk1EY2dNQzQ0T1RjNE5rZ3dMamMzTURBNE5VTXdMamMzT0RJek1pQXdMamc1TnpjMUlEQXVOemcyTURJeElEQXVPRGswTlRNMklEQXVOemt4T0RJMElEQXVPRGc0T0RreFF6QXVOemszTmpJM0lEQXVPRGd6TWpRMUlEQXVPREF3T1RrMUlEQXVPRGMxTmpBMElEQXVPREF4TWpJeklEQXVPRFkzTlRZMVZqQXVOVEUyTXpJeFF6QXVPREF3T1RrMUlEQXVOVEE0TWpneUlEQXVOemszTmpJM0lEQXVOVEF3TmpReUlEQXVOemt4T0RJMElEQXVORGswT1RrMlF6QXVOemcyTURJeElEQXVORGc1TXpVZ01DNDNOemd5TXpJZ01DNDBPRFl4TXpjZ01DNDNOekF3T0RVZ01DNDBPRFl3TWpkV01DNDBPRFl3TWpkYVRUQXVOakl3TVRjMUlEQXVORGcyTURJM1NEQXVNemN5T0RRMVZqQXVNelE0TmpBeVF6QXVNemN6TWpRMUlEQXVNekV6TkRVZ01DNHpPRGN3TmpVZ01DNHlOemszTkNBd0xqUXhNVFUwTmlBd0xqSTFOREl3TmtNd0xqUXlNVGszSURBdU1qUXlOREV5SURBdU5ETTBPREU1SURBdU1qTXlPVFEwSURBdU5EUTVNak01SURBdU1qSTJORE0wUXpBdU5EWXpOalU1SURBdU1qRTVPVEl6SURBdU5EYzVNekU0SURBdU1qRTJOVEU1SURBdU5EazFNVGMxSURBdU1qRTJORFEzUXpBdU5URXhNRGt6SURBdU1qRTJOVFFnTUM0MU1qWTRNVElnTUM0eU1UazVOVElnTUM0MU5ERXpJREF1TWpJMk5EVTVRekF1TlRVMU56ZzVJREF1TWpNeU9UWTJJREF1TlRZNE56SXhJREF1TWpReU5ESXlJREF1TlRjNU1qVWdNQzR5TlRReU1EWkRNQzQxT0RRMU1qTWdNQzR5TmpBd09UUWdNQzQxT0RreU9EUWdNQzR5TmpZME1Ea2dNQzQxT1RNME9EUWdNQzR5TnpNd09EVldNQzR5TnpNd09EVkRNQzQyTVRBeE5qa2dNQzR5T1RRM05EUWdNQzQyTVRrMk5EZ2dNQzR6TWpBNU56SWdNQzQyTWpBMk1Ua2dNQzR6TkRneE5qTk1NQzQyTWpBeE56VWdNQzQwT0RZd01qZGFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTWpVMU56a2dNQzQwT0RZd09EUklNQzQzTnpBd05qTkRNQzQzTnpneU1TQXdMalE0TmpFNU5DQXdMamM0TlRrNU9TQXdMalE0T1RRd09DQXdMamM1TVRnd01pQXdMalE1TlRBMU0wTXdMamM1TnpZd05TQXdMalV3TURZNU9TQXdMamd3TURrM015QXdMalV3T0RNMElEQXVPREF4TWpBeUlEQXVOVEUyTXpjNVZqQXVPRFkzTmpJelF6QXVPREF3T1RjeklEQXVPRGMxTmpZeUlEQXVOemszTmpBMUlEQXVPRGd6TXpBeUlEQXVOemt4T0RBeUlEQXVPRGc0T1RRNFREQXVNakE0TURBNElEQXVORGsxTURnelF6QXVNakV6TnpNNUlEQXVORGc1TkRJMklEQXVNakl4TkRnZ01DNDBPRFl4T1RjZ01DNHlNamsxT0RRZ01DNDBPRFl3T0RSSU1DNHlOalUyTVRaSU1DNHpOekk0TWpKSU1DNDJNakF4TlRKSU1DNDNNalUxTnpsYUlpQm1hV3hzUFNJak5UQkZOa1pHSWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMaklpSUdROUlrMHdMamN5TlRZd05TQXdMalE0TmpNeU9FZ3dMamMzTURBNE9VTXdMamMzT0RJek55QXdMalE0TmpRek9DQXdMamM0TmpBeU5pQXdMalE0T1RZMU1pQXdMamM1TVRneU9TQXdMalE1TlRJNU4wd3dMakl3T0RBek1TQXdMamc0T1RFMk0wTXdMakl3TWpJNU9TQXdMamc0TXpVd05pQXdMakU1T1RBeU9TQXdMamczTlRnMk5pQXdMakU1T0RreE5DQXdMamcyTnpnMk4xWXdMalV4TmpZeU0wTXdMakU1T1RBeU9TQXdMalV3T0RZeU5DQXdMakl3TWpJNU9TQXdMalV3TURrNE5DQXdMakl3T0RBek1TQXdMalE1TlRNeU4wTXdMakl4TXpjMk1pQXdMalE0T1RZM0lEQXVNakl4TlRBeklEQXVORGcyTkRReUlEQXVNakk1TmpBNElEQXVORGcyTXpJNFNEQXVNalkxTmpSSU1DNHpOekk0TkRaSU1DNDJNakF4TnpoSU1DNDNNalUyTURWYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRRMk1UWXlJREF1TlRjeU5EZzNUREF1TkRrNU5UTTBJREF1TlRFNE5UVTRRekF1TlRBd01EazFJREF1TlRFNE1EZ3pJREF1TlRBd09EQXpJREF1TlRFM09ESXlJREF1TlRBeE5UTTFJREF1TlRFM09ESXlRekF1TlRBeU1qWTNJREF1TlRFM09ESXlJREF1TlRBeU9UYzJJREF1TlRFNE1EZ3pJREF1TlRBek5UTTNJREF1TlRFNE5UVTRUREF1TlRVMk5EWTBJREF1TlRjeU5EZzNRekF1TlRVMk9ETXhJREF1TlRjeU56TXpJREF1TlRVM01UTXlJREF1TlRjek1EWTNJREF1TlRVM016UWdNQzQxTnpNME5UbERNQzQxTlRjMU5EZ2dNQzQxTnpNNE5URWdNQzQxTlRjMk5UY2dNQzQxTnpReU9Ea2dNQzQxTlRjMk5UY2dNQzQxTnpRM016UkRNQzQxTlRjMk5UY2dNQzQxTnpVeE56a2dNQzQxTlRjMU5EZ2dNQzQxTnpVMk1UY2dNQzQxTlRjek5DQXdMalUzTmpBd09VTXdMalUxTnpFek1pQXdMalUzTmpRd01pQXdMalUxTmpnek1TQXdMalUzTmpjek5TQXdMalUxTmpRMk5DQXdMalUzTmprNE1VZ3dMalV5TlRNelF6QXVOVEkwTmpJeklEQXVOVGMyT1RneElEQXVOVEl6T1RRMElEQXVOVGMzTWpZMklEQXVOVEl6TkRReklEQXVOVGMzTnpjeFF6QXVOVEl5T1RReklEQXVOVGM0TWpjM0lEQXVOVEl5TmpZeUlEQXVOVGM0T1RZeklEQXVOVEl5TmpZeUlEQXVOVGM1TmpjNFZqQXVOalE0T0RnM1F6QXVOVEl5TmpZeUlEQXVOalE1TmpBeUlEQXVOVEl5TXpnZ01DNDJOVEF5T0RnZ01DNDFNakU0T0NBd0xqWTFNRGM1TTBNd0xqVXlNVE00SURBdU5qVXhNams1SURBdU5USXdOekF4SURBdU5qVXhOVGd6SURBdU5URTVPVGt6SURBdU5qVXhOVGd6U0RBdU5EZzBPRFUyUXpBdU5EZzBORGc1SURBdU5qVXhOalk1SURBdU5EZzBNVEExSURBdU5qVXhOalU1SURBdU5EZ3pOelF5SURBdU5qVXhOVFUwUXpBdU5EZ3pNemM1SURBdU5qVXhORFE1SURBdU5EZ3pNRFE1SURBdU5qVXhNalV6SURBdU5EZ3lOemd5SURBdU5qVXdPVGd6UXpBdU5EZ3lOVEUxSURBdU5qVXdOekV6SURBdU5EZ3lNeklnTUM0Mk5UQXpOemtnTUM0ME9ESXlNVFlnTUM0Mk5UQXdNVE5ETUM0ME9ESXhNVElnTUM0Mk5EazJORFlnTUM0ME9ESXhNRE1nTUM0Mk5Ea3lOVGdnTUM0ME9ESXhPRGdnTUM0Mk5EZzRPRGRXTUM0MU56azJOemhETUM0ME9ESXdPQ0F3TGpVM09Ea3lOQ0F3TGpRNE1UY3dOU0F3TGpVM09ESXpOU0F3TGpRNE1URXpNeUF3TGpVM056Y3pPVU13TGpRNE1EVTJJREF1TlRjM01qUXpJREF1TkRjNU9ESTVJREF1TlRjMk9UYzBJREF1TkRjNU1EYzFJREF1TlRjMk9UZ3hTREF1TkRRM09UUXhRekF1TkRRM05EUTBJREF1TlRjMk9UUXpJREF1TkRRMk9UWTNJREF1TlRjMk56WTFJREF1TkRRMk5UWTFJREF1TlRjMk5EWTJRekF1TkRRMk1UWXpJREF1TlRjMk1UWTRJREF1TkRRMU9EVXhJREF1TlRjMU56WXlJREF1TkRRMU5qWTJJREF1TlRjMU1qazBRekF1TkRRMU5EZ3hJREF1TlRjME9ESTJJREF1TkRRMU5ESTVJREF1TlRjME16RTFJREF1TkRRMU5URTNJREF1TlRjek9ERTVRekF1TkRRMU5qQTBJREF1TlRjek16SXpJREF1TkRRMU9ESTRJREF1TlRjeU9EWXlJREF1TkRRMk1UWXlJREF1TlRjeU5EZzNWakF1TlRjeU5EZzNXazB3TGpVMU5qQXhPU0F3TGpneE9EYzJNMHd3TGpVd016QTVNaUF3TGpnM01qSTBNa013TGpVd01qZzBNU0F3TGpnM01qVXlPU0F3TGpVd01qVXpOQ0F3TGpnM01qYzFPU0F3TGpVd01qRTRPQ0F3TGpnM01qa3hOa013TGpVd01UZzBNeUF3TGpnM016QTNOQ0F3TGpVd01UUTJPU0F3TGpnM016RTFOU0F3TGpVd01UQTVJREF1T0Rjek1UVTFRekF1TlRBd056RXlJREF1T0Rjek1UVTFJREF1TlRBd016TTRJREF1T0Rjek1EYzBJREF1TkRrNU9Ua3pJREF1T0RjeU9URTJRekF1TkRrNU5qUTNJREF1T0RjeU56VTVJREF1TkRrNU16TTVJREF1T0RjeU5USTVJREF1TkRrNU1EZzVJREF1T0RjeU1qUXlUREF1TkRRMk1UWXlJREF1T0RFNE56WXpRekF1TkRRMU56azFJREF1T0RFNE5URTNJREF1TkRRMU5EazBJREF1T0RFNE1UZ3pJREF1TkRRMU1qZzJJREF1T0RFM056a3hRekF1TkRRMU1EYzNJREF1T0RFM016azVJREF1TkRRME9UWTRJREF1T0RFMk9UWXhJREF1TkRRME9UWTRJREF1T0RFMk5URTJRekF1TkRRME9UWTRJREF1T0RFMk1EY3hJREF1TkRRMU1EYzNJREF1T0RFMU5qTXpJREF1TkRRMU1qZzJJREF1T0RFMU1qUXhRekF1TkRRMU5EazBJREF1T0RFME9EUTVJREF1TkRRMU56azFJREF1T0RFME5URTFJREF1TkRRMk1UWXlJREF1T0RFME1qWTVTREF1TkRjM01qazFRekF1TkRjNE1EVWdNQzQ0TVRReU56Y2dNQzQwTnpnM09ERWdNQzQ0TVRRd01EZ2dNQzQwTnprek5UUWdNQzQ0TVRNMU1USkRNQzQwTnprNU1qWWdNQzQ0TVRNd01UWWdNQzQwT0RBek1ERWdNQzQ0TVRJek1qY2dNQzQwT0RBME1Ea2dNQzQ0TVRFMU56SldNQzQzTkRFNU1UUkRNQzQwT0RBME1Ea2dNQzQzTkRFeE9Ua2dNQzQwT0RBMk9TQXdMamMwTURVeE15QXdMalE0TVRFNUlEQXVOelF3TURBM1F6QXVORGd4TmpreElEQXVOek01TlRBeUlEQXVORGd5TXpjZ01DNDNNemt5TVRnZ01DNDBPRE13TnpjZ01DNDNNemt5TVRoSU1DNDFNVFU1T1VNd0xqVXhOalk1T0NBd0xqY3pPVEl4T0NBd0xqVXhOek0zTnlBd0xqY3pPVFV3TWlBd0xqVXhOemczTnlBd0xqYzBNREF3TjBNd0xqVXhPRE0zT0NBd0xqYzBNRFV4TXlBd0xqVXhPRFkxT1NBd0xqYzBNVEU1T1NBd0xqVXhPRFkxT1NBd0xqYzBNVGt4TkZZd0xqZ3hNVFUzTWtNd0xqVXhPRFkxT1NBd0xqZ3hNakk0TnlBd0xqVXhPRGswSURBdU9ERXlPVGN6SURBdU5URTVORFFnTUM0NE1UTTBOemxETUM0MU1UazVOREVnTUM0NE1UTTVPRFVnTUM0MU1qQTJNaUF3TGpneE5ESTJPU0F3TGpVeU1UTXlOeUF3TGpneE5ESTJPVWd3TGpVMU1qUTJNVU13TGpVMU16QTFNU0F3TGpneE16YzVNaUF3TGpVMU16Z3dOQ0F3TGpneE16VTNNU0F3TGpVMU5EVTFOU0F3TGpneE16WTFOa013TGpVMU5UTXdOU0F3TGpneE16YzBJREF1TlRVMU9Ua3lJREF1T0RFME1USXlJREF1TlRVMk5EWTBJREF1T0RFME56RTRRekF1TlRVMk9UTTJJREF1T0RFMU16RTBJREF1TlRVM01UVTBJREF1T0RFMk1EYzFJREF1TlRVM01EY3hJREF1T0RFMk9ETTBRekF1TlRVMk9UZzNJREF1T0RFM05Ua3lJREF1TlRVMk5qQTVJREF1T0RFNE1qZzJJREF1TlRVMk1ERTVJREF1T0RFNE56WXpWakF1T0RFNE56WXpXazB3TGpNME5qazNPU0F3TGpjME9URXdOVll3TGpjeE56WTBOa013TGpNME5qazNPU0F3TGpjeE5qa3pNU0F3TGpNME5qWTVPQ0F3TGpjeE5qSTBOU0F3TGpNME5qRTVOeUF3TGpjeE5UY3pPVU13TGpNME5UWTVOeUF3TGpjeE5USXpOQ0F3TGpNME5UQXhPQ0F3TGpjeE5EazFJREF1TXpRME16RWdNQzQzTVRRNU5VZ3dMakkzTnpFMVF6QXVNamMyTkRReklEQXVOekUwT1RVZ01DNHlOelUzTmpRZ01DNDNNVFEyTmpZZ01DNHlOelV5TmpNZ01DNDNNVFF4TmtNd0xqSTNORGMyTXlBd0xqY3hNelkxTkNBd0xqSTNORFE0TWlBd0xqY3hNamsyT0NBd0xqSTNORFE0TWlBd0xqY3hNakkxTTFZd0xqWTRNRE0wTlVNd0xqSTNOREl5TlNBd0xqWTNPVGt3T0NBd0xqSTNOREE1TmlBd0xqWTNPVFF3TnlBd0xqSTNOREV4SURBdU5qYzRPRGs1UXpBdU1qYzBNVEl6SURBdU5qYzRNemt4SURBdU1qYzBNamM0SURBdU5qYzNPRGs0SURBdU1qYzBOVFUzSURBdU5qYzNORGMxUXpBdU1qYzBPRE0ySURBdU5qYzNNRFV5SURBdU1qYzFNakkzSURBdU5qYzJOekU0SURBdU1qYzFOamcySURBdU5qYzJOVEZETUM0eU56WXhORFVnTUM0Mk56WXpNRElnTUM0eU56WTJOVElnTUM0Mk56WXlNeUF3TGpJM056RTFJREF1TmpjMk16QXhTREF1TXpRME16RkRNQzR6TkRVd01UZ2dNQzQyTnpZek1ERWdNQzR6TkRVMk9UY2dNQzQyTnpZd01UWWdNQzR6TkRZeE9UY2dNQzQyTnpVMU1URkRNQzR6TkRZMk9UZ2dNQzQyTnpVd01EVWdNQzR6TkRZNU56a2dNQzQyTnpRek1Ua2dNQzR6TkRZNU56a2dNQzQyTnpNMk1EUldNQzQyTkRJeE5EWkRNQzR6TkRjd016VWdNQzQyTkRFMU9Ua2dNQzR6TkRjeU16RWdNQzQyTkRFd056Y2dNQzR6TkRjMU5EZ2dNQzQyTkRBMk16SkRNQzR6TkRjNE5qVWdNQzQyTkRBeE9EWWdNQzR6TkRneU9UTWdNQzQyTXprNE16SWdNQzR6TkRnM09EY2dNQzQyTXprMk1EVkRNQzR6TkRreU9ESWdNQzQyTXprek56Y2dNQzR6TkRrNE1qY2dNQzQyTXpreU9EVWdNQzR6TlRBek5qZ2dNQzQyTXprek16ZERNQzR6TlRBNU1Ea2dNQzQyTXprek9EZ2dNQzR6TlRFME1qY2dNQzQyTXprMU9ESWdNQzR6TlRFNE56RWdNQzQyTXprNE9UbE1NQzQwTURRM09UZ2dNQzQyT1RNNE1qZERNQzQwTURVeU16WWdNQzQyT1RRek1qSWdNQzQwTURVME56Z2dNQzQyT1RRNU5qSWdNQzQwTURVME56Z2dNQzQyT1RVMk1qVkRNQzQwTURVME56Z2dNQzQyT1RZeU9EZ2dNQzQwTURVeU16WWdNQzQyT1RZNU1qZ2dNQzQwTURRM09UZ2dNQzQyT1RjME1qTk1NQzR6TlRFNE56RWdNQzQzTlRFek5USkRNQzR6TlRFME1qY2dNQzQzTlRFMk5qZ2dNQzR6TlRBNU1Ea2dNQzQzTlRFNE5qSWdNQzR6TlRBek5qZ2dNQzQzTlRFNU1UUkRNQzR6TkRrNE1qY2dNQzQzTlRFNU5qVWdNQzR6TkRreU9ESWdNQzQzTlRFNE56TWdNQzR6TkRnM09EY2dNQzQzTlRFMk5EWkRNQzR6TkRneU9UTWdNQzQzTlRFME1UZ2dNQzR6TkRjNE5qVWdNQzQzTlRFd05qUWdNQzR6TkRjMU5EZ2dNQzQzTlRBMk1UaERNQzR6TkRjeU16RWdNQzQzTlRBeE56TWdNQzR6TkRjd016VWdNQzQzTkRrMk5URWdNQzR6TkRZNU56a2dNQzQzTkRreE1EVldNQzQzTkRreE1EVmFUVEF1TmpVMU1qQXlJREF1TmpReU1UUTJWakF1Tmpjek5qQTBRekF1TmpVMU1qQXlJREF1TmpjME16RTVJREF1TmpVMU5EZ3pJREF1TmpjMU1EQTFJREF1TmpVMU9UZzBJREF1TmpjMU5URXhRekF1TmpVMk5EZzBJREF1TmpjMk1ERTJJREF1TmpVM01UWXpJREF1TmpjMk16QXhJREF1TmpVM09EY3hJREF1TmpjMk16QXhTREF1TnpJMk16WTFRekF1TnpJMk16WTFJREF1TmpjMk16QXhJREF1TnpJNU5EYzRJREF1TmpjMk16QXhJREF1TnpJNU5EYzRJREF1TmpjNE9UazNWakF1TnpFeU1qVXpRekF1TnpJNU16Y3hJREF1TnpFek1EQTNJREF1TnpJNE9UazJJREF1TnpFek5qazNJREF1TnpJNE5ESXpJREF1TnpFME1Ua3lRekF1TnpJM09EVWdNQzQzTVRRMk9EZ2dNQzQzTWpjeE1Ua2dNQzQzTVRRNU5UY2dNQzQzTWpZek5qVWdNQzQzTVRRNU5VZ3dMalkxTnpnM01VTXdMalkxTnpVeUlEQXVOekUwT1RVZ01DNDJOVGN4TnpNZ01DNDNNVFV3TVRrZ01DNDJOVFk0TlNBd0xqY3hOVEUxTlVNd0xqWTFOalV5TmlBd0xqY3hOVEk1SURBdU5qVTJNak15SURBdU56RTFORGc1SURBdU5qVTFPVGcwSURBdU56RTFOek01UXpBdU5qVTFOek0ySURBdU56RTFPVGtnTUM0Mk5UVTFNemtnTUM0M01UWXlPRGNnTUM0Mk5UVTBNRFVnTUM0M01UWTJNVFJETUM0Mk5UVXlOekVnTUM0M01UWTVOREVnTUM0Mk5UVXlNRElnTUM0M01UY3lPVElnTUM0Mk5UVXlNRElnTUM0M01UYzJORFpXTUM0M05Ea3hNRFZETUM0Mk5UVXlOVEVnTUM0M05EazJORFVnTUM0Mk5UVXhNemdnTUM0M05UQXhPRGdnTUM0Mk5UUTROemNnTUM0M05UQTJOak5ETUM0Mk5UUTJNVFlnTUM0M05URXhNemNnTUM0Mk5UUXlNVGtnTUM0M05URTFNakVnTUM0Mk5UTTNNemdnTUM0M05URTNOalJETUM0Mk5UTXlOVGdnTUM0M05USXdNRGNnTUM0Mk5USTNNVFlnTUM0M05USXdPVGNnTUM0Mk5USXhPRE1nTUM0M05USXdNalJETUM0Mk5URTJOVEVnTUM0M05URTVOU0F3TGpZMU1URTFNeUF3TGpjMU1UY3hOaUF3TGpZMU1EYzFOQ0F3TGpjMU1UTTFNa3d3TGpVNU56Z3lOeUF3TGpZNU56UXlNMVl3TGpZNU16Z3lOMHd3TGpZMU1EYzFOQ0F3TGpZek9UZzVPVU13TGpZMU1EYzFOQ0F3TGpZek9UZzVPU0F3TGpZMU5USXdNaUF3TGpZek9UUTBPU0F3TGpZMU5USXdNaUF3TGpZME1qRTBObFl3TGpZME1qRTBObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOFpHVm1jejRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gyeHBibVZoY2lJZ2VERTlJakF1TkRneU1qYzFJaUI1TVQwaUxUQXVNak0yTmpVNElpQjRNajBpTUM0MU1EVXlORE1pSUhreVBTSXdMams0TlRZNE1pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqSXlJaUJ6ZEc5d0xXTnZiRzl5UFNJak16SkVORVkxSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVORGNpSUhOMGIzQXRZMjlzYjNJOUlpTXpNVVF4UmpNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzQyTXlJZ2MzUnZjQzFqYjJ4dmNqMGlJekpGUXpsRlFpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpjM0lpQnpkRzl3TFdOdmJHOXlQU0lqTWpsQ1FVUkZJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU9Ea2lJSE4wYjNBdFkyOXNiM0k5SWlNeU1rRTFRMElpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpFNU9FRkNNeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1MiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMSIgeT0iMjQuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48b2JqZWN0IGxhYmVsPSJPa3RhIC0gTUZBIiBpZD0iMTIiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zZmQzYmQyYi05N2JkLTQzNDctOTdhMi0zODFmOGFkMGRmOGI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1MiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNC41IiB5PSIzODYiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNjkiIHZhbHVlPSImbHQ7ZGl2PkEzJmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM4MmIzNjY7ZmlsbENvbG9yPSNkNWU4ZDQ7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9IjUyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjI5NCIgd2lkdGg9IjIzIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTsiIHBhcmVudD0iMSIgc291cmNlPSI3NCIgdGFyZ2V0PSIyOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jODJiMzY2O3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7c3RhcnRBcnJvdz1ub25lO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjY3IiB0YXJnZXQ9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTUiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzQ2NDk1RDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7c2tldGNoPTE7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDAxIiB5PSIzMjIiIHdpZHRoPSIyNjciIGhlaWdodD0iMTIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJIRUMiIGlkPSI1NCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTc3NjM4N2I4LTcxODQtNDE0ZS04MTgzLTNkNmQ2YmMxOWZmMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtd2ViLWFwcHM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTmpnNE1qUWdNQzQ0TkRJeE1qZERNQzQyT0RBeE1UZ2dNQzQ1TVRBNE9Ua2dNQzQxTmpjM01qWWdNQzQ1TkRFMk1UY2dNQzQwTlRZek56TWdNQzQ1TWpjMU1qTkRNQzR6TkRVd01Ua2dNQzQ1TVRNME1qa2dNQzR5TkRNNE1qVWdNQzQ0TlRVMk56Y2dNQzR4TnpVd05USWdNQzQzTmpZNU56SkRNQzR4TURZeU56a2dNQzQyTnpneU5qZ2dNQzR3TnpVMU5qQTVJREF1TlRZMU9EYzJJREF1TURnNU5qVTFNU0F3TGpRMU5EVXlNME13TGpFd016YzBPU0F3TGpNME16RTJPU0F3TGpFMk1UVXdNU0F3TGpJME1UazNOaUF3TGpJMU1ESXdOeUF3TGpFM016SXdNMHd3TGpJMU5EWTROaUF3TGpFM01ESXhOME13TGpNME16a2dNQzR4TURNMk1qUWdNQzQwTlRVM05qZ2dNQzR3TnpRNE56azRJREF1TlRZMk1ETTBJREF1TURrd01qRTNOa013TGpZM05qTWdNQzR4TURVMU5UVWdNQzQzTnpZd056WWdNQzR4TmpNM016a2dNQzQ0TkRNM01qZ2dNQzR5TlRJeE5USkRNQzQ1TVRFek9ERWdNQzR6TkRBMU5qVWdNQzQ1TkRFME5UY2dNQzQwTlRJd09ERWdNQzQ1TWpjME16VWdNQzQxTmpJMU1qSkRNQzQ1TVRNME1UTWdNQzQyTnpJNU5qSWdNQzQ0TlRZME1qUWdNQzQzTnpNME1qVWdNQzQzTmpnNE1qUWdNQzQ0TkRJeE1qY2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYM0poWkdsaGJDa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU5pSWdaRDBpVFRBdU16azBOVGcwSURBdU5ERTVOVE5ETUM0MU1UUXlORGtnTUM0ek1EVTNNVGtnTUM0Mk56STVNRE1nTUM0eU5ERTVOeklnTUM0NE16Z3dORFlnTUM0eU5ERXpORGhETUM0NE1UWXpOVE1nTUM0eU1UUTFNVE1nTUM0M09URTBORGNnTUM0eE9UQTBORE1nTUM0M05qTTRPRGNnTUM0eE5qazJOemhETUM0Mk9ETTFORGNnTUM0eE56UTJNelFnTUM0Mk1EUTJNalVnTUM0eE9UTXhORFFnTUM0MU16QTBOaUF3TGpJeU5EUXlOa013TGpRMU5ERXdNU0F3TGpJMU56SXlOU0F3TGpNNE5UQTJNaUF3TGpNd05EazBNeUF3TGpNeU56TTVNeUF3TGpNMk5EYzRNVU13TGpNMU5URXhNU0F3TGpNM05UTXdNaUF3TGpNM09EWTRNaUF3TGpNNU5EVXdPQ0F3TGpNNU5EVTROQ0F3TGpReE9UVXpWakF1TkRFNU5UTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzQySWlCa1BTSk5NQzR4T0RRNU9EY2dNQzQxT0RrNE5EUkRNQzR4TmpjNE9EZ2dNQzQyTXpJeE9EVWdNQzR4TlRRd056Y2dNQzQyTnpVM09ERWdNQzR4TkRNMk56Y2dNQzQzTWpBeU5EVkRNQzR4TlRJNE5qWWdNQzQzTXpZeU1Ua2dNQzR4TmpNeE56Z2dNQzQzTlRFMU1qRWdNQzR4TnpRMU16VWdNQzQzTmpZd016UkRNQzR4T0RNME9UUWdNQzQzTnpjME9ESWdNQzR4T1RFNU5UVWdNQzQzT0RjNU16UWdNQzR5TURFNU1Ea2dNQzQzT1Rnek9EWkRNQzR5TVRNNU16VWdNQzQzTXpreE5EWWdNQzR5TXpFNU5EVWdNQzQyT0RFeU9DQXdMakkxTlRZMk1pQXdMall5TlRZM09VTXdMakl5T1RBNU5TQXdMall5TURrek5pQXdMakl3TkRVeE5DQXdMall3T0RRM01pQXdMakU0TkRrNE55QXdMalU0T1RnME5GWXdMalU0T1RnME5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalUxSWlCa1BTSk5NQzR5TXpNNE5qWWdNQzR6TmpNNE5UWkRNQzR5TVRZek1ESWdNQzR6TVRZM01qRWdNQzR5TURRM05qUWdNQzR5TmpjMU5UY2dNQzR4T1RrMU1qUWdNQzR5TVRjMU1qbERNQzR4TnpnMk16Y2dNQzR5TXprME5qWWdNQzR4TmpBeU56TWdNQzR5TmpNMk56TWdNQzR4TkRRM056VWdNQzR5T0RrMk9UZERNQzR4TlRBek9UUWdNQzR6TXpBd01EUWdNQzR4TlRrNE9UUWdNQzR6TmprMk56UWdNQzR4TnpNeE5EVWdNQzQwTURneE5UTkRNQzR4T0RnM05ERWdNQzR6T0RjNE9USWdNQzR5TURrNE1URWdNQzR6TnpJMU1qRWdNQzR5TXpNNE5qWWdNQzR6TmpNNE5UWldNQzR6TmpNNE5UWmFJaUJtYVd4c1BTSWpSakpHTWtZeUlpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlOemsxTlRNZ01DNDJNamMzTURkRE1DNHpOVFExT1RVZ01DNDJNamMzTURjZ01DNDBNVFUwTWprZ01DNDFOalk0TnpRZ01DNDBNVFUwTWprZ01DNDBPVEU0TXpKRE1DNDBNVFUwTWprZ01DNDBNVFkzT1NBd0xqTTFORFU1TlNBd0xqTTFOVGsxTnlBd0xqSTNPVFUxTXlBd0xqTTFOVGsxTjBNd0xqSXdORFV4TVNBd0xqTTFOVGsxTnlBd0xqRTBNelkzTnlBd0xqUXhOamM1SURBdU1UUXpOamMzSURBdU5Ea3hPRE15UXpBdU1UUXpOamMzSURBdU5UWTJPRGMwSURBdU1qQTBOVEV4SURBdU5qSTNOekEzSURBdU1qYzVOVFV6SURBdU5qSTNOekEzV2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERGZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzQxTlNJZ1pEMGlUVEF1TkRjM05qUTRJREF1TnpRd01qVTFRekF1TkRjM05qWTJJREF1TnpJNE5EVTJJREF1TkRnd01EVTFJREF1TnpFMk56Z3lJREF1TkRnME5qY3lJREF1TnpBMU9USTBRekF1TkRnNU1qZzVJREF1TmprMU1EWTFJREF1TkRrMk1EUWdNQzQyT0RVeU5EVWdNQzQxTURRMU1qUWdNQzQyTnpjd05EWkRNQzQwTlRnMk16a2dNQzQyTlRFNE9UWWdNQzQwTVRZeU9UVWdNQzQyTWpBM05qWWdNQzR6TnpnMk1ETWdNQzQxT0RRME56TkRNQzR6TlRnNU1EY2dNQzQyTURVM09ERWdNQzR6TXpJNU1qa2dNQzQyTWpBeU5UTWdNQzR6TURRME5ETWdNQzQyTWpVM09ESkRNQzR6TWpZNE9UY2dNQzQyTkRnM05qY2dNQzR6TlRFd01Ua2dNQzQyTnpBd05qRWdNQzR6TnpZMk1USWdNQzQyT0RrME9EbERNQzQwTURnME56a2dNQzQzTVRNMU5UTWdNQzQwTkRJMk5UY2dNQzQzTXpRek9UTWdNQzQwTnpnMk5ETWdNQzQzTlRFM01ETkRNQzQwTnpnd05qVWdNQzQzTkRjNU1USWdNQzQwTnpjM016TWdNQzQzTkRRd09EZ2dNQzQwTnpjMk5EZ2dNQzQzTkRBeU5UVmFJaUJtYVd4c1BTSWpSakpHTWtZeUlpOCtKaU40WVRzOGNHRjBhQ0J2Y0dGamFYUjVQU0l3TGpVMUlpQmtQU0pOTUM0M09URXlPVElnTUM0M05UQTFORFpETUM0M05EVXdOQ0F3TGpjMU1EVTNOQ0F3TGpZNU9EazBNaUF3TGpjME5USXlPU0F3TGpZMU16a3lNeUF3TGpjek5EWXhPVU13TGpZMU5ERTJPU0F3TGpjek5qUXpOaUF3TGpZMU5ERTJPU0F3TGpjek9ESTNOeUF3TGpZMU16a3lNeUF3TGpjME1EQTVORU13TGpZMU16azFOeUF3TGpjMU1UVTBOQ0F3TGpZMU1UY3pNaUF3TGpjMk1qZzRPU0F3TGpZME56TTNOeUF3TGpjM016UTNPVU13TGpZME16QXlNU0F3TGpjNE5EQTJPU0F3TGpZek5qWXlJREF1Tnprek5qazJJREF1TmpJNE5UUWdNQzQ0TURFNE1VTXdMalk0TkRVMU5TQXdMamd4TWprd09DQXdMamMwTVRjME1pQXdMamd4TmpreU1TQXdMamM1T0RjMU9DQXdMamd4TXpjMU5VTXdMamd5TURnM05TQXdMamM1TXpjMU1TQXdMamcwTURjek5pQXdMamMzTVRNNE55QXdMamcxTnprNE5pQXdMamMwTnpBMk1rTXdMamd6TlRnME1TQXdMamMwT1RVeUlEQXVPREV6TlRjeUlEQXVOelV3TmpneklEQXVOemt4TWpreUlEQXVOelV3TlRRMldpSWdabWxzYkQwaUkwWXlSakpHTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UWTFPRGc1SURBdU9ESTROemswUXpBdU5qRTBPREU0SURBdU9ESTROemswSURBdU5qVTBORGd6SURBdU56ZzVNVE14SURBdU5qVTBORGd6SURBdU56UXdNakF6UXpBdU5qVTBORGd6SURBdU5qa3hNamMxSURBdU5qRTBPREU0SURBdU5qVXhOakV4SURBdU5UWTFPRGc1SURBdU5qVXhOakV4UXpBdU5URTJPVFlnTUM0Mk5URTJNVEVnTUM0ME56Y3lPVFVnTUM0Mk9URXlOelVnTUM0ME56Y3lPVFVnTUM0M05EQXlNRE5ETUM0ME56Y3lPVFVnTUM0M09Ea3hNekVnTUM0MU1UWTVOaUF3TGpneU9EYzVOQ0F3TGpVMk5UZzRPU0F3TGpneU9EYzVORm9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF5WDJ4cGJtVmhjaWtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOeUlnWkQwaVRUQXVOamMwTnpVM0lEQXVOVEEwTVRneVF6QXVOamM1TVRVeElEQXVORGcwTnpFMElEQXVOamc1T0RFM0lEQXVORFkzTWpJM0lEQXVOekExTVRFM0lEQXVORFUwTkRFeFF6QXVOakl6TVRZMUlEQXVNemswT0RNMElEQXVOVFE0TmpReElEQXVNekkxTmpVM0lEQXVORGd6TVRNNElEQXVNalE0TXpVNVF6QXVORFEwT1RZMUlEQXVNakF6TlRNZ01DNDBNVEUyTURJZ01DNHhOVFE0TWlBd0xqTTRNelU1TmlBd0xqRXdNekF5TjBNd0xqTTJOVEF3TmlBd0xqRXdPRFl3TVNBd0xqTTBOamcyT1NBd0xqRXhOVFU0T1NBd0xqTXlPVE0wTmlBd0xqRXlNemt6TVVNd0xqTTFPVE14TnlBd0xqRTRNRE15TlNBd0xqTTVOVEU0TnlBd0xqSXpNek0zT1NBd0xqUXpOak0xTXlBd0xqSTRNakl3TTBNd0xqVXdOak15TVNBd0xqTTJOVGM0TkNBd0xqVTROalF3TWlBd0xqUTBNRE0wT1NBd0xqWTNORGMxTnlBd0xqVXdOREU0TWxZd0xqVXdOREU0TWxvaUlHWnBiR3c5SWlOR01rWXlSaklpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjMk56STROaUF3TGpZeE5URXpOME13TGpneE9USXpPU0F3TGpZeE5URXpOeUF3TGpnMk1UTTFOU0F3TGpVM016QXlNU0F3TGpnMk1UTTFOU0F3TGpVeU1UQTJPVU13TGpnMk1UTTFOU0F3TGpRMk9URXhOeUF3TGpneE9USXpPU0F3TGpReU56QXdNaUF3TGpjMk56STROaUF3TGpReU56QXdNa013TGpjeE5UTXpOQ0F3TGpReU56QXdNaUF3TGpZM016SXhPQ0F3TGpRMk9URXhOeUF3TGpZM016SXhPQ0F3TGpVeU1UQTJPVU13TGpZM016SXhPQ0F3TGpVM016QXlNU0F3TGpjeE5UTXpOQ0F3TGpZeE5URXpOeUF3TGpjMk56STROaUF3TGpZeE5URXpOMW9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF6WDJ4cGJtVmhjaWtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOVFVpSUdROUlrMHdMamt5TlRBNU5DQXdMalU0TkRRek9Fd3dMamt3TnpZM05DQXdMalUzTlRrM04wd3dMamc1TWpjME15QXdMalUyT0RBeE5FZ3dMamc0T1RjMU4wd3dMamczTmpneE5pQXdMalUxTnpVMk1rZ3dMamczTXpNek1rd3dMamcxTnprd015QXdMalUwTnpZd04wTXdMamcxTWpVMU9TQXdMalUyTlRrek5DQXdMamcwTVRNM015QXdMalU0TWpBeE15QXdMamd5TmpBMUlEQXVOVGt6TXprM1F6QXVPRE15TURJeUlEQXVOVGszTXpjNUlEQXVPRE00TkRreklEQXVOakF3T0RZeklEQXVPRFEwT1RZeklEQXVOakEwTXpRM1REQXVPRFE0T1RRMUlEQXVOakEyT0RNMlREQXVPRFkyTXpZMElEQXVOakUyTWpreVREQXVPVEE1TVRZNElEQXVOak00TmpsRE1DNDVNVFV4T1RrZ01DNDJNakEyTVRVZ01DNDVNakF3TWpFZ01DNDJNREl4TlRnZ01DNDVNak0yTURFZ01DNDFPRE0wTkROTU1DNDVNalV3T1RRZ01DNDFPRFEwTXpoYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU56azFOVE1nTUM0Mk1qYzNNRGRETUM0ek5UUTFPVFVnTUM0Mk1qYzNNRGNnTUM0ME1UVTBNamtnTUM0MU5qWTROelFnTUM0ME1UVTBNamtnTUM0ME9URTRNekpETUM0ME1UVTBNamtnTUM0ME1UWTNPU0F3TGpNMU5EVTVOU0F3TGpNMU5UazFOeUF3TGpJM09UVTFNeUF3TGpNMU5UazFOME13TGpJd05EVXhNU0F3TGpNMU5UazFOeUF3TGpFME16WTNOeUF3TGpReE5qYzVJREF1TVRRek5qYzNJREF1TkRreE9ETXlRekF1TVRRek5qYzNJREF1TlRZMk9EYzBJREF1TWpBME5URXhJREF1TmpJM056QTNJREF1TWpjNU5UVXpJREF1TmpJM056QTNXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkRFJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRZMU9EZzVJREF1T0RJNE56azBRekF1TmpFME9ERTRJREF1T0RJNE56azBJREF1TmpVME5EZ3pJREF1TnpnNU1UTXhJREF1TmpVME5EZ3pJREF1TnpRd01qQXpRekF1TmpVME5EZ3pJREF1TmpreE1qYzFJREF1TmpFME9ERTRJREF1TmpVeE5qRXhJREF1TlRZMU9EZzVJREF1TmpVeE5qRXhRekF1TlRFMk9UWWdNQzQyTlRFMk1URWdNQzQwTnpjeU9UVWdNQzQyT1RFeU56VWdNQzQwTnpjeU9UVWdNQzQzTkRBeU1ETkRNQzQwTnpjeU9UVWdNQzQzT0RreE16RWdNQzQxTVRZNU5pQXdMamd5T0RjNU5DQXdMalUyTlRnNE9TQXdMamd5T0RjNU5Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUTFYMnhwYm1WaGNpa2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQSEpoWkdsaGJFZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZjbUZrYVdGc0lpQmplRDBpTUNJZ1kzazlJakFpSUhJOUlqRWlJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCbmNtRmthV1Z1ZEZSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVEE1TURreUlEQXVOVEEzTmpFMUtTQnpZMkZzWlNnd0xqUXlNekE0TVNraVBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMakU0SWlCemRHOXdMV052Ykc5eVBTSWpOVVZCTUVWR0lpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTXdNRGM0UkRRaUx6NG1JM2hoT3p3dmNtRmthV0ZzUjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1WOXNhVzVsWVhJaUlIZ3hQU0l3TGpJNE1EVTBPQ0lnZVRFOUlqQXVOak14TVRreElpQjRNajBpTUM0eU56a3dOVFVpSUhreVBTSXdMalF6TkRVNU5TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJME5EUTBORFF5SXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpSa05HUTBaRElpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWRESmZiR2x1WldGeUlpQjRNVDBpTUM0MU5qVTRPRGtpSUhreFBTSXdMamd5T0RjNU5DSWdlREk5SWpBdU5UWTFPRGc1SWlCNU1qMGlNQzQyTlRJeE1Ea2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5EUTBORFEwTWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpEUmtOR1F5SXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXpYMnhwYm1WaGNpSWdlREU5SWpBdU56WTNNamcySWlCNU1UMGlNQzQyTVRRMk16a2lJSGd5UFNJd0xqYzJOekk0TmlJZ2VUSTlJakF1TkRJM01EQXlJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqUTBORFEwTkRJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpFaUlITjBiM0F0WTI5c2IzSTlJaU5HUTBaRFJrTWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBORjlzYVc1bFlYSWlJSGd4UFNJd0xqSTRNRFUwT0NJZ2VURTlJakF1TmpNeE1Ua3hJaUI0TWowaU1DNHlOemt3TlRVaUlIa3lQU0l3TGpRek5EVTVOU0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSTBORFEwTkRReUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtOR1EwWkRJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkRFZmYkdsdVpXRnlJaUI0TVQwaU1DNDFOalU0T0RraUlIa3hQU0l3TGpneU9EYzVOQ0lnZURJOUlqQXVOVFkxT0RnNUlpQjVNajBpTUM0Mk5USXhNRGtpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlORFEwTkRRME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaRFJrTkdReUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFeElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNVFV6T0RBNUlEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1NSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzOSIgeT0iMzIiIHdpZHRoPSIxOTMiIGhlaWdodD0iNTQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjU4IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSMxYmExZTI7c3RhcnRBcnJvdz1ub25lOyIgcGFyZW50PSIxIiBzb3VyY2U9IjkxIiB0YXJnZXQ9IjU0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTA2IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7cm91bmRlZD0xO3NrZXRjaD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtmb250U2l6ZT0xMjtmb250Q29sb3I9bm9uZTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNGRkQ5NjY7c3Ryb2tlV2lkdGg9MTtmaWxsQ29sb3I9I0IyQzlBQjsiIHBhcmVudD0iMSIgdGFyZ2V0PSI0NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNDM1Ljc5OTk5OTk5OTk5OTciIHk9IjIwNi4wMDAwMDAwMDAwMDAyMyIgYXM9InNvdXJjZVBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY4IiB2YWx1ZT0iQSIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jODJiMzY2O2ZpbGxDb2xvcj0jZDVlOGQ0O2ZvbnRDb2xvcj0jOEM4QzhDOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzOCIgeT0iMjYwIiB3aWR0aD0iMTciIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iQTIiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzgyYjM2NjtmaWxsQ29sb3I9I2Q1ZThkNDtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIzNzkiIHk9IjEwOS41IiB3aWR0aD0iMjMiIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjcxIiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ3IiB0YXJnZXQ9IjY3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzNDguMTA4MTA4MTA4MTA3OSIgeT0iNDguNSIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNDMyLjI0MzI0MzI0MzI0MzM0IiB5PSIxOTAiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI3MiIgdmFsdWU9IkQxIiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM2YzhlYmY7ZmlsbENvbG9yPSNkYWU4ZmM7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTk5IiB5PSItMTQuNSIgd2lkdGg9IjIzIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3MyIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzZjOGViZjtzdHJva2VXaWR0aD0yO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhO3NoYXBlPWFycm93O3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9I2RhZThmYzsiIHBhcmVudD0iMSIgc291cmNlPSI3NiIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgeD0iMC4zMTgyIiB5PSItMjMiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjMxIiB5PSItNy42MDE3Njk5MTE1MDQ1NjIiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI3MSIgeT0iLTUuODMxODU4NDA3MDc5NjA4IiBhcz0idGFyZ2V0UG9pbnQiLz48bXhQb2ludCB5PSIxIiBhcz0ib2Zmc2V0Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iRCIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jNmM4ZWJmO2ZpbGxDb2xvcj0jZGFlOGZjO2ZvbnRDb2xvcj0jOEM4QzhDOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQwOSIgeT0iLTEzLjUiIHdpZHRoPSIxNyIgaGVpZ2h0PSIxOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNzUiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jNmM4ZWJmO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSNkYWU4ZmM7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDciIHRhcmdldD0iNzQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjM3MCIgeT0iLTUuMTkyMzA3NjkyMzA3NjIyIiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSI0NDgiIHk9Ii00Ljc0Nzg2MzI0Nzg2MzI3OSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc2IiB2YWx1ZT0iQTEiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzgyYjM2NjtmaWxsQ29sb3I9I2Q1ZThkNDtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMTYiIHk9Ii0xNC41IiB3aWR0aD0iMjMiIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc3IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0yO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhO3NoYXBlPWFycm93O3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ5IiB0YXJnZXQ9Ijc2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSB4PSIwLjc2ODEiIHk9Ii0yMyIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzEiIHk9Ii03LjQyMTg0MTU0MTc1NjA2NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iMTk5IiB5PSItNS42MjMxMjYzMzgzMjk5MzkiIGFzPSJ0YXJnZXRQb2ludCIvPjxteFBvaW50IHk9IjEiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iODAiIHZhbHVlPSIiIHN0eWxlPSJlbmRBcnJvdz1ub25lO2Rhc2hlZD0xO2h0bWw9MTtyb3VuZGVkPTE7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPSNmOGNlY2M7Y3VydmVkPTE7aXIuc3luY2hyb25pemVkPTA7IiBwYXJlbnQ9IjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHdpZHRoPSI1MCIgaGVpZ2h0PSI1MCIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjQwIiB5PSI1MzYiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI0MCIgeT0iLTI0NyIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjgxIiB2YWx1ZT0iJmx0O2k+Jmx0O2ZvbnQgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNXB4JnF1b3Q7PkludGVybmV0Jmx0Oy9mb250PiZsdDsvaT4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250Q29sb3I9IzQ2NDk1RDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNzUiIHk9Ii0yMDAiIHdpZHRoPSI2MCIgaGVpZ2h0PSIxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODIiIHZhbHVlPSImbHQ7ZGl2IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTVweCZxdW90OyBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PiZsdDtmb250IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTVweCZxdW90Oz4mbHQ7aT4mbHQ7Zm9udCBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE1cHgmcXVvdDs+JmFtcDtuYnNwO0NvbXBhbnkmbHQ7L2ZvbnQ+Jmx0Oy9pPiZsdDticj4mbHQ7L2ZvbnQ+Jmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249bGVmdDt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj1ub25lO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0OCIgeT0iLTIwMCIgd2lkdGg9IjczIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSImbHQ7ZGl2PiZsdDtiPkxlZ2VuZCZsdDsvYj4mbHQ7L2Rpdj4iIGlyLnNvdXJjZVN0eWxlPSJ3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3JvdW5kZWQ9MTtza2V0Y2g9MDtmb250U2l6ZT0xNTtmb250Q29sb3I9IzQ2NDk1RDtzdHJva2VDb2xvcj0jNzg4QUEzO3N0cm9rZVdpZHRoPTM7ZmlsbENvbG9yPW5vbmU7Z3JhZGllbnRDb2xvcj1ub25lO3ZlcnRpY2FsQWxpZ249dG9wOyIgaWQ9Ijg2Ij48bXhDZWxsIHN0eWxlPSJ3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3JvdW5kZWQ9MTtza2V0Y2g9MDtmb250U2l6ZT0xMztmb250Q29sb3I9IzQ2NDk1RDtzdHJva2VDb2xvcj0jMjBDOUUzO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPW5vbmU7Z3JhZGllbnRDb2xvcj1ub25lO3ZlcnRpY2FsQWxpZ249dG9wO2NvbnRhaW5lcj0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ijg0NSIgeT0iLTE5MSIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIxMDQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9Ijg1IiB2YWx1ZT0iJmx0O2RpdiBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PiZsdDtiPkEmbHQ7L2I+IC0gQXV0aGVudGljYXRpb24mYW1wO25ic3A7Jmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM4MmIzNjY7ZmlsbENvbG9yPSNkNWU4ZDQ7Zm9udFNpemU9MTU7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9Ijg2IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjciIHk9IjI1IiB3aWR0aD0iMTI1IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NyIgdmFsdWU9IkQgLSBEYXRhIHRyYW5zZmVyIGUuZy4gZmlsZXMiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmb250U2l6ZT0xNTtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iODYiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNyIgeT0iNDgiIHdpZHRoPSIxNjUiIGhlaWdodD0iMjIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iJmx0O2RpdiBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PlIgLSBSZW1vdGUgU2NyZWVuL1Rlcm1pbmFsJmx0O2JyPiZsdDsvZGl2PiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmO2ltYWdlV2lkdGg9MzA7IiBwYXJlbnQ9Ijg2IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjciIHk9IjcwIiB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MSIgdmFsdWU9IlIiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzAwNkVBRjtmaWxsQ29sb3I9IzFiYTFlMjtmb250U2l6ZT0xNTtmb250Q29sb3I9I2ZmZmZmZjsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1MDQiIHk9IjE0OCIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MiIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSMwMDZFQUY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9IzFiYTFlMjsiIHBhcmVudD0iMSIgc291cmNlPSIyOCIgdGFyZ2V0PSI5MSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNDk3LjM5NDk0MTYzNDI0MTE1IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNTMzLjM0ODI0OTAyNzIzNzciIHk9IjM1NCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwMSIgdmFsdWU9IiZsdDtmb250IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMjRweCZxdW90Oz5Db250cmFjdG9yIFJlbW90ZSBBY2Nlc3MgdG8gQ29tcGFueSZsdDsvZm9udD4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250U2l6ZT0xNTtmb250Q29sb3I9IzQ2NDk1RDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI4NiIgeT0iLTI4OCIgd2lkdGg9IjM5NyIgaGVpZ2h0PSIyNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAyIiB2YWx1ZT0iVHJ1c3RlZCBQYXJ0bmVyIiBzdHlsZT0iaXIucmVmPTUzMTMxNWE3LTQxYTItNDBlZC1hYjg3LTIyYzNhNGMzYzdmZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj1kZWZhdWx0O2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj1ub25lO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTtza2V0Y2g9MDtmb250U2l6ZT0xMjtub0xhYmVsPTE7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTE3NCIgeT0iLTc1IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjE4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQ29udHJhY3RvciIgaWQ9IjQ5Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9MmJhZDYyMGYtOGY0Yi00OGQyLWIzZmItY2M5YjU5NDM0NzAyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVuZC11c2VyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TWpZME5EZ2dNQzR6TkRFNU16TkRNQzR6TWpZME5EZ2dNQzR5TlRVNE16TWdNQzR6T1RZeU5EWWdNQzR4T0RZd016VWdNQzQwT0RJek5EWWdNQzR4T0RZd016VkRNQzQxTmpnME5EWWdNQzR4T0RZd016VWdNQzQyTXpneU5EUWdNQzR5TlRVNE16TWdNQzQyTXpneU5EUWdNQzR6TkRFNU16TkRNQzQyTXpneU5EUWdNQzQwTWpnd016SWdNQzQxTmpnME5EWWdNQzQwT1RjNE15QXdMalE0TWpNME5pQXdMalE1TnpnelF6QXVNemsyTWpRMklEQXVORGszT0RNZ01DNHpNalkwTkRnZ01DNDBNamd3TXpJZ01DNHpNalkwTkRnZ01DNHpOREU1TXpOYVRUQXVORGd5TXpRMklEQXVNakkxTURBNVF6QXVOREUzTnpjeElEQXVNakkxTURBNUlEQXVNelkxTkRJeklEQXVNamMzTXpVNElEQXVNelkxTkRJeklEQXVNelF4T1RNelF6QXVNelkxTkRJeklEQXVOREEyTlRBM0lEQXVOREUzTnpjeElEQXVORFU0T0RVMklEQXVORGd5TXpRMklEQXVORFU0T0RVMlF6QXVOVFEyT1RJeElEQXVORFU0T0RVMklEQXVOVGs1TWpZNUlEQXVOREEyTlRBM0lEQXVOVGs1TWpZNUlEQXVNelF4T1RNelF6QXVOVGs1TWpZNUlEQXVNamMzTXpVNElEQXVOVFEyT1RJeElEQXVNakkxTURBNUlEQXVORGd5TXpRMklEQXVNakkxTURBNVdrMHdMakl6TWpreElEQXVOakkyTkRJNFF6QXVNak15T1RFeElEQXVOVGc1T0RJNUlEQXVNall5TlRneElEQXVOVFl3TVRnNUlEQXVNams1TVRZMUlEQXVOVFl3TVRnNVNEQXVOalkxTlRJNVF6QXVOamc0T0RVeklEQXVOVFl3TVRnNUlEQXVOekE1TXpZNElEQXVOVGN5TWpNM0lEQXVOekl4TVRjMElEQXVOVGt3TkRVMlF6QXVOekE1TWpVeUlEQXVOVGczT0RRM0lEQXVOamsyT0RZNElEQXVOVGcyTkRjeUlEQXVOamcwTVRZeklEQXVOVGcyTkRjeVF6QXVOall4TVRVMklEQXVOVGcyTkRjeUlEQXVOak01TWpBMElEQXVOVGt3T1RneElEQXVOakU1TVRNNUlEQXVOVGs1TVRZelNEQXVNams1TVRZMVF6QXVNamcwTURreElEQXVOVGs1TVRZeklEQXVNamN4T0RnMElEQXVOakV4TXpjZ01DNHlOekU0T0RRZ01DNDJNalkwTWpoV01DNDJNemd4TXpkRE1DNHlOekU0T0RRZ01DNDJPREE1TWpNZ01DNHlPVE13T1NBd0xqY3hNekE1TkNBd0xqTXlPVGc0TVNBd0xqY3pOVFE1TWtNd0xqTTJOelEwTlNBd0xqYzFPRE0yTVNBd0xqUXlNVEEwTXlBd0xqYzNNRFkxSURBdU5EZ3lNelEySURBdU56Y3dOalZETUM0ME9USTFNVGtnTUM0M056QTJOU0F3TGpVd01qUTRNU0F3TGpjM01ETXhNaUF3TGpVeE1qRTVNaUF3TGpjMk9UWTBNME13TGpVeE16QXlNU0F3TGpjNE1qazJOeUF3TGpVeE5UTTJOU0F3TGpjNU5UZzRNaUF3TGpVeE9UQTFNaUF3TGpnd09ESXhOa013TGpVd056QXlNaUF3TGpnd09URTFPU0F3TGpRNU5EYzJNU0F3TGpnd09UWXlOU0F3TGpRNE1qTTBOaUF3TGpnd09UWXlOVU13TGpReE5qWTFNaUF3TGpnd09UWXlOU0F3TGpNMU5USTNOU0F3TGpjNU5qVTRNU0F3TGpNd09UWXhOQ0F3TGpjMk9EYzRNME13TGpJMk16RTRJREF1TnpRd05URTBJREF1TWpNeU9URWdNQzQyT1RZMk9EWWdNQzR5TXpJNU1TQXdMall6T0RFek4xWXdMall5TmpReU9Gb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamM0TkRBeE15QXdMamN3TlRrMk4wd3dMamM0TURrNU1TQXdMamN3TkRnNU1rd3dMamMxTlRRMElEQXVOalUyT1RnMFF6QXVOelExTmpZeUlEQXVOak00TmpVZ01DNDNNalkxTnpRZ01DNDJNamN4T1RjZ01DNDNNRFUzT1RVZ01DNDJNamN4T1RkSU1DNDJOREUwTmpORE1DNDJNVGN5TkRVZ01DNDJNamN4T1RjZ01DNDFPVFUzTkRVZ01DNDJOREkyT1RRZ01DNDFPRGd3T0RZZ01DNDJOalUyTmpsTU1DNDFOelU1TURrZ01DNDNNREl5TURKRE1DNDFOVFV6T1NBd0xqY3hNRGcwTXlBd0xqVTBNVFV3TkNBd0xqY3pNVEEzT1NBd0xqVTBNVFV3TkNBd0xqYzFOREExTVZZd0xqYzNPVEV4TVVNd0xqVTBNVFV3TkNBd0xqYzVOVEE0TkNBd0xqVTFNVEF4TXlBd0xqZ3dPRGd6TmlBd0xqVTJORFkzT0NBd0xqZ3hOVEF4TmtNd0xqVTJPRE0yTVNBd0xqZ3pOakUzSURBdU5UZzJPREV5SURBdU9EVXlNalUwSURBdU5qQTVNREl4SURBdU9EVXlNalUwUXpBdU5qSTVPVGswSURBdU9EVXlNalUwSURBdU5qUTNOakUzSURBdU9ETTNPVEE1SURBdU5qVXlOakUwSURBdU9ERTRORGsyU0RBdU56UTFORGN6UXpBdU56VXdORFk1SURBdU9ETTNPVEE1SURBdU56WTRNRGt6SURBdU9EVXlNalUwSURBdU56ZzVNRFkySURBdU9EVXlNalUwUXpBdU9ERXhNamMwSURBdU9EVXlNalUwSURBdU9ESTVOekkySURBdU9ETTJNVGNnTUM0NE16TTBNRGtnTUM0NE1UVXdNVFpETUM0NE5EY3dOelFnTUM0NE1EZzRNellnTUM0NE5UWTFPRE1nTUM0M09UVXdPRFFnTUM0NE5UWTFPRE1nTUM0M056a3hNVEZXTUM0M056RTBPRGRETUM0NE5UWTFPRE1nTUM0M05EYzJPRFFnTUM0NE5ERTJNRFFnTUM0M01qWTBOVFlnTUM0NE1Ua3hOemdnTUM0M01UZzBOemhNTUM0M09EVXhPVGdnTUM0M01EWXpPRGxXTUM0M01EVTVOamRJTUM0M09EUXdNVE5hVFRBdU5qQTVORE0zSURBdU5qY3lOemcyUXpBdU5qRTBNRE15SURBdU5qVTVNREF4SURBdU5qSTJPVE15SURBdU5qUTVOekF6SURBdU5qUXhORFl6SURBdU5qUTVOekF6U0RBdU5qWTFNamcxVmpBdU56QTFPVFkzU0RBdU5UazRNemMzVERBdU5qQTVORE0zSURBdU5qY3lOemcyV2swd0xqYzFOakExT0NBd0xqY3dOVGsyTjBnd0xqWTROemM1TVZZd0xqWTBPVGN3TTBnd0xqY3dOVGM1TlVNd0xqY3hPREkyTXlBd0xqWTBPVGN3TXlBd0xqY3lPVGN4TlNBd0xqWTFOalUzTkNBd0xqY3pOVFU0TWlBd0xqWTJOelUzTlV3d0xqYzFOakExT0NBd0xqY3dOVGsyTjFwTk1DNDFPRFkxTVRVZ01DNDRNRGN5TkRORE1DNDFPRFkxTVRVZ01DNDNPVFE0TVRNZ01DNDFPVFkxT1RFZ01DNDNPRFEzTXpjZ01DNDJNRGt3TWpFZ01DNDNPRFEzTXpkRE1DNDJNakUwTlNBd0xqYzRORGN6TnlBd0xqWXpNVFV5TmlBd0xqYzVORGd4TXlBd0xqWXpNVFV5TmlBd0xqZ3dOekkwTTBNd0xqWXpNVFV5TmlBd0xqZ3hPVFkzTWlBd0xqWXlNVFExSURBdU9ESTVOelE1SURBdU5qQTVNREl4SURBdU9ESTVOelE1UXpBdU5UazJOVGt4SURBdU9ESTVOelE1SURBdU5UZzJOVEUxSURBdU9ERTVOamN5SURBdU5UZzJOVEUxSURBdU9EQTNNalF6V2swd0xqYzRPVEEyTmlBd0xqYzRORGN6TjBNd0xqZ3dNVFE1TmlBd0xqYzRORGN6TnlBd0xqZ3hNVFUzTWlBd0xqYzVORGd4TXlBd0xqZ3hNVFUzTWlBd0xqZ3dOekkwTTBNd0xqZ3hNVFUzTWlBd0xqZ3hPVFkzTWlBd0xqZ3dNVFE1TmlBd0xqZ3lPVGMwT1NBd0xqYzRPVEEyTmlBd0xqZ3lPVGMwT1VNd0xqYzNOall6TmlBd0xqZ3lPVGMwT1NBd0xqYzJOalUySURBdU9ERTVOamN5SURBdU56WTJOVFlnTUM0NE1EY3lORE5ETUM0M05qWTFOaUF3TGpjNU5EZ3hNeUF3TGpjM05qWXpOaUF3TGpjNE5EY3pOeUF3TGpjNE9UQTJOaUF3TGpjNE5EY3pOMW9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDNOamdpSUdobGFXZG9kRDBpTUM0M05qZ2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakV3T0RNNU9DQXdMakV5TXpZMU55a2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSIxMDIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTIyIiB5PSIyNC41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEwMyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO3JvdW5kZWQ9MTtza2V0Y2g9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuOTk5O2VudHJ5WT0wLjY2O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtmb250U2l6ZT0xMjtmb250Q29sb3I9bm9uZTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0xO2ZpbGxDb2xvcj0jZDVlOGQ0O3N0YXJ0QXJyb3c9bm9uZTsiIHBhcmVudD0iMSIgc291cmNlPSI2OSIgdGFyZ2V0PSIxMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTA0IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7cm91bmRlZD0xO3NrZXRjaD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC45OTk7ZW50cnlZPTAuNjY7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO2ZvbnRTaXplPTEyO2ZvbnRDb2xvcj1ub25lO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0xO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ0IiB0YXJnZXQ9IjY5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI0MDUiIHk9IjIzMi43OTU5MTgzNjczNDY3NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iMjExLjkxMDAwMDAwMDAwMDMiIHk9IjIyMS40MDAwMDAwMDAwMDAxIiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzEyIiB5PSIyMjkiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMDgiIHZhbHVlPSJBenVyZSBBY3RpdmUgRGlyZWN0b3J5IC0+IE9rdGEgLSBNRkEiIHN0eWxlPSJpci5yZWY9ZGZjNjA0Y2QtMzJlNS00MWU3LTk4ZmUtZGQzN2UxNDA4OWU0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSM2NkZGNjY7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9IzYwYTkxNztleGl0WD0wLjg3ODtleGl0WT0wLjkxMTtleGl0RHg9MDtleGl0RHk9MDtleGl0UGVyaW1ldGVyPTA7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTEiIHRhcmdldD0iMTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1OSIgdmFsdWU9IkNvbnRyYWN0b3IgLT4gU2FhUyAoU2FsZXMgRm9yY2UsIEFyaWJhLCBvdGhlcnMpIiBzdHlsZT0iaXIucmVmPTU3ZTVjM2FmLTg4MWEtNDkzNy04MGZhLTkwZGIwODk4NTc1NDtlZGdlU3R5bGU9bm9uZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7c3Ryb2tlQ29sb3I9Izk5Q0NGRjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZGFlOGZjO3JvdW5kZWQ9MDtzaGFwZT1mbGV4QXJyb3c7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ5IiB0YXJnZXQ9IjUzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE1IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7bGFiZWxCb3JkZXJDb2xvcj1ub25lO2ZvbnRDb2xvcj0jRkZGRkZGO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO3N0cm9rZUNvbG9yPSMwMDFEQkM7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9IzAwNTBlZjtzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTE2IiB0YXJnZXQ9IjEwOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjQxOCIgeT0iMjUxIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE2IiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2F1dG9zaXplPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3BvaW50cz1bXTtmaWxsQ29sb3I9IzY2QjJGRjtzdHJva2VDb2xvcj1kZWZhdWx0O3JvdW5kZWQ9MDtsYWJlbEJhY2tncm91bmRDb2xvcj1ub25lO2ZpbGxTdHlsZT1hdXRvO2ZvbnRDb2xvcj0jRkZGRkZGOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0Ni41IiB5PSIxMDUiIHdpZHRoPSIxNyIgaGVpZ2h0PSIxOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTIwIiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7bGFiZWxCb3JkZXJDb2xvcj1ub25lO2ZvbnRDb2xvcj0jRkZGRkZGO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDAxREJDO3N0cm9rZVdpZHRoPTI7ZmlsbENvbG9yPSMwMDUwZWY7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjgiIHRhcmdldD0iMTE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI0NzYuOTcyNjAyNzM5NzI1OTciIHk9IjQ2IiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSIyMjAiIHk9IjM0NC4yOTYyOTYyOTYyOTYzIiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-    <trustZone ref="TZ_SEGM" uuid="faf61dd8-7eab-4ac2-93c8-c42fd1e86040" name="Business App Hosting" desc="Virtualized Hosting Services (IHS Service) zone hosts non-CJ apps and virtualized servers." trustRating="90"/>
-    <trustZone ref="trusted-partner" uuid="531315a7-41a2-40ed-ab87-22c3a4c3c7ff" name="Trusted Partner" desc="Vetted and trusted partner" trustRating="30"/>
-  </trustZones>
-  <questions/>
-  <assets>
-    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="Azure AD -&gt; WVD" ref="2b435092-45ed-4304-b42e-8914062e05dd" source="6a20a317-2616-4aaa-8931-c7b1406ec787" target="85ab5253-6d14-450d-a534-8f7341d4f3d6">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; IoT Application (iot-security-compliance-framework)" ref="4896693a-46af-4c6c-ac8d-4db8ea017dfc" source="fc0d51fe-a373-4d18-a293-8a2b873e9ef9" target="d85f98d6-9f53-455a-86f8-4d239429e392">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Contractor -&gt; SaaS (Sales Force, Ariba, others)" ref="57e5c3af-881a-4937-80fa-90db08985754" source="78aab505-4109-4e57-8b91-756696703a30" target="6ad37665-cc66-48ea-a5e5-6ed8dd861ac2">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Back-end server" ref="df7537e6-9ef4-40f7-bf42-3680c15c6699" source="40a5314d-c9ec-4089-ae5b-6fa194301861" target="5ca55fe8-d024-4416-b6b9-abd237a56b2e">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Azure Active Directory -&gt; Okta - MFA" ref="dfc604cd-32e5-41e7-98fe-dd37e14089e4" source="6a20a317-2616-4aaa-8931-c7b1406ec787" target="dface3e0-9147-420d-91bd-85bdb802b47b">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="49f10f14-6996-4e7a-b19a-f3d33560fe01" diagramComponentId="8c841b66-93b3-48c3-a9a1-b4190d66a462" ref="d15de196-655f-47cd-837e-43bdc4a23df0" name="VPN Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-VPN-GW">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.416">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.429">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="92162812-10e0-4cdb-adec-4a24174130dc" diagramComponentId="3fd3bd2b-97bd-4347-97a2-381f8ad0df8b" ref="dface3e0-9147-420d-91bd-85bdb802b47b" name="Okta - MFA" desc="" library="" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
-      <tags/>
-      <questions>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-        <question ref="saml.server.role.sp" answer="true" manuallyModified="false"/>
-        <question ref="saml.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets>
-        <asset name="Personally Identifiable Information" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.731">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-294" name="Authentication Bypass by Capture-replay" state="0" impact="100" issueId="" issueLink="">
-          <desc>A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.360">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
-                        proves that the claim is correct.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.631">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.690">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.634">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.359">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.685">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.937">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.892">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.894">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.894">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.893">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
-&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
-&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
-&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
- &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
-&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references>
-              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
-              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".
- 
-</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.341">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.470">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.469">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.5.3" name="Authenticate SP to the IDP" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Since the Service Provider obtains artifacts from the user, a malicious site could impersonate the user at some new Service Provider site. The new Service Provider site would obtain assertions from the Identity Provider site and believe the malicious site to be the user. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The new Service Provider site will need to authenticate itself to the Identity Provider site so as to obtain the SAML assertions corresponding to the SAML artifacts. There are two cases to consider: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;If the new Service Provider site has no relationship with the Identity Provider site, it will be unable to authenticate and this step will fail.&lt;/li&gt; 
-  &lt;li&gt;If the new Service Provider site has an existing relationship with the Identity Provider site, the Identity Provider site will determine that assertions are being requested by a site other than that to which the artifacts were originally sent. In such a case, the Identity Provider site MUST not provide the assertions to the new Service Provider site.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.068">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.072">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.073">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.644">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" name="Check browser IP address against IP contained in authentication statement" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If a received authentication statement includes a &amp;lt;saml:SubjectLocality&amp;gt; element with the IP address of the user, the destination site MAY check the browser IP address against the IP address contained in the authentication statement. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the IP comparison is being done.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.5.1" name="Check validity period of all assertions obtained from the IDP" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The Service Provider site MUST check the validity period of all assertions obtained from the&amp;nbsp;Identity Provider site and reject expired assertions. A Service Provider site MAY choose to implement a stricter test of validity for SSO assertions, such as requiring the assertion's IssueInstant or AuthnInstant attribute value to be within a few minutes of the time at which the assertion is received at the Service Provider site.</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that when the Service Provider obtain an assertion from the Identity Provider the validity period is correct. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.683">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
-            <reference name="OWASP Security by Design Principles: Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
-          </references>
-          <standards>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="66" state="Required" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="RULES" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.472">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" name="Ensure confidentiality safeguards are implemented" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  In the case where the subject authenticates to the source site by revealing reusable authentication information, for example, in the form of a password, theft of the authentication information will enable an adversary to impersonate the subject. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   In order to avoid this problem, the connection between the subject's browser and the source site must implement a confidentiality safeguard. In addition, steps must be taken by either the subject or the destination site to ensure that the source site is genuinely the expected and trusted source site before revealing the authentication information. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Ensure a strong password or pass-phrase is used to protect access to the data.&lt;/li&gt; 
-  &lt;li&gt;Identify where is the sensitive data stored&lt;/li&gt; 
-  &lt;li&gt;Check that stored sensitive data is encrypted&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.082">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.1.3" name="Ensure &lt;inResponseTo&gt; attribute is used to correlate messages" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A fabricated request or response is inserted into the message stream. A false response such as a spurious "yes" reply to an authorization decision query or the return of false attribute information in response to an attribute query may result in inappropriate receiver action. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The ability to insert a request is not a threat at the SOAP binding level. The threat of inserting a false response can be a denial of service attack, for example returning SOAP Faults for responses, but this attack would become quickly obvious. The more subtle attack of returning fabricated responses is addressed in the SAML protocol, appropriate since according to the SOAP Binding definition each SOAP response must contain a single SAML protocol response unless it contains a fault. The SAML Protocol addresses this with two mechanisms, correlation of responses to requests using the required InResponseTo attribute, making an attack harder since requests must be intercepted to generate responses, and through the support origin authentication, either via signed SAML responses or through a secured transport connection such as SSL/TLS. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that the responses to requests use the InResponseTo attribute. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.2" name="Ensure &lt;Recipient&gt; attribute matches the URL" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Since the Service Provider site obtains bearer SAML assertions from the user by means of an HTML form, a malicious site could impersonate the user at some new Service Provider site. The new Service Provider site would believe the malicious site to be the subject of the assertion. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The Service Provider site MUST check the Recipient attribute of the SAML response to ensure that its value matches the "https://&amp;lt;assertion consumer host name and path&amp;gt;". As the response is digitally signed, the Recipient value cannot be altered by the malicious site.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-923-SEGREG" name="Ensure segregation of components of differing trust levels" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure segregation of components of differing trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
-                            happen.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
-                            behavior on the system.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
-                        practice and required minimum key lengths depend on the scenarios listed below.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
-            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
-            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
-                            &lt;br /&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
-                            bits&lt;/li&gt;
-                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.051">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
-&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
-&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
-  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
-  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
-  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
- &lt;/ul&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
-            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
-            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
- &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
- &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;span&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
-              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;ul&gt;
- &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
- &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.2 Testing for default credentials (OTG-AUTHN-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.5 Test remember password functionality (OTG-AUTHN-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;div&gt;
-   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
- &lt;/div&gt;
- &lt;div&gt;
-   Options:
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
- &lt;/div&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.475">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.807">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.1.6" name="Implement mTLS" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Man-in-the-middle attacks are particularly pernicious for this set of profiles. The MITM can relay requests, capture the returned assertion (or artifact), and relay back a false one. Then the original user cannot access the resource in question, but the MITM can do so using the captured resource. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Using a system that provides strong bilateral authentication will make it much more difficult for a MITM to insert himself into the conversation. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that in the communication between providers a mTLS configuration is used to mutually authenticate both parts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.3.1" name="Implement transient qualifiers" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A spurious entity could issue a redirect to a user agent so that the user agent would access a resource that disrupts single sign-on. For example, an attacker could redirect the user agent to a logout resource of a service provider causing the Principal to be logged out of all existing authentication sessions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Access to resources that produce side effects could be specified with a transient qualifier that must correspond to the current authentication session. A confirmation dialog could be interposed that relies on a transient qualifier with similar semantics 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure there is a mechanism to check a transient qualifier that is linked to the corresponding authentication session. 
-&lt;/div&gt; 
-&lt;div&gt;&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.052">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt; 
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.370">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.638">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.683">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" name="Set the HTTP security header 'Strict-Transport-Security' (HSTS)" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Modern browsers support the Strict-Transport-Security HTTP header. This header instructs the browser to only communicate over HTTPS for all subsequent requests to the domain, mitigating a number of attacks designed to force users to switch to unencrypted transport in order to expose data.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Add HTTP Strict Transport Security (HSTS) for all the requests and all the subdomains&lt;/li&gt;&lt;li&gt;Preload the URLs of the applications to the Strict Transport Security domain lists maintained by participating vendors&lt;/li&gt;&lt;li&gt;Encourage users to access the site with patched versions of the participating vendors.&lt;/li&gt;&lt;li&gt;Consider creating and pre-loading subdomains for critical applications prior to release to gain maximum advantage from HSTS pre-loading.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check that for every request to the service, the following header is returned:&lt;/li&gt;&lt;/ol&gt;&lt;blockquote&gt;&lt;p&gt;Strict-Transport-Security: max-age=31536000; includeSubDomains&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The attribute max-age should be of a reasonably long period (&amp;gt;1y).&amp;nbsp;The attribute includeSubDomains should also be present. &amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.682">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Strict Transport Security Cheat Sheet" url="https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.1" name="Synchronize clocks between SPs and IDPs" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The Identity Provider and Service Provider sites SHOULD make some reasonable effort to ensure that clock settings at both sites differ by at most a few minutes. Many forms of time synchronization service are available, both over the Internet and from proprietary sources. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the time both in the Service Provider and the Identity Provider and ensure it is the same.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-7.1.3" name="Use a common domain" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cookie poisoning attack, where parameters within the cookie are modified, to cause discovery of an fraudulent identity provider for example.&amp;nbsp;The specific mechanism of using a common domain limits the feasibility of this threat</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that the domain is common across all SAML services.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-          </references>
-          <standards>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.4" name="Use &lt;OneTimeUse&gt; assertion elements" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The browser/POST profile involves uploading of assertions from the web browser to a Service Provider site. This information is available as part of the web browser state and is usually stored in persistent storage on the user system in a completely unsecured fashion. The threat here is that the assertion may be "reused" at some later point in time. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Assertions communicated using this profile must always have short lifetimes and should have a &amp;lt;OneTimeUse&amp;gt; SAML assertion &amp;lt;Conditions&amp;gt; element. Service Provider sites are expected to ensure that the assertions are not re-used. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that the OneTimeUse attribute is used in the requests.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.1.2" name="Use SAML information to identify replay attacks" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>In general, the best way to prevent replay attacks is to prevent the message capture in the first place. Some of the transport-level schemes used to provide in-transit confidentiality will accomplish this goal. For example, if the SAML request-response conversation occurs over SOAP on HTTP/TLS, third parties are prevented from capturing the messages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note that since the potential replayer does not need to understand the message to replay it, schemes such as XML Encryption do not provide protection against replay. If an attacker can capture a SAML request that has been signed by the requester and encrypted to the responder, then the attacker can replay that request at any time without needing to be able to undo the encryption. The SAML request includes information about the issue time of the request, allowing a determination about whether replay is occurring. Alternatively, the unique key of the request (its ID) can be used to determine if this is a replay request or not.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional threats from the replay attack include cases where a "charge per request" model is in place. Replay could be used to run up large charges on a given account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Similarly, models where a client is allocated (or purchases) a fixed number of interactions with a system, the replay attack could exhaust these uses unless the issuer is careful to keep track of the unique key of each request.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that there is a mechanism to check SAML requests attributes to determine if a replay attack is happening. Then launch a replay attack to see if the mechanism is working properly. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" name="Use SOAP Message Security" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Change an AuthnRequest SOAP request so that it cannot be processed, such as by changing the PAOS header block service attribute value to an unknown value or by changing the ECP header block ProviderID or IDPList to cause the request to fail. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Provide integrity protection for the SOAP message, by using SOAP Message Security or SSL/TLS.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure the SOAP message uses the message protection mechanism defined in&amp;nbsp;Web Services Security: 3 SOAP Message Security 1.0</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references>
-              <reference name="Web Services Security: 3 SOAP Message Security 1.0" url="https://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.6" name="Use symmetric encryption to protect &lt;RelayState&gt; data" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Some of the messages may carry a &amp;lt;RelayState&amp;gt; element, which is recommended to be integrityprotected by the producer and optionally confidentiality- protected. If these practices are not followed, an adversary could trigger unwanted side effects. In addition, by not confidentiality-protecting the value of this element, a legitimate system entity could inadvertently expose information to the identity provider or a passive attacker. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Because the value of this element is both produced and consumed by the same 
- &lt;/div&gt; 
- &lt;div&gt;
-   system entity, symmetric cryptographic primitives could be utilized. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the RelayState attribute is encrypted with a strong symmetric cipher like AES.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.1.1" name="Use XMLEnc and XMLSig to add in-transit confidentiality and integrity" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Adding in-transit confidentiality at the SOAP level means constructing the SOAP message such that, regardless of SOAP transport, no one but the intended party will be able to access the message. The general solution to this problem is likely to be XML Encryption [XMLEnc]. This specification allows encryption of the SOAP message itself, which eliminates the risk of eavesdropping unless the key used in 
-&lt;/div&gt; 
-&lt;div&gt;
-  the encryption has been compromised. Alternatively, deployers can depend on the SOAP transport layer, or a layer beneath it, to provide in-transit confidentiality. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   The SAML protocol and the SOAP binding neither require nor forbid the 
- &lt;/div&gt; 
- &lt;div&gt;
-   deployment of systems that guarantee in-transit message integrity, but due to this large threat, it is highly recommended that such a system be used. At the SOAP binding level, this can be accomplished by digitally signing requests and responses with a system such as XML Signature [XMLSig]. The SAML specification allows for such signatures; see the SAML assertion and protocol specification for further information. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   If messages are digitally signed (with a sensible key management infrastructure) then the recipient has a guarantee that the message has not been altered in transit, unless the key used has been compromised. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that the SOAP message contains the attributes defined in the official documentation about XML Encryption and XML Signatures. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
-              <output/>
-            </source>
-            <references>
-              <reference name="XML Encryption Syntax and Processing Version 1.1" url="https://www.w3.org/TR/xmlenc-core/"/>
-              <reference name="XML Signature Syntax and Processing Version 1.1" url="https://www.w3.org/TR/xmldsig-core1/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-CS-C-2" name="Validate AuthnRequest and Response processing rules" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Validate AuthnRequest and Response processing rules.&amp;nbsp;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Refer to SAML Core (3.4.1.4) and&amp;nbsp;SAML Profiles (4.1.4.3) respectively for all AuthnRequest and Response processing rules.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-CS-C-1" name="Validate protocol usage" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  This is a common area for security gaps - see Google SSO vulnerability for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the SAML Profile usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The AVANTSSAR team suggested the following data elements should be required: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;b&gt;AuthnRequest(ID, SP)&lt;/b&gt;: An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo="&amp;lt;requestId&amp;gt;"). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.&lt;/li&gt; 
-  &lt;li&gt;&lt;b&gt;Response(ID, SP, IdP, {AA} K -1/IdP)&lt;/b&gt;: A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.&lt;/li&gt; 
-  &lt;li&gt;&lt;b&gt;AuthAssert(ID, C, IdP, SP)&lt;/b&gt;: An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.3" name="Verify SAML assertion signatures and authenticate the issuer" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The browser/POST profile requires the SAML response carrying SAML assertions to be signed, thus providing both message integrity and authentication. The Service Provider site MUST verify the signature and authenticate the issuer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   The following recommendations were proposed in response: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Always perform schema validation on the XML document prior to using it for any security--related purposes:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Always use local, trusted copies of schemas for validation.&lt;/li&gt; 
-    &lt;li&gt;Never allow automatic download of schemas from third party locations.&lt;/li&gt; 
-    &lt;li&gt;If possible, inspect schemas and perform schema hardening, to disable possible wildcard -type or relaxed processing statements.&lt;/li&gt; 
-   &lt;/ul&gt; 
-   &lt;li&gt;Securely validate the digital signature:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.&lt;/li&gt; 
-    &lt;li&gt;If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.&lt;/li&gt; 
-    &lt;li&gt;If you expect a heterogeneous signed documents (many certificates from many identity providers, multi-level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.&lt;/li&gt; 
-   &lt;/ul&gt; 
-   &lt;li&gt;Avoid signature-wrapping attacks.&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Never use getElementsByTagName to select security related elements in an XML document without prior validation.&lt;/li&gt; 
-    &lt;li&gt;Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Encryption should fail closed so that data does not get stored in an unprotected state. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
-            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
-                            &lt;br /&gt;
-                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
-                            the following conditions must be met: &lt;/p&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
-                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
-                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
-                            (e.g. gathered by different sessions or manipulation of session state) share a common
-                            divisor in the length.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.052">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;div&gt;
-   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
-                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" mitigation="25"/>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" mitigation="25"/>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.
-                            </desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-636">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                <countermeasure ref="CWE-603" mitigation="25"/>
-                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-367">
-                  <countermeasures>
-                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint.
-&lt;br /&gt;
-&lt;br /&gt;While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-923">
-                  <countermeasures>
-                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
-&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-523">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
-                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-SC-C-6.1.3" mitigation="20"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.3.1" mitigation="16"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.4.2" mitigation="16"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="16"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" mitigation="16"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.5.3" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SAML-2.0-SC-C-6.1.3" mitigation="20"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.3.1" mitigation="16"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.2" mitigation="16"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="16"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" mitigation="16"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.5.3" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="identity-fraud" name="An attacker try to perform identity fraud" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Identity fraud is the use by one person of another person's personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person. Most identity fraud is committed in the context of financial advantages, such as accessing a victim's credit card, bank or loan accounts. False or forged identity documents have been used in criminal activity (such as to gain access to security areas) or in dealings with government agencies, such as immigration. Often today, the identities of real persons are used in the preparation of these false documents.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-SC-C-7.1.3" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-345">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-CS-C-1" mitigation="25"/>
-                    <countermeasure ref="SAML-2.0-CS-C-2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="SAML-2.0-CS-C-1" mitigation="25"/>
-                <countermeasure ref="SAML-2.0-CS-C-2" mitigation="25"/>
-                <countermeasure ref="SAML-2.0-SC-C-7.1.3" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-SC-C-6.1.1" mitigation="20"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.1.6" mitigation="20"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.4.6" mitigation="20"/>
-                    <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" mitigation="20"/>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SAML-2.0-SC-C-6.1.1" mitigation="20"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.1.6" mitigation="20"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.6" mitigation="20"/>
-                <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" mitigation="20"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-367">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-SC-C-6.4.1" mitigation="50"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.4.4" mitigation="50"/>
-                    <countermeasure ref="SAML-2.0-SC-C-6.5.1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.1" mitigation="50"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.4" mitigation="50"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.5.1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-294">
-                  <countermeasures>
-                    <countermeasure ref="SAML-2.0-SC-C-6.1.2" mitigation="50"/>
-                    <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.1.2" mitigation="50"/>
-                <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" mitigation="50"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                theft and then uses this key to forge signatures from the original signer to mislead a
-                                victim into performing actions that benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
-                                generation and then uses this key to forge signatures from the original signer to
-                                mislead a victim into performing actions which benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-330">
-                  <countermeasures>
-                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-345">
-                  <countermeasures>
-                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="crypto-operations" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="crypto-operations" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="826c51d7-30c1-48f3-9a13-56977e45f92b" diagramComponentId="32a085ef-b687-477c-a60f-11a0ce789941" ref="85ab5253-6d14-450d-a534-8f7341d4f3d6" name="WVD" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
-&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall&lt;/p&gt; 
-&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
-&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
-&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
-&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
-&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
-&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
-&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
-&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
-&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
-&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
-&lt;p&gt;Create a default route&lt;/p&gt; 
-&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
-&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
-&lt;p&gt;3. Select Add.&lt;/p&gt; 
-&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
-&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
-&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
-&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
-&lt;p&gt;8. Select Create.&lt;/p&gt; 
-&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
-&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
-&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
-&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
-&lt;p&gt;13. Select OK.&lt;/p&gt; 
-&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
-&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
-&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
-&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
-&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
-&lt;p&gt;19. Select OK.&lt;/p&gt; 
-&lt;p&gt;Configure an application rule&lt;/p&gt; 
-&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
-&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
-&lt;p&gt;Configure a network rule&lt;/p&gt; 
-&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
-&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
-&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
-&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
-&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
-&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
-&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
-&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
-&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
-&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
-&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
-&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
-&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
-&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
-&lt;p&gt;13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
-&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
-&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
-&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
-&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
-&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
-
-  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
-
-  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
-
-  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
-
-  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
-
-  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
-
-  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
-
-  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
-
-  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
-
-  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
-- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.554">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
-
-	&lt;p&gt;Rationale:&lt;br /&gt;
-Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
-
-	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
-
-	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
-
-	&lt;p&gt;Remediation:&lt;br /&gt;
-View and manage hardening alerts and rules&lt;/p&gt;
-
-	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
-
-	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
-
-	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
-
-	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
-
-	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
-i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
-ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
-iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
-
-	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
-
-	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
-- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
-
-	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
-
-	&lt;p&gt;- Modify a rule&lt;br /&gt;
-- Delete a rule&lt;br /&gt;
-- Add a rule&lt;/p&gt;
-
-	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
-
-	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
-
-	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
-
-	&lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.555">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
-                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="a15dc169-6293-4f11-acb7-a811ed096f3f" diagramComponentId="425ab4f0-30a2-41bc-bcef-89402f5a2cb5" ref="68fef763-8713-48ee-8097-f8f7fe179db1" name="LDAP Directory" desc="" library="" parentComponentRef="" componentDefinitionRef="ldap-directory">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_SEGM"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:51.136">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.923">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-90" name="Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an LDAP query using externally-influenced input from an
-                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
-                        could modify the intended LDAP query when it is sent to a downstream component.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.714">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" url="https://cwe.mitre.org/data/definitions/90.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:51.071">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-150-LDAP" name="Escape LDAP meta-characters in user input" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        All data received from the client-side should be considered tainted and a potential risk,
-                        regardless of the source or transport method.&amp;nbsp;As such, all data from the client side
-                        must be subjected to strict validation, sanitization, and encoding against expected syntactic
-                        and semantic criteria.
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        When using user supplied input in an LDAP query:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Ensure that LDAP specific meta-characters are escaped before the query is executed.&lt;/li&gt;
-                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
-                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
-                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
-                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
-                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&lt;/li&gt;
-                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
-                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
-                        non-compliant data.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every part of the code which manages LDAP queries.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check it is correctly escaping the following characters: &amp;quot;\&amp;quot;,
-                            &amp;quot;(&amp;quot;, &amp;quot;|&amp;quot;, &amp;quot;&amp;lt;&amp;quot;, &amp;quot;/&amp;quot;,
-                            &amp;quot;)&amp;quot;, &amp;quot;=&amp;quot;, &amp;quot;~&amp;quot;, &amp;quot;&amp;amp;&amp;quot;,
-                            &amp;quot;&amp;gt;&amp;quot;, &amp;quot;*&amp;quot; .&lt;/li&gt;
-                            &lt;/ol&gt;A safe method to automatically escape those characters is to use a framework
-                            which allows LDAP prepared statements.&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-136" name="Attackers could access data for which they are not authorised through LDAP injection attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers could exploit LDAP injection vulnerabilities and gain access to data to
-                                which
-                                they are not authorized in the LDAP store.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-90">
-                  <countermeasures>
-                    <countermeasure ref="CWE-150-LDAP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-150-LDAP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="b857f5f8-0d90-464a-83cb-29bd426d5113" diagramComponentId="2bad620f-8f4b-48d2-b3fb-cc9b59434702" ref="78aab505-4109-4e57-8b91-756696703a30" name="Contractor" desc="" library="" parentComponentRef="" componentDefinitionRef="end-user">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="trusted-partner"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CSMS-4.3.4-15.2" name="Defined security procedures are not followed" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; &lt;b&gt;Defined security procedures&lt;/b&gt; are not followed&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.4-15.1" name="Social engineering" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; Innocent victim (e.g. owner, operator or maintenance engineer) being &lt;b&gt;tricked into taking an action&lt;/b&gt; to&lt;b&gt; &lt;/b&gt;unintentionally load malware or enable an attack&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.394">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSMS-M19" name="Define security procedures" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Organizations shall ensure security procedures are defined and followed including logging of actions and access related to the management of the security functions&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53 PS-1 Personnel Security Policy and Procedures" url="https://nvd.nist.gov/800-53/Rev4/control/PS-1"/>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M19" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.331">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M18" name="Define user roles and access privileges" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Measures shall be implemented for defining and controlling user roles and access privileges, based on the principle of least access privilege&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Role Definitions" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/01-Test_Role_Definitions"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M18" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
-          <threats>
-            <threat ref="CSMS-4.3.4-15" name="Unintended human actions carried out from outside of vehicles" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
-              <desc>This threat include: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Legitimate actors are able to take actions that would unwittingly facilitate a cyber-attack&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CSMS-4.3.4-15.1">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M18" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CSMS-4.3.4-15.2">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M19" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSMS-M18" mitigation="50"/>
-                <countermeasure ref="CSMS-M19" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7793ea19-b048-4e76-9b8d-ed4e7a07a396" diagramComponentId="74ebf67f-d7bc-4010-a340-f91efdbfdb38" ref="6a20a317-2616-4aaa-8931-c7b1406ec787" name="Azure AD" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-active-directory">
-      <tags/>
-      <questions>
-        <question ref="azure.remote.workers.no" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Personally Identifiable Information" accessType="10"/>
-        <asset name="Personally Identifiable Information" accessType="20"/>
-        <asset name="Personally Identifiable Information" accessType="40"/>
-        <asset name="Personally Identifiable Information" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are typically introduced during the
-                        configuration of the software.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-DATA-01" name="Sensitive data are accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data are not encrypted and the sensitive data is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="no-alerts-access" name="There is no alert for unauthorized access" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There is no alert to notify about unauthorized access to the resources, and this access is not logged.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.608">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD1" name="Block legacy authentication for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Block legacy authentication for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; To give your users easy access to your cloud apps, Azure Active Directory (Azure AD) supports a broad variety of authentication protocols including legacy authentication. Legacy authentication is a term that refers to an authentication request made by:&lt;br&gt; - Older Office clients that do not use modern authentication (for example, Office 2010 client)&lt;br&gt; - Any client that uses legacy mail protocols such as IMAP/SMTP/POP3&lt;br&gt; Today, the majority of all compromising sign-in attempts come from legacy authentication. Legacy authentication does not support multi-factor authentication (MFA). Even if you have an MFA policy enabled on your directory, a bad actor can authenticate using a legacy protocol and bypass MFA. The best way to protect your account from malicious authentication requests made by legacy protocols is to block these attempts altogether.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Follow the steps below in order to block legacy authentication in your directory&lt;/p&gt;&lt;p&gt;Identify legacy authentication use&lt;/p&gt;&lt;p&gt;Before you can block legacy authentication in your directory, you need to first understand if your users have apps that use legacy authentication and how it affects your overall directory. Azure AD sign-in logs can be used to understand if you are using legacy authentication.&lt;/p&gt;&lt;p&gt;1. Navigate to the Azure portal &amp;gt; Azure Active Directory &amp;gt; Sign-ins.&lt;br&gt; 2. Add the Client App column if it is not shown by clicking on Columns &amp;gt; Client App.&lt;br&gt; 3. Filter by Client App &amp;gt; check all the Legacy Authentication Clients options presented.&lt;br&gt; 4. Filter by Status &amp;gt; Success.&lt;br&gt; 5. Expand your date range if necessary using the Date filter.&lt;/p&gt;&lt;p&gt;Filtering will only show you successful sign-in attempts that were made by the selected legacy authentication protocols. Clicking on each individual sign-in attempt will show you additional details. The Client App column or the Client App field under the Basic Info tab after selecting an individual row of data will indicate which legacy authentication protocol was used. These logs will indicate which users are still depending on legacy authentication and which applications are using legacy protocols to make authentication requests. For users that do not appear in these logs and are confirmed to not be using legacy authentication, implement a Conditional Access policy or enable the Baseline policy: block legacy authentication for these users only.&lt;/p&gt;&lt;p&gt;Moving away from legacy authentication&lt;/p&gt;&lt;p&gt;Once you have a better idea of who is using legacy authentication in your directory and which applications depend on it, the next step is upgrading your users to use modern authentication. Modern authentication is a method of identity management that offers more secure user authentication and authorization. If you have an MFA policy in place on your directory, modern authentication ensures that the user is prompted for MFA when required. It is the more secure alternative to legacy authentication protocols.&lt;/p&gt;&lt;p&gt;This section gives a step-by-step overview on how to update your environment to modern authentication. Read through the steps below before enabling a legacy authentication blocking policy in your organization.&lt;/p&gt;&lt;p&gt;Step 1: Enable modern authentication in your directory&lt;/p&gt;&lt;p&gt;The first step in enabling modern authentication is making sure your directory supports modern authentication. Modern authentication is enabled by default for directories created on or after August 1, 2017. If your directory was created prior to this date, you will need to manually enable modern authentication for your directory using the following steps:&lt;/p&gt;&lt;p&gt;1. Check to see if your directory already supports modern authentication by running Get-CsOAuthConfiguration from the Skype for Business Online PowerShell module.&lt;br&gt; 2. If your command returns an empty OAuthServers property, then Modern Authentication is disabled. Update the setting to enable modern authentication using Set-CsOAuthConfiguration. If your OAuthServers property contains an entry, you are good to go.&lt;/p&gt;&lt;p&gt;Be sure to complete this step before moving forward. It is critical that your directory configurations are changed first because they dictate which protocol will be used by all Office clients. Even if you are using Office clients that support modern authentication, they will default to using legacy protocols if modern authentication is disabled on your directory.&lt;/p&gt;&lt;p&gt;Step 2: Office applications&lt;/p&gt;&lt;p&gt;Once you have enabled modern authentication in your directory, you can start updating applications by enabling modern authentication for Office clients. Office 2016 or later clients support modern authentication by default. No extra steps are required.&lt;/p&gt;&lt;p&gt;If you are using Office 2013 Windows clients or older, Azure recommends upgrading to Office 2016 or later. Even after completing the prior step of enabling modern authentication in your directory, the older Office applications will continue to use legacy authentication protocols. If you are using Office 2013 clients and are unable to immediately upgrade to Office 2016 or later, follow the steps in the following article to Enable Modern Authentication for Office 2013 on Windows devices. To help protect your account while you are using legacy authentication, Azure recommends using strong passwords across your directory. Check out Azure AD password protection to ban weak passwords across your directory.&lt;/p&gt;&lt;p&gt;Office 2010 does not support modern authentication. You will need to upgrade any users with Office 2010 to a more recent version of Office. Azure recommends upgrading to Office 2016 or later, as it blocks legacy authentication by default.&lt;/p&gt;&lt;p&gt;If you are using macOS, Azure recommends upgrading to Office for Mac 2016 or later. If you are using the native mail client, you will need to have macOS version 10.14 or later on all devices.&lt;/p&gt;&lt;p&gt;Step 3: Exchange and SharePoint&lt;/p&gt;&lt;p&gt;For Windows-based Outlook clients to use modern authentication, Exchange Online must be modern authentication enabled as well. If modern authentication is disabled for Exchange Online, Windows-based Outlook clients that support modern authentication (Outlook 2013 or later) will use basic authentication to connect to Exchange Online mailboxes.&lt;/p&gt;&lt;p&gt;SharePoint Online is enabled for modern authentication default. For directories created after August 1, 2017, modern authentication is enabled by default in Exchange Online. However, if you had previously disabled modern authentication or are you using a directory created prior to this date, follow the steps in the "Enable modern authentication in Exchange Online" in Reference Url.&lt;/p&gt;&lt;p&gt;Step 4: Skype for Business&lt;/p&gt;&lt;p&gt;To prevent legacy authentication requests made by Skype for Business, it is necessary to enable modern authentication for Skype for Business Online. For directories created after August 1, 2017, modern authentication for Skype for Business is enabled by default.&lt;/p&gt;&lt;p&gt;Azure suggests you transition to Microsoft Teams, which supports modern authentication by default. However, if you are unable to migrate at this time, you will need to enable modern authentication for Skype for Business Online so that Skype for Business clients start using modern authentication.&lt;/p&gt;&lt;p&gt;In addition to enabling modern authentication for Skype for Business Online, Azure recommends enabling modern authentication for Exchange Online when enabling modern authentication for Skype for Business. This process will help synchronize the state of modern authentication in Exchange Online and Skype for Business online and will prevent multiple sign-in prompts for Skype for Business clients.&lt;/p&gt;&lt;p&gt;Step 5: Using mobile devices&lt;br&gt; Applications on your mobile device need to block legacy authentication as well. Azure recommends using Outlook for Mobile. Outlook for Mobile supports modern authentication by default and will satisfy other MFA baseline protection policies.&lt;/p&gt;&lt;p&gt;In order to use the native iOS mail client, you will need to be running iOS version 11.0 or later to ensure the mail client has been updated to block legacy authentication.&lt;/p&gt;&lt;p&gt;Step 6: On-premises clients&lt;/p&gt;&lt;p&gt;If you are a hybrid customer using Exchange Server on-premises and Skype for Business on-premises, both services will need to be updated to enable modern authentication. When using modern authentication in a hybrid environment, you are still authenticating users on-premises. The story of authorizing their access to resources (files or emails) changes.&lt;/p&gt;&lt;p&gt;Before you can begin enabling modern authentication on-premises, please be sure that you have met the pre-requisites. You are now ready to enable modern authentication on-premises.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blocking legacy authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-block-legacy-authentication"/>
-            <reference name="Enable or disable modern authentication for Outlook in Exchange Online" url="https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To check if your users have apps that use legacy authentication, follow again the steps of "Identify legacy authentication use" section:&lt;/p&gt;      &lt;p&gt;1. Navigate to the Azure portal &gt; Azure Active Directory &gt; Sign-ins.&lt;br /&gt;  2. Add the Client App column if it is not shown by clicking on Columns &gt; Client App.&lt;br /&gt;  3. Filter by Client App &gt; check all the Legacy Authentication Clients options presented.&lt;br /&gt;  4. Filter by Status &gt; Success.&lt;br /&gt;  5. Expand your date range if necessary using the Date filter.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD18" name="Configure Azure Active Directory settings" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure Active Directory.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of methods required to reset' is set to '2'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0"&lt;/li&gt;&lt;li&gt;Ensure that 'Notify users on password resets?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can register applications' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guest user permissions are limited' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Members can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guests can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create security groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that no custom subscription owner roles are created&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;ol&gt;&lt;li&gt;Go to Users&lt;ol&gt;&lt;li&gt;Go to Password reset&lt;ol&gt;&lt;li&gt;Go to Authentication methods&lt;ol&gt;&lt;li&gt;Set the Number of methods required to reset to 2&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Registration&lt;ol&gt;&lt;li&gt;Set the Number of days before users are asked to re-confirm their authentication information to your organization defined frequency&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Notification&lt;ol&gt;&lt;li&gt;Set Notify users on password resets? to Yes&lt;/li&gt;&lt;li&gt;Set Notify all admins when other admins reset their password? to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to All Users&lt;ol&gt;&lt;li&gt;Click on Multi-Factor Authentication button on the top bar&lt;/li&gt;&lt;li&gt;Click on service settings&lt;/li&gt;&lt;li&gt;Disable Allow users to remember multi-factor authentication on devices they trust&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to User settings&lt;ol&gt;&lt;li&gt;Click on Manage how end users launch and view their applications&lt;ol&gt;&lt;li&gt;Set Users can consent to apps accessing company data on their behalf to No&lt;/li&gt;&lt;li&gt;Set Users can add gallery apps to their Access Panel to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Set Users can register applications to No&lt;/li&gt;&lt;li&gt;Set Restrict access to Azure AD administration portal to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to External Identities&lt;ol&gt;&lt;li&gt;Go to External collaboration settings&lt;ol&gt;&lt;li&gt;Set Guest users permissions are limited to Yes&lt;/li&gt;&lt;li&gt;Set Members can invite to No&lt;/li&gt;&lt;li&gt;Set Guests can invite to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Groups&lt;ol&gt;&lt;li&gt;Go to General in setting&lt;ol&gt;&lt;li&gt;Ensure that Restrict user ability to access groups features in the Access Pane is set to No&lt;/li&gt;&lt;li&gt;Set Users can create security groups in Azure Portals to No&lt;/li&gt;&lt;li&gt;Set Owners can manage group membership requests in the Access Panel to No&lt;/li&gt;&lt;li&gt;Set Users can create Microsoft 365 groups in Azure Portals to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Devices&lt;ol&gt;&lt;li&gt;Go to Device settings&lt;ol&gt;&lt;li&gt;Set Require Multi-Factor Auth to join devices to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.10" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.11" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.12" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.13" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.14" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.15" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.15" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.16" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.17" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.18" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.19" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.20" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.20" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.21" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.22" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.22" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="1.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="GS-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="IM-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD12" name="Configure Azure Monitor logs" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Configure Azure Monitor logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure Monitor logs allows you to query data to find particular events, analyze trends, and perform correlation across various data sources. You can also set up alerts on your query. With the integration of Azure AD activity logs in Azure Monitor logs, you can now perform tasks like:&lt;/p&gt; 
-&lt;p&gt;- Compare your Azure AD sign-in logs against security logs published by Azure Security Center&lt;br&gt; - Troubleshoot performance bottlenecks on your application's sign-in page by correlating application performance data from Azure Application Insights.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Using this feature requires an Azure AD Premium P1 or P2 license.&lt;/p&gt; 
-&lt;p&gt;Send logs to Azure Monitor&lt;/p&gt; 
-&lt;p&gt;1.Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. Select Azure Active Directory &amp;gt; Diagnostic settings -&amp;gt; Add diagnostic setting. You can also select Export Settings from the Audit Logs or Sign-ins page to get to the diagnostic settings configuration page.&lt;/p&gt; 
-&lt;p&gt;3. In the Diagnostic settings menu, select the Send to Log Analytics workspace check box, and then select Configure.&lt;/p&gt; 
-&lt;p&gt;4. Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.&lt;/p&gt; 
-&lt;p&gt;5. Do either or both of the following:&lt;/p&gt; 
-&lt;p&gt;- To send audit logs to the Log Analytics workspace, select the AuditLogs check box.&lt;br&gt; - To send sign-in logs to the Log Analytics workspace, select the SignInLogs check box.&lt;/p&gt; 
-&lt;p&gt;6. Select Save to save the setting.&lt;/p&gt; 
-&lt;p&gt;7. After about 15 minutes, verify that events are streamed to your Log Analytics workspace.&lt;/p&gt; 
-&lt;p&gt;Navigate to the Log Analytics workspace&lt;/p&gt; 
-&lt;p&gt;- Sign in to the Azure portal.&lt;br&gt; - Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace. The workspace will open with a default query.&lt;/p&gt; 
-&lt;p&gt;Alert on Azure AD activity log data&lt;/p&gt; 
-&lt;p&gt;You can also set up alerts on your query. For example, to configure an alert when more than 10 applications have been used in the last week:&lt;/p&gt; 
-&lt;p&gt;1. From the workspace, select Set alert to open the Create rule page.&lt;/p&gt; 
-&lt;p&gt;2. Select the default alert criteria created in the alert and update the Threshold in the default metric to 10.&lt;/p&gt; 
-&lt;p&gt;3. Enter a name and description for the alert, and choose the severity level. For our example, we could set it to Informational.&lt;/p&gt; 
-&lt;p&gt;4. Select the Action Group that will be alerted when the signal occurs. You can choose to notify your team via email or text message, or you could automate the action using webhooks, Azure functions or logic apps. Learn more about creating and managing alert groups in the Azure portal.&lt;/p&gt; 
-&lt;p&gt;5. Once you have configured the alert, select Create alert to enable it.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Analyze Azure AD activity logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics#alert-on-azure-ad-activity-log-data"/>
-            <reference name="Integrate Azure AD logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Monitor logs are configured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD4" name="Create an organization specific custom banned password list" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create an organization specific custom banned password list&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, the Azure Active Directory (Azure AD) custom banned password list let you add specific strings to evaluate and block. A password change request fails if there is a match in the custom banned password list.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Note: To complete this guide, you need a working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.&lt;/p&gt; 
-&lt;p&gt;Configure custom banned passwords&lt;/p&gt; 
-&lt;p&gt;To enable the custom banned password list and add entries to it, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, then choose Security from the menu on the left-hand side.&lt;/p&gt; 
-&lt;p&gt;3. Under the Manage menu header, select Authentication methods, then Password protection.&lt;/p&gt; 
-&lt;p&gt;4. Set the option for Enforce custom list to Yes.&lt;/p&gt; 
-&lt;p&gt;5. Add strings to the Custom banned password list, one string per line. The following considerations and limitations apply to the custom banned password list:&lt;/p&gt; 
-&lt;p&gt;- The custom banned password list can contain up to 1000 terms.&lt;br&gt; - The custom banned password list is case-insensitive.&lt;br&gt; - The custom banned password list considers common character substitution, such as o and 0, or a and @.&lt;br&gt; - The minimum string length is four characters, and the maximum is 16 characters.&lt;/p&gt; 
-&lt;p&gt;Specify your own custom passwords to ban.&lt;/p&gt; 
-&lt;p&gt;6. Leave the option for Enable password protection on Windows Server Active Directory to No.&lt;/p&gt; 
-&lt;p&gt;7. To enable the custom banned passwords and your entries, select Save.&lt;/p&gt; 
-&lt;p&gt;It may take several hours for updates to the custom banned password list to be applied.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Configure custom banned passwords for Azure Active Directory password protection" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password-protection"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test custom banned password list&lt;/p&gt;
-
-  &lt;p&gt;To see the custom banned password list in action, try to change the password to a variation of one that you added in the Remediation section. When Azure AD tries to process the password change, the password is matched against an entry in the custom banned password list. An error is then displayed to the user.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD3" name="Designate more than one global administrator in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Designate more than one global administrator in Azure AD&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you cannot sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.&lt;/p&gt; 
-&lt;p&gt;Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts cannot be used. Azure recommends that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create emergency access accounts&lt;/p&gt; 
-&lt;p&gt;Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.&lt;/p&gt; 
-&lt;p&gt;When configuring these accounts, the following requirements must be met:&lt;/p&gt; 
-&lt;p&gt;- The emergency access accounts should not be associated with any individual user in the organization. Make sure that your accounts are not connected with any employee-supplied mobile phones, hardware tokens that travel with individual employees, or other employee-specific credentials. This precaution covers instances where an individual employee is unreachable when the credential is needed. It is important to ensure that any registered devices are kept in a known, secure location that has multiple means of communicating with Azure AD.&lt;br&gt; - The authentication mechanism used for an emergency access account should be distinct from that used by your other administrative accounts, including other emergency access accounts. For example, if your normal administrator sign-in is via on-premises MFA, then Azure AD MFA would be a different mechanism. However if Azure AD MFA is your primary part of authentication for your administrative accounts, then consider a different approach for these, such as using Conditional Access with a third-party MFA provider via Custom controls.&lt;br&gt; - The device or credential must not expire or be in scope of automated cleanup due to lack of use.&lt;br&gt; - You should make the Global Administrator role assignment permanent for your emergency access accounts.&lt;/p&gt; 
-&lt;p&gt;Exclude at least one account from phone-based multi-factor authentication&lt;/p&gt; 
-&lt;p&gt;To reduce the risk of an attack resulting from a compromised password, Azure AD recommends that you require multi-factor authentication for all individual users. This group includes administrators and all others (for example, financial officers) whose compromised account would have a significant impact.&lt;/p&gt; 
-&lt;p&gt;However, at least one of your emergency access accounts should not have the same multi-factor authentication mechanism as your other non-emergency accounts. This includes third-party multi-factor authentication solutions. If you have a Conditional Access policy to require multi-factor authentication for every administrator for Azure AD and other connected software as a service (SaaS) apps, you should exclude emergency access accounts from this requirement, and configure a different mechanism instead. Additionally, you should make sure the accounts do not have a per-user multi-factor authentication policy.&lt;/p&gt; 
-&lt;p&gt;Exclude at least one account from Conditional Access policies&lt;/p&gt; 
-&lt;p&gt;During an emergency, you do not want a policy to potentially block your access to fix an issue. At least one emergency access account should be excluded from all Conditional Access policies.&lt;/p&gt; 
-&lt;p&gt;In addition you have to store the credentials for emergency access accounts safely and monitor sign-in and audit log activity.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Manage emergency access accounts in Azure AD" url="https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you have at least two emergency access accounts.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD8" name="Disable end-user consent to applications" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Disable end-user consent to applications&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The admin consent workflow gives admins a secure way to grant access to applications that require admin approval so end users do not expose corporate data. Microsoft recommends disabling future user consent operations to help reduce your surface area and mitigate this risk.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To configure user consent settings through the Azure portal:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a Global Administrator.&lt;br&gt; 2. Select Azure Active Directory &amp;gt; Enterprise applications &amp;gt; Consent and permissions &amp;gt; User consent settings.&lt;br&gt; 3. Under User consent for applications, select "Do not allow user consent" &lt;br&gt; 4. Select Save to save your settings.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure how end-users consent to applications" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that end-user consent to applications is disabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD11" name="Enable Azure AD Identity Protection" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Azure Active Directory Identity Protection&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Identity Protection is a tool that allows organizations to accomplish three key tasks:&lt;/p&gt;
-
-  &lt;p&gt;- Automate the detection and remediation of identity-based risks.&lt;br /&gt;
-- Investigate risks using data in the portal.&lt;br /&gt;
-- Export risk detection data to third-party utilities for further analysis.&lt;/p&gt;
-
-  &lt;p&gt;Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.&lt;/p&gt;
-
-  &lt;p&gt;The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Using this feature requires an Azure AD Premium P2 license.&lt;/p&gt;
-
-  &lt;p&gt;Then in the Azure portal under Azure Active Directory &gt; Security &gt; Identity Protection you can:&lt;/p&gt;
-
-  &lt;p&gt;- Configure the MFA registration policy&lt;br /&gt;
-- Configure risk policies&lt;br /&gt;
-- Configure notifications&lt;/p&gt;
-
-  &lt;p&gt;For more information please see Reference URLs.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Azure Active Directory Identity Protection notifications" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications"/>
-            <reference name="How To: Configure and enable risk policies" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies"/>
-            <reference name="How To: Configure the Azure AD Multi-Factor Authentication registration policy" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy"/>
-            <reference name="What is Identity Protection?" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure Active Directory Identity Protection is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD5" name="Enable combined security information registration in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable combined security information registration in Azure AD&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.&lt;br&gt; Note: Starting on August 15th 2020, all new Azure AD tenants will be automatically enabled for combined registration. Starting on December 14th 2020, all Azure AD tenants with one user will be automatically enabled for combined registration.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To enable combined registration, complete these steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a user administrator or global administrator.&lt;/p&gt; 
-&lt;p&gt;2. Go to Azure Active Directory &amp;gt; User settings &amp;gt; Manage user feature preview settings.&lt;/p&gt; 
-&lt;p&gt;3. Under Users can use the combined security information registration experience, choose to enable for a Selected group of users or for All users.&lt;/p&gt; 
-&lt;p&gt;Create a policy to require registration from a trusted location&lt;/p&gt; 
-&lt;p&gt;Complete the following steps to create a policy that applies to all selected users that attempt to register using the combined registration experience, and blocks access unless they are connecting from a location marked as trusted network:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;/p&gt; 
-&lt;p&gt;2. Select + New policy.&lt;/p&gt; 
-&lt;p&gt;3. Enter a name for this policy, such as Combined Security Info Registration on Trusted Networks.&lt;/p&gt; 
-&lt;p&gt;4. Under Assignments, select Users and groups. Choose the users and groups you want this policy to apply to, then select Done.&lt;/p&gt; 
-&lt;p&gt;Warning: Users must be enabled for combined registration.&lt;/p&gt; 
-&lt;p&gt;5. Under Cloud apps or actions, select User actions. Check Register security information, then select Done.&lt;/p&gt; 
-&lt;p&gt;6. Under Conditions &amp;gt; Locations, configure the following options:&lt;br&gt; a. Configure Yes.&lt;br&gt; b. Include Any location.&lt;br&gt; c. Exclude All trusted locations.&lt;/p&gt; 
-&lt;p&gt;7. Select Done on the Locations window, then select Done on the Conditions window.&lt;/p&gt; 
-&lt;p&gt;8. Under Access controls &amp;gt; Grant, choose Block access, then Select.&lt;/p&gt; 
-&lt;p&gt;9. Set Enable policy to On.&lt;/p&gt; 
-&lt;p&gt;10. To finalize the policy, select Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable combined security information registration in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that combined security information registration is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD14" name="Enable device based Conditional Access" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable device based Conditional Access&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Improve security and user experiences with device-based Conditional Access. This control ensures users can only access from devices that meet your standards for security and compliance. These devices are also known as managed devices. Managed devices can be Intune compliant or Hybrid Azure AD joined devices.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Managed devices&lt;/p&gt; 
-&lt;p&gt;In simple terms, managed devices are devices that are under some sort of organizational control. In Azure AD, the prerequisite for a managed device is that it has been registered with Azure AD. Registering a device creates an identity for the device in form of a device object. This object is used by Azure to track status information about a device. As an Azure AD administrator, you can already use this object to toggle (enable/disable) the state of a device.&lt;/p&gt; 
-&lt;p&gt;To get a device registered with Azure AD, you have three options:&lt;/p&gt; 
-&lt;p&gt;- Azure AD registered devices - to get a personal device registered with Azure AD&lt;br&gt; - Azure AD joined devices - to get an organizational Windows 10 device that is not joined to an on-premises AD registered with Azure AD.&lt;br&gt; - Hybrid Azure AD joined devices - to get a Windows 10 or supported down-level device that is joined to an on-premises AD registered with Azure AD.&lt;/p&gt; 
-&lt;p&gt;To become a managed device, a registered device must be either a Hybrid Azure AD joined device or a device that has been marked as compliant.&lt;/p&gt; 
-&lt;p&gt;Require Hybrid Azure AD joined devices&lt;/p&gt; 
-&lt;p&gt;In your Conditional Access policy, you can select Require Hybrid Azure AD joined device to state that the selected cloud apps can only be accessed using a managed device.&lt;/p&gt; 
-&lt;p&gt;This setting only applies to Windows 10 or down-level devices such as Windows 7 or Windows 8 that are joined to an on-premises AD. You can only register these devices with Azure AD using a Hybrid Azure AD join, which is an automated process to get a Windows 10 device registered.&lt;/p&gt; 
-&lt;p&gt;What makes a Hybrid Azure AD joined device a managed device? For devices that are joined to an on-premises AD, it is assumed that the control over these devices is enforced using management solutions such as Configuration Manager or group policy (GP) to manage them. Because there is no method for Azure AD to determine whether any of these methods has been applied to a device, requiring a hybrid Azure AD joined device is a relatively weak mechanism to require a managed device. It is up to you as an administrator to judge whether the methods that are applied to your on-premises domain-joined devices are strong enough to constitute a managed device if such a device is also a Hybrid Azure AD joined device.&lt;/p&gt; 
-&lt;p&gt;Require device to be marked as compliant&lt;/p&gt; 
-&lt;p&gt;The option to require a device to be marked as compliant is the strongest form to request a managed device.&lt;/p&gt; 
-&lt;p&gt;This option requires a device to be registered with Azure AD, and also to be marked as compliant by:&lt;br&gt; - Intune&lt;br&gt; - A third-party mobile device management (MDM) system that manages Windows 10 devices via Azure AD integration. Third-party MDM systems for device OS types other than Windows 10 are not supported.&lt;/p&gt; 
-&lt;p&gt;For a device that is marked as compliant, you can assume that:&lt;br&gt; - The mobile devices your workforce uses to access company data are managed&lt;br&gt; - Mobile apps your workforce uses are managed&lt;br&gt; - Your company information is protected by helping to control the way your workforce accesses and shares it&lt;br&gt; - The device and its apps are compliant with company security requirements&lt;/p&gt; 
-&lt;p&gt;Scenario: Require device enrollment for iOS and Android devices&lt;/p&gt; 
-&lt;p&gt;In this scenario, Contoso has decided that all mobile access to Microsoft 365 resources must use an enrolled device. All of their users already sign in with Azure AD credentials and have licenses assigned to them that include Azure AD Premium P1 or P2 and Microsoft Intune.&lt;/p&gt; 
-&lt;p&gt;Organizations must complete the following steps in order to require the use of an enrolled mobile device.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;br&gt; 3. Select New policy.&lt;br&gt; 4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.&lt;br&gt; 5. Under Assignments, select Users and groups&lt;br&gt; a. Under Include, select All users or the specific Users and groups you wish to apply this policy to.&lt;br&gt; b. Select Done.&lt;br&gt; 6. Under Cloud apps or actions &amp;gt; Include, select Office 365.&lt;br&gt; 7. Under Conditions, select Device platforms.&lt;br&gt; a. Set Configure to Yes.&lt;br&gt; b. Include Android and iOS.&lt;br&gt; 8. Under Access controls &amp;gt; Grant, select the following options:&lt;br&gt; - Require device to be marked as compliant&lt;br&gt; 9. Confirm your settings and set Enable policy to On.&lt;br&gt; 10. Select Create to create and enable your policy.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How To: Require managed devices for cloud app access with Conditional Access" url="https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices#require-hybrid-azure-ad-joined-devices"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that device based Conditional Access is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD16" name="Enable Microsoft's password guidance" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Microsoft's password guidance&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Password Guidance provides Microsoft's recommendations for password management based on current research and lessons from their own experience as one of the largest Identity Providers (IdPs) in the world. It covers recommendations for end users and identity administrators.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Download and enforce Microsoft's password guidance in your organization.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Password Guidance" url="https://www.microsoft.com/en-us/research/publication/password-guidance/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Microsoft's password guidance is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD7" name="Enable password writeback for SSPR if using hybrid identities" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable password writeback for SSPR if using hybrid identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; With Azure Active Directory (Azure AD) self-service password reset (SSPR), users can update their password or unlock their account using a web browser. In a hybrid environment where Azure AD is connected to an on-premises Active Directory Domain Services (AD DS) environment, this scenario can cause passwords to be different between the two directories.&lt;/p&gt; 
-&lt;p&gt;Password writeback can be used to synchronize password changes in Azure AD back to your on-premises AD DS environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Azure AD.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;/p&gt; 
-&lt;p&gt;Enable password writeback for SSPR&lt;/p&gt; 
-&lt;p&gt;Note: Before proceeding to the following steps, make sure you have enabled password writeback to Azure AD Connect first.&lt;/p&gt; 
-&lt;p&gt;With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.&lt;/p&gt; 
-&lt;p&gt;To enable password writeback in SSPR, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using a global administrator account.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, select Password reset, then choose On-premises integration.&lt;/p&gt; 
-&lt;p&gt;3. Set the option for Write back passwords to your on-premises directory? to Yes.&lt;/p&gt; 
-&lt;p&gt;4. Set the option for Allow users to unlock accounts without resetting their password? to Yes.&lt;/p&gt; 
-&lt;p&gt;5. When ready, select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Enable Azure Active Directory self-service password reset writeback to an on-premises environment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback#enable-password-writeback-for-sspr"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that password writeback for SSPR is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Licensing requirements&lt;/p&gt;
-
-  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
-
-  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
-- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
-
-  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
-
-  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
-- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
-When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
-
-  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD2" name="Enable Security defaults for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Security defaults for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; Managing security can be difficult with common identity-related attacks like password spray, replay, and phishing becoming more and more popular. Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:&lt;/p&gt;&lt;p&gt;- Requiring all users to register for Azure AD Multi-Factor Authentication.&lt;br&gt; - Requiring administrators to perform multi-factor authentication.&lt;br&gt; - Blocking legacy authentication protocols.&lt;br&gt; - Requiring users to perform multi-factor authentication when necessary.&lt;br&gt; - Protecting privileged activities like access to the Azure portal.&lt;/p&gt;&lt;p&gt;Note: If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Enabling security defaults&lt;br&gt; To enable security defaults in your directory:&lt;/p&gt;&lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Properties.&lt;br&gt; 3. Select Manage security defaults.&lt;br&gt; 4. Set the Enable security defaults toggle to Yes.&lt;br&gt; 5. Select Save.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; Warning: Before you enable security defaults, make sure your administrators are not using older authentication protocols.&lt;/p&gt;&lt;p&gt;Who should use Conditional Access instead of Security defaults?&lt;br&gt; - If you are an organization currently using Conditional Access policies to bring signals together, to make decisions, and enforce organizational policies, security defaults are probably not right for you.&lt;br&gt; - If you are an organization with Azure Active Directory Premium licenses, security defaults are probably not right for you.&lt;br&gt; - If your organization has complex security requirements you should consider Conditional Access.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What are security defaults?" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;To ensure that Security defaults are enabled:&lt;/p&gt;      &lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br /&gt;  2. Browse to Azure Active Directory &gt; Properties.&lt;br /&gt;  3. Select Manage security defaults.&lt;br /&gt;  4. Check that the Enable security defaults toggle is set to Yes.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD6" name="Enable self-service password reset (SSPR)" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable self-service password reset (SSPR)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Self-Service Password Reset (SSPR) is an Azure Active Directory (AD) feature that enables users to reset their passwords without contacting IT staff for help. The users can quickly unblock themselves and continue working no matter where they are or time of day. By allowing the employees to unblock themselves, your organization can reduce the non-productive time and high support costs for most common password-related issues.&lt;/p&gt; 
-&lt;p&gt;SSPR has the following key capabilities:&lt;/p&gt; 
-&lt;p&gt;- Self-service allows end users to reset their expired or non-expired passwords without contacting an administrator or helpdesk for support.&lt;br&gt; - Password Writeback allows management of on-premises passwords and resolution of account lockout though the cloud.&lt;br&gt; - Password management activity reports give administrators insight into password reset and registration activity occurring in their organization.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; This is how configure SSPR for a set of users in a test group. In the following example, the group SSPR-Test-Group is used. Provide your own Azure AD group as needed:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
-&lt;p&gt;2. Search for and select Azure Active Directory, then choose Password reset from the menu on the left-hand side.&lt;/p&gt; 
-&lt;p&gt;3. From the Properties page, under the option Self service password reset enabled, choose Select group&lt;/p&gt; 
-&lt;p&gt;4. Browse for and select your Azure AD group, such as SSPR-Test-Group, then choose Select.&lt;/p&gt; 
-&lt;p&gt;5. To enable SSPR for the select users, select Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Plan an Azure Active Directory self-service password reset deployment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment"/>
-            <reference name="Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Test self-service password reset&lt;/p&gt;
-
-  &lt;p&gt;With SSPR enabled and configured, test the SSPR process with a user that's part of the group you selected in the Remediation section, such as Test-SSPR-Group. In the following example, the testuser account is used. Provide your own user account that's part of the group you enabled for SSPR in the Remediation section.&lt;/p&gt;
-
-  &lt;p&gt;Note: When you test self-service password reset, use a non-administrator account. By default, admins are enabled for self-service password reset and are required to use two authentication methods to reset their password. For more information, see Administrator reset policy differences.&lt;/p&gt;
-
-  &lt;p&gt;1. To see the manual registration process, open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/ssprsetup. Users should be directed to this registration portal when they next sign-in.&lt;/p&gt;
-
-  &lt;p&gt;2. Sign in with a non-administrator test user, such as testuser, and register your authentication methods contact information.&lt;/p&gt;
-
-  &lt;p&gt;3. Once complete, select the button marked Looks good and close the browser window.&lt;/p&gt;
-
-  &lt;p&gt;4. Open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/sspr.&lt;/p&gt;
-
-  &lt;p&gt;5. Enter your non-administrator test users' account information, such as testuser, the characters from the CAPTCHA, and then select Next.&lt;/p&gt;
-
-  &lt;p&gt;6. Follow the verification steps to reset your password. When complete, you should receive an e-mail notification that your password was reset.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD17" name="Ensure there are no Azure Active Directory guest users if they are not needed" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.&lt;/p&gt;&lt;p&gt;Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.&lt;/p&gt;&lt;p&gt;Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely leading to a potential vulnerability.&lt;/p&gt;&lt;p&gt;Guest users should be review on a monthly basis to ensure that inactive and unneeded accounts are removed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Until you have a business need to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Delete all "Guest" users that are no longer required or are inactive.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;It is good practice to use a dynamic group to manage guest users. To create the dynamic group:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the Active Directory blade in the Azure Portal&lt;/li&gt;&lt;li&gt;Select the &lt;i&gt;Groups &lt;/i&gt;item&lt;/li&gt;&lt;li&gt;Create new&lt;/li&gt;&lt;li&gt;Type of &lt;i&gt;dynamic&lt;/i&gt;&lt;/li&gt;&lt;li&gt;Use the following dynamic selection rule. "(user.userType -eq "Guest")"&lt;/li&gt;&lt;li&gt;Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="1.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="PA-3" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Ensure that guest users listed are still required (USER TYPE = Guest)&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az ad user list --query "[?userType=='Guest']"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure all users listed are not inactive and still required.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using PowerShell&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Connect-AzureAD (Only needs to be performed once within the PowerShell session) Get-AzureADUser |Where-Object {$_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD9" name="Integrate supported SaaS applications from the gallery to Azure AD and enable SSO" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Integrate supported SaaS applications from the gallery to Azure AD and enable Single sign on (SSO)&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Azure AD has a gallery that contains thousands of pre-integrated applications. Some of the applications your organization uses are probably in the gallery accessible directly from the Azure portal. Provide access to corporate SaaS applications remotely and securely with improved user experience (SSO).&lt;/p&gt; 
-&lt;p&gt;After integrating supported SaaS applications, you can automatically create user identities and roles in the cloud (SaaS) applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change, increasing your organization's security.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
-&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
-&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
-&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
-&lt;p&gt;3. In the Enterprise applications pane, select New application.&lt;/p&gt; 
-&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
-&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
-&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
-&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on.&lt;/p&gt; 
-&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on.&lt;/p&gt; 
-&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
-&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
-&lt;p&gt;You have finished adding an application.&lt;/p&gt; 
-&lt;p&gt;How to set up automatic provisioning to an application&lt;/p&gt; 
-&lt;p&gt;For pre-integrated applications listed in the gallery, step-by-step guidance is available for setting up automatic provisioning. Please follow Reference URL for more details.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
-            <reference name="What is automated SaaS app user provisioning in Azure AD?" url="https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing supported SaaS applications integration&lt;/p&gt;
-
-  &lt;p&gt;Azure recommends using a non-production environment to test the steps in the description section.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD13" name="Secure legacy apps with Azure Active Directory" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure legacy apps with Azure Active Directory&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Publish and protect your on-premises and cloud legacy authentication applications by connecting them to Azure AD with your existing application delivery controller or network.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; You can protect your on-premises and cloud legacy authentication applications by connecting them to Azure Active Directory (AD) with:&lt;/p&gt; 
-&lt;p&gt;- Azure AD Application Proxy&lt;/p&gt; 
-&lt;p&gt;- Your existing application delivery controllers and networks&lt;/p&gt; 
-&lt;p&gt;- Virtual Private Network (VPN) and Software-Defined Perimeter (SDP) applications&lt;/p&gt; 
-&lt;p&gt;You can bridge the gap and strengthen your security posture across all applications with Azure AD capabilities like Azure AD Conditional Access and Azure AD Identity Protection.&lt;/p&gt; 
-&lt;p&gt;For more details please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure hybrid access: Secure legacy apps with Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/secure-hybrid-access"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your on-premises and cloud legacy authentication applications are secured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-AD15" name="Use Azure AD B2B to invite guest users" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure AD B2B to invite guest users&lt;/p&gt;
-
-  &lt;p&gt;Rationale:&lt;br /&gt;
-Azure Active Directory (Azure AD) business-to-business (B2B) collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with guest users from any other organization, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources. Developers can use Azure AD business-to-business APIs to customize the invitation process or write applications like self-service sign-up portals.&lt;/p&gt;
-
-  &lt;p&gt;Remediation:&lt;br /&gt;
-Invite guest users from the Azure AD portal&lt;/p&gt;
-
-  &lt;p&gt;As an administrator, you can add guest users to your organization in the Azure portal.&lt;/p&gt;
-
-  &lt;p&gt;- Create a new guest user in Azure AD, similar to how you'd add a new user.&lt;br /&gt;
-- Assign guest users to apps or groups.&lt;br /&gt;
-- Send an invitation email that contains a redemption link, or send a direct link to an app you want to share.&lt;br /&gt;
-- Guest users follow a few simple redemption steps to sign in.&lt;/p&gt;
-
-  &lt;p&gt;Impact:&lt;br /&gt;
-None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What is guest user access in Azure Active Directory B2B?" url="https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that Azure AD B2B is used to invite guest users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="50"/>
-                <countermeasure ref="AZ-A04" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD1" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD16" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD2" mitigation="12"/>
-                    <countermeasure ref="AZURE-AD4" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD6" mitigation="13"/>
-                    <countermeasure ref="AZURE-AD7" mitigation="13"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="12"/>
-                <countermeasure ref="AZURE-AD1" mitigation="12"/>
-                <countermeasure ref="AZURE-AD16" mitigation="13"/>
-                <countermeasure ref="AZURE-AD2" mitigation="12"/>
-                <countermeasure ref="AZURE-AD4" mitigation="13"/>
-                <countermeasure ref="AZURE-AD6" mitigation="13"/>
-                <countermeasure ref="AZURE-AD7" mitigation="13"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD3" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZURE-AD3" mitigation="20"/>
-                <countermeasure ref="AZURE-AD5" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-16">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD18" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD18" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
-                                ports or security network configurations.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="no-alerts-access">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-DATA-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD8" mitigation="50"/>
-                    <countermeasure ref="AZURE-AD9" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD8" mitigation="50"/>
-                <countermeasure ref="AZURE-AD9" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-L01" mitigation="20"/>
-                    <countermeasure ref="AZ-L05" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD10" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD11" mitigation="20"/>
-                    <countermeasure ref="AZURE-AD12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-L01" mitigation="20"/>
-                <countermeasure ref="AZ-L05" mitigation="20"/>
-                <countermeasure ref="AZURE-AD10" mitigation="20"/>
-                <countermeasure ref="AZURE-AD11" mitigation="20"/>
-                <countermeasure ref="AZURE-AD12" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-AD13" mitigation="34"/>
-                    <countermeasure ref="AZURE-AD14" mitigation="33"/>
-                    <countermeasure ref="AZURE-AD15" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-AD13" mitigation="34"/>
-                <countermeasure ref="AZURE-AD14" mitigation="33"/>
-                <countermeasure ref="AZURE-AD15" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="824ea612-060b-4baf-a326-47c8456bf04b" diagramComponentId="0193ed83-3192-408d-93d2-f20538095cf6" ref="5ca55fe8-d024-4416-b6b9-abd237a56b2e" name="Back-end server" desc="" library="" parentComponentRef="" componentDefinitionRef="back-end-server">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_SEGM"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CSMS-4.3.1-1.1+3.1" name="Abuse of privileges by staff (insider attack)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.1-2.1" name="Attack on back-end server stops it functioning" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; For example it prevents it from interacting with vehicles and providing services they rely on&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.1-3.5" name="Information breach" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; &lt;b&gt;Information breach &lt;/b&gt;by unintended sharing of data (e.g. admin errors)&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.1-3.2" name="Loss of information in the cloud" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; Sensitive data may be lost due to attacks or accidents when data is stored by third-party cloud service providers&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.1-1.2+3.3" name="Unauthorized internet access to the server" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Enabled for example by backdoors, unpatched system software vulnerabilities, SQL attacks or other means&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CSMS-4.3.1-1.3+3.4" name="Unauthorized physical access to the server" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt; Conducted by for example USB sticks or other media connecting to the server&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSMS-M4" name="Minimize risks associated with cloud computing" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Security Controls are applied to minimize risks associated with cloud computing. Example Security Controls can be found in OWASP and NCSC cloud computing guidance&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cloud Penetration Testing Playbook" url="https://cloudsecurityalliance.org/artifacts/cloud-penetration-testing-playbook/"/>
-            <reference name="NCSC Cloud Security Guidance" url="https://www.ncsc.gov.uk/collection/cloud-security/implementing-the-cloud-security-principles"/>
-            <reference name="OWASP T10 Cloud Security" url="https://owasp.org/www-pdf-archive/Cloud-Top10-Security-Risks.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M4" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.961">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M1" name="Minimize the risk of insider attack" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Security controls are applied to back-end systems to minimize the risk of insider attack&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Insiders: The Threat is Already Within" url="https://owasp.org/www-pdf-archive//OWASPIL-2016-06-14_Insiders-TheThreatisAlreadyWithin_SagieDulce-ShiriMargel.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M1" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M2" name="Minimize unauthorized access" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Security Controls are applied to back-end systems to minimize unauthorized access. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP T10: A5:2017-Broken Access Control" url="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="5.4.1" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="5.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="6.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="6.4.7" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M2" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M3" name="Prepare recovery measures in case of system outage" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Security Controls are applied to back-end systems. Where back-end servers are critical to the provision of services there are recovery measures in case of system outage. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Anti Ransomware Guide" url="https://owasp.org/www-pdf-archive/Anti-RansomwareGuidev1-7.pdf"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M3" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M5" name="Prevent data breaches" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Security Controls are applied to back-end systems to prevent data breaches. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP T10 Privacy Risks" url="https://owasp.org/www-pdf-archive/OWASP_Top_10_Privacy_Countermeasures_v1.0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M5" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSMS-M8" name="Prevent unauthorized access through system design" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt; Through system design and access control it should not be possible for unauthorized personnel to access personal or system critical data&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP T10: A5:2017-Broken Access Control" url="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
-            <standard ref="M8" supportedStandardRef="unece-wp29-csms"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
-          <threats>
-            <threat ref="CSMS-4.3.1-1" name="Back-end servers used as a means to attack a vehicle or extract data" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
-              <desc>This threat include: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Back-end servers as an attack vector&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CSMS-4.3.1-1.1+3.1">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CSMS-4.3.1-1.2+3.3">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CSMS-4.3.1-1.3+3.4">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M8" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSMS-M1" mitigation="34"/>
-                <countermeasure ref="CSMS-M2" mitigation="33"/>
-                <countermeasure ref="CSMS-M8" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSMS-4.3.1-2" name="Services from back-end server being disrupted affecting the operation of a vehicle" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
-              <desc>This threat include: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Disruption of services from back-end&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CSMS-4.3.1-2.1">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSMS-M3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSMS-4.3.1-3" name="Vehicle related data held on back-end servers being lost or compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
-              <desc>This threat include: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Loss of back-end servers's vehicle related data&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CSMS-4.3.1-3.2">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CSMS-4.3.1-3.5">
-                  <countermeasures>
-                    <countermeasure ref="CSMS-M5" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSMS-M4" mitigation="50"/>
-                <countermeasure ref="CSMS-M5" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3cdf7296-17cc-4113-a6a5-0db620b7cb71" diagramComponentId="120a9a07-bea1-4e2f-b8f3-5e42390e2dd9" ref="d85f98d6-9f53-455a-86f8-4d239429e392" name="OT" desc="" library="" parentComponentRef="" componentDefinitionRef="iot-application">
-      <tags/>
-      <questions>
-        <question ref="cloud-hosted-no" answer="true" manuallyModified="false"/>
-        <question ref="iot-web-ui-no" answer="true" manuallyModified="false"/>
-        <question ref="mqtt-client-no" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-592" name="Authentication Bypass Issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly perform authentication, allowing it to be bypassed through various methods.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-592: Authentication Bypass Issues" url="https://cwe.mitre.org/data/definitions/592.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
-                        proves that the claim is correct.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
-
-When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.715">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-209" name="Information Exposure Through an Error Message" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software generates an error message that includes sensitive information about its environment, users, or associated data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;This sensitive information may be valuable on its own (such as a password), or it may be useful for launching other deadlier attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-209: Information Exposure Through an Error Message" url="https://cwe.mitre.org/data/definitions/209.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="NO-PASSWORD-CHANGE" name="Lack of password change facility" state="0" impact="100" issueId="" issueLink="">
-          <desc>When the application does not offer a password change facility, a compromise of the current user password will lead to an attacker having persistent access to the account.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
-          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
-
-An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNPATCHED-PRODUCT" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
-          <desc>When patches and updates are not applied in a timely manner then a product (e.g. Operating System, Software or Mobile App) or a system could be vulnerable to known security issues. These issues could be leveraged by an attacker to gain access to the system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
-          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-307" name="The application does not implement anti-automation mechanisms to prevent automated long-time sustained probes" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
-
-This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, to compromise program logic (such as limiting humans to a single vote), or for other purposes. For example, an authentication routine might not limit the number of times an attacker can guess a password, or a website might conduct a poll but only expect humans to vote a maximum of once a day.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
-          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
-
-If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.159">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-254-PROD" name="The product lacks key security features" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.497">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-400" name="Uncontrolled Resource Consumption ('Resource Exhaustion')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly restrict the size or amount of resources that are requested or
-                        influenced by an actor, which can be used to consume more resources than intended.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')" url="https://cwe.mitre.org/data/definitions/400.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="IOT2.4.13.3" name="All product related web servers have their web server HTTP trace and trace methods disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  All product related web servers have their webserver HTTP trace and trace methods disabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP trace method is normally used to return the full HTTP request back to the requesting client for proxy-debugging purposes. However, servers supporting the HTTP trace method are subject to cross-site scripting (XSS) attacks when used in conjunction with various weaknesses in browsers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Disable web servers' HTTP trace and trace methods. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, regarding an Apache2.0 server: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Modify the security.conf file located under /etc/apache2/conf.d/security and set the Track option to Off. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can use curl to verify if HTTP TRACE was disabled in the server: 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;curl -v -X TRACE http://www.yourserver.com 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.889">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test HTTP Methods" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.14.1" name="All the production test and calibration software is erased, removed or secured before the product is dispatched from the factory" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All the production test and calibration software used during manufacture is erased, removed or secured before the product is dispatched from the factory.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The product should have all of the production test and calibration software used during manufacture erased, removed or secured before the product is dispatched from the factory. This is to prevent alteration of the product post manufacture when using authorized production software, for example, hacking of the RF characteristics for greater RF &lt;span class="caps"&gt;ERP&lt;/span&gt;. Where such functionality is required in a service center, it should be erased or removed upon completion of any servicing activities.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Erase, remove or secure all the production test and calibration software used during manufacture, before the product is dispatched from the factory.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.18" name="All the related servers and network elements prevent anonymous/guest access except for read only access to public information" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  All the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Read only access must be granted only for public information, so servers and network elements have to prevent all anonymous/guest access in order to prevent a potential theft or disclosure of sensitive information. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that all the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>When you have identified an application interface, for example a Cisco router web interface or a WebLogic administrator portal, check that the known usernames and passwords for these devices do not result in successful authentication. To do this you can consult the manufacturer's documentation or, even simpler, you can find common credentials using a search engine or one of the sites or tools listed in the Reference section.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.890">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for Default Credentials" url="https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/02-Testing_for_Default_Credentials"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.16" name="All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Passwords must be securely stored using only strong and approved cryptographic algorithms. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the product securely stores any passwords using an industry standard cryptographic algorithm. For example, see FIPS 140 or OWASP Password Storage Cheat Sheet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="FIPS PUB 140-2, Security Requirements for Cryptographic Modules, May 2001" url="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf"/>
-            <reference name="OWASP - Password Storage Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.890">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.17" name="All the related servers and network elements support access control measures" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  All the related servers and network elements support access control measures to restrict access to sensitive information or system processes to privileged accounts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sensitive information or system processes must be protected by means of access control measures implemented on servers and network elements. It is very important that users, devices, and systems be verified, authenticated and authorized before access to such critical data is granted, in order to prevent a potential theft or disclosure of sensitive information or system processes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that all the related servers and network elements support access control measures. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NCSC CAF guidance - B.2 Identity and access control" url="https://www.ncsc.gov.uk/collection/caf/caf-principles-and-guidance/b-2-identity-and-access-control"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Testing for role/privilege manipulation&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In every portion of the application where a user can create information in the database (e.g., making a payment, adding a contact, or sending a message), receive information (account statement, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record this functionality. The tester should try to access such functions as a different user in order to check if it is possible to access a function that should not be permitted for the user's role/privilege (but might be permitted as another user).&amp;nbsp; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://wiki.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.2" name="Any product related web servers have their webserver identification options switched off" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Any product related web servers have their webserver identification options (e.g. Apache or Linux) switched off. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When a web server is showing the world its type and possibly its version number, it allows attackers to launch targeted attacks against this specific web server and version. In addition, if the version of the web server is known to be vulnerable to a specific exploit, an attacker would just need to use the exploit as part of their attack. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Switch off the webserver identification options.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, to limit the information provided by an Apache server, modify the /etc/httpd/conf/httpd.conf file and change the following two lines: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ServerSignature Off 
-&lt;/div&gt; 
-&lt;div&gt;
-  ServerTokens Prod 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Save the file, exit, and restart your Apache web server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check what information the web sever is currently revealing. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, for an Apache server run: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  curl --head localhost 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you receive a response with a line similar to: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Server: Apache/2.2.15 (CentOS) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Then the web server is revealing too much information and should be reconfigured so that the output is: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Server: Apache 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="Fingerprint Web Server" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.5" name="Any product's port(s) that are not required for normal operation should be restricted or disabled" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If the product has any virtual port(s) that are not required for normal operation, they are only allowed to communicate with authorized and authenticated entities or are securely disabled when shipped.&lt;/p&gt; 
-&lt;p&gt; Where a port is used for field diagnostics, the port input commands are deactivated and the output provides no information which could compromise the device, such as credentials, memory addresses or function names. &lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have 80 or 443 open, or otherwise users will not be able to connect to use the web server. Thus, taking into account that every open port increases the attack surface, any product's port(s) that are not required for normal operation should be restricted or disabled.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Restrict or disable any port(s) that are not required for normal operation.&lt;/p&gt; 
-&lt;p&gt; Deactivate port input for port(s) that are used for field diagnostics and ensure their output provides no information which could compromise the device.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2014-I3 Insecure Network Services" url="https://www.owasp.org/index.php/Top_10_2014-I3_Insecure_Network_Services"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.5" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Checking for Insecure Network Services includes:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Determining if insecure network services exist by reviewing your device for open ports using a port scanner.&lt;/li&gt; 
- &lt;li&gt;As open ports are identified, each can be tested using any number of automated tools that look for DoS vulnerabilities, vulnerabilities related to &lt;span class="caps"&gt;UDP&lt;/span&gt; services and vulnerabilities related to buffer overflow and fuzzing attacks.&lt;/li&gt; 
- &lt;li&gt;Reviewing network ports to ensure they are absolutely necessary and if there are any ports being exposed to the internet using UPnP.&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.3-5.4" name="Implement Certificate pinning" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Certificate pinning is the process of associating the backend server with a particular X509 certificate or public key, instead of accepting any certificate signed by a trusted certificate authority. A mobile app that stores ("pins") the server certificate or public key will subsequently only establish connections to the known server. Verify that the server certificate is pinned. Pinning can be implemented in multiple ways:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Including server's certificate in the application bundle and performing verification on each connection. This requires an update mechanism whenever the certificate on the server is updated Limiting certificate issuer to e.g. one entity and bundling the intermediate CA's public key into the application. In this way we limit the attack surface and have a valid certificate.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Owning and managing your own PKI. The application would contain the intermediate CA's public key. This avoids updating the application every time you change the certificate on the server, due to e.g. expiration.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Note that using your own CA would cause the certificate to be self-singed. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Custom Certificate Stores and SSL Pinning" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4"/>
-            <reference name="OWASP MASVS - iOS - Testing Custom Certificate Stores and SSL Pinning" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-3-and-mstg-network-4"/>
-          </references>
-          <standards>
-            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Certificate pinning is implemented correctly.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.22" name="Input data validation should be maintained in accordance with industry practiced methods" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Input data validation should be maintained in accordance with industry practiced methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The failure to properly validate inputs is one of the most common software security weaknesses, specifically for web applications. This weakness leads to almost all of the major vulnerabilities in applications, such as cross site scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system attacks and buffer overflows. Input data should never be trusted, and therefore software should ensure that input data is strongly typed, has correct syntax, and that it is within length boundaries and contains only permitted characters or that numbers are correctly signed and within range boundaries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that input data validation is maintained in accordance with industry practiced methods as per NIST Special Publication 800-53 SI-10 (please see reference URL). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST - SI-10 INFORMATION INPUT VALIDATION" url="https://nvd.nist.gov/800-53/Rev4/control/SI-10"/>
-            <reference name="OWASP Proactive Controls - C5 - Validate all inputs" url="https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that all areas that accept user data properly handle unexpected data such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;special characters (examples: &amp;lt; &amp;gt; $ % &amp;amp;)&lt;/li&gt; 
-  &lt;li&gt;values other than the default items (e.g. letters if the URL argument is normally a number)&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Testing Scope&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; Input Form Fields 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; Hidden Variables 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; URL Parameters 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Desired System Behavior&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Whenever unexpected data is received by the application, the application will gracefully handle the situation and not return a stack trace or display detailed system information to the user. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Invalid form data should result in a message shown to the user explaining how to complete the form correctly. Unexpected data in hidden fields or the URL should result in more generic messages such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;i&gt;&amp;nbsp;The requested operation could not be performed.&lt;/i&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Input Validation testing" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/"/>
-              <reference name="WebAppSec/Secure Coding QA Checklist" url="https://wiki.mozilla.org/WebAppSec/Secure_Coding_QA_Checklist"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.33" name="Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed. These can include, but are not limited to, locations on the heap, the stack, and statically-allocated storage.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="ISO/IEC TR 24772:2013" url="https://www.iso.org/standard/61457.html"/>
-            <reference name="MEM03-C. Clear sensitive information stored in reusable resources" url="https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.33" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
- &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
- &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
- &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
-  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;b&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
- &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
- &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
- &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
- &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
- &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
- &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
- &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt; 
- &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
- &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
-&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
-&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
-&lt;ul&gt; 
- &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
- &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
- &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
- &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
- &lt;li&gt;at least 10 characters&lt;/li&gt; 
- &lt;li&gt;at most 128 characters&lt;/li&gt; 
-&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.2" name="Software images are digitally signed by the organization's approved signing authority. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where remote software upgrade can be supported by the device, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. A Certificate authority (CA) acts as a trusted third party, trusted both by the software author and by the device to verify the entity's identity.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, for remote software upgrades, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Protecting Software Integrity through code signing" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925977"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.4" name="Software images should be encrypted whilst being transferred to a device. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If remote software upgrades are supported by a device, software images should be encrypted whilst being transferred to it.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Data transmitted over a public network can be intercepted by unauthorized parties. A secure file transfer adds security features to the transmission by encrypting the file to preserve its confidentiality and integrity. This prevents eavesdroppers on the networks between the systems from accessing the file contents and reading or modifying them, necessitating the use of encryption for software images that are used for remote software upgrades.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Utilize encrypted protocols wherever possible to protect all data in transit. Where protocol encryption is not possible, consider encrypting data before the transfer.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Guide for Interconnecting Information Technology Systems" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.4" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.21" name="Software uses certificate pinning or public/private key equivalent for TCP/IP or UDP/IP connections" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where the device software communicates with a product related webserver or application over &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP, the device software uses certificate pinning or public/private key equivalent, where appropriate.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Secure connections are a cornerstone for client/server communication. Users, developers, and applications expect end-to-end security for their secure channels, but some secure channels are not meeting this expectation. Specifically, channels built using well known protocols can be vulnerable to a number of attacks. For example, traditional certificate validation protects against many types of man-in-the-middle (&lt;span class="caps"&gt;MITM&lt;/span&gt;) attacks, but it doesn't prevent all of them.&lt;/p&gt; 
-&lt;p&gt;Certificate pinning can still prevent the interception of a program's network traffic. Pinning is the process of associating a host with their expected X509 certificate or public key, which can be added to an application during development, or it can be added upon first encountering the certificate or public key.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the device software uses certificate pinning or a public/private key equivalent for &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP connections.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate and Public Key Pinning" url="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What_Is_Pinning"/>
-            <reference name="Pinning Cheat Sheet" url="https://www.owasp.org/index.php/Pinning_Cheat_Sheet"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.21" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
- &lt;/ul&gt;&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
-   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/span&gt; 
-&lt;span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.26" name="Support for partially downloading updates is provided" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Support for partially downloading updates is provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions to a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially downloading updates may be provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially downloading updates.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
-            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.25" name="Support for partially installing updates is provided" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Support for partially installing updates is provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions into a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially installing updates may be provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially installing updates.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
-            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.15" name="The maximum permissible number of failed login attempts follows the recommendations of 3GPP TS33.117" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If web services allow users to enter passwords as many times as they want, an attacker may try to exploit this by using scripts that enter different combinations until the password cracks. To prevent this, the number of failed login attempts per user should be limited, for example, to 5 failed attempts, locking the user out as a result. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.13.15" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Refer to the following test case in the 3GPP TS 33.117 document:&amp;nbsp;&amp;nbsp; 
-&lt;div&gt;
-  Test Name: TC_FAILED_LOGIN_ATTEMPTS&amp;nbsp; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.16" name="The product allows an authorized factory reset of the device's authorization information" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The product allows an authorized factory reset of the device's authorization information.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The devices are often authorized to an account, based on license agreements with service providers. The device should have the option to be deauthorized and reset in case the user no longer wants to use it or if the user wants to authorize the device to another account.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows an authorized factory reset of the device's authorization information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.845">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.12" name="The product allows the factory issued or OEM login accounts to be disabled, erased or renamed" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts should be disabled, erased or renamed. This is to avoid the type of attacks where factory default logins and passwords are published on the web, which allows attackers to mount very simple scanning and dictionary attacks on devices.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed when installed or commissioned.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.8" name="The product has protection against software reverting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The product has protection against reverting the software to an earlier and potentially less secure version.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both Operating System and individual software programs. Updates can apply a wide range of revisions into a system such as adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, the product should have protection to prevent software reverting to an earlier, out-of-date and probably insecure version.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product has mechanisms against software reverting.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
-            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.11" name="The product only allows controlled user account access" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The product only allows controlled user account access. Access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Product should not allow any unjustified anonymous or guest access in order to prevent potential theft or disclosure of sensitive information, therefore only controlled user account access should be permitted.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product only allows controlled user account access and access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;The best way to find out if an application has failed to properly restrict function level access is to verify every application function:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt;Does the UI show navigation to unauthorized functions?&lt;/li&gt; 
- &lt;li&gt;Are server side authentication or authorization checks missing?&lt;/li&gt; 
- &lt;li&gt;Are server side checks done that solely rely on information provided by the attacker?&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Using a proxy, browse your application with a privileged role. Then revisit restricted pages using a less privileged role. If the server responses are alike, you're probably vulnerable. Some testing proxies directly support this type of analysis.&lt;/p&gt; 
-&lt;p&gt;You can also check the access control implementation in the code. Try following a single privileged request through the code and verifying the authorization pattern. Then search the codebase to find where that pattern is not being followed.&lt;/p&gt; 
-&lt;p&gt; Automated tools are unlikely to find these problems.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.7" name="The product related web servers have repeated renegotiation of TLS connections disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The product related web servers have repeated renegotiation of TLS connections disabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Generally, a TLS renegotiation is a process that allows changing the details of a handshake after a connection is made with the server and it occurs when the session expires on either side and data continues to be sent. This means either that the session has simply expired due to timeout, or that a peer wants to change the cipher suite or wants to request a peer certificate and hasn't done so yet.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the case of web services, the server encrypts traffic using TLS, but allows a client to renegotiate the connection after the initial handshake. If the server does not&amp;nbsp; limit the number of renegotiations for a single TLS connection, then a client may open several simultaneous connections and repeatedly renegotiate them, which may exhaust the server's resources and lead to a Denial of Service (DoS) condition. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that web servers have repeated renegotiation of TLS connections disabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tips for Securing SSL Renegotiation" url="https://www.mcafee.com/blogs/enterprise/tips-securing-ssl-renegotiation/"/>
-            <reference name="Transport Layer Security (TLS) Renegotiation Indication Extension" url="https://tools.ietf.org/html/rfc5746"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The following example demonstrates how to check if client-initiated renegotiation is supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  openssl s_client -connect example.com:443 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Once the connection is established, the server will wait for us to type the next command. We can write the following two lines in order to initiate a renegotiation by specifying R in the second line, followed by enter or return. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  openssl s_client -connect host:port 
-&lt;/div&gt; 
-&lt;div&gt;
-  HEAD / HTTP/1.0 
-&lt;/div&gt; 
-&lt;div&gt;
-  R 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;lt;Enter or Return key&amp;gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A system that does not support client-initiated renegotiation will return an error and end the connection or the connection will time out. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  RENEGOTIATING 
-&lt;/div&gt; 
-&lt;div&gt;
-  write:errno=104 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A system that supports client-initiated renegotiation will keep the connection active and respond to further commands.&amp;nbsp; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="Manually Testing SSL/TLS Weaknesses" url="https://www.contextis.com/us/blog/manually-testing-ssl-tls-weaknesses"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.6" name="The product/system enforces passwords to be compliant with 3GPP TS33.117 or similar recommendations" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Password entry follows industry standard practice such recommendations of the 3GPP TS33.117 Password policy. [ref. 1] or &lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3] on password length, characters from the groupings and special characters.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A key concern when using passwords for authentication is password strength. A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means. The main characteristics that define a strong password are length, complexity and topology (the pattern that a password is written).&lt;/p&gt; 
-&lt;p&gt;Passwords should not be vulnerable to dictionary attack, which is a type of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. &lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product/system enforces passwords to be compliant with 3GPP TS33.117 or similar (&lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3]) recommendations to include: At least eight characters in length, characters from the groupings: alpha, numeric and special characters and should not be vulnerable to dictionary attack.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Catalogue of general security assurance requirements" url="https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2928"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="Password strategies that can help your organisation remain secure" url="https://www.ncsc.gov.uk/guidance/password-collection"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Please see reference [3] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.5" name="The product will not allow new passwords containing the user account name with which the user account is associated" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The product will not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Weak passwords are a serious threat to computer security, and specifically the guessable ones should be forbidden through organizational policy and suitable technical measures. Using the user account name as password or part of a password is completely insecure and makes a brute-force attack against the login interface much easier.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product does not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Implement Proper Password Strength Controls" url="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"/>
-            <reference name="Testing for Default or Guessable User Account (OWASP-AT-003)" url="https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Please see reference [2] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.8" name="The related servers have unused IP ports disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The related servers have unused IP ports disabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have ports 80 or 443 open, or otherwise users will not be able to connect to use the web server. However, taking into account that every open port increases the attack surface, any related servers' port(s) that are not used should be disabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Disable the servers' unused IP ports.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST - CM-7 LEAST FUNCTIONALITY" url="https://nvd.nist.gov/800-53/Rev4/control/CM-7"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  For example, the following command will look up, with a TCP connect scan, all open ports on IP 192.168.1.100 and will try to determine what services are bound to them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  nmap -PN -sT -sV -p0-65535 192.168.1.100 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Enumerate Applications on Webserver" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.24" name="The software has been designed to fail safely" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The software has been designed to meet the safety requirements identified in the risk assessment, i.e. in the case of unexpected invalid inputs, or erroneous software operations, the product does not become dangerous or compromise the security of other connected systems.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software is expected to fail, but when it does it has to be in a safe way and security controls and settings must remain in effect. The confidentiality and integrity of a system should remain intact even if availability has been lost. Attackers must not be permitted to gain access rights to privileged objects during a failure when those objects are normally inaccessible. Upon failing, a system that reveals sensitive information about the failure to potential attackers could supply additional knowledge to launch an attack.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software has been designed to fail safely. This typically involves several things:&lt;br /&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Secure defaults (default is to deny access).&lt;/li&gt; 
- &lt;li&gt;Upon failure, undo changes and restore a secure state.&lt;/li&gt; 
- &lt;li&gt;Always check return values for failure.&lt;/li&gt; 
- &lt;li&gt;In conditional code/filters make sure that there is a default case that does the right thing.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="US-CERT: Failing Securely" url="https://www.us-cert.gov/bsi/articles/knowledge/principles/failing-securely"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.24" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.4" name="Web servers' TLS certificate(s) are signed by trusted CAs, are within their validity period and processes are in place for their renewal" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  All the product related web servers' TLS certificate(s) are signed by trusted Certificate Authorities, are within their validity period and processes are in place for their renewal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The server validation component of TLS provides authentication between the server and the client via digital certificates. These certificates commonly include: 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Issuer: The entity that verified the information and issued the certificate (Certificate Authority). 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Valid to: The expiration date after which the certificate is no longer valid. 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Signature algorithm: The algorithm used to create the signature (keys) and prove its integrity. 
-&lt;/div&gt; 
-&lt;div&gt;
-  As mentioned above, the Certificate Authority (CA) is an entity that issues digital certificates and acts as a trusted third party, trusted both by the client and by the server, and which verifies the server's identity. Therefore, all web server certificates must be signed by a trusted Certificate Authority. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Expired or untrusted certificates that users usually ignore are an issue, as they are taken advantage of by attackers to expose users to DNS spoofing or Man-in-the-middle attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the web servers' TLS certificates are signed by trusted certificate authorities, their validity period has not elapsed, and that processes are in place for their renewal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Transport Layer Protection Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using OpenSSL, we can gather the server and intermediate certificates sent by a server using the following command: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  openssl s_client -showcerts -connect example.com:443 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="TLS/SSL Certificate Validity – Client and Server" url="https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_Transport_Layer_Security.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.30" name="When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; To implement certain control capabilities into a system, you'll want to remotely reset the device so as to achieve a known-good state and recover from errors and implement new configuration changes. You may also want to be able to reset the device to a factory default configuration, which is useful when you want to decommission a device or as a more invasive way to recover from unknown error conditions.&lt;/p&gt; 
-&lt;p&gt;Lastly, issuing a command to update or reload firmware is very important in order maintain security of the remote device, implement feature enhancements, and patch bugs.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; When a device cannot verify authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Code of Practice for Consumer IoT Security" url="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/971440/Code_of_Practice_for_Consumer_IoT_Security_October_2018_V2.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.5.29" name="Where a device cannot verify the authenticity of updates itself, only local updates are permitted" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where a device cannot verify the authenticity of updates itself (e.g. due to a lack of cryptographic capabilities), only local update by a physically present user is permitted.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. This process is used for remote updates too, where devices can verify the signature to confirm that the package is authentic and complete. For this reason, if a device cannot verify the authenticity of updates itself, only local updates should be permitted.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; If the device cannot verify the authenticity of updates, permit local updates only.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Top 10 2014-I9 Insecure Software/Firmware" url="https://www.owasp.org/index.php/Top_10_2014-I9_Insecure_Software/Firmware"/>
-          </references>
-          <standards>
-            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.20" name="Where a Product or Service includes a critical functionality, the service's infrastructure shall incorporate protection against DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Where a Product or Service includes any safety-critical or life-impacting functionality, the service's infrastructure shall incorporate protection against Distributed Denial of Service (DDoS) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Denial of Service (DoS) attack focuses on making a resource (site, application, server, etc.) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may stop being available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles the resources it uses. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Distributed Denial of Service (DDoS) attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. The exploited machines can include computers and other networked resources such as IoT devices.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the services' infrastructure incorporates protection against Distributed Denial of Service (DDoS) attacks, such as dropping of traffic or sink-holing (please see NIST 800-53 SC-5, reference URL [1]). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST - SC-5 DENIAL OF SERVICE PROTECTION" url="https://nvd.nist.gov/800-53/Rev4/control/SC-5"/>
-            <reference name="OWASP - Denial of Service" url="https://owasp.org/www-community/attacks/Denial_of_Service"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.20" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for Denial of Service" url="https://wiki.owasp.org/index.php/Testing_for_Denial_of_Service"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.21" name="Where a Product or Service includes critical functionality, the services' infrastructure shall incorporate redundancy to ensure service continuity and availability" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Where a Product or Service includes any safety-critical or life-impacting functionality, the services' infrastructure must incorporate redundancy to ensure service continuity and availability. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Since Web Services are susceptible to Denial of Service (DoS) attacks, it is important to replicate data and applications in a robust manner. Replication and redundancy can ensure access to critical data in the event of a failure. It will also enable the system to react in a coordinated way to deal with disruptions. Therefore, Web Services must be designed to include redundancy of critical functions, ensuring diversity among those critical functions implemented.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that, where a Product or Service includes a safety-critical or life-impacting functionality, the services' infrastructure incorporates redundancy to ensure service continuity and availability. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST - Guide to Secure Web Services" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-95.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.13.9" name="Where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Where a product related to a webserver encrypts communications using TLS and requests a client certificate, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In a traditional TLS handshake, the client authenticates the server, and the server doesn't know too much about the client. TLS Client Authentication is useful in cases where a server is keeping track of its numerous clients, as in IoT with millions of installs exchanging secure information. For example, an IoT company can issue a unique client certificate per device, and then limit the connections to their IoT infrastructure to only their devices by blocking connections where the client doesn't present a certificate signed by the company's Certificate Authority (CA). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that, where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Client Authentication During SSL Handshake" url="https://docs.oracle.com/cd/E19424-01/820-4811/aakhe/index.html"/>
-            <reference name="OWASP - TLS Client Authentication" url="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that only users whose certificates are signed by the trusted certificate authority can successfully authenticate with the server using client certificates.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.892">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.3" name="Where a UI password is used for login authentication, the factory issued or reset password is unique to each device in the product family" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where a user interface password is used for login authentication, the factory issued or reset password is unique to each device in the product family.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial user interface password or factory reset password is unique to each device in the product family. If a password-less authentication is used the same principles of uniqueness apply.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.15" name="Where passwords are entered on a UI, the actual pass phrase is obscured by default" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily the protection against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stolen, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.2" name="Where the product has a secure source of time there is a method of validating its integrity" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Where the product has a secure source of time there is a method of validating its integrity.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network Time Protocol (&lt;span class="caps"&gt;NTP&lt;/span&gt;) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, &lt;span class="caps"&gt;NTP&lt;/span&gt; is one of the oldest Internet protocols in current use. &lt;span class="caps"&gt;NTP&lt;/span&gt;sec is a fork implementation of &lt;span class="caps"&gt;NTP&lt;/span&gt; that has been systematically security-hardened.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the product has a secure source of time there is a method of validating its integrity such as &lt;span class="caps"&gt;NTP&lt;/span&gt;sec (please see reference &lt;span class="caps"&gt;URL&lt;/span&gt; [1]).&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NTPsec project - a secure, hardened, and improved implementation of Network Time Protocol derived from NTP" url="https://www.ntpsec.org/"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IOT2.4.8.17" name="Where the product  has the ability to remotely recover from an attack, it should rely on a known good state, to enable safe recovery and updating of the device" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;The ability to remotely recover from these situations should rely on a known good state, such as locally storing a known good version to enable safe recovery and updating of the device. This will avoid denial of service and costly recalls or maintenance visits, whilst managing the risk of potential takeover of the device by an attacker subverting update or other network communications mechanisms.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Ensuring Software Integrity in IoT Devices" url="https://www.omicsonline.org/open-access/ensuring-software-integrity-in-iot-devices-2165-7866-1000217.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-control" name="Access control" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="CAPEC-37" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-592">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-112" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-255">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-307">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
-                    <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
-                    <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="NO-PASSWORD-CHANGE">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
-                <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
-                <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
-                <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
-                <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
-                <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="network-rate-limit" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="network-rate-limit" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-732">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
-                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
-                <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
-                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-112-USERNAME" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>Attackers could perform a brute force attack against the login function by choosing a
-                                simple password that users are likely to use for the site, and that meets the site's
-                                password policy.
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
-                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
-                                through pure brute force means. &amp;nbsp;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                This type of attack cannot be defended against using an account lockout policy because
-                                each username is only attempted once.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-256" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>A compromise of the storage system medium itself (device, server or database) could
-                                allow attackers full access to the data
-                                stored, including authentication credentials such as passwords.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-257">
-                  <countermeasures>
-                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="device-operation" name="Device operation" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="IOT-INSUF-SEC" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-209">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-254-PROD">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNPATCHED-PRODUCT">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
-                    <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
-                    <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
-                    <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
-                <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
-                <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
-                <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
-                <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
-                <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
-                <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="OWASP A6:2017" name="Attackers attempt to exploit unpatched flaws to gain unauthorized access or knowledge of the system" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
-                    <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
-                    <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
-                <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
-                <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-400">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IOT-INSUF-SEC" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-254-PROD">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
-                    <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
-                    <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
-                    <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
-                <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
-                <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
-                <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IOT-WIDE-ATTACK-SURFACE" name="Attackers try to take advantage of a wide attack surface" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-215">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IOT-WIDE-ATTACK-SURFACE-OPEN-PORTS" name="Attackers try to retrieve banner information through the open ports to discover potential vulnerabilities" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;Every point of network interaction or another service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="UNRESTRICTED-NETWORK">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
-                    <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
-                <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-94" name="Man in the Middle Attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>	&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.4" mitigation="50"/>
-                    <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
-                    <countermeasure ref="MASVS-5.3-5.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.4" mitigation="50"/>
-                <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
-                <countermeasure ref="MASVS-5.3-5.4" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="read-or-post-data" name="Read or Post data" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="CAPEC-137" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&amp;amp;). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&amp;amp;new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="update-process" name="Update Process" desc="" library="iot-security-compliance-framework">
-          <threats>
-            <threat ref="CAPEC-122-UPDATE-PROCESS" name="An adversary is able to exploit the update process of the device to escalate its privileges" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-654">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
-                <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
-              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="18099e0a-f9ae-4008-a7f6-23db907920c4" diagramComponentId="07f79851-e44e-4069-b4b4-df6893e9790e" ref="6ad37665-cc66-48ea-a5e5-6ed8dd861ac2" name="SaaS (Sales Force, Ariba, Intelex, etc)" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-web-apps">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are typically introduced during the
-                        configuration of the software.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.640">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.640">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            More information: Doc MS Azure
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.639">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.146">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WEBAPPS1" name="Configure App Service settings for each app" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure PostgreSQL databases.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure App Service Authentication is set on Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app is using the latest version of TLS encryption&lt;/li&gt;&lt;li&gt;Ensure the web app has 'Client Certificates (Incoming client certificates)&lt;/li&gt;&lt;li&gt;Ensure that Register with Azure Active Directory is enabled on App Service&lt;/li&gt;&lt;li&gt;Ensure that 'PHP version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Python version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Java version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'HTTP Version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure FTP deployments are disabled&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to Azure Portal using https://portal.azure.com&lt;/li&gt;&lt;li&gt;Go to App Services&lt;/li&gt;&lt;li&gt;Click on each App&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Authentication / Authorization&lt;ol&gt;&lt;li&gt;Set App Service Authentication to On&lt;/li&gt;&lt;li&gt;Choose other parameters as per your requirement and Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on SSL settings&lt;ol&gt;&lt;li&gt;Set HTTPS Only to On under Protocol Settings section&lt;/li&gt;&lt;li&gt;Set Minimum TLS Version to 1.2 under Protocol Settings section&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Configuration&lt;ol&gt;&lt;li&gt;Set the option Client certificate mode located under Incoming client certificates is set to Require&lt;/li&gt;&lt;li&gt;Set PHP version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Set HTTP version to 2.0 under General settings&lt;/li&gt;&lt;li&gt;Under Platform Settings, FTP state should be Disabled or FTPS Only&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Identity&lt;ol&gt;&lt;li&gt;Set Status to On&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Application settings&lt;ol&gt;&lt;li&gt;Set Python version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Under General settings, Set Java version to latest version available&lt;/li&gt;&lt;li&gt;Set Java minor version to latest version available&lt;/li&gt;&lt;li&gt;Set Java web container to the latest version of web container available&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Alternatively, some of these can be done with Azure CLI.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To set App Service Authentication for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp auth update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --enabled true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTPS-only traffic value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set httpsOnly=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set TLS Version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --min-tls-version 1.2&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Incoming client certificates value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set clientCertEnabled=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Register with Azure Active Directory feature for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp identity assign --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep php&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest PHP version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --php-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep python&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Python version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --python-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep java&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Java version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --java-version '1.8' --java-container 'Tomcat' --java-container-version '&amp;lt;VERSION&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTP 2.0 version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --http20-enabled true&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.10" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.10" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DP-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="IM-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="NS-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PV-3" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PV-7" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Configure the password expiration to force after a determinate time, the password code shall be
-                        changed for the users.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
-                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
-                        PowerShell. With the following command as the example:&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
-                        days. The users receive notification 14 days prior to that expiry.
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        More information:&amp;nbsp;
-                        &lt;a
-                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                        MS Azure&lt;/a&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;More information:
-                            &lt;a
-                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                            MS Azure&lt;/a&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Custom rules that you create 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a policy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
-&lt;/div&gt; 
-&lt;div&gt;
-  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Association tab, enter one of the following settings, then select Add: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select Review + create, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
-            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test the application gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Find the public IP address for the application gateway on its Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Copy the public IP address, and then paste it into the address bar of your browser. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Disable anonymous access 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow only authenticated requests 
-&lt;/div&gt; 
-&lt;div&gt;
-  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.303">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable WAF logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable logging through the Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. In the Azure portal, find your resource and select Diagnostic settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Application Gateway, three logs are available: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Access log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Performance log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Firewall log 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. To start collecting data, select Turn on diagnostics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Type a name for the settings, confirm the settings, and select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that all WAF logs are enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
-  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
-                            are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt;
-   Use encryption to protect traffic on external and public networks as it is critical for data protection 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Rationale: 
- &lt;/div&gt; 
- &lt;div&gt;
-   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Remediation: 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Use a valid TLS/SSL certificate for custom domains. 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Redirect HTTP to HTTPs 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enforce FTPS 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enable client certificates 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Impact: 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
-            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
-            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test HTTPS 
-&lt;/div&gt; 
-&lt;div&gt;
-  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
-              <output/>
-            </source>
-            <references>
-              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Secure application secrets 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
-  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
-  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
-  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
-  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
-  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
-   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0 is are blocked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="50"/>
-                <countermeasure ref="AZ-A04" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZ-A12" mitigation="20"/>
-                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-16">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
-                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
-                    <countermeasure ref="AZ-L01" mitigation="16"/>
-                    <countermeasure ref="AZ-L02" mitigation="16"/>
-                    <countermeasure ref="AZ-L04" mitigation="16"/>
-                    <countermeasure ref="AZ-L05" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
-                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
-                <countermeasure ref="AZ-L01" mitigation="16"/>
-                <countermeasure ref="AZ-L02" mitigation="16"/>
-                <countermeasure ref="AZ-L04" mitigation="16"/>
-                <countermeasure ref="AZ-L05" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N01" mitigation="25"/>
-                    <countermeasure ref="AZ-N02" mitigation="25"/>
-                    <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N01" mitigation="25"/>
-                <countermeasure ref="AZ-N02" mitigation="25"/>
-                <countermeasure ref="AZ-N09" mitigation="25"/>
-                <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="cea69cc8-f974-4239-aa9a-22e739f60d57" diagramComponentId="90f2903c-942f-4556-905a-391a328a2373" ref="fc0d51fe-a373-4d18-a293-8a2b873e9ef9" name="Secure Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.754">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.203">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.755">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.755">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.757">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.384">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.385">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.385">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.044">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7a416f1a-0eb6-42a0-88f4-a920d277b4c6" diagramComponentId="776387b8-7184-414e-8183-3d6d6bc19ff0" ref="ec1fcae8-4837-4946-a97e-8986b55870b2" name="HEC" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-web-apps">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are typically introduced during the
-                        configuration of the software.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
-                            account.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
-                            console without MFA.&lt;/li&gt;
-                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Key security settings such as resetting the password and other password controls are not
-                        configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
-                            filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password expiration is not configured and users are not obliged to change their passwords.
-                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            More information: Doc MS Azure
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.710">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
-                        avoid this, access to the network must be as restricted as possible, so that only the necessary
-                        ports are open and the minimum inbound traffic is accepted.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &amp;nbsp;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
-                        make changes for everyone in a group in just one place. As people move around in your company,
-                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
-                        Based Access Control (RBAC).&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
-                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
-                        &lt;li&gt;Search and add the user.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WEBAPPS1" name="Configure App Service settings for each app" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure PostgreSQL databases.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure App Service Authentication is set on Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app is using the latest version of TLS encryption&lt;/li&gt;&lt;li&gt;Ensure the web app has 'Client Certificates (Incoming client certificates)&lt;/li&gt;&lt;li&gt;Ensure that Register with Azure Active Directory is enabled on App Service&lt;/li&gt;&lt;li&gt;Ensure that 'PHP version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Python version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Java version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'HTTP Version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure FTP deployments are disabled&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to Azure Portal using https://portal.azure.com&lt;/li&gt;&lt;li&gt;Go to App Services&lt;/li&gt;&lt;li&gt;Click on each App&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Authentication / Authorization&lt;ol&gt;&lt;li&gt;Set App Service Authentication to On&lt;/li&gt;&lt;li&gt;Choose other parameters as per your requirement and Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on SSL settings&lt;ol&gt;&lt;li&gt;Set HTTPS Only to On under Protocol Settings section&lt;/li&gt;&lt;li&gt;Set Minimum TLS Version to 1.2 under Protocol Settings section&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Configuration&lt;ol&gt;&lt;li&gt;Set the option Client certificate mode located under Incoming client certificates is set to Require&lt;/li&gt;&lt;li&gt;Set PHP version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Set HTTP version to 2.0 under General settings&lt;/li&gt;&lt;li&gt;Under Platform Settings, FTP state should be Disabled or FTPS Only&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Identity&lt;ol&gt;&lt;li&gt;Set Status to On&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Application settings&lt;ol&gt;&lt;li&gt;Set Python version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Under General settings, Set Java version to latest version available&lt;/li&gt;&lt;li&gt;Set Java minor version to latest version available&lt;/li&gt;&lt;li&gt;Set Java web container to the latest version of web container available&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Alternatively, some of these can be done with Azure CLI.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To set App Service Authentication for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp auth update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --enabled true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTPS-only traffic value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set httpsOnly=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set TLS Version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --min-tls-version 1.2&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Incoming client certificates value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set clientCertEnabled=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Register with Azure Active Directory feature for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp identity assign --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep php&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest PHP version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --php-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep python&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Python version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --python-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep java&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Java version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --java-version '1.8' --java-container 'Tomcat' --java-container-version '&amp;lt;VERSION&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTP 2.0 version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --http20-enabled true&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.1" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.10" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.10" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.2" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.2" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.4" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.5" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.5" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.6" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.6" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.7" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.7" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.8" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.8" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="9.9" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="9.9" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DP-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="IM-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="NS-1" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PV-3" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="PV-7" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Configure the password expiration to force after a determinate time, the password code shall be
-                        changed for the users.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
-                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
-                        PowerShell. With the following command as the example:&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
-                        days. The users receive notification 14 days prior to that expiry.
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        More information:&amp;nbsp;
-                        &lt;a
-                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                        MS Azure&lt;/a&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Check that the password expiration has got the correct values. Therefore, we can obtain the
-                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
-                            Windows PowerShell. With the following command:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;More information:
-                            &lt;a
-                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
-                            MS Azure&lt;/a&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.477">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.477">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
-            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
-                            groups to the users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Custom rules that you create 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a policy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
-&lt;/div&gt; 
-&lt;div&gt;
-  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. On the Association tab, enter one of the following settings, then select Add: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select Review + create, then select Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
-            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test the application gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Find the public IP address for the application gateway on its Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Copy the public IP address, and then paste it into the address bar of your browser. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Disable anonymous access 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Allow only authenticated requests 
-&lt;/div&gt; 
-&lt;div&gt;
-  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable alerts for anomalous activities 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All high severity alerts are sent to an Azure Event Hub 
-&lt;/div&gt; 
-&lt;div&gt;
-  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
-&lt;/div&gt; 
-&lt;div&gt;
-  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Set up a continuous export 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure continuous export from the Security Center pages in Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select the specific subscription for which you want to configure the data export. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Here you see the export options. There's a tab for each available export target. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL databases should be remediated 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Vulnerabilities in your virtual machines should be remediated 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To include the findings with these recommendations, enable the include security findings option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  7. Select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  View exported alerts and recommendations in Azure Monitor 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. From Azure Monitor's Alerts page, select New alert rule. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
-            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
-            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
-  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
-  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
-  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable per-user MFA 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  1. Log into the Azure portal as an owner. 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Select Azure Active Directory. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. Go into "Users and groups" &amp;gt; "All users". 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Select "Multi-Factor Authentication". 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Ensure your users have the MFA flag enabled. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable WAF logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable logging through the Azure portal 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. In the Azure portal, find your resource and select Diagnostic settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For Application Gateway, three logs are available: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Access log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Performance log 
-&lt;/div&gt; 
-&lt;div&gt;
-  - Firewall log 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. To start collecting data, select Turn on diagnostics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Type a name for the settings, confirm the settings, and select Save. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that all WAF logs are enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
-  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
-  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
-  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
-  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
-                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
-                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
-                            are enabled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt;
-   Use encryption to protect traffic on external and public networks as it is critical for data protection 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Rationale: 
- &lt;/div&gt; 
- &lt;div&gt;
-   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Remediation: 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Use a valid TLS/SSL certificate for custom domains. 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Redirect HTTP to HTTPs 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enforce FTPS 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Enable client certificates 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Impact: 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
-            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
-            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test HTTPS 
-&lt;/div&gt; 
-&lt;div&gt;
-  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
-              <output/>
-            </source>
-            <references>
-              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Export the information of Audit Logs to a storage account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
-  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
-  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
-  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
-  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Azure instances are into different VNets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
-                        accounts. With this process is ensured that there are not compromised accounts by former
-                        employees or by attackers.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
-                        &lt;li&gt;Select the user.&lt;/li&gt;
-                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Secure application secrets 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
-  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
-  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
-  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
-                            privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
-                            configured.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
-  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
-  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
-  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
-   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
-                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
-                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
-                            0.0.0.0/0 is are blocked.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZ-W04">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A04" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A03" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A03" mitigation="50"/>
-                <countermeasure ref="AZ-A04" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-IDENTITY-03">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A07" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A07" mitigation="50"/>
-                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A09" mitigation="20"/>
-                    <countermeasure ref="AZ-A10" mitigation="20"/>
-                    <countermeasure ref="AZ-A11" mitigation="20"/>
-                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="AZ-A12" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-A09" mitigation="20"/>
-                <countermeasure ref="AZ-A10" mitigation="20"/>
-                <countermeasure ref="AZ-A11" mitigation="20"/>
-                <countermeasure ref="AZ-A12" mitigation="20"/>
-                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-16">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
-                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
-                    <countermeasure ref="AZ-L01" mitigation="16"/>
-                    <countermeasure ref="AZ-L02" mitigation="16"/>
-                    <countermeasure ref="AZ-L04" mitigation="16"/>
-                    <countermeasure ref="AZ-L05" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
-                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
-                <countermeasure ref="AZ-L01" mitigation="16"/>
-                <countermeasure ref="AZ-L02" mitigation="16"/>
-                <countermeasure ref="AZ-L04" mitigation="16"/>
-                <countermeasure ref="AZ-L05" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N01" mitigation="25"/>
-                    <countermeasure ref="AZ-N02" mitigation="25"/>
-                    <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="AZ-N09" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZ-N01" mitigation="25"/>
-                <countermeasure ref="AZ-N02" mitigation="25"/>
-                <countermeasure ref="AZ-N09" mitigation="25"/>
-                <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="45fff781-2c55-4178-bfba-7661def4ba12" diagramComponentId="88872cd8-81f0-4518-bb59-e3ed78c56f03" ref="40a5314d-c9ec-4089-ae5b-6fa194301861" name="Web Service" desc="" library="" parentComponentRef="" componentDefinitionRef="web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_SEGM"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.118">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.232">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.120">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.236">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.236">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.120">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.119">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.666">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.119">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.510">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.910">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.781">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.912">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.911">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.911">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.834">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.082">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.430">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.671">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.835">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.835">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.672">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.253">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.436">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.781">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.619">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.083">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1f68f86b-86fa-4791-a14d-bf2ba8a27f90" diagramComponentId="70fbb43c-8538-4d2c-9dac-17e1a173d882" ref="90fdbf5a-9d44-4b11-b469-a7a60f3928ee" name="Internal Server" desc="" library="" parentComponentRef="" componentDefinitionRef="internal-server">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_SEGM"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="20"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
-          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
-                        to known security issues. These issues could be used by an attacker to gain access to the
-                        system.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Vendors and other maintainers of software release patches in response to security flaws and
-                        other bugs in their products.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
-                        failures or exploitation.&lt;/li&gt;
-                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
-                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
-                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
-                        the flaw.&lt;/li&gt;
-                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
-                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
-                            security and other patches.&lt;/li&gt;
-                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
-                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
-                            taking into account the associated risk.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.746">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
- &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
- &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
-&lt;/ul&gt; </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.747">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
-          <threats>
-            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If attackers compromise the server that hosts the service or data, then the data and
-                                the service itself could be at risk of compromise. The server could be compromised
-                                through any of the services that it exposes.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="UNNECESSARY-SERVICES">
-                  <countermeasures>
-                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNPATCHED-SERVER">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
-                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From d32b12bea3956c558531fedc2a406c1c60140503 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:21:44 -0400
Subject: [PATCH 15/28] Delete Templates/gcp-cloud-architecture.xml

---
 Templates/gcp-cloud-architecture.xml | 2288 --------------------------
 1 file changed, 2288 deletions(-)
 delete mode 100644 Templates/gcp-cloud-architecture.xml

diff --git a/Templates/gcp-cloud-architecture.xml b/Templates/gcp-cloud-architecture.xml
deleted file mode 100644
index 9b5faf2..0000000
--- a/Templates/gcp-cloud-architecture.xml
+++ /dev/null
@@ -1,2288 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="gcp-cloud-architecture" name="GCP - Cloud Architecture" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTYwOCIgZHk9IjEwODIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC41LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHVibGljIiBzdHlsZT0iaXIucmVmPTYzNzZkNTNlLTY0NjEtNDEyYi04ZTA0LTdiM2ZlMmIzOTdkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMzcyIiB5PSItNDEiIHdpZHRoPSIxMTEyIiBoZWlnaHQ9IjY1MSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iR0NQIFBsYXRmb3JtIEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z29vZ2xlLWNsb3VkLXBsYXRmb3JtLWVudmlyb25tZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk1qTTVNVE1nTUM0ek5UYzRPVFZNTUM0Mk5UQTFOelFnTUM0ek5UZ3pOVEpNTUM0M01qTXdNVFlnTUM0eU9EVTVNRGxNTUM0M01qWTFNamNnTUM0eU5UVXlNVGRETUM0Mk5qY3dNelVnTUM0eU1ESXhNRE1nTUM0MU9UQXdOVGNnTUM0eE56STNPRElnTUM0MU1UQXpNRFlnTUM0eE56STROVEpETUM0ek5qQXlNVGdnTUM0eE56STROVElnTUM0eU16TTFORElnTUM0eU56UTVOelFnTUM0eE9UWXdORFVnTUM0ME1UTXpNRFJETUM0eU1ETTVOVE1nTUM0ME1EYzNPRGdnTUM0eU1qQTROVGtnTUM0ME1URTVNallnTUM0eU1qQTROVGtnTUM0ME1URTVNalpNTUM0ek5qVTJNVFVnTUM0ek9EZ3hNalpETUM0ek5qVTJNVFVnTUM0ek9EZ3hNallnTUM0ek56TXdOVFFnTUM0ek56VTRNU0F3TGpNM05qZ3lOQ0F3TGpNM05qUXlNa013TGpReE1UQTFJREF1TXpNNE9ERTNJREF1TkRVNU5UUTVJREF1TXpFM016azFJREF1TlRFd016a3pJREF1TXpFM05ERTFRekF1TlRVek16RTBJREF1TXpFM05UQTFJREF1TlRreU9EVXhJREF1TXpNeU5qY2dNQzQyTWpNNU1TQXdMak0xTnpjMU9GWXdMak0xTnpnNU9FZ3dMall5TXpreE0xWXdMak0xTnpnNU5Wb2lJR1pwYkd3OUlpTkZRVFF6TXpVaUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TWpRMk55QXdMalF4TXpRNU9FTXdMamd3TnpnMU1pQXdMak0xTVRRMklEQXVOemN6TVRreUlEQXVNamsyTmpneElEQXVOekkyTkRFeUlEQXVNalUxTVRJM1REQXVOakl6T0RNMklEQXVNelUzTnpBelF6QXVOalkwT1RNMklEQXVNemt3T0RZM0lEQXVOamt4TWprNElEQXVORFF4TmpFMUlEQXVOamt4TWprNElEQXVORGs0TkRJMFZqQXVOVEUyTlRJNFF6QXVOelF4TWlBd0xqVXhOalV5T0NBd0xqYzRNVGMwSURBdU5UVTNNVFU0SURBdU56Z3hOelFnTUM0Mk1EWTVOME13TGpjNE1UYzBJREF1TmpVMk9EY3lJREF1TnpReE1URWdNQzQyT1RjME1UTWdNQzQyT1RFeU9UZ2dNQzQyT1RjME1UTklNQzQxTVRBME1UTk1NQzQwT1RJek1TQXdMamN4TlRZeU1WWXdMamd5TkRFMk9Fd3dMalV4TURReE15QXdMamcwTWpFM09VZ3dMalk1TVRJNU9FTXdMamd5TVRFeE9TQXdMamcwTVRrNU55QXdMamt5TmpNeE1pQXdMamN6Tmpnd055QXdMamt5TmpVd05pQXdMall3TmprNE5VTXdMamt5TmpReE5DQXdMalV5Tmprek5pQXdMamc0TmpFNE9DQXdMalExTmpFeE9DQXdMamd5TkRZM01pQXdMalF4TXpVeE0xWXdMalF4TXpWTU1DNDRNalEyTnlBd0xqUXhNelE1T0ZvaUlHWnBiR3c5SWlNME1qZzFSalFpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpNamt6TmpjZ01DNDROREkwTWpKSU1DNDFNVEF4TkRsV01DNDJPVGMxTkRSSU1DNHpNamt6TmpkRE1DNHpNVFkxTWpJZ01DNDJPVGMxTkRZZ01DNHpNRE00TWprZ01DNDJPVFEzT0RjZ01DNHlPVEl4TkRVZ01DNDJPRGswTlROTU1DNHlOall3TkRNZ01DNDJPVGMwTlRGTU1DNHhPVE0yTURFZ01DNDNOams0T1V3d0xqRTROekkxTmlBd0xqYzVORE0wTVVNd0xqSXlPREEzT1NBd0xqZ3lOVFE0TkNBd0xqSTNPREF3T1NBd0xqZzBNak0wTkNBd0xqTXlPVE0xTnlBd0xqZzBNak14T1V3d0xqTXlPVE0zSURBdU9EUXlOREl5U0RBdU16STVNelkzV2lJZ1ptbHNiRDBpSXpNMFFUZzFNeUl2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTXlPVE15T0NBd0xqTTNNVGd5TmtNd0xqRTVPVFV3TlNBd0xqTTNNakV6T0NBd0xqQTVOREk1T0RVZ01DNDBOemN6TWprZ01DNHdPVFF4TVRZeUlEQXVOakEzTVRVMVF6QXVNRGswTVRFMk1pQXdMalk0TXpVek9TQXdMakV6TURjd05DQXdMamMxTVRRMU5pQXdMakU0TnpNeE5pQXdMamM1TkRRM09Fd3dMakk1TWpFNU15QXdMalk0T1RVNU9VTXdMakkxT1RjM0lEQXVOamMwT1RjMklEQXVNak00T1RFeUlEQXVOalF5TnpJMElEQXVNak00T0RneUlEQXVOakEzTVRVMVF6QXVNak00T0RneUlEQXVOVFUzTWpVeUlEQXVNamM1TlRFeklEQXVOVEUyTnpFeElEQXVNekk1TXpJMUlEQXVOVEUyTnpFeFF6QXVNelkySURBdU5URTJOekV4SURBdU16azNOVEk1SURBdU5UTTRPREl4SURBdU5ERXhOemd6SURBdU5UY3dNRE0zVERBdU5URTJOall5SURBdU5EWTFNVFU0UXpBdU5EY3pOalV4SURBdU5EQTROVFEwSURBdU5EQTFOekl5SURBdU16Y3hPVFU1SURBdU16STVNelFnTUM0ek56RTVOVGxNTUM0ek1qa3pNamdnTUM0ek56RTRNalphSWlCbWFXeHNQU0lqUmtKQ1F6QTFJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakEySWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01UVXpPREE1SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqZ3pNak0zTkNJZ2FHVnBaMmgwUFNJd0xqWTJPVFV6TmlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EazBNVEUyTWlBd0xqRTNNamcxTWlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWFjN2U0Mzg3LWYzN2EtNDFmYi1hMjFhLWI2MmEyZmQ4Y2NlNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nb29nbGUtY2xvdWQtcGxhdGZvcm0tZW52aXJvbm1lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMSIgeT0iNDgiIHdpZHRoPSIxMDE4IiBoZWlnaHQ9IjU1NSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iUmVnaW9uIDEiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9Mzg0MmExZGQtN2EyZC00YTVlLWFmNmYtMDQyMmQ2ZmQyNDY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQwIiB5PSI0MSIgd2lkdGg9IjY5OSIgaGVpZ2h0PSI0MjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjYiIHZhbHVlPSJab25lIDEgLSBhIiBzdHlsZT0iaXIucmVmPTgxMzQ1YTljLWNjZGItNDFkYS05OWU0LTM1NDJkMTQwOGUxYjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzOSIgeT0iNTMiIHdpZHRoPSIzMDkiIGhlaWdodD0iMzQ0IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3IiB2YWx1ZT0iWm9uZSAxIC0gYiIgc3R5bGU9ImlyLnJlZj1jMmY1ZDAwZi0zN2JiLTRkZGEtODA5Ni1mYjg1NzEyM2YwOGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzY2IiB5PSI1MCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSIzNDciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlJlZ2lvbiAyIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTlhNmU0YWFiLTUyMmMtNDlhMi05OWE4LWEwNDU0MWZiN2E4Yjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3NjkiIHk9IjM4IiB3aWR0aD0iMTk4IiBoZWlnaHQ9IjQyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iOCIgdmFsdWU9IlpvbmUgMiAtIGEiIHN0eWxlPSJpci5yZWY9ZDU2ZGJhM2UtM2U2Yy00OWM2LWFlNWMtOTI3NmE5NjMwYTg4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE4IiB5PSI2NiIgd2lkdGg9IjE2NyIgaGVpZ2h0PSIzMzUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows/>
-  <customFields/>
-  <components>
-    <component uuid="c694f9b6-9b15-428a-a490-00e0b66b75df" diagramComponentId="ac7e4387-f37a-41fb-a21a-b62a2fd8cce7" ref="225ed77d-0324-4a33-9df7-aa4ba51a588b" name="GCP Platform Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="google-cloud-platform-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="GOOGLE-LOGS03" name="Audit logs can be deleted" state="0" impact="100" issueId="" issueLink="">
-          <desc>There is no external backups of log records. If logs are deleted, there is no way to recover them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.424">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The administrator accounts are used for all actions, not only for the administrative ones. This is because these users do not have a personal or user account to perform their daily actions.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.011">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.425">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login to the console without using Multi-factor Authentication (MFA) is considered as suspicious activity. Therefore connection without MFA must be audited and monitored and the corresponding security group must be informed and must validate this connection.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
-          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
-                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-IAM03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
-          <desc>Key security settings such as resetting the password, and other password controls are not
-                        configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-IAM-01" name="Misconfigured authentication method for administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>The authentication method "Multi-factor Authentication" for the Administrator accounts is not
-                        configured.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE_IAM-02" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials for the groups and roles are incorrectly configured and there are user accounts with more privileges than necessary.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-EXPIRATION-DATE" name="Misconfigured security key expirations" state="0" impact="100" issueId="" issueLink="">
-          <desc>The password and security key expiration is not configured and users are not obliged to change
-                        their security credentials. Not frequently changing passwords, gives attackers the chance to
-                        obtain credentials and gain access to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-VNET01" name="Networks for Google Cloud resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-RESOURCES-STATUS" name="Undetected Resources status changes" state="0" impact="100" issueId="" issueLink="">
-          <desc>Changes to the system status are not controlled with the consequence of system failure.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON06" name="Undetected brute force attempts on the Google Cloud console" state="0" impact="100" issueId="" issueLink="">
-          <desc>Failed connection attempts (brute force) must be audited and monitored and the corresponding personnel must be alerted and informed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON05" name="Undetected changes in the data encryption configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Changes to the database encryption must be audited and monitored. When there are changes to the database encryption, the security group must be alerted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON07" name="Undetected changes in the network configuration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Changes in network configurations (NACLs, route and gateway tables) are not detected because monitoring and alerts of network configuration changes are not in place.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON01" name="Undetected changes in the security configurations" state="0" impact="100" issueId="" issueLink="">
-          <desc>Monitoring and alerting for security configurations are not configured and changes cannot be detected.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-MON04" name="Undetected changes in the security groups" state="0" impact="100" issueId="" issueLink="">
-          <desc>Changes in the security groups must be traced and monitored and the corresponding personnel must approve these changes. If the configuration is not appropriate, attackers can gain access to security systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="GOOGLE-IAM03" name="Apply RBAC with pre-defined policies added into groups and roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Define and create groups that relate to job functions (administrators, developers, accounting,
-                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
-                        groups. All the users in an IAM group inherit the permissions assigned to the group. That way,
-                        you can make changes for everyone in a group in just one place. As people move around in your
-                        company, you can simply change what IAM group their IAM user belongs to. This method is known as
-                        Role Based Access Control (RBAC).&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        To add a team member and grant an IAM role to the member:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
-                        &lt;li&gt;Click Select a project.&lt;/li&gt;
-                        &lt;li&gt;Select a project and click Open.&lt;/li&gt;
-                        &lt;li&gt;Click Add to add new members to the project and set their permissions. In the Select a
-                        role drop-down menu, click on a service name to find the roles that belong to that service.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;To grant more than one role to the same project member:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
-                        &lt;li&gt;Click Select a project.&lt;/li&gt;
-                        &lt;li&gt;Select a project and click Open.&lt;/li&gt;
-                        &lt;li&gt;Enter the email address of the member and select all the roles that you want to grant
-                        to the member. Click Add.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;To grant a role to a member for more than one project:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Open the IAM and Admin Projects page in the Cloud Platform Console and open the IAM
-                        &amp;amp; ADMIN PROJECTS page.&lt;/li&gt;
-                        &lt;li&gt;Select all the projects for which you want to grant permissions.&lt;/li&gt;
-                        &lt;li&gt;In the IAM tab on the right pane, add the new member and select a role to grant the
-                        role for all selected projects.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Granting, changing, and revoking access to resources" url="https://cloud.google.com/iam/docs/granting-changing-revoking-access"/>
-          </references>
-          <standards>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
-                            &lt;li&gt;Click Select a project and click Open.&lt;/li&gt;
-                            &lt;li&gt;List all members from the project.&lt;/li&gt;
-                            &lt;li&gt;Check that each member has been assigned to the correct roles.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM08" name="Automatically rotate Google Service account keys" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The Google Service Keys shall be rotated to avoid unauthorized access.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        To enable automatic rotation of a key, set the rotation schedule with the following gcloud
-                        command-line syntax:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        gcloud kms keys update KEY_NAME \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --location LOCATION \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --keyring KEYRING_NAME \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --rotation-period ROTATION_PERIOD \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --next-rotation-time NEXT_ROTATION_TIME&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;For example:&amp;nbsp;
-                        &lt;div&gt;
-                        gcloud kms keys update KEY_NAME&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --rotation-period=30d&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --next-rotation-time=2016-10-12T12:34:56.1234Z
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: KMS rotation schedule" url="https://cloud.google.com/kms/docs/rotating-keys#kms-set-rotation-schedule-cli"/>
-          </references>
-          <standards>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check automatic rotation of keys is enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM19" name="Avoid assigning Service Account roles to IAM users at project level" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;is recommended to assign the Service Account User (iam.serviceAccountUser) and Service Account Token Creator (iam.serviceAccountTokenCreator) roles to a user for a specific service account rather than assigning the role to a user at project level.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A service account is a special Google account that belongs to an application or a virtual machine (VM), instead of to an individual end-user. Application/VM-Instance uses the service account to call the service's Google API so that users aren't directly involved. In addition to being an identity, a service account is a resource that has IAM policies attached to it. These policies determine who can use the service account.&lt;/p&gt;&lt;p&gt;Users with IAM roles to update the App Engine and Compute Engine instances (such as App Engine Deployer or Compute Instance Admin) can effectively run code as the service accounts used to run these instances, and indirectly gain access to all the resources for which the service accounts have access. Similarly, SSH access to a Compute Engine instance may also provide the ability to execute code as that instance/Service account.&lt;/p&gt;&lt;p&gt;Based on business needs, there could be multiple user-managed service accounts configured for a project. Granting the iam.serviceAccountUser or iam.serviceAserviceAccountTokenCreatorccountUser roles to a user for a project gives the user access to all service accounts in the project, including service accounts that may be created in the future. This can result in elevation of privileges by using service accounts and corresponding Compute Engine instances.&lt;/p&gt;&lt;p&gt;In order to implement least privileges best practices, IAM users should not be assigned the Service Account User or Service Account Token Creator roles at the project level. Instead, these roles should be assigned to a user for a specific service account, giving that user access to the service account. The Service Account User allows a user to bind a service account to a long-running job service, whereas the Service Account Token Creator role allows a user to directly impersonate (or assert) the identity of a service account.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;After revoking Service Account User or Service Account Token Creator roles at the project level from all impacted user account(s), these roles should be assigned to a user(s) for specific service account(s) according to business needs.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console by visiting: https://console.cloud.google.com/iam-admin/iam.&lt;/p&gt;&lt;p&gt;2. Click on the filter table text bar. Type Role: Service Account User&lt;/p&gt;&lt;p&gt;3. Click the Delete Bin icon in front of the role Service Account User for every user listed as a result of a filter.&lt;/p&gt;&lt;p&gt;4. Click on the filter table text bar. Type Role: Service Account Token Creator&lt;/p&gt;&lt;p&gt;5. Click the Delete Bin icon in front of the role Service Account Token Creator for every user listed as a result of a filter.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. Using a text editor, remove the bindings with the roles/iam.serviceAccountUser or roles/iam.serviceAccountTokenCreator.&lt;/p&gt;&lt;p&gt;2. Update the project's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects set-iam-policy PROJECT_ID iam.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.6" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.6" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console by visiting https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Click on the filter table text bar, Type Role: Service Account User.&lt;/p&gt;&lt;p&gt;3. Ensure no user is listed as a result of the filter.&lt;/p&gt;&lt;p&gt;4. Click on the filter table text bar, Type Role: Service Account Token Creator.&lt;/p&gt;&lt;p&gt;5. Ensure no user is listed as a result of the filter.&lt;/p&gt;&lt;p&gt;From Command Line: To ensure IAM users are not assigned Service Account User role at the project level:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountUser"&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountTokenCreator"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;These commands should not return any output.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM12" name="Avoid using API keys on a project" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys appear below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Deleting an API key will break dependent applications (if any).&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, to delete API Keys: Click the Delete Bin Icon in front of every API Key Name.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, no API key should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM09" name="Avoid using personal accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use corporate login credentials instead of personal accounts, such as Gmail accounts.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as personal accounts, should not be used for business purposes.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Follow the documentation and setup corporate login accounts.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.1" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For each Google Cloud Platform project, list the accounts that have been granted access to that project:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Also list the accounts added on each folder:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud resource-manager folders get-iam-policy FOLDER_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;And list your organization's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud organizations get-iam-policy ORGANIZATION_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM20" name="Block access to Cloud KMS cryptokeys from unauthorized access" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended that the IAM policy on Cloud KMS cryptokeys should restrict anonymous and/or public access.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Granting permissions to allUsers or allAuthenticatedUsers allows anyone to access the dataset. Such access might not be desirable if sensitive data is stored at the location. In this case, ensure that anonymous and/or public access to a Cloud KMS cryptokey is not allowed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removing the binding for allUsers and allAuthenticatedUsers members denies accessing cryptokeys to anonymous or public users.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all Cloud KMS Cryptokeys.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Remove IAM policy binding for a KMS key to remove access to allUsers and allAuthenticatedUsers using the below command.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allAuthenticatedUsers' --role='[role]'&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allUsers' --role='[role]'&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.9" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all Cloud KMS Cryptokeys.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure the below command's output does not contain allUsers and allAuthenticatedUsers.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys get-iam-policy [key_name] --keyring=[key_ring_name] --location=global --format=json | jq '.bindings[].members[]'&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET05" name="Configure Cloud DNS DNSSEC" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Cloud DNS by visiting https://console.cloud.google.com/net-services/dns/zones.&lt;/p&gt;&lt;p&gt;2. For each zone of Type Public, set DNSSEC to On.&lt;/p&gt;&lt;p&gt;From Command Line: Use the below command to enable DNSSEC for Cloud DNS Zone Name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state on&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure RSASHA1 is not used for the key-signing/zone-signing key.&lt;/p&gt;&lt;p&gt;1. If it is necessary to change the settings for a managed zone where it has been enabled, NSSEC must be turned off and re-enabled with different settings. To turn off DNSSEC, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state off&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. To update key-signing for a reported managed DNS Zone, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.3" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="3.4" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="3.5" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure the property algorithm for keyType zone signing is not using RSASHA1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones describe --format="json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs)"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-LOG05" name="Configure Cloud DNS Logging" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Security monitoring and forensics cannot depend solely on IP addresses from VPC flow logs, especially when considering the dynamic IP usage of cloud resources, HTTP virtual host routing, and other technology that can obscure the DNS name used by a client from the IP address. Monitoring of Cloud DNS logs provides visibility to DNS names requested by the clients within the VPC. These logs can be monitored for anomalous domain names, evaluated against threat intelligence.&lt;/p&gt; 
-&lt;p&gt;Note: For full capture of DNS, firewall must block egress UDP/53 (DNS) and TCP/443 (DNS over HTTPS) to prevent client from using external DNS name server for resolution.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling logging for private managed zones&lt;/p&gt; 
-&lt;p&gt;Use DNS policies to enable or disable logging for your networks, or use the DNS managed zone itself to enable or disable logging for queries resolved by that zone.&lt;/p&gt; 
-&lt;p&gt;Note: When you enable query logging, every DNS query to a Cloud DNS managed zone is logged.&lt;/p&gt; 
-&lt;p&gt;To enable logging for a network that does not have a DNS policy, run the dns policies create command.&lt;/p&gt; 
-&lt;p&gt;gcloud dns policies create POLICY_NAME \ -networks=NETWORK \ -enable-logging \ -description=DESCRIPTION&lt;/p&gt; 
-&lt;p&gt;Replace the following:&lt;/p&gt; 
-&lt;p&gt;- POLICY_NAME: the name of the DNS policy&lt;br&gt; - NETWORK: one or more networks in a comma-separated list&lt;br&gt; - DESCRIPTION: a description of the policy&lt;/p&gt; 
-&lt;p&gt;To enable logging for a network that has an existing DNS policy, run the dns policies update command.&lt;/p&gt; 
-&lt;p&gt;gcloud dns policies update POLICY_NAME \ -networks=NETWORK \ -enable-logging&lt;/p&gt; 
-&lt;p&gt;Replace the following:&lt;/p&gt; 
-&lt;p&gt;- POLICY_NAME: the name of the DNS policy&lt;br&gt; - NETWORK: one or more networks in a comma-separated list&lt;/p&gt; 
-&lt;p&gt;Enabling and disabling logging for managed public zones&lt;/p&gt; 
-&lt;p&gt;To turn on logging for an existing managed public zone, run the dns managed-zones update command.&lt;/p&gt; 
-&lt;p&gt;gcloud dns managed-zones update ZONE_NAME -log-dns-queries \&lt;/p&gt; 
-&lt;p&gt;Replace ZONE_NAME with the name of the DNS managed zone that you want to enable logging for.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Enabling of Cloud DNS logging might result in your project being charged for the additional logs usage.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-            <reference name="Cloud DNS Logging and monitoring" url="https://cloud.google.com/dns/docs/monitoring"/>
-          </references>
-          <standards>
-            <standard ref="2.12" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.12" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;From Command Line:&lt;/p&gt;
-
-	&lt;p&gt;1. List all VPCs networks in a project: &lt;/p&gt;
-
-	&lt;p&gt;gcloud compute networks list -format="table[box,title='All VPC Networks'](name:label='VPC Network Name')"&lt;/p&gt;
-
-	&lt;p&gt;2. List all DNS policies, logging enablement, and associated VPC networks: &lt;/p&gt;
-
-	&lt;p&gt;gcloud dns policies list -flatten="networks[]" -format="table[box,title='All DNS Policies By VPC Network'](name:label='Policy Name',enableLogging:label='LoggingEnabled':align=center,networks.networkUrl.basename():label='VPC Network Name')"&lt;/p&gt;
-
-	&lt;p&gt;Each VPC Network should be associated with a DNS policy with logging enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-IAM-01" name="Configure essential contacts for organization" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Many Google Cloud services, such as Cloud Billing, send out notifications to share important information with Google Cloud users. By default, these notifications are sent to members with certain Identity and Access Management (IAM) roles. With Essential Contacts, you can customize who receives notifications by providing your own list of contacts.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts&lt;/li&gt;&lt;li&gt;Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.&lt;/li&gt;&lt;li&gt;Click +Add contact&lt;/li&gt;&lt;li&gt;In the Email and Confirm Email fields, enter the email address of the contact.&lt;/li&gt;&lt;li&gt;From the Notification categories drop-down menu, select the notification categories that you want the contact to receive communications for.&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To add an organization Essential Contacts run a command:&lt;/li&gt;&lt;/ol&gt;&lt;blockquote&gt;&lt;p&gt;gcloud essential-contacts create --email="&amp;lt;EMAIL&amp;gt;" \ --notification-categories="&amp;lt;NOTIFICATION_CATEGORIES&amp;gt;" \ --organization=&amp;lt;ORGANIZATION_ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default, there are no Essential Contacts configured.&lt;/p&gt;&lt;p&gt;In the absence of an Essential Contact, the following IAM roles are used to identify users to notify for the following categories:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Legal: roles/billing.admin&lt;/li&gt;&lt;li&gt;Security: roles/resourcemanager.organizationAdmin&lt;/li&gt;&lt;li&gt;Suspension: roles/owner&lt;/li&gt;&lt;li&gt;Technical: roles/owner&lt;/li&gt;&lt;li&gt;Technical Incidents: roles/owner&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Managing notification contacts" url="https://cloud.google.com/resource-manager/docs/managing-notification-contacts"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.16" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts&lt;/li&gt;&lt;li&gt;Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.&lt;/li&gt;&lt;li&gt;Ensure that appropriate email addresses are configured for each of the following notification categories:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Legal&lt;/li&gt;&lt;li&gt;Security&lt;/li&gt;&lt;li&gt;Suspension&lt;/li&gt;&lt;li&gt;Technical&lt;/li&gt;&lt;li&gt;Technical Incidents&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Alternatively, appropriate email addresses can be configured for the All notification category to receive all possible important notifications.&amp;nbsp;&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To list all configured organization Essential Contacts run a command: gcloud essential-contacts list --organization=&amp;lt;ORGANIZATION_ID&amp;gt;&lt;/li&gt;&lt;li&gt;Ensure at least one appropriate email address is configured for each of the following notification categories:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;LEGAL&lt;/li&gt;&lt;li&gt;SECURITY&lt;/li&gt;&lt;li&gt;SUSPENSION&lt;/li&gt;&lt;li&gt;TECHNICAL&lt;/li&gt;&lt;li&gt;TECHNICAL_INCIDENTS&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Alternatively, appropriate email addresses can be configured for the ALL notification category to receive all possible important notifications.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET04" name="Configure Firewall Rules for instances behind IAP" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed. To ensure that load balancing works correctly health checks should also be allowed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;IAP ensure that access to VMs is controlled by authenticating incoming requests. However if the VM is still accessible from IP addresses other than the IAP it may still be possible to send unauthenticated requests to the instance. Care must be taken to ensure that loadbalancer health checks are not blocked as this would stop the loadbalancer from correctly knowing the health of the VM and loadbalancing correctly.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If firewall rules are not configured correctly, legitimate business services could be negatively impacted.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;/p&gt;&lt;p&gt;2. Select the checkbox next to the following rules:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;default-allow-http&lt;/li&gt;&lt;li&gt;default-allow-https&lt;/li&gt;&lt;li&gt;default-allow-internal&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;3. Click Delete.&lt;/p&gt;&lt;p&gt;4. Click Create firewall rule and set the following values:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Name: allow-iap-traffic&lt;/li&gt;&lt;li&gt;Targets: All instances in the network&lt;/li&gt;&lt;li&gt;Source IP ranges (press Enter after you paste each value in the box):&lt;ul&gt;&lt;li&gt;130.211.0.0/22&lt;/li&gt;&lt;li&gt;35.191.0.0/16&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Protocols and ports:&lt;ul&gt;&lt;li&gt;Specified protocols and ports&lt;/li&gt;&lt;li&gt;tcp:80&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;5. When you're finished updating values, click Create.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;/p&gt;&lt;p&gt;2. Verify that the only rules correspond to the following values:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Targets: All instances in the network&lt;/li&gt;&lt;li&gt;Source IP ranges (press Enter after you paste each value in the box):&lt;ul&gt;&lt;li&gt;130.211.0.0/22&lt;/li&gt;&lt;li&gt;35.191.0.0/16&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Protocols and ports:&lt;ul&gt;&lt;li&gt;Specified protocols and ports&lt;/li&gt;&lt;li&gt;tcp:80&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-LOG06" name="Configure sinks for all logs entries" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a sink (console)&lt;/p&gt; 
-&lt;p&gt;You can create up to 200 sinks per Cloud project.&lt;/p&gt; 
-&lt;p&gt;After you create the sink, ensure that Logging has the appropriate permissions to write logs to your sink's destination.&lt;/p&gt; 
-&lt;p&gt;To create a sink, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud console, go to the Logs Router page:&lt;/p&gt; 
-&lt;p&gt;2. Select an existing Cloud project.&lt;/p&gt; 
-&lt;p&gt;3. Select Create sink.&lt;/p&gt; 
-&lt;p&gt;4. In the Sink details panel, enter the following details:&lt;/p&gt; 
-&lt;p&gt;- Sink name: Provide an identifier for the sink; note that after you create the sink, you can't rename the sink but you can delete it and create a new sink.&lt;/p&gt; 
-&lt;p&gt;- Sink description (optional): Describe the purpose or use case for the sink.&lt;/p&gt; 
-&lt;p&gt;5. In the Sink destination panel, select the sink service and destination:&lt;/p&gt; 
-&lt;p&gt;- Select sink service: Select the service where you want your logs routed.&lt;/p&gt; 
-&lt;p&gt;Based on the service that you select, you can select from the following destinations:&lt;/p&gt; 
-&lt;p&gt;- Cloud Logging bucket: Select or create a Logging bucket.&lt;br&gt; - BigQuery table: Select or create the particular dataset to receive the routed logs. You also have the option to use partitioned tables.&lt;br&gt; - Cloud Storage bucket: Select or create the particular Cloud Storage bucket to receive the routed logs.&lt;br&gt; - Pub/Sub topic: Select or create the particular topic to receive the routed logs.&lt;br&gt; - Splunk: Select the Pub/Sub topic for your Splunk service.&lt;br&gt; - Other Cloud project: Manually add the Logging, BigQuery, Cloud Storage, or Pub/Sub service and destination information in the following format:&lt;/p&gt; 
-&lt;p&gt;SERVICE.googleapis.com/projects/PROJECT_ID/SINK_DESTINATION/DESTINATION_ID&lt;/p&gt; 
-&lt;p&gt;For example, if your sink destination is a BigQuery dataset, the sink destination would be the following:&lt;/p&gt; 
-&lt;p&gt;bigquery.googleapis.com/projects/PROJECT_ID/datasets/DATASET_ID&lt;/p&gt; 
-&lt;p&gt;Note that if you are routing logs between Cloud projects, you still need the appropriate destination permissions.&lt;/p&gt; 
-&lt;p&gt;6. In the Choose logs to include in sink panel, do the following:&lt;/p&gt; 
-&lt;p&gt;a. In the Build inclusion filter field, enter a filter expression that matches the log entries you want to include. If you don't set a filter, all logs from your selected resource are routed to the destination.&lt;/p&gt; 
-&lt;p&gt;For example, you might want to build a filter to route all Data Access logs to a single Logging bucket. This filter looks like the following:&lt;/p&gt; 
-&lt;p&gt;LOG_ID("cloudaudit.googleapis.com/data_access") OR LOG_ID("externalaudit.googleapis.com/data_access")&lt;/p&gt; 
-&lt;p&gt;Note that the length of a filter can't exceed 20,000 characters.&lt;/p&gt; 
-&lt;p&gt;b. To verify you entered the correct filter, select Preview logs. This opens the Logs Explorer in a new tab with the filter prepopulated.&lt;/p&gt; 
-&lt;p&gt;7. (Optional) In the Choose logs to filter out of sink panel, do the following:&lt;/p&gt; 
-&lt;p&gt;a. In the Exclusion filter name field, enter a name.&lt;/p&gt; 
-&lt;p&gt;b. In the Build an exclusion filter field, enter a filter expression that matches the log entries you want to exclude. You can also use the sample function to select a portion of the log entries to exclude.&lt;/p&gt; 
-&lt;p&gt;Key Point: If you want your exclusion filter to be disabled when the sink is created, then select Disable after you enter your filter expression. You can update the sink later to enable the exclusion filter.&lt;/p&gt; 
-&lt;p&gt;You can create up to 50 exclusion filters per sink. Note that the length of a filter can't exceed 20,000 characters.&lt;/p&gt; 
-&lt;p&gt;8. Select Create sink.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-            <reference name="Configure and manage sinks" url="https://cloud.google.com/logging/docs/export/configure_export_v2"/>
-          </references>
-          <standards>
-            <standard ref="2.2" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.2" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;From Console:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to Logging/Exports by visiting https://console.cloud.google.com/logs/exports.&lt;/p&gt;
-
-	&lt;p&gt;2. For every sink, click the 3-dot button for Menu options and select View Filter.&lt;/p&gt;
-
-	&lt;p&gt;3. Ensure there is at least one sink with an empty sink filter.&lt;/p&gt;
-
-	&lt;p&gt;4. Additionally, ensure that the resource configured as Destination exists.&lt;/p&gt;
-
-	&lt;p&gt;From Command Line:&lt;/p&gt;
-
-	&lt;p&gt;1. Ensure that a sink with an empty filter exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project: &lt;/p&gt;
-
-	&lt;p&gt;gcloud logging sinks list -folder=FOLDER_ID | -organization=ORGANIZATION_ID | -project=PROJECT_ID&lt;/p&gt;
-
-	&lt;p&gt;The output should list at least one sink with an empty filter.&lt;/p&gt;
-
-	&lt;p&gt;2. Additionally, ensure that the resource configured as Destination exists.&lt;/p&gt;
-
-	&lt;p&gt;See https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list for more information.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-GOV01" name="Configure the reset security challenge questions for Administrator accounts" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure configuration of the security challenge questions for the Administrator accounts recover or reset password process are secure.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to &lt;a href="https://myaccount.google.com/security#signin"&gt;Google Cloud Account&lt;/a&gt;.&lt;/li&gt; 
-  &lt;li&gt;Fill in the fields from the &amp;quot;Recover Account Options&amp;quot; sections and click &amp;quot;Save&amp;quot;.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: Security" url="https://myaccount.google.com/security#signin"/>
-          </references>
-          <standards>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to &lt;a href="https://myaccount.google.com/security#signin"&gt;Google Cloud
-                            account&lt;/a&gt;.&lt;/li&gt;
-                            &lt;li&gt;Check that all fields from the &amp;quot;Recover Account Options&amp;quot;
-                            sections are filled correctly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.880">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON06" name="Create alerts for changes in the security groups and in the security group configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for changes in the security groups and in the security group configurations&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about changes to the Security Groups or the Security Groups configuration. It's vital that monitoring of Security Groups detects and reports any unauthorized changes in the security systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when security groups and their configurations are changed or modified.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON03" name="Create alerts for security policy changes" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for security policy changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the Security Policy changes. It's vital that monitoring of the Security Policy detects and reports any unauthorized changes in the security configurations. &lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section shall be set up. In this case, you have to add the condition for the next methods: projects.getIamPolicy, projects.setIamPolicy, organizations.getIamPolicy and organizations.setIamPolicy&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Modify IAM policy" url="https://cloud.google.com/logging/docs/audit/configure-data-access?hl=es-419#getiampolicy-setiampolicy"/>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify for security policy changes.&lt;br /&gt;
-5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON13" name="Create alerts for the Logging of configuration changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the Logging of configuration changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts for Logging changes to monitor, audit and notify about changes in this section by the corresponding personnel. It's vital that any unauthorized changes are detected and reported.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. You don't have to change it.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the Logging of configuration changes.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON10" name="Create alerts for the VPC route table changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for the VPC route table changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC Route Table changes. It's vital that monitoring of the VPC Route Table detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the VPC route table configuration changes.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON11" name="Create alerts for VPC gateway changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for VPC gateway changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC Gateway changes. It's vital that monitoring of the VPC Gateway detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;br&gt; 1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt;- The Conditions section is already set up. Fill the condition correctly.&lt;br&gt;- In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt;- In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the VPC gateway configuration changes.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON09" name="Create alerts for VPC NACL changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts for VPC NACL changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC NACL (Network Access Control List) changes. It's vital that monitoring of VPC NACL detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the VPC NACL configuration changes.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON08" name="Create alerts to be notified about console login failure attempts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts to be notified about console login failure attempts&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and to be notified when there are several console login failure attempts. It's vital that monitoring of these connection attempts detects and reports any unauthorized access to the systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the console login failure attempts are greater than a fixed number.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON05" name="Create alerts to be notified about console login without 2FA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts to be notified about console login without 2FA&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when users log into the console without a Second Factor of Authentication. It's vital that monitoring of authentication to systems detects and reports any unauthorized access to them.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when users are logged into the console without using 2 Factor authentication&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON04" name="Create alerts to detect the changes of activity alerts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts to detect the changes of activity alerts&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about the changes of Monitoring alerts. It's vital that the monitoring of alerts detects and reports any unauthorized changes in the Monitoring systems.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. You don't have to change it.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify about the changes of activity alerts.&lt;br /&gt;
-5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON02A" name="Create alerts to notify about improper usage of the root account" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts to notify about improper usage of the root account&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about usage of the root account when this account is used frequently. It's vital that monitoring of root account usage detects and reports unauthorized or improper usage.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-            <reference name="Managing metric-based alerting policies" url="https://cloud.google.com/monitoring/alerts/using-alerting-ui"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify about improper usage of administrator accounts.&lt;br /&gt;
-5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.567">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON07" name="Create alerts when the data encryption changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create alerts when the data encryption changes&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the data encryption changes. It's vital that monitoring of data encryption detects and reports any unauthorized changes in the system configurations.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
-2. In the navigation pane, select Alerting.&lt;br /&gt;
-3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
-4. Check there exists an Alerting Policy to notify when the data encryption configuration changes.&lt;br /&gt;
-5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-MON01" name="Create an uptime check to alert when the server is down" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create an uptime check to alert when the server is down&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Create an uptime check to verify your web server is always accessible. The alerting policy controls who is notified when the uptime check fails.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create an uptime check and an alerting policy&lt;/p&gt; 
-&lt;p&gt;To create an uptime check, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br&gt; 2. In the navigation pane, click Uptime checks.&lt;br&gt; 3. Click Create Uptime check.&lt;br&gt; 4. For the title, enter My Uptime Check and then click Next.&lt;br&gt; 5. Target:&lt;br&gt; a. Select HTTP as the protocol.&lt;br&gt; b. Select Instance as the Resource Type.&lt;br&gt; c. In the Applies To field, select Single and for the instance name select lamp-1-vm.&lt;br&gt; d. Leave all other fields at their default values and click Next.&lt;br&gt; 6. Response Validation: Leave these fields at their default values and click Next&lt;br&gt; 7. Alert &amp;amp; Notification:&lt;br&gt; a. Ensure that the toggle's label is Alerting is enabled.&lt;br&gt; b. Leave the name and duration fields at their default values.&lt;br&gt; c. To add a notification channel to the alerting policy, in the text box labeled Notification channels, click Menu. Select the channels to add and click OK. The notifications are grouped alphabetically for each channel type.&lt;br&gt; To add an entry to the checkbox list, click Manage notification channels and follow the instructions. When you return to this dialog, click Refresh.&lt;br&gt; 8. To verify your uptime check configuration, click Test. If you see a "Connection error - refused" message, you might have not installed the Apache HTTP Server or you might have specified the HTTPS check type rather than HTTP.&lt;br&gt; 9. Click Create. When the create action is successful, the message Check and alert created is displayed and then the Uptime checks dashboard page is displayed.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: monitoring gs checks" url="https://cloud.google.com/monitoring/quickstart-lamp#gs-checks"/>
-            <reference name="Monitor a Compute Engine virtual machine" url="https://cloud.google.com/monitoring/monitor-compute-engine-virtual-machine"/>
-          </references>
-          <standards>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;1. Check there exists an uptime Check alert to notify when the server is down.&lt;br /&gt;
-2. Check that this uptime Check alert is configured correctly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.567">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM07" name="Create a process to create and manage the Google Service Keys" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create a process or mechanism to create, manage, or revoke the assignment of keys to users and
-                        give them the least necessary access to resources. There are two types of service account keys:&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;GCP-managed keys:&lt;/b&gt;&amp;nbsp;These keys are used by Cloud Platform
-                        services such as the App Engine and Compute Engine. These keys cannot be downloaded. Google will
-                        keep the keys and automatically rotate them daily.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;&lt;b&gt;User-managed keys:&amp;nbsp;&lt;/b&gt;These keys are created, downloadable,
-                        and managed by users. For user-managed keys, you need to ensure you have processes in place to
-                        address key management requirements such as:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Key storage&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Key distribution&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Key revocation&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Key rotation&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Protecting the keys from unauthorized users.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: IAM manage account keys" url="https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check there exists a mechanism or process to create, manage or revoke the assignment of
-                            keys to users.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM05" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create individual accounts for administrator users and with these new accounts perform the necessary administrative actions. By creating service accounts for people accessing your account, you can give each Google user a unique set of security credentials and roles.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The administrator accounts shall be used for administrative actions and for giving or revoking credentials to users' accounts. The administrator account shall be not used as a normal user account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console and open the IAM page.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click Select a project.&lt;/li&gt; 
-  &lt;li&gt;Select your project and click Open.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click Create Service Account.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Enter a service account name, select a role you wish to grant to the service account and click Create.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: manage service accounts" url="https://cloud.google.com/iam/docs/creating-managing-service-accounts"/>
-          </references>
-          <standards>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console and open the IAM
-                            page.&lt;/li&gt;
-                            &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select your project and click Open.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Review that each administrator user has an individual Google Service Account.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-LOG04" name="Create log metric filters and alerts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create log metric filters and alerts&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use log-based alerts to notify you whenever a specific message appears in your included logs. For example, if you want to know when an audit log records a particular data-access message, you can create a log-based alert that matches the message and notifies you when it appears.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Create a log-based alert (Logs Explorer)&lt;/p&gt; 
-&lt;p&gt;You can create log-based alerts from the Logs Explorer page in the Google Cloud console or by using the Monitoring API.&lt;/p&gt; 
-&lt;p&gt;The Logs Explorer interface for creating and editing log-based alerts guides you through the following steps:&lt;/p&gt; 
-&lt;p&gt;- Provide a name and description for the alert.&lt;br&gt; - Choose the logs for which you want to receive a notification.&lt;br&gt; - Set the time between notifications.&lt;br&gt; - Set the time for automatic closure of incidents.&lt;br&gt; - Specify whom to notify.&lt;/p&gt; 
-&lt;p&gt;For example, assume that you have an application that writes a syslog log entry with NOTICE severity when the application changes a network address. The log entries for network-address changes include a JSON payload that looks like the following:&lt;/p&gt; 
-&lt;p&gt;"jsonPayload": { "type": "Configuration change", "action": "Set network address", "result": "IP_ADDRESS",&lt;br&gt; }&lt;/p&gt; 
-&lt;p&gt;You want to create a log-based alert that notifies you when an invalid IPv4 address appears in the jsonPayload.result field of log entries in syslog with NOTICE severity.&lt;/p&gt; 
-&lt;p&gt;To create the log-based alert, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the Cloud console, select Logging, and then select Logs Explorer:&lt;/p&gt; 
-&lt;p&gt;2. Use the Query pane to build a query that matches the message you want to use in your log-based alert.&lt;/p&gt; 
-&lt;p&gt;For example, to find log entries with a severity level of NOTICE in the syslog log that have invalid IP addresses in the JSON payload, you can use the following query:&lt;/p&gt; 
-&lt;p&gt;log_id("syslog")&lt;br&gt; severity = "NOTICE"&lt;br&gt; jsonPayload.result !~ "^((25[0-5]|2[0-4][0-9]|&lt;sup&gt;&lt;a&gt;01&lt;/a&gt;&lt;/sup&gt;?[0-9][0-9]?)(\.|$)){4}$"&lt;/p&gt; 
-&lt;p&gt;Use Run query in the Query results pane to validate the query.&lt;/p&gt; 
-&lt;p&gt;3. In the header of the Query results pane, click Create alert. When your window is narrow, the Create alert option might appear on the Actions menu instead.&lt;/p&gt; 
-&lt;p&gt;4. In the Alert details pane, give the alert a name and description:&lt;/p&gt; 
-&lt;p&gt;a. Enter a name for your alert in the Alert Name field. For example: "Network address: invalid IPv4 value".&lt;/p&gt; 
-&lt;p&gt;b. Enter a description of this alert. You can also include information that might help the recipient of a notification diagnose the problem. The following string summarizes the reason for the alert:&lt;/p&gt; 
-&lt;p&gt;Log-based alert in project ${project} detected an invalid IPv4 value..&lt;/p&gt; 
-&lt;p&gt;5. To advance to the next step, click Next.&lt;/p&gt; 
-&lt;p&gt;6. In the Choose logs to include in the alert pane, check the query and results by clicking Preview logs.&lt;/p&gt; 
-&lt;p&gt;Google Cloud recommends building the query in the Logs Explorer Query pane. The query you built in the Query pane is also displayed on this pane, for example:&lt;/p&gt; 
-&lt;p&gt;log_id("syslog")&lt;br&gt; severity = "NOTICE"&lt;br&gt; jsonPayload.result !~ "^((25[0-5]|2[0-4][0-9]|&lt;sup&gt;&lt;a&gt;01&lt;/a&gt;&lt;/sup&gt;?[0-9][0-9]?)(\.|$)){4}$"&lt;/p&gt; 
-&lt;p&gt;You can edit the query in this pane, if necessary. If you edit the query, then check the results by clicking Preview logs.&lt;/p&gt; 
-&lt;p&gt;7. Click Next.&lt;/p&gt; 
-&lt;p&gt;8. Select the minimum time between notifications. This value lets you control the number of notifications you get from this alert if it is triggered multiple times. For this example, select 5 min from the options.&lt;/p&gt; 
-&lt;p&gt;You can leave the incident auto-close duration at the default value, or you can set it to a different value by selecting a different option on the menu.&lt;/p&gt; 
-&lt;p&gt;9. Click Next.&lt;/p&gt; 
-&lt;p&gt;10. Select one or more notification channels for your alert. For this example, select an email notification channel.&lt;/p&gt; 
-&lt;p&gt;If you already have an email notification channel configured, then you can select it from the list. If not, click Manage notification channels and add an email channel. For information about creating notification channels, see Managing notification channels.&lt;/p&gt; 
-&lt;p&gt;11. Click Save.&lt;/p&gt; 
-&lt;p&gt;Your log-based alert is now ready to test.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-            <reference name="Managing log-based alerts" url="https://cloud.google.com/logging/docs/alerting/log-based-alerts"/>
-          </references>
-          <standards>
-            <standard ref="2.10" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.10" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.11" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.11" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.4" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.4" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.5" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.5" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.6" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.6" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.7" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.7" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.8" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.8" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="2.9" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.9" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Test the example log-based alert&lt;/p&gt;
-
-	&lt;p&gt;To test the alert you created in the Description section, you can manually write a log entry that matches the query. To write the log entry, do the following:&lt;/p&gt;
-
-	&lt;p&gt;1. Configure the following log entry by changing the PROJECT_ID variable to your project ID:&lt;/p&gt;
-
-	&lt;p&gt;{
-  "entries": [
-  {
-    "logName": "projects/PROJECT_ID/logs/syslog",
-    "jsonPayload": {
-      "type": "Configuration change",
-      "action": "Set network address",
-      "result": "999.027.405.1",
-    },
-    "severity": "NOTICE",
-    "resource": {
-      "type": "generic_task",
-      "labels" : {
-        "project_id": "PROJECT_ID",
-        "location": "us-east1",
-        "namespace": "fake-task-2",
-        "job": "write-log-entry",
-        "task_id": "11",
-      },
-    },
-  ],&lt;br /&gt;
-}&lt;/p&gt;
-
-	&lt;p&gt;2. Go to the logEntries.write reference page, or click the following button:&lt;/p&gt;
-
-	&lt;p&gt;3. Copy the log entry you configured previously.&lt;/p&gt;
-
-	&lt;p&gt;4. In the Try this API pane, do the following:&lt;/p&gt;
-
-	&lt;p&gt;a. Replace the content of the Request body field in APIs Explorer with the log entry you copied in the previous step.&lt;/p&gt;
-
-	&lt;p&gt;b. Click Execute. If prompted, follow the authentication flow.&lt;/p&gt;
-
-	&lt;p&gt;If the logEntries.write call is successful, then you get an HTTP 200 response code and an empty response body, {}.&lt;/p&gt;
-
-	&lt;p&gt;The log entry matches the filter specified for the alert in the following ways:&lt;/p&gt;
-
-	&lt;p&gt;- The logName value specifies the syslog log in your Cloud project.&lt;br /&gt;
-- The severity value for this log entry is NOTICE.&lt;br /&gt;
-- The jsonPayload.result value is not a valid IPv4 address.&lt;/p&gt;
-
-	&lt;p&gt;After you write the log entry, the following sequence occurs:&lt;/p&gt;
-
-	&lt;p&gt;- The new log entry appears in the Logs Explorer and triggers the alert.&lt;br /&gt;
-- An incident is opened in Cloud Monitoring.&lt;br /&gt;
-- You receive a notification for the incident. If you configured an email notification channel, then the notification looks like the following screenshot:&lt;/p&gt;
-
-	&lt;p&gt;You can click View incident in the email to see the incident in Cloud Monitoring.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM04" name="Create mechanisms to ensure Least Privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create mechanisms to periodically review the group and user permissions to ensure the least
-                        privilege for the user accounts. Granting least privilege ensures that users only have the
-                        permissions required to complete their tasks rather than additional privileges that are not
-                        required. Following this model ensures that, should an account be compromised, the blast radius
-                        of damage is limited.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC with
-                        pre-defined policies added into groups or roles&amp;quot;.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Open the IAM page in the Google Cloud Platform Console and open the IAM page.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select a project and click Open.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Review the groups and users with access to the project and their permissions.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;If there is a user with more privileges, revoke the access as following:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Select the user to revoke privileges.&lt;/li&gt;
-                        &lt;li&gt;In the Roles(s) drop-down menu in the member's row, uncheck the roles you want to
-                        revoke and click Save.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Granting, changing, and revoking access to resources" url="https://cloud.google.com/iam/docs/granting-changing-revoking-access"/>
-          </references>
-          <standards>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check there is a mechanism in place to ensure the enforcement of the Least Privilege
-                            principle.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM02" name="Define roles for the Google Service Accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Define and create the roles for the Google Cloud. For each role, you can use one of the
-                        predefined roles or create a new custom role to ensure that each role has got the least minimum
-                        permissions.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;List all predefined roles and review them.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;If it's necessary, create new custom roles to ensure users have the least privileges.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;List all roles.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all fulfill the least privilege principle.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all roles are defined correctly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-LOG-03" name="Enable Access Approval" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Controlling access to your information is one of the foundations of information security. Google Employees do have access to your organizations' projects for support reasons. With Access Approval, organizations can then be certain that their information is accessed by only approved Google Personnel.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To use Access Approval your organization will need have enabled Access Transparency and have at one of the following support level: Enhanced or Premium. There will be subscription costs associated with these support levels, as well as increased storage costs for storing the logs. You will also not be able to turn the Access Transparency which Access Approval depends on, off yourself. To do so you will need to submit a service request to Google Cloud Support. There will also be additional overhead in managing user permissions. There may also be a potential delay in support times as Google Personnel will have to wait for their access to be approved.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be displayed here. On this screen, there is an option to click Enroll. If it is greyed out and you see an error bar at the top of the screen that says Access Transparency is not enabled please view the corresponding reference within this section to enable it.&lt;/li&gt;&lt;li&gt;In the second screen click Enroll.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Grant an IAM Group or User the role with permissions to Add Users to be Access Approval message Recipients&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the IAM and Admin. Select IAM in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button the says +add at the top of the screen.&lt;/li&gt;&lt;li&gt;In the principals field, select a user or group by typing in their associated email address.&lt;/li&gt;&lt;li&gt;Click on the role field to expand it. In the filter field enter Access Approval Approver and select it.&lt;/li&gt;&lt;li&gt;Click save.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Add a Group or User as an Approver for Access Approval Requests&lt;/p&gt;&lt;ol&gt;&lt;li&gt;As a user with the Access Approval Approver permission, within the project where you wish to add an email address to which request will be sent, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click Manage Settings&lt;/li&gt;&lt;li&gt;Under Set up approval notifications, enter the email address associated with a Google Cloud User or Group you wish to send Access Approval requests to. All future access approvals will be sent as emails to this address.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From CLI:&lt;/p&gt;&lt;p&gt;To update all services in an entire project, run the following command from an account that has permissions as an 'Approver for Access Approval Requests'&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud access-approval settings update --project=&amp;lt;project name&amp;gt; --enrolled_services=all --notification_emails='&amp;lt;email recipient for access approval requests&amp;gt;@&amp;lt;domain name&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Access Approval and its dependency of Access Transparency are not enabled.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Access Approval" url="https://cloud.google.com/cloud-provider-access-management/access-approval/docs/overview"/>
-          </references>
-          <standards>
-            <standard ref="2.15" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Determine if Access Transparency is Enabled as it is a Dependency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home inside the project you wish to audit, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status should be "Enabled' under the heading Access Transparency&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Determine if Access Approval is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be displayed here. If you see a screen saying you need to enroll in Access Approval, it is not enabled.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From CLI:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Determine if Access Approval is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;From within the project you wish to audit, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud access-approval settings get&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;The status will be displayed in the output.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-LOG-02" name="Enable Access Transparency" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Controlling access to your information is one of the foundations of information security. Given that Google Employees do have access to your organizations' projects for support reasons, you should have logging in place to view who, when, and why your information is being accessed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;To use Access Transparency your organization will need to have at one of the following support level: Premium, Enterprise, Platinum, or Gold. There will be subscription costs associated with support, as well as increased storage costs for storing the logs. You will also not be able to turn Access Transparency off yourself, and you will need to submit a service request to Google Cloud Support.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Add privileges to enable Access Transparency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the 'IAM and Admin'. Select IAM in the top of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button the says +add at the top of the screen.&lt;/li&gt;&lt;li&gt;In the principals field, select a user or group by typing in their associated email address.&lt;/li&gt;&lt;li&gt;Click on the role field to expand it. In the filter field enter Access Transparency Admin and select it.&lt;/li&gt;&lt;li&gt;Click save.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Verify that the Google Cloud project is associated with a billing account&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Select Billing.&lt;/li&gt;&lt;li&gt;If you see This project is not associated with a billing account you will need to enter billing information or switch to a project with a billing account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Enable Access Transparency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button labeled Enable Access Transparency for Organization&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Access Transparency is not enabled.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Access Transparency" url="https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/overview"/>
-          </references>
-          <standards>
-            <standard ref="2.14" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.14" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Determine if Access Transparency is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be under the heading Access Transparency. Status should be Enabled&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-LOG01" name="Enable all access logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable all access logs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Enable all audit logs in the Google Cloud Platform to control and monitor the access of users and the configuration changes in the systems. &lt;br&gt; First, you have to know there are two types of audit logs in the Google Cloud Platform: &lt;br&gt; - Admin Activity audit logs that are enabled for all services and cannot be configured.&lt;br&gt; - Data Access audit logs that are not enabled by default and they shall be configured.&lt;/p&gt; 
-&lt;p&gt;Remediation: &lt;br&gt; Configure Data Access audit logs with the Cloud console&lt;/p&gt; 
-&lt;p&gt;You can also use the API or the Google Cloud CLI to perform these tasks programmatically.&lt;/p&gt; 
-&lt;p&gt;To access audit log configuration options in the Cloud console, follow these steps:&lt;/p&gt; 
-&lt;p&gt;1. From the Cloud console, select IAM &amp;amp; Admin &amp;gt; Audit Logs:&lt;/p&gt; 
-&lt;p&gt;2. Select an existing Cloud project, folder, or organization at the top of the page.&lt;/p&gt; 
-&lt;p&gt;Enable audit logs&lt;/p&gt; 
-&lt;p&gt;To enable Data Access audit logs, do the following:&lt;/p&gt; 
-&lt;p&gt;1. In the main table on the Audit Logs page, select one or more Google Cloud services from the Title column.&lt;/p&gt; 
-&lt;p&gt;2. In the Log Type tab, select the Data Access audit log types that you want to enable and then click Save.&lt;/p&gt; 
-&lt;p&gt;3. Where you have successfully enabled audit logs, the table includes a checkmark. In the following example, you see that, for the Cloud Composer API service, Admin Read and Data Read audit logs are enabled:&lt;/p&gt; 
-&lt;p&gt;You can also enable audit logs for all Google Cloud services that produce Data Access audit logs. In the main table on the Audit Logs page, select all Google Cloud services.&lt;/p&gt; 
-&lt;p&gt;Note that this bulk configuration method applies only to the Google Cloud services that are currently available. If a new Google Cloud service is added, it inherits your default audit configuration.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure Data Access audit logs" url="https://cloud.google.com/logging/docs/audit/configure-data-access#config-console"/>
-            <reference name="Google Cloud docs: data access" url="https://cloud.google.com/logging/docs/audit/configure-data-access#project-and-organization"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Check that all audit logs in the Google Cloud Platform are enabled and configured.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-LOG-01" name="Enable Cloud Asset Inventory" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;It is recommended GCP Cloud Asset Inventory be enabled for all GCP projects.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;1Go to API &amp;amp; Services/Library by visiting https://console.cloud.google.com/apis/library&lt;/li&gt;&lt;li&gt;Search for Cloud Asset API and select the result for Cloud Asset API&lt;/li&gt;&lt;li&gt;Click the ENABLE button.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API:&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API through the services interface:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services enable cloudasset.googleapis.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The Cloud Asset Inventory API is disabled by default in each project.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Asset Inventory" url="https://cloud.google.com/asset-inventory/docs"/>
-          </references>
-          <standards>
-            <standard ref="2.13" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.13" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that the Cloud Asset API is enabled:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to API &amp;amp; Services/Library by visiting https://console.cloud.google.com/apis/library&lt;/li&gt;&lt;li&gt;Search for Cloud Asset API and select the result for Cloud Asset API&lt;/li&gt;&lt;li&gt;Ensure that API Enabled is displayed.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that the Cloud Asset API is enabled:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Query enabled services:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services list --enabled --filter=name:cloudasset.googleapis.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If the API is listed, then it is enabled. If the response is Listed 0 items the API is not enabled.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM15" name="Enable MFA for all non-service accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Load balancers are used to efficiently distribute traffic across multiple servers. Both SSL proxy and HTTPS load balancers are external load balancers, meaning they distribute traffic from the Internet to a GCP network. GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible cipher suites. To comply with users using outdated protocols, GCP load balancers can be configured to permit insecure cipher suites. In fact, the GCP default SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites. As a result, it is easy for customers to configure a load balancer without even knowing that they are permitting outdated cipher suites.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Creating more secure SSL policies can prevent clients using older TLS versions from establishing a connection.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console: If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy.&lt;/p&gt;&lt;p&gt;1. Navigate to the SSL Policies page by visiting: https://console.cloud.google.com/net-security/sslpolicies&lt;/p&gt;&lt;p&gt;2. Click on the name of the insecure policy to go to its SSL policy details page.&lt;/p&gt;&lt;p&gt;3. Click EDIT.&lt;/p&gt;&lt;p&gt;4. Set Minimum TLS version to TLS 1.2.&lt;/p&gt;&lt;p&gt;5. Set Profile to Modern or Restricted.&lt;/p&gt;&lt;p&gt;6. Alternatively, if teh user selects the profile Custom, make sure that the following features are disabled:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. For each insecure SSL policy, update it to use secure cyphers:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute ssl-policies update NAME [--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] --min-tls-version 1.2 [--custom-features FEATURES]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. If the target proxy has a GCP default SSL policy, use the following command corresponding to the proxy type to update it.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME --ssl-policy SSL_POLICY_NAME&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME --ssl-policy SSL_POLICY_NAME&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.2" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.2" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. See all load balancers by visiting https://console.cloud.google.com/net-services/loadbalancing/loadBalancers/list.&lt;/p&gt;&lt;p&gt;2. For each load balancer for SSL (Proxy) or HTTPS, click on its name to go the Load balancer details page.&lt;/p&gt;&lt;p&gt;3. Ensure that each target proxy entry in the Frontend table has an SSL Policy configured.&lt;/p&gt;&lt;p&gt;4. Click on each SSL policy to go to its SSL policy details page.&lt;/p&gt;&lt;p&gt;5. Ensure that the SSL policy satisfies one of the following conditions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;has a Min TLS set to TLS 1.2 and Profile set to Modern profile, or&lt;/li&gt;&lt;li&gt;has Profile set to Restricted. Note that a Restricted profile effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version, or&lt;/li&gt;&lt;li&gt;has Profile set to Custom and the following features are all disabled:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all TargetHttpsProxies and TargetSslProxies.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-https-proxies list gcloud compute target-ssl-proxies list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. For each target proxy, list its properties:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-https-proxies describe TARGET_HTTPS_PROXY_NAME gcloud compute target-ssl-proxies describe TARGET_SSL_PROXY_NAME&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure that the sslPolicy field is present and identifies the name of the SSL policy: sslPolicy: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/sslPolicies/SSL_POLICY_NAME&lt;/p&gt;&lt;p&gt;If the sslPolicy field is missing from the configuration, it means that the GCP default policy is used, which is insecure.&lt;/p&gt;&lt;p&gt;4. Describe the SSL policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute ssl-policies describe SSL_POLICY_NAME&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;5. Ensure that the policy satisfies one of the following conditions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;has Profile set to Modern and minTlsVersion set to TLS_1_2, or&lt;/li&gt;&lt;li&gt;has Profile set to Restricted, or&lt;/li&gt;&lt;li&gt;has Profile set to Custom and enabledFeatures does not contain any of the following values:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM16" name="Enable Security Key Enforcement for all admin accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Setup Security Key Enforcement for Google Cloud Platform admin accounts.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Google Cloud Platform users with Organization Administrator roles have the highest level of privilege in the organization. These accounts should be protected with the strongest form of two-factor authentication: Security Key Enforcement. Ensure that admins use Security Keys to log in instead of weaker second factors like SMS or one-time passwords (OTP). Security Keys are actual physical keys used to access Google Organization Administrator Accounts. They send an encrypted signature rather than a code, ensuring that logins cannot be phished.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If an organization administrator loses access to their security key, the user could lose access to their account. For this reason, it is important to set up backup security keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Step 1: Identify users with the Organization Administrator role.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Step 2: Setup Security Key Enforcement for each account. Learn more at: https://cloud.google.com/security-key/&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.3" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Step 1: Identify users with Organization Administrator privileges:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud organizations get-iam-policy ORGANIZATION_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Look for members granted the role "roles/resourcemanager.organizationAdmin".&amp;nbsp;&lt;/p&gt;&lt;p&gt;Step 2: Manually verify that Security Key Enforcement has been enabled for each account.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET08" name="Enable VPC Flow Logs for every subnet in a VPC Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;VPC networks and subnetworks not reserved for internal HTTP(S) load balancing provide logically isolated and secure network partitions where GCP resources can be launched. When Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows. Each VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet. If two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows.&lt;/p&gt;&lt;p&gt;Flow Logs supports the following use cases:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Network monitoring&lt;/li&gt;&lt;li&gt;Understanding network usage and optimizing network traffic expenses&lt;/li&gt;&lt;li&gt;Network forensics&lt;/li&gt;&lt;li&gt;Real-time security analysis&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Flow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows.&lt;/p&gt;&lt;p&gt;Note: Subnets reserved for use by internal HTTP(S) load balancers do not support VPC flow logs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference: https://cloud.google.com/vpc/&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list&lt;/p&gt;&lt;p&gt;2. Click the name of a subnet, The Subnet details page displays.&lt;/p&gt;&lt;p&gt;3. Click the EDIT button.&lt;/p&gt;&lt;p&gt;4. Set Flow Logs to On.&lt;/p&gt;&lt;p&gt;5. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;To set Private Google access for a network subnet, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks subnets update [SUBNET_NAME] --region [REGION] --enable-flow-logs&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.8" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list&lt;/p&gt;&lt;p&gt;2. From the list of network subnets, make sure for each subnet Flow Logs is set to On&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks list --format json | \ jq -r '.[].subnetworks | .[]' | \ xargs -I {} gcloud compute networks subnets describe {} --format json | \ jq -r '. | "Subnet: \(.name) Purpose: \(.purpose) VPC Flow Log Enabled: \(has("enableFlowLogs"))"'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The output of the above command will list each subnet, the subnet's purpose, and a true or false value if Flow Logs are enabled. If the subnet's purpose is PRIVATE then Flow Logs should be true.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-IAM-02" name="Encrypt Dataproc Cluster using Customer-Managed Encryption Key" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Cloud services offer the ability to protect data related to those services using encryption keys managed by the customer within Cloud KMS. These encryption keys are called customer-managed encryption keys (CMEK). When you protect data in Google Cloud services with CMEK, the CMEK key is within your control.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.&lt;/li&gt;&lt;li&gt;Select the project from the projects dropdown list.&lt;/li&gt;&lt;li&gt;On the Dataproc Cluster page, click on the Create Cluster to create a new cluster with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;On Create a cluster page, perform below steps:&lt;ol&gt;&lt;li&gt;Inside Set up cluster section perform below steps: -In the Name textbox, provide a name for your cluster.&lt;ol&gt;&lt;li&gt;From Location select the location in which you want to deploy a cluster.&lt;/li&gt;&lt;li&gt;Configure other configurations as per your requirements.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Inside Configure Nodes and Customize cluster section configure the settings as per your requirements.&lt;/li&gt;&lt;li&gt;Inside Manage security section, perform below steps:&lt;ol&gt;&lt;li&gt;From Encryption, select Customer-managed key.&lt;/li&gt;&lt;li&gt;Select a customer-managed key from dropdown list.&lt;/li&gt;&lt;li&gt;Ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account ("serviceAccount:service-&amp;lt;project_number&amp;gt;@compute-system.iam.gserviceaccount.com").&lt;/li&gt;&lt;li&gt;Click on Create to create a cluster.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Once the cluster is created migrate all your workloads from the older cluster to the new cluster and delete the old cluster by performing the below steps:&lt;ol&gt;&lt;li&gt;On the Clusters page, select the old cluster and click on Delete cluster.&lt;/li&gt;&lt;li&gt;On the Confirm deletion window, click on Confirm to delete the cluster.&lt;/li&gt;&lt;li&gt;Repeat step above for other Dataproc clusters available in the selected project.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Change the project from the project dropdown list and repeat the remediation procedure for other Dataproc clusters available in other projects.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;p&gt;Before creating cluster ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account ("serviceAccount:service-&amp;lt;project_number&amp;gt;@compute-system.iam.gserviceaccount.com"). Run clusters create command to create new cluster with customer-managed key:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters create &amp;lt;cluster_name&amp;gt; --region=us-central1 --gce-pd-kms-key=&amp;lt;key_resource_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The above command will create a new cluster in the selected region. Once the cluster is created migrate all your workloads from the older cluster to the new cluster and Run clusters delete command to delete cluster:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters delete &amp;lt;cluster_name&amp;gt; --region=us-central1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat step no. 1 to create a new Dataproc cluster. Change the project by running the below command and repeat the remediation procedure for other projects:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;project_ID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Encryption at rest in Google Cloud" url="https://cloud.google.com/security/encryption-at-rest/default-encryption"/>
-          </references>
-          <standards>
-            <standard ref="1.17" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.&lt;/li&gt;&lt;li&gt;Select the project from the project dropdown list.&lt;/li&gt;&lt;li&gt;On the Dataproc Clusters page, select the cluster and click on the Name attribute value that you want to examine.&lt;/li&gt;&lt;li&gt;On the details page, select the Configurations tab.&lt;/li&gt;&lt;li&gt;On the Configurations tab, check the Encryption type configuration attribute value. If the value is set to Google-managed key, then Dataproc Cluster is not encrypted with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;Repeat step no. 3 - 5 for other Dataproc Clusters available in the selected project.&lt;/li&gt;&lt;li&gt;Change the project from the project dropdown list and repeat the audit procedure for other projects.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Run clusters list command to list all the Dataproc Clusters available in the region:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters list --region='us-central1'&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Run clusters describe command to get the key details of the selected cluster:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters describe &amp;lt;cluster_name&amp;gt; --region=us-central1 --flatten=config.encryptionConfig.gcePdKmsKeyName&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;If the above command output return "null", then the selected cluster is not encrypted with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;Repeat step no. 2 and 3 for other Dataproc Clusters available in the selected region. Change the region by updating --region and repeat step no. 2 for other clusters available in the project. Change the project by running the below command and repeat the audit procedure for other Dataproc clusters available in other projects:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;project_ID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM11" name="Enforce separation of duties" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;The built-in/predefined IAM role Cloud KMS Admin allows the user/identity to create, delete, and manage service account(s). The built-in/predefined IAM role Cloud KMS CryptoKey Encrypter/Decrypter allows the user/identity (with adequate privileges on concerned resources) to encrypt and decrypt data at rest using an encryption key(s).&lt;/p&gt;&lt;p&gt;The built-in/predefined IAM role Cloud KMS CryptoKey Encrypter allows the user/identity (with adequate privileges on concerned resources) to encrypt data at rest using an encryption key(s). The built-in/predefined IAM role Cloud KMS CryptoKey Decrypter allows the user/identity (with adequate privileges on concerned resources) to decrypt data at rest using an encryption key(s).&lt;/p&gt;&lt;p&gt;Separation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action. In Cloud KMS, this could be an action such as using a key to access and decrypt data a user should not normally have access to. Separation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors. It is considered best practice.&lt;/p&gt;&lt;p&gt;No user(s) should have Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter roles assigned at the same time.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removed roles should be assigned to another user based on business needs.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; Admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. For any member having Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter roles granted/assigned, click the Delete Bin icon to remove the role from the member.&lt;/p&gt;&lt;p&gt;Note: Removing a role should be done based on the business requirement.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="1.8" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; Admin/IAM by visiting: https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Ensure no member has the roles Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter assigned.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all users and role assignments:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that there are no common users found in the member section for roles cloudkms.admin and any one of Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET02" name="Isolate Google Cloud resources into separate VNets by function" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Place the resources into separate VNets according to their use or function (production,
-                        development, test). Placing such resources accordingly ensures that a resource of a high
-                        security level is not exposed by the security settings of a lower labeled VNet.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Migrate or move it to the correct VNet.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Isolate resources" url="https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#use_projects_to_fully_isolate_resources"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Google Cloud resources are isolated and separated in several VNets by the
-                            function of the resources.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET01" name="Isolate groups of VM instances" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Use networks within projects to isolate groups of VM instances.
-
-                        Each project supports up to five isolated networks. Each network constitutes a global IP address
-                        space. This means that you can create resources, such as Google Compute Engine Virtual Machine
-                        (VM) instances, in multiple geographic regions, and the resources will share the same IP address
-                        space because they are on the same virtual network. Note that, despite the flat network address
-                        space, you still incur normal egress charges when you leave your zone. You can request a quota
-                        increase to support up to 15 isolated networks in each project.</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Isolate resources" url="https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#use_projects_to_fully_isolate_resources"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the projects are isolated using groups of VM instances.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM01" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Do regular reviews of service accounts on the system and verify they do not contain stolen or
-                        fake accounts. This process ensures there are not any compromised accounts by former employees
-                        or attackers.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least every 90 days complete the following:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Select your project and click Open. All service accounts are listed in the Service
-                        Accounts page.&lt;/li&gt;
-                        &lt;li&gt;For any user that should not exist, select the user and click the Delete button.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: manage service accounts" url="https://cloud.google.com/iam/docs/creating-managing-service-accounts"/>
-          </references>
-          <standards>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select your project and click Open. All service accounts are listed in the Service
-                            Accounts page.&lt;/li&gt;
-                            &lt;li&gt;Check that the necessary users appear in the list.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;And check that there is a process to review the access users at least every 90
-                            days.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM18" name="Remove Admin privileges on Service Account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Service accounts represent service-level security of the Resources (application or a VM) which can be determined by the roles assigned to it. Enrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM. A ServiceAccount Access holder can perform critical actions like delete, update change settings, etc. without user intervention. For this reason, it's recommended that service accounts not have Admin rights.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removing *Admin or *adminorEditororOwner` role assignments from service accounts may break functionality that uses impacted service accounts. Required role(s) should be assigned to impacted service accounts in order to restore broken functionalities.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Go to the Members&lt;/p&gt;&lt;p&gt;3. Identify User-Managed user created service account with roles containing *Admin or *admin or role matching Editor or role matching Owner&lt;/p&gt;&lt;p&gt;4. Click the Delete bin icon to remove the role from the member (service account in this case)&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json &amp;gt; iam.json&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;1. Using a text editor, Remove Role which contains roles/*Admin or roles/*admin or matched roles/editor or matches 'roles/owner`. Add a role to the bindings array that defines the group members and the role for those members.&lt;/p&gt;&lt;p&gt;2. Update the project's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects set-iam-policy PROJECT_ID iam.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.5" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Go to the Members&lt;/p&gt;&lt;p&gt;3. Ensure that there are no User-Managed user created service account(s) with roles containing *Admin or *admin or role matching Editor or role matching Owner&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. Get the policy that you want to modify, and write it to a JSON file: gcloud projects get-iam-policy PROJECT_ID --format json &amp;gt; iam.json&lt;/p&gt;&lt;p&gt;2. The contents of the JSON file will look similar to the following. Note that role of members group associated with each serviceaccount does not contain *Admin or *admin or does not match roles/editor or does not match roles/owner.&lt;/p&gt;&lt;p&gt;This recommendation is only applicable to User-Managed user-created service accounts. These accounts have the nomenclature: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com. Note that some Google-managed, Google-created service accounts have the same naming format, and should be excluded (e.g., appsdev-apps-dev-script-auth@system.gserviceaccount.com which needs the Owner role).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET03" name="Remove default and legacy networks" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;order to prevent use of legacy networks, a project should not have a legacy network configured.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. The network is global in scope and spans all cloud regions. Subnetworks cannot be created in a legacy network and are unable to switch from legacy to auto or custom subnet networks. Legacy networks can have an impact for high network traffic projects and are subject to a single point of contention or failure.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;For each Google Cloud Platform project,&lt;/p&gt;&lt;p&gt;1. Follow the documentation and create a non-legacy network suitable for the organization's requirements.&lt;/p&gt;&lt;p&gt;2. Follow the documentation and delete the networks in the legacy mode.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="3.2" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For each Google Cloud Platform project,&lt;/p&gt;&lt;p&gt;1. Set the project name in the Google Cloud Shell:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;Project-ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. List the networks configured in that project:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;None of the listed networks should be in the legacy mode.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM14" name="Restrict API key usage to call only APIs required by an application" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;API keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys are below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;In light of these potential risks, Google recommends using the standard authentication flow instead of API-Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;In order to reduce attack surfaces by providing least privileges, API-Keys can be restricted to use (call) only APIs required by an application.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Setting API restrictions may break existing application functioning, if not done carefully.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. In the Key restrictions section go to API restrictions.&lt;/p&gt;&lt;p&gt;4. Click the Select API drop-down to choose an API.&lt;/p&gt;&lt;p&gt;5. Click Save.&lt;/p&gt;&lt;p&gt;6. Repeat steps 2,3,4,5 for every unrestricted API key&lt;/p&gt;&lt;p&gt;Note: Do not set API restrictions to Google Cloud APIs, as this option allows access to all services offered by Google cloud.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.14" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. For every API Key, ensure the section Key restrictions parameter API restrictions is not set to None.&lt;/p&gt;&lt;p&gt;Or, Ensure API restrictions is not set to Google Cloud APIs&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note: Google Cloud APIs represents the API collection of all cloud services/APIs offered by Google cloud.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM13" name="Restrict API key usage to trusted hosts and apps" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys appear below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;In light of these potential risks, Google recommends using the standard authentication flow instead of API keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;In order to reduce attack vectors, API-Keys can be restricted only to trusted hosts, HTTP referrers and applications.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Setting Application Restrictions may break existing application functioning, if not done carefully.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. In the Key restrictions section, set the application restrictions to any of HTTP referrers, IP Adresses, Android Apps, iOs Apps.&lt;/p&gt;&lt;p&gt;4. Click Save.&lt;/p&gt;&lt;p&gt;5. Repeat steps 2,3,4 for every unrestricted API key. Note: Do not set HTTP referrers to wild-cards (* or *.[TLD] or .[TLD]/) allowing access to any/wide HTTP referrer(s) Do not set IP addresses and referrer to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.13" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. For every API Key, ensure the section Key restrictions parameter Application restrictions is not set to None.&lt;/p&gt;&lt;p&gt;Or,&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure Application restrictions is set to HTTP referrers and the referrer is not set to wild-cards (* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Or,&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure Application restrictions is set to IP addresses and referrer is not set to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET07" name="Restrict RDP access from the Internet" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;/p&gt;&lt;p&gt;Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the Internet to a VPC or VM instance using RDP on Port 3389 can be avoided.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;GCP Firewall Rules within a VPC Network. These rules apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through RDP with the default Port 3389. Generic access from the Internet to a specific IP Range should be restricted.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;All Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where secure shell access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to RDP port for the concerned VPC(s).&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC Network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Click the Firewall Rule to be modified.&lt;/p&gt;&lt;p&gt;4. Click Edit.&lt;/p&gt;&lt;p&gt;5. Modify Source IP ranges to specific IP.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;1.Update RDP Firewall rule with new SOURCE_RANGE from the below command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.7" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Ensure Port is not equal to 3389 and Action is not Allow.&lt;/p&gt;&lt;p&gt;4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;&lt;p&gt;From Command Line: gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed.ports)'&lt;/p&gt;&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;SOURCE_RANGES is 0.0.0.0/0&lt;/li&gt;&lt;li&gt;AND DIRECTION is INGRESS&lt;/li&gt;&lt;li&gt;AND IPProtocol is TCP or ALL&lt;/li&gt;&lt;li&gt;AND PORTS is set to 3389 or range containing 3389 or Null (not set)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;li&gt;When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-NET06" name="Restrict SSH access from the Internet" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;/p&gt;&lt;p&gt;Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the internet to VPC or VM instance using SSH on Port 22 can be avoided.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;GCP Firewall Rules within a VPC Network apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through SSH with the default Port 22. Generic access from the Internet to a specific IP Range needs to be restricted.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;All Secure Shell (SSH) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH port for the concerned VPC(s).&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC Network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Click the Firewall Rule you want to modify.&lt;/p&gt;&lt;p&gt;4. Click Edit.&lt;/p&gt;&lt;p&gt;5. Modify Source IP ranges to specific IP.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line: 1.Update the Firewall rule with the new SOURCE_RANGE from the below command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Ensure that Port is not equal to 22 and Action is not set to Allow.&lt;/p&gt;&lt;p&gt;4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;&lt;p&gt;From Command Line: gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed)'&lt;/p&gt;&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;SOURCE_RANGES is 0.0.0.0/0&lt;/li&gt;&lt;li&gt;AND DIRECTION is INGRESS&lt;/li&gt;&lt;li&gt;AND IPProtocol is tcp or ALL&lt;/li&gt;&lt;li&gt;AND PORTS is set to 22 or range containing 22 or Null (not set)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;li&gt;When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM10" name="Rotate keys within a period of 90 days" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.&lt;/p&gt;&lt;p&gt;Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.&lt;/p&gt;&lt;p&gt;The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in ISO or RFC3339 format, and the rotation period must be in the form INTEGER[UNIT], where units can be one of seconds (s), minutes (m), hours (h) or days (d).&lt;/p&gt;&lt;p&gt;It is recommended to rotate API keys every 90 days.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys are listed below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Because of these potential risks, Google recommends using the standard authentication flow instead of API Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;Once a key is stolen, it has no expiration, meaning it may be used indefinitely unless the project owner revokes or regenerates the key. Rotating API keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used.&lt;/p&gt;&lt;p&gt;API keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Regenerating Key may break existing client connectivity as the client will try to connect with older API keys they have stored on devices.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;For user-managed/external keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Delete any external (user-managed) Service Account Key older than 90 days:&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. In the Section Service Account Keys, for every external (user-managed) service account key where creation date is greater than or equal to the past 90 days, click Delete Bin Icon to Delete Service Account key&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Create a new external (user-managed) Service Account Key for a Service Account:&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. Click Create Credentials and Select Service Account Key.&lt;/li&gt;&lt;li&gt;3. Choose the service account in the drop-down list for which an External (user-managed) Service Account key needs to be created.&lt;/li&gt;&lt;li&gt;4. Select the desired key type format among JSON or P12.&lt;/li&gt;&lt;li&gt;5. Click Create. It will download the private key. Keep it safe.&lt;/li&gt;&lt;li&gt;6. Click Close if prompted.&lt;/li&gt;&lt;li&gt;7. The site will redirect to the APIs &amp;amp; Services\Credentials page. Make a note of the new ID displayed in the Service account keys section.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For KMS keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;1. Go to Cryptographic Keys by visiting: https://console.cloud.google.com/security/kms.&lt;/li&gt;&lt;li&gt;2. Click on the specific key ring&lt;/li&gt;&lt;li&gt;3. From the list of keys, choose the specific key and Click on Right side pop up the blade (3 dots).&lt;/li&gt;&lt;li&gt;4. Click on Edit rotation period.&lt;/li&gt;&lt;li&gt;5. On the pop-up window, Select a new rotation period in days which should be less than 90 and then choose Starting on date (date from which the rotation period begins).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/li&gt;&lt;li&gt;3. Click REGENERATE KEY to rotate API key.&lt;/li&gt;&lt;li&gt;4. Click Save.&lt;/li&gt;&lt;li&gt;5. Repeat steps 2,3,4 for every API key that has not been rotated in the last 90 days.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note: Do not set HTTP referrers to wild-cards (* or *.[TLD] or .[TLD]/) allowing access to any/wide HTTP referrer(s) Do not set IP addresses and referrer to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;For KMS keys:&lt;/p&gt;&lt;p&gt;1. Update and schedule rotation by ROTATION_PERIOD and NEXT_ROTATION_TIME for each key: gcloud kms keys update new --keyring=KEY_RING --location=LOCATION --next-rotation-time=NEXT_ROTATION_TIME --rotation-period=ROTATION_PERIOD&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.10" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="1.15" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.15" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="1.7" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.7" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that all keys have a rotation period of 90 days.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-LOG07" name="Use Bucket Lock to configure retention policies" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Logs can be exported by creating one or more sinks that include a log filter and a destination. As Cloud Logging receives new log entries, they are compared against each sink. If a log entry matches a sink's filter, then a copy of the log entry is written to the destination.&lt;/p&gt; 
-&lt;p&gt;Sinks can be configured to export logs in storage buckets. It is recommended to configure a data retention policy for these cloud storage buckets and to lock the data retention policy; thus permanently preventing the policy from being reduced or removed. This way, if the system is ever compromised by an attacker or a malicious insider who wants to cover their tracks, the activity logs are definitely preserved for forensics and security investigations.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Set a retention policy on a bucket&lt;/p&gt; 
-&lt;p&gt;To add, modify, or remove a retention policy on a bucket:&lt;/p&gt; 
-&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt; 
-&lt;p&gt;2. In the list of buckets, click on the name of the bucket whose retention policy you want to change.&lt;/p&gt; 
-&lt;p&gt;3. Select the Protection tab near the top of the page.&lt;/p&gt; 
-&lt;p&gt;4. In the Retention policy section, set your retention policy:&lt;/p&gt; 
-&lt;p&gt;a. If no retention policy currently applies to the bucket, click the + Set Retention Policy link. Choose a unit of time and a length of time for your retention period.&lt;/p&gt; 
-&lt;p&gt;b. If a retention policy currently applies to a bucket, it appears in the section. Click Edit to modify the retention time or Delete to remove the retention policy entirely.&lt;/p&gt; 
-&lt;p&gt;Lock a bucket&lt;/p&gt; 
-&lt;p&gt;To lock a bucket and permanently restrict edits to the bucket's retention policy:&lt;/p&gt; 
-&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt; 
-&lt;p&gt;2. In the list of buckets, click on the name of the bucket that you want to lock the retention policy for.&lt;/p&gt; 
-&lt;p&gt;3. Select the Protection tab near the top of the page.&lt;/p&gt; 
-&lt;p&gt;4. In the Retention policy section, click the Lock button.&lt;/p&gt; 
-&lt;p&gt;The Lock retention policy? dialog box appears.&lt;/p&gt; 
-&lt;p&gt;5. Read the Permanent notice.&lt;/p&gt; 
-&lt;p&gt;6. In the Bucket name text box, type in the name of your bucket.&lt;/p&gt; 
-&lt;p&gt;7. Click Lock policy.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Locking a bucket is an irreversible action. Once you lock a bucket, you cannot remove the retention policy from the bucket or decrease the retention period for the policy.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-            <reference name="Retention policies and retention policy locks" url="https://cloud.google.com/storage/docs/bucket-lock"/>
-          </references>
-          <standards>
-            <standard ref="2.3" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="2.3" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;View a bucket's retention policy and lock status&lt;/p&gt;
-
-	&lt;p&gt;To view what, if any, retention policy is set on a bucket and whether that retention policy is locked:&lt;/p&gt;
-
-	&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt;
-
-	&lt;p&gt;2. In the Column display options menu (Column options icon.), make sure Retention policy is checked.&lt;/p&gt;
-
-	&lt;p&gt;3. In the list of buckets, if a bucket has a retention policy, the retention period is displayed in the Protection column for the bucket. If the retention policy is locked, an image of a lock appears directly to the left of the retention period.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM17" name="Use GCP-managed service account keys only for each service account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;User managed service accounts should not have user-managed keys.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Anyone who has access to the keys will be able to access resources through the service account. GCP-managed keys are used by Cloud Platform services such as App Engine and Compute Engine. These keys cannot be downloaded. Google will keep the keys and automatically rotate them on an approximately weekly basis. User-managed keys are created, downloadable, and managed by users. They expire 10 years from creation.&lt;/p&gt;&lt;p&gt;For user-managed keys, the user has to take ownership of key management activities which include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Key storage&lt;/li&gt;&lt;li&gt;Key distribution&lt;/li&gt;&lt;li&gt;Key revocation&lt;/li&gt;&lt;li&gt;Key rotation&lt;/li&gt;&lt;li&gt;Protecting the keys from unauthorized users&lt;/li&gt;&lt;li&gt;Key recovery&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Even with key owner precautions, keys can be easily leaked by common development malpractices like checking keys into the source code or leaving them in the Downloads directory, or accidentally leaving them on support blogs/channels.&lt;/p&gt;&lt;p&gt;It is recommended to prevent user-managed service account keys.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Deleting user-managed Service Account Keys may break communication with the applications using the corresponding keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. In the left navigation pane, click Service accounts. All service accounts and their corresponding keys are listed.&lt;/p&gt;&lt;p&gt;3. Click the service account.&lt;/p&gt;&lt;p&gt;4. Click the edit and delete the keys.&lt;/p&gt;&lt;p&gt;From CLI: To delete a user managed Service Account Key,&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts keys delete --iam-account=&amp;lt;user-managed-service-account-EMAIL&amp;gt; &amp;lt;KEY-ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.4" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. In the left navigation pane, click Service accounts. All service accounts and their corresponding keys are listed.&lt;/p&gt;&lt;p&gt;3. Click the service accounts and check if keys exist.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;List All the service accounts:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify user-managed service accounts as such account EMAIL ends with iam.gserviceaccount.com&amp;nbsp;&lt;/p&gt;&lt;p&gt;For each user-managed service account, list the keys managed by the user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts keys list --iam-account=&amp;lt;Service Account&amp;gt; --managed-by=user&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;No keys should be listed.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GCP-IAM-03" name="Use secret manager to avoid storing secrets in cloud functions environment variables" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;It is recommended to use the Secret Manager, because environment variables are stored unencrypted, and accessible for all users who have access to the code.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;There should be no impact on the Cloud Function. There are minor costs after 10,000 requests a month to the Secret Manager API as well for a high use of other functions. Modifying the Cloud Function to use the Secret Manager may prevent it running to completion as its environment variables are.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Enable Secret Manager API for your Project&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project you wish to enable, select the Navigation hamburger menu in the top left. Hover over 'APIs &amp;amp; Services' to under the heading 'Serverless', then select 'Enabled APIs &amp;amp; Services' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the button '+ Enable APIS and Services'&lt;/li&gt;&lt;li&gt;In the Search bar, search for 'Secret Manager API' and select it.&lt;/li&gt;&lt;li&gt;Click the blue box that says 'Enable'.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Within the project you wish to enable the API in, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services enable Secret Manager API&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Reviewing Environment Variables That Should Be Migrated to Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)&lt;/li&gt;&lt;li&gt;Go to Cloud Functions&lt;/li&gt;&lt;li&gt;Click on a function name from the list&lt;/li&gt;&lt;li&gt;Click on Edit and review the Runtime environment for variables that should be secrets. Leave this list open for the next step.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;To view a list of your cloud functions run cloud functions list&lt;/li&gt;&lt;li&gt;For each cloud function run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions describe &amp;lt;function_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Review the settings of the buildEnvironmentVariables and environmentVariables. Keep this information for the next step.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Migrating Environment Variables to Secrets within the Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the Secret Manager page in the Cloud Console.&lt;/li&gt;&lt;li&gt;On the Secret Manager page, click Create Secret.&lt;/li&gt;&lt;li&gt;On the Create secret page, under Name, enter the name of the Environment Variable you are replacing. This will then be the Secret Variable you will reference in your code.&lt;/li&gt;&lt;li&gt;You will also need to add a version. This is the actual value of the variable that will be referenced from the code. To add a secret version when creating the initial secret, in the Secret value field, enter the value from the Environment Variable you are replacing.&lt;/li&gt;&lt;li&gt;Leave the Regions section unchanged.&lt;/li&gt;&lt;li&gt;Click the Create secret button.&lt;/li&gt;&lt;li&gt;Repeat for all Environment Variables&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Run the following command with the Environment Variable name you are replacing in the &amp;lt;secret-id&amp;gt;. It is most secure to point this command to a file with the Environment Variable value located in it, as if you entered it via command line it would show up in your shell's command history.&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud secrets create &amp;lt;secret-id&amp;gt; --data-file="/path/to/file.txt"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Granting your Runtime's Service Account Access to Secrets&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project containing your runtime login with account that has the 'roles/secretmanager.secretAccessor' permission.&lt;/li&gt;&lt;li&gt;Select the Navigation hamburger menu in the top left. Hover over 'Security' to under the then select 'Secret Manager' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the name of a secret listed in this screen.&lt;/li&gt;&lt;li&gt;If it is not already open, click Show Info Panel in this screen to open the panel. 5.In the info panel, click Add principal. 6.In the New principals field, enter the service account your function uses for its identity. (If you need help locating or updating your runtime's service account, please see the 'docs/securing/function-identity#runtime_service_account' reference.)&lt;/li&gt;&lt;li&gt;In the Select a role dropdown, choose Secret Manager and then Secret Manager Secret Accessor.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&amp;nbsp;&lt;/p&gt;&lt;p&gt;As of the time of writing, using Google CLI to list Runtime variables is only in beta. Because this is likely to change we are not including it here.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Modifying the Code to use the Secrets in Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;p&gt;This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the '/docs/creating-and-accessing-secrets#access' reference for language specific instructions.&amp;nbsp;&lt;/p&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;p&gt;This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the' /docs/creating-and-accessing-secrets#access' reference for language specific instructions.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Deleting the Insecure Environment Variables&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Be certain to do this step last. Removing variables from code actively referencing them will prevent it from completing successfully.&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Select the Navigation hamburger menu in the top left. Hover over 'Security' then select 'Secret Manager' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the name of a function. Click Edit.&lt;/li&gt;&lt;li&gt;Click Runtime, build and connections settings to expand the advanced configuration options.&lt;/li&gt;&lt;li&gt;Click 'Security'. Hover over the secret you want to remove, then click 'Delete'.&lt;/li&gt;&lt;li&gt;Click Next. Click Deploy. The latest version of the runtime will now reference the secrets in Secret Manager.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions deploy &amp;lt;Function name&amp;gt;--remove-env-vars &amp;lt;env vars&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If you need to find the env vars to remove, they are from the step where 'gcloud functions describe &amp;lt;function_name&amp;gt;' was run.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Secret Manager is not enabled.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Managing secrets" url="https://cloud.google.com/functions/docs/configuring/env-var#managing_secrets"/>
-            <reference name="Google Cloud docs: Secret Manager Overview" url="https://cloud.google.com/secret-manager/docs/overview"/>
-          </references>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="1.18" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Determine if Confidential Information is Stored in your Functions in Cleartext&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)&lt;/li&gt;&lt;li&gt;Within the project you wish to audit, select the Navigation hamburger menu in the top left. Scroll down to under the heading 'Serverless', then select 'Cloud Functions'&lt;/li&gt;&lt;li&gt;Click on a function name from the list&lt;/li&gt;&lt;li&gt;Open the Variables tab and you will see both buildEnvironmentVariables and environmentVariables&lt;/li&gt;&lt;li&gt;Review the variables whether they are secrets&lt;/li&gt;&lt;li&gt;Repeat step 3-5 until all functions are reviewed&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;To view a list of your cloud functions run&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions list&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;For each cloud function in the list run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions describe &amp;lt;function_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Review the settings of the buildEnvironmentVariables and environmentVariables. Determine if this is data that should not be publicly accessible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Determine if Secret Manager API is 'Enabled' for your Project&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project you wish to audit, select the Navigation hamburger menu in the top left. Hover over 'APIs &amp;amp; Services' to under the heading 'Serverless', then select 'Enabled APIs &amp;amp; Services' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the button '+ Enable APIS and Services'&lt;/li&gt;&lt;li&gt;In the Search bar, search for 'Secret Manager API' and select it.&lt;/li&gt;&lt;li&gt;If it is enabled, the blue box that normally says 'Enable' will instead say 'Manage'.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Within the project you wish to audit, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services list&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;If 'Secret Manager API' is in the list, it is enabled.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-IAM06" name="Use Security Key for 2-Step Verification for administrator or co-administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the users with administrator and co-administrator accounts activate and configure the second factor authentication provided by Google. With 2-Step Verification, you can log into Google with a security key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To activate and configure 2 Factor Authentication, you shall follow the following steps: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Go to the 2-Step Verification page section of &lt;a href="https://myaccount.google.com/signinoptions/two-step-verification"&gt;My Account&lt;/a&gt;.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click Add security key.&lt;/li&gt; 
-  &lt;li&gt;Follow the on-screen instructions.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud: mobile account" url="https://support.google.com/accounts/answer/6103523?co=GENIE.Platform%3DAndroid#phone"/>
-            <reference name="Google support: answers" url="https://support.google.com/accounts/answer/6103534"/>
-          </references>
-          <standards>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Go to the 2-Step Verification page section of My Account.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that 2-Step Verification authentication is enabled and configured correctly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACTIVITY LOGS ALERTS" name="Activity Logs alerts" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-SYSTEMS" name="Attackers access the systems without being detected" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected and consequently, changes made by attackers can not be audited or detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="25" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON02A" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON03">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON05" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON04">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON06" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON05">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON07" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON06">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON08" mitigation="17"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-RESOURCES-STATUS">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON01" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-MON01" mitigation="17"/>
-                <countermeasure ref="GOOGLE-MON02A" mitigation="17"/>
-                <countermeasure ref="GOOGLE-MON05" mitigation="17"/>
-                <countermeasure ref="GOOGLE-MON06" mitigation="16"/>
-                <countermeasure ref="GOOGLE-MON07" mitigation="16"/>
-                <countermeasure ref="GOOGLE-MON08" mitigation="17"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>Attackers could gain undetected access to the security system configurations and
-                                changes made by attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-MON01">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON03" mitigation="34"/>
-                    <countermeasure ref="GOOGLE-MON04" mitigation="33"/>
-                    <countermeasure ref="GOOGLE-MON13" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-MON03" mitigation="34"/>
-                <countermeasure ref="GOOGLE-MON04" mitigation="33"/>
-                <countermeasure ref="GOOGLE-MON13" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-MON07">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-MON09" mitigation="34"/>
-                    <countermeasure ref="GOOGLE-MON10" mitigation="33"/>
-                    <countermeasure ref="GOOGLE-MON11" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-MON09" mitigation="34"/>
-                <countermeasure ref="GOOGLE-MON10" mitigation="33"/>
-                <countermeasure ref="GOOGLE-MON11" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="GOOGLE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the administrator account due to lack of configuration of the account and its security mechanisms, such as modifying credentials and adding/removing user accounts.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-IAM-01">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-IAM06" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON01">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-IAM09" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM10" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM11" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM12" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM13" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM14" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM15" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM16" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM17" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM18" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM19" mitigation="6"/>
-                    <countermeasure ref="GOOGLE-IAM20" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-MON02">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-IAM05" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="LOST-SECURITY-ALERTS">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-GOV01" mitigation="6"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-GOV01" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM05" mitigation="16"/>
-                <countermeasure ref="GOOGLE-IAM06" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM09" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM10" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM11" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM12" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM13" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM14" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM15" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM16" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM17" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM18" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM19" mitigation="6"/>
-                <countermeasure ref="GOOGLE-IAM20" mitigation="6"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="GOOGLE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-IAM03">
-                  <countermeasures>
-                    <countermeasure ref="C-GCP-IAM-01" mitigation="25"/>
-                    <countermeasure ref="C-GCP-IAM-02" mitigation="25"/>
-                    <countermeasure ref="C-GCP-IAM-03" mitigation="25"/>
-                    <countermeasure ref="GOOGLE-IAM01" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GCP-IAM-01" mitigation="25"/>
-                <countermeasure ref="C-GCP-IAM-02" mitigation="25"/>
-                <countermeasure ref="C-GCP-IAM-03" mitigation="25"/>
-                <countermeasure ref="GOOGLE-IAM01" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-EXPIRATION-DATE">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-IAM08" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE_IAM-02">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-IAM02" mitigation="20"/>
-                    <countermeasure ref="GOOGLE-IAM03" mitigation="20"/>
-                    <countermeasure ref="GOOGLE-IAM04" mitigation="20"/>
-                    <countermeasure ref="GOOGLE-IAM07" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-IAM02" mitigation="20"/>
-                <countermeasure ref="GOOGLE-IAM03" mitigation="20"/>
-                <countermeasure ref="GOOGLE-IAM04" mitigation="20"/>
-                <countermeasure ref="GOOGLE-IAM07" mitigation="20"/>
-                <countermeasure ref="GOOGLE-IAM08" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-GCP-LOG-01" mitigation="12"/>
-                    <countermeasure ref="C-GCP-LOG-02" mitigation="12"/>
-                    <countermeasure ref="C-GCP-LOG-03" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-LOG01" mitigation="16"/>
-                    <countermeasure ref="GOOGLE-LOG04" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-LOG05" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-LOGS03">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-LOG06" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-LOG07" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GCP-LOG-01" mitigation="12"/>
-                <countermeasure ref="C-GCP-LOG-02" mitigation="12"/>
-                <countermeasure ref="C-GCP-LOG-03" mitigation="12"/>
-                <countermeasure ref="GOOGLE-LOG01" mitigation="16"/>
-                <countermeasure ref="GOOGLE-LOG04" mitigation="12"/>
-                <countermeasure ref="GOOGLE-LOG05" mitigation="12"/>
-                <countermeasure ref="GOOGLE-LOG06" mitigation="12"/>
-                <countermeasure ref="GOOGLE-LOG07" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
-              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
-                                ports or security network configurations.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-NET01" mitigation="16"/>
-                    <countermeasure ref="GOOGLE-NET02" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET03" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET04" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET05" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET06" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET07" mitigation="12"/>
-                    <countermeasure ref="GOOGLE-NET08" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-NET01" mitigation="16"/>
-                <countermeasure ref="GOOGLE-NET02" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET03" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET04" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET05" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET06" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET07" mitigation="12"/>
-                <countermeasure ref="GOOGLE-NET08" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="eb630716-ac69-4883-8499-00b7e6a60b72" diagramComponentId="9a6e4aab-522c-49a2-99a8-a04541fb7a8b" ref="3fa5c6ab-2549-49a1-94d9-a69704190e83" name="Region 2" desc="" library="" parentComponentRef="225ed77d-0324-4a33-9df7-aa4ba51a588b" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="a311c67f-8b37-4021-9c21-343c7a31b28a" diagramComponentId="3842a1dd-7a2d-4a5e-af6f-0422d6fd2466" ref="61951b97-69d9-449a-9702-b4679bd8b8f4" name="Region 1" desc="" library="" parentComponentRef="225ed77d-0324-4a33-9df7-aa4ba51a588b" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="67d1022a-f78c-4d25-bbec-8ef2a6244ebd" diagramComponentId="c2f5d00f-37bb-4dda-8096-fb857123f08a" ref="252ff667-19d7-429b-a99b-3fe3c51db42e" name="Zone 1 - b" desc="" library="" parentComponentRef="61951b97-69d9-449a-9702-b4679bd8b8f4" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="ebff2d9d-f5d3-495f-abd2-476c5e2c31a1" diagramComponentId="d56dba3e-3e6c-49c6-ae5c-9276a9630a88" ref="46934b86-3288-4cc2-8094-1cdd1e438674" name="Zone 2 - a" desc="" library="" parentComponentRef="3fa5c6ab-2549-49a1-94d9-a69704190e83" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="dc110ce8-c840-4737-971c-d790c4a1cd3f" diagramComponentId="81345a9c-ccdb-41da-99e4-3542d1408e1b" ref="97f7f8b8-feb1-43b5-9c3f-36dfa1f62ef5" name="Zone 1 - a" desc="" library="" parentComponentRef="61951b97-69d9-449a-9702-b4679bd8b8f4" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-  </components>
-</template>

From 90df5c1938005614e5f50eb59d08d81e2175a0ec Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:22:02 -0400
Subject: [PATCH 16/28] Delete Templates/generic-web-service.xml

---
 Templates/generic-web-service.xml | 14942 ----------------------------
 1 file changed, 14942 deletions(-)
 delete mode 100644 Templates/generic-web-service.xml

diff --git a/Templates/generic-web-service.xml b/Templates/generic-web-service.xml
deleted file mode 100644
index 65fc499..0000000
--- a/Templates/generic-web-service.xml
+++ /dev/null
@@ -1,14942 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="testing-template-121" name="Generic Web Service" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIwIiBpckRyYXdpb1ZlcnNpb249Im51bGwiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDktOSIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMjQ2IiB5PSItNCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIzNTEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWEzYzY3MzFjLTM1M2MtNGI1My04MWQxLWIzNThiZWU2MWFkYy0zIiB2YWx1ZT0iV2ViIENsaWVudCIgc3R5bGU9ImlyLnJlZj1hM2M2NzMxYy0zNTNjLTRiNTMtODFkMS1iMzU4YmVlNjFhZGM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSIyMDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3LTI1IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQiIHN0eWxlPSJpci5yZWY9ZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vYmlsZS1kZXZpY2UtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TlRBMk1qY2dNQzR4TWprMk16bERNQzR5T1RnME1qTWdNQzR4TWprMk16a2dNQzR5TlRZeE1EUWdNQzR4TnpFNU5UZ2dNQzR5TlRZeE1EUWdNQzR5TWpReE5qRldNQzQzT1RFeU9UZERNQzR5TlRZeE1EUWdNQzQ0TkRNMU1ERWdNQzR5T1RnME1qTWdNQzQ0T0RVNE1pQXdMak0xTURZeU55QXdMamc0TlRneVNEQXVOak0wTVRrMlF6QXVOamcyTXprNUlEQXVPRGcxT0RJZ01DNDNNamczTVRrZ01DNDRORE0xTURFZ01DNDNNamczTVRrZ01DNDNPVEV5T1RkV01DNHlNalF4TmpGRE1DNDNNamczTVRrZ01DNHhOekU1TlRnZ01DNDJPRFl6T1RrZ01DNHhNamsyTXprZ01DNDJNelF4T1RZZ01DNHhNamsyTXpsSU1DNHpOVEEyTWpkYVRUQXVNekkyT1RrMklEQXVNakV5TXpRMlF6QXVNekkyT1RrMklEQXVNVGs1TWprMUlEQXVNek0zTlRjMklEQXVNVGc0TnpFMUlEQXVNelV3TmpJM0lEQXVNVGc0TnpFMVNEQXVOak0wTVRrMlF6QXVOalEzTWpRM0lEQXVNVGc0TnpFMUlEQXVOalUzT0RJM0lEQXVNVGs1TWprMUlEQXVOalUzT0RJM0lEQXVNakV5TXpRMlZqQXVOek15TWpJeFF6QXVOalUzT0RJM0lEQXVOelExTWpjeElEQXVOalEzTWpRM0lEQXVOelUxT0RVeElEQXVOak0wTVRrMklEQXVOelUxT0RVeFNEQXVNelV3TmpJM1F6QXVNek0zTlRjMklEQXVOelUxT0RVeElEQXVNekkyT1RrMklEQXVOelExTWpjeElEQXVNekkyT1RrMklEQXVOek15TWpJeFZqQXVNakV5TXpRMldrMHdMalEyTkRnME1pQXdMamcxTURNM05FTXdMalEwT1RZeE5pQXdMamcxTURNM05DQXdMalF6TnpJM015QXdMamd6T0RBeklEQXVORE0zTWpjeklEQXVPREl5T0RBMFF6QXVORE0zTWpjeklEQXVPREEzTlRjNElEQXVORFE1TmpFMklEQXVOemsxTWpNMUlEQXVORFkwT0RReUlEQXVOemsxTWpNMVNEQXVOVEU1T1RoRE1DNDFNelV5TURZZ01DNDNPVFV5TXpVZ01DNDFORGMxTlNBd0xqZ3dOelUzT0NBd0xqVTBOelUxSURBdU9ESXlPREEwUXpBdU5UUTNOVFVnTUM0NE16Z3dNeUF3TGpVek5USXdOaUF3TGpnMU1ETTNOQ0F3TGpVeE9UazRJREF1T0RVd016YzBTREF1TkRZME9EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EQXdNalEwTVRReElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDktOSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3NSIgeT0iLTM1IiB3aWR0aD0iNzk1IiBoZWlnaHQ9IjQyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYWZkMmNiMjMtZWQ3Mi00ODhkLWFkOTktY2ZmZDEzOGY1ZDU4LTI5IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSAtPiBXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj1mN2M4YmVjZi02NzJiLTRiNDktYmQ4Ni01ZTE1ZTJmOWVlZmY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2LTciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTRhMGNjZmM1LTY4NDItNGI1MC1iZDg4LWY1MjFhZWYxNjZhNC0yOCIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIC0+IFdlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWQ3OTlkNDI5LTkyOTMtNGJmNS1hNjdmLWRjZjRiNDYxOTc0YTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQyNjA0ODZmLTUyYjMtNDk0Ni1iYWUxLWI5NjdiZWE5MzZjMy02IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWItMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj0yNjg4YzhmYi0zNjQ1LTQ2ZDMtODBkMy05NTNlYjdkZmQyZmE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhLTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzMtMjIiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhIHN0b3JlIiBzdHlsZT0iaXIucmVmPWExMWY2MTQzLTNmNzMtNGM4OS1hMTI0LWY1ZDkwMjE1ODRjNztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWMtMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS02ZDQ4NmYyMi05ZDU1LTQ0NzktODIzZS00Nzg1ZDMzN2RiY2ItMjQiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBNaWNyb3NvZnQgQXp1cmUgU2VydmljZSBCdXMgTWVzc2FnaW5nIiBzdHlsZT0iaXIucmVmPWUwODRiNjBiLTBjYzEtNDk2OC1hZjJlLWMzMGEzMWY5ODdhODtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTEtMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQzMTg5MTg3LWQyZWUtNGI1Yy04M2EyLWZiMDI4N2Y4YjczYS00IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTExZTQ4OGItNjY0My00ZmE2LTlhNWUtNzk5OGNmMmM2YjFjLTExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hNGIwMGFmZi03MjU1LTRkYmYtYTM3ZS0yM2QyZTNkMjBmNzctMTYiIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0+IFJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9MzUyMmFiNDAtZjAzYy00ZjFhLWI4NGEtMjgwMTY1NzUwMDc0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMS0yNyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjA4IiB5PSIxMjAuNzQxOTM1NDgzODcwOTgiIGFzPSJzb3VyY2VQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kNjNiODhhYy02MjUxLTQ4MTYtOWU3Ni0yYWNmZGU0YmFjZDItMTciIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0+IFdlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIiBzdHlsZT0iaXIucmVmPWMwMDdlODhkLWU4MWYtNDRkZi1iMTFkLThlNDBmMTE3YjUxZDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS03ZWYwM2M0MC1lMDI1LTQ0NWMtOWVmNi0zYWM5MTBhYWM4MjEtMjciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzLTYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjIwOCIgeT0iMTcwLjMyMjU4MDY0NTE2MTIyIiBhcz0ic291cmNlUG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExLTIzIiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFNlcnZpY2UgQnVzIE1lc3NhZ2luZyIgc3R5bGU9ImlyLnJlZj1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVNFUi1CVVMtTVNHO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM01EbGZNalV5TlRNcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTVNems1TmlBd0xqSXdOemMyTkVnd0xqSTBNemM0TTFZd0xqTTBOVFUwTmtNd0xqSTBNemM0TXlBd0xqTTBPRFV4TkNBd0xqSTBNall3TXlBd0xqTTFNVE0yTVNBd0xqSTBNRFV3TkNBd0xqTTFNelEyUXpBdU1qTTROREExSURBdU16VTFOVFU1SURBdU1qTTFOVFU1SURBdU16VTJOek00SURBdU1qTXlOVGtnTUM0ek5UWTNNemhJTUM0eE9ETXhPRGxETUM0eE9EQXlNakVnTUM0ek5UWTNNemdnTUM0eE56Y3pOelFnTUM0ek5UVTFOVGtnTUM0eE56VXlOelVnTUM0ek5UTTBOa013TGpFM016RTNOaUF3TGpNMU1UTTJNU0F3TGpFM01UazVOeUF3TGpNME9EVXhOQ0F3TGpFM01UazVOeUF3TGpNME5UVTBObFl3TGpJeU9UYzJNa013TGpFM01UazVOeUF3TGpJeU16a3lPQ0F3TGpFM05ETXhOU0F3TGpJeE9ETXpNeUF3TGpFM09EUTBJREF1TWpFME1qQTNRekF1TVRneU5UWTJJREF1TWpFd01EZ3hJREF1TVRnNE1UWXhJREF1TWpBM056WTBJREF1TVRrek9UazJJREF1TWpBM056WTBWakF1TWpBM056WTBXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0MUlpQmtQU0pOTUM0eE9UTTVPVFlnTUM0eU1EYzNOalJJTUM0eU5ETTNPRE5XTUM0ek5EVTFORFpETUM0eU5ETTNPRE1nTUM0ek5EZzFNVFFnTUM0eU5ESTJNRE1nTUM0ek5URXpOakVnTUM0eU5EQTFNRFFnTUM0ek5UTTBOa013TGpJek9EUXdOU0F3TGpNMU5UVTFPU0F3TGpJek5UVTFPU0F3TGpNMU5qY3pPQ0F3TGpJek1qVTVJREF1TXpVMk56TTRTREF1TVRnek1UZzVRekF1TVRnd01qSXhJREF1TXpVMk56TTRJREF1TVRjM016YzBJREF1TXpVMU5UVTVJREF1TVRjMU1qYzFJREF1TXpVek5EWkRNQzR4TnpNeE56WWdNQzR6TlRFek5qRWdNQzR4TnpFNU9UY2dNQzR6TkRnMU1UUWdNQzR4TnpFNU9UY2dNQzR6TkRVMU5EWldNQzR5TWprM05qSkRNQzR4TnpFNU9UY2dNQzR5TWpNNU1qZ2dNQzR4TnpRek1UVWdNQzR5TVRnek16TWdNQzR4TnpnME5DQXdMakl4TkRJd04wTXdMakU0TWpVMk5pQXdMakl4TURBNE1TQXdMakU0T0RFMk1TQXdMakl3TnpjMk5DQXdMakU1TXprNU5pQXdMakl3TnpjMk5GWXdMakl3TnpjMk5Gb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVWlJR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpneE1qVWdNQzR5TWprM05qSldNQzR5Tnpnd01EVk1NQzR4TnpJd01qUWdNQzR5Tnpnd01EVldNQzR5TWprM05qSkRNQzR4TnpJd01qUWdNQzR5TWpNNU1qZ2dNQzR4TnpRek5ESWdNQzR5TVRnek16SWdNQzR4TnpnME5qY2dNQzR5TVRReU1EZERNQzR4T0RJMU9UTWdNQzR5TVRBd09ERWdNQzR4T0RneE9EZ2dNQzR5TURjM05qUWdNQzR4T1RRd01qTWdNQzR5TURjM05qUk1NQzQ0TURZMU1USWdNQzR5TURjM05qUkRNQzQ0TVRJeU9DQXdMakl3TnpnMk5TQXdMamd4TnpjM05pQXdMakl4TURJeU55QXdMamd5TVRneE9TQXdMakl4TkRNME1rTXdMamd5TlRnMk1TQXdMakl4T0RRMU5pQXdMamd5T0RFeU5pQXdMakl5TXprNU5DQXdMamd5T0RFeU5TQXdMakl5T1RjMk1sWXdMakl5T1RjMk1sb2lJR1pwYkd3OUlpTTVORGswT1RRaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTRNekkxSURBdU5qUXhPRFEyU0RBdU1qTXpNRE0yUXpBdU1qTTJNREExSURBdU5qUXhPRFEySURBdU1qTTRPRFV4SURBdU5qUXpNREkxSURBdU1qUXdPVFVnTUM0Mk5EVXhNalJETUM0eU5ETXdORGtnTUM0Mk5EY3lNak1nTUM0eU5EUXlNamtnTUM0Mk5UQXdOeUF3TGpJME5ESXlPU0F3TGpZMU16QXpPRll3TGpjNU1UazNOMGd3TGpFNU5EQTFOa013TGpFNU1URTJOeUF3TGpjNU1UazNOeUF3TGpFNE9ETXdOaUF3TGpjNU1UUXdPQ0F3TGpFNE5UWXpOeUF3TGpjNU1ETXdNa013TGpFNE1qazJPQ0F3TGpjNE9URTVOeUF3TGpFNE1EVTBNeUF3TGpjNE56VTNOaUF3TGpFM09EVWdNQzQzT0RVMU16UkRNQzR4TnpRek56VWdNQzQzT0RFME1EZ2dNQzR4TnpJd05UY2dNQzQzTnpVNE1UTWdNQzR4TnpJd05UY2dNQzQzTmprNU56aFdNQzQyTlRReE9UWkRNQzR4TnpFNE9UUWdNQzQyTlRJMk16SWdNQzR4TnpJd05qTWdNQzQyTlRFd05URWdNQzR4TnpJMU5USWdNQzQyTkRrMU5UZERNQzR4TnpNd05ERWdNQzQyTkRnd05qSWdNQzR4TnpNNE5DQXdMalkwTmpZNE55QXdMakUzTkRnNU5pQXdMalkwTlRVeU1rTXdMakUzTlRrMU1pQXdMalkwTkRNMU55QXdMakUzTnpJME1pQXdMalkwTXpReU55QXdMakUzT0RZNE1TQXdMalkwTWpjNU5FTXdMakU0TURFeUlEQXVOalF5TVRZZ01DNHhPREUyTnpjZ01DNDJOREU0TXpjZ01DNHhPRE15TlNBd0xqWTBNVGcwTmxZd0xqWTBNVGcwTmxvaUlHWnBiR3c5SWlNNU9UazVPVGtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOU0lnWkQwaVRUQXVNVGd6TWpVZ01DNDJOREU0TkRaSU1DNHlNek13TXpaRE1DNHlNell3TURVZ01DNDJOREU0TkRZZ01DNHlNemc0TlRFZ01DNDJORE13TWpVZ01DNHlOREE1TlNBd0xqWTBOVEV5TkVNd0xqSTBNekEwT1NBd0xqWTBOekl5TXlBd0xqSTBOREl5T1NBd0xqWTFNREEzSURBdU1qUTBNakk1SURBdU5qVXpNRE00VmpBdU56a3hPVGMzU0RBdU1UazBNRFUyUXpBdU1Ua3hNVFkzSURBdU56a3hPVGMzSURBdU1UZzRNekEySURBdU56a3hOREE0SURBdU1UZzFOak0zSURBdU56a3dNekF5UXpBdU1UZ3lPVFk0SURBdU56ZzVNVGszSURBdU1UZ3dOVFF6SURBdU56ZzNOVGMySURBdU1UYzROU0F3TGpjNE5UVXpORU13TGpFM05ETTNOU0F3TGpjNE1UUXdPQ0F3TGpFM01qQTFOeUF3TGpjM05UZ3hNeUF3TGpFM01qQTFOeUF3TGpjMk9UazNPRll3TGpZMU5ERTVOa013TGpFM01UZzVOQ0F3TGpZMU1qWXpNaUF3TGpFM01qQTJNeUF3TGpZMU1UQTFNU0F3TGpFM01qVTFNaUF3TGpZME9UVTFOME13TGpFM016QTBNU0F3TGpZME9EQTJNaUF3TGpFM016ZzBJREF1TmpRMk5qZzNJREF1TVRjME9EazJJREF1TmpRMU5USXlRekF1TVRjMU9UVXlJREF1TmpRME16VTNJREF1TVRjM01qUXlJREF1TmpRek5ESTNJREF1TVRjNE5qZ3hJREF1TmpReU56azBRekF1TVRnd01USWdNQzQyTkRJeE5pQXdMakU0TVRZM055QXdMalkwTVRnek55QXdMakU0TXpJMUlEQXVOalF4T0RRMlZqQXVOalF4T0RRMldpSWdabWxzYkQwaUl6azVPVGs1T1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56WTNNakUxSURBdU5qUXhPRFEyU0RBdU9ERTNNREF5UXpBdU9ERTVPVGNnTUM0Mk5ERTRORFlnTUM0NE1qSTRNVGNnTUM0Mk5ETXdNalVnTUM0NE1qUTVNVFlnTUM0Mk5EVXhNalJETUM0NE1qY3dNVFVnTUM0Mk5EY3lNak1nTUM0NE1qZ3hPVFFnTUM0Mk5UQXdOeUF3TGpneU9ERTVOQ0F3TGpZMU16QXpPRll3TGpjMk9EZ3lRekF1T0RJNE1UazBJREF1TnpjME5qVTFJREF1T0RJMU9EYzNJREF1Tnpnd01qVWdNQzQ0TWpFM05URWdNQzQzT0RRek56VkRNQzQ0TVRjMk1qVWdNQzQzT0RnMU1ERWdNQzQ0TVRJd015QXdMamM1TURneE9TQXdMamd3TmpFNU5TQXdMamM1TURneE9VZ3dMamMxTmpRd09GWXdMalkxTkRFNU5rTXdMamMxTmpJME9DQXdMalkxTWpZMk5DQXdMamMxTmpRd05pQXdMalkxTVRFeE5TQXdMamMxTmpnM01pQXdMalkwT1RZME4wTXdMamMxTnpNek9DQXdMalkwT0RFM09TQXdMamMxT0RFd015QXdMalkwTmpneU1pQXdMamMxT1RFeE55QXdMalkwTlRZMk0wTXdMamMyTURFek1TQXdMalkwTkRVd05DQXdMamMyTVRNM05DQXdMalkwTXpVMk5pQXdMamMyTWpjMk9DQXdMalkwTWpreFF6QXVOelkwTVRZeElEQXVOalF5TWpVeklEQXVOelkxTmpjMUlEQXVOalF4T0RrZ01DNDNOamN5TVRVZ01DNDJOREU0TkRaV01DNDJOREU0TkRaYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMyTnpJeE5TQXdMalkwTVRnME5rZ3dMamd4TnpBd01rTXdMamd4T1RrM0lEQXVOalF4T0RRMklEQXVPREl5T0RFM0lEQXVOalF6TURJMUlEQXVPREkwT1RFMklEQXVOalExTVRJMFF6QXVPREkzTURFMUlEQXVOalEzTWpJeklEQXVPREk0TVRrMElEQXVOalV3TURjZ01DNDRNamd4T1RRZ01DNDJOVE13TXpoV01DNDNOamc0TWtNd0xqZ3lPREU1TkNBd0xqYzNORFkxTlNBd0xqZ3lOVGczTnlBd0xqYzRNREkxSURBdU9ESXhOelV4SURBdU56ZzBNemMxUXpBdU9ERTNOakkxSURBdU56ZzROVEF4SURBdU9ERXlNRE1nTUM0M09UQTRNVGtnTUM0NE1EWXhPVFVnTUM0M09UQTRNVGxJTUM0M05UWTBNRGhXTUM0Mk5UUXhPVFpETUM0M05UWXlORGdnTUM0Mk5USTJOalFnTUM0M05UWTBNRFlnTUM0Mk5URXhNVFVnTUM0M05UWTROeklnTUM0Mk5EazJORGRETUM0M05UY3pNemdnTUM0Mk5EZ3hOemtnTUM0M05UZ3hNRE1nTUM0Mk5EWTRNaklnTUM0M05Ua3hNVGNnTUM0Mk5EVTJOak5ETUM0M05qQXhNekVnTUM0Mk5EUTFNRFFnTUM0M05qRXpOelFnTUM0Mk5ETTFOallnTUM0M05qSTNOamdnTUM0Mk5ESTVNVU13TGpjMk5ERTJNU0F3TGpZME1qSTFNeUF3TGpjMk5UWTNOU0F3TGpZME1UZzVJREF1TnpZM01qRTFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVGN4T1RrM0lEQXVOelk1T1RrMFZqQXVOekl4TnpVeVNEQXVPREk0TURrNVZqQXVOelk1T1RrMFF6QXVPREk0TURrNUlEQXVOemMxT0RJNElEQXVPREkxTnpneElEQXVOemd4TkRJeklEQXVPREl4TmpVMklEQXVOemcxTlRRNVF6QXVPREUzTlRNZ01DNDNPRGsyTnpRZ01DNDRNVEU1TXpVZ01DNDNPVEU1T1RJZ01DNDRNRFl4SURBdU56a3hPVGt5U0RBdU1Ua3pPVGsyUXpBdU1UZzRNVFl4SURBdU56a3hPVGt5SURBdU1UZ3lOVFkySURBdU56ZzVOamMwSURBdU1UYzRORFFnTUM0M09EVTFORGxETUM0eE56UXpNVFVnTUM0M09ERTBNak1nTUM0eE56RTVPVGNnTUM0M056VTRNamdnTUM0eE56RTVPVGNnTUM0M05qazVPVFJXTUM0M05qazVPVFJhSWlCbWFXeHNQU0lqT1RRNU5EazBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RJME9DQXdMak0yTURNMU1sWXdMall6TWpjNU9Vd3dMalE1TnpZd015QXdMalE1TmpZNU4wd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6TXlRa1ZFUkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56QXlOamd4SURBdU16WXdOREUyVERBdU5EazNOVFU1SURBdU5EazJOelpNTUM0M01ESTVNalFnTUM0Mk16STJNVGhETUM0M01ESTBNemdnTUM0Mk1qY3lOekVnTUM0M01ESTJPREVnTUM0ek5UVTFOVFVnTUM0M01ESTJPREVnTUM0ek5qQTBNVFphSWlCbWFXeHNQU0lqTVRrNFFVSXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RZNE56VWdNQzQwT1RZNE1qWk1NQzR5T1RJME9DQXdMall6TWpZNE9FZ3dMamN3TWpRNE5WWXdMall6TWpRME5Vd3dMalE1TmpnM05TQXdMalE1TmpneU5sb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNsOHhOekE1WHpJMU1qVXpLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TWpreU5EZ2dNQzR6TmpBek5USklNQzQzTURJM01qWk1NQzQwT1RrM09TQXdMalV4T1RjNE5VTXdMalE1T0RVMk5pQXdMalV5TURjeE1pQXdMalE1TnpBM015QXdMalV5TVRJeE15QXdMalE1TlRVek55QXdMalV5TVRJeE0wTXdMalE1TkRBd01pQXdMalV5TVRJeE15QXdMalE1TWpVd09DQXdMalV5TURjeE1pQXdMalE1TVRJNE5DQXdMalV4T1RjNE5Vd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWEpmTVRjd09WOHlOVEkxTXlJZ2VERTlJakF1TkRrM05qQTBJaUI1TVQwaU1DNDBPVFk0TWpZaUlIZ3lQU0l3TGpRNU56WXdOQ0lnZVRJOUlqQXVOak15T1RNeElpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpNREExUWtFeElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TWpZaUlITjBiM0F0WTI5c2IzSTlJaU13TURVNE9VUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0MU15SWdjM1J2Y0MxamIyeHZjajBpSXpBd05FWTVNQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqZ2lJSE4wYjNBdFkyOXNiM0k5SWlNd01ETkdOME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpBd016QTJOeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1UY3dPVjh5TlRJMU15SStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0RBd01ERWlJR2hsYVdkb2REMGlNQzQ0T0RBd01ERWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEyTURBMU9EWWdNQzR3TmpBd05UZzJLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0NSIgeT0iMjgzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMS0yNyIgdmFsdWU9IkxvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9N2VmMDNjNDAtZTAyNS00NDVjLTllZjYtM2FjOTEwYWFjODIxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUxPQUQtQkFMQU5DRVI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCMmFXVjNRbTk0UFNJd0lEQWdNU0F4SWlCbWFXeHNQU0p1YjI1bElpQjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaVBqeG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TUY4eU5EVTNYekl6TWpBd0tTSStQSEJoZEdnZ1pEMGlUVEF1TXpVd09ETXlJREF1TWpjNU5UYzFRekF1TXpVM05UQXhJREF1TWpBMk1EVXpJREF1TkRFNU5qazRJREF1TVRRNE5ETTRJREF1TkRrMU5EUWdNQzR4TkRnME16aERNQzQxTnpFeE9ESWdNQzR4TkRnME16Z2dNQzQyTXpNek56a2dNQzR5TURZd05UTWdNQzQyTkRBd05EZ2dNQzR5TnprMU56VklNQzQyTkRNNU5FTXdMamN3TURRek9TQXdMakkzT1RVM05TQXdMamMwTmpJMElEQXVNekkxTURjM0lEQXVOelEyTWpRZ01DNHpPREV5TURaRE1DNDNORFl5TkNBd0xqUXpOek16TmlBd0xqY3dNRFF6T1NBd0xqUTRNamd6TnlBd0xqWTBNemswSURBdU5EZ3lPRE0zU0RBdU16UTJPVFJETUM0eU9UQTBOREVnTUM0ME9ESTRNemNnTUM0eU5EUTJOQ0F3TGpRek56TXpOaUF3TGpJME5EWTBJREF1TXpneE1qQTJRekF1TWpRME5qUWdNQzR6TWpVd056Y2dNQzR5T1RBME5ERWdNQzR5TnprMU56VWdNQzR6TkRZNU5DQXdMakkzT1RVM05VZ3dMak0xTURnek1scE5NQzQwT1RVME5DQXdMakU0TVRJeU1rTXdMalF6TXpRM05DQXdMakU0TVRJeU1pQXdMak00TXpJMElEQXVNak14TVRJM0lEQXVNemd6TWpRZ01DNHlPVEkyT0RoV01DNHlPVFU1TmpkRE1DNHpPRE15TkNBd0xqTXdOVEF5SURBdU16YzFPRFV6SURBdU16RXlNelU1SURBdU16WTJOelFnTUM0ek1USXpOVGxJTUM0ek5EWTVORU13TGpNd09EWTJOeUF3TGpNeE1qTTFPU0F3TGpJM056WTBJREF1TXpRek1UZ3pJREF1TWpjM05qUWdNQzR6T0RFeU1EWkRNQzR5TnpjMk5DQXdMalF4T1RJeU9TQXdMak13T0RZMk55QXdMalExTURBMU15QXdMak0wTmprMElEQXVORFV3TURVelNEQXVOalF6T1RSRE1DNDJPREl5TVRNZ01DNDBOVEF3TlRNZ01DNDNNVE15TkNBd0xqUXhPVEl5T1NBd0xqY3hNekkwSURBdU16Z3hNakEyUXpBdU56RXpNalFnTUM0ek5ETXhPRE1nTUM0Mk9ESXlNVE1nTUM0ek1USXpOVGtnTUM0Mk5ETTVOQ0F3TGpNeE1qTTFPVWd3TGpZeU5ERTBRekF1TmpFMU1ESTNJREF1TXpFeU16VTVJREF1TmpBM05qUWdNQzR6TURVd01pQXdMall3TnpZMElEQXVNamsxT1RZM1ZqQXVNamt5TmpnNFF6QXVOakEzTmpRZ01DNHlNekV4TWpjZ01DNDFOVGMwTURZZ01DNHhPREV5TWpJZ01DNDBPVFUwTkNBd0xqRTRNVEl5TWxvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JrUFNKTk1DNDBPVEV3TkNBd0xqUTJOVEl6TjBnd0xqVXdPRFkwVmpBdU5qWTNOak0zU0RBdU5Ea3hNRFJXTUM0ME5qVXlNemRhSWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEhCaGRHZ2daRDBpVFRBdU1qazNORFFnTUM0MU9EZzBNemRETUM0eU9UYzBOQ0F3TGpVNE16VTNOeUF3TGpNd01UTTRJREF1TlRjNU5qTTNJREF1TXpBMk1qUWdNQzQxTnprMk16ZERNQzR6TVRFeElEQXVOVGM1TmpNM0lEQXVNekUxTURRZ01DNDFPRE0xTnpjZ01DNHpNVFV3TkNBd0xqVTRPRFF6TjFZd0xqWTJOell6TjBNd0xqTXhOVEEwSURBdU5qY3lORGs0SURBdU16RXhNU0F3TGpZM05qUXpOeUF3TGpNd05qSTBJREF1TmpjMk5ETTNRekF1TXpBeE16Z2dNQzQyTnpZME16Y2dNQzR5T1RjME5DQXdMalkzTWpRNU9DQXdMakk1TnpRMElEQXVOalkzTmpNM1ZqQXVOVGc0TkRNM1dpSWdabWxzYkQwaUl6QkNRVEJDTnlJdlBqeHdZWFJvSUdROUlrMHdMalk1TXpRMElEQXVOVGc0TkRNM1F6QXVOamt6TkRRZ01DNDFPRE0xTnpjZ01DNDJPVGN6T0NBd0xqVTNPVFl6TnlBd0xqY3dNakkwSURBdU5UYzVOak0zUXpBdU56QTNNU0F3TGpVM09UWXpOeUF3TGpjeE1UQTBJREF1TlRnek5UYzNJREF1TnpFeE1EUWdNQzQxT0RnME16ZFdNQzQyTmpjMk16ZERNQzQzTVRFd05DQXdMalkzTWpRNU9DQXdMamN3TnpFZ01DNDJOelkwTXpjZ01DNDNNREl5TkNBd0xqWTNOalF6TjBNd0xqWTVOek00SURBdU5qYzJORE0zSURBdU5qa3pORFFnTUM0Mk56STBPVGdnTUM0Mk9UTTBOQ0F3TGpZMk56WXpOMVl3TGpVNE9EUXpOMW9pSUdacGJHdzlJaU13UWtFd1FqY2lMejQ4Y0dGMGFDQmtQU0pOTUM0M01ESXlOQ0F3TGpVM09UWXpOMVl3TGpVNU56SXpOMGd3TGpNd05qSTBWakF1TlRjNU5qTTNTREF1TnpBeU1qUmFJaUJtYVd4c1BTSWpNRUpCTUVJM0lpOCtQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqSTFNelEwSURBdU5qZzFNak0zVmpBdU56a3dPRE0zU0RBdU16VTVNRFJXTUM0Mk9EVXlNemRJTUM0eU5UTTBORnBOTUM0eU5EUTJOQ0F3TGpZMk56WXpOME13TGpJek9UYzRJREF1TmpZM05qTTNJREF1TWpNMU9EUWdNQzQyTnpFMU56Y2dNQzR5TXpVNE5DQXdMalkzTmpRek4xWXdMamM1T1RZek4wTXdMakl6TlRnMElEQXVPREEwTkRrNElEQXVNak01TnpnZ01DNDRNRGcwTXpjZ01DNHlORFEyTkNBd0xqZ3dPRFF6TjBnd0xqTTJOemcwUXpBdU16Y3lOeUF3TGpnd09EUXpOeUF3TGpNM05qWTBJREF1T0RBME5EazRJREF1TXpjMk5qUWdNQzQzT1RrMk16ZFdNQzQyTnpZME16ZERNQzR6TnpZMk5DQXdMalkzTVRVM055QXdMak0zTWpjZ01DNDJOamMyTXpjZ01DNHpOamM0TkNBd0xqWTJOell6TjBnd0xqSTBORFkwV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGp4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRrME5DQXdMalk0TlRJek4xWXdMamM1TURnek4wZ3dMamMxTlRBMFZqQXVOamcxTWpNM1NEQXVOalE1TkRSYVRUQXVOalF3TmpRZ01DNDJOamMyTXpkRE1DNDJNelUzT0NBd0xqWTJOell6TnlBd0xqWXpNVGcwSURBdU5qY3hOVGMzSURBdU5qTXhPRFFnTUM0Mk56WTBNemRXTUM0M09UazJNemRETUM0Mk16RTROQ0F3TGpnd05EUTVPQ0F3TGpZek5UYzRJREF1T0RBNE5ETTNJREF1TmpRd05qUWdNQzQ0TURnME16ZElNQzQzTmpNNE5FTXdMamMyT0RjZ01DNDRNRGcwTXpjZ01DNDNOekkyTkNBd0xqZ3dORFE1T0NBd0xqYzNNalkwSURBdU56azVOak0zVmpBdU5qYzJORE0zUXpBdU56Y3lOalFnTUM0Mk56RTFOemNnTUM0M05qZzNJREF1TmpZM05qTTNJREF1TnpZek9EUWdNQzQyTmpjMk16ZElNQzQyTkRBMk5Gb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NDhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5EazVPRFFnTUM0M09UQTRNemRNTUM0MU5qQTRNRGdnTUM0Mk9EVXlNemRJTUM0ME16ZzROekpNTUM0ME9UazROQ0F3TGpjNU1EZ3pOMXBOTUM0ME9USXlNVGtnTUM0NE1USTRNemRETUM0ME9UVTJNRFlnTUM0NE1UZzNNRFFnTUM0MU1EUXdOelFnTUM0NE1UZzNNRFFnTUM0MU1EYzBOakVnTUM0NE1USTRNemRNTUM0MU9ETTJOekVnTUM0Mk9EQTRNemRETUM0MU9EY3dOVGdnTUM0Mk56UTVOekVnTUM0MU9ESTRNalFnTUM0Mk5qYzJNemNnTUM0MU56WXdOU0F3TGpZMk56WXpOMGd3TGpReU16WXpRekF1TkRFMk9EVTFJREF1TmpZM05qTTNJREF1TkRFeU5qSXlJREF1TmpjME9UY3hJREF1TkRFMk1EQTVJREF1Tmpnd09ETTNUREF1TkRreU1qRTVJREF1T0RFeU9ETTNXaUlnWm1sc2JEMGlJekJDUVRCQ055SXZQand2Wno0OFpHVm1jejQ4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3WHpJME5UZGZNak15TURBaVBqeHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOTciIHk9Ijk4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE4NzBhN2MwLTFkOWQtNDhlYS04MDA4LTBlM2ZmZTFkNDA2MS0xNSIgdmFsdWU9IldlYiBDbGllbnQgLT4gTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0wZjAyOGU1ZC1hZmIzLTQ2OGEtOWQzMy01YTlmM2ExNzM0NTc7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VudHJ5WD0wO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7IiBwYXJlbnQ9IjEiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtN2VmMDNjNDAtZTAyNS00NDVjLTllZjYtM2FjOTEwYWFjODIxLTI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIyMDUiIHk9IjEyMy44NTAyMDI0MjkxNDk3IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtMjg1NGQ0OGYtM2NhZi00NzVkLTk4OGItOGI1OTViODdmNDYwLTI2IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQgLT4gTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj03Y2RlNzVlYy01NGVhLTQwYzgtOTc0MS0wODgwMTUxMmRjYmM7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LWRlMWRkMTVkLTUyNDItNGQwZS05MTNjLTA5ZDJkMzgxZGZiNy0yNSIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS03ZWYwM2M0MC1lMDI1LTQ0NWMtOWVmNi0zYWM5MTBhYWM4MjEtMjciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjIwNSIgeT0iMTA4Ljg4MTE3NDg5OTg2NjQ0IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="hospitals" uuid="0d73657e-ca3a-410d-8921-e8bb90856a24" name="Hospitals" desc="" trustRating="1"/>
-  </trustZones>
-  <questions>
-    <wizardQuestion ref="Amazon Web Services" answer="true" manuallyModified="false"/>
-  </questions>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Web Client -&gt; Load Balancer" ref="0f028e5d-afb3-468a-9d33-5a9f3a173457" source="a076c1e1-f412-473c-85af-2bc811522b81" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other database" ref="2688c8fb-3645-46d3-80d3-953eb7dfd2fa" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Load Balancer -&gt; RESTful Web Service" ref="3522ab40-f03c-4f1a-b84a-280165750074" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Mobile Device Client -&gt; Load Balancer" ref="7cde75ec-54ea-40c8-9741-08801512dcbc" source="84938d4c-4d32-4de6-a1be-c852de621214" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other data store" ref="a11f6143-3f73-4c89-a124-f5d9021584c7" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Load Balancer -&gt; Web Application - Server side" ref="c007e88d-e81f-44df-b11d-8e40f117b51d" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="6466e1cd-f115-44bf-9962-548b27fca47a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; Web Service" ref="d799d429-9293-4bf5-a67f-dcf4b461974a" source="6466e1cd-f115-44bf-9962-548b27fca47a" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="e084b60b-0cc1-4968-af2e-c30a31f987a8" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="RESTful Web Service -&gt; Web Service" ref="f7c8becf-672b-4b49-bd86-5e15e2f9eeff" source="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="6fd2012c-290a-4155-a0fb-02ef2d8bab89" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.480">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.092">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.292">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.038">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.273">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="51c726cf-9993-4244-a0e7-9bba115402ad" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.256">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.831">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.453">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.825">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.927">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.541">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.312">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.144">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.528">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.447">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.879">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.062">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1a65a7ea-0512-40c9-86d1-0d4771ba9693" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.420">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.970">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.057">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.224">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.589">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.936">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.514">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.651">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.134">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.840">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.508">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="d361b243-c73c-42d8-a3fe-6d4c5768847d" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The API is vulnerable to injection flaws if:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
-  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
-  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.917">
-              <output/>
-            </source>
-            <references>
-              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
-              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
-              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
-              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.167">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.721">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.541">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.744">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
-          <desc>Product A handles inputs or steps differently than Product B,
-          which causes A to perform incorrect actions based on its perception of B's
-          state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.160">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.998">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.177">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.311">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.311">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.721">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
-              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.695">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
-            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
-            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API5:2023-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
-              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API2:2023-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
-              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.696">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API9:2023-Improper Inventory Management" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
-              <output/>
-            </source>
-            <references>
-              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.697">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.111">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.477">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.697">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.996">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="review-api-responses" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="review-api-responses" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
-                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-authentication">
-                  <countermeasures>
-                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
-          <threats>
-            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
-                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-285">
-                  <countermeasures>
-                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-object-level-authorization">
-                  <countermeasures>
-                    <countermeasure ref="object-level-authorization" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                <countermeasure ref="object-level-authorization" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
-                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="api-vulnerable-injection">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-436">
-                  <countermeasures>
-                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="rest-content-type-val" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
-&lt;/div&gt;
-&lt;div&gt;
-  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-assets-inventory">
-                  <countermeasures>
-                    <countermeasure ref="inventory-api" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="inventory-api" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="b4dc9515-e6f8-453f-a134-6e2d33364199" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.397">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-AZURE-SER-BUS-MSG1" name="Use Azure Private Link to enable private access to Service Bus" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Private Link to enable private access to Service Bus&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Azure Private Link to enable private access to Service Bus from your virtual networks without crossing the internet.&lt;br&gt; Private access is an additional defense in depth measure to the authentication and traffic security offered by Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To integrate a Service Bus namespace with Azure Private Link, you'll need the following entities or permissions:&lt;/p&gt; 
-&lt;p&gt;- A Service Bus namespace.&lt;br&gt; - An Azure virtual network.&lt;br&gt; - A subnet in the virtual network. You can use the default subnet.&lt;br&gt; - Owner or contributor permissions for both the Service Bus namespace and the virtual network.&lt;/p&gt; 
-&lt;p&gt;Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your Service Bus namespace can be in a different region. And, Your private endpoint uses a private IP address in your virtual network.&lt;/p&gt; 
-&lt;p&gt;If you already have an existing namespace, you can create a private endpoint by following these steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. In the search bar, type in Service Bus.&lt;/p&gt; 
-&lt;p&gt;3. Select the namespace from the list to which you want to add a private endpoint.&lt;/p&gt; 
-&lt;p&gt;4. On the left menu, select Networking option under Settings. By default, the Selected networks option is selected.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; You see the Networking tab only for premium namespaces.&lt;/p&gt; 
-&lt;p&gt;Warning&lt;br&gt; If you don't add at least one IP firewall rule or a virtual network on this page, the namespace can be accessed over public internet (using the access key).&lt;/p&gt; 
-&lt;p&gt;If you select the All networks option, your Service Bus namespace accepts connections from any IP address (using the access key). This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.&lt;/p&gt; 
-&lt;p&gt;5. To allow access to the namespace via private endpoints, select the Private endpoint connections tab at the top of the page&lt;/p&gt; 
-&lt;p&gt;6. Select the + Private Endpoint button at the top of the page.&lt;/p&gt; 
-&lt;p&gt;7. On the Basics page, follow these steps:&lt;/p&gt; 
-&lt;p&gt;a. Select the Azure subscription in which you want to create the private endpoint.&lt;/p&gt; 
-&lt;p&gt;b. Select the resource group for the private endpoint resource.&lt;/p&gt; 
-&lt;p&gt;c. Enter a name for the private endpoint.&lt;/p&gt; 
-&lt;p&gt;d. Select a region for the private endpoint. Your private endpoint must be in the same region as your virtual network, but can be in a different region from the private link resource that you are connecting to.&lt;/p&gt; 
-&lt;p&gt;e. Select Next: Resource &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;8. On the Resource page, follow these steps:&lt;/p&gt; 
-&lt;p&gt;a. For connection method, if you select Connect to an Azure resource in my directory, follow these steps:&lt;/p&gt; 
-&lt;p&gt;i. Select the Azure subscription in which your Service Bus namespace exists.&lt;/p&gt; 
-&lt;p&gt;ii. For Resource type, Select Microsoft.ServiceBus/namespaces for the Resource type.&lt;/p&gt; 
-&lt;p&gt;iii. For Resource, select a Service Bus namespace from the drop-down list.&lt;/p&gt; 
-&lt;p&gt;iv. Confirm that the Target subresource is set to namespace.&lt;/p&gt; 
-&lt;p&gt;v. Select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;b. If you select Connect to an Azure resource by resource ID or alias, follow these steps:&lt;/p&gt; 
-&lt;p&gt;i. Enter the resource ID or alias. It can be the resource ID or alias that someone has shared with you. The easiest way to get the resource ID is to navigate to the Service Bus namespace in the Azure portal and copy the portion of URI starting from /subscriptions/. See the following image for an example.&lt;/p&gt; 
-&lt;p&gt;ii. For Target sub-resource, enter namespace. It's the type of the sub-resource that your private endpoint can access.&lt;/p&gt; 
-&lt;p&gt;iii.(optional) Enter a request message. The resource owner sees this message while managing private endpoint connection.&lt;/p&gt; 
-&lt;p&gt;iv. Then, select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;9. On the Configuration page, you select the subnet in a virtual network to where you want to deploy the private endpoint.&lt;/p&gt; 
-&lt;p&gt;a. Select a virtual network. Only virtual networks in the currently selected subscription and location are listed in the drop-down list.&lt;/p&gt; 
-&lt;p&gt;b. Select a subnet in the virtual network you selected.&lt;/p&gt; 
-&lt;p&gt;c. Select Next: Tags &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;10. On the Tags page, create any tags (names and values) that you want to associate with the private endpoint resource. Then, select Review + create button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;11. On the Review + create, review all the settings, and select Create to create the private endpoint.&lt;/p&gt; 
-&lt;p&gt;12. Confirm that the private endpoint is created. If you are the owner of the resource and had selected Connect to an Azure resource in my directory option for the Connection method, the endpoint connection should be auto-approved. If it's in the pending state, please see the Manage private endpoints using Azure portal section at Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allow access to Azure Service Bus namespaces via private endpoints" url="https://docs.microsoft.com/en-us/azure/service-bus-messaging/private-link-service"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate that the private link connection works&lt;/p&gt;
-
-	&lt;p&gt;You should validate that resources within the virtual network of the private endpoint are connecting to your Service Bus namespace over a private IP address, and that they have the correct private DNS zone integration.&lt;/p&gt;
-
-	&lt;p&gt;First, create a Windows virtual machine in the Azure portal&lt;/p&gt;
-
-	&lt;p&gt;In the Networking tab:&lt;/p&gt;
-
-	&lt;p&gt;1. Specify Virtual network and Subnet. You must select the Virtual Network on which you deployed the private endpoint.&lt;br /&gt;
-2. Specify a public IP resource.&lt;br /&gt;
-3. For NIC network security group, select None.&lt;br /&gt;
-4 For Load balancing, select No.&lt;/p&gt;
-
-	&lt;p&gt;Connect to the VM, open the command line, and run the following command:&lt;/p&gt;
-
-	&lt;p&gt;nslookup &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;
-
-	&lt;p&gt;You should see a result that looks like the following.&lt;/p&gt;
-
-	&lt;p&gt;Non-authoritative answer:&lt;br /&gt;
-Name:    &lt;service-bus-namespace-name&gt;.privatelink.servicebus.windows.net&lt;br /&gt;
-Address:  10.0.0.4 (private IP address associated with the private endpoint)&lt;br /&gt;
-Aliases:  &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
-&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
-&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
-&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
-&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
-&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
-          </references>
-          <standards>
-            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="4c9bae06-45d5-4b5f-9815-62b71b4e3d9b" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
-                        common that they deserve a special kingdom of their own. As with "API Abuse", there
-                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
-                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
-                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
-                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
-                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
-                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
-                        without restricting how much is copied. Other variants exist, but the existence of a classic
-                        overflow strongly suggests that the programmer is not considering even the most basic of
-                        security protections.
-                        &lt;br /&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
-              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software provides an Applications Programming Interface (API) or similar interface for
-                        interaction with external actors, but the interface includes a dangerous method or function that
-                        is not properly restricted.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
-                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
-                        leverage them to obtain information about the app.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.191">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
-                        attackers can leverage them to obtain information about the app.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
-
-When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.188">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application can be deployed with active debugging code that can create unintended entry
-                        points.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.189">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
-                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>For Android:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For iOS:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the set of protocol handlers are deactivated.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the exceptions are well-designed and are catched and handled well.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CODE-3 - Checking for Weaknesses in Third Party Libraries" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0042/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-CODE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; or &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CODE-2 - Testing Enforced Updating" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0036/"/>
-          </references>
-          <standards>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-CODE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
-&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
-&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing Local Storage for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0001/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing the Device-Access-Security Policy" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0012/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-STORAGE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app verifies the mobile device complies with the minimum
-                            device-access-security policy.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the application denies access to the session when the exceptions appear.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Search in the code the following instruction:
-                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
-                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;For iOS:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
-                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
-                            setJavaScriptEnabled:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [conf setPreferences:pref]; _webView = [[WKWebView
-                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
-                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [_webView loadRequest:request];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [self.view addSubview:_webView]; }
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Embedded Services" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0004/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Notifications" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0005/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether the Keyboard Cache Is Disabled for Text Input Fields" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0006/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Backups for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0009/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Logs for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0003/"/>
-            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Memory for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0011/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-            <standard ref="MASVS-STORAGE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the clipboard is disabled when sensitive data is used.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
-                        Android O and the behavior of MAC addresses have changed in Android N.
-
-                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
-                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
-                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
-                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
-                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
-                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
-                        they request the Build.Serial.
-                    </desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
-                            authenticate).&lt;/li&gt;
-                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;ol&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;exit the current user&lt;/li&gt;
-                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
-                            shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
-                            working properly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Log Class&lt;/li&gt; 
- &lt;li&gt;Logger Class&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
-&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;NSLog Method&lt;/li&gt; 
- &lt;li&gt;printf-like function&lt;/li&gt; 
- &lt;li&gt;NSAssert-like function&lt;/li&gt; 
- &lt;li&gt;Macro&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all executable files and libraries belonging to the app are encrypted or
-                            packed.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that sensitive data is not stored in plain text.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.6" name="Ensure that no sensitive stored data has been exposed via IPC mechanisms" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Inter Process Communication (IPC) allows processes to send each other messages and data. For processes that need to communicate with each other, there are different ways to implement IPC on iOS:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;XPC Services: XPC is a structured, asynchronous library that provides basic interprocess communication. It is managed by launchd. It is the most secure and flexible implementation of IPC on iOS and should be the preferred method. It runs in the most restricted environment possible: sandboxed with no root privilege escalation and minimal file system access and network access. Two different APIs are used with XPC Services:&lt;ul&gt;&lt;li&gt;NSXPCConnection API&lt;/li&gt;&lt;li&gt;XPC Services API&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Mach Ports: All IPC communication ultimately relies on the Mach Kernel API. Mach Ports allow local communication (intra-device communication) only. They can be implemented either natively or via Core Foundation (CFMachPort) and Foundation (NSMachPort) wrappers.&lt;/li&gt;&lt;li&gt;NSFileCoordinator: The class NSFileCoordinator can be used to manage and send data to and from apps via files that are available on the local file system to various processes. NSFileCoordinator methods run synchronously, so your code will be blocked until they stop executing. That's convenient because you don't have to wait for an asynchronous block callback, but it also means that the methods block the running thread.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;No sensitive data should be exposed via IPC mechanisms.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;For Android:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The first step is to look at AndroidManifest.xml to detect content providers exposed by the app. You can identify content providers by the &amp;lt;provider&amp;gt; element. Complete the following steps:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Determine whether the value of the export tag (android:exported) is "true". Even if it is not, the tag will be set to "true" automatically if an &amp;lt;intent-filter&amp;gt; has been defined for the tag. If the content is meant to be accessed only by the app itself, set android:exported to "false". If not, set the flag to "true" and define proper read/write permissions.&lt;/li&gt;&lt;li&gt;Determine whether the data is being protected by a permission tag (android:permission). Permission tags limit exposure to other apps.&lt;/li&gt;&lt;li&gt;Determine whether the android:protectionLevel attribute has the value signature. This setting indicates that the data is intended to be accessed only by apps from the same enterprise (i.e., signed with the same key). To make the data accessible to other apps, apply a security policy with the &amp;lt;permission&amp;gt; element and set a proper android:protectionLevel. If you use android:permission, other applications must declare corresponding &amp;lt;uses-permission&amp;gt; elements in their manifests to interact with your content provider. You can use the android:grantUriPermissions attribute to grant more specific access to other apps; you can limit access with the &amp;lt;grant-uri-permission&amp;gt; element.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Inspect the source code to understand how the content provider is meant to be used. Search for the following keywords:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;android.content.ContentProvider&lt;/li&gt;&lt;li&gt;android.database.Cursor&lt;/li&gt;&lt;li&gt;android.database.sqlite&lt;/li&gt;&lt;li&gt;.query&lt;/li&gt;&lt;li&gt;.update&lt;/li&gt;&lt;li&gt;.delete&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;To avoid SQL injection attacks within the app, use parameterized query methods, such as query, update, and delete. Be sure to properly sanitize all method arguments; for example, the selection argument could lead to SQL injection if it is made up of concatenated user input.&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If you expose a content provider, determine whether parameterized &lt;a href="https://developer.android.com/reference/android/content/ContentProvider.html#query%28android.net.Uri%2C%20java.lang.String%5B%5D%2C%20java.lang.String%2C%20java.lang.String%5B%5D%2C%20java.lang.String%29"&gt;query methods&lt;/a&gt; (query, update, and delete) are being used to prevent SQL injection. If so, make sure all their arguments are properly sanitized.&lt;/p&gt;&lt;p&gt;We will use the vulnerable password manager app &lt;a href="https://github.com/mwrlabs/drozer/releases/download/2.3.4/sieve.apk"&gt;Sieve&lt;/a&gt; as an example of a vulnerable content provider.&lt;/p&gt;&lt;h4&gt;Inspect the Android Manifest&lt;/h4&gt;&lt;p&gt;Identify all defined &amp;lt;provider&amp;gt; elements:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.DBContentProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".DBContentProvider"&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;lt;path-permission&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:path="/Keys"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:readPermission="com.mwr.example.sieve.READ_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:writePermission="com.mwr.example.sieve.WRITE_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; /&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;/provider&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.FileBackupProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".FileBackupProvider"&lt;/p&gt;&lt;p&gt;/&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;As shown in the AndroidManifest.xml above, the application exports two content providers. Note that one path ("/Keys") is protected by read and write permissions.&lt;/p&gt;&lt;h4&gt;Inspect the source code&lt;/h4&gt;&lt;p&gt;Inspect the query function in the DBContentProvider.java file to determine whether any sensitive information is being leaked:&lt;/p&gt;&lt;p&gt;Example in Java:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;public Cursor query(final Uri uri, final String[] array, final String s, final String[] array2, final String s2) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final int match = this.sUriMatcher.match(uri);&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final SQLiteQueryBuilder sqLiteQueryBuilder = new SQLiteQueryBuilder();&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Passwords");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Key");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, (String)null, (String)null, s2);&lt;/p&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Example in Kotlin:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;fun query(uri: Uri?, array: Array&amp;lt;String?&amp;gt;?, s: String?, array2: Array&amp;lt;String?&amp;gt;?, s2: String?): Cursor {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val match: Int = this.sUriMatcher.match(uri)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val sqLiteQueryBuilder = SQLiteQueryBuilder()&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Passwords"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Key"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, null as String?, null as String?, s2)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Here we see that there are actually two paths, "/Keys" and "/Passwords", and the latter is not being protected in the manifest and is therefore vulnerable.&lt;/p&gt;&lt;p&gt;When accessing a URI, the query statement returns all passwords and the path Passwords/. We will address this in the "Dynamic Analysis" section and show the exact URI that is required.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;h4&gt;Testing Content Providers&lt;/h4&gt;&lt;p&gt;To dynamically analyze an application's content providers, first enumerate the attack surface: pass the app's package name to the Drozer module app.provider.info:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.info -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Package: com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path Permissions:&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path: /Keys&lt;/p&gt;&lt;p&gt;&amp;nbsp;Type: PATTERN_LITERAL&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: com.mwr.example.sieve.READ_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: com.mwr.example.sieve.WRITE_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In this example, two content providers are exported. Both can be accessed without permission, except for the /Keys path in the DBContentProvider. With this information, you can reconstruct part of the content URIs to access the DBContentProvider (the URIs begin with content://).&lt;/p&gt;&lt;p&gt;To identify content provider URIs within the application, use Drozer's scanner.provider.finduris module. This module guesses paths and determines accessible content URIs in several ways:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.finduris -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/Keys&lt;/p&gt;&lt;p&gt;Accessible content URIs:&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Once you have a list of accessible content providers, try to extract data from each provider with the app.provider.query module:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --vertical&lt;/p&gt;&lt;p&gt;_id: 1&lt;/p&gt;&lt;p&gt;service: Email&lt;/p&gt;&lt;p&gt;username: incognitoguy50&lt;/p&gt;&lt;p&gt;password: PSFjqXIMVa5NJFudgDuuLVgJYFD+8w== (Base64 - encoded)&lt;/p&gt;&lt;p&gt;email: incognitoguy50@gmail.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can also use Drozer to insert, update, and delete records from a vulnerable content provider:&lt;/p&gt;&lt;p&gt;Insert record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.insert content://com.vulnerable.im/messages&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string date 1331763850325&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string type 0&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer _id 7&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Update record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.update content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args assisted_gps_enabled&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer value 0&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Delete record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.delete content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args my_setting&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;SQL Injection in Content Providers&lt;/h4&gt;&lt;p&gt;The Android platform promotes SQLite databases for storing user data. Because these databases are based on SQL, they may be vulnerable to SQL injection. You can use the Drozer module app.provider.query to test for SQL injection by manipulating the projection and selection fields that are passed to the content provider:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "' FROM Passwords" (code 1): , while compiling: SELECT ' FROM Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --selection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "')" (code 1): , while compiling: SELECT * FROM Passwords WHERE (')
-&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If an application is vulnerable to SQL Injection, it will return a verbose error message. SQL Injection on Android may be used to modify or query data from the vulnerable content provider. In the following example, the Drozer module app.provider.query is used to list all the database tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "*&lt;/p&gt;&lt;p&gt;FROM SQLITE_MASTER WHERE type='table';--"&lt;/p&gt;&lt;p&gt;| type &amp;nbsp;| name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | tbl_name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | rootpage | sql &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;|&lt;/p&gt;&lt;p&gt;| table | android_metadata | android_metadata | 3 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 4 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 5 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |
-&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;SQL Injection may also be used to retrieve data from otherwise protected tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "* FROM Key;--"&lt;/p&gt;&lt;p&gt;| Password | pin |&lt;/p&gt;&lt;p&gt;| thisismypassword | 9876 |&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can automate these steps with the scanner.provider.injection module, which automatically finds vulnerable content providers within an app:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.injection -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Injection in Projection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;p&gt;Injection in Selection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/
-&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;File System Based Content Providers&lt;/h4&gt;&lt;p&gt;Content providers can provide access to the underlying filesystem. This allows apps to share files (the Android sandbox normally prevents this). You can use the Drozer modules app.provider.read and app.provider.download to read and download files, respectively, from exported file-based content providers. These content providers are susceptible to directory traversal, which allows otherwise protected files in the target application's sandbox to be read.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.download content://com.vulnerable.app.FileProvider/../../../../../../../../data/data/com.vulnerable.app/database.db /home/user/database.db
-Written 24488 bytes
-&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Use the scanner.provider.traversal module to automate the process of finding content providers that are susceptible to directory traversal:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.traversal -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Vulnerable Providers:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note that adb can also be used to query content providers:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;$ adb shell content query --uri content://com.owaspomtg.vulnapp.provider.CredentialProvider/credentials&lt;/p&gt;&lt;p&gt;Row: 0 id=1, username=admin, password=StrongPwd&lt;/p&gt;&lt;p&gt;Row: 1 id=2, username=test, password=test&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;For iOS:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following section summarizes keywords that you should look for to identify IPC implementations within iOS source code.&lt;/p&gt;&lt;h4&gt;XPC Services&lt;/h4&gt;&lt;p&gt;Several classes may be used to implement the NSXPCConnection API:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSXPCConnection&lt;/li&gt;&lt;li&gt;NSXPCInterface&lt;/li&gt;&lt;li&gt;NSXPCListener&lt;/li&gt;&lt;li&gt;NSXPCListenerEndpoint&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;You can set security attributes for the connection. The attributes should be verified.&lt;/p&gt;&lt;p&gt;Check for the following two files in the Xcode project for the XPC Services API (which is C-based):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;xpc.h&lt;/li&gt;&lt;li&gt;connection.h&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;Mach Ports&lt;/h4&gt;&lt;p&gt;Keywords to look for in low-level implementations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;mach_port_t&lt;/li&gt;&lt;li&gt;mach_msg_*&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Keywords to look for in high-level implementations (Core Foundation and Foundation wrappers):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CFMachPort&lt;/li&gt;&lt;li&gt;CFMessagePort&lt;/li&gt;&lt;li&gt;NSMachPort&lt;/li&gt;&lt;li&gt;NSMessagePort&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;NSFileCoordinator&lt;/h4&gt;&lt;p&gt;Keywords to look for:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSFileCoordinator&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Verify IPC mechanisms with static analysis of the iOS source code. No iOS tool is currently available to verify IPC usage.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
-                        including stealthy responses that don't simply terminate the app.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the app implements multiple different responses to tampering, debugging and
-                            emulation, including stealthy responses that don't simply terminate the app.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Data Encryption on the Network" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0019/"/>
-            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Endpoint Identify Verification" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0021/"/>
-            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the Security Provider" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0023/"/>
-            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the TLS Settings" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0020/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-NETWORK-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
-          </references>
-          <standards>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
-                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
-                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
-                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
-                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
-                        the goal of protecting against memory patches applied during runtime. This includes unwanted
-                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
-                        well as rogue code loaded into process memory.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;div&gt;
-                        Integrity can be verified either by:&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
-                        values.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
-                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
-                            responds accordingly.&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
-                        the app is running inside an emulator, the app shall terminate the session.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
-                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
-                        is detected, the app shall force termination of the session.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Launch the app systematically with various apps and frameworks installed, such as the
-                            following:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
-                        features can be preventive or reactive. As the name implies, preventive anti-debugging
-                        techniques prevent the debugger from attaching in the first place, while reactive techniques
-                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
-                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
-                        combine multiple methods of prevention and detection which operate on different API layers and
-                        are distributed throughout the app.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
-          </references>
-          <standards>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
-                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
-                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
-                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
-                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
-                            or other sources);&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
-                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Remove the debugging code, log verbose errors or debugging messages in the production version.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
-          </references>
-          <standards>
-            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
-                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>- Produce a JavaScript payload.
-                            - Inject it into the file that the app is requesting. The injection could be done either
-                            through a MITM attack or by directly modifying the file in case it is stored on external
-                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
-                            exploitation payload) which is able to install a full agent, injecting a limited agent into
-                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
-                            - Check that only the JavaScript provided with the app is allowed.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>As a general rule of thumb, as little explanative information as possible should be provided
-                        along with the compiled code. Some metadata such as debugging information, line numbers and
-                        descriptive function or method names make the binary or bytecode easier to understand for the
-                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
-                        discarded without impacting the functionality of the app.
-
-                        This data shall be removed from the release version or shall be obfuscated in order to be
-                        inaccessible to the reverse engineer.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Symbols are usually stripped during the build process, so you need the compiled byte-code
-                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
-                            nm binary in your Android NDK and export it (or create an alias).
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            export $NM =
-                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            To display debug symbols:
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ $NM -a
-                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
-                            libfoo.so: no symbols&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;To display dynamic symbols:
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            $ $NM -D libfoo.so&amp;nbsp;
-                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
-                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
-                            Adding this flag causes gcc to discard the function names while still preserving the names
-                            of functions declared as JNIEXPORT.&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            Check if the following was added to build.gradle:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
-                            binutils and can be installed via Homebrew on Mac OS X.
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
-            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
-          </references>
-          <standards>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android applications:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
-                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
-                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
-                            permissions needed by the application.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
-  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This kind of vulnerability occurs in a number of ways: 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Make Sure That Free Security Features Are Activated" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0044/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Memory Corruption Bugs" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0043/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Implicit Intents" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0026/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Local Storage for Input Validation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0002/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Object Persistence" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0034/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for Injection Flaws" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0025/"/>
-            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for URL Loading in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0027/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-CODE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
-                            gain access to the system.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
-            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
-          </references>
-          <standards>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app is correctly signed.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker attempts to invoke all common switches and options in the target
-                                application for the purpose of discovering weaknesses in the target. For example, in
-                                some applications, adding the --debug switch causes debugging information to be
-                                displayed, which can sometimes reveal sensitive processing or configuration information
-                                to an attacker.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                This attack differs from other forms of API abuse in that the attacker is blindly
-                                attempting to invoke options in the hope that one of them will work rather than
-                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
-                                with the published options of a targeted application this attack method may still be
-                                fruitful as it might discover unpublicized functionality.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-215">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-489">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-656">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MEMORY-LEAKAGE">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="OUTDATED-LIBRARIES">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of an object, resource,
-                                or system by using a variety of analysis techniques to effectively determine how the
-                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
-                                duplicate the function, or a part of the function, of an object in order to duplicate or
-                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
-                                or software, although the methodology and techniques involved in each type of analysis
-                                differ widely. When adversaries are reverse engineering software, methodologies fall
-                                into two broad categories, 'white box' and 'black box.' White box techniques involve
-                                methods which can be applied to a piece of software when an executable or some other
-                                compiled object can be directly subjected to analysis, revealing at least a portion of
-                                its machine instructions that can be observed upon execution.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                'Black Box' methods involve interacting with the software indirectly, in the absence of
-                                the ability to measure, instrument, or analyze an executable object directly. Such
-                                analysis typically involves interacting with the software at the boundaries of where the
-                                software interfaces with a larger execution environment, such as input-output vectors,
-                                libraries, or APIs.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="MASVS-EMULATION-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                <countermeasure ref="MASVS-8.7" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>If the mobile application requests permissions or access to components that are not
-                                strictly needed by the application, then users can lose trust in the security of the
-                                application with an associated impact on the trust placed in the application provider.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                <countermeasure ref="MASVS-8.1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-732">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                <countermeasure ref="MASVS-4.9" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker employs forceful browsing to access portions of a website that are
-                                otherwise unreachable through direct URL entry.
-
-                                Usually, a front controller or similar design pattern is employed to protect access to
-                                portions of a web application.
-
-                                Forceful browsing enables an attacker to access information, perform privileged
-                                operations and otherwise reach sections of the web application that have been improperly
-                                protected.
-                            </desc>
-              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-749">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-83">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                <countermeasure ref="MASVS-6.7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>Errors and error handling represent a class of API. Errors related to error handling
-                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
-                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-388">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                <countermeasure ref="MASVS-7.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
-              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
-                                operations, typically triggered by input injected by an attacker. As a consequence, an
-                                attacker is able to write past the boundaries of allocated buffer regions in memory,
-                                causing a program crash or potentially redirection of execution as per the attackers'
-                                choice.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-120">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="35cfc692-3b5d-4a87-bdea-ec64da7b3d8d" diagramComponentId="" ref="general-threats" name="General Threats" desc="This component is used to group threats, weaknesses, and countermeasures on global scope, not to any specific component." library="" parentComponentRef="" componentDefinitionRef="">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="hospitals"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:01.113">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="MASVS-3.4" name="Frequently review the used cryptographic protocols and controls to ensure they are not deprecated" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the cryptographic protocols or algorithms used are widely considered suitable for
-                        security purposes. Frequently review all cryptographic protocols and algorithms to verify they
-                        are not deprecated.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the cryptographic protocols or algorithms used are not deprecated for security
-                            purposes.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-3.3-KEY-AES" name="Use other block modes rather than ECB mode for AES encryption" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
-          <desc>Advanced Encryption Standard (AES) is the widely accepted standard for symmetric encryption in
-                        mobile apps. It's an iterative block cipher that is based on a series of linked mathematical
-                        operations. AES performs a variable number of rounds on the input, each of which involve
-                        substitution and permutation of the bytes in the input block. Each round uses a 128-bit round
-                        key which is derived from the original AES key. As of this writing, no efficient cryptanalytic
-                        attacks against AES have been discovered. However, implementation details and configurable
-                        parameters such as the block cipher mode leave some margin for error.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        You shall configure AES encryption with Cipher Block Chaining (CBC) mode instead of ECB mode.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        In CBC mode, plaintext blocks are XORed with the previous ciphertext block. This ensures each
-                        encrypted block is unique and randomized even if blocks contain the same information. When
-                        storing encrypted data, we recommend using a block mode that also protects the integrity of the
-                        stored data, such as Galois/Counter Mode (GCM). The latter has the additional benefit that the
-                        algorithm is mandatory for each TLSv1.2 implementation, and thus is available on all modern
-                        platforms.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>If AES encryption is used, verify it's not configured with ECB mode.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-3.2" name="Use proven implementations of cryptographic primitives" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
-          <desc>It's recommended to use well-known algorithms that are widely regarded as secure. Mobile
-                        operating systems offer standard cryptographic APIs that implement those algorithms.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
-            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
-          </references>
-          <standards>
-            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Carefully inspect all the cryptographic methods used within the source code, especially
-                            those that are directly applied to sensitive data. All cryptographic operations should use
-                            standard cryptographic APIs for Android and iOS.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general-threats" name="General Threats" desc="This component is used to group threats, weaknesses, and countermeasures on global scope, not to any specific component." library="">
-          <threats>
-            <threat ref="CAPEC-97" name="An attacker leverages Cryptanalysis to gain access to sensitive data" state="Expose" source="MANUAL" edited="false" owner="jesperon@iriusrisk.com" library="" editable="true">
-              <desc>Cryptanalysis is the process of finding weaknesses in cryptographic algorithms and
-                                using these weaknesses to decipher the ciphertext without knowing the secret key
-                                (instance deduction). Sometimes the weakness is not in the cryptographic algorithm
-                                itself, but rather in how it is applied that makes cryptanalysis successful. An attacker
-                                may have other goals as well, such as:
-                                The goal of the attacker performing cryptanalysis will depend on the specific needs of
-                                the attacker in a given attack context. In most cases, if cryptanalysis is successful at
-                                all, an attacker will not be able to go past being able to deduce some information about
-                                the plaintext (goal 3). However, that may be sufficient for an attacker, depending on
-                                the context.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-3.2" mitigation="34"/>
-                    <countermeasure ref="MASVS-3.3-KEY-AES" mitigation="33"/>
-                    <countermeasure ref="MASVS-3.4" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-3.2" mitigation="34"/>
-                <countermeasure ref="MASVS-3.3-KEY-AES" mitigation="33"/>
-                <countermeasure ref="MASVS-3.4" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="28dedef7-48d7-4986-a0b6-ee0c2bb399ef" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.583">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.930">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.931">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.931">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.486">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.715">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="75060b01-634d-49bf-addd-bb25d27f1724" diagramComponentId="7ef03c40-e025-445c-9ef6-3ac910aac821" ref="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" name="Load Balancer" desc="" library="IR-Network-Components" parentComponentRef="" componentDefinitionRef="CD-LOAD-BALANCER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.907">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-LOAD-BALANCER2" name="Enable all access logs for Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="IR-Network-Components" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable all access logs for Load Balancers&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Logging should be configured to meet your organizational security and privacy policies. Enabling detailed logging to include information about events, event sources, timestamps, and users may assist in incident response activities.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable all access logs for Load Balancers.&lt;/p&gt; 
-&lt;p&gt;Please see Reference links for more information and examples.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Logging with Load Balancer" url="https://www.ibm.com/docs/en/was-zos/9.0.5?topic=SS7K4U_9.0.5/com.ibm.websphere.edge.doc/lb/tprf_log.htm"/>
-            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that the access logs are created when a user is visiting the load balancer.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.852">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-LOAD-BALANCER1" name="Use SSL Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="IR-Network-Components" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use SSL Load Balancers&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; An SSL load balancer is a load balancer that also performs encryption and decryption of data transported via HTTPS, which uses the Secure Sockets Layer (SSL) protocol or its successor, the Transport Layer Security (TLS) protocol, to secure HTTP data as it crosses the network. Encryption of sensitive information protects against potential attackers and man-in-the-middle attacks.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; An SSL load balancer acts as the server-side SSL endpoint for connections with clients, meaning that it performs the decryption of requests and encryption of responses that the web or application server would otherwise have to do. The process varies somewhat depending on the security of the network between the load balancer and server:&lt;/p&gt; 
-&lt;p&gt;- If the load balancer and server are on the same secured network (generally this means being behind a firewall), the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and forward the request to the server in the clear (unencrypted). It encrypts the server's response before returning it to the client.&lt;br&gt; - If the network between the load balancer and server is not secure, the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and re-encrypt the request before forwarding it to the server. The process is reversed for the response from server to client.&lt;/p&gt; 
-&lt;p&gt;Offloading the decryption and encryption process, which is computationally intensive, frees web and application servers to perform the work they are designed for, which speeds content delivery and improves the overall user experience. If the network between load balancer and servers is secure, you only need to install and manage the SSL certificates on the load balancer instead of every web and application server. This significantly reduces administrative overhead if the group of servers is large.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="What Is an SSL Load Balancer?" url="https://www.nginx.com/resources/glossary/ssl-load-balancer/#:~:text=An%20SSL%20load%20balancer%20is,as%20it%20crosses%20the%20network."/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that you are using an SSL load balancer.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.851">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="IR-Network-Components">
-          <threats>
-            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="IR-Network-Components" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="IR-Network-Components">
-          <threats>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="IR-Network-Components" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="307606c7-312c-4080-a7e1-b83404c29dff" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.545">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.158">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From cf4d540e2255923b3768d0500c5fda968fabb0c1 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:22:19 -0400
Subject: [PATCH 17/28] Delete Templates/kubernetes-deployment.xml

---
 Templates/kubernetes-deployment.xml | 10601 --------------------------
 1 file changed, 10601 deletions(-)
 delete mode 100644 Templates/kubernetes-deployment.xml

diff --git a/Templates/kubernetes-deployment.xml b/Templates/kubernetes-deployment.xml
deleted file mode 100644
index 3290979..0000000
--- a/Templates/kubernetes-deployment.xml
+++ /dev/null
@@ -1,10601 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="kubernetes-deployment" name="Kubernetes Deployment" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTg5NCIgZHk9Ijg5MSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjAuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjIiIHZhbHVlPSJJbnRyYW5ldCBPZmZpY2UgbmV0d29ya3MiIHN0eWxlPSJpci5yZWY9MTIyMjc3ZjItN2E0Mi00NGFkLTk3ODYtZWMxMDA0MTA3MDMwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjYwIiB5PSIzNTAiIHdpZHRoPSI3MjAiIGhlaWdodD0iNjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkJyb3dzZXIgLT4gQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0zMTI3NDc5NC1kOTVkLTQ2MmEtYTQ4MC1kN2FhNWJkOTA3NWI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyIiBzb3VyY2U9IjMiIHRhcmdldD0iMTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0zYjE3YjM3OS1hY2FhLTRiYTAtODg3OS0xOGUwNTJkNGViZGI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEwMS41IiB5PSI2MCIgd2lkdGg9IjEyOC41IiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1mYzkxNmIxMy05MGM3LTRiNzgtYjJhZi1mOGY1ZDBlNDJmZWI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NDAiIHk9IjI2Mi41IiB3aWR0aD0iMTAwIiBoZWlnaHQ9Ijc3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJLOFMgQ2x1c3RlciIgaXIuc291cmNlU3R5bGU9IndoaXRlU3BhY2U9d3JhcDtodG1sPTE7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9I2I5ZDBlNjtzdHJva2VXaWR0aD0zO2ZpbGxDb2xvcj0jZGJlYWY3O2FsaWduPWxlZnQ7dmVydGljYWxBbGlnbj10b3A7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0id2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmb250Q29sb3I9IzhDOEM4QztzdHJva2VDb2xvcj0jMjBDOUUzO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPSNkYmVhZjc7YWxpZ249bGVmdDt2ZXJ0aWNhbEFsaWduPXRvcDtjb250YWluZXI9MTtyb3VuZGVkPTE7YXJjU2l6ZT0zO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7Zm9udFNpemU9MTM7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIwIiB5PSIyMzAiIHdpZHRoPSI0NjAiIGhlaWdodD0iMzUwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI2IiB2YWx1ZT0iTWljcm9zZXJ2aWNlIC0+IE1pY3Jvc2VydmljZSIgc3R5bGU9ImlyLnJlZj1lYzUyMDFmZi1iMzQzLTQ5MDEtODIxYi02NjI4MWU5OTM2OWU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI1IiBzb3VyY2U9IjciIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI0MDAiIHk9IjE1MCIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik1pY3Jvc2VydmljZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZjMwYjliNGEtNTNmNC00NDg3LWFiZjQtYzhjNWFiZjVkZWY4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI4MCIgeT0iMTgwIiB3aWR0aD0iMTMwIiBoZWlnaHQ9IjE1MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iOCIgdmFsdWU9Ik9BdXRoMiBBdXRob3JpemF0aW9uIFNlcnZlciIgc3R5bGU9ImlyLnJlZj01MmMwZjk5MC0zNGRlLTQ0ZDgtYTg1NS0yMzJlMzY2NWY5ODY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjMwIiB5PSIyOSIgd2lkdGg9Ijc0IiBoZWlnaHQ9IjY2LjUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkiIHZhbHVlPSJNaWNyb3NlcnZpY2UgLT4gTWljcm9zZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWQ2M2U1NmY3LWMxMzctNDY3MS1iNDM4LWViMDVmODMwNmU1NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjI1O2VudHJ5WT0wO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjUiIHNvdXJjZT0iMTAiIHRhcmdldD0iNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjMwMCIgeT0iMTUwIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iTWljcm9zZXJ2aWNlIiBpci5zb3VyY2VTdHlsZT0iaXIucmVmPTY4MzFjZDYyLWQ4ODktNDgwOC1hMDZlLTc5YmI2NjBiOTQ4NTtyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNGNUY1RjU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTA7IiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zYzAxMGQ2ZC02ZjFkLTQyMzEtOGZiNi01OWM0MTg2M2I5MTg7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0wOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjMwMCIgeT0iNDIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI1OCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBUEkgZ2F0ZXdheSAtPiBNaWNyb3NlcnZpY2UiIHN0eWxlPSJpci5yZWY9NGE3MTNiOGEtMjgzMS00NzU3LTk3NDEtYTQ5NmI1OGY2NzYzO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjUiIHNvdXJjZT0iMTIiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkFQSSBnYXRld2F5IiBzdHlsZT0iaXIucmVmPTc0MWJlYzU0LWRjNWUtNGE0Ny05MzhjLTVmZDA1MDBhN2YzNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTQ2O2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI5Mi4yNSIgeT0iMzEiIHdpZHRoPSIxMDciIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEzIiB2YWx1ZT0iTWljcm9zZXJ2aWNlIC0+IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9MjdhZWNmOTQtMGIyZC00Zjg2LTkwNDgtM2JkMDk2ZmJkYTJmO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMTAiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0IiB2YWx1ZT0iQnJvd3NlciAtPiBMb2FkIEJhbGFuY2VyIiBzdHlsZT0iaXIucmVmPTVhYTBhOWQ3LWNjOTctNGVkMi1hYWFlLTVjOTcyODNhOWU2ZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnRhZ3M9Z2l0LHRlc3Qsc25tcDsiIHBhcmVudD0iMiIgc291cmNlPSIzIiB0YXJnZXQ9IjEyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxNjUiIHk9IjI3MiIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjE1IiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj1iZDVkMDE3NS0xYWU0LTQ2MDAtODlmNy1kNzkzODJiNDUyMWI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xMDciIHk9IjYwIiB3aWR0aD0iMTI4LjUiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="TZ_CAMPN" uuid="122277f2-7a42-44ad-9786-ec1004107030" name="Intranet Office networks" desc="All intranet subnets allocated to user campuses, with exception of DC LAN." trustRating="75"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Microservice -&gt; PostgreSQL" ref="27aecf94-0b2d-4f86-9048-3bd096fbda2f" source="fc4bb90d-5fd7-41c7-86d5-f525405e131c" target="c9a60958-03d9-4f6b-9eb5-f4d45d2e8ee7">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Browser -&gt; Browser" ref="31274794-d95d-462a-a480-d7aa5bd9075b" source="7a006981-9b19-4f28-9179-8d188d0287bb" target="97fc3a11-542f-405d-936a-0e5db5bfd099">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="API gateway -&gt; Microservice" ref="4a713b8a-2831-4757-9741-a496b58f6763" source="f77649d4-e989-4cc1-a2fa-1563a46cbfab" target="fc4bb90d-5fd7-41c7-86d5-f525405e131c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Browser -&gt; Load Balancer" ref="5aa0a9d7-cc97-4ed2-aaae-5c97283a9e6f" source="7a006981-9b19-4f28-9179-8d188d0287bb" target="f77649d4-e989-4cc1-a2fa-1563a46cbfab">
-      <assets/>
-      <tags>
-        <tag tag="git"/>
-        <tag tag="snmp"/>
-        <tag tag="test"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Microservice -&gt; Microservice" ref="d63e56f7-c137-4671-b438-eb05f8306e57" source="fc4bb90d-5fd7-41c7-86d5-f525405e131c" target="8739495e-2db8-472a-b6b1-03d575b0f774">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Microservice -&gt; Microservice" ref="ec5201ff-b343-4901-821b-66281e99369e" source="8739495e-2db8-472a-b6b1-03d575b0f774" target="fc4bb90d-5fd7-41c7-86d5-f525405e131c">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="b2ee1f6e-67d1-4ac8-b32e-e1ca1fda5a56" diagramComponentId="52c0f990-34de-44d8-a855-232e3665f986" ref="3d2dd5b4-2170-459e-b72b-8e09b0ce946d" name="OAuth2 Authorization Server" desc="" library="" parentComponentRef="8739495e-2db8-472a-b6b1-03d575b0f774" componentDefinitionRef="oauth2-authorization-server">
-      <tags/>
-      <questions>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.478">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.761">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.883">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".
- 
-</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="29" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;
- &lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;
- &lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:37.035">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.573">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="50" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt;
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="43" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="49" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;
-&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;
-&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;
-&lt;ol&gt;
- &lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;
- &lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;
- &lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;
-&lt;/ol&gt;
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="28" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:40.828">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-              <reference name="RFC7636" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="29" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="28" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against the following threats:&amp;nbsp; 
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt;
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt;
-  &lt;li&gt;online guessing (a short expiration time will reduce the likelihood of success)&amp;nbsp;&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt; Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="c38d0231-a456-4fd6-9399-1d0b31f44fde" diagramComponentId="bd5d0175-1ae4-4600-89f7-d79382b4521b" ref="97fc3a11-542f-405d-936a-0e5db5bfd099" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.156">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.388">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.041">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.386">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.705">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.388">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.171">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.919">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:13.821">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3d0c92b1-1ff1-44be-b49d-aa4fd959c279" diagramComponentId="3c010d6d-6f1d-4231-8fb6-59c41863b918" ref="fc4bb90d-5fd7-41c7-86d5-f525405e131c" name="Microservice" desc="" library="" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.180">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.282">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.179">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.748">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="43" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.170">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.060">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.603">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.604">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.061">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7b5eaf70-b951-4ce2-8af1-b62ae46bdae3" diagramComponentId="fc916b13-90c7-4b78-b2af-f8f5d0e42feb" ref="c9a60958-03d9-4f6b-9eb5-f4d45d2e8ee7" name="PostgreSQL" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.619">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.229">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.913">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.231">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.231">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.486">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.932">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3dfa5b94-2832-42e4-a457-294bf620838e" diagramComponentId="741bec54-dc5e-4a47-938c-5fd0500a7f37" ref="f77649d4-e989-4cc1-a2fa-1563a46cbfab" name="API gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.675">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="47" state="Required" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes>&lt;p&gt;mycomment-test-notes-3&lt;/p&gt;</notes>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="47" state="Rejected" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes>&lt;p&gt;mycomment-test-notes&lt;/p&gt;</notes>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6993393c-beaf-4d29-b8f3-f59d269cb3f0" diagramComponentId="f30b9b4a-53f4-4487-abf4-c8c5abf5def8" ref="8739495e-2db8-472a-b6b1-03d575b0f774" name="Microservice" desc="" library="" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.592">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.714">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.282">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
- Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec).
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Rationale&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
- Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:49.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.496">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.163">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="31" state="Implemented" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
- An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Rationale&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
- Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1e7ef724-93f2-4129-a7ae-5f8b3ca344c3" diagramComponentId="3b17b379-acaa-4ba0-8879-18e052d4ebdb" ref="7a006981-9b19-4f28-9179-8d188d0287bb" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions>
-        <question ref="authentication.browser.login.yes" answer="true" manuallyModified="false"/>
-        <question ref="authn.browser.sf" answer="true" manuallyModified="false"/>
-        <question ref="bespokeImplementationOfStandardCrypto" answer="true" manuallyModified="false"/>
-        <question ref="browser.data.json" answer="true" manuallyModified="false"/>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="jquery" answer="true" manuallyModified="false"/>
-        <question ref="react" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
-        <question ref="tp.content" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="TZ_CAMPN"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-942-CORS_PERMISSIVE" name="CORS Access-Control-Allow-Origin policy is set to *" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses a cross-domain policy file that includes domains that should not be trusted.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A cross-domain policy file ("crossdomain.xml" in Flash and "clientaccesspolicy.xml" in Silverlight) defines a whitelist of domains to which a server is allowed to make cross-domain requests. When making a cross-domain request, the Flash or Silverlight client will first look for the policy file on the target server. If it is found, and the domain hosting the application is explicitly allowed to make requests, the request is made.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if a cross-domain policy file includes domains that should not be trusted, such as when using wildcards, then the application could be attacked by these untrusted domains. An overly permissive policy file allows many of the same types of attacks seen in Cross-Site Scripting (CWE-79). Once a user has executed a malicious Flash or Silverlight application, they are vulnerable to a variety of attacks. The attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker could also potentially send malicious requests to a website on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. In many of these cases, the attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-942: Overly Permissive Cross-domain Whitelist" url="https://cwe.mitre.org/data/definitions/942.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.592">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.102">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
-                        proves that the claim is correct.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-233" name="Improper Handling of Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-525" name="Information Exposure Through Browser Caching" state="0" impact="100" issueId="" issueLink="">
-          <desc>For each web page, the application should have an appropriate caching policy specifying the
-                        extent to which the page and its form fields should be cached.
-                        &lt;br /&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-525: Information Exposure Through Browser Caching" url="https://cwe.mitre.org/data/definitions/525.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores sensitive information without properly limiting read or write access by
-                        unauthorized actors.
-                        If read access is not properly restricted, then attackers can steal the sensitive information.
-                        If write access is not properly restricted, then attackers can modify and possibly delete the
-                        data, causing incorrect results and possibly a denial of service.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.066">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-613" name="Insufficient Session Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.597">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-613: Insufficient Session Expiration" url="https://cwe.mitre.org/data/definitions/613.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.557">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:32.443">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM" name="No consent mechanism (conform GDPR &amp; E-privacy Regulation)" state="0" impact="100" issueId="" issueLink="">
-          <desc>No consent mechanisms (or a consent mechanism that does not comply with the GDPR and E-privacy legislation consent requirements) so the organization is unable prove to data protection authorities that the processing is legitimate/legal.
-          </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY" name="No export functionality" state="0" impact="100" issueId="" issueLink="">
-          <desc>No exportability functionality (for users or admins) which would allow the user to (directly or indirectly via an admin) export his personal data in a clear, readable format and transport it to another data controller. </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.864">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
-          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
-
-If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.104">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-94" name="The application executes code retrieved from untrusted data sources" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The execution of untrusted code potentially grants direct control over the application; allowing an attacker to perform arbitrary operations, steal sensitive data, or use the application to launch other malicious attacks.&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.349">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-94: Improper Control of Generation of Code ('Code Injection')" url="https://cwe.mitre.org/data/definitions/94.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-598" name="The application sends sensitive information using the URL query string" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application uses the GET method to process requests that contain sensitive
-                        information, which can expose that information through the browser's history, Referers, web
-                        logs, and other sources.
-                        &lt;br /&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-598: Information Exposure Through Query Strings in GET Request" url="https://cwe.mitre.org/data/definitions/598.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.170">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.637">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.472">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" name="Create a consent mechanism" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement a consent mechanism which allows data subjects (persons of whom personal data is processed) to give their consent for certain processing activities. This is mainly used for cookies and secondary purposes such as direct marketing, newsletters, ...&lt;br/&gt; 
-          &lt;br/&gt;The consent mechanism often consists of a check box. These check boxes are required for every single secondary purpose (not allowed to implement one consent box for all purposes). The consent boxes should: &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;be inactive by default (the data subject should active the box)&lt;/li&gt;
-              &lt;li&gt;revocable (the data subject must be able to revoke the consent in a way that is as easy as it was to give consent, this can be done by implementing a platform on which the data subject can actively manage his/her consents) &lt;/li&gt;
-              &lt;li&gt;Traceable (a consent database is required to track when consent was given and revoked. This must include timestamps) &lt;/li&gt;
-              &lt;/ul&gt;
-              &lt;br /&gt;You must involve the DPO and/or legal department to decide on the legitimation that can be used.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.6" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.7" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify appropriate user personal data consent mechanisms are in place and are not pre-granted.&lt;/li&gt;
-                &lt;li&gt;Verify users can modify their data consent choices in a manner as easy as giving consent.&lt;/li&gt;
-                &lt;li&gt;Verify the above above user activities have been appropriately logged.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.178">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="not-store-sensitive-data-client-side" name="Do not store sensitive data on the client-side and remove sensitive authentication data" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Browsers and extensions provide a number of local storage options to persist data during HTTP interactions, including (but not limited to) Cookies, HTML5 local storage, session storage, IndexedDB, Flash cookies, and Silverlight isolated storage. These storage options may all be accessed by subsequent users of the browser or computer, and due to this some have experienced unauthorized and/or remote access to their contents. It is important that sensitive, private, and otherwise restricted data is handled with care on the client-side, and is not stored in insecure locations which may expose it to attack.&lt;/p&gt;&lt;p&gt;Sensitive data should not be persistently stored on the client-side due to the risk of exposure. However, during normal application operation, authenticated and other sensitive data is passed, stored in transient form, and displayed to users. It is important that any such temporary storage is purged in a timely manner and actively at the end of a user session.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do not store sensitive data in any kind of persistent, client-side storage.&lt;/li&gt;&lt;li&gt;Review any application or browser layer caching or temporary storage to ensure it doesn't expose data.&lt;/li&gt;&lt;li&gt;Sensitive data (including any authenticated content) stored in client-side objects such as the browser DOM should be cleared and removed actively at the end of user session (e.g. using the logout function), and where possible cleared through hard termination of the browser (e.g. closing the window or tab without using the proper application function).&lt;/li&gt;&lt;li&gt;Ensure any storage used during application interaction is temporary, and automatically cleared by the browser.&lt;/li&gt;&lt;li&gt;Where possible, set expiration times on client-side data to prevent accidental or malicious storage or disclosure.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify application functionality where sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application.&lt;/li&gt;&lt;li&gt;Ensure that authentication data is removed after the session termination, to test it, use the following steps:&lt;ul&gt;&lt;li&gt;Access the application as an authenticated user.&lt;/li&gt;&lt;li&gt;Manually or programmatically browse the site and use authenticated functionality&lt;/li&gt;&lt;li&gt;In particular, identify application functionality in which sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application. For example, review the HTML5 objects localStorage and sessionStorage for any sensitive data which is saved and not deleted after the logout&lt;/li&gt;&lt;li&gt;Alternatively, a Javascript console can be used with the command: &lt;i&gt;sessionStorage//Storage {length: 0}localStorage//Storage {length: 0}&lt;/i&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Required" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.221">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
-                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
-                            within the application.&lt;/li&gt;
-                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
-                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
-                            or PUT request).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
-                        practice and required minimum key lengths depend on the scenarios listed below.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
-            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
-            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
-                            &lt;br /&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
-                            bits&lt;/li&gt;
-                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
-&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
-&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
-  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
-  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
-  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
- &lt;/ul&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
-            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
-            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-            <reference name="OWASP Top 10 Proactive Controls C8: Protect Data Everywhere" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
- &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
- &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;span&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
-              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" name="Implement a method to remove or export user data on demand" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data gathered from a user should be exportable. This does not include derived fields that were created by the organization, such as customer segmentation fields.&amp;nbsp;&lt;br&gt;&lt;br&gt;Provide or develop the means to facilitate data portability requests, such as download tools or Application Programming Interfaces (API).&amp;nbsp;&lt;br&gt;&lt;br&gt;Guarantees should be in place that personal data is transmitted in a structured, commonly used and machine-readable format, and ensure the interoperability of the data format, provided in the exercise of a data portability request.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="A Complete Guide to GDPR, CCPA and International Privacy Laws" url="https://secureprivacy.ai/complete-guide-to-international-data-privacy-laws/"/>
-          </references>
-          <standards>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Verify users have the functionality to request personal data transfer and/or download their own data.&lt;/li&gt;
-                        &lt;li&gt;Verify data is in a form acceptable to the Data Protection Practitioner.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.376">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="29" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="minimise-parameters-request" name="Minimize the number of parameters in a request" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP requests should contain only the necessary parameters to perform the action (such as hidden fields, Ajax variables, cookies and header values). And the response only return the required information. If unnecessary information is included in the HTTP request, the attack surface is enlarged unnecessarily.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify all requests have only the necessary parameters needed to work correctly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.377">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Overwrite memory with zeros or random data before release.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
-          </references>
-          <standards>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
-                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
-                            soon as they are not needed anymore.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.762">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.473">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-942-CORS" name="Restrict Cross Domain Origin policy through HTTP headers" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        If an overly permissive policy is specified then an attacker may be able to execute malicious
-                        code hosted on a third party site in the victim's browser under the security trust of the
-                        legitimate application. To prevent this:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Set the Access-Control-Allow-Origin header to only permit explicitly required trusted
-                        domains.&lt;/li&gt;
-                        &lt;li&gt;This set should be as small as possible, and follow the 'least privilege' paradigm.&lt;/li&gt;
-                        &lt;li&gt;Do not use untrusted or tainted user-data from untrusted domains in CORS responses
-                        without proper validation and sanitization.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;Access-Control-Allow-Origin:
-                            valid_host_name&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's end-points.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite, Fiddler)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Modify the Host: header in transit&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:32.218">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
-                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
-                        directives to control what data may be cached, where, and for how long. It is important to specify
-                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
-                        of authenticated and otherwise restricted access data, either in the users' browser or other
-                        devices.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
-                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
-                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-          </references>
-          <standards>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-94" name="Use JSON.parse to safely parse JSON objects" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AJAX requests used to pass data between the client and server may contain any data, including malicious executable content. This data must be parsed in a safe manner to prevent malicious code being executed compromising the application or it's users. Utilizing eval based solutions to process input data places the application at risk, as the malicious user has control over the data passed to the eval function, and could execute arbitrary code as a result. JSON.parse provides a means to convert the JSON payloads into an object without risk of execution.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure all tainted and potentially malicious data is processed using JSON.parse.&lt;/li&gt;&lt;li&gt;Data should be validated and sanitized using appropriate syntactic and semantic checks, ideally against a white-list of known-good input.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Identify application components receiving JSON as an input data.&lt;/li&gt;
-                            &lt;li&gt;Ensure the code interpreting the object is using the JSON.parse method.&lt;/li&gt;
-                            &lt;li&gt;If it is using an eval function the test should fail.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.224">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.835">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Encryption should fail closed so that data does not get stored in an unprotected state. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
-            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
-                            &lt;br /&gt;
-                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
-                            the following conditions must be met: &lt;/p&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
-                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
-                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
-                            (e.g. gathered by different sessions or manipulation of session state) share a common
-                            divisor in the length.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-204-AUTOCOMPLETE" name="Attackers with access to a victim's client could read locally stored credentials" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>If the application accepts sensitive data through forms, then browsers could cache that data and play it if an attacker views the same form in the same browser. This requires the attacker to have access to the victim's browser.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-525">
-                  <countermeasures>
-                    <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-922">
-                  <countermeasures>
-                    <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
-                <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-ILLEGAL-PROCESSING-PERSONAL-DATA" name="Illegal processing of personal data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Processing personal data without legal grounds which makes it possible for data subjects to file a complaint at local Data Protection Authority which might lead to administrative fines.
-              </desc>
-              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="WEB-QUERY-PARAM" name="Sensitive data is compromised through query parameters in the URL" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Sensitive data directly inserted as a parameters in the URL string could all too easily leak that data inside logs, browser history, etc.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Additionally this information could potentially be leveraged by an attacker to gain access to the entire system or user data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-598">
-                  <countermeasures>
-                    <countermeasure ref="CWE-598" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-598" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.
-                            </desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>If the component handles credentials and it does not do a proper clean-up of them in
-                                memory, they could be accessed by an attacker by inspecting the memory or reading
-                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-255">
-                  <countermeasures>
-                    <countermeasure ref="CWE-226" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-226" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-602">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-233">
-                  <countermeasures>
-                    <countermeasure ref="minimise-parameters-request" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="minimise-parameters-request" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ASVS-2014-3.3" name="Attackers could gain access to an open session, if they have access to a user's browser" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>If a user steps away from their browser for a few minutes and there is an
-                                opportunity for
-                                an attacker to access the browser, then they could gain access to the user's logged
-                                in
-                                session and perform operations on their behalf.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="10"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-613">
-                  <countermeasures>
-                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-942-CORS_PERMISSIVE" name="Attackers could gain access to sensitive data through a too permissive CORS policy" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An overly permissive policy file may allow many types of attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Once a user has visited a malicious site, they are vulnerable to a variety of attacks. For example, the attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker may be able to send malicious requests to a web site on behalf of the victim, which could be especially dangerous if the victim has administrator privileges to manage that site.&lt;/p&gt;&lt;p&gt;In many cases, these types of attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-942-CORS_PERMISSIVE">
-                  <countermeasures>
-                    <countermeasure ref="CWE-942-CORS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-942-CORS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="WEB-CLIENT-INJ" name="Attackers gain access to the system through Client-Side Code Injection" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an attacker is able to mix controlled input with Client-Side code he could direct attacks to steal sensitive data from users.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-94">
-                  <countermeasures>
-                    <countermeasure ref="CWE-94" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-94" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-SUBJECT-RIGTHS" name="Subjects cannot exercise their rights over their personal data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Data subject cannot exercise their rights which makes it possible for them to file a complaint at the local Data Protection Authority which might lead to administrative fines.&amp;nbsp;&lt;br&gt;&lt;br&gt;Data subject = person of whom personal data is processed&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY">
-                  <countermeasures>
-                    <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                theft and then uses this key to forge signatures from the original signer to mislead a
-                                victim into performing actions that benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
-                                generation and then uses this key to forge signatures from the original signer to
-                                mislead a victim into performing actions which benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-330">
-                  <countermeasures>
-                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-345">
-                  <countermeasures>
-                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="crypto-operations" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="crypto-operations" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 0fa4b3edcd5ac64fd66fc44e7c10fab24cde073d Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:22:36 -0400
Subject: [PATCH 18/28] Delete Templates/llm-template-template.xml

---
 Templates/llm-template-template.xml | 7269 ---------------------------
 1 file changed, 7269 deletions(-)
 delete mode 100644 Templates/llm-template-template.xml

diff --git a/Templates/llm-template-template.xml b/Templates/llm-template-template.xml
deleted file mode 100644
index 9333492..0000000
--- a/Templates/llm-template-template.xml
+++ /dev/null
@@ -1,7269 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="llm-template-template" name="llm-template template" tags="">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iNDY4NCIgZHk9IjIyNzkiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0ibnVsbCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjIiIHZhbHVlPSJQdWJsaWMiIHN0eWxlPSJpci5yZWY9NjM3NmQ1M2UtNjQ2MS00MTJiLThlMDQtN2IzZmUyYjM5N2RlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xNDAyIiB5PSItNDk3IiB3aWR0aD0iMjY4NyIgaGVpZ2h0PSIxNTU2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJMTE0gQXBwbGljYXRpb24iIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjMiPjxteENlbGwgc3R5bGU9ImlyLnJlZj04YTY0ZTJmZi1jYThmLTQyYzItOTkzZi0xMTMyZjYyMGExNGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzM0IiB5PSI1NyIgd2lkdGg9IjE5MDciIGhlaWdodD0iMTIyNiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJMTE0gUHJvZHVjdGlvbiBTZXJ2aWNlcyAtPiBBcHBsaWNhdGlvbiBTZXJ2aWNlcyIgc3R5bGU9ImlyLnJlZj04ODk4ZTY2Zi0wYjgzLTQ4ODEtYTE0My1jODFhN2ZlZGFiZWE7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPS0wLjAyMTtleGl0WT0wLjU4MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MS4wMDM7ZW50cnlZPTAuNTQ4O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZXhpdFBlcmltZXRlcj0wO2VudHJ5UGVyaW1ldGVyPTA7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iOCIgdGFyZ2V0PSIxNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ijc3MCIgeT0iNTc5Ii8+PG14UG9pbnQgeD0iNzcwIiB5PSI1ODMiLz48bXhQb2ludCB4PSI0NTEiIHk9IjU4MyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iTExNIFByb2R1Y3Rpb24gU2VydmljZXMgLT4gUGx1Z2luL0V4dGVuc2lvbnMiIHN0eWxlPSJpci5yZWY9NTQ5NzlkODMtZmFlYS00YTAyLTkwMDYtNjUzNmE2OGZhNGM5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSI4IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjgiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1lZDIzYTFjMC0wNmZjLTRlMTctYmYwMS1mNDRjYjdiOWQxMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTA4OSIgeT0iMjY1IiB3aWR0aD0iMjYwIiBoZWlnaHQ9IjU0MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzkiIHZhbHVlPSJMTE0gQXV0b21hdGlvbiAoQWdlbnRzKSAtPiBMTE0gTW9kZWwiIHN0eWxlPSJpci5yZWY9Yzc4MTg2MjktYTE4NC00MzU5LWFiMGMtMDg4YWJmZDg2M2VkO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iOCIgc291cmNlPSI5IiB0YXJnZXQ9IjE0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOSIgdmFsdWU9IkxMTSBBdXRvbWF0aW9uIChBZ2VudHMpIiBzdHlsZT0iaXIucmVmPTFjZDU3MjNiLTI3ZTItNDNiNi1iMWVmLWEwODIxYjYxOTJmOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijg1IiB5PSIxMzEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzgiIHZhbHVlPSJMTE0gTW9kZWwgLT4gTExNIEF1dG9tYXRpb24gKEFnZW50cykiIHN0eWxlPSJpci5yZWY9NGVmNTBjZGEtZWQzZS00YzdiLWEyY2UtMzEwODg0ZDhlYTQ1O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjgiIHNvdXJjZT0iMTQiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjIxNiIgeT0iMzg2Ii8+PG14UG9pbnQgeD0iMjE2IiB5PSIxNzYiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxNCIgdmFsdWU9IkxMTSBNb2RlbCIgc3R5bGU9ImlyLnJlZj0zODkxMzY1MS1hNjc5LTQ5NGUtYjQ5MS1mYWI5OTA1NmJiMDQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOTAiIHk9IjM0MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IlRyYWluaW5nIERhdGFzZXQgJmFtcDsgUHJvY2Vzc2luZyAtPiBMTE0gUHJvZHVjdGlvbiBTZXJ2aWNlcyIgc3R5bGU9ImlyLnJlZj0wZTQ0Y2Y2NC1jZGQ4LTQ4MGEtYjZlZS1kM2Y3MWUxMTQyOTM7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxMSIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVHJhaW5pbmcgRGF0YXNldCAmYW1wOyBQcm9jZXNzaW5nIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSIxMSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTE2MjRiY2FmLWI4MmUtNGZiOC1hM2UwLWU4MjA5NjFjZjNiMztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NTQiIHk9IjkxMSIgd2lkdGg9Ijg4OCIgaGVpZ2h0PSIyNzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iRmluZS1UdW5pbmcgRGF0YSIgc3R5bGU9ImlyLnJlZj1lNjU4MDkzNC03NDBmLTQ5NzQtOTdjZS01MWM4YzgyYWQ3MTQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjExIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE1MiIgeT0iODAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTMiIHZhbHVlPSJUcmFpbmluZyBEYXRhIiBzdHlsZT0iaXIucmVmPTI4ZmJmYjEzLWZiZmItNGRhNC05ZTljLWE1YTY5NjI2MzQwZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1vdGhlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TURFMU5pQXdMalF4TlRrMU5rTXdMalk0TnpreU1TQXdMalF4TlRrMU5pQXdMamcwTURFMU5pQXdMak0wTURjM05pQXdMamcwTURFMU5pQXdMakkwTnprMU5rTXdMamcwTURFMU5pQXdMakUxTlRFek5pQXdMalk0TnpreU1TQXdMakEzT1RrMU5qRWdNQzQxTURBeE5UWWdNQzR3TnprNU5UWXhRekF1TXpFeU16a3hJREF1TURjNU9UVTJNU0F3TGpFMk1ERTFOaUF3TGpFMU5URXpOaUF3TGpFMk1ERTFOaUF3TGpJME56azFOa013TGpFMk1ERTFOaUF3TGpNME1EYzNOaUF3TGpNeE1qTTVNU0F3TGpReE5UazFOaUF3TGpVd01ERTFOaUF3TGpReE5UazFObHBOTUM0M05qa3dPVFlnTUM0ME1qTXdPVFpETUM0M09UUTNOemdnTUM0ME1UQTJNek1nTUM0NE1UZzJOelFnTUM0ek9UUTROVGNnTUM0NE5EQXhOVFlnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0NE5EQXhOVFlnTUM0NE5EUTNOellnTUM0Mk9EYzVNakVnTUM0NU1UazVOVFlnTUM0MU1EQXhOVFlnTUM0NU1UazVOVFpETUM0ek1USXpPVEVnTUM0NU1UazVOVFlnTUM0eE5qQXhOVFlnTUM0NE5EUTNOellnTUM0eE5qQXhOVFlnTUM0M05URTVOVFpXTUM0ek56WXhPREpETUM0eE9ERTJNemtnTUM0ek9UUTROVGNnTUM0eU1EVTFNelFnTUM0ME1UQTJNek1nTUM0eU16RXlNVFlnTUM0ME1qTXdPVFpETUM0ek1ETXpPREVnTUM0ME5UZzNNVElnTUM0ek9UZzBPVFlnTUM0ME56ZzVOVFlnTUM0MU1EQXhOVFlnTUM0ME56ZzVOVFpETUM0Mk1ERTRNVFlnTUM0ME56ZzVOVFlnTUM0Mk9UWTVNekVnTUM0ME5UZzNNVElnTUM0M05qa3dPVFlnTUM0ME1qTXdPVFphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTMxIiB5PSI4MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkFwcGxpY2F0aW9uIFNlcnZpY2VzIC0+IFRyYWluaW5nIERhdGFzZXQgJmFtcDsgUHJvY2Vzc2luZyIgc3R5bGU9ImlyLnJlZj05NDg4ZjdiYi04ZGUyLTQzMzgtOWE4ZS0wZmFmMWZmODFkNmU7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxNSIgdGFyZ2V0PSIxMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iQXBwbGljYXRpb24gU2VydmljZXMgLT4gTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIHN0eWxlPSJpci5yZWY9ZDA3MTU5ZjktYmI1Yi00MWM0LWFlZTYtNzM4NTFmOWMxZjYzO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxNSIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQXBwbGljYXRpb24gU2VydmljZXMiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9OTgzOGUzNzUtMWQxMy00MzY2LWI5OGQtNzZkOTBhYjYwMWYyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE0OCIgeT0iMjQ1IiB3aWR0aD0iMzAyIiBoZWlnaHQ9IjYyMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTYiIHZhbHVlPSJDb3JlL0dyZWVuZmllbGQiIHN0eWxlPSJpci5yZWY9NDIyOWIzOTYtYmViOS00NjVjLWE3M2ItNTA2ZDhhYjY0N2VkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEwOSIgeT0iMjc3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iUGx1Z2luL0V4dGVuc2lvbnMgLT4gTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIHN0eWxlPSJpci5yZWY9YzI4MGRiMTEtY2RhNy00Zjk2LTkzMDItNmExNzI4ODFjMjhjO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuOTg3O2VudHJ5WT0wLjc3MjtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iMjAiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlBsdWdpbi9FeHRlbnNpb25zIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSIyMCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTRjOWY4NDlkLTI3NTYtNDNmNC05YjdiLTJkZTg3YmJjZjZiMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNTMyIiB5PSIyNTkiIHdpZHRoPSIyNzUiIGhlaWdodD0iNTYxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI3IiB2YWx1ZT0iUGx1Z2luIFN5c3RlbSIgc3R5bGU9ImlyLnJlZj00NTIwOWU2NC1iYjM4LTQ2OWUtYjhmYS1mYjAzNTE5YmI2NTI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtUExVR0lOLVNZU1RFTTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijk1IiB5PSIyMzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzEiIHZhbHVlPSJMTE0wMSZhbXA7bmJzcDsmbHQ7YnI+UHJvbXB0IEluamVjdGlvbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU0MSIgeT0iMTA5IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMyIiB2YWx1ZT0iTExNMDQmbHQ7YnI+TW9kZWwgRG9TIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNjk4IiB5PSIxMDkiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDIiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iNDEiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQxIiB2YWx1ZT0iTExNMDgmbHQ7YnI+RXhjZXNzaXZlIEFnZW5jeSIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjExMzMiIHk9IjkyIiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQzIiB2YWx1ZT0iTExNMDYmbHQ7YnI+U2Vuc2l0aXZlIEluZm9ybWF0aW9uIERpc2Nsb3N1cmUiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMzQyIiB5PSIyNiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0NCIgdmFsdWU9IkxMTTAyJmx0O2JyPiZhbXA7bmJzcDtJbnNlY3VyZSBPdXRwdXQgSGFuZGxpbmciIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMzQyIiB5PSIxMjMiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDYiIHZhbHVlPSJMTE0wOSZsdDticj5PdmVycmVsaWFuY2UiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNDg4IiB5PSIyNiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4MCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iNzciIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIxNjc0IiB5PSIxMDgzIi8+PG14UG9pbnQgeD0iMTY3NCIgeT0iOTMyIi8+PG14UG9pbnQgeD0iMTY3MCIgeT0iOTMyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNzciIHZhbHVlPSJMTE0wOCZsdDticj5FeGNlc3NpdmUgQWdlbmN5IiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTc4NyIgeT0iMTA0MyIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijc4IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNzgiIHZhbHVlPSJMTE0wNyAmbHQ7YnI+SW5zZWN1cmUgUGx1Z2luIERlc2lnbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE3ODciIHk9Ijg3OSIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NiIgdmFsdWU9IkxMTTAxJmx0O2JyPlByb21wdCZhbXA7bmJzcDsmbHQ7YnI+SW5qZWN0aW9uIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTUzNSIgeT0iODY2IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg3IiB2YWx1ZT0iTExNMDQmbHQ7YnI+TW9kZWwgRG9TIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTU0MSIgeT0iOTc2IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iTExNMDkmbHQ7YnI+T3ZlcnJlbGlhbmNlIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iOTMwIiB5PSI3MDgiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTEiIHZhbHVlPSJMTE0wMiZsdDticj5JbnNlY3VyZSBPdXRwdXQgSGFuZGxpbmciIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI3NDUiIHk9IjcwOCIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MiIgdmFsdWU9IkxMTTA2Jmx0O2JyPlNlbnNpdGl2ZSBJbmZvcm1hdGlvbiBEaXNjbG9zdXJlIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTUyIiB5PSI3MDgiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTYiIHZhbHVlPSJMTE0wMyZsdDticj5UcmFpbmluZyBEYXRhIFBvaXNvbmluZyIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU3IiB5PSIxMDc1IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk3IiB2YWx1ZT0iTExNMDYmbHQ7YnI+U2Vuc2l0aXZlIEluZm9ybWF0aW9uIERpc2Nsb3N1cmUiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNzUiIHk9IjEwNzUiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRG93bnN0cmVhbSBTZXJ2aWNlcyIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iNCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTdkNDkxMWQxLWY5M2YtNGQ2OS05MGMwLWE1MjRkMjk2M2RmNjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMjk0IiB5PSIzNjQiIHdpZHRoPSIzMDEiIGhlaWdodD0iNjk2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI1IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9YWM5MDhmZDUtMDdiNS00YWZkLWJmYjEtMWQ3NmRkNTkwMmM1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjExMCIgeT0iMTAxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj05Y2VlMjNlMC01YTZiLTRiOTgtOGFhNC1mMDBjZGZkZjIwMjQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd055QXdMamcyTmpRM0lEQXVOVFk1TXpNMklEQXVPRGd6TXpZM1NEQXVNemcxTURFNVF6QXVNekl4TlRBM0lEQXVPRGd6TXpZM0lEQXVNamN3TURJZ01DNDRNekU0TnprZ01DNHlOekF3TWlBd0xqYzJPRE0yTjFZd0xqSXpNVFk1T1VNd0xqSTNNREF5SURBdU1UWTRNVGczSURBdU16SXhOVEEzSURBdU1URTJOams1SURBdU16ZzFNREU1SURBdU1URTJOams1U0RBdU5qRTFNREpETUM0Mk56ZzFNek1nTUM0eE1UWTJPVGtnTUM0M016QXdNaUF3TGpFMk9ERTROeUF3TGpjek1EQXlJREF1TWpNeE5qazVWakF1TmpJd05qQXhRekF1TnpJd05EVTVJREF1TmpFNE9EYzVJREF1TnpFd05qRXlJREF1TmpFM09UZ2dNQzQzTURBMU5UWWdNQzQyTVRjNU9FTXdMalk1TURrNU9TQXdMall4TnprNElEQXVOamd4TmpNeUlEQXVOakU0TnpreUlEQXVOamN5TlRJZ01DNDJNakF6TlRGYVRUQXVNelkxT0RVeklEQXVOakExTkRWRE1DNHpOalU0TlRNZ01DNDFPRGsxTnpFZ01DNHpOemczTWpVZ01DNDFOelkzSURBdU16azBOakF6SURBdU5UYzJOMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpVM05qY2dNQzQyTXpReE9EWWdNQzQxT0RrMU56RWdNQzQyTXpReE9EWWdNQzQyTURVME5VTXdMall6TkRFNE5pQXdMall5TVRNeU9DQXdMall5TVRNeE5DQXdMall6TkRJZ01DNDJNRFUwTXpZZ01DNDJNelF5U0RBdU16azBOakF6UXpBdU16YzROekkxSURBdU5qTTBNaUF3TGpNMk5UZzFNeUF3TGpZeU1UTXlPQ0F3TGpNMk5UZzFNeUF3TGpZd05UUTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJRekF1TnpJNE1qSTBJREF1T0Rjek1UWTVJREF1TnpFek5UZ3hJREF1T0RrNU5ETTBJREF1TmprNU1ESXlJREF1T0RrNU5ETTBRekF1TmpnME9UQXpJREF1T0RrNU5ETTBJREF1Tmpjd056QTNJREF1T0RjME56TTNJREF1TmpZek1Ua3pJREF1T0RNNE1EVTRUREF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJTREF1TmpZeU5UQTRXazB3TGpVNU16WTBOQ0F3TGpnek5EVTROa3d3TGpZME5EUXlPQ0F3TGpnek5EVTRORU13TGpZME9EY3pNU0F3TGpnMU9URTBNeUF3TGpZMU5qQXlNeUF3TGpnNE1EQXpOeUF3TGpZMk5UVTJOeUF3TGpnNU5EWTJRekF1TmpNMU16TTVJREF1T0RnMU56TXlJREF1TmpFd01UY3pJREF1T0RZMU1ETTFJREF1TlRrMU16Y2dNQzQ0TXpjNE56Wk1NQzQxT1RNMk5EUWdNQzQ0TXpRMU9EWmFUVEF1TnpVek5qRTFJREF1T0RNME5UZzBUREF1T0RBME16azVJREF1T0RNME5UZzJRekF1TnpnNU9EYzJJREF1T0RZek16WWdNQzQzTmpNNU1UUWdNQzQ0T0RVek56VWdNQzQzTXpJME9EZ2dNQzQ0T1RRMk5UVkRNQzQzTkRFek9EZ2dNQzQ0T0RFd01ERWdNQzQzTkRnek16SWdNQzQ0TmpFNE9UUWdNQzQzTlRJM01UVWdNQzQ0TXprME5EVk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUk1NQzQ0TURRek9Ua2dNQzQ0TXpRMU9EWk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUmFUVEF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhRekF1T0RFMk1UYzJJREF1TnpZMU5UTTBJREF1T0RFMk9UZzVJREF1Tnpjek5ESTBJREF1T0RFMk9UZzVJREF1TnpneE5UQTBRekF1T0RFMk9UZzVJREF1Tnprek9ETXpJREF1T0RFMU1EazNJREF1T0RBMU56SXhJREF1T0RFeE5UZzVJREF1T0RFMk9Ea3pTREF1TnpVMk1USXlRekF1TnpVM016WTBJREF1T0RBMU5UazRJREF1TnpVNE1ERTBJREF1Tnprek56TXlJREF1TnpVNE1ERTBJREF1TnpneE5UQTBRekF1TnpVNE1ERTBJREF1TnpjMk1UUTJJREF1TnpVM09EZzVJREF1Tnpjd09EVTJJREF1TnpVM05qUTBJREF1TnpZMU5qVTBUREF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhUREF1TnpVM01UZzRJREF1TnpVM09URTRXazB3TGpVNE16UXhOQ0F3TGpjMU56a3hNVXd3TGpZME1EZzFOaUF3TGpjMU56a3hPRU13TGpZME1ETXhJREF1TnpZMU5UZzBJREF1TmpRd01ESTVJREF1Tnpjek5EWTJJREF1TmpRd01ESTVJREF1TnpneE5UQTBRekF1TmpRd01ESTVJREF1TnpreE1qZzJJREF1TmpRd05EUTJJREF1T0RBd09ETTNJREF1TmpReE1qUTRJREF1T0RFd01EUTVUREF1TmpReE9USXlJREF1T0RFMk9Ea3pTREF1TlRnMk5EVTFRekF1TlRneU9UUTJJREF1T0RBMU56SXhJREF1TlRneE1EVTFJREF1Tnprek9ETXpJREF1TlRneE1EVTFJREF1TnpneE5UQTBRekF1TlRneE1EVTFJREF1Tnpjek5ESTBJREF1TlRneE9EWTNJREF1TnpZMU5UTTBJREF1TlRnek5ERTBJREF1TnpVM09URXhXazB3TGpZMU9EWXpJREF1TnpVM09URXlTREF1TnpNNU5ERXpRekF1TnpRd01EQTJJREF1TnpZMU5USTNJREF1TnpRd016SXlJREF1Tnpjek5ERTJJREF1TnpRd016SXlJREF1TnpneE5UQTBRekF1TnpRd016SXlJREF1TnpreE16ZzBJREF1TnpNNU9EVXhJREF1T0RBd09UWTJJREF1TnpNNE9UYzVJREF1T0RFd01URTFUREF1TnpNNE1qVXlJREF1T0RFMk9Ea3pTREF1TmpVNU56a3hRekF1TmpVNE5EVTRJREF1T0RBMU56TTRJREF1TmpVM056SXhJREF1Tnprek9EVTBJREF1TmpVM056SXhJREF1TnpneE5UQTBRekF1TmpVM056SXhJREF1TnpjMU5ETTRJREF1TmpVM09EazVJREF1TnpZNU5EZzBJREF1TmpVNE1qTTRJREF1TnpZek5qY3pUREF1TmpVNE5qTWdNQzQzTlRjNU1USklNQzQzTXprME1UTklNQzQyTlRnMk0xcE5NQzQzTXpNM05Ea2dNQzQyTnpBek5UaE1NQzQzTXpJME56Y2dNQzQyTmpnek5VTXdMamMyT0RBM055QXdMalkzT0RnMU9TQXdMamM1TmpZMk9DQXdMamN3TlRjeElEQXVPREE1TlRZeUlEQXVOelF3TWpFNVREQXVOelUxTkRFMElEQXVOelF3TWpJeVF6QXVOelV4TmpreUlEQXVOekV4TnpFMUlEQXVOelEwTVRNeUlEQXVOamczTWpNeklEQXVOek16TnpRNUlEQXVOamN3TXpVNFREQXVOek15TkRjM0lEQXVOalk0TXpWTU1DNDNNek0zTkRrZ01DNDJOekF6TlRoYVRUQXVOalkwTVRNZ01DNDJOamczT0RSTU1DNDJOalUxTmpZZ01DNDJOamd6TlVNd0xqWTFOVEUzT0NBd0xqWTROREkyTnlBd0xqWTBOelExTnlBd0xqY3dOell4TmlBd0xqWTBNek0xTmlBd0xqY3pOVEF6TkV3d0xqWTBNall6SURBdU56UXdNakl5VERBdU5UZzRORGd4SURBdU56UXdNakU1UXpBdU5qQXhNakF4SURBdU56QTJNVGMySURBdU5qSTVNVGs0SURBdU5qYzVOVGcwSURBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVXd3TGpZMk5ERXpJREF1TmpZNE56ZzBXazB3TGpZNU9UQXlNaUF3TGpZMk16VTNORU13TGpjeE5EVTNOeUF3TGpZMk16VTNOQ0F3TGpjek1ESXlOaUF3TGpZNU16VTFNeUF3TGpjek5qa3pJREF1TnpNMk5UQTJUREF1TnpNM05EZ3pJREF1TnpRd01qRTVTREF1TmpZd05UWXhRekF1TmpZMk9USXpJREF1TmprMU1qa3hJREF1Tmpnek1ESXlJREF1TmpZek5UYzBJREF1TmprNU1ESXlJREF1TmpZek5UYzBXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU1pSWdhR1ZwWjJoMFBTSXdMamt5SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05EQXdNemt4SURBdU1EUXdNRE01TVNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDYiIHk9IjM1NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMyIgdmFsdWU9IlBsdWdpbi9FeHRlbnNpb25zIC0+IE90aGVyIGRhdGFiYXNlIiBzdHlsZT0iaXIucmVmPTdmN2I5MmJkLTU4OTItNDYwNi04YjhiLTZkYTMxZWYwMDRlZDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjAiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0IiB2YWx1ZT0iUGx1Z2luL0V4dGVuc2lvbnMgLT4gV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9NmZiMTQyNzctYmU4OS00NjY5LWFhNzItZGRhNmE1ODRiM2E0O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMiIgc291cmNlPSIyMCIgdGFyZ2V0PSI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjYiIHZhbHVlPSJFeHRlcm5hbCBEYXRhIFNvdXJjZXMgLT4gVHJhaW5pbmcgRGF0YXNldCAmYW1wOyBQcm9jZXNzaW5nIiBzdHlsZT0iaXIucmVmPWIxNzgzZGI2LTk1YjctNDM3Yy05MTkwLTJhMDJkMGVlMWRjMDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjUiIHRhcmdldD0iMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNSIgdmFsdWU9IkV4dGVybmFsIERhdGEgU291cmNlcyIgc3R5bGU9ImlyLnJlZj02ZDg2NjVjZC0wNGVlLTQxMDctYmM1Mi03ZDRkMTI5OWE3Yzc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTM5MCIgeT0iMTM5NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyOSIgdmFsdWU9IkVuZCBVc2VyIC0+IEFwcGxpY2F0aW9uIFNlcnZpY2VzIiBzdHlsZT0iaXIucmVmPTk0MjBkNGYwLWJlZTktNDhiMS05ZTAyLWFlOWFlODVkNGFmYTtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjgiIHRhcmdldD0iMTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzNzQiIHk9IjU3NCIvPjxteFBvaW50IHg9IjM3NCIgeT0iNjEzIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjgiIHZhbHVlPSJFbmQgVXNlciIgc3R5bGU9ImlyLnJlZj05ZTU2ZjZkMC03NTc1LTQyOGUtYTcwYS00Nzg4ZDk2N2I3NDE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDAiIHk9IjUyOSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9IkxMTTEwJmFtcDtuYnNwOyZsdDticj5Nb2RlbCBUaGVmdCIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIyMCIgeT0iMzY5IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgxIiB2YWx1ZT0iTExNMDgmbHQ7YnI+RXhjZXNzaXZlIEFnZW5jeSIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0MDgiIHk9IjE0MiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iODMiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg1IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO2VudHJ5WD0wLjk5ODtlbnRyeVk9MC45NTM7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyIiBzb3VyY2U9IjgzIiB0YXJnZXQ9IjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4MyIgdmFsdWU9IkxMTTA1Jmx0O2JyPlN1cHBseSBDaGFpbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzOTkiIHk9IjEyMDEiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzMiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMzAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii0xMTAyLjU1NTQ4MDk1NzAzMTIiIHk9IjcxLjQ0NDM5Njk3MjY1NjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMzQiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMzEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii00MTUuNDQ0MzM1OTM3NSIgeT0iLTQ0LjExMTE0NTAxOTUzMTI1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTQ5NCIgeT0iLTE0NSIvPjxteFBvaW50IHg9Ii00MTUiIHk9Ii0xNDUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIzMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTQxNS40NDQzMzU5Mzc1IiB5PSItNDAuNTU1NjAzMDI3MzQzNzUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMzI0IiB5PSItMTQ1Ii8+PG14UG9pbnQgeD0iLTQxNSIgeT0iLTE0NSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjMyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxNTQuMzMzNDk2MDkzNzUiIHk9IjEwMS42NjY2MjU5NzY1NjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE1NiIgeT0iLTI5MSIvPjxteFBvaW50IHg9Ii0xNTYiIHk9IjEwMiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ3IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzMTQiIHk9Ii0zNi4xMTEwODM5ODQzNzUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI0MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzY5LjQ0NDU4MDA3ODEyNSIgeT0iLTM1LjIyMjIyOTAwMzkwNjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNDkiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQxMS4yMjI0MTIxMDkzNzUiIHk9Ii0zOS42NjY2ODcwMTE3MTg3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzODUuNDQ0NTgwMDc4MTI1IiB5PSIyNDUuNjY2Njg3MDExNzE4NzUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzOTEiIHk9Ii0zNzQiLz48bXhQb2ludCB4PSIzOTEiIHk9IjI0NiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjgyIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjgxIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxMDQ2IiB5PSItMTMzLjg4ODg4NTQ5ODA0Njg4IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iODgiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iODYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQxNi41NTU2NjQwNjI1IiB5PSIyNDIuMTExMTQ1MDE5NTMxMjUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI4OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI4NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzUzLjQ0NDMzNTkzNzUiIHk9IjI0Ny40NDQ1MTkwNDI5Njg3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjkzIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjkwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItOTEuMDAwMTIyMDcwMzEyNSIgeT0iMTQwLjc3NzgzMjAzMTI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTQiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii0yODMiIHk9IjEzNy4yMjIyOTAwMzkwNjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTUiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii00NzYiIHk9IjE0Mi41NTU2MDMwMjczNDM3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk4IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9Ijk3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItMTY5LjIyMjE2Nzk2ODc1IiB5PSI4MTkiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItODUzIiB5PSI4OTQiLz48bXhQb2ludCB4PSItMTY5IiB5PSI4OTQiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI5NiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTE2OS4yMjIxNjc5Njg3NSIgeT0iODIwLjc3Nzk1NDEwMTU2MjUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItOTcxIiB5PSI4OTMiLz48bXhQb2ludCB4PSItMTY5IiB5PSI4OTMiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMDAiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii03NjkuMjIyMTY3OTY4NzUiIHk9IjUzNS40NDQ1MTkwNDI5Njg4IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTg1MyIgeT0iNTM1Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAxIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9Ijk2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNzczLjY2NjYyNTk3NjU2MjUiIHk9IjUzNi4zMzMzNzQwMjM0Mzc1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTk3MSIgeT0iNTM2Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="1"/>
-  </trustZones>
-  <questions>
-    <wizardQuestion ref="Status - NO" answer="true" manuallyModified="false"/>
-  </questions>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Training Dataset &amp; Processing -&gt; LLM Production Services" ref="0e44cf64-cdd8-480a-b6ee-d3f71e114293" source="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="LLM Model -&gt; LLM Automation (Agents)" ref="4ef50cda-ed3e-4c7b-a2ce-310884d8ea45" source="73fe679a-bbbf-41bc-a55e-2da6fff146ac" target="2d6db6bd-47e5-499d-a2cc-619112e664da">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="LLM Production Services -&gt; Plugin/Extensions" ref="54979d83-faea-4a02-9006-6536a68fa4c9" source="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" target="3050c74a-3bf7-4651-8413-63042ef8a1ff">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Plugin/Extensions -&gt; Web Service" ref="6fb14277-be89-4669-aa72-dda6a584b3a4" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="394f4bdf-cef5-4645-87b5-58d84f31c9ce">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Plugin/Extensions -&gt; Other database" ref="7f7b92bd-5892-4606-8b8b-6da31ef004ed" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="142aae3e-3ef4-4de4-9998-df16e6a7d62f">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="LLM Production Services -&gt; Application Services" ref="8898e66f-0b83-4881-a143-c81a7fedabea" source="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" target="c29771c0-8015-45c8-a153-319a23bb832b">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="End User -&gt; Application Services" ref="9420d4f0-bee9-48b1-9e02-ae9ae85d4afa" source="5d7cea0c-20cb-4d5b-8b11-47a6c2f5c748" target="c29771c0-8015-45c8-a153-319a23bb832b">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Application Services -&gt; Training Dataset &amp; Processing" ref="9488f7bb-8de2-4338-9a8e-0faf1ff81d6e" source="c29771c0-8015-45c8-a153-319a23bb832b" target="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="External Data Sources -&gt; Training Dataset &amp; Processing" ref="b1783db6-95b7-437c-9190-2a02d0ee1dc0" source="d0b398bc-1f18-465f-ab22-4c054bf72d0c" target="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Plugin/Extensions -&gt; LLM Production Services" ref="c280db11-cda7-4f96-9302-6a172881c28c" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="LLM Automation (Agents) -&gt; LLM Model" ref="c7818629-a184-4359-ab0c-088abfd863ed" source="2d6db6bd-47e5-499d-a2cc-619112e664da" target="73fe679a-bbbf-41bc-a55e-2da6fff146ac">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Application Services -&gt; LLM Production Services" ref="d07159f9-bb5b-41c4-aee6-73851f9c1f63" source="c29771c0-8015-45c8-a153-319a23bb832b" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields>
-    <customField ref="Business Line" value=""/>
-    <customField ref="Message" value=""/>
-    <customField ref="Milestone 1" value=""/>
-    <customField ref="Milestone 1 - Deadline" value=""/>
-    <customField ref="Milestone 2" value=""/>
-    <customField ref="Milestone 2 - Deadline" value=""/>
-    <customField ref="Milestone 3" value=""/>
-    <customField ref="Milestone 3 - Deadline" value=""/>
-    <customField ref="NT - Custom Field" value=""/>
-    <customField ref="Project Management Details" value=""/>
-    <customField ref="Project Manager" value=""/>
-    <customField ref="Project Owner Email" value="jrabe@iriusrisk.com"/>
-    <customField ref="Release Date" value=""/>
-    <customField ref="Standard" value=""/>
-    <customField ref="Starting WF State" value=""/>
-    <customField ref="Test" value=""/>
-    <customField ref="Use Case" value=""/>
-    <customField ref="User" value=""/>
-    <customField ref="User Email Field" value=""/>
-    <customField ref="prod-sec-eng" value=""/>
-    <customField ref="workflow-testing" value=""/>
-  </customFields>
-  <components>
-    <component uuid="fc17be11-85cc-4bbc-8d12-5c1324a66682" diagramComponentId="9838e375-1d13-4366-b98d-76d90ab601f2" ref="c29771c0-8015-45c8-a153-319a23bb832b" name="Application Services" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="30fcef9c-0638-465c-bb7e-a80ce4b21456" diagramComponentId="4229b396-beb9-465c-a73b-506d8ab647ed" ref="d9e5487d-9f19-4fdb-bc79-858c23748be1" name="Core/Greenfield" desc="" library="CS-Default" parentComponentRef="c29771c0-8015-45c8-a153-319a23bb832b" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="c0742e70-143a-46b7-b6a9-58cfe9d548e5" diagramComponentId="7d4911d1-f93f-4d69-90c0-a524d2963df6" ref="d5c2ada9-ff09-4e53-a3e7-56212684e587" name="Downstream Services" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="c829c637-2bc8-4cdd-a3df-47685727c835" diagramComponentId="9e56f6d0-7575-428e-a70a-4788d967b741" ref="5d7cea0c-20cb-4d5b-8b11-47a6c2f5c748" name="End User" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="9fec8811-7c57-4e5e-bb48-6927ab82e942" diagramComponentId="6d8665cd-04ee-4107-bc52-7d4d1299a7c7" ref="d0b398bc-1f18-465f-ab22-4c054bf72d0c" name="External Data Sources" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.658">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.657">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.657">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.658">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="43ea5335-6867-458a-bed5-3a67b7c0b7a4" diagramComponentId="e6580934-740f-4974-97ce-51c8c82ad714" ref="ac7e20a0-6a22-4c8c-813f-e729fd8a8d0a" name="Fine-Tuning Data" desc="" library="CS-Default" parentComponentRef="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.034">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7f59eb83-e2fd-4392-898f-51e43fa10804" diagramComponentId="8a64e2ff-ca8f-42c2-993f-1132f620a14a" ref="a0ac1685-fc5d-45ce-9746-204f5b12b111" name="LLM Application" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="127a0791-f8f2-484a-951f-c82f617af821" diagramComponentId="1cd5723b-27e2-43b6-b1ef-a0821b6192f9" ref="2d6db6bd-47e5-499d-a2cc-619112e664da" name="LLM Automation (Agents)" desc="" library="CS-Default" parentComponentRef="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.377">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f8f45584-d668-4b9e-bbfe-c14f87ba4ea8" diagramComponentId="38913651-a679-494e-b491-fab99056bb04" ref="73fe679a-bbbf-41bc-a55e-2da6fff146ac" name="LLM Model" desc="" library="CS-Default" parentComponentRef="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.014">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.762">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.762">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.956">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.637">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6fbbddb2-f720-4f16-a78c-10d42bbcf940" diagramComponentId="ed23a1c0-06fc-4e17-bf01-f44cb7b9d111" ref="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" name="LLM Production Services" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="d31943c8-e615-468e-b528-af213d9363ab" diagramComponentId="ac908fd5-07b5-4afd-bfb1-1d76dd5902c5" ref="142aae3e-3ef4-4de4-9998-df16e6a7d62f" name="Other database" desc="" library="CS-Default" parentComponentRef="d5c2ada9-ff09-4e53-a3e7-56212684e587" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.598">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.912">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="470acbc1-382a-439b-8bb8-3c65ad447110" diagramComponentId="4c9f849d-2756-43f4-9b7b-2de87bbcf6b0" ref="3050c74a-3bf7-4651-8413-63042ef8a1ff" name="Plugin/Extensions" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.106">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.025">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="45ebb509-eb40-48bb-98bf-d2a6ec32d2df" diagramComponentId="45209e64-bb38-469e-b8fa-fb03519bb652" ref="cedb6ad1-7374-46a0-8c7d-9534fcc468ab" name="Plugin System" desc="" library="IR-Functional-Components" parentComponentRef="3050c74a-3bf7-4651-8413-63042ef8a1ff" componentDefinitionRef="CD-PLUGIN-SYSTEM">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.817">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-94" name="The application executes code retrieved from untrusted data sources" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The execution of untrusted code potentially grants direct control over the application; allowing an attacker to perform arbitrary operations, steal sensitive data, or use the application to launch other malicious attacks.&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.819">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-94: Improper Control of Generation of Code ('Code Injection')" url="https://cwe.mitre.org/data/definitions/94.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-PLUGIN-PERMISSIONS" name="Assign specific permissions and privileges to plugins based on their intended functionality" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Assign specific permissions and privileges to plugins based on their intended functionality&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Assigning specific permissions and privileges to plugins can help to limit the resources and actions that plugins are able to access or perform within the system. This can help to prevent malicious plugins from accessing sensitive resources or performing unauthorized actions that could compromise the security of the system.&lt;/p&gt;&lt;p&gt;When assigning permissions and privileges to plugins, it is important to consider the specific functionality and requirements of each plugin. For example, a plugin that provides read-only access to a database may only require read permissions, while a plugin that performs write operations may require write permissions.&lt;/p&gt;&lt;p&gt;By assigning specific permissions and privileges to plugins based on their intended functionality, you can help to ensure that plugins are only able to access or perform the actions that are necessary for their intended purpose, reducing the risk of plugin-related attacks and protecting the security of the system.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the specific functionality and requirements of each plugin. This can be done by reviewing the plugin documentation or by analyzing the plugin code.&lt;/li&gt;&lt;li&gt;Assign specific permissions and privileges to each plugin based on its intended functionality. This can involve creating custom roles or permissions for each plugin, or using existing roles or permissions that are appropriate for the plugin.&lt;/li&gt;&lt;li&gt;Configure access controls and permissions for the plugin system to ensure that plugins are only able to access or perform the actions that are necessary for their intended purpose. This can involve using role-based access controls, attribute-based access controls, or other access control mechanisms.&lt;/li&gt;&lt;li&gt;Regularly review and update the permissions and privileges assigned to plugins to ensure that they remain appropriate and relevant to their intended functionality.&lt;/li&gt;&lt;li&gt;Monitor plugin activity and resource usage to detect any unusual or unauthorized behavior that could indicate a security breach or compromise.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Assigning specific permissions and privileges to plugins can have an impact on the performance. This is because the access control mechanisms used to enforce these permissions and privileges require additional computation and resource usage to check and enforce access.&lt;/p&gt;&lt;p&gt;To minimize the impact, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when assigning permissions and privileges to plugins. This may involve using lightweight access control mechanisms, optimizing the access control process for maximum efficiency, and monitoring resource usage to prevent excessive resource consumption.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the plugin documentation: Familiarize yourself with the documentation provided by the plugin developers. Look for any information regarding the specific permissions and privileges required for each plugin.&lt;/li&gt;&lt;li&gt;Identify the intended functionality of each plugin: Determine the intended purpose and functionality of each plugin. Understand the specific actions the plugins are designed to perform and the resources they may require access to.&lt;/li&gt;&lt;li&gt;Develop a permissions matrix: Create a matrix that lists all the plugins being used and their intended functionality. Identify the permissions and privileges required by each plugin to fulfill its intended purpose.&lt;/li&gt;&lt;li&gt;Configure permissions and privileges: Access the system or platform where the plugins are installed and configure the permissions and privileges accordingly. Ensure that the assigned permissions align with the intended functionality of each plugin as identified in the permissions matrix.&lt;/li&gt;&lt;li&gt;Test plugin functionality: Test each plugin to verify that it can perform its intended actions and access the necessary resources. Execute various scenarios and use cases to validate that the permissions and privileges assigned to the plugins do not hinder their functionality.&lt;/li&gt;&lt;li&gt;Test restricted functionality: Verify that the plugins are appropriately restricted from performing actions outside their intended functionality. Attempt to execute actions or access resources that are not within the scope of each plugin's permissions. The system should prevent or deny such unauthorized actions.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.731">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-PLUGIN-SANDBOX" name="Consider using a sandboxed environment or runtime that restricts the execution environment" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Consider using a sandboxed environment or runtime that restricts the execution environment.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A sandboxed environment is a controlled environment that limits the resources and permissions available to an application or process, preventing it from accessing sensitive data or system resources. By using a sandboxed environment or runtime for plugins, the execution of plugins can be restricted to a secure and isolated environment, preventing them from accessing sensitive data or system resources outside of the sandbox. This can help to mitigate the risk of malicious plugins executing unauthorized code and compromising the security of the system.&lt;/p&gt;&lt;p&gt;Implementing a sandboxed environment or runtime for plugins requires careful consideration of the requirements and limitations of the plugin system and the specific use case. It may involve configuring access controls, limiting resource usage, and monitoring plugin activity within the sandbox.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the plugin systems and applications that are most critical to the security of your software environment. These are the systems that should be prioritized for sandboxing.&lt;/li&gt;&lt;li&gt;Research and evaluate sandboxing tools or runtimes that are suitable for your plugin systems and applications. Consider factors such as compatibility, security features, and ease of use.&lt;/li&gt;&lt;li&gt;Develop a sandboxing strategy that outlines how plugins will be sandboxed, what resources will be restricted, and how access controls will be configured.&lt;/li&gt;&lt;li&gt;Configure access controls to limit the resources and permissions available to plugins within the sandbox. This may include restricting network access, file system access, and system privileges.&lt;/li&gt;&lt;li&gt;Monitor plugin activity within the sandbox to detect any unusual or suspicious behavior. This can be done using monitoring tools or by implementing logging and auditing mechanisms.&lt;/li&gt;&lt;li&gt;Limit resource usage within the sandbox to prevent plugins from consuming excessive resources. This can help to prevent denial-of-service attacks and other resource-intensive attacks.&lt;/li&gt;&lt;li&gt;Ensure that plugins are properly authenticated, validated, and authorized before they are executed within the sandbox. This can help to prevent the execution of malicious plugins.&lt;/li&gt;&lt;li&gt;Download plugins only from trusted sources and verify their authenticity before installing them within the sandbox.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing a sandboxed environment or runtime for plugins can have an impact on the performance of the application. To minimize it, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when implementing a sandboxed environment or runtime. This may involve configuring access controls to balance security and performance, monitoring resource usage within the sandbox, and optimizing the sandboxing process for maximum efficiency.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CWE CATEGORY: Privilege / Sandbox Issues" url="https://cwe.mitre.org/data/definitions/265.html"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify that a sandboxed environment or runtime has been implemented for the plugin system. This can be done by reviewing the system architecture and configuration.&lt;/li&gt;&lt;li&gt;Verify that access controls have been configured to limit the resources and permissions available to plugins within the sandbox. This can be done by attempting to access restricted resources or perform unauthorized actions within the sandbox.&lt;/li&gt;&lt;li&gt;Verify that resource usage within the sandbox is being monitored and limited to prevent plugins from consuming excessive resources. This can be done by monitoring resource usage metrics and attempting to perform resource-intensive actions within the sandbox.&lt;/li&gt;&lt;li&gt;Verify that plugins are being properly authenticated, validated, and authorized before they are executed within the sandbox. This can be done by attempting to execute a malicious plugin or a plugin that has not been properly authenticated or authorized.&lt;/li&gt;&lt;li&gt;Verify that plugins are being downloaded only from trusted sources and that their authenticity is being verified before installation within the sandbox. This can be done by attempting to download and install a plugin from an untrusted source or a plugin that has not been properly verified.&lt;/li&gt;&lt;li&gt;Attempt to execute a plugin outside of the sandboxed environment or runtime and verify that it is unable to access restricted resources or perform unauthorized actions.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.731">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" name="Encrypt sensitive data at rest and in transit within the plugin system" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Encrypt sensitive data at rest and in transit within the plugin system&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest and in transit involves the implementation of encryption techniques to protect sensitive data stored and transmitted within the plugin system. Encryption ensures that data is transformed into a secure and unreadable format, providing confidentiality and integrity.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Encrypting data at rest: It involves applying encryption to sensitive data when it is stored or persisted within the plugin system. This could include encrypting data in databases, file systems, or any other storage mechanisms used by the plugins. Encryption prevents unauthorized access to the data even if the storage medium is compromised.&lt;/li&gt;&lt;li&gt;Encrypting data in transit: It focuses on securing data as it is transmitted between different components or systems within the plugin environment. This includes encrypting data sent over networks, APIs, or any communication channels utilized by the plugins. Encryption safeguards the data from interception or tampering during transit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Encryption algorithms and protocols: Select strong encryption algorithms and protocols that are considered secure and widely accepted within the industry. Examples include AES (Advanced Encryption Standard) for data at rest and TLS (Transport Layer Security) for data in transit.&lt;/li&gt;&lt;li&gt;Key management: Develop robust key management practices to ensure the secure generation, storage, distribution, rotation, and revocation of encryption keys. Proper key management is essential for maintaining the confidentiality and integrity of the encrypted data.&lt;/li&gt;&lt;li&gt;Data classification and scope: Identify and classify the sensitive data that requires encryption within the plugin system. Clearly define the scope of what data needs to be encrypted, taking into account regulatory requirements and privacy considerations.&lt;/li&gt;&lt;li&gt;Encryption implementation: Implement encryption mechanisms at appropriate points within the plugin system. This may involve integrating encryption libraries, utilizing encryption modules or APIs, or leveraging encryption capabilities provided by the underlying infrastructure or platform.&lt;/li&gt;&lt;li&gt;Certificate management: When encrypting data in transit, employ digital certificates for secure communication channels. Properly manage and validate certificates to ensure the authenticity and integrity of the encryption process.&lt;/li&gt;&lt;li&gt;Testing and validation: Conduct thorough testing to verify the effectiveness and correctness of the encryption implementation. Validate that sensitive data is encrypted both at rest and in transit, and that decryption is only possible with authorized access and proper authentication.&lt;/li&gt;&lt;li&gt;Compliance and auditing: Ensure that the encryption practices implemented align with relevant regulatory requirements and industry standards. Maintain proper documentation and conduct periodic audits to validate compliance and adherence to encryption policies.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing encryption within the plugin system can have an impact on the performance of the application. The extent of the impact depends on various factors, including the encryption algorithms used, the size and complexity of the data being encrypted, the processing power of the system, and the efficiency of the encryption implementation.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST Special Publication 800-111: Guide to Storage Encryption Technologies for End User Devices" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf"/>
-            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sensitive data: Determine the types of sensitive data that need encryption within the plugin system.&lt;/li&gt;&lt;li&gt;Data at rest testing: Verify that the selected sensitive data is properly encrypted when stored or persisted within the plugin system.&lt;/li&gt;&lt;li&gt;Data in transit testing: Ensure that sensitive data is transmitted over secure communication channels using appropriate encryption protocols, such as TLS/SSL.&lt;/li&gt;&lt;li&gt;Key management testing: Evaluate the secure generation, storage, rotation, and revocation of encryption keys.&lt;/li&gt;&lt;li&gt;Performance impact assessment: Measure the impact of encryption on system performance, including encryption/decryption time and network latency.&lt;/li&gt;&lt;li&gt;Compliance validation: Confirm that the encryption implementation aligns with relevant regulatory requirements and industry standards.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing TLS/SSL encryption" url="https://testssl.sh/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-PLUGIN-CODE-REVIEW" name="Implement a thorough code review process for all plugins before allowing them to be installed or executed" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement a thorough code review process for all plugins before allowing them to be installed or executed&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Implement a code review process involves conducting a comprehensive examination of the code within plugins before permitting their installation or execution. This process aims to identify and mitigate potential security vulnerabilities, malicious code, or unintended functionality that could pose a threat to the system or platform.&lt;/p&gt;&lt;p&gt;By implementing a thorough code review process, organizations can gain better control over the quality and security of the plugins being utilized, ensuring that they align with the intended functionality and meet the required security standards. This countermeasure provides an additional layer of protection against potential risks associated with plugins, as it allows for the identification and removal of any malicious or vulnerable code.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Establish code review guidelines: Develop a set of guidelines or standards that define the criteria for code review. These guidelines should encompass security best practices, coding standards, and compliance requirements specific to the organization or platform.&lt;/li&gt;&lt;li&gt;Assign trained reviewers: Designate individuals or a team with expertise in code analysis and security to conduct the reviews. Ensure that they have the necessary knowledge and skills to identify potential security issues, vulnerabilities, and coding flaws.&lt;/li&gt;&lt;li&gt;Review process integration: Incorporate the code review process into the overall software development lifecycle (SDLC) or plugin management process. Define at which stage of the process the code review should occur to minimize any delays in installation or execution.&lt;/li&gt;&lt;li&gt;Review tools and automation: Leverage code analysis and review tools to assist in the review process. These tools can help identify common security vulnerabilities and coding errors more efficiently, increasing the effectiveness and speed of the code review.&lt;/li&gt;&lt;li&gt;Security-focused code review: Focus the code review process on identifying security-related issues, such as input validation flaws, access control vulnerabilities, insecure data handling, and potential injection attacks. Look for any indicators of malicious code, including backdoors, logic bombs, or unauthorized data exfiltration.&lt;/li&gt;&lt;li&gt;Documentation and tracking: Maintain thorough documentation of the code review process, including any identified issues, their severity, and the corresponding actions taken to address them. Track the progress of each code review to ensure that all plugins undergo the necessary scrutiny before installation or execution.&lt;/li&gt;&lt;li&gt;Ongoing code review: Establish a process for periodic or regular code reviews of installed plugins. This ensures that any code changes or updates to plugins are also subject to review, reducing the risk of introducing vulnerabilities through subsequent modifications.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing a thorough code review process for all plugins before allowing them to be installed or executed can have an impact on the performance of the application. The extent of the impact depends on various factors such as the size and complexity of the plugins, the frequency of code reviews, and the efficiency of the code review process itself.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Understand the code review process: Gain a clear understanding of the defined code review process and its requirements.&lt;/li&gt;&lt;li&gt;Review documentation: Evaluate the documentation that outlines the code review process, including guidelines and checklists.&lt;/li&gt;&lt;li&gt;Perform sample code reviews: Simulate the code review process by conducting sample reviews on representative plugins.&lt;/li&gt;&lt;li&gt;Review documentation and tracking: Validate that comprehensive documentation is maintained, capturing identified issues, severity, and actions taken to address them. Verify the accuracy of the code review tracking process.&lt;/li&gt;&lt;li&gt;Assess code review integration: Ensure that the code review process is seamlessly integrated into the overall software development or plugin management process.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" name="Implement mechanisms to verify the integrity of plugin code at runtime" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement mechanisms to verify the integrity of plugin code at runtime&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Verifying the integrity of plugin code at runtime involves checking that the code has not been modified or tampered with since it was installed or last verified. This can help to prevent malicious plugins from executing unauthorized code and compromising the security of the system.&lt;/p&gt;&lt;p&gt;Implementing mechanisms to verify the integrity of plugin code at runtime may involve using techniques such as code signing, checksum verification, or digital signatures. These techniques can be used to ensure that the plugin code has not been modified or tampered with since it was signed or verified.&lt;/p&gt;&lt;p&gt;By implementing mechanisms to verify the integrity of plugin code at runtime, you can help to ensure that only trusted and authorized plugins are executed within the system, and that the security of the system is not compromised by malicious plugins.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement code signing for plugins. This involves signing the plugin code using a digital certificate, which can be verified at runtime to ensure that the code has not been modified or tampered with.&lt;/li&gt;&lt;li&gt;Use checksum verification to verify the integrity of plugin code at runtime. This involves calculating a checksum value for the plugin code at install time, and then verifying that the checksum value matches at runtime to ensure that the code has not been modified.&lt;/li&gt;&lt;li&gt;Use digital signatures to verify the integrity of plugin code at runtime. This involves using cryptographic techniques to sign the plugin code and verify the signature at runtime to ensure that the code has not been modified or tampered with.&lt;/li&gt;&lt;li&gt;Implement runtime integrity checking mechanisms that monitor the execution of plugins and detect any unauthorized modifications or tampering.&lt;/li&gt;&lt;li&gt;Limit access to plugin installation directories and files to prevent unauthorized modification or tampering of plugin code.&lt;/li&gt;&lt;li&gt;Regularly update and patch the plugin system and its dependencies to address any known vulnerabilities or weaknesses that could be exploited by attackers.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing mechanisms to verify the integrity of plugin code can have an impact on the performance. This is because the verification process involves additional computation and resource usage to check the integrity of the plugin code.&lt;/p&gt;&lt;p&gt;To minimize the impact, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when implementing mechanisms to verify the integrity of plugin code at runtime. This may involve using lightweight verification mechanisms, optimizing the verification process for maximum efficiency, and monitoring resource usage to prevent excessive resource consumption.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Protecting Software Integrity through code signing" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925977"/>
-            <reference name="Top 25 Series - Rank 20 - Download of Code Without Integrity Check" url="https://software-security.sans.org/blog/2010/04/05/top-25-series-rank-20-download-code-integrity-check/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify that the plugin code is signed or checksummed at install time. This can be done by reviewing the installation process and verifying that the code is signed or checksummed.&lt;/li&gt;&lt;li&gt;Verify that the plugin code is verified at runtime to ensure that it has not been modified or tampered with. This can be done by monitoring the verification process and verifying that it detects any unauthorized modifications or tampering.&lt;/li&gt;&lt;li&gt;Verify that access to plugin installation directories and files is limited to prevent unauthorized modification or tampering of plugin code. This can be done by attempting to modify or tamper with the plugin code within the installation directories and files.&lt;/li&gt;&lt;li&gt;Verify that runtime integrity checking mechanisms are in place and are able to detect any unauthorized modifications or tampering of plugin code. This can be done by attempting to modify or tamper with the plugin code at runtime and verifying that the mechanisms detect the unauthorized changes.&lt;/li&gt;&lt;li&gt;Verify that the plugin system and its dependencies are regularly updated and patched to address any known vulnerabilities or weaknesses that could be exploited by attackers. This can be done by reviewing the update and patching process and verifying that it is effective in addressing vulnerabilities and weaknesses.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-HASHING-THECHNIQUES" name="Use code signing or hashing techniques to detect any modifications or tampering" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use code signing or hashing techniques to detect any modifications or tampering&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Code signing entails digitally signing the code with a cryptographic signature, using a trusted certificate, to verify its authenticity and integrity. Hashing techniques generate unique hash values or checksums for the code, allowing subsequent comparisons to detect any alterations or tampering. This countermeasure help protect against unauthorized modifications, ensure the code's integrity, and establish trust in the software or code's source and integrity.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implementation of Code Signing: Obtain a digital certificate from a trusted certificate authority (CA) and use it to digitally sign the code. This process involves generating a cryptographic signature that validates the authenticity and integrity of the code.&lt;/li&gt;&lt;li&gt;Verification of Code Signatures: Implement a verification process to validate the digital signatures of the code during runtime or installation. This ensures that the code has not been tampered with or modified since it was signed.&lt;/li&gt;&lt;li&gt;Secure Storage of Certificates: Safely store the digital certificates used for code signing in a secure location, protecting them from unauthorized access or tampering.&lt;/li&gt;&lt;li&gt;Periodic Certificate Renewal: Regularly review the expiration dates of the digital certificates and renew them in a timely manner to maintain the validity of code signatures.&lt;/li&gt;&lt;li&gt;Secure Distribution of Code: Establish secure distribution channels for the code, ensuring that it is not compromised during transit. Implement measures such as secure file transfer protocols (e.g., HTTPS) or code signing during deployment to maintain the integrity of the code.&lt;/li&gt;&lt;li&gt;Hash Verification: Implement hashing techniques to compute and store hash values or checksums for the code files. Periodically compare these hash values against the current versions to detect any modifications or tampering.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing code signing or hashing techniques have a minimal impact on the performance.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Introduction to Code Signing" url="https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537361(v=vs.85)"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify code signature validation, including testing for tampered or invalid signatures.&lt;/li&gt;&lt;li&gt;Compare hash values to detect unauthorized modifications.&lt;/li&gt;&lt;li&gt;Test code distribution channels for integrity and tampering detection.&lt;/li&gt;&lt;li&gt;Validate certificate validity and renewal processes.&lt;/li&gt;&lt;li&gt;Evaluate performance impact of the control.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.729">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-02-22T18:19:36.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
-          <threats>
-            <threat ref="CAPEC-122-PLUGIN-SYSTEM" name="An adversary is able to exploit features of the plugin system that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An adversary takes advantage of a vulnerability in a plugin system to execute malicious code. Plugin systems are used in many software applications to extend functionality, and they typically allow third-party developers to create and add their own plugins to the system. However, if the plugin system is not designed or implemented securely, it can be vulnerable to attack.&lt;/p&gt;&lt;p&gt;An attacker can exploit a vulnerability in the plugin system to execute code that is not authorized by the application or the user. This can allow the attacker to steal sensitive information, modify or delete data, or take control of the targeted system. Plugin system attacks often involve the use of malicious plugins that are disguised as legitimate ones or are downloaded from untrusted sources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="C-PLUGIN-PERMISSIONS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-PLUGIN-PERMISSIONS" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-242-CODE-INJECTION" name="An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An attacker exploits a vulnerability in input validation to inject malicious code into a system. This can allow the attacker to execute arbitrary commands, steal sensitive information, or take control of the targeted system. Code injection attacks can occur in a variety of contexts, such as web applications, operating systems, and mobile devices. The attack works by tricking the system into executing the injected code as if it were legitimate, often by exploiting weaknesses in programming languages or operating system features. Code injection attacks are a common and serious threat to the security of computer systems and proper input validation and sanitization techniques are essential to prevent them.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="C-PLUGIN-SANDBOX" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="C-HASHING-THECHNIQUES" mitigation="25"/>
-                    <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-94">
-                  <countermeasures>
-                    <countermeasure ref="C-PLUGIN-CODE-REVIEW" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-HASHING-THECHNIQUES" mitigation="25"/>
-                <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" mitigation="25"/>
-                <countermeasure ref="C-PLUGIN-CODE-REVIEW" mitigation="25"/>
-                <countermeasure ref="C-PLUGIN-SANDBOX" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-37-PLUGIN-SYSTEM" name="An attacker examines the plugin system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An adversary creates a plugin that appears to be legitimate but is actually designed to execute malicious code on the target system. The malicious plugin is then distributed to users or added to a repository, where it can be downloaded and installed by unsuspecting users.&lt;/p&gt;&lt;p&gt;Once the malicious plugin is installed, it can be used by the attacker to steal sensitive information, modify or delete data, or take control of the targeted system. The attacker may also use the malicious plugin to create a backdoor into the system, allowing them to access it in the future without detection.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-492-REDOS" name="An adversary may execute an attack on a program that uses a poor Regular Expression implementation by choosing input that results in an extreme situation for the Regex" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression (Regex) to enter these extreme situations and then hang for a very long time.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="a21ff4ea-8962-4a97-83f5-0eb65e18dace" diagramComponentId="28fbfb13-fbfb-4da4-9e9c-a5a69626340e" ref="e20863d2-1b1d-4681-b6ad-077a9a907c6a" name="Training Data" desc="" library="CS-Default" parentComponentRef="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.209">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.339">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="e723106b-31a5-42eb-a0dd-0d1b15ae8fc0" diagramComponentId="1624bcaf-b82e-4fb8-a3e0-e820961cf3b3" ref="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" name="Training Dataset &amp; Processing" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.396">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="c24df590-a2b2-4fe5-85d4-fc3adad953d8" diagramComponentId="9cee23e0-5a6b-4b98-8aa4-f00cdfdf2024" ref="394f4bdf-cef5-4645-87b5-58d84f31c9ce" name="Web Service" desc="" library="CS-Default" parentComponentRef="d5c2ada9-ff09-4e53-a3e7-56212684e587" componentDefinitionRef="web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.062">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.590">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.557">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.825">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.365">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.184">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.635">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.557">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.142">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.962">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.296">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.299">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.18" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.19" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.296">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.141">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.565">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="Compensating Controls" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
-              <output/>
-            </source>
-            <references/>
-            <customFields>
-              <customField ref="Documentation Links" value=""/>
-            </customFields>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="Attack Complexity" value=""/>
-                <customField ref="Attack Vector" value=""/>
-                <customField ref="CFMEA-ID" value=""/>
-                <customField ref="Mitre" value=""/>
-                <customField ref="Privileges Required" value=""/>
-                <customField ref="Records" value=""/>
-                <customField ref="STRIDE" value=""/>
-                <customField ref="User Interaction" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From cc25e1177a3891ffd614971d0690f2ca9db81cd8 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:22:54 -0400
Subject: [PATCH 19/28] Delete
 Templates/mobile-client-to-kubernetes-cluster-with-istio.xml

---
 ...lient-to-kubernetes-cluster-with-istio.xml | 17032 ----------------
 1 file changed, 17032 deletions(-)
 delete mode 100644 Templates/mobile-client-to-kubernetes-cluster-with-istio.xml

diff --git a/Templates/mobile-client-to-kubernetes-cluster-with-istio.xml b/Templates/mobile-client-to-kubernetes-cluster-with-istio.xml
deleted file mode 100644
index c88c660..0000000
--- a/Templates/mobile-client-to-kubernetes-cluster-with-istio.xml
+++ /dev/null
@@ -1,17032 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="Mobile Client to Kubernetes cluster with Istio" name="Mobile Client to Kubernetes cluster with Istio" tags="Community">
-  <desc>&lt;p&gt;AWS RDS + KUB&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjY2NSIgZHk9IjIwNjgiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC4zLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTI0IiB5PSItNzg5IiB3aWR0aD0iMjY4IiBoZWlnaHQ9IjQxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTc5IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQgKFRoaW4pIiBzdHlsZT0iaXIucmVmPTc0ODY4MTVlLTFlMDMtNDNkMC1iNDI3LTY0MzdkMTI4NjM3Zjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1tb2JpbGUtZGV2aWNlLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0ek5UQTJNamNnTUM0eE1qazJNemxETUM0eU9UZzBNak1nTUM0eE1qazJNemtnTUM0eU5UWXhNRFFnTUM0eE56RTVOVGdnTUM0eU5UWXhNRFFnTUM0eU1qUXhOakZXTUM0M09URXlPVGRETUM0eU5UWXhNRFFnTUM0NE5ETTFNREVnTUM0eU9UZzBNak1nTUM0NE9EVTRNaUF3TGpNMU1EWXlOeUF3TGpnNE5UZ3lTREF1TmpNME1UazJRekF1TmpnMk16azVJREF1T0RnMU9ESWdNQzQzTWpnM01Ua2dNQzQ0TkRNMU1ERWdNQzQzTWpnM01Ua2dNQzQzT1RFeU9UZFdNQzR5TWpReE5qRkRNQzQzTWpnM01Ua2dNQzR4TnpFNU5UZ2dNQzQyT0RZek9Ua2dNQzR4TWprMk16a2dNQzQyTXpReE9UWWdNQzR4TWprMk16bElNQzR6TlRBMk1qZGFUVEF1TXpJMk9UazJJREF1TWpFeU16UTJRekF1TXpJMk9UazJJREF1TVRrNU1qazFJREF1TXpNM05UYzJJREF1TVRnNE56RTFJREF1TXpVd05qSTNJREF1TVRnNE56RTFTREF1TmpNME1UazJRekF1TmpRM01qUTNJREF1TVRnNE56RTFJREF1TmpVM09ESTNJREF1TVRrNU1qazFJREF1TmpVM09ESTNJREF1TWpFeU16UTJWakF1TnpNeU1qSXhRekF1TmpVM09ESTNJREF1TnpRMU1qY3hJREF1TmpRM01qUTNJREF1TnpVMU9EVXhJREF1TmpNME1UazJJREF1TnpVMU9EVXhTREF1TXpVd05qSTNRekF1TXpNM05UYzJJREF1TnpVMU9EVXhJREF1TXpJMk9UazJJREF1TnpRMU1qY3hJREF1TXpJMk9UazJJREF1TnpNeU1qSXhWakF1TWpFeU16UTJXazB3TGpRMk5EZzBNaUF3TGpnMU1ETTNORU13TGpRME9UWXhOaUF3TGpnMU1ETTNOQ0F3TGpRek56STNNeUF3TGpnek9EQXpJREF1TkRNM01qY3pJREF1T0RJeU9EQTBRekF1TkRNM01qY3pJREF1T0RBM05UYzRJREF1TkRRNU5qRTJJREF1TnprMU1qTTFJREF1TkRZME9EUXlJREF1TnprMU1qTTFTREF1TlRFNU9UaERNQzQxTXpVeU1EWWdNQzQzT1RVeU16VWdNQzQxTkRjMU5TQXdMamd3TnpVM09DQXdMalUwTnpVMUlEQXVPREl5T0RBMFF6QXVOVFEzTlRVZ01DNDRNemd3TXlBd0xqVXpOVEl3TmlBd0xqZzFNRE0zTkNBd0xqVXhPVGs0SURBdU9EVXdNemMwU0RBdU5EWTBPRFF5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNREF3TWpRME1UUXhJREF1TURFMU16Z3dPU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTsiIHBhcmVudD0iMTciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODAiIHk9IjExMiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9Ik1vYmlsZSBEZXZpY2UgQ2xpZW50IChUaGluKSAtPiBBV1MgQVBJIEdhdGV3YXkiIHN0eWxlPSJpci5yZWY9MzQ1Njg3ZmYtNmNlNy00NjNmLTgwOTAtZGE0Yjk5YjkzZmNjO2VuZEFycm93PWNsYXNzaWM7aHRtbD0xO2ZvbnRDb2xvcj0jRkYzMzMzO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2N1cnZlZD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0tMC4wMzM7ZW50cnlZPTAuNTc4O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMSIgc291cmNlPSIxNzkiIHRhcmdldD0iNiIgZWRnZT0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgd2lkdGg9IjUwIiBoZWlnaHQ9IjUwIiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItMjU1IiB5PSItNTc5IiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSIzMCIgeT0iLTYxNiIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjI1MSIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTE5MSIgeT0iLTExMjYiIHdpZHRoPSIxMDk1IiBoZWlnaHQ9Ijk2MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNiIgdmFsdWU9IkFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj03NTE3ZjM2Ni05MDk2LTRlOTUtYmQ3Yy0wZjRhNzM3ZmQxZGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFkzTmpjZ01DNDRNakF3TnpGRE1DNDJORE01TkRNZ01DNDRNakF3T0RFZ01DNDJOREV4T0RnZ01DNDRNVGt4T1RRZ01DNDJNemc1TURFZ01DNDRNVGMxTXpkRE1DNDJNemN4TnpnZ01DNDRNVFl6TVNBd0xqWXpOVGMzTVNBd0xqZ3hORFk1TVNBd0xqWXpORGM1TnlBd0xqZ3hNamd4TTBNd0xqWXpNemd5TkNBd0xqZ3hNRGt6TlNBd0xqWXpNek14TVNBd0xqZ3dPRGcxTXlBd0xqWXpNek13TVNBd0xqZ3dOamN6TjFZd0xqRTVNelF3TkVNd0xqWXpNek14SURBdU1Ua3hNVEkxSURBdU5qTXpPVEEwSURBdU1UZzRPRGczSURBdU5qTTFNREkwSURBdU1UZzJPVEF6UXpBdU5qTTJNVFEwSURBdU1UZzBPVEU1SURBdU5qTTNOelUxSURBdU1UZ3pNalUxSURBdU5qTTVOekF4SURBdU1UZ3lNRGN4UXpBdU5qUXhOalk1SURBdU1UZ3dOemszSURBdU5qUXpPVE0zSURBdU1UZ3dNRFkxSURBdU5qUTJNamM0SURBdU1UYzVPVFE0UXpBdU5qUTROakU1SURBdU1UYzVPRE14SURBdU5qVXdPVFE1SURBdU1UZ3dNek16SURBdU5qVXpNRE0wSURBdU1UZ3hOREEwVERBdU9ESTJNelkzSURBdU1qWTJNRGN4UXpBdU9ESTROVGt4SURBdU1qWTNNVFlnTUM0NE16QTBOamdnTUM0eU5qZzRORGNnTUM0NE16RTNPRFlnTUM0eU56QTVORE5ETUM0NE16TXhNRFVnTUM0eU56TXdNemtnTUM0NE16TTRNVFFnTUM0eU56VTBOakVnTUM0NE16TTRNelFnTUM0eU56YzVNemRXTUM0M05Ea3hNemRETUM0NE16TTVOemNnTUM0M05USXdOakVnTUM0NE16TXhOVFFnTUM0M05UUTVOVEVnTUM0NE16RTBPVEVnTUM0M05UY3pOakZETUM0NE1qazRNamdnTUM0M05UazNOekVnTUM0NE1qYzBNVGtnTUM0M05qRTFOallnTUM0NE1qUTJNelFnTUM0M05qSTBOekZNTUM0Mk5URXpNREVnTUM0NE1qQXdOekZETUM0Mk5EazNPVGNnTUM0NE1qQXlPRGNnTUM0Mk5EZ3lOekVnTUM0NE1qQXlPRGNnTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZhVFRBdU5qWXdNVEF4SURBdU1qRTBPRGN4VmpBdU56ZzRNakEwVERBdU9EQTJOelkzSURBdU56TTVOVE0zVmpBdU1qZzJNakEwVERBdU5qWXdNVEF4SURBdU1qRTBPRGN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0xTXpRek15QXdMamd5TURBM1F6QXVNelV5TURFM0lEQXVPREl3TWpZeklEQXVNelV3TlRneUlEQXVPREl3TWpZeklEQXVNelE1TVRZMklEQXVPREl3TURkTU1DNHhOelU0TXpNZ01DNDNOakkwTjBNd0xqRTNNekEzTXlBd0xqYzJNVFUwTXlBd0xqRTNNRFk1TXlBd0xqYzFPVGN6TnlBd0xqRTJPVEExTmlBd0xqYzFOek16UXpBdU1UWTNOREU1SURBdU56VTBPVEl5SURBdU1UWTJOakUwSURBdU56VXlNRFExSURBdU1UWTJOelkySURBdU56UTVNVE0zVmpBdU1qYzNPVE0zUXpBdU1UWTJOemcySURBdU1qYzFORFl4SURBdU1UWTNORGsxSURBdU1qY3pNRE01SURBdU1UWTRPREUwSURBdU1qY3dPVFF6UXpBdU1UY3dNVE16SURBdU1qWTRPRFEzSURBdU1UY3lNREE1SURBdU1qWTNNVFlnTUM0eE56UXlNek1nTUM0eU5qWXdOekZNTUM0ek5EYzFOallnTUM0eE9ERTBNRFJETUM0ek5EazJOVEVnTUM0eE9EQXpNek1nTUM0ek5URTVPREVnTUM0eE56azRNekVnTUM0ek5UUXpNaklnTUM0eE56azVORGhETUM0ek5UWTJOak1nTUM0eE9EQXdOalVnTUM0ek5UZzVNeklnTUM0eE9EQTNPVGNnTUM0ek5qQTRPVGtnTUM0eE9ESXdOekZETUM0ek5qSTRNakVnTUM0eE9ETXlOekVnTUM0ek5qUTBNRFVnTUM0eE9EUTVORElnTUM0ek5qVTFNREVnTUM0eE9EWTVNalZETUM0ek5qWTFPVGdnTUM0eE9EZzVNRGdnTUM0ek5qY3hOekVnTUM0eE9URXhNemdnTUM0ek5qY3hOallnTUM0eE9UTTBNRFJXTUM0NE1EWTNNemRETUM0ek5qY3hOVFlnTUM0NE1EZzROVElnTUM0ek5qWTJORE1nTUM0NE1UQTVNelVnTUM0ek5qVTJOeUF3TGpneE1qZ3hNME13TGpNMk5EWTVOaUF3TGpneE5EWTVNU0F3TGpNMk16STRPU0F3TGpneE5qTXhJREF1TXpZeE5UWTJJREF1T0RFM05UTTNRekF1TXpVNU1qTTBJREF1T0RFNU16QTFJREF1TXpVMk16VTNJREF1T0RJd01qQXlJREF1TXpVek5ETXpJREF1T0RJd01EZFdNQzQ0TWpBd04xcE5NQzR4T1RNME16TWdNQzQzTkRBd04wd3dMak0wTURFZ01DNDNPRGczTXpkV01DNHlNVFUwTURSTU1DNHhPVE0wTXpNZ01DNHlPRGN3TURSV01DNDNOREF3TjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpNeU56SWdNQzR6TmpZMk16SklNQzQxT1RNeU56SldNQzR6TXprNU5qWklNQzQyTXpNeU56SldNQzR6TmpZMk16SmFUVEF1TlRVek1qY3lJREF1TXpZMk5qTXlTREF1TlRFek1qY3lWakF1TXpNNU9UWTJTREF1TlRVek1qY3lWakF1TXpZMk5qTXlXazB3TGpRM016STNNaUF3TGpNMk5qWXpNa2d3TGpRek16STNNbFl3TGpNek9UazJOa2d3TGpRM016STNNbFl3TGpNMk5qWXpNbHBOTUM0ek9UTXlOekVnTUM0ek5qWTJNekpJTUM0ek5UTXlOekZXTUM0ek16azVOalpJTUM0ek9UTXlOekZXTUM0ek5qWTJNekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TWpjeUlEQXVOall3TURnNVNEQXVOVGt6TWpjeVZqQXVOak16TkRJelNEQXVOak16TWpjeVZqQXVOall3TURnNVdrMHdMalUxTXpJM01pQXdMalkyTURBNE9VZ3dMalV4TXpJM01sWXdMall6TXpReU0wZ3dMalUxTXpJM01sWXdMalkyTURBNE9WcE5NQzQwTnpNeU56SWdNQzQyTmpBd09EbElNQzQwTXpNeU56SldNQzQyTXpNME1qTklNQzQwTnpNeU56SldNQzQyTmpBd09EbGFUVEF1TXprek1qY3hJREF1TmpZd01EZzVTREF1TXpVek1qY3hWakF1TmpNek5ESXpTREF1TXprek1qY3hWakF1TmpZd01EZzVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBNVFV5SURBdU5UUTFPVE5NTUM0ek9URXpPRFlnTUM0MU1ETXhNME13TGpNNE9Ua3lNeUF3TGpVd01UZzNPQ0F3TGpNNE9EYzBPQ0F3TGpVd01ETXlOQ0F3TGpNNE56azBNaUF3TGpRNU9EVTNOVU13TGpNNE56RXpOaUF3TGpRNU5qZ3lOaUF3TGpNNE5qY3hPU0F3TGpRNU5Ea3lNeUF3TGpNNE5qY3hPU0F3TGpRNU1qazVOME13TGpNNE5qY3hPU0F3TGpRNU1UQTNNU0F3TGpNNE56RXpOaUF3TGpRNE9URTJPQ0F3TGpNNE56azBNaUF3TGpRNE56UXhPRU13TGpNNE9EYzBPQ0F3TGpRNE5UWTJPU0F3TGpNNE9Ua3lNeUF3TGpRNE5ERXhOU0F3TGpNNU1UTTROaUF3TGpRNE1qZzJNMHd3TGpRME1UTTROaUF3TGpRME1EQTJNMHd3TGpRMU9EY3lJREF1TkRZd016Tk1NQzQwTWpBMU9EWWdNQzQwT1RNek9UZE1NQzQwTlRnM01pQXdMalV5TmpBMk0wd3dMalEwTVRVeUlEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVNE56STJJREF1TlRRMU9UTk1NQzQxTkRFek9UTWdNQzQxTWpVMk5qTk1NQzQxTnprMU1qVWdNQzQwT1RNek9UZE1NQzQxTkRFeU5pQXdMalEyTURnMk0wd3dMalUxT0RVNU15QXdMalEwTURBMk0wd3dMall3T0RjeU5TQXdMalE0TWpjelF6QXVOakV3TVRnNElEQXVORGd6T1RneUlEQXVOakV4TXpZeklEQXVORGcxTlRNMklEQXVOakV5TVRZNUlEQXVORGczTWpnMVF6QXVOakV5T1RjMUlEQXVORGc1TURNMElEQXVOakV6TXpreUlEQXVORGt3T1RNNElEQXVOakV6TXpreUlEQXVORGt5T0RZelF6QXVOakV6TXpreUlEQXVORGswTnpnNUlEQXVOakV5T1RjMUlEQXVORGsyTmpreklEQXVOakV5TVRZNUlEQXVORGs0TkRReVF6QXVOakV4TXpZeklEQXVOVEF3TVRreElEQXVOakV3TVRnNElEQXVOVEF4TnpRMUlEQXVOakE0TnpJMUlEQXVOVEF5T1RrM1REQXVOVFU0TnpJMklEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRFek5qZzVJREF1TkRFM01qSTJUREF1TkRZd05qa3pJREF1TlRjek9UYzFUREF1TkRnMU9UVTFJREF1TlRneU5URTFUREF1TlRNNE9UVXhJREF1TkRJMU56WTNUREF1TlRFek5qZzVJREF1TkRFM01qSTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01EWTNJaUI1TVQwaU1TNHlNRGN4TVNJZ2VESTlJakV1TWpBM01UVWlJSGt5UFNJdE1DNHlNRGN4TURjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTBSREkzUVRnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwRXhOalpHUmlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzYiIHk9IjQ0OSIgd2lkdGg9Ijg1IiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMjUiIHZhbHVlPSJBV1MgQVBJIEdhdGV3YXkgLT4gQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSIgc3R5bGU9ImlyLnJlZj0xMDk1OTAzMC0xYWMzLTRkODEtOGQzYi1iYmU3M2ZkNmYwZjk7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyNTEiIHNvdXJjZT0iNiIgdGFyZ2V0PSIxNDgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNTAiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIyNTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTg0IiB5PSI4MyIgd2lkdGg9Ijg4NiIgaGVpZ2h0PSI4MjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0MCIgdmFsdWU9Ik9BdXRoMiBBdXRob3JpemF0aW9uIFNlcnZlciIgc3R5bGU9ImlyLnJlZj04MjRhZDczNC1kZGYxLTRiYmUtOTU5MC01ODcyYTNhYmY2Mzk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjU3IiB5PSIzMzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjE2IiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIiBzdHlsZT0iaXIucmVmPTM1NjUyYTljLTcxOGItNGU5OC1iYjVjLWY1ZWQ3NzY0ZTdlYjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIyNDAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii03NSIgeT0iLTYyMS45MTE5MjQxMTkyNDExIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjU3IiB2YWx1ZT0iU2VydmljZSBtZXNoIChJc3RpbykgLT4gU29tcnlzdC1BUEkiIHN0eWxlPSJpci5yZWY9MTM1MzE1YWEtYmU3MC00NDcxLWJhNGEtYjI4ZTJhMjZjZDM4O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjE5MiIgdGFyZ2V0PSIzMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0OCIgdmFsdWU9IkFXUyBFTEIgKEVsYXN0aWMgTG9hZCBCYWxhbmNlcikiIHN0eWxlPSJpci5yZWY9MDI1MzJjZjctZWU0Yy00NWZkLWFjNzItOGQwNDlkYmNiMmQwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOakEwTnpRZ01DNDFNVE15TjBNd0xqWTJNemd5TkNBd0xqVXpNemd6TmlBd0xqWTNORGM1TkNBd0xqVTFNak00T0NBd0xqWTVNVElnTUM0MU5qVXlNelJETUM0M01EYzJNRGNnTUM0MU56Z3dPQ0F3TGpjeU9ESTBPQ0F3TGpVNE5ESTRJREF1TnpRNU1ERTNJREF1TlRneU5rTXdMamMyT1RjNE55QXdMalU0TURreE9TQXdMamM0T1RFMk15QXdMalUzTVRRNE1pQXdMamd3TXpJNUlEQXVOVFUyTVRZMVF6QXVPREUzTkRFNElEQXVOVFF3T0RRNElEQXVPREkxTWpZeUlEQXVOVEl3TnpjMElEQXVPREkxTWpZeUlEQXVORGs1T1RNMlF6QXVPREkxTWpZeUlEQXVORGM1TURrNUlEQXVPREUzTkRFNElEQXVORFU1TURJMUlEQXVPREF6TWprZ01DNDBORE0zTURoRE1DNDNPRGt4TmpNZ01DNDBNamd6T1RFZ01DNDNOamszT0RjZ01DNDBNVGc1TlRNZ01DNDNORGt3TVRjZ01DNDBNVGN5TnpORE1DNDNNamd5TkRnZ01DNDBNVFUxT1RJZ01DNDNNRGMyTURjZ01DNDBNakUzT1RJZ01DNDJPVEV5SURBdU5ETTBOak00UXpBdU5qYzBOemswSURBdU5EUTNORGcxSURBdU5qWXpPREkwSURBdU5EWTJNRE0ySURBdU5qWXdORGMwSURBdU5EZzJOakF6U0RBdU5UWXhNREE0UXpBdU5UVTVORFkxSURBdU5EWXlNRFUwSURBdU5UVXpNVEl6SURBdU5ETTRNRFExSURBdU5UUXlNelF4SURBdU5ERTFPVE0yVERBdU5qWXlNelF4SURBdU16RTBORFk1UXpBdU5qYzNNRFkySURBdU16STJNVEl6SURBdU5qazFNekV4SURBdU16TXlORE0wSURBdU56RTBNRGtnTUM0ek16SXpOME13TGpjek1qZzJPU0F3TGpNek1qTXdOeUF3TGpjMU1UQTNJREF1TXpJMU9EY3hJREF1TnpZMU56RTJJREF1TXpFME1URTRRekF1Tnpnd016WXhJREF1TXpBeU16WTBJREF1Tnprd05UZzBJREF1TWpnMU9UZzRJREF1TnprME56RXlJREF1TWpZM05qWTRRekF1TnprNE9EUWdNQzR5TkRrek5EZ2dNQzQzT1RZMk1qa2dNQzR5TXpBeE55QXdMamM0T0RRMElEQXVNakV6TWpjeFF6QXVOemd3TWpVZ01DNHhPVFl6TnpJZ01DNDNOalkxTmpnZ01DNHhPREkzTlRJZ01DNDNORGsyTXpFZ01DNHhOelEyTkVNd0xqY3pNalk1TlNBd0xqRTJOalV5T1NBd0xqY3hNelV3TnlBd0xqRTJORFF3TlNBd0xqWTVOVEl3TmlBd0xqRTJPRFl4TjBNd0xqWTNOamt3TmlBd0xqRTNNamd5T1NBd0xqWTJNRFUzTnlBd0xqRTRNekV5TnlBd0xqWTBPRGc1SURBdU1UazNPREkzUXpBdU5qTTNNakEwSURBdU1qRXlOVEkySURBdU5qTXdPRFV5SURBdU1qTXdOelUzSURBdU5qTXdPRGMwSURBdU1qUTVOVE0yUXpBdU5qTXdOekU0SURBdU1qWTFOak0ySURBdU5qTTFNellnTUM0eU9ERTBNVGNnTUM0Mk5EUXlNRGdnTUM0eU9UUTROamxNTUM0MU1qZ3lNRGdnTUM0ek9USTJNRE5ETUM0MU1EVXhOemNnTUM0ek5UZ3dPVGdnTUM0ME56RTJOVGdnTUM0ek16RTVNVGNnTUM0ME16STJNRE1nTUM0ek1UYzVNamRETUM0ek9UTTFORGdnTUM0ek1ETTVNemdnTUM0ek5URXdNamtnTUM0ek1ESTRPREVnTUM0ek1URXpNamdnTUM0ek1UUTVNVFJETUM0eU56RTJNamNnTUM0ek1qWTVORGNnTUM0eU16WTRORGtnTUM0ek5URTBNekVnTUM0eU1USXhNek1nTUM0ek9EUTNORGxETUM0eE9EYzBNVFlnTUM0ME1UZ3dOamNnTUM0eE56UXdOeklnTUM0ME5UZzBOVEVnTUM0eE56UXdOeklnTUM0ME9UazVNelpETUM0eE56UXdOeklnTUM0MU5ERTBNakVnTUM0eE9EYzBNVFlnTUM0MU9ERTRNRFlnTUM0eU1USXhNek1nTUM0Mk1UVXhNalJETUM0eU16WTRORGtnTUM0Mk5EZzBOREVnTUM0eU56RTJNamNnTUM0Mk56STVNallnTUM0ek1URXpNamdnTUM0Mk9EUTVOVGhETUM0ek5URXdNamtnTUM0Mk9UWTVPVEVnTUM0ek9UTTFORGdnTUM0Mk9UVTVNelVnTUM0ME16STJNRE1nTUM0Mk9ERTVORFZETUM0ME56RTJOVGdnTUM0Mk5qYzVOVFVnTUM0MU1EVXhOemNnTUM0Mk5ERTNOelFnTUM0MU1qZ3lNRGdnTUM0Mk1EY3lOMHd3TGpZME5ESXdPQ0F3TGpjd05UQXdNME13TGpZek5UTTJJREF1TnpFNE5EVTFJREF1TmpNd056RTRJREF1TnpNME1qTTNJREF1TmpNd09EYzBJREF1TnpVd016TTNRekF1TmpNd09EWTNJREF1TnpZNU1EZ2dNQzQyTXpjeU1Ua2dNQzQzT0RjeU56RWdNQzQyTkRnNE9URWdNQzQ0TURFNU16WkRNQzQyTmpBMU5qUWdNQzQ0TVRZMk1ERWdNQzQyTnpZNE5qY2dNQzQ0TWpZNE56RWdNQzQyT1RVeE16UWdNQzQ0TXpFd05qaERNQzQzTVRNME1ERWdNQzQ0TXpVeU5qVWdNQzQzTXpJMU5USWdNQzQ0TXpNeE5DQXdMamMwT1RRMU5TQXdMamd5TlRBMFF6QXVOelkyTXpVNElEQXVPREUyT1RReElEQXVOemd3TURFeUlEQXVPREF6TXpRMklEQXVOemc0TVRnMklEQXVOemcyTkRjNVF6QXVOemsyTXpZZ01DNDNOamsyTVRJZ01DNDNPVGcxTmprZ01DNDNOVEEwTnpFZ01DNDNPVFEwTlRNZ01DNDNNekl4T0RWRE1DNDNPVEF6TXpZZ01DNDNNVE00T1RrZ01DNDNPREF4TXpjZ01DNDJPVGMxTlRJZ01DNDNOalUxTWpRZ01DNDJPRFU0TVRSRE1DNDNOVEE1TVRFZ01DNDJOelF3TnpjZ01DNDNNekkzTkRjZ01DNDJOamMyTkRZZ01DNDNNVFF3TURRZ01DNDJOamMxTnpGRE1DNDJPVFV5TmpFZ01DNDJOamMwT1RZZ01DNDJOemN3TkRjZ01DNDJOek0zT0RNZ01DNDJOakl6TkRFZ01DNDJPRFUwTUROTU1DNDFOREl6TkRFZ01DNDFPRE01TXpaRE1DNDFOVE14TWpNZ01DNDFOakU0TWpnZ01DNDFOVGswTmpVZ01DNDFNemM0TVRrZ01DNDFOakV3TURnZ01DNDFNVE15TjBnd0xqWTJNRFEzTkZwTk1DNDNOREl3TnpRZ01DNDBORE0yTmpsRE1DNDNOVE15TURrZ01DNDBORE0yTkRNZ01DNDNOalF4SURBdU5EUTJPVEl4SURBdU56Y3pNemN4SURBdU5EVXpNRGczUXpBdU56Z3lOalF4SURBdU5EVTVNalUwSURBdU56ZzVPRGMwSURBdU5EWTRNRE15SURBdU56azBNVFV6SURBdU5EYzRNekV4UXpBdU56azRORE15SURBdU5EZzROVGtnTUM0M09UazFOalVnTUM0ME9UazVNRGdnTUM0M09UYzBNRGtnTUM0MU1UQTRNekZETUM0M09UVXlOVE1nTUM0MU1qRTNOVFVnTUM0M09EazVNRFVnTUM0MU16RTNPVE1nTUM0M09ESXdOREVnTUM0MU16azJOelZETUM0M056UXhOemdnTUM0MU5EYzFOVGdnTUM0M05qUXhOVElnTUM0MU5USTVNeUF3TGpjMU16SXpOQ0F3TGpVMU5URXhNa013TGpjME1qTXhOaUF3TGpVMU56STVOQ0F3TGpjek1EazVOU0F3TGpVMU5qRTROeUF3TGpjeU1EY3dOaUF3TGpVMU1Ua3pNME13TGpjeE1EUXhOeUF3TGpVME56WTNPQ0F3TGpjd01UWXlNaUF3TGpVME1EUTJOaUF3TGpZNU5UUXpNeUF3TGpVek1USXhRekF1TmpnNU1qUTBJREF1TlRJeE9UVTBJREF1TmpnMU9UUXhJREF1TlRFeE1EY2dNQzQyT0RVNU5ERWdNQzQwT1RrNU16WkRNQzQyT0RVNU5ERWdNQzQwT0RVd016WWdNQzQyT1RFNE5URWdNQzQwTnpBM05EVWdNQzQzTURJek56UWdNQzQwTmpBeE9UZERNQzQzTVRJNE9UY2dNQzQwTkRrMk5EZ2dNQzQzTWpjeE56VWdNQzQwTkRNM01EVWdNQzQzTkRJd056UWdNQzQwTkRNMk5qbFdNQzQwTkRNMk5qbGFUVEF1TnpFME16UXhJREF1TVRrek1qWTVRekF1TnpJMU5EY2dNQzR4T1RNeU5qa2dNQzQzTXpZek5EZ2dNQzR4T1RZMU5qa2dNQzQzTkRVMk1ERWdNQzR5TURJM05USkRNQzQzTlRRNE5UUWdNQzR5TURnNU16UWdNQzQzTmpJd05qWWdNQzR5TVRjM01qSWdNQzQzTmpZek1qVWdNQzR5TWpnd01ETkRNQzQzTnpBMU9ETWdNQzR5TXpneU9EVWdNQzQzTnpFMk9UZ2dNQzR5TkRrMU9UZ2dNQzQzTmprMU1qY2dNQzR5TmpBMU1UTkRNQzQzTmpjek5UVWdNQzR5TnpFME1qZ2dNQzQzTmpFNU9UY2dNQzR5T0RFME5UTWdNQzQzTlRReE1qZ2dNQzR5T0Rrek1qSkRNQzQzTkRZeU5Ua2dNQzR5T1RjeE9USWdNQzQzTXpZeU16TWdNQzR6TURJMU5TQXdMamN5TlRNeE9DQXdMak13TkRjeU1VTXdMamN4TkRRd015QXdMak13TmpnNU15QXdMamN3TXpBNUlEQXVNekExTnpjNElEQXVOamt5T0RBNUlEQXVNekF4TlRKRE1DNDJPREkxTWpjZ01DNHlPVGN5TmpFZ01DNDJOek0zTkNBd0xqSTVNREEwT1NBd0xqWTJOelUxTnlBd0xqSTRNRGM1TmtNd0xqWTJNVE0zTkNBd0xqSTNNVFUwTXlBd0xqWTFPREEzTkNBd0xqSTJNRFkyTkNBd0xqWTFPREEzTkNBd0xqSTBPVFV6TmtNd0xqWTFPREEzTkNBd0xqSXpORFl4TXlBd0xqWTJOREF3TWlBd0xqSXlNRE13TVNBd0xqWTNORFUxTkNBd0xqSXdPVGMwT1VNd0xqWTROVEV3TnlBd0xqRTVPVEU1TnlBd0xqWTVPVFF4T0NBd0xqRTVNekkyT1NBd0xqY3hORE0wTVNBd0xqRTVNekkyT1ZwTk1DNDNNVFF6TkRFZ01DNDJPVFF5TURORE1DNDNNalUwTnpVZ01DNDJPVFF5TURNZ01DNDNNell6TlRrZ01DNDJPVGMxTURjZ01DNDNORFUyTVRVZ01DNDNNRE0yT1RWRE1DNDNOVFE0TnpFZ01DNDNNRGs0T0RRZ01DNDNOakl3T0RNZ01DNDNNVGcyTnprZ01DNDNOall6TXpjZ01DNDNNamc1TmpsRE1DNDNOekExT1RJZ01DNDNNemt5TlRnZ01DNDNOekUyT1RnZ01DNDNOVEExTnpnZ01DNDNOamsxTVRjZ01DNDNOakUwT1RaRE1DNDNOamN6TXpVZ01DNDNOekkwTVRVZ01DNDNOakU1TmpNZ01DNDNPREkwTkNBd0xqYzFOREE0SURBdU56a3dNekEwUXpBdU56UTJNVGs0SURBdU56azRNVFkzSURBdU56TTJNVFlnTUM0NE1ETTFNVFlnTUM0M01qVXlNellnTUM0NE1EVTJOekpETUM0M01UUXpNVE1nTUM0NE1EYzRNamdnTUM0M01ESTVPVFVnTUM0NE1EWTJPVFFnTUM0Mk9USTNNVFlnTUM0NE1ESTBNVFZETUM0Mk9ESTBNemNnTUM0M09UZ3hNellnTUM0Mk56TTJOVGtnTUM0M09UQTVNRFFnTUM0Mk5qYzBPVElnTUM0M09ERTJNek5ETUM0Mk5qRXpNallnTUM0M056SXpOaklnTUM0Mk5UZ3dORGdnTUM0M05qRTBOekVnTUM0Mk5UZ3dOelFnTUM0M05UQXpNemRETUM0Mk5UZ3hNU0F3TGpjek5UUXpOeUF3TGpZMk5EQTFNeUF3TGpjeU1URTFPU0F3TGpZM05EWXdNaUF3TGpjeE1EWXpOa013TGpZNE5URTFJREF1TnpBd01URXpJREF1TmprNU5EUXhJREF1TmprME1qQXpJREF1TnpFME16UXhJREF1TmprME1qQXpXazB3TGpNMk9ESXdPQ0F3TGpZMk5qWXdNME13TGpNek5USTBOQ0F3TGpZMk5qWXdNeUF3TGpNd016QXlNU0F3TGpZMU5qZ3lPQ0F3TGpJM05UWXhNeUF3TGpZek9EVXhOVU13TGpJME9ESXdOU0F3TGpZeU1ESXdNU0F3TGpJeU5qZzBNaUF3TGpVNU5ERTNNU0F3TGpJeE5ESXlPQ0F3TGpVMk16Y3hOME13TGpJd01UWXhNeUF3TGpVek16STJNeUF3TGpFNU9ETXhNeUF3TGpRNU9UYzFNU0F3TGpJd05EYzBOQ0F3TGpRMk56UXlNVU13TGpJeE1URTNOQ0F3TGpRek5UQTVNU0F3TGpJeU56QTBPQ0F3TGpRd05UTTVOQ0F3TGpJMU1ETTFOeUF3TGpNNE1qQTROVU13TGpJM016WTJOU0F3TGpNMU9EYzNOaUF3TGpNd016TTJNeUF3TGpNME1qa3dNeUF3TGpNek5UWTVNeUF3TGpNek5qUTNNa013TGpNMk9EQXlNeUF3TGpNek1EQTBNU0F3TGpRd01UVXpOQ0F3TGpNek16TTBNU0F3TGpRek1UazRPQ0F3TGpNME5UazFOa013TGpRMk1qUTBNeUF3TGpNMU9EVTNNU0F3TGpRNE9EUTNNaUF3TGpNM09Ua3pNeUF3TGpVd05qYzROaUF3TGpRd056TTBNVU13TGpVeU5URWdNQzQwTXpRM05Ea2dNQzQxTXpRNE56UWdNQzQwTmpZNU56TWdNQzQxTXpRNE56UWdNQzQwT1RrNU16WkRNQzQxTXpRNE1EUWdNQzQxTkRReE1UY2dNQzQxTVRjeU1qSWdNQzQxT0RZME5qa2dNQzQwT0RVNU9ERWdNQzQyTVRjM01VTXdMalExTkRjMElEQXVOalE0T1RVeElEQXVOREV5TXpnNUlEQXVOalkyTlRNeklEQXVNelk0TWpBNElEQXVOalkyTmpBelZqQXVOalkyTmpBeldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjUwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY3IiB5PSIzNjUuNSIgd2lkdGg9Ijg5IiBoZWlnaHQ9Ijg3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNTEiIHZhbHVlPSJBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIC0+IFNvbXJ5c3QtQVBJIiBzdHlsZT0iaXIucmVmPWFkOTJiMTFjLTQzN2QtNDgyOC04NjJhLTI4MGNhZmU5MWQxZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIxNDgiIHRhcmdldD0iMTkyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNDQxIiB5PSItNjgwIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjExIiB2YWx1ZT0iU2VydmljZSBtZXNoIChJc3RpbykgLT4gU29tcnlzdC1BUEkiIHN0eWxlPSJpci5yZWY9YzEyMmY0YTMtMDVhYi00NjkxLTgyNDktNmY2MWUxNDU1ZmRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjE5MiIgdGFyZ2V0PSIxNDYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMjYiIHZhbHVlPSJLdWJlcm5ldGVzIENsdXN0ZXIgVVMtV2VzdDItcHJvZC1la3MtY2x1c3RlciAtPiBEb2NrZXIgTGludXggSG9zdCIgc3R5bGU9ImlyLnJlZj1iMDMwNDczOC01NWIxLTQzOWYtYmUwOC04NGE3NTg5NDk2YjU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyNTAiIHNvdXJjZT0iMTQ2IiB0YXJnZXQ9IjI3NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNjk1IiB5PSI4OTUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIyNTIiIHZhbHVlPSJPQXV0aDIgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgLT4gQWNjZXNzLVJpZ2h0cyAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9ZGU3NmQ3ZGMtNzE1OS00Zjc4LWE4NGQtMmVmNWU3YzM3MmQ0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjc1O2V4aXRZPTA7ZXhpdER4PTA7ZXhpdER5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIyNTAiIHNvdXJjZT0iMjQwIiB0YXJnZXQ9IjE5NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNjQwIiB5PSI4OCIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNzA4IiB5PSItNTYiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzMiIgdmFsdWU9IkJGRiBBUEkiIHN0eWxlPSJpci5yZWY9MGI5NTdjMzMtNmViZi00NjZjLThiNzAtNmNhNDBlMjc5NDdmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7Zm9udENvbG9yPSMzMzMzMzM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtmaWxsQ29sb3I9I2Y1ZjVmNTtzdHJva2VDb2xvcj0jNjY2NjY2OyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDU2IiB5PSIzNjguNSIgd2lkdGg9IjgxIiBoZWlnaHQ9IjgxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNTUiIHZhbHVlPSJTb21yeXN0LUFQSSAtPiBNQU1JIChNeVNRTCkiIHN0eWxlPSJpci5yZWY9M2FmZjIwYTgtZDJkMC00OGIyLThkMzEtOTNjNjAzM2JkMDVkO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2V4aXRYPTA7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjMyIiB0YXJnZXQ9IjE5MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzk4IiB5PSIxMzMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI2MSIgeT0iLTY5IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjU0IiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gUEFQSSAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9ZGEwYjQyZTktNzE1OC00OTI5LTllYjYtOTFlNzgwNjY1ZmY2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIxOTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQ0OC43NSIgeT0iOTMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjUzMSIgeT0iLTUzIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjUzIiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gQXV0aC1TZXJ2aWNlIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj00YTUyZTkwMy00YWMwLTQzYjAtYjIxMy0yMDgxMWY1Njg0OTg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIxOTYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjkxNiIgeT0iMzMuNSIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iOTg3IiB5PSItOTYiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxOTIiIHZhbHVlPSJJc3RpbyAoRGVmYXVsdCBHVykiIHN0eWxlPSJpci5yZWY9Njc2Yjk4Y2ItNDA5My00YzZlLTg1OGItNThlMzZkNjYwMDJlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXNlcnZpY2UtbWVzaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TURFeE9DQXdMalV6TkRKTU1DNHpOemM1TlRnZ01DNDJOVFl6TmtNd0xqTTNOemsxT0NBd0xqWTBOalU0TnlBd0xqTTJPREU0TlNBd0xqWXpOamd4TkNBd0xqTTJNekk1T1NBd0xqWXlOekEwTVVNd0xqTTFPRFF4TXlBd0xqWXhOekkyT1NBd0xqTTFNelV5TmlBd0xqWXhOekkyT1NBd0xqTTBPRFkwSURBdU5qRTNNalk1VERBdU5EWTFPVEV6SURBdU5EazVPVGsyVERBdU16TTRPRFkzSURBdU16Y3lPVFZETUM0ek5EWTJOVElnTUM0ek5qazVOekVnTUM0ek5UTTNNakVnTUM0ek5qVXpPRFlnTUM0ek5UazJNVFFnTUM0ek5UazBPVEpETUM0ek5qVTFNRGdnTUM0ek5UTTFPVGtnTUM0ek56QXdPVE1nTUM0ek5EWTFNamtnTUM0ek56TXdOeklnTUM0ek16ZzNORFZNTUM0MU1EQXhNVGdnTUM0ME5qVTNPVEZNTUM0Mk1qY3hOalFnTUM0ek16ZzNORFZETUM0Mk16SXdOU0F3TGpNME9EVXhPQ0F3TGpZek1qQTFJREF1TXpVek5EQTBJREF1TmpReE9ESXpJREF1TXpVNE1qa3hRekF1TmpRNU1UYzJJREF1TXpZeE9UUTJJREF1TmpVMU9DQXdMak0yTmpreE5DQXdMalkyTVRNMk9DQXdMak0zTWprMVREQXVOVE0wTXpJeUlEQXVORGs1T1RrMlREQXVOalUyTkRneUlEQXVOakl5TVRVMVF6QXVOalE0TVRZNElEQXVOakkwT0RZMUlEQXVOalF3T0RreUlEQXVOak13TURjeUlEQXVOak0xTmpRMUlEQXVOak0zTURZM1F6QXVOak13TXprNElEQXVOalEwTURZeklEQXVOakkzTkRNM0lEQXVOalV5TlRBMklEQXVOakkzTVRZMElEQXVOall4TWpRMlREQXVOVEF3TVRFNElEQXVOVE0wTWxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTXlPVEV3TWlBd0xqY3lORGMyVERBdU5ETTJOakF5SURBdU9ETXlNalU1VmpBdU9ESTNNemN6UXpBdU5ETTNORGNnTUM0NE1EWTVOallnTUM0ME5EWXlNeUF3TGpjNE56WTVOU0F3TGpRMk1UQXpOU0F3TGpjM016WXlNMHd3TGpNM016QTNPU0F3TGpZNE5UWTJPVU13TGpNM01EVTRJREF1TmprMU9EYzNJREF1TXpZMU1ETTFJREF1TnpBMU1EZ3pJREF1TXpVM01UZ2dNQzQzTVRJd05qVkRNQzR6TkRrek1qVWdNQzQzTVRrd05EY2dNQzR6TXprMU16SWdNQzQzTWpNME56VWdNQzR6TWpreE1ESWdNQzQzTWpRM05sWXdMamN5TkRjMldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVFkzT1RZNUlEQXVOVFU0TmpFeVREQXVNamN3TlRneUlEQXVOalkyTVRFeVF6QXVNamN4TVRJMElEQXVOalUyTVRZNUlEQXVNamMwTmprZ01DNDJORFkyTXlBd0xqSTRNRGd3TXlBd0xqWXpPRGMzTVVNd0xqSTROamt4TmlBd0xqWXpNRGt4TVNBd0xqSTVOVEk0TkNBd0xqWXlOVEV3TnlBd0xqTXdORGM0TmlBd0xqWXlNakV6TkV3d0xqSXlNVGN4T1NBd0xqVXpOREU0UXpBdU1qQTNOalEzSURBdU5UUTRPVGcwSURBdU1UZzRNemMxSURBdU5UVTNOelEwSURBdU1UWTNPVFk1SURBdU5UVTROakV5VmpBdU5UVTROakV5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qY3dOVGN5SURBdU16TXpPRFl5VERBdU1UZ3lOakUzSURBdU5ESXhPREUyUXpBdU1Ua3lOelU0SURBdU5ESXpOakkxSURBdU1qQXlNemd5SURBdU5ESTNOakl6SURBdU1qRXdPREl4SURBdU5ETXpOVE5ETUM0eU1Ua3lOaUF3TGpRek9UUXpOeUF3TGpJeU5qTXhJREF1TkRRM01URXhJREF1TWpNeE5EZ3hJREF1TkRVMk1ESk1NQzR6TVRRMU5TQXdMak0zTWprMU0wd3dMakk0TlRJek1TQXdMak0xT0RJNU5FTXdMakk0TURNME5TQXdMak0wT0RVeU1TQXdMakkzTlRRMU9DQXdMak0wTXpZek5TQXdMakkzTURVM01pQXdMak16TXpnMk1sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF6TmpVNU9DQXdMakUyTnpjeU5Vd3dMak16TXprNE5DQXdMakkzTURNek9FTXdMak0wTXpRMU1TQXdMakkzTWpZMU9DQXdMak0xTWpFd01TQXdMakkzTnpVeU9DQXdMak0xT0RrNU15QXdMakk0TkRReVF6QXVNelkxT0RnMUlEQXVNamt4TXpFeUlEQXVNemN3TnpVMUlEQXVNams1T1RZeUlEQXVNemN6TURjMUlEQXVNekE1TkRJNVREQXVORFl4TURJNUlEQXVNakl4TkRjMFF6QXVORFV6TWpneElEQXVNakUwT0RReElEQXVORFEzTURjNElEQXVNakEyTlRreUlEQXVORFF5T0RVNElEQXVNVGszTXpBM1F6QXVORE00TmpNM0lEQXVNVGc0TURJeElEQXVORE0yTlNBd0xqRTNOemt5TkNBd0xqUXpOalU1T0NBd0xqRTJOemN5TlZZd0xqRTJOemN5TlZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTNNVFE0SURBdU1qY3dNek0xVERBdU5UY3pOelV5SURBdU1UY3lOakEzUXpBdU5UY3lPVEF5SURBdU1UZ3lORFExSURBdU5UWTVPREU1SURBdU1Ua3hPVFlnTUM0MU5qUTNNemtnTUM0eU1EQTBNamRETUM0MU5UazJOVGdnTUM0eU1EZzRPVFFnTUM0MU5USTNNVFFnTUM0eU1UWXdPVEVnTUM0MU5EUTBNelFnTUM0eU1qRTBOekZNTUM0Mk16SXpPRGtnTUM0ek1EazBNalpETUM0Mk16UTNNRGdnTUM0eU9UazVOVGtnTUM0Mk16azFOemtnTUM0eU9URXpNRGtnTUM0Mk5EWTBOekVnTUM0eU9EUTBNVGRETUM0Mk5UTXpOak1nTUM0eU56YzFNalVnTUM0Mk5qSXdNVE1nTUM0eU56STJOVFFnTUM0Mk56RTBPQ0F3TGpJM01ETXpOVll3TGpJM01ETXpOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpneU56Y3pNU0F3TGpReU5qY3dNVXd3TGpjek5EZzVNU0F3TGpNek16ZzJNa013TGpjek1qVTNNaUF3TGpNME16TXlPU0F3TGpjeU56Y3dNU0F3TGpNMU1UazNPQ0F3TGpjeU1EZ3dPU0F3TGpNMU9EZzNRekF1TnpFek9URTNJREF1TXpZMU56WXlJREF1TnpBMU1qWTNJREF1TXpjd05qTXpJREF1TmprMU9EQXhJREF1TXpjeU9UVXlUREF1Tnpnek56VTBJREF1TkRZd09UQTFRekF1TnpnM016RWdNQzQwTlRFM05qTWdNQzQzT1RNeU56Y2dNQzQwTkRNM05UUWdNQzQ0TURFd01pQXdMalF6Tnpjek1rTXdMamd3T0RjMk5DQXdMalF6TVRjd09TQXdMamd4TnprNU5DQXdMalF5TnpnNU55QXdMamd5Tnpjek1TQXdMalF5Tmpjd01WWXdMalF5Tmpjd01Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamM0TXpJMk5DQXdMalV6T1RBMk1rd3dMamN3TURFNU5TQXdMall5TWpFek1VTXdMamN3T1RrMk9DQXdMall5TnpBeE55QXdMamN4TkRnMU5TQXdMall5TnpBeE55QXdMamN4T1RjME1TQXdMall6TmpjNVF6QXVOekkwTlRFMUlEQXVOalF4TURrZ01DNDNNamd5T1RrZ01DNDJORFl6TnpVZ01DNDNNekE0TXlBd0xqWTFNakk0TVVNd0xqY3pNek0yTVNBd0xqWTFPREU0TnlBd0xqY3pORFUzT1NBd0xqWTJORFUzTWlBd0xqY3pORFFnTUM0Mk56QTVPVFJNTUM0NE16Y3dNVFVnTUM0MU5qZ3pPREZETUM0NE1UWTBNaUF3TGpVMk5EWXhOeUF3TGpjNU56VTNPQ0F3TGpVMU5ETTBJREF1Tnpnek1qWTBJREF1TlRNNU1EWXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpNeU16ZzBJREF1Tmprd05UVXlUREF1TlRRNU16RTJJREF1Tnpjek5qSXhUREF1TlRVME1qQXpJREF1TnpjNE5UQTNRekF1TlRZd09ERTFJREF1TnpnME56UXpJREF1TlRZMU9UZzVJREF1TnpreU16UTFJREF1TlRZNU16WTFJREF1T0RBd056ZzBRekF1TlRjeU56UWdNQzQ0TURreU1qSWdNQzQxTnpReU16WWdNQzQ0TVRneU9UWWdNQzQxTnpNM05EZ2dNQzQ0TWpjek56Rk1NQzQyTnpZek5qRWdNQzQzTWpRM05UZERNQzQyTmprNU16Z2dNQzQzTWpRNU16WWdNQzQyTmpNMU5UTWdNQzQzTWpNM01UZ2dNQzQyTlRjMk5EZ2dNQzQzTWpFeE9EZERNQzQyTlRFM05ESWdNQzQzTVRnMk5UVWdNQzQyTkRZME5UWWdNQzQzTVRRNE56SWdNQzQyTkRJeE5UY2dNQzQzTVRBd09UZERNQzQyTXpjd01UY2dNQzQzTURRM01EWWdNQzQyTXpNMk1UTWdNQzQyT1RjNE9UZ2dNQzQyTXpJek9EUWdNQzQyT1RBMU5USldNQzQyT1RBMU5USmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TWpReU56SWdNQzR6T1RjME5EWkRNQzR6TmpRM05USWdNQzR6T1RjME5EWWdNQzR6T1RjMU5qZ2dNQzR6TmpRMk16RWdNQzR6T1RjMU5qZ2dNQzR6TWpReE5VTXdMak01TnpVMk9DQXdMakk0TXpZM0lEQXVNelkwTnpVeUlEQXVNalV3T0RVMElEQXVNekkwTWpjeUlEQXVNalV3T0RVMFF6QXVNamd6TnpreUlEQXVNalV3T0RVMElEQXVNalV3T1RjM0lEQXVNamd6TmpjZ01DNHlOVEE1TnpjZ01DNHpNalF4TlVNd0xqSTFNRGszTnlBd0xqTTJORFl6TVNBd0xqSTRNemM1TWlBd0xqTTVOelEwTmlBd0xqTXlOREkzTWlBd0xqTTVOelEwTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTNOVGd6TXlBd0xqTTVOelEwTmtNd0xqY3hOak14TXlBd0xqTTVOelEwTmlBd0xqYzBPVEV5T0NBd0xqTTJORFl6TVNBd0xqYzBPVEV5T0NBd0xqTXlOREUxUXpBdU56UTVNVEk0SURBdU1qZ3pOamNnTUM0M01UWXpNVE1nTUM0eU5UQTROVFFnTUM0Mk56VTRNek1nTUM0eU5UQTROVFJETUM0Mk16VXpOVFFnTUM0eU5UQTROVFFnTUM0Mk1ESTFNemtnTUM0eU9ETTJOeUF3TGpZd01qVXpPU0F3TGpNeU5ERTFRekF1TmpBeU5UTTVJREF1TXpZME5qTXhJREF1TmpNMU16VTBJREF1TXprM05EUTJJREF1TmpjMU9ETXpJREF1TXprM05EUTJXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpJME1qY3lJREF1TnpRNU1qVkRNQzR6TmpRM05USWdNQzQzTkRreU5TQXdMak01TnpVMk9DQXdMamN4TmpRek5TQXdMak01TnpVMk9DQXdMalkzTlRrMU5VTXdMak01TnpVMk9DQXdMall6TlRRM05pQXdMak0yTkRjMU1pQXdMall3TWpZMk1TQXdMak15TkRJM01pQXdMall3TWpZMk1VTXdMakk0TXpjNU1pQXdMall3TWpZMk1TQXdMakkxTURrM055QXdMall6TlRRM05pQXdMakkxTURrM055QXdMalkzTlRrMU5VTXdMakkxTURrM055QXdMamN4TmpRek5TQXdMakk0TXpjNU1pQXdMamMwT1RJMUlEQXVNekkwTWpjeUlEQXVOelE1TWpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOelU0TXpNZ01DNDNORGt5TlVNd0xqY3hOak14TXlBd0xqYzBPVEkxSURBdU56UTVNVEk0SURBdU56RTJORE0xSURBdU56UTVNVEk0SURBdU5qYzFPVFUxUXpBdU56UTVNVEk0SURBdU5qTTFORGMySURBdU56RTJNekV6SURBdU5qQXlOall4SURBdU5qYzFPRE16SURBdU5qQXlOall4UXpBdU5qTTFNelUwSURBdU5qQXlOall4SURBdU5qQXlOVE01SURBdU5qTTFORGMySURBdU5qQXlOVE01SURBdU5qYzFPVFUxUXpBdU5qQXlOVE01SURBdU56RTJORE0xSURBdU5qTTFNelUwSURBdU56UTVNalVnTUM0Mk56VTRNek1nTUM0M05Ea3lOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpFMk56VTBPQ0F3TGpRd056RXdORU13TGpFNE5Ua3hJREF1TkRBM01UQTBJREF1TWpBek9EWWdNQzQwTVRJMU5Ea2dNQzR5TVRreE1qZ2dNQzQwTWpJM05URkRNQzR5TXpRek9UVWdNQzQwTXpJNU5USWdNQzR5TkRZeU9UVWdNQzQwTkRjME5USWdNQzR5TlRNek1qSWdNQzQwTmpRME1UWkRNQzR5TmpBek5Ea2dNQzQwT0RFek9ERWdNQzR5TmpJeE9EY2dNQzQxTURBd05EZ2dNQzR5TlRnMk1EVWdNQzQxTVRnd05UZERNQzR5TlRVd01qTWdNQzQxTXpZd05qWWdNQzR5TkRZeE9ERWdNQzQxTlRJMk1Ea2dNQzR5TXpNeE9UY2dNQzQxTmpVMU9UTkRNQzR5TWpBeU1USWdNQzQxTnpnMU56Y2dNQzR5TURNMk55QXdMalU0TnpReE9TQXdMakU0TlRZMklEQXVOVGt4TURBeFF6QXVNVFkzTmpVeElEQXVOVGswTlRnMElEQXVNVFE0T1RnMElEQXVOVGt5TnpRMUlEQXVNVE15TURFNUlEQXVOVGcxTnpFNFF6QXVNVEUxTURVMUlEQXVOVGM0TmpreElEQXVNVEF3TlRVMUlEQXVOVFkyTnpreUlEQXVNRGt3TXpVek5pQXdMalUxTVRVeU5FTXdMakE0TURFMU1qRWdNQzQxTXpZeU5UY2dNQzR3TnpRM01EY2dNQzQxTVRnek1EY2dNQzR3TnpRM01EY2dNQzQwT1RrNU5EVkRNQzR3TnpRM01EY2dNQzQwTnpVek1qSWdNQzR3T0RRME9EZzFJREF1TkRVeE56QTRJREF1TVRBeE9TQXdMalF6TkRJNU4wTXdMakV4T1RNeE1TQXdMalF4TmpnNE5pQXdMakUwTWpreU5TQXdMalF3TnpFd05DQXdMakUyTnpVME9DQXdMalF3TnpFd05GWXdMalF3TnpFd05GcE5NQzQ0TXpJd09UUWdNQzQwTURjeE1EUkRNQzQ0TlRBME5UWWdNQzQwTURjeE1EUWdNQzQ0TmpnME1EWWdNQzQwTVRJMU5Ea2dNQzQ0T0RNMk56UWdNQzQwTWpJM05URkRNQzQ0T1RnNU5ESWdNQzQwTXpJNU5USWdNQzQ1TVRBNE5ERWdNQzQwTkRjME5USWdNQzQ1TVRjNE5qZ2dNQzQwTmpRME1UWkRNQzQ1TWpRNE9UVWdNQzQwT0RFek9ERWdNQzQ1TWpZM016UWdNQzQxTURBd05EZ2dNQzQ1TWpNeE5URWdNQzQxTVRnd05UZERNQzQ1TVRrMU5qa2dNQzQxTXpZd05qWWdNQzQ1TVRBM01qY2dNQzQxTlRJMk1Ea2dNQzQ0T1RjM05ETWdNQzQxTmpVMU9UTkRNQzQ0T0RRM05Ua2dNQzQxTnpnMU56Y2dNQzQ0TmpneU1UWWdNQzQxT0RjME1Ua2dNQzQ0TlRBeU1EY2dNQzQxT1RFd01ERkRNQzQ0TXpJeE9UY2dNQzQxT1RRMU9EUWdNQzQ0TVRNMU15QXdMalU1TWpjME5TQXdMamM1TmpVMk5TQXdMalU0TlRjeE9FTXdMamMzT1RZd01TQXdMalUzT0RZNU1TQXdMamMyTlRFd01TQXdMalUyTmpjNU1pQXdMamMxTkRrZ01DNDFOVEUxTWpSRE1DNDNORFEyT1RnZ01DNDFNell5TlRjZ01DNDNNemt5TlRNZ01DNDFNVGd6TURjZ01DNDNNemt5TlRNZ01DNDBPVGs1TkRWRE1DNDNNemt5TlRNZ01DNDBOelV6TWpJZ01DNDNORGt3TXpVZ01DNDBOVEUzTURnZ01DNDNOalkwTkRZZ01DNDBNelF5T1RkRE1DNDNPRE00TlRjZ01DNDBNVFk0T0RZZ01DNDRNRGMwTnpFZ01DNDBNRGN4TURRZ01DNDRNekl3T1RRZ01DNDBNRGN4TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNREF3TmpjZ01DNHdOelE1TlRFeVF6QXVOVEU0TkRNZ01DNHdOelE1TlRFeUlEQXVOVE0yTXpnZ01DNHdPREF6T1RZeUlEQXVOVFV4TmpRM0lEQXVNRGt3TlRrM04wTXdMalUyTmpreE5TQXdMakV3TURjNU9TQXdMalUzT0RneE5DQXdMakV4TlRJNU9TQXdMalU0TlRnME1TQXdMakV6TWpJMk0wTXdMalU1TWpnMk9DQXdMakUwT1RJeU9DQXdMalU1TkRjd055QXdMakUyTnpnNU5TQXdMalU1TVRFeU5TQXdMakU0TlRrd05FTXdMalU0TnpVME1pQXdMakl3TXpreE5DQXdMalUzT0RjZ01DNHlNakEwTlRZZ01DNDFOalUzTVRZZ01DNHlNek0wTkRGRE1DNDFOVEkzTXpJZ01DNHlORFkwTWpVZ01DNDFNell4T0RrZ01DNHlOVFV5TmpjZ01DNDFNVGd4T0NBd0xqSTFPRGcwT1VNd0xqVXdNREUzSURBdU1qWXlORE14SURBdU5EZ3hOVEF6SURBdU1qWXdOVGt6SURBdU5EWTBOVE01SURBdU1qVXpOVFkyUXpBdU5EUTNOVGMwSURBdU1qUTJOVE01SURBdU5ETXpNRGMxSURBdU1qTTBOak01SURBdU5ESXlPRGN6SURBdU1qRTVNemN5UXpBdU5ERXlOamN5SURBdU1qQTBNVEEwSURBdU5EQTNNakkzSURBdU1UZzJNVFUwSURBdU5EQTNNakkzSURBdU1UWTNOemt5UXpBdU5EQTNNakkzSURBdU1UUXpNVFk1SURBdU5ERTNNREE0SURBdU1URTVOVFUxSURBdU5ETTBOREU1SURBdU1UQXlNVFEwUXpBdU5EVXhPRE1nTUM0d09EUTNNekkySURBdU5EYzFORFExSURBdU1EYzBPVFV4TWlBd0xqVXdNREEyTnlBd0xqQTNORGsxTVRKV01DNHdOelE1TlRFeVdrMHdMalV3TURBMk55QXdMamN6T1RRNU4wTXdMalV4T0RReklEQXVOek01TkRrM0lEQXVOVE0yTXpnZ01DNDNORFE1TkRJZ01DNDFOVEUyTkRjZ01DNDNOVFV4TkRORE1DNDFOalk1TVRVZ01DNDNOalV6TkRVZ01DNDFOemc0TVRRZ01DNDNOems0TkRRZ01DNDFPRFU0TkRFZ01DNDNPVFk0TURsRE1DNDFPVEk0TmpnZ01DNDRNVE0zTnpNZ01DNDFPVFEzTURjZ01DNDRNekkwTkNBd0xqVTVNVEV5TlNBd0xqZzFNRFExUXpBdU5UZzNOVFF5SURBdU9EWTRORFU1SURBdU5UYzROeUF3TGpnNE5UQXdNaUF3TGpVMk5UY3hOaUF3TGpnNU56azROa013TGpVMU1qY3pNaUF3TGpreE1EazNJREF1TlRNMk1UZzVJREF1T1RFNU9ERXlJREF1TlRFNE1UZ2dNQzQ1TWpNek9UUkRNQzQxTURBeE55QXdMamt5TmprM055QXdMalE0TVRVd015QXdMamt5TlRFek9DQXdMalEyTkRVek9TQXdMamt4T0RFeE1VTXdMalEwTnpVM05DQXdMamt4TVRBNE5DQXdMalF6TXpBM05TQXdMamc1T1RFNE5TQXdMalF5TWpnM015QXdMamc0TXpreE4wTXdMalF4TWpZM01pQXdMamcyT0RZMUlEQXVOREEzTWpJM0lEQXVPRFV3TnlBd0xqUXdOekl5TnlBd0xqZ3pNak16TjBNd0xqUXdOekl5TnlBd0xqZ3dOemN4TlNBd0xqUXhOekF3T0NBd0xqYzROREVnTUM0ME16UTBNVGtnTUM0M05qWTJPRGxETUM0ME5URTRNeUF3TGpjME9USTNPQ0F3TGpRM05UUTBOU0F3TGpjek9UUTVOeUF3TGpVd01EQTJOeUF3TGpjek9UUTVOMW9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDROaUlnYUdWcFoyaDBQU0l3TGpnMklpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOams0TWpReUlEQXVNRGN3TURZNE5Da2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2Rhc2hlZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYxIiB5PSIzNjUuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNzQiIHZhbHVlPSJEb2NrZXIgRW52aXJvbm1lbnQiIHN0eWxlPSJpci5yZWY9NzI3NmE1ZTYtY2FlMC00ZmViLTgwMWItNWRlOGZhMGI5ZTVlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWRvY2tlci1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDVNVEUyTWpJZ01DNDBORE01TWpsRE1DNDVNRGswTkRrZ01DNDBOREl4TVRnZ01DNDRPRGs0T0RnZ01DNDBNamN5TmpZZ01DNDRORGM0TmpjZ01DNDBNamN5TmpaRE1DNDRNemNnTUM0ME1qY3lOallnTUM0NE1qVTNOeUF3TGpReU9ETTFNeUF3TGpneE5Ea3dNeUF3TGpRek1ERTJORU13TGpnd05qa3pOQ0F3TGpNM05EYzBNU0F3TGpjMk1Ea3lPU0F3TGpNME56a3pOU0F3TGpjMU9URXhPQ0F3TGpNME5qUTROa3d3TGpjME56ZzRPQ0F3TGpNek9UazJOa3d3TGpjME1EWTBNeUF3TGpNMU1EUTNNVU13TGpjek1UVTROeUF3TGpNMk5EVTVPQ0F3TGpjeU5EY3dOQ0F3TGpNNE1EVXpOeUF3TGpjeU1EY3lJREF1TXprMk9ETTRRekF1TnpFek1URXpJREF1TkRJNE16VXpJREF1TnpFM09ESXlJREF1TkRVNE1EVTNJREF1TnpNek56WWdNQzQwT0RNME1UUkRNQzQzTVRRMU5qSWdNQzQwT1RReU9ERWdNQzQyT0RNME1Ea2dNQzQwT1RZNE1UY2dNQzQyTnpZNE9EZ2dNQzQwT1RjeE56bElNQzR4TmpJMU1ERkRNQzR4TkRrd09UZ2dNQzQwT1RjeE56a2dNQzR4TXpneU16RWdNQzQxTURnd05EWWdNQzR4TXpneU16RWdNQzQxTWpFME5EbERNQzR4TXpjMU1EWWdNQzQxTmpZek5qY2dNQzR4TkRVeE1UUWdNQzQyTVRFeU9EWWdNQzR4TmpBMk9TQXdMalkxTXpZMk9FTXdMakUzT0RRMElEQXVOekF3TURNMUlEQXVNakEwT0RnMElEQXVOek0wTkRRNElEQXVNak00T1RNMUlEQXVOelUxTkRVNFF6QXVNamMzTXpNeklEQXVOemM1TURBMElEQXVNelF3TURBeElEQXVOemt5TkRBM0lEQXVOREV3TmpNNUlEQXVOemt5TkRBM1F6QXVORFF5TlRFMklEQXVOemt5TkRBM0lEQXVORGMwTXprMElEQXVOemc1TlRBNUlEQXVOVEExT1RBNUlEQXVOemd6TnpFelF6QXVOVFE1TnpRZ01DNDNOelUzTkRRZ01DNDFPVEUzTmpFZ01DNDNOakExTXlBd0xqWXpNRFV5TVNBd0xqY3pPRFF6TTBNd0xqWTJNak01T0NBd0xqY3hPVGsxT1NBd0xqWTVNVEF4TmlBd0xqWTVOalF4TXlBd0xqY3hOVEk0TmlBd0xqWTJPRGc0TWtNd0xqYzFOakl5SURBdU5qSXlPRGMzSURBdU56Z3dORGtnTUM0MU56RTBNemtnTUM0M09UZ3lOQ0F3TGpVeU5UYzVOa013TGpnd01EYzNOaUF3TGpVeU5UYzVOaUF3TGpnd01qazBPU0F3TGpVeU5UYzVOaUF3TGpnd05UUTROU0F3TGpVeU5UYzVOa013TGpnMU1EQTBNU0F3TGpVeU5UYzVOaUF3TGpnM056VTNNU0F3TGpVd09EQTBOaUF3TGpnNU1qYzROaUF3TGpRNU1qZ3pNa013TGprd01qa3lPU0F3TGpRNE16UXhOQ0F3TGpreE1EVXpOaUF3TGpRM01UZ3lNaUF3TGpreE5UazJPU0F3TGpRMU9EYzRNVXd3TGpreE9USXpJREF1TkRRNU16WXpUREF1T1RFeE5qSXlJREF1TkRRek9USTVXaUlnWm1sc2JEMGlJekF3T1RGRk1pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNakV3TWpZZ01DNDBPREl5TWpOSU1DNHlOemt3T0RaRE1DNHlPREl6TkRZZ01DNDBPREl5TWpNZ01DNHlPRFV5TkRRZ01DNDBOemsyT0RjZ01DNHlPRFV5TkRRZ01DNDBOell3TmpWV01DNDBNVFEwT0RORE1DNHlPRFV5TkRRZ01DNDBNVEV5TWpNZ01DNHlPREkzTURrZ01DNDBNRGd6TWpVZ01DNHlOemt3T0RZZ01DNDBNRGd6TWpWSU1DNHlNVEF5TmtNd0xqSXdOeUF3TGpRd09ETXlOU0F3TGpJd05ERXdNaUF3TGpReE1EZzJNU0F3TGpJd05ERXdNaUF3TGpReE5EUTRNMVl3TGpRM05qQTJOVU13TGpJd05EUTJOQ0F3TGpRM09UWTROeUF3TGpJd055QXdMalE0TWpJeU15QXdMakl4TURJMklEQXVORGd5TWpJeldpSWdabWxzYkQwaUl6QXdPVEZGTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16QTFNak1nTUM0ME9ESXlNak5JTUM0ek56UXdOVGRETUM0ek56Y3pNVGdnTUM0ME9ESXlNak1nTUM0ek9EQXlNVFVnTUM0ME56azJPRGNnTUM0ek9EQXlNVFVnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0ek9EQXlNVFVnTUM0ME1URXlNak1nTUM0ek56YzJPQ0F3TGpRd09ETXlOU0F3TGpNM05EQTFOeUF3TGpRd09ETXlOVWd3TGpNd05USXpRekF1TXpBeE9UY2dNQzQwTURnek1qVWdNQzR5T1Rrd056SWdNQzQwTVRBNE5qRWdNQzR5T1Rrd056SWdNQzQwTVRRME9ETldNQzQwTnpZd05qVkRNQzR5T1RrME16VWdNQzQwTnprMk9EY2dNQzR6TURFNU55QXdMalE0TWpJeU15QXdMak13TlRJeklEQXVORGd5TWpJeldpSWdabWxzYkQwaUl6QXdPVEZGTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EQXhPVEVnTUM0ME9ESXlNak5JTUM0ME56QTNNelpETUM0ME56TTVPVFlnTUM0ME9ESXlNak1nTUM0ME56WTRPVFFnTUM0ME56azJPRGNnTUM0ME56WTRPVFFnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0ME56WTRPVFFnTUM0ME1URXlNak1nTUM0ME56UXpOVGdnTUM0ME1EZ3pNalVnTUM0ME56QTNNellnTUM0ME1EZ3pNalZJTUM0ME1ERTVNVU13TGpNNU9EWTFJREF1TkRBNE16STFJREF1TXprMU56VXlJREF1TkRFd09EWXhJREF1TXprMU56VXlJREF1TkRFME5EZ3pWakF1TkRjMk1EWTFRekF1TXprMU56VXlJREF1TkRjNU5qZzNJREF1TXprNE1qZzRJREF1TkRneU1qSXpJREF1TkRBeE9URWdNQzQwT0RJeU1qTmFJaUJtYVd4c1BTSWpNREE1TVVVeUlpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPVGN4TWpVZ01DNDBPREl5TWpOSU1DNDFOalU1TlVNd0xqVTJPVEl4SURBdU5EZ3lNakl6SURBdU5UY3lNVEE0SURBdU5EYzVOamczSURBdU5UY3lNVEE0SURBdU5EYzJNRFkxVmpBdU5ERTBORGd6UXpBdU5UY3lNVEE0SURBdU5ERXhNakl6SURBdU5UWTVOVGN5SURBdU5EQTRNekkxSURBdU5UWTFPVFVnTUM0ME1EZ3pNalZJTUM0ME9UY3hNalZETUM0ME9UTTROalVnTUM0ME1EZ3pNalVnTUM0ME9UQTVOamNnTUM0ME1UQTROakVnTUM0ME9UQTVOamNnTUM0ME1UUTBPRE5XTUM0ME56WXdOalZETUM0ME9UQTVOamNnTUM0ME56azJPRGNnTUM0ME9UTTROalVnTUM0ME9ESXlNak1nTUM0ME9UY3hNalVnTUM0ME9ESXlNak5hSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TURVeU15QXdMak01TkRNek1rZ3dMak0zTkRBMU4wTXdMak0zTnpNeE9DQXdMak01TkRNek1pQXdMak00TURJeE5TQXdMak01TVRRek5DQXdMak00TURJeE5TQXdMak00T0RFM05GWXdMak15TmpVNU0wTXdMak00TURJeE5TQXdMak15TXpNek15QXdMak0zTnpZNElEQXVNekl3TkRNMUlEQXVNemMwTURVM0lEQXVNekl3TkRNMVNEQXVNekExTWpORE1DNHpNREU1TnlBd0xqTXlNRFF6TlNBd0xqSTVPVEEzTWlBd0xqTXlNamszSURBdU1qazVNRGN5SURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU1qazVORE0xSURBdU16a3hORE0wSURBdU16QXhPVGNnTUM0ek9UUXpNeklnTUM0ek1EVXlNeUF3TGpNNU5ETXpNbG9pSUdacGJHdzlJaU13TURreFJUSWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF3TVRreElEQXVNemswTXpNeVNEQXVORGN3TnpNMlF6QXVORGN6T1RrMklEQXVNemswTXpNeUlEQXVORGMyT0RrMElEQXVNemt4TkRNMElEQXVORGMyT0RrMElEQXVNemc0TVRjMFZqQXVNekkyTlRrelF6QXVORGMyT0RrMElEQXVNekl6TXpNeklEQXVORGMwTXpVNElEQXVNekl3TkRNMUlEQXVORGN3TnpNMklEQXVNekl3TkRNMVNEQXVOREF4T1RGRE1DNHpPVGcyTlNBd0xqTXlNRFF6TlNBd0xqTTVOVGMxTWlBd0xqTXlNamszSURBdU16azFOelV5SURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU16azFOelV5SURBdU16a3hORE0wSURBdU16azRNamc0SURBdU16azBNek15SURBdU5EQXhPVEVnTUM0ek9UUXpNekphSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RjeE1qVWdNQzR6T1RRek16SklNQzQxTmpVNU5VTXdMalUyT1RJeElEQXVNemswTXpNeUlEQXVOVGN5TVRBNElEQXVNemt4TkRNMElEQXVOVGN5TVRBNElEQXVNemc0TVRjMFZqQXVNekkyTlRrelF6QXVOVGN5TVRBNElEQXVNekl6TXpNeklEQXVOVFk1TWpFZ01DNHpNakEwTXpVZ01DNDFOalU1TlNBd0xqTXlNRFF6TlVnd0xqUTVOekV5TlVNd0xqUTVNemcyTlNBd0xqTXlNRFF6TlNBd0xqUTVNRGsyTnlBd0xqTXlNamszSURBdU5Ea3dPVFkzSURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU5Ea3dPVFkzSURBdU16a3hORE0wSURBdU5Ea3pPRFkxSURBdU16azBNek15SURBdU5EazNNVEkxSURBdU16azBNek15V2lJZ1ptbHNiRDBpSXpBd09URkZNaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrM01USTFJREF1TXpBMU9ETXhTREF1TlRZMU9UVkRNQzQxTmpreU1TQXdMak13TlRnek1TQXdMalUzTWpFd09DQXdMak13TXpJNU5TQXdMalUzTWpFd09DQXdMakk1T1RZM00xWXdMakl6T0RBNU1rTXdMalUzTWpFd09DQXdMakl6TkRnek1pQXdMalUyT1RJeElEQXVNak14T1RNMElEQXVOVFkxT1RVZ01DNHlNekU1TXpSSU1DNDBPVGN4TWpWRE1DNDBPVE00TmpVZ01DNHlNekU1TXpRZ01DNDBPVEE1TmpjZ01DNHlNelEwTmprZ01DNDBPVEE1TmpjZ01DNHlNemd3T1RKV01DNHlPVGsyTnpORE1DNDBPVEE1TmpjZ01DNHpNREk1TXpNZ01DNDBPVE00TmpVZ01DNHpNRFU0TXpFZ01DNDBPVGN4TWpVZ01DNHpNRFU0TXpGYUlpQm1hV3hzUFNJak1EQTVNVVV5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU9UTXdOeklnTUM0ME9ESXlNak5JTUM0Mk5qRTRPVGxETUM0Mk5qVXhOVGtnTUM0ME9ESXlNak1nTUM0Mk5qZ3dOVGNnTUM0ME56azJPRGNnTUM0Mk5qZ3dOVGNnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0Mk5qZ3dOVGNnTUM0ME1URXlNak1nTUM0Mk5qVTFNaklnTUM0ME1EZ3pNalVnTUM0Mk5qRTRPVGtnTUM0ME1EZ3pNalZJTUM0MU9UTXdOekpETUM0MU9EazRNVElnTUM0ME1EZ3pNalVnTUM0MU9EWTVNVFFnTUM0ME1UQTROakVnTUM0MU9EWTVNVFFnTUM0ME1UUTBPRE5XTUM0ME56WXdOalZETUM0MU9EY3lOellnTUM0ME56azJPRGNnTUM0MU9EazRNVElnTUM0ME9ESXlNak1nTUM0MU9UTXdOeklnTUM0ME9ESXlNak5hSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjU0IiB5PSI1NTAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iS3ViZXJuZXRlcyZhbXA7bmJzcDsiIGlyLnNvdXJjZVN0eWxlPSJncm91cDtmb250Q29sb3I9IzhDOEM4QztmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jMDAwMDAwO2NvbnRhaW5lcj0wO3JlY3Vyc2l2ZVJlc2l6ZT0xO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtzdHJva2VXaWR0aD0xO2ZvbnRTaXplPTEzO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7ZGFzaGVkPTE7IiBpZD0iMTU4Ij48bXhDZWxsIHN0eWxlPSJncm91cDtmb250Q29sb3I9IzhDOEM4QztmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jMjBDOUUzO2NvbnRhaW5lcj0xO3JlY3Vyc2l2ZVJlc2l6ZT0wO3ZlcnRpY2FsQWxpZ249dG9wO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtzdHJva2VXaWR0aD0xO2ZvbnRTaXplPTEzO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjI1MCIgdmVydGV4PSIxIiBjb25uZWN0YWJsZT0iMCI+PG14R2VvbWV0cnkgeD0iNzQiIHk9IjUzNCIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyMTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjE0NiIgdmFsdWU9Ikt1YmVybmV0ZXMgQ2x1c3RlciIgc3R5bGU9ImlyLnJlZj03MWNkNTQwNC1lMmVmLTRjNTktYjhjOS04YWQxYTIxOTU0MGY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9a3ViZXJuZXRlcy1jbHVzdGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGsyTnpFeElEQXVNREE0TVRReU1qZERNQzQwT0RneE1UVWdNQzR3TURnMU9EZ3hOaUF3TGpRM09UWTVNeUF3TGpBeE1EYzRNamdnTUM0ME56RTVNemtnTUM0d01UUTFPVGMwVERBdU1UTXpPVEE1SURBdU1UZ3dPVEUyUXpBdU1USTFNVFlnTUM0eE9EVXlNVGdnTUM0eE1UYzBOek1nTUM0eE9URTBOemtnTUM0eE1URTBNVGdnTUM0eE9Ua3lNekpETUM0eE1EVXpOak1nTUM0eU1EWTVPRFVnTUM0eE1ERXdPVFlnTUM0eU1UWXdNeklnTUM0d09UZzVNelEwSURBdU1qSTFOekF4VERBdU1ERTFOVFFnTUM0MU9Ua3lPVFJETUM0d01UTTJNVFF6SURBdU5qQTNPVEF5SURBdU1ERXpNems0T0NBd0xqWXhOamd4TmlBd0xqQXhORGt3TmpJZ01DNDJNalUxTVRGRE1DNHdNVFkwTVRNM0lEQXVOak0wTWpBMUlEQXVNREU1TmpFek5DQXdMalkwTWpVd01pQXdMakF5TkRNeE5qRWdNQzQyTkRrNU1URkRNQzR3TWpVME5UWTBJREF1TmpVeE56SXlJREF1TURJMk5qZ3lPQ0F3TGpZMU16UTNOU0F3TGpBeU56azVNRGdnTUM0Mk5UVXhOalJNTUM0eU5qRTVOaklnTUM0NU5UUTNNalJETUM0eU5qZ3dNVGdnTUM0NU5qSTBOellnTUM0eU56VTNNRFlnTUM0NU5qZzNNelFnTUM0eU9EUTBOVFlnTUM0NU56TXdNelJETUM0eU9UTXlNRFVnTUM0NU56Y3pNelVnTUM0ek1ESTNPU0F3TGprM09UVTJOeUF3TGpNeE1qVWdNQzQ1TnprMU5qVk1NQzQyT0RjM01TQXdMamszT1RRM05rTXdMalk1TnpReE5pQXdMamszT1RRNE15QXdMamN3TmprNU9TQXdMamszTnpJMU9DQXdMamN4TlRjME9DQXdMamszTWprMk5rTXdMamN5TkRRNU55QXdMamsyT0RZM015QXdMamN6TWpFNE55QXdMamsyTWpReU15QXdMamN6T0RJME9DQXdMamsxTkRZNFREQXVPVGN5TVRNeUlEQXVOalUxTURjMVF6QXVPVGM0TVRreUlEQXVOalEzTXpJZ01DNDVPREkwTmpJZ01DNDJNemd5TnlBd0xqazRORFl5TlNBd0xqWXlPRFU1TjBNd0xqazROamM0T0NBd0xqWXhPRGt5TkNBd0xqazROamM0T0NBd0xqWXdPRGczT0NBd0xqazRORFl5TmlBd0xqVTVPVEl3TlV3d0xqa3dNVEV3TWlBd0xqSXlOVFl4TWtNd0xqZzVPRGswTVNBd0xqSXhOVGswTXlBd0xqZzVORFkzTkNBd0xqSXdOamc1TmlBd0xqZzRPRFl4T1NBd0xqRTVPVEUwTTBNd0xqZzRNalUyTkNBd0xqRTVNVE01SURBdU9EYzBPRGMzSURBdU1UZzFNVEk1SURBdU9EWTJNVEk0SURBdU1UZ3dPREkzVERBdU5USTRNRFUwSURBdU1ERTBOVGszTkVNd0xqVXhPRE13TVNBd0xqQXdPVGM1T0RreElEQXVOVEEzTlRJeklEQXVNREEzTlRjNU16SWdNQzQwT1RZM01URWdNQzR3TURneE5ESXlOMVl3TGpBd09ERTBNakkzV2lJZ1ptbHNiRDBpSXpNeU5rTkZOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrNU9UUTFJREF1TVRNMU1qVTBRekF1TkRnNE56Y3hJREF1TVRNMU1qVTFJREF1TkRjNU56RXhJREF1TVRRMU5qRTVJREF1TkRjNU56RXlJREF1TVRVNE5EQXpRekF1TkRjNU56RXlJREF1TVRVNE5UazVJREF1TkRjNU56VXhJREF1TVRVNE56ZzNJREF1TkRjNU56VTFJREF1TVRVNE9UZ3lRekF1TkRjNU56TTVJREF1TVRZd056RTVJREF1TkRjNU5qVTNJREF1TVRZeU9ERXlJREF1TkRjNU56RXlJREF1TVRZME16STBRekF1TkRjNU9UYzVJREF1TVRjeE5qazRJREF1TkRneE5UUWdNQzR4Tnpjek5ERWdNQzQwT0RJME56a2dNQzR4T0RReE16UkRNQzQwT0RReE9ERWdNQzR4T1RnMk56VWdNQzQwT0RVMk1EY2dNQzR5TVRBM01qY2dNQzQwT0RRM01qY2dNQzR5TWpFNU0wTXdMalE0TXpnM01TQXdMakl5TmpFMU5DQXdMalE0TURnMUlEQXVNak13TURFNElEQXVORGM0TVRVMklEQXVNak15TnpBelREQXVORGMzTmpnZ01DNHlOREUxTVRoRE1DNDBOalUxTXpnZ01DNHlOREkxTlRRZ01DNDBOVE16TVRVZ01DNHlORFEwTlRFZ01DNDBOREV4TURZZ01DNHlORGN6TURWRE1DNHpPRGcxTnpFZ01DNHlOVGsxT0RnZ01DNHpORE16TkNBd0xqSTROelExTkNBd0xqTXdPRGt3TXlBd0xqTXlOVEEzT0VNd0xqTXdOalkyT0NBd0xqTXlNelV3T0NBd0xqTXdNamMxT1NBd0xqTXlNRFl5SURBdU16QXhOVGszSURBdU16RTVOek0yUXpBdU1qazNPVGcwSURBdU16SXdNak00SURBdU1qazBNek16SURBdU16SXhNemcySURBdU1qZzVOVGM0SURBdU16RTROVE0wUXpBdU1qZ3dOVEkwSURBdU16RXlNalU0SURBdU1qY3lNamMzSURBdU16QXpOVGswSURBdU1qWXlNams1SURBdU1qa3pNVFU1UXpBdU1qVTNOekkzSURBdU1qZzRNVFkzSURBdU1qVTBOREUySURBdU1qZ3pOREV6SURBdU1qUTRPVGd6SURBdU1qYzROakF4UXpBdU1qUTNOelVnTUM0eU56YzFNRGdnTUM0eU5EVTROamNnTUM0eU56WXdNekVnTUM0eU5EUTBPRGNnTUM0eU56UTVNRFpETUM0eU5EQXlOQ0F3TGpJM01UUXlJREF1TWpNMU1qTXhJREF1TWpZNU5qQXhJREF1TWpNd016azBJREF1TWpZNU5ETXhRekF1TWpJME1UYzBJREF1TWpZNU1qRXhJREF1TWpFNE1UZzJJREF1TWpjeE56RTFJREF1TWpFME1qWTRJREF1TWpjMk56YzJRekF1TWpBM016QXlJREF1TWpnMU56Y3pJREF1TWpBNU5UTXpJREF1TWprNU5USTBJREF1TWpFNU1qUWdNQzR6TURjME9UTkRNQzR5TVRrek16Z2dNQzR6TURjMU56UWdNQzR5TVRrME5ETWdNQzR6TURjMk16Y2dNQzR5TVRrMU5ESWdNQzR6TURjM01UWkRNQzR5TWpBNE56WWdNQzR6TURnNE1qa2dNQzR5TWpJMU1TQXdMak14TURJMU5pQXdMakl5TXpjek5pQXdMak14TVRFNE9FTXdMakl5T1RVd01TQXdMak14TlRVM01TQXdMakl6TkRjMk5pQXdMak14TnpneE5TQXdMakkwTURVeElEQXVNekl4TWprMFF6QXVNalV5TmpFeElEQXVNekk0T1RnNUlEQXVNall5TmpReUlEQXVNek0xTXpjZ01DNHlOekExT1RrZ01DNHpORE13TmpORE1DNHlOek0zTURjZ01DNHpORFkwTnpRZ01DNHlOelF5TlNBd0xqTTFNalE0TkNBd0xqSTNORFkyTXlBd0xqTTFOVEE0TTB3d0xqSTRNVEUwT0NBd0xqTTJNVEEwT0VNd0xqSTBOalF6TXlBd0xqUXhORGcwTlNBd0xqSXpNRE0yTnlBd0xqUTRNVEk1TlNBd0xqSXpPVGcyTWlBd0xqVTBPVEF3TWt3d0xqSXpNVE00T0NBd0xqVTFNVFUwUXpBdU1qSTVNVFUxSURBdU5UVTBOVEVnTUM0eU1qVTVPVGtnTUM0MU5Ua3hPRElnTUM0eU1qSTJPVGdnTUM0MU5qQTFOemRETUM0eU1USXlPRGdnTUM0MU5qTTVOVFFnTUM0eU1EQTFOeklnTUM0MU5qVXhPVE1nTUM0eE9EWTBNamNnTUM0MU5qWTNNa013TGpFM09UYzROaUF3TGpVMk56STRPU0F3TGpFM05EQTFOaUF3TGpVMk5qazFJREF1TVRZM01ERTJJREF1TlRZNE16SXpRekF1TVRZMU5EWTJJREF1TlRZNE5qSTFJREF1TVRZek16QTNJREF1TlRZNU1qQTFJREF1TVRZeE5qRXlJREF1TlRZNU5qRTBRekF1TVRZeE5UVXpJREF1TlRZNU5qSTNJREF1TVRZeE5EazRJREF1TlRZNU5qUTFJREF1TVRZeE5ETTVJREF1TlRZNU5qVTVRekF1TVRZeE16UTJJREF1TlRZNU5qZ3hJREF1TVRZeE1qSTFJREF1TlRZNU56STNJREF1TVRZeE1UTTJJREF1TlRZNU56UTRRekF1TVRRNU1qRXhJREF1TlRjeU56RTFJREF1TVRReE5UVWdNQzQxT0RRd01ESWdNQzR4TkRRd01UWWdNQzQxT1RVeE1qTkRNQzR4TkRZME9ETWdNQzQyTURZeU5EWWdNQzR4TlRneE16SWdNQzQyTVRNd01URWdNQzR4TnpBeE1qZ2dNQzQyTVRBek5EaERNQzR4TnpBeU1UVWdNQzQyTVRBek1qY2dNQzR4TnpBek5ERWdNQzQyTVRBek1qUWdNQzR4TnpBME16RWdNQzQyTVRBek1ETkRNQzR4TnpBMU5qWWdNQzQyTVRBeU56RWdNQzR4TnpBMk9EWWdNQzQyTVRBeU1EUWdNQzR4TnpBNE1pQXdMall4TURFM1F6QXVNVGN5TkRreUlEQXVOakE1TnpreUlEQXVNVGMwTlRnNElEQXVOakE1TXpjeElEQXVNVGMyTURVeElEQXVOakE0T1RZNFF6QXVNVGd5T1RjeklEQXVOakEzTURZZ01DNHhPRGM1T0RZZ01DNDJNRFF5TlRVZ01DNHhPVFF5TURrZ01DNDJNREU0TURGRE1DNHlNRGMxT1RZZ01DNDFPVFk0TlRZZ01DNHlNVGcyT0RRZ01DNDFPVEkzTWpZZ01DNHlNamswT0RZZ01DNDFPVEV4TVRaRE1DNHlNek01T1RjZ01DNDFPVEEzTlRJZ01DNHlNemczTlRFZ01DNDFPVE01T0RNZ01DNHlOREV4TVRVZ01DNDFPVFV6TkRWTU1DNHlORGs1TXpVZ01DNDFPVE0zT0RkRE1DNHlOekF5TXlBd0xqWTFPRFU0TVNBd0xqTXhNamMyTVNBd0xqY3hNRGsxTVNBd0xqTTJOall4TnlBd0xqYzBNemd4TWt3d0xqTTJNamswTXlBd0xqYzFNamc1TkVNd0xqTTJOREkyTnlBd0xqYzFOalF5SURBdU16WTFOekk0SURBdU56WXhNVGt5SURBdU16WTBOelF5SURBdU56WTBOamMwUXpBdU16WXdPREUwSURBdU56YzFNVFl4SURBdU16VTBNRGc0SURBdU56ZzJNakk1SURBdU16UTJOREk0SURBdU56azROVFk1UXpBdU16UXlOekU1SURBdU9EQTBNamNnTUM0ek16ZzVNalFnTUM0NE1EZzJPVFVnTUM0ek16VTFOemNnTUM0NE1UVXlNVGxETUM0ek16UTNOellnTUM0NE1UWTNPQ0F3TGpNek16YzFOaUF3TGpneE9URTNPQ0F3TGpNek1qazRNeUF3TGpneU1EZ3lPRU13TGpNeU56YzRNeUF3TGpnek1qSTROU0F3TGpNek1UVTVOeUF3TGpnME5UUTRNU0F3TGpNME1UVTROaUF3TGpnMU1EUXpNa013TGpNMU1UWXpPQ0F3TGpnMU5UUXhOU0F3TGpNMk5ERXhOQ0F3TGpnMU1ERTJJREF1TXpZNU5URTBJREF1T0RNNE5qaERNQzR6TmprMU1qSWdNQzQ0TXpnMk5qUWdNQzR6TmprMU5TQXdMamd6T0RZMU1TQXdMak0yT1RVMU55QXdMamd6T0RZek5VTXdMak0yT1RVMk15QXdMamd6T0RZeU1pQXdMak0yT1RVMU1pQXdMamd6T0RZd015QXdMak0yT1RVMU55QXdMamd6T0RVNU1VTXdMak0zTURNeU5pQXdMamd6TmprMk15QXdMak0zTVRReE5pQXdMamd6TkRneU5DQXdMak0zTWpBMk5TQXdMamd6TXpJNU0wTXdMak0zTkRrek1TQXdMamd5TmpVek1TQXdMak0zTlRnNE5TQXdMamd5TURjek5pQXdMak0zTnprd01TQXdMamd4TkRFNU5VTXdMak00TXpJMU5DQXdMamd3TURNME9DQXdMak00TmpFNU5TQXdMamM0TlRneE9TQXdMak01TXpVMk5TQXdMamMzTmpjMk5rTXdMak01TlRVNE15QXdMamMzTkRJNE55QXdMak01T0RnM015QXdMamMzTXpNek15QXdMalF3TWpJNE5DQXdMamMzTWpNNU0wd3dMalF3TmpnMk5pQXdMamMyTXpnME5VTXdMalExTXpneE55QXdMamM0TWpRd015QXdMalV3TmpNM01TQXdMamM0TnpNNE15QXdMalUxT0RnM0lEQXVOemMxTVRBNFF6QXVOVGN3T0RRMklEQXVOemN5TXpBNElEQXVOVGd5TkRBNElEQXVOelk0TmpnMElEQXVOVGt6TlRnMUlEQXVOelkwTXpNMVF6QXVOVGswT0RjeklEQXVOelkyTmpnNElEQXVOVGszTWpZMklEQXVOemN4TWpFZ01DNDFPVGM1TURnZ01DNDNOekl6TkRoRE1DNDJNREV6TnpRZ01DNDNOek0xTVNBd0xqWXdOVEUxT0NBd0xqYzNOREV3T1NBd0xqWXdPREkwTVNBd0xqYzNPRGd3TTBNd0xqWXhNemMxTkNBd0xqYzRPRFV3TXlBd0xqWXhOelV5TlNBd0xqYzVPVGszT0NBd0xqWXlNakV4T0NBd0xqZ3hNemd6T1VNd0xqWXlOREV6TkNBd0xqZ3lNRE0zT1NBd0xqWXlOVEV6TVNBd0xqZ3lOakUzTlNBd0xqWXlOems1T0NBd0xqZ3pNamt6TjBNd0xqWXlPRFkxTVNBd0xqZ3pORFEzT0NBd0xqWXlPVGN6TlNBd0xqZ3pOalkwT0NBd0xqWXpNRFV3TlNBd0xqZ3pPREkzT1VNd0xqWXpOVGc1TXlBd0xqZzBPVGM1TnlBd0xqWTBPRFF3T1NBd0xqZzFOVEEzSURBdU5qVTRORGMySURBdU9EVXdNRGMyUXpBdU5qWTRORFkwSURBdU9EUTFNVEl5SURBdU5qY3lNamd5SURBdU9ETXhPVEk0SURBdU5qWTNNRGM1SURBdU9ESXdORGN5UXpBdU5qWTJNekEySURBdU9ERTRPREl5SURBdU5qWTFNalF6SURBdU9ERTJOREkwSURBdU5qWTBORFF5SURBdU9ERTBPRFl6UXpBdU5qWXhNRGsxSURBdU9EQTRNek01SURBdU5qVTNNeUF3TGpnd016azFPQ0F3TGpZMU16VTVNU0F3TGpjNU9ESTFPRU13TGpZME5Ua3pNU0F3TGpjNE5Ua3hPQ0F3TGpZek9UVTNOeUF3TGpjM05UWTJOeUF3TGpZek5UWTFJREF1TnpZMU1UZ3hRekF1TmpNME1EQTNJREF1TnpVNU56Y3lJREF1TmpNMU9USTNJREF1TnpVMk5EQTVJREF1TmpNM01qQTJJREF1TnpVeU9EazBRekF1TmpNMk5EUWdNQzQzTlRFNU9TQXdMall6TkRnZ01DNDNORFk0T0RJZ01DNDJNek00TXpRZ01DNDNORFEwT0VNd0xqWTRPVGd3TXlBd0xqY3hNRFExSURBdU56TXhNRGcySURBdU5qVTJNVEkzSURBdU56VXdORGMwSURBdU5Ua3pNemczUXpBdU56VXpNRGt5SURBdU5Ua3pPREVnTUM0M05UYzJORElnTUM0MU9UUTJNemtnTUM0M05Ua3hNaUF3TGpVNU5EazBOVU13TGpjMk1qRTJNeUF3TGpVNU1qZzNPQ0F3TGpjMk5EazJNU0F3TGpVNU1ERTRNaUF3TGpjM01EUTBOeUF3TGpVNU1EWXlOME13TGpjNE1USTBPU0F3TGpVNU1qSXpOaUF3TGpjNU1qTXpOaUF3TGpVNU5qTTJOeUF3TGpnd05UY3lOQ0F3TGpZd01UTXhNVU13TGpneE1UazBOeUF3TGpZd016YzJOaUF3TGpneE5qazJJREF1TmpBMk5qRTFJREF1T0RJek9EZ3hJREF1TmpBNE5USXpRekF1T0RJMU16UTBJREF1TmpBNE9USTJJREF1T0RJM05EUWdNQzQyTURrek1ESWdNQzQ0TWpreE1USWdNQzQyTURrMk9FTXdMamd5T1RJME55QXdMall3T1RjeE5DQXdMamd5T1RNMk5pQXdMall3T1RjNE1pQXdMamd5T1RVd01pQXdMall3T1RneE5FTXdMamd5T1RVNU1pQXdMall3T1Rnek5TQXdMamd5T1RjeE9DQXdMall3T1Rnek9DQXdMamd5T1Rnd05DQXdMall3T1RnMU9FTXdMamcwTVRnd01pQXdMall4TWpVeE9DQXdMamcxTXpRMU1pQXdMall3TlRjMU55QXdMamcxTlRreE5pQXdMalU1TkRZek0wTXdMamcxT0RNNElEQXVOVGd6TlRFeUlEQXVPRFV3TnpJeUlEQXVOVGN5TWpJeUlEQXVPRE00TnprMklEQXVOVFk1TWpVNFF6QXVPRE0zTURZeUlEQXVOVFk0T0RVeUlEQXVPRE0wTmpBeUlEQXVOVFk0TVRZeUlEQXVPRE15T1RFM0lEQXVOVFkzT0RNelF6QXVPREkxT0RjMklEQXVOVFkyTkRZZ01DNDRNakF4TkRjZ01DNDFOalkzT1RrZ01DNDRNVE0xTURZZ01DNDFOall5TXpGRE1DNDNPVGt6TmpFZ01DNDFOalEzTURVZ01DNDNPRGMyTkRVZ01DNDFOak0wTmpNZ01DNDNOemN5TXpRZ01DNDFOakF3T0RkRE1DNDNOekk1T0RrZ01DNDFOVGd6T1RJZ01DNDNOams1TnlBd0xqVTFNekU1TVNBd0xqYzJPRFV3TVNBd0xqVTFNVEExVERBdU56WXdNek1nTUM0MU5EZzJNREpETUM0M05qUTFOamNnTUM0MU1UY3dOREVnTUM0M05qTTBNalFnTUM0ME9EUXhPVFVnTUM0M05UWXdPVFFnTUM0ME5URXpNME13TGpjME9EWTVOU0F3TGpReE9ERTJJREF1TnpNMU5qRTVJREF1TXpnM09ESXlJREF1TnpFNE1UYzVJREF1TXpZeE1Ea3pRekF1TnpJd01qYzFJREF1TXpVNU1UTXhJREF1TnpJME1qTXpJREF1TXpVMU5USXhJREF1TnpJMU16VTJJREF1TXpVME5EWkRNQzQzTWpVMk9EUWdNQzR6TlRBM01qRWdNQzQzTWpVME1ESWdNQzR6TkRZNE1ESWdNQzQzTWpreE5pQXdMak0wTWpZMk1rTXdMamN6TnpFeE55QXdMak16TkRrMk9TQXdMamMwTnpFME9TQXdMak15T0RVNE9TQXdMamMxT1RJMUlEQXVNekl3T0RrelF6QXVOelkwT1RreklEQXVNekUzTkRFMElEQXVOemN3TXpBeUlEQXVNekUxTVRjeElEQXVOemMyTURZM0lEQXVNekV3TnpnNFF6QXVOemMzTXpjZ01DNHpNRGszT1RZZ01DNDNOemt4TlNBd0xqTXdPREl5TnlBd0xqYzRNRFV5SURBdU16QTNNRGt6UXpBdU56a3dNakkxSURBdU1qazVNVElnTUM0M09USTBOVGtnTUM0eU9EVXpOeUF3TGpjNE5UUTVNU0F3TGpJM05qTTNOVU13TGpjM09EVXlNeUF3TGpJMk56TTRNU0F3TGpjMk5UQXlNU0F3TGpJMk5qVXpNeUF3TGpjMU5UTXhOU0F3TGpJM05EVXdOa013TGpjMU16a3pOQ0F3TGpJM05UWXpNaUF3TGpjMU1qQTJJREF1TWpjM01UQXlJREF1TnpVd09ERTVJREF1TWpjNE1qQXhRekF1TnpRMU16ZzNJREF1TWpnek1ERXpJREF1TnpReU1ETXpJREF1TWpnM056WTJJREF1TnpNM05EWXhJREF1TWpreU56VTRRekF1TnpJM05EZ3pJREF1TXpBek1UazBJREF1TnpFNU1qTTFJREF1TXpFeE9UQXhJREF1TnpFd01UZ3hJREF1TXpFNE1UYzRRekF1TnpBMk1qVTRJREF1TXpJd05UTWdNQzQzTURBMU1URWdNQzR6TVRrM01UWWdNQzQyT1RjNU1ETWdNQzR6TVRrMU5UaE1NQzQyT1RBeU1EZ2dNQzR6TWpVeU1URkRNQzQyTkRZek1qZ2dNQzR5TnpjNE1qa2dNQzQxT0RZMU9ETWdNQzR5TkRjMU16WWdNQzQxTWpJeU5USWdNQzR5TkRFMk5URkRNQzQxTWpJd056TWdNQzR5TXpnNE56VWdNQzQxTWpFNE16Y2dNQzR5TXpNNE5UY2dNQzQxTWpFM056Y2dNQzR5TXpJek5EZERNQzQxTVRreE5ETWdNQzR5TWprM05USWdNQzQxTVRVNU5qSWdNQzR5TWpjMU16Y2dNQzQxTVRVeE5qSWdNQzR5TWpFNU0wTXdMalV4TkRJNE1pQXdMakl4TURjeU55QXdMalV4TlRjMU1pQXdMakU1T0RZM05TQXdMalV4TnpRMU5DQXdMakU0TkRFek5FTXdMalV4T0RNNU15QXdMakUzTnpNME1TQXdMalV4T1RrMU5DQXdMakUzTVRZNU9DQXdMalV5TURJeU1TQXdMakUyTkRNeU5FTXdMalV5TURJNE1TQXdMakUyTWpZME9DQXdMalV5TURFNE5DQXdMakUyTURJeE5pQXdMalV5TURFM055QXdMakUxT0RRd00wTXdMalV5TURFM05pQXdMakUwTlRZeE9TQXdMalV4TVRFeE9TQXdMakV6TlRJMU15QXdMalE1T1RrME5TQXdMakV6TlRJMU5FZ3dMalE1T1RrME5WcE5NQzQwTnpRMk1URWdNQzR5T1RZNE5UUk1NQzQwTmpnMk1ESWdNQzQwTURZeE5EVk1NQzQwTmpneE5qa2dNQzQwTURZek5qZERNQzQwTmpjM05qWWdNQzQwTVRZeE5EVWdNQzQwTlRrNU5USWdNQzQwTWpNNU5USWdNQzQwTlRBek5UZ2dNQzQwTWpNNU5USkRNQzQwTkRZME1qZ2dNQzQwTWpNNU5USWdNQzQwTkRJNElEQXVOREl5TmpVeUlEQXVORE01T0RVeUlEQXVOREl3TkRNMVREQXVORE01TmpjNUlEQXVOREl3TlRJMFREQXVNelV5TmpVMElEQXVNelUyT1RrM1F6QXVNemM1TkNBd0xqTXlPVGt4TkNBd0xqUXhNell4TVNBd0xqTXdPVGtnTUM0ME5UTXdNemdnTUM0ek1EQTJPREpETUM0ME5qQXlOQ0F3TGpJNU9EazVPQ0F3TGpRMk56UXpPU0F3TGpJNU56YzBPU0F3TGpRM05EWXhNU0F3TGpJNU5qZzFORnBOTUM0MU1qVXpNaklnTUM0eU9UWTROVFJETUM0MU56RXpOVE1nTUM0ek1ESTJPRE1nTUM0Mk1UTTVNak1nTUM0ek1qUXhORGNnTUM0Mk5EWTFORFFnTUM0ek5UY3dOREpNTUM0MU5qQXdPQ0F3TGpReU1ERTJPRXd3TGpVMU9UYzNPQ0F3TGpReU1EQXpORU13TGpVMU1qRXdNeUF3TGpReU5UZ3dOaUF3TGpVME1USTVJREF1TkRJME16YzBJREF1TlRNMU16QTRJREF1TkRFMk5qVXhRekF1TlRNeU9EVTRJREF1TkRFek5EZzNJREF1TlRNeE5UY3lJREF1TkRBNU56WTNJREF1TlRNeE5ERTRJREF1TkRBMk1ERXhUREF1TlRNeE16TXhJREF1TkRBMU9UWTNUREF1TlRJMU16SXlJREF1TWprMk9EVTBXazB3TGpNeU1UQTVOQ0F3TGpNNU56Z3lUREF1TkRBd05UVTFJREF1TkRjeE1EQTNUREF1TkRBd05EWTRJREF1TkRjeE5EVXlRekF1TkRBM05qUWdNQzQwTnpjNE56TWdNQzQwTURnMk9UZ2dNQzQwT0Rrd01UUWdNQzQwTURJM01UWWdNQzQwT1RZM016aERNQzQwTURBeU5qWWdNQzQwT1RrNU1ESWdNQzR6T1RZNU9EWWdNQzQxTURJd01qVWdNQzR6T1RNME5qVWdNQzQxTURNd01UVk1NQzR6T1RNek56Z2dNQzQxTURNek56Sk1NQzR5T1RFMU1qUWdNQzQxTXpNMk5EUkRNQzR5T0RZek5DQXdMalE0TkRnek1TQXdMakk1TnpVeE1pQXdMalF6TnpNNElEQXVNekl4TURrMElEQXVNemszT0RKYVRUQXVOamM0TWpNeklEQXVNemszT0RZMFF6QXVOamt3TURNNUlEQXVOREUzTlRjZ01DNDJPVGc1T0NBd0xqUXpPVFUzT1NBd0xqY3dORE13TWlBd0xqUTJNelF6T1VNd0xqY3dPVFUySURBdU5EZzNNREV6SURBdU56RXdPRGdnTUM0MU1UQTFORFVnTUM0M01EZzNNVElnTUM0MU16TXlPRGRNTUM0Mk1EWXpNemtnTUM0MU1ESTVNalpNTUM0Mk1EWXlOVElnTUM0MU1ESTBPREZETUM0MU9UY3dPRFVnTUM0ME9UazVNREVnTUM0MU9URTBOVEVnTUM0ME9UQXlPVGtnTUM0MU9UTTFPRFVnTUM0ME9EQTJOamRETUM0MU9UUTBOVGtnTUM0ME56WTNNaklnTUM0MU9UWTBPVE1nTUM0ME56TXpPRFFnTUM0MU9Ua3lORGdnTUM0ME56QTVNVGhNTUM0MU9Ua3lNRFVnTUM0ME56QTJPVFZNTUM0Mk56Z3lNek1nTUM0ek9UYzROalJJTUM0Mk56Z3lNek5hVFRBdU5EZ3pOalEySURBdU5EYzJOall4U0RBdU5URTJNa3d3TGpVek5qUXpNeUF3TGpVd01qY3dORXd3TGpVeU9URTNJREF1TlRNMU1qQXlUREF1TkRrNU9UUTFJREF1TlRRNU5qZE1NQzQwTnpBMk16UWdNQzQxTXpVeE5UZE1NQzQwTmpNek56RWdNQzQxTURJMk5UbE1NQzQwT0RNMk5EWWdNQzQwTnpZMk5qRmFUVEF1TlRnNE1EQTRJREF1TlRZMU56ZzFRekF1TlRnNU16a3lJREF1TlRZMU56RTBJREF1TlRrd056WTVJREF1TlRZMU9EUXlJREF1TlRreU1URTFJREF1TlRZMk1EazNUREF1TlRreU1qZzRJREF1TlRZMU9EYzFUREF1TmprM05qUTBJREF1TlRnME1qRTJRekF1TmpneU1qSTFJREF1TmpJNE9ESTBJREF1TmpVeU56SXhJREF1TmpZM05EWTRJREF1TmpFek1qazVJREF1Tmprek16STVUREF1TlRjeU5EQXhJREF1TlRreE5qQTJUREF1TlRjeU5UTXhJREF1TlRreE5ESTRRekF1TlRZNE56YzBJREF1TlRneU5ETTVJREF1TlRjeU5UTTBJREF1TlRjeE9EazRJREF1TlRneE1UYzNJREF1TlRZM05qRXhRekF1TlRnek16a2dNQzQxTmpZMU1UTWdNQzQxT0RVM01ESWdNQzQxTmpVNU1EVWdNQzQxT0Rnd01EZ2dNQzQxTmpVM09EVklNQzQxT0Rnd01EaGFUVEF1TkRFeE1EWWdNQzQxTmpZeU16RkRNQzQwTVRreElEQXVOVFkyTXpRM0lEQXVOREkyTXpFeUlEQXVOVGN5TURreklEQXVOREk0TVRnZ01DNDFPREExTWpGRE1DNDBNamt3TlRRZ01DNDFPRFEwTmpZZ01DNDBNamcyTWprZ01DNDFPRGd6TnpZZ01DNDBNamN4T0RVZ01DNDFPVEU0TWpoTU1DNDBNamMwT0RnZ01DNDFPVEl5TWpsTU1DNHpPRGN3TWpNZ01DNDJPVEk1TWpoRE1DNHpORGt4T1NBd0xqWTJOemt5T1NBd0xqTXhPVEExTnlBd0xqWXpNRFE1T0NBd0xqTXdNamt6TnlBd0xqVTRORFUzTWt3d0xqUXdOek00TlNBd0xqVTJOak15VERBdU5EQTNOVFU0SURBdU5UWTJOVFF5UXpBdU5EQTROekkySURBdU5UWTJNekl4SURBdU5EQTVPVEV4SURBdU5UWTJNakUwSURBdU5ERXhNRFlnTUM0MU5qWXlNekZXTUM0MU5qWXlNekZhVFRBdU5EazVNamsySURBdU5qRXdNelE0UXpBdU5UQXlNRGszSURBdU5qRXdNalF5SURBdU5UQTBPVE01SURBdU5qRXdPRE0wSURBdU5UQTNOalFnTUM0Mk1USXhOek5ETUM0MU1URXhPREVnTUM0Mk1UTTVNamtnTUM0MU1UTTVNVFlnTUM0Mk1UWTJPVFFnTUM0MU1UVTJNemdnTUM0Mk1qQXdNRGhJTUM0MU1UWXdNamRNTUM0MU5qYzFNVFlnTUM0M01UVTRNVEZETUM0MU5qQTRNelFnTUM0M01UZ3hNVGNnTUM0MU5UTTVOalFnTUM0M01qQXdPRGtnTUM0MU5EWTVNemdnTUM0M01qRTNNekZETUM0MU1EYzFOVGtnTUM0M016QTVNemdnTUM0ME5qZ3pNRFlnTUM0M01qZ3hORGtnTUM0ME16STNOaklnTUM0M01UVTJOemRNTUM0ME9EUXhNaklnTUM0Mk1qQXdOVE5JTUM0ME9EUXlNRGhETUM0ME9EY3lPU0F3TGpZeE5ERXlJREF1TkRrek1UTTFJREF1TmpFd05UZ3hJREF1TkRrNU1qazJJREF1TmpFd016UTRXaUlnWm1sc2JEMGlkMmhwZEdVaUlITjBjbTlyWlQwaWQyaHBkR1VpSUhOMGNtOXJaUzEzYVdSMGFEMGlNQzR3TURJeE9EYzRNU0l2UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2Rhc2hlZD0xOyIgcGFyZW50PSIxNTgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTg1LjAwMDAwMDAwMDAwMDA2IiB5PSIxOCIgd2lkdGg9Ijg5LjMxIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJOYW1lc3BhY2U6IHByb2QmbHQ7YnI+TmFtZTogVVMtV2VzdDItcHJvZC1la3MtY2x1c3RlciIgaWQ9IjI3NiI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0zO2ZpbGxDb2xvcj0jRjVGNUY1O3NoYWRvdz0wOyIgcGFyZW50PSIxNTgiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNDciIHk9IjE1NSIgd2lkdGg9IjM1NSIgaGVpZ2h0PSI1MyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iQW1hem9uIFJEUyIgaWQ9IjI1NiI+PG14Q2VsbCBzdHlsZT0iZ3JvdXA7Zm9udENvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNkYmVhZjc7c3Ryb2tlQ29sb3I9IzIwQzlFMztjb250YWluZXI9MTtyZWN1cnNpdmVSZXNpemU9MDt2ZXJ0aWNhbEFsaWduPXRvcDtyb3VuZGVkPTE7YXJjU2l6ZT0zO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7c3Ryb2tlV2lkdGg9MTtmb250U2l6ZT0xMzt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgY29ubmVjdGFibGU9IjAiPjxteEdlb21ldHJ5IHg9IjE2MiIgeT0iNTMiIHdpZHRoPSI2NzkiIGhlaWdodD0iMjQyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxOTMiIHZhbHVlPSJNQU1JIChNeVNRTCkiIHN0eWxlPSJpci5yZWY9NTcxNzhhY2EtYmUzMS00YTE5LTg2MzMtODcxYjE3YjcxNWVmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW15c3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TkRBMk5EVWdNQzR5TkRnd056aERNQzQ0TkRBMk5EVWdNQzR6TkRBNE9UZ2dNQzQyT0RnME1TQXdMalF4TmpBM09DQXdMalV3TURZME5TQXdMalF4TmpBM09FTXdMak14TWpnNElEQXVOREUyTURjNElEQXVNVFl3TmpRMUlEQXVNelF3T0RrNElEQXVNVFl3TmpRMUlEQXVNalE0TURjNFF6QXVNVFl3TmpRMUlEQXVNVFUxTWpVNElEQXVNekV5T0RnZ01DNHdPREF3TnpneElEQXVOVEF3TmpRMUlEQXVNRGd3TURjNE1VTXdMalk0T0RReElEQXVNRGd3TURjNE1TQXdMamcwTURZME5TQXdMakUxTlRJMU9DQXdMamcwTURZME5TQXdMakkwT0RBM09GcE5NQzQ0TkRBMk5EVWdNQzR6TnpZek1EUkRNQzQ0TVRreE5qSWdNQzR6T1RRNU56a2dNQzQzT1RVeU5qY2dNQzQwTVRBM05UVWdNQzQzTmprMU9EVWdNQzQwTWpNeU1UaERNQzQyT1RjME1Ua2dNQzQwTlRnNE16UWdNQzQyTURJek1EUWdNQzQwTnprd056Z2dNQzQxTURBMk5EVWdNQzQwTnprd056aERNQzR6T1RnNU9EVWdNQzQwTnprd056Z2dNQzR6TURNNE5qa2dNQzQwTlRnNE16UWdNQzR5TXpFM01EVWdNQzQwTWpNeU1UaERNQzR5TURZd01qSWdNQzQwTVRBM05UVWdNQzR4T0RJeE1qY2dNQzR6T1RRNU56a2dNQzR4TmpBMk5EVWdNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TmpBMk5EVWdNQzQ0TkRRNE9UZ2dNQzR6TVRJNE9DQXdMamt5TURBM09DQXdMalV3TURZME5TQXdMamt5TURBM09FTXdMalk0T0RReElEQXVPVEl3TURjNElEQXVPRFF3TmpRMUlEQXVPRFEwT0RrNElEQXVPRFF3TmpRMUlEQXVOelV5TURjNFZqQXVNemMyTXpBMFdrMHdMall5T0RVMk5DQXdMamM0TkRVNU1VTXdMalkwTURZM05pQXdMamMzT1RRNE5TQXdMalkxTkRnMElEQXVOemMzTnpVNElEQXVOamN6TXpnNUlEQXVOemM0TWpZMFF6QXVOamN5T1RReUlEQXVOemMwTlRRMklEQXVOalkxT0RReUlEQXVOemN3TWpBM0lEQXVOall3T1RZM0lEQXVOelkzTWpJNFF6QXVOalU1TlRreklEQXVOelkyTXpnNElEQXVOalU0TXprMUlEQXVOelkxTmpVMklEQXVOalUzTlRjeklEQXVOelkxTURjM1F6QXVOalUyTURNM0lEQXVOell6T1RrMUlEQXVOalUwTkRreElEQXVOell5T0RrMElEQXVOalV5T1RNMUlEQXVOell4TnpnMVF6QXVOalEyT1RBeElEQXVOelUzTkRnNElEQXVOalF3TnpFeUlEQXVOelV6TURneElEQXVOak0wTXpZM0lEQXVOelE1TWpVeVF6QXVOak14TmpjeElEQXVOelEzTmpNZ01DNDJNamMzTURjZ01DNDNORFl5TkRRZ01DNDJNalF3TkRrZ01DNDNORFE1TmpaRE1DNDJNakl3TXpRZ01DNDNORFF5TmpJZ01DNDJNakF4TVRFZ01DNDNORE0xT0RrZ01DNDJNVGcxTkRVZ01DNDNOREk1TWpoRE1DNDJNVFkxT1RjZ01DNDNOREl4TURRZ01DNDJNVE01TWpjZ01DNDNOREV5T1NBd0xqWXhNVEEyTVNBd0xqYzBNRFF4TlVNd0xqWXdORFkyTWlBd0xqY3pPRFEyTXlBd0xqVTVOekk0T1NBd0xqY3pOakl4TkNBd0xqVTVORGd4TWlBd0xqY3pNamt3TmtNd0xqVTRPRE0xTkNBd0xqY3lOREkzT0NBd0xqVTRNemM1TlNBd0xqY3hNemt4TWlBd0xqVTNPVEl6SURBdU56QXpOVE01VERBdU5UYzRORFl4SURBdU56QXhOemc1UXpBdU5UYzJNVFV5SURBdU5qazJOVFEzSURBdU5UY3pOVFVnTUM0Mk9URXhOelVnTUM0MU56QTVNekVnTUM0Mk9EVTNOME13TGpVMk9EQTJOeUF3TGpZM09UZzFOaUF3TGpVMk5URTRNeUF3TGpZM016a3dNaUF3TGpVMk1qWTBOQ0F3TGpZMk9EQXpOME13TGpVMk1UWTFNeUF3TGpZMk5UYzBOeUF3TGpVMk1EZzNJREF1TmpZek5UVXlJREF1TlRZd01UQXhJREF1TmpZeE16azJRekF1TlRVNE9UazVJREF1TmpVNE16RXhJREF1TlRVM09USTJJREF1TmpVMU16QTFJREF1TlRVMk16RTJJREF1TmpVeU1qRTJRekF1TlRNNU16RTJJREF1TmpFNU5qSXpJREF1TlRFME5EWXlJREF1TlRreU16QTBJREF1TkRnME1EWTJJREF1TlRjek1UQTVRekF1TkRjME1Ea3hJREF1TlRZMk9EQTVJREF1TkRZek1UQTBJREF1TlRZeE1ERXlJREF1TkRVd09EUTBJREF1TlRVM01qZzNRekF1TkRRM01UUWdNQzQxTlRZeE5qSWdNQzQwTkRNd05ETWdNQzQxTlRVNU56TWdNQzQwTXpnNE9Ua2dNQzQxTlRVM09ESkRNQzQwTXpVeU9ERWdNQzQxTlRVMk1UVWdNQzQwTXpFMk1qWWdNQzQxTlRVME5EY2dNQzQwTWpneE5qVWdNQzQxTlRRMk5USklNQzQwTWpNME1UbERNQzQwTWpBM05DQXdMalUxTXpnMk5TQXdMalF4T0RNME1pQXdMalUxTVRjMU5DQXdMalF4TmpBMU5pQXdMalUwT1RjME1rTXdMalF4TkRjNU5TQXdMalUwT0RZek1pQXdMalF4TXpVMk9DQXdMalUwTnpVMU1pQXdMalF4TWpNME5pQXdMalUwTmpjME1VTXdMalF3TlRFNE1TQXdMalUwTVRrNU5TQXdMak01T0RFeU1pQXdMalV6T0RZME9TQXdMak00T1RZMk5TQXdMalV6TlRFek5rTXdMak00TmpRNElEQXVOVE16T0RFMElEQXVNemMzT1RZeElEQXVOVE13TmpjeElEQXVNemMwT1RBeUlEQXVOVE16TURORE1DNHpOek14TVNBd0xqVXpNell5TWlBd0xqTTNNak13TlNBd0xqVXpORE0zT1NBd0xqTTNNVGN6TnlBd0xqVXpOakU1TWtNd0xqTTJPVGsxTXlBd0xqVXpPRGc0TWlBd0xqTTNNVFU0T1NBd0xqVTBNekEzTVNBd0xqTTNNamM1TkNBd0xqVTBOVFk0TjBNd0xqTTNOVEE1SURBdU5UVXdOamN4SURBdU16YzRNRGMzSURBdU5UVTBNek0ySURBdU16Z3hNVEl6SURBdU5UVTRNRGMwUXpBdU16Z3lOVGMxSURBdU5UVTVPRFUySURBdU16ZzBNRFFnTUM0MU5qRTJOVFFnTUM0ek9EVTBOU0F3TGpVMk16WXlRekF1TXpnMU9Ua3lJREF1TlRZME16Y3pJREF1TXpnMk5UVWdNQzQxTmpVeE5ERWdNQzR6T0RjeE1UWWdNQzQxTmpVNU1qRkRNQzR6T1RBMk9ESWdNQzQxTnpBNE1qY2dNQzR6T1RRMU9UZ2dNQzQxTnpZeU1UY2dNQzR6T1Rjd05UUWdNQzQxT0RFMU5VTXdMalF3TURFek15QXdMalU0T0RJME15QXdMalF3TWpNeU5pQXdMalU1TlRNeE9TQXdMalF3TkRVd09DQXdMall3TWpNMk1rTXdMalF3TmpVME1TQXdMall3T0RreU5TQXdMalF3T0RVMk5TQXdMall4TlRRMU9DQXdMalF4TVRJNE9TQXdMall5TVRZeU5rTXdMalF4TXpRMk5TQXdMall5TmpVMElEQXVOREUyTlRrMUlEQXVOak15TVRRZ01DNDBNVGszTXpNZ01DNDJNell6T1RSRE1DNDBNakEyTkRFZ01DNDJNemMyTWpnZ01DNDBNakU0TURVZ01DNDJNemczTlRRZ01DNDBNakk1T1NBd0xqWXpPVGc1T1VNd0xqUXlOVEV3T0NBd0xqWTBNVGswTnlBd0xqUXlOekk0TnlBd0xqWTBOREExTkNBd0xqUXlPREUyT0NBd0xqWTBOamswTTBNd0xqUXpNRFExTkNBd0xqWTFNRFV6TXlBd0xqUXlOalF6TkNBd0xqWTJNRGs1TVNBd0xqUXlNemc1T1NBd0xqWTJOelU0TlVNd0xqUXlNekkwTlNBd0xqWTJPVEk0TmlBd0xqUXlNalk1SURBdU5qY3dOek1nTUM0ME1qSXpOamdnTUM0Mk56RTNNekpETUM0ME1UWXlPVElnTUM0Mk9UQTJNVFlnTUM0ME1UYzFOellnTUM0M01UY3dNamNnTUM0ME1qUTBOemtnTUM0M016TTBNek5ETUM0ME1qUTJPRGdnTUM0M016TTVNeklnTUM0ME1qUTRPVGNnTUM0M016UTBNemNnTUM0ME1qVXhNRGdnTUM0M016UTVORFZETUM0ME1qYzJNelVnTUM0M05ERXdOU0F3TGpRek1ETTFOQ0F3TGpjME56WXhPQ0F3TGpRek56RXpOaUF3TGpjME9USTFNa013TGpRek56WTNPU0F3TGpjME9EZ3pNU0F3TGpRek56STJPQ0F3TGpjME9UQTFPQ0F3TGpRek9ERTVNaUF3TGpjME9EY3lPRU13TGpRek9EVXdOQ0F3TGpjME5qSXhNeUF3TGpRek9EYzNOU0F3TGpjME16Y3hOaUF3TGpRek9UQTBNaUF3TGpjME1USTFNVU13TGpRME1ERXhPU0F3TGpjek1UTXpNaUF3TGpRME1URTBNU0F3TGpjeU1Ua3lNeUF3TGpRME5EVXlJREF1TnpFek9USXlRekF1TkRRMk1UVTRJREF1TnpFd01EUWdNQzQwTkRnM01UZ2dNQzQzTURZNU1UZ2dNQzQwTlRFeU5ERWdNQzQzTURNNE5FTXdMalExTWpjM09TQXdMamN3TVRrMk5DQXdMalExTkRNd015QXdMamN3TURFd05DQXdMalExTlRVNU5pQXdMalk1T0RGRE1DNDBOVGN5TnpVZ01DNDJPVGt3TmpjZ01DNDBOVGM0TWpFZ01DNDNNREV5T0RNZ01DNDBOVGd6TmpFZ01DNDNNRE0wTnpoRE1DNDBOVGcyTWpVZ01DNDNNRFExTlRNZ01DNDBOVGc0T0RjZ01DNDNNRFUyTWpNZ01DNDBOVGt5T0RJZ01DNDNNRFkxTXpoRE1DNDBOVGszT1RjZ01DNDNNRGMzTXpRZ01DNDBOakF6TVRVZ01DNDNNRGc1TkRZZ01DNDBOakE0TXpjZ01DNDNNVEF4TmpsRE1DNDBOak0wTnpNZ01DNDNNVFl6TXpRZ01DNDBOall5TWpJZ01DNDNNakkzTmpVZ01DNDBOamt6TURjZ01DNDNNamcyT1VNd0xqUTNOekEwTlNBd0xqYzBNelUxTWlBd0xqUTROVFV6TnlBd0xqYzFOemd6TVNBd0xqUTVOVEUwT0NBd0xqYzNNRGczTjBNd0xqUTVPRFUxT1NBd0xqYzNOVFV4TWlBd0xqVXdNekUwT0NBd0xqYzRNRFUwTWlBd0xqVXdOekkzTlNBd0xqYzRORFU0T0VNd0xqVXdOemswTXlBd0xqYzROVEkwTkNBd0xqVXdPRFkzSURBdU56ZzFOemM1SURBdU5UQTVNemc1SURBdU56ZzJNekE0UXpBdU5URXdOVFUwSURBdU56ZzNNVFkySURBdU5URXhOeUF3TGpjNE9EQXdPU0F3TGpVeE1qVTBPQ0F3TGpjNE9UTXpNVWd3TGpVeE16QTNOVll3TGpjNE9UZzJNVU13TGpVd09EVXlNU0F3TGpjNE9ETXdOQ0F3TGpVd05URXhNaUF3TGpjNE5EYzVNeUF3TGpVd01UZ3dNaUF3TGpjNE1UTTRORU13TGpRNU9UazJOQ0F3TGpjM09UUTVJREF1TkRrNE1UVTJJREF1TnpjM05qSTRJREF1TkRrMk1pQXdMamMzTmpFMVF6QXVORGcxTmpNeElEQXVOelk0TVRjeUlEQXVORGN6TVRZMklEQXVOelUyTXpRM0lEQXVORFkyTVRNNUlEQXVOelExTURNeFREQXVORFUyTmpRMElEQXVOekkyTURRM1ZqQXVOekkxTlRFNVF6QXVORFUxT0RBMElEQXVOekkyTmpRZ01DNDBOVFUyTmpVZ01DNDNNamM0TXlBd0xqUTFOVFV3TXlBd0xqY3lPVEl5TkVNd0xqUTFOVFF3T1NBd0xqY3pNREF5TXlBd0xqUTFOVE13T0NBd0xqY3pNRGc0T1NBd0xqUTFOVEEyTXlBd0xqY3pNVGcwTjBNd0xqUTFOREl4TlNBd0xqY3pOVEUwTnlBd0xqUTFNemM1TmlBd0xqY3pPRFUzTWlBd0xqUTFNek01TWlBd0xqYzBNVGc0TWtNd0xqUTFNak0zTkNBd0xqYzFNREl4TkNBd0xqUTFNVFEwTmlBd0xqYzFOemd4TmlBd0xqUTBNems0TnlBd0xqYzJNRGcxTWtNd0xqUXpNakEzTkNBd0xqYzJOVGN4TWlBd0xqUXlNelF3TmlBd0xqYzFNekExSURBdU5ERTVOek1nTUM0M05EY3hOREZETUM0ME1EYzNOREVnTUM0M01qYzVNRGtnTUM0ME1EUTJNeUF3TGpZNU5UWXdOaUF3TGpReE1qZzNNeUF3TGpZMk9UWXhPVU13TGpReE16VXdPU0F3TGpZMk56WXhNaUF3TGpReE16azBOeUF3TGpZMk5UUTBOeUF3TGpReE5ETTROQ0F3TGpZMk16STROa013TGpReE5USXdNeUF3TGpZMU9USXpJREF1TkRFMk1ESWdNQzQyTlRVeE9EWWdNQzQwTVRneE5ETWdNQzQyTlRJeU1UTkRNQzQwTVRjM09UUWdNQzQyTkRrME9EZ2dNQzQwTVRZeU1ERWdNQzQyTkRnd05pQXdMalF4TkRZd01TQXdMalkwTmpZeU4wTXdMalF4TXpjNU9DQXdMalkwTlRrd09DQXdMalF4TWprNU5DQXdMalkwTlRFNE9DQXdMalF4TWpNME5pQXdMalkwTkRNd01rTXdMalF3T1RFM05pQXdMall6T1RrNE15QXdMalF3TmpReE15QXdMall6TkRnNU55QXdMalF3TXprd09DQXdMall6TURBMk5FTXdMalF3TURJM055QXdMall5TXpBM05pQXdMak01TnpVeE5DQXdMall4TlRFNElEQXVNemswTnpreklEQXVOakEzTXprNFF6QXVNemt6TnprM0lEQXVOakEwTlRVeElEQXVNemt5T0RBM0lEQXVOakF4TnpFNUlEQXVNemt4TnpneElEQXVOVGs0T1RVelF6QXVNemt4TURreklEQXVOVGszTVRBMElEQXVNemt3TmpRNElEQXVOVGsxTWprMklEQXVNemt3TWpBNElEQXVOVGt6TlRFMFF6QXVNemc1TmpVeElEQXVOVGt4TWpVMUlEQXVNemc1TVRBMElEQXVOVGc1TURNMklEQXVNemc0TURnMklEQXVOVGcyT0RKRE1DNHpPRFU1TURZZ01DNDFPREl3TmprZ01DNHpPREl6TmpRZ01DNDFOemN6TWprZ01DNHpOemt3TmpVZ01DNDFOekk1TVRKRE1DNHpOemd4TnpZZ01DNDFOekUzTWpJZ01DNHpOemN6TURVZ01DNDFOekExTlRZZ01DNHpOelkwT0RNZ01DNDFOamswTWtNd0xqTTNOVFU1TnlBd0xqVTJPREU1TWlBd0xqTTNORFExTkNBd0xqVTJOamM0TVNBd0xqTTNNekU0TnlBd0xqVTJOVEl4TlVNd0xqTTJOalUyTmlBd0xqVTFOekF6TnlBd0xqTTFOalV5TnlBd0xqVTBORFl6TnlBd0xqTTJNVGN5TVNBd0xqVXpNVGszTmtNd0xqTTNNVFV4TlNBd0xqVXdPREEzT0NBd0xqUXdOVFEwTmlBd0xqVXlOakkxTkNBd0xqUXhPRFkzTkNBd0xqVXpORFl4TVVNd0xqUXlNREEwTWlBd0xqVXpOVFEzTnlBd0xqUXlNVFEzTWlBd0xqVXpOamN5TWlBd0xqUXlNamt5TnlBd0xqVXpOems0T1VNd0xqUXlOVEF3TkNBd0xqVXpPVGM1T1NBd0xqUXlOekV6TlNBd0xqVTBNVFkxTkNBd0xqUXlPVEl4T1NBd0xqVTBNalV5TWt3d0xqUTBOall5SURBdU5UUXpOVGM1UXpBdU5EUTNPVE0zSURBdU5UUXpPRGt5SURBdU5EUTVNalExSURBdU5UUTBNVGsxSURBdU5EVXdOVFF6SURBdU5UUTBORGszUXpBdU5EVTVPRGs0SURBdU5UUTJOalk1SURBdU5EWTROamsySURBdU5UUTROekV4SURBdU5EYzJNVFU0SURBdU5UVXpNRGMwUXpBdU5URTJNRGcySURBdU5UYzJORE14SURBdU5UUXhPRFlnTUM0Mk1EQXhPVEVnTUM0MU5qVTRNRFlnTUM0Mk16azFOakZETUM0MU5qa3hOQ0F3TGpZME5UQTBOU0F3TGpVM01UUXhOQ0F3TGpZMU1EZzVNU0F3TGpVM016YzFJREF1TmpVMk9EazFRekF1TlRjME9UQTRJREF1TmpVNU9EYzJJREF1TlRjMk1EZ3lJREF1TmpZeU9EazFJREF1TlRjM05EQTVJREF1TmpZMU9USTVRekF1TlRnek1qYzBJREF1TmpjNU16UXpJREF1TlRnNU56YzBJREF1Tmprek1qWTFJREF1TlRrMk16azBJREF1TnpBMk1ERTBRekF1TlRrM05EQXlJREF1TnpBM09UVTBJREF1TlRrNE16RTFJREF1TnpBNU9UUTVJREF1TlRrNU1qSTBJREF1TnpFeE9UTTJRekF1TmpBeE1UWTJJREF1TnpFMk1UYzVJREF1TmpBek1Ea2dNQzQzTWpBek9EVWdNQzQyTURVNE9ETWdNQzQzTWpNNU5ERkRNQzQyTURjd01UZ2dNQzQzTWpVek9EY2dNQzQyTURrek9URWdNQzQzTWpZeE9ERWdNQzQyTVRFMk15QXdMamN5Tmprek1VTXdMall4TWpnd05pQXdMamN5TnpNeU5DQXdMall4TXprME5pQXdMamN5Tnpjd05pQXdMall4TkRnMUlEQXVOekk0TVRZelF6QXVOakUzT0RRMElEQXVOekk1TmpjMElEQXVOakl4TURJNElEQXVOek14TURRNUlEQXVOakkwTWpNeElEQXVOek15TkRNelF6QXVOakk1TXpjM0lEQXVOek0wTmpVMklEQXVOak0wTlRjeklEQXVOek0yT1RBeElEQXVOak01TVRFeElEQXVOek01TnpZelF6QXVOalV5TXpneElEQXVOelE0TVRReUlEQXVOalkxTWpZNElEQXVOelU0TVRnNElEQXVOamMzTURjNElEQXVOelk0TWpReVF6QXVOamM1TmpNeUlEQXVOemN3TkRFM0lEQXVOamd4TmpnMUlEQXVOemN6TVRZeklEQXVOamd6TnpNNElEQXVOemMxT1RBMlF6QXVOamcxTXpFeElEQXVOemM0TURBNUlEQXVOamcyT0RneklEQXVOemd3TVRFZ01DNDJPRGcyTnprZ01DNDNPREU1TlROV01DNDNPRFF3TmpGTU1DNDJOemMyTURZZ01DNDNPRGN5TWpaRE1DNDJOek0xTkRJZ01DNDNPRGd5TnpVZ01DNDJOamszTlNBd0xqYzRPRFkyT0NBd0xqWTJOVGs1TVNBd0xqYzRPVEExT0VNd0xqWTJNakUzTnlBd0xqYzRPVFExTXlBd0xqWTFPRE01TnlBd0xqYzRPVGcwTlNBd0xqWTFORFF3TXlBd0xqYzVNRGt4TlVNd0xqWTFNelUwSURBdU56a3hNVFEzSURBdU5qVXlOak0wSURBdU56a3hNems0SURBdU5qVXhOams1SURBdU56a3hOalUzUXpBdU5qUTNOVEl4SURBdU56a3lPREUySURBdU5qUXlOelU1SURBdU56azBNVE0zSURBdU5qTTROVGdnTUM0M09UUTJNVXd3TGpZek9URXdPQ0F3TGpjNU5URXpOME13TGpZME1USTVNeUF3TGpnd01USXpOQ0F3TGpZMU1EUXhNaUF3TGpnd05qVTVNeUF3TGpZMU9EQXdNaUF3TGpneE1UQTFORU13TGpZMk1EZzFPU0F3TGpneE1qY3pOQ0F3TGpZMk16VWdNQzQ0TVRReU9EWWdNQzQyTmpVME56TWdNQzQ0TVRVM01ESkRNQzQyTnpRMU1pQXdMamd5TWpFNU1TQXdMalk0TXpBeklEQXVPRE13TURBNElEQXVOamc1TnpNMElEQXVPRE00T1RBMVREQXVOamsyTlRnNUlEQXVPRFExTnpZeVF6QXVOamszTXpJeUlEQXVPRFEyT0RJeklEQXVOamszT0RBMklEQXVPRFE0TURReElEQXVOams0TWpreElEQXVPRFE1TWpVNVF6QXVOams0T0RNM0lEQXVPRFV3TmpNeElEQXVOams1TXpneklEQXVPRFV5TURBeklEQXVOekF3TWpneUlEQXVPRFV6TVRRNFZqQXVPRFV6TmpjelF6QXVOams0TWpFMUlEQXVPRFV5T1RReElEQXVOamsyTnpnNElEQXVPRFV4TlRFMklEQXVOamsxTXpjMklEQXVPRFV3TVRBNFF6QXVOamswTlRneUlEQXVPRFE1TXpFMUlEQXVOamt6TnpreklEQXVPRFE0TlRJM0lEQXVOamt5T0RrNElEQXVPRFEzT0RkRE1DNDJPVEUwTXpFZ01DNDRORFkzT1RRZ01DNDJPRGs1TlRjZ01DNDRORFUyT0RFZ01DNDJPRGcwTnpZZ01DNDRORFExTmpORE1DNDJPRFE0T0RNZ01DNDROREU0TlRJZ01DNDJPREV5TlRNZ01DNDRNemt4TVRJZ01DNDJOemMyTURZZ01DNDRNelkzT1RkRE1DNDJOek14TVRRZ01DNDRNek01TkRjZ01DNDJOamd5TlRNZ01DNDRNekUzTWpjZ01DNDJOak16TlRjZ01DNDRNamswT1VNd0xqWTFPRGN5T1NBd0xqZ3lOek0zTmlBd0xqWTFOREEyT1NBd0xqZ3lOVEkwTnlBd0xqWTBPVFkxT1NBd0xqZ3lNalUxT1VNd0xqWTBOVEkwT0NBd0xqZ3hPVGczSURBdU5qUXdPVGcySURBdU9ERTJOak0ySURBdU5qTTJPRE0ySURBdU9ERXpORGczUXpBdU5qTTJNVGcxSURBdU9ERXlPVGt6SURBdU5qTTFOVE0xSURBdU9ERXlOU0F3TGpZek5EZzRPU0F3TGpneE1qQXhNME13TGpZek1EVXpNU0F3TGpnd09EY3lOaUF3TGpZeU5UWTFJREF1T0RBeU5EVWdNQzQyTWpJM05Ua2dNQzQzT1RjM056VkRNQzQyTWpJeE16SWdNQzQzT1RZM05UZ2dNQzQyTWpFM01UWWdNQzQzT1RVMk5URWdNQzQyTWpFek1EVWdNQzQzT1RRMU5qSkRNQzQyTWpBM016SWdNQzQzT1RNd016Z2dNQzQyTWpBeE56TWdNQzQzT1RFMU5Ea2dNQzQyTVRrd05qa2dNQzQzT1RBek9UTkRNQzQyTVRrME9EWWdNQzQzT0RjeU1ESWdNQzQyTWpJMk1ETWdNQzQzT0RZek5URWdNQzQyTWpVMU9TQXdMamM0TlRVek5rTXdMall5TmpZek9DQXdMamM0TlRJME9TQXdMall5TnpZM0lEQXVOemcwT1RZNElEQXVOakk0TlRZMElEQXVOemcwTlRreFdrMHdMalF5T0RFMk15QXdMalUzT0RNNVF6QXVORE14TURVMElEQXVOVGMzTnpZZ01DNDBNek0zT0RrZ01DNDFOemN5TmpZZ01DNDBNemMyTlRjZ01DNDFOemN6TXpsRE1DNDBNemsxTmlBd0xqVTNPVEUzTnlBd0xqUTBNalEzTmlBd0xqVTRNRFF5TXlBd0xqUTBNemszT1NBd0xqVTRNall4TlVNd0xqUTBORFEzTXlBd0xqVTRNek16TVNBd0xqUTBORGM0T1NBd0xqVTROREEyTWlBd0xqUTBOVEE1TmlBd0xqVTRORGMzTTBNd0xqUTBOVFE1TkNBd0xqVTROVFk1TkNBd0xqUTBOVGczTmlBd0xqVTROalU0TWlBd0xqUTBOall4TkNBd0xqVTROek0xT0VNd0xqUTBOall6TXlBd0xqVTVNams0SURBdU5EUTFNVE01SURBdU5UazJOalU0SURBdU5EUXhPRGN4SURBdU5UazRPVFl6VERBdU5EUXhNelEySURBdU5UazVORGcxVERBdU5ETTJNRGNnTUM0MU9EZzBNVEpETUM0ME16VXhOamtnTUM0MU9EY3hNaklnTUM0ME16UXhNVFVnTUM0MU9EVTVOaUF3TGpRek16QTFOeUF3TGpVNE5EYzVNME13TGpRek1UUXpOeUF3TGpVNE16QXdOeUF3TGpReU9UZ3dOaUF3TGpVNE1USXdPQ0F3TGpReU9EWTVJREF1TlRjNE9URTNTREF1TkRJNE1UWXpWakF1TlRjNE16bGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjM2IiB5PSI1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOTUiIHZhbHVlPSJQQVBJIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj03MjUzMGZmMy0wMTNlLTQ5ZjctYmMzNS1hZDM4ZDVmMTQ5M2U7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE5MiIgeT0iNDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTk2IiB2YWx1ZT0iQXV0aC1TZXJ2aWNlIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj05NmVmYzAzMi1mYzExLTQ3YzgtOTM1My0zYzM1MTdlODkwMzY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjM1NiIgeT0iNTEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTk3IiB2YWx1ZT0iQWNjZXNzLVJpZ2h0cyAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9MzJiMTlkYTgtMmUwZS00NDY2LWJhM2QtYjgxMGJkODk3ZGNlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjI1NiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTIiIHk9IjQ4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="AWS API Gateway -&gt; AWS ELB (Elastic Load Balancer)" ref="10959030-1ac3-4d81-8d3b-bbe73fd6f0f9" source="ccb00b1b-d74c-493e-b274-1a53a5a1755e" target="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Service mesh (Istio) -&gt; Somryst-API" ref="135315aa-be70-4471-ba4a-b28e2a26cd38" source="8d17dfe4-5356-46dd-a180-c69b965f58d8" target="b6dd5f39-9243-4289-b561-566f0a1ff4fb">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Mobile Device Client (Thin) -&gt; AWS API Gateway" ref="345687ff-6ce7-463f-8090-da4b99b93fcc" source="13c2109b-c9ef-4146-aa1c-a802b47d48c8" target="ccb00b1b-d74c-493e-b274-1a53a5a1755e">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Somryst-API -&gt; OAuth2 Authorization Server" ref="35652a9c-718b-4e98-bb5c-f5ed7764e7eb" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="c2a79ff4-f7f6-4927-8def-8b3ba9094b09">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Somryst-API -&gt; MAMI (MySQL)" ref="3aff20a8-d2d0-48b2-8d31-93c6033bd05d" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="002e1e5c-362a-4bda-99d7-8cef7bbaa4a0">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Somryst-API -&gt; Auth-Service (PostgreSQL)" ref="4a52e903-4ac0-43b0-b213-20811f568498" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="2a0c2a53-d710-4930-986d-4db95b02f292">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="AWS ELB (Elastic Load Balancer) -&gt; Somryst-API" ref="ad92b11c-437d-4828-862a-280cafe91d1f" source="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe" target="8d17dfe4-5356-46dd-a180-c69b965f58d8">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Kubernetes Cluster US-West2-prod-eks-cluster -&gt; Docker Linux Host" ref="b0304738-55b1-439f-be08-84a7589496b5" source="dcee0e0c-aaa9-4890-aebe-b79381151d49" target="a928a2dc-08c7-4b68-a594-2fa6325ab3d3">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Service mesh (Istio) -&gt; Somryst-API" ref="c122f4a3-05ab-4691-8249-6f61e1455fdc" source="8d17dfe4-5356-46dd-a180-c69b965f58d8" target="dcee0e0c-aaa9-4890-aebe-b79381151d49">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Somryst-API -&gt; PAPI (PostgreSQL)" ref="da0b42e9-7158-4929-9eb6-91e780665ff6" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="f6ea0329-f94b-4e27-a510-eadd4157f49c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="OAuth2 Authorization Server -&gt; Access-Rights (PostgreSQL)" ref="de76d7dc-7159-4f78-a84d-2ef5e7c372d4" source="c2a79ff4-f7f6-4927-8def-8b3ba9094b09" target="27c24a08-02f8-4fb7-b790-7e3db361c53d">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="17f18480-efb8-46bc-a81d-b878afc47c0d" diagramComponentId="824ad734-ddf1-4bbe-9590-5872a3abf639" ref="c2a79ff4-f7f6-4927-8def-8b3ba9094b09" name="OAuth2 Authorization Server" desc="" library="" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
-      <tags/>
-      <questions>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.223">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.868">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.672">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.047">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.873">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.597">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.605">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.336">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.152">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.030">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.035">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.437">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt; 
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.035">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.343">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.998">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="984463db-0f9d-4428-9b99-1c0a97bb41c0" diagramComponentId="71cd5404-e2ef-4c59-b8c9-8ad1a219540f" ref="dcee0e0c-aaa9-4890-aebe-b79381151d49" name="Kubernetes Cluster" desc="" library="" parentComponentRef="" componentDefinitionRef="kubernetes-cluster">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CP-AC-1.1" name="Default permissions are changed to become more permissive" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  File permissions are granted to users other than the owner.&amp;nbsp; By default this access is tightly controlled by Kubernetes.&amp;nbsp; This should not be changed as it protects access to PKI and other security critical information such as cluster administration.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.093">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AS-1.1" name="Exposure of environment variables" state="0" impact="100" issueId="" issueLink="">
-          <desc>Secrets stored as environment variables may be exposed by other Kubernetes processes such as the behavior of apps.&amp;nbsp; Alternative ways of storing secrets may be more suitable.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CP-AC-1.2" name="File ownership is extended to users unnecessarily" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  File ownership is granted to users other than root.&amp;nbsp; Granting unintended parties complete and full control over the file and allowing them to then grant access others may expose security critical data such as credentials and certificates.&amp;nbsp; Adversaries may also be able to change the way the cluster is administered. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-LM-1.1" name="Forensics capabilities are difficult to determine at early stages" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that system policies include forensics capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling. The absence of such capabilities can result in diminishing incident response and detection capabilities. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-LM-1.2" name="Forensics capabilities not integrated into existing architectures" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that forensics capabilities are integrated into existing applications and architectures is a challenge due to lack of resources to help with the modification and lack of the necessary guidance to do so. The absence can result in diminishing incident response and detection capabilities 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-3.1" name="Hosts which are not properly configured threaten the integrity of the container architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring trust in host systems that store images and launch containers is a challenge. The absence of host-hardening processes can result in the compromise of images, runtime environments, and stored data 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-1.1" name="Image provenance not verified" state="0" impact="100" issueId="" issueLink="">
-          <desc>Not allowing Kubernetes to ensure that images are verified can increase the risk of vulnerabilities being introduced to a cluster through images.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AA-1.1" name="Inadequate or missing infrastructure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Lack of infrastructure may result in insecure communications between containers are secured, lack of network traffic monitoring, and unauthorized access to the network traffic, resources, and configurations. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AC-1.2" name="Insufficient boundaries around namespaces" state="0" impact="100" issueId="" issueLink="">
-          <desc>Kubernetes supports multiple virtual clusters backed by the same physical cluster. These virtual clusters are called namespaces, and they provide a way to divide cluster resources between multiple users.&amp;nbsp; Namespaces which are not carefully managed can result in objects having access to parts of the cluster which should be beyond their scope.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AS-1.3" name="Kubernetes secrets management may be insufficient" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The in-built Kubernetes secret storage may not be sufficiently robust.&amp;nbsp; Depending on needs of individual systems, it may be necessary to configure alternative mechanisms. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CP-LA-1.1" name="Logging not carried out by default" state="0" impact="100" issueId="" issueLink="">
-          <desc>Logging must be deliberately set on Kubernetes as it is not a default configuration.&amp;nbsp; However the logging requirements must be carefully balanced against the resources that logging will consume.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-N-2.1" name="Missing or incomplete infrastructure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the complexities of container architectures and a lack of network tooling and data storage. The absence can result in diminished incident response and detection capabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-N-1.1" name="Namespace network policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>Despite the importance of network policies in securing pods, and therefore clusters, they are not created by default in Kubernetes.&amp;nbsp; Strong network policies should be designed and then applied to all namespaces in a cluster.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-1.2" name="Pipelines or build chains not secured" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-3.2" name="Resource mismanagement compromises quality of service" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  In addition to authorized resource usage, the operator faces a challenge to ensure resources are not overused or abused, because this will affect usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AC-1.1" name="Roles and service accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>Service accounts and role based access controls are methods which control access to cluster resources based on object identification.&amp;nbsp; Assigning permissions to objects which should be beyond their scope can result in them being misused by adversaries.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-2.1" name="Seccomp disabled" state="0" impact="100" issueId="" issueLink="">
-          <desc>Seccomp can be used to control cluster workloads by restricting the set of system calls that applications can make.&amp;nbsp; Kubernetes disables it by default, it should be manually configured instead.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-AS-1.2" name="Secrets management not configured across all areas of the system" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring the ability to automate the configuration of the secret management tool and dynamically generate secrets required by the application in a Continuous Integration/ Continuous Deployment (CI/CD) environment is a challenge because of the lack of best practices, tooling and automation for "key zero" (the first key in the key management system that is usually handled manually). The absence can result in the compromise of the application and/or data. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="W-NIST-800-190-01" name="Unauthorized hosts joining the cluster and running containers" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Unauthorized hosts should not run containers without appropriate authentication and authorization.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.755">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CP-AA-1.1" name="Unrevoked security certificates" state="0" impact="100" issueId="" issueLink="">
-          <desc>While security certificates are, in general, an effective security measure for a system, they are only useful if they are properly managed and controlled.&amp;nbsp; If security certificates are not revoked they may continue to be used long after a user's access should have ceased.&amp;nbsp; &amp;nbsp; The greater the number of historical unrevoked credentials there are, the greater the likelihood that an adversary will find a way to exploit the vulnerability.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PO-G-1.3" name="Vulnerability definitions may not be up to date" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-NSA-HG-05" name="Apply security patches and updates and remove components when they are no longer needed" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Following the hardening guidance outlined in this document is a step toward ensuring the security of applications running on Kubernetes orchestrated containers. However, security is an ongoing process, and it is vital to keep up with patches, updates, and upgrades. The specific software components vary depending on the individual configuration, but each piece of the overall system should be kept as secure as possible. This includes updating: Kubernetes, hypervisors, virtualization software, plugins, operating systems on which the environment is running, applications running on the servers, and any other software hosted in the Kubernetes environment. &amp;nbsp;&lt;/p&gt;&lt;p&gt;As updates are deployed, administrators should also keep up with removing any old components that are no longer needed from the environment. Using a managed Kubernetes service can help to automate upgrades and patches for Kubernetes, operating systems, and networking protocols. However, administrators must still patch and upgrade their containerized applications.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;The Center for Internet Security (CIS) publishes benchmarks for securing software. Administrators should adhere to the CIS benchmarks for Kubernetes and any other relevant system components. Administrators should check periodically to ensure their system's security is compliant with the current security experts' consensus on best practices. Periodic vulnerability scans and penetration tests should be performed on the various system components to proactively look for insecure configurations and zero-day vulnerabilities. Any discoveries should be promptly remediated before potential cyber actors can discover and exploit them.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-3.1.1" name="Client certificate authentication should not be used for users" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Kubernetes client certificate authentication does not allow for this due to a lack of support for certificate revocation. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   External mechanisms for authentication generally require additional software to be deployed. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Authenticating" url="https://kubernetes.io/docs/reference/access-authn-authz/authentication/"/>
-          </references>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="3.1.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-NSA-HG-04" name="Configure a metrics logger" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Kubernetes does not natively support alerting; however, several monitoring tools with alerting capabilities are compatible with Kubernetes. If Kubernetes administrators choose to configure an alerting tool to work within a Kubernetes environment, there are several metrics for which administrators should monitor and configure alerts. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Alerting when storage is low can help avoid performance issues and log loss due to limited resources and help identify malicious cryptojacking attempts. Cases of privileged Pod execution can be investigated to determine if an administrator made a mistake, an authentic use case necessitates escalated privileges, or a malicious actor deployed a privileged Pod. Suspicious Pod creation source IP addresses could indicate that a malicious cyber actor has broken out of a container and is attempting to create a malicious Pod. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Integrating Kubernetes with an organization's existing SIEM platform, especially those with machine learning/big data capabilities, can be useful in identifying irregularities in audit logs and cutting down on false alerts. If configuring such a tool to work with Kubernetes, it should be configured so that these cases and any others applicable to the use case are configured to trigger alerts. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Systems capable of acting automatically when suspected intrusions occur could potentially be configured to take steps to mitigate compromises while administrators respond to alerts. In the case of a Pod IP being listed as the source ID of a Pod creation request, one mitigation that could be implemented to keep the application available but temporarily stop any compromises of the cluster would be to automatically evict the Pod. Doing so would allow a clean version of the Pod to be rescheduled onto one of the nodes. Investigators can then examine the logs to determine if a breach occurred and, if so, how the malicious actors executed the compromise so that a patch can be deployed.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Examples of cases that could trigger alerts include but are not limited to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;low disk space on any of the machines in the environment,&lt;/li&gt;&lt;li&gt;available storage space on a logging volume running low,&lt;/li&gt;&lt;li&gt;external logging service going offline,&lt;/li&gt;&lt;li&gt;a Pod or application running with root permissions,&lt;/li&gt;&lt;li&gt;requests being made by an account for resources they do not have permission for,&lt;/li&gt;&lt;li&gt;an anonymous account being used or gaining privileges,&lt;/li&gt;&lt;li&gt;Pod or Worker Node IP addresses being listed as the source ID of a Pod creation request,&lt;/li&gt;&lt;li&gt;unusual system calls or failed API calls,&lt;/li&gt;&lt;li&gt;user/admin behavior that is abnormal (i.e. at unusual times or from an unusual location), and&lt;/li&gt;&lt;li&gt;significant deviations from the standard operation metrics baseline.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-NSA-HG-03" name="Configure control plane components to use authenticated, encrypted communications using Transport Layer Security (TLS) certificates" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The control plane is the core of Kubernetes and gives users the ability to view containers, schedule new Pods, read Secrets, and execute commands in the cluster. Because of these sensitive capabilities, the control plane should be highly protected. In addition to secure configurations such as TLS encryption, RBAC, and a strong authentication method, network separation can help prevent unauthorized users from accessing the control plane.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Kubernetes API server runs on ports 6443 and 8080, which should be protected by a firewall to accept only expected traffic. Port 8080, by default, is accessible without TLS encryption from the local machine, and the request bypasses authentication and authorization modules.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The insecure port can be disabled using the API server flag --insecure-port=0. The Kubernetes API server should not be exposed to the Internet or an untrusted network. Network policies can be applied to the kube-system namespace to limit internet access to the kube-system. If a default deny policy is implemented to all namespaces, the kube-system namespace must still be able to communicate with other control plane segments and worker nodes.&lt;/p&gt;&lt;p&gt;The following table lists the control plane ports and services:&lt;/p&gt;&lt;p&gt;Protocol Direction Port Range Purpose&lt;/p&gt;&lt;p&gt;TCP Inbound 6443 or 8080 if not disabled Kubernetes API server&lt;/p&gt;&lt;p&gt;TCP Inbound 2379-2380 etcd server client API&lt;/p&gt;&lt;p&gt;TCP Inbound 10250 kubelet API&lt;/p&gt;&lt;p&gt;TCP Inbound 10251 kube-scheduler&lt;/p&gt;&lt;p&gt;TCP Inbound 10252 kube-controller-manager&lt;/p&gt;&lt;p&gt;TCP Inbound 10258 cloud-controller-manager (optional)&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1. Set up TLS encryption&lt;/p&gt;&lt;p&gt;2. Set up strong authentication methods&lt;/p&gt;&lt;p&gt;3. Disable access to internet and unnecessary, or untrusted networks&lt;/p&gt;&lt;p&gt;4. Use RBAC policies to restrict access&lt;/p&gt;&lt;p&gt;5. Secure the etcd datastore with authentication and RBAC policies&lt;/p&gt;&lt;p&gt;6. Protect kubeconfig files from unauthorized modifications&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.5.1" name="Configure Image Provenance using ImagePolicyWebhook admission controller" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Configure Image Provenance for your deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Follow the Kubernetes documentation and setup image provenance. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   You need to regularly maintain your provenance configuration based on container image updates. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Docker: Anchore Toolbox" url="https://hub.docker.com/r/dnurmi/anchore-toolbox/"/>
-            <reference name="Kubernetes docs: Admission Controllers" url="https://kubernetes.io/docs/admin/admission-controllers/"/>
-            <reference name="Kubernetes issues: #22888" url="https://github.com/kubernetes/kubernetes/issues/22888"/>
-          </references>
-          <standards>
-            <standard ref="5.5.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the pod definitions in your cluster and verify that image provenance is configured as appropriate.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.4.2" name="Consider external secret storage" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes supports secrets as first-class objects, but care needs to be taken to ensure that access to secrets is carefully limited. Using an external secrets provider can ease the management of access to secrets, especially where secrets are used across both Kubernetes and non-Kubernetes environments. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Refer to the secrets management options offered by your cloud provider or a third-party secrets management solution. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.4.2" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your secrets management implementation</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.7.1" name="Create administrative boundaries between resources using namespaces" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use namespaces to isolate your Kubernetes objects. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Limiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups.&amp;nbsp; Resources created in one namespace can be hidden from other namespaces. 
-&lt;/div&gt; 
-&lt;div&gt;
-  By default, each resource created by a user in Kubernetes cluster runs in a default namespace, called default. You can create additional namespaces and attach resources and users to them. You can use Kubernetes Authorization plugins to create policies that segregate access to namespace resources between different users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Follow the documentation and create namespaces for objects in your deployment as you need them. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   You need to switch between namespaces for administration. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes blog: Deployment Best Practices" url="https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/"/>
-            <reference name="Kubernetes docs: Namespaces" url="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"/>
-          </references>
-          <standards>
-            <standard ref="5.7.1" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="5.7.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command and review the namespaces created in the cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl get namespaces 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that these namespaces are the ones you need and are adequately administered as per your requirements. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.3.2" name="Ensure that all Namespaces have Network Policies defined" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use network policies to isolate traffic in your cluster network. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Follow the documentation and create NetworkPolicy objects as you need them. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Once network policies are in use within a given namespace, traffic not explicitly allowed by a network policy will be denied. As such it is important to ensure that, when introducing network policies, legitimate traffic is not blocked. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Declare Network Policy" url="https://kubernetes.io/docs/tasks/configure-pod-container/declare-network-policy/"/>
-            <reference name="Kubernetes docs: Network Policies" url="https://kubernetes.io/docs/concepts/services-networking/networkpolicies/"/>
-            <reference name="Octetz.com" url="https://octetz.com/docs/2019/2019-04-22-netpol-api-k8s/"/>
-          </references>
-          <standards>
-            <standard ref="5.3.2" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command and review the NetworkPolicy objects created in the cluster. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl --all-namespaces get networkpolicy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that each namespace defined in the cluster has at least one Network Policy. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-3.2.1" name="Ensure that a minimal audit policy is created" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes can audit the details of requests made to the API server. The --audit-policy-file flag must be set for this logging to be enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging is an important detective control for all systems, to detect potential unauthorized access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Create an audit policy file for your cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Audit logs will be created on the master nodes, which will consume disk space. Care should be taken to avoid generating too large volumes of log information as this could impact the availability of the cluster nodes. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Auditing" url="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/"/>
-          </references>
-          <standards>
-            <standard ref="3.2.1" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="3.2.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command on one of the cluster master nodes: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ps -ef | grep kube-apiserver 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the --audit-policy-file is set. Review the contents of the file specified and ensure that it contains a valid audit policy. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.1.5" name="Ensure that default service accounts are not actively used" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. 
-&lt;/div&gt; 
-&lt;div&gt;
-  The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. 
- &lt;/div&gt; 
- &lt;div&gt;
-   Modify the configuration of each default service account to include this value automountServiceAccountToken: false 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   All workloads which require access to the Kubernetes API will require an explicit service account to be created. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Configure Service Account" url="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"/>
-          </references>
-          <standards>
-            <standard ref="5.1.5" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  For each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additionally ensure that the automountServiceAccountToken: false setting is in place for each default service account. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-NIST-800-190-02" name="Ensure that nodes are securely introduced to the cluster" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Orchestration platforms should be configured to provide features that create a secure environment for all the apps they run. Orchestrators should ensure that nodes are securely introduced to the cluster, have a persistent identity throughout their lifecycle, and can also provide an accurate inventory of nodes and their connectivity states. Organizations should ensure that orchestration platforms are designed specifically to be resilient to compromise of individual nodes without compromising the overall security of the cluster. A compromised node must be able to be isolated and removed from the cluster without disrupting or degrading overall cluster operations. Finally, organizations should choose orchestrators that provide mutually authenticated network connections between cluster members and end-to-end encryption of intra-cluster traffic. Because of the portability of containers, many deployments may occur across networks organizations do not directly control, so a secure-by-default posture is particularly important for this scenario.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-190" url="https://csrc.nist.gov/publications/detail/sp/800-190/final"/>
-          </references>
-          <standards>
-            <standard ref="4.3.5" supportedStandardRef="nist-800-190"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.351">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-1.1.14" name="Ensure that the admin.conf file ownership is set to root:root" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the admin.conf file ownership is set to root:root. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The admin.conf file contains the admin credentials for the cluster. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Run the below command (based on the file location on your system) on the master node. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   chown root:root /etc/kubernetes/admin.conf 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: kubeadm" url="https://kubernetes.io/docs/admin/kubeadm/"/>
-          </references>
-          <standards>
-            <standard ref="1.1.14" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="1.1.14" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command (based on the file location on your system) on the master node. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  stat -c %U:%G /etc/kubernetes/admin.conf 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the ownership is set to root:root. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-1.1.13" name="Ensure that the admin.conf file permissions are set to 644 or more restrictive" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the admin.conf file has permissions of 644 or more restrictive. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The admin.conf is the administrator kubeconfig file defining various settings for the administration of the cluster. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Run the below command (based on the file location on your system) on the master node. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   chmod 644 /etc/kubernetes/admin.conf 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Create Cluster Kubeadm" url="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/"/>
-          </references>
-          <standards>
-            <standard ref="1.1.13" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="1.1.13" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command (based on the file location on your system) on the master node.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  stat -c %a /etc/kubernetes/admin.conf 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the permissions are 644 or more restrictive. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-3.2.2" name="Ensure that the audit policy covers key security concerns" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the audit policy created for the cluster covers key security concerns. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Consider modification of the audit policy in use on the cluster to include these items, at a minimum. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Increasing audit logging will consume resources on the nodes or other log destination. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Audit Policy" url="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/"/>
-            <reference name="Kubernetes: configure-helper.sh" url="https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh"/>
-            <reference name="k8scop: k8s-security-dashboard" url="https://github.com/k8scop/k8s-security-dashboard/blob/master/configs/kubernetes/adv-audit.yaml"/>
-          </references>
-          <standards>
-            <standard ref="3.2.2" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Review the audit policy provided for the cluster and ensure that it covers at least the following areas : 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Access to Secrets managed by the cluster.&amp;nbsp; Care should be taken to only log Metadata for requests to&amp;nbsp; &amp;nbsp; &amp;nbsp;Secrets, ConfigMaps, and TokenReviews, in order to avoid the risk of logging sensitive data.&lt;/li&gt; 
-  &lt;li&gt;Modification of pod and deployment objects.&lt;/li&gt; 
-  &lt;li&gt;Use of pods/exec, pods/portforward, pods/proxy and services/proxy.&lt;/li&gt; 
-  &lt;li&gt;Roles and RoleBindings, ClusterRoles / ClusterRoleBindings&lt;/li&gt; 
-  &lt;li&gt;ConfigMaps&lt;/li&gt; 
-  &lt;li&gt;Secrets&lt;/li&gt; 
-  &lt;li&gt;Workloads: Deployments, DaemonSets, Pods,&lt;/li&gt; 
-  &lt;li&gt;Cluster's certificates&lt;/li&gt; 
-  &lt;li&gt;The resources within each apiVersion&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;div&gt;
-  For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.1.1" name="Ensure that the cluster-admin role is only used where required" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as cluster-admin provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as cluster-admin allow super-user access to perform any action on any resource. When used in a ClusterRoleBinding, it gives full control over every resource in the cluster and in all namespaces. When used in a RoleBinding, it gives full control over every resource in the rolebinding's namespace, including the namespace itself. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. 
- &lt;/div&gt; 
- &lt;div&gt;
-   Where possible, first bind users to a lower privileged role and then remove the cluster rolebinding to the cluster-admin role : 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   kubectl delete clusterrolebinding [name] 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt; Impact: &lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Care should be taken before removing any clusterrolebindings from the environment to ensure they were not required for operation of the cluster. Specifically, modifications should not be made to clusterrolebindings with the system: prefix as they are required for the operation of system components. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: User Facing Roles" url="https://kubernetes.io/docs/admin/authorization/rbac/"/>
-          </references>
-          <standards>
-            <standard ref="5.1.1" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Obtain a list of the principals who have access to the cluster-admin role by reviewing the clusterrolebinding output for each role binding that has access to the cluster-admin role. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;kubectl get clusterrolebindings -o=custom-columns= 
-&lt;/div&gt; 
-&lt;div&gt;
-  NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-1.1.20" name="Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that Kubernetes PKI certificate files have permissions of 644 or more restrictive. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes makes use of a number of certificate files as part of the operation of its components. The permissions on these files should be set to 644 or more restrictive to protect their integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Run the below command (based on the file location on your system) on the master node. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   chmod -R 644 /etc/kubernetes/pki/*.crt 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
-          </references>
-          <standards>
-            <standard ref="1.1.20" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="1.1.20" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command (based on the file location on your system) on the master node. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  find /etc/kubernetes/pki -name "*.crt" | xargs stat -c '%n %a' 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the permissions are 644 or more restrictive. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-1.1.19" name="Ensure that the Kubernetes PKI directory and file ownership is set to root:root" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that the Kubernetes PKI directory and file ownership is set to root:root. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes makes use of a number of certificates as part of its operation. You should set the ownership of the directory containing the PKI information and all files in that directory to maintain their integrity. The directory and files should be owned by root:root. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Run the below command (based on the file location on your system) on the master node. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   chown -R root:root /etc/kubernetes/pki/ 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
-          </references>
-          <standards>
-            <standard ref="1.1.19" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="1.1.19" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command (based on the file location on your system) on the master node. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  ls -laR /etc/kubernetes/pki/ 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the ownership of all files and directories in this hierarchy is set to root:root. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-1.1.21" name="Ensure that the Kubernetes PKI key file permissions are set to 600" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that Kubernetes PKI key files have permissions of 600. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes makes use of a number of key files as part of the operation of its components. The permissions on these files should be set to 600 to protect their integrity and confidentiality. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Run the below command (based on the file location on your system) on the master node. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   chmod -R 600 /etc/kubernetes/pki/*.key 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
-          </references>
-          <standards>
-            <standard ref="1.1.21" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="1.1.21" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the below command (based on the file location on your system) on the master node. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  find /etc/kubernetes/pki -name "*.key" | xargs stat -c '%n %a' 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Verify that the permissions are 600. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.7.2" name="Ensure that the seccomp profile is set to docker/default in your pod definitions" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable docker/default seccomp profile in your pod definitions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. You should enable it to ensure that the workloads have restricted actions available within the container. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you would need to enable alpha features in the apiserver by passing "--feature-gates=AllAlpha=true" argument. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS parameter to "--feature-gates=AllAlpha=true" 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   KUBE_API_ARGS="--feature-gates=AllAlpha=true" 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Based on your system, restart the kube-apiserver service. For example: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   systemctl restart kube-apiserver.service 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use annotations to enable the docker/default seccomp profile in your pod definitions. An example is as below: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   apiVersion: v1 
- &lt;/div&gt; 
- &lt;div&gt;
-   kind: Pod 
- &lt;/div&gt; 
- &lt;div&gt;
-   metadata: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;name: trustworthy-pod 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;annotations: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;seccomp.security.alpha.kubernetes.io/pod: docker/default 
- &lt;/div&gt; 
- &lt;div&gt;
-   spec: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;containers: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;- name: trustworthy-container 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;span style="white-space:pre"&gt; &lt;/span&gt;image: sotrustworthy:latest 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   If the docker/default seccomp profile is too restrictive for you, you would have to create/manage your own seccomp profiles. Also, you need to enable all alpha features for this to work. There is no individual switch to turn on this feature. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Docker docs: Seccomp" url="https://docs.docker.com/engine/security/seccomp/"/>
-            <reference name="Kubernetes issues: #39845" url="https://github.com/kubernetes/kubernetes/issues/39845"/>
-            <reference name="Kubernetes: Disable seccomp policy by default" url="https://github.com/kubernetes/kubernetes/pull/21790"/>
-          </references>
-          <standards>
-            <standard ref="5.7.2" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Review the pod definitions in your cluster. It should create a line as below: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  annotations: 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp;seccomp.security.alpha.kubernetes.io/pod: docker/default 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:5" name="For existing infrastructure, the operator should manage a gradual roll-out of capabilities, starting with capturing data (i.e., network traffic, disk and memory artifacts)" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Integrating forensics capabilities into an existing infrastructure should be part of the maintenance and&amp;nbsp; change management activities of the operator. This should be done as part of due diligence and compliance, as well as to satisfy rules and regulations. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The integration of forensics capabilities will help the operator meet due diligence requirements, compliance measures, rules, and regulations. These capabilities will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the forensics plan for available forensics capabilities and verify that they have been fully integrated according to the steps outlined. 
-&lt;br&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:4" name="For new infrastructure, the operator should implement planned forensics capabilities" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The design and implementation of planned forensics capabilities should take place along with the rest of the infrastructure and should be integrated with corporate incident response, business continuity and disaster recovery plans. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The design and implementation of forensics capabilities will help to verify the plan and revise the designs if needed to accommodate changes. These capabilities will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the forensics plan for available forensics capabilities and verify that they have been applied to the system.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:2" name="In a multi-tenant environment, the operator should ensure balanced resource consumption" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Quality of service should always be upheld at the expense of multi-tenancy 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This allows fulfillment of at least one service-level agreement (SLA). It can be beneficial to work with developers and/or vendors to refine resource requests. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span style="display: inline !important; float: none; background-color: transparent; color: rgb(0, 0, 0); font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;"&gt;The method of verifying balanced resource consumption will depend on the organizational policies and available tools.&amp;nbsp; Ensure that developers have been involved in determining resource requirements.&lt;/span&gt; 
-&lt;br&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:3" name="In a multi-tenant environment, the operator should ensure that the CMP optimizes cluster resource consumption" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensuring predictable platform behavior under conditions of varying resource availability can be a challenge, an operator needs to evaluate setting resource constraints to preserve environment stability when resources availability fluctuates. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Balancing the resource consumption facilitates sustainable execution, which in turn minimizes the resource contention. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The method of verifying balanced resource consumption will depend on the CMP being used to manage the system.&amp;nbsp; Check the relevant documentation for the CMP and any organizational policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.1.2" name="Minimize access to secrets" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Where possible, remove get, list and watch access to secret objects in the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Care should be taken not to remove access to secrets to system components which require this for their operation 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.1.2" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the users who have get, list or watch access to secrets objects in the Kubernetes API.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.1.3" name="Minimize wildcard use in Roles and ClusterRoles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard "*" which matches all items. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The principle of least privilege recommends that users are provided only the access required for their role and nothing more. The use of wildcard rights grants is likely to provide excessive rights to the Kubernetes API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.1.3" supportedStandardRef="cis-kubernetes-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Retrieve the roles defined across each namespaces in the cluster and review for wildcards&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl get roles --all-namespaces -o yaml 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Retrieve the cluster roles defined in the cluster and review for wildcards 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl get clusterroles -o yaml 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:3" name="Operators should design the secret management architecture by integrating with deployment tools or scripts and container orchestration tools" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Secret management deployment and initial seeding utilizing deployment time and user inputs can be handled by closely integrating it with the specific container orchestration scripts, as well as the 
-&lt;/div&gt; 
-&lt;div&gt;
-  corresponding deployment scripts in scenarios where deployment is triggered by a human user. In the case of a completely automated deployment, the use of a key management server (KMS) or a hardware secure module (HSM) should be utilized to bootstrap the secret management server with the initial bootstrapping secrets required. For instance, virtual machine (VM) metadata that has been bound to a specific role can be used to authenticate to an HSM to obtain secrets from an HSM during VM boot up.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Bootstrapping of secrets is always a chicken-and-egg issue and utilizing some auto-generated data, such as VM metadata, to obtain the first secret from the HSM/KMS is a way to overcome this issue. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Once the secret management system has been bootstrapped with deployment-time or boot-up time secrets, it is armed to handle dynamic generation of secrets. For instance, in order to dynamically generate database account credentials for applications it needs to use the database admin credentials obtained at deployment time to authorize the creation of a new user account and then pass these on to the application that needs to use it. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are a number of secrets management tools available.&amp;nbsp; Ensure that tools chosen is robust and that it has been correctly integrated with deployment tools and any other relevant features.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.8:1" name="Operators should ensure the availability of the capability to validate image signatures before deployment" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;/b&gt;Images should be signed as part of the build process and validated before used. Signing and validation can be achieved by using GPG&amp;nbsp; signatures on image contents or through similar methods. Developers should ensure that their images are signed as part of the build process.&amp;nbsp; Operators should ensure the availability of the capability to validate image signatures before deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;/b&gt;Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered&amp;nbsp; with between build and runtime. 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.8" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that there is a suitable image signing capability such as GPG&amp;nbsp; signatures for the system, and that developers and operators are aware of its existence and how to use it. 
-&lt;span style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-style: normal; font-variant: normal; font-weight: 400; text-decoration: none; word-spacing: 0px; display: inline !important; white-space: normal; orphans: 2; float: none; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.1:2" name="Operators should leverage a container management platform to securely move images across environments" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In a production container environment, there are many components to manage in addition to management of application code and container images. A CMP that can support the organization's scale across one or more environments and/or locations should have capabilities to securely synchronize container images. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the Operator must have the ability to validate and verify the code and/or binary artifacts between environments and promotion phases utilizing digital certificates and/or digital signatures provided by the developer or the orchestration engine.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the consistency of an application deployed by the build chain, the operator must also have the ability to synchronize the application code across all locations where the application is running or being consumed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using a CMP to manage container images, users of the platform can confidently expect appropriate versions of a container image to be available for execution across their environments. This minimizes confusion around versions of an application that is running in different environments. When coupled with the best practice of using a root of trust, users of the platform can ensure provenance and integrity of the container images across their environments. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a suitable CMP exists and is in use in your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.8:5" name="Operators should use trusted hosts that are securely hardened and, where container engine is securely configured, to store images and run containers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Operators will need to harden the OS and the container engine before storing images and running containers on them. It is important to only deploy the necessary packages on the host and to regularly apply security updates and kernel patches.&amp;nbsp; Operators will want to harden the container engine according to vendor's security best practices.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensuring that host OS and container engine are properly patched and securely configured will reduce the container's attack surface and exposure to known vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.8" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Please follow the best security practices according to your specific vendor.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.4.1" name="Prefer using secrets as files over secrets as environment variables" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes supports mounting secrets as data volumes or as environment variables. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Minimize the use of environment variable secrets. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is reasonably common for application code to log out its environment (particularly in the event of an error). This will include any secret values passed in as environment variables, so secrets can easily be exposed to any user or entity who has access to the logs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Application code which expects to read secrets in the form of environment variables would need modification 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Kubernetes docs: Using Secrets" url="https://kubernetes.io/docs/concepts/configuration/secret"/>
-          </references>
-          <standards>
-            <standard ref="5.4.1" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command to find references to objects which use environment variables defined from secrets. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} 
-&lt;/div&gt; 
-&lt;div&gt;
-  {.metadata.name} {"\n"}{end}' -A 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CIS-K-5.7.4" name="The default namespace should not be used" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Impact:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   None 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.7.4" supportedStandardRef="cis-kubernetes-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run this command to list objects in default namespace 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  kubectl get all 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The only entries there should be system managed resources such as the kubernetes service 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.5:2" name="The operator must provide authentication and authorization infrastructure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The Operator should provide the means to not only encrypt traffic, but at the same time ensure the identity of the containers and the actions that they can take. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Using a solution such as TLS with mutual authentication would ensure both the confidentiality of the traffic and the identity of the containers. Authorization mechanisms would be provided based on an RBAC such as LDAP, which leverages the identity provided by the authentication mechanism. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="4.3.2" supportedStandardRef="nist-800-190"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Individual container technologies will have their own methods for checking and applying encryption for communications.&amp;nbsp; Follow the relevant documentation for the technology in question. 
-&lt;br&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.5:3" name="The operator must provide network monitoring infrastructure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitoring network traffic and configurations provides the means to detect the tampering of network traffic and configurations besides potentially malicious traffic.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network monitoring challenges may be mitigated by defining standard semantics and syntax for network monitoring for containers, specifying "must report" events for compliance, and addressing the accuracy or relevance of network activity/events to network health for containers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Providing a record of network traffic (i.e., netflows) and configuration changes ensures that only expected behaviors and actions take place within a given environment. This helps in maintaining incident response and detection capabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Individual systems will have their own methods for monitoring network traffic.&amp;nbsp; Ensure that suitable methods are in use to secure both the container architecture and the underlying network technology. 
-&lt;br&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:4" name="The operator should design into infrastructure the ability to only allow the use of signed and approved images" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Operators should design an infrastructure that will accept only signed and approved images. The image approval can be tied to the organization's software acceptance policy (e.g., quality, security, stability, etc.), or to any acceptance criteria that is applicable. It should be possible for an operator to prevent running an image even if it is properly signed but otherwise fails to meet acceptance criteria. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Checking for signature validation ensures that image data was not tampered with between build and the time image is running. Preventing the use of unauthorized or unacceptable images (even if signed) provides further validation of images before they run. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span style="display: inline !important; float: none; background-color: transparent; color: rgb(0, 0, 0); font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;"&gt;Verify that there is a suitable image signing capability such as GPG&amp;nbsp; signatures for the system, and that developers and operators are aware of its existence and how to use it. They system should be configured to prevent access to images which are unsigned.&lt;/span&gt; 
-&lt;br&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:5" name="The operator should design the infrastructure to continuously identify newly published vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The operator should provide an infrastructure that continuously identifies image vulnerabilities in the following cases: images that are stored in a registry, images that are stored locally on the host, and images that are running as containers. Once a new vulnerability is identified, mitigation actions should take place based on the vulnerability severity and its impact on the application. Instead of patching running containers, it is preferable to apply the patch on a new image version and deploy the new image to the container runtime environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There is a need to continuously rescan images since new vulnerabilities are found and published over time. The scan should include all the images in the image registry, images on local machines (waiting to run), and images that are already running as containers. Applying patches by creating a new image version instead of updating running containers will provide better visibility into the process and ensure consistency between containers and their images. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that a vulnerability scanner exists which is robust, appropriate for the technology in question, can be automated, and can be applied to all stages of the build pipeline.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:3" name="The operator should include forensics capability planning for container environments" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Forensics planning should include the instrumentation, human resources, sources of evidence (i.e., network, disk, memory), processes, and procedures. The volatile nature of the container environment necessitates a more agile framework to capture and analyze the evidence.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Forensics capabilities are the basis for any incident response and mitigation activity. Forensics can provide the necessary evidence to determine the root cause of an incident and increase the speed of mitigation. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Integrating forensics capabilities into an incident response plan and procedures will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; text-decoration: none; word-spacing: 0px; white-space: normal; orphans: 2; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;
-  Verify that a forensics plan exists, that it is comprehensive, and that it includes identification of the forensics capabilities which can be applied to the system. 
-&lt;/div&gt; 
-&lt;div style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; text-decoration: none; word-spacing: 0px; white-space: normal; orphans: 2; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:3" name="The operator should provide infrastructure that isolates network traffic of different users and applications" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic for different users and applications needs to be segregated to limit lateral movement from potentially compromised users or applications.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This network isolation limits the threat vector of lateral movement. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the instructions in the relevant documentation for the container technology in use.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:2" name="The operator should provide infrastructure that supports resource management, access control, and monitoring of container volumes" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The management of volume resources includes following volume management service activities: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-&lt;ul&gt;
-&lt;li&gt;Creating, provisioning, and updating volume resource&lt;/li&gt;
-&lt;li&gt;Enrolling, accessing, and denying volume resource&lt;/li&gt;
-&lt;li&gt;Decommissioning and terminating volume resource&lt;/li&gt;
-&lt;li&gt;Troubleshooting volume resource&lt;/li&gt;
-&lt;li&gt;Monitoring, reporting, auditing, inventorying, validating, and verifying volume resource&lt;/li&gt;
-&lt;li&gt;Migrating volume resource&lt;/li&gt;
-&lt;li&gt;Encrypting volume resource&lt;/li&gt;
-&lt;li&gt;Recovering volume resource&lt;/li&gt;
-&lt;li&gt;Performance tuning volume resource&lt;/li&gt;
-&lt;/ul&gt;
-&lt;/div&gt; 
-&lt;div&gt;
-  The relationship between assets (i.e., people, groups, containers, network, host, and volumes) should be explicitly known and mapped to volume management service activities (as outlined in the CSA document referenced by this countermeasure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   The granular breakdown of "resources management" is concretely identified as a potential standard practice for consistent management of volume resource management activities. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the current infrastructure to ensure that&amp;nbsp;volume management service activities are mapped according to the guidelines in the related standard documentation.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-control" name="Access control" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="CP-AC-1" name="Attackers gain access to configuration files without necessary privileges" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>An adversary is able to exploit misconfigured file access to gain access to the master node configuration files which control credentials and certificates.&amp;nbsp; &amp;nbsp;The Kubernetes default is to reserve access to these files to root and to configure strong permissions.&amp;nbsp; These permissions may be changed by administrators in order to ease workflow but this can have serious implications for security.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CP-AC-1.1">
-                  <countermeasures>
-                    <countermeasure ref="C-NSA-HG-03" mitigation="16"/>
-                    <countermeasure ref="CIS-K-1.1.13" mitigation="20"/>
-                    <countermeasure ref="CIS-K-1.1.20" mitigation="16"/>
-                    <countermeasure ref="CIS-K-1.1.21" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CP-AC-1.2">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-1.1.14" mitigation="16"/>
-                    <countermeasure ref="CIS-K-1.1.19" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-NSA-HG-03" mitigation="16"/>
-                <countermeasure ref="CIS-K-1.1.13" mitigation="20"/>
-                <countermeasure ref="CIS-K-1.1.14" mitigation="16"/>
-                <countermeasure ref="CIS-K-1.1.19" mitigation="16"/>
-                <countermeasure ref="CIS-K-1.1.20" mitigation="16"/>
-                <countermeasure ref="CIS-K-1.1.21" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="T-NIST-800-190-01" name="Attackers take advantage of bad orchestrator configurations that expose the orchestrator and all other container technology components" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>&lt;p&gt;Maintenance of trust between the nodes in the environment requires special care. The orchestrator is the most foundational node. Weak orchestrator configurations can expose the orchestrator and all other container technology components to increased risk. Examples of possible consequences include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Unauthorized hosts joining the cluster and running containers&lt;/li&gt;&lt;li&gt;The compromise of a single cluster host implying compromise of the entire cluster-for example, if the same key pairs used for authentication are shared across all nodes&lt;/li&gt;&lt;li&gt;Communications between the orchestrator and DevOps personnel, administrators, and hosts being unencrypted and unauthenticated&lt;/li&gt;&lt;/ul&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST 800-190" url="https://csrc.nist.gov/publications/detail/sp/800-190/final"/>
-              </references>
-              <weaknesses>
-                <weakness ref="W-NIST-800-190-01">
-                  <countermeasures>
-                    <countermeasure ref="C-NIST-800-190-02" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-NIST-800-190-02" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="PO-AC-1" name="Misconfigured or incorrectly applied cluster wide roles may result in privilege escalation" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>There are a number of cluster wide roles which can be used to ensure security and integrity within a cluster.&amp;nbsp; Administration of these can be difficult as they can have overlapping interests, and because changes in one area can have implications for others.&amp;nbsp; It is essential to manage these appropriately in order to control access to objects in the cluster.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-AC-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.1.1" mitigation="20"/>
-                    <countermeasure ref="CIS-K-5.1.2" mitigation="16"/>
-                    <countermeasure ref="CIS-K-5.1.3" mitigation="16"/>
-                    <countermeasure ref="CIS-K-5.1.5" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-AC-1.2">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.7.1" mitigation="16"/>
-                    <countermeasure ref="CIS-K-5.7.4" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-5.1.1" mitigation="20"/>
-                <countermeasure ref="CIS-K-5.1.2" mitigation="16"/>
-                <countermeasure ref="CIS-K-5.1.3" mitigation="16"/>
-                <countermeasure ref="CIS-K-5.1.5" mitigation="16"/>
-                <countermeasure ref="CIS-K-5.7.1" mitigation="16"/>
-                <countermeasure ref="CIS-K-5.7.4" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="PO-AS-1" name="Kubernetes uses Secrets to store and manage sensitive information.  If an attacker gains access to these they can use it to attack many other parts of the cluster" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>Kubernetes allows sensitive data such as passwords, tokens or keys to be stored outside of their objects or configuration files. This is a useful security feature, however these secrets must be well protected in order to adequately secure the cluster.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-AS-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.4.1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-AS-1.2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-AS-1.3">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.4.2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-5.4.1" mitigation="34"/>
-                <countermeasure ref="CIS-K-5.4.2" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.10:3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="CP-AA-1" name="Client credentials may be exploited to allow attackers to gain access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>The exploitation of client credentials is a major threat in any system.&amp;nbsp; An adversary with access to client credentials can carry out any activity that the client can.&amp;nbsp; Their activities may also be missed by logging and other security measures as their activities may appear valid.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CP-AA-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-3.1.1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-3.1.1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="PO-AA-1" name="Lack of cluster wide authentication and authorization protocols may result in security gaps from individual development activities" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>&lt;div&gt;
-  In container networking, communications between containers must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled. In terms of applications, communications between containers affect access control-limiting access to network 
-&lt;/div&gt; 
-&lt;div&gt;
-  traffic, resources, and configurations.&amp;nbsp; The absence of cluster wide policies make these difficult to implement on an individual level.&amp;nbsp; This absence can result in information spillage and system compromise. 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-AA-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="PO-G-3" name="Complex requirements for configuring infrastructure may result in critical activities not being carried out" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>There are number of security risks which may be overlooked in container architectures.&amp;nbsp; This may compromise performance or integrity or clusters.&amp;nbsp;&amp;nbsp;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-G-3.1">
-                  <countermeasures>
-                    <countermeasure ref="C-NSA-HG-05" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.8:5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-G-3.2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.12:3" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.9:2" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-NSA-HG-05" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.12:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.12:3" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.8:5" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.9:2" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="PO-G-1" name="Malicious images may compromise security" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>One of the benefits of Kubernetes is the ability to share, download and re-use images.&amp;nbsp; This can greatly improve development and operation time and support collaboration.&amp;nbsp; However images which are not secured can be a mechanism for introducing malicious code etc.&amp;nbsp; to a cluster.&amp;nbsp;&amp;nbsp;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-G-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.5.1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-G-1.2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.1:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.8:1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-G-1.3">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:5" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-5.5.1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.1:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.6:4" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.6:5" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.8:1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="PO-G-2" name="Unrestricted access to system calls make the cluster vulnerable to a variety of attack mechanisms" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>System calls allow programs to request services from the kernel of the operating system they are executed on.&amp;nbsp; &amp;nbsp;They are the only entry points into the kernel system and, if not properly managed, can result in unintentional system complications or targeted attacks from outside.&amp;nbsp;&amp;nbsp;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-G-2.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.7.2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-5.7.2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-auditing" name="Logging and Auditing" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="CP-LA-1" name="Attackers make undetected or unaudited changes or ingress to cluster via the control plane" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>It is very difficult to make sure that no vulnerabilities remain in a system, no matter how good those responsible for security are.&amp;nbsp; This makes it extremely important that logging and monitoring are carried out in order to ensure that exploits are noticed and managed quickly. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In Kubernetes, logging should be configured via the control plane as this allows many other areas of the cluster to be monitored. 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CP-LA-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-3.2.1" mitigation="50"/>
-                    <countermeasure ref="CIS-K-3.2.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-3.2.1" mitigation="50"/>
-                <countermeasure ref="CIS-K-3.2.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="PO-LM-1" name="Lack of infrastructure wide forensics capabilities may result in a lack of sufficient data for security analytics" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>&lt;div&gt;
-  It is vital that the container infrastructure supports digital forensics capabilities that can be integrated into an incident response plan. Applications include image forensics (i.e., investigating the contents of an image), network forensics (i.e., investigating network traffic related to containers by collecting and analyzing netflows and full packet capture), memory forensics (i.e., investigating binaries and related activities in runtime for possible compromise), and log forensics (i.e., investigating host, container, and other infrastructure logs for anomalies and possible signs of compromise). It also ensures the infrastructure collects and provides access to the necessary data sources. 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-LM-1.1">
-                  <countermeasures>
-                    <countermeasure ref="C-NSA-HG-04" mitigation="25"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:3" mitigation="25"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="PO-LM-1.2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:5" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-NSA-HG-04" mitigation="25"/>
-                <countermeasure ref="CSA-SACA-3.1.7:3" mitigation="25"/>
-                <countermeasure ref="CSA-SACA-3.1.7:4" mitigation="25"/>
-                <countermeasure ref="CSA-SACA-3.1.7:5" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="kubernetes-library-devops">
-          <threats>
-            <threat ref="PO-N-1" name="Incorrect network policies may allow dangerous connections between objects in the cluster" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>&lt;div&gt; 
- &lt;div&gt;
-   Network policies are used to specify how groups of pods are allowed to communicate with each other and other network endpoints. NetworkPolicy resources use labels to select pods and define rules which specify what traffic is allowed to the selected pods.&amp;nbsp; &amp;nbsp;Running objects in a cluster without adequate network policies can result in unrestricted access.&amp;nbsp; This is a highly exploitable vulnerability which could be used to target many other areas of the cluster. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt;&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-N-1.1">
-                  <countermeasures>
-                    <countermeasure ref="CIS-K-5.3.2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CIS-K-5.3.2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="PO-N-2" name="Network traffic may be exposed to adversaries" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
-              <desc>&lt;div&gt;
-  Microservices have a higher requirement for secure communication between components than that found in legacy applications. Operators can be challenged to provide a flexible secure network transport between selected components. The absence can result in information spillage and system compromise 
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PO-N-2.1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:3" mitigation="50"/>
-                    <countermeasure ref="CSA-SACA-3.1.9:3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:3" mitigation="50"/>
-                <countermeasure ref="CSA-SACA-3.1.9:3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1006e968-1ec3-4c63-8a76-b10ae091e8da" diagramComponentId="7486815e-1e03-43d0-b427-6437d128637f" ref="13c2109b-c9ef-4146-aa1c-a802b47d48c8" name="Mobile Device Client (Thin)" desc="" library="" parentComponentRef="" componentDefinitionRef="mobile-device-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
-                        common that they deserve a special kingdom of their own. As with "API Abuse", there
-                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
-                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
-                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
-                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
-                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
-                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
-                        without restricting how much is copied. Other variants exist, but the existence of a classic
-                        overflow strongly suggests that the programmer is not considering even the most basic of
-                        security protections.
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
-              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software provides an Applications Programming Interface (API) or similar interface for
-                        interaction with external actors, but the interface includes a dangerous method or function that
-                        is not properly restricted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
-                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
-                        leverage them to obtain information about the app.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
-                        attackers can leverage them to obtain information about the app.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
-
-When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.913">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application can be deployed with active debugging code that can create unintended entry
-                        points.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
-                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>For Android:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For iOS:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
-            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-          </references>
-          <standards>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
-            <reference name="OWASP MASVS - iOS - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the set of protocol handlers are deactivated.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.262">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.6" name="Anonymize all data that is sent to 3rd Party services" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data that is sent to 3rd Party services shall be anonymized, so no PII data is available that would allow the 3rd party to identify the user account. Also all other data, like IDs in an application that can be mapped to a user account or session should not be sent to a third party.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-            <reference name="OWASP MASVS - iOS - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#determining-whether-sensitive-data-is-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-          </references>
-          <standards>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all data that is sent to 3rd Party services is anonymized.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
-          </references>
-          <standards>
-            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
-            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the exceptions are well-designed and are catched and handled well.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#checking-for-weaknesses-in-third-party-libraries-mstg-code-5"/>
-            <reference name="OWASP MASVS - iOS - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings"/>
-          </references>
-          <standards>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; or &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Platform Interaction Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x11-v6-interaction_with_the_environment"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
-            <reference name="OWASP MASVS - iOS - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Best Practices for Passwords" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
-&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
-&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#testing-the-device-access-security-policy-mstg-storage-11"/>
-            <reference name="OWASP MASVS - iOS - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-local-data-storage-mstg-storage-1-and-mstg-storage-2"/>
-          </references>
-          <standards>
-            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app verifies the mobile device complies with the minimum
-                            device-access-security policy.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
-            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the application denies access to the session when the exceptions appear.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-javascript-execution-in-webviews-mstg-platform-5"/>
-            <reference name="OWASP MASVS - iOS - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-ios-webviews-mstg-platform-5"/>
-          </references>
-          <standards>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Search in the code the following instruction:
-                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
-                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;For iOS:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
-                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
-                            setJavaScriptEnabled:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [conf setPreferences:pref]; _webView = [[WKWebView
-                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
-                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [_webView loadRequest:request];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [self.view addSubview:_webView]; }
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
-          </references>
-          <standards>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the clipboard is disabled when sensitive data is used.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
-                        Android O and the behavior of MAC addresses have changed in Android N.
-
-                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
-                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
-                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
-                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
-                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
-                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
-                        they request the Build.Serial.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-device-binding-mstg-resilience-10"/>
-            <reference name="OWASP MASVS - iOS - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#device-binding-mstg-resilience-10"/>
-          </references>
-          <standards>
-            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
-                            authenticate).&lt;/li&gt;
-                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;ol&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;exit the current user&lt;/li&gt;
-                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
-                            shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
-                            working properly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Log Class&lt;/li&gt; 
- &lt;li&gt;Logger Class&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
-&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;NSLog Method&lt;/li&gt; 
- &lt;li&gt;printf-like function&lt;/li&gt; 
- &lt;li&gt;NSAssert-like function&lt;/li&gt; 
- &lt;li&gt;Macro&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage"/>
-            <reference name="OWASP MASVS - iOS - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage"/>
-          </references>
-          <standards>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-          </references>
-          <standards>
-            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all executable files and libraries belonging to the app are encrypted or
-                            packed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that sensitive data is not stored in plain text.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
-                        including stealthy responses that don't simply terminate the app.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05c-reverse-engineering-and-tampering"/>
-            <reference name="OWASP MASVS - iOS - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06c-reverse-engineering-and-tampering"/>
-          </references>
-          <standards>
-            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the app implements multiple different responses to tampering, debugging and
-                            emulation, including stealthy responses that don't simply terminate the app.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing the Security Provider" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-the-security-provider-mstg-network-6"/>
-          </references>
-          <standards>
-            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-root-detection-mstg-resilience-1"/>
-            <reference name="OWASP MASVS - iOS - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#jailbreak-detection-mstg-resilience-1"/>
-          </references>
-          <standards>
-            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
-                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
-            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
-          </references>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
-                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
-                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
-                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
-                        the goal of protecting against memory patches applied during runtime. This includes unwanted
-                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
-                        well as rogue code loaded into process memory.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;div&gt;
-                        Integrity can be verified either by:&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
-                        values.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
-            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
-          </references>
-          <standards>
-            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
-                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
-                            responds accordingly.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
-                        the app is running inside an emulator, the app shall terminate the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
-          </references>
-          <standards>
-            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
-                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
-                        is detected, the app shall force termination of the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
-            <reference name="OWASP MASVS - iOS - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
-          </references>
-          <standards>
-            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Launch the app systematically with various apps and frameworks installed, such as the
-                            following:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
-                        features can be preventive or reactive. As the name implies, preventive anti-debugging
-                        techniques prevent the debugger from attaching in the first place, while reactive techniques
-                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
-                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
-                        combine multiple methods of prevention and detection which operate on different API layers and
-                        are distributed throughout the app.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
-            <reference name="OWASP MASVS - iOS - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
-          </references>
-          <standards>
-            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
-                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
-                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
-                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
-                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
-                            or other sources);&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
-                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Remove the debugging code, log verbose errors or debugging messages in the production version.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing for Debugging Code and Verbose Error Logging" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-          </references>
-          <standards>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
-                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-          </references>
-          <standards>
-            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Java Objects Are Exposed Through WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#determining-whether-java-objects-are-exposed-through-webviews-mstg-platform-7"/>
-          </references>
-          <standards>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>- Produce a JavaScript payload.
-                            - Inject it into the file that the app is requesting. The injection could be done either
-                            through a MITM attack or by directly modifying the file in case it is stored on external
-                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
-                            exploitation payload) which is able to install a full agent, injecting a limited agent into
-                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
-                            - Check that only the JavaScript provided with the app is allowed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>As a general rule of thumb, as little explanative information as possible should be provided
-                        along with the compiled code. Some metadata such as debugging information, line numbers and
-                        descriptive function or method names make the binary or bytecode easier to understand for the
-                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
-                        discarded without impacting the functionality of the app.
-
-                        This data shall be removed from the release version or shall be obfuscated in order to be
-                        inaccessible to the reverse engineer.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
-            <reference name="OWASP MASVS - iOS - Testing for Debugging Symbols" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-symbols-mstg-code-3"/>
-          </references>
-          <standards>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Symbols are usually stripped during the build process, so you need the compiled byte-code
-                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
-                            nm binary in your Android NDK and export it (or create an alias).
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            export $NM =
-                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            To display debug symbols:
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ $NM -a
-                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
-                            libfoo.so: no symbols&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;To display dynamic symbols:
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            $ $NM -D libfoo.so&amp;nbsp;
-                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
-                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
-                            Adding this flag causes gcc to discard the function names while still preserving the names
-                            of functions declared as JNIEXPORT.&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            Check if the following was added to build.gradle:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
-                            binutils and can be installed via Homebrew on Mac OS X.
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing App Permissions" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide"/>
-            <reference name="OWASP MASVS - iOS - Testing Custom URL Schemes" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-app-permissions-mstg-platform-1"/>
-          </references>
-          <standards>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android applications:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
-                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
-                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
-                            permissions needed by the application.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Verifying Data Encryption on the Network" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04f-testing-network-communication"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
-  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This kind of vulnerability occurs in a number of ways: 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing for Memory Management Bugs" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04h-testing-code-quality#memory-corruption-bugs-mstg-code-8"/>
-          </references>
-          <standards>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
-                            gain access to the system.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.261">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
-          </references>
-          <standards>
-            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
-            <reference name="OWASP MASVS - iOS - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
-          </references>
-          <standards>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app is correctly signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker attempts to invoke all common switches and options in the target
-                                application for the purpose of discovering weaknesses in the target. For example, in
-                                some applications, adding the --debug switch causes debugging information to be
-                                displayed, which can sometimes reveal sensitive processing or configuration information
-                                to an attacker.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                This attack differs from other forms of API abuse in that the attacker is blindly
-                                attempting to invoke options in the hope that one of them will work rather than
-                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
-                                with the published options of a targeted application this attack method may still be
-                                fruitful as it might discover unpublicized functionality.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-215">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-489">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-656">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MEMORY-LEAKAGE">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="OUTDATED-LIBRARIES">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of an object, resource,
-                                or system by using a variety of analysis techniques to effectively determine how the
-                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
-                                duplicate the function, or a part of the function, of an object in order to duplicate or
-                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
-                                or software, although the methodology and techniques involved in each type of analysis
-                                differ widely. When adversaries are reverse engineering software, methodologies fall
-                                into two broad categories, 'white box' and 'black box.' White box techniques involve
-                                methods which can be applied to a piece of software when an executable or some other
-                                compiled object can be directly subjected to analysis, revealing at least a portion of
-                                its machine instructions that can be observed upon execution.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                'Black Box' methods involve interacting with the software indirectly, in the absence of
-                                the ability to measure, instrument, or analyze an executable object directly. Such
-                                analysis typically involves interacting with the software at the boundaries of where the
-                                software interfaces with a larger execution environment, such as input-output vectors,
-                                libraries, or APIs.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="MASVS-EMULATION-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                <countermeasure ref="MASVS-8.7" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>If the mobile application requests permissions or access to components that are not
-                                strictly needed by the application, then users can lose trust in the security of the
-                                application with an associated impact on the trust placed in the application provider.</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                <countermeasure ref="MASVS-8.1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-732">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                <countermeasure ref="MASVS-4.9" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker employs forceful browsing to access portions of a website that are
-                                otherwise unreachable through direct URL entry.
-
-                                Usually, a front controller or similar design pattern is employed to protect access to
-                                portions of a web application.
-
-                                Forceful browsing enables an attacker to access information, perform privileged
-                                operations and otherwise reach sections of the web application that have been improperly
-                                protected.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-749">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-83">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                <countermeasure ref="MASVS-6.7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>Errors and error handling represent a class of API. Errors related to error handling
-                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
-                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-388">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                <countermeasure ref="MASVS-7.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
-              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
-                                operations, typically triggered by input injected by an attacker. As a consequence, an
-                                attacker is able to write past the boundaries of allocated buffer regions in memory,
-                                causing a program crash or potentially redirection of execution as per the attackers'
-                                choice.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-120">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="610557e7-471f-40e5-9ccf-ffe2e2693a10" diagramComponentId="72530ff3-013e-49f7-bc35-ad38d5f1493e" ref="f6ea0329-f94b-4e27-a510-eadd4157f49c" name="PAPI (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.439">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.261">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.032">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.262">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.262">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.378">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.122">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.958">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="0f839a14-0407-49f1-8bd1-c67e0b76c630" diagramComponentId="7517f366-9096-4e95-bd7c-0f4a737fd1da" ref="ccb00b1b-d74c-493e-b274-1a53a5a1755e" name="AWS API Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The administrator accounts are used for all actions, not only for administrative actions. This
-                        is because these users have not got a personal or a user account to do the daily actions.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.557">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.162">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of a command using
-                    externally-influenced input from an upstream component, but it does not
-                    neutralize or incorrectly neutralizes special elements that could modify the
-                    intended command when it is sent to a downstream
-                    component.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.163">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.559">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.163">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>This weakness occurs when the application transmits or stores
-                    authentication credentials and uses an insecure method that is susceptible to
-                    unauthorized interception and/or retrieval.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
-          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
-                        accounts are not configured.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
-  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
-  &lt;li&gt;Select "Policies".&lt;/li&gt; 
-  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
-  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
-  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
-  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;i&gt; {&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Statement": [{&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Action": [&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; ],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt; }]&lt;/i&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;i&gt;}&lt;/i&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
-  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
- &lt;/ul&gt; &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that MFA is forced on a policy:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
-                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
-  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
-  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
-  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
-  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
-                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
-                            $1,$9,$14}'&lt;/li&gt;
-                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
-                            access_key_2_active are false.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
-&lt;br&gt; 
-&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws iam create-credential-report
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
-                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
-                            addition to the above set up a metric filter as described elsewhere in this library to
-                            determine ad-hoc use of root.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Choose a minimum TLS version for a custom domain in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  When you create a custom domain, you specify the security policy for it. 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
-              <output/>
-            </source>
-            <references>
-              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Control and manage access to a REST API in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use the following mechanisms for authentication and authorization: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. IAM tags can be used together with IAM policies to control access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
-                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
-                        changes. AWS config tracks configuration changes within the environment and is a useful change
-                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
-                        configuration items.
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws logs put-metric-filter&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
-                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
-                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        aws cloudwatch put-metric-alarm&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --statistic Sum&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --period 300&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --threshold 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --evaluation-periods 1&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        --alarm-actions &amp;lt;topic_arn&amp;gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
-                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
-                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
-                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
-                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
-                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
-                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
-                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-  &lt;li&gt;Select IAM.&lt;/li&gt; 
-  &lt;li&gt;Select Users.&lt;/li&gt; 
-  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
-  &lt;li&gt;Complete the required information.&lt;/li&gt; 
-  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
-  &lt;li&gt;Click "Create".&lt;/li&gt; 
-  &lt;li&gt;Select the user.&lt;/li&gt; 
-  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
-  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
-  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
-  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
- &lt;/ol&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that each user has got the corresponding account with the corresponding
-                            credentials.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Create Route 53 alias records for API endpoints 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
-              <output/>
-            </source>
-            <references>
-              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that free-form fields do not contain sensitive data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a REST API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Do one of the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create an API and deploy it to a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Logs/Tracing in the Stage Editor. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable execution logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable CloudWatch Logs under CloudWatch Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Error or Info from the dropdown menu. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If desired, choose Enable Detailed CloudWatch Metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable access logging: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Enable Access Logging under Custom Access Logging. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can enable execution logging and access logging independent of each other. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test your logging setup&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
-&lt;/div&gt; 
-&lt;div&gt;
-  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
-              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Monitor REST API execution with Amazon CloudWatch metrics 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can access CloudWatch using any of the following methods: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Amazon CloudWatch console 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS CLI&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  CloudWatch API 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS SDKs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose the name of the API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. Under the selected API, choose Dashboard. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Use From and To to enter the date range. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
-                        source of identifying whether unintentional or malicious changes have occurred to resources with
-                        the AWS account.
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;br /&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
-                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
-                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
-                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
-                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
-                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;br /&gt;&amp;nbsp;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
-                            remediation section&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
-                            corner of the AWS management console to do this).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
-                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
-                        regions, even if they are not being used, to identify unintended or accidental changes.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;:
-                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
-                        &lt;br /&gt;
-                        &lt;blockquote&gt;
-                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
-                        --is-multi-region-trail
-                        &lt;/blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
-                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable payload compression by using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose an existing API or create a new one. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Another way is to use AWS CLI to create a new API and enable compression. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   1. Sign in to the API Gateway console. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   2. Choose a REST API. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   3. In the Resources pane, choose the method you want to test. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   For additional options you may need to specify, contact the API owner. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   5. Choose Test. The following information will be displayed: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
-   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
-   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
-   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
-   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
-   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
-              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If you choose to enable caching for a REST API, you can enable cache encryption. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To configure API caching for individual methods using the console: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Go to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stages list for the API, expand the stage and choose a method in the API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Override for this method in Settings. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-   &lt;b&gt;Remediation:&lt;/b&gt; 
-   &lt;br&gt; 
-   &lt;ol&gt; 
-    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
-    &lt;li&gt;Select IAM.&lt;/li&gt; 
-    &lt;li&gt;Select Users.&lt;/li&gt; 
-    &lt;li&gt;For each user:&lt;/li&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Select the user.&lt;/li&gt; 
-     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
-     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
-     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
-     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
-     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
-     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
-     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/ol&gt;
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
-                            &lt;li&gt;The following command displays a list of all IAM users along with their password
-                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
-                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
-                            to true.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
-  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
-  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
-  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
-  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
-  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
-  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; 
- &lt;br&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
-                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Enable request validation in API Gateway 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
-            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Test basic request validation using the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The following steps describe how to test basic request validation in the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To test the request validation on a method using TestInvoke in the API Gateway console 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  While signed in to the API Gateway console, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Resources for the API that you've configured a request validators map for. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose a method for which you have enabled the request validation with a specified request validator. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Method Execution, in the Client box, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Invalid request body" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the request parameters aren't valid, the following error message returns: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
-&lt;/div&gt; 
-&lt;div&gt;
-  } 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Content-Type: application/json 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: apigateway.us-east-1.amazonaws.com 
-&lt;/div&gt; 
-&lt;div&gt;
-  X-Amz-Date: 20170603T200400Z 
-&lt;/div&gt; 
-&lt;div&gt;
-  Authorization: AWS4-HMAC-SHA256 Credential=... 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; "patchOperations" : [ 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; { 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; &amp;nbsp; } 
-&lt;/div&gt; 
-&lt;div&gt;
-  &amp;nbsp; ] 
-&lt;/div&gt; 
-&lt;div&gt;
-  }&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of update-stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update the backend server to remove the old certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt;
-  or by calling the CLI command of delete-client-certificate: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
-&lt;/div&gt; 
-&lt;div&gt;
-  To rotate a client certificate in the console for a previously deployed API, do the following: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the main navigation pane, choose Client Certificates. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Client Certificates pane, choose Generate Client Certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Open the API for which you want to use the client certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Stages under the selected API and then choose a stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To save the settings, choose Save Changes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You need to redeploy the API for the changes to take effect. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Set up a stage for a REST API 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Create a new stage 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the APIs navigation pane, choose Stages under an API. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Stages navigation pane, choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Optionally, enter a stage description for Stage description. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Choose Create. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  To see your Stages follow the steps below: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Sign in to the API Gateway console. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. In the APIs pane, choose the API, and then choose Stages. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  3. In the Stages pane, choose the name of the stage. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
-              <output/>
-            </source>
-            <references>
-              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  To get started with AWS Secrets Manager: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Identify your secrets and locate where they are used in your applications. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
-&lt;/div&gt; 
-&lt;div&gt;
-  Update your applications to retrieve secrets from Secrets Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Enable AWS Shield. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
-              <output/>
-            </source>
-            <references>
-              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
-              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt; 
-  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
- &lt;/div&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can do this by: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
-  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Rationale: 
-&lt;/div&gt; 
-&lt;div&gt;
-  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Remediation: 
-&lt;/div&gt; 
-&lt;div&gt;
-  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: 
-&lt;/div&gt; 
-&lt;div&gt;
-  None 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt; 
- &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  1. Choose an API method. In Client, choose Test. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  2. From Client Certificate, choose Test to invoke the method request. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
-              <output/>
-            </source>
-            <references>
-              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
-&lt;p&gt;aws kms create-key&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
-            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
-            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                Attackers could gain unauthorized access to the administrator account due to the lack of
-                                the account and its security mechanisms, like modifying credentials and adding/removing
-                                user accounts.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.1">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.6">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-IAM-2.8">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-522">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
-                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-77">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
-                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
-                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="e4d3929a-d4a5-4161-ba39-a0ee4e7deff4" diagramComponentId="02532cf7-ee4c-45fd-ac72-8d049dbcb2d0" ref="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe" name="AWS ELB (Elastic Load Balancer)" desc="" library="" parentComponentRef="" componentDefinitionRef="load-balancer">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.056">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
-          <desc>We do not have our resources current status and as a result lose control of some resources,
-                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;br&gt; 
-&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;br&gt; 
-&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
-&lt;br&gt; 
-&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;br&gt; 
-&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
-&lt;br&gt; 
-&lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;br&gt; 
-&lt;br&gt; Using the Amazon unified command line interface: 
-&lt;ul&gt; 
- &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
-  &lt;blockquote&gt;
-    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-  &lt;/blockquote&gt; &lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
-            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
-          </references>
-          <standards>
-            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Through Auto-Scaling Group configuration you can define: 
-  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
-  Availability Zones / subnets used 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   or 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.302">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of the instances that are healthy at the time of the health check is InService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
-          </references>
-          <standards>
-            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div style=""&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;div style=""&gt;
-    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
-            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
-            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
-          </references>
-          <standards>
-            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
-                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
-                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
-                        engineered to be isolated from failures in other Availability Zones. By launching instances in
-                        separate Availability Zones, you can protect your applications from the failure of a single
-                        location. AWS assigns a unique ID to each subnet.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
-                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
-                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
-                        in a VPC, the CIDR blocks of the subnets must not overlap.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
-                        where possible.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
-                        fault tolerance and high availability from the perspective of resource deployment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-subnet --vpc-id application_vpc
-                        --cidr-block desired_cidr
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 create-tags --resources web_tier_elb_subnet1
-                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
-            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
-            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
-          </references>
-          <standards>
-            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  OR 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  When an internal load balancer is created, it receives a public DNS name with the following form: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   internal-name-123456789.region.elb.amazonaws.com 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
-            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
-          </references>
-          <standards>
-            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The SG associated with the App tier ELB should allow connectivity from the security group
-                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
-                        the application design.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
-                        ELB:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
-                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; },
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
-                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
-                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
-                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &amp;nbsp; &amp;nbsp; }
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        ]
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
-                        --ip-permissions file:///PathTo/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        A security group acts as a virtual firewall for your instance to control inbound and outbound
-                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
-                        instance to up to five security groups. Security groups act at the instance level, not the
-                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
-                        set of security groups. If you don't specify a particular group at launch time, the instance is
-                        automatically assigned to the default security group for the VPC.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        For each security group, you add rules that control the inbound traffic to instances, and a
-                        separate set of rules that control the outbound traffic.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This is required for both the configured port and protocol for the listener on the back-end
-                        instance and the port and protocol used for the health check.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
-                        security group rules that allow traffic for the specific application protocol and ports by
-                        referencing as source the security group associated with the App tier ELB.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        Using the Amazon unified command line interface:
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
-                        element from Audit procedure):&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 describe-security-groups --group-id app_tier_security_group
-                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div style=""&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
-                        --ip-permissions file:///tmp/IpPermissions.json
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
-                        App tier ELB security group as the source of the connections:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &lt;div style=""&gt;
-                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
-                        --protocol tcp --port specific_port
-                        --source-group app_tier_elb_security_group
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
-                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
-                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
-                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A security group acts as a virtual firewall for your instance to control inbound and 
-  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
-            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
-          </references>
-          <standards>
-            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
-          </references>
-          <standards>
-            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;quot;AccessLog&amp;quot;: { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
-            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
-            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
-          </references>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Via Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all ELB's:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation&lt;/b&gt;: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
-            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
-            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
-            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
-            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
-            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
-          </references>
-          <standards>
-            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws iam list-server-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  For Amazon Certificate Manager users: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm list-certificates 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
-                        establishing a new connection supporting the Server Order Preference option. When this option is
-                        selected, the load balancer selects the first cipher in its list that is in the client's list of
-                        ciphers.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
-                        &lt;br /&gt;To enable Server Order Preference:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Click Save. &lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
-                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  In order to use HTTPS, an SSL\TLS certificate must be attached. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
- &lt;/div&gt; 
- &lt;div style=""&gt;
-   "OriginProtocolPolicy": "https-only", 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
-            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
-          </references>
-          <standards>
-            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
-                            distributions (it should be set as https-only):&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
-                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;b&gt;Description&lt;/b&gt;:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  Each tag consists of a key and an optional value, both of which customer's define.
-  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ol&gt;
-  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
-  &lt;li&gt;ELB&lt;/li&gt;
-  &lt;li&gt;EBS Volumes&lt;/li&gt;
-  &lt;li&gt;S3 Buckets&lt;/li&gt;
- &lt;/ol&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-  A resource may have up to 10 tags associated with key &amp;amp; value such as:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
-  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
-  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
- &lt;/ul&gt;
- &lt;div&gt;
-  &lt;b&gt;Remediation:&lt;/b&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;&lt;br&gt;&lt;/b&gt;
-  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
-            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify tags are being used.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
-  &lt;div style=""&gt; 
-   &lt;br /&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; }, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     &amp;nbsp; &amp;nbsp; } 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     ] 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt;
-  note the security group id from the output 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;div&gt;
-    Using the Amazon unified command line interface: 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt; 
-    &lt;div&gt;
-      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
-            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
-            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
-          </references>
-          <standards>
-            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
-                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
-                        through the use of a unique random session key, and therefore prevents the decoding of captured
-                        data, even if the secret long-term key is compromised.
-                        &lt;br /&gt;
-                        &lt;br /&gt;
-                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
-                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
-                            Cryptography (ECDHE) cipher suites.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-295">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
-                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.13" mitigation="9"/>
-                    <countermeasure ref="aws-tier-6.17" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.19" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.21" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.22" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.1">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.1" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.1" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.14" mitigation="7"/>
-                    <countermeasure ref="aws-tier-3.15" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.18" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.26" mitigation="7"/>
-                    <countermeasure ref="aws-tier-6.5" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
-                <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.1" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.14" mitigation="7"/>
-                <countermeasure ref="aws-tier-3.15" mitigation="7"/>
-                <countermeasure ref="aws-tier-5.1" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.13" mitigation="9"/>
-                <countermeasure ref="aws-tier-6.17" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.18" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.19" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.21" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.22" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.26" mitigation="7"/>
-                <countermeasure ref="aws-tier-6.5" mitigation="7"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;div&gt;
-                                If audit trails in the resources are not enabled or not protected, attackers could gain
-                                access to the system and modify or delete data from the resources and the changes are
-                                not detected.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Logging-3.4">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="unknown-resource-status">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
-                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
-                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="814fa76c-86db-4a48-9df4-2a82622be208" diagramComponentId="57178aca-be31-4a19-8633-871b17b715ef" ref="002e1e5c-362a-4bda-99d7-8cef7bbaa4a0" name="MAMI (MySQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="mysql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.173">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.892">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.525">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.894">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.893">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:11.951">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.651">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="38a708d4-aa61-41fe-8799-181f8b863c2e" diagramComponentId="676b98cb-4093-4c6e-858b-58e36d66002e" ref="8d17dfe4-5356-46dd-a180-c69b965f58d8" name="Istio (Default GW)" desc="" library="" parentComponentRef="" componentDefinitionRef="service-mesh">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="SM-LM-1" name="Complexity of configuring infrastructure wide forensics capabilities may result in a lack of sufficient data for security analytics" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice whose performance must be monitored, both for security and performance purposes.&amp;nbsp; In complex architectures it can be difficult to track and use metrics effectively. Monitoring and logging capabilities which are not centralized take much longer to review and increase the risk of critical information being overlooked.&amp;nbsp; This increases the risk of poor performance, and of malicious activities being carried out undetected.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SM-G-1" name="Insufficient configuration of architecture may degrade performance" state="0" impact="100" issueId="" issueLink="">
-          <desc>Security risks for microservices includes not only access to unauthorized information, but also&amp;nbsp; protection of the features which affect performance, integrity, and quality of service.&amp;nbsp; Architectures must be configured to take these factors into account. With microservices, service-to-service communication becomes a fundamental determining factor for how applications behave at runtime.&amp;nbsp; This has implications both for security and performance. Microservices must be configured to ensure that only authorized users can access resources, and that resources are not overused or abused.&amp;nbsp; &amp;nbsp;Overuse will effect the resource usage of others in a shared environment. The absence of such configurations may result in a DOS-style scenario.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SM-AC-1" name="Multiple services create challenges for access control" state="0" impact="100" issueId="" issueLink="">
-          <desc>With a service mesh, it is possible to ensure that encryption and granular access control rules are put into place across an organization, in a way that can be centrally controlled.&amp;nbsp; However configuring this kind of access can be a challenge due to the amount and variety of internal services.&amp;nbsp;&amp;nbsp; Access policies need to be robust in order to ensure that access is controlled throughout the microservice.&amp;nbsp; Inadequate policies may result in gaps in security which allow unauthorized access to the system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SM-N-1" name="Network traffic is vulnerable to adversaries" state="0" impact="100" issueId="" issueLink="">
-          <desc>The tremendous increase in the number of components in a microservices-based application system, combined with complex network environments comprised of various interaction styles among components,&amp;nbsp; makes secure network configuration difficult.&amp;nbsp; Implementing this into core infrastructure frameworks such as a service mesh can provide mitigation. To secure connected systems, networks need to segment traffic between logical zones.&amp;nbsp; This can protect applications from adversaries, as well as limit the 'blast radius' in the case of a breach.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.156">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MM-SS-13(6)" name="Configure Layer 3 network segmentation to complement the Layer 5 network segmentation" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Layer 3 network segmentation must be configured within the orchestrator platform to complement the Layer 5 network segmentation achieved throughout the service mesh layer. This countermeasure helps mitigate the threat of malicious actors circumventing or bypassing the sidecar proxy that the service mesh uses for firewalling and blocking network traffic.&amp;nbsp; This applies to highly sensitive microservices-based applications</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-13(1)" name="Provide policy support for designating communication protocol and specifying the traffic load between services" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A service mesh should facilitate management of service-to-service communication in a way that makes it visible, manageable, and controlled.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policies should provide support for this based on the needs of the specific architecture in question. This allows the relevant logic to be decoupled from applications.&amp;nbsp; Removing this responsibility from developers of individual applications makes it more likely that the correct protocols will be applied consistently and comprehensively across the architecture. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-13(5)" name="Service mesh deployments should have configuration capabilities to collect and send environment metrics" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A service mesh is a networking infrastructure that leverages "sidecar" proxies for microservice deployments. Sidecar proxies should be able to capture both upstream and downstream communication, providing complete visibility into the external performance of all the services. Service mesh deployments should have configuration capabilities to collect and send environment metrics, including request metrics, to a centralized service for monitoring. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This insight into service traffic means that a service mesh and can expose metrics in a consistent way, irrespective of different programming languages and frameworks.&amp;nbsp; It is important to choose a service mesh which offers these capabilities, and to fully utilize them in any deployments. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Policies should allow for specifying either a single service mesh or multiple service meshes (each with their own control plane) for multi-cluster microservices environments to ensure high availability and resiliency in those scenarios. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-13(4)" name="Service mesh deployments should have configuration capabilities to specify resource usage limits for its components" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Service mesh deployments should have configuration capabilities to specify resource usage limits for its components. The absence of this feature creates the potential for these components to impact the resiliency and availability of the overall microservices application.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-13(2)" name="The default configuration should always enable access control policies for all services" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Controls should be applied at the earliest possible stages in order to ensure that all eventualities are covered.&amp;nbsp; Insisting that all access control is enabled by default for all services reduces the risk of objects being created or launched without strong levels of protection.&amp;nbsp; This forces developers and operators to ensure that services are protected and reduces the risk of controls being overlooked either accidentally, or to ease workflow and development time.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-control" name="Access control" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNUSED-ENDPOINTS" name="Attackers exploit deprecated or unused endpoints to access unauthorized resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>Endpoints that are exposed when they shouldn't be or have been forgotten but haven't any kind of security control might be a vector attack</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SM-AC-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-13(2)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-13(2)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-13(1)" mitigation="50"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-13(4)" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-13(1)" mitigation="50"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-13(4)" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SM-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-13(5)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-13(5)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CWE-311" name="Attackers gain unauthorised access to the administrative interface by sniffing the network" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>An attacker can sniff the credentials which are transmitted over the network and hence
-                                gain access
-                                to the administration interface.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SM-N-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MM-SS-13(6)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MM-SS-13(6)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="59aac4bf-e1c3-4e8d-9705-2a8b7a8103e7" diagramComponentId="96efc032-fc11-47c8-9353-3c3517e89036" ref="2a0c2a53-d710-4930-986d-4db95b02f292" name="Auth-Service (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.388">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.772">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.544">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="505ad18d-9ef9-409c-9258-2edbef1d68a1" diagramComponentId="32b19da8-2e0e-4466-ba3d-b810bd897dce" ref="27c24a08-02f8-4fb7-b790-7e3db361c53d" name="Access-Rights (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.160">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.411">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.627">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.095">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.259">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.548">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="4629a842-2b18-4685-aa10-656bfd206e8d" diagramComponentId="0b957c33-6ebf-466c-8b70-6ca40e27947f" ref="b6dd5f39-9243-4289-b561-566f0a1ff4fb" name="BFF API" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.400">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.399">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.343">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="9ed1fb76-665a-4e06-970c-215d3b4441c8" diagramComponentId="7276a5e6-cae0-4feb-801b-5de8fa0b9e5e" ref="a928a2dc-08c7-4b68-a594-2fa6325ab3d3" name="Docker Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="docker-environment">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-  </components>
-</template>

From 739e94982611667fbbfd03c5286e209eb363bd28 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:23:14 -0400
Subject: [PATCH 20/28] Delete Templates/ml-ai-example-template.xml

---
 Templates/ml-ai-example-template.xml | 8202 --------------------------
 1 file changed, 8202 deletions(-)
 delete mode 100644 Templates/ml-ai-example-template.xml

diff --git a/Templates/ml-ai-example-template.xml b/Templates/ml-ai-example-template.xml
deleted file mode 100644
index 3c53d23..0000000
--- a/Templates/ml-ai-example-template.xml
+++ /dev/null
@@ -1,8202 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="ml-ai-example-template" name="ml-ai-example template" tags="">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjIzMiIgZHk9IjEwMTEiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODI3IiBwYWdlSGVpZ2h0PSIxMTY5IiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNi4wLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48b2JqZWN0IGxhYmVsPSIiIGlkPSI3NyI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEgMjtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNDg4IiB5PSItNjUiIHdpZHRoPSIxMTc2IiBoZWlnaHQ9IjE1NyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9Izk5OTlGRjtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jMDA3RkZGO2ZpbGxDb2xvcj0jRkZGRkZGO2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEyIDEyOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jOTk5OUZGO3N0cm9rZVdpZHRoPTI7Zm9udFNpemU9MTQ7Zm9udENvbG9yPSMwMDdGRkY7ZmlsbENvbG9yPSNGRkZGRkY7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49MTIgMTI7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTQ4MCIgeT0iMTE0IiB3aWR0aD0iMjYyIiBoZWlnaHQ9IjE0NyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTAwIiB5PSItMTE4IiB3aWR0aD0iMzA0IiBoZWlnaHQ9IjYxNCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJXZWIgVUkiIHN0eWxlPSJpci5yZWY9MjlkOGYxOTItMzVlOC00NzlkLThiZmQtMzQ1NWY0ZDNjYmU1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xNDtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi11aTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16WXpOalkwSURBdU16ZzJOekZETUM0ek9UazJOemNnTUM0ek9EWTNNU0F3TGpReU9URTFOeUF3TGpReE5EWTRPU0F3TGpRek1UVTFNU0F3TGpRMU1EQTVOa3d3TGpRek1UY3dPQ0F3TGpRMU5EYzFORll3TGpnd01qVXpOa013TGpRek1UY3dPQ0F3TGpnek9EVTBPU0F3TGpRd016Y3lPU0F3TGpnMk9EQXlPU0F3TGpNMk9ETXlNaUF3TGpnM01EUXlNMHd3TGpNMk16WTJOQ0F3TGpnM01EVTRTREF1TVRrM05ETTRRekF1TVRZeE5ESTFJREF1T0Rjd05UZ2dNQzR4TXpFNU5EWWdNQzQ0TkRJMk1ERWdNQzR4TWprMU5USWdNQzQ0TURjeE9UUk1NQzR4TWprek9UVWdNQzQ0TURJMU16WldNQzQwTlRRM05UUkRNQzR4TWprek9UVWdNQzQwTVRnM05DQXdMakUxTnpNM015QXdMak00T1RJMk1TQXdMakU1TWpjNElEQXVNemcyT0RZM1REQXVNVGszTkRNNElEQXVNemcyTnpGSU1DNHpOak0yTmpSYVRUQXVNell6TmpZMElEQXVORE15TURjelNEQXVNVGszTkRNNFF6QXVNVGcxT1RVMklEQXVORE15TURjeklEQXVNVGMyTkRZMklEQXVORFF3TmpBMklEQXVNVGMwT1RZMElEQXVORFV4TmpjM1REQXVNVGMwTnpVM0lEQXVORFUwTnpVMFZqQXVPREF5TlRNMlF6QXVNVGMwTnpVM0lEQXVPREUwTURFNElEQXVNVGd6TWprZ01DNDRNak0xTURnZ01DNHhPVFF6TmpFZ01DNDRNalV3TVV3d0xqRTVOelF6T0NBd0xqZ3lOVEl4TjBnd0xqTTJNelkyTkVNd0xqTTNOVEUwTmlBd0xqZ3lOVEl4TnlBd0xqTTRORFl6TmlBd0xqZ3hOalk0TkNBd0xqTTROakV6T0NBd0xqZ3dOVFl4TTB3d0xqTTROak0wTlNBd0xqZ3dNalV6TmxZd0xqUTFORGMxTkVNd0xqTTROak0wTlNBd0xqUTBNekkzTWlBd0xqTTNOemd4TWlBd0xqUXpNemM0TWlBd0xqTTJOamMwTVNBd0xqUXpNakk0VERBdU16WXpOalkwSURBdU5ETXlNRGN6V2swd0xqTXdNekk0TkNBd0xqY3pORFE1TVVNd0xqTXhOVGd4TVNBd0xqY3pORFE1TVNBd0xqTXlOVGsyTlNBd0xqYzBORFkwTmlBd0xqTXlOVGsyTlNBd0xqYzFOekUzTTBNd0xqTXlOVGsyTlNBd0xqYzJPRFkxTlNBd0xqTXhOelF6TXlBd0xqYzNPREUwTlNBd0xqTXdOak0yTWlBd0xqYzNPVFkwTjB3d0xqTXdNekk0TkNBd0xqYzNPVGcxTkVnd0xqSTFOemc0TjBNd0xqSTBOVE0ySURBdU56YzVPRFUwSURBdU1qTTFNakExSURBdU56WTVOams1SURBdU1qTTFNakExSURBdU56VTNNVGN6UXpBdU1qTTFNakExSURBdU56UTFOamtnTUM0eU5ETTNNemdnTUM0M016WXlJREF1TWpVME9EQTVJREF1TnpNME5qazRUREF1TWpVM09EZzNJREF1TnpNME5Ea3hTREF1TXpBek1qZzBXazB3TGpjNE56SXpNU0F3TGpFME5EYzNOVU13TGpneU16STBOU0F3TGpFME5EYzNOU0F3TGpnMU1qY3lOQ0F3TGpFM01qYzFOQ0F3TGpnMU5URXhPQ0F3TGpJd09ERTJNVXd3TGpnMU5USTNOU0F3TGpJeE1qZ3lWakF1TlRVek1EUkRNQzQ0TlRVeU56VWdNQzQxT0Rrd05UUWdNQzQ0TWpjeU9UY2dNQzQyTVRnMU16TWdNQzQzT1RFNE9TQXdMall5TURreU9Fd3dMamM0TnpJek1TQXdMall5TVRBNE5FZ3dMalkwTXpRME0xWXdMamN3TkRJMVNEQXVOamd4TXpBMlF6QXVOamt6T0RNeklEQXVOekEwTWpVZ01DNDNNRE01T0RjZ01DNDNNVFEwTURRZ01DNDNNRE01T0RjZ01DNDNNalk1TXpGRE1DNDNNRE01T0RjZ01DNDNNemcwTVRRZ01DNDJPVFUwTlRRZ01DNDNORGM1TURNZ01DNDJPRFF6T0RRZ01DNDNORGswTURWTU1DNDJPREV6TURZZ01DNDNORGsyTVRKSU1DNDBOakl3TlRSV01DNDNNRFF5TlVnd0xqVTVPREE0TVZZd0xqWXlNVEE0TkVnd0xqUTJNakExTkZZd0xqVTNOVGN5TWtnd0xqYzROekl6TVVNd0xqYzVPRGN4TkNBd0xqVTNOVGN5TWlBd0xqZ3dPREl3TkNBd0xqVTJOekU0T1NBd0xqZ3dPVGN3TmlBd0xqVTFOakV4T0V3d0xqZ3dPVGt4TXlBd0xqVTFNekEwVmpBdU1qRXlPREpETUM0NE1EazVNVE1nTUM0eU1ERXpNemNnTUM0NE1ERXpPQ0F3TGpFNU1UZzBOeUF3TGpjNU1ETXdPU0F3TGpFNU1ETTBOVXd3TGpjNE56SXpNU0F3TGpFNU1ERXpPRWd3TGpJNE9ERTJORU13TGpJM05qWTRNU0F3TGpFNU1ERXpPQ0F3TGpJMk56RTVNU0F3TGpFNU9EWTNNU0F3TGpJMk5UWTRPU0F3TGpJd09UYzBNa3d3TGpJMk5UUTRNaUF3TGpJeE1qZ3lWakF1TXpVMk5EWTRTREF1TWpJd01USldNQzR5TVRJNE1rTXdMakl5TURFeUlEQXVNVGMyT0RBMklEQXVNalE0TURrNElEQXVNVFEzTXpJMklEQXVNamd6TlRBMUlEQXVNVFEwT1RNeVREQXVNamc0TVRZMElEQXVNVFEwTnpjMVNEQXVOemczTWpNeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprNE5EWXhOU0lnYUdWcFoyaDBQU0l3TGprNE5EWXhOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREFnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREVpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9EUTJOelk1SWlCb1pXbG5hSFE5SWpBdU9EUTJOelk1SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05qZzRORGMzSURBdU1EZzBNelV3TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49MTIgMTI7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNTgiIHk9IjI1MiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzNyIgdmFsdWU9IiIgc3R5bGU9Imdyb3VwO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGNvbm5lY3RhYmxlPSIwIj48bXhHZW9tZXRyeSB4PSI1MyIgeT0iMjYzIiB3aWR0aD0iNjYiIGhlaWdodD0iODgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFETUFBQUF6Q0FZQUFBQTZvVEFxQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJkYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pVeExDSjVJam93ZlN4N0luZ2lPalV4TENKNUlqbzFNWDBzZXlKNElqb3dMQ0o1SWpvMU1YMWRmV041SHNvQUFBamtTVVJCVkdoRDdWbHRiTlZYR2YvZDk3N1lsdFp0TFdWbWhVSzdnQmtUd1RBakpEcFpBaGlYU0dTV2pJSm1JY1lQWmliNjNjelBaQzZSTHpZTzVzcGcxY2pRclIxVFVkUzFZeU50R1dYdDJJRGJOOWJTMjl2MysvN2k4enpubkh0dlYyNjV2ZitTc1lWZmMrNTUvNS9uZDU3bk9XKzFKUW40Z3NDdTR5OEU3cEc1VzNIbnliQkhtbkNIY1VjV0FQNWtPQnpHM053Y3BxYW1FSTFFNFhhN1ViYWlETVZGeFhCNzNMRFpiTHIxOG1IWnlUQ0pvYUVobkgvbkhmVDE5bUp3ZUJqQllCQ0ZCUVdvcWFuQnVycDEyTExsRzVSZURaZkxxWHN0RDVhTlRDS2V3Q2NqbjZDdHJRMXYvdlUxOUYyNWdrUTRpRmc4U1ZwUWJSeDJPeHdGaFhob3pWcjhxS0VCMjdkdng2cnFWWEE0SGFxQlJTd0xtV1FpaWY2QmZodytmQmh2dGJYQ0hvdkFhYzl1Ump5aXkrM0NONy96Qkg3KzdMT29yNnNuU1hTbEJWaGVBQktKQklhR2g5RGNmQnhuejdUQzhXa2lXaTFKVzNvb0xvcEZvM2o3bjIraHBhVUZNek16dXNZYXJKR2hHZmI1ZkRoMjlDaGVlL1VWMGtpVVRFa1RZWWt6bk54MmkrVXNUdTI1MzhsWFR5SVFDT2pTL0dHSkRGdG9UMDhQL2s2bUZaNVRzNXVwQVJIL2xsYWNKamxMV21scStqM2EyOXQxU2Y2d1JDWVVEdUVmWjk2RWYreW01QTBSRTVORHBzdFlOeW1paW1EUzdvRGJZWWZ2eGcwMHYvd3kvT00rS2M4WGxzaU1qWTJoczdNTHlYaE04bXhLWWs1a1hrWWZ0bVJDaE9hWWd5bzBtbEd0aWx3T1hPcTZnT3ZYdmFMdGZKRS9HUnB6Y0hBUVV4UGprcEZacHpLbXc2YkY0aWFOMEprQ2NobG5LYmJSNG1HS2dxRXdCbWwvaXNmalVwWVA4aWRqUytMYXRXdVluWm9rWVpUUUxIeEtBMHlJU1hBWlM4OXRPQWd4Q2hUekJMRFdHUFpvQklNRFhsb1VQZ3N5QkIrWkdTK3hUSVVGRnhKR2FJSVIxR2hHakpBMUtQV2FlRUlKejBXVFV6UFVWTFhOQjViSVJJbUlBV3RGQWxOamdTaHROQ1FhRU9HMXRrVGdoVUxIWXpFcS9ZeklsSmVXeUw3Q3c0dmdMTERLcFVSU3BxZEppTUl5aEdWMWNDQndkUkVkUXUwNm53L3lKNU8wWWRWRE5YQ1RBTVkwbENha2t0SlNSRWdMSjFyTHlBc0QzWmZYdzhxcVN0aU5hZWFCL01tUVRIVjFkZmp5L1ZVNlR3Vm1Wak5tMTJpRXVGUEVnbk5ldFJYell4OGl1QXVMOFBEYVdrdUhUa3RtOW1CMU5iNjIrZXV3T1YycEdXYWhXUU95TEZPWnlqTXBybFJ0VEN3TEFJVkFOSUZITm0zR0dqcHcydWxrblM4c2tYRjdQUGpXdG0ya25RY29wNFEzL3NGQi9JVnJOQWVCYUUyMVpkQ0JHdzlVVnVMSko3K1A4dkp5S2NzWGxzallhQmEzYk42TTdZL3ZnS2VvU0JlU29GcGVwUTJWVm9GK2hJUWl3bkFWRm1MZmdZUFk4ZDNINFhSYXU2eFpJMFBDVlZaVm8zSC8wOWhHaE1RSDBuSXFNQWtHVjJodEdUK3hPUno0OWhNNzBkaTRIeXZLSzZUTUNpeVJZZGhwYVY2OXBoWUhEaDdFK2tjM2dieUFaTmFNTkpIMEtxWUMrNG1kaUt6OTZrWTAwSTJ6ckxSTTExa0RtZmFDdVZ3UytISVdqVVJrNGovNitDTTB2L1FTM2o3M0wweFArT2tHU3J0N3lyUVVXQnRmS2x1QkhUdS9oNzE3Zm9EVjYrcmdjRGpsNW1uRitSbVd5UEE1YW1Ua0JucjdlbEZTc2dLYkh0MklNVHJHdDdhMjRmWFRwekV5NkVVb0dDUW5KMDJRb0lXRnhianZ3YTlnOTY3ZCtPSGV2U2d0S1VGM2R4ZG1adWRrbWErcXFyTGtOL21Sb1I3VE05TWtTRGRhVHJ5Q2kxMmRxTGp2ZnZ6aWw3L0NZMXUzaXJhdWtwWXU5L2JpNnRYckNFMVBvTGlrRkxYMTlkanc4SHJVcks0UjM3bnczZ1g4N29Ybk1YcGpHT3MzYk1DZWhuM1l1dlV4RkJjWGl6OHVGVXNuUTYwSEJnZHc1TWdSbkRuMVo4VG82bXVHclZpNUNzLzg5R2ZZdlhzWExiTVZVcDZnSTMwaVFkZHBoMHRXUC9hZjZlbHAvT1hrQ1J3N2ZoeitvWDdWbVZCSTJuMXFmeVA1MFQ1VTB4NjJWRGR5L0pxZzB6a2hHQXpnRDAxTitPUFJGK0hnVFM5andNbkpLVng4LzVMNFFHMXRMVHdGQmVMb0R0NVVxV0dDTnBVSjhxVS90YlRnaGQ4K0QvL05VYmpvcG1rUUNnWFIzZFVGaDh1RGpXU3kvSEM0Rk9Tc0dYNU9HaUFmT0hYcU5FNjgySVRBYlBwRkpVa3piaTVhTVdySG0rbjZSemJLcmw1UHBsVmFXaXJhdU56VGc4c1h1L0FCeFZHNmNtZDdqbks2UFhqcXdJL1JTUHZQeXFxVnBOSGNWSlF6bVltSkNmem11ZWR3OW8zVGNsUm55SFZZMzBjWXZIK28wN1BhMmFNVStPRG9jZG9SalNjUUk1UHo1TGhnOFdQaG5vYW5jZWpRSVZUU0NTRVg1UFJwZnExODkveTdPTnYyT2dMaDlCMG1UVVROSEJNeEd5SlBwcHVTVHBEUGtGL1prL09KcUhhcUgwK0t1Y2l4bGhseE1qbCtVT3pvNk1qNUtwM3grVnVEVnlhdjE0c204cE53S0FTUHc2ZzhVL1ZLdWFJWlRyTWpVZUFWYVdIcmhmMVVyTkxHWEJtVEk4TzBieDJUdCt0Y0RPaTJaR1puWjlINnh0OXc1ZjNPZVRiT001aTZGb3VBdW80SHpSeFlFMHNGVFZhWm96cmFNQUVoUWVWR00xekgrUGpEWG5TMC93L0JIQjRKRnlYRHN6SFE3OFc1Ly93M2ZVWFdRckdKY1dCaDVMaFBRcElEcHVvRmhwZ214OHV5bUJmbFRUOGhOYTg5SjlUM0dHeHVIZTBkOEkzeks5RGlXSlJNSkJMRmU3U3hYZm5nMHZ5VlJ3dkhZTE1TRWlvekQwTFNDRW93aTROb2c5TEd4K1RzUnUyRWFBcmNUL1h0N3V5VURmcDJXSlJNWUc1V2x0TUV6VTRLTERnUHpDWm1CSlZ4aFphYVVBb2M2VnFDYWNjK3BCcGtDcTdLS05aa1ZUMzEwZDBtYm83Z1BDMEV0L09ickdUWThjZjlmdmxYQlMrekFoYllDQ0Vtb1FObmFlUk1ZZmd1d3pWQ2tGTVpnckFtcFMyVDQ5alVNUUVkcDh0dENJVWorTEN2RDM3LzRxYTJLSm5SMFJINEtZaUZtWUZTb05rejJza1FUcTdKcVZsbm9VZ2cwOWNJemZqVTk0UzArUTduK1J1NkRiOEFlY2wzKzY5N0paOE5XY253amo4OVBTT25Yc25ManhxTUIrWmh6T3hsYW9zMVlueElFWkVrdFVrTGI5cHpiUHpLa0RBRXpEalVpb3BzQ05OaGRYUnNUT3F5SVN1Wk9LMVVNMFFtRUE3TEVTWGw1QVJEUW9MSnA4QmxHVUczUy9XWE5BbEszMHpTWmlqbHBvNlJtU2ZyNEdTQ2ZrS1JHTVo5UHJHWWJLQnZaWDRwalJCdGtPZitmWTZPK00wSWhNSkVPeXR2R3B4Q2V1SnZEeU53dG05eUhXdUlCZWY5aklsSFF0ai9rMmV3YzljdU9zamUramtxS3htZWdWazZUUHBwRVZBelphUmRTcHBqaGtubjJvK1JUZ3QzK3F1b0tFZFpXYm14eEFYSVN1YnppRVZzNS9PSGUyVHVWdHdqYzNjQytEOXo1R25TaUd2L1dBQUFBQUJKUlU1RXJrSmdnZz09O2ZvbnRTaXplPTE0OyIgcGFyZW50PSIzNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB3aWR0aD0iNjYiIGhlaWdodD0iNjYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iJmx0O3NwYW4gc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz4mbHQ7Zm9udCBjb2xvcj0mcXVvdDsjMDA3ZmZmJnF1b3Q7IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTRweDsmcXVvdDs+VHJhZGVyJmx0Oy9mb250PiZsdDsvc3Bhbj4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250Q29sb3I9IzIwQzlFMztmb250U2l6ZT0xNDtmb250U3R5bGU9MCIgcGFyZW50PSIzNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1LjUiIHk9IjU2IiB3aWR0aD0iNTYiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik91dCBPZiBTY29wZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW91dC1vZi1zY29wZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJMk5DSWdhR1ZwWjJoMFBTSTJOQ0lnZG1sbGQwSnZlRDBpTUNBd0lEWTBJRFkwSWlCbWFXeHNQU0p1YjI1bElqNG1JM2hoT3p4emRIbHNaVDRtSTNoaE95QWdJQ0F1YVdOdmJpMW1hV3hzSUhzbUkzaGhPeUFnSUNBZ0lDQWdabWxzYkRvZ0l6RXhRVGhEUmpzbUkzaGhPeUFnSUNCOUppTjRZVHM4TDNOMGVXeGxQaVlqZUdFN1BIQmhkR2dnWkQwaVRUTXhMams1T1RnZ09TNDFPVFk1TWtNek9DNHdNelFnT1M0MU9UWTVNaUEwTXk0MU1URWdNVEV1T1RneU5pQTBOeTQxTXpreElERTFMamcyTWpGRE5EY3VOalUwSURFMUxqazBNVGNnTkRjdU56WXpNU0F4Tmk0d016STFJRFEzTGpnMk5USWdNVFl1TVRNME5rTTBOeTQ1TmpjeklERTJMakl6TmpjZ05EZ3VNRFU0TVNBeE5pNHpORFU0SURRNExqRXpOellnTVRZdU5EWXdOVU0xTWk0d01UY3pJREl3TGpRNE9Ea2dOVFF1TkRBeU9TQXlOUzQ1TmpVNUlEVTBMalF3TWprZ016SkROVFF1TkRBeU9TQTBOQzR6TnpNZ05EUXVNemN5TnlBMU5DNDBNRE15SURNeExqazVPVGdnTlRRdU5EQXpNa014T1M0Mk1qWTVJRFUwTGpRd016SWdPUzQxT1RZMk9DQTBOQzR6TnpNZ09TNDFPVFkyT0NBek1rTTVMalU1TmpZNElERTVMall5TnpFZ01Ua3VOakkyT1NBNUxqVTVOamt5SURNeExqazVPVGdnT1M0MU9UWTVNbHBOTkRZdU1EWXpJREl4TGpJM01qWk1NakV1TWpjeU5DQTBOaTR3TmpNeVF6STBMakkwTnprZ05EZ3VNek0yTkNBeU55NDVOall5SURRNUxqWTROamNnTXpFdU9UazVPQ0EwT1M0Mk9EWTNRelF4TGpjMk56a2dORGt1TmpnMk55QTBPUzQyT0RZMUlEUXhMamMyT0RFZ05Ea3VOamcyTlNBek1rTTBPUzQyT0RZMUlESTRMakV5TnpnZ05EZ3VORFF5TVNBeU5DNDFORFl4SURRMkxqTXpNVE1nTWpFdU5qTXpNa3cwTmk0d05qTWdNakV1TWpjeU5scE5NekV1T1RrNU9DQXhOQzR6TVRNMFF6SXlMakl6TVRjZ01UUXVNekV6TkNBeE5DNHpNVE14SURJeUxqSXpNaUF4TkM0ek1UTXhJRE15UXpFMExqTXhNekVnTXpZdU1ETXpOeUF4TlM0Mk5qTTBJRE01TGpjMU1pQXhOeTQ1TXpZMklEUXlMamN5TnpWTU5ESXVOekkzTWlBeE55NDVNelk1UXpNNUxqYzFNVGNnTVRVdU5qWXpOeUF6Tmk0d016TTBJREUwTGpNeE16UWdNekV1T1RrNU9DQXhOQzR6TVRNMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI0MSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTBmYzAxNjI4LTQ1ZTEtNGFmMS1iZTE1LWI5YmZlMjJmMzI0Mjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1vdXQtb2Ytc2NvcGU7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOSIgeT0iNDE5IiB3aWR0aD0iMjQ2IiBoZWlnaHQ9IjE2NiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDIiIHZhbHVlPSJBUEkgRW5kcG9pbnQgLSBCcm9rZXIgc2l0ZSIgc3R5bGU9ImlyLnJlZj1iYzQ5NDM1ZS02MjlhLTQyZGQtYjY2MS0xOWQzZjIyYWIzYzg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTE0O3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQVBJLUVORFBPSU5UO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpZMU9WOHlNelU0TXlraVBqeG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVY4eU5qVTVYekl6TlRnektTSStQSEJoZEdnZ1pEMGlUVEF1TnpVNE5qZ2dNQzQwTkRReE9USklNQzQzTkRNME56SkRNQzQzTXprNU5qSWdNQzQwTXpJME9UTWdNQzQzTXpZME5USWdNQzQwTWpBM09UUWdNQzQzTXpFM056TWdNQzQwTVRBeU5qVkRNQzQzTWpjd09UTWdNQzR6T1RrM016WWdNQzQzTWpJME1UTWdNQzR6T1RBek56Y2dNQzQzTVRZMU5qUWdNQzR6TnprNE5EaE1NQzQzTWpVNU1qTWdNQzR6TnpBME9EbERNQzQzTWprME16TWdNQzR6TmpZNU56a2dNQzQzTXpBMk1ETWdNQzR6TmpNME55QXdMamN6TURZd015QXdMak0xT0RjNVF6QXVOek13TmpBeklEQXVNelUwTVRFeElEQXVOekk1TkRNeklEQXVNelV3TmpBeElEQXVOekkxT1RJeklEQXVNelEzTURreFREQXVOamN3T1RNNElEQXVNamt5TVRBMlF6QXVOalkzTkRJNUlEQXVNamc0TlRrM0lEQXVOall6T1RFNUlEQXVNamczTkRJM0lEQXVOalU1TWpNNUlEQXVNamczTkRJM1F6QXVOalUwTlRZZ01DNHlPRGMwTWpjZ01DNDJOVEV3TlNBd0xqSTRPRFU1TnlBd0xqWTBOelUwSURBdU1qa3lNVEEyVERBdU5qTTVNelV4SURBdU16QXhORFkxUXpBdU5qSTVPVGt5SURBdU1qazFOakUySURBdU5qSXdOak16SURBdU1qa3dPVE0ySURBdU5qRXdNVEEwSURBdU1qZzJNalUzUXpBdU5UazROREExSURBdU1qZ3hOVGMzSURBdU5UZzJOekEySURBdU1qYzJPRGs0SURBdU5UY3pPRE0zSURBdU1qY3pNemc0VmpBdU1qWXdOVEU1UXpBdU5UY3pPRE0zSURBdU1qVXhNVFlnTUM0MU5qWTRNVGdnTUM0eU5EUXhOREVnTUM0MU5UYzBOVGtnTUM0eU5EUXhOREZJTUM0ME9EQXlORFpETUM0ME56QTRPRGNnTUM0eU5EUXhOREVnTUM0ME5qTTROamNnTUM0eU5URXhOaUF3TGpRMk16ZzJOeUF3TGpJMk1EVXhPVll3TGpJNE9UYzJOa2d3TGpRNE56STJOVll3TGpJMk56VXpPRWd3TGpVMU1EUXpPVll3TGpJM09USXpOME13TGpVMU1EUXpPU0F3TGpJNE56UXlOeUF3TGpVMU5URXhPU0F3TGpJNU16STNOaUF3TGpVMk16TXdPQ0F3TGpJNU5EUTBOa013TGpVM05qRTNOeUF3TGpJNU5qYzROaUF3TGpVNE9UQTBOaUF3TGpNd01UUTJOU0F3TGpZd01EYzBOU0F3TGpNd056TXhOVU13TGpZeE1USTNOQ0F3TGpNeE1UazVOQ0F3TGpZeU1UZ3dNeUF3TGpNeE56ZzBOQ0F3TGpZek1URTJNaUF3TGpNeU16WTVNME13TGpZek56QXhNU0F3TGpNeU9ETTNNeUF3TGpZME5qTTNJREF1TXpJM01qQXpJREF1TmpVeE1EVWdNQzR6TWpFek5UUk1NQzQyTlRreU16a2dNQzR6TVRNeE5qUk1NQzQzTURNMk9UVWdNQzR6TlRjMk1rd3dMalk1TkRNek5pQXdMak0yTlRnd09VTXdMalk0T0RRNE55QXdMak0zTURRNE9TQXdMalk0T0RRNE55QXdMak0zT0RZM09DQXdMalk1TVRrNU5pQXdMak00TlRZNU9FTXdMalk1TnpnME5pQXdMak01TmpJeU55QXdMamN3TXpZNU5TQXdMalF3TmpjMU5pQXdMamN3T0RNM05TQXdMalF4TnpJNE5VTXdMamN4TXpBMU5DQXdMalF5T0RrNE5DQXdMamN4Tnpjek5DQXdMalEwTURZNE15QXdMamN5TURBM05DQXdMalExTXpVMU1VTXdMamN5TWpReE15QXdMalEyTURVM01TQXdMamN5T0RJMk15QXdMalEyTlRJMUlEQXVOek0xTWpneUlEQXVORFkxTWpWSU1DNDNORGt6TWpGV01DNDFNamsxT1RSSU1DNDNNelV5T0RKRE1DNDNNamd5TmpNZ01DNDFNamsxT1RRZ01DNDNNakV5TkRRZ01DNDFNelF5TnpRZ01DNDNNakF3TnpRZ01DNDFOREV5T1RORE1DNDNNVFkxTmpRZ01DNDFOVEk1T1RJZ01DNDNNVE13TlRRZ01DNDFOalU0TmpFZ01DNDNNRGd6TnpVZ01DNDFOemMxTmtNd0xqY3dNelk1TlNBd0xqVTRPREE0T1NBd0xqWTVOemcwTmlBd0xqVTVPVGM0T0NBd0xqWTVNVGs1TmlBd0xqWXdPVEUwTjBNd0xqWTRPRFE0TnlBd0xqWXhORGs1TnlBd0xqWTRPVFkxTmlBd0xqWXlNekU0TmlBd0xqWTVORE16TmlBd0xqWXlPVEF6TlV3d0xqY3dNelk1TlNBd0xqWXpOekl5TkV3d0xqWTFPVEl6T1NBd0xqWTRNVFk0VERBdU5qVXlNaklnTUM0Mk56Y3dNREZETUM0Mk5EWXpOeUF3TGpZM01URTFNU0F3TGpZek9ERTRNU0F3TGpZM01URTFNU0F3TGpZek1qTXpNaUF3TGpZM05EWTJNVU13TGpZeU1qazNNeUF3TGpZNE1EVXhNU0F3TGpZeE1qUTBOQ0F3TGpZNE5qTTJJREF1TmpBeE9URTFJREF1TmpreE1EUkRNQzQxT1RBeU1UWWdNQzQyT1RZNE9Ea2dNQzQxTnpjek5EY2dNQzQzTURBek9Ua2dNQzQxTmpRME56Z2dNQzQzTURNNU1EaERNQzQxTlRjME5Ua2dNQzQzTURVd056Z2dNQzQxTlRFMk1Ea2dNQzQzTVRJd09UZ2dNQzQxTlRFMk1Ea2dNQzQzTVRreE1UZFdNQzQzTXpBNE1UWklNQzQwT0RjeU5qVldNQzQzTURnMU9EaElNQzQwTmpNNE5qZFdNQzQzTXpjNE16VkRNQzQwTmpNNE5qY2dNQzQzTkRjeE9UUWdNQzQwTnpBNE9EY2dNQzQzTlRReU1UUWdNQzQwT0RBeU5EWWdNQzQzTlRReU1UUklNQzQxTlRjME5UbERNQzQxTmpZNE1UZ2dNQzQzTlRReU1UUWdNQzQxTnpNNE16Y2dNQzQzTkRjeE9UUWdNQzQxTnpNNE16Y2dNQzQzTXpjNE16VldNQzQzTWpRNU5qWkRNQzQxT0RZM01EWWdNQzQzTWpFME5UY2dNQzQxT1RnME1EVWdNQzQzTVRjNU5EY2dNQzQyTVRBeE1EUWdNQzQzTVRJd09UaERNQzQyTVRrME5qTWdNQzQzTURjME1UZ2dNQzQyTWprNU9USWdNQzQzTURJM016Z2dNQzQyTXprek5URWdNQzQyT1RZNE9EbE1NQzQyTkRnM01TQXdMamN3TmpJME9FTXdMalkxTkRVMklEQXVOekV5TURrNElEQXVOalkxTURnNUlEQXVOekV5TURrNElEQXVOamN5TVRBNElEQXVOekEyTWpRNFREQXVOekkzTURreklEQXVOalV4TWpZelF6QXVOek13TmpBeklEQXVOalEzTnpVMElEQXVOek14TnpjeklEQXVOalEwTWpRMElEQXVOek14TnpjeklEQXVOak01TlRZMFF6QXVOek14TnpjeklEQXVOak0wT0RnMUlEQXVOekk1TkRNeklEQXVOak14TXpjMUlEQXVOekkzTURreklEQXVOakkzT0RZMVREQXVOekUzTnpNMElEQXVOakU0TlRBMlF6QXVOekl6TlRneklEQXVOakE1TVRRM0lEQXVOekk0TWpZeklEQXVOVGs0TmpFNElEQXVOek15T1RReUlEQXVOVGc1TWpVNVF6QXVOek0zTmpJeUlEQXVOVGM0TnpNZ01DNDNOREV4TXpJZ01DNDFOamN3TXpFZ01DNDNORFEyTkRFZ01DNDFOVFV6TXpKSU1DNDNOVGs0TlVNd0xqYzJORFV6SURBdU5UVTFNek15SURBdU56WTRNRE01SURBdU5UVTBNVFl5SURBdU56Y3hOVFE1SURBdU5UVXdOalV5UXpBdU56YzFNRFU1SURBdU5UUTNNVFF6SURBdU56YzJNakk1SURBdU5UUXpOak16SURBdU56YzJNakk1SURBdU5UTTRPVFUwVmpBdU5EVTVOREF4UXpBdU56YzFNRFU1SURBdU5EVXhNakV5SURBdU56WTRNRE01SURBdU5EUTBNVGt5SURBdU56VTROamdnTUM0ME5EUXhPVEphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVORGd6TnpVZ01DNDJNemcxTWpaRE1DNDBPVFkyTVRrZ01DNDJOREl3TXpVZ01DNDFNRGswT0RnZ01DNDJORFF6TnpVZ01DNDFNakl6TlRjZ01DNDJORFF6TnpWRE1DNDJNREU1TVNBd0xqWTBORE0zTlNBd0xqWTJOakkxTkNBd0xqVTRNREF6TVNBd0xqWTJOakkxTkNBd0xqVXdNRFEzT0VNd0xqWTJOakkxTkNBd0xqUXlNRGt5TmlBd0xqWXdNVGt4SURBdU16VTFOREV5SURBdU5USXlNelUzSURBdU16VTFOREV5UXpBdU5UQTRNekU0SURBdU16VTFOREV5SURBdU5EazFORFE1SURBdU16VTNOelV5SURBdU5EZ3lOVGd4SURBdU16WXhNall4VERBdU5EZ3pOelVnTUM0ek5qQXdPVEZNTUM0ME5qRTFNak1nTUM0ek5ESTFORE5JTUM0ek1ESTBNVGRETUM0ek1ERXlORGNnTUM0ek16WTJPVE1nTUM0eU9UYzNNemdnTUM0ek16QTRORFFnTUM0eU9URTRPRGdnTUM0ek1qWXhOalJETUM0eU9ESTFNamtnTUM0ek1qQXpNVFVnTUM0eU5qazJOaUF3TGpNeU1ETXhOU0F3TGpJMk1ETXdNU0F3TGpNeU5qRTJORU13TGpJMU1qRXhNaUF3TGpNek1qQXhOQ0F3TGpJME56UXpNaUF3TGpNME1UTTNNeUF3TGpJME56UXpNaUF3TGpNMU1EY3pNa013TGpJME56UXpNaUF3TGpNMk1EQTVNU0F3TGpJMU1qRXhNaUF3TGpNMk9UUTFJREF1TWpZd016QXhJREF1TXpjMU0wTXdMakkyTkRrNE1TQXdMak0zT0RneElEQXVNamN3T0RNZ01DNHpOems1TnprZ01DNHlOelkyT0NBd0xqTTNPVGszT1VNd0xqSTRNalV5T1NBd0xqTTNPVGszT1NBd0xqSTRPRE0zT0NBd0xqTTNPRGd4SURBdU1qa3pNRFU0SURBdU16YzFNME13TGpJNU9Ea3dOeUF3TGpNM01UYzVJREF1TXpBeU5ERTNJREF1TXpZMU9UUXhJREF1TXpBek5UZzNJREF1TXpVNE9USXhTREF1TkRVMU5qY3pUREF1TkRZMU1ETXlJREF1TXpZM01URXhRekF1TkRNNU1qazFJREF1TXpjNE9ERWdNQzQwTVRneU16WWdNQzR6T1RZek5UZ2dNQzQwTURNd01qZ2dNQzQwTVRrM05UWklNQzR6TkRreU1UTldNQzQwTWpBNU1qWkRNQzR6TkRVM01ETWdNQzQwTURnd05UY2dNQzR6TXpRd01EUWdNQzR6T1RnMk9UZ2dNQzR6TWpFeE16VWdNQzR6T1RnMk9UaERNQzR6TURRM05UY2dNQzR6T1RnMk9UZ2dNQzR5T1RFNE9EZ2dNQzQwTVRFMU5qY2dNQzR5T1RFNE9EZ2dNQzQwTWpjNU5EVkRNQzR5T1RFNE9EZ2dNQzQwTkRRek1qUWdNQzR6TURRM05UY2dNQzQwTlRjeE9USWdNQzR6TWpFeE16VWdNQzQwTlRjeE9USkRNQzR6TXpVeE56UWdNQzQwTlRjeE9USWdNQzR6TkRZNE56TWdNQzQwTkRjNE16TWdNQzR6TkRreU1UTWdNQzQwTXpRNU5qUldNQzQwTXpZeE16UklNQzR6T1RJME9UbERNQzR6T0RRek1TQXdMalExTWpVeE15QXdMak0zT1RZeklEQXVORGN3TURZeElEQXVNemM0TkRZZ01DNDBPRGczTnpsSU1DNHlPRGd6TnpoRE1DNHlPRGN5TURrZ01DNDBPRFF4SURBdU1qZzBPRFk1SURBdU5EYzVORElnTUM0eU9ERXpOVGtnTUM0ME56Y3dPREZETUM0eU5qazJOaUF3TGpRMk5UTTRNaUF3TGpJMU1EazBNaUF3TGpRMk5UTTRNaUF3TGpJek9USTBNeUF3TGpRM056QTRNVU13TGpJeU56VTBOQ0F3TGpRNE9EYzNPU0F3TGpJeU56VTBOQ0F3TGpVd056UTVPQ0F3TGpJek9USTBNeUF3TGpVeE9URTVOME13TGpJME5UQTVNaUF3TGpVeU5UQTBOaUF3TGpJMU1qRXhNaUF3TGpVeU56TTROaUF3TGpJMk1ETXdNU0F3TGpVeU56TTROa013TGpJMk9EUTVJREF1TlRJM016ZzJJREF1TWpjMU5URWdNQzQxTWpVd05EWWdNQzR5T0RFek5Ua2dNQzQxTVRreE9UZERNQzR5T0RRNE5qa2dNQzQxTVRVMk9EY2dNQzR5T0RjeU1Ea2dNQzQxTVRFd01EY2dNQzR5T0Rnek56Z2dNQzQxTURjME9UaElNQzR6TnprMk0wTXdMak00TURnZ01DNDFNall5TVRZZ01DNHpPRFUwT0NBd0xqVTBNemMyTkNBd0xqTTVNelkyT1NBd0xqVTJNVE14TTBnd0xqTTFNRE00TTFZd0xqVTJNalE0TTBNd0xqTTBOamczTXlBd0xqVTBPVFl4TkNBd0xqTXpOVEUzTkNBd0xqVTBNREkxTlNBd0xqTXlNak13TlNBd0xqVTBNREkxTlVNd0xqTXdOVGt5TnlBd0xqVTBNREkxTlNBd0xqSTVNekExT0NBd0xqVTFNekV5TkNBd0xqSTVNekExT0NBd0xqVTJPVFV3TWtNd0xqSTVNekExT0NBd0xqVTROVGc0TVNBd0xqTXdOVGt5TnlBd0xqVTVPRGMwT1NBd0xqTXlNak13TlNBd0xqVTVPRGMwT1VNd0xqTXpOak0wTkNBd0xqVTVPRGMwT1NBd0xqTTBPREEwTXlBd0xqVTRPVE01SURBdU16VXdNemd6SURBdU5UYzJOVEl4VmpBdU5UYzNOamt4U0RBdU5EQTBNVGs0UXpBdU5ERTVOREEySURBdU5qQXhNRGc1SURBdU5EUXhOak0wSURBdU5qRTROak00SURBdU5EWTJNakF5SURBdU5qSTVNVFkzVERBdU5EVTJPRFF6SURBdU5qTTNNelUyU0RBdU16QTBOelUzUXpBdU16QXlOREUzSURBdU5qTXhOVEEySURBdU1qazRPVEEzSURBdU5qSTFOalUzSURBdU1qazBNakk0SURBdU5qSXlNVFEzUXpBdU1qZzBPRFk1SURBdU5qRTFNVEk0SURBdU1qY3lJREF1TmpFMU1USTRJREF1TWpZeE5EY3hJREF1TmpJeU1UUTNRekF1TWpVek1qZ3lJREF1TmpJM09UazNJREF1TWpRNE5qQXlJREF1TmpNM016VTJJREF1TWpRNE5qQXlJREF1TmpRMk56RTFRekF1TWpRNE5qQXlJREF1TmpVMk1EYzBJREF1TWpVek1qZ3lJREF1TmpZMU5ETXpJREF1TWpZeE5EY3hJREF1TmpjeE1qZ3pRekF1TWpZME9UZ3hJREF1TmpjME56a3lJREF1TWpZNU5qWWdNQzQyTnpjeE16SWdNQzR5TnpVMU1TQXdMalkzTnpFek1rTXdMakk0TVRNMU9TQXdMalkzTnpFek1pQXdMakk0TnpJd09TQXdMalkzTkRjNU1pQXdMakk1TVRnNE9DQXdMalkzTWpRMU0wTXdMakk1Tnpjek9DQXdMalkyT0RrME15QXdMak13TVRJME55QXdMalkyTXpBNU15QXdMak13TWpReE55QXdMalkxTnpJME5FZ3dMalEyTURNMU0wd3dMalE0TXpjMUlEQXVOak00TlRJMldrMHdMakk0TVRNMU9TQXdMak0yTVRJMk1VTXdMakkzTnpnME9TQXdMak0yTXpZd01TQXdMakkzTXpFM0lEQXVNell6TmpBeElEQXVNalk1TmpZZ01DNHpOakV5TmpGRE1DNHlOamN6TWlBd0xqTTFPRGt5TVNBd0xqSTJORGs0TVNBd0xqTTFOVFF4TWlBd0xqSTJORGs0TVNBd0xqTTFNRGN6TWtNd0xqSTJORGs0TVNBd0xqTTBOakExTXlBd0xqSTJOek15SURBdU16UXlOVFF6SURBdU1qWTVOallnTUM0ek5EQXlNRE5ETUM0eU56TXhOeUF3TGpNek56ZzJNeUF3TGpJM056ZzBPU0F3TGpNek56ZzJNeUF3TGpJNE1UTTFPU0F3TGpNME1ESXdNME13TGpJNE5EZzJPU0F3TGpNME1qVTBNeUF3TGpJNE5qQXpPU0F3TGpNME5qQTFNeUF3TGpJNE5qQXpPU0F3TGpNMU1EY3pNa013TGpJNE5qQXpPU0F3TGpNMU5UUXhNaUF3TGpJNE5EZzJPU0F3TGpNMU9Ea3lNU0F3TGpJNE1UTTFPU0F3TGpNMk1USTJNVnBOTUM0ek1UazVOallnTUM0ME5EQTRNVFJETUM0ek1USTVORFlnTUM0ME5EQTRNVFFnTUM0ek1EZ3lOamNnTUM0ME16UTVOalFnTUM0ek1EZ3lOamNnTUM0ME1qa3hNVFZETUM0ek1EZ3lOamNnTUM0ME1qTXlOallnTUM0ek1UUXhNVFlnTUM0ME1UYzBNVFlnTUM0ek1UazVOallnTUM0ME1UYzBNVFpETUM0ek1qVTRNVFVnTUM0ME1UYzBNVFlnTUM0ek16RTJOalFnTUM0ME1qTXlOallnTUM0ek16RTJOalFnTUM0ME1qa3hNVFZETUM0ek16STRNelFnTUM0ME16UTVOalFnTUM0ek1qWTVPRFVnTUM0ME5EQTRNVFFnTUM0ek1UazVOallnTUM0ME5EQTRNVFJhVFRBdU1qWTRORGtnTUM0MU1EYzBPVGhETUM0eU5qTTRNVEVnTUM0MU1USXhOemNnTUM0eU5UVTJNakVnTUM0MU1USXhOemNnTUM0eU5UQTVORElnTUM0MU1EYzBPVGhETUM0eU5EWXlOaklnTUM0MU1ESTRNVGdnTUM0eU5EWXlOaklnTUM0ME9UUTJNamtnTUM0eU5UQTVORElnTUM0ME9EazVORGxETUM0eU5UTXlPRElnTUM0ME9EYzJNU0F3TGpJMU5qYzVNU0F3TGpRNE5qUTBJREF1TWpVNU1UTXhJREF1TkRnMk5EUkRNQzR5TmpFME56RWdNQzQwT0RZME5DQXdMakkyTkRrNE1TQXdMalE0TnpZeElEQXVNalkzTXpJZ01DNDBPRGs1TkRsRE1DNHlOamsyTmlBd0xqUTVNakk0T1NBd0xqSTNNRGd6SURBdU5EazFOems1SURBdU1qY3dPRE1nTUM0ME9UZ3hNemxETUM0eU56QTRNeUF3TGpVd01EUTNPQ0F3TGpJM01EZ3pJREF1TlRBMU1UVTRJREF1TWpZNE5Ea2dNQzQxTURjME9UaGFUVEF1TXpFNU9UWTJJREF1TlRneU16Y3hRekF1TXpFeU9UUTJJREF1TlRneU16Y3hJREF1TXpBNE1qWTNJREF1TlRjMk5USXhJREF1TXpBNE1qWTNJREF1TlRjd05qY3lRekF1TXpBNE1qWTNJREF1TlRZME9ESXpJREF1TXpFME1URTJJREF1TlRVNE9UY3pJREF1TXpFNU9UWTJJREF1TlRVNE9UY3pRekF1TXpJMU9ERTFJREF1TlRVNE9UY3pJREF1TXpNeE5qWTBJREF1TlRZME9ESXpJREF1TXpNeE5qWTBJREF1TlRjd05qY3lRekF1TXpNeE5qWTBJREF1TlRjMk5USXhJREF1TXpJMk9UZzFJREF1TlRneU16Y3hJREF1TXpFNU9UWTJJREF1TlRneU16Y3hXazB3TGpVNU5qQTJJREF1TkRZeE9EY3lWakF1TlRNMk56UTFRekF1TlRrMk1EWWdNQzQxTkRBeU5UVWdNQzQxT1RJMU5TQXdMalUwTXpjMk5DQXdMalU0T1RBME1TQXdMalUwTXpjMk5FTXdMalU0TlRVek1TQXdMalUwTXpjMk5DQXdMalU0TURnMU1pQXdMalUwTURJMU5TQXdMalU0TURnMU1pQXdMalV6TmpjME5WWXdMalEyTVRnM01rTXdMalU0TURnMU1pQXdMalExT0RNMk1pQXdMalU0TkRNMk1TQXdMalExTkRnMU15QXdMalU0TnpnM01TQXdMalExTkRnMU0wTXdMalU1TVRNNE1TQXdMalExTkRnMU15QXdMalU1TmpBMklEQXVORFU0TXpZeUlEQXVOVGsyTURZZ01DNDBOakU0TnpKYVRUQXVOVFkzT1RneklEQXVORFkyTlRVeVF6QXVOVGN5TmpZeUlEQXVORGN5TkRBeElEQXVOVGN6T0RNeUlEQXVORGM1TkRJZ01DNDFOek00TXpJZ01DNDBPRFV5TjBNd0xqVTNNemd6TWlBd0xqUTVNVEV4T1NBd0xqVTNNalkyTWlBd0xqUTVOVGM1T1NBd0xqVTJPVEUxTXlBd0xqVXdNRFEzT0VNd0xqVTJNek13TXlBd0xqVXdPVGd6T0NBd0xqVTFNemswTkNBd0xqVXhORFV4TnlBd0xqVTBNakkwTlNBd0xqVXhORFV4TjBnd0xqVXlNak0xTjFZd0xqVXpOamMwTlVNd0xqVXlNak0xTnlBd0xqVTBNREkxTlNBd0xqVXhPRGcwTnlBd0xqVTBNemMyTkNBd0xqVXhOVE16T0NBd0xqVTBNemMyTkVNd0xqVXhNVGd5T0NBd0xqVTBNemMyTkNBd0xqVXdPRE14T0NBd0xqVTBNREkxTlNBd0xqVXdPRE14T0NBd0xqVXpOamMwTlZZd0xqUTJOVE00TWtNd0xqVXdPRE14T0NBd0xqUTFPVFV6TWlBd0xqVXhNams1T0NBd0xqUTFNelk0TXlBd0xqVXlNREF4TnlBd0xqUTFNelk0TTBnd0xqVTBNelF4TlVNd0xqVTFNemswTkNBd0xqUTFORGcxTXlBd0xqVTJNek13TXlBd0xqUTFPVFV6TWlBd0xqVTJOems0TXlBd0xqUTJOalUxTWxwTk1DNDBPVGc1TlRrZ01DNDFORE0zTmpSRE1DNDBPVFUwTkRrZ01DNDFORFE1TXpRZ01DNDBPVEEzTnlBd0xqVTBNemMyTkNBd0xqUTRPVFlnTUM0MU16a3dPRFZNTUM0ME5qWXlNRElnTUM0ME56Y3dPREZNTUM0ME5ESTRNRFFnTUM0MU16a3dPRFZETUM0ME5ERTJNelFnTUM0MU5ERTBNalVnTUM0ME16a3lPVFVnTUM0MU5ETTNOalFnTUM0ME16VTNPRFVnTUM0MU5ETTNOalJETUM0ME16UTJNVFVnTUM0MU5ETTNOalFnTUM0ME16UTJNVFVnTUM0MU5ETTNOalFnTUM0ME16TTBORFVnTUM0MU5ETTNOalJETUM0ME1qazVNelVnTUM0MU5ESTFPVFVnTUM0ME1qYzFPVFlnTUM0MU16YzVNVFVnTUM0ME1qZzNOallnTUM0MU16UTBNRFZNTUM0ME5UWTRORE1nTUM0ME5qQTNNREpETUM0ME5UZ3dNVE1nTUM0ME5UY3hPVElnTUM0ME5qRTFNak1nTUM0ME5UUTROVE1nTUM0ME5qWXlNRElnTUM0ME5UUTROVE5ETUM0ME56QTRPRElnTUM0ME5UUTROVE1nTUM0ME56UXpPVEVnTUM0ME5UY3hPVElnTUM0ME56VTFOakVnTUM0ME5qQTNNREpNTUM0MU1ESTBOamtnTUM0MU16UTBNRFZETUM0MU1EUTRNRGtnTUM0MU16YzVNVFVnTUM0MU1ETTJNemtnTUM0MU5ESTFPVFVnTUM0ME9UZzVOVGtnTUM0MU5ETTNOalJhVFRBdU1qZ3hNelU1SURBdU5qVTNNalEwUXpBdU1qYzNPRFE1SURBdU5qVTVOVGcwSURBdU1qY3pNVGNnTUM0Mk5UazFPRFFnTUM0eU5qazJOaUF3TGpZMU56STBORU13TGpJMk56TXlJREF1TmpVME9UQTBJREF1TWpZME9UZ3hJREF1TmpVeE16azFJREF1TWpZME9UZ3hJREF1TmpRM09EZzFRekF1TWpZME9UZ3hJREF1TmpRME16YzFJREF1TWpZM016SWdNQzQyTXprMk9UWWdNQzR5TmprMk5pQXdMall6TnpNMU5rTXdMakkzTURneklEQXVOak0yTVRnMklEQXVNamN6TVRjZ01DNDJNelV3TVRZZ01DNHlOelUxTVNBd0xqWXpOVEF4TmtNd0xqSTNOemcwT1NBd0xqWXpOVEF4TmlBd0xqSTNPVEF4T1NBd0xqWXpOVEF4TmlBd0xqSTRNVE0xT1NBd0xqWXpOek0xTmtNd0xqSTRORGcyT1NBd0xqWXpPVFk1TmlBd0xqSTROakF6T1NBd0xqWTBNekl3TlNBd0xqSTROakF6T1NBd0xqWTBOemc0TlVNd0xqSTROakF6T1NBd0xqWTFNalUyTkNBd0xqSTRORGcyT1NBd0xqWTFORGt3TkNBd0xqSTRNVE0xT1NBd0xqWTFOekkwTkZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NDhjR0YwYUNCa1BTSk5NQzQxTlRjek5qUWdNQzQwT1RNMU5qSkRNQzQxTlRnMU16UWdNQzQwT1RFeU1qSWdNQzQxTlRrM01EUWdNQzQwT0RjM01USWdNQzQxTlRrM01EUWdNQzQwT0RVek56TkRNQzQxTlRrM01EUWdNQzQwT0RFNE5qTWdNQzQxTlRnMU16UWdNQzQwTnpnek5UTWdNQzQxTlRZeE9UUWdNQzQwTnpRNE5EUkRNQzQxTlRNNE5UVWdNQzQwTnpFek16UWdNQzQxTkRnd01EVWdNQzQwTmpnNU9UUWdNQzQxTkRNek1qWWdNQzQwTmpnNU9UUklNQzQxTWpNME16aFdNQzQxTURBMU9ERklNQzQxTkRNek1qWkRNQzQxTkRreE56VWdNQzQxTURBMU9ERWdNQzQxTlRVd01qVWdNQzQwT1RneU5ERWdNQzQxTlRjek5qUWdNQzQwT1RNMU5qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqd3ZaejQ4WkdWbWN6NDhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdYekkyTlRsZk1qTTFPRE1pUGp4eVpXTjBJSGRwWkhSb1BTSXdMalk0SWlCb1pXbG5hSFE5SWpBdU5qZ2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakUyTWpFd09TQXdMakUyTWpVNU9Da2lMejQ4TDJOc2FYQlFZWFJvUGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RGZk1qWTFPVjh5TXpVNE15SStQSEpsWTNRZ2QybGtkR2c5SWpBdU5UUTBJaUJvWldsbmFIUTlJakF1TlRFd01EY3pJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR5TWprME9USWdNQzR5TkRReE5ERXBJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0MSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NiIgeT0iMzYiIHdpZHRoPSIxNTQiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiB2YWx1ZT0iIiBzdHlsZT0iZ3JvdXA7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgY29ubmVjdGFibGU9IjAiPjxteEdlb21ldHJ5IHg9IjEwNiIgeT0iNjIiIHdpZHRoPSI4Ny4wMDAwMDAwMDAwMDAwMSIgaGVpZ2h0PSIxMjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjciIHZhbHVlPSImbHQ7c3BhbiBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE0cHg7JnF1b3Q7PiZsdDtmb250IGNvbG9yPSZxdW90OyMwMDdmZmYmcXVvdDsgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5EYXRhIFNvdXJjZSZsdDsvZm9udD4mbHQ7L3NwYW4+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjQwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0wLjk5OTk5OTk5OTk5OTk4NTgiIHk9IjkxIiB3aWR0aD0iODgiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM5IiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFRVUFBQUVtQ0FZQUFBQnJyb1VKQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJoYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pJMk1Td2llU0k2TUgwc2V5SjRJam95TmpFc0lua2lPakk1Tkgwc2V5SjRJam93TENKNUlqb3lPVFI5WFgya3pFem1BQUNpRTBsRVFWUjRYdTM5QzlpdDJWWFhpWTUxLzI3N1dyZFVwWkpVaFJBakpoQWptaUNRb0FKeWxhdUlJaGRQZTVTbTZkUG5lT3R6YkxVajNRL3FZOXMyeituMmFMZTI4TFFOallvZ2lOS28wQ0kzTVNBR1NFSlNxU1NWVkZWcVYrM0x0L2QzV2ZkMS9yLy9uUE5kNy9wcTc2cTlhMWNsVlpYNTMzdCs4emJtbU5jeDVwanpmZGRhblpVUUZSVVZGUm5kN0ZkVVZGUVlWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FLaVlnTlZLVlJVVkd5Z0tvV0tpb29OVktWUVVWR3hnYW9VS2lvcU5sQ1ZRa1ZGeFFhcVVxaW9xTmhBL1Q2RkZ4blNiS1FwV2NyRExaUzRXQzVqSmplWG15em1jVFNkeCtOSDA3aHdjQlNQeTEwNFBGYjRPRDUrZUJSUEhSekc1ZU9KYUh2bXQ0cU8rYTFXWGZGTHZFUGh6bnlXd2kxczlWV0dmeUtiOVR1dUg2eFd5eFFBblk0NTduVVcwZTkyWXRqcnhXalFpNzN0clRpN3V4MW41RTZOUnZGcHZiN2lXM0gzM2s3Y2RVcDVXNlBZR2ZaTTMxTzVnWnhZaVZmeTF6Z1pyL2hFb2lxRjV4SHRrV1JZNXhJdUMvRjhFVmVQeC9IWTVmMzQwQk5QeGtPUFB4bVBYNzRTdjNMcEtBNG4wemllUzlnWGkxZ3NWaEw4aGNwMm9pdXAyT3N0SlJ6ZFdJamZSRUk1bFQrV2ozaUtLazR2bE9kNjVIZDdzZXdQWWlWQlhGSkdQSG91MFRJR3BRZ1NrcitVVUQ0VDJtYmt5V1ZDdkQ5UVM2UTFsdXJqVXUxT0E3QlV2WW52WkRVUE5VVnhxU1dOUVdjK2liN2FQMVRmK21Rc2Q5VlA4UkY5djl1Tm5zSTkrK0g4L3RiTStTTXBrVHQzVDhYOWQ5OFJiM25nTmZINlY5d1Y5NTArRmZkSnlReWt4RkF3SFZ5dXQwRXIrc3c5cldpaktvVm5RRE13T2JCRXlDVzhrK2tzSG52cVl2emN4eTdFTHovMDRmalE0NC9GNDA5ZGlURTdiN2Nma3NlWWllNW9QdGNPdjRxcEV1WmE1TE9WQkxmWEZSZnQySWpjY0pnWXMySXA1SldyOUxSOUtqaFFVQ0pGMkdrbEw3dWxoSDRwSCtFV0hmUWhwWkQ0eVJKWVhSVVpFWlV6QzlIWVY1cnk1NE5ubnZyZS9PbjU3ZVd5bE1EbVVPT1RsR2lVMXRtVlEzSElyVkFhY2xZZXFEbVEybVZ6eEhuWkwya01QTHh3em9OUFNsWkNkQTR1V1luMCsvM1kwcmh1RFFlMmRIWTFybGd0cjk4YnhZT3ZlRVc4K2JVUHh1dnZmVVc4NHV6cDJOc2F4a0JLaGxGSmY5WTRFZjJVeGFlOFVuRG5OUVNzdWVQWkxDNWN1Um9QZmV6UitNQkhQaGEvOE1GSDQ3RW5MOGJGcTFlVk4vZlNSNWduRXY1ajdmQlhkaytuOGl3bkJGTUwwN3V4VjVkMnZaV0VsQjJjdUFSNmhkQXFibUdRWUhhRysxbG9LWUpRWXpaRGw5SldxNlEwdXRjVGFxVk50Y0RYUW9LdmRPcTNJTW5YVHBzZ0JVRjlLbC9xQTR0R3FLOFA1UGxweTZNZGwrSkxFRS96elhsV0FGSjkwNkhMNHpxcXE5TlZ2dWcwMms3clNXazVUOG1vU1NZQmxXa29QSjJxNTZKUGFwUTAyVWVxYzdYQU1wSENQWDFhYlZBNXpVMHMxRmZhZzlJQnRHZCtWWXhsZVlqbGx1clpFYzg5eFhla3VMRStWcjJGampvNzhicjdYeEcvNC9XZkZwLzVhUS9HQTNmZnBTUFByaFZIVHp6V281VndNdjV5eE10ZUtaVE8wVXRNK2Yyam8valFvNC9HcjMzZ29malpYM3RmUEhMaFFsellQNGhyazFtTVdZZ1NuT2tTODNzWll3dXhsaU83cjNhanRBdVhaYUhGZkR6M0x0V1R3MlRudkk0QzZQZUhrbjNPODRwSXdGZnM4UFlSZkRueFNDWitGbHJ6RkEwK05LV083YU4xT3N2UkNnZjFJVjlZMEI0RGdXY0JrMVBDb2I1SVFGeTI4SVpIOWdFQzlVeEFPWjFjSHExNHY3dGxvZTVxckx5TXBBenNvMkdGanM0QlBscDRoNmN0Sk1wWmVKVzJrQ1VrV3Q5WFVJNzJsR09JM0hBcjhWMllYb0lQWC9FcGlxMXpuSlFkbzJFQkZoOHRhSmRaY2UreXJRd2RXMkltaTRvNldBM3dGcDhPYmUyaytrUEhtcDc0OTVhVEdFZ1Rib3Y5MXFBZnAySW43amwvSmo3OVZmZkdaMzc2YStNelgvZEF2UGErZStPT1U3dStGM0V6VkJ5VUlYMDU0R1dqRkVvbkVNeWo4U1Nldkh3NWZ1SlgzaDN2ZnVpRDhSOGYra0I4NUlrTGNUQ2Q2dXd0czFrMGN4YmY4RHg3bGtaQnk2b0lQa0xySFZlTHFLT0ZxTjIvb3pKcHJ4S3RsWVNFVDI2NUtIRzVJc3gycVMyZFNEdTl6ZjhzeUVrd1VualUzZldpdHJEYk9sQTlYbDB1RUpNZEZySmdVME1vVmtETzc0NjRjOGg1b0FpamRtVFNaMzFKUlpNdjMySGFtdEtHaGU4Tk1GT1gyamk1VlBxVEpJRFV1OHJXQVJZQndDaVlkOGNheGl6d1RzejF1d3pqcStNRjVRQUtBYUhPZ2c5V09uNkpzTldIekFzRkFVdVVxdWxMbkRiSXQ3SmJ4bUMxSzUwd1ZiTFMxYTZ1bEJSRHY1aExTY0I3T1VyMG91MnBiRWRyb3J1Y1JRZHJKTGpqa1dKWFhTdFprQjN4NmF1K25VRTNUc2xDTzcyN0hmZkpvbmp6R3o0OVB2ZTN2em5lSkV2ajN2UG5ZaVJsc2g3Vk5BOHZOYnprbEVLN3NaajBqMSs2SE8vNmpmZkV2LzJsWDQ3LytQNkg0dU5YcmtrcFRPTklDbUIvTUVxTGtublI3aDFEVFJnN09BazJNN2ZTZ21PeDl2RVJUaHdGNUdtWDZUWnA2VktQWGQ4VHJmaG90TzFkREFWanF3QUZJdVZDR2VUTnh3Qm9pNE9QRlVqYXpia2lORmlwcHNsU2FBVWowdG1PNmNnM3ZkSTcxRUdhaEd2ZW1ZbGw1cVVrTGVOMWNhVXRvbGdTUUhVVW9Gd0E3YmxaWEdlWkRIbFN3WmhrUWNVcVFMQkwyb2dqZ3hVR2pwMWNWYXJ1a2ovQnZJY21zNVpkb1ZheTh5UFV3bUkzV1JvNEJOOVlLOEpCZDZGcU5mNElPWUt2dW4zY0VELzRENVlEbGVXNk40MkxVcFd1VVpMZ28zQjZzaFRjRmlrUkxJZEdxY3BEc2M2eE10UWVGSjJWaHR4S1IwYzd6Zm13TjVDUk1aR0NtVW5CZCtLTWxNWDVuWjI0LzY0NzQzV3lMcjc4Qzk0ZXIzL2cxZkdLODJkalN4dE9ialpUKzZMR2kxNHBsTVpOcGEwL3F0MytGMy8xM2ZIVHYvaUw4YXZ2ZTE5ODlHZ1oxNDRuTWRYa3Jib3kyWWZENlBSSEVqVU51d3AySlprOXpEd3QzcTRzQUFRSEV4dGhaV0ZOa0VFT3puak1sTUlzQUdRbENkVzVWRVpTNWgzY1BKSUFLbFU3eDFocDFNSGxZc2xuMlFJdDdTM3RSQTFTYWlxYjBKSFNTZ3M4S1FYWGs5dUc0QzRHV3BSa0V5K0tBMHNHS05pYjdpYjVWcG1sKzhGb3FRd2QwS0x1b1IwYVFDaUtWZ09XMnZXZUNaMVpGczZNcHk4VkNXcVJhRU5oQkN0ZFJxU3dzMVdubTZmNjJ0WUo0d2NkTkZrb3lVVndFZXhsT1Y1Uk9HVW95QTZmK1U4ekw4cXJIUm81ODdGbGdFQVBjajcwbE9QZXdadUJvS3llMmttZnJNeG9uMzE0aUtIcnl2VzRIeXFISlNNeXpaTDkyVUpLMThwSWZCbEtGTmRVU3NKeklPWDAxRFRPblQwZDUzYUdjZWZPS043OHVnZmppei92cmZIV04zOW0zSFhIZWQ5YnZCanhvbE1LTklZV0hVa0QvL3YzZnloKytwZmVGVC81czc4WUQzMzBZN0YvZE95ZHVUOFlSRzg0aWxrMzdZUnBSMFlReXJtZEtaT25mT2JhUW9Zd3lVKzBhVElhQVV4YVFQRjBFVWNieXFVY3p1czRDMnpadGFrRGp6d3VCNGxRM29tdW56MnYxSlB5bmQ1cVg4cE83WFkrZWZMTGhhTFRRRllFalpVQ2xMWkMrRW84dDVkalRxSGhCT1I4b2cxZDlrSGJrTGdlVnJrZElPK2lqUS9VZE1OQ0pFRWdyeWdFZ3BtVUplYWQyT0djTDNSMS9FckxMNlZocXEvNUkyenl5QzlDS1o5N0EwTmg2emVFSEJyVHBYQzU0N0FDZEI0RlV2bEcwTzJ5MGpIZk5mL1VYa2lwSzlIN1dDUCszRmtVeFdMK3RNUDBwVHcwNUVuWlNERjVXWmE0TDBOMVZGSGE3dlpXdk9uK1Y4ZVhmdDdiNGt1a0tON3dtbGZHaml4WmoxdHJpajRaZUZFb0JSckFZNzczUGZ4dy9JdC84elB4MHovL1MvSCtEMzhrcm5aSGNlWHFnUmY1YUdkYmRPemVvczVDc3V3TnMxRHlKd2xYV3lud2VERDVXZEJFMTFZS25oM1FVZ3I0Rmk3eFE2d2J4YUV5UlNtd0ZrZ2plWm5waWF5VlFoSlFKZGlIeHVuVWw5dWU2T1NBZmFYbnRqWDhjblpqUWFoRnFlN0VZOFZxQTZVL3BrbmwwNGFjK3dmZ2FXL050K24vRFpITHFCcVdTVm5jQmtLaTRrMGNvU0NNN3poaCtHT2FFMDBDaytpZFlLV1FTRlBaNHB1M014S3Y1cDRCQVlRZnZ2a0krQkxrUmxnekg5UFFmc2hNazhvM1NnSHdTTmYrV3FoVE8xdUtKNWR0SzRWQ2cxSklZY1lvbFcveldXb0R5OFB1OGlnRmZJNUp6QU4zR3gyMVp5RGE4MXU5K013SEg0Z3ZmY2ZueHBlODR4M3g0S3Z1MS9GTTYxZmx5M1I5b3ZCSlVRcFVTSzFQWHQyUFgvd1B2eG8vL0JNL0VULzNxNzhlajE2K0hNY3pEV3AvSU5uUmVYQ3VNNklHcGorUzhJdCt6bnNBQ0kzU0xCeTlaSDY3QXhMc0pEaEp1Tkxpejdzbm80cmdXQ2dWMFdJdHdwNkVUT21FRzZHbWdBUWFaUUdVVmdTektCOVFlR3lXelhVcXY2dTJiRm9TS2Q5MG9KLzVOd29oMWRQa1p3V1MrclZXQ09reVVyQlNTSXJIZWVLVDJwVEt3Y2Z0RTF3M0tENmdYVGNCU3BURlg1WUxWVnRCV3lCTGVoWThkbGVoa3pTVDhoQW0rZDc5RlRDTmxJTDlYRllDWngraHNvOGpzMVdtRWJ6RXY3U2xDQ3Q1aldKeCtscTRyNnNVU2hyV2pmT1NwV0xsUng5SUEvSnArMG5GME01dkt3WHk2SytmbXFna28yQWxKZjcyUmNQZHg2S24vUHpFcFV2L3AxSlNzNm1Vd1NEdXZlTmMvTzdYLzliNDJxLzgwbmo3MjM1WDNISDZGTk5wWGk4MFBxRktnWXU2Snk1ZWlSLy9sejhkMy85RFB4Sy9mdUh4dVBqeEMwbWdkdmNrRzFrZ2ROYU92c0pIaHdwTFFVZ0pKRk5PZVFvN3JuQW43OFF1azVVQ3dwK1VnTVNvazVXSGFiSlF5OW1hQUFxbnZLSWtVdjFKZ0JKdkhBTkVHNjBrc3FKSTlDbHZyVEJVM240dTN5aVZ0UkpxSzRVVnIrNWRWeUdrdXBmT0YxUSsxU1YrcHFNUGtLWDhGRmRaUjVKU012S1p0ZEFuSHNrSFdXWnZpS0pjV0NMRlNtZ3JodVlDejhLaFBCWjhFWHo5dHhDUlF6bk5tTXNoUExsOEoxc0t4V1MzUUx0TXBzbjVoSGt5NERTRVJ6N3Q4VDFLcm9OMEM3emk2N3BLSHVGU1BwZHh2dEphK1c2di9JWS90SFNZZExrTmEwQndIZVE1b2pRL1FVbjNJZTZQbjRJNDBpaURGTTdsKzBwemUwcWJOQ0g0S0pQWlBBYnpsWjltYk10ZytLelh2emIrYjkvNGRmSEY3L2o4T0xlM3A3bFIwOHpsK2NjTHJoUmdmanlleEMrODY1ZmplMy93aCtKbmYvay94aE02RWt4bEJYUzJkcng3ZDN0OXZ4ZmdOVEFZcHQ1T1pCVnNKeUV3ZUdUb2tWQWFUVmE1VG1lUThpUWNuTnU5MkxXUWsxQkR5bzF2RWdoYkRTcmpQTXhhK1VVNGl0QTJRdTN5UFhscklWcGJBcG5XeGRMeHBGMjI3TmIwZ1ZocVV5NlQ2VXI1RGF1QjhncGJFT0dqOExJb0ZkT1RMeS9UZU5KWWZTNmYrMVBxTHZVcWJEcFNGRy9xelh5VWtPSTNBdlNNTlV6S01tRlJGNllHZ3NDQ1Z5S0wyOGlXUVZyN0RqaU9zTGVFcUNnTjB0YkhnaVE0aHA4S3JBVzhyUmlBQlNvRnpLTXQxRTE5dWF6TDJNOEM2SEk1ano2UWxpMkZvbFNhOXVWeWlhLzRsSFRvN1N0ZStwUHJMMHJGZHloT0owMWg4MDAweStNRGIzcDlyR0xSdWp2Vzl2Q1VQNTlFU0haNmc1NFVReWZteDlkaVIvNlgvcDYzeHpkK3pWZkZGMy91NS9vMWI4LzE4NGdYVENud3ZzQVRGeS9IOS8vakg0ci83Ui8rbzNqa3dzVTRuTTlqcmdYZEhZMjA0TldabVJheDEyWVdQZ2wrVDRQRVl1UXhYMjhvODFzNXZ0QkI2Q1dFSG1RTnhQYjJYb3pINDFRWjVSRWdDOEphMERpQ1VOUUNrWVhOZ2tGWVFFbUE1Z0lQWVNNZmw2MFFuSGRVNVNXbGtnWEplYW45RnRqQ3Q1UzNwUUFaUzJ3dHBLVU80bFkwZWZmSE5RcUJOS0Y1T2tBNk5EbHNYc0lxSHovTXE3RWkxRWF6Sy93ektHUFhpdWQ2YmdqVENHV0o0Qk5zbGd5cldGeGFnc3Y4V0NDSmU2Y1VUSjhFQXFGcDB0Z0Z0TnNuWlVCZWkwWmVLVitVUVZ2b0VMUk5KU05hNkJWZld3cXR1b3BTZ0s2VWFiZXZxU01yRlNldjQ0a210Ylh3UllINTJBS2djNzdTbkpmYXkzajRrYWZTM0EveXBFekkzOVZjelpHSldYcnN5cU5zbnBheDNqbDZkRkVFczRtT0Z1S2hZMFZ2cFhLTGVTd21remk5dHhPLzlkNTc0ay8rc1crTHIveVNMNG83enB4dXB2WjI4YndyQlpoZGtETDRPLy9yOThVUC9NUlB4c01mZWlTR3AvWnNDaDhkSGtaZjRmN1dNTVlIQjFyL2U4MEM1cTFBSGgwUzUwTkJTVzFLc0hTK0l0K21PQmFGWHpwUkxUeCtaQUJ6K2FjcEJjcUluanhQUGVrV1Nsd1dMQXV2Mm96MFpvRnRhRlIzVitucFRtQ2QxOVFqSktXUTBndE5VanBKMkhoWkJqVDhLUzhhdDVjc0xCMlhvM3ptbzNyTmczSVcrbHlmazByNzVBdlpTMjBBYXB2YkFhZ0Q2Nm9nODJ4OFVDeXRHNkdZQkN3UmdtV3BaTDlSQnNKYWVKS2dPV3pUVDY0SW9ZVWRtaVFjVHNlVkp4YUVLVzhhQ1pVRUF6NUp1RkpaQ3hiNVFtTXBlTDJrc2tYQkpNV2d0UUlwOUpRdi9QRmRqbmpMWmQ1dDZ3UTBkVnJvaXdLamJVb24zM201Ykx0OStQU0JkaXBJbTN5MGtGSkFDZkJ1WEhuUnpLOXUrMzJMWkgxMHJORFZqdU5qSDVuTlFQeTBlbnhCaWZJWVNCWjQ2dnJLODJmaU83N3RXK05idnVIcnBDeDIwMUs1RFR5dlNtRThuY1VQL3RNZmplLzUyLzlMdk85REQ4ZHhkMWZyV010OEpQT0ljOUl3Q3dlZDV4aytMd3JRWWZjNU40TjhqZ2JxZEhjeHN2YWNjY0VvNlJ4c2J5ay9IVFZJbjF0ZWlvQmw0U21Db0hCUkNzMDdCQllvaUZNN3lNTlpqenRQN1NrMENxc1Z6NmdVb3B2ZVdOd3NtL1AxbnhlTHdFbWxnSi9hbFlWUzRlc3JCZlVsODBxK2FFRHhjMWVMc3ZDRkpvQ1dQbkl2SXhSK2JnTndQdDR6S3dXZWJuZ1JsN2twd2xUaTNtbXpFQXRGTWZnb1FEbVVndlBrWEZacm9PSFJDcmZ6aWxJQU9tS2FUaWc3ZFBGZHo3TXBoWEo4eUdVYUdqelM5VDl0UG9McEV2MWF3VUd3cnB2eXRvU0lDNnY4OU9La1VrajFFNldOU21lY1JISlNLVVJmTWlCTHdPOVBVQURIa1lTNjFFanVGR2F6bWZhL1ljeW00anVkUm1lNHBmSXF5K1pJL3c0UFlsZUtvRHMrampjKzhKcjRiLzc4ZnhsZjhQYlBsOUxJYStFNTRIbFRDazljdWhMZi9sLytWL0d2Zi9HWDRsakt3Y0lNYXkvRXRORDl1bkF4YVJHRUxNQkZhSk9nWkFFQ2xIRmFXdlNONENFRUZCSHRTVXVoblAxSnM2REp1VzdGUzVnZDFjaDBmQTZCY0xxbkVBMTVsQ21QTk1sejJ4T1AxS2FjTGxjRWV0M094Ti85aFE1ZWFuTXBuMmh5T0N1b3BseEpsK2VHT0o3VFQ1WjNYd3ROU2M4K3lmcm52cmNzakkzK0k0QXVDM0VxMDRDNTgzc0tMR2pDTFdkaE0xVkNGb2dpZkd1aFlZR1RScDc0bEh3bkpSb2pDMXk1dWFkZENJODNFcERMTmI1b0VnOU05YnlydTN5cW8vQXA2YVZNQ1pmMjBTWm8zSDJFMmZGMFVRaTlCUmRRM21YWC9KM2M4TVN0Mjlmd1Y5ajhpZWU2MGppazhpN1RMaXRYckpUU1AvSTlNN2w5dEpNNE5DdmVwcFRDUUxYUGpvNWpwRTFrVjdMM1I3LzFtK0s3L3Q5L0pzNXM1MDNyRnBGWHgrM2hrVWNmaTIvL1UzODJmdnhmL210LzdtQ3VzNzZQQUJXM2h5S29GdHdUcnFBZGJrUHBWZ0NDRmRNSkpDV0pRa3YrMDV5VnlETzRrbjhkbUdkQnUweHhUazUreFhQSFZ2NlU2QnlyUVVxQ0QrY2REUWJ4UDh0Uy8wLys4ejhWRnkvdlo4cGJ3MjByaFd1SGgvSG4vL0ozeFkvL3lJL0pIQnFxamNzWW5UN2xNMC9GN1FQaEtjNENWWVNwcERsNEhlRnVwVHRQUXB5c2hCUmZ2NWFkckNQT3NNWFprbkM0V0NpaWNackNPVzQvVmRLNHBpNG41L1FVMmNndk5CVzNoL0cxYS9vejFuUjBZekFheFhnMmRYaXhzeDAvL3EvK1Zienp2LzN1T01hYXVFWGNsbEtRaFJOLzkzdS9MLzc1VC8xTTlPNjh5MjhkNmhEa20xTStpRkp4ZTdpaDhKQ2U4OXFDVnB6KzJKWHd5Znp5OGhOaEZsSDVrQlhPU29NMEJKOXd6cU9NYVFvdE5DWHRPcTd3TCtHVHVGSDZCbTVFY3pObFB3WFFINDZpdDd1YmpoS2FLK1R4NlBqSTRkR3BVL0YvL0tOL0hQL1h6L3ljODI4RnQ2VVVNRm0rL3gvL2NDeTQvTk5KNStEU1piVzA3OGVKelhtdzRyYlFGcDZUUXZac2dzVlNNQTBMUnE3NEphMXhMVHA4RkVCUkhFWkp6N1NLYkZ3cFhBL21sMEg0WlB5V0FIM21jY3RsWDhhWWMzZkhyWXFzZ2ZuUmtSVjhmM3RMc3JpSy9XdFhZOUVieE4vOXZ1L0wxRGVQMjFJS3ZJdkFsNU5jZS9LcEdHM3ZhT0prZXVyWXdObW1PMml1eGl1ZUozaEh1QVd0andCZDd6NWhuY2IwSitmM0hGWjhhTG1kbHVCNmM0eXl0N3J6M0dxN04zQURKVkNWQS90dmV0TzN3K041SFIvbWk3bGRsNmRPY3Z2N1YrSTNmdk0zTS9YTmc5bC96bUJpTGx5NkVuSHFUQnhjTzRpdDgrZDhTNHJXcW5oK2NFTmhhZ25hMDJoeWZKa0ZtY2VxaEs2cklPQ1RmZWdTbkVLaS9pWWVCbnh4cGt2cEordHV0K2xrWHNHTjBpdHVEZjF1THhhVDlDVXkzT0g1eFQrTjdZS1grdVNmdWV2TzJEKzhkVm04TGFVQVh2LzZOL2dlQVF0aGZHVmZHbXZicjI0dVNhdDR3WEZTQ0s4cmNLUzEwd21qS0tCM05PZWRwR3VRMDl0MExaeXN1K0ZYOFlLQ04zcEgyOXN4a0tYQVJyemd4U2UvbTdLSzN0WW9ya2toUEplNXVDMmx3TG56aWQvM2JSR3YvVjJ4OWNTbDJPbU1ZN2k2cEJ5eDdjbjhYRTNscldMWTYvaWJhL3pjdXJ2Z2U4aUNieXJ6bDJGQXJiTVFMcDFaMVFrNm9pRFBhbkU4Tnk1aHNsc2IxUTNCWUxEejhhRVp2bmRncVNxWDNSUmVpUkVPUGpqeko1eWZMenVjK1Yrdm1wTTc3dE4yNEpad21JOGE0c2xKdHJmaUtleDZSSkNNZDg3THhFbGN1Z0Vteis4OEFMNjFpR3gvZVl6Qy91aTBzaE5kZnFiT2V3VThEcVllUEw2Um1jK1pxTTd1ZkI0ZHpFdk5ROWN2aEltQWhTVEh0d2xadWVOMFZyVnpQbnpvQjIybVdlSXYzMDc1NWJtNTY4MjJDZTFpM1BtVUtHQU11cm0vOU1GcC9xTjI1WEx1czBwelcwRzNFajg4UlR4ZVdmR283K1NYeGE0VSsyM2trZ21zcVR5dzVVNmlPTllBRFVsckpZMDNjWHFSZXBLUXlYSS8xbW4wbndNWGZXQmM4SG5MMDNFNTAvbTlCSEZUSGFUeGtpdGZXKyt3ZVBRVVlsYlQvSytkMjkzVkhIVDU1cWlaWEhwL2dqSGwzNEEzMTNxTG1DeU9ZN1lVblJTRE84QkNINTdTZlBaaWRPVkNuRjU4Z3A4K3NORDJQdU8zeGRZM2ZWMk1QK2QzeHRGaUsxWlB6bUpYRFJwc3dicXZNODdLMy8rL2NFZlZrWGsvK29kYTFGZFcwVmRIVUFaY1NpNzkrbkpyT3ZPa1h3OWxRVHdiVkdNRFQySkJxL3hKWHUxNG1zaWJnTWJCNVlwcjRZWnQ1Y1VVKzNteHQ5eEdXL1BpS3ZDaUZFSEQxMzRwSU5xU2prQWpUQVc1amN4WktZdWdQNU9EVi9MVG9tN3pzQUlsVFNocGdNVmUrUHVOd3V1Z1BhYUZGaEJ1eXVKbm5vQXg4YmhJZVpEM3RQbk1aWEh0UmIwNWxtdVlQM240VHNpdW9CMStBZUQ2bndVZGY4Vi9YL3FocnpGTEw1NGg5NmdKWEhjNGdzaEtIOFZPdi9tMFVFK0tZRFUrOEZOQUs1aGJ4RzBwQmRVWWo2ZzlZeW1HMDkvMHJiSDFaWDh3cG1mdWo4TjlhYS9EdzloZWRHTW96ZFhsZFdDT0ZYeFBvczVCUFNtSHZlM2RXTXlrTEJwbG9HNlR4MXVPZEtTMUlNcGtwNGw4RHJNbFhrM1pteXhmSnUxcGRlTmFiWFA4SkVoUytucFhZZWRJZmdQbGxUcmFLRk5vSVpOalVaYzMyL0FwNHp3eThQV2Z2QlRHSlZvN2RsL0hLWWVTU0Q2N3V5MkV2SXZkMEtFTXNPYk1XK1hnNFhLSlYxRU81cGZyTHUwcmIrWlJGdDhmRExLZmFFcWVvYkRMS0Zpc2dBMWh0aFdSL0RLbVRvTkhteTdEdklVMGR2NWovdXUybkNpVWFleEttd3BPMG1ZOGpjY3pvRTE3c3R5TitKRGVXMGdoTENVUHE3NjZpVXMyU1BLWkFva3YxcU5rWnRBZnhGQmowcDhleCtMYWxWaGRmTUt2U0tmdmRMZzEzSlpTMFBENmE5TldzKzBZM2ZmRzJQM2lyNHc3dnVtYlkvaTJkMmhHVGtWSEp1ank2RGhpL3lBR090OE1aS0oyWlRWTWV0TTRHRTdUZ0RBbVVnSTI1eFQzYldwT2N4MDNHRFJsUEdOZWdYZTZreURwUm1WYmFJUWFwN0RiVllxeGVBb1BmTGttMzNIKzA1ZE5ZVWhDQ3RGYUFCeEhLRnFMMXVrOFhKSnZ2bDRPeVFkZTVPYUZnQkpXT242VG5zTnlTU0RVRHR4aTdkSkhoVy9zT0dxa2p3ckxsL0xtRTNwdW8rSjJ5aXV2TWx2cGlHZHExN290YnI4VkRINXFsMm1MSWpGOW9tdjZuY3Nwb0x5a2ZEYVVTUTRianVlNUVaM3JCdzJQVFREbTY3blVuNmVUcERhMVVPb3RybzNyMVFHdVIxdHdQUjV0VjdDWWFRWEpDbGgvaGdUZ2EreFFpaHJYbml3RjJkdFNJRklBaHdjeDJkZngvYXJjK0pvVndpZGNLUUIrMm16cmFCWFQvV1ZjTzNWM2pONysrK0wrUC9UTmNmYXIvMGdjdmY3ZW1OKzVwNmxkeHZ4b0hNUEpOSFkwb1lQT1ZJMDlkSWQ4YXlySFpDNWxPYXlrU0ZpOGZLN2hackV4b0sxQlRjS1VPdGtzaEFLVHRoUFdLT240YVVHZTRNK2lJVTllRWdLSUU3M3pVK0gxNGhLaGFSRnNKNlhGZmxQOG9XTVJtQzRKVWhLUWxKWStiSlBEQ0dNcGo5Qlo4RVdmZmJlMUtBZWNoUHhtbk84Y1JJK1NTSlpDVWhoT2c2ZkNhUnhVRi9XV090VWVGRUxxV3hIcW5FODc5VjhCeDB2N05zWUJaNGlQL2xxZ0dUc25GUnFGUzVrQzhvcWYrZUlYM3VzNkVwbVJ3MmwrcUVkbzgyeGhveTdoYVh5dmgrdmszWWkycEJkKzdyc2FpSTJnemlTbk5hSERldlJtMDVoZHV4cmpTeGRqZHZtaVB5REZuUkcvMDFsNDNDcTBrVDZIVWhtOHAzRFhqL3g2WEpacGM2ZmNvWTRJdzlWUmJHK2QxbEhnVWd5ZitvMjQ5cEZINC9KL2ZHL01mL05ERVU5YzBQbG5ITjJkWVl4MlJuRThrN2oyKzlFYjVxOWZVei9vT2xhRHczSStFNVVQOGpRZjlsRTVyQXN1SnpQTjB6NDZMWlF2V2FGTStiQ1MrWERaSlo5UEZib3NRMDU2dTd3YzMreVU2Q2lmd3VRM0wvYVVQTnJqdk5hbk11VTZucnlVbC9obmZwd1BUVExNUG1WeTN3b2RQT1Fwa1BKek9aZUhWbGdtS1pHVFVpMDhBRHpJeVBHVTU0RGp4U2Y5bWVCWG9GRTBoRmttQ0xUQUFrMXgrQ3RmWWVKWVpjbFBkRndLcGtEYTdWMCtDeWNYZEVzYXBiQjVJTHh0Q3dORmFGNUpxVGpjV0JlWnY4dHpySEZFY3BMek16K1hFNUsxazlwSFdhZTdqdFIySS9OZVd6TktQNUdIUXJYaVV0dW9FeXVKSGlaK20rV0IwNXZqRjJucCtKTXNyZlZScUswb20vNEtYVmtLTEFWNDl6dzJmTFNhQytEMEtjdis0VGltc3RTWHZBSXc0N3RGVmpHUTh6akx6V1JsUFBEQUEvSHd3dzgvNjF5M2NmdEs0Y2MrR0plR3l6ZzNPZGJDMVRFQ00yWjBOZzc2VitPZVhqZEdhbHovNkRER2ozNGs5ai93bTNINW9mZkY4cU1mamJoeU9XSjNOekZpb2ZlSFZnN2NLZkQ1aVRtRFlBSFFnaTVDVndRSFgrblBwaFM0b0RFOVVCa0xwaHpDNDBHaVREdnZSSGtMSVhDWjNJYTIwcEJMOVdkRlVmSXlYLzlNR2tDUlpQNytlRFA4bkpHLzR0MzhWZGI4UllQWUtXaWxRTDVTRWwxUk9pVHovWThhSStjTHFpUGw1VFlETHFneXZRSC9BcVdiNXpPQU5rTGhSVXVZT1FFc2NnUXFqNCtYa09ZTTJMSXBTNnI0Rm9vc0hIS04waWdOSzRMa2haOW9KRjFKd0lEeTJnb0IvZ3d0VnJVU0VyMXBGTTQwcVJoMUlXeUt1OTZjQnozNVJTbTRmRXR4Q1lRbG5nNDM3UlAvb2hTYU1zcE8vVTgwMTFVS1dFMUdLays1WjFVS2NsbzE1dXRqSEY4M01CM0xrdWE0enNldHBWaDBKUGVidytMUFV2R1A4Nm84ZDNXOHhDUm1WZ29mL09BSG4zV3UyN2hOcFJCeCtwOStPQTY3QjNHdU80bnUxazZNZEV4WXJjNW9QVTVpTkRrZm5TMDFabGVON2gvSDl2d2dlcGN1eE9Rakg0bkRSejhXMDEvOTFkaS9kaTJPWmY3NEJwWEhLbHRiL3NJVm1yWCtqc0lzTUcyZlJYMFRTcUhrUDU5S3dmV1JYOG9qOU8yeU9iMnJoWjNTRWNCU1I2dk5XU2xZTnVpVCtSTXBkWm1OZWZvYmxlQ1RyUVZEdmlmUCtiUkJRWlpTeVVjcEZqUnB1QkordHFtbkFYa2hnNndVR2lVQmYrZmxCYzNDTHJzb3k0cHFuRTFDV3ZoRitOS3l5eDFrNFRzdkM0VENTWEdrdUk5ZHppY3ZLUVhpU2hYZFdvaE9Lb1dpcUpveUpROWV3bzJVQXJRSXJEaW5mUHB0T3ZrSU9NcTRsSUZQNFN0L1F5bEFYOG9ZVDFjS0xrczdsTjd3QVU1UHg3VU9qNHQ1SVdsOEZLdGpXUVVUTElOWjlFVHJ4L2s4bmhZOVZmbStTT0cwdm1ieG10ZTg1aE90RkZaeDZvZmZGOGRiM1RncjgyWGFHOFhPaWwvZTJkTjhIK29vb1VuVHZQYzErVU10eW9HRW5MUE9RQTJrTThQSG40aHJPZ2RkZXZTUnVQTEloK0xvaVkvRy9OS1RzVHE2R2t0cHc4NnBQUXNldjgzWUc2U25GMWdOY3ltUU9RTTlVa2ZwckhqNnE5SVVUbCtaUnIzeTUrbmJtZmlKdC9JZGovUzJURGIzRnVrZGlmVDdFTTNPUlhuUnp2dEtOWDhXcnh5RkVkNThEN0xNM3hRRmpZWFN3YlhRMnNKeCtlS3lNaElOdnRzQktPUDBUSStqckpLZHJmajZleWpTa1FlczFGZXZTZ0NQNHBNbUdqLzFFWW9WWDlwMXN5ajFBQyswM055eXc4bEFUUUVXZXN2M3dnY1diSUVGajdKd2VsWWdwR2RoOFJKc0MwTXA1MTlvRWtwZTJhR0JCTFVubVhIUVpaSXdsRjBYK0Z1TnFKdDBUSDNDMUptRlhDdkVkTTQzYjlMbHd3OWdyaE5XV1JZSVA1VVBiL01SYlgrYXZwbkw5WXVBK2FUK3Nvd0dZNjBKZUNzTmN6KzFMZFh0dmpBOTlFME9KY2czT25lMDdoZFNBaXYxZmZmSnAzeFJtSDdSS24vSVVHV2JhVEVyMnBQNlRwN3JsMitsSnF2OWszSjh1Rldsd0srem9SUm81QTVmV3FtQjdHdncrOGVITVpXQzJQLzRvM0g1OFkvRzRlVXI4ZmdIMysvdlpvaXhKb2VYYW5vRERhU1V3MmdVQTVYdERib2FXZ1pDVG53OUtXNVpHcUFZbkhJc0NVa1NQUDlhbFBoUS85eEp5bFJobC9SUUlJd1NXcFJLUHdrZ3pnWmF5VmNlYVVrb1ZSNWhLL3hiSnI2SHRnaThhZUF0QjQrU1Z0RFF5WGNjK2pWTnNUVEswU0xWcjR3VWtZT29sRTIrdjlQU0lVaFNtMUtrK0NYd0xNaE1HbUVYS0xuK0tUZWg1QlhmWTZXZFVaNEZUa2dDeXY2ZXhxWUliTElzc2pEaUE4SVM0TFlsc002VE5BZ29CZWZsdWJQUU5HMFViVlk2cFBtQzBuNnEwNHB0S2hQYzVTWFFDQ3RsWEU5SzQ0dDduWTVDMFZuRkx5cjVSYTRrNUJ6bktHOGVva21XUVJKY08xNGt3cXFBblZ3NWZya3RRcCtqd0p6SDhod05wam9XeU1yMnkyUHAyNWkycFJDb3grT3N2aFNsa0JnS3NGYjhKYVVVUmhwR3k0RldJMHFCcnh3c1NnRXMrbElLU3QrU3N0Z1I0WlpXUjk5djFtbHdwQmxYRng2TGcvMnI4ZFNUVDhTVEZ6NGVWeTQrRlFkWDltT1pQMGNlZkFpTDVyT1REOUtYdnJLREYwRnFmb1JGWUtlbG94d0R5Z0RHVHY0dFNWeGJHQW5qc3diaGhSTEFMRmRRa1hVWmpqZDBzTVJMT1FubHBoQzI4NkF2YWRtOGQzdlhmTXBSSUszYzNDN1JGTVZBWnFNVUFEenRVd2MrTkNpdTB1WU0wdTBuTDFsQXo0Q3lORHh3T1p6aFJiZlNZaTRvK1VVb0hWZEZ2aHNvYVdYeHNqTXFybTAyTFQrdmJxYzM1Umw4anBTZzVEbWNhWVd1WkVRUng4MUhPMjNpbC9nMzcxaGtJWlJVcGVISmFUMGJBaW1QY3MxZGdmSVNQNlVoNktxYjM2amcrT0doczdXeDBLYVMrZEkya2NPWDNaNXkxRC9Ya2RyOE9OOVRodlpnL1JCWCtyYU8yZ3NKN3BJbmJsSUcvSWh0UTZ0Mmxla3BWbFpiS2FUMkVYMkpLWVV0TDFKZXU5QVJRQjBwU2dGUm9KRWplaTBlWEk3MHRYcFJIRnRLRy9UN291dkdtUzJWcDhNeXFaYlQ0NWdkSFVncHlKcTQ5RlFjWHR1UHh6N3drVGcrUG82clY2L0dFVGV3RENqZEtXNXZWeFhwdnhRRlh5UFBKemM1WHBTZGRBbzliYkFpVWFzUXVHUVBLbGR1a0pTRzd3NVVoamI3cTlzSytKbXZESi81N2E4RnNaTXRFdUxwaVFSOHlKU2pyakxydVQxcnhRR044cXdVQktjVlJaT3NGR0FGa2NPdTMwRjRPR2xkSmtlVFJPUk1lNFh3QmlDYlJaMWhRZFBZbEZMRkFuQUZqRm1MbGppdmNKdWVjbHJCeVRJb1pWcjBwbGt2N0VZQmxKMmVPTFF3d29kRy9McUwxQktYYXltRXd0ZjJIVmtJTnV0SXpnb2hDNDdIaWp5UWVlQlRMdkVrWFdrV1V2aGhMUWlVVWY0Q29hZGZ5dVBYcm5xaVEzbjRHS0Mwby9rVjAvSUtlV2VpdGNaUDR1T3o0WWxtaUhXaE11a0hheVVENG9hY1VCYU0yU0NGY2d4eWcxVHZrbllLdkw5QU8xOXlTZ0U1d0ZMZ1cyYzVrN1dWd3ZiaTJKLzA2bXZISGZKV2xvalprNVBUQU9oTXpKRmpTeWIvcm80S2ZQZjlJT1pXRUdqV2tjYjNXTXBnZjM4L0xsKytiSGZwMHFXNGN1VktIQjhjeGxPSFYvTlhhS09CeFErRmdBTGdHQ0tCR2tqb2FZY3Y3NVRIM1VJU21yU0RqVk5RdENxSDRFSXJYME92UkdHWUxBaGcwNzRJTExUQVJ3V0JNa3B1bmpBNExhVWJUcU9Pek45NStzUE1lc2RQaXFYZEJpTXJEVitDUWc5VCszalVsZXNYS04vd3VVbTRMd1ZGMEhMWHZXeTRTTTNMeDAwbG5PbEF5V3NFbmpsMWZsclVuVWFva3pEYU5UUUNTaHM0VCtrZ0N5NUlGMnlLaXo3eFQyRUxzcURWNS9iNmJVb0UyY0tkZGwzbytTeU1RUm40bHJLd2doL2pWK3J6b3c0VWtjb2l6RXJyZDJUeUs5ekJvcEdnZDdRbVZ6cVNsRytoWGh4ZlRrcEVhN0JQZWZXbkoxcnE1MEp5ekowQ1NrRThHRCtQcmNxUjUyUERYR0htVzVscGZGTmJtcmREWHc1S0FVc0JrU3BLWVdlUU5DRUtnQStIc05mMkpDQW9DSlJGajR0Q2RkS1dSR2NSMjFybjJ4SzBnUmpCYjF0bE9DN3d1WElzQ3lZVnkrRklDZ0gvNDljdTI0SzRjblUvcmx5KzZpK2UyTDkyR0lmSFJ6SGhhNm9takp3bUZJZEFzUWgwcEdudUZQamRCUVlUb1pVaTRjS3kzRWN3YkhOK29OU0RMWG9yRlpXUnd3YzhoNGZXRjMwV1VvUlN0SlJYV3ZIcHVhRStPMDNCcEJ6VUx2TlA3WEFlMW9UekUxMFR6Z3BKU3lTWFVTbmFrK3NCellWampwZm9qZER3ejM0aitJS0ZUUm5OOGtHZ2hMU2pKU3haeEFWRnVFcWF3K3BYTzE1b1VBenl5eTlJWVdVay91ektTUkJTV09WemZjWEViaXNZbDgvS2hMWVhoVkRPOURNK25FY3Y0ZUZkWGdLVkZRZjBIZC8rU3pnUmNya09lUkpnZmppVzlON3NLTldwdEpoSmtDV0U1WGhBRzRkY2xvc1BzOXZUR29PV2RZNFFNNlpYZWxJaXROUDlTV01LRFFxQmR2UnkvMDhxaFplVnBYRHlUb0d3TjIveU5EbDlDVUc2ZXhDOU1yWVcyWEtBRHNVZ3pUN1VRaWVQWjdMOU9TOXNNT2hjWUthMFFSWXMwaWFEZ1c5dng5T3BmNjZlNzdCRFdSd2NIbHNwWEw1eXpmNDF4UThQVVJaajUvT1JWTjRiMXd5cmt5d0VPVG9DRUc3aUROdXVqaGVBQnFJWTZGZFdDSVRYUXFneWRCUWZXbnhBbWdBdFMxVUI1V2MrQWhQalBLS1VVYmhZQ1Q0NmVIRVhaVUIyc2pMb1BiQ2VUS3dhR3NQODBpNzZUSEM5UWtQWFdpcGVkTW92QzdCWlJnaFlScFBHWWk0K2FTMGE0bFl3SmEvUVFpTkhxd3NmTmdpSHMxQllLUWpYVXdpa2NwRUkzSDdsMGM3Q24zQnZ5ZU56dFQ4ckE3OFBZRis4VURxVGd5U2djcnptYllXa2ZBcy9kTEpZcVZkL3pNZjF1eDBwcmEvMTJ5Z3gxV0hhdk12VHB2RnFyTFE4eUlKV3NIMkVuWHA1TTlFUXIzYi9tbnVRbDdKUzRFNmhyUlNLcFRDYWpaS1NZT2ZQMXNCQW5ScG9iSkNYN2pMOTZBWEhDNFMrbkJHUkIzYkJyWjdNcnF3SXVDbjI1R3V5aXFrNDdvODh1RXBSQWJXQ1I0aml3bDBDeW1JaWk0VDFOVk1jSlRDYnplTm9Jc1Z3TkltcEZNbHkvMkpNbFk2U0dJK2xVS2FUbUl4bk1aRnltV3VSakxWVGlMRW5nWDlKQXVYVERvWjFLS3VEeVVDUTNXajFQRFZlQkVLSkN3aHlPb0prd1ZZNVd3cmwrR0E2bGFPZldUR29RdWR4ejJFYTVlTUQrcGtHcFBCeU1DSFROUDZOY0oybDRZVjlBdlEvQ1hiT0t6UzAyV2xaaVdhaE1laWJ4aXVWUzR2ZGFORTBpNTF3WHV6cm93aHBqRWNSbUNRUStpT1g2NU9wbmhTV3l1WTFBZjlDdjNWNDJYVnh2dWNJMENnRmpnUEs3ODcyVTc3U2lqVnJJYy90R21rYTRNMzZZcDNOY3h0TDJvSWZKc2x3RzhoakxESzIrUzBIcFZueGFJSTZjbzR6QkVycnBKdFVPT1UycC82VjQwTWExaGVsVW5oL1VncFRLWVgrVUVwQjVuNVdDajR1cURIY0ZXQUpjSVRDeDFMZ2N3OWRLUUh1R1Fpak5GSjZva0hJUi9KUkRpWGYxZ1E4c3BKQVRhUnltakNOQWxPdzBNQXVOSUFhUnI4VnlYVDZkeW9WWjAwd3pQaGdhcUdSTUVLandpcG1BY1BzUjRobTBzU1V4Y3FZcWRCWVBrcGlCbi94bU9ZN2k2bE1SNVRLUkQ3S2hQQmNFeldhWGt0S0NhZXkvbkNLQ2pMa2FSSnpRN3gyVkNIdFlmTGNMUDZvdDhRTjhwTUY1SmpDaTFIT2h6VFR0U2VmbDZNU1VocGpDN2dBcEtvWlg4alJLbHQ0TS9aQXF0TitJc0xMOFJ4dDZqYThRbE93OUl1WG01ekdLcGRQZVh3ck84M3Rja2Q1N2ZGSUM5b3ZBQWs5THVDVTV1SHg1R0M1d1UvbDVXL04wMDd1eVZDWlJKZk80d2p1OE9BS0thWnRsQWtLb05TbjlNWnZDWjdib0dLMHcvbVpoK3ZLY2Fjem40NlVkaWMrRGtPVythZDQ1bFhhSWZEZEMrYVo2YWl6ME5NbjVzTjl5VzBUb1drNFBwakd6YUhlek5ObFUxNVZDczlSS1l3OWdHbUhuYXNkakR0MHhJdFN3R2NxT0xQeis1Y01Gb3JETkxKa0ZpZ09MUTVleldaK1haZDJHaVp6Y256RkUrU0pGVTN5MHdUaXVBeHQ4am1yeWw5cXQzSWNHdFVMQ0RjTEovdGdZcGxMWVM5Qyt6a2dMRHZiL0hVZWk4S1h0MFphWEpOc2NWai9DTkFVUHFEOFZxWHB2U2dGalZsQitTbDV5bmdYRXhpWmRwdmdUWndaS1gwb1F0VFhtQ1JhT2VYUjc4TGYrVHkvRjF5M3hoV2F0Y1dnZEQ2aFMxeGptbWcwZTdETGltSFFlcm1xS29XMGxtNEduOUpLNGRobnRtUVpvQlJLdVdJcGNDbklsTXhKMXlqTjVOTG5NcFNuY25QZU5OTVlhQnJNSncyazZsR0k5SjRhaCsrSlZhWDJGUytDeTlNVDRxYlJCSktQSzR2Ukw2M2tCZFBtUVFkSW02blArSVhtWkpoMkcrSUhFSXprVXk4bWJtcmZPaTJIYzdrY0Zad3BYK1VMVDQzNVFHZDJ4anlWa3lOUDZVMTVWVnVVQlgxdVhpNFNEV1U2YzQ1ZmlTWUpWT0pQSG1sWXowV3BtSm55RUs3U2h0VlNTcTJNR1gwVG5YL2ZNby9UVXFjM3crVlNuVlVwUERzK3BaVkNPVDQ0WGVGU2pqaEt3VWRMKzBvWGFWc3BvRGdXZmRKWkxJbGZtbGJtS3FXVkNiSVRVM3dveXBEM1ptbVNVOXhNTFRCRkVEcjVJZ3lVOG1VQk9TMzdMSml5WUwySTVNTmpvZDRXQmVTMndJTWVLZ21hSkFRcG43THROTnh5bW5uUkkva2lXdGV2ZHJLVHAzU2gxTnZRS2tsSHB0SVg2azFsNVJPSGx0ZUlCY0tOMExRRXNjT1pIRHJ6VURwOUZBOEx2dElYUFZsdThsTjZxZ3M3anpHZ0gyUFByNkJ3VlFxVXZEa2dSNSt5NEpMU1puWDJ5OEFWbjhIMVlBdUZqc2VmdkdLTlk5cjhocVRJbVROUG4zeU9IVE10R0hhNjNrSUtiQzVsSjMrNFVIbUZCL0tIMnVYODlZbWl3ODI0cjlBWmVxTGRsd3ROWDJweU56SFBsNkQ1Y3BUZjFQQnhSYzRDeEhGREx2MlFLWXNIcFNMR1duQThzVUVZT3JKb1dPQjh3UTAvYTI3QjBJTHBxOUU0WHJyeGl6Y0ljY3VOVkJiSEpUQStMOXUwM1VwS0hZZjZXZkZkZ25McVNlTldIYlZOYVhZS0UxOTFjeG5lRWVob204aHVsVjEwK0lxeDVKYWRMYnQ1ZDVqRGlXYlpWWjdjUlB4d1V5bS9tZmpoaVBPb0ViL2l1ZUZUV2ltZ2hVODZsRUR4aTdJQUpUMDlwVWpPUUJ1Z0ZRUnV3NkhIT3VycEh5KzY0TkR5ZmlOV1BocmNPNXJDZkRpTXB5czltVlI5bVVROUxDQzU5TzZGckNOL3ZtT1Ezc09RSys5QytLMU1sUzBLaXpEMThvU2lVWER5UldBSFhkb0ZGYWU5T2V4ZHJUanZNSnRPaE9LVjYyQmJBcklRN0lTRkZDTDNMRnpTRXVaZEpGL1VPbDFWaytmMHR0UHVwN2JoejN6cWwzS1VJenhmOVNUZ2ZWbHdPcHBwYWM1RU04VXBqRTBCN1ZSSHVvbnkrUmtVSHZhb3BlS0ZCWmg4NnNaUFQyc3FuZ3MrcFpXQ0JTTzdndXVGaTVXQXNCWXJBWWVnSVIrK2NCTnRNUm10SEFnT2RjVFF1WGFsTXcvblcvdlphWDNIZkRhT3hYd2lNM3VtelhzaUF1M1FGZ2RjRWp6YVFLaTAwL0dzdEdRditOOWNGc0FpTzc3Wmw3aS80VmNDWkFVaEh3SHRjckVvb1VuOTZVczRsU2NGZzF0SkdlSHpjWFVMbE1LWTUzTUVXS3RrWmtGV214Rll4UkZDRG9VNHFUSlpKUXFya3gzNWRrdnQrblRZNlhKTmVnbzdMaTcwV1NNaVg1YUYrb0tablk0SGlEdDlFRTFIS3NFKzFnZDBXQit5ZEJheTJxUkljRVB4RlZlcGxoVG5YOFZ6dzZlMFVrZ0NzK2tRL3VLSUZ4Umh4R0c2NC9ja1pMeDVDVzAvZjZFSkw2Q2dIQWhQTVdtbE5TYVl0WExFN1dRK1QyUTYrRzRFeTBDemtPNWZVQ2paNUpmakxxUW9BQlNEMjVPdEFWeHZJREhnVTU5eWZQclREbVpaMk4xZVdURytPQlVQWDVEQ1N6NnUzSlA0cmtRMCtMNHJrYmphcWJxaUNQQlJETnk5ekJGbjZwZFEyaUhvY2oyRVVjZWluclp3WEZmYVpMQlFYRHhUT2s3anBEVG8rYkZCT3duOFFIejdLRU9GZVltTnRHNVhkb01VUW8rdy9DNktRSDV5U3VNOWhLbkdUQTBuekFlY2VvcjNzNnQ0Ym5ocEt3VXRETzh5N29aMkJpMUt3MXUybG5VV2F2emkydkVTUGdrRXA3anJvU21MME9vZkFqT1ZrTTlVNzhMbmJQSWs2R3BlWDhLQkc0cG9JQXRpSUw4dng4ZCtsMUlrT01RQjhaQW9xSHlLNDlJYmU5ckZ4WER6Y2d4RklUZVhzTXZ4d1NEZWpQTkxOOHJuTHNFZnlzbnRUTWVCZEJ4cUt6dnNHUndmUnVOSVkxOXhxUmJIK1JLUHZuamhCbEl3ZHFJWmlGZGZZVDRGaUZQUDFXNVpPK3I3UWtwUFRiSHJFTmI1bm5RYit2aWFNOTh0eUtGY2ZLUlFQNWxKdFZ6cHhKV09nc0hNa3RLeGt4V3lzaHRLMldtczVIakxiU1hYNlV2eFNhdHk4VHVUbXc2a2tPVXpCMTRLSjhDS3dUMGIwdmRyTVA1NTdNMk1zTm92OTNMRlMxc3BWRlJVUE8rb1NxR2lvbUlEVlNsVVZGUnNvQ3FGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2FvVUtpb3FObENWUWtWRnhRYXFVcWlvcU5oQVZRb1ZGUlVicUVxaG9xSmlBMVVwVkZSVWJLQXFoWXFLaWcxVXBWQlJVYkdCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FLaVlnTlZLVlJVVkd5Z0tvV0tpb29OVktWUVVWR3hnYW9VS2lvcU5uQmJTcUVqOTlXdjNJcytnWXFLaWhjZDN2S1d0K1RRemVQMmxFS25FMy90dDkwWmYvYXVYb3g2M1poMFJuRXdQQlhMd1RnRzNVbkU3RGlXbzFWYzdJL2pjbjhXNDk0cWVzdUlVZlNqdTRnWTk2Y3g3UzFpR2ZOWXJaU3hYRVYzMllsZXB4L0QzdEQ4aXl2MWxiQ3g2dXNQWFZEWkVNT09IRmhCMDB2aGlvb1hLU1phdHpNdDM3bVc2a0wrSWxiNmw5ZDV2eGVyeFV4TGUyNlprY1RFWURtSXJnb001NFBZV282VU41R3N6Q1UyVTIzUTh4aU5ldEZaTGFJbldYcnRwejBRZitrdi9hWDQyMy83YjIvS3pFM2d0cFFDdUg5dkZIL2h6US9Hajc3dHdmZ3Y3b3U0ZTNreExzMm04VlR2WEp6dG5ZbnRvMUdjUGRxT080OTM0K3hrVzQwZXhsVXBod3RieTlpYmoySm5Qb3pSYWhDRFZWZWRrVHlyVTR2RklpWXpEVWhGeGNzWUNCOXJuczJ3STRlLzFOcGZ6aVRvT0RJSEhTbVBXUnhMQWN3R2k1ajE1bkhVbWNSQ215MXlnc0IzdTkxWVRLZmFVRmZ4am5lOEkzN3dILzVndk92Zi8vdDQ1enZmR1hmZGRaZnJ1aFYwVmtJTzN4WmdNbFdqSGptYXgwODllalgrNmNOUHhLTkt2RHBmUm4rd0V6dTluZGlhTG1VaGpHTTVYRWJuVkM5T1g2VlRHaHhweWw2dkV3TXNDVzMrWGJoMWxyR2xIVjhHaUxSaFY1cHl4ZmpJVjF4cGZhVjFwUjlKRzRpMjE1V1ZvYnlGeWl6VURuRzI1aVcreENjdWpUdFRkNWUySkpLbXBqYlM1eDNSbEhLS1E2S20yMStvT2JpWjNGTGxvWUhIUWhwWk5vNWNLcitTbGFNQkZaRUtNY0hTNElBaDlxUUQrV1hJVnd0S0NrNlRsYU4wL0laV1lXaGRQb2NUTGUwV2FKL1NHQy9UaVYrS3E4ZW03ZGhmYXJkUklPMUFTeTI2WmNwWHJ0bFFIMmxOMitUTVI3VEF0QXF2ODlidEFwUmY1OG5QN2UvbWVrcWZFazNtSTdoZG9FMURwekl0MW1RcVQ3bmNadWVsZGpHTHRMdTB6VE9kNlZlMFBjK3o4M0o1U1YxRGd4Q2xOUG5NYXVadGVncXlFRnhldkV4VDJwWnBtR2NUbEhqaTR6QmRORzF5emZ5VmRnRG1YelNHMGxKZnNrK3pzS0lWN2c5Nk1aOXJidVcyZHJkZGZ2TFVVN0c5dlJ1ejhUaGU4OENEOGEzZjhpM3hUZC80aCtNMXIzbU41RWtXUStMNm5QQzhLWVUyNk9leHh2RVhMeDNFeno1NklYNXAvekNla0gzVWlhM1k2VXFzRjlPWWFVSHNkazlaK0pjeSsvdGRCSHVwWTBnUzlLNUdaU2hKckVyaHhLSXlMZTBXYUovU3FsSklQRjlxU3FFelZaM01TWTRYMnBJLzFBQmN1M1pORzJWWENtQTd4dU9qbUI5Y2pXNi9IM2ZlOTRwNCsrLzgzUGpPLyt3L2k3ZitydCtsbzhNb3RmbDV3QXVpRkFyZ3pMUmYwdUQreHY1Qi9KdUhQeGEvZW5FL0xnMkhjVFRVdVdpNnd4Q0tRaE9yQVJpcFY5c2FKQjB5WXFqVW9jeWlxaFFTZlZVS3VjM09TKzFpRmwvS1NxRS9LL3hWS3RNVkI3cmpTZXpzYk1YeDRiV1lIQjdFblhmZUVXOS94K2ZGSC92V2I0M2Y4M3Qrci9KMk5BaWFVMU0vZjNoQmxVSWJWRExYbjhzYTMxODVtTVFQL3Rxdng0WFZic3hsNnF5a0NVTkMzWkhrRFRYSkk2MlZnU1pVVmxOVkNrNXJMU3JUMG02QjlpbXRLb1hFODZXbUZIcWVsalQycktVRmN5REFCUXhYM1poZXVSS2Y4L2JQajMvOEQvNWVuRGwxT25aMGZIQ3Rtc3NYQ3NqUkp3UjBBUUcrVzFMOStYdWplT3RrRWZQM3ZqY1dIL3hBREo2OEVGdEh4N0dsZ1VNWjhQU2gwNmxQRHlwZTNrQm5TVVY0RDFuSXNUbXVocjNvYkEyanN6MktxWTRNL1FjZmpMZi9nYStJczNmZUhUdDdPMWJzTDZSQ0FMMTNja1g1Q1FKYWNUcWJ4UysvK3ozeGwvN2lkOFV2L3F1ZmpZOTg2T0c0ZXZsS3pLZmFWVkVJM1g2TStzTVk5RWVLejZPci9uYzFDR2l2SG1INUpZMS9wUFdrbGtuVGZ3MHh1MlAyUzd5VmppNG1ES1M3OVRlbks2a3BsNUpSOVBieGNLbHNwckh6M3BHY0s4K21ITE10UW5hTkF1OGNvUGlnN1BoT1d4TTB0QzFpYWpQYXRObHpuU0R6VzlPbW5HSlpsUE5yMmFsS09lcEx1MWhPeUxEVms5RU9ueVJjdHpjang5ZGxydCtueHVJeENvMytaSkpOdmluUzBCQW1wRHBLUFUyL2dkT2FrV21OeVpxbTRXKy9WYi9na3EzMkY1ckdGenA1Zk5meFZuZ2ROTlp0V3lldWJGbWt0ZE9SK2RzZDlHT2dvL1Z3YXhSOXVkV2RkOFZnZHl2KzdjLy9mUHk3ZC8xeXZPcVZyNHo3N3I0bmVxSmQ5K3o1aDhhek5Vb3ZBR0F2QXkvZSs2RVB4Ly8zNzMxZi9MTi8vaFB4K09GaHJMWjJvai92S3c5TnFTWm9RTHBuOXVLdSsrK0xWejN3WU56NWludml6S3MvM1Rlc08zdDdNZFJncmJTbzArS1ZScFVXT0RVOThPT1lmbDlsKzlLd3lzY1VtL05ZeDZaWXZ6aytNUEJMSFRubVNwOHBIOWVKa2VLeVdEUTVwcEdHd2ZoR1dWQVB4eDNvYWIrZHlsTUsvdVJCdDRDbjJzOHhncVpoUWxJWlhWb3NaNm05QXVuRlJBZE94OFFGTEE1TVZLWGhtd2ZJSmlldUhoOXltNTJYMm9WZzBPNGJIUjlZR3lYT1VjQithUWRZVGpXSGxKVlRXZHF6MEVaVWxQbXA2YTU5NkRIdjhlZlpkL29zaWFaWGg5SzdLdXUyZUx3WGNYb3hjL3RtcXROSFZGcXM5WUlWelBvOWlsTmE5MUlHbzJGMGh3T0hXWU02U01BOWVsTzFhWjc1SFkyak4xdkUvYklXdnY0YnZ5Rys4NDkvVzd6NjdqTnBUajBTeng5ZU1LVUEwNlBKTkg3d2gzOGsvcWUvKzczeDN2ZC9JTWFEVVd5ZlBXZEJ3ZzFXT2lLb1U3eTRNV1ZSOHJJR0M1N25raEx5M2oydmlUdnV1Q05lL2VwWHgzMzN2OHJQWEUrZFBodTd1N3RXRXYzbHNRY0ZIcUJNR0JNSVpocExsQUlLM2RPT0FLc2VMbldZckdWbmxOSVZSK0VRNXQ0QW9lY1o4R293YUNaVi96MnBubHp4eDBlN2s0WlNtTGx1VlVxR05aQWluZlVDYWdzZWNIb1d1clJRTFFIMm9UVllyRTdUZ3MvaFJKdjZoL3lRVnBWQzRubFNLZERmRWk5S0llM21DUWdkWUR3UlBQZExxd0IrWUVaWTlMWkVxRmM4dUllZ0RXRFpubC9hMUxRanBSMVBKeEorbElER25hZHVjdDIraE4rS1FkYnY5aDNKN0tYZDhoZml3ZHJ5WEtodUxWWlp6cjBZeWkzRjZ3eVBJSStQWXYrUmo4WGVIZWZqYzk3MFFIem5uL2dUOFlYdmVJZXNhNDdjU1E1dUY4KzdVb0RadGVOeC9OWC80WHZpQjM3MG44ZkhIbjQ0dG5RZTZzc3lPSnFxb3hvVTVNYkR6b2hqTWtuNHVsSUVUSW1HUitPZk84ZWtwWGt6M2JZVXdyMzMzU2NsOFVEY2VlZWQ4WXJYdkNLMnRyWmlUNWJFYUdmYk93TURXaXlGT1JNaHE0S0JubXJBcWRjS2drbVNPNXhwQXJMU1FJNlpUdWwybFU5Q010YlFNRHhZQlZnS3E2ek1hQ09YaWlpT29oVFlYNVpsd1ZTbDRQUlB0bEp3T1dGZFRuNUtNbFpUeGljSlBtOE9kcmxOWm14RnF3SXhIWTVkVGtUUjB5TG8rOGFaZDIzZ296a2ZZZ2tteTVGMnpKWEd1aWpMZDZaMUdSMnR3VjVQUndOWkE3dy9rSzBFaUxUdHVVMmVEOVdmL0x3bWxHN01aN0tFQnpHL2RxQjJMV0puZTBkSGJkNWsxQ3lQajFUSkpGNTMveXZpLy9Pbi8xL3g5Vi81NVRHOHpYY1V3UE9xRkdiU2JELzhMMzR5M3ZrM3Z5Yys4TkdQUlU4ZG1NeW1NUnB0eDFSNUs1bEMzZUdPQmtsV1FuOFVrMzVhckhhc2N6UWR4NEd1bEFTbW53WVBYNG5pclVIejR3QTVMaUdWUGppMUcrZk9uWXQ3WDNsZnZGTG5yVHZ2dml2T25qMGIyM3ZKa3VpT2VHUWpMU3UySEJNbW1sQ3NDQVFjRFcybG9HV1lsRlFXYk5YR2dCQ2ZJbTVxRy9rOHRhQjZ5cnFNSnBVRlkrdEJUYVFzM2VoU1dCV3kwT3J4SWRWVCtwUm9NaC9oaFZZS29NU1pSTk9rcWcwMkFBQlA5MVVUWEt3QzBwYTk0eWEvV0FuNHhNR1JWZ2pyYXlYWFFSaDdBK21Ba1RvdWkwRHI4M2g3eTJQdU5hek5DZGlLZFIzeTU5eWp5V2VCbVNlK2ltc1V1RFdZVTJROGxrVXg4cXZPTTIyMnRxWkZ1elhhaXZGa0VYdTcyekUva3NMNCtNZmlMVy85SGZIWHYrdS9qcmU5NWJlci9IUEg4NllVRGc2UDQwLy9oWGZHRC82VEg0MXJPN3RNanhUQUtKWlNDc0huR0lxV1ZHMHJEY2hBaW1JMlluQnk5Ukl5Qmc4OXgxOHc2Y3Q4UXN0S1V6SzRDQ0tBRDdUVHNYaExTNmMzd3pScU9wdnRTQ21jdit2T09IMzZkTngxMzZ0a1JaeU9jK2ZQeDZueloyTW9hMldsTTl0TWsyREIwQVNpTUdncjg4SWk0YTdCeHd1NXVTYVpLckVtdUhmd0k4bTA5T1EwZFZKeWJVdUJ2bm5CVktYZzlCZkw4U0hSUEgzOCt6MnRuMUlYZmhINFBHNHoxcFhBR3ZIVEFSeGx0YUY0S1E1MlZhZFdyTlpubDdXQ1VzQTZsZFVMM1ZJQ1hPcWxyNng3QlpJVC95anJQeEZIQjZXRXJ6VFlMeVFHSzE3M2gxNXQ2ZWdZMFplYlRhU3N6R01McXRqYUhzYnMydFU0UFpMdGNlMXkvTUd2LzVyNG0zL2x1Mk1rMlhrdWVGNlV3b1dMRitPUGZlZi9NMzc2Vi81RHJFYTdVbTdxaURSWmFIY2ZiRzlyZFdpbmw4YmpMTldUdVUrVnkyTjFiRWRhVlJOSFBvUEpKS0lVckN0Rk14K212SFR1S3JxUGVISURUUUxLQWFkbFlYTWU1d0VISFozZk5JZ2RIVSsyZG5maTFMbnpjWWNVeGgxMzNoVTdwL2Jpek5ueitjWjN5ejZUQ1I4dExibE9YSnRxSXRRbTdpS1lKcFFDeWdNYWk2S2FoVkt3TXRHaTVmaVF0TDR5Q05malE2YkxBbSthekVmNFJDa0ZIUE5pdjdSREdFNnVpVytpWVYySlFtRzRDaHc3dFM2NGEvTGxINDhMWmVFdStxS1hEOW13ZjY2aHBTd2J4Nm81Z21qamM3dmtxRnVyaHJwOTk1QUtLWVY1WkJKVk93NTZLeVozM01lRWRPeFFuVjVYODdTK3RSbjFCcjBZN1o2Sm8wYytHcDB6cDZJekc4Znk4Q0R1dXVOc0hGL2RqeS80bkxmRy8vRjMvbGJzSW4rM2lOdFdDc2ZhcmIvbE83NHpmdlJmLzFSTXR4QnlDUmZ2R1dpZzJPWG5PaE1oK055d2Nubkk4UGc1b3FydDk3VnpLMmpCMDVUaW93QzZXVUZNYVpvRW5rK01vUzZTY2toMGFHc3ZaS0I0U1NzODhFZml6eHo1ek1kRXVUSzZLeC9lc2xhR0dyU2QwNmRpNzh6Wk9DWHJZdnZVNmRqYVVUcVBoazZmUzA4MXZBT29MK0xwbDVib2c2eVZJNWwvNWZoUUxocFp0QWdqMVREdFpYaEpyMG9CbXZXWXZOQkt3ZVdFVWc2MGp3OXpDUmRZYW00OWF2SlpPOXdkZWFsc1M5aFlWMVRFM0NPYzVEc3FDM0hNdUNyaWV1Um9GL1VRMTRiZ080cmNIeXNEMnFvNDh3T21SNm4vcE5HdTBuNFVoTWREZVg1VXIvSTlyVVA0THFiYVhDbERtNDhQWWx0VzhQSEZwN1NPZDhSakdaUERRL1BaR1kzaW0zLy9PK0o3L3ZwZmwvTFM1bmdMdUcybDhOOS96OStPdi95My9sWk10T3ZUSU5ubzZ1MHF0blYwbU92TTNodEtvS1RWRUpyNVhCMVM1N282YXkwMWFkMTUrbmgwR21oOE1WU1lNeG1UME9tc1B6Nk5jZ0FNYVVsYjhGNTBBYzl1Q3kyT3BCV0RnVldodU9ydDlZZjVzYU9HalFXcnJaOEoxMS9QSGFTdVIyM25jaWkyOTJJZ1JiZXplMHJCUFpscHU5SGYydGJSWnlpRk5vemVLU2tkTG56WVNWUkhCMHRJdkZHSVRQSjhNZlVrQXhabFZRclFySVgxaFZZSzNsVXpFRFQzdi9oeTEvYk9LRU1iRlFLR3lTOXJFYjhvaDg1RUFpa2tzMThGOGQwV3dxayt0NGQrTEtkdUIzT0JjUEx1ek5nTFdyRDFLZ2NkUnhMbVR6eTJGdG9VYzN1WFBBckZGMDFTQ3FzWXFnMStKT2w4OVVlVzkxQ1dBeDhlUEw1NlZXdDY0VXY2MmRHeGxxMzZJZG8rRzdHT0hCd3p6czh1eDkvNUgvK24rS292L1RMMzkyWnhXMHFCb20vK2txK0p4OTd6U0N5M1ZuRnBjaXJpOUU3RTFzZmp2aWNtOGZqWnJHbWhaYUNaakh6ZWN0aVhOR21TME01SklaQ1FhYk1qanVMQWQ1ekJrdThMbk15cjhQZHhRYjZHM2Zud05mL0NWNzdyY3JITUw1ZmZxRXZnVTJrR2Nlb2l2OVFqREdSVmNGZkNSYW9WaFpRSkw1NDR6RDBLcHAvS1lmbHdvakRFbnpUcTZua25TZVBJT0xEQWVXVHF1SnhPaWsyKy9taGRyUVhENmN0MFpqVnJmTktWWHhiVlVmZklRa0NZTTNORGd4TVduS21Gb2lUYVBoak0wZzVqSVhTNjdDS1ZoVWFCcHY0MmpZVmJTZER3dWY1Q2I1N0Z6Mm5sTldIenkybWw3YUF2WHZEVFg1ZmpIUUo4bnVORHN6MGZlZHc0Nzl2SnRDOWg3KzdkZXoyWGZBUVpwUzFKa2JJblhXRWNOOGRDR3BQVXZyYnk4MUdRZmdsT3MwRFR0cHlmbFFMOTlkaVFwdkpVM2RBRGhUdXRmc09UZnBaSDUwbGh3Q2Y1ZG1MS1VhU01KWXJFN2N3MFR1dE5GSmVuemEyblRuTW5RVHAzWEF4dGR6YU5ML2pzejRwLzlRKy92eXpabThKdEs0VzdQdXNkY2VucXhZamRzZUwzeHM2c0gwZWpDOUVmYkdsTXRPTUR0YWd0dFBibG5xdFNvQXpQZjE4b3BjQ0F1b3lwQkxmcjZVckJCRzREZVRtT2I2ZStjNjhpcGRIaDVTb3BDRjZ5UWxuMFpUMXh0QnJrdHNIRGlrTFdUbEVZOUZHOUZxTTB6aXdpd0NJcFdHSjVDVlRIUW9HbUxDSmFOWnV2bFlMelczUk95NVpNMnhXRlFIakU3WG9Pcy91dEJUb0x5bnpROENwblp2MWhVVGwvSmpxWGhSYmZaVk1ldEllWUFpNlQwTFE5SjAxa2FaYjFrY1pKUEJnYlR3V1BBalcvbXBzT2M0Q2x5SWRsQ0RQSGNqc3pyVUcxRENXQ0FLWVgwZEs3QUtvb0MzMFN2TnRSQ21WTWlsSkllY0lMclJRNm1oODhzZUdSS2ZWN1UzRWlMejlONHNGNzdvcjMvOExQYUx4U1ZUZUQyMVlLWno3cmkrTGc2SW1JVjBncFhOMkswWDQzSm5jeU1mM29qSE5MUEpGcm9TMHQ1SEx4WnBRQ3k3bXRGTktrUDd0U1NMUXB2cUVVV0taS0swcUJBV2dyQlM4MDhndi9YQjlsMW5US2w5WGpjTzZIcGszcCttOWE4ZUUrSlIrRmtpdnRWUnJ0OGNUSzE0TDJZajV4QkJwSWtaZzhwN1dkS0tNemxOV1JaNC9YdnUzbk9JdXBMRG92K3V6bkZuanUrdVAxOGVha0R6cFNLb0MwOWZFbCtVNWJxTi80cHNtTEh1VWdzSUFQczFJQnBRMmxmckFjNWsxRFNLMWZ0eC9NdXJJNkJmckw2S2Exc2lhWWE4eEtXMnhCV1BEa0ZNZjF0Vk02SDlWQUdwWVdKanhoQUYvQ0NGc3VoMUl3TXYwektnWGx1VGtXMGsrR1V1REpSS0xwNm9oQ0dpckJDUW9OanlaeDc5a3o4YUgvOE8veUdONGNia3NwOE5qdWpqL3d4K1BLdTk4VnZkMUxPanBwa2xjNmo1L1dEcmt2NGRtU0VBSTE2TGtxaFVTNGFTbFlTTW5Yb25CY2JvTy80UHgydlBDMXI3cWNuL0pLK2NRcjE1WFRtL3F5VWlqOEhLYng1cGVGbktXTmJ5RlhHcjU1NUQzZlF3MTljcDN0YlhtcER1ZklMOGVNTkMxWmFKcTY0YnMrTm5FTERpaFhsRUxoQjJaYy9HWTRYU3hMSGhpVi90OEFxMm5pbnhhaEZqMitCR3k5VU5OemZLTzl3NHJLNGJYTXAzWGE4c0dLUjhxQXhRNWNOZ0doMGNrNDh5ejNJQWgxRVhvSkJ5WnpFUkE1ek9ja0pDbHQxZEc1R3lCOHNIYWV6dnVFQmQ1ZE1haS9wUlFvNjFINlJDZ0YwNmE4dGxKQXZQbS9IdXVuSzRWMGQ2VDJ1dTIwVS9rMEhOTkIrZHVYRCtLTzA2ZmlrZmY4NnNhOFB4dHVVeWxFdk9uLzl3UHhubi8wSXhHLy9uT3hlL1pzekhTZW5uYkdjWHAyWjF6dHIxOURQaW0waEo4dnBVQUgydndUdjFUK2VzY0hLd1hZSXJnT2tIOGRwUUJJSTk1V0N2aEN0NTh1UWltRE1Ic3BrVlhvR0ZyQ1ZnNktBOGRsWVlpZmg5NjA5RDMzMzNFNTBFdWZsMi9TaWwveTZYZ0pGejZGSG95MjErR1N2aEhQOUFYdHNKRXNGZmVqTEdBdnZwd1dPcjZ3Q0J6UHdsQUVrRENQb1oxSGVxRWpuUDFzdm04NEwvenMvSElQNFZiZEpSK0o0UjBZb0NDV0U4S09FUGtEZFBLUHVET0JGa0ZWT1Q2YXorV3BoVXR1VGtHWEo1N3F1RldsWUw2T2Jpb0Y4eUNjQ2lzc1hxSTFIOUZ1S0lXbVh5MSt0RTMvbjBrcFNIcXNMSmRMN3A1eVhWSUlLRDRzb3UybnJzYWRaMC9GUjk3L1hrM3R5Ym05TWJRcWJnOWJiLzdNNkgzVlY4ZldHejh2anVkblluYWtocXZSeTRGNmxKRTYxWEkzQ1plN0R0cnBONks1bVhxZXJXeFJPa253bis2NDdlV0cyNXFhQlpRbjNwRFg0Y011Y3J5L2JqMUVPY0JpZ2Y0RVAvMVoremg0UWNmdE5ZL1B1UGpFOFVLTEwwRkxHUlJLU3lIZ09JcU10VkNQNTlIRngwMjBHT1g0eHA4dXI1enpQc214QkFmL2VtNjZMLytLRHZmeXAvS0pUNjhsZjZaZFdMeEQvSUpIYzdnbXJMSVQxYnZzUlgvUmk1NWNGOGNyZWpNSnJGekhIeWJLTHAyOTBycm04alc3cnFTOEsrbnBTZkgxNWZmVnI0SDhnU1JsUUI5NWQyY28ycEVFWXpDUG1aUUFHOUo0ZFJUOFMyUEcrTWx4aTY5eDVBWi9MdGM4bWJqQkdyamgycmdPVEN1SGZ5dmxLSE05M0N5UDdpcHZMQUFQWlRPZGFjNjFHUitPWTNsMDZDZEF0NHJiVXdwcXlGTnNCbTk0Uyt4OTlSK001V2YvemxqZGNiZTQ5dVBnU0lzSWtodDE4QllHenp5eXU1VkJ2MW5hd2gvL1Z2aGp4dk1PZXFPRktjc2tJTEFvQ3dudjBndFFaMXNXS0ZvKzgvZlp1QWlEZ21uM1dpOWdYRiswdUs1Y3RvZldUcnNCejhGOXdhU0ZUOWp2NUl1UFA3UWpQcjNaUFByaTAxVWJldHJsOE51dXIwVTFpSjYvTk5kTzVnNWY3RkVjWHdMQ1hXQVBYakxWZVN1OUw5NkRISWErcnp6UytrcURycTgwWHNuRitZa0g3Yzl0Y252cEwyRmxzV0M5ZzVZZDB3TWhyN2dWZTJGZjVMTEVGbDBKdEJTeGxBbHYrdUxTMjJUeTFSYjdQczVoRFdMTmFXbjdvNnlNaWZMRXNLczBQbi9BaFcrUGw5VUtxRHU3VzVuLzFPYW40NVo0M0FaOFlkcUlzT3BFQVU0bXNicDZFS3RMK3pIbkZXblQzQnB1Ky9odzF3Ly9TbHpxblkvNzc5NksvYVBIWXZZdmZ6ekdQL1Zqc1gxMUhzZThjQUVRbW1KMkY1L2svQm94UW5XOTQwT0R4dXd2UEhBU1JuWkg1eWZ6UCtYbDQwTk9kMzJnbVBDVVpjV1IxemJwUy9tbUxybUNYTjhHbllFRm9IYm9PRUFhajBueGZlYm5lZmRLcTVVZG0zUUptWlpjS2xiNndSdVgrS0p4R2RWVDdnczRqdlNYNlhqRmNVWXk1L3gwRElLSGlpM1c0OGNqTitjVkIwbStDRFVQNmlsNUtWczdmaElNdCs4RXpIT3ByZGptYUZybzVhV2JaQ3JEaGlkT1NLTVQ5Vi81TElva2haTDFkWjY3YnA5QUN2Zm02VFZ3YXJldnNzMXlWSGk1VEdOaG52Q1M3MFZPWE5qSzMyekY1VnE2YzBnK3I2bUQva0lDUWxobDhaUFRuT1I4ajczemNlS2JhVXQrWTY0TDVuUHkrT0JMUzBVTDNkUEtwN0xFcjN0OGFQTGxGeDV1aXh3RHJDSmw3RkdjSjQ4UC9LS0JMM1pYc2c3a2Q2ZVRpSU9EV0Z5UkZTZUZ3THUyRHo3d21uam80UTllZDQ1dmhOdFVDcXU0NjUrK1gwcGhGZHZIUnpFOGN6N3U2Sy9pcVNldXh0VVAvM0pzL2RqL0h1T0RRelZ3Nms5NjhSaHVvVjR1K3Qzb2ozZ0tqNW1CTUVoSWZDaVh6NE5rM2lBVUxlZWliZ2V0cnJPdGFGaVd2SWJxejBEUTdLMjArTHdyMEdtRTB3S0pZaEFmN1Z3V0NndEN2aXZJUWdkOUVrRHhkRDUwV1ZqeEJYOFNqU3kza1hRRVRIbUVCWDhRaG5JdW50NC9jRnNFMHVmbFYzSW9BMS94YWRvakplR3ZvaUtidHRsWFBOZHRPc1lncy9DNHFOd0diWDVUemZ3UXJkd3V2LzBKY2h3MGZOeU9oT1pPNVVaZ0VaN0F4bkpaNWpNOUtPbnRNajdyNGl1dENBMHJIVi8vc1daQVdmU2duT2tONXlkaFNEU1pCNzdRc2FZa1NVb0tHbmk3cmxTK0VVcWxsVXU4OGhRRllmT1p2aWdEWEJib1VnN3VwalhQVkI3RjV6aDVLQVVoMVYzeU02M1E1VDBDbEJWUjlhVXJKV2NyVG92Szc1eEllVUlQSDE4WWVnelVGOWRNbnVhUll3NXR4T3B4dFhsdXhXZW5keTBXVWdTem82TllXczUwWkpyTVpJMUpTWWlXaTlRSEhuZ2dIbjc0NGJSZWJoSzNyUlRPLy9CdnhzSE9JSFowZnBuMVIzRnVzSXF0N3A3eW5vck93WWZpNG04K0hOZit3M3NpSHZsNGpJNTAxbEduNXdPZDdhUkliQjJ3azFvSnNKUEswWFk2SURmUVB3MlZ4MFFKU1dCNEkzSXcwZ2xsRVBPSkJrS0M2RXU3TEV5TmdpREk2OVlLSTlnV1RJU0VQTXJrT2l4OFdSa1UzMm5pSTZvc2NKUVhYNFdMVWtqbGxDZmhOaStubGZKSk1hRDhqTkltNVp0V2NGbXNGN0NSbCtvQjZlbkNabDFOUFNYZnBDbmVLTHhNbThuU1dnS1pyNkVnNC9OTVlEY0RKNWRJaVhOVloyUWhhWHpsZTRmTFFvTlVVTE90aWtLRHNDc0tMOU0yd3A4RUNqcC9Ga0Q1cnM4dWw4Y1NvWnlFek9VekhUelhiVWpXRFBGVVJ5cUw3L3FVeGx1MWlkWUp5bmVEeks5SkZ4eDMvbHBCYVZVcDJsSVFyRlNVV0dtLzZZK1RuNU5rem5rY1V2Tlo3Ym1jYWFRWUlHU3g1LzRGOXo1bXozMktqbk9FNmF1T2hkeUpMQTZlVEVwRFI0YmdRMUxjTmFrTmJCdTBiNjRqNGlkY0tWRDBuSlRDdGUxK25KYkdPcFp3Nzg2UFk2dC9La1pEbld0T25kSzVjeDZkSzFmaTJzTWZpQ2QvN1QvRy9LSDNSMXk2bUFhNnc0ZWwxQUVXUFJZNG40blFRazY3bWpTbGxJSjNYM1pFK1VzdmVtVXlFR2pWYmtySE1yRENLQjJYeGVCeVRLQ1MyRGt0VkpJUyt4WU9DWmY1aVpYaVJhQWJhMEdnWGFUYldvQldibE00VVJKUVpvRldXZnN1cHpNdy9RRk9VeG5TNmFEckZ4dGtNaXVWMGdZbW94SDZ0bEt4bjl2bThva2Z3MkcveEVIdVYrTTNOQzJJQjJmc1o4U0pwWEZ5cWF5UEJ6Z0ViazNqMmpDMzgyNlk4cGczQXBvN2FCeFZYSm1OUXNoQ3BzTEtMd0tZeXJaM1pQaDBzM0FaNG1uYVF1Tnd5bTllKzg0OGtxSW9hZGxsd2IrZVFtam9zaEpBNEp4bVMwWlp1VTNyL2xGMnJVQUtuZWU1NU9NUVlraEZhMlZpcHpCdEZNOGVUVkdZTjBPNzdQNzhRTXprS0diVHNZdzBsVDNNbjVaa25GSEF1ZTNjVi9HYTlWdzBueFJMWWZzSGZ5Mm1LQVUxWWpuYWlaMFp0NzQ2NjhhbE9OVzVSN3VsQ0xjV3NidlRqYjNPTExvWExzU0YzL2oxdVBDK0Q4YnhCeDd4UjZ0WGZ2UTBsMnhMSTJyZDh4c1FEUHlreDJja2RFYWtRemlFQkFKMlNBUkRaKzRrVUdWeEswMWh2MEVvUmNMVEFlY3JPWDNtSFVza0NSemx5VU40R1lDaU5NdzNDNTlDcVY0dEt3c3Q5Y2haRVpEZTRuVlNNZUNLVXVENGtjb2svc1c4dDFJQVNuZFpBYVhVRGlmZUlQVzVLQTZqc1RUNFE1c0o1emJCSS9NeENwK1M1UHd5YnRjSGdseHd2V1hTeWUvckcxN0lndUpOT1MxeThva2pPRWxJa29DWUxwZEpOR3ZCSlE4VW9lSWVvZVQ1U1E4alFEcG11R2tUTDhMcHpvQWsvaUJzdVQwcWF4bzJGR0JhTWdncmpiWmtHdGVqdkdJcG1aZnFKYTFZSEM1YkxDSEhjN3Z0Q0d1cHl2eUhydHgzSkpDSDRDUE10SS8rTUphRTZSOXRTUFZ2eldXTlNEYVc0Mk1kRTQ2aW80MTNPWlVpbU9qWXZaaEZmN250Y1lXVyt2RTFJdUtXZUs0a1c1OFVwWEQ2bjd3dkRuVjhPRDJieEtRL2pOT3JhUXk2dTVMZi9laE9kMk1rNGVRcjJKZnppWVY5WjJjVUk3bXV6dHM3RHowY1QzMzg4ZmlvcklnblB2TGhXRHoxaEV3bTN1ZGUrSkZUdDU5ZTd2R0NaczFMQ0tnVDA0bnpVbTk3ei9rSUhKZDhYakFzZElTWDhwekoxVTd2dk9KUlRQK1RpaUdsNVdNQVFpZVA4c3B3bWdmSUFwb0VVNW5KTnczUnhIZXRHQWhMRVdTaFRUeFNYUmIwa2lZNis1RERRMkdYei9YNmZYMmlLQVRTNlp2OVRKOVltWmI5c08yM3NWWmlLVjc4VHZ2dG9tZkIwNWFKNHdnZ1BVc3dEVUtWNGFjUFdxQ2s0MmlkL2J5anBYTWQ1WXBBU1NEd0NHdk44TFFpbFVzME5zL3pncWNlbm1TWVZzRDNjY1Z4WnpnOXRTZkhVUWlLRjM0Yk5OU2RmWGloRUZJNzVFaW5IR1dLTDVUUG9td29CUHFHTDNSbVdnTU9KM3BsS2srT2RhcTJEckJ3TTAvS2RUaENjUGtxNTZQSnRVUEp2aXlDR1VjRDdpY21HbE0rZjhLZEFkOTh2bXYrT1A5dWhQaHZLQ0RKM0NmblR1R2ZmVEFPWkNsd3B6RHU5dU1NNzZGMWVEMzFVdXhJay9FcFNTNFlhU3huSXQ2aUcyRithMENINTJiK0pCamZOZEVkaitQbzRoUHh4SWMrRkI5NzZLSFlmL3p4aUN1WVJ4b1VIdEVoVnJJQUJoSTBPc2d2U0IwcmpjWE9GMXp3RVdjc0JqcmpnZExVcHk5MllTa0tqVkFuU1dvRXNnaVI0czBURUFTdWdMd2lsSVVIU1lVV2tIZENNU0NJS0RGVjVMaVBJRVdvYzUxOFVLZmRoZzJGUVoxdC91VGh3emluZDJVNXVXOEN2RjJINnJjU2FLUEVLZDlHdTUvWGdWcVZRMmxNMjNDOHc0ZUFXbm5adDNDQjRndU5KWkFWQW1HNGw3SWJabm9XNGlLWWxHWDlPTDN3bEZCd2NaZm9sV3p6bVhCTHNSUmxBTEpDU1BGczJqTjZ6aTU1eVhmN2l6SUFwczFLQStITlBKTlNVSnl3MHBvK2xIWXUwZ2pTZm1hS0I2elVzZVQxZHhUY1FoYXl5dkQ3a2V6cXE2bWNsQUJoZFNpNnNnamNiK1YzcElEOUFUUGFTcDNpenlOYTBCN0hGNFZTMlAyaDk4UllTbUZYSFZsdTdjUnBLWVhPWWhqeitRVlpEY05ZYmNtTWwrTTdCL3JxejJrRnppMEhjV3JaaTBjSFYzeUJnbUxZSFF4alo5Q05MUWtkejcwWitDc1BmU0F1WFh3eUh2dm94K0tweHg2TGd5dVhZOFZiY2g1a0tRUHhUTTlxMVJFcEpILzNnUlFIN1hLM2VCcmh6THdEUzdEU283a2tERDR5Z0NMUWpWTEFLWTJKYmNjZGxpL1BhYVdNZWJSb05pd0c4cFF1SkVXVUZVQ09GeHBiTTVSaCtaUnk5c1hmdkhPNHBBa2RXVjZKdHZETWlvNGtGQytIYXVDeUdRUkxQTGZyUmtBdTJuamFVdUZTZ0RFQ3lpdkNXR29qRy9nUzBYa3M2RHczQ0E3dHp1WFh1eTFDUnhDbGtOcHZuZ3E3bk9nTExTL3ZHRmtZMlQzeEcxNEZMaWRlMUFWLzgxQTRYVHJJMFZlVlJWQVZaeVFUUDZMRXN4TFJUbDRVZ29WWlBEM1U1cUU2M1pkY0QyQ3VGZVp4WkYvbWZnL2g1cWlNSmFDTmJuSjh6Y2VGbU1rcHJZT3k4R1VoWThDRnZSUzlsSjM3NUVGTlkwQzlGdjRsc3BESFFPQnBqS2MzRFp1VXh2RW5SeW1jK3VIM3haR1V3aWtwaGJHT0Q2Y1cvQXo5Ymd6NlYyT2lSVGNRemJZYXp1L2E4R1lhbHlBcjdaQjhCOEY5MDBFYVVNRjNqRHBTRENTd3RKOHVuRHZYazNhVjhEUDQ0MGtjU2lsY2V2U3hlT0tqSDVXeXVLandvekdaVE9JSWpjckFJaUJTQ21ZZ3ZyMFJYN2VXQk1acE4xUUtPYzEwUmZDRU11REVpOEE3RDFxOG5FOFpsODFXQWpTVWxkOU1ScE9YeWhEMjhRRFlUenhJUjBGa3kzb2p6MjJ3cnlSYkRIbjJRZTVUbzZRRVA1V0J0bzFTM3NobGJnVWJ5MFZqRHBUV1ZnaGxUam56MjF3V25KYUZkaTNzcVNGckljN0NSNWpqZzhqTWs3UXNiSVdXa254dlJWRUlwc3Y4TGFBRmpxZXlqZURpaWtJQXJieWlmRXAvbEdnNjJrQmRWZ29Jc3BEdU44aHVLUnJxc3AvRGZxTlNpa0RDM3NNUzBIcGRzckdoQUh6OFVsbGVzSkxDWVRQa2lRc1dCZlVUOWs4UWlJLzFGY09wTldBZi9uSG8rdDErS1lRdWoyaVZ6Z3RuWUw3NHBDbUY5OGZ4VmpmT1RzY3hsVkxZVVNkN25UMzE2TkQzZ2owMWhvOEkwMUhlcE1mbnZvQjNBTHJhU3JnbEpaeCsvbzMwUk1QNzYzMXBUSmVYb0cvSkNpaU9zeGdXeG5SNlRZcmlhbHg4NGtJOGVlSGpjZkhDay9Ia3BhZmlrcFRId2RGUkREVklDdzI0TFFjMWhzOHFJR1FNTU4vRU5HQ0E4eTVyVXgvQlVqN3p5TENzK2dvb3pqR2s1UGsrb2huZkxLd3VtMTFyN0h2TDlIbi85b3RERGtPRDcvY3ljaGgzTXN3QW5raFBTaU9sNlFDMnpoZEtlcE9mRmRDTndLdkRKOUZlRGd1TmRRUFNpeXRBYWxtUUphMkVTNXl4Y3RnREtwZUYwcERRWi9NMzFabDQyYXJJTkw3blVSZ3EwMmc5d0tjSUx1WTA4Qm1mTXRDU2xzc3Z1bWxudHlKeEhqVGlqeS9NWk1rYVRtOEpmQzYvR3BRamlVQzYxaEtDWHRyWDZYR3BycmdXRkU4R3VoUFZKK0h2YUlPQ1YyZi80MjRucmxFYXhSZjRFa0VmRDNKYTZhZnp4Vk85VHhaQk9ib3dOdnhWV3hLdlJJOGw0cmpMRnNXcmJGa25MenVsc0sxRnpiSW1USDRxeTJDeXgzVmlhNnNUUXkyOExTNHpWUmtEZHpRNWptdUhCM0VrYmZ6eER6OFdWNjVkalNjdlBpVmxjVkhobE82djRkTEE5bnRiMXNRc0ZBMUZFbTcxZ2U5clpCRDVmVXFQdFhJQlZnZENhSitNeHJwb09ZUy9vTHdIUUJwNThEY2RlZm96eU4rZlJ6aWpQWG11MS9UWmFUeklMMjVSTEJueVduN2g0VHVTa3lpMHdyUG9ESFZ4VFF1YXBaTDlkbGRKSTc4SURHQTVuOXh4OGRzMGE1NmFCNGZsU3BwZlRzcENUaHJ6aEc5YVpSVTcyWG01ZkVzcFdQc0RvcVE3T2ZGSTdXS25WcEt0Qm5rSXZQMlUxdlhsbmdtOXMvdExURlNQdjJCVmFaUHBWZVdsT1BkZXZEcnVGN0x3bFQ5WUhhdm9lbHpjMStJTFZTbW9hN2VxRlBqZ0wrdTJLSVhpU0VNcDlIcHozbVR3ajJYMFZSRHJ3UllsdzZpMkRZZnB0L3o1NGM2cEJ2Vll4NHo5ZzhPNGZPVktIQjRmeFlXUFB4VmpLWWxyQndkT1A1UjFNZUZ4RDBjUjdVcit4aVFtVGZ4OFB5R0xnVWVkdkFOaC90bGtSM1lZZENqSkt4TXdVNXVjbnZNWjZCSUhIcEZNUzNvcFYvekZNTzlrR1NXOWdLOE9hM0NkOG1rSlpaeklBNDNTYUtXMXdlY2JuZ2tyelIvamF5RVM0TmFPTjk4WDBGclEzclVGRnEyL3dsejBoZ1ZkWVdqWERKUkdIbjRTbmcxcnc0OGZ5QzlsaWVPVFNIaVE4MXRwOG0xTkNMMFZ2NlhBR1YwZGxSQnlIUEIzWUxpK1Zlenh3U0xscDNTZURGQzNmTkdTdnB5Tm16Nlgrd1kvOHFTODBOWDZkSjVjVlFyUGsxSVkwam1WNlVuUS9KUkNPeTArUEZFSzNlNHMrcEpJN2gyOE1EU1FHbVlMS2RPK2xCWEJvS0xJdWVqMFI3WFZxTVJWOVVqQUoxSUEzRXVnTUk0bk0vdGorWE10Z2t1UFBlSGZyVGpXNGpnYVQySThUVzZ1ZkoxZG5pNU1STmwraTJWUWRsclM4aEVEcFZFVUI3ODhaU2hjMHRwdW1zc1RidnVBOEtKWUtpbmhhZjdKY2lmTHo0dWxBVnA1QlR3U0JPMXliU3lXMmttdkF4WWtTQXFWZ0JMeXJsNU0vdzBRYnlzUTVsTGdHeStodGJwVk9zY0VlS0l6MHYzQlpwbEc4QlNtRGF5TEV2Y2xvZ1UvclJQU2g4dWlGSGhrUGhPTitLTVVzcEJ0ODlxdzRFZW9yaVB4VUtiNTgyUElBRnFFVWJYWWQ1MUMrZDVGWEZVS3o1TlMyR0ZuVnBrYldRckw1WEdNSk9nY0gyeVphK0RtcXA5aDFIakYyT1luWTZkaFZSMzRmTEJ1cGtGbHNDZThUODdRcTNDNlUxRE5LcktVTUhDNTArUExaNlVjSmxvb0hETm1TdWUzQUtZNk8wNlZkblRwY29wTFFXQng4RE5oS0JqU1BKbEhTV2pTeE11eG9FcVlZUitrenk0OERlcXYwY3Y1eEZFczh0dVd5S3FmampsdHRPTnpicnFGZGxvNzdEdUpad0tDZklML0JteCtuMWcrN2FqbUlnZHl1dUw0THJPTWdVMEZrbG9DemN4bG5rVzVsUEd5WUxRV2ZYL0tCNnBVVnVITlhUcnQ1Q0doTjA5NGEwNmM3L1FrckgzdUFFUk4rY1FIeFlQU2dRZHZHUi9iWitVWUttc0ZKY0Mvd3hmL2loYkhkcFIrTDBTOGxVOGEzeDVROHB2K0ZWK29Ta0ZkdTFXbDBMNVRTT1hXU29GT2ozUys0UGpBanVESjBrQ2lFbFJBd3MwVDNiNkVHVXNoQ1RrNlFMbHlUS0oyYWk0YTFRZCtKazVEeWR6WTk0ZXVWTzVBVk1SZG8vaHhmQ0FHUDE2ZzRndGJLVTk0S3VWUlhxcnlSQ3Fkcnp2ek8rbzRMZUNabE1kc2xoNUhRWFBFTC92UUhvWGJqckp1RnlhcmZGRFM5Q2M1UUp2YUtPa1ovZFpGWWVIVFJwZUx3QlpPMGl3YXFid0JwRFFvZzFBVnBNV2J3TE4xKzZSQkpKOUZXOXE1UFZIN3N3VmhQbm14TTVkdVM5NlZIZGE0bUEvQ20rc1l5R0pqNXVCYjhxREZGaVJ0bVpXQ2hWcHhQL1hJL0doTzF6OGJsK296RDlvRzFBN1cySUdPSjY0NzgvTXFjZm5VaHE1MW9sSkp5M21ld3h6ZXlaL053RUdQYno3NFFsVUs2dHF0S29YMm5RTEhocUlVMnNjSExocEhPbHUzTFFVL3h0RkFMWmJhYVVYTEkwS1dobi9KeVhsTTVESm0zVkVqeUN3SCt1TWZmcEdQVXBnTWhwNFU4OUlvMlVlQnFDenBrM3lSV0FhUWNreGhDUS9VSnRwUG1FWG9pY1VwRG9vUWVDR2RjQzR2b1dxbkZRVlQ4djMrdTBENHBBUDhLQ2tvOFhZZWFGNGZGa3BlTzE0ZUhZSjJla0dQczdoQUd2M0RUK1Z5ZVJLRll2YnJUOU4yQkxVM1I1a1hua25vTFFDRkZ5L3hBS1dYSnd3K011UTZ5alA4UmxFME5QQm5MdWxqNG9VRndGd2c4TlRwWUc1TFVqNjVqUXFYcjhwZmFYN3RLdysvMUtlWVNtdCtmUHhLOVpYNjRXR2IxR21wWE1uSEwrMERWU21vYTdkemZFamxjcDdTMmhlTjhMZjF6MENJSDBLYlRMbGtIdE5PckFSK2V5S2xwNGtkaTV2bmtqVEZtUVlyQ3drK2s3SFFzUVNyd2MrSmNhd1owWlYzRUs0dTF4ZDlEQ0o4aXNJZ1BGM3hxZENVN3ZPNWZDYTNMUHB5dnI2ZUE4TkZPdE9DazNuNHZCbmFUaS8xNGtDbjlic1RKYjJkdjlLYzJjOXBKOHR2Y2VFcU5QU3RQUHhPcTN4NzBaYzBSc2NqclRCbmVvUUswOXdYZTZaSkM5WFdBK1ZrTlRSOEdGR1ZLY0tnUklWRlIxNm1HZk10TUlKcHhDUDU1Q1hGTWwvbTc2ak0rWjVBd3JtZUNWOThpcUJsbnZCUDg1WEtEeVphUDlrYVNrNTlFWUhiQzUyVUZ1blFXdW1ZTmZGVVp0WkorYVpST241cE8zaXhLZ1hrNjBXTEJXZHpYOVl3Q1hTY0RtdGcxT04weDdhK2xDdXVqVlZucnIxV2xvQ1V6NEszLzVUTk5RUDNDenhENzZDVXhJdGk2YW1GSmdrV0VuaC9YYmpxa21RcEg1cGtjVURNcFNWM0UwUC9CTzFFNVNaYUFPT1lLYTZsd0ZScVVuUmlWNFZjUnVFNDR2ampyM0x3NG00QU9LdzhkallPSnoyMVlhQis0dGlwK0NBc2p4N3puS2VGa0JmM1JGWURMbGsvV0JFek83N25ZTFdZS0l3QU1vN3FWM1orYVNhN01tYTJ1c1RibDdhbHZWU2g3aGFYeGg2aGxBOS9PVDd3aFdOYzhIa2h6Yis5d0ZncW5INWprME9FMmdFUFRacS9ERWFXWGZyUkZhWExVWjVYdnVrZVJ4WXJkc1VRRStZcjhlakVWRzFsZEtlaW1XbDYrbEw2M1VWZlRpTW92OE43SDNZRDlWdWJqdFlPanRJSUlHK0FkckQ1UGM4Ni9xbFJRNVhsYm9QKzlpbWpNZU1sSUY2OFduUTFobEljaTA2YTR5VkN2cHpZTFJjb3hMUjJXQ1A4TEQzMjVrelc2MFIxelB4TE5ocUk0Z3FTQmtudVJZcFdheXNxS2lxcVVxaW9xRGlCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU204ak1FN0NJQ1hXZnlTUzM0dm9hUzlOT0FYQVZMUXkxWHU1TFAvaXVjVnR6V3lMNVZsVlZIeHFZcXlDZHdLcXJxdHFLallRRlVLRlJVVkc2aEtvYUtpWWdOVktWUlVWR3lnS29XS2lvb05WS1ZRVVZHeGdhb1VLaW9xTmxDVlFrVkZ4UWFxVXFpb3FOaEFWUW9WRlJVYnFFcWhvcUppQTFVcFZGUlViS0FxaFlxS2lnMVVwVkJSVWJHQnFoUXFLaW8yVUpWQ1JVWEZCcXBTcUtpbzJFQlZDaFVWRlJ1b1NxR2lvbUlEVlNsVVZGUnNvQ3FGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2R0U0NoMzlPeHJ1eDZwekpwYXpzOUh2UlF3R25WaDE5MlBXRzJlcU5aYkxwUjNvOVVSY1VWRnhRNnhXcXh4S0tQSlQwdm1aK1c2M0szbnJTdjVtald5SklMcUR2bVhzdWNqWjdWa0txdnhzNXlDMlZzY3hpRmtjZHlMMjU1MllUZnB4OS95TUc5L3VBQTNzOS9zT3o5U0ppb3FLRzZPdEFBQUtvQ2lDNHMvSDQxZ2VqNk1qdWRyZTJiRjhxV0RNSlY5dCtic1YzS2FsRUhIUGRCbmoxVGl1N0VUTVl4bGJpNjZGLy9MaVdxSlI0Mm5ZWXJHd1h6clVhTFdLaW9wbkJUSlRYQkgwNlhTcWpHN3NuRDVsWlhCOGJkOXkxdXYxbzl0WldjWmUvZXBYbS9aV2NGdEtZYTRHdnZMTW1iaHJYLzY0SHdOWkNZdlRXOUcvWXhSRFdROTBvSzBFNW5PcERmbkVyZEVxS2lwdUNEYlhJajhBWlZDc0I5d3BXUVl5Q1pKeVdDMHdKV0xRazh6cHhGQms3NjY3N25MWlc4RnRLWVcrMnZvdG4zWnZuRHQ5T1I0ZlBSbWo3aktHRjZaeGZHRVduY0c1cGdQbGJGT1VBMm1sb3hVVkZkZEhFZjYyQTBYZ0o1T0o1R3dnaXozZE5adzV2V2M1Vzh6bWNkOHI3b2x2K1padmliL3hOLzdHTGN2YWJSOGZ2dmsxOThmUGY5bGI0My80OUR2anRiMHJjV2xuRmxmMnRtUFpUMHFoS0FFc2cySWRsS05FUlVYRmpZR2N0R1VJSU9DTmt6SVlEbnJPWDh3bU1SNlA0KzQ3NzRvLzkrZitiTHpyWGI4U2YvL3YvLzI0Ly83N1hlNVdjSHNYalFJTTd0Q2ZiMy85YStMbnYraDN4Ny84SFEvR0YrOWNqc3ZMZDhmVzFwWWJQSk41czVLUGRxdW9xTGc1RkVXQTNKUmpCR2tvQzQ0TUV5bUJxYXlGMHpwR2ZQbVhmVm44OUwvK3FYam9vWWZpdTcvN3I4VGRkOS90c3M4Rno1dVVZcUZzaTlzNzd0MktmL2E3M3hpUHZmM3Q4Zld2T2gvM2J3OWpNWjNJU1RGd0NTTEN2anBZN3hRcUtwNFo1ZGpkUG43YmVwQXM3U3IrMXJlOU5YN2crNzgvUHZib3grTEhmdXlmeGR2ZTlyYUc3bmJRa2VaNTRleDR0Sm9hK0lIRHEvR2pIL3RvL0o4WHJzYUhqM3F4MTcwejl1SjB4UHhpOUxwU0VvT0lRVytsTUc0WmZaWHBLTHk3MkpMV1N2RitMR0lrbGlNcG5sR3ZLK1VTc1Z6TjVYZGpJQ2Z5cEVXRE9oVjJQZ1pXTnhZcm1WY3l0aGJMaUpsb1NJZDIydUdjcHJCb1pwekx4R011QjUwTU5wVlRudmdzU0pPYnlTMWRoL2dxQTc1ejBjM1Zyam04bG1xMzhrTSt6RmJpU2oyNERuRjhaUmNzNS9teHJQTVdIaTk4YUEyRm0vSTVuR2p6a3h0NXBIVlZrK2tXYW8zajJkeFVPL0NYUzdWUXZrM09aVEpKU2FmbmdQcElTN3lWSm1jK29nV21WWGlkdDI0WEtIMUxlZkp6Kzd1NW50S25SSlA1Q0c0WGFOUFFxVXpiOVpDVWNybk56a3Z0MGlpNzNhVnR6SGFoWDlGMkprOXdYaTRmbVJiWExXMXl2YVdOaFJmOVdyY1ZHbzlSanBNKzY2anVYTDdMQXFIY1BOR3dIbWZMaWVZaVF6UTlaY0dYUExEZk9YQmNZcHg0eU9GN0FjSjNkaGhuOWs3Rms0OC9IdDMrU091K0Y1LzVwamZIZi9xZmZudDg3ZGQ5VGV6dDdZb2h4NGpuRnkrc1VtaUJXc2JxNjBmR3EvaXBweTdIajMvd1E3RTQveXF0RVFtakxBblpROUdaeldKYkFyNDk2TWRRbW1LeG1NbXFpR1JaYU5yNlVnTFlGNFFSaEpFaS9XNVBnOVdQZ1h3Vy9Vd1RPVU1KSURpZG5nWGJ3cHZIZXFxSnJVb2hDNWpLQWVxclN1RTVLQVd0UjhDY29oUW9VM3d3V3gzYjk1ekRNL05nelJQdWROTDZLTHhKZzY3VXlWWTJuODdpZGE5OU1MNzduZDhWWC83Rlh4amJPcEpiRFpSS1hnQThiOGVIWjRQV1kyejNJbjdMYmlmK2lJNFZYN0UxamFkKy9kMXgvTkVQeDQ0VXdqMDd1M0h2dWZPeHM3MGJNODNuL3VHeEo2ckFKcEVVQmJldFhRMU1UM1NrTVlEeitkd3ZRK0U4NkhsUVN4cjU1ZEttd1B3cUttNERiRWc0ck5XeW50QkQzamkwMXFSUzdOZ3cyQ2V3WUpleWpGZmE2UllEV2J0emxaWHJMdVJXZWJ2ckRxUFRsK0FQdDJNKzJJN3Q4L2ZFbDN6bDE4YlgvNEd2a0d4c3AzcFNWUzhZZXU4VWN2Z0ZCNE0xa1hEKzhpKzlLLzY3UC84WDRsMC84Ky9paWZlK040NCs5a2lNOXkvR2NqYU8vblkvOXU0NEhhZnZPUnZEc1k0SFVsdGRsVnRwVjFuSmNrQ1RhbVRTT1dzNXM5YjA1T1N6bEZTQ2xJcXNCZTNDSFUwV2V0c3FRbUZHYytYSlM2UEtoS1Z3S2tjTXRVRVZoSzN6OVQrRmMxNU9UODc3V25LdzBZb3daMVlHaE01SktCYUM4ek80ZkUyQjVvLzl0VFhSQkZ5YjBhYk5Yc016V3hCcjJwUlRMQXZHQjB1bUtNMVNqdnFjbG9zVjJPckphSWRQRXE3Ym01SGo2ekxYNzFOajhSaUZSbjh5eVNiZkZHbG9DQk5TSGFXZXB0L0FhZXZSWG8vSm1xYmhiNzlWdjBESmpUNHJXTWF0QWZHY1R0azBocXdLK1dMUTBacGw5L2ZSVnRhQjU1dDg2TUJTTnAyczRJWFc3a3JXOFhJMGpOZ2F4VW91UnFQb243cFRpcVFiajM3OENWbkFxM2p3VmErTUhTd0ZMaDBUaHhjRTZuZHA0UXNEbUtNMUgzdml5ZmorSC9yaCtKLy93ZmZISXdwM3VuM3Yra3NKTklPeDJ0Nkovcm16Y2ZxK1Y4WmRyM3BWbkw3enJualQ2OTRZMjl0YnNidTdHOE9oYU5SVWJsMW5zNGwzL2RPRGprd2Q3aHZrc3JaZVNST1hPd1dPQVJ3QkVQaHlMT0JPQVI5ZTRpS2Y1VktQRDdhaWNodWhOUjlNY01HMHhaUjIzcnBkb1BRdDVjblA3WCs1SHgvNHZFR1RMNlRhMWhocWZpbXo4V2d4RXpFWDArRVdBWjF5dFdISnNYYTlDMmFhM2tyNUdxUEZsU3N4bEdXeEp3dmpMWi94aHZpV1AvVDE4Y1cvOS9mRzNYZmNRZkhuSFMrWVVrQjRwdk5GL0p1Zis0WDRuci8xZCtKbmZ1bFhwTzIwWEVkYjBSL3BpTUJnOVMrckJYeGdRd09CSkRNYU1wbUdveDBwQVduTFY3d2l6cCsvTSs1NzFmMSszbnJYM1hmSDJmUG5ZdmYwS1NuU1VSeGQzZCs0YUdUd3k1MkNoajhMdDBYRWdveTRzQXdSYUREMkFxaEtnZnE4NEhNYm9UVWZCRXN3YlJFUTU2M2JCVXJmVXA3ODNQNlh1MUxveWVIanlHUHpLM0hjVU92ZGVYbWNBNkhYTGw4ZU1SNXV5eklvNlkxMDA1NWN6OEVrK251bnRMaTBPc2RIbkllanJ6RmpYbDU1OXozeGpyZCtkdnlwLy93NzR3MnZlMjFtVVhqY0hsNFFwWEJ3ZkJULzloZCtJYjc3ci8ydGVQZERINGlyazNIRXFWMnBQcDJidE5QM3VqS05OT3lUb1lTaVA0eXUwdnNkcFdnUkx5V1ZUQTVyWXpwVUozbDBLVXRpdUwwYnUyZFB4NTEzM3hWMzNYT3ZsY05yWC85NnNkMkxPODZjalQxWkdtQThtOGJSZEtJanhEd21VMm5aSXRpcUQyRm5HVnFNMU8xcUthUjZxSzhxaGRMR3dvdCtyZHNLelVtbE1HSUU1WXZLZVNnRisyVSsrbHFUa2xhL240TWk2T3VJaTBYQVBNaE56VW1BRnI0c1BIelZoVDhjZG1ONjdjRGhMVm5NdEc5Nk5JN0ZkS3lhTzdFdCtkZzZQSXd2K3ZJdmpULzNuZDhSbnlrcmdrdjUyOFh6cWhSZzlTdnZmbmY4dDMvdHI4YS8rZGwvRzVmN1ozdzVpQ1IwZWZOS096bmlHZHRLMHdMdXpNOTcwTndBVkoyV2M0aU96MkQ3M0RRNzlJQnlycklnMEZUNDZWdzEwTG1yczNzcXpwNCtFL2RKYTk0cmQrZWRkOGE1TysrSU0zZWNqOTFUZTlKQncrQUpFUXBpcWdHZnpoWXhuczlqTGdsbjhtYXFyaXFGSk5SZThMbU4wSm9QZ2lXWXRnaUk4OWJ0QXFWdktVOStidi9MWFNtc3hoT1BLV2EvQlY5aGZPS2tIKzJldHU4MW50YzVhNGEraUZuMDVwb3B0MS8xZWRHbGVyRjZXU2VUeFZYelJLRm9BYWY4M3REMENkcHN0YWE3bXZkejR2LzFYL25sOFdmK0g5OFpyMzNnMVdsd25pT2VONlZ3TkozRk8vLzZmeDkvLzN2L1FlenJLTURTWERDckFwLzNwbk1kV1FSbEVNa0hKZTVqQkQ1M0RhUjVMTkNxaVk0ODdpRktXZE13U1NuVGltUnJlenYyVHArT1UyZlB4TGJDZDcveTFYSHExS2s0SnlWeCt1ejUyT0dqcGNPQnFocVk5MFZwQURqNERURVVod1lZdnh3dlpnaSs2a0FKT0VsdHRCTFFwQ2JCR3JFTXZVQ1NNa20wK0tBL2tNL2lrZlB6YTAyODI2eEpKVzJSaFJoNHZ6SHRlaUY2b1dTVWhXQmVDdUozbDFkelBQSHpaVllPVThkaUlBWHF1dkpDYndRanA2WHBXWmR2OGxKZHNkUmVsdU8wTDRWMUlNdjFkelFvakdDSkYrVWpRc2VIRXlyUW9zLzVhNFdRMmp3dmovUnlIWVhPaWxWWXppZTVYTTR2YlNGTjRlR0NHL3RVQnBmbUpPY0x4MTN4RngzdFU2S0VKNVh6aXBJL0gyZ1hkbFpLYjVmSG5UcE1TcHU1VmJZRVdtcEhGaTFZZFhzeDNqdXR4aWNGc0dLSmEwM3hmbzNYcXRJMHZTcVk1NUE2U0pEZnpmUEE1YmtoNW0ybFZmcGZGSmg1a0s0a3hzRGpUSU9XYXAvcUFheVZ6dkVrWG5QZksrSy8rdE4vS3I3NUQzMWR5TkI0VGxEOXBRWFBIZnN5Y2I3eGovM3grTmxmZlhmTUpiampxNGN4M0R1amZUSU42czBxaFdSYXBhY0lDT0d6S1lVdWRDblR3bW4wa3FYQjA0bEZkK0M3aCszZG5kamEyWXU5dmIwNGRlYTBGTWRaSzQwdFdSZGNZRzd0Yk91RXNtM3piaW1lV0FNTXkwVWRQelJkNWozWHhNdzFFVk5ORG5jbFhrQTZCbW5hWEMyS0JMcGlYVGlOYzZCQXRHaC9MOUNjeGh1ZVpmZ3RkUGhGVWdXL3Z5RVVZZEFmK3poNFlhZHNwR1c2Um1sTThxSnpmdDRKY3oxcElTWTZJeXVVUkp0Y1dieU1zdjBzMUc2anluUFVBK2FkeXpRTFdjQ0M4ZUlWMWtwRk94dHgwWEJoWE5xQWEvY1R1SCtDOHpKZHlTTzhYSTN0Ri9jMG9XN2tVV1ZLWHU0bi9IcjVvbEFwS1U5dWtYMkhCM256OFlhVlhOZVdMMExmaTVrY1pYTXRLZHpSeHFDeWhwOUJ2bkJLb2JjMWlNVlkxb0tzMzY3a1pLVDJqQSt1eFo3YStBMWYvelh4UC83Vi95YTJlS0p4aTdodHBUQ1ZoZkNmZk1kM3hELzZGeitwTTVJR2E4Q05hdDlDTmw2a2IxKzZrVklnblBMbHEwTnRwVkMwN1RNcEJTZWpuZk5FSVl3SXRVSGM2aHZlaXBOSldJSWZReDAvK0hUWjlpZ3JqVjBwaWpPeEk2V3hzM2ZLQ2dPTG9uZkgzZUxmMXpGRXU0T09OWnE2ZkRKSUNvQ05CQjlMWTZGSjRwSnpyckIzRmsza2x2TFNwQ2FmQ1ZVZ3BkRkVURUtCT0VKakg0SExhU010TU1NTG9TeWFGQWJVVTNncGtQeGNGK2hyNXlCc2dWSkxYVDh0TG1tWnArT0ZiNHQvVDBRV2VJWE5zeWd4MmlXNmJtZ3NuZGRTT1BqbXVZaEpYdlRFL1ZpWnNrcTNENlJjZ2VPNVhLT2NoSzUyUXNLT0Y3L1FDYjN1Y1pPUEsyTlUzTGJNZXdDMTh4MVNGZG52SFd0TzFUbWY4Ym4xWngyeVZ1VXp6MGRickZkb1dJdXNUUlZTUEtFYmZiV2ZQck9KdUc3VjRMSExjNmd6cGRxYnhsSU5lTjZWQWoxaHZDdzNNMTdzNi9qRnYrbmhzWTRtOC9ndnZ2M2I0cnYrNGwvVWtzOHlkSk80TGFWQXdmL2w3LzM5K0RQLzlUdmpXTzBleXB3Nk9oNTdWNTZwa2N2Y2xwdFJDZ2c4azNFclNxSHdZdUwweDVOR1haaHhLSXNGTDVBUzE2RHdGTUlUNDFhbjluaE51d201RHF3TVdRN0RiWlRHS0daOVdSQlNHcVB0M1JqdGJrdVg3TVJnUjNtaUdReUcwVmQvcWRPS1NXM3IrQzRrdFpHMkhSMjF6ZFBOQll2cjhUSDRFbWR4aVlZSkp3NzZNdCtiL0N3c1JaQU5yOUlFQ3lYcG1SN0lyckZsNG5Jc1ZQdEpvSTNDSzVlbC9rWTVDSHhSUjFtWXVPWmVBeDRBY3h4a1B2U2h0SVA2V01hcC9sVE9xcFR5MUMvRjB1V1lhZHFrbEJ4dUtZWHR3cGU0MGkxNGhETnRiNWFVQWloMEpRNG0yWkpocnBjOTFvM29ORGRwblNrYzJrVUprNGJnc0U2WU84THlsN09pOUZxODFRNzZxNGlFUG4vbElPR3NLRDAyeEVIYUhWTFlaWjlucFVEekpHZXVjNkxGcEhCUGxzRkE2NWczSWMrcEcvL29CLzYzZVB2bmZrNWE1amVKMjFJS2FNZ3YrSkt2akovL2xWK05ub1JtS2xPR3l6K05hS3lrcVhnUEFUeVRVaWh4WlhvaTJuY0t5YzhDeTJTZFVBcUU3VnZJSVZKWG9FZTROYkdkM3FqaFpScVE2MUNHTEFBWGNwaDY2QTloN3hiNE03VkZ2QnBoN3lmaDUvdnZPR3AwUjl1dWh3OTNEV1I5OURVaGZTa1RyQXdVeGVEc251dkh3Wk1qalJWSVRsdWlTUVZQUWJZS0xMd1pTeTA2NytqS0w0c2orWEpnZG1qdnBFTEF1VnluQ0hGWlhGbmhtSDZwTmFWNXl2VDZrOEl0b2V6b3pMK21UNHMxK2FsTmJGUzB1MDJqUC9xZit0TFhlbVdFelpjMDJpMTYyZ3Y0M0gvS283M0pUM3h5dml3VEk2ZVpMcGNsek1Wdkd4N25GdWFETTZ5SXRMN2svRGFoZ280RHpiL2o0cld3QXFUZDhzbW1ycVRUTTFMNzA1MlFuUEpqb2VOaG93eWdvZi95Y3Y5ZmNLWEFWbWY1V05wS0lHK3VJNW41YVN4Mk5aZS85L00rSjM3bys3L3ZhV1B6VExndHBiQlFwZWNmZkgzd1h1RnkySk81dUpKQWpHSis2WEpzM1htM2xGZDY2SEt6U3FGOWZMZ3BwY0FNU0RoN1hTNFBKZFFlTmZHQVZ2bExUQlg1UlJHUWxuYUIzQTVOWXBkSG9hNVgvY2tqVVJUSWFLWDZDS3Q4NGMyT1V5NHFtU2JTT1dLNEh2SHArT3laNnA5djZTZ2xPbWo5UlpvNEZBTktSdms3Z3ozWGt5d04xV1RhMUcrbmk2NmdDR0s1a3dDcjJkVVUwTGc3anpRdm9rVFUwMjdoZUY1dzdQVEZDdkNDc3d6bnNoUlRIaldYTkY4MG1wYTQ4cHhlRmlyMXFYMVpLU1RGSkliNDFoYWFtZ25jMXZtRUZVbDBBaytCR2pnOThTM1k3eVU2ejF2MmFXY1puNFA4R0xxTmttZXMwdmdDdGNMOG1TL1hJNzh2UzhONTZqZHBHd0l2MThzeXk3Z1pHak9QVVI3UFpTY0p1UWVTZHJ1OHdrcEw0NUhUQU9Ibld5bE14dEhmMlluNVJQM1FKc3o2bEluZ1RiRXZXWnRmM0k4M3ZQN1Q0ajMvL21kZDltWnhXMHBoTHFYd2lqZDhWbHk4OUdUMHpwNk54ZkdSTFFWWWFwazN3blVqcFlBUXBIdzErWVJTc0NDVDkweEtBUklMWXVMTHhJdVIveHVEOUs1NFVRVEFOTXlUMmpqWTJUVVBsMVdBQldOZVdBRnEyMER4a2c1bmJweGRmMjYzQXExMlprdEh2dnNEU0N0OW9RenRvTDF1T3dzOVdUSTQ2eExSUUdZbG9iUkZQK2VyY3ROazM2eEpIK1Y2Qk1iYlBnMFZuSyt0TkUwdkM1aytwTVhOb2dTTFdXdkJDa2x3RTF4dW5zL2toTXRDTGdKQWVyNWphQ3lIWW9rd3l2SjdNczlUcTFLOEhEOFMvVEptV0hRQzhlS244cWtmMCswMFp3QStaUXdLK0tKZ1VNb1VIeEJlNVl0YXQ3Y2w3STdqejdMNXI3ajV5dTlsMzhsZHlxUTIwMWY2bDRRMmphUHZHekkvQkp3blRPNmo1SUsrckswUEFicm5XU21rWmRXTitVSGFIUHBiMjE0L2xKa2RINGNPdmJFNzZzWEgzLy91WnQzY0RHNUxLV0J1My9zWm54MFg5aTlwc1hkaWVHclBMMWR3YlBEQVpFRzhHYVZnV3RKdlJTbncrV2wzRnY2SnhvS0lVTXV0bG1uUldYbEFRMzJGeGtscHh5Zk5kdzZJUG5uUWtNNU94ZkJRWG0zM0phWDdsQ2VxcnpNcDlidTl1VndwVDVGVk9qNlJiMFdSSGNza2pjT09mWk5vVlJMdVpBa2hQQnZzcGpEL0ZDK3ZjdlBVQlJ3UDEvV2pGTWhyZnpobk9zaGpLV2cwN1B1ZUlNT2ZMTTFobGtISktvSzNaQkVYZ1diaG8xVHdzMUNnTFQxcVdYQ0s0a2pLWlJsVGxDaHgwMmc5a0Y0c0N3Vm4vSUcwb0lSem00TkhtcFF4Nyt3c0lJbXdPODBYMlVwMy9XM0JONjRrRC9yaXlGSytxMllabEhSWkxUMDVQOXFUenhoTXV1SnZmclNEdFVDL2xhKy9sRjlPeGNCNThGTVpLUTc2V0pUZm5NRjVBWlVDL0hvYTQ4Vnk1aU1zVnN4UzFrT1hqdzlNcEJBUEZuSCs3RTQ4OWZCN21uVndNN2c5UzBFRGRPZGYrWUhZLzZIdmo1My84SE14dUdjdjVydTlPRnlkMFl4cHNHeithckZLS29jV1hKblVTcklHOVlEbFJXM0JSSml5Nzk3cmp4MkVRaEU0ZHR2TUs0V0ZScERseURNdFJiTlFLdDdzNU9ZUEhmbFNNaVpOUjQ0TlBySUN1S1IwdW9sTFhxNGI1N3djSnd5TncvajhUMEtKaFZIeTIveFFTTFpPekMvUldBa1dHclhQNVltU2xoVW5iVXR4T2ZKS0d5aHJuMFNGUGY0RTFRNzZvanJnbHh4SG9aUjlJeUFZemZKZ0VRcEo0Qk9XaS94MFEyRVVBM21teitmc0pxNEZueForV2VTb2RTM2cxcDFCRVM3VHdwT2duMDZrZUtGeC9kQUtOdmNCQXB2TGxqcmRKbzQvbEMwMHBLdE1hVU5TUXZnbGZwSi9GcjdjcHRKR3Q0MHdIOUFEcFV5TEZwb1VkMEMwcENmK2JBdTBJUjFGMHBncWxubG5QcFJxenJQYXNsQUtVZ0syU014M0dRc3NtUUthekhpa0hWQ1QxNDI5Q3grTysrNjdMOTczdnZkNXptOFdXam5QSFYwMVlPOE5iNHo0OGkrS283ZDhWdXp6QVk0bnA3RXpWV2RIR3JCcm1wU3hGc0pzRVJPZGI3bGpXUEFTRDdlK2tjN2JhUUVMREo1Tk5EU3gvcEZYMHR0b3hUM3dHUTYzU1U4VXV4NjhlSzVIdDhIbkJveE9sajFKbHVQVTBYYVVTMGdMbyt6SzEwWGVWUjJVNThXUUYwemoyeXZoMWlMeEltT1JVRVp6d0tKa2tjdjNqb0tRa1BZTUx0R3BEUXE3SGUyMDdPQnZIeHJITTkrU1Rqc29TeHhmN1diaHd5TTFrN2JuY0FaOVRmMU82V21jQzgwbTdZM1Jvc3YxbHphczU2MEpQQTJsclEwVUxPWEl1eFhCU1gxWjQyVDhobkFiTko3eWtYWHVzOWdJVjF5UVl3MFAyRlRWRXI1cndBcDBGWHovQ0c5UGRLYkgvc3FBVzFFR0JiZlN0NmVCTnMvTzNCdmRML3l5MlByRDN4YngyZStJdytIcE9EbzRqdFcxL1lodG5ZbUgycTFISTM4a3RMTzFHOXVEVTdFbnMydjdpcFJHM2luWU1idWNMMzNHMU00SVl4WVd1Tjc0a2NaQVFTZXNKemtqcHplK0YySmFES1l0NlFJOHpLYzRGa0lyLzJtOFcyZ210NVF0eU9FbW4wbFNrQjJpNGVlOEpHeko1VjJVeFp6YjRGMEZJY3Q1TnQraElhMTk2KzAwQXJSWDZUbHNjOVc3SGJRb2hMVFQrT3l2WGU1bVhDcWY2Zkd6OHl2YXpKRmR1NDZjeG1KdUs1NlM1L0w0YWlPTy90SmU5MFhqSTk5V3h3a0Z4OUpHZ1pZbG5zWVJQcW9Ea0NBK2pGUFppYzBYWks4Z2pYTUdZZGU5dGhMSXY1R3lmdHA2dUE1ZG9kbW81d2E0RVkzVG03NnQxOGxTekhFTE5kRFpESk1zd2E2MHdVaHAzZms0bGdkWFlyWC9sRDlSM0R6QnVRWGNsbEpnaHE3dUg4YnljQ3ZPLzViZkhlZi80TGZHempmK2tZZzN2bG5hUWxyc2VCeTl5U3gyWlIzc2FVMk1kTTZaSFY2SjQrVmh6TGtZenVQaGlkYUUrQ3lWQndrTlZ5YUdRUzZ1bVlSV1hoa3dsN1ZMZVVibUJ3cGQ0cE45Z2ZwTHVJSDVaSG92RmpuOEVpNGdYcERMdUg3S0VXZ3Q5RlMvSnFtaGc1RDhuSVp2ZnN3MDhlVEtZazExNThWTHV1bHlPb0pXZUlxUGFjZzNUN2tOd2MwQ3lvMzFNN2dPQzBvK242bnc1d0FvSzRjWlc1VFZ1ajNVayt0SG9KMldYYXZ0cVgwbDNJNm5jZHJnSTNoc0dpVGhTT2Z2VEFkeWZjeGhVUWpOZkdZK2h2bVhNdkliT3BVM2twOHVZbk1hZExrOWFmNVVSbkg4TXM4ZzFaMFVsMUhxdVFrVXZzVVYrSmlIVHhMOTlhWkF2K1VXc3NKbEhYQU1IUFQ2TVZEZTh2Z281bGN2eCtyZ3NtVHZxcTJ4eGlLN0JkeWVVaEJHeTBrTXJoeEwyRHV4ZU9Xbnhma3YvNnE0VDFiRDFsZDhRd3hPbll2NWJCbkhUMTZMenJXajRBRlNaMXQwcHhleU1LWitVNUNyTHJUWmtzWEhZdFNnY0dtRzljQUFYVmRqNTRFakQ1b3ljTTFDQUpxVUpCaUpoamlkaGNabHNrODZ2c1BGVVM2bldXR2RRSnFrVEFzeWZhT01jcmp3OVhtUk5DYXorSEtOZ2pESzVNblAvRmo4M2pFVlR3S1RuUmNHd3FvOG5PSXBYd0xodU9wRWdDbXYycE5nd1NmVlN4ekhPZldabk91UkkxekttRmRKNTBLT2N5LzFxd2FQaTlyQVJSM09kYnJ2eWl2OWF3dGMwNStXUW1BODRKOFZrY0ZZNUx5a0VQSjRlQkl6THdGTEtzMlphQnFyaWd4OEFoa2xMSjVsRGdyL29yd0oyMlZRRmU2NlF1OXlhK2R4eURDdjY2Q3A0em9vWmRMZGovamhsNk0yNXdnUGRwZlhMS0luaTIxMmVDMG1seS9IYlA5eUxIbGhUZ3FqWEN6ZnFQNW53bTFkTlBLSnIxZjh5SHZqYW44b1MyQ2hvOE9XQkg4Y3U2TmRaVDRWcHg5NWJ6eitHKytKeTcvODdvaEhIL2R6VlQvODNWWmhIamROMDhzLzZRbEFQL3hJVXFMTDVSc0Q1cGVHY3R4bm8zeEp5TVZkTTFDUTVuUXUzbmpTUVI2ZDh2c0R6b2VCYU1qUGwyMXBiTlBGSDlvMlhkcmxpMEI0b1VLYWkweG9TbDZtQmVSdlhQcWxPcFNoTU1XMFNPQ1QyOWFVaFU1cDY0dkdGRyszRTVUWGlJbVhDOGptd2pTbm16ZDFPRzNkTitycWNCR1Y4OU9ZMEErSkRMd2dhYS9lNjBFOElXa1dhUkdFc21SNHR6K2J0a2xCcXo2RkxXZ0N2ZWYvK29LeENDRGxsWnQzc2JaQ29LempoTW5NdkZLYXd2S0xZbWlXcnROUzNvYWl6UXF5YVlQajZ6cGRsOExyT2x0MVU0ZkRFS2pNaVh3bEtGbHJXV2lYOVJnUUY5dyt1OVMyUWxPc21YUUhrOXVDb2lTdjBKcUJ3Z0lLS3lucGRPR1k3bmpFYTZ6Tm1GZTU1ZnZ4c2NyMXBBeWg0UktYN2o3NDRJUHh3UTkrMFBOK3M3Z3RwY0FqeVZQLzVOZmphTGlJMDl4dzlFOUY3K0JheE9CY3hPNDB0Z2ZMR1BMamwwOWVpT09IUGhEWDN2UGVPSHI0b1ZoZGZGSUtRaDA1alhZUUpGeThFTVRMUFZZSzdIZ01CTisybEJleUJhYWxGSUNWaWVKcmdZVm04NGxCVXpZTEU0ckFTaWVIZ1IrWnRtak1SK0cxMEtaNDRsTUVNS1czSDZHdUJUYTFTN1BaMERpOWxIY2UzdE9WVnJzTjNwV2d6VUxmVmd5cFh5NmVhQ2puc0h5WEVhbUM3aXRvM3FuSUNhSXBXVGZDaW5rcEN4U3drT1dLTGlsNVR0Tk0yV2ZSeW5jNkZiQ3dpVU5iRm53V1ROS1QwaW5wYmFITDZabUdQQXUxaEtldHFFd3JmajU2V25Cb1J4WlF5RjBXbW5YZFRidjV3SjdDcHNXeXlPSFN2bFcrL2VlSkJUelcxZ1J0a21uZStwUm4wM2JXTHZsS2IwejNwdTdTUDhWSmZnYWw0UDc1M2tobDFPOE94em5jYkphT2J6cVN6NDR2aXBYb3VXVFVvUENJR2N0dHVVamZTd3BlKzlyWHhnYys4QUd2bDV2RmJWb0txN2pqLy94dzdQY09ZekE5aU01d0owN1BPanBTM0tFandVRU1KcnV4ZTJZN1JqbzNkQlpYbzNOd0lUb1hIb3Y5aDM0ejlqLzg0VGg4LzN2OTAxZitOQ0RqNTB2SjdmU2JFRnFRYVZEVkdRdUEvS3dVVUFJczlxSVVGRXE3TnVHV0lGdm9WYzd4SEM3QzdVSEtnblJkcGNEdXF2UWtmT3R5Rm1xUWVWamdjM3hkWHI3NVo2WGcvSnlYQlp4OHYxUWxZVTE5eStWTVEza29DUXM1dlZFS3BnR0tFNlN1MGorbjVmejgwWFdua1lkaWFPaHh6ekwxYmwrbXdTTmNmSUZIelY3c1dwQVdCQzltTFdLVGtNNzhDZEN3MkVuTEFvWmpobHdPSVNTTnV3NThBUUdVZURuY2xKZGZyQVNuMGFjc3FIWTV2SDRQUUdXVm5QSlQrUTJsa04vWUxJSzZLWnp5bkU0NCt5MmxRRjBva25LRUxlV2IvZ2szcFJSeVhhVmUzOWtRaHdlV0htUEMwd1VzQWo3ZndQc0h2Q2tzUmRDUC9CNkc1aGVGQ1R2NEl4Zkl5SHgyL01sUkNxZC8rUDF4dk5XTnM5TnhUSFdNMkZHSGU1MDl0Zk13dGxqNFdsZDlOWnEzQS9ueFM4NUJBOUxsbGcrOUo2NDg5V1E4K2VHSDQ5SWpINGk0b0NQRzRiNFlqMk5BcTNaT3U0TjhYTFhiRzRrbmxvU0VVMHo1aVBKOEpFRVFJRTBDcTBDakhPVDR2RDExS2EzczFzVlVUNE5Vek8yVURwMEhsRHBFTyt0cGNlVXlwUHNvSUhpeEloQjBDdEJKK0ZGblN5aTdQUjY5RWxCY1BGSWJrNkx4RG01MnFTMndvOTZVbDVVUkwwd1ptV2RKcDJ4dUwzQ1o3SnNQdEk2clRvY1NHbVdTUGIvMzhBeGdjUlk4Ylprb25yN2NMb01GM2ZhRkZlLys1K09GQlFXaGNnYXRGVmp3YXJtRjBUUWxQeW1Xd3I3cy9HNVFvUVU4SFFHdVV6emJQRWpUSURNeXBpZGVGRUttS1VyQjVVcDVqeVMrY0pUNUF4UmNrNS9RR2MvTm16ck1OeXNFaDBtYnFPN2NmenVzRWFQNHJGK1Y4YmpBUS8za3N3dmNyOGtDMkQyNDZoM2ZQNlpFbXRxTkV0SXN1elNXak90WHZlNmo2MG1XR25SWURKL3c0OE96S1FWK3ZBVjVRU2tNdFNBNVlRendTVmNqeisvb2VLQkJXQndkeFB6S1UzSHd4T054NWJHUHh1WEhQeGFIbHkvSDBhT1BlY3o4NkpMVkxzR013Y2dYbE53M2xOZU9yVGg2S1F5WmhzaGF1dHNacE1Hd29paENtUldKZ3F2OGdTMExIY05BWThXTGIyeWlETDlxSlFZS1k3bWdUSkxRNGl6VThJVW5vS3p6VkUrVEJOOU00N2FsOHFZVi9FWWR5TUplMnBiNGk2WW9oVlplUXd1VVQ3alVoM0lESmMwS3NDRG5GVnFqbmY5c3VONHlXY21VemNsZW5BcDdRYWFrOVU1WmhFUytkMFI0NlgrSEczVEJaZTBYNFUrTHZKTS9SZG5zL0pRMUw0aTFKaXlFTHBqaStDMGExMGNhY1JTUncwbmhrTjR2SDhpU2tOb252OURKRGJnemdWYjU5Q1VKSFBsRnFOTVJ6LzNrZm9IampkZHFLdDlsenVVWHhlVCtrZWRHeXpDV3p1R1l2Smp4bXlkVEtkR0poblFtUjNnV0l4MVBYSy9DNmY2bEtMWEVMdzNsUzFncHNLbWVWQW9MQ1EyL2VyTTNITVl1cjBrejRPT2ptQjRkeG13OGpzbEhQaGpYOWkvSGswOWNpS2N1ZkR5dVNsRXNEdzlrVGttYk12ajliUmhaa1BrdXh4N2ZxcFRmNHZOZ0tlakJVTUJDbklVUncwK0YvQjZGeTN2QTVNcFErTTFCQ1YrWE93MnlrN0NiaHcveW1RNUxKUXVXQlpFeStPTHRlak9hTzRYR3g0bFBLdHJFVXhtbDU3TEZVbGdybWxRKzBjbW4zd0x0Y3IzWkIxYUFhbXNUVDE2cXYwRXFmMFBRelpQTFl5UGViT1hKTHdKYi9JeEdHWlQwSWxTMkZBU1hMMHBEZVptTzgzR3pQTE1ndEpXR2hkQjVSUkF0SmNuUmVMTE5LNlVsZ1VxS2gvS2pwbnExanZzQnBmTUtjYW16bi8xVVZ4YlFyRUNnWGZtekVmQ0VLTGZid3V0Q21oOEpzOHR5K1NkNjdnYkVKMTBVcm1MbmFLendMSDFhVk1xZ081Y3lVUDNRSXVpVFRtb0xTcEZaODVNSStFaVJKRVdVMnZhU1ZBbzlyY2oyOGFFb2hTMCtvVWdIMUVrVUJ6OEh0eVBoSG1rSDU3Y2NkcnRURGRqRVNtSjZjQzBPcjE2Sy9TZWZpQ3NYTDhUaHRhdHg4YkdMY1hSMHBQQTFLUlBlZzFkWHVJL3duWVFFcUs4NERWQmQvbVJpdWN6TUFqaGxweElkWm40eXJUa2lNQnhwUjE4VjgxcENpVFdDNzNTRVcvQUhaZ0J4cGFlWnk0cUJLUDBqWGJ6YmlzRUM2blRxeXZRVzRrVGI3UEFsUGRPVSt0UG5OSWkyaE5wMFlwRjlvMUUwQ1kxaWFOSmE1YStIOXNxNDNqTEpGMjFHenJmZ1pTQ2o2b0VYYWNyM0ttYTFab0tVM3R3VEZPR21ZdEliTXZYWVNjeE9GajZRYi84ZHB5d29pZ0dRUkZ3b0NnRkZVbmJ1WHY3Q0Q5ZU5CU0VmWVN2dFNYN1RDTWVoS1drTFBwRUluQWVQVkllbkZVd1BFcjl5THlBTEFKK0xROTc5NkM4bTZvS0VXSllBN2VPRlJRN0lXRnk0YS9sNGcxTGc4eTVGS2ZDWmxOUk9qUzUxdjVTVmdoOVF5QzkzQ252cU5ENGY0cEg0S00rbmF2bHBNZk14NDRFSzdRMzdjV28waUMwK3dqWkxsc1RrK0RpV0I4ZHhlSGdZbHk1ZGtxSzRGSmRsU2VDdVhyMGF4OG8vT3BheVlGSFFSUVFOSzRKdmFVSnd4SCtnOW5xd2lobWVoWTlIbWZqcHk5UUVhTGdvTkpKd20xNUM2ZkpDZVV4cVd2V0JjQkhhb2hBYXhZRGpncEZ6YWk0UGYvTmt3QVR6Z3M1UUd2eFVmc01DVU5qV2krQ3l4Vy9TVXBzM0ZFV0IrYVc2YmdRV1pzSDFsc2txV3dwRllLRzM3MVRMbVpnVVJVRDVIQzZDNWpTaHBEbGFhTVEzMy83RDAvV1hjc1UvYVNsUXlJSXBSNzJZL3dxN0g5QkFMNyswZDlud3crbFBVVllTTXFmNU94NVRXcU5VNUh2ckVQMkFyK3VEajRRUDN2aitQSWZidFl3aDd3ekFWM0ZlQk92NGRXVFIrdE9VcTVodVpXRkd1WWt2dnpVSnZTOVoxUWFPa09UN3JzR3RVRG0zSTcyVTlKSldDbGdCYU1DaUZJcWxNT3hNTFBoRFpYRG5vS1V1QlVKbnlZL1k3Wi9XUFBBSVpob1k4bHZTTE5zU3RDMHhRWE9lbG9EREJ5WENJTTBtVXl1RS9jdFhyQ3lldUhJeGptVkJrSGJsMmtGY2xVVnhJSVZ5ZkhpY2JuRjVKSWpTOENKUTR4QmlXUmxkOVlOMkxmblc2YkxFVlkrRkRFV1FMUW0rcGpXWjdrbjR5azVlZG4wTHA4Sk9nMGJoUmpFSUtJVkdjRE4veWpBU1RpTkxDWlJQZkpTdnBGS21PVFk0TGRjSExiQ1g2SXhjWitrT2RNMTdFRGRBV3lrVWJDd1h2azlBSUswb0JPQ0ZLekNzUmhZK0ZuZWlVUnpQRGNabi9FbGdMbEpaeW5UWXlUTlA3ODdPWTBjbnpwL0UxelNsc2t3RDBwMUVGcWlzRUZMYlVuMUxGcUxMNHFjOFAyR1F6d3dzVjFvanhLR2hQR2Y3RnAvZWNmcU9TRnNQN041WklaVDNGMGJhbU14VHhYblVXUGl6dDFIdTJpaVBSNjRQbUw4YzY3bXNheCt6b0ZORHJkRHlPTDRrbFVKNSt0QzJGRmpXV0FwQUJvQVZRVmQySWorc2dlSVlxamQ4blJTS1luczVjaWY1ZmorWGs3aytsQm1QbVlWU0dISFJKWi9YUElkeUF3U2FmUEZrSWc3bGVQOGJSWENnODl2UitOZytDbU04bmNTbEMwLzRrZWpSb2RLVU41RlM4UzlRYVFmZ0JsaWo3WGF1QlkySzFXaDh1ZTV3MEFna1BVRVpvRENLQVBKTlA4cDFQQWx0enN0Q0RXbEtUenUvOHdXSDZVTmVLWVVtaGRmOHkxSnFMQUhSTldqWDAwYWhGV2p0TTZHZGU3MWxZa0hOU01JbXRPaEtHZkpNNnpoQ0paOWdvYlZQbWh4OE10OE8xcFRTMXVaOFVTcUpSNmt6NWFYZFc2c3k4UkJLdm4yVmJiY0QybDQzcFpVWGd2ejhINkUwdmVya201WGdhVUhWZXNpbWYrRzFPTTdmZk1WTVVKWFM3UVBxeU4vWFlDV21ObE9uaFpvMkNGT3QzOGJVRTdxNXYrV3BBc2N6KzdUTEZHdWw4SksxRkxaOUR0ZmczMEFwYksrMEkydXhEN1YyK2FuNUFXWHhKWXc5MGZSVUhoWm9URy9pY2dNSlFsZGFBV1V5NmlhbGdCTHdOenQ3OGpSQWVaQTZvNzN3MTdHcmZqOXFsTkpRVHN3azhITmUvcEQ1eXcvUUhuR3BPWmxaVVhEc09OU3g1R2d5anNYbFMzNGtoS0lZeTZGQStJR1o4a08yMC9JbEh2U25DS0NGTG9mUmVnQ0JMa0tLajhNeUdjaVJUZHRGay94a2JTUWtTMExOZHhxOVRnb2dsV3NmSFVDakhMSnZCU1ZRM2lqNWdHRDVFczBib0ZuZ3d2V1dpVi8rS1NBZmtreUhJS1IyNXJsUXlNS0F3Q25Ob0dHbEhHa1d4aVF3aGpxNHZtK0FSd2tubWlUa0ZKWXpYd1NlS0g4MGRpcnZ1alBmNGp0TndmNzRxbW45OWZ1YVo1LzFNZTlaUjZMdHJvN2M3cVE0VkVBMCtDZ1J5bXNsS0ZmSS9XcS9qVWk3WjFxMFJSbXdYaFpaeVBuMlN1cmRtMnNiSkM0THc3OFpvbW9UcmRqb3oxTHJHN3lzTGhxdEJOUVlmdGJOVm9ESzRLTVVVQWEyRUZBYUN2c2kwdW1KeHBhQWZKUkJ5U2NkTWV2N3doSzFNTGVTZ0wvcFNGSDl2SDVOMjVZU0tIOVh2OHBwR2ozWC9KWWtTc0x0VndQTGo4RXNWSjc1OURsT2Njb2NTMUg0bDZabXlZM25mQVJjeWtIK2pIUGgvaFhub3lSUUhCTXRLUHlwZkQ3TDBaTmlTUm85TFlvMDIybnlERVdCdjJCRlNaNTBqd0h0VzhYRTM0eWQyb3JQT0pUSnBhOFR2bm1KT096a2sxUHlXUlR6bnNvRDU5TU9JbW1CT1pUZnFDdzhHdDdaNXdkdUVsaDkrRm5vQUFKUXRBMXBwVStBTUZGMGtsZDZUbXNLazZZd1g2NEJUSi9UekJkZjYwUm1PRTFnOXJ4TUVRamxNNTZnbTcvUHdSTkxPZVdYOHpqbFQwMk9rbHBDYUN4NFNtZkhOeCtFT3lzVmZGWkk1azhhUFZzZmQyQ1M1ekRIVTcycTA1RmNKdk54R0xMTVA4VXpyNkxrQklROXJZdE1BNnRNVDU5WTRXNTdicHNJVGNQSDNrM2o1bEJ2NXVteUthOHFCWVdmaTFJNDBxQ3BvWTRYcFFCZFVRcnMyaTdMZUtzTy8xS1ZTa0JER2I0a2swbEQwL1BWN2c1VGR3N1BEL2U5Z09lMlRPWis5T1JkUVExaDJLYzZzdURqK0NpeUZ3RDVlV0tuM2luVHhJTzBhSjNnK0p4QjhXSnB3Zms1UE1pdmtiTjZoR2JYVFJIOXlVSUo4cUp4Y2tZNkRwWDZrMUpSUzczZ0FQY3VnUHhTTGkzZUJJU3dYYWRIRmRyY250NDg3ZVNKTjMxYkN3Z3p4bnNFQm1sWk1QeVpCUE1RUDc0Q1hvcURjU01QdnFiSjQ3K3Q0NEg1bDNKS0swb0IyRElvK1EzL1ZBYitWU2s4Qjd6VWxjS3hMNFNTVW1CWFpOejlCYnlLUTBKWmVQRWpNQ2dHbEFLLy9nUU52Q1pxQjhPSG93NEdIcFBlRTZtMExUWFcrWXA3OGxXbzVMRm8vTWxRbDlkRUttK2hTU3hISHhaeGVXT09obEVPeCtJd0wyR21YZ0hUdUV4cW1IMWhMdjROOGtLeWladEJmd3d2T0M4RyswWk9BN1NWRVdTaDBkWUdMZnEwYUlYc1U5ZHcwbnBsRjR1aHFTZnhTQi9CSmorM21YR1EzL0Rpblg3QmVVVVFNZzNvMnBMSTQ2RjhadFdDbk1kNVdiN0RFbjZNcDN3dUJJR1ZVQmtyMHJQZ1ZhWGdzWUhiYzhOTFhTbndXNUlvQmRKUkN2eWd5NDJVQXRPaEphaThSRU9aY1crUUprMXBtZ3J6QkpRaGpYZlBRWmtrUUt2TEJDMDR2d3JORGlvYUpqV0xhblQ0VktuZzh0a3ZDd2cwUHpzblp6OHY4b1pPNW5YaXFiQmFtTXFxSjVsR1hUQUlsN1EyLzJpKzJEWHhaUkU3THd2NFhFb25LWXBVaGw3WlZ4N29UYWF1SDFDdi9qZ2ZQZ2FmN011OHpEZnpMNHFuVTM0V3J0VjI4ODgwekN6cHpBRUNUUDMrMFJuRlNUdVdJVlBxTDBvQjVWSEcxKzhJVUMrOHMrQlZwY0I2L0JRR0ExNU1mZngybUFYdit3RTU3Z3h3cExYcCtqSWYrTGxJdnZDekx3SHFjcy9BczJpZVhzanh2WlFES1JZY05PUjc5OHY1bllrbVcyNDFGcjlqOFQ2ZXlNMWljaml4NDI2aXVJbnF4M0dITWRlaXdPZDllSDlFVm83dk0vUUNRakZrNWNEalh5dEx1UTJGSzFmQ09CNzM4aWk0ci9MNGR1TFowMDZNNnl2YzF3TGpoMHk3aTZuNm9YUzVrZWlrRnUxNEc3V3ZkbzNFWTVERFloUXJYaURqSlM5V0tSL1FrbHYyNUxwcWUxOWpyWFIrY3hUbk5Ma1Y1VHJxcCtod2ZLZW5mZkZaS0IrM0ZNMWNjVDZmZ28vK1dFZ0pFSitwem9YeWkwSkU2QkFxNG1YQk44cWk0bW40bEZZSzE0TVhVWVovYjNKcnk3OFN4VzlPOHVsTlA4WElXcGNuS1doN0M1RkdzaEV5bmNWdDJVZ1o0SVk2VStDakhDUUh5SW92dWZqdHY2RjRZZW1rY00rV0Q0OXljYnhFNVordDg1dVJQZFduR3JsUlo0UGluSktCdk5HbVlvWFFSaXdweWFjVkJic09Yd0pLdUtRNVBUdnZtTkNnV0xKTFg1cTYzcm5hTHUybzhpVlpmRHMwanN0U3JENWxzci9aOFoyQ3VMbUVGQ0ZlT0k0U1FJQ1ZMcC9IdG91ZUxEcmk4bkc4YzBRYTFsdmpOSzRvQnh6ZkFqM1RtRTlWUjNFVE9hZXIvOGxQODhpWWdQWk9tYk1xYm9CUGFhVlFCS2o0T0M3UGlpdldBYzY3c0FWaFRUdlg4UWZuM1lxd2RpenZXaElNNzJMYVhlZmFhYWNyOFpBSk9GZjZTaXNTMTVFUU9GMU9lNkRMKzJVbTd1NnlZMEh6bHBzM1dSWXk5ZE51d2pZbmM3cHdVbWpkWG5IQThVVEZuN3hrdXZIOUJpZUhyZVQ4Z3pqNFdRbjVYUWhvQ012NVRWREYvUWFuNGtzK2lNYVRHL0VxZGJnZU9ZNWNKVjdBODNkQXUybWZ3N1IvTlpDU1V4NXZhZVd3NDZoV3BmV2srSEQwa1ZlU2VabXBXeHh0WDZsdHl1ZDloaTQ4UEZiUXAzeDZ6SHpSUytvdVl3VktPeXFlanZYTWZRcWk3Smh0Z1dxN05rcThuVC9UbXNUTnRkcG1tTE55VSsyS0UwbnlWRW9oUmxya1E0bXh6SVlWVHVzV005ZHJXYlQyNVRCMU1abm5XYm5Nc3ZNT3IvYXBNanN2N0x6UXNRUjhyNkt3RlZWTEFOWmdlck9BU2xEOHVKWFh0U1U0S0ljQ1IxVzI5TGp3NUVwT3FzcDNLT2srSmQyck9BMGpnM3lWcFh6YitkSldQb0xNNzBXbXIyMlRMMFZRMG16U3kwZXd1N0w3dTFZQXNvcVVqeW5SVTlwUWVYYnExVUNLeXNjeEtZeVJmSnl0TU1VSFVtcnBicW12R0dWNnlrdGpjeEpXcUMyLzR1bDRTU3VGc25pTE81bjJiTGdSWFZzQmtGK3NpYUlNQVBIUlZPZG5TUXk3bWI5d1JJdTVMNXQ0T0IvRTFueUlkR2poYTRndENHazN3MS94S0k0OHlpMUpRMXRBeTI2SEVLVTBIZ25pa0NHc0NENkFKVHRFVGhhR3p0eVNOVHRnZ2RTNWduOSsvVmdPODk1NVhENHAzWDJSMlUwZnJCQlZCZ2V3SzBCbVo1cSt5alZIb2h6bUhjNlN4bERZb2JleTdsTEZhU3hheXFuVTBiWWUwcHVaNlk1aDFaUExZUTJtOUJWOXpWYVkrc3BSZ1F2a0diMVhtRGlPeTJoUSt1VCt5L0tDRHZ1cnpCWDE1K254V0hJVUtjZUxad0x2c0NBaWliZm9YWVl3Rjd6cEtjYkxFUzlwcFZCUlVmSDhveXFGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2FvVUtpb3FObENWUWtWRnhRYXFVcWlvcU5oQVZRb1ZGUlVicUVxaG9xSmlBMVVwVkZSVWJLQXFoWXFLaWcxVXBWQlJVYkdCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FMaVJZclZhaFdkVHFkeEphMmdIUzQ0U2Y5Y1VKVkNSVVhGQnFwU3FLaW8yRUJWQ2hVVkZSdW9TcUdpb21JRFZTbFVWRlJzb0NxRmlvcUtEVlNsVUZIeE1zYWIzdlNtSExwNTNKWlM2SFk2OGMvZmRuZDgzdklncnZWMjQzRHJycmcyT2h1ei90WG9kcTlHYnptT1RreGkxWjNFb2p1TEdlSGxMSHFMV1F6bnMraXJ6R0xXajk1cUZOMUZMMWFMbFJ1MFdNMmp0ejFJbFZSVXZFd3hXNjRrRzcyWXk1L05aamxWV013bFB4RkxpY0M4dHhUZFF2S3pqTzVvRUV1bHp4V1g4TVZBZWN2WlVYUzZDL25IMGVrc1ltdllGOEVzenB6ZWl6LzZSLzlvL00yLytUZHYrWjJGMjFJS1ZQWDU5NTJMLy8wTDN4Ui8rY0dJVDU5OUlKYUxpOUdaajJKMGNENE9CcWRqdWR5TjdhT3R1T1BxTU80NEdNWm9NWXlqNFRDZU9LVWVkdy9ranRSaG5BWUZQZERYSUtrVHg1T3A2NmlvZUxrQ1llMUsrZ2VEUVl4R28rajFldEdSZ2xndWw3eVpKTm1lU1o2a0FEb3BiWEowSEl2cGxLZ2RMeThOSkV1VTYvYjc1bmZxMUtuNHYvL0pQeEUvK1M5L01yNzNlNzgzWHZ2YTErYmFiaDRkTVg3NmExSFBBVEM1cVBiL3hFZWZpSC80Z1NmaS9mTmhYTzV2VytzTXBEMkc4bmVrUm5aa0RZemsrdk5GVEhjdVNRZjBZbmRyVzlwTmpWa3NZOWdadU1PanZxeUgxVGg2WXREcmFPREVvNjlhcEFkVnBoTjlwWFdsR1FlcVlhQXdkRjJWazg2VXBZRmJLZHlWMzFFSzRVNklmY3lVdmxRYW1DZ0h2VWo2WEpVdU5DR0ZEcEo1OXRWY3U1bmMwbnpGVXhuVU14ZHZOZDNsVjhzT0F5b2lGV0p5VjBteE1jUk10aUcvRFBsS080TGhOQTJlMHZFYldvV2hkZmtjVHJTMFc2QjlTdXVxRGFZVHZ4UlhqMDNic2I5Y3FoNzVmdE5OdXd3TGpIVGxtazJ6RUV2YjVNeUhIVWt3cmNMcnZIVzdBT1hYZWZKeis3dTVudEtuUkpQNUNHNFhhTlBRcVV5ckRkQitLcGZiN0x6VUxtYVJkcGUyZWFZei9ZcTI1M2wyWGk0dktXdG91cVZOcnJlMHNmQVNXQWd1TDE2bUtXM0xOTXl6Q1VvODhYR1lMcG8ydVdiK1Nqc29ScnBvNkFOemlPVzluREZYaXhoSzJHZlF5cXFlVENadXkyZzRpR0YvSUdVeGllT2pJOG1Ga3FVa2RyWjM0czIvL1MzeEhkLytKK01ydnZ3cjR2U1owK0toOFJHLzU0TG5UU2tVd094UTduMVhEdUx2UHZUeGVOL1Y0N2cwVzhnRXd0d1pSTDhyYzJBbGdaWTd2VDJOQlpwUStVelFicmNmcDRaYk1SS3RMS09ZRHFkVktUaXR0YWhNUzdzRjJxZTBxaFFTejVlYVVvQitQdGNZeUdkTk16K0w2VXdrT2o1cnMxeDExRGVLYUFQdDliWEFSWGQwK2FJU0lzN2RkVmU4OHQ1WHhCLzlwbStLYi9yRGZ5UmVlZDk5WWlnZTVueDdlTjZWUWdIRHc2UWNhangvZmY5YS9PU0Z4K05ucmx5T0MrTk9qTHJic2RNWnh2RlVKbzg2MjVjYmFsQzIxYVV0TGV3dGpYMFBaZEhYWUZTbFlGZVZRbTZ6ODFLN21NV1hzbExZSG81aVBCN0hRdFpCVndWWXY1U0pQQzdUNmRnV3cvajRTRlVzNDlUdWR0eC8zeXZqYTcvbXErSVBmdTNYeFJ2ZjlFYVY2ejVuaStCR2VNR1V3Z2JvcDd6RCtTb2VPanlPWDN6eXlYalh4YWZpZUhGT1NtTVpoeXRweDJGUHJaR2dLNzZuOHhIQ1BwcE9xbEp3V210Um1aWjJDN1JQYVZVcEpKNHZOYVdBaFV6Nys5MWU2SDhxVDUwYWw2bU9CVElSWWxkSGc3dGxGWHpEMTMxTmZMT3NndGMrK0lEV2V1OTVWd1J0ZkdLVVFndFVSbzBJMlpPVFJUeHk5VnE4Ky9FTDhjaHNHdnM2V2x5VDR1aDJoektyc0JiMFI2TmJsSUlNcXFvVVRFdTdCZHFudEtvVUVzK1htbEpnN1FKb3gwY0hNVHM2OXNYaCtmTm40b0g3WHgxZi83VmZGVi8zMVY4VnIzN1YvYjZRekxXOTRQaUVLNFdUb0hhV3hvSEcrMFBYanVMWEhyOFVUeHd2SmJDRE9Gckp0UExDMWZMVkFNOTBwT2lxUUZFS1BJTHBhMkNyVWtnMFZTbVUrdVJvZTU1bjV4Vmh6TFM0VDdaU1dFM256YmpmY2ZaMHZPTnpQemYreURkOGZYemU1N3cxenAwNW8vbEtmZnhFNDVPdUZOcG9Ca3YrWEtiQ3c1TENEejU1TVI2OXRCL3ovaWptZzFGY2xYWEJVaHFNdG1Pa284aXlKK1Z4ZUJTbmRuWjlMaHVQajJKN3BIT1l6bXFYZHN6T2w1bSswQ1FzM3ZEbkltY3hsbUJMb1V3MCtoT04va3ppaE9DdldFeTRtWTR2ZzM1TTFSYWVKVXNieVYvRVpEN1R5SFdsQ0xhc0ZGQTBLQVhXSVVxaHM1TENFdmxpT1hHZDFNZUNNZkpDQWJldkZLUU9sSTR5TkYxZThHdWxrTXErY0VvaExkbDFYcTVYK2FDN1NFcXA5S25rMlJlNFVBTXByL1EvdDAxcHlHQXF2K2JkMEZKTzdwbVVBaW5NZzh0a2djWTBaODlsTEdhem5wS3lZTUtQT1JUVHBjcVNOdEw4bUQrOFZiL0wwWDRwQzliVGFDbWJINzc4VmJtRmVNOVpaeDNSYW1lZktvLzdBc3B3UkZqSkdwNGQ4ZTdPS3M2Zk94ZWYvV212aXErU0pmQ0Z2Ky8zeGF0ZTlXby9tZ1JwVkQ5NWVGRXBoVGJTSktkbGk1dG83QzlQWi9ISS90VjQvT2dvRGpWSnZiRm9OSkRIRXRydWNDQ2FaVndlSDhkTUUzRDErQ2oyOUcraExkNjdPWXRBakRSRnNqam1NZEY1Ym11a2RDMFU5bk9VdzFMQ3pFTDMrcHd2NHVMV1NKTXJwVENidVV5blA5REU4ektKNnVhWnN0cWpkZDhvaFdJcEZLVXdYNHpwU3VvTEN4SjRVYWR3VlFvdnJGTG9JSWdTWU9aeXFUSUlkWTk1eWtJOTZQVk5XeFJER3BmRUd5eW1LaVBoNXZpS01rSEFsNHVaanJGSnFaRG5jcHBIK0NqcXZQbGltcDRxc0dhZ0V3M3BEN3p5dnZqeUwvcWkrT3F2L0lyNGJXOTRmZXhxOHhLQmNsNWNlTkVxaGV1Q3RaR0RCTFRSeDZFbTZva3IrM0h4NkRBT05kRThEcDFKZUs5SUtReG11ekdlNlNpaTJib21BYm9pYzIzVzZVdVcrbkVzcmQwZFhKT3hsNDRKY3lrUEd4TVNiQlp6RC9xQndxTDNJbU5oU05nbm1temVQdk5PMDhzS0J4NVpLZmlVYU9WUWxjSW5XeWx3SEdTSGR2OVVCcVhnSjN0U0VuNkRjTUZiZ0NnS3hqR1ZSVUV3bnFRdit6c3hQUjc3UFFGNGo3U3VUS3QyVS81NGVoakQwY2pIMmVWRUc0VFdZazk4YU5kb09JelgzM04zZk5tWC9QNzRzdC8veGZGYlAvM1RZMmQ3eTNrTXU5aS9hUEhTVWdvbjRLWXp1dlFnZTNQOXVhWUordmpsSy9HKytkamhaVmZIQ2EyQnk1ZVB0Q0lHc2J1MXF3WFRpYWZHKzNFcytubS83L2NvSmxvc0N5NDZWejAvNnJtd08vYU9NbU8zVVQ1TGNUSDMwb3RlZDJBcjQzcEtvVmdLcy9teFlxbWRYdVRBaXpxRnExSjRZWlhDWFBPR05jRDRUS1pqSzRPQkJKaTVZVjU3ZzdUVFl6bGdBWmdIYldXY1JEUFRic0hMZFZpRjdQcHpXWWE4WWNpOUZqVGp5VlZabXlPWXhZNDJtcmU4OFRQaXE3NzBTK1AzZk43bnhhdnZ1OWN2R3pIRUwyWUZjRDI4cEpYQ0RhRWUwU2t2R2prWkM3SFBIY1dWSy9HaHc4TjRVZ3ZzeW13U08rUGRPTkRpT2RCQ094VDFzUXBNVkhDaVJYS3M5Ym8zbnlaRm9jWGY2NDk4d1Noanc4Y0ZXdzNkMmRPVVFqMCs0TDg0bEFJc3NBNDRQc3dsOUlTSE1oWFk3U25IaHBES3E2OWk1bkZVbTFBZXlvamhhcHJMVHRPN0JNb2ZxUHpaVTZmaVZmZmVHMS83cFY4WW4vUFpueDF2K0xSUGk3MmQ3VWFadUdFdllidzhsY0oxNEU0eTZUbk1zcnFtd0pPUy9nOWR1aHdmMGhIa0tabUVSMW93VTgwcWlxRzMyb2xyeDVPWWNyVGc3a0lXeE5HaUs1Y3VGd2VkU1doL2NWaDdpQmJVV2ltd0lsLzRwdzlWS1R5VFVpaDNDcFRweWtLdzZTL2xNSnRNMDNzQUErM3k0bXVlVmdUejZNZzZnQS9IanRQZGNady9jeVkrNDdmOGx2ajh0NzAxM3ZiWmI0a0hYL1VxV1pvaktSSFZybWE5MUt5QW04R25qRks0SVZodjZ5RHJNQ1l5TFE1MTdQaTE2U1ErckdQSXg2NWVpMHRLdTZ3RnRpK2k0MDQvcHZKN3M1SDhwQlFtV2x4TEtRdUdjNGt3c0tnN2FkR1Q1a1VPdktoVHVDcUZGMVlwZEhWMFlOYzNMMjNoN1BZTFdZaTJHSFRtNytqNFNKODVEcHpiM1luUGVOM3I0dk4rNSsrTXQ3N2x6UkwrKytPdWMyZWtTRlJMUy9KZmhqcmdhYWhLNFFaZ1VEQUYwK0Jva1drNWNGOXhKTVZ3UlFyanlhTkovT0RqQi9ISTBUU2UwcG5pU0F0MUpzV0JNbGpLWXNEblBZcW1OQXNUeUxmQ0lDaWx3SHNQUzlJYW9haEtnWHlQd1cwcUJlNFVpcVdnSHZyZGxsZmVmVWY4cnM5OFUzejJtMzVidlAyM3ZUYnV2Zk91T0wyeks4dkFWOFJ1QTByZ1UwSDRiNFNxRkc0REd3T25ZWlNoNE1lVjQvazhEcWV6K1BWWk56NTY1U0ErOU5UbGVIVC9LUFpucXpoWTllTkkybVdzeGFyRGlGL0lta2w0T3JJKyt2MlI1TElUVXo1QUprVXo2cWM3Q2NBMExZdlFaWFFPV2V3cHI2UzN3MXVkcTM0MGhpT0ZSMmk4NVZWb09yUDFSV2pibFRRK2YzSXlyemd3VUI5QVNTdktwcVR4cVRicWxuUktlbm5SckNNRmhrVWx4YVMwcVQ4Snl5TEVTYm1KSFM4VVFVUDVJMFFUM2xLZXBQc1JuM3c3Q2ZsOGZDbUdzZ1k0Rm5Ta1lMWjF4SHZOUFhmSEcxLy8rdmd0cjMwZ1B1ZlRYeFgzM0hXM2pnQm4vVFFBcFFpS1gzRjlWS1h3QW1BOW9JU2V2Z0FaY1hKNGJ3TGxjQ0N6OW9yT3VSZkg0M2p5OENnZVB6aUlKNjhleEs5Y1BJNERLUWNlZy9KU0REc2Y3MHNnZkR4dW0vVW1VaFNid2xxbUUzODRTNDlUUVVjS0FhVXdsOEF0eEE5M2ZxNHp0WUNsQWsrL3JZa3ZCL3lhdVhBOTNxQTdPN0ovby96VlVIS3N2dkZ4WUt3Q2xBSXZBWEh2UWgzek9FNVdEcnM1dXovUGhrV0hraGgwTzNHS1I0QzlWV3pKditmOCtYamQvYStNVDMvZ05mR2ErKzZOZSs4NEg2KzY0NXpQOThOKzMyZjhwOGs2N1ZEYXAvYStmK3VvU3VGRkFJbFREb0ViTEdDVHJPa0lvVlQ0OWg0ZW1mcjlpY1poZlN6aXlyd1RFd25rTWMvVXBYU3VIUi9INWF2WDRzbkwrL0hVdGF2eGZna21MMzVCejV1YUMvRkpDaWNyaU1uNjZVbEJPOXlaSDJ6c3VvMHlrZklaeU4wLzZjVE9hQ2p6ZkNmdVBITTY3cEVnMzNYMmJKeloyNVV3RCtOZW5lTzM1ZStNUnJFbE92elJRQmFUckpuckN2a0pWRkYvWVZDVndzc0YxNW5GZk9TL05kemlhcmllNERZcjZ0bUVHcm9xMlM4NlZLVlFVVkd4Z1h6bFdsRlJVUUVpL3YvSzNJRU9MM2U1T3dBQUFBQkpSVTVFcmtKZ2dnPT07Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjQwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHdpZHRoPSI4My40NSIgaGVpZ2h0PSI5NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMyIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTEwOSIgeT0iLTkwIiB3aWR0aD0iOTM0IiBoZWlnaHQ9IjU1NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iIiBpci5zb3VyY2VTdHlsZT0iZ3JvdXA7Zm9udFNpemU9MTQ7IiBpZD0iNzAiPjxteENlbGwgc3R5bGU9Imdyb3VwO2ZvbnRTaXplPTEzO2NvbnRhaW5lcj0xO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBjb25uZWN0YWJsZT0iMCI+PG14R2VvbWV0cnkgeD0iNDkiIHk9IjM0MiIgd2lkdGg9IjcyNCIgaGVpZ2h0PSIyMDQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IiIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEyIDEyO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzY2QjJGRjtmaWxsQ29sb3I9I0YwRjBGRjsiIGlkPSI2MyI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7ZGFzaFBhdHRlcm49MTIgMTI7c3Ryb2tlQ29sb3I9IzIwQzlFMztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jNjZCMkZGO2ZpbGxDb2xvcj0jRjBGMEZGO2NvbnRhaW5lcj0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3ZlcnRpY2FsQWxpZ249dG9wO2ZvbnRTaXplPTE0O2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI3MCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB5PSIzMi42OTIzMDc2OTIzMDc3IiB3aWR0aD0iNzI0IiBoZWlnaHQ9IjE3MS4zMDc2OTIzMDc2OTIzNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNzMiIHZhbHVlPSJTaW11bGF0b3IgU2VydmljZS4gUHJlZGljdGVkIGFjdGlvbnMsIGUuZy4sIGJ1eS9zZWxsIiBzdHlsZT0iaXIucmVmPTQ0ZmZiZmZjLThjYWEtNGY2NS1iYmU5LWEzMjdmYWE1YzhlYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd09TQXdMamcyTmpRM01TQXdMalUyT1RNek9DQXdMamc0TXpNMk4wZ3dMak00TlRBeE9VTXdMak15TVRVd055QXdMamc0TXpNMk55QXdMakkzTURBeUlEQXVPRE14T0RjNUlEQXVNamN3TURJZ01DNDNOamd6TmpkV01DNHlNekUyT1RsRE1DNHlOekF3TWlBd0xqRTJPREU0TnlBd0xqTXlNVFV3TnlBd0xqRXhOalk1T1NBd0xqTTROVEF4T1NBd0xqRXhOalk1T1Vnd0xqWXhOVEF5UXpBdU5qYzROVE16SURBdU1URTJOams1SURBdU56TXdNRElnTUM0eE5qZ3hPRGNnTUM0M016QXdNaUF3TGpJek1UWTVPVll3TGpZeU1EWXdNVU13TGpjeU1EUTFPU0F3TGpZeE9EZzNPU0F3TGpjeE1EWXhNaUF3TGpZeE56azRJREF1TnpBd05UVTJJREF1TmpFM09UaERNQzQyT1RBNU9Ua2dNQzQyTVRjNU9DQXdMalk0TVRZek1pQXdMall4T0RjNU1pQXdMalkzTWpVeUlEQXVOakl3TXpVeFdrMHdMak0yTlRnMU15QXdMall3TlRRMVF6QXVNelkxT0RVeklEQXVOVGc1TlRjeElEQXVNemM0TnpJMUlEQXVOVGMyTnlBd0xqTTVORFl3TXlBd0xqVTNOamRJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTNJREF1TmpNME1UZzJJREF1TlRnNU5UY3hJREF1TmpNME1UZzJJREF1TmpBMU5EVkRNQzQyTXpReE9EWWdNQzQyTWpFek1qZ2dNQzQyTWpFek1UUWdNQzQyTXpReUlEQXVOakExTkRNMklEQXVOak0wTWtnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqWXpORElnTUM0ek5qVTROVE1nTUM0Mk1qRXpNamdnTUM0ek5qVTROVE1nTUM0Mk1EVTBOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk1qYzFOU0F3TGpjMU1USTVPVU13TGpVMk1EUXpOaUF3TGpjMk1UWTNPU0F3TGpVMU9USXdOU0F3TGpjM01qSTNNaUF3TGpVMU9UQTRNaUF3TGpjNE1qa3dOa013TGpVMU9USXdPQ0F3TGpjNU16Z3dOU0F3TGpVMk1EUXpPQ0F3TGpnd05EUXdPU0F3TGpVMk1qYzFOQ0F3TGpneE5EZ3dNVU13TGpVMk16YzJOQ0F3TGpneE9UTXpOU0F3TGpVMk56VTFJREF1T0RJeU56STNJREF1TlRjeU1UYzJJREF1T0RJek1qUXlUREF1TlRrME16STBJREF1T0RJMU56QTJRekF1TmpBd05qWXlJREF1T0RJMk5ERTBJREF1TmpBMk1qa3lJREF1T0RNd01EZ3pJREF1TmpBNU5EazFJREF1T0RNMU5Ua3pRekF1TmpFeU56TTBJREF1T0RReE1USTNJREF1TmpFek1USXlJREF1T0RRM09ETTVJREF1TmpFd05UVTFJREF1T0RVek5qYzNUREF1TmpBeE5qSTFJREF1T0Rjek9UWTJRekF1TlRrNU56WTNJREF1T0RjNE1UZzNJREF1TmpBd056Z2dNQzQ0T0RNeE1UZ2dNQzQyTURReE5URWdNQzQ0T0RZeU5qbERNQzQyTVRrNE5EUWdNQzQ1TURBNU16UWdNQzQyTXpnMk5qWWdNQzQ1TVRFNE5UWWdNQzQyTlRreE9Ua2dNQzQ1TVRneU1UTkRNQzQyTmpNMk1qa2dNQzQ1TVRrMU9EUWdNQzQyTmpnME5EUWdNQzQ1TVRnd01EUWdNQzQyTnpFeE9UTWdNQzQ1TVRReU56Vk1NQzQyT0RRME5qZ2dNQzQ0T1RZeU56SkRNQzQyT0RneU5TQXdMamc1TVRFek5DQXdMalk1TkRJME9TQXdMamc0T0RFd05DQXdMamN3TURZeU9DQXdMamc0T0RFd05FTXdMamN3TnpBd055QXdMamc0T0RFd05DQXdMamN4TXpBd05pQXdMamc1TVRFek5DQXdMamN4TmpjNE15QXdMamc1TmpJMk5Vd3dMamN6TURBNElEQXVPVEUwTWpjNVF6QXVOek15T0RJNUlEQXVPVEU0TURBeklEQXVOek0zTmpNM0lEQXVPVEU1TlRneUlEQXVOelF5TURZMElEQXVPVEU0TWpFMVF6QXVOell5TmpFMklEQXVPVEV4T0RZNUlEQXVOemd4TkRVNElEQXVPVEF3T1RVeklEQXVOemszTVRjeUlEQXVPRGcyTWpnNFF6QXVPREF3TlRRMUlEQXVPRGd6TVRReElEQXVPREF4TlRZeElEQXVPRGM0TWpFeUlEQXVOems1TnpBNElEQXVPRGN6T1RsTU1DNDNPVEEzTmpJZ01DNDROVE0yTVVNd0xqYzRPREl5SURBdU9EUTNPQ0F3TGpjNE9EVTVNeUF3TGpnME1URXhOeUF3TGpjNU1UYzNNaUF3TGpnek5UWXhNa013TGpjNU5EazFNaUF3TGpnek1ERXdPQ0F3TGpnd01EVTJJREF1T0RJMk5ETTJJREF1T0RBMk9EZzFJREF1T0RJMU56RTRUREF1T0RJNU1ERTBJREF1T0RJek1qY3lRekF1T0RNek5UZzBJREF1T0RJeU56WTJJREF1T0RNM016UTBJREF1T0RFNU5EVXhJREF1T0RNNE5EQTRJREF1T0RFME9UZzJRekF1T0RRek5ERXhJREF1TnprMElEQXVPRFF6TkRFeElEQXVOemN5TVRNMklEQXVPRE00TkRBNElEQXVOelV4TVRWRE1DNDRNemN6TkRRZ01DNDNORFkyT0RVZ01DNDRNek0xT0RRZ01DNDNORE16TmprZ01DNDRNamt3TVRRZ01DNDNOREk0TmpSTU1DNDRNRFk0TlRJZ01DNDNOREEwTVRWRE1DNDRNREExTVRVZ01DNDNNemszTVRVZ01DNDNPVFE0T1NBd0xqY3pOakEwT0NBd0xqYzVNVGNnTUM0M016QTFNemxETUM0M09EZzFNU0F3TGpjeU5UQXpNU0F3TGpjNE9ERXpOU0F3TGpjeE9ETXpOaUF3TGpjNU1EWTVNU0F3TGpjeE1qVXdOMHd3TGpjNU9UWXpOaUF3TGpZNU1qRXpNVU13TGpnd01UUTRPQ0F3TGpZNE56a3hNU0F3TGpnd01EUTNNeUF3TGpZNE1qazRNeUF3TGpjNU56RXdNaUF3TGpZM09UZ3pOVU13TGpjNE1UUXdOaUF3TGpZMk5URTNPU0F3TGpjMk1qVTROaUF3TGpZMU5ESTJNeUF3TGpjME1qQTFOeUF3TGpZME56a3dPVU13TGpjek56WXlPQ0F3TGpZME5qVXpPQ0F3TGpjek1qZ3hOaUF3TGpZME9ERXhOeUF3TGpjek1EQTJOaUF3TGpZMU1UZzBNa3d3TGpjeE5qYzNOeUF3TGpZMk9UZzBOVU13TGpjeE1qazVNaUF3TGpZM05EazROeUF3TGpjd05qazVNeUF3TGpZM09EQXhPQ0F3TGpjd01EWXhNeUF3TGpZM09EQXhPRU13TGpZNU5ESXpOQ0F3TGpZM09EQXhPQ0F3TGpZNE9ESXpOU0F3TGpZM05EazROeUF3TGpZNE5EUTFPQ0F3TGpZMk9UZzFOa3d3TGpZM01URTNOQ0F3TGpZMU1UZzJPVU13TGpZMk9EUXlNeUF3TGpZME9ERTBOU0F3TGpZMk16WXhNaUF3TGpZME5qVTJOeUF3TGpZMU9URTROQ0F3TGpZME56a3pPRU13TGpZek9EWTFNU0F3TGpZMU5ESTVOU0F3TGpZeE9UZ3pJREF1TmpZMU1qRTNJREF1TmpBME1UTTNJREF1TmpjNU9EZ3lRekF1TmpBd056WTFJREF1Tmpnek1ETXlJREF1TlRrNU56VXlJREF1TmpnM09UWTBJREF1TmpBeE5qRWdNQzQyT1RJeE9EUk1NQzQyTVRBMU5ESWdNQzQzTVRJME56ZERNQzQyTVRFMk5qZ2dNQzQzTVRVd01UY2dNQzQyTVRJeU5ERWdNQzQzTVRjM016VWdNQzQyTVRJeU16Y2dNQzQzTWpBME9ETkRNQzQyTVRJeU1qWWdNQzQzTXpBM01EY2dNQzQyTURRMU1UZ2dNQzQzTXpreU9ETWdNQzQxT1RRek5ERWdNQzQzTkRBek9UbE1NQzQxTnpJeE56WWdNQzQzTkRJNE5qVkRNQzQxTmpjMU5UTWdNQzQzTkRNek9DQXdMalUyTXpjMk9DQXdMamMwTmpjMk9DQXdMalUyTWpjMU5TQXdMamMxTVRJNU9WcE5NQzQzTkRjNE1ERWdNQzQzT0RNd05qRkRNQzQzTkRjNE1ERWdNQzQ0TURreE1UY2dNQzQzTWpZMk56Z2dNQzQ0TXpBeU5DQXdMamN3TURZeU1TQXdMamd6TURJMFF6QXVOamMwTlRZMElEQXVPRE13TWpRZ01DNDJOVE0wTkRFZ01DNDRNRGt4TVRjZ01DNDJOVE0wTkRFZ01DNDNPRE13TmpGRE1DNDJOVE0wTkRFZ01DNDNOVGN3TURRZ01DNDJOelExTmpRZ01DNDNNelU0T0RFZ01DNDNNREEyTWpFZ01DNDNNelU0T0RGRE1DNDNNalkyTnpnZ01DNDNNelU0T0RFZ01DNDNORGM0TURFZ01DNDNOVGN3TURRZ01DNDNORGM0TURFZ01DNDNPRE13TmpGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj0xMiAxMjtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI2MyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3OCIgeT0iMTAiIHdpZHRoPSIxODkiIGhlaWdodD0iMTE3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI2OSIgdmFsdWU9IiZsdDtmb250IGNvbG9yPSZxdW90OyMwMDdmZmYmcXVvdDsgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5TaW11bGF0b3IgRW52aXJvbm1lbnQmbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjcwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii04IiB5PSI2LjY2MjQ5Mzk4MTcwNDM4MDUiIHdpZHRoPSIxNTQiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iTW9kZWwgb3V0cHV0cyIgc3R5bGU9ImlyLnJlZj1lMjQyMDA5MC05ZGViLTQ5ZGItODc1OS02MTM1NGE2YzQ3ZGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktTU9ERUwtT1VUUFVUUzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49OCA4OyIgcGFyZW50PSI3MCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTciIHk9IjU3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iTW9kZWwgb3V0cHV0cyAtPiBHZW5lcmljIFNlcnZpY2UgUHJlZGljdGVkIGFjdGlvbiwgZS5nLiwgYnV5L3NlbGwiIHN0eWxlPSJpci5yZWY9MzAyY2NjN2YtOWFmNy00NjQzLTliNWUtZTUxNzU2YjM0M2M3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDA3RkZGO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7Zm9udFNpemU9MTQ7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7IiBwYXJlbnQ9IjcwIiBzb3VyY2U9IjkwIiB0YXJnZXQ9IjczIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI1MDgiIHk9IjEwMSIgYXM9InNvdXJjZVBvaW50Ii8+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjM4MiIgeT0iMTIxLjE2MzYzNjM2MzYzNjM5Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAwIiB2YWx1ZT0iQnVpbGQgYW4gQXJ0aWZpY2lhbCBJbnRlbGxpZ2VuY2UgbW9kZWwgLT4gRGVwbG95bWVudCBTZXR1cCIgc3R5bGU9ImlyLnJlZj1lYjk1ZTYxYy04YjMyLTQ5NGMtOWZhNi0wMTg1ZWJjYmM1YjE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjc5OTtlbnRyeVk9MC4wMTk7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijc5IiB0YXJnZXQ9Ijg3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQnVpbGQgYW4gQXJ0aWZpY2lhbCBJbnRlbGxpZ2VuY2UgbW9kZWwiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NTC1BSS1NT0RFTC1CVUlMRDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iNzkiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1mMjg4ODc4NC02YWJjLTQzYzEtYjdiYS0wNzA0ZmE5ZmE2OGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktTU9ERUwtQlVJTEQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0ODIiIHk9IjUwIiB3aWR0aD0iMjc3IiBoZWlnaHQ9IjExNiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSIiIHN0eWxlPSJzaGFwZT1pbWFnZTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsQmFja2dyb3VuZENvbG9yPWRlZmF1bHQ7dmVydGljYWxBbGlnbj10b3A7YXNwZWN0PWZpeGVkO2ltYWdlQXNwZWN0PTA7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQU9FQUFBRGhDQU1BQUFBSmJTSklBQUFBZ1ZCTVZFWC8vLzhBQUFCMWRYV3pzN01sSlNYWTJOajgvUHlrcEtTR2hvYUtpb3F1cnE3ejgvUDI5dmJ1N3U0M056ZmQzZDJVbEpUbTV1YkV4TVNhbXBwOGZIek96czdVMU5ScmEydnE2dXFnb0tBdkx5Kyt2cjZQajQ5a1pHUnZiMjhSRVJFL1B6OVNVbElaR1JsTVRFeGFXbG9ORFExSFIwY2dJQ0JJU0VnNU9Ua3FLaXBwa2l5QUFBQVhXVWxFUVZSNG5OVWQxMkx5dks2c0FJRVFDSnV3Q3gyOC93TWVobVRMTTNJUyt2MUhkeTFPWXRuYWt1V1BqM2RCTk84MmorZHI0N3JaVGJPaFpjQXdtKzQyOTkvUHgyWjNIcjF0SHUrQ2JOOVFZSmRyT0dRN2RjQSsremNUTFFueGI4T0FVWXNNeUk3bWdOLzRuODAzRk9ZM2Mvb1BPS1l3WUxpekQ3ak4vK204dVJETjdOTi93R3VYMHF0endPei9nQjhuRnZxVDBMK1BtUHNHSENmL0dvRWlTSDNUdjBPdmNFUmEvSkYvQ1FzNjEwczhUNktQWk5GYWtuOU9DWlB1V292a0kwcm04WVUrdHZqWFNQaUE3TTl0bmNqL1I3RXBmSzdqZ1J5UVRMLy9MM1p4Y0paYnBZbU1xSzhoZUZxcEE0WmI4ZE41OFBGZmhSUE9zVzNaaGx4QmNHY082SWoxdWJ4L3FseUlCcE1zei9ONThyVEsxbUovckRLZm9uaXl2dTBUZis0Ky9od204L3U3czhuZ24ybVFZVGFUbXVIVXl6cmU2ZCtCRUtwREp3Z2k2R1E5Z1c3ak9MUGF0ZStHWkV0a2d3SWoxNXBING9tZWE0VEYybnZDOS9iUGVYUHNtTW9kVnM2SHVqakVLUzFYN3RkTzM0S0hDMUtINWZtQWx2dXhBZTZ5ZTBqdWZ2SG1EN1ZJeXowTkp4TStBY2gwNWhuaU1NcWZrTmVNaHhQV25razRXWXhPMytjbVRYd3YveVAvS3FiZi9QN2FMUysvWitZa21xOHhIa0ttbTNqK3ZTeDNQNHBBOHo1WkZ4RFg0S3NMckJHbHdyVDB1bmdjREdFVEwzRUtNam50ZnNsUC9vSFJLaTJ6alJwMzJMeisyL0U5ek1Id1k3Sy9mWFpWZ1p4dDhLUHQ5MnRHRVgvWmF6K0FlUFVLUEJhR3ZpZjlVcW9XRURRNjFuOFpNY2lvUElaU0FYdUpwQVk0T3BmeTlQckJHektyZ09GSEQ3NzhXZVpoUHFDSGV6Ui9ndkJNMS9kNEZRekY0cjVYOFNNWFdpem42ZXNYcjhhdmhDRnF5cmR5NHVEZy9naHVyOXNzcllnaFVzbjVuZUlVNVl6TitSbGNpNmRmaE9IUTYwSGdKcjR6cXRyelVlS3ltQkc5R0xaMm0vTzUvYlYyRXdFSXMzN0lsQVBoNGtOaVhpd0lQQmdTWTNlWldINS9BSGhmYnd4eURFR3JPMVRTazA4TVBVbkJpV0ZDRExPR1UrVkFGT0gyUGtaTVhsKzR1dFk0bjgzOEdTUVhoZ005WG1DbjR3UUVuZXY3MVFFdzNKUitnUU5EUy9EQ2JocHQzb3JoTU9rQUgveVdmb2NEUXoyV2VvZTI5WGxZaWJpVDFFMm9nM24vSW4zQXVqRzBCbWVzZnFiYzYrOUxmMTVmY0dxK095c2ZyMHlsMDdSRElFV0w4OXdhREJZbjMwYzJ5anpPeTNyeXhyRVJOVHlVNW9PbS9pcGw0WWJLR0l2V1NjNzZNOS9WNHhyWlJuL3BIY1BTNU9IRkVFeVZDR3dqeS82Z0xGWFdwZG8rRHZibUs2dG9YQytHMmlDYldYR3hQZGVzSUhWU3k1bzFxZ2hyRm9iQWxyWUljR0o5OEZ3NmI2eEZaOCsvbDJhdnYyVTRCcXU0K1NUdTc5MjZvNFQ0dlJqaVNOZ29PNGUxdHYxZVV3bnVQYUFrcFNweDMwdmNZWExmTVA2a0QyN0daTXU5R01LbVlaYlY2MEVNT21yZXVGU3NPSlBQWHozMnZnN2R0akYxdWV1QVlmdDNST0QzUU1kTlVIUVhMdWhxVFdvNlNuaFVKUGJzTmFaVlNLM0pJeUg0N1JwZkVNdFhOeFlwZjVZNEkvbWhZRjZNaEpZSXFmOVF3dUVTdHZpN0hjUElvcEdZb1Y5WjI3SUp6YU9pbmRGWXVrWjBGb1pNN1ZsbStnQ1J5M0RZcFphRWsvT3pPaXlOai9CQTVIT2JqZ0hKVDhNUWQwNDVrbWtqREhGc0xFMUFhRnVVWUlVRlVuSHpuVXY1YTB3MUlzTHRNTXNuRDN0OXZWRlh5ZWtCYTR0ekMxRzV1SXZIZ0dlRUhIVW1ySEdQcFpUdXlLVHByU1VmeTVwTElzbmRVUXdsWTdjTHNsSUVHNGRvUll3cE9HTXVRcFhNWGtJOUlYVG1xYjd6eEdrbWd0b3VvZm9iTmVnWC94RU1mYnBqcjBPSlVMUFZVclJ2NldoaWxLMzd2V21yaEUySWk4UG5ST1FLajlMdE5oeFFPWDlZQXJBK2dCME5INEpaNHBXL2ppcFN2MjFSQ3NOSko0L2p2T05UeThBamJBbU1ST3BQZ2RoMFE1RjFFSTVodWhVNi9iaDFUZ2c1a1pzaGhocTZuNEpoVXdQQndtQjBLSWFwVnBseGN1SDQ4L3A5Ni9oWkI1QWJoU1U2SFRXTWV5bG05RUFNTFRaU3p5Nm9ZYldadm5uRTMvTDhKRDdkNUZCSUVJWmFIQnhwMVNwcmtiRjR4bWtTTWpySnA3MW1mejNuOFhnSWhpdlREWHVDTmVLT3U4SlROYUROYjZ6QllSQ0E0ZENJcXlGWUEyRmdVZkdNaFRpSXBvTWdBRU5pUkl4MnplWnVKUCsyemN3Yit0QUJUTVJBYjRUQXZKWE43VUVCUG9iUzA5eS9RajFSUjZvbkN4NGdsTmFzQ1lKY0tsdnRPSGk1SFp1cGhaallHR0k2dlhFbEFub2hZdE1tMXdkTkdrSUQzcUlLRDBqeTZoazRzakZFVjJPanZHS0kydC9VZTkwUURLY2hHMjdBb0NIaFc3Zmh1QmlpUTNUVmJDUjgrZFY0WWwwQ1E2NTlvSUVhdE5WdzRXS0k2czFnT0l4M0dPYnZObVJiWU1OZDhZc0NpTlJ6VHlveVhBeGhrVVVTTVJLNkdkNXVpTUY5Q0d0QmNDL0FuMVJBT1JpaytXeGNESUdYSVl3NXVEL1dCRjBPMUdpVWZoMlpiNlpUUExBR1cyQzFiZTVrclBaSWYrSmllRkJvOGFrS2YxL2JDRjZFRVRzOFdOYlRDZWkvOCtQY0prUzVDTnRRWHVKaUNJKys5aTJuRDBHKytLeVpaeGkvNWhtUEVSaUVGUk9zd2tVbS93dkU4TFZSUUpndjF3eFNpRmR0K2RIU1pJYUZnV3VyVnNoaDdwSEl2YmZ0SVN5blh0WHJBbGcwWnlpUkNXanZFN2tYaUNHc3pZWnducDBQVVg5eXJaVFFtSUFMUU9hVDh5TmNERSt2Y1NoTDc1Nyt6aXRMc2FLUVhYb0tybWRKalNnQTJKOVVTM0l4QktLekZOVWNLVk1LZ0xBM1Y4R2xZN1J3SzlZZW9ZMGxwUUt2Vm45c2xjTlBRSnRHbFlJb1NiLzduRTFja09BUEpldDVIb3d2T3JIU3VHUmdtSjNrOXcxL1hnU2kxWCtUbE1DbGlMVlMrbjRpSTlMSFpELzF6ZzhGTURDbUNSZzZjOUlUdmY1cnBDZzRsMitoeEc2ZDhiam5HN1FQQ0NKQldYV1lodVJNZ1A4Sk53R0d1MzdQQm4xTE1jbU5XQ2tkNGVkcnM5RGltajNuSkR2YW1UdFp4eW5TaVkxMlFCRVM4RCtwS1BaV0tqaGdCamltY3FkMHBhQVhvV3djeHB1ZW9tNUs2cUxXOUNjMzY0M0xRdVpUQnNQN1NpLzcvUjFaZmJNSWU2VlhObG4zUVFtL2pzYUtCelpRT2xud0RQZ1ZQa09rQlcwOTRJV3ZPSEVFRSs5a1pFMFlMY1lqT3NnU2ZxY0lMZzJCcEo2cDVOaHpHU0pJSTJQV0lqSURyay9DbkRoUVBEZzlnZ1Y5dmVGQkVobXp0SkZoUnlHd2drampJQ1hCY0NyYU9GVDYwNEk5V2xrclZ6WStsMmRDUHFEdG9rd0gzbHdLSllySm92cE94cWhIVEpVUEZXUFlvd3RpeWVBVmtjOUM4cXZDaXd2ZUcySVpoM2J2b25yS1d6VWdBY05tMXdHWnBuQTdtdjQ0TVR4Y3VTeGs4RkFnWG1DY2sycE0xMUlNbFNtTlZLa1Fuai9zOUlRQUdmVjRIcnlnUitLQUNDWXMvclJVS1E3RnFPaW1vNlo3eStTQW95VHJydGZkTEdFYlZFSXNpbkkxMFhPRjQxN0pZOEIydlRna2lzVUlTTDRwajY5RHJFOFJpWjNuMUF2NzVtai9YUkJKMDF5Q1A4SlE4Q0lVUE9HVTdVY2NUQkJpeWJIbHJWSGplcHhacTBiK0NzTVBGUHN2eVd5SnAvZ0I2ZnpxcWthSlhDenpaeGdxRlVGNG5vTmREU2lKSVBpWVhGMFlEaWJ6Zko3Nkd0ZUFmZmpNcHVLT0JKVDJZY0VOTXp3cG9SWU1PMzBzc3o3Mm5QNHVMYndEbjk1N2ZsY0hYSlhRREZ3TkdNNVBEUW9qbHpjTncvWXk1aGYyMVZHWWNFS29qT0hBYkgzeVpkZGFzQW5YU0d4bldCUUdJMEtCeC8rclltaHYxMmQ5SFZvZUtXckgwUE5vb05jRFUrRVZNWFMxNS9HZGMydWh4UllxRnNHZExLb00wNkFhaHU2R2k3WVhBbUpiTkdoQ1B3b0s1enpQNG00M3pqdThsbU9WTUtRVzcvZnYxeTg5VTJmaEZtREVDeDdwQ3oyUlFkcnJ2V0RUYkJVSGNDcGhLSS9pekJhUDlZdzZmV0VEVzhxYllNZEhIMGJVbGdrL0ZtSzVGQjNPcVlLaFlFSVNDa3RFNE1jVUNKaFRRSkVScUx0amZRdVJldnpCeGlvWVlreER0YjFFdDBXRFN6QWUvZUVhNElPNTdaQUxRTnRIN3hVd3hOcDVQYmlBRnFTeHRPaUtsOWpEcUNEYTBpeFZxMThFOEtpZS9CVTFlNFpVeCtZQjRYdzQ4V3pnQ3piT2x4WGxMVHdBa3RNOFpZWVdwSTQ2K1BYZm1KQmp5OUpNUWFieC9ibWZ6WlkvMm1sbzE5c0F3M003SEJyS1RxVDcydzZzN3VHMy9ac3cwU01hM2x6Q29XYkZZWitMM1pya1N4b1hkK3hTdWFnK0FjZ252MHhOU0NJQ0JubzVGQmhyTzh6Yk1Hc3R5UTZldTVvRG5IVEpzV0g3TGxiR0VBVHBTeldDRXV6Yk1RQVJORVV5OWpSckpFRDZCSTh0OGlTU25YTHRLWFZmVTBRV0FCcndsMUtOb2tlWlFGeTBSSWFZVXg4a1BGK25NRW1GR0xLMldLbThoMUJhMEtZWWpoWGtFU1JlMFFGeExRWXh3WjFUSWNnemVyWTZoOG9ZZ2s1NDhkaFdlYWttWllFMno1RUlSREhLdWdXTmVvczBSRmpjd29xVk1iekMwajZrQjJ3YUZrTnF3dTBrcDRyU3NiaU1BVFdQcFk4ekJXUzJieWVHYXVjUEZxRG5oSGhFS1hKQnh6ci9sSXhITDZHNGVnYStVdGphQkxNZ1poU25nazBEMUg4MGZvQUYxVVFsYXQ0QitZT3hpYS9vVEtINWcrdG4xdEZWd0JBajlicmFReEpVWFhpY3drdkE0allmQzcrUzNQWFFnV0g5b05JdzlINEZEQk0wS05SaUlTRWIxUDNST2hDaStHTUVYUVlzK3hYYldodlNxNHIzSkhRdDlTS0VCYUxLQmt6UzRnVEVPdFRXekE2L29BZndxbUFvazFxaTdpbVY2VXhGbll1QWp0N01vYjYya2hoUzBWR3BGTVVnRnVOeEZ1Y3g2ZHF1Q2pXTFZoTW5WTUtER1E0QUFhZGJVdFZpYlphV1lBQks1YXpvNkVHUGdNbmxxZWxPSWxDZHVrcXNHQzkxR1F3S3Z6dHdrY3ZqT0tRWkNMaU85aW1Xam5uYmQ1Rkdib2F5TGtnTEFaL0VEKzI0RGxLRmwybU1YVGx2WWVzR1R6VWthVXhtcEpyb2tkVGJ0UEl0WVJzTG9kU1JleHJvbEhvaCs1R1NpaCt6WGpnNnFVOXVscjN0ZUx6dDllSlN5TnBENlhYa0R5ZGJXY0IybTlGZ2QwUkNuTFpMUkNKWFdkMVBtVzVoeTdkaCtMQzZXOXRaYzlhUFUzVm1SSjNzcmRzeU1KRjdRV0VYcFltWm1nT1pvTmx0NzgzamsvSlI2NmE0YjVvNitsK2MzYlhwU1M5YWdNeU50cFR2eFpCZXEyQ3hYVHhYYVhtZDQyaHZYNFZIV2MyMTdBbkxra0NVeWNGUUNFWXVpWUF2Z0p1Z0ZXL1VES3hhZWZsVHNpVWhsOHJDNkFJaWJienBSOXBWU2dKOWJKaUltajlXSFB2OTlUU3lNbEtqUEZIdFBnSUNYczN6ZUQyZXJsdTVOd2duQlRlckRxQU1oc05KYTdyZFRsc3BUNlRMYUo5aWpRc2UvUXJUREZMOThyTGs0Umd1bWtLTHQ1c3M3MjRnanVuU3ZjR1pCcloxazRsMVptRU5WdERHamdyYVhGdmd1WmFIUFhKd2pKQnppR2VEY2pTMHVTeXUxcGw3M0xRNG1yZ25Fc3RtZ3l3WmV5Qk9DY2hwb1QwZW1QWENJRkNidlRDY2VPa0liMkNaV0MrVmFqUDhBclRQWlgwci9DT284T3REeG5mNFpVUE04eGJMQnpFNjJzT3lBaEdvR2ZCdlpLZkFFNVZvNVFXMEptQ2ZLTG10VTllMWJoeGVRb3lRYmNFVUNHMWlqYlFRMERlNVhGVC9kNy9kN3NuaEM4WkJTaERBdVBqd2NHaWhJWEF2OTNSeFdRenhCRVlxdmZmaTNoQVE3RHUrL3NMcXhOQkFHL2pNSWVvYlQrZHQremJZMms3bmtWbWx3cjRvSkJ2VUR1cGZvWjR1UEJiQ3ZVVWFmN1hWTGtQK1ZTWVZvWG9zdEMvVVhRTzJETzZEQVM4SmllcHdUc25TamRTUDNXT3lzM2czZ01CZW9nWmM0NEtjbVFrbGlKdDMwbmtxVEV0aklMcnhoVUhQSFIwSFR3V2ZUZjltZm94QTRHbDFTejBlN0UxaFljWGVnbUdJVEh3Q2tGTklMNkxBamdQdzZ1VCtwUXNZT25CZXBmRGlycVVGdytEYnZzRGpDcWt1THRjMTRra3M0TkZpMTRnaUgraVR2Z0dQWElmSzBoS21VSlhPSDYra21xUHpodzZZMzN2TkxheTNDM2tMUEJkZ3pyNnRlNHNPV284ZDk0VVNma0FqZzEvT0hvamhhMzRaZllpNWgvQU05a242b29zVUFDSTh4ejZqejhYd3JQRGgwdzM5ZW0wb3BPU0xPc3RzVmZMQ0lJMXJlSlN2N2ZzclVyQ0tlekZ4SnoyNEdPNlUxdzVub3VjMDY0YStEMEdXS09leFZNRVJJbWc5aGxzdEhoa2wzd2puZWY2UVlpNGpQckNibWFVaVo4T2lOeFNDd25NOWVCWW05ZWxZV29zNVcrZDV0K2MzQTdnWVd0b3h2QUFEOXdYeEdsRFZaL0dQcmZzNWtRdXdlNCtrR0ZFQlI1aWMzVlVRdlFqTkpNU1RoR1pYUVFWd0MyV2tGL1hGMFRXbGhyTmhxK002QkVjeEp6dWFpRWR0dnhXWk9VQ0R0U0JYaEJFeTRoU2d5TkFERWlTWTU3SUV6WTdRRDNEd0NSdkRvWWhoRUxxU3dVdS9KTVgwQmJXMGhkeFhvbTBSS2VmNGNyNDBzL1N2dURsY1ZINUVXS2F6bDR1bktUSmN5Q0NQWHp1SlJ4VVNGNDBJS0lyRVUvTzljMmhzbzltNE5CaERXazY4dWV6M0YzSkN3Ty9uQ2VtblVsMGtIcGNrTHRzdkxBc011cWhMdm4rZXV1Mk5BQXl0VjdPOENNUTdHN25jR3RWSkd2OEZTN3F3ZTRJQ3EyeTgzMTMyMjl6cjhvZmtMUktsMzR5RWIxK1FoalJSTnhRREliVlR0N01hZHR4RHkwTlFabVp3c2lINGFVVXdTb2JESktXM1VGaU1aU1hTZDJpTGtGQ2Q5MkFINXA0czJ0WWVmdTYzRCsyMmt1TzFSaXpzd2N4YUw2UVB6YTVOdENENXpzNEQ1c3dkSVJsYlRWVzk2ZHJ3L09Ga0xIVHl6OWpCNDJZUmlUUFJZSjRrcnRvNlVZTlNXZTVWK3JqQkkzWDd2RnBmMzhiVmswTXphcXBxdnREMFBYbDh0ZWxQbyttUGlFOW1OS2xWVXkybWdEZFZLdENicGl3OVkzUVlaRE8wMWtvMkxYZkRtekJFN3ZxY1pjeEVHS3IvMm0rSExzUncySmt2d29zL2tVejVtaHRjb3VBNFA4SmROSFNuMCs1ZFBHZy8rREdNNHBmYmM1aUZwc0hBaU9WZjV3QlVXdWJ1Z0dIV1Y1cXkvL1pvWlpRWFE5cTMwWG05dWgyNGtYQUV2SFkzdkhKL3ZyY2wzNWVDZW53WXFtTDhHbVJLZ2ZkWEZHTVVBQzcvZDJqVDJkeGhLOHN1TWg0TWpSUi95UHJpbm5CWnVGd2lZK0hFNzRuamN4L2RHSTZOSjg0aDl5b0RYM0cxRzdnWkFZMmpQbHpSREFLUFF3Qk9EQ2VXQjBJNnBnTUZjTlViMktjQkY2elNMclZPK0UzZEdNcmpQVC9TOHcxbzdBOWVDRGRzRDg1OTBLWGVxcU16V3ZhbjA5NU9kOVBuOE9aWksxWkJoRmE2OTQxT1VSZ0h0UGZwaG0wN3JIU1F5U1l4dkxTSWpPakVKNHFpZXJ1SENmQkpLSC9oblM5L1FoNkdvWkloWmdKMjVCa2JwRFhadXNxM0RNQ2dPMmJyK1o4UHpOU1gyY09YcEJsYjVkL0FGUm5YUVpBbC9NMjNHZ014Qkc0SnRJL1RidXhVb0JPdkpxa0JRN0NIdUZUcXViNjlOTERxdmRBUVJzdWYvM3FnRXE1aE9nM2JjaDY0N250V0FJSkNwOWRmQVhmYjdjSTJCUVJUYUxrcGJ4SVBXRTdIS2doejRjSDdReHdaVU5ZSllWSnVDVEQya0twNCtZTU9VbFdZSEM3UVB5OWxzb1R2S0s0Q254Z29wUnExUWVyQjBIWmlKNkNFQ1JqWEd3NVhBT0llNWU4SHRFUFBqYUdOVFFPTU5wRCsvQ3NiTVkxZXk0RlpDWWtIdzQrVGptQkFNZ0ZMRnZuU243Yk5xQlAySGd5alMya0VSY1l3d0tVRWt6bTA4cnNJTWcrR3F2OTFDZ3BIUVk0MndJNFZhZlM2dzM3KzE0b0s0Y0RiMVRIQUUrSU1ZY0xVMmUyNUpCUXUzQ3ByNWFFaVhLUXRncDdDb0VMcGdLSWRqdUdMWFF5b1M0TThkbmtwU2EzR0tRck1XakhFelFpbE45RTd2dGJaN09wL1oxeDZvc0o0S251bnJBM3EzME94RStGV05KcDZkNmVyUHNYZkxzTXhIb2hrdlVpSit5aGx1blRraXo4SG9ROHZEQ21hOTcyL0l3OURsVEpPeUgweE01ZWJFWThhWno0WkkxM3dENjkwRDQyalM3Y2s1QnFha25sQUdsNnhwSU9pdEI4b2I1RXN6c1ZEWHdCbVRyOWo3bVJLcjlrcGVYZXhGc2YrMmk3a1RrWnBOcE1rd3FWVTRVQXdEVWhacWZVN3kxTDVsV1N4cGExWXFxZzA3YUt5NitpMDcyMjNzOTJYZW9DVmE0V0lwNWpXb0ZxQ2NQdmF6YmJiM3Y0MDBvNS9WUkxOK21WemRtQVNpWnd3MDFSaVJTSGJGVXVhSXN1dFVnWXdMMGVXcjlKdmJuUUFKNVJjZ3k1Ym5Jby93eUpUMmpXZVJWaDZuWXdGVHZWRVd2UnoveWF3cUk2bUNGbXVYR0hIMnMvNmlnb25mV3UxNTJpTmhNZmdoWlh5S0VQV1lNSnV0clpHekRmOXVwckw0ZmZXYXJMc3MvbklNV0Zta3hFRFVxTVVETlk5d2RBN0ltbXJxZERSWnJldXMyUlN3RERwNU4zcG8rSEpmSVdpQWltcGtMSDBHeklMQTNuNEFISkFzcHEzMXZldmQvTk9VbnVoandkRTdyZEFpUXVwSVpLaEJaYWtpS0MrWmJOQ0FPTm4vazRIRTFUU0oybnVlc1ZnZ3BvaStHaHI3U0Iwd01qanZ3Z0U3MHdsenNQNGRtY2xCdFdjV2lnRGdzSE96aG5MUm1vUFAwU3FPU2VoZGtSRmM3MGhuWklnYTMzc1Brd2tJL2F2aEowMDZCMEdpZlRiL2oyTlBpQ1NkdjdSRXVqTTVabWFJL3hMcnNtNVplS1l5U1NWKzZUTzN3Szl1dmVycFlTOFZtdlNrMFFjd0tZOUdrZHJSWEVQV3NRdnV2MEhtUEFGaVdJaWYwM3o5STdtb05NYUsvZmRranRKMVRhVXgzSGVHVHp2MkowcWJsL2RDY3dxTVBoc0ZNSkZvVGpHM2NlZmY2blhDNkhZeWRKOXlPSTZ1SCtDaUFjeTczVGJwbnBmK08rcnFidUl2Z2FJM0syYUhXcGs3WDVnK3g4Um9ob2tXMnYzcXMzVXhWRERxWFVmdjdmL0lSR2p3VERYSmNpNXFkOUVyVUNVTmJXd1VtT3ZOOTc3cjBIVWlYdW4yNkZ4UFd3dTJ6Z3RwcllvamZ1WHplSGFPTnhPdmRnU0dhMEkvd05CY0JuWFd4VkZuUUFBQUFCSlJVNUVya0pnZ2c9PTtmb250U2l6ZT0xNDsiIHBhcmVudD0iNzkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTQiIHk9IjM1LjQyIiB3aWR0aD0iNjQuNTgiIGhlaWdodD0iNjQuNTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI3IiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFGY0FBQUJiQ0FZQUFBQUdDaGtYQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJkYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pnM0xDSjVJam93ZlN4N0luZ2lPamczTENKNUlqbzVNWDBzZXlKNElqb3dMQ0o1SWpvNU1YMWRmZHNiZFRnQUFCWlJTVVJCVkhoZTdWd0plRnZWbGY2MWI3WnN5WXRzSjJRSEFvRWtCQUtocGRDVWtoQ2dKVUFoVUdnb3BXVXBoQzB3ZElBcHBSMitsbEk2aFRLVVBVQXBUSWVXNlVJcGF5Q0JRQllTRWtMSW5wQUY3N3Uxci9PZkt6bVJaVW1XYkNud05mNUJzZjBrdlhmdmY4ODk1ei8zbnZjME1RTERLQXEwaVovREtBS0d5UzBpaHNrdElvYkpMU0tHeVMwaWhza3RJb2JKTFNLR3lTMGloc2t0SWc2T0RJMDlMR2czTmZ4ZnczOEd3RUZCYnJpMUErNGw3eUpZWHcrTlRpWnJHbUwya1NVamtmZzFHUW1hREs1cVdFODVDY2FxQ3ZWM05od1U1UHEyYkVQREhUK0Q3K05QRUVrY0d3eGtXQ3hISEE3WG5iZWpaUEpFL3BYZGVnOEtuNnVoS2NiQ0liN0NRMzlGb3JSSUdhS0IzY0pCUVc1OGJnckZoWUZXdVpDQnovYkZJWmR0RlE4Vm9YVkVRaUZFYVNFRlkyTmdJOHNMa2NSZ0RZUUQ3M041dFNnSmhOK1BjRTgzd2sydGlMUjNJTkxSZ2JESGkyaFhOMklrVjJ1MVFsTmlnOEZ1aDk1UkRrT05DN3JLQ21oTVJtak01a1JneWcyK3pkdFEvKzkzd2t1Znl5RWJOSlRQUGZJSTFOMTFHNnhUam9vZnpJSURScTVjSnRydFFYRFhMcmhYcm9aLzB4WUU5K3hGcUxFSlVaK2YvaXpFc0I3M2FiRW8vWnBPQjQxZVhucEFwNGV1M0E3VGlEb1lEeGtCNjlUSnNFeWJDbjFORFhRbVErSUttUkhjVzQvV3h4WWhzSDFuL0lCV3JJNHZYZ2RhcldwYjROUGRDRFUxWjUwcys4ajk2ZTJ3VGo2U2YyVzMzdUtUeTdOSGFLWHV0OTlCeDR0L1IzRHJOZ1JvcGJGZ2tKMWpvTW5qOGtwYmtndzlyVnBQS1dROWJob3FMNWtIdzdneDBCbU1HZnNhaTBRUTZYRURuQkY5cmladDR6SFAwbVZvZWZCaEJGcmFFbStrUnkrNU5YZFJMVXlaRkQrWUJVVWpOeG9LSTB5cjlGQmZkckh4N3VVclNYSWc4VzVoSUozVlZ6aFJldEtKc0o4NkU1WVRqb1dockl4dlpMY29CWFk3M08xRzE5OWVSdE5EanlIYzFwYlZhZ1g1dWdYNWZHRWgxdERkQTgvcUQ5SHkyNGZSY1AvdjBFV3JMVFN4QXZHZm9iWjJkTDc4R2hydmZ4QWRmM2dCZ1cwN2Nwb05ZYmNIbnZmZVI4Zi92cGdUc2NtSXFTa3k4RGNLVG02WUFhbnJUMzlGQzBudGVQVU5oTHE2RXU5a2h6UkVsL2dwVFpmZmUvL09CdW1pVEczZjlrL1IrdXp6YVB6TmcvQjlzbGxwMGt5SUJzUG9XZm9lV3A5OEZyNXQyL01pVmhELy9NQ3pvM0J1Z2FjSk5UU2k1WkZGYVAvelh4QUpNa0JsZ0dwV3IrOTBPbUFZVVFzOWc1V2h1Z3FHcWtwb3pTYXFoMDVhWllkS1dVUDFEWWd3MkVRNnVoQ21yeDZveWJhSmg2SHlCNWZCUHZOa2FFdXNpYU54aEwxKzlMenlPaHJ2dnBkK3VLZGZ4aVp0TTdJdDFpbEhvK3ZOdHhFTjdKOXhNdER4Z0VhM01Qa0FxUVdKN3FIbVZyUS85U3phLy9naVFoNVA0cDIra0lackthT01yaXFZeDR5RzhaZ3BLSjB4SGFheG82Q2w1TkpTSWZRQld4WUxCaFRKL2syYjBmUCtTb1EyYjFGV0dpYjVTdEtsZ1FTK2txT09nUFBTaTFFMisrdEt2c201SWo0dlBNcy9RUE92N3FmRjdrZ3J5d3djOElyTHZnTkRYUTJhZm40ZmdtNEd3Z1I2eWEyOTZ3N1lwaHpCdjdKYjc1REpqVEhpQnovN0RHM1BQSS9PRi80UElhOHY4VTVmNkMxbW1BOC9ETGJqajRXTkZtVVpjd2gwREQ1S2F1V0lLSzAyMU5vRzc5cjE4TktQdS9renNIdVBHdHhVYURremJCeThFVCs3QTZieDQ1VGM2MXE4Qk8yTGZnL3ZKeHZqU1VvS0RHVjJsSjE1T3FxdS9KNEt3RTAvdTRmazdqZVUvZVRlUm5LTEhOQmtYSUtmMWFQOXVSZlE5ZGQvcENWVzlLcUZWbEI1NWVXb3UrOXVWTjk0RFVxbVRXR1VaMEtRQjdFQ3JkRUlVMTB0eXM4NERhNjdmNHhSOS80bkhHZk1ockcwdE04U29LU244cm5TcjUwQ1hWMGRJbDR2dWpuRm0rOTdBTjcxRzlJU3E2UEZPaTQ4RDlVTGZnaDlwWk0ybWRrcTQrbnZ3QmdTdVJGYWc1Y3lxL3YxeFFoMTlnOWNPaEpiUXQ5VmVkWDM0ZnoyK2JBY01sSk4vVnpXUXJOQk9xNDNHR0ErK2toVVgzTUZTZmtXekNQcjFIbmx6QWJLTS9zMzVxRHNyTm5DQkx4VUxtM1Avbzh5aEhTdVFHc3lvZlRMSjZEaXZITmdjTm9SazVOa2FXTkVmV0RnQ1Q5b2NzVWQrRmF0UVRPbldXRFBaLzB1cGFPZkt6dHpOa2JjOHhPVW4zZFdYSDhXR0JxTkZzYXhvMUYxOWZlVXNMY2VPUkU2V3JmenV4ZWpZdjZGMERvcjRIN2xEVFRkODEvd3JsdWZsbGg5U1FrcUw1NEgxNjAzd1RocXBDSlZ5eUhLNWkwMTZrd0RHOGlneUZWK2RzZE9ORC8wT0VLNzkvWnJpS0cwQkdWelpxSG0xaHRoSE0xZ1pURDFiUXUvcjE1REJjK3BvV1hxU0ZESmw0NUg3UzAzd0hYOTFhaGtRTkphTEhDL3RSU045eko0YmQzT1RMYy90WHAreGpudlhGUXV1QnBtSVRZcCtSQjNsZ2xGY3d0Q1pJVGF0Zk9sVjVuS2J1MG5aY1JpUzA3K01xb3UvWGJjcjZhTWNEUVNabWVaQW0vYWhrakFuemc2ZEdpMU9saFBuQTdIWlpkUVlZVGdmbThsMmhZOWcxQkxTd1pWWUVISmwyZHdWczJGd1daT0hOMFBTWmt6b1dodVFZS0JiOWtLZFAzOVpZU1NJcWxBeXdCVmNzSjB1SzY3QXFhSkU1UlZKU1BzRDhLemJDWHFiN3NMZS8vakxyaGZlbzBFWjliRCtVTDVjcjY2WG40VnpmYy9CTTlIREY2Sjk1SmhzTm5nbUg4UlhBc1h3REp1ZE9Kb01tSnE5aG5HaklLRmJxZjNaZUxMS0w3ZFRHbVhBL0tVWW5RSGJWMW8vc1d2MFBsUEVwT1NLSmhyWEtpKzgzWTR2bmFTNm1ReXdpVFIvZHFiYUhud0VmZy8zYVU2YmFYV3JmblJRcFNjTkFNYVEzN0tJUjFrNFAxcjFtTDN3dHNSYW1xaTUrbmJOV21SVGx6QlJlZWordG9yb2JOWityVlRnVitUOURqYTNxbldiclV5VytuZnRiRW9OYk9PQVpPSlRnNnJjWGxaYnBSK01yeHpKenpyUHFibTdFdXNqbFpiZXVwWFVUcnQ2TDROWnVNaTRRaXRmWG1jMkYyNzQ1M215MCtOMnZMNEl2Z2sySVF5cDZzRGdxZUxobmdOcW9MR1g5eVhsbGlCbmhaclArMXJxTGo0QXZwcFptN3BpQlh3c0w3VXhnQlhCOHZvT3BqR2pJQjFkQzBUbnhFdzFkYmtSS3dnZDNLRmoyNFB1aW5ldzVRMHlVMlhKc3FVY2JMUnNyQ2RqTERmQjkveVZXcGh4U2NXbXhSWW92UnI3ZzgreE40NzcwYjNQMTZodEFzbTNza0RiRWdrNklkdnhTbzAzUE5yZURac1NtdXh4dkp5dG04ZXFtNjRHbnBYRFZOZm53ck1XU0hrcDN2bGlKekpGZThSclA4TXZvODNxcDJDWk1oVWt5Qm1vREpJaGxvcmxZajlheEs3YVd0YWVhUE95MVMwNWVFbjRIbDNHYytkaHdVcllrUHdyMWlOcGtjWE1mUGEzRThWQ0JYS1l1ZWNCaWZsbWFUZTNnL1hjakJmUml3cHRTMEdjaWVYZWJ5UFZpR0wzY2x4Vk1NMDAwUVpVM0x5U1F4b3ZmS0Y3c1BqUTllTEw2SCtwNytFOStNTmFZbnRSWVR2K1hidVF0UDkvNjBTa2x3SmxyVUY4ZU1Odi93TlBDcy9TQnZoVFZXVnFLQ0NxTHJxY3ZwWUszcmVmQmROZEIxdFROVjltN2VxQVNvV2NpWTM2dlBDdjNFeklpa0tRY2lWUWdsRGRTV3RKRDVsSW00ZjNHOHVSdXZqVHlQVTNwNVQrNFY4My9hZGFIbm9VYmhYclU2clM1TVJvNlJ6MHhVMDBZL0xzbUZhSFd1M28rTDczMFhGSlhSWFRnZTZGeTlGNjZOUHdFOVN3dzJONnFkSXcySWhaM0lqYnEvYTg0cUYrdnBGOFp0ZWt0N3ozZ3BhVW9TdUlBanY4aFZvZmVwNUJxemRhWWtWeWFSTDQ3dGsvOHhMZ3RzNHhYMXJQMHE3SUtOY2dRUkkrdXFXM3o2Q29BVElOTDVUVHgzcllBcHMvK1ljYUprZCtqWjhndmFubjZONzJvS3c3Tlg1QXdqd3V6Ri80YlIyS25RL0lSSy9ad2JiSHR5MUJ4Mnk2dFhla1RpNEg3SXc0dCt3a1hMS2dOQ09YV2k0Nzdmd2I5L1JqMWloVS9SaitkbG5VY0NmaUdoemMzeHZLeG0wNEhBOXJlcVRqVEJVVlZOWGp0eS8wOHNUaGttS1ovSGJxUC9KenhFUUY1WEczUmdwQ1N1K2ZRRlQ0SXRocUhUeVhKdlFkTzhEOUxYcjlsazROU2gwRGdkSzJRNWRpVTBkS3pSeXN0d1kvNHUwY25yN01vK3lUUC9XSjU1RzQwT1BNZkExcENlMnZBejJNMllyLzFkeDZVVndrQUJaYzBoZHlJbkliTmk4VGUzWWV0WjhpR2dpMFlnRUEvQ1RvTGFuL29BZ3AzVzZoVzY5eVFUSE9kK0VnNW1YMFZYSnFjWEJhbXBHZUcvZjlRKzVoaXpJUnpNc2tSWUN1YmtGdGtwU1hyVmptd244VEpDcHBxdzg5YmNsVGhHeDJIUFBWc0hGT0tKR3BjYjJPYk5WRk5mVGNsS2RoQVJRRHdOaDI1UFB3clBxQTJaeWREZXIxeWxWNGVVc1NhZGpKZlcyei80NkhQUE9oYkd1bXIxajkyajE0aFpnVE1tcStQMW9Udyt6ek9JcGhwd3RWemJ4a3JjODBpSU5xOHBpMldubnZHK2g0cXJMWUdGV0pxdFpraG9iYTZ0UnZlQXF2bmRlM0lMalg5a0hTU3g2M2xtR3BsODlRQ3QrQ3ZVLytqRThzb3VjTXNqcUdtWXpIT2VmZytwYnJvZXB6c1dleFpXTHpBcTl2UlE2ZTBtLzgwdWRCT2htcEgvRlFHNldLNWZQc2llV0RRWnFZTnVYWnNCeHdUbEt5UGRaZVdMSHhTYzZ2M09oV3A3VVV5cWxRcWF2aHo2ejVYZVB3OS9ZbExaS1VVOWliU2NlajRxTExvQ0pxaVZPOTM1SWFpM2JTLzNJSmFLeFVOcmpoVUNPNUJJeXhmSWNZRm5kTHo5L0xpcHZ2QWFtUTBZa2p2YUhzYVlHenNzdlJmbFpweXZCbnc2U2tLU0RTaERvQ21SQjNqaU9TVXdhRlNJdVFjTzI5SWVJeDh4TGkwTkY3dVNxTnZkbFZ5elBNb0s1TjZPejZOMTlrS2xJUHlvUnUzTGh0YkJOUERUcitxaWMyMFEvWEhIbDVaUlBKRGlIUlJ4cGpwN3V4bkgybWFpNmFRR3NVeWZ4R3VtL0p4bGx6SmMrY0dtTDVCSUV1WkhMNjh0V2lDYmh4M29oV3phbUl3NVhDK05HS1pKTEhKZlYvZEtaSnpOaW42M2NRbUprc2tJbEk3VXVsTk0zMjA2WXJuWVVza0dJdFU0L0RzNkx6bE9xUVB4NEprUVpES05NZnZxN0ZQRzI3Sk5hbnkwOGNpSlhacHJPem9CajdMc2FKQ0pmWG1XelpxTGllL09WREpKRmFPZTM1cUw2dXF0Z0hIc0lQNVY3dzJXd3pCTVBnK3VXRzFBdUtvSUVwb1BzSk1zaWQ4MGROOE40cUt3YlorNkdaSDdSSG85YVFreUZiSkJxMGl5VUZ3cTVXVzRpOEdoU3JFa0V1WlIveG1nMWpubm5VQTF3V3JQVGxkZjhBT1pSbzlUdVFMN1FVanBaU0xBTVR1bXNyNnVOeUY3SU1Ja3FLRC96ZEZRdnZBR1djV1BWRm5wV2hDTHg2c1VVdHlBdVRVc1ZJZTRyai9IUEM3bFpybHpkVVE0dEc1THFvYUxVdjVLbjZ3d21PQys1VUcwV0drcExoOVpnZnRkUVY0ZXF5K2NyRlNCN1hRSlJCZGJqajBYWi9QTkpTdnpZUUloS1Vjbk9uWWd4aTB4dWt1eWE2SnhPcFNLS2had3RWMWZoVkx1anlaWWtDTk55L1Z1MkllcjNVYXZTRWlvcGhRcGdDV3ExN2ZBSmNOMTBIY3JubmdVVFo0N1VGYmh1dlJHV1F3L0w3UnAwQ2NIV05yVk1LalVWeVlhaE5SdGhrSzErR3cyaFNNaU5YRUpUWW9WeHpKaCtoUndSVHJmQWpwMnF2S2lmV1E4RkpFOThzT1d3Q2FqOC9ueTRibHlBeWdWWGtOangwR1ZRQmFtUTVvUjNmQXIvMXUxcUxTRVpXcU1KNXJHam9MSGt0cXN3R09STXJ0SEtLWG4wa2NxQ2s0MG13aXpLdDNFekFwczNzek9GWkRjQlBTMllGdWFnWGphVTJoTUhjME9NMWlvWlhtb3hpSTZKakdIQ09GaU9tc1FCSFByZVhTYmtUQzVOVnRWSm1RNC90TytYYUJGUzNkaTkrQjFLbnVJdDMrVUwyY0x4YjkyR25pWEwrbG10SkVTbDA0K0ZmdnpZeElIaUlIZTN3TkhXVkZUQXlraXVwUlJLaHJMZXRldlZGUHlpSU9MeHcvMytLb1JiVy92dW5QQ2xMeXVENWRpcFZCNm0rTUVpSVhmTEpYVFVoQ1duZkFXR2tTT1VsRW1HN09TMlB2Y0NPOU9lT1BJNWdVYXFWdEJXclVUM3EyLzBxMmhYdFJWVUlPWnBVeE5IaW9lOHlKVUFJN1ZaTms0cHFUaE1odXhuOWJ6MURycGVYNXc0OHZsQmlxV2w2dEsvblJJc2NVd2c1aURGMWFYZm5FTlpWMXlyRmVSRnJrQlc3YVdJdzFoWDAwOE55ZjBKVXUwUzJybExaVWFmQjJUTHgvUDJVbmhXclZIMXZNbVFKTWpDb0d5ZU1DRnhwTGpJbTF6Um4rWmpqMEVaMDFOam1iMFB3Wkt4ZWRhc1ErT0RqOEsvUWU1THlMN0pXRWpJWUVhb0RqeHZMVUhMb2o4b2ZaczZ3TVp5T3l4VHA2ak55Z09Cdk1rVk5tVmh1Mnp1TjlRNmJlb0pvcUVRZXBhK2k5YkhuMFNBK3ZKQVFiYUN1bDliak1ZSEhrYWdzU210S0F6SlhVYnZyMEJnNDViRWtlSWl0dzNLRkVnd2syMGJyYzBHNzBmcjQ3ZVVKdDRUeUk1RnFMNFJFVVpxcTJoSnRZM0RVVW4xSTBORjRxS3lhZWw3YjduYWMvTnVrVnFFOUM0cEZvNGczTnlpZGxXc2s0NkFWbVplU21BdUpBWkZya0RjZzY3R0JRT0pDMnhqaGthclNJWllzR1JHN25lWEswNk5vdytCUnBZdEMwaXlyTWdGZCs5Rys1UFBvRVcyNCtuck14SGJDOW1iQy9KemdlMDdZS3F0WlIrcXM2NnFEUVdESmxjZzJZMitza0tjTFVKTWdXV0xQUlhSenM1NFZYY3dCSU5zOHdqQnNqTXdXSXNoZDFJZkllbTJmKzFIYUg3c0tYUzk5QXJDYVc0YnlBU2hQOXpVb25hUUxVeUtaRDJrR0JZODlMdDUrUFVRRzlyNTU3K2liZEd6Q0haM0o5N3BDMGs4ck9QSHFmdDE1ZjR3STMvWDJVdEpOTk5QZGl4cjUzZ055YmhrMFZ2dTVnbXMrNGdaNFJMNDFtK0EvN09HcklYSzJhRGpRTnRuZmdXdXE2K0U0ZEJ4MU1DRnRlQWhrOXNMc1NRcFgrcDg4VzhJVXBKbE9xbVFLR1dZSW9rc2srSXZmVzBsZlRqOUh5MWF0RFQ0VWsvbG9JVktyVVNvcTFQSk85bFNsM28xLzhaTlBKWitFUE9Gem1oQXlZemoxZTFSMW1PbU1NdlBmdzA2RXdwR3JweEdwbHJIbi82Q3R0OC9qeERKem5aaVdSU1haeXJJdldnR3VoWURmWit1dkV4dEVVbUNFbmE3VlYxYW1KWWFaQkNLY01Da2RrSzIyd3ZVNUgwUWdtMlVsN1UvdWhubWlkVEFCWElSQlNOWElLZUs5SGpnb1JScisrT0xxbndvdGNZZ0UvYnRLUFIyTE5FcytUZHR6VmlCSVROSzduNnZ2ZjVhbUNZZHZyK0VhZ2dvS0xtOWtJQVQyRk9QamllZlprcThCSUZPZWZvSFNTNzRsZGdCRG9yNGN5bThDM1gxOU12SzhvR1V3SlljZnh6cTdyZ1Z4bkdqaDZ3aWlrS3VBazhiN25IRHZYWWRnaCt1Ui9kYlMrR25vb2lxQ3BlaFE3cXRwZFlXUDJtZmVRbzB0UzU0L3ZrNmVsNTdFNkVNMitpNVFHdlFvK3pVbVhCZGV5Vk00OGNvL3o5WUZJL2NYdkRza1FpMTVkNEcrRmF0UnMrU2QrQlpzVnBWZGN0MFQxZWxtQWw2cWRiUjZtQVlXUWY3S1NmQmRzSng2bkVzT2tjWnI2TkJzS2taYmRTODdmVDVrVFJscGJsQ0NDNDljWVlpMkNKUEJCbWtEeTQrdVFuRVlsRVZqTUllTnkzNVkzV1RzMi9OV2lZQmV5ZzFLS1VTelpCU1pIbElsYTQzMDJESDVCME5zMEh6K0xFb21UNE5wYWVmcHJidHRSYWJDb3k5RUxrbXNuRDNnb1hNSEQ4ZTBnelIwVVhZcUNKRy92d3VHRnhWaWFQNTRZQ1Jtd3E1YkpoSmh5cnZiR2hTZGIveS9BTjVOQXJOVGowd1NJalRPNTF4TlZGWEc5L2VUOW5EUzRXYzE3c21YZzNwV2JrYTRhRzRDUHBjcVorb3Brd3pUaGlmdDB6NzNNak5DTG9LWmFuN0N2YnluNUp5UDFxUXFiZGtiOTF5djV4VU13NFM2bzdRR1NmQWRmbDhtRGhya21mS1FCaTYzaWcwYUMzeEtDMmtEczdYQ1FIR2NXTlVxWk01ZGM4dlQ2aGRqUS9Xb1AwdmYrOWZCVDhBdm5qa0ZnaGFKZ2JXcVZOUWM5c3RzTXR6RjFKS3NmS0JQUG1rODVVMzBQMlBmMll2QUUvQnZ5eTVBdEd0dG1NbXc3WHdPc3Fycnc2cHMxS3gwL1AyTXJYWWt5ditwY2tWU0JDU2ZUL24vSXRnT2VySXZIeG1NbVJwS05MWXFHcmpjc1cvUExrQ3NXRExsTW1vdmUxbWxNODZWYTJHRFFacTlTMlBWUHlnSUZjZ0JKc25UNExqMG9zWi9hY1BxdU9xYUM5bDF6c2JEaHB5QlZKUWJhTnJxUDdoRDJDVnpDNFBGeUUzSlJvbmpJUFI1VW9jR1JnSEZia0NLZUEyVHprS0krNzRONVNkUGt1VnBRNEVFWVQ2cWtyWTU4eUNMb2RubGZmaW9DTlhJSm1Ya2ZwWEhqUmtuVGFGUVM1NzVtVndPbEIrNWl4WWp6dEdMVTNtaWk5ZWhuWUFvUjVac0hvdDJwOTRSaFdSU0RxZURFbG01Sm05anJsbm9XenVtVENtS2VQS2hvT2FYSUhjdFI3ZTI0RHVkNWZEcytRZGhIYnZVYzl3a0pKK3kvaHg2Z2w1Wmxxc29WVEsrL1BMR0E5NmNnV0tBcWE1Z1paV2hQalNSSVRjY2hncnl0V3RyZHFVYXZwY01VeHVId2dWdmRhWi9QdmdjRkFHdE14SUpuTm94QXFHeVMwaWhza3RJb2JKTFNLR3lTMGloc2t0R29EL0J5SVBuSDlYS1N5Q0FBQUFBRWxGVGtTdVFtQ0M7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9Ijc5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE1NSIgeT0iMzQuODUiIHdpZHRoPSI2Mi4yOSIgaGVpZ2h0PSI2NS4xNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODYiIHZhbHVlPSJEYXRhIFByZXBhcmF0aW9uIGZvciBBcnRpZmljaWFsIEludGVsbGlnZW5jZSBNb2RlbGluZyAtPiBCdWlsZCBhbiBBcnRpZmljaWFsIEludGVsbGlnZW5jZSBtb2RlbCIgc3R5bGU9ImlyLnJlZj1hZDhkYWE5My0zMzEwLTQyNDAtOWZhMi1kOGE0MTAzN2EzNWQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSI4NCIgdGFyZ2V0PSI3OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhdGEgUHJlcGFyYXRpb24gZm9yIEFydGlmaWNpYWwgSW50ZWxsaWdlbmNlIE1vZGVsaW5nIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREFUQS1QUkVQQVJBVElPTi1GT1ItQUktTU9ERUw7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9Ijg0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YWI0ZDEyOWQtZGI5NC00NjE0LThjZjgtZDZiOGM3ZDBiOGFlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1MLUFJLURBVEEtUFJFUEFSQVRJT04tRk9SLUFJLU1PREVMO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjgiIHk9IjUxIiB3aWR0aD0iMzY3IiBoZWlnaHQ9IjExNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iODMiIHZhbHVlPSIiIHN0eWxlPSJzaGFwZT1pbWFnZTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsQmFja2dyb3VuZENvbG9yPWRlZmF1bHQ7dmVydGljYWxBbGlnbj10b3A7YXNwZWN0PWZpeGVkO2ltYWdlQXNwZWN0PTA7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUZVQUFBQS9DQVlBQUFDUm1vUm1BQUFBQVhOU1IwSUFyczRjNlFBQUFBUm5RVTFCQUFDeGp3djhZUVVBQUFBSmNFaFpjd0FBRmlVQUFCWWxBVWxTSlBBQUFBQmRhVlJZZEZOdWFYQk5aWFJoWkdGMFlRQUFBQUFBZXlKamJHbHdVRzlwYm5SeklqcGJleUo0SWpvd0xDSjVJam93ZlN4N0luZ2lPamcyTENKNUlqb3dmU3g3SW5naU9qZzJMQ0o1SWpvMk0zMHNleUo0SWpvd0xDSjVJam8yTTMxZGZmUmphb1FBQUNDYlNVUkJWSGhlN1hzSGVGM1ZsZlY2VDArOVY2dkxrbnVSRGJaeHdRVUNHQmNNT0FQSlFFS0FTVWlCTUlGUUJ3SVRNZ2xoUWdoSkNQeEpTTUtRQ1NrMFk4QzRVOTE3bFh1UkxjbXlaY3ZxWFhyNjE5cm5QVW0yWmVEL2dlL3psNDl0MzNmUFBYV2ZkZmJaNWR3clR5Y0o1eFNKSFQ5dkllN1J3N1NvMCt2dVZzNHJrQy91UFoyK1FMcVRKWjN3ZXJ6d2QzYkE0MkdaeC9XamZIUXlnM2VQeHhveHFUNVZpV21OaWNEeko2UnpGTlFnQlNjckNvQXFkZ2w0cDZjZGZnSG03MFJMTzRGaXRsM280RThJdkY0UFFsanMwVDliQUsvZ1pKdE9oS2hPRjdGZkE1ZDF0QXIvdEtDS0k1TWt4NXI5QmlVMUtMa2tQd0dwckczQ3IzKzFFUHNPVnBxaytqczhDQS9yeEUwM1RNTGtTUU1RSHVvazFXT1FxcWNnaUV4Ylh3SXgyTGZLUHptb2dkN09KUXBJaTU4WEp5KzVFbmgrcGdSYUo3ZHdwL0paN3FHVXRqZTNZOXYyY3J6endRRzh2YXdVNzY0c3dZcTFoM0drdkpaMUpNRzZYRjkrUDl1cFBYdVRlcUNpc0dlL0Z1TlRBbFIwRG9McTlLSkpaMkNTYlIyZGFHMFRDTzNNNGRhVkJIT3JkaEMwMWhZL210dDhWQWRocGorMTNUdW9ZeHZhUXRETU1nRm14THFpZHQ3YjJ0dFlWLzFwcWRRVkpWWkNHNmo2U2VtYzIvNEdhRUM2eEZodFl5dFdyTnFQYmR0S2NPVVZJNUhmTndrMU5TM1l2ck1jdTNZZHc0bzErN0I2WFRucUdsb0lqcE5pTDBIcW54K1BrWVhabURRK0h5T0daeUl2SjVIQzZzV3FOZnV4WTBlNTlaV2JtNGhRbjdkYng4bzRtbDc5WkhUdWdXcmNVR3dJVGx1N0gvT1diTWVmbmwrSnZmdVBZdnJVRVpneXFSODJieTdCc3RXSFVIYWtGclYxVFd3amlaVHU5QklUNlU0SlppY0JBMUpUWWpDb2Z3cmI1VE1kanhkZlhvc2RlMDdncWl2T3c0MWZIWU9oQTFJUUl1M0FWdDUvVmtNbFBTaUd0TFhYYlRxTUh6d3lCenYzMWhEZ1RzUkcrNUNXRW8yS0UvV29iNVJVcW9Vek51WW1HU0R1THFCZG1SYytTbU5pZkFqaVlpTlJWbDVIdFFBKyt6Qmo2bURjZjlmbHlFeUx0VllocGd6L1NVRnRKMHZyTnBYaXdmOThDZHQzVlhIQzhrTTFZMGxpVVBuNUJXVWdyWVVJSVNpZDZPaGdQaVhPVDBtM09xWm4zUlNkV2xXK1doSlpwcjk1NDJnOGZPOE1SRVJRYlhnNXppZkgxRVk0cDBnN1VDQkVSWVFpSnpzZElUNWZZSjRFMU5TQzI5N2NyQWFjREU1WXFCZHB5V0hva3hLR3JQUUl4RVNId3NjOWJidVpFdXNNa3RxNVBPdUh6M0d4bE42RUtCbzUxK09uUmVmbTlpZExiZTBkS0tMdXUrK2hPZGk4clp3UTBLSG5GaGUzWXBpdVBXSmpPakdxc0E5R24xK0F2UHhzeE1mUi9hS2tIaXV2eHJaZDVkaTBwWVQrYXpYYTJtVHRwUktrZHdXdm40c1dnbGt6QzNIZm5aY2lOeVBleWsybmZncllucU9nYXR0Mm92eDRJMjY1L1JXczJWRE1FbTFQaHA2U01tN3BvUU5UTUh2V0NGdzFjd1N5cytJWlBWRnFPUk5kYmZ4cGFHakYvdjBuOExlWDFtTEJrdDA0ZnJMSjJtcHhOT1hveUJEY2VQMVkzSGZISmFhci9mUU1wQ2crRFRybnRyOFJZL2UyZGc5V3JENkF6VnNPbW9SNTVLejcvYVl6QnhiRTRlN3ZUY1ZOWHgySHZPd0VoQkVRU29jMUZXeUVDUEZSWVRpUHJ0U3QzNWlDYTJhUFFqeU5sTDh6ek9xSW1wcmFzR3psUHBTVVNHZEx0WkErSmZIcUhWUjFiZ1B3SjVnMnB2WGNNNi9ueFo5Z21hZ3IvN1NyMTh6dVM5dFFFNnlwYTBWUlVUSDZGeVJoK09BNERCMFVUK2xNeHBpUm1mamVkeTdGdE1zR0lUNG1vRys5a214M01lUW5HODR6Q0tIRUZ2Uk54TGUvUGdGWFh6R0VaZTNNMXpqMExyaFErdzlXWVRuOTFrQ0d1d2RaTVFvKzlMdyttbnJmL3N4Uk5xTTZDNC9GdUlWeFRIajg3ZndKdGJWMTZsOTVLbE9oTXllS1ZWVGRaaVpkcG54TEJzcFlwTW4zU2dhSURrazZVRlhiZ3BZMjVla2lhTnJpVEdZa2hjTkw0NlMwZW5OK3BzWVV3K1JQcDFaa1FQMm9xZm9zS2EzQlRkLzVIK3JhYW1zVnBLdW05OGV2bjdnZVVhSHNoQkl2S2RPeStxbCszYWxCa0JRZ0tPZHNqSGZUbWFEMmVPcmdkbXZrcklTajJJdWtjZy9sREZycGxMZTJkbkE3ZWVoZ2V4QVJwZzNub2YvWGJvWkNpRVdHZVJrU0FwV1ZEUXd4bVpEZktPQzdCdmdJNWxqTmFraHl0VEFCTnVQaUl1aGpSaEJJV1g4dXEwNmp0QkQ2UjBTOEZzYktCVk1PeDlTZEJlMWs1b21uM3NiVGYxeE4zclZTS3ZGaXlJQlUzSFBQNVVpSkMwZHlVaFFHNUNlYndlcmtQTld2a2JseHVqNGhxSDRDK3Y2SzNWajQ5bTZHaFUwSURRM0J6VGRNcE1VTng1dzNOdUpReVVrRGNQUjVlWmcxb3hEdkx0dHQxcmF1cnBsMUluREZ6SkdvcUtqRDh5OHNRMzE5T3gxd1B5Zm1PZytlY2Y2L2ttQWFPcWdQSHJ4bkd2S3lVczRBVlRzcnhJWndFNWZCbytjYVdCUVAzbDlWalB0LzhBcjJIMjVncVpOSkgxbEpqQTlEZUZnSFZjUXdQSEQzVllnSUY0OEJJQ3gwVmZyamd4cnlDQ21RN2dKVVZGdmZqRHZ2ZnhYekZ1eEEwWTRqT0hLa0FwTXZIRXhBTitDWlA2NWkzbEhzM0hPY2xqTUVtVmxKdVAraEY3Rjg1V0VVN2E3Q2lSTW5rWjJaZ0NWdkYzRmh5aXpjOUhyRGJXSWRmbDRVSmo4djduQkxmNXlybmJ1RkhhRHk1RW5FeGNSaTVQQXMyalB0ajNiZUNSREx2QjVLb0FIZ0ZpMDRIVzBRUVZIZjFNN1l2eGlsNVUzSzVVVmwxTm1PUmhxdDJycDJGTkF0bTNySlFBSk4xUklFVlkwdGtPQmxlTnJQaDlLcGtocEk2WGJzZUEybVh2azA0K1ZJWEgvOVJBeW5KUzNvbTRwYmIvc1RmYjlhM1BpMUN6SHUvQnhrcEVUaEFDM29MZDk5QWVNdUdJQ3ZYVDhHV1FTMG5WTDhYLys5RVBWMXRRd0ZwMkgwbVA0SVpiOGROQWc2UUZac0xyM2F3YnUyc2lUTnNldCt4WllrVE56WUp1YUNTQjdWYnRHU3JhaXVic0cxWHh5RlBxblIxTFh5REh4TzlnaDBVQXBObVpQVXQzNzM3Sy9BQTQrOGlmZFhsaGhXcHIvcEs0UjQyOGlYSDEvOVVpRWUrL0cxMUsvaVI3MnduT0E2MDBrSzNENktOSG8zOVd4a0FQc3g5YktSK05MVjUySDhlUm0yVFFUSWdQNnBtRFYxS0M0YzJ4ZjVCV253aHZnUVJ6MTM2U1g5OFlYSkEraktaQ0VoSVpydFBiVGVxUmcxc2k5U0VpS1F3RHJKU1pGSVlqcVYraXM1TVFwcFNkRzhSeUtGYVQwcmJjOVc3dXFuOGtxek8vTVlBVFUyZCtDcFo5L0RjMzlaaVpyYVZnSXRIZHFUZVZzR2x5UVpLQVN3cFZYK2F6T2YvRnhJU3JpTUdxVlZ1MGUxVzl1NTdFcklpNkJQREMrOUJhWUZyTnNCSDQ5T0JWWEU4Y1dlUWpjZlM2T2pGUEp4elNnSmR0akxVajNyY21zb3FZTTloOUZvK1dqbVRlb0NHMERTNXRYMkpMbFRJTWUzSFF5ZjVlb21ONTVkd1J2NzErbCtaV1VyNXJ5NUNWdXBtcnc2c0dZNzhlT24yU1prZ1hhdUwwbTlycHJxSmxSVnRSSkVIeThGQVd4SG5tSWlHYkpHTXpTT2RJQllmVnNZUGJNUCtjaThBdDE5SkowS3FocXBEL2RrbmRzVzVIOE5ZNXVVbmV2VVhHUU1XSXFrYXJhTnlTZ0xBczBDcExON09WT3l1azZLVkJaWUkwc0hqK3hFUVJCMHVReVhKNmtTZUY1YVppL0JQVnhhajUvOVlqRTJiRDRjV0F5T29mNWtvS3lOV3p3QnBGT3ZEK2pzbHg2dFoxdDFLZUJEN0Zqd04wOWVqeGVmL3hadSs5WWtHaXd0dmdDWDFQcDQ1NXoweGtCVzhHUFMyV3VTc2FBL0xITGcydlE1S0FmUll3QTg2VVpkS2d0aEluakEzTjNjZytNTU9WK2V1d1ZiR01ldlhWK01OK2V2dzlIS0ppeGJ0UmZyTngzR2x1MUg4ZnI4VFRRaXRWaTM4UkNXcjk2SGhzWVd3dUdrMXdCaVA3WVZsU0l5MG9jYnRwYmo3b2RleGU1OXg4a3Z5d04xZzJjSUl0MzJGcC9FYTVUczFyWjJidjFXNDFkaU1teHdQRWFQeU1MSnFnWXNYN1lIei85MURaNTdZUlc5bGxXOHI4U3JiMnhDWlZVai9YU2I0TWNpS2FPelVMZms5Q1JqUmx4MkZicEppQUtZRzJuSzJqYVdKaEFIeTJyeDJDOFc0THByeDV1bFhiVjZHMzZXbTRkWFh0dUlsT1I0NnVRb3ZQbldSdHgvVHh4V3JLUWJWOXVNL0x4a2hNV0V3Q2NYVE4wSlZFcFhhQ2dsU0M1QlNDZ05ZZ2lLZGxYaGhYK3N4VjEzVEVWU0xQMGhWU1l6dHZDVTNvcVRyZmpiMzllaXVMU1J2RW85cUI4dnBkS0Q4d3R6Y2VEZ0NUeit5d1dNc09xNWdJU0VIb0ZVbHA5ajVPVkVJYjkvSnVLcDc5MEVQNW8rUktaNzY4Q2g1Nnp5bWVRa3c1V1pHZ2dvZDJWSGhudVJuUkdOQkRuWkNhSEl5b2hEVkxnSGlZa3hab3ppWTMzSTdCT09tQWd2a3VMRGFhakM3ZVErVlBqWTRraW5DUXJRRThuR3hIRTV5RWtQUTI2R2ovMUcwbFhhaXlXTE42UHlSSTNqZ0Q4S1h2WWVyTWF6enkzRFM2OXZGaWRjWVBiRFJmSlNXZ2YxaThYd0VYbDQrNE05ZHByVjBOS0pKZ1kxTGZUZm1scGJRQStNYmhobm9uRXR0SFR6K1NqNkVFazlFemduS2JyMzNybGFDTmdnck81eWxKMmRoQWZ1dXdvWmZlTHRzR1RLNUh5NlhuRzQvcG94Q0F1blcwTmhIRkdZZ2Z6c05QUkppNkVFZGlBMlBvNWRPSjlURmx1WDN2VVhEa3JEang2NkNzZFBOQkE0NlZIcXdJNTJCaHZWV1BqdUhsdzljd1JpR0tRb3RuL205KzlnNmZ2N1VWWFRiRkxxdUtkUml2Smg4c1QrU0lyejRjQ0JJMXhzUm1yY2huN3F2S1lXSDJycVc2MnVKRmF6T0JPTnMxT3ZraG9FSlNSZ3RZUFUxWEh2bUxLQ3M2YkJZaWRYYmhvS0VzYlF0Y3Btb0pDZkY0OFJ3L3R5NHFIb1IvY3NOeWVKMHBhSUVVTnlFUjhmeVMyWGpINzVhUVNiVzVXRDZwS1prN1VXRStGaEJIWklCaTY2c0I4dW9RdDMyYVFDWER4NUVLSVlGTHo0NmhxczNWaHNmbkxScnFOWThsNHhUbFF5ZlBhSGtqZW5oMldnNUNWVTEvSXBMQkpmKzhxRitPa2pzL0hUSDg3R3ozNzhSY3krZWpRWDJkV1QzK3RtMFN0VXZWS3ZOWU9nbk9yZU9CS3dINzc5WFIyVGFqdmdFSE5NYy9mVTFqYWhzYUdGVnh0ZG13YTBOdnRSUjkzWlVOZUVwcVpXVkRNY2JxTWhhV3hxWnQxR3RMVzJjenZYVytqYjJOQkJjQnJacHQzNmFXaHNzM0ZxV1NadkpKVHhwbHkybzhmcUdPbVZHNmh0cmExb2JtNGxMODdqVVBRa0l5ZHFZait2dmJFT2I4emJoQ2tUQm1EVzlLRzRZdm9RekxoOENQM3NKSVNHQk00SFpQMDVMWW9MbjNxZjkrbjBJZkE3YUU2bE0wSHVqUUlDNWRKeVl2bi94TWxtUFAzc08xaSthaC9lcFE3VHR0eFBBL0hHdkhXWXQyZzd3OW05K01Qejc5Rm9uTVRDcFR2eHl0eU5PRWlML2JzL3ZzZXlmVmk5ZGgrZVpYbng0Wk40L2EzTldNQTZoMmo4L3ZqbkZRVHhwQnRINHhFQnQ3YU9BeGxKQjZSQWNubnVtTkI5YTlYWXlPQkI4VEtyeVd1eGZhWStyS1piRE9mWldMTDdFcDN5eko5QStrTmxPaUI0WGRTbFUwOHZDSkNZdENKZTRrUE0yMGs3MDNLUEZyKzlIZHVLU3JGdFJ6a1dMTjZDc29wbXJGcFhTaGZyQUhic3JtRDVUcFJYMUdMejlpTTBQQWRRY2J5QmVVWFlzZk9JdVV5TGx1NmdKTmJUNVNyR2hpM0ZxS3h1eElJbDIxR21yMUVjWnh6VHlaUTJ1anRyOE5vTHdTUkdnL201eVpSb0o3RTY3YjlpMmxCYzkrV3hwdFBWdXVKNEpmYnNQVWJkTEM5QjBIU0NxaHBsUjJwb3lJNmpycDZ1RlhXOWV5V3Vmbmh4TVpYV21ycDdVT21kUnNHRk9aMVUyWUhWZXczMlp4VlVhbFBrangxNE1DTTZPaHlYWHpvVVF3Zm5ZUGpRTEV5OXRCQ1pxWkc0WUV3ZVJwMlhpOEVEMDNIcEY0YWFrZEtKL1lTeEJZenJvM0NaMnRBd0RSclFCMU8vTUJoOVVtSXdkblF1Um8xSVF5SkQ0V21YRGtGR2VvejV6QnBOeDVFNnU5VmR4aTgxMlVlOW00Y2ZQakFMai94Z09pYU96U1RBUHR6OGxiRjB3YWFoSUMvUitCTnQzRktDQjM4MEYzOTVjVDM5V1RlTEV5Y2I4Tk1ubHBvN1dIcEVid2tFcW1hbitVbG9tQmFZUFp6NlhxMi9LM2E2cHlkWkI3b0hPajBiYWZ1N0dnb0d0S0pBRXYyODI3NDVGUkUwUGdxQkoweklwNkdLUkU1V0RQVGxpSXppaEF0b3ZLTERrSldkek9IOWRMbEM4ZDF2WHVyYXNLL3pSK1p5Y1NLUWtSYXJjM0pFMHYzNjVyOWRoTWlZQ0Z0SU42SThCRW9yeHgwOE1CVVAzanNEZ3dabElDOHIza3JEUTZlZ3FPZ2dycng2QWwyeXVNQStJdkUyb3JBdkNndVBZTVhhNWVUWngyM2ZZYWRqaDB1T2NrRUxrSm1lU01sU0M0YnRob0VEOVFTREdPbjluTndVaHVvZnNmMkQwSnhPWjVOVUxia2JqSGRXOFhEbTJnNENWbEtUbUJDQjZLaHdSRWVHMmtGelpLaUgyekNDVnpqamJwY1hScTdpb2tJUlI1Y29sRlplZWRGUllieDhkaUFUempZeDlIVmptQ2NMTGI4M092QmxuL2lWYjJ3blN4eHd5T0Fzeko0NUZNUDZwU0E2SXBTWER4ZFBISUJ2ZmVNeTVOR2Q4OWxyR0tJV2FKT2VHb2Z2M25veFpsdzJpRHpUUTJDb0doa1JaaThJYjducFFzVEdSZ1lreHRXWFYxSldYbytuZnY4KzNseTRsWExnUXZpemIzKzVIMmRnR2dUekxHQXpYOTVrc0phaUdURW1hcWh2eGlicXdVUGxWU2d1cWFTMEhFRnRmWnQ5em5PNHRCSkh5bXV3YldjSjlWWXpEdkg1d0NHbnc3WVVIVVpKR2N1UDFtTHI5c1BtSWV4aG0wTTBXTlYxTGRUUFIxaXZoU003NWFSdEwvYTBxSHJOWW9jNVlzaXRNbldxMTNhQVR3SmdCZlFhdUdIdFJRcnpVaGlSWFRON0RMSXpvd2hzQjhhTnpjWFhiNWpJd0NSZXZYZDFKWEJyYTlzdzk2M3RlSDNlTmpTM3RBWHdvdnJSN1hTeXNsNXdzNzVjOHF6a0JtUXQ5NTlieUxrbSt3L1g0SUZIM3NCYjg3ZGp6aHRiOE9qUDUyUHZvUnI4OWsvTE1KZlBpOS9laGY5K1lqNzIwQ040WmU0Vy9QWEZEZGgzb0JxUFBqNFBieXpZamlYdjdzSlBmcjZRdm1jRmZ2dUg5L0RTbkRYWXMrczRmdkw0QXRZN3BrRnRIQUZsZ09tUnZFaHRtTytzdEpTdEZRVHFxcDVDNEVEYXZZZHJ4OFR4K2JqcCtqSFUzZW00NWVhSjlLTzU3VFV4MWZkU3Nqay9uWGk5OHZvV095UEk2Qk9EQzBiMWg4K255WE9ST2hSRDkwcCtWanBWNVFiNDdQcnRqVlJpTE50UHQxN3VvUDlaemFpbXFia045ZlJMYTJycTdMMlJKRk0rcXM0NXEvV2lyN1VUelUyTmZHNUNDNVcvL05sNityV05MWDdVMXRCUFpSaFp6N0lhK3EzK3poYjZ1VFYyOEMzU1RwRTBtZlBFTE1sZzhBTUp1VVdPNitBc0Foa1dmZ29ueXJwNVVGUTlWRW0zM0RRSnYvdkZsM0h4aER5cW1VQkxyb3dmb1dpanFYOXI4UTc4NW5mdnNTd0UzLy9lTkV4aWRCYWl6NGJZdjIvRmloV1lOR21TMnlhbmtGNldPU2tMa3ZnVHVZKy96cVNBUytvcXNqdjYzOHdMNDkyRHZybEplT1MreTVEVE53Zk5IYTBZUHpvYi9YT2pjZU5YSmpEdUQ2VXVqY0NBZ21RTXlJdEQ1TFRoREFJODZKY2JqM3YvZlNiU001TlpIa0k5R0kwaGc1THRYVmwwWkNUU3NoSnc1KzFYSXBQUmw0YlUySUxWUzRDQ3ZKcUlFbUhuZ3dZcWRaRzJ2SFNxdm52Vk1SOXdzS3pPb3FqY2pEaEdmNmxPZW50TVZ5Z1ZsOVpRUWxlZ3Fyb0YzN2h4TkM0YzM1ZTZua1pMcjJBNWpuZlZ5cFVvS3l0ekxUNkNnbFpmNFY1dkpLa3dRNlZKa1JHei9JR3lwTVJJekxwaU5BcUhwek5jemNHTTZlY2pKVEVXVXlZT3hIbUYrUmcyS0JNekx5OUVha29zemo4L0gyUHBDYVF3UFdONkljc3o3SVhmekJramtaNmV3UEIwa0xsaFdUUXNpb0RTa3lKTmlzaVpnU25CRmJqNmIyUmx6TFR0cll2TVVWOXFQdjRPblVaNXVVUGE4TDh2cjhmWGJua09ELzl3TG5idVBtR0hLNEdYWXpZUHZXdGJ2ZjR3SHZqUDEzQzQ3Q1MrT0dzdzh1aVN2VWIxdFdFTG96aDZMQnJUZTgrOTl5SW5KMGREbjBFK256TXlINWRrZVowcWR5UUpEYUZPTlNuaVFpaDA3TlNNeWFzK2pkU2twSDJVcFMrY05RZkpncUpKYldrclo3NG1KQytpUTE5VE03L2R5aHcrN1l5R3RHM2RNcXNtS1NpMlo1RDZVbHNadEc3QjBDdjA1V3NPNFVlUExjV3V2VFY0Wi9sQlBQYkVQQVlxNVRZZmRkWEIzYWtQalo5OCtsMnNXbjBRczdpYnJ2dlNlQ3hsY1BJd2JjVWlCaUVkZWhVdlVLVVRUaWVEcFd2LzlLRGU4bnFRVFZSVitDT2UzWUdNQy9OcTYxczU4RzRVN1M2amxUK0t4WXVMVUhhMEhtdlhIY1NHVGNYTVA0WWw3K3pDVVZyNURWdExzWHJOUVJ3OVVZZEYxRjFGdThxd2UvOHhMSDVuTTQ0eHlscS9zUVFiTjVlZ3NySWVTOTh0UXNrUmhxa2MzQ1NQUElRS2h0NVlsUW9nWTFJREVsNERpdzIyN1NqRm4vKzZITFZWMWZSRm96QmlXRGFXRTdqL2VlRURIR1YwcGZyMURhMllPMjh6Tm0wK1NDRk13YjllT3g1WmZlTGtUaE40WWVqQXQrMnYrK25rQ3ZXZVhxTGZnNnlBTjZGM0Znck94ZFVJR2tHUGZTRDJ4RlB6c1lTaDZJSkZXL0hvTDk2aVZKekEzMTlaaVpkZTI0aDMzdHVKWHorOUNEdjNWbURlZ2kzNDg5OVgwS3BYNGZHbkZtRGhrbDE0YjhVQi9QSTM3OXFCOGo5ZVhZTzU4emZqSUhYYnI1NTVHenZvQmNnTmx3WFhBcmFkaFQycEJFbHFCMFU4QkswMnY4WHY3TVJkUDNnZFM5OC9pS3RuRGNOdm43d1dqejQ4a3hGZHJvWEZ2L3pkK3d5UksvSFh2NjNGaTY5dVFGNU9ISDd5MEV4Y01ESWJvYUVPUHAwamlOeHlCWGZOV2Voc2dpbm1lNk11UTJYc2R3T3NWQmd0YUdxS2wxRlVHR0laU1NVblI5c1hMN0d4VVVpSUFhSVlBQ1F3Nm9wUUhzc1RFNkxNMFU5TmlXWVVGUXI1M2FuSllmWlJSM3hjR0JKaTI4em5USWlQZFI4L0JFWVN1YW1kU2JMZGVqc3FhbTd4WXVXNlEzajBDWUZXUXozZkI0OCs4aThZUDQ1UjFkQjAvTWZkczNEUnBBR1k4L3BHM0hyUFhEcjR5MDNmZi9mMmFaZ3d2b0RJQldab0xwbDhlczZjYUFxYlhzTlVSNzB4RmhTQjNrWEIzSmVBRk92VzgyZ2hPVGtLZDMvL2kwaExUakFHUnArZmhmNERVcENVTUlIVzFrdnJIa3JqazROK09jbU0rZVBzRTZLTWpIamNjOGRNcEtiR0lJUUFEeDZZZ1lMOEZIejUyZ3VoTDB2NmNKTDMzREVWZmZNU2JHeW5BalF4OFhBbWp5YXB6RzZpZTdkeDNXRTg4K3g3MkY5Y2djTEJ5YlRpazhsYmxPbHIrY0oxdFkzNDF5OU5zbSt3dGhZZFlNVG53K3dyeGlFckpSNGJOcFlpS1ltUkh2UGNnWXBnN01hclYwbDF4V0xxVEdERlZPK0Fpd0p0ZUZNTmJUWU5LUE1WVFpkbzdQa0Y1bG9WNUNWemUvVkhDcVZ4Q0lFYTNMOFBDcGd2cnlDUlhrSy9naFFNRzV5T3BQaElPdUI1ZHJxVW01R0UwYVB5ellzWU5pZ1ZBd3RTS2JFUkdEc3FseEtVWUtPWlY5TEZXdSs4K3duQ3BrMGwrSTlINW1MRm1tSk1IcCtKaHgrNEVwT25EREQ5Mk5uWmhwODlPUjkzUGZBQ090c2FjZDlkMHpGcGZCNnV1M1lVcnJsNkZGWENWbnpuemhmeGYzNy9EazVXTlpuN0ZYd1hGNlJlUVRYY3lOU3B2cXUwa1JoMUJpR1F4Y3RKaUQwR3NsVXRhQWlNbE9CMjZWQWVLMWt6L2VzNWJ6VzJNdjdqeEx2YnVwVDFwM0pkTm5uTDVuSXhyYnYxRmVUUXBVK2xnRkpnZzJQSDZsQnh2QWJqeHVUaTlsc3ZzN09GVitkc3BMNnVJQ0JlMU5hMW9vWWhhQWY5Nlluajh2SFEvVFB3N2E5UFFXSlNsSDNjVnNNZ3BhR3AzZmkwbmkyQTZCNnZWMUFkdVFsMFVRQUE1WmhPUGEzSVBmTFgycmpURytrd1NhdHFWQnl2d3o5ZVhtT3ZvMWV0MjAvZmJqMHRlVDBXMFNXUjc3ZHBleW5tek51Q0l4VzFwdXVXcmRpTjhtTTFlR251UnZzcmxXMHNmL1gxRFNncHE4VkNlZ2tyNlRXVUhhMWtxTGpaemxoN3pJbVRFa2NCaGdNVVhFd1BGMWZ2cnk2YWxJYzdicnNFNXczUHRnL3JudnJ0RW16ZGRjTFVpS1puclQwK25LU0hjZnhFTTBwTHE5SGMzRUlnWGFIS05WVmRwdlo2MElkcy8rNktUa1Z4c0M3R2UzaWpTb2dSdXprSVdabFJqZEkrNXJtdGNhaWtDbzg5UGgrTEdNUFBuYmNUdjN4Nk1Zb1orLy92MzFaaTRlTDF0UDY3OGV0bmxxRDRjRFVXTHRxQWwrZHV3c0hpYXZ5SzlSWXRMYUwxMzAvci96YjI3RHVPUDcvd1B1YSt0Umw3OXJMOE53dlp6MG1xR1Mwa09lUFBxY0xnMHM2NGNxRzVYWWNPN1lNN2I1dU9JZjBaaWJGZE0wUG5xcXBtK3M3aVZTcEV3T3JZMGtzVmNRQzNmdTh2K09HamMxREJSZGJSbjV0bGNBeDkwc2ttM1lqMERxcXI3amY5SXdwdTArNW1RZkNZbzRUMm8yNmNqRE5Xcm1ad2Nqby9qWXdNUS85K2ZkQW5PUTVaR1RFME9CbDJuSmVibllUVXRHU3pyUDBLMHV5dlVsTFRVcENWbVlSSWJzdjgvRDVJUzR0SFNsSTArdVVuMjdGaFhtNktuYWxHUjZ2UGRETWltcFQ5TTcycThkM1laNUlYK251QUYxOVppMmYrc054Q3poQlp2ZURrMk16VUMvL3BGWGM3blM5OVZxcGdwYXVDUUxmK0EzYyt1MzNnNkVPMlAwY3g1a2lzTDRDYzNtSUgxbDdxd1cxenEyc1U2TnlpRlVwRlFFcWx5UE56RXZGZkQ4M0d6R2xEN1E4Zzd2bitWT1RtSmVHV202Zmd5cG1GbUhySllMUGsvV25kWjg4cXhIWFhqRUpCUVRJZXZIczZvNWRodUdUS1lMbzVNekI0U0RxK2NmUEY5aDMva0lISnVQZk82UmlRbjlURnFpZ29CTjNUZEJTQTNWNE82anVzMTZodWpsZldtVzRNbWcvbk9TamljczhtR01HWGw5cDlscSs1c1NmVHBXcklBWHNNZGlxb1lvYVg0MG1uOFpad1JJRDBtbGlsUVNCbDFVWHUwMGhMQnNwY0gyNGRLUVZrSmpiV2gvT0daU0VyUFI1NTJZbTA3bG1JbzRUMXowOUZibGFTdlJJWk5qakRQaXJPeTBxa3hVOUJQSDNhNGZRWnM5TGprSjRXZytGRHNwQklIM1VBZ2MvTFNVSnNYRFFLaDJRaU1qYkNkb1BHbGxUWnQxUWNQN2prUVJMWUJqaUJVeHl2dXRwWkRDdGRCWkl6ZFU0WXFBQlkxY01nUWVWdVJ1N3N5NmtaUDZWTU9UYlRIcXQ2S3FqaWdKZmR1QW82WmRJSHNhMksyVTJQcXJFcThGbitoNUdiZ0ZaYmYrbnNzalVaVGRLTDZ1cDYrNFRIL2l4Y3VUWTIreUd6U2tvU3JFdEt0NU1DdFhhWCsrbG0xc29EZFJ4Q3l0TVBZV0RjWFZsWlMzNEpDQjN5Z0NydHFoNGs4U0JPYkFsc1I3aytnb2RFVnAvUDh1MzFWWXBHMS9lcm9DSndwUTRKa1Y3WnVLOEJuYmdGcVZmblgwM2tXa2dDNXk4NWlOek1aSXhreEpHYWtjZ3lEM2J0T1lHM0Z1ekNsTWw5R2VWRWlRZFVWclV3ZHQrSGdyNHAxSk9KYUdwdXRlTzZsZXRLOGVPZkw4WGxsd3hrVk9YZVdqcVd1aitBMDBlL1FkTEJpVWlUY3FSRWtPVmdwcDdkd29uVTVqaXQ5TjlmMllJcWJtZjl0Vit3bWZNRVZOOUV3bDRLMm9tV3gzMWNvVlVPL2lsUmtQUXFSbXhRUkd3TUxZTUQzVDNwTXVLaW1KQUViSW9qOTdsR3J4UVc1ckV0dDIxWEtaNTgrcGlCZGV2dFZ5Q0RBSzlZVTRyblh2Z0FDNWR1d2hjdUdvQXhZd2JTZ0hpd2ZzTmUrelE5TnlzZS96SjdqTDBGM2J6NU1ONy9ZQWZXcmQ5bFcwMEhHR0lrK0RXMVNKTTFpUXVRZVJGZDRMcDZhbU5iVE5tYUNDbG9TTldYVHJVYW03eElvVkdUNnBDT2RPcVJQOUx0a2tyYis3eFpQcTAyMi9mQThoUnlUWFhLMXZQOGc1elNlN0JkYWtPN3hucGpMR0NGclhnOUExUzNGZlJDTGdyZnZtVUszbDEyMFA0TU1UemNpOWd3UDI3NDZrU0wzM1ZBcTc0VmV3OWtCSFRIYlZPeGUrOHhDeTlqb2lPUm5ocUZHNjY3d0l4SVE2UE9Mams0NStUK0lEZGd3R2dBN09NemZRdkZSMjFMQWViT1JnTjhrMU45aXlyZ3BRTTdaVFE2OWRvN0lQVTZKN1Q0bXdEUUNLVFJLeGczVHJFNXN3UzZCalhxbHV3WWVoRDV1WEhzTjhUT0hGS1RZMUE0TEJOSmpOQWs1UDJvcy9WOVFIeGNKTUlwTEJjeW90THI4aWg2R3hucENSaFJtSTYrZlpNUUV4dUtZVVBTN0dDbWIzYTg4U255RUVTWE9vMHNwdVZsZXRMWTBkL1ArK0NqQ0xSUWYra3ZuZldQQWcxZm1JOWdkZGlmQW1tcmlERWRvTWpQVTQ1TmgwRHFVTXhQQ2RIZlhRVW5hTkJwcnh0Qzd0R29SM0ZYT2tqTTAwdEZad1RaRThleEhwV20xRWgrZEt5aDhVeU5jR3g5bkdZejVVOXpjenVPbld3eVh0SVp3M3U1MEpXTmJVaU1EMmM0SFlwak5Td2pVUEhSRWRvR2FLQXFrOWVsRjRacVc5dlNpWmhRWGx5UStoYk9pM1gxRmpnOFhINDVoenNicUovVC96OXBrM3hPbnpKOUR1cG5RSitEK2huUTU2QitCdlE1cUo4QmZRN3FaMENmZy9xcEUvQi9BV2tNWWJlbjdocDdBQUFBQUVsRlRrU3VRbUNDO2ZvbnRTaXplPTE0OyIgcGFyZW50PSI4NCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNDIuMzQiIHk9IjM1Ljk0IiB3aWR0aD0iODIuMzEiIGhlaWdodD0iNjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgyIiB2YWx1ZT0iJmx0O2ZvbnQgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5EYXRhIGNvbGxlY3Rpb24sIHByZS1wcm9jZXNzaW5nLCBhbmQgcHJlcGFyYXRpb24gZm9yIGxlYXJuaW5nJmx0Oy9mb250PiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj1ub25lO2ZvbnRDb2xvcj0jMDA3RkZGO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU2IiB5PSIyMSIgd2lkdGg9IjM2OSIgaGVpZ2h0PSIyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODAiIHZhbHVlPSImbHQ7Zm9udCBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE0cHg7JnF1b3Q7Pk1vZGVsIGNyZWF0aW9uICZhbXA7YW1wOyBvcHRpbWl6YXRpb24mbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSMwMDdGRkY7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNDc2Ljk5ODYyMDY4OTY1NTEiIHk9IjI1IiB3aWR0aD0iMTkzIiBoZWlnaHQ9IjI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEZXBsb3ltZW50IFNldHVwIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREVQTE9ZTUVOVC1TRVRVUDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iODciPjxteENlbGwgc3R5bGU9ImlyLnJlZj0yMWQwZGU0Yi05N2ZjLTQ0NDYtYjBkYy1mMDdiZTJlNWQ5MDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREVQTE9ZTUVOVC1TRVRVUDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY5IiB5PSIxOTkiIHdpZHRoPSI2OTAiIGhlaWdodD0iMTQ2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI5MyIgdmFsdWU9IlRyYWRlIFNlcnZpY2UgLT4gVXNlcnMgSW5wdXQiIHN0eWxlPSJpci5yZWY9MTQxNjZjZmEtMDYxMC00YzAzLTg1Y2UtMTkxNmZiODg5NzYxO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjE5IiB0YXJnZXQ9Ijg4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJUcmFkZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWZiZTVhOGRkLWE4NDUtNGYyNC04YzY1LTQwNTdhZjcyOGQxYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd09TQXdMamcyTmpRM01TQXdMalUyT1RNek9DQXdMamc0TXpNMk4wZ3dMak00TlRBeE9VTXdMak15TVRVd055QXdMamc0TXpNMk55QXdMakkzTURBeUlEQXVPRE14T0RjNUlEQXVNamN3TURJZ01DNDNOamd6TmpkV01DNHlNekUyT1RsRE1DNHlOekF3TWlBd0xqRTJPREU0TnlBd0xqTXlNVFV3TnlBd0xqRXhOalk1T1NBd0xqTTROVEF4T1NBd0xqRXhOalk1T1Vnd0xqWXhOVEF5UXpBdU5qYzROVE16SURBdU1URTJOams1SURBdU56TXdNRElnTUM0eE5qZ3hPRGNnTUM0M016QXdNaUF3TGpJek1UWTVPVll3TGpZeU1EWXdNVU13TGpjeU1EUTFPU0F3TGpZeE9EZzNPU0F3TGpjeE1EWXhNaUF3TGpZeE56azRJREF1TnpBd05UVTJJREF1TmpFM09UaERNQzQyT1RBNU9Ua2dNQzQyTVRjNU9DQXdMalk0TVRZek1pQXdMall4T0RjNU1pQXdMalkzTWpVeUlEQXVOakl3TXpVeFdrMHdMak0yTlRnMU15QXdMall3TlRRMVF6QXVNelkxT0RVeklEQXVOVGc1TlRjeElEQXVNemM0TnpJMUlEQXVOVGMyTnlBd0xqTTVORFl3TXlBd0xqVTNOamRJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTNJREF1TmpNME1UZzJJREF1TlRnNU5UY3hJREF1TmpNME1UZzJJREF1TmpBMU5EVkRNQzQyTXpReE9EWWdNQzQyTWpFek1qZ2dNQzQyTWpFek1UUWdNQzQyTXpReUlEQXVOakExTkRNMklEQXVOak0wTWtnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqWXpORElnTUM0ek5qVTROVE1nTUM0Mk1qRXpNamdnTUM0ek5qVTROVE1nTUM0Mk1EVTBOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk1qYzFOU0F3TGpjMU1USTVPVU13TGpVMk1EUXpOaUF3TGpjMk1UWTNPU0F3TGpVMU9USXdOU0F3TGpjM01qSTNNaUF3TGpVMU9UQTRNaUF3TGpjNE1qa3dOa013TGpVMU9USXdPQ0F3TGpjNU16Z3dOU0F3TGpVMk1EUXpPQ0F3TGpnd05EUXdPU0F3TGpVMk1qYzFOQ0F3TGpneE5EZ3dNVU13TGpVMk16YzJOQ0F3TGpneE9UTXpOU0F3TGpVMk56VTFJREF1T0RJeU56STNJREF1TlRjeU1UYzJJREF1T0RJek1qUXlUREF1TlRrME16STBJREF1T0RJMU56QTJRekF1TmpBd05qWXlJREF1T0RJMk5ERTBJREF1TmpBMk1qa3lJREF1T0RNd01EZ3pJREF1TmpBNU5EazFJREF1T0RNMU5Ua3pRekF1TmpFeU56TTBJREF1T0RReE1USTNJREF1TmpFek1USXlJREF1T0RRM09ETTVJREF1TmpFd05UVTFJREF1T0RVek5qYzNUREF1TmpBeE5qSTFJREF1T0Rjek9UWTJRekF1TlRrNU56WTNJREF1T0RjNE1UZzNJREF1TmpBd056Z2dNQzQ0T0RNeE1UZ2dNQzQyTURReE5URWdNQzQ0T0RZeU5qbERNQzQyTVRrNE5EUWdNQzQ1TURBNU16UWdNQzQyTXpnMk5qWWdNQzQ1TVRFNE5UWWdNQzQyTlRreE9Ua2dNQzQ1TVRneU1UTkRNQzQyTmpNMk1qa2dNQzQ1TVRrMU9EUWdNQzQyTmpnME5EUWdNQzQ1TVRnd01EUWdNQzQyTnpFeE9UTWdNQzQ1TVRReU56Vk1NQzQyT0RRME5qZ2dNQzQ0T1RZeU56SkRNQzQyT0RneU5TQXdMamc1TVRFek5DQXdMalk1TkRJME9TQXdMamc0T0RFd05DQXdMamN3TURZeU9DQXdMamc0T0RFd05FTXdMamN3TnpBd055QXdMamc0T0RFd05DQXdMamN4TXpBd05pQXdMamc1TVRFek5DQXdMamN4TmpjNE15QXdMamc1TmpJMk5Vd3dMamN6TURBNElEQXVPVEUwTWpjNVF6QXVOek15T0RJNUlEQXVPVEU0TURBeklEQXVOek0zTmpNM0lEQXVPVEU1TlRneUlEQXVOelF5TURZMElEQXVPVEU0TWpFMVF6QXVOell5TmpFMklEQXVPVEV4T0RZNUlEQXVOemd4TkRVNElEQXVPVEF3T1RVeklEQXVOemszTVRjeUlEQXVPRGcyTWpnNFF6QXVPREF3TlRRMUlEQXVPRGd6TVRReElEQXVPREF4TlRZeElEQXVPRGM0TWpFeUlEQXVOems1TnpBNElEQXVPRGN6T1RsTU1DNDNPVEEzTmpJZ01DNDROVE0yTVVNd0xqYzRPREl5SURBdU9EUTNPQ0F3TGpjNE9EVTVNeUF3TGpnME1URXhOeUF3TGpjNU1UYzNNaUF3TGpnek5UWXhNa013TGpjNU5EazFNaUF3TGpnek1ERXdPQ0F3TGpnd01EVTJJREF1T0RJMk5ETTJJREF1T0RBMk9EZzFJREF1T0RJMU56RTRUREF1T0RJNU1ERTBJREF1T0RJek1qY3lRekF1T0RNek5UZzBJREF1T0RJeU56WTJJREF1T0RNM016UTBJREF1T0RFNU5EVXhJREF1T0RNNE5EQTRJREF1T0RFME9UZzJRekF1T0RRek5ERXhJREF1TnprMElEQXVPRFF6TkRFeElEQXVOemN5TVRNMklEQXVPRE00TkRBNElEQXVOelV4TVRWRE1DNDRNemN6TkRRZ01DNDNORFkyT0RVZ01DNDRNek0xT0RRZ01DNDNORE16TmprZ01DNDRNamt3TVRRZ01DNDNOREk0TmpSTU1DNDRNRFk0TlRJZ01DNDNOREEwTVRWRE1DNDRNREExTVRVZ01DNDNNemszTVRVZ01DNDNPVFE0T1NBd0xqY3pOakEwT0NBd0xqYzVNVGNnTUM0M016QTFNemxETUM0M09EZzFNU0F3TGpjeU5UQXpNU0F3TGpjNE9ERXpOU0F3TGpjeE9ETXpOaUF3TGpjNU1EWTVNU0F3TGpjeE1qVXdOMHd3TGpjNU9UWXpOaUF3TGpZNU1qRXpNVU13TGpnd01UUTRPQ0F3TGpZNE56a3hNU0F3TGpnd01EUTNNeUF3TGpZNE1qazRNeUF3TGpjNU56RXdNaUF3TGpZM09UZ3pOVU13TGpjNE1UUXdOaUF3TGpZMk5URTNPU0F3TGpjMk1qVTROaUF3TGpZMU5ESTJNeUF3TGpjME1qQTFOeUF3TGpZME56a3dPVU13TGpjek56WXlPQ0F3TGpZME5qVXpPQ0F3TGpjek1qZ3hOaUF3TGpZME9ERXhOeUF3TGpjek1EQTJOaUF3TGpZMU1UZzBNa3d3TGpjeE5qYzNOeUF3TGpZMk9UZzBOVU13TGpjeE1qazVNaUF3TGpZM05EazROeUF3TGpjd05qazVNeUF3TGpZM09EQXhPQ0F3TGpjd01EWXhNeUF3TGpZM09EQXhPRU13TGpZNU5ESXpOQ0F3TGpZM09EQXhPQ0F3TGpZNE9ESXpOU0F3TGpZM05EazROeUF3TGpZNE5EUTFPQ0F3TGpZMk9UZzFOa3d3TGpZM01URTNOQ0F3TGpZMU1UZzJPVU13TGpZMk9EUXlNeUF3TGpZME9ERTBOU0F3TGpZMk16WXhNaUF3TGpZME5qVTJOeUF3TGpZMU9URTROQ0F3TGpZME56a3pPRU13TGpZek9EWTFNU0F3TGpZMU5ESTVOU0F3TGpZeE9UZ3pJREF1TmpZMU1qRTNJREF1TmpBME1UTTNJREF1TmpjNU9EZ3lRekF1TmpBd056WTFJREF1Tmpnek1ETXlJREF1TlRrNU56VXlJREF1TmpnM09UWTBJREF1TmpBeE5qRWdNQzQyT1RJeE9EUk1NQzQyTVRBMU5ESWdNQzQzTVRJME56ZERNQzQyTVRFMk5qZ2dNQzQzTVRVd01UY2dNQzQyTVRJeU5ERWdNQzQzTVRjM016VWdNQzQyTVRJeU16Y2dNQzQzTWpBME9ETkRNQzQyTVRJeU1qWWdNQzQzTXpBM01EY2dNQzQyTURRMU1UZ2dNQzQzTXpreU9ETWdNQzQxT1RRek5ERWdNQzQzTkRBek9UbE1NQzQxTnpJeE56WWdNQzQzTkRJNE5qVkRNQzQxTmpjMU5UTWdNQzQzTkRNek9DQXdMalUyTXpjMk9DQXdMamMwTmpjMk9DQXdMalUyTWpjMU5TQXdMamMxTVRJNU9WcE5NQzQzTkRjNE1ERWdNQzQzT0RNd05qRkRNQzQzTkRjNE1ERWdNQzQ0TURreE1UY2dNQzQzTWpZMk56Z2dNQzQ0TXpBeU5DQXdMamN3TURZeU1TQXdMamd6TURJMFF6QXVOamMwTlRZMElEQXVPRE13TWpRZ01DNDJOVE0wTkRFZ01DNDRNRGt4TVRjZ01DNDJOVE0wTkRFZ01DNDNPRE13TmpGRE1DNDJOVE0wTkRFZ01DNDNOVGN3TURRZ01DNDJOelExTmpRZ01DNDNNelU0T0RFZ01DNDNNREEyTWpFZ01DNDNNelU0T0RGRE1DNDNNalkyTnpnZ01DNDNNelU0T0RFZ01DNDNORGM0TURFZ01DNDNOVGN3TURRZ01DNDNORGM0TURFZ01DNDNPRE13TmpGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj0xMiAxMjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI4NyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MyIgeT0iMzEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTIiIHZhbHVlPSJVc2VycyBJbnB1dCAtPiBUcmFpbmVkIE1vZGVsIiBzdHlsZT0iaXIucmVmPTczMmIwMjc5LTdkMjItNDE2NC1iZmUzLTE5ZWJjZDA5ZWNiMDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI4NyIgc291cmNlPSI4OCIgdGFyZ2V0PSI4OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg4IiB2YWx1ZT0iVXNlcnMgSW5wdXQiIHN0eWxlPSJpci5yZWY9YTFkMDNiYWUtZTZiNy00MmNlLThjY2QtOGI5N2QwZTdjZDM4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1MLUFJLVVTRVJTLUlOUFVUO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj04IDg7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI3NiIgeT0iMjgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODkiIHZhbHVlPSJUcmFpbmVkIE1vZGVsIiBzdHlsZT0iaXIucmVmPTc3MWJmOWZjLTFlODctNGMzNi05OTIwLTZhMDkwYjA2YWI2Yjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NTC1BSS1UUkFJTkVELU1PREVMO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj04IDg7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ4OSIgeT0iMjgiIHdpZHRoPSI5MSIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTEiIHZhbHVlPSJUcmFpbmVkIE1vZGVsIC0+IE1vZGVsIG91dHB1dHMiIHN0eWxlPSJpci5yZWY9ODNjNWM1ODItNTQzZC00N2E3LWE1NjEtMDE3ODIyYTIwZWM0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iODkiIHRhcmdldD0iOTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI3MjQiIHk9IjM2MCIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY2IiB2YWx1ZT0iR2VuZXJpYyBTZXJ2aWNlIFByZWRpY3RlZCBhY3Rpb24sIGUuZy4sIGJ1eS9zZWxsIC0+IE91dCBPZiBTY29wZSIgc3R5bGU9ImlyLnJlZj05MDQwOTcwNS1hZmU4LTQ0ZWEtOTEyMi05MjQ3ZDg4ZDJjNGY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSM2NkIyRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgc291cmNlPSI3MyIgdGFyZ2V0PSI0MSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xMzkiIHk9IjM5NyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iT3V0IE9mIFNjb3BlIC0+IEdlbmVyaWMgU2VydmljZSBQcmVkaWN0ZWQgYWN0aW9uLCBlLmcuLCBidXkvc2VsbCIgc3R5bGU9ImlyLnJlZj01NjQyNzkzMC02MTRlLTQ3N2YtYTEzYi1jYjk3ZTc3NjhmN2Q7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjAwNTtlbnRyeVk9MC42MzI7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSM2NkIyRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbnRyeVBlcmltZXRlcj0wO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQxIiB0YXJnZXQ9IjczIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE0NCIgeT0iMzQyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNzgiIHZhbHVlPSImbHQ7Zm9udCBjb2xvcj0mcXVvdDsjMDA3ZmZmJnF1b3Q7IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTRweDsmcXVvdDs+RGF0YSBwaXBlbGluZSAmYW1wO2FtcDsgbW9kZWwgY3JlYXRpb24mbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTMzNSIgeT0iLTkzLjk5NTQ4Mzg3MDk2Nzc1IiB3aWR0aD0iMTk4IiBoZWlnaHQ9IjI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5NiIgdmFsdWU9IldlYiBVSSAtPiBUcmFkZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPTlmYzk0MTkzLTdhYmYtNDc3Yy05OGM2LWYxMDgxNmYzZjlhNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjE5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE0NCIgeT0iMjA0Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAxIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIzOSIgdGFyZ2V0PSI4NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xNTgiIHk9Ii0xMyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwMiIgdmFsdWU9IlRyYWRlIFNlcnZpY2UgLT4gV2ViIFVJIiBzdHlsZT0iaXIucmVmPTE0ZDE4MTUyLWEzYmMtNGZlZi1hNjI4LWZlMTAxMTMyYjNlYjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTkiIHRhcmdldD0iMTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItOTgiIHk9IjE1NiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="100"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Trade Service -&gt; Users Input" ref="14166cfa-0610-4c03-85ce-1916fb889761" source="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" target="239ba369-2d9f-4e4c-8129-d86e8da7d042">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Trade Service -&gt; Web UI" ref="14d18152-a3bc-4fef-a628-fe101132b3eb" source="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" target="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Model outputs -&gt; Generic Service Predicted action, e.g., buy/sell" ref="302ccc7f-9af7-4643-9b5e-e51756b343c7" source="c80c37c8-4b1a-45e7-95c3-6005285c2b88" target="a4358da6-d80b-485c-b27c-2313a9e9e45d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Out Of Scope -&gt; Generic Service Predicted action, e.g., buy/sell" ref="56427930-614e-477f-a13b-cb97e7768f7d" source="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" target="a4358da6-d80b-485c-b27c-2313a9e9e45d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Users Input -&gt; Trained Model" ref="732b0279-7d22-4164-bfe3-19ebcd09ecb0" source="239ba369-2d9f-4e4c-8129-d86e8da7d042" target="4d33876c-2161-4cc7-875c-e6dd1667d7b9">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Trained Model -&gt; Model outputs" ref="83c5c582-543d-47a7-a561-017822a20ec4" source="4d33876c-2161-4cc7-875c-e6dd1667d7b9" target="c80c37c8-4b1a-45e7-95c3-6005285c2b88">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Generic Service Predicted action, e.g., buy/sell -&gt; Out Of Scope" ref="90409705-afe8-44ea-9122-9247d88d2c4f" source="a4358da6-d80b-485c-b27c-2313a9e9e45d" target="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web UI -&gt; Trade Service" ref="9fc94193-7abf-477c-98c6-f10816f3f9a4" source="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987" target="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Data Preparation for Artificial Intelligence Modeling -&gt; Build an Artificial Intelligence model" ref="ad8daa93-3310-4240-9fa2-d8a41037a35d" source="4f45bca0-5751-4558-8273-f3b5838931f8" target="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Build an Artificial Intelligence model -&gt; Deployment Setup" ref="eb95e61c-8b32-494c-9fa6-0185ebcbc5b1" source="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c" target="93188c58-de74-4bed-8fb8-21fe54a69945">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields>
-    <customField ref="qa_cf" value=""/>
-  </customFields>
-  <components>
-    <component uuid="d644ada8-e95a-4f79-a073-250c8e6d5ea3" diagramComponentId="bc49435e-629a-42dd-b661-19d3f22ab3c8" ref="33c42d7e-6bce-446e-ac2e-006b934959e6" name="API Endpoint - Broker site" desc="" library="IR-Functional-Components" parentComponentRef="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" componentDefinitionRef="CD-API-ENDPOINT">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures>
-        <countermeasure ref="CWE-285" name="Apply authorization checks to segregate and control access to user data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications protecting sensitive or otherwise restricted resources must ensure that only appropriate and authorized users can access the application data. It is important that an application prevent unauthorized users gaining inappropriate access to each other's data. Although user A and user B may both be trusted to access data within the application, they may be only authorized to access different subsets of the protected resources.&amp;nbsp; E.g. user A should not be able to access user B's personal data by manipulating a request (typical examples are the manipulation of an ID value or other object reference sent in the URL or body of an HTTP request).&lt;/p&gt;&lt;p&gt;It is not sufficient to rely on obscurity, for example obfuscated or secret URLs or filenames. The application must validate each request for protected data against the proven identity of the user. Before providing access to restricted resources the application must:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure the user has undergone appropriate authentication (identification and verification, or ID&amp;amp;V). E.g. they must have provided their identity and confirmed this with a password, token, or other verification. Typically this is done by checking the validity of the session token issued after login.&lt;/li&gt;&lt;li&gt;Confirm the user is authorized to access the data or resource they are requesting. E.g. their confirmed identify is checked against a server-side access control matrix to determine whether they may access the requested resource.&lt;/li&gt;&lt;li&gt;Access controls should be granular and make it possible to issue to individual resources to individual users or roles.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;URL and asset based access control is provided by most web-frameworks, and it is preferable to use an established and proven framework.&lt;/p&gt;&lt;p&gt;Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA CM-07 Least Functionality" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/158-08_02_CM-07"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.18" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.3" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="CM-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Using two different browsers configured with an intercepting proxy:&lt;/li&gt;&lt;li&gt;Login as user A in browser A.&lt;/li&gt;&lt;li&gt;Login as user B in browser B.&lt;/li&gt;&lt;li&gt;For every operation that displays sensitive data belonging to user A:&lt;ol&gt;&lt;li&gt;Perform the operation as user A and view their sensitive data.&lt;/li&gt;&lt;li&gt;Obtain the session ID of user B.&lt;/li&gt;&lt;li&gt;Configure the proxy to intercept.&lt;/li&gt;&lt;li&gt;Perform the operation as user A again, but this time intercept all the requests and replace user A's session ID with that of user B.&lt;/li&gt;&lt;li&gt;Ensure that user A's sensitive data is &lt;strong&gt;not &lt;/strong&gt;visible.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To ensure object-level authorization checks are in place:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.013">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.014">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-MINIMIZE-CLIENT-PROCESSING" name="Minimize the information that each client receives from the server side to accomplish its intended action" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Servers are often designed to send more data to the client than is really required, so it's necessary to send the minimum data from the server to the client. It's an easy way to send all information from server to client and then filter in the client's own, but this behaviour can lead to further data leak, in case that an attacker obtains this information, for example by intercepting requests or accessing the browser, so this could increase the risk of a future attack.&lt;/p&gt;&lt;p&gt;It is a good idea to have different endpoints that return different data, according to needs.&lt;/p&gt;&lt;p&gt;An example of bad code in JSP:&lt;/p&gt;&lt;p&gt;&lt;i&gt;Social Security Number: &amp;lt;%= ssn %&amp;gt;&amp;lt;/br&amp;gt;Credit Card Number: &amp;lt;%= ccn %&amp;gt;&lt;/i&gt;&lt;/p&gt;&lt;p&gt;This is a bad code, because it displays a user's credit card and social security numbers, even though they aren't absolutely necessary.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CWE-213: Exposure of Sensitive Information Due to Incompatible Policies" url="https://cwe.mitre.org/data/definitions/213.html"/>
-          </references>
-          <standards>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Use a proxy to pass browser requests through it and check the responses to see what data the server is sending. Can you get unnecessary data?&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Proxy can be replaced using DevTools from your browser.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.012">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.002">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.013">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
-          <threats>
-            <threat ref="CAPEC-180-BROKEN-ACCESS-CONTROL" name="An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the application" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An Access Control functionality often spans many areas of software depending on the complexity of the access control system. For example, managing access control metadata or building caching for scalability purposes are often additional components in an access control system that need to be built or managed. Vulnerabilities appear when a user is able to successfully request access to something they usually shouldn't have access to. Oftentimes this is found when the authorization is not implemented properly. A typical example would be a certain endpoint on a website that throws a 403 forbidden error which is then bypassed by adding an X-Forwarded-For: "127.0.0.1" header.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="CWE-285" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="security-logging" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-137-INJECTION" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Some of the most common types of injection attacks are SQL injections, cross-site scripting (XSS), code injection, OS command injection, host header injection, and more. A large part of vulnerabilities that exist in web applications can be classified as injection vulnerabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Scenario #1: An application uses untrusted data in the construction of the following vulnerable SQL call:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;String query = "SELECT * FROM accounts WHERE custID='' request.getParameter("id") + '';&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Scenario #2: Similarly, an application's blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)):&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;Query HQLQuery = session.createQuery("FROM accounts WHERE custID=' '+ request.getParameter("id") + "'");&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In both cases, the attacker modifies the 'id' parameter value in their browser to send: ' or '1'='1. For example:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;http://example.com/app/accountView?id=''or '1'='1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data, or even invoke stored procedures.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="DATA-VAL" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-157-DATA-DISCLOSURE" name="An attacker can inspect the HTTP responses using a proxy to access to sensitive information that is not directly visible in the client application" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;APIs retrieve necessary data from back end systems when client applications make an API call. However, most of the backend systems were not designed to handover the exact data that the client requested. Rather, the API serves more data than what is needed by the client and then a filtering mechanism is used in the client app code to mask or discard unwanted data. If an attacker launches the underlying API and examines the response patterns, they are able to access the redundant data which could contain sensitive information.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Besides returning excessive data records in response to a client request, an API may also expose certain references to the platform technologies used by the application. This allows hackers to look for vulnerabilities on such software and attack the system using that information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-MINIMIZE-CLIENT-PROCESSING" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="network-rate-limit" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="14f84dd5-8b27-4788-9739-5ff2afc3e156" diagramComponentId="f2888784-6abc-43c1-b7ba-0704fa9fa68e" ref="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c" name="Build an Artificial Intelligence model" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-MODEL-BUILD">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-MODEL-CHOICE" name="Carefully consider the model choice" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Models can be built using different approaches or algorithms. Overall, choosing the right algorithm depends on several factors, including business considerations, data size, accuracy, training time, parameters, and inference performance, among others.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;In general, the right choice is typically a combination of these aspects. In terms of security, however, the main algorithmic concern is about the nature of the data, where certain algorithms are more vulnerable to data leaks than others.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Depending on your privacy concerns, and/or compliance considerations, e.g., GPDR, &amp;nbsp;consider auditing the data privacy of the models under consideration, e.g., using tools like Privacy Meter.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Privacy Meter" url="https://github.com/privacytrustlab/ml_privacy_meter"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.769">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ROBUST-LEARNING" name="Consider robust learning and defenses against poisoning attacks for online models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Robustness verification, robust learning techniques, and other defenses against adversarial perturbations have become important aspects when developing an ML/AI model. Techniques for achieving robustness include adversarial training and learning techniques in the presence of outliers or noise. Robust statistics such as stochastic approximation approaches, which have shown to be robust against data poisoning attacks, e.g., training with stochastic gradient descent, is an example.&lt;/p&gt;
-&lt;p&gt;Depending on the domain area and the underlying ML/AI framework used, there are a number of tools that can help assess models against adversarial threats, including adversarial tampering. These include the Adversarial Robustness Toolbox, DeepRobust, or AutoAttack.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Adversarial Robustness Toolbox (ART)" url="https://adversarial-robustness-toolbox.readthedocs.io/en/latest/"/>
-            <reference name="Adversarial Robustness Tools" url="https://github.com/EthicalML/awesome-production-machine-learning#adversarial-robustness"/>
-            <reference name="Robust Machine Learning Models and Their Applications" url="https://dspace.mit.edu/bitstream/handle/1721.1/130760/1252059420-MIT.pdf?sequence=1&amp;isAllowed=y"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ENV-SETUP" name="Consider the right framework, model, and language for an application" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Setting up the right tool stack for your ML/AI projects is very important to work efficiently and be able to deliver results.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;The best ML/AI toolbox would include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Various flavors of Jupyter Notebooks which allow for quick experiments and visualization, and exchanging ideas between team members,&lt;/li&gt;
- &lt;li&gt;Appropriate IDEs with ease of use and possible connectivity with third-party platforms/clouds or useful extensions, e.g., Pycharm or Visual Studio,&lt;/li&gt;
- &lt;li&gt;Code and data versioning, e.g., Github, or Data Version Control (DVC),&lt;/li&gt;
- &lt;li&gt;The framework that provides the right functionality. Scikit-learn, R, TensorFlow, and PyTorch have been some of the favorites of ML/AI teams,&amp;nbsp; 
-  &lt;ul&gt;
-   &lt;li&gt;For more specialized areas, such as NLP or Computer Vision, more specialized frameworks and libraries exist such as Huggingface, Spacy, NLTK, Gensim, or OpenCV.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
- &lt;li&gt;For operationalizing models and managing their lifecycle, tools such as MLflow or Kubeflow are being used to manage ML/AI workflows and pipelines end-to-end.&lt;/li&gt;
- &lt;li&gt;In terms of larger and cloud-based platforms, Amazon SageMaker and Azure ML are the two biggest names. They provide fully-managed cloud services for predictive analytics&lt;/li&gt;
- &lt;li&gt;Running models in production and at scale also involves the language, the programming paradigm, and hosts: 
-  &lt;ul&gt;
-   &lt;li&gt;While most models are written in Python or R, these might be too slow for production models! Using faster languages such as C/C++ or Java might be a challenge.&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Use powerful hosts and parallel processing, e.g., Apache Spark, to perform iterative and heavy computational operations.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;The above only scratches the surface regarding what tools, libraries, and frameworks are available to build your model. &amp;nbsp;The landscape is also rapidly evolving. Make sure to consider the pros and cons of several alternatives before landing on a final solution.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Awesome Production Machine Learning - a curated list of tools to help setup ML/AI projects" url="https://github.com/EthicalML/awesome-production-machine-learning"/>
-            <reference name="Guidance and resources on building the right ML/AI platform - Neptune.ai's blog" url="https://neptune.ai/blog"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.018">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-EVALUATION-METRICS" name="Consider using data sets with well-known error rates for the model evaluation, in addition to well-established performance evaluation techniques" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When evaluating an ML/AI model for real-world uses, two fundamental questions arise: 1) Is the model good enough? and 2) Is it better than other alternatives?&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;To obtain reliable answers to these questions, special care should be taken in the process of selecting data, selecting and building the model, as well as the evaluation metrics used.&lt;/p&gt;
-&lt;p&gt;The validation/evaluation strategy of ML/AI models involves the following two main aspects:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Resampling methods, which are techniques of rearranging data samples to inspect if the model performs well. These include: 
-  &lt;ul&gt;
-   &lt;li&gt;Random Split,&lt;/li&gt;
-   &lt;li&gt;Time-Based Split,&lt;/li&gt;
-   &lt;li&gt;K-Fold Cross-Validation,&lt;/li&gt;
-   &lt;li&gt;Stratified K-Fold, and&lt;/li&gt;
-   &lt;li&gt;Bootstrap.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
- &lt;li&gt;Classification metrics, &amp;nbsp;including: 
-  &lt;ul&gt;
-   &lt;li&gt;Accuracy: sensitive to the sum of true positives+true negatives and to the total number of data points. Not sensitive to class imbalance.&lt;/li&gt;
-   &lt;li&gt;Precision: sensitive to true positives and false positives. Not sensitive to false negatives or true negatives.&lt;/li&gt;
-   &lt;li&gt;Recall: sensitive to true positives and false negatives. Not sensitive to false positives or true negatives.&lt;/li&gt;
-   &lt;li&gt;F-score: sensitive to true positives, false positives, and false negatives. Not sensitive to true negatives.&lt;/li&gt;
-   &lt;li&gt;Overlap: sensitive to the intersection and overlap of predicted and actual.&lt;/li&gt;
-   &lt;li&gt;Likelihood: sensitive to the probability that the model assigns to the test data.&lt;/li&gt;
-   &lt;li&gt;Distance: sensitive to the distance between the prediction and the actual value.&lt;/li&gt;
-   &lt;li&gt;Correlation: sensitive to each of true positives, true negatives, false positives, and false negatives, but unlike Accuracy metrics they factor in the degree of agreement that would be expected by chance.&lt;/li&gt;
-   &lt;li&gt;AUC: Does not rely on a specific classification threshold, but instead calculates the area under a curve parameterized by different thresholds.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Other measures include:&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Probabilistic measures, e.g., Akaike Information Criterion (AIC),&lt;/li&gt;
- &lt;li&gt;Regression metrics, e.g., Mean Squared Error or MSE, or&lt;/li&gt;
- &lt;li&gt;Clustering metrics, e.g., Elbow method.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The Ultimate Guide to Evaluation and Selection of Models in Machine Learning" url="https://neptune.ai/blog/ml-model-evaluation-and-selection"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PARAMETERS-PROTECTION" name="Perform sensitivity analyses and lock in the set of model parameters and hyperparameters" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Consider the following to assess and protect parameters and hyperparameters:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Mechanisms in place to protect and lock parameters and hyperparameters.&lt;/li&gt;
- &lt;li&gt;Sensitivity analysis to show how changes in model parameters affect model outputs.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Sensitivity Analysis Library" url="https://github.com/SALib/SALib"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-REPRESENTATION-ROBUSTNESS" name="Review the representation robustness" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Depending on the model used, randomization and encoding techniques have been proposed to potentially increase the resilience of models to adversarial attacks.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;For instance, assigning different encoded labels for each classifier in an ensemble structure has been shown to improve the classification performance on adversarial attacks. It has also been demonstrated that randomized defenses against adversarial attacks are more efficient than deterministic ones.&lt;/p&gt;
-&lt;p&gt;Representational robustness can manifest in decisions as basic as using word2vec embedding in an NLP system versus one-hot vector encodings, which can help combat some blind spot risks.&lt;/p&gt;
-&lt;p&gt;On the purely performance side, initialization strategies based on the properties of the statistical distribution of the data on which the models are trained have also been proposed.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data Driven Initialization for Machine Learning Classification Models" url="https://repository.urosario.edu.co/server/api/core/bitstreams/bb7de9d7-1410-49f2-a27f-70aaf4824dbe/content"/>
-            <reference name="Ensemble of Random Binary Output Encoding for Adversarial Robustness" url="https://ieeexplore.ieee.org/document/8813035"/>
-            <reference name="Randomization matters - How to defend against strong adversarial attacks" url="https://dl.acm.org/doi/pdf/10.5555/3524938.3525653"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.771">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-CATASTROPHIC-FORGETTING" name="Use strategies to counter potential catastrophic forgetting" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Consider using mechanisms to counter potential catastrophic forgetting, such as:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Complement the model with a memory storing previous information, for example, by using memory replay to consolidate internal representations,&lt;/li&gt;
- &lt;li&gt;Train the network while regularizing, and&lt;/li&gt;
- &lt;li&gt;Expand the model if necessary to represent new tasks.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Learn, don’t forget: constructive methods for effective continual learning" url="https://upcommons.upc.edu/bitstream/handle/2117/374177/thesis%20Aitor%20Ganuza.pdf?sequence=1&amp;isAllowed=y"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.017">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-CATASTROPHIC-INTERFERENCE" name="Models may be subject to catastrophic interference" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;A model is subject to abruptly and drastically forgetting previously learned information upon learning new information. Nowadays, this is more of an issue with autonomous and continuous learning, i.e., without any humans in the loop.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="75" easeOfExploitation="50"/>
-              <references>
-                <reference name="Continual Learning of Natural Language Processing Tasks: A Survey" url="https://arxiv.org/pdf/2211.12701.pdf"/>
-                <reference name="Overcoming catastrophic forgetting in neural networks" url="https://www.pnas.org/doi/10.1073/pnas.1611835114"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-CATASTROPHIC-FORGETTING" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-MANIPULATE-ONLINE-SYSTEM" name="An adversary may be able to manipulate an online learning system" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Online models continue to learn during operations. This might lead to a drift from the initial purpose or use case. Attackers might be able to lead the system in the wrong direction with specially crafted data, a.k.a data poisoning.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="75"/>
-              <references>
-                <reference name="Concealed Data Poisoning Attacks on NLP Models" url="https://aclanthology.org/2021.naacl-main.13.pdf"/>
-                <reference name="ML Attack Models: Adversarial Attacks and Data Poisoning Attacks" url="https://arxiv.org/ftp/arxiv/papers/2112/2112.02797.pdf"/>
-                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
-                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ROBUST-LEARNING" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-DATA-REPRESENTATION" name="Adversaries may exploit algorithmic leakage or data representation issues to extract data or attack the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Some algorithms are unsuited for processing confidential information. The choice of an algorithm should take into account the nature of the input data as well as how the algorithm represents and store the training data.&lt;/p&gt;
-&lt;p&gt;On the other hand, the model initialization and data representation might have an effect on how to defend against strong adversarial attacks.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="Confidential machine learning on untrusted platforms: a survey" url="https://cybersecurity.springeropen.com/articles/10.1186/s42400-021-00092-8"/>
-                <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
-                <reference name="Machine Learning with Confidential Computing: A Systematization of Knowledge" url="https://arxiv.org/pdf/2208.10134.pdf"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-REPRESENTATION-ROBUSTNESS" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-SCALABILITY-ISSUES" name="Models may be subject to failures due to scalability issues" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;The algorithm may not scale in performance in the real world, e.g., prediction time might be too important compared to the rate at which input data comes in. This might lead to denial of service situations.&lt;/p&gt;
-&lt;p&gt;There are a number of challenges in the way of scaling and accelerating ML/AI workloads:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Getting feature engineering right, while especially having in mind how they could be efficiently calculated and continuously monitored in production,&lt;/li&gt;
- &lt;li&gt;The tools and setup, especially in terms of programming language, processing power (single machine or distributed computing), and deployment technologies (e.g., containerization),&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;The maintenance of the model over time as it will need frequent fine-tuning and retraining, which might also be time-consuming and computationally expensive.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="How to Scale ML Projects – Lessons Learned from Experience" url="https://neptune.ai/blog/how-to-scale-ml-projects"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ENV-SETUP" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-EVALUATION-ISSUES" name="Models may be subject to overfitting, or bad evaluation sets" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;A number of risks must be considered when evaluating models' performance, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Overfitting: one of the most prevalent issues in ML/AI systems. This means the model is excellent with training data but does not generalize well.&lt;/li&gt;
- &lt;li&gt;Bad evaluation data: does test data reflect the data expected in production?&lt;/li&gt;
- &lt;li&gt;Bad upstream data: as the expression goes, "garbage in, garbage out". Issues in data upstream make both training and subsequent evaluation difficult.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Note that evaluation might be motivated by various stakeholder perspectives and interests. Always optimizing for the most common static tests would fail to account for the changes in societal, linguistic, and other relevant factors of the ecosystem and the application at hand. Make sure you validate that the metrics you selected properly measure what you are trying to achieve.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="Evaluation Gaps in Machine Learning Practice" url="https://arxiv.org/abs/2205.05256"/>
-                <reference name="What Is Overfitting?" url="https://www.ibm.com/topics/overfitting"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-EVALUATION-METRICS" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-MANIPULATE-PARAMETERS" name="An adversary may be able to manipulate model parameters or hyperparameters" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;ML/AI systems have a number of parameters and hyperparameters that might not be easy to understand or comprehensively test. Setting up and tuning models can be regarded as more of a black art than actual science, which make them subject to attacker influence.&lt;/p&gt;
-&lt;p&gt;If an attacker can manipulate either the hyperparameters (used to control the learning process) or the parameters (learned by the model to map the input into the desired output), this will have a devastating effect on the performance and reliability of the ML/AI model.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PARAMETERS-PROTECTION" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="50939219-14a2-4311-b44f-a032b5efc0ec" diagramComponentId="ab4d129d-db94-4614-8cf8-d6b8c7d0b8ae" ref="4f45bca0-5751-4558-8273-f3b5838931f8" name="Data Preparation for Artificial Intelligence Modeling" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-DATA-PREPARATION-FOR-AI-MODEL">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.653">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-359" name="Exposure of Private Information ('Privacy Violation')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.653">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.652">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores sensitive information without properly limiting read or write access by
-                        unauthorized actors.
-                        If read access is not properly restricted, then attackers can steal the sensitive information.
-                        If write access is not properly restricted, then attackers can modify and possibly delete the
-                        data, causing incorrect results and possibly a denial of service.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.323">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.322">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-AVOID-DIRECT-LOOPING" name="Avoid direct loops in the data pipeline" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A beneficial feedback loop typically involves bringing in unbiased, external information into your system, which would ensure that, over time, the models do not degrade due to being retrained on biased data that is strongly correlated to the outputs and does not reflect the true data distribution.&lt;/p&gt;
-&lt;p&gt;Human-in-the-loop, or human-on-the-loop (only holding overall control over the system), are generally good ideas in ML/AI systems.&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Human-in-the-Loop in Machine Learning: A Handful of Arguments in Favor" url="https://labelyourdata.com/articles/human-in-the-loop-in-machine-learning"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-REDUNDANCY" name="Build and maintain redundant data streams" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Avoid central points of failure or compromise for all critical components of your system including the data stream.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Internally, this involves network pathway, power, geographic, and data redundancy, and can even be extended to individuals, i.e., key staff looking after the data pipeline!&lt;/p&gt;
-&lt;p&gt;In addition, when possible, avoid 'vendor lock-in' and consider alternative data sources.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PROTECT-SOURCES" name="Carefully select and protect data sources when possible" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When selecting data sources, their security (availability and integrity, and possibly confidentiality) is of paramount importance. This involves:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Analyze the source, e.g., reputation,&lt;/li&gt;
- &lt;li&gt;Evaluate the data quality,&lt;/li&gt;
- &lt;li&gt;Verify the data formats and accessibility options,&lt;/li&gt;
- &lt;li&gt;Verify the reliability of the data, including in terms of their security aspects, as well as legitimacy and biases,&lt;/li&gt;
- &lt;li&gt;Verify the security of the data source, e.g., compliance with security standards and regulations.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to find reliable data sources" url="https://earlygrowthfinancialservices.com/blog/how-to-find-reliable-data-sources/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-MODEL-SELECTION" name="Consider model selection techniques for more reliable and reproducible inference and predictions" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Model selection in ML/AI is the process of selecting the best algorithm and model architecture for a specific job and/or data. It entails assessing and contrasting various models to identify the one that best fits the data at hand and produces the best results.&lt;/p&gt;
-&lt;p&gt;This involves some testing with modeling, as opposed to only relying on the characteristics of the data itself. Selection techniques include model performance comparisons with measurements such as the F-score, accuracy, precision, recall, or the area beneath the receiver's operating characteristic curve (AUC-ROC). Several model performance and validation strategies are used to assess each model's generalization, including sampling and splitting techniques.&lt;/p&gt;
-&lt;p&gt;Note that the selection step is a must even though it increases the computational cost and time, such as cross-validation for instance, which requires training and testing multiple times with varied parameters.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Model selection for machine learning" url="https://www.scholarhat.com/tutorial/machinelearning/model-selection-for-machine-learning"/>
-            <reference name="The Ultimate Guide to Evaluation and Selection of Models in Machine Learning" url="https://neptune.ai/blog/ml-model-evaluation-and-selection"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" name="Consider possible trojanized versions when acquiring shared models" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Never assume what you are downloading is safe! Malicious actors often use trojanized versions of popular applications in an effort to steal information and compromise systems.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;In this case, you might be fine-tuning a model with possibly a Trojan that includes sneaky behavior that is unanticipated.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Basic practices include carefully checking the source of the model, as well as using cryptographic methods like digital signatures and secure hashes to verify the authenticity and file integrity.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Verify Downloaded Files" url="https://www.digitalocean.com/community/tutorials/how-to-verify-downloaded-files"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" name="Consider potential privacy issues such as de-identification early on" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Consider how sensitive the input data is and how to protect it early on in the design and model development process. Best practices include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;De-identification and removal of PII (Personal Identifiable Information) in the training data,&lt;/li&gt;
- &lt;li&gt;Obfuscation, or other techniques that might reduce the exposure of the data later on, including randomized/shuffled data, regularization, or restricting/reducing the training sets.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;One example of data anonymization technique used to protect individual privacy in a dataset is k-anonymization. &amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Example tool: ARX Data Anonymization" url="https://github.com/arx-deidentifier/arx"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-TEST-PACKAGES" name="Consider the security of the data and model supply chain" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In addition to inherent modelization risks, there are additional ones associated with security engineering, software security, and supply chain security. These include trojanization or backdooring of base models or other packages.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Understand and maintain the full list of dependencies and harden the verification and patching pipelines. &amp;nbsp;Consider the following:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Verification of digital signatures/ cryptographic hashes,&lt;/li&gt;
- &lt;li&gt;Use secure repos,&lt;/li&gt;
- &lt;li&gt;Keep packages up-to-date,&lt;/li&gt;
- &lt;li&gt;Use segregated virtual environments,&lt;/li&gt;
- &lt;li&gt;Perform regular code reviews of packages and libraries,&lt;/li&gt;
- &lt;li&gt;Use package verification tools, and&lt;/li&gt;
- &lt;li&gt;Educate users.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure at every step: What is software supply chain security and why does it matter?" url="https://github.blog/2020-09-02-secure-your-software-supply-chain-and-protect-against-supply-chain-threats-github-blog/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-DATA-VERSION-CONTROL" name="Consider using version control to manage datasets" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data versioning should be treated in the same manner as code versioning.&lt;/p&gt;
-&lt;p&gt;There exist several data version control libraries such as DVC which is dedicated to ML/AI data and systems or lakeFS which provides a Git-like functionality for data using S3 or Google Cloud Storage (GCS).&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="(Not Just) Data Version Control" url="https://dvc.org/"/>
-            <reference name="Best 7 Data Version Control Tools That Improve Your Workflow With Machine Learning Projects" url="https://neptune.ai/blog/best-data-version-control-tools"/>
-            <reference name="Model and Data Versioning" url="https://github.com/EthicalML/awesome-production-machine-learning#model-and-data-versioning"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
-&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.580">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PROPER-SLICING" name="Ensure the split data originate from similar data with careful consideration for overlaps" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Make sure that the training, validation, and test sets are 'the same' from data integrity, trustworthiness, and mathematical perspectives.&lt;/p&gt;
-&lt;p&gt;Too much overlap or similarity between these sets may lead to overfitting. By contrast, when the evaluation set is too different from the eventual future inputs during operations, it will not measure the true performance.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Use best practices, including when using built-in methods within your favorite ML/AI framework.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Splits and Slicing (TensorFlow)" url="https://www.tensorflow.org/datasets/splits"/>
-            <reference name="Train Test Validation Split: How To &amp; Best Practices" url="https://www.v7labs.com/blog/train-validation-test-set"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" name="Harden the data and feedback pipeline" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data pipelines are at the heart of building a robust data practice. It includes the processing of the data, triggering model retraining, notifying when feedback/ metric is received/ reached, etc.&lt;/p&gt;
-&lt;p&gt;When considering data and feedback collectors in a production environment, there are several aspects to ensure the security of the deployment. Best practices and considerations include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Secure encrypted end-to-end communication,&lt;/li&gt;
- &lt;li&gt;User identity management,&lt;/li&gt;
- &lt;li&gt;Secure credentials,&lt;/li&gt;
- &lt;li&gt;Audit and log activities,&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Limit the exposure of the automation stages, e.g., scripts that perform data and feedback transformations,&lt;/li&gt;
- &lt;li&gt;Secure storage, and&lt;/li&gt;
- &lt;li&gt;Secure streaming system and pipeline.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Depending on your use case and infrastructure, you will have several options for data orchestration, including cloud-based options, such as AWS Glue or Azure Data Factory, among others.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Building a secure data pipeline in AWS Glue" url="https://docs.aws.amazon.com/whitepapers/latest/aws-glue-best-practices-build-secure-data-pipeline/building-a-secure-data-pipeline.html"/>
-            <reference name="Security considerations for data movement in Azure Data Factory" url="https://learn.microsoft.com/en-us/azure/data-factory/data-movement-security-considerations"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.580">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-IDENTIFY-BIAS" name="Identify potential bias in the data" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Measuring and mitigating the effects of potential biases and discriminatory patterns in the data is an important step to make ML/AI models fairer, especially in socially sensitive decision processes.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Bias Testing for Generalized Machine Learning Applications" url="https://github.com/pymetrics/audit-ai"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.030">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-MAINTAIN-QUALITY" name="Maintain data quality and integrity during data pre-processing" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintaining data quality is an essential practice when developing ML/AI models. This allows for a reliable data pipeline, including the data cleaning and feature engineering steps.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Developers might not always be aware of best practices for preparing or transforming the data for a given model type, which can lead to suboptimal representations of input features.&lt;/p&gt;
-&lt;p&gt;Many data issues can be identified with some lightweight automation. Some examples include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Numerical features on widely differing scales,&lt;/li&gt;
- &lt;li&gt;Values assigned special meanings, e.g., to represent missing data,&lt;/li&gt;
- &lt;li&gt;Malformed values of special string types, such as dates.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;This is far from being an exhaustive list. A schema or a set of constraints should be defined for this data validation step, which would depend on the initial data, how it is expected to evolve, and the model type.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Deequ - Unit Tests for Data" url="https://github.com/awslabs/deequ"/>
-            <reference name="The Data Linter: Lightweight, Automated Sanity Checking for ML Data Sets" url="http://learningsys.org/nips17/assets/papers/paper_19.pdf"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.031">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-MONITOR-DATA-DRIFT" name="Monitor for data drift, especially for new data and online models" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data drift is a type of model drift where the properties of the independent variables change, i.e., input distribution changes.&lt;/p&gt;
-&lt;p&gt;There are some basic monitoring measures to consider, including the use of statistical tests over time:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Compare the cumulative distributions of the initial training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Measure how a variable distribution changes, e.g., Population stability Index,&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Compare the feature distribution between the training data and post-training data, e.g., Z-score.&lt;/li&gt;
- &lt;li&gt;Compute the observed values and their mean, compared to a threshold value, e.g., the Page-Hinkley test.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;There are libraries and built-in verification and validation methods in ML/AI frameworks, such as TensorFlow for instance.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Frouros: A Python library for drift detection" url="https://arxiv.org/pdf/2208.06868.pdf"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.031">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-INPUT-MANIPULATION" name="Protect input from manipulation and poisoned data samples" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Always ensure that the training data is validated and verified before it is used to train the model. This involves the following considerations:&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Ensure that the data pipeline is properly managed and secure enough, e.g., versioning and security controls such as access control,&lt;/li&gt;
- &lt;li&gt;Secure storage,&lt;/li&gt;
- &lt;li&gt;Data monitoring, e.g., for changes in the data distribution, and&lt;/li&gt;
- &lt;li&gt;Logging and auditing.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-CONSISTENT-REPRESENTATION" name="Reviews of data representations, periodic validation, as well as future featurization options for the data being collected so that it is consistently represented" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Experimentations in the literature have revealed a strong correlation between data consistency and the performance of the ML/AI model. The following is helpful to maintain a consistent representation of the data throughout the ML/AI system lifecycle:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Measure the consistency of the labels assigned to similar items,&lt;/li&gt;
- &lt;li&gt;Detect issues such as low-quality/ambiguous examples or non-IID (independent and identically distributed) sampling,&lt;/li&gt;
- &lt;li&gt;Periodic automated validation to detect labeling errors, duplicates, outliers, etc.,&lt;/li&gt;
- &lt;li&gt;Account for possible changes in the data and alternatives on how to featurize it, and&lt;/li&gt;
- &lt;li&gt;Ensure data integrity while processing and migrating the data, over the network or into a new schema, for instance.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;There exist tools around aspects like labeling or validation that can help further automate and speed up the process. Additionaly, consider the use of frameworks for creating portable and production-ready ML/AI pipelines.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Argilla - MLOps for NLP: from data labeling to model monitoring" url="https://github.com/argilla-io/argilla"/>
-            <reference name="Cleanlab: clean data and labels by automatically detecting issues in a ML dataset" url="https://github.com/cleanlab/cleanlab"/>
-            <reference name="Model Training Orchestration" url="https://github.com/EthicalML/awesome-production-machine-learning#model-training-orchestration"/>
-            <reference name="TensorFlow Data Validation" url="https://github.com/tensorflow/data-validation"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-SECURE-STORAGE" name="Secure data storage" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Take measures to protect storage resources and the data stored on them, both on-premises and externally, e.g., on the cloud. This involves:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Access control to regulate who can use the data. The environment should identify, verify, and authorize a user before they access the data. Additional policies can dictate where the data can be copied and under which conditions.&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Storage encryption, which can be built in by the service provider. Otherwise, on-premise encryption should be considered.&lt;/li&gt;
- &lt;li&gt;Isolate data from other systems and networks.&lt;/li&gt;
- &lt;li&gt;Immutable storage as an extra protection layer that can help prevent bad actors from tampering with data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-SECURE-TRANSFER" name="Secure data transfer" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When data transfer is needed, various secure methods can be employed, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;SSH&lt;/li&gt;
- &lt;li&gt;SSL/TLS&lt;/li&gt;
- &lt;li&gt;VPN&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Also, do not forget to have a backup of your data before starting any migration process.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-VALIDATE-DATA" name="Validate data algorithmically before feeding it into the data pipeline" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Maintaining data quality is an essential practice when developing ML/AI models.&lt;/p&gt;
-&lt;p&gt;Best practices for monitoring and validating the data include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Consistent scale across the data variables,&lt;/li&gt;
- &lt;li&gt;Data balancing to remove bias,&lt;/li&gt;
- &lt;li&gt;Data sensitivity tests,&lt;/li&gt;
- &lt;li&gt;Outliers recognition,&lt;/li&gt;
- &lt;li&gt;Common statistical checks such as data sparseness or variance, etc. including for assessing the data representativeness for the target application,&lt;/li&gt;
- &lt;li&gt;Checking against the restrictions as to how the acquired data can be used,&lt;/li&gt;
- &lt;li&gt;Others, such as the validity of characters in text, or the correlation between variables, etc.&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;These might also depend on the domain area and target modeling.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Data Validation Tool" url="https://github.com/GoogleCloudPlatform/professional-services-data-validator"/>
-            <reference name="TensorFlow Data Validation" url="https://github.com/tensorflow/data-validation"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-DATA-POISONING" name="An adversary may be able to manipulate training data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Data is subject to poisoning whereby attackers may intentionally inject malicious data to cause ML/AI training to go awry.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Data engineers should consider what training data in their pipeline an attacker might be able to control and to what extent.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-INPUT-MANIPULATION" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-CHANGING-DATA" name="Changing data distribution and properties will affect the performance of the future model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;How the data will evolve over time is an important aspect to consider early on, which might affect pre-processing steps, as well as the future model behavior.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-MONITOR-DATA-DRIFT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-RAW-POISONING" name="Data sources may be unreliable due to data poisoning" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Data poisoning is one of the main concerns in adversarial ML/AI. It involves the intentional supply of wrong or misleading data to impact the quality of ML/AI models. The manipulation of the data is aimed at controlling the behavior of the model and delivering false results.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PROTECT-SOURCES" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-DATA-PRE-PROCESSING" name="Data encoding, normalization, filtering, feature selection, and annotation, may all introduce biases or affect the predictive and generalization qualities of the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Raw data needs to be properly pre-processed in order to be processed by a learning algorithm. It will impact both the performance and security of the future ML/AI model. Important aspects to take into consideration are:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Feature discovery/engineering: transforming raw data into features that are easier to interpret and feed into the ML/AI model. This mostly relies on the type of data.&lt;/li&gt;
- &lt;li&gt;Encoding: both data and feature encoding should be carefully considered, e.g., to avoid information loss.&lt;/li&gt;
- &lt;li&gt;Normalization: essentially to use a common scale throughout the data.&lt;/li&gt;
- &lt;li&gt;Partitioning: care must be taken when creating data partitions.&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Other data manipulation or helpers: such as data filters or randomness, which plays an important role in stochastic systems.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="A Comprehensive Guide to Data Preprocessing" url="https://neptune.ai/blog/data-preprocessing-guide"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-IDENTIFY-BIAS" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-MAINTAIN-QUALITY" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-UNRELIABLE-SOURCES" name="Data sources may be biased, unbalanced, not representative or properly encoded, or even include copyrighted or illegal material" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Multiple issues can occur with raw input data, including:&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Bias, which can have ethical and moral implications,&lt;/li&gt;
- &lt;li&gt;Imbalance, which reflects unequal distributions of classes within the dataset and will likely result in unstable models and poor performance (biased towards the overrepresented class),&lt;/li&gt;
- &lt;li&gt;Encoding and transformation, which might result in information loss, errors, or inconsistencies,&lt;/li&gt;
- &lt;li&gt;Representativity, which might not have proper coverage or distribution of the target population, and&lt;/li&gt;
- &lt;li&gt;Legality, such as copyrighted material or non-compliance with regulation, e.g., GDPR.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-VALIDATE-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-INPUT-INFERENCE" name="An adversary may be able to conduct input inference attacks later on to get information from training data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Data engineers should keep in mind that inference attacks are one of the most widespread attacks on ML/AI systems, and plan for it early on. The goals of these attacks are espionage and confidentiality.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;There are a number of inference attack types, including input inference. These attacks extract data from the training dataset, which represents a big issue in terms of privacy and GDPR compliance for instance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="ML04:2023 Membership Inference Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML04_2023-Membership_Inference_Attack.html"/>
-                <reference name="Membership Inference Attacks on Machine Learning: A Survey" url="https://arxiv.org/pdf/2103.07853.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-359">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-LACK-VERSION-CONTROL" name="Insufficient or lack of version control of the data can disrupt the system and lead to inconsistencies and failures" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Insufficient or lack of version control carries multiple risks including working from the wrong data, losing previous states and creating rework, &amp;nbsp;and increasing the risk of inconsistencies, errors, or even total failures of the system without the possibility of rolling back to older data/versions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Why Use a Version Control System?" url="https://www.git-tower.com/learn/git/ebook/en/desktop-gui/basics/why-use-version-control"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-DATA-VERSION-CONTROL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-INSECURE-STORE-TRANSFER" name="Data confidentiality and integrity can be jeopardized by an adversary taking advantage of data that is insecurely stored or managed" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Data sources that are not sufficiently protected might be manipulated or poisoned, whether at rest or during transfers.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-SECURE-TRANSFER" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-922">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-SECURE-TRANSFER" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-FEATURE-ENGINEERING" name="Consider how feature engineering and data representations and encodings might impact the future system output" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Data transformation into features, i.e., in a form that can be easily digested and interpreted by the ML/AI algorithm, is a key aspect in building performant and secure models.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;This involves a number of steps, including feature extraction and encoding, and a number of transformations such as dealing with missing values. Care must be taken early on to build a featurization pipeline that is likely to result in more robust systems.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="Feature Engineering" url="https://www.kaggle.com/learn/feature-engineering"/>
-                <reference name="Robust Feature Alignment (an example from image classification)" url="https://github.com/safreita1/unmask"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-CONSISTENT-REPRESENTATION" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-DISABLED-DATA-SOURCES" name="An adversary may target and disable data sources that the system depends on" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Beyond data integrity, confidentiality, and quality; availability is of critical importance, especially when it comes to public data sources.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Data sources, which might be used both during training and post-deployment, can be vulnerable to attacks, including denial of service type of attacks.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references>
-                <reference name="Understanding Denial-of-Service Attacks" url="https://www.us-cert.gov/ncas/tips/ST04-015"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-REDUNDANCY" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-DATA-SIMILARITY" name="(Di)similarity in training, test, and validation sets can result in overfitting, wrong evaluations, or simply erroneous models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;If the training, validation, and test sets are not similar from a data integrity, trustworthiness, and mathematical perspective, the model cannot be properly assessed and will ultimately exhibit poor behavior when it is fielded.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PROPER-SLICING" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-RAW-DATA-PROPERTIES" name="Raw data properties affect the design, selection, and outputs of ML/AI models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Have you properly vetted the data being considered, including how it matches the algorithm under consideration? Data properties and quality should be a major consideration in order to reduce the impact of 'garbage in, garbage out'. Is the data fit to serve its purpose in the context of future modeling, i.e., the considered ML/AI technique?&lt;/p&gt;
-&lt;p&gt;'Summarized' data via its statistical characteristics, as well as visualization, can be useful to select appropriate cleaning, feature processing, and modeling techniques.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-MODEL-SELECTION" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-LOOPING" name="For future online systems, they may be exposed to using their own output as input data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;There may be unexpected behavior if data output from the future model is directly used as input, which is referred to as looping.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-AVOID-DIRECT-LOOPING" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-MODEL-SKEWING" name="An adversary may be able to slowly retrain the system with malicious introductions" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;In an online system, an attacker might be able to slowly 'retrain' the system to shift its behavior in unintended directions. This might happen if an attacker compromises the feedback loop in the model lifecycle, e.g., MLOps system.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML08:2023 Model Skewing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML08_2023-Model_Skewing.html"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-BACKDOORING" name="An adversary may be able to use a base model or an underlying package as a means of attack ('backdooring')" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;If the model is not built from scratch, consider the possibility that the base models might be trojanized. Adversaries may introduce a backdoor by training the model with poisoned data, or injecting a payload into the model.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;The aim is that the model learns to associate an adversary trigger with the adversary's desired output.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="ML06:2023 Corrupted Packages" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML06_2023-Corrupted_Packages.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="33"/>
-                <countermeasure ref="C-ML-AI-TEST-PACKAGES" mitigation="33"/>
-                <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="34"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="df5de558-aa4f-48e5-9a04-6717f7d8e65f" diagramComponentId="21d0de4b-97fc-4446-b0dc-f07be2e5d903" ref="93188c58-de74-4bed-8fb8-21fe54a69945" name="Deployment Setup" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-DEPLOYMENT-SETUP">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-799" name="Improper Control of Interaction Frequency" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly limit the number or frequency of interactions that it has with
-                        an actor, such as the number of incoming requests.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;This can allow the actor to perform actions more frequently than expected. The actor
-                        could be a human or an automated process such as a virus or bot. This could be used to cause a
-                        denial of service, compromise program logic (such as limiting humans to a single vote), or other
-                        consequences. For example, an authentication routine might not limit the number of times an
-                        attacker can guess a password. Or, a web site might conduct a poll but only expect humans to
-                        vote a maximum of once a day.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.737">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-799: Improper Control of Interaction Frequency" url="https://cwe.mitre.org/data/definitions/799.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.733">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-PROTECT-DEPLOYMENT" name="Consider possible defenses at the deployment stage to secure the outputs or the model" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There is an increasing demand for privacy-preserving techniques in ML/AI, at all levels, from training to inference. While there is no silver bullet when it comes to achieving privacy in ML/AI, certain mechanisms can be used to further secure the outputs or the model, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Obfuscation, e.g., especially for shipped/on-device models, as opposed to remote or cloud-hosted models,&lt;/li&gt;
- &lt;li&gt;Encryption, e.g., homomorphic encryption where training, inference, and output can be based on/generate encrypted data,&lt;/li&gt;
- &lt;li&gt;Decentralizes the data, such as with federated machine learning that strengthens both input and output privacy,&lt;/li&gt;
- &lt;li&gt;Added noise or the use of regularization which has been shown to strengthen anonymization without compromising model accuracy.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;A number of ML/AI tools have now integrated privacy-preserving mechanisms such as Tensorflow or PyTorch. There are also tools dedicated to model deployment that can offer security and monitoring features, such as Seldon Core or Evidently.&lt;/p&gt;
-&lt;p&gt;In addition to ML/AI-specific solutions, data engineering solutions can also contribute to supporting output and model privacy. These include strong authentication, authorization, and proxy/token-based access to inference.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Model Serving and Monitoring" url="https://github.com/EthicalML/awesome-production-machine-learning#model-serving-and-monitoring"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
-&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-RECOVERY" name="Models in production should be able to recover to a known state, reset, or be 'cleaned' if necessary" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Make sure to have a failover mechanism and a business continuity plan. Best practices include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Manage your code base locally, backed by a remote repository,&lt;/li&gt;
- &lt;li&gt;Backup all data, including generated versioned models, important notebooks, and any configuration files,&lt;/li&gt;
- &lt;li&gt;Automate (script out) deployments, and&lt;/li&gt;
- &lt;li&gt;Make use of geo-replication for data storage/accounts if you are using your own deployment setup on a Cloud platform.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Disaster Recovery: Best Practices" url="https://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-453495.pdf"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-MONITOR-DRIFT" name="Monitor for model drift by continuously tracking the model's performance metrics in production" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Model drift detection is an active research field. New methods are continuously being proposed in the literature. There are, however, some basic monitoring measures to consider, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Continually monitoring the accuracy of the model when possible, e.g., using F-score,&lt;/li&gt;
- &lt;li&gt;Use statistical tests to: 
-  &lt;ul&gt;
-   &lt;li&gt;Compare the cumulative distributions of the training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Measure how a variable distribution has changed over time, e.g., Population stability Index, or&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Compare the feature distribution between the training and live data, e.g., Z-score.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Addressing model drift would then involve setting up the right schedule to retrain your model.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Drift detection in the literature - sciencedirect" url="https://www.sciencedirect.com/topics/computer-science/concept-drift-detection"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" name="Restrict the number of model queries" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Define a resource access policy especially to limit the size and frequency of user queries. There are different ways that you can approach rate limiting, especially for APIs. This would involve:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limits focused on controlling traffic from individual sources and making sure that users are staying within their prescribed limits, and&lt;/li&gt;&lt;li&gt;Global limits in relation to all the traffic coming into the system from all sources, and ensure that the overall rate limit (e.g., tested capacity of the system or what makes sense with regard to the model's task) is not exceeded.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Ideally, both are used to secure the system, including against denial of service attacks.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-SECURE-STORAGE" name="Secure data storage" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Take measures to protect storage resources and the data stored on them, both on-premises and externally, e.g., on the cloud. This involves:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Access control to regulate who can use the data. The environment should identify, verify, and authorize a user before they access the data. Additional policies can dictate where the data can be copied and under which conditions.&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Storage encryption, which can be built in by the service provider. Otherwise, on-premise encryption should be considered.&lt;/li&gt;
- &lt;li&gt;Isolate data from other systems and networks.&lt;/li&gt;
- &lt;li&gt;Immutable storage as an extra protection layer that can help prevent bad actors from tampering with data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.651">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" name="Sufficiently isolate production models, with proper security controls and monitoring" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;ML/AI models are exposed by nature. The following should be considered when deploying models to production:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Host segregation to allow for more efficient monitoring,&lt;/li&gt;
- &lt;li&gt;Host protections, e.g., using endpoint security solutions,&lt;/li&gt;
- &lt;li&gt;Secure configuration and proper maintenance, e.g., patch/vulnerability management,&lt;/li&gt;
- &lt;li&gt;Proper access control, and&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Minimal exposure of services.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;On the other hand, the user should have a clear understanding of his/her responsibility when using third parties hosted MLOps tools / MLaaS (Machine Learning as a Service) offerings to develop and deploy ML/AI models.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Model Serving and Monitoring" url="https://github.com/EthicalML/awesome-production-machine-learning#model-serving-and-monitoring"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-HOST-COMPROMISE" name="An adversary may be able to exploit the host of the ML/AI system" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Where and how is the model deployed and operating? Attackers might target host servers that are not sufficiently isolated and protected.&lt;br&gt;Note that there is a plethora of tools and platforms (MLOps tools) that are used for model development, deployment, and monitoring (cf. examples in the below reference). This will involve a shared responsibility model with the provider.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="75"/>
-              <references>
-                <reference name="MLOps landscape" url="https://neptune.ai/blog/mlops-tools-platforms-landscape"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-GARBAGE-DATA" name="Spamming the system with garbage data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Adversaries may spam the system with data to produce output noise. This may also affect the model behavior in the long run.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-799">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-EXTRACTION" name="An adversary may be able to conduct input inference or model inversion/extraction attacks" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Extraction attacks are quite common and are one of the simplest forms of privacy leakage for ML/AI models. Also called 'inference attacks' or 'model inversion'.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;An attacker might be able to extract details of the data corpus the model was trained on, the inputs (e.g., inferring sensitive data features/input from publicly available results of a model), or the model itself by uncovering its behavior and parameters. This might have serious privacy implications.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="ML03:2023 Model Inversion Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML03_2023-Model_Inversion_Attack.html"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PROTECT-DEPLOYMENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-ERRONEOUS-MODEL" name="An adversary may be able to manipulate online production models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Online production systems are subject to manipulation or complete shutdown by an ill-intentioned actor, or any other error or failure. Manipulation of online models might involve data provenance and integrity that results in model drift.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references>
-                <reference name="Plan for business continuity and resilience" url="https://www.ready.gov/it-disaster-recovery-plan"/>
-                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-MONITOR-DRIFT" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-RECOVERY" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-MODEL-STEALING" name="An adversary may be able to steal the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;An attacker may be able to gain access to the model itself or the model's parameters, including via an environment breach. The attacker can use this information to recreate the model.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML05:2023 Model Stealing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML05_2023-Model_Stealing.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="50"/>
-                    <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="afe71945-8447-45e8-9bec-e8289a74c114" diagramComponentId="e2420090-9deb-49db-8759-61354a6c47de" ref="c80c37c8-4b1a-45e7-95c3-6005285c2b88" name="Model outputs" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-MODEL-OUTPUTS">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-300" name="Channel Accessible by Non-Endpoint ('Man-in-the-Middle')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Inadequate or inconsistent verification may result in insufficient or incorrect identification of either communicating entity. This can have negative consequences such as misplaced trust in the entity at the other end of the channel. An attacker can leverage this by interposing between the communicating entities and masquerading as the original entity. In the absence of sufficient verification of an identity, an attacker could potentially eavesdrop and modify &amp;nbsp;communication between the original entities.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.280">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-EXPLAINABILITY" name="Consider improving and providing explainability" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Allowing users to comprehend and trust the results of the model does not only help transparency, but the overall security of the system as well.&amp;nbsp;&lt;br&gt;Certain models are explainable by nature, e.g., decision trees, but many others are not. Making inherently opaque models explainable can be done via a number of techniques, called post-hoc explainability techniques, such as:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Learning to generate text explanations,&lt;/li&gt;
- &lt;li&gt;Visualize the model's behavior vi dimensionality reduction for instance,&lt;/li&gt;
- &lt;li&gt;Segmenting the solution space into less complex solution subspaces,&lt;/li&gt;
- &lt;li&gt;Extracting representative examples of the inner relationships and correlations found by the model,&lt;/li&gt;
- &lt;li&gt;Compute the relevance score of features which would unveil the importance granted by the model to each of the variables.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="&quot;Why Should I Trust You?&quot;: Explaining the Predictions of Any Classifier" url="https://arxiv.org/abs/1602.04938"/>
-            <reference name="Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI" url="https://arxiv.org/abs/1910.10045"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" name="Harden the data and feedback pipeline" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data pipelines are at the heart of building a robust data practice. It includes the processing of the data, triggering model retraining, notifying when feedback/ metric is received/ reached, etc.&lt;/p&gt;
-&lt;p&gt;When considering data and feedback collectors in a production environment, there are several aspects to ensure the security of the deployment. Best practices and considerations include:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Secure encrypted end-to-end communication,&lt;/li&gt;
- &lt;li&gt;User identity management,&lt;/li&gt;
- &lt;li&gt;Secure credentials,&lt;/li&gt;
- &lt;li&gt;Audit and log activities,&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Limit the exposure of the automation stages, e.g., scripts that perform data and feedback transformations,&lt;/li&gt;
- &lt;li&gt;Secure storage, and&lt;/li&gt;
- &lt;li&gt;Secure streaming system and pipeline.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Depending on your use case and infrastructure, you will have several options for data orchestration, including cloud-based options, such as AWS Glue or Azure Data Factory, among others.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Building a secure data pipeline in AWS Glue" url="https://docs.aws.amazon.com/whitepapers/latest/aws-glue-best-practices-build-secure-data-pipeline/building-a-secure-data-pipeline.html"/>
-            <reference name="Security considerations for data movement in Azure Data Factory" url="https://learn.microsoft.com/en-us/azure/data-factory/data-movement-security-considerations"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-MONITOR-DRIFT" name="Monitor for model drift by continuously tracking the model's performance metrics in production" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Model drift detection is an active research field. New methods are continuously being proposed in the literature. There are, however, some basic monitoring measures to consider, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Continually monitoring the accuracy of the model when possible, e.g., using F-score,&lt;/li&gt;
- &lt;li&gt;Use statistical tests to: 
-  &lt;ul&gt;
-   &lt;li&gt;Compare the cumulative distributions of the training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Measure how a variable distribution has changed over time, e.g., Population stability Index, or&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Compare the feature distribution between the training and live data, e.g., Z-score.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Addressing model drift would then involve setting up the right schedule to retrain your model.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Drift detection in the literature - sciencedirect" url="https://www.sciencedirect.com/topics/computer-science/concept-drift-detection"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-MODEL-DRIFT" name="Model drift may occur when the data changes becoming unstable and producing unreliable predictions" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Model drift is one of the most prominent issues in ML/AI deployments. It represents the decay of the model's predictive power as a result of the changes in real-world conditions or attacks introducing malicious shifts in the distribution of training data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-MONITOR-DRIFT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-MITM-MODEL-OUTPUT" name="An adversary may be able to interpose between the model output and the intended receiver" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Output integrity might be hard to verify given the black-box model most data-driven systems operate in. An attacker might be able to execute a man-in-the-middle type of attack and hijack the model output without alerting the end user or even the model publisher monitoring the system&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML09:2023 Output Integrity Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML09_2023-Output_Integrity_Attack.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-300">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-OPACITY" name="Opaque systems may less accepted and make it easier for adversaries to inject erroneous outputs" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Interpretability and transparency might not be the main concerns initially, given that accuracy is what the data engineer would look for the most. This, however, makes attacks a much easier endeavor, since it will be harder to discern if anything has gone wrong. Additionally, the lack of transparency and/or the impossibility of interpretable outputs by humans is likely to increase skepticism about ML/AI systems. &amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="75" availability="25" easeOfExploitation="75"/>
-              <references>
-                <reference name="Artificial intelligence, transparency, and public decision-making" url="https://link.springer.com/article/10.1007/s00146-020-00960-w"/>
-                <reference name="What is explainable AI" url="https://www.ibm.com/watson/explainable-ai"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-EXPLAINABILITY" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3d36f35c-336e-4b99-ab42-8fecd30a6941" diagramComponentId="0fc01628-45e1-4af1-be15-b9bfe22f3242" ref="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" name="Out Of Scope" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="out-of-scope">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures/>
-      <usecases/>
-    </component>
-    <component uuid="6d28e216-ecbd-4255-ab8d-b09dedbf879d" diagramComponentId="44ffbffc-8caa-4f65-bbe9-a327faa5c8ec" ref="a4358da6-d80b-485c-b27c-2313a9e9e45d" name="Simulator Service. Predicted actions, e.g., buy/sell" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.444">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.864">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.445">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.210">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.863">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.421">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.208">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.582">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.762">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.763">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.564">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.952">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.&lt;/p&gt;&lt;p&gt;One of the ways to enforce this is by following the deny-by-default principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny-by-default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from untrusted data in logs" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.563">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.531">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.567">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.564">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.565">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.378">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.565">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.698">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.&lt;/p&gt;&lt;p&gt;Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.227">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.225">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
-                    <countermeasure ref="CWE-662" mitigation="16"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
-                    <countermeasure ref="security-logging" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
-                <countermeasure ref="CWE-662" mitigation="16"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
-                <countermeasure ref="security-logging" mitigation="16"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="df631004-6ac9-405d-ac55-39c9fe623577" diagramComponentId="fbe5a8dd-a845-4f24-8c65-4057af728d1c" ref="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" name="Trade Service" desc="" library="CS-Default" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="generic-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.874">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.492">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.199">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.874">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.494">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.198">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:01.968">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.873">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.244">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.557">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.559">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.560">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.561">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.841">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.512">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.&lt;/p&gt;&lt;p&gt;One of the ways to enforce this is by following the deny-by-default principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny-by-default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from untrusted data in logs" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.839">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.175">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.841">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.513">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.411">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:01.816">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.410">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.516">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.&lt;/p&gt;&lt;p&gt;Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
-                    <countermeasure ref="CWE-662" mitigation="16"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
-                    <countermeasure ref="security-logging" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
-                <countermeasure ref="CWE-662" mitigation="16"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
-                <countermeasure ref="security-logging" mitigation="16"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1f594d5a-0d4d-4ab7-af41-acc5d5cc76e5" diagramComponentId="771bf9fc-1e87-4c36-9920-6a090b06ab6b" ref="4d33876c-2161-4cc7-875c-e6dd1667d7b9" name="Trained Model" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="CD-ML-AI-TRAINED-MODEL">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-506" name="Embedded Malicious Code" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application contains code that appears to be malicious in
-                        nature.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-359" name="Exposure of Private Information ('Privacy Violation')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-MODEL-CHOICE" name="Carefully consider the model choice" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Models can be built using different approaches or algorithms. Overall, choosing the right algorithm depends on several factors, including business considerations, data size, accuracy, training time, parameters, and inference performance, among others.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;In general, the right choice is typically a combination of these aspects. In terms of security, however, the main algorithmic concern is about the nature of the data, where certain algorithms are more vulnerable to data leaks than others.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Depending on your privacy concerns, and/or compliance considerations, e.g., GPDR, &amp;nbsp;consider auditing the data privacy of the models under consideration, e.g., using tools like Privacy Meter.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Privacy Meter" url="https://github.com/privacytrustlab/ml_privacy_meter"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.984">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" name="Consider possible trojanized versions when acquiring shared models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Never assume what you are downloading is safe! Malicious actors often use trojanized versions of popular applications in an effort to steal information and compromise systems.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;In this case, you might be fine-tuning a model with possibly a Trojan that includes sneaky behavior that is unanticipated.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Basic practices include carefully checking the source of the model, as well as using cryptographic methods like digital signatures and secure hashes to verify the authenticity and file integrity.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Verify Downloaded Files" url="https://www.digitalocean.com/community/tutorials/how-to-verify-downloaded-files"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" name="Consider privacy-preserving techniques and strategies" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Privacy-preserving or privacy-enhancing techniques are designed to prevent the exposure of the model and data.&lt;/p&gt;
-&lt;p&gt;First, there are two types of access an adversary might have; 1) White Box, where information about the model or its original training data is available, and 2) Black Box, where there is no knowledge about the model or data. In this case, attackers would explore the model by providing carefully crafted inputs and observing outputs.&lt;/p&gt;
-&lt;p&gt;There are a number of attack types, which involve inferring information about the model and data, e.g., model inversion or membership inference.&lt;/p&gt;
-&lt;p&gt;Some of the defenses aiming to protect confidentiality and privacy in ML/AI-based systems are:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Differential Privacy: one of the state-of-the-art methods for providing access to information free from inferences. There are two main privacy-preserving model-training approaches in the literature: 1) using noisy stochastic gradient descent (noisy SGD), and 2) Private Aggregation of Teacher Ensembles (PATE).&lt;/li&gt;
- &lt;li&gt;Cryptography; e.g., privacy-enhancing tools based on secure multi-party computation (SMC) and fully homomorphic encryption (FHE) have been proposed to securely train supervised machine learning models.&lt;/li&gt;
- &lt;li&gt;Trusted environments (engineering/setup solution).&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Other techniques in this space include dropout, weight normalization, dimensionality reduction, selective gradient sharing, etc.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="An Overview of Privacy in Machine Learning" url="https://arxiv.org/pdf/2005.08679.pdf"/>
-            <reference name="ML03:2023 Model Inversion Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML03_2023-Model_Inversion_Attack.html"/>
-            <reference name="ML04:2023 Membership Inference Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML04_2023-Membership_Inference_Attack.html"/>
-            <reference name="ML05:2023 Model Stealing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML05_2023-Model_Stealing.html"/>
-            <reference name="Privacy Preserving ML" url="https://github.com/EthicalML/awesome-production-machine-learning#privacy-preserving-ml"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-KEEP-LOGS" name="Keep a history of queries to the model" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Keeping a history of queries to the system is highly recommended. Logging user interaction with the model is not only a powerful tool for user research (behavior study, usability, system metrics analysis, etc.) but will also allow reviews to make sure the system is not unintentionally leaking confidential information.&amp;nbsp;&lt;br&gt;Care must be taken on how you store the logs! Logging can itself introduce a security/privacy risk.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top seven logging and monitoring best practices" url="https://www.synopsys.com/blogs/software-security/logging-and-monitoring-best-practices/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.984">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PROTECT-SHARED" name="Protect data and IP when sharing or shipping models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Models sharing or shipping can be treated the same as software delivery and protection:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Consider training data as traditional source code.&lt;/li&gt;
- &lt;li&gt;Consider the model files as compiled executables.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;A number of mechanisms/options can be used, including:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Encryption, e.g., for on-device models, only unpacking in memory when the model is running,&lt;/li&gt;
- &lt;li&gt;Obfuscation, e.g., adding random noise to existing samples, or augmenting the dataset with new samples,&amp;nbsp;&lt;/li&gt;
- &lt;li&gt;Copyright traps, or&lt;/li&gt;
- &lt;li&gt;Confidential computing, e.g., built-in hardware-based security.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="ML Model Watermarking" url="https://github.com/SAP/ml-model-watermarking"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-SHARING-TRANSFER" name="An adversary may take advantage of model sharing and/or transfer" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Models storage and transfer may lead to the possibility that what is being reused may be a Trojaned (or otherwise damaged) version of the model. This risk is more pronounced in the case of using ready-to-use models.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML06:2023 Corrupted Packages" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML06_2023-Corrupted_Packages.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-PROTECT-SHARED" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-506">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PROTECT-SHARED" mitigation="50"/>
-                <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-PRIVACY" name="An adversary may be able to reveal sensitive information available in the model or the data used to build it" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;ML/AI models incorporate information and representations of the data ingested during training, some of which might be sensitive.&lt;br&gt;Algorithm choice might be a key factor to limit the risk, e.g., using a non-parametric method like k-nearest neighbors in a situation with sensitive medical records is probably a bad idea since exemplars will have to be stored on production hosts.&amp;nbsp;&lt;br&gt;In general, however, remember that any model is susceptible to memorizing information present within the training sets.&amp;nbsp;&lt;br&gt;You should also be aware of what outputs the model is producing and how it may reveal sensitive aspects of the training data, e.g., using monitoring.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="An Overview of Privacy in Machine Learning" url="https://arxiv.org/pdf/2005.08679.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-359">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-KEEP-LOGS" mitigation="33"/>
-                    <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="33"/>
-                    <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-KEEP-LOGS" mitigation="33"/>
-                <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="33"/>
-                <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" mitigation="34"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="ce54bad8-7bcc-40d9-8e11-b7c4b19edaa9" diagramComponentId="a1d03bae-e6b7-42ce-8ccd-8b97d0e7cd38" ref="239ba369-2d9f-4e4c-8129-d86e8da7d042" name="Users Input" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="CD-ML-AI-USERS-INPUT">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.525">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-ML-AI-ADVERSARIAL-ATTACKS" name="Consider defenses against adversarial tampering such as adversarial training methods or data preprocessing-based approaches" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Adversarial attacks and defenses are an active and rapidly growing research area. Thousands of research papers have been published in recent years (1200 in 2022!) documenting both attacks and defense techniques. These, however, can be classified into the following categories of defenses:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Model-oriented, including: 
-  &lt;ul&gt;
-   &lt;li&gt;Robustness improvement for models, e.g., adversarial training methods,&amp;nbsp;&lt;/li&gt;
-   &lt;li&gt;Adversarial attack detection, e.g., detect adversarial perturbations of commonly used attack methods, and&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
- &lt;li&gt;Data-oriented: essentially preprocessing functions: e.g., input cleansing or denoising.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Depending on the domain area and the underlying ML/AI framework used, there are a number of tools that can help assess models against adversarial threats, including adversarial tampering. These include the Adversarial Robustness Toolbox, DeepRobust, or AutoAttack.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey" url="https://arxiv.org/abs/2303.06302"/>
-            <reference name="Adversarial Robustness Toolbox (ART)" url="https://adversarial-robustness-toolbox.readthedocs.io/en/latest/"/>
-            <reference name="Adversarial Robustness Tools" url="https://github.com/EthicalML/awesome-production-machine-learning#adversarial-robustness"/>
-            <reference name="AutoAttack" url="https://github.com/fra31/auto-attack"/>
-            <reference name="DeepRobust" url="https://github.com/DSE-MSU/DeepRobust"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
-&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-INPUT-VALIDATION" name="Perform input validation by applying anomaly detection" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;This can be considered as part of the data preprocessing functions already mentioned in the overall defenses against adversarial tampering, except that it would attempt to validate the input without further processing.&lt;/p&gt;
-&lt;p&gt;Anomaly detection can be a powerful defense mechanism in this case. It would allow to model the distribution of the clean data, i.e., expected values or patterns, and consequently allows to (potentially) reject anomalous inputs that are likely to be malicious.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Anomaly Detection Learning Resources" url="https://github.com/yzhao062/anomaly-detection-resources"/>
-            <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
-            <reference name="Outlier and Anomaly Detection" url="https://github.com/EthicalML/awesome-production-machine-learning#outlier-and-anomaly-detection"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ML-AI-PROTECT-DATA-STREAMS" name="Protect the data stream and consider multiple independent sensors if possible" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;By design, input data will be structured and pre-processed similarly to the training data to be ingested by the model and make predictions. Protecting this input data stream and processing is of prime importance.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;Options include using a multi-modal input stream/system which will be harder to completely control. One way to carry this out might be to use multiple sensors that are not similarly designed or that do not have the same engineering failure conditions.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.476">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
-          <threats>
-            <threat ref="T-ML-AI-INPUT-STREAM" name="An adversary may take control of the input stream/pipeline" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;An ML/AI system that takes its input data from open and potentially unprotected sources may be purposefully manipulated or completely controlled by an attacker. If the data is used in retraining, the model will take in the poisoned/manipulated data and produce incorrect predictions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
-              <references>
-                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
-              </references>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-PROTECT-DATA-STREAMS" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="T-ML-AI-ADVERSARIAL-EXAMPLES" name="An adversary may input adversarial examples to the deployed model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
-              <desc>&lt;p&gt;Probably the most prevalent attack type on ML/AI models. &amp;nbsp;Adversarial examples are specially crafted inputs with the purpose of confusing a model, resulting essentially in misclassification. Making false predictions as a result of these perturbations will render the model useless.&amp;nbsp;&lt;/p&gt;
-&lt;p&gt;In the age of large language models, this includes prompt injection, where input text may trick the system into ignoring instructions, performing unintended actions, or even executing malicious code or instructions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="LLM01: Prompt Injection (LLM OWASP Top 10)" url="https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_0_1.pdf"/>
-                <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="C-ML-AI-INPUT-VALIDATION" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="34"/>
-                <countermeasure ref="C-ML-AI-ADVERSARIAL-ATTACKS" mitigation="33"/>
-                <countermeasure ref="C-ML-AI-INPUT-VALIDATION" mitigation="33"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="cf231b15-b15a-48b0-8f14-752222084701" diagramComponentId="29d8f192-35e8-479d-8bfd-3455f4d3cbe5" ref="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987" name="Web UI" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-ui">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software includes web functionality (such as a web widget)
-                        from another domain, which causes it to operate within the domain of the
-                        software, potentially granting total access and control of the software to the
-                        untrusted source.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.162">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Review periodically all assets which are accessed by the application and ensure that these
-                        assets are hosted by the application. If this is not the case and there are assets in external
-                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
-                        from external providers or CDNs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
-          </references>
-          <standards>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all assets are hosted by the application, and not by external providers.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="c1" value="default"/>
-            <customField ref="c2" value=""/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.041">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="general" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
-              <desc>Web applications typically make extensive use of 3rd party web resources such as
-                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
-                                repositories, or even Content Delivery Networks that host these libraries, then they
-                                could gain access to applications that use this content.
-                                &lt;div&gt;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-830">
-                  <countermeasures>
-                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="202030957" value=""/>
-                <customField ref="cfThreat" value=""/>
-                <customField ref="qa" value=""/>
-                <customField ref="safety" value=""/>
-                <customField ref="threat_custom_field_qa" value=""/>
-                <customField ref="threat_custom_field_qa_1" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 2f33f6bc4abf96bf421ae7b1086d1190003e965e Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:23:34 -0400
Subject: [PATCH 21/28] Delete Templates/nwe-autorizacion-de-operaciones.xml

---
 Templates/nwe-autorizacion-de-operaciones.xml | 17529 ----------------
 1 file changed, 17529 deletions(-)
 delete mode 100644 Templates/nwe-autorizacion-de-operaciones.xml

diff --git a/Templates/nwe-autorizacion-de-operaciones.xml b/Templates/nwe-autorizacion-de-operaciones.xml
deleted file mode 100644
index b9b95aa..0000000
--- a/Templates/nwe-autorizacion-de-operaciones.xml
+++ /dev/null
@@ -1,17529 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="nwe-autorizacion-de-operaciones" name="NWE-Autorizacion de Operaciones" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iNTY2MSIgZHk9IjI0MzQiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS4yLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTMiIHk9Ii0yMDkiIHdpZHRoPSIzOTEiIGhlaWdodD0iMjQ5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJCYWFTIiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj01NmY5NjlkNS05YjQwLTQ5NjUtYWU4My1hYzc4MzE5YjU5OTQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI5IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj1hMmZmNTY0Yi00NDdlLTQ3ZmEtOTVhMi02NTU3Yzc4NDlhNWY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iOSIgc291cmNlPSIxMSIgdGFyZ2V0PSIxMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBpZD0iMTEiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03NDM3MzQ5NS00YjgwLTRlMTgtOThiZi1hZjZiYWIwMDUzZDA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXktbWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EZzNNRElnTUM0Mk5ESTVNemRETUM0Mk5UWXlPRE1nTUM0Mk16UTBOemdnTUM0Mk5qUTJPRGNnTUM0Mk1qWTRNREVnTUM0Mk56TTNOemtnTUM0Mk1qQXdNME13TGpZM056YzBPQ0F3TGpZeE56QTNOQ0F3TGpZNE16QTBOeUF3TGpZeE5qa3dOaUF3TGpZNE5qazJOeUF3TGpZeE9UWXhNVXd3TGpjd05UYzJNeUF3TGpZek1qVTRNME13TGpjeE5ETTRNaUF3TGpZek9EVTFNaUF3TGpjeU5qTTFNaUF3TGpZek5qZzJOU0F3TGpjek16VTFOeUF3TGpZeU9EWTJNVU13TGpjek5UUTVOU0F3TGpZeU5qUTFOeUF3TGpjek5qazJPQ0F3TGpZeU16ZzROeUF3TGpjek56ZzRPU0F3TGpZeU1UQTRPRXd3TGpjME5UTWdNQzQxT1RnM05qVkRNQzQzTkRZNE5ERWdNQzQxT1RReE1qSWdNQzQzTlRFd09USWdNQzQxT1RBNE5EUWdNQzQzTlRVNU1EVWdNQzQxT1RBMU9EaERNQzQzTnpnek1EY2dNQzQxT0Rrek9UY2dNQzQ0TURBME9ERWdNQzQxT1RNek1qTWdNQzQ0TWpBM05pQXdMall3TWpBM1F6QXVPREkxTVRNeklEQXVOakF6T1RVMUlEQXVPREkzTnpJMklEQXVOakE0TkRZNUlEQXVPREkzTWpJeElEQXVOakV6TXpFMVREQXVPREkwTnpnMElEQXVOak0yTnpJelF6QXVPREkwTURjNUlEQXVOalF6TXpreUlEQXVPREkyTlRZeUlEQXVOalE1T0RjeklEQXVPRE14TkRjeUlEQXVOalUwTVRjM1F6QXVPRE0yTXpneUlEQXVOalU0TkRnZ01DNDRORE14TXpNZ01DNDJOakF3T1RNZ01DNDRORGsyTmpZZ01DNDJOVGcxTVRkTU1DNDROekkxTmpjZ01DNDJOVE13TWpORE1DNDROemN6TURjZ01DNDJOVEU0T0RZZ01DNDRPREl4TWpJZ01DNDJOVE00TmpVZ01DNDRPRFExTmpZZ01DNDJOVGM1TlRORE1DNDRPVFU0T1RNZ01DNDJOelk1TURZZ01DNDVNREkyT1RRZ01DNDJPVGd6TmprZ01DNDVNRFEwTlRjZ01DNDNNakEzTWpsRE1DNDVNRFE0TXpVZ01DNDNNalUxTXpJZ01DNDVNREl4TkRnZ01DNDNNekF4TnpNZ01DNDRPVGMzTlRFZ01DNDNNekl6TVROTU1DNDROelkxTWpNZ01DNDNOREkyTkRORE1DNDROekEwTlRNZ01DNDNORFUyTURFZ01DNDROall3TWpnZ01DNDNOVEV5TXlBd0xqZzJORFl3TlNBd0xqYzFOemd3TmtNd0xqZzJNekU0TWlBd0xqYzJORE00TXlBd0xqZzJORGt6SURBdU56Y3hNVEl5SURBdU9EWTVNekUySURBdU56YzFPVFU1VERBdU9EZzBOalE0SURBdU56a3lPRGM0UXpBdU9EZzNPREV4SURBdU56azJNelkzSURBdU9EZzRNemNnTUM0NE1ERTFOallnTUM0NE9EWXdORGNnTUM0NE1EVTROamxETUM0NE56VXhNak1nTUM0NE1qWXdPVGtnTUM0NE5UazNNekVnTUM0NE5ETTJOVGtnTUM0NE5ERXhNRGdnTUM0NE5UY3hNemhETUM0NE16Y3hORFlnTUM0NE5qQXdNRFlnTUM0NE16RTVNVGdnTUM0NE5qQXhNek1nTUM0NE1qZ3dORFVnTUM0NE5UYzBOVFpNTUM0NE1Ea3lPVEVnTUM0NE5EUTBPVEZETUM0NE1ETTVNVGNnTUM0NE5EQTRNREVnTUM0M09UY3dNVFlnTUM0NE16azVOallnTUM0M09UQTJPVFFnTUM0NE5ESXlORE5ETUM0M09EUXpOeklnTUM0NE5EUTFNVGtnTUM0M056a3pPQ0F3TGpnME9UWXpOU0F3TGpjM056STBOaUF3TGpnMU5qQXhOa3d3TGpjMk9UYzROU0F3TGpnM09EUXhPVU13TGpjMk9ESTBJREF1T0Rnek1EVTVJREF1TnpZek9UZzNJREF1T0RnMk16TXlJREF1TnpVNU1UYzJJREF1T0RnMk5UZzFRekF1TnpNMk56VTRJREF1T0RnM056WXhJREF1TnpFME5UY3hJREF1T0Rnek9ERTNJREF1TmprME1qZzJJREF1T0RjMU1EUTVRekF1TmpnNU9URTJJREF1T0Rjek1UWXhJREF1TmpnM016STNJREF1T0RZNE5qUTRJREF1TmpnM09ETXpJREF1T0RZek9EQTBUREF1Tmprd01qZ2dNQzQ0TkRBek5qWkRNQzQyT1RBNU9EUWdNQzQ0TXpNMk9UY2dNQzQyT0RnMU1ERWdNQzQ0TWpjeU1UWWdNQzQyT0RNMU9URWdNQzQ0TWpJNU1UTkRNQzQyTnpnMk9ERWdNQzQ0TVRnMk1Ea2dNQzQyTnpFNU15QXdMamd4TmprNU5pQXdMalkyTlRRd01pQXdMamd4T0RVM01Vd3dMalkwTWpVeE15QXdMamd5TkRBM05FTXdMall6TnpjM01TQXdMamd5TlRJeE5DQXdMall6TWprMU15QXdMamd5TXpJek5pQXdMall6TURVd09DQXdMamd4T1RFME5VTXdMall4T1RFNElEQXVPREF3TVRnNElEQXVOakV5TXpneUlEQXVOemM0TnpFNUlEQXVOakV3TmpJM0lEQXVOelUyTXpVMFF6QXVOakV3TWpVZ01DNDNOVEUxTkRrZ01DNDJNVEk1TkRJZ01DNDNORFk1TURZZ01DNDJNVGN6TkRNZ01DNDNORFEzTmpsTU1DNDJNemcwT1RrZ01DNDNNelEwT1RoRE1DNDJORFExT0RVZ01DNDNNekUxTkRFZ01DNDJORGt3TVRFZ01DNDNNalU0T1NBd0xqWTFNRFF4TkNBd0xqY3hPVEkxT1VNd0xqWTFNVGd5T0NBd0xqY3hNalkzTXlBd0xqWTFNREEzTnlBd0xqY3dOVGt5T1NBd0xqWTBOVFk1T0NBd0xqY3dNVEE0TkV3d0xqWXpNRE00TlNBd0xqWTROREUyTkVNd0xqWXlOekU0TnlBd0xqWTRNRFl6TVNBd0xqWXlOalkyTWlBd0xqWTNOVE0xTWlBd0xqWXlPVEEzTmlBd0xqWTNNVEF5T1VNd0xqWXpORFl3T1NBd0xqWTJNVEV5TVNBd0xqWTBNVEV5TnlBd0xqWTFNVGMzTkNBd0xqWTBPRGN3TWlBd0xqWTBNamt6TjFwTk1DNDNPRFl4TURFZ01DNDNPVGswTkVNd0xqZ3hPVGMyTlNBd0xqYzRNelkyTVNBd0xqZ3pOREkyTXlBd0xqYzBNelU0TVNBd0xqZ3hPRFE0TkNBd0xqY3dPVGt4T0VNd0xqZ3dNamN3TlNBd0xqWTNOakkxTlNBd0xqYzJNall5TkNBd0xqWTJNVGMxT0NBd0xqY3lPRGsySURBdU5qYzNOVE0yUXpBdU5qazFNamsySURBdU5qa3pNekUxSURBdU5qZ3dOems0SURBdU56TXpNemsySURBdU5qazJOVGMzSURBdU56WTNNRFU0UXpBdU56RXlNelUySURBdU9EQXdOekl4SURBdU56VXlORE0zSURBdU9ERTFNakU1SURBdU56ZzJNVEF4SURBdU56azVORFJhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpRNU16SWdNQzQzTmpJME9ERldNQzQzTlRZd05qUkRNQzQzTnpBeU1qWWdNQzQzTmpFek5qa2dNQzQzTmpRMk1qRWdNQzQzTmpRd01qRWdNQzQzTlRneE1Ua2dNQzQzTmpRd01qRkRNQzQzTlRJMk5ETWdNQzQzTmpRd01qRWdNQzQzTkRnME5TQXdMamMyTVRnMElEQXVOelExTlRReElEQXVOelUzTkRjMlZqQXVOemd5T0RnM1REQXVOek0wTXpjMUlEQXVOemc0TVRRNVZqQXVOamsyT0RrNVNEQXVOelExTlRReFZqQXVOek0yTkRJNFF6QXVOelExTlRReElEQXVOelF6TURFMklEQXVOelEyTmprMklEQXVOelEzTlRVeElEQXVOelE1TURBMklEQXVOelV3TURNeVF6QXVOelV4TkRBeUlEQXVOelV5TkRJNElEQXVOelUwT1RrMklEQXVOelV6TmpJMklEQXVOelU1TnpnM0lEQXVOelV6TmpJMlF6QXVOelk1T0RnMElEQXVOelV6TmpJMklEQXVOemMwT1RNeUlEQXVOelEzT1RjNUlEQXVOemMwT1RNeUlEQXVOek0yTmpnMVZqQXVOamsyT0RrNVNEQXVOemcyTURrNFZqQXVOell5TkRneFNEQXVOemMwT1RNeVdpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXlLU0krSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU16QTJOVEl5SURBdU1UVXdOakEzUXpBdU16STVNek0xSURBdU1UUXlOamM0SURBdU16VXlPVEV6SURBdU1UTTNNVFE0SURBdU16YzJPRGMxSURBdU1UTTBNVEE0UXpBdU16ZzNNek0xSURBdU1UTXlOemd4SURBdU16azNORGtnTUM0eE16Z3lOVFlnTUM0ME1ESXhOU0F3TGpFME56Y3pOa3d3TGpReU5EUTVNaUF3TGpFNU16RTRPVU13TGpRek5EY3hOU0F3TGpJeE5EQTNJREF1TkRVNE9UYzBJREF1TWpJek9UTXlJREF1TkRnd09ESTBJREF1TWpFMk1EYzVRekF1TkRnMk5qazRJREF1TWpFek9UY3lJREF1TkRreU1EWTBJREF1TWpFd05qVXpJREF1TkRrMk5qSXlJREF1TWpBMk1qa3lUREF1TlRNek1EazFJREF1TVRjeE5UYzVRekF1TlRRd05qZ3hJREF1TVRZME16WWdNQzQxTlRFNU9UWWdNQzR4TmpJM01qVWdNQzQxTmpFek1qUWdNQzR4TmpjMU1ERkRNQzQyTURRM05ESWdNQzR4T0RrM015QXdMalkwTWpVM015QXdMakl5TVRVeU5pQXdMalkzTVRrMk9TQXdMakkyTURRNU5VTXdMalkzT0RNd09DQXdMakkyT0RnNU9DQXdMalkzT0RZME5DQXdMakk0TURNNU1pQXdMalkzTWpnd05pQXdMakk0T1RFek4wd3dMalkwTkRZeE1pQXdMak16TVRNM01rTXdMall6TmpVMU9TQXdMak0wTXpNNU5DQXdMall6TkRjd05pQXdMak0xT0RVME15QXdMall6T1RZeUlEQXVNemN5TVRjeVF6QXVOalEwTlRNMElEQXVNemcxT0NBd0xqWTFOVFl5T0NBd0xqTTVOakk0TVNBd0xqWTJPVFV6SURBdU5EQXdOREEzVERBdU56RTRNakkzSURBdU5ERTBPVEk1UXpBdU56STRNekEwSURBdU5ERTNPVE0xSURBdU56TTFNemd6SURBdU5ESTJPVGs1SURBdU56TTFPRFkySURBdU5ETTNOVEUyUXpBdU56TTRNVEEwSURBdU5EZzJNalk1SURBdU56STVNamd4SURBdU5UTTBPRGd5SURBdU56RXdNRFU1SURBdU5UYzVOekF6UXpBdU56QTFPVE14SURBdU5UZzVNekk1SURBdU5qazJNVGcySURBdU5UazFNamswSURBdU5qZzFOelF6SURBdU5UazBOVGczVERBdU5qTTFNekkwSURBdU5Ua3hNVGMwUXpBdU5qSXdPVEF5SURBdU5Ua3dNakEwSURBdU5qQTJPRGc0SURBdU5UazJNVFl4SURBdU5UazNOVGMySURBdU5qQTNNakU1UXpBdU5UZzRNalkwSURBdU5qRTRNamMzSURBdU5UZzBOelkxSURBdU5qTXpNVEU0SURBdU5UZzRNVFV4SURBdU5qUTNNVGsxVERBdU5UazVPVGc0SURBdU5qazJOREk1UXpBdU5qQXlOREk1SURBdU56QTJOVGd4SURBdU5UazRNalF4SURBdU56RTNNVFkySURBdU5UZzVOVEkwSURBdU56SXlPRGM1UXpBdU5UUTROVFEwSURBdU56UTVOek14SURBdU5UQXhPRE16SURBdU56WTJOVGN6SURBdU5EVXpNVFEySURBdU56Y3lNRFV4UXpBdU5EUXlOemc1SURBdU56Y3pNakUySURBdU5ETXlPREE1SURBdU56WTNOek01SURBdU5ESTRNakVnTUM0M05UZ3pOalZNTUM0ME1EVTVNemdnTUM0M01USTVOekpETUM0ek9UazFNeklnTUM0M01EQXdNVE1nTUM0ek9EY3pOamdnTUM0Mk9UQTROakVnTUM0ek56TXhOVGtnTUM0Mk9EZ3pNRGxETUM0ek5UZzVOVEVnTUM0Mk9EVTNOVGdnTUM0ek5EUXpPRFVnTUM0Mk9UQXhNRGtnTUM0ek16TTVNekVnTUM0M01EQXdNVFJNTUM0eU9UY3lPRE1nTUM0M016UTRNalZETUM0eU9EazJPVElnTUM0M05ESXdNelVnTUM0eU56Z3pOemtnTUM0M05ETTJOaUF3TGpJMk9UQTFOeUF3TGpjek9EZzNPVU13TGpJeU5UWXlOQ0F3TGpjeE5qWXdOU0F3TGpFNE56YzRPU0F3TGpZNE5EYzJNU0F3TGpFMU9EUXdNU0F3TGpZME5UYzBNME13TGpFMU1qQTNNaUF3TGpZek56TXpPU0F3TGpFMU1UYzBNaUF3TGpZeU5UZzFJREF1TVRVM05UYzVJREF1TmpFM01URk1NQzR4T0RVNE1qRWdNQzQxTnpRNE1qZERNQzR4T1RNNE56TWdNQzQxTmpJNE1EVWdNQzR4T1RVM01qY2dNQzQxTkRjMk5UWWdNQzR4T1RBNE1UTWdNQzQxTXpRd01qaERNQzR4T0RVNE9Ua2dNQzQxTWpBek9Ua2dNQzR4TnpRNE1EUWdNQzQxTURrNU1UZ2dNQzR4TmpBNU1UVWdNQzQxTURVM09UWk1NQzR4TVRJeU15QXdMalE1TVRNd05VTXdMakV3TWpFME5pQXdMalE0T0RNd015QXdMakE1TlRBMU9Ua2dNQzQwTnpreU16VWdNQzR3T1RRMU56YzFJREF1TkRZNE56RXpRekF1TURreU16UXlJREF1TkRFNU9UVXhJREF1TVRBeE1UYzNJREF1TXpjeE16TWdNQzR4TWpBME1Ua2dNQzR6TWpZMU1EaERNQzR4TWpRMU5UTWdNQzR6TVRZNE56Z2dNQzR4TXpRek1EZ2dNQzR6TVRBNU1UWWdNQzR4TkRRM05UWWdNQzR6TVRFMk16Tk1NQzR4T1RRNU9DQXdMak14TlRBNE0wTXdMakl3T1RReU9TQXdMak14TmpBM0lEQXVNakl6TkRZNUlEQXVNekV3TURjeUlEQXVNak15TnprM0lEQXVNams0T0RnNFF6QXVNalF5TVRBeUlEQXVNamczT0RBeUlEQXVNalExTmpBeUlEQXVNamN5T1RRM0lEQXVNalF5TWpNeklEQXVNalU0T0RZeVREQXVNak13TkRNM0lEQXVNakE1TmpRNVF6QXVNakkzT1RjMElEQXVNVGs1TXpjeElEQXVNak15TXpBMElEQXVNVGc0TmpjZ01DNHlOREV5TVRJZ01DNHhPRE13TVRsRE1DNHlOakUyTXlBd0xqRTNNREEyTnlBd0xqSTRNek16TlNBd0xqRTFPVEkzSURBdU16QTJOVEl5SURBdU1UVXdOakEzV2swd0xqUXhOVFF5TWlBd0xqWXlNVGMzTTBNd0xqVXdPRFl5SURBdU5qSXhOemN6SURBdU5UZzBNVGN4SURBdU5UUTJNakl4SURBdU5UZzBNVGN4SURBdU5EVXpNREkwUXpBdU5UZzBNVGN4SURBdU16VTVPREkySURBdU5UQTROaklnTUM0eU9EUXlOelVnTUM0ME1UVTBNaklnTUM0eU9EUXlOelZETUM0ek1qSXlNak1nTUM0eU9EUXlOelVnTUM0eU5EWTJOeklnTUM0ek5UazRNallnTUM0eU5EWTJOeklnTUM0ME5UTXdNalJETUM0eU5EWTJOeklnTUM0MU5EWXlNakVnTUM0ek1qSXlNak1nTUM0Mk1qRTNOek1nTUM0ME1UVTBNaklnTUM0Mk1qRTNOek5hSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TnpVMk1pQXdMalE1T1RrMU9Fd3dMak0yT0RjNU5TQXdMalE0TWpFd09FZ3dMak16TkRJM05rd3dMak15TnpRMU1TQXdMalE1T1RrMU9FZ3dMak13TlRZMk5Fd3dMak0wTVRnNE9TQXdMalF3T0RBNE1VZ3dMak0yTVRBMU1Vd3dMak01TnpRd055QXdMalE1T1RrMU9FZ3dMak0zTlRZeVdrMHdMak0yTWpFd01TQXdMalEyTXpjek1rd3dMak0xTkRJeU5pQXdMalEwTXpreE0wTXdMak0xTXpBd01TQXdMalEwTURrek9DQXdMak0xTWpBNE1pQXdMalF6T0RNMU55QXdMak0xTVRRM0lEQXVORE0yTVRZNVF6QXVNelV4TVRJZ01DNDBNemMyTlRjZ01DNHpOVEF5TURFZ01DNDBOREF5TXpnZ01DNHpORGczTVRRZ01DNDBORE01TVROTU1DNHpOREE0TXprZ01DNDBOak0zTXpKSU1DNHpOakl4TURGYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME1Ea3hORFFnTUM0ME9UazVOVGhXTUM0ME1EZ3dPREZJTUM0ME5EazRNekZETUM0ME5qQTNOamdnTUM0ME1EZ3dPREVnTUM0ME5qZzRNVGdnTUM0ME1UQTVNalVnTUM0ME56TTVPQ0F3TGpReE5qWXhNa013TGpRM09USXpJREF1TkRJeU15QXdMalE0TVRnMU5TQXdMalF5T1RNZ01DNDBPREU0TlRVZ01DNDBNemMyTVRORE1DNDBPREU0TlRVZ01DNDBOREV5SURBdU5EZ3hNalF6SURBdU5EUTBOekF4SURBdU5EZ3dNREU0SURBdU5EUTRNVEV6UXpBdU5EYzROemt6SURBdU5EVXhORE00SURBdU5EYzJPVFUxSURBdU5EVTBOVFEwSURBdU5EYzBOVEExSURBdU5EVTNORE15UXpBdU5EY3lNRFUxSURBdU5EWXdNeklnTUM0ME5qZzJPRGNnTUM0ME5qSTJNemdnTUM0ME5qUXpPVGtnTUM0ME5qUXpPRGhETUM0ME5qQXhNVElnTUM0ME5qWXhNemdnTUM0ME5UVXlOVFlnTUM0ME5qY3dNVE1nTUM0ME5EazRNekVnTUM0ME5qY3dNVE5JTUM0ME1qa3dPVE5XTUM0ME9UazVOVGhJTUM0ME1Ea3hORFJhVFRBdU5EVXdOakU0SURBdU5EUTRNalEwUXpBdU5EVTBNVEU0SURBdU5EUTRNalEwSURBdU5EVTJOelF6SURBdU5EUTNNVGswSURBdU5EVTRORGt6SURBdU5EUTFNRGswUXpBdU5EWXdNalF6SURBdU5EUXlPVGswSURBdU5EWXhNVEU0SURBdU5EUXdOU0F3TGpRMk1URXhPQ0F3TGpRek56WXhNME13TGpRMk1URXhPQ0F3TGpRek5EZ3hNeUF3TGpRMk1ESTROeUF3TGpRek1qTTJNeUF3TGpRMU9EWXlOQ0F3TGpRek1ESTJNME13TGpRMU5qazJNaUF3TGpReU9EQTNOU0F3TGpRMU5ESTVNeUF3TGpReU5qazRNU0F3TGpRMU1EWXhPQ0F3TGpReU5qazRNVWd3TGpReU9UQTVNMVl3TGpRME9ESTBORWd3TGpRMU1EWXhPRm9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TkRFek55QXdMalE1T1RrMU9GWXdMalF3T0RBNE1VZ3dMalV4TkRBNE4xWXdMalE1T1RrMU9FZ3dMalE1TkRFek4xb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TXpjMUlpQm9aV2xuYUhROUlqQXVPVE0zTlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ETXhNalVnTUM0d016RXlOU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpJNE9UY3lOaUlnYUdWcFoyaDBQU0l3TGpJNE9UY3lNaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TmpFeU56a3pJREF1TlRrek56VXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01pSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQyTlRZeU5TSWdhR1ZwWjJoMFBTSXdMalkxTmpJMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdPRGMwTURJeklEQXVNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iOSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4MSIgeT0iNzkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTMiIHk9IjI5NSIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSI4Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9NWQ3MmUxN2ItNjAzYi00MGUyLWI3MmYtMTg3MjhjZDlhOTQ4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIyNCIgeT0iNzkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzMiIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIC0+IEJhYVMiIHN0eWxlPSJpci5yZWY9Yzg1MjA5MGEtMTk0Ny00NTM4LThkY2UtMzIxYjI2M2QyMTA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iNyIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YTg4YjZkMzMtOGFiMC00NWMyLTg3YTktODZkZGU4YjBlZmM3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODEiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMTAyMCIgeT0iLTI4OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIxODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkNsaWVudGVzIiBpZD0iMiI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTgyYTdmMDFlLTIwZTEtNDMxMy1iZTYzLTI1YjQ5NTRkOTIxMTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSI0OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxNSIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTU2IiB5PSItMTE5IiB3aWR0aD0iMzkxIiBoZWlnaHQ9IjI0OSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQmFhUyIgaWQ9IjE2Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9MGEwYjBiYTMtYzUzMC00YzRkLWIxNDItMWZmMzQ2Zjk0NWEwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIxNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMjQiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzAiIHZhbHVlPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyAtPiBCYWFTIiBzdHlsZT0iaXIucmVmPTEzZjhlMWRhLTFkNTEtNDQ5MC04MDliLTAzNjJkMmRiZjk2NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxNSIgc291cmNlPSIxNyIgdGFyZ2V0PSIxNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBpZD0iMTciPjxteENlbGwgc3R5bGU9ImlyLnJlZj02ZmYwMTkyNy1mYTM5LTQ5MzktOWViZi1mNzBhNTFiODc0ZjU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXktbWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EZzNNRElnTUM0Mk5ESTVNemRETUM0Mk5UWXlPRE1nTUM0Mk16UTBOemdnTUM0Mk5qUTJPRGNnTUM0Mk1qWTRNREVnTUM0Mk56TTNOemtnTUM0Mk1qQXdNME13TGpZM056YzBPQ0F3TGpZeE56QTNOQ0F3TGpZNE16QTBOeUF3TGpZeE5qa3dOaUF3TGpZNE5qazJOeUF3TGpZeE9UWXhNVXd3TGpjd05UYzJNeUF3TGpZek1qVTRNME13TGpjeE5ETTRNaUF3TGpZek9EVTFNaUF3TGpjeU5qTTFNaUF3TGpZek5qZzJOU0F3TGpjek16VTFOeUF3TGpZeU9EWTJNVU13TGpjek5UUTVOU0F3TGpZeU5qUTFOeUF3TGpjek5qazJPQ0F3TGpZeU16ZzROeUF3TGpjek56ZzRPU0F3TGpZeU1UQTRPRXd3TGpjME5UTWdNQzQxT1RnM05qVkRNQzQzTkRZNE5ERWdNQzQxT1RReE1qSWdNQzQzTlRFd09USWdNQzQxT1RBNE5EUWdNQzQzTlRVNU1EVWdNQzQxT1RBMU9EaERNQzQzTnpnek1EY2dNQzQxT0Rrek9UY2dNQzQ0TURBME9ERWdNQzQxT1RNek1qTWdNQzQ0TWpBM05pQXdMall3TWpBM1F6QXVPREkxTVRNeklEQXVOakF6T1RVMUlEQXVPREkzTnpJMklEQXVOakE0TkRZNUlEQXVPREkzTWpJeElEQXVOakV6TXpFMVREQXVPREkwTnpnMElEQXVOak0yTnpJelF6QXVPREkwTURjNUlEQXVOalF6TXpreUlEQXVPREkyTlRZeUlEQXVOalE1T0RjeklEQXVPRE14TkRjeUlEQXVOalUwTVRjM1F6QXVPRE0yTXpneUlEQXVOalU0TkRnZ01DNDRORE14TXpNZ01DNDJOakF3T1RNZ01DNDRORGsyTmpZZ01DNDJOVGcxTVRkTU1DNDROekkxTmpjZ01DNDJOVE13TWpORE1DNDROemN6TURjZ01DNDJOVEU0T0RZZ01DNDRPREl4TWpJZ01DNDJOVE00TmpVZ01DNDRPRFExTmpZZ01DNDJOVGM1TlRORE1DNDRPVFU0T1RNZ01DNDJOelk1TURZZ01DNDVNREkyT1RRZ01DNDJPVGd6TmprZ01DNDVNRFEwTlRjZ01DNDNNakEzTWpsRE1DNDVNRFE0TXpVZ01DNDNNalUxTXpJZ01DNDVNREl4TkRnZ01DNDNNekF4TnpNZ01DNDRPVGMzTlRFZ01DNDNNekl6TVROTU1DNDROelkxTWpNZ01DNDNOREkyTkRORE1DNDROekEwTlRNZ01DNDNORFUyTURFZ01DNDROall3TWpnZ01DNDNOVEV5TXlBd0xqZzJORFl3TlNBd0xqYzFOemd3TmtNd0xqZzJNekU0TWlBd0xqYzJORE00TXlBd0xqZzJORGt6SURBdU56Y3hNVEl5SURBdU9EWTVNekUySURBdU56YzFPVFU1VERBdU9EZzBOalE0SURBdU56a3lPRGM0UXpBdU9EZzNPREV4SURBdU56azJNelkzSURBdU9EZzRNemNnTUM0NE1ERTFOallnTUM0NE9EWXdORGNnTUM0NE1EVTROamxETUM0NE56VXhNak1nTUM0NE1qWXdPVGtnTUM0NE5UazNNekVnTUM0NE5ETTJOVGtnTUM0NE5ERXhNRGdnTUM0NE5UY3hNemhETUM0NE16Y3hORFlnTUM0NE5qQXdNRFlnTUM0NE16RTVNVGdnTUM0NE5qQXhNek1nTUM0NE1qZ3dORFVnTUM0NE5UYzBOVFpNTUM0NE1Ea3lPVEVnTUM0NE5EUTBPVEZETUM0NE1ETTVNVGNnTUM0NE5EQTRNREVnTUM0M09UY3dNVFlnTUM0NE16azVOallnTUM0M09UQTJPVFFnTUM0NE5ESXlORE5ETUM0M09EUXpOeklnTUM0NE5EUTFNVGtnTUM0M056a3pPQ0F3TGpnME9UWXpOU0F3TGpjM056STBOaUF3TGpnMU5qQXhOa3d3TGpjMk9UYzROU0F3TGpnM09EUXhPVU13TGpjMk9ESTBJREF1T0Rnek1EVTVJREF1TnpZek9UZzNJREF1T0RnMk16TXlJREF1TnpVNU1UYzJJREF1T0RnMk5UZzFRekF1TnpNMk56VTRJREF1T0RnM056WXhJREF1TnpFME5UY3hJREF1T0Rnek9ERTNJREF1TmprME1qZzJJREF1T0RjMU1EUTVRekF1TmpnNU9URTJJREF1T0Rjek1UWXhJREF1TmpnM016STNJREF1T0RZNE5qUTRJREF1TmpnM09ETXpJREF1T0RZek9EQTBUREF1Tmprd01qZ2dNQzQ0TkRBek5qWkRNQzQyT1RBNU9EUWdNQzQ0TXpNMk9UY2dNQzQyT0RnMU1ERWdNQzQ0TWpjeU1UWWdNQzQyT0RNMU9URWdNQzQ0TWpJNU1UTkRNQzQyTnpnMk9ERWdNQzQ0TVRnMk1Ea2dNQzQyTnpFNU15QXdMamd4TmprNU5pQXdMalkyTlRRd01pQXdMamd4T0RVM01Vd3dMalkwTWpVeE15QXdMamd5TkRBM05FTXdMall6TnpjM01TQXdMamd5TlRJeE5DQXdMall6TWprMU15QXdMamd5TXpJek5pQXdMall6TURVd09DQXdMamd4T1RFME5VTXdMall4T1RFNElEQXVPREF3TVRnNElEQXVOakV5TXpneUlEQXVOemM0TnpFNUlEQXVOakV3TmpJM0lEQXVOelUyTXpVMFF6QXVOakV3TWpVZ01DNDNOVEUxTkRrZ01DNDJNVEk1TkRJZ01DNDNORFk1TURZZ01DNDJNVGN6TkRNZ01DNDNORFEzTmpsTU1DNDJNemcwT1RrZ01DNDNNelEwT1RoRE1DNDJORFExT0RVZ01DNDNNekUxTkRFZ01DNDJORGt3TVRFZ01DNDNNalU0T1NBd0xqWTFNRFF4TkNBd0xqY3hPVEkxT1VNd0xqWTFNVGd5T0NBd0xqY3hNalkzTXlBd0xqWTFNREEzTnlBd0xqY3dOVGt5T1NBd0xqWTBOVFk1T0NBd0xqY3dNVEE0TkV3d0xqWXpNRE00TlNBd0xqWTROREUyTkVNd0xqWXlOekU0TnlBd0xqWTRNRFl6TVNBd0xqWXlOalkyTWlBd0xqWTNOVE0xTWlBd0xqWXlPVEEzTmlBd0xqWTNNVEF5T1VNd0xqWXpORFl3T1NBd0xqWTJNVEV5TVNBd0xqWTBNVEV5TnlBd0xqWTFNVGMzTkNBd0xqWTBPRGN3TWlBd0xqWTBNamt6TjFwTk1DNDNPRFl4TURFZ01DNDNPVGswTkVNd0xqZ3hPVGMyTlNBd0xqYzRNelkyTVNBd0xqZ3pOREkyTXlBd0xqYzBNelU0TVNBd0xqZ3hPRFE0TkNBd0xqY3dPVGt4T0VNd0xqZ3dNamN3TlNBd0xqWTNOakkxTlNBd0xqYzJNall5TkNBd0xqWTJNVGMxT0NBd0xqY3lPRGsySURBdU5qYzNOVE0yUXpBdU5qazFNamsySURBdU5qa3pNekUxSURBdU5qZ3dOems0SURBdU56TXpNemsySURBdU5qazJOVGMzSURBdU56WTNNRFU0UXpBdU56RXlNelUySURBdU9EQXdOekl4SURBdU56VXlORE0zSURBdU9ERTFNakU1SURBdU56ZzJNVEF4SURBdU56azVORFJhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpRNU16SWdNQzQzTmpJME9ERldNQzQzTlRZd05qUkRNQzQzTnpBeU1qWWdNQzQzTmpFek5qa2dNQzQzTmpRMk1qRWdNQzQzTmpRd01qRWdNQzQzTlRneE1Ua2dNQzQzTmpRd01qRkRNQzQzTlRJMk5ETWdNQzQzTmpRd01qRWdNQzQzTkRnME5TQXdMamMyTVRnMElEQXVOelExTlRReElEQXVOelUzTkRjMlZqQXVOemd5T0RnM1REQXVOek0wTXpjMUlEQXVOemc0TVRRNVZqQXVOamsyT0RrNVNEQXVOelExTlRReFZqQXVOek0yTkRJNFF6QXVOelExTlRReElEQXVOelF6TURFMklEQXVOelEyTmprMklEQXVOelEzTlRVeElEQXVOelE1TURBMklEQXVOelV3TURNeVF6QXVOelV4TkRBeUlEQXVOelV5TkRJNElEQXVOelUwT1RrMklEQXVOelV6TmpJMklEQXVOelU1TnpnM0lEQXVOelV6TmpJMlF6QXVOelk1T0RnMElEQXVOelV6TmpJMklEQXVOemMwT1RNeUlEQXVOelEzT1RjNUlEQXVOemMwT1RNeUlEQXVOek0yTmpnMVZqQXVOamsyT0RrNVNEQXVOemcyTURrNFZqQXVOell5TkRneFNEQXVOemMwT1RNeVdpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXlLU0krSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU16QTJOVEl5SURBdU1UVXdOakEzUXpBdU16STVNek0xSURBdU1UUXlOamM0SURBdU16VXlPVEV6SURBdU1UTTNNVFE0SURBdU16YzJPRGMxSURBdU1UTTBNVEE0UXpBdU16ZzNNek0xSURBdU1UTXlOemd4SURBdU16azNORGtnTUM0eE16Z3lOVFlnTUM0ME1ESXhOU0F3TGpFME56Y3pOa3d3TGpReU5EUTVNaUF3TGpFNU16RTRPVU13TGpRek5EY3hOU0F3TGpJeE5EQTNJREF1TkRVNE9UYzBJREF1TWpJek9UTXlJREF1TkRnd09ESTBJREF1TWpFMk1EYzVRekF1TkRnMk5qazRJREF1TWpFek9UY3lJREF1TkRreU1EWTBJREF1TWpFd05qVXpJREF1TkRrMk5qSXlJREF1TWpBMk1qa3lUREF1TlRNek1EazFJREF1TVRjeE5UYzVRekF1TlRRd05qZ3hJREF1TVRZME16WWdNQzQxTlRFNU9UWWdNQzR4TmpJM01qVWdNQzQxTmpFek1qUWdNQzR4TmpjMU1ERkRNQzQyTURRM05ESWdNQzR4T0RrM015QXdMalkwTWpVM015QXdMakl5TVRVeU5pQXdMalkzTVRrMk9TQXdMakkyTURRNU5VTXdMalkzT0RNd09DQXdMakkyT0RnNU9DQXdMalkzT0RZME5DQXdMakk0TURNNU1pQXdMalkzTWpnd05pQXdMakk0T1RFek4wd3dMalkwTkRZeE1pQXdMak16TVRNM01rTXdMall6TmpVMU9TQXdMak0wTXpNNU5DQXdMall6TkRjd05pQXdMak0xT0RVME15QXdMall6T1RZeUlEQXVNemN5TVRjeVF6QXVOalEwTlRNMElEQXVNemcxT0NBd0xqWTFOVFl5T0NBd0xqTTVOakk0TVNBd0xqWTJPVFV6SURBdU5EQXdOREEzVERBdU56RTRNakkzSURBdU5ERTBPVEk1UXpBdU56STRNekEwSURBdU5ERTNPVE0xSURBdU56TTFNemd6SURBdU5ESTJPVGs1SURBdU56TTFPRFkySURBdU5ETTNOVEUyUXpBdU56TTRNVEEwSURBdU5EZzJNalk1SURBdU56STVNamd4SURBdU5UTTBPRGd5SURBdU56RXdNRFU1SURBdU5UYzVOekF6UXpBdU56QTFPVE14SURBdU5UZzVNekk1SURBdU5qazJNVGcySURBdU5UazFNamswSURBdU5qZzFOelF6SURBdU5UazBOVGczVERBdU5qTTFNekkwSURBdU5Ua3hNVGMwUXpBdU5qSXdPVEF5SURBdU5Ua3dNakEwSURBdU5qQTJPRGc0SURBdU5UazJNVFl4SURBdU5UazNOVGMySURBdU5qQTNNakU1UXpBdU5UZzRNalkwSURBdU5qRTRNamMzSURBdU5UZzBOelkxSURBdU5qTXpNVEU0SURBdU5UZzRNVFV4SURBdU5qUTNNVGsxVERBdU5UazVPVGc0SURBdU5qazJOREk1UXpBdU5qQXlOREk1SURBdU56QTJOVGd4SURBdU5UazRNalF4SURBdU56RTNNVFkySURBdU5UZzVOVEkwSURBdU56SXlPRGM1UXpBdU5UUTROVFEwSURBdU56UTVOek14SURBdU5UQXhPRE16SURBdU56WTJOVGN6SURBdU5EVXpNVFEySURBdU56Y3lNRFV4UXpBdU5EUXlOemc1SURBdU56Y3pNakUySURBdU5ETXlPREE1SURBdU56WTNOek01SURBdU5ESTRNakVnTUM0M05UZ3pOalZNTUM0ME1EVTVNemdnTUM0M01USTVOekpETUM0ek9UazFNeklnTUM0M01EQXdNVE1nTUM0ek9EY3pOamdnTUM0Mk9UQTROakVnTUM0ek56TXhOVGtnTUM0Mk9EZ3pNRGxETUM0ek5UZzVOVEVnTUM0Mk9EVTNOVGdnTUM0ek5EUXpPRFVnTUM0Mk9UQXhNRGtnTUM0ek16TTVNekVnTUM0M01EQXdNVFJNTUM0eU9UY3lPRE1nTUM0M016UTRNalZETUM0eU9EazJPVElnTUM0M05ESXdNelVnTUM0eU56Z3pOemtnTUM0M05ETTJOaUF3TGpJMk9UQTFOeUF3TGpjek9EZzNPVU13TGpJeU5UWXlOQ0F3TGpjeE5qWXdOU0F3TGpFNE56YzRPU0F3TGpZNE5EYzJNU0F3TGpFMU9EUXdNU0F3TGpZME5UYzBNME13TGpFMU1qQTNNaUF3TGpZek56TXpPU0F3TGpFMU1UYzBNaUF3TGpZeU5UZzFJREF1TVRVM05UYzVJREF1TmpFM01URk1NQzR4T0RVNE1qRWdNQzQxTnpRNE1qZERNQzR4T1RNNE56TWdNQzQxTmpJNE1EVWdNQzR4T1RVM01qY2dNQzQxTkRjMk5UWWdNQzR4T1RBNE1UTWdNQzQxTXpRd01qaERNQzR4T0RVNE9Ua2dNQzQxTWpBek9Ua2dNQzR4TnpRNE1EUWdNQzQxTURrNU1UZ2dNQzR4TmpBNU1UVWdNQzQxTURVM09UWk1NQzR4TVRJeU15QXdMalE1TVRNd05VTXdMakV3TWpFME5pQXdMalE0T0RNd015QXdMakE1TlRBMU9Ua2dNQzQwTnpreU16VWdNQzR3T1RRMU56YzFJREF1TkRZNE56RXpRekF1TURreU16UXlJREF1TkRFNU9UVXhJREF1TVRBeE1UYzNJREF1TXpjeE16TWdNQzR4TWpBME1Ua2dNQzR6TWpZMU1EaERNQzR4TWpRMU5UTWdNQzR6TVRZNE56Z2dNQzR4TXpRek1EZ2dNQzR6TVRBNU1UWWdNQzR4TkRRM05UWWdNQzR6TVRFMk16Tk1NQzR4T1RRNU9DQXdMak14TlRBNE0wTXdMakl3T1RReU9TQXdMak14TmpBM0lEQXVNakl6TkRZNUlEQXVNekV3TURjeUlEQXVNak15TnprM0lEQXVNams0T0RnNFF6QXVNalF5TVRBeUlEQXVNamczT0RBeUlEQXVNalExTmpBeUlEQXVNamN5T1RRM0lEQXVNalF5TWpNeklEQXVNalU0T0RZeVREQXVNak13TkRNM0lEQXVNakE1TmpRNVF6QXVNakkzT1RjMElEQXVNVGs1TXpjeElEQXVNak15TXpBMElEQXVNVGc0TmpjZ01DNHlOREV5TVRJZ01DNHhPRE13TVRsRE1DNHlOakUyTXlBd0xqRTNNREEyTnlBd0xqSTRNek16TlNBd0xqRTFPVEkzSURBdU16QTJOVEl5SURBdU1UVXdOakEzV2swd0xqUXhOVFF5TWlBd0xqWXlNVGMzTTBNd0xqVXdPRFl5SURBdU5qSXhOemN6SURBdU5UZzBNVGN4SURBdU5UUTJNakl4SURBdU5UZzBNVGN4SURBdU5EVXpNREkwUXpBdU5UZzBNVGN4SURBdU16VTVPREkySURBdU5UQTROaklnTUM0eU9EUXlOelVnTUM0ME1UVTBNaklnTUM0eU9EUXlOelZETUM0ek1qSXlNak1nTUM0eU9EUXlOelVnTUM0eU5EWTJOeklnTUM0ek5UazRNallnTUM0eU5EWTJOeklnTUM0ME5UTXdNalJETUM0eU5EWTJOeklnTUM0MU5EWXlNakVnTUM0ek1qSXlNak1nTUM0Mk1qRTNOek1nTUM0ME1UVTBNaklnTUM0Mk1qRTNOek5hSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TnpVMk1pQXdMalE1T1RrMU9Fd3dMak0yT0RjNU5TQXdMalE0TWpFd09FZ3dMak16TkRJM05rd3dMak15TnpRMU1TQXdMalE1T1RrMU9FZ3dMak13TlRZMk5Fd3dMak0wTVRnNE9TQXdMalF3T0RBNE1VZ3dMak0yTVRBMU1Vd3dMak01TnpRd055QXdMalE1T1RrMU9FZ3dMak0zTlRZeVdrMHdMak0yTWpFd01TQXdMalEyTXpjek1rd3dMak0xTkRJeU5pQXdMalEwTXpreE0wTXdMak0xTXpBd01TQXdMalEwTURrek9DQXdMak0xTWpBNE1pQXdMalF6T0RNMU55QXdMak0xTVRRM0lEQXVORE0yTVRZNVF6QXVNelV4TVRJZ01DNDBNemMyTlRjZ01DNHpOVEF5TURFZ01DNDBOREF5TXpnZ01DNHpORGczTVRRZ01DNDBORE01TVROTU1DNHpOREE0TXprZ01DNDBOak0zTXpKSU1DNHpOakl4TURGYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME1Ea3hORFFnTUM0ME9UazVOVGhXTUM0ME1EZ3dPREZJTUM0ME5EazRNekZETUM0ME5qQTNOamdnTUM0ME1EZ3dPREVnTUM0ME5qZzRNVGdnTUM0ME1UQTVNalVnTUM0ME56TTVPQ0F3TGpReE5qWXhNa013TGpRM09USXpJREF1TkRJeU15QXdMalE0TVRnMU5TQXdMalF5T1RNZ01DNDBPREU0TlRVZ01DNDBNemMyTVRORE1DNDBPREU0TlRVZ01DNDBOREV5SURBdU5EZ3hNalF6SURBdU5EUTBOekF4SURBdU5EZ3dNREU0SURBdU5EUTRNVEV6UXpBdU5EYzROemt6SURBdU5EVXhORE00SURBdU5EYzJPVFUxSURBdU5EVTBOVFEwSURBdU5EYzBOVEExSURBdU5EVTNORE15UXpBdU5EY3lNRFUxSURBdU5EWXdNeklnTUM0ME5qZzJPRGNnTUM0ME5qSTJNemdnTUM0ME5qUXpPVGtnTUM0ME5qUXpPRGhETUM0ME5qQXhNVElnTUM0ME5qWXhNemdnTUM0ME5UVXlOVFlnTUM0ME5qY3dNVE1nTUM0ME5EazRNekVnTUM0ME5qY3dNVE5JTUM0ME1qa3dPVE5XTUM0ME9UazVOVGhJTUM0ME1Ea3hORFJhVFRBdU5EVXdOakU0SURBdU5EUTRNalEwUXpBdU5EVTBNVEU0SURBdU5EUTRNalEwSURBdU5EVTJOelF6SURBdU5EUTNNVGswSURBdU5EVTRORGt6SURBdU5EUTFNRGswUXpBdU5EWXdNalF6SURBdU5EUXlPVGswSURBdU5EWXhNVEU0SURBdU5EUXdOU0F3TGpRMk1URXhPQ0F3TGpRek56WXhNME13TGpRMk1URXhPQ0F3TGpRek5EZ3hNeUF3TGpRMk1ESTROeUF3TGpRek1qTTJNeUF3TGpRMU9EWXlOQ0F3TGpRek1ESTJNME13TGpRMU5qazJNaUF3TGpReU9EQTNOU0F3TGpRMU5ESTVNeUF3TGpReU5qazRNU0F3TGpRMU1EWXhPQ0F3TGpReU5qazRNVWd3TGpReU9UQTVNMVl3TGpRME9ESTBORWd3TGpRMU1EWXhPRm9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TkRFek55QXdMalE1T1RrMU9GWXdMalF3T0RBNE1VZ3dMalV4TkRBNE4xWXdMalE1T1RrMU9FZ3dMalE1TkRFek4xb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TXpjMUlpQm9aV2xuYUhROUlqQXVPVE0zTlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ETXhNalVnTUM0d016RXlOU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpJNE9UY3lOaUlnYUdWcFoyaDBQU0l3TGpJNE9UY3lNaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TmpFeU56a3pJREF1TlRrek56VXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01pSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQyTlRZeU5TSWdhR1ZwWjJoMFBTSXdMalkxTmpJMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdPRGMwTURJeklEQXVNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODEiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjUxMyIgeT0iLTUzMiIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIxOSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTQ1YjllMzRhLTUwYWItNDBjNi04NjY2LTg0YjkyN2E4OGY5NDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj0zNGRlMDc1Yi1kNDMxLTQ0MzMtOWZjMC04M2E5MWFlNDBkZTk7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTgiIHNvdXJjZT0iMjAiIHRhcmdldD0iMTkiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjIwIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NTI5ZTcxNWYtNjNlNi00NTdiLWJlNjktZDQ2MTcwZGY0ZDI1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjE4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MDAiIHk9Ii0yOSIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIxMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTAzZDViNTRiLWQxYzgtNDQ0MS1iNWQwLWI2ZTk4OGIxZTM2Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj0wZDAxYjA0Ny0wZGMyLTQwZTUtOGFmNi03ZjZmNWQ1Yjc0YzE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTIiIHNvdXJjZT0iMTQiIHRhcmdldD0iMTMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjE0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZDBhYjlmYjYtNjgyYy00NmY0LWJhYzQtMWRjMWM4Zjg2MDM5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjEyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNjExIiB5PSItMzY1IiB3aWR0aD0iNzY5IiBoZWlnaHQ9IjQwOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDEiIHZhbHVlPSJTUEEgT3BlcmFjaW9uZXMgUGVuZGllbnRlcyAtPiBEYXJ3aW4gR2F0ZXdheSBXZWIiIHN0eWxlPSJpci5yZWY9ZGFlYThkMTYtZmQxNS00YjI5LTljZDEtMmRjNWNiNTExZjk5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMzIiBzb3VyY2U9IjIzIiB0YXJnZXQ9IjI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU1BBIE9wZXJhY2lvbmVzIFBlbmRpZW50ZXMiIGlkPSIyMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWExMmY0OWE1LTA0MWEtNGM0Yy1iYzNmLWVlNjYyOTg5OTJkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2OCIgeT0iMTI3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkJGRiIgaWQ9IjIxIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZjNjZjQ4MDktNGIwYy00ZWI3LWJjNDAtN2IxMTE3NmU4ZjBjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NTYiIHk9IjU4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIyNCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTg2YTMzYzgzLWUwZGItNDE4Yi1hODQ4LTMwMDNkM2ViNzhmYTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMzMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTU3IiB5PSIyMjciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDIiIHZhbHVlPSJEYXJ3aW4gR2F0ZXdheSBXZWIgLT4gQkZGIiBzdHlsZT0iaXIucmVmPWNlNzNlOTdhLThhYzgtNDQwMy05YjhmLTE0YTE3ZDdmNzAxNDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzMyIgc291cmNlPSIyNiIgdGFyZ2V0PSIyMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFdlYiIgaWQ9IjI2Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9Y2ZmNWU4ZjMtOTQyMi00NjRlLThjZmMtZTcyMTc4NDVjZThjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMjgiIHk9IjU4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjU3IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj1hY2QwMzM3Yy01YmY3LTQzOWUtYWEyNC1kYTk4MTQwODUzOTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMzMiIHNvdXJjZT0iMjUiIHRhcmdldD0iMjQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjI1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZWFiYjM1ZTUtOWY3Ni00Y2M3LTgyNTQtNGZlYjZjOTBmYzg4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMjgiIHk9IjIyNyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzNSIgdmFsdWU9IkJGRiAtPiBJQk0gRGIyIiBzdHlsZT0iaXIucmVmPWQ2YjVlNGNmLWNiNjUtNGE0ZS04YTU0LTc0MWM2ZjlmOGQyNDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIxIiBzb3VyY2U9IjIxIiB0YXJnZXQ9IjU1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIyMjEiIHk9Ii01MTgiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMTAiIHk9Ii0xNzgiLz48bXhQb2ludCB4PSIyMjAiIHk9Ii0xNzgiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNiIgdmFsdWU9IkJhYVMgLT4gSUJNIERiMiIgc3R5bGU9ImlyLnJlZj1lODI1MDNkNy1lMWUwLTQ2ZTAtOTNkZi1iZmYyMjA0YjU3OGE7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0wO2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDsiIHBhcmVudD0iMSIgc291cmNlPSIyNCIgdGFyZ2V0PSI1NSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjI0IiB5PSItNTE4IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTkiIHk9Ii0xNzciLz48bXhQb2ludCB4PSIyMjAiIHk9Ii0xNzciLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNyIgdmFsdWU9IkJhYVMgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9ZWE4YWI3ODctOGYyYy00NTE1LTgxNTAtOTIyYTgzZTI0NDRlO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjQiIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzOCIgdmFsdWU9IkJhYVMgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9NGY0OWYzMzQtMDZjMi00MWYwLTlmNTctODY0YmJkNGNmYmE5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjQiIHRhcmdldD0iMTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzMTUiIHk9Ii05MyIvPjxteFBvaW50IHg9IjMxNSIgeT0iOTYiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzOSIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIC0+IERhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBzdHlsZT0iaXIucmVmPTBlY2YxZmIyLWIzZjktNGQwOC1iNTM4LTViNjMwMDllNDE1NDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjc1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxNCIgdGFyZ2V0PSIyNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiB2YWx1ZT0iQ2xpZW50ZXMgLT4gU1BBIE9wZXJhY2lvbmVzIFBlbmRpZW50ZXMiIHN0eWxlPSJpci5yZWY9NjY0MTUyMDgtNzBjMC00Mjk4LWFlMjctZWU4ZTdkYjQ0Y2UzO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMiIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNzk1IiB5PSIyNjciIHdpZHRoPSI2OTAiIGhlaWdodD0iMzA1IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJCRkYiIGlkPSI0NCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTFiMDQxMTQ0LWFiOTAtNDJjMS1hM2FlLTExMGUxZTIzODIyYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNDMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTExIiB5PSIxMDcuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI1MCIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFdlYiAtPiBCRkYiIHN0eWxlPSJpci5yZWY9NjIxYTQ3Y2YtOTk2ZC00YmU5LWEyMTYtZTQzOTI5ZWYxZGQ0O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQzIiBzb3VyY2U9IjQ1IiB0YXJnZXQ9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRGFyd2luIEdhdGV3YXkgV2ViIiBpZD0iNDUiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zODdkZTU3YS02YjA3LTRmNjQtOTgyNi1lYzBiZmQyN2RlYjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI5NyIgeT0iMTA3LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDkiIHZhbHVlPSJTUEEgQXV0b3JpemFjacOzbiBkZSBPcGVyYWNpb25lcyAtPiBEYXJ3aW4gR2F0ZXdheSBXZWIiIHN0eWxlPSJpci5yZWY9NzNhMWIyY2MtMjZkNi00ZjA0LTg4MDItMDcwMjE2NGRlNTU3O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQzIiBzb3VyY2U9IjQ3IiB0YXJnZXQ9IjQ1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU1BBIEF1dG9yaXphY2nDs24gZGUgT3BlcmFjaW9uZXMiIGlkPSI0NyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWQ4YmQ0MDI1LWQzNDMtNGEyOC05OTE5LTAxMmZiNTY3OTZlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0MyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4MyIgeT0iMTA3LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDgiIHZhbHVlPSJDbGllbnRlcyAtPiBTUEEgQXV0b3JpemFjacOzbiBkZSBPcGVyYWNpb25lcyIgc3R5bGU9ImlyLnJlZj0yNjg2OGVkMy1hOGE3LTRjMmEtOWM4ZS00M2UyNTFhYWVjMTY7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIyIiB0YXJnZXQ9IjQ3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTIiIHZhbHVlPSJCRkYgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9MjAyNzhmMGQtY2ZkMi00YjNjLWExZjUtNDVkOTU4NGFmODQxO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDQiIHRhcmdldD0iMjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MyIgdmFsdWU9IkJGRiAtPiBEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgc3R5bGU9ImlyLnJlZj03YzkwMzQyMi04NDNiLTQ2YmEtODFjOC0wNDE4OTdjMThmM2Q7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI0NCIgdGFyZ2V0PSI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTQiIHZhbHVlPSJCRkYgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9MWI2MWU4ZjEtMGZjOS00NTg5LTgzM2MtZGU1ODU4NmJlZjY2O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDQiIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMjM5IiB5PSI1MjMiLz48bXhQb2ludCB4PSIzNzQiIHk9IjUyMyIvPjxteFBvaW50IHg9IjM3NCIgeT0iLTQwNyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjU2IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDUiIHk9Ii03MTEiIHdpZHRoPSIyMzAiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1NSIgdmFsdWU9IklCTSBEYjIiIHN0eWxlPSJpci5yZWY9ODc5YzgyNjYtMGYzNy00ZTM0LWJhMzgtOWI3MjY4ZDQ5NjRmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUlCTS1EQjI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdYekl6TVROZk1qSXpOelFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjek5qVTFNU0F3TGpRek1qTTVPRU13TGpjMU9URTFNU0F3TGpReU1UUXpJREF1Tnpnd01UYzVJREF1TkRBM05UUTRJREF1TnprNU1EZzBJREF1TXpreE1URXpWakF1TnpJeE56azBRekF1TnprNU1EZzBJREF1T0RBek5EYzJJREF1TmpZMU1URTNJREF1T0RZNU5qTTBJREF1TkRrNU9EZzBJREF1T0RZNU5qTTBRekF1TXpNME5qVWdNQzQ0TmprMk16UWdNQzR5TURBMk9EUWdNQzQ0TURNME56WWdNQzR5TURBMk9EUWdNQzQzTWpFM09UUldNQzR6T1RFeE1UTkRNQzR5TVRrMU9EZ2dNQzQwTURjMU5EZ2dNQzR5TkRBMk1UWWdNQzQwTWpFME15QXdMakkyTXpJeE5pQXdMalF6TWpNNU9FTXdMak15TmpjeU1pQXdMalEyTXpjMElEQXVOREV3TkRJeklEQXVORGd4TlRVMElEQXVORGs1T0RnMElEQXVORGd4TlRVMFF6QXVOVGc1TXpRMElEQXVORGd4TlRVMElEQXVOamN6TURRMklEQXVORFl6TnpRZ01DNDNNelkxTlRFZ01DNDBNekl6T1RoYUlpQm1hV3hzUFNJak1EQTVRVEpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M016WTFOVEVnTUM0ME16SXpPVGhETUM0M05Ua3hOVEVnTUM0ME1qRTBNeUF3TGpjNE1ERTNPU0F3TGpRd056VTBPQ0F3TGpjNU9UQTROQ0F3TGpNNU1URXhNMVl3TGpVM01qRTVORU13TGpjNU9UQTROQ0F3TGpZMU16ZzNOaUF3TGpZMk5URXhOeUF3TGpjeU1EQXpOQ0F3TGpRNU9UZzROQ0F3TGpjeU1EQXpORU13TGpNek5EWTFJREF1TnpJd01ETTBJREF1TWpBd05qZzBJREF1TmpVek9EYzJJREF1TWpBd05qZzBJREF1TlRjeU1UazBWakF1TXpreE1URXpRekF1TWpFNU5UZzRJREF1TkRBM05UUTRJREF1TWpRd05qRTJJREF1TkRJeE5ETWdNQzR5TmpNeU1UWWdNQzQwTXpJek9UaERNQzR6TWpZM01qSWdNQzQwTmpNM05DQXdMalF4TURReU15QXdMalE0TVRVMU5DQXdMalE1T1RnNE5DQXdMalE0TVRVMU5FTXdMalU0T1RNME5DQXdMalE0TVRVMU5DQXdMalkzTXpBME5pQXdMalEyTXpjMElEQXVOek0yTlRVeElEQXVORE15TXprNFdpSWdabWxzYkQwaVlteGhZMnNpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJNU56ZzFNaUF3TGpRNU1UTTJOME13TGpNeU16UTRPU0F3TGpRNU56Y3dPQ0F3TGpNME9UTXpOaUF3TGpVd016Z3hOaUF3TGpNM05UTTVNaUF3TGpVd09UWTVRekF1TXpjMU5qVXpJREF1TlRFeU9EWXhJREF1TXpjMU9URTFJREF1TlRFMk1EVTNJREF1TXpjMk1UYzNJREF1TlRFNU1qaERNQzR6TkRrNU5qUWdNQzQxTVRNM055QXdMak15TXprMklEQXVOVEE0TURJMklEQXVNams0TVRZMUlEQXVOVEF5TURRNVF6QXVNams0TURZeElEQXVORGs0TkRZeUlEQXVNamszT1RVMklEQXVORGswT1RBeUlEQXVNamszT0RVeUlEQXVORGt4TXpZM1drMHdMak00TmpZNU15QXdMalV4TVRrMU1VTXdMak00TmprMU5TQXdMalV4TlRBeE9DQXdMak00TnpJeE5pQXdMalV4T0RFMk1pQXdMak00TnpRM09DQXdMalV5TVRNNE5VTXdMalF5TmpNZ01DNDFNalkyT0RjZ01DNDBOalU0TWprZ01DNDFNekF5TWpJZ01DNDFNRFl3TmpRZ01DNDFNekU1T0RsRE1DNDFNRFl3TmpRZ01DNDFNekU1T0RrZ01DNDBPVEk0TURFZ01DNDFNak13TWpNZ01DNDBOelkzTVRJZ01DNDFNakkxTlRWRE1DNDBORFl4TlRZZ01DNDFNakF3TURnZ01DNDBNVFl4TlNBd0xqVXhOalEzTXlBd0xqTTROalk1TXlBd0xqVXhNVGsxTVZwTk1DNDFNekEzTURnZ01DNDFNakkwTnpkRE1DNDFNekEzTURnZ01DNDFNalUwTkNBd0xqVXpNRGN3T0NBd0xqVXlPRFF3TWlBd0xqVXpNRGN3T0NBd0xqVXpNVE0yTlVNd0xqVTFOVFkyTlNBd0xqVXlPVFU1T0NBd0xqVTRNREkxTmlBd0xqVXlOekl3TnlBd0xqWXdORFE0TVNBd0xqVXlOREU1TWtNd0xqWXdNelF6TkNBd0xqVXlNVEk0TVNBd0xqWXdNalEwSURBdU5URTRNemNnTUM0Mk1ERTBPVGdnTUM0MU1UVTBOVGxETUM0MU56Z3lNVFVnTUM0MU1UZ3pOeUF3TGpVMU5EWXhPQ0F3TGpVeU1EY3dPU0F3TGpVek1EY3dPQ0F3TGpVeU1qUTNOMXBOTUM0M01URTBOVElnTUM0ME9URXlNVEZETUM0Mk9USTNOek1nTUM0ME9UWXdPVGNnTUM0Mk56TTNNamdnTUM0MU1EQTROemtnTUM0Mk5UUXpNVGNnTUM0MU1EVTFOVGRETUM0Mk5USTFNemdnTUM0MU1Ea3dPVElnTUM0Mk5UQTRNVEVnTUM0MU1USTJOVE1nTUM0Mk5Ea3hNemNnTUM0MU1UWXlNemxETUM0Mk56QXdOalVnTUM0MU1URTFNRGtnTUM0Mk9UQTFOelVnTUM0MU1EWTNNREVnTUM0M01UQTJOamNnTUM0MU1ERTRNVFZETUM0M01UQTVNamdnTUM0ME9UZ3lPQ0F3TGpjeE1URTVJREF1TkRrME56UTJJREF1TnpFeE5EVXlJREF1TkRreE1qRXhXazB3TGpJNU9EUTNPU0F3TGpVeE1qSTJNME13TGpNeU5EUXpNU0F3TGpVeE56azRNU0F3TGpNMU1EVTJOU0F3TGpVeU16UTJOQ0F3TGpNM05qZzRNeUF3TGpVeU9EY3hORU13TGpNM056QTVNaUF3TGpVek1qQTVNeUF3TGpNM056TXdNU0F3TGpVek5UUTNNaUF3TGpNM056VXhNU0F3TGpVek9EZzFRekF1TXpVeE1EZzVJREF1TlRNek9EWWdNQzR6TWpRNE5Ea2dNQzQxTWpnMk16WWdNQzR5T1RnM09UTWdNQzQxTWpNeE56aERNQzR5T1RnMk9Ea2dNQzQxTVRrMU5DQXdMakk1T0RVNE5DQXdMalV4TlRrd01TQXdMakk1T0RRM09TQXdMalV4TWpJMk0xcE5NQzR6T0RnNE9URWdNQzQxTkRBNFF6QXVORE15TXpjZ01DNDFORFU1TkRZZ01DNDBOelkwTnpjZ01DNDFORGt3TXpnZ01DNDFNakV5TVRFZ01DNDFOVEF3TnpoRE1DNDFNakV5TVRFZ01DNDFOVEF3TnpnZ01DNDFNVGszT1RrZ01DNDFOREkxT1RNZ01DNDFNVFkyTlRrZ01DNDFOREEyTkRSRE1DNDBOek13TnpZZ01DNDFNemt6TkRRZ01DNDBNekF5TnpjZ01DNDFNell3TmprZ01DNHpPRGd5TmpNZ01DNDFNekE0TWtNd0xqTTRPRFEzTWlBd0xqVXpOREUwTmlBd0xqTTRPRFk0TVNBd0xqVXpOelEzTXlBd0xqTTRPRGc1TVNBd0xqVTBNRGhhVFRBdU5UTXdOekE0SURBdU5UUTVOelkyUXpBdU5UVTNOakF4SURBdU5UUTNPRGsxSURBdU5UZzBNVEk0SURBdU5UUTFNelE0SURBdU5qRXdNamc0SURBdU5UUXlNVEkxUXpBdU5qQTVORFV4SURBdU5UTTRPVFUwSURBdU5qQTROVGc0SURBdU5UTTFPREVnTUM0Mk1EYzJPVGdnTUM0MU16STJPVEZETUM0MU9ESTBNamNnTUM0MU16VTRNU0F3TGpVMU5qYzJOQ0F3TGpVek9ETXdOU0F3TGpVek1EY3dPQ0F3TGpVME1ERTNOa013TGpVek1EY3dPQ0F3TGpVME16TTBOeUF3TGpVek1EY3dPQ0F3TGpVME5qVTBNeUF3TGpVek1EY3dPQ0F3TGpVME9UYzJObHBOTUM0M01EazFOamdnTUM0MU1qSTNNVEZETUM0M01EazNOemNnTUM0MU1Ua3hNalFnTUM0M01EazVOaUF3TGpVeE5UVXpOeUF3TGpjeE1ERXhOeUF3TGpVeE1UazFNVU13TGpZNE9EVXdPU0F3TGpVeE5qZzRPU0F3TGpZMk5qUTFOU0F3TGpVeU1UY3lNeUF3TGpZME16azFOeUF3TGpVeU5qUTFNME13TGpZME1qUTVNaUF3TGpVek1EQTBJREF1TmpReE1EVXpJREF1TlRNek5qSTJJREF1TmpNNU5qUXhJREF1TlRNM01qRXpRekF1TmpZek16azBJREF1TlRNeU5UTTFJREF1TmpnMk56QTBJREF1TlRJM056QXhJREF1TnpBNU5UWTRJREF1TlRJeU56RXhXazB3TGpNeU1UY3hJREF1TlRNM05USTFRekF1TXpNek1EWTBJREF1TlRNNU56WWdNQzR6TkRRME55QXdMalUwTVRrMk9TQXdMak0xTlRreU9DQXdMalUwTkRFMU1rTXdMak0xTmpBNE5TQXdMalUwTnpZNE55QXdMak0xTmpJeE5pQXdMalUxTVRJeU1pQXdMak0xTmpNeU1TQXdMalUxTkRjMU5rTXdMak0wTkRnMk1pQXdMalUxTWpZeU5TQXdMak16TXpReklEQXVOVFV3TkRZNElEQXVNekl5TURJMElEQXVOVFE0TWpnMVF6QXVNekl4T1RFNUlEQXVOVFEwTmprNElEQXVNekl4T0RFMUlEQXVOVFF4TVRFeUlEQXVNekl4TnpFZ01DNDFNemMxTWpWYVRUQXVOREV5T1RnMUlEQXVOVFV6TWpjMVF6QXVOREkwTnpVM0lEQXVOVFUwTmpJMklEQXVORE0yTlRneUlEQXVOVFUxT0RRNElEQXVORFE0TkRVNElEQXVOVFUyT1RNNVF6QXVORFE0TmpZNElEQXVOVFl3TXpjZ01DNDBORGc0TlRFZ01DNDFOak0zTnpVZ01DNDBORGt3TURnZ01DNDFOamN4TlRORE1DNDBNemN4T0RNZ01DNDFOall4TVRRZ01DNDBNalV6T0RVZ01DNDFOalE1TkRRZ01DNDBNVE0yTVRJZ01DNDFOak0yTkRWRE1DNDBNVE0wTURNZ01DNDFOakF4TmpJZ01DNDBNVE14T1RRZ01DNDFOVFkzTURVZ01DNDBNVEk1T0RVZ01DNDFOVE15TnpWYVRUQXVORGcwTWpRMklEQXVOVFk1TURJMVF6QXVORGsyTWpJNElEQXVOVFk1TVRneElEQXVOVEE0TWpBNUlEQXVOVFk1TVRneElEQXVOVEl3TVRreElEQXVOVFk1TURJMVF6QXVOVEl3TVRreElEQXVOVFk1TURJMUlEQXVOVEl5TmpJMElEQXVOVFl6TlRZM0lEQXVOVEl5TlRRMUlEQXVOVFU0T0RnNVF6QXVOVEE1TmpJeUlEQXVOVFU1TURRMUlEQXVORGsyTmprNUlEQXVOVFU1TURRMUlEQXVORGd6TnpjMUlEQXVOVFU0T0RnNVF6QXVORGd6T0RnZ01DNDFOakl5TmpjZ01DNDBPRFF3TVRFZ01DNDFOalUyTkRZZ01DNDBPRFF4TmpnZ01DNDFOamt3TWpWRE1DNDBPRFF5TWlBd0xqVTJPVEF5TlNBd0xqUTROREkwTmlBd0xqVTJPVEF5TlNBd0xqUTROREkwTmlBd0xqVTJPVEF5TlZwTk1DNDFOVFV3TXpjZ01DNDFOVGN4TnpORE1DNDFOVFE1T0RVZ01DNDFOakEyTURRZ01DNDFOVFE1TlRrZ01DNDFOalF3TURrZ01DNDFOVFE1TlRrZ01DNDFOamN6T0RkRE1DNDFOelU0TXpVZ01DNDFOalUwTVRJZ01DNDFPVFkwTnpVZ01DNDFOak13TnpNZ01DNDJNVFk0T0RFZ01DNDFOakF6TjBNd0xqWXhOVFkzTnlBd0xqVTFOekUwTnlBd0xqWXhORFV5TmlBd0xqVTFNemc1T1NBd0xqWXhNelF5T0NBd0xqVTFNRFl5TkVNd0xqVTVOREl5TmlBd0xqVTFNekUzTVNBd0xqVTNORGMyTWlBd0xqVTFOVE0xTkNBd0xqVTFOVEF6TnlBd0xqVTFOekUzTTFwTk1DNDJNekE1TWprZ01DNDFOVGd4TURsRE1DNDJOVEExTlNBd0xqVTFORFUzTkNBd0xqWTJPVGt3T0NBd0xqVTFNRGt4SURBdU5qZzVNREEySURBdU5UUTNNVEUxUXpBdU5qZzVNVFl6SURBdU5UUXpOak16SURBdU5qZzVNeklnTUM0MU5EQXdPVGdnTUM0Mk9EazBOemNnTUM0MU16WTFNVEZETUM0Mk56RTNOQ0F3TGpVME1ERTFJREF1TmpVek56RTFJREF1TlRRek5qVTVJREF1TmpNMU5EQXpJREF1TlRRM01ETTNRekF1TmpNek9EZzFJREF1TlRVd056Z2dNQzQyTXpJek9UUWdNQzQxTlRRME55QXdMall6TURreU9TQXdMalUxT0RFd09WcE5NQzR6TWpJeU5Ua2dNQzQxTlRnMk5UVkRNQzR6TXpNM01UZ2dNQzQxTmpBM09EWWdNQzR6TkRVeU1ESWdNQzQxTmpJNU1UY2dNQzR6TlRZM01UTWdNQzQxTmpVd05EaERNQzR6TlRZNE55QXdMalUyT0RZNE55QXdMak0xTnpBd01TQXdMalUzTWpNeU5TQXdMak0xTnpFd05TQXdMalUzTlRrMk5FTXdMak0wTlRVME1pQXdMalUzTXpnNE5TQXdMak16TkRBek1pQXdMalUzTVRjNElEQXVNekl5TlRjeklEQXVOVFk1TmpRNFF6QXVNekl5TkRZNUlEQXVOVFkxT1RVNElEQXVNekl5TXpZMElEQXVOVFl5TWpreklEQXVNekl5TWpVNUlEQXVOVFU0TmpVMVdrMHdMalF4TkRVMU5DQXdMalU0TkRZNU4wTXdMalEwTkRrd01TQXdMalU0TnpNNU9TQXdMalEzTlRNMU1pQXdMalU0T1RFNU15QXdMalV3TlRrd055QXdMalU1TURBM05rTXdMalV3TlRrd055QXdMalU1TURBM05pQXdMalV4TXpFeU9DQXdMalU0TkRFMU1TQXdMalV4TlRRd05DQXdMalUzT1RFMk1VTXdMalE0TVRRME55QXdMalUzT0RRNE5TQXdMalEwTnpZM05DQXdMalUzTmpZMk5pQXdMalF4TkRBNE15QXdMalUzTXpjd00wTXdMalF4TkRJMElEQXVOVGMzTXpReElEQXVOREUwTXprM0lEQXVOVGd4TURBMklEQXVOREUwTlRVMElEQXVOVGcwTmprM1drMHdMall5TXpNeE5pQXdMalUzT0RVek4wTXdMall5TWpReU55QXdMalUzTlRZeU5pQXdMall5TVRVek55QXdMalUzTWpjeE5TQXdMall5TURZME9DQXdMalUyT1Rnd05FTXdMalU1T1RBek9TQXdMalUzTWpjMk55QXdMalUzTnpFeE55QXdMalUzTlRJNE9DQXdMalUxTkRnNElEQXVOVGMzTXpZM1F6QXVOVFUwT0RnZ01DNDFPREE1TlRRZ01DNDFOVFE1TURZZ01DNDFPRFExTmpjZ01DNDFOVFE1TlRrZ01DNDFPRGd5TURWRE1DNDFOalkyTWpZZ01DNDFPRGN5TVRnZ01DNDFOemd5TkRJZ01DNDFPRFl4SURBdU5UZzVPREExSURBdU5UZzBPRFV5UXpBdU5UZzVPRFUzSURBdU5UZ3lOekl4SURBdU5UZzVPRGd6SURBdU5UZ3dOalF5SURBdU5UZzVPRGd6SURBdU5UYzROakUxUXpBdU5Ua3dOalk0SURBdU5UZ3dOVE00SURBdU5Ua3hORFV6SURBdU5UZ3lOVEV6SURBdU5Ua3lNak0zSURBdU5UZzBOVFF4UXpBdU5qRXpNVFkySURBdU5UZ3hOak1nTUM0Mk16TTRNRGNnTUM0MU56ZzBNRGNnTUM0Mk5UUXhOaUF3TGpVM05EZzNNa013TGpZMU5EZzVNaUF3TGpVM01qVTROU0F3TGpZMU5UWTFNU0F3TGpVM01ETTFJREF1TmpVMk5ETTJJREF1TlRZNE1UWTNRekF1TmpVMk16Z3pJREF1TlRjd01qUTJJREF1TmpVMk16TXhJREF1TlRjeU16STFJREF1TmpVMk1qYzVJREF1TlRjME5EQTFRekF1TmpZM01EVTNJREF1TlRjeU16YzNJREF1TmpjM056Z3pJREF1TlRjd01qazRJREF1TmpnNE5EVTJJREF1TlRZNE1UWTNRekF1TmpnNE5UWXhJREF1TlRZME5UZ2dNQzQyT0RnMk16a2dNQzQxTmpBNU5qZ2dNQzQyT0RnMk9USWdNQzQxTlRjek1qbERNQzQyTmpnek9URWdNQzQxTmpFeU9DQXdMalkwTnpjM055QXdMalUyTlRFZ01DNDJNalk0TkRnZ01DNDFOamczT1RGRE1DNDJNalUyT1RjZ01DNDFOekl3TmpVZ01DNDJNalExTWlBd0xqVTNOVE14TkNBd0xqWXlNek14TmlBd0xqVTNPRFV6TjFwTk1DNHpNakk0TURrZ01DNDFPREF4TnpSRE1DNHpNelF6TWlBd0xqVTRNak13TlNBd0xqTTBOVGcxTmlBd0xqVTRORFF6TnlBd0xqTTFOelF4T1NBd0xqVTROalUyT0VNd0xqTTFOelV5TkNBd0xqVTVNREkxT0NBd0xqTTFOell5T1NBd0xqVTVOREF3TVNBd0xqTTFOemN6TXlBd0xqVTVOemM1TlVNd0xqTTBOakV4T0NBd0xqVTVOVFkyTkNBd0xqTXpORFV5T1NBd0xqVTVNelE0TVNBd0xqTXlNamsyTmlBd0xqVTVNVEkwTmtNd0xqTXlNamt4TXlBd0xqVTROelV3TXlBd0xqTXlNamcyTVNBd0xqVTRNemd4TXlBd0xqTXlNamd3T1NBd0xqVTRNREUzTkZwTk1DNDBNVFV6TXprZ01DNDJNRFkzTmpKRE1DNDBORGc1TWprZ01DNDJNRGszTWpVZ01DNDBPREkxT1RnZ01DNDJNVEUwTmpZZ01DNDFNVFl6TkRVZ01DNDJNVEU1T0RaRE1DNDFNVE0zTlRVZ01DNDJNRFkyTURZZ01DNDFNRFl4TkRNZ01DNDJNREEzTlRnZ01DNDFNRFl4TkRNZ01DNDJNREEzTlRoRE1DNDBOelUyT1RJZ01DNDFPVGs0TnpVZ01DNDBORFV5T1RNZ01DNDFPVGd3T0RFZ01DNDBNVFE1TkRjZ01DNDFPVFV6TnpoRE1DNDBNVFV4TURRZ01DNDFPVGt4TWpFZ01DNDBNVFV5TXpRZ01DNDJNREk1TVRVZ01DNDBNVFV6TXprZ01DNDJNRFkzTmpKYVRUQXVOVFUxTVRFMUlEQXVOVGs0TnpNeFF6QXVOVFkyTnpNeElEQXVOVGszTnpReklEQXVOVGM0TXpJZ01DNDFPVFkyTWpZZ01DNDFPRGs0T0RNZ01DNDFPVFV6TnpoRE1DNDFPRGs0T0RNZ01DNDFPVGt4TWpFZ01DNDFPRGs1TURrZ01DNDJNREk0T0RrZ01DNDFPRGs1TmpFZ01DNDJNRFkyT0RSRE1DNDFOemcxTURNZ01DNDJNRGM1T0RNZ01DNDFOalk1TmpZZ01DNDJNRGt4TWpjZ01DNDFOVFV6TlRFZ01DNDJNVEF4TVRWRE1DNDFOVFV5TkRZZ01DNDJNRFl5TmpnZ01DNDFOVFV4TmpnZ01DNDJNREkwTnpRZ01DNDFOVFV4TVRVZ01DNDFPVGczTXpGYVRUQXVOalV3TlRVZ01DNDFPRFU0TmpaRE1DNDJNekkzTURnZ01DNDFPRGc1T0RVZ01DNDJNVFEyTXpFZ01DNDFPVEU0T1RZZ01DNDFPVFl6TVRrZ01DNDFPVFExT1RsRE1DNDFPVGMzTXpFZ01DNDFPVGd4T0RVZ01DNDFPVGt4TkRRZ01DNDJNREUzTnpJZ01DNDJNREExTlRjZ01DNDJNRFV6TlRoRE1DNDJNVFl3T1RZZ01DNDJNRE13TVRrZ01DNDJNekUwTnpnZ01DNDJNREEwTnpJZ01DNDJORFkzTURRZ01DNDFPVGMzTVRkRE1DNDJORGd3TVRJZ01DNDFPVE0zTmpjZ01DNDJORGt5T1RRZ01DNDFPRGs0TVRjZ01DNDJOVEExTlNBd0xqVTROVGcyTmxwTk1DNDJOVFUyTlRFZ01DNDFPRFE1TTBNd0xqWTJOalF5T1NBd0xqVTRNamM1T1NBd0xqWTNOekV5T1NBd0xqVTRNRFk1TkNBd0xqWTROemMxSURBdU5UYzROakUxUXpBdU5qZzNOelVnTUM0MU9ESXlNRElnTUM0Mk9EYzNOU0F3TGpVNE5UZ3hOQ0F3TGpZNE56YzFJREF1TlRnNU5EVXpRekF1TmpjM01USTVJREF1TlRreE5qTTJJREF1TmpZMk5ESTVJREF1TlRrek56a3pJREF1TmpVMU5qVXhJREF1TlRrMU9USTBRekF1TmpVMU5qVXhJREF1TlRreU1qTTBJREF1TmpVMU5qVXhJREF1TlRnNE5UWTVJREF1TmpVMU5qVXhJREF1TlRnME9UTmFUVEF1TXpJek1qQXhJREF1TmpBeE9EVkRNQzR6TXpRM05qUWdNQzQyTURReE16Y2dNQzR6TkRZek5UTWdNQzQyTURZek9UZ2dNQzR6TlRjNU5qa2dNQzQyTURnMk16TkRNQzR6TlRnd056TWdNQzQyTVRJMU16SWdNQzR6TlRneE56Z2dNQzQyTVRZME15QXdMak0xT0RJNE15QXdMall5TURNeU9VTXdMak0wTmpZeE5TQXdMall4TnprNUlEQXVNek0wT1RjMElEQXVOakUxTlRrNUlEQXVNekl6TXpVNElEQXVOakV6TVRVMVF6QXVNekl6TXpBMklEQXVOakE1TkRFeklEQXVNekl6TWpVMElEQXVOakExTmpRMElEQXVNekl6TWpBeElEQXVOakF4T0RWYVRUQXVOREUxTnpNeElEQXVOakUzT0RNMFF6QXVOREkzTlRBMElEQXVOakU1TVRNeklEQXVORE01TXpBeUlEQXVOakl3TXpBeklEQXVORFV4TVRJM0lEQXVOakl4TXpReVF6QXVORFV4TWpnMElEQXVOakkxTXpRMUlEQXVORFV4TkRFMUlEQXVOakk1TXprNUlEQXVORFV4TlRFNUlEQXVOak16TlRBMlF6QXVORE01TmprMUlEQXVOak15TkRZMklEQXVOREkzT0RjZ01DNDJNekV5TkRRZ01DNDBNVFl3TkRVZ01DNDJNams0TkRGRE1DNDBNVFU1TkRFZ01DNDJNalU0TXprZ01DNDBNVFU0TXpZZ01DNDJNakU0TXpZZ01DNDBNVFUzTXpFZ01DNDJNVGM0TXpSYVRUQXVOVEl4TmpBMElEQXVOakl5T1RoRE1DNDFNRGszTnprZ01DNDJNak14TXpZZ01DNDBPVGM1TlRRZ01DNDJNak14TmpJZ01DNDBPRFl4TXlBd0xqWXlNekExT0VNd0xqUTROakl6TkNBd0xqWXlOekEySURBdU5EZzJNelkxSURBdU5qTXhNVEUwSURBdU5EZzJOVEl5SURBdU5qTTFNakl4UXpBdU5EazVNVGcwSURBdU5qTTFNekkxSURBdU5URXhPRFEySURBdU5qTTFNamN6SURBdU5USTBOVEE0SURBdU5qTTFNRFkxUXpBdU5USTBNamN5SURBdU5qSTVNamsxSURBdU5USXhOakEwSURBdU5qSXlPVGdnTUM0MU1qRTJNRFFnTUM0Mk1qSTVPRnBOTUM0MU5UVTJOalVnTUM0Mk1qRXlOalJETUM0MU5qY3lNamdnTUM0Mk1qQXlNalVnTUM0MU56ZzNOalVnTUM0Mk1Ua3dOVFVnTUM0MU9UQXlOelVnTUM0Mk1UYzNOVFpETUM0MU9UQXpPQ0F3TGpZeU1UY3dOaUF3TGpVNU1EVXhNU0F3TGpZeU5UWTRNeUF3TGpVNU1EWTJPQ0F3TGpZeU9UWTROVU13TGpVM09USXdPU0F3TGpZek1UQXpOeUF3TGpVMk56WTNNeUF3TGpZek1qSXpNaUF3TGpVMU5qQTFOeUF3TGpZek16STNNa013TGpVMU5Ua2dNQzQyTWpreU1UY2dNQzQxTlRVM05qa2dNQzQyTWpVeU1UVWdNQzQxTlRVMk5qVWdNQzQyTWpFeU5qUmFUVEF1TmpRek5EQTRJREF1TmpBNU1UQXhRekF1TmpNd05EZzBJREF1TmpFeE5Ea3lJREF1TmpFM05EVTJJREF1TmpFek56STNJREF1TmpBME16STBJREF1TmpFMU9EQTJRekF1TmpBMU56ZzVJREF1TmpFNU5UUTVJREF1TmpBM01qZ2dNQzQyTWpNeU9USWdNQzQyTURnM09UY2dNQzQyTWpjd016UkRNQzQyTVRreE5UY2dNQzQyTWpVeU5qY2dNQzQyTWprME9TQXdMall5TXpNNU5TQXdMall6T1RjNU9DQXdMall5TVRReVF6QXVOalF4TURBeElEQXVOakUzTWpZeUlEQXVOalF5TWpBMElEQXVOakV6TVRVMUlEQXVOalF6TkRBNElEQXVOakE1TVRBeFdrMHdMalkxTlRnd09DQXdMall3TmpZd05rTXdMalkyTmpVek5DQXdMall3TkRNeE9TQXdMalkzTnpJd055QXdMall3TWpBek1pQXdMalk0TnpneU9DQXdMalU1T1RjME5VTXdMalk0TnpnNE1TQXdMall3TXpRek5TQXdMalk0Tnprek15QXdMall3TnpFeU5pQXdMalk0TnprNE5TQXdMall4TURneE5rTXdMalkzTnpReE55QXdMall4TXpJd055QXdMalkyTmpjMk9TQXdMall4TlRVNU9TQXdMalkxTmpBME15QXdMall4TnprNVF6QXVOalUxT1RNNUlEQXVOakUwTVRrMUlEQXVOalUxT0RZZ01DNDJNVEEwTURFZ01DNDJOVFU0TURnZ01DNDJNRFkyTURaYVRUQXVNekF3T0RNMElEQXVOakU0TXpjNVF6QXVNekkzTmpjMUlEQXVOakkwTWpVeklEQXVNelUwTmpJZ01DNDJNams1TVRrZ01DNHpPREUyTnlBd0xqWXpOVE0zTjBNd0xqTTRNVGN5TXlBd0xqWXpPVFE0TXlBd0xqTTRNVGd3TVNBd0xqWTBNelU1SURBdU16Z3hPVEEySURBdU5qUTNOamsyUXpBdU16VTBPREF6SURBdU5qUXhPREl5SURBdU16STNPRE15SURBdU5qTTFOelF4SURBdU16QXdPVGt4SURBdU5qSTVORFV4UXpBdU16QXdPVE01SURBdU5qSTFPREV6SURBdU16QXdPRGcySURBdU5qSXlNVEl5SURBdU16QXdPRE0wSURBdU5qRTRNemM1V2swd0xqVXlNemN5TXlBd0xqWTBOakV6TjBNd0xqUTNPVGt6SURBdU5qUTFOREE1SURBdU5ETTJNakUxSURBdU5qUXlORGN5SURBdU16a3lOVGM1SURBdU5qTTNNekkyUXpBdU16a3lOamcwSURBdU5qUXhORGcwSURBdU16a3lOell5SURBdU5qUTFOakUzSURBdU16a3lPREUxSURBdU5qUTVOekl6UXpBdU5ETTFNRGtnTUM0Mk5UUTVOek1nTUM0ME56YzBOekVnTUM0Mk5UZ3dOQ0F3TGpVeE9UazFOaUF3TGpZMU9Ea3lORU13TGpVeU1qTXhJREF1TmpVMk1qY3pJREF1TlRJek56SXpJREF1TmpRMk1UTTNJREF1TlRJek56SXpJREF1TmpRMk1UTTNXazB3TGpVek16VXpNeUF3TGpZME5UYzBOME13TGpVMU1qZzVNaUF3TGpZME5EUTBOeUF3TGpVM01qQTVOQ0F3TGpZME1qY3pNaUF3TGpVNU1URXpPU0F3TGpZME1EWXdNVU13TGpVNU1UTTBPQ0F3TGpZME5EYzFPU0F3TGpVNU1UVTFOeUF3TGpZME9Ea3hPQ0F3TGpVNU1UYzJOeUF3TGpZMU16QTNOa013TGpVM01qY3lNaUF3TGpZMU5UTXhNU0F3TGpVMU16UTVOQ0F3TGpZMU56QTNPQ0F3TGpVek5EQTRNaUF3TGpZMU9ETTNPRU13TGpVek16ZzNNeUF3TGpZMU5ERTJOeUF3TGpVek16WTVJREF1TmpRNU9UVTNJREF1TlRNek5UTXpJREF1TmpRMU56UTNXazB3TGpZek5qRXdPU0F3TGpZek1qZ3dORU13TGpZeU9ETTJOU0F3TGpZek5ETTJNeUF3TGpZeU1EVTBNeUF3TGpZek5UZzNNU0F3TGpZeE1qWTBNeUF3TGpZek56TXlOa013TGpZeE5ESTJOU0F3TGpZME1URTNNeUF3TGpZeE5UZzJNU0F3TGpZME5UQXhPU0F3TGpZeE56UXpJREF1TmpRNE9EWTJRekF1TmpJeU5UVTRJREF1TmpRM09ESTJJREF1TmpJM05qVTVJREF1TmpRMk56ZzJJREF1TmpNeU56TTBJREF1TmpRMU56UTNRekF1TmpNek9ETXpJREF1TmpReE5ETXlJREF1TmpNME9UVTRJREF1TmpNM01URTRJREF1TmpNMk1UQTVJREF1TmpNeU9EQTBXazB3TGpZMU5qTTFOeUF3TGpZeU9ETTJRekF1TmpjME1UUTJJREF1TmpJME1EUTFJREF1TmpreE9EQTFJREF1TmpFNU56Z3pJREF1TnpBNU16TXpJREF1TmpFMU5UY3pRekF1TnpBNU16ZzFJREF1TmpFNU1UVTVJREF1TnpBNU5EWXpJREF1TmpJeU5qazBJREF1TnpBNU5UWTRJREF1TmpJMk1UYzJRekF1TmpreU1UUTFJREF1TmpNd09EQXpJREF1TmpjME5Ua3hJREF1TmpNMU5ESTVJREF1TmpVMk9UQTNJREF1TmpRd01EVTFRekF1TmpVMk56VWdNQzQyTXpZeE5UY2dNQzQyTlRZMU5qY2dNQzQyTXpJeU5UZ2dNQzQyTlRZek5UY2dNQzQyTWpnek5scE5NQzR6TURFd05qa2dNQzQyTkRBeE16TkRNQzR6TWpjNU5qSWdNQzQyTkRZNU9UUWdNQzR6TlRRNU9EWWdNQzQyTlRNMU55QXdMak00TWpFME1TQXdMalkxT1RnMU9VTXdMak00TWpFNU5DQXdMalkyTkRFM05DQXdMak00TWpJM01pQXdMalkyT0RRNE9DQXdMak00TWpNM055QXdMalkzTWpnd01rTXdMak0xTlRFM0lEQXVOalkxT1RReElEQXVNekk0TURreklEQXVOalU0TnpZNElEQXVNekF4TVRRNElEQXVOalV4TWpnelF6QXVNekF4TVRRNElEQXVOalEzTlRRZ01DNHpNREV4TWpJZ01DNDJORE00TWpRZ01DNHpNREV3TmprZ01DNDJOREF4TXpOYVRUQXVOVEV3TmprMUlEQXVOamN4TmpNelF6QXVORGN4TXpRNUlEQXVOamN3TkRNM0lEQXVORE15TVRZZ01DNDJOamN5TkNBd0xqTTVNekV5T1NBd0xqWTJNakEwTWtNd0xqTTVNekU0TVNBd0xqWTJOalF3T1NBd0xqTTVNekkxT1NBd0xqWTNNRGMzTlNBd0xqTTVNek0yTkNBd0xqWTNOVEUwTVVNd0xqUXlNekkwSURBdU5qYzVOekUySURBdU5EVXpNaklnTUM0Mk9ESTVNemdnTUM0ME9ETXpNRFFnTUM0Mk9EUTRNVU13TGpRNU9UUTNNaUF3TGpZNE5EazJOaUF3TGpVeE1EWTVOU0F3TGpZM01UWXpNeUF3TGpVeE1EWTVOU0F3TGpZM01UWXpNMXBOTUM0MU16UTJNeklnTUM0Mk56QTVNekZETUM0MU5UUXhORGdnTUM0Mk5qazFNamdnTUM0MU56TTBOVFFnTUM0Mk5qYzNNRGdnTUM0MU9USTFOVEVnTUM0Mk5qVTBOek5ETUM0MU9USTROalVnTUM0Mk5qazRNemtnTUM0MU9UTXhOemtnTUM0Mk56UXlNRFlnTUM0MU9UTTBPVE1nTUM0Mk56ZzFOekpETUM0MU56UXpORFFnTUM0Mk9EQTVNVEVnTUM0MU5UUTVOVGtnTUM0Mk9ESTNPRElnTUM0MU16VXpNemdnTUM0Mk9EUXhPRFpETUM0MU16VXhNamtnTUM0Mk56azNOamdnTUM0MU16UTRPVE1nTUM0Mk56VXpORGtnTUM0MU16UTJNeklnTUM0Mk56QTVNekZhVFRBdU5qSTNNVFl5SURBdU5qY3lNVGM0UXpBdU5qSTRNVFUySURBdU5qWTNOU0F3TGpZeU9URTNOaUF3TGpZMk1qa3lOaUF3TGpZek1ESXlNeUF3TGpZMU9EUTFOa013TGpZeU56TTBOU0F3TGpZMU9UQTRJREF1TmpJME5EWTNJREF1TmpVNU56QXpJREF1TmpJeE5Ua2dNQzQyTmpBek1qZERNQzQyTWpNeU1USWdNQzQyTmpReU56Z2dNQzQyTWpRNE9EWWdNQzQyTmpneU5UUWdNQzQyTWpZMk1UTWdNQzQyTnpJeU5UWkRNQzQyTWpZM055QXdMalkzTWpJd05DQXdMall5TmprMU15QXdMalkzTWpFM09DQXdMall5TnpFMk1pQXdMalkzTWpFM09GcE5NQzQyTlRjMU16UWdNQzQyTlRFMU9UUkRNQzQyTnpVeE1UUWdNQzQyTkRZMU5USWdNQzQyT1RJMU5qUWdNQzQyTkRFME9EUWdNQzQzTURrNE9ESWdNQzQyTXpZek9VTXdMamN3T1RrNE55QXdMall6T1RrM055QXdMamN4TURFeE55QXdMalkwTXpVek9DQXdMamN4TURJM05DQXdMalkwTnpBM01rTXdMalk1TXpBMk1TQXdMalkxTWpZNE5pQXdMalkzTlRjME1pQXdMalkxT0RJME9DQXdMalkxT0RNeE9TQXdMalkyTXpjMU9FTXdMalkxT0RBMU9DQXdMalkxT1Rjd015QXdMalkxTnpjNU5pQXdMalkxTlRZME9TQXdMalkxTnpVek5DQXdMalkxTVRVNU5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME9UazRPRFFnTUM0ME1qWXdOVEZETUM0Mk5qVXhNVGNnTUM0ME1qWXdOVEVnTUM0M09Ua3dPRFFnTUM0ek5UazRPVE1nTUM0M09Ua3dPRFFnTUM0eU56Z3lNVEZETUM0M09Ua3dPRFFnTUM0eE9UWTFNamtnTUM0Mk5qVXhNVGNnTUM0eE16QXpOekVnTUM0ME9UazRPRFFnTUM0eE16QXpOekZETUM0ek16UTJOU0F3TGpFek1ETTNNU0F3TGpJd01EWTROQ0F3TGpFNU5qVXlPU0F3TGpJd01EWTROQ0F3TGpJM09ESXhNVU13TGpJd01EWTROQ0F3TGpNMU9UZzVNeUF3TGpNek5EWTFJREF1TkRJMk1EVXhJREF1TkRrNU9EZzBJREF1TkRJMk1EVXhXaUlnWm1sc2JEMGlZbXhoWTJzaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNOamsxTXlBd0xqZ3pNVFUwTkVNd0xqTTNOamsxTXlBd0xqYzVOekV6TmlBd0xqTTNOamsxTXlBd0xqYzJNamd4TmlBd0xqTTNOamsxTXlBd0xqY3lPRGMyUXpBdU16ZzNOREkxSURBdU56TXdOVElnTUM0ek9UYzVPRFVnTUM0M016SXpOamdnTUM0ME1EZzJNek1nTUM0M016UXhNamhETUM0ME5ERXpOamtnTUM0M016ZzNPVElnTUM0ME5UYzJORGtnTUM0M05UVTNOellnTUM0ME5UYzJORGtnTUM0M09EZzFNVEpETUM0ME5UYzJORGtnTUM0NE1EUTNPVElnTUM0ME5UTXdOek1nTUM0NE1UYzVNRFFnTUM0ME5ETTRNek1nTUM0NE1qYzBNRGhETUM0ME16UTJPREVnTUM0NE16WTNNellnTUM0ME1qSTRPRGtnTUM0NE5EQXhOamdnTUM0ME1EZzBOVGNnTUM0NE16YzFNamhETUM0ek9UYzRPVGNnTUM0NE16VTFNRFFnTUM0ek9EY3pNemNnTUM0NE16TTJOVFlnTUM0ek56WTVOVE1nTUM0NE16RTJNekpXTUM0NE16RTFORFJhVFRBdU16azJORGc1SURBdU56UTVNelV5UXpBdU16azJORGc1SURBdU56Y3hNelV5SURBdU16azJORGc1SURBdU56a3pOemt5SURBdU16azJORGc1SURBdU9ERTJOVGcwUXpBdU5EQXdNREE1SURBdU9ERTNNaUF3TGpRd016WXhOeUF3TGpneE56Y3lPQ0F3TGpRd056SXlOU0F3TGpneE9ETTBORU13TGpReE5qVTFNeUF3TGpneE9UZzBJREF1TkRJek56WTVJREF1T0RFM05EWTBJREF1TkRJNU1UTTNJREF1T0RFeE9ETXlRekF1TkRNME5ERTNJREF1T0RBMU9UTTJJREF1TkRNM01UUTFJREF1TnprM05UYzJJREF1TkRNM01UUTFJREF1TnpnMk56VXlRekF1TkRNM01UUTFJREF1TnpjMk5UUTBJREF1TkRNME16STVJREF1TnpZNE1qY3lJREF1TkRJNE56ZzFJREF1TnpZeU1URXlRekF1TkRJek1qUXhJREF1TnpVMU9EWTBJREF1TkRFMk1URXpJREF1TnpVeU1qVTJJREF1TkRBM01qSTFJREF1TnpVd09UTTJRekF1TkRBek5qRTNJREF1TnpVd05EQTRJREF1TkRBd01EQTVJREF1TnpRNU9EZ2dNQzR6T1RZME9Ea2dNQzQzTkRrek5USmFUVEF1TkRjek1UTTNJREF1T0RRMk5qaERNQzQwTnpNeE16Y2dNQzQ0TURnNU1qZ2dNQzQwTnpNeE16Y2dNQzQzTnpNNU1EUWdNQzQwTnpNeE16Y2dNQzQzTkRFMk9UWkRNQzQwT0RRd05Ea2dNQzQzTkRJeE16WWdNQzQwT1RRNU5qRWdNQzQzTkRJMElEQXVOVEExT0RjeklEQXVOelF5TXpFeVF6QXVOVEUxT0RFM0lEQXVOelF4T1RZZ01DNDFNak0xTmpFZ01DNDNORE16TmpnZ01DNDFNamt3TVRjZ01DNDNORFk0T0RoRE1DNDFNelEwTnpNZ01DNDNOVEEwTURnZ01DNDFNemN5TURFZ01DNDNOVFUxTVRJZ01DNDFNemN5TURFZ01DNDNOakkzTWpoRE1DNDFNemN5TURFZ01DNDNOamd5TnpJZ01DNDFNelUwTkRFZ01DNDNOek14TVRJZ01DNDFNekl3T1RjZ01DNDNOemMwTWpSRE1DNDFNamczTlRNZ01DNDNPREU1TVRJZ01DNDFNalExTWprZ01DNDNPRFE1T1RJZ01DNDFNVGt6TXpjZ01DNDNPRFk1TWpoRE1DNDFNVGt6TXpjZ01DNDNPRFk1TWpnZ01DNDFNVGt6TXpjZ01DNDNPRGN3TVRZZ01DNDFNVGt6TXpjZ01DNDNPRGN4T1RKRE1DNDFNalUzTmpFZ01DNDNPRGM0T1RZZ01DNDFNekE1TlRNZ01DNDNPVEF5TnpJZ01DNDFNelE1TVRNZ01DNDNPVFExT0RSRE1DNDFNemcyT1RjZ01DNDNPVGc0T1RZZ01DNDFOREE0TURrZ01DNDRNRFEyTVRZZ01DNDFOREE0TURrZ01DNDRNVEUzTkRSRE1DNDFOREE0TURrZ01DNDRNakU1TlRJZ01DNDFNemM0TVRjZ01DNDRNekEwSURBdU5UTXhPRE16SURBdU9ETTNNRGc0UXpBdU5USTFPVE0zSURBdU9EUXpPVFV5SURBdU5URTNOelV6SURBdU9EUTNOek0ySURBdU5UQTNOVFExSURBdU9EUTRRekF1TkRrMk1ERTNJREF1T0RRM09URXlJREF1TkRnME5UYzNJREF1T0RRM05UWWdNQzQwTnpNeE16Y2dNQzQ0TkRZNE5UWkRNQzQwTnpNeE16Y2dNQzQ0TkRZM05qZ2dNQzQwTnpNeE16Y2dNQzQ0TkRZMk9DQXdMalEzTXpFek55QXdMamcwTmpZNFdrMHdMalE1TWpjMk1TQXdMamMxTnpBNU5rTXdMalE1TWpjMk1TQXdMamMyTlRBeE5pQXdMalE1TWpjMk1TQXdMamMzTXpJNE9DQXdMalE1TWpjMk1TQXdMamM0TVRVMlF6QXVORGsxT0RReElEQXVOemd4TlRZZ01DNDBPVGc1TWpFZ01DNDNPREUyTkRnZ01DNDFNREl3T0RrZ01DNDNPREUyTkRoRE1DNDFNRFkxTnpjZ01DNDNPREUxTmlBd0xqVXhNREE1TnlBd0xqYzRNRE15T0NBd0xqVXhNalkwT1NBd0xqYzNOemcyTkVNd0xqVXhOVEk0T1NBd0xqYzNOVFFnTUM0MU1UWTJNRGtnTUM0M056SXdOVFlnTUM0MU1UWTJNRGtnTUM0M05qYzVNa013TGpVeE5qWXdPU0F3TGpjMk1EUTBJREF1TlRFeE5ERTNJREF1TnpVMk9ETXlJREF1TlRBeE1USXhJREF1TnpVM01EQTRRekF1TkRrNE16QTFJREF1TnpVM01EazJJREF1TkRrMU5EZzVJREF1TnpVM01EazJJREF1TkRreU56WXhJREF1TnpVM01EazJXazB3TGpRNU1qYzJNU0F3TGpjNU9ESTRRekF1TkRreU56WXhJREF1T0RBNE1qSTBJREF1TkRreU56WXhJREF1T0RFNE5ETXlJREF1TkRreU56WXhJREF1T0RJNE9ERTJRekF1TkRrMk5qTXpJREF1T0RJNE9ERTJJREF1TlRBd05UQTFJREF1T0RJNE9UQTBJREF1TlRBME5EWTFJREF1T0RJNE9UQTBRekF1TlRBNU16a3pJREF1T0RJNE9ERTJJREF1TlRFek1qWTFJREF1T0RJM05EQTRJREF1TlRFMU9Ua3pJREF1T0RJME5ERTJRekF1TlRFNE9EQTVJREF1T0RJeE16TTJJREF1TlRJd01qRTNJREF1T0RFM05UVXlJREF1TlRJd01qRTNJREF1T0RFeU5UTTJRekF1TlRJd01qRTNJREF1T0RBM056ZzBJREF1TlRFNE9EQTVJREF1T0RBME16VXlJREF1TlRFMU9Ua3pJREF1T0RBeE9EZzRRekF1TlRFek1UYzNJREF1TnprNU5URXlJREF1TlRBNU16QTFJREF1TnprNE1qZ2dNQzQxTURReE1UTWdNQzQzT1Rnek5qaERNQzQxTURBek1qa2dNQzQzT1Rnek5qZ2dNQzQwT1RZMU5EVWdNQzQzT1RneU9DQXdMalE1TWpjMk1TQXdMamM1T0RJNFdrMHdMalUzTkRFMk1TQXdMamd5TVRjM05rTXdMalU0TnpFNE5TQXdMamd4T1RnMElEQXVOakF3TWprM0lEQXVPREUzT0RFMklEQXVOakV6TXpJeElEQXVPREUxTmpFMlF6QXVOakV6TXpJeElEQXVPREl4T1RVeUlEQXVOakV6TXpJeElEQXVPREk0TWlBd0xqWXhNek15TVNBd0xqZ3pORFV6TmtNd0xqVTVNamt3TlNBd0xqZ3pPREExTmlBd0xqVTNNalF3TVNBd0xqZzBNVFFnTUM0MU5URTRPVGNnTUM0NE5EUTBPRU13TGpVMU1UZzVOeUF3TGpnME1UVTNOaUF3TGpVMU1UZzVOeUF3TGpnek9EWTNNaUF3TGpVMU1UZzVOeUF3TGpnek5UZzFOa013TGpVMU1UZzVOeUF3TGpneU9UZzNNaUF3TGpVMU1qZzJOU0F3TGpneU5ESTBJREF1TlRVME56RXpJREF1T0RFNU5FTXdMalUxTmpRM015QXdMamd4TkRJNU5pQXdMalUxT0RnME9TQXdMamd3T1RZek1pQXdMalUyTVRreU9TQXdMamd3TlRJek1rTXdMalUyTlRBNU55QXdMamd3TURjME5DQXdMalUyT1RnME9TQXdMamM1TlRZMElEQXVOVGMyTXpZeElEQXVOemc1TkRoRE1DNDFPREl6TkRVZ01DNDNPRE0xT0RRZ01DNDFPRFl6T1RNZ01DNDNOemcxTmpnZ01DNDFPRGc0TlRjZ01DNDNOelF5TlRaRE1DNDFPVEV5TXpNZ01DNDNOekF4TWlBd0xqVTVNalEyTlNBd0xqYzJOVGs0TkNBd0xqVTVNalEyTlNBd0xqYzJNVFU0TkVNd0xqVTVNalEyTlNBd0xqYzFNalF6TWlBd0xqVTROemc0T1NBd0xqYzBPRFkwT0NBd0xqVTNPRGd5TlNBd0xqYzBPVGsyT0VNd0xqVTNNRGt3TlNBd0xqYzFNVEV4TWlBd0xqVTJNek16TnlBd0xqYzFOVFF5TkNBd0xqVTFOakV5TVNBd0xqYzJNekE0UXpBdU5UVTJNVEl4SURBdU56VTJPRE15SURBdU5UVTJNVEl4SURBdU56VXdPRFE0SURBdU5UVTJNVEl4SURBdU56UTBPRFkwUXpBdU5UWTBNakUzSURBdU56TTRNelV5SURBdU5UY3pNVGt6SURBdU56TTBNemt5SURBdU5UZ3pNakkxSURBdU56TXlPREE0UXpBdU5Ua3lOVFV6SURBdU56TXhNekV5SURBdU5UazVPRFUzSURBdU56TXlOVFEwSURBdU5qQTFNVE0zSURBdU56TTJOamhETUM0Mk1UQTFNRFVnTUM0M05EQTVPVElnTUM0Mk1UTXlNek1nTUM0M05EYzJPQ0F3TGpZeE16SXpNeUF3TGpjMU5qZ3pNa013TGpZeE16SXpNeUF3TGpjMk1qRXhNaUF3TGpZeE1qUTBNU0F3TGpjMk5qazFNaUF3TGpZeE1EZzFOeUF3TGpjM01URTNOa013TGpZd09UTTJNU0F3TGpjM05UWTJOQ0F3TGpZd056QTNNeUF3TGpjNE1EQTJOQ0F3TGpZd05ERTJPU0F3TGpjNE5ESTRPRU13TGpZd01USTJOU0F3TGpjNE9EUXlOQ0F3TGpVNU5qWXdNU0F3TGpjNU16WXhOaUF3TGpVNU1EQXdNU0F3TGpjNU9UZzJORU13TGpVNE16ZzBNU0F3TGpnd05Ua3pOaUF3TGpVM09UWXhOeUF3TGpneE1EVXhNaUF3TGpVM056VXdOU0F3TGpneE16YzJPRU13TGpVM05UTTVNeUF3TGpneE5qa3pOaUF3TGpVM05ERTJNU0F3TGpneE9UUWdNQzQxTnpReE5qRWdNQzQ0TWpFM056WmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6SXpNVE5mTWpJek56UWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI1NiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MCIgeT0iNDUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="0d01b047-0dc2-40e5-8af6-7f6f5d5b74c1" source="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" target="ee01b296-281d-4c3b-9221-3520645a764c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; Darwin Gateway Sistemas" ref="0ecf1fb2-b3f9-4d08-b538-5b63009e4154" source="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" target="6ba9fa4e-3ff7-4b36-88d5-24fc50931802">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="13f8e1da-1d51-4490-809b-0362d2dbf967" source="2e15b9d8-0834-4052-85b9-faa3e90c123b" target="66d3a807-377b-4abc-a7e7-6a52763dfe1c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="1b61e8f1-0fc9-4589-833c-de58586bef66" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="20278f0d-cfd2-4b3c-a1f5-45d9584af841" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="6ba9fa4e-3ff7-4b36-88d5-24fc50931802">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Clientes -&gt; SPA Autorización de Operaciones" ref="26868ed3-a8a7-4c2a-9c8e-43e251aaec16" source="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" target="c56c54d1-cfc5-4a4a-9d59-970521002185">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="34de075b-d431-4433-9fc0-83a91ae40de9" source="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1" target="362e3b48-5761-4c75-b085-db8646b8b3f2">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BaaS -&gt; Darwin Gateway Sistemas" ref="4f49f334-06c2-41f0-9f57-864bbd4cfba9" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Web -&gt; BFF" ref="621a47cf-996d-4be9-a216-e43929ef1dd4" source="1aca92e8-55db-42eb-b24b-3a35fdebd151" target="366dc6c1-bc87-4ef9-920d-79fe2305ba66">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Clientes -&gt; SPA Operaciones Pendientes" ref="66415208-70c0-4298-ae27-ee8e7db44ce3" source="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" target="2028f9ba-9244-423f-be5e-e12c9dbe8a54">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="SPA Autorización de Operaciones -&gt; Darwin Gateway Web" ref="73a1b2cc-26d6-4f04-8802-0702164de557" source="c56c54d1-cfc5-4a4a-9d59-970521002185" target="1aca92e8-55db-42eb-b24b-3a35fdebd151">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="7c903422-843b-46ba-81c8-041897c18f3d" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="91e8385d-cf7d-4917-a707-b247579b5f00">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="a2ff564b-447e-47fa-95a2-6557c7849a5f" source="08d65c86-43f0-472d-9790-dbf0831b425b" target="32a29c1f-3e79-472d-8051-a6642869b784">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="acd0337c-5bf7-439e-aa24-da9814085391" source="6ba9fa4e-3ff7-4b36-88d5-24fc50931802" target="8631069e-e3ae-4432-9628-12b7f2212ee8">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="c852090a-1947-4538-8dce-321b263d2106" source="91e8385d-cf7d-4917-a707-b247579b5f00" target="7d59b3f7-d74d-4951-906c-49d1fa61ea05">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Darwin Gateway Web -&gt; BFF" ref="ce73e97a-8ac8-4403-9b8f-14a17d7f7014" source="9d4463a3-9a1f-418d-bea7-07798d2a8ccb" target="daf212bc-3f3a-4a06-9d44-06ac753fd4f3">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BFF -&gt; IBM Db2" ref="d6b5e4cf-cb65-4a4e-8a54-741c6f9f8d24" source="daf212bc-3f3a-4a06-9d44-06ac753fd4f3" target="5a703a97-9d25-4332-91f7-948f8055e807">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="SPA Operaciones Pendientes -&gt; Darwin Gateway Web" ref="daea8d16-fd15-4b29-9cd1-2dc5cb511f99" source="2028f9ba-9244-423f-be5e-e12c9dbe8a54" target="9d4463a3-9a1f-418d-bea7-07798d2a8ccb">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BaaS -&gt; IBM Db2" ref="e82503d7-e1e0-46e0-93df-bff2204b578a" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="5a703a97-9d25-4332-91f7-948f8055e807">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="BaaS -&gt; Darwin Gateway Sistemas" ref="ea8ab787-8f2c-4515-8150-922a83e2444e" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="12734c7b-80d1-4db9-aba3-85f76c1de1e6" diagramComponentId="d0ab9fb6-682c-46f4-bac4-1dc1c8f86039" ref="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.650">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.589">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6cde4fb4-cb28-404f-8f7f-ba11e323ca6e" diagramComponentId="5d72e17b-603b-40e2-b72f-18728cd9a948" ref="7d59b3f7-d74d-4951-906c-49d1fa61ea05" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.051">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.323">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.050">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.325">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.324">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.647">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.325">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.646">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.245">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.960">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.964">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="512f9cb8-7b1b-411a-8b40-0f72b987ce2f" diagramComponentId="6ff01927-fa39-4939-9ebf-f70a51b874f5" ref="2e15b9d8-0834-4052-85b9-faa3e90c123b" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.287">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.286">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="21b3e0c9-8143-404e-89f6-5b1577948354" diagramComponentId="387de57a-6b07-4f64-9826-ec0bfd27deb8" ref="1aca92e8-55db-42eb-b24b-3a35fdebd151" name="Darwin Gateway Web" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.389">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.390">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.028">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.704">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.027">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.706">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.705">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.388">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.390">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.706">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.635">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.265">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.919">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.269">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.269">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f70648dd-29aa-4888-b57d-fff7a1866f6a" diagramComponentId="0a0b0ba3-c530-4c4d-b142-1ff346f945a0" ref="66d3a807-377b-4abc-a7e7-6a52763dfe1c" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.583">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.582">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.974">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.238">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.857">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.858">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.239">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="95763d7e-6496-45d9-a508-56d096aa92ee" diagramComponentId="eabb35e5-9f76-4cc7-8254-4feb6c90fc88" ref="6ba9fa4e-3ff7-4b36-88d5-24fc50931802" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.016">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.347">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.348">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.014">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.266">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.901">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3fde4eb5-f010-4197-a7ab-f2d205d3652e" diagramComponentId="45b9e34a-50ab-40c6-8666-84b927a88f94" ref="362e3b48-5761-4c75-b085-db8646b8b3f2" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.521">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.134">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.453">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.716">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7d54e716-f1d6-4470-aa6e-054f75dbb525" diagramComponentId="cff5e8f3-9422-464e-8cfc-e7217845ce8c" ref="9d4463a3-9a1f-418d-bea7-07798d2a8ccb" name="Darwin Gateway Web" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.356">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.132">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.358">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.813">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.296">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.045">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.697">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.297">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.046">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.048">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.298">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="960e6014-9ab6-40da-93d2-4c3b27dcc38c" diagramComponentId="529e715f-63e6-457b-be69-d46170df4d25" ref="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.167">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.166">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7250bfc0-f114-453d-a657-f9464e828d1b" diagramComponentId="86a33c83-e0db-418b-a848-3003d3eb78fa" ref="8631069e-e3ae-4432-9628-12b7f2212ee8" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.173">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.576">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.860">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.510">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.084">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="ec377dd7-06b4-449a-aee2-064c3f86acfe" diagramComponentId="a88b6d33-8ab0-45c2-87a9-86dde8b0efc7" ref="91e8385d-cf7d-4917-a707-b247579b5f00" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.464">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.462">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.389">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.390">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.390">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.391">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.391">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3cdc8d5b-074a-4021-8929-eb51f3b7d11a" diagramComponentId="1b041144-ab90-42c1-a3ae-110e1e23822c" ref="366dc6c1-bc87-4ef9-920d-79fe2305ba66" name="BFF" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.238">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.472">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.719">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.077">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.473">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.720">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.722">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.081">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.081">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.722">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.474">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="adce88c6-2156-4010-a1c1-57cb8b9b4317" diagramComponentId="f3cf4809-4b0c-4eb7-bc40-7b11176e8f0c" ref="daf212bc-3f3a-4a06-9d44-06ac753fd4f3" name="BFF" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.581">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.580">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.255">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.487">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.148">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.149">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.150">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.491">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="df6273b0-7f26-442f-827d-6c023db57b1e" diagramComponentId="82a7f01e-20e1-4313-be63-25b4954d9211" ref="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" name="Clientes" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.892">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.503">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.616">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.458">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f035051a-8f3b-41cb-b892-d6f51866ba5c" diagramComponentId="879c8266-0f37-4e34-ba38-9b7268d4964f" ref="5a703a97-9d25-4332-91f7-948f8055e807" name="IBM Db2" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-IBM-DB2">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.653">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.016">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.300">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.018">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.017">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.564">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.173">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="92e79fa6-9404-4e32-90f1-5dcede678b2a" diagramComponentId="03d5b54b-d1c8-4441-b5d0-b6e988b1e363" ref="ee01b296-281d-4c3b-9221-3520645a764c" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.893">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.598">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.892">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.599">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.255">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.532">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.798">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.124">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.533">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="57fcb2d6-e0b2-4d80-876b-77086ff46a46" diagramComponentId="56f969d5-9b40-4965-ae83-ac78319b5994" ref="32a29c1f-3e79-472d-8051-a6642869b784" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.974">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.973">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.021">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.022">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.481">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.525">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.871">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.872">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.482">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.873">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.528">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.528">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.873">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.530">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.532">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.486">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="00098462-e7f6-4c67-b304-64ade1dfa6ad" diagramComponentId="74373495-4b80-4e18-98bf-af6bab0053d0" ref="08d65c86-43f0-472d-9790-dbf0831b425b" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.045">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.044">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.969">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="eec41e6b-7904-4209-8839-697022c6beb0" diagramComponentId="a12f49a5-041a-4c4c-bc3f-ee66298992de" ref="2028f9ba-9244-423f-be5e-e12c9dbe8a54" name="SPA Operaciones Pendientes" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.534">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.122">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.843">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.248">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.255">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.792">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.255">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.950">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.254">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="2715fb43-0e9e-438c-b7d0-e5225fa116dd" diagramComponentId="d8bd4025-d343-4a28-9919-012fb56796e0" ref="c56c54d1-cfc5-4a4a-9d59-970521002185" name="SPA Autorización de Operaciones" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.140">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.571">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.143">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.142">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.142">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.143">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.771">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.773">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.470">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.350">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 438984784959b5976526b6603dffab14aed6140b Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:23:55 -0400
Subject: [PATCH 22/28] Delete Templates/sample-system-template.xml

---
 Templates/sample-system-template.xml | 17730 -------------------------
 1 file changed, 17730 deletions(-)
 delete mode 100644 Templates/sample-system-template.xml

diff --git a/Templates/sample-system-template.xml b/Templates/sample-system-template.xml
deleted file mode 100644
index c3cb1fb..0000000
--- a/Templates/sample-system-template.xml
+++ /dev/null
@@ -1,17730 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="sample-system-template" name="sample-system template" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTE0MCIgZHk9IjgxOCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjEuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0yNDYiIHk9Ii00IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjM1MSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHZhbHVlPSJXZWIgQ2xpZW50IiBzdHlsZT0iaXIucmVmPWEzYzY3MzFjLTM1M2MtNGI1My04MWQxLWIzNThiZWU2MWFkYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5LTkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNzAiIHk9IjIwOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kZTFkZDE1ZC01MjQyLTRkMGUtOTEzYy0wOWQyZDM4MWRmYjctMjUiIHZhbHVlPSJNb2JpbGUgRGV2aWNlIENsaWVudCIgc3R5bGU9ImlyLnJlZj1kZTFkZDE1ZC01MjQyLTRkMGUtOTEzYy0wOWQyZDM4MWRmYjc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bW9iaWxlLWRldmljZS1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpOVEEyTWpjZ01DNHhNamsyTXpsRE1DNHlPVGcwTWpNZ01DNHhNamsyTXprZ01DNHlOVFl4TURRZ01DNHhOekU1TlRnZ01DNHlOVFl4TURRZ01DNHlNalF4TmpGV01DNDNPVEV5T1RkRE1DNHlOVFl4TURRZ01DNDRORE0xTURFZ01DNHlPVGcwTWpNZ01DNDRPRFU0TWlBd0xqTTFNRFl5TnlBd0xqZzROVGd5U0RBdU5qTTBNVGsyUXpBdU5qZzJNems1SURBdU9EZzFPRElnTUM0M01qZzNNVGtnTUM0NE5ETTFNREVnTUM0M01qZzNNVGtnTUM0M09URXlPVGRXTUM0eU1qUXhOakZETUM0M01qZzNNVGtnTUM0eE56RTVOVGdnTUM0Mk9EWXpPVGtnTUM0eE1qazJNemtnTUM0Mk16UXhPVFlnTUM0eE1qazJNemxJTUM0ek5UQTJNamRhVFRBdU16STJPVGsySURBdU1qRXlNelEyUXpBdU16STJPVGsySURBdU1UazVNamsxSURBdU16TTNOVGMySURBdU1UZzROekUxSURBdU16VXdOakkzSURBdU1UZzROekUxU0RBdU5qTTBNVGsyUXpBdU5qUTNNalEzSURBdU1UZzROekUxSURBdU5qVTNPREkzSURBdU1UazVNamsxSURBdU5qVTNPREkzSURBdU1qRXlNelEyVmpBdU56TXlNakl4UXpBdU5qVTNPREkzSURBdU56UTFNamN4SURBdU5qUTNNalEzSURBdU56VTFPRFV4SURBdU5qTTBNVGsySURBdU56VTFPRFV4U0RBdU16VXdOakkzUXpBdU16TTNOVGMySURBdU56VTFPRFV4SURBdU16STJPVGsySURBdU56UTFNamN4SURBdU16STJPVGsySURBdU56TXlNakl4VmpBdU1qRXlNelEyV2swd0xqUTJORGcwTWlBd0xqZzFNRE0zTkVNd0xqUTBPVFl4TmlBd0xqZzFNRE0zTkNBd0xqUXpOekkzTXlBd0xqZ3pPREF6SURBdU5ETTNNamN6SURBdU9ESXlPREEwUXpBdU5ETTNNamN6SURBdU9EQTNOVGM0SURBdU5EUTVOakUySURBdU56azFNak0xSURBdU5EWTBPRFF5SURBdU56azFNak0xU0RBdU5URTVPVGhETUM0MU16VXlNRFlnTUM0M09UVXlNelVnTUM0MU5EYzFOU0F3TGpnd056VTNPQ0F3TGpVME56VTFJREF1T0RJeU9EQTBRekF1TlRRM05UVWdNQzQ0TXpnd015QXdMalV6TlRJd05pQXdMamcxTURNM05DQXdMalV4T1RrNElEQXVPRFV3TXpjMFNEQXVORFkwT0RReVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprNE5EWXhOU0lnYUdWcFoyaDBQU0l3TGprNE5EWXhOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURBd01qUTBNVFF4SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY2IiB5PSI0NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijc1IiB5PSItMzUiIHdpZHRoPSI3OTUiIGhlaWdodD0iNDI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xOCIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2LTciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtMTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE5IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQyNjA0ODZmLTUyYjMtNDk0Ni1iYWUxLWI5NjdiZWE5MzZjMy02IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWItMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj1jNDcyZmUxNC1hOTUzLTRiOGYtYmJkNy1lN2E3MTNiZjY5MTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhLTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzMtMjIiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhIHN0b3JlIiBzdHlsZT0iaXIucmVmPTY2NzAxY2RiLTI5NTQtNGY5ZC05YjFiLTY3YWJhYmY4MmJhZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWMtMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS02ZDQ4NmYyMi05ZDU1LTQ0NzktODIzZS00Nzg1ZDMzN2RiY2ItMjQiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBNaWNyb3NvZnQgQXp1cmUgU2VydmljZSBCdXMgTWVzc2FnaW5nIiBzdHlsZT0iaXIucmVmPTA3MjIxNzRlLTFmNzYtNDMxZC1hYzcxLWEyOTgzZGZkM2Q2NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTEtMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQzMTg5MTg3LWQyZWUtNGI1Yy04M2EyLWZiMDI4N2Y4YjczYS00IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTExZTQ4OGItNjY0My00ZmE2LTlhNWUtNzk5OGNmMmM2YjFjLTExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yMCIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtMTIiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMiIgdmFsdWU9IiIgc3R5bGU9Im91dGxpbmVDb25uZWN0PTA7ZGFzaGVkPTA7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1jZW50ZXI7aHRtbD0xO3NoYXBlPW14Z3JhcGguYXdzMy5hcHBsaWNhdGlvbl9sb2FkX2JhbGFuY2VyO2ZpbGxDb2xvcj0jRjU4NTM0O2dyYWRpZW50Q29sb3I9bm9uZTtmb250Q29sb3I9IzhDOEM4QztzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTM7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NjkiIHk9IjI1IiB3aWR0aD0iNjkiIGhlaWdodD0iNzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE2IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE3IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTEzIiB2YWx1ZT0iIiBzdHlsZT0ib3V0bGluZUNvbm5lY3Q9MDtkYXNoZWQ9MDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtodG1sPTE7c2hhcGU9bXhncmFwaC5hd3MzLmNsYXNzaWNfbG9hZF9iYWxhbmNlcjtmaWxsQ29sb3I9I0Y1ODUzNDtncmFkaWVudENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0zOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTMwIiB5PSIxMTAiIHdpZHRoPSI2OSIgaGVpZ2h0PSI3MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExLTIzIiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFNlcnZpY2UgQnVzIE1lc3NhZ2luZyIgc3R5bGU9ImlyLnJlZj1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVNFUi1CVVMtTVNHO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM01EbGZNalV5TlRNcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTVNems1TmlBd0xqSXdOemMyTkVnd0xqSTBNemM0TTFZd0xqTTBOVFUwTmtNd0xqSTBNemM0TXlBd0xqTTBPRFV4TkNBd0xqSTBNall3TXlBd0xqTTFNVE0yTVNBd0xqSTBNRFV3TkNBd0xqTTFNelEyUXpBdU1qTTROREExSURBdU16VTFOVFU1SURBdU1qTTFOVFU1SURBdU16VTJOek00SURBdU1qTXlOVGtnTUM0ek5UWTNNemhJTUM0eE9ETXhPRGxETUM0eE9EQXlNakVnTUM0ek5UWTNNemdnTUM0eE56Y3pOelFnTUM0ek5UVTFOVGtnTUM0eE56VXlOelVnTUM0ek5UTTBOa013TGpFM016RTNOaUF3TGpNMU1UTTJNU0F3TGpFM01UazVOeUF3TGpNME9EVXhOQ0F3TGpFM01UazVOeUF3TGpNME5UVTBObFl3TGpJeU9UYzJNa013TGpFM01UazVOeUF3TGpJeU16a3lPQ0F3TGpFM05ETXhOU0F3TGpJeE9ETXpNeUF3TGpFM09EUTBJREF1TWpFME1qQTNRekF1TVRneU5UWTJJREF1TWpFd01EZ3hJREF1TVRnNE1UWXhJREF1TWpBM056WTBJREF1TVRrek9UazJJREF1TWpBM056WTBWakF1TWpBM056WTBXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0MUlpQmtQU0pOTUM0eE9UTTVPVFlnTUM0eU1EYzNOalJJTUM0eU5ETTNPRE5XTUM0ek5EVTFORFpETUM0eU5ETTNPRE1nTUM0ek5EZzFNVFFnTUM0eU5ESTJNRE1nTUM0ek5URXpOakVnTUM0eU5EQTFNRFFnTUM0ek5UTTBOa013TGpJek9EUXdOU0F3TGpNMU5UVTFPU0F3TGpJek5UVTFPU0F3TGpNMU5qY3pPQ0F3TGpJek1qVTVJREF1TXpVMk56TTRTREF1TVRnek1UZzVRekF1TVRnd01qSXhJREF1TXpVMk56TTRJREF1TVRjM016YzBJREF1TXpVMU5UVTVJREF1TVRjMU1qYzFJREF1TXpVek5EWkRNQzR4TnpNeE56WWdNQzR6TlRFek5qRWdNQzR4TnpFNU9UY2dNQzR6TkRnMU1UUWdNQzR4TnpFNU9UY2dNQzR6TkRVMU5EWldNQzR5TWprM05qSkRNQzR4TnpFNU9UY2dNQzR5TWpNNU1qZ2dNQzR4TnpRek1UVWdNQzR5TVRnek16TWdNQzR4TnpnME5DQXdMakl4TkRJd04wTXdMakU0TWpVMk5pQXdMakl4TURBNE1TQXdMakU0T0RFMk1TQXdMakl3TnpjMk5DQXdMakU1TXprNU5pQXdMakl3TnpjMk5GWXdMakl3TnpjMk5Gb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVWlJR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpneE1qVWdNQzR5TWprM05qSldNQzR5Tnpnd01EVk1NQzR4TnpJd01qUWdNQzR5Tnpnd01EVldNQzR5TWprM05qSkRNQzR4TnpJd01qUWdNQzR5TWpNNU1qZ2dNQzR4TnpRek5ESWdNQzR5TVRnek16SWdNQzR4TnpnME5qY2dNQzR5TVRReU1EZERNQzR4T0RJMU9UTWdNQzR5TVRBd09ERWdNQzR4T0RneE9EZ2dNQzR5TURjM05qUWdNQzR4T1RRd01qTWdNQzR5TURjM05qUk1NQzQ0TURZMU1USWdNQzR5TURjM05qUkRNQzQ0TVRJeU9DQXdMakl3TnpnMk5TQXdMamd4TnpjM05pQXdMakl4TURJeU55QXdMamd5TVRneE9TQXdMakl4TkRNME1rTXdMamd5TlRnMk1TQXdMakl4T0RRMU5pQXdMamd5T0RFeU5pQXdMakl5TXprNU5DQXdMamd5T0RFeU5TQXdMakl5T1RjMk1sWXdMakl5T1RjMk1sb2lJR1pwYkd3OUlpTTVORGswT1RRaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTRNekkxSURBdU5qUXhPRFEyU0RBdU1qTXpNRE0yUXpBdU1qTTJNREExSURBdU5qUXhPRFEySURBdU1qTTRPRFV4SURBdU5qUXpNREkxSURBdU1qUXdPVFVnTUM0Mk5EVXhNalJETUM0eU5ETXdORGtnTUM0Mk5EY3lNak1nTUM0eU5EUXlNamtnTUM0Mk5UQXdOeUF3TGpJME5ESXlPU0F3TGpZMU16QXpPRll3TGpjNU1UazNOMGd3TGpFNU5EQTFOa013TGpFNU1URTJOeUF3TGpjNU1UazNOeUF3TGpFNE9ETXdOaUF3TGpjNU1UUXdPQ0F3TGpFNE5UWXpOeUF3TGpjNU1ETXdNa013TGpFNE1qazJPQ0F3TGpjNE9URTVOeUF3TGpFNE1EVTBNeUF3TGpjNE56VTNOaUF3TGpFM09EVWdNQzQzT0RVMU16UkRNQzR4TnpRek56VWdNQzQzT0RFME1EZ2dNQzR4TnpJd05UY2dNQzQzTnpVNE1UTWdNQzR4TnpJd05UY2dNQzQzTmprNU56aFdNQzQyTlRReE9UWkRNQzR4TnpFNE9UUWdNQzQyTlRJMk16SWdNQzR4TnpJd05qTWdNQzQyTlRFd05URWdNQzR4TnpJMU5USWdNQzQyTkRrMU5UZERNQzR4TnpNd05ERWdNQzQyTkRnd05qSWdNQzR4TnpNNE5DQXdMalkwTmpZNE55QXdMakUzTkRnNU5pQXdMalkwTlRVeU1rTXdMakUzTlRrMU1pQXdMalkwTkRNMU55QXdMakUzTnpJME1pQXdMalkwTXpReU55QXdMakUzT0RZNE1TQXdMalkwTWpjNU5FTXdMakU0TURFeUlEQXVOalF5TVRZZ01DNHhPREUyTnpjZ01DNDJOREU0TXpjZ01DNHhPRE15TlNBd0xqWTBNVGcwTmxZd0xqWTBNVGcwTmxvaUlHWnBiR3c5SWlNNU9UazVPVGtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOU0lnWkQwaVRUQXVNVGd6TWpVZ01DNDJOREU0TkRaSU1DNHlNek13TXpaRE1DNHlNell3TURVZ01DNDJOREU0TkRZZ01DNHlNemc0TlRFZ01DNDJORE13TWpVZ01DNHlOREE1TlNBd0xqWTBOVEV5TkVNd0xqSTBNekEwT1NBd0xqWTBOekl5TXlBd0xqSTBOREl5T1NBd0xqWTFNREEzSURBdU1qUTBNakk1SURBdU5qVXpNRE00VmpBdU56a3hPVGMzU0RBdU1UazBNRFUyUXpBdU1Ua3hNVFkzSURBdU56a3hPVGMzSURBdU1UZzRNekEySURBdU56a3hOREE0SURBdU1UZzFOak0zSURBdU56a3dNekF5UXpBdU1UZ3lPVFk0SURBdU56ZzVNVGszSURBdU1UZ3dOVFF6SURBdU56ZzNOVGMySURBdU1UYzROU0F3TGpjNE5UVXpORU13TGpFM05ETTNOU0F3TGpjNE1UUXdPQ0F3TGpFM01qQTFOeUF3TGpjM05UZ3hNeUF3TGpFM01qQTFOeUF3TGpjMk9UazNPRll3TGpZMU5ERTVOa013TGpFM01UZzVOQ0F3TGpZMU1qWXpNaUF3TGpFM01qQTJNeUF3TGpZMU1UQTFNU0F3TGpFM01qVTFNaUF3TGpZME9UVTFOME13TGpFM016QTBNU0F3TGpZME9EQTJNaUF3TGpFM016ZzBJREF1TmpRMk5qZzNJREF1TVRjME9EazJJREF1TmpRMU5USXlRekF1TVRjMU9UVXlJREF1TmpRME16VTNJREF1TVRjM01qUXlJREF1TmpRek5ESTNJREF1TVRjNE5qZ3hJREF1TmpReU56azBRekF1TVRnd01USWdNQzQyTkRJeE5pQXdMakU0TVRZM055QXdMalkwTVRnek55QXdMakU0TXpJMUlEQXVOalF4T0RRMlZqQXVOalF4T0RRMldpSWdabWxzYkQwaUl6azVPVGs1T1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56WTNNakUxSURBdU5qUXhPRFEyU0RBdU9ERTNNREF5UXpBdU9ERTVPVGNnTUM0Mk5ERTRORFlnTUM0NE1qSTRNVGNnTUM0Mk5ETXdNalVnTUM0NE1qUTVNVFlnTUM0Mk5EVXhNalJETUM0NE1qY3dNVFVnTUM0Mk5EY3lNak1nTUM0NE1qZ3hPVFFnTUM0Mk5UQXdOeUF3TGpneU9ERTVOQ0F3TGpZMU16QXpPRll3TGpjMk9EZ3lRekF1T0RJNE1UazBJREF1TnpjME5qVTFJREF1T0RJMU9EYzNJREF1Tnpnd01qVWdNQzQ0TWpFM05URWdNQzQzT0RRek56VkRNQzQ0TVRjMk1qVWdNQzQzT0RnMU1ERWdNQzQ0TVRJd015QXdMamM1TURneE9TQXdMamd3TmpFNU5TQXdMamM1TURneE9VZ3dMamMxTmpRd09GWXdMalkxTkRFNU5rTXdMamMxTmpJME9DQXdMalkxTWpZMk5DQXdMamMxTmpRd05pQXdMalkxTVRFeE5TQXdMamMxTmpnM01pQXdMalkwT1RZME4wTXdMamMxTnpNek9DQXdMalkwT0RFM09TQXdMamMxT0RFd015QXdMalkwTmpneU1pQXdMamMxT1RFeE55QXdMalkwTlRZMk0wTXdMamMyTURFek1TQXdMalkwTkRVd05DQXdMamMyTVRNM05DQXdMalkwTXpVMk5pQXdMamMyTWpjMk9DQXdMalkwTWpreFF6QXVOelkwTVRZeElEQXVOalF5TWpVeklEQXVOelkxTmpjMUlEQXVOalF4T0RrZ01DNDNOamN5TVRVZ01DNDJOREU0TkRaV01DNDJOREU0TkRaYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMyTnpJeE5TQXdMalkwTVRnME5rZ3dMamd4TnpBd01rTXdMamd4T1RrM0lEQXVOalF4T0RRMklEQXVPREl5T0RFM0lEQXVOalF6TURJMUlEQXVPREkwT1RFMklEQXVOalExTVRJMFF6QXVPREkzTURFMUlEQXVOalEzTWpJeklEQXVPREk0TVRrMElEQXVOalV3TURjZ01DNDRNamd4T1RRZ01DNDJOVE13TXpoV01DNDNOamc0TWtNd0xqZ3lPREU1TkNBd0xqYzNORFkxTlNBd0xqZ3lOVGczTnlBd0xqYzRNREkxSURBdU9ESXhOelV4SURBdU56ZzBNemMxUXpBdU9ERTNOakkxSURBdU56ZzROVEF4SURBdU9ERXlNRE1nTUM0M09UQTRNVGtnTUM0NE1EWXhPVFVnTUM0M09UQTRNVGxJTUM0M05UWTBNRGhXTUM0Mk5UUXhPVFpETUM0M05UWXlORGdnTUM0Mk5USTJOalFnTUM0M05UWTBNRFlnTUM0Mk5URXhNVFVnTUM0M05UWTROeklnTUM0Mk5EazJORGRETUM0M05UY3pNemdnTUM0Mk5EZ3hOemtnTUM0M05UZ3hNRE1nTUM0Mk5EWTRNaklnTUM0M05Ua3hNVGNnTUM0Mk5EVTJOak5ETUM0M05qQXhNekVnTUM0Mk5EUTFNRFFnTUM0M05qRXpOelFnTUM0Mk5ETTFOallnTUM0M05qSTNOamdnTUM0Mk5ESTVNVU13TGpjMk5ERTJNU0F3TGpZME1qSTFNeUF3TGpjMk5UWTNOU0F3TGpZME1UZzVJREF1TnpZM01qRTFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVGN4T1RrM0lEQXVOelk1T1RrMFZqQXVOekl4TnpVeVNEQXVPREk0TURrNVZqQXVOelk1T1RrMFF6QXVPREk0TURrNUlEQXVOemMxT0RJNElEQXVPREkxTnpneElEQXVOemd4TkRJeklEQXVPREl4TmpVMklEQXVOemcxTlRRNVF6QXVPREUzTlRNZ01DNDNPRGsyTnpRZ01DNDRNVEU1TXpVZ01DNDNPVEU1T1RJZ01DNDRNRFl4SURBdU56a3hPVGt5U0RBdU1Ua3pPVGsyUXpBdU1UZzRNVFl4SURBdU56a3hPVGt5SURBdU1UZ3lOVFkySURBdU56ZzVOamMwSURBdU1UYzRORFFnTUM0M09EVTFORGxETUM0eE56UXpNVFVnTUM0M09ERTBNak1nTUM0eE56RTVPVGNnTUM0M056VTRNamdnTUM0eE56RTVPVGNnTUM0M05qazVPVFJXTUM0M05qazVPVFJhSWlCbWFXeHNQU0lqT1RRNU5EazBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RJME9DQXdMak0yTURNMU1sWXdMall6TWpjNU9Vd3dMalE1TnpZd015QXdMalE1TmpZNU4wd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6TXlRa1ZFUkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56QXlOamd4SURBdU16WXdOREUyVERBdU5EazNOVFU1SURBdU5EazJOelpNTUM0M01ESTVNalFnTUM0Mk16STJNVGhETUM0M01ESTBNemdnTUM0Mk1qY3lOekVnTUM0M01ESTJPREVnTUM0ek5UVTFOVFVnTUM0M01ESTJPREVnTUM0ek5qQTBNVFphSWlCbWFXeHNQU0lqTVRrNFFVSXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RZNE56VWdNQzQwT1RZNE1qWk1NQzR5T1RJME9DQXdMall6TWpZNE9FZ3dMamN3TWpRNE5WWXdMall6TWpRME5Vd3dMalE1TmpnM05TQXdMalE1TmpneU5sb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNsOHhOekE1WHpJMU1qVXpLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TWpreU5EZ2dNQzR6TmpBek5USklNQzQzTURJM01qWk1NQzQwT1RrM09TQXdMalV4T1RjNE5VTXdMalE1T0RVMk5pQXdMalV5TURjeE1pQXdMalE1TnpBM015QXdMalV5TVRJeE15QXdMalE1TlRVek55QXdMalV5TVRJeE0wTXdMalE1TkRBd01pQXdMalV5TVRJeE15QXdMalE1TWpVd09DQXdMalV5TURjeE1pQXdMalE1TVRJNE5DQXdMalV4T1RjNE5Vd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWEpmTVRjd09WOHlOVEkxTXlJZ2VERTlJakF1TkRrM05qQTBJaUI1TVQwaU1DNDBPVFk0TWpZaUlIZ3lQU0l3TGpRNU56WXdOQ0lnZVRJOUlqQXVOak15T1RNeElpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpNREExUWtFeElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TWpZaUlITjBiM0F0WTI5c2IzSTlJaU13TURVNE9VUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0MU15SWdjM1J2Y0MxamIyeHZjajBpSXpBd05FWTVNQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqZ2lJSE4wYjNBdFkyOXNiM0k5SWlNd01ETkdOME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpBd016QTJOeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1UY3dPVjh5TlRJMU15SStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0RBd01ERWlJR2hsYVdkb2REMGlNQzQ0T0RBd01ERWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEyTURBMU9EWWdNQzR3TmpBd05UZzJLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0NSIgeT0iMjgzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE1IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjEiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtMTMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yNiIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LWRlMWRkMTVkLTUyNDItNGQwZS05MTNjLTA5ZDJkMzgxZGZiNy0yNSIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions>
-    <wizardQuestion ref="template_16542065" answer="true" manuallyModified="false"/>
-  </questions>
-  <assets>
-    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
-      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
-    </asset>
-    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="0722174e-1f76-431d-ac71-a2983dfd3d67" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other data store" ref="66701cdb-2954-4f9d-9b1b-67ababf82baf" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Service -&gt; Other database" ref="c472fe14-a953-4b8f-bbd7-e7a713bf6911" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="6901d605-405e-40d3-a16c-fed2bf7325e9" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read
-                        the code or reverse engineer it if it is compiled in any form. If the client side code includes
-                        secret keys, sensitive business logic (like client authentication) or proprietary information,
-                        all of this is directly exposed to the user, allowing them to get the sensitive information or
-                        study the business logic with the aim of bypassing it.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Some examples of this vulnerability are:&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a
-                        cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt;
-                        &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client
-                        calls without a proxy.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:53.614">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
-                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
-                        required security controls are implemented correctly, operating as intended, enforcing the
-                        desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.794">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can
-                        be leaked to users with access to the code. This access can be incidentally granted by
-                        publishing the source code on a package-form or an online, public repository.
-
-                        The unauthorized access to any of those secrets could lead to a compromise of sensitive data or
-                        a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been
-                        actively reviewed or maintained.
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.014">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
-                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
-                        encryption between the client and server, terminating within a secure environment on the
-                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
-                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
-                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
-                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
-                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
-                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
-                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
-                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side
-                        technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or
-                        client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and
-                            Silverlight.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and
-                        subject to manipulation by a malicious actor, regardless of the controls in place (e.g.
-                        encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application
-                        logic decisions, such as access controls, and data considered sensitive or secret, such as
-                        encryption keys. While controls may be duplicated on the client-side to improve the user
-                        experience, it is important to have these enforced on the server-side.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt;
-                        &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required
-                        should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be
-                        considered tainted, and security decisions should not be made solely on this data. For example,
-                        an insecure implementation could include a compiled application (e.g. Flash!) performing
-                        authentication on the client-side against a stored password. The decompilation of the binary (in
-                        this case flv file) or the interception and modification of controls between the client and
-                        server could expose the password or allow unauthorized access to the authenticated application
-                        content.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly
-                            where client-side controls are implemented.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no
-                            inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span
-                            class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side
-                        software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or
-                        sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side
-                        must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online
-                        repositories, services, and other associated restricted content must have appropriate access
-                        controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server
-                        side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending
-                        on the use case, this encryption may be asymmetric or public key, or symmetric using a shared
-                        secret. Note however that reversible encryption on the client-side and in-memory storage are
-                        still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular
-                            expression patterns within the code, configuration and other files exposed on the client and
-                            server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be
-                            triggered before the code is published (in particular for public/open source code) as once
-                            published it is likely to be archived (and any disclosed secrets would be exposed and/or
-                            have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary
-                            or persistent storage of sensitive or secret data on the client-side, and the protections in
-                            place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Use periodically a static code analysis tool to analyze the code and detect potentially
-                        malicious code, such as time functions, unsafe file operations and networks connections. With
-                        the scanning of static code, we ensure the integrity of the application.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Verify that a code analysis tool is in use and it is configured to detect potentially
-                            malicious code, such as time functions, unsafe file operations and network connections.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
-                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
-                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
-                        connection, using approved cryptographic algorithms.&lt;/p&gt;
-                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
-                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
-                        authentication system, most typically identified as a separate entity in a Federated
-                        authentication system. A CSP may be an independent third party, or may issue credentials for its
-                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
-                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
-                        but whose users may be subsequently authenticated to other sites, applications or services
-                        without further action on their part.&lt;/p&gt;
-                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
-                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
-                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
-                        the claimant's possession and control of one or two authenticators, using an authentication
-                        protocol.&lt;/p&gt;
-                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
-                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
-                        to process a transaction or grant access to information or a system.&lt;/p&gt;
-                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
-                        identity proofing.&lt;/p&gt;
-                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
-                        authentication protocols.&lt;/p&gt;
-                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
-                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
-                            with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:53.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically
-                        secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid
-                        certificates expose the application and its users to spoofing attacks such as Man In The Middle
-                        (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence
-                        in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a
-                        trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is
-                        legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use
-                        throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a
-                            positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use
-                            TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL
-                            Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan
-                            tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool:
-                            https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate
-                            all security issues and warnings relating to the server certificate, and those in the trust
-                            chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in
-                        use, which have undergone extensive review and testing by the developers, as well as
-                        third-parties in the development, security, and cryptography space. Typically, these widely used
-                        implementations have a lower risk of exploitation compared with privately developed - or less
-                        known - implementations (although vulnerabilities such as Heartbleed highlight this is not
-                        universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify
-                        the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify
-                        the veracity of the implementations, and review third party validations together with security
-                        advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries
-                        are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven
-                        implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a
-                            publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If
-                            not, assurance of the security of the implementation should be sought, or the risk
-                            quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the
-                            server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm
-                            that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use
-                            TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL
-                            Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan
-                            tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool:
-                            https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate
-                            all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security
-                            mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment,
-                                allowing developers to monitor their code regularly in order to avoid security
-                                vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                As programming languages evolve, functions occasionally become obsolete due to:
-                                &lt;/div&gt;
-                                &lt;ul&gt;
-                                &lt;li&gt;Advances in the language.&lt;/li&gt;
-                                &lt;li&gt;Improved understanding of how operations should be performed effectively and
-                                securely.&lt;/li&gt;
-                                &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-                                &lt;/ul&gt;
-                                &lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that
-                                perform the same task in some different and hopefully improved way.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components
-                                (typically client and server). The attacker places himself in the communication channel
-                                between the two components. Whenever one component attempts to communicate with the
-                                other (data flow, authentication challenges, etc.), the data first goes to the attacker,
-                                who has the opportunity to observe or alter it, and it is then passed to the other
-                                component as if it were never intercepted. This interposition is transparent leaving the
-                                two compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="74e341fb-b28c-4e24-93c9-18ed9657d476" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
-                        actor without imposing any restrictions on how many resources can be allocated, in violation of
-                        the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.
-
-                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
-                        network traffic can often be sniffed by any attacker who has access to a network interface. This
-                        significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.241">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a
-                        user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an
-                        unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
-                        is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but
-                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
-                        intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
-                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
-                        arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
-                        a file or directory that is located underneath a restricted parent directory, but the software
-                        does not properly neutralize special elements within the pathname that can cause the pathname to
-                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
-                        file operations are intended to take place within a restricted directory. By using special
-                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
-                        location to access files or directories that are elsewhere on the system. One of the most common
-                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
-                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
-                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
-                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
-                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
-                        truncate a generated filename to widen the scope of attack. For example, the software may add
-                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
-                        effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or
-                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
-                        "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an
-                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
-                        could modify the intended OS command when it is sent to a downstream component. This could allow
-                        attackers to execute unexpected, dangerous commands directly on the operating system. This
-                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
-                        access to the operating system, such as in web applications.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
-                        specify commands that normally would not be accessible, or to call alternate commands with
-                        privileges that the attacker does not have. The problem is exacerbated if the compromised
-                        process does not follow the principle of least privilege, because the attacker-controlled
-                        commands may run with special system privileges that increases the amount of damage.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        There are at least two subtypes of OS command injection:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
-                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
-                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
-                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
-                        from executing. However, if the program does not remove command separators from the HOSTNAME
-                        argument, attackers could place the separators into the arguments, which allows them to execute
-                        their own program after nslookup has finished executing.The application accepts an input that it
-                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
-                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
-                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
-                        execute arbitrary commands or programs. If the command is being executed using functions like
-                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
-                        in the same line. From a weakness standpoint, these variants represent distinct programmer
-                        errors.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
-                        will be part of the arguments in the command to be executed. In the second variant, the
-                        programmer does not intend for the command to be accessible to any untrusted party, but the
-                        programmer probably has not accounted for alternate ways in which malicious attackers can
-                        provide input.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.781">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
-                        attributes, properties, or fields that are to be initialized or updated in an object, but it
-                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
-                        the object contains attributes that were only intended for internal use, then their unexpected
-                        modification could lead to a vulnerability. This weakness is sometimes known by the
-                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
-                        object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
-                        an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.781">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits
-                        important details about the event when logging it. When critical security events are not logged
-                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
-                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
-                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
-                        required security controls are implemented correctly, operating as intended, enforcing the
-                        desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.524">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
-                        immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
-                        a security decision, but it does not properly ensure that the IP address is truly associated
-                        with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.607">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
-                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
-                        expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
-                        down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in
-                        a way that is observable to an unauthorized actor, which exposes security-relevant information
-                        about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.498">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
-                        passwords, as well as sensitive information pertaining to the application and system. The source
-                        code can also be sent back to a client because of an error condition or an improperly configured
-                        handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.239">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
-                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.355">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
-                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
-                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.356">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
-                        Where there is no alternative, any user input being included must be sanitized or sandboxed
-                        before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
-                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
-                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
-                            will execute the code with the same permissions, potentially including operation system
-                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
-                            procedures that want to invoke a large number of functions, or set a large number of
-                            variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
-                        is denied. There are many ways this rule will manifest in application code. Some examples of
-                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
-                        new users/roles start with minimal or no permissions and users/roles do not receive access to
-                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
-                        an error or exception while processing access control requests. In these cases access control
-                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
-                        registers for a new account, that account should have minimal or no access by default until that
-                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
-                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
-                            every portion of the application in which a user can create information inside the database
-                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
-                            (statement of account, order details, etc.), or delete information (drop users, messages,
-                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method. Many flaws in applications result from
-                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
-                        disclosure. Use of filenames or other direct references to objects such as files on the
-                        server-side increases the risk of compromise of the system or unauthorized access to other
-                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
-                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
-                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
-                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
-                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
-                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
-                        references are used to access files from within the web-root deviating from recommended security
-                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
-                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
-                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
-                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
-                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
-                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
-                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
-                            way and if so, it should not be possible to access locations outside of this domain (i.e.
-                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
-                            etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.978">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but
-                        depending on the resource type the headers may vary. Identify the type of resource the web
-                        service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                        subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin:
-                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin:
-                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be
-                        omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data
-                        personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API
-                        endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized
-                        resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials:
-                        true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a
-                        href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods:
-                        POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...:
-                        ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers
-                        from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources
-                        that are intended for cross-origin no-cors embedding, but which don't intend to be directly
-                        legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated
-                        documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
-                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
-                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
-                        Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest,
-                        Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting
-                        Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents
-                        that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
-                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to
-                        be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
-                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
-                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
-                        that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
-                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
-                            properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some
-                            external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
-                            href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic
-                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
-                            href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just
-                            open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.469">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
-                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
-                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
-                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
-                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
-                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
-                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
-                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
-                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
-                        the usage of automated tools is detected, the application should respond by denying access and
-                        notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.045">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
-                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
-                        database records and database fields. Sensitive information can be extracted from data mining
-                        operations. When information is personally identifiable information, it may lead to
-                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
-                        data mining activities, organizations determine whether such activities are authorized.
-                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
-                        policies that address data mining requirements. Organizational personnel consult with the senior
-                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
-                        mining prevention and detection techniques include limiting the number and frequency of database
-                        queries to increase the work factor needed to determine the contents of databases, limiting
-                        types of responses provided to database queries, applying differential privacy techniques or
-                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
-                        occur. Data mining protection focuses on protecting information from data mining while such
-                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
-                        organizational information that may have been mined or otherwise obtained from data stores and
-                        is available as open-source information residing on external sites, such as social networking or
-                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
-                        threat program for deterring, detecting, and mitigating insider threats, including the
-                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
-                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
-                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
-                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
-                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
-                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
-                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
-                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
-                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or
-                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
-                        client-side actions. This can expose the application to attack through remote or local
-                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
-                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
-                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
-                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
-                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
-                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
-                            are untrusted, make sure there is a validation and sanitization mechanism before sending
-                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
-                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
-                        encryption between the client and server, terminating within a secure environment on the
-                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
-                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
-                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
-                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
-                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
-                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
-                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
-                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
-                        controllers, services, and other resources. This implies protection against spoofing and
-                        elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
-                            the database (e.g., making a payment, adding a contact, or sending a message), or can
-                            receive information (statement of account, order details, etc.), or delete information (drop
-                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
-                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
-                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
-                            may be used in applications for:&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
-                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
-                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
-                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
-                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
-                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
-                        applications. These HTTP methods can be used for nefarious purposes if the web server is
-                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
-                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
-                        and POST are by far the most common methods that are used to access information provided by a
-                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
-                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
-                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
-                        of these methods can potentially pose a security risk for a web application, as they allow an
-                        attacker to modify the files stored on the web server and, in some scenarios, steal the
-                        credentials of legitimate users. More specifically, the methods that should be disabled are the
-                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
-                        client to upload new files onto the web server. An attacker may exploit this by uploading
-                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
-                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
-                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
-                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
-                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
-                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
-                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
-                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
-                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
-                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
-                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
-                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
-                        DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.679">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
-                        secure deployment of the application, particularly if the application infrastructure is software
-                        defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
-                            configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
-                            (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Web server and application server configurations play a key role in the security of a web
-                        application. These servers are responsible for serving content and invoking applications that
-                        generate content. In addition, many application servers provide a number of services that web
-                        applications can use, including data storage, directory services, mail, messaging, and more.
-                        Failure to manage the proper configuration of your servers can lead to a wide variety of
-                        security problems.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Authorized administrators need to ensure the integrity of all security-relevant configurations
-                        to detect tampering.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            In order to evaluate the readiness of the application platform, testing for configuration
-                            management includes the following sections:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
-                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
-                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
-                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
-                        is directly written to a log file, then this data could contain newline or other meta-characters
-                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
-                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
-                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
-                        header) should be included with requests. This security header was designed to prevent
-                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
-                        fetch originates from. It doesn't include any path information, but only the server name. It is
-                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
-                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
-                        Content-Disposition response header tells the browser to download a file rather than displaying
-                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
-                        but does not specify a character set, then the browser may analyze the HTML and attempt to
-                        determine which character set it appears to be using. Even if the majority of the HTML actually
-                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
-                        in the response may cause the browser to interpret the content using a different character set.
-                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
-                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
-                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
-                        use the Origin header for authentication or access control decisions, as the Origin header can
-                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
-                        header for file downloading in all API responses with the following directives:
-                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
-                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
-                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
-                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
-                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
-                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
-                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
-                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
-                            insecure configurations; for example, when the server returns back the Origin header in the
-                            Access-Control-Allow-Origin without any additional checks AND returns
-                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
-                            that this configuration is very insecure, and is not acceptable in general terms, except in
-                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
-                            Reflected File Download input payloads to launch commands on the client machine. Reflected
-                            File Download is an attack combining URL path segments (now deprecated) with pages that
-                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
-                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
-                            popular misuse; namely, being used for encoding malicious injection strings in a way that
-                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
-                            validation filters, or take advantage of particular ways in which browsers render encoded
-                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
-                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
-                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
-                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
-                        Protections can include ensuring that DNS names used by applications are regularly checked for
-                        expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
-                            the connection to the DNS was authenticated successfully by username/password or certificate
-                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
-                        time that the application requires to function properly while minimizing the resources employed
-                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
-                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
-                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
-                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
-                        distinguishing between malicious and legitimate traffic. Many of the most common protection
-                        measures or systems focus on the network or transport layer, and as such, they would not be
-                        efficient when the target of the attack is the application layer. It is even difficult for the
-                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
-                        we have indicated, this type of attack is very specific, and generally require fewer resources
-                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
-                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
-                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
-                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
-                        application to identify "heavy" requests that are resource consuming. For example, if the web
-                        application has a search engine, an attack could be to carry out searches that require a high
-                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
-                        a challenge to the device making the network request in order to test whether or not it is a
-                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
-                        account online. By giving a requirement such as a JavaScript computational challenge, many
-                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
-                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
-                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
-                            application attack is Slowloris, which targets web servers. Verify that the implemented
-                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.377">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
-                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
-                        bypass important steps in the flow. This business logic limits provide us protection against
-                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
-                        business actions or transactions that exceed the established limits, should be recorded in the
-                        logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
-                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
-                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
-                            logic perspective.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
-                        to enumerate or attempt to exploit flaws in an application, for example, sending common
-                        passwords to multiple target accounts within an application. By profiling normal traffic
-                        volumes, and applying rate limiting, the application can be built to actively mitigate such
-                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
-                        rate-limiting based on the source IP address can be used to restrict attacks against the
-                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
-                        result in temporarily blocking or dropping traffic from the source. Note however that some
-                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
-                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
-                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
-                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
-                        failures than usual), and appropriate actions taken. For example, when the application detects
-                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
-                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
-                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
-                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
-                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
-                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
-                        detects a set number of failure login attempts, the account shall be locked for a certain time
-                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
-                        the application detects an account is locked more times than usual, this account should be
-                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
-                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
-                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
-                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
-                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
-                        the user successfully authenticates, the previous failed attempts shall be reset for that user
-                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
-                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
-                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
-                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
-                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
-                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
-                            log alerting function for an unusual amount of failed login attempts, even if they
-                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
-                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
-                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
-                        error handling does not give an attacker any information which can be leveraged for attacking
-                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
-                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
-                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
-                        an infrastructure for consistent error reporting proves more difficult than error handling. All
-                        exceptions should be caught as events with the severity of the error. These events will be
-                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
-                        corresponding error or system message in a consistent manner, depending on the severity of the
-                        error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
-                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
-                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
-                        However, proper logging practices can provide the crucial forensics needed to investigate after
-                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
-                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
-                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
-                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
-                        should be written using a format suited to be consumed by a log management solution, and include
-                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
-                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
-                        a monitoring system to continuously monitor the infrastructure, network, and the API
-                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
-                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
-                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
-                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
-                            confirm that the organization's logging policies, processes, and procedures are being
-                            followed properly both at the infrastructure level and the system level throughout the
-                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
-                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
-                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
-                            or others performing testing and validation can review the logging configuration and
-                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
-                            representative sampling of systems and infrastructure servers to ensure that they comply
-                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
-                            the direction of auditors) or others performing testing and validation can create security
-                            events on a representative sampling of systems through vulnerability scanning, penetration
-                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
-                            log data those activities should generate exist and are handled according to the
-                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
-                        little computational effort) force the server to expend relatively large computational work. If
-                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
-                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
-                        availability by sending unintelligible data. In a variation of this attack, an attacker
-                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
-                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
-                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
-                        the application traffic for signs of attack traffic or violations of policy at an application
-                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
-                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
-                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
-                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
-                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            and the options you should use will depend greatly on your testing requirements. Below are
-                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
-                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
-                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
-                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
-                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
-                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
-                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
-                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.377">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
-                        files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Data validation failures, together with access control violations, are symptomatic of malicious
-                        activity where an attacker is attempting to subvert the protections in place. It is therefore
-                        likely that unexpected input detected by the application relates to an attack. Rejecting and
-                        logging such activity, and ideally terminating the session, increases the likelihood of
-                        detecting and inhibiting structured attacks against the application.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
-                        the logs and subsequent access to them.&lt;/li&gt;
-                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
-                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
-                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
-                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
-                            relating to the event must be carefully sanitized and encoded; by definition the data could
-                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
-                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
-                        etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
-                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
-                            there is no company policy, check that at least the following data is included: timestamp
-                            event, status, error codes, service/command/application username or system account
-                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
-                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
-                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
-                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be
-                        precise enough to know who changed what and when). This includes data access from the
-                        application as well as data access from privileged accounts, such as database admins. In
-                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
-                            administrators and malicious actors.&lt;/li&gt;
-                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
-                            sufficiently detailed.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
-                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
-                        control and restrict access to the source. Application services may unexpectedly expose code,
-                        for example a service providing files to a user could be manipulated to access source code if
-                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
-                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
-                        configuration files are not downloadable directly from the service, and cannot be read and
-                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
-                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
-                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
-                            handlers which manage the source code interpretation before sending it to the client. If
-                            those handlers are not properly configured, the plain source code could be sent as a
-                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
-                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
-                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
-                        web site, email, blog, instant message, or program causes a user's web browser to perform an
-                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
-                        browser requests automatically include any credentials associated with the site, such as the
-                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
-                        site cannot distinguish between the forged or legitimate request sent by the victim. A
-                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
-                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
-                        re-authentication of sensitive functions is an effective way to protect your application against
-                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
-                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
-                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
-                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
-                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
-                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
-                        the server-side is problematic, an alternative defense is to use the double-submit cookie
-                        technique. This technique is easy to implement and is stateless. In this technique, a random
-                        value is sent in both a cookie and as a request parameter, with the server verifying if the
-                        cookie value and request value match. When a user visits (even before authenticating to prevent
-                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
-                        it as a cookie on the user's machine separate from the session identifier. The site then
-                        requires that every transaction request include this pseudo-random value as a hidden form value
-                        (or other request parameter/header). If both of them match on the server-side, the server
-                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
-                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
-                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
-                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
-                        determining the origin the request is going to (target origin). On the server-side verify if
-                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
-                        origin request) and if they don't, discard the request (meaning that the request originated from
-                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
-                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
-                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
-                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
-                            request and server response, and verify a unique strong token is being sent and verified
-                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
-                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
-                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
-                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
-                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
-                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
-                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
-                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
-                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
-                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
-                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
-                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
-                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
-                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
-                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
-                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
-                        or using hardware then this configuration may not be enough. The configuration will also cause
-                        denial of service to other users when under attack even from single source, as we are limiting
-                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
-                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
-                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
-                        block outgoing connections but we do not want it to become channel from where people start
-                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
-                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
-                        disabling the ICMP functionality of the targeted router, computer or other device. A network
-                        administrator can access the administrative interface of the device and disable its ability to
-                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
-                        request and the Echo Reply. The consequence of this is that all network activities that involve
-                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
-                        other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
-                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.378">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
-                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
-                        This may include elevating privileges or accessing sensitive data and functionality, such as
-                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
-                        critical functions and sensitive data should be further protected from attack using a risk-based
-                        authentication model requiring re-authentication via multi-factor authentication, or use of a
-                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
-                        re-authentication on key functions (such as requiring the old password before setting a new
-                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
-                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
-                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
-                        signing technologies or tokens that enable the server-side to verify the authenticity of a
-                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
-                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
-                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
-                        allowing them to prematurely enter or skip required sections of the application potentially
-                        allowing actions/transactions to be completed without successfully completing the entire
-                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
-                            order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Use periodically a static code analysis tool to analyze the code and detect potentially
-                        malicious code, such as time functions, unsafe file operations and networks connections. With
-                        the scanning of static code, we ensure the integrity of the application.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Verify that a code analysis tool is in use and it is configured to detect potentially
-                            malicious code, such as time functions, unsafe file operations and network connections.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to
-                        trick error-free programs, which follow best practices, into leaking their secrets. In fact, the
-                        safety checks of said best practices actually increase the attack surface and may make
-                        applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce
-                        potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to
-                        respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to
-                        the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict
-                        attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin
-                        resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when
-                        necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as
-                        a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or
-                        CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder,
-                        for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle
-                        to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case,
-                        you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or
-                        unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion
-                        attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read
-                        blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and
-                        globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
-                            properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.470">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
-                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
-                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
-                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
-                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
-                        control is critical in identifying application events (including attacks) through logging, and
-                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
-                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
-                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
-                        to detect possible situations in which the system has been compromised and give an appropriate
-                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
-                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
-                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                        &lt;li&gt;Use available features of the language or framework that allow specification of white
-                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
-                        (white list) or attr_protected (black list) macros in each class that may be used in mass
-                        assignment.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
-                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
-                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
-                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
-                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
-                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
-                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
-                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
-                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
-                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
-                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
-                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
-                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
-                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
-                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
-                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
-                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
-                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
-                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
-                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
-                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
-                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
-                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
-                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
-                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.378">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
-                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
-                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
-                        connection, using approved cryptographic algorithms.&lt;/p&gt;
-                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
-                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
-                        authentication system, most typically identified as a separate entity in a Federated
-                        authentication system. A CSP may be an independent third party, or may issue credentials for its
-                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
-                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
-                        but whose users may be subsequently authenticated to other sites, applications or services
-                        without further action on their part.&lt;/p&gt;
-                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
-                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
-                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
-                        the claimant's possession and control of one or two authenticators, using an authentication
-                        protocol.&lt;/p&gt;
-                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
-                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
-                        to process a transaction or grant access to information or a system.&lt;/p&gt;
-                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
-                        identity proofing.&lt;/p&gt;
-                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
-                        authentication protocols.&lt;/p&gt;
-                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
-                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
-                            with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
-                        two general types of encoding errors. If the byte sequence is not valid for the specified
-                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
-                        equivalent character sequence then an unmappable character has been encountered.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
-                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
-                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
-                        transmission will result in an error. Encoding and decoding errors typically result in data
-                        corruption.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;
-                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
-                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
-                        attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
-                        the source or transport method. For example, while hidden form fields, cookies or other headers
-                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
-                        forms. These can be modified by the user on the client-side in memory, or in transit on the
-                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
-                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
-                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
-                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
-                        data from the client side must be subjected to strict validation, sanitization, and encoding
-                        against expected syntactic and semantic criteria.
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
-                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
-                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
-                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
-                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
-                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
-                        non-compliant data.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
-                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
-                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
-                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
-                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
-                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
-                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
-                        server side, X- headers, and other platform specific data objects passed between the client and
-                        server.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
-                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
-                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
-                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;To test data validation:&amp;nbsp;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
-                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
-                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
-                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
-                            Fiddler, etc.).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk,
-                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
-                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
-                        the server. For example, injection of parameters into strings or cookies sent to the application
-                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
-                        logic and flow.
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
-                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
-                        the following HTTP request:&lt;/p&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
-                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
-                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
-                        whereas the actual operation used the second occurrence.&lt;/p&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
-                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
-                            the application in which those parameters are duplicated, or passed through other methods
-                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
-                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
-                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
-                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
-                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
-                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
-                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
-                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
-                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
-                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
-                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
-                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
-                        whitelisting can also be achieved by applying regular expressions. The application should only
-                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
-                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
-                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
-                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
-                            the input value which will be part of the Location header to redirect to domains which
-                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer
-                                software through black box analysis techniques. 'Black Box' methods involve interacting
-                                with the software indirectly, in the absence of direct access to the executable object.
-                                Such analysis typically involves interacting with the software at the boundaries of
-                                where the software interfaces with a larger execution environment, such as input-output
-                                vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service
-                                itself.
-                                &lt;br&gt;
-                                &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
-                                still critical to the security of the product that is being created. Because the issues
-                                covered by this section are not directly related to source code, we separated it from
-                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
-                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
-                                application's functionality; particularly URL's for web-apps. In cases in which the
-                                administrator failed to specify an ACL for a particular element, an attacker may be able
-                                to access it with impunity. An attacker with the ability to access functionality not
-                                properly constrained by ACLs can obtain sensitive information and possibly compromise
-                                the entire application. Such an attacker could potentially access resources that should
-                                only be available to users of a higher privilege level, or access management sections of
-                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
-                                application and observes any stack traces produced by error messages. Fuzzing techniques
-                                involve sending random or malformed messages to a target and monitoring the target's
-                                response. The attacker does not initially know how a target will respond to individual
-                                messages but by attempting a large number of message variants they may find a variant
-                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
-                                the targeted application to return an error including a stack trace, although fuzzing a
-                                target can also sometimes cause the target to enter an unstable state, causing a crash.
-                                The stack trace enumerates the chain of methods that led up to the point where the error
-                                was encountered. This can not only reveal the names of the methods (some of which may
-                                have known weaknesses) but possibly also the location of class files and libraries as
-                                well as parameter values. In some cases, the stack trace might even disclose sensitive
-                                configuration or user information.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment,
-                                allowing developers to monitor their code regularly in order to avoid security
-                                vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
-                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
-                                Service Provider it points to, some of these services will allow unverified users to
-                                claim these sub-domains as their own.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
-                                used inside the Service Provider.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;div&gt;
-                                &lt;b&gt;Attack Scenario&lt;/b&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;ol&gt;
-                                &lt;li&gt;Your company starts using a new service, eg an external Support
-                                Ticketing-service.&lt;/li&gt;
-                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
-                                support.your-domain.com&lt;/li&gt;
-                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
-                                redirection pointing to the ticketing system.&lt;/li&gt;
-                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
-                                verification is done by the Service Provider, and the DNS-setup is already correctly
-                                setup.&lt;/li&gt;
-                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
-                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
-                                destroy business credibility for your company.&lt;/li&gt;
-                                &lt;/ol&gt;
-                                &lt;/div&gt;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
-                                returned by the service, and this code contains confidential information such as
-                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
-                                files that can be downloaded from the service could also be leveraged to gain access to
-                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
-                                attempt to bypass this order so that they can perform operations for which they are not
-                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
-                                the attackers' request, thereby reducing the resources available for legitimate services
-                                and degrading or denying services. Usually, this attack focuses on memory allocation,
-                                but any finite resource on the target could be the attacked, including bandwidth,
-                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
-                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
-                                small number of requests that are carefully formatted to force the target to allocate
-                                excessive resources to service this request(s). Often this attack takes advantage of a
-                                bug in the target to cause the target to allocate resources vastly beyond what would be
-                                needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
-                                reserved for privileged users or administrators but are exposed to use by lower or
-                                non-privileged accounts. Access to sensitive information and functionality must be
-                                controlled to ensure that only authorized users are able to access these resources. If
-                                access control mechanisms are absent or misconfigured, a user may be able to access
-                                resources that are intended only for higher level users. An adversary may be able to
-                                exploit this to utilize a less trusted account to gain information and perform
-                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
-                                attacks in that the adversary never actually escalates their privileges but instead is
-                                able to use a lesser degree of privilege to access resources that should be (but are
-                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
-                                trust or subvert systems - all control functionality is working as configured but the
-                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
-                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
-                                log audit, cover traces of attack, or perform other malicious actions. The target host
-                                is not properly controlling log access. As a result tainted data is resulting in the log
-                                files leading to a failure in accountability, non-repudiation and incident forensics
-                                capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
-                                subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
-                                resources. The attacker can supply - or modify - a URL which the code running on the
-                                server will read or submit data to, and by carefully selecting the URLs, the attacker
-                                may be able to read server configuration details such as AWS metadata, connect to
-                                internal services like http enabled databases, or perform post requests towards internal
-                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files,
-                                when the executable loads the resource (such as an image file or configuration file) the
-                                attacker has modified the file to either execute malicious code directly or manipulate
-                                the target process (e.g. application server) to execute based on the malicious
-                                configuration parameters. Since systems are increasingly interrelated mashing up
-                                resources from local and remote sources the possibility of this attack occurring is
-                                high.
-                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
-                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
-                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
-                                into the browser. Another example targets clients reading pdf files. In this case the
-                                attacker simply appends javascript to the end of a legitimate url for a pdf
-                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
-                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
-                                modified the resource and loaded executable javascript into the client's browser
-                                process.
-                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
-                                or configuration file, for example a web.xml file used to configure security permissions
-                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
-                                the public role the ability to use the administration functionality.
-                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
-                                manipulated, the attacker gains full control.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which
-                                affect the behavior of that application. For example, many applications use external
-                                configuration files and libraries - modification of these entities or otherwise
-                                affecting the application's ability to use them would constitute a
-                                configuration/environment manipulation attack.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
-                                under his control and mix it with executed code on the server side by modifying the
-                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
-                                on the code isolation, this event could grant the user access to system resources and
-                                data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
-                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
-                                the target software to generate HTML text or other potentially executable content. Many
-                                websites rely on user-generated content and dynamically build resources like files,
-                                filenames, and URL links directly from user supplied data. In this attack pattern, the
-                                attacker uploads code that can execute in the client browser and/or redirect the client
-                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
-                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static,
-                                binary format for saving to disk or transferring over a network. These objects are then
-                                deserialized when needed to recover the data/state. By injecting a malformed object into
-                                a vulnerable application, an adversary can potentially compromise the application by
-                                manipulating the deserialization process. This can result in a number of unwanted
-                                outcomes, including remote code execution.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
-                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
-                                execute the malicious action against some third-party application. If successful, the
-                                action embedded in the malicious link will be processed and accepted by the targeted
-                                application with the users' privilege level.
-                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
-                                user session cookies by many web applications today. In such an architecture, once the
-                                user authenticates to an application and a session cookie is created on the user's
-                                system, all following transactions for that session are authenticated using that cookie
-                                including potential actions initiated by an attacker and simply "riding" the existing
-                                session cookie.
-                                &lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
-                                another specified URL. By modifying this URL value to point towards a malicious site, an
-                                attacker may successfully launch a phishing scam and steal user credentials. Because the
-                                server name in the modified link is identical to the original site, phishing attempts
-                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
-                                and submitting it to applications not expecting or effective at validating this
-                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could
-                                potentially set fields on those objects that were not designed to be modified by the
-                                user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="d16d50e6-8880-42db-a078-f9f07936fa5e" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
-                        actor without imposing any restrictions on how many resources can be allocated, in violation of
-                        the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.
-
-                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
-                        network traffic can often be sniffed by any attacker who has access to a network interface. This
-                        significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a
-                        user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an
-                        unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
-                        is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but
-                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
-                        intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
-                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
-                        arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
-                        a file or directory that is located underneath a restricted parent directory, but the software
-                        does not properly neutralize special elements within the pathname that can cause the pathname to
-                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
-                        file operations are intended to take place within a restricted directory. By using special
-                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
-                        location to access files or directories that are elsewhere on the system. One of the most common
-                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
-                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
-                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
-                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
-                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
-                        truncate a generated filename to widen the scope of attack. For example, the software may add
-                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
-                        effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or
-                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
-                        "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an
-                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
-                        could modify the intended OS command when it is sent to a downstream component. This could allow
-                        attackers to execute unexpected, dangerous commands directly on the operating system. This
-                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
-                        access to the operating system, such as in web applications.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
-                        specify commands that normally would not be accessible, or to call alternate commands with
-                        privileges that the attacker does not have. The problem is exacerbated if the compromised
-                        process does not follow the principle of least privilege, because the attacker-controlled
-                        commands may run with special system privileges that increases the amount of damage.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        There are at least two subtypes of OS command injection:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
-                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
-                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
-                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
-                        from executing. However, if the program does not remove command separators from the HOSTNAME
-                        argument, attackers could place the separators into the arguments, which allows them to execute
-                        their own program after nslookup has finished executing.The application accepts an input that it
-                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
-                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
-                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
-                        execute arbitrary commands or programs. If the command is being executed using functions like
-                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
-                        in the same line. From a weakness standpoint, these variants represent distinct programmer
-                        errors.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
-                        will be part of the arguments in the command to be executed. In the second variant, the
-                        programmer does not intend for the command to be accessible to any untrusted party, but the
-                        programmer probably has not accounted for alternate ways in which malicious attackers can
-                        provide input.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
-                        attributes, properties, or fields that are to be initialized or updated in an object, but it
-                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
-                        the object contains attributes that were only intended for internal use, then their unexpected
-                        modification could lead to a vulnerability. This weakness is sometimes known by the
-                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
-                        object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
-                        an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits
-                        important details about the event when logging it. When critical security events are not logged
-                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
-                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.576">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
-                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
-                        required security controls are implemented correctly, operating as intended, enforcing the
-                        desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.682">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
-                        immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
-                        a security decision, but it does not properly ensure that the IP address is truly associated
-                        with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.427">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
-                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
-                        expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
-                        down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.822">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
-                        passwords, as well as sensitive information pertaining to the application and system. The source
-                        code can also be sent back to a client because of an error condition or an improperly configured
-                        handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.107">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
-                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.634">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
-                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
-                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.635">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
-                        Where there is no alternative, any user input being included must be sanitized or sandboxed
-                        before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
-                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
-                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
-                            will execute the code with the same permissions, potentially including operation system
-                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
-                            procedures that want to invoke a large number of functions, or set a large number of
-                            variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
-                        is denied. There are many ways this rule will manifest in application code. Some examples of
-                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
-                        new users/roles start with minimal or no permissions and users/roles do not receive access to
-                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
-                        an error or exception while processing access control requests. In these cases access control
-                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
-                        registers for a new account, that account should have minimal or no access by default until that
-                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
-                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
-                            every portion of the application in which a user can create information inside the database
-                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
-                            (statement of account, order details, etc.), or delete information (drop users, messages,
-                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method. Many flaws in applications result from
-                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
-                        disclosure. Use of filenames or other direct references to objects such as files on the
-                        server-side increases the risk of compromise of the system or unauthorized access to other
-                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
-                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
-                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
-                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
-                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
-                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
-                        references are used to access files from within the web-root deviating from recommended security
-                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
-                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
-                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
-                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
-                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
-                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
-                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
-                            way and if so, it should not be possible to access locations outside of this domain (i.e.
-                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
-                            etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.385">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
-                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
-                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
-                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
-                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
-                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
-                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
-                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
-                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
-                        the usage of automated tools is detected, the application should respond by denying access and
-                        notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.904">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
-                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
-                        database records and database fields. Sensitive information can be extracted from data mining
-                        operations. When information is personally identifiable information, it may lead to
-                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
-                        data mining activities, organizations determine whether such activities are authorized.
-                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
-                        policies that address data mining requirements. Organizational personnel consult with the senior
-                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
-                        mining prevention and detection techniques include limiting the number and frequency of database
-                        queries to increase the work factor needed to determine the contents of databases, limiting
-                        types of responses provided to database queries, applying differential privacy techniques or
-                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
-                        occur. Data mining protection focuses on protecting information from data mining while such
-                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
-                        organizational information that may have been mined or otherwise obtained from data stores and
-                        is available as open-source information residing on external sites, such as social networking or
-                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
-                        threat program for deterring, detecting, and mitigating insider threats, including the
-                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
-                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
-                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
-                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
-                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
-                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
-                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
-                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
-                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or
-                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
-                        client-side actions. This can expose the application to attack through remote or local
-                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
-                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
-                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
-                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
-                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
-                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
-                            are untrusted, make sure there is a validation and sanitization mechanism before sending
-                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
-                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
-                        encryption between the client and server, terminating within a secure environment on the
-                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
-                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
-                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
-                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
-                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
-                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
-                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
-                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
-                        controllers, services, and other resources. This implies protection against spoofing and
-                        elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
-                            the database (e.g., making a payment, adding a contact, or sending a message), or can
-                            receive information (statement of account, order details, etc.), or delete information (drop
-                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
-                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
-                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
-                            may be used in applications for:&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
-                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
-                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
-                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
-                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
-                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
-                        applications. These HTTP methods can be used for nefarious purposes if the web server is
-                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
-                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
-                        and POST are by far the most common methods that are used to access information provided by a
-                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
-                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
-                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
-                        of these methods can potentially pose a security risk for a web application, as they allow an
-                        attacker to modify the files stored on the web server and, in some scenarios, steal the
-                        credentials of legitimate users. More specifically, the methods that should be disabled are the
-                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
-                        client to upload new files onto the web server. An attacker may exploit this by uploading
-                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
-                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
-                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
-                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
-                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
-                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
-                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
-                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
-                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
-                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
-                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
-                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
-                        DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.938">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
-                        secure deployment of the application, particularly if the application infrastructure is software
-                        defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
-                            configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
-                            (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Web server and application server configurations play a key role in the security of a web
-                        application. These servers are responsible for serving content and invoking applications that
-                        generate content. In addition, many application servers provide a number of services that web
-                        applications can use, including data storage, directory services, mail, messaging, and more.
-                        Failure to manage the proper configuration of your servers can lead to a wide variety of
-                        security problems.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Authorized administrators need to ensure the integrity of all security-relevant configurations
-                        to detect tampering.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            In order to evaluate the readiness of the application platform, testing for configuration
-                            management includes the following sections:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
-                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
-                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
-                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
-                        is directly written to a log file, then this data could contain newline or other meta-characters
-                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
-                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
-                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
-                        header) should be included with requests. This security header was designed to prevent
-                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
-                        fetch originates from. It doesn't include any path information, but only the server name. It is
-                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
-                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
-                        Content-Disposition response header tells the browser to download a file rather than displaying
-                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
-                        but does not specify a character set, then the browser may analyze the HTML and attempt to
-                        determine which character set it appears to be using. Even if the majority of the HTML actually
-                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
-                        in the response may cause the browser to interpret the content using a different character set.
-                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
-                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
-                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
-                        use the Origin header for authentication or access control decisions, as the Origin header can
-                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
-                        header for file downloading in all API responses with the following directives:
-                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
-                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
-                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
-                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
-                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
-                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
-                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
-                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
-                            insecure configurations; for example, when the server returns back the Origin header in the
-                            Access-Control-Allow-Origin without any additional checks AND returns
-                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
-                            that this configuration is very insecure, and is not acceptable in general terms, except in
-                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
-                            Reflected File Download input payloads to launch commands on the client machine. Reflected
-                            File Download is an attack combining URL path segments (now deprecated) with pages that
-                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
-                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
-                            popular misuse; namely, being used for encoding malicious injection strings in a way that
-                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
-                            validation filters, or take advantage of particular ways in which browsers render encoded
-                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
-                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
-                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
-                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
-                        Protections can include ensuring that DNS names used by applications are regularly checked for
-                        expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
-                            the connection to the DNS was authenticated successfully by username/password or certificate
-                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.269">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
-                        time that the application requires to function properly while minimizing the resources employed
-                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
-                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
-                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
-                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
-                        distinguishing between malicious and legitimate traffic. Many of the most common protection
-                        measures or systems focus on the network or transport layer, and as such, they would not be
-                        efficient when the target of the attack is the application layer. It is even difficult for the
-                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
-                        we have indicated, this type of attack is very specific, and generally require fewer resources
-                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
-                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
-                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
-                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
-                        application to identify "heavy" requests that are resource consuming. For example, if the web
-                        application has a search engine, an attack could be to carry out searches that require a high
-                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
-                        a challenge to the device making the network request in order to test whether or not it is a
-                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
-                        account online. By giving a requirement such as a JavaScript computational challenge, many
-                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
-                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
-                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
-                            application attack is Slowloris, which targets web servers. Verify that the implemented
-                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
-                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
-                        bypass important steps in the flow. This business logic limits provide us protection against
-                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
-                        business actions or transactions that exceed the established limits, should be recorded in the
-                        logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
-                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
-                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
-                            logic perspective.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
-                        to enumerate or attempt to exploit flaws in an application, for example, sending common
-                        passwords to multiple target accounts within an application. By profiling normal traffic
-                        volumes, and applying rate limiting, the application can be built to actively mitigate such
-                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
-                        rate-limiting based on the source IP address can be used to restrict attacks against the
-                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
-                        result in temporarily blocking or dropping traffic from the source. Note however that some
-                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
-                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
-                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
-                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
-                        failures than usual), and appropriate actions taken. For example, when the application detects
-                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
-                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
-                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
-                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
-                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
-                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
-                        detects a set number of failure login attempts, the account shall be locked for a certain time
-                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
-                        the application detects an account is locked more times than usual, this account should be
-                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
-                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
-                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
-                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
-                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
-                        the user successfully authenticates, the previous failed attempts shall be reset for that user
-                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
-                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
-                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
-                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
-                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
-                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
-                            log alerting function for an unusual amount of failed login attempts, even if they
-                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
-                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
-                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
-                        error handling does not give an attacker any information which can be leveraged for attacking
-                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
-                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
-                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
-                        an infrastructure for consistent error reporting proves more difficult than error handling. All
-                        exceptions should be caught as events with the severity of the error. These events will be
-                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
-                        corresponding error or system message in a consistent manner, depending on the severity of the
-                        error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
-                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
-                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
-                        However, proper logging practices can provide the crucial forensics needed to investigate after
-                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
-                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
-                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
-                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
-                        should be written using a format suited to be consumed by a log management solution, and include
-                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
-                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
-                        a monitoring system to continuously monitor the infrastructure, network, and the API
-                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
-                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
-                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
-                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
-                            confirm that the organization's logging policies, processes, and procedures are being
-                            followed properly both at the infrastructure level and the system level throughout the
-                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
-                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
-                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
-                            or others performing testing and validation can review the logging configuration and
-                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
-                            representative sampling of systems and infrastructure servers to ensure that they comply
-                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
-                            the direction of auditors) or others performing testing and validation can create security
-                            events on a representative sampling of systems through vulnerability scanning, penetration
-                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
-                            log data those activities should generate exist and are handled according to the
-                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
-                        little computational effort) force the server to expend relatively large computational work. If
-                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
-                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
-                        availability by sending unintelligible data. In a variation of this attack, an attacker
-                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
-                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
-                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
-                        the application traffic for signs of attack traffic or violations of policy at an application
-                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
-                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
-                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
-                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
-                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            and the options you should use will depend greatly on your testing requirements. Below are
-                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
-                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
-                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
-                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
-                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
-                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
-                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
-                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
-                        files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Data validation failures, together with access control violations, are symptomatic of malicious
-                        activity where an attacker is attempting to subvert the protections in place. It is therefore
-                        likely that unexpected input detected by the application relates to an attack. Rejecting and
-                        logging such activity, and ideally terminating the session, increases the likelihood of
-                        detecting and inhibiting structured attacks against the application.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
-                        the logs and subsequent access to them.&lt;/li&gt;
-                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
-                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
-                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
-                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
-                            relating to the event must be carefully sanitized and encoded; by definition the data could
-                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
-                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
-                        etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
-                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
-                            there is no company policy, check that at least the following data is included: timestamp
-                            event, status, error codes, service/command/application username or system account
-                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
-                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
-                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
-                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be
-                        precise enough to know who changed what and when). This includes data access from the
-                        application as well as data access from privileged accounts, such as database admins. In
-                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
-                            administrators and malicious actors.&lt;/li&gt;
-                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
-                            sufficiently detailed.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
-                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
-                        control and restrict access to the source. Application services may unexpectedly expose code,
-                        for example a service providing files to a user could be manipulated to access source code if
-                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
-                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
-                        configuration files are not downloadable directly from the service, and cannot be read and
-                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
-                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
-                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
-                            handlers which manage the source code interpretation before sending it to the client. If
-                            those handlers are not properly configured, the plain source code could be sent as a
-                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
-                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
-                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
-                        web site, email, blog, instant message, or program causes a user's web browser to perform an
-                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
-                        browser requests automatically include any credentials associated with the site, such as the
-                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
-                        site cannot distinguish between the forged or legitimate request sent by the victim. A
-                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
-                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
-                        re-authentication of sensitive functions is an effective way to protect your application against
-                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
-                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
-                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
-                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
-                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
-                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
-                        the server-side is problematic, an alternative defense is to use the double-submit cookie
-                        technique. This technique is easy to implement and is stateless. In this technique, a random
-                        value is sent in both a cookie and as a request parameter, with the server verifying if the
-                        cookie value and request value match. When a user visits (even before authenticating to prevent
-                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
-                        it as a cookie on the user's machine separate from the session identifier. The site then
-                        requires that every transaction request include this pseudo-random value as a hidden form value
-                        (or other request parameter/header). If both of them match on the server-side, the server
-                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
-                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
-                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
-                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
-                        determining the origin the request is going to (target origin). On the server-side verify if
-                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
-                        origin request) and if they don't, discard the request (meaning that the request originated from
-                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
-                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
-                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
-                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
-                            request and server response, and verify a unique strong token is being sent and verified
-                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
-                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
-                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
-                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
-                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
-                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
-                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
-                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
-                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
-                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
-                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
-                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
-                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
-                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
-                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
-                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
-                        or using hardware then this configuration may not be enough. The configuration will also cause
-                        denial of service to other users when under attack even from single source, as we are limiting
-                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
-                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
-                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
-                        block outgoing connections but we do not want it to become channel from where people start
-                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
-                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
-                        disabling the ICMP functionality of the targeted router, computer or other device. A network
-                        administrator can access the administrative interface of the device and disable its ability to
-                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
-                        request and the Echo Reply. The consequence of this is that all network activities that involve
-                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
-                        other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
-                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
-                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
-                        This may include elevating privileges or accessing sensitive data and functionality, such as
-                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
-                        critical functions and sensitive data should be further protected from attack using a risk-based
-                        authentication model requiring re-authentication via multi-factor authentication, or use of a
-                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
-                        re-authentication on key functions (such as requiring the old password before setting a new
-                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
-                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
-                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
-                        signing technologies or tokens that enable the server-side to verify the authenticity of a
-                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
-                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
-                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
-                        allowing them to prematurely enter or skip required sections of the application potentially
-                        allowing actions/transactions to be completed without successfully completing the entire
-                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
-                            order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Use periodically a static code analysis tool to analyze the code and detect potentially
-                        malicious code, such as time functions, unsafe file operations and networks connections. With
-                        the scanning of static code, we ensure the integrity of the application.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Verify that a code analysis tool is in use and it is configured to detect potentially
-                            malicious code, such as time functions, unsafe file operations and network connections.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
-                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
-                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
-                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
-                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
-                        control is critical in identifying application events (including attacks) through logging, and
-                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
-                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
-                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
-                        to detect possible situations in which the system has been compromised and give an appropriate
-                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
-                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
-                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                        &lt;li&gt;Use available features of the language or framework that allow specification of white
-                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
-                        (white list) or attr_protected (black list) macros in each class that may be used in mass
-                        assignment.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
-                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
-                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
-                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
-                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
-                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
-                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
-                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
-                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
-                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
-                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
-                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
-                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
-                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
-                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
-                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
-                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
-                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
-                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
-                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
-                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
-                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
-                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
-                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
-                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
-                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
-                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
-                        connection, using approved cryptographic algorithms.&lt;/p&gt;
-                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
-                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
-                        authentication system, most typically identified as a separate entity in a Federated
-                        authentication system. A CSP may be an independent third party, or may issue credentials for its
-                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
-                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
-                        but whose users may be subsequently authenticated to other sites, applications or services
-                        without further action on their part.&lt;/p&gt;
-                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
-                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
-                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
-                        the claimant's possession and control of one or two authenticators, using an authentication
-                        protocol.&lt;/p&gt;
-                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
-                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
-                        to process a transaction or grant access to information or a system.&lt;/p&gt;
-                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
-                        identity proofing.&lt;/p&gt;
-                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
-                        authentication protocols.&lt;/p&gt;
-                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
-                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
-                            with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
-                        two general types of encoding errors. If the byte sequence is not valid for the specified
-                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
-                        equivalent character sequence then an unmappable character has been encountered.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
-                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
-                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
-                        transmission will result in an error. Encoding and decoding errors typically result in data
-                        corruption.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;
-                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
-                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
-                        attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
-                        the source or transport method. For example, while hidden form fields, cookies or other headers
-                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
-                        forms. These can be modified by the user on the client-side in memory, or in transit on the
-                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
-                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
-                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
-                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
-                        data from the client side must be subjected to strict validation, sanitization, and encoding
-                        against expected syntactic and semantic criteria.
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
-                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
-                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
-                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
-                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
-                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
-                        non-compliant data.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
-                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
-                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
-                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
-                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
-                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
-                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
-                        server side, X- headers, and other platform specific data objects passed between the client and
-                        server.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
-                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
-                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
-                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;To test data validation:&amp;nbsp;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
-                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
-                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
-                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
-                            Fiddler, etc.).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk,
-                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
-                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
-                        the server. For example, injection of parameters into strings or cookies sent to the application
-                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
-                        logic and flow.
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
-                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
-                        the following HTTP request:&lt;/p&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
-                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
-                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
-                        whereas the actual operation used the second occurrence.&lt;/p&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
-                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
-                            the application in which those parameters are duplicated, or passed through other methods
-                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
-                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
-                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
-                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
-                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
-                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
-                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
-                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
-                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
-                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
-                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
-                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
-                        whitelisting can also be achieved by applying regular expressions. The application should only
-                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
-                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
-                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
-                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
-                            the input value which will be part of the Location header to redirect to domains which
-                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service
-                                itself.
-                                &lt;br&gt;
-                                &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
-                                still critical to the security of the product that is being created. Because the issues
-                                covered by this section are not directly related to source code, we separated it from
-                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
-                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
-                                application's functionality; particularly URL's for web-apps. In cases in which the
-                                administrator failed to specify an ACL for a particular element, an attacker may be able
-                                to access it with impunity. An attacker with the ability to access functionality not
-                                properly constrained by ACLs can obtain sensitive information and possibly compromise
-                                the entire application. Such an attacker could potentially access resources that should
-                                only be available to users of a higher privilege level, or access management sections of
-                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
-                                application and observes any stack traces produced by error messages. Fuzzing techniques
-                                involve sending random or malformed messages to a target and monitoring the target's
-                                response. The attacker does not initially know how a target will respond to individual
-                                messages but by attempting a large number of message variants they may find a variant
-                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
-                                the targeted application to return an error including a stack trace, although fuzzing a
-                                target can also sometimes cause the target to enter an unstable state, causing a crash.
-                                The stack trace enumerates the chain of methods that led up to the point where the error
-                                was encountered. This can not only reveal the names of the methods (some of which may
-                                have known weaknesses) but possibly also the location of class files and libraries as
-                                well as parameter values. In some cases, the stack trace might even disclose sensitive
-                                configuration or user information.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment,
-                                allowing developers to monitor their code regularly in order to avoid security
-                                vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
-                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
-                                Service Provider it points to, some of these services will allow unverified users to
-                                claim these sub-domains as their own.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
-                                used inside the Service Provider.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;div&gt;
-                                &lt;b&gt;Attack Scenario&lt;/b&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;ol&gt;
-                                &lt;li&gt;Your company starts using a new service, eg an external Support
-                                Ticketing-service.&lt;/li&gt;
-                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
-                                support.your-domain.com&lt;/li&gt;
-                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
-                                redirection pointing to the ticketing system.&lt;/li&gt;
-                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
-                                verification is done by the Service Provider, and the DNS-setup is already correctly
-                                setup.&lt;/li&gt;
-                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
-                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
-                                destroy business credibility for your company.&lt;/li&gt;
-                                &lt;/ol&gt;
-                                &lt;/div&gt;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
-                                returned by the service, and this code contains confidential information such as
-                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
-                                files that can be downloaded from the service could also be leveraged to gain access to
-                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
-                                attempt to bypass this order so that they can perform operations for which they are not
-                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
-                                the attackers' request, thereby reducing the resources available for legitimate services
-                                and degrading or denying services. Usually, this attack focuses on memory allocation,
-                                but any finite resource on the target could be the attacked, including bandwidth,
-                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
-                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
-                                small number of requests that are carefully formatted to force the target to allocate
-                                excessive resources to service this request(s). Often this attack takes advantage of a
-                                bug in the target to cause the target to allocate resources vastly beyond what would be
-                                needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
-                                reserved for privileged users or administrators but are exposed to use by lower or
-                                non-privileged accounts. Access to sensitive information and functionality must be
-                                controlled to ensure that only authorized users are able to access these resources. If
-                                access control mechanisms are absent or misconfigured, a user may be able to access
-                                resources that are intended only for higher level users. An adversary may be able to
-                                exploit this to utilize a less trusted account to gain information and perform
-                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
-                                attacks in that the adversary never actually escalates their privileges but instead is
-                                able to use a lesser degree of privilege to access resources that should be (but are
-                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
-                                trust or subvert systems - all control functionality is working as configured but the
-                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
-                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
-                                log audit, cover traces of attack, or perform other malicious actions. The target host
-                                is not properly controlling log access. As a result tainted data is resulting in the log
-                                files leading to a failure in accountability, non-repudiation and incident forensics
-                                capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
-                                subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
-                                resources. The attacker can supply - or modify - a URL which the code running on the
-                                server will read or submit data to, and by carefully selecting the URLs, the attacker
-                                may be able to read server configuration details such as AWS metadata, connect to
-                                internal services like http enabled databases, or perform post requests towards internal
-                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files,
-                                when the executable loads the resource (such as an image file or configuration file) the
-                                attacker has modified the file to either execute malicious code directly or manipulate
-                                the target process (e.g. application server) to execute based on the malicious
-                                configuration parameters. Since systems are increasingly interrelated mashing up
-                                resources from local and remote sources the possibility of this attack occurring is
-                                high.
-                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
-                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
-                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
-                                into the browser. Another example targets clients reading pdf files. In this case the
-                                attacker simply appends javascript to the end of a legitimate url for a pdf
-                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
-                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
-                                modified the resource and loaded executable javascript into the client's browser
-                                process.
-                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
-                                or configuration file, for example a web.xml file used to configure security permissions
-                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
-                                the public role the ability to use the administration functionality.
-                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
-                                manipulated, the attacker gains full control.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which
-                                affect the behavior of that application. For example, many applications use external
-                                configuration files and libraries - modification of these entities or otherwise
-                                affecting the application's ability to use them would constitute a
-                                configuration/environment manipulation attack.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
-                                under his control and mix it with executed code on the server side by modifying the
-                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
-                                on the code isolation, this event could grant the user access to system resources and
-                                data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
-                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
-                                the target software to generate HTML text or other potentially executable content. Many
-                                websites rely on user-generated content and dynamically build resources like files,
-                                filenames, and URL links directly from user supplied data. In this attack pattern, the
-                                attacker uploads code that can execute in the client browser and/or redirect the client
-                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
-                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static,
-                                binary format for saving to disk or transferring over a network. These objects are then
-                                deserialized when needed to recover the data/state. By injecting a malformed object into
-                                a vulnerable application, an adversary can potentially compromise the application by
-                                manipulating the deserialization process. This can result in a number of unwanted
-                                outcomes, including remote code execution.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
-                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
-                                execute the malicious action against some third-party application. If successful, the
-                                action embedded in the malicious link will be processed and accepted by the targeted
-                                application with the users' privilege level.
-                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
-                                user session cookies by many web applications today. In such an architecture, once the
-                                user authenticates to an application and a session cookie is created on the user's
-                                system, all following transactions for that session are authenticated using that cookie
-                                including potential actions initiated by an attacker and simply "riding" the existing
-                                session cookie.
-                                &lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
-                                another specified URL. By modifying this URL value to point towards a malicious site, an
-                                attacker may successfully launch a phishing scam and steal user credentials. Because the
-                                server name in the modified link is identical to the original site, phishing attempts
-                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
-                                and submitting it to applications not expecting or effective at validating this
-                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could
-                                potentially set fields on those objects that were not designed to be modified by the
-                                user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="8d190ba8-a2ab-4a3f-a437-b0440293f81f" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization
-                        and access control mechanisms in modern applications are complex and wide-spread. Even if the
-                        application implements a proper infrastructure for authorization checks, developers might forget
-                        to use these checks before accessing a sensitive object. Access control detection is not
-                        typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access
-                        can result in data disclosure to unauthorized parties, data loss, or data manipulation.
-                        Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object
-                        level authorization is an access control mechanism that is usually implemented at the code level
-                        to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every
-                        API endpoint that receives an ID of an object, and performs any type of action on the object,
-                        should implement object-level authorization checks. These checks should validate that the
-                        logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures
-                        in this mechanism typically leads to unauthorized information disclosure, modification, or
-                        destruction of data.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An
-                        API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the
-                        attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to
-                        perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits
-                        weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as
-                        authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the
-                        authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens
-                        ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text,
-                        encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The API is vulnerable to injection flaws if:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
-                        &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS
-                        commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
-                        &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated,
-                        filtered, or sanitized by the API.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br&gt;
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
-              <output/>
-            </source>
-            <references>
-              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
-              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
-              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
-              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
-                        actor without imposing any restrictions on how many resources can be allocated, in violation of
-                        the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.
-
-                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
-                        network traffic can often be sniffed by any attacker who has access to a network interface. This
-                        significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a
-                        user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an
-                        unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when
-                        an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
-                        is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but
-                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
-                        intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.259">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
-                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
-                        arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
-                        a file or directory that is located underneath a restricted parent directory, but the software
-                        does not properly neutralize special elements within the pathname that can cause the pathname to
-                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
-                        file operations are intended to take place within a restricted directory. By using special
-                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
-                        location to access files or directories that are elsewhere on the system. One of the most common
-                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
-                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
-                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
-                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
-                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
-                        truncate a generated filename to widen the scope of attack. For example, the software may add
-                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
-                        effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or
-                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
-                        "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an
-                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
-                        could modify the intended OS command when it is sent to a downstream component. This could allow
-                        attackers to execute unexpected, dangerous commands directly on the operating system. This
-                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
-                        access to the operating system, such as in web applications.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
-                        specify commands that normally would not be accessible, or to call alternate commands with
-                        privileges that the attacker does not have. The problem is exacerbated if the compromised
-                        process does not follow the principle of least privilege, because the attacker-controlled
-                        commands may run with special system privileges that increases the amount of damage.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        There are at least two subtypes of OS command injection:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
-                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
-                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
-                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
-                        from executing. However, if the program does not remove command separators from the HOSTNAME
-                        argument, attackers could place the separators into the arguments, which allows them to execute
-                        their own program after nslookup has finished executing.The application accepts an input that it
-                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
-                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
-                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
-                        execute arbitrary commands or programs. If the command is being executed using functions like
-                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
-                        in the same line. From a weakness standpoint, these variants represent distinct programmer
-                        errors.&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
-                        will be part of the arguments in the command to be executed. In the second variant, the
-                        programmer does not intend for the command to be accessible to any untrusted party, but the
-                        programmer probably has not accounted for alternate ways in which malicious attackers can
-                        provide input.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
-                        attributes, properties, or fields that are to be initialized or updated in an object, but it
-                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
-                        the object contains attributes that were only intended for internal use, then their unexpected
-                        modification could lead to a vulnerability. This weakness is sometimes known by the
-                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
-                        object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
-                        an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.879">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits
-                        important details about the event when logging it. When critical security events are not logged
-                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
-                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.031">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
-          <desc>Product A handles inputs or steps differently than Product B,
-                        which causes A to perform incorrect actions based on its perception of B's
-                        state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.614">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched
-                        systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API
-                        hosts because of modern concepts like microservices, which make applications easy to deploy and
-                        independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
-                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
-                        required security controls are implemented correctly, operating as intended, enforcing the
-                        desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.186">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
-                        immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
-                        a security decision, but it does not properly ensure that the IP address is truly associated
-                        with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.110">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
-                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
-                        expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
-                        down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in
-                        a way that is observable to an unauthorized actor, which exposes security-relevant information
-                        about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.438">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
-                        passwords, as well as sensitive information pertaining to the application and system. The source
-                        code can also be sent back to a client because of an error condition or an improperly configured
-                        handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.446">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.993">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
-                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
-                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
-                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
-                        Where there is no alternative, any user input being included must be sanitized or sandboxed
-                        before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
-                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
-                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
-                            will execute the code with the same permissions, potentially including operation system
-                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
-                            procedures that want to invoke a large number of functions, or set a large number of
-                            variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
-                        is denied. There are many ways this rule will manifest in application code. Some examples of
-                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
-                        new users/roles start with minimal or no permissions and users/roles do not receive access to
-                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
-                        an error or exception while processing access control requests. In these cases access control
-                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
-                        registers for a new account, that account should have minimal or no access by default until that
-                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
-                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
-                            every portion of the application in which a user can create information inside the database
-                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
-                            (statement of account, order details, etc.), or delete information (drop users, messages,
-                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method. Many flaws in applications result from
-                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
-                        disclosure. Use of filenames or other direct references to objects such as files on the
-                        server-side increases the risk of compromise of the system or unauthorized access to other
-                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
-                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
-                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
-                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
-                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
-                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
-                        references are used to access files from within the web-root deviating from recommended security
-                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
-                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
-                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
-                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
-                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
-                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
-                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
-                            way and if so, it should not be possible to access locations outside of this domain (i.e.
-                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
-                            etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.675">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but
-                        depending on the resource type the headers may vary. Identify the type of resource the web
-                        service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                        subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin:
-                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin:
-                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be
-                        omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data
-                        personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API
-                        endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized
-                        resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials:
-                        true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a
-                        href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods:
-                        POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...:
-                        ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers
-                        from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources
-                        that are intended for cross-origin no-cors embedding, but which don't intend to be directly
-                        legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated
-                        documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
-                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
-                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
-                        Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest,
-                        Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting
-                        Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents
-                        that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
-                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to
-                        be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
-                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
-                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
-                        that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
-                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
-                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
-                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
-                        ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
-                            properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some
-                            external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
-                            href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic
-                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
-                            href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
-                            href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just
-                            open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
-                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
-                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
-                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
-                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
-                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
-                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
-                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
-                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
-                        the usage of automated tools is detected, the application should respond by denying access and
-                        notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
-                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
-                        database records and database fields. Sensitive information can be extracted from data mining
-                        operations. When information is personally identifiable information, it may lead to
-                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
-                        data mining activities, organizations determine whether such activities are authorized.
-                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
-                        policies that address data mining requirements. Organizational personnel consult with the senior
-                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
-                        mining prevention and detection techniques include limiting the number and frequency of database
-                        queries to increase the work factor needed to determine the contents of databases, limiting
-                        types of responses provided to database queries, applying differential privacy techniques or
-                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
-                        occur. Data mining protection focuses on protecting information from data mining while such
-                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
-                        organizational information that may have been mined or otherwise obtained from data stores and
-                        is available as open-source information residing on external sites, such as social networking or
-                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
-                        threat program for deterring, detecting, and mitigating insider threats, including the
-                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
-                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
-                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
-                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
-                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
-                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
-                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
-                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
-                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or
-                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
-                        client-side actions. This can expose the application to attack through remote or local
-                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
-                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
-                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
-                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
-                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
-                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
-                            are untrusted, make sure there is a validation and sanitization mechanism before sending
-                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
-                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
-                        encryption between the client and server, terminating within a secure environment on the
-                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
-                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
-                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
-                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
-                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
-                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
-                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
-                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
-                        controllers, services, and other resources. This implies protection against spoofing and
-                        elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
-                            the database (e.g., making a payment, adding a contact, or sending a message), or can
-                            receive information (statement of account, order details, etc.), or delete information (drop
-                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
-                            to access such functions as another user in order to verify if it is possible to access a
-                            function that should not be permitted by the user's role/privilege (but might be permitted
-                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
-                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
-                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
-                            may be used in applications for:&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
-                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
-                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
-                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
-                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data
-                        sources, sometimes developers try to implement them in a generic way without thinking about the
-                        sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never
-                        rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the
-                        API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and
-                        enforce data returned by all API methods, including errors. Whenever possible: use schema's for
-                        responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all
-                        sensitive and personally identifiable information (PII) that your application stores and
-                        processes and review all API calls returning such information, to see if these responses could
-                        be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by
-                            sniffing (covertly observing) the traffic to analyze API responses, looking for any
-                            sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools
-                            usually can't detect this type of vulnerability because it's hard to differentiate between
-                            legitimate data returned from the API, and sensitive data that should not be returned
-                            without a deep understanding of the application. However, you can use a "man-in-the-middle
-                            proxy" like OWASP Zap to manually explore your application to find sensitive data in API
-                            responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your
-                            application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the
-                            Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In
-                            the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select
-                            the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore
-                            your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click
-                            the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs
-                            accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request
-                            from the left side panel and get the information via the right-side "Request" and "Response"
-                            tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.521">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
-              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
-                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
-                        applications. These HTTP methods can be used for nefarious purposes if the web server is
-                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
-                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
-                        and POST are by far the most common methods that are used to access information provided by a
-                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
-                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
-                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
-                        of these methods can potentially pose a security risk for a web application, as they allow an
-                        attacker to modify the files stored on the web server and, in some scenarios, steal the
-                        credentials of legitimate users. More specifically, the methods that should be disabled are the
-                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
-                        client to upload new files onto the web server. An attacker may exploit this by uploading
-                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
-                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
-                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
-                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
-                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
-                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
-                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
-                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
-                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
-                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
-                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
-                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
-                        DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.130">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
-                        secure deployment of the application, particularly if the application infrastructure is software
-                        defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
-                            configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
-                            (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Web server and application server configurations play a key role in the security of a web
-                        application. These servers are responsible for serving content and invoking applications that
-                        generate content. In addition, many application servers provide a number of services that web
-                        applications can use, including data storage, directory services, mail, messaging, and more.
-                        Failure to manage the proper configuration of your servers can lead to a wide variety of
-                        security problems.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Authorized administrators need to ensure the integrity of all security-relevant configurations
-                        to detect tampering.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Understanding the deployed configuration of the server hosting the web application is almost
-                            as important as the application security testing itself. After all, an application chain is
-                            only as strong as its weakest link. Application platforms are wide and varied, but some key
-                            platform configuration errors can compromise the application in the same way an unsecured
-                            application can compromise the server.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            In order to evaluate the readiness of the application platform, testing for configuration
-                            management includes the following sections:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
-                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
-                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
-                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
-                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
-                        is directly written to a log file, then this data could contain newline or other meta-characters
-                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
-                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header.
-                        Otherwise this could cause misinterpretation on the consumer/producer side and lead to code
-                        injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly
-                        check incoming Content-Type for REST services are the expected ones, such as application/xml or
-                        application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the
-                            server or not. For example: modify "content application/JSON" to "application/XML" and
-                            insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
-                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
-                        header) should be included with requests. This security header was designed to prevent
-                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
-                        fetch originates from. It doesn't include any path information, but only the server name. It is
-                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
-                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
-                        Content-Disposition response header tells the browser to download a file rather than displaying
-                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
-                        but does not specify a character set, then the browser may analyze the HTML and attempt to
-                        determine which character set it appears to be using. Even if the majority of the HTML actually
-                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
-                        in the response may cause the browser to interpret the content using a different character set.
-                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
-                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
-                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
-                        use the Origin header for authentication or access control decisions, as the Origin header can
-                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
-                        header for file downloading in all API responses with the following directives:
-                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
-                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
-                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
-                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
-                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
-                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
-                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
-                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
-                            insecure configurations; for example, when the server returns back the Origin header in the
-                            Access-Control-Allow-Origin without any additional checks AND returns
-                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
-                            that this configuration is very insecure, and is not acceptable in general terms, except in
-                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
-                            Reflected File Download input payloads to launch commands on the client machine. Reflected
-                            File Download is an attack combining URL path segments (now deprecated) with pages that
-                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
-                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
-                            popular misuse; namely, being used for encoding malicious injection strings in a way that
-                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
-                            validation filters, or take advantage of particular ways in which browsers render encoded
-                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
-                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
-                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
-                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
-                        Protections can include ensuring that DNS names used by applications are regularly checked for
-                        expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
-                            the connection to the DNS was authenticated successfully by username/password or certificate
-                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.080">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
-                        time that the application requires to function properly while minimizing the resources employed
-                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
-                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
-                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
-                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
-                        distinguishing between malicious and legitimate traffic. Many of the most common protection
-                        measures or systems focus on the network or transport layer, and as such, they would not be
-                        efficient when the target of the attack is the application layer. It is even difficult for the
-                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
-                        we have indicated, this type of attack is very specific, and generally require fewer resources
-                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
-                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
-                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
-                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
-                        application to identify "heavy" requests that are resource consuming. For example, if the web
-                        application has a search engine, an attack could be to carry out searches that require a high
-                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
-                        a challenge to the device making the network request in order to test whether or not it is a
-                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
-                        account online. By giving a requirement such as a JavaScript computational challenge, many
-                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
-                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
-                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
-                            application attack is Slowloris, which targets web servers. Verify that the implemented
-                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.950">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via
-                        configuration, and sometimes at the code level. Implementing proper checks can be a confusing
-                        task, since modern applications can contain many types of roles or groups and complex user
-                        hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your
-                        application should have a consistent and easy to analyze authorization module that is invoked
-                        from all your business functions. Frequently, such protection is provided by one or more
-                        components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement
-                        mechanism(s) should deny all access by default, requiring explicit grants to specific roles for
-                        access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level
-                        authorization flaws, while keeping in mind the business logic of the application and groups
-                        hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from
-                        an administrative abstract controller that implements authorization checks based on the user's
-                        group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller
-                        implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
-            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
-            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API
-                            endpoint that they should not have access to. These endpoints might be exposed to anonymous
-                            users or regular, non-privileged users. It's easier to discover these flaws in APIs since
-                            APIs are more structured, and the way to access certain functions is more predictable (e.g.,
-                            replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to
-                            "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't
-                            assume that an API endpoint is regular or administrative only based on the URL path. While
-                            developers might choose to expose most of the administrative endpoints under a specific
-                            relative path, like api/admins, it's very common to find these administrative endpoints
-                            under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The
-                            best way to find broken function-level authorization issues is to perform deep analysis of
-                            the authorization mechanism, while keeping in mind the user hierarchy, different roles or
-                            groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can
-                            access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive
-                            actions (e.g., creation, modification, or erasure) that they should not have access to by
-                            simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a
-                            user from group X can access a function that should be exposed only to users from group Y,
-                            by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
-              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
-                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
-                        bypass important steps in the flow. This business logic limits provide us protection against
-                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
-                        business actions or transactions that exceed the established limits, should be recorded in the
-                        logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
-                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
-                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
-                            logic perspective.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
-                        to enumerate or attempt to exploit flaws in an application, for example, sending common
-                        passwords to multiple target accounts within an application. By profiling normal traffic
-                        volumes, and applying rate limiting, the application can be built to actively mitigate such
-                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
-                        rate-limiting based on the source IP address can be used to restrict attacks against the
-                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
-                        result in temporarily blocking or dropping traffic from the source. Note however that some
-                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
-                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
-                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
-                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
-                        failures than usual), and appropriate actions taken. For example, when the application detects
-                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
-                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
-                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
-                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
-                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
-                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
-                        detects a set number of failure login attempts, the account shall be locked for a certain time
-                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
-                        the application detects an account is locked more times than usual, this account should be
-                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
-                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
-                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
-                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
-                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
-                        the user successfully authenticates, the previous failed attempts shall be reset for that user
-                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
-                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
-                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
-                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
-                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
-                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
-                            log alerting function for an unusual amount of failed login attempts, even if they
-                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out
-                        authentication strategy. An API built without protection from malicious threats through
-                        authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know
-                        all the possible flows to authenticate to the API (mobile / web / deep links that implement
-                        one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand
-                        deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and
-                        neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token
-                        generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential
-                        recovery / forget password endpoints should be treated as login endpoints in terms of brute
-                        force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication
-                        Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement
-                        anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force
-                        attacks on your authentication endpoints. This mechanism should be stricter than the regular
-                        rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha
-                        mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API
-                        keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the
-                            authentication process works and using that information to circumvent the authentication
-                            mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are
-                            transferred via an encrypted channel (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test
-                            for default credentials of common applications (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt
-                            an invalid login by using incorrect passwords a number of times to test the account lockout
-                            mechanism's ability to mitigate brute force password guessing (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify
-                            user input parameters to gain access to protected areas without providing valid credentials
-                            (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify
-                            that the credentials are only sent during the login phase, and not sent together with every
-                            request to the application (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check
-                            that the application does not leak any sensitive data into the browser cache. In order to do
-                            that, use a proxy (such as WebScarab) and search through the server responses that belong to
-                            the session, checking that for every page which contains sensitive information, the server
-                            instructed the browser not to cache any data (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine
-                            the resistance of the application against brute force password guessing using available
-                            password dictionaries by evaluating the length, complexity, reuse and aging requirements of
-                            passwords (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try
-                            to create security questions by creating a new account or by configuring your existing
-                            account's password recovery properties, to find weak self-generated questions (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine
-                            the resistance of the passwords reset functionality against guessing or bypassing (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully
-                            test the website's primary authentication functions. This should identify how accounts are
-                            issued, created or changed and how passwords are recovered, reset, or changed. Additionally
-                            knowledge of any elevated privilege authentication and authentication protection measures
-                            should be known (&lt;a
-                            href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
-                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
-                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
-                        error handling does not give an attacker any information which can be leveraged for attacking
-                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
-                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
-                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
-                        an infrastructure for consistent error reporting proves more difficult than error handling. All
-                        exceptions should be caught as events with the severity of the error. These events will be
-                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
-                        corresponding error or system message in a consistent manner, depending on the severity of the
-                        error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
-                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
-                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and
-                        hierarchy. Object-level authorization checks should be considered in every function that
-                        accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor
-                        not using an ID that has been sent from the client, but instead use an ID that is stored in the
-                        session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an
-                        authorization mechanism to check if the logged-in user has access to perform the requested
-                        action on the record in every function that uses an input from the client to access a record in
-                        the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write
-                        tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these
-                        tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used
-                            to reference objects directly. For example, locations where user input is used to access a
-                            database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the
-                            parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess
-                            whether it is possible to retrieve objects belonging to other users or otherwise bypass
-                            authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
-              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
-                        However, proper logging practices can provide the crucial forensics needed to investigate after
-                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
-                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
-                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
-                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
-                        should be written using a format suited to be consumed by a log management solution, and include
-                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
-                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
-                        a monitoring system to continuously monitor the infrastructure, network, and the API
-                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
-                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
-                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
-                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
-                            confirm that the organization's logging policies, processes, and procedures are being
-                            followed properly both at the infrastructure level and the system level throughout the
-                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
-                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
-                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
-                            or others performing testing and validation can review the logging configuration and
-                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
-                            representative sampling of systems and infrastructure servers to ensure that they comply
-                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
-                            the direction of auditors) or others performing testing and validation can create security
-                            events on a representative sampling of systems through vulnerability scanning, penetration
-                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
-                            log data those activities should generate exist and are handled according to the
-                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.811">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
-                        little computational effort) force the server to expend relatively large computational work. If
-                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
-                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
-                        availability by sending unintelligible data. In a variation of this attack, an attacker
-                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
-                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
-                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
-                        the application traffic for signs of attack traffic or violations of policy at an application
-                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
-                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
-                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
-                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
-                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            and the options you should use will depend greatly on your testing requirements. Below are
-                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
-                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
-                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
-                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
-                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
-                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
-                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
-                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
-                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.950">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining,
-                        upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks
-                        and performance attributes). The asset inventory makes up the first part of a chain in many risk
-                        management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory
-                        all API hosts and document important aspects of each one of them, focusing on the API
-                        environment (e.g., production, staging, test, development), who should have network access to
-                        the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory
-                        integrated services and document important aspects such as their role in the system, what data
-                        is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your
-                        API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing
-                        (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate
-                        documentation automatically by adopting open standards. Include the documentation build in your
-                        CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use
-                        the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for
-                        all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid
-                        using production data with non-production API deployments. If this is unavoidable, these
-                        endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When
-                        newer versions of APIs include security improvements, perform risk analysis to make the decision
-                        of the mitigation actions required for the older versions: for example, whether it is possible
-                        to backport the improvements without breaking API compatibility, or simply take the older
-                        versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Make sure the API host inventory and API documentation are updated and available to
-                            stakeholders. To check the validity of this documentation you can use an active/passive
-                            discovery tool to identify undocumented API hosts or endpoints.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
-              <output/>
-            </source>
-            <references>
-              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
-                        files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Data validation failures, together with access control violations, are symptomatic of malicious
-                        activity where an attacker is attempting to subvert the protections in place. It is therefore
-                        likely that unexpected input detected by the application relates to an attack. Rejecting and
-                        logging such activity, and ideally terminating the session, increases the likelihood of
-                        detecting and inhibiting structured attacks against the application.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
-                        the logs and subsequent access to them.&lt;/li&gt;
-                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
-                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
-                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
-                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
-                            relating to the event must be carefully sanitized and encoded; by definition the data could
-                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
-                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
-                        etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
-                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
-                            there is no company policy, check that at least the following data is included: timestamp
-                            event, status, error codes, service/command/application username or system account
-                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
-                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
-                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
-                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be
-                        precise enough to know who changed what and when). This includes data access from the
-                        application as well as data access from privileged accounts, such as database admins. In
-                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
-                            administrators and malicious actors.&lt;/li&gt;
-                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
-                            sufficiently detailed.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.811">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
-                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
-                        control and restrict access to the source. Application services may unexpectedly expose code,
-                        for example a service providing files to a user could be manipulated to access source code if
-                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
-                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
-                        configuration files are not downloadable directly from the service, and cannot be read and
-                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
-                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
-                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
-                            handlers which manage the source code interpretation before sending it to the client. If
-                            those handlers are not properly configured, the plain source code could be sent as a
-                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
-                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
-                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
-                        web site, email, blog, instant message, or program causes a user's web browser to perform an
-                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
-                        browser requests automatically include any credentials associated with the site, such as the
-                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
-                        site cannot distinguish between the forged or legitimate request sent by the victim. A
-                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
-                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
-                        re-authentication of sensitive functions is an effective way to protect your application against
-                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
-                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
-                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
-                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
-                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
-                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
-                        the server-side is problematic, an alternative defense is to use the double-submit cookie
-                        technique. This technique is easy to implement and is stateless. In this technique, a random
-                        value is sent in both a cookie and as a request parameter, with the server verifying if the
-                        cookie value and request value match. When a user visits (even before authenticating to prevent
-                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
-                        it as a cookie on the user's machine separate from the session identifier. The site then
-                        requires that every transaction request include this pseudo-random value as a hidden form value
-                        (or other request parameter/header). If both of them match on the server-side, the server
-                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
-                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
-                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
-                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
-                        determining the origin the request is going to (target origin). On the server-side verify if
-                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
-                        origin request) and if they don't, discard the request (meaning that the request originated from
-                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
-                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
-                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
-                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
-                            request and server response, and verify a unique strong token is being sent and verified
-                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
-                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
-                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
-                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
-                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
-                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
-                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
-                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
-                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
-                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
-                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
-                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
-                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
-                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
-                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
-                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
-                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
-                        or using hardware then this configuration may not be enough. The configuration will also cause
-                        denial of service to other users when under attack even from single source, as we are limiting
-                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
-                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
-                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
-                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
-                        block outgoing connections but we do not want it to become channel from where people start
-                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
-                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
-                        disabling the ICMP functionality of the targeted router, computer or other device. A network
-                        administrator can access the administrative interface of the device and disable its ability to
-                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
-                        request and the Echo Reply. The consequence of this is that all network activities that involve
-                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
-                        other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
-                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.951">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
-                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
-                        This may include elevating privileges or accessing sensitive data and functionality, such as
-                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
-                        critical functions and sensitive data should be further protected from attack using a risk-based
-                        authentication model requiring re-authentication via multi-factor authentication, or use of a
-                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
-                        re-authentication on key functions (such as requiring the old password before setting a new
-                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
-                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
-                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
-                        signing technologies or tokens that enable the server-side to verify the authenticity of a
-                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
-                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
-                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
-                        allowing them to prematurely enter or skip required sections of the application potentially
-                        allowing actions/transactions to be completed without successfully completing the entire
-                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
-                            order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Use periodically a static code analysis tool to analyze the code and detect potentially
-                        malicious code, such as time functions, unsafe file operations and networks connections. With
-                        the scanning of static code, we ensure the integrity of the application.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Verify that a code analysis tool is in use and it is configured to detect potentially
-                            malicious code, such as time functions, unsafe file operations and network connections.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.162">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to
-                        trick error-free programs, which follow best practices, into leaking their secrets. In fact, the
-                        safety checks of said best practices actually increase the attack surface and may make
-                        applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce
-                        potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to
-                        respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to
-                        the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict
-                        attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin
-                        resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when
-                        necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as
-                        a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or
-                        CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder,
-                        for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle
-                        to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case,
-                        you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or
-                        unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion
-                        attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read
-                        blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and
-                        globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
-                            properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.413">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
-                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
-                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
-                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
-                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
-                        control is critical in identifying application events (including attacks) through logging, and
-                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
-                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
-                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
-                        to detect possible situations in which the system has been compromised and give an appropriate
-                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
-                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
-                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
-                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                        &lt;li&gt;Use available features of the language or framework that allow specification of white
-                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
-                        (white list) or attr_protected (black list) macros in each class that may be used in mass
-                        assignment.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
-                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
-                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
-                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
-                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
-                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
-                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
-                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
-                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
-                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
-                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
-                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
-                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
-                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
-                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
-                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
-                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
-                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
-                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
-                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
-                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
-                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
-                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
-                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
-                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
-                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
-                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
-                            implemented availability protection is effective. One useful tool to execute this kind of
-                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
-                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
-                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
-                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
-                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
-                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.951">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
-                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
-                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
-                        connection, using approved cryptographic algorithms.&lt;/p&gt;
-                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
-                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
-                        authentication system, most typically identified as a separate entity in a Federated
-                        authentication system. A CSP may be an independent third party, or may issue credentials for its
-                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
-                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
-                        but whose users may be subsequently authenticated to other sites, applications or services
-                        without further action on their part.&lt;/p&gt;
-                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
-                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
-                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
-                        the claimant's possession and control of one or two authenticators, using an authentication
-                        protocol.&lt;/p&gt;
-                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
-                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
-                        to process a transaction or grant access to information or a system.&lt;/p&gt;
-                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
-                        identity proofing.&lt;/p&gt;
-                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
-                        authentication protocols.&lt;/p&gt;
-                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
-                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
-                            with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
-                        two general types of encoding errors. If the byte sequence is not valid for the specified
-                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
-                        equivalent character sequence then an unmappable character has been encountered.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
-                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
-                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
-                        transmission will result in an error. Encoding and decoding errors typically result in data
-                        corruption.&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation&lt;/b&gt;
-                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
-                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
-                        attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.132">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
-                        the source or transport method. For example, while hidden form fields, cookies or other headers
-                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
-                        forms. These can be modified by the user on the client-side in memory, or in transit on the
-                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
-                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
-                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
-                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
-                        data from the client side must be subjected to strict validation, sanitization, and encoding
-                        against expected syntactic and semantic criteria.
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
-                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
-                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
-                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
-                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
-                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
-                        non-compliant data.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
-                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
-                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
-                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
-                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
-                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
-                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
-                        server side, X- headers, and other platform specific data objects passed between the client and
-                        server.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
-                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
-                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
-                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;To test data validation:&amp;nbsp;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
-                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
-                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
-                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
-                            Fiddler, etc.).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk,
-                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
-                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
-                        the server. For example, injection of parameters into strings or cookies sent to the application
-                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
-                        logic and flow.
-                        &lt;div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
-                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
-                        the following HTTP request:&lt;/p&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
-                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
-                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
-                        whereas the actual operation used the second occurrence.&lt;/p&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
-                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
-                            the application in which those parameters are duplicated, or passed through other methods
-                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
-                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
-                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
-                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
-                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
-                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
-                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
-                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
-                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
-                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
-                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
-                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
-                        whitelisting can also be achieved by applying regular expressions. The application should only
-                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
-                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
-                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
-                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
-                            the input value which will be part of the Location header to redirect to domains which
-                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer
-                                software through black box analysis techniques. 'Black Box' methods involve interacting
-                                with the software indirectly, in the absence of direct access to the executable object.
-                                Such analysis typically involves interacting with the software at the boundaries of
-                                where the software interfaces with a larger execution environment, such as input-output
-                                vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sniff-api-responses" name="Attackers sniff the traffic to analyze API responses, looking for sensitive data" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is
-                                usually performed by sniffing (covertly observing) the traffic to analyze API responses,
-                                looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The
-                                API may return sensitive data to the client by design. This data is usually filtered on
-                                the client side before being presented to the user. An attacker could potentially sniff
-                                this traffic and see the sensitive data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="review-api-responses" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="review-api-responses" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and
-                                security engineers might have misconceptions about the boundaries of authentication and
-                                how to implement it correctly. In addition, the authentication mechanism is a prime
-                                target for attackers, since it's exposed to everyone. These two points make the
-                                authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
-                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-authentication">
-                  <countermeasures>
-                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
-          <threats>
-            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken
-                                object-level authorization by manipulating the ID of an object that is sent within the
-                                request. This may lead to unauthorized access to sensitive data. This issue is extremely
-                                common in API-based applications because the server component usually does not fully
-                                track the client's state, and instead, relies more on parameters like object IDs, that
-                                are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
-                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-285">
-                  <countermeasures>
-                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-object-level-authorization">
-                  <countermeasures>
-                    <countermeasure ref="object-level-authorization" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                <countermeasure ref="object-level-authorization" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service
-                                itself.
-                                &lt;br&gt;
-                                &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
-                                still critical to the security of the product that is being created. Because the issues
-                                covered by this section are not directly related to source code, we separated it from
-                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
-                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
-                                application's functionality; particularly URL's for web-apps. In cases in which the
-                                administrator failed to specify an ACL for a particular element, an attacker may be able
-                                to access it with impunity. An attacker with the ability to access functionality not
-                                properly constrained by ACLs can obtain sensitive information and possibly compromise
-                                the entire application. Such an attacker could potentially access resources that should
-                                only be available to users of a higher privilege level, or access management sections of
-                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
-                                application and observes any stack traces produced by error messages. Fuzzing techniques
-                                involve sending random or malformed messages to a target and monitoring the target's
-                                response. The attacker does not initially know how a target will respond to individual
-                                messages but by attempting a large number of message variants they may find a variant
-                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
-                                the targeted application to return an error including a stack trace, although fuzzing a
-                                target can also sometimes cause the target to enter an unstable state, causing a crash.
-                                The stack trace enumerates the chain of methods that led up to the point where the error
-                                was encountered. This can not only reveal the names of the methods (some of which may
-                                have known weaknesses) but possibly also the location of class files and libraries as
-                                well as parameter values. In some cases, the stack trace might even disclose sensitive
-                                configuration or user information.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment,
-                                allowing developers to monitor their code regularly in order to avoid security
-                                vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
-                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
-                                Service Provider it points to, some of these services will allow unverified users to
-                                claim these sub-domains as their own.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
-                                used inside the Service Provider.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;div&gt;
-                                &lt;b&gt;Attack Scenario&lt;/b&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;ol&gt;
-                                &lt;li&gt;Your company starts using a new service, eg an external Support
-                                Ticketing-service.&lt;/li&gt;
-                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
-                                support.your-domain.com&lt;/li&gt;
-                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
-                                redirection pointing to the ticketing system.&lt;/li&gt;
-                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
-                                verification is done by the Service Provider, and the DNS-setup is already correctly
-                                setup.&lt;/li&gt;
-                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
-                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
-                                destroy business credibility for your company.&lt;/li&gt;
-                                &lt;/ol&gt;
-                                &lt;/div&gt;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
-                                returned by the service, and this code contains confidential information such as
-                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
-                                files that can be downloaded from the service could also be leveraged to gain access to
-                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
-                                attempt to bypass this order so that they can perform operations for which they are not
-                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
-                                the attackers' request, thereby reducing the resources available for legitimate services
-                                and degrading or denying services. Usually, this attack focuses on memory allocation,
-                                but any finite resource on the target could be the attacked, including bandwidth,
-                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
-                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
-                                small number of requests that are carefully formatted to force the target to allocate
-                                excessive resources to service this request(s). Often this attack takes advantage of a
-                                bug in the target to cause the target to allocate resources vastly beyond what would be
-                                needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
-                                reserved for privileged users or administrators but are exposed to use by lower or
-                                non-privileged accounts. Access to sensitive information and functionality must be
-                                controlled to ensure that only authorized users are able to access these resources. If
-                                access control mechanisms are absent or misconfigured, a user may be able to access
-                                resources that are intended only for higher level users. An adversary may be able to
-                                exploit this to utilize a less trusted account to gain information and perform
-                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
-                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
-                                attacks in that the adversary never actually escalates their privileges but instead is
-                                able to use a lesser degree of privilege to access resources that should be (but are
-                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
-                                trust or subvert systems - all control functionality is working as configured but the
-                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
-                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
-                                log audit, cover traces of attack, or perform other malicious actions. The target host
-                                is not properly controlling log access. As a result tainted data is resulting in the log
-                                files leading to a failure in accountability, non-repudiation and incident forensics
-                                capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
-                                subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
-                                resources. The attacker can supply - or modify - a URL which the code running on the
-                                server will read or submit data to, and by carefully selecting the URLs, the attacker
-                                may be able to read server configuration details such as AWS metadata, connect to
-                                internal services like http enabled databases, or perform post requests towards internal
-                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files,
-                                when the executable loads the resource (such as an image file or configuration file) the
-                                attacker has modified the file to either execute malicious code directly or manipulate
-                                the target process (e.g. application server) to execute based on the malicious
-                                configuration parameters. Since systems are increasingly interrelated mashing up
-                                resources from local and remote sources the possibility of this attack occurring is
-                                high.
-                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
-                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
-                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
-                                into the browser. Another example targets clients reading pdf files. In this case the
-                                attacker simply appends javascript to the end of a legitimate url for a pdf
-                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
-                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
-                                modified the resource and loaded executable javascript into the client's browser
-                                process.
-                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
-                                or configuration file, for example a web.xml file used to configure security permissions
-                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
-                                the public role the ability to use the administration functionality.
-                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
-                                manipulated, the attacker gains full control.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which
-                                affect the behavior of that application. For example, many applications use external
-                                configuration files and libraries - modification of these entities or otherwise
-                                affecting the application's ability to use them would constitute a
-                                configuration/environment manipulation attack.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
-                                under his control and mix it with executed code on the server side by modifying the
-                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
-                                on the code isolation, this event could grant the user access to system resources and
-                                data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
-                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
-                                the target software to generate HTML text or other potentially executable content. Many
-                                websites rely on user-generated content and dynamically build resources like files,
-                                filenames, and URL links directly from user supplied data. In this attack pattern, the
-                                attacker uploads code that can execute in the client browser and/or redirect the client
-                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
-                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static,
-                                binary format for saving to disk or transferring over a network. These objects are then
-                                deserialized when needed to recover the data/state. By injecting a malformed object into
-                                a vulnerable application, an adversary can potentially compromise the application by
-                                manipulating the deserialization process. This can result in a number of unwanted
-                                outcomes, including remote code execution.
-                                &lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
-                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
-                                execute the malicious action against some third-party application. If successful, the
-                                action embedded in the malicious link will be processed and accepted by the targeted
-                                application with the users' privilege level.
-                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
-                                user session cookies by many web applications today. In such an architecture, once the
-                                user authenticates to an application and a session cookie is created on the user's
-                                system, all following transactions for that session are authenticated using that cookie
-                                including potential actions initiated by an attacker and simply "riding" the existing
-                                session cookie.
-                                &lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
-                                another specified URL. By modifying this URL value to point towards a malicious site, an
-                                attacker may successfully launch a phishing scam and steal user credentials. Because the
-                                server name in the modified link is identical to the original site, phishing attempts
-                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
-                                and submitting it to applications not expecting or effective at validating this
-                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL
-                                queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover
-                                when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection
-                                exploits can lead to information disclosure and data loss. It could also lead to DoS, or
-                                complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
-                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="api-vulnerable-injection">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted
-                                differently by intermediaries than it is by the target browser. To achieve this takes
-                                advantage of inconsistent or incorrect interpretations of the HTTP protocol by various
-                                applications. For example, using different block terminating characters (CR or LF
-                                alone), adding duplicate header fields that browsers interpret as belonging to separate
-                                responses, or other techniques. Consequences of this attack can include
-                                response-splitting, cross-site scripting, defacement, cache poisoning, or similar
-                                actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-436">
-                  <countermeasures>
-                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="rest-content-type-val" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                Old API versions are usually unpatched and are an easy way to compromise systems without
-                                having to fight state-of-the-art security mechanisms, which might be in place to protect
-                                the most recent API versions.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br&gt;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-assets-inventory">
-                  <countermeasures>
-                    <countermeasure ref="inventory-api" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="inventory-api" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could
-                                potentially set fields on those objects that were not designed to be modified by the
-                                user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="4dcfce29-0282-4abd-8b6e-67650ff2c4d5" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
-                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
-                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
-                            least privilege.&lt;/li&gt;
-                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;div&gt;
-                            &lt;/div&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:50.190">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Resources in the same VNet are compromised because when one of them is attacked and the
-                        attackers gain access, they also gain access to all resources.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Identify the resources and the Microsoft Azure instances.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the resources are in the correct VNet.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-AZURE-SER-BUS-MSG1" name="Use Azure Private Link to enable private access to Service Bus" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="Microsoft-Azure" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Azure Private Link to enable private access to Service Bus&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Azure Private Link to enable private access to Service Bus from your virtual networks without crossing the internet.&lt;br&gt; Private access is an additional defense in depth measure to the authentication and traffic security offered by Azure services.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To integrate a Service Bus namespace with Azure Private Link, you'll need the following entities or permissions:&lt;/p&gt; 
-&lt;p&gt;- A Service Bus namespace.&lt;br&gt; - An Azure virtual network.&lt;br&gt; - A subnet in the virtual network. You can use the default subnet.&lt;br&gt; - Owner or contributor permissions for both the Service Bus namespace and the virtual network.&lt;/p&gt; 
-&lt;p&gt;Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your Service Bus namespace can be in a different region. And, Your private endpoint uses a private IP address in your virtual network.&lt;/p&gt; 
-&lt;p&gt;If you already have an existing namespace, you can create a private endpoint by following these steps:&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
-&lt;p&gt;2. In the search bar, type in Service Bus.&lt;/p&gt; 
-&lt;p&gt;3. Select the namespace from the list to which you want to add a private endpoint.&lt;/p&gt; 
-&lt;p&gt;4. On the left menu, select Networking option under Settings. By default, the Selected networks option is selected.&lt;/p&gt; 
-&lt;p&gt;Note&lt;br&gt; You see the Networking tab only for premium namespaces.&lt;/p&gt; 
-&lt;p&gt;Warning&lt;br&gt; If you don't add at least one IP firewall rule or a virtual network on this page, the namespace can be accessed over public internet (using the access key).&lt;/p&gt; 
-&lt;p&gt;If you select the All networks option, your Service Bus namespace accepts connections from any IP address (using the access key). This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.&lt;/p&gt; 
-&lt;p&gt;5. To allow access to the namespace via private endpoints, select the Private endpoint connections tab at the top of the page&lt;/p&gt; 
-&lt;p&gt;6. Select the + Private Endpoint button at the top of the page.&lt;/p&gt; 
-&lt;p&gt;7. On the Basics page, follow these steps:&lt;/p&gt; 
-&lt;p&gt;a. Select the Azure subscription in which you want to create the private endpoint.&lt;/p&gt; 
-&lt;p&gt;b. Select the resource group for the private endpoint resource.&lt;/p&gt; 
-&lt;p&gt;c. Enter a name for the private endpoint.&lt;/p&gt; 
-&lt;p&gt;d. Select a region for the private endpoint. Your private endpoint must be in the same region as your virtual network, but can be in a different region from the private link resource that you are connecting to.&lt;/p&gt; 
-&lt;p&gt;e. Select Next: Resource &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;8. On the Resource page, follow these steps:&lt;/p&gt; 
-&lt;p&gt;a. For connection method, if you select Connect to an Azure resource in my directory, follow these steps:&lt;/p&gt; 
-&lt;p&gt;i. Select the Azure subscription in which your Service Bus namespace exists.&lt;/p&gt; 
-&lt;p&gt;ii. For Resource type, Select Microsoft.ServiceBus/namespaces for the Resource type.&lt;/p&gt; 
-&lt;p&gt;iii. For Resource, select a Service Bus namespace from the drop-down list.&lt;/p&gt; 
-&lt;p&gt;iv. Confirm that the Target subresource is set to namespace.&lt;/p&gt; 
-&lt;p&gt;v. Select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;b. If you select Connect to an Azure resource by resource ID or alias, follow these steps:&lt;/p&gt; 
-&lt;p&gt;i. Enter the resource ID or alias. It can be the resource ID or alias that someone has shared with you. The easiest way to get the resource ID is to navigate to the Service Bus namespace in the Azure portal and copy the portion of URI starting from /subscriptions/. See the following image for an example.&lt;/p&gt; 
-&lt;p&gt;ii. For Target sub-resource, enter namespace. It's the type of the sub-resource that your private endpoint can access.&lt;/p&gt; 
-&lt;p&gt;iii.(optional) Enter a request message. The resource owner sees this message while managing private endpoint connection.&lt;/p&gt; 
-&lt;p&gt;iv. Then, select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;9. On the Configuration page, you select the subnet in a virtual network to where you want to deploy the private endpoint.&lt;/p&gt; 
-&lt;p&gt;a. Select a virtual network. Only virtual networks in the currently selected subscription and location are listed in the drop-down list.&lt;/p&gt; 
-&lt;p&gt;b. Select a subnet in the virtual network you selected.&lt;/p&gt; 
-&lt;p&gt;c. Select Next: Tags &amp;gt; button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;10. On the Tags page, create any tags (names and values) that you want to associate with the private endpoint resource. Then, select Review + create button at the bottom of the page.&lt;/p&gt; 
-&lt;p&gt;11. On the Review + create, review all the settings, and select Create to create the private endpoint.&lt;/p&gt; 
-&lt;p&gt;12. Confirm that the private endpoint is created. If you are the owner of the resource and had selected Connect to an Azure resource in my directory option for the Connection method, the endpoint connection should be auto-approved. If it's in the pending state, please see the Manage private endpoints using Azure portal section at Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Allow access to Azure Service Bus namespaces via private endpoints" url="https://docs.microsoft.com/en-us/azure/service-bus-messaging/private-link-service"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate that the private link connection works&lt;/p&gt;
-
-	&lt;p&gt;You should validate that resources within the virtual network of the private endpoint are connecting to your Service Bus namespace over a private IP address, and that they have the correct private DNS zone integration.&lt;/p&gt;
-
-	&lt;p&gt;First, create a Windows virtual machine in the Azure portal&lt;/p&gt;
-
-	&lt;p&gt;In the Networking tab:&lt;/p&gt;
-
-	&lt;p&gt;1. Specify Virtual network and Subnet. You must select the Virtual Network on which you deployed the private endpoint.&lt;br /&gt;
-2. Specify a public IP resource.&lt;br /&gt;
-3. For NIC network security group, select None.&lt;br /&gt;
-4 For Load balancing, select No.&lt;/p&gt;
-
-	&lt;p&gt;Connect to the VM, open the command line, and run the following command:&lt;/p&gt;
-
-	&lt;p&gt;nslookup &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;
-
-	&lt;p&gt;You should see a result that looks like the following.&lt;/p&gt;
-
-	&lt;p&gt;Non-authoritative answer:&lt;br /&gt;
-Name:    &lt;service-bus-namespace-name&gt;.privatelink.servicebus.windows.net&lt;br /&gt;
-Address:  10.0.0.4 (private IP address associated with the private endpoint)&lt;br /&gt;
-Aliases:  &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.818">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="ccumming@synopsys.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
-&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
-&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
-&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
-&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
-&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
-&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
-&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
-&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
-          </references>
-          <standards>
-            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:50.095">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="ccumming@synopsys.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-ACCESS-01">
-                  <countermeasures>
-                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
-          <threats>
-            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="Microsoft-Azure" editable="true">
-              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AZURE-VNET01">
-                  <countermeasures>
-                    <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="9819df95-566d-4144-875d-7852fbffb68c" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
-                        common that they deserve a special kingdom of their own. As with "API Abuse", there
-                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
-                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
-                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
-                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
-                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
-                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
-                        without restricting how much is copied. Other variants exist, but the existence of a classic
-                        overflow strongly suggests that the programmer is not considering even the most basic of
-                        security protections.
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
-              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product downloads source code or an executable from a remote location and executes the
-                        code without sufficiently verifying the origin and integrity of the code.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software provides an Applications Programming Interface (API) or similar interface for
-                        interaction with external actors, but the interface includes a dangerous method or function that
-                        is not properly restricted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
-                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
-                        leverage them to obtain information about the app.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
-          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
-                        attackers can leverage them to obtain information about the app.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
-
-When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.609">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application can be deployed with active debugging code that can create unintended entry
-                        points.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
-                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>For Android:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For iOS:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
-            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-          </references>
-          <standards>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
-            <reference name="OWASP MASVS - iOS - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
-          </references>
-          <standards>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the set of protocol handlers are deactivated.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.6" name="Anonymize all data that is sent to 3rd Party services" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>All data that is sent to 3rd Party services shall be anonymized, so no PII data is available that would allow the 3rd party to identify the user account. Also all other data, like IDs in an application that can be mapped to a user account or session should not be sent to a third party.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-            <reference name="OWASP MASVS - iOS - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#determining-whether-sensitive-data-is-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-          </references>
-          <standards>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all data that is sent to 3rd Party services is anonymized.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
-          </references>
-          <standards>
-            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
-            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the exceptions are well-designed and are catched and handled well.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="89" state="Implemented" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#checking-for-weaknesses-in-third-party-libraries-mstg-code-5"/>
-            <reference name="OWASP MASVS - iOS - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings"/>
-          </references>
-          <standards>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; or &lt;/span&gt; 
-&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
-&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Platform Interaction Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x11-v6-interaction_with_the_environment"/>
-          </references>
-          <standards>
-            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
-            <reference name="OWASP MASVS - iOS - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
-          </references>
-          <standards>
-            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Best Practices for Passwords" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
-&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
-&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-   &lt;li&gt; 
-    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-    &lt;/div&gt;&lt;/li&gt; 
-  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#testing-the-device-access-security-policy-mstg-storage-11"/>
-            <reference name="OWASP MASVS - iOS - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-local-data-storage-mstg-storage-1-and-mstg-storage-2"/>
-          </references>
-          <standards>
-            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app verifies the mobile device complies with the minimum
-                            device-access-security policy.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
-            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the application denies access to the session when the exceptions appear.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-javascript-execution-in-webviews-mstg-platform-5"/>
-            <reference name="OWASP MASVS - iOS - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-ios-webviews-mstg-platform-5"/>
-          </references>
-          <standards>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Search in the code the following instruction:
-                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
-                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;For iOS:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
-                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
-                            setJavaScriptEnabled:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [conf setPreferences:pref]; _webView = [[WKWebView
-                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
-                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [_webView loadRequest:request];&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            [self.view addSubview:_webView]; }
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
-          </references>
-          <standards>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the clipboard is disabled when sensitive data is used.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
-                        Android O and the behavior of MAC addresses have changed in Android N.
-
-                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
-                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
-                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
-                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
-                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
-                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
-                        they request the Build.Serial.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-device-binding-mstg-resilience-10"/>
-            <reference name="OWASP MASVS - iOS - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#device-binding-mstg-resilience-10"/>
-          </references>
-          <standards>
-            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
-                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
-                            authenticate).&lt;/li&gt;
-                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;ol&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;exit the current user&lt;/li&gt;
-                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
-                            shared-preferences&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
-                            working properly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Log Class&lt;/li&gt; 
- &lt;li&gt;Logger Class&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
-&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;NSLog Method&lt;/li&gt; 
- &lt;li&gt;printf-like function&lt;/li&gt; 
- &lt;li&gt;NSAssert-like function&lt;/li&gt; 
- &lt;li&gt;Macro&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;p&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage"/>
-            <reference name="OWASP MASVS - iOS - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage"/>
-          </references>
-          <standards>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt; 
- &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-          </references>
-          <standards>
-            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all executable files and libraries belonging to the app are encrypted or
-                            packed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.803">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that sensitive data is not stored in plain text.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
-                        including stealthy responses that don't simply terminate the app.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05c-reverse-engineering-and-tampering"/>
-            <reference name="OWASP MASVS - iOS - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06c-reverse-engineering-and-tampering"/>
-          </references>
-          <standards>
-            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the app implements multiple different responses to tampering, debugging and
-                            emulation, including stealthy responses that don't simply terminate the app.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing the Security Provider" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-the-security-provider-mstg-network-6"/>
-          </references>
-          <standards>
-            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
-&lt;ol&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ol&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
-          </references>
-          <standards>
-            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-root-detection-mstg-resilience-1"/>
-            <reference name="OWASP MASVS - iOS - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#jailbreak-detection-mstg-resilience-1"/>
-          </references>
-          <standards>
-            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
-                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.804">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
-            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
-          </references>
-          <standards>
-            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
-                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
-                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
-                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
-                        the goal of protecting against memory patches applied during runtime. This includes unwanted
-                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
-                        well as rogue code loaded into process memory.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;div&gt;
-                        Integrity can be verified either by:&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
-                        values.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
-            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
-          </references>
-          <standards>
-            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
-                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
-                            responds accordingly.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
-                        the app is running inside an emulator, the app shall terminate the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
-          </references>
-          <standards>
-            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
-                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
-                        is detected, the app shall force termination of the session.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
-            <reference name="OWASP MASVS - iOS - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
-          </references>
-          <standards>
-            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Launch the app systematically with various apps and frameworks installed, such as the
-                            following:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
-                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
-                        features can be preventive or reactive. As the name implies, preventive anti-debugging
-                        techniques prevent the debugger from attaching in the first place, while reactive techniques
-                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
-                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
-                        combine multiple methods of prevention and detection which operate on different API layers and
-                        are distributed throughout the app.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
-            <reference name="OWASP MASVS - iOS - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
-          </references>
-          <standards>
-            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
-                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
-                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
-                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
-                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
-                            or other sources);&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
-                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Remove the debugging code, log verbose errors or debugging messages in the production version.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing for Debugging Code and Verbose Error Logging" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
-          </references>
-          <standards>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
-                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
-          </references>
-          <standards>
-            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
- &lt;li&gt; 
-  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
-   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
-  &lt;/div&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether Java Objects Are Exposed Through WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#determining-whether-java-objects-are-exposed-through-webviews-mstg-platform-7"/>
-          </references>
-          <standards>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>- Produce a JavaScript payload.
-                            - Inject it into the file that the app is requesting. The injection could be done either
-                            through a MITM attack or by directly modifying the file in case it is stored on external
-                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
-                            exploitation payload) which is able to install a full agent, injecting a limited agent into
-                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
-                            - Check that only the JavaScript provided with the app is allowed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.800">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
-          </references>
-          <standards>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>As a general rule of thumb, as little explanative information as possible should be provided
-                        along with the compiled code. Some metadata such as debugging information, line numbers and
-                        descriptive function or method names make the binary or bytecode easier to understand for the
-                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
-                        discarded without impacting the functionality of the app.
-
-                        This data shall be removed from the release version or shall be obfuscated in order to be
-                        inaccessible to the reverse engineer.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
-            <reference name="OWASP MASVS - iOS - Testing for Debugging Symbols" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-symbols-mstg-code-3"/>
-          </references>
-          <standards>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Symbols are usually stripped during the build process, so you need the compiled byte-code
-                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
-                            nm binary in your Android NDK and export it (or create an alias).
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            export $NM =
-                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            To display debug symbols:
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ $NM -a
-                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
-                            libfoo.so: no symbols&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;To display dynamic symbols:
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            $ $NM -D libfoo.so&amp;nbsp;
-                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
-                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
-                            Adding this flag causes gcc to discard the function names while still preserving the names
-                            of functions declared as JNIEXPORT.&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            Check if the following was added to build.gradle:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;br /&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
-                            binutils and can be installed via Homebrew on Mac OS X.
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing App Permissions" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide"/>
-            <reference name="OWASP MASVS - iOS - Testing Custom URL Schemes" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-app-permissions-mstg-platform-1"/>
-          </references>
-          <standards>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>For Android applications:&amp;nbsp;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
-                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
-                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
-                            permissions needed by the application.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
-&lt;/div&gt; 
-&lt;div&gt;
-  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Verifying Data Encryption on the Network" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04f-testing-network-communication"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
-  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This kind of vulnerability occurs in a number of ways: 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Testing for Memory Management Bugs" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04h-testing-code-quality#memory-corruption-bugs-mstg-code-8"/>
-          </references>
-          <standards>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
-                            gain access to the system.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.787">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
-          </references>
-          <standards>
-            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
-            <reference name="OWASP MASVS - iOS - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
-          </references>
-          <standards>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the app is correctly signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Partly-Mitigate" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker attempts to invoke all common switches and options in the target
-                                application for the purpose of discovering weaknesses in the target. For example, in
-                                some applications, adding the --debug switch causes debugging information to be
-                                displayed, which can sometimes reveal sensitive processing or configuration information
-                                to an attacker.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                This attack differs from other forms of API abuse in that the attacker is blindly
-                                attempting to invoke options in the hope that one of them will work rather than
-                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
-                                with the published options of a targeted application this attack method may still be
-                                fruitful as it might discover unpublicized functionality.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-215">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-489">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-656">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MEMORY-LEAKAGE">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="OUTDATED-LIBRARIES">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-1.9" mitigation="5"/>
-                <countermeasure ref="MASVS-2.13" mitigation="5"/>
-                <countermeasure ref="MASVS-2.14" mitigation="5"/>
-                <countermeasure ref="MASVS-2.15" mitigation="5"/>
-                <countermeasure ref="MASVS-2.3" mitigation="5"/>
-                <countermeasure ref="MASVS-2.5" mitigation="5"/>
-                <countermeasure ref="MASVS-4.4" mitigation="5"/>
-                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
-                <countermeasure ref="MASVS-5.6" mitigation="5"/>
-                <countermeasure ref="MASVS-7.3" mitigation="15"/>
-                <countermeasure ref="MASVS-7.4" mitigation="5"/>
-                <countermeasure ref="MASVS-7.5" mitigation="5"/>
-                <countermeasure ref="MASVS-7.9" mitigation="5"/>
-                <countermeasure ref="MASVS-8.11" mitigation="5"/>
-                <countermeasure ref="MASVS-8.13" mitigation="5"/>
-                <countermeasure ref="MASVS-8.2" mitigation="5"/>
-                <countermeasure ref="MASVS-8.8" mitigation="5"/>
-                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-494">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.1" mitigation="34"/>
-                <countermeasure ref="MASVS-8.3" mitigation="33"/>
-                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of an object, resource,
-                                or system by using a variety of analysis techniques to effectively determine how the
-                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
-                                duplicate the function, or a part of the function, of an object in order to duplicate or
-                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
-                                or software, although the methodology and techniques involved in each type of analysis
-                                differ widely. When adversaries are reverse engineering software, methodologies fall
-                                into two broad categories, 'white box' and 'black box.' White box techniques involve
-                                methods which can be applied to a piece of software when an executable or some other
-                                compiled object can be directly subjected to analysis, revealing at least a portion of
-                                its machine instructions that can be observed upon execution.
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                'Black Box' methods involve interacting with the software indirectly, in the absence of
-                                the ability to measure, instrument, or analyze an executable object directly. Such
-                                analysis typically involves interacting with the software at the boundaries of where the
-                                software interfaces with a larger execution environment, such as input-output vectors,
-                                libraries, or APIs.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="MASVS-EMULATION-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-8.10" mitigation="20"/>
-                <countermeasure ref="MASVS-8.4" mitigation="20"/>
-                <countermeasure ref="MASVS-8.5" mitigation="20"/>
-                <countermeasure ref="MASVS-8.6" mitigation="20"/>
-                <countermeasure ref="MASVS-8.7" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>If the mobile application requests permissions or access to components that are not
-                                strictly needed by the application, then users can lose trust in the security of the
-                                application with an associated impact on the trust placed in the application provider.</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.11" mitigation="20"/>
-                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
-                <countermeasure ref="MASVS-6.1" mitigation="20"/>
-                <countermeasure ref="MASVS-8.1" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-732">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-2.6" mitigation="25"/>
-                <countermeasure ref="MASVS-4.1" mitigation="25"/>
-                <countermeasure ref="MASVS-4.12" mitigation="25"/>
-                <countermeasure ref="MASVS-4.9" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>An attacker employs forceful browsing to access portions of a website that are
-                                otherwise unreachable through direct URL entry.
-
-                                Usually, a front controller or similar design pattern is employed to protect access to
-                                portions of a web application.
-
-                                Forceful browsing enables an attacker to access information, perform privileged
-                                operations and otherwise reach sections of the web application that have been improperly
-                                protected.</desc>
-              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-749">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-83">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-6.10" mitigation="25"/>
-                <countermeasure ref="MASVS-6.5" mitigation="25"/>
-                <countermeasure ref="MASVS-6.6" mitigation="25"/>
-                <countermeasure ref="MASVS-6.7" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>Errors and error handling represent a class of API. Errors related to error handling
-                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
-                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-388">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.6" mitigation="50"/>
-                <countermeasure ref="MASVS-7.7" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
-              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
-                                operations, typically triggered by input injected by an attacker. As a consequence, an
-                                attacker is able to write past the boundaries of allocated buffer regions in memory,
-                                causing a program crash or potentially redirection of execution as per the attackers'
-                                choice.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-120">
-                  <countermeasures>
-                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="MASVS-7.8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="d43b8baa-f67a-4026-b681-b260f0ea7fa0" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.226">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an
-                        unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable
-                        user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt;
-                        &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data
-                        store. The account should not be able to perform operations that are not explicitly required by
-                        the component that performs these operations. For example, if a web application needs to read
-                        data from certain tables and insert and update data from others, then a database account with
-                        only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt;
-                            &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt;
-                            &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary
-                            permissions are assigned.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.183">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security
-                        flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known
-                        security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public
-                        domain, they get included in automated exploitation suites like Metasploit and a wider less
-                        skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply
-                        patches and other software updates in a timely manner to prevent unexpected failures or
-                        exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches,
-                        in particular security patches, with expected timescales. &amp;nbsp;There is often a small
-                        window between the release of a patch, and potentially malicious actors reverse-engineering the
-                        patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence,
-                        vulnerability scanning, or other alerting services to ensure the project team is promptly aware
-                        of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.279">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why
-                        encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries,
-                        taking into account the data use, and do not invent your own.
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-                        &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so
-                        they cannot be recovered easily&lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest
-                            (e.g. databases).&lt;/li&gt;
-                            &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining
-                            the reasoning for that decision.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification
-                        (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data.
-                        For less sensitive but still restricted data, simple verification of the location of the user
-                        may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but
-                        non-public data, access could be restricted by IP address, limiting access to internal networks,
-                        workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side
-                        certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is
-                        handled, a full authentication process to identify and validate users with single or
-                        multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Try to obtain access to this information without any type of authentication, for
-                            example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of
-                        the service and its attack surface; and the likelihood of a malicious actor gaining access to
-                        the system.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Apply network layer security controls so that only the necessary and expected IP
-                        addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the network access to the service is only allowed for the components
-                            which need it.&lt;/li&gt;
-                            &lt;li&gt;There should be a firewall protecting the network segment in which the service is
-                            installed.&lt;/li&gt;
-                            &lt;li&gt;Check that the firewall restricts all access and only permits the minimum
-                            connections required using the principal of least privilege.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the
-                                privileges of an authorized or privileged user by evading - or circumventing - an
-                                authentication mechanism. The attacker is therefore able to access protected data
-                                without authentication ever having taken place. This refers to an attacker gaining
-                                access equivalent to an authenticated user without ever going through an authentication
-                                procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected
-                                access procedure that does not go through the proper checkpoints where authentication
-                                should occur. For example, a web site might assume that all users will click through a
-                                given link in order to access secure material and simply authenticate everyone that
-                                clicks the link. However, an attacker might be able to reach secured web content by
-                                explicitly entering the path to the content rather than clicking through the
-                                authentication link, thereby avoiding the check entirely. This attack pattern differs
-                                from other authentication attacks in that attacks of this pattern avoid authentication
-                                entirely, rather than faking authentication by exploiting flaws or by stealing
-                                credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
-                                subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="abe82b73-b22d-4aa0-b368-15b292ce5587" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.049">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an
-                        unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.221">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable
-                        user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt;
-                        &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data
-                        store. The account should not be able to perform operations that are not explicitly required by
-                        the component that performs these operations. For example, if a web application needs to read
-                        data from certain tables and insert and update data from others, then a database account with
-                        only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt;
-                            &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt;
-                            &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary
-                            permissions are assigned.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.988">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security
-                        flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known
-                        security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public
-                        domain, they get included in automated exploitation suites like Metasploit and a wider less
-                        skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply
-                        patches and other software updates in a timely manner to prevent unexpected failures or
-                        exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches,
-                        in particular security patches, with expected timescales. &amp;nbsp;There is often a small
-                        window between the release of a patch, and potentially malicious actors reverse-engineering the
-                        patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence,
-                        vulnerability scanning, or other alerting services to ensure the project team is promptly aware
-                        of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why
-                        encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries,
-                        taking into account the data use, and do not invent your own.
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-                        &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so
-                        they cannot be recovered easily&lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest
-                            (e.g. databases).&lt;/li&gt;
-                            &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining
-                            the reasoning for that decision.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.114">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification
-                        (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data.
-                        For less sensitive but still restricted data, simple verification of the location of the user
-                        may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but
-                        non-public data, access could be restricted by IP address, limiting access to internal networks,
-                        workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side
-                        certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is
-                        handled, a full authentication process to identify and validate users with single or
-                        multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Try to obtain access to this information without any type of authentication, for
-                            example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of
-                        the service and its attack surface; and the likelihood of a malicious actor gaining access to
-                        the system.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Apply network layer security controls so that only the necessary and expected IP
-                        addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the network access to the service is only allowed for the components
-                            which need it.&lt;/li&gt;
-                            &lt;li&gt;There should be a firewall protecting the network segment in which the service is
-                            installed.&lt;/li&gt;
-                            &lt;li&gt;Check that the firewall restricts all access and only permits the minimum
-                            connections required using the principal of least privilege.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the
-                                privileges of an authorized or privileged user by evading - or circumventing - an
-                                authentication mechanism. The attacker is therefore able to access protected data
-                                without authentication ever having taken place. This refers to an attacker gaining
-                                access equivalent to an authenticated user without ever going through an authentication
-                                procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected
-                                access procedure that does not go through the proper checkpoints where authentication
-                                should occur. For example, a web site might assume that all users will click through a
-                                given link in order to access secure material and simply authenticate everyone that
-                                clicks the link. However, an attacker might be able to reach secured web content by
-                                explicitly entering the path to the content rather than clicking through the
-                                authentication link, thereby avoiding the check entirely. This attack pattern differs
-                                from other authentication attacks in that attacks of this pattern avoid authentication
-                                entirely, rather than faking authentication by exploiting flaws or by stealing
-                                credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
-                                subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 1a7d388bb277d6bf9bf92e988c9def5beb187bfc Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:24:12 -0400
Subject: [PATCH 23/28] Delete Templates/sap-hana-on-gcp.xml

---
 Templates/sap-hana-on-gcp.xml | 6400 ---------------------------------
 1 file changed, 6400 deletions(-)
 delete mode 100644 Templates/sap-hana-on-gcp.xml

diff --git a/Templates/sap-hana-on-gcp.xml b/Templates/sap-hana-on-gcp.xml
deleted file mode 100644
index db3a032..0000000
--- a/Templates/sap-hana-on-gcp.xml
+++ /dev/null
@@ -1,6400 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="sap-hana-on-gcp" name="SAP HANA on GCP" tags="">
-  <desc>&lt;p&gt;See https://cloud.google.com/solutions/sap/docs/architectures/sap-s4hana-on-gcp&lt;/p&gt;</desc>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTMwNSIgZHk9IjEzMDgiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS42LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iNTgiIHdpZHRoPSI1OTYiIGhlaWdodD0iNTc4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJHQ1AgVlBDIChWaXJ0dWFsIFByaXZhdGUgQ2xvdWQpIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELVZQQztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RTVORFpmTWpVME16Y3BJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMamt5T1RRMU5TQXdMalExT1RZeU5Fd3dMamMwT0RZME1pQXdMakUwTlRFMk1VTXdMamMwTVRnME15QXdMakV6TXpFd015QXdMamN6TWpBeE1TQXdMakV5TXpBeklEQXVOekl3TVRJeElEQXVNVEUxT1RNNVF6QXVOekE0TWpNeUlEQXVNVEE0T0RRNUlEQXVOamswTmprMklEQXVNVEEwT1RnM0lEQXVOamd3T0RVMUlEQXVNVEEwTnpNMlNEQXVNekU1TVRZeFF6QXVNekExTXpFNElEQXVNVEEwT1RnZ01DNHlPVEUzT0NBd0xqRXdPRGd6T1NBd0xqSTNPVGc0T1NBd0xqRXhOVGt6UXpBdU1qWTNPVGs0SURBdU1USXpNREl4SURBdU1qVTRNVFk0SURBdU1UTXpNRGs0SURBdU1qVXhNemMwSURBdU1UUTFNVFl4VERBdU1EY3dORGt5TXlBd0xqUTFPRGM1T1VNd0xqQTJNell4TmpFZ01DNDBOekEzTmpRZ01DNHdOVGs1T1RjMklEQXVORGcwTXpJeklEQXVNRFU1T1RrM05pQXdMalE1T0RFeU5FTXdMakExT1RrNU56WWdNQzQxTVRFNU1qUWdNQzR3TmpNMk1UWXhJREF1TlRJMU5EZ3pJREF1TURjd05Ea3lNeUF3TGpVek56UTBPVXd3TGpJMU1UTXdOU0F3TGpnMU16WTVPVU13TGpJMU9EQXpNaUF3TGpnMk5Ua3pNeUF3TGpJMk56Z3hJREF1T0RjMk1qRTRJREF1TWpjNU5qZzRJREF1T0Rnek5UVTBRekF1TWpreE5UWTNJREF1T0Rrd09Ea3hJREF1TXpBMU1UUXhJREF1T0RrMU1ESTVJREF1TXpFNU1Ea3lJREF1T0RrMU5UWTRTREF1Tmpnd056ZzJRekF1TmprME56TTFJREF1T0RrMU1EZzVJREF1TnpBNE16SXhJREF1T0Rrd09UazRJREF1TnpJd01qRTFJREF1T0Rnek5qazFRekF1TnpNeU1UQTVJREF1T0RjMk16a3lJREF1TnpReE9UQTBJREF1T0RZMk1USTRJREF1TnpRNE5qUXlJREF1T0RVek9UQTFUREF1T1RJNU5EVTFJREF1TlRNNU5EUXpRekF1T1RNMk16Z3hJREF1TlRJM01qZ3lJREF1T1RRd01ESXlJREF1TlRFek5USTRJREF1T1RRd01ESXlJREF1TkRrNU5UTXpRekF1T1RRd01ESXlJREF1TkRnMU5UTTRJREF1T1RNMk16Z3hJREF1TkRjeE56ZzFJREF1T1RJNU5EVTFJREF1TkRVNU5qSTBWakF1TkRVNU5qSTBXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU5qWXlOVEEySURBdU16TTNNVFU0VERBdU5URTROelE1SURBdU5EQTJNalV5VERBdU5EUTVPVGs1SURBdU16TTNOVEF5VERBdU16TTNOall5SURBdU5EVXdNemc1VERBdU5ERXlORFl5SURBdU5USTFNVGc1VERBdU16TTNOVEkwSURBdU5qWXlOamc1VERBdU5UY3dORFE1SURBdU9EazFOREE0U0RBdU5qZ3dOemt6UXpBdU5qazBOelF5SURBdU9EazBPVEk1SURBdU56QTRNekk0SURBdU9Ea3dPRE01SURBdU56SXdNakl5SURBdU9EZ3pOVE0yUXpBdU56TXlNVEUySURBdU9EYzJNak16SURBdU56UXhPVEV4SURBdU9EWTFPVFk0SURBdU56UTROalE1SURBdU9EVXpOelEyVERBdU9UQTFOakEySURBdU5UZ3dORFkwVERBdU5qWXlOVEEySURBdU16TTNNVFU0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF4TnpRNU15QXdMalF6TkRneE5FZ3dMak00TXpFeE9GWXdMalUyT0RnM04wZ3dMalF4TnpRNU0xWXdMalF6TkRneE5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1UWTRNek1nTUM0ME1UZzBOVGRJTUM0MU9ESTBOVGhXTUM0MU5qZzBOamxJTUM0Mk1UWTRNek5XTUM0ME1UZzBOVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFkyTVRJeElEQXVNemd6TXpBeFNEQXVORE16TnpjM1ZqQXVOREUzTmpjMlNEQXVOVFkyTVRJeFZqQXVNemd6TXpBeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk5qRXlNU0F3TGpVNE1qVXlTREF1TkRNek56YzNWakF1TmpFMk9EazBTREF1TlRZMk1USXhWakF1TlRneU5USmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EUTBPVFl4SURBdU16TTFNakExU0RBdU16UXhPRE0yUXpBdU16TTRNRE01SURBdU16TTFNakExSURBdU16TTBPVFl4SURBdU16TTRNamd6SURBdU16TTBPVFl4SURBdU16UXlNRGhXTUM0ME5EVXlNRFZETUM0ek16UTVOakVnTUM0ME5Ea3dNRElnTUM0ek16Z3dNemtnTUM0ME5USXdPQ0F3TGpNME1UZ3pOaUF3TGpRMU1qQTRTREF1TkRRME9UWXhRekF1TkRRNE56VTRJREF1TkRVeU1EZ2dNQzQwTlRFNE16WWdNQzQwTkRrd01ESWdNQzQwTlRFNE16WWdNQzQwTkRVeU1EVldNQzR6TkRJd09FTXdMalExTVRnek5pQXdMak16T0RJNE15QXdMalEwT0RjMU9DQXdMak16TlRJd05TQXdMalEwTkRrMk1TQXdMak16TlRJd05Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5UZ3dNelVnTUM0ek16VXlNRFZJTUM0MU5UUTVNVU13TGpVMU1URXhNeUF3TGpNek5USXdOU0F3TGpVME9EQXpOU0F3TGpNek9ESTRNeUF3TGpVME9EQXpOU0F3TGpNME1qQTRWakF1TkRRMU1qQTFRekF1TlRRNE1ETTFJREF1TkRRNU1EQXlJREF1TlRVeE1URXpJREF1TkRVeU1EZ2dNQzQxTlRRNU1TQXdMalExTWpBNFNEQXVOalU0TURNMVF6QXVOall4T0RNeUlEQXVORFV5TURnZ01DNDJOalE1TVNBd0xqUTBPVEF3TWlBd0xqWTJORGt4SURBdU5EUTFNakExVmpBdU16UXlNRGhETUM0Mk5qUTVNU0F3TGpNek9ESTRNeUF3TGpZMk1UZ3pNaUF3TGpNek5USXdOU0F3TGpZMU9EQXpOU0F3TGpNek5USXdOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBORFE1TmpFZ01DNDFORGd6TkVnd0xqTTBNVGd6TmtNd0xqTXpPREF6T1NBd0xqVTBPRE0wSURBdU16TTBPVFl4SURBdU5UVXhOREU0SURBdU16TTBPVFl4SURBdU5UVTFNakUxVmpBdU5qVTRNelJETUM0ek16UTVOakVnTUM0Mk5qSXhNemNnTUM0ek16Z3dNemtnTUM0Mk5qVXlNVFVnTUM0ek5ERTRNellnTUM0Mk5qVXlNVFZJTUM0ME5EUTVOakZETUM0ME5EZzNOVGdnTUM0Mk5qVXlNVFVnTUM0ME5URTRNellnTUM0Mk5qSXhNemNnTUM0ME5URTRNellnTUM0Mk5UZ3pORll3TGpVMU5USXhOVU13TGpRMU1UZ3pOaUF3TGpVMU1UUXhPQ0F3TGpRME9EYzFPQ0F3TGpVME9ETTBJREF1TkRRME9UWXhJREF1TlRRNE16UmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qVTRNRE0xSURBdU5UUTRNelJJTUM0MU5UUTVNVU13TGpVMU1URXhNeUF3TGpVME9ETTBJREF1TlRRNE1ETTFJREF1TlRVeE5ERTRJREF1TlRRNE1ETTFJREF1TlRVMU1qRTFWakF1TmpVNE16UkRNQzQxTkRnd016VWdNQzQyTmpJeE16Y2dNQzQxTlRFeE1UTWdNQzQyTmpVeU1UVWdNQzQxTlRRNU1TQXdMalkyTlRJeE5VZ3dMalkxT0RBek5VTXdMalkyTVRnek1pQXdMalkyTlRJeE5TQXdMalkyTkRreElEQXVOall5TVRNM0lEQXVOalkwT1RFZ01DNDJOVGd6TkZZd0xqVTFOVEl4TlVNd0xqWTJORGt4SURBdU5UVXhOREU0SURBdU5qWXhPRE15SURBdU5UUTRNelFnTUM0Mk5UZ3dNelVnTUM0MU5EZ3pORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVGswTmw4eU5UUXpOeUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9DSWdhR1ZwWjJoMFBTSXdMamc0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05UazVPVGMySURBdU1EWXdNRFU0TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YzRkNjNmZjEtOWJmZS00MThmLWJhNmQtMWQ4M2JjOWJkYmQ1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUdPT0dMRS1DTE9VRC1WUEM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxOSIgeT0iMjYiIHdpZHRoPSI1NTUiIGhlaWdodD0iNTI2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IlB1YmxpYyIgc3R5bGU9ImlyLnJlZj02Mzc2ZDUzZS02NDYxLTQxMmItOGUwNC03YjNmZTJiMzk3ZGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYiIHk9IjMwIiB3aWR0aD0iMjUyIiBoZWlnaHQ9IjQ2MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQmFzdGlvbiBTZXJ2ZXIiIGlkPSIxMiI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELUNPTVBVVEUtRU5HSU5FO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpJek5EaGZNak14TURBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVFl5TkV3d0xqYzBPRGN3TXlBd0xqRTBOVEUyTVVNd0xqYzBNVGt3TkNBd0xqRXpNekV3TXlBd0xqY3pNakEzTWlBd0xqRXlNekF6SURBdU56SXdNVGd5SURBdU1URTFPVE01UXpBdU56QTRNamt6SURBdU1UQTRPRFE1SURBdU5qazBOelUzSURBdU1UQTBPVGczSURBdU5qZ3dPVEUySURBdU1UQTBOek0yU0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBPVGdnTUM0eU9URTROREVnTUM0eE1EZzRNemtnTUM0eU56azVOU0F3TGpFeE5Ua3pRekF1TWpZNE1EVTVJREF1TVRJek1ESXhJREF1TWpVNE1qSTVJREF1TVRNek1EazRJREF1TWpVeE5ETTFJREF1TVRRMU1UWXhUREF1TURjd05UVXpNeUF3TGpRMU9EYzVPVU13TGpBMk16WTNOeklnTUM0ME56QTNOalFnTUM0d05qQXdOVGcySURBdU5EZzBNekl6SURBdU1EWXdNRFU0TmlBd0xqUTVPREV5TkVNd0xqQTJNREExT0RZZ01DNDFNVEU1TWpRZ01DNHdOak0yTnpjeUlEQXVOVEkxTkRneklEQXVNRGN3TlRVek15QXdMalV6TnpRME9Vd3dMakkxTVRNMk5pQXdMamcxTXpZNU9VTXdMakkxT0RBNU15QXdMamcyTlRrek15QXdMakkyTnpnM01TQXdMamczTmpJeE9DQXdMakkzT1RjME9TQXdMamc0TXpVMU5FTXdMakk1TVRZeU9DQXdMamc1TURnNU1TQXdMak13TlRJd01pQXdMamc1TlRBeU9TQXdMak14T1RFMU15QXdMamc1TlRVMk9FZ3dMalk0TURnME4wTXdMalk1TkRjNU5pQXdMamc1TlRBNE9TQXdMamN3T0RNNE1pQXdMamc1TURrNU9DQXdMamN5TURJM05pQXdMamc0TXpZNU5VTXdMamN6TWpFM0lEQXVPRGMyTXpreUlEQXVOelF4T1RZMUlEQXVPRFkyTVRJNElEQXVOelE0TnpBeklEQXVPRFV6T1RBMVREQXVPVEk1TlRFMklEQXVOVE01TkRRelF6QXVPVE0yTkRReUlEQXVOVEkzTWpneUlEQXVPVFF3TURnMElEQXVOVEV6TlRJNElEQXVPVFF3TURnMElEQXVORGs1TlRNelF6QXVPVFF3TURnMElEQXVORGcxTlRNNElEQXVPVE0yTkRReUlEQXVORGN4TnpnMUlEQXVPVEk1TlRFMklEQXVORFU1TmpJMFZqQXVORFU1TmpJMFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T0RjM05qSTBJREF1TmpJNU16WTRUREF1TlRnd01EYzBJREF1TXpNeE56UTVUREF1TlRVNE56WXlJREF1TXpjM09UUTVUREF1TlRFeU1qZzNJREF1TXpNeE5UUXpUREF1TkRrd09ETTNJREF1TXpjM05UTTNUREF1TkRRMU1EUTVJREF1TXpNeE5qaE1NQzQwTXpNMk16Y2dNQzR6T0RjeU0wd3dMak01TWpjNU9TQXdMak01TkRFd05Vd3dMak00TkRNME15QXdMalF6TURRd05Vd3dMak16TVRVME15QXdMalEwTXpBMU5Vd3dMak0zT0RnME15QXdMalE1TURNMU5Vd3dMak16TWpBeU5DQXdMalV4TURrNFREQXVNemM0T0RReklEQXVOVFUzTnprNVREQXVNek14TnpRNUlEQXVOVGM0TXpVMVREQXVOalE0TmpnM0lEQXVPRGsxTWprelNEQXVOamd3T0RZeVF6QXVOamswT0RFeElEQXVPRGswT0RFMElEQXVOekE0TXprMklEQXVPRGt3TnpJeklEQXVOekl3TWprZ01DNDRPRE0wTWpGRE1DNDNNekl4T0RVZ01DNDROell4TVRnZ01DNDNOREU1T0NBd0xqZzJOVGcxTXlBd0xqYzBPRGN4T0NBd0xqZzFNell6VERBdU9EYzNOakkwSURBdU5qSTVNelk0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalUwTURFek1pQXdMalExTWpZek4wZ3dMalEyTVRZNE9FTXdMalExT1RRNE55QXdMalExTWpZMU5TQXdMalExTnpNNE1pQXdMalExTXpVek55QXdMalExTlRneU5TQXdMalExTlRBNU0wTXdMalExTkRJMk9TQXdMalExTmpZME9TQXdMalExTXpNNE55QXdMalExT0RjMU5TQXdMalExTXpNMk9TQXdMalEyTURrMU5WWXdMalV6T1RNNU9VTXdMalExTXpNMk9TQXdMalUwTVRZeE1pQXdMalExTkRJME15QXdMalUwTXpjek5TQXdMalExTlRnd01TQXdMalUwTlRNd05rTXdMalExTnpNMklEQXVOVFEyT0RjM0lEQXVORFU1TkRjMUlEQXVOVFEzTnpZNUlEQXVORFl4TmpnNElEQXVOVFEzTnpnM1NEQXVOVFF3TVRNeVF6QXVOVFF5TWprMklEQXVOVFEzTmprNElEQXVOVFEwTXpReUlEQXVOVFEyTnpjMUlEQXVOVFExT0RReElEQXVOVFExTWpFeVF6QXVOVFEzTXpReElEQXVOVFF6TmpRNElEQXVOVFE0TVRjM0lEQXVOVFF4TlRZMUlEQXVOVFE0TVRjMUlEQXVOVE01TXprNVZqQXVORFl3T1RVMVF6QXVOVFE0TVRVM0lEQXVORFU0TnpVMUlEQXVOVFEzTWpjMUlEQXVORFUyTmpRNUlEQXVOVFExTnpFNUlEQXVORFUxTURrelF6QXVOVFEwTVRZeklEQXVORFV6TlRNM0lEQXVOVFF5TURVM0lEQXVORFV5TmpVMUlEQXVOVE01T0RVM0lEQXVORFV5TmpNM0lpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZME16UXhJREF1TkRRMk16VTRRekF1TmpZMU16TTNJREF1TkRRMk16YzNJREF1TmpZMk16STJJREF1TkRRMk1UazJJREF1TmpZM01qVXhJREF1TkRRMU9ESTRRekF1TmpZNE1UYzJJREF1TkRRMU5EWWdNQzQyTmprd01UZ2dNQzQwTkRRNU1URWdNQzQyTmprM01qa2dNQzQwTkRReU1UTkRNQzQyTnpBME16a2dNQzQwTkRNMU1UVWdNQzQyTnpFd01EUWdNQzQwTkRJMk9ETWdNQzQyTnpFek9Ea2dNQzQwTkRFM05qVkRNQzQyTnpFM056UWdNQzQwTkRBNE5EWWdNQzQyTnpFNU56SWdNQzQwTXprNE5qRWdNQzQyTnpFNU56SWdNQzQwTXpnNE5qVldNQzQwTWpZMk1qZERNQzQyTnpFNU56SWdNQzQwTWpRMk5DQXdMalkzTVRFNE15QXdMalF5TWpjek5DQXdMalkyT1RjM055QXdMalF5TVRNeU9FTXdMalkyT0RNM01pQXdMalF4T1RreU15QXdMalkyTmpRMk5pQXdMalF4T1RFek5DQXdMalkyTkRRM09TQXdMalF4T1RFek5FZ3dMall5TmpFNE5WWXdMak00TXpJME5rTXdMall5TmpFMk55QXdMak00TVRBME5TQXdMall5TlRJNE5TQXdMak0zT0RrMElEQXVOakl6TnpJNElEQXVNemMzTXpnMFF6QXVOakl5TVRjeUlEQXVNemMxT0RJM0lEQXVOakl3TURZM0lEQXVNemMwT1RRMUlEQXVOakUzT0RZMklEQXVNemMwT1RJM1NEQXVOVGd5TURRM1ZqQXVNek0yT0RSRE1DNDFPREl3TkRjZ01DNHpNelE0TlRJZ01DNDFPREV5TlRnZ01DNHpNekk1TkRZZ01DNDFOems0TlRJZ01DNHpNekUxTkRGRE1DNDFOemcwTkRjZ01DNHpNekF4TXpZZ01DNDFOelkxTkRFZ01DNHpNamt6TkRZZ01DNDFOelExTlRNZ01DNHpNamt6TkRaSU1DNDFOakl6TVRaRE1DNDFOakF6TnpjZ01DNHpNamswTVRjZ01DNDFOVGcxTkNBd0xqTXpNREl6T0NBd0xqVTFOekU1TkNBd0xqTXpNVFl6TmtNd0xqVTFOVGcwT0NBd0xqTXpNekF6TXlBd0xqVTFOVEE1TmlBd0xqTXpORGc1T1NBd0xqVTFOVEE1TnlBd0xqTXpOamcwVmpBdU16YzFNVE0wU0RBdU5URTBOVE0xVmpBdU16TTJPRFJETUM0MU1UUTFNelVnTUM0ek16VTROU0F3TGpVeE5ETXpPU0F3TGpNek5EZzNJREF1TlRFek9UVTRJREF1TXpNek9UVTJRekF1TlRFek5UYzNJREF1TXpNek1EUXlJREF1TlRFek1ERTVJREF1TXpNeU1qRXpJREF1TlRFeU16RTJJREF1TXpNeE5URTJRekF1TlRFeE5qRXlJREF1TXpNd09ESWdNQzQxTVRBM056Z2dNQzR6TXpBeU5qa2dNQzQxTURrNE5qRWdNQzR6TWprNE9UZERNQzQxTURnNU5EUWdNQzR6TWprMU1qUWdNQzQxTURjNU5qSWdNQzR6TWprek16Y2dNQzQxTURZNU56SWdNQzR6TWprek5EWklNQzQwT1RRNE56SkRNQzQwT1RJNE9EVWdNQzR6TWprek5EWWdNQzQwT1RBNU56a2dNQzR6TXpBeE16WWdNQzQwT0RrMU56TWdNQzR6TXpFMU5ERkRNQzQwT0RneE5qZ2dNQzR6TXpJNU5EWWdNQzQwT0Rjek56Z2dNQzR6TXpRNE5USWdNQzQwT0Rjek56Z2dNQzR6TXpZNE5GWXdMak0zTlRFek5FZ3dMalEwTnpBNU1WWXdMak16TmpnMFF6QXVORFEzTURreElEQXVNek0wT0RVeUlEQXVORFEyTXpBeElEQXVNek15T1RRMklEQXVORFEwT0RrMklEQXVNek14TlRReFF6QXVORFF6TkRreElEQXVNek13TVRNMklEQXVORFF4TlRnMUlEQXVNekk1TXpRMklEQXVORE01TlRrM0lEQXVNekk1TXpRMlNEQXVOREkzTXpaRE1DNDBNall6TnpZZ01DNHpNamt6TkRZZ01DNDBNalUwTURFZ01DNHpNamsxTkNBd0xqUXlORFE1TWlBd0xqTXlPVGt4TmtNd0xqUXlNelU0TXlBd0xqTXpNREk1TXlBd0xqUXlNamMxTnlBd0xqTXpNRGcwTlNBd0xqUXlNakEyTVNBd0xqTXpNVFUwTVVNd0xqUXlNVE0yTlNBd0xqTXpNakl6TnlBd0xqUXlNRGd4TXlBd0xqTXpNekEyTXlBd0xqUXlNRFF6TmlBd0xqTXpNemszTWtNd0xqUXlNREEySURBdU16TTBPRGd4SURBdU5ERTVPRFkySURBdU16TTFPRFUySURBdU5ERTVPRFkySURBdU16TTJPRFJXTUM0ek56VXhNelJJTUM0ek9EUXhNVFpETUM0ek9ERTVNemdnTUM0ek56VXhNeklnTUM0ek56azRORFlnTUM0ek56VTVOemdnTUM0ek56Z3lPQ0F3TGpNM056UTVNa013TGpNM05qY3hOU0F3TGpNM09UQXdOaUF3TGpNM05UZ2dNQzR6T0RFd055QXdMak0zTlRjeU9DQXdMak00TXpJME5sWXdMalF4T0RreU4wZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalF4T0RreU55QXdMak16TXpZM09TQXdMalF4T1RjeE55QXdMak16TWpJM015QXdMalF5TVRFeU1rTXdMak16TURnMk9DQXdMalF5TWpVeU55QXdMak16TURBM09DQXdMalF5TkRRek5DQXdMak16TURBM09DQXdMalF5TmpReU1WWXdMalF6T0RZMU9FTXdMak16TURBM09DQXdMalEwTURZME5pQXdMak16TURnMk9DQXdMalEwTWpVMU1pQXdMak16TWpJM015QXdMalEwTXprMU4wTXdMak16TXpZM09TQXdMalEwTlRNMk15QXdMak16TlRVNE5TQXdMalEwTmpFMU1pQXdMak16TnpVM01pQXdMalEwTmpFMU1rZ3dMak0zTlRjeU9GWXdMalE0TmpNM01VZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalE0TmpNM01TQXdMak16TXpZM09TQXdMalE0TnpFMklEQXVNek15TWpjeklEQXVORGc0TlRZMlF6QXVNek13T0RZNElEQXVORGc1T1RjeElEQXVNek13TURjNElEQXVORGt4T0RjM0lEQXVNek13TURjNElEQXVORGt6T0RZMVZqQXVOVEEyTXpBNFF6QXVNek13TURZNUlEQXVOVEEzTWprNElEQXVNek13TWpVMklEQXVOVEE0TWpnZ01DNHpNekEyTWprZ01DNDFNRGt4T1RkRE1DNHpNekV3TURJZ01DNDFNVEF4TVRRZ01DNHpNekUxTlRJZ01DNDFNVEE1TkRrZ01DNHpNekl5TkRrZ01DNDFNVEUyTlRKRE1DNHpNekk1TkRZZ01DNDFNVEl6TlRVZ01DNHpNek0zTnpVZ01DNDFNVEk1TVRNZ01DNHpNelEyT0RnZ01DNDFNVE15T1RSRE1DNHpNelUyTURJZ01DNDFNVE0yTnpVZ01DNHpNelkxT0RJZ01DNDFNVE00TnpFZ01DNHpNemMxTnpJZ01DNDFNVE00TnpGSU1DNHpOelUzTWpoV01DNDFOVFF4TlRoSU1DNHpNemMxTnpKRE1DNHpNelUxT0RVZ01DNDFOVFF4TlRnZ01DNHpNek0yTnprZ01DNDFOVFE1TkRnZ01DNHpNekl5TnpNZ01DNDFOVFl6TlRORE1DNHpNekE0TmpnZ01DNDFOVGMzTlRrZ01DNHpNekF3TnpnZ01DNDFOVGsyTmpVZ01DNHpNekF3TnpnZ01DNDFOakUyTlRKV01DNDFOek00T1VNd0xqTXpNREEzT0NBd0xqVTNOVGczTnlBd0xqTXpNRGcyT0NBd0xqVTNOemM0TXlBd0xqTXpNakkzTXlBd0xqVTNPVEU0T1VNd0xqTXpNelkzT1NBd0xqVTRNRFU1TkNBd0xqTXpOVFU0TlNBd0xqVTRNVE00TXlBd0xqTXpOelUzTWlBd0xqVTRNVE00TTBnd0xqTTNOVGN5T0ZZd0xqWXhOams1TmtNd0xqTTNOVGMwTmlBd0xqWXhPVEU1TnlBd0xqTTNOall5T1NBd0xqWXlNVE13TWlBd0xqTTNPREU0TlNBd0xqWXlNamcxT0VNd0xqTTNPVGMwTVNBd0xqWXlORFF4TlNBd0xqTTRNVGcwTmlBd0xqWXlOVEk1TnlBd0xqTTROREEwTnlBd0xqWXlOVE14TlVnd0xqUXhPVGcyTmxZd0xqWTJNell3T0VNd0xqUXhPVGcyTmlBd0xqWTJORFU1TXlBd0xqUXlNREEySURBdU5qWTFOVFkzSURBdU5ESXdORE0ySURBdU5qWTJORGMyUXpBdU5ESXdPREV6SURBdU5qWTNNemcxSURBdU5ESXhNelkxSURBdU5qWTRNakV4SURBdU5ESXlNRFl4SURBdU5qWTRPVEEzUXpBdU5ESXlOelUzSURBdU5qWTVOakF6SURBdU5ESXpOVGd6SURBdU5qY3dNVFUxSURBdU5ESTBORGt5SURBdU5qY3dOVE15UXpBdU5ESTFOREF4SURBdU5qY3dPVEE0SURBdU5ESTJNemMySURBdU5qY3hNVEF5SURBdU5ESTNNellnTUM0Mk56RXhNREpJTUM0ME16azFPVGRETUM0ME5EQTFPREVnTUM0Mk56RXhNRElnTUM0ME5ERTFOVFlnTUM0Mk56QTVNRGdnTUM0ME5ESTBOalVnTUM0Mk56QTFNekpETUM0ME5ETXpOelFnTUM0Mk56QXhOVFVnTUM0ME5EUXlJREF1TmpZNU5qQXpJREF1TkRRME9EazJJREF1TmpZNE9UQTNRekF1TkRRMU5Ua3lJREF1TmpZNE1qRXhJREF1TkRRMk1UUTBJREF1TmpZM016ZzFJREF1TkRRMk5USXhJREF1TmpZMk5EYzJRekF1TkRRMk9EazNJREF1TmpZMU5UWTNJREF1TkRRM01Ea3hJREF1TmpZME5Ua3pJREF1TkRRM01Ea3hJREF1TmpZek5qQTRWakF1TmpJMU16RTFTREF1TkRnM016YzRWakF1TmpZek5qQTRRekF1TkRnM016YzRJREF1TmpZMU5UazJJREF1TkRnNE1UWTRJREF1TmpZM05UQXlJREF1TkRnNU5UY3pJREF1TmpZNE9UQTNRekF1TkRrd09UYzVJREF1Tmpjd016RXpJREF1TkRreU9EZzFJREF1TmpjeE1UQXlJREF1TkRrME9EY3lJREF1TmpjeE1UQXlTREF1TlRBMk9UY3lRekF1TlRBNE9UWWdNQzQyTnpFeE1ESWdNQzQxTVRBNE5qWWdNQzQyTnpBek1UTWdNQzQxTVRJeU56RWdNQzQyTmpnNU1EZERNQzQxTVRNMk56WWdNQzQyTmpjMU1ESWdNQzQxTVRRME5qWWdNQzQyTmpVMU9UWWdNQzQxTVRRME5qWWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQxTlRVd09UZFdNQzQyTmpNMk1EaERNQzQxTlRVd09UY2dNQzQyTmpVMU9UWWdNQzQxTlRVNE9EY2dNQzQyTmpjMU1ESWdNQzQxTlRjeU9USWdNQzQyTmpnNU1EZERNQzQxTlRnMk9UY2dNQzQyTnpBek1UTWdNQzQxTmpBMk1ETWdNQzQyTnpFeE1ESWdNQzQxTmpJMU9URWdNQzQyTnpFeE1ESklNQzQxTnpRNE1qbERNQzQxTnpZNE1UWWdNQzQyTnpFeE1ESWdNQzQxTnpnM01qSWdNQzQyTnpBek1UTWdNQzQxT0RBeE1qY2dNQzQyTmpnNU1EZERNQzQxT0RFMU16TWdNQzQyTmpjMU1ESWdNQzQxT0RJek1qSWdNQzQyTmpVMU9UWWdNQzQxT0RJek1qSWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQyTVRneE5ERkRNQzQyTWpBeU9UUWdNQzQyTWpVeU1qWWdNQzQyTWpJek15QXdMall5TkRNeE15QXdMall5TXpneU55QXdMall5TWpjMk5VTXdMall5TlRNeU5TQXdMall5TVRJeE5pQXdMall5TmpFMk9TQXdMall4T1RFMUlEQXVOakkyTVRnMUlEQXVOakUyT1RrMlZqQXVOVGd4TXpFMVNEQXVOalkwTXpReFF6QXVOalkxTXpNM0lEQXVOVGd4TXpNeklEQXVOalkyTXpJMklEQXVOVGd4TVRVeklEQXVOalkzTWpVeElEQXVOVGd3TnpnMFF6QXVOalk0TVRjMklEQXVOVGd3TkRFMklEQXVOalk1TURFNElEQXVOVGM1T0RZM0lEQXVOalk1TnpJNUlEQXVOVGM1TVRZNVF6QXVOamN3TkRNNUlEQXVOVGM0TkRjeElEQXVOamN4TURBMElEQXVOVGMzTmpNNUlEQXVOamN4TXpnNUlEQXVOVGMyTnpJeFF6QXVOamN4TnpjMElEQXVOVGMxT0RBeklEQXVOamN4T1RjeUlEQXVOVGMwT0RFM0lEQXVOamN4T1RjeUlEQXVOVGN6T0RJeFZqQXVOVFl4TlRnelF6QXVOamN4T1RjeUlEQXVOVFU1TlRrMklEQXVOamN4TVRneklEQXVOVFUzTmprZ01DNDJOamszTnpjZ01DNDFOVFl5T0RWRE1DNDJOamd6TnpJZ01DNDFOVFE0TnprZ01DNDJOalkwTmpZZ01DNDFOVFF3T1NBd0xqWTJORFEzT1NBd0xqVTFOREE1U0RBdU5qSTJNVGcxVmpBdU5URXpPRGN4U0RBdU5qWTBNelF4UXpBdU5qWTFNelF5SURBdU5URXpPRGc1SURBdU5qWTJNek0zSURBdU5URXpOekEzSURBdU5qWTNNalkzSURBdU5URXpNek0wUXpBdU5qWTRNVGszSURBdU5URXlPVFl5SURBdU5qWTVNRFF5SURBdU5URXlOREEySURBdU5qWTVOelUwSURBdU5URXhOekF4UXpBdU5qY3dORFkxSURBdU5URXdPVGsySURBdU5qY3hNREk0SURBdU5URXdNVFUySURBdU5qY3hOREE1SURBdU5UQTVNak5ETUM0Mk56RTNPU0F3TGpVd09ETXdNeUF3TGpZM01UazRNaUF3TGpVd056TXhJREF1TmpjeE9UY3lJREF1TlRBMk16QTRWakF1TkRrME1UUkRNQzQyTnpJd01TQXdMalE1TXpFeU1TQXdMalkzTVRnek9TQXdMalE1TWpFd05TQXdMalkzTVRRM01TQXdMalE1TVRFMU5VTXdMalkzTVRFd01pQXdMalE1TURJd05TQXdMalkzTURVME5DQXdMalE0T1RNek9TQXdMalkyT1RneklEQXVORGc0TmpFeVF6QXVOalk1TVRFMUlEQXVORGczT0RnMUlEQXVOalk0TWpZZ01DNDBPRGN6TVRFZ01DNDJOamN6TVRZZ01DNDBPRFk1TWpaRE1DNDJOall6TnpNZ01DNDBPRFkxTkNBd0xqWTJOVE0ySURBdU5EZzJNelV5SURBdU5qWTBNelF4SURBdU5EZzJNemN4U0RBdU5qSTJNVGcxVmpBdU5EUTJNelU0U0RBdU5qWTBNelF4V2swd0xqVTVOems1TnlBd0xqVTVOell3T0Vnd0xqUXdNemcwTjFZd0xqUXdNekU0TkVnd0xqVTVOems1TjFZd0xqVTVOell3T0ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpNME9GOHlNekV3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDRPQ0lnYUdWcFoyaDBQU0l3TGpnNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOakF3TlRnMklEQXVNRFl3TURVNE5pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPThjM2M3NDIwLTAyZDctNDljMi04ZWJlLTJkODgxM2I4NjI3MDsiIHBhcmVudD0iMTMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTQ1IiB5PSIxODUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iU0FQIFJvdXRlciIgaWQ9IjUiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03ZTdkY2U4Zi04OTM5LTQ2NjQtYTYxNi0wMGFjNjJjMjA1MjU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELUNPTVBVVEUtRU5HSU5FO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpJek5EaGZNak14TURBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVFl5TkV3d0xqYzBPRGN3TXlBd0xqRTBOVEUyTVVNd0xqYzBNVGt3TkNBd0xqRXpNekV3TXlBd0xqY3pNakEzTWlBd0xqRXlNekF6SURBdU56SXdNVGd5SURBdU1URTFPVE01UXpBdU56QTRNamt6SURBdU1UQTRPRFE1SURBdU5qazBOelUzSURBdU1UQTBPVGczSURBdU5qZ3dPVEUySURBdU1UQTBOek0yU0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBPVGdnTUM0eU9URTROREVnTUM0eE1EZzRNemtnTUM0eU56azVOU0F3TGpFeE5Ua3pRekF1TWpZNE1EVTVJREF1TVRJek1ESXhJREF1TWpVNE1qSTVJREF1TVRNek1EazRJREF1TWpVeE5ETTFJREF1TVRRMU1UWXhUREF1TURjd05UVXpNeUF3TGpRMU9EYzVPVU13TGpBMk16WTNOeklnTUM0ME56QTNOalFnTUM0d05qQXdOVGcySURBdU5EZzBNekl6SURBdU1EWXdNRFU0TmlBd0xqUTVPREV5TkVNd0xqQTJNREExT0RZZ01DNDFNVEU1TWpRZ01DNHdOak0yTnpjeUlEQXVOVEkxTkRneklEQXVNRGN3TlRVek15QXdMalV6TnpRME9Vd3dMakkxTVRNMk5pQXdMamcxTXpZNU9VTXdMakkxT0RBNU15QXdMamcyTlRrek15QXdMakkyTnpnM01TQXdMamczTmpJeE9DQXdMakkzT1RjME9TQXdMamc0TXpVMU5FTXdMakk1TVRZeU9DQXdMamc1TURnNU1TQXdMak13TlRJd01pQXdMamc1TlRBeU9TQXdMak14T1RFMU15QXdMamc1TlRVMk9FZ3dMalk0TURnME4wTXdMalk1TkRjNU5pQXdMamc1TlRBNE9TQXdMamN3T0RNNE1pQXdMamc1TURrNU9DQXdMamN5TURJM05pQXdMamc0TXpZNU5VTXdMamN6TWpFM0lEQXVPRGMyTXpreUlEQXVOelF4T1RZMUlEQXVPRFkyTVRJNElEQXVOelE0TnpBeklEQXVPRFV6T1RBMVREQXVPVEk1TlRFMklEQXVOVE01TkRRelF6QXVPVE0yTkRReUlEQXVOVEkzTWpneUlEQXVPVFF3TURnMElEQXVOVEV6TlRJNElEQXVPVFF3TURnMElEQXVORGs1TlRNelF6QXVPVFF3TURnMElEQXVORGcxTlRNNElEQXVPVE0yTkRReUlEQXVORGN4TnpnMUlEQXVPVEk1TlRFMklEQXVORFU1TmpJMFZqQXVORFU1TmpJMFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T0RjM05qSTBJREF1TmpJNU16WTRUREF1TlRnd01EYzBJREF1TXpNeE56UTVUREF1TlRVNE56WXlJREF1TXpjM09UUTVUREF1TlRFeU1qZzNJREF1TXpNeE5UUXpUREF1TkRrd09ETTNJREF1TXpjM05UTTNUREF1TkRRMU1EUTVJREF1TXpNeE5qaE1NQzQwTXpNMk16Y2dNQzR6T0RjeU0wd3dMak01TWpjNU9TQXdMak01TkRFd05Vd3dMak00TkRNME15QXdMalF6TURRd05Vd3dMak16TVRVME15QXdMalEwTXpBMU5Vd3dMak0zT0RnME15QXdMalE1TURNMU5Vd3dMak16TWpBeU5DQXdMalV4TURrNFREQXVNemM0T0RReklEQXVOVFUzTnprNVREQXVNek14TnpRNUlEQXVOVGM0TXpVMVREQXVOalE0TmpnM0lEQXVPRGsxTWprelNEQXVOamd3T0RZeVF6QXVOamswT0RFeElEQXVPRGswT0RFMElEQXVOekE0TXprMklEQXVPRGt3TnpJeklEQXVOekl3TWprZ01DNDRPRE0wTWpGRE1DNDNNekl4T0RVZ01DNDROell4TVRnZ01DNDNOREU1T0NBd0xqZzJOVGcxTXlBd0xqYzBPRGN4T0NBd0xqZzFNell6VERBdU9EYzNOakkwSURBdU5qSTVNelk0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalUwTURFek1pQXdMalExTWpZek4wZ3dMalEyTVRZNE9FTXdMalExT1RRNE55QXdMalExTWpZMU5TQXdMalExTnpNNE1pQXdMalExTXpVek55QXdMalExTlRneU5TQXdMalExTlRBNU0wTXdMalExTkRJMk9TQXdMalExTmpZME9TQXdMalExTXpNNE55QXdMalExT0RjMU5TQXdMalExTXpNMk9TQXdMalEyTURrMU5WWXdMalV6T1RNNU9VTXdMalExTXpNMk9TQXdMalUwTVRZeE1pQXdMalExTkRJME15QXdMalUwTXpjek5TQXdMalExTlRnd01TQXdMalUwTlRNd05rTXdMalExTnpNMklEQXVOVFEyT0RjM0lEQXVORFU1TkRjMUlEQXVOVFEzTnpZNUlEQXVORFl4TmpnNElEQXVOVFEzTnpnM1NEQXVOVFF3TVRNeVF6QXVOVFF5TWprMklEQXVOVFEzTmprNElEQXVOVFEwTXpReUlEQXVOVFEyTnpjMUlEQXVOVFExT0RReElEQXVOVFExTWpFeVF6QXVOVFEzTXpReElEQXVOVFF6TmpRNElEQXVOVFE0TVRjM0lEQXVOVFF4TlRZMUlEQXVOVFE0TVRjMUlEQXVOVE01TXprNVZqQXVORFl3T1RVMVF6QXVOVFE0TVRVM0lEQXVORFU0TnpVMUlEQXVOVFEzTWpjMUlEQXVORFUyTmpRNUlEQXVOVFExTnpFNUlEQXVORFUxTURrelF6QXVOVFEwTVRZeklEQXVORFV6TlRNM0lEQXVOVFF5TURVM0lEQXVORFV5TmpVMUlEQXVOVE01T0RVM0lEQXVORFV5TmpNM0lpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZME16UXhJREF1TkRRMk16VTRRekF1TmpZMU16TTNJREF1TkRRMk16YzNJREF1TmpZMk16STJJREF1TkRRMk1UazJJREF1TmpZM01qVXhJREF1TkRRMU9ESTRRekF1TmpZNE1UYzJJREF1TkRRMU5EWWdNQzQyTmprd01UZ2dNQzQwTkRRNU1URWdNQzQyTmprM01qa2dNQzQwTkRReU1UTkRNQzQyTnpBME16a2dNQzQwTkRNMU1UVWdNQzQyTnpFd01EUWdNQzQwTkRJMk9ETWdNQzQyTnpFek9Ea2dNQzQwTkRFM05qVkRNQzQyTnpFM056UWdNQzQwTkRBNE5EWWdNQzQyTnpFNU56SWdNQzQwTXprNE5qRWdNQzQyTnpFNU56SWdNQzQwTXpnNE5qVldNQzQwTWpZMk1qZERNQzQyTnpFNU56SWdNQzQwTWpRMk5DQXdMalkzTVRFNE15QXdMalF5TWpjek5DQXdMalkyT1RjM055QXdMalF5TVRNeU9FTXdMalkyT0RNM01pQXdMalF4T1RreU15QXdMalkyTmpRMk5pQXdMalF4T1RFek5DQXdMalkyTkRRM09TQXdMalF4T1RFek5FZ3dMall5TmpFNE5WWXdMak00TXpJME5rTXdMall5TmpFMk55QXdMak00TVRBME5TQXdMall5TlRJNE5TQXdMak0zT0RrMElEQXVOakl6TnpJNElEQXVNemMzTXpnMFF6QXVOakl5TVRjeUlEQXVNemMxT0RJM0lEQXVOakl3TURZM0lEQXVNemMwT1RRMUlEQXVOakUzT0RZMklEQXVNemMwT1RJM1NEQXVOVGd5TURRM1ZqQXVNek0yT0RSRE1DNDFPREl3TkRjZ01DNHpNelE0TlRJZ01DNDFPREV5TlRnZ01DNHpNekk1TkRZZ01DNDFOems0TlRJZ01DNHpNekUxTkRGRE1DNDFOemcwTkRjZ01DNHpNekF4TXpZZ01DNDFOelkxTkRFZ01DNHpNamt6TkRZZ01DNDFOelExTlRNZ01DNHpNamt6TkRaSU1DNDFOakl6TVRaRE1DNDFOakF6TnpjZ01DNHpNamswTVRjZ01DNDFOVGcxTkNBd0xqTXpNREl6T0NBd0xqVTFOekU1TkNBd0xqTXpNVFl6TmtNd0xqVTFOVGcwT0NBd0xqTXpNekF6TXlBd0xqVTFOVEE1TmlBd0xqTXpORGc1T1NBd0xqVTFOVEE1TnlBd0xqTXpOamcwVmpBdU16YzFNVE0wU0RBdU5URTBOVE0xVmpBdU16TTJPRFJETUM0MU1UUTFNelVnTUM0ek16VTROU0F3TGpVeE5ETXpPU0F3TGpNek5EZzNJREF1TlRFek9UVTRJREF1TXpNek9UVTJRekF1TlRFek5UYzNJREF1TXpNek1EUXlJREF1TlRFek1ERTVJREF1TXpNeU1qRXpJREF1TlRFeU16RTJJREF1TXpNeE5URTJRekF1TlRFeE5qRXlJREF1TXpNd09ESWdNQzQxTVRBM056Z2dNQzR6TXpBeU5qa2dNQzQxTURrNE5qRWdNQzR6TWprNE9UZERNQzQxTURnNU5EUWdNQzR6TWprMU1qUWdNQzQxTURjNU5qSWdNQzR6TWprek16Y2dNQzQxTURZNU56SWdNQzR6TWprek5EWklNQzQwT1RRNE56SkRNQzQwT1RJNE9EVWdNQzR6TWprek5EWWdNQzQwT1RBNU56a2dNQzR6TXpBeE16WWdNQzQwT0RrMU56TWdNQzR6TXpFMU5ERkRNQzQwT0RneE5qZ2dNQzR6TXpJNU5EWWdNQzQwT0Rjek56Z2dNQzR6TXpRNE5USWdNQzQwT0Rjek56Z2dNQzR6TXpZNE5GWXdMak0zTlRFek5FZ3dMalEwTnpBNU1WWXdMak16TmpnMFF6QXVORFEzTURreElEQXVNek0wT0RVeUlEQXVORFEyTXpBeElEQXVNek15T1RRMklEQXVORFEwT0RrMklEQXVNek14TlRReFF6QXVORFF6TkRreElEQXVNek13TVRNMklEQXVORFF4TlRnMUlEQXVNekk1TXpRMklEQXVORE01TlRrM0lEQXVNekk1TXpRMlNEQXVOREkzTXpaRE1DNDBNall6TnpZZ01DNHpNamt6TkRZZ01DNDBNalUwTURFZ01DNHpNamsxTkNBd0xqUXlORFE1TWlBd0xqTXlPVGt4TmtNd0xqUXlNelU0TXlBd0xqTXpNREk1TXlBd0xqUXlNamMxTnlBd0xqTXpNRGcwTlNBd0xqUXlNakEyTVNBd0xqTXpNVFUwTVVNd0xqUXlNVE0yTlNBd0xqTXpNakl6TnlBd0xqUXlNRGd4TXlBd0xqTXpNekEyTXlBd0xqUXlNRFF6TmlBd0xqTXpNemszTWtNd0xqUXlNREEySURBdU16TTBPRGd4SURBdU5ERTVPRFkySURBdU16TTFPRFUySURBdU5ERTVPRFkySURBdU16TTJPRFJXTUM0ek56VXhNelJJTUM0ek9EUXhNVFpETUM0ek9ERTVNemdnTUM0ek56VXhNeklnTUM0ek56azRORFlnTUM0ek56VTVOemdnTUM0ek56Z3lPQ0F3TGpNM056UTVNa013TGpNM05qY3hOU0F3TGpNM09UQXdOaUF3TGpNM05UZ2dNQzR6T0RFd055QXdMak0zTlRjeU9DQXdMak00TXpJME5sWXdMalF4T0RreU4wZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalF4T0RreU55QXdMak16TXpZM09TQXdMalF4T1RjeE55QXdMak16TWpJM015QXdMalF5TVRFeU1rTXdMak16TURnMk9DQXdMalF5TWpVeU55QXdMak16TURBM09DQXdMalF5TkRRek5DQXdMak16TURBM09DQXdMalF5TmpReU1WWXdMalF6T0RZMU9FTXdMak16TURBM09DQXdMalEwTURZME5pQXdMak16TURnMk9DQXdMalEwTWpVMU1pQXdMak16TWpJM015QXdMalEwTXprMU4wTXdMak16TXpZM09TQXdMalEwTlRNMk15QXdMak16TlRVNE5TQXdMalEwTmpFMU1pQXdMak16TnpVM01pQXdMalEwTmpFMU1rZ3dMak0zTlRjeU9GWXdMalE0TmpNM01VZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalE0TmpNM01TQXdMak16TXpZM09TQXdMalE0TnpFMklEQXVNek15TWpjeklEQXVORGc0TlRZMlF6QXVNek13T0RZNElEQXVORGc1T1RjeElEQXVNek13TURjNElEQXVORGt4T0RjM0lEQXVNek13TURjNElEQXVORGt6T0RZMVZqQXVOVEEyTXpBNFF6QXVNek13TURZNUlEQXVOVEEzTWprNElEQXVNek13TWpVMklEQXVOVEE0TWpnZ01DNHpNekEyTWprZ01DNDFNRGt4T1RkRE1DNHpNekV3TURJZ01DNDFNVEF4TVRRZ01DNHpNekUxTlRJZ01DNDFNVEE1TkRrZ01DNHpNekl5TkRrZ01DNDFNVEUyTlRKRE1DNHpNekk1TkRZZ01DNDFNVEl6TlRVZ01DNHpNek0zTnpVZ01DNDFNVEk1TVRNZ01DNHpNelEyT0RnZ01DNDFNVE15T1RSRE1DNHpNelUyTURJZ01DNDFNVE0yTnpVZ01DNHpNelkxT0RJZ01DNDFNVE00TnpFZ01DNHpNemMxTnpJZ01DNDFNVE00TnpGSU1DNHpOelUzTWpoV01DNDFOVFF4TlRoSU1DNHpNemMxTnpKRE1DNHpNelUxT0RVZ01DNDFOVFF4TlRnZ01DNHpNek0yTnprZ01DNDFOVFE1TkRnZ01DNHpNekl5TnpNZ01DNDFOVFl6TlRORE1DNHpNekE0TmpnZ01DNDFOVGMzTlRrZ01DNHpNekF3TnpnZ01DNDFOVGsyTmpVZ01DNHpNekF3TnpnZ01DNDFOakUyTlRKV01DNDFOek00T1VNd0xqTXpNREEzT0NBd0xqVTNOVGczTnlBd0xqTXpNRGcyT0NBd0xqVTNOemM0TXlBd0xqTXpNakkzTXlBd0xqVTNPVEU0T1VNd0xqTXpNelkzT1NBd0xqVTRNRFU1TkNBd0xqTXpOVFU0TlNBd0xqVTRNVE00TXlBd0xqTXpOelUzTWlBd0xqVTRNVE00TTBnd0xqTTNOVGN5T0ZZd0xqWXhOams1TmtNd0xqTTNOVGMwTmlBd0xqWXhPVEU1TnlBd0xqTTNOall5T1NBd0xqWXlNVE13TWlBd0xqTTNPREU0TlNBd0xqWXlNamcxT0VNd0xqTTNPVGMwTVNBd0xqWXlORFF4TlNBd0xqTTRNVGcwTmlBd0xqWXlOVEk1TnlBd0xqTTROREEwTnlBd0xqWXlOVE14TlVnd0xqUXhPVGcyTmxZd0xqWTJNell3T0VNd0xqUXhPVGcyTmlBd0xqWTJORFU1TXlBd0xqUXlNREEySURBdU5qWTFOVFkzSURBdU5ESXdORE0ySURBdU5qWTJORGMyUXpBdU5ESXdPREV6SURBdU5qWTNNemcxSURBdU5ESXhNelkxSURBdU5qWTRNakV4SURBdU5ESXlNRFl4SURBdU5qWTRPVEEzUXpBdU5ESXlOelUzSURBdU5qWTVOakF6SURBdU5ESXpOVGd6SURBdU5qY3dNVFUxSURBdU5ESTBORGt5SURBdU5qY3dOVE15UXpBdU5ESTFOREF4SURBdU5qY3dPVEE0SURBdU5ESTJNemMySURBdU5qY3hNVEF5SURBdU5ESTNNellnTUM0Mk56RXhNREpJTUM0ME16azFPVGRETUM0ME5EQTFPREVnTUM0Mk56RXhNRElnTUM0ME5ERTFOVFlnTUM0Mk56QTVNRGdnTUM0ME5ESTBOalVnTUM0Mk56QTFNekpETUM0ME5ETXpOelFnTUM0Mk56QXhOVFVnTUM0ME5EUXlJREF1TmpZNU5qQXpJREF1TkRRME9EazJJREF1TmpZNE9UQTNRekF1TkRRMU5Ua3lJREF1TmpZNE1qRXhJREF1TkRRMk1UUTBJREF1TmpZM016ZzFJREF1TkRRMk5USXhJREF1TmpZMk5EYzJRekF1TkRRMk9EazNJREF1TmpZMU5UWTNJREF1TkRRM01Ea3hJREF1TmpZME5Ua3pJREF1TkRRM01Ea3hJREF1TmpZek5qQTRWakF1TmpJMU16RTFTREF1TkRnM016YzRWakF1TmpZek5qQTRRekF1TkRnM016YzRJREF1TmpZMU5UazJJREF1TkRnNE1UWTRJREF1TmpZM05UQXlJREF1TkRnNU5UY3pJREF1TmpZNE9UQTNRekF1TkRrd09UYzVJREF1Tmpjd016RXpJREF1TkRreU9EZzFJREF1TmpjeE1UQXlJREF1TkRrME9EY3lJREF1TmpjeE1UQXlTREF1TlRBMk9UY3lRekF1TlRBNE9UWWdNQzQyTnpFeE1ESWdNQzQxTVRBNE5qWWdNQzQyTnpBek1UTWdNQzQxTVRJeU56RWdNQzQyTmpnNU1EZERNQzQxTVRNMk56WWdNQzQyTmpjMU1ESWdNQzQxTVRRME5qWWdNQzQyTmpVMU9UWWdNQzQxTVRRME5qWWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQxTlRVd09UZFdNQzQyTmpNMk1EaERNQzQxTlRVd09UY2dNQzQyTmpVMU9UWWdNQzQxTlRVNE9EY2dNQzQyTmpjMU1ESWdNQzQxTlRjeU9USWdNQzQyTmpnNU1EZERNQzQxTlRnMk9UY2dNQzQyTnpBek1UTWdNQzQxTmpBMk1ETWdNQzQyTnpFeE1ESWdNQzQxTmpJMU9URWdNQzQyTnpFeE1ESklNQzQxTnpRNE1qbERNQzQxTnpZNE1UWWdNQzQyTnpFeE1ESWdNQzQxTnpnM01qSWdNQzQyTnpBek1UTWdNQzQxT0RBeE1qY2dNQzQyTmpnNU1EZERNQzQxT0RFMU16TWdNQzQyTmpjMU1ESWdNQzQxT0RJek1qSWdNQzQyTmpVMU9UWWdNQzQxT0RJek1qSWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQyTVRneE5ERkRNQzQyTWpBeU9UUWdNQzQyTWpVeU1qWWdNQzQyTWpJek15QXdMall5TkRNeE15QXdMall5TXpneU55QXdMall5TWpjMk5VTXdMall5TlRNeU5TQXdMall5TVRJeE5pQXdMall5TmpFMk9TQXdMall4T1RFMUlEQXVOakkyTVRnMUlEQXVOakUyT1RrMlZqQXVOVGd4TXpFMVNEQXVOalkwTXpReFF6QXVOalkxTXpNM0lEQXVOVGd4TXpNeklEQXVOalkyTXpJMklEQXVOVGd4TVRVeklEQXVOalkzTWpVeElEQXVOVGd3TnpnMFF6QXVOalk0TVRjMklEQXVOVGd3TkRFMklEQXVOalk1TURFNElEQXVOVGM1T0RZM0lEQXVOalk1TnpJNUlEQXVOVGM1TVRZNVF6QXVOamN3TkRNNUlEQXVOVGM0TkRjeElEQXVOamN4TURBMElEQXVOVGMzTmpNNUlEQXVOamN4TXpnNUlEQXVOVGMyTnpJeFF6QXVOamN4TnpjMElEQXVOVGMxT0RBeklEQXVOamN4T1RjeUlEQXVOVGMwT0RFM0lEQXVOamN4T1RjeUlEQXVOVGN6T0RJeFZqQXVOVFl4TlRnelF6QXVOamN4T1RjeUlEQXVOVFU1TlRrMklEQXVOamN4TVRneklEQXVOVFUzTmprZ01DNDJOamszTnpjZ01DNDFOVFl5T0RWRE1DNDJOamd6TnpJZ01DNDFOVFE0TnprZ01DNDJOalkwTmpZZ01DNDFOVFF3T1NBd0xqWTJORFEzT1NBd0xqVTFOREE1U0RBdU5qSTJNVGcxVmpBdU5URXpPRGN4U0RBdU5qWTBNelF4UXpBdU5qWTFNelF5SURBdU5URXpPRGc1SURBdU5qWTJNek0zSURBdU5URXpOekEzSURBdU5qWTNNalkzSURBdU5URXpNek0wUXpBdU5qWTRNVGszSURBdU5URXlPVFl5SURBdU5qWTVNRFF5SURBdU5URXlOREEySURBdU5qWTVOelUwSURBdU5URXhOekF4UXpBdU5qY3dORFkxSURBdU5URXdPVGsySURBdU5qY3hNREk0SURBdU5URXdNVFUySURBdU5qY3hOREE1SURBdU5UQTVNak5ETUM0Mk56RTNPU0F3TGpVd09ETXdNeUF3TGpZM01UazRNaUF3TGpVd056TXhJREF1TmpjeE9UY3lJREF1TlRBMk16QTRWakF1TkRrME1UUkRNQzQyTnpJd01TQXdMalE1TXpFeU1TQXdMalkzTVRnek9TQXdMalE1TWpFd05TQXdMalkzTVRRM01TQXdMalE1TVRFMU5VTXdMalkzTVRFd01pQXdMalE1TURJd05TQXdMalkzTURVME5DQXdMalE0T1RNek9TQXdMalkyT1RneklEQXVORGc0TmpFeVF6QXVOalk1TVRFMUlEQXVORGczT0RnMUlEQXVOalk0TWpZZ01DNDBPRGN6TVRFZ01DNDJOamN6TVRZZ01DNDBPRFk1TWpaRE1DNDJOall6TnpNZ01DNDBPRFkxTkNBd0xqWTJOVE0ySURBdU5EZzJNelV5SURBdU5qWTBNelF4SURBdU5EZzJNemN4U0RBdU5qSTJNVGcxVmpBdU5EUTJNelU0U0RBdU5qWTBNelF4V2swd0xqVTVOems1TnlBd0xqVTVOell3T0Vnd0xqUXdNemcwTjFZd0xqUXdNekU0TkVnd0xqVTVOems1TjFZd0xqVTVOell3T0ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpNME9GOHlNekV3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDRPQ0lnYUdWcFoyaDBQU0l3TGpnNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOakF3TlRnMklEQXVNRFl3TURVNE5pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjEzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI0MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IkdDUCBWUE4gLT4gQmFzdGlvbiBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9ODUzYWZlNTQtZGEwYS00MzI3LTgyMDgtMGRlNDY4OWViNjQ0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTMiIHNvdXJjZT0iNiIgdGFyZ2V0PSIxMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJHQ1AgVlBOIiBzdHlsZT0iaXIucmVmPTE2NzYxYzQ3LWQyMTQtNDJjZS1iODllLThmYWM2ZTQzOWRlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1HT09HTEUtQ0xPVUQtVlBOO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM09EQmZNalV3TXpZcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVE00VERBdU56UTROekF6SURBdU1UUTBPVEUzUXpBdU56UXhPVEEwSURBdU1UTXlPRFU1SURBdU56TXlNRGN5SURBdU1USXlOemcySURBdU56SXdNVGd5SURBdU1URTFOamsxUXpBdU56QTRNamt6SURBdU1UQTROakExSURBdU5qazBOelUzSURBdU1UQTBOelF6SURBdU5qZ3dPVEUySURBdU1UQTBORGt5U0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBOek0ySURBdU1qa3hPRFF4SURBdU1UQTROVGsxSURBdU1qYzVPVFVnTUM0eE1UVTJPRFpETUM0eU5qZ3dOVGtnTUM0eE1qSTNOemNnTUM0eU5UZ3lNamtnTUM0eE16STROVFFnTUM0eU5URTBNelVnTUM0eE5EUTVNVGRNTUM0d056QTFOVE16SURBdU5EVTROamt5UXpBdU1EWXpOamMzTWlBd0xqUTNNRFkxT0NBd0xqQTJNREExT0RZZ01DNDBPRFF5TVRjZ01DNHdOakF3TlRnMklEQXVORGs0TURFM1F6QXVNRFl3TURVNE5pQXdMalV4TVRneE9DQXdMakEyTXpZM056SWdNQzQxTWpVek56Y2dNQzR3TnpBMU5UTXpJREF1TlRNM016UXlUREF1TWpVeE16WTJJREF1T0RVek5Ua3lRekF1TWpVNE1Ea3pJREF1T0RZMU9ESTJJREF1TWpZM09EY3hJREF1T0RjMk1URXhJREF1TWpjNU56UTVJREF1T0Rnek5EUTRRekF1TWpreE5qSTRJREF1T0Rrd056ZzBJREF1TXpBMU1qQXlJREF1T0RrME9USXpJREF1TXpFNU1UVXpJREF1T0RrMU5EWXhTREF1Tmpnd09EUTNRekF1TmprME56azJJREF1T0RrME9UZ3lJREF1TnpBNE16Z3lJREF1T0Rrd09Ea3hJREF1TnpJd01qYzJJREF1T0Rnek5UZzRRekF1TnpNeU1UY2dNQzQ0TnpZeU9EWWdNQzQzTkRFNU5qVWdNQzQ0TmpZd01qRWdNQzQzTkRnM01ETWdNQzQ0TlRNM09UaE1NQzQ1TWprMU1UWWdNQzQxTXprek16WkRNQzQ1TXpZME5qY2dNQzQxTWpjeE5Ua2dNQzQ1TkRBeE1qTWdNQzQxTVRNek56a2dNQzQ1TkRBeE1qTWdNQzQwT1Rrek5UaERNQzQ1TkRBeE1qTWdNQzQwT0RVek16WWdNQzQ1TXpZME5qY2dNQzQwTnpFMU5UY2dNQzQ1TWprMU1UWWdNQzQwTlRrek9GWXdMalExT1RNNFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T1RNNU9UWXpJREF1TkRrME1UY3pUREF1TmprNE16YzFJREF1TWpVeU9UTk1NQzQxT0RVME9EZ2dNQzR6TmpVMk1URk1NQzQyTkRJZ01DNDBNakl4TWpOV01DNDBPVFkxTVRGTU1DNDFPRFV3TURZZ01DNDFNRGMxTVRGTU1DNDFNemM1TVRNZ01DNDBOakEwTVRkTU1DNDBPRFUyTmpNZ01DNDBOVGMxTTB3d0xqUXlOVGN4TXlBd0xqVXdNalE1TWt3d0xqTTJOalExSURBdU5EUXpNak5NTUM0eU5UTTVNRFlnTUM0MU5UWXpNak5NTUM0MU9USTNOelVnTUM0NE9UVXlOakZJTUM0Mk9EQTNOelZETUM0Mk9UUTNNalFnTUM0NE9UUTNPRElnTUM0M01EZ3pNU0F3TGpnNU1EWTVNU0F3TGpjeU1ESXdOQ0F3TGpnNE16TTRPVU13TGpjek1qQTVPQ0F3TGpnM05qQTROaUF3TGpjME1UZzVNeUF3TGpnMk5UZ3lNU0F3TGpjME9EWXpNU0F3TGpnMU16VTVPRXd3TGpreU9UUTBOQ0F3TGpVek9URXpOa013TGprek56TXlNeUF3TGpVeU5UVXlJREF1T1RRd09UZzBJREF1TlRBNU9EY3lJREF1T1RNNU9UWXpJREF1TkRrME1UY3pWakF1TkRrME1UY3pXaUlnWm1sc2JEMGlZbXhoWTJzaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTBPRGs0TnlBd0xqUTRNalkyTmtnd0xqVTBORFUxTmxZd0xqVXhOekEwTVVnd0xqWTBPRGs0TjFZd0xqUTRNalkyTmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRreU5UTWdNQzR6TlRNM05rZ3dMall5TkRnM09GWXdMalkwTmpJeU1rZ3dMalkxT1RJMU0xWXdMak0xTXpjMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZNU16WTNNaUF3TGpZek16YzRPVWd3TGpVNU1EWXhOVU13TGpVNE5qZ3hPQ0F3TGpZek16YzRPU0F3TGpVNE16YzBJREF1TmpNMk9EWTNJREF1TlRnek56UWdNQzQyTkRBMk5qUldNQzQzTkRNM01rTXdMalU0TXpjMElEQXVOelEzTlRFM0lEQXVOVGcyT0RFNElEQXVOelV3TlRrMUlEQXVOVGt3TmpFMUlEQXVOelV3TlRrMVNEQXVOamt6TmpjeVF6QXVOamszTkRZNUlEQXVOelV3TlRrMUlEQXVOekF3TlRRM0lEQXVOelEzTlRFM0lEQXVOekF3TlRRM0lEQXVOelF6TnpKV01DNDJOREEyTmpSRE1DNDNNREExTkRjZ01DNDJNelk0TmpjZ01DNDJPVGMwTmprZ01DNDJNek0zT0RrZ01DNDJPVE0yTnpJZ01DNDJNek0zT0RsYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmprek5qY3lJREF1TWpVd09UYzNTREF1TlRrd05qRTFRekF1TlRnMk9ERTRJREF1TWpVd09UYzNJREF1TlRnek56UWdNQzR5TlRRd05UVWdNQzQxT0RNM05DQXdMakkxTnpnMU1sWXdMak0yTURrd09FTXdMalU0TXpjMElEQXVNelkwTnpBMUlEQXVOVGcyT0RFNElEQXVNelkzTnpneklEQXVOVGt3TmpFMUlEQXVNelkzTnpnelNEQXVOamt6TmpjeVF6QXVOamszTkRZNUlEQXVNelkzTnpneklEQXVOekF3TlRRM0lEQXVNelkwTnpBMUlEQXVOekF3TlRRM0lEQXVNell3T1RBNFZqQXVNalUzT0RVeVF6QXVOekF3TlRRM0lEQXVNalUwTURVMUlEQXVOamszTkRZNUlEQXVNalV3T1RjM0lEQXVOamt6TmpjeUlEQXVNalV3T1RjM1dpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRMU56Y3pOaUF3TGpRNE1qWTJOa2d3TGpNMU1EZ3pWakF1TlRFM01EUXhTREF1TkRVM056TTJWakF1TkRneU5qWTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTJNakF3TmlBd0xqUTBNVFF3Tmtnd0xqSTFPRGsxUXpBdU1qVTFNVFV6SURBdU5EUXhOREEySURBdU1qVXlNRGMxSURBdU5EUTBORGcwSURBdU1qVXlNRGMxSURBdU5EUTRNamd4VmpBdU5UVXhNek0zUXpBdU1qVXlNRGMxSURBdU5UVTFNVE0wSURBdU1qVTFNVFV6SURBdU5UVTRNakV5SURBdU1qVTRPVFVnTUM0MU5UZ3lNVEpJTUM0ek5qSXdNRFpETUM0ek5qVTRNRE1nTUM0MU5UZ3lNVElnTUM0ek5qZzRPREVnTUM0MU5UVXhNelFnTUM0ek5qZzRPREVnTUM0MU5URXpNemRXTUM0ME5EZ3lPREZETUM0ek5qZzRPREVnTUM0ME5EUTBPRFFnTUM0ek5qVTRNRE1nTUM0ME5ERTBNRFlnTUM0ek5qSXdNRFlnTUM0ME5ERTBNRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF3TURZNElEQXVOVFUxTURZNFF6QXVORGc1TVRrZ01DNDFOVFV3TmpnZ01DNDBOemcxTlRjZ01DNDFOVEU0TkRNZ01DNDBOamsxTVRJZ01DNDFORFUzT1RsRE1DNDBOakEwTmpjZ01DNDFNemszTlRZZ01DNDBOVE0wTVRnZ01DNDFNekV4TmpZZ01DNDBORGt5TlRVZ01DNDFNakV4TVRaRE1DNDBORFV3T1RJZ01DNDFNVEV3TmpZZ01DNDBORFF3TURNZ01DNDFNREF3TURjZ01DNDBORFl4TWpVZ01DNDBPRGt6TXpoRE1DNDBORGd5TkRjZ01DNDBOemcyTmprZ01DNDBOVE0wT0RZZ01DNDBOamc0TmprZ01DNDBOakV4TnpnZ01DNDBOakV4TnpoRE1DNDBOamc0TmprZ01DNDBOVE0wT0RZZ01DNDBOemcyTmprZ01DNDBORGd5TkRjZ01DNDBPRGt6TXpnZ01DNDBORFl4TWpWRE1DNDFNREF3TURjZ01DNDBORFF3TURNZ01DNDFNVEV3TmpZZ01DNDBORFV3T1RJZ01DNDFNakV4TVRZZ01DNDBORGt5TlRWRE1DNDFNekV4TmpZZ01DNDBOVE0wTVRnZ01DNDFNemszTlRZZ01DNDBOakEwTmpjZ01DNDFORFUzT1RrZ01DNDBOamsxTVRKRE1DNDFOVEU0TkRNZ01DNDBOemcxTlRjZ01DNDFOVFV3TmpnZ01DNDBPRGt4T1NBd0xqVTFOVEEyT0NBd0xqVXdNREEyT0VNd0xqVTFOVEEyT0NBd0xqVXhORFkxTlNBd0xqVTBPVEkzTkNBd0xqVXlPRFkwTlNBd0xqVXpPRGsxT1NBd0xqVXpPRGsxT1VNd0xqVXlPRFkwTlNBd0xqVTBPVEkzTkNBd0xqVXhORFkxTlNBd0xqVTFOVEEyT0NBd0xqVXdNREEyT0NBd0xqVTFOVEEyT0ZZd0xqVTFOVEEyT0ZwTk1DNDFNREF3TmpnZ01DNDBOalUyT1RORE1DNDBPVE15TnlBd0xqUTJOVFk1TXlBd0xqUTROall5TkNBd0xqUTJOemN3T1NBd0xqUTRNRGszTVNBd0xqUTNNVFE0TjBNd0xqUTNOVE14T0NBd0xqUTNOVEkyTkNBd0xqUTNNRGt4TWlBd0xqUTRNRFl6TWlBd0xqUTJPRE14SURBdU5EZzJPVEUwUXpBdU5EWTFOekE0SURBdU5Ea3pNVGsxSURBdU5EWTFNREk0SURBdU5UQXdNVEEzSURBdU5EWTJNelUwSURBdU5UQTJOemMxUXpBdU5EWTNOamdnTUM0MU1UTTBORE1nTUM0ME56QTVOVFFnTUM0MU1UazFOamdnTUM0ME56VTNOaklnTUM0MU1qUXpOelZETUM0ME9EQTFOamtnTUM0MU1qa3hPRE1nTUM0ME9EWTJPVFFnTUM0MU16STBOVFlnTUM0ME9UTXpOaklnTUM0MU16TTNPRE5ETUM0MU1EQXdNeUF3TGpVek5URXdPU0F3TGpVd05qazBNaUF3TGpVek5EUXlPU0F3TGpVeE16SXlNeUF3TGpVek1UZ3lOME13TGpVeE9UVXdOQ0F3TGpVeU9USXlOU0F3TGpVeU5EZzNNeUF3TGpVeU5EZ3hPU0F3TGpVeU9EWTFJREF1TlRFNU1UWTJRekF1TlRNeU5ESTNJREF1TlRFek5URXpJREF1TlRNME5EUXpJREF1TlRBMk9EWTNJREF1TlRNME5EUXpJREF1TlRBd01EWTRRekF1TlRNME5EUXpJREF1TkRrd09UVXlJREF1TlRNd09ESXlJREF1TkRneU1qQTRJREF1TlRJME16YzFJREF1TkRjMU56WXlRekF1TlRFM09USTVJREF1TkRZNU16RTFJREF1TlRBNU1UZzFJREF1TkRZMU5qa3pJREF1TlRBd01EWTRJREF1TkRZMU5qa3pXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01GOHhOemd3WHpJMU1ETTJJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpnNElpQm9aV2xuYUhROUlqQXVPRGdpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBMk1EQTFPRFlnTUM0d05qQXdOVGcyS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTkiIHk9IjE4NSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzAzIiB5PSIyNyIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI0NjQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI1IiB2YWx1ZT0iU0FQIENJICsgV0QgKyBIQU5BIC0+IEdDUCBTdG9yYWdlIiBzdHlsZT0iaXIucmVmPTYwNjA4NmMxLTA3Y2UtNGU5YS05NTY1LTZlNDA4NTVkMmZhZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjExIiBzb3VyY2U9IjE0IiB0YXJnZXQ9IjE1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU0FQIENJICsgV0QgKyBIQU5BIiBpZD0iMTQiPjxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUdPT0dMRS1DTE9VRC1DT01QVVRFLUVOR0lORTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6SXpORGhmTWpNeE1EQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMamt5T1RVeE5pQXdMalExT1RZeU5Fd3dMamMwT0Rjd015QXdMakUwTlRFMk1VTXdMamMwTVRrd05DQXdMakV6TXpFd015QXdMamN6TWpBM01pQXdMakV5TXpBeklEQXVOekl3TVRneUlEQXVNVEUxT1RNNVF6QXVOekE0TWpreklEQXVNVEE0T0RRNUlEQXVOamswTnpVM0lEQXVNVEEwT1RnM0lEQXVOamd3T1RFMklEQXVNVEEwTnpNMlNEQXVNekU1TWpJeVF6QXVNekExTXpjNUlEQXVNVEEwT1RnZ01DNHlPVEU0TkRFZ01DNHhNRGc0TXprZ01DNHlOems1TlNBd0xqRXhOVGt6UXpBdU1qWTRNRFU1SURBdU1USXpNREl4SURBdU1qVTRNakk1SURBdU1UTXpNRGs0SURBdU1qVXhORE0xSURBdU1UUTFNVFl4VERBdU1EY3dOVFV6TXlBd0xqUTFPRGM1T1VNd0xqQTJNelkzTnpJZ01DNDBOekEzTmpRZ01DNHdOakF3TlRnMklEQXVORGcwTXpJeklEQXVNRFl3TURVNE5pQXdMalE1T0RFeU5FTXdMakEyTURBMU9EWWdNQzQxTVRFNU1qUWdNQzR3TmpNMk56Y3lJREF1TlRJMU5EZ3pJREF1TURjd05UVXpNeUF3TGpVek56UTBPVXd3TGpJMU1UTTJOaUF3TGpnMU16WTVPVU13TGpJMU9EQTVNeUF3TGpnMk5Ua3pNeUF3TGpJMk56ZzNNU0F3TGpnM05qSXhPQ0F3TGpJM09UYzBPU0F3TGpnNE16VTFORU13TGpJNU1UWXlPQ0F3TGpnNU1EZzVNU0F3TGpNd05USXdNaUF3TGpnNU5UQXlPU0F3TGpNeE9URTFNeUF3TGpnNU5UVTJPRWd3TGpZNE1EZzBOME13TGpZNU5EYzVOaUF3TGpnNU5UQTRPU0F3TGpjd09ETTRNaUF3TGpnNU1EazVPQ0F3TGpjeU1ESTNOaUF3TGpnNE16WTVOVU13TGpjek1qRTNJREF1T0RjMk16a3lJREF1TnpReE9UWTFJREF1T0RZMk1USTRJREF1TnpRNE56QXpJREF1T0RVek9UQTFUREF1T1RJNU5URTJJREF1TlRNNU5EUXpRekF1T1RNMk5EUXlJREF1TlRJM01qZ3lJREF1T1RRd01EZzBJREF1TlRFek5USTRJREF1T1RRd01EZzBJREF1TkRrNU5UTXpRekF1T1RRd01EZzBJREF1TkRnMU5UTTRJREF1T1RNMk5EUXlJREF1TkRjeE56ZzFJREF1T1RJNU5URTJJREF1TkRVNU5qSTBWakF1TkRVNU5qSTBXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU9EYzNOakkwSURBdU5qSTVNelk0VERBdU5UZ3dNRGMwSURBdU16TXhOelE1VERBdU5UVTROell5SURBdU16YzNPVFE1VERBdU5URXlNamczSURBdU16TXhOVFF6VERBdU5Ea3dPRE0zSURBdU16YzNOVE0zVERBdU5EUTFNRFE1SURBdU16TXhOamhNTUM0ME16TTJNemNnTUM0ek9EY3lNMHd3TGpNNU1qYzVPU0F3TGpNNU5ERXdOVXd3TGpNNE5ETTBNeUF3TGpRek1EUXdOVXd3TGpNek1UVTBNeUF3TGpRME16QTFOVXd3TGpNM09EZzBNeUF3TGpRNU1ETTFOVXd3TGpNek1qQXlOQ0F3TGpVeE1EazRUREF1TXpjNE9EUXpJREF1TlRVM056azVUREF1TXpNeE56UTVJREF1TlRjNE16VTFUREF1TmpRNE5qZzNJREF1T0RrMU1qa3pTREF1Tmpnd09EWXlRekF1TmprME9ERXhJREF1T0RrME9ERTBJREF1TnpBNE16azJJREF1T0Rrd056SXpJREF1TnpJd01qa2dNQzQ0T0RNME1qRkRNQzQzTXpJeE9EVWdNQzQ0TnpZeE1UZ2dNQzQzTkRFNU9DQXdMamcyTlRnMU15QXdMamMwT0RjeE9DQXdMamcxTXpZelREQXVPRGMzTmpJMElEQXVOakk1TXpZNFdpSWdabWxzYkQwaVlteGhZMnNpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVME1ERXpNaUF3TGpRMU1qWXpOMGd3TGpRMk1UWTRPRU13TGpRMU9UUTROeUF3TGpRMU1qWTFOU0F3TGpRMU56TTRNaUF3TGpRMU16VXpOeUF3TGpRMU5UZ3lOU0F3TGpRMU5UQTVNME13TGpRMU5ESTJPU0F3TGpRMU5qWTBPU0F3TGpRMU16TTROeUF3TGpRMU9EYzFOU0F3TGpRMU16TTJPU0F3TGpRMk1EazFOVll3TGpVek9UTTVPVU13TGpRMU16TTJPU0F3TGpVME1UWXhNaUF3TGpRMU5ESTBNeUF3TGpVME16Y3pOU0F3TGpRMU5UZ3dNU0F3TGpVME5UTXdOa013TGpRMU56TTJJREF1TlRRMk9EYzNJREF1TkRVNU5EYzFJREF1TlRRM056WTVJREF1TkRZeE5qZzRJREF1TlRRM056ZzNTREF1TlRRd01UTXlRekF1TlRReU1qazJJREF1TlRRM05qazRJREF1TlRRME16UXlJREF1TlRRMk56YzFJREF1TlRRMU9EUXhJREF1TlRRMU1qRXlRekF1TlRRM016UXhJREF1TlRRek5qUTRJREF1TlRRNE1UYzNJREF1TlRReE5UWTFJREF1TlRRNE1UYzFJREF1TlRNNU16azVWakF1TkRZd09UVTFRekF1TlRRNE1UVTNJREF1TkRVNE56VTFJREF1TlRRM01qYzFJREF1TkRVMk5qUTVJREF1TlRRMU56RTVJREF1TkRVMU1Ea3pRekF1TlRRME1UWXpJREF1TkRVek5UTTNJREF1TlRReU1EVTNJREF1TkRVeU5qVTFJREF1TlRNNU9EVTNJREF1TkRVeU5qTTNJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qWTBNelF4SURBdU5EUTJNelU0UXpBdU5qWTFNek0zSURBdU5EUTJNemMzSURBdU5qWTJNekkySURBdU5EUTJNVGsySURBdU5qWTNNalV4SURBdU5EUTFPREk0UXpBdU5qWTRNVGMySURBdU5EUTFORFlnTUM0Mk5qa3dNVGdnTUM0ME5EUTVNVEVnTUM0Mk5qazNNamtnTUM0ME5EUXlNVE5ETUM0Mk56QTBNemtnTUM0ME5ETTFNVFVnTUM0Mk56RXdNRFFnTUM0ME5ESTJPRE1nTUM0Mk56RXpPRGtnTUM0ME5ERTNOalZETUM0Mk56RTNOelFnTUM0ME5EQTRORFlnTUM0Mk56RTVOeklnTUM0ME16azROakVnTUM0Mk56RTVOeklnTUM0ME16ZzROalZXTUM0ME1qWTJNamRETUM0Mk56RTVOeklnTUM0ME1qUTJOQ0F3TGpZM01URTRNeUF3TGpReU1qY3pOQ0F3TGpZMk9UYzNOeUF3TGpReU1UTXlPRU13TGpZMk9ETTNNaUF3TGpReE9Ua3lNeUF3TGpZMk5qUTJOaUF3TGpReE9URXpOQ0F3TGpZMk5EUTNPU0F3TGpReE9URXpORWd3TGpZeU5qRTROVll3TGpNNE16STBOa013TGpZeU5qRTJOeUF3TGpNNE1UQTBOU0F3TGpZeU5USTROU0F3TGpNM09EazBJREF1TmpJek56STRJREF1TXpjM016ZzBRekF1TmpJeU1UY3lJREF1TXpjMU9ESTNJREF1TmpJd01EWTNJREF1TXpjME9UUTFJREF1TmpFM09EWTJJREF1TXpjME9USTNTREF1TlRneU1EUTNWakF1TXpNMk9EUkRNQzQxT0RJd05EY2dNQzR6TXpRNE5USWdNQzQxT0RFeU5UZ2dNQzR6TXpJNU5EWWdNQzQxTnprNE5USWdNQzR6TXpFMU5ERkRNQzQxTnpnME5EY2dNQzR6TXpBeE16WWdNQzQxTnpZMU5ERWdNQzR6TWprek5EWWdNQzQxTnpRMU5UTWdNQzR6TWprek5EWklNQzQxTmpJek1UWkRNQzQxTmpBek56Y2dNQzR6TWprME1UY2dNQzQxTlRnMU5DQXdMak16TURJek9DQXdMalUxTnpFNU5DQXdMak16TVRZek5rTXdMalUxTlRnME9DQXdMak16TXpBek15QXdMalUxTlRBNU5pQXdMak16TkRnNU9TQXdMalUxTlRBNU55QXdMak16TmpnMFZqQXVNemMxTVRNMFNEQXVOVEUwTlRNMVZqQXVNek0yT0RSRE1DNDFNVFExTXpVZ01DNHpNelU0TlNBd0xqVXhORE16T1NBd0xqTXpORGczSURBdU5URXpPVFU0SURBdU16TXpPVFUyUXpBdU5URXpOVGMzSURBdU16TXpNRFF5SURBdU5URXpNREU1SURBdU16TXlNakV6SURBdU5URXlNekUySURBdU16TXhOVEUyUXpBdU5URXhOakV5SURBdU16TXdPRElnTUM0MU1UQTNOemdnTUM0ek16QXlOamtnTUM0MU1EazROakVnTUM0ek1qazRPVGRETUM0MU1EZzVORFFnTUM0ek1qazFNalFnTUM0MU1EYzVOaklnTUM0ek1qa3pNemNnTUM0MU1EWTVOeklnTUM0ek1qa3pORFpJTUM0ME9UUTROekpETUM0ME9USTRPRFVnTUM0ek1qa3pORFlnTUM0ME9UQTVOemtnTUM0ek16QXhNellnTUM0ME9EazFOek1nTUM0ek16RTFOREZETUM0ME9EZ3hOamdnTUM0ek16STVORFlnTUM0ME9EY3pOemdnTUM0ek16UTROVElnTUM0ME9EY3pOemdnTUM0ek16WTRORll3TGpNM05URXpORWd3TGpRME56QTVNVll3TGpNek5qZzBRekF1TkRRM01Ea3hJREF1TXpNME9EVXlJREF1TkRRMk16QXhJREF1TXpNeU9UUTJJREF1TkRRME9EazJJREF1TXpNeE5UUXhRekF1TkRRek5Ea3hJREF1TXpNd01UTTJJREF1TkRReE5UZzFJREF1TXpJNU16UTJJREF1TkRNNU5UazNJREF1TXpJNU16UTJTREF1TkRJM016WkRNQzQwTWpZek56WWdNQzR6TWprek5EWWdNQzQwTWpVME1ERWdNQzR6TWprMU5DQXdMalF5TkRRNU1pQXdMak15T1RreE5rTXdMalF5TXpVNE15QXdMak16TURJNU15QXdMalF5TWpjMU55QXdMak16TURnME5TQXdMalF5TWpBMk1TQXdMak16TVRVME1VTXdMalF5TVRNMk5TQXdMak16TWpJek55QXdMalF5TURneE15QXdMak16TXpBMk15QXdMalF5TURRek5pQXdMak16TXprM01rTXdMalF5TURBMklEQXVNek0wT0RneElEQXVOREU1T0RZMklEQXVNek0xT0RVMklEQXVOREU1T0RZMklEQXVNek0yT0RSV01DNHpOelV4TXpSSU1DNHpPRFF4TVRaRE1DNHpPREU1TXpnZ01DNHpOelV4TXpJZ01DNHpOems0TkRZZ01DNHpOelU1TnpnZ01DNHpOemd5T0NBd0xqTTNOelE1TWtNd0xqTTNOamN4TlNBd0xqTTNPVEF3TmlBd0xqTTNOVGdnTUM0ek9ERXdOeUF3TGpNM05UY3lPQ0F3TGpNNE16STBObFl3TGpReE9Ea3lOMGd3TGpNek56VTNNa013TGpNek5UVTROU0F3TGpReE9Ea3lOeUF3TGpNek16WTNPU0F3TGpReE9UY3hOeUF3TGpNek1qSTNNeUF3TGpReU1URXlNa013TGpNek1EZzJPQ0F3TGpReU1qVXlOeUF3TGpNek1EQTNPQ0F3TGpReU5EUXpOQ0F3TGpNek1EQTNPQ0F3TGpReU5qUXlNVll3TGpRek9EWTFPRU13TGpNek1EQTNPQ0F3TGpRME1EWTBOaUF3TGpNek1EZzJPQ0F3TGpRME1qVTFNaUF3TGpNek1qSTNNeUF3TGpRME16azFOME13TGpNek16WTNPU0F3TGpRME5UTTJNeUF3TGpNek5UVTROU0F3TGpRME5qRTFNaUF3TGpNek56VTNNaUF3TGpRME5qRTFNa2d3TGpNM05UY3lPRll3TGpRNE5qTTNNVWd3TGpNek56VTNNa013TGpNek5UVTROU0F3TGpRNE5qTTNNU0F3TGpNek16WTNPU0F3TGpRNE56RTJJREF1TXpNeU1qY3pJREF1TkRnNE5UWTJRekF1TXpNd09EWTRJREF1TkRnNU9UY3hJREF1TXpNd01EYzRJREF1TkRreE9EYzNJREF1TXpNd01EYzRJREF1TkRrek9EWTFWakF1TlRBMk16QTRRekF1TXpNd01EWTVJREF1TlRBM01qazRJREF1TXpNd01qVTJJREF1TlRBNE1qZ2dNQzR6TXpBMk1qa2dNQzQxTURreE9UZERNQzR6TXpFd01ESWdNQzQxTVRBeE1UUWdNQzR6TXpFMU5USWdNQzQxTVRBNU5Ea2dNQzR6TXpJeU5Ea2dNQzQxTVRFMk5USkRNQzR6TXpJNU5EWWdNQzQxTVRJek5UVWdNQzR6TXpNM056VWdNQzQxTVRJNU1UTWdNQzR6TXpRMk9EZ2dNQzQxTVRNeU9UUkRNQzR6TXpVMk1ESWdNQzQxTVRNMk56VWdNQzR6TXpZMU9ESWdNQzQxTVRNNE56RWdNQzR6TXpjMU56SWdNQzQxTVRNNE56RklNQzR6TnpVM01qaFdNQzQxTlRReE5UaElNQzR6TXpjMU56SkRNQzR6TXpVMU9EVWdNQzQxTlRReE5UZ2dNQzR6TXpNMk56a2dNQzQxTlRRNU5EZ2dNQzR6TXpJeU56TWdNQzQxTlRZek5UTkRNQzR6TXpBNE5qZ2dNQzQxTlRjM05Ua2dNQzR6TXpBd056Z2dNQzQxTlRrMk5qVWdNQzR6TXpBd056Z2dNQzQxTmpFMk5USldNQzQxTnpNNE9VTXdMak16TURBM09DQXdMalUzTlRnM055QXdMak16TURnMk9DQXdMalUzTnpjNE15QXdMak16TWpJM015QXdMalUzT1RFNE9VTXdMak16TXpZM09TQXdMalU0TURVNU5DQXdMak16TlRVNE5TQXdMalU0TVRNNE15QXdMak16TnpVM01pQXdMalU0TVRNNE0wZ3dMak0zTlRjeU9GWXdMall4TmprNU5rTXdMak0zTlRjME5pQXdMall4T1RFNU55QXdMak0zTmpZeU9TQXdMall5TVRNd01pQXdMak0zT0RFNE5TQXdMall5TWpnMU9FTXdMak0zT1RjME1TQXdMall5TkRReE5TQXdMak00TVRnME5pQXdMall5TlRJNU55QXdMak00TkRBME55QXdMall5TlRNeE5VZ3dMalF4T1RnMk5sWXdMalkyTXpZd09FTXdMalF4T1RnMk5pQXdMalkyTkRVNU15QXdMalF5TURBMklEQXVOalkxTlRZM0lEQXVOREl3TkRNMklEQXVOalkyTkRjMlF6QXVOREl3T0RFeklEQXVOalkzTXpnMUlEQXVOREl4TXpZMUlEQXVOalk0TWpFeElEQXVOREl5TURZeElEQXVOalk0T1RBM1F6QXVOREl5TnpVM0lEQXVOalk1TmpBeklEQXVOREl6TlRneklEQXVOamN3TVRVMUlEQXVOREkwTkRreUlEQXVOamN3TlRNeVF6QXVOREkxTkRBeElEQXVOamN3T1RBNElEQXVOREkyTXpjMklEQXVOamN4TVRBeUlEQXVOREkzTXpZZ01DNDJOekV4TURKSU1DNDBNemsxT1RkRE1DNDBOREExT0RFZ01DNDJOekV4TURJZ01DNDBOREUxTlRZZ01DNDJOekE1TURnZ01DNDBOREkwTmpVZ01DNDJOekExTXpKRE1DNDBORE16TnpRZ01DNDJOekF4TlRVZ01DNDBORFF5SURBdU5qWTVOakF6SURBdU5EUTBPRGsySURBdU5qWTRPVEEzUXpBdU5EUTFOVGt5SURBdU5qWTRNakV4SURBdU5EUTJNVFEwSURBdU5qWTNNemcxSURBdU5EUTJOVEl4SURBdU5qWTJORGMyUXpBdU5EUTJPRGszSURBdU5qWTFOVFkzSURBdU5EUTNNRGt4SURBdU5qWTBOVGt6SURBdU5EUTNNRGt4SURBdU5qWXpOakE0VmpBdU5qSTFNekUxU0RBdU5EZzNNemM0VmpBdU5qWXpOakE0UXpBdU5EZzNNemM0SURBdU5qWTFOVGsySURBdU5EZzRNVFk0SURBdU5qWTNOVEF5SURBdU5EZzVOVGN6SURBdU5qWTRPVEEzUXpBdU5Ea3dPVGM1SURBdU5qY3dNekV6SURBdU5Ea3lPRGcxSURBdU5qY3hNVEF5SURBdU5EazBPRGN5SURBdU5qY3hNVEF5U0RBdU5UQTJPVGN5UXpBdU5UQTRPVFlnTUM0Mk56RXhNRElnTUM0MU1UQTROallnTUM0Mk56QXpNVE1nTUM0MU1USXlOekVnTUM0Mk5qZzVNRGRETUM0MU1UTTJOellnTUM0Mk5qYzFNRElnTUM0MU1UUTBOallnTUM0Mk5qVTFPVFlnTUM0MU1UUTBOallnTUM0Mk5qTTJNRGhXTUM0Mk1qVXpNVFZJTUM0MU5UVXdPVGRXTUM0Mk5qTTJNRGhETUM0MU5UVXdPVGNnTUM0Mk5qVTFPVFlnTUM0MU5UVTRPRGNnTUM0Mk5qYzFNRElnTUM0MU5UY3lPVElnTUM0Mk5qZzVNRGRETUM0MU5UZzJPVGNnTUM0Mk56QXpNVE1nTUM0MU5qQTJNRE1nTUM0Mk56RXhNRElnTUM0MU5qSTFPVEVnTUM0Mk56RXhNREpJTUM0MU56UTRNamxETUM0MU56WTRNVFlnTUM0Mk56RXhNRElnTUM0MU56ZzNNaklnTUM0Mk56QXpNVE1nTUM0MU9EQXhNamNnTUM0Mk5qZzVNRGRETUM0MU9ERTFNek1nTUM0Mk5qYzFNRElnTUM0MU9ESXpNaklnTUM0Mk5qVTFPVFlnTUM0MU9ESXpNaklnTUM0Mk5qTTJNRGhXTUM0Mk1qVXpNVFZJTUM0Mk1UZ3hOREZETUM0Mk1qQXlPVFFnTUM0Mk1qVXlNallnTUM0Mk1qSXpNeUF3TGpZeU5ETXhNeUF3TGpZeU16Z3lOeUF3TGpZeU1qYzJOVU13TGpZeU5UTXlOU0F3TGpZeU1USXhOaUF3TGpZeU5qRTJPU0F3TGpZeE9URTFJREF1TmpJMk1UZzFJREF1TmpFMk9UazJWakF1TlRneE16RTFTREF1TmpZME16UXhRekF1TmpZMU16TTNJREF1TlRneE16TXpJREF1TmpZMk16STJJREF1TlRneE1UVXpJREF1TmpZM01qVXhJREF1TlRnd056ZzBRekF1TmpZNE1UYzJJREF1TlRnd05ERTJJREF1TmpZNU1ERTRJREF1TlRjNU9EWTNJREF1TmpZNU56STVJREF1TlRjNU1UWTVRekF1Tmpjd05ETTVJREF1TlRjNE5EY3hJREF1TmpjeE1EQTBJREF1TlRjM05qTTVJREF1TmpjeE16ZzVJREF1TlRjMk56SXhRekF1TmpjeE56YzBJREF1TlRjMU9EQXpJREF1TmpjeE9UY3lJREF1TlRjME9ERTNJREF1TmpjeE9UY3lJREF1TlRjek9ESXhWakF1TlRZeE5UZ3pRekF1TmpjeE9UY3lJREF1TlRVNU5UazJJREF1TmpjeE1UZ3pJREF1TlRVM05qa2dNQzQyTmprM056Y2dNQzQxTlRZeU9EVkRNQzQyTmpnek56SWdNQzQxTlRRNE56a2dNQzQyTmpZME5qWWdNQzQxTlRRd09TQXdMalkyTkRRM09TQXdMalUxTkRBNVNEQXVOakkyTVRnMVZqQXVOVEV6T0RjeFNEQXVOalkwTXpReFF6QXVOalkxTXpReUlEQXVOVEV6T0RnNUlEQXVOalkyTXpNM0lEQXVOVEV6TnpBM0lEQXVOalkzTWpZM0lEQXVOVEV6TXpNMFF6QXVOalk0TVRrM0lEQXVOVEV5T1RZeUlEQXVOalk1TURReUlEQXVOVEV5TkRBMklEQXVOalk1TnpVMElEQXVOVEV4TnpBeFF6QXVOamN3TkRZMUlEQXVOVEV3T1RrMklEQXVOamN4TURJNElEQXVOVEV3TVRVMklEQXVOamN4TkRBNUlEQXVOVEE1TWpORE1DNDJOekUzT1NBd0xqVXdPRE13TXlBd0xqWTNNVGs0TWlBd0xqVXdOek14SURBdU5qY3hPVGN5SURBdU5UQTJNekE0VmpBdU5EazBNVFJETUM0Mk56SXdNU0F3TGpRNU16RXlNU0F3TGpZM01UZ3pPU0F3TGpRNU1qRXdOU0F3TGpZM01UUTNNU0F3TGpRNU1URTFOVU13TGpZM01URXdNaUF3TGpRNU1ESXdOU0F3TGpZM01EVTBOQ0F3TGpRNE9UTXpPU0F3TGpZMk9UZ3pJREF1TkRnNE5qRXlRekF1TmpZNU1URTFJREF1TkRnM09EZzFJREF1TmpZNE1qWWdNQzQwT0Rjek1URWdNQzQyTmpjek1UWWdNQzQwT0RZNU1qWkRNQzQyTmpZek56TWdNQzQwT0RZMU5DQXdMalkyTlRNMklEQXVORGcyTXpVeUlEQXVOalkwTXpReElEQXVORGcyTXpjeFNEQXVOakkyTVRnMVZqQXVORFEyTXpVNFNEQXVOalkwTXpReFdrMHdMalU1TnprNU55QXdMalU1TnpZd09FZ3dMalF3TXpnME4xWXdMalF3TXpFNE5FZ3dMalU1TnprNU4xWXdMalU1TnpZd09Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qTTBPRjh5TXpFd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0NJZ2FHVnBaMmgwUFNJd0xqZzRJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpBd05UZzJJREF1TURZd01EVTROaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnJlZj0zNGMxODlhOS0xODgyLTQ5NzctOTk1MS00OGYwYjY1MjIxYWI7IiBwYXJlbnQ9IjExIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSIxMDUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iR0NQIFN0b3JhZ2UiIGlkPSIxNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTkwNzI5NDJkLTE0YTAtNDViNi04MzY4LThkNjAyOTAxZmU4MDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nb29nbGUtc3RvcmFnZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDVPRGd6TWpVZ01DNDBOakkxTUROTU1DNDNPRFl3TVRjZ01DNHhNVEEyTmtNd0xqYzNPRFF3T1NBd0xqQTVOekUyT0RJZ01DNDNOamMwTURnZ01DNHdPRFU0T1RjM0lEQXVOelUwTVRBMUlEQXVNRGMzT1RZME5FTXdMamMwTURnd01pQXdMakEzTURBek1URWdNQzQzTWpVMk5UY2dNQzR3TmpVM01UQXpJREF1TnpFd01UY2dNQzR3TmpVME1qazNTREF1TXpBMU5EYzNRekF1TWpnNU9UZzVJREF1TURZMU56QXlOaUF3TGpJM05EZzBNU0F3TGpBM01EQXlNRE1nTUM0eU5qRTFNellnTUM0d056YzVOVFF6UXpBdU1qUTRNak15SURBdU1EZzFPRGc0TkNBd0xqSXpOekl6TXlBd0xqQTVOekUyTXpFZ01DNHlNamsyTXpFZ01DNHhNVEEyTmt3d0xqQXlOekkwTlRNZ01DNDBOakUxT0VNd0xqQXhPVFUxTVRjZ01DNDBOelE1TmpjZ01DNHdNVFUxTURJNUlEQXVORGt3TVRNNElEQXVNREUxTlRBeU9TQXdMalV3TlRVM09VTXdMakF4TlRVd01qa2dNQzQxTWpFd01pQXdMakF4T1RVMU1UY2dNQzQxTXpZeE9URWdNQzR3TWpjeU5EVXpJREF1TlRRNU5UYzVUREF1TWpJNU5UVTBJREF1T1RBek5ESXlRekF1TWpNM01EZ3hJREF1T1RFM01URWdNQzR5TkRnd01qRWdNQzQ1TWpnMk1UZ2dNQzR5TmpFek1USWdNQzQ1TXpZNE1qWkRNQzR5TnpRMk1ESWdNQzQ1TkRVd016VWdNQzR5T0RrM09TQXdMamswT1RZMk5TQXdMak13TlRRZ01DNDVOVEF5TmpkSU1DNDNNVEF3T1RSRE1DNDNNalUzTURFZ01DNDVORGszTXpJZ01DNDNOREE1TURJZ01DNDVORFV4TlRVZ01DNDNOVFF5TVNBd0xqa3pOams0TkVNd0xqYzJOelV4T0NBd0xqa3lPRGd4TXlBd0xqYzNPRFEzTnlBd0xqa3hOek15T0NBd0xqYzROakF4TnlBd0xqa3dNelkxTTB3d0xqazRPRE15TlNBd0xqVTFNVGd4UXpBdU9UazJNRGMwSURBdU5UTTRNakF6SURFdU1EQXdNVFVnTUM0MU1qSTRNVFVnTVM0d01EQXhOU0F3TGpVd056RTFOa014TGpBd01ERTFJREF1TkRreE5EazRJREF1T1RrMk1EYzBJREF1TkRjMk1UQTVJREF1T1RnNE16STFJREF1TkRZeU5UQXpWakF1TkRZeU5UQXpXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU5qY3lPVGMwSURBdU5EQTBNamszVERBdU16azBOalkySURBdU5ESTVPVEV5VERBdU16UXdPRElnTUM0ME9ETTNOVGhNTUM0ek9EWTVOelFnTUM0MU1qazVNVEZNTUM0ek5ERXlNRFVnTUM0Mk1UQXdOalJNTUM0Mk9ERXlNRFVnTUM0NU5UQXdOakZJTUM0M01EazVOelJETUM0M01qVTFPREVnTUM0NU5EazFNalVnTUM0M05EQTNPRElnTUM0NU5EUTVORGdnTUM0M05UUXdPU0F3TGprek5qYzNOME13TGpjMk56TTVPQ0F3TGpreU9EWXdOeUF3TGpjM09ETTFPQ0F3TGpreE56RXlNaUF3TGpjNE5UZzVOeUF3TGprd016UTBOa3d3TGpreU5qZzVOeUF3TGpZMU9ESXhPRXd3TGpZM01qazNOQ0F3TGpRd05ESTVOMW9pSUdacGJHdzlJbUpzWVdOcklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOalk0TkNBd0xqUXdNakV3TlVnd0xqTTBPREEzTVVNd0xqTTBOamd5SURBdU5EQXlNRFkwSURBdU16UTFOVGN5SURBdU5EQXlNamN6SURBdU16UTBOREF6SURBdU5EQXlOekl5UXpBdU16UXpNak0wSURBdU5EQXpNVGNnTUM0ek5ESXhOallnTUM0ME1ETTRORGdnTUM0ek5ERXlOak1nTUM0ME1EUTNNVFZETUM0ek5EQXpOaUF3TGpRd05UVTRNeUF3TGpNek9UWXpPU0F3TGpRd05qWXlNaUF3TGpNek9URTBOQ0F3TGpRd056YzNNa013TGpNek9EWTBPU0F3TGpRd09Ea3lNaUF3TGpNek9ETTRPQ0F3TGpReE1ERTJJREF1TXpNNE16YzVJREF1TkRFeE5ERXlWakF1TkRjM016TTFRekF1TXpNNE16YzVJREF1TkRjNU9EQXpJREF1TXpNNU16WWdNQzQwT0RJeE56RWdNQzR6TkRFeE1EVWdNQzQwT0RNNU1UWkRNQzR6TkRJNE5URWdNQzQwT0RVMk5qSWdNQzR6TkRVeU1UZ2dNQzQwT0RZMk5ESWdNQzR6TkRjMk9EY2dNQzQwT0RZMk5ESklNQzQyTmpZNE5FTXdMalkyT1RNd015QXdMalE0TmpZeU1pQXdMalkzTVRZMU9TQXdMalE0TlRZek5TQXdMalkzTXpRZ01DNDBPRE00T1RSRE1DNDJOelV4TkRFZ01DNDBPREl4TlRNZ01DNDJOell4TWpnZ01DNDBOemszT1RjZ01DNDJOell4TkRnZ01DNDBOemN6TXpWV01DNDBNVEUwTVRKRE1DNDJOell4TWpnZ01DNDBNRGc1TlNBd0xqWTNOVEUwTVNBd0xqUXdOalU1TkNBd0xqWTNNelFnTUM0ME1EUTROVE5ETUM0Mk56RTJOVGtnTUM0ME1ETXhNVElnTUM0Mk5qa3pNRE1nTUM0ME1ESXhNalVnTUM0Mk5qWTROQ0F3TGpRd01qRXdOVll3TGpRd01qRXdOVnBOTUM0Mk1UYzFNek1nTUM0ME5qTTJORE5ETUM0Mk1UTTNOaUF3TGpRMk16WTBNeUF3TGpZeE1EQTNNU0F3TGpRMk1qVXlOQ0F3TGpZd05qa3pOQ0F3TGpRMk1EUXlPRU13TGpZd016YzVOeUF3TGpRMU9ETXpNU0F3TGpZd01UTTFNaUF3TGpRMU5UTTFNaUF3TGpVNU9Ua3dPQ0F3TGpRMU1UZzJOa013TGpVNU9EUTJOQ0F3TGpRME9ETTRJREF1TlRrNE1EZzJJREF1TkRRME5UUTFJREF1TlRrNE9ESXlJREF1TkRRd09EUTBRekF1TlRrNU5UVTRJREF1TkRNM01UUTBJREF1TmpBeE16YzFJREF1TkRNek56UTBJREF1TmpBME1EUXpJREF1TkRNeE1EYzNRekF1TmpBMk56RXhJREF1TkRJNE5EQTVJREF1TmpFd01URWdNQzQwTWpZMU9USWdNQzQyTVRNNE1URWdNQzQwTWpVNE5UWkRNQzQyTVRjMU1USWdNQzQwTWpVeE1pQXdMall5TVRNME55QXdMalF5TlRRNU55QXdMall5TkRnek15QXdMalF5TmprME1VTXdMall5T0RNeE9TQXdMalF5T0RNNE5TQXdMall6TVRJNU9DQXdMalF6TURneklEQXVOak16TXprMUlEQXVORE16T1RZM1F6QXVOak0xTkRreElEQXVORE0zTVRBMElEQXVOak0yTmpFZ01DNDBOREEzT1RNZ01DNDJNelkyTVNBd0xqUTBORFUyTmtNd0xqWXpOall4SURBdU5EUTNNRGN4SURBdU5qTTJNVEUySURBdU5EUTVOVFV5SURBdU5qTTFNVFU0SURBdU5EVXhPRFkyUXpBdU5qTTBNVGs1SURBdU5EVTBNVGd4SURBdU5qTXlOemswSURBdU5EVTJNamcwSURBdU5qTXhNREl5SURBdU5EVTRNRFUxUXpBdU5qSTVNalV4SURBdU5EVTVPREkzSURBdU5qSTNNVFE0SURBdU5EWXhNak15SURBdU5qSTBPRE16SURBdU5EWXlNVGxETUM0Mk1qSTFNVGtnTUM0ME5qTXhORGtnTUM0Mk1qQXdNemdnTUM0ME5qTTJORE1nTUM0Mk1UYzFNek1nTUM0ME5qTTJORE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalkyT0RRMklEQXVOVEk0T0RFMFNEQXVNelE0TURjMlF6QXVNelEyTnpreUlEQXVOVEk0TnpjeElEQXVNelExTlRFeklEQXVOVEk0T1RreUlEQXVNelEwTXpFM0lEQXVOVEk1TkRZMFF6QXVNelF6TVRJeUlEQXVOVEk1T1RNMklEQXVNelF5TURNMklEQXVOVE13TmpRNUlEQXVNelF4TVRJNElEQXVOVE14TlRVM1F6QXVNelF3TWpFNUlEQXVOVE15TkRZMklEQXVNek01TlRBM0lEQXVOVE16TlRVeUlEQXVNek01TURNMUlEQXVOVE0wTnpRM1F6QXVNek00TlRZeklEQXVOVE0xT1RReUlEQXVNek00TXpReElEQXVOVE0zTWpJeUlEQXVNek00TXpnMElEQXVOVE00TlRBMlZqQXVOakEwTkRJNFF6QXVNek00TkRBMElEQXVOakEyT0RreElEQXVNek01TXpreElEQXVOakE1TWpRM0lEQXVNelF4TVRNeUlEQXVOakV3T1RnNFF6QXVNelF5T0RjMElEQXVOakV5TnpJNUlEQXVNelExTWpJNUlEQXVOakV6TnpFMklEQXVNelEzTmpreUlEQXVOakV6TnpNMlNEQXVOalkyT0RRMlF6QXVOalk1TXpBNElEQXVOakV6TnpFMklEQXVOamN4TmpZMElEQXVOakV5TnpJNUlEQXVOamN6TkRBMUlEQXVOakV3T1RnNFF6QXVOamMxTVRRMklEQXVOakE1TWpRM0lEQXVOamMyTVRNeklEQXVOakEyT0RreElEQXVOamMyTVRVeklEQXVOakEwTkRJNFZqQXVOVE00TVRJeFF6QXVOamMyTVRNeklEQXVOVE0xTmpVNUlEQXVOamMxTVRRMklEQXVOVE16TXpBeklEQXVOamN6TkRBMUlEQXVOVE14TlRZeVF6QXVOamN4TmpZMElEQXVOVEk1T0RJeElEQXVOalk1TXpBNElEQXVOVEk0T0RNMElEQXVOalkyT0RRMklEQXVOVEk0T0RFMFZqQXVOVEk0T0RFMFdrMHdMall4TnpVek9DQXdMalU1TURNMU1rTXdMall4TXpjMk5TQXdMalU1TURNMU1pQXdMall4TURBM055QXdMalU0T1RJek15QXdMall3Tmprek9TQXdMalU0TnpFek4wTXdMall3TXpnd01pQXdMalU0TlRBME1TQXdMall3TVRNMU55QXdMalU0TWpBMk1TQXdMalU1T1RreE15QXdMalUzT0RVM05VTXdMalU1T0RRMk9TQXdMalUzTlRBNE9TQXdMalU1T0RBNU1pQXdMalUzTVRJMU5DQXdMalU1T0RneU9DQXdMalUyTnpVMU0wTXdMalU1T1RVMk5DQXdMalUyTXpnMU15QXdMall3TVRNNE1TQXdMalUyTURRMU5DQXdMall3TkRBME9TQXdMalUxTnpjNE5rTXdMall3TmpjeE55QXdMalUxTlRFeE9DQXdMall4TURFeE5pQXdMalUxTXpNd01TQXdMall4TXpneE5pQXdMalUxTWpVMk5VTXdMall4TnpVeE55QXdMalUxTVRneU9TQXdMall5TVRNMU15QXdMalUxTWpJd05pQXdMall5TkRnek9DQXdMalUxTXpZMVF6QXVOakk0TXpJMElEQXVOVFUxTURrMElEQXVOak14TXpBMElEQXVOVFUzTlRNNUlEQXVOak16TkNBd0xqVTJNRFkzTjBNd0xqWXpOVFE1TmlBd0xqVTJNemd4TkNBd0xqWXpOall4TlNBd0xqVTJOelV3TWlBd0xqWXpOall4TlNBd0xqVTNNVEkzTlVNd0xqWXpOall4TlNBd0xqVTNNemM0SURBdU5qTTJNVEl4SURBdU5UYzJNall4SURBdU5qTTFNVFl6SURBdU5UYzROVGMxUXpBdU5qTTBNakEwSURBdU5UZ3dPRGtnTUM0Mk16STNPVGtnTUM0MU9ESTVPVE1nTUM0Mk16RXdNamNnTUM0MU9EUTNOalJETUM0Mk1qa3lOVFlnTUM0MU9EWTFNellnTUM0Mk1qY3hOVE1nTUM0MU9EYzVOREVnTUM0Mk1qUTRNemdnTUM0MU9EZzVRekF1TmpJeU5USTBJREF1TlRnNU9EVTRJREF1TmpJd01EUXpJREF1TlRrd016VXlJREF1TmpFM05UTTRJREF1TlRrd016VXlXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1T0RRMk1UVWlJR2hsYVdkb2REMGlNQzQ1T0RRMk1EWWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakF4TlRNNE1Ea2dNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIxMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MCIgeT0iMjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI2IiB2YWx1ZT0iU0FQIFJvdXRlciAtPiBTQVAgQ0kgKyBXRCArIEhBTkEiIHN0eWxlPSJpci5yZWY9NmUyMTYwNjItYjQ5OC00Y2U2LWE4YmQtMmIzMGM3M2MyYWRiO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjciIHNvdXJjZT0iNSIgdGFyZ2V0PSIxNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMyIiB2YWx1ZT0iQmFzdGlvbiBTZXJ2ZXIgLT4gR0NQIFN0b3JhZ2UiIHN0eWxlPSJpci5yZWY9ZTI4ZDVkMzAtODBmMC00OGZiLWI5YTMtY2M1OWQyZDkxZWRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNyIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iQmFzdGlvbiBTZXJ2ZXIgLT4gU0FQIENJICsgV0QgKyBIQU5BIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9Yzk1OGNhMjUtYmVlYS00ZmEzLThhODctN2RlMjI5MmVkMjQ4O2lyLnRhZ3M9YWRtaW47IiBwYXJlbnQ9IjciIHNvdXJjZT0iMTIiIHRhcmdldD0iMTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHg9IjAuMTI3NiIgeT0iOSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgYXM9Im9mZnNldCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMjIxIiB5PSI1OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI1NzkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgiIHZhbHVlPSJCcm93c2VyIiBzdHlsZT0iaXIucmVmPTViOGVjYWMxLTU1ZmUtNGY5Mi1hYTA0LTI1YzkzZjc3MmM2Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1CUk9XU0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpVd05WOHlNekl5T0NraVBqeHdZWFJvSUdROUlrMHdMakl3TURnd05pQXdMakk1T0RZME4wTXdMakl3TURnd05pQXdMakl6T1RneU5DQXdMakkwT0RBeU55QXdMakU1TWpFek9TQXdMak13TmpJM055QXdMakU1TWpFek9VZ3dMalk0TlRrM00wTXdMamMwTkRJeU15QXdMakU1TWpFek9TQXdMamM1TVRRME5DQXdMakl6T1RneU5DQXdMamM1TVRRME5DQXdMakk1T0RZME4xWXdMalE1Tmpjd05rTXdMamMzT0RNNU5pQXdMalE0T0RVME55QXdMamMyTkRJMElEQXVORGd5TURJMUlEQXVOelE1TWpVMUlEQXVORGMzTkRJeVZqQXVNell5TlRVeFNEQXVNalF5T1RrMFZqQXVOamd5TURjMVF6QXVNalF5T1RrMElEQXVOekUzTXpZNUlEQXVNamN4TXpJM0lEQXVOelExT1RnZ01DNHpNRFl5TnpjZ01DNDNORFU1T0Vnd0xqVTBNamt6TlVNd0xqVTFNalU1TkNBd0xqYzJNVGszTWlBd0xqVTJORFl6SURBdU56YzJNelFnTUM0MU56ZzFORGNnTUM0M09EZzFPRE5JTUM0ek1EWXlOemRETUM0eU5EZ3dNamNnTUM0M09EZzFPRE1nTUM0eU1EQTRNRFlnTUM0M05EQTRPVGdnTUM0eU1EQTRNRFlnTUM0Mk9ESXdOelZXTUM0eU9UZzJORGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVOalUxTkRZM0lEQXVOekkwT0RJeFNEQXVOelE0TXpjM1F6QXVOek01TURjMElEQXVOemMwTXprMElEQXVOekl3TkRRMUlEQXVPREE0TVRNNUlEQXVOekF4T1RJeUlEQXVPREE0TVRNNVF6QXVOamd6T1RZZ01DNDRNRGd4TXprZ01DNDJOalU0T1RrZ01DNDNOelkwTURnZ01DNDJOVFl6TXpnZ01DNDNNamt5T0RSTU1DNDJOVFUwTmpjZ01DNDNNalE0TWpGSU1DNDNORGd6TnpkSU1DNDJOVFUwTmpkYVRUQXVOVFkzT0RVMUlEQXVOekkwT0RJMFREQXVOak15TkRZMklEQXVOekkwT0RKRE1DNDJNemM1TXprZ01DNDNOVFl6TnpRZ01DNDJORGN5TVRjZ01DNDNPRE15TVRnZ01DNDJOVGt6TlRrZ01DNDRNREl3TURSRE1DNDJNakE1TURFZ01DNDNPVEExTXpVZ01DNDFPRGc0T0RNZ01DNDNOak01TkRNZ01DNDFOekF3TlRFZ01DNDNNamt3TlV3d0xqVTJOemcxTlNBd0xqY3lORGd5TkZwTk1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkVNd0xqZ3hOelV4TWlBd0xqYzJNVGM1TWlBd0xqYzRORFE0TVNBd0xqYzVNREEzTmlBd0xqYzBORFVnTUM0NE1ERTVPVGxETUM0M05UVTRNak1nTUM0M09EUTBOVGNnTUM0M05qUTJOVGNnTUM0M05UazVNRGdnTUM0M056QXlNek1nTUM0M016RXdOalpNTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORXd3TGpjM01UTTNPQ0F3TGpjeU5EZ3lXazB3TGpjM05Ua3lOQ0F3TGpZeU5qTXlNMHd3TGpnME9UQXdOQ0F3TGpZeU5qTXhNME13TGpnMU1EazNNaUF3TGpZek5qRXdOeUF3TGpnMU1qQXdOaUF3TGpZME5qSTBOQ0F3TGpnMU1qQXdOaUF3TGpZMU5qWXlOVU13TGpnMU1qQXdOaUF3TGpZM01qUTJOU0F3TGpnME9UVTVPU0F3TGpZNE56Y3pPQ0F3TGpnME5URXpOU0F3TGpjd01qQTVNa2d3TGpjM05EVTJOME13TGpjM05qRTBOeUF3TGpZNE56VTRNU0F3TGpjM05qazNOU0F3TGpZM01qTXpOU0F3TGpjM05qazNOU0F3TGpZMU5qWXlOVU13TGpjM05qazNOU0F3TGpZME9UYzBJREF1TnpjMk9ERTJJREF1TmpReU9UUTFJREF1TnpjMk5UQTFJREF1TmpNMk1qWXhUREF1TnpjMU9USTBJREF1TmpJMk16SXpUREF1T0RRNU1EQTBJREF1TmpJMk16RXpUREF1TnpjMU9USTBJREF1TmpJMk16SXpXazB3TGpVMU5EZzBJREF1TmpJMk16RXpUREF1TmpJM09USWdNQzQyTWpZek1qTkRNQzQyTWpjeU1qWWdNQzQyTXpZeE56SWdNQzQyTWpZNE5qZ2dNQzQyTkRZeU9UZ2dNQzQyTWpZNE5qZ2dNQzQyTlRZMk1qVkRNQzQyTWpZNE5qZ2dNQzQyTmpreE9UTWdNQzQyTWpjek9UZ2dNQzQyT0RFME5qUWdNQzQyTWpnME1Ua2dNQzQyT1RNeU9UbE1NQzQyTWpreU56WWdNQzQzTURJd09USklNQzQxTlRnM01EbERNQzQxTlRReU5EVWdNQzQyT0RjM016Z2dNQzQxTlRFNE16Z2dNQzQyTnpJME5qVWdNQzQxTlRFNE16Z2dNQzQyTlRZMk1qVkRNQzQxTlRFNE16Z2dNQzQyTkRZeU5EUWdNQzQxTlRJNE56SWdNQzQyTXpZeE1EY2dNQzQxTlRRNE5DQXdMall5TmpNeE0xcE5NQzQyTlRBMU16UWdNQzQyTWpZek1UUklNQzQzTlRNek1VTXdMamMxTkRBMk5DQXdMall6TmpBNU9DQXdMamMxTkRRMk5pQXdMalkwTmpJek15QXdMamMxTkRRMk5pQXdMalkxTmpZeU5VTXdMamMxTkRRMk5pQXdMalkyT1RNeE9DQXdMamMxTXpnMk55QXdMalk0TVRZeU9TQXdMamMxTWpjMU9DQXdMalk1TXpNNE0wd3dMamMxTVRnek15QXdMamN3TWpBNU1rZ3dMalkxTWpBeE1VTXdMalkxTURNeE5TQXdMalk0TnpjMklEQXVOalE1TXpjM0lEQXVOamN5TkRreUlEQXVOalE1TXpjM0lEQXVOalUyTmpJMVF6QXVOalE1TXpjM0lEQXVOalE0T0RNeElEQXVOalE1TmpBMElEQXVOalF4TVRneElEQXVOalV3TURNMUlEQXVOak16TnpFMlREQXVOalV3TlRNMElEQXVOakkyTXpFMFNEQXVOelV6TXpGSU1DNDJOVEExTXpSYVRUQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1F6QXVOemc1TnpjNElEQXVOVEkwTnpRNElEQXVPREkyTVRVeklEQXVOVFU1TWpRM0lEQXVPRFF5TlRVM0lEQXVOakF6TlRneVREQXVOemN6TmpZMklEQXVOakF6TlRnM1F6QXVOelk0T1RNeElEQXVOVFkyT1RZeUlEQXVOelU1TXpFeklEQXVOVE0xTlRBNElEQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1REQXVOelEyTVRBMElEQXVOVEV6T0RJMldrMHdMalkxTnpVek1TQXdMalV4TVRnd05Vd3dMalkxT1RNMU9DQXdMalV4TVRJME4wTXdMalkwTmpFME1TQXdMalV6TVRZNU55QXdMall6TmpNeE9DQXdMalUyTVRZNU5pQXdMall6TVRFd01TQXdMalU1TmpreU1rd3dMall6TURFM055QXdMall3TXpVNE4wd3dMalUyTVRJNE5pQXdMall3TXpVNE1rTXdMalUzTnpRM0lEQXVOVFU1T0RRMUlEQXVOakV6TURnNElEQXVOVEkxTmpneElEQXVOalUzTlRNeElEQXVOVEV4T0RBMVREQXVOalU1TXpVNElEQXVOVEV4TWpRM1REQXVOalUzTlRNeElEQXVOVEV4T0RBMVdrMHdMamN3TVRreU1pQXdMalV3TlRFeE1VTXdMamN5TVRjeE1pQXdMalV3TlRFeE1TQXdMamMwTVRZeU1pQXdMalUwTXpZeU9DQXdMamMxTURFMU1TQXdMalU1T0RneE0wd3dMamMxTURnMU5DQXdMall3TXpVNE0wZ3dMalkxTWprNVF6QXVOall4TURnMElEQXVOVFExT0RZZ01DNDJPREUxTmpjZ01DNDFNRFV4TVRFZ01DNDNNREU1TWpJZ01DNDFNRFV4TVRGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQQzluUGp4a1pXWnpQanhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpVd05WOHlNekl5T0NJK1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iMjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE2IiB2YWx1ZT0iUmljaCBDbGllbnQiIHN0eWxlPSJpci5yZWY9MzZhOWVjYjktMDA0MS00MTk2LWJlMDctYTJmYzE0ZmZlMmM1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJpY2gtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORFFnTUM0eE5qTXdPRFpJTUM0eU5UWXdPVE5ETUM0eE9UQTRNemtnTUM0eE5qTXdPRFlnTUM0eE16YzVNemtnTUM0eU1UVTVOVE1nTUM0eE16YzVNemtnTUM0eU9ERXhOamRXTUM0Mk16VXlOVEZETUM0eE16YzVNemtnTUM0M01EQTBOallnTUM0eE9UQTRNemtnTUM0M05UTXpNeklnTUM0eU5UWXdPVE1nTUM0M05UTXpNekpJTUM0ek56UTFORE5XTUM0NE1UTXdNRFJNTUM0eU9EVTVPRFVnTUM0NE1UTXdNRFZETUM0eU5qazJOeklnTUM0NE1UTXdNRFVnTUM0eU5UWTBORGNnTUM0NE1qWXlNaklnTUM0eU5UWTBORGNnTUM0NE5ESTFNalpETUM0eU5UWTBORGNnTUM0NE5UZzRNamtnTUM0eU5qazJOeklnTUM0NE56SXdORFlnTUM0eU9EVTVPRFlnTUM0NE56SXdORFpNTUM0Mk9Ua3lPVFlnTUM0NE56SXdORE5ETUM0M01UVTJNU0F3TGpnM01qQTBNaUF3TGpjeU9EZ3pOU0F3TGpnMU9EZ3lOaUF3TGpjeU9EZ3pOQ0F3TGpnME1qVXlNa013TGpjeU9EZ3pOQ0F3TGpneU5qSXhPQ0F3TGpjeE5UWXdPU0F3TGpneE16QXdNaUF3TGpZNU9USTVOaUF3TGpneE16QXdNa3d3TGpZeE1EY3lPQ0F3TGpneE16QXdNMVl3TGpjMU16TXpNa2d3TGpjeU9EY3dPVU13TGpjNU16azJNeUF3TGpjMU16TXpNaUF3TGpnME5qZzJNeUF3TGpjd01EUTJOaUF3TGpnME5qZzJNeUF3TGpZek5USTFNVll3TGpZeU1ESXlPRU13TGpneU5qZzFPQ0F3TGpZek5qY3pPU0F3TGpnd05EZzBNU0F3TGpZMU1Ea3dNeUF3TGpjNE1USXpOaUF3TGpZMk1qSTVPRU13TGpjM01UUXhPU0F3TGpZNE1UTWdNQzQzTlRFMU9ESWdNQzQyT1RReU9USWdNQzQzTWpnM01Ea2dNQzQyT1RReU9USklNQzQyTlRBek9UaGFUVEF1TlRVeE5qVXhJREF1T0RFek1EQXpUREF1TkRNek5qSWdNQzQ0TVRNd01EUldNQzQzTlRNek16SklNQzQxTlRFMk5URldNQzQ0TVRNd01ETmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qSTVNREE1SURBdU5qUXpNamMwUXpBdU56YzFNakk1SURBdU5qUXpNamMwSURBdU9Ea3pOell6SURBdU5USTBOelFnTUM0NE9UTTNOak1nTUM0ek56ZzFNakZETUM0NE9UTTNOak1nTUM0eU16SXpNRE1nTUM0M056VXlNamtnTUM0eE1UTTNOeUF3TGpZeU9UQXdPU0F3TGpFeE16YzNRekF1TkRneU56a3lJREF1TVRFek56Y2dNQzR6TmpReU5UZ2dNQzR5TXpJek1ETWdNQzR6TmpReU5UZ2dNQzR6TnpnMU1qRkRNQzR6TmpReU5UZ2dNQzQxTWpRM05DQXdMalE0TWpjNU1pQXdMalkwTXpJM05DQXdMall5T1RBd09TQXdMalkwTXpJM05GcE5NQzQyT1RFME5qa2dNQzR5TXpJeU1EZERNQzQyT1RBMk9UTWdNQzR5TWpZME9DQXdMalk0TlRjNE15QXdMakl5TWpBMk5pQXdMalkzT1RnME5DQXdMakl5TWpBMk5rd3dMalkzT0RJMU1TQXdMakl5TWpFM00wd3dMalkzTmpjeU15QXdMakl5TWpRNE5VTXdMalkzTVRjMU9TQXdMakl5TXpnMU1TQXdMalkyT0RFeElEQXVNakk0TXprNUlEQXVOalk0TVRFZ01DNHlNek0zT1RsV01DNHlOamc1T0ROSU1DNDJOREEzTVRkTU1DNDJOREEzTXpJZ01DNHlNek0zT1RsTU1DNDJOREEyTWpVZ01DNHlNekl5TURkRE1DNDJNems0TkRrZ01DNHlNalkwT0NBd0xqWXpORGt6T1NBd0xqSXlNakEyTmlBd0xqWXlPU0F3TGpJeU1qQTJOa3d3TGpZeU56UXdOeUF3TGpJeU1qRTNNME13TGpZeU1UWTNPU0F3TGpJeU1qazFJREF1TmpFM01qWTJJREF1TWpJM09EVTVJREF1TmpFM01qWTJJREF1TWpNek56azVUREF1TmpFM01qVWdNQzR5TmpnNU9ETklNQzQxT0RrNE9EaFdNQzR5TXpNM09UbE1NQzQxT0RrM09ERWdNQzR5TXpJeU1EZERNQzQxT0Rrd01EVWdNQzR5TWpZME9DQXdMalU0TkRBNU5TQXdMakl5TWpBMk5pQXdMalUzT0RFMU5pQXdMakl5TWpBMk5rTXdMalUzTVRZM05DQXdMakl5TWpBMk5pQXdMalUyTmpReU1pQXdMakl5TnpNeE9TQXdMalUyTmpReU1pQXdMakl6TXpjNU9Vd3dMalUyTmpReU9TQXdMakkzTURFM01VTXdMalUwTXpRME5DQXdMakkzTkRnek5DQXdMalV5TlRNek55QXdMakk1TWprek5TQXdMalV5TURZMk5DQXdMak14TlRreE4wd3dMalE0TkRJNE9TQXdMak14TlRrek1rd3dMalE0TWpZNU55QXdMak14TmpBMFF6QXVORGMyT1RZNUlEQXVNekUyT0RFMklEQXVORGN5TlRVMUlEQXVNekl4TnpJMUlEQXVORGN5TlRVMUlEQXVNekkzTmpZMVREQXVORGN5TmpZeUlEQXVNekk1TWpVM1F6QXVORGN6TkRNNElEQXVNek0wT1RnMUlEQXVORGM0TXpRNElEQXVNek01TXprNUlEQXVORGcwTWpnNUlEQXVNek01TXprNVREQXVOVEU1TkRnNUlEQXVNek01TXpnelZqQXVNelkyTnpZeFREQXVORGcwTWpnNUlEQXVNelkyTnpjMlREQXVORGd5TmprM0lEQXVNelkyT0RnMFF6QXVORGMyT1RZNUlEQXVNelkzTmpZeElEQXVORGN5TlRVMUlEQXVNemN5TlRjZ01DNDBOekkxTlRVZ01DNHpOemcxTVV3d0xqUTNNalkyTWlBd0xqTTRNREV3TWtNd0xqUTNNelF6T0NBd0xqTTROVGd5T1NBd0xqUTNPRE0wT0NBd0xqTTVNREkwTXlBd0xqUTROREk0T1NBd0xqTTVNREkwTTB3d0xqVXhPVFE0T1NBd0xqTTVNREl5TjFZd0xqUXhOell3TlV3d0xqUTROREk0T1NBd0xqUXhOell5TVV3d0xqUTRNalk1TnlBd0xqUXhOemN5T0VNd0xqUTNOamsyT1NBd0xqUXhPRFV3TlNBd0xqUTNNalUxTlNBd0xqUXlNelF4TkNBd0xqUTNNalUxTlNBd0xqUXlPVE0xTkVNd0xqUTNNalUxTlNBd0xqUXpOVGd6TkNBd0xqUTNOemd3T0NBd0xqUTBNVEE0TnlBd0xqUTROREk0T1NBd0xqUTBNVEE0TjB3d0xqVXlNRFkyTWlBd0xqUTBNVEE0TjBNd0xqVXlOVE15T0NBd0xqUTJOREEzTnlBd0xqVTBNelF6T0NBd0xqUTRNakU0TlNBd0xqVTJOalF5T1NBd0xqUTROamcwT0V3d0xqVTJOalF5TWlBd0xqVXlNekl5TVV3d0xqVTJOalV5T0NBd0xqVXlORGd4TTBNd0xqVTJOek13TnlBd0xqVXpNRFUwSURBdU5UY3lNakUwSURBdU5UTTBPVFUwSURBdU5UYzRNVFUySURBdU5UTTBPVFUwVERBdU5UYzVOelEySURBdU5UTTBPRFEzUXpBdU5UZzFORGMwSURBdU5UTTBNRGNnTUM0MU9EazRPRGdnTUM0MU1qa3hOaUF3TGpVNE9UZzRPQ0F3TGpVeU16SXlNVll3TGpRNE9EQXdOVWd3TGpZeE56STFUREF1TmpFM01qWTJJREF1TlRJek1qSXhUREF1TmpFM016Y3pJREF1TlRJME9ERXpRekF1TmpFNE1UVXhJREF1TlRNd05UUWdNQzQyTWpNd05UZ2dNQzQxTXpRNU5UUWdNQzQyTWprZ01DNDFNelE1TlRSTU1DNDJNekExT1NBd0xqVXpORGcwTjBNd0xqWXpOak14T0NBd0xqVXpOREEzSURBdU5qUXdOek15SURBdU5USTVNVFlnTUM0Mk5EQTNNeklnTUM0MU1qTXlNakZNTUM0Mk5EQTNNVGNnTUM0ME9EZ3dNRFZJTUM0Mk5qZ3hNVll3TGpVeU16SXlNVXd3TGpZMk9ESXhOeUF3TGpVeU5EZ3hNME13TGpZMk9EazVOU0F3TGpVek1EVTBJREF1Tmpjek9UQXpJREF1TlRNME9UVTBJREF1TmpjNU9EUTBJREF1TlRNME9UVTBRekF1TmpnMk16SXpJREF1TlRNME9UVTBJREF1TmpreE5UYzJJREF1TlRJNU56QXhJREF1TmpreE5UYzJJREF1TlRJek1qSXhUREF1TmpreE5UZzJJREF1TkRnMk9EUTFRekF1TnpFME5UWXpJREF1TkRneU1UYzNJREF1TnpNeU5qWTBJREF1TkRZME1EYzRJREF1TnpNM016TXpJREF1TkRReE1Vd3dMamMzTXpjeElEQXVORFF4TURnM1REQXVOemMxTXpBeklEQXVORFF3T1RoRE1DNDNPREV3TWprZ01DNDBOREF5TURNZ01DNDNPRFUwTkRJZ01DNDBNelV5T1RRZ01DNDNPRFUwTkRJZ01DNDBNamt6TlRSTU1DNDNPRFV6TXpZZ01DNDBNamMzTmpKRE1DNDNPRFExTlRrZ01DNDBNakl3TXpVZ01DNDNOemsyTlNBd0xqUXhOell5TVNBd0xqYzNNemN4SURBdU5ERTNOakl4U0RBdU56TTROVEZXTUM0ek9UQXlORE5JTUM0M056TTNNVXd3TGpjM05UTXdNeUF3TGpNNU1ERXpOa013TGpjNE1UQXlPU0F3TGpNNE9UTTFPU0F3TGpjNE5UUTBNaUF3TGpNNE5EUTFJREF1TnpnMU5EUXlJREF1TXpjNE5URk1NQzQzT0RVek16WWdNQzR6TnpZNU1UaERNQzQzT0RRMU5Ua2dNQzR6TnpFeE9URWdNQzQzTnprMk5TQXdMak0yTmpjM05pQXdMamMzTXpjeElEQXVNelkyTnpjMlNEQXVOek00TlRGV01DNHpNemt6T1RsSU1DNDNOek0zTVV3d0xqYzNOVE13TXlBd0xqTXpPVEk1TWtNd0xqYzRNVEF5T1NBd0xqTXpPRFV4TlNBd0xqYzROVFEwTWlBd0xqTXpNell3TmlBd0xqYzROVFEwTWlBd0xqTXlOelkyTlVNd0xqYzROVFEwTWlBd0xqTXlNVEU0TmlBd0xqYzRNREU1SURBdU16RTFPVE15SURBdU56Y3pOekVnTUM0ek1UVTVNekpNTUM0M016Y3pNemNnTUM0ek1UVTVNelZETUM0M016STJOeklnTUM0eU9USTVOU0F3TGpjeE5EVTJPU0F3TGpJM05EZzBNeUF3TGpZNU1UVTROaUF3TGpJM01ERTNOVXd3TGpZNU1UVTNOaUF3TGpJek16YzVPVXd3TGpZNU1UUTJPU0F3TGpJek1qSXdOMXBOTUM0MU5ESTVOVFVnTUM0ek1qYzJOalZETUM0MU5ESTVOVFVnTUM0ek1EZ3lNalVnTUM0MU5UZzNNVFFnTUM0eU9USTBOallnTUM0MU56Z3hOVFlnTUM0eU9USTBOalpJTUM0Mk56azRORFJETUM0Mk9Ua3lPRFFnTUM0eU9USTBOallnTUM0M01UVXdORFFnTUM0ek1EZ3lNalVnTUM0M01UVXdORFFnTUM0ek1qYzJOalZXTUM0ME1qa3pOVFJETUM0M01UVXdORFFnTUM0ME5EZzNPVFFnTUM0Mk9Ua3lPRFFnTUM0ME5qUTFOVFFnTUM0Mk56azRORFFnTUM0ME5qUTFOVFJJTUM0MU56Z3hOVFpETUM0MU5UZzNNVFFnTUM0ME5qUTFOVFFnTUM0MU5ESTVOVFVnTUM0ME5EZzNPVFFnTUM0MU5ESTVOVFVnTUM0ME1qa3pOVFJXTUM0ek1qYzJOalZhVFRBdU5qYzJNREVnTUM0ek56ZzFPRGRETUM0Mk56WXdNU0F3TGpNMU1qWTJOaUF3TGpZMU5EazVOeUF3TGpNek1UWTFOQ0F3TGpZeU9UQTNOaUF3TGpNek1UWTFORU13TGpZd016RTFOU0F3TGpNek1UWTFOQ0F3TGpVNE1qRTBOQ0F3TGpNMU1qWTJOaUF3TGpVNE1qRTBOQ0F3TGpNM09EVTROME13TGpVNE1qRTBOQ0F3TGpRd05EVXdPQ0F3TGpZd016RTFOU0F3TGpReU5UVXlJREF1TmpJNU1EYzJJREF1TkRJMU5USkRNQzQyTlRRNU9UY2dNQzQwTWpVMU1pQXdMalkzTmpBeElEQXVOREEwTlRBNElEQXVOamMyTURFZ01DNHpOemcxT0RkYVRUQXVOakExTmpFZ01DNHpOemcxT0RkRE1DNDJNRFUyTVNBd0xqTTJOVFl5TnlBd0xqWXhOakV4TmlBd0xqTTFOVEV5SURBdU5qSTVNRGMySURBdU16VTFNVEpETUM0Mk5ESXdNellnTUM0ek5UVXhNaUF3TGpZMU1qVTBNaUF3TGpNMk5UWXlOeUF3TGpZMU1qVTBNaUF3TGpNM09EVTROME13TGpZMU1qVTBNaUF3TGpNNU1UVTBOeUF3TGpZME1qQXpOaUF3TGpRd01qQTFNeUF3TGpZeU9UQTNOaUF3TGpRd01qQTFNME13TGpZeE5qRXhOaUF3TGpRd01qQTFNeUF3TGpZd05UWXhJREF1TXpreE5UUTNJREF1TmpBMU5qRWdNQzR6TnpnMU9EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iODgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJHZW5lcmljIENsaWVudCIgc3R5bGU9ImlyLnJlZj01ZDlkMmZlNC02ZDg5LTQzYTAtODU2NC1jODA2MjNhNzYzNDg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z2VuZXJpYy1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHlOVFl6TXpjZ01DNDJPVFF5T1RKRE1DNHlOREUwTnlBd0xqWTVOREk1TWlBd0xqSXlOemc0TmlBd0xqWTRPRGd3TXlBd0xqSXhOelV3TWlBd0xqWTNPVGMwTTBNd0xqSXhNVGt4SURBdU5qYzBPRFkwSURBdU1qQTNNalEySURBdU5qWTRPVFE1SURBdU1qQXpPREVnTUM0Mk5qSXlPVGhETUM0eE9UazJNalFnTUM0Mk5UUXhPVFVnTUM0eE9UY3lOakVnTUM0Mk5EUTVPVGtnTUM0eE9UY3lOakVnTUM0Mk16VXlOVEZXTUM0eU9ERXhOamhETUM0eE9UY3lOakVnTUM0eU5EZzFOaUF3TGpJeU16Y3hJREF1TWpJeU1USTNJREF1TWpVMk16TTNJREF1TWpJeU1USTNUREF1TmpNME5EUTNJREF1TWpJeU1USTNUREF1TlRrMU5qQTNJREF1TVRZek1EZzJUREF1TWpVMk16TTNJREF1TVRZek1EZzJRekF1TVRreE1EZ3pJREF1TVRZek1EZzJJREF1TVRNNE1UZzBJREF1TWpFMU9UVXpJREF1TVRNNE1UZzBJREF1TWpneE1UWTRWakF1TmpNMU1qVXhRekF1TVRNNE1UZzBJREF1TmpRNE16Y3pJREF1TVRRd016STJJREF1TmpZd09UazJJREF1TVRRME1qYzVJREF1TmpjeU56ZzVRekF1TVRVd01UUTVJREF1Tmprd01qazRJREF1TVRZd01ERXpJREF1TnpBMU9UYzRJREF1TVRjeU56a2dNQzQzTVRnM05EZERNQzR4T1RReE56SWdNQzQzTkRBeE1UWWdNQzR5TWpNM01TQXdMamMxTXpNek15QXdMakkxTmpNek55QXdMamMxTXpNek0wZ3dMak0zTkRjNE4xWXdMamd4TXpBd05Vd3dMakk0TmpJeU9TQXdMamd4TXpBd05VTXdMakkyT1RreE5pQXdMamd4TXpBd05pQXdMakkxTmpZNU1TQXdMamd5TmpJeU1pQXdMakkxTmpZNU1TQXdMamcwTWpVeU5rTXdMakkxTmpZNU1TQXdMamcxT0RneklEQXVNalk1T1RFMklEQXVPRGN5TURRMklEQXVNamcyTWpNZ01DNDROekl3TkRaTU1DNDJPVGsxTkNBd0xqZzNNakEwTTBNd0xqY3hOVGcxTkNBd0xqZzNNakEwTXlBd0xqY3lPVEEzT1NBd0xqZzFPRGd5TmlBd0xqY3lPVEEzT1NBd0xqZzBNalV5TWtNd0xqY3lPVEEzT0NBd0xqZ3lOakl4T1NBd0xqY3hOVGcxTXlBd0xqZ3hNekF3TWlBd0xqWTVPVFUwSURBdU9ERXpNREF5VERBdU5qRXdPVGN5SURBdU9ERXpNREF6VmpBdU56VXpNek16U0RBdU56STRPVFV6UXpBdU56UXlPRFV6SURBdU56VXpNek16SURBdU56VTJNVGt6SURBdU56VXdPVE0wSURBdU56WTROVGdnTUM0M05EWTFNamRETUM0NE1EY3dOelVnTUM0M016STRNelVnTUM0NE16WXpOekVnTUM0Mk9UazNOVGNnTUM0NE5EUTNNRFlnTUM0Mk5Ua3dORGxETUM0NE5EWXlPQ0F3TGpZMU1UTTJNaUF3TGpnME56RXdOeUF3TGpZME16UXdNeUF3TGpnME56RXdOeUF3TGpZek5USTFNVll3TGpJNE1URTJOME13TGpnME56RXdOeUF3TGpJeE5UazFNeUF3TGpjNU5ESXdOeUF3TGpFMk16QTROaUF3TGpjeU9EazFNeUF3TGpFMk16QTROa2d3TGpVNU5UWXdOMHd3TGpZek5EUTBOeUF3TGpJeU1qRXlOMGd3TGpjeU9EazFNME13TGpjMk1UVTRJREF1TWpJeU1USTNJREF1TnpnNE1ETWdNQzR5TkRnMU5pQXdMamM0T0RBeklEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVOemc0TURNZ01DNDJORFE1T1RrZ01DNDNPRFUyTmpZZ01DNDJOVFF4T1RVZ01DNDNPREUwT0NBd0xqWTJNakk1T0VNd0xqYzNOREk0T1NBd0xqWTNOakl4T0NBd0xqYzJNVGN5TVNBd0xqWTROamt4TXlBd0xqYzBOalV5TVNBd0xqWTVNVFl6TjBNd0xqYzBNRGszTVNBd0xqWTVNek0yTWlBd0xqY3pOVEEzTVNBd0xqWTVOREk1TWlBd0xqY3lPRGsxTXlBd0xqWTVOREk1TWtnd0xqSTFOak16TjFwTk1DNDBNek00TmpRZ01DNDRNVE13TURSTU1DNDFOVEU0T1RVZ01DNDRNVE13TUROV01DNDNOVE16TXpOSU1DNDBNek00TmpSV01DNDRNVE13TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TURBeU5EUXhOREVnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iNDAwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJJbnRlcm5ldCIgc3R5bGU9ImlyLnJlZj1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTciIHk9Ii0xNjciIHdpZHRoPSI1OTIiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0yNzk4NjIxOC00ZjIzLTQ1MDItOWI4OC1lNzU3YmE0YzEyNmI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjUxIiB5PSIyOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOCIgdmFsdWU9IlJpY2ggQ2xpZW50IiBzdHlsZT0iaXIucmVmPThmNWU3NWExLTJlYTEtNGUxOC1hYWZiLWNhYTZiN2ZhOWQ2Zjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1yaWNoLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRRZ01DNHhOak13T0RaSU1DNHlOVFl3T1RORE1DNHhPVEE0TXprZ01DNHhOak13T0RZZ01DNHhNemM1TXprZ01DNHlNVFU1TlRNZ01DNHhNemM1TXprZ01DNHlPREV4TmpkV01DNDJNelV5TlRGRE1DNHhNemM1TXprZ01DNDNNREEwTmpZZ01DNHhPVEE0TXprZ01DNDNOVE16TXpJZ01DNHlOVFl3T1RNZ01DNDNOVE16TXpKSU1DNHpOelExTkROV01DNDRNVE13TURSTU1DNHlPRFU1T0RVZ01DNDRNVE13TURWRE1DNHlOamsyTnpJZ01DNDRNVE13TURVZ01DNHlOVFkwTkRjZ01DNDRNall5TWpJZ01DNHlOVFkwTkRjZ01DNDROREkxTWpaRE1DNHlOVFkwTkRjZ01DNDROVGc0TWprZ01DNHlOamsyTnpJZ01DNDROekl3TkRZZ01DNHlPRFU1T0RZZ01DNDROekl3TkRaTU1DNDJPVGt5T1RZZ01DNDROekl3TkRORE1DNDNNVFUyTVNBd0xqZzNNakEwTWlBd0xqY3lPRGd6TlNBd0xqZzFPRGd5TmlBd0xqY3lPRGd6TkNBd0xqZzBNalV5TWtNd0xqY3lPRGd6TkNBd0xqZ3lOakl4T0NBd0xqY3hOVFl3T1NBd0xqZ3hNekF3TWlBd0xqWTVPVEk1TmlBd0xqZ3hNekF3TWt3d0xqWXhNRGN5T0NBd0xqZ3hNekF3TTFZd0xqYzFNek16TWtnd0xqY3lPRGN3T1VNd0xqYzVNemsyTXlBd0xqYzFNek16TWlBd0xqZzBOamcyTXlBd0xqY3dNRFEyTmlBd0xqZzBOamcyTXlBd0xqWXpOVEkxTVZZd0xqWXlNREl5T0VNd0xqZ3lOamcxT0NBd0xqWXpOamN6T1NBd0xqZ3dORGcwTVNBd0xqWTFNRGt3TXlBd0xqYzRNVEl6TmlBd0xqWTJNakk1T0VNd0xqYzNNVFF4T1NBd0xqWTRNVE1nTUM0M05URTFPRElnTUM0Mk9UUXlPVElnTUM0M01qZzNNRGtnTUM0Mk9UUXlPVEpJTUM0Mk5UQXpPVGhhVFRBdU5UVXhOalV4SURBdU9ERXpNREF6VERBdU5ETXpOaklnTUM0NE1UTXdNRFJXTUM0M05UTXpNekpJTUM0MU5URTJOVEZXTUM0NE1UTXdNRE5hSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVOakk1TURBNUlEQXVOalF6TWpjMFF6QXVOemMxTWpJNUlEQXVOalF6TWpjMElEQXVPRGt6TnpZeklEQXVOVEkwTnpRZ01DNDRPVE0zTmpNZ01DNHpOemcxTWpGRE1DNDRPVE0zTmpNZ01DNHlNekl6TURNZ01DNDNOelV5TWprZ01DNHhNVE0zTnlBd0xqWXlPVEF3T1NBd0xqRXhNemMzUXpBdU5EZ3lOemt5SURBdU1URXpOemNnTUM0ek5qUXlOVGdnTUM0eU16SXpNRE1nTUM0ek5qUXlOVGdnTUM0ek56ZzFNakZETUM0ek5qUXlOVGdnTUM0MU1qUTNOQ0F3TGpRNE1qYzVNaUF3TGpZME16STNOQ0F3TGpZeU9UQXdPU0F3TGpZME16STNORnBOTUM0Mk9URTBOamtnTUM0eU16SXlNRGRETUM0Mk9UQTJPVE1nTUM0eU1qWTBPQ0F3TGpZNE5UYzRNeUF3TGpJeU1qQTJOaUF3TGpZM09UZzBOQ0F3TGpJeU1qQTJOa3d3TGpZM09ESTFNU0F3TGpJeU1qRTNNMHd3TGpZM05qY3lNeUF3TGpJeU1qUTROVU13TGpZM01UYzFPU0F3TGpJeU16ZzFNU0F3TGpZMk9ERXhJREF1TWpJNE16azVJREF1TmpZNE1URWdNQzR5TXpNM09UbFdNQzR5TmpnNU9ETklNQzQyTkRBM01UZE1NQzQyTkRBM016SWdNQzR5TXpNM09UbE1NQzQyTkRBMk1qVWdNQzR5TXpJeU1EZERNQzQyTXprNE5Ea2dNQzR5TWpZME9DQXdMall6TkRrek9TQXdMakl5TWpBMk5pQXdMall5T1NBd0xqSXlNakEyTmt3d0xqWXlOelF3TnlBd0xqSXlNakUzTTBNd0xqWXlNVFkzT1NBd0xqSXlNamsxSURBdU5qRTNNalkySURBdU1qSTNPRFU1SURBdU5qRTNNalkySURBdU1qTXpOems1VERBdU5qRTNNalVnTUM0eU5qZzVPRE5JTUM0MU9EazRPRGhXTUM0eU16TTNPVGxNTUM0MU9EazNPREVnTUM0eU16SXlNRGRETUM0MU9Ea3dNRFVnTUM0eU1qWTBPQ0F3TGpVNE5EQTVOU0F3TGpJeU1qQTJOaUF3TGpVM09ERTFOaUF3TGpJeU1qQTJOa013TGpVM01UWTNOQ0F3TGpJeU1qQTJOaUF3TGpVMk5qUXlNaUF3TGpJeU56TXhPU0F3TGpVMk5qUXlNaUF3TGpJek16YzVPVXd3TGpVMk5qUXlPU0F3TGpJM01ERTNNVU13TGpVME16UTBOQ0F3TGpJM05EZ3pOQ0F3TGpVeU5UTXpOeUF3TGpJNU1qa3pOU0F3TGpVeU1EWTJOQ0F3TGpNeE5Ua3hOMHd3TGpRNE5ESTRPU0F3TGpNeE5Ua3pNa3d3TGpRNE1qWTVOeUF3TGpNeE5qQTBRekF1TkRjMk9UWTVJREF1TXpFMk9ERTJJREF1TkRjeU5UVTFJREF1TXpJeE56STFJREF1TkRjeU5UVTFJREF1TXpJM05qWTFUREF1TkRjeU5qWXlJREF1TXpJNU1qVTNRekF1TkRjek5ETTRJREF1TXpNME9UZzFJREF1TkRjNE16UTRJREF1TXpNNU16azVJREF1TkRnME1qZzVJREF1TXpNNU16azVUREF1TlRFNU5EZzVJREF1TXpNNU16Z3pWakF1TXpZMk56WXhUREF1TkRnME1qZzVJREF1TXpZMk56YzJUREF1TkRneU5qazNJREF1TXpZMk9EZzBRekF1TkRjMk9UWTVJREF1TXpZM05qWXhJREF1TkRjeU5UVTFJREF1TXpjeU5UY2dNQzQwTnpJMU5UVWdNQzR6TnpnMU1Vd3dMalEzTWpZMk1pQXdMak00TURFd01rTXdMalEzTXpRek9DQXdMak00TlRneU9TQXdMalEzT0RNME9DQXdMak01TURJME15QXdMalE0TkRJNE9TQXdMak01TURJME0wd3dMalV4T1RRNE9TQXdMak01TURJeU4xWXdMalF4TnpZd05Vd3dMalE0TkRJNE9TQXdMalF4TnpZeU1Vd3dMalE0TWpZNU55QXdMalF4TnpjeU9FTXdMalEzTmprMk9TQXdMalF4T0RVd05TQXdMalEzTWpVMU5TQXdMalF5TXpReE5DQXdMalEzTWpVMU5TQXdMalF5T1RNMU5FTXdMalEzTWpVMU5TQXdMalF6TlRnek5DQXdMalEzTnpnd09DQXdMalEwTVRBNE55QXdMalE0TkRJNE9TQXdMalEwTVRBNE4wd3dMalV5TURZMk1pQXdMalEwTVRBNE4wTXdMalV5TlRNeU9DQXdMalEyTkRBM055QXdMalUwTXpRek9DQXdMalE0TWpFNE5TQXdMalUyTmpReU9TQXdMalE0TmpnME9Fd3dMalUyTmpReU1pQXdMalV5TXpJeU1Vd3dMalUyTmpVeU9DQXdMalV5TkRneE0wTXdMalUyTnpNd055QXdMalV6TURVMElEQXVOVGN5TWpFMElEQXVOVE0wT1RVMElEQXVOVGM0TVRVMklEQXVOVE0wT1RVMFREQXVOVGM1TnpRMklEQXVOVE0wT0RRM1F6QXVOVGcxTkRjMElEQXVOVE0wTURjZ01DNDFPRGs0T0RnZ01DNDFNamt4TmlBd0xqVTRPVGc0T0NBd0xqVXlNekl5TVZZd0xqUTRPREF3TlVnd0xqWXhOekkxVERBdU5qRTNNalkySURBdU5USXpNakl4VERBdU5qRTNNemN6SURBdU5USTBPREV6UXpBdU5qRTRNVFV4SURBdU5UTXdOVFFnTUM0Mk1qTXdOVGdnTUM0MU16UTVOVFFnTUM0Mk1qa2dNQzQxTXpRNU5UUk1NQzQyTXpBMU9TQXdMalV6TkRnME4wTXdMall6TmpNeE9DQXdMalV6TkRBM0lEQXVOalF3TnpNeUlEQXVOVEk1TVRZZ01DNDJOREEzTXpJZ01DNDFNak15TWpGTU1DNDJOREEzTVRjZ01DNDBPRGd3TURWSU1DNDJOamd4TVZZd0xqVXlNekl5TVV3d0xqWTJPREl4TnlBd0xqVXlORGd4TTBNd0xqWTJPRGs1TlNBd0xqVXpNRFUwSURBdU5qY3pPVEF6SURBdU5UTTBPVFUwSURBdU5qYzVPRFEwSURBdU5UTTBPVFUwUXpBdU5qZzJNekl6SURBdU5UTTBPVFUwSURBdU5qa3hOVGMySURBdU5USTVOekF4SURBdU5qa3hOVGMySURBdU5USXpNakl4VERBdU5qa3hOVGcySURBdU5EZzJPRFExUXpBdU56RTBOVFl6SURBdU5EZ3lNVGMzSURBdU56TXlOalkwSURBdU5EWTBNRGM0SURBdU56TTNNek16SURBdU5EUXhNVXd3TGpjM016Y3hJREF1TkRReE1EZzNUREF1TnpjMU16QXpJREF1TkRRd09UaERNQzQzT0RFd01qa2dNQzQwTkRBeU1ETWdNQzQzT0RVME5ESWdNQzQwTXpVeU9UUWdNQzQzT0RVME5ESWdNQzQwTWprek5UUk1NQzQzT0RVek16WWdNQzQwTWpjM05qSkRNQzQzT0RRMU5Ua2dNQzQwTWpJd016VWdNQzQzTnprMk5TQXdMalF4TnpZeU1TQXdMamMzTXpjeElEQXVOREUzTmpJeFNEQXVOek00TlRGV01DNHpPVEF5TkROSU1DNDNOek0zTVV3d0xqYzNOVE13TXlBd0xqTTVNREV6TmtNd0xqYzRNVEF5T1NBd0xqTTRPVE0xT1NBd0xqYzROVFEwTWlBd0xqTTRORFExSURBdU56ZzFORFF5SURBdU16YzROVEZNTUM0M09EVXpNellnTUM0ek56WTVNVGhETUM0M09EUTFOVGtnTUM0ek56RXhPVEVnTUM0M056azJOU0F3TGpNMk5qYzNOaUF3TGpjM016Y3hJREF1TXpZMk56YzJTREF1TnpNNE5URldNQzR6TXprek9UbElNQzQzTnpNM01Vd3dMamMzTlRNd015QXdMak16T1RJNU1rTXdMamM0TVRBeU9TQXdMak16T0RVeE5TQXdMamM0TlRRME1pQXdMak16TXpZd05pQXdMamM0TlRRME1pQXdMak15TnpZMk5VTXdMamM0TlRRME1pQXdMak15TVRFNE5pQXdMamM0TURFNUlEQXVNekUxT1RNeUlEQXVOemN6TnpFZ01DNHpNVFU1TXpKTU1DNDNNemN6TXpjZ01DNHpNVFU1TXpWRE1DNDNNekkyTnpJZ01DNHlPVEk1TlNBd0xqY3hORFUyT1NBd0xqSTNORGcwTXlBd0xqWTVNVFU0TmlBd0xqSTNNREUzTlV3d0xqWTVNVFUzTmlBd0xqSXpNemM1T1V3d0xqWTVNVFEyT1NBd0xqSXpNakl3TjFwTk1DNDFOREk1TlRVZ01DNHpNamMyTmpWRE1DNDFOREk1TlRVZ01DNHpNRGd5TWpVZ01DNDFOVGczTVRRZ01DNHlPVEkwTmpZZ01DNDFOemd4TlRZZ01DNHlPVEkwTmpaSU1DNDJOems0TkRSRE1DNDJPVGt5T0RRZ01DNHlPVEkwTmpZZ01DNDNNVFV3TkRRZ01DNHpNRGd5TWpVZ01DNDNNVFV3TkRRZ01DNHpNamMyTmpWV01DNDBNamt6TlRSRE1DNDNNVFV3TkRRZ01DNDBORGczT1RRZ01DNDJPVGt5T0RRZ01DNDBOalExTlRRZ01DNDJOems0TkRRZ01DNDBOalExTlRSSU1DNDFOemd4TlRaRE1DNDFOVGczTVRRZ01DNDBOalExTlRRZ01DNDFOREk1TlRVZ01DNDBORGczT1RRZ01DNDFOREk1TlRVZ01DNDBNamt6TlRSV01DNHpNamMyTmpWYVRUQXVOamMyTURFZ01DNHpOemcxT0RkRE1DNDJOell3TVNBd0xqTTFNalkyTmlBd0xqWTFORGs1TnlBd0xqTXpNVFkxTkNBd0xqWXlPVEEzTmlBd0xqTXpNVFkxTkVNd0xqWXdNekUxTlNBd0xqTXpNVFkxTkNBd0xqVTRNakUwTkNBd0xqTTFNalkyTmlBd0xqVTRNakUwTkNBd0xqTTNPRFU0TjBNd0xqVTRNakUwTkNBd0xqUXdORFV3T0NBd0xqWXdNekUxTlNBd0xqUXlOVFV5SURBdU5qSTVNRGMySURBdU5ESTFOVEpETUM0Mk5UUTVPVGNnTUM0ME1qVTFNaUF3TGpZM05qQXhJREF1TkRBME5UQTRJREF1TmpjMk1ERWdNQzR6TnpnMU9EZGFUVEF1TmpBMU5qRWdNQzR6TnpnMU9EZERNQzQyTURVMk1TQXdMak0yTlRZeU55QXdMall4TmpFeE5pQXdMak0xTlRFeUlEQXVOakk1TURjMklEQXVNelUxTVRKRE1DNDJOREl3TXpZZ01DNHpOVFV4TWlBd0xqWTFNalUwTWlBd0xqTTJOVFl5TnlBd0xqWTFNalUwTWlBd0xqTTNPRFU0TjBNd0xqWTFNalUwTWlBd0xqTTVNVFUwTnlBd0xqWTBNakF6TmlBd0xqUXdNakExTXlBd0xqWXlPVEEzTmlBd0xqUXdNakExTTBNd0xqWXhOakV4TmlBd0xqUXdNakExTXlBd0xqWXdOVFl4SURBdU16a3hOVFEzSURBdU5qQTFOakVnTUM0ek56ZzFPRGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DQXdMakF4TlRNNE1Ea3BJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODkiIHk9IjI4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJpci5yZWY9YWExMTAyZTctMjJhNC00N2Q0LTk1ZTUtZjI4OWFiOTIxM2I3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDEzIiB5PSIyOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IlJpY2ggQ2xpZW50IC0+IFNBUCBSb3V0ZXIiIHN0eWxlPSJpci5yZWY9NWVjN2M3ODMtYzQ1OS00OTAwLTgyMTYtODI1ZDM4ODZmMGMwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjc1O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTgiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iQnJvd3NlciAtPiBTQVAgUm91dGVyIiBzdHlsZT0iaXIucmVmPWQ2NTQyODEyLTYyMmUtNGFlNi05ZjUwLTI2YzE2NTc0M2VkYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjkiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gU0FQIFJvdXRlciIgc3R5bGU9ImlyLnJlZj1hODk3NzI2Ni04ZGM4LTQzMDMtODA4My1lZGVkOWMxMWMyZDI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxOSIgdGFyZ2V0PSI1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJSaWNoIENsaWVudCAtPiBTQVAgUm91dGVyIiBzdHlsZT0iaXIucmVmPWI0M2U3N2E0LTI4MmUtNDMwMy1hMWZiLTg2MDZmYWIwODI4OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE2IiB0YXJnZXQ9IjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNCIgdmFsdWU9IkJyb3dzZXIgLT4gU0FQIFJvdXRlciIgc3R5bGU9ImlyLnJlZj00MmNhMTliZC1kNDZhLTQ0MDUtOWQ0MC1jZjE0MTFlN2I0NGU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI4IiB0YXJnZXQ9IjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyOCIgdmFsdWU9IkdlbmVyaWMgQ2xpZW50IC0+IFNBUCBSb3V0ZXIiIHN0eWxlPSJpci5yZWY9Y2QxMmYzNTctYmQ5My00ZDBlLTg1ZGQtMzRkNjEyYjg5N2M3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTciIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI5IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj05NTEwMzgyOC05YjU0LTQwYzMtOWRmMi0wZTdhNjUyMjljYTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9IkJyb3dzZXIgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj0wY2ZiMjZiMC03ZWY4LTRlOGYtODU4Zi0zMmUxMGZmNjNmODY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjgiIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iUmljaCBDbGllbnQgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj0zY2JhZTc5OC00MDA3LTQ5YTctYWU2Zi0xZTZmODIwOGZmMmU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxNiIgdGFyZ2V0PSI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="100"/>
-    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="60"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Browser -&gt; GCP VPN" ref="0cfb26b0-7ef8-4e8f-858f-32e10ff63f86" source="00449516-33db-479d-a201-3582f48fd42b" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Rich Client -&gt; GCP VPN" ref="3cbae798-4007-49a7-ae6f-1e6f8208ff2e" source="b740e9e6-5afd-46b4-aecc-6037cfd51e04" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Browser -&gt; SAP Router" ref="42ca19bd-d46a-4405-9d40-cf1411e7b44e" source="00449516-33db-479d-a201-3582f48fd42b" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Rich Client -&gt; SAP Router" ref="5ec7c783-c459-4900-8216-825d3886f0c0" source="91280f47-7175-45c8-9dc4-6e3692293927" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="SAP CI + WD + HANA -&gt; GCP Storage" ref="606086c1-07ce-4e9a-9565-6e40855d2faf" source="9f247536-92d4-42dc-8f7a-0d5b8da02525" target="63f25813-9611-4061-8a55-7e8d91ebbf0e">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="SAP Router -&gt; SAP CI + WD + HANA" ref="6e216062-b498-4ce6-a8bd-2b30c73c2adb" source="d78e6be7-fa53-4f74-b420-98ea83d4c688" target="9f247536-92d4-42dc-8f7a-0d5b8da02525">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="GCP VPN -&gt; Bastion Server" ref="853afe54-da0a-4327-8208-0de4689eb644" source="eabd8d49-ff06-4c69-b250-3017f4f79c31" target="ce03b78b-c465-485b-ad9a-3e72ab140581">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; GCP VPN" ref="95103828-9b54-40c3-9df2-0e7a65229ca1" source="6dd70f5e-d8b5-4c38-94de-192c64730327" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; SAP Router" ref="a8977266-8dc8-4303-8083-eded9c11c2d2" source="9ced54cb-300b-4cea-9dba-c1eb433ee864" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Rich Client -&gt; SAP Router" ref="b43e77a4-282e-4303-a1fb-8606fab08289" source="b740e9e6-5afd-46b4-aecc-6037cfd51e04" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Bastion Server -&gt; SAP CI + WD + HANA" ref="c958ca25-beea-4fa3-8a87-7de2292ed248" source="ce03b78b-c465-485b-ad9a-3e72ab140581" target="9f247536-92d4-42dc-8f7a-0d5b8da02525">
-      <assets/>
-      <tags>
-        <tag tag="admin"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Generic Client -&gt; SAP Router" ref="cd12f357-bd93-4d0e-85dd-34d612b897c7" source="6dd70f5e-d8b5-4c38-94de-192c64730327" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Browser -&gt; SAP Router" ref="d6542812-622e-4ae6-9f50-26c165743edc" source="2a4f86ab-abb0-449b-a498-d403a62a3948" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Bastion Server -&gt; GCP Storage" ref="e28d5d30-80f0-48fb-b9a3-cc59d2d91edc" source="ce03b78b-c465-485b-ad9a-3e72ab140581" target="63f25813-9611-4061-8a55-7e8d91ebbf0e">
-      <assets/>
-      <tags/>
-    </dataflow>
-  </dataflows>
-  <customFields>
-    <customField ref="project-owner" value=""/>
-  </customFields>
-  <components>
-    <component uuid="9c986469-36ab-49d0-94ab-de5a0e3311f7" diagramComponentId="8c3c7420-02d7-49c2-8ebe-2d8813b86270" ref="ce03b78b-c465-485b-ad9a-3e72ab140581" name="Bastion Server" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.847">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
-&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
-&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
-&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
-&lt;p&gt;gcloud components update&lt;/p&gt; 
-&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
-&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
-&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
-&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
-&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
-
-	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
-
-	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
-
-
-	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
-  -query-path="hostkeys/" \
-  -zone=ZONE&lt;br /&gt;
-Replace the following:&lt;/p&gt;
-
-	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
-- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
-
-
-	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
-
-	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
-2. Select serial port 1.&lt;br /&gt;
-3. Search for the following message:&lt;/p&gt;
-
-	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
-
-	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.790">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="bbda0c87-b2aa-4919-9cd0-4965c21a6fe8" diagramComponentId="16761c47-d214-42ce-b89e-8fac6e439de0" ref="eabd8d49-ff06-4c69-b250-3017f4f79c31" name="GCP VPN" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-VPN">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to open ports is most likely an attack. To avoid this, access to the network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.631">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPN2" name="Define monitoring alerts for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Define monitoring alerts for Cloud VPN&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; To view metrics and create alerts related to your VPN tunnels, use Cloud Monitoring.&lt;br&gt; In addition to the predefined dashboards in Cloud Monitoring, you can create custom dashboards, set up alerts, and query the metrics by using the Monitoring API or the Cloud Console.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.&lt;/p&gt; 
-&lt;p&gt;To create an alerting policy that monitors one or more Cloud VPN gateway resources, follow these steps:&lt;/p&gt; 
-&lt;p&gt;1. In the Google Cloud Console, go to the Monitoring page.&lt;br&gt; 2. In the Monitoring navigation pane, select notificationsAlerting, and then select Create policy.&lt;br&gt; 3. If the button Return to Legacy UI is displayed and if you want to follow these instructions, then click it. You can create an alerting policy by using the Preview interface; however, these instructions are for the Legacy UI.&lt;br&gt; 4. Click Add condition:&lt;br&gt; a. The settings in the Target pane specify the resource and metric to be monitored. In the Find resource type and metric field, select the resource Cloud VPN gateway. Next, select a metric from the metrics list.&lt;br&gt; b. The settings in the Configuration pane of the alerting policy determine when the alert is triggered. Most fields in this pane are populated with default values.&lt;br&gt; c. Click Add.&lt;br&gt; 5. To advance to the notifications section, click Next.&lt;br&gt; 6. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.&lt;br&gt; If a notification channel that you want to add isn't listed, then click Manage notification channels. You are taken to the Notification channels page in a new browser tab. From this page, you can update the configured notification channels. After you have completed your updates, return to the original tab, click autorenewRefresh, and then select the notification channels to add to the alerting policy.&lt;br&gt; 7. To advance to the documentation section, click Next.&lt;br&gt; 8. Click Name and enter a name for the alerting policy.&lt;br&gt; 9. Optional: Click Documentation, and then add any information that you want included in a notification message.&lt;br&gt; 10. Click Save.&lt;/p&gt; 
-&lt;p&gt;Define alerts for VPN tunnel bandwidth&lt;/p&gt; 
-&lt;p&gt;To create alerting policies for the bytes per second (bps) and packets per second (pps) limits described in Network bandwidth, use Monitoring Query Language (MQL).&lt;/p&gt; 
-&lt;p&gt;When entering your queries, follow the instructions in Creating MQL alerting policies (console) and see the following examples:&lt;/p&gt; 
-&lt;p&gt;- Query for bps: This example query notifies you when the sum of sent_bytes_count and received_bytes_count exceeds 80% of the 3-Gbps (375 MBps) limit for a given VPN tunnel. "MBy" specifies megabytes as the unit of measurement. The value of 300 "MBy" is automatically scaled to compare to val(), which has the unit "Bytes". Please note that the align rate should be scaled appropriately to capture the necessary data. It can be set to as low as (1s), and scaled higher, if more data sampling points over a longer period of days, are needed.&lt;/p&gt; 
-&lt;p&gt;fetch vpn_gateway | { metric vpn.googleapis.com/network/sent_bytes_count &lt;/p&gt;
-&lt;dl&gt; 
- &lt;dt&gt;
-  metric vpn.googleapis.com/network/received_bytes_count } | align rate (1m) | filter (metric.tunnel_name == 'TUNNEL_NAME') | outer_join 0,0 | value val(0) + val(1) | condition val() &amp;gt; 300 "MBy/s"
- &lt;/dt&gt; 
-&lt;/dl&gt;
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;- Query for pps: This example query notifies you when the sum of sent_packets_count and received_packets_count exceeds 80% of the maximum recommended packet rate of 250,000 pps for a given VPN tunnel.&lt;/p&gt; 
-&lt;p&gt;fetch vpn_gateway | { metric vpn.googleapis.com/network/sent_packets_count &lt;/p&gt;
-&lt;dl&gt; 
- &lt;dt&gt;
-  metric vpn.googleapis.com/network/received_packets_count } | filter (metric.tunnel_name == 'TUNNEL_NAME') | outer_join 0,0 | value val(0) + val(1) | condition val() &amp;gt; 200000
- &lt;/dt&gt; 
-&lt;/dl&gt;
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="View logs and metrics" url="https://cloud.google.com/network-connectivity/docs/vpn/how-to/viewing-logs-metrics"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;View alerting policy&lt;/p&gt;
-
-	&lt;p&gt;1. In the Cloud Console, select Monitoring.&lt;/p&gt;
-
-	&lt;p&gt;2. In the navigation pane, select notifications Alerting.&lt;/p&gt;
-
-	&lt;p&gt;3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;/p&gt;
-
-	&lt;p&gt;4. Find the policy that you want to view, and then select it.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPN1" name="Enable Firewall Rules Logging for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Firewall Rules Logging for Cloud VPN&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Logging is also useful if you need to determine how many connections are affected by a given firewall rule.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling firewall rules logging&lt;/p&gt; 
-&lt;p&gt;1. Go to the Firewall page in the Google Cloud Console.&lt;br&gt; 2. In the Logs column, determine if firewall logging is on or off for each firewall rule.&lt;br&gt; 3. To enable logging for one or more firewall rules, select the checkbox next to each one.&lt;br&gt; 4. In the Firewall rules action bar, click Configure logs.&lt;br&gt; 5. In the Configure logs dialog, select On.&lt;br&gt; 6. To omit the metadata fields, expand Logs details and then clear Include metadata.&lt;br&gt; 7. Click Save configuration.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using Firewall Rules Logging" url="https://cloud.google.com/vpc/docs/using-firewall-rules-logging"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Viewing logs&lt;/p&gt;
-
-	&lt;p&gt;Firewall rule logs are created in the project that hosts the network containing the VM instances and firewall rules. With Shared VPC, VM instances are created in service projects, but they use a Shared VPC Network located in the host project. Firewall rules logs are stored in that host project.&lt;/p&gt;
-
-	&lt;p&gt;Use the Logs section of the Cloud Console to view firewall rule logs.&lt;/p&gt;
-
-	&lt;p&gt;The following filters demonstrate how you can search for specific firewall events.&lt;/p&gt;
-
-	&lt;p&gt;All firewall logs&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. Select Subnetwork in the first pull-down menu.&lt;br /&gt;
-3. Select compute.googleapis.com/firewall in the second pull-down menu.&lt;br /&gt;
-4. Click OK.&lt;/p&gt;
-
-	&lt;p&gt;Alternatively:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
-3. Paste the following into the field. Replace PROJECT_ID with your project ID.&lt;/p&gt;
-
-	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
-logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;/p&gt;
-
-
-	&lt;p&gt;Specific subnets&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. In the first pull-down menu, move the cursor to Subnetwork, then move it to the right to open up the individual subnet selection menu.&lt;br /&gt;
-3. In the second pull-down menu, select compute.googleapis.com/firewall.&lt;br /&gt;
-4. Click OK.&lt;/p&gt;
-
-	&lt;p&gt;Alternatively:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
-3. Paste the following into the field. Replace PROJECT_ID with your project ID and SUBNET_NAME with your subnetwork.&lt;/p&gt;
-
-	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
-logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
-resource.labels.subnetwork_name="SUBNET_NAME"&lt;/p&gt;
-
-
-	&lt;p&gt;Specific VMs&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
-3. Paste the following into the field. Replace PROJECT_ID with your project ID and INSTANCE_NAME with your VM.&lt;/p&gt;
-
-	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
-logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
-jsonPayload.instance.vm_name="INSTANCE_NAME"&lt;/p&gt;
-
-
-	&lt;p&gt;Connections from a specific country&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
-2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
-3. Paste the following into the field. Replace PROJECT_ID with your project ID and COUNTRY with the ISO 3166-1 alpha-3 code.&lt;/p&gt;
-
-	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
-logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
-jsonPayload.remote_location.country=COUNTRY&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.573">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPN4" name="Generate a strong pre-shared key for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Generate a strong pre-shared key for Cloud VPN&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; You can use a pre-shared key (also called a shared secret or PSK) to authenticate the Cloud VPN tunnel to your peer VPN gateway. As a security best practice, Google Cloud recommends that you generate a strong 32-character pre-shared key.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Generation methods&lt;/p&gt; 
-&lt;p&gt;Use the following methods to generate a strong 32-character pre-shared key.&lt;/p&gt; 
-&lt;p&gt;OpenSSL&lt;/p&gt; 
-&lt;p&gt;On a Linux or macOS system, run the following OpenSSL command:&lt;/p&gt; 
-&lt;p&gt;openssl rand -base64 24&lt;/p&gt; 
-&lt;p&gt;/dev/urandom&lt;/p&gt; 
-&lt;p&gt;On a Linux or macOS system, you can also use /dev/urandom as a pseudorandom source to generate a pre-shared key:&lt;/p&gt; 
-&lt;p&gt;- On Linux or macOS, send the random input to base64:&lt;/p&gt; 
-&lt;p&gt;head -c 24 /dev/urandom | base64&lt;/p&gt; 
-&lt;p&gt;Pass the random input through a hashing function, such as sha256:&lt;/p&gt; 
-&lt;p&gt;- On Linux:&lt;/p&gt; 
-&lt;p&gt;head -c 4096 /dev/urandom | sha256sum | cut -b1-32&lt;/p&gt; 
-&lt;p&gt;- On macOS:&lt;/p&gt; 
-&lt;p&gt;head -c 4096 /dev/urandom | openssl sha256 | cut -b1-32&lt;/p&gt; 
-&lt;p&gt;JavaScript&lt;/p&gt; 
-&lt;p&gt;You can generate the pre-shared key directly in a document by using JavaScript with the W3C Web Cryptography API. This API uses the Crypto.getRandomValues() method, which provides a cryptographically sound way of generating a pre-shared key.&lt;/p&gt; 
-&lt;p&gt;The following code creates an array of 24 random bytes, and then base64 encodes those bytes to produce a random 32-character string:&lt;/p&gt; 
-&lt;p&gt;var a = new Uint8Array(24);&lt;br&gt; window.crypto.getRandomValues(a);&lt;/p&gt; 
-&lt;p&gt;console.log(btoa(String.fromCharCode.apply(null, a)));&lt;/p&gt; 
-&lt;p&gt;Generated for you&lt;/p&gt; 
-&lt;p&gt;Your browser generates a random string by using the JavaScript snippet at the end of this page. It is 24 bytes from Crypto.getRandomValues, and is base64-encoded to create a 32-character pre-shared key. For more information, please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Generate a strong pre-shared key" url="https://cloud.google.com/network-connectivity/docs/vpn/how-to/generating-pre-shared-key"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that a strong pre-shared key is generated for Cloud VPN.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPN3" name="Set up firewall rules for Cloud VPN gateways" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Set up firewall rules for Cloud VPN gateways&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; VPC firewall rules let you allow or deny connections to or from your virtual machine (VM) instances based on a configuration that you specify. Enabled VPC firewall rules are always enforced, protecting your instances regardless of their configuration and operating system, even if they have not started up.&lt;br&gt; Every VPC network functions as a distributed firewall. While firewall rules are defined at the network level, connections are allowed or denied on a per-instance basis. You can think of the VPC firewall rules as existing not only between your instances and other networks, but also between individual instances within the same network.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Creating firewall rules&lt;/p&gt; 
-&lt;p&gt;1. Go to the Firewall page in the Google Cloud Console.&lt;br&gt; 2. Click Create firewall rule.&lt;br&gt; 3. Enter a Name for the firewall rule.&lt;br&gt; This name must be unique for the project.&lt;br&gt; 4. (Optional) You can enable firewall rules logging:&lt;br&gt; - Click Logs &amp;gt; On.&lt;br&gt; - To omit metadata, expand Logs details and then clear Include metadata.&lt;br&gt; 5. Specify the Network for the firewall rule.&lt;br&gt; 6. Specify the Priority of the rule.&lt;br&gt; The lower the number, the higher the priority.&lt;br&gt; 7. For the Direction of traffic, choose ingress or egress.&lt;br&gt; 8. For the Action on match, choose allow or deny.&lt;br&gt; 9. Specify the Targets of the rule.&lt;br&gt; - If you want the rule to apply to all instances in the network, choose All instances in the network.&lt;br&gt; - If you want the rule to apply to select instances by network (target) tags, choose Specified target tags, then type the tags to which the rule should apply into the Target tags field.&lt;br&gt; - If you want the rule to apply to select instances by associated service account, choose Specified service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Target service account field.&lt;br&gt; 10. For an ingress rule, specify the Source filter:&lt;br&gt; - Choose IP ranges and type the CIDR blocks into the Source IP ranges field to define the source for incoming traffic by IP address ranges. Use 0.0.0.0/0 for a source from any network.&lt;br&gt; - To limit source by network tag, choose Source tags, then type the network tags in to the Source tags field. For the limit on the number of source tags, see Per network limits. Filtering by source tag is only available if the target is not specified by service account. For more information, see filtering by service account versus network tag.&lt;br&gt; - To limit source by service account, choose Service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Source service account field. Filtering by source service account is only available if the target is not specified by network tag. For more information, see filtering by service account versus network tag.&lt;br&gt; - Specify a Second source filter if desired. Secondary source filters cannot use the same filter criteria as the primary one. Source IP ranges can be used together with Source tags or Source service account. The effective source set is the union of the source range IP addresses and the instances identified by network tags or service accounts. That is, if either the source IP range, or the source tags (or source service accounts) match the filter criteria, the source is included in the effective source set.&lt;br&gt; - Source tags and Source service account can't be used together.&lt;br&gt; 11. For an egress rule, specify the Destination filter:&lt;br&gt; - Choose IP ranges and type the CIDR blocks into the Destination IP ranges field to define the destination for outgoing traffic by IP address ranges. Use 0.0.0.0/0 to mean everywhere.&lt;br&gt; 12. Define the Protocols and ports to which the rule applies:&lt;br&gt; - Select Allow all or Deny all, depending on the action, to have the rule apply to all protocols and destination ports.&lt;br&gt; - Define specific protocols and destination ports:&lt;br&gt; a. Select tcp to include the TCP protocol and destination ports. Enter all or a comma-delimited list of destination ports, such as 20-22, 80, 8080.&lt;br&gt; b. Select udp to include the UDP protocol and destination ports. Enter all or a comma-delimited list of destination ports, such as 67-69, 123.&lt;br&gt; c. Select Other protocols to include protocols such as icmp or sctp.&lt;br&gt; 13. (Optional) You can create the firewall rule but not enforce it by setting its enforcement state to disabled. Click Disable rule, then select Disabled.&lt;br&gt; 14. Click Create.&lt;/p&gt; 
-&lt;p&gt;For more information, please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using firewall rules" url="https://cloud.google.com/vpc/docs/using-firewalls"/>
-            <reference name="VPC firewall rules overview" url="https://cloud.google.com/vpc/docs/firewalls"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;To show all firewall rules for all networks in your project:&lt;/p&gt;
-
-	&lt;p&gt;- Go to the Firewall page in the Google Cloud Console.&lt;/p&gt;
-
-	&lt;p&gt;To show firewall rules in a particular network:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the VPC networks page in the Google Cloud Console.&lt;br /&gt;
-2. Click the Name of a VPC network to go to its details page.&lt;br /&gt;
-3. On the details page for the network, click the Firewall rules tab.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPN1" mitigation="50"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPN2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPN1" mitigation="50"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPN2" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="GOOGLE-UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers could gain an unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPN3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPN3" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPN4" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPN4" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="0070f36f-9561-41de-9ea4-7ba0f39c6cf0" diagramComponentId="34c189a9-1882-4977-9951-48f0b65221ab" ref="9f247536-92d4-42dc-8f7a-0d5b8da02525" name="SAP CI + WD + HANA" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.769">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
-&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
-&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
-&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
-&lt;p&gt;gcloud components update&lt;/p&gt; 
-&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
-&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
-&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
-&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
-&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
-
-	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
-
-	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
-
-
-	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
-  -query-path="hostkeys/" \
-  -zone=ZONE&lt;br /&gt;
-Replace the following:&lt;/p&gt;
-
-	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
-- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
-
-
-	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
-
-	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
-2. Select serial port 1.&lt;br /&gt;
-3. Search for the following message:&lt;/p&gt;
-
-	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
-
-	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.740">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="62b4d68b-934d-40cf-8f54-c7145bb31257" diagramComponentId="7e7dce8f-8939-4664-a616-00ac62c20525" ref="d78e6be7-fa53-4f74-b420-98ea83d4c688" name="SAP Router" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.025">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
-&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
-&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
-&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
-&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
-&lt;p&gt;gcloud components update&lt;/p&gt; 
-&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
-&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
-&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
-&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
-&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
-&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
-
-	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
-
-	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
-
-
-	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
-  -query-path="hostkeys/" \
-  -zone=ZONE&lt;br /&gt;
-Replace the following:&lt;/p&gt;
-
-	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
-- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
-
-
-	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
-
-	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
-2. Select serial port 1.&lt;br /&gt;
-3. Search for the following message:&lt;/p&gt;
-
-	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
-
-	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
-
-	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.984">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="DATA-TRANSMIT-CLEAR">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1defa9ac-b2b7-4a06-a9ee-4339ea45389a" diagramComponentId="c4d63ff1-9bfe-418f-ba6d-1d83bc9bdbd5" ref="93f9dc70-a190-41c5-9943-76a0ce03cc41" name="GCP VPC (Virtual Private Cloud)" desc="" library="Google Cloud Platform" parentComponentRef="" componentDefinitionRef="CD-GOOGLE-CLOUD-VPC">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.562">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-NON-IDENTIFY" name="Non-identify the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>Resources are not registered in the safety net systems, and there are more unidentified resources. This can be a problem because these unidentified resources can have unknown weaknesses.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.563">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
-          <desc>Receiving unauthorized connections to open ports is most likely an attack. To avoid this, access to the network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.563">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC9" name="Configure network tags for all resources" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Configure network tags for all resources&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; A tag is simply a character string added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or instance templates. A tag is not a separate resource, so you cannot create it separately. All resources with that string are considered to have that tag. Tags enable you to make firewall rules and routes applicable to specific VM instances.&lt;br&gt; You can assign network tags to new VMs at creation time, or you can edit the set of assigned tags at any time later. You can edit network tags without stopping a VM.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Adding tags when creating a VM&lt;/p&gt; 
-&lt;p&gt;1. Go to the VM instances page.&lt;br&gt; 2. Click Create instance.&lt;br&gt; 3. Click Management, security, disks, networking, sole tenancy to open that section.&lt;br&gt; 4. Click the Networking tab.&lt;br&gt; 5. In the Network tags field, specify one or more tags, separated by commas.&lt;br&gt; 6. Populate other fields for the VM.&lt;br&gt; 7. Click Create.&lt;/p&gt; 
-&lt;p&gt;Adding tags to an existing VM&lt;/p&gt; 
-&lt;p&gt;1. Go to the VM instances page.&lt;br&gt; 2. Click an instance name.&lt;br&gt; 3. On the VM instance details page, click Edit.&lt;br&gt; 4. In the Network tags section, specify one or more tags, separated by commas.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Configuring network tags" url="https://cloud.google.com/vpc/docs/add-remove-network-tags"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Viewing tags&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the VM instances page.&lt;br /&gt;
-2. View tags in the Network tags column.&lt;br /&gt;
-If needed, click Column display options to add the Network tags column.&lt;br /&gt;
-3. To view instances that are tagged with a specific tag, in the filter, select the property Network tags and enter the tags you want to filter on.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.429">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC2" name="Enable Firewall Rules Logging" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enable Firewall Rules Logging&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Firewall Rules Logging lets you audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule.&lt;br&gt; Google Cloud recommends as a best practice to turn on Firewall Rules Logging and use Firewall Insights to verify that firewall rules are being used in the intended way.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; Enabling firewall rules logging&lt;/p&gt; 
-&lt;p&gt;1. Go to the Firewall page in the Google Cloud console.&lt;br&gt; 2. In the Logs column, determine if firewall logging is on or off for each firewall rule.&lt;br&gt; 3. To enable logging for one or more firewall rules, select the checkbox next to each one.&lt;br&gt; 4. In the Firewall rules action bar, click Configure logs.&lt;br&gt; 5. In the Configure logs dialog, select On.&lt;br&gt; 6. To omit the metadata fields, expand Logs details and then clear Include metadata.&lt;br&gt; 7. Click Save configuration.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Firewall Rules Logging can incur costs, so you might want to consider using it selectively.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using Firewall Rules Logging" url="https://cloud.google.com/vpc/docs/using-firewall-rules-logging"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Viewing logs&lt;/p&gt;
-
-	&lt;p&gt;Firewall rule logs are created in the project that hosts the network containing the VM instances and firewall rules. With Shared VPC, VM instances are created in service projects, but they use a Shared VPC Network located in the host project. Firewall rules logs are stored in that host project.&lt;/p&gt;
-
-	&lt;p&gt;Use the Logs section of the Cloud console to view firewall rule logs.&lt;/p&gt;
-
-	&lt;p&gt;The following filters demonstrate how you can search for specific firewall events.&lt;/p&gt;
-
-	&lt;p&gt;All firewall logs&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud console.&lt;br /&gt;
-2. Select Subnetwork in the first pull-down menu.&lt;br /&gt;
-3. Select compute.googleapis.com/firewall in the second pull-down menu.&lt;br /&gt;
-4. Click OK.&lt;/p&gt;
-
-	&lt;p&gt;Alternatively:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud console.&lt;br /&gt;
-2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
-3. Paste the following into the field. Replace PROJECT_ID with your project ID.&lt;/p&gt;
-
-	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
-logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall" &lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.427">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC4" name="Ensure legacy networks do not exist for older projects" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. The network is global in scope and spans all cloud regions. &lt;br&gt; Subnetworks cannot be created in a legacy network and are unable to switch from legacy to auto or custom subnet networks. Legacy networks can have an impact for high network traffic projects and are subject to a single point of contention or failure.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; For each Google Cloud Platform project:&lt;br&gt; 1. Create a non-legacy network suitable for the organization's requirements.&lt;/p&gt; 
-&lt;p&gt;Note: You can no longer create a legacy network.&lt;br&gt; If you try to create a legacy network, this error is displayed:&lt;br&gt; Creation of legacy mode networks is deprecated. Please create a subnet mode&lt;br&gt; network instead by removing the IPv4Range field and adding the&lt;br&gt; autoCreateSubnetworks field to your network insert request.&lt;/p&gt; 
-&lt;p&gt;2. Delete the networks in the legacy mode.&lt;/p&gt; 
-&lt;p&gt;For a legacy network, you can explicitly delete the network only if the network is not in use by any resources.&lt;/p&gt; 
-&lt;p&gt;To delete the network:&lt;/p&gt; 
-&lt;p&gt;gcloud compute networks delete LEGACY_NETWORK_NAME&lt;/p&gt; 
-&lt;p&gt;Replace the following:&lt;/p&gt; 
-&lt;p&gt;LEGACY_NETWORK_NAME: the name of the legacy network that you want to delete.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Creating a legacy network" url="https://cloud.google.com/vpc/docs/using-legacy#creating_a_legacy_network"/>
-            <reference name="Deleting a legacy network" url="https://cloud.google.com/vpc/docs/using-legacy#deleting_a_legacy_network"/>
-          </references>
-          <standards>
-            <standard ref="3.2" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;For each Google Cloud Platform project:&lt;/p&gt;
-
-	&lt;p&gt;1. Set the project name in the Google Cloud Shell:&lt;/p&gt;
-
-	&lt;p&gt;gcloud config set project &lt;Project-ID&gt; &lt;/p&gt;
-
-	&lt;p&gt;2. List the networks configured in that project:&lt;/p&gt;
-
-	&lt;p&gt;gcloud compute networks list &lt;/p&gt;
-
-	&lt;p&gt;None of the listed networks should be in the legacy mode.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC5" name="Ensure that SSH and RDP access is restricted from the internet" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;br&gt; Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the internet to VPC or VM instance using SSH on Port 22 and/or RDP on Port 3389 can be avoided.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; GCP Firewall Rules within a VPC Network apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through SSH with the default Port 22 and/or RDP on Port 3389. Generic access from the Internet to a specific IP Range needs to be restricted.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; From the Console:&lt;br&gt; 1. Go to VPC Network.&lt;br&gt; 2. Go to the Firewall Rules.&lt;br&gt; 3. Click the Firewall Rule you want to modify.&lt;br&gt; 4. Click Edit.&lt;br&gt; 5. Modify Source IP ranges to specific IP.&lt;br&gt; 6. Click Save.&lt;/p&gt; 
-&lt;p&gt;From Command Line:&lt;br&gt; 1.Update the Firewall rule with the new SOURCE_RANGE from the below command:&lt;/p&gt; 
-&lt;p&gt;gcloud compute firewall-rules update FirewallName -allow=[PROTOCOL[:PORT[-PORT]],...] -source-ranges=[CIDR_RANGE,...]&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; All Secure Shell (SSH) and/or Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH and/or RDP port for the concerned VPC.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blocked and limited traffic" url="https://cloud.google.com/vpc/docs/firewalls#blockedtraffic"/>
-            <reference name="Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts" url="https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts"/>
-          </references>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="3.7" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;From the Console:&lt;br /&gt;
-1. Go to VPC network.&lt;br /&gt;
-2. Go to the Firewall Rules.&lt;br /&gt;
-3. Ensure that Port is not equal to 22 and/or 3389 and Action is not set to Allow.&lt;br /&gt;
-4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;
-
-	&lt;p&gt;From Command Line:&lt;br /&gt;
-gcloud compute firewall-rules list -&lt;br /&gt;
-format=table'(name,direction,sourceRanges,allowed)'&lt;/p&gt;
-
-	&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;
-
-	&lt;p&gt;- SOURCE_RANGES is 0.0.0.0/0&lt;br /&gt;
-- AND DIRECTION is INGRESS&lt;br /&gt;
-- AND IPProtocol is tcp or ALL&lt;br /&gt;
-- AND PORTS is set to 22 or range containing 22 or 3389 or range containing 3389 or Null (not set)&lt;/p&gt;
-
-	&lt;p&gt;Note:&lt;br /&gt;
-- When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;br /&gt;
-- When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC3" name="Ensure that the default network does not exist in a project" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To prevent use of default network, a project should not have a default network.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; The default network has a preconfigured network configuration and automatically generates the following insecure firewall rules:&lt;br&gt; - default-allow-internal: Allows ingress connections for all protocols and ports among instances in the network.&lt;br&gt; - default-allow-ssh: Allows ingress connections on TCP port 22(SSH) from any source to any instance in the network.&lt;br&gt; - default-allow-rdp: Allows ingress connections on TCP port 3389(RDP) from any source to any instance in the network.&lt;br&gt; - default-allow-icmp: Allows ingress ICMP traffic from any source to any instance in the network.&lt;br&gt; These automatically created firewall rules do not get audit logged and cannot be configured to enable firewall rule logging.&lt;br&gt; Furthermore, the default network is an auto mode network, which means that its subnets use the same predefined range of IP addresses, and as a result, it's not possible to use Cloud VPN or VPC Network Peering with the default network.&lt;br&gt; Based on organization security and networking requirements, the organization should create a new network and delete the default network&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; From Console:&lt;br&gt; 1. Go to the VPC networks page by visiting: &lt;br&gt; https://console.cloud.google.com/networking/networks/list.&lt;br&gt; 2. Click the network named default.&lt;br&gt; 3. On the network detail page, click EDIT.&lt;br&gt; 4. Click DELETE VPC NETWORK.&lt;br&gt; 5. If needed, create a new network to replace the default network.&lt;/p&gt; 
-&lt;p&gt;From Command Line:&lt;br&gt; For each Google Cloud Platform project,&lt;br&gt; 1. Delete the default network:&lt;br&gt; gcloud compute networks delete default&lt;br&gt; 2. If needed, create a new network to replace it:&lt;br&gt; gcloud compute networks create NETWORK_NAME&lt;/p&gt; 
-&lt;p&gt;Prevention:&lt;br&gt; The user can prevent the default network and its insecure default firewall rules from being created by setting up an Organization Policy to Skip default network creation at https://console.cloud.google.com/iam-admin/orgpolicies/compute skipDefaultNetworkCreation.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; When an organization deletes the default network, it may need to migrate or service onto a new network&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Method: networks.delete" url="https://cloud.google.com/compute/docs/reference/rest/v1/networks/delete"/>
-            <reference name="Method: networks.insert" url="https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert"/>
-            <reference name="VPC network overview - Default network" url="https://cloud.google.com/vpc/docs/vpc#default-network"/>
-            <reference name="VPC network overview - Firewall rules" url="https://cloud.google.com/vpc/docs/vpc#firewall_rules"/>
-            <reference name="gcloud compute networks delete" url="https://cloud.google.com/sdk/gcloud/reference/compute/networks/delete"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;From Console:&lt;br /&gt;
-1. Go to the VPC networks page by visiting: &lt;br /&gt;
-https://console.cloud.google.com/networking/networks/list.&lt;br /&gt;
-2. Ensure that a network with the name default is not present.&lt;/p&gt;
-
-	&lt;p&gt;From Command Line:&lt;br /&gt;
-1. Set the project name in the Google Cloud Shell:&lt;br /&gt;
-gcloud config set project PROJECT_ID &lt;br /&gt;
-2. List the networks configured in that project:&lt;br /&gt;
-gcloud compute networks list &lt;br /&gt;
-It should not list default as one of the available networks in that project&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.427">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC1" name="Ensure that VPC flow Logs is enabled for every subnet in a VPC  network" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; VPC networks and subnetworks not reserved for internal HTTP load balancing provide logically isolated and secure network partitions where GCP resources can be launched. &lt;br&gt; When Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows. Each VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet. If two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows.&lt;br&gt; Flow Logs supports the following use cases:&lt;br&gt; - Network monitoring&lt;br&gt; - Understanding network usage and optimizing network traffic expenses&lt;br&gt; - Network forensics&lt;br&gt; - Real-time security analysis&lt;br&gt; Flow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows.&lt;br&gt; The Flow Logs must be configured such that all network traffic is logged, the interval of logging is granular to provide detailed information on the connections, no logs are filtered, and metadata to facilitate investigations are included.&lt;/p&gt; 
-&lt;p&gt;Note: Subnets reserved for use by internal HTTP load balancers do not support VPC flow logs.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; From Console:&lt;/p&gt; 
-&lt;p&gt;1. Go to the VPC network GCP Console visiting &lt;br&gt; https://console.cloud.google.com/networking/networks/list&lt;br&gt; 2. Click the name of a subnet, The Subnet details page displays.&lt;br&gt; 3. Click the EDIT button.&lt;br&gt; 4. Set Flow Logs to On.&lt;br&gt; 5. Expand the Configure Logs section.&lt;br&gt; 6. Set Aggregation Interval to 5 SEC.&lt;br&gt; 7. Check the box beside Include metadata.&lt;br&gt; 8. Set Sample rate to 100.&lt;br&gt; 9. Click Save.&lt;/p&gt; 
-&lt;p&gt;Note: It is not possible to configure a Log filter from the console.&lt;/p&gt; 
-&lt;p&gt;From Command Line:&lt;/p&gt; 
-&lt;p&gt;To enable VPC Flow Logs for a network subnet, run the following command:&lt;br&gt; gcloud compute networks subnets update [SUBNET_NAME] -region [REGION] -&lt;br&gt; enable-flow-logs -logging-aggregation-interval=interval-5-sec -logging flow-sampling=1 -logging-metadata=include-all&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference:&lt;br&gt; https://cloud.google.com/vpc/&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Using VPC Flow Logs" url="https://cloud.google.com/vpc/docs/using-flow-logs#enabling_vpc_flow_logging"/>
-            <reference name="Virtual Private Cloud (VPC)" url="https://cloud.google.com/vpc/"/>
-          </references>
-          <standards>
-            <standard ref="3.8" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;From Console:&lt;/p&gt;
-
-	&lt;p&gt;1. Go to the VPC network GCP Console visiting &lt;br /&gt;
-https://console.cloud.google.com/networking/networks/list&lt;br /&gt;
-2. From the list of network subnets, make sure for each subnet:&lt;br /&gt;
-- Flow Logs is set to On&lt;br /&gt;
-- Aggregation Interval is set to 5 sec&lt;br /&gt;
-- Include metadata checkbox is checked&lt;br /&gt;
-- Sample rate is set to 100%&lt;/p&gt;
-
-	&lt;p&gt;Note: It is not possible to determine if a Log filter has been defined from the console.&lt;/p&gt;
-
-
-	&lt;p&gt;From Command Line:&lt;/p&gt;
-
-	&lt;p&gt;gcloud compute networks subnets list -format json | \
- jq -r &lt;br /&gt;
-'(["Subnet","Purpose","Flow_Logs","Aggregation_Interval","Flow_Sampling","Met&lt;br /&gt;
-adata","Logs_Filtered"] | (., map(length*"-"))), 
- (.[] | 
- [
- .name, 
- .purpose,
- (if has("enableFlowLogs") and .enableFlowLogs == true then &lt;br /&gt;
-"Enabled" else "Disabled" end),
- (if has("logConfig") then .logConfig.aggregationInterval else &lt;br /&gt;
-"N/A" end),
- (if has("logConfig") then .logConfig.flowSampling else "N/A" &lt;br /&gt;
-end),
- (if has("logConfig") then .logConfig.metadata else "N/A" end),
- (if has("logConfig") then (.logConfig | has("filterExpr")) else &lt;br /&gt;
-"N/A" end)
- ]
- ) | 
- @tsv' | \
- column -t&lt;/p&gt;
-
-	&lt;p&gt;The output of the above command will list:&lt;br /&gt;
-- each subnet&lt;br /&gt;
-- the subnet's purpose&lt;br /&gt;
-- a Enabled or Disabled value if Flow Logs are enabled&lt;br /&gt;
-- the value for Aggregation Interval or N/A if disabled, the value for Flow Sampling&lt;br /&gt;
-or N/A if disabled&lt;br /&gt;
-- the value for Metadata or N/A if disabled&lt;br /&gt;
-- 'true' or 'false' if a Logging Filter is configured or 'N/A' if disabled.&lt;br /&gt;
-If the subnet's purpose is PRIVATE then Flow Logs should be Enabled.&lt;br /&gt;
-If Flow Logs is enabled then:&lt;br /&gt;
-- Aggregation_Interval should be INTERVAL_5_SEC&lt;br /&gt;
-- Flow_Sampling should be 1&lt;br /&gt;
-- Metadata should be INCLUDE_ALL_METADATA&lt;br /&gt;
-- Logs_Filtered should be false.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.426">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC7" name="Follow best practices for VPC firewall rules" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Follow best practices for VPC firewall rules&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; VPC firewall rules let you allow or deny connections to or from your virtual machine (VM) instances based on a configuration that you specify. Enabled VPC firewall rules are always enforced, protecting your instances regardless of their configuration and operating system, even if they have not started up.&lt;br&gt; Every VPC network functions as a distributed firewall. While firewall rules are defined at the network level, connections are allowed or denied on a per-instance basis. You can think of the VPC firewall rules as existing not only between your instances and other networks, but also between individual instances within the same network.&lt;br&gt; Google Cloud recommends to follow the best practices for firewall rules.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; When designing and evaluating your firewall rules, keep in mind the following best practices:&lt;/p&gt; 
-&lt;p&gt;- Implement least-privilege principles. Block all traffic by default and only allow the specific traffic you need. This includes limiting the rule to just the protocols and ports you need.&lt;br&gt; - Use hierarchical firewall policy rules to block traffic that should never be allowed at an organization or folder level.&lt;br&gt; - For "allow" rules, restrict them to specific VMs by specifying the service account of the VMs.&lt;br&gt; - If you need to create rules based on IP addresses, try to minimize the number of rules. It's easier to track one rule that allows traffic to a range of 16 VMs than it is to track 16 separate rules.&lt;/p&gt; 
-&lt;p&gt;For more information please see Reference URL.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="VPC firewall rules overview" url="https://cloud.google.com/vpc/docs/firewalls"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that you are following VPC firewall best practices.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC6" name="Use Identity Aware Proxy (IAP) to ensure only traffic from Google  IP addresses are allowed" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; IAP ensure that access to VMs is controlled by authenticating incoming requests. Access to your apps and the VMs should be restricted by firewall rules that allow only the proxy IAP IP addresses contained in the 35.235.240.0/20 subnet. Otherwise, unauthenticated requests can be made to your apps. To ensure that load balancing works correctly health checks should also be allowed.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; From the Console:&lt;br&gt; 1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;br&gt; 2. Select the checkbox next to the following rules:&lt;br&gt;- default-allow-http&lt;br&gt;- default-allow-https&lt;br&gt;- default-allow-internal&lt;br&gt; 3. Click Delete.&lt;br&gt; 4. Click Create firewall rule and set the following values:&lt;br&gt;-&lt;br&gt; Name: allow-iap-traffic&lt;br&gt;-&lt;br&gt; Targets: All instances in the network&lt;/p&gt; 
-&lt;p&gt;- Source IP ranges (press Enter after you paste each value in the box, copy the value below the bold text including the dash):&lt;br&gt; IAP Proxy Addresses&lt;br&gt; - 35.235.240.0/20&lt;br&gt; Google Health Check&lt;br&gt;- 130.211.0.0/22 **```Google Health Check&lt;br&gt;-&lt;br&gt; Protocols and ports:&lt;br&gt;- Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by;&lt;br&gt;- tcp:80 (Default HTTP Health Check port)&lt;br&gt;- tcp:443-(Default HTTPS Health Check port)&lt;br&gt; Note: if you have custom ports used by your load balancers, you will need to list them here&lt;br&gt; 5. When you're finished updating values, click Create.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; If firewall rules are not configured correctly, legitimate business services could be negatively impacted. It is recommended to make these changes during a time of low usage.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts" url="https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts"/>
-            <reference name="Creating health checks" url="https://cloud.google.com/load-balancing/docs/health-checks"/>
-            <reference name="Identity-Aware Proxy overview" url="https://cloud.google.com/iap/docs/concepts-overview"/>
-            <reference name="Setting up an external HTTPS load balancer" url="https://cloud.google.com/iap/docs/load-balancer-howto"/>
-          </references>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="cis-gcp-standard-level-2"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From the Console:&lt;br&gt; 1. For each of your apps that have IAP enabled go to the Cloud Console VPC network &amp;gt; &lt;br&gt; Firewall rules.&lt;br&gt; 2. Verify that the only rules correspond to the following values:&lt;br&gt;-&lt;br&gt; Targets: All instances in the network&lt;br&gt;-&lt;br&gt; Source IP ranges&lt;br&gt; IAP Proxy Addresses&lt;br&gt;- 35.235.240.0/20&lt;br&gt; Google Health Check&lt;br&gt;- 130.211.0.0/22&lt;br&gt; Google Health Check&lt;br&gt;- 35.191.0.0/16&lt;br&gt;-&lt;br&gt; Protocols and ports:&lt;br&gt;- Specified protocols and ports required for access and management of &lt;br&gt; your app. For example most health check connection protocols would &lt;br&gt; be covered by;&lt;br&gt;- tcp:80 (Default HTTP Health Check port)&lt;br&gt;- tcp:443-(Default HTTPS Health Check port)&lt;/p&gt; 
-&lt;p&gt;Note: if you have custom ports used by your load balancers, you will &lt;br&gt; need to list them here&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-GOOGLE-CLOUD-VPC8" name="Use Shared VPC to connect resources from multiple projects to a common VPC network" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use Shared VPC to connect resources from multiple projects to a common VPC network&lt;/p&gt; 
-&lt;p&gt;Rationale:&lt;br&gt; Shared VPC allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network, so that they can communicate with each other securely and efficiently using internal IPs from that network. When you use Shared VPC, you designate a project as a host project and attach one or more other service projects to it. The VPC networks in the host project are called Shared VPC networks. Eligible resources from service projects can use subnets in the Shared VPC network.&lt;br&gt; Shared VPC lets organization administrators delegate administrative responsibilities, such as creating and managing instances, to Service Project Admins while maintaining centralized control over network resources like subnets, routes, and firewalls.&lt;/p&gt; 
-&lt;p&gt;Remediation:&lt;br&gt; A Shared VPC network is a VPC network defined in a host project and made available as a centrally shared network for eligible resources in service projects. Shared VPC networks can be either auto or custom mode, but legacy networks are not supported.&lt;/p&gt; 
-&lt;p&gt;When a host project is enabled, you have two options for sharing networks:&lt;br&gt; - You can share all host project subnets. If you select this option, then any new subnets created in the host project, including subnets in new networks, will also be shared.&lt;br&gt; - You can specify individual subnets to share. If you share subnets individually, then only those subnets are shared unless you manually change the list.&lt;/p&gt; 
-&lt;p&gt;Host and service projects are connected by attachments at the project level. Subnets of the Shared VPC networks in the host project are accessible by Service Project Admins&lt;/p&gt; 
-&lt;p&gt;For detailed information on setting up Shared VPC please see Reference URLs.&lt;/p&gt; 
-&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Provisioning Shared VPC" url="https://cloud.google.com/vpc/docs/provisioning-shared-vpc"/>
-            <reference name="Shared VPC overview" url="https://cloud.google.com/vpc/docs/shared-vpc"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>	&lt;p&gt;Ensure that you are using Shared VPC to connect resources from multiple projects to a common VPC network.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC1" mitigation="50"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC1" mitigation="50"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC2" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="GOOGLE-UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers could gain an unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-NET-01">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC3" mitigation="15"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC4" mitigation="15"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC5" mitigation="14"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC6" mitigation="14"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC7" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-NON-IDENTIFY">
-                  <countermeasures>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC8" mitigation="14"/>
-                    <countermeasure ref="C-GOOGLE-CLOUD-VPC9" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC3" mitigation="15"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC4" mitigation="15"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC5" mitigation="14"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC6" mitigation="14"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC7" mitigation="14"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC8" mitigation="14"/>
-                <countermeasure ref="C-GOOGLE-CLOUD-VPC9" mitigation="14"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="588091d9-34f1-43d1-a85c-90e395ce4e52" diagramComponentId="9072942d-14a0-45b6-8368-8d602901fe80" ref="63f25813-9611-4061-8a55-7e8d91ebbf0e" name="GCP Storage" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="google-storage">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="GOOGLE-USECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
-          <desc>The credentials that are used to access the resources are not securely stored and can be
-                        accessed by unauthorized personnel.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-OBSOLETE-APPS-ACCESS" name="Obsolete applications have access to the resources" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are obsolete applications that no one uses, with permissions to access the resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-EASY-FIND-RESOURCES" name="Resources are exposed" state="0" impact="100" issueId="" issueLink="">
-          <desc>When you are into a VNet, you can search its resources, but that shall be used only when you
-                        know the resource name. The problem occurs when you don't know these names and you can easily
-                        find the resources. Therefore anyone with access to the system could easily find all the
-                        resources and gain access, regardless of having any information about them.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="GOOGLE-BACKUP" name="There is no recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no processes or mechanisms to regularly save the data to another place in order to
-                        have an older version of the data to restore in case of loss. Consequently the data cannot be
-                        easily recovered or they cannot be recovered at all.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.203">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="GOOGLE-STO05" name="Block access to Cloud Storage buckets from unauthorized access" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;No storage buckets would be publicly accessible. You would have to explicitly administer bucket access.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser.&lt;/p&gt;&lt;p&gt;2. Click on the bucket name to go to its Bucket details page.&lt;/p&gt;&lt;p&gt;3. Click on the Permissions tab.&lt;/p&gt;&lt;p&gt;4. Click Delete button in front of allUsers and allAuthenticatedUsers to remove that particular role assignment.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remove allUsers and allAuthenticatedUsers access.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil iam ch -d allUsers gs://BUCKET_NAME&amp;nbsp;&lt;/p&gt;&lt;p&gt;gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="cis-gcp-standard"/>
-            <standard ref="5.1" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser.&lt;/p&gt;&lt;p&gt;2. Click on each bucket name to go to its Bucket details page.&lt;/p&gt;&lt;p&gt;3. Click on the Permissions tab.&lt;/p&gt;&lt;p&gt;4. Ensure that allUsers and allAuthenticatedUsers are not in the Members list.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all buckets in a project gsutil ls&lt;/p&gt;&lt;p&gt;2. Check the IAM Policy for each bucket: gsutil iam get gs://BUCKET_NAME&lt;/p&gt;&lt;p&gt;No role should contain allUsers and/or allAuthenticatedUsers as a member.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-STO04" name="Enable Data Storage versioning" issueId="" issueLink="" platform="" cost="1" risk="27" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Enable data storage versioning to make data backups and avoid accidental or intentional
-                        removal of the data.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        To enable Object Versioning on a bucket:&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Using GSUTIL: Use the gsutil versioning set on command, replacing [VALUES_IN_BRACKETS]
-                        with the appropriate values: gsutil versioning set on gs://[BUCKET_NAME]&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Using REST APIS:&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;JSON API:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Get an authorization access token from the OAuth 2.0 Playground. Configure the
-                        playground to use your own OAuth credentials.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create a .json file that contains the following information: {&amp;quot;versioning&amp;quot;:
-                        { &amp;quot;enabled&amp;quot;: true }}&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Use cURL to call the JSON API with a PATCH Bucket request, replacing
-                        [VALUES_IN_BRACKETS] with the appropriate values:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        curl -X PATCH --data-binary @[JSON_FILE_NAME].json \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        -H &amp;quot;Authorization: Bearer [OAUTH2_TOKEN]&amp;quot; \&amp;nbsp;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        -H &amp;quot;Content-Type: application/json&amp;quot; \ &amp;quot;https://www.googleapis.com/storage/v1/b/[BUCKET_NAME]?fields=versioning&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;XML API:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Get an authorization access token from the OAuth 2.0 Playground. Configure the
-                        playground to use your own OAuth credentials.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Create an .xml file that contains the following information, replacing
-                        [VALUES_IN_BRACKETS] with the appropriate values: Enabled&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Use cURL to call the XML API, with a PUT Bucket request and versioning query string
-                        parameter, replacing [VALUES_IN_BRACKETS] with the appropriate values:&amp;nbsp;&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        curl -X PUT --data-binary @[XML_FILE_NAME].xml \
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        -H &amp;quot;Authorization: Bearer [OAUTH2_TOKEN]&amp;quot; \
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;div&gt;
-                        &amp;quot;https://storage.googleapis.com/[BUCKET_NAME]?versioning&amp;quot;
-                        &lt;/div&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: enable versioning" url="https://cloud.google.com/storage/docs/using-object-versioning#enable-object-versioning-xml"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that Data Storage versioning is enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-STO06" name="Enable uniform bucket-level access for Cloud Storage buckets" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It is recommended to use uniform bucket-level access to unify and simplify how you grant access to your Cloud Storage resources.&lt;/p&gt;&lt;p&gt;Cloud Storage offers two systems for granting users permission to access your buckets and objects: Cloud Identity and Access Management (Cloud IAM) and Access Control Lists (ACLs). These systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission. Cloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels. ACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis.&lt;/p&gt;&lt;p&gt;In order to support a uniform permissioning system, Cloud Storage has uniform bucket-level access. Using this feature disables ACLs for all Cloud Storage resources: access to Cloud Storage resources then is granted exclusively through Cloud IAM. Enabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible either.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If you enable uniform bucket-level access, you revoke access from users who gain their access solely through object ACLs.&lt;/p&gt;&lt;p&gt;Certain Google Cloud services, such as Stackdriver, Cloud Audit Logs, and Datastore, cannot export to Cloud Storage buckets that have uniform bucket-level access enabled.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Open the Cloud Storage browser in the Google Cloud Console by visiting: https://console.cloud.google.com/storage/browser&lt;/p&gt;&lt;p&gt;2. In the list of buckets, click on the name of the desired bucket.&lt;/p&gt;&lt;p&gt;3. Select the Permissions tab near the top of the page.&lt;/p&gt;&lt;p&gt;4. In the text box that starts with This bucket uses fine-grained access control..., click Edit.&lt;/p&gt;&lt;p&gt;5. In the pop-up menu that appears, select Uniform.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line: Use the on option in a uniformbucketlevelaccess set command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil uniformbucketlevelaccess set on gs://BUCKET_NAME/&lt;/p&gt;&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
-          </references>
-          <standards>
-            <standard ref="5.2" supportedStandardRef="cis-gcp-standard-level-2"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Open the Cloud Storage browser in the Google Cloud Console by visiting: https://console.cloud.google.com/storage/browser&lt;/p&gt;&lt;p&gt;2. For each bucket, make sure that Access control column has the value Uniform.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all buckets in a project&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil ls&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. For each bucket, verify that uniform bucket-level access is enabled.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil uniformbucketlevelaccess get gs://BUCKET_NAME/&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If uniform bucket-level access is enabled, the response looks like:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Uniform bucket-level access setting for gs://BUCKET_NAME/:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enabled: True&amp;nbsp;&lt;/p&gt;&lt;p&gt;LockedTime: LOCK_DATE&lt;/p&gt;&lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-STO01" name="Revoke access to Storage for unnecessary applications" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Create a mechanism or process to review all applications with access to the Data Storage and
-                        verify that these applications should have access. If an application should not have access to
-                        the data storage, you have to revoke the access from this application.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;To revoke the access from an application, go to the &lt;a
-                        href="https://www.google.com/accounts/ManageAccount"&gt;Google Account&lt;/a&gt;.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Click in to Authorizing applications and sites.&lt;/li&gt;
-                        &lt;li&gt;In the next page, you can revoke access for applications by clicking Revoke Access
-                        next to the application.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Best practices Storage" url="https://cloud.google.com/storage/docs/best-practices#security"/>
-          </references>
-          <standards>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that there are only the necessary accesses from applications to the data storages.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.136">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-STO02" name="Securely store your credentials" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that you securely store your credentials. This can be done differently depending on
-                        your environment and where you store your credentials. For example, if you store your
-                        credentials in a configuration file, make sure that you set appropriate permissions on that file
-                        to prevent unwanted access. If you are using Google App Engine, consider using StorageByKeyName
-                        to store your credentials.</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Best practices storage" url="https://cloud.google.com/storage/docs/best-practices"/>
-          </references>
-          <standards>
-            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the credentials are stored securely.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="GOOGLE-STO03" name="Use apropriate names for the buckets" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Google Cloud Storage requests refer to buckets and objects by their names. As a result, even
-                        though ACLs will prevent unauthorized third parties from operating on buckets or objects, a
-                        third party can attempt requests with bucket or object names and determine their existence by
-                        observing the error responses.&amp;nbsp;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        It can then be possible for information in bucket or object names to be leaked. If you are
-                        concerned about the privacy of your bucket or object names, you should take appropriate
-                        precautions, such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Choosing bucket and object names that are difficult to guess. For example, a bucket
-                        named mybucket-gtbytul3 is random enough that unauthorized third parties cannot feasibly guess
-                        it or enumerate other bucket names from it.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Avoiding use of sensitive information as part of bucket or object names. For example,
-                        instead of naming your bucket mysecretproject-prodbucket, name it somemeaninglesscodename-prod.
-                        In some applications, you may want to keep sensitive metadata in custom Google Cloud Storage
-                        headers such as x-goog-meta, rather than encoding the metadata in object names.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Google Cloud docs: Best practices Storage" url="https://cloud.google.com/storage/docs/best-practices#security"/>
-          </references>
-          <standards/>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all buckets are named appropriately.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GOOGLE CLOUD PLATFORM" name="Google Cloud Platform" desc="" library="Google Cloud Platform">
-          <threats>
-            <threat ref="LOSS-DATA-REMOVED" name="Attackers destroy the data and the data cannot be recovered" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;Attackers gain access to the systems and data with excessive permissions and they remove all the information from the system, which might lead to permanent loss of data, including sensitive or personal data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-BACKUP">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-STO04" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-STO04" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="ACCESS-TO-RESOURCES" name="Attackers gain access to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>Explicit naming of resources, missing security policies or misconfigurations on user permissions can lead attackers to exploit resources.</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-EASY-FIND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-STO03" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-STO03" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
-              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="GOOGLE-EASY-FIND-RESOURCES">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-STO05" mitigation="25"/>
-                    <countermeasure ref="GOOGLE-STO06" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-OBSOLETE-APPS-ACCESS">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-STO01" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="GOOGLE-USECURE-CREDENTIALS">
-                  <countermeasures>
-                    <countermeasure ref="GOOGLE-STO02" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="GOOGLE-STO01" mitigation="25"/>
-                <countermeasure ref="GOOGLE-STO02" mitigation="25"/>
-                <countermeasure ref="GOOGLE-STO05" mitigation="25"/>
-                <countermeasure ref="GOOGLE-STO06" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f4004de3-8b6b-40c0-a318-c0adda21927f" diagramComponentId="8f5e75a1-2ea1-4e18-aafb-caa6b7fa9d6f" ref="91280f47-7175-45c8-9dc4-6e3692293927" name="Rich Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rich-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.382">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.129">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.381">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.381">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.380">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.382">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.252">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="dc6515dc-53ae-4268-bdd3-1dda865358d8" diagramComponentId="27986218-4f23-4502-9b88-e757ba4c126b" ref="2a4f86ab-abb0-449b-a498-d403a62a3948" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.473">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.071">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.465">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:53.603">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.071">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.471">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.161">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.159">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:52.895">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.787">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
-&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.783">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.785">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.321">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="b432c1a5-c433-481f-b625-9efb3d320609" diagramComponentId="5d9d2fe4-6d89-43a0-8564-c80623a76348" ref="6dd70f5e-d8b5-4c38-94de-192c64730327" name="Generic Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.753">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.093">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.896">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.685">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="798a6555-6507-492d-a99e-c9383cf2ceea" diagramComponentId="5b8ecac1-55fe-4f92-aa04-25c93f772c63" ref="00449516-33db-479d-a201-3582f48fd42b" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.019">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.695">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.404">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.374">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.242">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.361">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.808">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
-&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="ff707509-f1f3-478d-99c9-581a1ef162f9" diagramComponentId="36a9ecb9-0041-4196-be07-a2fc14ffe2c5" ref="b740e9e6-5afd-46b4-aecc-6037cfd51e04" name="Rich Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rich-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.932">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.237">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.115">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.872">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7f63eb6d-8f3a-470f-a055-4db92b3a8db1" diagramComponentId="aa1102e7-22a4-47d4-95e5-f289ab9213b7" ref="9ced54cb-300b-4cea-9dba-c1eb433ee864" name="Generic Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.638">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.865">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.730">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.730">
-              <output/>
-            </source>
-            <references>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.587">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.732">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields>
-            <customField ref="countermeasure-action-state" value="False"/>
-          </customFields>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields>
-                <customField ref="is-relevant" value=""/>
-              </customFields>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 81ee0127401c4cbaa4a2ff3a399d11a120f4d03a Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:24:29 -0400
Subject: [PATCH 24/28] Delete Templates/simple-3-tier-web-application.xml

---
 Templates/simple-3-tier-web-application.xml | 10151 ------------------
 1 file changed, 10151 deletions(-)
 delete mode 100644 Templates/simple-3-tier-web-application.xml

diff --git a/Templates/simple-3-tier-web-application.xml b/Templates/simple-3-tier-web-application.xml
deleted file mode 100644
index 4dfc53f..0000000
--- a/Templates/simple-3-tier-web-application.xml
+++ /dev/null
@@ -1,10151 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="Simple 3 Tier Web Application" name="Simple 3 Tier Web Application" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTQzNCIgZHk9IjgxMyIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIGJhY2tncm91bmQ9Im5vbmUiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjEuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJJbnRlcm5ldCIgc3R5bGU9ImlyLnJlZj1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTU5NiIgeT0iLTYzIiB3aWR0aD0iNDIxIiBoZWlnaHQ9IjE4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNCIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWFwcGxpY2F0aW9uLXNlcnZlci1zaWRlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVVNd0xqTTJOVGcxTXlBd0xqSTRNamM0TWlBd0xqTTNPRGN5TlNBd0xqSTJPVGt4TVNBd0xqTTVORFl3TXlBd0xqSTJPVGt4TVVnd0xqWXdOVFF6TmtNd0xqWXlNVE14TkNBd0xqSTJPVGt4TVNBd0xqWXpOREU0TmlBd0xqSTRNamM0TWlBd0xqWXpOREU0TmlBd0xqSTVPRFkyTVVNd0xqWXpOREU0TmlBd0xqTXhORFV6T1NBd0xqWXlNVE14TkNBd0xqTXlOelF4TVNBd0xqWXdOVFF6TmlBd0xqTXlOelF4TVVnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqTXlOelF4TVNBd0xqTTJOVGcxTXlBd0xqTXhORFV6T1NBd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVZwTk1DNHpPVFEyTURNZ01DNDJPVEUxTnpoRE1DNHpOemczTWpVZ01DNDJPVEUxTnpnZ01DNHpOalU0TlRNZ01DNDNNRFEwTlNBd0xqTTJOVGcxTXlBd0xqY3lNRE15T0VNd0xqTTJOVGcxTXlBd0xqY3pOakl3TmlBd0xqTTNPRGN5TlNBd0xqYzBPVEEzT0NBd0xqTTVORFl3TXlBd0xqYzBPVEEzT0Vnd0xqVTFNREF4T1ZZd0xqWTVNVFUzT0Vnd0xqTTVORFl3TTFwTk1DNDJNakF6TlRFZ01DNDJNams1TVRGSU1DNDJNRFExTmpWRE1DNDFPVGN4TkRRZ01DNDJNams1TVRFZ01DNDFPVEF3TmpnZ01DNDJNekV6T1RNZ01DNDFPRE0yTVRrZ01DNDJNelF3TnpoSU1DNHpPVFEyTURORE1DNHpOemczTWpVZ01DNDJNelF3TnpnZ01DNHpOalU0TlRNZ01DNDJNakV5TURZZ01DNHpOalU0TlRNZ01DNDJNRFV6TWpoRE1DNHpOalU0TlRNZ01DNDFPRGswTkRrZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTkRrZ01DNDJNelF4T0RZZ01DNDJNRFV6TWpoRE1DNDJNelF4T0RZZ01DNDJNVFUzTkRVZ01DNDJNamcyTkRZZ01DNDJNalE0TmpnZ01DNDJNakF6TlRFZ01DNDJNams1TVRGYVRUQXVOamN5TlRFNUlEQXVOakk1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVMU1EQXhPVll3TGpnM05UTTJOa013TGpVMU1EQXhPU0F3TGpnM09EQTBNaUF3TGpVMU1ESXhNaUF3TGpnNE1EWTNNaUF3TGpVMU1EVTROQ0F3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNams1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOemMxTWpRZ01DNDJOakkzTWt3d0xqYzNPVGsxT1NBd0xqWTJNamM0T0VNd0xqZ3dNVGN6TmlBd0xqWTJOREF3TlNBd0xqZ3hPVEUyT0NBd0xqWTRNVFF6TnlBd0xqZ3lNRE00TmlBd0xqY3dNekU1T0V3d0xqZ3lNRFExTXlBd0xqY3dOVFl6TTFZd0xqZzFOelE0TWt3d0xqZ3lNRE00TmlBd0xqZzFPVGt4TjBNd0xqZ3hPVEUyT0NBd0xqZzRNVFkzT0NBd0xqZ3dNVGN6TnlBd0xqZzVPVEV4SURBdU56YzVPVGMxSURBdU9UQXdNekk0VERBdU56YzNOVFFnTUM0NU1EQXpPVFpJTUM0Mk1qVTJOemRETUM0Mk1ESTNPVFFnTUM0NU1EQXpPVFlnTUM0MU9EUXdPVFFnTUM0NE9ESTBPRFFnTUM0MU9ESTRNeklnTUM0NE5UazVNVGRNTUM0MU9ESTNOalFnTUM0NE5UYzBPREpXTUM0M01EVTJNek5ETUM0MU9ESTNOalFnTUM0Mk9ESTNOU0F3TGpZd01EWTNOQ0F3TGpZMk5EQTFJREF1TmpJek1qUXlJREF1TmpZeU56ZzRUREF1TmpJMU5qYzNJREF1TmpZeU56SklNQzQzTnpjMU1qUmFUVEF1TnprME1ESTVJREF1TnpJNE56UXhTREF1TmpBNU1UZzRUREF1TmpBNU1UY3lJREF1T0RVM05EZ3lRekF1TmpBNU1UY3lJREF1T0RZMk1ESTRJREF1TmpFMU5qWTNJREF1T0Rjek1EVTJJREF1TmpJek9UZzVJREF1T0Rjek9UQXhUREF1TmpJMU5qYzNJREF1T0Rjek9UZzNTREF1TnpjM05UUk1NQzQzTnpreU1qZ2dNQzQ0TnpNNU1ERkRNQzQzT0RZNU9UWWdNQzQ0TnpNeE1UTWdNQzQzT1RNeE56RWdNQzQ0TmpZNU16Y2dNQzQzT1RNNU5pQXdMamcxT1RFM1REQXVOemswTURRMUlEQXVPRFUzTkRneVREQXVOemswTURJNUlEQXVOekk0TnpReFdrMHdMalkzT0RRNU15QXdMamMwT0RVME4wTXdMalk0TXpVd055QXdMamMwT0RVME55QXdMalk0TnpZMUlEQXVOelV5TWpjeklEQXVOamc0TXpBMklEQXVOelUzTVRBM1REQXVOamc0TXprM0lEQXVOelU0TkRWV01DNDROVEE0T0VNd0xqWTRPRE01TnlBd0xqZzFOVGc1TXlBd0xqWTRORFkzTVNBd0xqZzJNREF6TnlBd0xqWTNPVGd6TnlBd0xqZzJNRFk1TTB3d0xqWTNPRFE1TXlBd0xqZzJNRGM0TTBnd0xqWXpNakkzT1VNd0xqWXlOekkyTmlBd0xqZzJNRGM0TXlBd0xqWXlNekV5TWlBd0xqZzFOekExTnlBd0xqWXlNalEyTmlBd0xqZzFNakl5TkV3d0xqWXlNak0zTmlBd0xqZzFNRGc0VmpBdU56VTRORFZETUM0Mk1qSXpOellnTUM0M05UTTBNemNnTUM0Mk1qWXhNRElnTUM0M05Ea3lPVE1nTUM0Mk16QTVNelVnTUM0M05EZzJNemhNTUM0Mk16SXlOemtnTUM0M05EZzFORGRJTUM0Mk56ZzBPVE5hVFRBdU5qWTROVGtnTUM0M05qZ3pOVFJJTUM0Mk5ESXhPREpXTUM0NE5EQTVOemRJTUM0Mk5qZzFPVll3TGpjMk9ETTFORnBOTUM0M05UYzNNVGdnTUM0M09EZ3hPVGxETUM0M05qTXhPRGNnTUM0M09EZ3hPVGtnTUM0M05qYzJNakVnTUM0M09USTJNek1nTUM0M05qYzJNakVnTUM0M09UZ3hNRE5ETUM0M05qYzJNakVnTUM0NE1ETXhNVFlnTUM0M05qTTRPVFlnTUM0NE1EY3lOaUF3TGpjMU9UQTJNaUF3TGpnd056a3hOVXd3TGpjMU56Y3hPQ0F3TGpnd09EQXdOa2d3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpnd09EQXdOaUF3TGpjd01UWTFPU0F3TGpnd016VTNNaUF3TGpjd01UWTFPU0F3TGpjNU9ERXdNME13TGpjd01UWTFPU0F3TGpjNU16QTRPU0F3TGpjd05UTTROQ0F3TGpjNE9EazBOaUF3TGpjeE1ESXhPQ0F3TGpjNE9ESTVUREF1TnpFeE5UWXlJREF1TnpnNE1UazVTREF1TnpVM056RTRXazB3TGpjM01Ea3lNaUF3TGpjME9EVTBOME13TGpjM05qTTVNaUF3TGpjME9EVTBOeUF3TGpjNE1EZ3lOU0F3TGpjMU1qazRNU0F3TGpjNE1EZ3lOU0F3TGpjMU9EUTFRekF1Tnpnd09ESTFJREF1TnpZek5EWTBJREF1TnpjM01TQXdMamMyTnpZd055QXdMamMzTWpJMk5pQXdMamMyT0RJMk0wd3dMamMzTURreU1pQXdMamMyT0RNMU5FZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamMyT0RNMU5DQXdMamN3TVRZMU9TQXdMamMyTXpreUlEQXVOekF4TmpVNUlEQXVOelU0TkRWRE1DNDNNREUyTlRrZ01DNDNOVE0wTXpjZ01DNDNNRFV6T0RRZ01DNDNORGt5T1RNZ01DNDNNVEF5TVRnZ01DNDNORGcyTXpoTU1DNDNNVEUxTmpJZ01DNDNORGcxTkRkSU1DNDNOekE1TWpKYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9NzI5YzE3OWUtMjc4OS00MjVmLTkxY2EtNDMzMjRjNTk3OTIxOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY2IiB5PSIzMyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IldlYiBDbGllbnQgLT4gV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTA2MmY3MDI1LWRlZDUtNGU4NC1hNGNiLWViMmNlNzgzYzljMztpci5hc3NldHM9Q3JlZGl0IENhcmQgRGF0YTtpci50YWdzPUhUVFBTOyIgcGFyZW50PSI1IiBzb3VyY2U9IjYiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJXZWIgQ2xpZW50IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTVhNmY2ZWQ1LTFjZjAtNDE2Yy1hOWRjLTY0MTQ3YzlkYTA0ZjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyODciIHk9IjI4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTk4IiB5PSIxNjMiIHdpZHRoPSIyMzAiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMiIgdmFsdWU9Ik1pY3Jvc29mdCBTUUwgU2VydmVyIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LXNxbC1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGd3TnpoRE1DNDRNemsyTmpnZ01DNHpOREE0T1RnZ01DNDJPRGMwTXpNZ01DNDBNVFl3TnpnZ01DNDBPVGsyTmpnZ01DNDBNVFl3TnpoRE1DNHpNVEU1TURNZ01DNDBNVFl3TnpnZ01DNHhOVGsyTmpnZ01DNHpOREE0T1RnZ01DNHhOVGsyTmpnZ01DNHlORGd3TnpoRE1DNHhOVGsyTmpnZ01DNHhOVFV5TlRnZ01DNHpNVEU1TURNZ01DNHdPREF3TnpneElEQXVORGs1TmpZNElEQXVNRGd3TURjNE1VTXdMalk0TnpRek15QXdMakE0TURBM09ERWdNQzQ0TXprMk5qZ2dNQzR4TlRVeU5UZ2dNQzQ0TXprMk5qZ2dNQzR5TkRnd056aGFUVEF1T0RNNU5qWTRJREF1TXpjMk16QTBRekF1T0RFNE1UZzJJREF1TXprME9UYzVJREF1TnprME1qa3hJREF1TkRFd056VTFJREF1TnpZNE5qQTRJREF1TkRJek1qRTRRekF1TmprMk5EUXpJREF1TkRVNE9ETTBJREF1TmpBeE16STRJREF1TkRjNU1EYzRJREF1TkRrNU5qWTRJREF1TkRjNU1EYzRRekF1TXprNE1EQTRJREF1TkRjNU1EYzRJREF1TXpBeU9Ea3pJREF1TkRVNE9ETTBJREF1TWpNd056STRJREF1TkRJek1qRTRRekF1TWpBMU1EUTJJREF1TkRFd056VTFJREF1TVRneE1UVWdNQzR6T1RRNU56a2dNQzR4TlRrMk5qZ2dNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TlRrMk5qZ2dNQzQ0TkRRNE9UZ2dNQzR6TVRFNU1ETWdNQzQ1TWpBd056Z2dNQzQwT1RrMk5qZ2dNQzQ1TWpBd056aERNQzQyT0RjME16TWdNQzQ1TWpBd056Z2dNQzQ0TXprMk5qZ2dNQzQ0TkRRNE9UZ2dNQzQ0TXprMk5qZ2dNQzQzTlRJd056aFdNQzR6TnpZek1EUmFUVEF1TlRBNE56TWdNQzQxTWpFeU56ZERNQzQxTURjMU5qZ2dNQzQxTWpFeE1qRWdNQzQwT0RnNE16RWdNQzQxTWpjNE56WWdNQzQwTnpZM05EUWdNQzQxTXpJM09EUkRNQzQwTmpBME16SWdNQzQxTXprME16Y2dNQzQwTkRjM05qVWdNQzQxTkRVM056RWdNQzQwTXprNU5UTWdNQzQxTlRFeU5UbERNQzQwTXpjME16VWdNQzQxTlRNd05EUWdNQzQwTXpRek5qSWdNQzQxTlRZd01Ua2dNQzQwTXpNeU1USWdNQzQxTlRjM01EZE1NQzQwTXpNd01UWWdNQzQxTlRnd01UUk1NQzQwTXpJNE1qY2dNQzQxTlRnek9EUkRNQzQwTXpJMk1UY2dNQzQxTlRnNU1UTWdNQzQwTXpJMU1TQXdMalUxT1RVME5pQXdMalF6TWpVeElEQXVOVFl3TVRjNVREQXVORE15TmpneUlEQXVOVFl3TXpReFF6QXVORE15TnpJNElEQXVOVFl3T1RBMklEQXVORE15T0RZeklEQXVOVFl4TlRReklEQXVORE16TVRRMElEQXVOVFl5TWpNNVF6QXVORE16T0RNZ01DNDFOak01TWpjZ01DNDBNelU0TXpjZ01DNDFOalU1T0RVZ01DNDBNemd4TURVZ01DNDFOamd3T1RkRE1DNDBNemd4TURVZ01DNDFOamd3T1RjZ01DNDBOakUxT1RRZ01DNDFPVEV3TURRZ01DNDBOalEwTkRNZ01DNDFPVFF5TnpkRE1DNDBOemMwTWpnZ01DNDJNRGt5TmpjZ01DNDBPRE13TnpZZ01DNDJNalF3TkRjZ01DNDBPRE0yTURRZ01DNDJORFEwTWpGRE1DNDBPRE01TWpFZ01DNDJOVGMxTVRFZ01DNDBPREUwTkNBd0xqWTJPVEF4T0NBd0xqUTNOVEkyTkNBd0xqWTRNak0zTkVNd0xqUTJOREk0TlNBd0xqY3dOak16TmlBd0xqUTBNVFk0TVNBd0xqY3pNalU1TWlBd0xqUXdOVGswTnlBd0xqYzJNVGt6T1V3d0xqUXdOVEV4TlNBd0xqYzJNall3TWtNd0xqUXdNek0xTnlBd0xqYzJNems1TXlBd0xqUXdNVEkwT1NBd0xqYzJOVGc0TXlBd0xqTTVPVEUxTXlBd0xqYzJOemt3TjBNd0xqTTVOakUxTkNBd0xqYzNNRGdnTUM0ek9UTXhPREVnTUM0M056TTVOalFnTUM0ek9URXlPRGNnTUM0M056WXpNalpETUM0ek9EWTBPRElnTUM0M09ESXpORE1nTUM0ek9ESTJPRE1nTUM0M09EZzNNamtnTUM0ek9ERXdORFlnTUM0M09UTTJNemxETUM0ek56Z3hORE1nTUM0NE1ESTFNRGdnTUM0ek56azFOamdnTUM0NE1URTBPQ0F3TGpNNE5URTJOQ0F3TGpneE9UYzJOME13TGpNNU1qTTBNaUF3TGpnek1ETXlNeUF3TGpRd05qWTBOeUF3TGpnME1UQTVNaUF3TGpReU16TXlOU0F3TGpnME9EUXlOME13TGpRek1UZ3lOQ0F3TGpnMU1qRTNOeUF3TGpRME5qRXlPU0F3TGpnMU5qazRJREF1TkRVMk9EazJJREF1T0RVNU5qY3hRekF1TkRjME56ZzVJREF1T0RZME1qRXhJREF1TlRBNU5ERTFJREF1T0RZNU1USWdNQzQxTWpnME5qa2dNQzQ0TmprNE5UaERNQzQxTXpJek1qSWdNQzQ0TnpBd01UY2dNQzQxTXprMU56a2dNQzQ0TmprNU56Y2dNQzQxTXprMU56a2dNQzQ0TmprNU56ZERNQzQxTXprMU56a2dNQzQ0TmprNU56Y2dNQzQxTkRFd09EUWdNQzQ0TmpNNU5EY2dNQzQxTkRRMU1UWWdNQzQ0TlRZNU1qWkRNQzQxTkRRMU1UWWdNQzQ0TlRZNU1qWWdNQzQxTlRnNE56SWdNQzQ0TVRrd09TQXdMalUyTkRjek1pQXdMamM1T1RrM09Vd3dMalUyTlRrMk9DQXdMamM1TlRrMk9FTXdMalUzTURreU5TQXdMamMzT1Rrd05pQXdMalUzTWprNU5DQXdMamMzTXpJZ01DNDFOelExTnprZ01DNDNORGs1TnpoRE1DNDFOell5TkRFZ01DNDNNalUyTnpJZ01DNDFOell4TkRFZ01DNDNNak00TkRjZ01DNDFOelU0TkRRZ01DNDNNVGcwTmpSTU1DNDFOelU0TVRVZ01DNDNNVGM1TkRsRE1DNDFOelV6TkNBd0xqY3dPRFEwT1NBd0xqVTNORFE1TlNBd0xqY3dNRGMwTVNBd0xqVTNNekUzTnlBd0xqWTVNekU1TkV3d0xqVTNNamszTVNBd0xqWTVNVFU0UXpBdU5qRTFNemd6SURBdU5qYzRPVGd5SURBdU5qWXlNamd4SURBdU5qWTNOVGszSURBdU5qa3pNelkxSURBdU5qWXlPRFF5VERBdU5qazRNVFk0SURBdU5qWXlNVEEwVERBdU5qazNORE1nTUM0Mk5qQTVORE5ETUM0Mk9UTXlNRGNnTUM0Mk5UUXpPVGNnTUM0Mk9UQXpNRFFnTUM0Mk5UQXpNeklnTUM0Mk9EWTRNVGtnTUM0Mk5EWXdNRFJETUM0Mk56WTJPRFVnTUM0Mk16TTBORElnTUM0Mk5qUXpPRGtnTUM0Mk1qTXlOVFVnTUM0Mk5Ea3pORE1nTUM0Mk1UUTRNVU13TGpZeU9EWTFNeUF3TGpZd016STFNU0F3TGpZd01UZzVNU0F3TGpVNU5ESXlOU0F3TGpVMk9EQXdOU0F3TGpVNE56VXlNVXd3TGpVMU5EQTNOU0F3TGpVNE5Vd3dMalV6TmpFNE9DQXdMalU0TWpBNE4wd3dMalV6TlRFeU1pQXdMalU0TURFNE5FTXdMalV5T0RnNU15QXdMalUyT1RJd05TQXdMalV5TWpBek1pQXdMalUxTlRVNE5pQXdMalV4T0RBeU1TQXdMalUwTmpRd01rd3dMalV4TlRjeE1TQXdMalUwTURnMVF6QXVOVEV6TkRrNElEQXVOVE0xTWpZNUlEQXVOVEV4TlRNMklEQXVOVEk1TlRVeklEQXVOVEV3TXpFeklEQXVOVEkxTVRNeVF6QXVOVEE1TkRFM0lEQXVOVEl4TlRReUlEQXVOVEE1TXpFZ01DNDFNakV6TXlBd0xqVXdPRGN6SURBdU5USXhNamMzV2swd0xqUTBOemMwTWlBd0xqVTNNVEU1Tmt3d0xqUTBOalU0TVNBd0xqVTNNRGcwT1V3d0xqUTBPVEUyTnlBd0xqVTNNamt3TjBNd0xqUTJNRFEyTXlBd0xqVTRNVGMzTkNBd0xqUTNNREl5T0NBd0xqVTVNamd3TmlBd0xqUTNOalF3TWlBd0xqWXdNelkzT0VNd0xqUTNOekE0T1NBd0xqWXdORGc1TXlBd0xqUTNOelkyT1NBd0xqWXdOVGM1TWlBd0xqUTNOemN5TWlBd0xqWXdOVGN6T0VNd0xqUTNOemMzTmlBd0xqWXdOVGN6T0NBd0xqUTNOekkwTnlBd0xqWXdNell5TnlBd0xqUTNOalUyTWlBd0xqWXdNVEUwTlV3d0xqUTNNelF3TmlBd0xqVTVNRFEzTjBNd0xqUTNNVFF3TVNBd0xqVTRNemsxTWlBd0xqUTJPVEk1TkNBd0xqVTNOelF4SURBdU5EWTVNRFkzSURBdU5UYzNNVGd6VERBdU5EWTRNalkwSURBdU5UYzJPVGN5VERBdU5EWXpNakEzSURBdU5UYzFOalV5VERBdU5EVTJNalFnTUM0MU56TTRNRFZNTUM0ME5EZzFPRGNnTUM0MU56RTBPREpNTUM0ME5EYzNORElnTUM0MU56RXhPVFphVFRBdU5EYzFNems1SURBdU5UYzROVEF4VERBdU5EY3lOVFE1SURBdU5UYzRNREk0VERBdU5EY3lOVEV4SURBdU5UYzRNRE00VERBdU5EY3pOVFV6SURBdU5UZ3dOREF4UXpBdU5EYzNNVFF5SURBdU5UZzRNRFUxSURBdU5EZ3hNU0F3TGpVNU9Ea3lPU0F3TGpRNE15QXdMall3TmpJMk5Vd3dMalE0TXpVNE1pQXdMall3T0RJM01Vd3dMalE0TmpRek1TQXdMall3TlRRM00wTXdMalE0T1RReU5DQXdMall3TWpRNE1pQXdMalE1TXpNeklEQXVOVGs1TWpJNElEQXVORGszTnpFMUlEQXVOVGsyTURjMFREQXVOVEF4TXpZNUlEQXVOVGt6TlRRMFF6QXVOVEF6TmpreElEQXVOVGt4T1RZeElEQXVOVEV3TnpFeUlEQXVOVGczTnpreUlEQXVOVEV5TkRVeklEQXVOVGcyT0RrMVREQXVOVEV6T0RnZ01DNDFPRFU1T1RkTU1DNDFNVE15TmpJZ01DNDFPRFUzT0RKTU1DNDFNVEEzTmpNZ01DNDFPRFV6TVVNd0xqVXdNRFEzTVNBd0xqVTRNelUyT1NBd0xqUTRORE0zTXlBd0xqVTRNRFV3T0NBd0xqUTNOVE01T1NBd0xqVTNPRFV3TVZwTk1DNDFNVGd5TlRrZ01DNDFPRFkzTXpkTU1DNDFNVGczTnlBd0xqVTROemN6TlV3d0xqVXlNREUxT1NBd0xqVTVNalU1TlVNd0xqVXlNakV4TWlBd0xqWXdNREkwT1NBd0xqVXlNekF4SURBdU5qQTROems1SURBdU5USXlOamswSURBdU5qRTJOemRNTUM0MU1qSXpOelVnTUM0Mk1qRXpNVXd3TGpVeU1qSXhPU0F3TGpZeU1UZ3pOa3d3TGpVeE9UUTNOQ0F3TGpZeU1EazBUREF1TlRBMk1EUXlJREF1TmpFMk9EbE1NQzQwT1RZM056Y2dNQzQyTVRReU16VkRNQzQwT1RJeU9TQXdMall4TXpBeU1pQXdMalE0T0RZME9TQXdMall4TVRreE5DQXdMalE0T0RZME9TQXdMall4TVRnd04wTXdMalE0T0RZME9TQXdMall4TVRRNU1TQXdMalE1TlRFNU15QXdMall3TkRrME55QXdMalE1TnprNU1pQXdMall3TWpRMk5VTXdMalV3TXpNeU1TQXdMalU1TnpjMk55QXdMalV4TnpjNE5DQXdMalU0TmpVM055QXdMalV4T0RJMU9TQXdMalU0Tmpjek4xcE5NQzQxTlRNMk1qTWdNQzQxT1RJM05UTkRNQzQxTkRNM05UTWdNQzQxT1RBNE5UTWdNQzQxTWpJd05pQXdMalU0TnpFd05TQXdMalV5TVRrd01pQXdMalU0TnpJMk5Fd3dMalV5TWpVek5TQXdMalU0T0RrMU0wTXdMalV5TmpJeklEQXVOVGszTlRBMElEQXVOVEk0TWpNMklEQXVOakEzTmpNNElEQXVOVEk0TWpNMklEQXVOakUzTmpZM1REQXVOVEk0TXpReElEQXVOakl4TURRMVREQXVOVE16TXpVMklEQXVOakUzTnpjeVF6QXVOVFF6TmpRNElEQXVOakV3T1RFeElEQXVOVFV6T1RreklEQXVOakExTWpZeklEQXVOVFkzT1RJNElEQXVOVGs0T1RneVREQXVOVGN4TlRrMklEQXVOVGszTWpNelF6QXVOVGN5TWpJM0lEQXVOVGsyT0RnMklEQXVOVGN5TkRFeElEQXVOVGsyTnpFeElEQXVOVGN5TWpVMklEQXVOVGsyTmpVNVF6QXVOVGN4TmpJeklEQXVOVGsyTXprMklEQXVOVFl3T1RZeElEQXVOVGswTVRjNElEQXVOVFV6TmpJeklEQXVOVGt5TnpVeldrMHdMalUzT0RBd09TQXdMalU1T0RNME9VTXdMalUzT0RFMk55QXdMalU1T0RVd055QXdMalUzTnpRNElEQXVOakF5TnpneUlEQXVOVGMyT0RRM0lEQXVOakExTXpFMVF6QXVOVGMwT1RRM0lEQXVOakV6TVRneElEQXVOVFk1T0RJNElEQXVOakkwT0RRMklEQXVOVFl6TlRRM0lEQXVOak0xT0RJMVREQXVOVFl4TXpJNUlEQXVOak01TkRFMFREQXVOVFU0TVRZeklEQXVOak0zTnpJMFF6QXVOVFV5TURRZ01DNDJNelF4TXpVZ01DNDFORFV3TnpNZ01DNDJNekEzTlRjZ01DNDFNemMwTnpJZ01DNDJNamMxT0RsTU1DNDFNelUzTXpnZ01DNDJNalk0Tmt3d0xqVXpNelEyTVNBd0xqWXlOVGcwT1VNd0xqVXpNekE1TVNBd0xqWXlOVFV6TVNBd0xqVTFNREE0TnlBd0xqWXhOREk0T1NBd0xqVTFPVEEyTVNBd0xqWXdPRGt3TkVNd0xqVTJOakU0TnlBd0xqWXdORFUzTnlBd0xqVTNOemM1TnlBd0xqVTVPREV6TnlBd0xqVTNPREF3T1NBd0xqVTVPRE0wT1ZwTk1DNDFPVGN4TVRZZ01DNDJNRE13T1RoTU1DNDFPVEkxTlRZZ01DNDJNREUzT0RoTU1DNDFPREl3TWlBd0xqVTVPRGs0TWtNd0xqVTRNVGt5TXlBd0xqVTVPRGs0TWlBd0xqVTRNVGd5TlNBd0xqVTVPVEk0TWlBd0xqVTRNVGMxTXlBd0xqVTVPVGMwTmtNd0xqVTRNVGN3TnlBd0xqWXdNREF6TmlBd0xqVTRNVFkzTVNBd0xqWXdNRE01SURBdU5UZ3hOalVnTUM0Mk1EQTNOelZETUM0MU9EQTNOVE1nTUM0Mk1URTBNemtnTUM0MU56Y3hNVElnTUM0Mk1qTTVORGdnTUM0MU56RTBOalVnTUM0Mk16VTVNME13TGpVM01URXdPQ0F3TGpZek5qWTVPQ0F3TGpVM01EYzVNeUF3TGpZek56TTVOaUF3TGpVM01EVTRPU0F3TGpZek56ZzRPRU13TGpVM01EUWdNQzQyTXpnek5ETWdNQzQxTnpBek1EVWdNQzQyTXpnMk1qTWdNQzQxTnpBek5UWWdNQzQyTXpnMk1qTk1NQzQxTnpNek5qUWdNQzQyTXpjME5qRkRNQzQxT1RJeE1ESWdNQzQyTWprNE5pQXdMall4TVRVeU5pQXdMall5TXpnME15QXdMall6TkRJeU1pQXdMall4T0RZeE4wd3dMall6TmpreE15QXdMall4TnprNE0wd3dMall6TXpBMklEQXVOakUyTWpReVF6QXVOakl6TnpjeUlEQXVOakV5TURFNUlEQXVOakE1TlRJZ01DNDJNRFkzT1RVZ01DNDFPVGN4TVRZZ01DNDJNRE13T1RoYVRUQXVORGt5T1RjMUlEQXVOakl5TXpZMlREQXVORGszT0RNeklEQXVOakl6TmpNeFF6QXVOVEF6T0RRNUlEQXVOakkxTXpJeElEQXVOVEUyTmpJeklEQXVOakk1TlRrMUlEQXVOVEUyTmpJeklEQXVOakk1T1RFeVREQXVOVEUwT1RnMklEQXVOak14TXpjeFREQXVOVEV6TlRFZ01DNDJNekkyTlRkRE1DNDFNRFkxT1RZZ01DNDJNemcwTVRFZ01DNDBPVGs1TkRVZ01DNDJORFEwT0NBd0xqUTVNVGszTkNBd0xqWTFNakU0Tmt3d0xqUTROelE0T0NBd0xqWTFOak13TkVNd0xqUTROek00TVNBd0xqWTFOak13TkNBd0xqUTROek15T1NBd0xqWTFOVGs0TnlBd0xqUTROek00TVNBd0xqWTFOVFUyTkVNd0xqUTRPRFU1TmlBd0xqWTBOalk1TnlBd0xqUTRPRE16TXlBd0xqWXpOVEk1TmlBd0xqUTROalkwTXlBd0xqWXlNemN6Tmt3d0xqUTROalV6TmlBd0xqWXlNamMyTjB3d0xqUTROak00SURBdU5qSXdPVFJETUM0ME9EWTBPRE1nTUM0Mk1qQTRNemNnTUM0ME9EazJOelFnTUM0Mk1qRTFOU0F3TGpRNU1qazNOU0F3TGpZeU1qTTJObHBOTUM0Mk16a3hOelFnTUM0Mk1qTTBOalZNTUM0Mk5EQTFOVFlnTUM0Mk1qRXdPVGhETUM0Mk5EQTBOVEVnTUM0Mk1qQTVPVEVnTUM0Mk16TTJORElnTUM0Mk1qSTVORFFnTUM0Mk1qY3lOVFFnTUM0Mk1qUTVOVEZETUM0Mk1UVXdOakVnTUM0Mk1qZzJPVGtnTUM0MU9UZzRNRFlnTUM0Mk16UTFNRFVnTUM0MU9EWTROellnTUM0Mk16a3pOakZETUM0MU9EQXdOamNnTUM0Mk5ESXhNRFlnTUM0MU56RXdPVFVnTUM0Mk5EVTVOVGdnTUM0MU56RXdPVFVnTUM0Mk5EWXhNVGRNTUM0MU56SXhOVEVnTUM0Mk5EY3dNVE5NTUM0MU56WXdOVFlnTUM0Mk5UQXhPREZETUM0MU9EUTBORGdnTUM0Mk5UY3hORGtnTUM0MU9URTFNaklnTUM0Mk5qUTVNRGdnTUM0MU9UYzBNek1nTUM0Mk56TTNOelZNTUM0MU9UZzVNVEVnTUM0Mk56VTRPRFZNTUM0Mk1ERXdNRFFnTUM0Mk56TXpNREpNTUM0Mk1ESTRNVGdnTUM0Mk56RXdNekZNTUM0Mk1UWTJORFlnTUM0Mk5UTTFOVGxETUM0Mk1qY3hOU0F3TGpZME1ETTJOQ0F3TGpZek1UYzVOaUF3TGpZek5ETTBOaUF3TGpZek5EazJNaUF3TGpZeU9UZ3dOMHd3TGpZek9URTNOQ0F3TGpZeU16UTJOVnBOTUM0Mk5EUTJNakVnTUM0Mk1qSXhOVE5NTUM0Mk5EVTBNRE1nTUM0Mk1qSTBNalpNTUM0Mk5EYzJNamtnTUM0Mk1qTTJNekZETUM0Mk5qQTBOVFlnTUM0Mk16QTVOamNnTUM0Mk56TXdNVGdnTUM0Mk5EQTBNVFlnTUM0Mk9ESTVOREVnTUM0Mk5UQXhNamhETUM0Mk9EVTNOQ0F3TGpZMU1qZzNNeUF3TGpZNU1qWTFOQ0F3TGpZMk1EQTFNaUF3TGpZNU1qVTBOeUF3TGpZMk1ERXdNMHd3TGpZNE56STJPU0F3TGpZMk1EVXlOME13TGpZMk5UQTBPU0F3TGpZMk1qSXhOeUF3TGpZek5qVTVPU0F3TGpZMk5qa3hNeUF3TGpZd09USTFOeUF3TGpZM016VXhUREF1TmpBMU5qWTNJREF1TmpjME16QXlRekF1TmpBMU5UWXlJREF1TmpjME16QXlJREF1TmpBM05qSWdNQzQyTnpJeU5EUWdNQzQyTVRBeU1Ea2dNQzQyTmprM05qUkRNQzQyTWpZeU5UTWdNQzQyTlRReU9UY2dNQzQyTXpNMU9URWdNQzQyTkRRMU16UWdNQzQyTkRJeU5EWWdNQzQyTWpjeE1UUk1NQzQyTkRRMk1qRWdNQzQyTWpJeE5UTmFUVEF1TlRNNU9EUTRJREF1TmpRd01UVXlRekF1TlRNME5qYzJJREF1TmpNM05UWTJJREF1TlRJM09ERXpJREF1TmpNME16UTJJREF1TlRJM01EY3pJREF1TmpNME1UZzRRekF1TlRJMk9URTNJREF1TmpNME1UZzRJREF1TlRJMk56QTFJREF1TmpNME56RTNJREF1TlRJMk5EazFJREF1TmpNMU5UQTRRekF1TlRJME16TWdNQzQyTkRVMU9EZ2dNQzQxTWpBMU1qa2dNQzQyTlRVNU16UWdNQzQxTVRVM056a2dNQzQyTmpRMU9EbERNQzQxTVRRek5UTWdNQzQyTmpjeE56WWdNQzQxTVRRek1ERWdNQzQyTmpjek9Ea2dNQzQxTVRRMU1UTWdNQzQyTmpjek9EbE1NQzQxTVRreU1Ea2dNQzQyTmpRMU9EbERNQzQxTWpnd056Z2dNQzQyTlRreU1EY2dNQzQxTXpZMU56VWdNQzQyTlRRMU1Ea2dNQzQxTkRZME9Ua2dNQzQyTkRrMU5EaERNQzQxTkRrMk1USWdNQzQyTkRnd01UWWdNQzQxTlRJeE5EVWdNQzQyTkRZMk9UY2dNQzQxTlRJd09UUWdNQzQyTkRZMk5EVk1NQzQxTkRreE5qZ2dNQzQyTkRVd01ERk1NQzQxTXprNE5EZ2dNQzQyTkRBeE5USmFUVEF1TlRJd01qRXlJREF1TmpNMU5EVTFRekF1TlRJd016Y2dNQzQyTXpVMk1UTWdNQzQxTVRnMU56WWdNQzQyTkRJeE1EWWdNQzQxTVRjME5qY2dNQzQyTkRVMk5ESkRNQzQxTVRVek1ETWdNQzQyTlRJek5EUWdNQzQxTVRFMk5qSWdNQzQyTmpBM016Y2dNQzQxTURneE1qVWdNQzQyTmpjd056Rk1NQzQxTURZNE5qWWdNQzQyTmpreU5URk1NQzQxTURVek1qY2dNQzQyTnpFNU1qZE1NQzQxTURRd01EY2dNQzQyTnpRd016aE1NQzQxTURFd05UTWdNQzQyTnpFeE9EbE1NQzQwT1RreE1ESWdNQzQyTmprek56VkRNQzQwT1RjM09Ua2dNQzQyTmpneU1qRWdNQzQwT1RZMU5UVWdNQzQyTmpjeU16a2dNQzQwT1RVeU56VWdNQzQyTmpZek5UbE1NQzQwT1RNeU9ESWdNQzQyTmpVd09EVk1NQzQwT1RFeU16WWdNQzQyTmpNNU5UWk1NQzQwT0RnM01ERWdNQzQyTmpJME9FTXdMalE0T0Rjd01TQXdMalkyTWpBMU5pQXdMalE1TnpjeU5pQXdMalkxTXpnM05pQXdMalV3TkRZME1TQXdMalkwTnprMk5Vd3dMalV4TXpBNE5pQXdMalkwTURrMk4wTXdMalV4TlRVek5pQXdMall6T0RrNE9DQXdMalV4TnpjNE55QXdMall6TnpJd05pQXdMalV4T1RBM09TQXdMall6TmpJek1rTXdMalV4T1RjMk5pQXdMall6TlRjeE5DQXdMalV5TURFNE1pQXdMall6TlRReU5DQXdMalV5TURJeE1pQXdMall6TlRRMU5WcE5NQzQxTmpRM05qSWdNQzQyTlRRME1EUk1NQzQxTmpJeE56WWdNQzQyTlRJM01UUk1NQzQxTmpBek1qZ2dNQzQyTlRVMU5qUkRNQzQxTlRFeE5EUWdNQzQyTmprek5ERWdNQzQxTXpnM09USWdNQzQyT0RNME9EY2dNQzQxTWpRNE5UY2dNQzQyT1RZek1USk1NQzQxTWpBMk1UVWdNQzQzTURBeU5ESk1NQzQxTVRrNE5qTWdNQzQzTURFd05USk1NQzQxTWlBd0xqY3dNVEEyTkV3d0xqVXlORFkwTnlBd0xqWTVPVFF5TjBNd0xqVTBOalEwTmlBd0xqWTVNVFF3TlNBd0xqVTJOVEV6SURBdU5qZzFORE01SURBdU5UZzVNekEySURBdU5qYzROek0yVERBdU5Ua3pOVGdnTUM0Mk56YzFNak5NTUM0MU9USTVORGNnTUM0Mk56WTRNelpETUM0MU9URTNPRFVnTUM0Mk56VTFOeUF3TGpVNE5UazNPU0F3TGpZM01ETTBOQ0F3TGpVNE1qazNNaUF3TGpZMk56ZzJNa013TGpVM056WXpPU0F3TGpZMk16TTNOaUF3TGpVM01EWTNNeUF3TGpZMU9ESTFOeUF3TGpVMk5EYzJNaUF3TGpZMU5EUXdORnBOTUM0MU5URXhORFFnTUM0Mk5UVTBOVGxNTUM0MU5EZzFJREF1TmpVNU16VTVUREF1TlRNNU5qZzRJREF1TmpjeE5UQTFRekF1TlRNME5URTFJREF1TmpjNE16WTJJREF1TlRJMU16TXhJREF1TmpnNU9EY3pJREF1TlRFNE9UazNJREF1TmprM016WTNUREF1TlRFek9UZzFJREF1TnpBek1USXlUREF1TlRFek9EYzJJREF1TnpBeU9UZ3hUREF1TlRFek56azRJREF1TnpBeU16TTJUREF1TlRFek56Y3pJREF1TnpBeE1UWTVRekF1TlRFek56Y3pJREF1TmprME56Z3hJREF1TlRFeU1UTTJJREF1TmpnM09UY3lJREF1TlRBNU1qZzNJREF1TmpneU1UWTRRekF1TlRBNE1EY3lJREF1TmpjNU56TTVJREF1TlRBM09EWWdNQzQyTnpreE5UZ2dNQzQxTURneE1qVWdNQzQyTnpnNE9UVkRNQzQxTURnM01pQXdMalkzT0RNMk1pQXdMalV4TkRNMU15QXdMalkzTlRBM0lEQXVOVEl3T0RZMElEQXVOamN4TXpnNVREQXVOVE0wTVRrNUlEQXVOalkwTURGRE1DNDFOREEzTkRVZ01DNDJOakExTWpjZ01DNDFOVEE1T0RNZ01DNDJOVFV6TlRRZ01DNDFOVEV4TkRRZ01DNDJOVFUwTlRsYVRUQXVORGczTVRjeElEQXVOamN6TVRrelREQXVORGcwTkRJMUlEQXVOamN4T0RJeVF6QXVORGcwTXpJZ01DNDJOekU0TWpJZ01DNDBPRE0zT1RFZ01DNDJOekk1T0RRZ01DNDBPRE16TnlBd0xqWTNORFV4TTB3d0xqUTRNRGcyT1NBd0xqWTRNVEU1TjB3d0xqUTNPRGt6TnlBd0xqWTROVFUwTlVNd0xqUTNOekE0T1NBd0xqWTRPVE01T0NBd0xqUTNOVE0wT0NBd0xqWTVNalF3T0NBd0xqUTNNVGcyTXlBd0xqWTVOemN6T1VNd0xqUTNNVE16TmlBd0xqWTVPRFV6TVNBd0xqUTNNVFE1TXlBd0xqWTVPRFF5TkNBd0xqUTNOakV6T1NBd0xqWTVORGN5T1VNd0xqUTRNRFUzTkNBd0xqWTVNVEU1TXlBd0xqUTRPREUzTXlBd0xqWTROVFF6T1NBd0xqUTVNekU0TnlBd0xqWTRNVGcxTVV3d0xqUTVOVEk0TXlBd0xqWTRNREkwTjB3d0xqUTVOakF5TXlBd0xqWTNPVFl4TlV3d0xqUTVOakkwT0NBd0xqWTNPVE14T0VNd0xqUTVNelUxTnlBd0xqWTNOekVnTUM0ME9UQTFORGtnTUM0Mk56VXdORElnTUM0ME9EY3hOekVnTUM0Mk56TXhPVE5hVFRBdU5UQXlNakUwSURBdU5qZzFOelUzVERBdU5UQXlORE00SURBdU5qZzFPRE16VERBdU5UQXlOekVnTUM0Mk9EWXhNak5NTUM0MU1EUXhPRGNnTUM0Mk9EZ3lOREpNTUM0MU1EUXlNVGtnTUM0Mk9EZ3lPVU13TGpVd056SXlOeUF3TGpZNU1qYzNOaUF3TGpVd09UVTFJREF1TmprNE56azBJREF1TlRFd01UTXlJREF1TnpBek5qVk1NQzQxTVRBeU16Y2dNQzQzTURRM01EZE1NQzQxTURNd01EWWdNQzQzTURjMU1ETkRNQzQwT1RBd056UWdNQzQzTVRJMU1UY2dNQzQwTnpneE5EWWdNQzQzTVRjME9DQXdMalEzTURBMk9DQXdMamN5TVRFM00wd3dMalEyTVRJMU5DQXdMamN5TlRNNU9FTXdMalExT0RZMk9DQXdMamN5TmpjeE5pQXdMalExTmpVMU5pQXdMamN5TnpjeE9TQXdMalExTmpVMU5pQXdMamN5TnpZMk5Vd3dMalEyTURFNU55QXdMamN5TkRreU1VTXdMalEzTlRrNE1TQXdMamN4TXpRMk55QXdMalE0T1RZMU1TQXdMamN3TURrd05TQXdMalE1T1RnNU1TQXdMalk0T0RNME5Fd3dMalV3TURRNE5pQXdMalk0TnpZek1rd3dMalV3TWpFd09DQXdMalk0TlRjMU4wZ3dMalV3TWpJeE5GcE5NQzQwT0RReE1TQXdMalk1T0RrMU1rTXdMalE0TmpVeE1TQXdMalk1TmpVeUlEQXVORGc1TlRZeElEQXVOamt6TVRnNElEQXVORGt4TmpReUlEQXVOamt3TnprMFF6QXVORGt6TVRJNElEQXVOamc1TURnMElEQXVORGswTVRJZ01DNDJPRGM0TlNBd0xqUTVOREF6TWlBd0xqWTROemMyTWtNd0xqUTVNemd5TWlBd0xqWTROelUxSURBdU5EYzFPVEk1SURBdU5qazVOamtnTUM0ME5qZ3hOeUF3TGpjd05USTROME13TGpRMk5USTJOU0F3TGpjd056TTBOU0F3TGpRMk5EZzVOU0F3TGpjd056Y3hOU0F3TGpRMk1qZzVNU0F3TGpjeE1ETXdNVXd3TGpRMU9EWTROeUF3TGpjeE5UVTFUREF1TkRVek56VTRJREF1TnpJeE1USXhUREF1TkRRNU5EWTVJREF1TnpJMU56azBRekF1TkRRNE5qRTRJREF1TnpJMk56TXhJREF1TkRRNE1qTTJJREF1TnpJM01UWTRJREF1TkRRNE1URTBJREF1TnpJM016UXlRekF1TkRRNE1ETWdNQzQzTWpjME5qSWdNQzQwTkRnd055QXdMamN5TnpRMU5pQXdMalEwT0RFMk5DQXdMamN5TnpRd01rd3dMalEwT1RZM055QXdMamN5TmpRME5Vd3dMalExTVRNeklEQXVOekkxTXprNFF6QXVORFl6T0RRZ01DNDNNVGMwT0NBd0xqUTNNemt5TXlBd0xqY3dPVE0xTVNBd0xqUTROREV4SURBdU5qazRPVFV5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPWUyM2M0OTI4LWI2MTYtNDlmMy04ZGMzLWQxODhlMjZjY2Y4MTsiIHBhcmVudD0iMjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjgiIHk9IjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLT4gTWljcm9zb2Z0IFNRTCBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj00MTAyYzQyOC0wNjJhLTQwMzYtOGJiZC1iYWViNTliMWJkZTQ7aXIuYXNzZXRzPUNyZWRpdCBDYXJkIERhdGE7aXIudGFncz1IVFRQUzsiIHBhcmVudD0iMSIgc291cmNlPSI0IiB0YXJnZXQ9IjIyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-  </trustZones>
-  <questions/>
-  <assets>
-    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
-      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
-    </asset>
-    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="Web Client -&gt; Web Application - Server side" ref="062f7025-ded5-4e84-a4cb-eb2ce783c9c3" source="8f1524bf-126c-4a18-9e88-22a4b9a90c24" target="75a5767d-29f5-4152-bfb5-ce45ff21ba2b">
-      <assets>
-        <asset name="Credit Card Data"/>
-      </assets>
-      <tags>
-        <tag tag="HTTPS"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; Microsoft SQL Server" ref="4102c428-062a-4036-8bbd-baeb59b1bde4" source="75a5767d-29f5-4152-bfb5-ce45ff21ba2b" target="a4c3de22-7059-4bf5-ac1b-bce95e7e98a4">
-      <assets>
-        <asset name="Credit Card Data"/>
-      </assets>
-      <tags>
-        <tag tag="HTTPS"/>
-      </tags>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="34db91e7-f20f-4386-9c59-c505c6206e49" diagramComponentId="729c179e-2789-425f-91ca-43324c597921" ref="75a5767d-29f5-4152-bfb5-ce45ff21ba2b" name="Web Application - Server side" desc="" library="" parentComponentRef="" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="feature.service.thirdparty.no" answer="true" manuallyModified="false"/>
-        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
-        <question ref="framework.node" answer="true" manuallyModified="false"/>
-        <question ref="lang.csharp" answer="true" manuallyModified="false"/>
-        <question ref="lang.javascript" answer="true" manuallyModified="false"/>
-        <question ref="lang.php" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-        <question ref="openid.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.no" answer="true" manuallyModified="false"/>
-        <question ref="server.dotnet" answer="true" manuallyModified="false"/>
-        <question ref="server.iis" answer="true" manuallyModified="false"/>
-        <question ref="server.session.building.no" answer="true" manuallyModified="false"/>
-        <question ref="service.data.json" answer="true" manuallyModified="false"/>
-        <question ref="use.fedramp.low.no" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="20"/>
-        <asset name="Credit Card Data" accessType="20"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.735">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-384" name="Application allows for leveraging a session ID not produced by the application" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                    Authenticating a user, or otherwise establishing a new user session, without invalidating any session identifier gives an attacker the opportunity to steal authenticated sessions. Such a scenario is commonly observed when:
-                    &lt;/div&gt;
-                    &lt;div&gt;
-                    &lt;ul&gt;
-                    &lt;li&gt;A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.&lt;/li&gt;
-                    &lt;li&gt;An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.&lt;/li&gt;
-                    &lt;li&gt;The application or container uses predictable session identifiers. In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.&lt;/li&gt;
-                    &lt;/ul&gt;
-                    &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.715">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PCI-R6-6.5" name="Applications are vulnerable to known flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>The applications are vulnerable to injection flaws, particularly SQL injections. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.965">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-639" name="Authorization Bypass Through User-Controlled Key" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user related record stored in the system and would be used to look up that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system. One manifestation of this weakness would be if a system used sequential or otherwise easily guessable session ids that would allow one user to easily switch to another user's session and read/modify their data.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-639: Authorization Bypass Through User-Controlled Key" url="https://cwe.mitre.org/data/definitions/639.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-425" name="Direct Request ('Forced Browsing')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not adequately enforce appropriate authorization on all restricted
-                        URLs, scripts, or files.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;Web applications susceptible to direct request attacks often make the false
-                        assumption that such resources can only be reached through a given navigation path and so only
-                        apply authorization at certain points in the path.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-425: Direct Request ('Forced Browsing')" url="https://cwe.mitre.org/data/definitions/425.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.757">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.280">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.713">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.979">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-209" name="Information Exposure Through an Error Message" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software generates an error message that includes sensitive information about its environment, users, or associated data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;This sensitive information may be valuable on its own (such as a password), or it may be useful for launching other deadlier attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-209: Information Exposure Through an Error Message" url="https://cwe.mitre.org/data/definitions/209.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.219">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.360">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.411">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-275" name="Permission Issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Weaknesses in this category are related to improper assignment - or handling - of permissions.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.162">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PCI-R6-6.3" name="Security is not included in the Software Development Life Cycle" state="0" impact="100" issueId="" issueLink="">
-          <desc>Security is missing during the requirement definition, design, analysis, and testing phases of software development.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.965">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-1004" name="Sensitive Cookie Without 'HttpOnly' Flag" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. &lt;div&gt;  The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header helps mitigate the risk associated with Cross-Site Scripting (XSS) where an attacker's script code might attempt to read the contents of a cookie and exfiltrate information obtained. When set, browsers that support the flag will not reveal the contents of the cookie to a third party via client-side script executed via XSS. &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-614" name="Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" state="0" impact="100" issueId="" issueLink="">
-          <desc>The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the
-                        user agent to send those cookies in plaintext over an HTTP session.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" url="https://cwe.mitre.org/data/definitions/614.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SRV-JSON-SIG" name="The application does not implement any integrity control on transmitted JSON data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If JSON data is not validated for authenticity and integrity then the application functionality could be subverted which may lead to sensitive data leaks or bypassing of critical business logic.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.492">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.235">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.236">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.236">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.235">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
-&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
-&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
-&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
- &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
-&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
-              <output/>
-            </source>
-            <references>
-              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
-              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.412">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-308" name="Use of Single-factor Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of single-factor authentication can lead to unnecessary risk of compromise when
-                        compared with the benefits of a dual-factor authentication scheme.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-308: Use of Single-factor Authentication" url="https://cwe.mitre.org/data/definitions/308.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.649">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.648">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PCI-R6-6.5.6-C" name="Address all &quot;high risk&quot; vulnerabilities detected" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All vulnerabilities identified by an organization's vulnerability risk-ranking
-                        process (defined
-                        in Requirement 6.1) as "high risk" that could affect the application should
-                        be 
-                        addressed during application development.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.6: Examine software-development policies and procedures and interview responsible personnel to verify that coding techniques address any "high risk" vulnerabilities that could affect the application, as identified in PCI DSS Requirement 6.1.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.867">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-285" name="Apply authorization checks to segregate and control access to user data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Applications protecting sensitive or otherwise restricted resources must ensure that only appropriate
-                        and authorized users can access the application data. It is important that an application
-                        prevent unauthorized users gaining inappropriate access to each other's data. Although user A
-                        and user B may both be trusted to access data within the application, they may be only authorized to
-                        access different subsets of the protected resources.&amp;nbsp; E.g. user A should not be
-                        able to access user B's personal data by manipulating a request (typical examples are the
-                        manipulation of an ID value or other object reference sent in the URL or body of an HTTP
-                        request).
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        It is not sufficient to rely on obscurity, for example obfuscated or secret URLs or filenames.
-                        The application must validate each request for protected data against the proven identity of the
-                        user. Before providing access to restricted resources the application must:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Ensure the user has undergone appropriate authentication (identification and
-                        verification, or ID&amp;amp;V). E.g. they must have provided their identity and confirmed this
-                        with a password, token, or other verification. Typically this is done by checking the
-                        validity of the session token issued after login.&lt;/li&gt;
-                        &lt;li&gt;Confirm the user is authorized to access the data or resource they are requesting. E.g.
-                        their confirmed identify is checked against a server-side access control matrix to determine
-                        whether they may access the requested resource.&lt;/li&gt;
-                        &lt;li&gt;Access controls should be granular and make it possible to issue to individual resources 
-                        to individual users or roles.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        URL and asset based access control is provided by most web-frameworks, and it is preferable to
-                        use an established and proven framework.
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA CM-07 Least Functionality" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/158-08_02_CM-07"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="CM-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Using two different browsers configured with an intercepting proxy:&lt;/li&gt;
-                            &lt;li&gt;Login as user A in browser A.&lt;/li&gt;
-                            &lt;li&gt;Login as user B in browser B.&lt;/li&gt;
-                            &lt;li&gt;For every operation that displays sensitive data belonging to user A:&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Perform the operation as user A and view their sensitive data.&lt;/li&gt;
-                            &lt;li&gt;Obtain the session ID of user B.&lt;/li&gt;
-                            &lt;li&gt;Configure the proxy to intercept.&lt;/li&gt;
-                            &lt;li&gt;Perform the operation as user A again, but this time intercept all the requests
-                            and replace user A's session ID with that of user B.&lt;/li&gt;
-                            &lt;li&gt;Ensure that user A's sensitive data is &lt;b&gt;not &lt;/b&gt;visible.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.240">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.445">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.766">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.017">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3.1-C" name="Clean up development and testing data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This data may give away information about the functioning of an application or system and is an easy target for unauthorized individuals to exploit to gain access to systems. Possession of such information could facilitate compromise of the system and related account data.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.6.a: Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.b: Observe testing processes for both off-theshelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.c: Examine data and accounts for recently installed or updated off-the-shelf software and inhouse applications to verify there is no test data or test accounts on systems in production.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.560">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
-            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
-          </references>
-          <standards>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.435">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.923">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.018">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.018">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.4-C" name="Do not transmit data over insecure channels" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications that fail to adequately encrypt network traffic using strong
-                        cryptography are at
-                        increased risk of being compromised and exposing cardholder data. If an attacker is able to
-                        exploit weak
-                        cryptographic processes, they may be able to gain control of an application or even gain
-                        clear-text access
-                        to encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="pci-sss"/>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.4: Examine software-development policies and procedures and interview responsible personnel to verify that insecure communications are addressed by means of coding techniques that properly authenticate and encrypt all sensitive communications.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.3-C" name="Do not use insecure cryptographic storage" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications that do not utilize strong cryptographic functions properly to store
-                        data are at
-                        increased risk of being compromised and exposing authentication credentials and/or cardholder
-                        data. If an
-                        attacker is able to exploit weak cryptographic processes, they may be able to gain clear-text
-                        access to
-                        encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="7.1" supportedStandardRef="pci-sss"/>
-            <standard ref="7.2" supportedStandardRef="pci-sss"/>
-            <standard ref="7.3" supportedStandardRef="pci-sss"/>
-            <standard ref="7.4" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.3: Examine software-development policies and procedures and interview responsible personnel to verify that insecure cryptographic storage is addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Prevent cryptographic flaws.&lt;/li&gt;&lt;li&gt;Use strong cryptographic algorithms and keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;7.1.a: The assessor shall examine the vendor evidence to confirm that, where cryptography is relied upon (in whole or in part) for the security of the critical assets:&lt;ul&gt;&lt;li&gt;Industry-accepted cryptographic algorithms and modes of operation are used in the software as the primary means for protecting critical assets; and&lt;/li&gt;&lt;li&gt;Use of any unapproved algorithms must be in conjunction with approved algorithms and implemented in a manner that does not reduce the equivalent cryptographic key strength provided by the approved algorithms.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.b: The assessor shall examine vendor evidence, including the vendor threat information, and test the software to confirm that:&lt;ul&gt;&lt;li&gt;Only documented cryptographic algorithms and modes are used in the software and are implemented correctly, and&lt;/li&gt;&lt;li&gt;Protections are incorporated to prevent common cryptographic attacks such as the use of the software as a decryption oracle, brute-force or dictionary attacks against the input domain of the sensitive data, the re-use of security parameters such as IVs, or the re-encryption of multiple datasets using linearly applied key values (such as XOR'd key values in stream ciphers or one-time pads).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.c: Where any algorithm or mode of operation requires a unique value per encryption operation or session, the assessor shall examine current publicly available literature or industry standards to identify security vulnerabilities in their implementation and test the software to confirm correct implementation. For example, this may include the use of a unique IV for a stream cipher mode of operation, a unique (and random) "k" value for a digital signature.&lt;/li&gt;&lt;li&gt;7.1.d: Where padding is used prior to/during encryption, the assessor shall examine vendor evidence and test the software to confirm that the encryption operation always incorporates an industry-accepted standard padding method.&lt;/li&gt;&lt;li&gt;7.1.e: Where hash functions are used within the software, the assessor shall:&lt;ul&gt;&lt;li&gt;Examine publicly available literature and research to identify vulnerable algorithms that can be exploited, and&lt;/li&gt;&lt;li&gt;Test the software to confirm that only approved, collision-resistant hash algorithms and methods are used with a salt value of appropriate strength, generated using a secure random number generator.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.a: The assessor shall examine vendor evidence and test the software to confirm that:&lt;ul&gt;&lt;li&gt;All cryptographic keys that are used for providing security to critical assets-including both confidentiality and authenticity-as well as for providing other security services to the software (such as authentication of end-point or software updates) have a unique purpose. For example, no key may be used for both encryption and authentication operations.&lt;/li&gt;&lt;li&gt;All keys have defined generation methods, and no secret or private cryptographic keys relied upon for security of critical assets are shared between software instances, except when a common secret or private key is used for securing the storage of other cryptographic keys that are generated during the installation, initialization, or first use of the software (e.g., white-box cryptography).&lt;/li&gt;&lt;li&gt;All cryptographic keys have an equivalent bit strength of at least 128 bits in accordance with industry standards.&lt;/li&gt;&lt;li&gt;All keys have a defined crypto-period aligned with industry standards, and methods are implemented to retire and/or update each key at the end of the defined crypto-period.&lt;/li&gt;&lt;li&gt;The integrity and confidentiality of all secret and private cryptographic keys managed by the software are protected when stored (e.g., encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and is stored separately from the data-encrypting key, or as at least two full-length key components or key shares, in accordance with an industry-accepted method).&lt;/li&gt;&lt;li&gt;All keys have a defined generation or injection process, and this process ensures sufficient entropy for the key.&lt;/li&gt;&lt;li&gt;All key-generation functions must implement one-way functions or other irreversible key-generation processes, and no reversible key calculation modes (such as key variants) are used to directly create new keys from an existing key.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.b: Where cryptography is used to protect a key, the assessor shall examine vendor evidence and test the software to confirm that security is not provided to any key by a key of lesser strength (e.g., by encrypting a 256-bit AES key with a 128-bit AES key).&lt;/li&gt;&lt;li&gt;7.2.c: Where any public keys are used by the system, the assessor shall examine vendor evidence and test the software to confirm that the vendor maintains an inventory of all cryptographic keys used by the software and that the authenticity of all public keys is maintained. Vendor evidence must identify:&lt;ul&gt;&lt;li&gt;Key label or name&lt;/li&gt;&lt;li&gt;Key location&lt;/li&gt;&lt;li&gt;Effective and expiration date&lt;/li&gt;&lt;li&gt;Key purpose/type&lt;/li&gt;&lt;li&gt;Key length&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.d: Where public or white-box keys are not unique per software instantiation the assessor shall examine vendor evidence and test the software to confirm that methods and procedures to revoke and/or replace such keys (or key pairs) exist.&lt;/li&gt;&lt;li&gt;7.2.e: Where the software relies upon external files or other data elements for key material (such as for public TLS certificates), the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to install such key material in accordance with this standard-including details noting any security requirements for such key material-is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;7.2.f: Where public keys are used, the assessor shall examine vendor evidence and test the software to confirm that public keys manually loaded or used as root keys are installed and stored in a way that provides dual control (to a level that is feasible on the execution environment), preventing a single user from replacing a key to facilitate a man-in-the-middle attack, easy decryption of stored data, etc. Where complete dual control is not feasible (e.g., due to a limitation of the execution environment), the assessor shall confirm that the methods implemented are appropriate to protect the public keys.&lt;/li&gt;&lt;li&gt;7.2.g: The assessor shall examine vendor evidence and test the software to confirm that any secret and/or private keys are managed in a way that ensures split knowledge over the key, to a level that is feasible given the platform on which the software is executed. Where absolute split knowledge is not feasible, the assessor shall confirm that methods implemented are reasonable to protect secrets and/or private keys.&lt;/li&gt;&lt;li&gt;7.2.h: The assessor shall examine vendor evidence and test the software to confirm that methods are implemented to "roll" any keys at the end of their defined crypto-period that ensure the security of the sensitive data (both cryptographic keys and data secured through use of these keys) is in line with the requirements of this standard.&lt;/li&gt;&lt;li&gt;7.3.a: The assessor shall examine vendor evidence to confirm that all random number generation methods implemented in the software:&lt;ul&gt;&lt;li&gt;Use at least 128 bits of entropy prior to the output of any random numbers from the random number generator.&lt;/li&gt;&lt;li&gt;Ensure it is not possible for the system to provide or produce reduced entropy upon start-up or entry of other predictable states of the system.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.3.b: Where the vendor is relying upon previous assessment of the random number generator, or source of initial entropy, the assessor shall examine the approval records of the previous assessment and test the software to confirm that this scheme and specific approval include the correct areas of the software in the scope of its assessment, and that the vendor claims do not exceed the scope of the evaluation or approval of that software. For example, some cryptographic implementations approved under FIPS 140-2 or 140-3 require seeding from an external entropy source to correctly output random data.&lt;/li&gt;&lt;li&gt;7.3.c: Where third-party software, platforms, or libraries are used for all or part of the random number generation process, the assessor shall examine current publicly available literature to confirm that there are no publicly known vulnerabilities or concerns with the software that may compromise its use for generating random values in the software under test. Where problems are known, but have been mitigated by the software vendor, the assessor shall examine vendor evidence and test the software to confirm that the vulnerabilities have been sufficiently mitigated. The assessor shall test the software to confirm that third-party software, platforms, or libraries are correctly integrated, implemented, and configured.&lt;/li&gt;&lt;li&gt;7.3.d: The assessor shall examine vendor evidence and test the software to confirm that methods have been implemented to prevent or detect (and respond) the interception, or "hooking," of random number calls that are serviced from third-party software, or the platform on which the software is executed.&lt;/li&gt;&lt;li&gt;7.3.e: The assessor shall test the software to obtain 128MB of data output from each random number generator implemented in the system to confirm the lack of statistical correlation in the output. This data may be generated by the assessor directly, or supplied by the vendor, but the assessor must confirm that the generation method implemented ensures that the data is produced as it would be produced by the software during normal operation.&lt;/li&gt;&lt;li&gt;7.4.a: The assessor shall examine vendor evidence and test the software to confirm that the methods used for the generation of all cryptographic keys and other material (such as IVs, "k" values for digital signatures, etc.) have entropy that meets the minimum effective strength requirements of the cryptographic primitives and keys.&lt;/li&gt;&lt;li&gt;7.4.b: Where cryptographic keys are generated through processes which require direct user interaction, such as through the entry of a passphrase or the use of "random" user interaction with the software, the assessor shall examine vendor evidence and test the software to confirm that these processes are implemented in such a way that they provide sufficient entropy. Specifically, the assessor shall confirm that:&lt;ul&gt;&lt;li&gt;Any methods used for generating keys directly from a password/passphrase enforces an input domain that is able to provide sufficient entropy, such that the total possible inputs are at least equal to that of the equivalent bit strength of the key being generated (e.g., a 32-hex-digit input field for an AES128 key).&lt;/li&gt;&lt;li&gt;The passphrase is passed through an industry-standard key-derivation function, such as PBKDF2 or bcrypt, which extends the work factor for any attempt to brute-force the passphrase value. The assessor shall confirm that a work factor of at least 10,000 is applied to any such implementation.&lt;/li&gt;&lt;li&gt;Clear and sufficient guidance is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 that any passphrase used must be:&lt;ul&gt;&lt;li&gt;Randomly generated itself, using a valid and secure random process: an online random number generator must not be used for this purpose.&lt;/li&gt;&lt;li&gt;Never implemented by a single person, such that one person has an advantage in recovering the clear key value; violating the requirements for split knowledge.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.4.c: Where any third-party software or platforms are relied upon by the software and do not meet the entropy requirements, the assessor shall examine vendor evidence and test the software to confirm that sufficient mitigations are implemented, and that clear and sufficient guidance on the secure configuration and usage of these software components is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.444">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.855">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-923-SEGREG" name="Ensure segregation of components of differing trust levels" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure segregation of components of differing trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.1" name="Ensure sensitive data is not revealed through error output messages" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the application does not output error messages or stack traces containing sensitive
-                        data that could assist an attacker, including the session id, software/framework versions and
-                        personal information.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application does not output error massages or stack traces containing sensitive data.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" name="Ensure that access control mechanisms are centralized" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access control, authentication and authorization procedures should be centralized, and all roles, permissions, groups and users shall be controlled - or gain access - through this mechanism.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To ensure roles, groups and permissions are assigned properly to users, we need to have centralized access control, to grant or deny access easily and securely.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that access control mechanisms are centralized.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
-                            happen.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
-                            behavior on the system.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="FEAT-ACC-CTRL" name="Ensure that attribute or feature-based access control is used" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles.
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="C7 OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.570">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;ul&gt;
- &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
- &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.2 Testing for default credentials (OTG-AUTHN-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.5 Test remember password functionality (OTG-AUTHN-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;div&gt;
-   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
- &lt;/div&gt;
- &lt;div&gt;
-   Options:
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
- &lt;/div&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.122">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="revoke-compromised-authentication-tokens" name="Implement an effective process to revoke compromised authentication tokens" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Theft or loss of an authentication token can undermine security in any multi-factor authentication process. Loss of a physical token or mobile device with soft-tokens, or compromise of a client-side certificate could mean an attacker has all of the factors required to authenticate to a system and bypass the protections provided by multi-factor authentication.&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Define an organization process to identify or report lost or compromised authentication tokens/factors&lt;/li&gt; 
- &lt;li&gt;Implement technical controls to suspend or revoke compromised tokens or accounts&lt;/li&gt; 
- &lt;li&gt;These processes should be implementable in a timely manner to reduce the attack window&lt;/li&gt; 
- &lt;li&gt;Implement mechanisms to renew authentication tokens/factors within a sufficient timeframe before they are revoked.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.5.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.5.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.8" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.1.2.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.1.4" supportedStandardRef="nist-800-63"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify there is a working process in place to revoke a given token in a timely manner.&lt;/li&gt;&lt;li&gt;Verify the renewal of authentication tokens/factors is completed in sufficient time.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="75" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.578">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.7-C" name="Implement cross-site scripting (XSS) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;XSS flaws occur whenever an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser, which can hijack user sessions, deface websites, possibly introduce worms, etc.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.7" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.7: Examine software-development policies and procedures and interview responsible personnel to verify that cross-site scripting (XSS) is addressed by means of coding techniques that validate all parameters before inclusion and use context-sensitive escaping, among other things.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SRV-JSON-WEB-SIGN" name="Implement JSON Web Signing for sensitive or authentication data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Data received from the client-side may have been modified at source or in transit. JSON Web
-                        Signing functionality is available to prevent (or rather detect) such modification.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Sensitive data, in particular any relied on for making access control or other
-                        security decisions, should be signed. This provides assurance that:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;The data comes from the trusted source and not from an untrusted actor.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The data received is that produced by the trusted party and has not been modified in
-                        transit.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the functions of the service which handle JSON data.&lt;/li&gt;&lt;li&gt;If the JSON data is used to make authentication decisions or part of a sensitive business logic flow, then check JSON Web Signing - leveraging JSON Web Tokens - is in use.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="JSON Web Signing - RFC" url="https://tools.ietf.org/html/rfc7515"/>
-              <reference name="JSON Web Tokens - RFC" url="https://tools.ietf.org/html/rfc7519"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="look-up-secret-auth" name="Implement Look-Up Secret Authentication" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Verifiers of look-up secrets should prompt the claimant for the next secret from their authenticator or for a specific secret. A given secret from an authenticator must be used successfully only once. If the look-up secret is derived from a grid card, each cell of the grid shall be used only once.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Verifiers should store look-up secrets in a form that is resistant to offline attacks and have:&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;At least 112 bits entropy and hashed with an approved one-way function.&lt;/li&gt; 
- &lt;li&gt;With fewer than 112 bits of entropy, it should be salted and hashed using a suitable one-way key derivation function, and salt value of at least 32 bits in length and arbitrarily chosen so as to minimize salt value collisions among stored hashes.&lt;/li&gt; 
- &lt;li&gt;Less than 64 bits of entropy, the verifier must implement a rate limiting mechanisms that effectively limits the number of failed authentication attempts that can be made on the subscriber's account&lt;/li&gt; 
-&lt;/ul&gt; 
- 
-&lt;div&gt; 
- &lt;div&gt;
-   Look up secrets: pre-generated lists of secret codes, similar to Transaction Authorization Numbers (TAN), social media recovery codes, or a grid containing a set of random values. These are distributed securely to users. These lookup codes are used once, and once all used, the lookup secret list is discarded. This type of authenticator is considered "something you have". 
- &lt;/div&gt; 
- &lt;div&gt;
-   https://pages.nist.gov/800-63-3/sp800-63b.html 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Verifier: An entity that verifies the claimant's identity by verifying the claimant's possession and control of a token using an authentication protocol. To do this, the Verifier may also need to validate credentials that link the token and identity and check their status. 
- &lt;/div&gt; 
- &lt;div&gt;
-   https://csrc.nist.gov/glossary/term/verifier&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-          </references>
-          <standards>
-            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.6.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.6.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.2.2" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify that:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The look-up secret are only able to be used once.&lt;/li&gt;&lt;li&gt;The random generation of the look-up secrets has at least 112 bits of entropy.&lt;/li&gt;&lt;li&gt;If the entropy is lower than&amp;nbsp;112 but higher than 64 bits, it leverages a hashed with a one-way key derivation function and salted with at least 32 bits in length.&lt;/li&gt;&lt;li&gt;If the entropy is lower than 64 bits, a rate limiting mechanisms is in place to limit the number of failed authentication attempts.,&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.10-C" name="Implement robust authentication and session management" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure authentication and session management prevent unauthorized individuals from compromising legitimate account credentials, keys, or session tokens that would otherwise enable an intruder to assume the identity of an authorized user.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="pci-sss"/>
-            <standard ref="5.2" supportedStandardRef="pci-sss"/>
-            <standard ref="5.3" supportedStandardRef="pci-sss"/>
-            <standard ref="5.4" supportedStandardRef="pci-sss"/>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.10" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.10: Examine software development policies and procedures and interview responsible personnel to verify that broken authentication and session management are addressed via coding techniques that commonly include:&lt;ul&gt;&lt;li&gt;Flagging session tokens (for example cookies) as "secure".&lt;/li&gt;&lt;li&gt;Not exposing session IDs in the URL.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;5.1.a: The assessor shall examine vendor evidence to confirm that the vendor has identified authentication requirements (i.e., type and number of factors) for all roles based on critical asset classification, the type of access (e.g., local, non-console, remote) and level of privilege. Note: The assessor should refer to evidence obtained in the testing of Control Objective 1.3 to determine the classifications for all critical assets.&lt;/li&gt;&lt;li&gt;5.1.b: The assessor shall examine vendor evidence and test the software to confirm that all access to critical assets is authenticated and authentication mechanisms are implemented correctly.&lt;/li&gt;&lt;li&gt;5.1.c: Where the software recommends, suggests, relies on, or otherwise facilitates the use of additional mechanisms (such as third-party VPNs, remote desktop features, etc.) to facilitate secure non-console access to the system on which the software is executed or directly to the software itself, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to configure authentication mechanisms correctly is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.1.d: The assessor shall examine vendor evidence to confirm that any sensitive data associated with credentials, including public keys, is identified as a critical asset.&lt;/li&gt;&lt;li&gt;5.2.a: The assessor shall examine vendor evidence and test the software to confirm that all implemented authentication methods require unique identification.&lt;/li&gt;&lt;li&gt;5.2.b: Where interfaces, such as APIs, allow for automated access to critical assets, the assessor shall examine vendor evidence and test the software to confirm that unique identification of different programs or systems accessing the critical assets is required (for example, through use of multiple public keys) and that guidance on configuring a unique credential for each program or system is included in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.2.c: Where identification is supplied across a non-console interface, the assessor shall test the software to confirm that authentication mechanisms are protected.&lt;/li&gt;&lt;li&gt;5.2.d: The assessor shall examine vendor evidence to confirm that the software vendor's implementation guidance provided to stakeholders per Control Objective 12.1 specifically notes that identification and authentication parameters must not be shared between individuals, programs, or in any way that prevents the unique identification of each access to a critical asset.&lt;/li&gt;&lt;li&gt;5.2.e: The assessor shall examine vendor evidence, including source code of the software, to confirm that there are no additional methods for accessing critical assets.&lt;/li&gt;&lt;li&gt;5.3.a: The assessor shall examine vendor evidence to confirm that all implemented authentication methods were evaluated to identify the details of known vulnerabilities or attack methods on the authentication method, and how the implementation mitigates against such attacks. The evidence must also illustrate that the implementation used in the software was considered. For example, a fingerprint may be uniquely identifiable to an individual, but the ability to spoof or otherwise bypass such technology can be highly dependent on the way the solution is implemented.&lt;/li&gt;&lt;li&gt;5.3.b: The assessor shall examine vendor evidence to confirm that implemented authentication methods are robust and that robustness of the authentication methods was evaluated using industry-accepted methods.&lt;/li&gt;&lt;li&gt;5.3.c: The assessor shall test the software to confirm the authentication methods are implemented correctly and do not expose vulnerabilities.&lt;/li&gt;&lt;li&gt;5.4.a: The assessor shall examine vendor evidence to confirm that the vendor has clearly identified and reasonably justified the required access for all critical assets.&lt;/li&gt;&lt;li&gt;5.4.b: The assessor shall examine vendor evidence and test the software to identify what access is provided to critical assets and confirm that such access correlates with the vendor evidence. The test to confirm access is restricted should include attempts to access critical assets through user accounts, roles, or services which should not have the required privileges.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.5-C" name="Implement robust error handling" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications can unintentionally leak information about their configuration or internal workings, or expose privileged information through improper error handling methods. Attackers use this weakness to steal sensitive data or compromise the system altogether. If a malicious individual can create errors that the application does not handle properly, they can gain detailed system information, create denial-of-service interruptions, cause security to fail, or crash the server. For example, the message "incorrect password provided" tells an attacker that the user ID provided was accurate and they should focus their efforts only on the password. Use more generic error messages, like "data could not be verified."&amp;nbsp;&lt;/p&gt;&lt;p&gt;Another common technique used by attackers to compromise sensitive data that is stored, processed, or transmitted by software is to manipulate the software in a way that generates unhandled exceptions.&lt;/p&gt;&lt;p&gt;Unhandled exceptions are error conditions that the software vendor has not anticipated and, therefore, has not factored into the software design. If an attacker can manipulate a software function that is known to handle sensitive data in a way that generates a condition that the software does not handle properly, it is possible that the software may output an error that includes sensitive data.&lt;/p&gt;&lt;p&gt;To protect against attacks involving unhandled exceptions, all terminal software functions handling sensitive data should include processes or routines that instruct the software how to treat unknown exceptions. These processes should determine what information to include in any error codes or values. The disclosure of sensitive data through error conditions or error reporting, whether intentional or accidental, should be avoided.&lt;/p&gt;&lt;p&gt;Race conditions can arise when the software requires sequential processing of data to perform some software function. For example, a "time-of-use, time-of-check race condition" exists when a file is checked at one point and used immediately after, with the assumption that the previous check is still valid. This assumption may not be correct if the system allows the file to be modified in between.&lt;/p&gt;&lt;p&gt;If an attacker can identify and manipulate the software to take advantage of a race condition, they may be able to execute arbitrary code or generate other conditions that the attacker could exploit further.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="B.3.2" supportedStandardRef="pci-sss"/>
-            <standard ref="B.3.3" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.5: Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by means of coding techniques that do not leak information via error messages (for example, by returning generic error details rather than specific ones).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;B.3.2.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that handle the sensitive data predefined in Control Objective 1.2. For each of the noted software functions, the assessor shall confirm that each function:&lt;ul&gt;&lt;li&gt;Checks return values for the presence of sensitive data&lt;/li&gt;&lt;li&gt;Processes the return values in a way that does not inadvertently "leak" sensitive data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;B.3.2.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that handles sensitive data by attempting to manipulate the software in a manner that generates an unhandled exception to confirm that error conditions do not expose sensitive data.&lt;/li&gt;&lt;li&gt;B.3.3.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that rely on synchronous processing. For each of the noted functions, the assessor shall confirm that protection mechanisms have been implemented in the software to mitigate race conditions.&lt;/li&gt;&lt;li&gt;B.3.3.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that relies on synchronous processing by attempting to generate a race condition (such as through specially-crafted attacks intended to exploit the timing of synchronous events) to confirm that the software is resistant to such attacks.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.8-C" name="Implement robust server side access control" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Improper access control refers to cases such as insecure direct object references, failure to
-                        restrict URL
-                        access, directory traversal, and failure to restrict user access to functions.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt; &lt;/p&gt;
-                        &lt;p&gt;A direct object reference occurs when a developer exposes a reference to an internal
-                        implementation
-                        object, such as a file, directory, database record, or key, as a URL or form parameter.
-                        Attackers can
-                        manipulate those references to access other objects without authorization.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Consistently enforce access control in the presentation layer and business logic for all
-                        URLs.
-                        Frequently, the only way an application protects a sensitive functionality is by preventing the
-                        display of
-                        links or URLs to unauthorized users. Attackers can use this weakness to perform
-                        unauthorized
-                        operations by accessing those URLs directly.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;An attacker may be able to enumerate and navigate the directory structure of a website
-                        (directory
-                        traversal) thus gaining access to unauthorized information as well as further insight
-                        into the
-                        workings of the site for later exploitation.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;If user interfaces permit access to unauthorized functions, this access could result in
-                        unauthorized individuals gaining access to privileged credentials or cardholder data. Only
-                        authorized users
-                        should be permitted to access direct object references to sensitive resources. Limiting access
-                        to data
-                        resources will help prevent cardholder data from being presented to unauthorized resources.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.8" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.8: Examine software-development policies and procedures and interview responsible personnel to verify that improper access control-such as insecure direct object references, failure to restrict URL access, and directory traversal-is addressed by means of a coding technique that includes:&lt;ul&gt;&lt;li&gt;Proper authentication of users&lt;/li&gt;&lt;li&gt;Input sanitization&lt;/li&gt;&lt;li&gt;Protection against the exposure of internal object references to users&lt;/li&gt;&lt;li&gt;User interfaces that do not permit access to unauthorized functions.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt; 
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.1a-C" name="Perform input validation for all untrusted data" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Injection flaws, particularly SQL injections, are a commonly used method for
-                        compromising
-                        applications. An injection occurs when user-supplied data is sent to an interpreter as part of a
-                        command or
-                        query. The attacker's hostile data tricks the interpreter into executing unintended commands or
-                        changing
-                        data, and allows the attacker to attack components inside the network through the application
-                        to initiate
-                        attacks such as buffer overflows, or to reveal both confidential information and server
-                        application
-                        functionalities.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Information should be validated before being sent to the application-for example,
-                        by
-                        checking for
-                        all alpha characters, mixes of alpha and numeric characters, etc.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3" supportedStandardRef="pci-sss"/>
-            <standard ref="6.5.1a" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="B.3.1" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.a: Examine software-development policies and procedures to verify that developers have to complete up-to-date training in secure coding techniques at least annually, based on industry best practices and guidance.&lt;/li&gt;&lt;li&gt;6.5.b: Examine records of training to verify that software developers receive up-to-date training on secure coding techniques at least annually, including how to avoid common coding vulnerabilities.&lt;/li&gt;&lt;li&gt;6.5.c: Verify that processes are in place to protect applications from, at a minimum, the following vulnerabilities:&lt;ul&gt;&lt;li&gt;Injection flaws, particularly SQL injection.&lt;/li&gt;&lt;li&gt;Buffer overflows&lt;/li&gt;&lt;li&gt;Insecure cryptographic storage&lt;/li&gt;&lt;li&gt;Insecure communications&lt;/li&gt;&lt;li&gt;Improper error handling&lt;/li&gt;&lt;li&gt;All "high risk" vulnerabilities identified in the vulnerability identification process&lt;/li&gt;&lt;li&gt;Cross-site scripting (XSS)&lt;/li&gt;&lt;li&gt;Improper access control&lt;/li&gt;&lt;li&gt;Cross-site request forgery (CSRF)&lt;/li&gt;&lt;li&gt;Broken authentication and session management.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;6.3.a: The assessor shall examine vendor evidence and test the software to confirm that each use of cryptography-where cryptography is relied upon (in whole or in part) for the security of critical assets-is compliant to Control Objective 7.&lt;/li&gt;&lt;li&gt;6.3.b: Where cryptographic methods provided by third-party software or aspects of the execution environment or platform on which the application is run are relied upon for the protection of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 provides clear and sufficient detail for correctly configuring these methods during the installation, initialization, or first use of the software.&lt;/li&gt;&lt;li&gt;6.3.c: Where asymmetric cryptography such as RSA or ECC is used for protecting the confidentiality of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that private keys are not used for providing confidentiality protection to the data.&lt;/li&gt;&lt;li&gt;B.3.1.a: The assessor shall examine all relevant software documentation and source code necessary to identify all external inputs to the software. For each user or other external input, the assessor shall examine all relevant software documentation and source code to confirm that inputs conform to a list of expected characteristics and that all input that does not conform to expected characteristics is rejected by the software or otherwise handled securely.&lt;/li&gt;&lt;li&gt;B.3.1.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.) the assessor shall test the software by attempting to supply each user or other external input with invalid or unexpected characteristics to confirm that the software validates all inputs and either rejects or securely handles all unexpected characteristics.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.444">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-FED" name="Provide a section with a list of all active sessions and information about them" issueId="" issueLink="" platform="" cost="0" risk="75" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The application should provide a section with a list of all the active sessions. That list should contain as much information as possible and should allow the user to invalidate all sessions or any of them selectively.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-10 Concurrent Session Control" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/32-08_02_AC-10"/>
-            <reference name="OSA AC-11 Session Lock" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/33-08_02_AC-11"/>
-            <reference name="OSA AC-12 Session Termination" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/34-08_02_AC-12"/>
-          </references>
-          <standards>
-            <standard ref="3.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="AC-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-10" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Find the section with the list of active sessions within the application features&lt;/li&gt;&lt;li&gt;Open an authenticated session on two or three different browsers.&lt;/li&gt;&lt;li&gt;Check the sessions are listed.&lt;/li&gt;&lt;li&gt;Close the sessions by logging out of the application.&lt;/li&gt;&lt;li&gt;Check the sessions listed relating to the ones you created have now disappeared.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.561">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.561">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.445">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3.2-C" name="Review custom code prior to release to production" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Security vulnerabilities in bespoke and custom software are commonly exploited by malicious individuals to gain access to a network and compromise account data.&lt;/p&gt;&lt;p&gt;Vulnerable code is far more difficult and expensive to address after it has been deployed or released into production environments. Requiring a formal review and signoff by management prior to release helps to ensure that code is approved and has been developed in accordance with policies and procedures.&lt;/p&gt;&lt;p&gt;Having code reviewed by someone other than the original author, who is both experienced in code reviews and knowledgeable about secure coding practices, minimizes the possibility that code containing security or logic errors that could affect the security of cardholder data is released into a production environment. Requiring management approval that the code was reviewed limits the ability for the process to be bypassed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following items should be considered for inclusion in code reviews:&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Searching for undocumented features (implant tools, backdoors).&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Confirming that software securely uses external components' functions (libraries, frameworks, APIs, etc.). For example, if a third-party library providing cryptographic functions is used, verify that it was integrated securely.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking for correct use of logging to prevent sensitive data from getting into logs.&lt;/p&gt;&lt;p&gt;&amp;nbsp; - Analysis of insecure code structures that may contain potential vulnerabilities related to common software attacks identified in Requirements 6.2.5.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking the application's behavior to detect logical vulnerabilities.&lt;/p&gt;&lt;p&gt;Having a formal review methodology and review checklists has been found to improve the quality of the code review process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Code review is a tiring process, and for this reason, it is most effective when reviewers only review small amounts of code at a time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To maintain the effectiveness of code reviews, it is beneficial to monitor the general workload of reviewers and to have them review applications they are familiar with.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Code reviews may be performed using either manual or automated processes, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Entitles that rely solely on manual code review should ensure that reviewers maintain their skills through regular training as new vulnerabilities are found, and new secure coding methods are recommended.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See the OWASP Code Review Guide.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.2.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.3.a: Examine documented software development procedures and interview responsible personnel to verify that processes are defined that require all bespoke and custom software to be reviewed in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.b: Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;6.2.3.1.a: If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel to verify that processes are defined for manual code reviews to be conducted in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.1.b: Examine evidence of changes to bespoke and custom software and interview personnel to verify that manual code reviews were conducted in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.333">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-2014-3.6" name="Session ID's should be transmitted securely" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly. Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, it should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (either standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value 'GET' parameter.&lt;/li&gt;&lt;li&gt;Specifically, never send the session ID token in the URL or over unencrypted transport.&lt;/li&gt;&lt;li&gt;Pass data only in appropriately protected fields in the body or headers, for example:&lt;ul&gt;&lt;li&gt;A session Cookie (e.g. JSESSIONID, ASP.NET_SessionID)&lt;/li&gt;&lt;li&gt;A POST parameter (e.g. a token in the HTTP request body, or JSON parameter)&lt;/li&gt;&lt;li&gt;A standard or bespoke HTTP header (Authorization: X-Session header)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Using a browser, authenticate to the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;For every authenticated request, check that the session ID is never part of the
-                            URL and is only sent as an HTTP header (i.e. a cookie).&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5-C" name="Train developers in up-to-date secure coding techniques" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Having staff knowledgeable in secure coding methods, including techniques defined in Requirement 6.2.4, will help minimize the number of security vulnerabilities introduced through poor coding practices.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Training for developers may be provided in-house or by third parties.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Training should include, but is not limited to, development languages in use, secure software design, secure coding techniques, use of techniques/methods for finding vulnerabilities in code, processes to prevent reintroducing previously resolved vulnerabilities, and how to use any automated security testing tools for detecting vulnerabilities in software.&amp;nbsp;&lt;/p&gt;&lt;p&gt;As industry-accepted secure coding practices change, organizational coding practices and developer training may need to be updated to address new threats.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.2.a: Examine software development procedures to verify that processes are defined for training of software development personnel developing bespoke and custom software that includes all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.2.b: Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.9-C" name="Use anti cross-site request forgery (CSRF) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request
-                        to a
-                        vulnerable web application, which then enables the attacker to perform any state-changing
-                        operations the
-                        victim is authorized to perform (such as updating account details, making purchases, or even
-                        authenticating
-                        to the application).&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.9" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.9: Examine software development policies and procedures and interview responsible personnel to verify that cross-site request forgery (CSRF) is addressed by means of coding techniques that ensure applications do not rely on authorization credentials and tokens automatically submitted by browsers.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3-C" name="Use a secure coding methodology" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Bespoke and custom software are developed securely, as follows:&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Based on industry standards and/or best practices for secure development.&amp;nbsp;&lt;/p&gt;&lt;p&gt;- In accordance with PCI DSS (for example, secure authentication and logging).&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Incorporating consideration of information security issues during each stage of the software development lifecycle.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Without the inclusion of security during the requirements definition, design, analysis, and testing phases of software development, security vulnerabilities can be inadvertently or maliciously introduced into the production environment.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Understanding how sensitive data is handled by the application- including when stored, transmitted, and in memory-can help identify where data needs to be protected. PCI DSS requirements must be considered when developing software to meet those requirements by design, rather than trying to retrofit the software later.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Secure software lifecycle management methodologies and frameworks include PCI Software Security Framework, BSIMM, OPENSAMM, and works from NIST, ISO, and SAFECode.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.1: Examine documented software development procedures to verify that processes are defined that include all elements specified in this requirement&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.184">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.1b-C" name="Use parameterized queries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The use of prepared statements with variable binding (aka parameterized queries) is how all
-                        developers
-                        should first be taught how to write database queries. They are simple to write and easier to
-                        understand
-                        than dynamic queries. Parameterized queries force the developer to first define all the SQL
-                        code, and then
-                        pass each parameter to the query later. This coding style allows the database to distinguish
-                        between code
-                        and data, regardless of what user input is supplied.</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.1b" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.1: Examine software-development policies and procedures and interview responsible personnel to verify that injection flaws are addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Validate input to verify that user data cannot modify the meaning of commands and queries.&lt;/li&gt;&lt;li&gt;Use parameterized queries.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.2-C" name="Validate buffer boundaries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Buffer overflows occur when an application does not have appropriate bounds checking
-                        on its
-                        buffer space. This can cause the information in the buffer to be pushed out of the buffer's
-                        memory space and
-                        into executable memory space. When this occurs, the attacker has the ability to insert malicious
-                        code at the
-                        end of the buffer and then push that malicious code into executable memory space by overflowing
-                        the buffer.
-                        The malicious code is then executed and often gives the attacker remote access to the
-                        application and/or
-                        infected system.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;div&gt;
-   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references>
-                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
-                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-614">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-232" name="Anonymous users could gain access to sensitive data" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could access data for which they are not authorized by connecting directly
-                                to the resource, without authenticating. E.g.: GET /userdetails?ID=145 to gain direct
-                                access to that user's personal information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references>
-                <reference name="OWASP Development Guide: Authorization" url="https://www.owasp.org/index.php/Guide_to_Authorization"/>
-                <reference name="OWASP Top Ten" url="https://www.owasp.org/index.php/Top_10_2007-Failure_to_Restrict_URL_Access"/>
-                <reference name="WASC-02" url="http://projects.webappsec.org/w/page/13246940/Insufficient%20Authorization"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-285" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-308">
-                  <countermeasures>
-                    <countermeasure ref="look-up-secret-auth" mitigation="33"/>
-                    <countermeasure ref="revoke-compromised-authentication-tokens" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-285" mitigation="34"/>
-                <countermeasure ref="look-up-secret-auth" mitigation="33"/>
-                <countermeasure ref="revoke-compromised-authentication-tokens" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ASVS-2014-3.12" name="Attackers could compromise users' sessions by compromising the session cookie" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>If the same session cookie is used for multiple applications, and one of those
-                                applications has a vulnerability which discloses the session ID. Then by compromising
-                                the session cookie in one application, the attacker would have access to the ID for the
-                                other.</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-1004">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-384">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-2014-3.6" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-2014-3.6" mitigation="50"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-87" name="Attackers gain access to data or services by directly accessing the resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker employs forceful browsing to access portions of a website that are
-                                otherwise unreachable through direct URL entry.&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Usually, a front controller or similar design pattern is employed to protect
-                                access to portions of a web application.&amp;nbsp;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Forceful browsing enables an attacker to access information, perform
-                                privileged operations and otherwise reach sections of the web application that have been
-                                improperly protected.
-                                &lt;br /&gt;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-384">
-                  <countermeasures>
-                    <countermeasure ref="CSD-SESS-FED" mitigation="34"/>
-                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-425">
-                  <countermeasures>
-                    <countermeasure ref="CWE-285" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-SESS-FED" mitigation="34"/>
-                <countermeasure ref="CWE-285" mitigation="33"/>
-                <countermeasure ref="secure-session-generation-and-expiration" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-215" name="Attackers gain access to services or data by sending malformed, or otherwise unexpected messages to a target application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's their desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can potentially learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-209">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-636">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.1" mitigation="50"/>
-                <countermeasure ref="ASVS-8.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references>
-                <reference name="OWASP Developers Guide: Authorization" url="https://www.owasp.org/index.php/Guide_to_Authorization"/>
-                <reference name="WASC-02" url="http://projects.webappsec.org/w/page/13246940/Insufficient%20Authorization"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-275">
-                  <countermeasures>
-                    <countermeasure ref="FEAT-ACC-CTRL" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-639">
-                  <countermeasures>
-                    <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="34"/>
-                    <countermeasure ref="CWE-285" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="34"/>
-                <countermeasure ref="CWE-285" mitigation="33"/>
-                <countermeasure ref="FEAT-ACC-CTRL" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-636">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                <countermeasure ref="CWE-603" mitigation="25"/>
-                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-367">
-                  <countermeasures>
-                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint.
-&lt;br /&gt;
-&lt;br /&gt;While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-923">
-                  <countermeasures>
-                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
-&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-523">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-59" name="The session ID, and hence the users' session is compromised through brute force attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could use brute force techniques to attempt to guess valid session
-                                IDs.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-330">
-                  <countermeasures>
-                    <countermeasure ref="look-up-secret-auth" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="look-up-secret-auth" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
-          <threats>
-            <threat ref="pci-dss-vuln-prevention" name="An attacker gains access to cardholder data through a vulnerable system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
-              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R6-6.3">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
-                    <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
-                    <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
-                <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
-                <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="pci-dss-vuln-detection" name="An attacker gains access to cardholder data through security flaws in the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
-              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R6-6.5">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ DATA" name="Read data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="SRV-JSON-SIG" name="Attackers gain access to user data by tampering with data in transit" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If the integrity of the data in transit is not protected, an attacker could modify this data causing the recipient to behave unexpectedly and potentially gain access to user data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SRV-JSON-SIG">
-                  <countermeasures>
-                    <countermeasure ref="SRV-JSON-WEB-SIGN" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SRV-JSON-WEB-SIGN" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="269f6777-3b2b-4b67-8bf3-5f30e27648fe" diagramComponentId="e23c4928-b616-49f3-8dc3-d188e26ccf81" ref="a4c3de22-7059-4bf5-ac1b-bce95e7e98a4" name="Microsoft SQL Server" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-sql-server">
-      <tags/>
-      <questions>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
-        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="10"/>
-        <asset name="Credit Card Data" accessType="10"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="PCI-R3-3.x" name="Cardholder data is unprotected on the system" state="0" impact="100" issueId="" issueLink="">
-          <desc>This covers 3.1 and 3.5 from PCI-DSS</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
-                        data transmission. For example, network traffic can often be sniffed by any attacker who has
-                        access to a network interface. This significantly lowers the difficulty of exploitation by
-                        attackers.
-                        &lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.320">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.142">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.981">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.193">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.993">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.500">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
-
-An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.192">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.191">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.500">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.992">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.990">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="64" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.072">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.635">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.853">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
-  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
-  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
-  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.415">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="56" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.240">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Data stored on the server or the client must be protected by encryption (data
-                        &lt;i&gt;at rest&lt;/i&gt;).
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
-                        be used to protect the data.&lt;/li&gt;
-                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
-                        storage.&lt;/li&gt;
-                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
-                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
-                        to a bespoke implementation).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.414">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
-          &lt;br /&gt;&lt;br /&gt;
-          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA.</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
-                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.415">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.1-C" name="Keep cardholder data storage to a minimum" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;A formal data retention policy identifies what data needs to be retained, for how long, and where that data resides so it can be securely destroyed or deleted as soon as it is no longer needed. The only account data that may be stored after authorization is the primary account number or PAN (rendered unreadable), expiration date, cardholder name, and service code.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The storage of SAD data prior to the completion of the authorization process is also included in the data retention and disposal policy so that storage of this sensitive data is kept to minimum, and only retained for the defined amount of time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;When identifying locations of stored account data, consider all processes and personnel with access to the data, as data could have been moved and stored in different locations than originally defined. Storage locations that are often overlooked include backup and archive systems, removable data storage devices, paper-based media, and audio recordings.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To define appropriate retention requirements, an entity first needs to understand its own business needs as well as any legal or regulatory obligations that apply to its industry or to the type of data being retained. Implementing an automated process to ensure data is automatically and securely deleted upon its defined retention limit can help ensure that account data is not retained beyond what is necessary for business, legal, or regulatory purposes.&lt;/p&gt;&lt;p&gt;Methods of eliminating data when it exceeds the retention period include secure deletion to complete removal of the data or rendering it unrecoverable and unable to be reconstructed. Identifying and securely eliminating stored data that has exceeded its specified retention period prevents unnecessary retention of data that is no longer needed. This process may be automated, manual, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The deletion function in most operating systems is not "secure deletion" as it allows deleted data to be recovered, so instead, a dedicated secure deletion function or application must be used to make data unrecoverable.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remember, if you don't need it, don't store it!&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;An automated, programmatic procedure could be run to locate and remove data, or a manual review of data storage areas could be performed. Whichever method is used, it is a good idea to monitor the process to ensure it is completed successfully, and that the results are recorded and validated as being complete. Implementing secure deletion methods ensures that the data cannot be retrieved when it is no longer needed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="pci-sss"/>
-            <standard ref="3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.2" supportedStandardRef="pci-sss"/>
-            <standard ref="3.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="3.3" supportedStandardRef="pci-sss"/>
-            <standard ref="3.4" supportedStandardRef="pci-sss"/>
-            <standard ref="3.5" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.2.1.a: Examine the data retention and disposal policies, procedures, and processes and interview personnel to verify processes are defined to include all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;3.2.1.b: Examine files and system records on system components where account data is stored to verify that the data storage amount and retention time does not exceed the requirements defined in the data retention policy.&lt;/li&gt;&lt;li&gt;3.2.1.c: Observe the mechanisms used to render account data unrecoverable to verify data cannot be recovered.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;3.1.a: The assessor shall examine vendor evidence to identify what sensitive data is collected by the software for use beyond any one transaction, the default time period for which it is retained, and whether the retention period is user-configurable, and to confirm vendor evidence includes reasonable justification for retaining the sensitive data.&lt;/li&gt;&lt;li&gt;3.1.b: The assessor shall test the software to confirm that all available functions or services designed for the retention of sensitive data are supported by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.1.c: The assessor shall test the software to confirm that sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected during storage in accordance with Control Objective 6. Any such functionality that allows for storage of sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user and retained only for the duration necessary in accordance with reasonable vendor criteria. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any sensitive data is securely deleted per Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.1.d: Where user input or interaction is required to configure the retention period of sensitive data, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.2.a: The assessor shall examine vendor evidence to identify all sensitive data that is retained by the software for transient use, what triggers the secure deletion of this data, and confirm reasonable justification exists for retaining the data. This includes data that is stored only in memory during the operation of the software.&lt;/li&gt;&lt;li&gt;3.2.b: The assessor shall test the software to confirm that all available functions or services that retain transient sensitive data are supported by vendor evidence and do not use immutable objects.&lt;/li&gt;&lt;li&gt;3.2.c: The assessor shall test the software to confirm that transient sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected in accordance with Control Objective 6. Any such functionality that allows for the storage of transient sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any transient sensitive data is securely deleted in accordance with Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.2.d: Where users can configure retention of transient sensitive data, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on this process is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.3.a: The assessor shall examine the vendor evidence to identify the protection methods implemented for all sensitive data during storage and transmission.&lt;/li&gt;&lt;li&gt;3.3.b: The assessor shall test the software to confirm that no additional storage of sensitive data is included.&lt;/li&gt;&lt;li&gt;3.3.c: Where sensitive data is stored outside of temporary variables within the code itself, the assessor shall test the software to confirm that sensitive data is protected using either strong cryptography or other methods that provide an equivalent level of security.&lt;/li&gt;&lt;li&gt;3.3.d: Where protection methods use cryptography, the assessor shall examine vendor evidence and test the software to confirm that the cryptographic implementation complies with Control Objective 7 of this standard.&lt;/li&gt;&lt;li&gt;3.3.e: Where sensitive data is protected using methods other than strong cryptography, the assessor shall examine vendor evidence and test the software to confirm that the protections are present in all environments where the software is designed to be executed, are correctly implemented, and are covered by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.3.f: Where users are required to configure protection methods, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.4.a: The assessor shall examine vendor evidence to identify all secure deletion methods implemented by the software for all non-transient sensitive data.&lt;/li&gt;&lt;li&gt;3.4.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the secure deletion of non-transient sensitive data and to confirm that any non-transient sensitive data is securely deleted using a method that ensures that the data is unrecoverable after deletion. Methods may include (but are not necessarily limited to) overwriting the data, deletion of cryptographic keys (of sufficient strength) which have been used to encrypt the data, or platform specific functions which provide for secure deletion. Methods must accommodate for platform specific issues, such as flash wear-leveling algorithms or SSD over-provisioning, which may complicate simple over-writing methods.&lt;/li&gt;&lt;li&gt;3.4.c: The assessor shall test the software using forensic tools to identify any non-transient sensitive data residue in the execution environment, and to confirm that the methods attested by the software vendor are correctly implemented and applied to all sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data (e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements), as well as covering all non-transient sensitive data types.&lt;/li&gt;&lt;li&gt;3.5.a: The assessor shall examine vendor evidence to identify all secure deletion methods for all transient sensitive data and to confirm that these methods ensure that the data is unrecoverable after deletion.&lt;/li&gt;&lt;li&gt;3.5.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the erasure of such transient sensitive data-such as abstraction layers between the code and the hardware execution environment-and to confirm what methods have been implemented to minimize the risk posed by these complications.&lt;/li&gt;&lt;li&gt;3.5.c: The assessor shall test the software, including usage of forensic tools, to identify any sensitive data residue in the execution environment to confirm that the methods attested by the software vendor are correctly implemented and applied to all transient sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data-e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements-as well as cover all non-transient sensitive data types.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.639">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.481">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="64" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.636">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.853">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.854">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
- &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
- &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
- &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
-  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;b&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
- &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
- &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
- &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
- &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
- &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
- &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
- &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt; 
- &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
- &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
-&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
-&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
-&lt;ul&gt; 
- &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
- &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
- &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
- &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
- &lt;li&gt;at least 10 characters&lt;/li&gt; 
- &lt;li&gt;at most 128 characters&lt;/li&gt; 
-&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.5.4-C" name="Store cryptographic keys in the fewest possible locations" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing any cryptographic keys in the fewest locations helps an organization track and monitor all key locations and minimizes the potential for keys to be exposed to unauthorized parties.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.6.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.4: Examine key storage locations and observe processes to verify that keys are stored in the fewest possible locations.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.5.3-C" name="Store securely secret and private keys used to encrypt/decrypt" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing cryptographic keys securely prevents unauthorized or unnecessary access that could result in the exposure of stored account data. Storing keys separately means they are stored such that if the location of one key is compromised, the second key is not also compromised.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Where data-encrypting keys are stored in an HSM, the HSM interaction channel should be protected to prevent interception of encryption or decryption operations.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.6.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.2.a: Examine documented procedures to verify it is defined that cryptographic keys used to encrypt/decrypt stored account data must exist only in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.b: Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.c: Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Key-encrypting keys are at least as strong as the data-encrypting keys they protect.&lt;/li&gt;&lt;li&gt;Key-encrypting keys are stored separately from data-encrypting keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.642">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.883">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                    <countermeasure ref="CWE-662" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                <countermeasure ref="CWE-662" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319-AUTH">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNRESTRICTED-NETWORK">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
-          <threats>
-            <threat ref="sensitive-auth-data-stealing" name="Attackers gain access to the personal identification number (PIN) or the encrypted PIN block after authorization" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
-              <desc>If full track data is stored, malicious individuals who obtain that data can use it to reproduce payment cards and complete fraudulent transactions. The purpose of the card validation code is to protect "card-not-present" transactions-Internet or mail order/telephone order (MO/TO) transactions-where the consumer and the card are not present. If this data is stolen, malicious individuals can execute fraudulent Internet and MO/TO transactions. These values should be known only to the card owner or bank that issued the card. If this data is stolen, malicious individuals can execute fraudulent PIN-based debit transactions (for example, ATM withdrawals).</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R3-3.x">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
-                    <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
-                    <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
-                <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
-                <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
-                                that data.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
-                    <countermeasure ref="store-backups-securely" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
-                <countermeasure ref="store-backups-securely" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>If sensitive data is stored or processed on the host, then should the host itself be
-                                compromised by an attacker, the confidentiality and/or the integrity of the data would
-                                also be at risk.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="b98ce640-adf4-43ad-b1f2-6137a490583f" diagramComponentId="5a6f6ed5-1cf0-416c-a9dc-64147c9da04f" ref="8f1524bf-126c-4a18-9e88-22a4b9a90c24" name="Web Client" desc="" library="" parentComponentRef="" componentDefinitionRef="web-client">
-      <tags/>
-      <questions>
-        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
-        <question ref="client.auth.no" answer="true" manuallyModified="false"/>
-        <question ref="client.authz.no" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="20"/>
-        <asset name="Customer Data" accessType="40"/>
-        <asset name="Credit Card Data" accessType="20"/>
-        <asset name="Credit Card Data" accessType="40"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="PCI-R6-6.5" name="Applications are vulnerable to known flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>The applications are vulnerable to injection flaws, particularly SQL injections. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.423">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
-                        proves that the claim is correct.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.361">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not check the revocation status of a
-                        certificate after its initial revocation check, which can cause the software to
-                        perform privileged actions even after the certificate is revoked at a later
-                        time.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.846">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="PCI-R6-6.3" name="Security is not included in the Software Development Life Cycle" state="0" impact="100" issueId="" issueLink="">
-          <desc>Security is missing during the requirement definition, design, analysis, and testing phases of software development.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.586">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.123">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
-          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.845">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.845">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="PCI-R6-6.5.6-C" name="Address all &quot;high risk&quot; vulnerabilities detected" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All vulnerabilities identified by an organization's vulnerability risk-ranking
-                        process (defined
-                        in Requirement 6.1) as "high risk" that could affect the application should
-                        be 
-                        addressed during application development.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.6: Examine software-development policies and procedures and interview responsible personnel to verify that coding techniques address any "high risk" vulnerabilities that could affect the application, as identified in PCI DSS Requirement 6.1.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.436">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3.1-C" name="Clean up development and testing data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This data may give away information about the functioning of an application or system and is an easy target for unauthorized individuals to exploit to gain access to systems. Possession of such information could facilitate compromise of the system and related account data.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.6.a: Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.b: Observe testing processes for both off-theshelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.c: Examine data and accounts for recently installed or updated off-the-shelf software and inhouse applications to verify there is no test data or test accounts on systems in production.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.438">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
-          <desc>&lt;div&gt;
-                        Configure and enable appropriate certification revocation for each certificate created, such as
-                        Online Certificate Status Protocol (OCSP) Stapling.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
-                        downloading a large list of revoked certificates, they can simply submit a request to a CA
-                        server, which returns a signed response with the certificate current status.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.769">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.4-C" name="Do not transmit data over insecure channels" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications that fail to adequately encrypt network traffic using strong
-                        cryptography are at
-                        increased risk of being compromised and exposing cardholder data. If an attacker is able to
-                        exploit weak
-                        cryptographic processes, they may be able to gain control of an application or even gain
-                        clear-text access
-                        to encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.6" supportedStandardRef="pci-sss"/>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.4: Examine software-development policies and procedures and interview responsible personnel to verify that insecure communications are addressed by means of coding techniques that properly authenticate and encrypt all sensitive communications.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.3-C" name="Do not use insecure cryptographic storage" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications that do not utilize strong cryptographic functions properly to store
-                        data are at
-                        increased risk of being compromised and exposing authentication credentials and/or cardholder
-                        data. If an
-                        attacker is able to exploit weak cryptographic processes, they may be able to gain clear-text
-                        access to
-                        encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="7.1" supportedStandardRef="pci-sss"/>
-            <standard ref="7.2" supportedStandardRef="pci-sss"/>
-            <standard ref="7.3" supportedStandardRef="pci-sss"/>
-            <standard ref="7.4" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.3: Examine software-development policies and procedures and interview responsible personnel to verify that insecure cryptographic storage is addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Prevent cryptographic flaws.&lt;/li&gt;&lt;li&gt;Use strong cryptographic algorithms and keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;7.1.a: The assessor shall examine the vendor evidence to confirm that, where cryptography is relied upon (in whole or in part) for the security of the critical assets:&lt;ul&gt;&lt;li&gt;Industry-accepted cryptographic algorithms and modes of operation are used in the software as the primary means for protecting critical assets; and&lt;/li&gt;&lt;li&gt;Use of any unapproved algorithms must be in conjunction with approved algorithms and implemented in a manner that does not reduce the equivalent cryptographic key strength provided by the approved algorithms.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.b: The assessor shall examine vendor evidence, including the vendor threat information, and test the software to confirm that:&lt;ul&gt;&lt;li&gt;Only documented cryptographic algorithms and modes are used in the software and are implemented correctly, and&lt;/li&gt;&lt;li&gt;Protections are incorporated to prevent common cryptographic attacks such as the use of the software as a decryption oracle, brute-force or dictionary attacks against the input domain of the sensitive data, the re-use of security parameters such as IVs, or the re-encryption of multiple datasets using linearly applied key values (such as XOR'd key values in stream ciphers or one-time pads).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.c: Where any algorithm or mode of operation requires a unique value per encryption operation or session, the assessor shall examine current publicly available literature or industry standards to identify security vulnerabilities in their implementation and test the software to confirm correct implementation. For example, this may include the use of a unique IV for a stream cipher mode of operation, a unique (and random) "k" value for a digital signature.&lt;/li&gt;&lt;li&gt;7.1.d: Where padding is used prior to/during encryption, the assessor shall examine vendor evidence and test the software to confirm that the encryption operation always incorporates an industry-accepted standard padding method.&lt;/li&gt;&lt;li&gt;7.1.e: Where hash functions are used within the software, the assessor shall:&lt;ul&gt;&lt;li&gt;Examine publicly available literature and research to identify vulnerable algorithms that can be exploited, and&lt;/li&gt;&lt;li&gt;Test the software to confirm that only approved, collision-resistant hash algorithms and methods are used with a salt value of appropriate strength, generated using a secure random number generator.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.a: The assessor shall examine vendor evidence and test the software to confirm that:&lt;ul&gt;&lt;li&gt;All cryptographic keys that are used for providing security to critical assets-including both confidentiality and authenticity-as well as for providing other security services to the software (such as authentication of end-point or software updates) have a unique purpose. For example, no key may be used for both encryption and authentication operations.&lt;/li&gt;&lt;li&gt;All keys have defined generation methods, and no secret or private cryptographic keys relied upon for security of critical assets are shared between software instances, except when a common secret or private key is used for securing the storage of other cryptographic keys that are generated during the installation, initialization, or first use of the software (e.g., white-box cryptography).&lt;/li&gt;&lt;li&gt;All cryptographic keys have an equivalent bit strength of at least 128 bits in accordance with industry standards.&lt;/li&gt;&lt;li&gt;All keys have a defined crypto-period aligned with industry standards, and methods are implemented to retire and/or update each key at the end of the defined crypto-period.&lt;/li&gt;&lt;li&gt;The integrity and confidentiality of all secret and private cryptographic keys managed by the software are protected when stored (e.g., encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and is stored separately from the data-encrypting key, or as at least two full-length key components or key shares, in accordance with an industry-accepted method).&lt;/li&gt;&lt;li&gt;All keys have a defined generation or injection process, and this process ensures sufficient entropy for the key.&lt;/li&gt;&lt;li&gt;All key-generation functions must implement one-way functions or other irreversible key-generation processes, and no reversible key calculation modes (such as key variants) are used to directly create new keys from an existing key.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.b: Where cryptography is used to protect a key, the assessor shall examine vendor evidence and test the software to confirm that security is not provided to any key by a key of lesser strength (e.g., by encrypting a 256-bit AES key with a 128-bit AES key).&lt;/li&gt;&lt;li&gt;7.2.c: Where any public keys are used by the system, the assessor shall examine vendor evidence and test the software to confirm that the vendor maintains an inventory of all cryptographic keys used by the software and that the authenticity of all public keys is maintained. Vendor evidence must identify:&lt;ul&gt;&lt;li&gt;Key label or name&lt;/li&gt;&lt;li&gt;Key location&lt;/li&gt;&lt;li&gt;Effective and expiration date&lt;/li&gt;&lt;li&gt;Key purpose/type&lt;/li&gt;&lt;li&gt;Key length&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.d: Where public or white-box keys are not unique per software instantiation the assessor shall examine vendor evidence and test the software to confirm that methods and procedures to revoke and/or replace such keys (or key pairs) exist.&lt;/li&gt;&lt;li&gt;7.2.e: Where the software relies upon external files or other data elements for key material (such as for public TLS certificates), the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to install such key material in accordance with this standard-including details noting any security requirements for such key material-is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;7.2.f: Where public keys are used, the assessor shall examine vendor evidence and test the software to confirm that public keys manually loaded or used as root keys are installed and stored in a way that provides dual control (to a level that is feasible on the execution environment), preventing a single user from replacing a key to facilitate a man-in-the-middle attack, easy decryption of stored data, etc. Where complete dual control is not feasible (e.g., due to a limitation of the execution environment), the assessor shall confirm that the methods implemented are appropriate to protect the public keys.&lt;/li&gt;&lt;li&gt;7.2.g: The assessor shall examine vendor evidence and test the software to confirm that any secret and/or private keys are managed in a way that ensures split knowledge over the key, to a level that is feasible given the platform on which the software is executed. Where absolute split knowledge is not feasible, the assessor shall confirm that methods implemented are reasonable to protect secrets and/or private keys.&lt;/li&gt;&lt;li&gt;7.2.h: The assessor shall examine vendor evidence and test the software to confirm that methods are implemented to "roll" any keys at the end of their defined crypto-period that ensure the security of the sensitive data (both cryptographic keys and data secured through use of these keys) is in line with the requirements of this standard.&lt;/li&gt;&lt;li&gt;7.3.a: The assessor shall examine vendor evidence to confirm that all random number generation methods implemented in the software:&lt;ul&gt;&lt;li&gt;Use at least 128 bits of entropy prior to the output of any random numbers from the random number generator.&lt;/li&gt;&lt;li&gt;Ensure it is not possible for the system to provide or produce reduced entropy upon start-up or entry of other predictable states of the system.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.3.b: Where the vendor is relying upon previous assessment of the random number generator, or source of initial entropy, the assessor shall examine the approval records of the previous assessment and test the software to confirm that this scheme and specific approval include the correct areas of the software in the scope of its assessment, and that the vendor claims do not exceed the scope of the evaluation or approval of that software. For example, some cryptographic implementations approved under FIPS 140-2 or 140-3 require seeding from an external entropy source to correctly output random data.&lt;/li&gt;&lt;li&gt;7.3.c: Where third-party software, platforms, or libraries are used for all or part of the random number generation process, the assessor shall examine current publicly available literature to confirm that there are no publicly known vulnerabilities or concerns with the software that may compromise its use for generating random values in the software under test. Where problems are known, but have been mitigated by the software vendor, the assessor shall examine vendor evidence and test the software to confirm that the vulnerabilities have been sufficiently mitigated. The assessor shall test the software to confirm that third-party software, platforms, or libraries are correctly integrated, implemented, and configured.&lt;/li&gt;&lt;li&gt;7.3.d: The assessor shall examine vendor evidence and test the software to confirm that methods have been implemented to prevent or detect (and respond) the interception, or "hooking," of random number calls that are serviced from third-party software, or the platform on which the software is executed.&lt;/li&gt;&lt;li&gt;7.3.e: The assessor shall test the software to obtain 128MB of data output from each random number generator implemented in the system to confirm the lack of statistical correlation in the output. This data may be generated by the assessor directly, or supplied by the vendor, but the assessor must confirm that the generation method implemented ensures that the data is produced as it would be produced by the software during normal operation.&lt;/li&gt;&lt;li&gt;7.4.a: The assessor shall examine vendor evidence and test the software to confirm that the methods used for the generation of all cryptographic keys and other material (such as IVs, "k" values for digital signatures, etc.) have entropy that meets the minimum effective strength requirements of the cryptographic primitives and keys.&lt;/li&gt;&lt;li&gt;7.4.b: Where cryptographic keys are generated through processes which require direct user interaction, such as through the entry of a passphrase or the use of "random" user interaction with the software, the assessor shall examine vendor evidence and test the software to confirm that these processes are implemented in such a way that they provide sufficient entropy. Specifically, the assessor shall confirm that:&lt;ul&gt;&lt;li&gt;Any methods used for generating keys directly from a password/passphrase enforces an input domain that is able to provide sufficient entropy, such that the total possible inputs are at least equal to that of the equivalent bit strength of the key being generated (e.g., a 32-hex-digit input field for an AES128 key).&lt;/li&gt;&lt;li&gt;The passphrase is passed through an industry-standard key-derivation function, such as PBKDF2 or bcrypt, which extends the work factor for any attempt to brute-force the passphrase value. The assessor shall confirm that a work factor of at least 10,000 is applied to any such implementation.&lt;/li&gt;&lt;li&gt;Clear and sufficient guidance is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 that any passphrase used must be:&lt;ul&gt;&lt;li&gt;Randomly generated itself, using a valid and secure random process: an online random number generator must not be used for this purpose.&lt;/li&gt;&lt;li&gt;Never implemented by a single person, such that one person has an advantage in recovering the clear key value; violating the requirements for split knowledge.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.4.c: Where any third-party software or platforms are relied upon by the software and do not meet the entropy requirements, the assessor shall examine vendor evidence and test the software to confirm that sufficient mitigations are implemented, and that clear and sufficient guidance on the secure configuration and usage of these software components is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="85" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.480">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
-                        practice and required minimum key lengths depend on the scenarios listed below.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
-            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
-            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
-                            &lt;br /&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
-                            bits&lt;/li&gt;
-                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
-&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
-&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
-  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
-  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
-  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
- &lt;/ul&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
-            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
-            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
- &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
- &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;span&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
-              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.7-C" name="Implement cross-site scripting (XSS) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;XSS flaws occur whenever an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser, which can hijack user sessions, deface websites, possibly introduce worms, etc.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.7" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.7: Examine software-development policies and procedures and interview responsible personnel to verify that cross-site scripting (XSS) is addressed by means of coding techniques that validate all parameters before inclusion and use context-sensitive escaping, among other things.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.10-C" name="Implement robust authentication and session management" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secure authentication and session management prevent unauthorized individuals from compromising legitimate account credentials, keys, or session tokens that would otherwise enable an intruder to assume the identity of an authorized user.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="5.1" supportedStandardRef="pci-sss"/>
-            <standard ref="5.2" supportedStandardRef="pci-sss"/>
-            <standard ref="5.3" supportedStandardRef="pci-sss"/>
-            <standard ref="5.4" supportedStandardRef="pci-sss"/>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.10" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.10: Examine software development policies and procedures and interview responsible personnel to verify that broken authentication and session management are addressed via coding techniques that commonly include:&lt;ul&gt;&lt;li&gt;Flagging session tokens (for example cookies) as "secure".&lt;/li&gt;&lt;li&gt;Not exposing session IDs in the URL.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;5.1.a: The assessor shall examine vendor evidence to confirm that the vendor has identified authentication requirements (i.e., type and number of factors) for all roles based on critical asset classification, the type of access (e.g., local, non-console, remote) and level of privilege. Note: The assessor should refer to evidence obtained in the testing of Control Objective 1.3 to determine the classifications for all critical assets.&lt;/li&gt;&lt;li&gt;5.1.b: The assessor shall examine vendor evidence and test the software to confirm that all access to critical assets is authenticated and authentication mechanisms are implemented correctly.&lt;/li&gt;&lt;li&gt;5.1.c: Where the software recommends, suggests, relies on, or otherwise facilitates the use of additional mechanisms (such as third-party VPNs, remote desktop features, etc.) to facilitate secure non-console access to the system on which the software is executed or directly to the software itself, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to configure authentication mechanisms correctly is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.1.d: The assessor shall examine vendor evidence to confirm that any sensitive data associated with credentials, including public keys, is identified as a critical asset.&lt;/li&gt;&lt;li&gt;5.2.a: The assessor shall examine vendor evidence and test the software to confirm that all implemented authentication methods require unique identification.&lt;/li&gt;&lt;li&gt;5.2.b: Where interfaces, such as APIs, allow for automated access to critical assets, the assessor shall examine vendor evidence and test the software to confirm that unique identification of different programs or systems accessing the critical assets is required (for example, through use of multiple public keys) and that guidance on configuring a unique credential for each program or system is included in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.2.c: Where identification is supplied across a non-console interface, the assessor shall test the software to confirm that authentication mechanisms are protected.&lt;/li&gt;&lt;li&gt;5.2.d: The assessor shall examine vendor evidence to confirm that the software vendor's implementation guidance provided to stakeholders per Control Objective 12.1 specifically notes that identification and authentication parameters must not be shared between individuals, programs, or in any way that prevents the unique identification of each access to a critical asset.&lt;/li&gt;&lt;li&gt;5.2.e: The assessor shall examine vendor evidence, including source code of the software, to confirm that there are no additional methods for accessing critical assets.&lt;/li&gt;&lt;li&gt;5.3.a: The assessor shall examine vendor evidence to confirm that all implemented authentication methods were evaluated to identify the details of known vulnerabilities or attack methods on the authentication method, and how the implementation mitigates against such attacks. The evidence must also illustrate that the implementation used in the software was considered. For example, a fingerprint may be uniquely identifiable to an individual, but the ability to spoof or otherwise bypass such technology can be highly dependent on the way the solution is implemented.&lt;/li&gt;&lt;li&gt;5.3.b: The assessor shall examine vendor evidence to confirm that implemented authentication methods are robust and that robustness of the authentication methods was evaluated using industry-accepted methods.&lt;/li&gt;&lt;li&gt;5.3.c: The assessor shall test the software to confirm the authentication methods are implemented correctly and do not expose vulnerabilities.&lt;/li&gt;&lt;li&gt;5.4.a: The assessor shall examine vendor evidence to confirm that the vendor has clearly identified and reasonably justified the required access for all critical assets.&lt;/li&gt;&lt;li&gt;5.4.b: The assessor shall examine vendor evidence and test the software to identify what access is provided to critical assets and confirm that such access correlates with the vendor evidence. The test to confirm access is restricted should include attempts to access critical assets through user accounts, roles, or services which should not have the required privileges.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.5-C" name="Implement robust error handling" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications can unintentionally leak information about their configuration or internal workings, or expose privileged information through improper error handling methods. Attackers use this weakness to steal sensitive data or compromise the system altogether. If a malicious individual can create errors that the application does not handle properly, they can gain detailed system information, create denial-of-service interruptions, cause security to fail, or crash the server. For example, the message "incorrect password provided" tells an attacker that the user ID provided was accurate and they should focus their efforts only on the password. Use more generic error messages, like "data could not be verified."&amp;nbsp;&lt;/p&gt;&lt;p&gt;Another common technique used by attackers to compromise sensitive data that is stored, processed, or transmitted by software is to manipulate the software in a way that generates unhandled exceptions.&lt;/p&gt;&lt;p&gt;Unhandled exceptions are error conditions that the software vendor has not anticipated and, therefore, has not factored into the software design. If an attacker can manipulate a software function that is known to handle sensitive data in a way that generates a condition that the software does not handle properly, it is possible that the software may output an error that includes sensitive data.&lt;/p&gt;&lt;p&gt;To protect against attacks involving unhandled exceptions, all terminal software functions handling sensitive data should include processes or routines that instruct the software how to treat unknown exceptions. These processes should determine what information to include in any error codes or values. The disclosure of sensitive data through error conditions or error reporting, whether intentional or accidental, should be avoided.&lt;/p&gt;&lt;p&gt;Race conditions can arise when the software requires sequential processing of data to perform some software function. For example, a "time-of-use, time-of-check race condition" exists when a file is checked at one point and used immediately after, with the assumption that the previous check is still valid. This assumption may not be correct if the system allows the file to be modified in between.&lt;/p&gt;&lt;p&gt;If an attacker can identify and manipulate the software to take advantage of a race condition, they may be able to execute arbitrary code or generate other conditions that the attacker could exploit further.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="B.3.2" supportedStandardRef="pci-sss"/>
-            <standard ref="B.3.3" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.5: Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by means of coding techniques that do not leak information via error messages (for example, by returning generic error details rather than specific ones).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;B.3.2.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that handle the sensitive data predefined in Control Objective 1.2. For each of the noted software functions, the assessor shall confirm that each function:&lt;ul&gt;&lt;li&gt;Checks return values for the presence of sensitive data&lt;/li&gt;&lt;li&gt;Processes the return values in a way that does not inadvertently "leak" sensitive data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;B.3.2.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that handles sensitive data by attempting to manipulate the software in a manner that generates an unhandled exception to confirm that error conditions do not expose sensitive data.&lt;/li&gt;&lt;li&gt;B.3.3.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that rely on synchronous processing. For each of the noted functions, the assessor shall confirm that protection mechanisms have been implemented in the software to mitigate race conditions.&lt;/li&gt;&lt;li&gt;B.3.3.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that relies on synchronous processing by attempting to generate a race condition (such as through specially-crafted attacks intended to exploit the timing of synchronous events) to confirm that the software is resistant to such attacks.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.8-C" name="Implement robust server side access control" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Improper access control refers to cases such as insecure direct object references, failure to
-                        restrict URL
-                        access, directory traversal, and failure to restrict user access to functions.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt; &lt;/p&gt;
-                        &lt;p&gt;A direct object reference occurs when a developer exposes a reference to an internal
-                        implementation
-                        object, such as a file, directory, database record, or key, as a URL or form parameter.
-                        Attackers can
-                        manipulate those references to access other objects without authorization.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Consistently enforce access control in the presentation layer and business logic for all
-                        URLs.
-                        Frequently, the only way an application protects a sensitive functionality is by preventing the
-                        display of
-                        links or URLs to unauthorized users. Attackers can use this weakness to perform
-                        unauthorized
-                        operations by accessing those URLs directly.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;An attacker may be able to enumerate and navigate the directory structure of a website
-                        (directory
-                        traversal) thus gaining access to unauthorized information as well as further insight
-                        into the
-                        workings of the site for later exploitation.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;If user interfaces permit access to unauthorized functions, this access could result in
-                        unauthorized individuals gaining access to privileged credentials or cardholder data. Only
-                        authorized users
-                        should be permitted to access direct object references to sensitive resources. Limiting access
-                        to data
-                        resources will help prevent cardholder data from being presented to unauthorized resources.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.8" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.8: Examine software-development policies and procedures and interview responsible personnel to verify that improper access control-such as insecure direct object references, failure to restrict URL access, and directory traversal-is addressed by means of a coding technique that includes:&lt;ul&gt;&lt;li&gt;Proper authentication of users&lt;/li&gt;&lt;li&gt;Input sanitization&lt;/li&gt;&lt;li&gt;Protection against the exposure of internal object references to users&lt;/li&gt;&lt;li&gt;User interfaces that do not permit access to unauthorized functions.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.1a-C" name="Perform input validation for all untrusted data" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Injection flaws, particularly SQL injections, are a commonly used method for
-                        compromising
-                        applications. An injection occurs when user-supplied data is sent to an interpreter as part of a
-                        command or
-                        query. The attacker's hostile data tricks the interpreter into executing unintended commands or
-                        changing
-                        data, and allows the attacker to attack components inside the network through the application
-                        to initiate
-                        attacks such as buffer overflows, or to reveal both confidential information and server
-                        application
-                        functionalities.&amp;nbsp;&lt;/p&gt;
-                        &lt;p&gt;Information should be validated before being sent to the application-for example,
-                        by
-                        checking for
-                        all alpha characters, mixes of alpha and numeric characters, etc.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3" supportedStandardRef="pci-sss"/>
-            <standard ref="6.5.1a" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="B.3.1" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.a: Examine software-development policies and procedures to verify that developers have to complete up-to-date training in secure coding techniques at least annually, based on industry best practices and guidance.&lt;/li&gt;&lt;li&gt;6.5.b: Examine records of training to verify that software developers receive up-to-date training on secure coding techniques at least annually, including how to avoid common coding vulnerabilities.&lt;/li&gt;&lt;li&gt;6.5.c: Verify that processes are in place to protect applications from, at a minimum, the following vulnerabilities:&lt;ul&gt;&lt;li&gt;Injection flaws, particularly SQL injection.&lt;/li&gt;&lt;li&gt;Buffer overflows&lt;/li&gt;&lt;li&gt;Insecure cryptographic storage&lt;/li&gt;&lt;li&gt;Insecure communications&lt;/li&gt;&lt;li&gt;Improper error handling&lt;/li&gt;&lt;li&gt;All "high risk" vulnerabilities identified in the vulnerability identification process&lt;/li&gt;&lt;li&gt;Cross-site scripting (XSS)&lt;/li&gt;&lt;li&gt;Improper access control&lt;/li&gt;&lt;li&gt;Cross-site request forgery (CSRF)&lt;/li&gt;&lt;li&gt;Broken authentication and session management.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;6.3.a: The assessor shall examine vendor evidence and test the software to confirm that each use of cryptography-where cryptography is relied upon (in whole or in part) for the security of critical assets-is compliant to Control Objective 7.&lt;/li&gt;&lt;li&gt;6.3.b: Where cryptographic methods provided by third-party software or aspects of the execution environment or platform on which the application is run are relied upon for the protection of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 provides clear and sufficient detail for correctly configuring these methods during the installation, initialization, or first use of the software.&lt;/li&gt;&lt;li&gt;6.3.c: Where asymmetric cryptography such as RSA or ECC is used for protecting the confidentiality of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that private keys are not used for providing confidentiality protection to the data.&lt;/li&gt;&lt;li&gt;B.3.1.a: The assessor shall examine all relevant software documentation and source code necessary to identify all external inputs to the software. For each user or other external input, the assessor shall examine all relevant software documentation and source code to confirm that inputs conform to a list of expected characteristics and that all input that does not conform to expected characteristics is rejected by the software or otherwise handled securely.&lt;/li&gt;&lt;li&gt;B.3.1.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.) the assessor shall test the software by attempting to supply each user or other external input with invalid or unexpected characteristics to confirm that the software validates all inputs and either rejects or securely handles all unexpected characteristics.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
- &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
- &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
- &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.770">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
- &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
-  &lt;ul&gt;
-   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
-   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
-   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
-   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
-  &lt;/ul&gt;&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
-                            service.&lt;/li&gt;
-                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
-                            class) ciphers are not supported.&lt;/li&gt;
-                            &lt;ol&gt;
-                            &lt;br /&gt;
-                            &lt;/ol&gt;
-                            &lt;/ol&gt;Some of the tools that can perform these tests are:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
-                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.770">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3.2-C" name="Review custom code prior to release to production" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Security vulnerabilities in bespoke and custom software are commonly exploited by malicious individuals to gain access to a network and compromise account data.&lt;/p&gt;&lt;p&gt;Vulnerable code is far more difficult and expensive to address after it has been deployed or released into production environments. Requiring a formal review and signoff by management prior to release helps to ensure that code is approved and has been developed in accordance with policies and procedures.&lt;/p&gt;&lt;p&gt;Having code reviewed by someone other than the original author, who is both experienced in code reviews and knowledgeable about secure coding practices, minimizes the possibility that code containing security or logic errors that could affect the security of cardholder data is released into a production environment. Requiring management approval that the code was reviewed limits the ability for the process to be bypassed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following items should be considered for inclusion in code reviews:&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Searching for undocumented features (implant tools, backdoors).&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Confirming that software securely uses external components' functions (libraries, frameworks, APIs, etc.). For example, if a third-party library providing cryptographic functions is used, verify that it was integrated securely.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking for correct use of logging to prevent sensitive data from getting into logs.&lt;/p&gt;&lt;p&gt;&amp;nbsp; - Analysis of insecure code structures that may contain potential vulnerabilities related to common software attacks identified in Requirements 6.2.5.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking the application's behavior to detect logical vulnerabilities.&lt;/p&gt;&lt;p&gt;Having a formal review methodology and review checklists has been found to improve the quality of the code review process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Code review is a tiring process, and for this reason, it is most effective when reviewers only review small amounts of code at a time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To maintain the effectiveness of code reviews, it is beneficial to monitor the general workload of reviewers and to have them review applications they are familiar with.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Code reviews may be performed using either manual or automated processes, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Entitles that rely solely on manual code review should ensure that reviewers maintain their skills through regular training as new vulnerabilities are found, and new secure coding methods are recommended.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See the OWASP Code Review Guide.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.3" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.2.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.3.a: Examine documented software development procedures and interview responsible personnel to verify that processes are defined that require all bespoke and custom software to be reviewed in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.b: Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;6.2.3.1.a: If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel to verify that processes are defined for manual code reviews to be conducted in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.1.b: Examine evidence of changes to bespoke and custom software and interview personnel to verify that manual code reviews were conducted in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.320">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5-C" name="Train developers in up-to-date secure coding techniques" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Having staff knowledgeable in secure coding methods, including techniques defined in Requirement 6.2.4, will help minimize the number of security vulnerabilities introduced through poor coding practices.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Training for developers may be provided in-house or by third parties.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Training should include, but is not limited to, development languages in use, secure software design, secure coding techniques, use of techniques/methods for finding vulnerabilities in code, processes to prevent reintroducing previously resolved vulnerabilities, and how to use any automated security testing tools for detecting vulnerabilities in software.&amp;nbsp;&lt;/p&gt;&lt;p&gt;As industry-accepted secure coding practices change, organizational coding practices and developer training may need to be updated to address new threats.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.2.a: Examine software development procedures to verify that processes are defined for training of software development personnel developing bespoke and custom software that includes all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.2.b: Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-          </references>
-          <standards>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.956">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.9-C" name="Use anti cross-site request forgery (CSRF) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request
-                        to a
-                        vulnerable web application, which then enables the attacker to perform any state-changing
-                        operations the
-                        victim is authorized to perform (such as updating account details, making purchases, or even
-                        authenticating
-                        to the application).&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.9" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.9: Examine software development policies and procedures and interview responsible personnel to verify that cross-site request forgery (CSRF) is addressed by means of coding techniques that ensure applications do not rely on authorization credentials and tokens automatically submitted by browsers.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.3-C" name="Use a secure coding methodology" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Bespoke and custom software are developed securely, as follows:&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Based on industry standards and/or best practices for secure development.&amp;nbsp;&lt;/p&gt;&lt;p&gt;- In accordance with PCI DSS (for example, secure authentication and logging).&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Incorporating consideration of information security issues during each stage of the software development lifecycle.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Without the inclusion of security during the requirements definition, design, analysis, and testing phases of software development, security vulnerabilities can be inadvertently or maliciously introduced into the production environment.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Understanding how sensitive data is handled by the application- including when stored, transmitted, and in memory-can help identify where data needs to be protected. PCI DSS requirements must be considered when developing software to meet those requirements by design, rather than trying to retrofit the software later.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Secure software lifecycle management methodologies and frameworks include PCI Software Security Framework, BSIMM, OPENSAMM, and works from NIST, ISO, and SAFECode.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.2.1: Examine documented software development procedures to verify that processes are defined that include all elements specified in this requirement&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.1b-C" name="Use parameterized queries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The use of prepared statements with variable binding (aka parameterized queries) is how all
-                        developers
-                        should first be taught how to write database queries. They are simple to write and easier to
-                        understand
-                        than dynamic queries. Parameterized queries force the developer to first define all the SQL
-                        code, and then
-                        pass each parameter to the query later. This coding style allows the database to distinguish
-                        between code
-                        and data, regardless of what user input is supplied.</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.1b" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;6.5.1: Examine software-development policies and procedures and interview responsible personnel to verify that injection flaws are addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Validate input to verify that user data cannot modify the meaning of commands and queries.&lt;/li&gt;&lt;li&gt;Use parameterized queries.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R6-6.5.2-C" name="Validate buffer boundaries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Buffer overflows occur when an application does not have appropriate bounds checking
-                        on its
-                        buffer space. This can cause the information in the buffer to be pushed out of the buffer's
-                        memory space and
-                        into executable memory space. When this occurs, the attacker has the ability to insert malicious
-                        code at the
-                        end of the buffer and then push that malicious code into executable memory space by overflowing
-                        the buffer.
-                        The malicious code is then executed and often gives the attacker remote access to the
-                        application and/or
-                        infected system.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="6.5.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Encryption should fail closed so that data does not get stored in an unprotected state. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
-            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
-                            &lt;br /&gt;
-                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
-                            the following conditions must be met: &lt;/p&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
-                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
-                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
-                            (e.g. gathered by different sessions or manipulation of session state) share a common
-                            divisor in the length.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
-                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
-                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
-                                encrypted data.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SSL-WEAK-CIPHERS">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="SSL-WEAK-PROTOCOL">
-                  <countermeasures>
-                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
-                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Users lose trust in the system because a key security mechanism, such as certificate
-                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
-                                expire or become invalid then this is clearly displayed in the browser as a security
-                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
-              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-370">
-                  <countermeasures>
-                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="funds-intercepted" name="Funds Intercepted" state="Expose" source="MANUAL" edited="false" owner="femi73@hotmail.com" library="" editable="true">
-              <desc/>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures/>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
-          <threats>
-            <threat ref="pci-dss-vuln-prevention" name="An attacker gains access to cardholder data through a vulnerable system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
-              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
-              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R6-6.3">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
-                    <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
-                    <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
-                <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
-                <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="pci-dss-vuln-detection" name="An attacker gains access to cardholder data through security flaws in the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
-              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R6-6.5">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
-                    <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
-                    <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
-                <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
-                <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                theft and then uses this key to forge signatures from the original signer to mislead a
-                                victim into performing actions that benefit the attacker.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
-                                generation and then uses this key to forge signatures from the original signer to
-                                mislead a victim into performing actions which benefit the attacker.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-330">
-                  <countermeasures>
-                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-345">
-                  <countermeasures>
-                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
-              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="crypto-operations" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="crypto-operations" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 801ae90d2b4efccb1e8c552cee9d4ac787ee3cb6 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:24:45 -0400
Subject: [PATCH 25/28] Delete Templates/simple-web-app.xml

---
 Templates/simple-web-app.xml | 12339 ---------------------------------
 1 file changed, 12339 deletions(-)
 delete mode 100644 Templates/simple-web-app.xml

diff --git a/Templates/simple-web-app.xml b/Templates/simple-web-app.xml
deleted file mode 100644
index 5d0792e..0000000
--- a/Templates/simple-web-app.xml
+++ /dev/null
@@ -1,12339 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="simple-web-app" name="Simple Web Application" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTE3NSIgZHk9Ijc1OSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjMuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjQ0IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMjMwIiB5PSItNSIgd2lkdGg9IjE2NyIgaGVpZ2h0PSIzNDYiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OCIgdmFsdWU9IkJyb3dzZXIgLSZndDsgV2ViIFVJIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0wO2VudHJ5WT0wLjI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTc0YTUwM2E5LTQyNWItNDkzNC05MGJkLTFiNDJhMDRmNzM1Zjtpci50YWdzPWxvZ2luLFJlZ2lzdGVyO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhOyIgcGFyZW50PSI0NCIgc291cmNlPSI0NiIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQnJvd3NlciIgaWQ9IjQ2Ij4KICAgICAgPG14Q2VsbCBzdHlsZT0iaXIucmVmPTliMTVlMTI1LTM3YWUtNDRlZi1hODAzLTZjNmIzOGFmOTQ2ZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1CUk9XU0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpVd05WOHlNekl5T0NraVBqeHdZWFJvSUdROUlrMHdMakl3TURnd05pQXdMakk1T0RZME4wTXdMakl3TURnd05pQXdMakl6T1RneU5DQXdMakkwT0RBeU55QXdMakU1TWpFek9TQXdMak13TmpJM055QXdMakU1TWpFek9VZ3dMalk0TlRrM00wTXdMamMwTkRJeU15QXdMakU1TWpFek9TQXdMamM1TVRRME5DQXdMakl6T1RneU5DQXdMamM1TVRRME5DQXdMakk1T0RZME4xWXdMalE1Tmpjd05rTXdMamMzT0RNNU5pQXdMalE0T0RVME55QXdMamMyTkRJMElEQXVORGd5TURJMUlEQXVOelE1TWpVMUlEQXVORGMzTkRJeVZqQXVNell5TlRVeFNEQXVNalF5T1RrMFZqQXVOamd5TURjMVF6QXVNalF5T1RrMElEQXVOekUzTXpZNUlEQXVNamN4TXpJM0lEQXVOelExT1RnZ01DNHpNRFl5TnpjZ01DNDNORFU1T0Vnd0xqVTBNamt6TlVNd0xqVTFNalU1TkNBd0xqYzJNVGszTWlBd0xqVTJORFl6SURBdU56YzJNelFnTUM0MU56ZzFORGNnTUM0M09EZzFPRE5JTUM0ek1EWXlOemRETUM0eU5EZ3dNamNnTUM0M09EZzFPRE1nTUM0eU1EQTRNRFlnTUM0M05EQTRPVGdnTUM0eU1EQTRNRFlnTUM0Mk9ESXdOelZXTUM0eU9UZzJORGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVOalUxTkRZM0lEQXVOekkwT0RJeFNEQXVOelE0TXpjM1F6QXVOek01TURjMElEQXVOemMwTXprMElEQXVOekl3TkRRMUlEQXVPREE0TVRNNUlEQXVOekF4T1RJeUlEQXVPREE0TVRNNVF6QXVOamd6T1RZZ01DNDRNRGd4TXprZ01DNDJOalU0T1RrZ01DNDNOelkwTURnZ01DNDJOVFl6TXpnZ01DNDNNamt5T0RSTU1DNDJOVFUwTmpjZ01DNDNNalE0TWpGSU1DNDNORGd6TnpkSU1DNDJOVFUwTmpkYVRUQXVOVFkzT0RVMUlEQXVOekkwT0RJMFREQXVOak15TkRZMklEQXVOekkwT0RKRE1DNDJNemM1TXprZ01DNDNOVFl6TnpRZ01DNDJORGN5TVRjZ01DNDNPRE15TVRnZ01DNDJOVGt6TlRrZ01DNDRNREl3TURSRE1DNDJNakE1TURFZ01DNDNPVEExTXpVZ01DNDFPRGc0T0RNZ01DNDNOak01TkRNZ01DNDFOekF3TlRFZ01DNDNNamt3TlV3d0xqVTJOemcxTlNBd0xqY3lORGd5TkZwTk1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkVNd0xqZ3hOelV4TWlBd0xqYzJNVGM1TWlBd0xqYzRORFE0TVNBd0xqYzVNREEzTmlBd0xqYzBORFVnTUM0NE1ERTVPVGxETUM0M05UVTRNak1nTUM0M09EUTBOVGNnTUM0M05qUTJOVGNnTUM0M05UazVNRGdnTUM0M056QXlNek1nTUM0M016RXdOalpNTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORXd3TGpjM01UTTNPQ0F3TGpjeU5EZ3lXazB3TGpjM05Ua3lOQ0F3TGpZeU5qTXlNMHd3TGpnME9UQXdOQ0F3TGpZeU5qTXhNME13TGpnMU1EazNNaUF3TGpZek5qRXdOeUF3TGpnMU1qQXdOaUF3TGpZME5qSTBOQ0F3TGpnMU1qQXdOaUF3TGpZMU5qWXlOVU13TGpnMU1qQXdOaUF3TGpZM01qUTJOU0F3TGpnME9UVTVPU0F3TGpZNE56Y3pPQ0F3TGpnME5URXpOU0F3TGpjd01qQTVNa2d3TGpjM05EVTJOME13TGpjM05qRTBOeUF3TGpZNE56VTRNU0F3TGpjM05qazNOU0F3TGpZM01qTXpOU0F3TGpjM05qazNOU0F3TGpZMU5qWXlOVU13TGpjM05qazNOU0F3TGpZME9UYzBJREF1TnpjMk9ERTJJREF1TmpReU9UUTFJREF1TnpjMk5UQTFJREF1TmpNMk1qWXhUREF1TnpjMU9USTBJREF1TmpJMk16SXpUREF1T0RRNU1EQTBJREF1TmpJMk16RXpUREF1TnpjMU9USTBJREF1TmpJMk16SXpXazB3TGpVMU5EZzBJREF1TmpJMk16RXpUREF1TmpJM09USWdNQzQyTWpZek1qTkRNQzQyTWpjeU1qWWdNQzQyTXpZeE56SWdNQzQyTWpZNE5qZ2dNQzQyTkRZeU9UZ2dNQzQyTWpZNE5qZ2dNQzQyTlRZMk1qVkRNQzQyTWpZNE5qZ2dNQzQyTmpreE9UTWdNQzQyTWpjek9UZ2dNQzQyT0RFME5qUWdNQzQyTWpnME1Ua2dNQzQyT1RNeU9UbE1NQzQyTWpreU56WWdNQzQzTURJd09USklNQzQxTlRnM01EbERNQzQxTlRReU5EVWdNQzQyT0RjM016Z2dNQzQxTlRFNE16Z2dNQzQyTnpJME5qVWdNQzQxTlRFNE16Z2dNQzQyTlRZMk1qVkRNQzQxTlRFNE16Z2dNQzQyTkRZeU5EUWdNQzQxTlRJNE56SWdNQzQyTXpZeE1EY2dNQzQxTlRRNE5DQXdMall5TmpNeE0xcE5NQzQyTlRBMU16UWdNQzQyTWpZek1UUklNQzQzTlRNek1VTXdMamMxTkRBMk5DQXdMall6TmpBNU9DQXdMamMxTkRRMk5pQXdMalkwTmpJek15QXdMamMxTkRRMk5pQXdMalkxTmpZeU5VTXdMamMxTkRRMk5pQXdMalkyT1RNeE9DQXdMamMxTXpnMk55QXdMalk0TVRZeU9TQXdMamMxTWpjMU9DQXdMalk1TXpNNE0wd3dMamMxTVRnek15QXdMamN3TWpBNU1rZ3dMalkxTWpBeE1VTXdMalkxTURNeE5TQXdMalk0TnpjMklEQXVOalE1TXpjM0lEQXVOamN5TkRreUlEQXVOalE1TXpjM0lEQXVOalUyTmpJMVF6QXVOalE1TXpjM0lEQXVOalE0T0RNeElEQXVOalE1TmpBMElEQXVOalF4TVRneElEQXVOalV3TURNMUlEQXVOak16TnpFMlREQXVOalV3TlRNMElEQXVOakkyTXpFMFNEQXVOelV6TXpGSU1DNDJOVEExTXpSYVRUQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1F6QXVOemc1TnpjNElEQXVOVEkwTnpRNElEQXVPREkyTVRVeklEQXVOVFU1TWpRM0lEQXVPRFF5TlRVM0lEQXVOakF6TlRneVREQXVOemN6TmpZMklEQXVOakF6TlRnM1F6QXVOelk0T1RNeElEQXVOVFkyT1RZeUlEQXVOelU1TXpFeklEQXVOVE0xTlRBNElEQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1REQXVOelEyTVRBMElEQXVOVEV6T0RJMldrMHdMalkxTnpVek1TQXdMalV4TVRnd05Vd3dMalkxT1RNMU9DQXdMalV4TVRJME4wTXdMalkwTmpFME1TQXdMalV6TVRZNU55QXdMall6TmpNeE9DQXdMalUyTVRZNU5pQXdMall6TVRFd01TQXdMalU1TmpreU1rd3dMall6TURFM055QXdMall3TXpVNE4wd3dMalUyTVRJNE5pQXdMall3TXpVNE1rTXdMalUzTnpRM0lEQXVOVFU1T0RRMUlEQXVOakV6TURnNElEQXVOVEkxTmpneElEQXVOalUzTlRNeElEQXVOVEV4T0RBMVREQXVOalU1TXpVNElEQXVOVEV4TWpRM1REQXVOalUzTlRNeElEQXVOVEV4T0RBMVdrMHdMamN3TVRreU1pQXdMalV3TlRFeE1VTXdMamN5TVRjeE1pQXdMalV3TlRFeE1TQXdMamMwTVRZeU1pQXdMalUwTXpZeU9DQXdMamMxTURFMU1TQXdMalU1T0RneE0wd3dMamMxTURnMU5DQXdMall3TXpVNE0wZ3dMalkxTWprNVF6QXVOall4TURnMElEQXVOVFExT0RZZ01DNDJPREUxTmpjZ01DNDFNRFV4TVRFZ01DNDNNREU1TWpJZ01DNDFNRFV4TVRGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQQzluUGp4a1pXWnpQanhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpVd05WOHlNekl5T0NJK1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci50YWdzPWFueTsiIHBhcmVudD0iNDQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iMzguNSIgeT0iMzIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NyIgdmFsdWU9ImFueSIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDYiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OSIgdmFsdWU9IldlYiBVSSAtJmd0OyBCcm93c2VyIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTE5ZDNjYzUzLTc5ODUtNDIyYy05YzY2LWE3ZDViZTBmZjNlYTtpci50YWdzPXJlc3BvbnNlOyIgcGFyZW50PSI0NCIgc291cmNlPSI0NyIgdGFyZ2V0PSI0NiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iV2ViIFVJIiBpZD0iNDciPgogICAgICA8bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItdWk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNell6TmpZMElEQXVNemcyTnpGRE1DNHpPVGsyTnpjZ01DNHpPRFkzTVNBd0xqUXlPVEUxTnlBd0xqUXhORFk0T1NBd0xqUXpNVFUxTVNBd0xqUTFNREE1Tmt3d0xqUXpNVGN3T0NBd0xqUTFORGMxTkZZd0xqZ3dNalV6TmtNd0xqUXpNVGN3T0NBd0xqZ3pPRFUwT1NBd0xqUXdNemN5T1NBd0xqZzJPREF5T1NBd0xqTTJPRE15TWlBd0xqZzNNRFF5TTB3d0xqTTJNelkyTkNBd0xqZzNNRFU0U0RBdU1UazNORE00UXpBdU1UWXhOREkxSURBdU9EY3dOVGdnTUM0eE16RTVORFlnTUM0NE5ESTJNREVnTUM0eE1qazFOVElnTUM0NE1EY3hPVFJNTUM0eE1qa3pPVFVnTUM0NE1ESTFNelpXTUM0ME5UUTNOVFJETUM0eE1qa3pPVFVnTUM0ME1UZzNOQ0F3TGpFMU56TTNNeUF3TGpNNE9USTJNU0F3TGpFNU1qYzRJREF1TXpnMk9EWTNUREF1TVRrM05ETTRJREF1TXpnMk56RklNQzR6TmpNMk5qUmFUVEF1TXpZek5qWTBJREF1TkRNeU1EY3pTREF1TVRrM05ETTRRekF1TVRnMU9UVTJJREF1TkRNeU1EY3pJREF1TVRjMk5EWTJJREF1TkRRd05qQTJJREF1TVRjME9UWTBJREF1TkRVeE5qYzNUREF1TVRjME56VTNJREF1TkRVME56VTBWakF1T0RBeU5UTTJRekF1TVRjME56VTNJREF1T0RFME1ERTRJREF1TVRnek1qa2dNQzQ0TWpNMU1EZ2dNQzR4T1RRek5qRWdNQzQ0TWpVd01Vd3dMakU1TnpRek9DQXdMamd5TlRJeE4wZ3dMak0yTXpZMk5FTXdMak0zTlRFME5pQXdMamd5TlRJeE55QXdMak00TkRZek5pQXdMamd4TmpZNE5DQXdMak00TmpFek9DQXdMamd3TlRZeE0wd3dMak00TmpNME5TQXdMamd3TWpVek5sWXdMalExTkRjMU5FTXdMak00TmpNME5TQXdMalEwTXpJM01pQXdMak0zTnpneE1pQXdMalF6TXpjNE1pQXdMak0yTmpjME1TQXdMalF6TWpJNFREQXVNell6TmpZMElEQXVORE15TURjeldrMHdMak13TXpJNE5DQXdMamN6TkRRNU1VTXdMak14TlRneE1TQXdMamN6TkRRNU1TQXdMak15TlRrMk5TQXdMamMwTkRZME5pQXdMak15TlRrMk5TQXdMamMxTnpFM00wTXdMak15TlRrMk5TQXdMamMyT0RZMU5TQXdMak14TnpRek15QXdMamMzT0RFME5TQXdMak13TmpNMk1pQXdMamMzT1RZME4wd3dMak13TXpJNE5DQXdMamMzT1RnMU5FZ3dMakkxTnpnNE4wTXdMakkwTlRNMklEQXVOemM1T0RVMElEQXVNak0xTWpBMUlEQXVOelk1TmprNUlEQXVNak0xTWpBMUlEQXVOelUzTVRjelF6QXVNak0xTWpBMUlEQXVOelExTmprZ01DNHlORE0zTXpnZ01DNDNNell5SURBdU1qVTBPREE1SURBdU56TTBOams0VERBdU1qVTNPRGczSURBdU56TTBORGt4U0RBdU16QXpNamcwV2swd0xqYzROekl6TVNBd0xqRTBORGMzTlVNd0xqZ3lNekkwTlNBd0xqRTBORGMzTlNBd0xqZzFNamN5TkNBd0xqRTNNamMxTkNBd0xqZzFOVEV4T0NBd0xqSXdPREUyTVV3d0xqZzFOVEkzTlNBd0xqSXhNamd5VmpBdU5UVXpNRFJETUM0NE5UVXlOelVnTUM0MU9Ea3dOVFFnTUM0NE1qY3lPVGNnTUM0Mk1UZzFNek1nTUM0M09URTRPU0F3TGpZeU1Ea3lPRXd3TGpjNE56SXpNU0F3TGpZeU1UQTRORWd3TGpZME16UTBNMVl3TGpjd05ESTFTREF1TmpneE16QTJRekF1Tmprek9ETXpJREF1TnpBME1qVWdNQzQzTURNNU9EY2dNQzQzTVRRME1EUWdNQzQzTURNNU9EY2dNQzQzTWpZNU16RkRNQzQzTURNNU9EY2dNQzQzTXpnME1UUWdNQzQyT1RVME5UUWdNQzQzTkRjNU1ETWdNQzQyT0RRek9EUWdNQzQzTkRrME1EVk1NQzQyT0RFek1EWWdNQzQzTkRrMk1USklNQzQwTmpJd05UUldNQzQzTURReU5VZ3dMalU1T0RBNE1WWXdMall5TVRBNE5FZ3dMalEyTWpBMU5GWXdMalUzTlRjeU1rZ3dMamM0TnpJek1VTXdMamM1T0RjeE5DQXdMalUzTlRjeU1pQXdMamd3T0RJd05DQXdMalUyTnpFNE9TQXdMamd3T1Rjd05pQXdMalUxTmpFeE9Fd3dMamd3T1RreE15QXdMalUxTXpBMFZqQXVNakV5T0RKRE1DNDRNRGs1TVRNZ01DNHlNREV6TXpjZ01DNDRNREV6T0NBd0xqRTVNVGcwTnlBd0xqYzVNRE13T1NBd0xqRTVNRE0wTlV3d0xqYzROekl6TVNBd0xqRTVNREV6T0Vnd0xqSTRPREUyTkVNd0xqSTNOalk0TVNBd0xqRTVNREV6T0NBd0xqSTJOekU1TVNBd0xqRTVPRFkzTVNBd0xqSTJOVFk0T1NBd0xqSXdPVGMwTWt3d0xqSTJOVFE0TWlBd0xqSXhNamd5VmpBdU16VTJORFk0U0RBdU1qSXdNVEpXTUM0eU1USTRNa013TGpJeU1ERXlJREF1TVRjMk9EQTJJREF1TWpRNE1EazRJREF1TVRRM016STJJREF1TWpnek5UQTFJREF1TVRRME9UTXlUREF1TWpnNE1UWTBJREF1TVRRME56YzFTREF1TnpnM01qTXhXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPRFEyTnpZNUlpQm9aV2xuYUhROUlqQXVPRFEyTnpZNUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOamc0TkRjM0lEQXVNRGcwTXpVd05pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIudGFncz1SZWdpc3Rlcixsb2dpbjtpci5yZWY9ZjVlMzdiNTYtODhmZi00Zjk0LTk3MGMtZGY4MGFlNTdkMGZjOyIgcGFyZW50PSI0NCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIzOC41IiB5PSIyMjIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NiIgdmFsdWU9IlJlZ2lzdGVyLGxvZ2luIiBzdHlsZT0idGV4dDtodG1sPTE7cmVzaXphYmxlPTA7ZWRpdGFibGU9MDtkZWxldGFibGU9MDtjb25uZWN0YWJsZT0wO3BvaW50cz1bXTtpci50eXBlPUNPTVBPTkVOVF9UQUc7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlOyIgcGFyZW50PSI0NyIgdmVydGV4PSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMS4zIiB5PSIwLjQ1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjQ1IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTQ0IiB5PSItMyIgd2lkdGg9IjUzNiIgaGVpZ2h0PSIzMzkiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2NCIgdmFsdWU9IkFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9MGZlNDAyMTItMTA5MC00ZjA5LThhNzYtMjBjZjU1ZmM2M2JlO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC44NTY7ZW50cnlZPTAuOTM5O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNDUiIHNvdXJjZT0iNDgiIHRhcmdldD0iNTAiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9IkFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkiIGlkPSI0OCI+CiAgICAgIDxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJkcztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWXdNRE1nTUM0ek56WTBOemxETUM0Mk5EWXdNRE1nTUM0ek16YzRNVE1nTUM0MU56QXhNemNnTUM0ek1UazVORFlnTUM0ME9Ua3pNemNnTUM0ek1UazVORFpETUM0ME1qZzFNemNnTUM0ek1UazVORFlnTUM0ek5USTJOeUF3TGpNek56Z3hNeUF3TGpNMU1qWTNJREF1TXpjMk5EYzVRekF1TXpVeU5qRXlJREF1TXpjNE5ERXpJREF1TXpVeU9ETTNJREF1TXpnd016UTBJREF1TXpVek16TTNJREF1TXpneU1qRXpWakF1TmpJeU9EYzVRekF1TXpVeU5qY2dNQzQyTmpJNE56a2dNQzQwTWpnMk55QXdMalkzT1RrME5TQXdMalV3TURBd015QXdMalkzT1RrME5VTXdMalUzTVRNek55QXdMalkzT1RrME5TQXdMalkwTmpZM0lEQXVOall5TXpRMUlEQXVOalEyTmpjZ01DNDJNak0yTnpsV01DNHpOelkwTnpsSU1DNDJORFl3TUROYVRUQXVORGs1TmpBeklEQXVNelEyTnpRMlF6QXVOVGMzTXpNM0lEQXVNelEyTnpRMklEQXVOakU1TmpBeklEQXVNelkzT1RRMklEQXVOakU1TmpBeklEQXVNemMyTmpFelF6QXVOakU1TmpBeklEQXVNemcxTWpjNUlEQXVOVGMzTmpBeklEQXVOREEyTkRjNUlEQXVORGs1TmpBeklEQXVOREEyTkRjNVF6QXVOREl4TmpBeklEQXVOREEyTkRjNUlEQXVNemM1TmpBeklEQXVNemcxTkRFeklEQXVNemM1TmpBeklEQXVNemMyTmpFelF6QXVNemM1TmpBeklEQXVNelkzT0RFeklEQXVOREl4T0RjZ01DNHpORFkzTkRZZ01DNDBPVGsyTURNZ01DNHpORFkzTkRaYVRUQXVOakU1TmpBeklEQXVOakl6T0RFeVF6QXVOakU1TmpBeklEQXVOak15TXpRMUlEQXVOVGMzTkRjZ01DNDJOVE0wTVRJZ01DNDBPVGsyTURNZ01DNDJOVE0wTVRKRE1DNDBNakUzTXpjZ01DNDJOVE0wTVRJZ01DNHpOemsyTURNZ01DNDJNekl6TkRVZ01DNHpOemsyTURNZ01DNDJNak00TVRKV01DNDFPREUyTnpsRE1DNDBNRGMzTXpjZ01DNDFPVGN3TVRJZ01DNDBOVFE1TXpjZ01DNDJNRFF6TkRVZ01DNDBPVGsyTURNZ01DNDJNRFF6TkRWRE1DNDFORFF5TnlBd0xqWXdORE0wTlNBd0xqVTVNVEEzSURBdU5UazNNVFExSURBdU5qRTVOakF6SURBdU5UZ3lNRGM1VmpBdU5qSXpPREV5V2swd0xqWXhPVFl3TXlBd0xqVTBOemswTmtNd0xqWXhPVFl3TXlBd0xqVTFOalEzT1NBd0xqVTNOell3TXlBd0xqVTNOemd4TWlBd0xqUTVPVFl3TXlBd0xqVTNOemd4TWtNd0xqUXlNVFl3TXlBd0xqVTNOemd4TWlBd0xqTTNPVFl3TXlBd0xqVTFOalEzT1NBd0xqTTNPVFl3TXlBd0xqVTBOemswTmtnd0xqTTRNREF3TTFZd0xqUTVOekF4TWtNd0xqUXdPREV6TnlBd0xqVXhNakl4TWlBd0xqUTFOVE16TnlBd0xqVXhPVFUwTmlBd0xqVXdNREF3TXlBd0xqVXhPVFUwTmtNd0xqVTBORFkzSURBdU5URTVOVFEySURBdU5Ua3hORGNnTUM0MU1USXpORFlnTUM0Mk1qQXdNRE1nTUM0ME9UY3lOemxNTUM0Mk1UazJNRE1nTUM0MU5EYzVORFphVFRBdU5qRTVOakF6SURBdU5EWXpNREV6UXpBdU5qRTVOakF6SURBdU5EY3hOamM1SURBdU5UYzNOakF6SURBdU5Ea3pNREV5SURBdU5EazVOakF6SURBdU5Ea3pNREV5UXpBdU5ESXhOakF6SURBdU5Ea3pNREV5SURBdU16YzVOakF6SURBdU5EY3hOamM1SURBdU16YzVOakF6SURBdU5EWXpNREV6U0RBdU16Z3dNREF6VmpBdU5ERXhNREV6UXpBdU5EQTROREF6SURBdU5ESTJNRGM1SURBdU5EVTFNRGNnTUM0ME16TXdNVE1nTUM0MU1EQXdNRE1nTUM0ME16TXdNVE5ETUM0MU5EUTVNemNnTUM0ME16TXdNVE1nTUM0MU9USXhNemNnTUM0ME1qVTRNVE1nTUM0Mk1qQXdNRE1nTUM0ME1UQTBOemxNTUM0Mk1UazJNRE1nTUM0ME5qTXdNVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNakV5TURreklEQXVPREEyT0Vnd0xqSTVPVGsxT1ZZd0xqZ3pNelEyTmtnd0xqRTNPVGsxT1VNd0xqRTNOalF5TXlBd0xqZ3pNelEyTmlBd0xqRTNNekF6TWlBd0xqZ3pNakEyTVNBd0xqRTNNRFV6TVNBd0xqZ3lPVFUyTVVNd0xqRTJPREF6TVNBd0xqZ3lOekEyTVNBd0xqRTJOall5TmlBd0xqZ3lNelkyT1NBd0xqRTJOall5TmlBd0xqZ3lNREV6TTFZd0xqY3dNREV6TTBnd0xqRTVNekk1TTFZd0xqYzROemN6TTB3d0xqSTVNekk1TXlBd0xqWTROemcyTmt3d0xqTXhNVGsxT1NBd0xqY3dOalkyTmt3d0xqSXhNakE1TXlBd0xqZ3dOamhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPRE16TXpNeElEQXVOekF3TVRNeFZqQXVPREl3TVRNeFF6QXVPRE16TXpNeElEQXVPREl6TmpZM0lEQXVPRE14T1RJMklEQXVPREkzTURVNUlEQXVPREk1TkRJMklEQXVPREk1TlRVNVF6QXVPREkyT1RJMUlEQXVPRE15TURZZ01DNDRNak0xTXpRZ01DNDRNek0wTmpRZ01DNDRNVGs1T1RnZ01DNDRNek0wTmpSSU1DNDJPVGs1T1RoV01DNDRNRFkzT1RoSU1DNDNPRGM0TmpSTU1DNDJPRGt6TXpFZ01DNDNNRGM1T1RoTU1DNDNNRGd4TXpFZ01DNDJPRGt6TXpGTU1DNDRNRFkyTmpRZ01DNDNPRGMzTXpGV01DNDNNREF4TXpGSU1DNDRNek16TXpGYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RNek16TXhJREF1TVRnd01qQTBWakF1TXpBd01qQTBTREF1T0RBMk5qWTBWakF1TWpFeU1qQTBUREF1TnpBNE1UTXhJREF1TXpFd056TTRUREF1TmpnNU16TXhJREF1TWpreE9UTTRUREF1TnpnM056TXhJREF1TVRrek5UTTNTREF1TmprNU9UazRWakF1TVRZMk9EZElNQzQ0TVRrNU9UaERNQzQ0TWpNMU16UWdNQzR4TmpZNE55QXdMamd5TmpreU5TQXdMakUyT0RJM05TQXdMamd5T1RReU5pQXdMakUzTURjM05VTXdMamd6TVRreU5pQXdMakUzTXpJM05pQXdMamd6TXpNek1TQXdMakUzTmpZMk55QXdMamd6TXpNek1TQXdMakU0TURJd05Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1URTVOVGtnTUM0eU9UTXpNRFJNTUM0eU9UTXlPVE1nTUM0ek1URTVOekZNTUM0eE9UTXlPVE1nTUM0eU1USXhNRFJXTUM0eU9UazRNemRJTUM0eE5qWTJNalpXTUM0eE56azRNemRETUM0eE5qWTJNallnTUM0eE56WXpNREVnTUM0eE5qZ3dNekVnTUM0eE56STVNU0F3TGpFM01EVXpNU0F3TGpFM01EUXdPVU13TGpFM016QXpNaUF3TGpFMk56a3dPU0F3TGpFM05qUXlNeUF3TGpFMk5qVXdOQ0F3TGpFM09UazFPU0F3TGpFMk5qVXdORWd3TGpJNU9UazFPVll3TGpFNU16RTNNVWd3TGpJeE1qQTVNMHd3TGpNeE1UazFPU0F3TGpJNU16TXdORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlPVFUwT1RFZ01DNDJNVGsxTURORE1DNHlNVFF3TWpVZ01DNDFPVEF4TnlBd0xqRTJOek0xT0NBd0xqVTBOVE0yT1NBd0xqRTJOek0xT0NBd0xqUTVOamN3TWtNd0xqRTJOek0xT0NBd0xqUTBPREF6TlNBd0xqSXhOREF5TlNBd0xqUXdNek0yT0NBd0xqSTVOVFE1TVNBd0xqTTNNemt3TVV3d0xqTXdORFUxTnlBd0xqTTVPRGsyT0VNd0xqSXpOVE0xT0NBd0xqUXlNemt3TWlBd0xqRTVOREF5TlNBd0xqUTJNRFF6TlNBd0xqRTVOREF5TlNBd0xqUTVOamN3TWtNd0xqRTVOREF5TlNBd0xqVXpNamsyT1NBd0xqSXpOVE0xT0NBd0xqVTJPVFV3TXlBd0xqTXdORFUxTnlBd0xqVTVORFF6TjB3d0xqSTVOVFE1TVNBd0xqWXhPVFV3TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT1RjeE16SWdNQzQyTWpJME5Fd3dMalk0T0RVNU9TQXdMalU1TnpFd04wTXdMamMyTWpVNU9TQXdMalUzTWpFM015QXdMamd3Tmpjek1pQXdMalV6TkRVM015QXdMamd3Tmpjek1pQXdMalE1Tmpjd05rTXdMamd3Tmpjek1pQXdMalExT0Rnek9TQXdMamMyTWpVNU9TQXdMalF5TVRJek9TQXdMalk0T0RVNU9TQXdMak01TmpFM01rd3dMalk1TnpFek1pQXdMak0zTURrM01rTXdMamM0TXpZMk5TQXdMalF3TURBek9TQXdMamd6TXpNNU9TQXdMalEwTmpFM01pQXdMamd6TXpNNU9TQXdMalE1Tmpjd05rTXdMamd6TXpNNU9TQXdMalUwTnpJMElEQXVOemd6TmpZMUlEQXVOVGt6TVRBM0lEQXVOamszTVRNeUlEQXVOakl5TkRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN5SWlCNU1qMGlMVEF1TWpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekpGTWpkQlJDSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOVEkzUmtaR0lpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9TG9naW4gQ3JlZGVudGlhbHMsVXNlcnMscGVyc29uYWxseSBpZGVudGlmaWFibGUgaW5mb3JtYXRpb247aXIucmVmPWM1MTJjN2UxLThmYWMtNDQxZS04NTA3LTE4ZGM3NDA5YTYzZDsiIHBhcmVudD0iNDUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iNDM3IiB5PSI2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNTMiIHZhbHVlPSJMb2dpbiBDcmVkZW50aWFscyxVc2VycyxwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBpbmZvcm1hdGlvbiIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDgiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2NiIgdmFsdWU9Ik1vbmdvREIgTm9TUUwgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj03NGUyOWRiZS1jYmFjLTRlYzAtYjhlZS1kN2U4Yzk4ODUxMzA7aXIudGFncz1xdWVyeSByZXN1bHRzLHBheW1lbnQgcmVzcG9uc2UscmVzcG9uc2U7IiBwYXJlbnQ9IjQ1IiBzb3VyY2U9IjQ5IiB0YXJnZXQ9IjUwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMjcwIiB5PSIyMTgiLz4KICAgICAgICA8L0FycmF5PgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9Ik1vbmdvREIgTm9TUUwiIGlkPSI0OSI+CiAgICAgIDxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vbmdvZGItbm9zcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGd3TnpoRE1DNDRNemsyTmpnZ01DNHpOREE0T1RnZ01DNDJPRGMwTXpNZ01DNDBNVFl3TnpnZ01DNDBPVGsyTmpnZ01DNDBNVFl3TnpoRE1DNHpNVEU1TURNZ01DNDBNVFl3TnpnZ01DNHhOVGsyTmpnZ01DNHpOREE0T1RnZ01DNHhOVGsyTmpnZ01DNHlORGd3TnpoRE1DNHhOVGsyTmpnZ01DNHhOVFV5TlRnZ01DNHpNVEU1TURNZ01DNHdPREF3TnpneElEQXVORGs1TmpZNElEQXVNRGd3TURjNE1VTXdMalk0TnpRek15QXdMakE0TURBM09ERWdNQzQ0TXprMk5qZ2dNQzR4TlRVeU5UZ2dNQzQ0TXprMk5qZ2dNQzR5TkRnd056aGFUVEF1T0RNNU5qWTRJREF1TXpjMk16QTBRekF1T0RFNE1UZzJJREF1TXprME9UYzVJREF1TnprME1qa3hJREF1TkRFd056VTFJREF1TnpZNE5qQTRJREF1TkRJek1qRTRRekF1TmprMk5EUXpJREF1TkRVNE9ETTBJREF1TmpBeE16STRJREF1TkRjNU1EYzRJREF1TkRrNU5qWTRJREF1TkRjNU1EYzRRekF1TXprNE1EQTRJREF1TkRjNU1EYzRJREF1TXpBeU9Ea3pJREF1TkRVNE9ETTBJREF1TWpNd056STRJREF1TkRJek1qRTRRekF1TWpBMU1EUTJJREF1TkRFd056VTFJREF1TVRneE1UVWdNQzR6T1RRNU56a2dNQzR4TlRrMk5qZ2dNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TlRrMk5qZ2dNQzQ0TkRRNE9UZ2dNQzR6TVRFNU1ETWdNQzQ1TWpBd056Z2dNQzQwT1RrMk5qZ2dNQzQ1TWpBd056aERNQzQyT0RjME16TWdNQzQ1TWpBd056Z2dNQzQ0TXprMk5qZ2dNQzQ0TkRRNE9UZ2dNQzQ0TXprMk5qZ2dNQzQzTlRJd056aFdNQzR6TnpZek1EUmFUVEF1TlRBeE5EQXlJREF1TlRNeE1qRTJRekF1TlRBeE1EZzVJREF1TlRNd09Ea2dNQzQxTURBM056Y2dNQzQxTXpBMU5qUWdNQzQxTURBME5qVWdNQzQxTXpFeE9EaE1NQzQxTURBME5qSWdNQzQxTXpFM05ERk1NQzQwT1RFMk56Z2dNQzQxTkRneU16ZERNQzQwT0RrM01ETWdNQzQxTlRFeU9ESWdNQzQwT0RjMU5qTWdNQzQxTlRNNU56Z2dNQzQwT0RVd05ETWdNQzQxTlRZME9EbERNQzQwTnpjMk5USWdNQzQxTmpNM09EY2dNQzQwTnpBM05qTWdNQzQxTnpFMU56WWdNQzQwTmpRME1qTWdNQzQxTnprNE1EUkRNQzQwTkRrMU16UWdNQzQxT1Rrek5UTWdNQzQwTXprME9UTWdNQzQyTWpFd05qTWdNQzQwTXpJek1qSWdNQzQyTkRRMU5ESkRNQzQwTWpnd01pQXdMalkxT0RnNE5TQXdMalF5TlRZNE5TQXdMalkzTXpVNU9TQXdMalF5TlRVeElEQXVOamc0TkRjM1F6QXVOREkwTnpnNUlEQXVOek15T1RVMklEQXVORFF3TURNNElEQXVOemN4TVRRNUlEQXVORGN3TnpneElEQXVPREF5T0RreFF6QXVORGMxTnpneUlEQXVPREEzT1RJMUlEQXVORGd4TVRnMUlEQXVPREV5TlRReklEQXVORGcyT1RNMklEQXVPREUyTmprNVREQXVORGczTVRrMklEQXVPREUyTmprelF6QXVORGc1TXpRMUlEQXVPREl3TURrM0lEQXVORGt4TXpFNUlEQXVPREl6TlRFeUlEQXVORGt4TmpjNUlEQXVPREkzTmpJMlREQXVORGt4TmpnNUlEQXVPREkzTmpNMlREQXVORGt4T0RrZ01DNDRNamt3TmpkRE1DNDBPVEl5TVRVZ01DNDRNekV6TXpRZ01DNDBPVEkxTlRRZ01DNDRNek0yT1RjZ01DNDBPVEkwTVNBd0xqZ3pOakEzTkZZd0xqZzFNalUzTjB3d0xqUTVNVGczTlNBd0xqZzFPRFE1TTBNd0xqUTVNVGczTlNBd0xqZzFPVEl4TkNBd0xqUTVNakEwT1NBd0xqZzJNREV3T1NBd0xqUTVNekV6SURBdU9EWXdNVEE1UXpBdU5EazBNVFFnTUM0NE5Ua3pOVGtnTUM0ME9UVXlNekVnTUM0NE5Ua3dORE1nTUM0ME9UWXlPRGtnTUM0NE5UZzNNemRNTUM0ME9UYzJNVFlnTUM0NE5UZ3pNVGxETUM0ME9UazBNRFlnTUM0NE5UYzFPVFlnTUM0MU1EQXlOVFVnTUM0NE5UYzBOalFnTUM0MU1EQTJOVFlnTUM0NE5UWTVOamxETUM0MU1ERXdNVGNnTUM0NE5UWTFNalFnTUM0MU1ERXdNVFVnTUM0NE5UVTNPRFVnTUM0MU1ERXdNVEVnTUM0NE5UUXdOakZXTUM0NE5UTTBPRE5XTUM0NE5EazRPREZETUM0MU1ERTFOVFlnTUM0NE5EQXdNVFFnTUM0MU1ESTBOREVnTUM0NE16QXpNeklnTUM0MU1EVTJOeklnTUM0NE1qQTRNalZNTUM0MU1EVTRORGNnTUM0NE1UazNOVFZETUM0MU1URTBNRE1nTUM0NE1UVTBORFFnTUM0MU1UWTNOelFnTUM0NE1UQTVOVGdnTUM0MU1qRTNPVFVnTUM0NE1EWXhNakpETUM0MU5ESXlNemtnTUM0M09EWXdNemdnTUM0MU5UZ3dNaklnTUM0M05qSTRPVGdnTUM0MU5qWTRNU0F3TGpjek5USTRNa013TGpVM01EQXpJREF1TnpJME9EZ2dNQzQxTnpReE5UWWdNQzQyT0RnNE1qY2dNQzQxTnpNeU5pQXdMalkzT0RZeFF6QXVOVGN4TXpBMUlEQXVOalV3TWpnMElEQXVOVFkwTkRFeUlEQXVOakl6TXpjNElEQXVOVFV4TURNMklEQXVOVGs0TWpjelF6QXVOVFF3T1RnMElEQXVOVGM1TmpFNUlEQXVOVEk0TkRNeElEQXVOVFl5T1RRZ01DNDFNVEkwT0RRZ01DNDFORGt4TXpKTU1DNDFNVEUxTWpFZ01DNDFORGd5T1RWRE1DNDFNRGc1T0RJZ01DNDFORFl3T1NBd0xqVXdOalV4TVNBd0xqVTBNemswTlNBd0xqVXdORFU1TWlBd0xqVTBNVEkwTVVNd0xqVXdNall5TmlBd0xqVXpPREUzTkNBd0xqVXdNVE0zTVNBd0xqVXpORGsyTkNBd0xqVXdNVFUwTmlBd0xqVXpNVE0yTTB3d0xqVXdNVFF3TWlBd0xqVXpNVEl4TmxwTk1DNDBPVFUzTVRZZ01DNDFOekV3TXpWTU1DNDBPVFUzTnpFZ01DNDFOVEV3TVRORE1DNDBPVE0yTkRJZ01DNDFOVFF5T0RZZ01DNDBPVEV6TURJZ01DNDFOVGN5TXpNZ01DNDBPRGcxTXpFZ01DNDFOVGs1T1RKTU1DNDBPRGcxTVRjZ01DNDFOakF3TURkRE1DNDBPREV5T0RnZ01DNDFOamN4TkRVZ01DNDBOelExTlNBd0xqVTNORGMyTkNBd0xqUTJPRE0wT1NBd0xqVTRNamd4TVVNd0xqUTFNemc1T0NBd0xqWXdNVGM0TnlBd0xqUTBOREE1TkNBd0xqWXlNamt5T1NBd0xqUXpOekExTkNBd0xqWTBOVGszTmtNd0xqUXpNamc0TVNBd0xqWTFPVGc1TXlBd0xqUXpNRFl5TXlBd0xqWTNOREUwTkNBd0xqUXpNRFExTkNBd0xqWTRPRFV6TlZZd0xqWTRPRFUxTjBNd0xqUXlPVGMxTlNBd0xqY3pNVGN3T0NBd0xqUTBORFE1SURBdU56WTROakk1SURBdU5EYzBNekV5SURBdU56azVOREk0UXpBdU5EYzRORFl5SURBdU9EQXpOakEwSURBdU5EZ3lPVEF4SURBdU9EQTNORGd6SURBdU5EZzNOVGt6SURBdU9ERXhNRE0xVERBdU5EZzNOakEySURBdU9ERXhNREUyVERBdU5EZzRNemszSURBdU9EQTVOek0zUXpBdU5Ea3dNemN4SURBdU9EQTJNamc0SURBdU5Ea3hOamcySURBdU9EQXlOVEF4SURBdU5Ea3lNamN5SURBdU56azROVGRNTUM0ME9USXlPU0F3TGpjNU9EUTBPRXd3TGpRNU1qTXhOU0F3TGpjNU9ETXlOME13TGpRNU16TTFOaUF3TGpjNU16RTBNU0F3TGpRNU16azNPU0F3TGpjNE9ESXpOaUF3TGpRNU16WTJPU0F3TGpjNE16STVNMHd3TGpRNU16WTFPU0F3TGpjNE16RXpOMVl3TGpjM09UTTROVXd3TGpRNU16WTVOeUF3TGpjM09UTXdNVXd3TGpRNU16Y3pNaUF3TGpjM056VXhOVXd3TGpRNU16ZzFOQ0F3TGpjMk9UWXhNMHd3TGpRNU5ESXdOU0F3TGpjME1UVXdNVXd3TGpRNU5UQTROQ0F3TGpZMU5qTXpNVXd3TGpRNU5UY3hOaUF3TGpVM01UQXpOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci50YWdzPVBheW1lbnRzO2lyLnJlZj04MDdlYjhmYS0yZjM2LTQwYzItODliYS03NmU5NTJkYzNmMTQ7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjQyOCIgeT0iMjE0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNTQiIHZhbHVlPSJQYXltZW50cyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2MiIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIC0mZ3Q7IEFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9MjZhNGJmMGQtM2RkOC00ZGUzLWJjMDctN2U4NzExYjcwYmVlO2lyLnRhZ3M9cmVzcG9uc2Usb3JkZXIgc3RhdHVzOyIgcGFyZW50PSI0NSIgc291cmNlPSI1MCIgdGFyZ2V0PSI0OCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNjUiIHZhbHVlPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSAtJmd0OyBNb25nb0RCIE5vU1FMIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj03MDE4YzBhYS04OTUzLTRhMjQtODRkZi0xMDE5Zjg5NDhjMDQ7aXIudGFncz1QYXltZW50cztpci5hc3NldHM9Q3JlZGl0IENhcmQgRGF0YTsiIHBhcmVudD0iNDUiIHNvdXJjZT0iNTAiIHRhcmdldD0iNDkiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC4yNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj0yNjNkZGE4Ny1iMDRiLTRmMjktODg3Mi1mNjVkODg5NGI1M2E7aXIudGFncz1xdWVyeSBmcm9udCBlbmQgZmlsZXM7IiBwYXJlbnQ9IjQ1IiBzb3VyY2U9IjUwIiB0YXJnZXQ9IjUxIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSIgaWQ9IjUwIj4KICAgICAgPG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWFwcGxpY2F0aW9uLXNlcnZlci1zaWRlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVVNd0xqTTJOVGcxTXlBd0xqSTRNamM0TWlBd0xqTTNPRGN5TlNBd0xqSTJPVGt4TVNBd0xqTTVORFl3TXlBd0xqSTJPVGt4TVVnd0xqWXdOVFF6TmtNd0xqWXlNVE14TkNBd0xqSTJPVGt4TVNBd0xqWXpOREU0TmlBd0xqSTRNamM0TWlBd0xqWXpOREU0TmlBd0xqSTVPRFkyTVVNd0xqWXpOREU0TmlBd0xqTXhORFV6T1NBd0xqWXlNVE14TkNBd0xqTXlOelF4TVNBd0xqWXdOVFF6TmlBd0xqTXlOelF4TVVnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqTXlOelF4TVNBd0xqTTJOVGcxTXlBd0xqTXhORFV6T1NBd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVZwTk1DNHpPVFEyTURNZ01DNDJPVEUxTnpoRE1DNHpOemczTWpVZ01DNDJPVEUxTnpnZ01DNHpOalU0TlRNZ01DNDNNRFEwTlNBd0xqTTJOVGcxTXlBd0xqY3lNRE15T0VNd0xqTTJOVGcxTXlBd0xqY3pOakl3TmlBd0xqTTNPRGN5TlNBd0xqYzBPVEEzT0NBd0xqTTVORFl3TXlBd0xqYzBPVEEzT0Vnd0xqVTFNREF4T1ZZd0xqWTVNVFUzT0Vnd0xqTTVORFl3TTFwTk1DNDJNakF6TlRFZ01DNDJNams1TVRGSU1DNDJNRFExTmpWRE1DNDFPVGN4TkRRZ01DNDJNams1TVRFZ01DNDFPVEF3TmpnZ01DNDJNekV6T1RNZ01DNDFPRE0yTVRrZ01DNDJNelF3TnpoSU1DNHpPVFEyTURORE1DNHpOemczTWpVZ01DNDJNelF3TnpnZ01DNHpOalU0TlRNZ01DNDJNakV5TURZZ01DNHpOalU0TlRNZ01DNDJNRFV6TWpoRE1DNHpOalU0TlRNZ01DNDFPRGswTkRrZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTkRrZ01DNDJNelF4T0RZZ01DNDJNRFV6TWpoRE1DNDJNelF4T0RZZ01DNDJNVFUzTkRVZ01DNDJNamcyTkRZZ01DNDJNalE0TmpnZ01DNDJNakF6TlRFZ01DNDJNams1TVRGYVRUQXVOamN5TlRFNUlEQXVOakk1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVMU1EQXhPVll3TGpnM05UTTJOa013TGpVMU1EQXhPU0F3TGpnM09EQTBNaUF3TGpVMU1ESXhNaUF3TGpnNE1EWTNNaUF3TGpVMU1EVTROQ0F3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNams1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOemMxTWpRZ01DNDJOakkzTWt3d0xqYzNPVGsxT1NBd0xqWTJNamM0T0VNd0xqZ3dNVGN6TmlBd0xqWTJOREF3TlNBd0xqZ3hPVEUyT0NBd0xqWTRNVFF6TnlBd0xqZ3lNRE00TmlBd0xqY3dNekU1T0V3d0xqZ3lNRFExTXlBd0xqY3dOVFl6TTFZd0xqZzFOelE0TWt3d0xqZ3lNRE00TmlBd0xqZzFPVGt4TjBNd0xqZ3hPVEUyT0NBd0xqZzRNVFkzT0NBd0xqZ3dNVGN6TnlBd0xqZzVPVEV4SURBdU56YzVPVGMxSURBdU9UQXdNekk0VERBdU56YzNOVFFnTUM0NU1EQXpPVFpJTUM0Mk1qVTJOemRETUM0Mk1ESTNPVFFnTUM0NU1EQXpPVFlnTUM0MU9EUXdPVFFnTUM0NE9ESTBPRFFnTUM0MU9ESTRNeklnTUM0NE5UazVNVGRNTUM0MU9ESTNOalFnTUM0NE5UYzBPREpXTUM0M01EVTJNek5ETUM0MU9ESTNOalFnTUM0Mk9ESTNOU0F3TGpZd01EWTNOQ0F3TGpZMk5EQTFJREF1TmpJek1qUXlJREF1TmpZeU56ZzRUREF1TmpJMU5qYzNJREF1TmpZeU56SklNQzQzTnpjMU1qUmFUVEF1TnprME1ESTVJREF1TnpJNE56UXhTREF1TmpBNU1UZzRUREF1TmpBNU1UY3lJREF1T0RVM05EZ3lRekF1TmpBNU1UY3lJREF1T0RZMk1ESTRJREF1TmpFMU5qWTNJREF1T0Rjek1EVTJJREF1TmpJek9UZzVJREF1T0Rjek9UQXhUREF1TmpJMU5qYzNJREF1T0Rjek9UZzNTREF1TnpjM05UUk1NQzQzTnpreU1qZ2dNQzQ0TnpNNU1ERkRNQzQzT0RZNU9UWWdNQzQ0TnpNeE1UTWdNQzQzT1RNeE56RWdNQzQ0TmpZNU16Y2dNQzQzT1RNNU5pQXdMamcxT1RFM1REQXVOemswTURRMUlEQXVPRFUzTkRneVREQXVOemswTURJNUlEQXVOekk0TnpReFdrMHdMalkzT0RRNU15QXdMamMwT0RVME4wTXdMalk0TXpVd055QXdMamMwT0RVME55QXdMalk0TnpZMUlEQXVOelV5TWpjeklEQXVOamc0TXpBMklEQXVOelUzTVRBM1REQXVOamc0TXprM0lEQXVOelU0TkRWV01DNDROVEE0T0VNd0xqWTRPRE01TnlBd0xqZzFOVGc1TXlBd0xqWTRORFkzTVNBd0xqZzJNREF6TnlBd0xqWTNPVGd6TnlBd0xqZzJNRFk1TTB3d0xqWTNPRFE1TXlBd0xqZzJNRGM0TTBnd0xqWXpNakkzT1VNd0xqWXlOekkyTmlBd0xqZzJNRGM0TXlBd0xqWXlNekV5TWlBd0xqZzFOekExTnlBd0xqWXlNalEyTmlBd0xqZzFNakl5TkV3d0xqWXlNak0zTmlBd0xqZzFNRGc0VmpBdU56VTRORFZETUM0Mk1qSXpOellnTUM0M05UTTBNemNnTUM0Mk1qWXhNRElnTUM0M05Ea3lPVE1nTUM0Mk16QTVNelVnTUM0M05EZzJNemhNTUM0Mk16SXlOemtnTUM0M05EZzFORGRJTUM0Mk56ZzBPVE5hVFRBdU5qWTROVGtnTUM0M05qZ3pOVFJJTUM0Mk5ESXhPREpXTUM0NE5EQTVOemRJTUM0Mk5qZzFPVll3TGpjMk9ETTFORnBOTUM0M05UYzNNVGdnTUM0M09EZ3hPVGxETUM0M05qTXhPRGNnTUM0M09EZ3hPVGtnTUM0M05qYzJNakVnTUM0M09USTJNek1nTUM0M05qYzJNakVnTUM0M09UZ3hNRE5ETUM0M05qYzJNakVnTUM0NE1ETXhNVFlnTUM0M05qTTRPVFlnTUM0NE1EY3lOaUF3TGpjMU9UQTJNaUF3TGpnd056a3hOVXd3TGpjMU56Y3hPQ0F3TGpnd09EQXdOa2d3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpnd09EQXdOaUF3TGpjd01UWTFPU0F3TGpnd016VTNNaUF3TGpjd01UWTFPU0F3TGpjNU9ERXdNME13TGpjd01UWTFPU0F3TGpjNU16QTRPU0F3TGpjd05UTTROQ0F3TGpjNE9EazBOaUF3TGpjeE1ESXhPQ0F3TGpjNE9ESTVUREF1TnpFeE5UWXlJREF1TnpnNE1UazVTREF1TnpVM056RTRXazB3TGpjM01Ea3lNaUF3TGpjME9EVTBOME13TGpjM05qTTVNaUF3TGpjME9EVTBOeUF3TGpjNE1EZ3lOU0F3TGpjMU1qazRNU0F3TGpjNE1EZ3lOU0F3TGpjMU9EUTFRekF1Tnpnd09ESTFJREF1TnpZek5EWTBJREF1TnpjM01TQXdMamMyTnpZd055QXdMamMzTWpJMk5pQXdMamMyT0RJMk0wd3dMamMzTURreU1pQXdMamMyT0RNMU5FZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamMyT0RNMU5DQXdMamN3TVRZMU9TQXdMamMyTXpreUlEQXVOekF4TmpVNUlEQXVOelU0TkRWRE1DNDNNREUyTlRrZ01DNDNOVE0wTXpjZ01DNDNNRFV6T0RRZ01DNDNORGt5T1RNZ01DNDNNVEF5TVRnZ01DNDNORGcyTXpoTU1DNDNNVEUxTmpJZ01DNDNORGcxTkRkSU1DNDNOekE1TWpKYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9ZXhwcmVzc2pzO2lyLnJlZj00MjE2MzdkMy1hYTNjLTQwNjItOGJjMi1kMmM5YTE1YzQwZGQ7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjEwNSIgeT0iMTYiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1MiIgdmFsdWU9ImV4cHJlc3NqcyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNTAiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2OCIgdmFsdWU9IkFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9MmU5ZGJkNWYtZTlhNy00NDQ0LTg2ODUtYmU5ZGRiY2IxYjg1O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI0NSIgc291cmNlPSI1MSIgdGFyZ2V0PSI1MCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgaWQ9IjUxIj4KICAgICAgPG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9czM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNQzQ1T1RrNU9UVklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTVNRFV4SURBdU5UTTBNVGc0UXpBdU9ERTFNVGcwSURBdU5URXpNalUxSURBdU56a3hORFV4SURBdU5EazRORFUxSURBdU56YzFNVGcwSURBdU5EZzNPVEl5UXpBdU56WTVPVGcwSURBdU5EZzBOVGc1SURBdU56VTFOekU0SURBdU5EYzVNalUxSURBdU56VTBOVEU0SURBdU5EYzBOVGc1UXpBdU56VTBORE0ySURBdU5EY3hNalVnTUM0M05UUTRPRFlnTUM0ME5qYzVNVGtnTUM0M05UVTROVEVnTUM0ME5qUTNNakpNTUM0M05qa3hPRFFnTUM0ek5qZzROVFpETUM0M056TXdOVEVnTUM0ek5EQTNNaklnTUM0M056WTNPRFFnTUM0ek1USTFPRGtnTUM0M09EQTJOVEVnTUM0eU9EUTBOVFpETUM0M09EUXhNVGdnTUM0eU5UZzFPRGtnTUM0M056RTNNVGdnTUM0eU5ERXlOVFlnTUM0M05UQTJOVEVnTUM0eU1qWTNNak5ETUM0M01EYzNNVGdnTUM0eE9UWTVPRGtnTUM0Mk5URTNNVGdnTUM0eE9EUTVPU0F3TGpZd01URTROQ0F3TGpFM05qY3lNME13TGpVek56Z3hNU0F3TGpFMk5qTTNOaUF3TGpRM016TTJOU0F3TGpFMk5ESTNJREF1TkRBNU5EVXhJREF1TVRjd05EVTJRekF1TXpVeE9UWTJJREF1TVRjME5qYzBJREF1TWprMU5UUTJJREF1TVRnNE1UZ3pJREF1TWpReU16ZzBJREF1TWpFd05EVTJRekF1TWpFek9EVXhJREF1TWpJek56ZzVJREF1TVRjMk5URTRJREF1TWpRME5UZzVJREF1TVRneE1UZzBJREF1TWpnd09UZzVRekF1TVRrME5URTRJREF1TXpnNU1qVTJJREF1TWpFd01qVXhJREF1TkRrM01qVTFJREF1TWpJME56ZzBJREF1TmpBMU16ZzRRekF1TWpNeE5EVXhJREF1TmpVME9EVTFJREF1TWpNNE1URTRJREF1TnpBME16SXhJREF1TWpRME56ZzBJREF1TnpVek56ZzRRekF1TWpRMU9EWWdNQzQzTmpNME1pQXdMakkwT1RRMklEQXVOemN5TlRrNElEQXVNalUxTWpFNUlEQXVOemd3TXprMFF6QXVNall3T1RjNElEQXVOemc0TVRrZ01DNHlOamcyT1RNZ01DNDNPVFF6TWpnZ01DNHlOemMxT0RRZ01DNDNPVGd4T0RoRE1DNHpNVGc1TVRnZ01DNDRNakExT0RnZ01DNHpOekF4TVRnZ01DNDRNalk1T0RnZ01DNDBNVFl5TlRFZ01DNDRNekV5TlRSRE1DNDBOemMxT0RNZ01DNDRNelkzT1RRZ01DNDFNemt6T0RJZ01DNDRNelF3TlRnZ01DNDFPVGs1T0RRZ01DNDRNak14TWpGRE1DNDJNemd6T0RRZ01DNDRNVFl3TlRRZ01DNDNNRGs0TlRFZ01DNDRNRFEwTlRRZ01DNDNNVFU1T0RRZ01DNDNOVFkwTlRSRE1DNDNNak0xT0RRZ01DNDJPVFk1T0RnZ01DNDNNekU1T0RRZ01DNDJNemMxTWpFZ01DNDNNems1T0RRZ01DNDFOemd4T0RoTU1DNDNOREk1TVRnZ01DNDFOakF3TlRWRE1DNDNOalEyTlRFZ01DNDFOalV5TlRVZ01DNDRNalkyTlRFZ01DNDFOell6TWpJZ01DNDRNVGt3TlRFZ01DNDFNelF4T0RoYVRUQXVORGd3TmpVeElEQXVNVGt6TXpnNVF6QXVOVFl3TmpVeElEQXVNVGt6TXpnNUlEQXVOalV5TWpVeElEQXVNakF5TkRVMklEQXVOekl6T1RnMElEQXVNalF4T1RJelF6QXVOek0xTURVeElEQXVNalE0TURVMklEQXVOell3TnpnMElEQXVNall4TnpnNUlEQXVOelV6TURVeElEQXVNamM0TURVMlF6QXVOelExTXpFNElEQXVNamswTXpJeklEQXVOekl4TXpFNElEQXVNekF5TkRVMklEQXVOekEyTmpVeElEQXVNekE0TXpJeVF6QXVOamcxTnpBNElEQXVNekUyTURVNUlEQXVOalkwTVRjZ01DNHpNakl3TnpnZ01DNDJOREl5TlRFZ01DNHpNall6TWpKRE1DNDFORGN3TnpRZ01DNHpORFV4TnpZZ01DNDBORGt6TWprZ01DNHpORGN5TURjZ01DNHpOVE0wTlRFZ01DNHpNekl6TWpKRE1DNHpNVEF4TlRnZ01DNHpNamM0TlRnZ01DNHlOamd3TkRRZ01DNHpNVFUxTWpJZ01DNHlNamt4T0RRZ01DNHlPVFU1TWpORE1DNHlNVGsxT0RRZ01DNHlPVEEwTlRZZ01DNHlNRE0zTVRnZ01DNHlPREExT0RrZ01DNHlNRGd4TVRnZ01DNHlOamMxTWpORE1DNHlNVEUyTURNZ01DNHlOakExTURJZ01DNHlNVGN3TnpRZ01DNHlOVFEyTmlBd0xqSXlNemcxTVNBd0xqSTFNRGN5TTBNd0xqSTFNekV6TnlBd0xqSXpNVGc0T1NBd0xqSTROVGN3TXlBd0xqSXhPRGN5TnlBd0xqTXhPVGcxTVNBd0xqSXhNVGt5TTBNd0xqTTNNalV3TnlBd0xqRTVPVEk0TWlBd0xqUXlOalVnTUM0eE9UTXdOVGtnTUM0ME9EQTJOVEVnTUM0eE9UTXpPRGxXTUM0eE9UTXpPRGxhVFRBdU5qZzVOekU0SURBdU56VTFNemc0UXpBdU5qZzNOekU0SURBdU56Y3dPVGc0SURBdU5qWXhPVGcwSURBdU56YzROekl4SURBdU5qUTVOekU0SURBdU56Z3pNVEl4UXpBdU5qSTBNalV4SURBdU56a3hOalFnTUM0MU9UYzVPRElnTUM0M09UYzFNemNnTUM0MU56RXpNVGdnTUM0NE1EQTNNakZETUM0MU1USXhOVFlnTUM0NE1EZzFPRGNnTUM0ME5USXlNVE1nTUM0NE1EZzFPRGNnTUM0ek9UTXdOVEVnTUM0NE1EQTNNakZETUM0ek5UVTVPVFlnTUM0M09UYzRORFlnTUM0ek1UazRNVElnTUM0M09EZ3dNekVnTUM0eU9EWXpPRFFnTUM0M056RTNPRGhETUM0eU9ERTRNellnTUM0M05qazRNVEVnTUM0eU56YzVNeUF3TGpjMk5qWXdOU0F3TGpJM05URXdNeUF3TGpjMk1qVXpRekF1TWpjeU1qYzNJREF1TnpVNE5EVTJJREF1TWpjd05qUXpJREF1TnpVek5qY3pJREF1TWpjd016ZzBJREF1TnpRNE56SXhRekF1TWpVM01EVXhJREF1TmpReU9UZzRJREF1TWpReE9EVXhJREF1TlRNM01qVTFJREF1TWpJM05UZzBJREF1TkRNeE5USXlUREF1TWpFeU1URTRJREF1TXpFMk9EVTJRekF1TWpReU5ESTVJREF1TXpNek5UZzNJREF1TWpjMU16STVJREF1TXpRMU1USTBJREF1TXpBNU5EVXhJREF1TXpVd09UZzVRekF1TXpRMU9UazRJREF1TXpVNE5ESTNJREF1TXpnek1ESXlJREF1TXpZek1qZ3pJREF1TkRJd01qVXhJREF1TXpZMU5USXlRekF1TkRrek16RTFJREF1TXpjd056VTRJREF1TlRZMk56UTVJREF1TXpZMk5qZ3hJREF1TmpNNE56ZzBJREF1TXpVek16ZzVRekF1TmpjM01UWTNJREF1TXpRM09EWTRJREF1TnpFME1qUTJJREF1TXpNMU5EazBJREF1TnpRNE1qVXhJREF1TXpFMk9EVTJUREF1TnpFNU9UZzBJREF1TlRJMk1UZzRRekF1TmpVeU5ERTRJREF1TlRBek9USTRJREF1TlRnMk5EQTJJREF1TkRjM01qQXpJREF1TlRJeU16ZzBJREF1TkRRMk1UZzVRekF1TlRFNU5UYzFJREF1TkRRMU1URTNJREF1TlRFMk9EVTJJREF1TkRRek9ESTBJREF1TlRFME1qVXhJREF1TkRReU16SXlRekF1TlRFd05qVXhJREF1TkRNNU5qVTFJREF1TlRFeE5UZzBJREF1TkRRd09UZzVJREF1TlRBNU9EVXhJREF1TkRNMk9EVTFRekF1TlRBMk5URTRJREF1TkRJNU1qVTFJREF1TlRBMU56RTRJREF1TkRJek5USXlJREF1TkRrNE5qVXhJREF1TkRFM01qVTFRekF1TkRrME9ETTJJREF1TkRFME1pQXdMalE1TURNek1pQXdMalF4TWpFeU15QXdMalE0TlRVek1TQXdMalF4TVRJd05VTXdMalE0TURjeklEQXVOREV3TWpnM0lEQXVORGMxTnpjNElEQXVOREV3TlRVMklEQXVORGN4TVRBMUlEQXVOREV4T1RnNFF6QXVORFkyTkRNeElEQXVOREV6TkRJeElEQXVORFl5TVRjNUlEQXVOREUxT1RjMElEQXVORFU0TnpFM0lEQXVOREU1TkRJMFF6QXVORFUxTWpVMklEQXVOREl5T0RjMUlEQXVORFV5TmprZ01DNDBNamN4TVRrZ01DNDBOVEV5TkRJZ01DNDBNekUzT0RoRE1DNDBORGszT1RVZ01DNDBNelkwTlRjZ01DNDBORGsxTVNBd0xqUTBNVFF3T0NBd0xqUTFNRFF4TXlBd0xqUTBOakl4TWtNd0xqUTFNVE14TmlBd0xqUTFNVEF4TmlBd0xqUTFNek0zT1NBd0xqUTFOVFV5TmlBd0xqUTFOalF5TWlBd0xqUTFPVE0xTVVNd0xqUTFPVFEyTmlBd0xqUTJNekUzTlNBd0xqUTJNek01T0NBd0xqUTJOakU1T1NBd0xqUTJOemczTmlBd0xqUTJPREUxTjBNd0xqUTNNak0xTkNBd0xqUTNNREV4TmlBd0xqUTNOekkwTXlBd0xqUTNNRGsxSURBdU5EZ3lNVEU0SURBdU5EY3dOVGc1UXpBdU5EZzJOekUwSURBdU5EWTVPREkySURBdU5Ea3hNVGswSURBdU5EWTRORGd5SURBdU5EazFORFV4SURBdU5EWTJOVGc1UXpBdU5UQXdOalV4SURBdU5EWTBPVGc1SURBdU5UQXdOalV4SURBdU5EWTFNalUxSURBdU5UQTJNVEU0SURBdU5EWTNOemc1UXpBdU5UY3dPVFl5SURBdU5EazVOREE0SURBdU5qTTNOelkySURBdU5USTJPRFF5SURBdU56QTJNVEU0SURBdU5UUTVPVEl5UXpBdU56RTJNemcwSURBdU5UVXpNalUxSURBdU56RTJNalV4SURBdU5UUTVPVEl5SURBdU56RTJNalV4SURBdU5UVTRORFUxUXpBdU56RTFPREU0SURBdU5UWTBPVFEzSURBdU56RTBPVGN5SURBdU5UY3hOREEwSURBdU56RXpOekU0SURBdU5UYzNOemc0VERBdU56QTFNVGcwSURBdU5qUXhNemc0VERBdU5qZzVOekU0SURBdU56VTFNemc0V2swd0xqUTRNems0TkNBd0xqUTBNREExTlVNd0xqUTRNems0TkNBd0xqUTBNelkxTlNBd0xqUTNPRGt4T0NBd0xqUTBNekkxTlNBd0xqUTNOelU0TkNBd0xqUTBNRGs0T1VNd0xqUTNOakkxTVNBd0xqUXpPRGN5TWlBd0xqUTRNems0TkNBd0xqUXpORGs0T1NBd0xqUTRNems0TkNBd0xqUTBNREExTlZwTk1DNDNORFkyTlRFZ01DNDFNek16T0RoTU1DNDNOVEEyTlRFZ01DNDFNRE01TWpKRE1DNDNOak01T0RRZ01DNDFNVEUxTWpJZ01DNDNPRFkyTlRFZ01DNDFNakk1T0RnZ01DNDNPVEkyTlRFZ01DNDFNemd4T0RoRE1DNDNOemsxT0RRZ01DNDFORE0xTWpJZ01DNDNOVGc1TVRnZ01DNDFNelkwTlRVZ01DNDNORFkyTlRFZ01DNDFNek16T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTJJaUI0TWowaU1TNHlNRGN3TmlJZ2VUSTlJaTB3TGpJd056QTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpGQ05qWXdSaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTmtOQlJUTkZJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXdMams1T1RrNU5TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9ZnJvbnQgZW5kIGZpbGVzO2lyLnJlZj04YmE3ODNhMC00YmRmLTQ5MmItODU2YS0yOTU5OTU1NWFhMTg7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjM4IiB5PSIyMTQiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NSIgdmFsdWU9ImZyb250IGVuZCBmaWxlcyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNTEiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2MCIgdmFsdWU9IldlYiBVSSAtJmd0OyBXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC4wMjg7ZW50cnlZPTAuMzY3O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9ODA5NjBkZjEtMjkzMS00MjU0LTgwNjYtY2MyYTJjMzEyYjhhO2lyLnRhZ3M9UGF5bWVudHMsT3JkZXJzLGxvZ2luLFJlZ2lzdGVyO2lyLmFzc2V0cz1QZXJzb25hbGx5IElkZW50aWZpYWJsZSBJbmZvcm1hdGlvbixDdXN0b21lciBEYXRhLENyZWRpdCBDYXJkIERhdGE7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDciIHRhcmdldD0iNTAiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSB4PSIwLjM0MzkiIHk9IjM1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCBhcz0ib2Zmc2V0Ii8+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iLTI0IiB5PSIxMjMiLz4KICAgICAgICA8L0FycmF5PgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjYxIiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgV2ViIFVJIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTI0ZTQzMWQzLWRjZmYtNDQ0Ni04MTIzLWE5ZTVjZDY2NTVhZTtpci50YWdzPWZyb250IGVuZCBmaWxlczsiIHBhcmVudD0iMSIgc291cmNlPSI1MCIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogIDwvcm9vdD4KPC9teEdyYXBoTW9kZWw+Cg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
-    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
-  </trustZones>
-  <questions/>
-  <assets>
-    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
-      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
-    </asset>
-    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
-      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
-    </asset>
-  </assets>
-  <settings/>
-  <dataflows>
-    <dataflow name="AWS RDS (Relational Database Service) -&gt; Web Application - Server side" ref="0fe40212-1090-4f09-8a76-20cf55fc63be" source="359eac88-b8b9-4af4-a01a-5291c0ecf82d" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web UI -&gt; Browser" ref="19d3cc53-7985-422c-9c66-a7d5be0ff3ea" source="d68365c1-2067-4110-917c-0443ea467645" target="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4">
-      <assets/>
-      <tags>
-        <tag tag="response"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; Web UI" ref="24e431d3-dcff-4446-8123-a9e5cd6655ae" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="d68365c1-2067-4110-917c-0443ea467645">
-      <assets/>
-      <tags>
-        <tag tag="front end files"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; AWS S3 (Simple Storage Service)" ref="263dda87-b04b-4f29-8872-f65d8894b53a" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7">
-      <assets/>
-      <tags>
-        <tag tag="query front end files"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; AWS RDS (Relational Database Service)" ref="26a4bf0d-3dd8-4de3-bc07-7e8711b70bee" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="359eac88-b8b9-4af4-a01a-5291c0ecf82d">
-      <assets/>
-      <tags>
-        <tag tag="order status"/>
-        <tag tag="response"/>
-      </tags>
-    </dataflow>
-    <dataflow name="AWS S3 (Simple Storage Service) -&gt; Web Application - Server side" ref="2e9dbd5f-e9a7-4444-8685-be9ddbcb1b85" source="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Web Application - Server side -&gt; MongoDB NoSQL" ref="7018c0aa-8953-4a24-84df-1019f8948c04" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="0dabda18-f39e-4929-96e0-83f231b84abe">
-      <assets>
-        <asset name="Credit Card Data"/>
-      </assets>
-      <tags>
-        <tag tag="Payments"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Browser -&gt; Web UI" ref="74a503a9-425b-4934-90bd-1b42a04f735f" source="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4" target="d68365c1-2067-4110-917c-0443ea467645">
-      <assets>
-        <asset name="Customer Data"/>
-      </assets>
-      <tags>
-        <tag tag="login"/>
-        <tag tag="Register"/>
-      </tags>
-    </dataflow>
-    <dataflow name="MongoDB NoSQL -&gt; Web Application - Server side" ref="74e29dbe-cbac-4ec0-b8ee-d7e8c9885130" source="0dabda18-f39e-4929-96e0-83f231b84abe" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
-      <assets/>
-      <tags>
-        <tag tag="payment response"/>
-        <tag tag="query results"/>
-        <tag tag="response"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Web UI -&gt; Web Application - Server side" ref="80960df1-2931-4254-8066-cc2a2c312b8a" source="d68365c1-2067-4110-917c-0443ea467645" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
-      <assets>
-        <asset name="Credit Card Data"/>
-        <asset name="Customer Data"/>
-        <asset name="Personally Identifiable Information"/>
-      </assets>
-      <tags>
-        <tag tag="login"/>
-        <tag tag="Orders"/>
-        <tag tag="Payments"/>
-        <tag tag="Register"/>
-      </tags>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="3546f256-0749-4868-ac0b-df22007600aa" diagramComponentId="f5e37b56-88ff-4f94-970c-df80ae57d0fc" ref="d68365c1-2067-4110-917c-0443ea467645" name="Web UI" desc="" library="" parentComponentRef="" componentDefinitionRef="web-ui">
-      <tags/>
-      <questions>
-        <question ref="authentication.browser.login.yes" answer="true" manuallyModified="false"/>
-        <question ref="authn.browser.sf" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="jquery" answer="true" manuallyModified="false"/>
-        <question ref="tp.content" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-942-CORS_PERMISSIVE" name="CORS Access-Control-Allow-Origin policy is set to *" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses a cross-domain policy file that includes domains that should not be trusted.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A cross-domain policy file ("crossdomain.xml" in Flash and "clientaccesspolicy.xml" in Silverlight) defines a whitelist of domains to which a server is allowed to make cross-domain requests. When making a cross-domain request, the Flash or Silverlight client will first look for the policy file on the target server. If it is found, and the domain hosting the application is explicitly allowed to make requests, the request is made.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if a cross-domain policy file includes domains that should not be trusted, such as when using wildcards, then the application could be attacked by these untrusted domains. An overly permissive policy file allows many of the same types of attacks seen in Cross-Site Scripting (CWE-79). Once a user has executed a malicious Flash or Silverlight application, they are vulnerable to a variety of attacks. The attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker could also potentially send malicious requests to a website on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. In many of these cases, the attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-942: Overly Permissive Cross-domain Whitelist" url="https://cwe.mitre.org/data/definitions/942.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.844">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.809">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-233" name="Improper Handling of Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.511">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software includes web functionality (such as a web widget)
-                        from another domain, which causes it to operate within the domain of the
-                        software, potentially granting total access and control of the software to the
-                        untrusted source.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-525" name="Information Exposure Through Browser Caching" state="0" impact="100" issueId="" issueLink="">
-          <desc>For each web page, the application should have an appropriate caching policy specifying the
-                        extent to which the page and its form fields should be cached.
-                        &lt;br /&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-525: Information Exposure Through Browser Caching" url="https://cwe.mitre.org/data/definitions/525.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores sensitive information without properly limiting read or write access by
-                        unauthorized actors.
-                        If read access is not properly restricted, then attackers can steal the sensitive information.
-                        If write access is not properly restricted, then attackers can modify and possibly delete the
-                        data, causing incorrect results and possibly a denial of service.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.276">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-613" name="Insufficient Session Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.213">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-613: Insufficient Session Expiration" url="https://cwe.mitre.org/data/definitions/613.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.509">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.963">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM" name="No consent mechanism (conform GDPR &amp; E-privacy Regulation)" state="0" impact="100" issueId="" issueLink="">
-          <desc>No consent mechanisms (or a consent mechanism that does not comply with the GDPR and E-privacy legislation consent requirements) so the organization is unable prove to data protection authorities that the processing is legitimate/legal.
-          </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY" name="No export functionality" state="0" impact="100" issueId="" issueLink="">
-          <desc>No exportability functionality (for users or admins) which would allow the user to (directly or indirectly via an admin) export his personal data in a clear, readable format and transport it to another data controller. </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.463">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
-          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
-
-If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.810">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-598" name="The application sends sensitive information using the URL query string" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application uses the GET method to process requests that contain sensitive
-                        information, which can expose that information through the browser's history, Referers, web
-                        logs, and other sources.
-                        &lt;br /&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-598: Information Exposure Through Query Strings in GET Request" url="https://cwe.mitre.org/data/definitions/598.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.844">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" name="Create a consent mechanism" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement a consent mechanism which allows data subjects (persons of whom personal data is processed) to give their consent for certain processing activities. This is mainly used for cookies and secondary purposes such as direct marketing, newsletters, ...&lt;br/&gt; 
-          &lt;br/&gt;The consent mechanism often consists of a check box. These check boxes are required for every single secondary purpose (not allowed to implement one consent box for all purposes). The consent boxes should: &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;be inactive by default (the data subject should active the box)&lt;/li&gt;
-              &lt;li&gt;revocable (the data subject must be able to revoke the consent in a way that is as easy as it was to give consent, this can be done by implementing a platform on which the data subject can actively manage his/her consents) &lt;/li&gt;
-              &lt;li&gt;Traceable (a consent database is required to track when consent was given and revoked. This must include timestamps) &lt;/li&gt;
-              &lt;/ul&gt;
-              &lt;br /&gt;You must involve the DPO and/or legal department to decide on the legitimation that can be used.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.6" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.7" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify appropriate user personal data consent mechanisms are in place and are not pre-granted.&lt;/li&gt;
-                &lt;li&gt;Verify users can modify their data consent choices in a manner as easy as giving consent.&lt;/li&gt;
-                &lt;li&gt;Verify the above above user activities have been appropriately logged.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.368">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Deploy a robust server-side validation and authentication system" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When authentication is performed solely on the client-side, the user's credentials (e.g., username and password) are sent to the server for verification. However, an attacker can intercept and modify these credentials before they are sent to the server, allowing them to gain unauthorized access to the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Furthermore, client-side authentication does not provide any protection against attacks that target the server-side of the application. For example, an attacker could exploit a vulnerability in the server-side code to gain access to sensitive data or functionality without needing to authenticate at all.&lt;/p&gt;&lt;p&gt;All data on the client-side must be considered tainted. As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.714">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="not-store-sensitive-data-client-side" name="Do not store sensitive data on the client-side and remove sensitive authentication data" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Browsers and extensions provide a number of local storage options to persist data during HTTP interactions, including (but not limited to) Cookies, HTML5 local storage, session storage, IndexedDB, Flash cookies, and Silverlight isolated storage. These storage options may all be accessed by subsequent users of the browser or computer, and due to this some have experienced unauthorized and/or remote access to their contents. It is important that sensitive, private, and otherwise restricted data is handled with care on the client-side, and is not stored in insecure locations which may expose it to attack.&lt;/p&gt;&lt;p&gt;Sensitive data should not be persistently stored on the client-side due to the risk of exposure. However, during normal application operation, authenticated and other sensitive data is passed, stored in transient form, and displayed to users. It is important that any such temporary storage is purged in a timely manner and actively at the end of a user session.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do not store sensitive data in any kind of persistent, client-side storage.&lt;/li&gt;&lt;li&gt;Review any application or browser layer caching or temporary storage to ensure it doesn't expose data.&lt;/li&gt;&lt;li&gt;Sensitive data (including any authenticated content) stored in client-side objects such as the browser DOM should be cleared and removed actively at the end of user session (e.g. using the logout function), and where possible cleared through hard termination of the browser (e.g. closing the window or tab without using the proper application function).&lt;/li&gt;&lt;li&gt;Ensure any storage used during application interaction is temporary, and automatically cleared by the browser.&lt;/li&gt;&lt;li&gt;Where possible, set expiration times on client-side data to prevent accidental or malicious storage or disclosure.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify application functionality where sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application.&lt;/li&gt;&lt;li&gt;Ensure that authentication data is removed after the session termination, to test it, use the following steps:&lt;ul&gt;&lt;li&gt;Access the application as an authenticated user.&lt;/li&gt;&lt;li&gt;Manually or programmatically browse the site and use authenticated functionality&lt;/li&gt;&lt;li&gt;In particular, identify application functionality in which sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application. For example, review the HTML5 objects localStorage and sessionStorage for any sensitive data which is saved and not deleted after the logout&lt;/li&gt;&lt;li&gt;Alternatively, a Javascript console can be used with the command: &lt;i&gt;sessionStorage//Storage {length: 0}localStorage//Storage {length: 0}&lt;/i&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.675">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
-                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
-                            within the application.&lt;/li&gt;
-                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
-                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
-                            or PUT request).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.330">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Review periodically all assets which are accessed by the application and ensure that these
-                        assets are hosted by the application. If this is not the case and there are assets in external
-                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
-                        from external providers or CDNs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
-          </references>
-          <standards>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all assets are hosted by the application, and not by external providers.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.047">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" name="Implement a method to remove or export user data on demand" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data gathered from a user should be exportable. This does not include derived fields that were created by the organization, such as customer segmentation fields.&amp;nbsp;&lt;br&gt;&lt;br&gt;Provide or develop the means to facilitate data portability requests, such as download tools or Application Programming Interfaces (API).&amp;nbsp;&lt;br&gt;&lt;br&gt;Guarantees should be in place that personal data is transmitted in a structured, commonly used and machine-readable format, and ensure the interoperability of the data format, provided in the exercise of a data portability request.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="A Complete Guide to GDPR, CCPA and International Privacy Laws" url="https://secureprivacy.ai/complete-guide-to-international-data-privacy-laws/"/>
-          </references>
-          <standards>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                        &lt;ol&gt;
-                        &lt;li&gt;Verify users have the functionality to request personal data transfer and/or download their own data.&lt;/li&gt;
-                        &lt;li&gt;Verify data is in a form acceptable to the Data Protection Practitioner.&lt;/li&gt;
-                        &lt;/ol&gt;
-                        &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.139">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="minimise-parameters-request" name="Minimize the number of parameters in a request" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP requests should contain only the necessary parameters to perform the action (such as hidden fields, Ajax variables, cookies and header values). And the response only return the required information. If unnecessary information is included in the HTTP request, the attack surface is enlarged unnecessarily.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify all requests have only the necessary parameters needed to work correctly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Overwrite memory with zeros or random data before release.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
-          </references>
-          <standards>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
-                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
-                            soon as they are not needed anymore.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.714">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.370">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-942-CORS" name="Restrict Cross Domain Origin policy through HTTP headers" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        If an overly permissive policy is specified then an attacker may be able to execute malicious
-                        code hosted on a third party site in the victim's browser under the security trust of the
-                        legitimate application. To prevent this:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Set the Access-Control-Allow-Origin header to only permit explicitly required trusted
-                        domains.&lt;/li&gt;
-                        &lt;li&gt;This set should be as small as possible, and follow the 'least privilege' paradigm.&lt;/li&gt;
-                        &lt;li&gt;Do not use untrusted or tainted user-data from untrusted domains in CORS responses
-                        without proper validation and sanitization.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;Access-Control-Allow-Origin:
-                            valid_host_name&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's end-points.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite, Fiddler)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Modify the Host: header in transit&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.331">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.922">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.370">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
-                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
-                        directives to control what data may be cached, where, and for how long. It is important to specify
-                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
-                        of authenticated and otherwise restricted access data, either in the users' browser or other
-                        devices.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
-                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
-                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.331">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
-&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.176">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-204-AUTOCOMPLETE" name="Attackers with access to a victim's client could read locally stored credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If the application accepts sensitive data through forms, then browsers could cache that data and play it if an attacker views the same form in the same browser. This requires the attacker to have access to the victim's browser.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-525">
-                  <countermeasures>
-                    <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-922">
-                  <countermeasures>
-                    <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
-                <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-ILLEGAL-PROCESSING-PERSONAL-DATA" name="Illegal processing of personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Processing personal data without legal grounds which makes it possible for data subjects to file a complaint at local Data Protection Authority which might lead to administrative fines.
-              </desc>
-              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="WEB-QUERY-PARAM" name="Sensitive data is compromised through query parameters in the URL" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Sensitive data directly inserted as a parameters in the URL string could all too easily leak that data inside logs, browser history, etc.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Additionally this information could potentially be leveraged by an attacker to gain access to the entire system or user data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-598">
-                  <countermeasures>
-                    <countermeasure ref="CWE-598" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-598" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If the component handles credentials and it does not do a proper clean-up of them in
-                                memory, they could be accessed by an attacker by inspecting the memory or reading
-                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-255">
-                  <countermeasures>
-                    <countermeasure ref="CWE-226" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-226" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-602">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Web applications typically make extensive use of 3rd party web resources such as
-                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
-                                repositories, or even Content Delivery Networks that host these libraries, then they
-                                could gain access to applications that use this content.
-                                &lt;div&gt;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-830">
-                  <countermeasures>
-                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-233">
-                  <countermeasures>
-                    <countermeasure ref="minimise-parameters-request" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="minimise-parameters-request" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ASVS-2014-3.3" name="Attackers could gain access to an open session, if they have access to a user's browser" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If a user steps away from their browser for a few minutes and there is an
-                                opportunity for
-                                an attacker to access the browser, then they could gain access to the user's logged
-                                in
-                                session and perform operations on their behalf.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="10"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-613">
-                  <countermeasures>
-                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-942-CORS_PERMISSIVE" name="Attackers could gain access to sensitive data through a too permissive CORS policy" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An overly permissive policy file may allow many types of attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Once a user has visited a malicious site, they are vulnerable to a variety of attacks. For example, the attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker may be able to send malicious requests to a web site on behalf of the victim, which could be especially dangerous if the victim has administrator privileges to manage that site.&lt;/p&gt;&lt;p&gt;In many cases, these types of attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-942-CORS_PERMISSIVE">
-                  <countermeasures>
-                    <countermeasure ref="CWE-942-CORS" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-942-CORS" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-SUBJECT-RIGTHS" name="Subjects cannot exercise their rights over their personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Data subject cannot exercise their rights which makes it possible for them to file a complaint at the local Data Protection Authority which might lead to administrative fines.&amp;nbsp;&lt;br&gt;&lt;br&gt;Data subject = person of whom personal data is processed&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY">
-                  <countermeasures>
-                    <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="fb13b9fa-08fa-4631-b65d-551d1c7a34dd" diagramComponentId="9b15e125-37ae-44ef-a803-6c6b38af946e" ref="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="internet"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.880">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.175">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.431">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.432">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.948">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.881">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.881">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.882">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.256">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.628">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.630">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.259">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.899">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.259">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
-&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.630">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.038">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="5b323e5c-94ca-4fc3-9c69-bc201d27a7dd" diagramComponentId="421637d3-aa3c-4062-8bc2-d2c9a15c40dd" ref="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" name="Web Application - Server side" desc="" library="" parentComponentRef="" componentDefinitionRef="web-application-server-side">
-      <tags/>
-      <questions>
-        <question ref="emailExistingPwd" answer="true" manuallyModified="false"/>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
-        <question ref="server.authentication.building.yes" answer="true" manuallyModified="false"/>
-        <question ref="server.javascript" answer="true" manuallyModified="false"/>
-        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.343">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-178-AUTH" name="Application does not distinguish between upper and lower case passwords" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The complexity of guessing a password is directly related to the character set being used. Not differentiating between upper and lower case passwords dramatically reduces this complexity.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319-PWD" name="Authentication credentials transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many communication channels can be surreptitiously observed ("sniffed") by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.380">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
-                        data transmission. For example, network traffic can often be sniffed by any attacker who has
-                        access to a network interface. This significantly lowers the difficulty of exploitation by
-                        attackers.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.837">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.343">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.344">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.880">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
-                        proves that the claim is correct.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.345">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.696">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.881">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.522">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.698">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.702">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.700">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.460">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.401">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
-          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.401">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.226">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.344">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.958">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-916" name="Password hashes can be reverted over a reasonable period of time" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort to make password cracking attacks infeasible or expensive. Many password storage mechanisms compute a hash and store the hash, instead of storing the original password in plaintext. In this design, authentication involves accepting an incoming password, computing its hash, and comparing it to the stored hash.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Many hash algorithms are designed to execute quickly with minimal overhead, even cryptographic hashes. However, this efficiency is a problem for password storage, because it can reduce an attacker's workload for brute-force password cracking. If an attacker can obtain the hashes through some other method (such as SQL injection on a database that stores hashes), then the attacker can store the hashes offline and use various techniques to crack the passwords by computing hashes efficiently. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing (such as cloud computing) and GPU, ASIC, or FPGA hardware. In such a scenario, an efficient hash algorithm helps the attacker. There are several properties of a hash scheme that are relevant to its strength against an offline, massively-parallel attack:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The amount of CPU time required to compute the hash (&amp;quot;stretching&amp;quot;)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The amount of memory required to compute the hash (&amp;quot;memory-hard&amp;quot; operations)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Including a random value, along with the password, as input to the hash computation (&amp;quot;salting&amp;quot;)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Given a hash, there is no known way of determining a password that produces this hash value, other than by guessing possible passwords (&amp;quot;one-way&amp;quot; hashing)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Relative to the number of all possible hashes that can be generated by the scheme, there is a low likelihood of producing the same hash for multiple different inputs (&amp;quot;collision resistance&amp;quot;)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Note that the security requirements for the software may vary depending on the environment and the value of the passwords. Different schemes might not provide all of these properties, yet may still provide sufficient security for the environment. Conversely, a solution might be very strong in preserving one property, which still being very weak for an attack against another property, or it might not be able to significantly reduce the efficiency of a massively-parallel attack. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.820">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-916" url="https://cwe.mitre.org/data/definitions/916.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
-          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.771">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
-
-An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.823">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection
-                        mechanism that provides sufficient defense against directed attacks against the
-                        product.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.027">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
-          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-204" name="Response Discrepancy Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software provides different responses to incoming requests in a way that allows an actor
-                        to determine system state information that is outside of that actor's control sphere.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;This issue frequently occurs during authentication, where a difference in
-                        failed-login messages could allow an attacker to determine if the username is valid or not.
-                        These exposures can be inadvertent (bug) or intentional (design).
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.823">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-204: Response Discrepancy Information Exposure" url="https://cwe.mitre.org/data/definitions/204.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.882">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-307" name="The application does not implement anti-automation mechanisms to prevent automated long-time sustained probes" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
-
-This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, to compromise program logic (such as limiting humans to a single vote), or for other purposes. For example, an authentication routine might not limit the number of times an attacker can guess a password, or a website might conduct a poll but only expect humans to vote a maximum of once a day.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.821">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
-          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
-
-If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.821">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.157">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CS-EMAIL-COMP" name="The application uses a weak credential recovery method for email access" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Using weak credential recovery methods (like sending an SMS or transmitting the new password over insecure channels, more generally), may be leveraged to compromise access to an email account.&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.379">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.342">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
-          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
-&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
-&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
-&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
- &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
-&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
-&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
-              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.698">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-620" name="Unverified Password Change" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;When setting a new password for a user, the product does not require knowledge of the original password, or use of another form of authentication.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.400">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-654" name="Authenticate users (multi - or two-factor - authentication [2FA])" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For more sensitive applications hosting data or functionality requiring greater assurance over the identification of users, a multi - or two-factor - authentication process is recommended. Together with asserting their identity and a password/phrase/PIN (something you know), such systems require additional factors, such as biometric validation (something you are), user-initiated action such as a button press on a FIDO hardware key or a token (something you have).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement multi-factor authentication for applications providing access to sensitive data or functionality, and for highly privileged user access (e.g. administrators).&lt;/li&gt;&lt;li&gt;This should leverage something such as a soft or hard-token verification in addition to the secret password/pass-phrase for example.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-          </references>
-          <standards>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5.2.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.5" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.9" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.1.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check for authentication functions of the component.&lt;/li&gt;&lt;li&gt;Verify at least a combination of the following factors is used within the authentication process.&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Something that you are: mainly biometric characteristics of yourself such as fingerprint, facial recognition, iris recognition, etc.)&lt;/li&gt;&lt;li&gt;Something that you know: a PIN, password, pass phrase, etc.&lt;/li&gt;&lt;li&gt;Something that you have: a hardware token, a card, a dongle, a mobile phone, etc.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.501">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.217">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
-            <reference name="OWASP Security by Design Principles: Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
-          </references>
-          <standards>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Deploy a robust server-side validation and authentication system" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;When authentication is performed solely on the client-side, the user's credentials (e.g., username and password) are sent to the server for verification. However, an attacker can intercept and modify these credentials before they are sent to the server, allowing them to gain unauthorized access to the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Furthermore, client-side authentication does not provide any protection against attacks that target the server-side of the application. For example, an attacker could exploit a vulnerability in the server-side code to gain access to sensitive data or functionality without needing to authenticate at all.&lt;/p&gt;&lt;p&gt;All data on the client-side must be considered tainted. As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.339">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.098">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.102">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.129">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.218">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-2.17" name="Do not transmit password in email or other unencrypted channels" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Data passed between the user and application without appropriate encryption, in particular in
-                        emails, may be intercepted or monitored by malicious parties.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Do not send plaintext passwords in emails or other unencrypted transport (e.g. a web
-                        page server over HTTP).&lt;/li&gt;
-                        &lt;li&gt;Password recovery processes should not send either the old or a new password to users
-                        (the former is particular bad due to the penchant for people to reuse the same password across
-                        multiple systems or applications).&lt;/li&gt;
-                        &lt;li&gt;If the recovery process is built on sending a temporary random password to users, the
-                        risk can be partly mitigated (but not eliminated) by:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Ensuring the random password is single use (one time password), and forcing the user
-                        to change the password on first login.&lt;/li&gt;
-                        &lt;li&gt;Making the password valid only for a short-time (time limited).&lt;/li&gt;
-                        &lt;li&gt;Requiring a further validation or identification step when the time limited one time
-                        password is used.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Review all password-provisioning mechanisms that are implemented by the
-                            application. &lt;br /&gt;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.872">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.130">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.724">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-204-USERNAME-LOGIN" name="Ensure application errors do not reveal account status" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Error messages can reveal information of use to an attacker, particularly in the cases relating to login, registration and recovery processes.&amp;nbsp; Explicit errors stating accounts are valid or not, or whether they are locked out, are useful to an attacker in enumerating usernames for subsequent attacks. Even small variations in errors returned to the user can be used to infer how the application operates, or enforces security controls.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To prevent a malicious user using error conditions to determine how the application functions in order to subvert it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Trap and log all known error conditions on the server-side&lt;/li&gt;&lt;li&gt;Create a generic trap for unexpected errors&lt;/li&gt;&lt;li&gt;E.g. Error messages during the login process should not disclose which authentication token was incorrect, instead a generic message simply stating that authentication failed should be displayed.&lt;/li&gt;&lt;li&gt;Ensure the error message returned to the user is generic, or contains only an obfuscated reference that can be correlated with the logged errors on the server-side. &amp;nbsp;In the case of applications delivered over HTTP, the HTTP header should also be generic to prevent enumeration (e.g. all error pages should produce a consistent HTTP 500 error)&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify error conditions within the application (i.e. Unexpected data types, unexpected data length, requests from an unexpected state, etc.).&lt;/li&gt;&lt;li&gt;And verify the responses do not reveal any information on the internals of the applications (i.e. they do not expose a full stack trace with all the methods called or the sql string sent to a database, etc.).&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.497">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
-                            happen.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
-                            behavior on the system.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
-                        practice and required minimum key lengths depend on the scenarios listed below.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
-            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
-            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
-            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
-                            &lt;br /&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
-                            bits&lt;/li&gt;
-                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
-                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
-                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
-                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
-                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
-                            &lt;/ul&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.176">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.101">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.682">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
-&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
-&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
-  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
-  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
-  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
- &lt;/ul&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
-            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
-            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-            <reference name="OWASP Top 10 Proactive Controls C8: Protect Data Everywhere" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
-          </references>
-          <standards>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
-&lt;/ul&gt;
-&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
- &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
- &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;span&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
-              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;ul&gt;
- &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
- &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.2 Testing for default credentials (OTG-AUTHN-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.5 Test remember password functionality (OTG-AUTHN-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
-&lt;/div&gt;
-&lt;div&gt;
-  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;br /&gt;
- &lt;/div&gt;
- &lt;div&gt;
-   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
- &lt;/div&gt;
- &lt;div&gt;
-   Options:
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
- &lt;/div&gt;
- &lt;div&gt;
-   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
- &lt;/div&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-923-SEGREG" name="Ensure the segregation of components of different trust levels" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the segregation of components of different trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.340">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.093">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.101">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="password-reset-email-best-practices" name="Implement Password reset email design best practices" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Passwords should not be sent in plain text (for example in an email), as they may be intercepted or monitored.&lt;/li&gt;&lt;li&gt;The client-side and the server-side should communicate by a secured and independent channel.&lt;/li&gt;&lt;li&gt;The application should verify the user's identity, and leverage a time-limited (not longer than 10 minutes) one-time password token (TOTP) from the user.&lt;/li&gt;&lt;li&gt;Alternatively, the application could require the user enters a soft-token (e.g. Google authenticator), a mobile-push / SMS code, or previously established off-line recovery mechanism (for example a list of pre-defined recovery codes).&amp;nbsp;&lt;/li&gt;&lt;li&gt;It should be noted that use of a random value in an e-mail or SMS has known weaknesses, and should be considered a less secure option.&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through the use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;The application should then require they choose a new password or phrase in line with the chosen policy.&lt;/li&gt;&lt;li&gt;For change and reset password functionality it is recommended to keep a history of old passwords (salted hashes used). These can be leveraged to prevent password reuse, or an attacker alternating between a selection of passwords (Monday1, Tuesday2 etc.).&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.10" supportedStandardRef="nist-800-63"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
- &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Go through the password reset method implemented by the application.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
- &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Check if the current or new passwords are revealed or sent in plain text at any point.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
- &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Check that the application requires you to introduce the old password, a new password and the new password confirmation.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
-&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.873">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.177">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.132">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.132">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="password-change-facility" name="Offer a password change facility" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Users must retain control of their credentials in a single factor system, and to facilitate this they must have the ability to change their password. This is particularly important should the user determine their password has been compromised, potentially allowing a third party to access the system impersonating them. Furthermore, accountability is adversely affected where users cannot change their passwords, as they can plausibly claim that even though they knew their account credentials were compromised, there was no way for them to prevent unauthorized use of the account.&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Users should be allowed to change their passwords, ideally within the application&lt;/li&gt;
- &lt;li&gt;Password change should require re-authentication to prevent abuse of a compromised or unattended session. I.e. the user should be required to enter their existing password in order to change it.&lt;/li&gt;
- &lt;li&gt;After a successful password change, the application should terminate all other active sessions.&lt;/li&gt;
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-          </references>
-          <standards>
-            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check on the application if there is a password change feature.&lt;/li&gt;&lt;li&gt;Check the previous password is needed and is validated before doing the actual change.&lt;/li&gt;&lt;li&gt;Check all active sessions are terminated after changing the password.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.500">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.099">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Security is often compromised through default or predictable account credentials, such as
-                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
-                        common account names, and force users to choose unique strong passwords rather than using vendor
-                        defaults.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
-                        required&lt;/li&gt;
-                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
-                        be changed.&lt;/li&gt;
-                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
-                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords-with-ui" name="Require the use of strong passwords with UI" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Passwords used either as sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password complexity. This should include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt;&lt;li&gt;Use of pass-phrases using multiple words, achieving longer memorable passwords more resistant to attack.&lt;/li&gt;&lt;li&gt;Use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt;&lt;li&gt;Preventing or discouraging use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password length:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Password length considers the minimum and maximum length of characters comprising the password. For ease of changing this length, its implementation could be configurable using a properties file or xml configuration file.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Minimum length.&lt;/strong&gt;&lt;ul&gt;&lt;li&gt;Memory secrets should be at least 8 characters long.&lt;/li&gt;&lt;li&gt;Memory secrets generated automatically should be at least 6 numeric characters.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Maximum length.&amp;nbsp;&lt;/strong&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length.&amp;nbsp;Passwords with 64 characters or longer should be permitted.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password Complexity:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Passwords with consecutive multiple spaces should be coalesced and converted into only one space. After this modification, the password length should still be at least 12 characters long.&lt;/li&gt;&lt;li&gt;Unicode characters will be permitted in the password. A single Unicode code point is considered a character.&lt;/li&gt;&lt;li&gt;Reject those passwords commonly used and those leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords:&amp;nbsp;&lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt;&lt;li&gt;Plain text passwords must not be stored, to protect them against brute forcing if the database is compromised and screen reader support enabled.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;UI features:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Allow the "paste" functionality, browser password helpers, and external password managers.&lt;/li&gt;&lt;li&gt;Mask the entire password as typed, or show briefly the last typed character of the password on platforms that do no have this as native functionality.&lt;/li&gt;&lt;li&gt;Include a password strength meter in pages in which the password is created, to help users generate a stronger password.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password Topologies:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ban commonly used password topologies.&lt;/li&gt;&lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt;&lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Additional Information:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems truncate the password at a length shorter than the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt;&lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt;&lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="NIST 800-63: Memorised secrets" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-            <reference name="Owasp CheatSheetSeries: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify passwords comply with the company policy for strong passwords.&lt;/li&gt;&lt;li&gt;If there is no policy, check the strength against industry standards such as NIST or OWASP.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;An example of strong password policy (&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt;&lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt;&lt;li&gt;at least 1 digit (0-9)&lt;/li&gt;&lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as a special character too&lt;/li&gt;&lt;li&gt;at least 10 characters&lt;/li&gt;&lt;li&gt;at most 128 characters&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;no more than 2 identical characters in a row (e.g., 111 not allowed).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.500">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.158">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PWD-RECOVER-OTP" name="Send time expired one time password/token (TOTP) in email" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks. Resetting passwords over email presents a risk of monitoring and interception, these threats can in part by mitigated by the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create a unique token or password that compromises at least 128 bits of provably random data.&lt;/li&gt;&lt;li&gt;This token should be emailed to the registered email address of the user; for example, in&amp;nbsp;the form of a one time password, or a unique identifier in a URL.&lt;/li&gt;&lt;li&gt;The token should expire after a short period of time (long enough for the user to receive and process the email - 15 minutes at most and preferably less).&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;The password or token must be single use; the user must be required to choose a new password and the token should be immediately invalidated.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform the password reset process implemented by the component.&lt;/li&gt;&lt;li&gt;Check the recovery is done by using a one time token in an email.&lt;/li&gt;&lt;li&gt;For this one time token check it cannot be reused and it cannot be used after a short period of time.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.307">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
- &lt;/ul&gt;&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
-   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/span&gt; 
-&lt;span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.678">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-178-AUTH" name="The login function should distinguish between upper and lower case passwords" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Passwords used either as sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and use of strong passwords is critical. In addition to password quality criteria, it is important that the verification of passwords by the application does not reduce the character space, and therefore quality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The login function should distinguish between upper and lowercase passwords; for example PASSWORD should be considered different to password, Password, PASSword etc.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Reducing the character set by considering an uppercase or a lowercase as equivalent also reduces the Computational Complexity.&lt;/li&gt;&lt;li&gt;Reduction in character space reduces computational cost of brute-force or dictionary attacks against the credentials.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Create a user or if it is created change its password to "UPPERCASEPASSWORD".&lt;/li&gt;&lt;li&gt;Logout of the application.&lt;/li&gt;&lt;li&gt;Check if it is possible to log in again with this username and the password "uppercasepassword".&lt;/li&gt;&lt;li&gt;It should be denied.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-          </references>
-          <standards>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-recovery-token-reset-account" name="Use a secure recovery token to reset an account password (such as a TOTP)" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Having identified the user through secret questions/answers, the application should proceed with a secure reset process.&lt;/li&gt;&lt;li&gt;Passwords should not be sent in plain text (for example in an email), as they may be intercepted or monitored.&lt;/li&gt;&lt;li&gt;Instead, the application should verify the user's identity, and use a time-limited one-time password token (TOTP).&lt;/li&gt;&lt;li&gt;If a time-based multi factor OTP token is re-used during the validity period, it should be logged and rejected with secure notifications sent to the holder of the device.&lt;/li&gt;&lt;li&gt;Alternatively, the application could require the user enters a soft-token (e.g. Google authenticator), a mobile-push / SMS code, or previously established off-line recovery mechanism (for example a list of pre-defined recovery codes). It should be noted that use of a random value in an e-mail or SMS has known weaknesses, and should be considered a less secure option.&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through the use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;If any token OTP has been sent in cases of theft or other loss, the validity of the token must be immediately and effectively revoked across the logged-in sessions.&lt;/li&gt;&lt;li&gt;The application should then require they choose a new password or phrase in line with the chosen policy.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Navigate through the password recovery process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Check that a Time-Based One-Time Password token or a push message with a unique, one-use-only and valid for a given time (typically 1h) is used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Check if a Time-Based One-Time Password token is used more than once, it is logged and notified.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.308">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.102">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Encryption should fail closed so that data does not get stored in an unprotected state. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
-            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
-          </references>
-          <standards>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
-                            &lt;br /&gt;
-                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
-                            the following conditions must be met: &lt;/p&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
-                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
-                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
-                            (e.g. gathered by different sessions or manipulation of session state) share a common
-                            divisor in the length.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
- &lt;div&gt;
-   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CSD-DEF-PWD" name="Attackers gain access to the system using default passwords" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Default passwords are usually public or can be obtained from manuals or technical data sheets. An attacker may use them to gain access to a system or user data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-255">
-                  <countermeasures>
-                    <countermeasure ref="CWE-255" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-255" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-AUTH-HASH" name="Attackers gain access to user accounts by accessing the password database" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker with access to the plain, readable credential database would have access
-                                to the system as any of those users.&amp;nbsp;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-916">
-                  <countermeasures>
-                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-636">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.2" mitigation="25"/>
-                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
-                <countermeasure ref="CWE-603" mitigation="25"/>
-                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-367">
-                  <countermeasures>
-                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof a component from a different system or process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The vulnerability allows attackers to spoof a component from a different system or process, thereby gaining the same level of access as the intended endpoint. Spoofing refers to the act of falsifying or mimicking the identity of a legitimate user or system. This component can be also known as an endpoint. In IT, an endpoint is a remote computing device that communicates back and forth with a network to which it is connected, which should not be mistaken by an API endpoint, which is an URIs (Uniform Resource Identifiers) on an API that an application can access.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Attackers can use various techniques to spoof the identity of the intended endpoint, such as IP address spoofing or DNS spoofing. By spoofing the endpoint, attackers can trick the system into thinking that they have the same level of access as the intended endpoint. This vulnerability is a significant threat to the security of network-based communication systems. It can allow attackers to gain unauthorized access to sensitive data or systems, and even take control over the targeted device or network.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, an attacker could use this vulnerability to gain access to a corporate network or steal sensitive information transmitted between two endpoints.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-923">
-                  <countermeasures>
-                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319-AUTH">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-178-AUTH">
-                  <countermeasures>
-                    <countermeasure ref="CWE-178-AUTH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-620">
-                  <countermeasures>
-                    <countermeasure ref="password-change-facility" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-654">
-                  <countermeasures>
-                    <countermeasure ref="CWE-654" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-178-AUTH" mitigation="25"/>
-                <countermeasure ref="CWE-654" mitigation="25"/>
-                <countermeasure ref="password-change-facility" mitigation="25"/>
-                <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
-&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-523">
-                  <countermeasures>
-                    <countermeasure ref="CWE-603" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-603" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-112-USERNAME" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Attackers could perform a brute force attack against the login function by choosing a
-                                simple password that users are likely to use for the site, and that meets the site's
-                                password policy.
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
-                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
-                                through pure brute force means. &amp;nbsp;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                This type of attack cannot be defended against using an account lockout policy because
-                                each username is only attempted once.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-307">
-                  <countermeasures>
-                    <countermeasure ref="network-rate-limit" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="network-rate-limit" mitigation="50"/>
-                <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-204-USERNAME-LOGIN" name="Usernames could be enumerated through login responses" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Usernames could be enumerated through the login feature if it returns error messages that allow attackers to infer whether the username or password was incorrect.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;For example, consider the following behavior: An attacker attempts a username that existed on the system, but an incorrect password, and the system responds with the message: "Incorrect password". Then the attacker attempts a username that definitely does not exist in the system, and the system responds with the message: "Username not recognized".&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Then the attacker can use automated scripts and typical usernames to create a list of usernames registered in the system.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-204">
-                  <countermeasures>
-                    <countermeasure ref="CWE-204-USERNAME-LOGIN" mitigation="50"/>
-                    <countermeasure ref="error-handling-centralized" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-204-USERNAME-LOGIN" mitigation="50"/>
-                <countermeasure ref="error-handling-centralized" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="PASSWORD RESET" name="Password reset" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-633" name="An adversary exploits a weakness in authentication to create an access token to associate a process/thread" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="password-reset-email-best-practices" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="password-reset-email-best-practices" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-AUTH-PWD" name="Attackers gain access to the system by accessing current user's password" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If an attacker has access to the password exchange method when the user resets his
-                                password, he would have access to the system as this user.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-2.17" mitigation="50"/>
-                    <countermeasure ref="password-reset-email-best-practices" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-2.17" mitigation="50"/>
-                <countermeasure ref="password-reset-email-best-practices" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-158-PWD-IN-EMAIL" name="Password sent over email or SMS is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;If the user's password is sent to them in email then attackers could perform network sniffing attacks if they are on the same network as the victim, for example, on the same WiFi network. Attackers would then be able to access the users' account without the user's knowledge.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CS-EMAIL-COMP">
-                  <countermeasures>
-                    <countermeasure ref="secure-recovery-token-reset-account" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-319-PWD">
-                  <countermeasures>
-                    <countermeasure ref="PWD-RECOVER-OTP" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PWD-RECOVER-OTP" mitigation="50"/>
-                <countermeasure ref="secure-recovery-token-reset-account" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="SENSITIVE READ OR POST DATA" name="Sensitive Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CWE-256" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>A compromise of the storage system medium itself (device, server or database) could
-                                allow attackers full access to the data
-                                stored, including authentication credentials such as passwords.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-257">
-                  <countermeasures>
-                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-287">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                theft and then uses this key to forge signatures from the original signer to mislead a
-                                victim into performing actions that benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-320">
-                  <countermeasures>
-                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
-                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
-                                generation and then uses this key to forge signatures from the original signer to
-                                mislead a victim into performing actions which benefit the attacker.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-330">
-                  <countermeasures>
-                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-345">
-                  <countermeasures>
-                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-693">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-7.2" mitigation="25"/>
-                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
-                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
-                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-326">
-                  <countermeasures>
-                    <countermeasure ref="crypto-operations" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="crypto-operations" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="6f118fe6-16ab-4f20-9fa3-02963db2cd15" diagramComponentId="c512c7e1-8fac-441e-8507-18dc7409a63d" ref="359eac88-b8b9-4af4-a01a-5291c0ecf82d" name="AWS RDS (Relational Database Service)" desc="" library="" parentComponentRef="" componentDefinitionRef="rds">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Customer Data" accessType="10"/>
-        <asset name="Customer Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="database-publically-accesible" name="Database is publically accesible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Everyone can access the RDS database and obtain the data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.251">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
-          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.246">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="no-notification-incident" name="No notification when an incident occurs" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no notifications when a security incident occurs. Therefore, we do not know when an
-                        attacker gains access to our systems and/or security systems
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="no-access-control-onrds" name="Not access control on RDS databases" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no access control mechanisms on the RDS database resources and any user can gain access
-                        to them and exfiltrate the data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.247">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="NOT_BACKUP_POLICIES" name="Not backup retention policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no data backup retention policies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.249">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
-          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-RDS-02" name="Assign to IAM roles the permissions for RDS instances" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The following AWS managed policies, which you can attach to users in your account, are
-                        specific to Amazon RDS:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;AmazonRDSReadOnlyAccess:&lt;/b&gt; Grants read-only access to all Amazon RDS
-                        resources for the root AWS account.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;&lt;b&gt;AmazonRDSFullAccess:&lt;/b&gt; Grants full access to all Amazon RDS resources
-                        for the root AWS account.&lt;/li&gt;
-                        &lt;/ul&gt;You can also create custom IAM policies that allow users to access the required
-                        Amazon RDS API actions and resources. You can attach these custom policies to the IAM users or
-                        groups that require those permissions.
-                        &lt;br /&gt;
-                        &lt;br /&gt;The permissions above shall be assigned to roles or groups:
-                        &lt;br /&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;The roles or groups only do calls to the API to get information, the
-                        AmazonRDSReadOnlyAccess permission shall be assigned.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The roles or groups who are responsible of managing the RDS instances shall be
-                        assigned the AmazonRDSFullAccess permission.&lt;/li&gt;
-                        &lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
-                            &lt;li&gt;Review the IAM roles and groups.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check that all roles or groups have got the AmazonRDSReadOnlyAccess permission.&lt;/li&gt;
-                            &lt;li&gt;Check that only the appropriate personnel have got AmazonRDSFullAccess permissions
-                            to manage the RDS instances.&lt;/li&gt;
-                            &lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.103">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.34" name="Configure RDS database to leverage the Data Tier Security Group" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  There are 6 database engines available for customer to run their database workloads on: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
-  &lt;li&gt;MySQL&lt;/li&gt; 
-  &lt;li&gt;MariaDB&lt;/li&gt; 
-  &lt;li&gt;Oracle&lt;/li&gt; 
-  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL&lt;/li&gt; 
- &lt;/ul&gt; 
-  Customers can deploy RDS databases within a VPC through the configuration of: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
-  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
-  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
-  &lt;li&gt;Network access to the managed Data-Tier must be tightly controlled using Security Groups for RDS and non local accessibility of the DB instance.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation: &lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify each non-compliant DB instance, and configure it to use the Data Tier Security Group:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --vpc-security-group-ids &amp;lt;data_tier_security_group&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
-          </references>
-          <standards>
-            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check if your application DB instances are configured to use the Data Tier
-                            Security Group:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
-                            --query &amp;quot;DBInstances[*].{VpcSecurityGroups:VpcSecurityGroups,
-                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.30" name="Do not allow the RDS database to be publically accessible" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  There are 6 database engines available for customer to run their database workloads on: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
-  &lt;li&gt;MySQL&lt;/li&gt; 
-  &lt;li&gt;MariaDB&lt;/li&gt; 
-  &lt;li&gt;Oracle&lt;/li&gt; 
-  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL&lt;/li&gt; 
- &lt;/ul&gt;Customers can deploy RDS databases within a VPC through the configuration of: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
-  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
-  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify each publicly accessible DB instance, and make it private:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --no-publicly-accessible 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
-          </references>
-          <standards>
-            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.3.3" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="2.3.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="6.30" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check if your application DB instances are publicly available:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
-                            --query &amp;quot;DBInstances[*].{PubliclyAccessible:PubliclyAccessible,
-                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.6" name="Enable Auto Minor Version Upgrade on RDS" issueId="" issueLink="" platform="" cost="1" risk="75" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair.&lt;/p&gt; 
-&lt;p&gt;There are 6 database engines available for customers to run their database workloads on:&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
- &lt;li&gt;MySQL&lt;/li&gt; 
- &lt;li&gt;MariaDB&lt;/li&gt; 
- &lt;li&gt;Oracle&lt;/li&gt; 
- &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
- &lt;li&gt;PostgreSQL&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;If the database engine used by your application supports it, ensure that the RDS Instances have Auto Minor Version Upgrade Enabled.&lt;/p&gt; 
-&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt; 
-&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Modify each DB instance with auto-minor-version-upgrade set to False, and enable auto-minor-version-upgrade:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;p&gt;aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --auto-minor-version-upgrade&lt;/p&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
-          </references>
-          <standards>
-            <standard ref="2.3.2" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="2.3.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check if your application DB instances have Auto Minor Version Upgrade enabled:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
-                            --query &amp;quot;DBInstances[*].{AutoMinorVersionUpgrade:AutoMinorVersionUpgrade,
-                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.4" name="Enable encryption at rest for Databases running on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Amazon RDS instances and snapshots can be encrypted at rest by enabling the encryption option on the Amazon RDS DB instance. Data that is encrypted at rest includes the underlying storage for a DB instance, its automated backups, read replicas, and snapshots. Encryption at rest should be enabled. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-  Using the Amazon unified CLI: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Perform a snapshot of the DB instance:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds create-db-snapshot --db-snapshot-identifier db_snapshot --db-instance-identifier your_db_instance 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Confirm created snapshot is available (once snapshot process has completed):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds describe-db-snapshots --query 'DBSnapshots[*].{DBSnapshotIdentifier:DBSnapshotIdentifier, DBInstanceIdentifier:DBInstanceIdentifier, Snapshotstatus:Status}' 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List all KMS Customer Managed Keys:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws kms list-aliases 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Copy to source RDS snapshot (from previous step) to a destination snapshot which will be encrypted:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt;
-   aws rds copy-db-snapshot --source-db-snapshot-identifier db_snapshot&amp;nbsp; --target-db-snapshot-identifier encrypted_db_snapshot --kms-key-id data_tier_kms_key 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Restore a snapshot to the target DB instance(from previous step) with the same values as original db instance with additional encrypted storage values:&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws rds restore-db-instance-from-db-snapshot --db-instance-identifier your_db_instance --db-snapshot-identifier encrypted_db_snapshot 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: copy db snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/rds/copy-db-snapshot.html"/>
-            <reference name="Amazon docs: copy snapshot" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html"/>
-            <reference name="Amazon docs: create db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html"/>
-            <reference name="Amazon docs: create db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-snapshot.html"/>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: describe db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-snapshots.html"/>
-            <reference name="Amazon docs: encryption" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html"/>
-            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
-          </references>
-          <standards>
-            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="2.3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all current RDS instances and review the encryption status of the DB
-                            instance:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws rds describe-db-instances --query 'DBInstances[*].{DBName:DBName,
-                            EncryptionEnabled:StorageEncrypted, CMK:KmsKeyId}'
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.4" name="Enable event subscriptions for DataBase security on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;AWS Relational Database Services offers customers a managed database engine solution
-                        for hosting customer created databases which can allow for a reduction in operational burden on
-                        customers.&lt;/p&gt;
-                        &lt;p&gt;RDS event subscriptions provide notification of selected event changes at a DB security
-                        group level.&lt;/p&gt;
-                        &lt;p&gt;Event subscriptions are designed to provide incident notification of events which may
-                        affect the network availability of the RDS instance.&lt;/p&gt;
-                        &lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt;
-                        &lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Create a new event subscription for DB Security Group events:&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;p&gt;aws rds create-event-subscription --subscription-name rds_event_subscription
-                        --sns-topic-arn
-                        sns_topic_arn
-                        --source-type db-security-group --event-categories rds_events
-                        --source-ids events_source_ids --enabled&lt;/p&gt;
-                        &lt;/blockquote&gt;
-                        &lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified CLI:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-security-group&amp;quot;
-                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-event-subscriptions --query
-                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
-                            EventCategoriesList:EventCategoriesList}'
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
-                            reported on
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
-                            instances)
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-4.3" name="Enable Event subscriptions for Instance level events on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  AWS Relational Database Services offers customers a managed database engine solution for hosting customer created databases which can allow for a reduction in operational burden on customers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  RDS event subscriptions provide notification of selected event changes at DataBase engine level such as: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Deletion&lt;/li&gt; 
-  &lt;li&gt;Failure&lt;/li&gt; 
-  &lt;li&gt;Failover&lt;/li&gt; 
-  &lt;li&gt;Low Storage&lt;/li&gt; 
-  &lt;li&gt;Maintenance&lt;/li&gt; 
- &lt;/ul&gt; 
-  Event subscriptions are designed to provide incident notification of events which may affect the availability of a RDS database instance. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified CLI: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Create a new event subscription for DB instance level events:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws rds create-event-subscription --subscription-name &amp;lt;rds_event_subscription&amp;gt; --sns-topic-arn sns_topic_arn --source-type &amp;lt;db-instance&amp;gt; --event-categories &amp;lt;rds_events&amp;gt; --source-ids &amp;lt;events_source_ids&amp;gt; --enabled 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: create event subscription" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-event-subscription.html"/>
-            <reference name="Amazon docs: describe event subcriptions" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-event-subscriptions.html"/>
-            <reference name="Amazon docs: user event messages" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages"/>
-          </references>
-          <standards>
-            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified CLI:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-instance&amp;quot;
-                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-event-subscriptions --query
-                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
-                            EventCategoriesList:EventCategoriesList}'
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
-                            reported on
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
-                            instances)
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.5" name="Enable Multi-AZ on RDS" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  There are 6 database engines available for customer to run their database workloads on: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
-  &lt;li&gt;MySQL&lt;/li&gt; 
-  &lt;li&gt;MariaDB&lt;/li&gt; 
-  &lt;li&gt;Oracle&lt;/li&gt; 
-  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Provides AWS managed high availability of the Database Tier across 2 availability zones within a region through asynchronous replication at the data layer. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br /&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify each no-multi-az DB instance, and make it Multi-AZ enabled:&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --multi-az 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
-          </references>
-          <standards>
-            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check if your application DB instances are Multi-AZ enabled:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
-                            --query &amp;quot;DBInstances[*].{MultiAZ:MultiAZ,
-                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.8" name="Set Backup retention policy on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  There are 6 database engines available for customer to run their database workloads on: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
-  &lt;li&gt;MySQL&lt;/li&gt; 
-  &lt;li&gt;MariaDB&lt;/li&gt; 
-  &lt;li&gt;Oracle&lt;/li&gt; 
-  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
-  &lt;li&gt;PostgreSQL&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Provides a managed backup function of the RDS Database, it is possible to define the backup window and retention period of the backup. Each customer should have a retention policy set for the type of data being stored. It is recommended to set this to at least 7. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Possible values are from 0 to 35 days. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Using the Amazon unified command line interface: 
- &lt;/div&gt; 
- &lt;div style=""&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Modify each DB instance with a Backup Retention Period of 0, and set a desired Backup Retention Period in days (recommended value = 7):&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div style=""&gt;
-     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --backup-retention-period &amp;lt;backup_retention_period&amp;gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
-            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
-          </references>
-          <standards>
-            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check if your application DB instances have a Backup Retention Period set (0 =
-                            there is no backup retention in place, 7 = there are 7 daily backups retained):&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;div&gt;
-                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
-                            --query &amp;quot;DBInstances[*].{BackupRetentionPeriod:BackupRetentionPeriod,
-                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-RDS-01" name="Use SSL to Encrypt the connection to a DB Instance" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Use SSL from your application to encrypt a connection to a DB instance running MySQL, MariaDB,
-                        Amazon Aurora, SQL Server, Oracle, or PostgreSQL. Each DB engine has its own process for
-                        implementing SSL. To learn how to implement SSL for your particular DB instance, please see link
-                        provided in &amp;quot;References&amp;quot; section.</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the SSL protocol is used to encrypt the data in transit.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-EC2-6.2">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.6" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.6" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-IAM-2.7">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-Network-5.2">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.5" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="database-publically-accesible">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.30" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="no-access-control-onrds">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.34" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.5" mitigation="34"/>
-                <countermeasure ref="aws-tier-6.30" mitigation="33"/>
-                <countermeasure ref="aws-tier-6.34" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="no-notification-incident">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-4.3" mitigation="50"/>
-                    <countermeasure ref="aws-tier-4.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-4.3" mitigation="50"/>
-                <countermeasure ref="aws-tier-4.4" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="NOT_BACKUP_POLICIES">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-3.8" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-3.8" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-1.4" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
-                <countermeasure ref="aws-tier-1.4" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="c44e3e92-8a8c-4efc-8c00-0762ea4d8889" diagramComponentId="807eb8fa-2f36-40c2-89ba-76e952dc3f14" ref="0dabda18-f39e-4929-96e0-83f231b84abe" name="MongoDB NoSQL" desc="" library="" parentComponentRef="" componentDefinitionRef="mongodb-nosql">
-      <tags/>
-      <questions>
-        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
-        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets>
-        <asset name="Credit Card Data" accessType="10"/>
-        <asset name="Credit Card Data" accessType="50"/>
-      </assets>
-      <settings/>
-      <weaknesses>
-        <weakness ref="PCI-R3-3.x" name="Cardholder data is unprotected on the system" state="0" impact="100" issueId="" issueLink="">
-          <desc>This covers 3.1 and 3.5 from PCI-DSS</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.228">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
-                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
-                        data transmission. For example, network traffic can often be sniffed by any attacker who has
-                        access to a network interface. This significantly lowers the difficulty of exploitation by
-                        attackers.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.538">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.100">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-943" name="Improper Neutralization of Special Elements in Data Query Logic" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.&lt;/p&gt;&lt;p&gt;Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated&lt;/li&gt;&lt;li&gt;Append additional commands to the query&lt;/li&gt;&lt;li&gt;Return more entities than intended&lt;/li&gt;&lt;li&gt;Return fewer entities than intended&lt;/li&gt;&lt;li&gt;Cause entities to be sorted in an unexpected way&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The ability to execute additional commands or change which entities are returned has obvious risks. But when the application logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the application query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges.&lt;/p&gt;&lt;p&gt;While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and NoSQL languages.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.465">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-943: Improper Neutralization of Special Elements in Data Query Logic" url="https://cwe.mitre.org/data/definitions/943.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.334">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.833">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.833">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
-
-An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.334">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.333">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.
-          </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.831">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.010">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
-  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
-  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
-  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.710">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.382">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        &lt;div&gt;
-                        Data stored on the server or the client must be protected by encryption (data
-                        &lt;i&gt;at rest&lt;/i&gt;).
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
-                        be used to protect the data.&lt;/li&gt;
-                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
-                        storage.&lt;/li&gt;
-                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
-                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
-                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
-                        to a bespoke implementation).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.708">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.625">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
-          &lt;br /&gt;&lt;br /&gt;
-          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA. 
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                &lt;ol&gt;
-                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
-                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.711">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.1-C" name="Keep cardholder data storage to a minimum" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;A formal data retention policy identifies what data needs to be retained, for how long, and where that data resides so it can be securely destroyed or deleted as soon as it is no longer needed. The only account data that may be stored after authorization is the primary account number or PAN (rendered unreadable), expiration date, cardholder name, and service code.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The storage of SAD data prior to the completion of the authorization process is also included in the data retention and disposal policy so that storage of this sensitive data is kept to minimum, and only retained for the defined amount of time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;When identifying locations of stored account data, consider all processes and personnel with access to the data, as data could have been moved and stored in different locations than originally defined. Storage locations that are often overlooked include backup and archive systems, removable data storage devices, paper-based media, and audio recordings.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To define appropriate retention requirements, an entity first needs to understand its own business needs as well as any legal or regulatory obligations that apply to its industry or to the type of data being retained. Implementing an automated process to ensure data is automatically and securely deleted upon its defined retention limit can help ensure that account data is not retained beyond what is necessary for business, legal, or regulatory purposes.&lt;/p&gt;&lt;p&gt;Methods of eliminating data when it exceeds the retention period include secure deletion to complete removal of the data or rendering it unrecoverable and unable to be reconstructed. Identifying and securely eliminating stored data that has exceeded its specified retention period prevents unnecessary retention of data that is no longer needed. This process may be automated, manual, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The deletion function in most operating systems is not "secure deletion" as it allows deleted data to be recovered, so instead, a dedicated secure deletion function or application must be used to make data unrecoverable.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remember, if you don't need it, don't store it!&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;An automated, programmatic procedure could be run to locate and remove data, or a manual review of data storage areas could be performed. Whichever method is used, it is a good idea to monitor the process to ensure it is completed successfully, and that the results are recorded and validated as being complete. Implementing secure deletion methods ensures that the data cannot be retrieved when it is no longer needed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.1" supportedStandardRef="pci-sss"/>
-            <standard ref="3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.2" supportedStandardRef="pci-sss"/>
-            <standard ref="3.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="3.3" supportedStandardRef="pci-sss"/>
-            <standard ref="3.4" supportedStandardRef="pci-sss"/>
-            <standard ref="3.5" supportedStandardRef="pci-sss"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.2.1.a: Examine the data retention and disposal policies, procedures, and processes and interview personnel to verify processes are defined to include all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;3.2.1.b: Examine files and system records on system components where account data is stored to verify that the data storage amount and retention time does not exceed the requirements defined in the data retention policy.&lt;/li&gt;&lt;li&gt;3.2.1.c: Observe the mechanisms used to render account data unrecoverable to verify data cannot be recovered.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;3.1.a: The assessor shall examine vendor evidence to identify what sensitive data is collected by the software for use beyond any one transaction, the default time period for which it is retained, and whether the retention period is user-configurable, and to confirm vendor evidence includes reasonable justification for retaining the sensitive data.&lt;/li&gt;&lt;li&gt;3.1.b: The assessor shall test the software to confirm that all available functions or services designed for the retention of sensitive data are supported by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.1.c: The assessor shall test the software to confirm that sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected during storage in accordance with Control Objective 6. Any such functionality that allows for storage of sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user and retained only for the duration necessary in accordance with reasonable vendor criteria. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any sensitive data is securely deleted per Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.1.d: Where user input or interaction is required to configure the retention period of sensitive data, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.2.a: The assessor shall examine vendor evidence to identify all sensitive data that is retained by the software for transient use, what triggers the secure deletion of this data, and confirm reasonable justification exists for retaining the data. This includes data that is stored only in memory during the operation of the software.&lt;/li&gt;&lt;li&gt;3.2.b: The assessor shall test the software to confirm that all available functions or services that retain transient sensitive data are supported by vendor evidence and do not use immutable objects.&lt;/li&gt;&lt;li&gt;3.2.c: The assessor shall test the software to confirm that transient sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected in accordance with Control Objective 6. Any such functionality that allows for the storage of transient sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any transient sensitive data is securely deleted in accordance with Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.2.d: Where users can configure retention of transient sensitive data, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on this process is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.3.a: The assessor shall examine the vendor evidence to identify the protection methods implemented for all sensitive data during storage and transmission.&lt;/li&gt;&lt;li&gt;3.3.b: The assessor shall test the software to confirm that no additional storage of sensitive data is included.&lt;/li&gt;&lt;li&gt;3.3.c: Where sensitive data is stored outside of temporary variables within the code itself, the assessor shall test the software to confirm that sensitive data is protected using either strong cryptography or other methods that provide an equivalent level of security.&lt;/li&gt;&lt;li&gt;3.3.d: Where protection methods use cryptography, the assessor shall examine vendor evidence and test the software to confirm that the cryptographic implementation complies with Control Objective 7 of this standard.&lt;/li&gt;&lt;li&gt;3.3.e: Where sensitive data is protected using methods other than strong cryptography, the assessor shall examine vendor evidence and test the software to confirm that the protections are present in all environments where the software is designed to be executed, are correctly implemented, and are covered by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.3.f: Where users are required to configure protection methods, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.4.a: The assessor shall examine vendor evidence to identify all secure deletion methods implemented by the software for all non-transient sensitive data.&lt;/li&gt;&lt;li&gt;3.4.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the secure deletion of non-transient sensitive data and to confirm that any non-transient sensitive data is securely deleted using a method that ensures that the data is unrecoverable after deletion. Methods may include (but are not necessarily limited to) overwriting the data, deletion of cryptographic keys (of sufficient strength) which have been used to encrypt the data, or platform specific functions which provide for secure deletion. Methods must accommodate for platform specific issues, such as flash wear-leveling algorithms or SSD over-provisioning, which may complicate simple over-writing methods.&lt;/li&gt;&lt;li&gt;3.4.c: The assessor shall test the software using forensic tools to identify any non-transient sensitive data residue in the execution environment, and to confirm that the methods attested by the software vendor are correctly implemented and applied to all sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data (e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements), as well as covering all non-transient sensitive data types.&lt;/li&gt;&lt;li&gt;3.5.a: The assessor shall examine vendor evidence to identify all secure deletion methods for all transient sensitive data and to confirm that these methods ensure that the data is unrecoverable after deletion.&lt;/li&gt;&lt;li&gt;3.5.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the erasure of such transient sensitive data-such as abstraction layers between the code and the hardware execution environment-and to confirm what methods have been implemented to minimize the risk posed by these complications.&lt;/li&gt;&lt;li&gt;3.5.c: The assessor shall test the software, including usage of forensic tools, to identify any sensitive data residue in the execution environment to confirm that the methods attested by the software vendor are correctly implemented and applied to all transient sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data-e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements-as well as cover all non-transient sensitive data types.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.123">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.348">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="71" state="Required" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.625">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
- &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
- &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
- &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
-  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;b&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
- &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
- &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
- &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
- &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
- &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
- &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
- &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="NIST 800-63: Memorised secrets" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-            <reference name="Owasp CheatSheetSeries: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt; 
- &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
- &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
-&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
-&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
-&lt;ul&gt; 
- &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
- &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
- &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
- &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
- &lt;li&gt;at least 10 characters&lt;/li&gt; 
- &lt;li&gt;at most 128 characters&lt;/li&gt; 
-&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.360">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.359">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.5.4-C" name="Store cryptographic keys in the fewest possible locations" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing any cryptographic keys in the fewest locations helps an organization track and monitor all key locations and minimizes the potential for keys to be exposed to unauthorized parties.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.6.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.4: Examine key storage locations and observe processes to verify that keys are stored in the fewest possible locations.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PCI-R3-3.5.3-C" name="Store securely secret and private keys used to encrypt/decrypt" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing cryptographic keys securely prevents unauthorized or unnecessary access that could result in the exposure of stored account data. Storing keys separately means they are stored such that if the location of one key is compromised, the second key is not also compromised.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Where data-encrypting keys are stored in an HSM, the HSM interaction channel should be protected to prevent interception of encryption or decryption operations.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
-          </references>
-          <standards>
-            <standard ref="3.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
-            <standard ref="3.6.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.2.a: Examine documented procedures to verify it is defined that cryptographic keys used to encrypt/decrypt stored account data must exist only in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.b: Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.c: Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Key-encrypting keys are at least as strong as the data-encrypting keys they protect.&lt;/li&gt;&lt;li&gt;Key-encrypting keys are stored separately from data-encrypting keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.125">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.359">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.220">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.221">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                    <countermeasure ref="CWE-662" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
-                <countermeasure ref="CWE-662" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319-AUTH">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-521">
-                  <countermeasures>
-                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="UNRESTRICTED-NETWORK">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-341" name="Attackers gain access to user data by manipulating server-side code" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server-side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-943">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
-                    <countermeasure ref="DATA-VAL" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
-                <countermeasure ref="DATA-VAL" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
-          <threats>
-            <threat ref="sensitive-auth-data-stealing" name="Attackers gain access to the personal identification number (PIN) or the encrypted PIN block after authorization" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="PCI-DSS" editable="true">
-              <desc>If full track data is stored, malicious individuals who obtain that data can use it to reproduce payment cards and complete fraudulent transactions. The purpose of the card validation code is to protect "card-not-present" transactions-Internet or mail order/telephone order (MO/TO) transactions-where the consumer and the card are not present. If this data is stolen, malicious individuals can execute fraudulent Internet and MO/TO transactions. These values should be known only to the card owner or bank that issued the card. If this data is stolen, malicious individuals can execute fraudulent PIN-based debit transactions (for example, ATM withdrawals).</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="PCI-R3-3.x">
-                  <countermeasures>
-                    <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
-                    <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
-                    <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
-                <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
-                <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
-                                that data.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
-                    <countermeasure ref="store-backups-securely" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
-                <countermeasure ref="store-backups-securely" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
-              <desc>If sensitive data is stored or processed on the host, then should the host itself be
-                                compromised by an attacker, the confidentiality and/or the integrity of the data would
-                                also be at risk.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="982e7bf3-f767-430e-be32-2dd53d45de11" diagramComponentId="8ba783a0-4bdf-492b-856a-29599555aa18" ref="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="" componentDefinitionRef="s3">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="public-cloud"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
-          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
-                        for an MFA.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
-                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
-          <desc>Sensitive data is not encrypted and is exposed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.689">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>Attackers can perform a successful denial of service on the system</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.687">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Granting least privilege ensures that users only have the permissions required to complete
-                their jobs rather than additional privileges that are not required. Following this model ensures
-                that, should an account be compromised, the blast radius of damage is limited.
-                &lt;br /&gt;
-                &lt;br /&gt;
-                &lt;b&gt;Remediation:&lt;/b&gt;
-                &lt;div&gt;
-                &lt;ul&gt;
-                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
-                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
-                &lt;/ul&gt;
-                &lt;/div&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
-            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
-            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
-            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
-            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
-            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
-                            groups or roles&amp;quot;.&lt;/li&gt;
-                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
-                            ability to perform their and no more.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
-&lt;br /&gt; 
-&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
-&lt;div&gt; 
- &lt;br /&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;br /&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
-  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
-  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
-  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
- &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; &lt;br /&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.18" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
-                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
-                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
-                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;select the instance&lt;/li&gt;
-                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
-                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
-                            assigned).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;div&gt;
-   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
- &lt;/div&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
-            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
-            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
-          </references>
-          <standards>
-            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
-                            then your bucket has no versioning enabled.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-3" name="Enable cross-region replication on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Enabling cross-Region replication on S3 buckets ensures that multiple versions of the data are available in different distinct Regions. This allows you to store data at even greater distances, minimize latency, increase operational efficiency, and protect against DDoS and data corruption events.&lt;/p&gt;&lt;p&gt;This is one method used to implement system hardening configuration.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;To enable S3 bucket replication&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon S3 console at https://console.aws.amazon.com/s3/.&lt;/li&gt;&lt;li&gt;Choose the S3 bucket that does not have cross-region replication enabled.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Management&lt;/strong&gt;, then choose &lt;strong&gt;Replication&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Add rule&lt;/strong&gt;. If versioning is not already enabled, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose your source bucket - &lt;strong&gt;Entire bucket&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose your destination bucket. If versioning is not already enabled on the destination bucket for your account, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose an IAM role. For more information on setting up permissions for replication, see the &lt;i&gt;Amazon Simple Storage Service User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Enter a rule name, choose &lt;strong&gt;Enabled&lt;/strong&gt; for the status, then choose &lt;strong&gt;Next&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Save&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.552">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="3.11" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
-            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
-            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt; 
- &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
-&lt;/blockquote&gt; 
-&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.553">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
-&lt;/div&gt; 
-&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
-&lt;br /&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
-            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
-  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
- &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Rationale&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
-  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
- &lt;/ul&gt; If data in transit is kept unencrypted: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
- &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;br&gt; 
-  &lt;/div&gt; 
-  &lt;div&gt; 
-   &lt;div&gt;
-     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
-   &lt;/div&gt; 
-   &lt;div&gt; 
-    &lt;ul&gt; 
-     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
-    &lt;/ul&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       { 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Version":"2012-10-17", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Id":"PutObjPolicy", 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;"Statement":{ 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Effect":"Deny", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Principal":"*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Action":"s3:PutObject", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;"Condition":{ 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt; 
-        &lt;div&gt;
-          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
-        &lt;/div&gt; 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt; 
-       &lt;div&gt;
-         &amp;nbsp;} 
-       &lt;/div&gt; 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt; 
-      &lt;div&gt;
-        &amp;nbsp;} 
-      &lt;/div&gt; 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt; 
-     &lt;div&gt;
-       } 
-     &lt;/div&gt; 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;div&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/div&gt; 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;div&gt; 
-    &lt;div&gt;
-      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
-    &lt;/div&gt; 
-   &lt;/div&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Get bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
-            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
-            <reference name="Put bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
-            <reference name="Using Server-side Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="3.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Using the Amazon unified command line interface:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api list-buckets --output table
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            ...
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;{
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Effect": "Deny",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Principal": "*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Action": "s3:PutObject",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Condition": {
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;/blockquote&gt;
-                            &lt;blockquote&gt;
-                            &amp;nbsp;}
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            &lt;br&gt;
-                            &lt;/div&gt;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.546">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
-  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
-  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
-  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
-  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
-  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;br&gt; 
-&lt;br&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
-            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
-            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
-            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
-          </references>
-          <standards>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="1.4.4" supportedStandardRef="PCI-DSS-v4.0"/>
-            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="2.1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
-                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            ./prowler -c extra73
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;
-                            &lt;div&gt;
-                            &lt;br /&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
-              <output/>
-            </source>
-            <references>
-              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br&gt; 
-&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br&gt; 
-&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
-&lt;div&gt; 
- &lt;br&gt; 
- &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
- &lt;br&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; {&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt; "Statement":[&lt;/i&gt; 
-   &lt;i&gt;{&lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
-    &lt;/div&gt; 
-    &lt;div&gt; 
-     &lt;i&gt;"Condition":{&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;div&gt; 
-       &lt;i&gt;"Bool":&lt;/i&gt; 
-      &lt;/div&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;blockquote&gt; 
-       &lt;div&gt; 
-        &lt;i&gt;}&lt;/i&gt; 
-       &lt;/div&gt; 
-      &lt;/blockquote&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;blockquote&gt; 
-     &lt;blockquote&gt; 
-      &lt;i&gt;}&lt;/i&gt; 
-     &lt;/blockquote&gt; 
-    &lt;/blockquote&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;blockquote&gt; 
-   &lt;blockquote&gt; 
-    &lt;div&gt; 
-     &lt;i&gt; }&lt;/i&gt; 
-     &lt;i&gt;]&lt;/i&gt; 
-    &lt;/div&gt; 
-   &lt;/blockquote&gt; 
-  &lt;/blockquote&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt; 
-   &lt;i&gt;} &lt;/i&gt; 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-  
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
-                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
-                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
-                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.548">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt; Description&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
-  static, streaming, and interactive content using a global network of edge locations. 
-  Requests for your content are automatically routed to the nearest edge location, so content 
-  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
-  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
-  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
-  Amazon Route 53. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Amazon CloudFront gives you three options for accelerating your entire website while 
-  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
-  addition to delivering securely from the edge, you can also configure CloudFront to use 
-  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
-  origin to your end users. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt; Remediation&lt;/b&gt;: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront create-distribution --distribution-config file://distconfig.json 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
-            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
-            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
-          </references>
-          <standards>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
-            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Using the Amazon unified command line interface: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt; 
-&lt;blockquote&gt; 
- &lt;blockquote&gt; 
-  &lt;div&gt;
-    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
-  &lt;/div&gt; 
- &lt;/blockquote&gt; 
-&lt;/blockquote&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.550">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
-&lt;br /&gt; 
-&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
-&lt;br /&gt; 
-&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
-&lt;br /&gt;Remediation 
-&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
-&lt;br /&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
-            <standard ref="2.1.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;blockquote&gt;
-                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
-                            &lt;/blockquote&gt;
-                            &lt;div&gt;
-                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
-                            has no MFA delete enabled.
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
-          <threats>
-            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="SYSTEM-VUL-DOS">
-                  <countermeasures>
-                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.1">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-3" mitigation="25"/>
-                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.2">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-2" mitigation="25"/>
-                <countermeasure ref="AWS-S3-3" mitigation="25"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="25"/>
-                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
-              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AWS-S3-7.3">
-                  <countermeasures>
-                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AWS-S3-7.4">
-                  <countermeasures>
-                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="misconfigured-s3-access-policies">
-                  <countermeasures>
-                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AWS-S3-1" mitigation="10"/>
-                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
-                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
-                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
-                <countermeasure ref="identify-audit-s3" mitigation="10"/>
-                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 2edac6d949072099fd6ac89514b59d9593717ab3 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:25:05 -0400
Subject: [PATCH 26/28] Delete Templates/st-generator-form-template.xml

---
 Templates/st-generator-form-template.xml | 19625 ---------------------
 1 file changed, 19625 deletions(-)
 delete mode 100644 Templates/st-generator-form-template.xml

diff --git a/Templates/st-generator-form-template.xml b/Templates/st-generator-form-template.xml
deleted file mode 100644
index a62f6cd..0000000
--- a/Templates/st-generator-form-template.xml
+++ /dev/null
@@ -1,19625 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<template ref="st-generator-form-template" name="st-generator-form template" tags="Community">
-  <desc/>
-  <diagram draft="false">
-    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjY0OCIgZHk9IjMyMCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjkuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjM0IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTExNTEiIHk9IjQzMSIgd2lkdGg9IjEzMTAiIGhlaWdodD0iOTEyIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQnJvd3NlciIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUJST1dTRVI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCMmFXVjNRbTk0UFNJd0lEQWdNU0F4SWlCbWFXeHNQU0p1YjI1bElpQjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaVBqeHpkSGxzWlQ0Z0lDQWdMbWxqYjI0dFptbHNiQ0I3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095QWdJQ0I5UEM5emRIbHNaVDQ4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQmZNalV3TlY4eU16SXlPQ2tpUGp4d1lYUm9JR1E5SWswd0xqSXdNRGd3TmlBd0xqSTVPRFkwTjBNd0xqSXdNRGd3TmlBd0xqSXpPVGd5TkNBd0xqSTBPREF5TnlBd0xqRTVNakV6T1NBd0xqTXdOakkzTnlBd0xqRTVNakV6T1Vnd0xqWTROVGszTTBNd0xqYzBOREl5TXlBd0xqRTVNakV6T1NBd0xqYzVNVFEwTkNBd0xqSXpPVGd5TkNBd0xqYzVNVFEwTkNBd0xqSTVPRFkwTjFZd0xqUTVOamN3TmtNd0xqYzNPRE01TmlBd0xqUTRPRFUwTnlBd0xqYzJOREkwSURBdU5EZ3lNREkxSURBdU56UTVNalUxSURBdU5EYzNOREl5VmpBdU16WXlOVFV4U0RBdU1qUXlPVGswVmpBdU5qZ3lNRGMxUXpBdU1qUXlPVGswSURBdU56RTNNelk1SURBdU1qY3hNekkzSURBdU56UTFPVGdnTUM0ek1EWXlOemNnTUM0M05EVTVPRWd3TGpVME1qa3pOVU13TGpVMU1qVTVOQ0F3TGpjMk1UazNNaUF3TGpVMk5EWXpJREF1TnpjMk16UWdNQzQxTnpnMU5EY2dNQzQzT0RnMU9ETklNQzR6TURZeU56ZERNQzR5TkRnd01qY2dNQzQzT0RnMU9ETWdNQzR5TURBNE1EWWdNQzQzTkRBNE9UZ2dNQzR5TURBNE1EWWdNQzQyT0RJd056VldNQzR5T1RnMk5EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEhCaGRHZ2daRDBpVFRBdU5qVTFORFkzSURBdU56STBPREl4U0RBdU56UTRNemMzUXpBdU56TTVNRGMwSURBdU56YzBNemswSURBdU56SXdORFExSURBdU9EQTRNVE01SURBdU56QXhPVEl5SURBdU9EQTRNVE01UXpBdU5qZ3pPVFlnTUM0NE1EZ3hNemtnTUM0Mk5qVTRPVGtnTUM0M056WTBNRGdnTUM0Mk5UWXpNemdnTUM0M01qa3lPRFJNTUM0Mk5UVTBOamNnTUM0M01qUTRNakZJTUM0M05EZ3pOemRJTUM0Mk5UVTBOamRhVFRBdU5UWTNPRFUxSURBdU56STBPREkwVERBdU5qTXlORFkySURBdU56STBPREpETUM0Mk16YzVNemtnTUM0M05UWXpOelFnTUM0Mk5EY3lNVGNnTUM0M09ETXlNVGdnTUM0Mk5Ua3pOVGtnTUM0NE1ESXdNRFJETUM0Mk1qQTVNREVnTUM0M09UQTFNelVnTUM0MU9EZzRPRE1nTUM0M05qTTVORE1nTUM0MU56QXdOVEVnTUM0M01qa3dOVXd3TGpVMk56ZzFOU0F3TGpjeU5EZ3lORnBOTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORU13TGpneE56VXhNaUF3TGpjMk1UYzVNaUF3TGpjNE5EUTRNU0F3TGpjNU1EQTNOaUF3TGpjME5EVWdNQzQ0TURFNU9UbERNQzQzTlRVNE1qTWdNQzQzT0RRME5UY2dNQzQzTmpRMk5UY2dNQzQzTlRrNU1EZ2dNQzQzTnpBeU16TWdNQzQzTXpFd05qWk1NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5Fd3dMamMzTVRNM09DQXdMamN5TkRneVdrMHdMamMzTlRreU5DQXdMall5TmpNeU0wd3dMamcwT1RBd05DQXdMall5TmpNeE0wTXdMamcxTURrM01pQXdMall6TmpFd055QXdMamcxTWpBd05pQXdMalkwTmpJME5DQXdMamcxTWpBd05pQXdMalkxTmpZeU5VTXdMamcxTWpBd05pQXdMalkzTWpRMk5TQXdMamcwT1RVNU9TQXdMalk0Tnpjek9DQXdMamcwTlRFek5TQXdMamN3TWpBNU1rZ3dMamMzTkRVMk4wTXdMamMzTmpFME55QXdMalk0TnpVNE1TQXdMamMzTmprM05TQXdMalkzTWpNek5TQXdMamMzTmprM05TQXdMalkxTmpZeU5VTXdMamMzTmprM05TQXdMalkwT1RjMElEQXVOemMyT0RFMklEQXVOalF5T1RRMUlEQXVOemMyTlRBMUlEQXVOak0yTWpZeFREQXVOemMxT1RJMElEQXVOakkyTXpJelREQXVPRFE1TURBMElEQXVOakkyTXpFelREQXVOemMxT1RJMElEQXVOakkyTXpJeldrMHdMalUxTkRnMElEQXVOakkyTXpFelREQXVOakkzT1RJZ01DNDJNall6TWpORE1DNDJNamN5TWpZZ01DNDJNell4TnpJZ01DNDJNalk0TmpnZ01DNDJORFl5T1RnZ01DNDJNalk0TmpnZ01DNDJOVFkyTWpWRE1DNDJNalk0TmpnZ01DNDJOamt4T1RNZ01DNDJNamN6T1RnZ01DNDJPREUwTmpRZ01DNDJNamcwTVRrZ01DNDJPVE15T1RsTU1DNDJNamt5TnpZZ01DNDNNREl3T1RKSU1DNDFOVGczTURsRE1DNDFOVFF5TkRVZ01DNDJPRGMzTXpnZ01DNDFOVEU0TXpnZ01DNDJOekkwTmpVZ01DNDFOVEU0TXpnZ01DNDJOVFkyTWpWRE1DNDFOVEU0TXpnZ01DNDJORFl5TkRRZ01DNDFOVEk0TnpJZ01DNDJNell4TURjZ01DNDFOVFE0TkNBd0xqWXlOak14TTFwTk1DNDJOVEExTXpRZ01DNDJNall6TVRSSU1DNDNOVE16TVVNd0xqYzFOREEyTkNBd0xqWXpOakE1T0NBd0xqYzFORFEyTmlBd0xqWTBOakl6TXlBd0xqYzFORFEyTmlBd0xqWTFOall5TlVNd0xqYzFORFEyTmlBd0xqWTJPVE14T0NBd0xqYzFNemcyTnlBd0xqWTRNVFl5T1NBd0xqYzFNamMxT0NBd0xqWTVNek00TTB3d0xqYzFNVGd6TXlBd0xqY3dNakE1TWtnd0xqWTFNakF4TVVNd0xqWTFNRE14TlNBd0xqWTROemMySURBdU5qUTVNemMzSURBdU5qY3lORGt5SURBdU5qUTVNemMzSURBdU5qVTJOakkxUXpBdU5qUTVNemMzSURBdU5qUTRPRE14SURBdU5qUTVOakEwSURBdU5qUXhNVGd4SURBdU5qVXdNRE0xSURBdU5qTXpOekUyVERBdU5qVXdOVE0wSURBdU5qSTJNekUwU0RBdU56VXpNekZJTUM0Mk5UQTFNelJhVFRBdU56UTJNVEEwSURBdU5URXpPREkyVERBdU56UTBORGcxSURBdU5URXhNalEzUXpBdU56ZzVOemM0SURBdU5USTBOelE0SURBdU9ESTJNVFV6SURBdU5UVTVNalEzSURBdU9EUXlOVFUzSURBdU5qQXpOVGd5VERBdU56Y3pOalkySURBdU5qQXpOVGczUXpBdU56WTRPVE14SURBdU5UWTJPVFl5SURBdU56VTVNekV6SURBdU5UTTFOVEE0SURBdU56UTJNVEEwSURBdU5URXpPREkyVERBdU56UTBORGcxSURBdU5URXhNalEzVERBdU56UTJNVEEwSURBdU5URXpPREkyV2swd0xqWTFOelV6TVNBd0xqVXhNVGd3TlV3d0xqWTFPVE0xT0NBd0xqVXhNVEkwTjBNd0xqWTBOakUwTVNBd0xqVXpNVFk1TnlBd0xqWXpOak14T0NBd0xqVTJNVFk1TmlBd0xqWXpNVEV3TVNBd0xqVTVOamt5TWt3d0xqWXpNREUzTnlBd0xqWXdNelU0TjB3d0xqVTJNVEk0TmlBd0xqWXdNelU0TWtNd0xqVTNOelEzSURBdU5UVTVPRFExSURBdU5qRXpNRGc0SURBdU5USTFOamd4SURBdU5qVTNOVE14SURBdU5URXhPREExVERBdU5qVTVNelU0SURBdU5URXhNalEzVERBdU5qVTNOVE14SURBdU5URXhPREExV2swd0xqY3dNVGt5TWlBd0xqVXdOVEV4TVVNd0xqY3lNVGN4TWlBd0xqVXdOVEV4TVNBd0xqYzBNVFl5TWlBd0xqVTBNell5T0NBd0xqYzFNREUxTVNBd0xqVTVPRGd4TTB3d0xqYzFNRGcxTkNBd0xqWXdNelU0TTBnd0xqWTFNams1UXpBdU5qWXhNRGcwSURBdU5UUTFPRFlnTUM0Mk9ERTFOamNnTUM0MU1EVXhNVEVnTUM0M01ERTVNaklnTUM0MU1EVXhNVEZhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BDOW5QanhrWldaelBqeGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNalV3TlY4eU16SXlPQ0krUEhKbFkzUWdkMmxrZEdnOUlqQXVPRGdpSUdobGFXZG9kRDBpTUM0NE9DSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRFl3TURVNE5pQXdMakEyTURBMU9EWXBJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI0NSI+CiAgICAgIDxteENlbGwgc3R5bGU9ImlyLnJlZj0zZWI4NzQ0My0zYjJiLTRlYzUtOTcwNi0yZmI0MjM5YWIwOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSI1IiB5PSIzNTgiIHdpZHRoPSIyMDYiIGhlaWdodD0iMTk2IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjcyIiB2YWx1ZT0iV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9NDUzNmI3OGItZTFhMC00YjJkLTg0MTUtYzczZGZiOWM5OTk3OyIgcGFyZW50PSI0NSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMTgiIHk9IjMyLjI1IiB3aWR0aD0iMTU5IiBoZWlnaHQ9IjEzMy43NSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjgzIiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPWM1ZTQ3NjUwLWZiOWUtNDljYi1iMDg1LTM5MDAxN2JmNTdjMTsiIHBhcmVudD0iMzQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ2IiB5PSIxNDIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9Ikt1YmVybmV0ZXMgQ2x1c3RlciIgaXIuc291cmNlU3R5bGU9InZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aHRtbD0xO3NoYXBlPW14Z3JhcGguYmFzaWMucmVjdDtmaWxsQ29sb3IyPW5vbmU7c3Ryb2tlV2lkdGg9MTtzaXplPTIwO2luZGVudD01O2ZvbnRDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1OyIgaWQ9Ijg3Ij4KICAgICAgPG14Q2VsbCBzdHlsZT0idmVydGljYWxBbGlnbj10b3A7aHRtbD0xO2ZpbGxDb2xvcjI9bm9uZTtzdHJva2VXaWR0aD0xO3NpemU9MjA7aW5kZW50PTU7Zm9udENvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNGNUY1RjU7Y29udGFpbmVyPTE7cm91bmRlZD0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTM7d2hpdGVTcGFjZT13cmFwO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSI0MjMiIHk9IjEzIiB3aWR0aD0iODY1IiBoZWlnaHQ9Ijg4NCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI2MyIgdmFsdWU9IkFQSSBnYXRld2F5IiBzdHlsZT0iaXIucmVmPTY5YTExMDY4LTk3YzUtNDQzYS05ZjJmLTNkMjdiZjhkZGFjOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEzMiIgeT0iMzU5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJTdHVkaW8iIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNzAiPgogICAgICA8bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtpci5yZWY9N2VjODgzOTMtZmFmZC00M2Q2LWIyMDUtY2ZhNTFkOGNmMTc1OyIgcGFyZW50PSI4NyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIxMTAiIHk9IjcyNSIgd2lkdGg9IjEzNCIgaGVpZ2h0PSIxMDUiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNDkiIHZhbHVlPSJMb2dpbiIgc3R5bGU9ImlyLnJlZj0xNjE3YzZjNC0wMTBjLTQ1YzgtOTA4NS0xODM3YTFkNjAwYzM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTE9HSU47aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dYekUwTlRCZk1qTTBNRGtpSUhOMGVXeGxQU0p0WVhOckxYUjVjR1U2WVd4d2FHRWlJRzFoYzJ0VmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlJSGc5SWpBaUlIazlJakFpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaVBpWWplR0U3UEdOcGNtTnNaU0JqZUQwaU1DNDFJaUJqZVQwaU1DNDFJaUJ5UFNJd0xqVWlJR1pwYkd3OUltSnNZV05ySWk4K0ppTjRZVHM4TDIxaGMycytKaU40WVRzOFp5QnRZWE5yUFNKMWNtd29JMjFoYzJzd1h6RTBOVEJmTWpNME1Ea3BJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TUY4eE5EVXdYekl6TkRBNUtTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlNVGMzTnpNZ01DNDFNalExTWpKTU1DNDBNekV5T0RJZ01DNDFNalExTkRsTU1DNHpPREU0TmpNZ01DNDFOekk0TVRKRE1DNHpOelF5TWpRZ01DNDFPREF5TmpnZ01DNHpOek0xTXpJZ01DNDFPVEU1TXpRZ01DNHpOemszT0RRZ01DNDJNREF4TlRSTU1DNHpPREU0TmpnZ01DNDJNREkxTURsRE1DNHpPRGsxTURrZ01DNDJNRGs1TmpNZ01DNDBNREUwTmpRZ01DNDJNVEEyTXpnZ01DNDBNRGs0T0RjZ01DNDJNRFExTXpkTU1DNDBNVEl6SURBdU5qQXlOVEEwVERBdU5EazRNamM1SURBdU5URTROVGMwUXpBdU5UQTFPVEV4SURBdU5URXhNVEkwSURBdU5UQTJOakVnTUM0ME9UazBOekVnTUM0MU1EQXpOek1nTUM0ME9URXlOVEZNTUM0ME9UZ3lPVFFnTUM0ME9EZzRPVFpNTUM0ME1USXpNVFVnTUM0ME1EUTRNRFJETUM0ME1ETTVNakVnTUM0ek9UWTFPVFFnTUM0ek9UQXlPVFlnTUM0ek9UWTFOemtnTUM0ek9ERTRPRE1nTUM0ME1EUTNOME13TGpNM05ESXpOQ0F3TGpReE1qSXhOaUF3TGpNM016VXlOaUF3TGpReU16ZzRNaUF3TGpNM09UYzJOeUF3TGpRek1qRXdPVXd3TGpNNE1UZzBPQ0F3TGpRek5EUTJOMHd3TGpRek1EazVOaUF3TGpRNE1qVTFNVXd3TGpJeE56YzNNeUF3TGpRNE1qVXlORll3TGpVeU5EVXlNbG9pSUdacGJHdzlJaU13UWtFd1FqY2lMejRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0MU1qWTFPU0F3TGpjek5EWXhPVWd3TGpVeU5UVTFNVU13TGpVeE5ERTBOU0F3TGpjek5ETTFJREF1TlRBME5UazFJREF1TnpJMU1qSTFJREF1TlRBME5UazFJREF1TnpFek5qSXhWakF1TWprMk5UVTRRekF1TlRBME5UazFJREF1TWpnek5TQXdMalV4TmpZM09TQXdMakkzTXpZd09DQXdMalV5T1RnMU55QXdMakkzTlRnM09Vd3dMamMzTXpjek9TQXdMak14TnpreE0wTXdMamM0TkRBeU1TQXdMak14T1RZNE5TQXdMamM1TVRVeE5TQXdMak15T0RRd05DQXdMamM1TVRVeE5TQXdMak16T0RVNU1sWXdMalkzTkRVMFF6QXVOemt4TlRFMUlEQXVOamcwT0RJMElEQXVOemd6T0RneklEQXVOamt6TlRrMUlEQXVOemN6TkRneklEQXVOamsxTWpZeFREQXVOVEk1TmpBeElEQXVOek0wTXpRelF6QXVOVEk0TlRnNUlEQXVOek0wTlRBMUlEQXVOVEkzTlRneklEQXVOek0wTlRrMklEQXVOVEkyTlRrZ01DNDNNelEyTVRsYVRUQXVOak16TnpBNUlEQXVORGcxTkRnNVF6QXVOak16TnpBNUlEQXVOVEF3T1RnMklEQXVOakl3T0RNMklEQXVOVEV6TlRRNElEQXVOakEwT1RVMklEQXVOVEV6TlRRNFF6QXVOVGc1TURjMUlEQXVOVEV6TlRRNElEQXVOVGMyTWpBeUlEQXVOVEF3T1RnMklEQXVOVGMyTWpBeUlEQXVORGcxTkRnNVF6QXVOVGMyTWpBeUlEQXVORFk1T1RreklEQXVOVGc1TURjMUlEQXVORFUzTkRNZ01DNDJNRFE1TlRZZ01DNDBOVGMwTTBNd0xqWXlNRGd6TmlBd0xqUTFOelF6SURBdU5qTXpOekE1SURBdU5EWTVPVGt6SURBdU5qTXpOekE1SURBdU5EZzFORGc1V2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRVek9UVWdNQzR6TVRjMU1UZE1NQzQwTnpVNU1ETWdNQzR6TVRjMU1qSk1NQzQwTnpVNE5qUWdNQzQwTkRFM01qVk1NQzQwTXpJMU9UVWdNQzR6T1RrME9EZE1NQzQwTXpJME16RWdNQzR6TXpnMU5URkRNQzQwTXpJME1UTWdNQzR6TWpjNU1EY2dNQzQwTkRBMU1URWdNQzR6TVRreE1ESWdNQzQwTlRFd01qWWdNQzR6TVRjM01EbE1NQzQwTlRNNU5TQXdMak14TnpVeE4xb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUXpNekF3TVNBd0xqWTNORFUzTlV3d0xqUXpNamt3TWlBd0xqWXhNekl6T1V3d0xqUTNOVGczTVNBd0xqVTNNVEl4TWt3d0xqUTNOVGt3TXlBd0xqVTVNVEl6TlZZd0xqWTVOVFV6T1V3d0xqUTFORFV5SURBdU5qazFOVE01UXpBdU5EUXpOak01SURBdU5qazFOVE01SURBdU5ETTBOalF4SURBdU5qZzNOalUzSURBdU5ETXpNakF5SURBdU5qYzNOREl4VERBdU5ETXpNREF4SURBdU5qYzBOVGMxV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3WHpFME5UQmZNak0wTURraVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOamc0TmpBNElpQm9aV2xuYUhROUlqQXVOamc0TmpBNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHhOakF4TlRZZ01DNHhOakE0T0RrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjcwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIxMC41IiB5PSIyOCIgd2lkdGg9Ijc0IiBoZWlnaHQ9IjU0LjUiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3MyIgdmFsdWU9IkFQSSBnYXRld2F5IC0mZ3Q7IExvZ2luIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC4yNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj0xMjhhMGU4Yi1iZTY0LTRkYzMtYTlhYi0yNDhkOTE1MDVhYmE7aXIudGFncz14bWwsSlNPTixIVFRQOyIgcGFyZW50PSI4NyIgc291cmNlPSI2MyIgdGFyZ2V0PSI0OSIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNzYiIHZhbHVlPSJTdHVkaW8gLSZndDsgQVBJIGdhdGV3YXkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTA7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj0wZTNlZTIwOS02MTMzLTQxZmUtYWI3ZC00NzdmNWVjZDQyNzQ7aXIudGFncz1BY2Nlc3MgVG9rZW4sSlNPTixIVFRQOyIgcGFyZW50PSI4NyIgc291cmNlPSI3MCIgdGFyZ2V0PSI2MyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjAuNDUwNiIgeT0iLTE4IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCBhcz0ib2Zmc2V0Ii8+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNTEiIHZhbHVlPSJPQXV0aDIgQXV0aG9yaXphdGlvbiBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9MDdlZGFmMzgtODVkNS00ZmMyLTk3YTEtZmZmZmM5MjFjOGM0O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW9hdXRoMi1hdXRob3JpemF0aW9uLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9EUXdOVGc0SURBdU5EZzBNemd4UXpBdU9EUXdOVGc0SURBdU1qZzNPVGtnTUM0Mk9ERXpPRElnTUM0eE1qZzNPRFFnTUM0ME9EUTVPVEVnTUM0eE1qZzNPRFJETUM0eU9EZzJNREVnTUM0eE1qZzNPRFFnTUM0eE1qa3pPVFVnTUM0eU9EYzVPU0F3TGpFeU9UTTVOU0F3TGpRNE5ETTRNVU13TGpFeU9UTTVOU0F3TGpZNE1EYzNNaUF3TGpJNE9EWXdNU0F3TGpnek9UazNPQ0F3TGpRNE5EazVNU0F3TGpnek9UazNPRU13TGpVd05qRXhOU0F3TGpnek9UazNPQ0F3TGpVeU5qZ3dPQ0F3TGpnek9ERXpOaUF3TGpVME5qa3lJREF1T0RNME5qQTBRekF1TlRNMk5UUXpJREF1T0RJeU1EZzBJREF1TlRJM05qTXlJREF1T0RBNE16QTBJREF1TlRJd05EVWdNQzQzT1RNMU0wTXdMalV3T0RneE15QXdMamM1TkRnMUlEQXVORGsyT1RneElEQXVOemsxTlRJNElEQXVORGcwT1RreElEQXVOemsxTlRJNFF6QXVNekV6TVRVZ01DNDNPVFUxTWpnZ01DNHhOek00TkRRZ01DNDJOVFl5TWpNZ01DNHhOek00TkRRZ01DNDBPRFF6T0RGRE1DNHhOek00TkRRZ01DNHpNVEkxTXprZ01DNHpNVE14TlNBd0xqRTNNekl6TkNBd0xqUTRORGs1TVNBd0xqRTNNekl6TkVNd0xqWTFOamd6TXlBd0xqRTNNekl6TkNBd0xqYzVOakV6T1NBd0xqTXhNalV6T1NBd0xqYzVOakV6T1NBd0xqUTRORE00TVVNd0xqYzVOakV6T1NBd0xqUTVOalkySURBdU56azFOREk0SURBdU5UQTROemN6SURBdU56azBNRFEwSURBdU5USXdOamhETUM0NE1EZzNPVGdnTUM0MU1qYzVNRE1nTUM0NE1qSTFOVE1nTUM0MU16WTROVEVnTUM0NE16VXdORFlnTUM0MU5EY3lOakpETUM0NE16ZzJPRGdnTUM0MU1qWTROVElnTUM0NE5EQTFPRGdnTUM0MU1EVTRNemdnTUM0NE5EQTFPRGdnTUM0ME9EUXpPREZhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16ZzFNREVnTUM0ME1ESXpNRGRETUM0Mk5EY3hPQ0F3TGpNNU16WXlPQ0F3TGpZME56RTRJREF1TXpjNU5UVTJJREF1TmpNNE5UQXhJREF1TXpjd09EYzNRekF1TmpJNU9ESXhJREF1TXpZeU1UazNJREF1TmpFMU56UTVJREF1TXpZeU1UazNJREF1TmpBM01EY2dNQzR6TnpBNE56ZE1NQzQwTWpjeU1EY2dNQzQxTlRBM05Fd3dMak0yTWpreE15QXdMalE0TmpRME5rTXdMak0xTkRJek5DQXdMalEzTnpjMk5pQXdMak0wTURFMk1pQXdMalEzTnpjMk5pQXdMak16TVRRNE1pQXdMalE0TmpRME5rTXdMak15TWpnd015QXdMalE1TlRFeU5TQXdMak15TWpnd015QXdMalV3T1RFNU55QXdMak16TVRRNE1pQXdMalV4TnpnM05rd3dMalF4TVRRNU1pQXdMalU1TnpnNE5VTXdMalF5TURFM01TQXdMall3TmpVMk5TQXdMalF6TkRJME15QXdMall3TmpVMk5TQXdMalEwTWpreU1pQXdMalU1TnpnNE5Vd3dMall6T0RVd01TQXdMalF3TWpNd04xb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TWlraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qazNOREV6SURBdU5UTXpOekpETUM0M056WXhORFVnTUM0MU1qZ3lOakVnTUM0NE1qZ3pORGNnTUM0MU5qWTNPRGtnTUM0NE5UZ3hPVFlnTUM0Mk1UTTNNekZETUM0NE56TXhOak1nTUM0Mk16Y3lOamNnTUM0NE9EYzRORGNnTUM0Mk56TXdNVFFnTUM0NE9EYzVNVFVnTUM0M01EazNORFJETUM0NE9EYzVPRGNnTUM0M05EazJOVEVnTUM0NE56VXdOVGtnTUM0M09EUXlNU0F3TGpnMU9ERTVOaUF3TGpnd09UVTJOME13TGpnME1EZzJOaUF3TGpnek5UWXlPU0F3TGpneE9EUTBPQ0F3TGpnMU56RTFOU0F3TGpjNU1ETTNPQ0F3TGpnM01USTRPVU13TGpjME16UTFOaUF3TGpnNU5Ea3hOeUF3TGpZM056ZzRJREF1T0RrMU5UWXpJREF1TmpNME9USTVJREF1T0RjeU9ERTBRekF1TlRnM01EazBJREF1T0RRM05EYzRJREF1TlRVd016RTFJREF1T0RFeE16RTNJREF1TlRNMk5qTWdNQzQzTkRnMk1EVkRNQzQxTXpFeE5UTWdNQzQzTWpNMU1Ea2dNQzQxTXpBMU1qTWdNQzQyT1RFd09ESWdNQzQxTXpneE5UTWdNQzQyTmpNeU5qRkRNQzQxTXprNU5EUWdNQzQyTlRZM016VWdNQzQxTkRNeE9UZ2dNQzQyTkRrNE5qWWdNQzQxTkRVM056UWdNQzQyTkRNME5EbERNQzQxTlRneE5USWdNQzQyTVRJMk1TQXdMalUzT1RJeU1TQXdMalU0TlRjNU5TQXdMall3TlRJeElEQXVOVFkzTWpRNFF6QXVOakUxTmpVMElEQXVOVFU1TnprMUlEQXVOakk0TXpJeklEQXVOVFV5TXpneklEQXVOak01TlRBeElEQXVOVFEzTkRNMlF6QXVOalV6TkRBNUlEQXVOVFF4TWpnZ01DNDJOelk0TWpVZ01DNDFNelV4TkRjZ01DNDJPVGMwTVRNZ01DNDFNek0zTWxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TkRZNE5Ea2dNQzQzTVRReE9UZERNQzQ0TkRZNE5Ea2dNQzQzT0RnMk1EY2dNQzQzT0RZMU1qa2dNQzQ0TkRnNU1qUWdNQzQzTVRJeE1qRWdNQzQ0TkRnNU1qUkRNQzQyTXpjM01USWdNQzQ0TkRnNU1qUWdNQzQxTnpjek9UTWdNQzQzT0RnMk1EY2dNQzQxTnpjek9UTWdNQzQzTVRReE9UZERNQzQxTnpjek9UTWdNQzQyTXprM09Ea2dNQzQyTXpjM01USWdNQzQxTnprME5qZ2dNQzQzTVRJeE1qRWdNQzQxTnprME5qaERNQzQzT0RZMU1qZ2dNQzQxTnprME5qZ2dNQzQ0TkRZNE5Ea2dNQzQyTXprM09Ea2dNQzQ0TkRZNE5Ea2dNQzQzTVRReE9UZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qazNPVEF4SURBdU5UTXpOekpETUM0M056WTJNeklnTUM0MU1qZ3lOakVnTUM0NE1qZzRNelVnTUM0MU5qWTNPRGtnTUM0NE5UZzJPRFFnTUM0Mk1UTTNNekZETUM0NE56TTJOU0F3TGpZek56STJOeUF3TGpnNE9ETXpOU0F3TGpZM016QXhOQ0F3TGpnNE9EUXdNaUF3TGpjd09UYzBORU13TGpnNE9EUTNOU0F3TGpjME9UWTFNU0F3TGpnM05UVTBOeUF3TGpjNE5ESXhJREF1T0RVNE5qZzBJREF1T0RBNU5UWTNRekF1T0RReE16VXpJREF1T0RNMU5qSTVJREF1T0RFNE9UTTJJREF1T0RVM01UVTFJREF1Tnprd09EWTJJREF1T0RjeE1qbERNQzQzTkRNNU5EUWdNQzQ0T1RRNU1UY2dNQzQyTnpnek5qZ2dNQzQ0T1RVMU5qTWdNQzQyTXpVME1UWWdNQzQ0TnpJNE1UUkRNQzQxT0RjMU9ESWdNQzQ0TkRjME56a2dNQzQxTlRBNE1EUWdNQzQ0TVRFek1UY2dNQzQxTXpjeE1UZ2dNQzQzTkRnMk1EWkRNQzQxTXpFMk5ERWdNQzQzTWpNMU1Ea2dNQzQxTXpFd01USWdNQzQyT1RFd09ETWdNQzQxTXpnMk5ESWdNQzQyTmpNeU5qSkRNQzQxTkRBME16SWdNQzQyTlRZM016VWdNQzQxTkRNMk9EWWdNQzQyTkRrNE5qY2dNQzQxTkRZeU5qSWdNQzQyTkRNME5VTXdMalUxT0RZMElEQXVOakV5TmpFeElEQXVOVGM1TnpBNUlEQXVOVGcxTnprMUlEQXVOakExTmprNUlEQXVOVFkzTWpRNFF6QXVOakUyTVRReUlEQXVOVFU1TnprMklEQXVOakk0T0RFeUlEQXVOVFV5TXpnMElEQXVOak01T1RnNUlEQXVOVFEzTkRNMlF6QXVOalV6T0RrM0lEQXVOVFF4TWpnZ01DNDJOemN6TVRNZ01DNDFNelV4TkRjZ01DNDJPVGM1TURFZ01DNDFNek0zTWxwTk1DNDJOekV5TXlBd0xqVTBOalkzTkVNd0xqWTBNVGs0TnlBd0xqVTFOREkxTmlBd0xqWXlNRFUwTlNBd0xqVTJOemd6T1NBd0xqWXdNVGc0T0NBd0xqVTRNalE0T0VNd0xqVTNORGs0TlNBd0xqWXdNell4TWlBd0xqVTFOemd6TkNBd0xqWXpNekE1TVNBd0xqVTBOemM0TmlBd0xqWTJPRFU1TkVNd0xqVXpOall3TnlBd0xqY3dPREE1TkNBd0xqVTBNemM0T0NBd0xqYzFOVGc1TXlBd0xqVTFPVEl4TmlBd0xqYzROVGswTTBNd0xqVTNOVEl4TmlBd0xqZ3hOekV3TnlBd0xqVTVOalk1T0NBd0xqZzBNVEk1TnlBd0xqWXlOekF6TkNBd0xqZzFPRE16TkVNd0xqWTFOalUwT1NBd0xqZzNORGt3T1NBd0xqWTVPREEySURBdU9EZzFOVFV4SURBdU56UXhNek0zSURBdU9EYzNNemcwUXpBdU56YzVOemcxSURBdU9EY3dNVEk0SURBdU9EQTRPVGczSURBdU9EVXpNemM0SURBdU9ETXlOemMzSURBdU9ESTROakUyUXpBdU9EWTBOakExSURBdU56azFORGcxSURBdU9Ea3dNVGcySURBdU56TTBORFl5SURBdU9EY3pNVFkwSURBdU5qY3dNVEU1UXpBdU9EWTROakV5SURBdU5qVXlPVEl5SURBdU9EWXlOalkwSURBdU5qTTBPVGs1SURBdU9EVXpNelV4SURBdU5qRTVPREkyUXpBdU9EUTRNeklnTUM0Mk1URTJNeUF3TGpnME1Ea3pOU0F3TGpZd016VTJOU0F3TGpnek16VXpPU0F3TGpVNU5UUTBNa013TGpnd05UWXlNaUF3TGpVMk5EYzROQ0F3TGpjMk1EVXdNU0F3TGpVek9ETTJOU0F3TGpjd01qUTNOQ0F3TGpVME1qRXdNVU13TGpZNU1UUXpJREF1TlRReU9ERXlJREF1TmpneE56STFJREF1TlRRek9UVXpJREF1TmpjeE1qTWdNQzQxTkRZMk56UmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpNNU5UY2dNQzQxT1RZeE9ESkRNQzQ0TURrNU5EVWdNQzQxT0RJeE55QXdMamM1TWpjeE9DQXdMalUyT1RVME15QXdMamMzTWpFMElEQXVOVFl4T0RreFF6QXVOelV3T0RFeElEQXVOVFV6T1RZZ01DNDNNalkyT0RJZ01DNDFORGN5TnpRZ01DNDJPVGd5TWpZZ01DNDFORGsyT1RsRE1DNDJOVEk0T1RZZ01DNDFOVE0xTmpJZ01DNDJNakV3TmpnZ01DNDFOek01TURFZ01DNDFPVFk0TnprZ01DNDFPVGMzTURWRE1DNDFOems1TXpZZ01DNDJNVFF6TnpnZ01DNDFOamN4T1RFZ01DNDJNelE0TURrZ01DNDFOVGczTnprZ01DNDJOVGcyTmpaRE1DNDFORFkwTWpjZ01DNDJPVE0yT1RVZ01DNDFORGN4TnpjZ01DNDNNelV3TkRFZ01DNDFOakV3TmpVZ01DNDNOekEyT0RGRE1DNDFOekk1TVRJZ01DNDRNREV3T0RJZ01DNDFPVEl6TURFZ01DNDRNalUyTURJZ01DNDJNVGszTXprZ01DNDRORFExT1RaRE1DNDJORFUxTXpNZ01DNDROakkwTlRNZ01DNDJPREkxTlRRZ01DNDROell6TURNZ01DNDNNalF4TXpRZ01DNDROekkzT1RGRE1DNDNOelEzTnpjZ01DNDROamcxTVRNZ01DNDRNVEU0TXpJZ01DNDROREkxTXpFZ01DNDRNell4TkRnZ01DNDRNVEkxT1RKRE1DNDROREl6TmprZ01DNDRNRFE1TXpNZ01DNDRORGcxTlRZZ01DNDNPVFl5TnpVZ01DNDROVEl4TlNBd0xqYzROVGt5TWtNd0xqZzFOVFkzTWlBd0xqYzNPRFEyTVNBd0xqZzFOek01TlNBd0xqYzNNek01TVNBd0xqZzFPVEF3T0NBd0xqYzNNRFk0TVVNd0xqZzJOVGMyTVNBd0xqYzFOVFUwT0NBd0xqZzJPVE0wTVNBd0xqY3pPVFU0SURBdU9EY3dORE0zSURBdU56SXhPVEV6UXpBdU9EY3pPREUxSURBdU5qWTNOVGMySURBdU9EVXlPVEE0SURBdU5qSTFNVE16SURBdU9ESXpPVFUzSURBdU5UazJNVGd5V2swd0xqZ3dPVEF6TVNBd0xqYzJNVGN6TWtNd0xqZ3dPRGt6TlNBd0xqYzJNVGt6T1NBd0xqZ3dPRGcwT1NBd0xqYzJNakV6TWlBd0xqZ3dPRGMwTnlBd0xqYzJNak0wTkVNd0xqZ3dOakl6TlNBd0xqYzJPVFV6TkNBd0xqZ3dNVGt3TmlBd0xqYzNOVFUwTlNBd0xqYzVOelUxT0NBd0xqYzRNRGcyTlVNd0xqYzRNRFUxSURBdU9EQXhOalV6SURBdU56VTBOak01SURBdU9ERTVOamsxSURBdU56RTVNakl6SURBdU9ESXlOalkyUXpBdU5qa3dNVFExSURBdU9ESTFNVEF6SURBdU5qWTBNalUySURBdU9ERTFORGczSURBdU5qUTJNakU0SURBdU9EQXpNRGczUXpBdU5qTXdOVFEwSURBdU56a3lNekV5SURBdU5qRTROakk1SURBdU56YzRPVGMwSURBdU5qRXdNamMwSURBdU56WXlPVFExUXpBdU5qQTVOelkwSURBdU56WXhPVGdnTUM0Mk1EUTVNVElnTUM0M05UQTRNRElnTUM0Mk1EUTRPVGdnTUM0M05UQXpNRGxETUM0MU9UZ3lOemtnTUM0M01qazNOemdnTUM0MU9UYzNNRFFnTUM0Mk9UWTNOallnTUM0Mk1EUTBPVGdnTUM0Mk56WTVOVFJETUM0Mk1Ea3dNekVnTUM0Mk5qTTNNek1nTUM0Mk1UWTFPRGdnTUM0Mk5EazBNallnTUM0Mk1qWTFPVFVnTUM0Mk16Z3dPVEpETUM0Mk5EQTBNVE1nTUM0Mk1qSTBORElnTUM0Mk5UUXlOREVnTUM0Mk1USTBNVFFnTUM0Mk56WXhNallnTUM0Mk1EVXpNalpETUM0Mk9EWXhNVGtnTUM0Mk1ESXdPRGtnTUM0Mk9UVXdOalFnTUM0MU9UZzNPVFVnTUM0M01EY3pOamdnTUM0MU9UZzBOamhETUM0M016Y3pOeklnTUM0MU9UYzJOamtnTUM0M05qYzVNallnTUM0Mk1URXhOQ0F3TGpjNE5ETXpNU0F3TGpZeU5UbERNQzQzT1RrME1EY2dNQzQyTXprME5qTWdNQzQ0TVRZMU9EZ2dNQzQyTmpVNE9ETWdNQzQ0TWpBNU1EZ2dNQzQyT1RBMk4wTXdMamd5TlRNMU5TQXdMamN4TmpFNE15QXdMamd5TURZeElEQXVOelF4TURreUlEQXVPREE1TURNeElEQXVOell4TnpNeVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TWpZeElEQXVOakEyT1RoTU1DNDJNakF5TVRjZ01DNDJNRFk1TWpGRE1DNDJNVFU0T0RVZ01DNDJNREE1T0RJZ01DNDJNVGN4TlRZZ01DNDFPVEkyTnpVZ01DNDJNak0xTXpnZ01DNDFPRGd3TVRoRE1DNDJNams1TVRrZ01DNDFPRE16TmlBd0xqWXpPREV4TnlBd0xqVTRORFkyTnlBd0xqWTBNalExSURBdU5Ua3dOakEyVERBdU5qUXlORGt6SURBdU5Ua3dOalkwUXpBdU5qUTJPREkySURBdU5UazJOakF6SURBdU5qUTFOVFUxSURBdU5qQTBPVEV4SURBdU5qTTVNVGN6SURBdU5qQTVOVFk0UXpBdU5qTXlOemt4SURBdU5qRTBNakkxSURBdU5qSTBOVGswSURBdU5qRXlPVEU1SURBdU5qSXdNall4SURBdU5qQTJPVGhhVFRBdU5qTTJOamczSURBdU5UazBPVGt6VERBdU5qTTJOalF6SURBdU5UazBPVE0wUXpBdU5qTTBORFkySURBdU5Ua3hPVFVnTUM0Mk16QTBNVElnTUM0MU9UQTVNalFnTUM0Mk1qY3lOVEVnTUM0MU9UTXlNekZETUM0Mk1qUXhNaUF3TGpVNU5UVXhOaUF3TGpZeU16ZzNOaUF3TGpVNU9UVTRPQ0F3TGpZeU5qQTFNeUF3TGpZd01qVTNNa3d3TGpZeU5qQTVOaUF3TGpZd01qWXpNVU13TGpZeU9ESTNOU0F3TGpZd05UWXhOQ0F3TGpZek1qTXlPQ0F3TGpZd05qWTBNU0F3TGpZek5UUTFPU0F3TGpZd05ETTFOa013TGpZek9EWXlNU0F3TGpZd01qQTBPU0F3TGpZek9EZzJOQ0F3TGpVNU56azNOeUF3TGpZek5qWTROeUF3TGpVNU5EazVNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOakU1TWpNZ01DNDFOamd3TURoTU1DNDJOamcwTXpZZ01DNDFOalU1TVRoTU1DNDJPRFkyT1RJZ01DNDFPRGN4TkRGTU1DNDJOemswTkRnZ01DNDFPRGswTmpWTU1DNDJOell5TnpZZ01DNDFPRFUyT0RGTU1DNDJOalk0TnpJZ01DNDFPRGcyT1RsTU1DNDJOalkxTWpnZ01DNDFPVE0yTVRGTU1DNDJOVGswTWpRZ01DNDFPVFU0T1V3d0xqWTJNVGt5TXlBd0xqVTJPREF3T0ZwTk1DNDJOekkyTXpnZ01DNDFPREV3TkRsTU1DNDJOamMyT1RnZ01DNDFOelE1T1V3d0xqWTJOekUzSURBdU5UZ3lPREF6VERBdU5qY3lOak00SURBdU5UZ3hNRFE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalk1T0Rjek1TQXdMalUzTkRRek0wd3dMalk1T0RjNE9DQXdMalUyTURBMU9Vd3dMamN3TlRrNU15QXdMalUyTURBNE4wd3dMamN3TlRrek55QXdMalUzTkRNeE5VTXdMamN3TlRreU1pQXdMalUzT0RBd09TQXdMamN3TnpjNElEQXVOVGM1TnpjeUlEQXVOekV3TmpNMElEQXVOVGM1TnpnMFF6QXVOekV6TkRnM0lEQXVOVGM1TnprMUlEQXVOekUxTXpVNElEQXVOVGM0TVRJZ01DNDNNVFV6TnpJZ01DNDFOelExTXpaTU1DNDNNVFUwTXlBd0xqVTJNREV5TlV3d0xqY3lNall6TlNBd0xqVTJNREUxTkV3d0xqY3lNalUzT1NBd0xqVTNORE0wTlVNd0xqY3lNalUwTnlBd0xqVTRNall4TVNBd0xqY3hOemd4TkNBd0xqVTROakl4TXlBd0xqY3hNRFV6TlNBd0xqVTROakU0TkVNd0xqY3dNekkxTmlBd0xqVTROakUxTlNBd0xqWTVPRFk1T1NBd0xqVTRNalEwTXlBd0xqWTVPRGN6TVNBd0xqVTNORFF6TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTkRnek1USWdNQzQxTnpFNU1EbE1NQzQzTkRBNU5qY2dNQzQxTmprMk5qaE1NQzQzTkRJM09ERWdNQzQxTmpNM01qRk1NQzQzTmpReU5UZ2dNQzQxTnpBeU56Wk1NQzQzTmpJME5EVWdNQzQxTnpZeU1qSk1NQzQzTlRVd09UZ2dNQzQxTnpNNU9ERk1NQzQzTkRrME16a2dNQzQxT1RJMU1rd3dMamMwTWpZMU15QXdMalU1TURRME9Vd3dMamMwT0RNeE1pQXdMalUzTVRrd09Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M09ETTNNVFlnTUM0MU56ZzJNVE5NTUM0M09EazJNak1nTUM0MU9ESTFORFJNTUM0M09EUXpNVFVnTUM0MU9UQTFNakpNTUM0M09URTRPVGNnTUM0MU9UVTFOamRNTUM0M09UY3lNRFlnTUM0MU9EYzFPRGxNTUM0NE1ETXhNVFFnTUM0MU9URTFNakZNTUM0M09EZzVNamtnTUM0Mk1USTRNelpNTUM0M09ETXdNakVnTUM0Mk1EZzVNRFJNTUM0M09EZzBNU0F3TGpZd01EZ3dOVXd3TGpjNE1EZ3lPU0F3TGpVNU5UYzFPVXd3TGpjM05UUXpPU0F3TGpZd016ZzFPRXd3TGpjMk9UVXpNU0F3TGpVNU9Ua3lOMHd3TGpjNE16Y3hOaUF3TGpVM09EWXhNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNRFF5TWpZZ01DNDRNVEUyTkROTU1DNDRNRFF5TmprZ01DNDRNVEUzTURGRE1DNDRNRGc0TWpjZ01DNDRNVGMwTnlBd0xqZ3dOemczTXlBd0xqZ3lOVGd5TVNBd0xqZ3dNVFkzTkNBd0xqZ3pNRGN4T0VNd0xqYzVOVFEzTmlBd0xqZ3pOVFl4TmlBd0xqYzROekl6TXlBd0xqZ3pORFl5TXlBd0xqYzRNalkzTlNBd0xqZ3lPRGcxTkV3d0xqYzRNall6TVNBd0xqZ3lPRGM1TmtNd0xqYzNPREEzTXlBd0xqZ3lNekF5TnlBd0xqYzNPVEF5TnlBd0xqZ3hORFkzTmlBd0xqYzROVEl5TmlBd0xqZ3dPVGMzT1VNd0xqYzVNVFF5TkNBd0xqZ3dORGc0TXlBd0xqYzVPVFkyT0NBd0xqZ3dOVGczTlNBd0xqZ3dOREl5TmlBd0xqZ3hNVFkwTTFwTk1DNDNPRGd5TmpjZ01DNDRNalF5TlV3d0xqYzRPRE14TWlBd0xqZ3lORE13T0VNd0xqYzVNRFl3TWlBd0xqZ3lOekl3TnlBd0xqYzVORFk1TWlBd0xqZ3lPREEzT0NBd0xqYzVOemMyTkNBd0xqZ3lOVFkxTVVNd0xqZ3dNRGd3TmlBd0xqZ3lNekkwT0NBd0xqZ3dNRGc1TkNBd0xqZ3hPVEUyT1NBd0xqYzVPRFl3TkNBd0xqZ3hOakkzTVV3d0xqYzVPRFUxT0NBd0xqZ3hOakl4TTBNd0xqYzVOakkyT1NBd0xqZ3hNek14TlNBd0xqYzVNakUzT0NBd0xqZ3hNalEwTkNBd0xqYzRPVEV6TnlBd0xqZ3hORGcwTjBNd0xqYzROakEyTlNBd0xqZ3hOekkzTkNBd0xqYzROVGszT0NBd0xqZ3lNVE0xTVNBd0xqYzRPREkyTnlBd0xqZ3lOREkxV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMyTkRNMU5pQXdMamcxTWpFNE5Fd3dMamMxTnprME1pQXdMamcxTkRVMU4wd3dMamN6T0RjM0lEQXVPRE0wTVRVNVREQXVOelExT1RBeklEQXVPRE14TlRFNFREQXVOelE1TWpNNUlEQXVPRE0xTVRVNFREQXVOelU0TlRBeElEQXVPRE14TnpOTU1DNDNOVGcyTWpnZ01DNDRNalk0TURsTU1DNDNOalUyTWpVZ01DNDRNalF5TVRsTU1DNDNOalF6TlRZZ01DNDROVEl4T0RSYVRUQXVOelV6TURjNElEQXVPRE01TmpJM1REQXVOelU0TWpnZ01DNDRORFUwTmpOTU1DNDNOVGcwTmpNZ01DNDRNemMyTXpOTU1DNDNOVE13TnpnZ01DNDRNemsyTWpkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpJM05qazBJREF1T0RRM016Y3hUREF1TnpJNE16STNJREF1T0RZeE56TXlUREF1TnpJeE1USTRJREF1T0RZeU1EVk1NQzQzTWpBMU1ESWdNQzQ0TkRjNE16VkRNQzQzTWpBek16Z2dNQzQ0TkRReE5EVWdNQzQzTVRnek9UZ2dNQzQ0TkRJME56UWdNQzQzTVRVMU5EZ2dNQzQ0TkRJMU9UbERNQzQzTVRJMk9UY2dNQzQ0TkRJM01qVWdNQzQzTVRBNU1EZ2dNQzQ0TkRRME9Ea2dNQzQzTVRFd05qWWdNQzQ0TkRnd05qbE1NQzQzTVRFM01ESWdNQzQ0TmpJME5qVk1NQzQzTURRMU1EUWdNQzQ0TmpJM09ETk1NQzQzTURNNE56Z2dNQzQ0TkRnMk1EWkRNQzQzTURNMU1UTWdNQzQ0TkRBek5EZ2dNQzQzTURnd05qY2dNQzQ0TXpZMU1qSWdNQzQzTVRVek16Z2dNQzQ0TXpZeU1ESkRNQzQzTWpJMk1Ea2dNQzQ0TXpVNE9DQXdMamN5TnpNMElEQXVPRE01TXpZNUlEQXVOekkzTmprMElEQXVPRFEzTXpjeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZM056VXhJREF1T0RVeE9UZzRUREF1TmpnME9USTJJREF1T0RVek9UbE1NQzQyT0RNek1EVWdNQzQ0TlRrNU9UUk1NQzQyTmpFMk1qRWdNQzQ0TlRReE5Fd3dMalkyTXpJME1pQXdMamcwT0RFek5rd3dMalkzTURZMU9DQXdMamcxTURFek9Fd3dMalkzTlRjeElEQXVPRE14TkRJeFREQXVOamd5TlRZeElEQXVPRE16TWpjeFREQXVOamMzTlRFZ01DNDROVEU1T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpReU5UUXpJREF1T0RRMk9EQTJUREF1TmpNMk5EVTJJREF1T0RRek1UVTVUREF1TmpReE16Z3pJREF1T0RNME9UTTVUREF1TmpNek5UY3hJREF1T0RNd01qVTJUREF1TmpJNE5qUTFJREF1T0RNNE5EYzJUREF1TmpJeU5UVTVJREF1T0RNME9ESTRUREF1TmpNMU56SXlJREF1T0RFeU9EWTJUREF1TmpReE9EQTRJREF1T0RFMk5URTFUREF1TmpNMk9EQTJJREF1T0RJME9EWk1NQzQyTkRRMk1UZ2dNQzQ0TWprMU5ETk1NQzQyTkRrMk1pQXdMamd5TVRFNU4wd3dMalkxTlRjd055QXdMamd5TkRnME5Vd3dMalkwTWpVME15QXdMamcwTmpnd05sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5UYzVOVGtnTUM0M09ERTJOelpXTUM0M05qQXhOVGhNTUM0Mk56YzJNRFlnTUM0M05ESXpPREpETUM0M01UQTRNVGNnTUM0M01USTJOemdnTUM0M01qWTVOVFlnTUM0Mk9UVTJNRFFnTUM0M01qYzBNalVnTUM0Mk56YzRNamxETUM0M01qYzBNalVnTUM0Mk5qVTBNek1nTUM0M01UazVOQ0F3TGpZMU5UWXdPU0F3TGpjd01qTTVPQ0F3TGpZMU5UWXdPVU13TGpZNE9UTXdNU0F3TGpZMU5UWXdPU0F3TGpZM056ZzBJREF1TmpZeU1UVTRJREF1TmpZNU9EZzNJREF1TmpZNE1qTTVUREF1TmpVNU9ETWdNQzQyTkRJM05EWkRNQzQyTnpFeU9URWdNQzQyTXpRd09USWdNQzQyT0Rrd05qWWdNQzQyTWpjd056VWdNQzQzTURrMk5Ea2dNQzQyTWpjd056VkRNQzQzTkRRd016RWdNQzQyTWpjd056VWdNQzQzTmpJNU56WWdNQzQyTkRjeE9Ea2dNQzQzTmpJNU56WWdNQzQyTnpRM09EbERNQzQzTmpJNU56WWdNQzQzTURBeU9ETWdNQzQzTkRRME9Ua2dNQzQzTWpBMk16RWdNQzQzTWpJMU1UTWdNQzQzTkRBeU56aE1NQzQzTURnME9DQXdMamMxTVRrM00xWXdMamMxTWpRME1VZ3dMamMyTlRjNE0xWXdMamM0TVRZM04wZ3dMalkxTnprMU9WWXdMamM0TVRZM05sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnpjaUlHaGxhV2RvZEQwaU1DNDNOeUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TVRJd01URTNJREF1TVRFNU9UazFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNESWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TXpZaUlHaGxhV2RvZEQwaU1DNHpOaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TlRNd01ESTVJREF1TlRNd01ESTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjUwMSIgeT0iNzMyLjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iTG9naW4gLSZndDsgT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTk4MTllM2Y3LTI1Y2UtNDQ3NC1hNGEyLTYwYzAyMzYwN2E4Yztpci50YWdzPUpTT04sSFRUUDsiIHBhcmVudD0iODciIHNvdXJjZT0iNDkiIHRhcmdldD0iNTEiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc3IiB2YWx1ZT0iT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIC0mZ3Q7IFN0dWRpbyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNzU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9NTJjYzJkMTgtNzNiZS00ZmQ4LTgxYWUtZGUzNGFiMmUxNjkxO2lyLnRhZ3M9SlNPTixIVFRQLHJldHVybiBhY2Nlc3NfdG9rZW47IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjUxIiB0YXJnZXQ9IjcwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNiIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTEzZGZmOGI5LTc4YjItNDllNy05M2ViLTBhZjQzNDk4M2I0MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ5IiB5PSI0OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNjciIHZhbHVlPSJBUEkgZ2F0ZXdheSAtJmd0OyBzdmMtY29tbW9uLWZvcm0tZ2VuZXJhdG9yIiBzdHlsZT0iaXIucmVmPWViOGRmNjFmLWQwYTQtNDkxYi1hNWI4LWY0Mzg3NWFjNGQ0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0wO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIudGFncz1BY2Nlc3MgVG9rZW4seG1sLEpTT04sSFRUUDsiIHBhcmVudD0iODciIHNvdXJjZT0iNjMiIHRhcmdldD0iMjYiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSB4PSIwLjEwMzciIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjQxIiB5PSIzMDQiLz4KICAgICAgICA8L0FycmF5PgogICAgICAgIDxteFBvaW50IGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2OCIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgQVBJIGdhdGV3YXkiIHN0eWxlPSJpci5yZWY9ZTIwNmEwYjktM2U2ZS00N2VlLWExYTYtZDE4ZmQ5ZWRhZDM2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjI1O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNzU7ZW50cnlZPTA7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci50YWdzPXhtbCxKU09OLEhUVFA7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI2IiB0YXJnZXQ9IjcwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMTY4IiB5PSIyOTQiLz4KICAgICAgICAgIDxteFBvaW50IHg9IjM2NiIgeT0iNTE0Ii8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyOCIgdmFsdWU9InN2Yy1iaXotc2VkLXNlcnZpY2UtaW52b2tlIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1mNjk4MzczYi1mZmY5LTRiNGQtYjJiYy03MzA1N2M3YmE4MDQ7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIzODQiIHk9IjQ5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzMyIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgc3ZjLWJpei1zZWQtc2VydmljZS1pbnZva2UiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTQ2NGI3NTBhLTJhYzktNDI1Zi1iNDEzLWJiMDBmMjViYTFhNjtpci50YWdzPUFjY2VzcyBUb2tlbixKU09OLFJFU1RhcGk7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI2IiB0YXJnZXQ9IjI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTAuMDEyMiIgeT0iMjEiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHk9IjEiIGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzMiIgdmFsdWU9InN2Yy1iaXotc2VkLXNlcnZpY2UtaW52b2tlIC0mZ3Q7IHN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj1mOTM2YjU0Ny00M2I1LTRkOTAtOTNmOC05ZWI2OTZjNWEyYTE7aXIudGFncz1KU09OLEhUVFA7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI4IiB0YXJnZXQ9IjI2IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMC4wMTExIiB5PSIyMSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPG14UG9pbnQgYXM9Im9mZnNldCIvPgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc5IiB2YWx1ZT0iUmVkaXMgU2VydmVyIiBzdHlsZT0iaXIucmVmPTg1YTY5MzZhLTg5YzQtNDIxOC05YmRjLWNkMWEzNGM4YmZlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1yZWRpcy1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TkRBeE9URTVJREF1TmpnNE5UVTNRekF1TXpZNU16QXpJREF1TmpjMU1EVTRJREF1TXpNMU9UUTRJREF1TmpZeE1qVTBJREF1TXpJMU9ETTNJREF1TmpVMk5ESTFRekF1TXpFMk1EUWdNQzQyTlRFMk56VWdNQzR6TVRBMElEQXVOalEzT0RFMUlEQXVNekE1T0RBMklEQXVOalEwTWpVelZqQXVOakEyTlRWSU1DNHpNVEEwUXpBdU16RXdOQ0F3TGpZd01qWTVJREF1TXpFMU56UXpJREF1TlRrNU5ESTFJREF1TXpJMU1qUXpJREF1TlRrMU5UWTFRekF1TXpRME9ETTNJREF1TlRnM09EUTNJREF1TkRVek56a3hJREF1TlRRMU1EazJJREF1TkRjMk9UUTNJREF1TlRNMk56ZzBRekF1TlRBd01UQXpJREF1TlRJNE5EY3hJREF1TlRBNE1URTVJREF1TlRJNE1UYzFJREF1TlRJM056RXlJREF1TlRNMU0wTXdMalV6TmpJMk15QXdMalV6T0RVek9DQXdMalUyTURZME5TQXdMalUwT0RFeElEQXVOVGczTURFMklEQXVOVFU0TkRZeVF6QXVOakl4TURjeklEQXVOVGN4T0RNeElEQXVOalU0TkRRMUlEQXVOVGcyTlRBeklEQXVOalk1TXpJeElEQXVOVGt3TlRFNFF6QXVOamM1TVRFNElEQXVOVGswTURneElEQXVOamcwTVRZMUlEQXVOVGszTXpRMklEQXVOamcwTVRZMUlEQXVOakF4TWpBMlZqQXVOak00TXpFMVF6QXVOamcwTVRZMUlEQXVOalF4T0RjNElEQXVOamM1TnpFeUlEQXVOalEyTURNMElEQXVOalk1TmpFNUlEQXVOalV4TXpjNFF6QXVOall3TURNNUlEQXVOalUyTXpneUlEQXVOak14TVRFeUlEQXVOalk0TnpVeklEQXVOakF4TWpRZ01DNDJPREUxTWpoRE1DNDFOamt3T0RVZ01DNDJPVFV5T0NBd0xqVXpOVGd6TlNBd0xqY3dPVFVnTUM0MU1qUTBORFlnTUM0M01UVTFNRE5ETUM0MU1ESTBOemdnTUM0M01qWTNPRFFnTUM0ME9UQXdNRGtnTUM0M01qWTNPRFFnTUM0ME56STNPVEVnTUM0M01UZzBOekpETUM0ME5qUXpNalFnTUM0M01UUXpPRFVnTUM0ME16TTBOamNnTUM0M01ERTJNVFFnTUM0ME1ERTVNVGtnTUM0Mk9EZzFOVGRhVFRBdU5EUTBPRGcwSURBdU5qTTJPRE14VERBdU5UQTFNVFVnTUM0Mk5qRTNOamhNTUM0MU16RXlOelVnTUM0Mk1qTTBOekZNTUM0ME5EUTRPRFFnTUM0Mk16WTRNekZhVFRBdU5UZzFNREE1SURBdU5qSXlOVGd4VERBdU5qTTJNRGN4SURBdU5qQXlNemt6VERBdU5UZzFNREE1SURBdU5UZ3lNakEyVERBdU5USTRNekEySURBdU5qQTBORGN4VERBdU5UYzVNelk1SURBdU5qSTBOalU1VERBdU5UZzFNREE1SURBdU5qSXlOVGd4V2swd0xqUTNOelUwSURBdU5UUTVPRFEyVERBdU5EZzFPRFV6SURBdU5UWTFNamcwVERBdU5EVTRNalF6SURBdU5UYzFOamMxVERBdU5EazFOalE1SURBdU5UYzRPVFJNTUM0MU1EY3lNamdnTUM0MU9UZ3lNemRNTUM0MU1UUXpOVE1nTUM0MU9EQTNNakZNTUM0MU5EWTNNVElnTUM0MU56YzBOVFpNTUM0MU1qRTNOelFnTUM0MU5qYzVOVFpNTUM0MU1qZ3pNRFlnTUM0MU5URTVNalJNTUM0MU1ETTJOalVnTUM0MU5UazVORXd3TGpRM056VTBJREF1TlRRNU9EUTJXazB3TGpRMk56YzBNeUF3TGpZd05EYzJPRU13TGpRMk56YzBNeUF3TGpVNU5EazNNU0F3TGpRME5qazJNaUF3TGpVNE5qazFOaUF3TGpReU1UUXpNU0F3TGpVNE5qazFOa013TGpNNU5Ua2dNQzQxT0RZNU5UWWdNQzR6TnpVeE1UZ2dNQzQxT1RRNU56RWdNQzR6TnpVeE1UZ2dNQzQyTURRM05qaERNQzR6TnpVeE1UZ2dNQzQyTVRRMU5qVWdNQzR6T1RVNUlEQXVOakl5TlRneElEQXVOREl4TkRNeElEQXVOakl5TlRneFF6QXVORFEyT1RZeUlEQXVOakl5TlRneElEQXVORFkzTnpReklEQXVOakUwTlRZMUlEQXVORFkzTnpReklEQXVOakEwTnpZNFdrMHdMalU1TnpreU1pQXdMamN3T1RJME4wTXdMall5T0RreU1pQXdMalk1TlRreUlEQXVOalU1TmpZNUlEQXVOamd5TnlBd0xqWTJPVFl4T1NBd0xqWTNOelV3TTBNd0xqWTNPVFF4TmlBd0xqWTNNalExTmlBd0xqWTROREUyTlNBd0xqWTJPREk1T1NBd0xqWTROREUyTlNBd0xqWTJOVEF6TkZZd0xqY3dNakUwTTBNd0xqWTROREUyTlNBd0xqY3dOVGN3TmlBd0xqWTNPVGN4TWlBd0xqY3dPVGcyTWlBd0xqWTJPVFl4T1NBd0xqY3hOVEl3TmtNd0xqWTJNREF6T1NBd0xqY3lNREl4SURBdU5qTXhNVEVnTUM0M016STFPRElnTUM0Mk1ERXlNemdnTUM0M05EVXpOVGhETUM0MU5qa3dPRE1nTUM0M05Ua3hNRGtnTUM0MU16VTRNelVnTUM0M056TXpNamtnTUM0MU1qUTBORFlnTUM0M056a3pNekZETUM0MU1ESTBOemdnTUM0M09UQTJNVElnTUM0ME9UQXdNRGtnTUM0M09UQTJNVElnTUM0ME56STNPVEVnTUM0M09ESXpRekF1TkRZME16STFJREF1TnpjNE1qRXpJREF1TkRNek5EWTVJREF1TnpZMU5EUXlJREF1TkRBeE9USXhJREF1TnpVeU16ZzJRekF1TXpZNU16QTBJREF1TnpNNE9EZzNJREF1TXpNMU9UUTRJREF1TnpJMU1EZ3lJREF1TXpJMU9ETTNJREF1TnpJd01qVXpRekF1TXpFMk1EUWdNQzQzTVRVMU1ETWdNQzR6TVRBMElEQXVOekV4TmpReklEQXVNekV3TkNBd0xqY3dOemM0TkZZd0xqWTNNREE0TVVNd0xqTXhNRFFnTUM0Mk56TTVOQ0F3TGpNeE5qQTBJREF1TmpjM056azVJREF1TXpJMk1UTTBJREF1TmpneU5UUTVRekF1TXpNMk16RTRJREF1TmpnM05EZzNJREF1TXpjeE1EUTNJREF1TnpBeE9ERWdNQzQwTURRME55QXdMamN4TlRVNU5FTXdMalF6TlRNME9TQXdMamN5T0RNeU9TQXdMalEyTlRFeE5pQXdMamMwTURZd05TQXdMalEzTXpNNE5DQXdMamMwTkRVNU5rTXdMalE1TURZd01pQXdMamMxTWprd09TQXdMalV3TWpjM05DQXdMamMxTXpJd05pQXdMalV5TkRjME15QXdMamMwTVRZeU9FTXdMalV6TlRjeU15QXdMamN6TlRrNE9TQXdMalUyTmprME9DQXdMamN5TWpVMk5DQXdMalU1TnpreU1pQXdMamN3T1RJME4xcE5NQzQxT1RjNU1qSWdNQzQzTnpBM1F6QXVOakk0T1RJeUlEQXVOelUzTXpjeklEQXVOalU1TmpZNUlEQXVOelEwTVRVeklEQXVOalk1TmpFNUlEQXVOek00T1RVMlF6QXVOamM1TkRFMklEQXVOek16T1RBNUlEQXVOamcwTVRZMUlEQXVOek13TURVZ01DNDJPRFF4TmpVZ01DNDNNalkwT0RkV01DNDNOak0xT1RkRE1DNDJPRFF4TmpVZ01DNDNOamN4TlRrZ01DNDJOemszTVRJZ01DNDNOekV6TVRVZ01DNDJOamsyTVRrZ01DNDNOelkyTlRsRE1DNDJOakF3TXprZ01DNDNPREUyTmpNZ01DNDJNekV4TVNBd0xqYzVOREF6TlNBd0xqWXdNVEl6T0NBd0xqZ3dOamd4TVVNd0xqVTJPVEE0TXlBd0xqZ3lNRFUyTWlBd0xqVXpOVGd6TlNBd0xqZ3pORGM0TWlBd0xqVXlORFEwTmlBd0xqZzBNRGM0TkVNd0xqVXdNalEzT0NBd0xqZzFNakEyTlNBd0xqUTVNREF3T1NBd0xqZzFNakEyTlNBd0xqUTNNamM1TVNBd0xqZzBNemMxTTBNd0xqUTJORE15TlNBd0xqZ3pPVFkyTmlBd0xqUXpNelEzTVNBd0xqZ3lOamc1TmlBd0xqUXdNVGt5TlNBd0xqZ3hNemcwTVVNd0xqTTJPVE13TnlBd0xqZ3dNRE0wTVNBd0xqTXpOVGswT1NBd0xqYzROalV6TlNBd0xqTXlOVGd6TnlBd0xqYzRNVGN3TmtNd0xqTXhOakEwSURBdU56YzJPVFUySURBdU16RXdOQ0F3TGpjM016QTVOaUF3TGpNeE1EUWdNQzQzTmpreU16ZFdNQzQzTXpFMU16UkRNQzR6TVRBMElEQXVOek0xTXpreklEQXVNekUyTURRZ01DNDNNemsxTlNBd0xqTXlOakV6TkNBd0xqYzBOREF3TTBNd0xqTXpOak14T0NBd0xqYzBPRGswSURBdU16Y3hNRFEzSURBdU56WXpNall6SURBdU5EQTBORGNnTUM0M056Y3dORGRETUM0ME16VXpORGtnTUM0M09EazNPRElnTUM0ME5qVXhNVFlnTUM0NE1ESXdOVGdnTUM0ME56TXpPRFFnTUM0NE1EWXdOVU13TGpRNU1EWXdNaUF3TGpneE5ETTJNaUF3TGpVd01qYzNOQ0F3TGpneE5EWTFPU0F3TGpVeU5EYzBNeUF3TGpnd016QTRNVU13TGpVek5UY3lNeUF3TGpjNU56UTBNaUF3TGpVMk5qazBPQ0F3TGpjNE5EQXhOeUF3TGpVNU56a3lNaUF3TGpjM01EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQyMSIgeT0iMzU1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI4MCIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgUmVkaXMgU2VydmVyIiBzdHlsZT0iaXIucmVmPTFjYTcwM2JhLTgxZWEtNGM2MC1hOGNjLWM1ZDViYjllM2EzNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iODciIHNvdXJjZT0iMjYiIHRhcmdldD0iNzkiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8QXJyYXkgYXM9InBvaW50cyI+CiAgICAgICAgICA8bXhQb2ludCB4PSIyMzQiIHk9IjM2MCIvPgogICAgICAgIDwvQXJyYXk+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iODEiIHZhbHVlPSJSZWRpcyBTZXJ2ZXIgLSZndDsgc3ZjLWNvbW1vbi1mb3JtLWdlbmVyYXRvciIgc3R5bGU9ImlyLnJlZj1kYjkzMWJiMC01ZWExLTQzZTUtYTBiZi1jOTg1NWY2ODY2MzE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI4NyIgc291cmNlPSI3OSIgdGFyZ2V0PSIyNiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjI2OCIgeT0iMzIwIi8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzNyIgdmFsdWU9IlBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9MGNjMjZhYzItYmUxOS00NTMzLTgyYjItMWQ4NmNkNGUyNDBmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2MzUiIHk9IjM1OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNDMiIHZhbHVlPSJzdmMtYml6LXNlZC1zZXJ2aWNlLWludm9rZSAtJmd0OyBQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPTc0NTZlODkyLWIzYWItNGRjMS05N2FkLTJhN2JjNDA3NDFhNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjc1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjU7ZW50cnlZPTA7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci50YWdzPUpEQkM7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI4IiB0YXJnZXQ9IjM3IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI0MiIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj03NGRhYWNhZi1jZjg2LTRhZmUtYjYxNC1lNjM3YWU4OTU2Y2I7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIudGFncz1KREJDOyIgcGFyZW50PSI4NyIgc291cmNlPSIyNiIgdGFyZ2V0PSIzNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjQyOSIgeT0iMzA3Ii8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OCIgdmFsdWU9Ik1pZ3JhdGlvbiBtaWNyb3NlcnZpY2VzIiBzdHlsZT0iaXIucmVmPWJjZTVhNTA1LTJmY2UtNDEzMy1hMDE5LWEyNGE5NDgyNWZhYjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NzQiIHk9IjQ5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OSIgdmFsdWU9Ik1pZ3JhdGlvbiBtaWNyb3NlcnZpY2VzIC0mZ3Q7IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9NTE1MTQ1NjUtODExNy00ZWE4LThkYzctNzBjMThjNDE4MjA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnRhZ3M9SkRCQzsiIHBhcmVudD0iODciIHNvdXJjZT0iNTgiIHRhcmdldD0iMzciIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijg0IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSAtJmd0OyBBUEkgZ2F0ZXdheSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9NzkxNmQ3ZDgtYWYyOC00MzJiLWI0ZjQtNDQwZDVhYTBlYzVhO2lyLnRhZ3M9QWNjZXNzIFRva2VuLHhtbCxKU09OLEhUVFBTLFJFU1RhcGk7IiBwYXJlbnQ9IjM0IiBzb3VyY2U9IjgzIiB0YXJnZXQ9IjYzIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTAuNDg4IiB5PSIyMyIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMjY3IiB5PSIzNzUiLz4KICAgICAgICA8L0FycmF5PgogICAgICAgIDxteFBvaW50IGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1NCIgdmFsdWU9IlN0dWRpbyAtJmd0OyBzdmMtY29tbW9uLWZvcm0tZ2VuZXJhdG9yIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj02N2E3NDVlYi00NGFmLTQ5N2ItYjk5MS05ZjExMzNlMTEyZjY7aXIudGFncz14bWwsSlNPTixIVFRQUztlbnRyeVg9MDtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIzNCIgc291cmNlPSI3MiIgdGFyZ2V0PSI3MCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9Ii0wLjEzOTkiIHk9Ii0xOSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPG14UG9pbnQgeD0iMzU3IiB5PSI4NC4xMjUiIGFzPSJzb3VyY2VQb2ludCIvPgogICAgICAgIDxteFBvaW50IHg9IjUyMCIgeT0iNDc3IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgICA8bXhQb2ludCB4PSItMSIgYXM9Im9mZnNldCIvPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjM3MSIgeT0iNTgwIi8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3NSIgdmFsdWU9IlN0dWRpbyAtJmd0OyBXZWIgVUkiIHN0eWxlPSJpci5yZWY9ZDgxODMzZjAtMmNhYS00MWY1LWI0OGYtOTJiMTBhNmEyYjc1O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNzU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMzQiIHNvdXJjZT0iNzAiIHRhcmdldD0iNzIiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8QXJyYXkgYXM9InBvaW50cyI+CiAgICAgICAgICA8bXhQb2ludCB4PSIyMjYiIHk9IjcwMSIvPgogICAgICAgIDwvQXJyYXk+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogIDwvcm9vdD4KPC9teEdyYXBoTW9kZWw+Cg==</schema>
-  </diagram>
-  <trustZones>
-    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
-  </trustZones>
-  <questions/>
-  <assets/>
-  <settings/>
-  <dataflows>
-    <dataflow name="Studio -&gt; API gateway" ref="0e3ee209-6133-41fe-ab7d-477f5ecd4274" source="1109d524-d643-4eca-92e2-38b9ccf070f7" target="c31bf547-b418-44fb-8d64-f592cbea254d">
-      <assets/>
-      <tags>
-        <tag tag="Access Token"/>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-      </tags>
-    </dataflow>
-    <dataflow name="API gateway -&gt; Login" ref="128a0e8b-be64-4dc3-a9ab-248d91505aba" source="c31bf547-b418-44fb-8d64-f592cbea254d" target="d8b0b4ff-d891-43e6-8637-fa76bed6da36">
-      <assets/>
-      <tags>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-        <tag tag="xml"/>
-      </tags>
-    </dataflow>
-    <dataflow name="svc-common-form-generator -&gt; Redis Server" ref="1ca703ba-81ea-4c60-a8cc-c5d5bb9e3a34" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="85a95b22-8293-49eb-be6d-aaa441e54e11">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="svc-common-form-generator -&gt; svc-biz-sed-service-invoke" ref="464b750a-2ac9-425f-b413-bb00f25ba1a6" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="0dd85c2b-afa1-409c-b6ff-39941d67abf8">
-      <assets/>
-      <tags>
-        <tag tag="Access Token"/>
-        <tag tag="JSON"/>
-        <tag tag="RESTapi"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Migration microservices -&gt; PostgreSQL" ref="51514565-8117-4ea8-8dc7-70c18c418206" source="159009df-8374-4463-8b8c-8f8c38f279ae" target="df661557-3440-41ad-a563-621fc3f3e0cb">
-      <assets/>
-      <tags>
-        <tag tag="JDBC"/>
-      </tags>
-    </dataflow>
-    <dataflow name="OAuth2 Authorization Server -&gt; Studio" ref="52cc2d18-73be-4fd8-81ae-de34ab2e1691" source="efa06989-4844-444d-9db0-effc951e280c" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
-      <assets/>
-      <tags>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-        <tag tag="return access_token"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Studio -&gt; svc-common-form-generator" ref="67a745eb-44af-497b-b991-9f1133e112f6" source="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
-      <assets/>
-      <tags>
-        <tag tag="HTTPS"/>
-        <tag tag="JSON"/>
-        <tag tag="xml"/>
-      </tags>
-    </dataflow>
-    <dataflow name="svc-biz-sed-service-invoke -&gt; PostgreSQL" ref="7456e892-b3ab-4dc1-97ad-2a7bc40741a4" source="0dd85c2b-afa1-409c-b6ff-39941d67abf8" target="df661557-3440-41ad-a563-621fc3f3e0cb">
-      <assets/>
-      <tags>
-        <tag tag="JDBC"/>
-      </tags>
-    </dataflow>
-    <dataflow name="svc-common-form-generator -&gt; PostgreSQL" ref="74daacaf-cf86-4afe-b614-e637ae8956cb" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="df661557-3440-41ad-a563-621fc3f3e0cb">
-      <assets/>
-      <tags>
-        <tag tag="JDBC"/>
-      </tags>
-    </dataflow>
-    <dataflow name="RESTful Web Service -&gt; API gateway" ref="7916d7d8-af28-432b-b4f4-440d5aa0ec5a" source="54c2adc5-954b-49bd-9f1c-295b16a74473" target="c31bf547-b418-44fb-8d64-f592cbea254d">
-      <assets/>
-      <tags>
-        <tag tag="Access Token"/>
-        <tag tag="HTTPS"/>
-        <tag tag="JSON"/>
-        <tag tag="RESTapi"/>
-        <tag tag="xml"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Login -&gt; OAuth2 Authorization Server" ref="9819e3f7-25ce-4474-a4a2-60c023607a8c" source="d8b0b4ff-d891-43e6-8637-fa76bed6da36" target="efa06989-4844-444d-9db0-effc951e280c">
-      <assets/>
-      <tags>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-      </tags>
-    </dataflow>
-    <dataflow name="Studio -&gt; Web UI" ref="d81833f0-2caa-41f5-b48f-92b10a6a2b75" source="1109d524-d643-4eca-92e2-38b9ccf070f7" target="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="Redis Server -&gt; svc-common-form-generator" ref="db931bb0-5ea1-43e5-a0bf-c9855f686631" source="85a95b22-8293-49eb-be6d-aaa441e54e11" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
-      <assets/>
-      <tags/>
-    </dataflow>
-    <dataflow name="svc-common-form-generator -&gt; API gateway" ref="e206a0b9-3e6e-47ee-a1a6-d18fd9edad36" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
-      <assets/>
-      <tags>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-        <tag tag="xml"/>
-      </tags>
-    </dataflow>
-    <dataflow name="API gateway -&gt; svc-common-form-generator" ref="eb8df61f-d0a4-491b-a5b8-f43875ac4d46" source="c31bf547-b418-44fb-8d64-f592cbea254d" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
-      <assets/>
-      <tags>
-        <tag tag="Access Token"/>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-        <tag tag="xml"/>
-      </tags>
-    </dataflow>
-    <dataflow name="svc-biz-sed-service-invoke -&gt; svc-common-form-generator" ref="f936b547-43b5-4d90-93f8-9eb696c5a2a1" source="0dd85c2b-afa1-409c-b6ff-39941d67abf8" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
-      <assets/>
-      <tags>
-        <tag tag="HTTP"/>
-        <tag tag="JSON"/>
-      </tags>
-    </dataflow>
-  </dataflows>
-  <customFields/>
-  <components>
-    <component uuid="7a5e9411-bc0d-4aee-ad35-341bf4d0013c" diagramComponentId="07edaf38-85d5-4fc2-97a1-ffffc921c8c4" ref="efa06989-4844-444d-9db0-effc951e280c" name="OAuth2 Authorization Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
-      <tags/>
-      <questions>
-        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
-        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
-          <desc>If the client does not provide enough protection, an attacker or
-   disgruntled employee could retrieve the passwords for a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.341">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This attack can still be effective even when CSRF defense/the "state" parameter (see 
- &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
- &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.159">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
-          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.599">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.919">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.598">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.921">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
-          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
- Impact: Access to a single user's data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:38.516">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The attacker conducts the following flow:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
-          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
-          <desc>OAuth makes no attempt to verify the authenticity of the
-   authorization server.  A hostile party could take advantage of this
-   by intercepting the client's requests and returning misleading or
-   otherwise incorrect responses.  This could be achieved using DNS or
-   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
-   and similar protocols may cause users to become inured to the
-   practice of being redirected to web sites where they are asked to
-   enter their passwords.  If users are not careful to verify the
-   authenticity of these web sites before entering their credentials, it
-   will be possible for attackers to exploit this practice to steal
-   users' passwords.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.654">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>An attacker could attempt to replay valid requests in order to obtain
-   or to modify/destroy user data.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.599">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.842">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
-          <desc>If access tokens are sent via URI query parameters, such tokens may
-   leak to log files and the HTTP "referer".
- 
-</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
-          <desc>When obtaining end-user authorization, the end user may not
-   understand the scope of the access being granted and to whom, or they
-   may end up providing a client with access to resources that should
-   not be permitted.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.334">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
-&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.993">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: 
-&lt;div&gt;
-  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, the client makes the following HTTP request using transport-layer security: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
-&lt;/div&gt; 
-&lt;div&gt;
-  Host: server.example.com 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Check that the access token is not passed using this way. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.521">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>There are three different flows that can be used: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
-  &lt;li&gt;Device flow&lt;/li&gt; 
-  &lt;li&gt;Client credentials flow&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Ensure that the system is using one of them. 
- &lt;/div&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.277">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
-  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
- &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.333">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The expiration time is determined by several factors, including:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.522">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are other ways to achieve a reasonable security level, as described in the following sections. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that public clients don't store client secrets.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.334">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.607">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.773">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An authorization interface typically has the following components: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Website name and logo&lt;/li&gt; 
-  &lt;li&gt;User identification&lt;/li&gt; 
-  &lt;li&gt;Application details&lt;/li&gt; 
-  &lt;li&gt;The requested scope&lt;/li&gt; 
-  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
-  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
- &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
-&lt;div&gt; 
- &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.334">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Considerations to migrate to OAuth2.1:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Additional recommendations: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
-  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
-  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
- &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt; 
-  &lt;ol&gt; 
-  &lt;/ol&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
-            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
-&lt;div&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
-  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
-  &lt;ol&gt; 
-   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
-  &lt;/ol&gt; 
-  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
-  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
- &lt;/ol&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references>
-              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
- &lt;ul&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check at least one of the following: 
-&lt;br&gt; 
-&lt;ul&gt; 
- &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references>
-              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Public clients could be: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Single-page apps&lt;/li&gt; 
-  &lt;li&gt;Browser-based apps&lt;/li&gt; 
-  &lt;li&gt;Mobile apps&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.334">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This is a countermeasure against: Abuse of revealed client secrets for private clients 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:38.482">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
-&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
-&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
-            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
-              <output/>
-            </source>
-            <references>
-              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
-              <reference name="RFC7636" url="https://tools.ietf.org/html/rfc7636"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  This countermeasure helps to mitigate:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;modifications of the message and&lt;/li&gt; 
-   &lt;li&gt;replay attempts&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.996">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;detect token leakage and&lt;/li&gt; 
-  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;div&gt;
-   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
-  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
- &lt;/div&gt; 
- &lt;div&gt;
-   &amp;nbsp; 
-  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the following bindings are set: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
-  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
-  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
-  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.996">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-347">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An adversary exploits a weakness to bypass authorization system</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.2.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.2.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.10">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.4">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
-                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
-                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
-                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
-                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.4.1.5">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.3.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.2">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.6.7">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An adversary attempts to retrieve tokens by guessing</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.6.3">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="RFC6819-4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.1">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
-                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.11">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="RFC6819-4.4.1.12">
-                  <countermeasures>
-                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
-                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="769af225-d13b-4813-96ef-d48038e1a699" diagramComponentId="1617c6c4-010c-45c8-9085-1837a1d600c3" ref="d8b0b4ff-d891-43e6-8637-fa76bed6da36" name="Login" desc="" library="IR-Functional-Components" parentComponentRef="1109d524-d643-4eca-92e2-38b9ccf070f7" componentDefinitionRef="CD-LOGIN">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses/>
-      <countermeasures>
-        <countermeasure ref="C-SET-TIMESTAMP-ON-REQUEST" name="Attach timestamps or sequence numbers to each sent message" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To avoid replay attacks, a type of man in the middle attack, it is recommended to add a timestamp or sequence numbers in the exchanged messages, this will allow the receiver to discard messages with a duplicated sequence number or timestamp.&lt;/p&gt;&lt;p&gt;An example of sequence number in its messages is the TCP protocol with its ACK.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Transaction Authorization Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Review code application.&lt;/li&gt;&lt;li&gt;Check the exchanged messages and verifies if there is a timestamp or sequence number and that no duplicates are allowed.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-654" name="Authenticate users (multi - or two-factor - authentication [2FA])" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For more sensitive applications hosting data or functionality requiring greater assurance over the identification of users, a multi - or two-factor - authentication process is recommended. Together with asserting their identity and a password/phrase/PIN (something you know), such systems require additional factors, such as biometric validation (something you are), user-initiated action such as a button press on a FIDO hardware key or a token (something you have).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement multi-factor authentication for applications providing access to sensitive data or functionality, and for highly privileged user access (e.g. administrators).&lt;/li&gt;&lt;li&gt;This should leverage something such as a soft or hard-token verification in addition to the secret password/pass-phrase for example.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-          </references>
-          <standards>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5.2.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.5" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.9" supportedStandardRef="nist-800-63"/>
-            <standard ref="6.1.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check for authentication functions of the component.&lt;/li&gt;&lt;li&gt;Verify at least a combination of the following factors is used within the authentication process.&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Something that you are: mainly biometric characteristics of yourself such as fingerprint, facial recognition, iris recognition, etc.)&lt;/li&gt;&lt;li&gt;Something that you know: a PIN, password, pass phrase, etc.&lt;/li&gt;&lt;li&gt;Something that you have: a hardware token, a card, a dongle, a mobile phone, etc.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-AUTHZ-AFTER-AUTHN" name="Authorize after you authenticate" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Authorization should be conducted as an explicit check, and as necessary even after an initial authentication has been completed. Authorization depends not only on the privileges associated with an authenticated user, but also on the context of the request. The time of the request and the location of the requesting user may both need to be taken into account.&lt;/p&gt;&lt;p&gt;Sometimes a user's authorization for a system or service needs to be revoked, for example, when an employee leaves a company. If the authorization mechanism fails to allow for such revocation, the system is vulnerable to abuse by authenticated users exercising out-of-date authorizations.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Authorize After You Authenticate" url="https://cybersecurity.ieee.org/blog/2015/11/13/authorize-after-you-authenticate/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Validate that no authorization process is conducted before an authentication process has previously finished.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-SAML-VERIFY-IDP-X509" name="Check if the X509Certificate entity is really the correct certificate for your Identity Provider" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It is necessary to ensure the identity of the supplier by verifying the certificate of the messages, to ensure that it is the correct one.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="SAML Raider - SAML2 Burp Extension" url="https://github.com/portswigger/saml-raider"/>
-            <reference name="SAML Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check if it is possible to remove the signature&lt;/li&gt;&lt;li&gt;Sign the SAML Response with own certificate&lt;/li&gt;&lt;li&gt;Check the signature algorithm in use&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-524" name="Clear caches of sensitive data" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Applications storing or caching data locally are at risk of attack and compromise of that data. Local temporary storage, thumbnail images, and configuration files often contain excerpts of sensitive information that may be left on the device during or after the application is used.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure all temporary files, caches, and storage are purged after use and when the application is closed.&lt;/li&gt;&lt;li&gt;Do not allow the application to cache sensitive information outside of the OS provided secure stores.&lt;/li&gt;&lt;li&gt;Use OS controls to restrict thumbnails of the application in cases where sensitive information is displayed.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP MASVS - Android - Testing Whether the Keyboard Cache Is Disabled for Text Input Fields" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-the-keyboard-cache-is-disabled-for-text-input-fields-mstg-storage-5"/>
-            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
-          </references>
-          <standards>
-            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check the application for the use of caching.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify they are periodically emptied.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.858">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-IMPLEMENT-SSO" name="Consider using Single Sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Single Sign-on (SSO) occurs when a user logs in to one application and is then signed in to other applications automatically, regardless of the platform, technology, or domain the user is using. The user signs in only one time, hence the name of the feature (Single Sign-on).&lt;/p&gt;&lt;p&gt;SSO provides a seamless experience for users when using your applications and services. Instead of having to remember separate sets of credentials for each application or service, users can simply log in once and access your full suite of applications.&lt;/p&gt;&lt;p&gt;Whenever users go to a domain that requires authentication, they are redirected to the authentication domain where they may be asked to log in. If the user is already logged in at the authentication domain, they can be immediately redirected to the original domain without signing in again.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Single Sign-On" url="https://auth0.com/docs/authenticate/single-sign-on"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if there is any chance to connect to a SSO from your application&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
-                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
-                            within the application.&lt;/li&gt;
-                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
-                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
-                            or PUT request).&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                            &lt;ol&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.213">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.1" name="Ensure sensitive data is not revealed through error output messages" issueId="" issueLink="" platform="" cost="0" risk="37" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure the application does not output error messages or stack traces containing sensitive
-                        data that could assist an attacker, including the session id, software/framework versions and
-                        personal information.</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-          </references>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application does not output error massages or stack traces containing sensitive data.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.361">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" name="Ensure that access control mechanisms are centralized" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access control, authentication and authorization procedures should be centralized, and all roles, permissions, groups and users shall be controlled - or gain access - through this mechanism.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To ensure roles, groups and permissions are assigned properly to users, we need to have centralized access control, to grant or deny access easily and securely.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that access control mechanisms are centralized.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.360">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.038">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.037">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-FORCE-LOGOUT" name="Force logout if account permissions have been revoked" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Active sessions could be used by a malicious actor even after the account has been removed or blocked from the system. This could open the door to MitM attacks and session hijacking attacks while the application connects to the IdP to confirm that the session has no more rights to operate.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Man-in-the-middle Attack" url="https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack"/>
-            <reference name="Session Hijacking Attack" url="https://owasp.org/www-community/attacks/Session_hijacking_attack"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check periodically the session status with the SSO/IdP and force the log off process in case the active account was blocked/deleted.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.364">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="37" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.364">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-THREAD-CONCURRENCY" name="Implement threading, concurrency and asynchronicity" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to make your application more responsive to a user and maximize the performance of your user's computer, we have different coding techniques. Not so long ago, apps got faster simply by buying a newer PC or server and then that trend has reversed. Users still want responsive UI and business owners want servers that scale with their business. The transition to mobile and cloud and an internet-connected population of &amp;gt;3B users has resulted in a new set of software patterns.&lt;/p&gt;&lt;p&gt;Using multiple threads of execution is one of the most powerful ways to keep your application responsive to the user and at the same time make use of the processor in between or even during user events.&lt;/p&gt;&lt;p&gt;We use concurrency to take advantage of the hardware, so you can parallelize your code to distribute work across multiple processors.&lt;/p&gt;&lt;p&gt;Async programming is a key technique that makes it straightforward to handle blocking I/O and concurrent operations on multiple cores.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Parallel Processing, Concurrency, and Async Programming in .NET" url="https://docs.microsoft.com/en-us/dotnet/standard/parallel-processing-and-concurrency"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for bottlenecks in the workflow of the application that may cause a denial of service attack if exploited such as a misconfigured file reader that blocks the main thread if more than one file is uploaded to the application.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ACCOUNT-LOCKDOWN" name="Instead of completely locking out an account, place it in a lockdown mode with limited capabilities" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Depending on how critical the application is, accounts can be entirely locked out or just flagged to have most of their permissions removed. This is useful to ensure that the user experience remains good while at the same time protect the system of potential attacks due to an account misuse.&lt;/p&gt;&lt;p&gt;Developers should check that this lockdown mode doesn't reveal any potential information that could be relevant to an attacker as well as the actions that the user can do. Developers must provide a process to recover the account to its normal behavior.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Attempt to login several times with a wrong password&lt;/li&gt;&lt;li&gt;Login with the right password and check if the behavior is the same with and without having failed the login attempts.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-TOKEN-TIMEOUT" name="Invalidate a session after a predefined idle time has passed" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to keep the authenticated state and track the users progress, applications provide users with a session identifier or token which binds the user authentication credentials to the user HTTP traffic and the appropriate access controls enforced by the web application.&lt;/p&gt;&lt;p&gt;It is mandatory to set expiration timeouts for every session, establishing the amount of time a session will remain active. Insufficient session expiration by the web application increases the exposure of other session-based attacks, as for the attacker to be able to reuse a valid session ID and hijack the associated session.&lt;/p&gt;&lt;p&gt;The session expiration timeout values must be set accordingly with the purpose and nature of the web application, and balance security and usability. There are two automatic session expiration, iddle timeout and absolute timeout. Both values are highly dependent on how critical the web application and its data are. Common idle timeouts ranges are 2-5 minutes for high-value applications and 15-30 minutes for low risk applications. Absolute timeouts depend on how long a user usually uses the application. If the application is intended to be used by an office worker for a full day, an appropriate absolute timeout range could be between 4 and 8 hours.&lt;/p&gt;&lt;p&gt;When a session expires, the web application must take active actions to invalidate the session on both sides, client and server. The latter is the most relevant and mandatory from a security perspective.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Set session timeout to the minimal value possible depending on the context of the application.&lt;/li&gt;&lt;li&gt;Avoid "infinite" session timeout.&lt;/li&gt;&lt;li&gt;Prefer declarative definition of the session timeout in order to apply a global timeout for all application sessions.&lt;/li&gt;&lt;li&gt;Trace session creation/destruction in order to analyse the creation trend and try to detect a normal number of session creations (application profiling phase in a attack).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-OTP-BRUTE-FORCE" name="Prevent brute force attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement appropriate protection to prevent users from brute-forcing token generation and token checking with mechanisms such as rate limiting or CAPTCHA. And remember that OTP length must be at least 6 characters long and a combination of different characters (not only numbers, not only letters, ...).&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Protect Against Automated Attacks" url="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#protect-against-automated-attacks"/>
-          </references>
-          <standards>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if there is any captcha enabled and investigate if making continuous requests with an automated tool like Burp it is still accepting the request and generating or checking OTPs.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:53.905">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-OTP-INVALID" name="Prevent old or used OTPs from being reused by invalidating them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;One-time passwords (OTP) are secrets used during operations that need added security or as part of user enrollment processes. Despite their short lifespan, only one OTP should be valid at any given time, and therefore, all previous OTPs should be invalidated whenever a new one is generated or after the OTP has expired.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Forgot Password Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html"/>
-            <reference name="Invalidate Previous OTPs" url="https://docs.fluidattacks.com/criteria/requirements/347"/>
-          </references>
-          <standards>
-            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Request an OTP and try to use it a couple of times. Verify that the OTP cannot be used twice or more.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:53.906">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-PREVENT-SIMULTANEOUS-LOGIN" name="Prevent Simultaneous Logins" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;It's possible that the application needs or wants to have simultaneous session, in this case, please control the number of the total active session and limit it.&lt;/p&gt;&lt;p&gt;If the application does not want to allow simultaneous session logons, it must take effective actions after each new authentication event, implicitly terminating the previously available session, or asking the user (through the old, new or both sessions) about the session that must remain active.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Open different browsers, or a "normal" tab and an "anonymous" tab, and check the following points:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Have you received some notification in some tab?&lt;/li&gt;&lt;li&gt;Was it possible to log in on the new login attempt? if the answer is yes, then has the previously open session been closed?&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If the first session has been closed, it is recommended to check that it has been carried out correctly. To do this, use a proxy in the process, and forward requests prior to logout and check the response.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-SESSION-ID-ON-PARAMETER" name="Prevent the attacker from making the user use his session by accepting session IDs only from cookies, not from GET or POST parameters" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The preferred session ID exchange mechanism should allow defining advanced token properties, such as the token expiration date and time, or granular usage constraints. This is one of the reasons why cookies (RFCs 2109 &amp;amp; 2965 &amp;amp; 6265) are one of the most extensively used session ID exchange mechanisms, offering advanced capabilities not available in other methods.&lt;/p&gt;&lt;p&gt;The usage of specific session ID exchange mechanisms, such as those where the ID is included in the URL, might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines), as well as facilitate other attacks, such as the manipulation of the ID or session fixation attacks.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Review the code and check where the session ID is set.&lt;/li&gt;&lt;li&gt;Functional test, review the traffic (requests and responses), and verify thtat the session ID only appears in the cookie.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
- &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
- &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
- &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
-  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;b&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
-&lt;ul&gt; 
- &lt;ul&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
- &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
- &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
- &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
- &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
- &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
- &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
- &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;ul&gt; 
-&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
-            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt; 
- &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
- &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
-&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
-&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
-&lt;ul&gt; 
- &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
- &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
- &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
- &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
- &lt;li&gt;at least 10 characters&lt;/li&gt; 
- &lt;li&gt;at most 128 characters&lt;/li&gt; 
-&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-NEW-LOCATION-LOGIN-ALERT" name="Send a message to the user each time the system detects that the user is logging in from a new device or IP" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Aside from the IP address, there are a number of different factors that can be used to attempt to fingerprint a device. Some of these can be obtained passively by the server from the HTTP headers (particularly the "User-Agent" header), including:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Operating system&lt;/li&gt;&lt;li&gt;Browser&lt;/li&gt;&lt;li&gt;Language&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Using JavaScript it is possible to access far more information, such as:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Screen resolution&lt;/li&gt;&lt;li&gt;Installed fonts&lt;/li&gt;&lt;li&gt;Installed browser plugins&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Using these various attributes, it is possible to create a fingerprint of the device. This fingerprint can then be matched against any browser attempting to login to the account, and if it doesn't match then the user can be prompted for additional authentication. Many users will have multiple devices or browsers that they use, so it is not practical to block attempts that do not match the existing fingerprints.&lt;/p&gt;&lt;p&gt;To take in mind: data submitted from client can be spoofed by an attacker.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Credential Stuffing Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use the application and try to log in from different devices. Note the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Does the notification arrive?&lt;/li&gt;&lt;li&gt;Are the user's trusted devices saved in server (DB)?&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
-                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
-                        directives to control what data may be cached, where, and for how long. It is important to specify
-                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
-                        of authenticated and otherwise restricted access data, either in the users' browser or other
-                        devices.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
-                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
-                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
-                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-          </references>
-          <standards>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.859">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
-  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
- &lt;/ul&gt;&lt;/span&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
-          </references>
-          <standards>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;span&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt; 
- &lt;ul&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
-   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/ul&gt; 
- &lt;ol&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
-  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
- &lt;/ol&gt;&lt;/span&gt; 
-&lt;span&gt;&lt;/span&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:55.110">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-IMPLEMENT-LOGOUT" name="The logout function should be prominently visible to the user" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Developers must create a logout functionality that is clearly visible for the user when navigating the application.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check if the logout functionality is accessible and how hard it is to disconnect from the application.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-SIGN-REQUESTS" name="Use of digital signatures to make it easier for the receiver to authenticate if the sender is really the person they think they are" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Making use of digital signatures on exchanged messages will make it more difficult for man-in-the-middle attacks to occur, so add a digital signature to your important messages if you want to verify the sender identity.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Top Ten Proactive Controls 2018 - C6: Implement Digital Identity" url="https://owasp.org/www-project-proactive-controls/v3/en/c6-digital-identity"/>
-            <reference name="RFC7515" url="https://tools.ietf.org/html/rfc7515"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Review code application and configuration&lt;/li&gt;&lt;li&gt;Check the exchanged messages and verify if signature is being used.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-ONE-TIME-PASSWORD" name="Use one-time passwords" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Use One Time Password (TOTP) codes. This can be achieved with:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Hardware&lt;/li&gt;&lt;li&gt;Software (cheaper option).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Software option would typically involve the user installing a TOTP application on their mobile phone, and then scanning a QR code provided by the web application which provides the initial seed. The authenticator app then generates a six digit number every 30 or 60 seconds.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Multi-Factor Authentication Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Try logging into the application several times:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do you use the same password all the time?&lt;/li&gt;&lt;li&gt;Or do you use a different password each time?&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.038">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="C-RANDOM-SESSION-KEYS" name="Use random-session session keys, which are time-specific and will change with time making it difficult for an attacker to fool the receiver with an old message" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks, where an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good Cryptographically Secure Pseudorandom Number Generator must be used.&lt;/p&gt;&lt;p&gt;Additionally, a random session ID is not enough; it must also be unique to avoid duplicated IDs. A random session ID must not already exist in the current session ID space.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Log in and log out, while saving the session IDs and check:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The session id is different in every log in to the application?&lt;/li&gt;&lt;li&gt;Is it predictable? For example, one session ID is 123ABC&lt;strong&gt;D&lt;/strong&gt; and the next 123ABC&lt;strong&gt;E&lt;/strong&gt; (the example contains a short key to understanding).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To perform these checks it is possible to use DevTools from the browser or an easier way using a proxy to logall requests.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>A short expiration time for tokens is a means of protection against
-   the following threats:&amp;nbsp;  
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;online guessing (a short expiration time will reduce the
-      likelihood of success)&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;
-Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
-          <implementations/>
-          <references>
-            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the token expiration time in the authorization server policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.038">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="FILE-DATA-CHECK" name="Validate the file format before processing" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Attackers may attempt to bypass controls on uploaded content by renaming, embedding, or otherwise manipulating benign files with malicious content. As with client-side data, the application should screen uploaded content before processing it.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;File contents and file-system path data must be checked for safety.&lt;/li&gt;&lt;li&gt;Consider directory traversal, local file inclusion, and OS injection attacks when validating filenames.&lt;/li&gt;&lt;li&gt;Verify the MIME type is correct and appropriate, and matches content.&lt;/li&gt;&lt;li&gt;Files with an structured format should be checked against the expected format/definition (e.g. XML against a XSD or DTD).&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: XXE" url="https://pwning.owasp-juice.shop/part2/xxe.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A4:2017-XML External Entities (XXE)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify structured data being processed by your component which is coming from untrusted sources.&lt;/li&gt;&lt;li&gt;Check there is a validation method for the format and the structure.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Examples of this is to check JSON against a JSON schema, XML against an XSD or a DTD, or checking that a received file which is purported to be an image is actually an image.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.038">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAML-2.0-SC-C-6.4.3" name="Verify SAML assertion signatures and authenticate the issuer" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  The browser/POST profile requires the SAML response carrying SAML assertions to be signed, thus providing both message integrity and authentication. The Service Provider site MUST verify the signature and authenticate the issuer. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   The following recommendations were proposed in response: 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Always perform schema validation on the XML document prior to using it for any security--related purposes:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Always use local, trusted copies of schemas for validation.&lt;/li&gt; 
-    &lt;li&gt;Never allow automatic download of schemas from third party locations.&lt;/li&gt; 
-    &lt;li&gt;If possible, inspect schemas and perform schema hardening, to disable possible wildcard -type or relaxed processing statements.&lt;/li&gt; 
-   &lt;/ul&gt; 
-   &lt;li&gt;Securely validate the digital signature:&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.&lt;/li&gt; 
-    &lt;li&gt;If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.&lt;/li&gt; 
-    &lt;li&gt;If you expect a heterogeneous signed documents (many certificates from many identity providers, multi-level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.&lt;/li&gt; 
-   &lt;/ul&gt; 
-   &lt;li&gt;Avoid signature-wrapping attacks.&lt;/li&gt; 
-   &lt;ul&gt; 
-    &lt;li&gt;Never use getElementsByTagName to select security related elements in an XML document without prior validation.&lt;/li&gt; 
-    &lt;li&gt;Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.&lt;/li&gt; 
-   &lt;/ul&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
-            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
-            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
-            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
-          <threats>
-            <threat ref="CAPEC-37-CRACK-PASSWORD-HASH" name="A malicious user has access to the users' password hashes and tries to crack the passwords" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Although it is not possible to "decrypt" password hashes to obtain the original passwords, it is possible to "crack" the hashes in some circumstances.&lt;/p&gt;&lt;p&gt;The basic steps are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Select a password you think the victim has chosen (e.g.password1!).&lt;/li&gt;&lt;li&gt;Calculate the hash.&lt;/li&gt;&lt;li&gt;Compare the hash you calculated with the hash of the victim. If they match, you have correctly "cracked" the hash and now know the plaintext value of their password.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This process is repeated for a large number of potential passwords. Different methods can be used to select candidate passwords, including:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Lists of passwords obtained from other compromised sites.&lt;/li&gt;&lt;li&gt;Brute force (trying every possible candidate).&lt;/li&gt;&lt;li&gt;Dictionaries or wordlists of common passwords&lt;/li&gt;&lt;/ul&gt;</desc>
-              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-600-SESSION-REUSE" name="An attacker can reuse old session credentials or session IDs for authorization" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;At his town's public library, John logs onto his bank's Web site to transfer money from his checking account to his savings account. Once John completes his transaction he gets distracted, forgets to sign off from his bank's Web site, and walks away from the computer.&amp;nbsp;&lt;/p&gt;&lt;p&gt;A second user, Malcolm, now uses the same computer as John. Instead of using the browser to navigate to a new site, Malcolm simply explores the browser history to return to the previous URL where John's account information was displayed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Because John's session is still active Malcolm can now transfer money, open new accounts, order additional credit cards, or perform any other actions available to John via the bank's Web site.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-IMPLEMENT-LOGOUT" mitigation="50"/>
-                <countermeasure ref="C-TOKEN-TIMEOUT" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-112-OTP-GENERATION-ABUSE" name="An attacker can send a lot of OTP requests to increase the likelihood of matching one of the generated codes in a later brute force attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;For example, in a password reset functionality based on the delivery of a code by email or SMS to the user, an attacker can send a lot of requests to it, generating a lot of valid codes with the goal of increasing the chances of matching the code in a brute force attack. The attack takes place in the following steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Automation of requests to the password reset functionality (new codes don't invalidate older ones).&lt;/li&gt;&lt;li&gt;Creation of a custom dictionary to try to match valid codes (e.g.: if a code has only 5 numbers, the dictionary is as follows: [00000, 00001,..., 99999]).&lt;/li&gt;&lt;li&gt;Brute force attack on the functionality to check the OTP and find a match.&lt;/li&gt;&lt;li&gt;Once the attacker knows a valid code he/she can proceed with the password change.&lt;/li&gt;&lt;/ol&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-OTP-BRUTE-FORCE" mitigation="50"/>
-                <countermeasure ref="C-OTP-INVALID" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-593-SSO-SYNC" name="Attackers are able to keep their application session active after the SSO/IdP blocks/deletes their account" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;If a user successfully logs in via SSO and falls prey to a phishing attack, the attacker gets access to all the endpoints of the external applications within the cloud that the user is provisioned for.&lt;/p&gt;&lt;p&gt;If the attack is detected, the user account can be disabled. However, the user may still remain logged in. This could allow the attacker to stay logged on with access to the linked application.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-FORCE-LOGOUT" mitigation="50"/>
-                <countermeasure ref="security-logging" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-49-BRUTE-FORCE-AUTH" name="Attackers can brute force the authentication system to find valid credentials" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Hackers launch brute-force attacks using widely available tools that utilize wordlists and smart rulesets to intelligently and automatically guess user passwords. Although such attacks are easy to detect, they are not so easy to prevent.&lt;/p&gt;&lt;p&gt;For example, many HTTP brute-force tools can relay requests through a list of open proxy servers. Since each request appears to come from a different IP address, you cannot block these attacks simply by blocking the IP address. To further complicate things, some tools try a different username and password on each attempt, so you cannot lock out a single account for failed password attempts.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.1" mitigation="16"/>
-                <countermeasure ref="C-ACCOUNT-LOCKDOWN" mitigation="16"/>
-                <countermeasure ref="CWE-654" mitigation="16"/>
-                <countermeasure ref="network-rate-limit" mitigation="20"/>
-                <countermeasure ref="require-use-strong-passwords" mitigation="16"/>
-                <countermeasure ref="security-logging" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115-LOGIN-BYPASS" name="Attackers can bypass the login system using a less hardened alternative for accessing the system" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;The basic way to take advantage of the application's access control flaws is called "forced browsing".&lt;/p&gt;&lt;p&gt;Let's say that the website http://mysite.com It is a website that supports the authenticity of the user and the administrator will be taken to the appropriate webpage after validation. But if an attacker knows the URL, he or she can enter it in their browser, for example&lt;/p&gt;&lt;p&gt;http://mysite.com/admin_page or http://mysite.com/user_page&lt;/p&gt;&lt;p&gt;If it is a secure website, it will be redirected to the login page. But if those pages are allowed to be accessed, it will be incomplete access control and will cause damage.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="20"/>
-                <countermeasure ref="C-AUTHZ-AFTER-AUTHN" mitigation="20"/>
-                <countermeasure ref="CWE-603" mitigation="20"/>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="20"/>
-                <countermeasure ref="security-logging" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-575-ENUM-USERS" name="Attackers can enumerate the existence of valid accounts in the system using error/informational messages" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;If your login page has different error messages for unrecognized usernames and incorrect passwords, an attacker can write a script to submit lengthy lists of common usernames and test the response. With those results, the attacker can then infer which usernames are valid.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.1" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="security-logging" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130-DOS-AUTH" name="Attackers can execute Denial of Service attacks to prevent valid users from accessing the system" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An attacker leverages the security functionality of the system aimed at thwarting potential attacks (like automatic block of accounts after a number of failed login attempts) to launch a denial of service attack against a legitimate system user.&lt;/p&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.1" mitigation="25"/>
-                <countermeasure ref="C-THREAD-CONCURRENCY" mitigation="25"/>
-                <countermeasure ref="network-rate-limit" mitigation="25"/>
-                <countermeasure ref="security-logging" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-180-SAML-SPOOFING" name="Attackers can modify the SAML response from the Identify Provider and change assertions' values to impersonate valid users in the Service Provider" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Sometimes not only does the Service Provider fail to check the validity of the signature in the SAML response, but it doesn't even verify its mere presence. The equivalent of a Service Provider accepting unsigned SAML assertions is accepting a username without checking the password.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-SAML-VERIFY-IDP-X509" mitigation="50"/>
-                <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-INJECTION" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Some of the most common types of injection attacks are SQL injections, cross-site scripting (XSS), code injection, OS command injection, host header injection, and more. A large part of vulnerabilities that exist in web applications can be classified as injection vulnerabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Scenario #1: An application uses untrusted data in the construction of the following vulnerable SQL call:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;String query = "SELECT * FROM accounts WHERE custID='' request.getParameter("id") + '';&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Scenario #2: Similarly, an application's blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)):&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;Query HQLQuery = session.createQuery("FROM accounts WHERE custID=' '+ request.getParameter("id") + "'");&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In both cases, the attacker modifies the 'id' parameter value in their browser to send: ' or '1'='1. For example:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;http://example.com/app/accountView?id=''or '1'='1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data, or even invoke stored procedures.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="20"/>
-                <countermeasure ref="DATA-VAL" mitigation="20"/>
-                <countermeasure ref="FILE-DATA-CHECK" mitigation="20"/>
-                <countermeasure ref="SER-UNTRUST" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-600-CRED-STUFFING" name="Attackers take control of another user's account without being detected if they get to know the password for that account" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Credential stuffing is the automated injection of stolen username and password pairs ("credentials") in to website login forms, in order to fraudulently gain access to user accounts.&lt;/p&gt;&lt;p&gt;Since many users will re-use the same password and username/email, when those credentials are exposed (by a database breach or phishing attack, for example) submitting those sets of stolen credentials into dozens or hundreds of other sites can allow an attacker to compromise those accounts too.&lt;/p&gt;&lt;p&gt;Credential Stuffing is a subset of the brute force attack category. Brute forcing will attempt to try multiple passwords against one or multiple accounts; guessing a password, in other words. Credential Stuffing typically refers to specifically using known (breached) username / password pairs against other websites.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-IMPLEMENT-SSO" mitigation="20"/>
-                <countermeasure ref="C-NEW-LOCATION-LOGIN-ALERT" mitigation="20"/>
-                <countermeasure ref="C-PREVENT-SIMULTANEOUS-LOGIN" mitigation="20"/>
-                <countermeasure ref="CWE-654" mitigation="20"/>
-                <countermeasure ref="security-logging" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-60-MALICIOUS-REPLY" name="Attackers use replay attacks to execute malicious actions" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;A replay attack is a kind of man-in-the-middle attack in which an attacker sniffs messages being sent on a channel to intercept them and resend them under the cloak of authentic messages. What makes the replay attack particularly harmful is that the attacker does not even need to decrypt the message they resend but can still fool the receiver into thinking that the received message is legitimate.&lt;/p&gt;&lt;p&gt;One example of replay attack is called pass the hash. This is referring to the hash value that is associated with a password that is sent across the network during the authentication process. If the attacker can gain access to the hash, they may be able to replay that hash back to the server and pretend that they are the original workstation.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-ONE-TIME-PASSWORD" mitigation="20"/>
-                <countermeasure ref="C-RANDOM-SESSION-KEYS" mitigation="20"/>
-                <countermeasure ref="C-SET-TIMESTAMP-ON-REQUEST" mitigation="20"/>
-                <countermeasure ref="C-SIGN-REQUESTS" mitigation="20"/>
-                <countermeasure ref="RFC6819-5.1.5.3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-37-CACHED-DATA" name="Sensitive data is compromised by inspecting cached data in the client side" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;An attacker can also use a decompiler to decompile a downloaded Java applet in order to look for information such as hardcoded IP addresses, file paths, passwords or other such contents.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="CWE-524" mitigation="50"/>
-                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-37-SENSITIVE-DATA-URL" name="Sensitive data is compromised through query parameters in the URL" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;Regardless of using encryption, the following URL will expose information in the locations detailed below:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;https://vulnerablehost.com/authuser?user=bob&amp;amp;authz_token=1234&amp;amp;expire=1500000000&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The parameter values for user, authz_token, and expire will be exposed in the following locations when using HTTP or HTTPS:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Referer Header&lt;/li&gt;&lt;li&gt;Web Logs&lt;/li&gt;&lt;li&gt;Shared Systems&lt;/li&gt;&lt;li&gt;Browser History&lt;/li&gt;&lt;li&gt;Browser Cache&lt;/li&gt;&lt;li&gt;Shoulder Surfing&lt;/li&gt;&lt;/ul&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="CWE-598" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-61-SESSION-FIXATION" name="The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
-              <desc>&lt;p&gt;The attack consists of obtaining a valid session ID (e.g. by connecting to the application), inducing a user to authenticate himself with that session ID, and then hijacking the user-validated session by the knowledge of the used session ID. The attacker has to provide a legitimate Web application session ID and try to make the victim's browser use it. There are several techniques to execute the attack; it depends on how the Web application deals with session tokens. Below are some of the most common techniques:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Session token in the URL argument.&lt;/li&gt;&lt;li&gt;Session token in a hidden form field.&lt;/li&gt;&lt;li&gt;Session ID in a cookie.&lt;/li&gt;&lt;li&gt;Client-side script.&lt;/li&gt;&lt;/ul&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses/>
-              <countermeasures>
-                <countermeasure ref="C-SESSION-ID-ON-PARAMETER" mitigation="50"/>
-                <countermeasure ref="secure-session-generation-and-expiration" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="fc222786-f608-4e45-a224-5b3906f57c3c" diagramComponentId="69a11068-97c5-443a-9f2f-3d27bf8ddac9" ref="c31bf547-b418-44fb-8d64-f592cbea254d" name="API gateway" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.778">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
-          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
-&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.777">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.534">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="45" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.537">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="AG-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="f45db819-cb21-44a4-b104-ce48b698c7eb" diagramComponentId="f698373b-fff9-4b4d-b2bc-73057c7ba804" ref="0dd85c2b-afa1-409c-b6ff-39941d67abf8" name="svc-biz-sed-service-invoke" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.844">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.843">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.440">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.170">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.382">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.726">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.086">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.383">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.383">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.727">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.727">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.727">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.728">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.728">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.383">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="1c358fa5-3231-4311-bba9-f096b40a6fd5" diagramComponentId="c5e47650-fb9e-49cb-b085-390017bf57c1" ref="54c2adc5-954b-49bd-9f1c-295b16a74473" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.665">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.663">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The API is vulnerable to injection flaws if:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
-  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
-  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.665">
-              <output/>
-            </source>
-            <references>
-              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
-              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
-              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
-              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
-Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
-                        data will be valid.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
-          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.172">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.582">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.666">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.686">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.173">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software supports a session in which more than one behavior
-                        must be performed by an actor, but it does not properly ensure that the actor
-                        performs the behaviors in the required sequence.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.688">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.523">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes
-                        output that is written to logs.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.588">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.525">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.685">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.527">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.527">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
-          <desc>Information written to log files can be of a sensitive nature
-                        and give valuable guidance to an attacker or expose sensitive user
-                        information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.584">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
-          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.583">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
-          <desc>Product A handles inputs or steps differently than Product B,
-          which causes A to perform incorrect actions based on its perception of B's
-          state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.666">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.666">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:25.519">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
-          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software logs too much information, making log files hard
-                        to process and possibly hindering recovery efforts or forensic analysis after an
-                        attack.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.583">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.174">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
-          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:30.093">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.686">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
-          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
-          <desc/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.920">
-              <output/>
-            </source>
-            <references>
-              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
-              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
-          </references>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.090">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.104">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.995">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="19" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
-                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
-                            notifies the security group.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.088">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
-          </references>
-          <standards>
-            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.093">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="16" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Develop a log retention policy to identify storage requirements for device logs and implement
-                        procedures to ensure that the audit logs are available for a security response in the case of
-                        incident or investigation.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
-                        logs should be archived in a protected storage and should be accessible in the future as
-                        required for incidents or investigations.
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-          </references>
-          <standards>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
-                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.965">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.921">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="16" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
-                        data should be included in the logs
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Review the logs.&lt;/li&gt;
-                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.089">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.090">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
-          <implementations/>
-          <references>
-            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
-            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
-          </references>
-          <standards>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
-&lt;ul&gt;
- &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
- &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
- &lt;li&gt;Caching/Persistence&lt;/li&gt;
- &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
- &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
-              <output/>
-            </source>
-            <references>
-              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
-              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.482">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
-              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.916">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation:&lt;/b&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-&lt;/div&gt;
-&lt;div&gt;
-  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.921">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="48" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
-                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
-                        each log file.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
-                            tools for log monitoring.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.967">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="48" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
-                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
-                            newline and/or carriage return.&lt;/li&gt;
-                            &lt;li&gt;If not, then check that there is a central function that escapes these
-                            meta-characters before writing them to the log file.&lt;/li&gt;
-                            &lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.484">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.108">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.215">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.672">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
-            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
-            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
-              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
-   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
-  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="8" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
-            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
-            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
-              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
-            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
-            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.970">
-              <output/>
-            </source>
-            <references>
-              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.485">
-              <output/>
-            </source>
-            <references>
-              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="48" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the number of accounts with privileges to modify the logs is limited and
-                            controlled.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
-  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
-  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
-  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.968">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
-                        information to track user actions within the system. These logs should be forensically sound,
-                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
-                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
-                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
-                        source).&lt;/li&gt;
-                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
-                        or not introduced in logs).&lt;/li&gt;
-                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
-                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
-                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;div&gt;
-                        Source:&amp;nbsp;&amp;nbsp;
-                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
-                        &lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
-            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
-            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
-            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
-            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
-            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
-              <output/>
-            </source>
-            <references>
-              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
-                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.970">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement functionality to record backend TLS connection failures and include these in the
-                        logs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="8" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.108">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="19" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
-            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
-          </references>
-          <standards>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.090">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:25.453">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
-            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.998">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
-            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
-            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
-                            ntpd in Linux based systems).&lt;/li&gt;
-                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="34" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.106">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
-            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
-            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
-            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
-            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
-&lt;/div&gt;
-&lt;div&gt;
-  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;b&gt;Remediation&lt;/b&gt;
-&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
-          <implementations/>
-          <references>
-            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
-          </references>
-          <standards>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all application components are using the same encoding style.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.921">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="34" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.918">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.106">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-203">
-                  <countermeasures>
-                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
-                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="review-api-responses" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="review-api-responses" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
-                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-authentication">
-                  <countermeasures>
-                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
-          <threats>
-            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
-                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-285">
-                  <countermeasures>
-                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-object-level-authorization">
-                  <countermeasures>
-                    <countermeasure ref="object-level-authorization" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                <countermeasure ref="object-level-authorization" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
-    &lt;br&gt;
-    &lt;br&gt;See references for more information.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
-              </references>
-              <weaknesses>
-                <weakness ref="AV-DOS-APP">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L3">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-L4">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="AV-DoS-TLS">
-                  <countermeasures>
-                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
-                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
-                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
-                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-276">
-                  <countermeasures>
-                    <countermeasure ref="deny-default-enf" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="deny-default-enf" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-460">
-                  <countermeasures>
-                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="error-handling-centralized" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
-  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br /&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;div&gt;
-  &lt;b&gt;Attack Scenario&lt;/b&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;ol&gt;
-   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
-   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
-   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
-   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
-   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
-  &lt;/ol&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-350">
-                  <countermeasures>
-                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="identify-dns-domains" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-541">
-                  <countermeasures>
-                    <countermeasure ref="CWE-541" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-541" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-841">
-                  <countermeasures>
-                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
-                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-770">
-                  <countermeasures>
-                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                    <countermeasure ref="network-rate-limit" mitigation="34"/>
-                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
-                <countermeasure ref="network-rate-limit" mitigation="34"/>
-                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-272">
-                  <countermeasures>
-                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-117">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-8.8" mitigation="20"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
-                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Automated attacks against many user accounts, or successful attacks against an account
-                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
-                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
-                                &lt;div&gt;
-                                &amp;nbsp;
-                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
-                                authentication system, attackers stand a greater chance of success.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-778">
-                  <countermeasures>
-                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                    <countermeasure ref="CWE-662" mitigation="14"/>
-                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                    <countermeasure ref="security-logging" mitigation="14"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
-                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
-                <countermeasure ref="CWE-662" mitigation="14"/>
-                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
-                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
-                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
-                <countermeasure ref="security-logging" mitigation="14"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-532">
-                  <countermeasures>
-                    <countermeasure ref="CWE-532" mitigation="70"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-779">
-                  <countermeasures>
-                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-532" mitigation="70"/>
-                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
-          <threats>
-            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-918">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                    <countermeasure ref="CWE-601" mitigation="25"/>
-                    <countermeasure ref="DATA-VAL" mitigation="25"/>
-                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
-                <countermeasure ref="CWE-601" mitigation="25"/>
-                <countermeasure ref="DATA-VAL" mitigation="25"/>
-                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
-&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
-&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
-&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
-&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
-&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-95">
-                  <countermeasures>
-                    <countermeasure ref="dyn-exec" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="dyn-exec" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-15">
-                  <countermeasures>
-                    <countermeasure ref="configuration-integrity" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="configuration-integrity" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="80"/>
-                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="80"/>
-                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-116">
-                  <countermeasures>
-                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-502">
-                  <countermeasures>
-                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
-                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="api-vulnerable-injection">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-                                This type of attack targets the communication between two components (typically client
-                                and server). The attacker places himself in the communication channel between the two
-                                components. Whenever one component attempts to communicate with the other (data flow,
-                                authentication challenges, etc.), the data first goes to the attacker, who has the
-                                opportunity to observe or alter it, and it is then passed on to the other component as
-                                if it was never intercepted. This interposition is transparent leaving the two
-                                compromised components unaware of the potential corruption or leakage of their
-                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
-                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-319">
-                  <countermeasures>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-436">
-                  <countermeasures>
-                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="rest-content-type-val" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
-&lt;/div&gt;
-&lt;div&gt;
-  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-assets-inventory">
-                  <countermeasures>
-                    <countermeasure ref="inventory-api" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="inventory-api" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="ea7d658f-8db8-4ec8-bf98-03cbb31acfc2" diagramComponentId="3eb87443-3b2b-4ec5-9706-2fb4239ab091" ref="295a899b-e1f6-4ff3-8227-1dd1855f2ab6" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.251">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.505">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.694">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.694">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.380">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.252">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.252">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.252">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.252">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.835">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.837">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.836">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.352">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.448">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.836">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.837">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="3cd34698-e9ff-4860-a4d6-307c2636830e" diagramComponentId="13dff8b9-78b2-49e7-93eb-0af434983b41" ref="79ecf6b7-7801-4bf8-8946-781e16059de9" name="svc-common-form-generator" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions>
-        <question ref="microservices.comm.sync.http.rest" answer="true" manuallyModified="false"/>
-      </questions>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.618">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.613">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The API is vulnerable to injection flaws if:
-&lt;/div&gt;
-&lt;div&gt;
- &lt;ul&gt;
-  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
-  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
-  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
- &lt;/ul&gt;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.617">
-              <output/>
-            </source>
-            <references>
-              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
-              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
-              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
-              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.374">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.907">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
-          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
-                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
-                        &lt;div&gt;
-                        &amp;nbsp;
-                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
-                        mechanism for verifying that it was intentionally sent, then it might be possible for an
-                        attacker to trick a client into making an unintentional request to the web server which will be
-                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
-                        and can result in exposure of data or unintended code execution.
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.625">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.373">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.449">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.441">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:24.448">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>An information exposure is the intentional or unintentional disclosure of information to an
-                        actor that is not explicitly authorized to have access to that information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.624">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
-          <desc>A directory listing is inappropriately exposed, yielding
-                        potentially sensitive information to attackers.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.907">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
-          <desc>Product A handles inputs or steps differently than Product B,
-          which causes A to perform incorrect actions based on its perception of B's
-          state.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.622">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.624">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.908">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.623">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
-          <desc>The server contains a protection mechanism that assumes that
-                        any URI that is accessed using HTTP GET will not cause a state change to the
-                        associated resource. This might allow attackers to bypass intended access
-                        restrictions and conduct resource modification and deletion attacks, since some
-                        applications allow GET to modify state.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify the areas of the application that can be affected by the following causes:
-                            &lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
-                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
-                            behavior.&lt;/li&gt;
-                            &lt;/ol&gt;
-                            &lt;div&gt;
-                            Perform testing on them to look for a security problem.&amp;nbsp;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:24.449">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.831">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.801">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.292">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.542">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
-                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
-                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.831">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
-            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
-            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
-          </references>
-          <standards>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-          </references>
-          <standards>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
-                            Using a command line web client like telnet or netcat could help on this task.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.831">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.356">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
-              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
-                            methods: GET and POST.&lt;/li&gt;
-                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
-                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
-          <implementations/>
-          <references>
-            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>
-                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
-                            &lt;br /&gt;
-                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
-                            &lt;br /&gt;
-                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
-                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
-                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
-                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
-                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
-                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
-                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
-                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
-                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
-                            &lt;br /&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.805">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Application security can be undermined by misconfiguration of the underlying server or
-                        development environment.
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;br /&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
-                        such as:
-                        &lt;/div&gt;
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
-                        data in transit and at rest.&lt;/li&gt;
-                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
-                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
-                        stack traces should not be returned to users).&lt;/li&gt;
-                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
-                        methods).&lt;/li&gt;
-                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
-                        structures (e.g. passwords in configuration files).&lt;/li&gt;
-                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                        &lt;div&gt;&lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
-            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.378">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.293">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
-            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
-            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
-            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
-          </references>
-          <standards>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.806">
-              <output/>
-            </source>
-            <references>
-              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
-              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
-              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
-              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
-            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
-            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.379">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
-              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="8" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
-            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.379">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:21.380">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
-              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.380">
-              <output/>
-            </source>
-            <references>
-              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="8" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:21.381">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-                        Reject requests containing unexpected or missing content type headers with HTTP response status
-                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
-                        &lt;/div&gt;
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
-            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
-          </references>
-          <standards>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.805">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-          </references>
-          <standards>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
-                            necessary.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.806">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>
-                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
-                        &lt;p&gt;&lt;/p&gt;
-                        &lt;ul&gt;
-                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
-                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
-                         &lt;ul&gt;
-                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
-                         &lt;/ul&gt;
-                        &lt;/ul&gt;
-                    </desc>
-          <implementations>
-            <implementation platform="Spring.java">
-              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.544">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.832">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.381">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
-&lt;div&gt;
- &lt;div&gt;
-  &lt;ul&gt;
-  &lt;/ul&gt;
- &lt;/div&gt;
- &lt;div&gt;
-  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;blockquote&gt;
-   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
-  &lt;/blockquote&gt;
-  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
- &lt;/div&gt;
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
-              <output/>
-            </source>
-            <references>
-              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.804">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="review-api-responses" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="review-api-responses" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
-                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-authentication">
-                  <countermeasures>
-                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
-          <threats>
-            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
-                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="CWE-285">
-                  <countermeasures>
-                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="api-broken-object-level-authorization">
-                  <countermeasures>
-                    <countermeasure ref="object-level-authorization" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="centralized-authz-module" mitigation="50"/>
-                <countermeasure ref="object-level-authorization" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-2">
-                  <countermeasures>
-                    <countermeasure ref="ENV-USE" mitigation="50"/>
-                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ENV-USE" mitigation="50"/>
-                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
-&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
-&lt;br&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-352">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-18.8" mitigation="34"/>
-                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
-                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-601">
-                  <countermeasures>
-                    <countermeasure ref="CWE-601" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-601" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>An attacker monitors data streams to or from a target in order to gather information.
-                                This attack may be undertaken in order to gather information to support a later attack,
-                                or the data collected may be the end goal of the attack. This attack usually involves
-                                sniffing network traffic, but may include observing other types of data streams, such as
-                                radio. In most varieties of this attack, the attacker is passive and simply observes
-                                regular communication, however in some variants the attacker may attempt to initiate the
-                                establishment of a data stream or influence the nature of the data transmitted. However,
-                                in all variants of this attack, and distinguishing this attack from other data
-                                collection methods, the attacker is not the intended recipient of the data stream.
-                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
-                                (e.g. network traffic) and reading the content. This differs from attacks that collect
-                                more qualitative information, such as communication volume, or other information not
-                                explicitly communicated via a data stream.
-                            </desc>
-              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-200">
-                  <countermeasures>
-                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASVS-11.5" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-173">
-                  <countermeasures>
-                    <countermeasure ref="harden-http-headers" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-235">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="50"/>
-                <countermeasure ref="harden-http-headers" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
-                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="api-vulnerable-injection">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-436">
-                  <countermeasures>
-                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="rest-content-type-val" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
-&lt;/div&gt;
-&lt;div&gt;
-  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
- &lt;br&gt;
-&lt;/div&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-assets-inventory">
-                  <countermeasures>
-                    <countermeasure ref="inventory-api" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="inventory-api" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
-              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-915">
-                  <countermeasures>
-                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
-                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>The application could be tricked into exposing data to unauthorized users by
-                                manipulating the parameters it accepts. All data received from the client side could be
-                                subject to manipulation, including fields like cookies and HTTP headers, if these are
-                                used as inputs to the application.
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="CWE-147" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-22">
-                  <countermeasures>
-                    <countermeasure ref="CWE-639" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-548">
-                  <countermeasures>
-                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-650">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-147" mitigation="25"/>
-                <countermeasure ref="CWE-639" mitigation="25"/>
-                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
-                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="7e80910b-1d71-4d8e-b743-66004cf62914" diagramComponentId="85a6936a-89c4-4218-9bdc-cd1a34c8bfe0" ref="85a95b22-8293-49eb-be6d-aaa441e54e11" name="Redis Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="redis-server">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:54.098">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.875">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-943" name="Improper Neutralization of Special Elements in Data Query Logic" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.&lt;/p&gt;&lt;p&gt;Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated&lt;/li&gt;&lt;li&gt;Append additional commands to the query&lt;/li&gt;&lt;li&gt;Return more entities than intended&lt;/li&gt;&lt;li&gt;Return fewer entities than intended&lt;/li&gt;&lt;li&gt;Cause entities to be sorted in an unexpected way&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The ability to execute additional commands or change which entities are returned has obvious risks. But when the application logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the application query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges.&lt;/p&gt;&lt;p&gt;While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and NoSQL languages.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.430">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-943: Improper Neutralization of Special Elements in Data Query Logic" url="https://cwe.mitre.org/data/definitions/943.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  There are at least two subtypes of OS command injection:&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T11:03:53.497">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.497">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.876">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="redis-server-exposed" name="The Redis server is exposed" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;If access is permitted from other servers or public access, compromise is more likely, as the Redis server is exposed.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.497">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:54.037">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.691">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-redis-access-localhost-only" name="Secure Redis Server access to localhost only" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;By default, Redis server is - and should only be - accessible from the localhost. But if access has been allowed from other servers or public access, likelihood of compromise increases.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Redis configuration file, # vim /usr/local/redis/6379.conf&lt;/li&gt;&lt;li&gt;Once opened, look for 'bind' parameter &amp;amp; change it to, bind 127.0.0.1 ::1&lt;/li&gt;&lt;li&gt;Save the file &amp;amp; exit. Now restart the Redis service to implement the changes made.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Check the Redis server is only accessible from localhost.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.438">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-redis-renaming-dangerous-commands" name="Secure Redis Server by renaming or disabling dangerous commands" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In order to avoid any serious repercussions if someone gains access to their Redis server, Redis provides a way to rename some of the dangerous commands like:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;LUSHDB,&lt;/li&gt;&lt;li&gt;FLUSHALL,&lt;/li&gt;&lt;li&gt;KEYS,&lt;/li&gt;&lt;li&gt;DEL,&lt;/li&gt;&lt;li&gt;CONFIG,&lt;/li&gt;&lt;li&gt;SHUTDOWN,&lt;/li&gt;&lt;li&gt;BGREWRITEAOF,&lt;/li&gt;&lt;li&gt;BGSAVE,&lt;/li&gt;&lt;li&gt;SAVE,&lt;/li&gt;&lt;li&gt;RENAME,&lt;/li&gt;&lt;li&gt;and DEBUG.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;There are other commands also that can be renamed but these are some of the most dangerous ones. Ensure to disable commands altogether if not needed in the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Disabling a command is a similar process to renaming a command, for renaming, provide an alternate name for the command, but for disabling rename it to an empty name or string.&lt;/p&gt;&lt;p&gt;To rename a command, open the configuration file, # vim /usr/local/redis/6379.conf&lt;/p&gt;&lt;p&gt;Under the 'Security' section, we can rename or disable a command. To disable a command, use the following example as a reference: rename-command FLUSHALL ""&lt;/p&gt;&lt;p&gt;For renaming a command, use the following example as reference: rename-command FLUSHALL DELETEITALL&lt;/p&gt;&lt;p&gt;Here, we have renamed FLUSHALL command to DELETEITALL (Delete It All). Once changes have been made, save the file &amp;amp; restart the Redis service to implement the changes. Now login to redis-cli &amp;amp; check the renamed commands.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Try to use the following Redis Server commands in the redis-cli and verify they do not work:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;LUSHDB,&lt;/li&gt;&lt;li&gt;FLUSHALL,&lt;/li&gt;&lt;li&gt;KEYS,&lt;/li&gt;&lt;li&gt;DEL,&lt;/li&gt;&lt;li&gt;CONFIG,&lt;/li&gt;&lt;li&gt;SHUTDOWN,&lt;/li&gt;&lt;li&gt;BGREWRITEAOF,&lt;/li&gt;&lt;li&gt;BGSAVE,&lt;/li&gt;&lt;li&gt;SAVE,&lt;/li&gt;&lt;li&gt;RENAME,&lt;/li&gt;&lt;li&gt;and DEBUG.&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T11:03:53.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-redis-with-password" name="Secure Redis Server installation with a password" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The first operation to perform with a Redis installation, is to assign a password:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;open the configuration file. (Note:- This is the configuration file path for local installation, yours may be '/etc/redis/redis.conf' or if you have a custom installation, then go to that location. # vim /usr/local/redis/6379.conf)&lt;/li&gt;&lt;li&gt;Look for the parameter 'requirepass', and uncomment it and then assign a password, requirepass&amp;nbsp; test@9879&lt;/li&gt;&lt;li&gt;Once the changes have been made, restart the Redis service to implement the changes made. In order to connect to the redis-cli, enter the password. First, connect to redis-cli, # redis-cli&lt;/li&gt;&lt;li&gt;Now provide the password: 127.0.0.1:6379&amp;gt; auth test#9897&lt;/li&gt;&lt;li&gt;Connection to redis-cli established.&lt;/li&gt;&lt;/ol&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
-          </references>
-          <standards>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-     &lt;ol&gt;
-      &lt;li&gt;Connect to redis-cli: # redis-cli&lt;/li&gt;
-      &lt;li&gt;Check that the password is required.&lt;/li&gt;
-      &lt;li&gt;Provide the password: 127.0.0.1:6379&amp;gt; auth test#9897&lt;/li&gt;
-      &lt;li&gt;Check that the authentication is successful.&lt;/li&gt;
-     &lt;/ol&gt;
-    &lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.439">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.313">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.314">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="secure-redis-with-password" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-redis-with-password" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-341" name="Attackers gain access to user data by manipulating server-side code" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server-side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-943">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
-                    <countermeasure ref="DATA-VAL" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
-                <countermeasure ref="DATA-VAL" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-88" name="An adversary injects operating system commands into existing application functions" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.
-    &lt;br /&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-78">
-                  <countermeasures>
-                    <countermeasure ref="secure-redis-renaming-dangerous-commands" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-redis-renaming-dangerous-commands" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="redis-server-exposed">
-                  <countermeasures>
-                    <countermeasure ref="secure-redis-access-localhost-only" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="secure-redis-access-localhost-only" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="5927025a-fce3-485e-9dfb-889614d37108" diagramComponentId="0cc26ac2-be19-4533-82b2-1d86cd4e240f" ref="df661557-3440-41ad-a563-621fc3f3e0cb" name="PostgreSQL" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="postgresql">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:49.917">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.128">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:49.778">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
-              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.129">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;ul&gt; 
- &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
-&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.129">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
- &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
- &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:49.872">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;br /&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
-                            their associated patches are available for the version deployed.&lt;/li&gt;
-                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
-                            &lt;/ol&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.015">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
-          &lt;br /&gt;
-              &lt;ul&gt;
-              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
-              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
-              &lt;/ul&gt;
-          </desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
-          </references>
-          <standards>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                &lt;ol&gt;
-                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
-                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
-                &lt;/ol&gt;
-                &lt;/div&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
-            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
-            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-          </references>
-          <standards>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
-            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
-            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;
-                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
-                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
-                &lt;/ol&gt;
-            </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
- &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
- &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
- &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations>
-            <implementation platform="C#">
-              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:49.679">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
-          <threats>
-            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
-                                services for which they are not authorized.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-284">
-                  <countermeasures>
-                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
-                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-306">
-                  <countermeasures>
-                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
-                  <countermeasures>
-                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>If attackers gain access to the application or the application server, then they could
-                                directly access the data store using the privilege assigned to the application.
-                                &lt;div&gt;
-                                If the data store user account used by the application has elevated privileges then this
-                                could allow attackers to perform unauthorized operations such as dropping tables,
-                                modifying the database schema or modifying data.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-89">
-                  <countermeasures>
-                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="00aff6c2-f18c-4317-98d5-056f2e20e224" diagramComponentId="4536b78b-e1a0-4b2d-8415-c73dfb9c9997" ref="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a" name="Web UI" desc="" library="CS-Default" parentComponentRef="295a899b-e1f6-4ff3-8227-1dd1855f2ab6" componentDefinitionRef="web-ui">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
-          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
-&lt;div&gt; 
- &lt;br /&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Some examples of this vulnerability are:&amp;nbsp; 
- &lt;div&gt; 
-  &lt;ul&gt; 
-   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
-   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
-   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
-  &lt;/ul&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.266">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
-              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software performs an operation at a privilege level that is higher than the minimum level
-                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
-
-                        New weaknesses can be exposed because running with extra privileges, such as root or
-                        Administrator, can disable the normal security checks being performed by the operating system or
-                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
-                        they occur while operating at raised privileges. Privilege management functions can behave in
-                        some less-than-obvious ways, and they have different quirks on different platforms. These
-                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
-                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
-                        a process is running as root when a signal fires or a sub-process is executed, the signal
-                        handler or sub-process will operate with root privileges.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.977">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
-                        is placed in output that is used as a web page that is served to other users. Cross-site
-                        scripting (XSS) vulnerabilities occur when:
-                        &lt;ol&gt;
-                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
-                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
-                        data.&lt;/li&gt;
-                        &lt;li&gt;During page generation, the application does not prevent the data from containing
-                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
-                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
-                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
-                        script that was injected using the untrusted data.&lt;/li&gt;
-                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
-                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
-                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
-                        states that scripts in one domain should not be able to access resources or run code in a
-                        different domain.&lt;/li&gt;
-                        &lt;/ol&gt;There are three main kinds of XSS:
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
-                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
-                        vulnerable web application, which is then reflected back to the victim and executed by the web
-                        browser. The most common mechanism for delivering malicious content is to include it as a
-                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
-                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
-                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
-                        content back to the victim, the content is executed by the victim's browser.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        The application stores dangerous data in a database, message forum, visitor log, or other
-                        trusted data store. At a later time, the dangerous data is subsequently read back into the
-                        application and included in dynamic content. From an attacker's perspective, the optimal place
-                        to inject malicious content is in an area that is displayed to either many users or particularly
-                        interesting users. Interesting users typically have elevated privileges in the application or
-                        interact with sensitive data that is valuable to the attacker. If one of these users executes
-                        malicious content, the attacker may be able to perform privileged operations on behalf of the
-                        user or gain access to sensitive data belonging to the user. For example, the attacker might
-                        inject XSS into a log message, which might not be handled properly when an administrator views
-                        the logs.
-                        &lt;/blockquote&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;blockquote&gt;
-                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
-                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
-                        script that is sent to the client, such as Javascript that performs sanity checks on a form
-                        before the user submits it. If the server-supplied script processes user-supplied data and then
-                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
-                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
-                        activities. The attacker could transfer private information, such as cookies that may include
-                        session information, from the victim's machine to the attacker. The attacker could send
-                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
-                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
-                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
-                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
-                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
-                        referred to as &amp;quot;drive-by hacking&amp;quot;.
-                        &lt;/blockquote&gt;
-                        &lt;blockquote&gt;
-                        &lt;br /&gt;
-                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
-                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
-                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
-                        suspicious.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software includes web functionality (such as a web widget)
-                        from another domain, which causes it to operate within the domain of the
-                        software, potentially granting total access and control of the software to the
-                        untrusted source.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.769">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not validate or incorrectly validates input that can affect the control flow
-                        or data flow of a program.
-
-                        When software does not validate input properly, an attacker is able to craft the input in a form
-                        that is not expected by the rest of the application. This will lead to parts of the system
-                        receiving unintended input, which may result in altered control flow, arbitrary control of a
-                        resource, or arbitrary code execution.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.644">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.976">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
-          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
-                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
-                        malicious content in the trusted web page context.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
-          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.502">
-              <output/>
-            </source>
-            <references>
-              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
-          <desc>The software does not encrypt sensitive or critical information
-                        before storage or transmission.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
-          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
-
-          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
-          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
-                        defense against directed attacks against the product. This weakness covers three distinct
-                        situations:
-                        &lt;div&gt;
-                        &lt;ul&gt;
-                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
-                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
-                        for example, against the most common attacks - but it does not protect against everything that
-                        is intended.&amp;nbsp;&lt;/li&gt;
-                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
-                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
-                        &lt;/ul&gt;
-                        &lt;/div&gt;
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
-          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
-&lt;br /&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.266">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
-                        the exposure of sensitive information.
-                    </desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
-              <output/>
-            </source>
-            <references>
-              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
-            </references>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.876">
-              <output/>
-            </source>
-            <references>
-              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
-            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
-            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
-            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-          </references>
-          <standards>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
-            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.136">
-              <output/>
-            </source>
-            <references>
-              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>Review periodically all assets which are accessed by the application and ensure that these
-                        assets are hosted by the application. If this is not the case and there are assets in external
-                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
-                        from external providers or CDNs.
-                    </desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
-          </references>
-          <standards>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all assets are hosted by the application, and not by external providers.
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.718">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;
- &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
-&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.138">
-              <output/>
-            </source>
-            <references>
-              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
-  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-          </references>
-          <standards>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
- &lt;/ul&gt; 
- &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
-
- For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
- - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
- - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
-          <implementations>
-            <implementation platform=".NET">
-              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
-            </implementation>
-          </implementations>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
-          </references>
-          <standards>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
-&lt;/div&gt;
-&lt;div&gt;
-  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
-&lt;/div&gt;
-&lt;div&gt;
-  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that the application only requests the necessary permissions to work correctly.
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.137">
-              <output/>
-            </source>
-            <references>
-              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
-              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
-              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
-            </references>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt;
-  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.464">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
-            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
-            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
-            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
-            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
-          </references>
-          <standards>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
-            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;div&gt;
-                            &lt;ol&gt;
-                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
-                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
-                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
-                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
-                            &lt;ul&gt;
-                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
-                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
-                            &lt;/ul&gt;
-                            &lt;/ol&gt;
-                            &lt;/div&gt;
-                        </steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
-            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
-            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
-          </references>
-          <standards>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
-            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
-&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
-&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
-&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
-&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
-&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
-&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
-&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
-&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
-            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
-          </references>
-          <standards>
-            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.138">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
-            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
-            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
-            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
-            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
-            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
-            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
-          </references>
-          <standards>
-            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
-            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
-            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
-            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
-            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
-            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
-            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
-            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
-            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
-            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
-            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Serialized Java objects&lt;/li&gt; 
- &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
- &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
-&lt;/ul&gt;To test data validation:&amp;nbsp; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;p&gt;&lt;/p&gt; 
-&lt;ul&gt; 
- &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
- &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
-&lt;/ul&gt; 
-&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.579">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
-            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
-          </references>
-          <standards>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.137">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
-            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
-            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
-          </references>
-          <standards>
-            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
-            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
-            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
-            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
-            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
-            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.138">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-20">
-                  <countermeasures>
-                    <countermeasure ref="DATA-VAL" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="DATA-VAL" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references>
-                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
-                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
-              </references>
-              <weaknesses>
-                <weakness ref="lack-automated-vuln-identification">
-                  <countermeasures>
-                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Web applications typically make extensive use of 3rd party web resources such as
-                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
-                                repositories, or even Content Delivery Networks that host these libraries, then they
-                                could gain access to applications that use this content.
-                                &lt;div&gt;
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-830">
-                  <countermeasures>
-                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>Secrets stored in any client side components, such as a mobile application, thick
-                                client application or in JavaScript used by a browser, can be accessed by
-                                users/attackers who have access to this client.
-                                &lt;div&gt;
-                                &lt;br /&gt;
-                                &lt;/div&gt;
-                                &lt;div&gt;
-                                Attackers could then gain access to the data or services that are protected by this
-                                secret, if no other credentials are required.
-                                &lt;/div&gt;
-                            </desc>
-              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-312">
-                  <countermeasures>
-                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-798, CWE-603">
-                  <countermeasures>
-                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
-                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;div&gt;
-  As programming languages evolve, functions occasionally become obsolete due to:
-&lt;/div&gt;
-&lt;ul&gt;
- &lt;li&gt;Advances in the language.&lt;/li&gt;
- &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
- &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
-&lt;/ul&gt;
-&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
-&lt;br /&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-477">
-                  <countermeasures>
-                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="INS-CLIENT" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
-              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-NOSNIFF">
-                  <countermeasures>
-                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-79">
-                  <countermeasures>
-                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-84-HTTP-ONLY">
-                  <countermeasures>
-                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="WEB-CSP">
-                  <countermeasures>
-                    <countermeasure ref="WEB-CSP" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
-                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
-                <countermeasure ref="WEB-CSP" mitigation="25"/>
-                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-311">
-                  <countermeasures>
-                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CWE-327">
-                  <countermeasures>
-                    <countermeasure ref="CWE-327" mitigation="25"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
-                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
-                <countermeasure ref="CWE-327" mitigation="25"/>
-                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-250">
-                  <countermeasures>
-                    <countermeasure ref="excessive-permissions" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="excessive-permissions" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
-          <threats>
-            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
-              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CWE-693-CLICKJACK">
-                  <countermeasures>
-                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="adad0817-a993-4e56-88a0-55f2d18bea73" diagramComponentId="bce5a505-2fce-4133-a019-a24a94825fab" ref="159009df-8374-4463-8b8c-8f8c38f279ae" name="Migration microservices" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.797">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:47.023">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.796">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:47.024">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:47.024">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.502">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:47.024">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.501">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.965">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.708">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.393">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.394">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.965">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.394">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.966">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.966">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-    <component uuid="78b5114d-6ec5-4628-841e-5c50903cc3fc" diagramComponentId="7ec88393-fafd-43d6-b205-cfa51d8cf175" ref="1109d524-d643-4eca-92e2-38b9ccf070f7" name="Studio" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
-      <tags/>
-      <questions/>
-      <trustZones>
-        <trustZone ref="private-secured"/>
-      </trustZones>
-      <assets/>
-      <settings/>
-      <weaknesses>
-        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
-&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.694">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
- &lt;/div&gt;&lt;div&gt;
-  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:40.089">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
-&lt;/div&gt;&lt;div&gt;
-  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.693">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
-&lt;/div&gt;&lt;div&gt;
-  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
-&lt;/div&gt;&lt;div&gt;
-  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:40.091">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
-&lt;/div&gt;&lt;div&gt;
-  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.865">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
-&lt;/div&gt;&lt;div&gt;
-  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.866">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
-          <desc>&lt;div&gt;
-   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
- &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div&gt;
-   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:40.092">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
-          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
-  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <test expiryDate="" expiryPeriod="0">
-            <steps/>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.864">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </weakness>
-      </weaknesses>
-      <countermeasures>
-        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.952">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;ul&gt; 
-  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
-  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
-  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
-  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
-  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
-  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
- &lt;/ul&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.267">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.756">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.758">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt;
-   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.953">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.953">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
-   &lt;div style=""&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Description:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Ensure that applications are secure and follow best practices. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Rationale:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;br&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt; 
-     &lt;b&gt;Remediation:&lt;/b&gt; 
-    &lt;/div&gt; 
-    &lt;div style=""&gt;
-      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
-    &lt;/div&gt; 
-   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;div style=""&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Harden credentials before deploying applications 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
-            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Tools that are essential during application development can create security risks in deployment 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Ensure that any dependencies used by applications are also secure. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Remediation:&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
-&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
-            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
-            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Description:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Rationale:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;br&gt; 
- &lt;/div&gt; 
- &lt;div&gt; 
-  &lt;b&gt;Remediation:&lt;/b&gt; 
- &lt;/div&gt; 
- &lt;div&gt;
-   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
- &lt;/div&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references>
-            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
-            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
-          </references>
-          <standards/>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
-            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.760">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
-          <desc>&lt;div&gt; 
- &lt;b&gt;Description&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;b&gt;Rationale&lt;/b&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
-&lt;/div&gt; 
-&lt;div&gt; 
- &lt;br&gt; 
-&lt;/div&gt; 
-&lt;div&gt;
-  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
-&lt;/div&gt;</desc>
-          <implementations/>
-          <references/>
-          <standards>
-            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
-          </standards>
-          <customFields/>
-          <test expiryDate="" expiryPeriod="0">
-            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
-            <notes/>
-            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.953">
-              <output/>
-            </source>
-            <references/>
-            <customFields/>
-          </test>
-        </countermeasure>
-      </countermeasures>
-      <usecases>
-        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AS-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
-                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-AA-1">
-                  <countermeasures>
-                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
-                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
-&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-D-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
-              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
-                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
-                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
-                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Almost any source of data can be an injection vector: environment variables,
-                                parameters, external and internal web services, and all types of users. Injection flaws
-                                occur when an attacker can send hostile data to an interpreter.
-                            </desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="IM-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
-              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="CO-G-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
-                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>An attacker find flaws to access container volumes without permission</desc>
-              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-G-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
- Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
-              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="APP-LM-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                  </countermeasures>
-                </weakness>
-                <weakness ref="APP-LM-2">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
-                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
-                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
-          <threats>
-            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
-              <desc>Attackers gain undetected access to the network systems and changes made by the
-                                attackers couldn't be audited or detected.
-                            </desc>
-              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
-              <references/>
-              <weaknesses>
-                <weakness ref="CO-N-1">
-                  <countermeasures>
-                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-                  </countermeasures>
-                </weakness>
-              </weaknesses>
-              <countermeasures>
-                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
-              </countermeasures>
-              <customFields/>
-            </threat>
-          </threats>
-        </usecase>
-      </usecases>
-    </component>
-  </components>
-</template>

From 257fb83f093c1075de3c06dacc4c477747e391f8 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:25:53 -0400
Subject: [PATCH 27/28] Add files via upload

---
 ...plication-and-api-behind-load-balancer.xml |   531 +
 .../aws-environment-template.xml              | 21475 ++++++++++++
 .../aws-siem-and-cloudwatch.xml               | 17267 +++++++++
 .../aws-simple-infrastructure-with-waf.xml    |   219 +
 ...pplication-remote-access-web-ui-access.xml | 29169 ++++++++++++++++
 .../azure-general-network-architecture.xml    | 12271 +++++++
 ...ent-to-azure-functions-and-web-backend.xml |  7855 +++++
 .../external-user-access-through-vpn.xml      | 19104 ++++++++++
 .../gcp-cloud-architecture.xml                |  2288 ++
 .../generic-web-service.xml                   | 14942 ++++++++
 .../kubernetes-deployment.xml                 | 10601 ++++++
 .../llm-template-template.xml                 |  7269 ++++
 .../ml-ai-example-template.xml                |  8202 +++++
 ...lient-to-kubernetes-cluster-with-istio.xml | 17032 +++++++++
 .../nwe-autorizacion-de-operaciones.xml       | 17529 ++++++++++
 .../sample-system-template.xml                | 17730 ++++++++++
 .../Submitted_Templates/sap-hana-on-gcp.xml   |  6400 ++++
 .../simple-3-tier-web-application.xml         | 10151 ++++++
 .../Submitted_Templates/simple-web-app.xml    | 12339 +++++++
 .../st-generator-form-template.xml            | 19625 +++++++++++
 20 files changed, 251999 insertions(+)
 create mode 100644 Templates/Submitted_Templates/3-tier-web-application-and-api-behind-load-balancer.xml
 create mode 100644 Templates/Submitted_Templates/aws-environment-template.xml
 create mode 100644 Templates/Submitted_Templates/aws-siem-and-cloudwatch.xml
 create mode 100644 Templates/Submitted_Templates/aws-simple-infrastructure-with-waf.xml
 create mode 100644 Templates/Submitted_Templates/aws-web-application-remote-access-web-ui-access.xml
 create mode 100644 Templates/Submitted_Templates/azure-general-network-architecture.xml
 create mode 100644 Templates/Submitted_Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml
 create mode 100644 Templates/Submitted_Templates/external-user-access-through-vpn.xml
 create mode 100644 Templates/Submitted_Templates/gcp-cloud-architecture.xml
 create mode 100644 Templates/Submitted_Templates/generic-web-service.xml
 create mode 100644 Templates/Submitted_Templates/kubernetes-deployment.xml
 create mode 100644 Templates/Submitted_Templates/llm-template-template.xml
 create mode 100644 Templates/Submitted_Templates/ml-ai-example-template.xml
 create mode 100644 Templates/Submitted_Templates/mobile-client-to-kubernetes-cluster-with-istio.xml
 create mode 100644 Templates/Submitted_Templates/nwe-autorizacion-de-operaciones.xml
 create mode 100644 Templates/Submitted_Templates/sample-system-template.xml
 create mode 100644 Templates/Submitted_Templates/sap-hana-on-gcp.xml
 create mode 100644 Templates/Submitted_Templates/simple-3-tier-web-application.xml
 create mode 100644 Templates/Submitted_Templates/simple-web-app.xml
 create mode 100644 Templates/Submitted_Templates/st-generator-form-template.xml

diff --git a/Templates/Submitted_Templates/3-tier-web-application-and-api-behind-load-balancer.xml b/Templates/Submitted_Templates/3-tier-web-application-and-api-behind-load-balancer.xml
new file mode 100644
index 0000000..83139f8
--- /dev/null
+++ b/Templates/Submitted_Templates/3-tier-web-application-and-api-behind-load-balancer.xml
@@ -0,0 +1,531 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="3 Tier Web Application and API behind load balancer" name="3 Tier Web Application and API behind load balancer" tags="Community">
+  <desc>&lt;p&gt;Web Server/Application&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjc3MiIgZHk9IjE3MDciIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS4yLjAiPgogIDxyb290PgogICAgPG14Q2VsbCBpZD0iMCIvPgogICAgPG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+CiAgICA8bXhDZWxsIGlkPSI5IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMjQ2IiB5PSItNCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIzNTEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzIiB2YWx1ZT0iV2ViIENsaWVudCIgc3R5bGU9ImlyLnJlZj1hM2M2NzMxYy0zNTNjLTRiNTMtODFkMS1iMzU4YmVlNjFhZGM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjcwIiB5PSIyMDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjI1IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQiIHN0eWxlPSJpci5yZWY9ZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vYmlsZS1kZXZpY2UtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TlRBMk1qY2dNQzR4TWprMk16bERNQzR5T1RnME1qTWdNQzR4TWprMk16a2dNQzR5TlRZeE1EUWdNQzR4TnpFNU5UZ2dNQzR5TlRZeE1EUWdNQzR5TWpReE5qRldNQzQzT1RFeU9UZERNQzR5TlRZeE1EUWdNQzQ0TkRNMU1ERWdNQzR5T1RnME1qTWdNQzQ0T0RVNE1pQXdMak0xTURZeU55QXdMamc0TlRneVNEQXVOak0wTVRrMlF6QXVOamcyTXprNUlEQXVPRGcxT0RJZ01DNDNNamczTVRrZ01DNDRORE0xTURFZ01DNDNNamczTVRrZ01DNDNPVEV5T1RkV01DNHlNalF4TmpGRE1DNDNNamczTVRrZ01DNHhOekU1TlRnZ01DNDJPRFl6T1RrZ01DNHhNamsyTXprZ01DNDJNelF4T1RZZ01DNHhNamsyTXpsSU1DNHpOVEEyTWpkYVRUQXVNekkyT1RrMklEQXVNakV5TXpRMlF6QXVNekkyT1RrMklEQXVNVGs1TWprMUlEQXVNek0zTlRjMklEQXVNVGc0TnpFMUlEQXVNelV3TmpJM0lEQXVNVGc0TnpFMVNEQXVOak0wTVRrMlF6QXVOalEzTWpRM0lEQXVNVGc0TnpFMUlEQXVOalUzT0RJM0lEQXVNVGs1TWprMUlEQXVOalUzT0RJM0lEQXVNakV5TXpRMlZqQXVOek15TWpJeFF6QXVOalUzT0RJM0lEQXVOelExTWpjeElEQXVOalEzTWpRM0lEQXVOelUxT0RVeElEQXVOak0wTVRrMklEQXVOelUxT0RVeFNEQXVNelV3TmpJM1F6QXVNek0zTlRjMklEQXVOelUxT0RVeElEQXVNekkyT1RrMklEQXVOelExTWpjeElEQXVNekkyT1RrMklEQXVOek15TWpJeFZqQXVNakV5TXpRMldrMHdMalEyTkRnME1pQXdMamcxTURNM05FTXdMalEwT1RZeE5pQXdMamcxTURNM05DQXdMalF6TnpJM015QXdMamd6T0RBeklEQXVORE0zTWpjeklEQXVPREl5T0RBMFF6QXVORE0zTWpjeklEQXVPREEzTlRjNElEQXVORFE1TmpFMklEQXVOemsxTWpNMUlEQXVORFkwT0RReUlEQXVOemsxTWpNMVNEQXVOVEU1T1RoRE1DNDFNelV5TURZZ01DNDNPVFV5TXpVZ01DNDFORGMxTlNBd0xqZ3dOelUzT0NBd0xqVTBOelUxSURBdU9ESXlPREEwUXpBdU5UUTNOVFVnTUM0NE16Z3dNeUF3TGpVek5USXdOaUF3TGpnMU1ETTNOQ0F3TGpVeE9UazRJREF1T0RVd016YzBTREF1TkRZME9EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EQXdNalEwTVRReElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI5IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjEwIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzUiIHk9Ii0zNSIgd2lkdGg9Ijc5NSIgaGVpZ2h0PSI0MjkiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyOSIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UgLSZndDsgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YWZkMmNiMjMtZWQ3Mi00ODhkLWFkOTktY2ZmZDEzOGY1ZDU4O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTAiIHNvdXJjZT0iNyIgdGFyZ2V0PSI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cmVzdC1mdWxsLXdlYi1zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTROakU0TWlBd0xqSTBPVE0wTmtNd0xqTTROakU0TWlBd0xqSXpOVGc0TkNBd0xqTTVOekE1TlNBd0xqSXlORGszTVNBd0xqUXhNRFUxTnlBd0xqSXlORGszTVVnd0xqVTRPVE13TjBNd0xqWXdNamMyT1NBd0xqSXlORGszTVNBd0xqWXhNelk0TWlBd0xqSXpOVGc0TkNBd0xqWXhNelk0TWlBd0xqSTBPVE0wTmtNd0xqWXhNelk0TWlBd0xqSTJNamd3T0NBd0xqWXdNamMyT1NBd0xqSTNNemN5TVNBd0xqVTRPVE13TnlBd0xqSTNNemN5TVVnd0xqUXhNRFUxTjBNd0xqTTVOekE1TlNBd0xqSTNNemN5TVNBd0xqTTROakU0TWlBd0xqSTJNamd3T0NBd0xqTTROakU0TWlBd0xqSTBPVE0wTmxwTk1DNDBNVEExTlRjZ01DNDFPREkwTnpGRE1DNHpPVGN3T1RVZ01DNDFPREkwTnpFZ01DNHpPRFl4T0RJZ01DNDFPVE16T0RRZ01DNHpPRFl4T0RJZ01DNDJNRFk0TkRaRE1DNHpPRFl4T0RJZ01DNDJNakF6TURjZ01DNHpPVGN3T1RVZ01DNDJNekV5TWpFZ01DNDBNVEExTlRjZ01DNDJNekV5TWpGSU1DNDFNekk1TlRORE1DNDFNelkyTkRjZ01DNDJNVE0xTVRNZ01DNDFORE0yT0RZZ01DNDFPVGN3TXpJZ01DNDFOVE16T0NBd0xqVTRNalEzTVVnd0xqUXhNRFUxTjFwTk1DNDJORFl4T0RJZ01DNDFNakU1TjFZd0xqRTVNalEzTVVNd0xqWTBOakU0TWlBd0xqRTJOVFUwTnlBd0xqWXlORE0xTlNBd0xqRTBNemN5TVNBd0xqVTVOelF6TVNBd0xqRTBNemN5TVVnd0xqUXdNalF6TVVNd0xqTTNOVFV3TnlBd0xqRTBNemN5TVNBd0xqTTFNelk0TWlBd0xqRTJOVFUwTnlBd0xqTTFNelk0TWlBd0xqRTVNalEzTVZZd0xqWTBOelEzUXpBdU16VXpOamd5SURBdU5qYzBNemswSURBdU16YzFOVEEzSURBdU5qazJNakl4SURBdU5EQXlORE14SURBdU5qazJNakl4U0RBdU5UTTBOelEyUXpBdU5UTTVOVE01SURBdU56RTBNVFF5SURBdU5UUTNPREF4SURBdU56TXdOalEySURBdU5UVTROelkxSURBdU56UTBPVGN4U0RBdU5EQXlORE14UXpBdU16UTROVGcwSURBdU56UTBPVGN4SURBdU16QTBPVE15SURBdU56QXhNekU0SURBdU16QTBPVE15SURBdU5qUTNORGRXTUM0eE9USTBOekZETUM0ek1EUTVNeklnTUM0eE16ZzJNak1nTUM0ek5EZzFPRFFnTUM0d09UUTVOekEzSURBdU5EQXlORE14SURBdU1EazBPVGN3TjBnd0xqVTVOelF6TVVNd0xqWTFNVEkzT1NBd0xqQTVORGszTURjZ01DNDJPVFE1TXpJZ01DNHhNemcyTWpNZ01DNDJPVFE1TXpJZ01DNHhPVEkwTnpGV01DNDFNakl4TmpWRE1DNDJPRFk0TkRNZ01DNDFNakEzTVRFZ01DNDJOemcxTVRJZ01DNDFNVGs1TlRJZ01DNDJOekF3TURRZ01DNDFNVGs1TlRKRE1DNDJOakU0T0RNZ01DNDFNVGs1TlRJZ01DNDJOVE01TWpRZ01DNDFNakEyTkRNZ01DNDJORFl4T0RJZ01DNDFNakU1TjFwTk1DNHpPRFl4T0RJZ01DNDFNRGt6TkRaRE1DNHpPRFl4T0RJZ01DNDBPVFU0T0RRZ01DNHpPVGN3T1RVZ01DNDBPRFE1TnpFZ01DNDBNVEExTlRjZ01DNDBPRFE1TnpGSU1DNDFPRGt6TURkRE1DNDJNREkzTmprZ01DNDBPRFE1TnpFZ01DNDJNVE0yT0RJZ01DNDBPVFU0T0RRZ01DNDJNVE0yT0RJZ01DNDFNRGt6TkRaRE1DNDJNVE0yT0RJZ01DNDFNakk0TURnZ01DNDJNREkzTmprZ01DNDFNek0zTWlBd0xqVTRPVE13TnlBd0xqVXpNemN5U0RBdU5ERXdOVFUzUXpBdU16azNNRGsxSURBdU5UTXpOeklnTUM0ek9EWXhPRElnTUM0MU1qSTRNRGdnTUM0ek9EWXhPRElnTUM0MU1Ea3pORFphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16ZzRPREVnTUM0M01EVXdORGRJTUM0M01EQTNPVFJETUM0Mk9UUTFPVFVnTUM0M016YzNOaUF3TGpZNE1qRTRNU0F3TGpjMk1EQXlPQ0F3TGpZMk9UZ3pPQ0F3TGpjMk1EQXlPRU13TGpZMU56ZzJPQ0F3TGpjMk1EQXlPQ0F3TGpZME5UZ3pNaUF3TGpjek9UQTRPU0F3TGpZek9UUTJNU0F3TGpjd056azVNVXd3TGpZek9EZzRNU0F3TGpjd05UQTBOMGd3TGpjd01EYzVORWd3TGpZek9EZzRNVnBOTUM0MU9EQTBPVGdnTUM0M01EVXdORGhNTUM0Mk1qTTFOVE1nTUM0M01EVXdORFpETUM0Mk1qY3lNREVnTUM0M01qVTROamdnTUM0Mk16TXpPRE1nTUM0M05ETTFPRE1nTUM0Mk5ERTBOelVnTUM0M05UVTVPRU13TGpZeE5UZzBOeUF3TGpjME9EUXhNU0F3TGpVNU5EVXhNU0F3TGpjek1EZzJOQ0F3TGpVNE1UazJNU0F3TGpjd056Z3pOMHd3TGpVNE1EUTVPQ0F3TGpjd05UQTBPRnBOTUM0M01UWXhNaklnTUM0M01EVXdORFpNTUM0M05Ua3hOemdnTUM0M01EVXdORGhETUM0M05EWTROalVnTUM0M01qazBORFFnTUM0M01qUTROVFFnTUM0M05EZ3hNRGtnTUM0Mk9UZ3lNVEVnTUM0M05UVTVOemRETUM0M01EVTNOVFlnTUM0M05EUTBJREF1TnpFeE5qUXpJREF1TnpJNE1qQXhJREF1TnpFMU16VTVJREF1TnpBNU1UWTNUREF1TnpFMk1USXlJREF1TnpBMU1EUTJUREF1TnpVNU1UYzRJREF1TnpBMU1EUTRUREF1TnpFMk1USXlJREF1TnpBMU1EUTJXazB3TGpjeE9URTFNU0F3TGpZME1EQTBOMHd3TGpjMk56ZzFJREF1TmpRd01EUXhRekF1TnpZNU1UWXlJREF1TmpRMk5UQTBJREF1TnpZNU9EVXhJREF1TmpVek1Ua3pJREF1TnpZNU9EVXhJREF1TmpZd01EUXpRekF1TnpZNU9EVXhJREF1Tmpjd05EazNJREF1TnpZNE1qUTNJREF1Tmpnd05UYzFJREF1TnpZMU1qY3pJREF1Tmprd01EUTNTREF1TnpFNE1qUTNRekF1TnpFNU15QXdMalk0TURRM01TQXdMamN4T1RnMU1pQXdMalkzTURReElEQXVOekU1T0RVeUlEQXVOall3TURRelF6QXVOekU1T0RVeUlEQXVOalUxTlNBd0xqY3hPVGMwTmlBd0xqWTFNVEF4TmlBd0xqY3hPVFV6T0NBd0xqWTBOall3TlV3d0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4VERBdU56RTVNVFV4SURBdU5qUXdNRFEzV2swd0xqVTNNVGd5TlNBd0xqWTBNREEwTVV3d0xqWXlNRFV5TkNBd0xqWTBNREEwTjBNd0xqWXlNREEyTWlBd0xqWTBOalUwTmlBd0xqWXhPVGd5TXlBd0xqWTFNekl5T1NBd0xqWXhPVGd5TXlBd0xqWTJNREEwTTBNd0xqWXhPVGd5TXlBd0xqWTJPRE16TnlBd0xqWXlNREUzTmlBd0xqWTNOalF6TlNBd0xqWXlNRGcxTnlBd0xqWTROREkwTlV3d0xqWXlNVFF5T0NBd0xqWTVNREEwTjBnd0xqVTNORFF3TWtNd0xqVTNNVFF5T0NBd0xqWTRNRFUzTlNBd0xqVTJPVGd5TkNBd0xqWTNNRFE1TnlBd0xqVTJPVGd5TkNBd0xqWTJNREEwTTBNd0xqVTJPVGd5TkNBd0xqWTFNekU1TXlBd0xqVTNNRFV4TXlBd0xqWTBOalV3TkNBd0xqVTNNVGd5TlNBd0xqWTBNREEwTVZwTk1DNDJNelUxT1RNZ01DNDJOREF3TkRGSU1DNDNNRFF3T0RKRE1DNDNNRFExT0RRZ01DNDJORFkwT1RjZ01DNDNNRFE0TlRJZ01DNDJOVE14T0RZZ01DNDNNRFE0TlRJZ01DNDJOakF3TkRORE1DNDNNRFE0TlRJZ01DNDJOamcwTWlBd0xqY3dORFExTXlBd0xqWTNOalUwTkNBd0xqY3dNemN4TkNBd0xqWTRORE13TVV3d0xqY3dNekE1TnlBd0xqWTVNREEwT0Vnd0xqWXpOalUzT0VNd0xqWXpOVFEwTnlBd0xqWTRNRFU1SURBdU5qTTBPREl6SURBdU5qY3dOVEUwSURBdU5qTTBPREl6SURBdU5qWXdNRFF6UXpBdU5qTTBPREl6SURBdU5qVTBPU0F3TGpZek5EazNOQ0F3TGpZME9UZzFNaUF3TGpZek5USTJNU0F3TGpZME5Ea3lOa3d3TGpZek5UVTVNeUF3TGpZME1EQTBNVWd3TGpjd05EQTRNa2d3TGpZek5UVTVNMXBOTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNRekF1TnpJNE16Z3pJREF1TlRjek1ERTNJREF1TnpVeU5qSXpJREF1TlRrMU56Z3pJREF1TnpZek5UVTFJREF1TmpJMU1EUk1NQzQzTVRjMk5EY2dNQzQyTWpVd05ETkRNQzQzTVRRME9USWdNQzQyTURBNE56UWdNQzQzTURnd09ESWdNQzQxT0RBeE1UY2dNQzQyT1RreU9DQXdMalUyTlRneFREQXVOams0TWpBeElEQXVOVFkwTVRBM1REQXVOams1TWpnZ01DNDFOalU0TVZwTk1DNDJOREF5TlRZZ01DNDFOalEwTnpaTU1DNDJOREUwTnpRZ01DNDFOalF4TURoRE1DNDJNekkyTmpZZ01DNDFOemMyTURNZ01DNDJNall4TWlBd0xqVTVOek01T1NBd0xqWXlNalkwTkNBd0xqWXlNRFkwTlV3d0xqWXlNakF5T0NBd0xqWXlOVEEwTTB3d0xqVTNOakV5SURBdU5qSTFNRFJETUM0MU9EWTVNRFVnTUM0MU9UWXhOemdnTUM0Mk1UQTJOQ0F3TGpVM016WXpNeUF3TGpZME1ESTFOaUF3TGpVMk5EUTNOa3d3TGpZME1UUTNOQ0F3TGpVMk5ERXdPRXd3TGpZME1ESTFOaUF3TGpVMk5EUTNObHBOTUM0Mk5qazRNemdnTUM0MU5qQXdOVGxETUM0Mk9ETXdNalVnTUM0MU5qQXdOVGtnTUM0Mk9UWXlPVE1nTUM0MU9EVTBOellnTUM0M01ERTVOemNnTUM0Mk1qRTRPVE5NTUM0M01ESTBORFVnTUM0Mk1qVXdOREZJTUM0Mk16Y3lNME13TGpZME1qWXlOQ0F3TGpVNE5qazBPU0F3TGpZMU5qSTNNeUF3TGpVMk1EQTFPU0F3TGpZMk9UZ3pPQ0F3TGpVMk1EQTFPVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenh5WldOMElIZzlJakF1TVRrNU9UVXhJaUI1UFNJd0xqZ3lPVGsxTmlJZ2QybGtkR2c5SWpBdU5qQXlOallpSUdobGFXZG9kRDBpTUM0eE5ESXlNemNpSUhKNFBTSXdMakEzTVRFeE9EUWlJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakkzTlRFMUlEQXVPVFV5TWpFelF6QXVNalkyT1RFZ01DNDVOVEl3TlRNZ01DNHlOakEwTXlBd0xqazBPVFUzTXlBd0xqSTFOVGN4SURBdU9UUTBOemN6UXpBdU1qVXhNRGNnTUM0NU5EQXdOVFFnTUM0eU5EZzNOU0F3TGprek16RTNOQ0F3TGpJME9EYzFJREF1T1RJME1UTTBWakF1T1RFMk5qazBRekF1TWpRNE56VWdNQzQ1TVRNNU56UWdNQzR5TkRneU15QXdMamt4TVRnMU5DQXdMakkwTnpFNUlEQXVPVEV3TXpNMFF6QXVNalEyTVRVZ01DNDVNRGczTXpRZ01DNHlORFEyTnlBd0xqa3dOemt6TkNBd0xqSTBNamMxSURBdU9UQTNPVE0wU0RBdU1qTTVPVGxXTUM0NE9UVXpNelZJTUM0eU5ESTNOVU13TGpJME5EWTNJREF1T0RrMU16TTFJREF1TWpRMk1UVWdNQzQ0T1RRMU16VWdNQzR5TkRjeE9TQXdMamc1TWprek5VTXdMakkwT0RJeklEQXVPRGt4TXpNMUlEQXVNalE0TnpVZ01DNDRPRGt5TVRVZ01DNHlORGczTlNBd0xqZzROalUzTlZZd0xqZzNPVEkxTlVNd0xqSTBPRGMxSURBdU9EY3dNakUxSURBdU1qVXhNRGNnTUM0NE5qTXpNelVnTUM0eU5UVTNNU0F3TGpnMU9EWXhOVU13TGpJMk1EUXpJREF1T0RVek9EazFJREF1TWpZMk9URWdNQzQ0TlRFME1UWWdNQzR5TnpVeE5TQXdMamcxTVRFM05sWXdMamcyTXpjM05VTXdMakkyTmpreElEQXVPRFkwTWpVMUlEQXVNall5TnprZ01DNDROamcyT1RVZ01DNHlOakkzT1NBd0xqZzNOekE1TlZZd0xqZzROVE0zTlVNd0xqSTJNamM1SURBdU9Ea3dOREUxSURBdU1qWXhPVFVnTUM0NE9UUXlNVFVnTUM0eU5qQXlOeUF3TGpnNU5qYzNOVU13TGpJMU9EWTNJREF1T0RrNU1qVTBJREF1TWpVMk1qTWdNQzQ1TURBNE9UUWdNQzR5TlRJNU5TQXdMamt3TVRZNU5FTXdMakkxT1RVeElEQXVPVEF6TXpjMElEQXVNall5TnprZ01DNDVNRGc0TVRRZ01DNHlOakkzT1NBd0xqa3hPREF4TkZZd0xqa3lOakk1TkVNd0xqSTJNamM1SURBdU9UTTBPRFUwSURBdU1qWTJPVEVnTUM0NU16a3lPVFFnTUM0eU56VXhOU0F3TGprek9UWXhORll3TGprMU1qSXhNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlPVEF4TlRZZ01DNDVNelkyTVRSV01DNDROVEkyTVRaSU1DNHpNamN6TlRaRE1DNHpNemN3TXpZZ01DNDROVEkyTVRZZ01DNHpORFF3TXpZZ01DNDROVFV3TVRVZ01DNHpORGd6TlRZZ01DNDROVGs0TVRWRE1DNHpOVEkzTlRZZ01DNDROalEyTVRVZ01DNHpOVFE1TlRZZ01DNDROekEzTXpVZ01DNHpOVFE1TlRZZ01DNDROemd4TnpWRE1DNHpOVFE1TlRZZ01DNDRPRE16TnpVZ01DNHpOVE0wTnpZZ01DNDRPRGd5TlRVZ01DNHpOVEExTVRZZ01DNDRPVEk0TVRWRE1DNHpORGMxTlRZZ01DNDRPVGN6TnpVZ01DNHpORE15TnpZZ01DNDVNREEwT1RRZ01DNHpNemMyTnpZZ01DNDVNREl4TnpSTU1DNHpOVFEwTnpZZ01DNDVNelkyTVRSSU1DNHpNemd5TnpaTU1DNHpNakl3TnpZZ01DNDVNRE0zTXpSSU1DNHpNRFExTlRaV01DNDVNelkyTVRSSU1DNHlPVEF4TlRaYVRUQXVNekEwTlRVMklEQXVPRGt3TURVMVNEQXVNekkzTlRrMlF6QXVNek14T1RFMklEQXVPRGt3TURVMUlEQXVNek0xTURjMklEQXVPRGc0T1RNMUlEQXVNek0zTURjMklEQXVPRGcyTmprMVF6QXVNek01TURjMklEQXVPRGcwTkRVMUlEQXVNelF3TURjMklEQXVPRGd4TmpFMUlEQXVNelF3TURjMklEQXVPRGM0TVRjMVF6QXVNelF3TURjMklEQXVPRGMwT0RFMUlEQXVNek01TVRFMklEQXVPRGN5TURFMUlEQXVNek0zTVRrMklEQXVPRFk1TnpjMVF6QXVNek0xTWpjMklEQXVPRFkzTkRVMUlEQXVNek15TURjMklEQXVPRFkyTWprMUlEQXVNekkzTlRrMklEQXVPRFkyTWprMVNEQXVNekEwTlRVMlZqQXVPRGt3TURVMVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNM01qTXdOQ0F3TGprek5qWXhORll3TGpnMU1qWXhOa2d3TGpReU56QXlORll3TGpnMk5qRTNOVWd3TGpNNE5qY3dORll3TGpnNE5qUTFOVWd3TGpReE1UVTBORll3TGprd01EQXhORWd3TGpNNE5qY3dORll3TGpreU16QTFORWd3TGpReU9UWTJORll3TGprek5qWXhORWd3TGpNM01qTXdORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBOekkzTnpnZ01DNDVNemd3TlRSRE1DNDBOalV3T1RnZ01DNDVNemd3TlRRZ01DNDBOVGcwTlRnZ01DNDVNell4TXpRZ01DNDBOVEk0TlRnZ01DNDVNekl5T1RSRE1DNDBORGN6TXpnZ01DNDVNamd6TnpRZ01DNDBORE0wTVRnZ01DNDVNak13TlRRZ01DNDBOREV3T1RnZ01DNDVNVFl6TXpSTU1DNDBOVFEwTVRnZ01DNDVNVEUwTVRSRE1DNDBOVFl4TnpnZ01DNDVNVFV6TXpRZ01DNDBOVGcyT1RnZ01DNDVNVGcwT1RRZ01DNDBOakU1TnpnZ01DNDVNakE0T1RSRE1DNDBOalV5TlRnZ01DNDVNak15TVRRZ01DNDBOamt3TVRnZ01DNDVNalF6TnpRZ01DNDBOek15TlRnZ01DNDVNalF6TnpSRE1DNDBOemMyTlRnZ01DNDVNalF6TnpRZ01DNDBPREV4TXpnZ01DNDVNak16TnpRZ01DNDBPRE0yT1RnZ01DNDVNakV6TnpSRE1DNDBPRFl6TXpnZ01DNDVNVGt6TnpRZ01DNDBPRGMyTlRnZ01DNDVNVFkwT1RRZ01DNDBPRGMyTlRnZ01DNDVNVEkzTXpSRE1DNDBPRGMyTlRnZ01DNDVNVEV5TVRRZ01DNDBPRGN5T1RnZ01DNDVNRGs0TVRRZ01DNDBPRFkxTnpnZ01DNDVNRGcxTXpSRE1DNDBPRFU0TlRnZ01DNDVNRGN4TnpRZ01DNDBPRFV3TVRnZ01DNDVNRFl3TlRRZ01DNDBPRFF3TlRnZ01DNDVNRFV4TnpSRE1DNDBPRE14TnpnZ01DNDVNRFF5T1RRZ01DNDBPREU0TVRnZ01DNDVNRE0wTVRRZ01DNDBOems1TnpnZ01DNDVNREkxTXpSRE1DNDBOemd4TXpnZ01DNDVNREUyTlRRZ01DNDBOelkxTnpnZ01DNDVNREE1TnpRZ01DNDBOelV5T1RnZ01DNDVNREEwT1RSRE1DNDBOelF3TVRnZ01DNDRPVGs1TXpRZ01DNDBOekl4TXpnZ01DNDRPVGt5TlRRZ01DNDBOamsyTlRnZ01DNDRPVGcwTlRSRE1DNDBOalkwTlRnZ01DNDRPVGN6TXpVZ01DNDBOak01TnpnZ01DNDRPVFkwTlRVZ01DNDBOakl5TVRnZ01DNDRPVFU0TVRWRE1DNDBOakExTXpnZ01DNDRPVFV4TnpVZ01DNDBOVGd6TXpnZ01DNDRPVFF4TXpVZ01DNDBOVFUyTVRnZ01DNDRPVEkyT1RWRE1DNDBOVEk1TnpnZ01DNDRPVEV4TnpVZ01DNDBOVEE1TXpnZ01DNDRPRGsyTlRVZ01DNDBORGswT1RnZ01DNDRPRGd4TXpWRE1DNDBORGd4TXpnZ01DNDRPRFkyTVRVZ01DNDBORFk0T1RnZ01DNDRPRFEyTVRVZ01DNDBORFUzTnpnZ01DNDRPREl4TXpWRE1DNDBORFEzTXpnZ01DNDROemsxTnpVZ01DNDBORFF5TVRnZ01DNDROelkzTnpVZ01DNDBORFF5TVRnZ01DNDROek0zTXpWRE1DNDBORFF5TVRnZ01DNDROamN6TXpVZ01DNDBORFkyT1RnZ01DNDROakU1TnpVZ01DNDBOVEUyTlRnZ01DNDROVGMyTlRWRE1DNDBOVFkyTVRnZ01DNDROVE16TXpZZ01DNDBOak16TXpnZ01DNDROVEV4TnpZZ01DNDBOekU0TVRnZ01DNDROVEV4TnpaRE1DNDBOemc0TlRnZ01DNDROVEV4TnpZZ01DNDBPRFEyT1RnZ01DNDROVEk0TlRZZ01DNDBPRGt6TXpnZ01DNDROVFl5TVRWRE1DNDBPVE01TnpnZ01DNDROVGswT1RVZ01DNDBPVGN3T1RnZ01DNDROak00TVRVZ01DNDBPVGcyT1RnZ01DNDROamt4TnpWTU1DNDBPRFUzTXpnZ01DNDROek0wT1RWRE1DNDBPRE14TnpnZ01DNDROamMzTXpVZ01DNDBOemd5TVRnZ01DNDROalE0TlRVZ01DNDBOekE0TlRnZ01DNDROalE0TlRWRE1DNDBOamN3T1RnZ01DNDROalE0TlRVZ01DNDBOalF4TXpnZ01DNDROalUyTlRVZ01DNDBOakU1TnpnZ01DNDROamN5TlRWRE1DNDBOVGs0T1RnZ01DNDROamczTnpVZ01DNDBOVGc0TlRnZ01DNDROekE1TnpVZ01DNDBOVGc0TlRnZ01DNDROek00TlRWRE1DNDBOVGc0TlRnZ01DNDROelUzTnpVZ01DNDBOVGsyTlRnZ01DNDROemMwT1RVZ01DNDBOakV5TlRnZ01DNDROemt3TVRWRE1DNDBOakk1TXpnZ01DNDRPREExTXpVZ01DNDBOalEyT1RnZ01DNDRPREUyT1RVZ01DNDBOalkxTXpnZ01DNDRPREkwT1RWRE1DNDBOamcwTlRnZ01DNDRPRE15TVRVZ01DNDBOekV5TlRnZ01DNDRPRFF4TnpVZ01DNDBOelE1TXpnZ01DNDRPRFV6TnpWRE1DNDBOemN6TXpnZ01DNDRPRFl5TlRVZ01DNDBOemt4TXpnZ01DNDRPRFk1TXpVZ01DNDBPREF6TXpnZ01DNDRPRGMwTVRWRE1DNDBPREUyTVRnZ01DNDRPRGM0TVRVZ01DNDBPRE16TnpnZ01DNDRPRGcxTXpVZ01DNDBPRFUyTVRnZ01DNDRPRGsxTnpWRE1DNDBPRGM0TlRnZ01DNDRPVEEyTVRVZ01DNDBPRGsyTVRnZ01DNDRPVEUxTnpVZ01DNDBPVEE0T1RnZ01DNDRPVEkwTlRWRE1DNDBPVEl4TnpnZ01DNDRPVE15TlRVZ01DNDBPVE0yTVRnZ01DNDRPVFF6TnpVZ01DNDBPVFV5TVRnZ01DNDRPVFU0TVRWRE1DNDBPVFk0T1RnZ01DNDRPVGN5TlRVZ01DNDBPVGd4TnpnZ01DNDRPVGczTnpRZ01DNDBPVGt3TlRnZ01DNDVNREF6TnpSRE1DNDBPVGs1TXpnZ01DNDVNREU0T1RRZ01DNDFNREEyT1RnZ01DNDVNRE0zTXpRZ01DNDFNREV6TXpnZ01DNDVNRFU0T1RSRE1DNDFNREU1TnpnZ01DNDVNRGM1TnpRZ01DNDFNREl5T1RnZ01DNDVNVEF5TlRRZ01DNDFNREl5T1RnZ01DNDVNVEkzTXpSRE1DNDFNREl5T1RnZ01DNDVNakExTnpRZ01DNDBPVGswT1RnZ01DNDVNalkzTnpRZ01DNDBPVE00T1RnZ01DNDVNekV6TXpSRE1DNDBPRGd6TnpnZ01DNDVNelU0TVRRZ01DNDBPREV6TXpnZ01DNDVNemd3TlRRZ01DNDBOekkzTnpnZ01DNDVNemd3TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVeU1ESWdNQzQ0TmpZME1UVldNQzQ1TXpZMk1UUklNQzQxTXpjMk1sWXdMamcyTmpReE5VZ3dMalV4TXpjMFZqQXVPRFV5TmpFMlNEQXVOVGMxT1ZZd0xqZzJOalF4TlVnd0xqVTFNakF5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TlRRek5TQXdMamc0TnpVek5WWXdMamt6TmpZeE5FZ3dMalU1TVRNNU5WWXdMamc0TnpVek5VZ3dMalU0TWpVeE5WWXdMamczTlRJNU5VZ3dMalU1TVRNNU5WWXdMamcyTlRZNU5VTXdMalU1TVRNNU5TQXdMamcxTmpBeE5TQXdMalU1TmpJek5TQXdMamcxTVRFM05pQXdMall3TlRreE5TQXdMamcxTVRFM05rTXdMall4TURjNU5TQXdMamcxTVRFM05pQXdMall4TlRFeE5TQXdMamcxTWpFek5pQXdMall4T0RnM05TQXdMamcxTkRBMU5WWXdMamcyTlRVM05VTXdMall4TlRVNU5TQXdMamcyTkRJeE5TQXdMall4TWpZM05TQXdMamcyTXpVek5TQXdMall4TURFeE5TQXdMamcyTXpVek5VTXdMall3TmprNU5TQXdMamcyTXpVek5TQXdMall3TlRRek5TQXdMamcyTlRFek5TQXdMall3TlRRek5TQXdMamcyT0RNek5WWXdMamczTlRJNU5VZ3dMall4T0RnM05WWXdMamc0TnpVek5VZ3dMall3TlRRek5Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qWXpOVFFnTUM0NU16WTJNVFJXTUM0NU16QTNNelJETUM0Mk5qSTFNVFFnTUM0NU16VTJNVFFnTUM0Mk5UY3hOVFFnTUM0NU16Z3dOVFFnTUM0Mk5UQXlOelFnTUM0NU16Z3dOVFJETUM0Mk5ETTROelFnTUM0NU16Z3dOVFFnTUM0Mk16ZzJNelFnTUM0NU16WXdOVFFnTUM0Mk16UTFOVFFnTUM0NU16SXdOVFJETUM0Mk16QTBOelFnTUM0NU1qYzVOelFnTUM0Mk1qZzBNelFnTUM0NU1qRTFOelFnTUM0Mk1qZzBNelFnTUM0NU1USTROVFJXTUM0NE56VXlPVFZJTUM0Mk5ESTBOelJXTUM0NU1UQXpNelJETUM0Mk5ESTBOelFnTUM0NU1UazROVFFnTUM0Mk5EWXpNVFFnTUM0NU1qUTJNVFFnTUM0Mk5UTTVPVFFnTUM0NU1qUTJNVFJETUM0Mk5qSXlNelFnTUM0NU1qUTJNVFFnTUM0Mk5qWXpOVFFnTUM0NU1UazVNelFnTUM0Mk5qWXpOVFFnTUM0NU1UQTFOelJXTUM0NE56VXlPVFZJTUM0Mk9EQXpPVFJXTUM0NU16WTJNVFJJTUM0Mk5qWXpOVFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOams1TURBNUlEQXVPVE0yTmpFMFZqQXVPRFUyTlRjMVREQXVOekV6TURRNUlEQXVPRFE1T1RjMlZqQXVPVE0yTmpFMFNEQXVOams1TURBNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjeU56UTVJREF1T1RVeU1qRXpWakF1T1RNNU5qRTBRekF1TnpNMU9ERWdNQzQ1TXpreU1UUWdNQzQzTXprNU55QXdMamt6TkRjM05DQXdMamN6T1RrM0lEQXVPVEkyTWprMFZqQXVPVEU0TURFMFF6QXVOek01T1RjZ01DNDVNRGc0TVRRZ01DNDNORE15TlNBd0xqa3dNek0zTkNBd0xqYzBPVGd4SURBdU9UQXhOamswUXpBdU56UTJOVE1nTUM0NU1EQTRPVFFnTUM0M05EUXdOU0F3TGpnNU9USTFOQ0F3TGpjME1qTTNJREF1T0RrMk56YzFRekF1TnpRd056Y2dNQzQ0T1RReU1UVWdNQzQzTXprNU55QXdMamc1TURReE5TQXdMamN6T1RrM0lEQXVPRGcxTXpjMVZqQXVPRGMzTURrMVF6QXVOek01T1RjZ01DNDROamcyT1RVZ01DNDNNelU0TVNBd0xqZzJOREkxTlNBd0xqY3lOelE1SURBdU9EWXpOemMxVmpBdU9EVXhNVGMyUXpBdU56TTFOek1nTUM0NE5URTBNVFlnTUM0M05ESXlNU0F3TGpnMU16a3pOU0F3TGpjME5qa3pJREF1T0RVNE56TTFRekF1TnpVeE5qVWdNQzQ0TmpNME5UVWdNQzQzTlRRd01TQXdMamczTURJNU5TQXdMamMxTkRBeElEQXVPRGM1TWpVMVZqQXVPRGcyTlRjMVF6QXVOelUwTURFZ01DNDRPRGt5TVRVZ01DNDNOVFExTXlBd0xqZzVNVE16TlNBd0xqYzFOVFUzSURBdU9Ea3lPVE0xUXpBdU56VTJOakVnTUM0NE9UUTFNelVnTUM0M05UZ3dPU0F3TGpnNU5UTXpOU0F3TGpjMk1EQXhJREF1T0RrMU16TTFTREF1TnpZeU5qVldNQzQ1TURjNU16UklNQzQzTmpBd01VTXdMamMxT0RBNUlEQXVPVEEzT1RNMElEQXVOelUyTmpFZ01DNDVNRGczTXpRZ01DNDNOVFUxTnlBd0xqa3hNRE16TkVNd0xqYzFORFV6SURBdU9URXhPRFUwSURBdU56VTBNREVnTUM0NU1UTTVOelFnTUM0M05UUXdNU0F3TGpreE5qWTVORll3TGpreU5ERXpORU13TGpjMU5EQXhJREF1T1RNek1UYzBJREF1TnpVeE5qVWdNQzQ1TkRBd05UUWdNQzQzTkRZNU15QXdMamswTkRjM00wTXdMamMwTWpJeElEQXVPVFE1TlRjeklEQXVOek0xTnpNZ01DNDVOVEl3TlRNZ01DNDNNamMwT1NBd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpjNElpQm9aV2xuYUhROUlqQXVOemdpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpFd09UZzJNeUF3TGpBek1EQXlPVE1wSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjI1OSIgeT0iMjAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9NGEwY2NmYzUtNjg0Mi00YjUwLWJkODgtZjUyMWFlZjE2NmE0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTAiIHNvdXJjZT0iNiIgdGFyZ2V0PSI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtJmd0OyBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxMCIgc291cmNlPSI4IiB0YXJnZXQ9IjQiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iV2ViIFNlcnZpY2UgLSZndDsgT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzM7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxMCIgc291cmNlPSI4IiB0YXJnZXQ9IjExIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNCIgdmFsdWU9IldlYiBTZXJ2aWNlIC0mZ3Q7IE1pY3Jvc29mdCBBenVyZSBTZXJ2aWNlIEJ1cyBNZXNzYWdpbmciIHN0eWxlPSJpci5yZWY9NmQ0ODZmMjItOWQ1NS00NDc5LTgyM2UtNDc4NWQzMzdkYmNiO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iOCIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI0IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMTYiIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0mZ3Q7IFJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YTRiMDBhZmYtNzI1NS00ZGJmLWEzN2UtMjNkMmUzZDIwZjc3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iMjciIHRhcmdldD0iNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwOCIgeT0iMTIwLjc0MTkzNTQ4Mzg3MDk4IiBhcz0ic291cmNlUG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkxvYWQgQmFsYW5jZXIgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDYzYjg4YWMtNjI1MS00ODE2LTllNzYtMmFjZmRlNGJhY2QyO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMTAiIHNvdXJjZT0iMjciIHRhcmdldD0iNiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwOCIgeT0iMTcwLjMyMjU4MDY0NTE2MTIyIiBhcz0ic291cmNlUG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyMyIgdmFsdWU9Ik1pY3Jvc29mdCBBenVyZSBTZXJ2aWNlIEJ1cyBNZXNzYWdpbmciIHN0eWxlPSJpci5yZWY9ZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1JQ1JPU09GVC1BWlVSRS1TRVItQlVTLU1TRztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RTNNRGxmTWpVeU5UTXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMakU1TXprNU5pQXdMakl3TnpjMk5FZ3dMakkwTXpjNE0xWXdMak0wTlRVME5rTXdMakkwTXpjNE15QXdMak0wT0RVeE5DQXdMakkwTWpZd015QXdMak0xTVRNMk1TQXdMakkwTURVd05DQXdMak0xTXpRMlF6QXVNak00TkRBMUlEQXVNelUxTlRVNUlEQXVNak0xTlRVNUlEQXVNelUyTnpNNElEQXVNak15TlRrZ01DNHpOVFkzTXpoSU1DNHhPRE14T0RsRE1DNHhPREF5TWpFZ01DNHpOVFkzTXpnZ01DNHhOemN6TnpRZ01DNHpOVFUxTlRrZ01DNHhOelV5TnpVZ01DNHpOVE0wTmtNd0xqRTNNekUzTmlBd0xqTTFNVE0yTVNBd0xqRTNNVGs1TnlBd0xqTTBPRFV4TkNBd0xqRTNNVGs1TnlBd0xqTTBOVFUwTmxZd0xqSXlPVGMyTWtNd0xqRTNNVGs1TnlBd0xqSXlNemt5T0NBd0xqRTNORE14TlNBd0xqSXhPRE16TXlBd0xqRTNPRFEwSURBdU1qRTBNakEzUXpBdU1UZ3lOVFkySURBdU1qRXdNRGd4SURBdU1UZzRNVFl4SURBdU1qQTNOelkwSURBdU1Ua3pPVGsySURBdU1qQTNOelkwVmpBdU1qQTNOelkwV2lJZ1ptbHNiRDBpSXprNU9UazVPU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDFJaUJrUFNKTk1DNHhPVE01T1RZZ01DNHlNRGMzTmpSSU1DNHlORE0zT0ROV01DNHpORFUxTkRaRE1DNHlORE0zT0RNZ01DNHpORGcxTVRRZ01DNHlOREkyTURNZ01DNHpOVEV6TmpFZ01DNHlOREExTURRZ01DNHpOVE0wTmtNd0xqSXpPRFF3TlNBd0xqTTFOVFUxT1NBd0xqSXpOVFUxT1NBd0xqTTFOamN6T0NBd0xqSXpNalU1SURBdU16VTJOek00U0RBdU1UZ3pNVGc1UXpBdU1UZ3dNakl4SURBdU16VTJOek00SURBdU1UYzNNemMwSURBdU16VTFOVFU1SURBdU1UYzFNamMxSURBdU16VXpORFpETUM0eE56TXhOellnTUM0ek5URXpOakVnTUM0eE56RTVPVGNnTUM0ek5EZzFNVFFnTUM0eE56RTVPVGNnTUM0ek5EVTFORFpXTUM0eU1qazNOakpETUM0eE56RTVPVGNnTUM0eU1qTTVNamdnTUM0eE56UXpNVFVnTUM0eU1UZ3pNek1nTUM0eE56ZzBOQ0F3TGpJeE5ESXdOME13TGpFNE1qVTJOaUF3TGpJeE1EQTRNU0F3TGpFNE9ERTJNU0F3TGpJd056YzJOQ0F3TGpFNU16azVOaUF3TGpJd056YzJORll3TGpJd056YzJORm9pSUdacGJHdzlJaU01T1RrNU9Ua2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMxTmpNME9DQXdMakl3TnpjMk5FZ3dMamd3TmpFek5FTXdMamd4TVRrMk9TQXdMakl3TnpjMk5DQXdMamd4TnpVMk5DQXdMakl4TURBNE1TQXdMamd5TVRZNUlEQXVNakUwTWpBM1F6QXVPREkxT0RFMUlEQXVNakU0TXpNeklEQXVPREk0TVRNeklEQXVNakl6T1RJNElEQXVPREk0TVRNeklEQXVNakk1TnpZeVZqQXVNelExTlRRMlF6QXVPREk0TVRNeklEQXVNelE0TlRFMElEQXVPREkyT1RVMElEQXVNelV4TXpZeElEQXVPREkwT0RVMUlEQXVNelV6TkRaRE1DNDRNakkzTlRZZ01DNHpOVFUxTlRrZ01DNDRNVGs1TURrZ01DNHpOVFkzTXpnZ01DNDRNVFk1TkRFZ01DNHpOVFkzTXpoSU1DNDNOamN4TlRSRE1DNDNOalF5TlRNZ01DNHpOVFkyTXpnZ01DNDNOakUxTURRZ01DNHpOVFUwTVRVZ01DNDNOVGswT0RnZ01DNHpOVE16TWpaRE1DNDNOVGMwTnpJZ01DNHpOVEV5TXpnZ01DNDNOVFl6TkRZZ01DNHpORGcwTkRnZ01DNDNOVFl6TkRnZ01DNHpORFUxTkRaV01DNHlNRGMzTmpSYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMxTmpNME9DQXdMakl3TnpjMk5FZ3dMamd3TmpFek5FTXdMamd4TVRrMk9TQXdMakl3TnpjMk5DQXdMamd4TnpVMk5DQXdMakl4TURBNE1TQXdMamd5TVRZNUlEQXVNakUwTWpBM1F6QXVPREkxT0RFMUlEQXVNakU0TXpNeklEQXVPREk0TVRNeklEQXVNakl6T1RJNElEQXVPREk0TVRNeklEQXVNakk1TnpZeVZqQXVNelExTlRRMlF6QXVPREk0TVRNeklEQXVNelE0TlRFMElEQXVPREkyT1RVMElEQXVNelV4TXpZeElEQXVPREkwT0RVMUlEQXVNelV6TkRaRE1DNDRNakkzTlRZZ01DNHpOVFUxTlRrZ01DNDRNVGs1TURrZ01DNHpOVFkzTXpnZ01DNDRNVFk1TkRFZ01DNHpOVFkzTXpoSU1DNDNOamN4TlRSRE1DNDNOalF5TlRNZ01DNHpOVFkyTXpnZ01DNDNOakUxTURRZ01DNHpOVFUwTVRVZ01DNDNOVGswT0RnZ01DNHpOVE16TWpaRE1DNDNOVGMwTnpJZ01DNHpOVEV5TXpnZ01DNDNOVFl6TkRZZ01DNHpORGcwTkRnZ01DNDNOVFl6TkRnZ01DNHpORFUxTkRaV01DNHlNRGMzTmpSYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qZ3hNalVnTUM0eU1qazNOakpXTUM0eU56Z3dNRFZNTUM0eE56SXdNalFnTUM0eU56Z3dNRFZXTUM0eU1qazNOakpETUM0eE56SXdNalFnTUM0eU1qTTVNamdnTUM0eE56UXpORElnTUM0eU1UZ3pNeklnTUM0eE56ZzBOamNnTUM0eU1UUXlNRGRETUM0eE9ESTFPVE1nTUM0eU1UQXdPREVnTUM0eE9EZ3hPRGdnTUM0eU1EYzNOalFnTUM0eE9UUXdNak1nTUM0eU1EYzNOalJNTUM0NE1EWTFNVElnTUM0eU1EYzNOalJETUM0NE1USXlPQ0F3TGpJd056ZzJOU0F3TGpneE56YzNOaUF3TGpJeE1ESXlOeUF3TGpneU1UZ3hPU0F3TGpJeE5ETTBNa013TGpneU5UZzJNU0F3TGpJeE9EUTFOaUF3TGpneU9ERXlOaUF3TGpJeU16azVOQ0F3TGpneU9ERXlOU0F3TGpJeU9UYzJNbFl3TGpJeU9UYzJNbG9pSUdacGJHdzlJaU01TkRrME9UUWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakU0TXpJMUlEQXVOalF4T0RRMlNEQXVNak16TURNMlF6QXVNak0yTURBMUlEQXVOalF4T0RRMklEQXVNak00T0RVeElEQXVOalF6TURJMUlEQXVNalF3T1RVZ01DNDJORFV4TWpSRE1DNHlORE13TkRrZ01DNDJORGN5TWpNZ01DNHlORFF5TWprZ01DNDJOVEF3TnlBd0xqSTBOREl5T1NBd0xqWTFNekF6T0ZZd0xqYzVNVGszTjBnd0xqRTVOREExTmtNd0xqRTVNVEUyTnlBd0xqYzVNVGszTnlBd0xqRTRPRE13TmlBd0xqYzVNVFF3T0NBd0xqRTROVFl6TnlBd0xqYzVNRE13TWtNd0xqRTRNamsyT0NBd0xqYzRPVEU1TnlBd0xqRTRNRFUwTXlBd0xqYzROelUzTmlBd0xqRTNPRFVnTUM0M09EVTFNelJETUM0eE56UXpOelVnTUM0M09ERTBNRGdnTUM0eE56SXdOVGNnTUM0M056VTRNVE1nTUM0eE56SXdOVGNnTUM0M05qazVOemhXTUM0Mk5UUXhPVFpETUM0eE56RTRPVFFnTUM0Mk5USTJNeklnTUM0eE56SXdOak1nTUM0Mk5URXdOVEVnTUM0eE56STFOVElnTUM0Mk5EazFOVGRETUM0eE56TXdOREVnTUM0Mk5EZ3dOaklnTUM0eE56TTROQ0F3TGpZME5qWTROeUF3TGpFM05EZzVOaUF3TGpZME5UVXlNa013TGpFM05UazFNaUF3TGpZME5ETTFOeUF3TGpFM056STBNaUF3TGpZME16UXlOeUF3TGpFM09EWTRNU0F3TGpZME1qYzVORU13TGpFNE1ERXlJREF1TmpReU1UWWdNQzR4T0RFMk56Y2dNQzQyTkRFNE16Y2dNQzR4T0RNeU5TQXdMalkwTVRnME5sWXdMalkwTVRnME5sb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JRzl3WVdOcGRIazlJakF1TlNJZ1pEMGlUVEF1TVRnek1qVWdNQzQyTkRFNE5EWklNQzR5TXpNd016WkRNQzR5TXpZd01EVWdNQzQyTkRFNE5EWWdNQzR5TXpnNE5URWdNQzQyTkRNd01qVWdNQzR5TkRBNU5TQXdMalkwTlRFeU5FTXdMakkwTXpBME9TQXdMalkwTnpJeU15QXdMakkwTkRJeU9TQXdMalkxTURBM0lEQXVNalEwTWpJNUlEQXVOalV6TURNNFZqQXVOemt4T1RjM1NEQXVNVGswTURVMlF6QXVNVGt4TVRZM0lEQXVOemt4T1RjM0lEQXVNVGc0TXpBMklEQXVOemt4TkRBNElEQXVNVGcxTmpNM0lEQXVOemt3TXpBeVF6QXVNVGd5T1RZNElEQXVOemc1TVRrM0lEQXVNVGd3TlRReklEQXVOemczTlRjMklEQXVNVGM0TlNBd0xqYzROVFV6TkVNd0xqRTNORE0zTlNBd0xqYzRNVFF3T0NBd0xqRTNNakExTnlBd0xqYzNOVGd4TXlBd0xqRTNNakExTnlBd0xqYzJPVGszT0ZZd0xqWTFOREU1TmtNd0xqRTNNVGc1TkNBd0xqWTFNall6TWlBd0xqRTNNakEyTXlBd0xqWTFNVEExTVNBd0xqRTNNalUxTWlBd0xqWTBPVFUxTjBNd0xqRTNNekEwTVNBd0xqWTBPREEyTWlBd0xqRTNNemcwSURBdU5qUTJOamczSURBdU1UYzBPRGsySURBdU5qUTFOVEl5UXpBdU1UYzFPVFV5SURBdU5qUTBNelUzSURBdU1UYzNNalF5SURBdU5qUXpOREkzSURBdU1UYzROamd4SURBdU5qUXlOemswUXpBdU1UZ3dNVElnTUM0Mk5ESXhOaUF3TGpFNE1UWTNOeUF3TGpZME1UZ3pOeUF3TGpFNE16STFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOelkzTWpFMUlEQXVOalF4T0RRMlNEQXVPREUzTURBeVF6QXVPREU1T1RjZ01DNDJOREU0TkRZZ01DNDRNakk0TVRjZ01DNDJORE13TWpVZ01DNDRNalE1TVRZZ01DNDJORFV4TWpSRE1DNDRNamN3TVRVZ01DNDJORGN5TWpNZ01DNDRNamd4T1RRZ01DNDJOVEF3TnlBd0xqZ3lPREU1TkNBd0xqWTFNekF6T0ZZd0xqYzJPRGd5UXpBdU9ESTRNVGswSURBdU56YzBOalUxSURBdU9ESTFPRGMzSURBdU56Z3dNalVnTUM0NE1qRTNOVEVnTUM0M09EUXpOelZETUM0NE1UYzJNalVnTUM0M09EZzFNREVnTUM0NE1USXdNeUF3TGpjNU1EZ3hPU0F3TGpnd05qRTVOU0F3TGpjNU1EZ3hPVWd3TGpjMU5qUXdPRll3TGpZMU5ERTVOa013TGpjMU5qSTBPQ0F3TGpZMU1qWTJOQ0F3TGpjMU5qUXdOaUF3TGpZMU1URXhOU0F3TGpjMU5qZzNNaUF3TGpZME9UWTBOME13TGpjMU56TXpPQ0F3TGpZME9ERTNPU0F3TGpjMU9ERXdNeUF3TGpZME5qZ3lNaUF3TGpjMU9URXhOeUF3TGpZME5UWTJNME13TGpjMk1ERXpNU0F3TGpZME5EVXdOQ0F3TGpjMk1UTTNOQ0F3TGpZME16VTJOaUF3TGpjMk1qYzJPQ0F3TGpZME1qa3hRekF1TnpZME1UWXhJREF1TmpReU1qVXpJREF1TnpZMU5qYzFJREF1TmpReE9Ea2dNQzQzTmpjeU1UVWdNQzQyTkRFNE5EWldNQzQyTkRFNE5EWmFJaUJtYVd4c1BTSWpPVGs1T1RrNUlpOCtKaU40WVRzOGNHRjBhQ0J2Y0dGamFYUjVQU0l3TGpVaUlHUTlJazB3TGpjMk56SXhOU0F3TGpZME1UZzBOa2d3TGpneE56QXdNa013TGpneE9UazNJREF1TmpReE9EUTJJREF1T0RJeU9ERTNJREF1TmpRek1ESTFJREF1T0RJME9URTJJREF1TmpRMU1USTBRekF1T0RJM01ERTFJREF1TmpRM01qSXpJREF1T0RJNE1UazBJREF1TmpVd01EY2dNQzQ0TWpneE9UUWdNQzQyTlRNd016aFdNQzQzTmpnNE1rTXdMamd5T0RFNU5DQXdMamMzTkRZMU5TQXdMamd5TlRnM055QXdMamM0TURJMUlEQXVPREl4TnpVeElEQXVOemcwTXpjMVF6QXVPREUzTmpJMUlEQXVOemc0TlRBeElEQXVPREV5TURNZ01DNDNPVEE0TVRrZ01DNDRNRFl4T1RVZ01DNDNPVEE0TVRsSU1DNDNOVFkwTURoV01DNDJOVFF4T1RaRE1DNDNOVFl5TkRnZ01DNDJOVEkyTmpRZ01DNDNOVFkwTURZZ01DNDJOVEV4TVRVZ01DNDNOVFk0TnpJZ01DNDJORGsyTkRkRE1DNDNOVGN6TXpnZ01DNDJORGd4TnprZ01DNDNOVGd4TURNZ01DNDJORFk0TWpJZ01DNDNOVGt4TVRjZ01DNDJORFUyTmpORE1DNDNOakF4TXpFZ01DNDJORFExTURRZ01DNDNOakV6TnpRZ01DNDJORE0xTmpZZ01DNDNOakkzTmpnZ01DNDJOREk1TVVNd0xqYzJOREUyTVNBd0xqWTBNakkxTXlBd0xqYzJOVFkzTlNBd0xqWTBNVGc1SURBdU56WTNNakUxSURBdU5qUXhPRFEyVmpBdU5qUXhPRFEyV2lJZ1ptbHNiRDBpSXprNU9UazVPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TVRjeE9UazNJREF1TnpZNU9UazBWakF1TnpJeE56VXlTREF1T0RJNE1EazVWakF1TnpZNU9UazBRekF1T0RJNE1EazVJREF1TnpjMU9ESTRJREF1T0RJMU56Z3hJREF1TnpneE5ESXpJREF1T0RJeE5qVTJJREF1TnpnMU5UUTVRekF1T0RFM05UTWdNQzQzT0RrMk56UWdNQzQ0TVRFNU16VWdNQzQzT1RFNU9USWdNQzQ0TURZeElEQXVOemt4T1RreVNEQXVNVGt6T1RrMlF6QXVNVGc0TVRZeElEQXVOemt4T1RreUlEQXVNVGd5TlRZMklEQXVOemc1TmpjMElEQXVNVGM0TkRRZ01DNDNPRFUxTkRsRE1DNHhOelF6TVRVZ01DNDNPREUwTWpNZ01DNHhOekU1T1RjZ01DNDNOelU0TWpnZ01DNHhOekU1T1RjZ01DNDNOams1T1RSV01DNDNOams1T1RSYUlpQm1hV3hzUFNJak9UUTVORGswSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU9USTBPQ0F3TGpNMk1ETTFNbFl3TGpZek1qYzVPVXd3TGpRNU56WXdNeUF3TGpRNU5qWTVOMHd3TGpJNU1qUTRJREF1TXpZd016VXlXaUlnWm1sc2JEMGlJek15UWtWRVJDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF5TmpneElEQXVNell3TkRFMlREQXVORGszTlRVNUlEQXVORGsyTnpaTU1DNDNNREk1TWpRZ01DNDJNekkyTVRoRE1DNDNNREkwTXpnZ01DNDJNamN5TnpFZ01DNDNNREkyT0RFZ01DNHpOVFUxTlRVZ01DNDNNREkyT0RFZ01DNHpOakEwTVRaYUlpQm1hV3hzUFNJak1UazRRVUl6SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME9UWTROelVnTUM0ME9UWTRNalpNTUM0eU9USTBPQ0F3TGpZek1qWTRPRWd3TGpjd01qUTROVll3TGpZek1qUTBOVXd3TGpRNU5qZzNOU0F3TGpRNU5qZ3lObG9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF3WDJ4cGJtVmhjbDh4TnpBNVh6STFNalV6S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qa3lORGdnTUM0ek5qQXpOVEpJTUM0M01ESTNNalpNTUM0ME9UazNPU0F3TGpVeE9UYzROVU13TGpRNU9EVTJOaUF3TGpVeU1EY3hNaUF3TGpRNU56QTNNeUF3TGpVeU1USXhNeUF3TGpRNU5UVXpOeUF3TGpVeU1USXhNME13TGpRNU5EQXdNaUF3TGpVeU1USXhNeUF3TGpRNU1qVXdPQ0F3TGpVeU1EY3hNaUF3TGpRNU1USTROQ0F3TGpVeE9UYzROVXd3TGpJNU1qUTRJREF1TXpZd016VXlXaUlnWm1sc2JEMGlJelV3UlRaR1JpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhKZk1UY3dPVjh5TlRJMU15SWdlREU5SWpBdU5EazNOakEwSWlCNU1UMGlNQzQwT1RZNE1qWWlJSGd5UFNJd0xqUTVOell3TkNJZ2VUSTlJakF1TmpNeU9UTXhJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqTURBMVFrRXhJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU1qWWlJSE4wYjNBdFkyOXNiM0k5SWlNd01EVTRPVVFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDFNeUlnYzNSdmNDMWpiMnh2Y2owaUl6QXdORVk1TUNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMamdpSUhOMGIzQXRZMjlzYjNJOUlpTXdNRE5HTjBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUl6QXdNekEyTnlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVGN3T1Y4eU5USTFNeUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9EQXdNREVpSUdobGFXZG9kRDBpTUM0NE9EQXdNREVpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBMk1EQTFPRFlnTUM0d05qQXdOVGcyS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NDUiIHk9IjI4MyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMjciIHZhbHVlPSJMb2FkIEJhbGFuY2VyIiBzdHlsZT0iaXIucmVmPTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1MT0FELUJBTEFOQ0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01GOHlORFUzWHpJek1qQXdLU0krUEhCaGRHZ2daRDBpVFRBdU16VXdPRE15SURBdU1qYzVOVGMxUXpBdU16VTNOVEF4SURBdU1qQTJNRFV6SURBdU5ERTVOams0SURBdU1UUTRORE00SURBdU5EazFORFFnTUM0eE5EZzBNemhETUM0MU56RXhPRElnTUM0eE5EZzBNemdnTUM0Mk16TXpOemtnTUM0eU1EWXdOVE1nTUM0Mk5EQXdORGdnTUM0eU56azFOelZJTUM0Mk5ETTVORU13TGpjd01EUXpPU0F3TGpJM09UVTNOU0F3TGpjME5qSTBJREF1TXpJMU1EYzNJREF1TnpRMk1qUWdNQzR6T0RFeU1EWkRNQzQzTkRZeU5DQXdMalF6TnpNek5pQXdMamN3TURRek9TQXdMalE0TWpnek55QXdMalkwTXprMElEQXVORGd5T0RNM1NEQXVNelEyT1RSRE1DNHlPVEEwTkRFZ01DNDBPREk0TXpjZ01DNHlORFEyTkNBd0xqUXpOek16TmlBd0xqSTBORFkwSURBdU16Z3hNakEyUXpBdU1qUTBOalFnTUM0ek1qVXdOemNnTUM0eU9UQTBOREVnTUM0eU56azFOelVnTUM0ek5EWTVOQ0F3TGpJM09UVTNOVWd3TGpNMU1EZ3pNbHBOTUM0ME9UVTBOQ0F3TGpFNE1USXlNa013TGpRek16UTNOQ0F3TGpFNE1USXlNaUF3TGpNNE16STBJREF1TWpNeE1USTNJREF1TXpnek1qUWdNQzR5T1RJMk9EaFdNQzR5T1RVNU5qZERNQzR6T0RNeU5DQXdMak13TlRBeUlEQXVNemMxT0RVeklEQXVNekV5TXpVNUlEQXVNelkyTnpRZ01DNHpNVEl6TlRsSU1DNHpORFk1TkVNd0xqTXdPRFkyTnlBd0xqTXhNak0xT1NBd0xqSTNOelkwSURBdU16UXpNVGd6SURBdU1qYzNOalFnTUM0ek9ERXlNRFpETUM0eU56YzJOQ0F3TGpReE9USXlPU0F3TGpNd09EWTJOeUF3TGpRMU1EQTFNeUF3TGpNME5qazBJREF1TkRVd01EVXpTREF1TmpRek9UUkRNQzQyT0RJeU1UTWdNQzQwTlRBd05UTWdNQzQzTVRNeU5DQXdMalF4T1RJeU9TQXdMamN4TXpJMElEQXVNemd4TWpBMlF6QXVOekV6TWpRZ01DNHpORE14T0RNZ01DNDJPREl5TVRNZ01DNHpNVEl6TlRrZ01DNDJORE01TkNBd0xqTXhNak0xT1Vnd0xqWXlOREUwUXpBdU5qRTFNREkzSURBdU16RXlNelU1SURBdU5qQTNOalFnTUM0ek1EVXdNaUF3TGpZd056WTBJREF1TWprMU9UWTNWakF1TWpreU5qZzRRekF1TmpBM05qUWdNQzR5TXpFeE1qY2dNQzQxTlRjME1EWWdNQzR4T0RFeU1qSWdNQzQwT1RVME5DQXdMakU0TVRJeU1sb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NDhjR0YwYUNCa1BTSk5NQzQwT1RFd05DQXdMalEyTlRJek4wZ3dMalV3T0RZMFZqQXVOalkzTmpNM1NEQXVORGt4TURSV01DNDBOalV5TXpkYUlpQm1hV3hzUFNJak1FSkJNRUkzSWk4K1BIQmhkR2dnWkQwaVRUQXVNamszTkRRZ01DNDFPRGcwTXpkRE1DNHlPVGMwTkNBd0xqVTRNelUzTnlBd0xqTXdNVE00SURBdU5UYzVOak0zSURBdU16QTJNalFnTUM0MU56azJNemRETUM0ek1URXhJREF1TlRjNU5qTTNJREF1TXpFMU1EUWdNQzQxT0RNMU56Y2dNQzR6TVRVd05DQXdMalU0T0RRek4xWXdMalkyTnpZek4wTXdMak14TlRBMElEQXVOamN5TkRrNElEQXVNekV4TVNBd0xqWTNOalF6TnlBd0xqTXdOakkwSURBdU5qYzJORE0zUXpBdU16QXhNemdnTUM0Mk56WTBNemNnTUM0eU9UYzBOQ0F3TGpZM01qUTVPQ0F3TGpJNU56UTBJREF1TmpZM05qTTNWakF1TlRnNE5ETTNXaUlnWm1sc2JEMGlJekJDUVRCQ055SXZQanh3WVhSb0lHUTlJazB3TGpZNU16UTBJREF1TlRnNE5ETTNRekF1Tmprek5EUWdNQzQxT0RNMU56Y2dNQzQyT1Rjek9DQXdMalUzT1RZek55QXdMamN3TWpJMElEQXVOVGM1TmpNM1F6QXVOekEzTVNBd0xqVTNPVFl6TnlBd0xqY3hNVEEwSURBdU5UZ3pOVGMzSURBdU56RXhNRFFnTUM0MU9EZzBNemRXTUM0Mk5qYzJNemRETUM0M01URXdOQ0F3TGpZM01qUTVPQ0F3TGpjd056RWdNQzQyTnpZME16Y2dNQzQzTURJeU5DQXdMalkzTmpRek4wTXdMalk1TnpNNElEQXVOamMyTkRNM0lEQXVOamt6TkRRZ01DNDJOekkwT1RnZ01DNDJPVE0wTkNBd0xqWTJOell6TjFZd0xqVTRPRFF6TjFvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JrUFNKTk1DNDNNREl5TkNBd0xqVTNPVFl6TjFZd0xqVTVOekl6TjBnd0xqTXdOakkwVmpBdU5UYzVOak0zU0RBdU56QXlNalJhSWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMakkxTXpRMElEQXVOamcxTWpNM1ZqQXVOemt3T0RNM1NEQXVNelU1TURSV01DNDJPRFV5TXpkSU1DNHlOVE0wTkZwTk1DNHlORFEyTkNBd0xqWTJOell6TjBNd0xqSXpPVGM0SURBdU5qWTNOak0zSURBdU1qTTFPRFFnTUM0Mk56RTFOemNnTUM0eU16VTROQ0F3TGpZM05qUXpOMVl3TGpjNU9UWXpOME13TGpJek5UZzBJREF1T0RBME5EazRJREF1TWpNNU56Z2dNQzQ0TURnME16Y2dNQzR5TkRRMk5DQXdMamd3T0RRek4wZ3dMak0yTnpnMFF6QXVNemN5TnlBd0xqZ3dPRFF6TnlBd0xqTTNOalkwSURBdU9EQTBORGs0SURBdU16YzJOalFnTUM0M09UazJNemRXTUM0Mk56WTBNemRETUM0ek56WTJOQ0F3TGpZM01UVTNOeUF3TGpNM01qY2dNQzQyTmpjMk16Y2dNQzR6TmpjNE5DQXdMalkyTnpZek4wZ3dMakkwTkRZMFdpSWdabWxzYkQwaUl6QkNRVEJDTnlJdlBqeHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EazBOQ0F3TGpZNE5USXpOMVl3TGpjNU1EZ3pOMGd3TGpjMU5UQTBWakF1TmpnMU1qTTNTREF1TmpRNU5EUmFUVEF1TmpRd05qUWdNQzQyTmpjMk16ZERNQzQyTXpVM09DQXdMalkyTnpZek55QXdMall6TVRnMElEQXVOamN4TlRjM0lEQXVOak14T0RRZ01DNDJOelkwTXpkV01DNDNPVGsyTXpkRE1DNDJNekU0TkNBd0xqZ3dORFE1T0NBd0xqWXpOVGM0SURBdU9EQTRORE0zSURBdU5qUXdOalFnTUM0NE1EZzBNemRJTUM0M05qTTRORU13TGpjMk9EY2dNQzQ0TURnME16Y2dNQzQzTnpJMk5DQXdMamd3TkRRNU9DQXdMamMzTWpZMElEQXVOems1TmpNM1ZqQXVOamMyTkRNM1F6QXVOemN5TmpRZ01DNDJOekUxTnpjZ01DNDNOamczSURBdU5qWTNOak0zSURBdU56WXpPRFFnTUM0Mk5qYzJNemRJTUM0Mk5EQTJORm9pSUdacGJHdzlJaU13UWtFd1FqY2lMejQ4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVORGs1T0RRZ01DNDNPVEE0TXpkTU1DNDFOakE0TURnZ01DNDJPRFV5TXpkSU1DNDBNemc0TnpKTU1DNDBPVGs0TkNBd0xqYzVNRGd6TjFwTk1DNDBPVEl5TVRrZ01DNDRNVEk0TXpkRE1DNDBPVFUyTURZZ01DNDRNVGczTURRZ01DNDFNRFF3TnpRZ01DNDRNVGczTURRZ01DNDFNRGMwTmpFZ01DNDRNVEk0TXpkTU1DNDFPRE0yTnpFZ01DNDJPREE0TXpkRE1DNDFPRGN3TlRnZ01DNDJOelE1TnpFZ01DNDFPREk0TWpRZ01DNDJOamMyTXpjZ01DNDFOell3TlNBd0xqWTJOell6TjBnd0xqUXlNell6UXpBdU5ERTJPRFUxSURBdU5qWTNOak0zSURBdU5ERXlOakl5SURBdU5qYzBPVGN4SURBdU5ERTJNREE1SURBdU5qZ3dPRE0zVERBdU5Ea3lNakU1SURBdU9ERXlPRE0zV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGp3dlp6NDhaR1ZtY3o0OFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6STBOVGRmTWpNeU1EQWlQanh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9Ijk3IiB5PSI5OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iMTUiIHZhbHVlPSJXZWIgQ2xpZW50IC0mZ3Q7IExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9MTg3MGE3YzAtMWQ5ZC00OGVhLTgwMDgtMGUzZmZlMWQ0MDYxO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbnRyeVg9MDtlbnRyeVk9MC43NTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIxIiBzb3VyY2U9IjMiIHRhcmdldD0iMjciIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCB4PSIyMDUiIHk9IjEyMy44NTAyMDI0MjkxNDk3IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNiIgdmFsdWU9Ik1vYmlsZSBEZXZpY2UgQ2xpZW50IC0mZ3Q7IExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9Mjg1NGQ0OGYtM2NhZi00NzVkLTk4OGItOGI1OTViODdmNDYwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgc291cmNlPSIyNSIgdGFyZ2V0PSIyNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHg9IjIwNSIgeT0iMTA4Ljg4MTE3NDg5OTg2NjQ0IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgPC9yb290Pgo8L214R3JhcGhNb2RlbD4K</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Web Client -&gt; Load Balancer" ref="1870a7c0-1d9d-48ea-8008-0e3ffe1d4061" source="a076c1e1-f412-473c-85af-2bc811522b81" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other database" ref="1d56ec2a-8a66-4fe3-9293-a379a44704eb" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Mobile Device Client -&gt; Load Balancer" ref="2854d48f-3caf-475d-988b-8b595b87f460" source="84938d4c-4d32-4de6-a1be-c852de621214" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other data store" ref="2b0b8f3f-64fc-4915-97b8-d21e0dbe6633" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; Web Service" ref="4a0ccfc5-6842-4b50-bd88-f521aef166a4" source="6466e1cd-f115-44bf-9962-548b27fca47a" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="6d486f22-9d55-4479-823e-4785d337dbcb" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Load Balancer -&gt; RESTful Web Service" ref="a4b00aff-7255-4dbf-a37e-23d2e3d20f77" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="RESTful Web Service -&gt; Web Service" ref="afd2cb23-ed72-488d-ad99-cffd138f5d58" source="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Load Balancer -&gt; Web Application - Server side" ref="d63b88ac-6251-4816-9e76-2acfde4bacd2" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="6466e1cd-f115-44bf-9962-548b27fca47a">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="b36abde1-f1d7-4b65-9cf1-74bd1bf678ac" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.480">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jamesrabe@outlook.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.273">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="598c7abe-3b72-4a85-9510-d8df88d6b473" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="73e59e3e-c7d5-4ed3-b6cf-557591cbefe3" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="22330e4d-e9d5-4518-b8a0-387832c7ba89" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="415e1aea-f929-46f4-b7bb-d5cd25c6238a" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.397">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jamesrabe@outlook.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
+&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
+&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
+&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
+&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
+&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
+          </references>
+          <standards>
+            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1a0d321c-3a44-4f54-990a-50e5632acbc9" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="aeb45ed7-5b3e-4dbd-b49c-5f40915df150" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="a718bf82-090d-428f-b632-db46f0a27c23" diagramComponentId="7ef03c40-e025-445c-9ef6-3ac910aac821" ref="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" name="Load Balancer" desc="" library="IR-Network-Components" parentComponentRef="" componentDefinitionRef="CD-LOAD-BALANCER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-LOAD-BALANCER2" name="Enable all access logs for Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jamesrabe@outlook.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable all access logs for Load Balancers&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Logging should be configured to meet your organizational security and privacy policies. Enabling detailed logging to include information about events, event sources, timestamps, and users may assist in incident response activities.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable all access logs for Load Balancers.&lt;/p&gt; 
+&lt;p&gt;Please see Reference links for more information and examples.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Logging with Load Balancer" url="https://www.ibm.com/docs/en/was-zos/9.0.5?topic=SS7K4U_9.0.5/com.ibm.websphere.edge.doc/lb/tprf_log.htm"/>
+            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that the access logs are created when a user is visiting the load balancer.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.852">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-LOAD-BALANCER1" name="Use SSL Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jamesrabe@outlook.com" library="IR-Network-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use SSL Load Balancers&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; An SSL load balancer is a load balancer that also performs encryption and decryption of data transported via HTTPS, which uses the Secure Sockets Layer (SSL) protocol or its successor, the Transport Layer Security (TLS) protocol, to secure HTTP data as it crosses the network. Encryption of sensitive information protects against potential attackers and man-in-the-middle attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; An SSL load balancer acts as the server-side SSL endpoint for connections with clients, meaning that it performs the decryption of requests and encryption of responses that the web or application server would otherwise have to do. The process varies somewhat depending on the security of the network between the load balancer and server:&lt;/p&gt; 
+&lt;p&gt;- If the load balancer and server are on the same secured network (generally this means being behind a firewall), the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and forward the request to the server in the clear (unencrypted). It encrypts the server's response before returning it to the client.&lt;br&gt; - If the network between the load balancer and server is not secure, the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and re-encrypt the request before forwarding it to the server. The process is reversed for the response from server to client.&lt;/p&gt; 
+&lt;p&gt;Offloading the decryption and encryption process, which is computationally intensive, frees web and application servers to perform the work they are designed for, which speeds content delivery and improves the overall user experience. If the network between load balancer and servers is secure, you only need to install and manage the SSL certificates on the load balancer instead of every web and application server. This significantly reduces administrative overhead if the group of servers is large.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What Is an SSL Load Balancer?" url="https://www.nginx.com/resources/glossary/ssl-load-balancer/#:~:text=An%20SSL%20load%20balancer%20is,as%20it%20crosses%20the%20network."/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that you are using an SSL load balancer.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.851">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jamesrabe@outlook.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="11be6883-6c1c-4400-af6a-baa210f2f619" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/aws-environment-template.xml b/Templates/Submitted_Templates/aws-environment-template.xml
new file mode 100644
index 0000000..ed5a169
--- /dev/null
+++ b/Templates/Submitted_Templates/aws-environment-template.xml
@@ -0,0 +1,21475 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="aws-environment-template" name="aws-environment template" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjA2MiIgZHk9Ijc2OSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjEuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjIiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMTEwIiB5PSIzNSIgd2lkdGg9Ijk5MSIgaGVpZ2h0PSI1NDEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyMCIgdmFsdWU9IldBRiIgc3R5bGU9ImlyLnJlZj04MWE0OWFlMC1hOWQwLTRhMDktYTk0YS05ODA0YTFjMmJmZDI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyMSIgeT0iMjQwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJWUEMgLSBWaXJ0dWFsIFByaXZhdGUgQ2xvdWQiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNJalJUTkdRMFpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPRFU1TkNBd0xqWXlNRE5JTUM0eU9Ua3lOek5ETUM0eU1qWXlNRFlnTUM0Mk1qQXpJREF1TVRjd016UWdNQzQxTnpFMUlEQXVNVFkyTmpBMklEQXVOVEEwTkRNelF6QXVNVFkyTmpBMklEQXVOVEF4TmpNeklEQXVNVFkyTmpBMklEQXVORGs0TkRNeklEQXVNVFkyTmpBMklEQXVORGsxTWpNelF6QXVNVFkxTkRjeElEQXVORFkzTkRBNElEQXVNVGN6T0RBM0lEQXVORFF3TURJeElEQXVNVGt3TWpVeElEQXVOREUzTlRRMlF6QXVNakEyTmprMUlEQXVNemsxTURjeElEQXVNak13TWpjMklEQXVNemM0T0RNNUlEQXVNalUzTVRRZ01DNHpOekUxUXpBdU1qVTNNVFFnTUM0ek5qYzVJREF1TWpVM01UUWdNQzR6TmpRME16TWdNQzR5TlRjeE5DQXdMak0yTURnek0wTXdMakkxTnpneE1pQXdMak15TkRrek55QXdMakkyT1RBNU5DQXdMakk1TURBME5DQXdMakk0T1RVMk15QXdMakkyTURVME9VTXdMak14TURBek15QXdMakl6TVRBMU5DQXdMak16T0RjM05DQXdMakl3T0RJM055QXdMak0zTWpFMk5pQXdMakU1TlRBNE9VTXdMalF3TlRVMU9DQXdMakU0TVRrZ01DNDBOREl4TURZZ01DNHhOemc0T1NBd0xqUTNOekl3TmlBd0xqRTROalF6TjBNd0xqVXhNak13TmlBd0xqRTVNems0TkNBd0xqVTBORE00TnlBd0xqSXhNVGMxTVNBd0xqVTJPVFF3TmlBd0xqSXpOelZETUM0MU9EWTROVFVnTUM0eU5UUTNOeUF3TGpZd01UQXpPQ0F3TGpJM05UQTFNU0F3TGpZeE1USTNNeUF3TGpJNU56TTJOME13TGpZeU5Ua3dNaUF3TGpJNE5UWXhOQ0F3TGpZME5ERXdPQ0F3TGpJM09USXhOaUF3TGpZMk1qZzNNeUF3TGpJM09USXpNME13TGpjd01UVTBJREF1TWpjNU1qTXpJREF1TnpReU9EY3pJREF1TXpBMk9ETXpJREF1TnpRNU5qY3pJREF1TXpZNE0wTXdMamM0TWpVeklEQXVNemMwT0NBd0xqZ3hNakUzTXlBd0xqTTVNak0xSURBdU9ETXpOamN6SURBdU5ERTRNRE16VERBdU9ERXlOelFnTUM0ME16UTBNek5ETUM0M09USTNOelVnTUM0ME1URTFPVElnTUM0M05qVXlPVGNnTUM0ek9UWTJORGNnTUM0M016VXlOek1nTUM0ek9USXpRekF1TnpNeU1qY3pJREF1TXpreE9ERTVJREF1TnpJNU5USTJJREF1TXprd016STNJREF1TnpJM05Ea2dNQzR6T0Rnd056SkRNQzQzTWpVME5UTWdNQzR6T0RVNE1UY2dNQzQzTWpReU5EY2dNQzR6T0RJNU16UWdNQzQzTWpRd056TWdNQzR6TnprNVF6QXVOekl4TURBMklEQXVNekk0T0RNeklEQXVOamt4TVRRZ01DNHpNRFU1SURBdU5qWXlPRGN6SURBdU16QTFPVU13TGpZMU16azVOeUF3TGpNd05UazRNaUF3TGpZME5USTJJREF1TXpBNE1USWdNQzQyTXpjek5Ea2dNQzR6TVRJeE5EVkRNQzQyTWprME16Y2dNQzR6TVRZeE55QXdMall5TWpVMk5pQXdMak15TVRrM05DQXdMall4TnpJM015QXdMak15T1RGRE1DNDJNVFU0TkRFZ01DNHpNekV3TURrZ01DNDJNVE01TWpJZ01DNHpNekkwT1RrZ01DNDJNVEUzTVRjZ01DNHpNek0wTVRORE1DNDJNRGsxTVRNZ01DNHpNelF6TWpnZ01DNDJNRGN4TURNZ01DNHpNelEyTXpRZ01DNDJNRFEzTkNBd0xqTXpORE5ETUM0Mk1ESXpOallnTUM0ek16TTVNemNnTUM0Mk1EQXhNelVnTUM0ek16STVOREVnTUM0MU9UZ3lPREVnTUM0ek16RTBNVFpETUM0MU9UWTBNamNnTUM0ek1qazRPU0F3TGpVNU5UQXhPU0F3TGpNeU56ZzVNaUF3TGpVNU5ESXdOaUF3TGpNeU5UWXpNME13TGpVNE5UQTNPU0F3TGpJNU9UY3hOQ0F3TGpVM01ESTNNeUF3TGpJM05qRTJNaUF3TGpVMU1EZzNNeUF3TGpJMU5qZERNQzQxTWprMU56UWdNQzR5TXpRM09EY2dNQzQxTURJeU9EWWdNQzR5TVRrMk5ESWdNQzQwTnpJME1qSWdNQzR5TVRNeE5qTkRNQzQwTkRJMU5Ua2dNQzR5TURZMk9ETWdNQzQwTVRFME5EY2dNQzR5TURreE5UWWdNQzR6T0RJNU9ESWdNQzR5TWpBeU56RkRNQzR6TlRRMU1UY2dNQzR5TXpFek9EY2dNQzR6TWprNU5qTWdNQzR5TlRBMk5USWdNQzR6TVRJek9UTWdNQzR5TnpVMk5UUkRNQzR5T1RRNE1qUWdNQzR6TURBMk5UWWdNQzR5T0RVd01Ua2dNQzR6TXpBeU9EWWdNQzR5T0RReU1EWWdNQzR6TmpBNE16TkRNQzR5T0RReU1qVWdNQzR6TmpjeU1ETWdNQzR5T0RRMU9ERWdNQzR6TnpNMU5qZ2dNQzR5T0RVeU56TWdNQzR6TnprNVF6QXVNamcxTlRrMElEQXVNemd6TURneUlEQXVNamcwTnpZeElEQXVNemcyTWpjeklEQXVNamd5T1RJMUlEQXVNemc0T0RreVF6QXVNamd4TURrZ01DNHpPVEUxTVRFZ01DNHlOemd6TnpRZ01DNHpPVE16T0RNZ01DNHlOelV5TnpNZ01DNHpPVFF4TmpkRE1DNHlORFV3TURZZ01DNDBNREUyTXpNZ01DNHhPVE01TkNBd0xqUXlORGd6TXlBd0xqRTVNemswSURBdU5EazFNak16UXpBdU1Ua3pPREEySURBdU5EazNOak14SURBdU1Ua3pPREEySURBdU5UQXdNRE0xSURBdU1Ua3pPVFFnTUM0MU1ESTBNek5ETUM0eE9UWTROek1nTUM0MU5UVTNOamNnTUM0eU5ERTFOQ0F3TGpVNU16WXpNeUF3TGpNd01EWXdOaUF3TGpVNU16WXpNMGd3TGpRNE56STNNMHd3TGpRNE5UazBJREF1TmpJd00xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56STBOVEVnTUM0NE1UWTRNRFZETUM0MU1UUXpNVGdnTUM0NE1UWTRNRFVnTUM0MU1USTBOVEVnTUM0Mk16a3dOekVnTUM0MU1USTBOVEVnTUM0Mk16Y3pNemhXTUM0ME56VXdOekZETUM0MU1USTBORElnTUM0ME56SXpORGNnTUM0MU1UTXlOamdnTUM0ME5qazJPRFVnTUM0MU1UUTRNVGdnTUM0ME5qYzBORFZETUM0MU1UWXpOamNnTUM0ME5qVXlNRFFnTUM0MU1UZzFOallnTUM0ME5qTTBPVElnTUM0MU1qRXhNVGdnTUM0ME5qSTFNemhNTUM0Mk5qYzNPRFVnTUM0ME1EZ3lOekZETUM0Mk56QTRNRFFnTUM0ME1EY3lNRFFnTUM0Mk56UXdPVGdnTUM0ME1EY3lNRFFnTUM0Mk56Y3hNVGdnTUM0ME1EZ3lOekZNTUM0NE1qTTNPRFVnTUM0ME5qSTFNemhETUM0NE1qWXpNemNnTUM0ME5qTTBPVElnTUM0NE1qZzFNelVnTUM0ME5qVXlNRFFnTUM0NE16QXdPRFVnTUM0ME5qYzBORFZETUM0NE16RTJNelFnTUM0ME5qazJPRFVnTUM0NE16STBOaUF3TGpRM01qTTBOeUF3TGpnek1qUTFNU0F3TGpRM05UQTNNVll3TGpZME56TXpPRU13TGpnek1qUTFNU0F3TGpZME9UQTNNU0F3TGpnek1EVTROU0F3TGpneE5qZ3dOU0F3TGpZM01qUTFNU0F3TGpneE5qZ3dOVnBOTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZXTUM0Mk16Y3pNemhETUM0MU16a3hNVGdnTUM0Mk5ETTJNRFVnTUM0MU5EQTVPRFVnTUM0M09UQXhNemdnTUM0Mk56STBOVEVnTUM0M09UQXhNemhETUM0NE1ETTVNVGdnTUM0M09UQXhNemdnTUM0NE1EVTNPRFVnTUM0Mk5UTXlNRFVnTUM0NE1EVTNPRFVnTUM0Mk5EY3pNemhXTUM0ME9EUTBNRFZNTUM0Mk56STBOVEVnTUM0ME16UTVNemhNTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TkRNNUlEQXVOelkyT1RJMFF6QXVOVGczTmpNNUlEQXVOelkyT1RJMElEQXVOVFkyT0RNNUlEQXVOalU1TXpJMElEQXVOVFkxTnpjeklEQXVOalUwTnpreFF6QXVOVFkxTmpReElEQXVOalV6T1RrMklEQXVOVFkxTmpReElEQXVOalV6TVRnMUlEQXVOVFkxTnpjeklEQXVOalV5TXpreFZqQXVOVEUwTWpVNFF6QXVOVFkxTnpjZ01DNDFNVEUxT0RjZ01DNDFOalkxTmprZ01DNDFNRGc1TnpnZ01DNDFOamd3TmpjZ01DNDFNRFkzTmpkRE1DNDFOamsxTmpVZ01DNDFNRFExTlRZZ01DNDFOekUyT1RJZ01DNDFNREk0TkRZZ01DNDFOelF4TnpNZ01DNDFNREU0TlRoTU1DNDJOamMxTURZZ01DNDBOalV3TlRoRE1DNDJOekEyTnpRZ01DNDBOak0zT1RZZ01DNDJOelF5TURVZ01DNDBOak0zT1RZZ01DNDJOemN6TnpNZ01DNDBOalV3TlRoTU1DNDNOekEzTURZZ01DNDFNREU0TlRoRE1DNDNOek14T0RjZ01DNDFNREk0TkRZZ01DNDNOelV6TVRRZ01DNDFNRFExTlRZZ01DNDNOelk0TVRJZ01DNDFNRFkzTmpkRE1DNDNOemd6TURrZ01DNDFNRGc1TnpnZ01DNDNOemt4TURrZ01DNDFNVEUxT0RjZ01DNDNOemt4TURZZ01DNDFNVFF5TlRoV01DNDJOVEl6T1RGRE1DNDNOemt4TnpJZ01DNDJOVE14T1NBd0xqYzNPVEUzTWlBd0xqWTFNems1TWlBd0xqYzNPVEV3TmlBd0xqWTFORGM1TVVNd0xqYzNPREF6T1NBd0xqWTFPVE15TkNBd0xqYzFOekl6T1NBd0xqYzJOamt5TkNBd0xqWTNNalF6T1NBd0xqYzJOamt5TkZwTk1DNDFPVEkwTXprZ01DNDJOVEV3TlRoRE1DNDFPVFExTnpNZ01DNDJOakV4T1RFZ01DNDJNVE0yTXprZ01DNDNOREF5TlRnZ01DNDJOekkwTXprZ01DNDNOREF5TlRoRE1DNDNNekV5TXprZ01DNDNOREF5TlRnZ01DNDNOVEF6TURZZ01DNDJOakV6TWpRZ01DNDNOVEkwTXprZ01DNDJOVEV3TlRoV01DNDFNak16TWpSTU1DNDJOekkwTXprZ01DNDBPVEU0TlRoTU1DNDFPVEkwTXprZ01DNDFNak16TWpSV01DNDJOVEV3TlRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b20iIGlkPSIzIj4KICAgICAgPG14Q2VsbCBzdHlsZT0iaXIucmVmPWY5ZjM1NmI3LWQzNWUtNDA1Yy1iNDIzLTE2NjVmMTE0OGU3Yztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj12cGM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIxMjgiIHk9IjM4IiB3aWR0aD0iODQ4IiBoZWlnaHQ9IjQ1MiIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUzMgLSBTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPTA4YmRlY2E0LTY5MjMtNDA4OC04ZDg2LWI1YTY5MWJlODgzNTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1zMztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01DNDVPVGs1T1RWSU1WWXdXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RFNU1EVXhJREF1TlRNME1UZzRRekF1T0RFMU1UZzBJREF1TlRFek1qVTFJREF1TnpreE5EVXhJREF1TkRrNE5EVTFJREF1TnpjMU1UZzBJREF1TkRnM09USXlRekF1TnpZNU9UZzBJREF1TkRnME5UZzVJREF1TnpVMU56RTRJREF1TkRjNU1qVTFJREF1TnpVME5URTRJREF1TkRjME5UZzVRekF1TnpVME5ETTJJREF1TkRjeE1qVWdNQzQzTlRRNE9EWWdNQzQwTmpjNU1Ua2dNQzQzTlRVNE5URWdNQzQwTmpRM01qSk1NQzQzTmpreE9EUWdNQzR6TmpnNE5UWkRNQzQzTnpNd05URWdNQzR6TkRBM01qSWdNQzQzTnpZM09EUWdNQzR6TVRJMU9Ea2dNQzQzT0RBMk5URWdNQzR5T0RRME5UWkRNQzQzT0RReE1UZ2dNQzR5TlRnMU9Ea2dNQzQzTnpFM01UZ2dNQzR5TkRFeU5UWWdNQzQzTlRBMk5URWdNQzR5TWpZM01qTkRNQzQzTURjM01UZ2dNQzR4T1RZNU9Ea2dNQzQyTlRFM01UZ2dNQzR4T0RRNU9TQXdMall3TVRFNE5DQXdMakUzTmpjeU0wTXdMalV6TnpneE1TQXdMakUyTmpNM05pQXdMalEzTXpNMk5TQXdMakUyTkRJM0lEQXVOREE1TkRVeElEQXVNVGN3TkRVMlF6QXVNelV4T1RZMklEQXVNVGMwTmpjMElEQXVNamsxTlRRMklEQXVNVGc0TVRneklEQXVNalF5TXpnMElEQXVNakV3TkRVMlF6QXVNakV6T0RVeElEQXVNakl6TnpnNUlEQXVNVGMyTlRFNElEQXVNalEwTlRnNUlEQXVNVGd4TVRnMElEQXVNamd3T1RnNVF6QXVNVGswTlRFNElEQXVNemc1TWpVMklEQXVNakV3TWpVeElEQXVORGszTWpVMUlEQXVNakkwTnpnMElEQXVOakExTXpnNFF6QXVNak14TkRVeElEQXVOalUwT0RVMUlEQXVNak00TVRFNElEQXVOekEwTXpJeElEQXVNalEwTnpnMElEQXVOelV6TnpnNFF6QXVNalExT0RZZ01DNDNOak0wTWlBd0xqSTBPVFEySURBdU56Y3lOVGs0SURBdU1qVTFNakU1SURBdU56Z3dNemswUXpBdU1qWXdPVGM0SURBdU56ZzRNVGtnTUM0eU5qZzJPVE1nTUM0M09UUXpNamdnTUM0eU56YzFPRFFnTUM0M09UZ3hPRGhETUM0ek1UZzVNVGdnTUM0NE1qQTFPRGdnTUM0ek56QXhNVGdnTUM0NE1qWTVPRGdnTUM0ME1UWXlOVEVnTUM0NE16RXlOVFJETUM0ME56YzFPRE1nTUM0NE16WTNPVFFnTUM0MU16a3pPRElnTUM0NE16UXdOVGdnTUM0MU9UazVPRFFnTUM0NE1qTXhNakZETUM0Mk16Z3pPRFFnTUM0NE1UWXdOVFFnTUM0M01EazROVEVnTUM0NE1EUTBOVFFnTUM0M01UVTVPRFFnTUM0M05UWTBOVFJETUM0M01qTTFPRFFnTUM0Mk9UWTVPRGdnTUM0M016RTVPRFFnTUM0Mk16YzFNakVnTUM0M016azVPRFFnTUM0MU56Z3hPRGhNTUM0M05ESTVNVGdnTUM0MU5qQXdOVFZETUM0M05qUTJOVEVnTUM0MU5qVXlOVFVnTUM0NE1qWTJOVEVnTUM0MU56WXpNaklnTUM0NE1Ua3dOVEVnTUM0MU16UXhPRGhhVFRBdU5EZ3dOalV4SURBdU1Ua3pNemc1UXpBdU5UWXdOalV4SURBdU1Ua3pNemc1SURBdU5qVXlNalV4SURBdU1qQXlORFUySURBdU56SXpPVGcwSURBdU1qUXhPVEl6UXpBdU56TTFNRFV4SURBdU1qUTRNRFUySURBdU56WXdOemcwSURBdU1qWXhOemc1SURBdU56VXpNRFV4SURBdU1qYzRNRFUyUXpBdU56UTFNekU0SURBdU1qazBNekl6SURBdU56SXhNekU0SURBdU16QXlORFUySURBdU56QTJOalV4SURBdU16QTRNekl5UXpBdU5qZzFOekE0SURBdU16RTJNRFU1SURBdU5qWTBNVGNnTUM0ek1qSXdOemdnTUM0Mk5ESXlOVEVnTUM0ek1qWXpNakpETUM0MU5EY3dOelFnTUM0ek5EVXhOellnTUM0ME5Ea3pNamtnTUM0ek5EY3lNRGNnTUM0ek5UTTBOVEVnTUM0ek16SXpNakpETUM0ek1UQXhOVGdnTUM0ek1qYzROVGdnTUM0eU5qZ3dORFFnTUM0ek1UVTFNaklnTUM0eU1qa3hPRFFnTUM0eU9UVTVNak5ETUM0eU1UazFPRFFnTUM0eU9UQTBOVFlnTUM0eU1ETTNNVGdnTUM0eU9EQTFPRGtnTUM0eU1EZ3hNVGdnTUM0eU5qYzFNak5ETUM0eU1URTJNRE1nTUM0eU5qQTFNRElnTUM0eU1UY3dOelFnTUM0eU5UUTJOaUF3TGpJeU16ZzFNU0F3TGpJMU1EY3lNME13TGpJMU16RXpOeUF3TGpJek1UZzRPU0F3TGpJNE5UY3dNeUF3TGpJeE9EY3lOeUF3TGpNeE9UZzFNU0F3TGpJeE1Ua3lNME13TGpNM01qVXdOeUF3TGpFNU9USTRNaUF3TGpReU5qVWdNQzR4T1RNd05Ua2dNQzQwT0RBMk5URWdNQzR4T1RNek9EbFdNQzR4T1RNek9EbGFUVEF1TmpnNU56RTRJREF1TnpVMU16ZzRRekF1TmpnM056RTRJREF1Tnpjd09UZzRJREF1TmpZeE9UZzBJREF1TnpjNE56SXhJREF1TmpRNU56RTRJREF1Tnpnek1USXhRekF1TmpJME1qVXhJREF1TnpreE5qUWdNQzQxT1RjNU9ESWdNQzQzT1RjMU16Y2dNQzQxTnpFek1UZ2dNQzQ0TURBM01qRkRNQzQxTVRJeE5UWWdNQzQ0TURnMU9EY2dNQzQwTlRJeU1UTWdNQzQ0TURnMU9EY2dNQzR6T1RNd05URWdNQzQ0TURBM01qRkRNQzR6TlRVNU9UWWdNQzQzT1RjNE5EWWdNQzR6TVRrNE1USWdNQzQzT0Rnd016RWdNQzR5T0RZek9EUWdNQzQzTnpFM09EaERNQzR5T0RFNE16WWdNQzQzTmprNE1URWdNQzR5TnpjNU15QXdMamMyTmpZd05TQXdMakkzTlRFd015QXdMamMyTWpVelF6QXVNamN5TWpjM0lEQXVOelU0TkRVMklEQXVNamN3TmpReklEQXVOelV6TmpjeklEQXVNamN3TXpnMElEQXVOelE0TnpJeFF6QXVNalUzTURVeElEQXVOalF5T1RnNElEQXVNalF4T0RVeElEQXVOVE0zTWpVMUlEQXVNakkzTlRnMElEQXVORE14TlRJeVREQXVNakV5TVRFNElEQXVNekUyT0RVMlF6QXVNalF5TkRJNUlEQXVNek16TlRnM0lEQXVNamMxTXpJNUlEQXVNelExTVRJMElEQXVNekE1TkRVeElEQXVNelV3T1RnNVF6QXVNelExT1RrNElEQXVNelU0TkRJM0lEQXVNemd6TURJeUlEQXVNell6TWpneklEQXVOREl3TWpVeElEQXVNelkxTlRJeVF6QXVORGt6TXpFMUlEQXVNemN3TnpVNElEQXVOVFkyTnpRNUlEQXVNelkyTmpneElEQXVOak00TnpnMElEQXVNelV6TXpnNVF6QXVOamMzTVRZM0lEQXVNelEzT0RZNElEQXVOekUwTWpRMklEQXVNek0xTkRrMElEQXVOelE0TWpVeElEQXVNekUyT0RVMlREQXVOekU1T1RnMElEQXVOVEkyTVRnNFF6QXVOalV5TkRFNElEQXVOVEF6T1RJNElEQXVOVGcyTkRBMklEQXVORGMzTWpBeklEQXVOVEl5TXpnMElEQXVORFEyTVRnNVF6QXVOVEU1TlRjMUlEQXVORFExTVRFM0lEQXVOVEUyT0RVMklEQXVORFF6T0RJMElEQXVOVEUwTWpVeElEQXVORFF5TXpJeVF6QXVOVEV3TmpVeElEQXVORE01TmpVMUlEQXVOVEV4TlRnMElEQXVORFF3T1RnNUlEQXVOVEE1T0RVeElEQXVORE0yT0RVMVF6QXVOVEEyTlRFNElEQXVOREk1TWpVMUlEQXVOVEExTnpFNElEQXVOREl6TlRJeUlEQXVORGs0TmpVeElEQXVOREUzTWpVMVF6QXVORGswT0RNMklEQXVOREUwTWlBd0xqUTVNRE16TWlBd0xqUXhNakV5TXlBd0xqUTROVFV6TVNBd0xqUXhNVEl3TlVNd0xqUTRNRGN6SURBdU5ERXdNamczSURBdU5EYzFOemM0SURBdU5ERXdOVFUySURBdU5EY3hNVEExSURBdU5ERXhPVGc0UXpBdU5EWTJORE14SURBdU5ERXpOREl4SURBdU5EWXlNVGM1SURBdU5ERTFPVGMwSURBdU5EVTROekUzSURBdU5ERTVOREkwUXpBdU5EVTFNalUySURBdU5ESXlPRGMxSURBdU5EVXlOamtnTUM0ME1qY3hNVGtnTUM0ME5URXlORElnTUM0ME16RTNPRGhETUM0ME5EazNPVFVnTUM0ME16WTBOVGNnTUM0ME5EazFNU0F3TGpRME1UUXdPQ0F3TGpRMU1EUXhNeUF3TGpRME5qSXhNa013TGpRMU1UTXhOaUF3TGpRMU1UQXhOaUF3TGpRMU16TTNPU0F3TGpRMU5UVXlOaUF3TGpRMU5qUXlNaUF3TGpRMU9UTTFNVU13TGpRMU9UUTJOaUF3TGpRMk16RTNOU0F3TGpRMk16TTVPQ0F3TGpRMk5qRTVPU0F3TGpRMk56ZzNOaUF3TGpRMk9ERTFOME13TGpRM01qTTFOQ0F3TGpRM01ERXhOaUF3TGpRM056STBNeUF3TGpRM01EazFJREF1TkRneU1URTRJREF1TkRjd05UZzVRekF1TkRnMk56RTBJREF1TkRZNU9ESTJJREF1TkRreE1UazBJREF1TkRZNE5EZ3lJREF1TkRrMU5EVXhJREF1TkRZMk5UZzVRekF1TlRBd05qVXhJREF1TkRZME9UZzVJREF1TlRBd05qVXhJREF1TkRZMU1qVTFJREF1TlRBMk1URTRJREF1TkRZM056ZzVRekF1TlRjd09UWXlJREF1TkRrNU5EQTRJREF1TmpNM056WTJJREF1TlRJMk9EUXlJREF1TnpBMk1URTRJREF1TlRRNU9USXlRekF1TnpFMk16ZzBJREF1TlRVek1qVTFJREF1TnpFMk1qVXhJREF1TlRRNU9USXlJREF1TnpFMk1qVXhJREF1TlRVNE5EVTFRekF1TnpFMU9ERTRJREF1TlRZME9UUTNJREF1TnpFME9UY3lJREF1TlRjeE5EQTBJREF1TnpFek56RTRJREF1TlRjM056ZzRUREF1TnpBMU1UZzBJREF1TmpReE16ZzRUREF1TmpnNU56RTRJREF1TnpVMU16ZzRXazB3TGpRNE16azROQ0F3TGpRME1EQTFOVU13TGpRNE16azROQ0F3TGpRME16WTFOU0F3TGpRM09Ea3hPQ0F3TGpRME16STFOU0F3TGpRM056VTROQ0F3TGpRME1EazRPVU13TGpRM05qSTFNU0F3TGpRek9EY3lNaUF3TGpRNE16azROQ0F3TGpRek5EazRPU0F3TGpRNE16azROQ0F3TGpRME1EQTFOVnBOTUM0M05EWTJOVEVnTUM0MU16TXpPRGhNTUM0M05UQTJOVEVnTUM0MU1ETTVNakpETUM0M05qTTVPRFFnTUM0MU1URTFNaklnTUM0M09EWTJOVEVnTUM0MU1qSTVPRGdnTUM0M09USTJOVEVnTUM0MU16Z3hPRGhETUM0M056azFPRFFnTUM0MU5ETTFNaklnTUM0M05UZzVNVGdnTUM0MU16WTBOVFVnTUM0M05EWTJOVEVnTUM0MU16TXpPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3dOamNpSUhreFBTSXhMakl3TnpBMklpQjRNajBpTVM0eU1EY3dOaUlnZVRJOUlpMHdMakl3TnpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekZDTmpZd1JpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOa05CUlRORklpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJd0xqazVPVGs1TlNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI3MjEiIHk9IjMxMyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNSIgdmFsdWU9IkxhbWJkYSBGdW5jdGlvbiIgc3R5bGU9ImlyLnJlZj02MzQzNjA1MS03OTdlLTRjYTctOWE3MC1kZGYzYTZjNGVmMWE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXdzLWxhbWJkYS1mdW5jdGlvbjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTFNVEVnTUM0NE16TXlPVWd3TGpZME1qSTBORU13TGpZek9UY3pNU0F3TGpnek16STRNeUF3TGpZek56STNNU0F3TGpnek1qVTJOaUF3TGpZek5URTBPQ0F3TGpnek1USXlNVU13TGpZek16QXlOU0F3TGpneU9UZzNOeUF3TGpZek1UTXlOU0F3TGpneU56azFPU0F3TGpZek1ESTBOQ0F3TGpneU5UWTVUREF1TXprM09UYzNJREF1TXpNNU9UVTVTREF1TWprNU56RkRNQzR5T1RZeE56UWdNQzR6TXprNU5Ua2dNQzR5T1RJM09ETWdNQzR6TXpnMU5UUWdNQzR5T1RBeU9ESWdNQzR6TXpZd05UTkRNQzR5T0RjM09ESWdNQzR6TXpNMU5UTWdNQzR5T0RZek56Y2dNQzR6TXpBeE5qSWdNQzR5T0RZek56Y2dNQzR6TWpZMk1qVldNQzR4TnprNU5UbERNQzR5T0RZek56Y2dNQzR4TnpZME1qTWdNQzR5T0RjM09ESWdNQzR4TnpNd016SWdNQzR5T1RBeU9ESWdNQzR4TnpBMU16RkRNQzR5T1RJM09ETWdNQzR4Tmpnd016RWdNQzR5T1RZeE56UWdNQzR4TmpZMk1qWWdNQzR5T1RrM01TQXdMakUyTmpZeU5rZ3dMalV3TlRBME5FTXdMalV3TnpVMU55QXdMakUyTmpZek15QXdMalV4TURBeE55QXdMakUyTnpNMUlEQXVOVEV5TVRRZ01DNHhOamcyT1RWRE1DNDFNVFF5TmpRZ01DNHhOekF3TkNBd0xqVXhOVGsyTXlBd0xqRTNNVGsxTnlBd0xqVXhOekEwTkNBd0xqRTNOREl5Tmt3d0xqYzBPREkwTlNBd0xqWTFPVGsxT0Vnd0xqZ3dOalV4TVVNd0xqZ3hNREEwT0NBd0xqWTFPVGsxT0NBd0xqZ3hNelF6T1NBd0xqWTJNVE0yTWlBd0xqZ3hOVGt6T1NBd0xqWTJNemcyTTBNd0xqZ3hPRFEwSURBdU5qWTJNell6SURBdU9ERTVPRFExSURBdU5qWTVOelUxSURBdU9ERTVPRFExSURBdU5qY3pNamt4VmpBdU9ERTVPVFUzUXpBdU9ERTVPRFExSURBdU9ESXpORGt6SURBdU9ERTRORFFnTUM0NE1qWTRPRFVnTUM0NE1UVTVNemtnTUM0NE1qa3pPRFZETUM0NE1UTTBNemtnTUM0NE16RTRPRFlnTUM0NE1UQXdORGdnTUM0NE16TXlPU0F3TGpnd05qVXhNU0F3TGpnek16STVXazB3TGpZMU1EWTBOQ0F3TGpnd05qWXlORWd3TGpjNU16RTNPRll3TGpZNE5qWXlORWd3TGpjek9UZzBOVU13TGpjek56TXpNU0F3TGpZNE5qWXhOeUF3TGpjek5EZzNNU0F3TGpZNE5Ua2dNQzQzTXpJM05EZ2dNQzQyT0RRMU5UVkRNQzQzTXpBMk1qVWdNQzQyT0RNeU1TQXdMamN5T0RreU5TQXdMalk0TVRJNU15QXdMamN5TnpnME5TQXdMalkzT1RBeU5Fd3dMalE1TmpZME5DQXdMakU1TXpJNU0wZ3dMak14TXpFM04xWXdMak14TXpJNU1rZ3dMalF3TmpVeE1VTXdMalF3T1RBeU5DQXdMak14TXpJNU9TQXdMalF4TVRRNE5DQXdMak14TkRBeE5pQXdMalF4TXpZd055QXdMak14TlRNMk1VTXdMalF4TlRjeklEQXVNekUyTnpBMklEQXVOREUzTkRNZ01DNHpNVGcyTWpNZ01DNDBNVGcxTVRFZ01DNHpNakE0T1RKTU1DNDJOVEEyTkRRZ01DNDRNRFkyTWpSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZMk1qUTVJREF1T0RNek16WTRTREF1TVRreU9URTJRekF1TVRrd05qVWdNQzQ0TXpNek56TWdNQzR4T0RnME1pQXdMamd6TWpnZ01DNHhPRFkwTXpjZ01DNDRNekUzTURORE1DNHhPRFEwTlRRZ01DNDRNekEyTURjZ01DNHhPREkzT0RNZ01DNDRNamt3TWpNZ01DNHhPREUxT0RJZ01DNDRNamN4TURGRE1DNHhPREF6TURrZ01DNDRNalV4TXpRZ01DNHhOemsxTnpjZ01DNDRNakk0TmpVZ01DNHhOemswTmlBd0xqZ3lNRFV5TkVNd0xqRTNPVE0wTXlBd0xqZ3hPREU0TXlBd0xqRTNPVGcwTlNBd0xqZ3hOVGcxTXlBd0xqRTRNRGt4TmlBd0xqZ3hNemMyT0V3d0xqTTJNakkwT1NBd0xqUXpORGsyT0VNd0xqTTJNek16SURBdU5ETXlOams1SURBdU16WTFNREk1SURBdU5ETXdOemd5SURBdU16WTNNVFV6SURBdU5ESTVORE0zUXpBdU16WTVNamMySURBdU5ESTRNRGt6SURBdU16Y3hOek0ySURBdU5ESTNNemMxSURBdU16YzBNalE1SURBdU5ESTNNelk0VmpBdU5ESTNNelk0UXpBdU16YzJOelE0SURBdU5ESTNNell6SURBdU16YzVNVGs0SURBdU5ESTRNRFl4SURBdU16Z3hNeklnTUM0ME1qa3pPREZETUM0ek9ETTBOREVnTUM0ME16QTNNREVnTUM0ek9EVXhORGtnTUM0ME16STFPVEVnTUM0ek9EWXlORGtnTUM0ME16UTRNelZNTUM0ME56TXdORGtnTUM0Mk1UTXpOamhETUM0ME56TTVNak1nTUM0Mk1UVXhOemNnTUM0ME56UXpOellnTUM0Mk1UY3hOaUF3TGpRM05ETTNOaUF3TGpZeE9URTJPRU13TGpRM05ETTNOaUF3TGpZeU1URTNOeUF3TGpRM016a3lNeUF3TGpZeU16RTJJREF1TkRjek1EUTVJREF1TmpJME9UWTRUREF1TXpjNE16Z3lJREF1T0RJME9UWTRRekF1TXpjM05ERXhJREF1T0RJM05EQTNJREF1TXpjMU56UXlJREF1T0RJNU5UQTJJREF1TXpjek5UZzBJREF1T0RNeFF6QXVNemN4TkRJMUlEQXVPRE15TkRrMElEQXVNelk0T0RjMElEQXVPRE16TXpFNElEQXVNelkyTWpRNUlEQXVPRE16TXpZNFdrMHdMakl4TkRJME9TQXdMamd3Tmpjd01rZ3dMak0xTnpnME9Vd3dMalEwTmpJME9TQXdMall5TURBek5Vd3dMak0zTkRNNE1pQXdMalEzTVRNMk9Fd3dMakl4TkRJME9TQXdMamd3Tmpjd01sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4c2FXNWxZWEpIY21Ga2FXVnVkQ0JwWkQwaWNHRnBiblF3WDJ4cGJtVmhjaUlnZURFOUlpMHdMakl3TnpJaUlIa3hQU0l4TGpJd056SWlJSGd5UFNJeExqSXdOekEzSWlCNU1qMGlMVEF1TWpBM01EWTNJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqUXpnMU1URkNJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpFaUlITjBiM0F0WTI5c2IzSTlJaU5HUmprNU1EQWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzIxIiB5PSI0MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNiIgdmFsdWU9IkVMQiAtIEVsYXN0aWMgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0yYTg5YzQ4OC0xNmYwLTQ2NTktODdkMi04NWU0MTM2ZDcyNjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bG9hZC1iYWxhbmNlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qQTBOelFnTUM0MU1UTXlOME13TGpZMk16Z3lOQ0F3TGpVek16Z3pOaUF3TGpZM05EYzVOQ0F3TGpVMU1qTTRPQ0F3TGpZNU1USWdNQzQxTmpVeU16UkRNQzQzTURjMk1EY2dNQzQxTnpnd09DQXdMamN5T0RJME9DQXdMalU0TkRJNElEQXVOelE1TURFM0lEQXVOVGd5TmtNd0xqYzJPVGM0TnlBd0xqVTRNRGt4T1NBd0xqYzRPVEUyTXlBd0xqVTNNVFE0TWlBd0xqZ3dNekk1SURBdU5UVTJNVFkxUXpBdU9ERTNOREU0SURBdU5UUXdPRFE0SURBdU9ESTFNall5SURBdU5USXdOemMwSURBdU9ESTFNall5SURBdU5EazVPVE0yUXpBdU9ESTFNall5SURBdU5EYzVNRGs1SURBdU9ERTNOREU0SURBdU5EVTVNREkxSURBdU9EQXpNamtnTUM0ME5ETTNNRGhETUM0M09Ea3hOak1nTUM0ME1qZ3pPVEVnTUM0M05qazNPRGNnTUM0ME1UZzVOVE1nTUM0M05Ea3dNVGNnTUM0ME1UY3lOek5ETUM0M01qZ3lORGdnTUM0ME1UVTFPVElnTUM0M01EYzJNRGNnTUM0ME1qRTNPVElnTUM0Mk9URXlJREF1TkRNME5qTTRRekF1TmpjME56azBJREF1TkRRM05EZzFJREF1TmpZek9ESTBJREF1TkRZMk1ETTJJREF1TmpZd05EYzBJREF1TkRnMk5qQXpTREF1TlRZeE1EQTRRekF1TlRVNU5EWTFJREF1TkRZeU1EVTBJREF1TlRVek1USXpJREF1TkRNNE1EUTFJREF1TlRReU16UXhJREF1TkRFMU9UTTJUREF1TmpZeU16UXhJREF1TXpFME5EWTVRekF1TmpjM01EWTJJREF1TXpJMk1USXpJREF1TmprMU16RXhJREF1TXpNeU5ETTBJREF1TnpFME1Ea2dNQzR6TXpJek4wTXdMamN6TWpnMk9TQXdMak16TWpNd055QXdMamMxTVRBM0lEQXVNekkxT0RjeElEQXVOelkxTnpFMklEQXVNekUwTVRFNFF6QXVOemd3TXpZeElEQXVNekF5TXpZMElEQXVOemt3TlRnMElEQXVNamcxT1RnNElEQXVOemswTnpFeUlEQXVNalkzTmpZNFF6QXVOems0T0RRZ01DNHlORGt6TkRnZ01DNDNPVFkyTWprZ01DNHlNekF4TnlBd0xqYzRPRFEwSURBdU1qRXpNamN4UXpBdU56Z3dNalVnTUM0eE9UWXpOeklnTUM0M05qWTFOamdnTUM0eE9ESTNOVElnTUM0M05EazJNekVnTUM0eE56UTJORU13TGpjek1qWTVOU0F3TGpFMk5qVXlPU0F3TGpjeE16VXdOeUF3TGpFMk5EUXdOU0F3TGpZNU5USXdOaUF3TGpFMk9EWXhOME13TGpZM05qa3dOaUF3TGpFM01qZ3lPU0F3TGpZMk1EVTNOeUF3TGpFNE16RXlOeUF3TGpZME9EZzVJREF1TVRrM09ESTNRekF1TmpNM01qQTBJREF1TWpFeU5USTJJREF1TmpNd09EVXlJREF1TWpNd056VTNJREF1TmpNd09EYzBJREF1TWpRNU5UTTJRekF1TmpNd056RTRJREF1TWpZMU5qTTJJREF1TmpNMU16WWdNQzR5T0RFME1UY2dNQzQyTkRReU1EZ2dNQzR5T1RRNE5qbE1NQzQxTWpneU1EZ2dNQzR6T1RJMk1ETkRNQzQxTURVeE56Y2dNQzR6TlRnd09UZ2dNQzQwTnpFMk5UZ2dNQzR6TXpFNU1UY2dNQzQwTXpJMk1ETWdNQzR6TVRjNU1qZERNQzR6T1RNMU5EZ2dNQzR6TURNNU16Z2dNQzR6TlRFd01qa2dNQzR6TURJNE9ERWdNQzR6TVRFek1qZ2dNQzR6TVRRNU1UUkRNQzR5TnpFMk1qY2dNQzR6TWpZNU5EY2dNQzR5TXpZNE5Ea2dNQzR6TlRFME16RWdNQzR5TVRJeE16TWdNQzR6T0RRM05EbERNQzR4T0RjME1UWWdNQzQwTVRnd05qY2dNQzR4TnpRd056SWdNQzQwTlRnME5URWdNQzR4TnpRd056SWdNQzQwT1RrNU16WkRNQzR4TnpRd056SWdNQzQxTkRFME1qRWdNQzR4T0RjME1UWWdNQzQxT0RFNE1EWWdNQzR5TVRJeE16TWdNQzQyTVRVeE1qUkRNQzR5TXpZNE5Ea2dNQzQyTkRnME5ERWdNQzR5TnpFMk1qY2dNQzQyTnpJNU1qWWdNQzR6TVRFek1qZ2dNQzQyT0RRNU5UaERNQzR6TlRFd01qa2dNQzQyT1RZNU9URWdNQzR6T1RNMU5EZ2dNQzQyT1RVNU16VWdNQzQwTXpJMk1ETWdNQzQyT0RFNU5EVkRNQzQwTnpFMk5UZ2dNQzQyTmpjNU5UVWdNQzQxTURVeE56Y2dNQzQyTkRFM056UWdNQzQxTWpneU1EZ2dNQzQyTURjeU4wd3dMalkwTkRJd09DQXdMamN3TlRBd00wTXdMall6TlRNMklEQXVOekU0TkRVMUlEQXVOak13TnpFNElEQXVOek0wTWpNM0lEQXVOak13T0RjMElEQXVOelV3TXpNM1F6QXVOak13T0RZM0lEQXVOelk1TURnZ01DNDJNemN5TVRrZ01DNDNPRGN5TnpFZ01DNDJORGc0T1RFZ01DNDRNREU1TXpaRE1DNDJOakExTmpRZ01DNDRNVFkyTURFZ01DNDJOelk0TmpjZ01DNDRNalk0TnpFZ01DNDJPVFV4TXpRZ01DNDRNekV3TmpoRE1DNDNNVE0wTURFZ01DNDRNelV5TmpVZ01DNDNNekkxTlRJZ01DNDRNek14TkNBd0xqYzBPVFExTlNBd0xqZ3lOVEEwUXpBdU56WTJNelU0SURBdU9ERTJPVFF4SURBdU56Z3dNREV5SURBdU9EQXpNelEySURBdU56ZzRNVGcySURBdU56ZzJORGM1UXpBdU56azJNellnTUM0M05qazJNVElnTUM0M09UZzFOamtnTUM0M05UQTBOekVnTUM0M09UUTBOVE1nTUM0M016SXhPRFZETUM0M09UQXpNellnTUM0M01UTTRPVGtnTUM0M09EQXhNemNnTUM0Mk9UYzFOVElnTUM0M05qVTFNalFnTUM0Mk9EVTRNVFJETUM0M05UQTVNVEVnTUM0Mk56UXdOemNnTUM0M016STNORGNnTUM0Mk5qYzJORFlnTUM0M01UUXdNRFFnTUM0Mk5qYzFOekZETUM0Mk9UVXlOakVnTUM0Mk5qYzBPVFlnTUM0Mk56Y3dORGNnTUM0Mk56TTNPRE1nTUM0Mk5qSXpOREVnTUM0Mk9EVTBNRE5NTUM0MU5ESXpOREVnTUM0MU9ETTVNelpETUM0MU5UTXhNak1nTUM0MU5qRTRNamdnTUM0MU5UazBOalVnTUM0MU16YzRNVGtnTUM0MU5qRXdNRGdnTUM0MU1UTXlOMGd3TGpZMk1EUTNORnBOTUM0M05ESXdOelFnTUM0ME5ETTJOamxETUM0M05UTXlNRGtnTUM0ME5ETTJORE1nTUM0M05qUXhJREF1TkRRMk9USXhJREF1Tnpjek16Y3hJREF1TkRVek1EZzNRekF1TnpneU5qUXhJREF1TkRVNU1qVTBJREF1TnpnNU9EYzBJREF1TkRZNE1ETXlJREF1TnprME1UVXpJREF1TkRjNE16RXhRekF1TnprNE5ETXlJREF1TkRnNE5Ua2dNQzQzT1RrMU5qVWdNQzQwT1RrNU1EZ2dNQzQzT1RjME1Ea2dNQzQxTVRBNE16RkRNQzQzT1RVeU5UTWdNQzQxTWpFM05UVWdNQzQzT0RrNU1EVWdNQzQxTXpFM09UTWdNQzQzT0RJd05ERWdNQzQxTXprMk56VkRNQzQzTnpReE56Z2dNQzQxTkRjMU5UZ2dNQzQzTmpReE5USWdNQzQxTlRJNU15QXdMamMxTXpJek5DQXdMalUxTlRFeE1rTXdMamMwTWpNeE5pQXdMalUxTnpJNU5DQXdMamN6TURrNU5TQXdMalUxTmpFNE55QXdMamN5TURjd05pQXdMalUxTVRrek0wTXdMamN4TURReE55QXdMalUwTnpZM09DQXdMamN3TVRZeU1pQXdMalUwTURRMk5pQXdMalk1TlRRek15QXdMalV6TVRJeFF6QXVOamc1TWpRMElEQXVOVEl4T1RVMElEQXVOamcxT1RReElEQXVOVEV4TURjZ01DNDJPRFU1TkRFZ01DNDBPVGs1TXpaRE1DNDJPRFU1TkRFZ01DNDBPRFV3TXpZZ01DNDJPVEU0TlRFZ01DNDBOekEzTkRVZ01DNDNNREl6TnpRZ01DNDBOakF4T1RkRE1DNDNNVEk0T1RjZ01DNDBORGsyTkRnZ01DNDNNamN4TnpVZ01DNDBORE0zTURVZ01DNDNOREl3TnpRZ01DNDBORE0yTmpsV01DNDBORE0yTmpsYVRUQXVOekUwTXpReElEQXVNVGt6TWpZNVF6QXVOekkxTkRjZ01DNHhPVE15TmprZ01DNDNNell6TkRnZ01DNHhPVFkxTmprZ01DNDNORFUyTURFZ01DNHlNREkzTlRKRE1DNDNOVFE0TlRRZ01DNHlNRGc1TXpRZ01DNDNOakl3TmpZZ01DNHlNVGMzTWpJZ01DNDNOall6TWpVZ01DNHlNamd3TURORE1DNDNOekExT0RNZ01DNHlNemd5T0RVZ01DNDNOekUyT1RnZ01DNHlORGsxT1RnZ01DNDNOamsxTWpjZ01DNHlOakExTVRORE1DNDNOamN6TlRVZ01DNHlOekUwTWpnZ01DNDNOakU1T1RjZ01DNHlPREUwTlRNZ01DNDNOVFF4TWpnZ01DNHlPRGt6TWpKRE1DNDNORFl5TlRrZ01DNHlPVGN4T1RJZ01DNDNNell5TXpNZ01DNHpNREkxTlNBd0xqY3lOVE14T0NBd0xqTXdORGN5TVVNd0xqY3hORFF3TXlBd0xqTXdOamc1TXlBd0xqY3dNekE1SURBdU16QTFOemM0SURBdU5qa3lPREE1SURBdU16QXhOVEpETUM0Mk9ESTFNamNnTUM0eU9UY3lOakVnTUM0Mk56TTNOQ0F3TGpJNU1EQTBPU0F3TGpZMk56VTFOeUF3TGpJNE1EYzVOa013TGpZMk1UTTNOQ0F3TGpJM01UVTBNeUF3TGpZMU9EQTNOQ0F3TGpJMk1EWTJOQ0F3TGpZMU9EQTNOQ0F3TGpJME9UVXpOa013TGpZMU9EQTNOQ0F3TGpJek5EWXhNeUF3TGpZMk5EQXdNaUF3TGpJeU1ETXdNU0F3TGpZM05EVTFOQ0F3TGpJd09UYzBPVU13TGpZNE5URXdOeUF3TGpFNU9URTVOeUF3TGpZNU9UUXhPQ0F3TGpFNU16STJPU0F3TGpjeE5ETTBNU0F3TGpFNU16STJPVnBOTUM0M01UUXpOREVnTUM0Mk9UUXlNRE5ETUM0M01qVTBOelVnTUM0Mk9UUXlNRE1nTUM0M016WXpOVGtnTUM0Mk9UYzFNRGNnTUM0M05EVTJNVFVnTUM0M01ETTJPVFZETUM0M05UUTROekVnTUM0M01EazRPRFFnTUM0M05qSXdPRE1nTUM0M01UZzJOemtnTUM0M05qWXpNemNnTUM0M01qZzVOamxETUM0M056QTFPVElnTUM0M016a3lOVGdnTUM0M056RTJPVGdnTUM0M05UQTFOemdnTUM0M05qazFNVGNnTUM0M05qRTBPVFpETUM0M05qY3pNelVnTUM0M056STBNVFVnTUM0M05qRTVOak1nTUM0M09ESTBOQ0F3TGpjMU5EQTRJREF1Tnprd016QTBRekF1TnpRMk1UazRJREF1TnprNE1UWTNJREF1TnpNMk1UWWdNQzQ0TURNMU1UWWdNQzQzTWpVeU16WWdNQzQ0TURVMk56SkRNQzQzTVRRek1UTWdNQzQ0TURjNE1qZ2dNQzQzTURJNU9UVWdNQzQ0TURZMk9UUWdNQzQyT1RJM01UWWdNQzQ0TURJME1UVkRNQzQyT0RJME16Y2dNQzQzT1RneE16WWdNQzQyTnpNMk5Ua2dNQzQzT1RBNU1EUWdNQzQyTmpjME9USWdNQzQzT0RFMk16TkRNQzQyTmpFek1qWWdNQzQzTnpJek5qSWdNQzQyTlRnd05EZ2dNQzQzTmpFME56RWdNQzQyTlRnd056UWdNQzQzTlRBek16ZERNQzQyTlRneE1TQXdMamN6TlRRek55QXdMalkyTkRBMU15QXdMamN5TVRFMU9TQXdMalkzTkRZd01pQXdMamN4TURZek5rTXdMalk0TlRFMUlEQXVOekF3TVRFeklEQXVOams1TkRReElEQXVOamswTWpBeklEQXVOekUwTXpReElEQXVOamswTWpBeldrMHdMak0yT0RJd09DQXdMalkyTmpZd00wTXdMak16TlRJME5DQXdMalkyTmpZd015QXdMak13TXpBeU1TQXdMalkxTmpneU9DQXdMakkzTlRZeE15QXdMall6T0RVeE5VTXdMakkwT0RJd05TQXdMall5TURJd01TQXdMakl5TmpnME1pQXdMalU1TkRFM01TQXdMakl4TkRJeU9DQXdMalUyTXpjeE4wTXdMakl3TVRZeE15QXdMalV6TXpJMk15QXdMakU1T0RNeE15QXdMalE1T1RjMU1TQXdMakl3TkRjME5DQXdMalEyTnpReU1VTXdMakl4TVRFM05DQXdMalF6TlRBNU1TQXdMakl5TnpBME9DQXdMalF3TlRNNU5DQXdMakkxTURNMU55QXdMak00TWpBNE5VTXdMakkzTXpZMk5TQXdMak0xT0RjM05pQXdMak13TXpNMk15QXdMak0wTWprd015QXdMak16TlRZNU15QXdMak16TmpRM01rTXdMak0yT0RBeU15QXdMak16TURBME1TQXdMalF3TVRVek5DQXdMak16TXpNME1TQXdMalF6TVRrNE9DQXdMak0wTlRrMU5rTXdMalEyTWpRME15QXdMak0xT0RVM01TQXdMalE0T0RRM01pQXdMak0zT1Rrek15QXdMalV3TmpjNE5pQXdMalF3TnpNME1VTXdMalV5TlRFZ01DNDBNelEzTkRrZ01DNDFNelE0TnpRZ01DNDBOalk1TnpNZ01DNDFNelE0TnpRZ01DNDBPVGs1TXpaRE1DNDFNelE0TURRZ01DNDFORFF4TVRjZ01DNDFNVGN5TWpJZ01DNDFPRFkwTmprZ01DNDBPRFU1T0RFZ01DNDJNVGMzTVVNd0xqUTFORGMwSURBdU5qUTRPVFV4SURBdU5ERXlNemc1SURBdU5qWTJOVE16SURBdU16WTRNakE0SURBdU5qWTJOakF6VmpBdU5qWTJOakF6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI3MiIgeT0iMTg5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJFQzIgLSBFbGFzdGljIENvbXB1dGUgQ2xvdWQiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTJNamdnTUM0MU16azVOVGxJTUM0M016azVOakZXTUM0MU1UTXlPVE5JTUM0NE1EWTJNamhXTUM0eE9UTXlPVE5JTUM0ME9EWTJNamhXTUM0eU5UazVOVGxJTUM0ME5UazVOakZXTUM0eE9UTXlPVE5ETUM0ME5UazVOakVnTUM0eE9EWXlNaUF3TGpRMk1qYzNJREF1TVRjNU5ETTNJREF1TkRZM056Y3hJREF1TVRjME5ETTJRekF1TkRjeU56Y3lJREF1TVRZNU5ETTFJREF1TkRjNU5UVTFJREF1TVRZMk5qSTJJREF1TkRnMk5qSTRJREF1TVRZMk5qSTJTREF1T0RBMk5qSTRRekF1T0RFek55QXdMakUyTmpZeU5pQXdMamd5TURRNE15QXdMakUyT1RRek5TQXdMamd5TlRRNE5DQXdMakUzTkRRek5rTXdMamd6TURRNE5TQXdMakUzT1RRek55QXdMamd6TXpJNU5DQXdMakU0TmpJeUlEQXVPRE16TWprMElEQXVNVGt6TWprelZqQXVOVEV6TWprelF6QXVPRE16TWprMElEQXVOVEl3TXpZMUlEQXVPRE13TkRnMUlEQXVOVEkzTVRRNElEQXVPREkxTkRnMElEQXVOVE15TVRRNVF6QXVPREl3TkRneklEQXVOVE0zTVRVZ01DNDRNVE0zSURBdU5UTTVPVFU1SURBdU9EQTJOakk0SURBdU5UTTVPVFU1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV4TXpFM0lEQXVPRE16TWprMFNEQXVNVGt6TVRjeFF6QXVNVGcyTURrNElEQXVPRE16TWprMElEQXVNVGM1TXpFMUlEQXVPRE13TkRnMUlEQXVNVGMwTXpFMElEQXVPREkxTkRnMFF6QXVNVFk1TXpFeklEQXVPREl3TkRneklEQXVNVFkyTlRBMElEQXVPREV6TnlBd0xqRTJOalV3TkNBd0xqZ3dOall5TjFZd0xqUTROall5T0VNd0xqRTJOalV3TkNBd0xqUTNPVFUxTlNBd0xqRTJPVE14TXlBd0xqUTNNamMzTWlBd0xqRTNORE14TkNBd0xqUTJOemMzTVVNd0xqRTNPVE14TlNBd0xqUTJNamMzSURBdU1UZzJNRGs0SURBdU5EVTVPVFl4SURBdU1Ua3pNVGN4SURBdU5EVTVPVFl4U0RBdU1qVTVPRE0zVmpBdU5EZzJOakk0U0RBdU1Ua3pNVGN4VmpBdU9EQTJOakkzU0RBdU5URXpNVGRXTUM0M016azVOakZJTUM0MU16azRNelpXTUM0NE1EWTJNamRETUM0MU16azRNellnTUM0NE1UTTNJREF1TlRNM01ESTNJREF1T0RJd05EZ3pJREF1TlRNeU1ESTJJREF1T0RJMU5EZzBRekF1TlRJM01ESTFJREF1T0RNd05EZzFJREF1TlRJd01qUXlJREF1T0RNek1qazBJREF1TlRFek1UY2dNQzQ0TXpNeU9UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56RXpNamc1SURBdU16YzVPVFUxVmpBdU16VXpNamc0U0RBdU5qY3pNamc1UXpBdU5qY3lOelFnTUM0ek5EWXpPVGdnTUM0Mk5qazNOVFFnTUM0ek16azVNeUF3TGpZMk5EZzJOeUF3TGpNek5UQTBNME13TGpZMU9UazRJREF1TXpNd01UVTJJREF1TmpVek5URXlJREF1TXpJM01UY2dNQzQyTkRZMk1qSWdNQzR6TWpZMk1qRldNQzR5T0RZMk1qRklNQzQyTVRrNU5UVldNQzR6TWpZMk1qRklNQzQxTnprNU5UVldNQzR5T0RZMk1qRklNQzQxTlRNeU9EaFdNQzR6TWpZMk1qRklNQzQxTVRNeU9EaFdNQzR5T0RZMk1qRklNQzQwT0RZMk1qSldNQzR6TWpZMk1qRklNQzQwTkRZMk1qRldNQzR5T0RZMk1qRklNQzQwTVRrNU5UVldNQzR6TWpZMk1qRklNQzR6TnprNU5UVldNQzR5T0RZMk1qRklNQzR6TlRNeU9EaFdNQzR6TWpZMk1qRkRNQzR6TkRZek9UZ2dNQzR6TWpjeE55QXdMak16T1RreklEQXVNek13TVRVMklEQXVNek0xTURReklEQXVNek0xTURRelF6QXVNek13TVRVMklEQXVNek01T1RNZ01DNHpNamN4TnlBd0xqTTBOak01T0NBd0xqTXlOall5TVNBd0xqTTFNekk0T0Vnd0xqSTROall5TVZZd0xqTTNPVGsxTlVnd0xqTXlOall5TVZZd0xqUXhPVGsxTlVnd0xqSTROall5TVZZd0xqUTBOall5TVVnd0xqTXlOall5TVZZd0xqUTROall5TWtnd0xqSTROall5TVZZd0xqVXhNekk0T0Vnd0xqTXlOall5TVZZd0xqVTFNekk0T0Vnd0xqSTROall5TVZZd0xqVTNPVGsxTlVnd0xqTXlOall5TVZZd0xqWXhPVGsxTlVnd0xqSTROall5TVZZd0xqWTBOall5TWtnd0xqTXlOall5TVVNd0xqTXlOekUzSURBdU5qVXpOVEV4SURBdU16TXdNVFUySURBdU5qVTVPVGdnTUM0ek16VXdORE1nTUM0Mk5qUTROamRETUM0ek16azVNeUF3TGpZMk9UYzFOQ0F3TGpNME5qTTVPQ0F3TGpZM01qYzBJREF1TXpVek1qZzRJREF1Tmpjek1qZzVWakF1TnpFek1qZzVTREF1TXpjNU9UVTFWakF1Tmpjek1qZzVTREF1TkRFNU9UVTFWakF1TnpFek1qZzVTREF1TkRRMk5qSXhWakF1Tmpjek1qZzVTREF1TkRnMk5qSXlWakF1TnpFek1qZzVTREF1TlRFek1qZzRWakF1Tmpjek1qZzVTREF1TlRVek1qZzRWakF1TnpFek1qZzVTREF1TlRjNU9UVTFWakF1Tmpjek1qZzVTREF1TmpFNU9UVTFWakF1TnpFek1qZzVTREF1TmpRMk5qSXlWakF1Tmpjek1qZzVRekF1TmpVek5URXlJREF1TmpjeU56UWdNQzQyTlRrNU9DQXdMalkyT1RjMU5DQXdMalkyTkRnMk55QXdMalkyTkRnMk4wTXdMalkyT1RjMU5DQXdMalkxT1RrNElEQXVOamN5TnpRZ01DNDJOVE0xTVRFZ01DNDJOek15T0RrZ01DNDJORFkyTWpKSU1DNDNNVE15T0RsV01DNDJNVGs1TlRWSU1DNDJOek15T0RsV01DNDFOems1TlRWSU1DNDNNVE15T0RsV01DNDFOVE15T0RoSU1DNDJOek15T0RsV01DNDFNVE15T0RoSU1DNDNNVE15T0RsV01DNDBPRFkyTWpKSU1DNDJOek15T0RsV01DNDBORFkyTWpGSU1DNDNNVE15T0RsV01DNDBNVGs1TlRWSU1DNDJOek15T0RsV01DNHpOems1TlRWSU1DNDNNVE15T0RsYVRUQXVOalEyTmpJeUlEQXVOalEwTWpJeVF6QXVOalEyTmpJeUlEQXVOalEwT0RVNElEQXVOalEyTXpZNUlEQXVOalExTkRZNUlEQXVOalExT1RFNUlEQXVOalExT1RFNVF6QXVOalExTkRZNUlEQXVOalEyTXpZNUlEQXVOalEwT0RVNUlEQXVOalEyTmpJeUlEQXVOalEwTWpJeUlEQXVOalEyTmpJeVNEQXVNelUxTmpnNFF6QXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUwTkRReElEQXVOalEyTXpZNUlEQXVNelV6T1RreElEQXVOalExT1RFNVF6QXVNelV6TlRReElEQXVOalExTkRZNUlEQXVNelV6TWpnNElEQXVOalEwT0RVNElEQXVNelV6TWpnNElEQXVOalEwTWpJeVZqQXVNelUxTmpnNFF6QXVNelV6TWpnNElEQXVNelUxTURVeElEQXVNelV6TlRReElEQXVNelUwTkRReElEQXVNelV6T1RreElEQXVNelV6T1RreFF6QXVNelUwTkRReElEQXVNelV6TlRReElEQXVNelUxTURVeElEQXVNelV6TWpnNElEQXVNelUxTmpnNElEQXVNelV6TWpnNFNEQXVOalEwTWpJeVF6QXVOalEwT0RVNUlEQXVNelV6TWpnNElEQXVOalExTkRZNUlEQXVNelV6TlRReElEQXVOalExT1RFNUlEQXVNelV6T1RreFF6QXVOalEyTXpZNUlEQXVNelUwTkRReElEQXVOalEyTmpJeUlEQXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUxTmpnNFZqQXVOalEwTWpJeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbSIgaWQ9IjciPgogICAgICA8bXhDZWxsIHN0eWxlPSJpci5yZWY9Mzk4Nzc4M2ItMGQ1OC00MmJkLThhMjYtNGE3MmJiY2M3NTZlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVjMjt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjIwMCIgeT0iNDAiIHdpZHRoPSI0MDkiIGhlaWdodD0iMTc1IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjkiIHZhbHVlPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSAoQ1MtRGVmYXVsdCkiIHN0eWxlPSJpci5yZWY9ZDIwYjNmNDktN2I2YS00ZGMyLWE1ZWYtY2JhOGU1MTViMTcxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjIzMyIgeT0iMTUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCIgaXIuc291cmNlU3R5bGU9ImNvbnRhaW5lcj11bmRlZmluZWQ7cm91bmRlZD0xO2FyY1NpemU9OTA7cGVyaW1ldGVyPXVuZGVmaW5lZDtyZWN1cnNpdmVSZXNpemU9dW5kZWZpbmVkO3ZlcnRpY2FsQWxpZ249dG9wO3N0cm9rZVdpZHRoPXVuZGVmaW5lZDtzdHJva2VDb2xvcj0jMjBDOUUzO2ZvbnRTaXplPTEyO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7YWxpZ249Y2VudGVyO3RleHREaXJlY3Rpb249dW5kZWZpbmVkO3NwYWNpbmdUb3A9dW5kZWZpbmVkO3NwYWNpbmdMZWZ0PXVuZGVmaW5lZDthc3BlY3Q9dW5kZWZpbmVkO2Rhc2hlZD11bmRlZmluZWQ7Zm9udFN0eWxlPXVuZGVmaW5lZDtvdXRsaW5lQ29ubmVjdD11bmRlZmluZWQ7c2hhcGU9dW5kZWZpbmVkO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tIiBpZD0iOCI+CiAgICAgIDxteENlbGwgc3R5bGU9ImlyLnJlZj1kNmIwNTBhZC00MGE4LTQwMDYtYTM4ZS05M2ZkOWYzNWNiMjc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iMjAwIiB5PSIyNjQiIHdpZHRoPSI0MTEiIGhlaWdodD0iMTY2IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgKENTLURlZmF1bHQpIiBzdHlsZT0iaXIucmVmPWFlZDg2MDE1LTE4YzEtNGE4NC05ZGFmLTJmZWIyMGJmMTI5Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItYXBwbGljYXRpb24tc2VydmVyLXNpZGU7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVU13TGpNMk5UZzFNeUF3TGpJNE1qYzRNaUF3TGpNM09EY3lOU0F3TGpJMk9Ua3hNU0F3TGpNNU5EWXdNeUF3TGpJMk9Ua3hNVWd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJMk9Ua3hNU0F3TGpZek5ERTROaUF3TGpJNE1qYzRNaUF3TGpZek5ERTROaUF3TGpJNU9EWTJNVU13TGpZek5ERTROaUF3TGpNeE5EVXpPU0F3TGpZeU1UTXhOQ0F3TGpNeU56UXhNU0F3TGpZd05UUXpOaUF3TGpNeU56UXhNVWd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56UXhNU0F3TGpNMk5UZzFNeUF3TGpNeE5EVXpPU0F3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVnBOTUM0ek9UUTJNRE1nTUM0Mk9URTFOemhETUM0ek56ZzNNalVnTUM0Mk9URTFOemdnTUM0ek5qVTROVE1nTUM0M01EUTBOU0F3TGpNMk5UZzFNeUF3TGpjeU1ETXlPRU13TGpNMk5UZzFNeUF3TGpjek5qSXdOaUF3TGpNM09EY3lOU0F3TGpjME9UQTNPQ0F3TGpNNU5EWXdNeUF3TGpjME9UQTNPRWd3TGpVMU1EQXhPVll3TGpZNU1UVTNPRWd3TGpNNU5EWXdNMXBOTUM0Mk1qQXpOVEVnTUM0Mk1qazVNVEZJTUM0Mk1EUTFOalZETUM0MU9UY3hORFFnTUM0Mk1qazVNVEVnTUM0MU9UQXdOamdnTUM0Mk16RXpPVE1nTUM0MU9ETTJNVGtnTUM0Mk16UXdOemhJTUM0ek9UUTJNRE5ETUM0ek56ZzNNalVnTUM0Mk16UXdOemdnTUM0ek5qVTROVE1nTUM0Mk1qRXlNRFlnTUM0ek5qVTROVE1nTUM0Mk1EVXpNamhETUM0ek5qVTROVE1nTUM0MU9EazBORGtnTUM0ek56ZzNNalVnTUM0MU56WTFOemdnTUM0ek9UUTJNRE1nTUM0MU56WTFOemhJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTFOemdnTUM0Mk16UXhPRFlnTUM0MU9EazBORGtnTUM0Mk16UXhPRFlnTUM0Mk1EVXpNamhETUM0Mk16UXhPRFlnTUM0Mk1UVTNORFVnTUM0Mk1qZzJORFlnTUM0Mk1qUTROamdnTUM0Mk1qQXpOVEVnTUM0Mk1qazVNVEZhVFRBdU5qY3lOVEU1SURBdU5qSTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUxTURBeE9WWXdMamczTlRNMk5rTXdMalUxTURBeE9TQXdMamczT0RBME1pQXdMalUxTURJeE1pQXdMamc0TURZM01pQXdMalUxTURVNE5DQXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1qazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056YzFNalFnTUM0Mk5qSTNNa3d3TGpjM09UazFPU0F3TGpZMk1qYzRPRU13TGpnd01UY3pOaUF3TGpZMk5EQXdOU0F3TGpneE9URTJPQ0F3TGpZNE1UUXpOeUF3TGpneU1ETTROaUF3TGpjd016RTVPRXd3TGpneU1EUTFNeUF3TGpjd05UWXpNMVl3TGpnMU56UTRNa3d3TGpneU1ETTROaUF3TGpnMU9Ua3hOME13TGpneE9URTJPQ0F3TGpnNE1UWTNPQ0F3TGpnd01UY3pOeUF3TGpnNU9URXhJREF1TnpjNU9UYzFJREF1T1RBd016STRUREF1TnpjM05UUWdNQzQ1TURBek9UWklNQzQyTWpVMk56ZERNQzQyTURJM09UUWdNQzQ1TURBek9UWWdNQzQxT0RRd09UUWdNQzQ0T0RJME9EUWdNQzQxT0RJNE16SWdNQzQ0TlRrNU1UZE1NQzQxT0RJM05qUWdNQzQ0TlRjME9ESldNQzQzTURVMk16TkRNQzQxT0RJM05qUWdNQzQyT0RJM05TQXdMall3TURZM05DQXdMalkyTkRBMUlEQXVOakl6TWpReUlEQXVOall5TnpnNFREQXVOakkxTmpjM0lEQXVOall5TnpKSU1DNDNOemMxTWpSYVRUQXVOemswTURJNUlEQXVOekk0TnpReFNEQXVOakE1TVRnNFREQXVOakE1TVRjeUlEQXVPRFUzTkRneVF6QXVOakE1TVRjeUlEQXVPRFkyTURJNElEQXVOakUxTmpZM0lEQXVPRGN6TURVMklEQXVOakl6T1RnNUlEQXVPRGN6T1RBeFREQXVOakkxTmpjM0lEQXVPRGN6T1RnM1NEQXVOemMzTlRSTU1DNDNOemt5TWpnZ01DNDROek01TURGRE1DNDNPRFk1T1RZZ01DNDROek14TVRNZ01DNDNPVE14TnpFZ01DNDROalk1TXpjZ01DNDNPVE01TmlBd0xqZzFPVEUzVERBdU56azBNRFExSURBdU9EVTNORGd5VERBdU56azBNREk1SURBdU56STROelF4V2swd0xqWTNPRFE1TXlBd0xqYzBPRFUwTjBNd0xqWTRNelV3TnlBd0xqYzBPRFUwTnlBd0xqWTROelkxSURBdU56VXlNamN6SURBdU5qZzRNekEySURBdU56VTNNVEEzVERBdU5qZzRNemszSURBdU56VTRORFZXTUM0NE5UQTRPRU13TGpZNE9ETTVOeUF3TGpnMU5UZzVNeUF3TGpZNE5EWTNNU0F3TGpnMk1EQXpOeUF3TGpZM09UZ3pOeUF3TGpnMk1EWTVNMHd3TGpZM09EUTVNeUF3TGpnMk1EYzRNMGd3TGpZek1qSTNPVU13TGpZeU56STJOaUF3TGpnMk1EYzRNeUF3TGpZeU16RXlNaUF3TGpnMU56QTFOeUF3TGpZeU1qUTJOaUF3TGpnMU1qSXlORXd3TGpZeU1qTTNOaUF3TGpnMU1EZzRWakF1TnpVNE5EVkRNQzQyTWpJek56WWdNQzQzTlRNME16Y2dNQzQyTWpZeE1ESWdNQzQzTkRreU9UTWdNQzQyTXpBNU16VWdNQzQzTkRnMk16aE1NQzQyTXpJeU56a2dNQzQzTkRnMU5EZElNQzQyTnpnME9UTmFUVEF1TmpZNE5Ua2dNQzQzTmpnek5UUklNQzQyTkRJeE9ESldNQzQ0TkRBNU56ZElNQzQyTmpnMU9WWXdMamMyT0RNMU5GcE5NQzQzTlRjM01UZ2dNQzQzT0RneE9UbERNQzQzTmpNeE9EY2dNQzQzT0RneE9Ua2dNQzQzTmpjMk1qRWdNQzQzT1RJMk16TWdNQzQzTmpjMk1qRWdNQzQzT1RneE1ETkRNQzQzTmpjMk1qRWdNQzQ0TURNeE1UWWdNQzQzTmpNNE9UWWdNQzQ0TURjeU5pQXdMamMxT1RBMk1pQXdMamd3TnpreE5Vd3dMamMxTnpjeE9DQXdMamd3T0RBd05rZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamd3T0RBd05pQXdMamN3TVRZMU9TQXdMamd3TXpVM01pQXdMamN3TVRZMU9TQXdMamM1T0RFd00wTXdMamN3TVRZMU9TQXdMamM1TXpBNE9TQXdMamN3TlRNNE5DQXdMamM0T0RrME5pQXdMamN4TURJeE9DQXdMamM0T0RJNVREQXVOekV4TlRZeUlEQXVOemc0TVRrNVNEQXVOelUzTnpFNFdrMHdMamMzTURreU1pQXdMamMwT0RVME4wTXdMamMzTmpNNU1pQXdMamMwT0RVME55QXdMamM0TURneU5TQXdMamMxTWprNE1TQXdMamM0TURneU5TQXdMamMxT0RRMVF6QXVOemd3T0RJMUlEQXVOell6TkRZMElEQXVOemMzTVNBd0xqYzJOell3TnlBd0xqYzNNakkyTmlBd0xqYzJPREkyTTB3d0xqYzNNRGt5TWlBd0xqYzJPRE0xTkVnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqYzJPRE0xTkNBd0xqY3dNVFkxT1NBd0xqYzJNemt5SURBdU56QXhOalU1SURBdU56VTRORFZETUM0M01ERTJOVGtnTUM0M05UTTBNemNnTUM0M01EVXpPRFFnTUM0M05Ea3lPVE1nTUM0M01UQXlNVGdnTUM0M05EZzJNemhNTUM0M01URTFOaklnTUM0M05EZzFORGRJTUM0M056QTVNakphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIyMzciIHk9IjciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1iY2JlMDVhYy0xNDM4LTRiZDAtOTU1Ni0yYTVmMWZhMWZmM2Q7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iNzE4IiB5PSIxODEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICA8L3Jvb3Q+CjwvbXhHcmFwaE1vZGVsPgo=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows/>
+  <customFields/>
+  <components>
+    <component uuid="50630844-5d1b-4c74-ab2d-a70fe9cce782" diagramComponentId="bcbe05ac-1438-4bd0-9556-2a5f1fa1ff3d" ref="f6a29fea-6f54-4111-aa03-9360ddb31bb7" name="PostgreSQL" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.684">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.848">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="fc9771a8-3261-40fc-9e57-bd2eeb0d5c49" diagramComponentId="81a49ae0-a9d0-4a09-a94a-9804a1c2bfd2" ref="b15b943c-ed71-4eca-a2a7-55863dd9c0af" name="WAF" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-WAF">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AWS-WAF1" name="Control access to AWS WAF resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Control access to AWS WAF resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles). &lt;br&gt; Policies that are attached to an IAM identity are known as identity-based policies, and policies that are attached to a resource are known as resource-based policies. AWS WAF supports only identity-based policies.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Using identity-based policies (IAM policies) for AWS WAF&lt;/p&gt; 
+&lt;p&gt;The following shows an example of a permissions policy:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2019-07-29", "Statement": [ { "Sid": "CreateFunctionPermissions", "Effect": "Allow", "Action": [ "wafv2:ListWebACLs", "wafv2:GetWebACL", "cloudwatch:ListMetrics", "wafv2:GetSampledRequests" ], "Resource": "*" }, { "Sid": "PermissionToPassAnyRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::account-id:role/*" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Overview of managing access permissions to your AWS WAF resources" url="https://docs.aws.amazon.com/waf/latest/developerguide/access-control-overview.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.353">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-WAF1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="5beb999f-60f3-4910-877b-12a09c778a14" diagramComponentId="d20b3f49-7b6a-4dc2-a5ef-cba8e515b171" ref="717fd1b3-7962-479e-8662-af5e05f9aa49" name="Web Application - Server side (CS-Default)" desc="" library="" parentComponentRef="c60259f7-8d4d-4dfb-a7ac-5f17f1db9fcf" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.130">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.505">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.353">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.939">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.354">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.988">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.807">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.748">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.809">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.200">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.300">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.749">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.453">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.306">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:40.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.455">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:39.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f9faeea5-d0ed-4a44-8402-ac458db729a0" diagramComponentId="08bdeca4-6923-4088-8d86-b5a691be8835" ref="9c8ed27d-59fa-4f00-87e6-6fcf94c8dd3f" name="S3 - Simple Storage Service" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
+          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
+                        for an MFA.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
+            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
+            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
+          </references>
+          <standards>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
+                            then your bucket has no versioning enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-3" name="Enable cross-region replication on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enabling cross-Region replication on S3 buckets ensures that multiple versions of the data are available in different distinct Regions. This allows you to store data at even greater distances, minimize latency, increase operational efficiency, and protect against DDoS and data corruption events.&lt;/p&gt;&lt;p&gt;This is one method used to implement system hardening configuration.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;To enable S3 bucket replication&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon S3 console at https://console.aws.amazon.com/s3/.&lt;/li&gt;&lt;li&gt;Choose the S3 bucket that does not have cross-region replication enabled.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Management&lt;/strong&gt;, then choose &lt;strong&gt;Replication&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Add rule&lt;/strong&gt;. If versioning is not already enabled, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose your source bucket - &lt;strong&gt;Entire bucket&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose your destination bucket. If versioning is not already enabled on the destination bucket for your account, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose an IAM role. For more information on setting up permissions for replication, see the &lt;i&gt;Amazon Simple Storage Service User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Enter a rule name, choose &lt;strong&gt;Enabled&lt;/strong&gt; for the status, then choose &lt;strong&gt;Next&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Save&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:39:59.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
+&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
+&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
+            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
+&lt;/div&gt; 
+&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
+            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
+ &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
+ &lt;/ul&gt; If data in transit is kept unencrypted: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
+ &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Version":"2012-10-17", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Id":"PutObjPolicy", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Statement":{ 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Effect":"Deny", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Principal":"*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Action":"s3:PutObject", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Condition":{ 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;} 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;} 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
+            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
+            <reference name="Using Server-side Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api list-buckets --output table
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            ...
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;{
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Effect": "Deny",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Principal": "*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Action": "s3:PutObject",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Condition": {
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
+  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
+  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
+  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
+  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
+  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;br&gt; 
+&lt;br&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
+            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
+            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
+            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
+                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            ./prowler -c extra73
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
+              <output/>
+            </source>
+            <references>
+              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; {&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; "Statement":[&lt;/i&gt; 
+   &lt;i&gt;{&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Condition":{&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;div&gt; 
+       &lt;i&gt;"Bool":&lt;/i&gt; 
+      &lt;/div&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;}&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;i&gt;}&lt;/i&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; }&lt;/i&gt; 
+     &lt;i&gt;]&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt;} &lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
+                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
+                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.781">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br /&gt; 
+&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br /&gt; 
+&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
+&lt;br /&gt;Remediation 
+&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
+                            has no MFA delete enabled.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-3" mitigation="25"/>
+                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                <countermeasure ref="AWS-S3-3" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6279ea03-a531-45ab-8f16-0da8eb96bd2d" diagramComponentId="d6b050ad-40a8-4006-a38e-93fd9f35cb27" ref="a5f31feb-0210-47cd-b98c-c4baa599857e" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="ec2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
+          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.966">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
+                        To avoid this, access to the network must be as restricted as possible, so that only the
+                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
+  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 allocate-address --domain vpc 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
+            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
+          </references>
+          <standards>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon Unified CLI: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    A list of approved AMIs must be maintained by the organization. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
+  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface:: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each NAT gateway is created in a specific Availability Zone and implemented with 
+  redundancy in that zone. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   and/or 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
+            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
+  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
+  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
+  are engineered to be isolated from failures in other Availability Zones. By launching 
+  instances in separate Availability Zones, you can protect your applications from the failure 
+  of a single location. AWS assigns a unique ID to each subnet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
+  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
+  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
+  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
+  Some AWS regions have more than 2 availability zones and it is recommended to use more 
+  than 2 where possible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The port for these inbound rules would depend on the Database engine used and the 
+  configured port. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The default values are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
+  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
+  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When we create a default VPC, AWS does the following to set it up: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
+  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
+  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  Label this Default VPC "Do Not Use". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
+  set a label to remind others not to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
+            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
+            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
+            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
+          </references>
+          <standards>
+            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Copy snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
+            <reference name="Create snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
+            <reference name="Create volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
+            <reference name="Delete volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
+            <reference name="Describe volumes" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
+            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" name="Ensure that the EC2 instances are managed by the systems manager" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances. Additional configuration is needed in Systems Manager for patch deployment to managed EC2 instances.&lt;/p&gt;&lt;p&gt;If you use EC2 instances managed by Systems Manager to collect inventory for your cardholder data environment (CDE), make sure that the instances are managed by Systems Manager. Using Systems Manager can help to maintain an inventory of system components that are in scope for PCI DSS.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For systems that are in scope for PCI DSS, before you install vendor patches in a production environment, you should test and validate them. After you deploy patches, validate security settings and controls to ensure that deployed patches have not affected the security of the CDE. If you use EC2 instances managed by Systems Manager to patch managed instances in your CDE, ensure that the instances are managed by Systems Manager. Systems Manager deploys system patches, which helps to protect system components and software from known vulnerabilities.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;You can use the Systems Manager quick setup to set up Systems Manager to manage your EC2 instances.&lt;/p&gt;&lt;p&gt;To determine whether your instances can support Systems Manager associations, see Systems Manager prerequisites in the &lt;i&gt;AWS Systems Manager User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To ensure EC2 instances are managed by Systems Manager&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Quick setup&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;On the configuration screen, keep the default options.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Set up Systems Manager&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.315">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
+                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
+                        every 90 days (or immediately if security patches become available) to avoid undue exposure
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;For linux instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
+                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
+            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
+            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
+          </references>
+          <standards>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
+                        (ingress/egress) on the default security group in order to force the use of least privilege via
+                        custom created security groups.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
+                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
+                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
+                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the default security group.&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
+                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Default Value&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The prescribed value is the default value. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
+            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
+            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
+          </references>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-images --owners self --filters 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    ImageId:ImageId, Public:Public}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.795">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references>
+              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        ALL TCP or ALL ports to avoid undue server exposure.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt; 
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 22</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 3389</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-1" name="VPC default security group should prohibit inbound and outbound traffic" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a service that is in scope for PCI DSS is associated with the default security group, the default rules for the security group will allow all outbound traffic. The rules also allow all inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.&lt;/p&gt;&lt;p&gt;You should change the default security group rules setting to restrict inbound and outbound traffic. Using the default might violate the requirement to allow only necessary traffic to and from the CDE.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To create new security groups and assign them to your resources&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;. View the default security groups details to see the resources that are assigned to them.&lt;/li&gt;&lt;li&gt;Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;After you assign the new security groups to the resources, remove the inbound and outbound rules from the default security groups. This ensures that the default security groups are not used.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To remove the rules from the default security group&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select a default security group, and choose the &lt;strong&gt;Inbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit inbound rules&lt;/strong&gt;. Then delete all of the inbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;li&gt;Select a default security group and choose the &lt;strong&gt;Outbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit outbound rules&lt;/strong&gt;. Then delete all of the outbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:00.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="VOLUMES-NOT-ENCRYPTED">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-02">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-03">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="0ac902c0-a3a4-40e9-9030-94f08137abe2" diagramComponentId="3987783b-0d58-42bd-8a26-4a72bbcc756e" ref="c60259f7-8d4d-4dfb-a7ac-5f17f1db9fcf" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="ec2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
+          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.838">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.227">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
+                        To avoid this, access to the network must be as restricted as possible, so that only the
+                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.229">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
+  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 allocate-address --domain vpc 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
+            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
+          </references>
+          <standards>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon Unified CLI: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    A list of approved AMIs must be maintained by the organization. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
+  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface:: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each NAT gateway is created in a specific Availability Zone and implemented with 
+  redundancy in that zone. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   and/or 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
+            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
+  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
+  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
+  are engineered to be isolated from failures in other Availability Zones. By launching 
+  instances in separate Availability Zones, you can protect your applications from the failure 
+  of a single location. AWS assigns a unique ID to each subnet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
+  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
+  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
+  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
+  Some AWS regions have more than 2 availability zones and it is recommended to use more 
+  than 2 where possible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.087">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The port for these inbound rules would depend on the Database engine used and the 
+  configured port. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The default values are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
+  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
+  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When we create a default VPC, AWS does the following to set it up: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
+  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
+  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  Label this Default VPC "Do Not Use". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
+  set a label to remind others not to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
+            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
+            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
+            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
+          </references>
+          <standards>
+            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Copy snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
+            <reference name="Create snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
+            <reference name="Create volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
+            <reference name="Delete volume" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
+            <reference name="Describe volumes" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
+            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" name="Ensure that the EC2 instances are managed by the systems manager" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Systems Manager is an AWS service that you can use to view and control your AWS infrastructure. To help you to maintain security and compliance, Systems Manager scans your managed instances. A managed instance is a machine that is configured for use with Systems Manager. Systems Manager then reports or takes corrective action on any policy violations that it detects. Systems Manager also helps you to configure and maintain your managed instances. Additional configuration is needed in Systems Manager for patch deployment to managed EC2 instances.&lt;/p&gt;&lt;p&gt;If you use EC2 instances managed by Systems Manager to collect inventory for your cardholder data environment (CDE), make sure that the instances are managed by Systems Manager. Using Systems Manager can help to maintain an inventory of system components that are in scope for PCI DSS.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For systems that are in scope for PCI DSS, before you install vendor patches in a production environment, you should test and validate them. After you deploy patches, validate security settings and controls to ensure that deployed patches have not affected the security of the CDE. If you use EC2 instances managed by Systems Manager to patch managed instances in your CDE, ensure that the instances are managed by Systems Manager. Systems Manager deploys system patches, which helps to protect system components and software from known vulnerabilities.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;You can use the Systems Manager quick setup to set up Systems Manager to manage your EC2 instances.&lt;/p&gt;&lt;p&gt;To determine whether your instances can support Systems Manager associations, see Systems Manager prerequisites in the &lt;i&gt;AWS Systems Manager User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To ensure EC2 instances are managed by Systems Manager&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Quick setup&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;On the configuration screen, keep the default options.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Set up Systems Manager&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3.3" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
+                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
+                        every 90 days (or immediately if security patches become available) to avoid undue exposure
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;For linux instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
+                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
+            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
+            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
+          </references>
+          <standards>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
+                        (ingress/egress) on the default security group in order to force the use of least privilege via
+                        custom created security groups.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
+                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
+                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
+                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the default security group.&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
+                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Default Value&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The prescribed value is the default value. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
+            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
+            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
+          </references>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-images --owners self --filters 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    ImageId:ImageId, Public:Public}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.083">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.084">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.084">
+              <output/>
+            </source>
+            <references>
+              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        ALL TCP or ALL ports to avoid undue server exposure.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt; 
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 22</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 3389</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:38.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-1" name="VPC default security group should prohibit inbound and outbound traffic" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a service that is in scope for PCI DSS is associated with the default security group, the default rules for the security group will allow all outbound traffic. The rules also allow all inbound traffic from network interfaces (and their associated instances) that are assigned to the same security group.&lt;/p&gt;&lt;p&gt;You should change the default security group rules setting to restrict inbound and outbound traffic. Using the default might violate the requirement to allow only necessary traffic to and from the CDE.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, create new security groups and assign those security groups to your resources. To prevent the default security groups from being used, remove their inbound and outbound rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To create new security groups and assign them to your resources&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;. View the default security groups details to see the resources that are assigned to them.&lt;/li&gt;&lt;li&gt;Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the &lt;i&gt;Amazon VPC User Guide&lt;/i&gt;.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;After you assign the new security groups to the resources, remove the inbound and outbound rules from the default security groups. This ensures that the default security groups are not used.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To remove the rules from the default security group&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.&lt;/li&gt;&lt;li&gt;In the navigation pane, choose &lt;strong&gt;Security groups&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select a default security group, and choose the &lt;strong&gt;Inbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit inbound rules&lt;/strong&gt;. Then delete all of the inbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;li&gt;Select a default security group and choose the &lt;strong&gt;Outbound rules&lt;/strong&gt; tab. Choose &lt;strong&gt;Edit outbound rules&lt;/strong&gt;. Then delete all of the outbound rules. Choose &lt;strong&gt;Save rules&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Repeat the previous step for each default security group.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="VOLUMES-NOT-ENCRYPTED">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-02">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-03">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-1" mitigation="5"/>
+                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SYSTEMS-MANAGER4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="eb2a6979-bf61-4c54-aa25-0a91ec8f7177" diagramComponentId="f9f356b7-d35e-405c-b423-1665f1148e7c" ref="358252c4-3454-41c0-a725-ff1c4193ca9e" name="VPC - Virtual Private Cloud" desc="" library="" parentComponentRef="" componentDefinitionRef="vpc">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
+            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before you begin, make sure of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
+  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
+  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
+  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
+  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
+  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test end-to-end connectivity 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon EC2 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On the dashboard, choose Launch Instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Choose an instance type, and then choose Next: Configure Instance Details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ping 10.0.0.4 
+&lt;/div&gt; 
+&lt;div&gt;
+  Pinging 10.0.0.4 with 32 bytes of data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ping statistics for 10.0.0.4: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Approximate round trip times in milliseconds: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use SSH or RDP to connect to your instances in the VPC. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control access to VPC resources with IAM identities and policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Control access to VPC resources by using: 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Identities: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authentication is how you sign in to AWS using your identity credentials. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Identity-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Resource-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Access control lists (ACLs): 
+&lt;/div&gt; 
+&lt;div&gt;
+  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Creating CloudWatch alarms to monitor a NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm for outbound traffic through the NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm to monitor port allocation errors 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
+              <output/>
+            </source>
+            <references>
+              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for VPC endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route traffic to an Amazon VPC interface endpoint 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console and open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the right pane, choose the endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the Route 53 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Hosted Zones. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create Record Set. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specify the following values: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose A - IPv4 address. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Yes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias Target 
+&lt;/div&gt; 
+&lt;div&gt;
+  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Different accounts - Enter the value that you got in step 1 of this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Routing Policy 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Evaluate Target Health 
+&lt;/div&gt; 
+&lt;div&gt;
+  Accept the default value of No. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable VPC Traffic Mirroring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content inspection 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Threat monitoring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Troubleshooting 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your traffic mirror resources using any of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
+              <output/>
+            </source>
+            <references>
+              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.447">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network ACLs for VPC as an additional layer of security 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following are the parts of a network ACL rule: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Source. [Inbound rules only] The source of the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow/Deny. Whether to allow or deny the specified traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the navigation pane, choose Network ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select a Network ACL to see details. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use VPC endpoint policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your endpoint policy can be like any IAM policy; however, take note of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:37.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                <countermeasure ref="AWS-VPC1" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC7" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3edc2e5f-e2ef-4833-844c-2a847adcace5" diagramComponentId="63436051-797e-4ca7-9a70-ddf3a6c4ef1a" ref="76a20665-1544-491d-9631-538160faaac9" name="Lambda Function" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="aws-lambda-function">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-VPC-IP-ADDRESS-DEPLETION-WEAKNESS" name="AWS VPC IP address depletion" state="0" impact="100" issueId="" issueLink="">
+          <desc>Organizations that deploy AWS Lambda functions in VPC (Virtual Private Cloud) environments should also pay attention to the potential exhaustion of IP addresses in the VPC subnet.  
+ An attacker might cause a denial of service scenario by forcing more and more function instances to execute, and deplete the VPC subnet from available IP addresses.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.140">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W10" name="All Lambda functions have the same permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>Setting of permissions is done at the function level. Because there could be many functions, the job of configuring permissions on each one is all too often ignored or forgotten, leading to security weak spots.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.492">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-592" name="Authentication Bypass Issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly perform authentication, allowing it to be bypassed through various methods.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.944">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-592: Authentication Bypass Issues" url="https://cwe.mitre.org/data/definitions/592.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W12" name="Containers aren't monitored" state="0" impact="100" issueId="" issueLink="">
+          <desc>Monitoring is needed to understand the relationships between all of the objects across a virtual environment's topology, recognize the difference between inconsequential anomalies and actual performance problems. This will show you the root cause and recommended actions for remediation. This way, you can understand what needs your attention, and how to narrow a problem to the relevant components.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W4" name="Data in transit is sent using a weak encryption algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>When the SSL/TLS service is present this is good but does introduce complexities that must be overcome:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;SSL/TLS protocols, ciphers, keys and renegotiation must be properly configured.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Certificate validity must be ensured.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W3" name="Data in transit was sent via an unencrypted protocol" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data must be protected when it is transmitted through the network. Currently the security best practice is to send any data over an encrypted channel. As a rule of thumb if data must be protected when it is stored, this data must also be protected during transmission.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of sensitive data include:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Information used in authentication (e.g. Credentials, PINs, Session identifiers, Tokens, Cookies...)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Information protected by laws, regulations or specific organizational policy (e.g. Credit Cards, Customers data)&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W20" name="DynamoDB APIs are vulnerable to XSS" state="0" impact="100" issueId="" issueLink="">
+          <desc>DynamoDB is a NoSQL database and as such is schemaless. NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W8" name="Environment variables are not stored securely" state="0" impact="100" issueId="" issueLink="">
+          <desc>Environment variables were stored in plain text configuration files and stored in the code repository</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W15" name="Functions consume too much memory" state="0" impact="100" issueId="" issueLink="">
+          <desc>Default limits and poor configuration can lead to successful DDoS attacks.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W16" name="Functions don't have a rate limit or aren't throttled" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker can try to freeze the system with huge amounts of requests. 
+ If your concurrency limits are set and high, an attacker can still execute a lot of requests and it will cost you a lot of money. It's important to set some limits on services or functions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W14" name="Functions have poor concurrency limits" state="0" impact="100" issueId="" issueLink="">
+          <desc>If your concurrency limits are too small, scaling will not be as flexible as you would like. If your concurrency limits are too high, DoS could be a problem.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W17" name="Functions take too long to execute" state="0" impact="100" issueId="" issueLink="">
+          <desc>The function is taken too long to execute. This could be because the function is doing too much or recursive patterns are used.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W13" name="Functions use vulnerable dependencies" state="0" impact="100" issueId="" issueLink="">
+          <desc>Dependency management is a widespread problem in development. Developers may be unaware that third-party libraries or frameworks can contain vulnerabilities and those vulnerabilities are being constantly detected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.436">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W22" name="Messages exposed to end users reveal information about serverless functions and the logic used" state="0" impact="100" issueId="" issueLink="">
+          <desc>Messages to end users must only contain general information and not leak data relating to software implementation or the underlying technology.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W19" name="No validation for asynchronous events" state="0" impact="100" issueId="" issueLink="">
+          <desc>Lambda can handle several different event types that can trigger a serverless function. These event types don't necessarily need to be HTTP requests (e.g. S3, SNS, SES, CloudWatch Events, etc.). This increases the potential attack surface and introduces complexities to secure the serverless functions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W1" name="Sensitive stored information was not encrypted at rest" state="0" impact="100" issueId="" issueLink="">
+          <desc>Because sensitive information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is used and decode the information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W2" name="The Data Store is directly exposed to the internet" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data Stores are accessible by the public internet with no - or weak - authentication.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W11" name="The container has processes, pieces of code or temporary files lingering around" state="0" impact="100" issueId="" issueLink="">
+          <desc>Container lifetime is important, but also the correct execution and cleanup of your functions. If the container has lingering temporary files or - for example - static data in memory, an attacker could steal this information and leverage it for building a more destructive attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.940">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W9" name="The function takes untrusted input" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developers should avoid writing code that passes user-controlled input to dangerous functions. This is one of the basics of secure programming. Whenever a function has the capability to execute a dangerous action, it should either not receive user input, or the user-controlled data should be sanitized in order to prevent a malicious user from breaking the intended functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W18" name="The retry mechanism of asynchronous sources are not configured correctly" state="0" impact="100" issueId="" issueLink="">
+          <desc>Asynchronous events (e.g. S3, SNS, SES, CloudWatch Events, etc.) uses queues before invoking, so retry behavior must be taken in account.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W6" name="Unused functions are more risk from a security standpoint as they are often not maintained" state="0" impact="100" issueId="" issueLink="">
+          <desc>Unused functions are mostly unmaintained. Therefore code may not be regularly reviewed. And because the code isn't under your attention, this can impose a security risk, especially if the functionality of your application changes over time.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W5" name="Unused functions have vulnerable dependencies because they were never updated" state="0" impact="100" issueId="" issueLink="">
+          <desc>Unused functions remain mostly unpatched. So if dependencies have vulnerabilities, this might not catch your attention and could create a security weak point.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.507">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W21" name="Verbose error messages are left in the code and are not removed before moving to production" state="0" impact="100" issueId="" issueLink="">
+          <desc>Error messages or debugging information must be removed before moving to the production/release branch. This type of information gives an attacker additional insight on the internal working of the application/functions and on the technology used.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-LAMBDA-W7" name="Your AWS credentials were stored in a code repositories such as GitHub" state="0" impact="100" issueId="" issueLink="">
+          <desc>Monitoring is needed to understand the relationships between all of the objects across a virtual environment's topology and recognize the difference between inconsequential anomalies and actual performance problems. 
+ This will identify root causes and recommended actions for remediation. This way, you can understand what needs your attention, and how to narrow down a problem to the relevant components.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.945">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select the user.&lt;/li&gt; 
+   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ol&gt;Create a Group and add a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
+  &lt;li&gt;Click Create Group.&lt;/li&gt; 
+  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-attached-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C20" name="Change the default memory usage to the amount of memory the function really needs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Specify the amount of memory you want to allocate for your Lambda function. CloudWatch logs can contain memory usage on each function execution. Set the default memory usage to the amount of memory that the function really needs. By default, it set to of 1024 MB.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Update the memory size of your functions using the following AWS CLI command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda update-function-configuration --function-name myfunction --memory-size 256&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;In the example, we change the amount memory for the function to 256 MB.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
+            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
+            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the AWS Lambda console at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Choose a function.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Settings are on the first page shown.&lt;/li&gt; 
+ &lt;li&gt;Check that each function has got the really necessary amount of memory.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C26" name="Configurate the retry settings of asynchronous sources" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Any Lambda function invoked asynchronously is retried twice before the event is discarded. If the retries fail and you're unsure why, use Dead Letter Queues (DLQ) to direct unprocessed events to an Amazon SQS queue or an Amazon SNS topic to analyze the failure.&lt;/p&gt; 
+&lt;p&gt;AWS Lambda directs events that cannot be processed to the specified Amazon SNS topic or Amazon SQS queue. Functions that don't specify a DLQ will discard events after they have exhausted their retries. For more information about retry policies, see AWS Lambda Retry Behavior.&lt;/p&gt; 
+&lt;p&gt;You configure a DLQ by specifying the Amazon Resource Name TargetArn value on the Lambda function's DeadLetterConfig parameter.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Update the timeout of your functions using the following AWS CLI command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda update-function-configuration --function-name myfunction --dead-letter-config (structure)&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;A dead letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see Dead Letter Queues in the references.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
+ &lt;p&gt; TargetArn=string&lt;/p&gt; 
+ &lt;p&gt; JSON Syntax:&lt;/p&gt; 
+ &lt;p&gt;{ "TargetArn": "string"&lt;/p&gt; 
+ &lt;p&gt; }&lt;/p&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Retry Behavior" url="https://docs.aws.amazon.com/lambda/latest/dg/retries-on-errors.html"/>
+            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
+            <reference name="Dead Letter Queue" url="https://docs.aws.amazon.com/lambda/latest/dg/dlq.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Use AWS CLI and use the following command to view the timeout limit per function:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check all function and verify that they have got set a well the timeout limit.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C12" name="Configure IAM Role statements on a per-function basis" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You should spend time crafting suitable, minimal roles for each of your functions. This leverages the principle of least privilege. If you are using the API Gateway, you can also set Lambda authorizers. A Lambda function should do one specific task, so ensure the following model is followed: One function, one use case, one permission.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt; Remediation: &lt;br /&gt;&lt;/b&gt; UsingAWSConsole: &lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Login to theAWSManagement Console.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Navigate to the Lambda dashboard at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the navigation panel, underAWSLambda section, choose Functions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Choose the Lambda function that you want to examine then click on the function name to access its configuration page.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Select the Configuration tab then click the Execution role to expand the panel with theIAMrole that defines the permissions for the selected function.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Copy the name of theIAMexecution role currently available in the Existing role drop-down list.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Now navigate to theIAMdashboard at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the left navigation panel, choose Roles.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Paste the name of the execution role copied at step no. 6 in the Search box and press Enter.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Click on the AmazonIAMexecution role returned as the result.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;On theIAMrole configuration page, select the Permissions tab from the bottom panel.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Click on the attachedIAMpolicy name available within Policy name column to access the policy document (JSONformat).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Include inside the {}JSONpanel, the policy document defined for the selectedIAMexecution role.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Add the Action and Resource elements&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;and their current values, if the element values are set to "*"&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;and the Effect is set to "Allow",the selected Amazon Lambda function has admin privileges (we have to restrict the admin privileges in the Amazon Lambda function)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Repeat step no. 12 and 13 to add otherIAMpolicies attached to the selected execution role.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Repeat steps no. 4 - 16 to add theIAMexecution role permissions for other Amazon Lambda functions created within the current region.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Change theAWSregion from the navigation bar and repeat the process for the other regions.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;UsingAWSConsole:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Login to theAWSManagement Console.&lt;/li&gt; 
+ &lt;li&gt;Navigate to the Lambda dashboard at https://console.aws.amazon.com/lambda/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the navigation panel, underAWSLambda section, choose Functions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Choose the Lambda function that you want to examine then click on the function name to access its configuration page.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Select the Configuration tab then click the Execution role to expand the panel with theIAMrole that defines the permissions for the selected function.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Copy the name of theIAMexecution role currently available in the Existing role drop-down list.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Now navigate to theIAMdashboard at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the left navigation panel, choose Roles.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Paste the name of the execution role copied at step no. 6 in the Search box and press Enter.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Click on the AmazonIAMexecution role returned as the result.&lt;/li&gt; 
+ &lt;li&gt;On theIAMrole configuration page, select the Permissions tab from the bottom panel.&lt;/li&gt; 
+ &lt;li&gt;Click on the attachedIAMpolicy name available within Policy name column to access the policy document (JSONformat).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Inside the {}JSONpanel, verify the policy document defined for the selectedIAMexecution role. Identify Action and Resource elements and their current values. If the element values are set to "*" and the Effect is set to "Allow",the selected Amazon Lambda function has admin privileges&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&amp;nbsp;Repeat step no. 12 and 13 to verify otherIAMpolicies attached to the selected execution role.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Repeat steps no. 4 - 15 to verify theIAMexecution role permissions for other Amazon Lambda functions created within the current region.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Change theAWSregion from the navigation bar and repeat the process for the other regions.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.336">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.17" name="Configure TLS1.1+ for CloudFront to Origin connection" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  CloudFront can connect to your origin using only HTTP, only HTTPS, or to connect by matching the protocol used by the viewer. Our recommendation is to use HTTPS only. In 
+  this case you can choose which SSL\TLS protocols CloudFront is allowed to use when 
+  establishing an HTTPS connection to your origin. Ensure that you are using only TLS1.1+ as 
+  the SSL\TLS protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For configuring Origin SSL protocols first save locally the current distribution config:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Edit and replace "OriginSslProtocols" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "OriginSslProtocols": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    &amp;nbsp;"Items": [ 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "TLSv1.1", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "TLSv1.2" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    ], 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Quantity": 2 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon Cloudfront New Origin Security Features" url="https://aws.amazon.com/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin-security-features/"/>
+            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the "OriginSslProtocols" used by application Cloudfront distributions (only TLSv1.1 and TLSv1.2 should be present):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, OriginSslProtocols:Origins.Items[*].CustomOriginConfig.OriginSslProtocols.Items[*]}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C11" name="Enable and set up Request Validation in API Gateway" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To perform the API Gateway basic validation, we have to enable and set up the Request Validation in the API Gateway.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To enable basic validation, you specify validation rules in a request validator, add the validator to the API's map of request validators, and assign the validator to individual API methods.&lt;/p&gt; 
+&lt;p&gt;To set up a basic validation, we have some possibilities to configure it:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;by Importing OpenAPI Definition&lt;/li&gt; 
+ &lt;li&gt;using the API Gateway REST API&lt;/li&gt; 
+ &lt;li&gt;using the API Gateway Console&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Using the API Gateway Console:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The API Gateway console lets you set up the basic request validation on a method using one of the three validators:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Validate body: This is the body-only validator.&lt;/li&gt; 
+  &lt;li&gt;Validate query string parameters and headers: This is the parameters-only validator.&lt;/li&gt; 
+  &lt;li&gt;Validate body, query string parameters, and headers: This validator is for both body and parameters validation.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;When you choose one of the above validators to enable it on an API method, the API Gateway console will add the validator to the API's RequestValidators map, if the validator has not already been added to the validators map of the API. To enable a request validator on a method:&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the API Gateway console, if not already logged in.&lt;/li&gt; 
+  &lt;li&gt;Create a new or choose an existing API.&lt;/li&gt; 
+  &lt;li&gt;Create a new or choose an existing resource of the API.&lt;/li&gt; 
+  &lt;li&gt;Create a new or choose an existing method the resource.&lt;/li&gt; 
+  &lt;li&gt;Choose Method Request.&lt;/li&gt; 
+  &lt;li&gt;Choose the pencil icon of Request Validator under Settings.&lt;/li&gt; 
+  &lt;li&gt;Choose Validate body, Validate query string parameters and headers or Validate body, query string parameters, and headers from the Request Validator drop-down list and then choose the check mark icon to save your choice.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;For more information see the references.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify in the code if input parameters for functions are validated&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
+&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
+&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
+            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C16" name="Ensure it only exists one user to access to the API gateway" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The API gateway sits between the Lambda functions and the user. You must create an API gateway user that only has the ability to communicate with Lambda functions. It can only communicate between your internal perimeter. If the user is manipulated to send from a source other than theAPIgateway, access should be denied. You can also set Lambda authorizers in the API Gateway. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; Configure the Lambda authorizers on API methods: &lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the API Gateway console.&lt;/li&gt; 
+ &lt;li&gt;Create an API method and choose Authorizers under that API.&lt;/li&gt; 
+ &lt;li&gt;Give the permissions to access to the Lambda Functions only to one user.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Set Up an IAM to Invoke Lambda Functions" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-lambda.html#api-as-lambda-proxy-setup-iam-role-policies"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that Lambda authorizers are configured on API methods:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the API Gateway console.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Select each existing API and choose Authorizers under that API.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Check that it exist only one API gateway user with the permissions to access to the Lambda Functions.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" name="Ensure that each Lambda Function has got at least one VPC subnet in each Availability Zone" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;By specifying subnets in each of the Availability Zones, your Lambda function can run in another Availability Zone if one goes down or runs out of IP addresses.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Review each function and verify that each function has got at least one associated subnet Id in different Availability Zone with the following command:&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt;aws lambda get-function --function-name&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;If there is any function without associated Subnet Id per Availability Zone, we can update the Lambda function and assign a subnet from a specific Availability Zone with the following command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda update-function-configuration --function-name --vpc-config &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. For more information, see VPC Settings .&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
+ &lt;p&gt;SubnetIds=string,string,SecurityGroupIds=string,string&lt;/p&gt; 
+ &lt;p&gt; JSON Syntax:&lt;/p&gt; 
+ &lt;p&gt;{ "SubnetIds": ["string", ...], "SecurityGroupIds": ["string", ...]&lt;/p&gt; 
+ &lt;p&gt; }&lt;/p&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda get function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function.html#output"/>
+            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
+            <reference name="Configuring a Lambda Function to Access Resources in an Amazon VPC" url="https://docs.aws.amazon.com/lambda/latest/dg/vpc.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that all Lambda functions have got at least one associate VPN subnet per Availability Zone with the following command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C8" name="Ensure that sensitive data is not commited to the repository" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create the mechanisms to ensure that sensitive data, such personal data or credentials is not uploaded to a repository. There are different ways to implement it. One of them is with the git pre-commit hooks, this way is described in the references.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Preventing AWS credential leaks in Git with pre-commit" url="https://www.unixdaemon.net/cloud/preventing-aws-creds-in-git-with-pre-commit/"/>
+            <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that there is not any sensitive data in the code from a repository.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C29" name="Ensure that sensitive data is not saved into logs files" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Review periodically all logs to ensure that sensitive data is not presented in the logs files.&lt;/p&gt;
+
+	&lt;p&gt;AWS introduces a new security service Macie recognizing sensitive data such as personally identifiable information (PII) or intellectual property, and provides you with dashboards and alerts that give visibility into how this data is being accessed or moved.&lt;/p&gt;
+
+	&lt;p&gt;You can also use the Amazon Macie service to classify all data and find if there is sensitive data in the logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CloudWatch user guide" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html"/>
+            <reference name="AWS Macie" url="https://aws.amazon.com/macie/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify if the log files don't contain sensitive data.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" name="Ensure that the access control through API is centralized" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The access control, authentication and authorization procedures through API shall be centralized. To implement it into Lambda functions, we have got the two options:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication as well as information described by headers, paths, query strings, stage variables, or context variables request parameters.&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;TOKEN type Lambda authorizers grant a caller permissions to invoke a given request using an authorization token passed in a header. The token could be, for example, an OAuth token.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;REQUEST type Lambda authorizers grant a caller permissions to invoke a given request using request parameters, including headers, query strings, stage variables, or context parameters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; Create an API Gateway Lambda Authorizer Lambda Function:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Before creating an API Gateway Lambda authorizer, you must first create the AWS Lambda function that implements the logic to authorize and, if necessary, to authenticate the caller. You can do so in the Lambda console, using the code template available from the API Gateway Lambda Authorizer blueprint.&lt;/li&gt; 
+ &lt;li&gt;To grant IAM principals in the account that owns the API permission to call authorizer:create or create-authorizer to control the Lambda function used in your Lambda authorizer, you can create the following IAM policy.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt;
+    { 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;quot;Statement&amp;quot;: [ 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Action&amp;quot;: [ 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;apigateway:POST&amp;quot; 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Resource&amp;quot;: [ 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;arn:aws:apigateway:region::/restapis/restapi_id/authorizers&amp;quot; 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; //Create Authorizer operation is allowed only with the following Lambda function 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;Condition&amp;quot;: { 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;StringEquals&amp;quot;: { 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;apigateway:AuthorizerUri&amp;quot;: &amp;quot;arn:aws:lambda:region:account-id:function:lambda-function-name&amp;quot; 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    &amp;nbsp; &amp;nbsp; ] 
+  &lt;/blockquote&gt; 
+  &lt;blockquote&gt;
+    } 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;p&gt;&lt;/p&gt; 
+ &lt;p&gt;Create a Lambda Function for a Lambda Authorizer of the TOKEN type&lt;br /&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;In the code editor of the Lambda console, enter the following Node.js code as an example of the API Gateway Lambda authorizer of the TOKEN type.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;p&gt;&lt;/p&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;p&gt;// A simple TOKEN authorizer example to demonstrate how to use an authorization token&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// to allow or deny a request. In this example, the caller named 'user' is allowed to invoke&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// a request if the client-supplied token value is 'allow'. The caller is not allowed to invoke&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// the request if the token value is 'deny'. If the token value is 'Unauthorized', the function&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// returns the 'Unauthorized' error with an HTTP status code of 401. For any other token value,&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// the authorizer returns an 'Invalid token' error.&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
+   &lt;p&gt;exports.handler =&amp;nbsp; function(event, context, callback) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var token = event.authorizationToken;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; switch (token.toLowerCase()) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'allow':&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generatePolicy('user', 'Allow', event.methodArn));&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'deny':&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generatePolicy('user', 'Deny', event.methodArn));&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; case 'unauthorized':&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Unauthorized&amp;quot;);&amp;nbsp; &amp;nbsp;// Return a 401 Unauthorized response&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; break;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default:&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Error: Invalid token&amp;quot;);&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
+   &lt;p&gt;};&lt;/p&gt; 
+   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
+   &lt;p&gt;// Help function to generate an IAM policy&lt;/p&gt; 
+   &lt;p&gt;var generatePolicy = function(principalId, effect, resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.principalId = principalId;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (effect &amp;amp;&amp;amp; resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var policyDocument = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Version = '2012-10-17';&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement = [];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var statementOne = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Action = 'execute-api:Invoke';&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Effect = effect;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Resource = resource;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement[0] = statementOne;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; authResponse.policyDocument = policyDocument;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Optional output with custom properties of the String, Number or Boolean type.&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.context = {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;stringKey&amp;quot;: &amp;quot;stringval&amp;quot;,&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;numberKey&amp;quot;: 123,&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;booleanKey&amp;quot;: true&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; };&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; return authResponse;&lt;/p&gt; 
+   &lt;p&gt;}&lt;/p&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;p&gt;Create a Lambda Function of a Lambda Authorizer of the REQUEST type&lt;br /&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;In the code editor of the Lambda console, enter the following Node.js code for a simplified Lambda function as an example of the API Gateway Lambda authorizers of the REQUEST type.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;p&gt;&lt;/p&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;p&gt;exports.handler = function(event, context, callback) {&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; console.log('Received event:', JSON.stringify(event, null, 2));&lt;/p&gt; 
+   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // A simple REQUEST authorizer example to demonstrate how to use request&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // parameters to allow or deny a request. In this example, a request is&amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // authorized if the client-supplied HeaderAuth1 header, QueryString1 query parameter,&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // stage variable of StageVar1 and the accountId in the request context all match&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // specified values of 'headerValue1', 'queryValue1', 'stageValue1', and&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // '123456789012', respectively.&lt;/p&gt; 
+   &lt;p&gt;&lt;br /&gt;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Retrieve request parameters from the Lambda function input:&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var headers = event.headers;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var queryStringParameters = event.queryStringParameters;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var pathParameters = event.pathParameters;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var stageVariables = event.stageVariables;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var requestContext = event.requestContext;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Parse the input for the parameter values&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var tmp = event.methodArn.split(':');&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var apiGatewayArnTmp = tmp[5].split('/');&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var awsAccountId = tmp[4];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var region = tmp[3];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var restApiId = apiGatewayArnTmp[0];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var stage = apiGatewayArnTmp[1];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var method = apiGatewayArnTmp[2];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var resource = '/'; // root resource&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (apiGatewayArnTmp[3]) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; resource += apiGatewayArnTmp[3];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Perform authorization to return the Allow policy for correct parameters and&amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // the 'Unauthorized' error, otherwise.&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var condition = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; condition.IpAddress = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (headers.HeaderAuth1 === &amp;quot;headerValue1&amp;quot;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; queryStringParameters.QueryString1 === &amp;quot;queryValue1&amp;quot;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; stageVariables.StageVar1 === &amp;quot;stageValue1&amp;quot;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;amp;&amp;amp; requestContext.accountId === &amp;quot;123456789012&amp;quot;) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(null, generateAllow('me', event.methodArn));&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&amp;nbsp; else {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; callback(&amp;quot;Unauthorized&amp;quot;);&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
+   &lt;p&gt;}&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;// Help function to generate an IAM policy&lt;/p&gt; 
+   &lt;p&gt;var generatePolicy = function(principalId, effect, resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Required output:&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; var authResponse = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.principalId = principalId;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; if (effect &amp;amp;&amp;amp; resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var policyDocument = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Version = '2012-10-17'; // default version&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement = [];&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; var statementOne = {};&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Action = 'execute-api:Invoke'; // default action&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Effect = effect;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; statementOne.Resource = resource;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; policyDocument.Statement[0] = statementOne;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; authResponse.policyDocument = policyDocument;&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; }&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; // Optional output with custom properties of the String, Number or Boolean type.&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; authResponse.context = {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;stringKey&amp;quot;: &amp;quot;stringval&amp;quot;,&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;numberKey&amp;quot;: 123,&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;booleanKey&amp;quot;: true&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; };&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; return authResponse;&lt;/p&gt; 
+   &lt;p&gt;}&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;var generateAllow = function(principalId, resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; return generatePolicy(principalId, 'Allow', resource);&lt;/p&gt; 
+   &lt;p&gt;}&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt; 
+   &lt;p&gt;var generateDeny = function(principalId, resource) {&lt;/p&gt; 
+   &lt;p&gt;&amp;nbsp; &amp;nbsp; return generatePolicy(principalId, 'Deny', resource);&lt;/p&gt; 
+   &lt;p&gt;}&lt;/p&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;div&gt; 
+  &lt;p&gt;Amazon Cognito&lt;/p&gt; 
+  &lt;p&gt;&lt;/p&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;To create and configure an Amazon Cognito user pool for your API, you perform the following tasks:&lt;/li&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Use the Amazon Cognito console, CLI/SDK, or API to create a user pool-or use one that's owned by another AWS account.&lt;/li&gt; 
+    &lt;li&gt;Use the API Gateway console, CLI/SDK, or API to create an API Gateway authorizer with the chosen user pool.&lt;/li&gt; 
+    &lt;li&gt;Use the API Gateway console, CLI/SDK, or API to enable the authorizer on selected API methods.&lt;/li&gt; 
+   &lt;/ol&gt; 
+   &lt;li&gt;To call any API methods with a user pool enabled, your API clients perform the following tasks:&lt;/li&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Use the Amazon Cognito CLI/SDK or API to sign a user in to the chosen user pool, and obtain an identity token or access token.&lt;/li&gt; 
+    &lt;li&gt;Use a client-specific framework to call the deployed API Gateway API and supply the appropriate token in the Authorization header.&lt;/li&gt; 
+   &lt;/ol&gt; 
+  &lt;/ul&gt; 
+  &lt;p&gt;&lt;/p&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Control Access to a REST API Using Amazon Cognito User Pools as Authorizer" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html"/>
+            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that access control mechanisms for the API are centralized.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.900">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C14" name="Ensure that there is no user in production with the permission to delete permission on any service" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure that there is no user in production that can delete services, functions and perhaps even data. This will ensure that nobody deletes items by accident. If delete actions are required in production, ensure that you have proper guidelines in place to prevent accidental deletion.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To view a function's resource-based policy, use the get-policy command.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-policy --function-name my-function --output text&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;For versions and aliases, append the version number or alias to the function name.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-policy --function-name my-function:PROD&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;To remove permissions from your function, use remove-permission.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda remove-permission --function-name example --statement-id sns&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;Use the get-layer-version-policy command to view the permissions on a layer, and remove-layer-version-permission to remove statements from the policy.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-layer-version-policy --layer-name my-layer --version-number 3 --output text&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt;aws lambda remove-layer-version-permission --layer-name my-layer --version-number 3 --statement-id engineering-org&lt;/p&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use the following command to view the remove permission over a certain function:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-layer-version-policy --layer-name my-layer --version-number 3 --output text&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;Verify that the command above doesn't show the permissions defined with "Action": ["lambda:DeleteFunction"]&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.337">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" name="Ensure that your VPC Lambda subnet has enough IP addresses to scale" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The subnets you specify should have sufficient available IP addresses to match the number of ENIs. If your VPC does not have sufficient ENIs or subnet IPs, your Lambda function will not scale as requests increase, and you will see an increase in invocation errors with EC2 error types like EC2ThrottledException. For asynchronous invocation, if you see an increase in errors without corresponding CloudWatch Logs, invoke the Lambda function synchronously in the console to get the error responses. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Review each function and verify that each function has got at least one associated subnet Id with the following command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;If there is any function without associated Subnet Id, we can update the function and assign a subnet with the following command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda update-function-configuration --function-name --vpc-config &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. For more information, see VPC Settings .&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; Shorthand Syntax:&lt;/p&gt; 
+ &lt;p&gt;SubnetIds=string,string,SecurityGroupIds=string,string&lt;/p&gt; 
+ &lt;p&gt; JSON Syntax:&lt;/p&gt; 
+ &lt;p&gt;{ "SubnetIds": ["string", ...], "SecurityGroupIds": ["string", ...]&lt;/p&gt; 
+ &lt;p&gt; }&lt;/p&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda get function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/get-function.html#output"/>
+            <reference name="AWS Lambda update function configuration" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/update-function-configuration.html"/>
+            <reference name="Configuring a Lambda Function to Access Resources in an Amazon VPC" url="https://docs.aws.amazon.com/lambda/latest/dg/vpc.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that all functions have got at least one associate VPN subnet with the following command:&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws lambda get-function --function-name &lt;/p&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable AWS Log integrity for the application generated logs, such as storing logs on write-once media, forwarding a copy of the logs to a centralized SIEM or generating message digests for each log file.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;AWS Management Console:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;To enable log file integrity validation with the CloudTrail console, choose Yes for the Enable log file validation option when you create or update a trail. By default, this feature is enabled for new trails.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;AWS CLI:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;To enable log file integrity validation with the AWS CLI, use the --enable-log-file-validation option with the create-trail or update-trail commands.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;To disable log file integrity validation, use the --no-enable-log-file-validation option.&lt;/li&gt; 
+  &lt;li&gt;For example:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;p&gt;aws cloudtrail update-trail --name your-trail-name --enable-log-file-validation&lt;/p&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;CloudTrail API:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;To enable log file integrity validation with the CloudTrail API, set the EnableLogFileValidation request parameter to true when calling CreateTrail or UpdateTrail.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI describe trails" url="https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/describe-trails.html"/>
+            <reference name="Enabling Log File Integrity Validation for CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the AWS Logs Integrity is enabled if the output of the following command in the AWS CLI has got the variable "LogFileValidationEnabled" set to true.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws cloudtrail describe-trails&lt;/p&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C5" name="Ensure you store your encryption keys in a Key Management System" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Verify that you are using the Key Management Service. You can see a list of your customer managed keys in the AWS Management Console.&lt;br /&gt; To view your CMKs (console): &lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the left navigation pane, choose Encryption keys.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For Region, choose the appropriate AWS Region. Do not use the region selector in the navigation bar (top right corner). The console shows all the CMKs in your AWS account in the chosen region, including customer-managed and AWS managed CMKs. The page displays the alias, key ID, status, and creation date for each CMK.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;If you need to create a CMK:&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the AWS Management Console and open the AWS Key Management Service (AWS KMS) console at https://console.aws.amazon.com/kms.&lt;/li&gt; 
+ &lt;li&gt;To change the AWS Region, use the Region selector in the upper-right corner of the page.&lt;/li&gt; 
+ &lt;li&gt;In the navigation pane, choose Customer managed keys.&lt;/li&gt; 
+ &lt;li&gt;Choose Create key.&lt;/li&gt; 
+ &lt;li&gt;Type an alias for the CMK. The alias name cannot begin with aws/. The aws/ prefix is reserved by Amazon Web Services to represent AWS managed CMKs in your account.&lt;/li&gt; 
+ &lt;li&gt;An alias is a display name that you can use to identify the CMK. We recommend that you choose an alias that indicates the type of data you plan to protect or the application you plan to use with the CMK.&lt;/li&gt; 
+ &lt;li&gt;Aliases are required when you create a CMK in the AWS Management Console. They are optional when you use the CreateKey operation.&lt;/li&gt; 
+ &lt;li&gt;(Optional) Type a description for the CMK.&lt;/li&gt; 
+ &lt;li&gt;We recommend that you choose a description that explains the type of data you plan to protect or the application you plan to use with the CMK.&lt;/li&gt; 
+ &lt;li&gt;Choose Next.&lt;/li&gt; 
+ &lt;li&gt;(Optional) Type a tag key and an optional tag value. To add more than one tag to the CMK, choose Add tag.&lt;/li&gt; 
+ &lt;li&gt;When you add tags to your AWS resources, AWS generates a cost allocation report with usage and costs aggregated by tags. For information about tagging CMKs, see Tagging Keys.&lt;/li&gt; 
+ &lt;li&gt;Choose Next.&lt;/li&gt; 
+ &lt;li&gt;Select the IAM users and roles that can administer the CMK.&lt;/li&gt; 
+ &lt;li&gt;(Optional) To prevent the selected IAM users and roles from deleting this CMK, in the Key deletion section at the bottom of the page, clear the Allow key administrators to delete this key check box.&lt;/li&gt; 
+ &lt;li&gt;Choose Next.&lt;/li&gt; 
+ &lt;li&gt;Select the IAM users and roles that can use the CMK for cryptographic operations.&lt;/li&gt; 
+ &lt;li&gt;(Optional) You can allow other AWS accounts to use this CMK for cryptographic operations. To do so, in the Other AWS accounts section at the bottom of the page, choose Add another AWS account and enter the AWS account identification number of an external account. To add multiple external accounts, repeat this step.&lt;/li&gt; 
+ &lt;li&gt;Choose Next.&lt;/li&gt; 
+ &lt;li&gt;Review the key policy document that was created from your choices. You can edit it, too.&lt;/li&gt; 
+ &lt;li&gt;Choose Finish to create the CMK.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Key management service documentation" url="https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that you are using the Key Management Service. To view a list of your customer managed keys in the AWS Management Console.&lt;/li&gt; 
+ &lt;li&gt;To view your CMKs (console):&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console and open the AWS Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
+  &lt;li&gt;In the left navigation pane, choose Encryption keys.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;For Region, choose the appropriate AWS Region. Do not use the region selector in the navigation bar (top right corner). The console shows all the CMKs in your AWS account in the chosen region, including customer-managed and AWS managed CMKs. The page displays the alias, key ID, status, and creation date for each CMK.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" name="Increase log reports with serverless-specific information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Organizations adopting serverless architectures, are encouraged to augment log reports with serverless-specific information such as:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Logging of API access keys related to successful/failed logins (authentication)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Attempts to invoke serverless functions with inadequate permissions (authorizations)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Successful/failed deployment of new serverless functions or configurations (change)&lt;/li&gt; 
+ &lt;li&gt;Changes to function permissions or execution roles (change)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Changes to files or access permissions on relevant cloud storage services (change)&lt;/li&gt; 
+ &lt;li&gt;Changes in function trigger definitions (change)&lt;/li&gt; 
+ &lt;li&gt;Anomalous interaction or irregular flow between serverless functions (change)&lt;/li&gt; 
+ &lt;li&gt;Changes to 3rd party dependencies (modules, libraries or APIs)&lt;/li&gt; 
+ &lt;li&gt;Outbound connections initiated by serverless functions (network)&lt;/li&gt; 
+ &lt;li&gt;Execution of serverless functions or access to data from an external 3rd party account not related to the main account to which the serverless application belongs (resource access)&lt;/li&gt; 
+ &lt;li&gt;Serverless function execution timeouts (failure reports)&lt;/li&gt; 
+ &lt;li&gt;Concurrent serverless function execution limits reached (failure reports)&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Organizations are also encouraged to adopt serverless application logic/code runtime tracing and debugging facilities in order to gain better understanding of the overall system and data flow. For example: AWS X-Ray&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; To log more actions with the CloudTrail, we only have to create a trail as following:&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Create a trail. By default, when you create a trail in a region in the CloudTrail console, the trail applies to all regions.&lt;/li&gt; 
+ &lt;li&gt;Create an Amazon S3 bucket or specify an existing bucket where you want the log files delivered. By default, log files from all regions in your account are delivered to the bucket that you specify.&lt;/li&gt; 
+ &lt;li&gt;Configure your trail to log read-only, write-only, or all management events, and all or a subset of data events. By default, trails log all management events and no data events.&lt;/li&gt; 
+ &lt;li&gt;Create an Amazon SNS topic to receive notifications when log files are delivered. Delivery notifications from all regions are sent to the topic that you specify.&lt;/li&gt; 
+ &lt;li&gt;Configure CloudWatch Logs to receive your logs from CloudTrail so that you can monitor for specific log events.&lt;/li&gt; 
+ &lt;li&gt;Change the encryption method for your log files from server-side encryption with Amazon S3-managed encryption keys (SSE-S3) to server-side encryption with AWS KMS-managed keys (SSE-KMS).&lt;/li&gt; 
+ &lt;li&gt;Turn on integrity validation for log files. This enables the delivery of digest files that you can use to validate the integrity of log files after CloudTrail has delivered them.&lt;/li&gt; 
+ &lt;li&gt;Add tags (custom key-value pairs) to your trail.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI describe trails" url="https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/describe-trails.html"/>
+            <reference name="AWS Lambda Metrics and Dimensions - CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html"/>
+            <reference name="AWS-X-Ray" url="https://aws.amazon.com/xray/"/>
+            <reference name="Creating a Trail For Your AWS Account" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html"/>
+            <reference name="Logging AWS Lambda API Calls by Using AWS CloudTrail" url="https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html"/>
+            <reference name="Logging AWS Serverless Application Repository API Calls with AWS CloudTrail" url="https://docs.aws.amazon.com/serverlessrepo/latest/devguide/logging-using-cloudtrail.html"/>
+            <reference name="Troubleshooting &amp; Monitoring Lambda-based Apps with CloudWatch" url="https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the new logs are included in CloudTrail, we can get all trails with the following command: &lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; aws cloudtrail describe-trails&lt;/p&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C17" name="Limit the lifetime of your containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure that your containers and functions lifecycles are handled correctly and no lingering processes exist.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Use CloudWatch metrics to view the number of tasks in your services that are in the RUNNING state and set a CloudWatch alarm for this metric to alert you if the number of running tasks in your service falls below a specified value.&lt;/p&gt; 
+&lt;p&gt; To view the number of running tasks in a service&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
+ &lt;li&gt;On the navigation pane, choose Metrics.&lt;/li&gt; 
+ &lt;li&gt;On the All metrics tab, choose ECS.&lt;/li&gt; 
+ &lt;li&gt;Choose ClusterName, ServiceName and then choose any metric (either CPUUtilization or MemoryUtilization) that corresponds to the service to view running tasks in.&lt;/li&gt; 
+ &lt;li&gt;On the Graphed metrics tab, change Period to 1 Minute and Statistic to Sample Count.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To create a CloudWatch alarm on a metric&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
+ &lt;li&gt;On the left navigation, choose Alarms, Create Alarm.&lt;/li&gt; 
+ &lt;li&gt;In the CloudWatch Metrics by Category section, choose ECS Metrics &amp;gt; ClusterName.&lt;/li&gt; 
+ &lt;li&gt;On the Modify Alarm page, choose the MemoryReservation metric for the default cluster and choose Next.&lt;/li&gt; 
+ &lt;li&gt;In the Alarm Threshold section, enter a name and description for your alarm.&lt;/li&gt; 
+ &lt;li&gt;Set the threshold and time period requirement to MemoryReservation greater than 75% for 1 period.&lt;/li&gt; 
+ &lt;li&gt;Configure a notification to send when the alarm is triggered. You can also choose to delete the notification if you don't want to configure one now.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CloudWatch metrics" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html#available_cloudwatch_metrics"/>
+            <reference name="Tutorial: Scaling container instances with CloudWatch alarms" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch_alarm_autoscaling.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check CloudWatch data on containers and services that are in the RUNNING state.&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
+ &lt;li&gt;On the navigation pane, choose Metrics.&lt;/li&gt; 
+ &lt;li&gt;On the All metrics tab, choose ECS.&lt;/li&gt; 
+ &lt;li&gt;Choose ClusterName, ServiceName and then choose any metric (either CPUUtilization or MemoryUtilization) that corresponds to the service to view running tasks in.&lt;/li&gt; 
+ &lt;li&gt;On the Graphed metrics tab, change Period to 1 Minute and Statistic to Sample Count.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt; 
+&lt;p&gt;The following AWS managed policies, which you can attach to users in your account, are specific to CloudWatch Logs:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;CloudWatchLogsFullAccess - Grants full access to CloudWatch Logs.&lt;/li&gt; 
+ &lt;li&gt;CloudWatchLogsReadOnlyAccess - Grants read-only access to CloudWatch Logs.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;By default, all user shall only have got the managed policy "CloudWatchLogsReadOnlyAccess", and only few users shall have got the managed policy "CloudWatchLogsFullAccess".&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Go to the AWS CLI.&lt;/li&gt; 
+ &lt;li&gt;List all users, with the following command:&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws iam list-users&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Run the following command per user to ensure that only the desired users have got the managed policy "CloudWatchLogsFullAccess" and the other users the managed policy "CloudWatchLogsReadOnlyAccess", to do it run the following command per username:&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws iam list-attached-user-policies --user-name [userName]&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;If there is at least user with the managed policy "CloudWatchLogsFullAccess" and it shall not be allowed, we have to change the managed policy for these users.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Run the following command per each user to remove the managed policy:&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws iam delete-user-policy --user-name [userName] --policy-name CloudWatchLogsFullAccess&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Run the following command per each user to add a new managed policy:&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess --user-name [userName]&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI assign policy to user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-user-policy.html"/>
+            <reference name="AWS CLI list policies per user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-user-policies.html"/>
+            <reference name="AWS CLI list users" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"/>
+            <reference name="AWS CLI remove policy per user" url="https://docs.aws.amazon.com/cli/latest/reference/iam/delete-user-policy.html"/>
+            <reference name="AWS Managed (Predefined) Policies for CloudWatch Logs" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html#managed-policies-cwl"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Go to the AWS CLI.&lt;/li&gt; 
+ &lt;li&gt;List all users, with the following command: aws iam list-users&lt;/li&gt; 
+ &lt;li&gt;Run the following command per user and check that only the desired users have got the managed policy "CloudWatchLogsFullAccess" and the other users the managed policy "CloudWatchLogsReadOnlyAccess", to do it run the following command per username: aws iam list-attached-user-policies --user-name [userName]&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C18" name="Monitor the containers for processes hanging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use CloudWatch to monitor the containers and the processes&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Before your container instances can send log data to CloudWatch Logs, you must create an IAM policy to allow your container instances to use the CloudWatch Logs APIs, and then you must attach that policy to ecsInstanceRole.&lt;/p&gt; 
+&lt;p&gt;To create the ECS-CloudWatchLogs IAM policy&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
+ &lt;li&gt;In the navigation pane, choose Policies.&lt;/li&gt; 
+ &lt;li&gt;Choose Create policy, JSON.&lt;/li&gt; 
+ &lt;li&gt;Enter the following policy:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:&lt;strong&gt;:*:&lt;/strong&gt;" ] } ]}&lt;/li&gt; 
+ &lt;li&gt;Choose Review policy.&lt;/li&gt; 
+ &lt;li&gt;On the Review policy page, enter ECS-CloudWatchLogs for the Name and choose Create policy.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To attach the ECS-CloudWatchLogs policy to ecsInstanceRole&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt; 
+ &lt;li&gt;In the navigation pane, choose Roles.&lt;/li&gt; 
+ &lt;li&gt;Choose ecsInstanceRole. If the role does not exist, follow the procedures in Amazon ECS Container Instance IAM Role to create the role.&lt;/li&gt; 
+ &lt;li&gt;Choose Permissions, Attach policy.&lt;/li&gt; 
+ &lt;li&gt;To narrow the available policies to attach, for Filter, type ECS-CloudWatchLogs.&lt;/li&gt; 
+ &lt;li&gt;Check the box to the left of the ECS-CloudWatchLogs policy and choose Attach policy.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To install the CloudWatch Logs agent:&lt;br /&gt; Run the following command to install the CloudWatch Logs agent.&lt;br /&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt; sudo yum install -y awslogs&lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;To configure the CloudWatch Logs agent:&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Back up the existing CloudWatch Logs agent configuration file: sudo mv /etc/awslogs/awslogs.conf /etc/awslogs/awslogs.conf.bak&lt;/li&gt; 
+ &lt;li&gt;Create a blank configuration file: sudo touch /etc/awslogs/awslogs.conf&lt;/li&gt; 
+ &lt;li&gt;Open the /etc/awslogs/awslogs.conf file with a text editor, and copy the example file above into it.&lt;/li&gt; 
+ &lt;li&gt;Install the jq JSON query utility: sudo yum install -y jq&lt;/li&gt; 
+ &lt;li&gt;Query the Amazon ECS introspection API to find the cluster name and set it to an environment variable: cluster=$(curl -s http://localhost:51678/v1/metadata | jq -r '. | .Cluster')&lt;/li&gt; 
+ &lt;li&gt;Replace the {cluster} placeholders in the file with the value of the environment variable you set in the previous step: sudo sed -i -e "s/{cluster}/$cluster/g" /etc/awslogs/awslogs.conf&lt;/li&gt; 
+ &lt;li&gt;Query the Amazon ECS introspection API operation to find the container instance ID and set it to an environment variable: container_instance_id=$(curl -s http://localhost:51678/v1/metadata | jq -r '. | .ContainerInstanceArn' | awk -F/ '{print $2}' )&lt;/li&gt; 
+ &lt;li&gt;Replace the {container_instance_id} placeholders in the file with the value of the environment variable you set in the previous step: sudo sed -i -e "s/{container_instance_id}/$container_instance_id/g" /etc/awslogs/awslogs.conf&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To configure the CloudWatch Logs agent Region:&lt;br /&gt; By default, the CloudWatch Logs agent sends data to the us-east-1 region. To send your data to a different region, such as the Region in which your cluster is located, you can set the Region in the /etc/awslogs/awscli.conf file.&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the /etc/awslogs/awscli.conf file with a text editor.&lt;/li&gt; 
+ &lt;li&gt;In the [default] section, replace us-east-1 with the Region from which to view log data.&lt;/li&gt; 
+ &lt;li&gt;Save the file and exit your text editor.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To start the CloudWatch Logs agent&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Start the CloudWatch Logs agent with the following command.&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Linux: sudo service awslogs start&lt;/li&gt; 
+  &lt;li&gt;Amazon Linux 2: sudo systemctl start awslogsd&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure that the CloudWatch Logs agent starts at every system boot with the following command.&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Linux: sudo chkconfig awslogs on&lt;/li&gt; 
+  &lt;li&gt;Amazon Linux 2: sudo systemctl enable awslogsd.service&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon ECS CloudWatch Metrics" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html"/>
+            <reference name="Using CloudWatch Logs with Container Instances" url="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that each container throws their logs and follow the next steps to do it.&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&lt;/li&gt; 
+ &lt;li&gt;In the left navigation pane, choose Logs.&lt;/li&gt; 
+ &lt;li&gt;You should see the log groups you configured in Configuring and Starting the CloudWatch Logs Agent.&lt;/li&gt; 
+ &lt;li&gt;Choose a log group to view.&lt;/li&gt; 
+ &lt;li&gt;Choose a log stream to view. The streams are identified by the cluster name and container instance ID that sent the logs.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C2" name="Not expose your data stores directly to internet" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When using S3 buckets ensure you disable public read access, unless you are using the bucket for storing images or a static website. Ensure data stores are properly protected with firewall settings and gateways. Create specific internal users to access the data store and ensure that only those users can access the data store.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt; To set ACL access permissions for an S3 bucket: &lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the Bucket name list, choose the name of the bucket that you want to set permissions for.&lt;/li&gt; 
+ &lt;li&gt;Choose Permissions .&lt;/li&gt; 
+ &lt;li&gt;You can manage bucket access permissions for the following: Owner access, Access for other AWS accounts, Public access or S3 log delivery group.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How Do I Set ACL Bucket Permissions?" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-bucket-permissions.html"/>
+            <reference name="Identifying Public Buckets Using Bucket Permissions Check" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/bucket-permissions-check.html"/>
+            <reference name="S3 Access Control List (ACL) Overview" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the access permissions for an S3 bucket: &lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;In the Bucket name list, choose the name of the bucket that you want to set permissions for.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Choose Permissions.&lt;/li&gt; 
+ &lt;li&gt;Check that the permissions are defined well.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-937" name="Regularly check for known vulnerabilities in the dependencies of your project" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Vulnerabilities in common popular and shared libraries are published and recorded in a number of
+                        online databases and services, including the MITRE CVE and CWE databases.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Perform regular checks for published vulnerabilities in third party components and the
+                        IDE.&lt;/li&gt;
+                        &lt;li&gt;Test and apply appropriate recommended patches and mitigations.&lt;/li&gt;
+                        &lt;li&gt;Use subscription threat intelligence and alerting services to ensure timely
+                        notification of possible threats&lt;/li&gt;
+                        &lt;li&gt;Use automated vulnerability scanning tools to identify and test for security threats
+                        to the project.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Common Vulnerabilities and Exposures (CVE) Database" url="https://cve.mitre.org/"/>
+            <reference name="Common Weakness Enumeration (CWE) Database" url="https://cwe.mitre.org"/>
+            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
+            <reference name="OWASP Dependency-Check" url="https://www.owasp.org/index.php/OWASP_Dependency_Check"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1.14.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.SC-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Ensure a process is in place to regularly check for vulnerabilities in software
+                            components and libraries. Sources should include:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Vendor notifications&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Threat intelligence feeds&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Vulnerability scanning.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Verify that processes exist to respond to vulnerabilities to research, test, and
+                            deploy appropriate patches.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            The following tools can help in automating dependencies checks:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.owasp.org/index.php/OWASP_Dependency_Check"&gt;OWASP
+                            Dependency Check&lt;/a&gt;&amp;nbsp;for Java and .NET.&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="http://retirejs.github.io/retire.js/"&gt;Retire.js&lt;/a&gt;&amp;nbsp;with
+                            support to scan several different of the most popular JS libraries and frameworks.&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://nodesecurity.io/opensource"&gt;nodesecurity.io&lt;/a&gt;&amp;nbsp;which
+                            focuses on node packages and libraries' security.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.443">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C7" name="Review and remove unused functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Review the current Lambda Functions and remove those unused functions from the system.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To list all functions:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Go to the AWS CLI, and write the following command:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws list-functions&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review all functions search those unused functions.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;To remove a certain function:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Go to the AWS CLI, and write the following command:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt; aws delete-function -function-name &lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Delete function" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/delete-function.html"/>
+            <reference name="AWS CLI List functions" url="https://docs.aws.amazon.com/cli/latest/reference/lambda/list-functions.html"/>
+            <reference name="Automating the discovery of unused AWS Lambda functions" url="https://aws.amazon.com/blogs/mt/automating-the-discovery-of-unused-aws-lambda-functions/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Write the following command in the AWS CLI and check that all listed functions are not unused functions:&amp;nbsp;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;p&gt;aws list-functions&lt;/p&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.443">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C22" name="Set a concurrency limits for your functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Lambda provides a concurrent execution limit control at both the account level and the function level. By default, AWS Lambda limits the total concurrent executions across all functions within a given region to 1000. The function level concurrent execution limit is by default enforced against the sum of the concurrent executions of all functions.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; To set a concurrency limit for your Lambda function using the AWS CLI, do the following:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Use the PutFunctionConcurrency operation and pass in the function name and concurrency limit you want allocated to this function:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt; aws lambda put-function-concurrency --function-name function-name --reserved-concurrent-executions limit value&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Managing Concurrency" url="https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html"/>
+            <reference name="Set Concurrency Limits on Individual AWS Lambda Functions" url="https://aws.amazon.com/about-aws/whats-new/2017/11/set-concurrency-limits-on-individual-aws-lambda-functions/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Use AWS CLI and use the following command to view the concurrency limit per function:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check all function and verify that they have got set a well the concurrency limit.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; {&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; "Statement":[&lt;/i&gt; 
+   &lt;i&gt;{&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Condition":{&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;div&gt; 
+       &lt;i&gt;"Bool":&lt;/i&gt; 
+      &lt;/div&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;}&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;i&gt;}&lt;/i&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; }&lt;/i&gt; 
+     &lt;i&gt;]&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt;} &lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
+                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
+                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C25" name="Set time-outs on invocations of functions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To prevent your Lambda function from running indefinitely, you specify a timeout. You shall set this value based on your expected execution time. The default for functions created in the console is 3 seconds. To ensure that you write clean code also verify that the termination criteria are met every time to prevent endless or long invocations.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Update the timeout of your functions using the following AWS CLI command:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws lambda update-function-configuration --function-name myfunction --timeout 3&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;In the example, we change the timeout limit to 3 seconds&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
+            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
+            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Use AWS CLI and use the following command to view the timeout limit per function:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws lambda get-function --function-name function-name&amp;nbsp;&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check all function and verify that they have got set a well the timeout limit.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C9" name="Store your environment variables in a secure place" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Plain text environment variables should not be pushed to code repositories. You can use KMS to encrypt environment variables.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt; Step 1: Create the Lambda Function (If you've already created the Lambda function, skip this step)&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Sign in to the AWS Management Console and open the AWS Lambda console at https://console.aws.amazon.com/lambda/.&lt;/li&gt; 
+ &lt;li&gt;Choose Create a Lambda function.&lt;/li&gt; 
+ &lt;li&gt;In Select blueprint, choose the Author from scratch button.&lt;/li&gt; 
+ &lt;li&gt;In Basic information, do the following:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;In Name, specify your Lambda function name.&lt;/li&gt; 
+  &lt;li&gt;In Role, choose Choose an existing role.&lt;/li&gt; 
+  &lt;li&gt;In Existing role, choose lambda_basic_execution.&lt;/li&gt; 
+  &lt;li&gt;Note: If the policy of the execution role does not have the decrypt permission, you will need add it.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Choose Create function.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Step 2: Configure the Lambda Function&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Under Configuration, specify the Runtime of your choice.&lt;/li&gt; 
+ &lt;li&gt;Under the Lambda function code section you can take advantage of the Edit code inline option to replace the Lambda function handler code with your custom code.&lt;/li&gt; 
+ &lt;li&gt;Note the Triggers tab. Under the Triggers page, you can optionally choose a service that automatically triggers your Lambda function by choosing the Add trigger button and then choosing the gray box with ellipses (...) to display a list of available services. For this example, do not configure a trigger and choose Configuration.&lt;/li&gt; 
+ &lt;li&gt;Note the Monitoring tab. This page will provide immediate CloudWatch metrics for your Lambda function invocations, as well as links to other helpful guides, including Using AWS X-Ray.&lt;/li&gt; 
+ &lt;li&gt;Expand the Environment variables section.&lt;/li&gt; 
+ &lt;li&gt;Enter your key-value pair. Expand the Encryption configuration section. Note that Lambda provides a default service key under KMS key to encrypt at rest which encrypts your information after it has been uploaded. If the information you provided is sensitive, you can additionally check the Enable helpers for encryption in transit checkbox and supply a custom key. This masks the value you entered and results in a call to AWS KMS to encrypt the value and return it as Ciphertext. If you haven't created a KMS key for your account, you will be provided a link to the AWS IAM console to create one. The account must have have encrypt and decrypt permissions for that key. Note that the Encrypt button toggles to Decrypt after you choose it. This affords you the option to update the information. Once you have done that, choose the Encrypt button.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Environment Variables" url="https://docs.aws.amazon.com/lambda/latest/dg/env_variables.html#env_encrypt"/>
+            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1. Under Configuration, specify the Runtime of your choice.&lt;br /&gt;
+2. Expand the Environment variables section.&lt;br /&gt;
+3. Check that the Environment variables are configured well in this section.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:33.901">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C23" name="Use a profiler tool to improve the application" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When using a profiler tool, the execution of your functions are monitored. It will reveal which functions are called, number of invocations, execution times, memory usage and CPU use.&lt;/p&gt;
+
+	&lt;p&gt;You can use it to find and identify bottlenecks and address them. Therefore, you shall use a profiler tool to improve the time of use, memory usage and CPU usage of the function.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Limits" url="https://docs.aws.amazon.com/lambda/latest/dg/limits.html"/>
+            <reference name="Best practices for AWS Lambda timeouts" url="https://epsagon.com/development/best-practices-for-aws-lambda-timeouts/"/>
+            <reference name="Function configuration" url="https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that a profiler tool is used to improve the Lambda function.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-LAMBDA-C24" name="Use the API gateway Plans to throttle incoming API calls or rate limit the requests" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Throttling or rate limiting will limit the rate of transactions passing through the API Gateway. When limits are exceeded the API gateway will respond with a HTTP response error code. There are several possibilities to set throttling but the use of an API key and usage plan is a best practice.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br /&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;In the Amazon API Gateway main navigation pane, choose Usage Plans, and then choose Create.&lt;/li&gt; 
+ &lt;li&gt;Under Create Usage Plan, do the following:&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;For Name, type a name for your plan (for example, Plan_A).&lt;/li&gt; 
+  &lt;li&gt;For Description, type a description for your plan.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select Enable throttling, and set Rate (for example, 100) and Burst (for example, 200).&lt;/li&gt; 
+  &lt;li&gt;Choose Enable quota, and set its limit (for example, 5000) for a selected time interval (for example, Month).&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;li&gt;To add a stage to the plan, do the following in the Associated API Stages pane:&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Choose Add API Stage.&lt;/li&gt; 
+  &lt;li&gt;Choose an API (for example, PetStore) from the API drop-down list.&lt;/li&gt; 
+  &lt;li&gt;Choose a stage (for example, Stage_1) from the Stage drop-down list.&lt;/li&gt; 
+  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;li&gt;To configure method throttling, do the following:&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Choose Configure Method Throttling.&lt;/li&gt; 
+  &lt;li&gt;Choose Add Resource/Method.&lt;/li&gt; 
+  &lt;li&gt;Choose the resource from the Resource drop-down menu.&lt;/li&gt; 
+  &lt;li&gt;Choose the method from the Method drop-down menu.&lt;/li&gt; 
+  &lt;li&gt;Set Rate (requests per second) (for example, 100) and Burst (for example, 200).&lt;/li&gt; 
+  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
+  &lt;li&gt;Choose Close.&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;li&gt;To add a key to the plan, do the following in the API Keys tab:&lt;/li&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;To use an existing key, choose Add API Key to Usage Plan.&lt;/li&gt; 
+  &lt;li&gt;For Name, type a name for the key you want to add (for example, MyFirstKey).&lt;/li&gt; 
+  &lt;li&gt;Choose the checkmark icon to save.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;As needed, repeat the preceding steps to add other existing API keys to this usage plan.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS API gateway Limits" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html"/>
+            <reference name="Create and Use Usage Plans with API Keys" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html"/>
+            <reference name="Create, Configure, and Test Usage Plans Using the API Gateway CLI and REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-rest-api.html"/>
+            <reference name="Create, Configure, and Test Usage Plans with the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.html"/>
+            <reference name="Throttle API Requests for Better Throughput" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Check that all API Gateway Plans are configured well.&lt;/li&gt; 
+ &lt;li&gt;Go to the API Gateway main navigation pane, choose Usage Plans.&lt;/li&gt; 
+ &lt;li&gt;Choose a usage plan from the list of usage plans.&lt;/li&gt; 
+ &lt;li&gt;From within the specified plan, choose API Keys.&lt;/li&gt; 
+ &lt;li&gt;Choose an API key, and then choose Usage to view Subscriber's Traffic from the plan you're monitoring, and verify that all works well&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL-GENERIC" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="aws-lambda" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received shall be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies, or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms, these can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;/p&gt; 
+&lt;p&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one end of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/p&gt; 
+&lt;p&gt;As such, all data received must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria.&lt;/p&gt; 
+&lt;p&gt; Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."&lt;br /&gt; Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&lt;/p&gt; 
+&lt;p&gt; While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&lt;/p&gt; 
+&lt;p&gt; Validate all data received from the client, including values such as HTTP headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Input Validation Cheat Sheet" url="https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet"/>
+            <reference name="OWASP Testing for Input Validation" url="https://www.owasp.org/index.php/Testing_for_Input_Validation"/>
+          </references>
+          <standards>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify all data input points for the application, for example:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt; 
+ &lt;li&gt;API calls&lt;/li&gt; 
+ &lt;li&gt;HTTP Headers&lt;/li&gt; 
+ &lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the whitelists (for example with a regular expression) before being processed.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;To test data validation:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;A number of tools can be used to aid in testing: &lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Directly with your browser and with the Developer Tools&lt;/li&gt; 
+ &lt;li&gt;Use a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt; 
+ &lt;li&gt;Use a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="AWS-LAMBDA-T13" name="Attackers gain access to a Lambda function through a Cross-site scripting attack on the DynamoDB API" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Through a Cross-site scripting attack an attacker retrieves credentials. The parameters weren't validated, resulting in an injection of code to retrieve sensitive data such as as credentials.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL-GENERIC" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LAMBDA-T4" name="Attackers gain access to the AWS account through leaked credentials" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;By storing your account information or environment variables in a "public" resource or storing them as plain text, attackers can find that information. Attackers will scan GitHub repositories or scrape/crawl files on your resources to find this kind of information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C8" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W8">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C9" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C8" mitigation="50"/>
+                <countermeasure ref="AWS-LAMBDA-C9" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-592">
+                  <countermeasures>
+                    <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED-AWS-LAMBDA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W10">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C12" mitigation="25"/>
+                    <countermeasure ref="AWS-LAMBDA-C16" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C12" mitigation="25"/>
+                <countermeasure ref="AWS-LAMBDA-C16" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-233" name="Privilege Escalation" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W10">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C12" mitigation="33"/>
+                    <countermeasure ref="AWS-LAMBDA-C14" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C12" mitigation="33"/>
+                <countermeasure ref="AWS-LAMBDA-C14" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="AWS-LAMBDA-T12" name="Attackers force to increase the Amazon billing through overloading the resources" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;One of the principles of Lambda functions is that you pay for the amount of time your code is running. This pushes the developer to write efficient code. Efficient code should also be limited in execution time. An attacker could try to force services to overload resources and push the boundaries.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W16">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="20"/>
+                    <countermeasure ref="AWS-LAMBDA-C24" mitigation="20"/>
+                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="20"/>
+                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W19">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="20"/>
+                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C11" mitigation="20"/>
+                <countermeasure ref="AWS-LAMBDA-C22" mitigation="20"/>
+                <countermeasure ref="AWS-LAMBDA-C24" mitigation="20"/>
+                <countermeasure ref="AWS-LAMBDA-C25" mitigation="20"/>
+                <countermeasure ref="AWS-LAMBDA-C26" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="50"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="50"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W14">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W15">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C20" mitigation="13"/>
+                    <countermeasure ref="AWS-LAMBDA-C23" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W16">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
+                    <countermeasure ref="AWS-LAMBDA-C24" mitigation="13"/>
+                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
+                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W17">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W18">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-VPC-IP-ADDRESS-DEPLETION-WEAKNESS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" mitigation="12"/>
+                    <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C20" mitigation="13"/>
+                <countermeasure ref="AWS-LAMBDA-C22" mitigation="13"/>
+                <countermeasure ref="AWS-LAMBDA-C23" mitigation="13"/>
+                <countermeasure ref="AWS-LAMBDA-C24" mitigation="13"/>
+                <countermeasure ref="AWS-LAMBDA-C25" mitigation="12"/>
+                <countermeasure ref="AWS-LAMBDA-C26" mitigation="12"/>
+                <countermeasure ref="AWS-LAMBDA-IP-ADDRESSES-VPC" mitigation="12"/>
+                <countermeasure ref="AWS-LAMBDA-SUBNET-AVAILABILITY-ZONE" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LAMBDA-T15" name="Lambda function is compromised through a code injection attack" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;When input validation is non-existent or not strong, malicious code can be injected through the input parameters. This may compromise the complete application and data stores.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W9">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
+                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
+                <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LAMBDA-T5" name="Lambda function is exploited by a non-HTTP event through code injection" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;A Lambda function can be triggered by a non-HTTP event (e.g. S3, SNS, SES, CloudWatch Events, etc.). When input validation is non-existing or not strong, malicious code can be injected through the input parameters. This may lead to complete compromise of the application and data stores.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W9">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
+                    <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C11" mitigation="50"/>
+                <countermeasure ref="DATA-VAL-GENERIC" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LAMBDA-T9" name="Lambda functions are accessible through an unclean container" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Cloud providers run your functions in a container. Because you want your function to execute as fast and efficient as possible, the containers are kept warm. This means that a container will be persistent for a while after a function is executed. This could leave room for a successful attack on the container.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W11">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C17" mitigation="25"/>
+                    <countermeasure ref="AWS-LAMBDA-C20" mitigation="25"/>
+                    <countermeasure ref="AWS-LAMBDA-C23" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W12">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C18" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C17" mitigation="25"/>
+                <countermeasure ref="AWS-LAMBDA-C18" mitigation="25"/>
+                <countermeasure ref="AWS-LAMBDA-C20" mitigation="25"/>
+                <countermeasure ref="AWS-LAMBDA-C23" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-94" name="Man in the Middle Attack" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C5" mitigation="33"/>
+                    <countermeasure ref="aws-tier-1.17" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C5" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="34"/>
+                <countermeasure ref="aws-tier-1.17" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="MONITORING AND LOGGING" name="Monitoring and Logging" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" mitigation="33"/>
+                    <countermeasure ref="AWS-LOGS-INTEGRITY" mitigation="34"/>
+                    <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-LOG-SPECIFICS" mitigation="33"/>
+                <countermeasure ref="AWS-LOGS-INTEGRITY" mitigation="34"/>
+                <countermeasure ref="AWS-RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PATCHING" name="Patching" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="AWS-LAMBDA-T3" name="Attackers exploit an unused function to enter the system" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;A &amp;quot;problem&amp;quot; with serverless architecture is that you don't pay for functions that aren't used. This means that your unused functions will not appear on your bill. If the unused functions become forgotten, they can become a threat. Those functions will not be updated or patched.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W5">
+                  <countermeasures>
+                    <countermeasure ref="CWE-937" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W6">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C7" mitigation="50"/>
+                <countermeasure ref="CWE-937" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LAMBDA-T10" name="Lambda functions are compromised through exploiting vulnerable dependencies" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Functions often use third-party libraries or frameworks. These dependencies can be vulnerable and new vulnerabilities are regularly disclosed. As soon as a vulnerability is registered in the CVE database, attackers will try to exploit the vulnerability within hours using automated exploits.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W13">
+                  <countermeasures>
+                    <countermeasure ref="CWE-937" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-937" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="SENSITIVE INFORMATION IN DATA STORES" name="Sensitive information in data stores" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="AWS-LAMBDA-T1" name="Sensitive information is leaked from data stores" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Sensitive information is exfiltrated from a data store because there is no encryption applied or the server was misconfigured&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="SENSITIVE INFORMATION IN LOGS" name="Sensitive information in logs" desc="" library="aws-lambda">
+          <threats>
+            <threat ref="AWS-LAMBDA-T14" name="Sensitive data is leaked through non-sanitized debugging/logging statements" state="Expose" source="RULES" edited="false" owner="" library="aws-lambda" editable="true">
+              <desc>&lt;p&gt;Whilst logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships, ensuring sensitive user data and system information are not exposed to potential attackers.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-LAMBDA-W21">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-LAMBDA-W22">
+                  <countermeasures>
+                    <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-LAMBDA-C29" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a60c094b-6d79-4aa6-8633-72e2cfab0ca2" diagramComponentId="aed86015-18c1-4a84-9daf-2feb20bf1293" ref="d5c97dad-ac42-4bda-b803-765e1e0f65e4" name="Web Application - Server side (CS-Default)" desc="" library="" parentComponentRef="a5f31feb-0210-47cd-b98c-c4baa599857e" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.453">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.710">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.453">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.785">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.050">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.711">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.871">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.452">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.662">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.049">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.241">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.326">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.887">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.325">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.945">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:35.889">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.326">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:36.324">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.946">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:34.947">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="81419837-f1a6-48b5-afc1-a2f9b3061ab9" diagramComponentId="2a89c488-16f0-4659-87d2-85e4136d7268" ref="b67b25bc-867e-4095-abfd-1e05c2ab31a3" name="ELB - Elastic Load Balancer" desc="" library="" parentComponentRef="358252c4-3454-41c0-a725-ff1c4193ca9e" componentDefinitionRef="load-balancer">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.003">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.004">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
+          <desc>We do not have our resources current status and as a result lose control of some resources,
+                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:32.002">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;br&gt; 
+&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;br&gt; 
+&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
+&lt;br&gt; 
+&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;br&gt; 
+&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
+&lt;br&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br&gt; 
+&lt;br&gt; Using the Amazon unified command line interface: 
+&lt;ul&gt; 
+ &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
+  &lt;blockquote&gt;
+    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+  &lt;/blockquote&gt; &lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-07-27T19:40:01.625">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div style=""&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;div style=""&gt;
+    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
+                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
+                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
+                        engineered to be isolated from failures in other Availability Zones. By launching instances in
+                        separate Availability Zones, you can protect your applications from the failure of a single
+                        location. AWS assigns a unique ID to each subnet.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
+                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
+                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
+                        in a VPC, the CIDR blocks of the subnets must not overlap.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
+                        where possible.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
+                        fault tolerance and high availability from the perspective of resource deployment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-subnet --vpc-id application_vpc
+                        --cidr-block desired_cidr
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-tags --resources web_tier_elb_subnet1
+                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  OR 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  When an internal load balancer is created, it receives a public DNS name with the following form: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   internal-name-123456789.region.elb.amazonaws.com 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
+          </references>
+          <standards>
+            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The SG associated with the App tier ELB should allow connectivity from the security group
+                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
+                        the application design.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
+                        ELB:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
+                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; },
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
+                        --ip-permissions file:///PathTo/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This is required for both the configured port and protocol for the listener on the back-end
+                        instance and the port and protocol used for the health check.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
+                        security group rules that allow traffic for the specific application protocol and ports by
+                        referencing as source the security group associated with the App tier ELB.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
+                        element from Audit procedure):&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
+                        App tier ELB security group as the source of the connections:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
+                        --protocol tcp --port specific_port
+                        --source-group app_tier_elb_security_group
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
+                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
+                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
+                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.716">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+          </references>
+          <standards>
+            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;quot;AccessLog&amp;quot;: { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
+            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
+            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
+          </references>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Via Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all ELB's:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
+            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
+            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
+            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
+            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
+            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
+          </references>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-server-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For Amazon Certificate Manager users: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm list-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
+                        establishing a new connection supporting the Server Order Preference option. When this option is
+                        selected, the load balancer selects the first cipher in its list that is in the client's list of
+                        ciphers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
+                        &lt;br /&gt;To enable Server Order Preference:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Click Save. &lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  In order to use HTTPS, an SSL\TLS certificate must be attached. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   "OriginProtocolPolicy": "https-only", 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
+                            distributions (it should be set as https-only):&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
+                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+  &lt;div style=""&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; }, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     ] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the security group id from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt; 
+    &lt;div&gt;
+      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
+                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
+                        through the use of a unique random session key, and therefore prevents the decoding of captured
+                        data, even if the secret long-term key is compromised.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
+                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
+                            Cryptography (ECDHE) cipher suites.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-21T19:11:31.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.13" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.17" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.19" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.21" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.22" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.1" mitigation="8"/>
+                    <countermeasure ref="aws-tier-3.14" mitigation="8"/>
+                    <countermeasure ref="aws-tier-3.15" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.18" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.26" mitigation="8"/>
+                    <countermeasure ref="aws-tier-6.5" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-9" mitigation="4"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                <countermeasure ref="C-AWS-SRA-9" mitigation="4"/>
+                <countermeasure ref="aws-tier-3.1" mitigation="8"/>
+                <countermeasure ref="aws-tier-3.14" mitigation="8"/>
+                <countermeasure ref="aws-tier-3.15" mitigation="8"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.13" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.17" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.18" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.19" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.21" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.22" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.26" mitigation="8"/>
+                <countermeasure ref="aws-tier-6.5" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="unknown-resource-status">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/aws-siem-and-cloudwatch.xml b/Templates/Submitted_Templates/aws-siem-and-cloudwatch.xml
new file mode 100644
index 0000000..d48d86d
--- /dev/null
+++ b/Templates/Submitted_Templates/aws-siem-and-cloudwatch.xml
@@ -0,0 +1,17267 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="AWS - SIEM and CloudWatch" name="AWS - SIEM and CloudWatch" tags="Community">
+  <desc>&lt;p&gt;Hosted Application with SIEM/CloudWatch&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIwIiBpckRyYXdpb1ZlcnNpb249IjMuMC4zLVNOQVBTSE9UIj48cm9vdD48bXhDZWxsIGlkPSIwIi8+PG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+PG14Q2VsbCBpZD0iMyIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMTA3MS4wIiB5PSItNC4wIiB3aWR0aD0iMTc5LjAiIGhlaWdodD0iMTc2LjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MDE0YmFkYWMtMzc0Zi00ZDg5LThjMjctNDI1MzBlY2Q5NDdlOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjQ2Ljc1IiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNzQyLjAiIHk9Ii0yNC4wIiB3aWR0aD0iNTE1LjAiIGhlaWdodD0iNTE2LjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCAtPiBPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1jMDEzMDE0OS01YzMxLTQxNjUtYjZlMi0yMmNjNTgzMzliZGQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkVsYXN0aWNzZWFyY2ggLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1lMTM1MWJlZS0yN2QyLTQ2YzctYmI4OS02ZjI5MmZhZjM5Zjg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCIgc3R5bGU9ImlyLnJlZj05OTUyMjA0ZS03ZTJjLTQ0MGMtOTUwNS01NGMxYzFmNTVlODE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWxhc3RpY3NlYXJjaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1EQXdPREVnTUM0ek5qTXlPREZJTUM0eE9EQXdPREZETUM0eE56WTFORFVnTUM0ek5qTXlPREVnTUM0eE56TXhOVFFnTUM0ek5qUTJPRFlnTUM0eE56QTJOVE1nTUM0ek5qY3hPRFpETUM0eE5qZ3hOVE1nTUM0ek5qazJPRGNnTUM0eE5qWTNORGdnTUM0ek56TXdOemdnTUM0eE5qWTNORGdnTUM0ek56WTJNVFZXTUM0NE1ETXlPREZETUM0eE5qWTNORGdnTUM0NE1EWTRNVGNnTUM0eE5qZ3hOVE1nTUM0NE1UQXlNRGtnTUM0eE56QTJOVE1nTUM0NE1USTNNRGxETUM0eE56TXhOVFFnTUM0NE1UVXlNU0F3TGpFM05qVTBOU0F3TGpneE5qWXhOQ0F3TGpFNE1EQTRNU0F3TGpneE5qWXhORWd3TGpNd01EQTRNVU13TGpNd016WXhPQ0F3TGpneE5qWXhOQ0F3TGpNd056QXdPU0F3TGpneE5USXhJREF1TXpBNU5UQTVJREF1T0RFeU56QTVRekF1TXpFeU1ERWdNQzQ0TVRBeU1Ea2dNQzR6TVRNME1UVWdNQzQ0TURZNE1UY2dNQzR6TVRNME1UVWdNQzQ0TURNeU9ERldNQzR6TnpZMk1UVkRNQzR6TVRNME1UVWdNQzR6TnpNd056Z2dNQzR6TVRJd01TQXdMak0yT1RZNE55QXdMak13T1RVd09TQXdMak0yTnpFNE5rTXdMak13TnpBd09TQXdMak0yTkRZNE5pQXdMak13TXpZeE9DQXdMak0yTXpJNE1TQXdMak13TURBNE1TQXdMak0yTXpJNE1WcE5NQzR5T0RZM05EZ2dNQzQzT0RrNU5EaElNQzR4T1RNME1UVldNQzR6T0RrNU5EaElNQzR5T0RZM05EaFdNQzQzT0RrNU5EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU9EQXpNelkyUXpBdU5EZzJOelUxSURBdU9EQTJPVEF6SURBdU5EZzFNelVnTUM0NE1UQXlPVFFnTUM0ME9ESTRORGtnTUM0NE1USTNPVFJETUM0ME9EQXpORGtnTUM0NE1UVXlPVFVnTUM0ME56WTVOVGNnTUM0NE1UWTNJREF1TkRjek5ESXhJREF1T0RFMk4wZ3dMak0xTXpReU1VTXdMak0wT1RnNE5TQXdMamd4TmpjZ01DNHpORFkwT1RRZ01DNDRNVFV5T1RVZ01DNHpORE01T1RNZ01DNDRNVEkzT1RSRE1DNHpOREUwT1RNZ01DNDRNVEF5T1RRZ01DNHpOREF3T0RnZ01DNDRNRFk1TURNZ01DNHpOREF3T0RnZ01DNDRNRE16TmpaV01DNDFOek16TmpSRE1DNHpORFEwTWpNZ01DNDFPVGd4TkRVZ01DNHpOVE0wTnpZZ01DNDJNakU0TmpRZ01DNHpOalkzTlRVZ01DNDJORE15TXpKV01DNDNPRGs1U0RBdU5EWXdNRGc0VmpBdU56SXdNRE15UXpBdU5EWTROek14SURBdU56SXpOams0SURBdU5EYzNOalEzSURBdU56STJOamcxSURBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU56STRPVFkyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE0TmpjMU5TQXdMakk1TmpZMU9WWXdMak0wTXpnMU9VTXdMalEzTnpZek1pQXdMak0wTmpNeE1pQXdMalEyT0RjeE5pQXdMak0wT1RRM055QXdMalEyTURBNE9DQXdMak0xTXpNeU5WWXdMak13T1RrNU1rZ3dMak0yTmpjMU5WWXdMalF5T1RrNU1rTXdMak0xTXpRM05pQXdMalExTVRNMU9TQXdMak0wTkRReU15QXdMalEzTlRBM09DQXdMak0wTURBNE9DQXdMalE1T1RnMU9WWXdMakk1TmpZMU9VTXdMak0wTURBNE9DQXdMakk1TXpFeU1pQXdMak0wTVRRNU15QXdMakk0T1Rjek1TQXdMak0wTXprNU15QXdMakk0TnpJelF6QXVNelEyTkRrMElEQXVNamcwTnpNZ01DNHpORGs0T0RVZ01DNHlPRE16TWpVZ01DNHpOVE0wTWpFZ01DNHlPRE16TWpWSU1DNDBOek0wTWpGRE1DNDBOelk1TlRjZ01DNHlPRE16TWpVZ01DNDBPREF6TkRrZ01DNHlPRFEzTXlBd0xqUTRNamcwT1NBd0xqSTROekl6UXpBdU5EZzFNelVnTUM0eU9EazNNekVnTUM0ME9EWTNOVFVnTUM0eU9UTXhNaklnTUM0ME9EWTNOVFVnTUM0eU9UWTJOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TkRJNElEQXVOek01TlRkV01DNDNPRGs1TjBnd0xqVTBNREE1TkZZd0xqY3pOall6TjBNd0xqVXpNVEUzTmlBd0xqY3pOalkyTmlBd0xqVXlNakkyTnlBd0xqY3pOakE0TnlBd0xqVXhNelF5T0NBd0xqY3pORGt3TTFZd0xqZ3dNek13TTBNd0xqVXhNelF5T0NBd0xqZ3dOamcwSURBdU5URTBPRE15SURBdU9ERXdNak14SURBdU5URTNNek16SURBdU9ERXlOek15UXpBdU5URTVPRE16SURBdU9ERTFNak15SURBdU5USXpNakkxSURBdU9ERTJOak0zSURBdU5USTJOell4SURBdU9ERTJOak0zU0RBdU5qUTJOell4UXpBdU5qVXdNamszSURBdU9ERTJOak0zSURBdU5qVXpOamc1SURBdU9ERTFNak15SURBdU5qVTJNVGc1SURBdU9ERXlOek15UXpBdU5qVTROamtnTUM0NE1UQXlNekVnTUM0Mk5qQXdPVFFnTUM0NE1EWTROQ0F3TGpZMk1EQTVOQ0F3TGpnd016TXdNMVl3TGpjMk5qSXpOMHd3TGpZek16UXlPQ0F3TGpjek9UVTNXazB3TGpZME5qYzJNU0F3TGpFM05qWXpOa2d3TGpVeU5qYzJNVU13TGpVeU16SXlOU0F3TGpFM05qWXpOaUF3TGpVeE9UZ3pNeUF3TGpFM09EQTBNU0F3TGpVeE56TXpNeUF3TGpFNE1EVTBNVU13TGpVeE5EZ3pNaUF3TGpFNE16QTBNU0F3TGpVeE16UXlPQ0F3TGpFNE5qUXpNeUF3TGpVeE16UXlPQ0F3TGpFNE9UazJPVll3TGpNek9ETTJPVU13TGpVeU1qSTJOaUF3TGpNek56RTNOQ0F3TGpVek1URTNOaUF3TGpNek5qVTVOU0F3TGpVME1EQTVOQ0F3TGpNek5qWXpObFl3TGpNek5qWXpObFl3TGpJd016TXdNa2d3TGpZek16UXlPRll3TGpNMU9UazJPVU13TGpZME1qYzNJREF1TXpZME9URTNJREF1TmpVeE5qZzVJREF1TXpjd05qSTFJREF1TmpZd01EazBJREF1TXpjM01ETTJWakF1TVRrd016WTVRekF1TmpZd01UUTRJREF1TVRnNE5UZzFJREF1TmpVNU9EUXpJREF1TVRnMk9EQTRJREF1TmpVNU1UazNJREF1TVRnMU1UUTBRekF1TmpVNE5UVXhJREF1TVRnek5EZ2dNQzQyTlRjMU56Y2dNQzR4T0RFNU5qSWdNQzQyTlRZek16TWdNQzR4T0RBMk9ERkRNQzQyTlRVd09TQXdMakUzT1RRd01TQXdMalkxTXpZd01pQXdMakUzT0RNNE1pQXdMalkxTVRrMU9DQXdMakUzTnpZNE9FTXdMalkxTURNeE15QXdMakUzTmprNU15QXdMalkwT0RVME5pQXdMakUzTmpZek5TQXdMalkwTmpjMk1TQXdMakUzTmpZek5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qQXhNREVnTUM0eU5ETXlPRFpJTUM0M01EQXhNREZETUM0Mk9UWTFOalVnTUM0eU5ETXlPRFlnTUM0Mk9UTXhOek1nTUM0eU5EUTJPVEVnTUM0Mk9UQTJOek1nTUM0eU5EY3hPVEZETUM0Mk9EZ3hOeklnTUM0eU5EazJPVElnTUM0Mk9EWTNOamdnTUM0eU5UTXdPRE1nTUM0Mk9EWTNOamdnTUM0eU5UWTJNVGxXTUM0ME1ERXhOVEpETUM0Mk9UY3dORGdnTUM0ME1USXlOVEVnTUM0M01EVTVPVGNnTUM0ME1qUTFNVElnTUM0M01UTTBNelFnTUM0ME16YzJPRFpXTUM0eU5qazVOVE5JTUM0NE1EWTNOamhXTUM0Mk56azVOVEpNTUM0NE16TTBNelFnTUM0M01EWTJNVGhXTUM0eU5UWTJNVGxETUM0NE16TTBNelFnTUM0eU5UTXdPRE1nTUM0NE16SXdNamtnTUM0eU5EazJPVElnTUM0NE1qazFNamtnTUM0eU5EY3hPVEZETUM0NE1qY3dNamdnTUM0eU5EUTJPVEVnTUM0NE1qTTJNemNnTUM0eU5ETXlPRFlnTUM0NE1qQXhNREVnTUM0eU5ETXlPRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREUzTURjMElEQXVOekk0TmpnelREQXVOamszTURjMElEQXVOakE0TmpnelF6QXVOekUwTWpFeElEQXVOVGN4TXpVZ01DNDNNVGMxTXpJZ01DNDFNamt4TkRRZ01DNDNNRFkwTkRZZ01DNDBPRGsxT1RGRE1DNDJPVFV6TlRrZ01DNDBOVEF3TXpjZ01DNDJOekExT0RZZ01DNDBNVFUzTURZZ01DNDJNelkxTkRJZ01DNHpPVEkzTVRsRE1DNDJNREkwT1RnZ01DNHpOamszTXpFZ01DNDFOakV6T1RZZ01DNHpOVGsxT0RJZ01DNDFNakExTmpVZ01DNHpOalF3T0VNd0xqUTNPVGN6TkNBd0xqTTJPRFUzTnlBd0xqUTBNVGd5T0NBd0xqTTROelF6SURBdU5ERXpOakEwSURBdU5ERTNNamMzUXpBdU16ZzFNemdnTUM0ME5EY3hNak1nTUM0ek5qZzJOek1nTUM0ME9EWXdNalFnTUM0ek5qWTBOaklnTUM0MU1qY3dOREpETUM0ek5qUXlOVElnTUM0MU5qZ3dOakVnTUM0ek56WTJPQ0F3TGpZd09EVXpNU0F3TGpRd01UVXpNeUF3TGpZME1USXpPVU13TGpReU5qTTROU0F3TGpZM016azBOaUF3TGpRMk1qQTBOaUF3TGpZNU5qYzJOQ0F3TGpVd01qRTFOeUF3TGpjd05UWXlORU13TGpVME1qSTJPQ0F3TGpjeE5EUTROQ0F3TGpVNE5ESXlNeUF3TGpjd09EZ3hNU0F3TGpZeU1EVTBJREF1TmpnNU5qRTJUREF1TnpNNE5UUWdNQzQ0TURjME9ETkRNQzQzTkRnNU16Y2dNQzQ0TVRjNE9UY2dNQzQzTmpNd05EUWdNQzQ0TWpNM05UVWdNQzQzTnpjM05pQXdMamd5TXpjMk4wTXdMamM1TWpRM05TQXdMamd5TXpjNElEQXVPREEyTlRreklEQXVPREUzT1RRMklEQXVPREUzTURBM0lEQXVPREEzTlRRNVF6QXVPREkzTkRJeElEQXVOemszTVRVeklEQXVPRE16TWpjNUlEQXVOemd6TURRMUlEQXVPRE16TWpreElEQXVOelk0TXpORE1DNDRNek16TURRZ01DNDNOVE0yTVRVZ01DNDRNamMwTnlBd0xqY3pPVFE1TnlBd0xqZ3hOekEzTkNBd0xqY3lPVEE0TTFZd0xqY3lPRFk0TTFwTk1DNHpPVE15TURjZ01DNDFNelkwTVRaRE1DNHpPVE15TURjZ01DNDFNRGMwTURnZ01DNDBNREU0TURrZ01DNDBOemt3TlRJZ01DNDBNVGM1TWpVZ01DNDBOVFE1TXpKRE1DNDBNelF3TkRFZ01DNDBNekE0TVRNZ01DNDBOVFk1TkRjZ01DNDBNVEl3TVRVZ01DNDBPRE0zTkRjZ01DNDBNREE1TVRSRE1DNDFNVEExTkRZZ01DNHpPRGs0TVRNZ01DNDFOREF3TXpZZ01DNHpPRFk1TURnZ01DNDFOamcwT0RjZ01DNHpPVEkxTmpoRE1DNDFPVFk1TXpjZ01DNHpPVGd5TWpjZ01DNDJNak13TnpFZ01DNDBNVEl4T1RVZ01DNDJORE0xT0RNZ01DNDBNekkzTURkRE1DNDJOalF3T1RRZ01DNDBOVE15TVRrZ01DNDJOemd3TmpNZ01DNDBOemt6TlRJZ01DNDJPRE0zTWpJZ01DNDFNRGM0TURORE1DNDJPRGt6T0RFZ01DNDFNell5TlRNZ01DNDJPRFkwTnpjZ01DNDFOalUzTkRNZ01DNDJOelV6TnpZZ01DNDFPVEkxTkRORE1DNDJOalF5TnpVZ01DNDJNVGt6TkRNZ01DNDJORFUwTnpZZ01DNDJOREl5TkRrZ01DNDJNakV6TlRjZ01DNDJOVGd6TmpWRE1DNDFPVGN5TXpnZ01DNDJOelEwT0RFZ01DNDFOamc0T0RFZ01DNDJPRE13T0RNZ01DNDFNems0TnpRZ01DNDJPRE13T0RORE1DNDFNREE1TnpVZ01DNDJPRE13T0RNZ01DNDBOak0yTnlBd0xqWTJOell6SURBdU5ETTJNVFkxSURBdU5qUXdNVEkxUXpBdU5EQTROalU1SURBdU5qRXlOaklnTUM0ek9UTXlNRGNnTUM0MU56VXpNVFFnTUM0ek9UTXlNRGNnTUM0MU16WTBNVFphVFRBdU56azRNVFFnTUM0M09EZ3lPRE5ETUM0M09USTNNVGtnTUM0M09UTTJOek1nTUM0M09EVXpPRFVnTUM0M09UWTJPVGdnTUM0M056YzNOQ0F3TGpjNU5qWTVPRU13TGpjM01EQTVOU0F3TGpjNU5qWTVPQ0F3TGpjMk1qYzJNU0F3TGpjNU16WTNNeUF3TGpjMU56TTBJREF1TnpnNE1qZ3pUREF1TmpRek56UWdNQzQyTnpRMk9ETkRNQzQyTlRrek1qVWdNQzQyTmpJNU1Ea2dNQzQyTnpJNE5ETWdNQzQyTkRnMk1qVWdNQzQyT0RNM05DQXdMall6TWpReE5rd3dMamM1T0RRd055QXdMamMwTnpZeE5rTXdMamd3TXpjMU15QXdMamMxTXpBMUlEQXVPREEyTnpJNElEQXVOell3TXpneUlEQXVPREEyTmpjNElEQXVOelk0TURBMVF6QXVPREEyTmpJNElEQXVOemMxTmpJM0lEQXVPREF6TlRVNElEQXVOemd5T1RJZ01DNDNPVGd4TkNBd0xqYzRPREk0TTFZd0xqYzRPREk0TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RBNE16a2dNQzQxT1RrNU1EZERNQzQwTnpFMU5ESWdNQzQxT1RNeU5UVWdNQzQwTmpNMk5qSWdNQzQxT0RRNE1pQXdMalExTnpZMU9DQXdMalUzTlRBNU1rTXdMalExTVRZMU5TQXdMalUyTlRNMk5DQXdMalEwTnpZME9DQXdMalUxTkRVek9DQXdMalEwTlRnM01TQXdMalUwTXpJME5rTXdMalEwTkRBNU5DQXdMalV6TVRrMU5DQXdMalEwTkRVNE15QXdMalV5TURReU1TQXdMalEwTnpNd09TQXdMalV3T1RNeE9VTXdMalExTURBek5TQXdMalE1T0RJeE9DQXdMalExTkRrME15QXdMalE0TnpjM0lEQXVORFl4TnpRNElEQXVORGM0TlRnMVF6QXVORFk0TlRVeklEQXVORFk1TkNBd0xqUTNOekV4T0NBd0xqUTJNVFkyTVNBd0xqUTROamswTkNBd0xqUTFOVGd5UXpBdU5EazJOemN4SURBdU5EUTVPVGM0SURBdU5UQTNOall4SURBdU5EUTJNVFV5SURBdU5URTRPVGd5SURBdU5EUTBOVFl5UXpBdU5UTXdNekF5SURBdU5EUXlPVGN6SURBdU5UUXhPREkySURBdU5EUXpOalV6SURBdU5UVXlPRGd4SURBdU5EUTJOVFl5UXpBdU5UWXpPVE0xSURBdU5EUTVORGN5SURBdU5UYzBNekF4SURBdU5EVTBOVFV6SURBdU5UZ3pNemN5SURBdU5EWXhOVEE1VERBdU5UWTNOVEExSURBdU5EZ3lPVGMxUXpBdU5UWXhNakk0SURBdU5EYzRNekkzSURBdU5UVTBNRGszSURBdU5EYzBPVFlnTUM0MU5EWTFNVGdnTUM0ME56TXdOamRETUM0MU16ZzVOQ0F3TGpRM01URTNOQ0F3TGpVek1UQTJNeUF3TGpRM01EYzVNeUF3TGpVeU16TXpOeUF3TGpRM01UazBORU13TGpVeE5UWXhNU0F3TGpRM016QTVOaUF3TGpVd09ERTRPQ0F3TGpRM05UYzFOeUF3TGpVd01UUTVNU0F3TGpRM09UYzNPRU13TGpRNU5EYzVOQ0F3TGpRNE16YzVPQ0F3TGpRNE9EazFOQ0F3TGpRNE9UQTVPQ0F3TGpRNE5ETXdOU0F3TGpRNU5UTTNOVU13TGpRM09UWTFOaUF3TGpVd01UWTFNaUF3TGpRM05qSTVJREF1TlRBNE56Z3pJREF1TkRjME16azNJREF1TlRFMk16WXlRekF1TkRjeU5UQTBJREF1TlRJek9UUWdNQzQwTnpJeE1qSWdNQzQxTXpFNE1UY2dNQzQwTnpNeU56UWdNQzQxTXprMU5ETkRNQzQwTnpRME1qVWdNQzQxTkRjeU5qZ2dNQzQwTnpjd09EY2dNQzQxTlRRMk9USWdNQzQwT0RFeE1EZ2dNQzQxTmpFek9EbERNQzQwT0RVeE1qZ2dNQzQxTmpnd09EWWdNQzQwT1RBME1qZ2dNQzQxTnpNNU1qVWdNQzQwT1RZM01EVWdNQzQxTnpnMU56Uk1NQzQwT0RBNE16a2dNQzQxT1RrNU1EZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjeUlpQjVNajBpTFRBdU1qQTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTEuMCIgeT0iMjUxLjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIC0+IEVsYXN0aWNzZWFyY2giIHN0eWxlPSJpci5yZWY9ZDJiMDBiZDAtMzczMi00MGYyLTg5NDgtMmJkNjA5M2ZjNmRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNyIgc291cmNlPSIxMCIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjQiIHZhbHVlPSJFQzIgLSBFbGFzdGljIENvbXB1dGUgQ2xvdWQgLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj00NTZlZjNiNC1kODc0LTRiZTktOTNkMS01NzdiM2RmMjI0YzA7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjEwIiB0YXJnZXQ9IjIzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjEiIHZhbHVlPSJPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1kMDc3ZjJjZS04ZjUxLTRlZWQtYjllOC0yOWMzM2MxYzkwMWU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9czM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNQzQ1T1RrNU9UVklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTVNRFV4SURBdU5UTTBNVGc0UXpBdU9ERTFNVGcwSURBdU5URXpNalUxSURBdU56a3hORFV4SURBdU5EazRORFUxSURBdU56YzFNVGcwSURBdU5EZzNPVEl5UXpBdU56WTVPVGcwSURBdU5EZzBOVGc1SURBdU56VTFOekU0SURBdU5EYzVNalUxSURBdU56VTBOVEU0SURBdU5EYzBOVGc1UXpBdU56VTBORE0ySURBdU5EY3hNalVnTUM0M05UUTRPRFlnTUM0ME5qYzVNVGtnTUM0M05UVTROVEVnTUM0ME5qUTNNakpNTUM0M05qa3hPRFFnTUM0ek5qZzROVFpETUM0M056TXdOVEVnTUM0ek5EQTNNaklnTUM0M056WTNPRFFnTUM0ek1USTFPRGtnTUM0M09EQTJOVEVnTUM0eU9EUTBOVFpETUM0M09EUXhNVGdnTUM0eU5UZzFPRGtnTUM0M056RTNNVGdnTUM0eU5ERXlOVFlnTUM0M05UQTJOVEVnTUM0eU1qWTNNak5ETUM0M01EYzNNVGdnTUM0eE9UWTVPRGtnTUM0Mk5URTNNVGdnTUM0eE9EUTVPU0F3TGpZd01URTROQ0F3TGpFM05qY3lNME13TGpVek56Z3hNU0F3TGpFMk5qTTNOaUF3TGpRM016TTJOU0F3TGpFMk5ESTNJREF1TkRBNU5EVXhJREF1TVRjd05EVTJRekF1TXpVeE9UWTJJREF1TVRjME5qYzBJREF1TWprMU5UUTJJREF1TVRnNE1UZ3pJREF1TWpReU16ZzBJREF1TWpFd05EVTJRekF1TWpFek9EVXhJREF1TWpJek56ZzVJREF1TVRjMk5URTRJREF1TWpRME5UZzVJREF1TVRneE1UZzBJREF1TWpnd09UZzVRekF1TVRrME5URTRJREF1TXpnNU1qVTJJREF1TWpFd01qVXhJREF1TkRrM01qVTFJREF1TWpJME56ZzBJREF1TmpBMU16ZzRRekF1TWpNeE5EVXhJREF1TmpVME9EVTFJREF1TWpNNE1URTRJREF1TnpBME16SXhJREF1TWpRME56ZzBJREF1TnpVek56ZzRRekF1TWpRMU9EWWdNQzQzTmpNME1pQXdMakkwT1RRMklEQXVOemN5TlRrNElEQXVNalUxTWpFNUlEQXVOemd3TXprMFF6QXVNall3T1RjNElEQXVOemc0TVRrZ01DNHlOamcyT1RNZ01DNDNPVFF6TWpnZ01DNHlOemMxT0RRZ01DNDNPVGd4T0RoRE1DNHpNVGc1TVRnZ01DNDRNakExT0RnZ01DNHpOekF4TVRnZ01DNDRNalk1T0RnZ01DNDBNVFl5TlRFZ01DNDRNekV5TlRSRE1DNDBOemMxT0RNZ01DNDRNelkzT1RRZ01DNDFNemt6T0RJZ01DNDRNelF3TlRnZ01DNDFPVGs1T0RRZ01DNDRNak14TWpGRE1DNDJNemd6T0RRZ01DNDRNVFl3TlRRZ01DNDNNRGs0TlRFZ01DNDRNRFEwTlRRZ01DNDNNVFU1T0RRZ01DNDNOVFkwTlRSRE1DNDNNak0xT0RRZ01DNDJPVFk1T0RnZ01DNDNNekU1T0RRZ01DNDJNemMxTWpFZ01DNDNNems1T0RRZ01DNDFOemd4T0RoTU1DNDNOREk1TVRnZ01DNDFOakF3TlRWRE1DNDNOalEyTlRFZ01DNDFOalV5TlRVZ01DNDRNalkyTlRFZ01DNDFOell6TWpJZ01DNDRNVGt3TlRFZ01DNDFNelF4T0RoYVRUQXVORGd3TmpVeElEQXVNVGt6TXpnNVF6QXVOVFl3TmpVeElEQXVNVGt6TXpnNUlEQXVOalV5TWpVeElEQXVNakF5TkRVMklEQXVOekl6T1RnMElEQXVNalF4T1RJelF6QXVOek0xTURVeElEQXVNalE0TURVMklEQXVOell3TnpnMElEQXVNall4TnpnNUlEQXVOelV6TURVeElEQXVNamM0TURVMlF6QXVOelExTXpFNElEQXVNamswTXpJeklEQXVOekl4TXpFNElEQXVNekF5TkRVMklEQXVOekEyTmpVeElEQXVNekE0TXpJeVF6QXVOamcxTnpBNElEQXVNekUyTURVNUlEQXVOalkwTVRjZ01DNHpNakl3TnpnZ01DNDJOREl5TlRFZ01DNHpNall6TWpKRE1DNDFORGN3TnpRZ01DNHpORFV4TnpZZ01DNDBORGt6TWprZ01DNHpORGN5TURjZ01DNHpOVE0wTlRFZ01DNHpNekl6TWpKRE1DNHpNVEF4TlRnZ01DNHpNamM0TlRnZ01DNHlOamd3TkRRZ01DNHpNVFUxTWpJZ01DNHlNamt4T0RRZ01DNHlPVFU1TWpORE1DNHlNVGsxT0RRZ01DNHlPVEEwTlRZZ01DNHlNRE0zTVRnZ01DNHlPREExT0RrZ01DNHlNRGd4TVRnZ01DNHlOamMxTWpORE1DNHlNVEUyTURNZ01DNHlOakExTURJZ01DNHlNVGN3TnpRZ01DNHlOVFEyTmlBd0xqSXlNemcxTVNBd0xqSTFNRGN5TTBNd0xqSTFNekV6TnlBd0xqSXpNVGc0T1NBd0xqSTROVGN3TXlBd0xqSXhPRGN5TnlBd0xqTXhPVGcxTVNBd0xqSXhNVGt5TTBNd0xqTTNNalV3TnlBd0xqRTVPVEk0TWlBd0xqUXlOalVnTUM0eE9UTXdOVGtnTUM0ME9EQTJOVEVnTUM0eE9UTXpPRGxXTUM0eE9UTXpPRGxhVFRBdU5qZzVOekU0SURBdU56VTFNemc0UXpBdU5qZzNOekU0SURBdU56Y3dPVGc0SURBdU5qWXhPVGcwSURBdU56YzROekl4SURBdU5qUTVOekU0SURBdU56Z3pNVEl4UXpBdU5qSTBNalV4SURBdU56a3hOalFnTUM0MU9UYzVPRElnTUM0M09UYzFNemNnTUM0MU56RXpNVGdnTUM0NE1EQTNNakZETUM0MU1USXhOVFlnTUM0NE1EZzFPRGNnTUM0ME5USXlNVE1nTUM0NE1EZzFPRGNnTUM0ek9UTXdOVEVnTUM0NE1EQTNNakZETUM0ek5UVTVPVFlnTUM0M09UYzRORFlnTUM0ek1UazRNVElnTUM0M09EZ3dNekVnTUM0eU9EWXpPRFFnTUM0M056RTNPRGhETUM0eU9ERTRNellnTUM0M05qazRNVEVnTUM0eU56YzVNeUF3TGpjMk5qWXdOU0F3TGpJM05URXdNeUF3TGpjMk1qVXpRekF1TWpjeU1qYzNJREF1TnpVNE5EVTJJREF1TWpjd05qUXpJREF1TnpVek5qY3pJREF1TWpjd016ZzBJREF1TnpRNE56SXhRekF1TWpVM01EVXhJREF1TmpReU9UZzRJREF1TWpReE9EVXhJREF1TlRNM01qVTFJREF1TWpJM05UZzBJREF1TkRNeE5USXlUREF1TWpFeU1URTRJREF1TXpFMk9EVTJRekF1TWpReU5ESTVJREF1TXpNek5UZzNJREF1TWpjMU16STVJREF1TXpRMU1USTBJREF1TXpBNU5EVXhJREF1TXpVd09UZzVRekF1TXpRMU9UazRJREF1TXpVNE5ESTNJREF1TXpnek1ESXlJREF1TXpZek1qZ3pJREF1TkRJd01qVXhJREF1TXpZMU5USXlRekF1TkRrek16RTFJREF1TXpjd056VTRJREF1TlRZMk56UTVJREF1TXpZMk5qZ3hJREF1TmpNNE56ZzBJREF1TXpVek16ZzVRekF1TmpjM01UWTNJREF1TXpRM09EWTRJREF1TnpFME1qUTJJREF1TXpNMU5EazBJREF1TnpRNE1qVXhJREF1TXpFMk9EVTJUREF1TnpFNU9UZzBJREF1TlRJMk1UZzRRekF1TmpVeU5ERTRJREF1TlRBek9USTRJREF1TlRnMk5EQTJJREF1TkRjM01qQXpJREF1TlRJeU16ZzBJREF1TkRRMk1UZzVRekF1TlRFNU5UYzFJREF1TkRRMU1URTNJREF1TlRFMk9EVTJJREF1TkRRek9ESTBJREF1TlRFME1qVXhJREF1TkRReU16SXlRekF1TlRFd05qVXhJREF1TkRNNU5qVTFJREF1TlRFeE5UZzBJREF1TkRRd09UZzVJREF1TlRBNU9EVXhJREF1TkRNMk9EVTFRekF1TlRBMk5URTRJREF1TkRJNU1qVTFJREF1TlRBMU56RTRJREF1TkRJek5USXlJREF1TkRrNE5qVXhJREF1TkRFM01qVTFRekF1TkRrME9ETTJJREF1TkRFME1pQXdMalE1TURNek1pQXdMalF4TWpFeU15QXdMalE0TlRVek1TQXdMalF4TVRJd05VTXdMalE0TURjeklEQXVOREV3TWpnM0lEQXVORGMxTnpjNElEQXVOREV3TlRVMklEQXVORGN4TVRBMUlEQXVOREV4T1RnNFF6QXVORFkyTkRNeElEQXVOREV6TkRJeElEQXVORFl5TVRjNUlEQXVOREUxT1RjMElEQXVORFU0TnpFM0lEQXVOREU1TkRJMFF6QXVORFUxTWpVMklEQXVOREl5T0RjMUlEQXVORFV5TmprZ01DNDBNamN4TVRrZ01DNDBOVEV5TkRJZ01DNDBNekUzT0RoRE1DNDBORGszT1RVZ01DNDBNelkwTlRjZ01DNDBORGsxTVNBd0xqUTBNVFF3T0NBd0xqUTFNRFF4TXlBd0xqUTBOakl4TWtNd0xqUTFNVE14TmlBd0xqUTFNVEF4TmlBd0xqUTFNek0zT1NBd0xqUTFOVFV5TmlBd0xqUTFOalF5TWlBd0xqUTFPVE0xTVVNd0xqUTFPVFEyTmlBd0xqUTJNekUzTlNBd0xqUTJNek01T0NBd0xqUTJOakU1T1NBd0xqUTJOemczTmlBd0xqUTJPREUxTjBNd0xqUTNNak0xTkNBd0xqUTNNREV4TmlBd0xqUTNOekkwTXlBd0xqUTNNRGsxSURBdU5EZ3lNVEU0SURBdU5EY3dOVGc1UXpBdU5EZzJOekUwSURBdU5EWTVPREkySURBdU5Ea3hNVGswSURBdU5EWTRORGd5SURBdU5EazFORFV4SURBdU5EWTJOVGc1UXpBdU5UQXdOalV4SURBdU5EWTBPVGc1SURBdU5UQXdOalV4SURBdU5EWTFNalUxSURBdU5UQTJNVEU0SURBdU5EWTNOemc1UXpBdU5UY3dPVFl5SURBdU5EazVOREE0SURBdU5qTTNOelkySURBdU5USTJPRFF5SURBdU56QTJNVEU0SURBdU5UUTVPVEl5UXpBdU56RTJNemcwSURBdU5UVXpNalUxSURBdU56RTJNalV4SURBdU5UUTVPVEl5SURBdU56RTJNalV4SURBdU5UVTRORFUxUXpBdU56RTFPREU0SURBdU5UWTBPVFEzSURBdU56RTBPVGN5SURBdU5UY3hOREEwSURBdU56RXpOekU0SURBdU5UYzNOemc0VERBdU56QTFNVGcwSURBdU5qUXhNemc0VERBdU5qZzVOekU0SURBdU56VTFNemc0V2swd0xqUTRNems0TkNBd0xqUTBNREExTlVNd0xqUTRNems0TkNBd0xqUTBNelkxTlNBd0xqUTNPRGt4T0NBd0xqUTBNekkxTlNBd0xqUTNOelU0TkNBd0xqUTBNRGs0T1VNd0xqUTNOakkxTVNBd0xqUXpPRGN5TWlBd0xqUTRNems0TkNBd0xqUXpORGs0T1NBd0xqUTRNems0TkNBd0xqUTBNREExTlZwTk1DNDNORFkyTlRFZ01DNDFNek16T0RoTU1DNDNOVEEyTlRFZ01DNDFNRE01TWpKRE1DNDNOak01T0RRZ01DNDFNVEUxTWpJZ01DNDNPRFkyTlRFZ01DNDFNakk1T0RnZ01DNDNPVEkyTlRFZ01DNDFNemd4T0RoRE1DNDNOemsxT0RRZ01DNDFORE0xTWpJZ01DNDNOVGc1TVRnZ01DNDFNelkwTlRVZ01DNDNORFkyTlRFZ01DNDFNek16T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTJJaUI0TWowaU1TNHlNRGN3TmlJZ2VUSTlJaTB3TGpJd056QTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpGQ05qWXdSaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTmtOQlJUTkZJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXdMams1T1RrNU5TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMTkuMCIgeT0iMjUxLjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIzIiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj04NjcwMTY2ZS1kYzM2LTRmNTItYmVhNi00NTQ1ZTk5OTJjODg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMTkuMCIgeT0iNjUuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBdXRvc2NhbGluZyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iMTAiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMS4zIiB5PSIwLjQ1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNzAuMCIgeT0iLTM4LjAiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJBUEkgLSBJL08gLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPTI0MDkwY2IxLTBjYjYtNDU1ZC05ZDE3LTNjMTFiYTcwODQ4NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iOSIgdGFyZ2V0PSIxMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkiIHZhbHVlPSJBUEkgLSBJL08iIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZETUM0Mk5ETTVORE1nTUM0NE1qQXdPREVnTUM0Mk5ERXhPRGdnTUM0NE1Ua3hPVFFnTUM0Mk16ZzVNREVnTUM0NE1UYzFNemRETUM0Mk16Y3hOemdnTUM0NE1UWXpNU0F3TGpZek5UYzNNU0F3TGpneE5EWTVNU0F3TGpZek5EYzVOeUF3TGpneE1qZ3hNME13TGpZek16Z3lOQ0F3TGpneE1Ea3pOU0F3TGpZek16TXhNU0F3TGpnd09EZzFNeUF3TGpZek16TXdNU0F3TGpnd05qY3pOMVl3TGpFNU16UXdORU13TGpZek16TXhJREF1TVRreE1USTFJREF1TmpNek9UQTBJREF1TVRnNE9EZzNJREF1TmpNMU1ESTBJREF1TVRnMk9UQXpRekF1TmpNMk1UUTBJREF1TVRnME9URTVJREF1TmpNM056VTFJREF1TVRnek1qVTFJREF1TmpNNU56QXhJREF1TVRneU1EY3hRekF1TmpReE5qWTVJREF1TVRnd056azNJREF1TmpRek9UTTNJREF1TVRnd01EWTFJREF1TmpRMk1qYzRJREF1TVRjNU9UUTRRekF1TmpRNE5qRTVJREF1TVRjNU9ETXhJREF1TmpVd09UUTVJREF1TVRnd016TXpJREF1TmpVek1ETTBJREF1TVRneE5EQTBUREF1T0RJMk16WTNJREF1TWpZMk1EY3hRekF1T0RJNE5Ua3hJREF1TWpZM01UWWdNQzQ0TXpBME5qZ2dNQzR5TmpnNE5EY2dNQzQ0TXpFM09EWWdNQzR5TnpBNU5ETkRNQzQ0TXpNeE1EVWdNQzR5TnpNd016a2dNQzQ0TXpNNE1UUWdNQzR5TnpVME5qRWdNQzQ0TXpNNE16UWdNQzR5TnpjNU16ZFdNQzQzTkRreE16ZERNQzQ0TXpNNU56Y2dNQzQzTlRJd05qRWdNQzQ0TXpNeE5UUWdNQzQzTlRRNU5URWdNQzQ0TXpFME9URWdNQzQzTlRjek5qRkRNQzQ0TWprNE1qZ2dNQzQzTlRrM056RWdNQzQ0TWpjME1Ua2dNQzQzTmpFMU5qWWdNQzQ0TWpRMk16UWdNQzQzTmpJME56Rk1NQzQyTlRFek1ERWdNQzQ0TWpBd056RkRNQzQyTkRrM09UY2dNQzQ0TWpBeU9EY2dNQzQyTkRneU56RWdNQzQ0TWpBeU9EY2dNQzQyTkRZM05qY2dNQzQ0TWpBd056RmFUVEF1TmpZd01UQXhJREF1TWpFME9EY3hWakF1TnpnNE1qQTBUREF1T0RBMk56WTNJREF1TnpNNU5UTTNWakF1TWpnMk1qQTBUREF1TmpZd01UQXhJREF1TWpFME9EY3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTFNelF6TXlBd0xqZ3lNREEzUXpBdU16VXlNREUzSURBdU9ESXdNall6SURBdU16VXdOVGd5SURBdU9ESXdNall6SURBdU16UTVNVFkySURBdU9ESXdNRGRNTUM0eE56VTRNek1nTUM0M05qSTBOME13TGpFM016QTNNeUF3TGpjMk1UVTBNeUF3TGpFM01EWTVNeUF3TGpjMU9UY3pOeUF3TGpFMk9UQTFOaUF3TGpjMU56TXpRekF1TVRZM05ERTVJREF1TnpVME9USXlJREF1TVRZMk5qRTBJREF1TnpVeU1EUTFJREF1TVRZMk56WTJJREF1TnpRNU1UTTNWakF1TWpjM09UTTNRekF1TVRZMk56ZzJJREF1TWpjMU5EWXhJREF1TVRZM05EazFJREF1TWpjek1ETTVJREF1TVRZNE9ERTBJREF1TWpjd09UUXpRekF1TVRjd01UTXpJREF1TWpZNE9EUTNJREF1TVRjeU1EQTVJREF1TWpZM01UWWdNQzR4TnpReU16TWdNQzR5TmpZd056Rk1NQzR6TkRjMU5qWWdNQzR4T0RFME1EUkRNQzR6TkRrMk5URWdNQzR4T0RBek16TWdNQzR6TlRFNU9ERWdNQzR4TnprNE16RWdNQzR6TlRRek1qSWdNQzR4TnprNU5EaERNQzR6TlRZMk5qTWdNQzR4T0RBd05qVWdNQzR6TlRnNU16SWdNQzR4T0RBM09UY2dNQzR6TmpBNE9Ua2dNQzR4T0RJd056RkRNQzR6TmpJNE1qRWdNQzR4T0RNeU56RWdNQzR6TmpRME1EVWdNQzR4T0RRNU5ESWdNQzR6TmpVMU1ERWdNQzR4T0RZNU1qVkRNQzR6TmpZMU9UZ2dNQzR4T0RnNU1EZ2dNQzR6TmpjeE56RWdNQzR4T1RFeE16Z2dNQzR6TmpjeE5qWWdNQzR4T1RNME1EUldNQzQ0TURZM016ZERNQzR6TmpjeE5UWWdNQzQ0TURnNE5USWdNQzR6TmpZMk5ETWdNQzQ0TVRBNU16VWdNQzR6TmpVMk55QXdMamd4TWpneE0wTXdMak0yTkRZNU5pQXdMamd4TkRZNU1TQXdMak0yTXpJNE9TQXdMamd4TmpNeElEQXVNell4TlRZMklEQXVPREUzTlRNM1F6QXVNelU1TWpNMElEQXVPREU1TXpBMUlEQXVNelUyTXpVM0lEQXVPREl3TWpBeUlEQXVNelV6TkRNeklEQXVPREl3TURkV01DNDRNakF3TjFwTk1DNHhPVE0wTXpNZ01DNDNOREF3TjB3d0xqTTBNREVnTUM0M09EZzNNemRXTUM0eU1UVTBNRFJNTUM0eE9UTTBNek1nTUM0eU9EY3dNRFJXTUM0M05EQXdOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek15TnpJZ01DNHpOalkyTXpKSU1DNDFPVE15TnpKV01DNHpNems1TmpaSU1DNDJNek15TnpKV01DNHpOalkyTXpKYVRUQXVOVFV6TWpjeUlEQXVNelkyTmpNeVNEQXVOVEV6TWpjeVZqQXVNek01T1RZMlNEQXVOVFV6TWpjeVZqQXVNelkyTmpNeVdrMHdMalEzTXpJM01pQXdMak0yTmpZek1rZ3dMalF6TXpJM01sWXdMak16T1RrMk5rZ3dMalEzTXpJM01sWXdMak0yTmpZek1scE5NQzR6T1RNeU56RWdNQzR6TmpZMk16SklNQzR6TlRNeU56RldNQzR6TXprNU5qWklNQzR6T1RNeU56RldNQzR6TmpZMk16SmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qTXpNamN5SURBdU5qWXdNRGc1U0RBdU5Ua3pNamN5VmpBdU5qTXpOREl6U0RBdU5qTXpNamN5VmpBdU5qWXdNRGc1V2swd0xqVTFNekkzTWlBd0xqWTJNREE0T1Vnd0xqVXhNekkzTWxZd0xqWXpNelF5TTBnd0xqVTFNekkzTWxZd0xqWTJNREE0T1ZwTk1DNDBOek15TnpJZ01DNDJOakF3T0RsSU1DNDBNek15TnpKV01DNDJNek0wTWpOSU1DNDBOek15TnpKV01DNDJOakF3T0RsYVRUQXVNemt6TWpjeElEQXVOall3TURnNVNEQXVNelV6TWpjeFZqQXVOak16TkRJelNEQXVNemt6TWpjeFZqQXVOall3TURnNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRME1UVXlJREF1TlRRMU9UTk1NQzR6T1RFek9EWWdNQzQxTURNeE0wTXdMak00T1RreU15QXdMalV3TVRnM09DQXdMak00T0RjME9DQXdMalV3TURNeU5DQXdMak00TnprME1pQXdMalE1T0RVM05VTXdMak00TnpFek5pQXdMalE1TmpneU5pQXdMak00TmpjeE9TQXdMalE1TkRreU15QXdMak00TmpjeE9TQXdMalE1TWprNU4wTXdMak00TmpjeE9TQXdMalE1TVRBM01TQXdMak00TnpFek5pQXdMalE0T1RFMk9DQXdMak00TnprME1pQXdMalE0TnpReE9FTXdMak00T0RjME9DQXdMalE0TlRZMk9TQXdMak00T1RreU15QXdMalE0TkRFeE5TQXdMak01TVRNNE5pQXdMalE0TWpnMk0wd3dMalEwTVRNNE5pQXdMalEwTURBMk0wd3dMalExT0RjeUlEQXVORFl3TXpOTU1DNDBNakExT0RZZ01DNDBPVE16T1RkTU1DNDBOVGczTWlBd0xqVXlOakEyTTB3d0xqUTBNVFV5SURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFU0TnpJMklEQXVOVFExT1ROTU1DNDFOREV6T1RNZ01DNDFNalUyTmpOTU1DNDFOemsxTWpVZ01DNDBPVE16T1RkTU1DNDFOREV5TmlBd0xqUTJNRGcyTTB3d0xqVTFPRFU1TXlBd0xqUTBNREEyTTB3d0xqWXdPRGN5TlNBd0xqUTRNamN6UXpBdU5qRXdNVGc0SURBdU5EZ3pPVGd5SURBdU5qRXhNell6SURBdU5EZzFOVE0ySURBdU5qRXlNVFk1SURBdU5EZzNNamcxUXpBdU5qRXlPVGMxSURBdU5EZzVNRE0wSURBdU5qRXpNemt5SURBdU5Ea3dPVE00SURBdU5qRXpNemt5SURBdU5Ea3lPRFl6UXpBdU5qRXpNemt5SURBdU5EazBOemc1SURBdU5qRXlPVGMxSURBdU5EazJOamt6SURBdU5qRXlNVFk1SURBdU5EazRORFF5UXpBdU5qRXhNell6SURBdU5UQXdNVGt4SURBdU5qRXdNVGc0SURBdU5UQXhOelExSURBdU5qQTROekkxSURBdU5UQXlPVGszVERBdU5UVTROekkySURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEV6TmpnNUlEQXVOREUzTWpJMlREQXVORFl3TmpreklEQXVOVGN6T1RjMVREQXVORGcxT1RVMUlEQXVOVGd5TlRFMVREQXVOVE00T1RVeElEQXVOREkxTnpZM1REQXVOVEV6TmpnNUlEQXVOREUzTWpJMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3hNU0lnZURJOUlqRXVNakEzTVRVaUlIa3lQU0l0TUM0eU1EY3hNRGNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlNMFJESTNRVGdpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBFeE5qWkdSaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTM1MWNlOTNhLTUzY2QtNDFlNy1iNmZkLWE3ZWZmYzk5N2FjMzsiIHBhcmVudD0iNCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyNC4wIiB5PSI2NC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPWNhOWJiMzM2LTVmMGItNDQ2MS1iMTU2LTE2YWVlZWMxNjE0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iMTIiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkNsb3VkV2F0Y2giIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1jbG91ZHdhdGNoO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTVRrNU9EZ2dNQzQyTXprNU5UTklNQzR5TnpNek1qRkRNQzR5TlRnME9EVWdNQzQyTXprMk5qWWdNQzR5TkRRd01EZ2dNQzQyTXpVek16TWdNQzR5TXpFME5UVWdNQzQyTWpjME1rTXdMakl4TVRJME5TQXdMall4TlRBek9TQXdMakU1TkRZeklEQXVOVGszTlRneklEQXVNVGd6TWpZeElEQXVOVGMyTnpnM1F6QXVNVGN4T0RreklEQXVOVFUxT1RreElEQXVNVFkyTVRZM0lEQXVOVE15TlRneUlEQXVNVFkyTmpVMUlEQXVOVEE0T0RnMlF6QXVNVFkxTWprNUlEQXVORGd4TnpRZ01DNHhOek14TURjZ01DNDBOVFE1TWpZZ01DNHhPRGc0TWpVZ01DNDBNekkzTlRKRE1DNHlNRFExTkRNZ01DNDBNVEExTnpnZ01DNHlNamN5TlRnZ01DNHpPVFF6TXlBd0xqSTFNek15TVNBd0xqTTROall5UXpBdU1qVXpNekl4SURBdU16Z3pNVFV6SURBdU1qVXpNekl4SURBdU16YzVOamcySURBdU1qVXpNekl4SURBdU16YzJNakpETUM0eU5UUXdOVElnTUM0ek5ESXpORFFnTUM0eU5qUXhPVEVnTUM0ek1Ea3pNemdnTUM0eU9ESTJNRFFnTUM0eU9EQTRPVFJETUM0ek1ERXdNVGdnTUM0eU5USTBOU0F3TGpNeU5qazRJREF1TWpJNU5qZzRJREF1TXpVM05UZzRJREF1TWpFMU1UVXpRekF1TXprd05EZzJJREF1TWpBd05UazRJREF1TkRJM01EY3lJREF1TVRrMk5UTTVJREF1TkRZeU16WWdNQzR5TURNMU0wTXdMalE1TnpZME9DQXdMakl4TURVeU1TQXdMalV5T1RreU15QXdMakl5T0RJeU1pQXdMalUxTkRjNE9DQXdMakkxTkRJeVF6QXVOVGN4TlRBeUlEQXVNamN4TWpReUlEQXVOVGcxTURRNElEQXVNamt4TVRBNUlEQXVOVGswTnpnNElEQXVNekV5T0RnMlF6QXVOakE0TmpneUlEQXVNekF4TmpjeUlEQXVOakkxT1RrNElEQXVNamsxTlRVMUlEQXVOalF6T0RVMElEQXVNamsxTlRVelF6QXVOamd3TVRJeElEQXVNamsxTlRVeklEQXVOekl3T1RJeElEQXVNekl6TURJZ01DNDNNamd6T0RjZ01DNHpPRE15T0RaRE1DNDNOakkyTlRRZ01DNHpPVEUwTWlBd0xqZ3pNekExTkNBd0xqUXhPVFF5SURBdU9ETXpNRFUwSURBdU5URXdNRGcyUXpBdU9ETTBNakU1SURBdU5UTXlOemt5SURBdU9ESTRPVEE1SURBdU5UVTFNell4SURBdU9ERTNOelEwSURBdU5UYzFNVFkyUXpBdU9EQTJOVGM1SURBdU5UazBPVGN4SURBdU56a3dNREUzSURBdU5qRXhNVGsySURBdU56WTVPVGczSURBdU5qSXhPVFV6VERBdU56VTJOalUwSURBdU5UazROakpETUM0M056STBORFFnTUM0MU9UQXdPQ0F3TGpjNE5UUTNNU0F3TGpVM056SXhOaUF3TGpjNU5ESXdPU0F3TGpVMk1UVXpOVU13TGpnd01qazBOeUF3TGpVME5UZzFOQ0F3TGpnd056QXpNeUF3TGpVeU9EQXdOeUF3TGpnd05UazROeUF3TGpVeE1EQTROa013TGpnd05UazROeUF3TGpRek1UWTROaUF3TGpjME1UQTFOQ0F3TGpReE1qSXlJREF1TnpFeU5qVTBJREF1TkRBM05ESkRNQzQzTVRBNU1TQXdMalF3TnpFd09TQXdMamN3T1RJME5TQXdMalF3TmpRMU5DQXdMamN3TnpjMU55QXdMalF3TlRRNU1rTXdMamN3TmpJMk9TQXdMalF3TkRVek1TQXdMamN3TkRrNE55QXdMalF3TXpJNE1pQXdMamN3TXprNE55QXdMalF3TVRneVF6QXVOekF5TURNeUlEQXVNems1TURJM0lEQXVOekF4TWpJeElEQXVNemsxTlRreUlEQXVOekF4TnpJeElEQXVNemt5TWpKRE1DNDJPVGM0TlRRZ01DNHpORE00TWlBd0xqWTJPVFU0TnlBd0xqTXlNakl5SURBdU5qUXpNRFUwSURBdU16SXlNakpETUM0Mk16UTJNRFFnTUM0ek1qSXlPVFVnTUM0Mk1qWXlPVElnTUM0ek1qUXpOemNnTUM0Mk1UZzRNRFVnTUM0ek1qZ3lPVFZETUM0Mk1URXpNVGNnTUM0ek16SXlNVE1nTUM0Mk1EUTROamNnTUM0ek16YzROVFFnTUM0MU9UazVPRGdnTUM0ek5EUTNOVE5ETUM0MU9UZzFOVGtnTUM0ek5EWTNNRGdnTUM0MU9UWTJNallnTUM0ek5EZ3lNemdnTUM0MU9UUXpPVFFnTUM0ek5Ea3hOemRETUM0MU9USXhOak1nTUM0ek5UQXhNVGNnTUM0MU9EazNNVGNnTUM0ek5UQTBNekVnTUM0MU9EY3pNakVnTUM0ek5UQXdPRFpETUM0MU9EUTVNeklnTUM0ek5EazNNVElnTUM0MU9ESTJPU0F3TGpNME9EWTVOaUF3TGpVNE1EZ3pOU0F3TGpNME56RTBOa013TGpVM09EazRJREF1TXpRMU5UazJJREF1TlRjM05UZ2dNQzR6TkRNMU55QXdMalUzTmpjNE9DQXdMak0wTVRJNE5rTXdMalUyT0RBNU5DQXdMak14TlRZNU5TQXdMalUxTXpjNUlEQXVNamt5TXpjeElEQXVOVE0wT1RJeElEQXVNamN6TURKRE1DNDFNVE00TWpVZ01DNHlOVEV4TWprZ01DNDBPRFkxTXpFZ01DNHlNell5TWpRZ01DNDBOVFkzTVNBd0xqSXpNRE14TTBNd0xqUXlOamc0T1NBd0xqSXlORFF3TVNBd0xqTTVOVGszTXlBd0xqSXlOemMyTlNBd0xqTTJPREV5TVNBd0xqSXpPVGsxTTBNd0xqTTBNalF6T0NBd0xqSTFNalEwTmlBd0xqTXlNRFkxTkNBd0xqSTNNVGN4TmlBd0xqTXdOVEV5TWlBd0xqSTVOVFk0TkVNd0xqSTRPVFU1SURBdU16RTVOalV5SURBdU1qZ3dPRGs1SURBdU16UTNOREEzSURBdU1qYzVPVGc0SURBdU16YzFPVFV6UXpBdU1qZ2dNQzR6T0RJeE1ESWdNQzR5T0RBek5UWWdNQzR6T0RneU5EUWdNQzR5T0RFd05UVWdNQzR6T1RRek5UTkRNQzR5T0RFME9EWWdNQzR6T1RjM016TWdNQzR5T0RBMk1EZ2dNQzQwTURFeE5TQXdMakkzT0RVNU9TQXdMalF3TXprd01rTXdMakkzTmpVNU1TQXdMalF3TmpZMU5DQXdMakkzTXpZd05TQXdMalF3T0RVek15QXdMakkzTURJMU5TQXdMalF3T1RFMU0wTXdMakkwTnpVNUlEQXVOREV6TnpnMUlEQXVNakkzTXpReklEQXVOREkyTkRBeUlEQXVNakV6TVRrNElEQXVORFEwTnpBMlF6QXVNVGs1TURVMElEQXVORFl6TURFeElEQXVNVGt4T1RVeklEQXVORGcxTnpnMklEQXVNVGt6TVRnNElEQXVOVEE0T0RnMlF6QXVNVGt5TmpJNElEQXVOVEk0TURrM0lEQXVNVGszTVRnMklEQXVOVFEzTVRFZ01DNHlNRFl6T1RNZ01DNDFOak01TnpsRE1DNHlNVFUyTURFZ01DNDFPREE0TkRnZ01DNHlNamt4TWpnZ01DNDFPVFE1TmpZZ01DNHlORFUxT0RnZ01DNDJNRFE0T0RaRE1DNHlOVE00T0NBd0xqWXhNREU1TWlBd0xqSTJNelEzT1NBd0xqWXhNekVnTUM0eU56TXpNakVnTUM0Mk1UTXlPRFpJTUM0ME1UazVPRGhXTUM0Mk16azVOVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU0TkRrMUlEQXVOekU1T1RjM1REQXVOekl6T0RJNElEQXVOakkwT1RGRE1DNDNNemMwTURNZ01DNDFPVFEwTWlBd0xqY3pPVGMyTVNBd0xqVTJNREV4TWlBd0xqY3pNRFE0TlNBd0xqVXlPREExTWtNd0xqY3lNVEl3T0NBd0xqUTVOVGs1TVNBd0xqY3dNRGc1TlNBd0xqUTJPREkwTXlBd0xqWTNNekV6TnlBd0xqUTBPVGN4TWtNd0xqWTBOVE0zT0NBd0xqUXpNVEU0TVNBd0xqWXhNVGsyTWlBd0xqUXlNekEyTWlBd0xqVTNPRGM1TlNBd0xqUXlOamM0T0VNd0xqVTBOVFl5T1NBd0xqUXpNRFV4TlNBd0xqVXhORGcwT0NBd0xqUTBOVGcwT0NBd0xqUTVNVGc1TkNBd0xqUTNNREEzTjBNd0xqUTJPRGswSURBdU5EazBNekEySURBdU5EVTFNamt5SURBdU5USTFPRGN4SURBdU5EVXpNell5SURBdU5UVTVNVGxETUM0ME5URTBNeklnTUM0MU9USTFNU0F3TGpRMk1UTTBOU0F3TGpZeU5UUXpPU0F3TGpRNE1UTTBPQ0F3TGpZMU1qRTFOa013TGpVd01UTTFNU0F3TGpZM09EZzNNeUF3TGpVek1ERTFOaUF3TGpZNU56WTFPQ0F3TGpVMk1qWTNNU0F3TGpjd05URTRPVU13TGpVNU5URTROU0F3TGpjeE1qY3hPU0F3TGpZeU9UTXhOaUF3TGpjd09EVXhNaUF3TGpZMU9UQXlPQ0F3TGpZNU16TXhUREF1TnpVeU16WXhJREF1TnpnMk5qUXpRekF1TnpZeE1qWTJJREF1TnprMU16TWdNQzQzTnpNeU5UWWdNQzQ0TURBeE1qVWdNQzQzT0RVMk9UVWdNQzQzT1RrNU56ZERNQzQzT1RFNE16WWdNQzQ0TURBd05qSWdNQzQzT1RjNU16SWdNQzQzT1RnNU1qY2dNQzQ0TURNMk16RWdNQzQzT1RZMk16aERNQzQ0TURrek16RWdNQzQzT1RRek5TQXdMamd4TkRVeE9TQXdMamM1TURrMU1pQXdMamd4T0RnNU5TQXdMamM0TmpZME0wTXdMamd5TXpJM01TQXdMamM0TWpJMU15QXdMamd5Tmpjek5DQXdMamMzTnpBMElEQXVPREk1TURnMElEQXVOemN4TXpBMVF6QXVPRE14TkRNMUlEQXVOelkxTlRZNUlEQXVPRE15TmpJMklEQXVOelU1TkRJMUlEQXVPRE15TlRnNUlEQXVOelV6TWpJM1F6QXVPRE15TlRVeElEQXVOelEzTURJNElEQXVPRE14TWpnM0lEQXVOelF3T0RrNUlEQXVPREk0T0RZNElEQXVOek0xTVRreVF6QXVPREkyTkRRNUlEQXVOekk1TkRnMUlEQXVPREl5T1RJeklEQXVOekkwTXpFMElEQXVPREU0TkRrMUlEQXVOekU1T1RjM1drMHdMalU1TkRZeU9DQXdMalk0TWpJME0wTXdMalUzTVRrM05TQXdMalk0TWpJME15QXdMalUwT1Rnek1pQXdMalkzTlRVeU5pQXdMalV6TURrNU55QXdMalkyTWprME1VTXdMalV4TWpFMk1pQXdMalkxTURNMU5pQXdMalE1TnpRNE1pQXdMall6TWpRMk9DQXdMalE0T0RneE15QXdMall4TVRVMFF6QXVORGd3TVRRMElEQXVOVGt3TmpFeUlEQXVORGMzT0RjMklEQXVOVFkzTlRneklEQXVORGd5TWprMUlEQXVOVFExTXpZMlF6QXVORGcyTnpFMUlEQXVOVEl6TVRRNElEQXVORGszTmpJeklEQXVOVEF5TnpRZ01DNDFNVE0yTkRFZ01DNDBPRFkzTWpORE1DNDFNamsyTlRrZ01DNDBOekEzTURVZ01DNDFOVEF3TmpZZ01DNDBOVGszT1RjZ01DNDFOekl5T0RRZ01DNDBOVFV6TnpkRE1DNDFPVFExTURFZ01DNDBOVEE1TlRnZ01DNDJNVGMxTXlBd0xqUTFNekl5TmlBd0xqWXpPRFExT0NBd0xqUTJNVGc1TlVNd0xqWTFPVE00TmlBd0xqUTNNRFUyTkNBd0xqWTNOekkzTkNBd0xqUTROVEkwTkNBd0xqWTRPVGcxT1NBd0xqVXdOREEzT1VNd0xqY3dNalEwTkNBd0xqVXlNamt4TXlBd0xqY3dPVEUyTVNBd0xqVTBOVEExTnlBd0xqY3dPVEUyTVNBd0xqVTJOemN4UXpBdU56QTVNVFl4SURBdU5UazRNRGcySURBdU5qazNNRGswSURBdU5qSTNNakU0SURBdU5qYzFOakUxSURBdU5qUTROamszUXpBdU5qVTBNVE0ySURBdU5qY3dNVGMySURBdU5qSTFNREEwSURBdU5qZ3lNalF6SURBdU5UazBOakk0SURBdU5qZ3lNalF6V2swd0xqYzVPVGsyTVNBd0xqYzJOek14UXpBdU56azJNRGN6SURBdU56Y3dPVGsxSURBdU56a3dPVEU1SURBdU56Y3pNRFVnTUM0M09EVTFOakVnTUM0M056TXdOVU13TGpjNE1ESXdOQ0F3TGpjM016QTFJREF1TnpjMU1EVWdNQzQzTnpBNU9UVWdNQzQzTnpFeE5qRWdNQzQzTmpjek1Vd3dMalk0TWpNMk1TQXdMalkzT0RVeFF6QXVOamt6TWpBMUlEQXVOamN3TURBeklEQXVOekF5TnpNZ01DNDJOVGs1TXpnZ01DNDNNVEEyTWpnZ01DNDJORGcyTkROTU1DNDNPVGs1TmpFZ01DNDNNemcxTVVNd0xqZ3dNemMwSURBdU56UXlNelV4SURBdU9EQTFPRFUzSURBdU56UTNOVEl5SURBdU9EQTFPRFUzSURBdU56VXlPVEZETUM0NE1EVTROVGNnTUM0M05UZ3lPVGdnTUM0NE1ETTNOQ0F3TGpjMk16UTJPU0F3TGpjNU9UazJNU0F3TGpjMk56TXhXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWXpNVFF4TVNBd0xqVXdOVGN4T1V3d0xqWXhOVFUwTlNBd0xqVXlOekU0TlVNd0xqWXdPRFF3T0NBd0xqVXlNVGc1T0NBd0xqVTVPVGcyTkNBd0xqVXhPRGcwTkNBd0xqVTVNRGs1TWlBd0xqVXhPRFF4UXpBdU5UZ3lNVElnTUM0MU1UYzVOellnTUM0MU56TXpNVGtnTUM0MU1qQXhPREVnTUM0MU5qVTNJREF1TlRJME56UTNRekF1TlRVNE1EZ3hJREF1TlRJNU16RXpJREF1TlRVeE9UZzNJREF1TlRNMk1ETTBJREF1TlRRNE1UZzJJREF1TlRRME1EWXlRekF1TlRRME16ZzFJREF1TlRVeU1Ea2dNQzQxTkRNd05Ea2dNQzQxTmpFd05qUWdNQzQxTkRRek5EWWdNQzQxTmprNE5URkRNQzQxTkRVd09EWWdNQzQxTnpVNE1Ua2dNQzQxTkRjd05ERWdNQzQxT0RFMU56SWdNQzQxTlRBd09URWdNQzQxT0RZM05UVkRNQzQxTlRNeE5ERWdNQzQxT1RFNU16Y2dNQzQxTlRjeU1qRWdNQzQxT1RZME5DQXdMalUyTWpBM09TQXdMalU1T1RrNE5Fd3dMalUwTmpjME5pQXdMall5TURjNE5FTXdMalV6TVRnM05DQXdMall3T1RNME5TQXdMalV5TWpBNE5pQXdMalU1TWpVeU5TQXdMalV4T1RRNE9TQXdMalUzTXprME5FTXdMalV4TmpnNU1TQXdMalUxTlRNMk1pQXdMalV5TVRZNU1TQXdMalV6TmpVd015QXdMalV6TWpnMU5pQXdMalV5TVRReU5FTXdMalUwTkRBeU1TQXdMalV3TmpNME5pQXdMalUyTURZMU9DQXdMalE1TmpJMU1pQXdMalUzT1RFNE9TQXdMalE1TXpNeE5VTXdMalU1TnpjeUlEQXVORGt3TXpjNElEQXVOakUyTmpZMElEQXVORGswT0RNeUlEQXVOak14T1RRMElEQXVOVEExTnpFNVNEQXVOak14TkRFeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3dOeUlnZURJOUlqRXVNakEzTURjaUlIa3lQU0l0TUM0eU1EY3dOamNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlOQ01EQTRORVFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaR05FWTRRaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTEyYzcyZWM3LTliODctNDM2ZS1iMTkwLTY5ZjA1NjU0YTBhZjsiIHBhcmVudD0iNCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyNC4wIiB5PSIyMDkuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjkiIHZhbHVlPSJBV1MgQWNjb3VudCBFbnZpcm9ubWVudCIgc3R5bGU9ImlyLnJlZj1jMWExMjc2Zi00MTFhLTRhZWItODE4Yy1hNGI2MDUxMTJjNTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRFZ01FZ3dWakZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGMyTnpJMElEQXVOamd3TXpBelNEQXVNVFU1T1RFeVZqQXVOak13T0RjNFF6QXVNVFU1T0RNeklEQXVOVGN5TmpBMUlEQXVNVGM1TXpJeUlEQXVOVEUxT1RreklEQXVNakUxTWpVMklEQXVORGN3TVRFNVF6QXVNalV4TVRnNUlEQXVOREkwTWpRMUlEQXVNekF4TkRnMElEQXVNemt4TnpZM0lEQXVNelU0TURjNElEQXVNemMzT0RreFREQXVNell6T1RNNUlEQXVNemMyTkRZMVREQXVNelk1TXpJMUlEQXVNemM1TXpFMlF6QXVNemczTXpjNElEQXVNemc0T1RneElEQXVOREEzTlRNM0lEQXVNemswTURNNElEQXVOREk0TURFMElEQXVNemswTURNNFF6QXVORFE0TkRreElEQXVNemswTURNNElEQXVORFk0TmpVeElEQXVNemc0T1RneElEQXVORGcyTnpBMElEQXVNemM1TXpFMlREQXVORGt5TURnNUlEQXVNemMyTkRZMVREQXVORGszT1RVZ01DNHpOemM0T1RGRE1DNDFORGc0TVRnZ01DNHpPVEExTURnZ01DNDFPVFEzTWprZ01DNDBNVGd4SURBdU5qSTVOelEwSURBdU5EVTNNRGs0VERBdU5qQTJNeUF3TGpRM09ETXlOVU13TGpVM05qWXdPQ0F3TGpRME5UVTFOU0F3TGpVek9ERXhOaUF3TGpReU1qQXhPU0F3TGpRNU5UUXhOaUF3TGpReE1EVXlORU13TGpRM05ESXdPQ0F3TGpReU1EZ2dNQzQwTlRBNU5EY2dNQzQwTWpZeE16a2dNQzQwTWpjek9ERWdNQzQwTWpZeE16bERNQzQwTURNNE1UUWdNQzQwTWpZeE16a2dNQzR6T0RBMU5UUWdNQzQwTWpBNElEQXVNelU1TXpRMUlEQXVOREV3TlRJMFF6QXVNekV4TURJeElEQXVOREl6TnpReklEQXVNalk0TXpjMElEQXVORFV5TkRZeklEQXVNak0zT1RVeklEQXVORGt5TWpjeVF6QXVNakEzTlRNeklEQXVOVE15TURnZ01DNHhPVEV3TWpNZ01DNDFPREEzTnpZZ01DNHhPVEE1TmlBd0xqWXpNRGczT0ZZd0xqWTBPRFl5U0RBdU5EYzJNRGxNTUM0ME56WTNNalFnTUM0Mk9EQXpNRE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOREkzTmpNMUlEQXVOREkxTURFMVF6QXVOREF6TnpNNElEQXVOREkxTURnMklEQXVNemd3TWpBM0lEQXVOREU1TVRRNUlEQXVNelU1TWpBMElEQXVOREEzTnpRNFF6QXVNek14TXprMElEQXVNemt5TlRjM0lEQXVNekE1TkRJNUlEQXVNelk0TlRjMElEQXVNamsyTnpjM0lEQXVNek01TlRORE1DNHlPRFF4TWpRZ01DNHpNVEEwT0RZZ01DNHlPREUxTURVZ01DNHlOemd3TlRVZ01DNHlPRGt6TXpNZ01DNHlORGN6TlRaRE1DNHlPVGN4TmpJZ01DNHlNVFkyTlRnZ01DNHpNVFE1T1RFZ01DNHhPRGswTkRJZ01DNHpOREF3TURZZ01DNHhOekF3TURSRE1DNHpOalV3TWpFZ01DNHhOVEExTmpZZ01DNHpPVFUzT1RnZ01DNHhOREF3TVRVZ01DNDBNamMwTnpjZ01DNHhOREF3TVRWRE1DNDBOVGt4TlRZZ01DNHhOREF3TVRVZ01DNDBPRGs1TXpNZ01DNHhOVEExTmpZZ01DNDFNVFE1TkRnZ01DNHhOekF3TURSRE1DNDFNems1TmpNZ01DNHhPRGswTkRJZ01DNDFOVGMzT1RNZ01DNHlNVFkyTlRnZ01DNDFOalUyTWpFZ01DNHlORGN6TlRaRE1DNDFOek0wTkRrZ01DNHlOemd3TlRVZ01DNDFOekE0TXlBd0xqTXhNRFE0TmlBd0xqVTFPREUzTnlBd0xqTXpPVFV6UXpBdU5UUTFOVEkxSURBdU16WTROVGMwSURBdU5USXpOVFlnTUM0ek9USTFOemNnTUM0ME9UVTNOU0F3TGpRd056YzBPRll3TGpRd056YzBPRU13TGpRM05EZ3hNaUF3TGpReE9UQXlNaUF3TGpRMU1UUXhOU0F3TGpReU5EazFOQ0F3TGpReU56WXpOU0F3TGpReU5UQXhOVnBOTUM0ME1qYzJNelVnTUM0eE56VTJOekpETUM0ME1ETXlPRGtnTUM0eE56VXlNRFVnTUM0ek56azBPVElnTUM0eE9ESTVNeUF3TGpNMk1EQTJNU0F3TGpFNU56WXdOa013TGpNME1EWXpJREF1TWpFeU1qZ3pJREF1TXpJMk5qa3lJREF1TWpNek1EWXhJREF1TXpJd05EZ3hJREF1TWpVMk5qQTNRekF1TXpFME1qY3hJREF1TWpnd01UVTBJREF1TXpFMk1UUTRJREF1TXpBMU1UQTBJREF1TXpJMU9ERXpJREF1TXpJM05EVTFRekF1TXpNMU5EYzNJREF1TXpRNU9EQTNJREF1TXpVeU16WTVJREF1TXpZNE1qWTFJREF1TXpjek56YzRJREF1TXpjNU9EWTNRekF1TXprd01UUTFJREF1TXpnNE5qUTFJREF1TkRBNE5ESTVJREF1TXprek1qTTRJREF1TkRJM01EQXlJREF1TXprek1qTTRRekF1TkRRMU5UYzBJREF1TXprek1qTTRJREF1TkRZek9EVTRJREF1TXpnNE5qUTFJREF1TkRnd01qSTJJREF1TXpjNU9EWTNRekF1TlRBeE5UTWdNQzR6Tmpnek1USWdNQzQxTVRnek5pQXdMak0wT1RrMk5pQXdMalV5T0RBME1TQXdMak15TnpjME5rTXdMalV6TnpjeU1TQXdMak13TlRVeU5pQXdMalV6T1RZNU5TQXdMakk0TURjd055QXdMalV6TXpZMUlEQXVNalUzTWpNMlF6QXVOVEkzTmpBMUlEQXVNak16TnpZMElEQXVOVEV6T0RnNElEQXVNakV5T1RnM0lEQXVORGswTmpjNElEQXVNVGs0TWpBNVF6QXVORGMxTkRZNUlEQXVNVGd6TkRNZ01DNDBOVEU0TnpFZ01DNHhOelUwT1RjZ01DNDBNamMyTXpVZ01DNHhOelUyTnpKV01DNHhOelUyTnpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmpjek5ESTJJREF1T0RZd01EUTRUREF1TlRBME9EZ3pJREF1TnpZeU56Z3lWakF1TlRZNE1Ea3hUREF1Tmpjek5ESTJJREF1TkRjd09ESTFUREF1T0RReE9UWTVJREF1TlRZNE1Ea3hWakF1TnpZeU56Z3lUREF1Tmpjek5ESTJJREF1T0RZd01EUTRXazB3TGpVek5qVTJOQ0F3TGpjME5EUXdOa3d3TGpZM016UXlOaUF3TGpneU16WXhNMHd3TGpneE1ESTRPQ0F3TGpjME5EUXdObFl3TGpVNE5UazVNa3d3TGpZM016UXlOaUF3TGpVd05qYzROVXd3TGpVek5qVTJOQ0F3TGpVNE5UazVNbFl3TGpjME5EUXdObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOek0xTmpNZ01DNDJPRE0yTnpkTU1DNDFNVEk1TXprZ01DNDFPVEV3TURSTU1DNDFNamczT0NBd0xqVTJNelU1T1V3d0xqWTNNelUyTXlBd0xqWTBOekE0TTB3d0xqZ3hPRE0wTmlBd0xqVTJNelU1T1V3d0xqZ3pOREU0TnlBd0xqVTVNVEF3TkV3d0xqWTNNelUyTXlBd0xqWTRNelkzTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT0Rrek9UWWdNQzQyTmpVMU1qZElNQzQyTlRjM01UVldNQzQ0TkRFNE5ESklNQzQyT0Rrek9UWldNQzQyTmpVMU1qZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeE1EY2lJSGt4UFNJeExqSXdOekUxSWlCNE1qMGlNUzR5TURjeE1TSWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTTROVEV4UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrWTVPVEF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0LjAiIHk9IjM1NC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IlVzZXIgLSBXZWIgVUkgLT4gQVdTIEFQSSBHYXRld2F5IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj1iZTE3ZDA1My1iZTc0LTRkYjEtOTVmNC0wMmE3ZmJhODY2M2M7aXIudGFncz1Mb2dpbiBDcmVkZW50aWFscztpci5hc3NldHM9UGVyc29uYWxseSBJZGVudGlmaWFibGUgSW5mb3JtYXRpb247IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNSIgdGFyZ2V0PSI5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMTU5LjAiIHk9IjIzNi4wIiB3aWR0aD0iMzQzLjAiIGhlaWdodD0iMjAyLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIgLT4gU0lFTSBUZWFtIiBzdHlsZT0iaXIucmVmPWUzMTJlZGNmLWVjZjEtNGM3My04ZmI0LTdkZDk1ZThiMDZkYTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTE7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxOSIgc291cmNlPSIxNyIgdGFyZ2V0PSIyNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE3IiB2YWx1ZT0iSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1pbnRlcm5hbC1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVU13TGpNMk5UZzFNeUF3TGpJNE1qYzRNeUF3TGpNM09EY3lOU0F3TGpJMk9Ua3hNU0F3TGpNNU5EWXdNeUF3TGpJMk9Ua3hNVWd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJMk9Ua3hNU0F3TGpZek5ERTROaUF3TGpJNE1qYzRNeUF3TGpZek5ERTROaUF3TGpJNU9EWTJNVU13TGpZek5ERTROaUF3TGpNeE5EVXpPU0F3TGpZeU1UTXhOQ0F3TGpNeU56UXhNU0F3TGpZd05UUXpOaUF3TGpNeU56UXhNVWd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56UXhNU0F3TGpNMk5UZzFNeUF3TGpNeE5EVXpPU0F3TGpNMk5UZzFNeUF3TGpJNU9EWTJNVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNNU5EWXdNeUF3TGpZNU1UVTNPRU13TGpNM09EY3lOU0F3TGpZNU1UVTNPQ0F3TGpNMk5UZzFNeUF3TGpjd05EUTFJREF1TXpZMU9EVXpJREF1TnpJd016STRRekF1TXpZMU9EVXpJREF1TnpNMk1qQTJJREF1TXpjNE56STFJREF1TnpRNU1EYzRJREF1TXprME5qQXpJREF1TnpRNU1EYzRTREF1TlRjd01ERTVWakF1TmpreE5UYzRTREF1TXprME5qQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpNd01qRTRJREF1TmpFNU9URXhTREF1TmpBd01ERTVRekF1TlRnNU1qWXpJREF1TmpFNU9URXhJREF1TlRjNU9ESTVJREF1TmpJMU5UY3lJREF1TlRjME5UTXpJREF1TmpNME1EYzRTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1EYzRJREF1TXpZMU9EVXpJREF1TmpJeE1qQTJJREF1TXpZMU9EVXpJREF1TmpBMU16STRRekF1TXpZMU9EVXpJREF1TlRnNU5EVWdNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5TQXdMall6TkRFNE5pQXdMall3TlRNeU9FTXdMall6TkRFNE5pQXdMall4TURZMU1TQXdMall6TWpjMElEQXVOakUxTmpNMklEQXVOak13TWpFNElEQXVOakU1T1RFeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TlRFNUlEQXVOakU1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVM01EQXhPVll3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNVGs1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek0wTXpFZ01DNDJOVEF3TWpSRE1DNDJNVFV3TWpFZ01DNDJOVEF3TWpRZ01DNDJNREF3T1RnZ01DNDJOalExTnpVZ01DNDJNREF3T1RnZ01DNDJPREkxTWpSV01DNDRPVGt4T1RGRE1DNDJNREF3T1RnZ01DNDVNRFV4TnpRZ01DNDJNRFV3TnpJZ01DNDVNVEF3TWpRZ01DNDJNVEV5TURrZ01DNDVNVEF3TWpSSU1DNDJORFExTkRKV01DNDROVFU0TlRoRE1DNDJORFExTkRJZ01DNDRORGs0TnpVZ01DNDJORGsxTVRZZ01DNDRORFV3TWpRZ01DNDJOVFUyTlRNZ01DNDRORFV3TWpSSU1DNDNORFExTkRGRE1DNDNOVEEyTnpjZ01DNDRORFV3TWpRZ01DNDNOVFUyTlRJZ01DNDRORGs0TnpVZ01DNDNOVFUyTlRJZ01DNDROVFU0TlRoV01DNDVNVEF3TWpSSU1DNDNPRGc1T0RWRE1DNDNPVFV4TWpFZ01DNDVNVEF3TWpRZ01DNDRNREF3T1RZZ01DNDVNRFV4TnpRZ01DNDRNREF3T1RZZ01DNDRPVGt4T1RGV01DNDNPVEE0TlRoRE1DNDRNREF3T1RZZ01DNDNOekk1TURrZ01DNDNPRFV4TnpJZ01DNDNOVGd6TlRnZ01DNDNOalkzTmpNZ01DNDNOVGd6TlRoSU1DNDNOVFUyTlRKV01DNDJPREkxTWpSRE1DNDNOVFUyTlRJZ01DNDJOalExTnpVZ01DNDNOREEzTWpnZ01DNDJOVEF3TWpRZ01DNDNNakl6TVRrZ01DNDJOVEF3TWpSSU1DNDJNek0wTXpGYVRUQXVOalkyTnpZMElEQXVOekEwTVRreFF6QXVOalkyTnpZMElEQXVOekV3TVRjMElEQXVOall4TnpnNUlEQXVOekUxTURJMElEQXVOalUxTmpVeklEQXVOekUxTURJMFF6QXVOalE1TlRFMklEQXVOekUxTURJMElEQXVOalEwTlRReUlEQXVOekV3TVRjMElEQXVOalEwTlRReUlEQXVOekEwTVRreFF6QXVOalEwTlRReUlEQXVOams0TWpBNElEQXVOalE1TlRFMklEQXVOamt6TXpVNElEQXVOalUxTmpVeklEQXVOamt6TXpVNFF6QXVOall4TnpnNUlEQXVOamt6TXpVNElEQXVOalkyTnpZMElEQXVOams0TWpBNElEQXVOalkyTnpZMElEQXVOekEwTVRreFdrMHdMalkyTmpjMk5DQXdMamMxT0RNMU9FTXdMalkyTmpjMk5DQXdMamMyTkRNME1TQXdMalkyTVRjNE9TQXdMamMyT1RFNU1TQXdMalkxTlRZMU15QXdMamMyT1RFNU1VTXdMalkwT1RVeE5pQXdMamMyT1RFNU1TQXdMalkwTkRVME1pQXdMamMyTkRNME1TQXdMalkwTkRVME1pQXdMamMxT0RNMU9FTXdMalkwTkRVME1pQXdMamMxTWpNM05TQXdMalkwT1RVeE5pQXdMamMwTnpVeU5DQXdMalkxTlRZMU15QXdMamMwTnpVeU5FTXdMalkyTVRjNE9TQXdMamMwTnpVeU5DQXdMalkyTmpjMk5DQXdMamMxTWpNM05TQXdMalkyTmpjMk5DQXdMamMxT0RNMU9GcE5NQzQyTmpZM05qUWdNQzQ0TVRJMU1qUkRNQzQyTmpZM05qUWdNQzQ0TVRnMU1EZ2dNQzQyTmpFM09Ea2dNQzQ0TWpNek5UZ2dNQzQyTlRVMk5UTWdNQzQ0TWpNek5UaERNQzQyTkRrMU1UWWdNQzQ0TWpNek5UZ2dNQzQyTkRRMU5ESWdNQzQ0TVRnMU1EZ2dNQzQyTkRRMU5ESWdNQzQ0TVRJMU1qUkRNQzQyTkRRMU5ESWdNQzQ0TURZMU5ERWdNQzQyTkRrMU1UWWdNQzQ0TURFMk9URWdNQzQyTlRVMk5UTWdNQzQ0TURFMk9URkRNQzQyTmpFM09Ea2dNQzQ0TURFMk9URWdNQzQyTmpZM05qUWdNQzQ0TURZMU5ERWdNQzQyTmpZM05qUWdNQzQ0TVRJMU1qUmFUVEF1TnpFeE1qQTRJREF1TnpBME1Ua3hRekF1TnpFeE1qQTRJREF1TnpFd01UYzBJREF1TnpBMk1qTXpJREF1TnpFMU1ESTBJREF1TnpBd01EazNJREF1TnpFMU1ESTBRekF1Tmprek9UWWdNQzQzTVRVd01qUWdNQzQyT0RnNU9EWWdNQzQzTVRBeE56UWdNQzQyT0RnNU9EWWdNQzQzTURReE9URkRNQzQyT0RnNU9EWWdNQzQyT1RneU1EZ2dNQzQyT1RNNU5pQXdMalk1TXpNMU9DQXdMamN3TURBNU55QXdMalk1TXpNMU9FTXdMamN3TmpJek15QXdMalk1TXpNMU9DQXdMamN4TVRJd09DQXdMalk1T0RJd09DQXdMamN4TVRJd09DQXdMamN3TkRFNU1WcE5NQzQzTVRFeU1EZ2dNQzQzTlRnek5UaERNQzQzTVRFeU1EZ2dNQzQzTmpRek5ERWdNQzQzTURZeU16TWdNQzQzTmpreE9URWdNQzQzTURBd09UY2dNQzQzTmpreE9URkRNQzQyT1RNNU5pQXdMamMyT1RFNU1TQXdMalk0T0RrNE5pQXdMamMyTkRNME1TQXdMalk0T0RrNE5pQXdMamMxT0RNMU9FTXdMalk0T0RrNE5pQXdMamMxTWpNM05TQXdMalk1TXprMklEQXVOelEzTlRJMElEQXVOekF3TURrM0lEQXVOelEzTlRJMFF6QXVOekEyTWpNeklEQXVOelEzTlRJMElEQXVOekV4TWpBNElEQXVOelV5TXpjMUlEQXVOekV4TWpBNElEQXVOelU0TXpVNFdrMHdMamN4TVRJd09DQXdMamd4TWpVeU5FTXdMamN4TVRJd09DQXdMamd4T0RVd09DQXdMamN3TmpJek15QXdMamd5TXpNMU9DQXdMamN3TURBNU55QXdMamd5TXpNMU9FTXdMalk1TXprMklEQXVPREl6TXpVNElEQXVOamc0T1RnMklEQXVPREU0TlRBNElEQXVOamc0T1RnMklEQXVPREV5TlRJMFF6QXVOamc0T1RnMklEQXVPREEyTlRReElEQXVOamt6T1RZZ01DNDRNREUyT1RFZ01DNDNNREF3T1RjZ01DNDRNREUyT1RGRE1DNDNNRFl5TXpNZ01DNDRNREUyT1RFZ01DNDNNVEV5TURnZ01DNDRNRFkxTkRFZ01DNDNNVEV5TURnZ01DNDRNVEkxTWpSYVRUQXVOelUxTmpVeUlEQXVPREV5TlRJMFF6QXVOelUxTmpVeUlEQXVPREU0TlRBNElEQXVOelV3TmpjM0lEQXVPREl6TXpVNElEQXVOelEwTlRReElEQXVPREl6TXpVNFF6QXVOek00TkRBMElEQXVPREl6TXpVNElEQXVOek16TkRNZ01DNDRNVGcxTURnZ01DNDNNek0wTXlBd0xqZ3hNalV5TkVNd0xqY3pNelF6SURBdU9EQTJOVFF4SURBdU56TTROREEwSURBdU9EQXhOamt4SURBdU56UTBOVFF4SURBdU9EQXhOamt4UXpBdU56VXdOamMzSURBdU9EQXhOamt4SURBdU56VTFOalV5SURBdU9EQTJOVFF4SURBdU56VTFOalV5SURBdU9ERXlOVEkwV2swd0xqY3pNelF6SURBdU9URXdNREkwVmpBdU9EWTJOamt4U0RBdU56RXhNalkwVmpBdU9URXdNREkwU0RBdU56TXpORE5hVFRBdU5qZzVNRFF5SURBdU9URXdNREkwVmpBdU9EWTJOamt4U0RBdU5qWTJOelkwVmpBdU9URXdNREkwU0RBdU5qZzVNRFF5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9ZGE1OGY0NzMtMDk4My00YTM1LWFlZDgtZTlmYzBkNmY0ZGRlOyIgcGFyZW50PSIxOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIyMDguNSIgeT0iNDYuMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iOTAuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjciIHZhbHVlPSJTSUVNIFRlYW0iIHN0eWxlPSJpci5yZWY9YjMzNTIwOGYtMmVjMy00NjZmLWFiNzYtNTFmOWRhNTkwNDA2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIxOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0Mi4wIiB5PSI0Ni4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTUzYmEyZDQ3LWNmMTctNGFiZC04NzM2LTQyMGJlODBlODY0Mztpci50YWdzPUFsZXJ0czsiIHBhcmVudD0iMSIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iVGhpcyBUaHJlYXQgTW9kZWwgY292ZXJzIGEgaG9zdGVkIGFwcGxpY2F0aW9uLCB0aGF0IGEgdXNlciBhY2Nlc3NlcyB2aWEuIGEgVUkuICZsdDticj4mbHQ7YnI+QSBTSUVNIHRlYW0gKG9uLXByZW1pc2UpIGlzIGFibGUgdG8gbW9uaXRvciB0aGUgaGVhbHRoIG9mIHRoZSBhcHBsaWNhdGlvbiB2aWEuIHRoZSBDbG91ZHdhdGNoIHNlcnZpY2UuIiBzdHlsZT0ic2hhcGU9bm90ZTtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE0O3NpemU9MjA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I2ZmZjJjYztzdHJva2VDb2xvcj0jZDZiNjU2O2ZvbnRDb2xvcj0jNjY2NjAwOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMjk4LjAiIHk9Ii0yLjAiIHdpZHRoPSIxOTMuMCIgaGVpZ2h0PSIxNjUuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVlBDIC0gQ3VzdG9tZXIgSW5zdGFuY2UiIGlyLnNvdXJjZVN0eWxlPSJjb250YWluZXI9dW5kZWZpbmVkO3JvdW5kZWQ9MTthcmNTaXplPTkwO3BlcmltZXRlcj11bmRlZmluZWQ7cmVjdXJzaXZlUmVzaXplPXVuZGVmaW5lZDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD11bmRlZmluZWQ7c3Ryb2tlQ29sb3I9IzIwQzlFMztmb250U2l6ZT0xMjt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2FsaWduPWNlbnRlcjt0ZXh0RGlyZWN0aW9uPXVuZGVmaW5lZDtzcGFjaW5nVG9wPXVuZGVmaW5lZDtzcGFjaW5nTGVmdD11bmRlZmluZWQ7YXNwZWN0PXVuZGVmaW5lZDtkYXNoZWQ9dW5kZWZpbmVkO2ZvbnRTdHlsZT11bmRlZmluZWQ7b3V0bGluZUNvbm5lY3Q9dW5kZWZpbmVkO3NoYXBlPXVuZGVmaW5lZDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNJalJUTkdRMFpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPRFU1TkNBd0xqWXlNRE5JTUM0eU9Ua3lOek5ETUM0eU1qWXlNRFlnTUM0Mk1qQXpJREF1TVRjd016UWdNQzQxTnpFMUlEQXVNVFkyTmpBMklEQXVOVEEwTkRNelF6QXVNVFkyTmpBMklEQXVOVEF4TmpNeklEQXVNVFkyTmpBMklEQXVORGs0TkRNeklEQXVNVFkyTmpBMklEQXVORGsxTWpNelF6QXVNVFkxTkRjeElEQXVORFkzTkRBNElEQXVNVGN6T0RBM0lEQXVORFF3TURJeElEQXVNVGt3TWpVeElEQXVOREUzTlRRMlF6QXVNakEyTmprMUlEQXVNemsxTURjeElEQXVNak13TWpjMklEQXVNemM0T0RNNUlEQXVNalUzTVRRZ01DNHpOekUxUXpBdU1qVTNNVFFnTUM0ek5qYzVJREF1TWpVM01UUWdNQzR6TmpRME16TWdNQzR5TlRjeE5DQXdMak0yTURnek0wTXdMakkxTnpneE1pQXdMak15TkRrek55QXdMakkyT1RBNU5DQXdMakk1TURBME5DQXdMakk0T1RVMk15QXdMakkyTURVME9VTXdMak14TURBek15QXdMakl6TVRBMU5DQXdMak16T0RjM05DQXdMakl3T0RJM055QXdMak0zTWpFMk5pQXdMakU1TlRBNE9VTXdMalF3TlRVMU9DQXdMakU0TVRrZ01DNDBOREl4TURZZ01DNHhOemc0T1NBd0xqUTNOekl3TmlBd0xqRTROalF6TjBNd0xqVXhNak13TmlBd0xqRTVNems0TkNBd0xqVTBORE00TnlBd0xqSXhNVGMxTVNBd0xqVTJPVFF3TmlBd0xqSXpOelZETUM0MU9EWTROVFVnTUM0eU5UUTNOeUF3TGpZd01UQXpPQ0F3TGpJM05UQTFNU0F3TGpZeE1USTNNeUF3TGpJNU56TTJOME13TGpZeU5Ua3dNaUF3TGpJNE5UWXhOQ0F3TGpZME5ERXdPQ0F3TGpJM09USXhOaUF3TGpZMk1qZzNNeUF3TGpJM09USXpNME13TGpjd01UVTBJREF1TWpjNU1qTXpJREF1TnpReU9EY3pJREF1TXpBMk9ETXpJREF1TnpRNU5qY3pJREF1TXpZNE0wTXdMamM0TWpVeklEQXVNemMwT0NBd0xqZ3hNakUzTXlBd0xqTTVNak0xSURBdU9ETXpOamN6SURBdU5ERTRNRE16VERBdU9ERXlOelFnTUM0ME16UTBNek5ETUM0M09USTNOelVnTUM0ME1URTFPVElnTUM0M05qVXlPVGNnTUM0ek9UWTJORGNnTUM0M016VXlOek1nTUM0ek9USXpRekF1TnpNeU1qY3pJREF1TXpreE9ERTVJREF1TnpJNU5USTJJREF1TXprd016STNJREF1TnpJM05Ea2dNQzR6T0Rnd056SkRNQzQzTWpVME5UTWdNQzR6T0RVNE1UY2dNQzQzTWpReU5EY2dNQzR6T0RJNU16UWdNQzQzTWpRd056TWdNQzR6TnprNVF6QXVOekl4TURBMklEQXVNekk0T0RNeklEQXVOamt4TVRRZ01DNHpNRFU1SURBdU5qWXlPRGN6SURBdU16QTFPVU13TGpZMU16azVOeUF3TGpNd05UazRNaUF3TGpZME5USTJJREF1TXpBNE1USWdNQzQyTXpjek5Ea2dNQzR6TVRJeE5EVkRNQzQyTWprME16Y2dNQzR6TVRZeE55QXdMall5TWpVMk5pQXdMak15TVRrM05DQXdMall4TnpJM015QXdMak15T1RGRE1DNDJNVFU0TkRFZ01DNHpNekV3TURrZ01DNDJNVE01TWpJZ01DNHpNekkwT1RrZ01DNDJNVEUzTVRjZ01DNHpNek0wTVRORE1DNDJNRGsxTVRNZ01DNHpNelF6TWpnZ01DNDJNRGN4TURNZ01DNHpNelEyTXpRZ01DNDJNRFEzTkNBd0xqTXpORE5ETUM0Mk1ESXpOallnTUM0ek16TTVNemNnTUM0Mk1EQXhNelVnTUM0ek16STVOREVnTUM0MU9UZ3lPREVnTUM0ek16RTBNVFpETUM0MU9UWTBNamNnTUM0ek1qazRPU0F3TGpVNU5UQXhPU0F3TGpNeU56ZzVNaUF3TGpVNU5ESXdOaUF3TGpNeU5UWXpNME13TGpVNE5UQTNPU0F3TGpJNU9UY3hOQ0F3TGpVM01ESTNNeUF3TGpJM05qRTJNaUF3TGpVMU1EZzNNeUF3TGpJMU5qZERNQzQxTWprMU56UWdNQzR5TXpRM09EY2dNQzQxTURJeU9EWWdNQzR5TVRrMk5ESWdNQzQwTnpJME1qSWdNQzR5TVRNeE5qTkRNQzQwTkRJMU5Ua2dNQzR5TURZMk9ETWdNQzQwTVRFME5EY2dNQzR5TURreE5UWWdNQzR6T0RJNU9ESWdNQzR5TWpBeU56RkRNQzR6TlRRMU1UY2dNQzR5TXpFek9EY2dNQzR6TWprNU5qTWdNQzR5TlRBMk5USWdNQzR6TVRJek9UTWdNQzR5TnpVMk5UUkRNQzR5T1RRNE1qUWdNQzR6TURBMk5UWWdNQzR5T0RVd01Ua2dNQzR6TXpBeU9EWWdNQzR5T0RReU1EWWdNQzR6TmpBNE16TkRNQzR5T0RReU1qVWdNQzR6TmpjeU1ETWdNQzR5T0RRMU9ERWdNQzR6TnpNMU5qZ2dNQzR5T0RVeU56TWdNQzR6TnprNVF6QXVNamcxTlRrMElEQXVNemd6TURneUlEQXVNamcwTnpZeElEQXVNemcyTWpjeklEQXVNamd5T1RJMUlEQXVNemc0T0RreVF6QXVNamd4TURrZ01DNHpPVEUxTVRFZ01DNHlOemd6TnpRZ01DNHpPVE16T0RNZ01DNHlOelV5TnpNZ01DNHpPVFF4TmpkRE1DNHlORFV3TURZZ01DNDBNREUyTXpNZ01DNHhPVE01TkNBd0xqUXlORGd6TXlBd0xqRTVNemswSURBdU5EazFNak16UXpBdU1Ua3pPREEySURBdU5EazNOak14SURBdU1Ua3pPREEySURBdU5UQXdNRE0xSURBdU1Ua3pPVFFnTUM0MU1ESTBNek5ETUM0eE9UWTROek1nTUM0MU5UVTNOamNnTUM0eU5ERTFOQ0F3TGpVNU16WXpNeUF3TGpNd01EWXdOaUF3TGpVNU16WXpNMGd3TGpRNE56STNNMHd3TGpRNE5UazBJREF1TmpJd00xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56STBOVEVnTUM0NE1UWTRNRFZETUM0MU1UUXpNVGdnTUM0NE1UWTRNRFVnTUM0MU1USTBOVEVnTUM0Mk16a3dOekVnTUM0MU1USTBOVEVnTUM0Mk16Y3pNemhXTUM0ME56VXdOekZETUM0MU1USTBORElnTUM0ME56SXpORGNnTUM0MU1UTXlOamdnTUM0ME5qazJPRFVnTUM0MU1UUTRNVGdnTUM0ME5qYzBORFZETUM0MU1UWXpOamNnTUM0ME5qVXlNRFFnTUM0MU1UZzFOallnTUM0ME5qTTBPVElnTUM0MU1qRXhNVGdnTUM0ME5qSTFNemhNTUM0Mk5qYzNPRFVnTUM0ME1EZ3lOekZETUM0Mk56QTRNRFFnTUM0ME1EY3lNRFFnTUM0Mk56UXdPVGdnTUM0ME1EY3lNRFFnTUM0Mk56Y3hNVGdnTUM0ME1EZ3lOekZNTUM0NE1qTTNPRFVnTUM0ME5qSTFNemhETUM0NE1qWXpNemNnTUM0ME5qTTBPVElnTUM0NE1qZzFNelVnTUM0ME5qVXlNRFFnTUM0NE16QXdPRFVnTUM0ME5qYzBORFZETUM0NE16RTJNelFnTUM0ME5qazJPRFVnTUM0NE16STBOaUF3TGpRM01qTTBOeUF3TGpnek1qUTFNU0F3TGpRM05UQTNNVll3TGpZME56TXpPRU13TGpnek1qUTFNU0F3TGpZME9UQTNNU0F3TGpnek1EVTROU0F3TGpneE5qZ3dOU0F3TGpZM01qUTFNU0F3TGpneE5qZ3dOVnBOTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZXTUM0Mk16Y3pNemhETUM0MU16a3hNVGdnTUM0Mk5ETTJNRFVnTUM0MU5EQTVPRFVnTUM0M09UQXhNemdnTUM0Mk56STBOVEVnTUM0M09UQXhNemhETUM0NE1ETTVNVGdnTUM0M09UQXhNemdnTUM0NE1EVTNPRFVnTUM0Mk5UTXlNRFVnTUM0NE1EVTNPRFVnTUM0Mk5EY3pNemhXTUM0ME9EUTBNRFZNTUM0Mk56STBOVEVnTUM0ME16UTVNemhNTUM0MU16a3hNVGdnTUM0ME9EUTBNRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN5TkRNNUlEQXVOelkyT1RJMFF6QXVOVGczTmpNNUlEQXVOelkyT1RJMElEQXVOVFkyT0RNNUlEQXVOalU1TXpJMElEQXVOVFkxTnpjeklEQXVOalUwTnpreFF6QXVOVFkxTmpReElEQXVOalV6T1RrMklEQXVOVFkxTmpReElEQXVOalV6TVRnMUlEQXVOVFkxTnpjeklEQXVOalV5TXpreFZqQXVOVEUwTWpVNFF6QXVOVFkxTnpjZ01DNDFNVEUxT0RjZ01DNDFOalkxTmprZ01DNDFNRGc1TnpnZ01DNDFOamd3TmpjZ01DNDFNRFkzTmpkRE1DNDFOamsxTmpVZ01DNDFNRFExTlRZZ01DNDFOekUyT1RJZ01DNDFNREk0TkRZZ01DNDFOelF4TnpNZ01DNDFNREU0TlRoTU1DNDJOamMxTURZZ01DNDBOalV3TlRoRE1DNDJOekEyTnpRZ01DNDBOak0zT1RZZ01DNDJOelF5TURVZ01DNDBOak0zT1RZZ01DNDJOemN6TnpNZ01DNDBOalV3TlRoTU1DNDNOekEzTURZZ01DNDFNREU0TlRoRE1DNDNOek14T0RjZ01DNDFNREk0TkRZZ01DNDNOelV6TVRRZ01DNDFNRFExTlRZZ01DNDNOelk0TVRJZ01DNDFNRFkzTmpkRE1DNDNOemd6TURrZ01DNDFNRGc1TnpnZ01DNDNOemt4TURrZ01DNDFNVEUxT0RjZ01DNDNOemt4TURZZ01DNDFNVFF5TlRoV01DNDJOVEl6T1RGRE1DNDNOemt4TnpJZ01DNDJOVE14T1NBd0xqYzNPVEUzTWlBd0xqWTFNems1TWlBd0xqYzNPVEV3TmlBd0xqWTFORGM1TVVNd0xqYzNPREF6T1NBd0xqWTFPVE15TkNBd0xqYzFOekl6T1NBd0xqYzJOamt5TkNBd0xqWTNNalF6T1NBd0xqYzJOamt5TkZwTk1DNDFPVEkwTXprZ01DNDJOVEV3TlRoRE1DNDFPVFExTnpNZ01DNDJOakV4T1RFZ01DNDJNVE0yTXprZ01DNDNOREF5TlRnZ01DNDJOekkwTXprZ01DNDNOREF5TlRoRE1DNDNNekV5TXprZ01DNDNOREF5TlRnZ01DNDNOVEF6TURZZ01DNDJOakV6TWpRZ01DNDNOVEkwTXprZ01DNDJOVEV3TlRoV01DNDFNak16TWpSTU1DNDJOekkwTXprZ01DNDBPVEU0TlRoTU1DNDFPVEkwTXprZ01DNDFNak16TWpSV01DNDJOVEV3TlRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b20iIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZGZiMjYzMWYtZDk1OS00YTE5LWFjZTQtNjJmYjU1MmI2NzczO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE0MS4wIiB5PSIzNy4wIiB3aWR0aD0iMzQwLjAiIGhlaWdodD0iMzkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCIgaWQ9IjEwIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NjMwZjhkN2YtYWI1Mi00NGM5LTk4NzUtZWY5Yzk3OWNkNGU1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9ODQ7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVjMjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EWTJNamdnTUM0MU16azVOVGxJTUM0M016azVOakZXTUM0MU1UTXlPVE5JTUM0NE1EWTJNamhXTUM0eE9UTXlPVE5JTUM0ME9EWTJNamhXTUM0eU5UazVOVGxJTUM0ME5UazVOakZXTUM0eE9UTXlPVE5ETUM0ME5UazVOakVnTUM0eE9EWXlNaUF3TGpRMk1qYzNJREF1TVRjNU5ETTNJREF1TkRZM056Y3hJREF1TVRjME5ETTJRekF1TkRjeU56Y3lJREF1TVRZNU5ETTFJREF1TkRjNU5UVTFJREF1TVRZMk5qSTJJREF1TkRnMk5qSTRJREF1TVRZMk5qSTJTREF1T0RBMk5qSTRRekF1T0RFek55QXdMakUyTmpZeU5pQXdMamd5TURRNE15QXdMakUyT1RRek5TQXdMamd5TlRRNE5DQXdMakUzTkRRek5rTXdMamd6TURRNE5TQXdMakUzT1RRek55QXdMamd6TXpJNU5DQXdMakU0TmpJeUlEQXVPRE16TWprMElEQXVNVGt6TWprelZqQXVOVEV6TWprelF6QXVPRE16TWprMElEQXVOVEl3TXpZMUlEQXVPRE13TkRnMUlEQXVOVEkzTVRRNElEQXVPREkxTkRnMElEQXVOVE15TVRRNVF6QXVPREl3TkRneklEQXVOVE0zTVRVZ01DNDRNVE0zSURBdU5UTTVPVFU1SURBdU9EQTJOakk0SURBdU5UTTVPVFU1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV4TXpFM0lEQXVPRE16TWprMFNEQXVNVGt6TVRjeFF6QXVNVGcyTURrNElEQXVPRE16TWprMElEQXVNVGM1TXpFMUlEQXVPRE13TkRnMUlEQXVNVGMwTXpFMElEQXVPREkxTkRnMFF6QXVNVFk1TXpFeklEQXVPREl3TkRneklEQXVNVFkyTlRBMElEQXVPREV6TnlBd0xqRTJOalV3TkNBd0xqZ3dOall5TjFZd0xqUTROall5T0VNd0xqRTJOalV3TkNBd0xqUTNPVFUxTlNBd0xqRTJPVE14TXlBd0xqUTNNamMzTWlBd0xqRTNORE14TkNBd0xqUTJOemMzTVVNd0xqRTNPVE14TlNBd0xqUTJNamMzSURBdU1UZzJNRGs0SURBdU5EVTVPVFl4SURBdU1Ua3pNVGN4SURBdU5EVTVPVFl4U0RBdU1qVTVPRE0zVmpBdU5EZzJOakk0U0RBdU1Ua3pNVGN4VmpBdU9EQTJOakkzU0RBdU5URXpNVGRXTUM0M016azVOakZJTUM0MU16azRNelpXTUM0NE1EWTJNamRETUM0MU16azRNellnTUM0NE1UTTNJREF1TlRNM01ESTNJREF1T0RJd05EZ3pJREF1TlRNeU1ESTJJREF1T0RJMU5EZzBRekF1TlRJM01ESTFJREF1T0RNd05EZzFJREF1TlRJd01qUXlJREF1T0RNek1qazBJREF1TlRFek1UY2dNQzQ0TXpNeU9UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56RXpNamc1SURBdU16YzVPVFUxVmpBdU16VXpNamc0U0RBdU5qY3pNamc1UXpBdU5qY3lOelFnTUM0ek5EWXpPVGdnTUM0Mk5qazNOVFFnTUM0ek16azVNeUF3TGpZMk5EZzJOeUF3TGpNek5UQTBNME13TGpZMU9UazRJREF1TXpNd01UVTJJREF1TmpVek5URXlJREF1TXpJM01UY2dNQzQyTkRZMk1qSWdNQzR6TWpZMk1qRldNQzR5T0RZMk1qRklNQzQyTVRrNU5UVldNQzR6TWpZMk1qRklNQzQxTnprNU5UVldNQzR5T0RZMk1qRklNQzQxTlRNeU9EaFdNQzR6TWpZMk1qRklNQzQxTVRNeU9EaFdNQzR5T0RZMk1qRklNQzQwT0RZMk1qSldNQzR6TWpZMk1qRklNQzQwTkRZMk1qRldNQzR5T0RZMk1qRklNQzQwTVRrNU5UVldNQzR6TWpZMk1qRklNQzR6TnprNU5UVldNQzR5T0RZMk1qRklNQzR6TlRNeU9EaFdNQzR6TWpZMk1qRkRNQzR6TkRZek9UZ2dNQzR6TWpjeE55QXdMak16T1RreklEQXVNek13TVRVMklEQXVNek0xTURReklEQXVNek0xTURRelF6QXVNek13TVRVMklEQXVNek01T1RNZ01DNHpNamN4TnlBd0xqTTBOak01T0NBd0xqTXlOall5TVNBd0xqTTFNekk0T0Vnd0xqSTROall5TVZZd0xqTTNPVGsxTlVnd0xqTXlOall5TVZZd0xqUXhPVGsxTlVnd0xqSTROall5TVZZd0xqUTBOall5TVVnd0xqTXlOall5TVZZd0xqUTROall5TWtnd0xqSTROall5TVZZd0xqVXhNekk0T0Vnd0xqTXlOall5TVZZd0xqVTFNekk0T0Vnd0xqSTROall5TVZZd0xqVTNPVGsxTlVnd0xqTXlOall5TVZZd0xqWXhPVGsxTlVnd0xqSTROall5TVZZd0xqWTBOall5TWtnd0xqTXlOall5TVVNd0xqTXlOekUzSURBdU5qVXpOVEV4SURBdU16TXdNVFUySURBdU5qVTVPVGdnTUM0ek16VXdORE1nTUM0Mk5qUTROamRETUM0ek16azVNeUF3TGpZMk9UYzFOQ0F3TGpNME5qTTVPQ0F3TGpZM01qYzBJREF1TXpVek1qZzRJREF1Tmpjek1qZzVWakF1TnpFek1qZzVTREF1TXpjNU9UVTFWakF1Tmpjek1qZzVTREF1TkRFNU9UVTFWakF1TnpFek1qZzVTREF1TkRRMk5qSXhWakF1Tmpjek1qZzVTREF1TkRnMk5qSXlWakF1TnpFek1qZzVTREF1TlRFek1qZzRWakF1Tmpjek1qZzVTREF1TlRVek1qZzRWakF1TnpFek1qZzVTREF1TlRjNU9UVTFWakF1Tmpjek1qZzVTREF1TmpFNU9UVTFWakF1TnpFek1qZzVTREF1TmpRMk5qSXlWakF1Tmpjek1qZzVRekF1TmpVek5URXlJREF1TmpjeU56UWdNQzQyTlRrNU9DQXdMalkyT1RjMU5DQXdMalkyTkRnMk55QXdMalkyTkRnMk4wTXdMalkyT1RjMU5DQXdMalkxT1RrNElEQXVOamN5TnpRZ01DNDJOVE0xTVRFZ01DNDJOek15T0RrZ01DNDJORFkyTWpKSU1DNDNNVE15T0RsV01DNDJNVGs1TlRWSU1DNDJOek15T0RsV01DNDFOems1TlRWSU1DNDNNVE15T0RsV01DNDFOVE15T0RoSU1DNDJOek15T0RsV01DNDFNVE15T0RoSU1DNDNNVE15T0RsV01DNDBPRFkyTWpKSU1DNDJOek15T0RsV01DNDBORFkyTWpGSU1DNDNNVE15T0RsV01DNDBNVGs1TlRWSU1DNDJOek15T0RsV01DNHpOems1TlRWSU1DNDNNVE15T0RsYVRUQXVOalEyTmpJeUlEQXVOalEwTWpJeVF6QXVOalEyTmpJeUlEQXVOalEwT0RVNElEQXVOalEyTXpZNUlEQXVOalExTkRZNUlEQXVOalExT1RFNUlEQXVOalExT1RFNVF6QXVOalExTkRZNUlEQXVOalEyTXpZNUlEQXVOalEwT0RVNUlEQXVOalEyTmpJeUlEQXVOalEwTWpJeUlEQXVOalEyTmpJeVNEQXVNelUxTmpnNFF6QXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUwTkRReElEQXVOalEyTXpZNUlEQXVNelV6T1RreElEQXVOalExT1RFNVF6QXVNelV6TlRReElEQXVOalExTkRZNUlEQXVNelV6TWpnNElEQXVOalEwT0RVNElEQXVNelV6TWpnNElEQXVOalEwTWpJeVZqQXVNelUxTmpnNFF6QXVNelV6TWpnNElEQXVNelUxTURVeElEQXVNelV6TlRReElEQXVNelUwTkRReElEQXVNelV6T1RreElEQXVNelV6T1RreFF6QXVNelUwTkRReElEQXVNelV6TlRReElEQXVNelUxTURVeElEQXVNelV6TWpnNElEQXVNelUxTmpnNElEQXVNelV6TWpnNFNEQXVOalEwTWpJeVF6QXVOalEwT0RVNUlEQXVNelV6TWpnNElEQXVOalExTkRZNUlEQXVNelV6TlRReElEQXVOalExT1RFNUlEQXVNelV6T1RreFF6QXVOalEyTXpZNUlEQXVNelUwTkRReElEQXVOalEyTmpJeUlEQXVNelUxTURVeElEQXVOalEyTmpJeUlEQXVNelUxTmpnNFZqQXVOalEwTWpJeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1My4wIiB5PSI2NS4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="API - I/O -&gt; EC2 - Elastic Compute Cloud" ref="24090cb1-0cb6-455d-9d17-3c11ba708487" source="329646f1-38b8-4996-93e4-1e342f0bafb3" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="EC2 - Elastic Compute Cloud -&gt; PostgreSQL" ref="456ef3b4-d874-4be9-93d1-577b3df224c0" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="CloudWatch -&gt; Internal Logging Server" ref="53ba2d47-cf17-4abd-8736-420be80e8643" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d">
+      <assets/>
+      <tags>
+        <tag tag="Alerts"/>
+      </tags>
+    </dataflow>
+    <dataflow name="User - Web UI -&gt; AWS API Gateway" ref="be17d053-be74-4db1-95f4-02a7fba8663c" source="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" target="329646f1-38b8-4996-93e4-1e342f0bafb3">
+      <assets>
+        <asset name="Personally Identifiable Information"/>
+      </assets>
+      <tags>
+        <tag tag="Login Credentials"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Elasticsearch -&gt; Overflow / Cold Storage" ref="c0130149-5c31-4165-b6e2-22cc58339bdd" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="85488534-b4b9-4b7f-837b-1d895fd6a673">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="CloudWatch -&gt; EC2 - Elastic Compute Cloud" ref="ca9bb336-5f0b-4461-b156-16aeeec16146" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="EC2 - Elastic Compute Cloud -&gt; Elasticsearch" ref="d2b00bd0-3732-40f2-8948-2bd6093fc6dc" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="458aeca6-65f5-4791-a48c-3d18d76a02b5">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Elasticsearch -&gt; PostgreSQL" ref="e1351bee-27d2-46c7-bb89-6f292faf39f8" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Internal Logging Server -&gt; SIEM Team" ref="e312edcf-ecf1-4c73-8fb4-7dd95e8b06da" source="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" target="315742d3-3d9e-4a0c-909c-78f3885e8607">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="945c328f-b4db-4023-ac59-e5b71bd01a69" diagramComponentId="b335208f-2ec3-466f-ab76-51f9da590406" ref="315742d3-3d9e-4a0c-909c-78f3885e8607" name="SIEM Team" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                <countermeasure ref="CWE-327" mitigation="33"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f8a89be1-7b94-4500-ae4c-fc7fdb05ea4b" diagramComponentId="8670166e-dc36-4f52-bea6-4545e9992c88" ref="794c99e8-a31a-4592-93a6-618a207a7aaa" name="PostgreSQL" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6b0c61f2-8966-4122-b600-8ba5cf4e8602" diagramComponentId="9952204e-7e2c-440c-9505-54c1c1f55e81" ref="458aeca6-65f5-4791-a48c-3d18d76a02b5" name="Elasticsearch" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="elasticsearch">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.231">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.213">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.219">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.202">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-ELASTICSEARCH1" name="Control access to Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Control access to Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service offers several ways of controlling access to domains by supporting three types of access policies:&lt;br&gt; - Resource-based Policies&lt;br&gt; - Identity-based Policies&lt;br&gt; - IP-based Policies&lt;/p&gt; 
+&lt;p&gt;Fine-grained access control offers additional ways of controlling access to your data on Amazon Elasticsearch Service. For example, depending on who makes the request, you might want a search to return results from only one index. You might want to hide certain fields in your documents or exclude certain documents altogether. Fine-grained access control offers the following features:&lt;br&gt; - Role-based access control&lt;br&gt; - Security at the index, document, and field level&lt;br&gt; - Kibana multi-tenancy&lt;br&gt; - HTTP basic authentication for Elasticsearch and Kibana&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To configure access policies (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain that you want to update.&lt;/p&gt; 
+&lt;p&gt;4. Choose Actions and Modify access policy.&lt;/p&gt; 
+&lt;p&gt;5. Edit the access policy JSON, or use the dropdown list to choose a preconfigured option.&lt;/p&gt; 
+&lt;p&gt;6. Choose Submit.&lt;/p&gt; 
+&lt;p&gt;Enabling Fine-Grained Access Control&lt;/p&gt; 
+&lt;p&gt;Enable fine-grained access control using the console, AWS CLI, or configuration API. The console offers the simplest experience while creating a new domain.&lt;/p&gt; 
+&lt;p&gt;In the Fine-grained access control section, enable or disable fine-grained access control:&lt;/p&gt; 
+&lt;p&gt;- If you want to use IAM for user management, choose Set IAM role as master user and specify the ARN for an IAM role.&lt;/p&gt; 
+&lt;p&gt;- If you want to use the internal user database, choose Create a master user and specify a user name and password.&lt;/p&gt; 
+&lt;p&gt;Whichever option you choose, the master user can access all indices in the cluster and all Elasticsearch APIs.&lt;/p&gt; 
+&lt;p&gt;If you disable fine-grained access control, you can still control access to your domain by placing it within a VPC, applying a restrictive access policy, or both. You must enable node-to-node encryption and encryption at rest to use fine-grained access control.&lt;/p&gt; 
+&lt;p&gt;Here are the requirements for enabling fine-grained access control:&lt;/p&gt; 
+&lt;p&gt;- Elasticsearch 6.7 or later&lt;br&gt; - Encryption of data at rest and node-to-node encryption enabled&lt;br&gt; - Require HTTPS for all traffic to the domain enabled&lt;/p&gt; 
+&lt;p&gt;You can't enable fine-grained access control on existing domains, only new ones. After you enable fine-grained access control, you can't disable it.&lt;/p&gt; 
+&lt;p&gt;For more information and examples about different types of policies and access control, please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; If you enabled VPC access for your domain, you can't configure an IP-based policy. Instead, you can use security groups to control which IP addresses can access the domain.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Creating and Managing Amazon Elasticsearch Service Domains" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html"/>
+            <reference name="Identity and Access Management in Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH7" name="Create alerts for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Configure alerts in Amazon Elasticsearch Service (Amazon ES) to get notified when data from one or more Elasticsearch indices meets certain conditions. &lt;br&gt; For example, you might want to receive an email if your application logs more than five HTTP 503 errors in one hour, or you might want to page a developer if no new documents have been indexed in the last 20 minutes.&lt;br&gt; Alerting requires Elasticsearch version 6.2 or later.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To get started with alerting&lt;/p&gt; 
+&lt;p&gt;1. Choose Alerting from the Kibana main menu.&lt;/p&gt; 
+&lt;p&gt;2. Set up a destination for the alert. Choose between Slack, Amazon Chime, a custom webhook, or Amazon SNS. As you might imagine, notifications require connectivity to the destination. For example, your Amazon ES domain must be able to connect to the internet to notify a Slack channel or send a custom webhook to a third-party server.&lt;/p&gt; 
+&lt;p&gt;3. Create a monitor in one of three ways: visually, using a query, or using an anomaly detector.&lt;/p&gt; 
+&lt;p&gt;4. Define a condition to trigger the monitor.&lt;/p&gt; 
+&lt;p&gt;5. (Optional) Add one or more actions to the monitor.&lt;/p&gt; 
+&lt;p&gt;Tip&lt;br&gt; After an action successfully sends a message, secure access to that message. If your domain contains sensitive data, consider using triggers without actions and periodically checking Kibana for alerts.&lt;/p&gt; 
+&lt;p&gt;For further information and Recommended CloudWatch Alarms please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Alerting for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/alerting.html"/>
+            <reference name="Recommended CloudWatch Alarms" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/cloudwatch-alarms.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have created alerts for Amazon Elasticsearch.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH6" name="Enable all logs for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable all logs for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES exposes four Elasticsearch logs through Amazon CloudWatch Logs: error logs, search slow logs, index slow logs, and audit logs. Search slow logs, index slow logs, and error logs are useful for troubleshooting performance and stability issues. Audit logs track user activity for compliance purposes. &lt;br&gt; All the logs are disabled by default.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Log Publishing (Console)&lt;/p&gt; 
+&lt;p&gt;The Amazon ES console is the simplest way to enable the publishing of logs to CloudWatch.&lt;/p&gt; 
+&lt;p&gt;To enable log publishing to CloudWatch (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
+&lt;p&gt;4. On the Logs tab, choose Setup for the log you want.&lt;/p&gt; 
+&lt;p&gt;5. Create a CloudWatch log group, or choose an existing one.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; If you plan to enable multiple logs, AWS recommends publishing each to its own log group. This separation makes the logs easier to scan.&lt;/p&gt; 
+&lt;p&gt;6. Choose an access policy that contains the appropriate permissions, or create a policy using the JSON that the console provides:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com" }, "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Resource": "cw_log_group_arn" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Important&lt;br&gt; CloudWatch Logs supports 10 resource policies per Region. If you plan to enable logs for several Amazon ES domains, you should create and reuse a broader policy that includes multiple log groups to avoid reaching this limit.&lt;/p&gt; 
+&lt;p&gt;7. Choose Enable.&lt;/p&gt; 
+&lt;p&gt;Audit Log Kibana UI&lt;/p&gt; 
+&lt;p&gt;After you enable audit logs, configure them to match your needs.&lt;/p&gt; 
+&lt;p&gt;1. Open Kibana, and choose Security.&lt;/p&gt; 
+&lt;p&gt;2. Choose Audit logs.&lt;/p&gt; 
+&lt;p&gt;3. Choose Enable audit logging.&lt;/p&gt; 
+&lt;p&gt;The Kibana UI offers full control of audit log settings under General settings and Compliance settings.&lt;/p&gt; 
+&lt;p&gt;Setting Elasticsearch Logging Thresholds for Slow Logs&lt;/p&gt; 
+&lt;p&gt;After you enable the publishing of slow logs to CloudWatch, you still must specify logging thresholds for each Elasticsearch index. These thresholds define precisely what should be logged and at which log level.&lt;/p&gt; 
+&lt;p&gt;You specify these settings through the Elasticsearch REST API:&lt;/p&gt; 
+&lt;p&gt;PUT elasticsearch_domain_endpoint/index/_settings&lt;br&gt; { "index.search.slowlog.threshold.query.warn": "5s", "index.search.slowlog.threshold.query.info": "2s"&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; The status of your domain changes from Active to Processing. The status must return to Active before log publishing is enabled. This change typically takes 30 minutes, but can take longer depending on your domain configuration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Audit Logs for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/audit-logs.html"/>
+            <reference name="Configuring Elasticsearch Logs" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createdomain-configure-slow-logs.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Observe the logs&lt;/p&gt;
+
+	&lt;p&gt;1. Open the CloudWatch console.&lt;br /&gt;
+2. In the navigation pane, choose Log groups.&lt;br /&gt;
+3. Choose the log group that you specified while enabling logs. Within the log group, Amazon ES creates a log stream for each node in your domain.&lt;br /&gt;
+4. In Log streams, choose Search all.&lt;br /&gt;
+5. For the read and write events, see the corresponding logs. You can expect a delay of 5 seconds before the log appears.&lt;/p&gt;
+
+
+	&lt;p&gt;Testing slow logs&lt;/p&gt;
+
+	&lt;p&gt;To test that slow logs are publishing successfully, consider starting with very low values to verify that logs appear in CloudWatch, and then increase the thresholds to more useful levels.&lt;/p&gt;
+
+	&lt;p&gt;If the logs don't appear, check the following:&lt;/p&gt;
+
+	&lt;p&gt;- Does the CloudWatch log group exist? Check the CloudWatch console.&lt;/p&gt;
+
+	&lt;p&gt;- Does Amazon ES have permissions to write to the log group? Check the Amazon ES console.&lt;/p&gt;
+
+	&lt;p&gt;- Is the Amazon ES domain configured to publish to the log group? Check the Amazon ES console, use the AWS CLI describe-elasticsearch-domain-config option, or call DescribeElasticsearchDomainConfig using one of the SDKs.&lt;/p&gt;
+
+	&lt;p&gt;- Are the Elasticsearch logging thresholds low enough that your requests are exceeding them? To review your thresholds for an index, use the following command:&lt;/p&gt;
+
+	&lt;p&gt;GET elasticsearch_domain_endpoint/index/_settings?pretty&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH5" name="Enable dedicated master nodes for production Amazon Elasticsearch domains" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable dedicated master nodes for production Amazon Elasticsearch domains&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service uses dedicated master nodes to increase cluster stability. A dedicated master node performs cluster management tasks, but does not hold data or respond to data upload requests. AWS recommends that you add three dedicated master nodes to each production Amazon ES domain. Never choose an even number of dedicated master nodes.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; When creating and managing Amazon ES domains:&lt;/p&gt; 
+&lt;p&gt;- Enable dedicated master nodes. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. AWS recommends three dedicated master nodes for production domains.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; You can choose different instance types for your dedicated master nodes and data nodes. For example, you might select general purpose or storage-optimized instances for your data nodes, but compute-optimized instances for your dedicated master nodes.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Dedicated Master Nodes" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that dedicated master nodes option is enabled and three dedicated master nodes are used for each domain.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.818">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH4" name="Enable encryption of data at rest for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable encryption of data at rest for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES domains offer encryption of data at rest, a security feature that helps prevent unauthorized access to your data. The feature uses AWS Key Management Service (AWS KMS) to store and manage your encryption keys and the Advanced Encryption Standard algorithm with 256-bit keys (AES-256) to perform the encryption. If enabled, the feature encrypts the following aspects of a domain:&lt;/p&gt; 
+&lt;p&gt;- All indices (including those in UltraWarm storage)&lt;br&gt; - Elasticsearch logs&lt;br&gt; - Swap files&lt;br&gt; - All other data in the application directory&lt;br&gt; - Automated snapshots&lt;/p&gt; 
+&lt;p&gt;The following are not encrypted when you enable encryption of data at rest, but you can take additional steps to protect them:&lt;/p&gt; 
+&lt;p&gt;- Manual snapshots: You currently can't use KMS master keys to encrypt manual snapshots. You can, however, use server-side encryption with S3-managed keys or customer master keys (CMKs) to encrypt the bucket you use as a snapshot repository.&lt;br&gt; - Slow logs and error logs: If you publish logs and want to encrypt them, you can encrypt their CloudWatch Logs log group using the same AWS KMS master key as the Amazon ES domain.&lt;/p&gt; 
+&lt;p&gt;Amazon ES supports only symmetric customer master keys, not asymmetric ones.&lt;/p&gt; 
+&lt;p&gt;Regardless of whether encryption at rest is enabled, all domains automatically encrypt custom packages using AES-256 and Amazon ES-managed keys.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Encryption of Data at Rest&lt;/p&gt; 
+&lt;p&gt;Encryption of data at rest on new domains requires Elasticsearch 5.1 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
+&lt;p&gt;To use the Amazon ES console to configure encryption of data at rest, you must have read permissions to AWS KMS, such as the following identity-based policy:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:List*", "kms:Describe*" ], "Resource": "*" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;If you want to use a master key other than (Default) aws/es, you must also have permissions to create grants for the key. These permissions typically take the form of a resource-based policy that you specify when you create the key.&lt;/p&gt; 
+&lt;p&gt;If you want to keep your key exclusive to Amazon ES, you can add the kms:ViaService condition to that key policy:&lt;/p&gt; 
+&lt;p&gt;"Condition": { "StringEquals": { "kms:ViaService": "es.us-west-1.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Warning&lt;br&gt; If you delete the key that you used to encrypt a domain, the domain becomes inaccessible. The Amazon ES team can't help you recover your data. AWS KMS deletes master keys only after a waiting period of at least seven days, so the Amazon ES team might contact you if they detect that your domain is at risk.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; - Automatic key rotation preserves the properties of your AWS KMS master keys, so the rotation has no effect on your ability to access your Elasticsearch data. Encrypted Amazon ES domains don't support manual key rotation, which involves creating a new master key and updating any references to the old key. &lt;br&gt; - Certain instance types don't support encryption of data at rest.&lt;br&gt; - Domains that encrypt data at rest use a different repository name for their automated snapshots.&lt;br&gt; - Encrypting an Amazon ES domain requires a grant, and each encryption key has a limit of 500 grants per principal. This limit means that the maximum number of Amazon ES domains that you can encrypt using a single key is 500. Currently, Amazon ES supports a maximum of 100 domains per account (per Region), so this grant limit is of no consequence. If the domain limit per account increases, however, the grant limit might become relevant.&lt;br&gt; If you need to encrypt more than 500 domains at that time, you can create additional keys. Keys are regional, not global, so if you operate in more than one AWS Region, you already need multiple keys.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Encryption of Data at Rest for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To ensure that encryption of data at rest for Amazon Elasticsearch is enabled (from console):&lt;/p&gt;
+
+	&lt;p&gt;1. Sign In to the Console.&lt;br /&gt;
+2. Go to Amazon Elasticsearch dashboard.&lt;br /&gt;
+3. Ensure that Encryption at rest is set to Enabled on the selected domain&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH9" name="Enable Node-to-node Encryption for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Node-to-node Encryption for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES.&lt;/p&gt; 
+&lt;p&gt;Each Amazon ES domain-regardless of whether the domain uses VPC access-resides within its own, dedicated VPC. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure. By default, however, traffic within the VPC is unencrypted. Node-to-node encryption enables TLS 1.2 encryption for all communications within the VPC.&lt;/p&gt; 
+&lt;p&gt;If you send data to Amazon ES over HTTPS, node-to-node encryption helps ensure that your data remains encrypted as Elasticsearch distributes (and redistributes) it throughout the cluster. If data arrives unencrypted over HTTP, Amazon ES encrypts it after it reaches the cluster. You can require that all traffic to the domain arrive over HTTPS using the console, AWS CLI, or configuration API.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Node-to-node Encryption&lt;/p&gt; 
+&lt;p&gt;Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
+&lt;p&gt;Alternatively, you can use the AWS CLI or configuration API.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; After you configure a domain to use node-to-node encryption, you can't disable the setting. Instead, you can take a manual snapshot of the encrypted domain, create another domain, migrate your data, and delete the old domain.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Node-to-node Encryption for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Node-to-node Encryption for Amazon Elasticsearch is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.855">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH8" name="Set up Anomaly Detection for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Set up Anomaly Detection for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Anomaly detection in Amazon Elasticsearch Service (Amazon ES) automatically detects anomalies in your Elasticsearch data in near-real time by using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream. The algorithm computes an anomaly grade and confidence score value for each incoming data point. Anomaly detection uses these values to differentiate an anomaly from normal variations in your data.&lt;br&gt; You can pair the anomaly detection plugin with the Alerting for Amazon Elasticsearch Service plugin to notify you as soon as an anomaly is detected.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Anomaly detection requires Elasticsearch 7.4 or later. All instance types support anomaly detection except for t2.micro and t2.small.&lt;/p&gt; 
+&lt;p&gt;Getting Started with Anomaly Detection&lt;/p&gt; 
+&lt;p&gt;To get started, choose Anomaly Detection in Kibana.&lt;/p&gt; 
+&lt;p&gt;Step 1: Create a Detector&lt;/p&gt; 
+&lt;p&gt;A detector is an individual anomaly detection task. You can create multiple detectors, and all the detectors can run simultaneously, with each analyzing data from different sources.&lt;/p&gt; 
+&lt;p&gt;Step 2: Add Features to Your Detector&lt;/p&gt; 
+&lt;p&gt;A feature is the field in your index that you check for anomalies. A detector can discover anomalies across one or more features. You must choose one of the following aggregations for each feature: average(), sum(), count(), min(), or max().&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; The count() aggregation method is only available in Elasticsearch version 7.7 and later. For version 7.4, use a custom expression like the following:&lt;/p&gt; 
+&lt;p&gt;{ "aggregation_name": { "value_count": { "field": "field_name" } }&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;The aggregation method determines what constitutes an anomaly. For example, if you choose min(), the detector focuses on finding anomalies based on the minimum values of your feature. If you choose average(), the detector finds anomalies based on the average values of your feature. You can add a maximum of five features per detector.&lt;/p&gt; 
+&lt;p&gt;You can configure the following optional settings (available in 7.7 and later):&lt;/p&gt; 
+&lt;p&gt;- Category field - Categorize or slice your data with a dimension like IP address, product ID, country code, and so on.&lt;/p&gt; 
+&lt;p&gt;- Window size - Set the number of aggregation intervals from your data stream to consider in a detection window.&lt;/p&gt; 
+&lt;p&gt;After you set up your features, preview sample anomalies and adjust the feature settings if necessary.&lt;/p&gt; 
+&lt;p&gt;Step 3: Observe the Results&lt;/p&gt; 
+&lt;p&gt;- Live anomalies - displays the live anomaly results for the last 60 intervals. For example, if the interval is set to 10, it shows the results for the last 600 minutes. This chart refreshes every 30 seconds.&lt;/p&gt; 
+&lt;p&gt;- Anomaly history - plots the anomaly grade with the corresponding measure of confidence.&lt;/p&gt; 
+&lt;p&gt;- Feature breakdown - plots the features based on the aggregation method. You can vary the date-time range of the detector.&lt;/p&gt; 
+&lt;p&gt;- Anomaly occurrence - shows the Start time, End time, Data confidence, and Anomaly grade for each anomaly detected.&lt;/p&gt; 
+&lt;p&gt;If you set the category field, you see an additional Heat map chart that correlates results for anomalous entities. Choose a filled rectangle to see a more detailed view of the anomaly.&lt;/p&gt; 
+&lt;p&gt;Step 4: Set Up Alerts&lt;br&gt; To create a monitor to send you notifications when any anomalies are detected, choose Set up alerts. The plugin redirects you to the Add monitor page where you can configure an alert.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Anomaly Detection for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ad.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Anomaly Detection for Amazon Elasticsearch has been properly configured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.846">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH3" name="Update Service Software for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Update Service Software for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES regularly releases system software updates that add features or otherwise improve your domains.&lt;br&gt; The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge.&lt;br&gt; Each notification includes details about the service software update. The notification severity is Informational if the update is optional and High if it's required. Consider the following when deciding whether to update your domain:&lt;br&gt; - If you take no action on required updates, Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation, Amazon ES sends notifications when it starts the update and when the update is complete.&lt;br&gt; - If you start an update manually, Amazon ES doesn't send a notification when it starts the update, only when the update is complete.&lt;br&gt; Manually updating your domain lets you take advantage of new features more quickly.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Service software updates differ from Elasticsearch version upgrades.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To request a service software update (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
+&lt;p&gt;4. For Service software release, follow the documentation link to compare your current version to the latest version. Then choose Update.&lt;/p&gt; 
+&lt;p&gt;To request a service software update (AWS CLI and AWS SDKs)&lt;/p&gt; 
+&lt;p&gt;You can use the following commands to see if an update is available, check upgrade eligibility, and request an update:&lt;/p&gt; 
+&lt;p&gt;describe-elasticsearch-domain (DescribeElasticsearchDomain)&lt;/p&gt; 
+&lt;p&gt;start-elasticsearch-service-software-update (StartElasticsearchServiceSoftwareUpdate)&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Consider starting the update at a low traffic time.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Service Software Updates" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Service Software for Amazon Elasticsearch has been updated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH2" name="Upgrade Amazon Elasticsearch to the latest version" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Upgrade Amazon Elasticsearch to the latest version&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; To get the new Elasticsearch features, bug fixes and security updates, upgrade Elasticsearch to the latest version.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Elasticsearch version upgrades differ from service software updates.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The upgrade process consists of three steps:&lt;/p&gt; 
+&lt;p&gt;1. Pre-upgrade checks - Amazon ES performs a series of checks for issues that can block an upgrade and doesn't proceed to the next step unless these checks succeed.&lt;/p&gt; 
+&lt;p&gt;2. Snapshot - Amazon ES takes a snapshot of the Elasticsearch cluster and doesn't proceed to the next step unless the snapshot succeeds. If the upgrade fails, Amazon ES uses this snapshot to restore the cluster to its original state.&lt;/p&gt; 
+&lt;p&gt;3. Upgrade - Amazon ES starts the upgrade, which can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;/p&gt; 
+&lt;p&gt;Starting an Upgrade&lt;/p&gt; 
+&lt;p&gt;The upgrade process is irreversible and can't be paused or canceled. During an upgrade, you can't make configuration changes to the domain. Before starting an upgrade, double-check that you want to proceed. You can use these same steps to perform the pre-upgrade check without actually starting an upgrade.&lt;/p&gt; 
+&lt;p&gt;If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;/p&gt; 
+&lt;p&gt;To upgrade a domain to a later version of Elasticsearch (console)&lt;/p&gt; 
+&lt;p&gt;1. Take a manual snapshot of your domain. This snapshot serves as a backup that you can restore on a new domain if you want to return to using the prior Elasticsearch version.&lt;/p&gt; 
+&lt;p&gt;2. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;3. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;4. In the navigation pane, under My domains, choose the domain that you want to upgrade.&lt;/p&gt; 
+&lt;p&gt;5. Choose Actions and Upgrade domain.&lt;/p&gt; 
+&lt;p&gt;6. For Operation, choose Upgrade, Submit, and Continue.&lt;/p&gt; 
+&lt;p&gt;7. Return to the Overview tab and choose Upgrade status to monitor the state of the upgrade.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;br&gt; Upgrade can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;br&gt; Amazon ES offers in-place Elasticsearch upgrades for domains that run versions 5.1 and later. If you use services like Amazon Kinesis Data Firehose or Amazon CloudWatch Logs to stream data to Amazon ES, check that these services support the newer version of Elasticsearch before migrating.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Upgrading Elasticsearch" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use the following operation to identify the right Elasticsearch version for your domain:&lt;/p&gt;
+
+	&lt;p&gt;get-compatible-elasticsearch-versions (GetCompatibleElasticsearchVersions)&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.789">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
+                <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
+                <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
+                <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="c799276d-dd32-409a-9153-fa3453715d65" diagramComponentId="da58f473-0983-4a35-aed8-e9fc0d6f4dde" ref="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" name="Internal Logging Server" desc="" library="" parentComponentRef="" componentDefinitionRef="internal-server">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
+                        to known security issues. These issues could be used by an attacker to gain access to the
+                        system.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.510">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Vendors and other maintainers of software release patches in response to security flaws and
+                        other bugs in their products.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
+                        failures or exploitation.&lt;/li&gt;
+                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
+                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
+                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
+                        the flaw.&lt;/li&gt;
+                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
+                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
+                            security and other patches.&lt;/li&gt;
+                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
+                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
+                            taking into account the associated risk.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
+ &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
+ &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
+&lt;/ul&gt; </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:43.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
+          <threats>
+            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers compromise the server that hosts the service or data, then the data and
+                                the service itself could be at risk of compromise. The server could be compromised
+                                through any of the services that it exposes.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNNECESSARY-SERVICES">
+                  <countermeasures>
+                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNPATCHED-SERVER">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="9cce7724-8f70-4ccd-a332-aad82e968eb0" diagramComponentId="351ce93a-53cd-41e7-b6fd-a7effc997ac3" ref="329646f1-38b8-4996-93e4-1e342f0bafb3" name="API - I/O" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.747">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of a command using
+                    externally-influenced input from an upstream component, but it does not
+                    neutralize or incorrectly neutralizes special elements that could modify the
+                    intended command when it is sent to a downstream
+                    component.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:50.102">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:49.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-12-10T16:38:53.139">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Choose a minimum TLS version for a custom domain in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create a custom domain, you specify the security policy for it. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:38:45.299">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control and manage access to a REST API in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use the following mechanisms for authentication and authorization: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. IAM tags can be used together with IAM policies to control access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-18T15:20:51.952">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for API endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:49:02.306">
+              <output/>
+            </source>
+            <references>
+              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:29:43.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:47:51.718">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a REST API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Do one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create an API and deploy it to a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Logs/Tracing in the Stage Editor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable execution logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable CloudWatch Logs under CloudWatch Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Error or Info from the dropdown menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If desired, choose Enable Detailed CloudWatch Metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable access logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable Access Logging under Custom Access Logging. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable execution logging and access logging independent of each other. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test your logging setup&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:45:18.275">
+              <output/>
+            </source>
+            <references>
+              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
+              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Monitor REST API execution with Amazon CloudWatch metrics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can access CloudWatch using any of the following methods: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon CloudWatch console 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS CLI&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  CloudWatch API 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose the name of the API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Under the selected API, choose Dashboard. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Use From and To to enter the date range. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:46:32.717">
+              <output/>
+            </source>
+            <references>
+              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable payload compression by using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API or create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Another way is to use AWS CLI to create a new API and enable compression. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose a REST API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. In the Resources pane, choose the method you want to test. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For additional options you may need to specify, contact the API owner. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Choose Test. The following information will be displayed: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
+   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
+   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
+   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
+   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
+   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:33:00.030">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If you choose to enable caching for a REST API, you can enable cache encryption. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To configure API caching for individual methods using the console: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Go to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stages list for the API, expand the stage and choose a method in the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Override for this method in Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:28:19.444">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable request validation in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test basic request validation using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following steps describe how to test basic request validation in the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test the request validation on a method using TestInvoke in the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  While signed in to the API Gateway console, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Resources for the API that you've configured a request validators map for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a method for which you have enabled the request validation with a specified request validator. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Method Execution, in the Client box, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Invalid request body" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the request parameters aren't valid, the following error message returns: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:41:53.285">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content-Type: application/json 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: apigateway.us-east-1.amazonaws.com 
+&lt;/div&gt; 
+&lt;div&gt;
+  X-Amz-Date: 20170603T200400Z 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authorization: AWS4-HMAC-SHA256 Credential=... 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "patchOperations" : [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; } 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; ] 
+&lt;/div&gt; 
+&lt;div&gt;
+  }&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of update-stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to remove the old certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of delete-client-certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate in the console for a previously deployed API, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the main navigation pane, choose Client Certificates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Client Certificates pane, choose Generate Client Certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the API for which you want to use the client certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages under the selected API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To save the settings, choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need to redeploy the API for the changes to take effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:31:36.166">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up a stage for a REST API 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a new stage 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the APIs navigation pane, choose Stages under an API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Stages navigation pane, choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Optionally, enter a stage description for Stage description. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To see your Stages follow the steps below: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the APIs pane, choose the API, and then choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the Stages pane, choose the name of the stage. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:34:49.306">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To get started with AWS Secrets Manager: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identify your secrets and locate where they are used in your applications. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update your applications to retrieve secrets from Secrets Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.983">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:20:17.914">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can do this by: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
+  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:18:21.424">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose an API method. In Client, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. From Client Certificate, choose Test to invoke the method request. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:30:05.704">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-77">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f52df292-c406-4958-b0d0-14657076bd42" diagramComponentId="630f8d7f-ab52-44c9-9875-ef9c979cd4e5" ref="f4049c60-9be6-471e-8885-753b7ce5c14d" name="EC2 - Elastic Compute Cloud" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="ec2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
+          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:38:28.834">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.070">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:54:10.678">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:34:35.371">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
+                        To avoid this, access to the network must be as restricted as possible, so that only the
+                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
+  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 allocate-address --domain vpc 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
+            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
+          </references>
+          <standards>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:31:03.095">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:44:34.594">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon Unified CLI: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:30:24.393">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    A list of approved AMIs must be maintained by the organization. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:46:26.599">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
+  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:57:31.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:40:33.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:37:32.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface:: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:46:34.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each NAT gateway is created in a specific Availability Zone and implemented with 
+  redundancy in that zone. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   and/or 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
+            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:34:03.576">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
+  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
+  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
+  are engineered to be isolated from failures in other Availability Zones. By launching 
+  instances in separate Availability Zones, you can protect your applications from the failure 
+  of a single location. AWS assigns a unique ID to each subnet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
+  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
+  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
+  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
+  Some AWS regions have more than 2 availability zones and it is recommended to use more 
+  than 2 where possible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:27:41.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The port for these inbound rules would depend on the Database engine used and the 
+  configured port. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The default values are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
+  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
+  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:04:42.704">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When we create a default VPC, AWS does the following to set it up: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
+  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
+  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  Label this Default VPC "Do Not Use". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
+  set a label to remind others not to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
+            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
+            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
+            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
+          </references>
+          <standards>
+            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:52:45.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Copy snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
+            <reference name="Create snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
+            <reference name="Create volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
+            <reference name="Delete volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
+            <reference name="Describe volumes" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
+            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T17:12:03.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
+                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
+                        every 90 days (or immediately if security patches become available) to avoid undue exposure
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;For linux instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
+                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:49:36.275">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
+            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
+            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
+          </references>
+          <standards>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:17:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:10:24.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:00:55.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
+                        (ingress/egress) on the default security group in order to force the use of least privilege via
+                        custom created security groups.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
+                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
+                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
+                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the default security group.&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
+                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Default Value&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The prescribed value is the default value. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
+            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
+            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
+          </references>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-images --owners self --filters 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    ImageId:ImageId, Public:Public}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T12:25:04.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:14:01.280">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.436">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.460">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.475">
+              <output/>
+            </source>
+            <references>
+              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        ALL TCP or ALL ports to avoid undue server exposure.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt; 
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 22</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 3389</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="VOLUMES-NOT-ENCRYPTED">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-02">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-03">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="150e5fa6-078f-47ac-98b8-939d88a61936" diagramComponentId="d077f2ce-8f51-4eed-b9e8-29c33c1c901e" ref="85488534-b4b9-4b7f-837b-1d895fd6a673" name="Overflow / Cold Storage" desc="" library="" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
+          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
+                        for an MFA.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T13:16:12.065">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.595">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.792">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
+            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
+            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
+          </references>
+          <standards>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
+                            then your bucket has no versioning enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.388">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.402">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
+&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
+&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt; 
+</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
+            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
+&lt;/div&gt; 
+&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
+            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T15:40:07.036">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
+ &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
+ &lt;/ul&gt; If data in transit is kept unencrypted: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
+ &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Version":"2012-10-17", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Id":"PutObjPolicy", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Statement":{ 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Effect":"Deny", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Principal":"*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Action":"s3:PutObject", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Condition":{ 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;} 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;} 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
+            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
+            <reference name="Using Server-side Encryption" url="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api list-buckets --output table
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            ...
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;{
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Effect": "Deny",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Principal": "*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Action": "s3:PutObject",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Condition": {
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T11:46:08.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
+  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
+  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
+  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
+  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
+  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;br&gt; 
+&lt;br&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
+            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
+            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
+            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
+                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            ./prowler -c extra73
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T14:10:10.879">
+              <output/>
+            </source>
+            <references>
+              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; {&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; "Statement":[&lt;/i&gt; 
+   &lt;i&gt;{&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Condition":{&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;div&gt; 
+       &lt;i&gt;"Bool":&lt;/i&gt; 
+      &lt;/div&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;}&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;i&gt;}&lt;/i&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; }&lt;/i&gt; 
+     &lt;i&gt;]&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt;} &lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
+                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
+                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.943">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.957">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br /&gt; 
+&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br /&gt; 
+&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
+&lt;br /&gt;Remediation 
+&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
+                            has no MFA delete enabled.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="393453ad-c739-44c3-a9b8-2a9f46195d08" diagramComponentId="12c72ec7-9b87-436e-b190-69f05654a0af" ref="8bf78537-3cdd-4c79-88be-e341adba0b30" name="CloudWatch" desc="" library="" parentComponentRef="" componentDefinitionRef="cloudwatch">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.027">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.042">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-CLOUDWATCH7" name="Connect to CloudWatch using Interface VPC Endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Connect to CloudWatch using Interface VPC Endpoints&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; If you use Amazon Virtual Private Cloud (Amazon VPC) to host your AWS resources, you can establish a private connection between your VPC, CloudWatch, and CloudWatch Synthetics. You can use these connections to enable CloudWatch and CloudWatch Synthetics to communicate with your resources on your VPC without going through the public internet.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Creating a VPC Endpoint for CloudWatch&lt;/p&gt; 
+&lt;p&gt;To start using CloudWatch with your VPC, create an interface VPC endpoint for CloudWatch. The service name to choose is com.amazonaws.region.monitoring.&lt;/p&gt; 
+&lt;p&gt;You do not need to change the settings for CloudWatch. CloudWatch calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch, and you already have metrics flowing to CloudWatch from resources located on your VPC, these metrics begin flowing through the interface VPC endpoint by default.&lt;/p&gt; 
+&lt;p&gt;Controlling Access to Your CloudWatch VPC Endpoint&lt;/p&gt; 
+&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, Amazon VPC attaches a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
+&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
+&lt;p&gt;To edit the VPC endpoint policy for CloudWatch&lt;/p&gt; 
+&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
+&lt;p&gt;3. If you have not already created the endpoint for CloudWatch, choose Create Endpoint. Select com.amazonaws.region.monitoring, and then choose Create endpoint.&lt;/p&gt; 
+&lt;p&gt;4. Select the com.amazonaws.region.monitoring endpoint, and then choose the Policy tab.&lt;/p&gt; 
+&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
+&lt;p&gt;Creating a VPC Endpoint for CloudWatch Synthetics&lt;/p&gt; 
+&lt;p&gt;To start using CloudWatch Synthetics with your VPC, create an interface VPC endpoint for CloudWatch Synthetics. The service name to choose is com.amazonaws.region.synthetics. For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.&lt;/p&gt; 
+&lt;p&gt;You do not need to change the settings for CloudWatch Synthetics. CloudWatch Synthetics communicates with other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch Synthetics, and you already have an interface endpoint for Amazon S3, CloudWatch Synthetics begins communicating with Amazon S3 through the interface VPC endpoint by default.&lt;/p&gt; 
+&lt;p&gt;Controlling Access to Your CloudWatch Synthetics VPC Endpoint&lt;/p&gt; 
+&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, we attach a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
+&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
+&lt;p&gt;To edit the VPC endpoint policy for CloudWatch Synthetics&lt;/p&gt; 
+&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
+&lt;p&gt;3. If you have not already created the endpoint for CloudWatch Synthetics, choose Create Endpoint. Select com.amazonaws.region.synthetics and then choose Create endpoint.&lt;/p&gt; 
+&lt;p&gt;4. Select the com.amazonaws.region.synthetics endpoint and then choose the Policy tab.&lt;/p&gt; 
+&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
+&lt;p&gt;The following are the general steps for setting up an interface endpoint:&lt;/p&gt; 
+&lt;p&gt;1. Choose the VPC in which to create the interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service to which you're connecting.&lt;/p&gt; 
+&lt;p&gt;2. Choose a subnet in your VPC to use the interface endpoint. We create an endpoint network interface in the subnet. You can specify more than one subnet in different Availability Zones (as supported by the service) to help ensure that your interface endpoint is resilient to Availability Zone failures. In that case, we create an endpoint network interface in each subnet that you specify.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; An endpoint network interface is a requester-managed network interface. You can view it in your account, but you cannot manage it yourself. For more information, see Elastic Network Interfaces.&lt;/p&gt; 
+&lt;p&gt;3. Specify the security groups to associate with the endpoint network interface. The security group rules control the traffic to the endpoint network interface from resources in your VPC. If you do not specify a security group, we associate the default security group for the VPC.&lt;/p&gt; 
+&lt;p&gt;4. (Optional, AWS services and AWS Marketplace Partner services only) Enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.&lt;/p&gt; 
+&lt;p&gt;Important&lt;br&gt; Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.&lt;/p&gt; 
+&lt;p&gt;Private DNS is enabled in the other subnets which are in the same VPC and Availability Zone or Local Zone.&lt;/p&gt; 
+&lt;p&gt;5. When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.&lt;/p&gt; 
+&lt;p&gt;6. After you create the interface endpoint, it's available to use when it's accepted by the service provider. The service provider must configure the service to accept requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using CloudWatch and CloudWatch Synthetics with Interface VPC Endpoints" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Viewing your interface endpoint&lt;br /&gt;
+After you've created an interface endpoint, you can view information about it using the Console or the Command line.&lt;/p&gt;
+
+	&lt;p&gt;To view information about an interface endpoint using the console:&lt;/p&gt;
+
+	&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Endpoints and select your interface endpoint.&lt;/p&gt;
+
+	&lt;p&gt;3. To view information about the interface endpoint, choose Details. The DNS Names field displays the DNS names to use to access the service.&lt;/p&gt;
+
+	&lt;p&gt;4. To view the subnets in which the interface endpoint has been created, and the ID of the endpoint network interface in each subnet, choose Subnets.&lt;/p&gt;
+
+	&lt;p&gt;5. To view the security groups that are associated with the endpoint network interface, choose Security Groups.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH1" name="Control access to Amazon CloudWatch resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Control access to Amazon CloudWatch resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles), and some services (such as AWS Lambda) also support attaching permissions policies to resources.&lt;br&gt; Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. CloudWatch supports only identity-based policies.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following shows an example of a permissions policy.&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", &lt;a&gt;Statement&lt;/a&gt; &lt;a&gt;Effect&lt;/a&gt;"Allow", &lt;a&gt;Action&lt;/a&gt;"cloudwatch:GetMetricStatistics","cloudwatch:ListMetrics"], &lt;a&gt;Resource&lt;/a&gt;"*", &lt;a&gt;Condition&lt;/a&gt; &lt;a&gt;Bool&lt;/a&gt; &lt;a&gt;aws:SecureTransport&lt;/a&gt;"true" } } } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;This sample policy has one statement that grants permissions to a group for two CloudWatch actions (cloudwatch:GetMetricStatistics, and cloudwatch:ListMetrics), but only if the group uses SSL with the request (&lt;a&gt;aws:SecureTransport&lt;/a&gt;"true").&lt;/p&gt; 
+&lt;p&gt;For further information please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Overview of Managing Access Permissions to Your CloudWatch Resources" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-access-control-overview-cw.html"/>
+            <reference name="Sharing CloudWatch Dashboards" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-identity-based-access-control-cw.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.270">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.1" name="Create a SNS topic for sending out notifications from Cloudtwatch Alarms" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  For the Cloudwatch alarms and Auto-Scaling Groups to be able to send out notifications, a SNS topic should be created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  When using Amazon SNS, you (as the owner) create a topic and control access to it by defining policies that determine which publishers and subscribers can communicate with the topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Cloudwatch alarms and certain actions inside Auto-Scaling Groups needs to be sent out to administrators, in order to be acted upon. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new topic, and note the topic-arn value:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a subscription to the new topic:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: sns get topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/get-topic-attributes.html"/>
+            <reference name="Amazon docs: sns list subscriptions by topic" url="https://docs.aws.amazon.com/cli/latest/reference/sns/list-subscriptions-by-topic.html"/>
+            <reference name="Amazon docs: sns set topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/create-topic.html"/>
+            <reference name="Amazon docs: sns subscribe" url="https://docs.aws.amazon.com/cli/latest/reference/sns/subscribe.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all cloudwatch alarms and filter by alarm action (review &amp;quot;AlarmActions&amp;quot;: []):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch describe-alarms --query 'MetricAlarms[*].{AlarmName:AlarmName, AlarmActions:AlarmActions, Dimensions:Dimensions}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List SNS topic attributes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns list-topic-attributes --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List SNS topic subscriptions (endpoint which receives messages captured by the SNS topic):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH4" name="Create CloudWatch Alarms based on Anomaly Detection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create CloudWatch Alarms based on Anomaly Detection&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; When you enable anomaly detection for a metric, CloudWatch applies statistical and machine learning algorithms. These algorithms continuously analyze metrics of systems and applications, determine normal baselines, and surface anomalies with minimal user intervention.&lt;br&gt; You can create an alarm based on CloudWatch anomaly detection, which mines past metric data and creates a model of expected values. The expected values take into account the typical hourly, daily, and weekly patterns in the metric.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alarm based on anomaly detection&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Alarms, Create Alarm.&lt;/p&gt; 
+&lt;p&gt;3. Choose Select Metric and do one of the following:&lt;/p&gt; 
+&lt;p&gt;- Choose the service namespace that contains the metric that you want. To narrow the choices, continue choosing options as they appear. When a list of metrics appears, select the check box next to the metric that you want.&lt;/p&gt; 
+&lt;p&gt;- In the search box, enter the name of a metric, dimension, or resource ID and press Enter. Then choose one of the results and continue until a list of metrics appears. Select the check box next to the metric that you want.&lt;/p&gt; 
+&lt;p&gt;4. Choose the Graphed metrics tab.&lt;/p&gt; 
+&lt;p&gt;a. Under Statistic , choose one of the statistics or predefined percentiles, or specify a custom percentile (for example, p95.45).&lt;/p&gt; 
+&lt;p&gt;b. Under Period, choose the evaluation period for the alarm. When evaluating the alarm, each period is aggregated into one data point. For anomaly detection alarms, the value must be one minute or longer.&lt;/p&gt; 
+&lt;p&gt;You can also choose whether the y-axis legend appears on the left or right while you're creating the alarm. This preference is used only while you're creating the alarm.&lt;/p&gt; 
+&lt;p&gt;c. Choose Select metric.&lt;/p&gt; 
+&lt;p&gt;The Specify metric and conditions page appears, showing a graph and other information about the metric and statistic you have selected.&lt;/p&gt; 
+&lt;p&gt;5. Under Conditions, specify the following:&lt;/p&gt; 
+&lt;p&gt;a. Choose Anomaly detection.&lt;/p&gt; 
+&lt;p&gt;If the model for this metric and statistic already exists, CloudWatch displays the anomaly detection band in the sample graph at the top of the screen. If the model does not already exist, the model will be generated when you finish creating the alarm. It takes up to 15 minutes for the actual anomaly detection band generated by the model to appear in the graph. Before that, the band you see is an approximation of the anomaly detection band. To see the graph in a longer time frame, choose Edit at the top right of the page.&lt;/p&gt; 
+&lt;p&gt;b. For Whenever metric is, specify whether the metric must be greater than, lower than, or outside (in either direction) the band to trigger the alarm.&lt;/p&gt; 
+&lt;p&gt;c. For Anomaly detection threshold, choose the number to use for the anomaly detection threshold. A higher number creates a thicker band of "normal" values that is more tolerant of metric changes, and a lower number creates a thinner band that will go to ALARM state with smaller metric deviations. The number does not have to be a whole number.&lt;/p&gt; 
+&lt;p&gt;d. Choose Additional configuration. For Datapoints to alarm, specify how many evaluation periods (data points) must be in the ALARM state to trigger the alarm. If the two values here match, you create an alarm that goes to ALARM state if that many consecutive periods are breaching.&lt;/p&gt; 
+&lt;p&gt;To create an M out of N alarm, specify a lower number for the first value than you specify for the second value. For more information, see Evaluating an Alarm.&lt;/p&gt; 
+&lt;p&gt;e. For Missing data treatment, choose how to have the alarm behave when some data points are missing. For more information, see Configuring How CloudWatch Alarms Treat Missing Data.&lt;/p&gt; 
+&lt;p&gt;f. If the alarm uses a percentile as the monitored statistic, a Percentiles with low samples box appears. Use it to choose whether to evaluate or ignore cases with low sample rates. If you choose ignore (maintain alarm state), the current alarm state is always maintained when the sample size is too low. For more information, see Percentile-Based CloudWatch Alarms and Low Data Samples.&lt;/p&gt; 
+&lt;p&gt;6. Choose Next.&lt;/p&gt; 
+&lt;p&gt;7. Under Notification, select an SNS topic to notify when the alarm is in ALARM state, OK state, or INSUFFICIENT_DATA state.&lt;/p&gt; 
+&lt;p&gt;To have the alarm send multiple notifications for the same alarm state or for different alarm states, choose Add notification.&lt;/p&gt; 
+&lt;p&gt;To have the alarm not send notifications, choose Remove.&lt;/p&gt; 
+&lt;p&gt;8. To have the alarm perform EC2 actions when it changes state or create a Systems Manager OpsItem when it goes into ALARM state, choose the appropriate button and choose the alarm state and action to perform.&lt;/p&gt; 
+&lt;p&gt;9. When finished, choose Next.&lt;/p&gt; 
+&lt;p&gt;10. Enter a name and description for the alarm. The name must contain only ASCII characters. Then choose Next.&lt;/p&gt; 
+&lt;p&gt;11. Under Preview and create, confirm that the information and conditions are what you want, then choose Create alarm.&lt;/p&gt; 
+&lt;p&gt;Modifying an Anomaly Detection Model&lt;/p&gt; 
+&lt;p&gt;Once you have created an alarm, you can adjust the anomaly detection model. You can exclude certain time periods from being used in the model creation. It is critical that you exclude unusual events such as system outages, deployments, and holidays from the training data. You can also specify whether to adjust the model for daylight savings time changes.&lt;/p&gt; 
+&lt;p&gt;To adjust the anomaly detection model for an alarm&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Alarms.&lt;/p&gt; 
+&lt;p&gt;3. Choose the name of the alarm. Use the search box to find the alarm if necessary.&lt;/p&gt; 
+&lt;p&gt;4. Choose View in metrics.&lt;/p&gt; 
+&lt;p&gt;5. In the lower part of the screen, choose Edit model.&lt;/p&gt; 
+&lt;p&gt;6. To exclude a time period from being used to produce the model, choose Add another time range to exclude from training. Then select or enter the days and times to exclude from training, and choose Apply.&lt;/p&gt; 
+&lt;p&gt;7. If the metric is sensitive to daylight savings time changes, select the appropriate time zone in the Metric timezone box.&lt;/p&gt; 
+&lt;p&gt;8. Choose Update.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Using anomaly detection models for alarms incurs charges on your AWS account.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Creating a CloudWatch Alarm Based on Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Anomaly_Detection_Alarm.html"/>
+            <reference name="Using CloudWatch Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have created Anomaly Detection alarms properly.&lt;/p&gt;
+
+	&lt;p&gt;After you create a model, it constantly updates itself, using the latest data from the metric.&lt;/p&gt;
+
+	&lt;p&gt;After you enable anomaly detection on a metric, you can choose to exclude specified time periods of the metric from being used to train the model. This way, you can exclude deployments or other unusual events from being used for model training, ensuring the most accurate model is created.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH2" name="Follow the security best practices for CloudWatch Synthetics Canaries" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Follow the security best practices for CloudWatch Synthetics Canaries&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries follow the same routes and perform the same actions as a customer, which makes it possible for you to continually verify your customer experience even when you don't have any customer traffic on your applications.&lt;br&gt; However, there are several security issues that you should consider when creating and running canaries in Synthetics. AWS recommends to follow the undermentioned security best practices.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following sections explain security issues that you should consider when creating and running canaries in Synthetics.&lt;/p&gt; 
+&lt;p&gt;Use Secure Connections&lt;/p&gt; 
+&lt;p&gt;Because canary code and the results from canary test runs can contain sensitive information, do not have your canary connect to endpoints over unencrypted connections. Always use encrypted connections, such as those that begin with https://.&lt;/p&gt; 
+&lt;p&gt;Canary Naming Considerations&lt;/p&gt; 
+&lt;p&gt;The Amazon Resource Name (ARN) of a canary is included in the user-agent header as a part of outbound calls made from the Puppeteer-driven Chromium browser that is included as a part of the CloudWatch Synthetics wrapper library. This helps identify CloudWatch Synthetics canary traffic and relate it back to the canaries that are making calls.&lt;/p&gt; 
+&lt;p&gt;The canary ARN includes the canary name. Choose canary names that do not reveal proprietary information.&lt;/p&gt; 
+&lt;p&gt;Additionally, be sure to point your canaries only at websites and endpoints that you control.&lt;/p&gt; 
+&lt;p&gt;Secrets in Canary Code&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you don't include secrets, such as access keys or database credentials, in your canary source code.&lt;/p&gt; 
+&lt;p&gt;Permissions Considerations&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you restrict access to resources that are created or used by CloudWatch Synthetics. Use tight permissions on the Amazon S3 buckets where canaries store test run results and other artifacts, such as logs and screenshots.&lt;/p&gt; 
+&lt;p&gt;Similarly, keep tight permissions on the locations where your canary source code is stored, so that no user accidentally or maliciously deletes the Lambda layers or Lambda functions used for the canary.&lt;/p&gt; 
+&lt;p&gt;To help make sure you run the canary code you intend, you can use object versioning on the Amazon S3 bucket where your canary code is stored. Then when you specify this code to run as a canary, you can include the object versionId as part of the path, as in the following examples:&lt;/p&gt; 
+&lt;p&gt;https://bucket.s3.amazonaws.com/path/object.zip?versionId=version-id&lt;br&gt; https://s3.amazonaws.com/bucket/path/object.zip?versionId=version-id&lt;br&gt; https://bucket.s3-region.amazonaws.com/path/object.zip?versionId=version-id&lt;/p&gt; 
+&lt;p&gt;Stack Traces and Exception Messages&lt;/p&gt; 
+&lt;p&gt;By default, CloudWatch Synthetics canaries capture any exception thrown by your canary script, no matter whether the script is custom or is from a blueprint. CloudWatch Synthetics logs both the exception message and the stack trace to three locations:&lt;/p&gt; 
+&lt;p&gt;- Back into the CloudWatch Synthetics service to speed up debugging when you describe test runs&lt;/p&gt; 
+&lt;p&gt;- Into CloudWatch Logs according to the configuration that your Lambda functions are created with&lt;/p&gt; 
+&lt;p&gt;- Into the Synthetics log file, which is a plaintext file that is uploaded to the Amazon S3 location specified by the value you set for the resultsLocation of the canary&lt;/p&gt; 
+&lt;p&gt;If you want to send and store less information, you can capture exceptions before they return to the CloudWatch Synthetics wrapper library.&lt;/p&gt; 
+&lt;p&gt;Scope Your IAM Roles Narrowly&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you do not configure your canary to visit potentially malicious URLs or endpoints. Pointing your Canary to untrusted or unknown websites or endpoints could expose your Lambda function code to malicious user's scripts. Assuming a malicious website can break out of Chromium, it could have access to your Lambda code in a similar way to if you connected to it using an internet browser.&lt;/p&gt; 
+&lt;p&gt;Run your Lambda function with an IAM execution role that has scoped-down permissions. This way, if your Lambda function is compromised by a malicious script, it is limited in the actions it can take when running as your canary's AWS account.&lt;/p&gt; 
+&lt;p&gt;When you use the CloudWatch console to create a canary, it is created with a scoped-down IAM execution role.&lt;/p&gt; 
+&lt;p&gt;Header Logging&lt;/p&gt; 
+&lt;p&gt;By default, canary header logging logs only the request URL, response code, and response status. Within your canary script, you can customize the logging to log more or less information.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Considerations for Synthetics Canaries" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/servicelens_canaries_security.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are following security best practices for CloudWatch Synthetics Canaries.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.355">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH6" name="Use CloudWatch Agent to collect system-level metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use CloudWatch Agent to collect system-level metrics&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The unified CloudWatch agent enables you to do the following:&lt;/p&gt; 
+&lt;p&gt;- Collect internal system-level metrics from Amazon EC2 instances across operating systems. The metrics can include in-guest metrics, in addition to the metrics for EC2 instances. The additional metrics that can be collected are listed in Metrics Collected by the CloudWatch Agent.&lt;/p&gt; 
+&lt;p&gt;- Collect system-level metrics from on-premises servers. These can include servers in a hybrid environment as well as servers not managed by AWS.&lt;/p&gt; 
+&lt;p&gt;- Retrieve custom metrics from your applications or services using the StatsD and collectd protocols. StatsD is supported on both Linux servers and servers running Windows Server. collectd is supported only on Linux servers.&lt;/p&gt; 
+&lt;p&gt;- Collect logs from Amazon EC2 instances and on-premises servers, running either Linux or Windows Server.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Installation Process Overview&lt;/p&gt; 
+&lt;p&gt;You can download and install the CloudWatch agent manually using the command line, or you can integrate it with SSM. The general flow of installing the CloudWatch agent using either method is as follows:&lt;/p&gt; 
+&lt;p&gt;1. Create IAM roles or users that enable the agent to collect metrics from the server and optionally to integrate with AWS Systems Manager.&lt;/p&gt; 
+&lt;p&gt;2. Download the agent package.&lt;/p&gt; 
+&lt;p&gt;3. Modify the CloudWatch agent configuration file and specify the metrics that you want to collect.&lt;/p&gt; 
+&lt;p&gt;4. Install and start the agent on your servers. As you install the agent on an EC2 instance, you attach the IAM role that you created in step 1. As you install the agent on an on-premises server, you specify a named profile that contains the credentials of the IAM user that you created in step 1.&lt;/p&gt; 
+&lt;p&gt;For further information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Please follow Reference URL to check for Supported Operating Systems.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Collecting Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify That the CloudWatch Agent Is Running&lt;/p&gt;
+
+	&lt;p&gt;You can query the CloudWatch agent to find whether it's running or stopped. You can use AWS Systems Manager to do this remotely. You can also use the command line, but only to check the local server.&lt;/p&gt;
+
+	&lt;p&gt;To query the status of the CloudWatch agent using Run Command&lt;/p&gt;
+
+	&lt;p&gt;1. Open the Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Run Command.&lt;/p&gt;
+
+	&lt;p&gt;&lt;del&gt;or&lt;/del&gt;&lt;/p&gt;
+
+	&lt;p&gt;If the AWS Systems Manager home page opens, scroll down and choose Explore Run Command.&lt;/p&gt;
+
+	&lt;p&gt;3. Choose Run command.&lt;/p&gt;
+
+	&lt;p&gt;4. In the Command document list, choose the button next to AmazonCloudWatch-ManageAgent.&lt;/p&gt;
+
+	&lt;p&gt;5. In the Action list, choose status.&lt;/p&gt;
+
+	&lt;p&gt;6. For Optional Configuration Source choose default and keep Optional Configuration Location blank.&lt;/p&gt;
+
+	&lt;p&gt;7. In the Target area, choose the instance to check.&lt;/p&gt;
+
+	&lt;p&gt;8. Choose Run.&lt;/p&gt;
+
+	&lt;p&gt;If the agent is running, the output resembles the following.&lt;/p&gt;
+
+	&lt;p&gt;{
+       "status": "running",
+       "starttime": "2017-12-12T18:41:18",
+       "version": "1.73.4"&lt;br /&gt;
+}&lt;/p&gt;
+
+	&lt;p&gt;If the agent is stopped, the "status" field displays "stopped".&lt;/p&gt;
+
+
+	&lt;p&gt;To query the status of the CloudWatch agent locally using the command line&lt;/p&gt;
+
+	&lt;p&gt;- On a Linux server, enter the following:&lt;/p&gt;
+
+	&lt;p&gt;sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status&lt;/p&gt;
+
+	&lt;p&gt;- On a server running Windows Server, enter the following in PowerShell as an administrator:&lt;/p&gt;
+
+	&lt;p&gt;&amp;amp; $Env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1 -m ec2 -a status&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.303">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH5" name="Use CloudWatch metric streams" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use CloudWatch metric streams&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use metric streams to continually stream CloudWatch metrics to a destination of your choice, with near-real-time delivery and low latency. Supported destinations include AWS destinations such as Amazon Simple Storage Service and several third-party service provider destinations.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to use the CloudWatch console to set up a metric stream to another AWS service&lt;/p&gt; 
+&lt;p&gt;When you use the console to set up a metric stream, you have the option of choosing the Quick S3 Setup. This method works well if want the final output as JSON or to be queried by Amazon Athena. If you want the final format to be Parquet format or Optimized Row Columnar (ORC), you should create your own Kinesis Data Firehose delivery stream and choose Select an existing Firehose owned by your account instead of choosing Quick S3 Setup.&lt;/p&gt; 
+&lt;p&gt;To set up a metric stream to an AWS service&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Streams, Create stream.&lt;/p&gt; 
+&lt;p&gt;3. Choose the CloudWatch metric namespaces to include in the metric stream.&lt;/p&gt; 
+&lt;p&gt;- To include all or most of your metric namespaces in the metric stream, choose All metrics.&lt;/p&gt; 
+&lt;p&gt;Then, if you want to exclude some metric namespaces from the stream, choose Exclude metric namespaces and select the namespaces to exclude.&lt;/p&gt; 
+&lt;p&gt;- To include only a few metric namespaces in the metric stream, choose Selected namespaces and then select the namespaces to include.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt; 
+&lt;p&gt;4. Choose one of the following:&lt;/p&gt; 
+&lt;p&gt;- For a quick setup, choose Quick S3 setup. CloudWatch will create all necessary resources including the Kinesis Data Firehose delivery stream and the necessary IAM roles. The default format for this option is JSON, but you can change the format later in this procedure.&lt;/p&gt; 
+&lt;p&gt;- To use a Kinesis Data Firehose delivery stream that already exists, choose Select an existing Firehose owned by your account. The Kinesis Data Firehose delivery stream must be in the same account. The default format for this option is OpenTelemetry, but you can change the format later in this procedure.&lt;/p&gt; 
+&lt;p&gt;Then select the Kinesis Data Firehose delivery stream to use under Select your Kinesis Data Firehose delivery stream.&lt;/p&gt; 
+&lt;p&gt;5. (Optional) If you're using Quick S3 Setup, you can choose Select existing resources to use an existing S3 bucket or existing IAM roles instead of having CloudWatch create new ones for you.&lt;/p&gt; 
+&lt;p&gt;6. (Optional) If you're using Select an existing Firehose owned by your account, you can choose Select existing service role to use an existing IAM role instead of having CloudWatch create a new one for you.&lt;/p&gt; 
+&lt;p&gt;7. (Optional) To change the output format from the default format for your scenario, choose Change output format. The supported formats are JSON and OpenTelemetry 0.7.0.&lt;/p&gt; 
+&lt;p&gt;8. (Optional) Customize the name of the new metric stream under Metric stream name.&lt;/p&gt; 
+&lt;p&gt;9. Choose Create metric stream.&lt;/p&gt; 
+&lt;p&gt;Setting up a metric stream to a third-party solution&lt;/p&gt; 
+&lt;p&gt;To set up a CloudWatch metric stream to stream metrics to a third-party solution, follow the instructions provided by that third-party provider.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Metric stream operation and maintenance" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-operation.html"/>
+            <reference name="Using metric streams" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metric-Streams.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Metric streams are always in one of two states, Running or Stopped.&lt;/p&gt;
+
+	&lt;p&gt;Running - The metric stream is running correctly. There might not be any metric data streamed to the destination because of the filters on the stream.&lt;/p&gt;
+
+	&lt;p&gt;Stopped - The metric stream has been explicitly stopped by someone, and not because of an error. It might be useful to stop your stream to temporarily pause the streaming of data without deleting the stream.&lt;/p&gt;
+
+	&lt;p&gt;If you stop and restart a metric stream, the metric data that was published to CloudWatch while the metric stream was stopped is not backfilled to the metric stream.&lt;/p&gt;
+
+	&lt;p&gt;If you change the output format of a metric stream, in certain cases you might see a small amount of metric data written to the destination in both the old format and the new format. To avoid this situation, you can create a new Kinesis Data Firehose delivery stream with the same configuration as your current one, then change to the new Kinesis Data Firehose delivery stream and change the output format at the same time. This way, the Kinesis records with different output format are stored on Amazon S3 in separate objects. Later, you can direct the traffic back to the original Kinesis Data Firehose delivery stream and delete the second delivery stream.&lt;/p&gt;
+
+	&lt;p&gt;To view, edit, stop, and start your metric streams&lt;/p&gt;
+
+	&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Streams.&lt;/p&gt;
+
+	&lt;p&gt;The list of streams appears, and the Status column displays whether each stream is running or stopped.&lt;/p&gt;
+
+	&lt;p&gt;3. To stop or start a metric stream, select the stream and choose Stop or Start.&lt;/p&gt;
+
+	&lt;p&gt;4. To see the details about a metric stream, select the stream and choose View details.&lt;/p&gt;
+
+	&lt;p&gt;5. To change the stream's output format, filters, destination Kinesis Data Firehose stream, or roles, choose Edit and make the changes that you want.&lt;/p&gt;
+
+	&lt;p&gt;If you change the filters, there might be some gaps in the metric data during the transition.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.316">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
+                    <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
+                    <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
+                    <countermeasure ref="aws-tier-4.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
+                <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
+                <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
+                <countermeasure ref="aws-tier-4.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
+                <countermeasure ref="AWS-VPC5" mitigation="34"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6752527a-61a6-45fd-b5e1-38cd8d0c5ae6" diagramComponentId="c1a1276f-411a-4aeb-818c-a4b605112c51" ref="88ead499-6db6-4ecb-96d9-363b587ed0d5" name="AWS Account Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-Logging-3.3" name="Audit logs are accesible" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The audit logs are not encrypted and they can be accessed by attackers and obtain sensitive data
+                        in clear text.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.5" name="Brute force attempts on the Amazon management console cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The failure connection attempts (brute force) must be audited and monitored and the
+                        correspondent personnel must be alerted and informed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.12" name="Changes in the network configuration cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The changes in the network configurations (NACLs, route and gateway tables) are not detected
+                        because the monitorization and alerts of the network configuration are not configured to detect
+                        these changes.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.4" name="Changes in the security configurations can be not detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Monitoring and alerting for security configurations are not configured and changes cannot be
+                        detected.&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.10" name="Changes in the security groups cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the security groups must be audited and monitored and the correspondent
+                        personnel must approve these changes. If the situation is not the correct, attackers can access
+                        to security systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="cloudwatch-misconfig" name="Cloudwatch is misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T13:52:40.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.3" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login to the console without using the Multi-factor Authentication (MFA) and they are not
+                        detected. The connection without the MFA must be audited and monitored, the correct security
+                        group must be informed and they must validate this connection.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:15.193">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.1" name="Non-auditable API calls in all regions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The API call to the resources is not audited and the actions are not recorded into the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.8" name="Non-centrality audit logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The audit logs are not stored in a central system. Therefore, the audit logs cannot be
+                        exploited correctly by the security personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator account is not configured. The security question to recover or reset the
+                        password and the authentication method are not configured.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:26.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-1.21" name="The access keys are generated when the setup of the users is started" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The system doesn't require additional steps to create access keys, the access keys are
+                        generating when the process to create an user is starting. The problem is that these keys can be
+                        in use somewhere in the organization and maybe these keys are not necessary for the user.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EXPIRATION-DATE" name="The password expiration is not established" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.9" name="The security policies are exposed in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not configured and the security configurations are exposed for the
+                        attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.7" name="Unaudited connections with the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The connections with the applications and with the databases cannot be audited and not
+                        detected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.9" name="Unaudited resources changes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the applications and in the databases and these changes are not detected and
+                        not audited.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.685">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.12" name="Apply an AWS Managed Config Rule for EIPs attached to EC2 instances within VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources. You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Description": "Checks whether all EIP addresses allocated to a VPC are attached to 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    EC2 instances or in-use ENIs.", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ConfigRuleName": "eip-attached", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Source": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Owner": "AWS", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "SourceIdentifier": "EIP_ATTACHED" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Scope": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ComplianceResourceTypes": [ 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "AWS::EC2::EIP" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    ] 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe config rules" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"/>
+            <reference name="Put config rule" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/put-config-rule.html"/>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for a Config Rule that checks whether all EIP addresses allocated to a VPC are attached to EC2 instances or in-use ENIs:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'EIP_ATTACHED']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:48:26.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.3-2.4" name="Apply an IAM Role for Amazon EC2 Tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      } 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Web tier EC2 instances, check if and which IAM instance profile they have attached, and note the name of the instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-instances --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Reservations[*].Instances[*].{IamInstanceProfile:IamInstanceProfile, InstanceId:InstanceId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:47:29.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.1-2.2" name="Apply IAM Policy for EC2 IAM Roles for tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles defined with AWS Identity Access Management. An IAM policy is a document that formally states one or more permissions using the following structure:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Actions: what actions are allowed (each AWS service has its own set of actions)&lt;/li&gt; 
+  &lt;li&gt;Resources: which resources will be affected by the action&lt;/li&gt; 
+  &lt;li&gt;Effect: what effect will be when the subject (user/group/roles) requests access Policies are documents that are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;b&gt;Remediation&lt;/b&gt;: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM managed policy for Web tier instances, and note the policy ARN:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-policy --policy-name &amp;lt;iam_policy_name&amp;gt; --policy-document file://policy 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the IAM policy created to the Web tier IAM role:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --rolename &amp;lt;web_tier_iam_role&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="Get policy version" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html"/>
+            <reference name="List attached role policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-role-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check managed policies attached to the IAM role, and note the policies ARN:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-attached-role-policies --role-name &amp;lt;web_tier_iam_role&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the version of the IAM policies attached to the IAM role:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --query "Policy.DefaultVersionId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the document policy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;iam_policy_arn&amp;gt; --version-id &amp;lt;iam_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:34:12.746">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select the user.&lt;/li&gt; 
+   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ol&gt;Create a Group and add a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
+  &lt;li&gt;Click Create Group.&lt;/li&gt; 
+  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-attached-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
+  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
+  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
+  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
+  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
+  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
+  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
+                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
+                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
+                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
+                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
+                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
+                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
+                            ALLOW.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.703">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.5-2.6" name="Configure AutoScaling Group Launch Configuration for Tier to use a customer created IAM Role" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  *Note: references to Web tier are also applicable to App tier. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the Web tier IAM instance profile :&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if your Web tier autoscaling group is using a launch configuration with an IAM instance profile configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query "LaunchConfigurations[*].IamInstanceProfile" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:55:23.427">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM1" name="Configure contact email and telephone details on AWS accounts" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.&lt;/p&gt;&lt;p&gt;An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, next to Account Settings, choose Edit.&lt;/li&gt;&lt;li&gt;Next to the field that you need to update, choose Edit.&lt;/li&gt;&lt;li&gt;After you have entered your changes, choose Save changes.&lt;/li&gt;&lt;li&gt;After you have made your changes, choose Done.&lt;/li&gt;&lt;li&gt;To edit your contact information, under Contact Information, choose Edit.&lt;/li&gt;&lt;li&gt;For the fields that you want to change, type your updated information, and then choose Update.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, review and verify the current details.&lt;/li&gt;&lt;li&gt;Under Contact Information, review and verify the current details.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.232">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.11" name="Configure password expiration" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Change access keys regularly, and make sure that all IAM users in your account do as well. That way, if an access key is compromised without your knowledge, you limit how long the credentials can be used to access your resources. Credential reports can be used to determine how long access keys have been active for. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;Select the user you wish to rotate the key for.&lt;/li&gt; 
+  &lt;li&gt;Under access keys click &amp;quot;Create Access Key&amp;quot; (do not touch the existing key yet).&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Download credentials&amp;quot; or &amp;quot;Show credentials&amp;quot; so that you have a record of them.&lt;/li&gt; 
+  &lt;li&gt;Update any applications with the new credentials and test (we recommend to leave a few days or a week for testing).&lt;/li&gt; 
+  &lt;li&gt;Once complete complete 1-4 above and for the key which needs rotating click &amp;quot;Make Inactive | Delete&amp;quot; and click &amp;quot;Deactive&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Once you are confident you will no longer need the key (wait several more days) repeat 1-4 and select &amp;quot;Delete&amp;quot; for the inactive key.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Check the access keys created time: aws iam get-credential-report --query
+                            'Content' --output text | base64 -D | awk -F, '{print $1,$9,$10,$14,$15}'&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each access_key_1_active and access_key_9_active that is set to True ensure
+                            the created date is within the last 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.1" name="Configure the security challenge questions within the AWS Account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When an AWS account is initially created it is configured with a top level account known as the &amp;quot;root&amp;quot; account that has full administration access to all resources. In the event that the password or MFA device associated with this account is lost AWS support may recover it by asking you to answer the security questions. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;For each question:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select an appropriate question.&lt;/li&gt; 
+   &lt;li&gt;Enter an appropriate answer.&lt;/li&gt; 
+   &lt;li&gt;Follow the above process for all 3 questions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;Click Update when complete.&lt;/li&gt; 
+  &lt;li&gt;We recommend to store the questions and answers in a secure location such as a safe where they can be used in case recovery is required.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether questions and answers have been saved.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.7" name="Create a Cloudwatch Alarm and its action for the &quot;VPC Flow Logs&quot; metric filter" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt;
+   A Cloudwatch alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The Cloudwatch Alarm will trigger a notification being sent to the administrators every time the "REJECT packets" specified threshold is reached. The alarm should be created for the "VPC Flow Logs" metric, and the action should have a SNS topic configured.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch alarm for the VPC Flow Logs metric, and configure an Alarm Action:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws cloudwatch put-metric-alarm --alarm-name &amp;lt;vpc_flow_log_alarm_name&amp;gt; --alarm-actions &amp;lt;sns_topic_arn&amp;gt; --metric-name &amp;lt;vpc_flow_log_metric_name&amp;gt; --namespace LogMetrics --statistic &amp;lt;desired_statistic&amp;gt; --period &amp;lt;desired_period&amp;gt; --evaluation-periods &amp;lt;desired_evaluation_periods&amp;gt; --threshold &amp;lt;desired_threshold&amp;gt; --comparison-operator &amp;lt;desired_operator&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe alarms" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"/>
+            <reference name="Put metric alarm" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html"/>
+          </references>
+          <standards>
+            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Cloudwatch alarms configured for the VPC Flow Logs metric, and check if an Alarm Action is configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch describe-alarms --query "MetricAlarms[?MetricName =='&amp;lt;vpc_flow_log_metric_name&amp;gt;'].{MetricName:MetricName,AlarmActions:AlarmActions,AlarmName:AlarmName}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:51:42.064">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.6" name="Create a log metric filter for the Cloudwatch group assigned to the &quot;VPC Flow Logs&quot;" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Description:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  This recommendation builds upon the Foundation benchmark recommendation: "Ensure VPC Flow Logging is Enabled in all Applicable Regions"&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  VPC flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. VPC flow logs can capture accepted traffic, rejected traffic, or all traffic.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Metric filters can be used to express how the service would extract metric observations from ingested events and transform them to data points in a CloudWatch metric. Metric filters are assigned to log groups, and all of the filters assigned to a log group are applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A metric filter should be created for counting how many IP packets are rejected in the VPC flow logs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a metric filter for the Cloudwatch Log group assigned to the "VPC Flow Logs":&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs put-metric-filter --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; --filter-name &amp;lt;vpc_flow_log_filter_name&amp;gt; --filter-pattern "{ $.errorCode =\"AccessDenied\" }" --metric-transformations metricName= &amp;lt;vpc_flow_log_metric_name&amp;gt;,metricNamespace=LogMetrics,metricValue=1 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"/>
+            <reference name="Filter log events" url="https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html"/>
+            <reference name="Put metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html"/>
+          </references>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface to check if the log metric filter: 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws logs describe-metric-filters --region &amp;lt;application_region&amp;gt; --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:48:32.261">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.7" name="Create an IAM group for administration purposes" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and should have administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new IAM group for administration purposes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-group --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attach the Admin policy to the administration IAM group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam attach-group-policy --policy-arn &amp;lt;admin_policy_arn&amp;gt; --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The name of the IAM admin group name should be known prior to auditing this recommendation. For a sample admin policy arn see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Attach group policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-group-policy.html"/>
+            <reference name="Create groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-group.html"/>
+            <reference name="List groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM groups created for administration purposes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-groups --query "Groups[?GroupName == '&amp;lt;iam_admin_group_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:59:51.981">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.8" name="Create an IAM policy that allows admin privileges for all services used" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A policy is a document that formally states one or more permissions.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies apply only to identities (users, groups, and roles) - not resources. You must ensure that you have an IAM managed policy created with admin permissions for all the AWS services used by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create an IAM managed admin policy for all AWS services used:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-policy --policy-name &amp;lt;admin_policy_name&amp;gt; --policy-document file://policy 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The admin policy should be defined prior to auditing and remediating this recommendation. For a sample admin policy see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM admin policies and note the policy ARN and DefaultVersionId:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-policies --query "Policies[?PolicyName == '&amp;lt;admin_policy_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If the policy exists, check the policy document:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;admin_policy_arn&amp;gt; --version-id &amp;lt;admin_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:02:44.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.20" name="Create an IAM role for managing incidents with AWS" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>WS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br /&gt;Using the Amazon unified command line interface, create an IAM role for managing incidents with AWS: 
+&lt;br /&gt; 
+&lt;br /&gt;Create a trust relationship policy document that allows &amp;lt;iam_user&amp;gt; to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: 
+&lt;br /&gt; 
+&lt;br /&gt;{ 
+&lt;br /&gt;&amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
+&lt;br /&gt;&amp;quot;Statement&amp;quot;: [{ 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Principal&amp;quot;: { 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;AWS&amp;quot;: &amp;quot;&amp;lt;iam_user&amp;gt;&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }, 
+&lt;br /&gt;&amp;nbsp; &amp;quot;Action&amp;quot;: &amp;quot;sts:AssumeRole&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }] 
+&lt;br /&gt;} 
+&lt;br /&gt; 
+&lt;br /&gt;Create the IAM role using the above trust policy: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam create-role --role-name &amp;lt;aws_support_iam_role&amp;gt; --assume-role-policy-document file:///tmp/TrustPolicy.json 
+&lt;br /&gt; 
+&lt;br /&gt;Attach 'AWSSupportAccess' managed policy to the created IAM role: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --role-name &amp;lt;aws_support_iam_role&amp;gt; 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="Amazon docs: list entities for policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html"/>
+            <reference name="Amazon docs: list policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+            <reference name="Amazon docs: managed policies and inline policies" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the &amp;quot;Arn&amp;quot; element value: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-policies --query &amp;quot;Policies[?PolicyName == 'AWSSupportAccess']&amp;quot; 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;Check if the 'AWSSupportAccess' is attached to any IAM user, group or role: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-entities-for-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; 
+            &lt;span style=" , Arial;"&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.026">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-3" name="Create AWS Organizations change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;organizations_changes&amp;gt;` --metric-transformations metricName= `&amp;lt;organizations_changes&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;organizations_changes&amp;gt;` --metric-name `&amp;lt;organizations_changes&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.359">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.8" name="Create billing alerts to identify unusual spend" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By setting billing alarms you can monitor your AWS spend and be alerted if it exceeds certain thresholds thus protecting you from accruing unnecessary charges. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the Receive Billing Alerts check box.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Choose Save preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia). The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, under "Metrics", choose "Billing".&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of billing metrics, select the check box next to Currency USD, for the metric named EstimatedCharges. Define the alarm as follows:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If you want the alarm to trigger as soon as you go over the free tier, set "When my total AWS charges for the month exceed" to $.01. This means that you'll receive a notification as soon as you incur a charge. Otherwise, set it to the amount you want to trigger the alarm, and you will be notified when you go over that amount.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose the "New list" link next to the "send a notification to" box.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;When prompted, enter your email address or choose your Amazon SNS notification from the drop down.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose "Create Alarm".&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;In the "Confirm new email addresses" dialog box, confirm the email address or choose "I will do it later". If you don't confirm the email address now, the alarm remains in the Pending confirmation status until you do so, and does not send an alert. To view the status of your alarm, choose "Alarms" in the navigation panel.&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management
+                            console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the &amp;quot;Receive Billing Alerts&amp;quot; check box is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia).
+                            The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, under &amp;quot;Alarms&amp;quot;, check for one called
+                            &amp;quot;Billing&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on the alert if it exists and select the checkbox in the first column.&lt;/li&gt;
+                            &lt;li&gt;In the preview pane check that the &amp;quot;EstimatedCharges&amp;quot; threshold
+                            is set to the correct value and that the &amp;quot;Actions&amp;quot; is send an alarm to a
+                            valid email address.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.4" name="Create cloudtrail configuration changes alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is changes to
+                        cloudtrail. Since cloudtrail is the actual utility logging API calls it's security is paramount
+                        to ensuring that this continues. Therefore alerting on changes to cloudtrail activity can
+                        prevent a malicious user switching off the logging in order to carry out untracked activities.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&amp;nbsp;&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;aws
+                        logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) ||
+                        ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName =
+                            DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.4-5.5" name="Create Cloudwatch Log Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS CloudWatch Log groups define groups of log streams that share the same retention, monitoring, and access control settings. Each log stream has to belong to one log group.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch log group for the Web tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs create-log-group --log-group-name &amp;lt;web_tier_log_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html"/>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs describe-log-groups --query "logGroups[?logGroupName =='&amp;lt;web_tier_log_group&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:24:18.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.6" name="Create IAM Policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is management IAM policy changes. IAM manages authorization and authentication controls with AWS and therefore it is vital that unauthorized changes are detected. Enabling monitoring of these changes ensures that these policies remain intact and as desired. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for IAM policy changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=Delete UserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=P utUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=Cr eatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)| |($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUs erPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above:aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource
+                            = kms.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))} }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.3" name="Create management console login alerts when MFA is not used" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is login on the
+                        console without MFA. Since logging on at the console should be restricted to only those users
+                        with an active MFA this alert will highlight those with password only access. This helps to
+                        capture weaker login procedures (password only) as they occur.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login without MFA: aws logs
+                        put-metric-filter --log-group-name &amp;lt;cloudwatch-logs-group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{
+                        $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot; }'&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot;
+                            }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.5" name="Create management console login failure alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is management
+                        console login failures. The management console is the AWS account GUI where administration
+                        activity is performed and is therefore a primary target for brute force attempts. To identify
+                        these attempts alerts for login failures should be enabled as this can highlight suspicious
+                        activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login failures: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = ConsoleLogin)
+                        &amp;amp;&amp;amp; ($.errorMessage = &amp;quot;Failed authentication&amp;quot;) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = ConsoleLogin) &amp;amp;&amp;amp; ($.errorMessage = \&amp;quot;Failed
+                            authentication\&amp;quot;) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-2" name="Create network gateways change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for network gateways changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;network_gw_changes_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;network_gw_changes_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;network_gw_changes_alarm&amp;gt;` --metric-name `&amp;lt;network_gw_changes_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.12" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.2" name="Create root account usage alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is usage of the
+                        root account. This account should not be used on a day to day basis due to its full unrestricted
+                        privilege therefore usage should be by exception. Monitoring this usage should capture any
+                        suspicious activity used on the account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws logs
+                        describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy NOT
+                        EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy
+                            NOT EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.8" name="Create s3 bucket policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is S3 bucket policy changes. S3 bucket policies are a resource based policy that provide authorizations on S3 buckets. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Making sure that their integrity remains intact is vital in ensuring the data within the S3 bucket remains secure and authorizations intact. Therefore s3 bucket policy changes should be alerted upon 
+ &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a metric filter that checks for S3 Bucket policy changes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;value&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS topic for notifications:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns create-topic --name &amp;lt;topic_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) ||
+                            ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName =
+                            PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName =
+                            DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName =
+                            DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.10" name="Create security group change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is security group changes. Security groups are analogous to firewalls and therefore protect inbound and outbound access to &amp;amp; from AWS resources such as ec2 instances and RDS databases (amongst other things. Therefore alerting on changes to security groups helps ensure that the resources protected by them are not exposed.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for security group changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
+                            AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName
+                            = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName =
+                            DeleteSecurityGroup)}&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-1" name="Create unauthorized API calls alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information, but gracefully fail if they don't have permissions.&lt;/p&gt;&lt;p&gt;If an excessive number of alerts are being generated then an organization may wish to consider adding read access to the limited IAM user permissions simply to quiet the alerts.&lt;/p&gt;&lt;p&gt;In some cases doing this may allow the users to actually view some areas of the system - any additional access given should be reviewed for alignment with the original limited IAM user intent.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for unauthorized API calls and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;unauthorized_api_calls_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.sourceIPAddress!="delivery.logs.amazonaws.com") || ($.eventName!="HeadBucket") }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;unauthorized_api_calls_alarm&amp;gt;` --metric-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.329">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.13" name="Create VPC gateway change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC gateway
+                        changes. VPC gateways are used as a means of sending traffic outside of a VPC (ie to the
+                        internet) and are vital in ensuring traffic flows to the correct destination. Therefore alerting
+                        on changes to VPC gateways ensuring traffic continues to flow as expected via the correct
+                        gateway.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC gateway changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateCustomerGateway)
+                        || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||
+                        ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName =
+                        DetachInternetGateway) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.14" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) ||
+                            ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) ||
+                            ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.11" name="Create VPC NACL change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC NACL
+                        changes. Network Access Control Lists (NACLS) control inbound and outbound access to &amp;amp;
+                        from AWS subnets and work like packet filters to protect the network. Therefore alerting on
+                        changes to NACLS helps ensure that the subnets protected by them are not exposed.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for NACL changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateNetworkAcl) ||
+                        ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =
+                        DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName =
+                        ReplaceNetworkAclAssociation) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) ||
+                            ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName =
+                            ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.12" name="Create VPC route table change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC route
+                        table changes. VPC route tables provide a means of routing network traffic between subnets and
+                        via gateways and ensures traffic flows via the correct path. Therefore alerting on changes to
+                        route tables ensuring traffic continues to flow as expected.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC route table changes: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateRoute)
+                        || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =
+                        ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute)
+                        || ($.eventName = DisassociateRouteTable) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.13" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName
+                            = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName =
+                            DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.6-5.7" name="Define a retention period for Cloudwatch log group in tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Retention period should be used to specify how long log events are kept in CloudWatch Logs. Expired log events get deleted automatically. Just like metric filters, retention settings are also assigned to log groups, and the retention assigned to a log group is applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Put a retention policy for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-retention-policy --log-group-name &amp;lt;web_tier_log_group&amp;gt; --retention-indays &amp;lt;log_retention_period&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  If the retention period is not configured then logs will be retained indefinitely with increasing cost. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+            <reference name="Put retention policy" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-retention-policy.html"/>
+          </references>
+          <standards>
+            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group, and check for the presence of "retentionInDays" element:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs describe-log-groups --query "logGroups[?logGroupName == 
+   &lt;/div&gt; 
+   &lt;div&gt;
+     '&amp;lt;web_tier_log_group&amp;gt;']" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:28:27.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM2" name="Disable credentials unused after 45 days" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to manage Unused Password (IAM user console access)&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select user whose Console last sign-in is greater than 45 days&lt;/li&gt;&lt;li&gt;Click Security credentials&lt;/li&gt;&lt;li&gt;In section Sign-in credentials, Console password click Manage&lt;/li&gt;&lt;li&gt;Under Console Access select Disable 10.Click Apply&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Perform the following to deactivate Access Keys:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have been used and&lt;ol&gt;&lt;li&gt;Click on Make Inactive&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have not been used and&lt;ol&gt;&lt;li&gt;Click the X to Delete&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine if unused credentials exist:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click the Settings (gear) icon.&lt;/li&gt;&lt;li&gt;Select Console last sign-in, Access key last used, and Access Key Id&lt;/li&gt;&lt;li&gt;Click on Close&lt;/li&gt;&lt;li&gt;Check and ensure that Console last sign-in is less than 45 days ago.&lt;ol&gt;&lt;li&gt;Note - Never means the user has never logged in.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Check and ensure that Access key age is less than 45 days and that Access key last used does not say None&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Download Credential Report:&lt;/p&gt;&lt;p&gt;1. Run the following commands:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam generate-credential-report&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure unused credentials do not exist:&lt;/p&gt;&lt;p&gt;2. For each user having password_enabled set to TRUE , ensure password_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When password_enabled is set to TRUE and password_last_used is set to No_Information , ensure password_last_changed is less than 45 days ago.&lt;/p&gt;&lt;p&gt;3. For each user having an access_key_1_active or access_key_2_active to TRUE , ensure the corresponding access_key_n_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When a user having an access_key_x_active (where x is 1 or 2) to TRUE and corresponding access_key_x_last_used_date is set to N/A', ensure access_key_x_last_rotated` is less than 45 days ago.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.245">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.21" name="Do not setup access keys during initial user setup for all IAM users that have a console password" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials, it also generates unnecessary management work in auditing and rotating these keys. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation: &lt;/b&gt; 
+&lt;br /&gt;Perform the following to delete access keys that do not pass the audit. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Login to the AWS Management Console.Click Services.&lt;/li&gt; 
+ &lt;li&gt;Click IAM&lt;/li&gt; 
+ &lt;li&gt;Click on Users.Click on Security Credentials.&lt;/li&gt; 
+ &lt;li&gt;As an Administrator.&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;br /&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; As an IAM User&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Via CLI:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;aws iam delete-access-key&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ol&gt; 
+&lt;span style="font-weight: bold;"&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform the following to determine if access keys are rotated as prescribed: 
+            &lt;br /&gt; 
+            &lt;ol&gt; 
+             &lt;li&gt;Login to the AWS Management Console&lt;/li&gt; 
+             &lt;li&gt;Click Services&lt;/li&gt; 
+             &lt;li&gt;Click IAM&lt;/li&gt; 
+             &lt;li&gt;Click on a User&lt;/li&gt; 
+             &lt;li&gt;Compare the user creation date to the key 1 creation date.&lt;/li&gt; 
+             &lt;li&gt;For any that match, the key was created during initial user setup.&lt;/li&gt; 
+            &lt;/ol&gt;Keys that were created at the same time as the user profile and do not have a last used date should be deleted. 
+            &lt;br /&gt; 
+            &lt;br /&gt;Via the CLI: 
+            &lt;br /&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam generate-credential-report 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;br /&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;The output of this command will produce a table similar to the following:&amp;nbsp;&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_ 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               key_2_active,access_key_2_last_used_date 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               elise,false,true,2015-04-16T15:14:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               brandon,true,true,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               rakesh,false,false,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               helene,false,true,2015-11-18T17:47:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;For any user having access_key_last_used_date set to N/A , ensure that access key is deleted&lt;/li&gt; 
+            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.039">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.058">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
+                        creates a digest for each log file it writes to S3. These digests can then be used to determine
+                        if a log has been modified since being written
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails&amp;nbsp;
+                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM6" name="Enable IAM Access Analyzer for all regions" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable IAM Access analyzer for IAM policies about all resources in each region.&lt;/p&gt;&lt;p&gt;IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM Access Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to enable IAM Access analyzer for IAM policies:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;Choose Access analyzer.&lt;/li&gt;&lt;li&gt;Choose Create analyzer.&lt;/li&gt;&lt;li&gt;On the Create analyzer page, confirm that the Region displayed is the Region where you want to enable Access Analyzer.&lt;/li&gt;&lt;li&gt;Enter a name for the analyzer. Optional as it will generate a name for you automatically.&lt;/li&gt;&lt;li&gt;Add any tags that you want to apply to the analyzer. Optional.&lt;/li&gt;&lt;li&gt;Choose Create Analyzer.&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer create-analyzer --analyzer-name &amp;lt;NAME&amp;gt; --type &amp;lt;ACCOUNT|ORGANIZATION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat this command above for each active region. Note: The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.20" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/&lt;/li&gt;&lt;li&gt;Choose Access analyzer&lt;/li&gt;&lt;li&gt;Click 'Analyzers'&lt;/li&gt;&lt;li&gt;Ensure that at least one analyzer is present&lt;/li&gt;&lt;li&gt;Ensure that the STATUS is set to Active&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run the following command:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer list-analyzers | grep status&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that at least one Analyzer the status is set to ACTIVE&lt;/p&gt;&lt;p&gt;3. Repeat the steps above for each active region.&lt;/p&gt;&lt;p&gt;If an Access analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.6" name="Enable S3 Bucket logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>S3 Bucket Access Logging generates log files that contain access records for each request made
+                        to an S3 bucket. By enabling this it is possible to capture events relating to the objects
+                        within that bucket thus helping to capture potential security issues or identifying threats. It
+                        is recommended to enable S3 bucket logging on any S3 bucket that contains sensitive data and
+                        stored the logs in a separate bucket for security analysis.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                        &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&lt;/li&gt;
+                        &lt;li&gt;Click on Properties in the top right of the console.&lt;/li&gt;
+                        &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                        &lt;li&gt;Click on the &amp;quot;Enabled&amp;quot; checkbox.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Bucket&amp;quot; to store the logs.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Prefix&amp;quot; for the logs.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                            &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on Properties in the top right of the console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Enabled&amp;quot; is checked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.5" name="Encrypt CloudTrail logs using KMS" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon
+                        server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security
+                        layer that is directly manageable, you can instead use server-side encryption with AWS
+                        KMS-managed
+                        keys (SSE-KMS) for your CloudTrail log files. This provides several advantages:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across
+                        all regions.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail
+                        log files.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can assign permissions for the key to the users in your organization according to
+                        your requirements.&lt;/li&gt;
+                        &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now
+                        need to meet two conditions:&amp;nbsp;&lt;/li&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;you must have S3 read permission on the bucket, and&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;you must be granted decrypt permission by the CMK policy.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ul&gt;Because S3 automatically decrypts the log files for requests from users authorized to
+                        use the CMK, SSE-KMS encryption for CloudTrail log files is backward compatible with existing
+                        applications that read CloudTrail log data.&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select CloudTrail from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on a Trail.&lt;/li&gt;
+                        &lt;li&gt;Under the S3 section click on the edit button.&lt;/li&gt;
+                        &lt;li&gt;Click Advanced.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Encrypt Log Files&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Create a new KMS key&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;In &amp;quot;KMS key&amp;quot; type a name for your key.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt; 
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails
+                            &lt;/blockquote&gt;Check that KMS is enabled if the &amp;quot;KmsKeyId&amp;quot; property is
+                            set.
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.9" name="Enforce employee lifecycle policies" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Regular reviews of accounts on the system should be conducted to ensure that stale accounts
+                        cannot be abused either by those former employees using them or compromised by attackers.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;At least every 90 days complete the following:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                        &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;
+                        &lt;li&gt;Click on Users.&lt;/li&gt;
+                        &lt;li&gt;For any user that should no longer exist:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;select the user,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;User Actions&amp;quot;,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Ensure all users are valid users.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM4" name="Ensure IAM policies that allow full &quot;*:*&quot; administrative privileges are not attached" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.&lt;/p&gt;&lt;p&gt;Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.&lt;/p&gt;&lt;p&gt;IAM policies that have a statement with "Effect": "Allow" with "Action": "*" over "Resource": "*" should be removed.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the navigation pane, click Policies and then search for the policy name found in the audit step.&lt;/li&gt;&lt;li&gt;Select the policy that needs to be deleted.&lt;/li&gt;&lt;li&gt;In the policy action menu, select first Detach&lt;/li&gt;&lt;li&gt;Select all Users, Groups, Roles that have this policy attached&lt;/li&gt;&lt;li&gt;Click Detach Policy&lt;/li&gt;&lt;li&gt;In the policy action menu, select Detach&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges as found in the audit step:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Lists all IAM users, groups, and roles that the specified managed policy is attached to. aws iam list-entities-for-policy --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Users: aws iam detach-user-policy --user-name &amp;lt;iam_user&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Groups: aws iam detach-group-policy --group-name &amp;lt;iam_group&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name &amp;lt;iam_role&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine what policies are created: From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Run the following to get a list of IAM policies: aws iam list-policies --only-attached --output text&lt;/li&gt;&lt;li&gt;For each policy returned, run the following command to determine if any policies is allowing full administrative privileges on the account: aws iam get-policy-version --policy-arn &amp;lt;policy_arn&amp;gt; --version-id &amp;lt;version&amp;gt;&lt;/li&gt;&lt;li&gt;In output ensure policy should not have any Statement block with "Effect": "Allow" and Action set to "*" and Resource set to "*"&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.271">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Network-1" name="Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL to remediate, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Click Edit inbound rules&lt;/li&gt;&lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click Delete to remove the offending inbound rule&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to determine if the account is configured as prescribed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Note: A Port value of ALL or a port range such as 0-1024 are inclusive of port 22, 3389, and other remote server administration ports&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.373">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM3" name="Ensure there is only one active access key available for any single IAM user" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/li&gt;&lt;li&gt;In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.&lt;/li&gt;&lt;li&gt;If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.&lt;/li&gt;&lt;li&gt;Repeat steps no. 3 - 7 for each IAM user in your AWS account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/p&gt;&lt;p&gt;2. Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user&lt;/p&gt;&lt;p&gt;Note - the command does not return any output:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam update-access-key --access-key-id &amp;lt;access-key-id&amp;gt; --status Inactive --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.&lt;/p&gt;&lt;p&gt;4. Repeat steps no. 1 - 3 for each IAM user in your AWS account.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;Under Access Keys section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Repeat steps no. 3 - 5 for each IAM user in your AWS account.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-users command to list all IAM users within your account:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-users --query "Users[*].UserName"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all your IAM user names.&lt;/p&gt;&lt;p&gt;2. Run list-access-keys command using the IAM user name list to return the current status of each access key associated with the selected IAM user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata ("Username", "AccessKeyId", "Status", "CreateDate") for each access key on that user account.&lt;/p&gt;&lt;p&gt;3. Check the Status property value for each key returned to determine each keys current state. If the Status property value for more than one IAM access key is set to Active, the user access configuration does not adhere to this recommendation, refer to the remediation below.&lt;/p&gt;&lt;p&gt;Repeat steps no. 2 and 3 for each IAM user in your AWS account.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.8" name="Export EC2 OS logs to cloudwatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudwatch logs is an AWS service that allows you to send logs from an EC2 instance to
+                        cloudwatch via an agent installed locally on the machine. The logs are then stored centrally
+                        within cloudwatch logs and metric alerts can be configured so that security incidents can be
+                        reported to the security team. It is recommended to enable cloudwatch log monitoring on all EC2
+                        servers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Follow the directions provided in &amp;quot;http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html&amp;quot;
+                        to install and enable Cloudwatch Logs on a new EC2 instance.
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select Cloudwatch from the services menu.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Logs&amp;quot;.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on your log group.&lt;/li&gt;
+                            &lt;li&gt;Click on your log stream.&lt;/li&gt;
+                            &lt;li&gt;Ensure event data is being captured as per the logs on your machine.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.8-5.9" name="Install an agent for AWS Cloudwatch Logs within AutoScaling Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use CloudWatch Logs to monitor, store and access log files from an Amazon EC2 instance (application or system data). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  With CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics). For example, you could set an alarm on the number of errors that occur in your system logs or view graphs of web request latency from your application logs. Log data can be stored and accessed for as long as you need using highly durable, lowcost storage so you don't have to worry about filling up hard drives. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A Cloudwatch agent needs to run within the Guest Operating System of each EC2 instance you wish to ship logs from. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a sample agent configuration file for Amazon Linux and save it as a text file (for example, awslogs.cfg) either on the AMI's filesystem, in a publicly accessible http/https location, or an Amazon S3 location (for example, s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt;):&lt;/li&gt; 
+ &lt;/ul&gt; 
+  [general] 
+  state_file = /var/awslogs/state/agent-state 
+  [/var/log/messages] 
+  file = /var/log/messages 
+  log_group_name = /var/log/messages 
+  log_stream_name = {instance_id} 
+  datetime_format = %b %d %H:%M:%S 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new Web tier Autoscaling Launch Configuration with UserData populated for installing Cloudwatch Logs agent:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create and save locally a file containing the UserData, for example /tmp/UserData.txt:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     #!/bin/bashcurl https://s3.amazonaws.com/awscloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agentsetup.py./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Note: You can install the CloudWatch Logs agent by specifying the us-east-1, uswest-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, or sa-east-1 regions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; -- user-data file:///tmp/UserData.txt 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="EC2 New Instance CWL" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html"/>
+          </references>
+          <standards>
+            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Cloudwatch Logs agent is installed through UserData in the Web tier Autoscaling Launch Configuration:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt;--query "LaunchConfigurations[*].UserData" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Output should be similar with:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    #!/bin/bash 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agent-setup.py ./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:37:37.654">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
+                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
+                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
+                        account activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
+                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
+                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
+                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
+                        &lt;li&gt;Click Allow.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
+                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
+                            is set to a recent time (ie within the latest day or so).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.1" name="Launch EC2 instances into a VPC" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACLs) and routing. However, the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is recommended to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure. &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Launch Instance".&lt;/li&gt;&lt;li&gt;Complete the wizard until step 3. At this point, ensure a VPC ID is selected for the "Network" option, choose an appropriate "Subnet" and "Auto-assign Public IP" option.&lt;/li&gt;&lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;NB: If you want to migrate an already running instance you will need to convert the image into an AMI and then launch a new instance using the AMI and placing in a VPC, as per the steps above&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Instances" from the left hand menu.&lt;/li&gt;&lt;li&gt;For each instance in the list:&lt;ul&gt;&lt;li&gt;select the instance&lt;/li&gt;&lt;li&gt;in the preview pane confirm the instance has a "VPC ID". If a hyphen "-" is shown then your instance is running in EC2-Classic mode.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM7" name="Manage IAM users centrally via identity federation or AWS Organizations for multi-account environments" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;The remediation procedure will vary based on the individual organization's implementation of identity federation and/or AWS Organizations with the acceptance criteria that no non-service IAM users, and non-root accounts, are present outside the account providing centralized IAM user management.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.21" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For multi-account AWS environments with an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine the master account for identity federation or IAM user management&lt;/li&gt;&lt;li&gt;Login to that account through the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Identity providers&lt;/li&gt;&lt;li&gt;Verify the configuration&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Then..., determine all accounts that should not have local users present. For each account...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For multi-account AWS environments implementing AWS Organizations without an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.2" name="Register a Security contact for your AWS account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS will occasionally send security advisories and alerts to the account holder. By default this will go to the email address that the account is registered under. However if a security contact is specified these alerts will be sent here instead. Therefore this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Security&amp;quot; section complete the requested contact information.&lt;/li&gt; 
+  &lt;li&gt;Click update when complete.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether a contact has been set for &amp;quot;Security&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM5" name="Remove expired SSL/TLS certificates stored in AWS IAM" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To delete Expired Certificate run following command by replacing &amp;lt;CERTIFICATE_NAME&amp;gt; with the name of the certificate to delete:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam delete-server-certificate --server-certificate-name &amp;lt;CERTIFICATE_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;When the preceding command is successful, it does not return any output.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.19" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Getting the certificates expiration information via AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run list-server-certificates command to list all the IAM-stored server certificates:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-server-certificates&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc):&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ "ServerCertificateMetadataList": [ { "ServerCertificateId": "EHDGFRW7EJFYTE88D", "ServerCertificateName": "MyServerCertificate", "Expiration": "2018-07-10T23:59:59Z", "Path": "/", "Arn": "arn:aws:iam::012345678910:server-certificate/MySSLCertificate", "UploadDate": "2018-06-10T11:56:08Z" } ] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Verify the ServerCertificateName and Expiration parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ { "ServerCertificateMetadataList": [] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This means that there are no expired certificates, It DOES NOT mean that no certificates exist.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.071">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-AWS" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails are not properly protected, an attacker could gain access to the system,
+                                modify the status of the resources or exfiltrate sensitive data without being noticed.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-ACCESS-ROOT-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-1.21">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                    <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AWS RESOURCE LOGGING" name="AWS Resource Logging" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="CLOUDWATCH METRIC ALERTS" name="Cloudwatch Metric Alerts" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED_ACCESS_SYSTEMS_AWS" name="Attackers access to the systems without being detected" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain access to the systems and they are not detected and the changes of the
+                                attackers could not be detected and audited.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                    <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.5">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="cloudwatch-misconfig">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.10">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK-AWS" name="Sensitive data is compromised through undetected network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain undetected access to the network systems and the changes of the attackers
+                                could not be audited or detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.12">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="VIRTUAL PRIVATE CLOUD (VPC) NETWORK" name="Virtual Private Cloud (VPC) Network" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                    <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="2ec0fe5e-c8aa-4a77-8019-35d62fd4b0ae" diagramComponentId="dfb2631f-d959-4a19-ace4-62fb552b6773" ref="bb23eb31-51d2-42fd-9350-d4db18531e34" name="VPC - Customer Instance" desc="" library="" parentComponentRef="" componentDefinitionRef="vpc">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.110">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.115">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.119">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.129">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
+            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before you begin, make sure of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
+  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
+  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
+  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
+  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
+  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test end-to-end connectivity 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon EC2 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On the dashboard, choose Launch Instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Choose an instance type, and then choose Next: Configure Instance Details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ping 10.0.0.4 
+&lt;/div&gt; 
+&lt;div&gt;
+  Pinging 10.0.0.4 with 32 bytes of data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ping statistics for 10.0.0.4: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Approximate round trip times in milliseconds: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use SSH or RDP to connect to your instances in the VPC. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:31:55.971">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control access to VPC resources with IAM identities and policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Control access to VPC resources by using: 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Identities: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authentication is how you sign in to AWS using your identity credentials. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Identity-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Resource-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Access control lists (ACLs): 
+&lt;/div&gt; 
+&lt;div&gt;
+  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.899">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Creating CloudWatch alarms to monitor a NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm for outbound traffic through the NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm to monitor port allocation errors 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:58:07.550">
+              <output/>
+            </source>
+            <references>
+              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for VPC endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route traffic to an Amazon VPC interface endpoint 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console and open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the right pane, choose the endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the Route 53 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Hosted Zones. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create Record Set. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specify the following values: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose A - IPv4 address. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Yes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias Target 
+&lt;/div&gt; 
+&lt;div&gt;
+  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Different accounts - Enter the value that you got in step 1 of this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Routing Policy 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Evaluate Target Health 
+&lt;/div&gt; 
+&lt;div&gt;
+  Accept the default value of No. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:39:59.223">
+              <output/>
+            </source>
+            <references>
+              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:54:35.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable VPC Traffic Mirroring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content inspection 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Threat monitoring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Troubleshooting 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your traffic mirror resources using any of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T13:00:52.965">
+              <output/>
+            </source>
+            <references>
+              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.909">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To get started with AWS Secrets Manager: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identify your secrets and locate where they are used in your applications. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update your applications to retrieve secrets from Secrets Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.969">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network ACLs for VPC as an additional layer of security 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following are the parts of a network ACL rule: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Source. [Inbound rules only] The source of the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow/Deny. Whether to allow or deny the specified traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the navigation pane, choose Network ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select a Network ACL to see details. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:43:47.241">
+              <output/>
+            </source>
+            <references>
+              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use VPC endpoint policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your endpoint policy can be like any IAM policy; however, take note of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:41:32.102">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.653">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                <countermeasure ref="AWS-VPC1" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                <countermeasure ref="AWS-VPC7" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a92a46be-78b8-44e6-ac61-fb61382dfbc2" diagramComponentId="014badac-374f-4d89-8c27-42530ecd947e" ref="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" name="User - Web UI" desc="" library="" parentComponentRef="" componentDefinitionRef="web-ui">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.752">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software includes web functionality (such as a web widget)
+                        from another domain, which causes it to operate within the domain of the
+                        software, potentially granting total access and control of the software to the
+                        untrusted source.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-18T14:51:05.701">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.862">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.944">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:20:27.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.807">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component's end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:25:46.844">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Review periodically all assets which are accessed by the application and ensure that these
+                        assets are hosted by the application. If this is not the case and there are assets in external
+                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
+                        from external providers or CDNs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
+          </references>
+          <standards>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all assets are hosted by the application, and not by external providers.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T11:44:50.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform=".NET" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.033">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only request the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-09-30T09:11:03.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-30T15:19:22.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.974">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.007">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Web applications typically make extensive use of 3rd party web resources such as
+                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
+                                repositories, or even Content Delivery Networks that host these libraries, then they
+                                could gain access to applications that use this content.
+                                &lt;div&gt;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-830">
+                  <countermeasures>
+                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
+                <countermeasure ref="WEB-CSP" mitigation="33"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                <countermeasure ref="CWE-327" mitigation="33"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/aws-simple-infrastructure-with-waf.xml b/Templates/Submitted_Templates/aws-simple-infrastructure-with-waf.xml
new file mode 100644
index 0000000..cbfeb7b
--- /dev/null
+++ b/Templates/Submitted_Templates/aws-simple-infrastructure-with-waf.xml
@@ -0,0 +1,219 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="AWS - Simple infrastructure with WAF" name="AWS - Simple infrastructure with WAF" tags="Community">
+  <desc>&lt;p&gt;AWS Template&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTIzNiIgZHk9IjQyNCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjUuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDgiIHk9IjM2MCIgd2lkdGg9IjY5MSIgaGVpZ2h0PSI1NDgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBBY2NvdW50IEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRFZ01FZ3dWakZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGMyTnpJMElEQXVOamd3TXpBelNEQXVNVFU1T1RFeVZqQXVOak13T0RjNFF6QXVNVFU1T0RNeklEQXVOVGN5TmpBMUlEQXVNVGM1TXpJeUlEQXVOVEUxT1RreklEQXVNakUxTWpVMklEQXVORGN3TVRFNVF6QXVNalV4TVRnNUlEQXVOREkwTWpRMUlEQXVNekF4TkRnMElEQXVNemt4TnpZM0lEQXVNelU0TURjNElEQXVNemMzT0RreFREQXVNell6T1RNNUlEQXVNemMyTkRZMVREQXVNelk1TXpJMUlEQXVNemM1TXpFMlF6QXVNemczTXpjNElEQXVNemc0T1RneElEQXVOREEzTlRNM0lEQXVNemswTURNNElEQXVOREk0TURFMElEQXVNemswTURNNFF6QXVORFE0TkRreElEQXVNemswTURNNElEQXVORFk0TmpVeElEQXVNemc0T1RneElEQXVORGcyTnpBMElEQXVNemM1TXpFMlREQXVORGt5TURnNUlEQXVNemMyTkRZMVREQXVORGszT1RVZ01DNHpOemM0T1RGRE1DNDFORGc0TVRnZ01DNHpPVEExTURnZ01DNDFPVFEzTWprZ01DNDBNVGd4SURBdU5qSTVOelEwSURBdU5EVTNNRGs0VERBdU5qQTJNeUF3TGpRM09ETXlOVU13TGpVM05qWXdPQ0F3TGpRME5UVTFOU0F3TGpVek9ERXhOaUF3TGpReU1qQXhPU0F3TGpRNU5UUXhOaUF3TGpReE1EVXlORU13TGpRM05ESXdPQ0F3TGpReU1EZ2dNQzQwTlRBNU5EY2dNQzQwTWpZeE16a2dNQzQwTWpjek9ERWdNQzQwTWpZeE16bERNQzQwTURNNE1UUWdNQzQwTWpZeE16a2dNQzR6T0RBMU5UUWdNQzQwTWpBNElEQXVNelU1TXpRMUlEQXVOREV3TlRJMFF6QXVNekV4TURJeElEQXVOREl6TnpReklEQXVNalk0TXpjMElEQXVORFV5TkRZeklEQXVNak0zT1RVeklEQXVORGt5TWpjeVF6QXVNakEzTlRNeklEQXVOVE15TURnZ01DNHhPVEV3TWpNZ01DNDFPREEzTnpZZ01DNHhPVEE1TmlBd0xqWXpNRGczT0ZZd0xqWTBPRFl5U0RBdU5EYzJNRGxNTUM0ME56WTNNalFnTUM0Mk9EQXpNRE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOREkzTmpNMUlEQXVOREkxTURFMVF6QXVOREF6TnpNNElEQXVOREkxTURnMklEQXVNemd3TWpBM0lEQXVOREU1TVRRNUlEQXVNelU1TWpBMElEQXVOREEzTnpRNFF6QXVNek14TXprMElEQXVNemt5TlRjM0lEQXVNekE1TkRJNUlEQXVNelk0TlRjMElEQXVNamsyTnpjM0lEQXVNek01TlRORE1DNHlPRFF4TWpRZ01DNHpNVEEwT0RZZ01DNHlPREUxTURVZ01DNHlOemd3TlRVZ01DNHlPRGt6TXpNZ01DNHlORGN6TlRaRE1DNHlPVGN4TmpJZ01DNHlNVFkyTlRnZ01DNHpNVFE1T1RFZ01DNHhPRGswTkRJZ01DNHpOREF3TURZZ01DNHhOekF3TURSRE1DNHpOalV3TWpFZ01DNHhOVEExTmpZZ01DNHpPVFUzT1RnZ01DNHhOREF3TVRVZ01DNDBNamMwTnpjZ01DNHhOREF3TVRWRE1DNDBOVGt4TlRZZ01DNHhOREF3TVRVZ01DNDBPRGs1TXpNZ01DNHhOVEExTmpZZ01DNDFNVFE1TkRnZ01DNHhOekF3TURSRE1DNDFNems1TmpNZ01DNHhPRGswTkRJZ01DNDFOVGMzT1RNZ01DNHlNVFkyTlRnZ01DNDFOalUyTWpFZ01DNHlORGN6TlRaRE1DNDFOek0wTkRrZ01DNHlOemd3TlRVZ01DNDFOekE0TXlBd0xqTXhNRFE0TmlBd0xqVTFPREUzTnlBd0xqTXpPVFV6UXpBdU5UUTFOVEkxSURBdU16WTROVGMwSURBdU5USXpOVFlnTUM0ek9USTFOemNnTUM0ME9UVTNOU0F3TGpRd056YzBPRll3TGpRd056YzBPRU13TGpRM05EZ3hNaUF3TGpReE9UQXlNaUF3TGpRMU1UUXhOU0F3TGpReU5EazFOQ0F3TGpReU56WXpOU0F3TGpReU5UQXhOVnBOTUM0ME1qYzJNelVnTUM0eE56VTJOekpETUM0ME1ETXlPRGtnTUM0eE56VXlNRFVnTUM0ek56azBPVElnTUM0eE9ESTVNeUF3TGpNMk1EQTJNU0F3TGpFNU56WXdOa013TGpNME1EWXpJREF1TWpFeU1qZ3pJREF1TXpJMk5qa3lJREF1TWpNek1EWXhJREF1TXpJd05EZ3hJREF1TWpVMk5qQTNRekF1TXpFME1qY3hJREF1TWpnd01UVTBJREF1TXpFMk1UUTRJREF1TXpBMU1UQTBJREF1TXpJMU9ERXpJREF1TXpJM05EVTFRekF1TXpNMU5EYzNJREF1TXpRNU9EQTNJREF1TXpVeU16WTVJREF1TXpZNE1qWTFJREF1TXpjek56YzRJREF1TXpjNU9EWTNRekF1TXprd01UUTFJREF1TXpnNE5qUTFJREF1TkRBNE5ESTVJREF1TXprek1qTTRJREF1TkRJM01EQXlJREF1TXprek1qTTRRekF1TkRRMU5UYzBJREF1TXprek1qTTRJREF1TkRZek9EVTRJREF1TXpnNE5qUTFJREF1TkRnd01qSTJJREF1TXpjNU9EWTNRekF1TlRBeE5UTWdNQzR6Tmpnek1USWdNQzQxTVRnek5pQXdMak0wT1RrMk5pQXdMalV5T0RBME1TQXdMak15TnpjME5rTXdMalV6TnpjeU1TQXdMak13TlRVeU5pQXdMalV6T1RZNU5TQXdMakk0TURjd055QXdMalV6TXpZMUlEQXVNalUzTWpNMlF6QXVOVEkzTmpBMUlEQXVNak16TnpZMElEQXVOVEV6T0RnNElEQXVNakV5T1RnM0lEQXVORGswTmpjNElEQXVNVGs0TWpBNVF6QXVORGMxTkRZNUlEQXVNVGd6TkRNZ01DNDBOVEU0TnpFZ01DNHhOelUwT1RjZ01DNDBNamMyTXpVZ01DNHhOelUyTnpKV01DNHhOelUyTnpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmpjek5ESTJJREF1T0RZd01EUTRUREF1TlRBME9EZ3pJREF1TnpZeU56Z3lWakF1TlRZNE1Ea3hUREF1Tmpjek5ESTJJREF1TkRjd09ESTFUREF1T0RReE9UWTVJREF1TlRZNE1Ea3hWakF1TnpZeU56Z3lUREF1Tmpjek5ESTJJREF1T0RZd01EUTRXazB3TGpVek5qVTJOQ0F3TGpjME5EUXdOa3d3TGpZM016UXlOaUF3TGpneU16WXhNMHd3TGpneE1ESTRPQ0F3TGpjME5EUXdObFl3TGpVNE5UazVNa3d3TGpZM016UXlOaUF3TGpVd05qYzROVXd3TGpVek5qVTJOQ0F3TGpVNE5UazVNbFl3TGpjME5EUXdObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOek0xTmpNZ01DNDJPRE0yTnpkTU1DNDFNVEk1TXprZ01DNDFPVEV3TURSTU1DNDFNamczT0NBd0xqVTJNelU1T1V3d0xqWTNNelUyTXlBd0xqWTBOekE0TTB3d0xqZ3hPRE0wTmlBd0xqVTJNelU1T1V3d0xqZ3pOREU0TnlBd0xqVTVNVEF3TkV3d0xqWTNNelUyTXlBd0xqWTRNelkzTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT0Rrek9UWWdNQzQyTmpVMU1qZElNQzQyTlRjM01UVldNQzQ0TkRFNE5ESklNQzQyT0Rrek9UWldNQzQyTmpVMU1qZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeE1EY2lJSGt4UFNJeExqSXdOekUxSWlCNE1qMGlNUzR5TURjeE1TSWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTTROVEV4UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrWTVPVEF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjEzIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NWExZWQ2NjMtNWUzYS00NDIwLWIyY2QtZmUyZDI2ODMxZDFkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFtYXpvbi13ZWItc2VydmljZXMtZW52aXJvbm1lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzQiIHk9IjQxIiB3aWR0aD0iNjE1IiBoZWlnaHQ9IjQ5NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iQVdTIFZQQyAoVmlydHVhbCBQcml2YXRlIENsb3VkKSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtjb250YWluZXI9MDtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0xO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9NDczZWVkZTctYjk2Mi00YWQyLTg3ZDYtZGZhNzJjZTllZjM3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iMzMiIHdpZHRoPSI1MjQiIGhlaWdodD0iMjEzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkgLT4gQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgc3R5bGU9ImlyLnJlZj1kMzliNTJkOS1iNGI4LTQzY2ItODBhNS1jOGM1NDVjOGExMWE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC4yNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxNSIgc291cmNlPSIxNiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjMwMiIgeT0iNzguNSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkiIGlkPSIxNiI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWM4OWJmYWQwLWI4OGQtNDQ2Zi1hMjYzLWUzNjc1YjZhYTNjZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lYzI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNRFkyTWpnZ01DNDFNems1TlRsSU1DNDNNems1TmpGV01DNDFNVE15T1ROSU1DNDRNRFkyTWpoV01DNHhPVE15T1ROSU1DNDBPRFkyTWpoV01DNHlOVGs1TlRsSU1DNDBOVGs1TmpGV01DNHhPVE15T1RORE1DNDBOVGs1TmpFZ01DNHhPRFl5TWlBd0xqUTJNamMzSURBdU1UYzVORE0zSURBdU5EWTNOemN4SURBdU1UYzBORE0yUXpBdU5EY3lOemN5SURBdU1UWTVORE0xSURBdU5EYzVOVFUxSURBdU1UWTJOakkySURBdU5EZzJOakk0SURBdU1UWTJOakkyU0RBdU9EQTJOakk0UXpBdU9ERXpOeUF3TGpFMk5qWXlOaUF3TGpneU1EUTRNeUF3TGpFMk9UUXpOU0F3TGpneU5UUTROQ0F3TGpFM05EUXpOa013TGpnek1EUTROU0F3TGpFM09UUXpOeUF3TGpnek16STVOQ0F3TGpFNE5qSXlJREF1T0RNek1qazBJREF1TVRrek1qa3pWakF1TlRFek1qa3pRekF1T0RNek1qazBJREF1TlRJd016WTFJREF1T0RNd05EZzFJREF1TlRJM01UUTRJREF1T0RJMU5EZzBJREF1TlRNeU1UUTVRekF1T0RJd05EZ3pJREF1TlRNM01UVWdNQzQ0TVRNM0lEQXVOVE01T1RVNUlEQXVPREEyTmpJNElEQXVOVE01T1RVNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVeE16RTNJREF1T0RNek1qazBTREF1TVRrek1UY3hRekF1TVRnMk1EazRJREF1T0RNek1qazBJREF1TVRjNU16RTFJREF1T0RNd05EZzFJREF1TVRjME16RTBJREF1T0RJMU5EZzBRekF1TVRZNU16RXpJREF1T0RJd05EZ3pJREF1TVRZMk5UQTBJREF1T0RFek55QXdMakUyTmpVd05DQXdMamd3TmpZeU4xWXdMalE0TmpZeU9FTXdMakUyTmpVd05DQXdMalEzT1RVMU5TQXdMakUyT1RNeE15QXdMalEzTWpjM01pQXdMakUzTkRNeE5DQXdMalEyTnpjM01VTXdMakUzT1RNeE5TQXdMalEyTWpjM0lEQXVNVGcyTURrNElEQXVORFU1T1RZeElEQXVNVGt6TVRjeElEQXVORFU1T1RZeFNEQXVNalU1T0RNM1ZqQXVORGcyTmpJNFNEQXVNVGt6TVRjeFZqQXVPREEyTmpJM1NEQXVOVEV6TVRkV01DNDNNems1TmpGSU1DNDFNems0TXpaV01DNDRNRFkyTWpkRE1DNDFNems0TXpZZ01DNDRNVE0zSURBdU5UTTNNREkzSURBdU9ESXdORGd6SURBdU5UTXlNREkySURBdU9ESTFORGcwUXpBdU5USTNNREkxSURBdU9ETXdORGcxSURBdU5USXdNalF5SURBdU9ETXpNamswSURBdU5URXpNVGNnTUM0NE16TXlPVFJhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekV6TWpnNUlEQXVNemM1T1RVMVZqQXVNelV6TWpnNFNEQXVOamN6TWpnNVF6QXVOamN5TnpRZ01DNHpORFl6T1RnZ01DNDJOamszTlRRZ01DNHpNems1TXlBd0xqWTJORGcyTnlBd0xqTXpOVEEwTTBNd0xqWTFPVGs0SURBdU16TXdNVFUySURBdU5qVXpOVEV5SURBdU16STNNVGNnTUM0Mk5EWTJNaklnTUM0ek1qWTJNakZXTUM0eU9EWTJNakZJTUM0Mk1UazVOVFZXTUM0ek1qWTJNakZJTUM0MU56azVOVFZXTUM0eU9EWTJNakZJTUM0MU5UTXlPRGhXTUM0ek1qWTJNakZJTUM0MU1UTXlPRGhXTUM0eU9EWTJNakZJTUM0ME9EWTJNakpXTUM0ek1qWTJNakZJTUM0ME5EWTJNakZXTUM0eU9EWTJNakZJTUM0ME1UazVOVFZXTUM0ek1qWTJNakZJTUM0ek56azVOVFZXTUM0eU9EWTJNakZJTUM0ek5UTXlPRGhXTUM0ek1qWTJNakZETUM0ek5EWXpPVGdnTUM0ek1qY3hOeUF3TGpNek9Ua3pJREF1TXpNd01UVTJJREF1TXpNMU1EUXpJREF1TXpNMU1EUXpRekF1TXpNd01UVTJJREF1TXpNNU9UTWdNQzR6TWpjeE55QXdMak0wTmpNNU9DQXdMak15TmpZeU1TQXdMak0xTXpJNE9FZ3dMakk0TmpZeU1WWXdMak0zT1RrMU5VZ3dMak15TmpZeU1WWXdMalF4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalEwTmpZeU1VZ3dMak15TmpZeU1WWXdMalE0TmpZeU1rZ3dMakk0TmpZeU1WWXdMalV4TXpJNE9FZ3dMak15TmpZeU1WWXdMalUxTXpJNE9FZ3dMakk0TmpZeU1WWXdMalUzT1RrMU5VZ3dMak15TmpZeU1WWXdMall4T1RrMU5VZ3dMakk0TmpZeU1WWXdMalkwTmpZeU1rZ3dMak15TmpZeU1VTXdMak15TnpFM0lEQXVOalV6TlRFeElEQXVNek13TVRVMklEQXVOalU1T1RnZ01DNHpNelV3TkRNZ01DNDJOalE0TmpkRE1DNHpNems1TXlBd0xqWTJPVGMxTkNBd0xqTTBOak01T0NBd0xqWTNNamMwSURBdU16VXpNamc0SURBdU5qY3pNamc1VmpBdU56RXpNamc1U0RBdU16YzVPVFUxVmpBdU5qY3pNamc1U0RBdU5ERTVPVFUxVmpBdU56RXpNamc1U0RBdU5EUTJOakl4VmpBdU5qY3pNamc1U0RBdU5EZzJOakl5VmpBdU56RXpNamc1U0RBdU5URXpNamc0VmpBdU5qY3pNamc1U0RBdU5UVXpNamc0VmpBdU56RXpNamc1U0RBdU5UYzVPVFUxVmpBdU5qY3pNamc1U0RBdU5qRTVPVFUxVmpBdU56RXpNamc1U0RBdU5qUTJOakl5VmpBdU5qY3pNamc1UXpBdU5qVXpOVEV5SURBdU5qY3lOelFnTUM0Mk5UazVPQ0F3TGpZMk9UYzFOQ0F3TGpZMk5EZzJOeUF3TGpZMk5EZzJOME13TGpZMk9UYzFOQ0F3TGpZMU9UazRJREF1TmpjeU56UWdNQzQyTlRNMU1URWdNQzQyTnpNeU9Ea2dNQzQyTkRZMk1qSklNQzQzTVRNeU9EbFdNQzQyTVRrNU5UVklNQzQyTnpNeU9EbFdNQzQxTnprNU5UVklNQzQzTVRNeU9EbFdNQzQxTlRNeU9EaElNQzQyTnpNeU9EbFdNQzQxTVRNeU9EaElNQzQzTVRNeU9EbFdNQzQwT0RZMk1qSklNQzQyTnpNeU9EbFdNQzQwTkRZMk1qRklNQzQzTVRNeU9EbFdNQzQwTVRrNU5UVklNQzQyTnpNeU9EbFdNQzR6TnprNU5UVklNQzQzTVRNeU9EbGFUVEF1TmpRMk5qSXlJREF1TmpRME1qSXlRekF1TmpRMk5qSXlJREF1TmpRME9EVTRJREF1TmpRMk16WTVJREF1TmpRMU5EWTVJREF1TmpRMU9URTVJREF1TmpRMU9URTVRekF1TmpRMU5EWTVJREF1TmpRMk16WTVJREF1TmpRME9EVTVJREF1TmpRMk5qSXlJREF1TmpRME1qSXlJREF1TmpRMk5qSXlTREF1TXpVMU5qZzRRekF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVME5EUXhJREF1TmpRMk16WTVJREF1TXpVek9Ua3hJREF1TmpRMU9URTVRekF1TXpVek5UUXhJREF1TmpRMU5EWTVJREF1TXpVek1qZzRJREF1TmpRME9EVTRJREF1TXpVek1qZzRJREF1TmpRME1qSXlWakF1TXpVMU5qZzRRekF1TXpVek1qZzRJREF1TXpVMU1EVXhJREF1TXpVek5UUXhJREF1TXpVME5EUXhJREF1TXpVek9Ua3hJREF1TXpVek9Ua3hRekF1TXpVME5EUXhJREF1TXpVek5UUXhJREF1TXpVMU1EVXhJREF1TXpVek1qZzRJREF1TXpVMU5qZzRJREF1TXpVek1qZzRTREF1TmpRME1qSXlRekF1TmpRME9EVTVJREF1TXpVek1qZzRJREF1TmpRMU5EWTVJREF1TXpVek5UUXhJREF1TmpRMU9URTVJREF1TXpVek9Ua3hRekF1TmpRMk16WTVJREF1TXpVME5EUXhJREF1TmpRMk5qSXlJREF1TXpVMU1EVXhJREF1TmpRMk5qSXlJREF1TXpVMU5qZzRWakF1TmpRME1qSXlXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01pSWdlVEU5SWpFdU1qQTNNaUlnZURJOUlqRXVNakEzTURjaUlIa3lQU0l0TUM0eU1EY3dOamNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlORE9EVXhNVUlpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaR09Ua3dNQ0l2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE0OCIgeT0iNTciIHdpZHRoPSI5OCIgaGVpZ2h0PSI4Ny41IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkiIHN0eWxlPSJpci5yZWY9MDM5NGFjMDEtZjdkYi00MjUyLWJiNjYtZDNlYTZjYzk5NzA1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXMzO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTUM0NU9UazVPVFZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU1TURVeElEQXVOVE0wTVRnNFF6QXVPREUxTVRnMElEQXVOVEV6TWpVMUlEQXVOemt4TkRVeElEQXVORGs0TkRVMUlEQXVOemMxTVRnMElEQXVORGczT1RJeVF6QXVOelk1T1RnMElEQXVORGcwTlRnNUlEQXVOelUxTnpFNElEQXVORGM1TWpVMUlEQXVOelUwTlRFNElEQXVORGMwTlRnNVF6QXVOelUwTkRNMklEQXVORGN4TWpVZ01DNDNOVFE0T0RZZ01DNDBOamM1TVRrZ01DNDNOVFU0TlRFZ01DNDBOalEzTWpKTU1DNDNOamt4T0RRZ01DNHpOamc0TlRaRE1DNDNOek13TlRFZ01DNHpOREEzTWpJZ01DNDNOelkzT0RRZ01DNHpNVEkxT0RrZ01DNDNPREEyTlRFZ01DNHlPRFEwTlRaRE1DNDNPRFF4TVRnZ01DNHlOVGcxT0RrZ01DNDNOekUzTVRnZ01DNHlOREV5TlRZZ01DNDNOVEEyTlRFZ01DNHlNalkzTWpORE1DNDNNRGMzTVRnZ01DNHhPVFk1T0RrZ01DNDJOVEUzTVRnZ01DNHhPRFE1T1NBd0xqWXdNVEU0TkNBd0xqRTNOamN5TTBNd0xqVXpOemd4TVNBd0xqRTJOak0zTmlBd0xqUTNNek0yTlNBd0xqRTJOREkzSURBdU5EQTVORFV4SURBdU1UY3dORFUyUXpBdU16VXhPVFkySURBdU1UYzBOamMwSURBdU1qazFOVFEySURBdU1UZzRNVGd6SURBdU1qUXlNemcwSURBdU1qRXdORFUyUXpBdU1qRXpPRFV4SURBdU1qSXpOemc1SURBdU1UYzJOVEU0SURBdU1qUTBOVGc1SURBdU1UZ3hNVGcwSURBdU1qZ3dPVGc1UXpBdU1UazBOVEU0SURBdU16ZzVNalUySURBdU1qRXdNalV4SURBdU5EazNNalUxSURBdU1qSTBOemcwSURBdU5qQTFNemc0UXpBdU1qTXhORFV4SURBdU5qVTBPRFUxSURBdU1qTTRNVEU0SURBdU56QTBNekl4SURBdU1qUTBOemcwSURBdU56VXpOemc0UXpBdU1qUTFPRFlnTUM0M05qTTBNaUF3TGpJME9UUTJJREF1TnpjeU5UazRJREF1TWpVMU1qRTVJREF1Tnpnd016azBRekF1TWpZd09UYzRJREF1TnpnNE1Ua2dNQzR5TmpnMk9UTWdNQzQzT1RRek1qZ2dNQzR5TnpjMU9EUWdNQzQzT1RneE9EaERNQzR6TVRnNU1UZ2dNQzQ0TWpBMU9EZ2dNQzR6TnpBeE1UZ2dNQzQ0TWpZNU9EZ2dNQzQwTVRZeU5URWdNQzQ0TXpFeU5UUkRNQzQwTnpjMU9ETWdNQzQ0TXpZM09UUWdNQzQxTXprek9ESWdNQzQ0TXpRd05UZ2dNQzQxT1RrNU9EUWdNQzQ0TWpNeE1qRkRNQzQyTXpnek9EUWdNQzQ0TVRZd05UUWdNQzQzTURrNE5URWdNQzQ0TURRME5UUWdNQzQzTVRVNU9EUWdNQzQzTlRZME5UUkRNQzQzTWpNMU9EUWdNQzQyT1RZNU9EZ2dNQzQzTXpFNU9EUWdNQzQyTXpjMU1qRWdNQzQzTXprNU9EUWdNQzQxTnpneE9EaE1NQzQzTkRJNU1UZ2dNQzQxTmpBd05UVkRNQzQzTmpRMk5URWdNQzQxTmpVeU5UVWdNQzQ0TWpZMk5URWdNQzQxTnpZek1qSWdNQzQ0TVRrd05URWdNQzQxTXpReE9EaGFUVEF1TkRnd05qVXhJREF1TVRrek16ZzVRekF1TlRZd05qVXhJREF1TVRrek16ZzVJREF1TmpVeU1qVXhJREF1TWpBeU5EVTJJREF1TnpJek9UZzBJREF1TWpReE9USXpRekF1TnpNMU1EVXhJREF1TWpRNE1EVTJJREF1TnpZd056ZzBJREF1TWpZeE56ZzVJREF1TnpVek1EVXhJREF1TWpjNE1EVTJRekF1TnpRMU16RTRJREF1TWprME16SXpJREF1TnpJeE16RTRJREF1TXpBeU5EVTJJREF1TnpBMk5qVXhJREF1TXpBNE16SXlRekF1TmpnMU56QTRJREF1TXpFMk1EVTVJREF1TmpZME1UY2dNQzR6TWpJd056Z2dNQzQyTkRJeU5URWdNQzR6TWpZek1qSkRNQzQxTkRjd056UWdNQzR6TkRVeE56WWdNQzQwTkRrek1qa2dNQzR6TkRjeU1EY2dNQzR6TlRNME5URWdNQzR6TXpJek1qSkRNQzR6TVRBeE5UZ2dNQzR6TWpjNE5UZ2dNQzR5Tmpnd05EUWdNQzR6TVRVMU1qSWdNQzR5TWpreE9EUWdNQzR5T1RVNU1qTkRNQzR5TVRrMU9EUWdNQzR5T1RBME5UWWdNQzR5TURNM01UZ2dNQzR5T0RBMU9Ea2dNQzR5TURneE1UZ2dNQzR5TmpjMU1qTkRNQzR5TVRFMk1ETWdNQzR5TmpBMU1ESWdNQzR5TVRjd056UWdNQzR5TlRRMk5pQXdMakl5TXpnMU1TQXdMakkxTURjeU0wTXdMakkxTXpFek55QXdMakl6TVRnNE9TQXdMakk0TlRjd015QXdMakl4T0RjeU55QXdMak14T1RnMU1TQXdMakl4TVRreU0wTXdMak0zTWpVd055QXdMakU1T1RJNE1pQXdMalF5TmpVZ01DNHhPVE13TlRrZ01DNDBPREEyTlRFZ01DNHhPVE16T0RsV01DNHhPVE16T0RsYVRUQXVOamc1TnpFNElEQXVOelUxTXpnNFF6QXVOamczTnpFNElEQXVOemN3T1RnNElEQXVOall4T1RnMElEQXVOemM0TnpJeElEQXVOalE1TnpFNElEQXVOemd6TVRJeFF6QXVOakkwTWpVeElEQXVOemt4TmpRZ01DNDFPVGM1T0RJZ01DNDNPVGMxTXpjZ01DNDFOekV6TVRnZ01DNDRNREEzTWpGRE1DNDFNVEl4TlRZZ01DNDRNRGcxT0RjZ01DNDBOVEl5TVRNZ01DNDRNRGcxT0RjZ01DNHpPVE13TlRFZ01DNDRNREEzTWpGRE1DNHpOVFU1T1RZZ01DNDNPVGM0TkRZZ01DNHpNVGs0TVRJZ01DNDNPRGd3TXpFZ01DNHlPRFl6T0RRZ01DNDNOekUzT0RoRE1DNHlPREU0TXpZZ01DNDNOams0TVRFZ01DNHlOemM1TXlBd0xqYzJOall3TlNBd0xqSTNOVEV3TXlBd0xqYzJNalV6UXpBdU1qY3lNamMzSURBdU56VTRORFUySURBdU1qY3dOalF6SURBdU56VXpOamN6SURBdU1qY3dNemcwSURBdU56UTROekl4UXpBdU1qVTNNRFV4SURBdU5qUXlPVGc0SURBdU1qUXhPRFV4SURBdU5UTTNNalUxSURBdU1qSTNOVGcwSURBdU5ETXhOVEl5VERBdU1qRXlNVEU0SURBdU16RTJPRFUyUXpBdU1qUXlOREk1SURBdU16TXpOVGczSURBdU1qYzFNekk1SURBdU16UTFNVEkwSURBdU16QTVORFV4SURBdU16VXdPVGc1UXpBdU16UTFPVGs0SURBdU16VTROREkzSURBdU16Z3pNREl5SURBdU16WXpNamd6SURBdU5ESXdNalV4SURBdU16WTFOVEl5UXpBdU5Ea3pNekUxSURBdU16Y3dOelU0SURBdU5UWTJOelE1SURBdU16WTJOamd4SURBdU5qTTROemcwSURBdU16VXpNemc1UXpBdU5qYzNNVFkzSURBdU16UTNPRFk0SURBdU56RTBNalEySURBdU16TTFORGswSURBdU56UTRNalV4SURBdU16RTJPRFUyVERBdU56RTVPVGcwSURBdU5USTJNVGc0UXpBdU5qVXlOREU0SURBdU5UQXpPVEk0SURBdU5UZzJOREEySURBdU5EYzNNakF6SURBdU5USXlNemcwSURBdU5EUTJNVGc1UXpBdU5URTVOVGMxSURBdU5EUTFNVEUzSURBdU5URTJPRFUySURBdU5EUXpPREkwSURBdU5URTBNalV4SURBdU5EUXlNekl5UXpBdU5URXdOalV4SURBdU5ETTVOalUxSURBdU5URXhOVGcwSURBdU5EUXdPVGc1SURBdU5UQTVPRFV4SURBdU5ETTJPRFUxUXpBdU5UQTJOVEU0SURBdU5ESTVNalUxSURBdU5UQTFOekU0SURBdU5ESXpOVEl5SURBdU5EazROalV4SURBdU5ERTNNalUxUXpBdU5EazBPRE0ySURBdU5ERTBNaUF3TGpRNU1ETXpNaUF3TGpReE1qRXlNeUF3TGpRNE5UVXpNU0F3TGpReE1USXdOVU13TGpRNE1EY3pJREF1TkRFd01qZzNJREF1TkRjMU56YzRJREF1TkRFd05UVTJJREF1TkRjeE1UQTFJREF1TkRFeE9UZzRRekF1TkRZMk5ETXhJREF1TkRFek5ESXhJREF1TkRZeU1UYzVJREF1TkRFMU9UYzBJREF1TkRVNE56RTNJREF1TkRFNU5ESTBRekF1TkRVMU1qVTJJREF1TkRJeU9EYzFJREF1TkRVeU5qa2dNQzQwTWpjeE1Ua2dNQzQwTlRFeU5ESWdNQzQwTXpFM09EaERNQzQwTkRrM09UVWdNQzQwTXpZME5UY2dNQzQwTkRrMU1TQXdMalEwTVRRd09DQXdMalExTURReE15QXdMalEwTmpJeE1rTXdMalExTVRNeE5pQXdMalExTVRBeE5pQXdMalExTXpNM09TQXdMalExTlRVeU5pQXdMalExTmpReU1pQXdMalExT1RNMU1VTXdMalExT1RRMk5pQXdMalEyTXpFM05TQXdMalEyTXpNNU9DQXdMalEyTmpFNU9TQXdMalEyTnpnM05pQXdMalEyT0RFMU4wTXdMalEzTWpNMU5DQXdMalEzTURFeE5pQXdMalEzTnpJME15QXdMalEzTURrMUlEQXVORGd5TVRFNElEQXVORGN3TlRnNVF6QXVORGcyTnpFMElEQXVORFk1T0RJMklEQXVORGt4TVRrMElEQXVORFk0TkRneUlEQXVORGsxTkRVeElEQXVORFkyTlRnNVF6QXVOVEF3TmpVeElEQXVORFkwT1RnNUlEQXVOVEF3TmpVeElEQXVORFkxTWpVMUlEQXVOVEEyTVRFNElEQXVORFkzTnpnNVF6QXVOVGN3T1RZeUlEQXVORGs1TkRBNElEQXVOak0zTnpZMklEQXVOVEkyT0RReUlEQXVOekEyTVRFNElEQXVOVFE1T1RJeVF6QXVOekUyTXpnMElEQXVOVFV6TWpVMUlEQXVOekUyTWpVeElEQXVOVFE1T1RJeUlEQXVOekUyTWpVeElEQXVOVFU0TkRVMVF6QXVOekUxT0RFNElEQXVOVFkwT1RRM0lEQXVOekUwT1RjeUlEQXVOVGN4TkRBMElEQXVOekV6TnpFNElEQXVOVGMzTnpnNFREQXVOekExTVRnMElEQXVOalF4TXpnNFREQXVOamc1TnpFNElEQXVOelUxTXpnNFdrMHdMalE0TXprNE5DQXdMalEwTURBMU5VTXdMalE0TXprNE5DQXdMalEwTXpZMU5TQXdMalEzT0RreE9DQXdMalEwTXpJMU5TQXdMalEzTnpVNE5DQXdMalEwTURrNE9VTXdMalEzTmpJMU1TQXdMalF6T0RjeU1pQXdMalE0TXprNE5DQXdMalF6TkRrNE9TQXdMalE0TXprNE5DQXdMalEwTURBMU5WcE5NQzQzTkRZMk5URWdNQzQxTXpNek9EaE1NQzQzTlRBMk5URWdNQzQxTURNNU1qSkRNQzQzTmpNNU9EUWdNQzQxTVRFMU1qSWdNQzQzT0RZMk5URWdNQzQxTWpJNU9EZ2dNQzQzT1RJMk5URWdNQzQxTXpneE9EaERNQzQzTnprMU9EUWdNQzQxTkRNMU1qSWdNQzQzTlRnNU1UZ2dNQzQxTXpZME5UVWdNQzQzTkRZMk5URWdNQzQxTXpNek9EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEySWlCNE1qMGlNUzR5TURjd05pSWdlVEk5SWkwd0xqSXdOekEzTWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RkNOall3UmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5rTkJSVE5GSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l3TGprNU9UazVOU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI5NyIgeT0iNjEuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjcwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IlBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9ODViMGZlOGMtYTVkZC00NTIyLWEyNmUtNGFhZjQ5YTcwM2I2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQxMyIgeT0iNTUuNzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjUiIHZhbHVlPSJBV1MgV0FGIChXZWIgQXBwbGljYXRpb24gRmlyZXdhbGwpIC0+IEFXUyBFQzIgKEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCkiIHN0eWxlPSJpci5yZWY9ZmY3NGUzZjktNDU4Yi00NmVlLThiZjMtMjc3MmM2ZjA2YzRkO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuMTI5O2VudHJ5WT0wLjI2OTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjE1IiBzb3VyY2U9IjIzIiB0YXJnZXQ9IjE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJBV1MgV0FGIChXZWIgQXBwbGljYXRpb24gRmlyZXdhbGwpIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1mM2MzOTk3Zi03YWU3LTRhMDktYmZlZS05ZWNiM2RkMDY2Yjc7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIxIiB5PSI1OC41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBWUEMgRGl2aXNpb24gQiIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtjb250YWluZXI9MDtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0xO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgaWQ9IjI4Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YTRjMDY3MzQtZjAxMy00OWFlLTkwOGMtYjkwNDFmNDRjNmU5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXZwYzt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iMjU4IiB3aWR0aD0iNTI0IiBoZWlnaHQ9IjIxMyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMjkiIHZhbHVlPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIC0+IEFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkiIHN0eWxlPSJpci5yZWY9OWUwOWMwMjgtZGY2OS00M2Q4LThjYjktMjBhYzA1NWNhN2I0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMjgiIHNvdXJjZT0iMzAiIHRhcmdldD0iMzEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzMDIiIHk9Ijc4LjUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBpZD0iMzAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1lZjU3MGRhNS03OWQxLTQ2M2MtYWM1MS1lODEzMDEzOGEyNWU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNDgiIHk9IjU3IiB3aWR0aD0iOTgiIGhlaWdodD0iODcuNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzEiIHZhbHVlPSJBV1MgUzMgKFNpbXBsZSBTdG9yYWdlIFNlcnZpY2UpIiBzdHlsZT0iaXIucmVmPTc2OTAzMjAxLWI4NWEtNDY2Ny05ZDY1LTZjYzJhZGFkMmZkNDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1zMztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01DNDVPVGs1T1RWSU1WWXdXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RFNU1EVXhJREF1TlRNME1UZzRRekF1T0RFMU1UZzBJREF1TlRFek1qVTFJREF1TnpreE5EVXhJREF1TkRrNE5EVTFJREF1TnpjMU1UZzBJREF1TkRnM09USXlRekF1TnpZNU9UZzBJREF1TkRnME5UZzVJREF1TnpVMU56RTRJREF1TkRjNU1qVTFJREF1TnpVME5URTRJREF1TkRjME5UZzVRekF1TnpVME5ETTJJREF1TkRjeE1qVWdNQzQzTlRRNE9EWWdNQzQwTmpjNU1Ua2dNQzQzTlRVNE5URWdNQzQwTmpRM01qSk1NQzQzTmpreE9EUWdNQzR6TmpnNE5UWkRNQzQzTnpNd05URWdNQzR6TkRBM01qSWdNQzQzTnpZM09EUWdNQzR6TVRJMU9Ea2dNQzQzT0RBMk5URWdNQzR5T0RRME5UWkRNQzQzT0RReE1UZ2dNQzR5TlRnMU9Ea2dNQzQzTnpFM01UZ2dNQzR5TkRFeU5UWWdNQzQzTlRBMk5URWdNQzR5TWpZM01qTkRNQzQzTURjM01UZ2dNQzR4T1RZNU9Ea2dNQzQyTlRFM01UZ2dNQzR4T0RRNU9TQXdMall3TVRFNE5DQXdMakUzTmpjeU0wTXdMalV6TnpneE1TQXdMakUyTmpNM05pQXdMalEzTXpNMk5TQXdMakUyTkRJM0lEQXVOREE1TkRVeElEQXVNVGN3TkRVMlF6QXVNelV4T1RZMklEQXVNVGMwTmpjMElEQXVNamsxTlRRMklEQXVNVGc0TVRneklEQXVNalF5TXpnMElEQXVNakV3TkRVMlF6QXVNakV6T0RVeElEQXVNakl6TnpnNUlEQXVNVGMyTlRFNElEQXVNalEwTlRnNUlEQXVNVGd4TVRnMElEQXVNamd3T1RnNVF6QXVNVGswTlRFNElEQXVNemc1TWpVMklEQXVNakV3TWpVeElEQXVORGszTWpVMUlEQXVNakkwTnpnMElEQXVOakExTXpnNFF6QXVNak14TkRVeElEQXVOalUwT0RVMUlEQXVNak00TVRFNElEQXVOekEwTXpJeElEQXVNalEwTnpnMElEQXVOelV6TnpnNFF6QXVNalExT0RZZ01DNDNOak0wTWlBd0xqSTBPVFEySURBdU56Y3lOVGs0SURBdU1qVTFNakU1SURBdU56Z3dNemswUXpBdU1qWXdPVGM0SURBdU56ZzRNVGtnTUM0eU5qZzJPVE1nTUM0M09UUXpNamdnTUM0eU56YzFPRFFnTUM0M09UZ3hPRGhETUM0ek1UZzVNVGdnTUM0NE1qQTFPRGdnTUM0ek56QXhNVGdnTUM0NE1qWTVPRGdnTUM0ME1UWXlOVEVnTUM0NE16RXlOVFJETUM0ME56YzFPRE1nTUM0NE16WTNPVFFnTUM0MU16a3pPRElnTUM0NE16UXdOVGdnTUM0MU9UazVPRFFnTUM0NE1qTXhNakZETUM0Mk16Z3pPRFFnTUM0NE1UWXdOVFFnTUM0M01EazROVEVnTUM0NE1EUTBOVFFnTUM0M01UVTVPRFFnTUM0M05UWTBOVFJETUM0M01qTTFPRFFnTUM0Mk9UWTVPRGdnTUM0M016RTVPRFFnTUM0Mk16YzFNakVnTUM0M016azVPRFFnTUM0MU56Z3hPRGhNTUM0M05ESTVNVGdnTUM0MU5qQXdOVFZETUM0M05qUTJOVEVnTUM0MU5qVXlOVFVnTUM0NE1qWTJOVEVnTUM0MU56WXpNaklnTUM0NE1Ua3dOVEVnTUM0MU16UXhPRGhhVFRBdU5EZ3dOalV4SURBdU1Ua3pNemc1UXpBdU5UWXdOalV4SURBdU1Ua3pNemc1SURBdU5qVXlNalV4SURBdU1qQXlORFUySURBdU56SXpPVGcwSURBdU1qUXhPVEl6UXpBdU56TTFNRFV4SURBdU1qUTRNRFUySURBdU56WXdOemcwSURBdU1qWXhOemc1SURBdU56VXpNRFV4SURBdU1qYzRNRFUyUXpBdU56UTFNekU0SURBdU1qazBNekl6SURBdU56SXhNekU0SURBdU16QXlORFUySURBdU56QTJOalV4SURBdU16QTRNekl5UXpBdU5qZzFOekE0SURBdU16RTJNRFU1SURBdU5qWTBNVGNnTUM0ek1qSXdOemdnTUM0Mk5ESXlOVEVnTUM0ek1qWXpNakpETUM0MU5EY3dOelFnTUM0ek5EVXhOellnTUM0ME5Ea3pNamtnTUM0ek5EY3lNRGNnTUM0ek5UTTBOVEVnTUM0ek16SXpNakpETUM0ek1UQXhOVGdnTUM0ek1qYzROVGdnTUM0eU5qZ3dORFFnTUM0ek1UVTFNaklnTUM0eU1qa3hPRFFnTUM0eU9UVTVNak5ETUM0eU1UazFPRFFnTUM0eU9UQTBOVFlnTUM0eU1ETTNNVGdnTUM0eU9EQTFPRGtnTUM0eU1EZ3hNVGdnTUM0eU5qYzFNak5ETUM0eU1URTJNRE1nTUM0eU5qQTFNRElnTUM0eU1UY3dOelFnTUM0eU5UUTJOaUF3TGpJeU16ZzFNU0F3TGpJMU1EY3lNME13TGpJMU16RXpOeUF3TGpJek1UZzRPU0F3TGpJNE5UY3dNeUF3TGpJeE9EY3lOeUF3TGpNeE9UZzFNU0F3TGpJeE1Ua3lNME13TGpNM01qVXdOeUF3TGpFNU9USTRNaUF3TGpReU5qVWdNQzR4T1RNd05Ua2dNQzQwT0RBMk5URWdNQzR4T1RNek9EbFdNQzR4T1RNek9EbGFUVEF1TmpnNU56RTRJREF1TnpVMU16ZzRRekF1TmpnM056RTRJREF1Tnpjd09UZzRJREF1TmpZeE9UZzBJREF1TnpjNE56SXhJREF1TmpRNU56RTRJREF1Tnpnek1USXhRekF1TmpJME1qVXhJREF1TnpreE5qUWdNQzQxT1RjNU9ESWdNQzQzT1RjMU16Y2dNQzQxTnpFek1UZ2dNQzQ0TURBM01qRkRNQzQxTVRJeE5UWWdNQzQ0TURnMU9EY2dNQzQwTlRJeU1UTWdNQzQ0TURnMU9EY2dNQzR6T1RNd05URWdNQzQ0TURBM01qRkRNQzR6TlRVNU9UWWdNQzQzT1RjNE5EWWdNQzR6TVRrNE1USWdNQzQzT0Rnd016RWdNQzR5T0RZek9EUWdNQzQzTnpFM09EaERNQzR5T0RFNE16WWdNQzQzTmprNE1URWdNQzR5TnpjNU15QXdMamMyTmpZd05TQXdMakkzTlRFd015QXdMamMyTWpVelF6QXVNamN5TWpjM0lEQXVOelU0TkRVMklEQXVNamN3TmpReklEQXVOelV6TmpjeklEQXVNamN3TXpnMElEQXVOelE0TnpJeFF6QXVNalUzTURVeElEQXVOalF5T1RnNElEQXVNalF4T0RVeElEQXVOVE0zTWpVMUlEQXVNakkzTlRnMElEQXVORE14TlRJeVREQXVNakV5TVRFNElEQXVNekUyT0RVMlF6QXVNalF5TkRJNUlEQXVNek16TlRnM0lEQXVNamMxTXpJNUlEQXVNelExTVRJMElEQXVNekE1TkRVeElEQXVNelV3T1RnNVF6QXVNelExT1RrNElEQXVNelU0TkRJM0lEQXVNemd6TURJeUlEQXVNell6TWpneklEQXVOREl3TWpVeElEQXVNelkxTlRJeVF6QXVORGt6TXpFMUlEQXVNemN3TnpVNElEQXVOVFkyTnpRNUlEQXVNelkyTmpneElEQXVOak00TnpnMElEQXVNelV6TXpnNVF6QXVOamMzTVRZM0lEQXVNelEzT0RZNElEQXVOekUwTWpRMklEQXVNek0xTkRrMElEQXVOelE0TWpVeElEQXVNekUyT0RVMlREQXVOekU1T1RnMElEQXVOVEkyTVRnNFF6QXVOalV5TkRFNElEQXVOVEF6T1RJNElEQXVOVGcyTkRBMklEQXVORGMzTWpBeklEQXVOVEl5TXpnMElEQXVORFEyTVRnNVF6QXVOVEU1TlRjMUlEQXVORFExTVRFM0lEQXVOVEUyT0RVMklEQXVORFF6T0RJMElEQXVOVEUwTWpVeElEQXVORFF5TXpJeVF6QXVOVEV3TmpVeElEQXVORE01TmpVMUlEQXVOVEV4TlRnMElEQXVORFF3T1RnNUlEQXVOVEE1T0RVeElEQXVORE0yT0RVMVF6QXVOVEEyTlRFNElEQXVOREk1TWpVMUlEQXVOVEExTnpFNElEQXVOREl6TlRJeUlEQXVORGs0TmpVeElEQXVOREUzTWpVMVF6QXVORGswT0RNMklEQXVOREUwTWlBd0xqUTVNRE16TWlBd0xqUXhNakV5TXlBd0xqUTROVFV6TVNBd0xqUXhNVEl3TlVNd0xqUTRNRGN6SURBdU5ERXdNamczSURBdU5EYzFOemM0SURBdU5ERXdOVFUySURBdU5EY3hNVEExSURBdU5ERXhPVGc0UXpBdU5EWTJORE14SURBdU5ERXpOREl4SURBdU5EWXlNVGM1SURBdU5ERTFPVGMwSURBdU5EVTROekUzSURBdU5ERTVOREkwUXpBdU5EVTFNalUySURBdU5ESXlPRGMxSURBdU5EVXlOamtnTUM0ME1qY3hNVGtnTUM0ME5URXlORElnTUM0ME16RTNPRGhETUM0ME5EazNPVFVnTUM0ME16WTBOVGNnTUM0ME5EazFNU0F3TGpRME1UUXdPQ0F3TGpRMU1EUXhNeUF3TGpRME5qSXhNa013TGpRMU1UTXhOaUF3TGpRMU1UQXhOaUF3TGpRMU16TTNPU0F3TGpRMU5UVXlOaUF3TGpRMU5qUXlNaUF3TGpRMU9UTTFNVU13TGpRMU9UUTJOaUF3TGpRMk16RTNOU0F3TGpRMk16TTVPQ0F3TGpRMk5qRTVPU0F3TGpRMk56ZzNOaUF3TGpRMk9ERTFOME13TGpRM01qTTFOQ0F3TGpRM01ERXhOaUF3TGpRM056STBNeUF3TGpRM01EazFJREF1TkRneU1URTRJREF1TkRjd05UZzVRekF1TkRnMk56RTBJREF1TkRZNU9ESTJJREF1TkRreE1UazBJREF1TkRZNE5EZ3lJREF1TkRrMU5EVXhJREF1TkRZMk5UZzVRekF1TlRBd05qVXhJREF1TkRZME9UZzVJREF1TlRBd05qVXhJREF1TkRZMU1qVTFJREF1TlRBMk1URTRJREF1TkRZM056ZzVRekF1TlRjd09UWXlJREF1TkRrNU5EQTRJREF1TmpNM056WTJJREF1TlRJMk9EUXlJREF1TnpBMk1URTRJREF1TlRRNU9USXlRekF1TnpFMk16ZzBJREF1TlRVek1qVTFJREF1TnpFMk1qVXhJREF1TlRRNU9USXlJREF1TnpFMk1qVXhJREF1TlRVNE5EVTFRekF1TnpFMU9ERTRJREF1TlRZME9UUTNJREF1TnpFME9UY3lJREF1TlRjeE5EQTBJREF1TnpFek56RTRJREF1TlRjM056ZzRUREF1TnpBMU1UZzBJREF1TmpReE16ZzRUREF1TmpnNU56RTRJREF1TnpVMU16ZzRXazB3TGpRNE16azROQ0F3TGpRME1EQTFOVU13TGpRNE16azROQ0F3TGpRME16WTFOU0F3TGpRM09Ea3hPQ0F3TGpRME16STFOU0F3TGpRM056VTROQ0F3TGpRME1EazRPVU13TGpRM05qSTFNU0F3TGpRek9EY3lNaUF3TGpRNE16azROQ0F3TGpRek5EazRPU0F3TGpRNE16azROQ0F3TGpRME1EQTFOVnBOTUM0M05EWTJOVEVnTUM0MU16TXpPRGhNTUM0M05UQTJOVEVnTUM0MU1ETTVNakpETUM0M05qTTVPRFFnTUM0MU1URTFNaklnTUM0M09EWTJOVEVnTUM0MU1qSTVPRGdnTUM0M09USTJOVEVnTUM0MU16Z3hPRGhETUM0M056azFPRFFnTUM0MU5ETTFNaklnTUM0M05UZzVNVGdnTUM0MU16WTBOVFVnTUM0M05EWTJOVEVnTUM0MU16TXpPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3dOamNpSUhreFBTSXhMakl3TnpBMklpQjRNajBpTVM0eU1EY3dOaUlnZVRJOUlpMHdMakl3TnpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekZDTmpZd1JpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOa05CUlRORklpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJd0xqazVPVGs1TlNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOTciIHk9IjYxLjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI3MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzIiIHZhbHVlPSJQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPWIyMjAzNmJjLWQyYmYtNGNhMi1iODhjLTRiNGQ4ZmYwNTJmYTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1wb3N0Z3Jlc3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWkRNQzQ0TXprMk5qZ2dNQzR6TkRBM056WWdNQzQyT0RjME16TWdNQzQwTVRVNU5UWWdNQzQwT1RrMk5qZ2dNQzQwTVRVNU5UWkRNQzR6TVRFNU1ETWdNQzQwTVRVNU5UWWdNQzR4TlRrMk5qZ2dNQzR6TkRBM056WWdNQzR4TlRrMk5qZ2dNQzR5TkRjNU5UWkRNQzR4TlRrMk5qZ2dNQzR4TlRVeE16WWdNQzR6TVRFNU1ETWdNQzR3TnprNU5UWXhJREF1TkRrNU5qWTRJREF1TURjNU9UVTJNVU13TGpZNE56UXpNeUF3TGpBM09UazFOakVnTUM0NE16azJOamdnTUM0eE5UVXhNellnTUM0NE16azJOamdnTUM0eU5EYzVOVFphVFRBdU9ETTVOalk0SURBdU16YzJNVGd5UXpBdU9ERTRNVGcySURBdU16azBPRFUzSURBdU56azBNamt4SURBdU5ERXdOak16SURBdU56WTROakE0SURBdU5ESXpNRGsyUXpBdU5qazJORFF6SURBdU5EVTROekV5SURBdU5qQXhNekk0SURBdU5EYzRPVFUySURBdU5EazVOalk0SURBdU5EYzRPVFUyUXpBdU16azRNREE0SURBdU5EYzRPVFUySURBdU16QXlPRGt6SURBdU5EVTROekV5SURBdU1qTXdOekk0SURBdU5ESXpNRGsyUXpBdU1qQTFNRFEySURBdU5ERXdOak16SURBdU1UZ3hNVFVnTUM0ek9UUTROVGNnTUM0eE5UazJOamdnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0eE5UazJOamdnTUM0NE5EUTNOellnTUM0ek1URTVNRE1nTUM0NU1UazVOVFlnTUM0ME9UazJOamdnTUM0NU1UazVOVFpETUM0Mk9EYzBNek1nTUM0NU1UazVOVFlnTUM0NE16azJOamdnTUM0NE5EUTNOellnTUM0NE16azJOamdnTUM0M05URTVOVFpXTUM0ek56WXhPREphVFRBdU5UZzBOelkwSURBdU5URTVPVGM0U0RBdU5UZzNNVGc0UXpBdU5qRXlORFE1SURBdU5USXdNVGMzSURBdU5qUXlOVGt4SURBdU5USTNOREUwSURBdU5qWTBPRFkxSURBdU5UVTFPRGsxUXpBdU5qWTNOekF6SURBdU5UVTVOVEUwSURBdU5qWTVPVEkzSURBdU5UWTRNVGMzSURBdU5qWTVOell4SURBdU5UZ3dNVEk0UXpBdU5qWTVOVFl4SURBdU5Ua3lNRGM0SURBdU5qWTNNamc0SURBdU5qQTNNVFkxSURBdU5qWXpNREExSURBdU5qSXpPREV5UXpBdU5qVTFNREExSURBdU5qVTBOek0wSURBdU5qUXdNREF4SURBdU5qa3hJREF1TmpFNU1UZzNJREF1TnpJek56aE1NQzQyTVRjeU9UVWdNQzQzTWpFek9VTXdMall5TlRFMk15QXdMamN3T0RNeU9DQXdMall5TmpZeU15QXdMalk1TlRBeE5pQXdMall5TmpBeU5pQXdMalk0TWpsRE1DNDJNalUzTlRJZ01DNDJOemN6SURBdU5qSTFNVEV6SURBdU5qY3hPVEF6SURBdU5qSTBOVEF6SURBdU5qWTJOelkyUXpBdU5qSXpOekE1SURBdU5qWXdNRGN5SURBdU5qSXlPVFkzSURBdU5qVXpPREU1SURBdU5qSXpNVFUxSURBdU5qUTRNVEk0UXpBdU5qSXpNelEwSURBdU5qUXlNREl5SURBdU5qSTBNVFE0SURBdU5qTTJOamswSURBdU5qSTBPVFEzSURBdU5qTXhOREF5UXpBdU5qSTFPVFl5SURBdU5qSTBOalk1SURBdU5qSTJPVFk0SURBdU5qRTNPVGsxSURBdU5qSTJOamtnTUM0Mk1EazROVFJNTUM0Mk1qWTNPRGtnTUM0Mk1EazJNemhETUM0Mk1qY3dOVFVnTUM0Mk1EZzFNallnTUM0Mk1qY3dNaklnTUM0Mk1EYzROemtnTUM0Mk1qWTVPRGdnTUM0Mk1EY3lORGhETUM0Mk1qWTVNRFVnTUM0Mk1EVTVPRGNnTUM0Mk1qWTJOek1nTUM0Mk1EUTNOelVnTUM0Mk1qWXpNalVnTUM0Mk1ETXpNekZETUM0Mk1qVTJNamdnTUM0Mk1EQTBOaUF3TGpZeU5ETTVPU0F3TGpVNU5qYzFPQ0F3TGpZeU1qVTNOQ0F3TGpVNU1qTTNOME13TGpZeE56YzBOeUF3TGpVNE1EazNJREF1TmpFeE5ESTVJREF1TlRjd01qVTFJREF1TmpBek56ZzFJREF1TlRZd05UQTVRekF1TlRreU56Z3hJREF1TlRRMk5ETTFJREF1TlRjM01UWXpJREF1TlRNeU16STNJREF1TlRVMk5EZ3lJREF1TlRJek1UWTFRekF1TlRZMU56Z3lJREF1TlRJeE1UYzRJREF1TlRjMU1qVTFJREF1TlRJd01URXhJREF1TlRnME56WTBJREF1TlRFNU9UYzRXazB3TGpRMk16TXlJREF1TlRNNU1EZ3lRekF1TkRjek9Ua3hJREF1TlRNd01qQXlJREF1TkRnNE1EWTNJREF1TlRJME1qYzNJREF1TlRBM05qZzFJREF1TlRJME1qSTNWakF1TlRJME1qWklNQzQxTURrMU9UUkRNQzQxTlRFek1pQXdMalV5TkRrME1TQXdMalUzT0RNeU5DQXdMalUwTmpBNE5pQXdMalU1TlRBd05TQXdMalUyTnpReE5FTXdMall3TWpBeU15QXdMalUzTmpNM015QXdMall3Tnpnek15QXdMalU0TmpJeE55QXdMall4TWpJNE15QXdMalU1TmpZNU1rTXdMall4TWprNE9DQXdMalU1T0RNMk5TQXdMall4TXpNMk5pQXdMalU1T1RVNE1TQXdMall4TXpjek9TQXdMall3TURjNE1rTXdMall4TXpnNE5DQXdMall3TVRJME9TQXdMall4TkRBeU9TQXdMall3TVRjeE5DQXdMall4TkRFNU1pQXdMall3TWpJd01rTXdMalU1TkRVd055QXdMall3TURJeE1TQXdMalU0TVRNNU5TQXdMall3TXpjMk15QXdMalUzTXpreU5pQXdMall4TWpNeU4wTXdMalUyTlRRNU5TQXdMall5TVRrM0lEQXVOVFkxT1RjMklEQXVOak0xTmpRM0lEQXVOVFk1TWpZeUlEQXVOalE0T0RVNFF6QXVOVGN5TlRZMUlEQXVOall5TURnMklEQXVOVGM0T1RJeUlEQXVOamMxTmpZeklEQXVOVGcwTnpZMElEQXVOamcyT0RZM1F6QXVOVGczTXpJM0lEQXVOamt4TnpjeklEQXVOVGc1TnpnM0lEQXVOamsyTWpBM0lEQXVOVGt4T0RReklEQXVOams1T1RGTU1DNDFPVEkyT0RFZ01DNDNNREUwTWpOTU1DNDFPVFk1TkRjZ01DNDNNRGswTkVNd0xqVTVPVGN6SURBdU56RTJNREl5SURBdU5qQXpORFUxSURBdU56SXlNVFkySURBdU5qQTRNREF4SURBdU56STNOamhNTUM0Mk1USXdNelFnTUM0M016TXdOelJETUM0Mk1UQTRNak1nTUM0M016TTBNak1nTUM0Mk1Ea3pORFVnTUM0M016TTVNRFFnTUM0Mk1EYzNOamdnTUM0M016UTJNVGhETUM0Mk1EUTJNVFVnTUM0M016WXdORFVnTUM0Mk1EQTVOalFnTUM0M016ZzJPRFFnTUM0MU9UZzJNRFlnTUM0M05ETkRNQzQxT1RZek1UWWdNQzQzTkRjeE9Ua2dNQzQxT1RVeU5UUWdNQzQzTlRJM01Ea2dNQzQxT1RVMU9EWWdNQzQzTlRrNE9FTXdMalU1TkRnMU5TQXdMamMyT1RNNUlEQXVOVGc0T0RFMElEQXVPREU1T1RNZ01DNDFPRFU0TVNBd0xqZ3pOek0xTjBNd0xqVTRNemd3TVNBd0xqZzBPRGs1TWlBd0xqVTRNRFkyTlNBd0xqZzFOalU1TkNBd0xqVTNOVFF4T1NBd0xqZzJNakExTkVNd0xqVTNNREUxT0NBd0xqZzJOelV4TlNBd0xqVTJNakk1TVNBd0xqZzNNVE14TmlBd0xqVTBPVFUwTkNBd0xqZzNOREExTkVNd0xqVXpORGd6T1NBd0xqZzNOekl3T0NBd0xqVXlOamM0T1NBd0xqZzNOREExTkNBd0xqVXlNVEUzT1NBd0xqZzJPVE0wTVVNd0xqVXhOVFUyT1NBd0xqZzJORFl4SURBdU5URXlORFkxSURBdU9EVTNOalUySURBdU5URXdNelF4SURBdU9EVXlNelExUXpBdU5UQTVOamt6SURBdU9EVXdOelV4SURBdU5UQTROamdnTUM0NE5EWXdNemdnTUM0MU1EYzVOamNnTUM0NE16azRORGRETUM0MU1EY3lOVFFnTUM0NE16TTJNemtnTUM0MU1EWTJPRGtnTUM0NE1qVTNOeklnTUM0MU1EWXpNRGdnTUM0NE1UWTRORE5ETUM0MU1EVTFNelFnTUM0M09UWXhOeUF3TGpVd05UUTJNeUF3TGpjM05UUTNPQ0F3TGpVd05qQTVNU0F3TGpjMU5EZ3dNVU13TGpVd05qRXhPQ0F3TGpjMU5EQTRNeUF3TGpVd05qQXdOU0F3TGpjMU16TTJOeUF3TGpVd05UYzFPU0F3TGpjMU1qWTVNME13TGpVd05UVXlOeUF3TGpjMU1UQTFJREF1TlRBMU1USTVJREF1TnpRNU5EVTJJREF1TlRBME5UZ3hJREF1TnpRM09UYzVRekF1TlRBeU5EY3pJREF1TnpReU16TTJJREF1TkRrNE5UY3pJREF1TnpNM016a2dNQzQwT1RJNE9UWWdNQzQzTXpVd016TkRNQzQwT1RFd016Y2dNQzQzTXpReU16WWdNQzQwT0RjNU1UY2dNQzQzTXpJNU1EZ2dNQzQwT0RNNU16TWdNQzQzTXpNeU5Fd3dMalE0TVRjNU1pQXdMamN6TXpZM01rTXdMalE0TXpNeE1pQXdMamN5TnprM0lEQXVORGcxTVRRMklEQXVOekl5TXpVM0lEQXVORGczTWpnM0lEQXVOekUyT0RVNVF6QXVORGc0TVRNMklEQXVOekUwTlRjeklEQXVORGc1TWpBMklEQXVOekV5TVRjMklEQXVORGt3TXpjZ01DNDNNRGsxTmpoRE1DNDBPVFk1TXpJZ01DNDJPVFE0TmpJZ01DNDFNRFkwT0RrZ01DNDJOek0wTkRVZ01DNDBPVFkxTmpVZ01DNDJNamMxTTBNd0xqUTVOREV5TkNBd0xqWXhOakkzTnlBd0xqUTROelF3TXlBd0xqWXdPRGcxT0NBd0xqUTNPVEkzSURBdU5qQTFOekExUXpBdU5EY3hNVE0zSURBdU5qQXlOVFV4SURBdU5EWXlNVFU0SURBdU5qQXpNVFE0SURBdU5EVXpPREkySURBdU5qQTFNRFUzUXpBdU5EUTFORGswSURBdU5qQTJPVGd6SURBdU5ETTNOekVnTUM0Mk1UQXpNRElnTUM0ME16RTNPRFVnTUM0Mk1UTTJNakpNTUM0ME16RTFOamdnTUM0Mk1UTTNOVFZETUM0ME16SXpORGdnTUM0Mk1ETTNNamtnTUM0ME16UXpNak1nTUM0MU9EZzVOVGdnTUM0ME5EQXdPRE1nTUM0MU56TTJPRGhETUM0ME5EUTVNamtnTUM0MU5qQTRNalVnTUM0ME5USXpNVFVnTUM0MU5EZ3lOaUF3TGpRMk16TXlJREF1TlRNNU1EZ3lXazB3TGpNNU1URXpOeUF3TGpVeU5USTNNMHd3TGpNNU56UTBOQ0F3TGpVeU5UQTVUREF1TkRBek56TTBJREF1TlRJMU1qVTJRekF1TkRJek16SWdNQzQxTWpZeU1Ua2dNQzQwTkRFME1URWdNQzQxTXpFek16RWdNQzQwTlRFMk1ESWdNQzQxTXpRMk9ETkRNQzQwTkRFeU1qZ2dNQzQxTkRRNE5ERWdNQzQwTXpRek1EY2dNQzQxTlRjek9Ea2dNQzQwTWprMk5pQXdMalUyT1Rjek9FTXdMalF5TXpFME9TQXdMalU0Tnpjd01pQXdMalF4T1RneU5DQXdMall3TmpZNElEQXVOREU1T0RNMElEQXVOakkxTnpnNFREQXVOREU1T0RVZ01DNDJNalU0T0RkV01DNDJNalU1TjFZd0xqWXlOakk0TmtNd0xqUXhPVGcxSURBdU5qSTNPVEk1SURBdU5ERTVPVGMzSURBdU5qTXdNREUySURBdU5ESXdNVE0xSURBdU5qTXlOakV6UXpBdU5ESXdNekk1SURBdU5qTTFPREV6SURBdU5ESXdOVGNnTUM0Mk16azNPRFlnTUM0ME1qQTJPQ0F3TGpZME5EWTFPVU13TGpReU1EZzNPU0F3TGpZMU16Y3lNU0F3TGpReU1EWTBPQ0F3TGpZMk5URTVJREF1TkRFNE9UTTRJREF1TmpjM05EVTJRekF1TkRFM05URTVJREF1TmpnM01EazJJREF1TkRFNE5UUTVJREF1TmprMk9UTTRJREF1TkRJeE9UTXpJREF1TnpBMk1EYzFRekF1TkRJMU16RTVJREF1TnpFMU1qRXlJREF1TkRNd09UUTVJREF1TnpJek16VWdNQzQwTXpnek1EY2dNQzQzTWprM016aERNQzQwTWpjNU16Z2dNQzQzTkRBM05TQXdMalF4TnpreE9DQXdMamMxTWpBNE5pQXdMalF3T0RJMk5TQXdMamMyTXpjelF6QXVOREF5T1RjZ01DNDNOekF3T0RjZ01DNHpPVGcyTXprZ01DNDNOekl4TmpJZ01DNHpPVFV3TXpjZ01DNDNOekl6TWpoRE1DNHpPVEUwTlRJZ01DNDNOekkwTnpjZ01DNHpPRGMxTURJZ01DNDNOekEzTURFZ01DNHpPREk1TlRRZ01DNDNOall6TURORE1DNHpOek01TWpVZ01DNDNOVGMxTURZZ01DNHpOalEwTVRRZ01DNDNNemc1TVRjZ01DNHpOVFkxTmpRZ01DNDNNVGMxTlRaRE1DNHpORGczTXlBd0xqWTVOakU1TlNBd0xqTTBNakl3TnlBd0xqWTNNakF4TWlBd0xqTXpOell3T1NBd0xqWTFNVFEyTkVNd0xqTXpNams1TlNBd0xqWXpNRGt4TmlBd0xqTXpNRE13TmlBd0xqWXhNell5TWlBd0xqTXlPVGs1TVNBd0xqWXdOelEwTjBNd0xqTXlPRE0yTkNBd0xqVTNORGd6TXlBd0xqTXpOVGd6TkNBd0xqVTFOVEV6TWlBd0xqTTBOekU0TmlBd0xqVTBNekV4TlVNd0xqTTFPRFV5TWlBd0xqVXpNVEE1T0NBd0xqTTNORE0zTXlBd0xqVXlOakl6TlNBd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTFwTk1DNDFPREl6TURnZ01DNDJNVGsyTVRORE1DNDFPRFUyTWpnZ01DNDJNVFU0TVRNZ01DNDFPVEU1TlRFZ01DNDJNVEk1TURnZ01DNDJNRE15TWpFZ01DNDJNVEkzTlRsRE1DNDJNRGN6TWpjZ01DNDJNVEkzTmpFZ01DNDJNVEUwTXlBd0xqWXhNekF5T0NBd0xqWXhOVFV3TXlBd0xqWXhNelUxTlVNd0xqWXhOVE00TkNBd0xqWXhPRGMyT0NBd0xqWXhORFk0TnlBd0xqWXlNelU0TnlBd0xqWXhNemswTWlBd0xqWXlPRGN6TjBNd0xqWXhNekV5TmlBd0xqWXpORE0zTnlBd0xqWXhNakkxTWlBd0xqWTBNRFF4TXlBd0xqWXhNakF4T0NBd0xqWTBOemM1TmtNd0xqWXhNVGMzT1NBd0xqWTFOVEF6TVNBd0xqWXhNalkxTkNBd0xqWTJNakl4TWlBd0xqWXhNelV4T1NBd0xqWTJPVE14TlVNd0xqWXhOREE1T0NBd0xqWTNOREEzTkNBd0xqWXhORFkzTXlBd0xqWTNPRGM1T1NBd0xqWXhORGt3TlNBd0xqWTRNelE0TVVNd0xqWXhOVE0xTkNBd0xqWTVNamt3T0NBd0xqWXhORFUzTXlBd0xqY3dNVGsxTkNBd0xqWXhNREl3T1NBd0xqY3hNVEUyTmtNd0xqWXdPVEUzT1NBd0xqY3dPVE0wSURBdU5qQTRNVFkzSURBdU56QTNNemd4SURBdU5qQTNNalUwSURBdU56QTFNVFUzUXpBdU5qQTJNemMySURBdU56QXpNRE0xSURBdU5qQTFNREEySURBdU56QXdOVGc1SURBdU5qQXpNVFk1SURBdU5qazNNekE1VERBdU5qQXlOREEzSURBdU5qazFPVFEyUXpBdU5qQXdNaUF3TGpZNU1UazNPU0F3TGpVNU56UTJNaUF3TGpZNE56QTVPU0F3TGpVNU5EWTBJREF1TmpneE5qY3lRekF1TlRnNE9UazNJREF1Tmpjd09ETTBJREF1TlRneU9UZzRJREF1TmpVM056ZzRJREF1TlRnd01EZzBJREF1TmpRMk1USkRNQzQxTnpjeE5qTWdNQzQyTXpRME5qZ2dNQzQxTnpjMk1URWdNQzQyTWpVd01EZ2dNQzQxT0RJek1EZ2dNQzQyTVRrMk1UTmFUVEF1TkRVMk16TXlJREF1TmpFMU9EazJRekF1TkRVNU5qZzBJREF1TmpFMU1URXhJREF1TkRZek1URXpJREF1TmpFME5qazVJREF1TkRZMk5UVTNJREF1TmpFME5qWTNRekF1TkRZNU5URTJJREF1TmpFME5qQXlJREF1TkRjeU5EWXpJREF1TmpFMU1EYzBJREF1TkRjMU1qVXpJREF1TmpFMk1EWXhRekF1TkRnd01qTXlJREF1TmpFM09UZzNJREF1TkRnek9EVWdNQzQyTWpFME1EWWdNQzQwT0RVMk56Y2dNQzQyTWprNE56RkRNQzQwT1RRNU1UWWdNQzQyTnpJMk1qSWdNQzQwT0RjME5DQXdMalk0T1RBM015QXdMalE0TURjMk5TQXdMamN3TXpjMU9VTXdMalEzT1RNM01TQXdMamN3TmpneU9DQXdMalEzT0RBeE1TQXdMamN3T1RneUlEQXVORGMyT0RRM0lEQXVOekV5T1RVNFF6QXVORGMwTlRJeklEQXVOekU1TVRneUlEQXVORGN5TVRrNUlEQXVOekkxTURreElEQXVORGN3TnpnNUlEQXVOek13T1RFM1F6QXVORFEyTlRnNUlEQXVOek13T0RnMElEQXVOREkxT1RreUlEQXVOekEzTXpneElEQXVOREk1T1RVNElEQXVOamM0T1RrNVF6QXVORE14TnpnMUlEQXVOalkxT1RNM0lEQXVORE15TURFMklEQXVOalV6T0RjeElEQXVORE14T0RFM0lEQXVOalEwTkRGRE1DNDBNekUyTnpNZ01DNDJNemd4TkRRZ01DNDBNekV6T0NBd0xqWXpNek16TXlBd0xqUXpNVEU1TWlBd0xqWXpNREl6TmtNd0xqUXpNVEV5TVNBd0xqWXlPVEEySURBdU5ETXhNRFkxSURBdU5qSTRNVE14SURBdU5ETXhNRE0zSURBdU5qSTNORFkwVERBdU5ETXhOREF5SURBdU5qSTNNVE15UXpBdU5ETXpNakl4SURBdU5qSTFOekEySURBdU5ETTFNVFU1SURBdU5qSTBORFFnTUM0ME16Y3hPVFVnTUM0Mk1qTXpORGhETUM0ME5ETXlNVFFnTUM0Mk1qQXdNalVnTUM0ME5EazJOVEVnTUM0Mk1UYzFNVGtnTUM0ME5UWXpNeklnTUM0Mk1UVTRPVFphVFRBdU5UazROemc1SURBdU5qRTRNRFV6U0RBdU5UazNPVFpXTUM0Mk1UZ3dNRE5NTUM0MU9UVXpNRFFnTUM0Mk1UZ3lNVGxETUM0MU9USTROalFnTUM0Mk1UZzFPRFFnTUM0MU9UQTNNRFlnTUM0Mk1Ua3lORGdnTUM0MU9Ea3hNVElnTUM0Mk1qQXhORFJETUM0MU9EZ3pOelVnTUM0Mk1qQTFNVElnTUM0MU9EYzNNVFVnTUM0Mk1qRXdNVGtnTUM0MU9EY3hOekVnTUM0Mk1qRTJNemhNTUM0MU9EWTJNRE1nTUM0Mk1qSTJNamhNTUM0MU9EWTBOek1nTUM0Mk1qTTNOak5ETUM0MU9EWTJNaUF3TGpZeU5EVTBPU0F3TGpVNE5qazRNeUF3TGpZeU5USTNPQ0F3TGpVNE56VXlJREF1TmpJMU9EY3hRekF1TlRnM056Z3hJREF1TmpJMk1UZzRJREF1TlRnNE1EWXhJREF1TmpJMk5EZzVJREF1TlRnNE16VTVJREF1TmpJMk56Y3lRekF1TlRnNE56WTRJREF1TmpJM01UWWdNQzQxT0RreU1Ea2dNQzQyTWpjMU1UUWdNQzQxT0RrMk56Y2dNQzQyTWpjNE1qbERNQzQxT1RFMk5UY2dNQzQyTWpreU1pQXdMalU1TkRBNElEQXVOakk1T0RJNUlEQXVOVGsyTkRneUlEQXVOakk1TlRNNVF6QXVOVGs0T1RVZ01DNDJNamt4TVRJZ01DNDJNREV5TURVZ01DNDJNamM0TnpRZ01DNDJNREk0T0RrZ01DNDJNall3TWtNd0xqWXdNek15TVNBd0xqWXlOVFUzTmlBd0xqWXdNemN4TmlBd0xqWXlOVEE1TnlBd0xqWXdOREEyT0NBd0xqWXlORFU0T0VNd0xqWXdORE13TXlBd0xqWXlOREkwT0NBd0xqWXdORFV4T1NBd0xqWXlNemc1TlNBd0xqWXdORGN4TkNBd0xqWXlNelV6UXpBdU5qQTFNVEkxSURBdU5qSXlPRFU0SURBdU5qQTFNekk0SURBdU5qSXlNRGM0SURBdU5qQTFNamsxSURBdU5qSXhNamxNTUM0Mk1EVXpNVElnTUM0Mk1qRXhOVGRNTUM0Mk1EUTRPRE1nTUM0Mk1qQXhNVEpNTUM0Mk1EUXdOamNnTUM0Mk1Ua3pNekZETUM0Mk1ETTNOek1nTUM0Mk1Ua3hNemdnTUM0Mk1ETTBOVEVnTUM0Mk1UZzVOeUF3TGpZd016QTVPU0F3TGpZeE9EZ3lOVU13TGpZd01qWTVOU0F3TGpZeE9EWTFPU0F3TGpZd01qSTFOU0F3TGpZeE9EVXlOU0F3TGpZd01UYzNOeUF3TGpZeE9EUXhPRU13TGpZd01UQTVOaUF3TGpZeE9ESTFNU0F3TGpZd01ETXpOaUF3TGpZeE9ERTBOQ0F3TGpVNU9UVXhPU0F3TGpZeE9EQTRPRU13TGpVNU9USTRJREF1TmpFNE1EY3lJREF1TlRrNU1ETTNJREF1TmpFNE1EWXhJREF1TlRrNE56ZzVJREF1TmpFNE1EVXpXazB3TGpRM01Ea3lNaUF3TGpZeU1UQTFOMHd3TGpRMk9ERTJOaUF3TGpZeU1EZzBNa3d3TGpRMk9ERTBPU0F3TGpZeU1Ea3dPRU13TGpRMk5qUXlOU0F3TGpZeU1EZ3lNU0F3TGpRMk5EWTVPU0F3TGpZeU1UQTBOaUF3TGpRMk16QTFOQ0F3TGpZeU1UVTNNa013TGpRMk1UWXhJREF1TmpJeU1EZzJJREF1TkRZd01UTXpJREF1TmpJek1ERTJJREF1TkRVNU9EZzBJREF1TmpJME9EQTRRekF1TkRVNU56YzRJREF1TmpJMU9ETTJJREF1TkRZd01ERTNJREF1TmpJMk9EY2dNQzQwTmpBMU5qVWdNQzQyTWpjM05EWkRNQzQwTmpFd09EUWdNQzQyTWpnM05ESWdNQzQwTmpFM05ETWdNQzQyTWprMk5Ua2dNQzQwTmpJMU1qTWdNQzQyTXpBME5qaERNQzQwTmpRek5UVWdNQzQyTXpJME56Z2dNQzQwTmpZNE1TQXdMall6TXpneE1TQXdMalEyT1RRNU5DQXdMall6TkRJMU1rTXdMalEzTWpFeE9TQXdMall6TkRVM05TQXdMalEzTkRjM01TQXdMall6TXprd05pQXdMalEzTmpreklEQXVOak15TXpjM1F6QXVORGMzT0RJMElEQXVOak14TnpnZ01DNDBOemcyTWpRZ01DNDJNekV3TlRNZ01DNDBOemt6TURNZ01DNDJNekF5TVRsRE1DNDBOems1TlRZZ01DNDJNamsxTURVZ01DNDBPREF6T0RrZ01DNDJNamcyTVRnZ01DNDBPREExTkRnZ01DNDJNamMyTmpORE1DNDBPREExTnpJZ01DNDJNamMwTWprZ01DNDBPREExTnpRZ01DNDJNamN4T1RRZ01DNDBPREExTlRRZ01DNDJNalk1TmpGRE1DNDBPREExTXpFZ01DNDJNalkyT0RrZ01DNDBPREEwTnpjZ01DNDJNalkwTWlBd0xqUTRNRE01TkNBd0xqWXlOakUxT1VNd0xqUTRNREkwSURBdU5qSTFOamN6SURBdU5EYzVPVGczSURBdU5qSTFNakkxSURBdU5EYzVOalV4SURBdU5qSTBPRFF5UXpBdU5EYzVNRE0xSURBdU5qSTBNVEU1SURBdU5EYzRNamcySURBdU5qSXpOVEl5SURBdU5EYzNORFEwSURBdU5qSXpNRGd5UXpBdU5EYzFOekU0SURBdU5qSXlNRGcySURBdU5EY3pORFl4SURBdU5qSXhOREEySURBdU5EY3dPVEl5SURBdU5qSXhNRFUzV2swd0xqWXhPRFE1SURBdU56UXlOek0wVERBdU5qRTROVFFnTUM0M05ESTNNVGhETUM0Mk1qQXlNRE1nTUM0M05EUXdPU0F3TGpZeU1qQTJJREF1TnpRMU1Ua3lJREF1TmpJME1EVXhJREF1TnpRMk1ESXhRekF1TmpNeU1EWTRJREF1TnpRNU16SXpJREF1TmpRMU1UUTJJREF1TnpVd05qQXlJREF1TmpZNE1qWTJJREF1TnpRMU9ESXhRekF1TmpZek5UWTBJREF1TnpRNU9UVTBJREF1TmpVNE1qa3pJREF1TnpVek16a3hJREF1TmpVeU5qRTJJREF1TnpVMk1ESTVRekF1TmpRMU5qazBJREF1TnpVNU1qUTVJREF1TmpNeU5qWTFJREF1TnpZeE56SXlJREF1TmpJeU1EYzFJREF1TnpZeE9ETTRRekF1TmpFMk56WTBJREF1TnpZeE9USXhJREF1TmpFeUlEQXVOell4TXpVM0lEQXVOakE1TVRZeUlEQXVOell3TkRrMFF6QXVOakE0TWpnM0lEQXVOell3TWpReElEQXVOakEzTkRVM0lEQXVOelU1T0RRNUlEQXVOakEyTnpBM0lEQXVOelU1TXpNeVF6QXVOakEyTkRReElEQXVOelV6TlRjeUlEQXVOakEzTXpNM0lEQXVOelV3TVRnMklEQXVOakE0TXpneUlEQXVOelE0TWpjNFF6QXVOakE1TWpJMklEQXVOelEyTmpRNUlEQXVOakV3TmpNNElEQXVOelExTXpnMUlEQXVOakV5TXpVZ01DNDNORFEzTWpaRE1DNDJNVE15TnpZZ01DNDNORFF6TVRjZ01DNDJNVFF5T1RrZ01DNDNORFF3TWpJZ01DNDJNVFUwTXpVZ01DNDNORE0yT1RWRE1DNDJNVFl6TnpJZ01DNDNORE0wTWpVZ01DNDJNVGN6T0RjZ01DNDNORE14TXpJZ01DNDJNVGcwT1NBd0xqYzBNamN6TkZwTk1DNDBPRFE0T1RjZ01DNDNORFF5TnpoSU1DNDBPRFV5TkRWV01DNDNORFF6TVRGRE1DNDBPRFl3TVRJZ01DNDNORFEwTURZZ01DNDBPRFkzTmpjZ01DNDNORFExT0RJZ01DNDBPRGMwT1RRZ01DNDNORFE0TXpaRE1DNDBPRGM0T0RJZ01DNDNORFE1TnpFZ01DNDBPRGd5TmpFZ01DNDNORFV4TWpnZ01DNDBPRGcyTXpFZ01DNDNORFV6TURkRE1DNDBPVEEwTWpNZ01DNDNORFl3TlRRZ01DNDBPVEk1TmpNZ01DNDNORGczTWpZZ01DNDBPVFF4TWpRZ01DNDNOVEU0TTBNd0xqUTVOVEkzSURBdU56VTBPVE16SURBdU5EazFNVEl4SURBdU56VTNPREl5SURBdU5Ea3pOekkzSURBdU56VTVOemhETUM0ME9EVTJORE1nTUM0M056RXhNVFlnTUM0ME56WXhOallnTUM0M056VTBPREVnTUM0ME5qY3dOVFFnTUM0M056Y3dOREZETUM0ME5UYzVORElnTUM0M056ZzFPRFVnTUM0ME5Ea3lNVElnTUM0M056Y3dOREVnTUM0ME5ETTVJREF1TnpjMU56RTBRekF1TkRReU1ESTFJREF1TnpjMU1qTXlJREF1TkRNNU56QXhJREF1TnpjME16VXpJREF1TkRNM09Ea3lJREF1Tnpjek16VTNRekF1TkRNM01UWXhJREF1TnpjeU9UYzFJREF1TkRNM01qRXlJREF1TnpjeU9EYzJJREF1TkRNMk56TWdNQzQzTnpJME56ZERNQzQwTXpneU1qUWdNQzQzTnpFM05qTWdNQzQwTkRBME5qVWdNQzQzTnpBNE9EUWdNQzQwTkRRek9ESWdNQzQzTnpBd09EZERNQzQwTlRZM05EY2dNQzQzTmpjMU5EZ2dNQzQwTmpJNU16Z2dNQzQzTmpVMU1qTWdNQzQwTmpjM01ERWdNQzQzTmpFM016bERNQzQwTnpBMk1UTWdNQzQzTlRrME1UVWdNQzQwTnpJMU1ERWdNQzQzTlRZNU9UTWdNQzQwTnpRNE5EZ2dNQzQzTlRNNU9ETkRNQzQwTnpZek5ERWdNQzQzTlRJd05qZ2dNQzQwTnpnd01pQXdMamMwT1RreE5TQXdMalE0TURJMk5pQXdMamMwTnpNNU9FTXdMalE0TWpjek9DQXdMamMwTkRZMklEQXVORGcwTURFMklEQXVOelEwTXpZeElEQXVORGcwT0RrM0lEQXVOelEwTWpjNFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0MTMiIHk9IjU1Ljc1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iQVdTIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSAtPiBBV1MgRUMyIChFbGFzdGljIENvbXB1dGUgQ2xvdWQpIiBzdHlsZT0iaXIucmVmPWZhM2U5YTc2LTc5NDYtNDY3OC1hNzdjLWU5YTNlMmFlYzdmZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjEyOTtlbnRyeVk9MC4yNjk7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyOCIgc291cmNlPSIzNCIgdGFyZ2V0PSIzMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM0IiB2YWx1ZT0iQVdTIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSIgc3R5bGU9ImlyLnJlZj1lZjdhZmRjZS0zZmQ1LTQ0OTgtODRiZi1mNDBkYzI0MTI4YjA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtV0FGO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmprNU56a2dNQzQyTlRBMk9UbE1NQzQyTlRFeE1qTWdNQzQyTmprMU5UWk1NQzQ0TVRBMU5USWdNQzQ0TWpnNU9EbE1NQzQ0TWprME1EZ2dNQzQ0TVRBeE16Sk1NQzQyTmprNU56a2dNQzQyTlRBMk9UbGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UZzVOVEV4SURBdU1UY3dNVEE1VERBdU1UY3dOalUwSURBdU1UZzRPVFkxVERBdU16UTNNek00SURBdU16WTFOalEzVERBdU16WTJNVGsxSURBdU16UTJOemt4VERBdU1UZzVOVEV4SURBdU1UY3dNVEE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak13TkRBek1pQXdMalkzTnpJNE9Fd3dMakl4TURZNU15QXdMamMzTURZelREQXVNakk1TlRVZ01DNDNPRGswT0RkTU1DNHpNakk0T0RnZ01DNDJPVFl4TkRWTU1DNHpNRFF3TXpJZ01DNDJOemN5T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tnpjd056QTNJREF1TWpFd05qRTNUREF1TmpjM016WTRJREF1TXpBek9UVTFUREF1TmprMk1qSTBJREF1TXpJeU9ERXhUREF1TnpnNU5UWXpJREF1TWpJNU5EY3pUREF1Tnpjd056QTNJREF1TWpFd05qRTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNek14TnlBd0xqUTROamN6TlZZd0xqVXhNelF3TWtnd0xqZ3dOalkxTVVNd0xqZ3dOREl5TWlBd0xqVTNNelEzSURBdU56ZzBNRE00SURBdU5qTXhORGNnTUM0M05EZzJOVEVnTUM0Mk9EQXdOamhNTUM0M01qY3dOVEVnTUM0Mk5qUXpNelZETUM0M05Ua3dOak1nTUM0Mk1qQXpNRFlnTUM0M056Y3pOREVnTUM0MU5qYzNPVE1nTUM0M056azFPRFFnTUM0MU1UTTBNREpJTUM0M05USTVNVGRXTUM0ME9EWTNNelZJTUM0M056azFPRFJETUM0M056Y3lOak1nTUM0ME16STBPRElnTUM0M05UZzVPRGtnTUM0ek9EQXhNVGtnTUM0M01qY3dOVEVnTUM0ek16WXlNREpNTUM0M05EZzJOVEVnTUM0ek1qQXdOamhETUM0M09ETTVORE1nTUM0ek5qZzJPVGdnTUM0NE1EUXdNelFnTUM0ME1qWTJPVFVnTUM0NE1EWXpPRFFnTUM0ME9EWTNNelZJTUM0NE16TXpNVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamd3TURZNElEQXVNalV4TXpreVREQXVOalkwTXpNMUlEQXVNamN5T1RreVF6QXVOakl3TXpBMklEQXVNalF3T1RnZ01DNDFOamMzT1RNZ01DNHlNakkzTURJZ01DNDFNVE0wTURJZ01DNHlNakEwTlRsV01DNHlORGN4TWpaSU1DNDBPRFkzTXpWV01DNHlNakEwTlRsRE1DNDBNekkwT0RJZ01DNHlNakkzT0NBd0xqTTRNREV4T1NBd0xqSTBNVEExTkNBd0xqTXpOakl3TWlBd0xqSTNNams1TWt3d0xqTXlNREEyT0NBd0xqSTFNVE01TWtNd0xqTTJPRFk1T0NBd0xqSXhOakVnTUM0ME1qWTJPVFVnTUM0eE9UWXdNRGtnTUM0ME9EWTNNelVnTUM0eE9UTTJOVGxXTUM0eE5qWTVPVEpJTUM0MU1UTTBNREpXTUM0eE9UTTJOVGxETUM0MU56TTBORElnTUM0eE9UWXdNRGtnTUM0Mk16RTBNemtnTUM0eU1UWXhJREF1Tmpnd01EWTRJREF1TWpVeE16a3lWakF1TWpVeE16a3lXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTRNREEyT0NBd0xqYzBPRFkxTVVNd0xqWXpNVFF6T1NBd0xqYzRNemswTXlBd0xqVTNNelEwTWlBd0xqZ3dOREF6TkNBd0xqVXhNelF3TWlBd0xqZ3dOak00TkZZd0xqZ3pNekExTVVnd0xqUTROamN6TlZZd0xqZ3dOak00TkVNd0xqUXlOalk1TlNBd0xqZ3dOREF6TkNBd0xqTTJPRFk1T0NBd0xqYzRNemswTXlBd0xqTXlNREEyT0NBd0xqYzBPRFkxTVV3d0xqTXpOVGd3TWlBd0xqY3lOekExTVVNd0xqTTNPVGd6TVNBd0xqYzFPVEEyTXlBd0xqUXpNak0wTkNBd0xqYzNOek0wTVNBd0xqUTROamN6TlNBd0xqYzNPVFU0TkZZd0xqYzFNamt4T0Vnd0xqVXhNelF3TWxZd0xqYzNPVFU0TkVNd0xqVTJOelkxTlNBd0xqYzNOekkyTXlBd0xqWXlNREF4T0NBd0xqYzFPRGs0T1NBd0xqWTJNemt6TlNBd0xqY3lOekExTVV3d0xqWTRNREEyT0NBd0xqYzBPRFkxTVZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBME5Ua2dNQzQxTVRNME1ESkRNQzR5TWpJM09DQXdMalUyTnpZMU5TQXdMakkwTVRBMU5DQXdMall5TURBeE9DQXdMakkzTWprNU1pQXdMalkyTXprek5Vd3dMakkxTVRNNU1pQXdMalk0TURBMk9FTXdMakl4TmpFZ01DNDJNekUwTXprZ01DNHhPVFl3TURrZ01DNDFOek0wTkRJZ01DNHhPVE0yTlRrZ01DNDFNVE0wTURKSU1DNHhOalk1T1RKV01DNDBPRFkzTXpWSU1DNHhPVE0yTlRsRE1DNHhPVFl3TURrZ01DNDBNalkyT1RVZ01DNHlNVFl4SURBdU16WTROams0SURBdU1qVXhNemt5SURBdU16SXdNRFk0VERBdU1qY3lPVGt5SURBdU16TTFPREF5UXpBdU1qUXdPVGdnTUM0ek56azRNekVnTUM0eU1qSTNNRElnTUM0ME16SXpORFFnTUM0eU1qQTBOVGtnTUM0ME9EWTNNelZJTUM0eU5EY3hNalpXTUM0MU1UTTBNREpJTUM0eU1qQTBOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TkRjNUlEQXVOREUxT0RReFF6QXVOakU0TlRVZ01DNDBNVFE0TVRRZ01DNDJNVFl6T1RnZ01DNDBNVFF5TnpjZ01DNDJNVFF5TVRJZ01DNDBNVFF5TnpkRE1DNDJNVEl3TWpZZ01DNDBNVFF5TnpjZ01DNDJNRGs0TnpRZ01DNDBNVFE0TVRRZ01DNDJNRGM1TkRVZ01DNDBNVFU0TkRGRE1DNDJNRFU1TnpnZ01DNDBNVFk0TkRNZ01DNDJNRFF5T1NBd0xqUXhPRE14T0NBd0xqWXdNekF6TkNBd0xqUXlNREV6TTBNd0xqWXdNVGMzTnlBd0xqUXlNVGswT0NBd0xqWXdNRGs1TVNBd0xqUXlOREEwTnlBd0xqWXdNRGMwTlNBd0xqUXlOakkwTVVNd0xqVTVPVGt5TmlBd0xqUXpORE0zTVNBd0xqVTVPRFUwTlNBd0xqUTBNalF6TlNBd0xqVTVOall4TWlBd0xqUTFNRE0zTlVNd0xqVTVNelE0TlNBd0xqUXhPREE1T0NBd0xqVTRNakF3TlNBd0xqTTROekU1TkNBd0xqVTJNek13TVNBd0xqTTJNRGN3TkVNd0xqVTBORFU1TnlBd0xqTXpOREl4TlNBd0xqVXhPVE14TlNBd0xqTXhNekExTlNBd0xqUTRPVGswTlNBd0xqSTVPVE13T1VNd0xqUTNNVGt5T0NBd0xqSTROVFUxTnlBd0xqUTFNRGd6SURBdU1qYzJOREEwSURBdU5ESTRORGM1SURBdU1qY3lOalF5UXpBdU5ESTFOVGs0SURBdU1qY3lNVFl5SURBdU5ESXlOalFnTUM0eU56STJOREVnTUM0ME1qQXdOVGtnTUM0eU56UXdNRFpETUM0ME1UYzBOemNnTUM0eU56VXpOeUF3TGpReE5UUXhOQ0F3TGpJM056VTBOQ0F3TGpReE5ERTRPQ0F3TGpJNE1ERTVORU13TGpReE1qazJNU0F3TGpJNE1qZzBOQ0F3TGpReE1qWXpPU0F3TGpJNE5UZ3lNeUF3TGpReE16STJPU0F3TGpJNE9EWTNORU13TGpReE16a2dNQzR5T1RFMU1qVWdNQzQwTVRVME5Ea2dNQzR5T1RRd09TQXdMalF4TnpZM09TQXdMakk1TlRrM05VTXdMalF6TVRVNU55QXdMak13T1RVNUlEQXVORFF4T0RBMklEQXVNekkyTlRNMUlEQXVORFEzTXpNMklEQXVNelExTWpBelF6QXVORFV5T0RZM0lEQXVNell6T0RjeElEQXVORFV6TlRNMUlEQXVNemd6TmpReklEQXVORFE1TWpjNUlEQXVOREF5TmpReFF6QXVORE16T0RFeUlEQXVNemd5TWpReUlEQXVOREE1TWpjNUlEQXVNelUzT0RReUlEQXVNemd3TWpFeUlEQXVNelUzT0RReVF6QXVNemM0TURZeUlEQXVNelUzT0RRMUlEQXVNemMxT1RRMUlEQXVNelU0TXpZNElEQXVNemMwTURReUlEQXVNelU1TXpZM1F6QXVNemN5TVRNNElEQXVNell3TXpZMUlEQXVNemN3TlRBMElEQXVNell4T0RBNUlEQXVNelk1TWpjNUlEQXVNell6TlRjMVF6QXVNelk0TURReElEQXVNelkxTXpZMUlEQXVNelkzTWpZZ01DNHpOamMwTXpFZ01DNHpOamN3TURRZ01DNHpOamsxT1RORE1DNHpOalkzTkRnZ01DNHpOekUzTlRRZ01DNHpOamN3TWpZZ01DNHpOek01TkRVZ01DNHpOamM0TVRJZ01DNHpOelU1TnpWRE1DNHpOelUxTkRVZ01DNHpPVFU0TkRJZ01DNHpPVEE0TnprZ01DNDBOVFV4TnpVZ01DNHpOamt3TVRJZ01DNDBPRGsxTnpSRE1DNHpOamMxTkRVZ01DNDBPVEUzTURnZ01DNHpOall6TkRVZ01DNDBPVE00TkRFZ01DNHpOalV3TVRJZ01DNDBPVFl4TURoRE1DNHpOVEEwTkRrZ01DNDFNakkyT0RRZ01DNHpORFl4T1RJZ01DNDFOVE0yT1RVZ01DNHpOVE13TlRRZ01DNDFPRE15TVRKRE1DNHpOVGs1TVRjZ01DNDJNVEkzTWprZ01DNHpOemMwTVRnZ01DNDJNemcyT0RFZ01DNDBNREl5TVRJZ01DNDJOVFl4TURkRE1DNDBNamd5TkRZZ01DNDJOek0zTXpVZ01DNDBOVFkwT0RrZ01DNDJPRGM0TlRZZ01DNDBPRFl5TVRJZ01DNDJPVGd4TURkRE1DNDBPRGMyTmpVZ01DNDJPVGcyTXpRZ01DNDBPRGt4T1RrZ01DNDJPVGc1TURVZ01DNDBPVEEzTkRVZ01DNDJPVGc1TURkSU1DNDBPVE0xTkRWRE1DNDFNVEV5TnprZ01DNDJPVGN6TURjZ01DNDJNekU1TkRVZ01DNDJPREUzTURjZ01DNDJOVFkyTVRJZ01DNDFPRFU1TnpSRE1DNDJPVEEzTkRVZ01DNDBOVFU1TnpVZ01DNDJNak0wTVRJZ01DNDBNVGMwTkRFZ01DNDJNakEwTnprZ01DNDBNVFU0TkRGYVRUQXVORGN4TVRRMUlEQXVOall6T1RjelF6QXVORFV5TkRZMUlEQXVOalUyTURReUlEQXVORE0wTmpBeklEQXVOalEyTXpBM0lEQXVOREUzT0RFeUlEQXVOak0wT1RBM1F6QXVNems0TXpJNElEQXVOakl4TWpjM0lEQXVNemcwTlRZNElEQXVOakF3T1RJM0lEQXVNemM1TVRjNElEQXVOVGMzTnpZM1F6QXVNemN6TnpnNElEQXVOVFUwTmpBNElEQXVNemMzTVRRNElEQXVOVE13TWpjeklEQXVNemc0TmpFeUlEQXVOVEE1TkRReFREQXVNemt4T0RFeUlEQXVOVEF6T1RjMFF6QXVOREUwTXpRMUlEQXVORFk0TnpjMElEQXVOREEzT0RFeUlEQXVOREl3TnpjMUlEQXVOREF3TnpRMUlEQXVNemt4TnpBNFF6QXVOREU0TVRreUlEQXVOREExTURrMElEQXVORE15TmpNM0lEQXVOREl4T1RreElEQXVORFF6TVRRMUlEQXVORFF4TXpBNFF6QXVORFEwTWprMElEQXVORFF6TmpZMUlEQXVORFEyTVRFeklEQXVORFExTmpNeElEQXVORFE0TXpjeklEQXVORFEyT1RaRE1DNDBOVEEyTXpRZ01DNDBORGd5T0RrZ01DNDBOVE15TXpZZ01DNDBORGc1TWpJZ01DNDBOVFU0TlRRZ01DNDBORGczT0VNd0xqUTFPRFEzTXlBd0xqUTBPRFl6TnlBd0xqUTJNRGs1TVNBd0xqUTBOemN5TmlBd0xqUTJNekE1TkNBd0xqUTBOakUyUXpBdU5EWTFNVGszSURBdU5EUTBOVGswSURBdU5EWTJOemt5SURBdU5EUXlORFF5SURBdU5EWTNOamM1SURBdU5ETTVPVGMxUXpBdU5EYzFPRFExSURBdU5ERTVPREF5SURBdU5EYzVOamcxSURBdU16azRNVE01SURBdU5EYzRPVFVnTUM0ek56WXpPRGxETUM0ME56Z3lNVFVnTUM0ek5UUTJNemdnTUM0ME56STVNakVnTUM0ek16TXlPRFFnTUM0ME5qTTBNVElnTUM0ek1UTTNNRGxETUM0ME9EQXpORFlnTUM0ek1qTTFNaUF3TGpRNU16ZzRNaUF3TGpNek9ESTJOU0F3TGpVd01qSXhNaUF3TGpNMU5UazNOVU13TGpVeU1URTBOU0F3TGpNNU5URTNOU0F3TGpVeE5qZzNPU0F3TGpRME9UTXdPQ0F3TGpRNU1USTNPU0F3TGpRNU5qRXdPRU13TGpRMk5EazRJREF1TlRRM09UTTNJREF1TkRVM09EUTRJREF1TmpBM016azFJREF1TkRjeE1UUTFJREF1TmpZek9UY3pXazB3TGpZek1URTBOU0F3TGpVM09UVTNORU13TGpZeE16WTNPU0F3TGpZME56VTNOQ0F3TGpVek1ETTBOU0F3TGpZMk5qYzNNeUF3TGpVd01EUTNPU0F3TGpZM01UUTBRekF1TkRrek1qYzVJREF1TmpRMU5UYzBJREF1TkRjNU1ERXlJREF1TlRjek16QTNJREF1TlRFME5qRXlJREF1TlRBNE1qUXhRekF1TlRNNU5UQTRJREF1TkRZME9EWTVJREF1TlRRMk5UTTNJREF1TkRFek5UQTRJREF1TlRNME1qRXlJREF1TXpZMU1EUXlRekF1TlRVNE16UTFJREF1TXprek16QTRJREF1TlRjNE5qRXlJREF1TkRNM09UYzFJREF1TlRZM09ERXlJREF1TlRBME9UQTRRekF1TlRZM016a3pJREF1TlRBM05UYzBJREF1TlRZM056azBJREF1TlRFd016QTFJREF1TlRZNE9UWWdNQzQxTVRJM016bERNQzQxTnpBeE1qY2dNQzQxTVRVeE56TWdNQzQxTnpJd01EVWdNQzQxTVRjeE9UVWdNQzQxTnpRek5EWWdNQzQxTVRnMU16bERNQzQxTnpZMk9EY2dNQzQxTVRrNE9ETWdNQzQxTnprek9DQXdMalV5TURRNE5TQXdMalU0TWpBM0lEQXVOVEl3TWpZMVF6QXVOVGcwTnpZZ01DNDFNakF3TkRVZ01DNDFPRGN6TWlBd0xqVXhPVEF4TkNBd0xqVTRPVFF4TWlBd0xqVXhOek13T0VNd0xqWXdOamM0TnlBd0xqVXdNRFEwTVNBd0xqWXhPRFE0TXlBd0xqUTNPRFU0TnlBd0xqWXlNamczT1NBd0xqUTFORGMzTlVNd0xqWXpOVFkzT1NBd0xqUTNNek13T0NBd0xqWTBPVEF4TWlBd0xqVXhNRGMzTkNBd0xqWXpNVEkzT1NBd0xqVTNPVFUzTkVnd0xqWXpNVEUwTlZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXdYMnhwYm1WaGNpSWdlREU5SWkwd0xqSXdOekEyTnlJZ2VURTlJakV1TWpBM01EY2lJSGd5UFNJeExqSXdOeklpSUhreVBTSXRNQzR5TURjeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRa1F3T0RFMklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdSalV5TlRJaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMSIgeT0iNTguNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzNSIgdmFsdWU9IkhSIiBzdHlsZT0idGV4dDtodG1sPTE7cmVzaXphYmxlPTA7ZWRpdGFibGU9MDtkZWxldGFibGU9MDtjb25uZWN0YWJsZT0wO3BvaW50cz1bXTtpci50eXBlPUNPTVBPTkVOVF9UQUc7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlOyIgcGFyZW50PSIyOCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxLjMiIHk9IjAuNDUiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTUiIHk9IjM2MCIgd2lkdGg9IjE0OSIgaGVpZ2h0PSIzMzUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik91dCBPZiBTY29wZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW91dC1vZi1zY29wZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJMk5DSWdhR1ZwWjJoMFBTSTJOQ0lnZG1sbGQwSnZlRDBpTUNBd0lEWTBJRFkwSWlCbWFXeHNQU0p1YjI1bElqNG1JM2hoT3p4emRIbHNaVDRtSTNoaE95QWdJQ0F1YVdOdmJpMW1hV3hzSUhzbUkzaGhPeUFnSUNBZ0lDQWdabWxzYkRvZ0l6RXhRVGhEUmpzbUkzaGhPeUFnSUNCOUppTjRZVHM4TDNOMGVXeGxQaVlqZUdFN1BIQmhkR2dnWkQwaVRUTXhMams1T1RnZ09TNDFPVFk1TWtNek9DNHdNelFnT1M0MU9UWTVNaUEwTXk0MU1URWdNVEV1T1RneU5pQTBOeTQxTXpreElERTFMamcyTWpGRE5EY3VOalUwSURFMUxqazBNVGNnTkRjdU56WXpNU0F4Tmk0d016STFJRFEzTGpnMk5USWdNVFl1TVRNME5rTTBOeTQ1TmpjeklERTJMakl6TmpjZ05EZ3VNRFU0TVNBeE5pNHpORFU0SURRNExqRXpOellnTVRZdU5EWXdOVU0xTWk0d01UY3pJREl3TGpRNE9Ea2dOVFF1TkRBeU9TQXlOUzQ1TmpVNUlEVTBMalF3TWprZ016SkROVFF1TkRBeU9TQTBOQzR6TnpNZ05EUXVNemN5TnlBMU5DNDBNRE15SURNeExqazVPVGdnTlRRdU5EQXpNa014T1M0Mk1qWTVJRFUwTGpRd016SWdPUzQxT1RZMk9DQTBOQzR6TnpNZ09TNDFPVFkyT0NBek1rTTVMalU1TmpZNElERTVMall5TnpFZ01Ua3VOakkyT1NBNUxqVTVOamt5SURNeExqazVPVGdnT1M0MU9UWTVNbHBOTkRZdU1EWXpJREl4TGpJM01qWk1NakV1TWpjeU5DQTBOaTR3TmpNeVF6STBMakkwTnprZ05EZ3VNek0yTkNBeU55NDVOall5SURRNUxqWTROamNnTXpFdU9UazVPQ0EwT1M0Mk9EWTNRelF4TGpjMk56a2dORGt1TmpnMk55QTBPUzQyT0RZMUlEUXhMamMyT0RFZ05Ea3VOamcyTlNBek1rTTBPUzQyT0RZMUlESTRMakV5TnpnZ05EZ3VORFF5TVNBeU5DNDFORFl4SURRMkxqTXpNVE1nTWpFdU5qTXpNa3cwTmk0d05qTWdNakV1TWpjeU5scE5NekV1T1RrNU9DQXhOQzR6TVRNMFF6SXlMakl6TVRjZ01UUXVNekV6TkNBeE5DNHpNVE14SURJeUxqSXpNaUF4TkM0ek1UTXhJRE15UXpFMExqTXhNekVnTXpZdU1ETXpOeUF4TlM0Mk5qTTBJRE01TGpjMU1pQXhOeTQ1TXpZMklEUXlMamN5TnpWTU5ESXVOekkzTWlBeE55NDVNelk1UXpNNUxqYzFNVGNnTVRVdU5qWXpOeUF6Tmk0d016TTBJREUwTGpNeE16UWdNekV1T1RrNU9DQXhOQzR6TVRNMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMjEiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03Y2I4N2VjMS1lMDllLTQxZWEtOTkyNC03Y2IxNTc4N2I0MTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3V0LW9mLXNjb3BlO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjEyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEyIiB5PSI0MCIgd2lkdGg9IjEyNiIgaGVpZ2h0PSIyNjciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9YzI1YTg0N2YtMmYyZS00Nzc2LWE2ODEtMGFmZTM2ZWI3YTQyOyIgcGFyZW50PSIyMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNy41IiB5PSI3OCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNCIgdmFsdWU9IkdlbmVyaWMgQ2xpZW50IC0+IEFXUyBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuMTY4O2VudHJ5WT0wLjI3NDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTEwODM5NTc4LTdhMjYtNDNiMS05YTcyLTU4MmQ0Y2E0Zjk3NDtpci50YWdzPVBvcnQgNDQzLFRMUzsiIHBhcmVudD0iMSIgc291cmNlPSIyMiIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjIwMiIgeT0iNTExIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjciIHZhbHVlPSJHZW5lcmljIENsaWVudCAtPiBBV1MgQWNjb3VudCBFbnZpcm9ubWVudCIgc3R5bGU9ImlyLnJlZj03ZTRkNjNhMS1hMjdkLTQ0ODQtYjQ0MC1jZGRhZjQzOTdlNDE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC4wMDE7ZW50cnlZPTAuMTYyO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgc291cmNlPSIyMiIgdGFyZ2V0PSIxMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
+      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="Generic Client -&gt; AWS WAF (Web Application Firewall)" ref="10839578-7a26-43b1-9a72-582d4ca4f974" source="5d4241cb-f507-4801-bce7-9fddeb295c9b" target="cc0f6f94-1d00-460d-9770-ca34b35bf4ae">
+      <assets/>
+      <tags>
+        <tag tag="Port 443"/>
+        <tag tag="TLS"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; AWS Account Environment" ref="7e4d63a1-a27d-4484-b440-cddaf4397e41" source="5d4241cb-f507-4801-bce7-9fddeb295c9b" target="b6e6ff98-a72c-4bfb-ae01-c6987520c15e">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS EC2 (Elastic Compute Cloud) -&gt; AWS S3 (Simple Storage Service)" ref="9e09c028-df69-43d8-8cb9-20ac055ca7b4" source="7becc80b-902f-48f2-9a79-2cee1f8c6c8e" target="264938b2-0327-4077-9242-58aa381563f7">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS EC2 (Elastic Compute Cloud) -&gt; AWS S3 (Simple Storage Service)" ref="d39b52d9-b4b8-43cb-80a5-c8c545c8a11a" source="10a6d491-1de3-4e75-ac59-b04533518e9c" target="5ddc7008-c98a-4ab4-914e-3889c47874d0">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS WAF (Web Application Firewall) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="fa3e9a76-7946-4678-a77c-e9a3e2aec7ff" source="99f36fa6-c259-43bb-b805-74ca5ad05ffd" target="7becc80b-902f-48f2-9a79-2cee1f8c6c8e">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS WAF (Web Application Firewall) -&gt; AWS EC2 (Elastic Compute Cloud)" ref="ff74e3f9-458b-46ee-8bf3-2772c6f06c4d" source="cc0f6f94-1d00-460d-9770-ca34b35bf4ae" target="10a6d491-1de3-4e75-ac59-b04533518e9c">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="6857e855-7501-4dec-9d14-04da6700e2cc" diagramComponentId="5a1ed663-5e3a-4420-b2cd-fe2d26831d1d" ref="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" name="AWS Account Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="dfb2890f-3147-4003-81e0-0969e3dcc04b" diagramComponentId="ef570da5-79d1-463c-ac51-e8130138a25e" ref="7becc80b-902f-48f2-9a79-2cee1f8c6c8e" name="AWS EC2 (Elastic Compute Cloud)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="ec2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="6e649c56-0865-4823-94be-206b30c7da6a" diagramComponentId="85b0fe8c-a5dd-4522-a26e-4aaf49a703b6" ref="d7b34c8c-822f-4170-ba02-b2cee8c08249" name="PostgreSQL" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="4fa37b71-ca5f-4c16-ab4c-6fe44516251e" diagramComponentId="473eede7-b962-4ad2-87d6-dfa72ce9ef37" ref="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" name="AWS VPC (Virtual Private Cloud)" desc="" library="" parentComponentRef="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" componentDefinitionRef="vpc">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="55f1cadb-cd32-4614-976d-d83164ba5c60" diagramComponentId="0394ac01-f7db-4252-bb66-d3ea6cc99705" ref="5ddc7008-c98a-4ab4-914e-3889c47874d0" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Credit Card Data" accessType="10"/>
+        <asset name="Credit Card Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="76ce4171-394f-408f-8f94-62a191605bd3" diagramComponentId="a4c06734-f013-49ae-908c-b9041f44c6e9" ref="56b8349f-2c06-496e-a379-fb91a0144298" name="AWS VPC Division B" desc="" library="" parentComponentRef="b6e6ff98-a72c-4bfb-ae01-c6987520c15e" componentDefinitionRef="vpc">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="b49e8846-3572-4024-b716-71e5b0365e4d" diagramComponentId="c25a847f-2f2e-4776-a681-0afe36eb7a42" ref="5d4241cb-f507-4801-bce7-9fddeb295c9b" name="Generic Client" desc="" library="" parentComponentRef="f9fa7542-689c-422f-a121-97602b6a8440" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets>
+        <asset name="Credit Card Data" accessType="40"/>
+      </assets>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="e03cf0c0-6368-40bc-9a4a-83de4ef69c18" diagramComponentId="b22036bc-d2bf-4ca2-b88c-4b4d8ff052fa" ref="ec96a34a-2c41-4f14-8304-4a43c9fc4b4f" name="PostgreSQL" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="7ea13731-e5c5-4460-9e1e-dc5ec0016a83" diagramComponentId="c89bfad0-b88d-446f-a263-e3675b6aa3cd" ref="10a6d491-1de3-4e75-ac59-b04533518e9c" name="AWS EC2 (Elastic Compute Cloud)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="ec2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Credit Card Data" accessType="10"/>
+        <asset name="Credit Card Data" accessType="20"/>
+        <asset name="Credit Card Data" accessType="40"/>
+        <asset name="Credit Card Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="0bc19a69-6117-4e22-b453-bafcd928c1b3" diagramComponentId="ef7afdce-3fd5-4498-84bf-f40dc24128b0" ref="99f36fa6-c259-43bb-b805-74ca5ad05ffd" name="AWS WAF (Web Application Firewall)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="CD-WAF">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="e7ad2639-a9d9-4d9a-b23a-30f596a6e449" diagramComponentId="7cb87ec1-e09e-41ea-9924-7cb15787b411" ref="f9fa7542-689c-422f-a121-97602b6a8440" name="Out Of Scope" desc="" library="" parentComponentRef="" componentDefinitionRef="out-of-scope">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="4007a097-0b22-4580-845a-58f0284596cc" diagramComponentId="76903201-b85a-4667-9d65-6cc2adad2fd4" ref="264938b2-0327-4077-9242-58aa381563f7" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="56b8349f-2c06-496e-a379-fb91a0144298" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="597b6e8c-2ea1-4926-9ece-3ffee5a35b67" diagramComponentId="f3c3997f-7ae7-4a09-bfee-9ecb3dd066b7" ref="cc0f6f94-1d00-460d-9770-ca34b35bf4ae" name="AWS WAF (Web Application Firewall)" desc="" library="" parentComponentRef="2b466d0b-3794-4f8f-9d2d-19b9c9fd3447" componentDefinitionRef="CD-WAF">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Credit Card Data" accessType="40"/>
+        <asset name="Credit Card Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/aws-web-application-remote-access-web-ui-access.xml b/Templates/Submitted_Templates/aws-web-application-remote-access-web-ui-access.xml
new file mode 100644
index 0000000..1110bb2
--- /dev/null
+++ b/Templates/Submitted_Templates/aws-web-application-remote-access-web-ui-access.xml
@@ -0,0 +1,29169 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="two-examples-template" name="AWS - Web Application (Remote Access + Web UI Access)" tags="Community">
+  <desc>&lt;p&gt;This project shows &lt;strong&gt;two&lt;/strong&gt; simple threat models:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;One that is remotely accessed by a user&lt;/li&gt;
+ &lt;li&gt;Another that builds on this by having external monitoring made available to a Security team via. their SIEM.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Made by &lt;a target="_blank"&gt;Jonny Tennyson&lt;/a&gt;&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjM4OCIgZHk9IjE3MzciIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS40LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMDY4IiB5PSIyNiIgd2lkdGg9IjE3OSIgaGVpZ2h0PSIxNzYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MDE0YmFkYWMtMzc0Zi00ZDg5LThjMjctNDI1MzBlY2Q5NDdlOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjQ2Ljc1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii03NDIiIHk9Ii0zOCIgd2lkdGg9IjYyMCIgaGVpZ2h0PSI1OTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkFXUyBBY2NvdW50IEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0iaXIucmVmPWMxYTEyNzZmLTQxMWEtNGFlYi04MThjLWE0YjYwNTExMmM1MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hbWF6b24td2ViLXNlcnZpY2VzLWVudmlyb25tZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEVnTUVnd1ZqRklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzJOekkwSURBdU5qZ3dNekF6U0RBdU1UVTVPVEV5VmpBdU5qTXdPRGM0UXpBdU1UVTVPRE16SURBdU5UY3lOakExSURBdU1UYzVNekl5SURBdU5URTFPVGt6SURBdU1qRTFNalUySURBdU5EY3dNVEU1UXpBdU1qVXhNVGc1SURBdU5ESTBNalExSURBdU16QXhORGcwSURBdU16a3hOelkzSURBdU16VTRNRGM0SURBdU16YzNPRGt4VERBdU16WXpPVE01SURBdU16YzJORFkxVERBdU16WTVNekkxSURBdU16YzVNekUyUXpBdU16ZzNNemM0SURBdU16ZzRPVGd4SURBdU5EQTNOVE0zSURBdU16azBNRE00SURBdU5ESTRNREUwSURBdU16azBNRE00UXpBdU5EUTRORGt4SURBdU16azBNRE00SURBdU5EWTROalV4SURBdU16ZzRPVGd4SURBdU5EZzJOekEwSURBdU16YzVNekUyVERBdU5Ea3lNRGc1SURBdU16YzJORFkxVERBdU5EazNPVFVnTUM0ek56YzRPVEZETUM0MU5EZzRNVGdnTUM0ek9UQTFNRGdnTUM0MU9UUTNNamtnTUM0ME1UZ3hJREF1TmpJNU56UTBJREF1TkRVM01EazRUREF1TmpBMk15QXdMalEzT0RNeU5VTXdMalUzTmpZd09DQXdMalEwTlRVMU5TQXdMalV6T0RFeE5pQXdMalF5TWpBeE9TQXdMalE1TlRReE5pQXdMalF4TURVeU5FTXdMalEzTkRJd09DQXdMalF5TURnZ01DNDBOVEE1TkRjZ01DNDBNall4TXprZ01DNDBNamN6T0RFZ01DNDBNall4TXpsRE1DNDBNRE00TVRRZ01DNDBNall4TXprZ01DNHpPREExTlRRZ01DNDBNakE0SURBdU16VTVNelExSURBdU5ERXdOVEkwUXpBdU16RXhNREl4SURBdU5ESXpOelF6SURBdU1qWTRNemMwSURBdU5EVXlORFl6SURBdU1qTTNPVFV6SURBdU5Ea3lNamN5UXpBdU1qQTNOVE16SURBdU5UTXlNRGdnTUM0eE9URXdNak1nTUM0MU9EQTNOellnTUM0eE9UQTVOaUF3TGpZek1EZzNPRll3TGpZME9EWXlTREF1TkRjMk1EbE1NQzQwTnpZM01qUWdNQzQyT0RBek1ETmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5ESTNOak0xSURBdU5ESTFNREUxUXpBdU5EQXpOek00SURBdU5ESTFNRGcySURBdU16Z3dNakEzSURBdU5ERTVNVFE1SURBdU16VTVNakEwSURBdU5EQTNOelE0UXpBdU16TXhNemswSURBdU16a3lOVGMzSURBdU16QTVOREk1SURBdU16WTROVGMwSURBdU1qazJOemMzSURBdU16TTVOVE5ETUM0eU9EUXhNalFnTUM0ek1UQTBPRFlnTUM0eU9ERTFNRFVnTUM0eU56Z3dOVFVnTUM0eU9Ea3pNek1nTUM0eU5EY3pOVFpETUM0eU9UY3hOaklnTUM0eU1UWTJOVGdnTUM0ek1UUTVPVEVnTUM0eE9EazBORElnTUM0ek5EQXdNRFlnTUM0eE56QXdNRFJETUM0ek5qVXdNakVnTUM0eE5UQTFOallnTUM0ek9UVTNPVGdnTUM0eE5EQXdNVFVnTUM0ME1qYzBOemNnTUM0eE5EQXdNVFZETUM0ME5Ua3hOVFlnTUM0eE5EQXdNVFVnTUM0ME9EazVNek1nTUM0eE5UQTFOallnTUM0MU1UUTVORGdnTUM0eE56QXdNRFJETUM0MU16azVOak1nTUM0eE9EazBORElnTUM0MU5UYzNPVE1nTUM0eU1UWTJOVGdnTUM0MU5qVTJNakVnTUM0eU5EY3pOVFpETUM0MU56TTBORGtnTUM0eU56Z3dOVFVnTUM0MU56QTRNeUF3TGpNeE1EUTROaUF3TGpVMU9ERTNOeUF3TGpNek9UVXpRekF1TlRRMU5USTFJREF1TXpZNE5UYzBJREF1TlRJek5UWWdNQzR6T1RJMU56Y2dNQzQwT1RVM05TQXdMalF3TnpjME9GWXdMalF3TnpjME9FTXdMalEzTkRneE1pQXdMalF4T1RBeU1pQXdMalExTVRReE5TQXdMalF5TkRrMU5DQXdMalF5TnpZek5TQXdMalF5TlRBeE5WcE5NQzQwTWpjMk16VWdNQzR4TnpVMk56SkRNQzQwTURNeU9Ea2dNQzR4TnpVeU1EVWdNQzR6TnprME9USWdNQzR4T0RJNU15QXdMak0yTURBMk1TQXdMakU1TnpZd05rTXdMak0wTURZeklEQXVNakV5TWpneklEQXVNekkyTmpreUlEQXVNak16TURZeElEQXVNekl3TkRneElEQXVNalUyTmpBM1F6QXVNekUwTWpjeElEQXVNamd3TVRVMElEQXVNekUyTVRRNElEQXVNekExTVRBMElEQXVNekkxT0RFeklEQXVNekkzTkRVMVF6QXVNek0xTkRjM0lEQXVNelE1T0RBM0lEQXVNelV5TXpZNUlEQXVNelk0TWpZMUlEQXVNemN6TnpjNElEQXVNemM1T0RZM1F6QXVNemt3TVRRMUlEQXVNemc0TmpRMUlEQXVOREE0TkRJNUlEQXVNemt6TWpNNElEQXVOREkzTURBeUlEQXVNemt6TWpNNFF6QXVORFExTlRjMElEQXVNemt6TWpNNElEQXVORFl6T0RVNElEQXVNemc0TmpRMUlEQXVORGd3TWpJMklEQXVNemM1T0RZM1F6QXVOVEF4TlRNZ01DNHpOamd6TVRJZ01DNDFNVGd6TmlBd0xqTTBPVGsyTmlBd0xqVXlPREEwTVNBd0xqTXlOemMwTmtNd0xqVXpOemN5TVNBd0xqTXdOVFV5TmlBd0xqVXpPVFk1TlNBd0xqSTRNRGN3TnlBd0xqVXpNelkxSURBdU1qVTNNak0yUXpBdU5USTNOakExSURBdU1qTXpOelkwSURBdU5URXpPRGc0SURBdU1qRXlPVGczSURBdU5EazBOamM0SURBdU1UazRNakE1UXpBdU5EYzFORFk1SURBdU1UZ3pORE1nTUM0ME5URTROekVnTUM0eE56VTBPVGNnTUM0ME1qYzJNelVnTUM0eE56VTJOekpXTUM0eE56VTJOekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOamN6TkRJMklEQXVPRFl3TURRNFREQXVOVEEwT0RneklEQXVOell5TnpneVZqQXVOVFk0TURreFREQXVOamN6TkRJMklEQXVORGN3T0RJMVREQXVPRFF4T1RZNUlEQXVOVFk0TURreFZqQXVOell5TnpneVREQXVOamN6TkRJMklEQXVPRFl3TURRNFdrMHdMalV6TmpVMk5DQXdMamMwTkRRd05rd3dMalkzTXpReU5pQXdMamd5TXpZeE0wd3dMamd4TURJNE9DQXdMamMwTkRRd05sWXdMalU0TlRrNU1rd3dMalkzTXpReU5pQXdMalV3TmpjNE5Vd3dMalV6TmpVMk5DQXdMalU0TlRrNU1sWXdMamMwTkRRd05sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk56TTFOak1nTUM0Mk9ETTJOemRNTUM0MU1USTVNemtnTUM0MU9URXdNRFJNTUM0MU1qZzNPQ0F3TGpVMk16VTVPVXd3TGpZM016VTJNeUF3TGpZME56QTRNMHd3TGpneE9ETTBOaUF3TGpVMk16VTVPVXd3TGpnek5ERTROeUF3TGpVNU1UQXdORXd3TGpZM016VTJNeUF3TGpZNE16WTNOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJPRGt6T1RZZ01DNDJOalUxTWpkSU1DNDJOVGMzTVRWV01DNDROREU0TkRKSU1DNDJPRGt6T1RaV01DNDJOalUxTWpkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN4TURjaUlIa3hQU0l4TGpJd056RTFJaUI0TWowaU1TNHlNRGN4TVNJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSTBNNE5URXhRaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtZNU9UQXdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMjkiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1jMWExMjc2Zi00MTFhLTRhZWItODE4Yy1hNGI2MDUxMTJjNTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YW1hem9uLXdlYi1zZXJ2aWNlcy1lbnZpcm9ubWVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI4IiB5PSI0MCIgd2lkdGg9IjU2OCIgaGVpZ2h0PSI1MzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjkiIHZhbHVlPSJBUEkgLSBJL08iIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZETUM0Mk5ETTVORE1nTUM0NE1qQXdPREVnTUM0Mk5ERXhPRGdnTUM0NE1Ua3hPVFFnTUM0Mk16ZzVNREVnTUM0NE1UYzFNemRETUM0Mk16Y3hOemdnTUM0NE1UWXpNU0F3TGpZek5UYzNNU0F3TGpneE5EWTVNU0F3TGpZek5EYzVOeUF3TGpneE1qZ3hNME13TGpZek16Z3lOQ0F3TGpneE1Ea3pOU0F3TGpZek16TXhNU0F3TGpnd09EZzFNeUF3TGpZek16TXdNU0F3TGpnd05qY3pOMVl3TGpFNU16UXdORU13TGpZek16TXhJREF1TVRreE1USTFJREF1TmpNek9UQTBJREF1TVRnNE9EZzNJREF1TmpNMU1ESTBJREF1TVRnMk9UQXpRekF1TmpNMk1UUTBJREF1TVRnME9URTVJREF1TmpNM056VTFJREF1TVRnek1qVTFJREF1TmpNNU56QXhJREF1TVRneU1EY3hRekF1TmpReE5qWTVJREF1TVRnd056azNJREF1TmpRek9UTTNJREF1TVRnd01EWTFJREF1TmpRMk1qYzRJREF1TVRjNU9UUTRRekF1TmpRNE5qRTVJREF1TVRjNU9ETXhJREF1TmpVd09UUTVJREF1TVRnd016TXpJREF1TmpVek1ETTBJREF1TVRneE5EQTBUREF1T0RJMk16WTNJREF1TWpZMk1EY3hRekF1T0RJNE5Ua3hJREF1TWpZM01UWWdNQzQ0TXpBME5qZ2dNQzR5TmpnNE5EY2dNQzQ0TXpFM09EWWdNQzR5TnpBNU5ETkRNQzQ0TXpNeE1EVWdNQzR5TnpNd016a2dNQzQ0TXpNNE1UUWdNQzR5TnpVME5qRWdNQzQ0TXpNNE16UWdNQzR5TnpjNU16ZFdNQzQzTkRreE16ZERNQzQ0TXpNNU56Y2dNQzQzTlRJd05qRWdNQzQ0TXpNeE5UUWdNQzQzTlRRNU5URWdNQzQ0TXpFME9URWdNQzQzTlRjek5qRkRNQzQ0TWprNE1qZ2dNQzQzTlRrM056RWdNQzQ0TWpjME1Ua2dNQzQzTmpFMU5qWWdNQzQ0TWpRMk16UWdNQzQzTmpJME56Rk1NQzQyTlRFek1ERWdNQzQ0TWpBd056RkRNQzQyTkRrM09UY2dNQzQ0TWpBeU9EY2dNQzQyTkRneU56RWdNQzQ0TWpBeU9EY2dNQzQyTkRZM05qY2dNQzQ0TWpBd056RmFUVEF1TmpZd01UQXhJREF1TWpFME9EY3hWakF1TnpnNE1qQTBUREF1T0RBMk56WTNJREF1TnpNNU5UTTNWakF1TWpnMk1qQTBUREF1TmpZd01UQXhJREF1TWpFME9EY3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTFNelF6TXlBd0xqZ3lNREEzUXpBdU16VXlNREUzSURBdU9ESXdNall6SURBdU16VXdOVGd5SURBdU9ESXdNall6SURBdU16UTVNVFkySURBdU9ESXdNRGRNTUM0eE56VTRNek1nTUM0M05qSTBOME13TGpFM016QTNNeUF3TGpjMk1UVTBNeUF3TGpFM01EWTVNeUF3TGpjMU9UY3pOeUF3TGpFMk9UQTFOaUF3TGpjMU56TXpRekF1TVRZM05ERTVJREF1TnpVME9USXlJREF1TVRZMk5qRTBJREF1TnpVeU1EUTFJREF1TVRZMk56WTJJREF1TnpRNU1UTTNWakF1TWpjM09UTTNRekF1TVRZMk56ZzJJREF1TWpjMU5EWXhJREF1TVRZM05EazFJREF1TWpjek1ETTVJREF1TVRZNE9ERTBJREF1TWpjd09UUXpRekF1TVRjd01UTXpJREF1TWpZNE9EUTNJREF1TVRjeU1EQTVJREF1TWpZM01UWWdNQzR4TnpReU16TWdNQzR5TmpZd056Rk1NQzR6TkRjMU5qWWdNQzR4T0RFME1EUkRNQzR6TkRrMk5URWdNQzR4T0RBek16TWdNQzR6TlRFNU9ERWdNQzR4TnprNE16RWdNQzR6TlRRek1qSWdNQzR4TnprNU5EaERNQzR6TlRZMk5qTWdNQzR4T0RBd05qVWdNQzR6TlRnNU16SWdNQzR4T0RBM09UY2dNQzR6TmpBNE9Ua2dNQzR4T0RJd056RkRNQzR6TmpJNE1qRWdNQzR4T0RNeU56RWdNQzR6TmpRME1EVWdNQzR4T0RRNU5ESWdNQzR6TmpVMU1ERWdNQzR4T0RZNU1qVkRNQzR6TmpZMU9UZ2dNQzR4T0RnNU1EZ2dNQzR6TmpjeE56RWdNQzR4T1RFeE16Z2dNQzR6TmpjeE5qWWdNQzR4T1RNME1EUldNQzQ0TURZM016ZERNQzR6TmpjeE5UWWdNQzQ0TURnNE5USWdNQzR6TmpZMk5ETWdNQzQ0TVRBNU16VWdNQzR6TmpVMk55QXdMamd4TWpneE0wTXdMak0yTkRZNU5pQXdMamd4TkRZNU1TQXdMak0yTXpJNE9TQXdMamd4TmpNeElEQXVNell4TlRZMklEQXVPREUzTlRNM1F6QXVNelU1TWpNMElEQXVPREU1TXpBMUlEQXVNelUyTXpVM0lEQXVPREl3TWpBeUlEQXVNelV6TkRNeklEQXVPREl3TURkV01DNDRNakF3TjFwTk1DNHhPVE0wTXpNZ01DNDNOREF3TjB3d0xqTTBNREVnTUM0M09EZzNNemRXTUM0eU1UVTBNRFJNTUM0eE9UTTBNek1nTUM0eU9EY3dNRFJXTUM0M05EQXdOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNek15TnpJZ01DNHpOalkyTXpKSU1DNDFPVE15TnpKV01DNHpNems1TmpaSU1DNDJNek15TnpKV01DNHpOalkyTXpKYVRUQXVOVFV6TWpjeUlEQXVNelkyTmpNeVNEQXVOVEV6TWpjeVZqQXVNek01T1RZMlNEQXVOVFV6TWpjeVZqQXVNelkyTmpNeVdrMHdMalEzTXpJM01pQXdMak0yTmpZek1rZ3dMalF6TXpJM01sWXdMak16T1RrMk5rZ3dMalEzTXpJM01sWXdMak0yTmpZek1scE5NQzR6T1RNeU56RWdNQzR6TmpZMk16SklNQzR6TlRNeU56RldNQzR6TXprNU5qWklNQzR6T1RNeU56RldNQzR6TmpZMk16SmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qTXpNamN5SURBdU5qWXdNRGc1U0RBdU5Ua3pNamN5VmpBdU5qTXpOREl6U0RBdU5qTXpNamN5VmpBdU5qWXdNRGc1V2swd0xqVTFNekkzTWlBd0xqWTJNREE0T1Vnd0xqVXhNekkzTWxZd0xqWXpNelF5TTBnd0xqVTFNekkzTWxZd0xqWTJNREE0T1ZwTk1DNDBOek15TnpJZ01DNDJOakF3T0RsSU1DNDBNek15TnpKV01DNDJNek0wTWpOSU1DNDBOek15TnpKV01DNDJOakF3T0RsYVRUQXVNemt6TWpjeElEQXVOall3TURnNVNEQXVNelV6TWpjeFZqQXVOak16TkRJelNEQXVNemt6TWpjeFZqQXVOall3TURnNVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRME1UVXlJREF1TlRRMU9UTk1NQzR6T1RFek9EWWdNQzQxTURNeE0wTXdMak00T1RreU15QXdMalV3TVRnM09DQXdMak00T0RjME9DQXdMalV3TURNeU5DQXdMak00TnprME1pQXdMalE1T0RVM05VTXdMak00TnpFek5pQXdMalE1TmpneU5pQXdMak00TmpjeE9TQXdMalE1TkRreU15QXdMak00TmpjeE9TQXdMalE1TWprNU4wTXdMak00TmpjeE9TQXdMalE1TVRBM01TQXdMak00TnpFek5pQXdMalE0T1RFMk9DQXdMak00TnprME1pQXdMalE0TnpReE9FTXdMak00T0RjME9DQXdMalE0TlRZMk9TQXdMak00T1RreU15QXdMalE0TkRFeE5TQXdMak01TVRNNE5pQXdMalE0TWpnMk0wd3dMalEwTVRNNE5pQXdMalEwTURBMk0wd3dMalExT0RjeUlEQXVORFl3TXpOTU1DNDBNakExT0RZZ01DNDBPVE16T1RkTU1DNDBOVGczTWlBd0xqVXlOakEyTTB3d0xqUTBNVFV5SURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFU0TnpJMklEQXVOVFExT1ROTU1DNDFOREV6T1RNZ01DNDFNalUyTmpOTU1DNDFOemsxTWpVZ01DNDBPVE16T1RkTU1DNDFOREV5TmlBd0xqUTJNRGcyTTB3d0xqVTFPRFU1TXlBd0xqUTBNREEyTTB3d0xqWXdPRGN5TlNBd0xqUTRNamN6UXpBdU5qRXdNVGc0SURBdU5EZ3pPVGd5SURBdU5qRXhNell6SURBdU5EZzFOVE0ySURBdU5qRXlNVFk1SURBdU5EZzNNamcxUXpBdU5qRXlPVGMxSURBdU5EZzVNRE0wSURBdU5qRXpNemt5SURBdU5Ea3dPVE00SURBdU5qRXpNemt5SURBdU5Ea3lPRFl6UXpBdU5qRXpNemt5SURBdU5EazBOemc1SURBdU5qRXlPVGMxSURBdU5EazJOamt6SURBdU5qRXlNVFk1SURBdU5EazRORFF5UXpBdU5qRXhNell6SURBdU5UQXdNVGt4SURBdU5qRXdNVGc0SURBdU5UQXhOelExSURBdU5qQTROekkxSURBdU5UQXlPVGszVERBdU5UVTROekkySURBdU5UUTFPVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEV6TmpnNUlEQXVOREUzTWpJMlREQXVORFl3TmpreklEQXVOVGN6T1RjMVREQXVORGcxT1RVMUlEQXVOVGd5TlRFMVREQXVOVE00T1RVeElEQXVOREkxTnpZM1REQXVOVEV6TmpnNUlEQXVOREUzTWpJMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTURZM0lpQjVNVDBpTVM0eU1EY3hNU0lnZURJOUlqRXVNakEzTVRVaUlIa3lQU0l0TUM0eU1EY3hNRGNpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlNMFJESTNRVGdpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBFeE5qWkdSaUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTM1MWNlOTNhLTUzY2QtNDFlNy1iNmZkLWE3ZWZmYzk5N2FjMzsiIHBhcmVudD0iMjkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTUiIHk9IjcxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iQ2xvdWRXYXRjaCIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWNsb3Vkd2F0Y2g7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNVGs1T0RnZ01DNDJNems1TlROSU1DNHlOek16TWpGRE1DNHlOVGcwT0RVZ01DNDJNemsyTmpZZ01DNHlORFF3TURnZ01DNDJNelV6TXpNZ01DNHlNekUwTlRVZ01DNDJNamMwTWtNd0xqSXhNVEkwTlNBd0xqWXhOVEF6T1NBd0xqRTVORFl6SURBdU5UazNOVGd6SURBdU1UZ3pNall4SURBdU5UYzJOemczUXpBdU1UY3hPRGt6SURBdU5UVTFPVGt4SURBdU1UWTJNVFkzSURBdU5UTXlOVGd5SURBdU1UWTJOalUxSURBdU5UQTRPRGcyUXpBdU1UWTFNams1SURBdU5EZ3hOelFnTUM0eE56TXhNRGNnTUM0ME5UUTVNallnTUM0eE9EZzRNalVnTUM0ME16STNOVEpETUM0eU1EUTFORE1nTUM0ME1UQTFOemdnTUM0eU1qY3lOVGdnTUM0ek9UUXpNeUF3TGpJMU16TXlNU0F3TGpNNE5qWXlRekF1TWpVek16SXhJREF1TXpnek1UVXpJREF1TWpVek16SXhJREF1TXpjNU5qZzJJREF1TWpVek16SXhJREF1TXpjMk1qSkRNQzR5TlRRd05USWdNQzR6TkRJek5EUWdNQzR5TmpReE9URWdNQzR6TURrek16Z2dNQzR5T0RJMk1EUWdNQzR5T0RBNE9UUkRNQzR6TURFd01UZ2dNQzR5TlRJME5TQXdMak15TmprNElEQXVNakk1TmpnNElEQXVNelUzTlRnNElEQXVNakUxTVRVelF6QXVNemt3TkRnMklEQXVNakF3TlRrNElEQXVOREkzTURjeUlEQXVNVGsyTlRNNUlEQXVORFl5TXpZZ01DNHlNRE0xTTBNd0xqUTVOelkwT0NBd0xqSXhNRFV5TVNBd0xqVXlPVGt5TXlBd0xqSXlPREl5TWlBd0xqVTFORGM0T0NBd0xqSTFOREl5UXpBdU5UY3hOVEF5SURBdU1qY3hNalF5SURBdU5UZzFNRFE0SURBdU1qa3hNVEE1SURBdU5UazBOemc0SURBdU16RXlPRGcyUXpBdU5qQTROamd5SURBdU16QXhOamN5SURBdU5qSTFPVGs0SURBdU1qazFOVFUxSURBdU5qUXpPRFUwSURBdU1qazFOVFV6UXpBdU5qZ3dNVEl4SURBdU1qazFOVFV6SURBdU56SXdPVEl4SURBdU16SXpNRElnTUM0M01qZ3pPRGNnTUM0ek9ETXlPRFpETUM0M05qSTJOVFFnTUM0ek9URTBNaUF3TGpnek16QTFOQ0F3TGpReE9UUXlJREF1T0RNek1EVTBJREF1TlRFd01EZzJRekF1T0RNME1qRTVJREF1TlRNeU56a3lJREF1T0RJNE9UQTVJREF1TlRVMU16WXhJREF1T0RFM056UTBJREF1TlRjMU1UWTJRekF1T0RBMk5UYzVJREF1TlRrME9UY3hJREF1Tnprd01ERTNJREF1TmpFeE1UazJJREF1TnpZNU9UZzNJREF1TmpJeE9UVXpUREF1TnpVMk5qVTBJREF1TlRrNE5qSkRNQzQzTnpJME5EUWdNQzQxT1RBd09DQXdMamM0TlRRM01TQXdMalUzTnpJeE5pQXdMamM1TkRJd09TQXdMalUyTVRVek5VTXdMamd3TWprME55QXdMalUwTlRnMU5DQXdMamd3TnpBek15QXdMalV5T0RBd055QXdMamd3TlRrNE55QXdMalV4TURBNE5rTXdMamd3TlRrNE55QXdMalF6TVRZNE5pQXdMamMwTVRBMU5DQXdMalF4TWpJeUlEQXVOekV5TmpVMElEQXVOREEzTkRKRE1DNDNNVEE1TVNBd0xqUXdOekV3T1NBd0xqY3dPVEkwTlNBd0xqUXdOalExTkNBd0xqY3dOemMxTnlBd0xqUXdOVFE1TWtNd0xqY3dOakkyT1NBd0xqUXdORFV6TVNBd0xqY3dORGs0TnlBd0xqUXdNekk0TWlBd0xqY3dNems0TnlBd0xqUXdNVGd5UXpBdU56QXlNRE15SURBdU16azVNREkzSURBdU56QXhNakl4SURBdU16azFOVGt5SURBdU56QXhOekl4SURBdU16a3lNakpETUM0Mk9UYzROVFFnTUM0ek5ETTRNaUF3TGpZMk9UVTROeUF3TGpNeU1qSXlJREF1TmpRek1EVTBJREF1TXpJeU1qSkRNQzQyTXpRMk1EUWdNQzR6TWpJeU9UVWdNQzQyTWpZeU9USWdNQzR6TWpRek56Y2dNQzQyTVRnNE1EVWdNQzR6TWpneU9UVkRNQzQyTVRFek1UY2dNQzR6TXpJeU1UTWdNQzQyTURRNE5qY2dNQzR6TXpjNE5UUWdNQzQxT1RrNU9EZ2dNQzR6TkRRM05UTkRNQzQxT1RnMU5Ua2dNQzR6TkRZM01EZ2dNQzQxT1RZMk1qWWdNQzR6TkRneU16Z2dNQzQxT1RRek9UUWdNQzR6TkRreE56ZERNQzQxT1RJeE5qTWdNQzR6TlRBeE1UY2dNQzQxT0RrM01UY2dNQzR6TlRBME16RWdNQzQxT0Rjek1qRWdNQzR6TlRBd09EWkRNQzQxT0RRNU16SWdNQzR6TkRrM01USWdNQzQxT0RJMk9TQXdMak0wT0RZNU5pQXdMalU0TURnek5TQXdMak0wTnpFME5rTXdMalUzT0RrNElEQXVNelExTlRrMklEQXVOVGMzTlRnZ01DNHpORE0xTnlBd0xqVTNOamM0T0NBd0xqTTBNVEk0TmtNd0xqVTJPREE1TkNBd0xqTXhOVFk1TlNBd0xqVTFNemM1SURBdU1qa3lNemN4SURBdU5UTTBPVEl4SURBdU1qY3pNREpETUM0MU1UTTRNalVnTUM0eU5URXhNamtnTUM0ME9EWTFNekVnTUM0eU16WXlNalFnTUM0ME5UWTNNU0F3TGpJek1ETXhNME13TGpReU5qZzRPU0F3TGpJeU5EUXdNU0F3TGpNNU5UazNNeUF3TGpJeU56YzJOU0F3TGpNMk9ERXlNU0F3TGpJek9UazFNME13TGpNME1qUXpPQ0F3TGpJMU1qUTBOaUF3TGpNeU1EWTFOQ0F3TGpJM01UY3hOaUF3TGpNd05URXlNaUF3TGpJNU5UWTRORU13TGpJNE9UVTVJREF1TXpFNU5qVXlJREF1TWpnd09EazVJREF1TXpRM05EQTNJREF1TWpjNU9UZzRJREF1TXpjMU9UVXpRekF1TWpnZ01DNHpPREl4TURJZ01DNHlPREF6TlRZZ01DNHpPRGd5TkRRZ01DNHlPREV3TlRVZ01DNHpPVFF6TlRORE1DNHlPREUwT0RZZ01DNHpPVGMzTXpNZ01DNHlPREEyTURnZ01DNDBNREV4TlNBd0xqSTNPRFU1T1NBd0xqUXdNemt3TWtNd0xqSTNOalU1TVNBd0xqUXdOalkxTkNBd0xqSTNNell3TlNBd0xqUXdPRFV6TXlBd0xqSTNNREkxTlNBd0xqUXdPVEUxTTBNd0xqSTBOelU1SURBdU5ERXpOemcxSURBdU1qSTNNelF6SURBdU5ESTJOREF5SURBdU1qRXpNVGs0SURBdU5EUTBOekEyUXpBdU1UazVNRFUwSURBdU5EWXpNREV4SURBdU1Ua3hPVFV6SURBdU5EZzFOemcySURBdU1Ua3pNVGc0SURBdU5UQTRPRGcyUXpBdU1Ua3lOakk0SURBdU5USTRNRGszSURBdU1UazNNVGcySURBdU5UUTNNVEVnTUM0eU1EWXpPVE1nTUM0MU5qTTVOemxETUM0eU1UVTJNREVnTUM0MU9EQTRORGdnTUM0eU1qa3hNamdnTUM0MU9UUTVOallnTUM0eU5EVTFPRGdnTUM0Mk1EUTRPRFpETUM0eU5UTTRPQ0F3TGpZeE1ERTVNaUF3TGpJMk16UTNPU0F3TGpZeE16RWdNQzR5TnpNek1qRWdNQzQyTVRNeU9EWklNQzQwTVRrNU9EaFdNQzQyTXprNU5UTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTRORGsxSURBdU56RTVPVGMzVERBdU56SXpPREk0SURBdU5qSTBPVEZETUM0M016YzBNRE1nTUM0MU9UUTBNaUF3TGpjek9UYzJNU0F3TGpVMk1ERXhNaUF3TGpjek1EUTROU0F3TGpVeU9EQTFNa013TGpjeU1USXdPQ0F3TGpRNU5UazVNU0F3TGpjd01EZzVOU0F3TGpRMk9ESTBNeUF3TGpZM016RXpOeUF3TGpRME9UY3hNa013TGpZME5UTTNPQ0F3TGpRek1URTRNU0F3TGpZeE1UazJNaUF3TGpReU16QTJNaUF3TGpVM09EYzVOU0F3TGpReU5qYzRPRU13TGpVME5UWXlPU0F3TGpRek1EVXhOU0F3TGpVeE5EZzBPQ0F3TGpRME5UZzBPQ0F3TGpRNU1UZzVOQ0F3TGpRM01EQTNOME13TGpRMk9EazBJREF1TkRrME16QTJJREF1TkRVMU1qa3lJREF1TlRJMU9EY3hJREF1TkRVek16WXlJREF1TlRVNU1UbERNQzQwTlRFME16SWdNQzQxT1RJMU1TQXdMalEyTVRNME5TQXdMall5TlRRek9TQXdMalE0TVRNME9DQXdMalkxTWpFMU5rTXdMalV3TVRNMU1TQXdMalkzT0RnM015QXdMalV6TURFMU5pQXdMalk1TnpZMU9DQXdMalUyTWpZM01TQXdMamN3TlRFNE9VTXdMalU1TlRFNE5TQXdMamN4TWpjeE9TQXdMall5T1RNeE5pQXdMamN3T0RVeE1pQXdMalkxT1RBeU9DQXdMalk1TXpNeFREQXVOelV5TXpZeElEQXVOemcyTmpRelF6QXVOell4TWpZMklEQXVOemsxTXpNZ01DNDNOek15TlRZZ01DNDRNREF4TWpVZ01DNDNPRFUyT1RVZ01DNDNPVGs1TnpkRE1DNDNPVEU0TXpZZ01DNDRNREF3TmpJZ01DNDNPVGM1TXpJZ01DNDNPVGc1TWpjZ01DNDRNRE0yTXpFZ01DNDNPVFkyTXpoRE1DNDRNRGt6TXpFZ01DNDNPVFF6TlNBd0xqZ3hORFV4T1NBd0xqYzVNRGsxTWlBd0xqZ3hPRGc1TlNBd0xqYzROalkwTTBNd0xqZ3lNekkzTVNBd0xqYzRNakkxTXlBd0xqZ3lOamN6TkNBd0xqYzNOekEwSURBdU9ESTVNRGcwSURBdU56Y3hNekExUXpBdU9ETXhORE0xSURBdU56WTFOVFk1SURBdU9ETXlOakkySURBdU56VTVOREkxSURBdU9ETXlOVGc1SURBdU56VXpNakkzUXpBdU9ETXlOVFV4SURBdU56UTNNREk0SURBdU9ETXhNamczSURBdU56UXdPRGs1SURBdU9ESTRPRFk0SURBdU56TTFNVGt5UXpBdU9ESTJORFE1SURBdU56STVORGcxSURBdU9ESXlPVEl6SURBdU56STBNekUwSURBdU9ERTRORGsxSURBdU56RTVPVGMzV2swd0xqVTVORFl5T0NBd0xqWTRNakkwTTBNd0xqVTNNVGszTlNBd0xqWTRNakkwTXlBd0xqVTBPVGd6TWlBd0xqWTNOVFV5TmlBd0xqVXpNRGs1TnlBd0xqWTJNamswTVVNd0xqVXhNakUyTWlBd0xqWTFNRE0xTmlBd0xqUTVOelE0TWlBd0xqWXpNalEyT0NBd0xqUTRPRGd4TXlBd0xqWXhNVFUwUXpBdU5EZ3dNVFEwSURBdU5Ua3dOakV5SURBdU5EYzNPRGMySURBdU5UWTNOVGd6SURBdU5EZ3lNamsxSURBdU5UUTFNelkyUXpBdU5EZzJOekUxSURBdU5USXpNVFE0SURBdU5EazNOakl6SURBdU5UQXlOelFnTUM0MU1UTTJOREVnTUM0ME9EWTNNak5ETUM0MU1qazJOVGtnTUM0ME56QTNNRFVnTUM0MU5UQXdOallnTUM0ME5UazNPVGNnTUM0MU56SXlPRFFnTUM0ME5UVXpOemRETUM0MU9UUTFNREVnTUM0ME5UQTVOVGdnTUM0Mk1UYzFNeUF3TGpRMU16SXlOaUF3TGpZek9EUTFPQ0F3TGpRMk1UZzVOVU13TGpZMU9UTTROaUF3TGpRM01EVTJOQ0F3TGpZM056STNOQ0F3TGpRNE5USTBOQ0F3TGpZNE9UZzFPU0F3TGpVd05EQTNPVU13TGpjd01qUTBOQ0F3TGpVeU1qa3hNeUF3TGpjd09URTJNU0F3TGpVME5UQTFOeUF3TGpjd09URTJNU0F3TGpVMk56Y3hRekF1TnpBNU1UWXhJREF1TlRrNE1EZzJJREF1TmprM01EazBJREF1TmpJM01qRTRJREF1TmpjMU5qRTFJREF1TmpRNE5qazNRekF1TmpVME1UTTJJREF1Tmpjd01UYzJJREF1TmpJMU1EQTBJREF1TmpneU1qUXpJREF1TlRrME5qSTRJREF1TmpneU1qUXpXazB3TGpjNU9UazJNU0F3TGpjMk56TXhRekF1TnprMk1EY3pJREF1Tnpjd09UazFJREF1Tnprd09URTVJREF1Tnpjek1EVWdNQzQzT0RVMU5qRWdNQzQzTnpNd05VTXdMamM0TURJd05DQXdMamMzTXpBMUlEQXVOemMxTURVZ01DNDNOekE1T1RVZ01DNDNOekV4TmpFZ01DNDNOamN6TVV3d0xqWTRNak0yTVNBd0xqWTNPRFV4UXpBdU5qa3pNakExSURBdU5qY3dNREF6SURBdU56QXlOek1nTUM0Mk5UazVNemdnTUM0M01UQTJNamdnTUM0Mk5EZzJORE5NTUM0M09UazVOakVnTUM0M016ZzFNVU13TGpnd016YzBJREF1TnpReU16VXhJREF1T0RBMU9EVTNJREF1TnpRM05USXlJREF1T0RBMU9EVTNJREF1TnpVeU9URkRNQzQ0TURVNE5UY2dNQzQzTlRneU9UZ2dNQzQ0TURNM05DQXdMamMyTXpRMk9TQXdMamM1T1RrMk1TQXdMamMyTnpNeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZek1UUXhNU0F3TGpVd05UY3hPVXd3TGpZeE5UVTBOU0F3TGpVeU56RTROVU13TGpZd09EUXdPQ0F3TGpVeU1UZzVPQ0F3TGpVNU9UZzJOQ0F3TGpVeE9EZzBOQ0F3TGpVNU1EazVNaUF3TGpVeE9EUXhRekF1TlRneU1USWdNQzQxTVRjNU56WWdNQzQxTnpNek1Ua2dNQzQxTWpBeE9ERWdNQzQxTmpVM0lEQXVOVEkwTnpRM1F6QXVOVFU0TURneElEQXVOVEk1TXpFeklEQXVOVFV4T1RnM0lEQXVOVE0yTURNMElEQXVOVFE0TVRnMklEQXVOVFEwTURZeVF6QXVOVFEwTXpnMUlEQXVOVFV5TURrZ01DNDFORE13TkRrZ01DNDFOakV3TmpRZ01DNDFORFF6TkRZZ01DNDFOams0TlRGRE1DNDFORFV3T0RZZ01DNDFOelU0TVRrZ01DNDFORGN3TkRFZ01DNDFPREUxTnpJZ01DNDFOVEF3T1RFZ01DNDFPRFkzTlRWRE1DNDFOVE14TkRFZ01DNDFPVEU1TXpjZ01DNDFOVGN5TWpFZ01DNDFPVFkwTkNBd0xqVTJNakEzT1NBd0xqVTVPVGs0TkV3d0xqVTBOamMwTmlBd0xqWXlNRGM0TkVNd0xqVXpNVGczTkNBd0xqWXdPVE0wTlNBd0xqVXlNakE0TmlBd0xqVTVNalV5TlNBd0xqVXhPVFE0T1NBd0xqVTNNemswTkVNd0xqVXhOamc1TVNBd0xqVTFOVE0yTWlBd0xqVXlNVFk1TVNBd0xqVXpOalV3TXlBd0xqVXpNamcxTmlBd0xqVXlNVFF5TkVNd0xqVTBOREF5TVNBd0xqVXdOak0wTmlBd0xqVTJNRFkxT0NBd0xqUTVOakkxTWlBd0xqVTNPVEU0T1NBd0xqUTVNek14TlVNd0xqVTVOemN5SURBdU5Ea3dNemM0SURBdU5qRTJOalkwSURBdU5EazBPRE15SURBdU5qTXhPVFEwSURBdU5UQTFOekU1U0RBdU5qTXhOREV4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNRFkzSWlCNU1UMGlNUzR5TURjd055SWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5DTURBNE5FUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHTkVZNFFpSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MTJjNzJlYzctOWI4Ny00MzZlLWIxOTAtNjlmMDU2NTRhMGFmOyIgcGFyZW50PSIyOSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1NSIgeT0iMjc0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlZQQyAtIEN1c3RvbWVyIEluc3RhbmNlIiBpci5zb3VyY2VTdHlsZT0iY29udGFpbmVyPXVuZGVmaW5lZDtyb3VuZGVkPTE7YXJjU2l6ZT05MDtwZXJpbWV0ZXI9dW5kZWZpbmVkO3JlY3Vyc2l2ZVJlc2l6ZT11bmRlZmluZWQ7dmVydGljYWxBbGlnbj10b3A7c3Ryb2tlV2lkdGg9dW5kZWZpbmVkO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTI7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDthbGlnbj1jZW50ZXI7dGV4dERpcmVjdGlvbj11bmRlZmluZWQ7c3BhY2luZ1RvcD11bmRlZmluZWQ7c3BhY2luZ0xlZnQ9dW5kZWZpbmVkO2FzcGVjdD11bmRlZmluZWQ7ZGFzaGVkPXVuZGVmaW5lZDtmb250U3R5bGU9dW5kZWZpbmVkO291dGxpbmVDb25uZWN0PXVuZGVmaW5lZDtzaGFwZT11bmRlZmluZWQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSWpSVE5HUTBaRElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RVNU5DQXdMall5TUROSU1DNHlPVGt5TnpORE1DNHlNall5TURZZ01DNDJNakF6SURBdU1UY3dNelFnTUM0MU56RTFJREF1TVRZMk5qQTJJREF1TlRBME5ETXpRekF1TVRZMk5qQTJJREF1TlRBeE5qTXpJREF1TVRZMk5qQTJJREF1TkRrNE5ETXpJREF1TVRZMk5qQTJJREF1TkRrMU1qTXpRekF1TVRZMU5EY3hJREF1TkRZM05EQTRJREF1TVRjek9EQTNJREF1TkRRd01ESXhJREF1TVRrd01qVXhJREF1TkRFM05UUTJRekF1TWpBMk5qazFJREF1TXprMU1EY3hJREF1TWpNd01qYzJJREF1TXpjNE9ETTVJREF1TWpVM01UUWdNQzR6TnpFMVF6QXVNalUzTVRRZ01DNHpOamM1SURBdU1qVTNNVFFnTUM0ek5qUTBNek1nTUM0eU5UY3hOQ0F3TGpNMk1EZ3pNME13TGpJMU56Z3hNaUF3TGpNeU5Ea3pOeUF3TGpJMk9UQTVOQ0F3TGpJNU1EQTBOQ0F3TGpJNE9UVTJNeUF3TGpJMk1EVTBPVU13TGpNeE1EQXpNeUF3TGpJek1UQTFOQ0F3TGpNek9EYzNOQ0F3TGpJd09ESTNOeUF3TGpNM01qRTJOaUF3TGpFNU5UQTRPVU13TGpRd05UVTFPQ0F3TGpFNE1Ua2dNQzQwTkRJeE1EWWdNQzR4TnpnNE9TQXdMalEzTnpJd05pQXdMakU0TmpRek4wTXdMalV4TWpNd05pQXdMakU1TXprNE5DQXdMalUwTkRNNE55QXdMakl4TVRjMU1TQXdMalUyT1RRd05pQXdMakl6TnpWRE1DNDFPRFk0TlRVZ01DNHlOVFEzTnlBd0xqWXdNVEF6T0NBd0xqSTNOVEExTVNBd0xqWXhNVEkzTXlBd0xqSTVOek0yTjBNd0xqWXlOVGt3TWlBd0xqSTROVFl4TkNBd0xqWTBOREV3T0NBd0xqSTNPVEl4TmlBd0xqWTJNamczTXlBd0xqSTNPVEl6TTBNd0xqY3dNVFUwSURBdU1qYzVNak16SURBdU56UXlPRGN6SURBdU16QTJPRE16SURBdU56UTVOamN6SURBdU16WTRNME13TGpjNE1qVXpJREF1TXpjME9DQXdMamd4TWpFM015QXdMak01TWpNMUlEQXVPRE16TmpjeklEQXVOREU0TURNelREQXVPREV5TnpRZ01DNDBNelEwTXpORE1DNDNPVEkzTnpVZ01DNDBNVEUxT1RJZ01DNDNOalV5T1RjZ01DNHpPVFkyTkRjZ01DNDNNelV5TnpNZ01DNHpPVEl6UXpBdU56TXlNamN6SURBdU16a3hPREU1SURBdU56STVOVEkySURBdU16a3dNekkzSURBdU56STNORGtnTUM0ek9EZ3dOekpETUM0M01qVTBOVE1nTUM0ek9EVTRNVGNnTUM0M01qUXlORGNnTUM0ek9ESTVNelFnTUM0M01qUXdOek1nTUM0ek56azVRekF1TnpJeE1EQTJJREF1TXpJNE9ETXpJREF1TmpreE1UUWdNQzR6TURVNUlEQXVOall5T0RjeklEQXVNekExT1VNd0xqWTFNems1TnlBd0xqTXdOVGs0TWlBd0xqWTBOVEkySURBdU16QTRNVElnTUM0Mk16Y3pORGtnTUM0ek1USXhORFZETUM0Mk1qazBNemNnTUM0ek1UWXhOeUF3TGpZeU1qVTJOaUF3TGpNeU1UazNOQ0F3TGpZeE56STNNeUF3TGpNeU9URkRNQzQyTVRVNE5ERWdNQzR6TXpFd01Ea2dNQzQyTVRNNU1qSWdNQzR6TXpJME9Ua2dNQzQyTVRFM01UY2dNQzR6TXpNME1UTkRNQzQyTURrMU1UTWdNQzR6TXpRek1qZ2dNQzQyTURjeE1ETWdNQzR6TXpRMk16UWdNQzQyTURRM05DQXdMak16TkRORE1DNDJNREl6TmpZZ01DNHpNek01TXpjZ01DNDJNREF4TXpVZ01DNHpNekk1TkRFZ01DNDFPVGd5T0RFZ01DNHpNekUwTVRaRE1DNDFPVFkwTWpjZ01DNHpNams0T1NBd0xqVTVOVEF4T1NBd0xqTXlOemc1TWlBd0xqVTVOREl3TmlBd0xqTXlOVFl6TTBNd0xqVTROVEEzT1NBd0xqSTVPVGN4TkNBd0xqVTNNREkzTXlBd0xqSTNOakUyTWlBd0xqVTFNRGczTXlBd0xqSTFOamRETUM0MU1qazFOelFnTUM0eU16UTNPRGNnTUM0MU1ESXlPRFlnTUM0eU1UazJORElnTUM0ME56STBNaklnTUM0eU1UTXhOak5ETUM0ME5ESTFOVGtnTUM0eU1EWTJPRE1nTUM0ME1URTBORGNnTUM0eU1Ea3hOVFlnTUM0ek9ESTVPRElnTUM0eU1qQXlOekZETUM0ek5UUTFNVGNnTUM0eU16RXpPRGNnTUM0ek1qazVOak1nTUM0eU5UQTJOVElnTUM0ek1USXpPVE1nTUM0eU56VTJOVFJETUM0eU9UUTRNalFnTUM0ek1EQTJOVFlnTUM0eU9EVXdNVGtnTUM0ek16QXlPRFlnTUM0eU9EUXlNRFlnTUM0ek5qQTRNek5ETUM0eU9EUXlNalVnTUM0ek5qY3lNRE1nTUM0eU9EUTFPREVnTUM0ek56TTFOamdnTUM0eU9EVXlOek1nTUM0ek56azVRekF1TWpnMU5UazBJREF1TXpnek1EZ3lJREF1TWpnME56WXhJREF1TXpnMk1qY3pJREF1TWpneU9USTFJREF1TXpnNE9Ea3lRekF1TWpneE1Ea2dNQzR6T1RFMU1URWdNQzR5Tnpnek56UWdNQzR6T1RNek9ETWdNQzR5TnpVeU56TWdNQzR6T1RReE5qZERNQzR5TkRVd01EWWdNQzQwTURFMk16TWdNQzR4T1RNNU5DQXdMalF5TkRnek15QXdMakU1TXprMElEQXVORGsxTWpNelF6QXVNVGt6T0RBMklEQXVORGszTmpNeElEQXVNVGt6T0RBMklEQXVOVEF3TURNMUlEQXVNVGt6T1RRZ01DNDFNREkwTXpORE1DNHhPVFk0TnpNZ01DNDFOVFUzTmpjZ01DNHlOREUxTkNBd0xqVTVNell6TXlBd0xqTXdNRFl3TmlBd0xqVTVNell6TTBnd0xqUTROekkzTTB3d0xqUTROVGswSURBdU5qSXdNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOekkwTlRFZ01DNDRNVFk0TURWRE1DNDFNVFF6TVRnZ01DNDRNVFk0TURVZ01DNDFNVEkwTlRFZ01DNDJNemt3TnpFZ01DNDFNVEkwTlRFZ01DNDJNemN6TXpoV01DNDBOelV3TnpGRE1DNDFNVEkwTkRJZ01DNDBOekl6TkRjZ01DNDFNVE15TmpnZ01DNDBOamsyT0RVZ01DNDFNVFE0TVRnZ01DNDBOamMwTkRWRE1DNDFNVFl6TmpjZ01DNDBOalV5TURRZ01DNDFNVGcxTmpZZ01DNDBOak0wT1RJZ01DNDFNakV4TVRnZ01DNDBOakkxTXpoTU1DNDJOamMzT0RVZ01DNDBNRGd5TnpGRE1DNDJOekE0TURRZ01DNDBNRGN5TURRZ01DNDJOelF3T1RnZ01DNDBNRGN5TURRZ01DNDJOemN4TVRnZ01DNDBNRGd5TnpGTU1DNDRNak0zT0RVZ01DNDBOakkxTXpoRE1DNDRNall6TXpjZ01DNDBOak0wT1RJZ01DNDRNamcxTXpVZ01DNDBOalV5TURRZ01DNDRNekF3T0RVZ01DNDBOamMwTkRWRE1DNDRNekUyTXpRZ01DNDBOamsyT0RVZ01DNDRNekkwTmlBd0xqUTNNak0wTnlBd0xqZ3pNalExTVNBd0xqUTNOVEEzTVZZd0xqWTBOek16T0VNd0xqZ3pNalExTVNBd0xqWTBPVEEzTVNBd0xqZ3pNRFU0TlNBd0xqZ3hOamd3TlNBd0xqWTNNalExTVNBd0xqZ3hOamd3TlZwTk1DNDFNemt4TVRnZ01DNDBPRFEwTURWV01DNDJNemN6TXpoRE1DNDFNemt4TVRnZ01DNDJORE0yTURVZ01DNDFOREE1T0RVZ01DNDNPVEF4TXpnZ01DNDJOekkwTlRFZ01DNDNPVEF4TXpoRE1DNDRNRE01TVRnZ01DNDNPVEF4TXpnZ01DNDRNRFUzT0RVZ01DNDJOVE15TURVZ01DNDRNRFUzT0RVZ01DNDJORGN6TXpoV01DNDBPRFEwTURWTU1DNDJOekkwTlRFZ01DNDBNelE1TXpoTU1DNDFNemt4TVRnZ01DNDBPRFEwTURWYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpjeU5ETTVJREF1TnpZMk9USTBRekF1TlRnM05qTTVJREF1TnpZMk9USTBJREF1TlRZMk9ETTVJREF1TmpVNU16STBJREF1TlRZMU56Y3pJREF1TmpVME56a3hRekF1TlRZMU5qUXhJREF1TmpVek9UazJJREF1TlRZMU5qUXhJREF1TmpVek1UZzFJREF1TlRZMU56Y3pJREF1TmpVeU16a3hWakF1TlRFME1qVTRRekF1TlRZMU56Y2dNQzQxTVRFMU9EY2dNQzQxTmpZMU5qa2dNQzQxTURnNU56Z2dNQzQxTmpnd05qY2dNQzQxTURZM05qZERNQzQxTmprMU5qVWdNQzQxTURRMU5UWWdNQzQxTnpFMk9USWdNQzQxTURJNE5EWWdNQzQxTnpReE56TWdNQzQxTURFNE5UaE1NQzQyTmpjMU1EWWdNQzQwTmpVd05UaERNQzQyTnpBMk56UWdNQzQwTmpNM09UWWdNQzQyTnpReU1EVWdNQzQwTmpNM09UWWdNQzQyTnpjek56TWdNQzQwTmpVd05UaE1NQzQzTnpBM01EWWdNQzQxTURFNE5UaERNQzQzTnpNeE9EY2dNQzQxTURJNE5EWWdNQzQzTnpVek1UUWdNQzQxTURRMU5UWWdNQzQzTnpZNE1USWdNQzQxTURZM05qZERNQzQzTnpnek1Ea2dNQzQxTURnNU56Z2dNQzQzTnpreE1Ea2dNQzQxTVRFMU9EY2dNQzQzTnpreE1EWWdNQzQxTVRReU5UaFdNQzQyTlRJek9URkRNQzQzTnpreE56SWdNQzQyTlRNeE9TQXdMamMzT1RFM01pQXdMalkxTXprNU1pQXdMamMzT1RFd05pQXdMalkxTkRjNU1VTXdMamMzT0RBek9TQXdMalkxT1RNeU5DQXdMamMxTnpJek9TQXdMamMyTmpreU5DQXdMalkzTWpRek9TQXdMamMyTmpreU5GcE5NQzQxT1RJME16a2dNQzQyTlRFd05UaERNQzQxT1RRMU56TWdNQzQyTmpFeE9URWdNQzQyTVRNMk16a2dNQzQzTkRBeU5UZ2dNQzQyTnpJME16a2dNQzQzTkRBeU5UaERNQzQzTXpFeU16a2dNQzQzTkRBeU5UZ2dNQzQzTlRBek1EWWdNQzQyTmpFek1qUWdNQzQzTlRJME16a2dNQzQyTlRFd05UaFdNQzQxTWpNek1qUk1NQzQyTnpJME16a2dNQzQwT1RFNE5UaE1NQzQxT1RJME16a2dNQzQxTWpNek1qUldNQzQyTlRFd05UaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6UkVNamRCT0NJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalFURTJOa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tIiBpZD0iNyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWRmYjI2MzFmLWQ5NTktNGExOS1hY2U0LTYyZmI1NTJiNjc3Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj12cGM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMjkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTk1IiB5PSI4NyIgd2lkdGg9IjM0MCIgaGVpZ2h0PSIzOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCAtPiBPdmVyZmxvdyAvIENvbGQgU3RvcmFnZSIgc3R5bGU9ImlyLnJlZj1jMDEzMDE0OS01YzMxLTQxNjUtYjZlMi0yMmNjNTgzMzliZGQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNiIgdmFsdWU9IkVsYXN0aWNzZWFyY2ggLT4gUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1lMTM1MWJlZS0yN2QyLTQ2YzctYmI4OS02ZjI5MmZhZjM5Zjg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI3IiBzb3VyY2U9IjgiIHRhcmdldD0iMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iRWxhc3RpY3NlYXJjaCIgc3R5bGU9ImlyLnJlZj05OTUyMjA0ZS03ZTJjLTQ0MGMtOTUwNS01NGMxYzFmNTVlODE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWxhc3RpY3NlYXJjaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1EQXdPREVnTUM0ek5qTXlPREZJTUM0eE9EQXdPREZETUM0eE56WTFORFVnTUM0ek5qTXlPREVnTUM0eE56TXhOVFFnTUM0ek5qUTJPRFlnTUM0eE56QTJOVE1nTUM0ek5qY3hPRFpETUM0eE5qZ3hOVE1nTUM0ek5qazJPRGNnTUM0eE5qWTNORGdnTUM0ek56TXdOemdnTUM0eE5qWTNORGdnTUM0ek56WTJNVFZXTUM0NE1ETXlPREZETUM0eE5qWTNORGdnTUM0NE1EWTRNVGNnTUM0eE5qZ3hOVE1nTUM0NE1UQXlNRGtnTUM0eE56QTJOVE1nTUM0NE1USTNNRGxETUM0eE56TXhOVFFnTUM0NE1UVXlNU0F3TGpFM05qVTBOU0F3TGpneE5qWXhOQ0F3TGpFNE1EQTRNU0F3TGpneE5qWXhORWd3TGpNd01EQTRNVU13TGpNd016WXhPQ0F3TGpneE5qWXhOQ0F3TGpNd056QXdPU0F3TGpneE5USXhJREF1TXpBNU5UQTVJREF1T0RFeU56QTVRekF1TXpFeU1ERWdNQzQ0TVRBeU1Ea2dNQzR6TVRNME1UVWdNQzQ0TURZNE1UY2dNQzR6TVRNME1UVWdNQzQ0TURNeU9ERldNQzR6TnpZMk1UVkRNQzR6TVRNME1UVWdNQzR6TnpNd056Z2dNQzR6TVRJd01TQXdMak0yT1RZNE55QXdMak13T1RVd09TQXdMak0yTnpFNE5rTXdMak13TnpBd09TQXdMak0yTkRZNE5pQXdMak13TXpZeE9DQXdMak0yTXpJNE1TQXdMak13TURBNE1TQXdMak0yTXpJNE1WcE5NQzR5T0RZM05EZ2dNQzQzT0RrNU5EaElNQzR4T1RNME1UVldNQzR6T0RrNU5EaElNQzR5T0RZM05EaFdNQzQzT0RrNU5EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU9EQXpNelkyUXpBdU5EZzJOelUxSURBdU9EQTJPVEF6SURBdU5EZzFNelVnTUM0NE1UQXlPVFFnTUM0ME9ESTRORGtnTUM0NE1USTNPVFJETUM0ME9EQXpORGtnTUM0NE1UVXlPVFVnTUM0ME56WTVOVGNnTUM0NE1UWTNJREF1TkRjek5ESXhJREF1T0RFMk4wZ3dMak0xTXpReU1VTXdMak0wT1RnNE5TQXdMamd4TmpjZ01DNHpORFkwT1RRZ01DNDRNVFV5T1RVZ01DNHpORE01T1RNZ01DNDRNVEkzT1RSRE1DNHpOREUwT1RNZ01DNDRNVEF5T1RRZ01DNHpOREF3T0RnZ01DNDRNRFk1TURNZ01DNHpOREF3T0RnZ01DNDRNRE16TmpaV01DNDFOek16TmpSRE1DNHpORFEwTWpNZ01DNDFPVGd4TkRVZ01DNHpOVE0wTnpZZ01DNDJNakU0TmpRZ01DNHpOalkzTlRVZ01DNDJORE15TXpKV01DNDNPRGs1U0RBdU5EWXdNRGc0VmpBdU56SXdNRE15UXpBdU5EWTROek14SURBdU56SXpOams0SURBdU5EYzNOalEzSURBdU56STJOamcxSURBdU5EZzJOelUxSURBdU56STRPVFkyVmpBdU56STRPVFkyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE0TmpjMU5TQXdMakk1TmpZMU9WWXdMak0wTXpnMU9VTXdMalEzTnpZek1pQXdMak0wTmpNeE1pQXdMalEyT0RjeE5pQXdMak0wT1RRM055QXdMalEyTURBNE9DQXdMak0xTXpNeU5WWXdMak13T1RrNU1rZ3dMak0yTmpjMU5WWXdMalF5T1RrNU1rTXdMak0xTXpRM05pQXdMalExTVRNMU9TQXdMak0wTkRReU15QXdMalEzTlRBM09DQXdMak0wTURBNE9DQXdMalE1T1RnMU9WWXdMakk1TmpZMU9VTXdMak0wTURBNE9DQXdMakk1TXpFeU1pQXdMak0wTVRRNU15QXdMakk0T1Rjek1TQXdMak0wTXprNU15QXdMakk0TnpJelF6QXVNelEyTkRrMElEQXVNamcwTnpNZ01DNHpORGs0T0RVZ01DNHlPRE16TWpVZ01DNHpOVE0wTWpFZ01DNHlPRE16TWpWSU1DNDBOek0wTWpGRE1DNDBOelk1TlRjZ01DNHlPRE16TWpVZ01DNDBPREF6TkRrZ01DNHlPRFEzTXlBd0xqUTRNamcwT1NBd0xqSTROekl6UXpBdU5EZzFNelVnTUM0eU9EazNNekVnTUM0ME9EWTNOVFVnTUM0eU9UTXhNaklnTUM0ME9EWTNOVFVnTUM0eU9UWTJOVGxhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TkRJNElEQXVOek01TlRkV01DNDNPRGs1TjBnd0xqVTBNREE1TkZZd0xqY3pOall6TjBNd0xqVXpNVEUzTmlBd0xqY3pOalkyTmlBd0xqVXlNakkyTnlBd0xqY3pOakE0TnlBd0xqVXhNelF5T0NBd0xqY3pORGt3TTFZd0xqZ3dNek13TTBNd0xqVXhNelF5T0NBd0xqZ3dOamcwSURBdU5URTBPRE15SURBdU9ERXdNak14SURBdU5URTNNek16SURBdU9ERXlOek15UXpBdU5URTVPRE16SURBdU9ERTFNak15SURBdU5USXpNakkxSURBdU9ERTJOak0zSURBdU5USTJOell4SURBdU9ERTJOak0zU0RBdU5qUTJOell4UXpBdU5qVXdNamszSURBdU9ERTJOak0zSURBdU5qVXpOamc1SURBdU9ERTFNak15SURBdU5qVTJNVGc1SURBdU9ERXlOek15UXpBdU5qVTROamtnTUM0NE1UQXlNekVnTUM0Mk5qQXdPVFFnTUM0NE1EWTROQ0F3TGpZMk1EQTVOQ0F3TGpnd016TXdNMVl3TGpjMk5qSXpOMHd3TGpZek16UXlPQ0F3TGpjek9UVTNXazB3TGpZME5qYzJNU0F3TGpFM05qWXpOa2d3TGpVeU5qYzJNVU13TGpVeU16SXlOU0F3TGpFM05qWXpOaUF3TGpVeE9UZ3pNeUF3TGpFM09EQTBNU0F3TGpVeE56TXpNeUF3TGpFNE1EVTBNVU13TGpVeE5EZ3pNaUF3TGpFNE16QTBNU0F3TGpVeE16UXlPQ0F3TGpFNE5qUXpNeUF3TGpVeE16UXlPQ0F3TGpFNE9UazJPVll3TGpNek9ETTJPVU13TGpVeU1qSTJOaUF3TGpNek56RTNOQ0F3TGpVek1URTNOaUF3TGpNek5qVTVOU0F3TGpVME1EQTVOQ0F3TGpNek5qWXpObFl3TGpNek5qWXpObFl3TGpJd016TXdNa2d3TGpZek16UXlPRll3TGpNMU9UazJPVU13TGpZME1qYzNJREF1TXpZME9URTNJREF1TmpVeE5qZzVJREF1TXpjd05qSTFJREF1TmpZd01EazBJREF1TXpjM01ETTJWakF1TVRrd016WTVRekF1TmpZd01UUTRJREF1TVRnNE5UZzFJREF1TmpVNU9EUXpJREF1TVRnMk9EQTRJREF1TmpVNU1UazNJREF1TVRnMU1UUTBRekF1TmpVNE5UVXhJREF1TVRnek5EZ2dNQzQyTlRjMU56Y2dNQzR4T0RFNU5qSWdNQzQyTlRZek16TWdNQzR4T0RBMk9ERkRNQzQyTlRVd09TQXdMakUzT1RRd01TQXdMalkxTXpZd01pQXdMakUzT0RNNE1pQXdMalkxTVRrMU9DQXdMakUzTnpZNE9FTXdMalkxTURNeE15QXdMakUzTmprNU15QXdMalkwT0RVME5pQXdMakUzTmpZek5TQXdMalkwTmpjMk1TQXdMakUzTmpZek5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qQXhNREVnTUM0eU5ETXlPRFpJTUM0M01EQXhNREZETUM0Mk9UWTFOalVnTUM0eU5ETXlPRFlnTUM0Mk9UTXhOek1nTUM0eU5EUTJPVEVnTUM0Mk9UQTJOek1nTUM0eU5EY3hPVEZETUM0Mk9EZ3hOeklnTUM0eU5EazJPVElnTUM0Mk9EWTNOamdnTUM0eU5UTXdPRE1nTUM0Mk9EWTNOamdnTUM0eU5UWTJNVGxXTUM0ME1ERXhOVEpETUM0Mk9UY3dORGdnTUM0ME1USXlOVEVnTUM0M01EVTVPVGNnTUM0ME1qUTFNVElnTUM0M01UTTBNelFnTUM0ME16YzJPRFpXTUM0eU5qazVOVE5JTUM0NE1EWTNOamhXTUM0Mk56azVOVEpNTUM0NE16TTBNelFnTUM0M01EWTJNVGhXTUM0eU5UWTJNVGxETUM0NE16TTBNelFnTUM0eU5UTXdPRE1nTUM0NE16SXdNamtnTUM0eU5EazJPVElnTUM0NE1qazFNamtnTUM0eU5EY3hPVEZETUM0NE1qY3dNamdnTUM0eU5EUTJPVEVnTUM0NE1qTTJNemNnTUM0eU5ETXlPRFlnTUM0NE1qQXhNREVnTUM0eU5ETXlPRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREUzTURjMElEQXVOekk0TmpnelREQXVOamszTURjMElEQXVOakE0TmpnelF6QXVOekUwTWpFeElEQXVOVGN4TXpVZ01DNDNNVGMxTXpJZ01DNDFNamt4TkRRZ01DNDNNRFkwTkRZZ01DNDBPRGsxT1RGRE1DNDJPVFV6TlRrZ01DNDBOVEF3TXpjZ01DNDJOekExT0RZZ01DNDBNVFUzTURZZ01DNDJNelkxTkRJZ01DNHpPVEkzTVRsRE1DNDJNREkwT1RnZ01DNHpOamszTXpFZ01DNDFOakV6T1RZZ01DNHpOVGsxT0RJZ01DNDFNakExTmpVZ01DNHpOalF3T0VNd0xqUTNPVGN6TkNBd0xqTTJPRFUzTnlBd0xqUTBNVGd5T0NBd0xqTTROelF6SURBdU5ERXpOakEwSURBdU5ERTNNamMzUXpBdU16ZzFNemdnTUM0ME5EY3hNak1nTUM0ek5qZzJOek1nTUM0ME9EWXdNalFnTUM0ek5qWTBOaklnTUM0MU1qY3dOREpETUM0ek5qUXlOVElnTUM0MU5qZ3dOakVnTUM0ek56WTJPQ0F3TGpZd09EVXpNU0F3TGpRd01UVXpNeUF3TGpZME1USXpPVU13TGpReU5qTTROU0F3TGpZM016azBOaUF3TGpRMk1qQTBOaUF3TGpZNU5qYzJOQ0F3TGpVd01qRTFOeUF3TGpjd05UWXlORU13TGpVME1qSTJPQ0F3TGpjeE5EUTROQ0F3TGpVNE5ESXlNeUF3TGpjd09EZ3hNU0F3TGpZeU1EVTBJREF1TmpnNU5qRTJUREF1TnpNNE5UUWdNQzQ0TURjME9ETkRNQzQzTkRnNU16Y2dNQzQ0TVRjNE9UY2dNQzQzTmpNd05EUWdNQzQ0TWpNM05UVWdNQzQzTnpjM05pQXdMamd5TXpjMk4wTXdMamM1TWpRM05TQXdMamd5TXpjNElEQXVPREEyTlRreklEQXVPREUzT1RRMklEQXVPREUzTURBM0lEQXVPREEzTlRRNVF6QXVPREkzTkRJeElEQXVOemszTVRVeklEQXVPRE16TWpjNUlEQXVOemd6TURRMUlEQXVPRE16TWpreElEQXVOelk0TXpORE1DNDRNek16TURRZ01DNDNOVE0yTVRVZ01DNDRNamMwTnlBd0xqY3pPVFE1TnlBd0xqZ3hOekEzTkNBd0xqY3lPVEE0TTFZd0xqY3lPRFk0TTFwTk1DNHpPVE15TURjZ01DNDFNelkwTVRaRE1DNHpPVE15TURjZ01DNDFNRGMwTURnZ01DNDBNREU0TURrZ01DNDBOemt3TlRJZ01DNDBNVGM1TWpVZ01DNDBOVFE1TXpKRE1DNDBNelF3TkRFZ01DNDBNekE0TVRNZ01DNDBOVFk1TkRjZ01DNDBNVEl3TVRVZ01DNDBPRE0zTkRjZ01DNDBNREE1TVRSRE1DNDFNVEExTkRZZ01DNHpPRGs0TVRNZ01DNDFOREF3TXpZZ01DNHpPRFk1TURnZ01DNDFOamcwT0RjZ01DNHpPVEkxTmpoRE1DNDFPVFk1TXpjZ01DNHpPVGd5TWpjZ01DNDJNak13TnpFZ01DNDBNVEl4T1RVZ01DNDJORE0xT0RNZ01DNDBNekkzTURkRE1DNDJOalF3T1RRZ01DNDBOVE15TVRrZ01DNDJOemd3TmpNZ01DNDBOemt6TlRJZ01DNDJPRE0zTWpJZ01DNDFNRGM0TURORE1DNDJPRGt6T0RFZ01DNDFNell5TlRNZ01DNDJPRFkwTnpjZ01DNDFOalUzTkRNZ01DNDJOelV6TnpZZ01DNDFPVEkxTkRORE1DNDJOalF5TnpVZ01DNDJNVGt6TkRNZ01DNDJORFUwTnpZZ01DNDJOREl5TkRrZ01DNDJNakV6TlRjZ01DNDJOVGd6TmpWRE1DNDFPVGN5TXpnZ01DNDJOelEwT0RFZ01DNDFOamc0T0RFZ01DNDJPRE13T0RNZ01DNDFNems0TnpRZ01DNDJPRE13T0RORE1DNDFNREE1TnpVZ01DNDJPRE13T0RNZ01DNDBOak0yTnlBd0xqWTJOell6SURBdU5ETTJNVFkxSURBdU5qUXdNVEkxUXpBdU5EQTROalU1SURBdU5qRXlOaklnTUM0ek9UTXlNRGNnTUM0MU56VXpNVFFnTUM0ek9UTXlNRGNnTUM0MU16WTBNVFphVFRBdU56azRNVFFnTUM0M09EZ3lPRE5ETUM0M09USTNNVGtnTUM0M09UTTJOek1nTUM0M09EVXpPRFVnTUM0M09UWTJPVGdnTUM0M056YzNOQ0F3TGpjNU5qWTVPRU13TGpjM01EQTVOU0F3TGpjNU5qWTVPQ0F3TGpjMk1qYzJNU0F3TGpjNU16WTNNeUF3TGpjMU56TTBJREF1TnpnNE1qZ3pUREF1TmpRek56UWdNQzQyTnpRMk9ETkRNQzQyTlRrek1qVWdNQzQyTmpJNU1Ea2dNQzQyTnpJNE5ETWdNQzQyTkRnMk1qVWdNQzQyT0RNM05DQXdMall6TWpReE5rd3dMamM1T0RRd055QXdMamMwTnpZeE5rTXdMamd3TXpjMU15QXdMamMxTXpBMUlEQXVPREEyTnpJNElEQXVOell3TXpneUlEQXVPREEyTmpjNElEQXVOelk0TURBMVF6QXVPREEyTmpJNElEQXVOemMxTmpJM0lEQXVPREF6TlRVNElEQXVOemd5T1RJZ01DNDNPVGd4TkNBd0xqYzRPREk0TTFZd0xqYzRPREk0TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT0RBNE16a2dNQzQxT1RrNU1EZERNQzQwTnpFMU5ESWdNQzQxT1RNeU5UVWdNQzQwTmpNMk5qSWdNQzQxT0RRNE1pQXdMalExTnpZMU9DQXdMalUzTlRBNU1rTXdMalExTVRZMU5TQXdMalUyTlRNMk5DQXdMalEwTnpZME9DQXdMalUxTkRVek9DQXdMalEwTlRnM01TQXdMalUwTXpJME5rTXdMalEwTkRBNU5DQXdMalV6TVRrMU5DQXdMalEwTkRVNE15QXdMalV5TURReU1TQXdMalEwTnpNd09TQXdMalV3T1RNeE9VTXdMalExTURBek5TQXdMalE1T0RJeE9DQXdMalExTkRrME15QXdMalE0TnpjM0lEQXVORFl4TnpRNElEQXVORGM0TlRnMVF6QXVORFk0TlRVeklEQXVORFk1TkNBd0xqUTNOekV4T0NBd0xqUTJNVFkyTVNBd0xqUTROamswTkNBd0xqUTFOVGd5UXpBdU5EazJOemN4SURBdU5EUTVPVGM0SURBdU5UQTNOall4SURBdU5EUTJNVFV5SURBdU5URTRPVGd5SURBdU5EUTBOVFl5UXpBdU5UTXdNekF5SURBdU5EUXlPVGN6SURBdU5UUXhPREkySURBdU5EUXpOalV6SURBdU5UVXlPRGd4SURBdU5EUTJOVFl5UXpBdU5UWXpPVE0xSURBdU5EUTVORGN5SURBdU5UYzBNekF4SURBdU5EVTBOVFV6SURBdU5UZ3pNemN5SURBdU5EWXhOVEE1VERBdU5UWTNOVEExSURBdU5EZ3lPVGMxUXpBdU5UWXhNakk0SURBdU5EYzRNekkzSURBdU5UVTBNRGszSURBdU5EYzBPVFlnTUM0MU5EWTFNVGdnTUM0ME56TXdOamRETUM0MU16ZzVOQ0F3TGpRM01URTNOQ0F3TGpVek1UQTJNeUF3TGpRM01EYzVNeUF3TGpVeU16TXpOeUF3TGpRM01UazBORU13TGpVeE5UWXhNU0F3TGpRM016QTVOaUF3TGpVd09ERTRPQ0F3TGpRM05UYzFOeUF3TGpVd01UUTVNU0F3TGpRM09UYzNPRU13TGpRNU5EYzVOQ0F3TGpRNE16YzVPQ0F3TGpRNE9EazFOQ0F3TGpRNE9UQTVPQ0F3TGpRNE5ETXdOU0F3TGpRNU5UTTNOVU13TGpRM09UWTFOaUF3TGpVd01UWTFNaUF3TGpRM05qSTVJREF1TlRBNE56Z3pJREF1TkRjME16azNJREF1TlRFMk16WXlRekF1TkRjeU5UQTBJREF1TlRJek9UUWdNQzQwTnpJeE1qSWdNQzQxTXpFNE1UY2dNQzQwTnpNeU56UWdNQzQxTXprMU5ETkRNQzQwTnpRME1qVWdNQzQxTkRjeU5qZ2dNQzQwTnpjd09EY2dNQzQxTlRRMk9USWdNQzQwT0RFeE1EZ2dNQzQxTmpFek9EbERNQzQwT0RVeE1qZ2dNQzQxTmpnd09EWWdNQzQwT1RBME1qZ2dNQzQxTnpNNU1qVWdNQzQwT1RZM01EVWdNQzQxTnpnMU56Uk1NQzQwT0RBNE16a2dNQzQxT1RrNU1EZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEzSWlCNE1qMGlNUzR5TURjeUlpQjVNajBpTFRBdU1qQTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTEiIHk9IjI1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOCIgdmFsdWU9IkVDMiAtIEVsYXN0aWMgQ29tcHV0ZSBDbG91ZCAtPiBFbGFzdGljc2VhcmNoIiBzdHlsZT0iaXIucmVmPWQyYjAwYmQwLTM3MzItNDBmMi04OTQ4LTJiZDYwOTNmYzZkYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjciIHNvdXJjZT0iMTAiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0IiB2YWx1ZT0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIC0+IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9NDU2ZWYzYjQtZDg3NC00YmU5LTkzZDEtNTc3YjNkZjIyNGMwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNyIgc291cmNlPSIxMCIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iT3ZlcmZsb3cgLyBDb2xkIFN0b3JhZ2UiIHN0eWxlPSJpci5yZWY9ZDA3N2YyY2UtOGY1MS00ZWVkLWI5ZTgtMjljMzNjMWM5MDFlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXMzO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTUM0NU9UazVPVFZJTVZZd1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREQmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPREU1TURVeElEQXVOVE0wTVRnNFF6QXVPREUxTVRnMElEQXVOVEV6TWpVMUlEQXVOemt4TkRVeElEQXVORGs0TkRVMUlEQXVOemMxTVRnMElEQXVORGczT1RJeVF6QXVOelk1T1RnMElEQXVORGcwTlRnNUlEQXVOelUxTnpFNElEQXVORGM1TWpVMUlEQXVOelUwTlRFNElEQXVORGMwTlRnNVF6QXVOelUwTkRNMklEQXVORGN4TWpVZ01DNDNOVFE0T0RZZ01DNDBOamM1TVRrZ01DNDNOVFU0TlRFZ01DNDBOalEzTWpKTU1DNDNOamt4T0RRZ01DNHpOamc0TlRaRE1DNDNOek13TlRFZ01DNHpOREEzTWpJZ01DNDNOelkzT0RRZ01DNHpNVEkxT0RrZ01DNDNPREEyTlRFZ01DNHlPRFEwTlRaRE1DNDNPRFF4TVRnZ01DNHlOVGcxT0RrZ01DNDNOekUzTVRnZ01DNHlOREV5TlRZZ01DNDNOVEEyTlRFZ01DNHlNalkzTWpORE1DNDNNRGMzTVRnZ01DNHhPVFk1T0RrZ01DNDJOVEUzTVRnZ01DNHhPRFE1T1NBd0xqWXdNVEU0TkNBd0xqRTNOamN5TTBNd0xqVXpOemd4TVNBd0xqRTJOak0zTmlBd0xqUTNNek0yTlNBd0xqRTJOREkzSURBdU5EQTVORFV4SURBdU1UY3dORFUyUXpBdU16VXhPVFkySURBdU1UYzBOamMwSURBdU1qazFOVFEySURBdU1UZzRNVGd6SURBdU1qUXlNemcwSURBdU1qRXdORFUyUXpBdU1qRXpPRFV4SURBdU1qSXpOemc1SURBdU1UYzJOVEU0SURBdU1qUTBOVGc1SURBdU1UZ3hNVGcwSURBdU1qZ3dPVGc1UXpBdU1UazBOVEU0SURBdU16ZzVNalUySURBdU1qRXdNalV4SURBdU5EazNNalUxSURBdU1qSTBOemcwSURBdU5qQTFNemc0UXpBdU1qTXhORFV4SURBdU5qVTBPRFUxSURBdU1qTTRNVEU0SURBdU56QTBNekl4SURBdU1qUTBOemcwSURBdU56VXpOemc0UXpBdU1qUTFPRFlnTUM0M05qTTBNaUF3TGpJME9UUTJJREF1TnpjeU5UazRJREF1TWpVMU1qRTVJREF1Tnpnd016azBRekF1TWpZd09UYzRJREF1TnpnNE1Ua2dNQzR5TmpnMk9UTWdNQzQzT1RRek1qZ2dNQzR5TnpjMU9EUWdNQzQzT1RneE9EaERNQzR6TVRnNU1UZ2dNQzQ0TWpBMU9EZ2dNQzR6TnpBeE1UZ2dNQzQ0TWpZNU9EZ2dNQzQwTVRZeU5URWdNQzQ0TXpFeU5UUkRNQzQwTnpjMU9ETWdNQzQ0TXpZM09UUWdNQzQxTXprek9ESWdNQzQ0TXpRd05UZ2dNQzQxT1RrNU9EUWdNQzQ0TWpNeE1qRkRNQzQyTXpnek9EUWdNQzQ0TVRZd05UUWdNQzQzTURrNE5URWdNQzQ0TURRME5UUWdNQzQzTVRVNU9EUWdNQzQzTlRZME5UUkRNQzQzTWpNMU9EUWdNQzQyT1RZNU9EZ2dNQzQzTXpFNU9EUWdNQzQyTXpjMU1qRWdNQzQzTXprNU9EUWdNQzQxTnpneE9EaE1NQzQzTkRJNU1UZ2dNQzQxTmpBd05UVkRNQzQzTmpRMk5URWdNQzQxTmpVeU5UVWdNQzQ0TWpZMk5URWdNQzQxTnpZek1qSWdNQzQ0TVRrd05URWdNQzQxTXpReE9EaGFUVEF1TkRnd05qVXhJREF1TVRrek16ZzVRekF1TlRZd05qVXhJREF1TVRrek16ZzVJREF1TmpVeU1qVXhJREF1TWpBeU5EVTJJREF1TnpJek9UZzBJREF1TWpReE9USXpRekF1TnpNMU1EVXhJREF1TWpRNE1EVTJJREF1TnpZd056ZzBJREF1TWpZeE56ZzVJREF1TnpVek1EVXhJREF1TWpjNE1EVTJRekF1TnpRMU16RTRJREF1TWprME16SXpJREF1TnpJeE16RTRJREF1TXpBeU5EVTJJREF1TnpBMk5qVXhJREF1TXpBNE16SXlRekF1TmpnMU56QTRJREF1TXpFMk1EVTVJREF1TmpZME1UY2dNQzR6TWpJd056Z2dNQzQyTkRJeU5URWdNQzR6TWpZek1qSkRNQzQxTkRjd056UWdNQzR6TkRVeE56WWdNQzQwTkRrek1qa2dNQzR6TkRjeU1EY2dNQzR6TlRNME5URWdNQzR6TXpJek1qSkRNQzR6TVRBeE5UZ2dNQzR6TWpjNE5UZ2dNQzR5Tmpnd05EUWdNQzR6TVRVMU1qSWdNQzR5TWpreE9EUWdNQzR5T1RVNU1qTkRNQzR5TVRrMU9EUWdNQzR5T1RBME5UWWdNQzR5TURNM01UZ2dNQzR5T0RBMU9Ea2dNQzR5TURneE1UZ2dNQzR5TmpjMU1qTkRNQzR5TVRFMk1ETWdNQzR5TmpBMU1ESWdNQzR5TVRjd056UWdNQzR5TlRRMk5pQXdMakl5TXpnMU1TQXdMakkxTURjeU0wTXdMakkxTXpFek55QXdMakl6TVRnNE9TQXdMakk0TlRjd015QXdMakl4T0RjeU55QXdMak14T1RnMU1TQXdMakl4TVRreU0wTXdMak0zTWpVd055QXdMakU1T1RJNE1pQXdMalF5TmpVZ01DNHhPVE13TlRrZ01DNDBPREEyTlRFZ01DNHhPVE16T0RsV01DNHhPVE16T0RsYVRUQXVOamc1TnpFNElEQXVOelUxTXpnNFF6QXVOamczTnpFNElEQXVOemN3T1RnNElEQXVOall4T1RnMElEQXVOemM0TnpJeElEQXVOalE1TnpFNElEQXVOemd6TVRJeFF6QXVOakkwTWpVeElEQXVOemt4TmpRZ01DNDFPVGM1T0RJZ01DNDNPVGMxTXpjZ01DNDFOekV6TVRnZ01DNDRNREEzTWpGRE1DNDFNVEl4TlRZZ01DNDRNRGcxT0RjZ01DNDBOVEl5TVRNZ01DNDRNRGcxT0RjZ01DNHpPVE13TlRFZ01DNDRNREEzTWpGRE1DNHpOVFU1T1RZZ01DNDNPVGM0TkRZZ01DNHpNVGs0TVRJZ01DNDNPRGd3TXpFZ01DNHlPRFl6T0RRZ01DNDNOekUzT0RoRE1DNHlPREU0TXpZZ01DNDNOams0TVRFZ01DNHlOemM1TXlBd0xqYzJOall3TlNBd0xqSTNOVEV3TXlBd0xqYzJNalV6UXpBdU1qY3lNamMzSURBdU56VTRORFUySURBdU1qY3dOalF6SURBdU56VXpOamN6SURBdU1qY3dNemcwSURBdU56UTROekl4UXpBdU1qVTNNRFV4SURBdU5qUXlPVGc0SURBdU1qUXhPRFV4SURBdU5UTTNNalUxSURBdU1qSTNOVGcwSURBdU5ETXhOVEl5VERBdU1qRXlNVEU0SURBdU16RTJPRFUyUXpBdU1qUXlOREk1SURBdU16TXpOVGczSURBdU1qYzFNekk1SURBdU16UTFNVEkwSURBdU16QTVORFV4SURBdU16VXdPVGc1UXpBdU16UTFPVGs0SURBdU16VTROREkzSURBdU16Z3pNREl5SURBdU16WXpNamd6SURBdU5ESXdNalV4SURBdU16WTFOVEl5UXpBdU5Ea3pNekUxSURBdU16Y3dOelU0SURBdU5UWTJOelE1SURBdU16WTJOamd4SURBdU5qTTROemcwSURBdU16VXpNemc1UXpBdU5qYzNNVFkzSURBdU16UTNPRFk0SURBdU56RTBNalEySURBdU16TTFORGswSURBdU56UTRNalV4SURBdU16RTJPRFUyVERBdU56RTVPVGcwSURBdU5USTJNVGc0UXpBdU5qVXlOREU0SURBdU5UQXpPVEk0SURBdU5UZzJOREEySURBdU5EYzNNakF6SURBdU5USXlNemcwSURBdU5EUTJNVGc1UXpBdU5URTVOVGMxSURBdU5EUTFNVEUzSURBdU5URTJPRFUySURBdU5EUXpPREkwSURBdU5URTBNalV4SURBdU5EUXlNekl5UXpBdU5URXdOalV4SURBdU5ETTVOalUxSURBdU5URXhOVGcwSURBdU5EUXdPVGc1SURBdU5UQTVPRFV4SURBdU5ETTJPRFUxUXpBdU5UQTJOVEU0SURBdU5ESTVNalUxSURBdU5UQTFOekU0SURBdU5ESXpOVEl5SURBdU5EazROalV4SURBdU5ERTNNalUxUXpBdU5EazBPRE0ySURBdU5ERTBNaUF3TGpRNU1ETXpNaUF3TGpReE1qRXlNeUF3TGpRNE5UVXpNU0F3TGpReE1USXdOVU13TGpRNE1EY3pJREF1TkRFd01qZzNJREF1TkRjMU56YzRJREF1TkRFd05UVTJJREF1TkRjeE1UQTFJREF1TkRFeE9UZzRRekF1TkRZMk5ETXhJREF1TkRFek5ESXhJREF1TkRZeU1UYzVJREF1TkRFMU9UYzBJREF1TkRVNE56RTNJREF1TkRFNU5ESTBRekF1TkRVMU1qVTJJREF1TkRJeU9EYzFJREF1TkRVeU5qa2dNQzQwTWpjeE1Ua2dNQzQwTlRFeU5ESWdNQzQwTXpFM09EaERNQzQwTkRrM09UVWdNQzQwTXpZME5UY2dNQzQwTkRrMU1TQXdMalEwTVRRd09DQXdMalExTURReE15QXdMalEwTmpJeE1rTXdMalExTVRNeE5pQXdMalExTVRBeE5pQXdMalExTXpNM09TQXdMalExTlRVeU5pQXdMalExTmpReU1pQXdMalExT1RNMU1VTXdMalExT1RRMk5pQXdMalEyTXpFM05TQXdMalEyTXpNNU9DQXdMalEyTmpFNU9TQXdMalEyTnpnM05pQXdMalEyT0RFMU4wTXdMalEzTWpNMU5DQXdMalEzTURFeE5pQXdMalEzTnpJME15QXdMalEzTURrMUlEQXVORGd5TVRFNElEQXVORGN3TlRnNVF6QXVORGcyTnpFMElEQXVORFk1T0RJMklEQXVORGt4TVRrMElEQXVORFk0TkRneUlEQXVORGsxTkRVeElEQXVORFkyTlRnNVF6QXVOVEF3TmpVeElEQXVORFkwT1RnNUlEQXVOVEF3TmpVeElEQXVORFkxTWpVMUlEQXVOVEEyTVRFNElEQXVORFkzTnpnNVF6QXVOVGN3T1RZeUlEQXVORGs1TkRBNElEQXVOak0zTnpZMklEQXVOVEkyT0RReUlEQXVOekEyTVRFNElEQXVOVFE1T1RJeVF6QXVOekUyTXpnMElEQXVOVFV6TWpVMUlEQXVOekUyTWpVeElEQXVOVFE1T1RJeUlEQXVOekUyTWpVeElEQXVOVFU0TkRVMVF6QXVOekUxT0RFNElEQXVOVFkwT1RRM0lEQXVOekUwT1RjeUlEQXVOVGN4TkRBMElEQXVOekV6TnpFNElEQXVOVGMzTnpnNFREQXVOekExTVRnMElEQXVOalF4TXpnNFREQXVOamc1TnpFNElEQXVOelUxTXpnNFdrMHdMalE0TXprNE5DQXdMalEwTURBMU5VTXdMalE0TXprNE5DQXdMalEwTXpZMU5TQXdMalEzT0RreE9DQXdMalEwTXpJMU5TQXdMalEzTnpVNE5DQXdMalEwTURrNE9VTXdMalEzTmpJMU1TQXdMalF6T0RjeU1pQXdMalE0TXprNE5DQXdMalF6TkRrNE9TQXdMalE0TXprNE5DQXdMalEwTURBMU5WcE5NQzQzTkRZMk5URWdNQzQxTXpNek9EaE1NQzQzTlRBMk5URWdNQzQxTURNNU1qSkRNQzQzTmpNNU9EUWdNQzQxTVRFMU1qSWdNQzQzT0RZMk5URWdNQzQxTWpJNU9EZ2dNQzQzT1RJMk5URWdNQzQxTXpneE9EaERNQzQzTnprMU9EUWdNQzQxTkRNMU1qSWdNQzQzTlRnNU1UZ2dNQzQxTXpZME5UVWdNQzQzTkRZMk5URWdNQzQxTXpNek9EaGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjd05qY2lJSGt4UFNJeExqSXdOekEySWlCNE1qMGlNUzR5TURjd05pSWdlVEk5SWkwd0xqSXdOekEzTWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RkNOall3UmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5rTkJSVE5GSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l3TGprNU9UazVOU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMjE5IiB5PSIyNTEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPTg2NzAxNjZlLWRjMzYtNGY1Mi1iZWE2LTQ1NDVlOTk5MmM4ODtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1wb3N0Z3Jlc3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWkRNQzQ0TXprMk5qZ2dNQzR6TkRBM056WWdNQzQyT0RjME16TWdNQzQwTVRVNU5UWWdNQzQwT1RrMk5qZ2dNQzQwTVRVNU5UWkRNQzR6TVRFNU1ETWdNQzQwTVRVNU5UWWdNQzR4TlRrMk5qZ2dNQzR6TkRBM056WWdNQzR4TlRrMk5qZ2dNQzR5TkRjNU5UWkRNQzR4TlRrMk5qZ2dNQzR4TlRVeE16WWdNQzR6TVRFNU1ETWdNQzR3TnprNU5UWXhJREF1TkRrNU5qWTRJREF1TURjNU9UVTJNVU13TGpZNE56UXpNeUF3TGpBM09UazFOakVnTUM0NE16azJOamdnTUM0eE5UVXhNellnTUM0NE16azJOamdnTUM0eU5EYzVOVFphVFRBdU9ETTVOalk0SURBdU16YzJNVGd5UXpBdU9ERTRNVGcySURBdU16azBPRFUzSURBdU56azBNamt4SURBdU5ERXdOak16SURBdU56WTROakE0SURBdU5ESXpNRGsyUXpBdU5qazJORFF6SURBdU5EVTROekV5SURBdU5qQXhNekk0SURBdU5EYzRPVFUySURBdU5EazVOalk0SURBdU5EYzRPVFUyUXpBdU16azRNREE0SURBdU5EYzRPVFUySURBdU16QXlPRGt6SURBdU5EVTROekV5SURBdU1qTXdOekk0SURBdU5ESXpNRGsyUXpBdU1qQTFNRFEySURBdU5ERXdOak16SURBdU1UZ3hNVFVnTUM0ek9UUTROVGNnTUM0eE5UazJOamdnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0eE5UazJOamdnTUM0NE5EUTNOellnTUM0ek1URTVNRE1nTUM0NU1UazVOVFlnTUM0ME9UazJOamdnTUM0NU1UazVOVFpETUM0Mk9EYzBNek1nTUM0NU1UazVOVFlnTUM0NE16azJOamdnTUM0NE5EUTNOellnTUM0NE16azJOamdnTUM0M05URTVOVFpXTUM0ek56WXhPREphVFRBdU5UZzBOelkwSURBdU5URTVPVGM0U0RBdU5UZzNNVGc0UXpBdU5qRXlORFE1SURBdU5USXdNVGMzSURBdU5qUXlOVGt4SURBdU5USTNOREUwSURBdU5qWTBPRFkxSURBdU5UVTFPRGsxUXpBdU5qWTNOekF6SURBdU5UVTVOVEUwSURBdU5qWTVPVEkzSURBdU5UWTRNVGMzSURBdU5qWTVOell4SURBdU5UZ3dNVEk0UXpBdU5qWTVOVFl4SURBdU5Ua3lNRGM0SURBdU5qWTNNamc0SURBdU5qQTNNVFkxSURBdU5qWXpNREExSURBdU5qSXpPREV5UXpBdU5qVTFNREExSURBdU5qVTBOek0wSURBdU5qUXdNREF4SURBdU5qa3hJREF1TmpFNU1UZzNJREF1TnpJek56aE1NQzQyTVRjeU9UVWdNQzQzTWpFek9VTXdMall5TlRFMk15QXdMamN3T0RNeU9DQXdMall5TmpZeU15QXdMalk1TlRBeE5pQXdMall5TmpBeU5pQXdMalk0TWpsRE1DNDJNalUzTlRJZ01DNDJOemN6SURBdU5qSTFNVEV6SURBdU5qY3hPVEF6SURBdU5qSTBOVEF6SURBdU5qWTJOelkyUXpBdU5qSXpOekE1SURBdU5qWXdNRGN5SURBdU5qSXlPVFkzSURBdU5qVXpPREU1SURBdU5qSXpNVFUxSURBdU5qUTRNVEk0UXpBdU5qSXpNelEwSURBdU5qUXlNREl5SURBdU5qSTBNVFE0SURBdU5qTTJOamswSURBdU5qSTBPVFEzSURBdU5qTXhOREF5UXpBdU5qSTFPVFl5SURBdU5qSTBOalk1SURBdU5qSTJPVFk0SURBdU5qRTNPVGsxSURBdU5qSTJOamtnTUM0Mk1EazROVFJNTUM0Mk1qWTNPRGtnTUM0Mk1EazJNemhETUM0Mk1qY3dOVFVnTUM0Mk1EZzFNallnTUM0Mk1qY3dNaklnTUM0Mk1EYzROemtnTUM0Mk1qWTVPRGdnTUM0Mk1EY3lORGhETUM0Mk1qWTVNRFVnTUM0Mk1EVTVPRGNnTUM0Mk1qWTJOek1nTUM0Mk1EUTNOelVnTUM0Mk1qWXpNalVnTUM0Mk1ETXpNekZETUM0Mk1qVTJNamdnTUM0Mk1EQTBOaUF3TGpZeU5ETTVPU0F3TGpVNU5qYzFPQ0F3TGpZeU1qVTNOQ0F3TGpVNU1qTTNOME13TGpZeE56YzBOeUF3TGpVNE1EazNJREF1TmpFeE5ESTVJREF1TlRjd01qVTFJREF1TmpBek56ZzFJREF1TlRZd05UQTVRekF1TlRreU56Z3hJREF1TlRRMk5ETTFJREF1TlRjM01UWXpJREF1TlRNeU16STNJREF1TlRVMk5EZ3lJREF1TlRJek1UWTFRekF1TlRZMU56Z3lJREF1TlRJeE1UYzRJREF1TlRjMU1qVTFJREF1TlRJd01URXhJREF1TlRnME56WTBJREF1TlRFNU9UYzRXazB3TGpRMk16TXlJREF1TlRNNU1EZ3lRekF1TkRjek9Ua3hJREF1TlRNd01qQXlJREF1TkRnNE1EWTNJREF1TlRJME1qYzNJREF1TlRBM05qZzFJREF1TlRJME1qSTNWakF1TlRJME1qWklNQzQxTURrMU9UUkRNQzQxTlRFek1pQXdMalV5TkRrME1TQXdMalUzT0RNeU5DQXdMalUwTmpBNE5pQXdMalU1TlRBd05TQXdMalUyTnpReE5FTXdMall3TWpBeU15QXdMalUzTmpNM015QXdMall3Tnpnek15QXdMalU0TmpJeE55QXdMall4TWpJNE15QXdMalU1TmpZNU1rTXdMall4TWprNE9DQXdMalU1T0RNMk5TQXdMall4TXpNMk5pQXdMalU1T1RVNE1TQXdMall4TXpjek9TQXdMall3TURjNE1rTXdMall4TXpnNE5DQXdMall3TVRJME9TQXdMall4TkRBeU9TQXdMall3TVRjeE5DQXdMall4TkRFNU1pQXdMall3TWpJd01rTXdMalU1TkRVd055QXdMall3TURJeE1TQXdMalU0TVRNNU5TQXdMall3TXpjMk15QXdMalUzTXpreU5pQXdMall4TWpNeU4wTXdMalUyTlRRNU5TQXdMall5TVRrM0lEQXVOVFkxT1RjMklEQXVOak0xTmpRM0lEQXVOVFk1TWpZeUlEQXVOalE0T0RVNFF6QXVOVGN5TlRZMUlEQXVOall5TURnMklEQXVOVGM0T1RJeUlEQXVOamMxTmpZeklEQXVOVGcwTnpZMElEQXVOamcyT0RZM1F6QXVOVGczTXpJM0lEQXVOamt4TnpjeklEQXVOVGc1TnpnM0lEQXVOamsyTWpBM0lEQXVOVGt4T0RReklEQXVOams1T1RGTU1DNDFPVEkyT0RFZ01DNDNNREUwTWpOTU1DNDFPVFk1TkRjZ01DNDNNRGswTkVNd0xqVTVPVGN6SURBdU56RTJNREl5SURBdU5qQXpORFUxSURBdU56SXlNVFkySURBdU5qQTRNREF4SURBdU56STNOamhNTUM0Mk1USXdNelFnTUM0M016TXdOelJETUM0Mk1UQTRNak1nTUM0M016TTBNak1nTUM0Mk1Ea3pORFVnTUM0M016TTVNRFFnTUM0Mk1EYzNOamdnTUM0M016UTJNVGhETUM0Mk1EUTJNVFVnTUM0M016WXdORFVnTUM0Mk1EQTVOalFnTUM0M016ZzJPRFFnTUM0MU9UZzJNRFlnTUM0M05ETkRNQzQxT1RZek1UWWdNQzQzTkRjeE9Ua2dNQzQxT1RVeU5UUWdNQzQzTlRJM01Ea2dNQzQxT1RVMU9EWWdNQzQzTlRrNE9FTXdMalU1TkRnMU5TQXdMamMyT1RNNUlEQXVOVGc0T0RFMElEQXVPREU1T1RNZ01DNDFPRFU0TVNBd0xqZ3pOek0xTjBNd0xqVTRNemd3TVNBd0xqZzBPRGs1TWlBd0xqVTRNRFkyTlNBd0xqZzFOalU1TkNBd0xqVTNOVFF4T1NBd0xqZzJNakExTkVNd0xqVTNNREUxT0NBd0xqZzJOelV4TlNBd0xqVTJNakk1TVNBd0xqZzNNVE14TmlBd0xqVTBPVFUwTkNBd0xqZzNOREExTkVNd0xqVXpORGd6T1NBd0xqZzNOekl3T0NBd0xqVXlOamM0T1NBd0xqZzNOREExTkNBd0xqVXlNVEUzT1NBd0xqZzJPVE0wTVVNd0xqVXhOVFUyT1NBd0xqZzJORFl4SURBdU5URXlORFkxSURBdU9EVTNOalUySURBdU5URXdNelF4SURBdU9EVXlNelExUXpBdU5UQTVOamt6SURBdU9EVXdOelV4SURBdU5UQTROamdnTUM0NE5EWXdNemdnTUM0MU1EYzVOamNnTUM0NE16azRORGRETUM0MU1EY3lOVFFnTUM0NE16TTJNemtnTUM0MU1EWTJPRGtnTUM0NE1qVTNOeklnTUM0MU1EWXpNRGdnTUM0NE1UWTRORE5ETUM0MU1EVTFNelFnTUM0M09UWXhOeUF3TGpVd05UUTJNeUF3TGpjM05UUTNPQ0F3TGpVd05qQTVNU0F3TGpjMU5EZ3dNVU13TGpVd05qRXhPQ0F3TGpjMU5EQTRNeUF3TGpVd05qQXdOU0F3TGpjMU16TTJOeUF3TGpVd05UYzFPU0F3TGpjMU1qWTVNME13TGpVd05UVXlOeUF3TGpjMU1UQTFJREF1TlRBMU1USTVJREF1TnpRNU5EVTJJREF1TlRBME5UZ3hJREF1TnpRM09UYzVRekF1TlRBeU5EY3pJREF1TnpReU16TTJJREF1TkRrNE5UY3pJREF1TnpNM016a2dNQzQwT1RJNE9UWWdNQzQzTXpVd016TkRNQzQwT1RFd016Y2dNQzQzTXpReU16WWdNQzQwT0RjNU1UY2dNQzQzTXpJNU1EZ2dNQzQwT0RNNU16TWdNQzQzTXpNeU5Fd3dMalE0TVRjNU1pQXdMamN6TXpZM01rTXdMalE0TXpNeE1pQXdMamN5TnprM0lEQXVORGcxTVRRMklEQXVOekl5TXpVM0lEQXVORGczTWpnM0lEQXVOekUyT0RVNVF6QXVORGc0TVRNMklEQXVOekUwTlRjeklEQXVORGc1TWpBMklEQXVOekV5TVRjMklEQXVORGt3TXpjZ01DNDNNRGsxTmpoRE1DNDBPVFk1TXpJZ01DNDJPVFE0TmpJZ01DNDFNRFkwT0RrZ01DNDJOek0wTkRVZ01DNDBPVFkxTmpVZ01DNDJNamMxTTBNd0xqUTVOREV5TkNBd0xqWXhOakkzTnlBd0xqUTROelF3TXlBd0xqWXdPRGcxT0NBd0xqUTNPVEkzSURBdU5qQTFOekExUXpBdU5EY3hNVE0zSURBdU5qQXlOVFV4SURBdU5EWXlNVFU0SURBdU5qQXpNVFE0SURBdU5EVXpPREkySURBdU5qQTFNRFUzUXpBdU5EUTFORGswSURBdU5qQTJPVGd6SURBdU5ETTNOekVnTUM0Mk1UQXpNRElnTUM0ME16RTNPRFVnTUM0Mk1UTTJNakpNTUM0ME16RTFOamdnTUM0Mk1UTTNOVFZETUM0ME16SXpORGdnTUM0Mk1ETTNNamtnTUM0ME16UXpNak1nTUM0MU9EZzVOVGdnTUM0ME5EQXdPRE1nTUM0MU56TTJPRGhETUM0ME5EUTVNamtnTUM0MU5qQTRNalVnTUM0ME5USXpNVFVnTUM0MU5EZ3lOaUF3TGpRMk16TXlJREF1TlRNNU1EZ3lXazB3TGpNNU1URXpOeUF3TGpVeU5USTNNMHd3TGpNNU56UTBOQ0F3TGpVeU5UQTVUREF1TkRBek56TTBJREF1TlRJMU1qVTJRekF1TkRJek16SWdNQzQxTWpZeU1Ua2dNQzQwTkRFME1URWdNQzQxTXpFek16RWdNQzQwTlRFMk1ESWdNQzQxTXpRMk9ETkRNQzQwTkRFeU1qZ2dNQzQxTkRRNE5ERWdNQzQwTXpRek1EY2dNQzQxTlRjek9Ea2dNQzQwTWprMk5pQXdMalUyT1Rjek9FTXdMalF5TXpFME9TQXdMalU0Tnpjd01pQXdMalF4T1RneU5DQXdMall3TmpZNElEQXVOREU1T0RNMElEQXVOakkxTnpnNFREQXVOREU1T0RVZ01DNDJNalU0T0RkV01DNDJNalU1TjFZd0xqWXlOakk0TmtNd0xqUXhPVGcxSURBdU5qSTNPVEk1SURBdU5ERTVPVGMzSURBdU5qTXdNREUySURBdU5ESXdNVE0xSURBdU5qTXlOakV6UXpBdU5ESXdNekk1SURBdU5qTTFPREV6SURBdU5ESXdOVGNnTUM0Mk16azNPRFlnTUM0ME1qQTJPQ0F3TGpZME5EWTFPVU13TGpReU1EZzNPU0F3TGpZMU16Y3lNU0F3TGpReU1EWTBPQ0F3TGpZMk5URTVJREF1TkRFNE9UTTRJREF1TmpjM05EVTJRekF1TkRFM05URTVJREF1TmpnM01EazJJREF1TkRFNE5UUTVJREF1TmprMk9UTTRJREF1TkRJeE9UTXpJREF1TnpBMk1EYzFRekF1TkRJMU16RTVJREF1TnpFMU1qRXlJREF1TkRNd09UUTVJREF1TnpJek16VWdNQzQwTXpnek1EY2dNQzQzTWprM016aERNQzQwTWpjNU16Z2dNQzQzTkRBM05TQXdMalF4TnpreE9DQXdMamMxTWpBNE5pQXdMalF3T0RJMk5TQXdMamMyTXpjelF6QXVOREF5T1RjZ01DNDNOekF3T0RjZ01DNHpPVGcyTXprZ01DNDNOekl4TmpJZ01DNHpPVFV3TXpjZ01DNDNOekl6TWpoRE1DNHpPVEUwTlRJZ01DNDNOekkwTnpjZ01DNHpPRGMxTURJZ01DNDNOekEzTURFZ01DNHpPREk1TlRRZ01DNDNOall6TURORE1DNHpOek01TWpVZ01DNDNOVGMxTURZZ01DNHpOalEwTVRRZ01DNDNNemc1TVRjZ01DNHpOVFkxTmpRZ01DNDNNVGMxTlRaRE1DNHpORGczTXlBd0xqWTVOakU1TlNBd0xqTTBNakl3TnlBd0xqWTNNakF4TWlBd0xqTXpOell3T1NBd0xqWTFNVFEyTkVNd0xqTXpNams1TlNBd0xqWXpNRGt4TmlBd0xqTXpNRE13TmlBd0xqWXhNell5TWlBd0xqTXlPVGs1TVNBd0xqWXdOelEwTjBNd0xqTXlPRE0yTkNBd0xqVTNORGd6TXlBd0xqTXpOVGd6TkNBd0xqVTFOVEV6TWlBd0xqTTBOekU0TmlBd0xqVTBNekV4TlVNd0xqTTFPRFV5TWlBd0xqVXpNVEE1T0NBd0xqTTNORE0zTXlBd0xqVXlOakl6TlNBd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTFwTk1DNDFPREl6TURnZ01DNDJNVGsyTVRORE1DNDFPRFUyTWpnZ01DNDJNVFU0TVRNZ01DNDFPVEU1TlRFZ01DNDJNVEk1TURnZ01DNDJNRE15TWpFZ01DNDJNVEkzTlRsRE1DNDJNRGN6TWpjZ01DNDJNVEkzTmpFZ01DNDJNVEUwTXlBd0xqWXhNekF5T0NBd0xqWXhOVFV3TXlBd0xqWXhNelUxTlVNd0xqWXhOVE00TkNBd0xqWXhPRGMyT0NBd0xqWXhORFk0TnlBd0xqWXlNelU0TnlBd0xqWXhNemswTWlBd0xqWXlPRGN6TjBNd0xqWXhNekV5TmlBd0xqWXpORE0zTnlBd0xqWXhNakkxTWlBd0xqWTBNRFF4TXlBd0xqWXhNakF4T0NBd0xqWTBOemM1TmtNd0xqWXhNVGMzT1NBd0xqWTFOVEF6TVNBd0xqWXhNalkxTkNBd0xqWTJNakl4TWlBd0xqWXhNelV4T1NBd0xqWTJPVE14TlVNd0xqWXhOREE1T0NBd0xqWTNOREEzTkNBd0xqWXhORFkzTXlBd0xqWTNPRGM1T1NBd0xqWXhORGt3TlNBd0xqWTRNelE0TVVNd0xqWXhOVE0xTkNBd0xqWTVNamt3T0NBd0xqWXhORFUzTXlBd0xqY3dNVGsxTkNBd0xqWXhNREl3T1NBd0xqY3hNVEUyTmtNd0xqWXdPVEUzT1NBd0xqY3dPVE0wSURBdU5qQTRNVFkzSURBdU56QTNNemd4SURBdU5qQTNNalUwSURBdU56QTFNVFUzUXpBdU5qQTJNemMySURBdU56QXpNRE0xSURBdU5qQTFNREEySURBdU56QXdOVGc1SURBdU5qQXpNVFk1SURBdU5qazNNekE1VERBdU5qQXlOREEzSURBdU5qazFPVFEyUXpBdU5qQXdNaUF3TGpZNU1UazNPU0F3TGpVNU56UTJNaUF3TGpZNE56QTVPU0F3TGpVNU5EWTBJREF1TmpneE5qY3lRekF1TlRnNE9UazNJREF1Tmpjd09ETTBJREF1TlRneU9UZzRJREF1TmpVM056ZzRJREF1TlRnd01EZzBJREF1TmpRMk1USkRNQzQxTnpjeE5qTWdNQzQyTXpRME5qZ2dNQzQxTnpjMk1URWdNQzQyTWpVd01EZ2dNQzQxT0RJek1EZ2dNQzQyTVRrMk1UTmFUVEF1TkRVMk16TXlJREF1TmpFMU9EazJRekF1TkRVNU5qZzBJREF1TmpFMU1URXhJREF1TkRZek1URXpJREF1TmpFME5qazVJREF1TkRZMk5UVTNJREF1TmpFME5qWTNRekF1TkRZNU5URTJJREF1TmpFME5qQXlJREF1TkRjeU5EWXpJREF1TmpFMU1EYzBJREF1TkRjMU1qVXpJREF1TmpFMk1EWXhRekF1TkRnd01qTXlJREF1TmpFM09UZzNJREF1TkRnek9EVWdNQzQyTWpFME1EWWdNQzQwT0RVMk56Y2dNQzQyTWprNE56RkRNQzQwT1RRNU1UWWdNQzQyTnpJMk1qSWdNQzQwT0RjME5DQXdMalk0T1RBM015QXdMalE0TURjMk5TQXdMamN3TXpjMU9VTXdMalEzT1RNM01TQXdMamN3TmpneU9DQXdMalEzT0RBeE1TQXdMamN3T1RneUlEQXVORGMyT0RRM0lEQXVOekV5T1RVNFF6QXVORGMwTlRJeklEQXVOekU1TVRneUlEQXVORGN5TVRrNUlEQXVOekkxTURreElEQXVORGN3TnpnNUlEQXVOek13T1RFM1F6QXVORFEyTlRnNUlEQXVOek13T0RnMElEQXVOREkxT1RreUlEQXVOekEzTXpneElEQXVOREk1T1RVNElEQXVOamM0T1RrNVF6QXVORE14TnpnMUlEQXVOalkxT1RNM0lEQXVORE15TURFMklEQXVOalV6T0RjeElEQXVORE14T0RFM0lEQXVOalEwTkRGRE1DNDBNekUyTnpNZ01DNDJNemd4TkRRZ01DNDBNekV6T0NBd0xqWXpNek16TXlBd0xqUXpNVEU1TWlBd0xqWXpNREl6TmtNd0xqUXpNVEV5TVNBd0xqWXlPVEEySURBdU5ETXhNRFkxSURBdU5qSTRNVE14SURBdU5ETXhNRE0zSURBdU5qSTNORFkwVERBdU5ETXhOREF5SURBdU5qSTNNVE15UXpBdU5ETXpNakl4SURBdU5qSTFOekEySURBdU5ETTFNVFU1SURBdU5qSTBORFFnTUM0ME16Y3hPVFVnTUM0Mk1qTXpORGhETUM0ME5ETXlNVFFnTUM0Mk1qQXdNalVnTUM0ME5EazJOVEVnTUM0Mk1UYzFNVGtnTUM0ME5UWXpNeklnTUM0Mk1UVTRPVFphVFRBdU5UazROemc1SURBdU5qRTRNRFV6U0RBdU5UazNPVFpXTUM0Mk1UZ3dNRE5NTUM0MU9UVXpNRFFnTUM0Mk1UZ3lNVGxETUM0MU9USTROalFnTUM0Mk1UZzFPRFFnTUM0MU9UQTNNRFlnTUM0Mk1Ua3lORGdnTUM0MU9Ea3hNVElnTUM0Mk1qQXhORFJETUM0MU9EZ3pOelVnTUM0Mk1qQTFNVElnTUM0MU9EYzNNVFVnTUM0Mk1qRXdNVGtnTUM0MU9EY3hOekVnTUM0Mk1qRTJNemhNTUM0MU9EWTJNRE1nTUM0Mk1qSTJNamhNTUM0MU9EWTBOek1nTUM0Mk1qTTNOak5ETUM0MU9EWTJNaUF3TGpZeU5EVTBPU0F3TGpVNE5qazRNeUF3TGpZeU5USTNPQ0F3TGpVNE56VXlJREF1TmpJMU9EY3hRekF1TlRnM056Z3hJREF1TmpJMk1UZzRJREF1TlRnNE1EWXhJREF1TmpJMk5EZzVJREF1TlRnNE16VTVJREF1TmpJMk56Y3lRekF1TlRnNE56WTRJREF1TmpJM01UWWdNQzQxT0RreU1Ea2dNQzQyTWpjMU1UUWdNQzQxT0RrMk56Y2dNQzQyTWpjNE1qbERNQzQxT1RFMk5UY2dNQzQyTWpreU1pQXdMalU1TkRBNElEQXVOakk1T0RJNUlEQXVOVGsyTkRneUlEQXVOakk1TlRNNVF6QXVOVGs0T1RVZ01DNDJNamt4TVRJZ01DNDJNREV5TURVZ01DNDJNamM0TnpRZ01DNDJNREk0T0RrZ01DNDJNall3TWtNd0xqWXdNek15TVNBd0xqWXlOVFUzTmlBd0xqWXdNemN4TmlBd0xqWXlOVEE1TnlBd0xqWXdOREEyT0NBd0xqWXlORFU0T0VNd0xqWXdORE13TXlBd0xqWXlOREkwT0NBd0xqWXdORFV4T1NBd0xqWXlNemc1TlNBd0xqWXdORGN4TkNBd0xqWXlNelV6UXpBdU5qQTFNVEkxSURBdU5qSXlPRFU0SURBdU5qQTFNekk0SURBdU5qSXlNRGM0SURBdU5qQTFNamsxSURBdU5qSXhNamxNTUM0Mk1EVXpNVElnTUM0Mk1qRXhOVGRNTUM0Mk1EUTRPRE1nTUM0Mk1qQXhNVEpNTUM0Mk1EUXdOamNnTUM0Mk1Ua3pNekZETUM0Mk1ETTNOek1nTUM0Mk1Ua3hNemdnTUM0Mk1ETTBOVEVnTUM0Mk1UZzVOeUF3TGpZd016QTVPU0F3TGpZeE9EZ3lOVU13TGpZd01qWTVOU0F3TGpZeE9EWTFPU0F3TGpZd01qSTFOU0F3TGpZeE9EVXlOU0F3TGpZd01UYzNOeUF3TGpZeE9EUXhPRU13TGpZd01UQTVOaUF3TGpZeE9ESTFNU0F3TGpZd01ETXpOaUF3TGpZeE9ERTBOQ0F3TGpVNU9UVXhPU0F3TGpZeE9EQTRPRU13TGpVNU9USTRJREF1TmpFNE1EY3lJREF1TlRrNU1ETTNJREF1TmpFNE1EWXhJREF1TlRrNE56ZzVJREF1TmpFNE1EVXpXazB3TGpRM01Ea3lNaUF3TGpZeU1UQTFOMHd3TGpRMk9ERTJOaUF3TGpZeU1EZzBNa3d3TGpRMk9ERTBPU0F3TGpZeU1Ea3dPRU13TGpRMk5qUXlOU0F3TGpZeU1EZ3lNU0F3TGpRMk5EWTVPU0F3TGpZeU1UQTBOaUF3TGpRMk16QTFOQ0F3TGpZeU1UVTNNa013TGpRMk1UWXhJREF1TmpJeU1EZzJJREF1TkRZd01UTXpJREF1TmpJek1ERTJJREF1TkRVNU9EZzBJREF1TmpJME9EQTRRekF1TkRVNU56YzRJREF1TmpJMU9ETTJJREF1TkRZd01ERTNJREF1TmpJMk9EY2dNQzQwTmpBMU5qVWdNQzQyTWpjM05EWkRNQzQwTmpFd09EUWdNQzQyTWpnM05ESWdNQzQwTmpFM05ETWdNQzQyTWprMk5Ua2dNQzQwTmpJMU1qTWdNQzQyTXpBME5qaERNQzQwTmpRek5UVWdNQzQyTXpJME56Z2dNQzQwTmpZNE1TQXdMall6TXpneE1TQXdMalEyT1RRNU5DQXdMall6TkRJMU1rTXdMalEzTWpFeE9TQXdMall6TkRVM05TQXdMalEzTkRjM01TQXdMall6TXprd05pQXdMalEzTmpreklEQXVOak15TXpjM1F6QXVORGMzT0RJMElEQXVOak14TnpnZ01DNDBOemcyTWpRZ01DNDJNekV3TlRNZ01DNDBOemt6TURNZ01DNDJNekF5TVRsRE1DNDBOems1TlRZZ01DNDJNamsxTURVZ01DNDBPREF6T0RrZ01DNDJNamcyTVRnZ01DNDBPREExTkRnZ01DNDJNamMyTmpORE1DNDBPREExTnpJZ01DNDJNamMwTWprZ01DNDBPREExTnpRZ01DNDJNamN4T1RRZ01DNDBPREExTlRRZ01DNDJNalk1TmpGRE1DNDBPREExTXpFZ01DNDJNalkyT0RrZ01DNDBPREEwTnpjZ01DNDJNalkwTWlBd0xqUTRNRE01TkNBd0xqWXlOakUxT1VNd0xqUTRNREkwSURBdU5qSTFOamN6SURBdU5EYzVPVGczSURBdU5qSTFNakkxSURBdU5EYzVOalV4SURBdU5qSTBPRFF5UXpBdU5EYzVNRE0xSURBdU5qSTBNVEU1SURBdU5EYzRNamcySURBdU5qSXpOVEl5SURBdU5EYzNORFEwSURBdU5qSXpNRGd5UXpBdU5EYzFOekU0SURBdU5qSXlNRGcySURBdU5EY3pORFl4SURBdU5qSXhOREEySURBdU5EY3dPVEl5SURBdU5qSXhNRFUzV2swd0xqWXhPRFE1SURBdU56UXlOek0wVERBdU5qRTROVFFnTUM0M05ESTNNVGhETUM0Mk1qQXlNRE1nTUM0M05EUXdPU0F3TGpZeU1qQTJJREF1TnpRMU1Ua3lJREF1TmpJME1EVXhJREF1TnpRMk1ESXhRekF1TmpNeU1EWTRJREF1TnpRNU16SXpJREF1TmpRMU1UUTJJREF1TnpVd05qQXlJREF1TmpZNE1qWTJJREF1TnpRMU9ESXhRekF1TmpZek5UWTBJREF1TnpRNU9UVTBJREF1TmpVNE1qa3pJREF1TnpVek16a3hJREF1TmpVeU5qRTJJREF1TnpVMk1ESTVRekF1TmpRMU5qazBJREF1TnpVNU1qUTVJREF1TmpNeU5qWTFJREF1TnpZeE56SXlJREF1TmpJeU1EYzFJREF1TnpZeE9ETTRRekF1TmpFMk56WTBJREF1TnpZeE9USXhJREF1TmpFeUlEQXVOell4TXpVM0lEQXVOakE1TVRZeUlEQXVOell3TkRrMFF6QXVOakE0TWpnM0lEQXVOell3TWpReElEQXVOakEzTkRVM0lEQXVOelU1T0RRNUlEQXVOakEyTnpBM0lEQXVOelU1TXpNeVF6QXVOakEyTkRReElEQXVOelV6TlRjeUlEQXVOakEzTXpNM0lEQXVOelV3TVRnMklEQXVOakE0TXpneUlEQXVOelE0TWpjNFF6QXVOakE1TWpJMklEQXVOelEyTmpRNUlEQXVOakV3TmpNNElEQXVOelExTXpnMUlEQXVOakV5TXpVZ01DNDNORFEzTWpaRE1DNDJNVE15TnpZZ01DNDNORFF6TVRjZ01DNDJNVFF5T1RrZ01DNDNORFF3TWpJZ01DNDJNVFUwTXpVZ01DNDNORE0yT1RWRE1DNDJNVFl6TnpJZ01DNDNORE0wTWpVZ01DNDJNVGN6T0RjZ01DNDNORE14TXpJZ01DNDJNVGcwT1NBd0xqYzBNamN6TkZwTk1DNDBPRFE0T1RjZ01DNDNORFF5TnpoSU1DNDBPRFV5TkRWV01DNDNORFF6TVRGRE1DNDBPRFl3TVRJZ01DNDNORFEwTURZZ01DNDBPRFkzTmpjZ01DNDNORFExT0RJZ01DNDBPRGMwT1RRZ01DNDNORFE0TXpaRE1DNDBPRGM0T0RJZ01DNDNORFE1TnpFZ01DNDBPRGd5TmpFZ01DNDNORFV4TWpnZ01DNDBPRGcyTXpFZ01DNDNORFV6TURkRE1DNDBPVEEwTWpNZ01DNDNORFl3TlRRZ01DNDBPVEk1TmpNZ01DNDNORGczTWpZZ01DNDBPVFF4TWpRZ01DNDNOVEU0TTBNd0xqUTVOVEkzSURBdU56VTBPVE16SURBdU5EazFNVEl4SURBdU56VTNPREl5SURBdU5Ea3pOekkzSURBdU56VTVOemhETUM0ME9EVTJORE1nTUM0M056RXhNVFlnTUM0ME56WXhOallnTUM0M056VTBPREVnTUM0ME5qY3dOVFFnTUM0M056Y3dOREZETUM0ME5UYzVORElnTUM0M056ZzFPRFVnTUM0ME5Ea3lNVElnTUM0M056Y3dOREVnTUM0ME5ETTVJREF1TnpjMU56RTBRekF1TkRReU1ESTFJREF1TnpjMU1qTXlJREF1TkRNNU56QXhJREF1TnpjME16VXpJREF1TkRNM09Ea3lJREF1Tnpjek16VTNRekF1TkRNM01UWXhJREF1TnpjeU9UYzFJREF1TkRNM01qRXlJREF1TnpjeU9EYzJJREF1TkRNMk56TWdNQzQzTnpJME56ZERNQzQwTXpneU1qUWdNQzQzTnpFM05qTWdNQzQwTkRBME5qVWdNQzQzTnpBNE9EUWdNQzQwTkRRek9ESWdNQzQzTnpBd09EZERNQzQwTlRZM05EY2dNQzQzTmpjMU5EZ2dNQzQwTmpJNU16Z2dNQzQzTmpVMU1qTWdNQzQwTmpjM01ERWdNQzQzTmpFM016bERNQzQwTnpBMk1UTWdNQzQzTlRrME1UVWdNQzQwTnpJMU1ERWdNQzQzTlRZNU9UTWdNQzQwTnpRNE5EZ2dNQzQzTlRNNU9ETkRNQzQwTnpZek5ERWdNQzQzTlRJd05qZ2dNQzQwTnpnd01pQXdMamMwT1RreE5TQXdMalE0TURJMk5pQXdMamMwTnpNNU9FTXdMalE0TWpjek9DQXdMamMwTkRZMklEQXVORGcwTURFMklEQXVOelEwTXpZeElEQXVORGcwT0RrM0lEQXVOelEwTWpjNFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIxOSIgeT0iNjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj02MzBmOGQ3Zi1hYjUyLTQ0YzktOTg3NS1lZjljOTc5Y2Q0ZTU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT04NDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZWMyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TURZMk1qZ2dNQzQxTXprNU5UbElNQzQzTXprNU5qRldNQzQxTVRNeU9UTklNQzQ0TURZMk1qaFdNQzR4T1RNeU9UTklNQzQwT0RZMk1qaFdNQzR5TlRrNU5UbElNQzQwTlRrNU5qRldNQzR4T1RNeU9UTkRNQzQwTlRrNU5qRWdNQzR4T0RZeU1pQXdMalEyTWpjM0lEQXVNVGM1TkRNM0lEQXVORFkzTnpjeElEQXVNVGMwTkRNMlF6QXVORGN5TnpjeUlEQXVNVFk1TkRNMUlEQXVORGM1TlRVMUlEQXVNVFkyTmpJMklEQXVORGcyTmpJNElEQXVNVFkyTmpJMlNEQXVPREEyTmpJNFF6QXVPREV6TnlBd0xqRTJOall5TmlBd0xqZ3lNRFE0TXlBd0xqRTJPVFF6TlNBd0xqZ3lOVFE0TkNBd0xqRTNORFF6TmtNd0xqZ3pNRFE0TlNBd0xqRTNPVFF6TnlBd0xqZ3pNekk1TkNBd0xqRTROakl5SURBdU9ETXpNamswSURBdU1Ua3pNamt6VmpBdU5URXpNamt6UXpBdU9ETXpNamswSURBdU5USXdNelkxSURBdU9ETXdORGcxSURBdU5USTNNVFE0SURBdU9ESTFORGcwSURBdU5UTXlNVFE1UXpBdU9ESXdORGd6SURBdU5UTTNNVFVnTUM0NE1UTTNJREF1TlRNNU9UVTVJREF1T0RBMk5qSTRJREF1TlRNNU9UVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXhNekUzSURBdU9ETXpNamswU0RBdU1Ua3pNVGN4UXpBdU1UZzJNRGs0SURBdU9ETXpNamswSURBdU1UYzVNekUxSURBdU9ETXdORGcxSURBdU1UYzBNekUwSURBdU9ESTFORGcwUXpBdU1UWTVNekV6SURBdU9ESXdORGd6SURBdU1UWTJOVEEwSURBdU9ERXpOeUF3TGpFMk5qVXdOQ0F3TGpnd05qWXlOMVl3TGpRNE5qWXlPRU13TGpFMk5qVXdOQ0F3TGpRM09UVTFOU0F3TGpFMk9UTXhNeUF3TGpRM01qYzNNaUF3TGpFM05ETXhOQ0F3TGpRMk56YzNNVU13TGpFM09UTXhOU0F3TGpRMk1qYzNJREF1TVRnMk1EazRJREF1TkRVNU9UWXhJREF1TVRrek1UY3hJREF1TkRVNU9UWXhTREF1TWpVNU9ETTNWakF1TkRnMk5qSTRTREF1TVRrek1UY3hWakF1T0RBMk5qSTNTREF1TlRFek1UZFdNQzQzTXprNU5qRklNQzQxTXprNE16WldNQzQ0TURZMk1qZERNQzQxTXprNE16WWdNQzQ0TVRNM0lEQXVOVE0zTURJM0lEQXVPREl3TkRneklEQXVOVE15TURJMklEQXVPREkxTkRnMFF6QXVOVEkzTURJMUlEQXVPRE13TkRnMUlEQXVOVEl3TWpReUlEQXVPRE16TWprMElEQXVOVEV6TVRjZ01DNDRNek15T1RSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFek1qZzVJREF1TXpjNU9UVTFWakF1TXpVek1qZzRTREF1Tmpjek1qZzVRekF1TmpjeU56UWdNQzR6TkRZek9UZ2dNQzQyTmprM05UUWdNQzR6TXprNU15QXdMalkyTkRnMk55QXdMak16TlRBME0wTXdMalkxT1RrNElEQXVNek13TVRVMklEQXVOalV6TlRFeUlEQXVNekkzTVRjZ01DNDJORFkyTWpJZ01DNHpNalkyTWpGV01DNHlPRFkyTWpGSU1DNDJNVGs1TlRWV01DNHpNalkyTWpGSU1DNDFOems1TlRWV01DNHlPRFkyTWpGSU1DNDFOVE15T0RoV01DNHpNalkyTWpGSU1DNDFNVE15T0RoV01DNHlPRFkyTWpGSU1DNDBPRFkyTWpKV01DNHpNalkyTWpGSU1DNDBORFkyTWpGV01DNHlPRFkyTWpGSU1DNDBNVGs1TlRWV01DNHpNalkyTWpGSU1DNHpOems1TlRWV01DNHlPRFkyTWpGSU1DNHpOVE15T0RoV01DNHpNalkyTWpGRE1DNHpORFl6T1RnZ01DNHpNamN4TnlBd0xqTXpPVGt6SURBdU16TXdNVFUySURBdU16TTFNRFF6SURBdU16TTFNRFF6UXpBdU16TXdNVFUySURBdU16TTVPVE1nTUM0ek1qY3hOeUF3TGpNME5qTTVPQ0F3TGpNeU5qWXlNU0F3TGpNMU16STRPRWd3TGpJNE5qWXlNVll3TGpNM09UazFOVWd3TGpNeU5qWXlNVll3TGpReE9UazFOVWd3TGpJNE5qWXlNVll3TGpRME5qWXlNVWd3TGpNeU5qWXlNVll3TGpRNE5qWXlNa2d3TGpJNE5qWXlNVll3TGpVeE16STRPRWd3TGpNeU5qWXlNVll3TGpVMU16STRPRWd3TGpJNE5qWXlNVll3TGpVM09UazFOVWd3TGpNeU5qWXlNVll3TGpZeE9UazFOVWd3TGpJNE5qWXlNVll3TGpZME5qWXlNa2d3TGpNeU5qWXlNVU13TGpNeU56RTNJREF1TmpVek5URXhJREF1TXpNd01UVTJJREF1TmpVNU9UZ2dNQzR6TXpVd05ETWdNQzQyTmpRNE5qZERNQzR6TXprNU15QXdMalkyT1RjMU5DQXdMak0wTmpNNU9DQXdMalkzTWpjMElEQXVNelV6TWpnNElEQXVOamN6TWpnNVZqQXVOekV6TWpnNVNEQXVNemM1T1RVMVZqQXVOamN6TWpnNVNEQXVOREU1T1RVMVZqQXVOekV6TWpnNVNEQXVORFEyTmpJeFZqQXVOamN6TWpnNVNEQXVORGcyTmpJeVZqQXVOekV6TWpnNVNEQXVOVEV6TWpnNFZqQXVOamN6TWpnNVNEQXVOVFV6TWpnNFZqQXVOekV6TWpnNVNEQXVOVGM1T1RVMVZqQXVOamN6TWpnNVNEQXVOakU1T1RVMVZqQXVOekV6TWpnNVNEQXVOalEyTmpJeVZqQXVOamN6TWpnNVF6QXVOalV6TlRFeUlEQXVOamN5TnpRZ01DNDJOVGs1T0NBd0xqWTJPVGMxTkNBd0xqWTJORGcyTnlBd0xqWTJORGcyTjBNd0xqWTJPVGMxTkNBd0xqWTFPVGs0SURBdU5qY3lOelFnTUM0Mk5UTTFNVEVnTUM0Mk56TXlPRGtnTUM0Mk5EWTJNakpJTUM0M01UTXlPRGxXTUM0Mk1UazVOVFZJTUM0Mk56TXlPRGxXTUM0MU56azVOVFZJTUM0M01UTXlPRGxXTUM0MU5UTXlPRGhJTUM0Mk56TXlPRGxXTUM0MU1UTXlPRGhJTUM0M01UTXlPRGxXTUM0ME9EWTJNakpJTUM0Mk56TXlPRGxXTUM0ME5EWTJNakZJTUM0M01UTXlPRGxXTUM0ME1UazVOVFZJTUM0Mk56TXlPRGxXTUM0ek56azVOVFZJTUM0M01UTXlPRGxhVFRBdU5qUTJOakl5SURBdU5qUTBNakl5UXpBdU5qUTJOakl5SURBdU5qUTBPRFU0SURBdU5qUTJNelk1SURBdU5qUTFORFk1SURBdU5qUTFPVEU1SURBdU5qUTFPVEU1UXpBdU5qUTFORFk1SURBdU5qUTJNelk1SURBdU5qUTBPRFU1SURBdU5qUTJOakl5SURBdU5qUTBNakl5SURBdU5qUTJOakl5U0RBdU16VTFOamc0UXpBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTBORFF4SURBdU5qUTJNelk1SURBdU16VXpPVGt4SURBdU5qUTFPVEU1UXpBdU16VXpOVFF4SURBdU5qUTFORFk1SURBdU16VXpNamc0SURBdU5qUTBPRFU0SURBdU16VXpNamc0SURBdU5qUTBNakl5VmpBdU16VTFOamc0UXpBdU16VXpNamc0SURBdU16VTFNRFV4SURBdU16VXpOVFF4SURBdU16VTBORFF4SURBdU16VXpPVGt4SURBdU16VXpPVGt4UXpBdU16VTBORFF4SURBdU16VXpOVFF4SURBdU16VTFNRFV4SURBdU16VXpNamc0SURBdU16VTFOamc0SURBdU16VXpNamc0U0RBdU5qUTBNakl5UXpBdU5qUTBPRFU1SURBdU16VXpNamc0SURBdU5qUTFORFk1SURBdU16VXpOVFF4SURBdU5qUTFPVEU1SURBdU16VXpPVGt4UXpBdU5qUTJNelk1SURBdU16VTBORFF4SURBdU5qUTJOakl5SURBdU16VTFNRFV4SURBdU5qUTJOakl5SURBdU16VTFOamc0VmpBdU5qUTBNakl5V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnRhZ3M9QXV0b3NjYWxpbmc7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTMiIHk9IjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iQXV0b3NjYWxpbmciIHN0eWxlPSJ0ZXh0O2h0bWw9MTtyZXNpemFibGU9MDtlZGl0YWJsZT0wO2RlbGV0YWJsZT0wO2Nvbm5lY3RhYmxlPTA7cG9pbnRzPVtdO2lyLnR5cGU9Q09NUE9ORU5UX1RBRzthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7IiBwYXJlbnQ9IjEwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTcwIiB5PSItMzgiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJBUEkgLSBJL08gLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPTI0MDkwY2IxLTBjYjYtNDU1ZC05ZDE3LTNjMTFiYTcwODQ4NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI5IiBzb3VyY2U9IjkiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gRUMyIC0gRWxhc3RpYyBDb21wdXRlIENsb3VkIiBzdHlsZT0iaXIucmVmPWNhOWJiMzM2LTVmMGItNDQ2MS1iMTU2LTE2YWVlZWMxNjE0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI5IiBzb3VyY2U9IjEyIiB0YXJnZXQ9IjEwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTMiIHZhbHVlPSJVc2VyIC0gV2ViIFVJIC0+IEFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9YmUxN2QwNTMtYmU3NC00ZGIxLTk1ZjQtMDJhN2ZiYTg2NjNjO2lyLnRhZ3M9TG9naW4gQ3JlZGVudGlhbHM7aXIuYXNzZXRzPVBlcnNvbmFsbHkgSWRlbnRpZmlhYmxlIEluZm9ybWF0aW9uOyIgcGFyZW50PSIxIiBzb3VyY2U9IjUiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItMTE1OSIgeT0iMjM2IiB3aWR0aD0iMzQzIiBoZWlnaHQ9IjIwMiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjgiIHZhbHVlPSJJbnRlcm5hbCBMb2dnaW5nIFNlcnZlciAtPiBTSUVNIFRlYW0iIHN0eWxlPSJpci5yZWY9ZTMxMmVkY2YtZWNmMS00YzczLThmYjQtN2RkOTVlOGIwNmRhO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjE5IiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJJbnRlcm5hbCBMb2dnaW5nIFNlcnZlciIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWludGVybmFsLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE15QXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE15QXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak01TkRZd015QXdMalk1TVRVM09FTXdMak0zT0RjeU5TQXdMalk1TVRVM09DQXdMak0yTlRnMU15QXdMamN3TkRRMUlEQXVNelkxT0RVeklEQXVOekl3TXpJNFF6QXVNelkxT0RVeklEQXVOek0yTWpBMklEQXVNemM0TnpJMUlEQXVOelE1TURjNElEQXVNemswTmpBeklEQXVOelE1TURjNFNEQXVOVGN3TURFNVZqQXVOamt4TlRjNFNEQXVNemswTmpBeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak13TWpFNElEQXVOakU1T1RFeFNEQXVOakF3TURFNVF6QXVOVGc1TWpZeklEQXVOakU1T1RFeElEQXVOVGM1T0RJNUlEQXVOakkxTlRjeUlEQXVOVGMwTlRNeklEQXVOak0wTURjNFNEQXVNemswTmpBelF6QXVNemM0TnpJMUlEQXVOak0wTURjNElEQXVNelkxT0RVeklEQXVOakl4TWpBMklEQXVNelkxT0RVeklEQXVOakExTXpJNFF6QXVNelkxT0RVeklEQXVOVGc1TkRVZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTlNBd0xqWXpOREU0TmlBd0xqWXdOVE15T0VNd0xqWXpOREU0TmlBd0xqWXhNRFkxTVNBd0xqWXpNamMwSURBdU5qRTFOak0ySURBdU5qTXdNakU0SURBdU5qRTVPVEV4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qY3lOVEU1SURBdU5qRTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUzTURBeE9WWXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1UazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16TTBNekVnTUM0Mk5UQXdNalJETUM0Mk1UVXdNakVnTUM0Mk5UQXdNalFnTUM0Mk1EQXdPVGdnTUM0Mk5qUTFOelVnTUM0Mk1EQXdPVGdnTUM0Mk9ESTFNalJXTUM0NE9Ua3hPVEZETUM0Mk1EQXdPVGdnTUM0NU1EVXhOelFnTUM0Mk1EVXdOeklnTUM0NU1UQXdNalFnTUM0Mk1URXlNRGtnTUM0NU1UQXdNalJJTUM0Mk5EUTFOREpXTUM0NE5UVTROVGhETUM0Mk5EUTFORElnTUM0NE5EazROelVnTUM0Mk5EazFNVFlnTUM0NE5EVXdNalFnTUM0Mk5UVTJOVE1nTUM0NE5EVXdNalJJTUM0M05EUTFOREZETUM0M05UQTJOemNnTUM0NE5EVXdNalFnTUM0M05UVTJOVElnTUM0NE5EazROelVnTUM0M05UVTJOVElnTUM0NE5UVTROVGhXTUM0NU1UQXdNalJJTUM0M09EZzVPRFZETUM0M09UVXhNakVnTUM0NU1UQXdNalFnTUM0NE1EQXdPVFlnTUM0NU1EVXhOelFnTUM0NE1EQXdPVFlnTUM0NE9Ua3hPVEZXTUM0M09UQTROVGhETUM0NE1EQXdPVFlnTUM0M056STVNRGtnTUM0M09EVXhOeklnTUM0M05UZ3pOVGdnTUM0M05qWTNOak1nTUM0M05UZ3pOVGhJTUM0M05UVTJOVEpXTUM0Mk9ESTFNalJETUM0M05UVTJOVElnTUM0Mk5qUTFOelVnTUM0M05EQTNNamdnTUM0Mk5UQXdNalFnTUM0M01qSXpNVGtnTUM0Mk5UQXdNalJJTUM0Mk16TTBNekZhVFRBdU5qWTJOelkwSURBdU56QTBNVGt4UXpBdU5qWTJOelkwSURBdU56RXdNVGMwSURBdU5qWXhOemc1SURBdU56RTFNREkwSURBdU5qVTFOalV6SURBdU56RTFNREkwUXpBdU5qUTVOVEUySURBdU56RTFNREkwSURBdU5qUTBOVFF5SURBdU56RXdNVGMwSURBdU5qUTBOVFF5SURBdU56QTBNVGt4UXpBdU5qUTBOVFF5SURBdU5qazRNakE0SURBdU5qUTVOVEUySURBdU5qa3pNelU0SURBdU5qVTFOalV6SURBdU5qa3pNelU0UXpBdU5qWXhOemc1SURBdU5qa3pNelU0SURBdU5qWTJOelkwSURBdU5qazRNakE0SURBdU5qWTJOelkwSURBdU56QTBNVGt4V2swd0xqWTJOamMyTkNBd0xqYzFPRE0xT0VNd0xqWTJOamMyTkNBd0xqYzJORE0wTVNBd0xqWTJNVGM0T1NBd0xqYzJPVEU1TVNBd0xqWTFOVFkxTXlBd0xqYzJPVEU1TVVNd0xqWTBPVFV4TmlBd0xqYzJPVEU1TVNBd0xqWTBORFUwTWlBd0xqYzJORE0wTVNBd0xqWTBORFUwTWlBd0xqYzFPRE0xT0VNd0xqWTBORFUwTWlBd0xqYzFNak0zTlNBd0xqWTBPVFV4TmlBd0xqYzBOelV5TkNBd0xqWTFOVFkxTXlBd0xqYzBOelV5TkVNd0xqWTJNVGM0T1NBd0xqYzBOelV5TkNBd0xqWTJOamMyTkNBd0xqYzFNak0zTlNBd0xqWTJOamMyTkNBd0xqYzFPRE0xT0ZwTk1DNDJOalkzTmpRZ01DNDRNVEkxTWpSRE1DNDJOalkzTmpRZ01DNDRNVGcxTURnZ01DNDJOakUzT0RrZ01DNDRNak16TlRnZ01DNDJOVFUyTlRNZ01DNDRNak16TlRoRE1DNDJORGsxTVRZZ01DNDRNak16TlRnZ01DNDJORFExTkRJZ01DNDRNVGcxTURnZ01DNDJORFExTkRJZ01DNDRNVEkxTWpSRE1DNDJORFExTkRJZ01DNDRNRFkxTkRFZ01DNDJORGsxTVRZZ01DNDRNREUyT1RFZ01DNDJOVFUyTlRNZ01DNDRNREUyT1RGRE1DNDJOakUzT0RrZ01DNDRNREUyT1RFZ01DNDJOalkzTmpRZ01DNDRNRFkxTkRFZ01DNDJOalkzTmpRZ01DNDRNVEkxTWpSYVRUQXVOekV4TWpBNElEQXVOekEwTVRreFF6QXVOekV4TWpBNElEQXVOekV3TVRjMElEQXVOekEyTWpNeklEQXVOekUxTURJMElEQXVOekF3TURrM0lEQXVOekUxTURJMFF6QXVOamt6T1RZZ01DNDNNVFV3TWpRZ01DNDJPRGc1T0RZZ01DNDNNVEF4TnpRZ01DNDJPRGc1T0RZZ01DNDNNRFF4T1RGRE1DNDJPRGc1T0RZZ01DNDJPVGd5TURnZ01DNDJPVE01TmlBd0xqWTVNek0xT0NBd0xqY3dNREE1TnlBd0xqWTVNek0xT0VNd0xqY3dOakl6TXlBd0xqWTVNek0xT0NBd0xqY3hNVEl3T0NBd0xqWTVPREl3T0NBd0xqY3hNVEl3T0NBd0xqY3dOREU1TVZwTk1DNDNNVEV5TURnZ01DNDNOVGd6TlRoRE1DNDNNVEV5TURnZ01DNDNOalF6TkRFZ01DNDNNRFl5TXpNZ01DNDNOamt4T1RFZ01DNDNNREF3T1RjZ01DNDNOamt4T1RGRE1DNDJPVE01TmlBd0xqYzJPVEU1TVNBd0xqWTRPRGs0TmlBd0xqYzJORE0wTVNBd0xqWTRPRGs0TmlBd0xqYzFPRE0xT0VNd0xqWTRPRGs0TmlBd0xqYzFNak0zTlNBd0xqWTVNemsySURBdU56UTNOVEkwSURBdU56QXdNRGszSURBdU56UTNOVEkwUXpBdU56QTJNak16SURBdU56UTNOVEkwSURBdU56RXhNakE0SURBdU56VXlNemMxSURBdU56RXhNakE0SURBdU56VTRNelU0V2swd0xqY3hNVEl3T0NBd0xqZ3hNalV5TkVNd0xqY3hNVEl3T0NBd0xqZ3hPRFV3T0NBd0xqY3dOakl6TXlBd0xqZ3lNek0xT0NBd0xqY3dNREE1TnlBd0xqZ3lNek0xT0VNd0xqWTVNemsySURBdU9ESXpNelU0SURBdU5qZzRPVGcySURBdU9ERTROVEE0SURBdU5qZzRPVGcySURBdU9ERXlOVEkwUXpBdU5qZzRPVGcySURBdU9EQTJOVFF4SURBdU5qa3pPVFlnTUM0NE1ERTJPVEVnTUM0M01EQXdPVGNnTUM0NE1ERTJPVEZETUM0M01EWXlNek1nTUM0NE1ERTJPVEVnTUM0M01URXlNRGdnTUM0NE1EWTFOREVnTUM0M01URXlNRGdnTUM0NE1USTFNalJhVFRBdU56VTFOalV5SURBdU9ERXlOVEkwUXpBdU56VTFOalV5SURBdU9ERTROVEE0SURBdU56VXdOamMzSURBdU9ESXpNelU0SURBdU56UTBOVFF4SURBdU9ESXpNelU0UXpBdU56TTROREEwSURBdU9ESXpNelU0SURBdU56TXpORE1nTUM0NE1UZzFNRGdnTUM0M016TTBNeUF3TGpneE1qVXlORU13TGpjek16UXpJREF1T0RBMk5UUXhJREF1TnpNNE5EQTBJREF1T0RBeE5qa3hJREF1TnpRME5UUXhJREF1T0RBeE5qa3hRekF1TnpVd05qYzNJREF1T0RBeE5qa3hJREF1TnpVMU5qVXlJREF1T0RBMk5UUXhJREF1TnpVMU5qVXlJREF1T0RFeU5USTBXazB3TGpjek16UXpJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TnpFeE1qWTBWakF1T1RFd01ESTBTREF1TnpNek5ETmFUVEF1TmpnNU1EUXlJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TmpZMk56WTBWakF1T1RFd01ESTBTREF1TmpnNU1EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1kYTU4ZjQ3My0wOTgzLTRhMzUtYWVkOC1lOWZjMGQ2ZjRkZGU7IiBwYXJlbnQ9IjE5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIwOC41IiB5PSI0NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IlNJRU0gVGVhbSIgc3R5bGU9ImlyLnJlZj1iMzM1MjA4Zi0yZWMzLTQ2NmYtYWI3Ni01MWY5ZGE1OTA0MDY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z2VuZXJpYy1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHlOVFl6TXpjZ01DNDJPVFF5T1RKRE1DNHlOREUwTnlBd0xqWTVOREk1TWlBd0xqSXlOemc0TmlBd0xqWTRPRGd3TXlBd0xqSXhOelV3TWlBd0xqWTNPVGMwTTBNd0xqSXhNVGt4SURBdU5qYzBPRFkwSURBdU1qQTNNalEySURBdU5qWTRPVFE1SURBdU1qQXpPREVnTUM0Mk5qSXlPVGhETUM0eE9UazJNalFnTUM0Mk5UUXhPVFVnTUM0eE9UY3lOakVnTUM0Mk5EUTVPVGtnTUM0eE9UY3lOakVnTUM0Mk16VXlOVEZXTUM0eU9ERXhOamhETUM0eE9UY3lOakVnTUM0eU5EZzFOaUF3TGpJeU16Y3hJREF1TWpJeU1USTNJREF1TWpVMk16TTNJREF1TWpJeU1USTNUREF1TmpNME5EUTNJREF1TWpJeU1USTNUREF1TlRrMU5qQTNJREF1TVRZek1EZzJUREF1TWpVMk16TTNJREF1TVRZek1EZzJRekF1TVRreE1EZ3pJREF1TVRZek1EZzJJREF1TVRNNE1UZzBJREF1TWpFMU9UVXpJREF1TVRNNE1UZzBJREF1TWpneE1UWTRWakF1TmpNMU1qVXhRekF1TVRNNE1UZzBJREF1TmpRNE16Y3pJREF1TVRRd016STJJREF1TmpZd09UazJJREF1TVRRME1qYzVJREF1TmpjeU56ZzVRekF1TVRVd01UUTVJREF1Tmprd01qazRJREF1TVRZd01ERXpJREF1TnpBMU9UYzRJREF1TVRjeU56a2dNQzQzTVRnM05EZERNQzR4T1RReE56SWdNQzQzTkRBeE1UWWdNQzR5TWpNM01TQXdMamMxTXpNek15QXdMakkxTmpNek55QXdMamMxTXpNek0wZ3dMak0zTkRjNE4xWXdMamd4TXpBd05Vd3dMakk0TmpJeU9TQXdMamd4TXpBd05VTXdMakkyT1RreE5pQXdMamd4TXpBd05pQXdMakkxTmpZNU1TQXdMamd5TmpJeU1pQXdMakkxTmpZNU1TQXdMamcwTWpVeU5rTXdMakkxTmpZNU1TQXdMamcxT0RneklEQXVNalk1T1RFMklEQXVPRGN5TURRMklEQXVNamcyTWpNZ01DNDROekl3TkRaTU1DNDJPVGsxTkNBd0xqZzNNakEwTTBNd0xqY3hOVGcxTkNBd0xqZzNNakEwTXlBd0xqY3lPVEEzT1NBd0xqZzFPRGd5TmlBd0xqY3lPVEEzT1NBd0xqZzBNalV5TWtNd0xqY3lPVEEzT0NBd0xqZ3lOakl4T1NBd0xqY3hOVGcxTXlBd0xqZ3hNekF3TWlBd0xqWTVPVFUwSURBdU9ERXpNREF5VERBdU5qRXdPVGN5SURBdU9ERXpNREF6VmpBdU56VXpNek16U0RBdU56STRPVFV6UXpBdU56UXlPRFV6SURBdU56VXpNek16SURBdU56VTJNVGt6SURBdU56VXdPVE0wSURBdU56WTROVGdnTUM0M05EWTFNamRETUM0NE1EY3dOelVnTUM0M016STRNelVnTUM0NE16WXpOekVnTUM0Mk9UazNOVGNnTUM0NE5EUTNNRFlnTUM0Mk5Ua3dORGxETUM0NE5EWXlPQ0F3TGpZMU1UTTJNaUF3TGpnME56RXdOeUF3TGpZME16UXdNeUF3TGpnME56RXdOeUF3TGpZek5USTFNVll3TGpJNE1URTJOME13TGpnME56RXdOeUF3TGpJeE5UazFNeUF3TGpjNU5ESXdOeUF3TGpFMk16QTROaUF3TGpjeU9EazFNeUF3TGpFMk16QTROa2d3TGpVNU5UWXdOMHd3TGpZek5EUTBOeUF3TGpJeU1qRXlOMGd3TGpjeU9EazFNME13TGpjMk1UVTRJREF1TWpJeU1USTNJREF1TnpnNE1ETWdNQzR5TkRnMU5pQXdMamM0T0RBeklEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVOemc0TURNZ01DNDJORFE1T1RrZ01DNDNPRFUyTmpZZ01DNDJOVFF4T1RVZ01DNDNPREUwT0NBd0xqWTJNakk1T0VNd0xqYzNOREk0T1NBd0xqWTNOakl4T0NBd0xqYzJNVGN5TVNBd0xqWTROamt4TXlBd0xqYzBOalV5TVNBd0xqWTVNVFl6TjBNd0xqYzBNRGszTVNBd0xqWTVNek0yTWlBd0xqY3pOVEEzTVNBd0xqWTVOREk1TWlBd0xqY3lPRGsxTXlBd0xqWTVOREk1TWtnd0xqSTFOak16TjFwTk1DNDBNek00TmpRZ01DNDRNVE13TURSTU1DNDFOVEU0T1RVZ01DNDRNVE13TUROV01DNDNOVE16TXpOSU1DNDBNek00TmpSV01DNDRNVE13TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TURBeU5EUXhOREVnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjE5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQyIiB5PSI0NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IkNsb3VkV2F0Y2ggLT4gSW50ZXJuYWwgTG9nZ2luZyBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTUzYmEyZDQ3LWNmMTctNGFiZC04NzM2LTQyMGJlODBlODY0Mztpci50YWdzPUFsZXJ0czsiIHBhcmVudD0iMSIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iVGhpcyBUaHJlYXQgTW9kZWwgY292ZXJzIGEgaG9zdGVkIGFwcGxpY2F0aW9uLCB0aGF0IGEgdXNlciBhY2Nlc3NlcyB2aWEuIGEgVUkuICZsdDticj4mbHQ7YnI+QSBTSUVNIHRlYW0gKG9uLXByZW1pc2UpIGlzIGFibGUgdG8gbW9uaXRvciB0aGUgaGVhbHRoIG9mIHRoZSBhcHBsaWNhdGlvbiB2aWEuIHRoZSBDbG91ZHdhdGNoIHNlcnZpY2UuIiBzdHlsZT0ic2hhcGU9bm90ZTtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE0O3NpemU9MjA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmaWxsQ29sb3I9I2ZmZjJjYztzdHJva2VDb2xvcj0jZDZiNjU2O2ZvbnRDb2xvcj0jNjY2NjAwOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0xMjk1IiB5PSItODgiIHdpZHRoPSIxOTMiIGhlaWdodD0iMTY1IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMTE3NyIgeT0iLTcyMiIgd2lkdGg9IjE0NSIgaGVpZ2h0PSIxNTEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiB2YWx1ZT0iVXNlciIgc3R5bGU9ImlyLnJlZj0wOGFlMjQxZi0wNGViLTRkZDYtYjYxYS1mMGM1NjAwOTJiODc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW5kLXVzZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpNalkwTkRnZ01DNHpOREU1TXpORE1DNHpNalkwTkRnZ01DNHlOVFU0TXpNZ01DNHpPVFl5TkRZZ01DNHhPRFl3TXpVZ01DNDBPREl6TkRZZ01DNHhPRFl3TXpWRE1DNDFOamcwTkRZZ01DNHhPRFl3TXpVZ01DNDJNemd5TkRRZ01DNHlOVFU0TXpNZ01DNDJNemd5TkRRZ01DNHpOREU1TXpORE1DNDJNemd5TkRRZ01DNDBNamd3TXpJZ01DNDFOamcwTkRZZ01DNDBPVGM0TXlBd0xqUTRNak0wTmlBd0xqUTVOemd6UXpBdU16azJNalEySURBdU5EazNPRE1nTUM0ek1qWTBORGdnTUM0ME1qZ3dNeklnTUM0ek1qWTBORGdnTUM0ek5ERTVNek5hVFRBdU5EZ3lNelEySURBdU1qSTFNREE1UXpBdU5ERTNOemN4SURBdU1qSTFNREE1SURBdU16WTFOREl6SURBdU1qYzNNelU0SURBdU16WTFOREl6SURBdU16UXhPVE16UXpBdU16WTFOREl6SURBdU5EQTJOVEEzSURBdU5ERTNOemN4SURBdU5EVTRPRFUySURBdU5EZ3lNelEySURBdU5EVTRPRFUyUXpBdU5UUTJPVEl4SURBdU5EVTRPRFUySURBdU5UazVNalk1SURBdU5EQTJOVEEzSURBdU5UazVNalk1SURBdU16UXhPVE16UXpBdU5UazVNalk1SURBdU1qYzNNelU0SURBdU5UUTJPVEl4SURBdU1qSTFNREE1SURBdU5EZ3lNelEySURBdU1qSTFNREE1V2swd0xqSXpNamt4SURBdU5qSTJOREk0UXpBdU1qTXlPVEV4SURBdU5UZzVPREk1SURBdU1qWXlOVGd4SURBdU5UWXdNVGc1SURBdU1qazVNVFkxSURBdU5UWXdNVGc1U0RBdU5qWTFOVEk1UXpBdU5qZzRPRFV6SURBdU5UWXdNVGc1SURBdU56QTVNelk0SURBdU5UY3lNak0zSURBdU56SXhNVGMwSURBdU5Ua3dORFUyUXpBdU56QTVNalV5SURBdU5UZzNPRFEzSURBdU5qazJPRFk0SURBdU5UZzJORGN5SURBdU5qZzBNVFl6SURBdU5UZzJORGN5UXpBdU5qWXhNVFUySURBdU5UZzJORGN5SURBdU5qTTVNakEwSURBdU5Ua3dPVGd4SURBdU5qRTVNVE01SURBdU5UazVNVFl6U0RBdU1qazVNVFkxUXpBdU1qZzBNRGt4SURBdU5UazVNVFl6SURBdU1qY3hPRGcwSURBdU5qRXhNemNnTUM0eU56RTRPRFFnTUM0Mk1qWTBNamhXTUM0Mk16Z3hNemRETUM0eU56RTRPRFFnTUM0Mk9EQTVNak1nTUM0eU9UTXdPU0F3TGpjeE16QTVOQ0F3TGpNeU9UZzRNU0F3TGpjek5UUTVNa013TGpNMk56UTBOU0F3TGpjMU9ETTJNU0F3TGpReU1UQTBNeUF3TGpjM01EWTFJREF1TkRneU16UTJJREF1Tnpjd05qVkRNQzQwT1RJMU1Ua2dNQzQzTnpBMk5TQXdMalV3TWpRNE1TQXdMamMzTURNeE1pQXdMalV4TWpFNU1pQXdMamMyT1RZME0wTXdMalV4TXpBeU1TQXdMamM0TWprMk55QXdMalV4TlRNMk5TQXdMamM1TlRnNE1pQXdMalV4T1RBMU1pQXdMamd3T0RJeE5rTXdMalV3TnpBeU1pQXdMamd3T1RFMU9TQXdMalE1TkRjMk1TQXdMamd3T1RZeU5TQXdMalE0TWpNME5pQXdMamd3T1RZeU5VTXdMalF4TmpZMU1pQXdMamd3T1RZeU5TQXdMak0xTlRJM05TQXdMamM1TmpVNE1TQXdMak13T1RZeE5DQXdMamMyT0RjNE0wTXdMakkyTXpFNElEQXVOelF3TlRFMElEQXVNak15T1RFZ01DNDJPVFkyT0RZZ01DNHlNekk1TVNBd0xqWXpPREV6TjFZd0xqWXlOalF5T0ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzROREF4TXlBd0xqY3dOVGsyTjB3d0xqYzRNRGs1TVNBd0xqY3dORGc1TWt3d0xqYzFOVFEwSURBdU5qVTJPVGcwUXpBdU56UTFOall5SURBdU5qTTROalVnTUM0M01qWTFOelFnTUM0Mk1qY3hPVGNnTUM0M01EVTNPVFVnTUM0Mk1qY3hPVGRJTUM0Mk5ERTBOak5ETUM0Mk1UY3lORFVnTUM0Mk1qY3hPVGNnTUM0MU9UVTNORFVnTUM0Mk5ESTJPVFFnTUM0MU9EZ3dPRFlnTUM0Mk5qVTJOamxNTUM0MU56VTVNRGtnTUM0M01ESXlNREpETUM0MU5UVXpPU0F3TGpjeE1EZzBNeUF3TGpVME1UVXdOQ0F3TGpjek1UQTNPU0F3TGpVME1UVXdOQ0F3TGpjMU5EQTFNVll3TGpjM09URXhNVU13TGpVME1UVXdOQ0F3TGpjNU5UQTROQ0F3TGpVMU1UQXhNeUF3TGpnd09EZ3pOaUF3TGpVMk5EWTNPQ0F3TGpneE5UQXhOa013TGpVMk9ETTJNU0F3TGpnek5qRTNJREF1TlRnMk9ERXlJREF1T0RVeU1qVTBJREF1TmpBNU1ESXhJREF1T0RVeU1qVTBRekF1TmpJNU9UazBJREF1T0RVeU1qVTBJREF1TmpRM05qRTNJREF1T0RNM09UQTVJREF1TmpVeU5qRTBJREF1T0RFNE5EazJTREF1TnpRMU5EY3pRekF1TnpVd05EWTVJREF1T0RNM09UQTVJREF1TnpZNE1Ea3pJREF1T0RVeU1qVTBJREF1TnpnNU1EWTJJREF1T0RVeU1qVTBRekF1T0RFeE1qYzBJREF1T0RVeU1qVTBJREF1T0RJNU56STJJREF1T0RNMk1UY2dNQzQ0TXpNME1Ea2dNQzQ0TVRVd01UWkRNQzQ0TkRjd056UWdNQzQ0TURnNE16WWdNQzQ0TlRZMU9ETWdNQzQzT1RVd09EUWdNQzQ0TlRZMU9ETWdNQzQzTnpreE1URldNQzQzTnpFME9EZERNQzQ0TlRZMU9ETWdNQzQzTkRjMk9EUWdNQzQ0TkRFMk1EUWdNQzQzTWpZME5UWWdNQzQ0TVRreE56Z2dNQzQzTVRnME56aE1NQzQzT0RVeE9UZ2dNQzQzTURZek9EbFdNQzQzTURVNU5qZElNQzQzT0RRd01UTmFUVEF1TmpBNU5ETTNJREF1TmpjeU56ZzJRekF1TmpFME1ETXlJREF1TmpVNU1EQXhJREF1TmpJMk9UTXlJREF1TmpRNU56QXpJREF1TmpReE5EWXpJREF1TmpRNU56QXpTREF1TmpZMU1qZzFWakF1TnpBMU9UWTNTREF1TlRrNE16YzNUREF1TmpBNU5ETTNJREF1TmpjeU56ZzJXazB3TGpjMU5qQTFPQ0F3TGpjd05UazJOMGd3TGpZNE56YzVNVll3TGpZME9UY3dNMGd3TGpjd05UYzVOVU13TGpjeE9ESTJNeUF3TGpZME9UY3dNeUF3TGpjeU9UY3hOU0F3TGpZMU5qVTNOQ0F3TGpjek5UVTRNaUF3TGpZMk56VTNOVXd3TGpjMU5qQTFPQ0F3TGpjd05UazJOMXBOTUM0MU9EWTFNVFVnTUM0NE1EY3lORE5ETUM0MU9EWTFNVFVnTUM0M09UUTRNVE1nTUM0MU9UWTFPVEVnTUM0M09EUTNNemNnTUM0Mk1Ea3dNakVnTUM0M09EUTNNemRETUM0Mk1qRTBOU0F3TGpjNE5EY3pOeUF3TGpZek1UVXlOaUF3TGpjNU5EZ3hNeUF3TGpZek1UVXlOaUF3TGpnd056STBNME13TGpZek1UVXlOaUF3TGpneE9UWTNNaUF3TGpZeU1UUTFJREF1T0RJNU56UTVJREF1TmpBNU1ESXhJREF1T0RJNU56UTVRekF1TlRrMk5Ua3hJREF1T0RJNU56UTVJREF1TlRnMk5URTFJREF1T0RFNU5qY3lJREF1TlRnMk5URTFJREF1T0RBM01qUXpXazB3TGpjNE9UQTJOaUF3TGpjNE5EY3pOME13TGpnd01UUTVOaUF3TGpjNE5EY3pOeUF3TGpneE1UVTNNaUF3TGpjNU5EZ3hNeUF3TGpneE1UVTNNaUF3TGpnd056STBNME13TGpneE1UVTNNaUF3TGpneE9UWTNNaUF3TGpnd01UUTVOaUF3TGpneU9UYzBPU0F3TGpjNE9UQTJOaUF3TGpneU9UYzBPVU13TGpjM05qWXpOaUF3TGpneU9UYzBPU0F3TGpjMk5qVTJJREF1T0RFNU5qY3lJREF1TnpZMk5UWWdNQzQ0TURjeU5ETkRNQzQzTmpZMU5pQXdMamM1TkRneE15QXdMamMzTmpZek5pQXdMamM0TkRjek55QXdMamM0T1RBMk5pQXdMamM0TkRjek4xb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0M05qZ2lJR2hsYVdkb2REMGlNQzQzTmpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPRE01T0NBd0xqRXlNelkxTnlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNDgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjcuNSIgeT0iMzAuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OSIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTg2MyIgeT0iLTg4OCIgd2lkdGg9IjY3MyIgaGVpZ2h0PSI1MDgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYwIiB2YWx1ZT0iQVdTIENsb3VkRnJvbnQgLT4gQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9ODE0N2YyMTAtNjgyMy00Y2ZjLWIwOTQtMmQ5YmU4MTY3YmE0O2lyLnRhZ3M9aHR0cHM6IDQ0MzsiIHBhcmVudD0iNDkiIHNvdXJjZT0iNTEiIHRhcmdldD0iNTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MSIgdmFsdWU9IkFXUyBDbG91ZEZyb250IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Y2YtY2xvdWRmcm9udDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1UVXlOVFVnTUM0NE1EZzROak5NTUM0MU9URTFNakVnTUM0M09UWTFPVGRETUM0Mk1EUXhOamtnTUM0M056STFORFFnTUM0Mk1UUXpNVEVnTUM0M05EY3lOVFlnTUM0Mk1qRTNPRGdnTUM0M01qRXhNMHd3TGpZME56TTRPQ0F3TGpjeU9EVTVOME13TGpZek9UUXlPQ0F3TGpjMU5qTTNNeUF3TGpZeU9EWTJNaUF3TGpjNE16STJOeUF3TGpZeE5USTFOU0F3TGpnd09EZzJNMVl3TGpnd09EZzJNMXBOTUM0Mk5EQXdOVFVnTUM0MU5qUTNNME13TGpZek5UUTBNaUF3TGpRNU1EQTNNU0F3TGpZeE1USXdNeUF3TGpReE56azFNeUF3TGpVMk9UYzRPQ0F3TGpNMU5UWTJNMHd3TGpVNU1qQTFOU0F3TGpNME1URXpRekF1TmpNMk1EWTVJREF1TkRBM01qVTVJREF1TmpZeE9ESTNJREF1TkRnek9EUTBJREF1TmpZMk56SXhJREF1TlRZek1UTk1NQzQyTkRBd05UVWdNQzQxTmpRM00xcE5NQzQwTmpReE9EZ2dNQzR5TkRJNU9UWkRNQzQwTkRRNE16Y2dNQzR5TWpnMU5EVWdNQzQwTWpReU1Ua2dNQzR5TVRVNE56SWdNQzQwTURJMU9EZ2dNQzR5TURVeE0wd3dMalF4TkRjeU1TQXdMakU0TVRNNU5rTXdMalF6TnpjME9DQXdMakU1TWpjeU5pQXdMalExT1Rjd05DQXdMakl3TmpFeE5DQXdMalE0TURNeU1TQXdMakl5TVRNNU4wd3dMalEyTkRFNE9DQXdMakkwTWprNU5sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56TXlOU0F3TGpVNU9EWTBOME13TGpVek1URTJOQ0F3TGpVMU5qZzBOeUF3TGpRNE1ESTROQ0F3TGpVeU5EazJNaUF3TGpReU5ETXhOaUF3TGpVd05UTXhORXd3TGpRek1qVTRNeUF3TGpRM09UazRRekF1TkRreU1Ua2dNQzQxTURBNU1ESWdNQzQxTkRZek9URWdNQzQxTXpRNE16UWdNQzQxT1RFeU5TQXdMalUzT1RNeE5Fd3dMalUzTXpJMUlEQXVOVGs0TmpRM1dpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZNE16RTNNU0F3TGpjMU56ZzNORU13TGpZM09ESXpOeUF3TGpjME5EVTBNU0F3TGpZM01qWXpOeUF3TGpjek1qSTNOQ0F3TGpZMk5qVXdOQ0F3TGpjeE9UZzNORXd3TGpZNU1ETTNNU0F3TGpjd09EQXdPRU13TGpZNU5qazBOeUF3TGpjeU1UQXpOaUF3TGpjd01qZzJOaUF3TGpjek5ETTROaUF3TGpjd09ERXdOQ0F3TGpjME9EQXdPRXd3TGpZNE16RTNNU0F3TGpjMU56ZzNORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNRGMyTlRRZ01DNDRNVFV5TXpKTU1DNDFPVGt4TWpFZ01DNDNPVEF3TXpKRE1DNDJNekV3TmpNZ01DNDNOemt5TmpjZ01DNDJOakE1TlRJZ01DNDNOak14TnpNZ01DNDJPRGMxTWpFZ01DNDNOREkwTXpKTU1DNDNNRE01TWpFZ01DNDNOak0wT1RoRE1DNDJOelE1T0RRZ01DNDNPRFl3TlRZZ01DNDJOREkwTXpVZ01DNDRNRE0xTkRnZ01DNDJNRGMyTlRRZ01DNDRNVFV5TXpKV01DNDRNVFV5TXpKYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TVRnek9EWTRJREF1TkRrek0wd3dMakUzTnpjek5DQXdMalEyTnpRek0wTXdMakl3TnpJNU9TQXdMalEyTURFNU1pQXdMakl6TnpVMk9TQXdMalExTmpJeE15QXdMakkyT0RBd01TQXdMalExTlRVMk5rd3dMakkyT0RZMk9DQXdMalE0TWpJek0wTXdMakkwTURBNE1pQXdMalE0TWpneE9DQXdMakl4TVRZME5pQXdMalE0TmpVeU9TQXdMakU0TXpnMk9DQXdMalE1TXpOV01DNDBPVE16V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF3TWpJNE15QXdMalF3T0RRMlREQXVNemM1T0RneklEQXVNemt6T1RJM1F6QXVNems1TkRVMUlEQXVNell5TVRNNUlEQXVOREl6TlRjNElEQXVNek16TXprZ01DNDBOVEUwT0RNZ01DNHpNRGcxT1RSTU1DNDBOamt3T0RNZ01DNHpNamczTWpkRE1DNDBORE13TWpRZ01DNHpOVEU0T0RNZ01DNDBNakExTVRZZ01DNHpOemczTkRrZ01DNDBNREl5T0RNZ01DNDBNRGcwTmxZd0xqUXdPRFEyV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TURZeE9TQXdMakkxTURRelREQXVOVGt4TlRVeklEQXVNakkxTXpZMFF6QXVOakV4TmpJeUlEQXVNakUzT0RRZ01DNDJNekl5TmpjZ01DNHlNVEU1TlRRZ01DNDJOVE15T0RZZ01DNHlNRGMzTmpSTU1DNDJOVGd5TVRrZ01DNHlNelEwTTBNd0xqWXpPRFl3T0NBd0xqSXpPREUxTWlBd0xqWXhPVE0wTVNBd0xqSTBNelV3TXlBd0xqWXdNRFl4T1NBd0xqSTFNRFF6VmpBdU1qVXdORE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNek0yTnpVM0lEQXVOemcyTmpWRE1DNHpNVFE1TmpZZ01DNDNNell3TnpVZ01DNHpNRE16TWpNZ01DNDJPREUzTVRNZ01DNHpNREkwT1NBd0xqWXlOalkxUXpBdU16QXlPVE15SURBdU5qQTFORE15SURBdU16QTFOekEwSURBdU5UZzBNekk0SURBdU16RXdOelUzSURBdU5UWXpOekUyUXpBdU16RXhOamtnTUM0MU5Ua3dOU0F3TGpNeE1qYzFOeUF3TGpVMU5ESTFJREF1TXpFek5qa2dNQzQxTkRrek1UWk1NQzR6TkRBek5UY2dNQzQxTlRRMU1UWkRNQzR6TXprME1qUWdNQzQxTlRrMU9ETWdNQzR6TXpnek5UY2dNQzQxTmpRek9ETWdNQzR6TXpjME1qUWdNQzQxTmpreE9ETkRNQzR6TXpJM05qVWdNQzQxT0Rnd01ERWdNQzR6TXpBeE56SWdNQzQyTURjeU55QXdMak15T1RZNUlEQXVOakkyTmpWRE1DNHpNekF5T1RVZ01DNDJOemd6T0NBd0xqTTBNVEEzT0NBd0xqY3lPVFE0TlNBd0xqTTJNVFF5TkNBd0xqYzNOekExVERBdU16TTJOelUzSURBdU56ZzJOalZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF3TURnZ01DNDRNek15TlRoRE1DNDBNVEUyTnpVZ01DNDRNek15TlRnZ01DNHpNalk0T1RFZ01DNDNPVGd4TXprZ01DNHlOalF6TnprZ01DNDNNelUyTWpkRE1DNHlNREU0TmpjZ01DNDJOek14TVRVZ01DNHhOalkzTkRnZ01DNDFPRGd6TXlBd0xqRTJOamMwT0NBd0xqUTVPVGt5TlVNd0xqRTJOamMwT0NBd0xqUTVNekV5TlNBd0xqRTJOamMwT0NBd0xqUTROalU1TVNBd0xqRTJOelF4TlNBd0xqUTNPVGM1TVVNd0xqRTNNVFV6TmlBd0xqUXhNVFUzTVNBd0xqRTVOalV5TnlBd0xqTTBOakkyTmlBd0xqSXpPVEF3TXlBd0xqSTVNamN5TkVNd0xqSTRNVFEzT1NBd0xqSXpPVEU0TVNBd0xqTXpPVE00TmlBd0xqRTVPVGs1SURBdU5EQTBPRGd4SURBdU1UZ3dORFU0UXpBdU5EUTNOalExSURBdU1UWTNOek01SURBdU5Ea3lOVEkzSURBdU1UWXpOek0wSURBdU5UTTJPRFkzSURBdU1UWTROamd4UXpBdU5UZ3hNakE0SURBdU1UY3pOakk1SURBdU5qSTBNVEEwSURBdU1UZzNOREkzSURBdU5qWXpNREV6SURBdU1qQTVNalU0UXpBdU56RXhNRE01SURBdU1qTTJNVGczSURBdU56VXhOalEzSURBdU1qYzBOVGt6SURBdU56Z3hNakE0SURBdU16SXhNRFEyUXpBdU9ERXdOelk1SURBdU16WTNORGs0SURBdU9ESTRNell6SURBdU5ESXdOVFVnTUM0NE16STBNVGNnTUM0ME56VTBOakZETUM0NE16WTBOekVnTUM0MU16QXpOek1nTUM0NE1qWTROaUF3TGpVNE5UUXpNeUF3TGpnd05EUTBNaUF3TGpZek5UY3lORU13TGpjNE1qQXlOQ0F3TGpZNE5qQXhOQ0F3TGpjME56UTVOeUF3TGpjeU9UazJPQ0F3TGpjd016azBOaUF3TGpjMk16WTFPRU13TGpZME5UUTNNU0F3TGpnd09EWXdOQ0F3TGpVM016Z3pNeUF3TGpnek16QTJNU0F3TGpVd01EQTRJREF1T0RNek1qVTRWakF1T0RNek1qVTRXazB3TGpVd01EQTRJREF1TVRrek1qVTRRekF1TkRjd016Z3lJREF1TVRrek16VTBJREF1TkRRd09EWXlJREF1TVRrM09EUTNJREF1TkRFeU5EZ3hJREF1TWpBMk5Ua3hRekF1TXpVeU1qZzRJREF1TWpJME5UVXpJREF1TWprNU1EWXlJREF1TWpZd05UWTNJREF1TWpZd01EQXlJREF1TXpBNU56WXlRekF1TWpJd09UUXlJREF1TXpVNE9UVTNJREF1TVRrM09UTXhJREF1TkRFNE9UWWdNQzR4T1RRd09ERWdNQzQwT0RFMk5UaERNQzR4T1RRd09ERWdNQzQwT0RjNU1qVWdNQzR4T1RNME1UVWdNQzQwT1RNNU1qVWdNQzR4T1RNME1UVWdNQzQwT1RrNU1qVkRNQzR4T1RNME1UVWdNQzQxT0RFeU5UZ2dNQzR5TWpVM01qUWdNQzQyTlRreU5pQXdMakk0TXpJek5TQXdMamN4TmpjM01VTXdMak0wTURjME5pQXdMamMzTkRJNE1pQXdMalF4T0RjME9DQXdMamd3TmpVNU1TQXdMalV3TURBNElEQXVPREEyTlRreFF6QXVOVE16TnpVZ01DNDRNRFkyTkRRZ01DNDFOamN4T1NBd0xqZ3dNVEExTlNBd0xqVTVPVEF4TXlBd0xqYzVNREExT0VNd0xqWXpNVEF4SURBdU56YzVNekkySURBdU5qWXdPVFE0SURBdU56WXpNak1nTUM0Mk9EYzFORFlnTUM0M05ESTBOVGhETUM0M016Z3hNalFnTUM0M01ETXpNakVnTUM0M056VXlJREF1TmpRNU16VWdNQzQzT1RNMU9EZ2dNQzQxT0Rnd09UbERNQzQ0TVRFNU56WWdNQzQxTWpZNE5EZ2dNQzQ0TVRBM05UUWdNQzQwTmpFek9ERWdNQzQzT1RBd09UVWdNQzQwTURBNE5UaERNQzQzTmprME16WWdNQzR6TkRBek16VWdNQzQzTXpBek56TWdNQzR5T0RjM09EVWdNQzQyTnpnek56RWdNQzR5TlRBMU5qRkRNQzQyTWpZek55QXdMakl4TXpNek55QXdMalUyTkRBek1pQXdMakU1TXpNd01pQXdMalV3TURBNElEQXVNVGt6TWpVNFZqQXVNVGt6TWpVNFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVek1qUTFOU0F3TGpNME5UWTNNa013TGpVeU1EYzJOeUF3TGpNME5UWTNNaUF3TGpVd09UTTBNaUF3TGpNME1qSXdOU0F3TGpRNU9UWXlOaUF3TGpNek5UY3dPVU13TGpRNE9Ua3dPU0F3TGpNeU9USXhNaUF3TGpRNE1qTXpPU0F3TGpNeE9UazNPU0F3TGpRM056ZzNNaUF3TGpNd09URTNPVU13TGpRM016UXdOU0F3TGpJNU9ETTNPQ0F3TGpRM01qSTBOQ0F3TGpJNE5qUTVOU0F3TGpRM05EVXpNeUF3TGpJM05UQXpNME13TGpRM05qZ3lNeUF3TGpJMk16VTNNaUF3TGpRNE1qUTJNaUF3TGpJMU16QTBOeUF3TGpRNU1EY3pOaUF3TGpJME5EYzVNa013TGpRNU9UQXhJREF1TWpNMk5UTTNJREF1TlRBNU5UUTNJREF1TWpNd09USXlJREF1TlRJeE1ERTBJREF1TWpJNE5qVTRRekF1TlRNeU5EZ2dNQzR5TWpZek9UUWdNQzQxTkRRek5qRWdNQzR5TWpjMU9ETWdNQzQxTlRVeE5USWdNQzR5TXpJd056UkRNQzQxTmpVNU5ESWdNQzR5TXpZMU5qVWdNQzQxTnpVeE5UZ2dNQzR5TkRReE5UWWdNQzQxT0RFMk16SWdNQzR5TlRNNE9EZERNQzQxT0RneE1EWWdNQzR5TmpNMk1UZ2dNQzQxT1RFMU5EZ2dNQzR5TnpVd05URWdNQzQxT1RFMU1qSWdNQzR5T0RZM016bERNQzQxT1RFMU1qSWdNQzR5T1RRME9TQXdMalU0T1RrNU15QXdMak13TWpFMk5DQXdMalU0TnpBeU15QXdMak13T1RNeU0wTXdMalU0TkRBMU15QXdMak14TmpRNE1pQXdMalUzT1RjZ01DNHpNakk1T0RRZ01DNDFOelF5TVRRZ01DNHpNamcwTlRoRE1DNDFOamczTWpjZ01DNHpNek01TXpNZ01DNDFOakl5TVRRZ01DNHpNemd5TnpFZ01DNDFOVFV3TkRrZ01DNHpOREV5TWpWRE1DNDFORGM0T0RNZ01DNHpORFF4TnprZ01DNDFOREF5TURZZ01DNHpORFUyT1NBd0xqVXpNalExTlNBd0xqTTBOVFkzTWxZd0xqTTBOVFkzTWxwTk1DNDFNekkwTlRVZ01DNHlOVFF6TXpsRE1DNDFNall3TkRjZ01DNHlOVFF6TXprZ01DNDFNVGszT0RNZ01DNHlOVFl5TXprZ01DNDFNVFEwTlRVZ01DNHlOVGszT1RsRE1DNDFNRGt4TWpjZ01DNHlOak16TmlBd0xqVXdORGszTkNBd0xqSTJPRFF5SURBdU5UQXlOVEl4SURBdU1qYzBNelJETUM0MU1EQXdOamtnTUM0eU9EQXlOaUF3TGpRNU9UUXlPQ0F3TGpJNE5qYzNOU0F3TGpVd01EWTNPQ0F3TGpJNU16QTJRekF1TlRBeE9USTRJREF1TWprNU16UTFJREF1TlRBMU1ERTBJREF1TXpBMU1URTRJREF1TlRBNU5UUTFJREF1TXpBNU5qUTVRekF1TlRFME1EYzJJREF1TXpFME1UZ3hJREF1TlRFNU9EUTVJREF1TXpFM01qWTJJREF1TlRJMk1UTTBJREF1TXpFNE5URTNRekF1TlRNeU5ERTVJREF1TXpFNU56WTNJREF1TlRNNE9UTTBJREF1TXpFNU1USTFJREF1TlRRME9EVTBJREF1TXpFMk5qY3pRekF1TlRVd056YzBJREF1TXpFME1qSXhJREF1TlRVMU9ETTFJREF1TXpFd01EWTRJREF1TlRVNU16azFJREF1TXpBME56UkRNQzQxTmpJNU5UVWdNQzR5T1RrME1URWdNQzQxTmpRNE5UVWdNQzR5T1RNeE5EY2dNQzQxTmpRNE5UVWdNQzR5T0RZM016bERNQzQxTmpRNE5UVWdNQzR5TnpneE5EWWdNQzQxTmpFME5ESWdNQzR5TmprNU1EVWdNQzQxTlRVek5qVWdNQzR5TmpNNE1qbERNQzQxTkRreU9Ea2dNQzR5TlRjM05UTWdNQzQxTkRFd05EZ2dNQzR5TlRRek16a2dNQzQxTXpJME5UVWdNQzR5TlRRek16bFdNQzR5TlRRek16bGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16VXdOVGN4SURBdU5UTXhOekE0UXpBdU16TTRPRGc0SURBdU5UTXhOekE0SURBdU16STNORFk0SURBdU5USTRNalF6SURBdU16RTNOelUxSURBdU5USXhOelV6UXpBdU16QTRNRFF4SURBdU5URTFNall6SURBdU16QXdORGN4SURBdU5UQTJNRE00SURBdU1qazJJREF1TkRrMU1qUTFRekF1TWpreE5USTVJREF1TkRnME5EVXlJREF1TWprd016WWdNQzQwTnpJMU56VWdNQzR5T1RJMk16a2dNQzQwTmpFeE1UaERNQzR5T1RRNU1UZ2dNQzQwTkRrMk5pQXdMak13TURVME5DQXdMalF6T1RFek5TQXdMak13T0Rnd05DQXdMalF6TURnM05FTXdMak14TnpBMk5TQXdMalF5TWpZeE5DQXdMak15TnpVNE9TQXdMalF4TmprNE9DQXdMak16T1RBME55QXdMalF4TkRjd09VTXdMak0xTURVd05TQXdMalF4TWpReklEQXVNell5TXpneElEQXVOREV6TmlBd0xqTTNNekUzTkNBd0xqUXhPREEzUXpBdU16Z3pPVFkzSURBdU5ESXlOVFF4SURBdU16a3pNVGt5SURBdU5ETXdNVEV5SURBdU16azVOamd6SURBdU5ETTVPREkxUXpBdU5EQTJNVGN6SURBdU5EUTVOVE01SURBdU5EQTVOak0zSURBdU5EWXdPVFU1SURBdU5EQTVOak0zSURBdU5EY3lOalF4UXpBdU5EQTVOakF5SURBdU5EZzRNamsySURBdU5EQXpNelk0SURBdU5UQXpNams1SURBdU16a3lNams0SURBdU5URTBNelk0UXpBdU16Z3hNakk1SURBdU5USTFORE00SURBdU16WTJNakkxSURBdU5UTXhOamN5SURBdU16VXdOVGN4SURBdU5UTXhOekE0V2swd0xqTTFNRFUzTVNBd0xqUTBNREkwTVVNd0xqTTBOREUyTWlBd0xqUTBNREkwTVNBd0xqTXpOemc1T0NBd0xqUTBNakUwTVNBd0xqTXpNalUzSURBdU5EUTFOekF4UXpBdU16STNNalF5SURBdU5EUTVNall4SURBdU16SXpNRGc1SURBdU5EVTBNekl5SURBdU16SXdOak0zSURBdU5EWXdNalF5UXpBdU16RTRNVGcxSURBdU5EWTJNVFl5SURBdU16RTNOVFF6SURBdU5EY3lOamMzSURBdU16RTROemt6SURBdU5EYzRPVFl5UXpBdU16SXdNRFF6SURBdU5EZzFNalEzSURBdU16SXpNVEk1SURBdU5Ea3hNRElnTUM0ek1qYzJOaUF3TGpRNU5UVTFNVU13TGpNek1qRTVNaUF3TGpVd01EQTRNaUF3TGpNek56azJOU0F3TGpVd016RTJPQ0F3TGpNME5ESTFJREF1TlRBME5ERTRRekF1TXpVd05UTTFJREF1TlRBMU5qWTVJREF1TXpVM01EUTVJREF1TlRBMU1ESTNJREF1TXpZeU9UY2dNQzQxTURJMU56VkRNQzR6TmpnNE9TQXdMalV3TURFeU1pQXdMak0zTXprMUlEQXVORGsxT1RjZ01DNHpOemMxTVNBd0xqUTVNRFkwTVVNd0xqTTRNVEEzSURBdU5EZzFNekV6SURBdU16Z3lPVGN4SURBdU5EYzVNRFE1SURBdU16Z3lPVGN4SURBdU5EY3lOalF4UXpBdU16Z3pNREEySURBdU5EWTRNelkwSURBdU16Z3lNVGswSURBdU5EWTBNVEl5SURBdU16Z3dOVGd4SURBdU5EWXdNVFpETUM0ek56ZzVOamtnTUM0ME5UWXhPVGdnTUM0ek56WTFPRGdnTUM0ME5USTFPVFVnTUM0ek56TTFOellnTUM0ME5EazFOVGhETUM0ek56QTFOak1nTUM0ME5EWTFNakVnTUM0ek5qWTVPQ0F3TGpRME5ERXhNU0F3TGpNMk16QXpNU0F3TGpRME1qUTJOa013TGpNMU9UQTRNeUF3TGpRME1EZ3lNU0F3TGpNMU5EZzBPQ0F3TGpRek9UazNOQ0F3TGpNMU1EVTNNU0F3TGpRek9UazNORll3TGpRME1ESTBNVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORE0yTnpNZ01DNDNNREkyTURoRE1DNDJNekU1TnprZ01DNDNNREkyTXpRZ01DNDJNakExTkRFZ01DNDJPVGt4T0RrZ01DNDJNVEE0TURjZ01DNDJPVEkzTURsRE1DNDJNREV3TnpNZ01DNDJPRFl5TWprZ01DNDFPVE0wT0RJZ01DNDJOemN3TURVZ01DNDFPRGc1T1RRZ01DNDJOall5TURaRE1DNDFPRFExTURjZ01DNDJOVFUwTURnZ01DNDFPRE16TWpZZ01DNDJORE0xTWlBd0xqVTROVFl3TVNBd0xqWXpNakExUXpBdU5UZzNPRGMySURBdU5qSXdOVGM1SURBdU5Ua3pOVEEwSURBdU5qRXdNRFF5SURBdU5qQXhOemN6SURBdU5qQXhOemN6UXpBdU5qRXdNRFF5SURBdU5Ua3pOVEEwSURBdU5qSXdOVGM1SURBdU5UZzNPRGMySURBdU5qTXlNRFE1SURBdU5UZzFOakF4UXpBdU5qUXpOVEU1SURBdU5UZ3pNekkySURBdU5qVTFOREEySURBdU5UZzBOVEEzSURBdU5qWTJNakExSURBdU5UZzRPVGswUXpBdU5qYzNNREF6SURBdU5Ua3pORGd5SURBdU5qZzJNakkzSURBdU5qQXhNRGN6SURBdU5qa3lOekEzSURBdU5qRXdPREEzUXpBdU5qazVNVGczSURBdU5qSXdOVFF4SURBdU56QXlOak15SURBdU5qTXhPVGdnTUM0M01ESTJNRFlnTUM0Mk5ETTJOelJETUM0M01ESTJNRFlnTUM0Mk5Ua3pNRFFnTUM0Mk9UWXpPVGNnTUM0Mk56UXlPVFFnTUM0Mk9EVXpORFVnTUM0Mk9EVXpORFpETUM0Mk56UXlPVE1nTUM0Mk9UWXpPVGtnTUM0Mk5Ua3pNRE1nTUM0M01ESTJNRGdnTUM0Mk5ETTJOek1nTUM0M01ESTJNRGhXTUM0M01ESTJNRGhhVFRBdU5qUXpOamN6SURBdU5qRXhNamN6UXpBdU5qTTNNalU1SURBdU5qRXhNalEzSURBdU5qTXdPVGd5SURBdU5qRXpNVEkwSURBdU5qSTFOak0ySURBdU5qRTJOalk1UXpBdU5qSXdNamtnTUM0Mk1qQXlNVE1nTUM0Mk1UWXhNVGNnTUM0Mk1qVXlOalFnTUM0Mk1UTTJORFFnTUM0Mk16RXhPREpETUM0Mk1URXhOekVnTUM0Mk16Y3hJREF1TmpFd05URXhJREF1TmpRek5qRTVJREF1TmpFeE56UTJJREF1TmpRNU9URXlRekF1TmpFeU9UZ3hJREF1TmpVMk1qQTJJREF1TmpFMk1EVTJJREF1TmpZeE9Ua3lJREF1TmpJd05UZ3lJREF1TmpZMk5UTTNRekF1TmpJMU1UQTRJREF1TmpjeE1EZ3hJREF1TmpNd09EZ3hJREF1TmpjME1UZ2dNQzQyTXpjeE5qa2dNQzQyTnpVME5ESkRNQzQyTkRNME5UZ2dNQzQyTnpZM01ETWdNQzQyTkRrNU56a2dNQzQyTnpZd05qa2dNQzQyTlRVNU1EY2dNQzQyTnpNMk1rTXdMalkyTVRnek5TQXdMalkzTVRFM01pQXdMalkyTmprd015QXdMalkyTnpBeE9TQXdMalkzTURRM0lEQXVOall4TmpnNFF6QXVOamMwTURNMklEQXVOalUyTXpVM0lEQXVOamMxT1RNNUlEQXVOalV3TURnM0lEQXVOamMxT1RNNUlEQXVOalF6TmpjMFF6QXVOamMxT1RNNUlEQXVOak0xTVRBeklEQXVOamN5TlRRMElEQXVOakkyT0RneUlEQXVOalkyTkRrM0lEQXVOakl3T0RGRE1DNDJOakEwTkRrZ01DNDJNVFEzTXpjZ01DNDJOVEl5TkRJZ01DNDJNVEV6TURnZ01DNDJORE0yTnpNZ01DNDJNVEV5TnpOV01DNDJNVEV5TnpOYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN4TkRjaUlIa3hQU0l4TGpJd056RXhJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056RXdOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpSRU1qZEJPQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUVRFMk5rWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci5yZWY9NzM3ZDdhM2MtOWFlNy00YzM3LThmZjctNmM3NjM3ZmVlZDBhOyIgcGFyZW50PSI0OSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2OSIgeT0iMjkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1OSIgdmFsdWU9IkFXUyBBUEkgR2F0ZXdheSAtPiBBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj01YmFkZjk3NC1hZWViLTRiYjAtOWZkZS1hZjYwMzMxM2Q2M2E7aXIudGFncz1odHRwczogNDQzOyIgcGFyZW50PSI0OSIgc291cmNlPSI1MiIgdGFyZ2V0PSI1OCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUyIiB2YWx1ZT0iQVdTIEFQSSBHYXRld2F5IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFkzTmpjZ01DNDRNakF3TnpGRE1DNDJORE01TkRNZ01DNDRNakF3T0RFZ01DNDJOREV4T0RnZ01DNDRNVGt4T1RRZ01DNDJNemc1TURFZ01DNDRNVGMxTXpkRE1DNDJNemN4TnpnZ01DNDRNVFl6TVNBd0xqWXpOVGMzTVNBd0xqZ3hORFk1TVNBd0xqWXpORGM1TnlBd0xqZ3hNamd4TTBNd0xqWXpNemd5TkNBd0xqZ3hNRGt6TlNBd0xqWXpNek14TVNBd0xqZ3dPRGcxTXlBd0xqWXpNek13TVNBd0xqZ3dOamN6TjFZd0xqRTVNelF3TkVNd0xqWXpNek14SURBdU1Ua3hNVEkxSURBdU5qTXpPVEEwSURBdU1UZzRPRGczSURBdU5qTTFNREkwSURBdU1UZzJPVEF6UXpBdU5qTTJNVFEwSURBdU1UZzBPVEU1SURBdU5qTTNOelUxSURBdU1UZ3pNalUxSURBdU5qTTVOekF4SURBdU1UZ3lNRGN4UXpBdU5qUXhOalk1SURBdU1UZ3dOemszSURBdU5qUXpPVE0zSURBdU1UZ3dNRFkxSURBdU5qUTJNamM0SURBdU1UYzVPVFE0UXpBdU5qUTROakU1SURBdU1UYzVPRE14SURBdU5qVXdPVFE1SURBdU1UZ3dNek16SURBdU5qVXpNRE0wSURBdU1UZ3hOREEwVERBdU9ESTJNelkzSURBdU1qWTJNRGN4UXpBdU9ESTROVGt4SURBdU1qWTNNVFlnTUM0NE16QTBOamdnTUM0eU5qZzRORGNnTUM0NE16RTNPRFlnTUM0eU56QTVORE5ETUM0NE16TXhNRFVnTUM0eU56TXdNemtnTUM0NE16TTRNVFFnTUM0eU56VTBOakVnTUM0NE16TTRNelFnTUM0eU56YzVNemRXTUM0M05Ea3hNemRETUM0NE16TTVOemNnTUM0M05USXdOakVnTUM0NE16TXhOVFFnTUM0M05UUTVOVEVnTUM0NE16RTBPVEVnTUM0M05UY3pOakZETUM0NE1qazRNamdnTUM0M05UazNOekVnTUM0NE1qYzBNVGtnTUM0M05qRTFOallnTUM0NE1qUTJNelFnTUM0M05qSTBOekZNTUM0Mk5URXpNREVnTUM0NE1qQXdOekZETUM0Mk5EazNPVGNnTUM0NE1qQXlPRGNnTUM0Mk5EZ3lOekVnTUM0NE1qQXlPRGNnTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZhVFRBdU5qWXdNVEF4SURBdU1qRTBPRGN4VmpBdU56ZzRNakEwVERBdU9EQTJOelkzSURBdU56TTVOVE0zVmpBdU1qZzJNakEwVERBdU5qWXdNVEF4SURBdU1qRTBPRGN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0xTXpRek15QXdMamd5TURBM1F6QXVNelV5TURFM0lEQXVPREl3TWpZeklEQXVNelV3TlRneUlEQXVPREl3TWpZeklEQXVNelE1TVRZMklEQXVPREl3TURkTU1DNHhOelU0TXpNZ01DNDNOakkwTjBNd0xqRTNNekEzTXlBd0xqYzJNVFUwTXlBd0xqRTNNRFk1TXlBd0xqYzFPVGN6TnlBd0xqRTJPVEExTmlBd0xqYzFOek16UXpBdU1UWTNOREU1SURBdU56VTBPVEl5SURBdU1UWTJOakUwSURBdU56VXlNRFExSURBdU1UWTJOelkySURBdU56UTVNVE0zVmpBdU1qYzNPVE0zUXpBdU1UWTJOemcySURBdU1qYzFORFl4SURBdU1UWTNORGsxSURBdU1qY3pNRE01SURBdU1UWTRPREUwSURBdU1qY3dPVFF6UXpBdU1UY3dNVE16SURBdU1qWTRPRFEzSURBdU1UY3lNREE1SURBdU1qWTNNVFlnTUM0eE56UXlNek1nTUM0eU5qWXdOekZNTUM0ek5EYzFOallnTUM0eE9ERTBNRFJETUM0ek5EazJOVEVnTUM0eE9EQXpNek1nTUM0ek5URTVPREVnTUM0eE56azRNekVnTUM0ek5UUXpNaklnTUM0eE56azVORGhETUM0ek5UWTJOak1nTUM0eE9EQXdOalVnTUM0ek5UZzVNeklnTUM0eE9EQTNPVGNnTUM0ek5qQTRPVGtnTUM0eE9ESXdOekZETUM0ek5qSTRNakVnTUM0eE9ETXlOekVnTUM0ek5qUTBNRFVnTUM0eE9EUTVORElnTUM0ek5qVTFNREVnTUM0eE9EWTVNalZETUM0ek5qWTFPVGdnTUM0eE9EZzVNRGdnTUM0ek5qY3hOekVnTUM0eE9URXhNemdnTUM0ek5qY3hOallnTUM0eE9UTTBNRFJXTUM0NE1EWTNNemRETUM0ek5qY3hOVFlnTUM0NE1EZzROVElnTUM0ek5qWTJORE1nTUM0NE1UQTVNelVnTUM0ek5qVTJOeUF3TGpneE1qZ3hNME13TGpNMk5EWTVOaUF3TGpneE5EWTVNU0F3TGpNMk16STRPU0F3TGpneE5qTXhJREF1TXpZeE5UWTJJREF1T0RFM05UTTNRekF1TXpVNU1qTTBJREF1T0RFNU16QTFJREF1TXpVMk16VTNJREF1T0RJd01qQXlJREF1TXpVek5ETXpJREF1T0RJd01EZFdNQzQ0TWpBd04xcE5NQzR4T1RNME16TWdNQzQzTkRBd04wd3dMak0wTURFZ01DNDNPRGczTXpkV01DNHlNVFUwTURSTU1DNHhPVE0wTXpNZ01DNHlPRGN3TURSV01DNDNOREF3TjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpNeU56SWdNQzR6TmpZMk16SklNQzQxT1RNeU56SldNQzR6TXprNU5qWklNQzQyTXpNeU56SldNQzR6TmpZMk16SmFUVEF1TlRVek1qY3lJREF1TXpZMk5qTXlTREF1TlRFek1qY3lWakF1TXpNNU9UWTJTREF1TlRVek1qY3lWakF1TXpZMk5qTXlXazB3TGpRM016STNNaUF3TGpNMk5qWXpNa2d3TGpRek16STNNbFl3TGpNek9UazJOa2d3TGpRM016STNNbFl3TGpNMk5qWXpNbHBOTUM0ek9UTXlOekVnTUM0ek5qWTJNekpJTUM0ek5UTXlOekZXTUM0ek16azVOalpJTUM0ek9UTXlOekZXTUM0ek5qWTJNekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TWpjeUlEQXVOall3TURnNVNEQXVOVGt6TWpjeVZqQXVOak16TkRJelNEQXVOak16TWpjeVZqQXVOall3TURnNVdrMHdMalUxTXpJM01pQXdMalkyTURBNE9VZ3dMalV4TXpJM01sWXdMall6TXpReU0wZ3dMalUxTXpJM01sWXdMalkyTURBNE9WcE5NQzQwTnpNeU56SWdNQzQyTmpBd09EbElNQzQwTXpNeU56SldNQzQyTXpNME1qTklNQzQwTnpNeU56SldNQzQyTmpBd09EbGFUVEF1TXprek1qY3hJREF1TmpZd01EZzVTREF1TXpVek1qY3hWakF1TmpNek5ESXpTREF1TXprek1qY3hWakF1TmpZd01EZzVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBNVFV5SURBdU5UUTFPVE5NTUM0ek9URXpPRFlnTUM0MU1ETXhNME13TGpNNE9Ua3lNeUF3TGpVd01UZzNPQ0F3TGpNNE9EYzBPQ0F3TGpVd01ETXlOQ0F3TGpNNE56azBNaUF3TGpRNU9EVTNOVU13TGpNNE56RXpOaUF3TGpRNU5qZ3lOaUF3TGpNNE5qY3hPU0F3TGpRNU5Ea3lNeUF3TGpNNE5qY3hPU0F3TGpRNU1qazVOME13TGpNNE5qY3hPU0F3TGpRNU1UQTNNU0F3TGpNNE56RXpOaUF3TGpRNE9URTJPQ0F3TGpNNE56azBNaUF3TGpRNE56UXhPRU13TGpNNE9EYzBPQ0F3TGpRNE5UWTJPU0F3TGpNNE9Ua3lNeUF3TGpRNE5ERXhOU0F3TGpNNU1UTTROaUF3TGpRNE1qZzJNMHd3TGpRME1UTTROaUF3TGpRME1EQTJNMHd3TGpRMU9EY3lJREF1TkRZd016Tk1NQzQwTWpBMU9EWWdNQzQwT1RNek9UZE1NQzQwTlRnM01pQXdMalV5TmpBMk0wd3dMalEwTVRVeUlEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVNE56STJJREF1TlRRMU9UTk1NQzQxTkRFek9UTWdNQzQxTWpVMk5qTk1NQzQxTnprMU1qVWdNQzQwT1RNek9UZE1NQzQxTkRFeU5pQXdMalEyTURnMk0wd3dMalUxT0RVNU15QXdMalEwTURBMk0wd3dMall3T0RjeU5TQXdMalE0TWpjelF6QXVOakV3TVRnNElEQXVORGd6T1RneUlEQXVOakV4TXpZeklEQXVORGcxTlRNMklEQXVOakV5TVRZNUlEQXVORGczTWpnMVF6QXVOakV5T1RjMUlEQXVORGc1TURNMElEQXVOakV6TXpreUlEQXVORGt3T1RNNElEQXVOakV6TXpreUlEQXVORGt5T0RZelF6QXVOakV6TXpreUlEQXVORGswTnpnNUlEQXVOakV5T1RjMUlEQXVORGsyTmpreklEQXVOakV5TVRZNUlEQXVORGs0TkRReVF6QXVOakV4TXpZeklEQXVOVEF3TVRreElEQXVOakV3TVRnNElEQXVOVEF4TnpRMUlEQXVOakE0TnpJMUlEQXVOVEF5T1RrM1REQXVOVFU0TnpJMklEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRFek5qZzVJREF1TkRFM01qSTJUREF1TkRZd05qa3pJREF1TlRjek9UYzFUREF1TkRnMU9UVTFJREF1TlRneU5URTFUREF1TlRNNE9UVXhJREF1TkRJMU56WTNUREF1TlRFek5qZzVJREF1TkRFM01qSTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01EWTNJaUI1TVQwaU1TNHlNRGN4TVNJZ2VESTlJakV1TWpBM01UVWlJSGt5UFNJdE1DNHlNRGN4TURjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTBSREkzUVRnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwRXhOalpHUmlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPWE3MzcxMzU5LTU5MDgtNDViNC04NWE4LTE2MjFlNTBmOGRjZDsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjkiIHk9IjM5NSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJBV1MgRWxhc3RpQ2FjaGUgZm9yIFJlZGlzIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtRUxBU1RJQ0FDSEUtRk9SLVJFRElTO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh0WVhOcklHbGtQU0p0WVhOck1GOHlNelkwWHpJek1UUXlJaUJ6ZEhsc1pUMGliV0Z6YXkxMGVYQmxPbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0OFkybHlZMnhsSUdONFBTSXdMalVpSUdONVBTSXdMalVpSUhJOUlqQXVOU0lnWm1sc2JEMGlZbXhoWTJzaUx6NDhMMjFoYzJzK1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1GOHlNelkwWHpJek1UUXlLU0krUEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdYekl6TmpSZk1qTXhORElwSWo0OGNHRjBhQ0JrUFNKTk1TNHdNREF3TXlBd1NETXVNRFV4TnpabExUQTFWakZJTVM0d01EQXdNMVl3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5WHpJek5qUmZNak14TkRJcElpOCtQSEJoZEdnZ1pEMGlUVEF1TlRBd01ETTBJREF1T0RBME5qRkRNQzQwTVRBM05ESWdNQzQ0TURRMk1TQXdMak15TURFM05TQXdMamM0TURjNU9TQXdMak15TURFM05TQXdMamN6TlRRME5GWXdMalF5T1RRME0wZ3dMak0wT0RVeU1sWXdMamN6TlRRME5FTXdMak0wT0RVeU1pQXdMamMwT1RZeE55QXdMalF3TVRrMU5TQXdMamMzTmpFeU1TQXdMalE1T1RnNU1pQXdMamMzTmpFeU1VTXdMalU1TnpneU9TQXdMamMzTmpFeU1TQXdMalkxTVRRd05DQXdMamMwT1RFNU1pQXdMalkxTVRRd05DQXdMamN6TlRRME5GWXdMalF5T1RRME0wZ3dMalkzT1RjMU1WWXdMamN6TlRRME5FTXdMalk0TURFM05pQXdMamM0TURjNU9TQXdMalU0T1RZd09TQXdMamd3TkRZeElEQXVOVEF3TURNMElEQXVPREEwTmpGYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGp4d1lYUm9JR1E5SWswd0xqUXhNakUxTlNBd0xqVTVNalU0TVVNd0xqTTFNamt4TVNBd0xqVTRNRGd4TnlBd0xqTXlNRE14TWlBd0xqVTFPVEV6TWlBd0xqTXlNRE14TWlBd0xqVXpNVFE1TkVnd0xqTTBPRFkxT1VNd0xqTTBPRFkxT1NBd0xqVXpOemN6SURBdU16WTFOVEkxSURBdU5UVTBNekV6SURBdU5ERTNPREkxSURBdU5UWTBOalpNTUM0ME1USXhOVFVnTUM0MU9USTFPREZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQanh3WVhSb0lHUTlJazB3TGpZd05ESXdOQ0F3TGpVNE9EYzFORXd3TGpVNU56STJJREF1TlRZeE5FTXdMall6TmprME5TQXdMalUxTVRNek55QXdMalkxTVRZNE5TQXdMalV6TnpjeklEQXVOalV4TmpnMUlEQXVOVE14TkRrMFNEQXVOamd3TURNeFF6QXVOamd3TURNeElEQXVOVFUyTURFMElEQXVOalV6TVRBeUlEQXVOVGMyTkRJeklEQXVOakEwTWpBMElEQXVOVGc0TnpVMFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0OGNHRjBhQ0JrUFNKTk1DNDFNREF3TXpnZ01DNDBPVGcxT0VNd0xqUXhNRFl3TlNBd0xqUTVPRFU0SURBdU16SXdNRE00SURBdU5EYzBPVEV4SURBdU16SXdNRE00SURBdU5ESTVOREUxUXpBdU16SXdNRE00SURBdU16Z3pPVEU1SURBdU5ERXdOakExSURBdU16WXdNVEEzSURBdU5UQXdNRE00SURBdU16WXdNVEEzUXpBdU5UZzVORGN5SURBdU16WXdNVEEzSURBdU5qYzVPRGszSURBdU16Z3pPVEU1SURBdU5qYzVPRGszSURBdU5ESTVOREUxUXpBdU5qYzVPRGszSURBdU5EYzBPVEV4SURBdU5UZzVOakV6SURBdU5EazROVGdnTUM0MU1EQXdNemdnTUM0ME9UZzFPRnBOTUM0MU1EQXdNemdnTUM0ek9EZzFPVFpETUM0ME1ERTVOVGtnTUM0ek9EZzFPVFlnTUM0ek5EZzFNallnTUM0ME1UVTFNalVnTUM0ek5EZzFNallnTUM0ME1qazBNVFZETUM0ek5EZzFNallnTUM0ME5ETXpNRFFnTUM0ME1ESXlORE1nTUM0ME56QXlNelFnTUM0MU1EQXdNemdnTUM0ME56QXlNelJETUM0MU9UYzRNelFnTUM0ME56QXlNelFnTUM0Mk5URTBNRGtnTUM0ME5ETXpNRFFnTUM0Mk5URTBNRGtnTUM0ME1qazBNVFZETUM0Mk5URTBNRGtnTUM0ME1UVTFNalVnTUM0MU9UZ3lOVGtnTUM0ek9EZzFPVFlnTUM0MU1EQXdNemdnTUM0ek9EZzFPVFpXTUM0ek9EZzFPVFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQanh3WVhSb0lHUTlJazB3TGpVd01EQXpPQ0F3TGpnd05EVXlOME13TGpReE1EWXdOU0F3TGpnd05EVXlOeUF3TGpNeU1EQXpPQ0F3TGpjNE1EY3hOaUF3TGpNeU1EQXpPQ0F3TGpjek5UTTJNVll3TGpZek16TXhORU13TGpNeU1EQXpPQ0F3TGpZeU9UVTFOU0F3TGpNeU1UVXpNU0F3TGpZeU5UazFJREF1TXpJME1UZzVJREF1TmpJek1qa3lRekF1TXpJMk9EUTNJREF1TmpJd05qTTBJREF1TXpNd05EVXlJREF1TmpFNU1UUXhJREF1TXpNME1qRXhJREF1TmpFNU1UUXhRekF1TXpNM09UY2dNQzQyTVRreE5ERWdNQzR6TkRFMU56VWdNQzQyTWpBMk16UWdNQzR6TkRReU16TWdNQzQyTWpNeU9USkRNQzR6TkRZNE9URWdNQzQyTWpVNU5TQXdMak0wT0RNNE5DQXdMall5T1RVMU5TQXdMak0wT0RNNE5DQXdMall6TXpNeE5FTXdMak0wT0RNNE5DQXdMall6T1RVMUlEQXVNelkxTXpreUlEQXVOalUyTVRNeklEQXVOREUzTlRVZ01DNDJOalkyTWpGTU1DNDBNVEU0T0RFZ01DNDJPVFE1TmpoRE1DNHpPRGsyTnpZZ01DNDJPVEV4TmpnZ01DNHpOamd5TXpNZ01DNDJPRE0zT1RjZ01DNHpORGd6T0RRZ01DNDJOek14TkRGV01DNDNNelUzT0RkRE1DNHpORGd6T0RRZ01DNDNORGs1TmlBd0xqUXdNVGsxT1NBd0xqYzNOalEyTkNBd0xqVXdNREF6T0NBd0xqYzNOalEyTkVNd0xqVTVPREV4TnlBd0xqYzNOalEyTkNBd0xqWTFNVFF3T1NBd0xqYzBPVFV6TlNBd0xqWTFNVFF3T1NBd0xqY3pOVGM0TjFZd0xqWTNNalUzTkVNd0xqWXpOalV6TWlBd0xqWTRNRGcyTXlBd0xqWXlNRFUwTWlBd0xqWTROamszTWlBd0xqWXdNemt5T0NBd0xqWTVNRGN4Tmt3d0xqVTVOams0TXlBd0xqWTJNekl4T1VNd0xqWXpOalkyT1NBd0xqWTFNekUxTmlBd0xqWTFNVFF3T1NBd0xqWXpPVFUxSURBdU5qVXhOREE1SURBdU5qTXpNekUwUXpBdU5qVXhOREE1SURBdU5qSTVOVFUxSURBdU5qVXlPVEF5SURBdU5qSTFPVFVnTUM0Mk5UVTFOaUF3TGpZeU16STVNa013TGpZMU9ESXhPQ0F3TGpZeU1EWXpOQ0F3TGpZMk1UZ3lNeUF3TGpZeE9URTBNU0F3TGpZMk5UVTRNaUF3TGpZeE9URTBNVU13TGpZMk9UTTBNU0F3TGpZeE9URTBNU0F3TGpZM01qazBOaUF3TGpZeU1EWXpOQ0F3TGpZM05UWXdOQ0F3TGpZeU16STVNa013TGpZM09ESTJNaUF3TGpZeU5UazFJREF1TmpjNU56VTFJREF1TmpJNU5UVTFJREF1TmpjNU56VTFJREF1TmpNek16RTBWakF1TnpNMU16WXhRekF1Tmpnd01ETTVJREF1Tnpnd056RTJJREF1TlRnNU5qRXpJREF1T0RBME5USTNJREF1TlRBd01ETTRJREF1T0RBME5USTNXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NDhjR0YwYUNCa1BTSk5NQzQwTkRBeU1UWWdNQzQzTWpVNE1qVldNQzQxTXprNE56SklNQzQxTURnNU5UWkRNQzQxTWpRNE16RWdNQzQxTXprd09DQXdMalUwTURRd05DQXdMalUwTkRRd05pQXdMalUxTWpRMk9DQXdMalUxTkRjMU5FTXdMalUxTnpnNU9TQXdMalUxT1RnNE15QXdMalUyTWpFMk5DQXdMalUyTmpFeE9DQXdMalUyTkRrM05pQXdMalUzTXpBek9FTXdMalUyTnpjNE9DQXdMalUzT1RrMU9DQXdMalUyT1RBNE1TQXdMalU0TnpRd01TQXdMalUyT0RjMk9DQXdMalU1TkRnMk5FTXdMalUyT1RBME1TQXdMall3TmpBMU5TQXdMalUyTlRneU1TQXdMall4TnpBMU15QXdMalUxT1RVMU5TQXdMall5TmpNeU9VTXdMalUxTWpreE5pQXdMall6TlRZeE15QXdMalUwTXpZeU9TQXdMalkwTWpZM055QXdMalV6TWprd09TQXdMalkwTmpVNU4wd3dMalU0TURNNUlEQXVOekkxT1RZM1NEQXVOVFE0TURjMVREQXVOVEExTlRVMUlEQXVOalV5TWpZMlNEQXVORGN5TmpjelZqQXVOekkxT1RZM1REQXVORFF3TWpFMklEQXVOekkxT0RJMVdrMHdMalEzTWpZM015QXdMall5TmpZeE0wZ3dMalV3TkRnME5rTXdMalV3T1RBME1TQXdMall5TnpJd015QXdMalV4TXpNeE55QXdMall5TmpneElEQXVOVEUzTXpNMElEQXVOakkxTkRZMlF6QXVOVEl4TXpVeUlEQXVOakkwTVRJeUlEQXVOVEkxTURBeklEQXVOakl4T0RZeklEQXVOVEkzT1RrNUlEQXVOakU0T0RZM1F6QXVOVE13T1RrMElEQXVOakUxT0RjeUlEQXVOVE16TWpVeklEQXVOakV5TWpJeElEQXVOVE0wTlRrM0lEQXVOakE0TWpBelF6QXVOVE0xT1RReElEQXVOakEwTVRnMUlEQXVOVE0yTXpNMElEQXVOVGs1T1RFZ01DNDFNelUzTkRRZ01DNDFPVFUzTVRWRE1DNDFNell6T1RVZ01DNDFPVEUxT0RNZ01DNDFNell3TnpRZ01DNDFPRGN6TlRjZ01DNDFNelE0TURnZ01DNDFPRE16TnpGRE1DNDFNek0xTkRFZ01DNDFOemt6T0RVZ01DNDFNekV6TmpRZ01DNDFOelUzTkRrZ01DNDFNamcwTkRnZ01DNDFOekkzTlRGRE1DNDFNalUxTXpJZ01DNDFOamszTlRJZ01DNDFNakU1TlRnZ01DNDFOamMwTnpRZ01DNDFNVGd3TURrZ01DNDFOall3T1RkRE1DNDFNVFF3TmlBd0xqVTJORGN5SURBdU5UQTVPRFEwSURBdU5UWTBNamd5SURBdU5UQTFOamszSURBdU5UWTBPREUzU0RBdU5EY3lOamN6VmpBdU5qSTJOakV6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejQ4Y0dGMGFDQmtQU0pOTUM0NE1qWTNNREVnTUM0eU5UWXdOakpETUM0NE16QXlNemNnTUM0eU5UWXdOaklnTUM0NE16TTJNamdnTUM0eU5UUTJOVGNnTUM0NE16WXhNamtnTUM0eU5USXhOVGRETUM0NE16ZzJNamtnTUM0eU5EazJOVFlnTUM0NE5EQXdNelFnTUM0eU5EWXlOalVnTUM0NE5EQXdNelFnTUM0eU5ESTNNamxXTUM0eU1UTTFNamxETUM0NE5EQXdNelFnTUM0eU1EazVPVElnTUM0NE16ZzJNamtnTUM0eU1EWTJNREVnTUM0NE16WXhNamtnTUM0eU1EUXhNREZETUM0NE16TTJNamdnTUM0eU1ERTJJREF1T0RNd01qTTNJREF1TWpBd01UazFJREF1T0RJMk56QXhJREF1TWpBd01UazFTREF1TVRjek16WTRRekF1TVRZNU9ETXhJREF1TWpBd01UazFJREF1TVRZMk5EUWdNQzR5TURFMklEQXVNVFl6T1RNNUlEQXVNakEwTVRBeFF6QXVNVFl4TkRNNUlEQXVNakEyTmpBeElEQXVNVFl3TURNMElEQXVNakE1T1RreUlEQXVNVFl3TURNMElEQXVNakV6TlRJNVZqQXVNalF5TlRrMVF6QXVNVFl3TURNMElEQXVNalEyTVRNeUlEQXVNVFl4TkRNNUlEQXVNalE1TlRJeklEQXVNVFl6T1RNNUlEQXVNalV5TURJelF6QXVNVFkyTkRRZ01DNHlOVFExTWpRZ01DNHhOams0TXpFZ01DNHlOVFU1TWprZ01DNHhOek16TmpnZ01DNHlOVFU1TWpsRE1DNHhPREEyT1RrZ01DNHlOVFkyTWpjZ01DNHhPRGMxTURjZ01DNHlOakF3TXpNZ01DNHhPVEkwTmpFZ01DNHlOalUwT0RKRE1DNHhPVGMwTVRZZ01DNHlOekE1TXpFZ01DNHlNREF4TmpFZ01DNHlOemd3TXpFZ01DNHlNREF4TmpFZ01DNHlPRFV6T1RWRE1DNHlNREF4TmpFZ01DNHlPVEkzTmlBd0xqRTVOelF4TmlBd0xqSTVPVGcySURBdU1Ua3lORFl4SURBdU16QTFNekE1UXpBdU1UZzNOVEEzSURBdU16RXdOelU0SURBdU1UZ3dOams1SURBdU16RTBNVFkwSURBdU1UY3pNelk0SURBdU16RTBPRFl5UXpBdU1UWTVPRE14SURBdU16RTBPRFl5SURBdU1UWTJORFFnTUM0ek1UWXlOamNnTUM0eE5qTTVNemtnTUM0ek1UZzNOamRETUM0eE5qRTBNemtnTUM0ek1qRXlOamdnTUM0eE5qQXdNelFnTUM0ek1qUTJOVGtnTUM0eE5qQXdNelFnTUM0ek1qZ3hPVFZXTUM0MU5qQXhPVFZETUM0eE5qQXdNelFnTUM0MU5qTTNNeklnTUM0eE5qRTBNemtnTUM0MU5qY3hNak1nTUM0eE5qTTVNemtnTUM0MU5qazJNak5ETUM0eE5qWTBOQ0F3TGpVM01qRXlOQ0F3TGpFMk9UZ3pNU0F3TGpVM016VXlPU0F3TGpFM016TTJPQ0F3TGpVM016VXlPVWd3TGpJNU16TTJPRll3TGpVME5qZzJNa2d3TGpJME1EQXpORll3TGpVek16VXlPVWd3TGpJNU16TTJPRll3TGpVd05qZzJNa2d3TGpJeU5qY3dNVU13TGpJeU16RTJOU0F3TGpVd05qZzJNaUF3TGpJeE9UYzNNeUF3TGpVd09ESTJOeUF3TGpJeE56STNNeUF3TGpVeE1EYzJOME13TGpJeE5EYzNNaUF3TGpVeE16STJPQ0F3TGpJeE16TTJPQ0F3TGpVeE5qWTFPU0F3TGpJeE16TTJPQ0F3TGpVeU1ERTVOVll3TGpVME5qZzJNa2d3TGpFNE5qY3dNVll3TGpNek9UYzVOVU13TGpFNU9ETTBOaUF3TGpNek5qSTBOeUF3TGpJd09EVTBNaUF3TGpNeU9UQTFNU0F3TGpJeE5UYzRPQ0F3TGpNeE9USTJPVU13TGpJeU16QXpNeUF3TGpNd09UUTROeUF3TGpJeU5qazBOQ0F3TGpJNU56WXpOU0F3TGpJeU5qazBOQ0F3TGpJNE5UUTJNa013TGpJeU5qazBOQ0F3TGpJM016STRPU0F3TGpJeU16QXpNeUF3TGpJMk1UUXpOeUF3TGpJeE5UYzRPQ0F3TGpJMU1UWTFOVU13TGpJd09EVTBNaUF3TGpJME1UZzNNeUF3TGpFNU9ETTBOaUF3TGpJek5EWTNOeUF3TGpFNE5qY3dNU0F3TGpJek1URXlPVll3TGpJeU5qZzJNa2d3TGpneE16TTJPRll3TGpJek1USTJNa013TGpnd01UZzVNeUF3TGpJek5EazFNaUF3TGpjNU1UZzROaUF3TGpJME1qRTROeUF3TGpjNE5EYzROeUF3TGpJMU1Ua3lOME13TGpjM056WTRPQ0F3TGpJMk1UWTJPQ0F3TGpjM016ZzJNeUF3TGpJM016UXdPU0F3TGpjM016ZzJNeUF3TGpJNE5UUTJNa013TGpjM016ZzJNeUF3TGpJNU56VXhOU0F3TGpjM056WTRPQ0F3TGpNd09USTFOaUF3TGpjNE5EYzROeUF3TGpNeE9EazVOa013TGpjNU1UZzROaUF3TGpNeU9EY3pOeUF3TGpnd01UZzVNeUF3TGpNek5UazNNaUF3TGpneE16TTJPQ0F3TGpNek9UWTJNbFl3TGpVME5qZzJNa2d3TGpnd01EQXpORll3TGpVeU1ERTVOVU13TGpnd01EQXpOQ0F3TGpVeE5qWTFPU0F3TGpjNU9EWXlPU0F3TGpVeE16STJPQ0F3TGpjNU5qRXlPU0F3TGpVeE1EYzJOME13TGpjNU16WXlPQ0F3TGpVd09ESTJOeUF3TGpjNU1ESXpOeUF3TGpVd05qZzJNaUF3TGpjNE5qY3dNU0F3TGpVd05qZzJNa2d3TGpjd05qY3dNVll3TGpVek16VXlPVWd3TGpjM016TTJPRll3TGpVME5qZzJNa2d3TGpjd05qY3dNVll3TGpVM016VXlPVWd3TGpneU5qY3dNVU13TGpnek1ESXpOeUF3TGpVM016VXlPU0F3TGpnek16WXlPQ0F3TGpVM01qRXlOQ0F3TGpnek5qRXlPU0F3TGpVMk9UWXlNME13TGpnek9EWXlPU0F3TGpVMk56RXlNeUF3TGpnME1EQXpOQ0F3TGpVMk16Y3pNaUF3TGpnME1EQXpOQ0F3TGpVMk1ERTVOVll3TGpNeU9ERTVOVU13TGpnME1EQXpOQ0F3TGpNeU5EWTFPU0F3TGpnek9EWXlPU0F3TGpNeU1USTJPQ0F3TGpnek5qRXlPU0F3TGpNeE9EYzJOME13TGpnek16WXlPQ0F3TGpNeE5qSTJOeUF3TGpnek1ESXpOeUF3TGpNeE5EZzJNaUF3TGpneU5qY3dNU0F3TGpNeE5EZzJNa013TGpneE9UUTVOQ0F3TGpNeE5EQXlJREF1T0RFeU9EUTRJREF1TXpFd05UWWdNQzQ0TURnd01qUWdNQzR6TURVeE5FTXdMamd3TXpJd01TQXdMakk1T1RjeUlEQXVPREF3TlRNMklEQXVNamt5TnpFNElEQXVPREF3TlRNMklEQXVNamcxTkRZeVF6QXVPREF3TlRNMklEQXVNamM0TWpBMklEQXVPREF6TWpBeElEQXVNamN4TWpBMElEQXVPREE0TURJMElEQXVNalkxTnpnMFF6QXVPREV5T0RRNElEQXVNall3TXpZMElEQXVPREU1TkRrMElEQXVNalUyT1RBMElEQXVPREkyTnpBeElEQXVNalUyTURZeVZqQXVNalUyTURZeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0OGNHRjBhQ0JrUFNKTk1DNDBPVE16TmpjZ01DNHpNek0wTVRoV01DNHlOalkzTlRGRE1DNDBPVE16TmpjZ01DNHlOak15TVRVZ01DNDBPVEU1TmpNZ01DNHlOVGs0TWpRZ01DNDBPRGswTmpJZ01DNHlOVGN6TWpORE1DNDBPRFk1TmpJZ01DNHlOVFE0TWpNZ01DNDBPRE0xTnlBd0xqSTFNelF4T0NBd0xqUTRNREF6TkNBd0xqSTFNelF4T0Vnd0xqTTROamN3TVVNd0xqTTRNekUyTkNBd0xqSTFNelF4T0NBd0xqTTNPVGMzTXlBd0xqSTFORGd5TXlBd0xqTTNOekkzTXlBd0xqSTFOek15TTBNd0xqTTNORGMzTWlBd0xqSTFPVGd5TkNBd0xqTTNNek0yTnlBd0xqSTJNekl4TlNBd0xqTTNNek0yTnlBd0xqSTJOamMxTVZZd0xqTTBOamMxTVVnd0xqUXdNREF6TkZZd0xqSTRNREE0TlVnd0xqUTJOamN3TVZZd0xqTXpNelF4T0Vnd0xqUTVNek0yTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrUEhCaGRHZ2daRDBpVFRBdU5qSTJOams1SURBdU16UTJOelV4VmpBdU1qWTJOelV4UXpBdU5qSTJOams1SURBdU1qWXpNakUxSURBdU5qSTFNamswSURBdU1qVTVPREkwSURBdU5qSXlOemt6SURBdU1qVTNNekl6UXpBdU5qSXdNamt6SURBdU1qVTBPREl6SURBdU5qRTJPVEF5SURBdU1qVXpOREU0SURBdU5qRXpNelkxSURBdU1qVXpOREU0U0RBdU5USXdNRE15UXpBdU5URTJORGsySURBdU1qVXpOREU0SURBdU5URXpNVEEwSURBdU1qVTBPREl6SURBdU5URXdOakEwSURBdU1qVTNNekl6UXpBdU5UQTRNVEF6SURBdU1qVTVPREkwSURBdU5UQTJOams1SURBdU1qWXpNakUxSURBdU5UQTJOams1SURBdU1qWTJOelV4VmpBdU16TXpOREU0U0RBdU5UTXpNelkxVmpBdU1qZ3dNRGcxU0RBdU5qQXdNRE15VmpBdU16UTJOelV4U0RBdU5qSTJOams1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejQ4Y0dGMGFDQmtQU0pOTUM0M01EWTJPVGNnTUM0ME5UTTBNVGhXTUM0ME9EQXdPRFZJTUM0M05EWTJPVGRETUM0M05UQXlNek1nTUM0ME9EQXdPRFVnTUM0M05UTTJNalFnTUM0ME56ZzJPQ0F3TGpjMU5qRXlOU0F3TGpRM05qRTNPVU13TGpjMU9EWXlOU0F3TGpRM016WTNPU0F3TGpjMk1EQXpJREF1TkRjd01qZzRJREF1TnpZd01ETWdNQzQwTmpZM05URldNQzR5TmpZM05URkRNQzQzTmpBd015QXdMakkyTXpJeE5TQXdMamMxT0RZeU5TQXdMakkxT1RneU5DQXdMamMxTmpFeU5TQXdMakkxTnpNeU0wTXdMamMxTXpZeU5DQXdMakkxTkRneU15QXdMamMxTURJek15QXdMakkxTXpReE9DQXdMamMwTmpZNU55QXdMakkxTXpReE9FZ3dMalkxTXpNMk0wTXdMalkwT1RneU55QXdMakkxTXpReE9DQXdMalkwTmpRek5pQXdMakkxTkRneU15QXdMalkwTXprek5TQXdMakkxTnpNeU0wTXdMalkwTVRRek5TQXdMakkxT1RneU5DQXdMalkwTURBeklEQXVNall6TWpFMUlEQXVOalF3TURNZ01DNHlOalkzTlRGV01DNHpOakF3T0RWSU1DNDJOalkyT1RkV01DNHlPREF3T0RWSU1DNDNNek16TmpOV01DNDBOVE0wTVRoSU1DNDNNRFkyT1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGp4d1lYUm9JR1E5SWswd0xqSTJOamN3TXlBd0xqSTRNREE0TlVnd0xqTXpNek0yT1ZZd0xqTTJNREE0TlVnd0xqTTJNREF6TmxZd0xqSTJOamMxTVVNd0xqTTJNREF6TmlBd0xqSTJNekl4TlNBd0xqTTFPRFl6TVNBd0xqSTFPVGd5TkNBd0xqTTFOakV6TVNBd0xqSTFOek15TTBNd0xqTTFNell6SURBdU1qVTBPREl6SURBdU16VXdNak01SURBdU1qVXpOREU0SURBdU16UTJOekF6SURBdU1qVXpOREU0U0RBdU1qVXpNelk1UXpBdU1qUTVPRE16SURBdU1qVXpOREU0SURBdU1qUTJORFF5SURBdU1qVTBPREl6SURBdU1qUXpPVFF4SURBdU1qVTNNekl6UXpBdU1qUXhORFF4SURBdU1qVTVPREkwSURBdU1qUXdNRE0ySURBdU1qWXpNakUxSURBdU1qUXdNRE0ySURBdU1qWTJOelV4VmpBdU5EWTJOelV4UXpBdU1qUXdNRE0ySURBdU5EY3dNamc0SURBdU1qUXhORFF4SURBdU5EY3pOamM1SURBdU1qUXpPVFF4SURBdU5EYzJNVGM1UXpBdU1qUTJORFF5SURBdU5EYzROamdnTUM0eU5EazRNek1nTUM0ME9EQXdPRFVnTUM0eU5UTXpOamtnTUM0ME9EQXdPRFZJTUM0eU9UTXpOamxXTUM0ME5UTTBNVGhJTUM0eU5qWTNNRE5XTUM0eU9EQXdPRFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQand2Wno0OEwyYytQR1JsWm5NK1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5WHpJek5qUmZNak14TkRJaUlIZ3hQU0l0TUM0eU1EY3hOamtpSUhreFBTSXhMakl3TnpJaUlIZ3lQU0l4TGpJd056RWlJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajQ4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqTWtVeU4wRkVJaTgrUEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5USTNSa1pHSWk4K1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0OFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6SXpOalJmTWpNeE5ESWlQanh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI1NSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWY3MjRmNjU3LTdiNTUtNGE5NC1iMjM1LTI5NWE3OGQwNGIzYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1FTEFTVElDQUNIRS1GT1ItUkVESVM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjQ5IiB5PSIyOS41IiB3aWR0aD0iMjI1IiBoZWlnaHQ9IjQxMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNTciIHZhbHVlPSJBV1MgRWxhc3RpQ2FjaGUiIHN0eWxlPSJpci5yZWY9NGVkMTlhYmYtZDVjYy00YzJmLTlhNTUtYjc5ZGM2YmEyMWUzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVsYXN0aWNhY2hlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHMWhjMnNnYVdROUltMWhjMnN3SWlCdFlYTnJMWFI1Y0dVOUltRnNjR2hoSWlCdFlYTnJWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCNFBTSXdJaUI1UFNJd0lpQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJajRtSTNoaE96eGphWEpqYkdVZ1kzZzlJakF1TlNJZ1kzazlJakF1TlNJZ2NqMGlNQzQxSWlCbWFXeHNQU0ppYkdGamF5SXZQaVlqZUdFN1BDOXRZWE5yUGlZamVHRTdQR2NnYldGemF6MGlkWEpzS0NOdFlYTnJNQ2tpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1TQXdTREJXTVVneFZqQmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURBeU1UTWdNQzR6TlRrNU9EVkRNQzQwTVRBM05EWWdNQzR6TlRrNU9EVWdNQzR6TVRrNU5EWWdNQzR6T0RNek1Ua2dNQzR6TVRrNU5EWWdNQzQwTWpjNU9EVldNQzQzTXpFNU9EVkRNQzR6TVRrNU5EWWdNQzQzTnpZMk5USWdNQzQwTVRBek5EWWdNQzQzT1RrNU9EVWdNQzQwT1RrNE1UTWdNQzQzT1RrNU9EVkRNQzQxT0RreU9DQXdMamM1T1RrNE5TQXdMalkzT1RrME5pQXdMamMzTmpZMU1pQXdMalkzT1RrME5pQXdMamN6TVRrNE5WWXdMalF5TnprNE5VTXdMalkzT1RrME5pQXdMak00TXpNeE9TQXdMalU0T1RReE15QXdMak0xT1RrNE5TQXdMalV3TURJeE15QXdMak0xT1RrNE5WcE5NQzQxTURBeU1UTWdNQzQzTnpNek1UbERNQzQwTURFd01UTWdNQzQzTnpNek1Ua2dNQzR6TkRZMk1UTWdNQzQzTkRZMk5USWdNQzR6TkRZMk1UTWdNQzQzTXpFNU9EVldNQzQyTmpjNE5USkRNQzR6TnprNU5EWWdNQzQyT0RneE1Ua2dNQzQwTXprNU5EWWdNQzQyT1RnMk5USWdNQzQwT1RrNE1UTWdNQzQyT1RnMk5USkRNQzQxTlRrMk9DQXdMalk1T0RZMU1pQXdMall4T1RneE15QXdMalk0T0RFeE9TQXdMalkxTWpnNElEQXVOalkzT1RnMVZqQXVOek14T1RnMVF6QXVOalV6TWpnZ01DNDNORFkyTlRJZ01DNDFPVGt4TkRZZ01DNDNOek16TVRrZ01DNDFNREF5TVRNZ01DNDNOek16TVRsYVRUQXVOVEF3TWpFeklEQXVOamN4T1RnMVF6QXVOREF4TURFeklEQXVOamN4T1RnMUlEQXVNelEzTURFeklEQXVOalExTXpFNUlEQXVNelEzTURFeklEQXVOak13TmpVeVZqQXVOVFkyTmpVeVF6QXVNemd3TXpRMklEQXVOVGcyTnpnMUlEQXVORFF3TXpRMklEQXVOVGszTXpFNUlEQXVOVEF3TWpFeklEQXVOVGszTXpFNVF6QXVOVFl3TURnZ01DNDFPVGN6TVRrZ01DNDJNakF5TVRNZ01DNDFPRFkzT0RVZ01DNDJOVE15T0NBd0xqVTJOalkxTWxZd0xqWXpNRFkxTWtNd0xqWTFNekk0SURBdU5qUTBOalV5SURBdU5UazVNVFEySURBdU5qY3hPVGcxSURBdU5UQXdNakV6SURBdU5qY3hPVGcxV2swd0xqVXdNREl4TXlBd0xqVTNNRFkxTWtNd0xqUXdNVEF4TXlBd0xqVTNNRFkxTWlBd0xqTTBOekF4TXlBd0xqVTBNems0TlNBd0xqTTBOekF4TXlBd0xqVXlPVE14T1ZZd0xqUTJOVEU0TlVNd0xqTTRNRE0wTmlBd0xqUTROVFExTWlBd0xqUTBNRE0wTmlBd0xqUTVOVGs0TlNBd0xqVXdNREl4TXlBd0xqUTVOVGs0TlVNd0xqVTJNREE0SURBdU5EazFPVGcxSURBdU5qSXdNakV6SURBdU5EZzFORFV5SURBdU5qVXpNamdnTUM0ME5qVXhPRFZXTUM0MU1qa3pNVGxETUM0Mk5UTXlPQ0F3TGpVME16TXhPU0F3TGpVNU9URTBOaUF3TGpVM01EWTFNaUF3TGpVd01ESXhNeUF3TGpVM01EWTFNbHBOTUM0MU1EQXlNVE1nTUM0ME5qa3pNVGxETUM0ME1ERXdNVE1nTUM0ME5qa3pNVGtnTUM0ek5EWTJNVE1nTUM0ME5ERTVPRFVnTUM0ek5EWTJNVE1nTUM0ME1qYzVPRFZETUM0ek5EWTJNVE1nTUM0ME1UTTVPRFVnTUM0ek9UazVORFlnTUM0ek9EWTJOVElnTUM0ME9UazRNVE1nTUM0ek9EWTJOVEpETUM0MU9UazJPQ0F3TGpNNE5qWTFNaUF3TGpZMU16STRJREF1TkRFek9UZzFJREF1TmpVek1qZ2dNQzQwTWpjNU9EVkRNQzQyTlRNeU9DQXdMalEwTVRrNE5TQXdMalU1T1RFME5pQXdMalEyT1RNeE9TQXdMalV3TURJeE15QXdMalEyT1RNeE9WWXdMalEyT1RNeE9Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1qWTNNREVnTUM0eU5UVTRNVGhETUM0NE16QXlNemNnTUM0eU5UVTRNVGdnTUM0NE16TTJNamdnTUM0eU5UUTBNVE1nTUM0NE16WXhNamtnTUM0eU5URTVNVE5ETUM0NE16ZzJNamtnTUM0eU5EazBNVElnTUM0NE5EQXdNelFnTUM0eU5EWXdNakVnTUM0NE5EQXdNelFnTUM0eU5ESTBPRFZXTUM0eU1UTXlPRFZETUM0NE5EQXdNelFnTUM0eU1EazNORGdnTUM0NE16ZzJNamtnTUM0eU1EWXpOVGNnTUM0NE16WXhNamtnTUM0eU1ETTROVFpETUM0NE16TTJNamdnTUM0eU1ERXpOVFlnTUM0NE16QXlNemNnTUM0eE9UazVOVEVnTUM0NE1qWTNNREVnTUM0eE9UazVOVEZJTUM0eE56TXpOamhETUM0eE5qazRNekVnTUM0eE9UazVOVEVnTUM0eE5qWTBOQ0F3TGpJd01UTTFOaUF3TGpFMk16a3pPU0F3TGpJd016ZzFOa013TGpFMk1UUXpPU0F3TGpJd05qTTFOeUF3TGpFMk1EQXpOQ0F3TGpJd09UYzBPQ0F3TGpFMk1EQXpOQ0F3TGpJeE16STROVll3TGpJME1qTTFNVU13TGpFMk1EQXpOQ0F3TGpJME5UZzROeUF3TGpFMk1UUXpPU0F3TGpJME9USTNPU0F3TGpFMk16a3pPU0F3TGpJMU1UYzNPVU13TGpFMk5qUTBJREF1TWpVME1qZ2dNQzR4TmprNE16RWdNQzR5TlRVMk9EUWdNQzR4TnpNek5qZ2dNQzR5TlRVMk9EUkRNQzR4T0RBMk9Ua2dNQzR5TlRZek9ETWdNQzR4T0RjMU1EY2dNQzR5TlRrM09Ea2dNQzR4T1RJME5qRWdNQzR5TmpVeU16aERNQzR4T1RjME1UWWdNQzR5TnpBMk9EY2dNQzR5TURBeE5qRWdNQzR5TnpjM09EY2dNQzR5TURBeE5qRWdNQzR5T0RVeE5URkRNQzR5TURBeE5qRWdNQzR5T1RJMU1UWWdNQzR4T1RjME1UWWdNQzR5T1RrMk1UWWdNQzR4T1RJME5qRWdNQzR6TURVd05qVkRNQzR4T0RjMU1EY2dNQzR6TVRBMU1UTWdNQzR4T0RBMk9Ua2dNQzR6TVRNNU1pQXdMakUzTXpNMk9DQXdMak14TkRZeE9FTXdMakUyT1Rnek1TQXdMak14TkRZeE9DQXdMakUyTmpRMElEQXVNekUyTURJeklEQXVNVFl6T1RNNUlEQXVNekU0TlRJelF6QXVNVFl4TkRNNUlEQXVNekl4TURJMElEQXVNVFl3TURNMElEQXVNekkwTkRFMUlEQXVNVFl3TURNMElEQXVNekkzT1RVeFZqQXVOVFU1T1RVeFF6QXVNVFl3TURNMElEQXVOVFl6TkRnM0lEQXVNVFl4TkRNNUlEQXVOVFkyT0RjNUlEQXVNVFl6T1RNNUlEQXVOVFk1TXpjNVF6QXVNVFkyTkRRZ01DNDFOekU0T0NBd0xqRTJPVGd6TVNBd0xqVTNNekk0TkNBd0xqRTNNek0yT0NBd0xqVTNNekk0TkVnd0xqSTVNek0yT0ZZd0xqVTBOall4T0Vnd0xqSTBNREF6TkZZd0xqVXpNekk0TkVnd0xqSTVNek0yT0ZZd0xqVXdOall4T0Vnd0xqSXlOamN3TVVNd0xqSXlNekUyTlNBd0xqVXdOall4T0NBd0xqSXhPVGMzTXlBd0xqVXdPREF5TXlBd0xqSXhOekkzTXlBd0xqVXhNRFV5TTBNd0xqSXhORGMzTWlBd0xqVXhNekF5TXlBd0xqSXhNek0yT0NBd0xqVXhOalF4TlNBd0xqSXhNek0yT0NBd0xqVXhPVGsxTVZZd0xqVTBOall4T0Vnd0xqRTROamN3TVZZd0xqTXpPVFUxTVVNd0xqRTVPRE0wTmlBd0xqTXpOakF3TXlBd0xqSXdPRFUwTWlBd0xqTXlPRGd3TnlBd0xqSXhOVGM0T0NBd0xqTXhPVEF5TlVNd0xqSXlNekF6TXlBd0xqTXdPVEkwTWlBd0xqSXlOamswTkNBd0xqSTVOek01TVNBd0xqSXlOamswTkNBd0xqSTROVEl4T0VNd0xqSXlOamswTkNBd0xqSTNNekEwTlNBd0xqSXlNekF6TXlBd0xqSTJNVEU1TXlBd0xqSXhOVGM0T0NBd0xqSTFNVFF4TVVNd0xqSXdPRFUwTWlBd0xqSTBNVFl5T1NBd0xqRTVPRE0wTmlBd0xqSXpORFF6TXlBd0xqRTROamN3TVNBd0xqSXpNRGc0TkZZd0xqSXlOall4T0Vnd0xqZ3hNek0yT0ZZd0xqSXpNVEF4T0VNd0xqZ3dNVGc1TXlBd0xqSXpORGN3TnlBd0xqYzVNVGc0TmlBd0xqSTBNVGswTXlBd0xqYzRORGM0TnlBd0xqSTFNVFk0TTBNd0xqYzNOelk0T0NBd0xqSTJNVFF5TXlBd0xqYzNNemcyTXlBd0xqSTNNekUyTlNBd0xqYzNNemcyTXlBd0xqSTROVEl4T0VNd0xqYzNNemcyTXlBd0xqSTVOekkzTVNBd0xqYzNOelk0T0NBd0xqTXdPVEF4TWlBd0xqYzRORGM0TnlBd0xqTXhPRGMxTWtNd0xqYzVNVGc0TmlBd0xqTXlPRFE1TWlBd0xqZ3dNVGc1TXlBd0xqTXpOVGN5T0NBd0xqZ3hNek0yT0NBd0xqTXpPVFF4T0ZZd0xqVTBOall4T0Vnd0xqZ3dNREF6TkZZd0xqVXhPVGsxTVVNd0xqZ3dNREF6TkNBd0xqVXhOalF4TlNBd0xqYzVPRFl5T1NBd0xqVXhNekF5TXlBd0xqYzVOakV5T1NBd0xqVXhNRFV5TTBNd0xqYzVNell5T0NBd0xqVXdPREF5TXlBd0xqYzVNREl6TnlBd0xqVXdOall4T0NBd0xqYzROamN3TVNBd0xqVXdOall4T0Vnd0xqY3dOamN3TVZZd0xqVXpNekk0TkVnd0xqYzNNek0yT0ZZd0xqVTBOall4T0Vnd0xqY3dOamN3TVZZd0xqVTNNekk0TkVnd0xqZ3lOamN3TVVNd0xqZ3pNREl6TnlBd0xqVTNNekk0TkNBd0xqZ3pNell5T0NBd0xqVTNNVGc0SURBdU9ETTJNVEk1SURBdU5UWTVNemM1UXpBdU9ETTROakk1SURBdU5UWTJPRGM1SURBdU9EUXdNRE0wSURBdU5UWXpORGczSURBdU9EUXdNRE0wSURBdU5UVTVPVFV4VmpBdU16STNPVFV4UXpBdU9EUXdNRE0wSURBdU16STBOREUxSURBdU9ETTROakk1SURBdU16SXhNREkwSURBdU9ETTJNVEk1SURBdU16RTROVEl6UXpBdU9ETXpOakk0SURBdU16RTJNREl6SURBdU9ETXdNak0zSURBdU16RTBOakU0SURBdU9ESTJOekF4SURBdU16RTBOakU0UXpBdU9ERTVORGswSURBdU16RXpOemMySURBdU9ERXlPRFE0SURBdU16RXdNekUySURBdU9EQTRNREkwSURBdU16QTBPRGsyUXpBdU9EQXpNakF4SURBdU1qazVORGMySURBdU9EQXdOVE0ySURBdU1qa3lORGN6SURBdU9EQXdOVE0ySURBdU1qZzFNakU0UXpBdU9EQXdOVE0ySURBdU1qYzNPVFl5SURBdU9EQXpNakF4SURBdU1qY3dPVFU1SURBdU9EQTRNREkwSURBdU1qWTFOVE01UXpBdU9ERXlPRFE0SURBdU1qWXdNVEU1SURBdU9ERTVORGswSURBdU1qVTJOallnTUM0NE1qWTNNREVnTUM0eU5UVTRNVGhXTUM0eU5UVTRNVGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGt6TWpreElEQXVNek16TWprMlZqQXVNalkyTmpJNVF6QXVORGt6TWpreElEQXVNall6TURreklEQXVORGt4T0RnMklEQXVNalU1TnpBeUlEQXVORGc1TXpnMklEQXVNalUzTWpBeFF6QXVORGcyT0RnMUlEQXVNalUwTnpBeElEQXVORGd6TkRrMElEQXVNalV6TWprMklEQXVORGM1T1RVNElEQXVNalV6TWprMlNEQXVNemcyTmpJMFF6QXVNemd6TURnNElEQXVNalV6TWprMklEQXVNemM1TmprM0lEQXVNalUwTnpBeElEQXVNemMzTVRrMklEQXVNalUzTWpBeFF6QXVNemMwTmprMklEQXVNalU1TnpBeUlEQXVNemN6TWpreElEQXVNall6TURreklEQXVNemN6TWpreElEQXVNalkyTmpJNVZqQXVNelEyTmpJNVNEQXVNems1T1RVNFZqQXVNamM1T1RZelNEQXVORFkyTmpJMFZqQXVNek16TWprMlNEQXVORGt6TWpreFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZeU5qY3hOQ0F3TGpNME5qWXlPVll3TGpJMk5qWXlPVU13TGpZeU5qY3hOQ0F3TGpJMk16QTVNeUF3TGpZeU5UTXdPU0F3TGpJMU9UY3dNaUF3TGpZeU1qZ3dPU0F3TGpJMU56SXdNVU13TGpZeU1ETXdPQ0F3TGpJMU5EY3dNU0F3TGpZeE5qa3hOeUF3TGpJMU16STVOaUF3TGpZeE16TTRNU0F3TGpJMU16STVOa2d3TGpVeU1EQTBOME13TGpVeE5qVXhNU0F3TGpJMU16STVOaUF3TGpVeE16RXlJREF1TWpVME56QXhJREF1TlRFd05qRTVJREF1TWpVM01qQXhRekF1TlRBNE1URTVJREF1TWpVNU56QXlJREF1TlRBMk56RTBJREF1TWpZek1Ea3pJREF1TlRBMk56RTBJREF1TWpZMk5qSTVWakF1TXpNek1qazJTREF1TlRNek16Z3hWakF1TWpjNU9UWXpTREF1TmpBd01EUTNWakF1TXpRMk5qSTVTREF1TmpJMk56RTBXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3dOalk0TVNBd0xqUTFNekk1TmxZd0xqUTNPVGsyTTBnd0xqYzBOalk0TVVNd0xqYzFNREl4T0NBd0xqUTNPVGsyTXlBd0xqYzFNell3T1NBd0xqUTNPRFUxT0NBd0xqYzFOakV3T1NBd0xqUTNOakExTjBNd0xqYzFPRFl4SURBdU5EY3pOVFUzSURBdU56WXdNREUxSURBdU5EY3dNVFkxSURBdU56WXdNREUxSURBdU5EWTJOakk1VmpBdU1qWTJOakk1UXpBdU56WXdNREUxSURBdU1qWXpNRGt6SURBdU56VTROakVnTUM0eU5UazNNRElnTUM0M05UWXhNRGtnTUM0eU5UY3lNREZETUM0M05UTTJNRGtnTUM0eU5UUTNNREVnTUM0M05UQXlNVGdnTUM0eU5UTXlPVFlnTUM0M05EWTJPREVnTUM0eU5UTXlPVFpJTUM0Mk5UTXpORGhETUM0Mk5EazRNVElnTUM0eU5UTXlPVFlnTUM0Mk5EWTBNaUF3TGpJMU5EY3dNU0F3TGpZME16a3lJREF1TWpVM01qQXhRekF1TmpReE5ERTVJREF1TWpVNU56QXlJREF1TmpRd01ERTFJREF1TWpZek1Ea3pJREF1TmpRd01ERTFJREF1TWpZMk5qSTVWakF1TXpVNU9UWXpTREF1TmpZMk5qZ3hWakF1TWpjNU9UWXpTREF1TnpNek16UTRWakF1TkRVek1qazJTREF1TnpBMk5qZ3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqSTJOalkxTnlBd0xqSTNPVGsyTTBnd0xqTXpNek15TkZZd0xqTTFPVGsyTTBnd0xqTTFPVGs1VmpBdU1qWTJOakk1UXpBdU16VTVPVGtnTUM0eU5qTXdPVE1nTUM0ek5UZzFPRFlnTUM0eU5UazNNRElnTUM0ek5UWXdPRFVnTUM0eU5UY3lNREZETUM0ek5UTTFPRFVnTUM0eU5UUTNNREVnTUM0ek5UQXhPVE1nTUM0eU5UTXlPVFlnTUM0ek5EWTJOVGNnTUM0eU5UTXlPVFpJTUM0eU5UTXpNalJETUM0eU5EazNPRGNnTUM0eU5UTXlPVFlnTUM0eU5EWXpPVFlnTUM0eU5UUTNNREVnTUM0eU5ETTRPVFVnTUM0eU5UY3lNREZETUM0eU5ERXpPVFVnTUM0eU5UazNNRElnTUM0eU16azVPU0F3TGpJMk16QTVNeUF3TGpJek9UazVJREF1TWpZMk5qSTVWakF1TkRZMk5qSTVRekF1TWpNNU9Ua2dNQzQwTnpBeE5qVWdNQzR5TkRFek9UVWdNQzQwTnpNMU5UY2dNQzR5TkRNNE9UVWdNQzQwTnpZd05UZERNQzR5TkRZek9UWWdNQzQwTnpnMU5UZ2dNQzR5TkRrM09EY2dNQzQwTnprNU5qTWdNQzR5TlRNek1qUWdNQzQwTnprNU5qTklNQzR5T1RNek1qUldNQzQwTlRNeU9UWklNQzR5TmpZMk5UZFdNQzR5TnprNU5qTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXRNQzR5TURjeUlpQjVNVDBpTVM0eU1EY3lJaUI0TWowaU1TNHlNRGN3TnlJZ2VUSTlJaTB3TGpJd056QTJOeUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpKRk1qZEJSQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTlRJM1JrWkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNTUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjcuNSIgeT0iMjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjU2IiB2YWx1ZT0iQVdTIEVsYXN0aUNhY2hlIiBzdHlsZT0iaXIucmVmPWU5NWUyYjg3LTc4ZGQtNDY5MS1hYmJlLTczMDVjNTJiZTc4MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbGFzdGljYWNoZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1EQXlNVE1nTUM0ek5UazVPRFZETUM0ME1UQTNORFlnTUM0ek5UazVPRFVnTUM0ek1UazVORFlnTUM0ek9ETXpNVGtnTUM0ek1UazVORFlnTUM0ME1qYzVPRFZXTUM0M016RTVPRFZETUM0ek1UazVORFlnTUM0M056WTJOVElnTUM0ME1UQXpORFlnTUM0M09UazVPRFVnTUM0ME9UazRNVE1nTUM0M09UazVPRFZETUM0MU9Ea3lPQ0F3TGpjNU9UazROU0F3TGpZM09UazBOaUF3TGpjM05qWTFNaUF3TGpZM09UazBOaUF3TGpjek1UazROVll3TGpReU56azROVU13TGpZM09UazBOaUF3TGpNNE16TXhPU0F3TGpVNE9UUXhNeUF3TGpNMU9UazROU0F3TGpVd01ESXhNeUF3TGpNMU9UazROVnBOTUM0MU1EQXlNVE1nTUM0M056TXpNVGxETUM0ME1ERXdNVE1nTUM0M056TXpNVGtnTUM0ek5EWTJNVE1nTUM0M05EWTJOVElnTUM0ek5EWTJNVE1nTUM0M016RTVPRFZXTUM0Mk5qYzROVEpETUM0ek56azVORFlnTUM0Mk9EZ3hNVGtnTUM0ME16azVORFlnTUM0Mk9UZzJOVElnTUM0ME9UazRNVE1nTUM0Mk9UZzJOVEpETUM0MU5UazJPQ0F3TGpZNU9EWTFNaUF3TGpZeE9UZ3hNeUF3TGpZNE9ERXhPU0F3TGpZMU1qZzRJREF1TmpZM09UZzFWakF1TnpNeE9UZzFRekF1TmpVek1qZ2dNQzQzTkRZMk5USWdNQzQxT1RreE5EWWdNQzQzTnpNek1Ua2dNQzQxTURBeU1UTWdNQzQzTnpNek1UbGFUVEF1TlRBd01qRXpJREF1TmpjeE9UZzFRekF1TkRBeE1ERXpJREF1TmpjeE9UZzFJREF1TXpRM01ERXpJREF1TmpRMU16RTVJREF1TXpRM01ERXpJREF1TmpNd05qVXlWakF1TlRZMk5qVXlRekF1TXpnd016UTJJREF1TlRnMk56ZzFJREF1TkRRd016UTJJREF1TlRrM016RTVJREF1TlRBd01qRXpJREF1TlRrM016RTVRekF1TlRZd01EZ2dNQzQxT1Rjek1Ua2dNQzQyTWpBeU1UTWdNQzQxT0RZM09EVWdNQzQyTlRNeU9DQXdMalUyTmpZMU1sWXdMall6TURZMU1rTXdMalkxTXpJNElEQXVOalEwTmpVeUlEQXVOVGs1TVRRMklEQXVOamN4T1RnMUlEQXVOVEF3TWpFeklEQXVOamN4T1RnMVdrMHdMalV3TURJeE15QXdMalUzTURZMU1rTXdMalF3TVRBeE15QXdMalUzTURZMU1pQXdMak0wTnpBeE15QXdMalUwTXprNE5TQXdMak0wTnpBeE15QXdMalV5T1RNeE9WWXdMalEyTlRFNE5VTXdMak00TURNME5pQXdMalE0TlRRMU1pQXdMalEwTURNME5pQXdMalE1TlRrNE5TQXdMalV3TURJeE15QXdMalE1TlRrNE5VTXdMalUyTURBNElEQXVORGsxT1RnMUlEQXVOakl3TWpFeklEQXVORGcxTkRVeUlEQXVOalV6TWpnZ01DNDBOalV4T0RWV01DNDFNamt6TVRsRE1DNDJOVE15T0NBd0xqVTBNek14T1NBd0xqVTVPVEUwTmlBd0xqVTNNRFkxTWlBd0xqVXdNREl4TXlBd0xqVTNNRFkxTWxwTk1DNDFNREF5TVRNZ01DNDBOamt6TVRsRE1DNDBNREV3TVRNZ01DNDBOamt6TVRrZ01DNHpORFkyTVRNZ01DNDBOREU1T0RVZ01DNHpORFkyTVRNZ01DNDBNamM1T0RWRE1DNHpORFkyTVRNZ01DNDBNVE01T0RVZ01DNHpPVGs1TkRZZ01DNHpPRFkyTlRJZ01DNDBPVGs0TVRNZ01DNHpPRFkyTlRKRE1DNDFPVGsyT0NBd0xqTTROalkxTWlBd0xqWTFNekk0SURBdU5ERXpPVGcxSURBdU5qVXpNamdnTUM0ME1qYzVPRFZETUM0Mk5UTXlPQ0F3TGpRME1UazROU0F3TGpVNU9URTBOaUF3TGpRMk9UTXhPU0F3TGpVd01ESXhNeUF3TGpRMk9UTXhPVll3TGpRMk9UTXhPVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNalkzTURFZ01DNHlOVFU0TVRoRE1DNDRNekF5TXpjZ01DNHlOVFU0TVRnZ01DNDRNek0yTWpnZ01DNHlOVFEwTVRNZ01DNDRNell4TWprZ01DNHlOVEU1TVRORE1DNDRNemcyTWprZ01DNHlORGswTVRJZ01DNDROREF3TXpRZ01DNHlORFl3TWpFZ01DNDROREF3TXpRZ01DNHlOREkwT0RWV01DNHlNVE15T0RWRE1DNDROREF3TXpRZ01DNHlNRGszTkRnZ01DNDRNemcyTWprZ01DNHlNRFl6TlRjZ01DNDRNell4TWprZ01DNHlNRE00TlRaRE1DNDRNek0yTWpnZ01DNHlNREV6TlRZZ01DNDRNekF5TXpjZ01DNHhPVGs1TlRFZ01DNDRNalkzTURFZ01DNHhPVGs1TlRGSU1DNHhOek16TmpoRE1DNHhOams0TXpFZ01DNHhPVGs1TlRFZ01DNHhOalkwTkNBd0xqSXdNVE0xTmlBd0xqRTJNemt6T1NBd0xqSXdNemcxTmtNd0xqRTJNVFF6T1NBd0xqSXdOak0xTnlBd0xqRTJNREF6TkNBd0xqSXdPVGMwT0NBd0xqRTJNREF6TkNBd0xqSXhNekk0TlZZd0xqSTBNak0xTVVNd0xqRTJNREF6TkNBd0xqSTBOVGc0TnlBd0xqRTJNVFF6T1NBd0xqSTBPVEkzT1NBd0xqRTJNemt6T1NBd0xqSTFNVGMzT1VNd0xqRTJOalEwSURBdU1qVTBNamdnTUM0eE5qazRNekVnTUM0eU5UVTJPRFFnTUM0eE56TXpOamdnTUM0eU5UVTJPRFJETUM0eE9EQTJPVGtnTUM0eU5UWXpPRE1nTUM0eE9EYzFNRGNnTUM0eU5UazNPRGtnTUM0eE9USTBOakVnTUM0eU5qVXlNemhETUM0eE9UYzBNVFlnTUM0eU56QTJPRGNnTUM0eU1EQXhOakVnTUM0eU56YzNPRGNnTUM0eU1EQXhOakVnTUM0eU9EVXhOVEZETUM0eU1EQXhOakVnTUM0eU9USTFNVFlnTUM0eE9UYzBNVFlnTUM0eU9UazJNVFlnTUM0eE9USTBOakVnTUM0ek1EVXdOalZETUM0eE9EYzFNRGNnTUM0ek1UQTFNVE1nTUM0eE9EQTJPVGtnTUM0ek1UTTVNaUF3TGpFM016TTJPQ0F3TGpNeE5EWXhPRU13TGpFMk9UZ3pNU0F3TGpNeE5EWXhPQ0F3TGpFMk5qUTBJREF1TXpFMk1ESXpJREF1TVRZek9UTTVJREF1TXpFNE5USXpRekF1TVRZeE5ETTVJREF1TXpJeE1ESTBJREF1TVRZd01ETTBJREF1TXpJME5ERTFJREF1TVRZd01ETTBJREF1TXpJM09UVXhWakF1TlRVNU9UVXhRekF1TVRZd01ETTBJREF1TlRZek5EZzNJREF1TVRZeE5ETTVJREF1TlRZMk9EYzVJREF1TVRZek9UTTVJREF1TlRZNU16YzVRekF1TVRZMk5EUWdNQzQxTnpFNE9DQXdMakUyT1Rnek1TQXdMalUzTXpJNE5DQXdMakUzTXpNMk9DQXdMalUzTXpJNE5FZ3dMakk1TXpNMk9GWXdMalUwTmpZeE9FZ3dMakkwTURBek5GWXdMalV6TXpJNE5FZ3dMakk1TXpNMk9GWXdMalV3TmpZeE9FZ3dMakl5Tmpjd01VTXdMakl5TXpFMk5TQXdMalV3TmpZeE9DQXdMakl4T1RjM015QXdMalV3T0RBeU15QXdMakl4TnpJM015QXdMalV4TURVeU0wTXdMakl4TkRjM01pQXdMalV4TXpBeU15QXdMakl4TXpNMk9DQXdMalV4TmpReE5TQXdMakl4TXpNMk9DQXdMalV4T1RrMU1WWXdMalUwTmpZeE9FZ3dMakU0Tmpjd01WWXdMak16T1RVMU1VTXdMakU1T0RNME5pQXdMak16TmpBd015QXdMakl3T0RVME1pQXdMak15T0Rnd055QXdMakl4TlRjNE9DQXdMak14T1RBeU5VTXdMakl5TXpBek15QXdMak13T1RJME1pQXdMakl5TmprME5DQXdMakk1TnpNNU1TQXdMakl5TmprME5DQXdMakk0TlRJeE9FTXdMakl5TmprME5DQXdMakkzTXpBME5TQXdMakl5TXpBek15QXdMakkyTVRFNU15QXdMakl4TlRjNE9DQXdMakkxTVRReE1VTXdMakl3T0RVME1pQXdMakkwTVRZeU9TQXdMakU1T0RNME5pQXdMakl6TkRRek15QXdMakU0Tmpjd01TQXdMakl6TURnNE5GWXdMakl5TmpZeE9FZ3dMamd4TXpNMk9GWXdMakl6TVRBeE9FTXdMamd3TVRnNU15QXdMakl6TkRjd055QXdMamM1TVRnNE5pQXdMakkwTVRrME15QXdMamM0TkRjNE55QXdMakkxTVRZNE0wTXdMamMzTnpZNE9DQXdMakkyTVRReU15QXdMamMzTXpnMk15QXdMakkzTXpFMk5TQXdMamMzTXpnMk15QXdMakk0TlRJeE9FTXdMamMzTXpnMk15QXdMakk1TnpJM01TQXdMamMzTnpZNE9DQXdMak13T1RBeE1pQXdMamM0TkRjNE55QXdMak14T0RjMU1rTXdMamM1TVRnNE5pQXdMak15T0RRNU1pQXdMamd3TVRnNU15QXdMak16TlRjeU9DQXdMamd4TXpNMk9DQXdMak16T1RReE9GWXdMalUwTmpZeE9FZ3dMamd3TURBek5GWXdMalV4T1RrMU1VTXdMamd3TURBek5DQXdMalV4TmpReE5TQXdMamM1T0RZeU9TQXdMalV4TXpBeU15QXdMamM1TmpFeU9TQXdMalV4TURVeU0wTXdMamM1TXpZeU9DQXdMalV3T0RBeU15QXdMamM1TURJek55QXdMalV3TmpZeE9DQXdMamM0Tmpjd01TQXdMalV3TmpZeE9FZ3dMamN3Tmpjd01WWXdMalV6TXpJNE5FZ3dMamMzTXpNMk9GWXdMalUwTmpZeE9FZ3dMamN3Tmpjd01WWXdMalUzTXpJNE5FZ3dMamd5Tmpjd01VTXdMamd6TURJek55QXdMalUzTXpJNE5DQXdMamd6TXpZeU9DQXdMalUzTVRnNElEQXVPRE0yTVRJNUlEQXVOVFk1TXpjNVF6QXVPRE00TmpJNUlEQXVOVFkyT0RjNUlEQXVPRFF3TURNMElEQXVOVFl6TkRnM0lEQXVPRFF3TURNMElEQXVOVFU1T1RVeFZqQXVNekkzT1RVeFF6QXVPRFF3TURNMElEQXVNekkwTkRFMUlEQXVPRE00TmpJNUlEQXVNekl4TURJMElEQXVPRE0yTVRJNUlEQXVNekU0TlRJelF6QXVPRE16TmpJNElEQXVNekUyTURJeklEQXVPRE13TWpNM0lEQXVNekUwTmpFNElEQXVPREkyTnpBeElEQXVNekUwTmpFNFF6QXVPREU1TkRrMElEQXVNekV6TnpjMklEQXVPREV5T0RRNElEQXVNekV3TXpFMklEQXVPREE0TURJMElEQXVNekEwT0RrMlF6QXVPREF6TWpBeElEQXVNams1TkRjMklEQXVPREF3TlRNMklEQXVNamt5TkRjeklEQXVPREF3TlRNMklEQXVNamcxTWpFNFF6QXVPREF3TlRNMklEQXVNamMzT1RZeUlEQXVPREF6TWpBeElEQXVNamN3T1RVNUlEQXVPREE0TURJMElEQXVNalkxTlRNNVF6QXVPREV5T0RRNElEQXVNall3TVRFNUlEQXVPREU1TkRrMElEQXVNalUyTmpZZ01DNDRNalkzTURFZ01DNHlOVFU0TVRoV01DNHlOVFU0TVRoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrek1qa3hJREF1TXpNek1qazJWakF1TWpZMk5qSTVRekF1TkRrek1qa3hJREF1TWpZek1Ea3pJREF1TkRreE9EZzJJREF1TWpVNU56QXlJREF1TkRnNU16ZzJJREF1TWpVM01qQXhRekF1TkRnMk9EZzFJREF1TWpVME56QXhJREF1TkRnek5EazBJREF1TWpVek1qazJJREF1TkRjNU9UVTRJREF1TWpVek1qazJTREF1TXpnMk5qSTBRekF1TXpnek1EZzRJREF1TWpVek1qazJJREF1TXpjNU5qazNJREF1TWpVME56QXhJREF1TXpjM01UazJJREF1TWpVM01qQXhRekF1TXpjME5qazJJREF1TWpVNU56QXlJREF1TXpjek1qa3hJREF1TWpZek1Ea3pJREF1TXpjek1qa3hJREF1TWpZMk5qSTVWakF1TXpRMk5qSTVTREF1TXprNU9UVTRWakF1TWpjNU9UWXpTREF1TkRZMk5qSTBWakF1TXpNek1qazJTREF1TkRrek1qa3hXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWXlOamN4TkNBd0xqTTBOall5T1ZZd0xqSTJOall5T1VNd0xqWXlOamN4TkNBd0xqSTJNekE1TXlBd0xqWXlOVE13T1NBd0xqSTFPVGN3TWlBd0xqWXlNamd3T1NBd0xqSTFOekl3TVVNd0xqWXlNRE13T0NBd0xqSTFORGN3TVNBd0xqWXhOamt4TnlBd0xqSTFNekk1TmlBd0xqWXhNek00TVNBd0xqSTFNekk1Tmtnd0xqVXlNREEwTjBNd0xqVXhOalV4TVNBd0xqSTFNekk1TmlBd0xqVXhNekV5SURBdU1qVTBOekF4SURBdU5URXdOakU1SURBdU1qVTNNakF4UXpBdU5UQTRNVEU1SURBdU1qVTVOekF5SURBdU5UQTJOekUwSURBdU1qWXpNRGt6SURBdU5UQTJOekUwSURBdU1qWTJOakk1VmpBdU16TXpNamsyU0RBdU5UTXpNemd4VmpBdU1qYzVPVFl6U0RBdU5qQXdNRFEzVmpBdU16UTJOakk1U0RBdU5qSTJOekUwV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamN3TmpZNE1TQXdMalExTXpJNU5sWXdMalEzT1RrMk0wZ3dMamMwTmpZNE1VTXdMamMxTURJeE9DQXdMalEzT1RrMk15QXdMamMxTXpZd09TQXdMalEzT0RVMU9DQXdMamMxTmpFd09TQXdMalEzTmpBMU4wTXdMamMxT0RZeElEQXVORGN6TlRVM0lEQXVOell3TURFMUlEQXVORGN3TVRZMUlEQXVOell3TURFMUlEQXVORFkyTmpJNVZqQXVNalkyTmpJNVF6QXVOell3TURFMUlEQXVNall6TURreklEQXVOelU0TmpFZ01DNHlOVGszTURJZ01DNDNOVFl4TURrZ01DNHlOVGN5TURGRE1DNDNOVE0yTURrZ01DNHlOVFEzTURFZ01DNDNOVEF5TVRnZ01DNHlOVE15T1RZZ01DNDNORFkyT0RFZ01DNHlOVE15T1RaSU1DNDJOVE16TkRoRE1DNDJORGs0TVRJZ01DNHlOVE15T1RZZ01DNDJORFkwTWlBd0xqSTFORGN3TVNBd0xqWTBNemt5SURBdU1qVTNNakF4UXpBdU5qUXhOREU1SURBdU1qVTVOekF5SURBdU5qUXdNREUxSURBdU1qWXpNRGt6SURBdU5qUXdNREUxSURBdU1qWTJOakk1VmpBdU16VTVPVFl6U0RBdU5qWTJOamd4VmpBdU1qYzVPVFl6U0RBdU56TXpNelE0VmpBdU5EVXpNamsyU0RBdU56QTJOamd4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMakkyTmpZMU55QXdMakkzT1RrMk0wZ3dMak16TXpNeU5GWXdMak0xT1RrMk0wZ3dMak0xT1RrNVZqQXVNalkyTmpJNVF6QXVNelU1T1RrZ01DNHlOak13T1RNZ01DNHpOVGcxT0RZZ01DNHlOVGszTURJZ01DNHpOVFl3T0RVZ01DNHlOVGN5TURGRE1DNHpOVE0xT0RVZ01DNHlOVFEzTURFZ01DNHpOVEF4T1RNZ01DNHlOVE15T1RZZ01DNHpORFkyTlRjZ01DNHlOVE15T1RaSU1DNHlOVE16TWpSRE1DNHlORGszT0RjZ01DNHlOVE15T1RZZ01DNHlORFl6T1RZZ01DNHlOVFEzTURFZ01DNHlORE00T1RVZ01DNHlOVGN5TURGRE1DNHlOREV6T1RVZ01DNHlOVGszTURJZ01DNHlNems1T1NBd0xqSTJNekE1TXlBd0xqSXpPVGs1SURBdU1qWTJOakk1VmpBdU5EWTJOakk1UXpBdU1qTTVPVGtnTUM0ME56QXhOalVnTUM0eU5ERXpPVFVnTUM0ME56TTFOVGNnTUM0eU5ETTRPVFVnTUM0ME56WXdOVGRETUM0eU5EWXpPVFlnTUM0ME56ZzFOVGdnTUM0eU5EazNPRGNnTUM0ME56azVOak1nTUM0eU5UTXpNalFnTUM0ME56azVOak5JTUM0eU9UTXpNalJXTUM0ME5UTXlPVFpJTUM0eU5qWTJOVGRXTUM0eU56azVOak5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1GOXNhVzVsWVhJaUlIZ3hQU0l0TUM0eU1EY3lJaUI1TVQwaU1TNHlNRGN5SWlCNE1qMGlNUzR5TURjd055SWdlVEk5SWkwd0xqSXdOekEyTnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6SkZNamRCUkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak5USTNSa1pHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjU1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY3LjUiIHk9IjczIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYxIiB2YWx1ZT0iQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSAtPiBBV1MgRWxhc3RpQ2FjaGUgZm9yIFJlZGlzIiBzdHlsZT0iaXIucmVmPTUwNTAxNGYyLWEwY2QtNGFhMC1iMTAyLWNjNTk4MGUxMzhkODtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQ5IiBzb3VyY2U9IjU4IiB0YXJnZXQ9IjU1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTgiIHZhbHVlPSJBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bG9hZC1iYWxhbmNlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qQTBOelFnTUM0MU1UTXlOME13TGpZMk16Z3lOQ0F3TGpVek16Z3pOaUF3TGpZM05EYzVOQ0F3TGpVMU1qTTRPQ0F3TGpZNU1USWdNQzQxTmpVeU16UkRNQzQzTURjMk1EY2dNQzQxTnpnd09DQXdMamN5T0RJME9DQXdMalU0TkRJNElEQXVOelE1TURFM0lEQXVOVGd5TmtNd0xqYzJPVGM0TnlBd0xqVTRNRGt4T1NBd0xqYzRPVEUyTXlBd0xqVTNNVFE0TWlBd0xqZ3dNekk1SURBdU5UVTJNVFkxUXpBdU9ERTNOREU0SURBdU5UUXdPRFE0SURBdU9ESTFNall5SURBdU5USXdOemMwSURBdU9ESTFNall5SURBdU5EazVPVE0yUXpBdU9ESTFNall5SURBdU5EYzVNRGs1SURBdU9ERTNOREU0SURBdU5EVTVNREkxSURBdU9EQXpNamtnTUM0ME5ETTNNRGhETUM0M09Ea3hOak1nTUM0ME1qZ3pPVEVnTUM0M05qazNPRGNnTUM0ME1UZzVOVE1nTUM0M05Ea3dNVGNnTUM0ME1UY3lOek5ETUM0M01qZ3lORGdnTUM0ME1UVTFPVElnTUM0M01EYzJNRGNnTUM0ME1qRTNPVElnTUM0Mk9URXlJREF1TkRNME5qTTRRekF1TmpjME56azBJREF1TkRRM05EZzFJREF1TmpZek9ESTBJREF1TkRZMk1ETTJJREF1TmpZd05EYzBJREF1TkRnMk5qQXpTREF1TlRZeE1EQTRRekF1TlRVNU5EWTFJREF1TkRZeU1EVTBJREF1TlRVek1USXpJREF1TkRNNE1EUTFJREF1TlRReU16UXhJREF1TkRFMU9UTTJUREF1TmpZeU16UXhJREF1TXpFME5EWTVRekF1TmpjM01EWTJJREF1TXpJMk1USXpJREF1TmprMU16RXhJREF1TXpNeU5ETTBJREF1TnpFME1Ea2dNQzR6TXpJek4wTXdMamN6TWpnMk9TQXdMak16TWpNd055QXdMamMxTVRBM0lEQXVNekkxT0RjeElEQXVOelkxTnpFMklEQXVNekUwTVRFNFF6QXVOemd3TXpZeElEQXVNekF5TXpZMElEQXVOemt3TlRnMElEQXVNamcxT1RnNElEQXVOemswTnpFeUlEQXVNalkzTmpZNFF6QXVOems0T0RRZ01DNHlORGt6TkRnZ01DNDNPVFkyTWprZ01DNHlNekF4TnlBd0xqYzRPRFEwSURBdU1qRXpNamN4UXpBdU56Z3dNalVnTUM0eE9UWXpOeklnTUM0M05qWTFOamdnTUM0eE9ESTNOVElnTUM0M05EazJNekVnTUM0eE56UTJORU13TGpjek1qWTVOU0F3TGpFMk5qVXlPU0F3TGpjeE16VXdOeUF3TGpFMk5EUXdOU0F3TGpZNU5USXdOaUF3TGpFMk9EWXhOME13TGpZM05qa3dOaUF3TGpFM01qZ3lPU0F3TGpZMk1EVTNOeUF3TGpFNE16RXlOeUF3TGpZME9EZzVJREF1TVRrM09ESTNRekF1TmpNM01qQTBJREF1TWpFeU5USTJJREF1TmpNd09EVXlJREF1TWpNd056VTNJREF1TmpNd09EYzBJREF1TWpRNU5UTTJRekF1TmpNd056RTRJREF1TWpZMU5qTTJJREF1TmpNMU16WWdNQzR5T0RFME1UY2dNQzQyTkRReU1EZ2dNQzR5T1RRNE5qbE1NQzQxTWpneU1EZ2dNQzR6T1RJMk1ETkRNQzQxTURVeE56Y2dNQzR6TlRnd09UZ2dNQzQwTnpFMk5UZ2dNQzR6TXpFNU1UY2dNQzQwTXpJMk1ETWdNQzR6TVRjNU1qZERNQzR6T1RNMU5EZ2dNQzR6TURNNU16Z2dNQzR6TlRFd01qa2dNQzR6TURJNE9ERWdNQzR6TVRFek1qZ2dNQzR6TVRRNU1UUkRNQzR5TnpFMk1qY2dNQzR6TWpZNU5EY2dNQzR5TXpZNE5Ea2dNQzR6TlRFME16RWdNQzR5TVRJeE16TWdNQzR6T0RRM05EbERNQzR4T0RjME1UWWdNQzQwTVRnd05qY2dNQzR4TnpRd056SWdNQzQwTlRnME5URWdNQzR4TnpRd056SWdNQzQwT1RrNU16WkRNQzR4TnpRd056SWdNQzQxTkRFME1qRWdNQzR4T0RjME1UWWdNQzQxT0RFNE1EWWdNQzR5TVRJeE16TWdNQzQyTVRVeE1qUkRNQzR5TXpZNE5Ea2dNQzQyTkRnME5ERWdNQzR5TnpFMk1qY2dNQzQyTnpJNU1qWWdNQzR6TVRFek1qZ2dNQzQyT0RRNU5UaERNQzR6TlRFd01qa2dNQzQyT1RZNU9URWdNQzR6T1RNMU5EZ2dNQzQyT1RVNU16VWdNQzQwTXpJMk1ETWdNQzQyT0RFNU5EVkRNQzQwTnpFMk5UZ2dNQzQyTmpjNU5UVWdNQzQxTURVeE56Y2dNQzQyTkRFM056UWdNQzQxTWpneU1EZ2dNQzQyTURjeU4wd3dMalkwTkRJd09DQXdMamN3TlRBd00wTXdMall6TlRNMklEQXVOekU0TkRVMUlEQXVOak13TnpFNElEQXVOek0wTWpNM0lEQXVOak13T0RjMElEQXVOelV3TXpNM1F6QXVOak13T0RZM0lEQXVOelk1TURnZ01DNDJNemN5TVRrZ01DNDNPRGN5TnpFZ01DNDJORGc0T1RFZ01DNDRNREU1TXpaRE1DNDJOakExTmpRZ01DNDRNVFkyTURFZ01DNDJOelk0TmpjZ01DNDRNalk0TnpFZ01DNDJPVFV4TXpRZ01DNDRNekV3TmpoRE1DNDNNVE0wTURFZ01DNDRNelV5TmpVZ01DNDNNekkxTlRJZ01DNDRNek14TkNBd0xqYzBPVFExTlNBd0xqZ3lOVEEwUXpBdU56WTJNelU0SURBdU9ERTJPVFF4SURBdU56Z3dNREV5SURBdU9EQXpNelEySURBdU56ZzRNVGcySURBdU56ZzJORGM1UXpBdU56azJNellnTUM0M05qazJNVElnTUM0M09UZzFOamtnTUM0M05UQTBOekVnTUM0M09UUTBOVE1nTUM0M016SXhPRFZETUM0M09UQXpNellnTUM0M01UTTRPVGtnTUM0M09EQXhNemNnTUM0Mk9UYzFOVElnTUM0M05qVTFNalFnTUM0Mk9EVTRNVFJETUM0M05UQTVNVEVnTUM0Mk56UXdOemNnTUM0M016STNORGNnTUM0Mk5qYzJORFlnTUM0M01UUXdNRFFnTUM0Mk5qYzFOekZETUM0Mk9UVXlOakVnTUM0Mk5qYzBPVFlnTUM0Mk56Y3dORGNnTUM0Mk56TTNPRE1nTUM0Mk5qSXpOREVnTUM0Mk9EVTBNRE5NTUM0MU5ESXpOREVnTUM0MU9ETTVNelpETUM0MU5UTXhNak1nTUM0MU5qRTRNamdnTUM0MU5UazBOalVnTUM0MU16YzRNVGtnTUM0MU5qRXdNRGdnTUM0MU1UTXlOMGd3TGpZMk1EUTNORnBOTUM0M05ESXdOelFnTUM0ME5ETTJOamxETUM0M05UTXlNRGtnTUM0ME5ETTJORE1nTUM0M05qUXhJREF1TkRRMk9USXhJREF1Tnpjek16Y3hJREF1TkRVek1EZzNRekF1TnpneU5qUXhJREF1TkRVNU1qVTBJREF1TnpnNU9EYzBJREF1TkRZNE1ETXlJREF1TnprME1UVXpJREF1TkRjNE16RXhRekF1TnprNE5ETXlJREF1TkRnNE5Ua2dNQzQzT1RrMU5qVWdNQzQwT1RrNU1EZ2dNQzQzT1RjME1Ea2dNQzQxTVRBNE16RkRNQzQzT1RVeU5UTWdNQzQxTWpFM05UVWdNQzQzT0RrNU1EVWdNQzQxTXpFM09UTWdNQzQzT0RJd05ERWdNQzQxTXprMk56VkRNQzQzTnpReE56Z2dNQzQxTkRjMU5UZ2dNQzQzTmpReE5USWdNQzQxTlRJNU15QXdMamMxTXpJek5DQXdMalUxTlRFeE1rTXdMamMwTWpNeE5pQXdMalUxTnpJNU5DQXdMamN6TURrNU5TQXdMalUxTmpFNE55QXdMamN5TURjd05pQXdMalUxTVRrek0wTXdMamN4TURReE55QXdMalUwTnpZM09DQXdMamN3TVRZeU1pQXdMalUwTURRMk5pQXdMalk1TlRRek15QXdMalV6TVRJeFF6QXVOamc1TWpRMElEQXVOVEl4T1RVMElEQXVOamcxT1RReElEQXVOVEV4TURjZ01DNDJPRFU1TkRFZ01DNDBPVGs1TXpaRE1DNDJPRFU1TkRFZ01DNDBPRFV3TXpZZ01DNDJPVEU0TlRFZ01DNDBOekEzTkRVZ01DNDNNREl6TnpRZ01DNDBOakF4T1RkRE1DNDNNVEk0T1RjZ01DNDBORGsyTkRnZ01DNDNNamN4TnpVZ01DNDBORE0zTURVZ01DNDNOREl3TnpRZ01DNDBORE0yTmpsV01DNDBORE0yTmpsYVRUQXVOekUwTXpReElEQXVNVGt6TWpZNVF6QXVOekkxTkRjZ01DNHhPVE15TmprZ01DNDNNell6TkRnZ01DNHhPVFkxTmprZ01DNDNORFUyTURFZ01DNHlNREkzTlRKRE1DNDNOVFE0TlRRZ01DNHlNRGc1TXpRZ01DNDNOakl3TmpZZ01DNHlNVGMzTWpJZ01DNDNOall6TWpVZ01DNHlNamd3TURORE1DNDNOekExT0RNZ01DNHlNemd5T0RVZ01DNDNOekUyT1RnZ01DNHlORGsxT1RnZ01DNDNOamsxTWpjZ01DNHlOakExTVRORE1DNDNOamN6TlRVZ01DNHlOekUwTWpnZ01DNDNOakU1T1RjZ01DNHlPREUwTlRNZ01DNDNOVFF4TWpnZ01DNHlPRGt6TWpKRE1DNDNORFl5TlRrZ01DNHlPVGN4T1RJZ01DNDNNell5TXpNZ01DNHpNREkxTlNBd0xqY3lOVE14T0NBd0xqTXdORGN5TVVNd0xqY3hORFF3TXlBd0xqTXdOamc1TXlBd0xqY3dNekE1SURBdU16QTFOemM0SURBdU5qa3lPREE1SURBdU16QXhOVEpETUM0Mk9ESTFNamNnTUM0eU9UY3lOakVnTUM0Mk56TTNOQ0F3TGpJNU1EQTBPU0F3TGpZMk56VTFOeUF3TGpJNE1EYzVOa013TGpZMk1UTTNOQ0F3TGpJM01UVTBNeUF3TGpZMU9EQTNOQ0F3TGpJMk1EWTJOQ0F3TGpZMU9EQTNOQ0F3TGpJME9UVXpOa013TGpZMU9EQTNOQ0F3TGpJek5EWXhNeUF3TGpZMk5EQXdNaUF3TGpJeU1ETXdNU0F3TGpZM05EVTFOQ0F3TGpJd09UYzBPVU13TGpZNE5URXdOeUF3TGpFNU9URTVOeUF3TGpZNU9UUXhPQ0F3TGpFNU16STJPU0F3TGpjeE5ETTBNU0F3TGpFNU16STJPVnBOTUM0M01UUXpOREVnTUM0Mk9UUXlNRE5ETUM0M01qVTBOelVnTUM0Mk9UUXlNRE1nTUM0M016WXpOVGtnTUM0Mk9UYzFNRGNnTUM0M05EVTJNVFVnTUM0M01ETTJPVFZETUM0M05UUTROekVnTUM0M01EazRPRFFnTUM0M05qSXdPRE1nTUM0M01UZzJOemtnTUM0M05qWXpNemNnTUM0M01qZzVOamxETUM0M056QTFPVElnTUM0M016a3lOVGdnTUM0M056RTJPVGdnTUM0M05UQTFOemdnTUM0M05qazFNVGNnTUM0M05qRTBPVFpETUM0M05qY3pNelVnTUM0M056STBNVFVnTUM0M05qRTVOak1nTUM0M09ESTBOQ0F3TGpjMU5EQTRJREF1Tnprd016QTBRekF1TnpRMk1UazRJREF1TnprNE1UWTNJREF1TnpNMk1UWWdNQzQ0TURNMU1UWWdNQzQzTWpVeU16WWdNQzQ0TURVMk56SkRNQzQzTVRRek1UTWdNQzQ0TURjNE1qZ2dNQzQzTURJNU9UVWdNQzQ0TURZMk9UUWdNQzQyT1RJM01UWWdNQzQ0TURJME1UVkRNQzQyT0RJME16Y2dNQzQzT1RneE16WWdNQzQyTnpNMk5Ua2dNQzQzT1RBNU1EUWdNQzQyTmpjME9USWdNQzQzT0RFMk16TkRNQzQyTmpFek1qWWdNQzQzTnpJek5qSWdNQzQyTlRnd05EZ2dNQzQzTmpFME56RWdNQzQyTlRnd056UWdNQzQzTlRBek16ZERNQzQyTlRneE1TQXdMamN6TlRRek55QXdMalkyTkRBMU15QXdMamN5TVRFMU9TQXdMalkzTkRZd01pQXdMamN4TURZek5rTXdMalk0TlRFMUlEQXVOekF3TVRFeklEQXVOams1TkRReElEQXVOamswTWpBeklEQXVOekUwTXpReElEQXVOamswTWpBeldrMHdMak0yT0RJd09DQXdMalkyTmpZd00wTXdMak16TlRJME5DQXdMalkyTmpZd015QXdMak13TXpBeU1TQXdMalkxTmpneU9DQXdMakkzTlRZeE15QXdMall6T0RVeE5VTXdMakkwT0RJd05TQXdMall5TURJd01TQXdMakl5TmpnME1pQXdMalU1TkRFM01TQXdMakl4TkRJeU9DQXdMalUyTXpjeE4wTXdMakl3TVRZeE15QXdMalV6TXpJMk15QXdMakU1T0RNeE15QXdMalE1T1RjMU1TQXdMakl3TkRjME5DQXdMalEyTnpReU1VTXdMakl4TVRFM05DQXdMalF6TlRBNU1TQXdMakl5TnpBME9DQXdMalF3TlRNNU5DQXdMakkxTURNMU55QXdMak00TWpBNE5VTXdMakkzTXpZMk5TQXdMak0xT0RjM05pQXdMak13TXpNMk15QXdMak0wTWprd015QXdMak16TlRZNU15QXdMak16TmpRM01rTXdMak0yT0RBeU15QXdMak16TURBME1TQXdMalF3TVRVek5DQXdMak16TXpNME1TQXdMalF6TVRrNE9DQXdMak0wTlRrMU5rTXdMalEyTWpRME15QXdMak0xT0RVM01TQXdMalE0T0RRM01pQXdMak0zT1Rrek15QXdMalV3TmpjNE5pQXdMalF3TnpNME1VTXdMalV5TlRFZ01DNDBNelEzTkRrZ01DNDFNelE0TnpRZ01DNDBOalk1TnpNZ01DNDFNelE0TnpRZ01DNDBPVGs1TXpaRE1DNDFNelE0TURRZ01DNDFORFF4TVRjZ01DNDFNVGN5TWpJZ01DNDFPRFkwTmprZ01DNDBPRFU1T0RFZ01DNDJNVGMzTVVNd0xqUTFORGMwSURBdU5qUTRPVFV4SURBdU5ERXlNemc1SURBdU5qWTJOVE16SURBdU16WTRNakE0SURBdU5qWTJOakF6VmpBdU5qWTJOakF6V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTFRBdU1qQTNNaUlnZVRFOUlqRXVNakEzTWlJZ2VESTlJakV1TWpBM01EY2lJSGt5UFNJdE1DNHlNRGN3TmpjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRPRFV4TVVJaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkdPVGt3TUNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPWMxNGFhYjUxLWRmZWYtNGMzMi1iZDU5LTkyNTllYTRhZGYwNDsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjkiIHk9IjE5MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MyIgdmFsdWU9IlNDVyBVc2VyIC0+IEFXUyBDbG91ZEZyb250IiBzdHlsZT0iaXIucmVmPTJjNjRkZGNjLWFkYTctNDdkMi1iMmJkLThiNjIzM2U5NzQ2OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNTAiIHRhcmdldD0iNTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1NCIgdmFsdWU9IlNDVyBVc2VyIC0+IEFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj01YTc0OWExYS0wNDAzLTQ3N2YtOGNiMy1iYmZmNDRhMGQ5MTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjUwIiB0YXJnZXQ9IjUyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNjIiIHZhbHVlPSJUaGlzIGJhc2ljIFRocmVhdCBNb2RlbCBkZXNjcmliZXMgYW4gQVdTIGhvc3RlZCBhcHBsaWNhdGlvbiB0aGF0IGEgdXNlciBhY2Nlc3NlcyByZW1vdGVseS4iIHN0eWxlPSJzaGFwZT1ub3RlO3N0cm9rZVdpZHRoPTI7Zm9udFNpemU9MTQ7c2l6ZT0yMDt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2ZpbGxDb2xvcj0jZmZmMmNjO3N0cm9rZUNvbG9yPSNkNmI2NTY7Zm9udENvbG9yPSM2NjY2MDA7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTEyNDkiIHk9Ii05MTQiIHdpZHRoPSIxOTMiIGhlaWdodD0iMTEyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="API - I/O -&gt; EC2 - Elastic Compute Cloud" ref="24090cb1-0cb6-455d-9d17-3c11ba708487" source="329646f1-38b8-4996-93e4-1e342f0bafb3" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="SCW User -&gt; AWS CloudFront" ref="2c64ddcc-ada7-47d2-b2bd-8b6233e97469" source="5fabbae7-9089-4bc6-beb9-9a432631c9d2" target="55881b84-57b2-495d-b21c-84c5fea0db1c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="EC2 - Elastic Compute Cloud -&gt; PostgreSQL" ref="456ef3b4-d874-4be9-93d1-577b3df224c0" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS ELB (Elastic Load Balancer) -&gt; AWS ElastiCache for Redis" ref="505014f2-a0cd-4aa0-b102-cc5980e138d8" source="f594eb8d-5453-4e6c-89aa-5d4ada78530e" target="ac6b58c4-31d2-491c-8e25-ef787e9af4ae">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="CloudWatch -&gt; Internal Logging Server" ref="53ba2d47-cf17-4abd-8736-420be80e8643" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d">
+      <assets/>
+      <tags>
+        <tag tag="Alerts"/>
+      </tags>
+    </dataflow>
+    <dataflow name="SCW User -&gt; AWS API Gateway" ref="5a749a1a-0403-477f-8cb3-bbff44a0d911" source="5fabbae7-9089-4bc6-beb9-9a432631c9d2" target="cb3c3a00-6887-4025-a440-4c5298fb2b0d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS API Gateway -&gt; AWS ELB (Elastic Load Balancer)" ref="5badf974-aeeb-4bb0-9fde-af603313d63a" source="cb3c3a00-6887-4025-a440-4c5298fb2b0d" target="f594eb8d-5453-4e6c-89aa-5d4ada78530e">
+      <assets/>
+      <tags>
+        <tag tag="https: 443"/>
+      </tags>
+    </dataflow>
+    <dataflow name="AWS CloudFront -&gt; AWS ELB (Elastic Load Balancer)" ref="8147f210-6823-4cfc-b094-2d9be8167ba4" source="55881b84-57b2-495d-b21c-84c5fea0db1c" target="f594eb8d-5453-4e6c-89aa-5d4ada78530e">
+      <assets/>
+      <tags>
+        <tag tag="https: 443"/>
+      </tags>
+    </dataflow>
+    <dataflow name="User - Web UI -&gt; AWS API Gateway" ref="be17d053-be74-4db1-95f4-02a7fba8663c" source="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" target="329646f1-38b8-4996-93e4-1e342f0bafb3">
+      <assets>
+        <asset name="Personally Identifiable Information"/>
+      </assets>
+      <tags>
+        <tag tag="Login Credentials"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Elasticsearch -&gt; Overflow / Cold Storage" ref="c0130149-5c31-4165-b6e2-22cc58339bdd" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="85488534-b4b9-4b7f-837b-1d895fd6a673">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="CloudWatch -&gt; EC2 - Elastic Compute Cloud" ref="ca9bb336-5f0b-4461-b156-16aeeec16146" source="8bf78537-3cdd-4c79-88be-e341adba0b30" target="f4049c60-9be6-471e-8885-753b7ce5c14d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="EC2 - Elastic Compute Cloud -&gt; Elasticsearch" ref="d2b00bd0-3732-40f2-8948-2bd6093fc6dc" source="f4049c60-9be6-471e-8885-753b7ce5c14d" target="458aeca6-65f5-4791-a48c-3d18d76a02b5">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Elasticsearch -&gt; PostgreSQL" ref="e1351bee-27d2-46c7-bb89-6f292faf39f8" source="458aeca6-65f5-4791-a48c-3d18d76a02b5" target="794c99e8-a31a-4592-93a6-618a207a7aaa">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Internal Logging Server -&gt; SIEM Team" ref="e312edcf-ecf1-4c73-8fb4-7dd95e8b06da" source="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" target="315742d3-3d9e-4a0c-909c-78f3885e8607">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="794e4f2f-b0d4-4f89-80ca-518da7b3b7d0" diagramComponentId="737d7a3c-9ae7-4c37-8ff7-6c7637feed0a" ref="55881b84-57b2-495d-b21c-84c5fea0db1c" name="AWS CloudFront" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="cf-cloudfront">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.291">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PROOF-DOS" name="There are no proofs of a DoS" state="0" impact="100" issueId="" issueLink="">
+          <desc>System is not configured to alert system administrators that a denial of service attack is happening or happened.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-3.12" name="Configure HTTP to HTTPS Redirects with a CloudFront Viewer Protocol Policy" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Configure the Viewer Protocol Policy for your CloudFront cache to redirect HTTP requests to HTTPS requests or to require that viewers use only the HTTPS protocol to access your objects in the CloudFront cache. You should also configure one or more cache behaviors in the same distribution to allow both HTTP and HTTPS, so you can require HTTPS for some objects but not for others. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  In order to use HTTPS, a SSL\TLS certificate must be attached. This depends on your data classification policy and needs to be configured according to your encryption policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For configuring "ViewerProtocolPolicy" first save locally the current distribution config:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Edit and replace "ViewerProtocolPolicy" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ViewerProtocolPolicy": "redirect-to-https", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="3.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the "ViewerProtocolPolicy" used by application Cloudfront distributions (it should be set as redirect-to-https):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, ViewerProtocolPolicy:DefaultCacheBehavior.ViewerProtocolPolicy}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.187">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.17" name="Configure TLS1.1+ for CloudFront to Origin connection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  CloudFront can connect to your origin using only HTTP, only HTTPS, or to connect by matching the protocol used by the viewer. Our recommendation is to use HTTPS only. In 
+  this case you can choose which SSL\TLS protocols CloudFront is allowed to use when 
+  establishing an HTTPS connection to your origin. Ensure that you are using only TLS1.1+ as 
+  the SSL\TLS protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For configuring Origin SSL protocols first save locally the current distribution config:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Edit and replace "OriginSslProtocols" element in /tmp/cf-distribution.json with the below section:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "OriginSslProtocols": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    &amp;nbsp;"Items": [ 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "TLSv1.1", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "TLSv1.2" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    ], 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Quantity": 2 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon Cloudfront New Origin Security Features" url="https://aws.amazon.com/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin-security-features/"/>
+            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the "OriginSslProtocols" used by application Cloudfront distributions (only TLSv1.1 and TLSv1.2 should be present):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, OriginSslProtocols:Origins.Items[*].CustomOriginConfig.OriginSslProtocols.Items[*]}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.3" name="Enable AWS Cloudfront logging" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, for example, .html, .css, .php, image, and media files, to end users. CloudFront delivers your content through a worldwide network of edge locations. When an end user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so content is delivered with the best possible performance. If the content is already in that edge location, CloudFront delivers it immediately. If the content is not currently in that edge location, CloudFront retrieves it from a customer defined Origin, such as AWS S3, AWS ELB or EC2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For enabling logging first save locally the current distribution config:&lt;/li&gt; 
+ &lt;/ul&gt; 
+  aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Edit and replace "Logging" element in /tmp/cf-distribution.json with the below section: "Logging": { "Bucket": "&amp;lt;s3_bucket_name&amp;gt;", "Prefix": "cloudfrontlogs", "Enabled": true, "IncludeCookies": false },&lt;/li&gt; 
+  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag"&lt;/li&gt; 
+  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution-config.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Cloudfront distributions and identify your application Distribution and Origin IDs. Note the "Id:" element:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;span style="white-space:pre"&gt; &lt;/span&gt;aws cloudfront list-distributions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Using the distribution Id from the previous step display the distribution settings, and check if the "Enabled" element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;span style="white-space:pre"&gt; &lt;/span&gt;aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig.Logging" 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.4" name="Enable Geo-Restriction within Cloudfront Distribution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront is a web service that speeds up distribution of your static and dynamic 
+  web content, for example, .html, .css, .php, image, and media files, to end users. CloudFront 
+  delivers your content through a worldwide network of edge locations. When an end user 
+  requests content that you're serving with CloudFront, the user is routed to the edge 
+  location that provides the lowest latency, so content is delivered with the best possible 
+  performance. If the content is already in that edge location, CloudFront delivers it 
+  immediately. If the content is not currently in that edge location, CloudFront retrieves it 
+  from a customer defined Origin, such as AWS S3, AWS ELB or EC2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For enabling GeoRestrictions first save locally the current distribution config: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Edit the GeoRestrictions section in /tmp/cf-distribution.json with the desired configuration (similar to the below sample):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Restrictions": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     "GeoRestriction": { 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt;
+      "RestrictionType": "&amp;lt;blacklist|whitelist&amp;gt;", 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt;
+      &amp;nbsp;"Quantity": 3, 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt;
+      &amp;nbsp;"Items": ["&amp;lt;country_code_1&amp;gt;", "&amp;lt;country_code_2&amp;gt;"] 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the current ETag of your CloudFront distribution: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "ETag" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; -- distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt;&amp;nbsp; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="6.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Check if geo restrictions are enabled on your application CloudFront distribution:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws cloudfront get-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --query "Distribution.DistributionConfig.Restrictions.GeoRestriction" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-7" name="Prevent viewer requests from bypassing the CDN and accessing the origin content directly" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When you deliver web content through a CDN such as CloudFront, a best practice is to prevent viewer requests from bypassing the CDN and accessing your origin content directly. For more information, see the blog post How to enhance Amazon CloudFront origin security with AWS WAF and AWS Secrets Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+            <reference name="How to enhance Amazon CloudFront origin security with AWS WAF and AWS Secrets Manager" url="https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the CDN is not bypassed by auditing the logs.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-7" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-7" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PROOF-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.3" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.17" mitigation="25"/>
+                    <countermeasure ref="aws-tier-3.12" mitigation="25"/>
+                    <countermeasure ref="aws-tier-6.4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.17" mitigation="25"/>
+                <countermeasure ref="aws-tier-3.12" mitigation="25"/>
+                <countermeasure ref="aws-tier-5.3" mitigation="25"/>
+                <countermeasure ref="aws-tier-6.4" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="dc781d65-f874-4a58-84d7-f84a402edb24" diagramComponentId="4ed19abf-d5cc-4c2f-9a55-b79dc6ba21e3" ref="8eac4034-fa71-4753-938c-c147a01a52cb" name="AWS ElastiCache" desc="" library="Hydras-AWS-Foundation" parentComponentRef="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" componentDefinitionRef="elasticache">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.754">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.527">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.755">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE8" name="Apply any updates of type security for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Apply any updates of type security for AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You control when to apply an update, regardless of the recommendation. At a minimum, AWS strongly recommends that you apply any updates of type security to ensure that your clusters are always up-to-date with current security patches. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can apply the service updates using one of the following console options. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Console for Redis or Memcached 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose this to view Update Status for individual clusters, and then choose Apply, View, or Stop for the service updates. If a service update is available, the console displays a banner at the top of the page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you choose Apply Now, you can choose to apply the service update to all or a subset of the applicable clusters in this workflow. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you choose Dismiss, the console stops displaying the banner for that console session. However, the banner reappears the next time that you refresh your session. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  On the Apply Updates Now page, you can use these options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Auto-Update after Due Date: If this attribute is yes, after the Recommended apply by Date has passed, ElastiCache schedules clusters yet to be updated in the appropriate maintenance window. Updates are applied along with other applicable updates. You can continue to apply the updates until the update expiration date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If this attribute is no and you don't apply the self-service update before it expires, ElastiCache doesn't automatically apply the service update for you. If your cluster is part of one or more ElastiCache-supported compliance programs and isn't updated, it remains out of compliance until the next cumulative update becomes available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - The Nodes Updated ratio value for your cluster and the Estimated Update Time value help you plan your maintenance schedule. If service updates exceed the estimated time constraints for your business flows, you can stop updates and reapply them at a later date. For more information, see Stopping the Self-Service Updates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If you choose to apply the service updates to any or all available clusters, choose Confirm. If you choose this, you then view the Service Updates page, where you can monitor the status of your service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If you choose Cancel, you can explore further options, as explained following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  On the ElastiCache dashboard, you can check Update Status for each of your Redis clusters, as shown following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update Status displays one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - update available: An update is available to apply to this cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - not-applied: An update is available but not yet applied. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - scheduling: The update date is being scheduled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - scheduled: The update date has been scheduled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - waiting-to-start: The update process will soon begin. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - in-progress: The update is being applied to this cluster, rendering it unavailable for the duration of the value in Estimated Update Time. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - stopping: An in-progress update has been interrupted before completion. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - stopped: The update has been terminated. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you stop an in-progress update on a cluster, some nodes might be updated while others are not. The stopping process doesn't roll back any changes to already updated nodes. You can reapply the update to those nodes that still have an available status at your convenience if the update doesn't have an Expired status. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - complete: The update has been successfully applied. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - up to date: The cluster doesn't have any outstanding active service updates and your cluster is compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Service Updates List 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view the list of individual service updates and their status, along with other information, choose the Service Updates List tab. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Service Updates List, you can view the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Name: A unique identifier for the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Status: The status of the update, which is one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- complete: The update has been applied and all clusters are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- cancelled: The update has been canceled and is no longer necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- expired: The update is no longer available to apply. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Severity: The priority of applying the update: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- important: We recommend that you apply this update as soon as your business flow allows (within 30 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Type: For this version, only security updates are supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Release Date: When the update is released and available to apply on your Redis fleet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Recommended Apply By Date: ElastiCache guidance date to apply the updates by. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choosing an individual update provides additional details, including the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Description: Provides details on the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Expiration Date: The date when the service update expires and no longer is available. Any updates that aren't applied before their expiration date are cumulatively rolled into the next update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Important 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you apply updates of type security as soon as you can. Doing this helps ensure that your Redis clusters are always up-to-date with the latest security patches and are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view the list of individual service updates in relation to the applicable clusters, choose the Service Update Status tab. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Service Updates Status list, you can view the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Name: Detailed information about the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Cluster Name: The list of your Redis clusters that are eligible for the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Nodes Updated: The ratio of individual nodes within a specific cluster that were updated or remain available for the specific service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Severity: The priority of applying the update: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- important: We recommend that you apply this update as soon as you can (within 30 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Type: For this version, only security updates are supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Status: The status of the update, which is one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- complete: The update has been applied and all Redis clusters are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- canceled: The update has been canceled and is no longer necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- expired: The update is no longer available to apply. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update SLA Met: This reflects whether your cluster is compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- yes: All available updates have been applied to this cluster and available nodes by the apply-by date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  -- no: The service update might have been applied successfully to one or more nodes, but other nodes within the cluster still have an available status. This typically happens when a service update is applied and then stopped. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you stop the progress of a service update on a cluster, any nodes that are already updated have a complete status. Any nodes that have an In Progress or Stopping status revert to a Stopped status, and the Service Update SLA Met status changes to no. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- N/A: The replication group was created after the recommended apply-by date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Cluster Status Modified Date: The latest date that the cluster was modified with a service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Show Previous Updates check box, if selected, displays a list of previous updates that are no longer available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Managing the Service Updates -  Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/managing-updates.html"/>
+            <reference name="Managing the Service Updates - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/managing-updates.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that any updates of type security are applied for AWS ElastiCache.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.466">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE1" name="Control access to AWS ElastiCache using IAM policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control access to AWS ElastiCache using IAM policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can have valid credentials to authenticate your requests, but unless you have permissions you cannot create or access Amazon ElastiCache resources. For example, you must have permissions to create an ElastiCache cache cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following shows an example of a permissions policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;"Version": "2012-10-17", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;"Statement": [{ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowClusterPermissions", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateCacheCluster", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateReplicationGroup", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:DescribeCacheClusters", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:ModifyCacheCluster", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:RebootCacheCluster"], 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}, 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;{ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowUserToPassRole", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ "iam:PassRole" ], 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;] 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The policy has two statements: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. The first statement grants permissions for the Amazon ElastiCache actions (elasticache:CreateCacheCluster, elasticache:DescribeCacheClusters, elasticache:ModifyCacheCluster, and elasticache:RebootCacheCluster) on any cache cluster owned by the account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. The second statement grants permissions for the IAM action (iam:PassRole) on IAM roles. The wildcard character (*) at the end of the Resource value means that the statement allows permission for the iam:PassRole action on any IAM role. To limit this permission to a specific role, replace the wildcard character (*) in the resource ARN with the specific role name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The policy doesn't specify the Principal element because in an identity-based policy you don't specify the principal who gets the permission. When you attach policy to a user, the user is the implicit principal. When you attach a permissions policy to an IAM role, the principal identified in the role's trust policy gets the permissions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using Identity-Based Policies (IAM Policies) for Amazon ElastiCache" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.IdentityBasedPolicies.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE10" name="Enable AWS SNS Notifications for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable AWS SNS Notifications for AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When significant events happen for a cluster, ElastiCache sends notification to a specific Amazon SNS topic. Examples include a failure to add a node, success in adding a node, the modification of a security group, and others. By monitoring for key events, you can know the current state of your clusters and, depending upon the event, be able to take corrective action. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Adding an Amazon SNS Topic (Console) 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following procedure shows you how to add an Amazon SNS topic for a cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  This process can also be used to modify the Amazon SNS topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To add or modify an Amazon SNS topic for a cluster (Console) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the AWS Management Console and open the ElastiCache console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In Clusters, choose the cluster for which you want to add or modify an Amazon SNS topic ARN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4 In Modify Cluster under Topic for SNS Notification, choose the SNS topic you want to add, or choose Manual ARN input and type the ARN of the Amazon SNS topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Managing ElastiCache Amazon SNS Notifications - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/ECEvents.SNS.html"/>
+            <reference name="Managing ElastiCache Amazon SNS Notifications - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ECEvents.SNS.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
+            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE9" name="Use CloudWatch alarms with AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use CloudWatch alarms with AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  ElastiCache provides metrics that enable you to monitor your clusters. You can access these metrics through CloudWatch. ElastiCache provides both host-level metrics (for example, CPU usage) and metrics that are specific to the cache engine software (for example, cache gets and cache misses). These metrics are measured and published for each Cache node in 60-second intervals. 
+&lt;/div&gt; 
+&lt;div&gt;
+  By setting CloudWatch alarms on certain key metrics, you will be notified if your cache cluster's performance starts to degrade. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitoring CloudWatch Cluster and Node Metrics (Console) 
+&lt;/div&gt; 
+&lt;div&gt;
+  To gather CPU utilization statistics for a cache cluster 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the AWS Management Console and open the ElastiCache console at https://console.aws.amazon.com/elasticache/. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the cache nodes you want to view metrics for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting more than 20 nodes disables viewing metrics on the console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  a. On the Cache Clusters page of the AWS Management Console, click the name of one or more cache clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The detail page for the cache cluster appears. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  b. Click the Nodes tab at the top of the window. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  c. On the Nodes tab of the detail window, select the cache nodes that you want to view metrics for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A list of available CloudWatch Metrics appears at the bottom of the console window. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  d. Click on the CPU Utilization metric. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CloudWatch console will open, displaying your selected metrics. You can use the Statistic and Period drop-down list boxes and Time Range tab to change the metrics being displayed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring Use with CloudWatch Metrics - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheMetrics.html"/>
+            <reference name="Monitoring Use with CloudWatch Metrics - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheMetrics.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To test your rule that triggers on an API call, you have to trigger it with its Specific operation as defined into the Cloudwatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  In CloudWatch Events, it is possible to create rules that lead to infinite loops, where a rule is fired repeatedly. For example, a rule might detect that ACLs have changed on an S3 bucket, and trigger software to change them to the desired state. If the rule is not written carefully, the subsequent change to the ACLs fires the rule again, creating an infinite loop. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To prevent this, write the rules so that the triggered actions do not re-fire the same rule. For example, your rule could fire only if ACLs are found to be in a bad state, instead of after any change. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An infinite loop can quickly cause higher than expected charges. AWS recommends that you use budgeting, which alerts you when charges exceed your specified limit. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
+              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail PDF" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.675">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:36.467">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
+                    <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
+                <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1291b3e1-bf0b-497b-9387-b8053fe67f69" diagramComponentId="b335208f-2ec3-466f-ab76-51f9da590406" ref="315742d3-3d9e-4a0c-909c-78f3885e8607" name="SIEM Team" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                <countermeasure ref="CWE-327" mitigation="33"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1eb0e3d1-7d8a-413c-bce4-1c51579945b6" diagramComponentId="c14aab51-dfef-4c32-bd59-9259ea4adf04" ref="f594eb8d-5453-4e6c-89aa-5d4ada78530e" name="AWS ELB (Elastic Load Balancer)" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="load-balancer">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
+          <desc>We do not have our resources current status and as a result lose control of some resources,
+                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;br&gt; 
+&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;br&gt; 
+&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
+&lt;br&gt; 
+&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;br&gt; 
+&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
+&lt;br&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br&gt; 
+&lt;br&gt; Using the Amazon unified command line interface: 
+&lt;ul&gt; 
+ &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
+  &lt;blockquote&gt;
+    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+  &lt;/blockquote&gt; &lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div style=""&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;div style=""&gt;
+    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
+                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
+                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
+                        engineered to be isolated from failures in other Availability Zones. By launching instances in
+                        separate Availability Zones, you can protect your applications from the failure of a single
+                        location. AWS assigns a unique ID to each subnet.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
+                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
+                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
+                        in a VPC, the CIDR blocks of the subnets must not overlap.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
+                        where possible.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
+                        fault tolerance and high availability from the perspective of resource deployment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-subnet --vpc-id application_vpc
+                        --cidr-block desired_cidr
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-tags --resources web_tier_elb_subnet1
+                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  OR 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  When an internal load balancer is created, it receives a public DNS name with the following form: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   internal-name-123456789.region.elb.amazonaws.com 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
+          </references>
+          <standards>
+            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The SG associated with the App tier ELB should allow connectivity from the security group
+                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
+                        the application design.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
+                        ELB:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
+                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; },
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
+                        --ip-permissions file:///PathTo/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This is required for both the configured port and protocol for the listener on the back-end
+                        instance and the port and protocol used for the health check.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
+                        security group rules that allow traffic for the specific application protocol and ports by
+                        referencing as source the security group associated with the App tier ELB.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
+                        element from Audit procedure):&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
+                        App tier ELB security group as the source of the connections:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
+                        --protocol tcp --port specific_port
+                        --source-group app_tier_elb_security_group
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
+                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
+                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
+                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+          </references>
+          <standards>
+            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;quot;AccessLog&amp;quot;: { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
+            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
+            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
+          </references>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Via Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all ELB's:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
+            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
+            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
+            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
+            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
+            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
+          </references>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-server-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For Amazon Certificate Manager users: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm list-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
+                        establishing a new connection supporting the Server Order Preference option. When this option is
+                        selected, the load balancer selects the first cipher in its list that is in the client's list of
+                        ciphers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
+                        &lt;br /&gt;To enable Server Order Preference:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Click Save. &lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  In order to use HTTPS, an SSL\TLS certificate must be attached. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   "OriginProtocolPolicy": "https-only", 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
+                            distributions (it should be set as https-only):&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
+                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+  &lt;div style=""&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; }, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     ] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the security group id from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt; 
+    &lt;div&gt;
+      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
+                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
+                        through the use of a unique random session key, and therefore prevents the decoding of captured
+                        data, even if the secret long-term key is compromised.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
+                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
+                            Cryptography (ECDHE) cipher suites.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.13" mitigation="9"/>
+                    <countermeasure ref="aws-tier-6.17" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.19" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.21" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.22" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.1" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.14" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.15" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.18" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.26" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.5" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.1" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.14" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.15" mitigation="7"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.13" mitigation="9"/>
+                <countermeasure ref="aws-tier-6.17" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.18" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.19" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.21" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.22" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.26" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.5" mitigation="7"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="unknown-resource-status">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ca5c76bb-4bee-4a37-b807-3cab139cd499" diagramComponentId="8670166e-dc36-4f52-bea6-4545e9992c88" ref="794c99e8-a31a-4592-93a6-618a207a7aaa" name="PostgreSQL" desc="" library="CS-Default" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+            <implementation platform="Java">
+              <desc>
+                                ClN0cmluZyBzZWxlY3RTdGF0ZW1lbnQgPSAiU0VMRUNUICogRlJPTSBVc2VyIFdIRVJFIHVzZXJJZCA9ID8gIjsKUHJlcGFyZWRTdGF0ZW1lbnQgcHJlcFN0bXQgPSBjb24ucHJlcGFyZVN0YXRlbWVudChzZWxlY3RTdGF0ZW1lbnQpOwpwcmVwU3RtdC5zZXRTdHJpbmcoMSwgdXNlcklkKTsKUmVzdWx0U2V0IHJzID0gcHJlcFN0bXQuZXhlY3V0ZVF1ZXJ5KCk7Cg==
+                            </desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="50f3c51c-b1e1-4c4f-a363-2f611369ea35" diagramComponentId="f724f657-7b55-4a94-b235-295a78d04b3c" ref="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" name="AWS ElastiCache for Redis" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="CD-ELASTICACHE-FOR-REDIS">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.571">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:22.572">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-ELASTICACHE2-REDIS" name="Authenticate users with Redis AUTH or RBAC" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Authenticate users with Redis AUTH or RBAC 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Redis authentication tokens enable Redis to require a token (password) before allowing clients to run commands, thereby improving data security. Instead of authenticating users with the Redis AUTH command, in Amazon ElastiCache for Redis 6.x you can use a feature called Role-Based Access Control (RBAC). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying Redis AUTH to an ElastiCache for Redis Cluster 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can require that users enter a token on a token-protected Redis server. To do this, include the parameter --auth-token (API: AuthToken) with the correct token when you create your replication group or cluster. Also include it in all subsequent commands to the replication group or cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying RBAC to a Replication Group for ElastiCache for Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To use ElastiCache for Redis RBAC, you take the following steps: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Create one or more users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Create a user group and add users to the group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Assign the user group to a replication group that has in-transit encryption enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Authenticating Users with Role-Based Access Control (RBAC)" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html"/>
+            <reference name="Authenticating Users with the Redis AUTH Command" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that you use Redis AUTH or RBAC for enhanced security.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.465">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE7-REDIS" name="Enable AOF in AWS ElastiCache for Redis" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable Append Only Files (AOF) in AWS ElastiCache for Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, the data in a Redis node on ElastiCache resides only in memory and isn't persistent. If a node is rebooted, or if the underlying physical server experiences a hardware failure, the data in the cache is lost. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you require data durability, you can enable the Redis append-only file feature (AOF). When this feature is enabled, the node writes all of the commands that change cache data to an append-only file. When a node is rebooted and the cache engine starts, the AOF is "replayed." The result is a warm Redis cache with all of the data intact. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AOF is disabled by default. To enable AOF for a cluster running Redis, you must create a parameter group with the appendonly parameter set to yes. You then assign that parameter group to your cluster. You can also modify the appendfsync parameter to control how often Redis writes to the AOF file. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When using AOF, keep the following in mind: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - To improve performance, consider enabling RDB snapshots on a designated persistence only secondary node. Then, disable both RDB snapshots and AOF on the primary node and all other secondary nodes. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - To improve performance, set the value of the appendfsync parameter to everysec or no to write to disk every second or as needed. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - AOF is supported only for use with Redis versions 2.8.21 and earlier. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - AOF is subject to the limitations described at Mitigating failures: Redis Append Only Files (AOF). 
+&lt;/div&gt; 
+&lt;div&gt;
+  - AOF isn't supported for cache.t1.micro and cache.t2.* nodes, or Multi-AZ replication groups. For nodes of these types, the appendonly parameter value is ignored. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Manual backups using AOF is a suitable option for maintaining a high level of data persistence at a relatively low cost by using the functionality that is native to Redis versions 2.8.21 and earlier. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Performance impact - Low to high. AOF performance impact is highly correlated with the associated appendfsync parameter value, which controls how often the AOF output buffer is written to disk. The more frequently the output buffer is written to disk, the greater the impact on performance. Choosing the always option for this parameter causes the buffer to be flushed every time the cache data is modified. Therefore, this option isn't recommended. Because the AOF file can grow quickly, it's a best practice to verify your disk space requirements. Another performance consideration for AOF is the time required to replay an AOF file. You might need several minutes to populate the Redis nodes with the cache data. During this time, your application can satisfy queries only for uncached data by directly querying your database. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Append Only Files (AOF) in ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/RedisAOF.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that AOF is enabled in AWS ElastiCache for Redis.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE6-REDIS" name="Enable automatic backups on AWS ElastiCache clusters running Redis" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable automatic backips on AWS ElastiCache clusters running Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon ElastiCache clusters running Redis can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all of the data in the cluster. All backups are written to Amazon Simple Storage Service (Amazon S3), which provides durable storage. At any time, you can restore your data by creating a new Redis cluster and populating it with data from a backup. With ElastiCache, you can manage backups using the AWS Management Console, the AWS Command Line Interface (AWS CLI), and the ElastiCache API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable or disable automatic backups on an existing Redis cluster or replication group by modifying it using the ElastiCache console, the AWS CLI, or the ElastiCache API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Using the AWS Management Console 
+&lt;/div&gt; 
+&lt;div&gt;
+  To modify a cluster (console) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the AWS Management Console and open the ElastiCache console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. From the list in the upper-right corner, choose the AWS Region where the cluster that you want to modify is located. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the navigation pane, choose the engine running on the cluster that you want to modify. 
+&lt;/div&gt; 
+&lt;div&gt;
+  A list of the chosen engine's clusters appears. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. In the list of clusters, for the cluster that you want to modify, choose its name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Choose Actions and then choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Modify Cluster window appears. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. In the Modify Cluster window, make the modifications that you want. 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Apply Immediately box applies only to node type and engine version modifications. To apply changes immediately, choose the Apply Immediately check box. If this box is not chosen, node type and engine version modifications are applied during the next maintenance window. Other modifications, such as changing the maintenance window, are applied immediately. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable or disable automatic backups when creating a Redis cluster or replication group using the ElastiCache console, the AWS CLI, or the ElastiCache API. You can enable automatic backups when you create a Redis cluster by checking the Enable Automatic Backups box in the Advanced Redis Settings section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Performance Impact of Backups 
+&lt;/div&gt; 
+&lt;div&gt;
+  The backup process depends upon which Redis version you're running. Beginning with Redis 2.8.22, the process is forkless. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Backup and Restore for ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Enable Automatic Backups box is checked in the Advanced Redis Settings section.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE5-REDIS" name="Enable AWS ElastiCache at-rest encryption for Redis" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable AWS ElastiCache at-rest encryption for Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  ElastiCache for Redis at-rest encryption is an optional feature to increase data security by encrypting on-disk data. When enabled on a replication group, it encrypts the following aspects: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Disk during sync, backup and swap operations 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Backups stored in Amazon S3 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want to enable at-rest encryption, you must meet the following conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Your cluster or replication group must be running Redis 3.2.6, 4.0.10 or later. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Your cluster or replication group must be created in a VPC based on Amazon VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, you can also use AUTH and the AUTH token (password) needed to perform operations on this cluster or replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable ElastiCache at-rest encryption when you create a Redis replication group by setting the parameter AtRestEncryptionEnabled to true. You can't enable at-rest encryption on existing replication groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable at-rest encryption when you create an ElastiCache for Redis replication group. You can do so using the AWS Management Console, the AWS CLI, or the ElastiCache API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When creating a replication group, you can pick one of the following options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Default - This option uses service managed encryption at rest. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Customer managed CMK - This option allows you to provide the Key ID/ARN from AWS KMS for encryption at rest. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enabling At-Rest Encryption on an Existing Redis Cluster 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can only enable at-rest encryption when you create a Redis replication group. If you have an existing replication group on which you want to enable at-rest encryption, do the following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable at-rest encryption on an existing replication group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Create a manual backup of your existing replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Create a new replication group by restoring from the backup. On the new replication group, enable at-rest encryption.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Update the endpoints in your application to point to the new replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Delete the old replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enabling At-Rest Encryption Using the AWS Management Console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable at-rest encryption when creating a replication group using the AWS Management Console, make the following selections: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose Redis as your engine. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Choose version 3.2.6, 4.0.10 or later as your engine version. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Choose Yes from the Encryption at-rest list. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because there is some processing needed to encrypt and decrypt the data, enabling at-rest encryption can have a performance impact during these operations. You should benchmark your data with and without at-rest encryption to determine the performance impact for your use cases. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="At-Rest Encryption in ElastiCache for Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/at-rest-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that AWS ElastiCache at-rest encryption for Redis is enabled when creating a replication group.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE3-REDIS" name="Enable AWS ElastiCache in-transit encryption for Redis" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable AWS ElastiCache in-transit encryption for Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To help keep your data secure, Amazon ElastiCache and Amazon EC2 provide mechanisms to guard against unauthorized access of your data on the server. By providing in-transit encryption capability, ElastiCache gives you a tool you can use to help protect your data when it is moving from one location to another. For example, you might move data from a primary node to a read replica node within a replication group, or between your replication group and your application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want to enable in-transit encryption, you must meet the following conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Your cluster or replication group must be running Redis 3.2.6, 4.0.10 or later. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Your cluster or replication group must be created in a VPC based on Amazon VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, you can also use AUTH and the AUTH token (password) needed to perform operations on this cluster or replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable in-transit encryption when you create an ElastiCache for Redis replication group using the AWS Management Console, the AWS CLI, or the ElastiCache API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enabling In-Transit Encryption on an Existing Cluster 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can only enable in-transit encryption when you create a Redis replication group. If you have an existing replication group on which you want to enable in-transit encryption, do the following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable in-transit encryption for an existing Redis replication group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Create a manual backup of the replication group. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Create a new replication group by restoring from the backup setting the engine version to 3.2.6, 4.0.10 and later, and the parameter TransitEncryptionEnabled to true (CLI: --transit-encryption-enabled). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Update the endpoints in your application to the new replication group's endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Delete the old replication group. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enabling In-Transit Encryption Using the AWS Management Console 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable in-transit encryption when creating a replication group using the AWS Management Console, make the following selections: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose Redis as your engine. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Choose engine version 3.2.6, 4.0.10 or later. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Choose Yes from the Encryption in-transit list. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because of the processing required to encrypt and decrypt the data at the endpoints, implementing in-transit encryption can reduce performance. Benchmark in-transit encryption compared to no encryption on your own data to determine its impact on performance for your implementation. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="ElastiCache for Redis In-Transit Encryption (TLS)" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that AWS ElastiCache in-transit encryption for Redis is enabled when creating a replication group.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE4-REDIS" name="Enable Multi-AZ in AWS ElastiCache for Redis" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable Multi-AZ in AWS ElastiCache for Redis 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  In certain cases, ElastiCache for Redis detects and replaces a primary node. These cases include certain types of planned maintenance and the unlikely event of a primary node or Availability Zone failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This replacement results in some downtime for the cluster. If you have Multi-AZ enabled on the cluster, the downtime is minimized. In this case, the role of primary node fails over to one of the read replicas. There's no need to create and provision a new primary node. This failover and replica promotion ensure that you can resume writing to the new primary as soon as promotion is complete. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable Multi-AZ using the ElastiCache console when you create a new Redis cluster or by modifying an existing Redis cluster with replication. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-AZ is enabled by default on Redis (cluster mode enabled) clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Important 
+&lt;/div&gt; 
+&lt;div&gt;
+  ElastiCache will automatically enable Multi-AZ only if the cluster contains at least one replica in a different Availability Zone from the primary in all shards. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When creating a Cluster Mode Disabled Cluster (Console) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Number of replicas, choose the number of read replicas that you want for this cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If you choose to have one or more replicas, the Multi-AZ check box is available. AWS strongly suggests that you enable Multi-AZ, which helps ensure your eligibility for service level agreement (SLA) compliance. If you enter 0, the Multi-AZ check box is not enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Minimizing Downtime in ElastiCache for Redis with Multi-AZ" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Multi-AZ is enabled in AWS ElastiCache for Redis.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:17.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="redis" name="Redis" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE3-REDIS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE3-REDIS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE2-REDIS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE2-REDIS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE4-REDIS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE4-REDIS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE6-REDIS" mitigation="50"/>
+                    <countermeasure ref="AWS-ELASTICACHE7-REDIS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE6-REDIS" mitigation="50"/>
+                <countermeasure ref="AWS-ELASTICACHE7-REDIS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE5-REDIS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE5-REDIS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="5160f03a-545b-46a5-9108-ce52631e57bd" diagramComponentId="9952204e-7e2c-440c-9505-54c1c1f55e81" ref="458aeca6-65f5-4791-a48c-3d18d76a02b5" name="Elasticsearch" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="elasticsearch">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.231">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.213">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.219">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.202">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-ELASTICSEARCH1" name="Control access to Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Control access to Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service offers several ways of controlling access to domains by supporting three types of access policies:&lt;br&gt; - Resource-based Policies&lt;br&gt; - Identity-based Policies&lt;br&gt; - IP-based Policies&lt;/p&gt; 
+&lt;p&gt;Fine-grained access control offers additional ways of controlling access to your data on Amazon Elasticsearch Service. For example, depending on who makes the request, you might want a search to return results from only one index. You might want to hide certain fields in your documents or exclude certain documents altogether. Fine-grained access control offers the following features:&lt;br&gt; - Role-based access control&lt;br&gt; - Security at the index, document, and field level&lt;br&gt; - Kibana multi-tenancy&lt;br&gt; - HTTP basic authentication for Elasticsearch and Kibana&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To configure access policies (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain that you want to update.&lt;/p&gt; 
+&lt;p&gt;4. Choose Actions and Modify access policy.&lt;/p&gt; 
+&lt;p&gt;5. Edit the access policy JSON, or use the dropdown list to choose a preconfigured option.&lt;/p&gt; 
+&lt;p&gt;6. Choose Submit.&lt;/p&gt; 
+&lt;p&gt;Enabling Fine-Grained Access Control&lt;/p&gt; 
+&lt;p&gt;Enable fine-grained access control using the console, AWS CLI, or configuration API. The console offers the simplest experience while creating a new domain.&lt;/p&gt; 
+&lt;p&gt;In the Fine-grained access control section, enable or disable fine-grained access control:&lt;/p&gt; 
+&lt;p&gt;- If you want to use IAM for user management, choose Set IAM role as master user and specify the ARN for an IAM role.&lt;/p&gt; 
+&lt;p&gt;- If you want to use the internal user database, choose Create a master user and specify a user name and password.&lt;/p&gt; 
+&lt;p&gt;Whichever option you choose, the master user can access all indices in the cluster and all Elasticsearch APIs.&lt;/p&gt; 
+&lt;p&gt;If you disable fine-grained access control, you can still control access to your domain by placing it within a VPC, applying a restrictive access policy, or both. You must enable node-to-node encryption and encryption at rest to use fine-grained access control.&lt;/p&gt; 
+&lt;p&gt;Here are the requirements for enabling fine-grained access control:&lt;/p&gt; 
+&lt;p&gt;- Elasticsearch 6.7 or later&lt;br&gt; - Encryption of data at rest and node-to-node encryption enabled&lt;br&gt; - Require HTTPS for all traffic to the domain enabled&lt;/p&gt; 
+&lt;p&gt;You can't enable fine-grained access control on existing domains, only new ones. After you enable fine-grained access control, you can't disable it.&lt;/p&gt; 
+&lt;p&gt;For more information and examples about different types of policies and access control, please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; If you enabled VPC access for your domain, you can't configure an IP-based policy. Instead, you can use security groups to control which IP addresses can access the domain.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Creating and Managing Amazon Elasticsearch Service Domains" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html"/>
+            <reference name="Identity and Access Management in Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH7" name="Create alerts for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Configure alerts in Amazon Elasticsearch Service (Amazon ES) to get notified when data from one or more Elasticsearch indices meets certain conditions. &lt;br&gt; For example, you might want to receive an email if your application logs more than five HTTP 503 errors in one hour, or you might want to page a developer if no new documents have been indexed in the last 20 minutes.&lt;br&gt; Alerting requires Elasticsearch version 6.2 or later.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To get started with alerting&lt;/p&gt; 
+&lt;p&gt;1. Choose Alerting from the Kibana main menu.&lt;/p&gt; 
+&lt;p&gt;2. Set up a destination for the alert. Choose between Slack, Amazon Chime, a custom webhook, or Amazon SNS. As you might imagine, notifications require connectivity to the destination. For example, your Amazon ES domain must be able to connect to the internet to notify a Slack channel or send a custom webhook to a third-party server.&lt;/p&gt; 
+&lt;p&gt;3. Create a monitor in one of three ways: visually, using a query, or using an anomaly detector.&lt;/p&gt; 
+&lt;p&gt;4. Define a condition to trigger the monitor.&lt;/p&gt; 
+&lt;p&gt;5. (Optional) Add one or more actions to the monitor.&lt;/p&gt; 
+&lt;p&gt;Tip&lt;br&gt; After an action successfully sends a message, secure access to that message. If your domain contains sensitive data, consider using triggers without actions and periodically checking Kibana for alerts.&lt;/p&gt; 
+&lt;p&gt;For further information and Recommended CloudWatch Alarms please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Alerting for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/alerting.html"/>
+            <reference name="Recommended CloudWatch Alarms" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/cloudwatch-alarms.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have created alerts for Amazon Elasticsearch.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH6" name="Enable all logs for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable all logs for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES exposes four Elasticsearch logs through Amazon CloudWatch Logs: error logs, search slow logs, index slow logs, and audit logs. Search slow logs, index slow logs, and error logs are useful for troubleshooting performance and stability issues. Audit logs track user activity for compliance purposes. &lt;br&gt; All the logs are disabled by default.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Log Publishing (Console)&lt;/p&gt; 
+&lt;p&gt;The Amazon ES console is the simplest way to enable the publishing of logs to CloudWatch.&lt;/p&gt; 
+&lt;p&gt;To enable log publishing to CloudWatch (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
+&lt;p&gt;4. On the Logs tab, choose Setup for the log you want.&lt;/p&gt; 
+&lt;p&gt;5. Create a CloudWatch log group, or choose an existing one.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; If you plan to enable multiple logs, AWS recommends publishing each to its own log group. This separation makes the logs easier to scan.&lt;/p&gt; 
+&lt;p&gt;6. Choose an access policy that contains the appropriate permissions, or create a policy using the JSON that the console provides:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com" }, "Action": [ "logs:PutLogEvents", "logs:CreateLogStream" ], "Resource": "cw_log_group_arn" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Important&lt;br&gt; CloudWatch Logs supports 10 resource policies per Region. If you plan to enable logs for several Amazon ES domains, you should create and reuse a broader policy that includes multiple log groups to avoid reaching this limit.&lt;/p&gt; 
+&lt;p&gt;7. Choose Enable.&lt;/p&gt; 
+&lt;p&gt;Audit Log Kibana UI&lt;/p&gt; 
+&lt;p&gt;After you enable audit logs, configure them to match your needs.&lt;/p&gt; 
+&lt;p&gt;1. Open Kibana, and choose Security.&lt;/p&gt; 
+&lt;p&gt;2. Choose Audit logs.&lt;/p&gt; 
+&lt;p&gt;3. Choose Enable audit logging.&lt;/p&gt; 
+&lt;p&gt;The Kibana UI offers full control of audit log settings under General settings and Compliance settings.&lt;/p&gt; 
+&lt;p&gt;Setting Elasticsearch Logging Thresholds for Slow Logs&lt;/p&gt; 
+&lt;p&gt;After you enable the publishing of slow logs to CloudWatch, you still must specify logging thresholds for each Elasticsearch index. These thresholds define precisely what should be logged and at which log level.&lt;/p&gt; 
+&lt;p&gt;You specify these settings through the Elasticsearch REST API:&lt;/p&gt; 
+&lt;p&gt;PUT elasticsearch_domain_endpoint/index/_settings&lt;br&gt; { "index.search.slowlog.threshold.query.warn": "5s", "index.search.slowlog.threshold.query.info": "2s"&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; The status of your domain changes from Active to Processing. The status must return to Active before log publishing is enabled. This change typically takes 30 minutes, but can take longer depending on your domain configuration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Audit Logs for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/audit-logs.html"/>
+            <reference name="Configuring Elasticsearch Logs" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createdomain-configure-slow-logs.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Observe the logs&lt;/p&gt;
+
+	&lt;p&gt;1. Open the CloudWatch console.&lt;br /&gt;
+2. In the navigation pane, choose Log groups.&lt;br /&gt;
+3. Choose the log group that you specified while enabling logs. Within the log group, Amazon ES creates a log stream for each node in your domain.&lt;br /&gt;
+4. In Log streams, choose Search all.&lt;br /&gt;
+5. For the read and write events, see the corresponding logs. You can expect a delay of 5 seconds before the log appears.&lt;/p&gt;
+
+
+	&lt;p&gt;Testing slow logs&lt;/p&gt;
+
+	&lt;p&gt;To test that slow logs are publishing successfully, consider starting with very low values to verify that logs appear in CloudWatch, and then increase the thresholds to more useful levels.&lt;/p&gt;
+
+	&lt;p&gt;If the logs don't appear, check the following:&lt;/p&gt;
+
+	&lt;p&gt;- Does the CloudWatch log group exist? Check the CloudWatch console.&lt;/p&gt;
+
+	&lt;p&gt;- Does Amazon ES have permissions to write to the log group? Check the Amazon ES console.&lt;/p&gt;
+
+	&lt;p&gt;- Is the Amazon ES domain configured to publish to the log group? Check the Amazon ES console, use the AWS CLI describe-elasticsearch-domain-config option, or call DescribeElasticsearchDomainConfig using one of the SDKs.&lt;/p&gt;
+
+	&lt;p&gt;- Are the Elasticsearch logging thresholds low enough that your requests are exceeding them? To review your thresholds for an index, use the following command:&lt;/p&gt;
+
+	&lt;p&gt;GET elasticsearch_domain_endpoint/index/_settings?pretty&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH5" name="Enable dedicated master nodes for production Amazon Elasticsearch domains" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable dedicated master nodes for production Amazon Elasticsearch domains&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon Elasticsearch Service uses dedicated master nodes to increase cluster stability. A dedicated master node performs cluster management tasks, but does not hold data or respond to data upload requests. AWS recommends that you add three dedicated master nodes to each production Amazon ES domain. Never choose an even number of dedicated master nodes.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; When creating and managing Amazon ES domains:&lt;/p&gt; 
+&lt;p&gt;- Enable dedicated master nodes. Dedicated master nodes increase cluster stability and are required for domains that have instance counts greater than 10. AWS recommends three dedicated master nodes for production domains.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; You can choose different instance types for your dedicated master nodes and data nodes. For example, you might select general purpose or storage-optimized instances for your data nodes, but compute-optimized instances for your dedicated master nodes.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Dedicated Master Nodes" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-dedicatedmasternodes.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that dedicated master nodes option is enabled and three dedicated master nodes are used for each domain.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.818">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH4" name="Enable encryption of data at rest for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable encryption of data at rest for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES domains offer encryption of data at rest, a security feature that helps prevent unauthorized access to your data. The feature uses AWS Key Management Service (AWS KMS) to store and manage your encryption keys and the Advanced Encryption Standard algorithm with 256-bit keys (AES-256) to perform the encryption. If enabled, the feature encrypts the following aspects of a domain:&lt;/p&gt; 
+&lt;p&gt;- All indices (including those in UltraWarm storage)&lt;br&gt; - Elasticsearch logs&lt;br&gt; - Swap files&lt;br&gt; - All other data in the application directory&lt;br&gt; - Automated snapshots&lt;/p&gt; 
+&lt;p&gt;The following are not encrypted when you enable encryption of data at rest, but you can take additional steps to protect them:&lt;/p&gt; 
+&lt;p&gt;- Manual snapshots: You currently can't use KMS master keys to encrypt manual snapshots. You can, however, use server-side encryption with S3-managed keys or customer master keys (CMKs) to encrypt the bucket you use as a snapshot repository.&lt;br&gt; - Slow logs and error logs: If you publish logs and want to encrypt them, you can encrypt their CloudWatch Logs log group using the same AWS KMS master key as the Amazon ES domain.&lt;/p&gt; 
+&lt;p&gt;Amazon ES supports only symmetric customer master keys, not asymmetric ones.&lt;/p&gt; 
+&lt;p&gt;Regardless of whether encryption at rest is enabled, all domains automatically encrypt custom packages using AES-256 and Amazon ES-managed keys.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Encryption of Data at Rest&lt;/p&gt; 
+&lt;p&gt;Encryption of data at rest on new domains requires Elasticsearch 5.1 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
+&lt;p&gt;To use the Amazon ES console to configure encryption of data at rest, you must have read permissions to AWS KMS, such as the following identity-based policy:&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:List*", "kms:Describe*" ], "Resource": "*" } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;If you want to use a master key other than (Default) aws/es, you must also have permissions to create grants for the key. These permissions typically take the form of a resource-based policy that you specify when you create the key.&lt;/p&gt; 
+&lt;p&gt;If you want to keep your key exclusive to Amazon ES, you can add the kms:ViaService condition to that key policy:&lt;/p&gt; 
+&lt;p&gt;"Condition": { "StringEquals": { "kms:ViaService": "es.us-west-1.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" }&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Warning&lt;br&gt; If you delete the key that you used to encrypt a domain, the domain becomes inaccessible. The Amazon ES team can't help you recover your data. AWS KMS deletes master keys only after a waiting period of at least seven days, so the Amazon ES team might contact you if they detect that your domain is at risk.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; - Automatic key rotation preserves the properties of your AWS KMS master keys, so the rotation has no effect on your ability to access your Elasticsearch data. Encrypted Amazon ES domains don't support manual key rotation, which involves creating a new master key and updating any references to the old key. &lt;br&gt; - Certain instance types don't support encryption of data at rest.&lt;br&gt; - Domains that encrypt data at rest use a different repository name for their automated snapshots.&lt;br&gt; - Encrypting an Amazon ES domain requires a grant, and each encryption key has a limit of 500 grants per principal. This limit means that the maximum number of Amazon ES domains that you can encrypt using a single key is 500. Currently, Amazon ES supports a maximum of 100 domains per account (per Region), so this grant limit is of no consequence. If the domain limit per account increases, however, the grant limit might become relevant.&lt;br&gt; If you need to encrypt more than 500 domains at that time, you can create additional keys. Keys are regional, not global, so if you operate in more than one AWS Region, you already need multiple keys.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Encryption of Data at Rest for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/encryption-at-rest.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To ensure that encryption of data at rest for Amazon Elasticsearch is enabled (from console):&lt;/p&gt;
+
+	&lt;p&gt;1. Sign In to the Console.&lt;br /&gt;
+2. Go to Amazon Elasticsearch dashboard.&lt;br /&gt;
+3. Ensure that Encryption at rest is set to Enabled on the selected domain&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH9" name="Enable Node-to-node Encryption for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Node-to-node Encryption for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Node-to-node encryption provides an additional layer of security on top of the default features of Amazon ES.&lt;/p&gt; 
+&lt;p&gt;Each Amazon ES domain-regardless of whether the domain uses VPC access-resides within its own, dedicated VPC. This architecture prevents potential attackers from intercepting traffic between Elasticsearch nodes and keeps the cluster secure. By default, however, traffic within the VPC is unencrypted. Node-to-node encryption enables TLS 1.2 encryption for all communications within the VPC.&lt;/p&gt; 
+&lt;p&gt;If you send data to Amazon ES over HTTPS, node-to-node encryption helps ensure that your data remains encrypted as Elasticsearch distributes (and redistributes) it throughout the cluster. If data arrives unencrypted over HTTP, Amazon ES encrypts it after it reaches the cluster. You can require that all traffic to the domain arrive over HTTPS using the console, AWS CLI, or configuration API.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling Node-to-node Encryption&lt;/p&gt; 
+&lt;p&gt;Node-to-node encryption on new domains requires Elasticsearch 6.0 or later. Enabling the feature on existing domains requires Elasticsearch 6.7 or later. Choose the existing domain in the AWS console, Actions, and Modify encryption.&lt;/p&gt; 
+&lt;p&gt;Alternatively, you can use the AWS CLI or configuration API.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; After you configure a domain to use node-to-node encryption, you can't disable the setting. Instead, you can take a manual snapshot of the encrypted domain, create another domain, migrate your data, and delete the old domain.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Node-to-node Encryption for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ntn.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Node-to-node Encryption for Amazon Elasticsearch is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.855">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH8" name="Set up Anomaly Detection for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Set up Anomaly Detection for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Anomaly detection in Amazon Elasticsearch Service (Amazon ES) automatically detects anomalies in your Elasticsearch data in near-real time by using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream. The algorithm computes an anomaly grade and confidence score value for each incoming data point. Anomaly detection uses these values to differentiate an anomaly from normal variations in your data.&lt;br&gt; You can pair the anomaly detection plugin with the Alerting for Amazon Elasticsearch Service plugin to notify you as soon as an anomaly is detected.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Anomaly detection requires Elasticsearch 7.4 or later. All instance types support anomaly detection except for t2.micro and t2.small.&lt;/p&gt; 
+&lt;p&gt;Getting Started with Anomaly Detection&lt;/p&gt; 
+&lt;p&gt;To get started, choose Anomaly Detection in Kibana.&lt;/p&gt; 
+&lt;p&gt;Step 1: Create a Detector&lt;/p&gt; 
+&lt;p&gt;A detector is an individual anomaly detection task. You can create multiple detectors, and all the detectors can run simultaneously, with each analyzing data from different sources.&lt;/p&gt; 
+&lt;p&gt;Step 2: Add Features to Your Detector&lt;/p&gt; 
+&lt;p&gt;A feature is the field in your index that you check for anomalies. A detector can discover anomalies across one or more features. You must choose one of the following aggregations for each feature: average(), sum(), count(), min(), or max().&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; The count() aggregation method is only available in Elasticsearch version 7.7 and later. For version 7.4, use a custom expression like the following:&lt;/p&gt; 
+&lt;p&gt;{ "aggregation_name": { "value_count": { "field": "field_name" } }&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;The aggregation method determines what constitutes an anomaly. For example, if you choose min(), the detector focuses on finding anomalies based on the minimum values of your feature. If you choose average(), the detector finds anomalies based on the average values of your feature. You can add a maximum of five features per detector.&lt;/p&gt; 
+&lt;p&gt;You can configure the following optional settings (available in 7.7 and later):&lt;/p&gt; 
+&lt;p&gt;- Category field - Categorize or slice your data with a dimension like IP address, product ID, country code, and so on.&lt;/p&gt; 
+&lt;p&gt;- Window size - Set the number of aggregation intervals from your data stream to consider in a detection window.&lt;/p&gt; 
+&lt;p&gt;After you set up your features, preview sample anomalies and adjust the feature settings if necessary.&lt;/p&gt; 
+&lt;p&gt;Step 3: Observe the Results&lt;/p&gt; 
+&lt;p&gt;- Live anomalies - displays the live anomaly results for the last 60 intervals. For example, if the interval is set to 10, it shows the results for the last 600 minutes. This chart refreshes every 30 seconds.&lt;/p&gt; 
+&lt;p&gt;- Anomaly history - plots the anomaly grade with the corresponding measure of confidence.&lt;/p&gt; 
+&lt;p&gt;- Feature breakdown - plots the features based on the aggregation method. You can vary the date-time range of the detector.&lt;/p&gt; 
+&lt;p&gt;- Anomaly occurrence - shows the Start time, End time, Data confidence, and Anomaly grade for each anomaly detected.&lt;/p&gt; 
+&lt;p&gt;If you set the category field, you see an additional Heat map chart that correlates results for anomalous entities. Choose a filled rectangle to see a more detailed view of the anomaly.&lt;/p&gt; 
+&lt;p&gt;Step 4: Set Up Alerts&lt;br&gt; To create a monitor to send you notifications when any anomalies are detected, choose Set up alerts. The plugin redirects you to the Add monitor page where you can configure an alert.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Anomaly Detection for Amazon Elasticsearch Service" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/ad.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Anomaly Detection for Amazon Elasticsearch has been properly configured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.846">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH3" name="Update Service Software for Amazon Elasticsearch" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Update Service Software for Amazon Elasticsearch&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Amazon ES regularly releases system software updates that add features or otherwise improve your domains.&lt;br&gt; The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge.&lt;br&gt; Each notification includes details about the service software update. The notification severity is Informational if the update is optional and High if it's required. Consider the following when deciding whether to update your domain:&lt;br&gt; - If you take no action on required updates, Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation, Amazon ES sends notifications when it starts the update and when the update is complete.&lt;br&gt; - If you start an update manually, Amazon ES doesn't send a notification when it starts the update, only when the update is complete.&lt;br&gt; Manually updating your domain lets you take advantage of new features more quickly.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Service software updates differ from Elasticsearch version upgrades.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To request a service software update (console)&lt;/p&gt; 
+&lt;p&gt;1. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;2. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;3. In the navigation pane, under My domains, choose the domain you want to update.&lt;/p&gt; 
+&lt;p&gt;4. For Service software release, follow the documentation link to compare your current version to the latest version. Then choose Update.&lt;/p&gt; 
+&lt;p&gt;To request a service software update (AWS CLI and AWS SDKs)&lt;/p&gt; 
+&lt;p&gt;You can use the following commands to see if an update is available, check upgrade eligibility, and request an update:&lt;/p&gt; 
+&lt;p&gt;describe-elasticsearch-domain (DescribeElasticsearchDomain)&lt;/p&gt; 
+&lt;p&gt;start-elasticsearch-service-software-update (StartElasticsearchServiceSoftwareUpdate)&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Consider starting the update at a low traffic time.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Service Software Updates" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Service Software for Amazon Elasticsearch has been updated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICSEARCH2" name="Upgrade Amazon Elasticsearch to the latest version" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Upgrade Amazon Elasticsearch to the latest version&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; To get the new Elasticsearch features, bug fixes and security updates, upgrade Elasticsearch to the latest version.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Elasticsearch version upgrades differ from service software updates.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The upgrade process consists of three steps:&lt;/p&gt; 
+&lt;p&gt;1. Pre-upgrade checks - Amazon ES performs a series of checks for issues that can block an upgrade and doesn't proceed to the next step unless these checks succeed.&lt;/p&gt; 
+&lt;p&gt;2. Snapshot - Amazon ES takes a snapshot of the Elasticsearch cluster and doesn't proceed to the next step unless the snapshot succeeds. If the upgrade fails, Amazon ES uses this snapshot to restore the cluster to its original state.&lt;/p&gt; 
+&lt;p&gt;3. Upgrade - Amazon ES starts the upgrade, which can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;/p&gt; 
+&lt;p&gt;Starting an Upgrade&lt;/p&gt; 
+&lt;p&gt;The upgrade process is irreversible and can't be paused or canceled. During an upgrade, you can't make configuration changes to the domain. Before starting an upgrade, double-check that you want to proceed. You can use these same steps to perform the pre-upgrade check without actually starting an upgrade.&lt;/p&gt; 
+&lt;p&gt;If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;/p&gt; 
+&lt;p&gt;To upgrade a domain to a later version of Elasticsearch (console)&lt;/p&gt; 
+&lt;p&gt;1. Take a manual snapshot of your domain. This snapshot serves as a backup that you can restore on a new domain if you want to return to using the prior Elasticsearch version.&lt;/p&gt; 
+&lt;p&gt;2. Sign In to the Console.&lt;/p&gt; 
+&lt;p&gt;3. Under Analytics, choose Elasticsearch Service.&lt;/p&gt; 
+&lt;p&gt;4. In the navigation pane, under My domains, choose the domain that you want to upgrade.&lt;/p&gt; 
+&lt;p&gt;5. Choose Actions and Upgrade domain.&lt;/p&gt; 
+&lt;p&gt;6. For Operation, choose Upgrade, Submit, and Continue.&lt;/p&gt; 
+&lt;p&gt;7. Return to the Overview tab and choose Upgrade status to monitor the state of the upgrade.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; If the cluster has dedicated master nodes, upgrades complete without downtime. Otherwise, the cluster might be unresponsive for several seconds post-upgrade while it elects a master node.&lt;br&gt; Upgrade can take from 15 minutes to several hours to complete. Kibana might be unavailable during some or all of the upgrade.&lt;br&gt; Amazon ES offers in-place Elasticsearch upgrades for domains that run versions 5.1 and later. If you use services like Amazon Kinesis Data Firehose or Amazon CloudWatch Logs to stream data to Amazon ES, check that these services support the newer version of Elasticsearch before migrating.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Upgrading Elasticsearch" url="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-version-migration.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use the following operation to identify the right Elasticsearch version for your domain:&lt;/p&gt;
+
+	&lt;p&gt;get-compatible-elasticsearch-versions (GetCompatibleElasticsearchVersions)&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.789">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH2" mitigation="50"/>
+                <countermeasure ref="AWS-ELASTICSEARCH3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
+                    <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH6" mitigation="34"/>
+                <countermeasure ref="AWS-ELASTICSEARCH7" mitigation="33"/>
+                <countermeasure ref="AWS-ELASTICSEARCH8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICSEARCH9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-5.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="0e2135b9-d234-486d-822f-928bca46b59c" diagramComponentId="da58f473-0983-4a35-aed8-e9fc0d6f4dde" ref="8ecba4d5-1c67-4175-bfc8-e29fb10a2c3d" name="Internal Logging Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="internal-server">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
+                        to known security issues. These issues could be used by an attacker to gain access to the
+                        system.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.510">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Vendors and other maintainers of software release patches in response to security flaws and
+                        other bugs in their products.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
+                        failures or exploitation.&lt;/li&gt;
+                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
+                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
+                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
+                        the flaw.&lt;/li&gt;
+                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
+                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
+                            security and other patches.&lt;/li&gt;
+                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
+                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
+                            taking into account the associated risk.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
+ &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
+ &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
+&lt;/ul&gt; </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:43.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
+          <threats>
+            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers compromise the server that hosts the service or data, then the data and
+                                the service itself could be at risk of compromise. The server could be compromised
+                                through any of the services that it exposes.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNNECESSARY-SERVICES">
+                  <countermeasures>
+                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNPATCHED-SERVER">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b72c4d08-d532-40ca-9d4d-682929663006" diagramComponentId="351ce93a-53cd-41e7-b6fd-a7effc997ac3" ref="329646f1-38b8-4996-93e4-1e342f0bafb3" name="API - I/O" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="api-gateway">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.747">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of a command using
+                    externally-influenced input from an upstream component, but it does not
+                    neutralize or incorrectly neutralizes special elements that could modify the
+                    intended command when it is sent to a downstream
+                    component.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:50.102">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-10T15:20:49.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-12-10T16:38:53.139">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Choose a minimum TLS version for a custom domain in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create a custom domain, you specify the security policy for it. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:38:45.299">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control and manage access to a REST API in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use the following mechanisms for authentication and authorization: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. IAM tags can be used together with IAM policies to control access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-18T15:20:51.952">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for API endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:49:02.306">
+              <output/>
+            </source>
+            <references>
+              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+              <reference name="Routing traffic to an Amazon API Gateway API by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:29:43.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:47:51.718">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a REST API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Do one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create an API and deploy it to a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Logs/Tracing in the Stage Editor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable execution logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable CloudWatch Logs under CloudWatch Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Error or Info from the dropdown menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If desired, choose Enable Detailed CloudWatch Metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable access logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable Access Logging under Custom Access Logging. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable execution logging and access logging independent of each other. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test your logging setup&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:45:18.275">
+              <output/>
+            </source>
+            <references>
+              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
+              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Monitor REST API execution with Amazon CloudWatch metrics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can access CloudWatch using any of the following methods: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon CloudWatch console 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS CLI&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  CloudWatch API 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose the name of the API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Under the selected API, choose Dashboard. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Use From and To to enter the date range. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:46:32.717">
+              <output/>
+            </source>
+            <references>
+              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable payload compression by using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API or create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Another way is to use AWS CLI to create a new API and enable compression. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose a REST API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. In the Resources pane, choose the method you want to test. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For additional options you may need to specify, contact the API owner. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Choose Test. The following information will be displayed: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
+   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
+   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
+   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
+   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
+   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:33:00.030">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If you choose to enable caching for a REST API, you can enable cache encryption. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To configure API caching for individual methods using the console: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Go to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stages list for the API, expand the stage and choose a method in the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Override for this method in Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:28:19.444">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable request validation in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Enable request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test basic request validation using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following steps describe how to test basic request validation in the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test the request validation on a method using TestInvoke in the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  While signed in to the API Gateway console, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Resources for the API that you've configured a request validators map for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a method for which you have enabled the request validation with a specified request validator. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Method Execution, in the Client box, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Invalid request body" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the request parameters aren't valid, the following error message returns: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:41:53.285">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Required" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content-Type: application/json 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: apigateway.us-east-1.amazonaws.com 
+&lt;/div&gt; 
+&lt;div&gt;
+  X-Amz-Date: 20170603T200400Z 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authorization: AWS4-HMAC-SHA256 Credential=... 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "patchOperations" : [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; } 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; ] 
+&lt;/div&gt; 
+&lt;div&gt;
+  }&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of update-stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to remove the old certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of delete-client-certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate in the console for a previously deployed API, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the main navigation pane, choose Client Certificates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Client Certificates pane, choose Generate Client Certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the API for which you want to use the client certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages under the selected API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To save the settings, choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need to redeploy the API for the changes to take effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:31:36.166">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up a stage for a REST API 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a new stage 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the APIs navigation pane, choose Stages under an API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Stages navigation pane, choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Optionally, enter a stage description for Stage description. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To see your Stages follow the steps below: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the APIs pane, choose the API, and then choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the Stages pane, choose the name of the stage. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:34:49.306">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To get started with AWS Secrets Manager: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identify your secrets and locate where they are used in your applications. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update your applications to retrieve secrets from Secrets Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.983">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:20:17.914">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can do this by: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
+  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T11:18:21.424">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose an API method. In Client, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. From Client Certificate, choose Test to invoke the method request. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T10:30:05.704">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+              <reference name="Test invoke to verify the client certificate configuration" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-77">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6b097766-0b12-4b58-9847-8ef48e085739" diagramComponentId="e95e2b87-78dd-4691-abbe-7305c52be781" ref="46ce1e88-97c9-4162-b67f-b64b5af527c6" name="AWS ElastiCache" desc="" library="Hydras-AWS-Foundation" parentComponentRef="ac6b58c4-31d2-491c-8e25-ef787e9af4ae" componentDefinitionRef="elasticache">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE8" name="Apply any updates of type security for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Apply any updates of type security for AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You control when to apply an update, regardless of the recommendation. At a minimum, AWS strongly recommends that you apply any updates of type security to ensure that your clusters are always up-to-date with current security patches. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can apply the service updates using one of the following console options. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Console for Redis or Memcached 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose this to view Update Status for individual clusters, and then choose Apply, View, or Stop for the service updates. If a service update is available, the console displays a banner at the top of the page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you choose Apply Now, you can choose to apply the service update to all or a subset of the applicable clusters in this workflow. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you choose Dismiss, the console stops displaying the banner for that console session. However, the banner reappears the next time that you refresh your session. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  On the Apply Updates Now page, you can use these options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Auto-Update after Due Date: If this attribute is yes, after the Recommended apply by Date has passed, ElastiCache schedules clusters yet to be updated in the appropriate maintenance window. Updates are applied along with other applicable updates. You can continue to apply the updates until the update expiration date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If this attribute is no and you don't apply the self-service update before it expires, ElastiCache doesn't automatically apply the service update for you. If your cluster is part of one or more ElastiCache-supported compliance programs and isn't updated, it remains out of compliance until the next cumulative update becomes available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - The Nodes Updated ratio value for your cluster and the Estimated Update Time value help you plan your maintenance schedule. If service updates exceed the estimated time constraints for your business flows, you can stop updates and reapply them at a later date. For more information, see Stopping the Self-Service Updates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If you choose to apply the service updates to any or all available clusters, choose Confirm. If you choose this, you then view the Service Updates page, where you can monitor the status of your service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If you choose Cancel, you can explore further options, as explained following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  On the ElastiCache dashboard, you can check Update Status for each of your Redis clusters, as shown following. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update Status displays one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - update available: An update is available to apply to this cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - not-applied: An update is available but not yet applied. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - scheduling: The update date is being scheduled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - scheduled: The update date has been scheduled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - waiting-to-start: The update process will soon begin. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - in-progress: The update is being applied to this cluster, rendering it unavailable for the duration of the value in Estimated Update Time. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - stopping: An in-progress update has been interrupted before completion. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - stopped: The update has been terminated. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you stop an in-progress update on a cluster, some nodes might be updated while others are not. The stopping process doesn't roll back any changes to already updated nodes. You can reapply the update to those nodes that still have an available status at your convenience if the update doesn't have an Expired status. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - complete: The update has been successfully applied. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - up to date: The cluster doesn't have any outstanding active service updates and your cluster is compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Applying the Service Updates Using the Service Updates List 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view the list of individual service updates and their status, along with other information, choose the Service Updates List tab. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Service Updates List, you can view the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Name: A unique identifier for the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Status: The status of the update, which is one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- complete: The update has been applied and all clusters are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- cancelled: The update has been canceled and is no longer necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- expired: The update is no longer available to apply. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Severity: The priority of applying the update: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- important: We recommend that you apply this update as soon as your business flow allows (within 30 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Type: For this version, only security updates are supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Release Date: When the update is released and available to apply on your Redis fleet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Recommended Apply By Date: ElastiCache guidance date to apply the updates by. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choosing an individual update provides additional details, including the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Description: Provides details on the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Expiration Date: The date when the service update expires and no longer is available. Any updates that aren't applied before their expiration date are cumulatively rolled into the next update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Important 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you apply updates of type security as soon as you can. Doing this helps ensure that your Redis clusters are always up-to-date with the latest security patches and are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view the list of individual service updates in relation to the applicable clusters, choose the Service Update Status tab. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Service Updates Status list, you can view the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Name: Detailed information about the service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Cluster Name: The list of your Redis clusters that are eligible for the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Nodes Updated: The ratio of individual nodes within a specific cluster that were updated or remain available for the specific service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Severity: The priority of applying the update: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- critical: We recommend that you apply this update immediately (within 14 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- important: We recommend that you apply this update as soon as you can (within 30 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- medium: We recommend that you apply this update as soon as you can (within 60 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- low: We recommend that you apply this update as soon as you can (within 90 days or less). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Update Type: For this version, only security updates are supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update Status: The status of the update, which is one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- available: The update is available for requisite Redis clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- complete: The update has been applied and all Redis clusters are compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- canceled: The update has been canceled and is no longer necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- expired: The update is no longer available to apply. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Service Update SLA Met: This reflects whether your cluster is compliant. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- yes: All available updates have been applied to this cluster and available nodes by the apply-by date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  -- no: The service update might have been applied successfully to one or more nodes, but other nodes within the cluster still have an available status. This typically happens when a service update is applied and then stopped. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you stop the progress of a service update on a cluster, any nodes that are already updated have a complete status. Any nodes that have an In Progress or Stopping status revert to a Stopped status, and the Service Update SLA Met status changes to no. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;-- N/A: The replication group was created after the recommended apply-by date. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Cluster Status Modified Date: The latest date that the cluster was modified with a service update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Show Previous Updates check box, if selected, displays a list of previous updates that are no longer available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Managing the Service Updates -  Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/managing-updates.html"/>
+            <reference name="Managing the Service Updates - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/managing-updates.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that any updates of type security are applied for AWS ElastiCache.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.004">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE1" name="Control access to AWS ElastiCache using IAM policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control access to AWS ElastiCache using IAM policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can have valid credentials to authenticate your requests, but unless you have permissions you cannot create or access Amazon ElastiCache resources. For example, you must have permissions to create an ElastiCache cache cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following shows an example of a permissions policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;"Version": "2012-10-17", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;"Statement": [{ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowClusterPermissions", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateCacheCluster", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:CreateReplicationGroup", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:DescribeCacheClusters", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:ModifyCacheCluster", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "elasticache:RebootCacheCluster"], 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}, 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;{ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Sid": "AllowUserToPassRole", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Effect": "Allow", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Action": [ "iam:PassRole" ], 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;"Resource": "*" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp;] 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The policy has two statements: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. The first statement grants permissions for the Amazon ElastiCache actions (elasticache:CreateCacheCluster, elasticache:DescribeCacheClusters, elasticache:ModifyCacheCluster, and elasticache:RebootCacheCluster) on any cache cluster owned by the account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. The second statement grants permissions for the IAM action (iam:PassRole) on IAM roles. The wildcard character (*) at the end of the Resource value means that the statement allows permission for the iam:PassRole action on any IAM role. To limit this permission to a specific role, replace the wildcard character (*) in the resource ARN with the specific role name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The policy doesn't specify the Principal element because in an identity-based policy you don't specify the principal who gets the permission. When you attach policy to a user, the user is the implicit principal. When you attach a permissions policy to an IAM role, the principal identified in the role's trust policy gets the permissions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using Identity-Based Policies (IAM Policies) for Amazon ElastiCache" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.IdentityBasedPolicies.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE10" name="Enable AWS SNS Notifications for AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable AWS SNS Notifications for AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When significant events happen for a cluster, ElastiCache sends notification to a specific Amazon SNS topic. Examples include a failure to add a node, success in adding a node, the modification of a security group, and others. By monitoring for key events, you can know the current state of your clusters and, depending upon the event, be able to take corrective action. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Adding an Amazon SNS Topic (Console) 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following procedure shows you how to add an Amazon SNS topic for a cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  This process can also be used to modify the Amazon SNS topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To add or modify an Amazon SNS topic for a cluster (Console) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the AWS Management Console and open the ElastiCache console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In Clusters, choose the cluster for which you want to add or modify an Amazon SNS topic ARN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4 In Modify Cluster under Topic for SNS Notification, choose the SNS topic you want to add, or choose Manual ARN input and type the ARN of the Amazon SNS topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Choose Modify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Managing ElastiCache Amazon SNS Notifications - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/ECEvents.SNS.html"/>
+            <reference name="Managing ElastiCache Amazon SNS Notifications - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ECEvents.SNS.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
+            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.006">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-ELASTICACHE9" name="Use CloudWatch alarms with AWS ElastiCache" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use CloudWatch alarms with AWS ElastiCache 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  ElastiCache provides metrics that enable you to monitor your clusters. You can access these metrics through CloudWatch. ElastiCache provides both host-level metrics (for example, CPU usage) and metrics that are specific to the cache engine software (for example, cache gets and cache misses). These metrics are measured and published for each Cache node in 60-second intervals. 
+&lt;/div&gt; 
+&lt;div&gt;
+  By setting CloudWatch alarms on certain key metrics, you will be notified if your cache cluster's performance starts to degrade. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitoring CloudWatch Cluster and Node Metrics (Console) 
+&lt;/div&gt; 
+&lt;div&gt;
+  To gather CPU utilization statistics for a cache cluster 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the AWS Management Console and open the ElastiCache console at https://console.aws.amazon.com/elasticache/. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the cache nodes you want to view metrics for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting more than 20 nodes disables viewing metrics on the console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  a. On the Cache Clusters page of the AWS Management Console, click the name of one or more cache clusters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The detail page for the cache cluster appears. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  b. Click the Nodes tab at the top of the window. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  c. On the Nodes tab of the detail window, select the cache nodes that you want to view metrics for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A list of available CloudWatch Metrics appears at the bottom of the console window. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  d. Click on the CPU Utilization metric. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CloudWatch console will open, displaying your selected metrics. You can use the Statistic and Period drop-down list boxes and Time Range tab to change the metrics being displayed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring Use with CloudWatch Metrics - Memcached" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheMetrics.html"/>
+            <reference name="Monitoring Use with CloudWatch Metrics - Redis" url="https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheMetrics.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To test your rule that triggers on an API call, you have to trigger it with its Specific operation as defined into the Cloudwatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  In CloudWatch Events, it is possible to create rules that lead to infinite loops, where a rule is fired repeatedly. For example, a rule might detect that ACLs have changed on an S3 bucket, and trigger software to change them to the desired state. If the rule is not written carefully, the subsequent change to the ACLs fires the rule again, creating an infinite loop. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To prevent this, write the rules so that the triggered actions do not re-fire the same rule. For example, your rule could fire only if ACLs are found to be in a bad state, instead of after any change. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An infinite loop can quickly cause higher than expected charges. AWS recommends that you use budgeting, which alerts you when charges exceed your specified limit. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.005">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
+              <reference name="Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail PDF" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.256">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:32.006">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
+                    <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-ELASTICACHE10" mitigation="50"/>
+                <countermeasure ref="AWS-ELASTICACHE9" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="9e24a1d1-e6a8-4fee-937c-2f6fe8375aa1" diagramComponentId="630f8d7f-ab52-44c9-9875-ef9c979cd4e5" ref="f4049c60-9be6-471e-8885-753b7ce5c14d" name="EC2 - Elastic Compute Cloud" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="ec2">
+      <tags>
+        <tag tag="Autoscaling"/>
+      </tags>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IND-RESOURCES" name="AWS Resources are indistinguishable" state="0" impact="100" issueId="" issueLink="">
+          <desc>AWS Resources are indistinguishable and countermeasures cannot be applied confidently.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:38:28.834">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.070">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:14.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:54:10.678">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="VOLUMES-NOT-ENCRYPTED" name="The volumes are not encrypted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Volumes are not encrypted, leading to the disclosure of information.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T12:34:35.371">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-04" name="Unauthorised connection attempts are allowed on Amazon resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Amazon resources is most likely to be receiving an attack. To avoid this, access to the network must be as restricted as possible using Network Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-02" name="Unauthorised connection attempts are allowed on port 22" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 22 is most likely to be receiving an SSH attack. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-03" name="Unauthorised connection attempts are allowed on port 3389" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to port 3389 is most likely to be receiving an RDP attack.
+                        To avoid this, access to the network must be as restricted as possible, so that only the
+                        necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-6.9" name="Allocate Elastic IPs for NAT Gateways" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. 
+  You can associate an Elastic IP address with any instance, network interface for your VPC or a NAT Gateway. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Allocate Elastic IP address for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 allocate-address --domain vpc 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allocate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html"/>
+            <reference name="Describe addresses" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html"/>
+          </references>
+          <standards>
+            <standard ref="6.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if you have Elastic IP addresses allocated and unused for the number of NAT Gateways that you want to deploy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-addresses --filters Name=domain,Values=vpc --query "Addresses[?AssociationId == null]" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:31:03.095">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.10-5.11" name="Apply an AWS Managed Config Rule to encrypt volumes" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records all configuration changes to these resources. You can evaluate these configurations and changes to comply with the ideal configurations defined by AWS Config Rules.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create locally a json file (similar to the below example) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;{&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Description": "Checks whether Web Tier EBS volumes that are in an attached state&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;are encrypted.",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"ConfigRuleName": "encrypted-volumes-web-tier",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Source": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Owner": "AWS",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"SourceIdentifier": "ENCRYPTED_VOLUMES"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;},&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"InputParameters": "{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"Scope": {&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagKey": "&amp;lt;web_tier_tag&amp;gt;",&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;"TagValue": "&amp;lt;web_tier_tag_value&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Search for a Config Rule that checks if the EBS volumes tagged with Web tier tags are encrypted with the Web tier KMS key:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'ENCRYPTED_VOLUMES']|[?Scope.TagKey == '&amp;lt;web_tier_tag&amp;gt;']|[?Scope.TagValue =='&amp;lt;web_tier_tag_value&amp;gt;']|[?InputParameters == '{\"kmsId\":\"&amp;lt;web_tier_kms_key&amp;gt;\"}']"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:44:34.594">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.2" name="Configure Auto-Scaling Group for multiple Availability Zones" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon Unified CLI: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List all the subnets and the associated Availability Zones from the application VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --query "Subnets[?VpcId == '&amp;lt;application_vpc&amp;gt;'].{VPC:VpcId,Subnet:SubnetId, AZ:AvailabilityZone, CIDR:CidrBlock}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update AutoScaling Group to include more than 1 Availability Zones within the same VPC:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling update-auto-scaling-group --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; --availability-zones &amp;lt;application_az&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+            <reference name="Update autoscaling group" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/update-auto-scaling-group.html"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all Auto-Scaling Groups and associated Availability Zones, and ensure there is more than 1 Availability Zone assigned to the Auto-Scaling Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[*].{AZs:AvailabilityZones, ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:30:24.393">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.3-3.4" name="Configure Auto-Scaling Launch Configuration for Tier to use an approved AMI" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon EC2 capacity up or down automatically according to conditions you define.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  These properties can be defined within the Auto-Scaling Group configuration.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Your Organization must maintain a list of approved AMIs. Use these when creating AutoScaling Groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the approved Web tier AMI from your organization's list:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;&amp;nbsp; 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt; 
+  &lt;div&gt;
+    A list of approved AMIs must be maintained by the organization. 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using an approved AMI from your organization's list (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, AMI:ImageId,InstanceType:InstanceType}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:46:26.599">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.32-6.33" name="Configure Auto-Scaling Launch Configuration for Tier to use the Tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Auto Scaling helps maintain application availability and allows you to scale your Amazon 
+  EC2 capacity up or down automatically according to conditions you define. You can use Auto Scaling to help ensure that you are running your desired number of Amazon EC2 instances or can automatically increase the number of Amazon EC2 instances during demand spikes to maintain performance and decrease capacity during lulls to reduce costs. These properties can be defined within the Auto-Scaling Group configuration. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Additional properties can be defined through the launch configuration such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Instance Type&lt;/li&gt; 
+  &lt;li&gt;Amazon Machine Image (Pre-configured Operating System Images - allows for O.S Hardening)&lt;/li&gt; 
+  &lt;li&gt;IAM Role&lt;/li&gt; 
+  &lt;li&gt;Security Groups&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create new launch configuration for the Web tier using the Web Tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;new_web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="6.32" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.33" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the associated Launch Configuration of the Web Tier Auto-Scaling Group (note the value of "LaunchConfig" element):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &amp;lt;web_tier_autoscaling_group_name&amp;gt; --query 'AutoScalingGroups[*].{LaunchConfig:LaunchConfigurationName,ASG:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure actively used Launch Configuration found in the previous step is using the Web Tier Security Group (replace &amp;lt;web_tier_launch_config&amp;gt; with the Launch Configuration previously found):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query 'LaunchConfigurations[*].{LaunchConfig:LaunchConfigurationName, SecurityGroups:SecurityGroups}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:57:31.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.12" name="Create a route table for the private subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your private subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the private subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnetid &amp;lt;private_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the private subnets, and check if they contain the default route (0.0.0.0/0) pointing to the NAT Gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;private_subnet1&amp;gt;,&amp;lt;private_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:40:33.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.11" name="Create a route table for the public subnets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a route table for your public subnets, and note the RouteTableId in the output:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route-table --vpc-id &amp;lt;application_vpc&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Associate the new route table with the public subnets: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet1&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 associate-route-table --route-table-id &amp;lt;route_table_id&amp;gt; --subnet-id &amp;lt;public_subnet2&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Create route table" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route-table.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List route tables attached to the public subnets, and check if they contain the default route (0.0.0.0/0) pointing to the Internet Gateway (IGW):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;public_subnet1&amp;gt;,&amp;lt;public_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Tags:Tags, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:37:32.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.14-6.15" name="Create default route (0.0.0.0/0) from Routing Table associated with tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_nat_gw&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface:: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;web_tier_subnet1&amp;gt;,&amp;lt;web_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:46:34.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.10" name="Create NAT Gateways in at least two AZ" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the Internet or other AWS services, but prevent the Internet from initiating a connection with those instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To create a NAT gateway, you must specify the public subnet in which the NAT gateway will reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. This enables instances in your private subnets to communicate with the Internet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each NAT gateway is created in a specific Availability Zone and implemented with 
+  redundancy in that zone. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a NAT Gateway in a public subnet from a different Availability Zone: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet1&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   and/or 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-nat-gateway --subnet-id &amp;lt;public_subnet2&amp;gt; --allocation-id &amp;lt;elastic_ip_allocation&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create NAT Gateway" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-nat-gateway.html"/>
+            <reference name="Describe NAT Gateways" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the NAT Gateways from your application VPC, and note the subnets they are deployed in:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt; --query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Availability Zones where the above subnets are deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --subnet-ids &amp;lt;public_subnet1&amp;gt; &amp;lt;public_subnet2&amp;gt; --query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:34:03.576">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.6-6.7-6.8" name="Create subnets for tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can 
+  add one or more subnets in each Availability Zone. Each subnet must reside entirely within 
+  one Availability Zone and cannot span zones. Availability Zones are distinct locations that 
+  are engineered to be isolated from failures in other Availability Zones. By launching 
+  instances in separate Availability Zones, you can protect your applications from the failure 
+  of a single location. AWS assigns a unique ID to each subnet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a 
+  subnet shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). 
+  The allowed block size is between a /28 netmask and /16 netmask. If you create more than 
+  one subnet in a VPC, the CIDR blocks of the subnets must not overlap. 
+  Some AWS regions have more than 2 availability zones and it is recommended to use more 
+  than 2 where possible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create subnets for Web tier, and note the subnet id: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-subnet --vpc-id &amp;lt;application_vpc&amp;gt; --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Tag the above subnets with the Web tier tags: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-tags --resources &amp;lt;web_tier_subnet1&amp;gt; &amp;lt;web_tier_subnet2&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:27:41.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.24" name="Create the Data tier Security Group and ensure it allows inbound connections from App tier Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The port for these inbound rules would depend on the Database engine used and the 
+  configured port. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The default values are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt; MySQL - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;MSSQL - TCP 1433&lt;/li&gt; 
+  &lt;li&gt;Oracle SQL - TCP 1521&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL - TCP 5432&lt;/li&gt; 
+  &lt;li&gt;MariaDB - TCP 3306&lt;/li&gt; 
+  &lt;li&gt;Amazon Aurora DB - TCP 3306&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the App tier security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;app_tier_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.24" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --query "DBInstances[*].VpcSecurityGroups" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that allows connections only from App tier security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:04:42.704">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.31" name="Don't use the default VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A default VPC is ready for you to use - you can immediately start launching instances into your default VPC without having to perform any additional configuration steps. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  When we create a default VPC, AWS does the following to set it up: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a default subnet in each Availability Zone.&lt;/li&gt; 
+  &lt;li&gt;Create an Internet gateway and connect it to your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway.&lt;/li&gt; 
+  &lt;li&gt;Create a default security group and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Create a default network access control list (ACL) and associate it with your default VPC.&lt;/li&gt; 
+  &lt;li&gt;Associate the default DHCP options set for your AWS account with your default VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  Label this Default VPC "Do Not Use". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new VPC with the desired CIDR and migrate your application: &lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-vpc --cidr-block &amp;lt;desired_cidr&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The Default VPC can be deleted but only AWS Support can restore it. Don't delete it - just 
+  set a label to remind others not to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create VPC" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc.html"/>
+            <reference name="Default VPC" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html"/>
+            <reference name="Deleted default VPC" url="https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/"/>
+            <reference name="Describe VPCs" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpcs.html"/>
+          </references>
+          <standards>
+            <standard ref="6.31" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon Unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the attributes of the VPC's in your account and note the value of the "IsDefault" attribute for the VPC where the application is deployed:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-vpcs --query "Vpcs[*].{VpcId:VpcId, IsDefault:IsDefault, Tags:Tags}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:52:45.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.5-1.6" name="Encrypt all EBS Volumes for tier" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;br&gt;Elastic Block Storage (EBS) volumes can be encrypted using AWS Key Management Service (KMS). In this configuration, encryption and decryption are handled transparently and require no additional action from the user, an Amazon EC2 instance, or an application. When an encrypted Amazon EBS volume is attached to a supported Amazon EC2 instance type, the data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. The encryption occurs on the servers that host Amazon EC2 instances. Additionally, snapshots of encrypted volumes are automatically encrypted, and volumes that are created from encrypted snapshots are also automatically encrypted. It is recommended that all EBS volumes for the web tier be encrypted.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;*Note: references to Web tier are also applicable to App tier.&lt;/p&gt;&lt;p&gt;&lt;br&gt;Using the Amazon unified command line interface:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note all the volume ids of unencrypted EBS volumes and create a snapshot for each of them:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-snapshot --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt; --description "Snapshot for encryption operation"&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotIdelement from the output of step 1 and copy the snapshot to an encrypted snapshot using the KMS key created for the Web-tier:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 copy-snapshot --source-region &amp;lt;application_region&amp;gt; --source-snapshot-id &amp;lt;unencrypted_ebs_snapshot&amp;gt; --description "Encrypted snapshot." --encrypted --kms-keyid &amp;lt;web_tier_kms_key&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Note the SnapshotId element from the output of step 2 and create a new EBS volume from the encrypted snapshot in the same Availability Zone as the unencrypted volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-volume --availability-zone &amp;lt;application_az&amp;gt; --snapshot-id &amp;lt;encrypted_ebs_snapshot&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Tag the newly created EBS volume using the Volume Id from the previous step &amp;lt;encrypted_ebs_volume&amp;gt;:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 create-tags --resources &amp;lt;encrypted_ebs_volume&amp;gt; --tags Key=&amp;lt;web_tier_tag&amp;gt;,Value=&amp;lt;web_tier_tag_value&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Delete unencrypted EBS volume:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 delete-volume --volume-id &amp;lt;unencrypted_ebs_volume&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Copy snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html"/>
+            <reference name="Create snapshot" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-snapshot.html"/>
+            <reference name="Create volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/create-volume.html"/>
+            <reference name="Delete volume" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-volume.html"/>
+            <reference name="Describe volumes" url="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"/>
+            <reference name="EBS Encryption Considerations" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified command line interface: (Note that you should replace &amp;lt;web_tier_tag&amp;gt;:&amp;lt;web_tier_tag_value&amp;gt; with your own tag and value for the Web tier)&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Note the EBS volume ids, Instance ids, Availability Zones, and check if the Encrypted element is True or False&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;aws ec2 describe-volumes --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query 'Volumes[*].{VolumeId:VolumeId, Encrypted:Encrypted, AvailabilityZone:AvailabilityZone, InstanceId:Attachments[*].InstanceId}' --output table&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T17:12:03.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.2" name="Maintain a patch policy and patch EC2 systems regularly" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Patching instances ensures that packages within the Operating System (OS) are updated to the
+                        latest version and/or have security fixes applied. It is recommended to patch EC2 instances
+                        every 90 days (or immediately if security patches become available) to avoid undue exposure
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;For linux instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For Windows instances ensure your OS is updated as per:
+                        http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#update-windows-instance&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Ensure you have a documented patching policy.&lt;/li&gt;
+                            &lt;li&gt;Ensure your systems have been patched at least every 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.16" name="Remove default route (0.0.0.0/0) from Routing Table associated with Data tier subnet" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A route table contains a set of rules, called routes, that are used to determine where 
+  network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the 
+  routing for the subnet. A subnet can only be associated with one route table at a time, but 
+  you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists and it has a NAT GW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidrblock 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Delete route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the subnets associated with the Data tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-subnets --filters Name=tag:&amp;lt;data_tier_tag&amp;gt;,Values=&amp;lt;data_tier_tag_value&amp;gt; --query "Subnets[*].SubnetId" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has a NAT GW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-route-tables --filters Name=association.subnetid,Values=&amp;lt;data_tier_subnet1&amp;gt;,&amp;lt;data_tier_subnet2&amp;gt; --query "RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T09:49:36.275">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.27-6.28-6.29" name="Remove Elastic / Public IP addresses from EC2 instances within Tier" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All subnets have an attribute that determines whether instances launched into that subnet receive a public IP address. The public IP address is assigned to the default network interface (eth0). By default, instances launched into a default subnet are assigned a public IP address. A public IP address is mapped to the primary private IP address through network address translation (NAT). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An Elastic IP address is a static, public IP address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for your VPC. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App and Data tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If in the above output the "IpOwnerId" is "amazon" the public Ip is not an Elastic IP and it cannot be manually disassociated from the instance after launch:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Make sure that the Web tier subnet doesn't assign public Ip's at launch (run the command for all Web tier subnets)&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws ec2 modify-subnet-attribute --subnet-id &amp;lt;web_tier_subnet1&amp;gt; --no-map-publicip-on-launch 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an AMI from the instance and launch a replacement instance in the same subnet&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;If in the above output the "IpOwnerId" is an AWS account number, this is an Elastic IP and it can be disassociated:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 disassociate-address --public-ip &amp;lt;elastic_ip_address&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Disassociate address" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/disassociate-address.html"/>
+            <reference name="Modify subnet attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-subnet-attribute.html"/>
+            <reference name="VPC IP Addressing" url="https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html"/>
+          </references>
+          <standards>
+            <standard ref="6.27" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.28" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.29" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the instance-id's, tags and public IP's of the EC2 instances from the application VPC that have a public IP associated, and check if there are any instances with Web tier tags listed:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-instances --filters "Name=vpc-id,Values=&amp;lt;application_vpc&amp;gt;" --query "Reservations[*].Instances[?PublicIpAddress != null].{InstanceId:InstanceId, PublicIpAddresses:NetworkInterfaces[*].Association, SubnetId:SubnetId, Tags:Tags}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:17:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.25" name="Remove inbound rules for CIDR of 0 (Global Allow) for Data tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;data_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.25" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Retrieve the Data tier security group configured for your RDS DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-instances --db-instance-identifier &amp;lt;your_db_instance&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids &amp;lt;data_tier_security_group&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:10:24.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.20-6.23" name="Remove inbound rules for CIDR of 0 (Global Allow) for tier Security Group" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you 
+  can assign the instance to up to five security groups. Security groups act at the instance 
+  level, not the subnet level. Therefore, each instance in a subnet in your VPC could be 
+  assigned to a different set of security groups. If you don't specify a particular group at 
+  launch time, the instance is automatically assigned to the default security group for the 
+  VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a 
+  separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Remove the ingress rules for CIDR 0.0.0.0/0 (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --protocol tcp/udp --port &amp;lt;specific_port&amp;gt; --cidr 0.0.0.0/0 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.20" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.23" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List the ingress rules for the Web tier security group, and make sure it has no inbound rules for CIDR of 0.0.0.0/0:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-18T10:00:55.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.6" name="Restrict all traffic with the default security group" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit all traffic
+                        (ingress/egress) on the default security group in order to force the use of least privilege via
+                        custom created security groups.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify AWS resources that exist within the default security group.&lt;/li&gt;
+                        &lt;li&gt;Create a set of least privilege security groups for those resources.&lt;/li&gt;
+                        &lt;li&gt;Place the resources in those security groups.&lt;/li&gt;
+                        &lt;li&gt;Remove the resources noted in 1 from the default security group.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the default security group.&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exist.&lt;/li&gt;
+                            &lt;li&gt;Click the Outbound Rules tab.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure no rules exist.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.7-1.8" name="Set Customer-owned AMIs in tier to be private" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon Machine Images (AMI) are an exact duplicate of the instance they were created from and will allow anyone with access to create a complete replica of the original instance. The original instance may contain intellectual property, proprietary applications, and configuration information that can be used to exploit or compromise any running instance in the web tier.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For each AMI that is public remove group ALL from the launch permissions:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws ec2 modify-image-attribute --image-id &amp;lt;public_image_id&amp;gt; --launch-permission "{\"Remove\":[{\"Group\":\"all\"}]}" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Default Value&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The prescribed value is the default value. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe images" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html"/>
+            <reference name="Modify image attribute" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html"/>
+            <reference name="Sharing AMIs" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html"/>
+          </references>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: (Note that you should replace&amp;nbsp;&amp;lt;tier_tag&amp;gt;:&amp;lt;tier_tag_value&amp;gt;&amp;nbsp;with your own tag and value for the tier)&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note the image id's, AMI name, and check if Public element is True or False:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-images --owners self --filters 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Name=tag:&amp;lt;tier_tag&amp;gt;,Values=&amp;lt;tier_tag_value&amp;gt; --query 'Images[*].{Name:Name, 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    ImageId:ImageId, Public:Public}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T12:25:04.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:14:01.280">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.436">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-8" name="Use AWS Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;You can use Traffic Mirroring to copy network traffic from an elastic network interface of EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for content inspection, threat monitoring, or troubleshooting. For example, you might want to monitor the traffic that is leaving your VPC or the traffic whose source is outside your VPC. In this case, you will mirror all traffic except for the traffic passing within your VPC and send it to a single monitoring appliance. VPC flow logs do not capture mirrored traffic; they generally capture information from packet headers only. Traffic Mirroring provides deeper insight into the network traffic by allowing you to analyze actual traffic content, including payload. Enable Traffic Mirroring only for the elastic network interface of EC2 instances that might be operating as part of sensitive workloads or for which you expect to need detailed diagnostics in the event of an issue.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the network traffic is copied from an EC2 instance after having configured Traffic Mirroring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.460">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-EC2-IMDS" name="Use IMDSv2 instead of IMDSv1" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All EC2 Instances have access to the metadata service at 169.254.169.254. This contains useful information about the instance such as its IP address, the name of the security group, etc. On EC2 instances that have an IAM role attached the metadata service will also contain IAM credentials to authenticate as this role. Depending on what version of IMDS is in place, and what capabilities the SSRF has those credentials could be stolen.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Tools for helping with the transition to IMDSv2&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;If your software uses IMDSv1, use the following tools to help reconfigure your software to use IMDSv2.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;AWS software:&lt;/strong&gt; The latest versions of the AWS SDKs and CLIs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the AWS SDKs and CLIs. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html"&gt;Installing, updating, and uninstalling the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;CloudWatch&lt;/strong&gt;: IMDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Updates to EC2 APIs and CLIs&lt;/strong&gt;: For existing instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2. For new instances, you can use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; API) and the metadata-options parameter to launch new instances that require the use of IMDSv2.&lt;/p&gt;&lt;p&gt;To require the use of IMDSv2 on all new instances launched by Auto Scaling groups, your Auto Scaling groups can use either a launch template or a launch configuration. When you &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-launch-template.html"&gt;create a launch template&lt;/a&gt; or &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"&gt;create a launch configuration&lt;/a&gt;, you must configure the MetadataOptions parameters to require the use of IMDSv2. After you configure the launch template or launch configuration, the Auto Scaling group launches new instances using the new launch template or launch configuration, but existing instances are not affected.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; CLI command (or the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API) to require the use of IMDSv2 on the existing instances, or terminate the instances and the Auto Scaling group will launch new replacement instances with the instance metadata options settings that are defined in the launch template or launch configuration.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;IAM policies and SCPs&lt;/strong&gt;: You can use an IAM condition to enforce that IAM users can't launch an instance unless it uses IMDSv2. You can also use IAM conditions to enforce that IAM users can't modify running instances to re-enable IMDSv1, and to enforce that the instance metadata service is available on the instance.&lt;/p&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. These condition keys can be used either in IAM policies or AWS Organizations service control policies (SCPs).&lt;/p&gt;&lt;p&gt;Furthermore, you can choose an additional layer of protection to enforce the change from IMDSv1 to IMDSv2. At the access management layer with respect to the APIs called via EC2 Role credentials, you can use a new condition key in either IAM policies or AWS Organizations service control policies (SCPs). Specifically, by using the policy condition key ec2:RoleDelivery with a value of 2.0 in your IAM policies, API calls made with EC2 Role credentials obtained from IMDSv1 will receive an UnauthorizedOperation response. The same thing can be achieved more broadly with that condition required by an SCP. This ensures that credentials delivered via IMDSv1 cannot actually be used to call APIs because any API calls not matching the specified condition will receive an UnauthorizedOperation error. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html"&gt;Service Control Policies&lt;/a&gt; in the &lt;i&gt;AWS Organizations User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Recommended path to requiring IMDSv2 access&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Using the above tools, we recommend that you follow this path for transitioning to IMDSv2:&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 1: At the start&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Update the SDKs, CLIs, and your software that use Role credentials on their EC2 instances to IMDSv2-compatible versions. For information about updating the CLI, see &lt;a href="https://docs.aws.amazon.com/cli/latest/userguide/install-linux.html#install-linux-awscli-upgrade"&gt;Upgrading to the latest version of the AWS CLI&lt;/a&gt; in the &lt;i&gt;AWS Command Line Interface User Guide&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Then, change your software that directly accesses instance metadata (in other words, that does not use an SDK) using the IMDSv2 requests.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 2: During the transition&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Track your transition progress by using the CloudWatch metric MetadataNoToken. This metric shows the number of calls to the instance metadata service that are using IMDSv1 on your instances. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#ec2-cloudwatch-metrics"&gt;Instance metrics&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 3: When everything is ready on all instances&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;Everything is ready on all instances when the CloudWatch metric MetadataNoToken records zero IMDSv1 usage. At this stage, you can do the following:&lt;/p&gt;&lt;p&gt;For existing instances: You can require IMDSv2 use through the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html"&gt;modify-instance-metadata-options&lt;/a&gt; command. You can make these changes on running instances; you do not need to restart your instances.&lt;/p&gt;&lt;p&gt;For new instances: When launching a new instance, you can do one of the following:&lt;/p&gt;&lt;p&gt;In the Amazon EC2 console launch instance wizard, set &lt;strong&gt;Metadata accessible&lt;/strong&gt; to &lt;strong&gt;Enabled&lt;/strong&gt; and &lt;strong&gt;Metadata version&lt;/strong&gt; to &lt;strong&gt;V2&lt;/strong&gt;. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html#configure_instance_details_step"&gt;Step 3: Configure Instance Details&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Use the &lt;a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html"&gt;run-instances&lt;/a&gt; command to specify that only IMDSv2 is to be used.&lt;/p&gt;&lt;p&gt;Updating instance metadata options for existing instances is available only through the API or AWS CLI. It is currently not available in the Amazon EC2 console. For more information, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html"&gt;Configure the instance metadata options&lt;/a&gt;.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Step 4: When all of your instances are transitioned to IMDSv2&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;The ec2:MetadataHttpTokens, ec2:MetadataHttpPutResponseHopLimit, and ec2:MetadataHttpEndpoint IAM condition keys can be used to control the use of the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html"&gt;RunInstances&lt;/a&gt; and the &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html"&gt;ModifyInstanceMetadataOptions&lt;/a&gt; API and corresponding CLI. If a policy is created, and a parameter in the API call does not match the state specified in the policy using the condition key, the API or CLI call fails with an UnauthorizedOperation response. For example IAM policies, see &lt;a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-instance-metadata"&gt;Work with instance metadata&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Configuring IMDS" url="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;If there is a valid role you can steal, make a request to http://&amp;lt;aws-ip&amp;gt;/?proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/. This will return the name of the IAM role the credentials represent.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.475">
+              <output/>
+            </source>
+            <references>
+              <reference name="Steal EC2 Metadata Credentials via SSRF" url="https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.7" name="Use Network Access Control Lists (NACLs) for blacklisting" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Network Access Control Lists (NACLs) act as packet filters across subnets, allowing or deny traffic per pre-created rules. It is recommended to use NACLs as a method to blacklist IP addresses, denying either inbound or outbound access across your subnets.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console (with VPC update).&lt;/li&gt;&lt;li&gt;Select VPC from the service menu.&lt;/li&gt;&lt;li&gt;Select Network ACL's.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;ul&gt;&lt;li&gt;Select the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Click edit.&lt;/li&gt;&lt;li&gt;add a DENY rule that will restrict inbound access from a blacklisted IP address or range to a designated port or IP range.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select VPC from the services menu.&lt;/li&gt;&lt;li&gt;Select Network ACLs.&lt;/li&gt;&lt;li&gt;For each Network ACL ID, perform the following:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Click the Inbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access from a blacklisted IP or range.&lt;/li&gt;&lt;li&gt;Click the Outbound Rules tab.&lt;/li&gt;&lt;li&gt;Ensure a rule exists to DENY access to a blacklisted IP or range.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.5" name="Use security groups to block ingress to all ports from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        ALL TCP or ALL ports to avoid undue server exposure.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range of 0-1024 of 0-65535 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.3" name="Use security groups to block ingress to port 22 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 22 (SSH) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update)&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt; 
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 22</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.4" name="Use security groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security groups are analogous to firewalls and therefore provide stateful filtering of
+                        ingress/egress network traffic to AWS resources. It is recommended to limit inbound access to
+                        port 3389 (RDP) to IP addresses that require this access to avoid undue exposure to risk.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Login to the AWS Management Console (with VPC update).&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select Security Groups.&lt;/li&gt;
+                        &lt;li&gt;For each security group, perform the following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the security group.&lt;/li&gt;
+                        &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                        &lt;li&gt;Identify the rules to be removed.&lt;/li&gt;
+                        &lt;li&gt;Click the x in the Remove column.&lt;/li&gt;
+                        &lt;li&gt;Click Save&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Security Groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each security group, perform the following:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Select the security group.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the Inbound tab.&lt;/li&gt;
+                            &lt;li&gt;Ensure no rule exists that has a port range that includes port 22 and has a source
+                            of 0.0.0.0/0.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;NB: Note that if the port range includes 0-1024 or 0-65535 these also include
+                            port 3389</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-EC2-IMDS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                    <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                    <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="VOLUMES-NOT-ENCRYPTED">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                    <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.7" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.5-1.6" mitigation="12"/>
+                <countermeasure ref="aws-tier-1.7-1.8" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.2" mitigation="12"/>
+                <countermeasure ref="aws-tier-3.3-3.4" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="12"/>
+                <countermeasure ref="aws-tier-5.10-5.11" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                    <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-02">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-NET-03">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Network-5.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-Network-5.4" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.5" mitigation="6"/>
+                <countermeasure ref="Hydras-AWS-Network-5.6" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.10" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.11" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.12" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.14-6.15" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.16" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.20-6.23" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.24" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.25" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.27-6.28-6.29" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.31" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.6-6.7-6.8" mitigation="6"/>
+                <countermeasure ref="aws-tier-6.9" mitigation="6"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                    <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                    <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW9" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.3" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.32-6.33" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-SRA-8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="bcf6d830-8260-48e3-a96d-c509e58b5789" diagramComponentId="d077f2ce-8f51-4eed-b9e8-29c33c1c901e" ref="85488534-b4b9-4b7f-837b-1d895fd6a673" name="Overflow / Cold Storage" desc="" library="Hydras-AWS-Foundation" parentComponentRef="bb23eb31-51d2-42fd-9350-d4db18531e34" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
+          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
+                        for an MFA.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T13:16:12.065">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:13.595">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.792">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
+            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
+            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
+          </references>
+          <standards>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
+                            then your bucket has no versioning enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.388">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.402">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest with KMS" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. &lt;/p&gt; 
+&lt;p&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. &lt;/p&gt; 
+&lt;p&gt;To ensure that sensitive data is encrypted at rest you can use AWS KMS-managed keys (SSE-KMS). This provides several advantages: &lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users in your organization according to your requirements.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now need to meet two conditions: 1) you must have S3 read permission on the bucket, and 2) you must be granted decrypt permission by the CMK policy.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;It is recommended to encrypt all sensitive data with SSE-KMS to avoid undue disclosure of information and provide an extra layer of security.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation: &lt;/b&gt;&lt;br /&gt; The following example shows how to upload data using AWS KMS Encryption: &lt;br /&gt; aws s3api put-object --bucket --server-side-encryption aws:kms --ssekms-key-id --key &lt;/p&gt; 
+</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Storing Lambda function encrypted secrets using environment variables and KMS" url="https://docs.aws.amazon.com/lambda/latest/dg/tutorial-env_console.html"/>
+            <reference name="Storing and Retrieving a Secret (AWS Tutorial)" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
+&lt;/div&gt; 
+&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
+            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T15:40:07.036">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
+ &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
+ &lt;/ul&gt; If data in transit is kept unencrypted: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
+ &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Version":"2012-10-17", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Id":"PutObjPolicy", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Statement":{ 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Effect":"Deny", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Principal":"*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Action":"s3:PutObject", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Condition":{ 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;} 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;} 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
+            <reference name="List buckets" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket policy" url="http://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
+            <reference name="Using Server-side Encryption" url="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api list-buckets --output table
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            ...
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;{
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Effect": "Deny",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Principal": "*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Action": "s3:PutObject",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Condition": {
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T11:46:08.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
+  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
+  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
+  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
+  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
+  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;br&gt; 
+&lt;br&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
+            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
+            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
+            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
+                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            ./prowler -c extra73
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-11-15T14:10:10.879">
+              <output/>
+            </source>
+            <references>
+              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; {&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; "Statement":[&lt;/i&gt; 
+   &lt;i&gt;{&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Condition":{&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;div&gt; 
+       &lt;i&gt;"Bool":&lt;/i&gt; 
+      &lt;/div&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;}&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;i&gt;}&lt;/i&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; }&lt;/i&gt; 
+     &lt;i&gt;]&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt;} &lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
+                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
+                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.943">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.957">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br /&gt; 
+&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br /&gt; 
+&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
+&lt;br /&gt;Remediation 
+&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
+                            has no MFA delete enabled.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="50"/>
+                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="29b3dab5-6ff0-4719-a871-637e3a1e8e5b" diagramComponentId="12c72ec7-9b87-436e-b190-69f05654a0af" ref="8bf78537-3cdd-4c79-88be-e341adba0b30" name="CloudWatch" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="cloudwatch">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.027">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.042">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:14.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AWS-CLOUDWATCH7" name="Connect to CloudWatch using Interface VPC Endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Connect to CloudWatch using Interface VPC Endpoints&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; If you use Amazon Virtual Private Cloud (Amazon VPC) to host your AWS resources, you can establish a private connection between your VPC, CloudWatch, and CloudWatch Synthetics. You can use these connections to enable CloudWatch and CloudWatch Synthetics to communicate with your resources on your VPC without going through the public internet.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Creating a VPC Endpoint for CloudWatch&lt;/p&gt; 
+&lt;p&gt;To start using CloudWatch with your VPC, create an interface VPC endpoint for CloudWatch. The service name to choose is com.amazonaws.region.monitoring.&lt;/p&gt; 
+&lt;p&gt;You do not need to change the settings for CloudWatch. CloudWatch calls other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch, and you already have metrics flowing to CloudWatch from resources located on your VPC, these metrics begin flowing through the interface VPC endpoint by default.&lt;/p&gt; 
+&lt;p&gt;Controlling Access to Your CloudWatch VPC Endpoint&lt;/p&gt; 
+&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, Amazon VPC attaches a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
+&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
+&lt;p&gt;To edit the VPC endpoint policy for CloudWatch&lt;/p&gt; 
+&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
+&lt;p&gt;3. If you have not already created the endpoint for CloudWatch, choose Create Endpoint. Select com.amazonaws.region.monitoring, and then choose Create endpoint.&lt;/p&gt; 
+&lt;p&gt;4. Select the com.amazonaws.region.monitoring endpoint, and then choose the Policy tab.&lt;/p&gt; 
+&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
+&lt;p&gt;Creating a VPC Endpoint for CloudWatch Synthetics&lt;/p&gt; 
+&lt;p&gt;To start using CloudWatch Synthetics with your VPC, create an interface VPC endpoint for CloudWatch Synthetics. The service name to choose is com.amazonaws.region.synthetics. For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.&lt;/p&gt; 
+&lt;p&gt;You do not need to change the settings for CloudWatch Synthetics. CloudWatch Synthetics communicates with other AWS services using either public endpoints or private interface VPC endpoints, whichever are in use. For example, if you create an interface VPC endpoint for CloudWatch Synthetics, and you already have an interface endpoint for Amazon S3, CloudWatch Synthetics begins communicating with Amazon S3 through the interface VPC endpoint by default.&lt;/p&gt; 
+&lt;p&gt;Controlling Access to Your CloudWatch Synthetics VPC Endpoint&lt;/p&gt; 
+&lt;p&gt;A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you don't attach a policy when you create an endpoint, we attach a default policy for you that allows full access to the service. An endpoint policy doesn't override or replace IAM user policies or service-specific policies. It's a separate policy for controlling access from the endpoint to the specified service.&lt;/p&gt; 
+&lt;p&gt;Endpoint policies must be written in JSON format.&lt;/p&gt; 
+&lt;p&gt;To edit the VPC endpoint policy for CloudWatch Synthetics&lt;/p&gt; 
+&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Endpoints.&lt;/p&gt; 
+&lt;p&gt;3. If you have not already created the endpoint for CloudWatch Synthetics, choose Create Endpoint. Select com.amazonaws.region.synthetics and then choose Create endpoint.&lt;/p&gt; 
+&lt;p&gt;4. Select the com.amazonaws.region.synthetics endpoint and then choose the Policy tab.&lt;/p&gt; 
+&lt;p&gt;5. Choose Edit Policy, and then make your changes.&lt;/p&gt; 
+&lt;p&gt;The following are the general steps for setting up an interface endpoint:&lt;/p&gt; 
+&lt;p&gt;1. Choose the VPC in which to create the interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service to which you're connecting.&lt;/p&gt; 
+&lt;p&gt;2. Choose a subnet in your VPC to use the interface endpoint. We create an endpoint network interface in the subnet. You can specify more than one subnet in different Availability Zones (as supported by the service) to help ensure that your interface endpoint is resilient to Availability Zone failures. In that case, we create an endpoint network interface in each subnet that you specify.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; An endpoint network interface is a requester-managed network interface. You can view it in your account, but you cannot manage it yourself. For more information, see Elastic Network Interfaces.&lt;/p&gt; 
+&lt;p&gt;3. Specify the security groups to associate with the endpoint network interface. The security group rules control the traffic to the endpoint network interface from resources in your VPC. If you do not specify a security group, we associate the default security group for the VPC.&lt;/p&gt; 
+&lt;p&gt;4. (Optional, AWS services and AWS Marketplace Partner services only) Enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.&lt;/p&gt; 
+&lt;p&gt;Important&lt;br&gt; Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.&lt;/p&gt; 
+&lt;p&gt;Private DNS is enabled in the other subnets which are in the same VPC and Availability Zone or Local Zone.&lt;/p&gt; 
+&lt;p&gt;5. When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.&lt;/p&gt; 
+&lt;p&gt;6. After you create the interface endpoint, it's available to use when it's accepted by the service provider. The service provider must configure the service to accept requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using CloudWatch and CloudWatch Synthetics with Interface VPC Endpoints" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Viewing your interface endpoint&lt;br /&gt;
+After you've created an interface endpoint, you can view information about it using the Console or the Command line.&lt;/p&gt;
+
+	&lt;p&gt;To view information about an interface endpoint using the console:&lt;/p&gt;
+
+	&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Endpoints and select your interface endpoint.&lt;/p&gt;
+
+	&lt;p&gt;3. To view information about the interface endpoint, choose Details. The DNS Names field displays the DNS names to use to access the service.&lt;/p&gt;
+
+	&lt;p&gt;4. To view the subnets in which the interface endpoint has been created, and the ID of the endpoint network interface in each subnet, choose Subnets.&lt;/p&gt;
+
+	&lt;p&gt;5. To view the security groups that are associated with the endpoint network interface, choose Security Groups.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH1" name="Control access to Amazon CloudWatch resources" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Control access to Amazon CloudWatch resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Every AWS resource is owned by an AWS account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles), and some services (such as AWS Lambda) also support attaching permissions policies to resources.&lt;br&gt; Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. CloudWatch supports only identity-based policies.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following shows an example of a permissions policy.&lt;/p&gt; 
+&lt;p&gt;{ "Version": "2012-10-17", &lt;a&gt;Statement&lt;/a&gt; &lt;a&gt;Effect&lt;/a&gt;"Allow", &lt;a&gt;Action&lt;/a&gt;"cloudwatch:GetMetricStatistics","cloudwatch:ListMetrics"], &lt;a&gt;Resource&lt;/a&gt;"*", &lt;a&gt;Condition&lt;/a&gt; &lt;a&gt;Bool&lt;/a&gt; &lt;a&gt;aws:SecureTransport&lt;/a&gt;"true" } } } ]&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;This sample policy has one statement that grants permissions to a group for two CloudWatch actions (cloudwatch:GetMetricStatistics, and cloudwatch:ListMetrics), but only if the group uses SSL with the request (&lt;a&gt;aws:SecureTransport&lt;/a&gt;"true").&lt;/p&gt; 
+&lt;p&gt;For further information please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Overview of Managing Access Permissions to Your CloudWatch Resources" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-access-control-overview-cw.html"/>
+            <reference name="Sharing CloudWatch Dashboards" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-dashboard-sharing.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for CloudWatch" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-identity-based-access-control-cw.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.270">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.1" name="Create a SNS topic for sending out notifications from Cloudtwatch Alarms" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  For the Cloudwatch alarms and Auto-Scaling Groups to be able to send out notifications, a SNS topic should be created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  When using Amazon SNS, you (as the owner) create a topic and control access to it by defining policies that determine which publishers and subscribers can communicate with the topic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Cloudwatch alarms and certain actions inside Auto-Scaling Groups needs to be sent out to administrators, in order to be acted upon. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new topic, and note the topic-arn value:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a subscription to the new topic:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: sns get topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/get-topic-attributes.html"/>
+            <reference name="Amazon docs: sns list subscriptions by topic" url="https://docs.aws.amazon.com/cli/latest/reference/sns/list-subscriptions-by-topic.html"/>
+            <reference name="Amazon docs: sns set topic attributes" url="https://docs.aws.amazon.com/cli/latest/reference/sns/create-topic.html"/>
+            <reference name="Amazon docs: sns subscribe" url="https://docs.aws.amazon.com/cli/latest/reference/sns/subscribe.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all cloudwatch alarms and filter by alarm action (review &amp;quot;AlarmActions&amp;quot;: []):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch describe-alarms --query 'MetricAlarms[*].{AlarmName:AlarmName, AlarmActions:AlarmActions, Dimensions:Dimensions}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List SNS topic attributes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns list-topic-attributes --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List SNS topic subscriptions (endpoint which receives messages captured by the SNS topic):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.328">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH4" name="Create CloudWatch Alarms based on Anomaly Detection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create CloudWatch Alarms based on Anomaly Detection&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; When you enable anomaly detection for a metric, CloudWatch applies statistical and machine learning algorithms. These algorithms continuously analyze metrics of systems and applications, determine normal baselines, and surface anomalies with minimal user intervention.&lt;br&gt; You can create an alarm based on CloudWatch anomaly detection, which mines past metric data and creates a model of expected values. The expected values take into account the typical hourly, daily, and weekly patterns in the metric.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alarm based on anomaly detection&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Alarms, Create Alarm.&lt;/p&gt; 
+&lt;p&gt;3. Choose Select Metric and do one of the following:&lt;/p&gt; 
+&lt;p&gt;- Choose the service namespace that contains the metric that you want. To narrow the choices, continue choosing options as they appear. When a list of metrics appears, select the check box next to the metric that you want.&lt;/p&gt; 
+&lt;p&gt;- In the search box, enter the name of a metric, dimension, or resource ID and press Enter. Then choose one of the results and continue until a list of metrics appears. Select the check box next to the metric that you want.&lt;/p&gt; 
+&lt;p&gt;4. Choose the Graphed metrics tab.&lt;/p&gt; 
+&lt;p&gt;a. Under Statistic , choose one of the statistics or predefined percentiles, or specify a custom percentile (for example, p95.45).&lt;/p&gt; 
+&lt;p&gt;b. Under Period, choose the evaluation period for the alarm. When evaluating the alarm, each period is aggregated into one data point. For anomaly detection alarms, the value must be one minute or longer.&lt;/p&gt; 
+&lt;p&gt;You can also choose whether the y-axis legend appears on the left or right while you're creating the alarm. This preference is used only while you're creating the alarm.&lt;/p&gt; 
+&lt;p&gt;c. Choose Select metric.&lt;/p&gt; 
+&lt;p&gt;The Specify metric and conditions page appears, showing a graph and other information about the metric and statistic you have selected.&lt;/p&gt; 
+&lt;p&gt;5. Under Conditions, specify the following:&lt;/p&gt; 
+&lt;p&gt;a. Choose Anomaly detection.&lt;/p&gt; 
+&lt;p&gt;If the model for this metric and statistic already exists, CloudWatch displays the anomaly detection band in the sample graph at the top of the screen. If the model does not already exist, the model will be generated when you finish creating the alarm. It takes up to 15 minutes for the actual anomaly detection band generated by the model to appear in the graph. Before that, the band you see is an approximation of the anomaly detection band. To see the graph in a longer time frame, choose Edit at the top right of the page.&lt;/p&gt; 
+&lt;p&gt;b. For Whenever metric is, specify whether the metric must be greater than, lower than, or outside (in either direction) the band to trigger the alarm.&lt;/p&gt; 
+&lt;p&gt;c. For Anomaly detection threshold, choose the number to use for the anomaly detection threshold. A higher number creates a thicker band of "normal" values that is more tolerant of metric changes, and a lower number creates a thinner band that will go to ALARM state with smaller metric deviations. The number does not have to be a whole number.&lt;/p&gt; 
+&lt;p&gt;d. Choose Additional configuration. For Datapoints to alarm, specify how many evaluation periods (data points) must be in the ALARM state to trigger the alarm. If the two values here match, you create an alarm that goes to ALARM state if that many consecutive periods are breaching.&lt;/p&gt; 
+&lt;p&gt;To create an M out of N alarm, specify a lower number for the first value than you specify for the second value. For more information, see Evaluating an Alarm.&lt;/p&gt; 
+&lt;p&gt;e. For Missing data treatment, choose how to have the alarm behave when some data points are missing. For more information, see Configuring How CloudWatch Alarms Treat Missing Data.&lt;/p&gt; 
+&lt;p&gt;f. If the alarm uses a percentile as the monitored statistic, a Percentiles with low samples box appears. Use it to choose whether to evaluate or ignore cases with low sample rates. If you choose ignore (maintain alarm state), the current alarm state is always maintained when the sample size is too low. For more information, see Percentile-Based CloudWatch Alarms and Low Data Samples.&lt;/p&gt; 
+&lt;p&gt;6. Choose Next.&lt;/p&gt; 
+&lt;p&gt;7. Under Notification, select an SNS topic to notify when the alarm is in ALARM state, OK state, or INSUFFICIENT_DATA state.&lt;/p&gt; 
+&lt;p&gt;To have the alarm send multiple notifications for the same alarm state or for different alarm states, choose Add notification.&lt;/p&gt; 
+&lt;p&gt;To have the alarm not send notifications, choose Remove.&lt;/p&gt; 
+&lt;p&gt;8. To have the alarm perform EC2 actions when it changes state or create a Systems Manager OpsItem when it goes into ALARM state, choose the appropriate button and choose the alarm state and action to perform.&lt;/p&gt; 
+&lt;p&gt;9. When finished, choose Next.&lt;/p&gt; 
+&lt;p&gt;10. Enter a name and description for the alarm. The name must contain only ASCII characters. Then choose Next.&lt;/p&gt; 
+&lt;p&gt;11. Under Preview and create, confirm that the information and conditions are what you want, then choose Create alarm.&lt;/p&gt; 
+&lt;p&gt;Modifying an Anomaly Detection Model&lt;/p&gt; 
+&lt;p&gt;Once you have created an alarm, you can adjust the anomaly detection model. You can exclude certain time periods from being used in the model creation. It is critical that you exclude unusual events such as system outages, deployments, and holidays from the training data. You can also specify whether to adjust the model for daylight savings time changes.&lt;/p&gt; 
+&lt;p&gt;To adjust the anomaly detection model for an alarm&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Alarms.&lt;/p&gt; 
+&lt;p&gt;3. Choose the name of the alarm. Use the search box to find the alarm if necessary.&lt;/p&gt; 
+&lt;p&gt;4. Choose View in metrics.&lt;/p&gt; 
+&lt;p&gt;5. In the lower part of the screen, choose Edit model.&lt;/p&gt; 
+&lt;p&gt;6. To exclude a time period from being used to produce the model, choose Add another time range to exclude from training. Then select or enter the days and times to exclude from training, and choose Apply.&lt;/p&gt; 
+&lt;p&gt;7. If the metric is sensitive to daylight savings time changes, select the appropriate time zone in the Metric timezone box.&lt;/p&gt; 
+&lt;p&gt;8. Choose Update.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Using anomaly detection models for alarms incurs charges on your AWS account.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Creating a CloudWatch Alarm Based on Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Anomaly_Detection_Alarm.html"/>
+            <reference name="Using CloudWatch Anomaly Detection" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have created Anomaly Detection alarms properly.&lt;/p&gt;
+
+	&lt;p&gt;After you create a model, it constantly updates itself, using the latest data from the metric.&lt;/p&gt;
+
+	&lt;p&gt;After you enable anomaly detection on a metric, you can choose to exclude specified time periods of the metric from being used to train the model. This way, you can exclude deployments or other unusual events from being used for model training, ensuring the most accurate model is created.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH2" name="Follow the security best practices for CloudWatch Synthetics Canaries" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Follow the security best practices for CloudWatch Synthetics Canaries&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries follow the same routes and perform the same actions as a customer, which makes it possible for you to continually verify your customer experience even when you don't have any customer traffic on your applications.&lt;br&gt; However, there are several security issues that you should consider when creating and running canaries in Synthetics. AWS recommends to follow the undermentioned security best practices.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following sections explain security issues that you should consider when creating and running canaries in Synthetics.&lt;/p&gt; 
+&lt;p&gt;Use Secure Connections&lt;/p&gt; 
+&lt;p&gt;Because canary code and the results from canary test runs can contain sensitive information, do not have your canary connect to endpoints over unencrypted connections. Always use encrypted connections, such as those that begin with https://.&lt;/p&gt; 
+&lt;p&gt;Canary Naming Considerations&lt;/p&gt; 
+&lt;p&gt;The Amazon Resource Name (ARN) of a canary is included in the user-agent header as a part of outbound calls made from the Puppeteer-driven Chromium browser that is included as a part of the CloudWatch Synthetics wrapper library. This helps identify CloudWatch Synthetics canary traffic and relate it back to the canaries that are making calls.&lt;/p&gt; 
+&lt;p&gt;The canary ARN includes the canary name. Choose canary names that do not reveal proprietary information.&lt;/p&gt; 
+&lt;p&gt;Additionally, be sure to point your canaries only at websites and endpoints that you control.&lt;/p&gt; 
+&lt;p&gt;Secrets in Canary Code&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you don't include secrets, such as access keys or database credentials, in your canary source code.&lt;/p&gt; 
+&lt;p&gt;Permissions Considerations&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you restrict access to resources that are created or used by CloudWatch Synthetics. Use tight permissions on the Amazon S3 buckets where canaries store test run results and other artifacts, such as logs and screenshots.&lt;/p&gt; 
+&lt;p&gt;Similarly, keep tight permissions on the locations where your canary source code is stored, so that no user accidentally or maliciously deletes the Lambda layers or Lambda functions used for the canary.&lt;/p&gt; 
+&lt;p&gt;To help make sure you run the canary code you intend, you can use object versioning on the Amazon S3 bucket where your canary code is stored. Then when you specify this code to run as a canary, you can include the object versionId as part of the path, as in the following examples:&lt;/p&gt; 
+&lt;p&gt;https://bucket.s3.amazonaws.com/path/object.zip?versionId=version-id&lt;br&gt; https://s3.amazonaws.com/bucket/path/object.zip?versionId=version-id&lt;br&gt; https://bucket.s3-region.amazonaws.com/path/object.zip?versionId=version-id&lt;/p&gt; 
+&lt;p&gt;Stack Traces and Exception Messages&lt;/p&gt; 
+&lt;p&gt;By default, CloudWatch Synthetics canaries capture any exception thrown by your canary script, no matter whether the script is custom or is from a blueprint. CloudWatch Synthetics logs both the exception message and the stack trace to three locations:&lt;/p&gt; 
+&lt;p&gt;- Back into the CloudWatch Synthetics service to speed up debugging when you describe test runs&lt;/p&gt; 
+&lt;p&gt;- Into CloudWatch Logs according to the configuration that your Lambda functions are created with&lt;/p&gt; 
+&lt;p&gt;- Into the Synthetics log file, which is a plaintext file that is uploaded to the Amazon S3 location specified by the value you set for the resultsLocation of the canary&lt;/p&gt; 
+&lt;p&gt;If you want to send and store less information, you can capture exceptions before they return to the CloudWatch Synthetics wrapper library.&lt;/p&gt; 
+&lt;p&gt;Scope Your IAM Roles Narrowly&lt;/p&gt; 
+&lt;p&gt;AWS recommends that you do not configure your canary to visit potentially malicious URLs or endpoints. Pointing your Canary to untrusted or unknown websites or endpoints could expose your Lambda function code to malicious user's scripts. Assuming a malicious website can break out of Chromium, it could have access to your Lambda code in a similar way to if you connected to it using an internet browser.&lt;/p&gt; 
+&lt;p&gt;Run your Lambda function with an IAM execution role that has scoped-down permissions. This way, if your Lambda function is compromised by a malicious script, it is limited in the actions it can take when running as your canary's AWS account.&lt;/p&gt; 
+&lt;p&gt;When you use the CloudWatch console to create a canary, it is created with a scoped-down IAM execution role.&lt;/p&gt; 
+&lt;p&gt;Header Logging&lt;/p&gt; 
+&lt;p&gt;By default, canary header logging logs only the request URL, response code, and response status. Within your canary script, you can customize the logging to log more or less information.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Considerations for Synthetics Canaries" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/servicelens_canaries_security.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are following security best practices for CloudWatch Synthetics Canaries.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="http://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.355">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH6" name="Use CloudWatch Agent to collect system-level metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use CloudWatch Agent to collect system-level metrics&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The unified CloudWatch agent enables you to do the following:&lt;/p&gt; 
+&lt;p&gt;- Collect internal system-level metrics from Amazon EC2 instances across operating systems. The metrics can include in-guest metrics, in addition to the metrics for EC2 instances. The additional metrics that can be collected are listed in Metrics Collected by the CloudWatch Agent.&lt;/p&gt; 
+&lt;p&gt;- Collect system-level metrics from on-premises servers. These can include servers in a hybrid environment as well as servers not managed by AWS.&lt;/p&gt; 
+&lt;p&gt;- Retrieve custom metrics from your applications or services using the StatsD and collectd protocols. StatsD is supported on both Linux servers and servers running Windows Server. collectd is supported only on Linux servers.&lt;/p&gt; 
+&lt;p&gt;- Collect logs from Amazon EC2 instances and on-premises servers, running either Linux or Windows Server.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Installation Process Overview&lt;/p&gt; 
+&lt;p&gt;You can download and install the CloudWatch agent manually using the command line, or you can integrate it with SSM. The general flow of installing the CloudWatch agent using either method is as follows:&lt;/p&gt; 
+&lt;p&gt;1. Create IAM roles or users that enable the agent to collect metrics from the server and optionally to integrate with AWS Systems Manager.&lt;/p&gt; 
+&lt;p&gt;2. Download the agent package.&lt;/p&gt; 
+&lt;p&gt;3. Modify the CloudWatch agent configuration file and specify the metrics that you want to collect.&lt;/p&gt; 
+&lt;p&gt;4. Install and start the agent on your servers. As you install the agent on an EC2 instance, you attach the IAM role that you created in step 1. As you install the agent on an on-premises server, you specify a named profile that contains the credentials of the IAM user that you created in step 1.&lt;/p&gt; 
+&lt;p&gt;For further information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Please follow Reference URL to check for Supported Operating Systems.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Collecting Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify That the CloudWatch Agent Is Running&lt;/p&gt;
+
+	&lt;p&gt;You can query the CloudWatch agent to find whether it's running or stopped. You can use AWS Systems Manager to do this remotely. You can also use the command line, but only to check the local server.&lt;/p&gt;
+
+	&lt;p&gt;To query the status of the CloudWatch agent using Run Command&lt;/p&gt;
+
+	&lt;p&gt;1. Open the Systems Manager console at https://console.aws.amazon.com/systems-manager/.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Run Command.&lt;/p&gt;
+
+	&lt;p&gt;&lt;del&gt;or&lt;/del&gt;&lt;/p&gt;
+
+	&lt;p&gt;If the AWS Systems Manager home page opens, scroll down and choose Explore Run Command.&lt;/p&gt;
+
+	&lt;p&gt;3. Choose Run command.&lt;/p&gt;
+
+	&lt;p&gt;4. In the Command document list, choose the button next to AmazonCloudWatch-ManageAgent.&lt;/p&gt;
+
+	&lt;p&gt;5. In the Action list, choose status.&lt;/p&gt;
+
+	&lt;p&gt;6. For Optional Configuration Source choose default and keep Optional Configuration Location blank.&lt;/p&gt;
+
+	&lt;p&gt;7. In the Target area, choose the instance to check.&lt;/p&gt;
+
+	&lt;p&gt;8. Choose Run.&lt;/p&gt;
+
+	&lt;p&gt;If the agent is running, the output resembles the following.&lt;/p&gt;
+
+	&lt;p&gt;{
+       "status": "running",
+       "starttime": "2017-12-12T18:41:18",
+       "version": "1.73.4"&lt;br /&gt;
+}&lt;/p&gt;
+
+	&lt;p&gt;If the agent is stopped, the "status" field displays "stopped".&lt;/p&gt;
+
+
+	&lt;p&gt;To query the status of the CloudWatch agent locally using the command line&lt;/p&gt;
+
+	&lt;p&gt;- On a Linux server, enter the following:&lt;/p&gt;
+
+	&lt;p&gt;sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status&lt;/p&gt;
+
+	&lt;p&gt;- On a server running Windows Server, enter the following in PowerShell as an administrator:&lt;/p&gt;
+
+	&lt;p&gt;&amp;amp; $Env:ProgramFiles\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1 -m ec2 -a status&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.303">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDWATCH5" name="Use CloudWatch metric streams" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use CloudWatch metric streams&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use metric streams to continually stream CloudWatch metrics to a destination of your choice, with near-real-time delivery and low latency. Supported destinations include AWS destinations such as Amazon Simple Storage Service and several third-party service provider destinations.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to use the CloudWatch console to set up a metric stream to another AWS service&lt;/p&gt; 
+&lt;p&gt;When you use the console to set up a metric stream, you have the option of choosing the Quick S3 Setup. This method works well if want the final output as JSON or to be queried by Amazon Athena. If you want the final format to be Parquet format or Optimized Row Columnar (ORC), you should create your own Kinesis Data Firehose delivery stream and choose Select an existing Firehose owned by your account instead of choosing Quick S3 Setup.&lt;/p&gt; 
+&lt;p&gt;To set up a metric stream to an AWS service&lt;/p&gt; 
+&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt; 
+&lt;p&gt;2. In the navigation pane, choose Streams, Create stream.&lt;/p&gt; 
+&lt;p&gt;3. Choose the CloudWatch metric namespaces to include in the metric stream.&lt;/p&gt; 
+&lt;p&gt;- To include all or most of your metric namespaces in the metric stream, choose All metrics.&lt;/p&gt; 
+&lt;p&gt;Then, if you want to exclude some metric namespaces from the stream, choose Exclude metric namespaces and select the namespaces to exclude.&lt;/p&gt; 
+&lt;p&gt;- To include only a few metric namespaces in the metric stream, choose Selected namespaces and then select the namespaces to include.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt; 
+&lt;p&gt;4. Choose one of the following:&lt;/p&gt; 
+&lt;p&gt;- For a quick setup, choose Quick S3 setup. CloudWatch will create all necessary resources including the Kinesis Data Firehose delivery stream and the necessary IAM roles. The default format for this option is JSON, but you can change the format later in this procedure.&lt;/p&gt; 
+&lt;p&gt;- To use a Kinesis Data Firehose delivery stream that already exists, choose Select an existing Firehose owned by your account. The Kinesis Data Firehose delivery stream must be in the same account. The default format for this option is OpenTelemetry, but you can change the format later in this procedure.&lt;/p&gt; 
+&lt;p&gt;Then select the Kinesis Data Firehose delivery stream to use under Select your Kinesis Data Firehose delivery stream.&lt;/p&gt; 
+&lt;p&gt;5. (Optional) If you're using Quick S3 Setup, you can choose Select existing resources to use an existing S3 bucket or existing IAM roles instead of having CloudWatch create new ones for you.&lt;/p&gt; 
+&lt;p&gt;6. (Optional) If you're using Select an existing Firehose owned by your account, you can choose Select existing service role to use an existing IAM role instead of having CloudWatch create a new one for you.&lt;/p&gt; 
+&lt;p&gt;7. (Optional) To change the output format from the default format for your scenario, choose Change output format. The supported formats are JSON and OpenTelemetry 0.7.0.&lt;/p&gt; 
+&lt;p&gt;8. (Optional) Customize the name of the new metric stream under Metric stream name.&lt;/p&gt; 
+&lt;p&gt;9. Choose Create metric stream.&lt;/p&gt; 
+&lt;p&gt;Setting up a metric stream to a third-party solution&lt;/p&gt; 
+&lt;p&gt;To set up a CloudWatch metric stream to stream metrics to a third-party solution, follow the instructions provided by that third-party provider.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Consider carefully whether to stream all metrics, because the more metrics that you stream the higher your metric stream charges will be.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Metric stream operation and maintenance" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-operation.html"/>
+            <reference name="Using metric streams" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metric-Streams.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Metric streams are always in one of two states, Running or Stopped.&lt;/p&gt;
+
+	&lt;p&gt;Running - The metric stream is running correctly. There might not be any metric data streamed to the destination because of the filters on the stream.&lt;/p&gt;
+
+	&lt;p&gt;Stopped - The metric stream has been explicitly stopped by someone, and not because of an error. It might be useful to stop your stream to temporarily pause the streaming of data without deleting the stream.&lt;/p&gt;
+
+	&lt;p&gt;If you stop and restart a metric stream, the metric data that was published to CloudWatch while the metric stream was stopped is not backfilled to the metric stream.&lt;/p&gt;
+
+	&lt;p&gt;If you change the output format of a metric stream, in certain cases you might see a small amount of metric data written to the destination in both the old format and the new format. To avoid this situation, you can create a new Kinesis Data Firehose delivery stream with the same configuration as your current one, then change to the new Kinesis Data Firehose delivery stream and change the output format at the same time. This way, the Kinesis records with different output format are stored on Amazon S3 in separate objects. Later, you can direct the traffic back to the original Kinesis Data Firehose delivery stream and delete the second delivery stream.&lt;/p&gt;
+
+	&lt;p&gt;To view, edit, stop, and start your metric streams&lt;/p&gt;
+
+	&lt;p&gt;1. Open the CloudWatch console.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, choose Streams.&lt;/p&gt;
+
+	&lt;p&gt;The list of streams appears, and the Status column displays whether each stream is running or stopped.&lt;/p&gt;
+
+	&lt;p&gt;3. To stop or start a metric stream, select the stream and choose Stop or Start.&lt;/p&gt;
+
+	&lt;p&gt;4. To see the details about a metric stream, select the stream and choose View details.&lt;/p&gt;
+
+	&lt;p&gt;5. To change the stream's output format, filters, destination Kinesis Data Firehose stream, or roles, choose Edit and make the changes that you want.&lt;/p&gt;
+
+	&lt;p&gt;If you change the filters, there might be some gaps in the metric data during the transition.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-06-22T08:10:13.316">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
+                    <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
+                    <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
+                    <countermeasure ref="aws-tier-4.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH4" mitigation="25"/>
+                <countermeasure ref="AWS-CLOUDWATCH5" mitigation="25"/>
+                <countermeasure ref="AWS-CLOUDWATCH6" mitigation="25"/>
+                <countermeasure ref="aws-tier-4.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDWATCH7" mitigation="33"/>
+                <countermeasure ref="AWS-VPC5" mitigation="34"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="bf5398d4-336a-4832-bfe2-db51e7e9e20c" diagramComponentId="a7371359-5908-45b4-85a8-1621e50f8dcd" ref="cb3c3a00-6887-4025-a440-4c5298fb2b0d" name="AWS API Gateway" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="api-gateway">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.413">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.927">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of a command using
+                    externally-influenced input from an upstream component, but it does not
+                    neutralize or incorrectly neutralizes special elements that could modify the
+                    intended command when it is sent to a downstream
+                    component.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.415">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.929">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.928">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.716">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Choose a minimum TLS version for a custom domain in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create a custom domain, you specify the security policy for it. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control and manage access to a REST API in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use the following mechanisms for authentication and authorization: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. IAM tags can be used together with IAM policies to control access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for API endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+              <reference name="Routing traffic to an Amazon API Gateway API by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a REST API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Do one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create an API and deploy it to a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Logs/Tracing in the Stage Editor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable execution logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable CloudWatch Logs under CloudWatch Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Error or Info from the dropdown menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If desired, choose Enable Detailed CloudWatch Metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable access logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable Access Logging under Custom Access Logging. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable execution logging and access logging independent of each other. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test your logging setup&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
+              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Monitor REST API execution with Amazon CloudWatch metrics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can access CloudWatch using any of the following methods: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon CloudWatch console 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS CLI&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  CloudWatch API 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose the name of the API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Under the selected API, choose Dashboard. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Use From and To to enter the date range. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable payload compression by using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API or create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Another way is to use AWS CLI to create a new API and enable compression. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose a REST API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. In the Resources pane, choose the method you want to test. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For additional options you may need to specify, contact the API owner. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Choose Test. The following information will be displayed: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
+   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
+   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
+   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
+   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
+   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If you choose to enable caching for a REST API, you can enable cache encryption. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To configure API caching for individual methods using the console: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Go to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stages list for the API, expand the stage and choose a method in the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Override for this method in Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable request validation in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Enable request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test basic request validation using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following steps describe how to test basic request validation in the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test the request validation on a method using TestInvoke in the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  While signed in to the API Gateway console, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Resources for the API that you've configured a request validators map for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a method for which you have enabled the request validation with a specified request validator. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Method Execution, in the Client box, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Invalid request body" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the request parameters aren't valid, the following error message returns: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.725">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content-Type: application/json 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: apigateway.us-east-1.amazonaws.com 
+&lt;/div&gt; 
+&lt;div&gt;
+  X-Amz-Date: 20170603T200400Z 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authorization: AWS4-HMAC-SHA256 Credential=... 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "patchOperations" : [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; } 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; ] 
+&lt;/div&gt; 
+&lt;div&gt;
+  }&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of update-stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to remove the old certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of delete-client-certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate in the console for a previously deployed API, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the main navigation pane, choose Client Certificates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Client Certificates pane, choose Generate Client Certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the API for which you want to use the client certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages under the selected API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To save the settings, choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need to redeploy the API for the changes to take effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up a stage for a REST API 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a new stage 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the APIs navigation pane, choose Stages under an API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Stages navigation pane, choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Optionally, enter a stage description for Stage description. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To see your Stages follow the steps below: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the APIs pane, choose the API, and then choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the Stages pane, choose the name of the stage. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To get started with AWS Secrets Manager:&lt;/p&gt;&lt;p&gt;1. Identify your secrets and locate where they are used in your applications.&lt;/p&gt;&lt;p&gt;2. Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console.&lt;/p&gt;&lt;p&gt;3. Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets.&lt;/p&gt;&lt;p&gt;4. If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation.&lt;/p&gt;&lt;p&gt;5. If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret.&lt;/p&gt;&lt;p&gt;6. Update your applications to retrieve secrets from Secrets Manager.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.249">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+              <reference name="Get started with AWS Secrets Manager" url="https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can do this by: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
+  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose an API method. In Client, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. From Client Certificate, choose Test to invoke the method request. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+              <reference name="Test invoke to verify the client certificate configuration" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:28.245">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-77">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="45e29082-ac55-486b-91c5-96cf1cf7e024" diagramComponentId="c1a1276f-411a-4aeb-818c-a4b605112c51" ref="88ead499-6db6-4ecb-96d9-363b587ed0d5" name="AWS Account Environment" desc="" library="Hydras-AWS-Foundation" parentComponentRef="" componentDefinitionRef="amazon-web-services-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-Logging-3.3" name="Audit logs are accesible" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The audit logs are not encrypted and they can be accessed by attackers and obtain sensitive data
+                        in clear text.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.5" name="Brute force attempts on the Amazon management console cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The failure connection attempts (brute force) must be audited and monitored and the
+                        correspondent personnel must be alerted and informed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.12" name="Changes in the network configuration cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The changes in the network configurations (NACLs, route and gateway tables) are not detected
+                        because the monitorization and alerts of the network configuration are not configured to detect
+                        these changes.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.4" name="Changes in the security configurations can be not detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Monitoring and alerting for security configurations are not configured and changes cannot be
+                        detected.&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.10" name="Changes in the security groups cannot be detected" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the security groups must be audited and monitored and the correspondent
+                        personnel must approve these changes. If the situation is not the correct, attackers can access
+                        to security systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="cloudwatch-misconfig" name="Cloudwatch is misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-25T13:52:40.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Monitoring-4.3" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login to the console without using the Multi-factor Authentication (MFA) and they are not
+                        detected. The connection without the MFA must be audited and monitored, the correct security
+                        group must be informed and they must validate this connection.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:15.193">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.1" name="Non-auditable API calls in all regions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The API call to the resources is not audited and the actions are not recorded into the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.8" name="Non-centrality audit logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The audit logs are not stored in a central system. Therefore, the audit logs cannot be
+                        exploited correctly by the security personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator account is not configured. The security question to recover or reset the
+                        password and the authentication method are not configured.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-24T14:48:26.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-1.21" name="The access keys are generated when the setup of the users is started" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The system doesn't require additional steps to create access keys, the access keys are
+                        generating when the process to create an user is starting. The problem is that these keys can be
+                        in use somewhere in the organization and maybe these keys are not necessary for the user.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EXPIRATION-DATE" name="The password expiration is not established" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.9" name="The security policies are exposed in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not configured and the security configurations are exposed for the
+                        attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.7" name="Unaudited connections with the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The connections with the applications and with the databases cannot be audited and not
+                        detected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.9" name="Unaudited resources changes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in the applications and in the databases and these changes are not detected and
+                        not audited.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.685">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.12" name="Apply an AWS Managed Config Rule for EIPs attached to EC2 instances within VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources. You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Description": "Checks whether all EIP addresses allocated to a VPC are attached to 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    EC2 instances or in-use ENIs.", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ConfigRuleName": "eip-attached", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Source": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Owner": "AWS", 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "SourceIdentifier": "EIP_ATTACHED" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    }, 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "Scope": { 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "ComplianceResourceTypes": [ 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    "AWS::EC2::EIP" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    ] 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    } 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a Config Rule using the configuration saved earlier:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe config rules" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"/>
+            <reference name="Put config rule" url="https://docs.aws.amazon.com/cli/latest/reference/configservice/put-config-rule.html"/>
+            <reference name="What is Config" url="https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html"/>
+          </references>
+          <standards>
+            <standard ref="5.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for a Config Rule that checks whether all EIP addresses allocated to a VPC are attached to EC2 instances or in-use ENIs:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws configservice describe-config-rules --query "ConfigRules[?Source.SourceIdentifier== 'EIP_ATTACHED']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:48:26.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.3-2.4" name="Apply an IAM Role for Amazon EC2 Tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      } 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Describe instances" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Web tier EC2 instances, check if and which IAM instance profile they have attached, and note the name of the instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-instances --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "Reservations[*].Instances[*].{IamInstanceProfile:IamInstanceProfile, InstanceId:InstanceId}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:47:29.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.1-2.2" name="Apply IAM Policy for EC2 IAM Roles for tier" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles defined with AWS Identity Access Management. An IAM policy is a document that formally states one or more permissions using the following structure:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Actions: what actions are allowed (each AWS service has its own set of actions)&lt;/li&gt; 
+  &lt;li&gt;Resources: which resources will be affected by the action&lt;/li&gt; 
+  &lt;li&gt;Effect: what effect will be when the subject (user/group/roles) requests access Policies are documents that are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;b&gt;Remediation&lt;/b&gt;: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    *Note: references to Web tier are also applicable to App tier 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an instance profile for Web tier instances:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM role for the instance profile:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a trust relationship policy document and save it locally as /tmp/TrustPolicy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      { 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Version": "2012-10-17", 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      "Statement": [ 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Effect": "Allow", 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Principal": { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        "Service": "ec2.amazonaws.com" 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       }, 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       "Action": "sts:AssumeRole" 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      ] 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Create the IAM role using the above trust policy:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       aws iam create-role --role-name &amp;lt;web_tier_iam_role&amp;gt; --assume-role-policydocument file:///tmp/TrustPolicy.json 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Add the IAM role created to the Instance profile:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam add-role-to-instance-profile --role-name &amp;lt;web_tier_iam_role&amp;gt; --instanceprofile-name &amp;lt;web_tier_instance_profile&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If doesn't exist, create an IAM managed policy for Web tier instances, and note the policy ARN:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam create-policy --policy-name &amp;lt;iam_policy_name&amp;gt; --policy-document file://policy 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the IAM policy created to the Web tier IAM role:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --rolename &amp;lt;web_tier_iam_role&amp;gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add role to instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/add-role-to-instance-profile.html"/>
+            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="Create instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-instance-profile.html"/>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Create role" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="Get policy version" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy-version.html"/>
+            <reference name="List attached role policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-role-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check managed policies attached to the IAM role, and note the policies ARN:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-attached-role-policies --role-name &amp;lt;web_tier_iam_role&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the version of the IAM policies attached to the IAM role:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --query "Policy.DefaultVersionId" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the document policy:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;iam_policy_arn&amp;gt; --version-id &amp;lt;iam_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:34:12.746">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.8" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers, accounting, etc.), define the relevant permissions for each group, and then assign IAM users to those groups. All the users in an IAM group inherit the permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can simply change what IAM group their IAM user belongs to. This method is know as Role Based Access Control (RBAC). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Remove privilege granted directly to a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;For each user complete the following:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select the user.&lt;/li&gt; 
+   &lt;li&gt;Click on the Permissions tab.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Managed Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Detach Policy&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Expand &amp;quot;Inline Policies&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Click &amp;quot;Remove Policy&amp;quot;.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ol&gt;Create a Group and add a user: 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select Groups and click Create New Group.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Group Name box, type the name of the group and click Next Step.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of policies, select the check box for each policy that you want to apply to all members of the group. Click Next Step.&lt;/li&gt; 
+  &lt;li&gt;Click Create Group.&lt;/li&gt; 
+  &lt;li&gt;Click the new Group and select the &amp;quot;Users&amp;quot; tab.&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Add Users to Group&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select the users and click &amp;quot;Add Users&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Run the following to determine if they have policies directly attached:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-attached-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws iam list-user-policies --user-name user
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.3" name="Avoid publishing CloudTrail logs publicly" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Since cloudtrail logs capture all API calls for the AWS account they should be stored in an S3 bucket that is not accessible to the public. Applying the correct bucket policy helps ensure the confidentiality of the data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with s3 update privileges).&lt;/li&gt; 
+  &lt;li&gt;Select s3 from the services list.&lt;/li&gt; 
+  &lt;li&gt;Right-click on the bucket you have used for "cloudtrail" and click "Properties".&lt;/li&gt; 
+  &lt;li&gt;In the Properties pane, click the Permissions tab.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the row that grants permission to "Everyone" or "Any Authenticated User".&lt;/li&gt; 
+  &lt;li&gt;Uncheck all the permissions granted to Everyone or Any Authenticated User.&lt;/li&gt; 
+  &lt;li&gt;Click Save to save the ACL.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If the Edit bucket policy button is present, click it.&lt;/li&gt; 
+  &lt;li&gt;Remove any Statement having an Effect set to Allow and a Principal set to *.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain the bucket name of the cloudtrail:&amp;nbsp;aws cloudtrail describe-trails
+                            --query 'trailList[*].S3BucketName'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;AllUsers&amp;quot; is not granted access to the bucket:&amp;nbsp;aws
+                            s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]'&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Authenticated Users&amp;quot; is not granted access to the
+                            bucket: aws s3api get-bucket-acl --bucket &amp;lt;bucket_name&amp;gt; --query
+                            'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/Authenticated Users`]'&lt;/li&gt;
+                            &lt;li&gt;Validate the bucket policy does not grant access to all:&amp;nbsp;aws s3api
+                            get-bucket-policy --bucket &amp;lt;bucket_name&amp;gt;&lt;/li&gt;
+                            &lt;li&gt;Check that the above command does not provide a principal of *, with EFFECT set to
+                            ALLOW.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.703">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.5-2.6" name="Configure AutoScaling Group Launch Configuration for Tier to use a customer created IAM Role" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;An IAM role is similar to a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Also, a role does not have any credentials (password or access keys) associated with it. Instead, if a user is assigned to a role, access keys are created dynamically and provided to the user.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use roles to delegate access to users, applications, or services that don't normally have access to your AWS resources. Applications must sign their API requests with AWS credentials. Therefore, if you are an application developer, you need a strategy for managing credentials for your applications that run on EC2 instances.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  IAM Roles for EC2 allow application running within an EC2 instance assume the role applied to the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  *Note: references to Web tier are also applicable to App tier. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration for the Web tier using the Web tier IAM instance profile :&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="Get instance profile" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-instance-profile.html"/>
+          </references>
+          <standards>
+            <standard ref="2.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="2.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if your Web tier autoscaling group is using a launch configuration with an IAM instance profile configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt; --query "LaunchConfigurations[*].IamInstanceProfile" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check and note the IAM role name used by the Web tier instance profile:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-instance-profile --instance-profile-name &amp;lt;web_tier_instance_profile&amp;gt; --query "InstanceProfile.Roles[*].RoleName" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:55:23.427">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM1" name="Configure contact email and telephone details on AWS accounts" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.&lt;/p&gt;&lt;p&gt;An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing ).&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, next to Account Settings, choose Edit.&lt;/li&gt;&lt;li&gt;Next to the field that you need to update, choose Edit.&lt;/li&gt;&lt;li&gt;After you have entered your changes, choose Save changes.&lt;/li&gt;&lt;li&gt;After you have made your changes, choose Done.&lt;/li&gt;&lt;li&gt;To edit your contact information, under Contact Information, choose Edit.&lt;/li&gt;&lt;li&gt;For the fields that you want to change, type your updated information, and then choose Update.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:*Billing )&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&lt;/li&gt;&lt;li&gt;On the navigation bar, choose your account name, and then choose My Account.&lt;/li&gt;&lt;li&gt;On the Account Settings page, review and verify the current details.&lt;/li&gt;&lt;li&gt;Under Contact Information, review and verify the current details.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.232">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.11" name="Configure password expiration" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Change access keys regularly, and make sure that all IAM users in your account do as well. That way, if an access key is compromised without your knowledge, you limit how long the credentials can be used to access your resources. Credential reports can be used to determine how long access keys have been active for. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Click on Users.&lt;/li&gt; 
+  &lt;li&gt;Select the user you wish to rotate the key for.&lt;/li&gt; 
+  &lt;li&gt;Under access keys click &amp;quot;Create Access Key&amp;quot; (do not touch the existing key yet).&lt;/li&gt; 
+  &lt;li&gt;Click &amp;quot;Download credentials&amp;quot; or &amp;quot;Show credentials&amp;quot; so that you have a record of them.&lt;/li&gt; 
+  &lt;li&gt;Update any applications with the new credentials and test (we recommend to leave a few days or a week for testing).&lt;/li&gt; 
+  &lt;li&gt;Once complete complete 1-4 above and for the key which needs rotating click &amp;quot;Make Inactive | Delete&amp;quot; and click &amp;quot;Deactive&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Once you are confident you will no longer need the key (wait several more days) repeat 1-4 and select &amp;quot;Delete&amp;quot; for the inactive key.&lt;/li&gt; 
+ &lt;/ol&gt; 
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Check the access keys created time: aws iam get-credential-report --query
+                            'Content' --output text | base64 -D | awk -F, '{print $1,$9,$10,$14,$15}'&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each access_key_1_active and access_key_9_active that is set to True ensure
+                            the created date is within the last 90 days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.1" name="Configure the security challenge questions within the AWS Account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When an AWS account is initially created it is configured with a top level account known as the &amp;quot;root&amp;quot; account that has full administration access to all resources. In the event that the password or MFA device associated with this account is lost AWS support may recover it by asking you to answer the security questions. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;For each question:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Select an appropriate question.&lt;/li&gt; 
+   &lt;li&gt;Enter an appropriate answer.&lt;/li&gt; 
+   &lt;li&gt;Follow the above process for all 3 questions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;Click Update when complete.&lt;/li&gt; 
+  &lt;li&gt;We recommend to store the questions and answers in a secure location such as a safe where they can be used in case recovery is required.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Configure Security Challenge Questions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether questions and answers have been saved.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.7" name="Create a Cloudwatch Alarm and its action for the &quot;VPC Flow Logs&quot; metric filter" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;div&gt;
+   A Cloudwatch alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The Cloudwatch Alarm will trigger a notification being sent to the administrators every time the "REJECT packets" specified threshold is reached. The alarm should be created for the "VPC Flow Logs" metric, and the action should have a SNS topic configured.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch alarm for the VPC Flow Logs metric, and configure an Alarm Action:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws cloudwatch put-metric-alarm --alarm-name &amp;lt;vpc_flow_log_alarm_name&amp;gt; --alarm-actions &amp;lt;sns_topic_arn&amp;gt; --metric-name &amp;lt;vpc_flow_log_metric_name&amp;gt; --namespace LogMetrics --statistic &amp;lt;desired_statistic&amp;gt; --period &amp;lt;desired_period&amp;gt; --evaluation-periods &amp;lt;desired_evaluation_periods&amp;gt; --threshold &amp;lt;desired_threshold&amp;gt; --comparison-operator &amp;lt;desired_operator&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe alarms" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"/>
+            <reference name="Put metric alarm" url="https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/put-metric-alarm.html"/>
+          </references>
+          <standards>
+            <standard ref="4.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all the Cloudwatch alarms configured for the VPC Flow Logs metric, and check if an Alarm Action is configured:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch describe-alarms --query "MetricAlarms[?MetricName =='&amp;lt;vpc_flow_log_metric_name&amp;gt;'].{MetricName:MetricName,AlarmActions:AlarmActions,AlarmName:AlarmName}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:51:42.064">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.6" name="Create a log metric filter for the Cloudwatch group assigned to the &quot;VPC Flow Logs&quot;" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Description:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  This recommendation builds upon the Foundation benchmark recommendation: "Ensure VPC Flow Logging is Enabled in all Applicable Regions"&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  VPC flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. VPC flow logs can capture accepted traffic, rejected traffic, or all traffic.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Metric filters can be used to express how the service would extract metric observations from ingested events and transform them to data points in a CloudWatch metric. Metric filters are assigned to log groups, and all of the filters assigned to a log group are applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A metric filter should be created for counting how many IP packets are rejected in the VPC flow logs.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a metric filter for the Cloudwatch Log group assigned to the "VPC Flow Logs":&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs put-metric-filter --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; --filter-name &amp;lt;vpc_flow_log_filter_name&amp;gt; --filter-pattern "{ $.errorCode =\"AccessDenied\" }" --metric-transformations metricName= &amp;lt;vpc_flow_log_metric_name&amp;gt;,metricNamespace=LogMetrics,metricValue=1 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"/>
+            <reference name="Filter log events" url="https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html"/>
+            <reference name="Put metric filter" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html"/>
+          </references>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface to check if the log metric filter: 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws logs describe-metric-filters --region &amp;lt;application_region&amp;gt; --log-group-name &amp;lt;vpc_flow_log_group_name&amp;gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T15:48:32.261">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.7" name="Create an IAM group for administration purposes" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;: 
+&lt;div&gt; 
+ &lt;br&gt; 
+  An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and should have administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new IAM group for administration purposes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-group --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attach the Admin policy to the administration IAM group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam attach-group-policy --policy-arn &amp;lt;admin_policy_arn&amp;gt; --group-name &amp;lt;iam_admin_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The name of the IAM admin group name should be known prior to auditing this recommendation. For a sample admin policy arn see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Attach group policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-group-policy.html"/>
+            <reference name="Create groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-group.html"/>
+            <reference name="List groups" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="2.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM groups created for administration purposes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-groups --query "Groups[?GroupName == '&amp;lt;iam_admin_group_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T13:59:51.981">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-2.8" name="Create an IAM policy that allows admin privileges for all services used" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A policy is a document that formally states one or more permissions.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies apply only to identities (users, groups, and roles) - not resources. You must ensure that you have an IAM managed policy created with admin permissions for all the AWS services used by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create an IAM managed admin policy for all AWS services used:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam create-policy --policy-name &amp;lt;admin_policy_name&amp;gt; --policy-document file://policy 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;br&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The admin policy should be defined prior to auditing and remediating this recommendation. For a sample admin policy see recommendation 2.1. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html"/>
+            <reference name="Get policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html"/>
+            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="2.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the IAM admin policies and note the policy ARN and DefaultVersionId:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-policies --query "Policies[?PolicyName == '&amp;lt;admin_policy_name&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;If the policy exists, check the policy document:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam get-policy-version --policy-arn &amp;lt;admin_policy_arn&amp;gt; --version-id &amp;lt;admin_policy_version&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T14:02:44.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.20" name="Create an IAM role for managing incidents with AWS" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>WS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br /&gt;Using the Amazon unified command line interface, create an IAM role for managing incidents with AWS: 
+&lt;br /&gt; 
+&lt;br /&gt;Create a trust relationship policy document that allows &amp;lt;iam_user&amp;gt; to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: 
+&lt;br /&gt; 
+&lt;br /&gt;{ 
+&lt;br /&gt;&amp;quot;Version&amp;quot;: &amp;quot;2012-10-17&amp;quot;, 
+&lt;br /&gt;&amp;quot;Statement&amp;quot;: [{ 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Effect&amp;quot;: &amp;quot;Allow&amp;quot;, 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;Principal&amp;quot;: { 
+&lt;br /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; &amp;quot;AWS&amp;quot;: &amp;quot;&amp;lt;iam_user&amp;gt;&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }, 
+&lt;br /&gt;&amp;nbsp; &amp;quot;Action&amp;quot;: &amp;quot;sts:AssumeRole&amp;quot; 
+&lt;br /&gt;&amp;nbsp; }] 
+&lt;br /&gt;} 
+&lt;br /&gt; 
+&lt;br /&gt;Create the IAM role using the above trust policy: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam create-role --role-name &amp;lt;aws_support_iam_role&amp;gt; --assume-role-policy-document file:///tmp/TrustPolicy.json 
+&lt;br /&gt; 
+&lt;br /&gt;Attach 'AWSSupportAccess' managed policy to the created IAM role: 
+&lt;br /&gt; 
+&lt;br /&gt;aws iam attach-role-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; --role-name &amp;lt;aws_support_iam_role&amp;gt; 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="Amazon docs: list entities for policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html"/>
+            <reference name="Amazon docs: list policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+            <reference name="Amazon docs: managed policies and inline policies" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"/>
+            <reference name="Attach role policy" url="https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html"/>
+            <reference name="List policies" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-policies.html"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface: 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the &amp;quot;Arn&amp;quot; element value: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-policies --query &amp;quot;Policies[?PolicyName == 'AWSSupportAccess']&amp;quot; 
+            &lt;br /&gt; 
+            &lt;div&gt; 
+             &lt;ul&gt; 
+              &lt;li&gt;Check if the 'AWSSupportAccess' is attached to any IAM user, group or role: &lt;/li&gt; 
+             &lt;/ul&gt; 
+            &lt;/div&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; aws iam list-entities-for-policy --policy-arn &amp;lt;iam_policy_arn&amp;gt; 
+            &lt;span style=" , Arial;"&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.026">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-3" name="Create AWS Organizations change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;organizations_changes&amp;gt;` --metric-transformations metricName= `&amp;lt;organizations_changes&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;organizations_changes&amp;gt;` --metric-name `&amp;lt;organizations_changes&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.15" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.359">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.8" name="Create billing alerts to identify unusual spend" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By setting billing alarms you can monitor your AWS spend and be alerted if it exceeds certain thresholds thus protecting you from accruing unnecessary charges. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select the Receive Billing Alerts check box.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Choose Save preferences.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia). The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;On the navigation pane, under "Metrics", choose "Billing".&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the list of billing metrics, select the check box next to Currency USD, for the metric named EstimatedCharges. Define the alarm as follows:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If you want the alarm to trigger as soon as you go over the free tier, set "When my total AWS charges for the month exceed" to $.01. This means that you'll receive a notification as soon as you incur a charge. Otherwise, set it to the amount you want to trigger the alarm, and you will be notified when you go over that amount.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose the "New list" link next to the "send a notification to" box.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;When prompted, enter your email address or choose your Amazon SNS notification from the drop down.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Choose "Create Alarm".&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;In the "Confirm new email addresses" dialog box, confirm the email address or choose "I will do it later". If you don't confirm the email address now, the alarm remains in the Pending confirmation status until you do so, and does not send an alert. To view the status of your alarm, choose "Alarms" in the navigation panel.&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console and open the Billing and Cost Management
+                            console at https://console.aws.amazon.com/billing/home#/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, choose Preferences.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the &amp;quot;Receive Billing Alerts&amp;quot; check box is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If necessary, change the region on the navigation bar to US East (N. Virginia).
+                            The billing metric data is stored in this region, even for resources in other regions.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the navigation pane, under &amp;quot;Alarms&amp;quot;, check for one called
+                            &amp;quot;Billing&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on the alert if it exists and select the checkbox in the first column.&lt;/li&gt;
+                            &lt;li&gt;In the preview pane check that the &amp;quot;EstimatedCharges&amp;quot; threshold
+                            is set to the correct value and that the &amp;quot;Actions&amp;quot; is send an alarm to a
+                            valid email address.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.4" name="Create cloudtrail configuration changes alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is changes to
+                        cloudtrail. Since cloudtrail is the actual utility logging API calls it's security is paramount
+                        to ensuring that this continues. Therefore alerting on changes to cloudtrail activity can
+                        prevent a malicious user switching off the logging in order to carry out untracked activities.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&amp;nbsp;&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;aws
+                        logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) ||
+                        ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.5" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName =
+                            DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.4-5.5" name="Create Cloudwatch Log Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  AWS CloudWatch Log groups define groups of log streams that share the same retention, monitoring, and access control settings. Each log stream has to belong to one log group.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a Cloudwatch log group for the Web tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs create-log-group --log-group-name &amp;lt;web_tier_log_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html"/>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs describe-log-groups --query "logGroups[?logGroupName =='&amp;lt;web_tier_log_group&amp;gt;']" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:24:18.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.6" name="Create IAM Policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is management IAM policy changes. IAM manages authorization and authentication controls with AWS and therefore it is vital that unauthorized changes are detected. Enabling monitoring of these changes ensures that these policies remain intact and as desired. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for IAM policy changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=Delete UserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=P utUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=Cr eatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)| |($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUs erPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above:aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt; &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource
+                            = kms.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))} }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.3" name="Create management console login alerts when MFA is not used" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is login on the
+                        console without MFA. Since logging on at the console should be restricted to only those users
+                        with an active MFA this alert will highlight those with password only access. This helps to
+                        capture weaker login procedures (password only) as they occur.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login without MFA: aws logs
+                        put-metric-filter --log-group-name &amp;lt;cloudwatch-logs-group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{
+                        $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot; }'&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != &amp;quot;true&amp;quot;
+                            }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.5" name="Create management console login failure alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is management
+                        console login failures. The management console is the AWS account GUI where administration
+                        activity is performed and is therefore a primary target for brute force attempts. To identify
+                        these attempts alerts for login failures should be enabled as this can highlight suspicious
+                        activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for console login failures: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = ConsoleLogin)
+                        &amp;amp;&amp;amp; ($.errorMessage = &amp;quot;Failed authentication&amp;quot;) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = ConsoleLogin) &amp;amp;&amp;amp; ($.errorMessage = \&amp;quot;Failed
+                            authentication\&amp;quot;) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-2" name="Create network gateways change alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for network gateways changes and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;network_gw_changes_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;network_gw_changes_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;network_gw_changes_alarm&amp;gt;` --metric-name `&amp;lt;network_gw_changes_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.12" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.2" name="Create root account usage alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is usage of the
+                        root account. This account should not be used on a day to day basis due to its full unrestricted
+                        privilege therefore usage should be by exception. Monitoring this usage should capture any
+                        suspicious activity used on the account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                        &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                        &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws logs
+                        describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                        $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy NOT
+                        EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4: aws
+                        cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                        &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                        list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.3" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            $.userIdentity.type = \&amp;quot;Root\&amp;quot; &amp;amp;&amp;amp; $.userIdentity.invokedBy
+                            NOT EXISTS &amp;amp;&amp;amp; $.eventType != \&amp;quot;AwsServiceEvent\&amp;quot; } &amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.8" name="Create s3 bucket policy change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is S3 bucket policy changes. S3 bucket policies are a resource based policy that provide authorizations on S3 buckets. 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Making sure that their integrity remains intact is vital in ensuring the data within the S3 bucket remains secure and authorizations intact. Therefore s3 bucket policy changes should be alerted upon 
+ &lt;br /&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a metric filter that checks for S3 Bucket policy changes:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;value&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS topic for notifications:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns create-topic --name &amp;lt;topic_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.8" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;:&amp;nbsp;
+                            aws logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventSource = s3.amazonaws.com) &amp;amp;&amp;amp; (($.eventName = PutBucketAcl) ||
+                            ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName =
+                            PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName =
+                            DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName =
+                            DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.10" name="Create security group change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried to identify suspicious API activity. One such activity that should be monitored is security group changes. Security groups are analogous to firewalls and therefore protect inbound and outbound access to &amp;amp; from AWS resources such as ec2 instances and RDS databases (amongst other things. Therefore alerting on changes to security groups helps ensure that the resources protected by them are not exposed.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Create a metric filter that checks for security group changes: aws logs put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt; 
+  &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName =
+                            AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName
+                            = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName =
+                            DeleteSecurityGroup)}&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Monitoring-1" name="Create unauthorized API calls alerts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information, but gracefully fail if they don't have permissions.&lt;/p&gt;&lt;p&gt;If an excessive number of alerts are being generated then an organization may wish to consider adding read access to the limited IAM user permissions simply to quiet the alerts.&lt;/p&gt;&lt;p&gt;In some cases doing this may allow the users to actually view some areas of the system - any additional access given should be reviewed for alignment with the original limited IAM user intent.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the following to setup the metric filter, alarm, SNS topic, and subscription:&lt;/p&gt;&lt;p&gt;1. Create a metric filter based on filter pattern provided which checks for unauthorized API calls and the &amp;lt;cloudtrail_log_group_name&amp;gt; taken from audit step 1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs put-metric-filter --log-group-name &amp;lt;cloudtrail_log_group_name&amp;gt; --filter-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --metric-transformations metricName= `&amp;lt;unauthorized_api_calls_metric&amp;gt;` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.sourceIPAddress!="delivery.logs.amazonaws.com") || ($.eventName!="HeadBucket") }'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.&lt;/p&gt;&lt;p&gt;2. Create an SNS topic that the alarm will notify&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns create-topic --name &amp;lt;sns_topic_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the same topic for all monitoring alarms.&lt;/p&gt;&lt;p&gt;3. Create an SNS subscription to the topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns subscribe --topic-arn &amp;lt;sns_topic_arn&amp;gt; --protocol &amp;lt;protocol_for_sns&amp;gt; --notification-endpoint &amp;lt;sns_subscription_endpoints&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: you can execute this command once and then re-use the SNS subscription for all monitoring alarms.&lt;/p&gt;&lt;p&gt;4. Create an alarm that is associated with the CloudWatch Logs Metric Filter created in step 1 and an SNS topic created in step 2&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch put-metric-alarm --alarm-name `&amp;lt;unauthorized_api_calls_alarm&amp;gt;` --metric-name `&amp;lt;unauthorized_api_calls_metric&amp;gt;` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:&lt;/p&gt;&lt;p&gt;1. Identify the log group name configured for use with active multi-region CloudTrail:&lt;/p&gt;&lt;p&gt;List all CloudTrails:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail describe-trails&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify Multi region Cloudtrails: Trails with "IsMultiRegionTrail" set to true&lt;/p&gt;&lt;p&gt;From value associated with CloudWatchLogsLogGroupArn note &amp;lt;cloudtrail_log_group_name&amp;gt;&lt;/p&gt;&lt;p&gt;Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:log-group:NewGroup:*, &amp;lt;cloudtrail_log_group_name&amp;gt; would be NewGroup&lt;/p&gt;&lt;p&gt;Ensure Identified Multi region CloudTrail is active&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-trail-status --name &amp;lt;Name of a Multi-region CloudTrail&amp;gt; ensure IsLogging is set to TRUE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure identified Multi-region Cloudtrail captures all Management Events&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --trail-name &amp;lt;trailname shown in describe-trails&amp;gt; Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Get a list of all associated metric filters for this &amp;lt;cloudtrail_log_group_name&amp;gt;:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws logs describe-metric-filters --log-group-name "&amp;lt;cloudtrail_log_group_name&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure the output from the above command contains the following:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;"Filter = {(($.errorCode="*UnauthorizedOperation") || ($.errorCode="AccessDenied*")) &amp;amp;&amp;amp; (($.sourceIPAddress!="delivery.logs.amazonaws.com") &amp;amp;&amp;amp; ($.eventName!="HeadBucket"))}"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. Note the &amp;lt;unauthorized_api_calls_metric&amp;gt; value associated with the filterPattern found in step 3.&lt;/p&gt;&lt;p&gt;5. Get a list of CloudWatch alarms and filter on the &amp;lt;unauthorized_api_calls_metric&amp;gt; captured in step 4.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== `&amp;lt;unauthorized_api_calls_metric&amp;gt;`]'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;6. Note the AlarmActions value - this will provide the SNS topic ARN value.&lt;/p&gt;&lt;p&gt;7. Ensure there is at least one active subscriber to the SNS topic&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws sns list-subscriptions-by-topic --topic-arn &amp;lt;sns_topic_arn&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;at least one subscription should have "SubscriptionArn" with valid aws ARN.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Example of valid "SubscriptionArn": "arn:aws:sns:&amp;lt;region&amp;gt;:&amp;lt;aws_account_number&amp;gt;:&amp;lt;SnsTopicName&amp;gt;:&amp;lt;SubscriptionID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.329">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.13" name="Create VPC gateway change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC gateway
+                        changes. VPC gateways are used as a means of sending traffic outside of a VPC (ie to the
+                        internet) and are vital in ensuring traffic flows to the correct destination. Therefore alerting
+                        on changes to VPC gateways ensuring traffic continues to flow as expected via the correct
+                        gateway.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC gateway changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateCustomerGateway)
+                        || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) ||
+                        ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName =
+                        DetachInternetGateway) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.14" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following: &amp;quot;filterPattern&amp;quot;: &amp;quot;{
+                            ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) ||
+                            ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) ||
+                            ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.11" name="Create VPC NACL change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC NACL
+                        changes. Network Access Control Lists (NACLS) control inbound and outbound access to &amp;amp;
+                        from AWS subnets and work like packet filters to protect the network. Therefore alerting on
+                        changes to NACLS helps ensure that the subnets protected by them are not exposed.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for NACL changes: aws logs put-metric-filter
+                        --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt; --metric-
+                        transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateNetworkAcl) ||
+                        ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName =
+                        DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName =
+                        ReplaceNetworkAclAssociation) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) ||
+                            ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName =
+                            ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.12" name="Create VPC route table change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is VPC route
+                        table changes. VPC route tables provide a means of routing network traffic between subnets and
+                        via gateways and ensures traffic flows via the correct path. Therefore alerting on changes to
+                        route tables ensuring traffic continues to flow as expected.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Create a metric filter that checks for VPC route table changes: aws logs
+                        put-metric-filter --log-group-name &amp;lt;group&amp;gt; --filter-name &amp;lt;name&amp;gt;
+                        --metric- transformations &amp;lt;value&amp;gt; --filter-pattern '{ ($.eventName = CreateRoute)
+                        || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName =
+                        ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute)
+                        || ($.eventName = DisassociateRouteTable) }'&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps: aws cloudwatch put-metric-alarm --alarm-name
+                        &amp;lt;value&amp;gt; --metric-name &amp;lt;metric_filter_name&amp;gt; --statistic Sum --period
+                        300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt; --alarm-actions &amp;lt;topic_arn&amp;gt;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.13" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&amp;nbsp;&amp;quot;filterPattern&amp;quot;:
+                            &amp;quot;{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName
+                            = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName =
+                            DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:&amp;nbsp;aws
+                            cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.6-5.7" name="Define a retention period for Cloudwatch log group in tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;b&gt;Description&lt;/b&gt;:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Retention period should be used to specify how long log events are kept in CloudWatch Logs. Expired log events get deleted automatically. Just like metric filters, retention settings are also assigned to log groups, and the retention assigned to a log group is applied to their log streams.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Put a retention policy for your Web tier Cloudwatch log group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws logs put-retention-policy --log-group-name &amp;lt;web_tier_log_group&amp;gt; --retention-indays &amp;lt;log_retention_period&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Impact&lt;/b&gt;:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  If the retention period is not configured then logs will be retained indefinitely with increasing cost. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe log groups" url="https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"/>
+            <reference name="Put retention policy" url="https://docs.aws.amazon.com/cli/latest/reference/logs/put-retention-policy.html"/>
+          </references>
+          <standards>
+            <standard ref="5.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.7" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the Amazon unified command line interface:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Search for your Web tier Cloudwatch log group, and check for the presence of "retentionInDays" element:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws logs describe-log-groups --query "logGroups[?logGroupName == 
+   &lt;/div&gt; 
+   &lt;div&gt;
+     '&amp;lt;web_tier_log_group&amp;gt;']" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:28:27.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM2" name="Disable credentials unused after 45 days" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to manage Unused Password (IAM user console access)&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select user whose Console last sign-in is greater than 45 days&lt;/li&gt;&lt;li&gt;Click Security credentials&lt;/li&gt;&lt;li&gt;In section Sign-in credentials, Console password click Manage&lt;/li&gt;&lt;li&gt;Under Console Access select Disable 10.Click Apply&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Perform the following to deactivate Access Keys:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console:&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click on Security Credentials&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have been used and&lt;ol&gt;&lt;li&gt;Click on Make Inactive&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Select any access keys that are over 45 days old and that have not been used and&lt;ol&gt;&lt;li&gt;Click the X to Delete&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine if unused credentials exist:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click on Users&lt;/li&gt;&lt;li&gt;Click the Settings (gear) icon.&lt;/li&gt;&lt;li&gt;Select Console last sign-in, Access key last used, and Access Key Id&lt;/li&gt;&lt;li&gt;Click on Close&lt;/li&gt;&lt;li&gt;Check and ensure that Console last sign-in is less than 45 days ago.&lt;ol&gt;&lt;li&gt;Note - Never means the user has never logged in.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Check and ensure that Access key age is less than 45 days and that Access key last used does not say None&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Download Credential Report:&lt;/p&gt;&lt;p&gt;1. Run the following commands:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam generate-credential-report&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure unused credentials do not exist:&lt;/p&gt;&lt;p&gt;2. For each user having password_enabled set to TRUE , ensure password_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When password_enabled is set to TRUE and password_last_used is set to No_Information , ensure password_last_changed is less than 45 days ago.&lt;/p&gt;&lt;p&gt;3. For each user having an access_key_1_active or access_key_2_active to TRUE , ensure the corresponding access_key_n_last_used_date is less than 45 days ago.&lt;/p&gt;&lt;p&gt;When a user having an access_key_x_active (where x is 1 or 2) to TRUE and corresponding access_key_x_last_used_date is set to N/A', ensure access_key_x_last_rotated` is less than 45 days ago.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.245">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-1.21" name="Do not setup access keys during initial user setup for all IAM users that have a console password" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS console defaults the checkbox for creating access keys to enabled. This results in many access keys being generated unnecessarily. In addition to unnecessary credentials, it also generates unnecessary management work in auditing and rotating these keys. 
+&lt;br /&gt; 
+&lt;br /&gt; 
+&lt;b&gt;Remediation: &lt;/b&gt; 
+&lt;br /&gt;Perform the following to delete access keys that do not pass the audit. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Login to the AWS Management Console.Click Services.&lt;/li&gt; 
+ &lt;li&gt;Click IAM&lt;/li&gt; 
+ &lt;li&gt;Click on Users.Click on Security Credentials.&lt;/li&gt; 
+ &lt;li&gt;As an Administrator.&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;br /&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; As an IAM User&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click on Delete for keys that were created at the same time as the user profile but have not been used.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Via CLI:&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;aws iam delete-access-key&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ol&gt; 
+&lt;span style="font-weight: bold;"&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform the following to determine if access keys are rotated as prescribed: 
+            &lt;br /&gt; 
+            &lt;ol&gt; 
+             &lt;li&gt;Login to the AWS Management Console&lt;/li&gt; 
+             &lt;li&gt;Click Services&lt;/li&gt; 
+             &lt;li&gt;Click IAM&lt;/li&gt; 
+             &lt;li&gt;Click on a User&lt;/li&gt; 
+             &lt;li&gt;Compare the user creation date to the key 1 creation date.&lt;/li&gt; 
+             &lt;li&gt;For any that match, the key was created during initial user setup.&lt;/li&gt; 
+            &lt;/ol&gt;Keys that were created at the same time as the user profile and do not have a last used date should be deleted. 
+            &lt;br /&gt; 
+            &lt;br /&gt;Via the CLI: 
+            &lt;br /&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization:&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam generate-credential-report 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;br /&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;The output of this command will produce a table similar to the following:&amp;nbsp;&lt;/li&gt; 
+            &lt;/ul&gt; 
+            &lt;blockquote&gt; 
+             &lt;blockquote&gt;
+               user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_ 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               key_2_active,access_key_2_last_used_date 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               elise,false,true,2015-04-16T15:14:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               brandon,true,true,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               rakesh,false,false,N/A,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               helene,false,true,2015-11-18T17:47:00+00:00,false,N/A 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 
+             &lt;/blockquote&gt; 
+             &lt;blockquote&gt;
+               anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A 
+             &lt;/blockquote&gt; 
+            &lt;/blockquote&gt; 
+            &lt;ul&gt; 
+             &lt;li&gt;For any user having access_key_last_used_date set to N/A , ensure that access key is deleted&lt;/li&gt; 
+            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.039">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.058">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.2" name="Enable CloudTrail log file validation" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Enabling log file validation will provide additional integrity checking of CloudTrail as it
+                        creates a digest for each log file it writes to S3. These digests can then be used to determine
+                        if a log has been modified since being written
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail update-trail --name &amp;lt;trail_name&amp;gt; --enable-log-file-validation
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails&amp;nbsp;
+                            &lt;/blockquote&gt;Ensure LogFileValidationEnabled = true (for each trail)
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM6" name="Enable IAM Access Analyzer for all regions" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable IAM Access analyzer for IAM policies about all resources in each region.&lt;/p&gt;&lt;p&gt;IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM Access Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS(Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple Queue Service) queues.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to enable IAM Access analyzer for IAM policies:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;Choose Access analyzer.&lt;/li&gt;&lt;li&gt;Choose Create analyzer.&lt;/li&gt;&lt;li&gt;On the Create analyzer page, confirm that the Region displayed is the Region where you want to enable Access Analyzer.&lt;/li&gt;&lt;li&gt;Enter a name for the analyzer. Optional as it will generate a name for you automatically.&lt;/li&gt;&lt;li&gt;Add any tags that you want to apply to the analyzer. Optional.&lt;/li&gt;&lt;li&gt;Choose Create Analyzer.&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer create-analyzer --analyzer-name &amp;lt;NAME&amp;gt; --type &amp;lt;ACCOUNT|ORGANIZATION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat this command above for each active region. Note: The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.20" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the IAM console at https://console.aws.amazon.com/iam/&lt;/li&gt;&lt;li&gt;Choose Access analyzer&lt;/li&gt;&lt;li&gt;Click 'Analyzers'&lt;/li&gt;&lt;li&gt;Ensure that at least one analyzer is present&lt;/li&gt;&lt;li&gt;Ensure that the STATUS is set to Active&lt;/li&gt;&lt;li&gt;Repeat these step for each active region&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run the following command:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws accessanalyzer list-analyzers | grep status&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that at least one Analyzer the status is set to ACTIVE&lt;/p&gt;&lt;p&gt;3. Repeat the steps above for each active region.&lt;/p&gt;&lt;p&gt;If an Access analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.6" name="Enable S3 Bucket logging" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>S3 Bucket Access Logging generates log files that contain access records for each request made
+                        to an S3 bucket. By enabling this it is possible to capture events relating to the objects
+                        within that bucket thus helping to capture potential security issues or identifying threats. It
+                        is recommended to enable S3 bucket logging on any S3 bucket that contains sensitive data and
+                        stored the logs in a separate bucket for security analysis.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                        &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&lt;/li&gt;
+                        &lt;li&gt;Click on Properties in the top right of the console.&lt;/li&gt;
+                        &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                        &lt;li&gt;Click on the &amp;quot;Enabled&amp;quot; checkbox.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Bucket&amp;quot; to store the logs.&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Target Prefix&amp;quot; for the logs.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update access).&lt;/li&gt;
+                            &lt;li&gt;Select S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Under All Buckets click on the S3 bucket you wish to enable logging.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on Properties in the top right of the console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under Bucket:&amp;lt;bucket_name&amp;gt; click on Logging.&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;Enabled&amp;quot; is checked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.5" name="Encrypt CloudTrail logs using KMS" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon
+                        server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security
+                        layer that is directly manageable, you can instead use server-side encryption with AWS
+                        KMS-managed
+                        keys (SSE-KMS) for your CloudTrail log files. This provides several advantages:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;You can create and manage the CMK encryption keys yourself.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can use a single CMK to encrypt and decrypt log files for multiple accounts across
+                        all regions.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You have control over who can use your key for encrypting and decrypting CloudTrail
+                        log files.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;You can assign permissions for the key to the users in your organization according to
+                        your requirements.&lt;/li&gt;
+                        &lt;li&gt;You have enhanced security. With this feature, in order to read log files, you now
+                        need to meet two conditions:&amp;nbsp;&lt;/li&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;you must have S3 read permission on the bucket, and&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;you must be granted decrypt permission by the CMK policy.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ul&gt;Because S3 automatically decrypts the log files for requests from users authorized to
+                        use the CMK, SSE-KMS encryption for CloudTrail log files is backward compatible with existing
+                        applications that read CloudTrail log data.&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select CloudTrail from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on a Trail.&lt;/li&gt;
+                        &lt;li&gt;Under the S3 section click on the edit button.&lt;/li&gt;
+                        &lt;li&gt;Click Advanced.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Encrypt Log Files&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Set &amp;quot;Create a new KMS key&amp;quot; to &amp;quot;Yes&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;In &amp;quot;KMS key&amp;quot; type a name for your key.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt; 
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail describe-trails
+                            &lt;/blockquote&gt;Check that KMS is enabled if the &amp;quot;KmsKeyId&amp;quot; property is
+                            set.
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.9" name="Enforce employee lifecycle policies" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Regular reviews of accounts on the system should be conducted to ensure that stale accounts
+                        cannot be abused either by those former employees using them or compromised by attackers.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;&amp;nbsp;
+                        &lt;br /&gt;At least every 90 days complete the following:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                        &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;
+                        &lt;li&gt;Click on Users.&lt;/li&gt;
+                        &lt;li&gt;For any user that should no longer exist:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;select the user,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;User Actions&amp;quot;,&lt;/li&gt;
+                        &lt;li&gt;click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Obtain a list of IAM users by: aws iam list-users --query 'Users[*].UserName'
+                            --output text&lt;/li&gt;
+                            &lt;li&gt;Ensure all users are valid users.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM4" name="Ensure IAM policies that allow full &quot;*:*&quot; administrative privileges are not attached" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant least privilege -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform only those tasks, instead of allowing full administrative privileges.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.&lt;/p&gt;&lt;p&gt;Providing full administrative privileges instead of restricting to the minimum set of permissions that the user is required to do exposes the resources to potentially unwanted actions.&lt;/p&gt;&lt;p&gt;IAM policies that have a statement with "Effect": "Allow" with "Action": "*" over "Resource": "*" should be removed.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the navigation pane, click Policies and then search for the policy name found in the audit step.&lt;/li&gt;&lt;li&gt;Select the policy that needs to be deleted.&lt;/li&gt;&lt;li&gt;In the policy action menu, select first Detach&lt;/li&gt;&lt;li&gt;Select all Users, Groups, Roles that have this policy attached&lt;/li&gt;&lt;li&gt;Click Detach Policy&lt;/li&gt;&lt;li&gt;In the policy action menu, select Detach&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to detach the policy that has full administrative privileges as found in the audit step:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Lists all IAM users, groups, and roles that the specified managed policy is attached to. aws iam list-entities-for-policy --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Users: aws iam detach-user-policy --user-name &amp;lt;iam_user&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Groups: aws iam detach-group-policy --group-name &amp;lt;iam_group&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;li&gt;Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name &amp;lt;iam_role&amp;gt; --policy-arn &amp;lt;policy_arn&amp;gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following to determine what policies are created: From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Run the following to get a list of IAM policies: aws iam list-policies --only-attached --output text&lt;/li&gt;&lt;li&gt;For each policy returned, run the following command to determine if any policies is allowing full administrative privileges on the account: aws iam get-policy-version --policy-arn &amp;lt;policy_arn&amp;gt; --version-id &amp;lt;version&amp;gt;&lt;/li&gt;&lt;li&gt;In output ensure policy should not have any Statement block with "Effect": "Allow" and Action set to "*" and Resource set to "*"&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.271">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-Network-1" name="Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port 22 and RDP to port 3389.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL to remediate, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Click Edit inbound rules&lt;/li&gt;&lt;li&gt;Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click Delete to remove the offending inbound rule&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Perform the following to determine if the account is configured as prescribed:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home&lt;/li&gt;&lt;li&gt;In the left pane, click Network ACLs&lt;/li&gt;&lt;li&gt;For each network ACL, perform the following:&lt;ol&gt;&lt;li&gt;Select the network ACL&lt;/li&gt;&lt;li&gt;Click the Inbound Rules tab&lt;/li&gt;&lt;li&gt;Ensure no rule exists that has a port range that includes port 22, 3389, or other remote server administration ports for your environment and has a Source of 0.0.0.0/0 and shows ALLOW&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Note: A Port value of ALL or a port range such as 0-1024 are inclusive of port 22, 3389, and other remote server administration ports&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.373">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM3" name="Ensure there is only one active access key available for any single IAM user" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. One of the best ways to protect your account is to not allow users to have multiple access keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;In Access Keys section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/li&gt;&lt;li&gt;In the same Access Keys section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the Make Inactive link.&lt;/li&gt;&lt;li&gt;If you receive the Change Key Status confirmation box, click Deactivate to switch off the selected key.&lt;/li&gt;&lt;li&gt;Repeat steps no. 3 - 7 for each IAM user in your AWS account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Using the IAM user and access key information provided in the Audit CLI, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working.&lt;/p&gt;&lt;p&gt;2. Run the update-access-key command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user&lt;/p&gt;&lt;p&gt;Note - the command does not return any output:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam update-access-key --access-key-id &amp;lt;access-key-id&amp;gt; --status Inactive --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. To confirm that the selected access key pair has been successfully deactivated run the list-access-keys audit command again for that IAM User:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) Status is set to Inactive, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation.&lt;/p&gt;&lt;p&gt;4. Repeat steps no. 1 - 3 for each IAM user in your AWS account.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Sign in to the AWS Management Console and navigate to IAM dashboard at https://console.aws.amazon.com/iam/.&lt;/li&gt;&lt;li&gt;In the left navigation panel, choose Users.&lt;/li&gt;&lt;li&gt;Click on the IAM user name that you want to examine.&lt;/li&gt;&lt;li&gt;On the IAM user configuration page, select Security Credentials tab.&lt;/li&gt;&lt;li&gt;Under Access Keys section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated then the users access configuration does not adhere to security best practices and the risk of accidental exposures increases.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Repeat steps no. 3 - 5 for each IAM user in your AWS account.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-users command to list all IAM users within your account:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-users --query "Users[*].UserName"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all your IAM user names.&lt;/p&gt;&lt;p&gt;2. Run list-access-keys command using the IAM user name list to return the current status of each access key associated with the selected IAM user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-access-keys --user-name &amp;lt;user-name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should expose the metadata ("Username", "AccessKeyId", "Status", "CreateDate") for each access key on that user account.&lt;/p&gt;&lt;p&gt;3. Check the Status property value for each key returned to determine each keys current state. If the Status property value for more than one IAM access key is set to Active, the user access configuration does not adhere to this recommendation, refer to the remediation below.&lt;/p&gt;&lt;p&gt;Repeat steps no. 2 and 3 for each IAM user in your AWS account.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.8" name="Export EC2 OS logs to cloudwatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudwatch logs is an AWS service that allows you to send logs from an EC2 instance to
+                        cloudwatch via an agent installed locally on the machine. The logs are then stored centrally
+                        within cloudwatch logs and metric alerts can be configured so that security incidents can be
+                        reported to the security team. It is recommended to enable cloudwatch log monitoring on all EC2
+                        servers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;br /&gt;&lt;/b&gt;Follow the directions provided in &amp;quot;http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html&amp;quot;
+                        to install and enable Cloudwatch Logs on a new EC2 instance.
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select Cloudwatch from the services menu.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Logs&amp;quot;.&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click on your log group.&lt;/li&gt;
+                            &lt;li&gt;Click on your log stream.&lt;/li&gt;
+                            &lt;li&gt;Ensure event data is being captured as per the logs on your machine.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.8-5.9" name="Install an agent for AWS Cloudwatch Logs within AutoScaling Group for tier" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can use CloudWatch Logs to monitor, store and access log files from an Amazon EC2 instance (application or system data). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  With CloudWatch Logs, you can monitor your logs, in near real-time, for specific phrases, values or patterns (metrics). For example, you could set an alarm on the number of errors that occur in your system logs or view graphs of web request latency from your application logs. Log data can be stored and accessed for as long as you need using highly durable, lowcost storage so you don't have to worry about filling up hard drives. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A Cloudwatch agent needs to run within the Guest Operating System of each EC2 instance you wish to ship logs from. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can also use any third party log management tools (like Splunk, Loggly, AlertLogic Log Manager, etc.) as long as the recommendation goal is achieved.&lt;/li&gt; 
+  &lt;li&gt;The below Audit and Remediation steps need to be modified for your specific log management tool, as they are provided in the benchmark only for Amazon Cloudwatch&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   *Note: references to Web tier are also applicable to App tier. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a sample agent configuration file for Amazon Linux and save it as a text file (for example, awslogs.cfg) either on the AMI's filesystem, in a publicly accessible http/https location, or an Amazon S3 location (for example, s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt;):&lt;/li&gt; 
+ &lt;/ul&gt; 
+  [general] 
+  state_file = /var/awslogs/state/agent-state 
+  [/var/log/messages] 
+  file = /var/log/messages 
+  log_group_name = /var/log/messages 
+  log_stream_name = {instance_id} 
+  datetime_format = %b %d %H:%M:%S 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new Web tier Autoscaling Launch Configuration with UserData populated for installing Cloudwatch Logs agent:&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create and save locally a file containing the UserData, for example /tmp/UserData.txt:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     #!/bin/bashcurl https://s3.amazonaws.com/awscloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agentsetup.py./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Note: You can install the CloudWatch Logs agent by specifying the us-east-1, uswest-1, us-west-2, eu-west-1, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, or sa-east-1 regions.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt;
+     aws autoscaling create-launch-configuration --launch-configurationname &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt; --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt; -- user-data file:///tmp/UserData.txt 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+            <reference name="EC2 New Instance CWL" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/EC2NewInstanceCWL.html"/>
+          </references>
+          <standards>
+            <standard ref="5.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Cloudwatch Logs agent is installed through UserData in the Web tier Autoscaling Launch Configuration:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --launch-configuration-names &amp;lt;web_tier_launch_config&amp;gt;--query "LaunchConfigurations[*].UserData" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Output should be similar with:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    #!/bin/bash 
+  &lt;/div&gt; 
+  &lt;div&gt;
+    curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -Ochmod +x ./awslogs-agent-setup.py ./awslogs-agent-setup.py -n -r us-east-1 -c s3://&amp;lt;s3_bucket_name&amp;gt;/&amp;lt;cloudwatch_agent_config_file&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-03-17T16:37:37.654">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.4" name="Integrate the CloudTrail logs into CloudWatch logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>One way to work with cloudtrail logs is to send them to cloudwatch logs which allows you to
+                        define metric filters for alerting and monitoring. This allows you to take immediate action if a
+                        certain threshold has been met. Enabling this provides the opportunity to monitor for sensitive
+                        account activity.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with cloudtrail update permission).&lt;/li&gt;
+                        &lt;li&gt;Select Cloudtrail from the services list.&lt;/li&gt;
+                        &lt;li&gt;Under All Buckets select the target bucket you want to check.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Properties&amp;quot; then &amp;quot;Trails&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on each trail where no CloudWatch Logs are defined.&lt;/li&gt;
+                        &lt;li&gt;Go to the &amp;quot;CloudWatch Logs&amp;quot; section and click on &amp;quot;Configure&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Define a new or select an existing log group and click &amp;quot;Continue&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Configure the IAM Role which will deliver CloudTrail events to CloudWatch Logs.&lt;/li&gt;
+                        &lt;li&gt;Create/Select an IAM Role and Policy Name.&lt;/li&gt;
+                        &lt;li&gt;Click Allow.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws cloudtrail get-trail-status --name &amp;lt;trail_name&amp;gt;
+                            &lt;/blockquote&gt;Ensure the &amp;quot;LatestcloudwatchLogdDeliveryTime&amp;quot; property
+                            is set to a recent time (ie within the latest day or so).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.1" name="Launch EC2 instances into a VPC" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACLs) and routing. However, the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is recommended to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure. &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Launch Instance".&lt;/li&gt;&lt;li&gt;Complete the wizard until step 3. At this point, ensure a VPC ID is selected for the "Network" option, choose an appropriate "Subnet" and "Auto-assign Public IP" option.&lt;/li&gt;&lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;NB: If you want to migrate an already running instance you will need to convert the image into an AMI and then launch a new instance using the AMI and placing in a VPC, as per the steps above&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Log in to the AWS Management Console.&lt;/li&gt;&lt;li&gt;Select EC2 from the services menu.&lt;/li&gt;&lt;li&gt;Select "Instances" from the left hand menu.&lt;/li&gt;&lt;li&gt;For each instance in the list:&lt;ul&gt;&lt;li&gt;select the instance&lt;/li&gt;&lt;li&gt;in the preview pane confirm the instance has a "VPC ID". If a hyphen "-" is shown then your instance is running in EC2-Classic mode.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM7" name="Manage IAM users centrally via identity federation or AWS Organizations for multi-account environments" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;The remediation procedure will vary based on the individual organization's implementation of identity federation and/or AWS Organizations with the acceptance criteria that no non-service IAM users, and non-root accounts, are present outside the account providing centralized IAM user management.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.21" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For multi-account AWS environments with an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine the master account for identity federation or IAM user management&lt;/li&gt;&lt;li&gt;Login to that account through the AWS Management Console&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Identity providers&lt;/li&gt;&lt;li&gt;Verify the configuration&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Then..., determine all accounts that should not have local users present. For each account...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For multi-account AWS environments implementing AWS Organizations without an external identity provider...&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Determine all accounts that should not have local users present&lt;/li&gt;&lt;li&gt;Log into the AWS Management Console&lt;/li&gt;&lt;li&gt;Switch role into each identified account&lt;/li&gt;&lt;li&gt;Click Services&lt;/li&gt;&lt;li&gt;Click IAM&lt;/li&gt;&lt;li&gt;Click Users&lt;/li&gt;&lt;li&gt;Confirm that no IAM users representing individuals are present&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Gov-1.2" name="Register a Security contact for your AWS account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS will occasionally send security advisories and alerts to the account holder. By default this will go to the email address that the account is registered under. However if a security contact is specified these alerts will be sent here instead. Therefore this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt; 
+  &lt;li&gt;Click account name on the top right of the management console.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt; 
+  &lt;li&gt;Click on Edit.&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Security&amp;quot; section complete the requested contact information.&lt;/li&gt; 
+  &lt;li&gt;Click update when complete.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Account as root.&lt;/li&gt;
+                            &lt;li&gt;Click account name on the top right of the management console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;My Account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Scroll down to &amp;quot;Alternate Contacts&amp;quot; section.&lt;/li&gt;
+                            &lt;li&gt;Confirm whether a contact has been set for &amp;quot;Security&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-IAM5" name="Remove expired SSL/TLS certificates stored in AWS IAM" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To delete Expired Certificate run following command by replacing &amp;lt;CERTIFICATE_NAME&amp;gt; with the name of the certificate to delete:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam delete-server-certificate --server-certificate-name &amp;lt;CERTIFICATE_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;When the preceding command is successful, it does not return any output.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.19" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Getting the certificates expiration information via AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM via the AWS API use the Command Line Interface (CLI).&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Run list-server-certificates command to list all the IAM-stored server certificates:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws iam list-server-certificates&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc):&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ "ServerCertificateMetadataList": [ { "ServerCertificateId": "EHDGFRW7EJFYTE88D", "ServerCertificateName": "MyServerCertificate", "Expiration": "2018-07-10T23:59:59Z", "Path": "/", "Arn": "arn:aws:iam::012345678910:server-certificate/MySSLCertificate", "UploadDate": "2018-06-10T11:56:08Z" } ] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Verify the ServerCertificateName and Expiration parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;{ { "ServerCertificateMetadataList": [] }&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This means that there are no expired certificates, It DOES NOT mean that no certificates exist.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-08-05T06:56:59.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.071">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-AWS" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails are not properly protected, an attacker could gain access to the system,
+                                modify the status of the resources or exfiltrate sensitive data without being noticed.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.2" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.3" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.4" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.5" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-ACCESS-ROOT-01">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Gov-1.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Gov-1.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                    <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-IAM1" mitigation="10"/>
+                <countermeasure ref="AWS-IAM2" mitigation="10"/>
+                <countermeasure ref="AWS-IAM3" mitigation="10"/>
+                <countermeasure ref="AWS-IAM4" mitigation="10"/>
+                <countermeasure ref="AWS-IAM5" mitigation="10"/>
+                <countermeasure ref="AWS-IAM6" mitigation="10"/>
+                <countermeasure ref="AWS-IAM7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.9" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-1.21">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                    <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                    <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.20" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-1.21" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.11" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="8"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.8" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.1-2.2" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.3-2.4" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.5-2.6" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.7" mitigation="8"/>
+                <countermeasure ref="aws-tier-2.8" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AWS RESOURCE LOGGING" name="AWS Resource Logging" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                    <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Logging-3.9">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.6" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.8" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.6" mitigation="16"/>
+                <countermeasure ref="aws-tier-4.7" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="CLOUDWATCH METRIC ALERTS" name="Cloudwatch Metric Alerts" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED_ACCESS_SYSTEMS_AWS" name="Attackers access to the systems without being detected" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain access to the systems and they are not detected and the changes of the
+                                attackers could not be detected and audited.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                    <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.5">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="cloudwatch-misconfig">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                    <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.2" mitigation="12"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.3" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.4" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.5" mitigation="11"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="11"/>
+                <countermeasure ref="aws-tier-4.8" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.4-5.5" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.6-5.7" mitigation="11"/>
+                <countermeasure ref="aws-tier-5.8-5.9" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.10">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Monitoring-4.4">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.10" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.6" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK-AWS" name="Sensitive data is compromised through undetected network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers gain undetected access to the network systems and the changes of the attackers
+                                could not be audited or detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Monitoring-4.12">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                    <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Monitoring-1" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-2" mitigation="16"/>
+                <countermeasure ref="AWS-Monitoring-3" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.11" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.12" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.13" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="VIRTUAL PRIVATE CLOUD (VPC) NETWORK" name="Virtual Private Cloud (VPC) Network" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                    <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-Network-1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.1" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="20"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                <countermeasure ref="aws-tier-5.12" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="53209bc4-bd2a-432a-913b-53da5d5022e1" diagramComponentId="08ae241f-04eb-4dd6-b61a-f0c560092b87" ref="5fabbae7-9089-4bc6-beb9-9a432631c9d2" name="User" desc="" library="unece-wp-29-csms" parentComponentRef="" componentDefinitionRef="end-user">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CSMS-4.3.4-15.2" name="Defined security procedures are not followed" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; &lt;b&gt;Defined security procedures&lt;/b&gt; are not followed&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.617">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.4-15.1" name="Social engineering" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; Innocent victim (e.g. owner, operator or maintenance engineer) being &lt;b&gt;tricked into taking an action&lt;/b&gt; to&lt;b&gt; &lt;/b&gt;unintentionally load malware or enable an attack&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.617">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSMS-M19" name="Define security procedures" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Organizations shall ensure security procedures are defined and followed including logging of actions and access related to the management of the security functions&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53 PS-1 Personnel Security Policy and Procedures" url="https://nvd.nist.gov/800-53/Rev4/control/PS-1"/>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M19" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M18" name="Define user roles and access privileges" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Measures shall be implemented for defining and controlling user roles and access privileges, based on the principle of least access privilege&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Role Definitions" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/01-Test_Role_Definitions"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M18" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-04-13T12:05:25.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
+          <threats>
+            <threat ref="CSMS-4.3.4-15" name="Unintended human actions carried out from outside of vehicles" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="unece-wp-29-csms" editable="true">
+              <desc>This threat include: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Legitimate actors are able to take actions that would unwittingly facilitate a cyber-attack&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSMS-4.3.4-15.1">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M18" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CSMS-4.3.4-15.2">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M19" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSMS-M18" mitigation="50"/>
+                <countermeasure ref="CSMS-M19" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="01389eec-4ec1-4d9e-bde9-f91bf903a3ab" diagramComponentId="dfb2631f-d959-4a19-ace4-62fb552b6773" ref="bb23eb31-51d2-42fd-9350-d4db18531e34" name="VPC - Customer Instance" desc="" library="Hydras-AWS-Foundation" parentComponentRef="88ead499-6db6-4ecb-96d9-363b587ed0d5" componentDefinitionRef="vpc">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.110">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.115">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.119">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.129">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:25.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.8" name="The access to the routing tables are not restricted" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Being highly selective in peering routing tables is a very effective way of minimizing the
+                        impact of breach as resources outside of these routes are inaccessible to the peered VPC.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards>
+            <standard ref="1.22" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC2" name="Connect to VPC using an AWS Site-to-Site VPN connection" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Connect to VPC using an AWS Site-to-Site VPN connection&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your Site-to-Site VPN resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS VPC - VPN connections" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html"/>
+            <reference name="What is AWS Site-to-Site VPN?" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  After you create the AWS Site-to-Site VPN connection and configure the customer gateway, you can launch an instance and test the connection by pinging the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before you begin, make sure of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use an AMI that responds to ping requests. AWS recommends that you use one of the Amazon Linux AMIs.&lt;/li&gt; 
+  &lt;li&gt;Configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.&lt;/li&gt; 
+  &lt;li&gt;If you are using instances running Windows Server, connect to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.&lt;/li&gt; 
+  &lt;li&gt;(Static routing) Ensure that the customer gateway device has a static route to your VPC, and that your VPN connection has a VPN connection has a static route so that traffic can get back to your customer gateway device.&lt;/li&gt; 
+  &lt;li&gt;(Dynamic routing) Ensure that the BGP status on your customer gateway device is established. It takes approximately 30 seconds for a BGP peering session to be established. Ensure that routes are advertised with BGP correctly and showing in the subnet route table, so that traffic can get back to your customer gateway. Make sure that both tunnels are configured with BGP routing.&lt;/li&gt; 
+  &lt;li&gt;Ensure that you have configured routing in your subnet route tables for the VPN connection.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test end-to-end connectivity 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon EC2 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On the dashboard, choose Launch Instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Choose an Amazon Machine Image (AMI) page, choose an AMI, and then choose Select. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Choose an instance type, and then choose Next: Configure Instance Details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. On the Configure Instance Details page, for Network, select your VPC. For Subnet, select your subnet. Choose Next until you reach the Configure Security Group page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select the Select an existing security group option, and then select the group that you configured earlier. Choose Review and Launch. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Review the settings that you've chosen. Make any changes that you need, and then choose Launch to select a key pair and launch the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  9. From a computer in your network that is behind the customer gateway device, use the ping command with the instance's private IP address. A successful response is similar to the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ping 10.0.0.4 
+&lt;/div&gt; 
+&lt;div&gt;
+  Pinging 10.0.0.4 with 32 bytes of data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt;
+  Reply from 10.0.0.4: bytes=32 time&amp;lt;1ms TTL=128 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ping statistics for 10.0.0.4: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Approximate round trip times in milliseconds: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Minimum = 0ms, Maximum = 0ms, Average = 0ms 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test tunnel failover, you can temporarily disable one of the tunnels on your customer gateway device, and repeat the above step. You cannot disable a tunnel on the AWS side of the VPN connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use SSH or RDP to connect to your instances in the VPC. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:31:55.971">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing the Site-to-Site VPN connection" url="https://docs.aws.amazon.com/vpn/latest/s2svpn/HowToTestEndToEnd_Linux.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC1" name="Control access to VPC resources with IAM identities and policies" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control access to VPC resources with IAM identities and policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon VPC resources. IAM is an AWS service that you can use with no additional charge. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Control access to VPC resources by using: 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Identities: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authentication is how you sign in to AWS using your identity credentials. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You must be authenticated (signed in to AWS) as the AWS account root user, an IAM user, or by assuming an IAM role. You can also use your company's single sign-on authentication, or even sign in using Google or Facebook. In these cases, your administrator previously set up identity federation using IAM roles. When you access AWS using credentials from another company, you are assuming a role indirectly. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Identity-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Resource-based policies: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. Service administrators can use these policies to define what actions a specified principal (account member, user, or role) can perform on that resource and under what conditions. Resource-based policies are inline policies. There are no managed resource-based policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Access control lists (ACLs): 
+&lt;/div&gt; 
+&lt;div&gt;
+  Access control lists (ACLs) are a type of policy that controls which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Identity and access management for Amazon VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/security-iam.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.899">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.888">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC8" name="Create CloudWatch alarms to monitor a NAT gateway" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Creating CloudWatch alarms to monitor a NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor your NAT gateway using CloudWatch, which collects information from your NAT gateway and creates readable, near real-time metrics. You can use this information to monitor and troubleshoot your NAT gateway. NAT gateway metric data is provided at 1-minute intervals, and statistics are recorded for a period of 15 months. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It sends a notification to an Amazon SNS topic based on the value of the metric relative to a given threshold over a number of time periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, you can create an alarm that monitors the amount of traffic coming in or leaving the NAT gateway. The following alarm monitors the amount of outbound traffic from clients in your VPC through the NAT gateway to the internet. It sends a notification when the number of bytes reaches a threshold of 5,000,000 during a 15-minute period. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm for outbound traffic through the NAT gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the BytesOutToDestination metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt;= and enter 5000000. Enter 1 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 15 minutes and specify a statistic of Sum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create an alarm that monitors the ErrorPortAllocation metric and sends a notification when the value is greater than zero (0) for three consecutive 5-minute periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To create an alarm to monitor port allocation errors 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the CloudWatch console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Alarms, Create Alarm. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose NAT Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the NAT gateway and the ErrorPortAllocation metric and choose Next. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure the alarm as follows, and choose Create Alarm when you are done: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose &amp;gt; and enter 0. Enter 3 for the consecutive periods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Actions, select an existing notification list or choose New list to create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Alarm Preview, select a period of 5 minutes and specify a statistic of Maximum. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring NAT gateways using Amazon CloudWatch" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can test an alarm by setting it to any state using the SetAlarmState API action or the set-alarm-state command in the AWS CLI. This temporary state change lasts only until the next alarm comparison occurs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:58:07.550">
+              <output/>
+            </source>
+            <references>
+              <reference name="Using Amazon CloudWatch Alarms" url="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC3" name="Create Route 53 alias records for VPC endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for VPC endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An Amazon Virtual Private Cloud (Amazon VPC) interface endpoint lets you use AWS PrivateLink to access selected services. These services include some AWS services, services that are hosted by other AWS customers and partners in their own VPCs, and supported AWS Marketplace partner services. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route domain traffic to an interface endpoint, use Amazon Route 53 to create an alias record. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To route traffic to an Amazon VPC interface endpoint 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the Route 53 hosted zone and the Amazon VPC interface endpoint using the same account, skip to step 2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you created the hosted zone and the interface endpoint using different accounts, get the service name for the interface endpoint: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console and open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the right pane, choose the endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the bottom pane, get the value of DNS name, for example, vpce-0fd00dd593example-dexample.cloudtrail.us-west-2.vpce.amazonaws.com. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the Route 53 console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the navigation pane, choose Hosted Zones. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the name of the hosted zone that has the domain name that you want to use to route traffic to your interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create Record Set. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specify the following values: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the domain name that you want to use to route traffic to your Amazon VPC interface endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose A - IPv4 address. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Yes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alias Target 
+&lt;/div&gt; 
+&lt;div&gt;
+  How you specify the value for Alias Target depends on whether you created the hosted zone and the interface endpoint using the same AWS account or different accounts: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Same account - Choose the list, and find the category Amazon VPC Endpoints. Then choose the DNS name of the interface endpoint that you want to route internet traffic to. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Different accounts - Enter the value that you got in step 1 of this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Routing Policy 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the applicable routing policy. For more information, see Choosing a routing policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Evaluate Target Health 
+&lt;/div&gt; 
+&lt;div&gt;
+  Accept the default value of No. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your interface endpoint by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:39:59.223">
+              <output/>
+            </source>
+            <references>
+              <reference name="Routing traffic to an Amazon Virtual Private Cloud interface endpoint by using your domain name" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC7" name="Do not put sensitive data into VPC free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with Amazon VPC or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into Amazon VPC or other services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon Virtual Private Cloud" url="https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:54:35.989">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.946">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.6" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.7" name="Enable VPC flow logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>VPC Flow logs enable the capture of IP traffic that traverses the network interfaces within a
+                        VPC. These logs are captured and sent to cloudtrail logs enabling you to detect security
+                        incidents that may be occurring across the network.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                        &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                        &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Select a VPC.&lt;/li&gt;
+                        &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Create Flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose a role (note this must be pre-created. Follow the link provided in the text
+                        underneath &amp;quot;Role&amp;quot; for help).&lt;/li&gt;
+                        &lt;li&gt;Select a &amp;quot;Destination Log Group&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Create flow Log&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign into the management console.&lt;/li&gt;
+                            &lt;li&gt;Select VPC from the services menu.&lt;/li&gt;
+                            &lt;li&gt;In the left pane click &amp;quot;Your VPCs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select a VPC.&lt;/li&gt;
+                            &lt;li&gt;Select the Flow Logs tab from the preview panel.&lt;/li&gt;
+                            &lt;li&gt;Ensure a Log Flow exists that has Active in the Status column.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC9" name="Enable VPC Traffic Mirroring" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable VPC Traffic Mirroring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content inspection 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Threat monitoring 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Troubleshooting 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can create, access, and manage your traffic mirror resources using any of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Management Console- Provides a web interface that you can use to access your traffic mirror resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Command Line Interface (AWS CLI) - Provides commands for a broad set of AWS services, including Amazon VPC. The AWS CLI is supported on Windows, macOS, and Linux. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs - Provide language-specific APIs. The AWS SDKs take care of many of the connection details, such as calculating signatures, handling request retries, and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Query API- Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC. However, it requires that your application handle low-level details such as generating the hash to sign the request and handling errors. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is Traffic Mirroring?" url="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  You can review your traffic mirror targets, filters and sessions from Amazon VPC console:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the Region selector, choose the AWS Region that you used when you created the VPCs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the navigation pane, choose Traffic Mirroring, Mirror Targets/Mirror Filters/Mirror Sessions. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T13:00:52.965">
+              <output/>
+            </source>
+            <references>
+              <reference name="Getting started with Traffic Mirroring" url="https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-getting-started.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-CLOUDTRAIL2" name="Log to a dedicated and centralized Amazon S3 bucket" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Log to a dedicated and centralized Amazon S3 bucket&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The following are some steps you can take:&lt;/p&gt; 
+&lt;p&gt;- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.&lt;/p&gt; 
+&lt;p&gt;- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.&lt;/p&gt; 
+&lt;p&gt;- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.&lt;/p&gt; 
+&lt;p&gt;- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Best Practices in AWS CloudTrail" url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html"/>
+            <reference name="Security OU - Log Archive account" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using a dedicated and centralized Amazon S3 bucket for CloudTrail log files.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:05:12.909">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.8" name="Reduce routing tables entries for VPC peering" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+  Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+  Remove and add route table entries to ensure that the least number of subnets or hosts as is required to accomplish the purpose for peering are routable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Via CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;For each &amp;lt;route_table_id&amp;gt; containing routes non compliant with your routing policy (which grants more than desired ""least access""), delete the non compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 delete-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;non_compliant_destination_CIDR&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Create a new compliant route:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block &amp;lt;compliant_destination_CIDR&amp;gt; --vpc-peering-connection-id &amp;lt;peering_connection_id&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configurations with Specific Routes" url="https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html"/>
+          </references>
+          <standards>
+            <standard ref="5.4" supportedStandardRef="CIS AWS Standard"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review routing tables of peered VPCs for whether they route
+                            all subnets of each VPC and whether that is necessary to accomplish the intended purposes
+                            for peering the VPCs.&lt;br /&gt;&lt;br /&gt;&lt;b&gt;Via CLI:&lt;/b&gt;&lt;br /&gt;List all
+                            the route tables from a VPC and check if &amp;quot;GatewayId&amp;quot; is pointing to a
+                            &amp;lt;peering_connection_id&amp;gt; (e.g. pcx-1a2b3c4d) and if &amp;quot;DestinationCidrBlock&amp;quot;
+                            is as specific as desired.&lt;br /&gt;
+                            &lt;blockquote&gt;
+                            aws ec2 describe-route-tables --filter &amp;quot;Name=vpc-id,Values=&amp;lt;vpc_id&amp;gt;&amp;quot;
+                            --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes,
+                            AssociatedSubnets:Associations[*].SubnetId}&amp;quot;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.2" name="Separate VPC into zones by function" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. It is recommended that resources be placed into VPC's according to use case (ie dev/test/prod) and that appropriate security levels be set on these VPC's. Placing such resources accordingly ensures that a resource of a higher security level is not exposed by the security settings of a lower labeled VPC.&amp;nbsp; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify the resources that exist within an incorrect VPC.&lt;/li&gt; 
+  &lt;li&gt;Migrate or move them to the correct VPC.&lt;/li&gt; 
+ &lt;/ol&gt; 
+   &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource added to a VPC is isolated according to its designation (ie
+                            test/dev/prod).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-04-01T07:51:15.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To get started with AWS Secrets Manager: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identify your secrets and locate where they are used in your applications. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update your applications to retrieve secrets from Secrets Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.969">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC6" name="Use Network ACLs for VPC" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network ACLs for VPC as an additional layer of security 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can add or remove rules from the default network ACL, or create additional network ACLs for your VPC. When you add or remove rules from a network ACL, the changes are automatically applied to the subnets that it's associated with. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following are the parts of a network ACL rule: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Type. The type of traffic; for example, SSH. You can also specify all traffic or a custom range. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Protocol. You can specify any protocol that has a standard protocol number. For more information, see Protocol Numbers. If you specify ICMP as the protocol, you can specify any or all of the ICMP types and codes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Port range. The listening port or port range for the traffic. For example, 80 for HTTP traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Source. [Inbound rules only] The source of the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Destination. [Outbound rules only] The destination for the traffic (CIDR range). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow/Deny. Whether to allow or deny the specified traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Review your Network ACLs using the console:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Open the Amazon VPC console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the navigation pane, choose Network ACLs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select a Network ACL to see details. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:43:47.241">
+              <output/>
+            </source>
+            <references>
+              <reference name="Network ACLs" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC4" name="Use VPC endpoint policies" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use VPC endpoint policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. Endpoint policies must be written in JSON format. Not all services support endpoint policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A VPC endpoint policy is an IAM resource policy that you attach to an endpoint when you create or modify the endpoint. If you do not attach a policy when you create an endpoint, AWS attaches a default policy for you that allows full access to the service. If a service does not support endpoint policies, the endpoint allows full access to the service. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You cannot attach more than one policy to an endpoint. However, you can modify the policy at any time. If you do modify a policy, it can take a few minutes for the changes to take effect. For more information about writing policies, see Overview of IAM Policies in the IAM User Guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your endpoint policy can be like any IAM policy; however, take note of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Only the parts of the policy that relate to the specified service will work. You cannot use an endpoint policy to allow resources in your VPC to perform other actions; for example, if you add EC2 actions to an endpoint policy for an endpoint to Amazon S3, they will have no effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your policy must contain a Principal element. For additional information related gateway endpoints, see Endpoint policies for gateway endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The size of an endpoint policy cannot exceed 20,480 characters (including white space). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling access to services with VPC endpoints" url="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-06-19T12:41:32.102">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+              <reference name="Testing IAM policies with the IAM policy simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-VPC5" name="Use VPC security groups" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use VPC security groups&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.&lt;/p&gt;&lt;p&gt;If you launch an instance using the Amazon EC2 API or a command line tool and you don't specify a security group, the instance is automatically assigned to the default security group for the VPC. If you launch an instance using the Amazon EC2 console, you have an option to create a new security group for the instance.&lt;/p&gt;&lt;p&gt;For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;To create a security group using the console&lt;/p&gt;&lt;p&gt;Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;Choose Create Security Group.&lt;/p&gt;&lt;p&gt;Enter a name for the security group (for example, my-security-group) and provide a description. Select the ID of your VPC from the VPC menu and choose Yes, Create.&lt;/p&gt;&lt;p&gt;To create a security group use the command line&lt;/p&gt;&lt;p&gt;create-security-group (AWS CLI)&lt;/p&gt;&lt;p&gt;New-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;Describe one or more security groups using the command line&lt;/p&gt;&lt;p&gt;describe-security-groups (AWS CLI)&lt;/p&gt;&lt;p&gt;Get-EC2SecurityGroup (AWS Tools for Windows PowerShell)&lt;/p&gt;&lt;p&gt;By default, new security groups start with only an outbound rule that allows all traffic to leave the instances. You must add rules to enable any inbound traffic or to restrict the outbound traffic.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Review your security groups using the console:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Open the Amazon VPC console.&lt;/p&gt;&lt;p&gt;2. In the navigation pane, choose Security Groups.&lt;/p&gt;&lt;p&gt;3. Select a security group to see the details.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-03-15T08:08:24.653">
+              <output/>
+            </source>
+            <references>
+              <reference name="Security groups for your VPC" url="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                    <countermeasure ref="AWS-VPC1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-CLOUDTRAIL2" mitigation="50"/>
+                <countermeasure ref="AWS-VPC1" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC7" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                <countermeasure ref="AWS-VPC7" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                    <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC8" mitigation="33"/>
+                <countermeasure ref="AWS-VPC9" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                    <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-VPC3" mitigation="17"/>
+                <countermeasure ref="AWS-VPC4" mitigation="17"/>
+                <countermeasure ref="AWS-VPC5" mitigation="17"/>
+                <countermeasure ref="AWS-VPC6" mitigation="17"/>
+                <countermeasure ref="Hydras-AWS-Network-5.2" mitigation="16"/>
+                <countermeasure ref="Hydras-AWS-Network-5.8" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="899a22b7-e9b1-4ad0-a88b-8c529d2fe7fa" diagramComponentId="014badac-374f-4d89-8c27-42530ecd947e" ref="c489bf07-0b51-45f9-b4f8-5cc2d83e6a81" name="User - Web UI" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-ui">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.752">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software includes web functionality (such as a web widget)
+                        from another domain, which causes it to operate within the domain of the
+                        software, potentially granting total access and control of the software to the
+                        untrusted source.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-18T14:51:05.701">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-07T14:11:14.917">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.862">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.944">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:20:27.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.807">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component's end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-30T12:25:46.844">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Review periodically all assets which are accessed by the application and ensure that these
+                        assets are hosted by the application. If this is not the case and there are assets in external
+                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
+                        from external providers or CDNs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
+          </references>
+          <standards>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all assets are hosted by the application, and not by external providers.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T11:44:50.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform=".NET" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+            <implementation platform="Spring MVC">
+              <desc>
+                                CkluIHdlYi54bWwKCjxjb250ZXh0LXBhcmFtPgogICAgPHBhcmFtLW5hbWU+ZGVmYXVsdEh0bWxFc2NhcGU8L3BhcmFtLW5hbWU+CiAgICA8cGFyYW0tdmFsdWU+dHJ1ZTwvcGFyYW0tdmFsdWU+CjwvY29udGV4dC1wYXJhbT4=
+                            </desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.033">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only request the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-09-30T09:11:03.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-30T15:19:22.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:20.974">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:21.007">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-07T14:11:14.845">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jonnytennyson@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Web applications typically make extensive use of 3rd party web resources such as
+                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
+                                repositories, or even Content Delivery Networks that host these libraries, then they
+                                could gain access to applications that use this content.
+                                &lt;div&gt;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-830">
+                  <countermeasures>
+                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="33"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="34"/>
+                <countermeasure ref="WEB-CSP" mitigation="33"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                <countermeasure ref="CWE-327" mitigation="33"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="jonnytennyson@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/azure-general-network-architecture.xml b/Templates/Submitted_Templates/azure-general-network-architecture.xml
new file mode 100644
index 0000000..87ae44d
--- /dev/null
+++ b/Templates/Submitted_Templates/azure-general-network-architecture.xml
@@ -0,0 +1,12271 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="azure-general-network-architecture" name="Azure - General Network Architecture" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjI0OCIgZHk9IjEwODIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC42LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHVibGljIiBzdHlsZT0iaXIucmVmPTYzNzZkNTNlLTY0NjEtNDEyYi04ZTA0LTdiM2ZlMmIzOTdkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMzUyIiB5PSItMzEiIHdpZHRoPSIxMjE3IiBoZWlnaHQ9IjU5OSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQXp1cmUgRW52aXJvbm1lbnQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtZW52aXJvbm1lbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTROekEyTWlBd0xqRTJOalV3TkVnd0xqWXdNakl6TWt3d0xqTTNPRGczTWlBd0xqZ3lPRE13T0VNd0xqTTNOalUzTmlBd0xqZ3pOVEV4SURBdU16Y3lNakEwSURBdU9EUXhNREl4SURBdU16WTJNemN5SURBdU9EUTFNakE0UXpBdU16WXdOVFFnTUM0NE5Ea3pPVFFnTUM0ek5UTTFOREVnTUM0NE5URTJORFlnTUM0ek5EWXpOaklnTUM0NE5URTJORFpJTUM0eE56ZzVNVEZETUM0eE56TTBOeklnTUM0NE5URTJORGNnTUM0eE5qZ3hNVEVnTUM0NE5UQXpOVElnTUM0eE5qTXlOeklnTUM0NE5EYzROamxETUM0eE5UZzBNek1nTUM0NE5EVXpPRFlnTUM0eE5UUXlOVFFnTUM0NE5ERTNPRGNnTUM0eE5URXdPRElnTUM0NE16Y3pOamxETUM0eE5EYzVNU0F3TGpnek1qazFNU0F3TGpFME5UZ3pOaUF3TGpneU56ZzBNU0F3TGpFME5UQXpNU0F3TGpneU1qUTJNa013TGpFME5ESXlOaUF3TGpneE56QTRNeUF3TGpFME5EY3hNeUF3TGpneE1UVTVJREF1TVRRMk5EVXlJREF1T0RBMk5ETTJUREF1TXpVME5UVXpJREF1TVRnNU9EUXlRekF1TXpVMk9EUTVJREF1TVRnek1EUWdNQzR6TmpFeU1qRWdNQzR4TnpjeE1qa2dNQzR6Tmpjd05UTWdNQzR4TnpJNU5ESkRNQzR6TnpJNE9EVWdNQzR4TmpnM05UWWdNQzR6TnprNE9ETWdNQzR4TmpZMU1EUWdNQzR6T0Rjd05qSWdNQzR4TmpZMU1EUmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT1RrMk5UY2dNQzQyTVRBek5USklNQzR6TlRnME5EZERNQzR6TlRVeU56Y2dNQzQyTVRBek5USWdNQzR6TlRJeE9DQXdMall4TVRNd05pQXdMak0wT1RVMU9TQXdMall4TXpBNVF6QXVNelEyT1RNNElEQXVOakUwT0RjMElEQXVNelEwT1RFMElEQXVOakUzTkRBMUlEQXVNelF6TnpVeUlEQXVOakl3TXpVMVF6QXVNelF5TlRnNUlEQXVOakl6TXpBMUlEQXVNelF5TXpReElEQXVOakkyTlRNMklEQXVNelF6TURRZ01DNDJNamsyTWpsRE1DNHpORE0zTXpnZ01DNDJNekkzTWpFZ01DNHpORFV6TlRJZ01DNDJNelUxTXpJZ01DNHpORGMyTnlBd0xqWXpOelk1TlV3d0xqVTJOamt5TWlBd0xqZzBNak15T0VNd0xqVTNNek13TkNBd0xqZzBPREk0TkNBd0xqVTRNVGN3T0NBd0xqZzFNVFU1TnlBd0xqVTVNRFF6TnlBd0xqZzFNVFU1TjBnd0xqYzRNell6TkV3d0xqWTVPVFkxTnlBd0xqWXhNRE0xTWxvaUlHWnBiR3c5SWlNd01EYzRSRFFpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpNNE56RTBNU0F3TGpFMk5qVXdORU13TGpNM09UZzROQ0F3TGpFMk5qUTNOeUF3TGpNM01qZ3dPQ0F3TGpFMk9EYzNJREF1TXpZMk9UUTNJREF1TVRjek1EVkRNQzR6TmpFd09EWWdNQzR4Tnpjek1qa2dNQzR6TlRZM05EWWdNQzR4T0RNek55QXdMak0xTkRVMk1pQXdMakU1TURJNVREQXVNVFEyTnpnMklEQXVPREExT0RjNFF6QXVNVFEwT1RNZ01DNDRNVEV3TlNBd0xqRTBORE0wTnlBd0xqZ3hOalU1TkNBd0xqRTBOVEE0TnlBd0xqZ3lNakF6T1VNd0xqRTBOVGd5TmlBd0xqZ3lOelE0TkNBd0xqRTBOemcyTnlBd0xqZ3pNalkzTVNBd0xqRTFNVEF6TlNBd0xqZ3pOekUyTVVNd0xqRTFOREl3TXlBd0xqZzBNVFkxTVNBd0xqRTFPRFF3TnlBd0xqZzBOVE14TVNBd0xqRTJNekk0T1NBd0xqZzBOemd6TTBNd0xqRTJPREUzTWlBd0xqZzFNRE0xTkNBd0xqRTNNelU1SURBdU9EVXhOall6SURBdU1UYzVNRGcxSURBdU9EVXhOalE0U0RBdU16VXdPRFpETUM0ek5UY3lOaUF3TGpnMU1EVXdOU0F3TGpNMk16STBNU0F3TGpnME56WTRNeUF3TGpNMk9ERTVNaUF3TGpnME16UTNNVU13TGpNM016RTBOQ0F3TGpnek9USTFPU0F3TGpNM05qZzRPQ0F3TGpnek16Z3dPU0F3TGpNM09UQTBNeUF3TGpneU56WTNOa3d3TGpReU1EUTNNeUF3TGpjd05UVTNORXd3TGpVMk9EUTNOU0F3TGpnME16WXhNVU13TGpVM05EWTNOaUF3TGpnME9EYzBNeUF3TGpVNE1qUTFOaUF3TGpnMU1UVTRNaUF3TGpVNU1EVXdOU0F3TGpnMU1UWTBPVWd3TGpjNE1qazRPRXd3TGpZNU9EVTJOU0F3TGpZeE1EUk1NQzQwTlRJME5qUWdNQzQyTVRBME5UVk1NQzQyTURNd09UUWdNQzR4TmpZMU1EUklNQzR6T0RjeE5ERmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNVjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTmpFM09EVWdNQzR4T0RrNE1EWkRNQzQyTlRrME9UTWdNQzR4T0RNd01UVWdNQzQyTlRVeE1qZ2dNQzR4TnpjeE1UTWdNQzQyTkRrek1EWWdNQzR4TnpJNU16TkRNQzQyTkRNME9ETWdNQzR4TmpnM05UTWdNQzQyTXpZME9UWWdNQzR4TmpZMU1EUWdNQzQyTWprek1qZ2dNQzR4TmpZMU1EUklNQzR6T0RrMU1qWkRNQzR6T1RZMk9UVWdNQzR4TmpZMU1EUWdNQzQwTURNMk9ESWdNQzR4TmpnM05UTWdNQzQwTURrMU1EVWdNQzR4TnpJNU16TkRNQzQwTVRVek1qZ2dNQzR4TnpjeE1UTWdNQzQwTVRrMk9UTWdNQzR4T0RNd01UVWdNQzQwTWpFNU9EWWdNQzR4T0RrNE1EWk1NQzQyTXpBd09Ua2dNQzQ0TURZME16VkRNQzQyTXpFNE16Z2dNQzQ0TVRFMU9EZ2dNQzQyTXpJek1qVWdNQzQ0TVRjd09ESWdNQzQyTXpFMU1Ua2dNQzQ0TWpJME5rTXdMall6TURjeE5DQXdMamd5Tnpnek9TQXdMall5T0RZek9TQXdMamd6TWprME9TQXdMall5TlRRMk55QXdMamd6TnpNMk9FTXdMall5TWpJNU5TQXdMamcwTVRjNE5pQXdMall4T0RFeE55QXdMamcwTlRNNE5TQXdMall4TXpJM09DQXdMamcwTnpnMk9VTXdMall3T0RRek9TQXdMamcxTURNMU1pQXdMall3TXpBM09DQXdMamcxTVRZME55QXdMalU1TnpZek9TQXdMamcxTVRZME9FZ3dMamd6TnpRME1VTXdMamcwTWpnNElEQXVPRFV4TmpRM0lEQXVPRFE0TWpReElEQXVPRFV3TXpVeUlEQXVPRFV6TURnZ01DNDRORGM0TmpsRE1DNDROVGM1TVRrZ01DNDRORFV6T0RZZ01DNDROakl3T1RjZ01DNDROREUzT0RZZ01DNDROalV5TmprZ01DNDRNemN6TmpoRE1DNDROamcwTkRFZ01DNDRNekk1TkRrZ01DNDROekExTVRVZ01DNDRNamM0TXprZ01DNDROekV6TWlBd0xqZ3lNalEyUXpBdU9EY3lNVEkxSURBdU9ERTNNRGd4SURBdU9EY3hOak0zSURBdU9ERXhOVGc0SURBdU9EWTVPRGs0SURBdU9EQTJORE0xVERBdU5qWXhOemcxSURBdU1UZzVPREEyV2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERKZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXdMalEyTlRRNE5pSWdlVEU5SWpBdU1qRTNNamMxSWlCNE1qMGlNQzR5TkRJd01qa2lJSGt5UFNJd0xqZzNOelF5TWlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RXhORUU0UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EWTJPVUpESWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzQxTXpVek55SWdlVEU5SWpBdU5USTBPVElpSUhneVBTSXdMalE0TXpZM09TSWdlVEk5SWpBdU5UUXlNems0SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXOXdZV05wZEhrOUlqQXVNeUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqQTNNVElpSUhOMGIzQXRiM0JoWTJsMGVUMGlNQzR5SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVNekl4SWlCemRHOXdMVzl3WVdOcGRIazlJakF1TVNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMall5TXpFaUlITjBiM0F0YjNCaFkybDBlVDBpTUM0d05TSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMVzl3WVdOcGRIazlJakFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWElpSUhneFBTSXdMalV3TmpjMk1TSWdlVEU5SWpBdU1UazRNREUxSWlCNE1qMGlNQzQzTlRJd05EWWlJSGt5UFNJd0xqZzFNVFV4TnlJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6TkRRMEpHTkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1qZzVNa1JHSWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1T0RRMk1UVWlJR2hsYVdkb2REMGlNQzQ1T0RRMk1URWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakF4TlRNNE1Ea2dNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnprMU5UWTVJaUJvWldsbmFIUTlJakF1TnprMU5UWTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR4TURrNU9EVWdNQzR4TURrNE5qTXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjMiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zZjZhNGJkYS0yYTc1LTQyYmUtYTY3Zi1kZTNmNmQxYWJiNjE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWVudmlyb25tZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjMiIHk9IjM1IiB3aWR0aD0iMTE3NyIgaGVpZ2h0PSI1MzYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkF6dXJlIFZOZXQiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVk5FVDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RXlNVE5mTWpFMk56Z3BJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkyTURjeE15QXdMalUwT1RZNU9FTXdMalk0T0RJMU55QXdMalUwT1RZNU9DQXdMamN4TURVNE55QXdMalV5TnpNMk9TQXdMamN4TURVNE55QXdMalE1T1RneU5VTXdMamN4TURVNE55QXdMalEzTWpJNElEQXVOamc0TWpVM0lEQXVORFE1T1RVeElEQXVOall3TnpFeklEQXVORFE1T1RVeFF6QXVOak16TVRZNUlEQXVORFE1T1RVeElEQXVOakV3T0RRZ01DNDBOekl5T0NBd0xqWXhNRGcwSURBdU5EazVPREkxUXpBdU5qRXdPRFFnTUM0MU1qY3pOamtnTUM0Mk16TXhOamtnTUM0MU5EazJPVGdnTUM0Mk5qQTNNVE1nTUM0MU5EazJPVGhhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWEpmTVRJeE0xOHlNVFkzT0NraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNVFV6TWlBd0xqVTBPVGt6T1VNd0xqVXlPVEEzTmlBd0xqVTBPVGt6T1NBd0xqVTFNVFF3TkNBd0xqVXlOell4TVNBd0xqVTFNVFF3TkNBd0xqVXdNREEyTjBNd0xqVTFNVFF3TkNBd0xqUTNNalV5TkNBd0xqVXlPVEEzTmlBd0xqUTFNREU1TlNBd0xqVXdNVFV6TWlBd0xqUTFNREU1TlVNd0xqUTNNems0T1NBd0xqUTFNREU1TlNBd0xqUTFNVFkySURBdU5EY3lOVEkwSURBdU5EVXhOallnTUM0MU1EQXdOamRETUM0ME5URTJOaUF3TGpVeU56WXhNU0F3TGpRM016azRPU0F3TGpVME9Ua3pPU0F3TGpVd01UVXpNaUF3TGpVME9Ua3pPVm9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF4WDJ4cGJtVmhjbDh4TWpFelh6SXhOamM0S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16UXlPRFF6SURBdU5UUTVPVE01UXpBdU16Y3dNemc0SURBdU5UUTVPVE01SURBdU16a3lOekUzSURBdU5USTNOakV4SURBdU16a3lOekUzSURBdU5UQXdNRFkzUXpBdU16a3lOekUzSURBdU5EY3lOVEkwSURBdU16Y3dNemc0SURBdU5EVXdNVGsxSURBdU16UXlPRFF6SURBdU5EVXdNVGsxUXpBdU16RTFNams0SURBdU5EVXdNVGsxSURBdU1qa3lPVFk1SURBdU5EY3lOVEkwSURBdU1qa3lPVFk1SURBdU5UQXdNRFkzUXpBdU1qa3lPVFk1SURBdU5USTNOakV4SURBdU16RTFNams0SURBdU5UUTVPVE01SURBdU16UXlPRFF6SURBdU5UUTVPVE01V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERKZmJHbHVaV0Z5WHpFeU1UTmZNakUyTnpncElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOemt3TnpZZ01DNDJPVGsxTmpOTU1DNHpOVEExTXprZ01DNDNNamd4T0VNd0xqTTBPREV5TXlBd0xqY3pNRFl3TWlBd0xqTTBORGcwTkNBd0xqY3pNVGsyTmlBd0xqTTBNVFF5TkNBd0xqY3pNVGszTVVNd0xqTXpPREF3TXlBd0xqY3pNVGszTlNBd0xqTXpORGN5SURBdU56TXdOakl4SURBdU16TXlNams0SURBdU56STRNakExVERBdU1USXhNREU0SURBdU5URTNOVEUxUXpBdU1URTJNVGMwSURBdU5URXlOamcwSURBdU1URXpORFEzSURBdU5UQTJNVEkySURBdU1URXpORE0zSURBdU5EazVNamcxUXpBdU1URXpOREk0SURBdU5Ea3lORFF6SURBdU1URTJNVE0ySURBdU5EZzFPRGM0SURBdU1USXdPVFkzSURBdU5EZ3hNRE16VERBdU1UUTVOVEExSURBdU5EVXlOREUyVERBdU16YzVNRFVnTUM0Mk9ERXpNakpETUM0ek9ERTBOek1nTUM0Mk9ETTNNemdnTUM0ek9ESTRNellnTUM0Mk9EY3dNVFlnTUM0ek9ESTROREVnTUM0Mk9UQTBNemRETUM0ek9ESTRORFlnTUM0Mk9UTTROVGdnTUM0ek9ERTBPVEVnTUM0Mk9UY3hOREVnTUM0ek56a3dOellnTUM0Mk9UazFOak5XTUM0Mk9UazFOak5hSWlCbWFXeHNQU0lqTlRCRk5rWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TkRZd05EY2dNQzR5TnpJMU16Vk1NQzR6TnpRMk5qVWdNQzR6TURFd056SkRNQzR6Tnpjd09EY2dNQzR6TURNME9EZ2dNQzR6TnpnME5TQXdMak13TmpjMk5pQXdMak0zT0RRMU5TQXdMak14TURFNE4wTXdMak0zT0RRMklEQXVNekV6TmpBNElEQXVNemMzTVRBMklEQXVNekUyT0RreElEQXVNemMwTmprZ01DNHpNVGt6TVROTU1DNHhORGt4TWpJZ01DNDFORFUxTURkTU1DNHhNakExTURVZ01DNDFNVFk1TjBNd0xqRXhOVFkyTVNBd0xqVXhNakV6T1NBd0xqRXhNamt6TkNBd0xqVXdOVFU0TVNBd0xqRXhNamt5TkNBd0xqUTVPRGMwUXpBdU1URXlPVEUxSURBdU5Ea3hPRGs0SURBdU1URTFOakl6SURBdU5EZzFNek16SURBdU1USXdORFUwSURBdU5EZ3dORGc1VERBdU16STNPREEySURBdU1qY3lOVFl4UXpBdU16TXdNakl5SURBdU1qY3dNVE01SURBdU16TXpOVEF4SURBdU1qWTROemMxSURBdU16TTJPVEl5SURBdU1qWTROemRETUM0ek5EQXpORElnTUM0eU5qZzNOalVnTUM0ek5ETTJNalVnTUM0eU56QXhNaUF3TGpNME5qQTBOeUF3TGpJM01qVXpOVll3TGpJM01qVXpOVm9pSUdacGJHdzlJaU14TkRrd1JFWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamcxTURVNE5pQXdMalExTWpFME9Fd3dMamczT1RFeU15QXdMalE0TURjMk5rTXdMamc0TXprMU5DQXdMalE0TlRZeElEQXVPRGcyTmpZeklEQXVORGt5TVRjMklEQXVPRGcyTmpVeklEQXVORGs1TURFM1F6QXVPRGcyTmpReklEQXVOVEExT0RVNUlEQXVPRGd6T1RFM0lEQXVOVEV5TkRFM0lEQXVPRGM1TURjeUlEQXVOVEUzTWpRNFREQXVOalkzTnprMElEQXVOekkzT1RReFF6QXVOalkxTXpjeUlEQXVOek13TXpVMklEQXVOall5TURrZ01DNDNNekUzTVNBd0xqWTFPRFkyT1NBd0xqY3pNVGN3TmtNd0xqWTFOVEkwT0NBd0xqY3pNVGN3TVNBd0xqWTFNVGsyT1NBd0xqY3pNRE16TnlBd0xqWTBPVFUxTkNBd0xqY3lOemt4TlV3d0xqWXlNVEF4TnlBd0xqWTVPVEk1T0VNd0xqWXhPRFl3TVNBd0xqWTVOamczTlNBd0xqWXhOekkwTnlBd0xqWTVNelU1TXlBd0xqWXhOekkxTWlBd0xqWTVNREUzTWtNd0xqWXhOekkxTnlBd0xqWTROamMxTVNBd0xqWXhPRFl5SURBdU5qZ3pORGN5SURBdU5qSXhNRFF5SURBdU5qZ3hNRFUzVERBdU9EVXdOVGcySURBdU5EVXlNVFE0VmpBdU5EVXlNVFE0V2lJZ1ptbHNiRDBpSXpVd1JUWkdSaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RjNU1UTTBJREF1TlRFMk9ERk1NQzQ0TlRBMU1UY2dNQzQxTkRVek5EaE1NQzQyTWpRNU5EY2dNQzR6TVRreE5EaERNQzQyTWpJMU16SWdNQzR6TVRZM01qWWdNQzQyTWpFeE56Y2dNQzR6TVRNME5ETWdNQzQyTWpFeE9ESWdNQzR6TVRBd01qTkRNQzQyTWpFeE9EY2dNQzR6TURZMk1ESWdNQzQyTWpJMU5URWdNQzR6TURNek1qTWdNQzQyTWpRNU56TWdNQzR6TURBNU1EZE1NQzQyTlRNNE9UVWdNQzR5TnpJd05qWkRNQzQyTlRZek1UY2dNQzR5TmprMk5URWdNQzQyTlRrMklEQXVNalk0TWprMklEQXVOall6TURJeElEQXVNalk0TXpBeFF6QXVOalkyTkRReElEQXVNalk0TXpBMklEQXVOalk1TnpJZ01DNHlOamsyTmprZ01DNDJOekl4TXpZZ01DNHlOekl3T1RKTU1DNDROemswT1NBd0xqUTRNREF5TlVNd0xqZzRORE15TVNBd0xqUTRORGcyT1NBd0xqZzROekF5T1NBd0xqUTVNVFF6TkNBd0xqZzROekF5SURBdU5EazRNamMyUXpBdU9EZzNNREVnTUM0MU1EVXhNVGdnTUM0NE9EUXlPRE1nTUM0MU1URTJOelVnTUM0NE56azBNemtnTUM0MU1UWTFNRGRNTUM0NE56a3hNelFnTUM0MU1UWTRNVm9pSUdacGJHdzlJaU14TkRrd1JFWWlMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeVh6RXlNVE5mTWpFMk56Z2lJSGd4UFNJd0xqWXlOVFUwTXlJZ2VURTlJakF1TkRZME9ETTJJaUI0TWowaU1DNDJPVFl4TlRJaUlIa3lQU0l3TGpVek5USTBPQ0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpnMlJEWXpNeUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTlVVNU5qSTBJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREZmYkdsdVpXRnlYekV5TVROZk1qRTJOemdpSUhneFBTSXdMak0zT0RVM01pSWdlVEU5SWpBdU5EZ3lORFFpSUhneVBTSXdMalEwT0RZMU1TSWdlVEk5SWpBdU5UVXlPVFE1SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJak9EWkVOak16SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlNMVJUazJNalFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWEpmTVRJeE0xOHlNVFkzT0NJZ2VERTlJakF1TWpFNU9EYzNJaUI1TVQwaU1DNDBPREkwTkNJZ2VESTlJakF1TWpnNU9UVTJJaUI1TWowaU1DNDFOVEk1TlRJaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTROa1EyTXpNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUl6VkZPVFl5TkNJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVEl4TTE4eU1UWTNPQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9DSWdhR1ZwWjJoMFBTSXdMamc0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05qQXdOVGcySURBdU1EWXdNRFU0TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWZkMTY3ZDM3LTQzN2YtNGQ4Ny1hYmUwLTAwY2ZjMDFlOTY5ZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVk5FVDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE2NyIgeT0iMjIiIHdpZHRoPSI5OTEiIGhlaWdodD0iNDgyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyMiIgdmFsdWU9IlN1Ym5ldCAxIC0+IEF6dXJlIExvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9YjZiNTRiYWYtN2Q3My00ZmM2LTg1ZDYtNDJlMTcwYWFiZjA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iNSIgc291cmNlPSI2IiB0YXJnZXQ9IjE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzE2IiB5PSIxMjQiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJTdWJuZXQgMSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wOyIgaWQ9IjYiPjxteENlbGwgc3R5bGU9ImlyLnJlZj00ZTZhYzgxNC1kN2FjLTQ4MTAtYjFkNC03ZDE5OWU0ZjE3MjA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7c3Ryb2tlV2lkdGg9MTt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDMiIHk9IjM5IiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjM3MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTAiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1mMmJkMmMwNC0zMGYzLTQ4ZjItOTk1OC03YzY4NjM4YjBhZjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzMiIgeT0iMjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIzIiB2YWx1ZT0iU3VibmV0IDIgLT4gQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj1iNWY4MGE3Ny1mN2Q2LTQ3NzQtOWYzZS05ZWRjOThkMGU1MDY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI1IiBzb3VyY2U9IjciIHRhcmdldD0iMTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI2NDQiIHk9IjEyNSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlN1Ym5ldCAyIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTg0NzA4ZDEwLWYwYmEtNGMwZS1hOWEyLWUyNDk0ZmY1YzUzZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNjMiIHk9IjM1IiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjM3NSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1iY2U1NzYzMi1hMDg1LTQ1OGUtYmMzZC04NjU3MDkxYjg4NjQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzMCIgeT0iMjMzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE2IiB2YWx1ZT0iQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj1lZjZlMTI1YS1kNThiLTRjODYtOGY1Ny0wNzUwZDE0NTNiM2Q7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TURrNU16QTVOaUF3TGpRNE5EQXdPRXd3TGpRMk9EZzNNU0F3TGpBeU5UQTJOemRETUM0ME56RTVNamtnTUM0d01qRTVNalE1SURBdU5EYzFOVGcySURBdU1ERTVOREkyT1NBd0xqUTNPVFl5TmlBd0xqQXhOemN5TVRKRE1DNDBPRE0yTmpZZ01DNHdNVFl3TVRVMUlEQXVORGc0TURBM0lEQXVNREUxTVRNMk55QXdMalE1TWpNNU1pQXdMakF4TlRFek5qZERNQzQwT1RZM056Y2dNQzR3TVRVeE16WTNJREF1TlRBeE1URTRJREF1TURFMk1ERTFOU0F3TGpVd05URTFPQ0F3TGpBeE56Y3lNVEpETUM0MU1Ea3hPVGdnTUM0d01UazBNalk1SURBdU5URXlPRFUxSURBdU1ESXhPVEkwT1NBd0xqVXhOVGt4TXlBd0xqQXlOVEEyTnpkTU1DNDVOelE0TlRNZ01DNDBPRFF3TURoRE1DNDVOemM1T1RZZ01DNDBPRGN3TmpZZ01DNDVPREEwT1RRZ01DNDBPVEEzTWpNZ01DNDVPREl4T1RrZ01DNDBPVFEzTmpORE1DNDVPRE01TURVZ01DNDBPVGc0TURNZ01DNDVPRFEzT0RRZ01DNDFNRE14TkRRZ01DNDVPRFEzT0RRZ01DNDFNRGMxTWpsRE1DNDVPRFEzT0RRZ01DNDFNVEU1TVRRZ01DNDVPRE01TURVZ01DNDFNVFl5TlRVZ01DNDVPREl4T1RrZ01DNDFNakF5T1RWRE1DNDVPREEwT1RRZ01DNDFNalF6TXpVZ01DNDVOemM1T1RZZ01DNDFNamM1T1RJZ01DNDVOelE0TlRNZ01DNDFNekV3TlV3d0xqVXhOVE0yTmlBd0xqazVNRFV6TjBNd0xqVXdPVEl6TVNBd0xqazVOalUxTVNBd0xqVXdNRGs0TXlBd0xqazVPVGt4T1NBd0xqUTVNak01TWlBd0xqazVPVGt4T1VNd0xqUTRNemd3TVNBd0xqazVPVGt4T1NBd0xqUTNOVFUxTXlBd0xqazVOalUxTVNBd0xqUTJPVFF4T0NBd0xqazVNRFV6TjB3d0xqQXdPVGt6TURrMklEQXVOVE14TURWRE1DNHdNRFkzT0RneUlEQXVOVEkzT1RreUlEQXVNREEwTWprd01pQXdMalV5TkRNek5TQXdMakF3TWpVNE5EVWdNQzQxTWpBeU9UVkRNQzR3TURBNE56ZzRNRElnTUM0MU1UWXlOVFVnTUNBd0xqVXhNVGt4TkNBd0lEQXVOVEEzTlRJNVF6QWdNQzQxTURNeE5EUWdNQzR3TURBNE56ZzRNRElnTUM0ME9UZzRNRE1nTUM0d01ESTFPRFExSURBdU5EazBOell6UXpBdU1EQTBNamt3TWlBd0xqUTVNRGN5TXlBd0xqQXdOamM0T0RJZ01DNDBPRGN3TmpZZ01DNHdNRGs1TXpBNU5pQXdMalE0TkRBd09GWXdMalE0TkRBd09Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall4TWpRNE5TQXdMakl6TkRJM04wd3dMalE1TmpVeE9TQXdMakV4T0RnMU9VTXdMalE1TlRNeE5pQXdMakV4TnpjNE15QXdMalE1TXpjMU9DQXdMakV4TnpFNE9DQXdMalE1TWpFME15QXdMakV4TnpFNE9FTXdMalE1TURVeU9DQXdMakV4TnpFNE9DQXdMalE0T0RrM0lEQXVNVEUzTnpneklEQXVORGczTnpZM0lEQXVNVEU0T0RVNVREQXVNemN4T0RBeElEQXVNak0wTWpjM1F6QXVNemN3TnpNMElEQXVNak0wT1RrMUlEQXVNelk1T1RVMElEQXVNak0yTURZM0lEQXVNelk1TlRrNElEQXVNak0zTXpBelF6QXVNelk1TWpReUlEQXVNak00TlRNNUlEQXVNelk1TXpNMElEQXVNak01T0RZeElEQXVNelk1T0RVMklEQXVNalF4TURNM1F6QXVNemN3TXpjNUlEQXVNalF5TWpFeUlEQXVNemN4TWprNUlEQXVNalF6TVRZMklEQXVNemN5TkRVMUlEQXVNalF6TnpNeFF6QXVNemN6TmpFeElEQXVNalEwTWprMUlEQXVNemMwT1RJNUlEQXVNalEwTkRNMElEQXVNemMyTVRjM0lEQXVNalEwTVRJelNEQXVORFEwTURBMlF6QXVORFEwTnprMklEQXVNalEwTVRJeklEQXVORFExTlRjNUlEQXVNalEwTWpjNUlEQXVORFEyTXpBNUlEQXVNalEwTlRneFF6QXVORFEzTURNNUlEQXVNalEwT0RnMElEQXVORFEzTnpBeUlEQXVNalExTXpJM0lEQXVORFE0TWpZeElEQXVNalExT0RnMVF6QXVORFE0T0RJZ01DNHlORFkwTkRRZ01DNDBORGt5TmpNZ01DNHlORGN4TURnZ01DNDBORGsxTmpVZ01DNHlORGM0TXpoRE1DNDBORGs0TmpnZ01DNHlORGcxTmpnZ01DNDBOVEF3TWpNZ01DNHlORGt6TlNBd0xqUTFNREF5TXlBd0xqSTFNREUwVmpBdU16VTVOVFF4UXpBdU5EVXdNREl6SURBdU16WXhNVE0zSURBdU5EVXdOalUzSURBdU16WXlOalkzSURBdU5EVXhOemcySURBdU16WXpOemsyUXpBdU5EVXlPVEUwSURBdU16WTBPVEkwSURBdU5EVTBORFExSURBdU16WTFOVFU0SURBdU5EVTJNRFFnTUM0ek5qVTFOVGhJTUM0MU1qZ3lORFZETUM0MU1qazROREVnTUM0ek5qVTFOVGdnTUM0MU16RXpOeklnTUM0ek5qUTVNalFnTUM0MU16STFJREF1TXpZek56azJRekF1TlRNek5qSTVJREF1TXpZeU5qWTNJREF1TlRNME1qWXpJREF1TXpZeE1UTTNJREF1TlRNME1qWXpJREF1TXpVNU5UUXhWakF1TWpVd01UUkRNQzQxTXpReU5qTWdNQzR5TkRrek5TQXdMalV6TkRReE9DQXdMakkwT0RVMk9DQXdMalV6TkRjeU1TQXdMakkwTnpnek9FTXdMalV6TlRBeU15QXdMakkwTnpFd09DQXdMalV6TlRRMk5pQXdMakkwTmpRME5DQXdMalV6TmpBeU5TQXdMakkwTlRnNE5VTXdMalV6TmpVNE5DQXdMakkwTlRNeU55QXdMalV6TnpJME55QXdMakkwTkRnNE5DQXdMalV6TnprM055QXdMakkwTkRVNE1VTXdMalV6T0Rjd055QXdMakkwTkRJM09TQXdMalV6T1RRNE9TQXdMakkwTkRFeU15QXdMalUwTURJNElEQXVNalEwTVRJelNEQXVOakE0TVRBNVF6QXVOakE1TXpVM0lEQXVNalEwTkRNMElEQXVOakV3TmpjMUlEQXVNalEwTWprMUlEQXVOakV4T0RNeElEQXVNalF6TnpNeFF6QXVOakV5T1RnM0lEQXVNalF6TVRZMklEQXVOakV6T1RBM0lEQXVNalF5TWpFeUlEQXVOakUwTkRNZ01DNHlOREV3TXpkRE1DNDJNVFE1TlRJZ01DNHlNems0TmpFZ01DNDJNVFV3TkRRZ01DNHlNemcxTXprZ01DNDJNVFEyT0RnZ01DNHlNemN6TURORE1DNDJNVFF6TXpJZ01DNHlNell3TmpjZ01DNDJNVE0xTlRJZ01DNHlNelE1T1RVZ01DNDJNVEkwT0RVZ01DNHlNelF5TnpkV01DNHlNelF5TnpkYUlpQm1hV3hzUFNJalFqUkZRek0ySWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU1UZzNPRElnTUM0ek56Y3dNVGRNTUM0eE1ETTVNU0F3TGpRNU16VXpRekF1TVRBeU9EY3lJREF1TkRrME5qUXpJREF1TVRBeU1qazFJREF1TkRrMk1UQTVJREF1TVRBeU1qazFJREF1TkRrM05qTXlRekF1TVRBeU1qazFJREF1TkRrNU1UVTFJREF1TVRBeU9EY3lJREF1TlRBd05qSXhJREF1TVRBek9URWdNQzQxTURFM016Vk1NQzR5TVRnM09ESWdNQzQyTVRjeE5UTkRNQzR5TVRrMk1qTWdNQzQyTVRnd05EWWdNQzR5TWpBM01UY2dNQzQyTVRnMk5qRWdNQzR5TWpFNU1UZ2dNQzQyTVRnNU1UVkRNQzR5TWpNeE1UZ2dNQzQyTVRreE5qa2dNQzR5TWpRek5qZ2dNQzQyTVRrd05TQXdMakl5TlRRNU9TQXdMall4T0RVM05FTXdMakl5TmpZeU9TQXdMall4T0RBNU9DQXdMakl5TnpVNE9DQXdMall4TnpJNE9DQXdMakl5T0RJME5TQXdMall4TmpJMU1VTXdMakl5T0Rrd01pQXdMall4TlRJeE5TQXdMakl5T1RJeU55QXdMall4TkRBd015QXdMakl5T1RFM05TQXdMall4TWpjM04xWXdMalUwTlRRNU5VTXdMakl5T1RFM05TQXdMalUwTXpnNU9TQXdMakl5T1Rnd09TQXdMalUwTWpNMk9TQXdMakl6TURrek9DQXdMalUwTVRJMFF6QXVNak15TURZMklEQXVOVFF3TVRFeUlEQXVNak16TlRrM0lEQXVOVE01TkRjNElEQXVNak0xTVRreUlEQXVOVE01TkRjNFNEQXVNelEwTlRrMFF6QXVNelExTXpZeElEQXVOVE01TkRneUlEQXVNelEyTVRJZ01DNDFNemt6TWpRZ01DNHpORFk0TWpJZ01DNDFNemt3TVRaRE1DNHpORGMxTWpRZ01DNDFNemczTURnZ01DNHpORGd4TlRNZ01DNDFNemd5TlRVZ01DNHpORGcyTmprZ01DNDFNemMyT0RoRE1DNHpORGt4T0RVZ01DNDFNemN4TWlBd0xqTTBPVFUzTmlBd0xqVXpOalExTVNBd0xqTTBPVGd4TmlBd0xqVXpOVGN5TTBNd0xqTTFNREExTmlBd0xqVXpORGs1TkNBd0xqTTFNREUwTVNBd0xqVXpOREl5TkNBd0xqTTFNREEyTkNBd0xqVXpNelEyTVZZd0xqUTJNVEkxTmtNd0xqTTFNRFV5TWlBd0xqUTJNRFE0T1NBd0xqTTFNRGM0TlNBd0xqUTFPVFl5TWlBd0xqTTFNRGd6TVNBd0xqUTFPRGN6UXpBdU16VXdPRGMySURBdU5EVTNPRE00SURBdU16VXdOekF5SURBdU5EVTJPVFE0SURBdU16VXdNekkxSURBdU5EVTJNVE01UXpBdU16UTVPVFEzSURBdU5EVTFNekk1SURBdU16UTVNemMzSURBdU5EVTBOakkxSURBdU16UTROalkwSURBdU5EVTBNRGcyUXpBdU16UTNPVFV4SURBdU5EVXpOVFE0SURBdU16UTNNVEUzSURBdU5EVXpNVGt6SURBdU16UTJNak0xSURBdU5EVXpNRFV4U0RBdU1qTTJPRE16UXpBdU1qTTJNRGN4SURBdU5EVXpNVEk0SURBdU1qTTFNeUF3TGpRMU16QTBNeUF3TGpJek5EVTNNaUF3TGpRMU1qZ3dNME13TGpJek16ZzBOQ0F3TGpRMU1qVTJNeUF3TGpJek16RTNOQ0F3TGpRMU1qRTNNaUF3TGpJek1qWXdOeUF3TGpRMU1UWTFOa013TGpJek1qQXpPU0F3TGpRMU1URTBJREF1TWpNeE5UZzNJREF1TkRVd05URXhJREF1TWpNeE1qYzRJREF1TkRRNU9EQTVRekF1TWpNd09UY2dNQzQwTkRreE1EY2dNQzR5TXpBNE1UTWdNQzQwTkRnek5EZ2dNQzR5TXpBNE1UWWdNQzQwTkRjMU9ERldNQzR6T0RFek9UTkRNQzR5TXpFek9UY2dNQzR6TnprM09UY2dNQzR5TXpFek1Ua2dNQzR6Tnpnd016WWdNQzR5TXpBMk1ERWdNQzR6TnpZME9UaERNQzR5TWprNE9ETWdNQzR6TnpRNU5Ua2dNQzR5TWpnMU9ETWdNQzR6TnpNM05qa2dNQzR5TWpZNU9EY2dNQzR6TnpNeE9EaERNQzR5TWpVek9URWdNQzR6TnpJMk1EZ2dNQzR5TWpNMk15QXdMak0zTWpZNE5TQXdMakl5TWpBNU1pQXdMak0zTXpRd00wTXdMakl5TURVMU15QXdMak0zTkRFeU1TQXdMakl4T1RNMk1pQXdMak0zTlRReU1TQXdMakl4T0RjNE1pQXdMak0zTnpBeE4xb2lJR1pwYkd3OUlpTkNORVZETXpZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzNNREUyTnlBd0xqWXhOekF3TkV3d0xqZzROalk0SURBdU5UQXhNRE01UXpBdU9EZzNOekU0SURBdU5EazVPVEkxSURBdU9EZzRNamsxSURBdU5EazRORFU1SURBdU9EZzRNamsxSURBdU5EazJPVE0yUXpBdU9EZzRNamsxSURBdU5EazFOREUwSURBdU9EZzNOekU0SURBdU5Ea3pPVFE0SURBdU9EZzJOamdnTUM0ME9USTRNelJNTUM0M056QXhOamNnTUM0ek56WTROamxETUM0M05qa3pNRFFnTUM0ek56WXhOVFVnTUM0M05qZ3lOVGtnTUM0ek56VTJPVFlnTUM0M05qY3hOU0F3TGpNM05UVTBORU13TGpjMk5qQTBNU0F3TGpNM05UTTVNaUF3TGpjMk5Ea3hNU0F3TGpNM05UVTFNaUF3TGpjMk16ZzRPQ0F3TGpNM05qQXdOME13TGpjMk1qZzJOU0F3TGpNM05qUTJNaUF3TGpjMk1UazRPU0F3TGpNM056RTVNeUF3TGpjMk1UTTFPU0F3TGpNM09ERXhPRU13TGpjMk1EY3lPU0F3TGpNM09UQTBNeUF3TGpjMk1ETTJPU0F3TGpNNE1ERXlOaUF3TGpjMk1ETXlNU0F3TGpNNE1USTBOVll3TGpRME9UWXlRekF1TnpZd016STBJREF1TkRVd016ZzNJREF1TnpZd01UWTNJREF1TkRVeE1UUTJJREF1TnpVNU9EVTVJREF1TkRVeE9EUTRRekF1TnpVNU5UVWdNQzQwTlRJMU5TQXdMamMxT1RBNU9DQXdMalExTXpFNElEQXVOelU0TlRNZ01DNDBOVE0yT1RWRE1DNDNOVGM1TmpNZ01DNDBOVFF5TVRFZ01DNDNOVGN5T1RNZ01DNDBOVFEyTURJZ01DNDNOVFkxTmpVZ01DNDBOVFE0TkRKRE1DNDNOVFU0TXpjZ01DNDBOVFV3T0RNZ01DNDNOVFV3TmpjZ01DNDBOVFV4TmpjZ01DNDNOVFF6TURRZ01DNDBOVFV3T1Vnd0xqWTBORGt3TWtNd0xqWTBOREV6TlNBd0xqUTFOVEE0TnlBd0xqWTBNek0zTmlBd0xqUTFOVEkwTkNBd0xqWTBNalkzTkNBd0xqUTFOVFUxTWtNd0xqWTBNVGszTWlBd0xqUTFOVGcyTVNBd0xqWTBNVE0wTXlBd0xqUTFOak14TXlBd0xqWTBNRGd5TnlBd0xqUTFOamc0TVVNd0xqWTBNRE14TVNBd0xqUTFOelEwT0NBd0xqWXpPVGt5SURBdU5EVTRNVEU0SURBdU5qTTVOamdnTUM0ME5UZzRORFpETUM0Mk16azBOQ0F3TGpRMU9UVTNOQ0F3TGpZek9UTTFOU0F3TGpRMk1ETTBOQ0F3TGpZek9UUXpNaUF3TGpRMk1URXdOMVl3TGpVek16TXhNa013TGpZek9UTTFOU0F3TGpVek5EQTNOU0F3TGpZek9UUTBJREF1TlRNME9EUTJJREF1TmpNNU5qZ2dNQzQxTXpVMU56UkRNQzQyTXprNU1pQXdMalV6TmpNd01pQXdMalkwTURNeE1TQXdMalV6TmprM01pQXdMalkwTURneU55QXdMalV6TnpVek9VTXdMalkwTVRNME15QXdMalV6T0RFd05pQXdMalkwTVRrM01pQXdMalV6T0RVMU9TQXdMalkwTWpZM05DQXdMalV6T0RnMk4wTXdMalkwTXpNM05pQXdMalV6T1RFM05pQXdMalkwTkRFek5TQXdMalV6T1RNek15QXdMalkwTkRrd01pQXdMalV6T1RNeU9VZ3dMamMxTkRNd05FTXdMamMxTlRnNU9TQXdMalV6T1RNeU9TQXdMamMxTnpReklEQXVOVE01T1RZeklEQXVOelU0TlRVNElEQXVOVFF4TURreVF6QXVOelU1TmpnM0lEQXVOVFF5TWpJZ01DNDNOakF6TWpFZ01DNDFORE0zTlRFZ01DNDNOakF6TWpFZ01DNDFORFV6TkRaV01DNDJNVE14TnpWRE1DNDNOakEwTlRrZ01DNDJNVFF5TkRjZ01DNDNOakE0T0RRZ01DNDJNVFV5TmpJZ01DNDNOakUxTlNBd0xqWXhOakV4TTBNd0xqYzJNakl4TnlBd0xqWXhOamsyTkNBd0xqYzJNekVnTUM0Mk1UYzJNaUF3TGpjMk5ERXdOeUF3TGpZeE9EQXhNa013TGpjMk5URXhOU0F3TGpZeE9EUXdOQ0F3TGpjMk5qSXdPU0F3TGpZeE9EVXhOeUF3TGpjMk56STNOU0F3TGpZeE9ETTBRekF1TnpZNE16UXlJREF1TmpFNE1UWXlJREF1TnpZNU16UWdNQzQyTVRjM01ERWdNQzQzTnpBeE5qY2dNQzQyTVRjd01EUldNQzQyTVRjd01EUmFJaUJtYVd4c1BTSWpRalJGUXpNMklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFV3TnpJZ01DNDFNRGM0TURoRE1DNDJORFV5TkRnZ01DNDBOemt6TlRFZ01DNDJNemMwTmpRZ01DNDBOVEUwTVRFZ01DNDJNakkxT1RrZ01DNDBNamN4TkRSRE1DNDJNRGMzTXpRZ01DNDBNREk0TnpnZ01DNDFPRFl6T0NBd0xqTTRNekkxSURBdU5UWXdPVFE1SURBdU16Y3dORGM1UXpBdU5UTTFOVEU0SURBdU16VTNOekE0SURBdU5UQTNNREl5SURBdU16VXlNekF5SURBdU5EYzROamdnTUM0ek5UUTROekZETUM0ME5UQXpNemtnTUM0ek5UYzBOREVnTUM0ME1qTXlPQ0F3TGpNMk56ZzRNeUF3TGpRd01EVTJJREF1TXpnMU1ERTVRekF1TXpjM09EUWdNQzQwTURJeE5UVWdNQzR6TmpBek5qUWdNQzQwTWpVek1ETWdNQzR6TlRBeE1EVWdNQzQwTlRFNE5EZERNQzR6TXprNE5EWWdNQzQwTnpnek9URWdNQzR6TXpjeU1UUWdNQzQxTURjeU56VWdNQzR6TkRJMU1EVWdNQzQxTXpVeU16ZERNQzR6TkRjM09UWWdNQzQxTmpNeE9UZ2dNQzR6TmpBM09Ua2dNQzQxT0RreE1qTWdNQzR6T0RBd05EY2dNQzQyTVRBd09EUkRNQzR6T1RreU9UVWdNQzQyTXpFd05EVWdNQzQwTWpRd01pQXdMalkwTmpJd055QXdMalExTVRRek1TQXdMalkxTXpnMU9GWXdMamN3TlRneU0wTXdMalF6TWpnd05TQXdMamN4TlRRME55QXdMalF4TnprMU15QXdMamN6TVRBME9TQXdMalF3T1RJMU9DQXdMamMxTURFeU5rTXdMalF3TURVMk1pQXdMamMyT1RJd01pQXdMak01T0RVeU55QXdMamM1TURZME5pQXdMalF3TXpRM09TQXdMamd4TVRBeE4wTXdMalF3T0RRek1pQXdMamd6TVRNNE9TQXdMalF5TURBNE5DQXdMamcwT1RVd05pQXdMalF6TmpVMk5pQXdMamcyTWpRMk1VTXdMalExTXpBME9TQXdMamczTlRReE55QXdMalEzTXpRd05pQXdMamc0TWpRMklEQXVORGswTXpjeElEQXVPRGd5TkRaRE1DNDFNVFV6TXpZZ01DNDRPREkwTmlBd0xqVXpOVFk1TXlBd0xqZzNOVFF4TnlBd0xqVTFNakUzTlNBd0xqZzJNalEyTVVNd0xqVTJPRFkxT0NBd0xqZzBPVFV3TmlBd0xqVTRNRE14SURBdU9ETXhNemc1SURBdU5UZzFNall5SURBdU9ERXhNREUzUXpBdU5Ua3dNakUwSURBdU56a3dOalEySURBdU5UZzRNVGM1SURBdU56WTVNakF5SURBdU5UYzVORGcwSURBdU56VXdNVEkyUXpBdU5UY3dOemc0SURBdU56TXhNRFE1SURBdU5UVTFPVE0ySURBdU56RTFORFEzSURBdU5UTTNNekV4SURBdU56QTFPREl6VmpBdU5qVXhNVEl6UXpBdU5UWTRNVGcySURBdU5qUXhPREV4SURBdU5UazFNamcySURBdU5qSXlPRGt5SURBdU5qRTBOalkySURBdU5UazNNVEUyUXpBdU5qTTBNRFEzSURBdU5UY3hNelF4SURBdU5qUTBOams1SURBdU5UUXdNRFUwSURBdU5qUTFNRGN5SURBdU5UQTNPREE0VmpBdU5UQTNPREE0V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TWpreE1pQXdMalU1TlRZNE4wTXdMalUwTVRnMU15QXdMalU1TlRZNE55QXdMalU0TVRVeU9DQXdMalUxTmpBeE15QXdMalU0TVRVeU9DQXdMalV3TnpBM01rTXdMalU0TVRVeU9DQXdMalExT0RFek1TQXdMalUwTVRnMU15QXdMalF4T0RRMU55QXdMalE1TWpreE1pQXdMalF4T0RRMU4wTXdMalEwTXprM01TQXdMalF4T0RRMU55QXdMalF3TkRJNU55QXdMalExT0RFek1TQXdMalF3TkRJNU55QXdMalV3TnpBM01rTXdMalF3TkRJNU55QXdMalUxTmpBeE15QXdMalEwTXprM01TQXdMalU1TlRZNE55QXdMalE1TWpreE1pQXdMalU1TlRZNE4xb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RJek9USWlJSGt4UFNJeExqRXdNVEF6SWlCNE1qMGlNQzQwT1RJek9USWlJSGt5UFNJdE1DNHdOREExTnpNeklpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpOVVU1TmpJMElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TURJaUlITjBiM0F0WTI5c2IzSTlJaU0xUmprM01qUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJemMyUWtNeVJDSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTkiIHk9IjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlN1Ym5ldCAzIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iOCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTMzODhkYzgxLThkZDItNDA1Mi1hZDZjLTBiYjA5OTQwZTViZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MDYiIHk9IjM1IiB3aWR0aD0iMjQzIiBoZWlnaHQ9IjM3MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTIiIHZhbHVlPSJBenVyZSBXaW5kb3dzIFZpcnR1YWwgTWFjaGluZSIgc3R5bGU9ImlyLnJlZj1lZjEyNmViMi1jMzU1LTRhMmItYTc5NS0xZjJkMGY4ZjU4NmM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEzNyIgeT0iMjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE3IiB2YWx1ZT0iQXp1cmUgTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0yZDMxODAxZS0yNjUwLTQ5MzQtYmVjMC1jNGM3OTBlZWQ2NzQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TURrNU16QTVOaUF3TGpRNE5EQXdPRXd3TGpRMk9EZzNNU0F3TGpBeU5UQTJOemRETUM0ME56RTVNamtnTUM0d01qRTVNalE1SURBdU5EYzFOVGcySURBdU1ERTVOREkyT1NBd0xqUTNPVFl5TmlBd0xqQXhOemN5TVRKRE1DNDBPRE0yTmpZZ01DNHdNVFl3TVRVMUlEQXVORGc0TURBM0lEQXVNREUxTVRNMk55QXdMalE1TWpNNU1pQXdMakF4TlRFek5qZERNQzQwT1RZM056Y2dNQzR3TVRVeE16WTNJREF1TlRBeE1URTRJREF1TURFMk1ERTFOU0F3TGpVd05URTFPQ0F3TGpBeE56Y3lNVEpETUM0MU1Ea3hPVGdnTUM0d01UazBNalk1SURBdU5URXlPRFUxSURBdU1ESXhPVEkwT1NBd0xqVXhOVGt4TXlBd0xqQXlOVEEyTnpkTU1DNDVOelE0TlRNZ01DNDBPRFF3TURoRE1DNDVOemM1T1RZZ01DNDBPRGN3TmpZZ01DNDVPREEwT1RRZ01DNDBPVEEzTWpNZ01DNDVPREl4T1RrZ01DNDBPVFEzTmpORE1DNDVPRE01TURVZ01DNDBPVGc0TURNZ01DNDVPRFEzT0RRZ01DNDFNRE14TkRRZ01DNDVPRFEzT0RRZ01DNDFNRGMxTWpsRE1DNDVPRFEzT0RRZ01DNDFNVEU1TVRRZ01DNDVPRE01TURVZ01DNDFNVFl5TlRVZ01DNDVPREl4T1RrZ01DNDFNakF5T1RWRE1DNDVPREEwT1RRZ01DNDFNalF6TXpVZ01DNDVOemM1T1RZZ01DNDFNamM1T1RJZ01DNDVOelE0TlRNZ01DNDFNekV3TlV3d0xqVXhOVE0yTmlBd0xqazVNRFV6TjBNd0xqVXdPVEl6TVNBd0xqazVOalUxTVNBd0xqVXdNRGs0TXlBd0xqazVPVGt4T1NBd0xqUTVNak01TWlBd0xqazVPVGt4T1VNd0xqUTRNemd3TVNBd0xqazVPVGt4T1NBd0xqUTNOVFUxTXlBd0xqazVOalUxTVNBd0xqUTJPVFF4T0NBd0xqazVNRFV6TjB3d0xqQXdPVGt6TURrMklEQXVOVE14TURWRE1DNHdNRFkzT0RneUlEQXVOVEkzT1RreUlEQXVNREEwTWprd01pQXdMalV5TkRNek5TQXdMakF3TWpVNE5EVWdNQzQxTWpBeU9UVkRNQzR3TURBNE56ZzRNRElnTUM0MU1UWXlOVFVnTUNBd0xqVXhNVGt4TkNBd0lEQXVOVEEzTlRJNVF6QWdNQzQxTURNeE5EUWdNQzR3TURBNE56ZzRNRElnTUM0ME9UZzRNRE1nTUM0d01ESTFPRFExSURBdU5EazBOell6UXpBdU1EQTBNamt3TWlBd0xqUTVNRGN5TXlBd0xqQXdOamM0T0RJZ01DNDBPRGN3TmpZZ01DNHdNRGs1TXpBNU5pQXdMalE0TkRBd09GWXdMalE0TkRBd09Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall4TWpRNE5TQXdMakl6TkRJM04wd3dMalE1TmpVeE9TQXdMakV4T0RnMU9VTXdMalE1TlRNeE5pQXdMakV4TnpjNE15QXdMalE1TXpjMU9DQXdMakV4TnpFNE9DQXdMalE1TWpFME15QXdMakV4TnpFNE9FTXdMalE1TURVeU9DQXdMakV4TnpFNE9DQXdMalE0T0RrM0lEQXVNVEUzTnpneklEQXVORGczTnpZM0lEQXVNVEU0T0RVNVREQXVNemN4T0RBeElEQXVNak0wTWpjM1F6QXVNemN3TnpNMElEQXVNak0wT1RrMUlEQXVNelk1T1RVMElEQXVNak0yTURZM0lEQXVNelk1TlRrNElEQXVNak0zTXpBelF6QXVNelk1TWpReUlEQXVNak00TlRNNUlEQXVNelk1TXpNMElEQXVNak01T0RZeElEQXVNelk1T0RVMklEQXVNalF4TURNM1F6QXVNemN3TXpjNUlEQXVNalF5TWpFeUlEQXVNemN4TWprNUlEQXVNalF6TVRZMklEQXVNemN5TkRVMUlEQXVNalF6TnpNeFF6QXVNemN6TmpFeElEQXVNalEwTWprMUlEQXVNemMwT1RJNUlEQXVNalEwTkRNMElEQXVNemMyTVRjM0lEQXVNalEwTVRJelNEQXVORFEwTURBMlF6QXVORFEwTnprMklEQXVNalEwTVRJeklEQXVORFExTlRjNUlEQXVNalEwTWpjNUlEQXVORFEyTXpBNUlEQXVNalEwTlRneFF6QXVORFEzTURNNUlEQXVNalEwT0RnMElEQXVORFEzTnpBeUlEQXVNalExTXpJM0lEQXVORFE0TWpZeElEQXVNalExT0RnMVF6QXVORFE0T0RJZ01DNHlORFkwTkRRZ01DNDBORGt5TmpNZ01DNHlORGN4TURnZ01DNDBORGsxTmpVZ01DNHlORGM0TXpoRE1DNDBORGs0TmpnZ01DNHlORGcxTmpnZ01DNDBOVEF3TWpNZ01DNHlORGt6TlNBd0xqUTFNREF5TXlBd0xqSTFNREUwVmpBdU16VTVOVFF4UXpBdU5EVXdNREl6SURBdU16WXhNVE0zSURBdU5EVXdOalUzSURBdU16WXlOalkzSURBdU5EVXhOemcySURBdU16WXpOemsyUXpBdU5EVXlPVEUwSURBdU16WTBPVEkwSURBdU5EVTBORFExSURBdU16WTFOVFU0SURBdU5EVTJNRFFnTUM0ek5qVTFOVGhJTUM0MU1qZ3lORFZETUM0MU1qazROREVnTUM0ek5qVTFOVGdnTUM0MU16RXpOeklnTUM0ek5qUTVNalFnTUM0MU16STFJREF1TXpZek56azJRekF1TlRNek5qSTVJREF1TXpZeU5qWTNJREF1TlRNME1qWXpJREF1TXpZeE1UTTNJREF1TlRNME1qWXpJREF1TXpVNU5UUXhWakF1TWpVd01UUkRNQzQxTXpReU5qTWdNQzR5TkRrek5TQXdMalV6TkRReE9DQXdMakkwT0RVMk9DQXdMalV6TkRjeU1TQXdMakkwTnpnek9FTXdMalV6TlRBeU15QXdMakkwTnpFd09DQXdMalV6TlRRMk5pQXdMakkwTmpRME5DQXdMalV6TmpBeU5TQXdMakkwTlRnNE5VTXdMalV6TmpVNE5DQXdMakkwTlRNeU55QXdMalV6TnpJME55QXdMakkwTkRnNE5DQXdMalV6TnprM055QXdMakkwTkRVNE1VTXdMalV6T0Rjd055QXdMakkwTkRJM09TQXdMalV6T1RRNE9TQXdMakkwTkRFeU15QXdMalUwTURJNElEQXVNalEwTVRJelNEQXVOakE0TVRBNVF6QXVOakE1TXpVM0lEQXVNalEwTkRNMElEQXVOakV3TmpjMUlEQXVNalEwTWprMUlEQXVOakV4T0RNeElEQXVNalF6TnpNeFF6QXVOakV5T1RnM0lEQXVNalF6TVRZMklEQXVOakV6T1RBM0lEQXVNalF5TWpFeUlEQXVOakUwTkRNZ01DNHlOREV3TXpkRE1DNDJNVFE1TlRJZ01DNHlNems0TmpFZ01DNDJNVFV3TkRRZ01DNHlNemcxTXprZ01DNDJNVFEyT0RnZ01DNHlNemN6TURORE1DNDJNVFF6TXpJZ01DNHlNell3TmpjZ01DNDJNVE0xTlRJZ01DNHlNelE1T1RVZ01DNDJNVEkwT0RVZ01DNHlNelF5TnpkV01DNHlNelF5TnpkYUlpQm1hV3hzUFNJalFqUkZRek0ySWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU1UZzNPRElnTUM0ek56Y3dNVGRNTUM0eE1ETTVNU0F3TGpRNU16VXpRekF1TVRBeU9EY3lJREF1TkRrME5qUXpJREF1TVRBeU1qazFJREF1TkRrMk1UQTVJREF1TVRBeU1qazFJREF1TkRrM05qTXlRekF1TVRBeU1qazFJREF1TkRrNU1UVTFJREF1TVRBeU9EY3lJREF1TlRBd05qSXhJREF1TVRBek9URWdNQzQxTURFM016Vk1NQzR5TVRnM09ESWdNQzQyTVRjeE5UTkRNQzR5TVRrMk1qTWdNQzQyTVRnd05EWWdNQzR5TWpBM01UY2dNQzQyTVRnMk5qRWdNQzR5TWpFNU1UZ2dNQzQyTVRnNU1UVkRNQzR5TWpNeE1UZ2dNQzQyTVRreE5qa2dNQzR5TWpRek5qZ2dNQzQyTVRrd05TQXdMakl5TlRRNU9TQXdMall4T0RVM05FTXdMakl5TmpZeU9TQXdMall4T0RBNU9DQXdMakl5TnpVNE9DQXdMall4TnpJNE9DQXdMakl5T0RJME5TQXdMall4TmpJMU1VTXdMakl5T0Rrd01pQXdMall4TlRJeE5TQXdMakl5T1RJeU55QXdMall4TkRBd015QXdMakl5T1RFM05TQXdMall4TWpjM04xWXdMalUwTlRRNU5VTXdMakl5T1RFM05TQXdMalUwTXpnNU9TQXdMakl5T1Rnd09TQXdMalUwTWpNMk9TQXdMakl6TURrek9DQXdMalUwTVRJMFF6QXVNak15TURZMklEQXVOVFF3TVRFeUlEQXVNak16TlRrM0lEQXVOVE01TkRjNElEQXVNak0xTVRreUlEQXVOVE01TkRjNFNEQXVNelEwTlRrMFF6QXVNelExTXpZeElEQXVOVE01TkRneUlEQXVNelEyTVRJZ01DNDFNemt6TWpRZ01DNHpORFk0TWpJZ01DNDFNemt3TVRaRE1DNHpORGMxTWpRZ01DNDFNemczTURnZ01DNHpORGd4TlRNZ01DNDFNemd5TlRVZ01DNHpORGcyTmprZ01DNDFNemMyT0RoRE1DNHpORGt4T0RVZ01DNDFNemN4TWlBd0xqTTBPVFUzTmlBd0xqVXpOalExTVNBd0xqTTBPVGd4TmlBd0xqVXpOVGN5TTBNd0xqTTFNREExTmlBd0xqVXpORGs1TkNBd0xqTTFNREUwTVNBd0xqVXpOREl5TkNBd0xqTTFNREEyTkNBd0xqVXpNelEyTVZZd0xqUTJNVEkxTmtNd0xqTTFNRFV5TWlBd0xqUTJNRFE0T1NBd0xqTTFNRGM0TlNBd0xqUTFPVFl5TWlBd0xqTTFNRGd6TVNBd0xqUTFPRGN6UXpBdU16VXdPRGMySURBdU5EVTNPRE00SURBdU16VXdOekF5SURBdU5EVTJPVFE0SURBdU16VXdNekkxSURBdU5EVTJNVE01UXpBdU16UTVPVFEzSURBdU5EVTFNekk1SURBdU16UTVNemMzSURBdU5EVTBOakkxSURBdU16UTROalkwSURBdU5EVTBNRGcyUXpBdU16UTNPVFV4SURBdU5EVXpOVFE0SURBdU16UTNNVEUzSURBdU5EVXpNVGt6SURBdU16UTJNak0xSURBdU5EVXpNRFV4U0RBdU1qTTJPRE16UXpBdU1qTTJNRGN4SURBdU5EVXpNVEk0SURBdU1qTTFNeUF3TGpRMU16QTBNeUF3TGpJek5EVTNNaUF3TGpRMU1qZ3dNME13TGpJek16ZzBOQ0F3TGpRMU1qVTJNeUF3TGpJek16RTNOQ0F3TGpRMU1qRTNNaUF3TGpJek1qWXdOeUF3TGpRMU1UWTFOa013TGpJek1qQXpPU0F3TGpRMU1URTBJREF1TWpNeE5UZzNJREF1TkRVd05URXhJREF1TWpNeE1qYzRJREF1TkRRNU9EQTVRekF1TWpNd09UY2dNQzQwTkRreE1EY2dNQzR5TXpBNE1UTWdNQzQwTkRnek5EZ2dNQzR5TXpBNE1UWWdNQzQwTkRjMU9ERldNQzR6T0RFek9UTkRNQzR5TXpFek9UY2dNQzR6TnprM09UY2dNQzR5TXpFek1Ua2dNQzR6Tnpnd016WWdNQzR5TXpBMk1ERWdNQzR6TnpZME9UaERNQzR5TWprNE9ETWdNQzR6TnpRNU5Ua2dNQzR5TWpnMU9ETWdNQzR6TnpNM05qa2dNQzR5TWpZNU9EY2dNQzR6TnpNeE9EaERNQzR5TWpVek9URWdNQzR6TnpJMk1EZ2dNQzR5TWpNMk15QXdMak0zTWpZNE5TQXdMakl5TWpBNU1pQXdMak0zTXpRd00wTXdMakl5TURVMU15QXdMak0zTkRFeU1TQXdMakl4T1RNMk1pQXdMak0zTlRReU1TQXdMakl4T0RjNE1pQXdMak0zTnpBeE4xb2lJR1pwYkd3OUlpTkNORVZETXpZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzNNREUyTnlBd0xqWXhOekF3TkV3d0xqZzROalk0SURBdU5UQXhNRE01UXpBdU9EZzNOekU0SURBdU5EazVPVEkxSURBdU9EZzRNamsxSURBdU5EazRORFU1SURBdU9EZzRNamsxSURBdU5EazJPVE0yUXpBdU9EZzRNamsxSURBdU5EazFOREUwSURBdU9EZzNOekU0SURBdU5Ea3pPVFE0SURBdU9EZzJOamdnTUM0ME9USTRNelJNTUM0M056QXhOamNnTUM0ek56WTROamxETUM0M05qa3pNRFFnTUM0ek56WXhOVFVnTUM0M05qZ3lOVGtnTUM0ek56VTJPVFlnTUM0M05qY3hOU0F3TGpNM05UVTBORU13TGpjMk5qQTBNU0F3TGpNM05UTTVNaUF3TGpjMk5Ea3hNU0F3TGpNM05UVTFNaUF3TGpjMk16ZzRPQ0F3TGpNM05qQXdOME13TGpjMk1qZzJOU0F3TGpNM05qUTJNaUF3TGpjMk1UazRPU0F3TGpNM056RTVNeUF3TGpjMk1UTTFPU0F3TGpNM09ERXhPRU13TGpjMk1EY3lPU0F3TGpNM09UQTBNeUF3TGpjMk1ETTJPU0F3TGpNNE1ERXlOaUF3TGpjMk1ETXlNU0F3TGpNNE1USTBOVll3TGpRME9UWXlRekF1TnpZd016STBJREF1TkRVd016ZzNJREF1TnpZd01UWTNJREF1TkRVeE1UUTJJREF1TnpVNU9EVTVJREF1TkRVeE9EUTRRekF1TnpVNU5UVWdNQzQwTlRJMU5TQXdMamMxT1RBNU9DQXdMalExTXpFNElEQXVOelU0TlRNZ01DNDBOVE0yT1RWRE1DNDNOVGM1TmpNZ01DNDBOVFF5TVRFZ01DNDNOVGN5T1RNZ01DNDBOVFEyTURJZ01DNDNOVFkxTmpVZ01DNDBOVFE0TkRKRE1DNDNOVFU0TXpjZ01DNDBOVFV3T0RNZ01DNDNOVFV3TmpjZ01DNDBOVFV4TmpjZ01DNDNOVFF6TURRZ01DNDBOVFV3T1Vnd0xqWTBORGt3TWtNd0xqWTBOREV6TlNBd0xqUTFOVEE0TnlBd0xqWTBNek0zTmlBd0xqUTFOVEkwTkNBd0xqWTBNalkzTkNBd0xqUTFOVFUxTWtNd0xqWTBNVGszTWlBd0xqUTFOVGcyTVNBd0xqWTBNVE0wTXlBd0xqUTFOak14TXlBd0xqWTBNRGd5TnlBd0xqUTFOamc0TVVNd0xqWTBNRE14TVNBd0xqUTFOelEwT0NBd0xqWXpPVGt5SURBdU5EVTRNVEU0SURBdU5qTTVOamdnTUM0ME5UZzRORFpETUM0Mk16azBOQ0F3TGpRMU9UVTNOQ0F3TGpZek9UTTFOU0F3TGpRMk1ETTBOQ0F3TGpZek9UUXpNaUF3TGpRMk1URXdOMVl3TGpVek16TXhNa013TGpZek9UTTFOU0F3TGpVek5EQTNOU0F3TGpZek9UUTBJREF1TlRNME9EUTJJREF1TmpNNU5qZ2dNQzQxTXpVMU56UkRNQzQyTXprNU1pQXdMalV6TmpNd01pQXdMalkwTURNeE1TQXdMalV6TmprM01pQXdMalkwTURneU55QXdMalV6TnpVek9VTXdMalkwTVRNME15QXdMalV6T0RFd05pQXdMalkwTVRrM01pQXdMalV6T0RVMU9TQXdMalkwTWpZM05DQXdMalV6T0RnMk4wTXdMalkwTXpNM05pQXdMalV6T1RFM05pQXdMalkwTkRFek5TQXdMalV6T1RNek15QXdMalkwTkRrd01pQXdMalV6T1RNeU9VZ3dMamMxTkRNd05FTXdMamMxTlRnNU9TQXdMalV6T1RNeU9TQXdMamMxTnpReklEQXVOVE01T1RZeklEQXVOelU0TlRVNElEQXVOVFF4TURreVF6QXVOelU1TmpnM0lEQXVOVFF5TWpJZ01DNDNOakF6TWpFZ01DNDFORE0zTlRFZ01DNDNOakF6TWpFZ01DNDFORFV6TkRaV01DNDJNVE14TnpWRE1DNDNOakEwTlRrZ01DNDJNVFF5TkRjZ01DNDNOakE0T0RRZ01DNDJNVFV5TmpJZ01DNDNOakUxTlNBd0xqWXhOakV4TTBNd0xqYzJNakl4TnlBd0xqWXhOamsyTkNBd0xqYzJNekVnTUM0Mk1UYzJNaUF3TGpjMk5ERXdOeUF3TGpZeE9EQXhNa013TGpjMk5URXhOU0F3TGpZeE9EUXdOQ0F3TGpjMk5qSXdPU0F3TGpZeE9EVXhOeUF3TGpjMk56STNOU0F3TGpZeE9ETTBRekF1TnpZNE16UXlJREF1TmpFNE1UWXlJREF1TnpZNU16UWdNQzQyTVRjM01ERWdNQzQzTnpBeE5qY2dNQzQyTVRjd01EUldNQzQyTVRjd01EUmFJaUJtYVd4c1BTSWpRalJGUXpNMklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFV3TnpJZ01DNDFNRGM0TURoRE1DNDJORFV5TkRnZ01DNDBOemt6TlRFZ01DNDJNemMwTmpRZ01DNDBOVEUwTVRFZ01DNDJNakkxT1RrZ01DNDBNamN4TkRSRE1DNDJNRGMzTXpRZ01DNDBNREk0TnpnZ01DNDFPRFl6T0NBd0xqTTRNekkxSURBdU5UWXdPVFE1SURBdU16Y3dORGM1UXpBdU5UTTFOVEU0SURBdU16VTNOekE0SURBdU5UQTNNREl5SURBdU16VXlNekF5SURBdU5EYzROamdnTUM0ek5UUTROekZETUM0ME5UQXpNemtnTUM0ek5UYzBOREVnTUM0ME1qTXlPQ0F3TGpNMk56ZzRNeUF3TGpRd01EVTJJREF1TXpnMU1ERTVRekF1TXpjM09EUWdNQzQwTURJeE5UVWdNQzR6TmpBek5qUWdNQzQwTWpVek1ETWdNQzR6TlRBeE1EVWdNQzQwTlRFNE5EZERNQzR6TXprNE5EWWdNQzQwTnpnek9URWdNQzR6TXpjeU1UUWdNQzQxTURjeU56VWdNQzR6TkRJMU1EVWdNQzQxTXpVeU16ZERNQzR6TkRjM09UWWdNQzQxTmpNeE9UZ2dNQzR6TmpBM09Ua2dNQzQxT0RreE1qTWdNQzR6T0RBd05EY2dNQzQyTVRBd09EUkRNQzR6T1RreU9UVWdNQzQyTXpFd05EVWdNQzQwTWpRd01pQXdMalkwTmpJd055QXdMalExTVRRek1TQXdMalkxTXpnMU9GWXdMamN3TlRneU0wTXdMalF6TWpnd05TQXdMamN4TlRRME55QXdMalF4TnprMU15QXdMamN6TVRBME9TQXdMalF3T1RJMU9DQXdMamMxTURFeU5rTXdMalF3TURVMk1pQXdMamMyT1RJd01pQXdMak01T0RVeU55QXdMamM1TURZME5pQXdMalF3TXpRM09TQXdMamd4TVRBeE4wTXdMalF3T0RRek1pQXdMamd6TVRNNE9TQXdMalF5TURBNE5DQXdMamcwT1RVd05pQXdMalF6TmpVMk5pQXdMamcyTWpRMk1VTXdMalExTXpBME9TQXdMamczTlRReE55QXdMalEzTXpRd05pQXdMamc0TWpRMklEQXVORGswTXpjeElEQXVPRGd5TkRaRE1DNDFNVFV6TXpZZ01DNDRPREkwTmlBd0xqVXpOVFk1TXlBd0xqZzNOVFF4TnlBd0xqVTFNakUzTlNBd0xqZzJNalEyTVVNd0xqVTJPRFkxT0NBd0xqZzBPVFV3TmlBd0xqVTRNRE14SURBdU9ETXhNemc1SURBdU5UZzFNall5SURBdU9ERXhNREUzUXpBdU5Ua3dNakUwSURBdU56a3dOalEySURBdU5UZzRNVGM1SURBdU56WTVNakF5SURBdU5UYzVORGcwSURBdU56VXdNVEkyUXpBdU5UY3dOemc0SURBdU56TXhNRFE1SURBdU5UVTFPVE0ySURBdU56RTFORFEzSURBdU5UTTNNekV4SURBdU56QTFPREl6VmpBdU5qVXhNVEl6UXpBdU5UWTRNVGcySURBdU5qUXhPREV4SURBdU5UazFNamcySURBdU5qSXlPRGt5SURBdU5qRTBOalkySURBdU5UazNNVEUyUXpBdU5qTTBNRFEzSURBdU5UY3hNelF4SURBdU5qUTBOams1SURBdU5UUXdNRFUwSURBdU5qUTFNRGN5SURBdU5UQTNPREE0VmpBdU5UQTNPREE0V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TWpreE1pQXdMalU1TlRZNE4wTXdMalUwTVRnMU15QXdMalU1TlRZNE55QXdMalU0TVRVeU9DQXdMalUxTmpBeE15QXdMalU0TVRVeU9DQXdMalV3TnpBM01rTXdMalU0TVRVeU9DQXdMalExT0RFek1TQXdMalUwTVRnMU15QXdMalF4T0RRMU55QXdMalE1TWpreE1pQXdMalF4T0RRMU4wTXdMalEwTXprM01TQXdMalF4T0RRMU55QXdMalF3TkRJNU55QXdMalExT0RFek1TQXdMalF3TkRJNU55QXdMalV3TnpBM01rTXdMalF3TkRJNU55QXdMalUxTmpBeE15QXdMalEwTXprM01TQXdMalU1TlRZNE55QXdMalE1TWpreE1pQXdMalU1TlRZNE4xb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RJek9USWlJSGt4UFNJeExqRXdNVEF6SWlCNE1qMGlNQzQwT1RJek9USWlJSGt5UFNJdE1DNHdOREExTnpNeklpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpOVVU1TmpJMElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TURJaUlITjBiM0F0WTI5c2IzSTlJaU0xUmprM01qUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJemMyUWtNeVJDSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTciIHk9IjQxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iQXp1cmUgQXBwbGljYXRpb24gR2F0ZXdheSAtPiBTdWJuZXQgMSIgc3R5bGU9ImlyLnJlZj02ZjU2YTJlNC00ZTNhLTQ3NjQtYjc4MC03Njc0NDQ5ZjAyNDQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIzIiBzb3VyY2U9IjQiIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJBenVyZSBBcHBsaWNhdGlvbiBHYXRld2F5IiBzdHlsZT0iaXIucmVmPWY1ZmU2YjIzLTdiZDAtNGUwMC04ZjM2LTY4ODgwNzk5NTRlNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtYXBwbGljYXRpb24tZ2F0ZXdheTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNRGMyT0RrZ01DNDVPVGs1T1RKRE1DNDBPRFF3TlRnZ01DNDVPVGs1T1RJZ01DNDBOakEwTWpjZ01DNDVPVEF4TkRVZ01DNDBOREkzTURRZ01DNDVOekkwTWpKTU1DNHdOREk1TlRBeElEQXVOVGN5TmpjeFF6QXVNREkxTWpJM0lEQXVOVFUwT1RRNElEQXVNREUxTXpnd09TQXdMalV6TVRNeE55QXdMakF4TlRNNE1Ea2dNQzQxTURjMk9EWkRNQzR3TVRVek9EQTVJREF1TkRnME1EVTJJREF1TURJMU1qSTNJREF1TkRZd05ESTFJREF1TURReU9UVXdNU0F3TGpRME1qY3dNa3d3TGpRME1qY3dOQ0F3TGpBME1qazFRekF1TkRZd05ESTNJREF1TURJMU1qSTNJREF1TkRnME1EVTRJREF1TURFMU16Z3dPU0F3TGpVd056WTRPU0F3TGpBeE5UTTRNRGxETUM0MU16RXpNVGtnTUM0d01UVXpPREE1SURBdU5UVTBPVFVnTUM0d01qVXlNamNnTUM0MU56STJOek1nTUM0d05ESTVOVXd3TGprM05ETTVOaUF3TGpRME5EWTNNVU13TGprNU1qRXhPU0F3TGpRMk1qTTVOQ0F4TGpBd01UazNJREF1TkRnME1EVTJJREV1TURBeE9UY2dNQzQxTURrMk5UVkRNUzR3TURFNU55QXdMalV6TXpJNE5pQXdMams1TWpFeE9TQXdMalUxTmpreE55QXdMamszTkRNNU5pQXdMalUzTkRZMFREQXVOVGN5TmpjeklEQXVPVGN5TkRJeVF6QXVOVFUwT1RVZ01DNDVPVEF4TkRVZ01DNDFNekV6TVRrZ01DNDVPVGs1T1RJZ01DNDFNRGMyT0RrZ01DNDVPVGs1T1RKYUlpQm1hV3hzUFNJak4wWkNRVEF3SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1EQTVNRFFnTUM0ek9ERXpNamhETUM0MU56TXpOelFnTUM0ME1ESXpOemtnTUM0MU5EQTVOakVnTUM0ME1USTJNVGtnTUM0MU1EZzNORFFnTUM0ME1USTJNVGxETUM0ME5qTXdOVGdnTUM0ME1USTJNVGtnTUM0ME1UYzRPRFFnTUM0ek9USXhJREF1TXpnNE1ERXhJREF1TXpVek1EVkRNQzR6TXpjd01EZ2dNQzR5T0RZME5URWdNQzR6TkRrMU9URWdNQzR4T1RFeUlEQXVOREUyTXpBNElEQXVNVFF3TVRVNFF6QXVORFF6T0RFNUlEQXVNVEU0T1RnNUlEQXVORGMyTWpreElEQXVNVEE0T0RnM0lEQXVOVEE0TkRRNUlEQXVNVEE0T0RnM1F6QXVOVFUwTVRNMUlEQXVNVEE0T0RnM0lEQXVOVGs1TXpJNUlEQXVNVEk1TkRBMklEQXVOakk1TVRneUlEQXVNVFk0TkRjMVF6QXVOamd3TWpBMUlEQXVNak0xTURrMElEQXVOalkzTkRnMElEQXVNek13TXpZMUlEQXVOakF3T1RBMElEQXVNemd4TXpJNFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVNVFVpSUdROUlrMHdMalUzTWpZM015QXdMakEwTWprMVF6QXVOVFUwT1RVZ01DNHdNalV5TWpjZ01DNDFNekV6TVRrZ01DNHdNVFV6T0RBNUlEQXVOVEEzTmpnNUlEQXVNREUxTXpnd09VTXdMalE0TkRBMU9DQXdMakF4TlRNNE1Ea2dNQzQwTmpBME1qY2dNQzR3TWpVeU1qY2dNQzQwTkRJM01EUWdNQzR3TkRJNU5Vd3dMakEwTWprMU1ERWdNQzQwTkRJM01ESkRNQzR3TWpVeU1qY2dNQzQwTmpBME1qVWdNQzR3TVRVek9EQTVJREF1TkRnME1EVTJJREF1TURFMU16Z3dPU0F3TGpVd056WTROa013TGpBeE5UTTRNRGtnTUM0MU16RXpNVGNnTUM0d01qVXlNamNnTUM0MU5UUTVORGdnTUM0d05ESTVOVEF4SURBdU5UY3lOamN4VERBdU1qWTVOREV5SURBdU56azVNVE14VERBdU5qazJOek0xSURBdU1UWTNNREV4VERBdU5UY3lOamN6SURBdU1EUXlPVFZhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEEzTmpVMUlEQXVPVEV6TkRVM1REQXVOak0zTmpJMElEQXVOemd6TkRnNFNEQXVOVFExTURkV01DNHpPVEkxTnpoSU1DNDBOamd5TjFZd0xqYzRNelE0T0Vnd0xqTTNOelk0Tmt3d0xqVXdOelkxTlNBd0xqa3hNelExTjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RrNU16Y2dNQzQyTnpRM01ERldNQzQwT1RBNE9UUk1NQzQzTWpVNE56Z2dNQzQxTlRRNU5UTk1NQzQxTlRrMU9UWWdNQzR6T0RnMk56Sk1NQzQxTURNNU1EWWdNQzQwTkRRek5qRk1NQzQyTnpBeE9EZ2dNQzQyTVRBMk5ETk1NQzQyTURZeE1qa2dNQzQyTnpRM01ERklNQzQzT0RrNU16ZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qSTFPRE1nTUM0Mk56VTBOakpJTUM0ME1EazJNVGRNTUM0ek5EVTFOemdnTUM0Mk1URTBNak5NTUM0MU1UWTFNallnTUM0ME5EQTBOelZNTUM0ME5qQTRNVGNnTUM0ek9EUTNOalpNTUM0eU9EazROamtnTUM0MU5UVTNNVFJNTUM0eU1qVTRNeUF3TGpRNU1UWTNOVll3TGpZM05UUTJNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFPRGczTVRFZ01DNHpOalV6T1RsRE1DNDFOalE0TkRRZ01DNHpPRE0yTlRRZ01DNDFNelkzTWpNZ01DNHpPVEkxTXpVZ01DNDFNRGc0SURBdU16a3lOVE0xUXpBdU5EWTVNVGM1SURBdU16a3lOVE0xSURBdU5ESTVPVGt4SURBdU16YzBOelV6SURBdU5EQTBNVEUxSURBdU16UXdPRGd5UXpBdU16VTVPRGcySURBdU1qZ3pNVEkwSURBdU16Y3dOemsySURBdU1qQXdOVE0xSURBdU5ESTROalV5SURBdU1UVTJNalkzUXpBdU5EVXlOVEU1SURBdU1UTTNPVEV6SURBdU5EZ3dOalU1SURBdU1USTVNVFVnTUM0MU1EZzFORFFnTUM0eE1qa3hOVU13TGpVME9ERTJOQ0F3TGpFeU9URTFJREF1TlRnM016VXlJREF1TVRRMk9UTXpJREF1TmpFek1qSTRJREF1TVRnd09ESXpRekF1TmpVM05EazJJREF1TWpNNE5UZ2dNQzQyTkRZME5qZ2dNQzR6TWpFeE9TQXdMalU0T0RjeE1TQXdMak0yTlRNNU9Wb2lJR1pwYkd3OUlpTTFPVUkwUkRraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVTJORFV5TVNBd0xqSTRNems0T1VNd0xqVTNOREE1TWlBd0xqSTVOalEzTkNBd0xqVTVNVGcxTkNBd0xqSTVPRGN4T1NBd0xqWXdOREkySURBdU1qZzVNamcyUXpBdU5qQTBPVEVnTUM0eU9EZzNPVFFnTUM0Mk1EVTBNRE1nTUM0eU9EZ3hPRE1nTUM0Mk1EVTVPVE1nTUM0eU9EYzJOVEpETUM0Mk1UZzJPVFVnTUM0eU9UWTFPVElnTUM0Mk1qYzBPVGNnTUM0ek1ESTFJREF1TmpNeU5EWWdNQzR6TURVNE5qZERNQzQyTXpNNU16Y2dNQzR6TURJd05qWWdNQzQyTXpRNU5ERWdNQzR5T1RnME1EUWdNQzQyTXpVNU9EVWdNQzR5T1RRMU9ETkRNQzQyTXpBM05EY2dNQzR5T1RBMk9EUWdNQzQyTWpNMk16Z2dNQzR5T0RVeU1TQXdMall4TXpNM09DQXdMakkzTmpsRE1DNDJNVFkzTkRVZ01DNHlOamd3TlRnZ01DNDJNVFUyT0RJZ01DNHlOVGMzTWlBd0xqWXdPVFV6T0NBd0xqSTBPVFkwTmtNd0xqWXdNRGN6TmlBd0xqSXpPREkyTkNBd0xqVTROVEUxT1NBd0xqSXpOVE0yT1NBd0xqVTNNams0T1NBd0xqSTBNak01T1VNd0xqVTFPVFUzT1NBd0xqSXpNRE0yTnlBd0xqVTBORGd5T1NBd0xqSXhOalUyTXlBd0xqVXlPVEk1TWlBd0xqSXdNVEV5TkVNd0xqVTNOelUzTnlBd0xqRTNOVEUxSURBdU5qRXhPRGd4SURBdU1UYzRPVFV4SURBdU5qRXhPRGd4SURBdU1UYzRPVFV4UXpBdU5qQTJNVFV4SURBdU1UY3hOalExSURBdU5UazVOek14SURBdU1UWTFNalExSURBdU5Ua3lPRGM0SURBdU1UVTVORGMxUXpBdU5UY3lOVEUySURBdU1UVTJNekkxSURBdU5UUXdPRGt4SURBdU1UVTJOamM1SURBdU5UQTBOek0ySURBdU1UYzFPRGs1VERBdU5UQTBOekUySURBdU1UYzFPRGM1UXpBdU5Ea3lOalkwSURBdU1UWXpNamMySURBdU5EZ3dOREUySURBdU1UUTVOelEzSURBdU5EWTNPVE14SURBdU1UTTFNalUwUXpBdU5EWXhPVFkwSURBdU1UTTNNVFkwSURBdU5EVTJNVEUxSURBdU1UTTVOVEkzSURBdU5EVXdORGd6SURBdU1UUXlNelF6UXpBdU5EVTVOams1SURBdU1UVTNOREkzSURBdU5EY3lNVEExSURBdU1UY3lOak1nTUM0ME9EWXdOamNnTUM0eE9EYzBOemhETUM0ME9EWXdPRGNnTUM0eE9EYzFNVGNnTUM0ME9EWXhNallnTUM0eE9EYzFNemNnTUM0ME9EWXhOallnTUM0eE9EYzFOelpETUM0ME56UTFNRGdnTUM0eE9UVTNNamtnTUM0ME5qRTFOU0F3TGpJd05qWXhPQ0F3TGpRME9UVTNOeUF3TGpJeE9USTJNVU13TGpRME9EQTBNU0F3TGpJeU1EZzVOU0F3TGpRME5qVTROQ0F3TGpJeU1qVXpJREF1TkRRMU1UUTNJREF1TWpJME1UWTBRekF1TkRNM09UazRJREF1TWpJeU5qWTNJREF1TkRNd05EYzJJREF1TWpJek1UQXhJREF1TkRJek5EUTJJREF1TWpJMU5qUXhRekF1TkRFeE5URXlJREF1TVRrNU9UQXpJREF1TkRFeU5EYzNJREF1TVRjNU1qSTNJREF1TkRFME16WTRJREF1TVRZNE5UY3pRekF1TkRBNU1UZzRJREF1TVRjME1EQTRJREF1TkRBME16UTBJREF1TVRjNU5qazVJREF1TkRBd01UZzVJREF1TVRnMU56ZzBRekF1TXprM01EYzRJREF1TVRrNE5UQTFJREF1TXprMk1Ua3lJREF1TWpFMk9EVTRJREF1TkRBMU16ZzRJREF1TWpNNE9UY3pRekF1TXprME56VTBJREF1TWpVeU9EazFJREF1TXprME1qUXlJREF1TWpjeU5qSTJJREF1TkRBMU16WTRJREF1TWpnM01UazVRekF1TkRBMk1qazBJREF1TWpnNE5DQXdMalF3TnpJM09DQXdMakk0T1RVeU1pQXdMalF3T0RNeU1pQXdMakk1TURZd05VTXdMalF3TXpRM09DQXdMak13TnpFeU55QXdMalF3TVRJNU1pQXdMak15TXpBM09DQXdMalF3TURZeU1pQXdMak16TmpjMk5FTXdMalF3TVRnMk15QXdMak16T0RRMU55QXdMalF3TVRnMk15QXdMak16T1Rnek5pQXdMalF3TXpFd05DQXdMak0wTVRRNVF6QXVOREE1TkRJMUlEQXVNelE1TlRneklEQXVOREUzTXpZeElEQXVNelUyTkRFM0lEQXVOREkxTURJeElEQXVNell5TmtNd0xqUXlOREEzTmlBd0xqTTBPREV3TnlBd0xqUXlOVEVnTUM0ek1qWTNOREVnTUM0ME16UXdOaUF3TGpNd01qWTNOME13TGpRME1ESTBNeUF3TGpNd016RTBPU0F3TGpRME5qVXlOU0F3TGpNd01qRTJOU0F3TGpRMU1qUXhNeUF3TGpJNU9UY3dNME13TGpRMU5UYzRJREF1TXpBeU5qYzNJREF1TkRVNU16QTFJREF1TXpBMU5qY2dNQzQwTmpNd09EWWdNQzR6TURnM01qSkRNQzQwTnpZd01EUWdNQzR6TVRnNU5qSWdNQzQwT0RnNU1ETWdNQzR6TWpZNU1UZ2dNQzQxTURFME5qY2dNQzR6TXpNeE9FTXdMalV3TURneE55QXdMak16T1RVNElEQXVOVEF5TkRFeUlEQXVNelEyTWpFMklEQXVOVEEyTlRZM0lEQXVNelV4TnpGRE1DNDFNVFUwTkRnZ01DNHpOak14TnpFZ01DNDFNekU0T1RFZ01DNHpOalV6TVRnZ01DNDFORE16TlRJZ01DNHpOVFkxTlRWRE1DNDFORFUzTXpVZ01DNHpOVFEzTWpNZ01DNDFORGMyTWpVZ01DNHpOVEkxTVRnZ01DNDFORGt4T0RFZ01DNHpOVEF4TlRWRE1DNDFOamsyT0RFZ01DNHpOVFEzTWpNZ01DNDFPRGMxT0RFZ01DNHpOVFUxTXpFZ01DNDJNREE0TlRRZ01DNHpOVFUxTXpGRE1DNDJNREk0T0RJZ01DNHpOVFUxTXpFZ01DNDJNVEl6TVRVZ01DNHpOREkyT1RFZ01DNDJNVGMzTXlBd0xqTXpORGN6TmtNd0xqWXdPVFkxTmlBd0xqTXpOalF5T1NBd0xqVTROVFkzTVNBd0xqTXpPVGN4T0NBd0xqVTFNamt5TXlBd0xqTXpNRE13TlVNd0xqVTFNakV6TlNBd0xqTXlOall5TWlBd0xqVTFNRFl4T1NBd0xqTXlNekExT0NBd0xqVTBPREU1TmlBd0xqTXhPVGcyT0VNd0xqVXpPVGc0TmlBd0xqTXdPRGsxT1NBd0xqVXlORFkyTkNBd0xqTXdOalU1TlNBd0xqVXhNek15TVNBd0xqTXhNemt3TVVNd0xqVXdNVGt6T1NBd0xqTXdOemN4T0NBd0xqUTVNREF3TmlBd0xqSTVPVGszT1NBd0xqUTNOemN4T0NBd0xqSTVNREkxTVVNd0xqUTNOVEl6TmlBd0xqSTRPREk0TWlBd0xqUTNNamcxTkNBd0xqSTROak16TWlBd0xqUTNNRFUxSURBdU1qZzBNell6UXpBdU5EYzRNRGN5SURBdU1qY3lOVEk0SURBdU5EYzRPRFlnTUM0eU5UY3pORFVnTUM0ME56SXlNalFnTUM0eU5EUTFPRFZETUM0ME56TTNOQ0F3TGpJME16QTJPU0F3TGpRM05USXhOeUF3TGpJME1UVTNNaUF3TGpRM05qZ3hNaUF3TGpJME1EQTNOVU13TGpRNE9EazRNaUF3TGpJeU9EWTVNeUF3TGpVd01EUTBNeUF3TGpJeE9UVTVOU0F3TGpVeE1URTFOU0F3TGpJeE1qSTVRekF1TlRFd056SXlJREF1TWpFeE9EazJJREF1TlRFd016STRJREF1TWpFeE5EWXpJREF1TlRBNU9URTFJREF1TWpFeE1EWTVRekF1TlRFd016UTRJREF1TWpFeE5EWXpJREF1TlRFd056UXlJREF1TWpFeE9EYzJJREF1TlRFeE1UYzFJREF1TWpFeU1qZERNQzQxTVRFeE56VWdNQzR5TVRJeU55QXdMalV4TVRFM05TQXdMakl4TWpJM0lEQXVOVEV4TVRVMUlEQXVNakV5TWpkRE1DNDFNamMxT1RnZ01DNHlNamMwTnpJZ01DNDFORFV3TWpZZ01DNHlOREU0T0RjZ01DNDFOakUxTkRnZ01DNHlOVFEzTmpaRE1DNDFOVGN4T1RZZ01DNHlOalF3TWpFZ01DNDFOVGM0T0RVZ01DNHlOelV6TURVZ01DNDFOalExTWpFZ01DNHlPRE01T0RsYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TVNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ERTFNemd3T1NBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzYiIHk9IjM3NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOSIgdmFsdWU9IkF6dXJlIEROUyAoRG9tYWluIE5hbWUgU3lzdGVtKSAtPiBBenVyZSBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkiIHN0eWxlPSJpci5yZWY9YTkxN2M4ZTgtYWM2My00NDUzLWJmMzMtYjQ5YTYwOGU1ZThmO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMyIgc291cmNlPSI5IiB0YXJnZXQ9IjEzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMTU2IiB5PSIxOTUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iQXp1cmUgRE5TIChEb21haW4gTmFtZSBTeXN0ZW0pIiBzdHlsZT0iaXIucmVmPWRlNjQ1NTAxLTk3Y2MtNDIwYy05YzgzLTlmYTMyYzRhOWRhMjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtRE5TO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFeU5EQmZNakkzTmpjcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOalU0TkNBd0xqZ3pNRFkyTmtNd0xqWTJPVEl5TXlBd0xqZzVPRE01TmlBd0xqVTFPRFV6TlNBd0xqa3lPRFkwT0NBd0xqUTBPRGczSURBdU9URTBOelkzUXpBdU16TTVNakEwSURBdU9UQXdPRGczSURBdU1qTTVOVFEwSURBdU9EUTBNREV4SURBdU1UY3hPREUwSURBdU56VTJOalV4UXpBdU1UQTBNRGcwSURBdU5qWTVNamt4SURBdU1EY3pPRE14TnlBd0xqVTFPRFl3TXlBd0xqQTROemN4TWpJZ01DNDBORGc1TXpoRE1DNHhNREUxT1RNZ01DNHpNemt5TnpNZ01DNHhOVGcwTmprZ01DNHlNemsyTVRRZ01DNHlORFU0TWprZ01DNHhOekU0T0RSTU1DNHlOVEF5TkRFZ01DNHhOamc1TkRORE1DNHpNemd4TURJZ01DNHhNRE16TlRrZ01DNDBORGd5TnpRZ01DNHdOelV3TlRFeElEQXVOVFUyT0RZNElEQXVNRGt3TVRVMk5FTXdMalkyTlRRMk1pQXdMakV3TlRJMk1pQXdMamMyTXpjeU5pQXdMakUyTWpVMk15QXdMamd6TURNMU15QXdMakkwT1RZek5VTXdMamc1TmprNElEQXVNek0yTnpBNElEQXVPVEkyTmlBd0xqUTBOalV6TkNBd0xqa3hNamM1SURBdU5UVTFNME13TGpnNU9EazRNU0F3TGpZMk5EQTJOaUF3TGpnME1qZzFOaUF3TGpjMk16QXdOU0F3TGpjMU5qVTROQ0F3TGpnek1EWTJOaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREJmY21Ga2FXRnNYekV5TkRCZk1qSTNOamNwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1ERXlNRFVnTUM0eE1qUXlOamhETUM0ME1qWTJOVFFnTUM0eE1qUXlOamdnTUM0ek5UTTNOemNnTUM0eE5EWXpOelVnTUM0eU9URTNPU0F3TGpFNE56YzVNME13TGpJeU9UZ3dNeUF3TGpJeU9USXhNU0F3TGpFNE1UUTVJREF1TWpnNE1EZ3hJREF1TVRVeU9UWWdNQzR6TlRZNU5UZERNQzR4TWpRME16RWdNQzQwTWpVNE16UWdNQzR4TVRZNU5qWWdNQzQxTURFMk1qTWdNQzR4TXpFMU1TQXdMalUzTkRjME1rTXdMakUwTmpBMU5TQXdMalkwTnpnMk1TQXdMakU0TVRrMU5DQXdMamN4TlRBeU5TQXdMakl6TkRZM0lEQXVOelkzTnpSRE1DNHlPRGN6T0RZZ01DNDRNakEwTlRZZ01DNHpOVFExTkRrZ01DNDROVFl6TlRZZ01DNDBNamMyTmpnZ01DNDROekE1UXpBdU5UQXdOemczSURBdU9EZzFORFEwSURBdU5UYzJOVGMySURBdU9EYzNPVGdnTUM0Mk5EVTBOVElnTUM0NE5EazBOVU13TGpjeE5ETXlPU0F3TGpneU1Ea3lNU0F3TGpjM016RTVPQ0F3TGpjM01qWXdPQ0F3TGpneE5EWXhOeUF3TGpjeE1EWXlNVU13TGpnMU5qQXpOU0F3TGpZME9EWXpOQ0F3TGpnM09ERTBNaUF3TGpVM05UYzFOaUF3TGpnM09ERTBNaUF3TGpVd01USXdOVU13TGpnM09EQXhNaUF3TGpRd01USTNOU0F3TGpnek9ESTFPQ0F3TGpNd05UUTNOU0F3TGpjMk56VTVOaUF3TGpJek5EZ3hNME13TGpZNU5qa3pOU0F3TGpFMk5ERTFNaUF3TGpZd01URXpOU0F3TGpFeU5ETTVOeUF3TGpVd01USXdOU0F3TGpFeU5ESTJPRll3TGpFeU5ESTJPRnBOTUM0M05UTTJOQ0F3TGpJMU1USXlNVU13TGpjeU1EYzNOQ0F3TGpJMk9UY3hNaUF3TGpZNE5USXhOQ0F3TGpJNE1qazBOQ0F3TGpZME9ESTFOQ0F3TGpJNU1EUXpORU13TGpZek5UUTJOQ0F3TGpJME16RTNNU0F3TGpZeE5EYzBOaUF3TGpFNU9EUXlNU0F3TGpVNE5qazROQ0F3TGpFMU9EQTRPVU13TGpZMU1EQXpOeUF3TGpFM016SXpNaUF3TGpjd056WTVPU0F3TGpJd05UUTFOU0F3TGpjMU16WTBJREF1TWpVeE1qSXhWakF1TWpVeE1qSXhXazB3TGpVd01USXdOU0F3TGpFME5UTTBOVU13TGpVeE9URXdOaUF3TGpFME5UTXpNaUF3TGpVek5qazNOeUF3TGpFME5qZ3dPQ0F3TGpVMU5EWXpNeUF3TGpFME9UYzFObFl3TGpFME9UYzFOa013TGpVNU1EUTROQ0F3TGpFNU1qUXpOU0F3TGpZeE5qRXpNaUF3TGpJME1qY3lOaUF3TGpZeU9UWXlPQ0F3TGpJNU5qZ3dOa013TGpVME1UTXhOeUF3TGpNeE1qazROeUF3TGpRMU1EZ2dNQzR6TVRJNU9EY2dNQzR6TmpJME9EZ2dNQzR5T1RZNE1EWkRNQzR6TnpVNU5EZ2dNQzR5TkRNM09USWdNQzQwTURFeU5UUWdNQzR4T1RRMU1pQXdMalF6TmpVd015QXdMakUxTWpZNU4xWXdMakUxTWpZNU4wTXdMalExTnpnd05DQXdMakUwT0RJNU5pQXdMalEzT1RRMklEQXVNVFExT0RNMUlEQXVOVEF4TWpBMUlEQXVNVFExTXpRMVZqQXVNVFExTXpRMVdrMHdMalF3TXpFM01pQXdMakUxT0RBNE9VTXdMak0zTlRBM015QXdMakU1T0RBd01TQXdMak0xTkRBeE9DQXdMakkwTWpRek1pQXdMak0wTURreU1TQXdMakk0T1RRMU5FTXdMak13TnpneE1pQXdMakk0TWpjek1pQXdMakkzTmpJek5pQXdMakkyT1Rrek5TQXdMakkwTnpjNE9TQXdMakkxTVRjeE1VTXdMakk1TURjMUlEQXVNakEzTnpZeElEQXVNelEwTWpRZ01DNHhOelUxTXpJZ01DNDBNRE14TnpJZ01DNHhOVGd3T0RsV01DNHhOVGd3T0RsYVRUQXVNalF5TXprNElEQXVOelEyTWpnNFF6QXVNalk0T1RNeUlEQXVOekk0TlRreElEQXVNams0TlRFeklEQXVOekUxT1RZZ01DNHpNamsyTkRjZ01DNDNNRGt3TXpaRE1DNHpOREU0TURJZ01DNDNOVGMzTkNBd0xqTTJORE0zT1NBd0xqZ3dNekl5T0NBd0xqTTVOVGd4T1NBd0xqZzBNak0yTVVNd0xqTXpOekkwTXlBd0xqZ3lOREV4TnlBd0xqSTRORE00T0NBd0xqYzVNVEF4T1NBd0xqSTBNak01T0NBd0xqYzBOakk0T0ZZd0xqYzBOakk0T0ZwTk1DNDFOVFkxT1RRZ01DNDROVFF4TWpWRE1DNDFNemd5TXprZ01DNDROVFkxT0RFZ01DNDFNVGszTVRjZ01DNDROVGMxTmpVZ01DNDFNREV5TURVZ01DNDROVGN3TmpaRE1DNDBOemMwT0RNZ01DNDROVGN4TWpNZ01DNDBOVE00TWpJZ01DNDROVFEyTlRnZ01DNDBNekEyTWpFZ01DNDRORGszTVRORE1DNHpPRGsxT1RNZ01DNDRNRGszTVRjZ01DNHpOakV4TkRJZ01DNDNOVGcyTURjZ01DNHpORGczTmpNZ01DNDNNREkyTmpORE1DNDBORE00TlRrZ01DNDJPRE15T1RNZ01DNDFOREU0T0RVZ01DNDJPRE15T1RNZ01DNDJNelk1T0RFZ01DNDNNREkyTmpORE1DNDJNalF6TWpnZ01DNDNOVGczTWpFZ01DNDFPVFUxTWprZ01DNDRNRGs0TkRNZ01DNDFOVFF4TkRNZ01DNDRORGszTVROTU1DNDFOVFkxT1RRZ01DNDROVFF4TWpWYVRUQXVOVGt5TXpjMklEQXVPRFEyTWpneVF6QXVOakkwTnpnMElEQXVPREEyTURreElEQXVOalEzT0RnMUlEQXVOelU1TWpFNUlEQXVOall3TURFNElEQXVOekE1TURNMlF6QXVOamswTmpreElEQXVOekUzTVRjMUlEQXVOekkzT0RBMElEQXVOek13T1RFM0lEQXVOelU0TURVeElEQXVOelE1TnpFNVF6QXVOekV5TmpZNUlEQXVOemsyTURBNElEQXVOalUxTXpBMklEQXVPREk0TnpZeklEQXVOVGt5TXpjMklEQXVPRFEwTXpJeFZqQXVPRFEyTWpneVdrMHdMalkyTkRreUlEQXVOamc0TkRRNVF6QXVOalk0T0RReElEQXVOamN3T0RBeklEQXVOamN5TWpjeklEQXVOalV5TmpZM0lEQXVOamMwTnpJeklEQXVOak16TlRWTU1DNDJOVEl4TnpZZ01DNDJNemc1TkRKRE1DNDJORGszTWpVZ01DNDJOVFF4TXpjZ01DNDJORGN5TnpRZ01DNDJOamt6TXpJZ01DNDJORE00TkRNZ01DNDJPRE0xTkRkRE1DNDFORFV6TlRRZ01DNDJOak0wTlNBd0xqUTBNemd5TVNBd0xqWTJNelExSURBdU16UTFNek15SURBdU5qZ3pOVFEzUXpBdU16UXhPVEF4SURBdU5qY3dNekV6SURBdU16TTVORFVnTUM0Mk5UWXdPVGdnTUM0ek16WTVPVGtnTUM0Mk5ERXpPVE5ETUM0ek16WTNOaklnTUM0Mk16azVNeklnTUM0ek16WTNOaklnTUM0Mk16ZzBORElnTUM0ek16WTVPVGtnTUM0Mk16WTVPREZNTUM0ek1UUTBOVElnTUM0Mk16QTJNRGxETUM0ek1UUXhPQ0F3TGpZek5URTRJREF1TXpFME1UZ2dNQzQyTXprM05qTWdNQzR6TVRRME5USWdNQzQyTkRRek16UkRNQzR6TVRRME5USWdNQzQyTmpBd01Ua2dNQzR6TVRrNE5EUWdNQzQyTnpRM01qUWdNQzR6TWpJM09EVWdNQzQyT0RnNU16bERNQzR5T0RjNE1Ea2dNQzQyT1RZMk16Y2dNQzR5TlRRMU5qZ2dNQzQzTVRBM05qVWdNQzR5TWpRM05USWdNQzQzTXpBMk1ETkRNQzR4TnpBMk56UWdNQzQyTmpVM01qVWdNQzR4TkRFMU1EZ2dNQzQxT0RNMk9EWWdNQzR4TkRJME9UY2dNQzQwT1RreU16RkRNQzR4TkRNME9EVWdNQzQwTVRRM056WWdNQzR4TnpRMU5qSWdNQzR6TXpNME5ESWdNQzR5TXpBeE5ETWdNQzR5TmprNE5EZERNQzR5TmpFek1UY2dNQzR5T0RrNU1UUWdNQzR5T1RVNE5UVWdNQzR6TURReE9UUWdNQzR6TXpJd09UZ2dNQzR6TVRJd01ERkRNQzR6TWpnMk5qY2dNQzR6TWpNM05qVWdNQzR6TWpVM01qWWdNQzR6TXpZMU1Ea2dNQzR6TWpNeU56VWdNQzR6TkRreU5UUkRNQzR6TWpBNE1qUWdNQzR6TmpFNU9UZ2dNQzR6TWpNeU56VWdNQzR6TmpFMU1EZ2dNQzR6TVRrek5UUWdNQzR6Tmpjek9Vd3dMak0wTWpNNU1TQXdMak0yTVRrNU9GWXdMak0xTXpZMk5VTXdMak0wTlRNek1pQXdMak0wTURreU1TQXdMak0wT0RJM015QXdMak15T0RZMk55QXdMak0xTVRjd05DQXdMak14Tmprd00wTXdMalF3TVRBd01pQXdMak15TlRrME55QXdMalExTVRFZ01DNHpNams0T0RrZ01DNDFNREV5TURVZ01DNHpNamcyTmpkRE1DNDFORFk1TWpRZ01DNHpNamcyTmpVZ01DNDFPVEkxTkRRZ01DNHpNalF6T1RnZ01DNDJNemMwTnpFZ01DNHpNVFU1TWpKRE1DNDJOREE1TURJZ01DNHpNamt4TlRjZ01DNDJORFF6TXpNZ01DNHpORE16TnpJZ01DNDJORGN5TnpRZ01DNHpOVGMxT0RkTU1DNDJOams0TWpJZ01DNHpOakk1TnpoRE1DNDJOall5TWpjZ01DNHpORFV6TXpJZ01DNDJOakl6TURZZ01DNHpNamc1T1RRZ01DNDJOVGd3TlRnZ01DNHpNVE01TmpKRE1DNDJPVGMzT0RnZ01DNHpNRFV5TkRFZ01DNDNNelU0TlRRZ01DNHlPVEF4T0NBd0xqYzNNRGM1TmlBd0xqSTJPVE0xTjBNd0xqZ3lOelF3TXlBd0xqTXpNelExTWlBd0xqZzFPRGc0T0NBd0xqUXhOVGczTnlBd0xqZzFPVFF5T1NBd0xqVXdNVE00T1VNd0xqZzFPVGszSURBdU5UZzJPVEF5SURBdU9ESTVOVEk1SURBdU5qWTVOekU0SURBdU56Y3pOek0zSURBdU56TTBOVEkwUXpBdU56UXdNemMxSURBdU56RXlOekE1SURBdU56QXpOVGt6SURBdU5qazJOak00SURBdU5qWTBPVElnTUM0Mk9EWTVOemhXTUM0Mk9EZzBORGxhSWlCbWFXeHNQU0lqTlVWQk1FVkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TkRBNU5qa2dNQzQwTURNeU1qaERNQzR5TlRrNElEQXVOREF3TlRJNUlEQXVNamM0T0RBMElEQXVNems1TWpFNUlEQXVNamszT0RJNElEQXVNems1TXpBMlF6QXVNekkzT1RnMUlEQXVNemsyT0RrMklEQXVNelUzT1RNMklEQXVOREEyTURBeklEQXVNemd4TmpRMklEQXVOREkwTnprMVF6QXVNemt4TURVNElEQXVORE0wTVRRMklEQXVNems0TkRjMUlEQXVORFExTXpFZ01DNDBNRE0wTkRZZ01DNDBOVGMyTVRGRE1DNDBNRGcwTVRjZ01DNDBOams1TVRJZ01DNDBNVEE0TXprZ01DNDBPRE13T1RRZ01DNDBNVEExTmpZZ01DNDBPVFl6TlRsRE1DNDBNVEV6TVRjZ01DNDFNVEV3T0RnZ01DNDBNRGt3TlRJZ01DNDFNalU0TVRVZ01DNDBNRE01TVRFZ01DNDFNemsyTXpoRE1DNHpPVGczTmprZ01DNDFOVE0wTmpFZ01DNHpPVEE0TlRrZ01DNDFOall3T0RnZ01DNHpPREEyTmpZZ01DNDFOelkzTkRaRE1DNHpOVFV6TXpFZ01DNDFPVGd5TURrZ01DNHpNakkyTWlBd0xqWXdPRGt6TnlBd0xqSTRPVFE1TlNBd0xqWXdOalkwTmtNd0xqSTNNekV5TkNBd0xqWXdOamN5TXlBd0xqSTFOamMyTVNBd0xqWXdOVGt3TlNBd0xqSTBNRFEzT1NBd0xqWXdOREU1Tmt3d0xqSTBNRGsyT1NBd0xqUXdNekl5T0ZwTk1DNHlOamM1TWpnZ01DNDFPRFl3TlRsRE1DNHlOelk1TURNZ01DNDFPRFkyTnpnZ01DNHlPRFU1TVRFZ01DNDFPRFkyTnpnZ01DNHlPVFE0T0RjZ01DNDFPRFl3TlRsRE1DNHpNRFk0TWpNZ01DNDFPRGMwTVRJZ01DNHpNVGc1TVNBd0xqVTROakF6T1NBd0xqTXpNREl6T1NBd0xqVTRNakEwTkVNd0xqTTBNVFUyT0NBd0xqVTNPREEwT1NBd0xqTTFNVGcwTWlBd0xqVTNNVFV6TlNBd0xqTTJNREk0T1NBd0xqVTJNams1TkVNd0xqTTJPRGN6TmlBd0xqVTFORFExTXlBd0xqTTNOVEV6TlNBd0xqVTBOREV3TmlBd0xqTTNPVEF3TkNBd0xqVXpNamN6TkVNd0xqTTRNamczTXlBd0xqVXlNVE0yTWlBd0xqTTROREV4TWlBd0xqVXdPVEkySURBdU16Z3lOakkySURBdU5EazNNek01UXpBdU16Z3pOak14SURBdU5EZzJNamN6SURBdU16Z3lNVEUxSURBdU5EYzFNVEl5SURBdU16YzRNVGt4SURBdU5EWTBOekkxUXpBdU16YzBNalkySURBdU5EVTBNekk1SURBdU16WTRNRE0ySURBdU5EUTBPVFUzSURBdU16VTVPVFk1SURBdU5ETTNNekUxUXpBdU16VXhPVEF5SURBdU5ESTVOamN5SURBdU16UXlNakE0SURBdU5ESXpPVFU0SURBdU16TXhOakUwSURBdU5ESXdOa013TGpNeU1UQXlNU0F3TGpReE56STBNeUF3TGpNd09UZ3dOU0F3TGpReE5qTXpNU0F3TGpJNU9EZ3dPQ0F3TGpReE56a3pNME13TGpJNE9EVTBJREF1TkRFMk9UQTNJREF1TWpjNE1UazJJREF1TkRFMk9UQTNJREF1TWpZM09USTRJREF1TkRFM09UTXpWakF1TlRnMk1EVTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBOVE0zTkNBd0xqWXdORGM1TjFZd0xqTTVPRFF6T0Vnd0xqUTNOREk1TTB3d0xqVTBNRFEyTmlBd0xqVXdNVE0zTWtNd0xqVTFORE14TVNBd0xqVXlNamt6TkNBd0xqVTJOamMxTlNBd0xqVTBOVE0yTkNBd0xqVTNOemN4T0NBd0xqVTJPRFV5TlVNd0xqVTNOVEkyTnlBd0xqVTBNVEEzTmlBd0xqVTNORGMzTnlBd0xqVXhOakEzTnlBd0xqVTNORGMzTnlBd0xqUTRNemN5TmxZd0xqTTVPRFF6T0Vnd0xqVTVPVEk0TlZZd0xqWXdORGM1TjBnd0xqVTNNak15Tmt3d0xqVXdOell5TlNBd0xqVXdNVE0zTWtNd0xqUTVNelF4SURBdU5EYzRNek0wSURBdU5EYzVOamcxSURBdU5EVXlNelUySURBdU5EWTRPVEF4SURBdU5ETXlOelE1UXpBdU5EWTRPVEF4SURBdU5EVTROekk0SURBdU5EWTRPVEF4SURBdU5EZ3hOelkySURBdU5EWTRPVEF4SURBdU5URTRNRE00VmpBdU5qQTJNalk0VERBdU5EUTFNemMwSURBdU5qQTBOemszV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkwTWprd05pQXdMalUzTWpRek4wTXdMalkxTnpjNU9TQXdMalU0TVRBM055QXdMalkzTkRjd05TQXdMalU0TlRZME1TQXdMalk1TVRreU1pQXdMalU0TlRZM01rTXdMamN4T1RNM01pQXdMalU0TlRZM01pQXdMamN6TlRBMU55QXdMalUzTVRRMU55QXdMamN6TlRBMU55QXdMalUxTURNNFF6QXVOek0xTURVM0lEQXVOVEk1TXpBeklEQXVOekkwTWpjeklEQXVOVEU1T1RrZ01DNDJPVFl6TXpRZ01DNDFNRGsyT1RaRE1DNDJOamd6T1RRZ01DNDBPVGswTURNZ01DNDJOREUwTXpVZ01DNDBPREF5T0RZZ01DNDJOREUwTXpVZ01DNDBOVEE0TnpaRE1DNDJOREU1TURrZ01DNDBOREkyT1RrZ01DNDJORFF3TlRjZ01DNDBNelEzTURZZ01DNDJORGMzTkRjZ01DNDBNamN6T1RORE1DNDJOVEUwTXpZZ01DNDBNakF3T0NBd0xqWTFOalU0T1NBd0xqUXhNell3TXlBd0xqWTJNamc0TmlBd0xqUXdPRE0yTkVNd0xqWTJPVEU0TWlBd0xqUXdNekV5TlNBd0xqWTNOalE0TnlBd0xqTTVPVEl6TlNBd0xqWTRORE0wT1NBd0xqTTVOamt6TmtNd0xqWTVNakl4TVNBd0xqTTVORFl6TmlBd0xqY3dNRFEyTVNBd0xqTTVNemszTnlBd0xqY3dPRFU0T0NBd0xqTTVORGs1TjBNd0xqY3lORE0xSURBdU16azBOVFV4SURBdU56TTVPVGc0SURBdU16azNPVEUwSURBdU56VTBNVGN6SURBdU5EQTBPREF4VERBdU56UTJNek14SURBdU5ESTJPRFU0UXpBdU56TTBNekUySURBdU5ESXdNamd6SURBdU56SXdPREV6SURBdU5ERTJPVEE0SURBdU56QTNNVEU0SURBdU5ERTNNRFUxUXpBdU5qYzROamc0SURBdU5ERTNNRFUxSURBdU5qWTNPVEEwSURBdU5ETXpOeklnTUM0Mk5qYzVNRFFnTUM0ME5EYzVNelZETUM0Mk5qYzVNRFFnTUM0ME5qSXhOU0F3TGpZNE1EWTBPU0F3TGpRM05qZzFOU0F3TGpjd09UQTNPQ0F3TGpRNE56WXpPVU13TGpjek56VXdPQ0F3TGpRNU9EUXlNaUF3TGpjMk1qQXhOaUF3TGpVeE9EQXlPU0F3TGpjMk1qQXhOaUF3TGpVME9EUXhPVU13TGpjMk1qQXhOaUF3TGpVM09EZ3dPU0F3TGpjek9EUTRPQ0F3TGpZd056Y3lPU0F3TGpZNE9UUTNNaUF3TGpZd056Y3lPVU13TGpZM01URXpPQ0F3TGpZd056a3pNeUF3TGpZMU16QTJOaUF3TGpZd016TTNNeUF3TGpZek56QXlOQ0F3TGpVNU5EUTVOVXd3TGpZME1qa3dOaUF3TGpVM01qUXpOMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eHlZV1JwWVd4SGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gzSmhaR2xoYkY4eE1qUXdYekl5TnpZM0lpQmplRDBpTUNJZ1kzazlJakFpSUhJOUlqRWlJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCbmNtRmthV1Z1ZEZSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVEV4TlNBd0xqVXhNVE15TXlrZ2MyTmhiR1VvTUM0ME1UWTJORElwSWo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNHhPQ0lnYzNSdmNDMWpiMnh2Y2owaUl6VkZRVEJGUmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4TDNKaFpHbGhiRWR5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01GOHhNalF3WHpJeU56WTNJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpnNE1qSTVPQ0lnYUdWcFoyaDBQU0l3TGpnNE1qSTVPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01URTVOaUF3TGpBMk1EQTFPRFlwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNCIgeT0iNTUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjAiIHZhbHVlPSJBenVyZSBXQUYgKFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCkgLT4gQXp1cmUgQXBwbGljYXRpb24gR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj00MzU1OGRlYi1jMzMzLTRjMWUtYjE0Ni1jZWExYzVjZjA3YTA7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC45MTE7ZW50cnlZPTAuMjg5O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMyIgc291cmNlPSIxMyIgdGFyZ2V0PSI0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMTUyIiB5PSIzNTciLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IkF6dXJlIFdBRiAoV2ViIEFwcGxpY2F0aW9uIEZpcmV3YWxsKSIgc3R5bGU9ImlyLnJlZj02ZDRhNmJkMi00MTQzLTRlNzctYmYyZi0zMTdiMmQ4ZjMyODM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdBRjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNE1Ea3pJREF1TnpZek5UQXlRekF1TmpJMk1UQTNJREF1T0RFNU16VTRJREF1TlRNME9UTXhJREF1T0RRME5ETXlJREF1TkRRME5UQTJJREF1T0RNek1qUXhRekF1TXpVME1EZ3lJREF1T0RJeU1EVXhJREF1TWpjeE56WTVJREF1TnpjMU5UQTJJREF1TWpFMU5UY3hJREF1TnpBek56ZzNRekF1TVRVNU16Y3pJREF1TmpNeU1EWTRJREF1TVRNek9EWTFJREF1TlRReE1ERXlJREF1TVRRME5qSTFJREF1TkRVd05UTTJRekF1TVRVMU16ZzBJREF1TXpZd01EVTVJREF1TWpBeE5UTTNJREF1TWpjM05USTJJREF1TWpjeU9UZzNJREF1TWpJd09UZzNUREF1TWpjM01ETTJJREF1TWpFMk9UTTRRekF1TXpRNU5UZ3lJREF1TVRZeE9UazRJREF1TkRRd09EazVJREF1TVRNM09UUTRJREF1TlRNeE1EazJJREF1TVRVd01ESTJRekF1TmpJeE1qa3pJREF1TVRZeU1UQTBJREF1TnpBek1EWTFJREF1TWpBNU16TXhJREF1TnpVNE5qQXlJREF1TWpneE5ESXlRekF1T0RFME1UTTRJREF1TXpVek5URXlJREF1T0RNNE9UUXhJREF1TkRRME5qSTNJREF1T0RJM05qQTRJREF1TlRNME9USkRNQzQ0TVRZeU56VWdNQzQyTWpVeU1UUWdNQzQzTmprM01qTWdNQzQzTURjek56TWdNQzQyT1Rnd09UTWdNQzQzTmpNMU1ESmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjl5WVdScFlXd3BJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TWpBek56Y2dNQzQxTmpFMU1qTkRNQzR5TURjM016a2dNQzQxT1RZd01Ua2dNQzR4T1RZNU1qZ2dNQzQyTXpFeE5UWWdNQzR4T0RjNU9EZ2dNQzQyTmpZM09EbE1NQzR5TVRJeU9DQXdMamN3TXpJeU4wd3dMakl6TmpVM01pQXdMamN5TnpVeE9VTXdMakkwTlRJME9TQXdMalkzT0RVMk15QXdMakkyTURJeE9DQXdMall6TURrek5DQXdMakk0TVRFd055QXdMalU0TlRneE5rTXdMakkxT0RjMU1pQXdMalU0TkRVM05pQXdMakl6TnpReUlEQXVOVGMyTURReklEQXVNakl3TXpjM0lEQXVOVFl4TlRJeldpSWdabWxzYkQwaUl6Z3pRamxHT1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qWXdPRFkwSURBdU16YzBOek0xUXpBdU1qUTNNVFUzSURBdU16TTJOelV4SURBdU1qTTNOalUwSURBdU1qazNNemM1SURBdU1qTXlOVEl6SURBdU1qVTNNekkwUXpBdU1qRTFORGsxSURBdU1qYzBNemsySURBdU1qQXdOVFEySURBdU1qa3pOREl4SURBdU1UZzNPVGc0SURBdU16RTBNREExUXpBdU1Ua3lNalEySURBdU16UTNNak0xSURBdU1qQXdOQ0F3TGpNM09UZzBPU0F3TGpJeE1qSTRJREF1TkRFeE1UY3pRekF1TWpJME56VTFJREF1TXprME56STVJREF1TWpReE5UZzBJREF1TXpneU1UQTJJREF1TWpZd09EWTBJREF1TXpjME56TTFWakF1TXpjME56TTFXaUlnWm1sc2JEMGlJemd6UWpsR09TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNamszTXpBeUlEQXVOVGc1TnpFNVF6QXVNelUzTmpjMElEQXVOVGc1TnpFNUlEQXVOREEyTmpFMUlEQXVOVFF3TnpjNElEQXVOREEyTmpFMUlEQXVORGd3TkRBM1F6QXVOREEyTmpFMUlEQXVOREl3TURNMUlEQXVNelUzTmpjMElEQXVNemN4TURrMElEQXVNamszTXpBeUlEQXVNemN4TURrMFF6QXVNak0yT1RNZ01DNHpOekV3T1RRZ01DNHhPRGM1T0RnZ01DNDBNakF3TXpVZ01DNHhPRGM1T0RnZ01DNDBPREEwTURkRE1DNHhPRGM1T0RnZ01DNDFOREEzTnpnZ01DNHlNelk1TXlBd0xqVTRPVGN4T1NBd0xqSTVOek13TWlBd0xqVTRPVGN4T1ZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5ReFgyeHBibVZoY2lraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTFPVEkyT0NBd0xqWTRNamM0TVVNd0xqUTFPVGcxTVNBd0xqWTJNelEwT0NBd0xqUTJOams0T1NBd0xqWTBORGc0T0NBd0xqUTNPVFV4TVNBd0xqWXpNREUwT0VNd0xqUTBNVFl4TkNBd0xqWXhNRFE1TmlBd0xqUXdOek0zTmlBd0xqVTRORFEzTlNBd0xqTTNPREk1TlNBd0xqVTFNekl5TTBNd0xqTTJNVGszT1NBd0xqVTNNREUySURBdU16UXdOekl4SURBdU5UZ3hORGs0SURBdU16RTNOVFkySURBdU5UZzFOakV5UXpBdU16TTJOemcwSURBdU5qQTFOVGMxSURBdU16VTNNRFUySURBdU5qSTBORGsySURBdU16YzRNamsxSURBdU5qUXlNamswUXpBdU5EQXlPREkxSURBdU5qWXlNamMySURBdU5ETXdNRGswSURBdU5qYzROak0zSURBdU5EVTVNalk0SURBdU5qa3dPRGM0VmpBdU5qZ3lOemd4V2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpFME16VTJJREF1Tmprd09EVTRRekF1TmpjMk1qUTFJREF1Tmprd09ESTBJREF1TmpNNE1qUTJJREF1TmpnMk56VXlJREF1TmpBd09Ua3pJREF1TmpjNE56RXhWakF1TmpneU56WkRNQzQyTURFd055QXdMalk1TVRnd05pQXdMalU1T1RNeE55QXdMamN3TURjM05DQXdMalU1TlRnek9DQXdMamN3T1RFeU5FTXdMalU1TWpNMU9TQXdMamN4TnpRM05DQXdMalU0TnpJeU55QXdMamN5TlRBek5DQXdMalU0TURjMUlEQXVOek14TXpRNVF6QXVOakkyTURjNUlEQXVOelF3TURnNUlEQXVOamN5TXpZeklEQXVOelF5T0RFeUlEQXVOekU0TkRBMUlEQXVOek01TkRRM1F6QXVOek0wTlRrNUlEQXVOekl6TWpVZ01DNDNOVEEzT1RRZ01DNDNNRE13TURVZ01DNDNOalk1T0RrZ01DNDJPRFk0TURsRE1DNDNORGsyTnprZ01DNDJPVEF6TWpjZ01DNDNNeklnTUM0Mk9URTJPRGNnTUM0M01UUXpOVFlnTUM0Mk9UQTROVGhXTUM0Mk9UQTROVGhhSWlCbWFXeHNQU0lqT0ROQ09VWTVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTVRFNU1pQXdMak16TkRRMVF6QXVOVGcyTVRrNElEQXVNamszTmpRMUlEQXVOalkzT0RreElEQXVNamM0TWpZZ01DNDNOVEEzT0RjZ01DNHlOemMzTjBNd0xqY3pNelUySURBdU1qVTFPRGd6SURBdU56RXpNRGM1SURBdU1qTTJOelk0SURBdU5qa3dNRFU0SURBdU1qSXhNRGc1UXpBdU5qSTBOamMzSURBdU1qSTFOemsySURBdU5UWXdORFV6SURBdU1qUXdPREkzSURBdU5EazVOemMwSURBdU1qWTFOakkwUXpBdU5EZzFPRGd6SURBdU1qY3hOVFE1SURBdU5EY3lNell6SURBdU1qYzRNekE1SURBdU5EVTVNamc0SURBdU1qZzFPRFkzUXpBdU5ESTROalkzSURBdU1qUTVNell5SURBdU5EQXhOVFUySURBdU1qRXdNRFV5SURBdU16YzRNekUySURBdU1UWTRORFUzUXpBdU16WTFNek00SURBdU1UWTVNelU1SURBdU16VXlPREF5SURBdU1UY3pOVE00SURBdU16UXhPRGM0SURBdU1UZ3dOakF6UXpBdU16WTJORFEzSURBdU1qSTBPRGN6SURBdU16azBPRGs1SURBdU1qWTJPRGMwSURBdU5ESTJPRGs1SURBdU16QTJNVEZETUM0ek9UUXhNRElnTUM0ek1qUTNNaklnTUM0ek5qUXhNVE1nTUM0ek5EYzRPVFVnTUM0ek16YzRNeUF3TGpNM05Ea3pOME13TGpNMU9UVXdNaUF3TGpNNE5EQTNNU0F3TGpNM056ZzJOaUF3TGpNNU9UWXhJREF1TXprd05EWXhJREF1TkRFNU5EY3lRekF1TkRFek1qTTRJREF1TXprMU9EUXlJREF1TkRNNU1URTFJREF1TXpjMU5ERXpJREF1TkRZM016ZzFJREF1TXpVNE56UXlRekF1TlRFeU5ETWdNQzQwTURjeU56VWdNQzQxTmpJMk5qTWdNQzQwTlRBM01qRWdNQzQyTVRjeE9ETWdNQzQwT0RneU9UaERNQzQyTWpFeU5EUWdNQzQwTnpJM05UZ2dNQzQyTWprMk56UWdNQzQwTlRnM01EZ2dNQzQyTkRFME56VWdNQzQwTkRjNE1USkRNQzQxT1RVME5qZ2dNQzQwTVRNek56WWdNQzQxTlRJeE5UY2dNQzR6TnpVME56a2dNQzQxTVRFNU1pQXdMak16TkRRMVZqQXVNek0wTkRWYUlpQm1hV3hzUFNJak9ETkNPVVk1SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk9UUXdOVEVnTUM0MU9ERXdPVE5ETUM0M016WTFNelVnTUM0MU9ERXdPVE1nTUM0M056QTVOelVnTUM0MU5EWTJOVE1nTUM0M056QTVOelVnTUM0MU1EUXhOamxETUM0M056QTVOelVnTUM0ME5qRTJPRFlnTUM0M016WTFNelVnTUM0ME1qY3lORFlnTUM0Mk9UUXdOVEVnTUM0ME1qY3lORFpETUM0Mk5URTFOamNnTUM0ME1qY3lORFlnTUM0Mk1UY3hNallnTUM0ME5qRTJPRFlnTUM0Mk1UY3hNallnTUM0MU1EUXhOamxETUM0Mk1UY3hNallnTUM0MU5EWTJOVE1nTUM0Mk5URTFOamNnTUM0MU9ERXdPVE1nTUM0Mk9UUXdOVEVnTUM0MU9ERXdPVE5hSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpNMk5EZ2dNQzQxTlRZNE1ETkRNQzQ0TVRrMklEQXVOVFV5TnpVMElEQXVPREUxTlRVeElEQXVOVFV5TnpVMElEQXVPREV4TlRBeklEQXVOVFE0TnpBMlF6QXVPREEzTkRVMElEQXVOVFEwTmpVM0lEQXVPREF6TkRBMUlEQXVOVFEwTmpVM0lEQXVOems1TXpVM0lEQXVOVFF3TmpBNFNEQXVOemsxTXpBNFREQXVOemd6TVRZeUlEQXVOVE15TlRFeFNEQXVOemM1TVRFelREQXVOelkyT1RZNElEQXVOVEkwTkRFMFF6QXVOell6T0RVZ01DNDFNemt5TWprZ01DNDNOVFV4TlRJZ01DNDFOVEl5TnpVZ01DNDNOREkyTnpZZ01DNDFOakE0TlRGRE1DNDNORFkzTWpRZ01DNDFOalE1SURBdU56VXdOemN6SURBdU5UWTBPU0F3TGpjMU9EZzNJREF1TlRZNE9UUTVTREF1TnpZeU9URTVRekF1TnpZMk9UWTRJREF1TlRjeU9UazNJREF1TnpjeE1ERTJJREF1TlRjeU9UazNJREF1TnpjMU1EWTFJREF1TlRjM01EUTJRekF1TnpnM01qRXhJREF1TlRnMU1UUXpJREF1TnprNU16VTNJREF1TlRnNU1Ua3hJREF1T0RFeE5UQXpJREF1TlRrM01qZzVRekF1T0RFMU5UVXhJREF1TlRnMU1UUXpJREF1T0RFNU5pQXdMalUyT0RrME9TQXdMamd5TXpZME9DQXdMalUxTmpnd00xb2lJR1pwYkd3OUlpTTRNMEk1UmpraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqSTVOek13TWlBd0xqVTRPVGN4T1VNd0xqTTFOelkzTkNBd0xqVTRPVGN4T1NBd0xqUXdOall4TlNBd0xqVTBNRGMzT0NBd0xqUXdOall4TlNBd0xqUTRNRFF3TjBNd0xqUXdOall4TlNBd0xqUXlNREF6TlNBd0xqTTFOelkzTkNBd0xqTTNNVEE1TkNBd0xqSTVOek13TWlBd0xqTTNNVEE1TkVNd0xqSXpOamt6SURBdU16Y3hNRGswSURBdU1UZzNPVGc0SURBdU5ESXdNRE0xSURBdU1UZzNPVGc0SURBdU5EZ3dOREEzUXpBdU1UZzNPVGc0SURBdU5UUXdOemM0SURBdU1qTTJPVE1nTUM0MU9EazNNVGtnTUM0eU9UY3pNRElnTUM0MU9EazNNVGxhSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTXpJeE5qUWdNQzQzTlRVMk1UVkRNQzQxTnpJME1USWdNQzQzTlRVMk1UVWdNQzQyTURVd016a2dNQzQzTWpJNU9EY2dNQzQyTURVd016a2dNQzQyT0RJM016bERNQzQyTURVd016a2dNQzQyTkRJME9URWdNQzQxTnpJME1USWdNQzQyTURrNE5qTWdNQzQxTXpJeE5qUWdNQzQyTURrNE5qTkRNQzQwT1RFNU1UY2dNQzQyTURrNE5qTWdNQzQwTlRreU9TQXdMalkwTWpRNU1TQXdMalExT1RJNUlEQXVOamd5TnpNNVF6QXVORFU1TWprZ01DNDNNakk1T0RjZ01DNDBPVEU1TVRjZ01DNDNOVFUyTVRVZ01DNDFNekl4TmpRZ01DNDNOVFUyTVRWYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek5EVTVNemNnTUM0MU5qRTFNak5JTUM0NE16VTRNVGhETUM0NE5ETTVNVFlnTUM0MU5qRTFNak1nTUM0NE5UWXdOakVnTUM0MU5qazJNakVnTUM0NE5UWXdOakVnTUM0MU56YzNNVGhXTUM0NE16WTRNekpETUM0NE5UVTNNVGtnTUM0NE5ESXdPRGdnTUM0NE5UTTBOellnTUM0NE5EY3dOQ0F3TGpnME9UYzFNU0F3TGpnMU1EYzJOVU13TGpnME5qQXlOeUF3TGpnMU5EUTVJREF1T0RReE1EYzFJREF1T0RVMk56TXpJREF1T0RNMU9ERTRJREF1T0RVM01EYzFTREF1TXpRMU9UTTNRekF1TXpReE1USTRJREF1T0RVMk5EZzFJREF1TXpNMk56UXhJREF1T0RVME1ETTNJREF1TXpNek56RTBJREF1T0RVd01qVTBRekF1TXpNd05qZzRJREF1T0RRMk5EY3hJREF1TXpJNU1qWXlJREF1T0RReE5qVXpJREF1TXpJNU56UXlJREF1T0RNMk9ETXlWakF1TlRneE56WTNRekF1TXpJNU1qWXlJREF1TlRjMk9UUTJJREF1TXpNd05qZzRJREF1TlRjeU1USTRJREF1TXpNek56RTBJREF1TlRZNE16UTFRekF1TXpNMk56UXhJREF1TlRZME5UWXlJREF1TXpReE1USTRJREF1TlRZeU1URXpJREF1TXpRMU9UTTNJREF1TlRZeE5USXpWakF1TlRZeE5USXpXaUlnWm1sc2JEMGlJemd5TVRBeE1DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGsxTnpnM0lEQXVOVGt6TnpWSU1DNHpOVEF3TXpkV01DNDJOVGcxTWpsSU1DNDBPVFUzT0RkV01DNDFPVE0zTlZvaUlHWnBiR3c5SWlORk5qSXpNak1pTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZMk5UYzJPU0F3TGpVNU16YzFTREF1TlRJd01ESldNQzQyTlRnMU1qbElNQzQyTmpVM05qbFdNQzQxT1RNM05Wb2lJR1pwYkd3OUlpTkdSamN6T0RFaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZ3pNVGcwT1NBd0xqVTVNemMxU0RBdU5qZzJNRGsyVmpBdU5qVTROVEk1U0RBdU9ETXhPRFE1VmpBdU5Ua3pOelZhSWlCbWFXeHNQU0lqUlRZeU16SXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTVRBM05qY2dNQzQyTnpnM01URklNQzR6TlRBd016ZFdNQzQzTkRNME9USklNQzQwTVRBM05qZFdNQzQyTnpnM01URmFJaUJtYVd4c1BTSWpSVFl5TXpJeklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNekUzTWpVZ01DNDJOemczTVRGSU1DNDNOekE1T1RaV01DNDNORE0wT1RKSU1DNDRNekUzTWpWV01DNDJOemczTVRGYUlpQm1hV3hzUFNJalJrWTNNemd4SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU9EQTJPRGdnTUM0Mk56ZzNNVEZJTUM0ME16UTVNemRXTUM0M05ETTBPVEpJTUM0MU9EQTJPRGhXTUM0Mk56ZzNNVEZhSWlCbWFXeHNQU0lqUmtZM016Z3hJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTkRZMk9Ua2dNQzQyTnpnM01URklNQzQyTURBNU5USldNQzQzTkRNME9USklNQzQzTkRZMk9UbFdNQzQyTnpnM01URmFJaUJtYVd4c1BTSWpSVFl5TXpJeklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPVFUzT0RjZ01DNDNOak0yTnpKSU1DNHpOVEF3TXpkV01DNDRNamcwTkRoSU1DNDBPVFUzT0RkV01DNDNOak0yTnpKYUlpQm1hV3hzUFNJalJUWXlNekl6SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qVTNOamtnTUM0M05qTTJOekpJTUM0MU1qQXdNbFl3TGpneU9EUTBPRWd3TGpZMk5UYzJPVll3TGpjMk16WTNNbG9pSUdacGJHdzlJaU5HUmpjek9ERWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamd6TVRnME9TQXdMamMyTXpZM01rZ3dMalk0TmpBNU5sWXdMamd5T0RRME9FZ3dMamd6TVRnME9WWXdMamMyTXpZM01sb2lJR1pwYkd3OUlpTkZOakl6TWpNaUx6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BISmhaR2xoYkVkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmNtRmthV0ZzSWlCamVEMGlNQ0lnWTNrOUlqQWlJSEk5SWpFaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUJuY21Ga2FXVnVkRlJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5EZzFPVEk1SURBdU5Ea3lNVEE1S1NCelkyRnNaU2d3TGpNME16ZzROaWtpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRTRNeUlnYzNSdmNDMWpiMnh2Y2owaUl6VkZRVEJGUmlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4TDNKaFpHbGhiRWR5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzR5T1RneE9UTWlJSGt4UFNJd0xqVTVNelkwTmlJZ2VESTlJakF1TWprMk9UTTNJaUI1TWowaU1DNDBNek16TmpJaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRRME5EUTBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzR4TWpNaUlITjBiM0F0WTI5c2IzSTlJaU5FTjBRM1JEY2lMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0ME1qRWlJSE4wYjNBdFkyOXNiM0k5SWlORlFrVkNSVUlpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDNNVFlpSUhOMGIzQXRZMjlzYjNJOUlpTkdPRVk0UmpnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkRSa05HUXlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzNyIgeT0iMjI1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii02MjUiIHk9IjE4OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIxODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE1IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJpci5yZWY9MTg2ZDBjZmItZGIwZS00YmUxLWE3NzEtNjJiZjAxY2VkZGNjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIxNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJHZW5lcmljIENsaWVudCAtPiBBenVyZSBETlMgKERvbWFpbiBOYW1lIFN5c3RlbSkiIHN0eWxlPSJpci5yZWY9ZWU4OGZlMzUtOWVmYi00Y2Y4LTgxYmYtZTI2YzU5Y2ZmNjVhO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9IjE1IiB0YXJnZXQ9IjkiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Azure WAF (Web Application Firewall) -&gt; Azure Application Gateway" ref="43558deb-c333-4c1e-b146-cea1c5cf07a0" source="803627c9-d7fe-43f3-8bc1-571442c87223" target="ed384e04-bede-4c28-9efe-7662cd1d6253">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Azure Application Gateway -&gt; Subnet 1" ref="6f56a2e4-4e3a-4764-b780-7674449f0244" source="ed384e04-bede-4c28-9efe-7662cd1d6253" target="93915a63-309d-4fd5-8cf8-1e8c346f3dac">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Azure DNS (Domain Name System) -&gt; Azure WAF (Web Application Firewall)" ref="a917c8e8-ac63-4453-bf33-b49a608e5e8f" source="f72549b9-c513-41ed-9eb7-63730d128139" target="803627c9-d7fe-43f3-8bc1-571442c87223">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Subnet 2 -&gt; Azure Load Balancer" ref="b5f80a77-f7d6-4774-9f3e-9edc98d0e506" source="70317d76-9d27-4914-b512-80a1d22080b1" target="fe531998-3fcc-461c-922d-8541f758ab35">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Subnet 1 -&gt; Azure Load Balancer" ref="b6b54baf-7d73-4fc6-85d6-42e170aabf06" source="93915a63-309d-4fd5-8cf8-1e8c346f3dac" target="c8ab2ca0-1ed2-4c22-8e96-76ed382f4049">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; Azure DNS (Domain Name System)" ref="ee88fe35-9efb-4cf8-81bf-e26c59cff65a" source="a482191d-3ddd-4a7f-8a98-da175dac0d97" target="f72549b9-c513-41ed-9eb7-63730d128139">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="c4f49ef5-fbeb-41da-b36a-c2a7c33d2be4" diagramComponentId="3f6a4bda-2a75-42be-a67f-de3f6d1abb61" ref="2b860f59-c9c6-479c-9a92-08cadbd9128a" name="Azure Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-LOGS03" name="Audit logs can be deleted" state="0" impact="100" issueId="" issueLink="">
+          <desc>There is no external backups of log records. If logs are deleted, there is no way to recover
+                        them.ed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are typically introduced during the
+                        configuration of the software.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.813">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            More information: Doc MS Azure
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.616">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-LOGS02" name="Non-auditable connections to the web application" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The status connection or failed attempts cannot be audited because they are not recorded into
+                        the logs.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Detailed error messages&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-LOGS01" name="Non-auditable resource changes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The Diagnostic Logs are not activated and configured. Therefore, the changes or the access to
+                        the resources are not recorded into the logs.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that &amp;quot;Application Logging (Filesystem)&amp;quot; and &amp;quot;Application
+                            Logging (Blob)&amp;quot; are enabled.&lt;/li&gt;
+                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
+                            are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-ACCESS-ROOT-01" name="The Root Account is mis-configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator account is not configured. The security question to recover or reset the
+                        password and the authentication method are not configured.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON06" name="Undetected brute force attempts on MS Azure management console" state="0" impact="100" issueId="" issueLink="">
+          <desc>The failure connection attempts (brute force) must be audited and monitored and correspondent
+                        personnel must be alerted and informed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when several console login failure attempts
+                            occur.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON05" name="Undetected changes in data encryption configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes on the database encryption must be audited and monitored. When there are changes
+                        on the database encryption, the security group must be alerted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the Transparent Data Encryption is
+                            disabled.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON07" name="Undetected changes in network configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Changes in network configurations (NACLs, route and gateway tables) are not detected because
+                        monitoring and alerting on the network is not configured to detect these changes.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC NACL changes.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC route table changes.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC gateway changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON01" name="Undetected changes in security configurations" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Monitoring and alerting for security configurations are not configured and changes cannot be
+                        detected.&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration
+                            changes.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the security policy changes.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the recommended configuration changes.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when activity alerts changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON04" name="Undetected changes in security groups" state="0" impact="100" issueId="" issueLink="">
+          <desc>The changes in security groups must be traced and monitored and the correspondent personnel
+                        must approve these changes. If the situation is not the correct, attackers can access to
+                        security systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the security groups or security group
+                            configurations change.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.339">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.736">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A08" name="Configure a strong security challenge questions for the user account" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        Activate and configure the security challenge question and the possibility of resetting the
+                        password by confirming the user's identity is allowed. Make sure that the security confirmation
+                        measures match the security criteria. Otherwise, it could make a weak confirmation and allow the&amp;nbsp;password
+                        reset to malicious users.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation: &amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Choose the security confirmation measures that match the security criteria and click
+                        &amp;quot;Save&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;ol&gt;
+                        &lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Azure AD self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-getting-started"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Configure the password expiration to force after a determinate time, the password code shall be
+                        changed for the users.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
+                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
+                        PowerShell. With the following command as the example:&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
+                        days. The users receive notification 14 days prior to that expiry.
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        More information:&amp;nbsp;
+                        &lt;a
+                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                        MS Azure&lt;/a&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;More information:
+                            &lt;a
+                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                            MS Azure&lt;/a&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A02" name="Configure the security challenge questions for the administrator account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Activate and configure the security challenge question and the possibility of resetting the password by confirming the user's identity is allowed. In case of being an owner account of the subscription that has full administration access, it is necessary to do this, as a security measure that this password is lost. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The security confirmation measures will depend on those specified by the Active Directory administrator. Make sure that the security confirmation measures match the security criteria. Otherwise, it could make a weak confirmation and allow the password reset to malicious users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Using the console:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;Open https://aka.ms/ssprsetup and Log into the account.&lt;/li&gt; 
+   &lt;li&gt;Respond to security measures.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Once all needed controls are finished, click on accept.&lt;/li&gt; 
+  &lt;/ol&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Using the portal:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+   &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+   &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt; 
+   &lt;li&gt;Choose the security confirmation measures that match the security criteria and click &amp;quot;Save&amp;quot;.&lt;/li&gt; 
+  &lt;/ol&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Azure AD self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-getting-started"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Using the portal:
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are filled
+                            and enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M04" name="Create alerts due of Transparent Data Encryption Deletion" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes of
+                        Transparent Data Encryption to the correspondent personnel. It's vital that these unauthorized
+                        changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the Transparent Data Encryption is
+                            disabled.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.206">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M12" name="Create alerts for changes in security groups and in security groups configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
+                        the security groups or in security groups configurations to the correspondent personnel. It's
+                        vital that these unauthorized changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the security groups or security group
+                            configurations change.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M02" name="Create alerts for security policy changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the Management
+                        Security Policies changes to the correspondent personnel. It's vital that these unauthorized
+                        changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the security policy changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M08" name="Create alerts for VPC gateway changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
+                        the VPC gateway tables to the correspondent personnel. It's vital that these unauthorized
+                        changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;VPC gateways are used as a means of sending traffic outside of VPC (i.e. to the
+                        Internet) and are vital in ensuring traffic flows to correct destination. Therefore alerting on
+                        changes to VPC gateways ensuring traffic continues to flow as expected via the correct gateway.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC gateway changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M06" name="Create alerts for VPC NACL changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
+                        the Network Access Control Lists (NACLs) to the correspondent personnel. It's vital that these
+                        unauthorized changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The Network Access Control Lists (NACLs) control inbound and outbound access to &amp;amp; from
+                        MS Azure subnets and work like packet filters to protect the network. Therefore alerting on
+                        changes to NACLs help ensure that the subnets protected by them are not exposed.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC NACL changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M07" name="Create alerts for VPC route table changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
+                        the VPC route tables to the correspondent personnel. It's vital that these unauthorized changes
+                        are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        VPC route table provides a means of routing network traffic between subnets and via gateways and
+                        ensures traffic flows via the correct path. Therefore alerting on changes to route tables
+                        ensuring the traffic continues to flow as expected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when the VPC route table changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M03" name="Create alerts to detect changes in the recommendation configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the changes in
+                        the recommendation configurations to the correspondent personnel. It's vital that these
+                        unauthorized changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to alert when the recommended configuration changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.207">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M09" name="Create alerts to detect changes on activity alerts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the alert
+                        modifications to the correspondent personnel. It's vital that these unauthorized changes are
+                        detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when activity alerts&amp;nbsp;changes.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M10" name="Create alerts to notify a bad usage of the root account" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the usage of the
+                        root accounts to the correspondent personnel. It's vital that these unauthorized changes are
+                        detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M11" name="Create alerts to notify about the console login without MFA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for Activity Log changes to monitor, audit and notify about the user's login into
+                        the console without Multi-factor Authentication to the correspondent personnel. It's vital that
+                        these unauthorized changes are detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M05" name="Create alerts to notify the console login failure attempts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Create alerts for the Activity Logs changes to monitor, audit and notify about the console login
+                        failure attempts to the correspondent personnel. It's vital that these unauthorized changes are
+                        detected.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Add activity log alert&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Filling the fields with the corresponding values.&lt;/li&gt;
+                        &lt;li&gt;Select in actions the personnel should be received this information.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when several&amp;nbsp;console login failure
+                            attempts occur.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD19" name="Create a resource lock administrator role" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Given the resource lock functionality is outside of standard Role Based Access Control(RBAC), it would be prudent to create a resource lock administrator role to prevent inadvertent unlocking of resources.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;By adding this role is you can have specific permissions granted for managing just resource locks rather than needing to provide the wide owner or contributor role reducing the risk of the user being able to do unintentional damage.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Azure Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Azure portal, open a subscription or resource group where you want the custom role to be assignable.&lt;/li&gt;&lt;li&gt;Select Access control (IAM)&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Select Add custom role`.&lt;/li&gt;&lt;li&gt;In the Custom Role Name field enter Resource Lock Administrator&lt;/li&gt;&lt;li&gt;In the Description field enter Can Administer Resource Locks&lt;/li&gt;&lt;li&gt;For Baseline permissions select Start from scratch&lt;/li&gt;&lt;li&gt;Click next&lt;/li&gt;&lt;li&gt;In the Permissions tab select Add permissions&lt;/li&gt;&lt;li&gt;In the Search for a permission box, type in Microsoft.Authorization/locks to search for permissions.&lt;/li&gt;&lt;li&gt;Select the check box next to the permission called Microsoft.Authorization/locks&lt;/li&gt;&lt;li&gt;Click add&lt;/li&gt;&lt;li&gt;Click Review+create&lt;/li&gt;&lt;li&gt;Click Create&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Assign the newly created role to the appropriate user. Using PowerShell: Below is a power shell definition for a resource lock administrator role created at an Azure Management group level&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Import-Module Az.Accounts Connect-AzAccount $role = Get-AzRoleDefinition "User Access Administrator" $role.Id = $null $role.Name = "Resource Lock Administrator" $role.Description = "Can Administer Resource Locks" $role.Actions.Clear() $role.Actions.Add("Microsoft.Authorization/locks/*") $role.AssignableScopes.Clear() * Scope at the Management group level Management group $role.AssignableScopes.Add("/providers/Microsoft.Management/managementGroups/MG-Name") New-AzRoleDefinition -Role $role Get-AzureRmRoleDefinition "Resource Lock Administrator"&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.23" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Azure Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Azure portal, open a subscription or resource group where you want the view assigned roles.&lt;/li&gt;&lt;li&gt;Select Access control (IAM)&lt;/li&gt;&lt;li&gt;Select Roles&lt;/li&gt;&lt;li&gt;Search for the custom role named &amp;lt;role_name&amp;gt; Ex. from remediation "Resource Lock Administrator"&lt;/li&gt;&lt;li&gt;Ensure that the role is assigned the appropriate user/users&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L03" name="Enable Detailed error messages" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Enable the detailed error information for HTTP status codes that indicate a failure (status code
+                        400 or greater) is saved into the logs files. This may contain information that can help
+                        determine why the server returned the error code.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                        &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                        &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Enable the &amp;quot;Detailed error messages&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Push &amp;quot;Save&amp;quot; to save the changes.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Detailed error messages&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.052">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.737">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
+  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
+                            are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.582">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N08" name="Isolate Azure resources into separate VNets by function" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Place the resources into separate VNets according to their use (production, development, test).
+                        Placing such resources accordingly ensures that a resource of a higher security level is not
+                        exposed by the security settings of a lower labeled VNet.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
+                        &lt;li&gt;Migrate or move it to the correct Vnet.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Azure Virtual Network" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
+                            &lt;li&gt;Check that the resources are into the correct Vnet.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.582">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.738">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:39.738">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="API LOGGING AND AUDITING" name="API Logging and Auditing" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNAUDITABLE-CHANGES-AZURE" name="Attackers make undetected and unaudited changes to system configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>If audit trails are not properly protected, an attacker could gain access to the
+                                system, modify the status of resources or exfiltrate sensitive data without being
+                                noticed.</desc>
+              <riskRating confidentiality="25" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-LOGS01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-L01" mitigation="20"/>
+                    <countermeasure ref="AZ-L02" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-LOGS02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-L03" mitigation="20"/>
+                    <countermeasure ref="AZ-L04" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-LOGS03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-L05" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-L01" mitigation="20"/>
+                <countermeasure ref="AZ-L02" mitigation="20"/>
+                <countermeasure ref="AZ-L03" mitigation="20"/>
+                <countermeasure ref="AZ-L04" mitigation="20"/>
+                <countermeasure ref="AZ-L05" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-ACCESS-ROOT-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A02" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A01" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A01" mitigation="25"/>
+                <countermeasure ref="AZ-A02" mitigation="25"/>
+                <countermeasure ref="AZ-A03" mitigation="25"/>
+                <countermeasure ref="AZ-A04" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                    <countermeasure ref="AZ-A08" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZ-A08" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="30"/>
+                    <countermeasure ref="AZ-A11" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="30"/>
+                <countermeasure ref="AZ-A11" mitigation="30"/>
+                <countermeasure ref="AZ-A12" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-16">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD19" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD19" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG ACTIVITY ALERTS" name="Log Activity alerts" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-SYSTEMS" name="Attackers access the systems without being detected" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected and consequently, changes made by attackers can not be audited or detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="25" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M10" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M11" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON05">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M04" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON06">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M05" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-M04" mitigation="20"/>
+                <countermeasure ref="AZ-M05" mitigation="20"/>
+                <countermeasure ref="AZ-M10" mitigation="20"/>
+                <countermeasure ref="AZ-M11" mitigation="20"/>
+                <countermeasure ref="AZ-M12" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Attackers could gain undetected access to the security system configurations and
+                                changes made by attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-MON01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M01" mitigation="25"/>
+                    <countermeasure ref="AZ-M02" mitigation="25"/>
+                    <countermeasure ref="AZ-M03" mitigation="25"/>
+                    <countermeasure ref="AZ-M09" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-M01" mitigation="25"/>
+                <countermeasure ref="AZ-M02" mitigation="25"/>
+                <countermeasure ref="AZ-M03" mitigation="25"/>
+                <countermeasure ref="AZ-M09" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-MON07">
+                  <countermeasures>
+                    <countermeasure ref="AZ-M06" mitigation="40"/>
+                    <countermeasure ref="AZ-M07" mitigation="30"/>
+                    <countermeasure ref="AZ-M08" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-M06" mitigation="40"/>
+                <countermeasure ref="AZ-M07" mitigation="30"/>
+                <countermeasure ref="AZ-M08" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNAUTHORIZED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N08" mitigation="50"/>
+                    <countermeasure ref="AZ-N09" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N08" mitigation="50"/>
+                <countermeasure ref="AZ-N09" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d88aac13-8af9-45f8-9416-e5f6189461f0" diagramComponentId="84708d10-f0ba-4c0e-a9a2-e2494ff5c53f" ref="70317d76-9d27-4914-b512-80a1d22080b1" name="Subnet 2" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="efc2c6b2-6c06-46b5-ae9d-986b1c580372" diagramComponentId="f5fe6b23-7bd0-4e00-8f36-6888079954e7" ref="ed384e04-bede-4c28-9efe-7662cd1d6253" name="Azure Application Gateway" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="microsoft-azure-application-gateway">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not adequately configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.917">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW7" name="Configure end-to-end encryption with TLS for Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Configure end-to-end encryption with TLS for Azure Application Gateway&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Encrypt all sensitive information in transit by configuring end-to-end encryption with TLS for your Azure Application Gateways.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a new application gateway with end-to-end TLS&lt;/p&gt; 
+&lt;p&gt;To create a new application gateway with end-to-end TLS encryption, you will need to first enable TLS termination while creating a new application gateway. This action enables TLS encryption for communication between the client and application gateway. Then, you will need to put on the Safe Recipients list the certificates for the backend servers in the HTTP settings. This configuration enables TLS encryption for communication between the application gateway and the backend servers. That accomplishes end-to-end TLS encryption.&lt;/p&gt; 
+&lt;p&gt;Add authentication/root certificates of backend servers&lt;/p&gt; 
+&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
+&lt;p&gt;2. Select HTTP settings from the left-side menu. Azure automatically created a default HTTP setting, appGatewayBackendHttpSettings, when you created the application gateway.&lt;/p&gt; 
+&lt;p&gt;3. Select appGatewayBackendHttpSettings.&lt;/p&gt; 
+&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Backend authentication certificates or Trusted root certificates appears.&lt;/p&gt; 
+&lt;p&gt;5. Select Create new.&lt;/p&gt; 
+&lt;p&gt;6. In the Name field, enter a suitable name.&lt;/p&gt; 
+&lt;p&gt;7. Select the certificate file in the Upload CER certificate box.&lt;/p&gt; 
+&lt;p&gt;For Standard and WAF (v1) application gateways, you should upload the public key of your backend server certificate in .cer format.&lt;/p&gt; 
+&lt;p&gt;For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the backend server certificate in .cer format. If the backend certificate is issued by a well-known certificate authority (CA), you can select the Use Well Known CA Certificate check box, and then you do not have to upload a certificate.&lt;/p&gt; 
+&lt;p&gt;8. Select Save.&lt;/p&gt; 
+&lt;p&gt;Enable end-to-end TLS for an existing application gateway&lt;/p&gt; 
+&lt;p&gt;To configure an existing application gateway with end-to-end TLS encryption, you must first enable TLS termination in the listener. This action enables TLS encryption for communication between the client and the application gateway. Then, put those certificates for backend servers in the HTTP settings on the Safe Recipients list. This configuration enables TLS encryption for communication between the application gateway and the backend servers. That accomplishes end-to-end TLS encryption.&lt;/p&gt; 
+&lt;p&gt;You will need to use a listener with the HTTPS protocol and a certificate for enabling TLS termination. You can either use an existing listener that meets those conditions or create a new listener. If you choose the former option, you can ignore the following "Enable TLS termination in an existing application gateway" section and move directly to the "Add authentication/trusted root certificates for backend servers" section.&lt;/p&gt; 
+&lt;p&gt;If you choose the latter option, apply the steps in the following procedure.&lt;/p&gt; 
+&lt;p&gt;Enable TLS termination in an existing application gateway&lt;/p&gt; 
+&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
+&lt;p&gt;2. Select Listeners from the left-side menu.&lt;/p&gt; 
+&lt;p&gt;3. Select either Basic or Multi-site listener depending on your requirements.&lt;/p&gt; 
+&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Certificate appears.&lt;/p&gt; 
+&lt;p&gt;5. Upload the PFX certificate you intend to use for TLS termination between the client and the application gateway.&lt;/p&gt; 
+&lt;p&gt;Note: For testing purposes, you can use a self-signed certificate. However, this is not advised for production workloads, because they are harder to manage and are not completely secure. &lt;/p&gt; 
+&lt;p&gt;6. Add other required settings for the Listener, depending on your requirements.&lt;/p&gt; 
+&lt;p&gt;7. Select OK to save.&lt;/p&gt; 
+&lt;p&gt;Add authentication/trusted root certificates of backend servers&lt;/p&gt; 
+&lt;p&gt;1. Select All resources, and then select myAppGateway.&lt;/p&gt; 
+&lt;p&gt;2. Select HTTP settings from the left-side menu. You can either put certificates in an existing backend HTTP setting on the Safe Recipients list or create a new HTTP setting. (In the next step, the certificate for the default HTTP setting, appGatewayBackendHttpSettings, is added to the Safe Recipients list.)&lt;/p&gt; 
+&lt;p&gt;3. Select appGatewayBackendHttpSettings.&lt;/p&gt; 
+&lt;p&gt;4. Under Protocol, select HTTPS. A pane for Backend authentication certificates or Trusted root certificates appears.&lt;/p&gt; 
+&lt;p&gt;5. Select Create new.&lt;/p&gt; 
+&lt;p&gt;6. In the Name field, enter a suitable name.&lt;/p&gt; 
+&lt;p&gt;7. Select the certificate file in the Upload CER certificate box.&lt;/p&gt; 
+&lt;p&gt;For Standard and WAF (v1) application gateways, you should upload the public key of your backend server certificate in .cer format.&lt;/p&gt; 
+&lt;p&gt;For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the backend server certificate in .cer format. If the backend certificate is issued by a well-known CA, you can select the Use Well Known CA Certificate check box, and then you do not have to upload a certificate.&lt;/p&gt; 
+&lt;p&gt;8. Select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure end-to-end TLS by using Application Gateway with the portal" url="https://docs.microsoft.com/en-us/azure/application-gateway/end-to-end-ssl-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that end-to-end encryption is enabled for all Azure Application Gateways.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Custom rules that you create 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a policy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
+&lt;/div&gt; 
+&lt;div&gt;
+  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Association tab, enter one of the following settings, then select Add: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select Review + create, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
+            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test the application gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Find the public IP address for the application gateway on its Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Copy the public IP address, and then paste it into the address bar of your browser. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable and use Traffic Analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Visualize network activity across your Azure subscriptions and identify hot spots. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Pinpoint network misconfigurations leading to failed connections in your network. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable Network Watcher 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select a network security group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable flow log settings 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling flow log settings, you must complete the following tasks: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register the Azure Insights provider, if it's not already registered for your subscription: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  New-AzStorageAccount ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Location westcentralus ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -SkuName Standard_LRS ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Kind StorageV2 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the following options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Select On for Status 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Select On for Traffic Analytics Status. 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View traffic analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
+&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
+&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
+&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
+&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW4" name="Enable DDoS Standard protection on your Azure VNets associated with Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable DDoS Standard protection on your Azure Virtual Networks Enable DDoS Standard protection on your Azure VNets associated with Application Gateway&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Enable DDoS Standard protection on your Azure Virtual Networks associated with your production instances of Azure Application Gateway to guard against DDoS attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;3. Select Create.&lt;/p&gt; 
+&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
+&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
+&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you do not have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
+
+  &lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
+
+  &lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
+2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
+3. Select your DDoS protection plan from the list.&lt;/p&gt;
+
+  &lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW3" name="Enable diagnostic settings for Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable diagnostic settings for Application Gateway&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Activity logging is automatically enabled for every Resource Manager resource. You must enable access and performance logging to start collecting the data available through those logs.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable logging through the Azure portal&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, find your resource and select Diagnostic settings.&lt;/p&gt; 
+&lt;p&gt;For Application Gateway, three logs are available:&lt;br&gt; - Access log&lt;br&gt; - Performance log&lt;br&gt; - Firewall log&lt;/p&gt; 
+&lt;p&gt;2. To start collecting data, select Turn on diagnostics.&lt;/p&gt; 
+&lt;p&gt;3. The Diagnostics settings page provides the settings for the diagnostic logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the diagnostic logs.&lt;/p&gt; 
+&lt;p&gt;4. Type a name for the settings, confirm the settings, and select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Back-end health and diagnostic logs for Application Gateway" url="https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;View and analyze the access, performance, and firewall logs&lt;/p&gt;
+
+  &lt;p&gt;Azure Monitor logs can collect the counter and event log files from your Blob storage account. It includes visualizations and powerful search capabilities to analyze your logs.&lt;/p&gt;
+
+  &lt;p&gt;You can also connect to your storage account and retrieve the JSON log entries for access and performance logs. After you download the JSON files, you can convert them to CSV and view them in Excel, Power BI, or any other data-visualization tool.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW6" name="Enable HTTPS/SSL for trusted certificates when deploying Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable HTTPS/SSL for trusted certificates when deploying Application Gateway&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Deploy Azure Application Gateway for web applications with HTTPS/SSL enabled for trusted certificates.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a self-signed certificate&lt;/p&gt; 
+&lt;p&gt;In this section, you use New-SelfSignedCertificate to create a self-signed certificate. You upload the certificate to the Azure portal when you create the listener for the application gateway.&lt;/p&gt; 
+&lt;p&gt;On your local computer, open a Windows PowerShell window as an administrator. Run the following command to create the certificate:&lt;/p&gt; 
+&lt;p&gt;New-SelfSignedCertificate ` -certstorelocation cert:\localmachine\my ` -dnsname www.contoso.com&lt;/p&gt; 
+&lt;p&gt;You should see something like this response:&lt;/p&gt; 
+&lt;p&gt;PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\my&lt;/p&gt; 
+&lt;p&gt;Thumbprint Subject&lt;br&gt; ----- ----&lt;br&gt; E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 CN=www.contoso.com&lt;/p&gt; 
+&lt;p&gt;Use Export-PfxCertificate with the Thumbprint that was returned to export a pfx file from the certificate. Make sure your password is 4 - 12 characters long:&lt;/p&gt; 
+&lt;p&gt;$pwd = ConvertTo-SecureString -String  -Force -AsPlainText&lt;br&gt; Export-PfxCertificate ` -cert cert:\localMachine\my\E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 ` -FilePath c:\appgwcert.pfx ` -Password $pwd&lt;/p&gt; 
+&lt;p&gt;Create an application gateway&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource on the left menu of the Azure portal. The New window appears.&lt;/p&gt; 
+&lt;p&gt;2. Select Networking and then select Application Gateway in the Featured list.&lt;/p&gt; 
+&lt;p&gt;Basics tab&lt;/p&gt; 
+&lt;p&gt;1. On the Basics tab, enter these values for the following application gateway settings:&lt;/p&gt; 
+&lt;p&gt;- Resource group: Select myResourceGroupAG for the resource group. If it does not exist, select Create new to create it.&lt;/p&gt; 
+&lt;p&gt;- Application gateway name: Enter myAppGateway for the name of the application gateway.&lt;/p&gt; 
+&lt;p&gt;2. For Azure to communicate between the resources that you create, it needs a virtual network. You can either create a new virtual network or use an existing one. In this example, you will create a new virtual network at the same time that you create the application gateway. Application Gateway instances are created in separate subnets. You create two subnets in this example: one for the application gateway, and another for the backend servers.&lt;/p&gt; 
+&lt;p&gt;Under Configure virtual network, create a new virtual network by selecting Create new. In the Create virtual network window that opens, enter the following values to create the virtual network and two subnets:&lt;/p&gt; 
+&lt;p&gt;- Name: Enter myVNet for the name of the virtual network.&lt;/p&gt; 
+&lt;p&gt;- Subnet name (Application Gateway subnet): The Subnets grid will show a subnet named Default. Change the name of this subnet to myAGSubnet.&lt;br&gt; The application gateway subnet can contain only application gateways. No other resources are allowed.&lt;/p&gt; 
+&lt;p&gt;- Subnet name (backend server subnet): In the second row of the Subnets grid, enter myBackendSubnet in the Subnet name column.&lt;/p&gt; 
+&lt;p&gt;- Address range (backend server subnet): In the second row of the Subnets Grid, enter an address range that does not overlap with the address range of myAGSubnet. For example, if the address range of myAGSubnet is 10.0.0.0/24, enter 10.0.1.0/24 for the address range of myBackendSubnet.&lt;/p&gt; 
+&lt;p&gt;Select OK to close the Create virtual network window and save the virtual network settings.&lt;/p&gt; 
+&lt;p&gt;3. On the Basics tab, accept the default values for the other settings and then select Next: Frontends.&lt;/p&gt; 
+&lt;p&gt;Frontends tab&lt;/p&gt; 
+&lt;p&gt;1. On the Frontends tab, verify Frontend IP address type is set to Public.&lt;br&gt; You can configure the Frontend IP to be Public or Private as per your use case. In this example, you will choose a Public Frontend IP.&lt;/p&gt; 
+&lt;p&gt;Note: For the Application Gateway v2 SKU, you can only choose Public frontend IP configuration. Private frontend IP configuration is currently not enabled for this v2 SKU.&lt;/p&gt; 
+&lt;p&gt;2. Choose Create new for the Public IP address and enter myAGPublicIPAddress for the public IP address name, and then select OK.&lt;/p&gt; 
+&lt;p&gt;3. Select Next: Backends.&lt;/p&gt; 
+&lt;p&gt;Backends tab&lt;/p&gt; 
+&lt;p&gt;The backend pool is used to route requests to the backend servers that serve the request. Backend pools can be composed of NICs, virtual machine scale sets, public IPs, internal IPs, fully qualified domain names (FQDN), and multi-tenant backends like Azure App Service. In this example, you will create an empty backend pool with your application gateway and then add backend targets to the backend pool.&lt;/p&gt; 
+&lt;p&gt;1. On the Backends tab, select +Add a backend pool.&lt;/p&gt; 
+&lt;p&gt;2. In the Add a backend pool window that opens, enter the following values to create an empty backend pool:&lt;/p&gt; 
+&lt;p&gt;- Name: Enter myBackendPool for the name of the backend pool.&lt;br&gt; - Add backend pool without targets: Select Yes to create a backend pool with no targets. You will add backend targets after creating the application gateway.&lt;/p&gt; 
+&lt;p&gt;3. In the Add a backend pool window, select Add to save the backend pool configuration and return to the Backends tab.&lt;/p&gt; 
+&lt;p&gt;4. On the Backends tab, select Next: Configuration.&lt;/p&gt; 
+&lt;p&gt;Configuration tab&lt;/p&gt; 
+&lt;p&gt;On the Configuration tab, you will connect the frontend and backend pool you created using a routing rule.&lt;/p&gt; 
+&lt;p&gt;1. Select Add a rule in the Routing rules column.&lt;/p&gt; 
+&lt;p&gt;2. In the Add a routing rule window that opens, enter myRoutingRule for the Rule name.&lt;/p&gt; 
+&lt;p&gt;3. A routing rule requires a listener. On the Listener tab within the Add a routing rule window, enter the following values for the listener:&lt;/p&gt; 
+&lt;p&gt;- Listener name: Enter myListener for the name of the listener.&lt;br&gt; - Frontend IP: Select Public to choose the public IP you created for the frontend.&lt;br&gt; - Protocol: Select HTTPS.&lt;br&gt; - Port: Verify 443 is entered for the port.&lt;/p&gt; 
+&lt;p&gt;Under HTTPS Certificate:&lt;/p&gt; 
+&lt;p&gt;- PFX certificate file - Browse to and select the c:\appgwcert.pfx file that you create earlier.&lt;/p&gt; 
+&lt;p&gt;- Certificate name - Type mycert1 for the name of the certificate.&lt;/p&gt; 
+&lt;p&gt;- Password - Type your password.&lt;/p&gt; 
+&lt;p&gt;Accept the default values for the other settings on the Listener tab, then select the Backend targets tab to configure the rest of the routing rule.&lt;/p&gt; 
+&lt;p&gt;4. On the Backend targets tab, select myBackendPool for the Backend target.&lt;/p&gt; 
+&lt;p&gt;5. For the HTTP setting, select Create new to create a new HTTP setting. The HTTP setting will determine the behavior of the routing rule. In the Add an HTTP setting window that opens, enter myHTTPSetting for the HTTP setting name. Accept the default values for the other settings in the Add an HTTP setting window, then select Add to return to the Add a routing rule window.&lt;/p&gt; 
+&lt;p&gt;6. On the Add a routing rule window, select Add to save the routing rule and return to the Configuration tab.&lt;/p&gt; 
+&lt;p&gt;7. Select Next: Tags and then Next: Review + create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Configure an application gateway with TLS termination using the Azure portal" url="https://docs.microsoft.com/en-us/azure/application-gateway/create-ssl-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the application gateway&lt;/p&gt;
+
+  &lt;p&gt;1. Select All resources, and then select myAGPublicIPAddress.&lt;/p&gt;
+
+  &lt;p&gt;2. In the address bar of your browser, type https://&lt;your application gateway IP address&gt;.&lt;/p&gt;
+
+  &lt;p&gt;To accept the security warning if you used a self-signed certificate, select Details (or Advanced on Chrome) and then go on to the webpage.&lt;/p&gt;
+
+  &lt;p&gt;Your secured IIS website is then displayed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-NSG-FLOW-LOGS" name="Enable NSG flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable NSG flow logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable NSG flow log&lt;/p&gt; 
+&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
+&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
+&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
+&lt;p&gt;The storage account may take around minute to create. Do not continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
+&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
+&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
+&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
+&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
+&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
+&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
+&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that NSG flow logs are enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable WAF logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable logging through the Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. In the Azure portal, find your resource and select Diagnostic settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Application Gateway, three logs are available: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Access log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Performance log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Firewall log 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. To start collecting data, select Turn on diagnostics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Type a name for the settings, confirm the settings, and select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that all WAF logs are enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-CRED-SCAN" name="Implement Credential Scanner to identify credentials within code" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement Credential Scanner to identify credentials within code&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Prerequisites:&lt;br&gt; 1. You are using the Azure DevOps Build system.&lt;br&gt; 2. The Microsoft Security Code Analysis Extension installed in your account.&lt;br&gt; Setup:&lt;br&gt; 1. Open your team project from your Azure DevOps Account.&lt;br&gt; 2. Navigate to the Build tab under Build and Release&lt;br&gt; 3. Select the Build Definition into which you wish to add the CredScan build task.&lt;br&gt; - New - Click New and follow the steps detailed to create a new Build Definition.&lt;br&gt; - Edit - Select the Build Definition. On the subsequent page, click Edit to begin editing the Build Definition.&lt;br&gt; 4. Click + to navigate to the Add Tasks pane.&lt;br&gt; 5. Find the CredScan build task either from the list or using the search box and then click Add.&lt;br&gt; 6. The Run CredScan build task should now be a part of the Build Definition.&lt;/p&gt; 
+&lt;p&gt;Customizing the CredScan Build Task:&lt;br&gt; 1. Click the task Run CredScan to see the different options available within.&lt;br&gt; 2. Available options include&lt;br&gt; Output Format - TSV/ CSV/ SARIF/ PREfast&lt;br&gt; Tool Version (Recommended: Latest)&lt;br&gt; Scan Folder - The folder in your repository to scan&lt;br&gt; Searchers File Type - Options to locate the searchers file used for scanning.&lt;br&gt; Suppressions File - A JSON file can be used for suppressing issues in the output log (more details in the Resources section).&lt;br&gt; (New) Verbose Output - self explanatory&lt;br&gt; Batch Size - The number of concurrent threads used to run Credential Scanners in parallel. Defaults to 20 (Value must be in the range of 1 to 2147483647).&lt;br&gt; (New) Match Timeout - The amount of time to spend attempting a searcher match before abandoning the check.&lt;br&gt; (New) File Scan Read Buffer Size - Buffer size while reading content in bytes. (Defaults to 524288)&lt;br&gt; (New) Maximum File Scan Read Bytes - Maximum number of bytes to read from a given file during content analysis. (Defaults to 104857600)&lt;br&gt; Run this task (under Control Options) - Specifies when the task should run. Choose "Custom conditions" to specify more complex conditions.&lt;/p&gt; 
+&lt;p&gt;*Version - Build task version within Azure DevOps. Not frequently used.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Getting started with Credential Scanner (CredScan)" url="https://secdevtools.azurewebsites.net/helpcredscan.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Credential Scanner is implemented&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
+&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APPROVED-LOCATIONS" name="Manage Azure resources from only approved locations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Manage Azure resources from only approved locations 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use Conditional Access Named Locations to allow access from only specific logical groupings of IP address ranges or countries/regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Prerequisites 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - An Azure AD tenant. Sign up for a free trial. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - A user, who is a global administrator for the tenant. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - An IP range that is established and credible in your organization. The IP range needs to be in Classless Interdomain Routing (CIDR) format. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure named locations 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the left pane, select Azure Active Directory, then select Conditional Access from the Security section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Conditional Access page, select Named locations and select New location. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Fill out the form on the new page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In the Name box, type a name for your named location. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In the IP ranges box, type the IP range in CIDR format. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Click Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Configure named locations in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that you have configured named locations in your Azure environment.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
+  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
+  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
+  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
+  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
+  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
+  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
+  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
+                            subscription.&lt;/li&gt;
+                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
+                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
+&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
+&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
+&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
+&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
+&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
+&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
+&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
+&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
+&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
+&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
+&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
+&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
+&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
+&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
+&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
+&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
+            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW5" name="Use Azure app registration to interact with Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure app registration to interact with Application Gateway&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use an Azure app registration (service principal) to retrieve a token that can be used to interact with your Azure Application Gateways via API calls.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Client registration&lt;/p&gt; 
+&lt;p&gt;To register a client that accesses an Azure Resource Manager REST API, see Reference URL. The article shows you how to:&lt;/p&gt; 
+&lt;p&gt;- Register the client application with Azure AD.&lt;br&gt; - Set permission requests to allow the client to access the Azure Resource Manager API.&lt;br&gt; - Configure Azure Resource Manager Role-Based Access Control (RBAC) settings for authorizing the client.&lt;/p&gt; 
+&lt;p&gt;If your client accesses an API other than an Azure Resource Manager API, refer to:&lt;/p&gt; 
+&lt;p&gt;- Register an application with the Microsoft identity platform&lt;br&gt; - Register the client application with Azure AD, in the "Register an application" section.&lt;br&gt; - Create a secret key (if you are registering a web client), in the "Add credentials" section.&lt;br&gt; - Configure an application to expose a web API&lt;br&gt; - Add permissions to your web API, exposing them as scopes&lt;br&gt; - Configure a client application to access a web API&lt;br&gt; - Add permission requests as required by the scopes defined for the API, in the "Add permissions to access your web API" section.&lt;/p&gt; 
+&lt;p&gt;Now that you have completed registration of your client application, move on to your client code where you create the REST request and handle the response.&lt;/p&gt; 
+&lt;p&gt;Acquire an access token&lt;/p&gt; 
+&lt;p&gt;After you have a valid client registration, you have two ways to integrate with Azure AD to acquire an access token:&lt;/p&gt; 
+&lt;p&gt;- Platform- and language-neutral OAuth2 service endpoints, which we use in this article. The instructions provided in this section assume nothing about your client's platform or language/script when you use the Azure AD OAuth endpoints. The only requirement is that you can send/receive HTTPS requests to/from Azure AD, and parse the response message.&lt;br&gt; - The platform- and language-specific Microsoft Authentication Libraries (MSAL), which is beyond the scope of this article. The libraries provide asynchronous wrappers for the OAuth2 endpoint requests, and robust token-handling features such as caching and refresh token management. For more information, see the Overview of Microsoft Authentication Library (MSAL).&lt;/p&gt; 
+&lt;p&gt;The two Azure AD endpoints that you use to authenticate your client and acquire an access token are referred to as the OAuth2 /authorize and /token endpoints. How you use them depends on your application's registration and the type of OAuth2 authorization grant flow you need to support your application at run-time. For the purposes of this article, we assume that your client uses one of the following authorization grant flows: authorization code or client credentials. To acquire an access token used in the remaining sections, follow the instructions for the flow that best matches your scenario.&lt;/p&gt; 
+&lt;p&gt;Authorization code grant (interactive clients)&lt;/p&gt; 
+&lt;p&gt;This grant is used by both web and native clients, requiring credentials from a signed-in user in order to delegate resource access to the client application. It uses the /authorize endpoint to obtain an authorization code (in response to user sign-in/consent), followed by the /token endpoint to exchange the authorization code for an access token.&lt;/p&gt; 
+&lt;p&gt;1. First, your client needs to request an authorization code from Azure AD. For details on the format of the HTTPS GET request to the /authorize endpoint, and example request/response messages, see Request an authorization code. The URI contains the following query-string parameters, which are specific to your client application:&lt;/p&gt; 
+&lt;p&gt;- client_id: A GUID that was assigned to your client application during registration, also known as an application ID.&lt;/p&gt; 
+&lt;p&gt;- redirect_uri: A URL-encoded version of one of the reply/redirect URIs, specified during registration of your client application. The value you pass must match your registration value exactly.&lt;/p&gt; 
+&lt;p&gt;- resource: A URL-encoded identifier URI that's specified by the REST API you are calling. Web/REST APIs (also known as resource applications) can expose one or more application ID URIs in their configuration. For example:&lt;/p&gt; 
+&lt;p&gt;- Azure Resource Manager provider (and classic deployment model) APIs use https://management.core.windows.net/.&lt;br&gt; - For any other resources, see the API documentation or the resource application's configuration in the Azure portal.&lt;/p&gt; 
+&lt;p&gt;The request to the /authorize endpoint first triggers a sign-in prompt to authenticate the user. The response you get back is delivered as a redirect (302) to the URI that you specified in redirect_uri. The response header message contains a location field, containing the redirect URI followed by a code query parameter. The code parameter contains the authorization code that you need for step 2.&lt;/p&gt; 
+&lt;p&gt;2. Next, your client needs to redeem the authorization code for an access token. Because this is a POST request, you package your application-specific parameters in the request body. In addition to some of the previously mentioned parameters (along with other new ones), you will pass:&lt;/p&gt; 
+&lt;p&gt;- code: This query parameter contains the authorization code that you obtained in step 1.&lt;/p&gt; 
+&lt;p&gt;- client_secret: You need this parameter only if your client is configured as a web application. This is the same secret/key value that you generated earlier, in client registration.&lt;/p&gt; 
+&lt;p&gt;Client credentials grant (non-interactive clients)&lt;/p&gt; 
+&lt;p&gt;This grant is used only by web clients, allowing the application to access resources directly (no user delegation) using the client's credentials, which are provided at registration time. The grant is typically used by non-interactive clients (no UI) that run as a service or daemon. It requires only the /token endpoint to acquire an access token.&lt;/p&gt; 
+&lt;p&gt;The client/resource interactions for this grant are similar to step 2 of the authorization code grant.&lt;/p&gt; 
+&lt;p&gt;Assemble the request message&lt;/p&gt; 
+&lt;p&gt;Most programming languages or frameworks and scripting environments make it easy to assemble and send the request message. They typically provide a web/HTTP class or API that abstracts the creation or formatting of the request, making it easier to write the client code (the HttpWebRequest class in the .NET Framework, for example). For brevity, and because most of the task is handled for you, this section covers only the important elements of the request.&lt;/p&gt; 
+&lt;p&gt;Request URI&lt;/p&gt; 
+&lt;p&gt;Because sensitive information is being transmitted and received, all REST requests require the HTTPS protocol for the URI scheme, giving the request and response a secure channel. The information (that is, the Azure AD authorization code, access/bearer token, and sensitive request/response data) is encrypted by a lower transport layer, ensuring the privacy of the messages.&lt;/p&gt; 
+&lt;p&gt;The remainder of your service's request URI (the host, resource path, and any required query-string parameters) are determined by its related REST API specification. For example, Azure Resource Manager provider APIs use https://management.azure.com/, and Azure classic deployment model uses https://management.core.windows.net/. Both require an api-version query-string parameter.&lt;/p&gt; 
+&lt;p&gt;Request header&lt;/p&gt; 
+&lt;p&gt;The request URI is bundled in the request message header, along with any additional fields required by your service's REST API specification and the HTTP specification. Your request might require the following common header fields:&lt;/p&gt; 
+&lt;p&gt;- Authorization: Contains the OAuth2 bearer token to secure the request, as acquired earlier from Azure AD.&lt;br&gt; - Content-Type: Typically set to "application/json" (name/value pairs in JSON format), and specifies the MIME type of the request body.&lt;br&gt; - Host: The domain name or IP address of the server where the REST service endpoint is hosted.&lt;/p&gt; 
+&lt;p&gt;Request body&lt;/p&gt; 
+&lt;p&gt;As mentioned earlier, the request message body is optional, depending on the specific operation you are requesting and its parameter requirements. If it's required, the API specification for the service you are requesting also specifies the encoding and format.&lt;/p&gt; 
+&lt;p&gt;The request body is separated from the header by an empty line, formatted in accordance with the Content-Type header field. An example of an "application/json" formatted body would appear as follows:&lt;/p&gt; 
+&lt;p&gt;{ "": ""&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure REST API reference" url="https://docs.microsoft.com/en-us/rest/api/azure/"/>
+            <reference name="Quickstart: Register an application with the Microsoft identity platform" url="https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Send the request&lt;/p&gt;
+
+  &lt;p&gt;Now that you have the service's request URI and have created the related request message header and body, you are ready to send the request to the REST service endpoint.&lt;/p&gt;
+
+  &lt;p&gt;For example, you might send an HTTPS GET request method for an Azure Resource Manager provider by using request header fields that are similar to the following (note that the request body is empty):&lt;/p&gt;
+
+  &lt;p&gt;GET /subscriptions?api-version=2014-04-01-preview HTTP/1.1&lt;br /&gt;
+Authorization: Bearer &lt;bearer-token&gt;&lt;br /&gt;
+Host: management.azure.com&lt;/p&gt;
+
+  &lt;p&gt;&lt;no body&gt;&lt;/p&gt;
+
+  &lt;p&gt;And you might send an HTTPS PUT request method for an Azure Resource Manager provider, by using request header and body fields similar to the following example:&lt;/p&gt;
+
+  &lt;p&gt;PUT /subscriptions/.../resourcegroups/ExampleResourceGroup?api-version=2016-02-01  HTTP/1.1&lt;br /&gt;
+Authorization: Bearer &lt;bearer-token&gt;&lt;br /&gt;
+Content-Length: 29&lt;br /&gt;
+Content-Type: application/json&lt;br /&gt;
+Host: management.azure.com&lt;/p&gt;
+
+  &lt;p&gt;{
+  "location": "West US"&lt;br /&gt;
+}&lt;/p&gt;
+
+  &lt;p&gt;After you make the request, the response message header and optional body are returned.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-GW1" name="Use Azure Key Vault to securely store Application Gateway certificates" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Key Vault to securely store Application Gateway certificates&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure Key Vault is a platform-managed secret store that you can use to safeguard secrets, keys, and SSL certificates. Azure Application Gateway supports integration with Key Vault for server certificates that are attached to HTTPS-enabled listeners. This support is limited to the Application Gateway v2 SKU.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Application Gateway integration with Key Vault requires a three-step configuration process:&lt;/p&gt; 
+&lt;p&gt;1. Create a user-assigned managed identity&lt;/p&gt; 
+&lt;p&gt;You create or reuse an existing user-assigned managed identity, which Application Gateway uses to retrieve certificates from Key Vault on your behalf. For more information, see Create, list, delete, or assign a role to a user-assigned managed identity using the Azure portal. This step creates a new identity in the Azure Active Directory tenant. The identity is trusted by the subscription that's used to create the identity.&lt;/p&gt; 
+&lt;p&gt;2. Configure your key vault&lt;/p&gt; 
+&lt;p&gt;You then either import an existing certificate or create a new one in your key vault. The certificate will be used by applications that run through the application gateway. In this step, you can also use a key vault secret that's stored as a password-less, base-64 encoded PFX file. We recommend using a certificate type because of the auto-renewal capability that's available with certificate type objects in the key vault. After you have created a certificate or a secret, you define access policies in the key vault to allow the identity to be granted get access to the secret.&lt;/p&gt; 
+&lt;p&gt;Important: Application Gateway currently requires Key Vault to allow access from all networks in order to leverage the integration. It does not support Key Vault integration when Key Vault is set to only allow private endpoints and select networks access. Support for private and select networks is in the works for full integration of Key Vault with Application Gateway.&lt;/p&gt; 
+&lt;p&gt;Note: If you deploy the application gateway via an ARM template, either by using the Azure CLI or PowerShell, or via an Azure application deployed from the Azure portal, the SSL certificate is stored in the key vault as a base64-encoded PFX file. You must complete the steps in Use Azure Key Vault to pass secure parameter value during deployment.&lt;br&gt; It is particularly important to set enabledForTemplateDeployment to true. The certificate may be password-less or it may have a password. In the case of a certificate with a password, the following example shows a possible configuration for the sslCertificates entry in the properties for the ARM template configuration for an app gateway. The values of appGatewaySSLCertificateData and appGatewaySSLCertificatePassword are looked up from the key vault as described in the section Reference secrets with dynamic ID. Follow the references backward from parameters('secretName') to see how the lookup happens. If the certificate is pass-wordless, omit the password entry.&lt;/p&gt; 
+&lt;p&gt;"sslCertificates": [ { "name": "appGwSslCertificate", "properties": { "data": "[parameters('appGatewaySSLCertificateData')]", "password": "[parameters('appGatewaySSLCertificatePassword')]" } }&lt;br&gt; ]&lt;/p&gt; 
+&lt;p&gt;3. Configure the application gateway&lt;/p&gt; 
+&lt;p&gt;After you complete the two preceding steps, you can set up or modify an existing application gateway to use the user-assigned managed identity.&lt;br&gt; You can also configure the HTTP listener's TLS/SSL certificate to point to the complete URI of the Key Vault certificate or secret ID.&lt;/p&gt; 
+&lt;p&gt;To see how to backup customer managed certificates within Azure Key Vault, please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Backup-AzureKeyVaultCertificate" url="https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/backup-azurekeyvaultcertificate?view=azurermps-6.13.0"/>
+            <reference name="TLS termination with Key Vault certificates" url="https://docs.microsoft.com/en-us/azure/application-gateway/key-vault-certs"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Application Gateway is integrated with Azure Key Vault.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.776">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
+&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="34"/>
+                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="34"/>
+                <countermeasure ref="AZ-A04" mitigation="33"/>
+                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                <countermeasure ref="AZURE-SSO" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VM01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-V02" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-V02" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-APP-GW1" mitigation="50"/>
+                    <countermeasure ref="AZURE-CRED-SCAN" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-APP-GW1" mitigation="50"/>
+                <countermeasure ref="AZURE-CRED-SCAN" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="11"/>
+                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="11"/>
+                    <countermeasure ref="AZ-L01" mitigation="11"/>
+                    <countermeasure ref="AZ-L05" mitigation="11"/>
+                    <countermeasure ref="AZ-M01" mitigation="11"/>
+                    <countermeasure ref="AZURE-APP-GW3" mitigation="11"/>
+                    <countermeasure ref="AZURE-MONITOR6" mitigation="11"/>
+                    <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="12"/>
+                    <countermeasure ref="AZURE-SENTINEL" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="11"/>
+                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="11"/>
+                <countermeasure ref="AZ-L01" mitigation="11"/>
+                <countermeasure ref="AZ-L05" mitigation="11"/>
+                <countermeasure ref="AZ-M01" mitigation="11"/>
+                <countermeasure ref="AZURE-APP-GW3" mitigation="11"/>
+                <countermeasure ref="AZURE-MONITOR6" mitigation="11"/>
+                <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="12"/>
+                <countermeasure ref="AZURE-SENTINEL" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N01" mitigation="14"/>
+                    <countermeasure ref="AZURE-APP-GW4" mitigation="14"/>
+                    <countermeasure ref="AZURE-APP-GW5" mitigation="14"/>
+                    <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="15"/>
+                    <countermeasure ref="AZURE-WAF-GW" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-NON-IDENTIFY">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-TAGS" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="15"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N01" mitigation="14"/>
+                <countermeasure ref="AZ-N09" mitigation="15"/>
+                <countermeasure ref="AZURE-APP-GW4" mitigation="14"/>
+                <countermeasure ref="AZURE-APP-GW5" mitigation="14"/>
+                <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="15"/>
+                <countermeasure ref="AZURE-TAGS" mitigation="14"/>
+                <countermeasure ref="AZURE-WAF-GW" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-APP-GW6" mitigation="50"/>
+                    <countermeasure ref="AZURE-APP-GW7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-APP-GW6" mitigation="50"/>
+                <countermeasure ref="AZURE-APP-GW7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d00dd004-6dab-4a06-80d9-8b2a69722f17" diagramComponentId="2d31801e-2650-4934-bec0-c4c790eed674" ref="fe531998-3fcc-461c-922d-8541f758ab35" name="Azure Load Balancer" desc="" library="" parentComponentRef="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" componentDefinitionRef="microsoft-azure-load-balancer">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.609">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not adequately configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.608">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-04" name="Unauthorized connection attempts on Azure resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Azure resources is most likely to be receiving an
+                        attack. To avoid this, access to the network must be as restricted as possible using Network
+                        Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Network security groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select the Network Security Group (NSG) for your virtual machine and click on
+                            &amp;quot;Inbound security rules&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is a rule to deny the inbound access from a blacklisted IP
+                            address or range to a designated port or port range.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.608">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.885">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable and use Traffic Analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Visualize network activity across your Azure subscriptions and identify hot spots. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Pinpoint network misconfigurations leading to failed connections in your network. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable Network Watcher 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select a network security group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable flow log settings 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling flow log settings, you must complete the following tasks: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register the Azure Insights provider, if it's not already registered for your subscription: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  New-AzStorageAccount ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Location westcentralus ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -SkuName Standard_LRS ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Kind StorageV2 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the following options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Select On for Status 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Select On for Traffic Analytics Status. 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View traffic analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;3. Select Create.&lt;/p&gt; 
+&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
+&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
+&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
+
+	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
+
+	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
+2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
+3. Select your DDoS protection plan from the list.&lt;/p&gt;
+
+	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
+&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
+&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
+&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
+&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-NSG-LOGS" name="Enable Network Security Group flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Network Security Group (NSG) flow logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. &lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to enable NSG flow log&lt;/p&gt; 
+&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
+&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
+&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
+&lt;p&gt;The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
+&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
+&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
+&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
+&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
+&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
+&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
+&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Download flow log&lt;/p&gt;
+
+	&lt;p&gt;1. From Network Watcher, in the portal, select NSG flow logs under LOGS.&lt;/p&gt;
+
+	&lt;p&gt;2. Select You can download flow logs from configured storage accounts.&lt;/p&gt;
+
+	&lt;p&gt;3. Select the storage account that you configured in step 2 of Enable NSG flow log (Remediation section).&lt;/p&gt;
+
+	&lt;p&gt;4. Under Blob service, select Containers, and then select the insights-logs-networksecuritygroupflowevent container.&lt;/p&gt;
+
+	&lt;p&gt;5. In the container, navigate the folder hierarchy until you get to a PT1H.json file. Log files are written to a folder hierarchy that follows the following naming convention: https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json&lt;/p&gt;
+
+	&lt;p&gt;6. Select ... to the right of the PT1H.json file and select Download.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.886">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing&lt;/p&gt;
+
+  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
+
+  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SECURE-CONFIG" name="Establish secure configurations with Azure Policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Establish secure configurations for Azure Traffic Manager&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.&lt;/p&gt; 
+&lt;p&gt;Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.&lt;/p&gt; 
+&lt;p&gt;All Azure Policy data and objects are encrypted at rest.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Define and implement standard security configurations for Azure Traffic Manager with Azure Policy&lt;/p&gt; 
+&lt;p&gt;1. Use Azure Policy to put restrictions on the type of resources that can be created in your and in customer subscriptions using the following built-in policy definitions:&lt;br&gt; - Not allowed resource types&lt;br&gt; - Allowed resource types&lt;br&gt; You can also create custom Azure Policy definitions to restrict more granular resource settings.&lt;/p&gt; 
+&lt;p&gt;2. Use built-in Azure Policy definitions as well as Azure Policy aliases in the "Microsoft.Network" namespace to create custom policies to alert, audit, and enforce system configurations. Additionally, develop a process and pipeline for managing policy exceptions.&lt;/p&gt; 
+&lt;p&gt;3. Use Azure Policy [audit], [deny], and [deploy if not exist] to automatically enforce configurations for your Azure resources.&lt;/p&gt; 
+&lt;p&gt;4. You can use recommendations from Azure Security Center or built-in Azure Policies, such as:&lt;br&gt; - There should be more than one owner assigned to your subscription&lt;br&gt; - Deprecated accounts with owner permissions should be removed from your subscription&lt;br&gt; - External accounts with owner permissions should be removed from your subscription&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; It is important to validate a new policy works as intended before allowing it to change or block work. The validation must ensure only the intended resources are determined to be non-compliant and no compliant resources are incorrectly included (known as a false positive) in the results.&lt;br&gt; For this reason, your policy definitions should be as tightly defined and focused on the resources and the properties you need to evaluate for compliance as possible.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create and manage policies to enforce compliance" url="https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage"/>
+            <reference name="Understand Azure Policy effects" url="https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The recommended approach to validating a new policy definition is by following these steps:&lt;/p&gt;
+
+	&lt;p&gt;- Tightly define your policy&lt;br /&gt;
+- Audit your existing resources&lt;br /&gt;
+- Audit new or updated resource requests&lt;br /&gt;
+- Deploy your policy to resources&lt;br /&gt;
+- Continuous monitoring&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
+&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER3" name="Integrate Azure Firewall with Azure Standard Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Integrate Azure Firewall with Azure Standard Load Balancer&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can integrate an Azure Firewall into a virtual network with an Azure Standard Load Balancer (either public or internal).&lt;br&gt; Explicitly define internet connectivity and valid source IPs through outbound rules and network security groups with your Load Balancer to use Microsoft's threat intelligence for protecting your web applications.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The preferred design is to integrate an internal load balancer with your Azure firewall, as this is a much simpler design. You can use a public load balancer if you already have one deployed and you want to keep it in place. However, you need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;/p&gt; 
+&lt;p&gt;Public load balancer&lt;/p&gt; 
+&lt;p&gt;With a public load balancer, the load balancer is deployed with a public frontend IP address.&lt;/p&gt; 
+&lt;p&gt;Asymmetric routing&lt;/p&gt; 
+&lt;p&gt;Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.&lt;/p&gt; 
+&lt;p&gt;Fix the routing issue&lt;/p&gt; 
+&lt;p&gt;When you deploy an Azure Firewall into a subnet, one step is to create a default route for the subnet directing packets through the firewall's private IP address located on the AzureFirewallSubnet.&lt;br&gt; When you introduce the firewall into your load balancer scenario, you want your Internet traffic to come in through your firewall's public IP address. From there, the firewall applies its firewall rules and NATs the packets to your load balancer's public IP address. This is where the problem occurs. Packets arrive on the firewall's public IP address, but return to the firewall via the private IP address (using the default route). To avoid this problem, create an additional host route for the firewall's public IP address. Packets going to the firewall's public IP address are routed via the Internet. This avoids taking the default route to the firewall's private IP address.&lt;/p&gt; 
+&lt;p&gt;Internal load balancer&lt;/p&gt; 
+&lt;p&gt;With an internal load balancer, the load balancer is deployed with a private frontend IP address.&lt;br&gt; There's no asymmetric routing issue with this scenario. The incoming packets arrive at the firewall's public IP address, get translated to the load balancer's private IP address, and then returns to the firewall's private IP address using the same return path.&lt;br&gt; So, you can deploy this scenario similar to the public load balancer scenario, but without the need for the firewall public IP address host route.&lt;/p&gt; 
+&lt;p&gt;Note: The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Additional security&lt;/p&gt; 
+&lt;p&gt;To further enhance the security of your load-balanced scenario, you can use network security groups (NSGs).&lt;br&gt; For example, you can create an NSG on the backend subnet where the load-balanced virtual machines are located. Allow incoming traffic originating from the firewall IP address/port.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;br&gt; The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Integrate Azure Firewall with Azure Standard Load Balancer" url="https://docs.microsoft.com/en-us/azure/firewall/integrate-lb"/>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Firewall is integrated with Azure Standard Load Balancer.&lt;br /&gt;
+Test the firewall to confirm that it works as expected, following the testing steps for firewall deployment.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER1" name="Maintain an inventory of administrative accounts for Azure Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure role-based access control (Azure RBAC) allows you to manage access to Azure resources such as your Load Balancer through role assignments. Assign these roles to users, groups service principals, and managed identities.&lt;br&gt; Inventory Pre-defined and built-in roles for certain resources with tools like Azure CLI, Azure PowerShell or the Azure portal.&lt;br&gt; It is highly recommended by Microsoft to maintain an inventory of administrative accounts.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure built-in roles" url="https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
+&lt;p&gt;Version control workflow&lt;/p&gt; 
+&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
+&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-JIT-VM-ACCESS" name="Secure your management ports with just-in-time VM access" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure your management ports with just-in-time (JIT) VM access&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. All of your virtual machines are potential targets for an attack. When a VM is successfully compromised, it's used as the entry point to attack further resources within your environment.&lt;/p&gt; 
+&lt;p&gt;As with all cybersecurity prevention techniques, your goal should be to reduce the attack surface. In this case, that means having fewer open ports, especially management ports.&lt;br&gt; Your legitimate users also use these ports, so it's not practical to keep them closed.&lt;br&gt; To solve this dilemma, Azure Security Center offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to Enable JIT on your VMs from Azure Security Center&lt;/p&gt; 
+&lt;p&gt;From Security Center, you can enable and configure the JIT VM access.&lt;/p&gt; 
+&lt;p&gt;1. Open the Azure Defender dashboard and from the advanced protection area, select Just-in-time VM access.&lt;/p&gt; 
+&lt;p&gt;The Just-in-time VM access page opens with your VMs grouped into the following tabs:&lt;/p&gt; 
+&lt;p&gt;a. Configured - VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:&lt;br&gt; i. The number of approved JIT requests in the last seven days&lt;br&gt; ii. The last access date and time&lt;br&gt; iii. The connection details configured&lt;br&gt; iv. The last user&lt;/p&gt; 
+&lt;p&gt;b. Not configured - VMs without JIT enabled, but that can support JIT. Microsoft recommends that you enable JIT for these VMs.&lt;/p&gt; 
+&lt;p&gt;c. Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons:&lt;br&gt; i. Missing network security group (NSG) - JIT requires an NSG to be configured&lt;br&gt; ii. Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models.&lt;br&gt; iii. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.&lt;/p&gt; 
+&lt;p&gt;2. From the Not configured tab, mark the VMs to protect with JIT and select Enable JIT on VMs.&lt;/p&gt; 
+&lt;p&gt;The JIT VM access page opens listing the ports that Security Center recommends protecting:&lt;/p&gt; 
+&lt;p&gt;- 22 - SSH&lt;br&gt; - 3389 - RDP&lt;br&gt; - 5985 - WinRM&lt;br&gt; - 5986 - WinRM&lt;/p&gt; 
+&lt;p&gt;To accept the default settings, select Save.&lt;/p&gt; 
+&lt;p&gt;3. To customize the JIT options:&lt;/p&gt; 
+&lt;p&gt;- Add custom ports with the Add button.&lt;br&gt; - Modify one of the default ports, by selecting it from the list.&lt;/p&gt; 
+&lt;p&gt;For each port (custom and default) the Add port configuration pane offers the following options:&lt;/p&gt; 
+&lt;p&gt;- Protocol- The protocol that is allowed on this port when a request is approved&lt;br&gt; - Allowed source IPs- The IP ranges that are allowed on this port when a request is approved&lt;br&gt; - Maximum request time- The maximum time window during which a specific port can be opened&lt;/p&gt; 
+&lt;p&gt;a. Set the port security to your needs.&lt;/p&gt; 
+&lt;p&gt;b. Select OK.&lt;/p&gt; 
+&lt;p&gt;4. Select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure your management ports with just-in-time access" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time"/>
+            <reference name="Understanding just-in-time (JIT) VM access" url="https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Audit JIT access activity in Security Center&lt;/p&gt;
+
+	&lt;p&gt;You can gain insights into VM activities using log search. To view the logs:&lt;/p&gt;
+
+	&lt;p&gt;1. From Just-in-time VM access, select the Configured tab.&lt;/p&gt;
+
+	&lt;p&gt;2. For the VM that you want to audit, open the ellipsis menu at the end of the row.&lt;/p&gt;
+
+	&lt;p&gt;3. Select Activity Log from the menu.&lt;/p&gt;
+
+	&lt;p&gt;4. The activity log provides a filtered view of previous operations for that VM along with time, date, and subscription.&lt;/p&gt;
+
+	&lt;p&gt;To download the log information, select Download as CSV.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-RESOURCE1" name="Set resource locks for mission critical Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to CanNotDelete or ReadOnly to achieve this purpose.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.&lt;/li&gt;&lt;li&gt;ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;For each of the mission critical resource, click on Locks&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Give the lock a name and a description, then select the type, CanNotDelete or ReadOnly as appropriate&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To lock a resource, provide the name of the resource, its resource type, and its resource group name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock create --name &amp;lt;LockName&amp;gt; --lock-type &amp;lt;CanNotDelete/Read-only&amp;gt; --resource-group &amp;lt;resourceGroupName&amp;gt; --resource-name &amp;lt;resourceName&amp;gt; --resource-type &amp;lt;resourceType&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="cis-azure-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;Click on Locks&lt;/li&gt;&lt;li&gt;Ensure the lock is defined with name and description, type as CanNotDelete or ReadOnly as appropriate.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Review the list of all locks set currently:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock list --resource-group &amp;lt;resourcegroupname&amp;gt; --resource-name &amp;lt;resourcename&amp;gt; --namespace &amp;lt;Namespace&amp;gt; --resource-type &amp;lt;type&amp;gt; --parent ""&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
+  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
+  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
+  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
+  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
+                            subscription.&lt;/li&gt;
+                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
+                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER2" name="Upgrade Azure Public Load Balancers from Basic to Standard" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Upgrade Azure Public Load Balancers from Basic to Standard&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Azure offers two types of Load Balancer offerings, Standard and Basic. &lt;/p&gt;
+
+	&lt;p&gt;Standard Load Balancer is secure by default and part of your virtual network. The virtual network is a private and isolated network. This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource.&lt;br /&gt;
+Basic Load Balancer is open to the internet by default.&lt;/p&gt;
+
+	&lt;p&gt;Using a Standard Load Balancer is recommended for your production workloads and typically the Basic Load Balancer is only used for testing since the basic type is open to connections from the internet by default, and doesn't require network security groups for operation.&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+There are two stages in an upgrade:&lt;/p&gt;
+
+	&lt;p&gt;1. Change IP allocation method from Dynamic to Static.&lt;br /&gt;
+2. Run the PowerShell script to complete the upgrade and traffic migration.&lt;/p&gt;
+
+	&lt;p&gt;There are different scripts to support upgrade for Public (External) Load Balancers, Private (Internal) where no outbound connection is required and Private (Internal) where outbound connection is required.&lt;br /&gt;
+For more information please see the Reference URLs. &lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+It usually take about 5-10 minutes for the script to finish and it could take longer depending on the complexity of your Load Balancer configuration. Therefore, keep the downtime in mind and plan for failover if necessary.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Upgrade Azure Internal Load Balancer - Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-internalbasic-to-publicstandard"/>
+            <reference name="Upgrade Azure Internal Load Balancer- No Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basicinternal-standard"/>
+            <reference name="Upgrade Azure Public Load Balancer" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basic-standard"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using Standard Load Balancers for your production workloads.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
+&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
+&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
+&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
+&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
+&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
+&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
+&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
+&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
+&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
+&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
+&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
+&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
+&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
+&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
+&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
+&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
+            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.504">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
+&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:43.887">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="25"/>
+                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A01" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A01" mitigation="25"/>
+                <countermeasure ref="AZ-A03" mitigation="25"/>
+                <countermeasure ref="AZ-A04" mitigation="25"/>
+                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
+                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
+                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                <countermeasure ref="AZURE-SSO" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VM01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-V02" mitigation="33"/>
+                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+                    <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-V02" mitigation="33"/>
+                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+                <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
+                <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                    <countermeasure ref="AZ-L01" mitigation="33"/>
+                    <countermeasure ref="AZ-L05" mitigation="33"/>
+                    <countermeasure ref="AZ-M01" mitigation="25"/>
+                    <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
+                    <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
+                    <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                <countermeasure ref="AZ-L01" mitigation="33"/>
+                <countermeasure ref="AZ-L05" mitigation="33"/>
+                <countermeasure ref="AZ-M01" mitigation="25"/>
+                <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
+                <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
+                <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
+                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
+                    <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
+                    <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-NON-IDENTIFY">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-TAGS" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N09" mitigation="12"/>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
+                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
+                <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
+                <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
+                <countermeasure ref="AZURE-TAGS" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="539accc4-a293-4c64-821a-0ac0be0f651b" diagramComponentId="f2bd2c04-30f3-48f2-9958-7c68638b0af8" ref="266e0b13-2a57-4c2d-9ae6-6363fd4c5c7b" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="93915a63-309d-4fd5-8cf8-1e8c346f3dac" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.278">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.192">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.192">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="984e4d5c-6e77-4caf-b74b-09d691e8cc33" diagramComponentId="bce57632-a085-458e-bc3d-8657091b8864" ref="00541527-3e92-4c4c-a95f-ac62c6355616" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="70317d76-9d27-4914-b512-80a1d22080b1" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.854">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.644">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:38.645">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="2309a8ff-5fd8-4734-8f8e-9b25b321ffc2" diagramComponentId="4e6ac814-d7ac-4810-b1d4-7d199e4f1720" ref="93915a63-309d-4fd5-8cf8-1e8c346f3dac" name="Subnet 1" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="215c2163-29c5-4003-a75c-095c16dd7a91" diagramComponentId="6d4a6bd2-4143-4e77-bf2f-317b2d8f3283" ref="803627c9-d7fe-43f3-8bc1-571442c87223" name="Azure WAF (Web Application Firewall)" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-WAF">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.953">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Custom rules that you create 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a policy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
+&lt;/div&gt; 
+&lt;div&gt;
+  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Association tab, enter one of the following settings, then select Add: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select Review + create, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
+            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test the application gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Find the public IP address for the application gateway on its Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Copy the public IP address, and then paste it into the address bar of your browser. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.928">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-WAF-GW" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-WAF-GW" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="66e076eb-cdee-4e3f-9c6a-9c641004f5e3" diagramComponentId="186d0cfb-db0e-4be1-a771-62bf01ceddcc" ref="a482191d-3ddd-4a7f-8a98-da175dac0d97" name="Generic Client" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.437">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.622">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.623">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.538">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.401">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="bdc666b1-550d-497b-b2db-54000dc85c90" diagramComponentId="ef6e125a-d58b-4c86-8f57-0750d1453b3d" ref="c8ab2ca0-1ed2-4c22-8e96-76ed382f4049" name="Azure Load Balancer" desc="" library="" parentComponentRef="70317d76-9d27-4914-b512-80a1d22080b1" componentDefinitionRef="microsoft-azure-load-balancer">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not adequately configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.501">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-04" name="Unauthorized connection attempts on Azure resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to Azure resources is most likely to be receiving an
+                        attack. To avoid this, access to the network must be as restricted as possible using Network
+                        Access Control Lists for blacklisting.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Network security groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select the Network Security Group (NSG) for your virtual machine and click on
+                            &amp;quot;Inbound security rules&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is a rule to deny the inbound access from a blacklisted IP
+                            address or range to a designated port or port range.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.501">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-M01" name="Create alerts for changes on Activity Logs configuration" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the Activity Logs changes to monitor, audit and notify about the changes to the correspondent personnel. It's vital that these unauthorized changes are detected.&lt;/p&gt;&lt;p&gt;Checklist:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that Activity Log Alert exists for:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Create Policy Assignment&lt;/li&gt;&lt;li&gt;Delete Policy Assignment&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group&lt;/li&gt;&lt;li&gt;Delete Network Security Group&lt;/li&gt;&lt;li&gt;Create or Update Network Security Group Rule&lt;/li&gt;&lt;li&gt;Delete Network Security Group Rule&lt;/li&gt;&lt;li&gt;Create or Update Security Solution&lt;/li&gt;&lt;li&gt;Delete Security Solution&lt;/li&gt;&lt;li&gt;Create or Update or Delete SQL Server Firewall Rule&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Monitor&lt;/li&gt;&lt;li&gt;Select Alerts&lt;ol&gt;&lt;li&gt;For each one of the elements in the checklist, click On New Alert Rule&lt;ol&gt;&lt;li&gt;Under Scope, click Select resource&lt;/li&gt;&lt;li&gt;Select the appropriate subscription under Filter by subscription&lt;/li&gt;&lt;li&gt;Select Policy Assignment under Filter by resource type&lt;/li&gt;&lt;li&gt;Select All for Filter by location&lt;/li&gt;&lt;li&gt;Click on the subscription resource from the entries populated under Resource&lt;/li&gt;&lt;li&gt;Verify Selection preview shows All Policy assignment (policyAssignments) and your selected subscription name&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Condition click Add Condition&lt;/li&gt;&lt;li&gt;Select the corresponding element from the checklist&lt;/li&gt;&lt;li&gt;Click Done&lt;/li&gt;&lt;li&gt;Under Action group, select Add action groups and complete creation process or select appropriate action group&lt;/li&gt;&lt;li&gt;Under Alert rule details, enter Alert rule name and Description&lt;/li&gt;&lt;li&gt;Select appropriate resource group to save the alert to&lt;/li&gt;&lt;li&gt;Check Enable alert rule upon creation checkbox&lt;/li&gt;&lt;li&gt;Click Create alert rule&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create activity log alerts" url="https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-activity-log-alerts"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.2.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to "Monitor" and then to "Alerts".&lt;/li&gt;&lt;li&gt;Check that there is any rule to alert when the Activity Logs configuration changes.&lt;/li&gt;&lt;li&gt;Check if these rules are enabled.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.764">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable and use Traffic Analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Visualize network activity across your Azure subscriptions and identify hot spots. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Pinpoint network misconfigurations leading to failed connections in your network. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable Network Watcher 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select a network security group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable flow log settings 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling flow log settings, you must complete the following tasks: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register the Azure Insights provider, if it's not already registered for your subscription: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  New-AzStorageAccount ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Location westcentralus ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -SkuName Standard_LRS ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Kind StorageV2 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the following options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Select On for Status 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Select On for Traffic Analytics Status. 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View traffic analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;3. Select Create.&lt;/p&gt; 
+&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
+&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
+&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
+
+	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
+
+	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
+2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
+3. Select your DDoS protection plan from the list.&lt;/p&gt;
+
+	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SENTINEL" name="Enable Azure Sentinel" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable Azure Sentinel&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal. Make sure that the subscription in which Azure Sentinel is created is selected.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. Select the workspace you want to use or create a new one. You can run Azure Sentinel on more than one workspace, but the data is isolated to a single workspace.&lt;/p&gt; 
+&lt;p&gt;Note: Default workspaces created by Azure Security Center will not appear in the list; you cannot install Azure Sentinel on them.&lt;/p&gt; 
+&lt;p&gt;Important: Once deployed on a workspace, Azure Sentinel does not currently support the moving of that workspace to other resource groups or subscriptions.&lt;/p&gt; 
+&lt;p&gt;If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be effective in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.&lt;/p&gt; 
+&lt;p&gt;5. Select Add Azure Sentinel.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: On-board Azure Sentinel" url="https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Azure Sentinel is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-NSG-LOGS" name="Enable Network Security Group flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Network Security Group (NSG) flow logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. &lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to enable NSG flow log&lt;/p&gt; 
+&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
+&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
+&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
+&lt;p&gt;The storage account may take around minute to create. Don't continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
+&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
+&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
+&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
+&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
+&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
+&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
+&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Download flow log&lt;/p&gt;
+
+	&lt;p&gt;1. From Network Watcher, in the portal, select NSG flow logs under LOGS.&lt;/p&gt;
+
+	&lt;p&gt;2. Select You can download flow logs from configured storage accounts.&lt;/p&gt;
+
+	&lt;p&gt;3. Select the storage account that you configured in step 2 of Enable NSG flow log (Remediation section).&lt;/p&gt;
+
+	&lt;p&gt;4. Under Blob service, select Containers, and then select the insights-logs-networksecuritygroupflowevent container.&lt;/p&gt;
+
+	&lt;p&gt;5. In the container, navigate the folder hierarchy until you get to a PT1H.json file. Log files are written to a folder hierarchy that follows the following naming convention: https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1H.json&lt;/p&gt;
+
+	&lt;p&gt;6. Select ... to the right of the PT1H.json file and select Download.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.765">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing&lt;/p&gt;
+
+  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
+
+  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SECURE-CONFIG" name="Establish secure configurations with Azure Policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Establish secure configurations for Azure Traffic Manager&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.&lt;/p&gt; 
+&lt;p&gt;Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.&lt;/p&gt; 
+&lt;p&gt;All Azure Policy data and objects are encrypted at rest.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Define and implement standard security configurations for Azure Traffic Manager with Azure Policy&lt;/p&gt; 
+&lt;p&gt;1. Use Azure Policy to put restrictions on the type of resources that can be created in your and in customer subscriptions using the following built-in policy definitions:&lt;br&gt; - Not allowed resource types&lt;br&gt; - Allowed resource types&lt;br&gt; You can also create custom Azure Policy definitions to restrict more granular resource settings.&lt;/p&gt; 
+&lt;p&gt;2. Use built-in Azure Policy definitions as well as Azure Policy aliases in the "Microsoft.Network" namespace to create custom policies to alert, audit, and enforce system configurations. Additionally, develop a process and pipeline for managing policy exceptions.&lt;/p&gt; 
+&lt;p&gt;3. Use Azure Policy [audit], [deny], and [deploy if not exist] to automatically enforce configurations for your Azure resources.&lt;/p&gt; 
+&lt;p&gt;4. You can use recommendations from Azure Security Center or built-in Azure Policies, such as:&lt;br&gt; - There should be more than one owner assigned to your subscription&lt;br&gt; - Deprecated accounts with owner permissions should be removed from your subscription&lt;br&gt; - External accounts with owner permissions should be removed from your subscription&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; It is important to validate a new policy works as intended before allowing it to change or block work. The validation must ensure only the intended resources are determined to be non-compliant and no compliant resources are incorrectly included (known as a false positive) in the results.&lt;br&gt; For this reason, your policy definitions should be as tightly defined and focused on the resources and the properties you need to evaluate for compliance as possible.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create and manage policies to enforce compliance" url="https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage"/>
+            <reference name="Understand Azure Policy effects" url="https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The recommended approach to validating a new policy definition is by following these steps:&lt;/p&gt;
+
+	&lt;p&gt;- Tightly define your policy&lt;br /&gt;
+- Audit your existing resources&lt;br /&gt;
+- Audit new or updated resource requests&lt;br /&gt;
+- Deploy your policy to resources&lt;br /&gt;
+- Continuous monitoring&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SUBSCRIPTIONS" name="Implement isolation using separate subscriptions" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement isolation using separate subscriptions&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can create an additional subscription for your Enterprise Agreement (EA), Microsoft Customer Agreement or Microsoft Partner Agreement billing account in the Azure portal. You may want an additional subscription to avoid hitting subscription limits, to create separate environments for security, or to isolate data for compliance reasons.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a subscription in the Azure portal&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search for Subscriptions.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.&lt;/p&gt; 
+&lt;p&gt;5. Fill the form and click Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create an additional Azure subscription" url="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have implemented isolation through separate subscriptions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER3" name="Integrate Azure Firewall with Azure Standard Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Integrate Azure Firewall with Azure Standard Load Balancer&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can integrate an Azure Firewall into a virtual network with an Azure Standard Load Balancer (either public or internal).&lt;br&gt; Explicitly define internet connectivity and valid source IPs through outbound rules and network security groups with your Load Balancer to use Microsoft's threat intelligence for protecting your web applications.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; The preferred design is to integrate an internal load balancer with your Azure firewall, as this is a much simpler design. You can use a public load balancer if you already have one deployed and you want to keep it in place. However, you need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;/p&gt; 
+&lt;p&gt;Public load balancer&lt;/p&gt; 
+&lt;p&gt;With a public load balancer, the load balancer is deployed with a public frontend IP address.&lt;/p&gt; 
+&lt;p&gt;Asymmetric routing&lt;/p&gt; 
+&lt;p&gt;Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session.&lt;/p&gt; 
+&lt;p&gt;Fix the routing issue&lt;/p&gt; 
+&lt;p&gt;When you deploy an Azure Firewall into a subnet, one step is to create a default route for the subnet directing packets through the firewall's private IP address located on the AzureFirewallSubnet.&lt;br&gt; When you introduce the firewall into your load balancer scenario, you want your Internet traffic to come in through your firewall's public IP address. From there, the firewall applies its firewall rules and NATs the packets to your load balancer's public IP address. This is where the problem occurs. Packets arrive on the firewall's public IP address, but return to the firewall via the private IP address (using the default route). To avoid this problem, create an additional host route for the firewall's public IP address. Packets going to the firewall's public IP address are routed via the Internet. This avoids taking the default route to the firewall's private IP address.&lt;/p&gt; 
+&lt;p&gt;Internal load balancer&lt;/p&gt; 
+&lt;p&gt;With an internal load balancer, the load balancer is deployed with a private frontend IP address.&lt;br&gt; There's no asymmetric routing issue with this scenario. The incoming packets arrive at the firewall's public IP address, get translated to the load balancer's private IP address, and then returns to the firewall's private IP address using the same return path.&lt;br&gt; So, you can deploy this scenario similar to the public load balancer scenario, but without the need for the firewall public IP address host route.&lt;/p&gt; 
+&lt;p&gt;Note: The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Additional security&lt;/p&gt; 
+&lt;p&gt;To further enhance the security of your load-balanced scenario, you can use network security groups (NSGs).&lt;br&gt; For example, you can create an NSG on the backend subnet where the load-balanced virtual machines are located. Allow incoming traffic originating from the firewall IP address/port.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You need to be aware of an asymmetric routing issue that can break functionality with the public load balancer scenario.&lt;br&gt; The virtual machines in the backend pool will not have outbound internet connectivity with this configuration. For more information please see Reference URLs.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Integrate Azure Firewall with Azure Standard Load Balancer" url="https://docs.microsoft.com/en-us/azure/firewall/integrate-lb"/>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Firewall is integrated with Azure Standard Load Balancer.&lt;br /&gt;
+Test the firewall to confirm that it works as expected, following the testing steps for firewall deployment.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER1" name="Maintain an inventory of administrative accounts for Azure Load Balancer" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure role-based access control (Azure RBAC) allows you to manage access to Azure resources such as your Load Balancer through role assignments. Assign these roles to users, groups service principals, and managed identities.&lt;br&gt; Inventory Pre-defined and built-in roles for certain resources with tools like Azure CLI, Azure PowerShell or the Azure portal.&lt;br&gt; It is highly recommended by Microsoft to maintain an inventory of administrative accounts.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure built-in roles" url="https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts for Azure Load Balancer&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A01" name="Register a Security contact for your Azure account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Provide the security contact details for the Azure subscription. Microsoft Security Response Center (MSRC) performs security monitoring of the Azure network and infrastructure and receives threat intelligence and abuse complaints from third parties. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Microsoft will use this information provided to contact if the MSRC discovers that customer data has been accessed by an unlawful or unauthorized party. Also, this provides the means of ensuring these advisories are routed to the security team, especially if a distribution email address is used.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security contact details&amp;quot;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Once filled, save changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Provide security contact details in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
+&lt;p&gt;Version control workflow&lt;/p&gt; 
+&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
+&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-JIT-VM-ACCESS" name="Secure your management ports with just-in-time VM access" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure your management ports with just-in-time (JIT) VM access&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. All of your virtual machines are potential targets for an attack. When a VM is successfully compromised, it's used as the entry point to attack further resources within your environment.&lt;/p&gt; 
+&lt;p&gt;As with all cybersecurity prevention techniques, your goal should be to reduce the attack surface. In this case, that means having fewer open ports, especially management ports.&lt;br&gt; Your legitimate users also use these ports, so it's not practical to keep them closed.&lt;br&gt; To solve this dilemma, Azure Security Center offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to Enable JIT on your VMs from Azure Security Center&lt;/p&gt; 
+&lt;p&gt;From Security Center, you can enable and configure the JIT VM access.&lt;/p&gt; 
+&lt;p&gt;1. Open the Azure Defender dashboard and from the advanced protection area, select Just-in-time VM access.&lt;/p&gt; 
+&lt;p&gt;The Just-in-time VM access page opens with your VMs grouped into the following tabs:&lt;/p&gt; 
+&lt;p&gt;a. Configured - VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:&lt;br&gt; i. The number of approved JIT requests in the last seven days&lt;br&gt; ii. The last access date and time&lt;br&gt; iii. The connection details configured&lt;br&gt; iv. The last user&lt;/p&gt; 
+&lt;p&gt;b. Not configured - VMs without JIT enabled, but that can support JIT. Microsoft recommends that you enable JIT for these VMs.&lt;/p&gt; 
+&lt;p&gt;c. Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons:&lt;br&gt; i. Missing network security group (NSG) - JIT requires an NSG to be configured&lt;br&gt; ii. Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models.&lt;br&gt; iii. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.&lt;/p&gt; 
+&lt;p&gt;2. From the Not configured tab, mark the VMs to protect with JIT and select Enable JIT on VMs.&lt;/p&gt; 
+&lt;p&gt;The JIT VM access page opens listing the ports that Security Center recommends protecting:&lt;/p&gt; 
+&lt;p&gt;- 22 - SSH&lt;br&gt; - 3389 - RDP&lt;br&gt; - 5985 - WinRM&lt;br&gt; - 5986 - WinRM&lt;/p&gt; 
+&lt;p&gt;To accept the default settings, select Save.&lt;/p&gt; 
+&lt;p&gt;3. To customize the JIT options:&lt;/p&gt; 
+&lt;p&gt;- Add custom ports with the Add button.&lt;br&gt; - Modify one of the default ports, by selecting it from the list.&lt;/p&gt; 
+&lt;p&gt;For each port (custom and default) the Add port configuration pane offers the following options:&lt;/p&gt; 
+&lt;p&gt;- Protocol- The protocol that is allowed on this port when a request is approved&lt;br&gt; - Allowed source IPs- The IP ranges that are allowed on this port when a request is approved&lt;br&gt; - Maximum request time- The maximum time window during which a specific port can be opened&lt;/p&gt; 
+&lt;p&gt;a. Set the port security to your needs.&lt;/p&gt; 
+&lt;p&gt;b. Select OK.&lt;/p&gt; 
+&lt;p&gt;4. Select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure your management ports with just-in-time access" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time"/>
+            <reference name="Understanding just-in-time (JIT) VM access" url="https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Audit JIT access activity in Security Center&lt;/p&gt;
+
+	&lt;p&gt;You can gain insights into VM activities using log search. To view the logs:&lt;/p&gt;
+
+	&lt;p&gt;1. From Just-in-time VM access, select the Configured tab.&lt;/p&gt;
+
+	&lt;p&gt;2. For the VM that you want to audit, open the ellipsis menu at the end of the row.&lt;/p&gt;
+
+	&lt;p&gt;3. Select Activity Log from the menu.&lt;/p&gt;
+
+	&lt;p&gt;4. The activity log provides a filtered view of previous operations for that VM along with time, date, and subscription.&lt;/p&gt;
+
+	&lt;p&gt;To download the log information, select Download as CSV.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-RESOURCE1" name="Set resource locks for mission critical Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to CanNotDelete or ReadOnly to achieve this purpose.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.&lt;/li&gt;&lt;li&gt;ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;For each of the mission critical resource, click on Locks&lt;/li&gt;&lt;li&gt;Click Add&lt;/li&gt;&lt;li&gt;Give the lock a name and a description, then select the type, CanNotDelete or ReadOnly as appropriate&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To lock a resource, provide the name of the resource, its resource type, and its resource group name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock create --name &amp;lt;LockName&amp;gt; --lock-type &amp;lt;CanNotDelete/Read-only&amp;gt; --resource-group &amp;lt;resourceGroupName&amp;gt; --resource-name &amp;lt;resourceName&amp;gt; --resource-type &amp;lt;resourceType&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="cis-azure-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the specific Azure Resource or Resource Group&lt;/li&gt;&lt;li&gt;Click on Locks&lt;/li&gt;&lt;li&gt;Ensure the lock is defined with name and description, type as CanNotDelete or ReadOnly as appropriate.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Review the list of all locks set currently:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az lock list --resource-group &amp;lt;resourcegroupname&amp;gt; --resource-name &amp;lt;resourcename&amp;gt; --namespace &amp;lt;Namespace&amp;gt; --resource-type &amp;lt;type&amp;gt; --parent ""&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-V02" name="Set up the security policy" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up the security policies to define the items for which Security Center collects data and makes recommendations. Apply different security policies to different sets of Azure resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your subscription.&lt;/li&gt; 
+  &lt;li&gt;Select Prevention policy.&lt;/li&gt; 
+  &lt;li&gt;Turn on or turn off policy items that you want to apply to all Azure resources.&lt;/li&gt; 
+  &lt;li&gt;When you're finished selecting your settings, select OK.&lt;/li&gt; 
+  &lt;li&gt;On the Security policy blade, select Save.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Set security policies in Azure Security Center" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-policies"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;On the Security Center dashboard, select Security policy, and then select your
+                            subscription.&lt;/li&gt;
+                            &lt;li&gt;Select Prevention policy.&lt;/li&gt;
+                            &lt;li&gt;Check that the required policy items are enabled.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-LOAD-BALANCER2" name="Upgrade Azure Public Load Balancers from Basic to Standard" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Upgrade Azure Public Load Balancers from Basic to Standard&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Azure offers two types of Load Balancer offerings, Standard and Basic. &lt;/p&gt;
+
+	&lt;p&gt;Standard Load Balancer is secure by default and part of your virtual network. The virtual network is a private and isolated network. This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource.&lt;br /&gt;
+Basic Load Balancer is open to the internet by default.&lt;/p&gt;
+
+	&lt;p&gt;Using a Standard Load Balancer is recommended for your production workloads and typically the Basic Load Balancer is only used for testing since the basic type is open to connections from the internet by default, and doesn't require network security groups for operation.&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+There are two stages in an upgrade:&lt;/p&gt;
+
+	&lt;p&gt;1. Change IP allocation method from Dynamic to Static.&lt;br /&gt;
+2. Run the PowerShell script to complete the upgrade and traffic migration.&lt;/p&gt;
+
+	&lt;p&gt;There are different scripts to support upgrade for Public (External) Load Balancers, Private (Internal) where no outbound connection is required and Private (Internal) where outbound connection is required.&lt;br /&gt;
+For more information please see the Reference URLs. &lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+It usually take about 5-10 minutes for the script to finish and it could take longer depending on the complexity of your Load Balancer configuration. Therefore, keep the downtime in mind and plan for failover if necessary.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Upgrade Azure Internal Load Balancer - Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-internalbasic-to-publicstandard"/>
+            <reference name="Upgrade Azure Internal Load Balancer- No Outbound Connection Required" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basicinternal-standard"/>
+            <reference name="Upgrade Azure Public Load Balancer" url="https://docs.microsoft.com/en-us/azure/load-balancer/upgrade-basic-standard"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using Standard Load Balancers for your production workloads.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SSO" name="Use Azure Active Directory single sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Active Directory single sign-on (SSO)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Single sign-on means a user does not have to sign in to every application they use. The user logs in once and that credential is used for other apps too.&lt;/p&gt; 
+&lt;p&gt;Single sign-on provides many benefits over traditional sign-on methods.&lt;/p&gt; 
+&lt;p&gt;- With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or My Apps. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.&lt;/p&gt; 
+&lt;p&gt;- Without single sign-on, users must remember application-specific passwords and sign in to each application. IT staff needs to create and update user accounts for each application such as Microsoft 365, Box, and Salesforce. Users need to remember their passwords, plus spend the time to sign in to each application.&lt;/p&gt; 
+&lt;p&gt;Azure Active Directory (Azure AD) has a gallery that contains thousands of pre-integrated applications. Many of the applications your organization uses are probably already in the gallery.&lt;/p&gt; 
+&lt;p&gt;After an application is added to your Azure AD tenant, you can:&lt;/p&gt; 
+&lt;p&gt;- Configure properties for the app.&lt;br&gt; - Manage user access to the app with a Conditional Access policy.&lt;br&gt; - Configure single sign-on so users can sign in to the app with their Azure AD credentials.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
+&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
+&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
+&lt;p&gt;3. In the Enterprise applications pane, select New application. Select New application to add a gallery app to your tenant&lt;/p&gt; 
+&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
+&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
+&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
+&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on. Screenshot shows adding an OIDC-based SSO app.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on. Screenshot shows adding an SAML-based SSO app.&lt;/p&gt; 
+&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
+&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
+&lt;p&gt;You have finished adding an application. &lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
+            <reference name="What is single sign-on (SSO)?" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that, wherever possible, you are using Azure Active Directory SSO instead of configuring individual stand-alone credentials per-service.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-RESOURCE-MANAGER" name="Use Azure Resource Manager" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Resource Manager&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The Resource Manager and classic deployment models represent two different ways of deploying and managing your Azure solutions. You work with them through two different API sets, and the deployed resources can contain important differences. The two models are not compatible with each other.&lt;br&gt; With Resource Manager, you can:&lt;br&gt; - Manage your infrastructure through declarative templates rather than scripts.&lt;br&gt; - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.&lt;br&gt; - Redeploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state.&lt;br&gt; - Define the dependencies between resources so they are deployed in the correct order.&lt;br&gt; - Apply access control to all services because Azure role-based access control (Azure RBAC) is natively integrated into the management platform.&lt;br&gt; - Apply tags to resources to logically organize all the resources in your subscription.&lt;br&gt; - Clarify your organization's billing by viewing costs for a group of resources sharing the same tag.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To simplify the deployment and management of resources, Microsoft recommends that you use Resource Manager for all new resources. If possible, Microsoft recommends that you redeploy existing resources through Resource Manager.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Resource Manager and classic deployment models are not compatible with each other.&lt;br&gt; There are three scenarios to be aware of:&lt;br&gt; 1. Cloud Services does not support Resource Manager deployment model.&lt;br&gt; 2. Virtual machines, storage accounts, and virtual networks support both Resource Manager and classic deployment models.&lt;br&gt; 3. All other Azure services support Resource Manager.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources" url="https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you are using Resource Manager for all new resources.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
+&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:40.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="25"/>
+                    <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A01" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A01" mitigation="25"/>
+                <countermeasure ref="AZ-A03" mitigation="25"/>
+                <countermeasure ref="AZ-A04" mitigation="25"/>
+                <countermeasure ref="AZURE-SUBSCRIPTIONS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
+                    <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                    <countermeasure ref="AZURE-SSO" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER1" mitigation="100"/>
+                <countermeasure ref="AZURE-RESOURCE-MANAGER" mitigation="20"/>
+                <countermeasure ref="AZURE-SSO" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-04">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VM01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-V02" mitigation="33"/>
+                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+                    <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-V02" mitigation="33"/>
+                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+                <countermeasure ref="AZURE-RESOURCE1" mitigation="34"/>
+                <countermeasure ref="AZURE-SECURE-CONFIG" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                    <countermeasure ref="AZ-L01" mitigation="33"/>
+                    <countermeasure ref="AZ-L05" mitigation="33"/>
+                    <countermeasure ref="AZ-M01" mitigation="25"/>
+                    <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
+                    <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
+                    <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                <countermeasure ref="AZ-L01" mitigation="33"/>
+                <countermeasure ref="AZ-L05" mitigation="33"/>
+                <countermeasure ref="AZ-M01" mitigation="25"/>
+                <countermeasure ref="AZURE-MONITOR6" mitigation="25"/>
+                <countermeasure ref="AZURE-NSG-LOGS" mitigation="25"/>
+                <countermeasure ref="AZURE-SENTINEL" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
+                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
+                    <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
+                    <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
+                    <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-NON-IDENTIFY">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-TAGS" mitigation="11"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N09" mitigation="12"/>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="11"/>
+                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="11"/>
+                <countermeasure ref="AZURE-FIREWALL3" mitigation="11"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="11"/>
+                <countermeasure ref="AZURE-JIT-VM-ACCESS" mitigation="11"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER2" mitigation="11"/>
+                <countermeasure ref="AZURE-LOAD-BALANCER3" mitigation="11"/>
+                <countermeasure ref="AZURE-TAGS" mitigation="11"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="aa4f28fb-ddc0-4895-b84d-e35b27ba71f4" diagramComponentId="de645501-97cc-420c-9c83-9fa32c4a9da2" ref="f72549b9-c513-41ed-9eb7-63730d128139" name="Azure DNS (Domain Name System)" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-DNS">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.050">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-ADMIN-INV" name="Maintain an inventory of administrative accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintain an inventory of administrative accounts&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure AD has built-in roles that must be explicitly assigned and are queryable. Use the Azure AD PowerShell module to perform ad hoc queries to discover accounts that are members of administrative groups.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get-AzureADDirectoryRole" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0"/>
+            <reference name="Get-AzureADDirectoryRoleMember" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrolemember?view=azureadps-2.0"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.024">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADMIN-INV" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADMIN-INV" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="804ced73-ae5a-41b2-af9e-2c3ab0778132" diagramComponentId="3388dc81-8dd2-4052-ad6c-0bb09940e5bf" ref="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" name="Subnet 3" desc="" library="" parentComponentRef="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="f204c630-7b80-4c89-8a60-75745f86a084" diagramComponentId="ef126eb2-c355-4a2b-a795-1f2d0f8f586c" ref="b0159b26-8d10-41ed-bf52-4e8759635810" name="Azure Windows Virtual Machine" desc="" library="" parentComponentRef="8d3a7058-c610-41e8-9ac6-4af7e1ef3f60" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.844">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:41.813">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6f44195d-4146-4d17-b40a-c7625ee38350" diagramComponentId="fd167d37-437f-4d87-abe0-00cfc01e969d" ref="f1db8ec1-2ce2-4a15-b231-07b1abafcd1f" name="Azure VNet" desc="" library="" parentComponentRef="2b860f59-c9c6-479c-9a92-08cadbd9128a" componentDefinitionRef="CD-MICROSOFT-AZURE-VNET">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NON-IDENTIFY" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weaknesses might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VM01" name="Security policies exposing system resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security policies are not adequately configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.343">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.148">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MONITOR6" name="Enable and use Traffic Analytics" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable and use Traffic Analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Visualize network activity across your Azure subscriptions and identify hot spots. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Identify security threats to, and secure your network, with information such as open-ports, applications attempting Internet access, and virtual machines (VM) connecting to rogue networks. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Understand traffic flow patterns across Azure regions and the Internet to optimize your network deployment for performance and capacity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Pinpoint network misconfigurations leading to failed connections in your network. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable Network Watcher 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To analyze traffic, you need to have an existing network watcher, or enable a network watcher in each region that you have NSGs that you want to analyze traffic for. Traffic analytics can be enabled for NSGs hosted in any of the supported regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select a network security group 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see Create a network security group to create one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Azure portal, go to Network watcher, and then select NSG flow logs. Select the network security group that you want to enable an NSG flow log for. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you try to enable traffic analytics for an NSG that is hosted in any region other than the supported regions, you receive a "Not found" error. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable flow log settings 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Before enabling flow log settings, you must complete the following tasks: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register the Azure Insights provider, if it's not already registered for your subscription: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Register-AzResourceProvider -ProviderNamespace Microsoft.Insights 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you don't already have an Azure Storage account to store NSG flow logs in, you must create a storage account. You can create a storage account with the command that follows. Before running the command, replace &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; with a name that is unique across all Azure locations, between 3-24 characters in length, using only numbers and lower-case letters. You can also change the resource group name, if necessary. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  New-AzStorageAccount ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Location westcentralus ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Name &amp;lt;replace-with-your-unique-storage-account-name&amp;gt; ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -ResourceGroupName myResourceGroup ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -SkuName Standard_LRS ` 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; -Kind StorageV2 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Select the following options: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Select On for Status 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Version 2 for Flow Logs version. Version 2 contains flow-session statistics (Bytes and Packets) 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Select an existing storage account to store the flow logs in. Ensure that your storage does not have "Data Lake Storage Gen2 Hierarchical Namespace Enabled" set to true. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Set Retention to the number of days you want to store data for. If you want to store the data forever, set the value to 0. You incur Azure Storage fees for the storage account. 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Select On for Traffic Analytics Status. 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Select processing interval. Based on your choice, flow logs will be collected from storage account and processed by Traffic Analytics. You can choose processing interval of every 1 hour or every 10 mins. 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select an existing Log Analytics (OMS) Workspace, or select Create New Workspace to create a new one. A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics. If you select an existing workspace, it must exist in one of the supported regions and have been upgraded to the new query language. If you do not wish to upgrade an existing workspace, or do not have a workspace in a supported region, create a new one. For more information about query languages, see Azure Log Analytics upgrade to new log search. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The log analytics workspace hosting the traffic analytics solution and the NSGs do not have to be in the same region. For example, you may have traffic analytics in a workspace in the West Europe region, while you may have NSGs in East US and West US. Multiple NSGs can be configured in the same workspace. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Repeat the previous steps for any other NSGs for which you wish to enable traffic analytics for. Data from flow logs is sent to the workspace, so ensure that the local laws and regulations in your country/region permit data storage in the region where the workspace exists. If you have set different processing intervals for different NSGs, data will be collected at different intervals. For example: You can choose to enable processing interval of 10 mins for critical VNETs and 1 hour for noncritical VNETs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can also configure traffic analytics using the Set-AzNetworkWatcherConfigFlowLog PowerShell cmdlet in Azure PowerShell. Run Get-Module -ListAvailable Az to find your installed version. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Traffic Analytics" url="https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View traffic analytics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view Traffic Analytics, search for Network Watcher in the portal search bar. Once inside Network Watcher, to explore traffic analytics and its capabilities, select Traffic Analytics from the left menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The dashboard may take up to 30 minutes to appear the first time because Traffic Analytics must first aggregate enough data for it to derive meaningful insights, before it can generate any reports. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-DDOS-PROTECTION" name="Enable Azure DDoS Standard protection on your Azure Virtual Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure DDoS Standard protection on your Azure Virtual Network&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Enable Azure Distributed Denial of Service (DDoS) Standard protection on your Azure Virtual Network to guard against DDoS attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a DDoS protection plan&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Search the term DDoS. When DDoS protection plan appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;3. Select Create.&lt;/p&gt; 
+&lt;p&gt;4. Enter or select the following values, then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyDdosProtectionPlan.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Create new and enter MyResourceGroup.&lt;br&gt; Location: Enter East US.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for a new virtual network&lt;/p&gt; 
+&lt;p&gt;1. Select Create a resource in the upper left corner of the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Networking, and then select Virtual network.&lt;/p&gt; 
+&lt;p&gt;3. Enter or select the following values, accept the remaining defaults, and then select Create:&lt;/p&gt; 
+&lt;p&gt;Name: Enter MyVnet.&lt;br&gt; Subscription: Select your subscription.&lt;br&gt; Resource group: Select Use existing, and then select MyResourceGroup&lt;br&gt; Location: Enter East US&lt;br&gt; DDoS Protection Standard: Select Enable. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Enable DDoS protection for an existing virtual network&lt;/p&gt; 
+&lt;p&gt;1. Create a DDoS protection plan by completing the steps in Create a DDoS protection plan, if you don't have an existing DDoS protection plan.&lt;br&gt; 2. Select Create a resource in the upper left corner of the Azure portal.&lt;br&gt; 3. Enter the name of the virtual network that you want to enable DDoS Protection Standard for in the Search resources, services, and docs box at the top of the portal. When the name of the virtual network appears in the search results, select it.&lt;br&gt; 4. Select DDoS protection, under SETTINGS.&lt;br&gt; 5. Select Standard. Under DDoS protection plan, select an existing DDoS protection plan, or the plan you created in step 1, and then select Save. The plan you select can be in the same, or different subscription than the virtual network, but both subscriptions must be associated to the same Azure Active Directory tenant.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; You cannot move a virtual network to another resource group or subscription when DDoS Standard is enabled for the virtual network. If you need to move a virtual network with DDoS Standard enabled, disable DDoS Standard first, move the virtual network, and then enable DDoS standard. After the move, the auto-tuned policy thresholds for all the protected public IP addresses in the virtual network are reset.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Create and configure Azure DDoS Protection Standard" url="https://docs.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate and test&lt;/p&gt;
+
+	&lt;p&gt;First, check the details of your DDoS protection plan:&lt;/p&gt;
+
+	&lt;p&gt;1. Select All services on the top, left of the portal.&lt;br /&gt;
+2. Enter DDoS in the Filter box. When DDoS protection plans appear in the results, select it.&lt;br /&gt;
+3. Select your DDoS protection plan from the list.&lt;/p&gt;
+
+	&lt;p&gt;The MyVnet virtual network should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.149">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-SECURITY-CENTER4" name="Enable Azure Defender" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Defender&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Azure Defender provides security alerts and advanced threat protection for virtual machines, SQL databases, containers, web applications, your network, and more.&lt;/p&gt;
+
+	&lt;p&gt;When you enable Azure Defender from the Pricing and settings area of Azure Security Center, the following Defender plans are all enabled simultaneously and provide comprehensive defenses for the compute, data, and service layers of your environment:&lt;/p&gt;
+
+	&lt;p&gt;- Azure Defender for servers&lt;br /&gt;
+- Azure Defender for App Service&lt;br /&gt;
+- Azure Defender for Storage&lt;br /&gt;
+- Azure Defender for SQL&lt;br /&gt;
+- Azure Defender for Kubernetes&lt;br /&gt;
+- Azure Defender for container registries&lt;br /&gt;
+- Azure Defender for Key Vault&lt;br /&gt;
+- Azure Defender for Resource Manager&lt;br /&gt;
+- Azure Defender for DNS&lt;/p&gt;
+
+	&lt;p&gt;Each plan in Azure Defender is priced separately and can be individually set to on or off. For example, you might want to turn off Azure Defender for App Service on subscriptions that don't have an associated Azure App Service plan.&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+To enable Azure Defender on one subscription:&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's main menu, select Pricing &amp;amp; settings.&lt;br /&gt;
+2. Select the subscription or workspace that you want to protect.&lt;br /&gt;
+3. Select Azure Defender on to upgrade.&lt;br /&gt;
+4. Select Save.&lt;/p&gt;
+
+	&lt;p&gt;Tip: You'll notice that each plan in Azure Defender is priced separately and can be individually set to on or off. For example, you might want to turn off Azure Defender for App Service on subscriptions that don't have an associated Azure App Service plan.&lt;/p&gt;
+
+
+	&lt;p&gt;To enable Azure Defender on multiple subscriptions or workspaces:&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's sidebar, select Getting started.&lt;/p&gt;
+
+	&lt;p&gt;The Upgrade tab lists subscriptions and workspaces eligible for onboarding.&lt;/p&gt;
+
+	&lt;p&gt;2. From the Select subscriptions and workspaces to enable Azure Defender on list, select the subscriptions and workspaces to upgrade and select Upgrade to enable Azure Defender.&lt;/p&gt;
+
+	&lt;p&gt;- If you select subscriptions and workspaces that aren't eligible for trial, the next step will upgrade them and charges will begin.&lt;br /&gt;
+- If you select a workspace that's eligible for a free trial, the next step will begin a trial.&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Introduction to Azure Defender" url="https://docs.microsoft.com/en-us/azure/security-center/azure-defender"/>
+            <reference name="Quickstart: Enable Azure Defender" url="https://docs.microsoft.com/en-us/azure/security-center/enable-azure-defender"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="2.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DP-3" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="ES-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="IM-8" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To ensure that Azure Defender is enabled from Azure portal&lt;/p&gt;
+
+	&lt;p&gt;1. Go to Security Center&lt;br /&gt;
+2. Select Pricing &amp;amp; settings blade&lt;br /&gt;
+3. Click on the subscription name&lt;br /&gt;
+4. Select the Azure Defender plans blade&lt;br /&gt;
+5. Review the chosen pricing tier. For the desired resource type Plan should be set to On.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-NSG-FLOW-LOGS" name="Enable NSG flow logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable NSG flow logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable NSG flow log&lt;/p&gt; 
+&lt;p&gt;1. NSG flow log data is written to an Azure Storage account. To create an Azure Storage account, select + Create a resource at the top, left corner of the portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Storage, then select Storage account - blob, file, table, queue.&lt;/p&gt; 
+&lt;p&gt;3. Enter, or select the following information, accept the remaining defaults, and then select Create.&lt;/p&gt; 
+&lt;p&gt;Name: 3-24 characters in length, can only contain lowercase letters and numbers, and must be unique across all Azure Storage accounts.&lt;br&gt; Location: Select East US&lt;br&gt; Resource group: Select Use existing, and then select myResourceGroup&lt;/p&gt; 
+&lt;p&gt;The storage account may take around minute to create. Do not continue with remaining steps until the storage account is created. In all cases, the storage account must be in the same region as the NSG.&lt;/p&gt; 
+&lt;p&gt;4. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;5. Under LOGS, select NSG flow logs.&lt;/p&gt; 
+&lt;p&gt;6. From the list of NSGs, select the NSG named myVm-nsg.&lt;/p&gt; 
+&lt;p&gt;7. Under Flow logs settings, select On.&lt;/p&gt; 
+&lt;p&gt;8. Select the flow logging version. Version 2 contains flow-session statistics (Bytes and Packets)&lt;/p&gt; 
+&lt;p&gt;9. Select the storage account that you created in step 3.&lt;/p&gt; 
+&lt;p&gt;Note: NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.&lt;/p&gt; 
+&lt;p&gt;10. In the top, left corner of portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;11. Set Retention (days) to 5, and then select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Log network traffic to and from a virtual machine using the Azure portal" url="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that NSG flow logs are enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AZURE-VNET2" name="Enable packet capture for VPN gateways" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable packet capture for VPN gateways&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use VPN Gateway's packet capture in addition to commonly available packet capture tools to record network packets.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To set up packet capture in Azure portal&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Go to Virtual network gateway setup.&lt;/p&gt; 
+&lt;p&gt;3. Select VPN Gateway Packet Capture from the left-nav menu.&lt;/p&gt; 
+&lt;p&gt;4. Click Start Packet Capture.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure packet capture for VPN gateways" url="https://docs.microsoft.com/en-us/azure/vpn-gateway/packet-capture"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that packet capture for VPN gateways is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Licensing requirements&lt;/p&gt;
+
+  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
+
+  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
+- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
+
+  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
+
+  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
+- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
+When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
+
+  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AZURE-VNET1" name="Enable resource logs for NSGs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable resource logs for NSGs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; When you enable logging for an NSG, you can gather the following types of resource log information:&lt;br&gt; - Event: Entries are logged for which NSG rules are applied to VMs, based on MAC address.&lt;br&gt; - Rule counter: Contains entries for how many times each NSG rule is applied to deny or allow traffic. The status for these rules is collected every 300 seconds.&lt;br&gt; Resource logs are only available for NSGs deployed through the Azure Resource Manager deployment model. You cannot enable resource logging for NSGs deployed through the classic deployment model. &lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to enable resource logs for NSG from Azure Portal&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the portal.&lt;/p&gt; 
+&lt;p&gt;2. Select All services, then type network security groups. When Network security groups appear in the search results, select it.&lt;/p&gt; 
+&lt;p&gt;3. Select the NSG you want to enable logging for.&lt;/p&gt; 
+&lt;p&gt;4. Under MONITORING, select Diagnostics logs, and then select Turn on diagnostics.&lt;/p&gt; 
+&lt;p&gt;5. Under Diagnostics settings, enter, or select the following information, and then select Save:&lt;/p&gt; 
+&lt;p&gt;- Name: A name of your choosing. For example: myNsgDiagnostics&lt;br&gt; - Archive to a storage account, Stream to an event hub, and Send to Log Analytics: You can select as many destinations as you choose.&lt;br&gt; - LOG: Select either, or both log categories.&lt;/p&gt; 
+&lt;p&gt;6. View and analyze logs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Resource logging for a network security group" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;View and analyze logs&lt;br /&gt;
+To learn how to view resource log data, see Azure platform logs overview. If you send diagnostics data to:&lt;/p&gt;
+
+	&lt;p&gt;Azure Monitor logs: You can use the network security group analytics solution for enhanced insights. The solution provides visualizations for NSG rules that allow or deny traffic, per MAC address, of the network interface in a virtual machine.&lt;br /&gt;
+Azure Storage account: Data is written to a PT1H.json file. You can find the:&lt;br /&gt;
+Event log in the following path: insights-logs-networksecuritygroupevent/resourceId=/SUBSCRIPTIONS/[ID]/RESOURCEGROUPS/[RESOURCE-GROUP-NAME-FOR-NSG]/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/[NSG NAME]/y=[YEAR]/m=[MONTH/d=[DAY]/h=[HOUR]/m=[MINUTE]&lt;br /&gt;
+Rule counter log in the following path: insights-logs-networksecuritygrouprulecounter/resourceId=/SUBSCRIPTIONS/[ID]/RESOURCEGROUPS/[RESOURCE-GROUP-NAME-FOR-NSG]/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/[NSG NAME]/y=[YEAR]/m=[MONTH/d=[DAY]/h=[HOUR]/m=[MINUTE]&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FIREWALL3" name="Enable Threat intelligence-based filtering to alert and deny traffic" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Threat intelligence-based filtering to alert and deny traffic&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. Azure recommends to enable it in alert and deny mode.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, threat intelligence-based filtering is enabled in alert mode. You cannot turn off this feature or change the mode until the portal interface becomes available in your region.&lt;br&gt; You can then change the mode by selecting "Alert and deny" in the Azure portal interface.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; none&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Firewall threat intelligence-based filtering" url="https://docs.microsoft.com/en-us/azure/firewall/threat-intel"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing&lt;/p&gt;
+
+  &lt;p&gt;- Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.&lt;/p&gt;
+
+  &lt;p&gt;- Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt;
+   Use encryption to protect traffic on external and public networks as it is critical for data protection 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Rationale: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Remediation: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Use a valid TLS/SSL certificate for custom domains. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Redirect HTTP to HTTPs 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enforce FTPS 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enable client certificates 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Impact: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
+            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
+            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
+            <reference name="Security in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test HTTPS 
+&lt;/div&gt; 
+&lt;div&gt;
+  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references>
+              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-CRED-SCAN" name="Implement Credential Scanner to identify credentials within code" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement Credential Scanner to identify credentials within code&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Prerequisites:&lt;br&gt; 1. You are using the Azure DevOps Build system.&lt;br&gt; 2. The Microsoft Security Code Analysis Extension installed in your account.&lt;br&gt; Setup:&lt;br&gt; 1. Open your team project from your Azure DevOps Account.&lt;br&gt; 2. Navigate to the Build tab under Build and Release&lt;br&gt; 3. Select the Build Definition into which you wish to add the CredScan build task.&lt;br&gt; - New - Click New and follow the steps detailed to create a new Build Definition.&lt;br&gt; - Edit - Select the Build Definition. On the subsequent page, click Edit to begin editing the Build Definition.&lt;br&gt; 4. Click + to navigate to the Add Tasks pane.&lt;br&gt; 5. Find the CredScan build task either from the list or using the search box and then click Add.&lt;br&gt; 6. The Run CredScan build task should now be a part of the Build Definition.&lt;/p&gt; 
+&lt;p&gt;Customizing the CredScan Build Task:&lt;br&gt; 1. Click the task Run CredScan to see the different options available within.&lt;br&gt; 2. Available options include&lt;br&gt; Output Format - TSV/ CSV/ SARIF/ PREfast&lt;br&gt; Tool Version (Recommended: Latest)&lt;br&gt; Scan Folder - The folder in your repository to scan&lt;br&gt; Searchers File Type - Options to locate the searchers file used for scanning.&lt;br&gt; Suppressions File - A JSON file can be used for suppressing issues in the output log (more details in the Resources section).&lt;br&gt; (New) Verbose Output - self explanatory&lt;br&gt; Batch Size - The number of concurrent threads used to run Credential Scanners in parallel. Defaults to 20 (Value must be in the range of 1 to 2147483647).&lt;br&gt; (New) Match Timeout - The amount of time to spend attempting a searcher match before abandoning the check.&lt;br&gt; (New) File Scan Read Buffer Size - Buffer size while reading content in bytes. (Defaults to 524288)&lt;br&gt; (New) Maximum File Scan Read Bytes - Maximum number of bytes to read from a given file during content analysis. (Defaults to 104857600)&lt;br&gt; Run this task (under Control Options) - Specifies when the task should run. Choose "Custom conditions" to specify more complex conditions.&lt;/p&gt; 
+&lt;p&gt;*Version - Build task version within Azure DevOps. Not frequently used.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Getting started with Credential Scanner (CredScan)" url="https://secdevtools.azurewebsites.net/helpcredscan.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Credential Scanner is implemented&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N08" name="Isolate Azure resources into separate VNets by function" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Place the resources into separate VNets according to their use (production, development, test).
+                        Placing such resources accordingly ensures that a resource of a higher security level is not
+                        exposed by the security settings of a lower labeled VNet.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
+                        &lt;li&gt;Migrate or move it to the correct Vnet.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Azure Virtual Network" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Identify the resources that exist in an incorrect VNet.&lt;/li&gt;
+                            &lt;li&gt;Check that the resources are into the correct Vnet.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADMIN-INV" name="Maintain an inventory of administrative accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintain an inventory of administrative accounts&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure AD has built-in roles that must be explicitly assigned and are queryable. Use the Azure AD PowerShell module to perform ad hoc queries to discover accounts that are members of administrative groups.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; How to get a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole [-Filter ] [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRole -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;How to get members of a directory role in Azure AD with PowerShell&lt;/p&gt; 
+&lt;p&gt;Get-AzureADDirectoryRoleMember -ObjectId  [-InformationAction ] [-InformationVariable ] []&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get-AzureADDirectoryRole" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0"/>
+            <reference name="Get-AzureADDirectoryRoleMember" url="https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrolemember?view=azureadps-2.0"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you maintain an inventory of administrative accounts.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APPROVED-LOCATIONS" name="Manage Azure resources from only approved locations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Manage Azure resources from only approved locations 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use Conditional Access Named Locations to allow access from only specific logical groupings of IP address ranges or countries/regions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Prerequisites 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - An Azure AD tenant. Sign up for a free trial. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - A user, who is a global administrator for the tenant. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - An IP range that is established and credible in your organization. The IP range needs to be in Classless Interdomain Routing (CIDR) format. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure named locations 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the left pane, select Azure Active Directory, then select Conditional Access from the Security section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Conditional Access page, select Named locations and select New location. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Fill out the form on the new page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In the Name box, type a name for your named location. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In the IP ranges box, type the IP range in CIDR format. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Click Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Configure named locations in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that you have configured named locations in your Azure environment.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-REPOS-GIT" name="Securely store configuration of Azure resources" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Securely store configuration of Azure resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; If using custom Azure Policy definitions, use Azure DevOps or Azure Repos to securely store and manage your code.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Use version control to save your work and coordinate code changes across your team. Even if you are just a single developer, version control helps you stay organized as you fix bugs and develop new features. Version control keeps a history of your development so that you can review and even rollback to any version of your code with ease.&lt;/p&gt; 
+&lt;p&gt;Version control workflow&lt;/p&gt; 
+&lt;p&gt;Version control has a general workflow that most developers use when writing code and sharing it with the team.&lt;/p&gt; 
+&lt;p&gt;These steps are:&lt;br&gt; 1. Get a local copy of code if they do not have one yet.&lt;br&gt; 2. Make changes to code to fix bugs or add new features.&lt;br&gt; 3. Once the code is ready, make it available for review by your team.&lt;br&gt; 4. Once the code is reviewed, merge it into the team's shared codebase.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Repos Git tutorial" url="https://docs.microsoft.com/en-us/azure/devops/repos/git/gitworkflow?view=azure-devops"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that the configuration of Azure resources is securely stored.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
+  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
+  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
+  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
+&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
+&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
+&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
+&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
+&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
+  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
+  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
+   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0 is are blocked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N03" name="Use Network Security Groups to block ingress to port 3389 from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure
+                        resources. Set the limit inbound access to port 3389 (Remote Desk Protocol) to IP addresses that
+                        require this access to avoid undue exposure to risk.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                        &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt;
+                        &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;:&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Allow RDP port traffic just to/from IPs that require the access.&lt;/li&gt;
+                        &lt;li&gt;Otherwise, remove all rules that allow port 3389 traffic.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that the traffic through the
+                            port 3389 is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-TAGS" name="Use service tags in place of specific IP addresses" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use service tags in place of specific IP addresses&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to define network access controls on network security groups or Azure Firewall. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name, such as ApiManagement, in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;You can use service tags to achieve network isolation and protect your Azure resources from the general Internet while accessing Azure services that have public endpoints. Create inbound/outbound network security group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available service tags of specific Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; By default, service tags reflect the ranges for the entire cloud. Some service tags also allow more granular control by restricting the corresponding IP ranges to a specified region. For example, the service tag Storage represents Azure Storage for the entire cloud, but Storage.WestUS narrows the range to only the storage IP address ranges from the WestUS region.&lt;/p&gt; 
+&lt;p&gt;By specifying the service tag name in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Virtual network service tags" url="https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your network security rules are simplified by using VNet Service tags.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-21T14:49:42.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADMIN-INV" mitigation="50"/>
+                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADMIN-INV" mitigation="50"/>
+                <countermeasure ref="AZURE-MANAGED-ID" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VM01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-REPOS-GIT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-CRED-SCAN" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-CRED-SCAN" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="INSUFFICIENT-LOGGING-MONITORING" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="14"/>
+                    <countermeasure ref="AZURE-AD10" mitigation="14"/>
+                    <countermeasure ref="AZURE-MONITOR6" mitigation="14"/>
+                    <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="14"/>
+                    <countermeasure ref="AZURE-SECURITY-CENTER4" mitigation="14"/>
+                    <countermeasure ref="C-AZURE-VNET1" mitigation="15"/>
+                    <countermeasure ref="C-AZURE-VNET2" mitigation="15"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="14"/>
+                <countermeasure ref="AZURE-AD10" mitigation="14"/>
+                <countermeasure ref="AZURE-MONITOR6" mitigation="14"/>
+                <countermeasure ref="AZURE-NSG-FLOW-LOGS" mitigation="14"/>
+                <countermeasure ref="AZURE-SECURITY-CENTER4" mitigation="14"/>
+                <countermeasure ref="C-AZURE-VNET1" mitigation="15"/>
+                <countermeasure ref="C-AZURE-VNET2" mitigation="15"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N01" mitigation="9"/>
+                    <countermeasure ref="AZ-N02" mitigation="9"/>
+                    <countermeasure ref="AZ-N03" mitigation="9"/>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="9"/>
+                    <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="9"/>
+                    <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="9"/>
+                    <countermeasure ref="AZURE-FIREWALL3" mitigation="9"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="9"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-NON-IDENTIFY">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-TAGS" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N08" mitigation="9"/>
+                    <countermeasure ref="AZ-N09" mitigation="9"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N01" mitigation="9"/>
+                <countermeasure ref="AZ-N02" mitigation="9"/>
+                <countermeasure ref="AZ-N03" mitigation="9"/>
+                <countermeasure ref="AZ-N08" mitigation="9"/>
+                <countermeasure ref="AZ-N09" mitigation="9"/>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="9"/>
+                <countermeasure ref="AZURE-APPROVED-LOCATIONS" mitigation="9"/>
+                <countermeasure ref="AZURE-DDOS-PROTECTION" mitigation="9"/>
+                <countermeasure ref="AZURE-FIREWALL3" mitigation="9"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="9"/>
+                <countermeasure ref="AZURE-TAGS" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml b/Templates/Submitted_Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml
new file mode 100644
index 0000000..39209bb
--- /dev/null
+++ b/Templates/Submitted_Templates/azure-mqtt-client-to-azure-functions-and-web-backend.xml
@@ -0,0 +1,7855 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="Azure - MQTT Client to Azure Functions and Web backend" name="Azure - MQTT Client to Azure Functions and Web backend" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIxIiBpckRyYXdpb1ZlcnNpb249IjMuMS4wIj48cm9vdD48bXhDZWxsIGlkPSIwIi8+PG14Q2VsbCBpZD0iMSIgcGFyZW50PSIwIi8+PG14Q2VsbCBpZD0iMiIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTU0MS4wIiB5PSI0NjMuMCIgd2lkdGg9IjU5Mi4wIiBoZWlnaHQ9IjQzNS4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iTWljcm9zb2Z0IFNRTCBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9YWNkMmFiMmEtNjJkYS00ZDZkLWJhZDItYTZhYTIwMDM0NTdlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc29mdC1zcWwtc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TXprMk5qZ2dNQzR5TkRnd056aERNQzQ0TXprMk5qZ2dNQzR6TkRBNE9UZ2dNQzQyT0RjME16TWdNQzQwTVRZd056Z2dNQzQwT1RrMk5qZ2dNQzQwTVRZd056aERNQzR6TVRFNU1ETWdNQzQwTVRZd056Z2dNQzR4TlRrMk5qZ2dNQzR6TkRBNE9UZ2dNQzR4TlRrMk5qZ2dNQzR5TkRnd056aERNQzR4TlRrMk5qZ2dNQzR4TlRVeU5UZ2dNQzR6TVRFNU1ETWdNQzR3T0RBd056Z3hJREF1TkRrNU5qWTRJREF1TURnd01EYzRNVU13TGpZNE56UXpNeUF3TGpBNE1EQTNPREVnTUM0NE16azJOamdnTUM0eE5UVXlOVGdnTUM0NE16azJOamdnTUM0eU5EZ3dOemhhVFRBdU9ETTVOalk0SURBdU16YzJNekEwUXpBdU9ERTRNVGcySURBdU16azBPVGM1SURBdU56azBNamt4SURBdU5ERXdOelUxSURBdU56WTROakE0SURBdU5ESXpNakU0UXpBdU5qazJORFF6SURBdU5EVTRPRE0wSURBdU5qQXhNekk0SURBdU5EYzVNRGM0SURBdU5EazVOalk0SURBdU5EYzVNRGM0UXpBdU16azRNREE0SURBdU5EYzVNRGM0SURBdU16QXlPRGt6SURBdU5EVTRPRE0wSURBdU1qTXdOekk0SURBdU5ESXpNakU0UXpBdU1qQTFNRFEySURBdU5ERXdOelUxSURBdU1UZ3hNVFVnTUM0ek9UUTVOemtnTUM0eE5UazJOamdnTUM0ek56WXpNRFJXTUM0M05USXdOemhETUM0eE5UazJOamdnTUM0NE5EUTRPVGdnTUM0ek1URTVNRE1nTUM0NU1qQXdOemdnTUM0ME9UazJOamdnTUM0NU1qQXdOemhETUM0Mk9EYzBNek1nTUM0NU1qQXdOemdnTUM0NE16azJOamdnTUM0NE5EUTRPVGdnTUM0NE16azJOamdnTUM0M05USXdOemhXTUM0ek56WXpNRFJhVFRBdU5UQTROek1nTUM0MU1qRXlOemRETUM0MU1EYzFOamdnTUM0MU1qRXhNakVnTUM0ME9EZzRNekVnTUM0MU1qYzROellnTUM0ME56WTNORFFnTUM0MU16STNPRFJETUM0ME5qQTBNeklnTUM0MU16azBNemNnTUM0ME5EYzNOalVnTUM0MU5EVTNOekVnTUM0ME16azVOVE1nTUM0MU5URXlOVGxETUM0ME16YzBNelVnTUM0MU5UTXdORFFnTUM0ME16UXpOaklnTUM0MU5UWXdNVGtnTUM0ME16TXlNVElnTUM0MU5UYzNNRGRNTUM0ME16TXdNVFlnTUM0MU5UZ3dNVFJNTUM0ME16STRNamNnTUM0MU5UZ3pPRFJETUM0ME16STJNVGNnTUM0MU5UZzVNVE1nTUM0ME16STFNU0F3TGpVMU9UVTBOaUF3TGpRek1qVXhJREF1TlRZd01UYzVUREF1TkRNeU5qZ3lJREF1TlRZd016UXhRekF1TkRNeU56STRJREF1TlRZd09UQTJJREF1TkRNeU9EWXpJREF1TlRZeE5UUXpJREF1TkRNek1UUTBJREF1TlRZeU1qTTVRekF1TkRNek9ETWdNQzQxTmpNNU1qY2dNQzQwTXpVNE16Y2dNQzQxTmpVNU9EVWdNQzQwTXpneE1EVWdNQzQxTmpnd09UZERNQzQwTXpneE1EVWdNQzQxTmpnd09UY2dNQzQwTmpFMU9UUWdNQzQxT1RFd01EUWdNQzQwTmpRME5ETWdNQzQxT1RReU56ZERNQzQwTnpjME1qZ2dNQzQyTURreU5qY2dNQzQwT0RNd056WWdNQzQyTWpRd05EY2dNQzQwT0RNMk1EUWdNQzQyTkRRME1qRkRNQzQwT0RNNU1qRWdNQzQyTlRjMU1URWdNQzQwT0RFME5DQXdMalkyT1RBeE9DQXdMalEzTlRJMk5DQXdMalk0TWpNM05FTXdMalEyTkRJNE5TQXdMamN3TmpNek5pQXdMalEwTVRZNE1TQXdMamN6TWpVNU1pQXdMalF3TlRrME55QXdMamMyTVRrek9Vd3dMalF3TlRFeE5TQXdMamMyTWpZd01rTXdMalF3TXpNMU55QXdMamMyTXprNU15QXdMalF3TVRJME9TQXdMamMyTlRnNE15QXdMak01T1RFMU15QXdMamMyTnprd04wTXdMak01TmpFMU5DQXdMamMzTURnZ01DNHpPVE14T0RFZ01DNDNOek01TmpRZ01DNHpPVEV5T0RjZ01DNDNOell6TWpaRE1DNHpPRFkwT0RJZ01DNDNPREl6TkRNZ01DNHpPREkyT0RNZ01DNDNPRGczTWprZ01DNHpPREV3TkRZZ01DNDNPVE0yTXpsRE1DNHpOemd4TkRNZ01DNDRNREkxTURnZ01DNHpOemsxTmpnZ01DNDRNVEUwT0NBd0xqTTROVEUyTkNBd0xqZ3hPVGMyTjBNd0xqTTVNak0wTWlBd0xqZ3pNRE15TXlBd0xqUXdOalkwTnlBd0xqZzBNVEE1TWlBd0xqUXlNek15TlNBd0xqZzBPRFF5TjBNd0xqUXpNVGd5TkNBd0xqZzFNakUzTnlBd0xqUTBOakV5T1NBd0xqZzFOams0SURBdU5EVTJPRGsySURBdU9EVTVOamN4UXpBdU5EYzBOemc1SURBdU9EWTBNakV4SURBdU5UQTVOREUxSURBdU9EWTVNVElnTUM0MU1qZzBOamtnTUM0NE5qazROVGhETUM0MU16SXpNaklnTUM0NE56QXdNVGNnTUM0MU16azFOemtnTUM0NE5qazVOemNnTUM0MU16azFOemtnTUM0NE5qazVOemRETUM0MU16azFOemtnTUM0NE5qazVOemNnTUM0MU5ERXdPRFFnTUM0NE5qTTVORGNnTUM0MU5EUTFNVFlnTUM0NE5UWTVNalpETUM0MU5EUTFNVFlnTUM0NE5UWTVNallnTUM0MU5UZzROeklnTUM0NE1Ua3dPU0F3TGpVMk5EY3pNaUF3TGpjNU9UazNPVXd3TGpVMk5UazJPQ0F3TGpjNU5UazJPRU13TGpVM01Ea3lOU0F3TGpjM09Ua3dOaUF3TGpVM01qazVOQ0F3TGpjM016SWdNQzQxTnpRMU56a2dNQzQzTkRrNU56aERNQzQxTnpZeU5ERWdNQzQzTWpVMk56SWdNQzQxTnpZeE5ERWdNQzQzTWpNNE5EY2dNQzQxTnpVNE5EUWdNQzQzTVRnME5qUk1NQzQxTnpVNE1UVWdNQzQzTVRjNU5EbERNQzQxTnpVek5DQXdMamN3T0RRME9TQXdMalUzTkRRNU5TQXdMamN3TURjME1TQXdMalUzTXpFM055QXdMalk1TXpFNU5Fd3dMalUzTWprM01TQXdMalk1TVRVNFF6QXVOakUxTXpneklEQXVOamM0T1RneUlEQXVOall5TWpneElEQXVOalkzTlRrM0lEQXVOamt6TXpZMUlEQXVOall5T0RReVREQXVOams0TVRZNElEQXVOall5TVRBMFREQXVOamszTkRNZ01DNDJOakE1TkRORE1DNDJPVE15TURjZ01DNDJOVFF6T1RjZ01DNDJPVEF6TURRZ01DNDJOVEF6TXpJZ01DNDJPRFk0TVRrZ01DNDJORFl3TURSRE1DNDJOelkyT0RVZ01DNDJNek0wTkRJZ01DNDJOalF6T0RrZ01DNDJNak15TlRVZ01DNDJORGt6TkRNZ01DNDJNVFE0TVVNd0xqWXlPRFkxTXlBd0xqWXdNekkxTVNBd0xqWXdNVGc1TVNBd0xqVTVOREl5TlNBd0xqVTJPREF3TlNBd0xqVTROelV5TVV3d0xqVTFOREEzTlNBd0xqVTROVXd3TGpVek5qRTRPQ0F3TGpVNE1qQTROMHd3TGpVek5URXlNaUF3TGpVNE1ERTRORU13TGpVeU9EZzVNeUF3TGpVMk9USXdOU0F3TGpVeU1qQXpNaUF3TGpVMU5UVTROaUF3TGpVeE9EQXlNU0F3TGpVME5qUXdNa3d3TGpVeE5UY3hNU0F3TGpVME1EZzFRekF1TlRFek5EazRJREF1TlRNMU1qWTVJREF1TlRFeE5UTTJJREF1TlRJNU5UVXpJREF1TlRFd016RXpJREF1TlRJMU1UTXlRekF1TlRBNU5ERTNJREF1TlRJeE5UUXlJREF1TlRBNU16RWdNQzQxTWpFek15QXdMalV3T0RjeklEQXVOVEl4TWpjM1drMHdMalEwTnpjME1pQXdMalUzTVRFNU5rd3dMalEwTmpVNE1TQXdMalUzTURnME9Vd3dMalEwT1RFMk55QXdMalUzTWprd04wTXdMalEyTURRMk15QXdMalU0TVRjM05DQXdMalEzTURJeU9DQXdMalU1TWpnd05pQXdMalEzTmpRd01pQXdMall3TXpZM09FTXdMalEzTnpBNE9TQXdMall3TkRnNU15QXdMalEzTnpZMk9TQXdMall3TlRjNU1pQXdMalEzTnpjeU1pQXdMall3TlRjek9FTXdMalEzTnpjM05pQXdMall3TlRjek9DQXdMalEzTnpJME55QXdMall3TXpZeU55QXdMalEzTmpVMk1pQXdMall3TVRFME5Vd3dMalEzTXpRd05pQXdMalU1TURRM04wTXdMalEzTVRRd01TQXdMalU0TXprMU1pQXdMalEyT1RJNU5DQXdMalUzTnpReElEQXVORFk1TURZM0lEQXVOVGMzTVRnelREQXVORFk0TWpZMElEQXVOVGMyT1RjeVREQXVORFl6TWpBM0lEQXVOVGMxTmpVeVREQXVORFUyTWpRZ01DNDFOek00TURWTU1DNDBORGcxT0RjZ01DNDFOekUwT0RKTU1DNDBORGMzTkRJZ01DNDFOekV4T1RaYVRUQXVORGMxTXprNUlEQXVOVGM0TlRBeFREQXVORGN5TlRRNUlEQXVOVGM0TURJNFREQXVORGN5TlRFeElEQXVOVGM0TURNNFREQXVORGN6TlRVeklEQXVOVGd3TkRBeFF6QXVORGMzTVRReUlEQXVOVGc0TURVMUlEQXVORGd4TVNBd0xqVTVPRGt5T1NBd0xqUTRNeUF3TGpZd05qSTJOVXd3TGpRNE16VTRNaUF3TGpZd09ESTNNVXd3TGpRNE5qUXpNU0F3TGpZd05UUTNNME13TGpRNE9UUXlOQ0F3TGpZd01qUTRNaUF3TGpRNU16TXpJREF1TlRrNU1qSTRJREF1TkRrM056RTFJREF1TlRrMk1EYzBUREF1TlRBeE16WTVJREF1TlRrek5UUTBRekF1TlRBek5qa3hJREF1TlRreE9UWXhJREF1TlRFd056RXlJREF1TlRnM056a3lJREF1TlRFeU5EVXpJREF1TlRnMk9EazFUREF1TlRFek9EZ2dNQzQxT0RVNU9UZE1NQzQxTVRNeU5qSWdNQzQxT0RVM09ESk1NQzQxTVRBM05qTWdNQzQxT0RVek1VTXdMalV3TURRM01TQXdMalU0TXpVMk9TQXdMalE0TkRNM015QXdMalU0TURVd09DQXdMalEzTlRNNU9TQXdMalUzT0RVd01WcE5NQzQxTVRneU5Ua2dNQzQxT0RZM016ZE1NQzQxTVRnM055QXdMalU0Tnpjek5Vd3dMalV5TURFMU9TQXdMalU1TWpVNU5VTXdMalV5TWpFeE1pQXdMall3TURJME9TQXdMalV5TXpBeElEQXVOakE0TnprNUlEQXVOVEl5TmprMElEQXVOakUyTnpkTU1DNDFNakl6TnpVZ01DNDJNakV6TVV3d0xqVXlNakl4T1NBd0xqWXlNVGd6Tmt3d0xqVXhPVFEzTkNBd0xqWXlNRGswVERBdU5UQTJNRFF5SURBdU5qRTJPRGxNTUM0ME9UWTNOemNnTUM0Mk1UUXlNelZETUM0ME9USXlPU0F3TGpZeE16QXlNaUF3TGpRNE9EWTBPU0F3TGpZeE1Ua3hOQ0F3TGpRNE9EWTBPU0F3TGpZeE1UZ3dOME13TGpRNE9EWTBPU0F3TGpZeE1UUTVNU0F3TGpRNU5URTVNeUF3TGpZd05EazBOeUF3TGpRNU56azVNaUF3TGpZd01qUTJOVU13TGpVd016TXlNU0F3TGpVNU56YzJOeUF3TGpVeE56YzROQ0F3TGpVNE5qVTNOeUF3TGpVeE9ESTFPU0F3TGpVNE5qY3pOMXBOTUM0MU5UTTJNak1nTUM0MU9USTNOVE5ETUM0MU5ETTNOVE1nTUM0MU9UQTROVE1nTUM0MU1qSXdOaUF3TGpVNE56RXdOU0F3TGpVeU1Ua3dNaUF3TGpVNE56STJORXd3TGpVeU1qVXpOU0F3TGpVNE9EazFNME13TGpVeU5qSXpJREF1TlRrM05UQTBJREF1TlRJNE1qTTJJREF1TmpBM05qTTRJREF1TlRJNE1qTTJJREF1TmpFM05qWTNUREF1TlRJNE16UXhJREF1TmpJeE1EUTFUREF1TlRNek16VTJJREF1TmpFM056Y3lRekF1TlRRek5qUTRJREF1TmpFd09URXhJREF1TlRVek9Ua3pJREF1TmpBMU1qWXpJREF1TlRZM09USTRJREF1TlRrNE9UZ3lUREF1TlRjeE5UazJJREF1TlRrM01qTXpRekF1TlRjeU1qSTNJREF1TlRrMk9EZzJJREF1TlRjeU5ERXhJREF1TlRrMk56RXhJREF1TlRjeU1qVTJJREF1TlRrMk5qVTVRekF1TlRjeE5qSXpJREF1TlRrMk16azJJREF1TlRZd09UWXhJREF1TlRrME1UYzRJREF1TlRVek5qSXpJREF1TlRreU56VXpXazB3TGpVM09EQXdPU0F3TGpVNU9ETTBPVU13TGpVM09ERTJOeUF3TGpVNU9EVXdOeUF3TGpVM056UTRJREF1TmpBeU56Z3lJREF1TlRjMk9EUTNJREF1TmpBMU16RTFRekF1TlRjME9UUTNJREF1TmpFek1UZ3hJREF1TlRZNU9ESTRJREF1TmpJME9EUTJJREF1TlRZek5UUTNJREF1TmpNMU9ESTFUREF1TlRZeE16STVJREF1TmpNNU5ERTBUREF1TlRVNE1UWXpJREF1TmpNM056STBRekF1TlRVeU1EUWdNQzQyTXpReE16VWdNQzQxTkRVd056TWdNQzQyTXpBM05UY2dNQzQxTXpjME56SWdNQzQyTWpjMU9EbE1NQzQxTXpVM016Z2dNQzQyTWpZNE5rd3dMalV6TXpRMk1TQXdMall5TlRnME9VTXdMalV6TXpBNU1TQXdMall5TlRVek1TQXdMalUxTURBNE55QXdMall4TkRJNE9TQXdMalUxT1RBMk1TQXdMall3T0Rrd05FTXdMalUyTmpFNE55QXdMall3TkRVM055QXdMalUzTnpjNU55QXdMalU1T0RFek55QXdMalUzT0RBd09TQXdMalU1T0RNME9WcE5NQzQxT1RjeE1UWWdNQzQyTURNd09UaE1NQzQxT1RJMU5UWWdNQzQyTURFM09EaE1NQzQxT0RJd01pQXdMalU1T0RrNE1rTXdMalU0TVRreU15QXdMalU1T0RrNE1pQXdMalU0TVRneU5TQXdMalU1T1RJNE1pQXdMalU0TVRjMU15QXdMalU1T1RjME5rTXdMalU0TVRjd055QXdMall3TURBek5pQXdMalU0TVRZM01TQXdMall3TURNNUlEQXVOVGd4TmpVZ01DNDJNREEzTnpWRE1DNDFPREEzTlRNZ01DNDJNVEUwTXprZ01DNDFOemN4TVRJZ01DNDJNak01TkRnZ01DNDFOekUwTmpVZ01DNDJNelU1TTBNd0xqVTNNVEV3T0NBd0xqWXpOalk1T0NBd0xqVTNNRGM1TXlBd0xqWXpOek01TmlBd0xqVTNNRFU0T1NBd0xqWXpOemc0T0VNd0xqVTNNRFFnTUM0Mk16Z3pORE1nTUM0MU56QXpNRFVnTUM0Mk16ZzJNak1nTUM0MU56QXpOVFlnTUM0Mk16ZzJNak5NTUM0MU56TXpOalFnTUM0Mk16YzBOakZETUM0MU9USXhNRElnTUM0Mk1qazROaUF3TGpZeE1UVXlOaUF3TGpZeU16ZzBNeUF3TGpZek5ESXlNaUF3TGpZeE9EWXhOMHd3TGpZek5qa3hNeUF3TGpZeE56azRNMHd3TGpZek16QTJJREF1TmpFMk1qUXlRekF1TmpJek56Y3lJREF1TmpFeU1ERTVJREF1TmpBNU5USWdNQzQyTURZM09UVWdNQzQxT1RjeE1UWWdNQzQyTURNd09UaGFUVEF1TkRreU9UYzFJREF1TmpJeU16WTJUREF1TkRrM09ETXpJREF1TmpJek5qTXhRekF1TlRBek9EUTVJREF1TmpJMU16SXhJREF1TlRFMk5qSXpJREF1TmpJNU5UazFJREF1TlRFMk5qSXpJREF1TmpJNU9URXlUREF1TlRFME9UZzJJREF1TmpNeE16Y3hUREF1TlRFek5URWdNQzQyTXpJMk5UZERNQzQxTURZMU9UWWdNQzQyTXpnME1URWdNQzQwT1RrNU5EVWdNQzQyTkRRME9DQXdMalE1TVRrM05DQXdMalkxTWpFNE5rd3dMalE0TnpRNE9DQXdMalkxTmpNd05FTXdMalE0TnpNNE1TQXdMalkxTmpNd05DQXdMalE0TnpNeU9TQXdMalkxTlRrNE55QXdMalE0TnpNNE1TQXdMalkxTlRVMk5FTXdMalE0T0RVNU5pQXdMalkwTmpZNU55QXdMalE0T0RNek15QXdMall6TlRJNU5pQXdMalE0TmpZME15QXdMall5TXpjek5rd3dMalE0TmpVek5pQXdMall5TWpjMk4wd3dMalE0TmpNNElEQXVOakl3T1RSRE1DNDBPRFkwT0RNZ01DNDJNakE0TXpjZ01DNDBPRGsyTnpRZ01DNDJNakUxTlNBd0xqUTVNamszTlNBd0xqWXlNak0yTmxwTk1DNDJNemt4TnpRZ01DNDJNak0wTmpWTU1DNDJOREExTlRZZ01DNDJNakV3T1RoRE1DNDJOREEwTlRFZ01DNDJNakE1T1RFZ01DNDJNek0yTkRJZ01DNDJNakk1TkRRZ01DNDJNamN5TlRRZ01DNDJNalE1TlRGRE1DNDJNVFV3TmpFZ01DNDJNamcyT1RrZ01DNDFPVGc0TURZZ01DNDJNelExTURVZ01DNDFPRFk0TnpZZ01DNDJNemt6TmpGRE1DNDFPREF3TmpjZ01DNDJOREl4TURZZ01DNDFOekV3T1RVZ01DNDJORFU1TlRnZ01DNDFOekV3T1RVZ01DNDJORFl4TVRkTU1DNDFOekl4TlRFZ01DNDJORGN3TVROTU1DNDFOell3TlRZZ01DNDJOVEF4T0RGRE1DNDFPRFEwTkRnZ01DNDJOVGN4TkRrZ01DNDFPVEUxTWpJZ01DNDJOalE1TURnZ01DNDFPVGMwTXpNZ01DNDJOek0zTnpWTU1DNDFPVGc1TVRFZ01DNDJOelU0T0RWTU1DNDJNREV3TURRZ01DNDJOek16TURKTU1DNDJNREk0TVRnZ01DNDJOekV3TXpGTU1DNDJNVFkyTkRZZ01DNDJOVE0xTlRsRE1DNDJNamN4TlNBd0xqWTBNRE0yTkNBd0xqWXpNVGM1TmlBd0xqWXpORE0wTmlBd0xqWXpORGsyTWlBd0xqWXlPVGd3TjB3d0xqWXpPVEUzTkNBd0xqWXlNelEyTlZwTk1DNDJORFEyTWpFZ01DNDJNakl4TlROTU1DNDJORFUwTURNZ01DNDJNakkwTWpaTU1DNDJORGMyTWprZ01DNDJNak0yTXpGRE1DNDJOakEwTlRZZ01DNDJNekE1TmpjZ01DNDJOek13TVRnZ01DNDJOREEwTVRZZ01DNDJPREk1TkRFZ01DNDJOVEF4TWpoRE1DNDJPRFUzTkNBd0xqWTFNamczTXlBd0xqWTVNalkxTkNBd0xqWTJNREExTWlBd0xqWTVNalUwTnlBd0xqWTJNREV3TTB3d0xqWTROekkyT1NBd0xqWTJNRFV5TjBNd0xqWTJOVEEwT1NBd0xqWTJNakl4TnlBd0xqWXpOalU1T1NBd0xqWTJOamt4TXlBd0xqWXdPVEkxTnlBd0xqWTNNelV4VERBdU5qQTFOalkzSURBdU5qYzBNekF5UXpBdU5qQTFOVFl5SURBdU5qYzBNekF5SURBdU5qQTNOaklnTUM0Mk56SXlORFFnTUM0Mk1UQXlNRGtnTUM0Mk5qazNOalJETUM0Mk1qWXlOVE1nTUM0Mk5UUXlPVGNnTUM0Mk16TTFPVEVnTUM0Mk5EUTFNelFnTUM0Mk5ESXlORFlnTUM0Mk1qY3hNVFJNTUM0Mk5EUTJNakVnTUM0Mk1qSXhOVE5hVFRBdU5UTTVPRFE0SURBdU5qUXdNVFV5UXpBdU5UTTBOamMySURBdU5qTTNOVFkySURBdU5USTNPREV6SURBdU5qTTBNelEySURBdU5USTNNRGN6SURBdU5qTTBNVGc0UXpBdU5USTJPVEUzSURBdU5qTTBNVGc0SURBdU5USTJOekExSURBdU5qTTBOekUzSURBdU5USTJORGsxSURBdU5qTTFOVEE0UXpBdU5USTBNek1nTUM0Mk5EVTFPRGdnTUM0MU1qQTFNamtnTUM0Mk5UVTVNelFnTUM0MU1UVTNOemtnTUM0Mk5qUTFPRGxETUM0MU1UUXpOVE1nTUM0Mk5qY3hOellnTUM0MU1UUXpNREVnTUM0Mk5qY3pPRGtnTUM0MU1UUTFNVE1nTUM0Mk5qY3pPRGxNTUM0MU1Ua3lNRGtnTUM0Mk5qUTFPRGxETUM0MU1qZ3dOemdnTUM0Mk5Ua3lNRGNnTUM0MU16WTFOelVnTUM0Mk5UUTFNRGtnTUM0MU5EWTBPVGtnTUM0Mk5EazFORGhETUM0MU5EazJNVElnTUM0Mk5EZ3dNVFlnTUM0MU5USXhORFVnTUM0Mk5EWTJPVGNnTUM0MU5USXdPVFFnTUM0Mk5EWTJORFZNTUM0MU5Ea3hOamdnTUM0Mk5EVXdNREZNTUM0MU16azRORGdnTUM0Mk5EQXhOVEphVFRBdU5USXdNakV5SURBdU5qTTFORFUxUXpBdU5USXdNemNnTUM0Mk16VTJNVE1nTUM0MU1UZzFOellnTUM0Mk5ESXhNRFlnTUM0MU1UYzBOamNnTUM0Mk5EVTJOREpETUM0MU1UVXpNRE1nTUM0Mk5USXpORFFnTUM0MU1URTJOaklnTUM0Mk5qQTNNemNnTUM0MU1EZ3hNalVnTUM0Mk5qY3dOekZNTUM0MU1EWTROallnTUM0Mk5qa3lOVEZNTUM0MU1EVXpNamNnTUM0Mk56RTVNamRNTUM0MU1EUXdNRGNnTUM0Mk56UXdNemhNTUM0MU1ERXdOVE1nTUM0Mk56RXhPRGxNTUM0ME9Ua3hNRElnTUM0Mk5qa3pOelZETUM0ME9UYzNPVGtnTUM0Mk5qZ3lNakVnTUM0ME9UWTFOVFVnTUM0Mk5qY3lNemtnTUM0ME9UVXlOelVnTUM0Mk5qWXpOVGxNTUM0ME9UTXlPRElnTUM0Mk5qVXdPRFZNTUM0ME9URXlNellnTUM0Mk5qTTVOVFpNTUM0ME9EZzNNREVnTUM0Mk5qSTBPRU13TGpRNE9EY3dNU0F3TGpZMk1qQTFOaUF3TGpRNU56Y3lOaUF3TGpZMU16ZzNOaUF3TGpVd05EWTBNU0F3TGpZME56azJOVXd3TGpVeE16QTROaUF3TGpZME1EazJOME13TGpVeE5UVXpOaUF3TGpZek9EazRPQ0F3TGpVeE56YzROeUF3TGpZek56SXdOaUF3TGpVeE9UQTNPU0F3TGpZek5qSXpNa013TGpVeE9UYzJOaUF3TGpZek5UY3hOQ0F3TGpVeU1ERTRNaUF3TGpZek5UUXlOQ0F3TGpVeU1ESXhNaUF3TGpZek5UUTFOVnBOTUM0MU5qUTNOaklnTUM0Mk5UUTBNRFJNTUM0MU5qSXhOellnTUM0Mk5USTNNVFJNTUM0MU5qQXpNamdnTUM0Mk5UVTFOalJETUM0MU5URXhORFFnTUM0Mk5qa3pOREVnTUM0MU16ZzNPVElnTUM0Mk9ETTBPRGNnTUM0MU1qUTROVGNnTUM0Mk9UWXpNVEpNTUM0MU1qQTJNVFVnTUM0M01EQXlOREpNTUM0MU1UazROak1nTUM0M01ERXdOVEpNTUM0MU1pQXdMamN3TVRBMk5Fd3dMalV5TkRZME55QXdMalk1T1RReU4wTXdMalUwTmpRME5pQXdMalk1TVRRd05TQXdMalUyTlRFeklEQXVOamcxTkRNNUlEQXVOVGc1TXpBMklEQXVOamM0TnpNMlREQXVOVGt6TlRnZ01DNDJOemMxTWpOTU1DNDFPVEk1TkRjZ01DNDJOelk0TXpaRE1DNDFPVEUzT0RVZ01DNDJOelUxTnlBd0xqVTROVGszT1NBd0xqWTNNRE0wTkNBd0xqVTRNamszTWlBd0xqWTJOemcyTWtNd0xqVTNOell6T1NBd0xqWTJNek0zTmlBd0xqVTNNRFkzTXlBd0xqWTFPREkxTnlBd0xqVTJORGMyTWlBd0xqWTFORFF3TkZwTk1DNDFOVEV4TkRRZ01DNDJOVFUwTlRsTU1DNDFORGcxSURBdU5qVTVNelU1VERBdU5UTTVOamc0SURBdU5qY3hOVEExUXpBdU5UTTBOVEUxSURBdU5qYzRNelkySURBdU5USTFNek14SURBdU5qZzVPRGN6SURBdU5URTRPVGszSURBdU5qazNNelkzVERBdU5URXpPVGcxSURBdU56QXpNVEl5VERBdU5URXpPRGMySURBdU56QXlPVGd4VERBdU5URXpOems0SURBdU56QXlNek0yVERBdU5URXpOemN6SURBdU56QXhNVFk1UXpBdU5URXpOemN6SURBdU5qazBOemd4SURBdU5URXlNVE0ySURBdU5qZzNPVGN5SURBdU5UQTVNamczSURBdU5qZ3lNVFk0UXpBdU5UQTRNRGN5SURBdU5qYzVOek01SURBdU5UQTNPRFlnTUM0Mk56a3hOVGdnTUM0MU1EZ3hNalVnTUM0Mk56ZzRPVFZETUM0MU1EZzNNaUF3TGpZM09ETTJNaUF3TGpVeE5ETTFNeUF3TGpZM05UQTNJREF1TlRJd09EWTBJREF1TmpjeE16ZzVUREF1TlRNME1UazVJREF1TmpZME1ERkRNQzQxTkRBM05EVWdNQzQyTmpBMU1qY2dNQzQxTlRBNU9ETWdNQzQyTlRVek5UUWdNQzQxTlRFeE5EUWdNQzQyTlRVME5UbGFUVEF1TkRnM01UY3hJREF1Tmpjek1Ua3pUREF1TkRnME5ESTFJREF1TmpjeE9ESXlRekF1TkRnME16SWdNQzQyTnpFNE1qSWdNQzQwT0RNM09URWdNQzQyTnpJNU9EUWdNQzQwT0RNek55QXdMalkzTkRVeE0wd3dMalE0TURnMk9TQXdMalk0TVRFNU4wd3dMalEzT0Rrek55QXdMalk0TlRVME5VTXdMalEzTnpBNE9TQXdMalk0T1RNNU9DQXdMalEzTlRNME9DQXdMalk1TWpRd09DQXdMalEzTVRnMk15QXdMalk1Tnpjek9VTXdMalEzTVRNek5pQXdMalk1T0RVek1TQXdMalEzTVRRNU15QXdMalk1T0RReU5DQXdMalEzTmpFek9TQXdMalk1TkRjeU9VTXdMalE0TURVM05DQXdMalk1TVRFNU15QXdMalE0T0RFM015QXdMalk0TlRRek9TQXdMalE1TXpFNE55QXdMalk0TVRnMU1Vd3dMalE1TlRJNE15QXdMalk0TURJME4wd3dMalE1TmpBeU15QXdMalkzT1RZeE5Vd3dMalE1TmpJME9DQXdMalkzT1RNeE9FTXdMalE1TXpVMU55QXdMalkzTnpFZ01DNDBPVEExTkRrZ01DNDJOelV3TkRJZ01DNDBPRGN4TnpFZ01DNDJOek14T1ROYVRUQXVOVEF5TWpFMElEQXVOamcxTnpVM1REQXVOVEF5TkRNNElEQXVOamcxT0RNelREQXVOVEF5TnpFZ01DNDJPRFl4TWpOTU1DNDFNRFF4T0RjZ01DNDJPRGd5TkRKTU1DNDFNRFF5TVRrZ01DNDJPRGd5T1VNd0xqVXdOekl5TnlBd0xqWTVNamMzTmlBd0xqVXdPVFUxSURBdU5qazROemswSURBdU5URXdNVE15SURBdU56QXpOalZNTUM0MU1UQXlNemNnTUM0M01EUTNNRGRNTUM0MU1ETXdNRFlnTUM0M01EYzFNRE5ETUM0ME9UQXdOelFnTUM0M01USTFNVGNnTUM0ME56Z3hORFlnTUM0M01UYzBPQ0F3TGpRM01EQTJPQ0F3TGpjeU1URTNNMHd3TGpRMk1USTFOQ0F3TGpjeU5UTTVPRU13TGpRMU9EWTJPQ0F3TGpjeU5qY3hOaUF3TGpRMU5qVTFOaUF3TGpjeU56Y3hPU0F3TGpRMU5qVTFOaUF3TGpjeU56WTJOVXd3TGpRMk1ERTVOeUF3TGpjeU5Ea3lNVU13TGpRM05UazRNU0F3TGpjeE16UTJOeUF3TGpRNE9UWTFNU0F3TGpjd01Ea3dOU0F3TGpRNU9UZzVNU0F3TGpZNE9ETTBORXd3TGpVd01EUTROaUF3TGpZNE56WXpNa3d3TGpVd01qRXdPQ0F3TGpZNE5UYzFOMGd3TGpVd01qSXhORnBOTUM0ME9EUXhNU0F3TGpZNU9EazFNa013TGpRNE5qVXhNU0F3TGpZNU5qVXlJREF1TkRnNU5UWXhJREF1Tmprek1UZzRJREF1TkRreE5qUXlJREF1Tmprd056azBRekF1TkRrek1USTRJREF1TmpnNU1EZzBJREF1TkRrME1USWdNQzQyT0RjNE5TQXdMalE1TkRBek1pQXdMalk0TnpjMk1rTXdMalE1TXpneU1pQXdMalk0TnpVMUlEQXVORGMxT1RJNUlEQXVOams1TmprZ01DNDBOamd4TnlBd0xqY3dOVEk0TjBNd0xqUTJOVEkyTlNBd0xqY3dOek0wTlNBd0xqUTJORGc1TlNBd0xqY3dOemN4TlNBd0xqUTJNamc1TVNBd0xqY3hNRE13TVV3d0xqUTFPRFk0TnlBd0xqY3hOVFUxVERBdU5EVXpOelU0SURBdU56SXhNVEl4VERBdU5EUTVORFk1SURBdU56STFOemswUXpBdU5EUTROakU0SURBdU56STJOek14SURBdU5EUTRNak0ySURBdU56STNNVFk0SURBdU5EUTRNVEUwSURBdU56STNNelF5UXpBdU5EUTRNRE1nTUM0M01qYzBOaklnTUM0ME5EZ3dOeUF3TGpjeU56UTFOaUF3TGpRME9ERTJOQ0F3TGpjeU56UXdNa3d3TGpRME9UWTNOeUF3TGpjeU5qUTBOVXd3TGpRMU1UTXpJREF1TnpJMU16azRRekF1TkRZek9EUWdNQzQzTVRjME9DQXdMalEzTXpreU15QXdMamN3T1RNMU1TQXdMalE0TkRFeElEQXVOams0T1RVeVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI1LjAiIHk9IjE0MC4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI2IiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIEZ1bmN0aW9ucyAtPiBNaWNyb3NvZnQgU1FMIFNlcnZlciIgc3R5bGU9ImlyLnJlZj0wZDkxZTY0MC1mODUyLTRjYjEtYWY0OC05MTdlMzMwNjcxZmU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyIiBzb3VyY2U9IjQiIHRhcmdldD0iMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJNaWNyb3NvZnQgQXp1cmUgRnVuY3Rpb25zIiBzdHlsZT0iaXIucmVmPTMzODJmN2M0LWM4OWMtNGRiYS1iZmUyLTViOGNlZTM2MzUzNDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtZnVuY3Rpb25zO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek16TXdNU0F3TGpZNU5qSTBOa3d3TGpNd05qQTVPU0F3TGpjeU16SXpNME13TGpNd016Z3dNeUF3TGpjeU5UVXpOaUF3TGpNd01EWTROeUF3TGpjeU5qZ3pNaUF3TGpJNU56UXpOU0F3TGpjeU5qZ3pOME13TGpJNU5ERTRNeUF3TGpjeU5qZzBNU0F3TGpJNU1UQTJNeUF3TGpjeU5UVTFOQ0F3TGpJNE9EYzJNU0F3TGpjeU16STFPRXd3TGpBNE9EZzJNREVnTUM0MU1qTTVNalJETUM0d09EUXlOak00SURBdU5URTVNelFnTUM0d09ERTJOelkxSURBdU5URXpNVEU1SURBdU1EZ3hOalkzTXlBd0xqVXdOall5T0VNd0xqQTRNVFkxT0RFZ01DNDFNREF4TXpjZ01DNHdPRFF5TWpjNElEQXVORGt6T1RBNUlEQXVNRGc0T0RFeE1TQXdMalE0T1RNeE1rd3dMakV4TlRnMU1pQXdMalEyTWpFNU5Vd3dMak16TXpFeE5TQXdMalkzT0RnME0wTXdMak16TlRReE9DQXdMalk0TVRFek9TQXdMak16TmpjeE5DQXdMalk0TkRJMU5pQXdMak16TmpjeE9TQXdMalk0TnpVd04wTXdMak16TmpjeU15QXdMalk1TURjMU9TQXdMak16TlRRek5pQXdMalk1TXpnM09TQXdMak16TXpFMElEQXVOamsyTVRneFREQXVNek16TURFZ01DNDJPVFl5TkRaYUlpQm1hV3hzUFNJak5UQkZOa1pHSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1ERTRPVFFnTUM0eU9USXhNRFJNTUM0ek1qZzVOemtnTUM0ek1Ua3hNVEpETUM0ek16RXlPRElnTUM0ek1qRTBNRGdnTUM0ek16STFOemdnTUM0ek1qUTFNalVnTUM0ek16STFPRElnTUM0ek1qYzNOelpETUM0ek16STFPRGNnTUM0ek16RXdNamdnTUM0ek16RXpJREF1TXpNME1UUTRJREF1TXpJNU1EQTBJREF1TXpNMk5EVk1NQzR4TVRVMU5qUWdNQzQxTlRBME9USk1NQzR3T0RnME5EWXpJREF1TlRJek5EVXlRekF1TURnek9EVWdNQzQxTVRnNE5qa2dNQzR3T0RFeU5qSTNJREF1TlRFeU5qUTNJREF1TURneE1qVXpOU0F3TGpVd05qRTFOa013TGpBNE1USTBORE1nTUM0ME9UazJOalVnTUM0d09ETTRNVFFnTUM0ME9UTTBNemNnTUM0d09EZ3pPVGMwSURBdU5EZzRPRFJNTUM0eU9EUTJNakVnTUM0eU9USXdOalJETUM0eU9EWTVNak1nTUM0eU9EazNPU0F3TGpJNU1EQXpJREF1TWpnNE5URTRJREF1TWprek1qWTJJREF1TWpnNE5USTFRekF1TWprMk5UQXlJREF1TWpnNE5UTXpJREF1TWprNU5qQXpJREF1TWpnNU9ERTVJREF1TXpBeE9EazBJREF1TWpreU1UQTBWakF1TWpreU1UQTBXaUlnWm1sc2JEMGlJekUwT1RCRVJpSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPRFkzT1RJZ01DNDBOakl4TlRoTU1DNDRPVFE1TWpnZ01DNDBPRGt5TkRORE1DNDRPVGsxTVRJZ01DNDBPVE00TXprZ01DNDVNREl3T0RFZ01DNDFNREF3TmpnZ01DNDVNREl3TnpJZ01DNDFNRFkxTlRsRE1DNDVNREl3TmpNZ01DNDFNVE13TlNBd0xqZzVPVFEzTmlBd0xqVXhPVEkzTWlBd0xqZzVORGczT1NBd0xqVXlNemcxTlV3d0xqWTVORGszT0NBd0xqY3lNekU1TTBNd0xqWTVNalkzTmlBd0xqY3lOVFE0T1NBd0xqWTRPVFUxTmlBd0xqY3lOamMzTmlBd0xqWTROak13TkNBd0xqY3lOamMzTVVNd0xqWTRNekExTWlBd0xqY3lOamMyTnlBd0xqWTNPVGt6TmlBd0xqY3lOVFEzTVNBd0xqWTNOelkwSURBdU56SXpNVFk0VERBdU5qVXdOell4SURBdU5qazJNakV6UXpBdU5qUTRORFkxSURBdU5qa3pPVEV4SURBdU5qUTNNVGM0SURBdU5qa3dOemt4SURBdU5qUTNNVGd5SURBdU5qZzNOVE01UXpBdU5qUTNNVGczSURBdU5qZzBNamczSURBdU5qUTRORGd6SURBdU5qZ3hNVGN4SURBdU5qVXdOemcySURBdU5qYzRPRGMxVERBdU9EWTRNREUzSURBdU5EWXlNalUyVERBdU9EWTNPVElnTUM0ME5qSXhOVGhhSWlCbWFXeHNQU0lqTlRCRk5rWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0T1RVeE55QXdMalV5TXpNMU1rd3dMamcyT0RBNE5TQXdMalUxTURNMk1Vd3dMalkxTkRZME15QXdMak16TmpNeE5rTXdMalkxTWpNME55QXdMak16TkRBeE5DQXdMalkxTVRBMklEQXVNek13T0RrMElEQXVOalV4TURZMUlEQXVNekkzTmpReVF6QXVOalV4TURZNUlEQXVNekkwTXpreElEQXVOalV5TXpZMklEQXVNekl4TWpjMElEQXVOalUwTmpZNElEQXVNekU0T1RjNFREQXVOamd4TnpVeklEQXVNamt4T1RkRE1DNDJPRFF3TlRVZ01DNHlPRGsyTnpRZ01DNDJPRGN4TnpZZ01DNHlPRGd6T0RjZ01DNDJPVEEwTWpjZ01DNHlPRGd6T1RGRE1DNDJPVE0yTnprZ01DNHlPRGd6T1RZZ01DNDJPVFkzT1RVZ01DNHlPRGsyT1RJZ01DNDJPVGt3T1RFZ01DNHlPVEU1T1RSTU1DNDRPVFV6TVRZZ01DNDBPRGczTnpORE1DNDRPVGs0T1RrZ01DNDBPVE16TmprZ01DNDVNREkwTmprZ01DNDBPVGsxT1RnZ01DNDVNREkwTmlBd0xqVXdOakE0T1VNd0xqa3dNalExTVNBd0xqVXhNalU0SURBdU9EazVPRFkwSURBdU5URTRPREF5SURBdU9EazFNalkzSURBdU5USXpNemcxVERBdU9EazFNVGNnTUM0MU1qTXpOVEphSWlCbWFXeHNQU0lqTVRRNU1FUkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTmpjeE9UVWdNQzQxTkRnNU1qbElNQzR6TURJek9UWkRNQzR6TURBd09EUWdNQzQxTkRrd01UZ2dNQzR5T1RjNE1qZ2dNQzQxTkRneE9UZ2dNQzR5T1RZeE1USWdNQzQxTkRZMk5EVkRNQzR5T1RRek9UWWdNQzQxTkRVd09URWdNQzR5T1RNek5UVWdNQzQxTkRJNU1qa2dNQzR5T1RNeU1UTWdNQzQxTkRBMk1UaERNQzR5T1RNeU1UUWdNQzQxTXprME1qRWdNQzR5T1RNME9UY2dNQzQxTXpneU5ESWdNQzR5T1RRd016a2dNQzQxTXpjeE56Uk1NQzQwT1RFMk1qTWdNQzR4TkRZeU16RkRNQzQwT1RJME5qUWdNQzR4TkRRM01UVWdNQzQwT1RNM01EVWdNQzR4TkRNME5Ua2dNQzQwT1RVeU1USWdNQzR4TkRJMk1ERkRNQzQwT1RZM01UZ2dNQzR4TkRFM05ETWdNQzQwT1RnME16RWdNQzR4TkRFek1UVWdNQzQxTURBeE5qUWdNQzR4TkRFek5qUklNQzQyT1RVd09EUkRNQzQyT1Rjek9UY2dNQzR4TkRFeU56WWdNQzQyT1RrMk5UTWdNQzR4TkRJd09UWWdNQzQzTURFek5qa2dNQzR4TkRNMk5EbERNQzQzTURNd09EVWdNQzR4TkRVeU1ESWdNQzQzTURReE1qWWdNQzR4TkRjek5qVWdNQzQzTURReU5qZ2dNQzR4TkRrMk56VkRNQzQzTURReU5USWdNQzR4TlRFek5ERWdNQzQzTURNMk9EY2dNQzR4TlRJNU5UUWdNQzQzTURJMk5qRWdNQzR4TlRReU5qZE1NQzQwTnpBMk16a2dNQzQwTmpBeE1qVklNQzQyT1RZNU1qRkRNQzQyT1RreU16UWdNQzQwTmpBd016WWdNQzQzTURFME9TQXdMalEyTURnMU5pQXdMamN3TXpJd05pQXdMalEyTWpRd09VTXdMamN3TkRreU1pQXdMalEyTXprMk15QXdMamN3TlRrMk1pQXdMalEyTmpFeU5TQXdMamN3TmpFd05TQXdMalEyT0RRek5rTXdMamN3TmpBM0lEQXVORGN3TlRReklEQXVOekExTWpFeklEQXVORGN5TlRVeklEQXVOekF6TnpFM0lEQXVORGMwTURNNFREQXVNekkzTmprM0lEQXVPRFkxTWpFeFF6QXVNekkwTVRZeElEQXVPRFkzTXpJeklEQXVNams1TURRMElEQXVPRGc0TVRZNUlEQXVNekV4TXpVZ01DNDROVFkxTXpKTU1DNDBOamN4T1RVZ01DNDFORGc1TWpsYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gyeHBibVZoY2lJZ2VERTlJakF1TkRrM056Z2lJSGt4UFNJd0xqZzJPRE00SWlCNE1qMGlNQzQwT1RjM09DSWdlVEk5SWpBdU1UTTFOVGt4SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJalJrVkJNVEZDSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVNamcwSWlCemRHOXdMV052Ykc5eVBTSWpSa1ZCTlRGQklpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TlRRM0lpQnpkRzl3TFdOdmJHOXlQU0lqUmtWQ01ERTRJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU9DSWdjM1J2Y0MxamIyeHZjajBpSTBaR1F6TXhOQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtaRU56QkdJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVPRFEyTVRVaUlHaGxhV2RvZEQwaU1DNDVPRFEyTVRFaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0lEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIyMi4wIiB5PSI0OS4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI3My4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IldlYiBDbGllbnQgLT4gTWljcm9zb2Z0IEF6dXJlIEFjdGl2ZSBEaXJlY3RvcnkiIHN0eWxlPSJpci5yZWY9NzRmMTRkMWItYjM5MC00Mjk4LTkxYWYtNzgwZWJmYzMxYTMzO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMiIgc291cmNlPSI3IiB0YXJnZXQ9IjEyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNyIgdmFsdWU9IldlYiBDbGllbnQiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9MmRiODc3OGItNDg1Yy00YjA3LWJlNjEtZmY4NjQzNTk3ZWRkOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQwMS4wIiB5PSI4Ni4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4IiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFBvd2VyIEJJIiBzdHlsZT0iaXIucmVmPTcyNWE1NGZhLTM0ZjYtNDQxOC1hOTcxLWM5Mzg3ZjIxNzE4ZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtUE9XRVItQkk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTmpjeE5Ea2dNQzR4TURRd01EUklNQzQxTlRZeU1UWkRNQzQxTXpnd056a2dNQzR4TURRd01EUWdNQzQxTWpNek56WWdNQzR4TVRnM01EY2dNQzQxTWpNek56WWdNQzR4TXpZNE5EUldNQzQ0TmpZNE9UVkRNQzQxTWpNek56WWdNQzQ0T0RVd016SWdNQzQxTXpnd056a2dNQzQ0T1RrM016VWdNQzQxTlRZeU1UWWdNQzQ0T1RrM016VklNQzQzTmpjeE5EbERNQzQzT0RVeU9EWWdNQzQ0T1RrM016VWdNQzQzT1RrNU9Ea2dNQzQ0T0RVd016SWdNQzQzT1RrNU9Ea2dNQzQ0TmpZNE9UVldNQzR4TXpZNE5EUkRNQzQzT1RrNU9Ea2dNQzR4TVRnM01EY2dNQzQzT0RVeU9EWWdNQzR4TURRd01EUWdNQzQzTmpjeE5Ea2dNQzR4TURRd01EUmFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhaeUJtYVd4MFpYSTlJblZ5YkNnalptbHNkR1Z5TUY5a0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemN3T0RZZ01DNDROalk0TXpsV01DNDRPVGsyTnpoSU1DNDJNRFF5TkRaSU1DNHpPVE16TVRORE1DNHpOelV4TnpjZ01DNDRPVGsyTnpnZ01DNHpOakEwTnpRZ01DNDRPRFE1TnpVZ01DNHpOakEwTnpRZ01DNDROalk0TXpsV01DNHpNelV3T0RaRE1DNHpOakEwTnpRZ01DNHpNVFk1TkRrZ01DNHpOelV4TnpjZ01DNHpNREl5TkRZZ01DNHpPVE16TVRNZ01DNHpNREl5TkRaSU1DNDJNRFF5TkRaRE1DNDJNakl6T0RNZ01DNHpNREl5TkRZZ01DNDJNemN3T0RZZ01DNHpNVFk1TkRrZ01DNDJNemN3T0RZZ01DNHpNelV3T0RaV01DNDROalk0TXpsYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1WOXNhVzVsWVhJcElpOCtKaU40WVRzOEwyYytKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TkRjMk5qZzJJREF1T0RZMk9UYzRWakF1T0RrNU9ERTRTREF1TkRRek9EUTJTREF1TWpNeU9URXpRekF1TWpFME56YzJJREF1T0RrNU9ERTRJREF1TWpBd01EY3pJREF1T0RnMU1URTFJREF1TWpBd01EY3pJREF1T0RZMk9UYzRWakF1TlRNME56a3pRekF1TWpBd01EY3pJREF1TlRFMk5qVTJJREF1TWpFME56YzJJREF1TlRBeE9UVXpJREF1TWpNeU9URXpJREF1TlRBeE9UVXpTREF1TkRRek9EUTJRekF1TkRZeE9UZ3pJREF1TlRBeE9UVXpJREF1TkRjMk5qZzJJREF1TlRFMk5qVTJJREF1TkRjMk5qZzJJREF1TlRNME56a3pWakF1T0RZMk9UYzRXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREpmYkdsdVpXRnlLU0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4Wm1sc2RHVnlJR2xrUFNKbWFXeDBaWEl3WDJRaUlIZzlJakF1TXpZd05EYzBJaUI1UFNJdE1DNDJOekEwTlRRaUlIZHBaSFJvUFNJMExqRTJOelF4SWlCb1pXbG5hSFE5SWpRdU5EZzRNak1pSUdacGJIUmxjbFZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJZ1kyOXNiM0l0YVc1MFpYSndiMnhoZEdsdmJpMW1hV3gwWlhKelBTSnpVa2RDSWo0bUkzaGhPenhtWlVac2IyOWtJR1pzYjI5a0xXOXdZV05wZEhrOUlqQWlJSEpsYzNWc2REMGlRbUZqYTJkeWIzVnVaRWx0WVdkbFJtbDRJaTgrSmlONFlUczhabVZEYjJ4dmNrMWhkSEpwZUNCcGJqMGlVMjkxY21ObFFXeHdhR0VpSUhSNWNHVTlJbTFoZEhKcGVDSWdkbUZzZFdWelBTSXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXhNamNnTUNJZ2NtVnpkV3gwUFNKb1lYSmtRV3h3YUdFaUx6NG1JM2hoT3p4bVpVOW1abk5sZENCa2VEMGlNUzQ1TkRVMElpQmtlVDBpTUM0NU56STNJaTgrSmlONFlUczhabVZIWVhWemMybGhia0pzZFhJZ2MzUmtSR1YyYVdGMGFXOXVQU0l3TGprM01qY2lMejRtSTNoaE96eG1aVU52YlhCdmMybDBaU0JwYmpJOUltaGhjbVJCYkhCb1lTSWdiM0JsY21GMGIzSTlJbTkxZENJdlBpWWplR0U3UEdabFEyOXNiM0pOWVhSeWFYZ2dkSGx3WlQwaWJXRjBjbWw0SWlCMllXeDFaWE05SWpBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBZ01DQXdJREFnTUNBd0lEQWdNQ0F3SURBdU1EVXpJREFpTHo0bUkzaGhPenhtWlVKc1pXNWtJRzF2WkdVOUltNXZjbTFoYkNJZ2FXNHlQU0pDWVdOclozSnZkVzVrU1cxaFoyVkdhWGdpSUhKbGMzVnNkRDBpWldabVpXTjBNVjlrY205d1UyaGhaRzkzSWk4K0ppTjRZVHM4Wm1WQ2JHVnVaQ0J0YjJSbFBTSnViM0p0WVd3aUlHbHVQU0pUYjNWeVkyVkhjbUZ3YUdsaklpQnBiakk5SW1WbVptVmpkREZmWkhKdmNGTm9ZV1J2ZHlJZ2NtVnpkV3gwUFNKemFHRndaU0l2UGlZamVHRTdQQzltYVd4MFpYSStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWElpSUhneFBTSXdMalkyTVRZNE15SWdlVEU5SWpBdU1UQTBNREEwSWlCNE1qMGlNQzQyTmpFMk9ETWlJSGt5UFNJd0xqZzVPVGN6TlNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwVkNRa0l4TkNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalFqSTFOREF3SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERGZmJHbHVaV0Z5SWlCNE1UMGlNQzQwT1RnM09DSWdlVEU5SWpBdU16QXlNalEySWlCNE1qMGlNQzQwT1RnM09DSWdlVEk5SWpBdU9EazVOamM0SWlCbmNtRmthV1Z1ZEZWdWFYUnpQU0oxYzJWeVUzQmhZMlZQYmxWelpTSStKaU40WVRzOGMzUnZjQ0J6ZEc5d0xXTnZiRzl5UFNJalJqbEZOVGd6SWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlORVJUazRNREFpTHo0bUkzaGhPend2YkdsdVpXRnlSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTWw5c2FXNWxZWElpSUhneFBTSXdMak16T0RNM09TSWdlVEU5SWpBdU5UQXhPVFV6SWlCNE1qMGlNQzR6TXpnek56a2lJSGt5UFNJd0xqZzVPVGd4T0NJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwWTVSVFk0UWlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJqTkRSRE15SWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI3NC4wIiB5PSIyMDguMCIgd2lkdGg9IjkwLjAiIGhlaWdodD0iODIuMCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTIiIHZhbHVlPSJNaWNyb3NvZnQgQXp1cmUgQWN0aXZlIERpcmVjdG9yeSIgc3R5bGU9ImlyLnJlZj0wYjdkYjIxZC00NTlhLTRjZDUtODg2Ny00NWVkN2I1Y2RjNDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LWF6dXJlLWFjdGl2ZS1kaXJlY3Rvcnk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzR3TnpBMU5qYzNJREF1TlRjeU5qSTNUREF1TlRBek56azRJREF1T0RVek56ZzRUREF1T1RRME5qZzNJREF1TlRjeE5UTXpUREF1T1RrNU9UTTFJREF1TmpNMk1EaE1NQzQxTURNM09UZ2dNQzQ1TlRVMU16Rk1NQzR3TVRVek1UazRJREF1TmpNMk1EaE1NQzR3TnpBMU5qYzNJREF1TlRjeU5qSTNXaUlnWm1sc2JEMGlJelV3UlRaR1JpSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVEF6TXpNeklEQXVOVE0yTlRaTU1DNDFNRE0zTkRJZ01DNHdOVGsxTnpBelREQXVPVEV5TXpVM0lEQXVOVE0zTVRBM1REQXVOVEF6TnpReUlEQXVOemsxTWprMFREQXVNVEF6TXpNeklEQXVOVE0yTlRaYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRBek56UXlJREF1TURVNU5UY3dNMVl3TGpjNU5USTVORXd3TGpFd016TXpNeUF3TGpVek5qVTJUREF1TlRBek56UXlJREF1TURVNU5UY3dNMW9pSUdacGJHdzlJaU0xTUVVMlJrWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TXpjNE5DQXdMakExT1RVM01ETldNQzQzT1RVeU9UUk1NQzQ1TVRJMElEQXVOVE0zTVRBM1REQXVOVEF6TnpnMElEQXVNRFU1TlRjd00xb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TXpjNE5DQXdMalF6T1RZNU4wd3dMamt4TWpRZ01DNDFNemN3TmpSTU1DNDFNRE0zT0RRZ01DNDNPVFV5TlRGV01DNDBNemsyT1RkYUlpQm1hV3hzUFNJak5UTkNNVVV3SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU1ETTNORElnTUM0M09UVXlOVEZNTUM0eE1ETXpNek1nTUM0MU16WTFNVGRNTUM0MU1ETTNORElnTUM0ME16azJPVGRXTUM0M09UVXlOVEZhSWlCbWFXeHNQU0lqT1VORlFrWkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURNM09EUWdNQzQ1TlRVMU16Rk1NQzQ1T1RrNU1qRWdNQzQyTXpZd09Fd3dMamswTkRZM015QXdMalUzTVRVek0wd3dMalV3TXpjNE5DQXdMamcxTXpjNE9GWXdMamsxTlRVek1Wb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXhYMnhwYm1WaGNpa2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZiR2x1WldGeUlpQjRNVDBpTUM0M05EQXdPVElpSUhreFBTSXdMamN5TnpRMk5TSWdlREk5SWpBdU5EZzJPREk1SWlCNU1qMGlNQzR5TkRjM05DSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekU1T0RoRU9TSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpraUlITjBiM0F0WTI5c2IzSTlJaU0xTkVGRlJqQWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNVjlzYVc1bFlYSWlJSGd4UFNJd0xqWXpNVEl6TnlJZ2VURTlJakF1TlRnM09UUXpJaUI0TWowaU1DNDRNRFl5TnpraUlIa3lQU0l3TGpnNE9UZzVNU0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMakVpSUhOMGIzQXRZMjlzYjNJOUlpTTFORUZGUmpBaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzR5T1NJZ2MzUnZjQzFqYjJ4dmNqMGlJelJHUVVKRlJTSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpVeElpQnpkRzl3TFdOdmJHOXlQU0lqTkRGQk1rVTVJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU56UWlJSE4wYjNBdFkyOXNiM0k5SWlNeVFUa3pSVEFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNDRPQ0lnYzNSdmNDMWpiMnh2Y2owaUl6RTVPRGhFT1NJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRXhJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TVRVek1UazRJREF1TURFMU16Z3dPU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI0MzAuMCIgeT0iMjI0LjAiIHdpZHRoPSI5MC4wIiBoZWlnaHQ9IjkwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTE1MC4wIiB5PSI1OTAuMCIgYXM9InRhcmdldFBvaW50Ii8+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xODEuMCIgeT0iNTczLjAiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNTQzLjAiIHk9IjIyNC4wIiB3aWR0aD0iNTM5LjAiIGhlaWdodD0iMTgwLjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwIiB2YWx1ZT0iTVFUVCBDbGllbnQiIHN0eWxlPSJpci5yZWY9N2Y5ZTA2NzYtZjllYy00MDNiLWIwYzYtN2RkZTZjYWE2MWEwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1xdHQtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0kyTkNJZ2FHVnBaMmgwUFNJMk5DSWdkbWxsZDBKdmVEMGlNQ0F3SURZMElEWTBJaUJtYVd4c1BTSnViMjVsSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk5ERXVNekEyTlNBeU1DNDNPVEF5VERNNExqSXdOallnTWpVdU5EZ3hNVU16T1M0NU1UazJJREkzTGpFeE16RWdOREF1T1Rrd05pQXlPUzQwTVRReElEUXdMams1T1RZZ016RXVPVFkzTVV3ME5DNDFNRGsySURNeUxqVTNNekZETkRVdU1EazVJRE14TGpJek55QTBOaTR4TlRVMElETXdMakUyTVRZZ05EY3VORGd3T0NBeU9TNDFORGczUXpRNExqZ3dOak1nTWpndU9UTTFOeUExTUM0ek1EazRJREk0TGpneU56SWdOVEV1TnpBNU5TQXlPUzR5TkRNMFF6VXpMakV3T1RNZ01qa3VOalU1TnlBMU5DNHpNRGt5SURNd0xqVTNNakVnTlRVdU1EZzBNeUF6TVM0NE1EazRRelUxTGpnMU9UUWdNek11TURRM05DQTFOaTR4TlRZMklETTBMalV5TlRNZ05UVXVPVEl3TVNBek5TNDVOall6UXpVMUxqWTRNelVnTXpjdU5EQTNOQ0ExTkM0NU1qazJJRE00TGpjeE1qY2dOVE11TnprNU5TQXpPUzQyTXpjMlF6VXlMalkyT1RRZ05EQXVOVFl5TlNBMU1TNHlOREE0SURReExqQTBNellnTkRrdU56Z3hOQ0EwTUM0NU9UQTJRelE0TGpNeU1qRWdOREF1T1RNM05TQTBOaTQ1TXpJeElEUXdMak0xTkRFZ05EVXVPRGN5TWlBek9TNHpORGsyUXpRMExqZ3hNaklnTXpndU16UTFNU0EwTkM0eE5UUTVJRE0yTGprNE9EVWdORFF1TURJek5pQXpOUzQxTXpReFREUXdMalV4TXpZZ016UXVPVEk0TVVNek9TNDNOekEzSURNM0xqQTNPVFVnTXpndU1qUXlPQ0F6T0M0NE56RWdNell1TWpNMU5pQXpPUzQ1TkRReFRETTNMalUyTnpZZ05EUXVNREUxTVVNek9TNHdNalF5SURRekxqa3hNRElnTkRBdU5EWTVJRFEwTGpNME1ESWdOREV1TmpNeE1pQTBOUzR5TWpRMFF6UXlMamM1TXpRZ05EWXVNVEE0TmlBME15NDFPVE16SURRM0xqTTROak1nTkRNdU9EZ3dPU0EwT0M0NE1UaERORFF1TVRZNE5TQTFNQzR5TkRrM0lEUXpMamt5TkNBMU1TNDNNemN5SURRekxqRTVNelFnTlRNdU1EQXhOa00wTWk0ME5qSTNJRFUwTGpJMk5pQTBNUzR5T1RZZ05UVXVNakl3TlNBek9TNDVNVEU1SURVMUxqWTROak5ETXpndU5USTNPU0ExTmk0eE5USWdNemN1TURJeE5DQTFOaTR3T1RjZ016VXVOamMxSURVMUxqVXpNVFZETXpRdU16STROaUExTkM0NU5qWWdNek11TWpNME55QTFNeTQ1TWpnNUlETXlMalU1T0RJZ05USXVOakUwTmtNek1TNDVOakUzSURVeExqTXdNRE1nTXpFdU9ESTJOU0EwT1M0M09UZzVJRE15TGpJeE56Y2dORGd1TXpreVF6TXlMall3T1NBME5pNDVPRFV4SURNekxqVWdORFV1TnpZNU1TQXpOQzQzTWpNMklEUTBMamszTWpGTU16TXVNemc0TmlBME1DNDRPVEl4UXpNeExqYzJOVElnTkRFdU1UUTJOaUF6TUM0eE1ETWdOREF1T1RVeE1TQXlPQzQxT0RJNUlEUXdMak15TjBNeU55NHdOakk0SURNNUxqY3dNamtnTWpVdU56UXlPQ0F6T0M0Mk56TTVJREkwTGpjMk5qWWdNemN1TXpVeU1Vd3hPUzQ0TmpFMklETTVMamN4TmpGRE1qQXVNVGMxTVNBME1TNHhOREkwSURFNUxqazFOellnTkRJdU5qTTBNU0F4T1M0eU5EazVJRFF6TGpreE1UVkRNVGd1TlRReU15QTBOUzR4T0RrZ01UY3VNemt6SURRMkxqRTJORFVnTVRZdU1ERTNOU0EwTmk0Mk5UVXlRekUwTGpZME1qRWdORGN1TVRRMU9TQXhNeTR4TXpRNUlEUTNMakV4T0RFZ01URXVOemM0TkNBME5pNDFOemRETVRBdU5ESXlJRFEyTGpBek5Ua2dPUzR6TURrME9DQTBOUzR3TVRnM0lEZ3VOalE1TXprZ05ETXVOekUyTVVNM0xqazRPVEk1SURReUxqUXhNelFnTnk0NE1qWTVOU0EwTUM0NU1UUTNJRGd1TVRreU9DQXpPUzQxTURBNVF6Z3VOVFU0TmpVZ016Z3VNRGczTVNBNUxqUXlOelUySURNMkxqZzFOVE1nTVRBdU5qTTJOeUF6Tmk0d016WXpRekV4TGpnME5UZ2dNelV1TWpFM015QXhNeTR6TVRJeElETTBMamcyTnpRZ01UUXVOell3TnlBek5TNHdOVEl5UXpFMkxqSXdPVE1nTXpVdU1qTTNJREUzTGpVME1EZ2dNelV1T1RRek9DQXhPQzQxTURVMklETTNMakEwTURGTU1qTXVOREEwTmlBek5DNDJOemt4UXpJeUxqa3pPVFVnTXpNdU1UZzJPU0F5TWk0NE56RXhJRE14TGpVNU9UUWdNak11TWpBMk1pQXpNQzR3TnpJNFF6SXpMalUwTVRNZ01qZ3VOVFEyTWlBeU5DNHlOamd6SURJM0xqRXpNeklnTWpVdU16RTFOaUF5TlM0NU56TXhUREl5TGpVeE1EWWdNakl1TkRVeE1VTXlNUzR4T0RReElESXpMakEyTVRnZ01Ua3VOamd3TXlBeU15NHhOamMzSURFNExqSTRNVE1nTWpJdU56UTRPVU14Tmk0NE9ESXpJREl5TGpNek1ESWdNVFV1Tmpnek9TQXlNUzQwTVRVMklERTBMamt4TVNBeU1DNHhOelkyUXpFMExqRXpPQ0F4T0M0NU16YzJJREV6TGpnME16VWdNVGN1TkRVNU1pQXhOQzR3T0RJMklERTJMakF4T0RWRE1UUXVNekl4TnlBeE5DNDFOemM1SURFMUxqQTNPQ0F4TXk0eU56TTVJREUyTGpJd09UY2dNVEl1TXpVeFF6RTNMak0wTVRVZ01URXVOREk0SURFNExqYzNNU0F4TUM0NU5EazJJREl3TGpJek1ETWdNVEV1TURBMU1rTXlNUzQyT0RrMUlERXhMakEyTURrZ01qTXVNRGM0TlNBeE1TNDJORFk0SURJMExqRXpOallnTVRJdU5qVXpNME15TlM0eE9UUTRJREV6TGpZMU9UY2dNalV1T0RRNU5pQXhOUzR3TVRjMUlESTFMamszT0RNZ01UWXVORGN5TWtNeU5pNHhNRGNnTVRjdU9USTJPU0F5TlM0M01EQTNJREU1TGpNM09EVWdNalF1T0RNMU5pQXlNQzQxTlRVeFRESTNMalkyTnpZZ01qUXVNVEV3TVVNeU9DNDVOVEUySURJekxqUXdNakVnTXpBdU5ESTNOaUF5TXk0d01EQXhJRE14TGprNU9UWWdNak11TURBd01VTXpNeTR6TWpVMklESXpMakF3TURFZ016UXVOVGcxTmlBeU15NHlPRGd4SURNMUxqY3hPVFlnTWpNdU9EQTBNVXd6T0M0Mk1UazJJREU1TGpReE5UWkRNemt1TkRJeU15QXlNQzR3TVRVeElEUXdMak15T0RVZ01qQXVORGd6T0NBME1TNHpNRFkxSURJd0xqYzVNREphVFRJeUxqRXlNRGtnTVRrdU1USXhORU15TVM0MU5UZ3pJREU1TGpZNE5DQXlNQzQzT1RVeklESXdMakF3TURFZ01Ua3VPVGs1TmlBeU1DNHdNREF4UXpFNUxqSXdOQ0F5TUM0d01EQXhJREU0TGpRME1Ea2dNVGt1TmpnMElERTNMamczT0RNZ01Ua3VNVEl4TkVNeE55NHpNVFUzSURFNExqVTFPRGdnTVRZdU9UazVOaUF4Tnk0M09UVTNJREUyTGprNU9UWWdNVGN1TURBd01VTXhOaTQ1T1RrMklERTJMakl3TkRRZ01UY3VNekUxTnlBeE5TNDBOREUwSURFM0xqZzNPRE1nTVRRdU9EYzRPRU14T0M0ME5EQTVJREUwTGpNeE5qSWdNVGt1TWpBMElERTBMakF3TURFZ01Ua3VPVGs1TmlBeE5DNHdNREF4UXpJd0xqYzVOVE1nTVRRdU1EQXdNU0F5TVM0MU5UZ3pJREUwTGpNeE5qSWdNakl1TVRJd09TQXhOQzQ0TnpnNFF6SXlMalk0TXpVZ01UVXVORFF4TkNBeU1pNDVPVGsySURFMkxqSXdORFFnTWpJdU9UazVOaUF4Tnk0d01EQXhRekl5TGprNU9UWWdNVGN1TnprMU55QXlNaTQyT0RNMUlERTRMalUxT0RnZ01qSXVNVEl3T1NBeE9TNHhNakUwV2swek5pNHlOREl5SURNMkxqSTBNamRETXpVdU1URTNJRE0zTGpNMk56a2dNek11TlRrd09TQXpPQzR3TURBeElETXhMams1T1RZZ016Z3VNREF3TVVNek1DNDBNRGd6SURNNExqQXdNREVnTWpndU9EZ3lNaUF6Tnk0ek5qYzVJREkzTGpjMU55QXpOaTR5TkRJM1F6STJMall6TVRjZ016VXVNVEUzTlNBeU5TNDVPVGsySURNekxqVTVNVFFnTWpVdU9UazVOaUF6TWk0d01EQXhRekkxTGprNU9UWWdNekF1TkRBNE9DQXlOaTQyTXpFM0lESTRMamc0TWpjZ01qY3VOelUzSURJM0xqYzFOelJETWpndU9EZ3lNaUF5Tmk0Mk16SXlJRE13TGpRd09ETWdNall1TURBd01TQXpNUzQ1T1RrMklESTJMakF3TURGRE16TXVOVGt3T1NBeU5pNHdNREF4SURNMUxqRXhOeUF5Tmk0Mk16SXlJRE0yTGpJME1qSWdNamN1TnpVM05FTXpOeTR6TmpjMUlESTRMamc0TWpjZ016Y3VPVGs1TmlBek1DNDBNRGc0SURNM0xqazVPVFlnTXpJdU1EQXdNVU16Tnk0NU9UazJJRE16TGpVNU1UUWdNemN1TXpZM05TQXpOUzR4TVRjMUlETTJMakkwTWpJZ016WXVNalF5TjFwTk1UWXVNVEl3T1NBek9DNDROemc0UXpFMkxqWTRNelVnTXprdU5EUXhOQ0F4Tmk0NU9UazJJRFF3TGpJd05EUWdNVFl1T1RrNU5pQTBNUzR3TURBeFF6RTJMams1T1RZZ05ERXVOemsxTnlBeE5pNDJPRE0xSURReUxqVTFPRGdnTVRZdU1USXdPU0EwTXk0eE1qRTBRekUxTGpVMU9ETWdORE11TmpnMElERTBMamM1TlRNZ05EUXVNREF3TVNBeE15NDVPVGsySURRMExqQXdNREZETVRNdU1qQTBJRFEwTGpBd01ERWdNVEl1TkRRd09TQTBNeTQyT0RRZ01URXVPRGM0TXlBME15NHhNakUwUXpFeExqTXhOVGNnTkRJdU5UVTRPQ0F4TUM0NU9UazJJRFF4TGpjNU5UY2dNVEF1T1RrNU5pQTBNUzR3TURBeFF6RXdMams1T1RZZ05EQXVNakEwTkNBeE1TNHpNVFUzSURNNUxqUTBNVFFnTVRFdU9EYzRNeUF6T0M0NE56ZzRRekV5TGpRME1Ea2dNemd1TXpFMk1TQXhNeTR5TURRZ016Z3VNREF3TVNBeE15NDVPVGsySURNNExqQXdNREZETVRRdU56azFNeUF6T0M0d01EQXhJREUxTGpVMU9ETWdNemd1TXpFMk1TQXhOaTR4TWpBNUlETTRMamczT0RoYVRUUXdMakV5TURrZ05EY3VPRGM0T0VNME1DNDJPRE0xSURRNExqUTBNVFFnTkRBdU9UazVOaUEwT1M0eU1EUTBJRFF3TGprNU9UWWdOVEF1TURBd01VTTBNQzQ1T1RrMklEVXdMamM1TlRjZ05EQXVOamd6TlNBMU1TNDFOVGc0SURRd0xqRXlNRGtnTlRJdU1USXhORU16T1M0MU5UZ3pJRFV5TGpZNE5DQXpPQzQzT1RVeklEVXpMakF3TURFZ016Y3VPVGs1TmlBMU15NHdNREF4UXpNM0xqSXdOQ0ExTXk0d01EQXhJRE0yTGpRME1Ea2dOVEl1TmpnMElETTFMamczT0RNZ05USXVNVEl4TkVNek5TNHpNVFUzSURVeExqVTFPRGdnTXpRdU9UazVOaUExTUM0M09UVTNJRE0wTGprNU9UWWdOVEF1TURBd01VTXpOQzQ1T1RrMklEUTVMakl3TkRRZ016VXVNekUxTnlBME9DNDBOREUwSURNMUxqZzNPRE1nTkRjdU9EYzRPRU16Tmk0ME5EQTVJRFEzTGpNeE5qRWdNemN1TWpBMElEUTNMakF3TURFZ016Y3VPVGs1TmlBME55NHdNREF4UXpNNExqYzVOVE1nTkRjdU1EQXdNU0F6T1M0MU5UZ3pJRFEzTGpNeE5qRWdOREF1TVRJd09TQTBOeTQ0TnpnNFdrMDFNaTR4TWpBNUlETTNMakV5TVRSRE5URXVOVFU0TXlBek55NDJPRFFnTlRBdU56azFNeUF6T0M0d01EQXhJRFE1TGprNU9UWWdNemd1TURBd01VTTBPUzR5TURRZ016Z3VNREF3TVNBME9DNDBOREE1SURNM0xqWTROQ0EwTnk0NE56Z3pJRE0zTGpFeU1UUkRORGN1TXpFMU55QXpOaTQxTlRnNElEUTJMams1T1RZZ016VXVOemsxTnlBME5pNDVPVGsySURNMUxqQXdNREZETkRZdU9UazVOaUF6TkM0eU1EUTBJRFEzTGpNeE5UY2dNek11TkRReE5DQTBOeTQ0TnpneklETXlMamczT0RoRE5EZ3VORFF3T1NBek1pNHpNVFl4SURRNUxqSXdOQ0F6TWk0d01EQXhJRFE1TGprNU9UWWdNekl1TURBd01VTTFNQzQzT1RVeklETXlMakF3TURFZ05URXVOVFU0TXlBek1pNHpNVFl4SURVeUxqRXlNRGtnTXpJdU9EYzRPRU0xTWk0Mk9ETTFJRE16TGpRME1UUWdOVEl1T1RrNU5pQXpOQzR5TURRMElEVXlMams1T1RZZ016VXVNREF3TVVNMU1pNDVPVGsySURNMUxqYzVOVGNnTlRJdU5qZ3pOU0F6Tmk0MU5UZzRJRFV5TGpFeU1Ea2dNemN1TVRJeE5Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5ORFFnTWpFdU1UazVPVU0wT0M0NU56QTJJREl4TGpFNU9Ua2dOVE1nTVRjdU1UY3dOU0ExTXlBeE1pNHlRelV6SURjdU1qSTVNemtnTkRndU9UY3dOaUF6TGpFNU9UazFJRFEwSURNdU1UazVPVFZETXprdU1ESTVOQ0F6TGpFNU9UazFJRE0xSURjdU1qSTVNemtnTXpVZ01USXVNa016TlNBeE55NHhOekExSURNNUxqQXlPVFFnTWpFdU1UazVPU0EwTkNBeU1TNHhPVGs1V2swek9TNDRJRGt1TmpjNU9UWkRNemt1T0NBNExqYzFNakV5SURRd0xqVTFNaklnTnk0NU9UazVOaUEwTVM0ME9DQTNMams1T1RrMlNEUTJMalV5UXpRM0xqUTBOemdnTnk0NU9UazVOaUEwT0M0eUlEZ3VOelV5TVRJZ05EZ3VNaUE1TGpZM09UazJWakV6TGpBMFF6UTRMaklnTVRNdU9UWTNPQ0EwTnk0ME5EYzRJREUwTGpjeUlEUTJMalV5SURFMExqY3lTRFEwTGpVME56Sk1OREl1TVRNeklERTJMak15T1RSRE5ESXVNREEwTVNBeE5pNDBNVFV6SURReExqZ3pPRFFnTVRZdU5ESXpOQ0EwTVM0M01ERTRJREUyTGpNMU1ETkROREV1TlRZMU15QXhOaTR5TnpjeUlEUXhMalE0SURFMkxqRXpORGtnTkRFdU5EZ2dNVFV1T1RoV01UUXVOekpETkRBdU5UVXlNaUF4TkM0M01pQXpPUzQ0SURFekxqazJOemdnTXprdU9DQXhNeTR3TkZZNUxqWTNPVGsyV2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzMi4wIiB5PSIzNy4wIiB3aWR0aD0iOTAuMCIgaGVpZ2h0PSI5MC4wIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTI1OC4wIiB5PSIzNTYuMCIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iLTI2My4wIiB5PSI1MDcuMCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="Microsoft Azure Functions -&gt; Microsoft SQL Server" ref="0d91e640-f852-4cb1-af48-917e330671fe" source="7ea65cc3-7318-4575-96b2-20d7ef22b32d" target="1de050a1-bf02-45ee-b386-bb404f067e9f">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Client -&gt; Microsoft Azure Active Directory" ref="74f14d1b-b390-4298-91af-780ebfc31a33" source="4146a845-163b-4da1-8a49-7e4081ae6ce9" target="f6372a8d-42ab-4572-80a1-edd76f49b5d1">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="6c5a8227-71d8-4261-bbf7-9b8397cd9520" diagramComponentId="7f9e0676-f9ec-403b-b0c6-7dde6caa61a0" ref="a5e77e93-52aa-43c6-b3e5-6f2ecfcbfe77" name="MQTT Client" desc="" library="" parentComponentRef="" componentDefinitionRef="mqtt-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="auth-cred-client-unprotected" name="Authentication credentials unprotected on the client side" state="0" impact="100" issueId="" issueLink="">
+          <desc>Client side has insufficiently protected credentials, which allows remote attackers to obtain sensitive information via unspecified vectors.&amp;nbsp;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.629">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="mqtt-client-dos" name="MQTT client does not present  protective measures against denial-of-service (DoS) attacks" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                    MQTT client does not have measures to protect from excessively high message frequency on subscribed topics. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.629">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="mqtt-client-authz" name="MQTT client don't authorize commands coming from IoT applications" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:46.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="enforce-app-id-validation-mqtt-client" name="Enforce Application ID validation in the MQTT client" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    Application ID validation is an extra level of security between the IoT application and the device to ensure that no fake application can send commands to the device. This mechanism can be used both as startup security and as a communication security mechanism. By using this scheme, the device stores the unique ID of the IoT application and validates it when it processes the commands that are coming from the IoT application. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    If the IoT application sends an invalid unique ID with a command, the command is ignored by the device. If the device has storage capability, the IoT application unique ID can be encrypted and stored. In that case, the unique ID request is not necessary after every restart. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Enforce Application ID validation in the MQTT client 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Securing IoT devices and gateways" url="https://developer.ibm.com/technologies/iot/articles/iot-trs-secure-iot-solutions1/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="input-val-mqtt-clients" name="Implement Input Validation on MQTT clients" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    It's a good pattern to always validate inputs, no matter how trusted the environment is. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Your MQTT clients should at least validate the following: 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;ul&gt; 
+                    &lt;li&gt;&lt;b&gt;MQTT topics&lt;/b&gt;: Did the client receive messages on topics the client did not subscribe to? In such a case your application should ignore the message. If you are using wildcard subscriptions, only process messages on topics you know the client can interpret.&lt;/li&gt; 
+                    &lt;li&gt;&lt;b&gt;MQTT message payload&lt;/b&gt;: The payload of MQTT messages is always binary. The structure of the data in the payload is typically defined on the application level. Always make sure you can parse the actual message. So if you are expecting a JSON payload but the actual payload is in XML, your parser will probably have a hard time interpreting the messages. So always validate if your application can handle the input, otherwise malicious MQTT clients could craft MQTT packets that your subscribers can't handle.&lt;/li&gt; 
+                    &lt;/ul&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Your MQTT Applications: Are they resilient enough?" url="https://www.hivemq.com/blog/are-your-mqtt-applications-resilient-enough/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.812">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="mqtt-client-throttling" name="Implement MQTT throttling on the client-side" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Most MQTT client applications are not designed for handling huge amounts of MQTT messages per second. It's important to know your client's load limitations and then throttle the message ingestion rate to a limit that doesn't overwhelm your client. Such an implementation typically stops to read from the socket as soon as a specific bytes per second or messages per second rate threshold is exceeded. So even if the broker tries to send lots of messages, TCP backpressure mechanisms take effect and your client won't be overwhelmed. If this is not possible with your client library, you should think about implementing load shedding, which means you throw away messages that you can't handle. This is not optimal but certainly better than constantly crashing your client. 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Throttle the message ingestion rate to a limit that doesn't overwhelm your client. 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Throttling MQTT Data" url="https://mqtt.cool/throttling-mqtt-data/"/>
+            <reference name="Your MQTT Applications: Are they resilient enough?" url="https://www.hivemq.com/blog/are-your-mqtt-applications-resilient-enough/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="limit-mqtt-messages-sizes" name="Set a limit for MQTT message sizes" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    MQTT defines a maximum message size of 256MB. In most MQTT deployment scenarios, messages are often smaller than a kilobyte. If you are familiar with your usage scenario and you know the maximum message size that can occur, it makes sense to decrease the maximum allowed message size to that limit. If no limit is set, it is possible for malicious MQTT clients to send large messages (which can result in excessive memory consumption and unneeded bandwidth usage). 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Limit the maximum message size on a global and per-client basis. 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+                        &lt;ul&gt; 
+                        &lt;li&gt;Use a client to send and receive data over MQTT.&lt;br&gt;&lt;/li&gt; 
+                        &lt;li&gt;Increase the message size of the data in a development/testing environment to test the presence of maximum message size thresholds. &lt;br&gt;&lt;/li&gt; 
+                        &lt;li&gt;Verify that when the MQTT broker receives a message that exceeds that threshold, it drops the packet.&lt;/li&gt; 
+                        &lt;/ul&gt; 
+                        &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
+              <output/>
+            </source>
+            <references>
+              <reference name="MQTT Client and Mosquitto Broker Message Restrictions" url="https://www.ibm.com/docs/en/mapms/1_cloud?topic=messaging-restrictions-limitations"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="irrevocable-secure-boot" name="The product's processor system has an irrevocable Secure Boot process" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    The product's processor system has an irrevocable Secure Boot process, to provide assurance that it's running code that hasn't been compromised. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Rationale:&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Secure boot is a UEFI (Unified Extensible Firmware Interface) process where the Operating System boot images and code are authenticated against the hardware before they are allowed to be used in the boot process. This way, it ensures that the boot and Operating System software is the intended manufacturer version and hasn't been tampered by malware or other malicious third parties. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;div&gt;
+                    In essence, the manufacturer stores their private key very securely and never reveals it to anyone. When a device is manufactured, the public key associated with the private key is placed in secure storage on the device. The bootloader code is developed using a secure development process and then a cryptographic hash of it is digitally signed with the manufacturer's private key. Whenever bootloader firmware is to be installed on the device, the hash signature is checked against the embedded public key on the device to confirm that it is a genuine hash value from that manufacturer. The firmware code is then hashed again and compared with the signed hash. If this matches (which indicates the firmware code hasn't been altered), only then will the new firmware get installed. 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Thereafter, whenever the device boots, the installed bootloader is again verified before being allowed to run. Cryptographic functions for these purposes and storage of keys can be provided by dedicated chips or modules such a Secure Access Modules (SAM) or Trusted Platform Modules (TPM). 
+                    &lt;/div&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation:&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    The product's processor system has to be set up beforehand in such a way that it only authenticates code generated using trusted security credentials. 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Device Secure Boot" url="https://www.iotsecurityfoundation.org/best-practice-guide-articles/device-secure-boot/"/>
+            <reference name="Secure boot" url="https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot"/>
+            <reference name="The whys and hows of secure boot" url="https://www.embedded.com/the-whys-and-hows-of-secure-boot/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="data-integrity-checks" name="Use data integrity checks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    Use data integrity checks with stamps as a good addition to message encryption. Even if the attacker can decrypt the message (and encrypt it after modification), the integrity check still fails if the message was altered. Especially if you use MQTT without TLS, data integrity checks add an additional layer of security. 
+                    &lt;br&gt; 
+                    &lt;br&gt;MQTT PUBLISH packets can contain a digital signature/MAC/checksum that verifies the contents of the packet. This calculated stamp is typically added to the payload (for example, at the beginning of the payload). The receiver of the packet can verify the integrity of the data by recalculating/validating the stamp. This validation assures that the message was not tampered with by a malicious third party. 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Use data integrity checks with stamps. 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="MQTT Message Data Integrity - MQTT Security Fundamentals" url="https://www.hivemq.com/blog/mqtt-security-fundamentals-mqtt-message-data-integrity/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+                        &lt;li&gt;Review the project documentation and use exploratory testing looking for parts of the application/system (components i.e. For example, input fields, databases or logs) that move, store or handle data/information.&lt;/li&gt; 
+                        &lt;li&gt;For each identified component determine what type of data/information is logically acceptable and what types the application/system should guard against. Also, consider who according to the business logic is allowed to insert, update and delete data/information and in each component.&lt;/li&gt; 
+                        &lt;li&gt;Attempt to insert, update or edit delete the data/information values with invalid data/information into each component (i.e. input, database, or log) by users that should not be allowed per the business logic workflow.&lt;/li&gt; 
+                        &lt;/ul&gt; 
+                        &lt;br&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test Integrity Checks" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/03-Test_Integrity_Checks"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="iot-hardware-protect-creds" name="Use hardware security solutions to protect sensitive information on IoT devices" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>IoT devices need an efficient secure processor to store its identity and handle authentication, and to store public and private encryption keys, and to store keys and run hashing algorithms for verifying software signatures to be able to verify software signatures. 
+                    &lt;div&gt; 
+                    &lt;div&gt;
+                    Likely candidates for hardware security solutions to protect sensitive data in IoT devices include PUF (Physically Unclonable Functions), TPM (Trusted Platform Module), HSM (Hardware Security Module) and TrustZone.&amp;nbsp; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;ul&gt; 
+                    &lt;li&gt; PUF uses random patterns in the silicon to differentiate chips from each other and creates a unique random number. This generated random number is used to seed a strong device ID and cryptographic keys to create a hardware root of trust.&lt;/li&gt; 
+                    &lt;li&gt;Security co-processors are physically separate chips offering true isolation of private keys. A TPM offers isolation and facilities for the secure generation of cryptographic keys, and limitation of their use, and true random number generation. It also includes capabilities such as remote attestation and sealed storage. However, these powerful security capabilities come at price, usually moving deployment to higher end IoT devices.&amp;nbsp;&lt;/li&gt; 
+                    &lt;li&gt;A Hardware Security Module (HSM) is another physically separate chip and likely at a lower cost compared to a TPM. Like the TPM, it safeguards and manages digital keys for strong authentication and provides crypto processing. An HSM traditionally comes in the form of a large plug-in card or a separate external device attaching to the protected device, making it somewhat less suited to an IoT device. Depending upon the perceived and likely threat vectors, an HSM may provide an effective solution.&lt;/li&gt; 
+                    &lt;li&gt;Trust Zone is another single chip solution segregating execution space into secure and insecure worlds. Insecure apps are not allowed to access security-critical assets. Those same security critical assets are isolated from tampering. Like a TPM, cost moves it to higher-end devices.&lt;/li&gt; 
+                    &lt;/ul&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Use&amp;nbsp;hardware security solutions (like PUF, TPM, HSM or Trust Zone) to protect sensitive data in IoT devices. 
+                    &lt;/div&gt; 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Device security" url="https://cloud.google.com/iot/docs/concepts/device-security"/>
+            <reference name="Protecting the IoT with Secure Hardware" url="https://www.digikey.com/en/articles/techzone/2017/mar/protecting-the-iot-with-secure-hardware"/>
+            <reference name="Securing Edge Nodes" url="https://realtimelogic.com/downloads/docs/IoT-Security-Solutions.pdf"/>
+            <reference name="What is an IoT Hardware Secure Element?" url="https://cerberus-laboratories.com/blog/iot_hsms/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.814">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="mqtt-payload-encryption" name="Use MQTT payload encryption" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                    TLS provides security on the network layer while MQTT payload encryption provides security on the application layer, so they can be used in conjunction without conflict. MQTT payload encryption only solves the problem of protecting application messages from eavesdroppers or untrusted MQTT clients (if no authentication mechanism is in place). An attacker can still replay the message or modify parts of the message, such as the topic, if there is no secure communication channel over TLS. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    MQTT Payload encryption is the encryption of application-specific data on the application level (typically, the MQTT PUBLISH packet payload or the CONNECT LWT payload). This approach allows end-to-end encryption of application data even on untrusted environments. While the message metadata such as the MQTT Topic stays intact, the payload of the message gets encrypted. This type of encryption is not defined in the MQTT specification and is completely application specific. 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Only the payload data (private sensor information) of the message needs to be encrypted. The message fields of MQTT PUBLISH messages are not changed. The payload information is binary, so no special encoding mechanism is required while it transmits the message. Also, no specific changes are required on the broker side because the MQTT message format remains the same. Only the application that is interpreting the message payload needs to decrypt the message to understand the content. 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Advantages of Payload Encryption: 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;ul&gt; 
+                    &lt;li&gt;Complete end-to-end message security.&lt;/li&gt; 
+                    &lt;li&gt;Adds another layer of security for applications that are transmitting highly sensitive data.&lt;/li&gt; 
+                    &lt;li&gt;Appropriate in situations where TLS cannot be used.&lt;br&gt;&lt;/li&gt; 
+                    &lt;/ul&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Disadvantages of Payload Encryption: 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;ul&gt; 
+                    &lt;li&gt;Might not be possible to implement in devices with very low resources.&lt;/li&gt; 
+                    &lt;li&gt;Messages can still be modified by attacker if a secured communication channel is not used.&lt;br&gt; &lt;/li&gt; 
+                    &lt;/ul&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;br&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt; 
+                    &lt;b&gt;Remediation&lt;/b&gt; 
+                    &lt;/div&gt; 
+                    &lt;div&gt;
+                    Use payload encryption if you can't use TLS but still don't want to send your application data in plain text. Payload encryption provides an additional layer of security since all your application data is secured. 
+                    &lt;br&gt; 
+                    &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Securing IoT data over the network" url="https://developer.ibm.com/technologies/iot/articles/iot-trs-secure-iot-solutions2/"/>
+            <reference name="Securing MQTT Systems - MQTT Security Fundamentals" url="https://www.hivemq.com/blog/mqtt-security-fundamentals-payload-encryption/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+                        &lt;ul&gt; 
+                        &lt;li&gt;Use a standard packet sniffing tool such as Wireshark to inspect MQTT traffic.&lt;/li&gt; 
+                        &lt;/ul&gt; 
+                        &lt;/div&gt; 
+                        &lt;div&gt; 
+                        &lt;ul&gt; 
+                        &lt;li&gt;Check that MQTT PUBLISH messages are encrypted (not visible in clear text).&lt;/li&gt; 
+                        &lt;/ul&gt; 
+                        &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.815">
+              <output/>
+            </source>
+            <references>
+              <reference name="Examination of vulnerabilities in Message Queuing Telemetry Transport (MQTT) in IoT Systems and implementation of countermeasures" url="https://www.researchgate.net/publication/338335323_Examination_of_vulnerabilities_in_Message_Queuing_Telemetry_Transport_MQTT_in_IoT_Systems_and_implementation_of_countermeasures"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.7.13" name="Where the MQTT protocol is used, it is protected by a TLS connection with no known cipher vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt; 
+                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; &lt;span class="caps"&gt;MQTT&lt;/span&gt; (Message Queue Telemetry Transport), is a very lightweight and widely used messaging and information exchange protocol for IoT devices throughout the world. The &lt;span class="caps"&gt;MQTT&lt;/span&gt; communication can be encrypted using &lt;span class="caps"&gt;TLS&lt;/span&gt; / &lt;span class="caps"&gt;SSL&lt;/span&gt; protocols, ensuring a secure and safe communication.&lt;/p&gt; 
+                    &lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the &lt;span class="caps"&gt;MQTT&lt;/span&gt; protocol is used, it is protected by a &lt;span class="caps"&gt;TLS&lt;/span&gt; connection with no known cipher vulnerabilities.&lt;/p&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="MQTT Version 3.1.1 Plus Errata 01" url="https://docs.oasis-open.org/mqtt/mqtt/v3.1.1/mqtt-v3.1.1.html"/>
+            <reference name="MQTT and CoAP, IoT Protocols" url="https://www.eclipse.org/community/eclipse_newsletter/2014/february/article2.php"/>
+          </references>
+          <standards>
+            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.13" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:43.815">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION AND AUTHORIZATION" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="mqtt-client-fake-app" name="An attacker can simulate a fake application to send commands to the MQTT client" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker can simulate a fake application to send commands to the MQTT client to get sensitive data or to change their configuration.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="mqtt-client-authz">
+                  <countermeasures>
+                    <countermeasure ref="enforce-app-id-validation-mqtt-client" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="enforce-app-id-validation-mqtt-client" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="cred-extract-mqtt-client" name="Attackers can extract authentication credentials from the client and use them to log in to the MQTT broker" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;div&gt;
+                            An attacker who manages to extract the X.509 certificate/private key pair from a device can use the certificate/key for either eavesdropping on the communication or for exploiting an IoT solution. A unique certificate per device makes it possible to disable the exploited certificate/key by using a revocation list; however, this requires that the IoT solution can detect the exploitation in the first place. A solution that uses the same certificate/key in all devices has lost all integrity if someone manages to extract it from any single device. 
+                            &lt;/div&gt; 
+                            &lt;div&gt; 
+                            &lt;br&gt; 
+                            &lt;/div&gt; 
+                            &lt;div&gt;
+                            The complexity associated with extracting the certificate/key from a device greatly depends on the type of device and the components used in that device. A device based on a high-level operating system where the certificate/key is stored in a file system on an external flash memory module makes it much easier for a hacker to extract than a certificate/key for a device using internal microcontroller flash memory and where the JTAG fuse has been blown. 
+                            &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="RSA Keys Found in IoT Medical Devices, Implants Prone to Attack" url="https://healthitsecurity.com/news/rsa-keys-found-in-iot-medical-devices-implants-prone-to-attack"/>
+              </references>
+              <weaknesses>
+                <weakness ref="auth-cred-client-unprotected">
+                  <countermeasures>
+                    <countermeasure ref="iot-hardware-protect-creds" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="iot-hardware-protect-creds" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="firmware-update-mqtt" name="An attacker can change the firmware update link over MQTT in such way that the victim devices install malicious firmware" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker who has already known the data packets by sniffing the traffic can modify the data in transit. One of the interesting scenarios happens when attacker identifies someone who sends a link to download a firmware update for some devices over MQTT. The attacker can change the link in such way that the victim devices install malicious firmware that transforms them into botnets.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="irrevocable-secure-boot" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="irrevocable-secure-boot" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="mqtt-client-dos" name="An attacker can overload MQTT clients due to too high message frequency on subscribed topics" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker can send a large volume of dataset messages with the goal of overwhelming the subscriber, the middleware or dependent components such as CPU, TCP/IP stack, operating system, or the file system.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="mqtt-client-dos">
+                  <countermeasures>
+                    <countermeasure ref="data-integrity-checks" mitigation="25"/>
+                    <countermeasure ref="input-val-mqtt-clients" mitigation="25"/>
+                    <countermeasure ref="limit-mqtt-messages-sizes" mitigation="25"/>
+                    <countermeasure ref="mqtt-client-throttling" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="data-integrity-checks" mitigation="25"/>
+                <countermeasure ref="input-val-mqtt-clients" mitigation="25"/>
+                <countermeasure ref="limit-mqtt-messages-sizes" mitigation="25"/>
+                <countermeasure ref="mqtt-client-throttling" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.7.13" mitigation="50"/>
+                    <countermeasure ref="mqtt-payload-encryption" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.7.13" mitigation="50"/>
+                <countermeasure ref="mqtt-payload-encryption" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="fbd62900-0f33-4040-acb1-a8126c416d6c" diagramComponentId="2db8778b-485c-4b07-be61-ff8643597edd" ref="4146a845-163b-4da1-8a49-7e4081ae6ce9" name="Web Client" desc="" library="" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions>
+        <question ref="client.authentication.building.yes" answer="true" manuallyModified="false"/>
+        <question ref="client.ssl" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.no" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="40"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.193">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.013">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.029">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:50:39.802">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.660">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.035">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.041">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-05-06T09:23:20.012">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.055">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.061">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.067">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.216">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.082">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-30T14:52:04.610">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:42.000">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".
+ 
+</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T09:48:50.678">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:04:19.860">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintencionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:51.097">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.050">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.075">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.117">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.132">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:04:13.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-06-27T10:10:41.554">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-28T12:52:08.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.193">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.206">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt; 
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.219">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Overwrite memory with zeros or random data before release.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
+          </references>
+          <standards>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
+                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
+                            soon as they are not needed anymore.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-12-01T15:04:13.538">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.617">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.234">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.255">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.275">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-29T17:54:26.128">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.334">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-17T12:53:45.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.346">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.361">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.372">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-30T08:44:22.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2020-10-19T07:04:50.596">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.775">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T10:05:11.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>If the component handles credentials and it does not do a proper clean-up of them in
+                                memory, they could be accessed by an attacker by inspecting the memory or reading
+                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-226" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-226" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-602">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="34"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="33"/>
+                <countermeasure ref="CWE-327" mitigation="33"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="66fb8a74-3310-4d9f-94f8-2c3fb6ad12eb" diagramComponentId="3382f7c4-c89c-4dba-bfe2-5b8cee363534" ref="7ea65cc3-7318-4575-96b2-20d7ef22b32d" name="Microsoft Azure Functions" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-functions">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Personally Identifiable Information" accessType="40"/>
+        <asset name="Personally Identifiable Information" accessType="50"/>
+        <asset name="Customer Data" accessType="40"/>
+        <asset name="Customer Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.901">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.911">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of a command using
+                    externally-influenced input from an upstream component, but it does not
+                    neutralize or incorrectly neutralizes special elements that could modify the
+                    intended command when it is sent to a downstream
+                    component.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.916">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.926">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.931">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.944">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.935">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            More information: Doc MS Azure
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.950">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.954">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.330">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Configure the password expiration to force after a determinate time, the password code shall be
+                        changed for the users.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
+                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
+                        PowerShell. With the following command as the example:&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
+                        days. The users receive notification 14 days prior to that expiry.
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        More information:&amp;nbsp;
+                        &lt;a
+                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                        MS Azure&lt;/a&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;More information:
+                            &lt;a
+                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                            MS Azure&lt;/a&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.337">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Custom rules that you create 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a policy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
+&lt;/div&gt; 
+&lt;div&gt;
+  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Association tab, enter one of the following settings, then select Add: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select Review + create, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
+            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test the application gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Find the public IP address for the application gateway on its Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Copy the public IP address, and then paste it into the address bar of your browser. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.366">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Disable anonymous access 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow only authenticated requests 
+&lt;/div&gt; 
+&lt;div&gt;
+  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.375">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FUNCTIONS1" name="Disable remote debugging" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Disable remote debugging for Azure Functions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remote debugging for Azure Functions requires certain inbound ports to be opened. Denying the access to these inbound ports, will help you reduce the possibility of a security breach. Ensure that your Azure Functions have remote debugging disabled in order to enhance security and protect them from unauthorized access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Make sure that remote debugging is disabled, except when you are actively debugging your functions. You can disable remote debugging in the General Settings tab of your function app Configuration in the portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Securing Azure Functions" url="https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that your Azure Functions have remote debugging disabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.385">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.392">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.400">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.407">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.415">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable WAF logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable logging through the Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. In the Azure portal, find your resource and select Diagnostic settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Application Gateway, three logs are available: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Access log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Performance log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Firewall log 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. To start collecting data, select Turn on diagnostics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Type a name for the settings, confirm the settings, and select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that all WAF logs are enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.425">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt;
+   Use encryption to protect traffic on external and public networks as it is critical for data protection 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Rationale: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Remediation: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Use a valid TLS/SSL certificate for custom domains. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Redirect HTTP to HTTPs 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enforce FTPS 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enable client certificates 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Impact: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
+            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
+            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test HTTPS 
+&lt;/div&gt; 
+&lt;div&gt;
+  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.433">
+              <output/>
+            </source>
+            <references>
+              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FUNCTIONS3" name="Function code must validate any data received from a trigger or input binding" issueId="" issueLink="" platform="" cost="0" risk="88" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Function code must validate any data received from a trigger or input binding 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The triggers and bindings used by your functions don't provide any additional data validation. Your code must validate any data received from a trigger or input binding. If an upstream service is compromised, you don't want unvalidated inputs flowing through your functions. For example, if your function stores data from an Azure Storage queue in a relational database, you must validate the data and parameterize your commands to avoid SQL injection attacks.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't assume that the data coming into your function has already been validated or sanitized. It's also a good idea to verify that the data being written to output bindings is valid. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Implement a data validation procedure for the data coming into your functions. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Securing Azure Functions" url="https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that your code validates any data received from a trigger or input binding.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.455">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.463">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.471">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-FUNCTIONS2" name="Restrict CORS access to Azure Functions" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Restrict CORS access to Azure Functions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Functions supports cross-origin resource sharing (CORS). CORS is configured in the portal and through the Azure CLI. The CORS allowed origins list applies at the function app level. With CORS enabled, responses include the Access-Control-Allow-Origin header. 
+&lt;/div&gt; 
+&lt;div&gt;
+  To prevent malicious code execution on the client, modern browsers block requests from web applications to resources running in a separate domain. Cross-origin resource sharing (CORS) lets an Access-Control-Allow-Origin header declare which origins are allowed to call endpoints on your function app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you configure the Allowed origins list for your function app, the Access-Control-Allow-Origin header is automatically added to all responses from HTTP endpoints in your function app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When the wild-card (*) is used, all other domains are ignored. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the az functionapp cors add command to add a domain to the allowed origins list. The following example adds the contoso.com domain: 
+&lt;/div&gt; 
+&lt;div&gt;
+  az functionapp cors add --name &amp;lt;FUNCTION_APP_NAME&amp;gt; \ 
+&lt;/div&gt; 
+&lt;div&gt;
+  --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; \ 
+&lt;/div&gt; 
+&lt;div&gt;
+  --allowed-origins https://contoso.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the az functionapp cors show command to list the current allowed origins. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Manage your function app" url="https://docs.microsoft.com/en-us/azure/azure-functions/functions-how-to-use-azure-function-app-settings"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that CORS access is restricted.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Secure application secrets 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
+  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
+  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
+  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.492">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-API-MANAGEMENT" name="Use Azure API Management (APIM) to authenticate requests" issueId="" issueLink="" platform="" cost="0" risk="52" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Azure API Management (APIM) to authenticate requests 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  APIM provides a variety of API security options for incoming requests. With APIM in place, you can configure your function app to accept requests only from the IP address of your APIM instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Management authentication policies 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authenticate with Basic 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy statement 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-basic username="username" password="password" /&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Example 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-basic username="testuser" password="testpassword" /&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authenticate with client certificate 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the authentication-certificate policy to authenticate with a backend service using client certificate. The certificate needs to be installed into API Management first and is identified by its thumbprint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy statement 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-certificate thumbprint="thumbprint" certificate-id="resource name"/&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Examples 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In this example, the client certificate is identified by its thumbprint: 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-certificate thumbprint="CA06F56B258B7A0D4F2B05470939478651151984" /&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In this example, the client certificate is identified by the resource name: 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-certificate certificate-id="544fe9ddf3b8f30fb490d90f" /&amp;gt;&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - In this example, the client certificate is set in the policy rather than retrieved from the built-in certificate store: 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-certificate body="@(context.Variables.GetValueOrDefault&amp;lt;byte[]&amp;gt;("byteCertificate"))" password="optional-certificate-password" /&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authenticate with managed identity 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Both system-assigned identity and any of the multiple user-assigned identity can be used to request token. If client-id is not provided system-assigned identity is assumed. If the client-id variable is provided token is requested for that user-assigned identity from Azure Active Directory 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy statement 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-managed-identity resource="resource" client-id="clientid of user-assigned identity" output-token-variable-name="token-variable" ignore-error="true|false"/&amp;gt;&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Example 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use managed identity to authenticate with a backend service 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-managed-identity resource="https://graph.microsoft.com"/&amp;gt;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-managed-identity resource="https://management.azure.com/"/&amp;gt; &amp;lt;!--Azure Resource Manager--&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;authentication-managed-identity resource="https://vault.azure.net"/&amp;gt; &amp;lt;!--Azure Key Vault--&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="API Management authentication policies" url="https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that you use an APIM authentication option to authenticate requests.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="55" state="Required" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
+  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
+  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
+   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0 is are blocked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2021-01-27T09:23:30.507">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="50"/>
+                <countermeasure ref="AZ-A04" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="34"/>
+                    <countermeasure ref="AZURE-API-MANAGEMENT" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="34"/>
+                <countermeasure ref="AZURE-API-MANAGEMENT" mitigation="33"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZ-A12" mitigation="20"/>
+                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="25"/>
+                    <countermeasure ref="AZ-L01" mitigation="25"/>
+                    <countermeasure ref="AZ-L05" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="25"/>
+                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="25"/>
+                <countermeasure ref="AZ-L01" mitigation="25"/>
+                <countermeasure ref="AZ-L05" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-77">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-FUNCTIONS3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-FUNCTIONS3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N01" mitigation="20"/>
+                    <countermeasure ref="AZ-N02" mitigation="16"/>
+                    <countermeasure ref="AZURE-FUNCTIONS1" mitigation="16"/>
+                    <countermeasure ref="AZURE-FUNCTIONS2" mitigation="16"/>
+                    <countermeasure ref="AZURE-WAF-GW" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N01" mitigation="20"/>
+                <countermeasure ref="AZ-N02" mitigation="16"/>
+                <countermeasure ref="AZ-N09" mitigation="16"/>
+                <countermeasure ref="AZURE-FUNCTIONS1" mitigation="16"/>
+                <countermeasure ref="AZURE-FUNCTIONS2" mitigation="16"/>
+                <countermeasure ref="AZURE-WAF-GW" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="81b84ddb-d1b0-4331-865b-cd3146e6b3af" diagramComponentId="acd2ab2a-62da-4d6d-bad2-a6aa2003457e" ref="1de050a1-bf02-45ee-b386-bb404f067e9f" name="Microsoft SQL Server" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-sql-server">
+      <tags/>
+      <questions>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
+        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Personally Identifiable Information" accessType="10"/>
+        <asset name="Personally Identifiable Information" accessType="50"/>
+        <asset name="Customer Data" accessType="10"/>
+        <asset name="Customer Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
+                        data transmission. For example, network traffic can often be sniffed by any attacker who has
+                        access to a network interface. This significantly lowers the difficulty of exploitation by
+                        attackers.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:15.646">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:00.986">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T20:58:34.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.083">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:45.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-03-13T16:00:44.000">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-19T07:31:57.124">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2017-03-22T09:56:18.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-07T07:51:33.406">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-25T21:10:35.879">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-25T21:47:09.132">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.
+          </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-10-04T15:57:14.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.312">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-11-20T18:23:44.319">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="91" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-08-07T09:28:58.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="62" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
+  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
+  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-08-29T10:47:33.932">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="62" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:15.675">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:17.905">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:44:50.785">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
+          &lt;br /&gt;&lt;br /&gt;
+          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA. 
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                &lt;ol&gt;
+                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
+                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-01-18T14:48:40.303">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="42" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server)&lt;/li&gt;
+                        &lt;li&gt;Origin, with this field we mark if the logs are provided by a trusted or untrusted
+                        source.&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs)&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that, at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc) .&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-24T13:07:20.403">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:14.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:18.335">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2019-07-10T12:00:36.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="91" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-23T21:01:06.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="42" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="fedramp-high-baseline" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="fedramp-low-baseline" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="fedramp-moderate-baseline" supportedStandardRef="fedramp-moderate-baseline"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-11-24T13:05:33.389">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform=".NET C#" cost="0" risk="69" state="Required" owner="alessia71@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side, in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker may append an 'OR' statement to the customerName parameter in order to bypass checks and return additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;Using prepared statements with carefully controlled and validated input conditions mitigates against SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2015-08-15T17:17:13.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised though attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.
+                            </desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                    <countermeasure ref="CWE-662" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                <countermeasure ref="CWE-662" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319-AUTH">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
+                                that data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                    <countermeasure ref="store-backups-securely" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                <countermeasure ref="store-backups-securely" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="CS-Default" editable="true">
+              <desc>If sensitive data is stored or processed on the host, then should the host itself be
+                                compromised by an attacker, the confidentiality and/or the integrity of the data would
+                                also be at risk.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="0c92d868-d9e8-464c-9f86-2bf0491811d2" diagramComponentId="0b7db21d-459a-4cd5-8867-45ed7b5cdc43" ref="f6372a8d-42ab-4572-80a1-edd76f49b5d1" name="Microsoft Azure Active Directory" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-active-directory">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are typically introduced during the
+                        configuration of the software.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-DATA-01" name="Sensitive data are accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data are not encrypted and the sensitive data is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-alerts-access" name="There is no alert for unauthorized access" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There is no alert to notify about unauthorized access to the resources, and this access is not logged.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.496">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.280">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD1" name="Block legacy authentication for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Block legacy authentication for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; To give your users easy access to your cloud apps, Azure Active Directory (Azure AD) supports a broad variety of authentication protocols including legacy authentication. Legacy authentication is a term that refers to an authentication request made by:&lt;br&gt; - Older Office clients that do not use modern authentication (for example, Office 2010 client)&lt;br&gt; - Any client that uses legacy mail protocols such as IMAP/SMTP/POP3&lt;br&gt; Today, the majority of all compromising sign-in attempts come from legacy authentication. Legacy authentication does not support multi-factor authentication (MFA). Even if you have an MFA policy enabled on your directory, a bad actor can authenticate using a legacy protocol and bypass MFA. The best way to protect your account from malicious authentication requests made by legacy protocols is to block these attempts altogether.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Follow the steps below in order to block legacy authentication in your directory&lt;/p&gt;&lt;p&gt;Identify legacy authentication use&lt;/p&gt;&lt;p&gt;Before you can block legacy authentication in your directory, you need to first understand if your users have apps that use legacy authentication and how it affects your overall directory. Azure AD sign-in logs can be used to understand if you are using legacy authentication.&lt;/p&gt;&lt;p&gt;1. Navigate to the Azure portal &amp;gt; Azure Active Directory &amp;gt; Sign-ins.&lt;br&gt; 2. Add the Client App column if it is not shown by clicking on Columns &amp;gt; Client App.&lt;br&gt; 3. Filter by Client App &amp;gt; check all the Legacy Authentication Clients options presented.&lt;br&gt; 4. Filter by Status &amp;gt; Success.&lt;br&gt; 5. Expand your date range if necessary using the Date filter.&lt;/p&gt;&lt;p&gt;Filtering will only show you successful sign-in attempts that were made by the selected legacy authentication protocols. Clicking on each individual sign-in attempt will show you additional details. The Client App column or the Client App field under the Basic Info tab after selecting an individual row of data will indicate which legacy authentication protocol was used. These logs will indicate which users are still depending on legacy authentication and which applications are using legacy protocols to make authentication requests. For users that do not appear in these logs and are confirmed to not be using legacy authentication, implement a Conditional Access policy or enable the Baseline policy: block legacy authentication for these users only.&lt;/p&gt;&lt;p&gt;Moving away from legacy authentication&lt;/p&gt;&lt;p&gt;Once you have a better idea of who is using legacy authentication in your directory and which applications depend on it, the next step is upgrading your users to use modern authentication. Modern authentication is a method of identity management that offers more secure user authentication and authorization. If you have an MFA policy in place on your directory, modern authentication ensures that the user is prompted for MFA when required. It is the more secure alternative to legacy authentication protocols.&lt;/p&gt;&lt;p&gt;This section gives a step-by-step overview on how to update your environment to modern authentication. Read through the steps below before enabling a legacy authentication blocking policy in your organization.&lt;/p&gt;&lt;p&gt;Step 1: Enable modern authentication in your directory&lt;/p&gt;&lt;p&gt;The first step in enabling modern authentication is making sure your directory supports modern authentication. Modern authentication is enabled by default for directories created on or after August 1, 2017. If your directory was created prior to this date, you will need to manually enable modern authentication for your directory using the following steps:&lt;/p&gt;&lt;p&gt;1. Check to see if your directory already supports modern authentication by running Get-CsOAuthConfiguration from the Skype for Business Online PowerShell module.&lt;br&gt; 2. If your command returns an empty OAuthServers property, then Modern Authentication is disabled. Update the setting to enable modern authentication using Set-CsOAuthConfiguration. If your OAuthServers property contains an entry, you are good to go.&lt;/p&gt;&lt;p&gt;Be sure to complete this step before moving forward. It is critical that your directory configurations are changed first because they dictate which protocol will be used by all Office clients. Even if you are using Office clients that support modern authentication, they will default to using legacy protocols if modern authentication is disabled on your directory.&lt;/p&gt;&lt;p&gt;Step 2: Office applications&lt;/p&gt;&lt;p&gt;Once you have enabled modern authentication in your directory, you can start updating applications by enabling modern authentication for Office clients. Office 2016 or later clients support modern authentication by default. No extra steps are required.&lt;/p&gt;&lt;p&gt;If you are using Office 2013 Windows clients or older, Azure recommends upgrading to Office 2016 or later. Even after completing the prior step of enabling modern authentication in your directory, the older Office applications will continue to use legacy authentication protocols. If you are using Office 2013 clients and are unable to immediately upgrade to Office 2016 or later, follow the steps in the following article to Enable Modern Authentication for Office 2013 on Windows devices. To help protect your account while you are using legacy authentication, Azure recommends using strong passwords across your directory. Check out Azure AD password protection to ban weak passwords across your directory.&lt;/p&gt;&lt;p&gt;Office 2010 does not support modern authentication. You will need to upgrade any users with Office 2010 to a more recent version of Office. Azure recommends upgrading to Office 2016 or later, as it blocks legacy authentication by default.&lt;/p&gt;&lt;p&gt;If you are using macOS, Azure recommends upgrading to Office for Mac 2016 or later. If you are using the native mail client, you will need to have macOS version 10.14 or later on all devices.&lt;/p&gt;&lt;p&gt;Step 3: Exchange and SharePoint&lt;/p&gt;&lt;p&gt;For Windows-based Outlook clients to use modern authentication, Exchange Online must be modern authentication enabled as well. If modern authentication is disabled for Exchange Online, Windows-based Outlook clients that support modern authentication (Outlook 2013 or later) will use basic authentication to connect to Exchange Online mailboxes.&lt;/p&gt;&lt;p&gt;SharePoint Online is enabled for modern authentication default. For directories created after August 1, 2017, modern authentication is enabled by default in Exchange Online. However, if you had previously disabled modern authentication or are you using a directory created prior to this date, follow the steps in the "Enable modern authentication in Exchange Online" in Reference Url.&lt;/p&gt;&lt;p&gt;Step 4: Skype for Business&lt;/p&gt;&lt;p&gt;To prevent legacy authentication requests made by Skype for Business, it is necessary to enable modern authentication for Skype for Business Online. For directories created after August 1, 2017, modern authentication for Skype for Business is enabled by default.&lt;/p&gt;&lt;p&gt;Azure suggests you transition to Microsoft Teams, which supports modern authentication by default. However, if you are unable to migrate at this time, you will need to enable modern authentication for Skype for Business Online so that Skype for Business clients start using modern authentication.&lt;/p&gt;&lt;p&gt;In addition to enabling modern authentication for Skype for Business Online, Azure recommends enabling modern authentication for Exchange Online when enabling modern authentication for Skype for Business. This process will help synchronize the state of modern authentication in Exchange Online and Skype for Business online and will prevent multiple sign-in prompts for Skype for Business clients.&lt;/p&gt;&lt;p&gt;Step 5: Using mobile devices&lt;br&gt; Applications on your mobile device need to block legacy authentication as well. Azure recommends using Outlook for Mobile. Outlook for Mobile supports modern authentication by default and will satisfy other MFA baseline protection policies.&lt;/p&gt;&lt;p&gt;In order to use the native iOS mail client, you will need to be running iOS version 11.0 or later to ensure the mail client has been updated to block legacy authentication.&lt;/p&gt;&lt;p&gt;Step 6: On-premises clients&lt;/p&gt;&lt;p&gt;If you are a hybrid customer using Exchange Server on-premises and Skype for Business on-premises, both services will need to be updated to enable modern authentication. When using modern authentication in a hybrid environment, you are still authenticating users on-premises. The story of authorizing their access to resources (files or emails) changes.&lt;/p&gt;&lt;p&gt;Before you can begin enabling modern authentication on-premises, please be sure that you have met the pre-requisites. You are now ready to enable modern authentication on-premises.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blocking legacy authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-block-legacy-authentication"/>
+            <reference name="Enable or disable modern authentication for Outlook in Exchange Online" url="https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To check if your users have apps that use legacy authentication, follow again the steps of "Identify legacy authentication use" section:&lt;/p&gt;      &lt;p&gt;1. Navigate to the Azure portal &gt; Azure Active Directory &gt; Sign-ins.&lt;br /&gt;  2. Add the Client App column if it is not shown by clicking on Columns &gt; Client App.&lt;br /&gt;  3. Filter by Client App &gt; check all the Legacy Authentication Clients options presented.&lt;br /&gt;  4. Filter by Status &gt; Success.&lt;br /&gt;  5. Expand your date range if necessary using the Date filter.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD18" name="Configure Azure Active Directory settings" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure Active Directory.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of methods required to reset' is set to '2'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0"&lt;/li&gt;&lt;li&gt;Ensure that 'Notify users on password resets?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can register applications' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guest user permissions are limited' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Members can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guests can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create security groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that no custom subscription owner roles are created&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;ol&gt;&lt;li&gt;Go to Users&lt;ol&gt;&lt;li&gt;Go to Password reset&lt;ol&gt;&lt;li&gt;Go to Authentication methods&lt;ol&gt;&lt;li&gt;Set the Number of methods required to reset to 2&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Registration&lt;ol&gt;&lt;li&gt;Set the Number of days before users are asked to re-confirm their authentication information to your organization defined frequency&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Notification&lt;ol&gt;&lt;li&gt;Set Notify users on password resets? to Yes&lt;/li&gt;&lt;li&gt;Set Notify all admins when other admins reset their password? to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to All Users&lt;ol&gt;&lt;li&gt;Click on Multi-Factor Authentication button on the top bar&lt;/li&gt;&lt;li&gt;Click on service settings&lt;/li&gt;&lt;li&gt;Disable Allow users to remember multi-factor authentication on devices they trust&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to User settings&lt;ol&gt;&lt;li&gt;Click on Manage how end users launch and view their applications&lt;ol&gt;&lt;li&gt;Set Users can consent to apps accessing company data on their behalf to No&lt;/li&gt;&lt;li&gt;Set Users can add gallery apps to their Access Panel to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Set Users can register applications to No&lt;/li&gt;&lt;li&gt;Set Restrict access to Azure AD administration portal to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to External Identities&lt;ol&gt;&lt;li&gt;Go to External collaboration settings&lt;ol&gt;&lt;li&gt;Set Guest users permissions are limited to Yes&lt;/li&gt;&lt;li&gt;Set Members can invite to No&lt;/li&gt;&lt;li&gt;Set Guests can invite to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Groups&lt;ol&gt;&lt;li&gt;Go to General in setting&lt;ol&gt;&lt;li&gt;Ensure that Restrict user ability to access groups features in the Access Pane is set to No&lt;/li&gt;&lt;li&gt;Set Users can create security groups in Azure Portals to No&lt;/li&gt;&lt;li&gt;Set Owners can manage group membership requests in the Access Panel to No&lt;/li&gt;&lt;li&gt;Set Users can create Microsoft 365 groups in Azure Portals to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Devices&lt;ol&gt;&lt;li&gt;Go to Device settings&lt;ol&gt;&lt;li&gt;Set Require Multi-Factor Auth to join devices to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.10" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.10" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.11" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.13" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.13" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.14" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.14" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.15" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.15" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.16" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.17" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.17" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.18" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.19" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.20" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.21" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.22" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.22" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.23" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.23" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="GS-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="IM-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD12" name="Configure Azure Monitor logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Configure Azure Monitor logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure Monitor logs allows you to query data to find particular events, analyze trends, and perform correlation across various data sources. You can also set up alerts on your query. With the integration of Azure AD activity logs in Azure Monitor logs, you can now perform tasks like:&lt;/p&gt; 
+&lt;p&gt;- Compare your Azure AD sign-in logs against security logs published by Azure Security Center&lt;br&gt; - Troubleshoot performance bottlenecks on your application's sign-in page by correlating application performance data from Azure Application Insights.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Using this feature requires an Azure AD Premium P1 or P2 license.&lt;/p&gt; 
+&lt;p&gt;Send logs to Azure Monitor&lt;/p&gt; 
+&lt;p&gt;1.Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Azure Active Directory &amp;gt; Diagnostic settings -&amp;gt; Add diagnostic setting. You can also select Export Settings from the Audit Logs or Sign-ins page to get to the diagnostic settings configuration page.&lt;/p&gt; 
+&lt;p&gt;3. In the Diagnostic settings menu, select the Send to Log Analytics workspace check box, and then select Configure.&lt;/p&gt; 
+&lt;p&gt;4. Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.&lt;/p&gt; 
+&lt;p&gt;5. Do either or both of the following:&lt;/p&gt; 
+&lt;p&gt;- To send audit logs to the Log Analytics workspace, select the AuditLogs check box.&lt;br&gt; - To send sign-in logs to the Log Analytics workspace, select the SignInLogs check box.&lt;/p&gt; 
+&lt;p&gt;6. Select Save to save the setting.&lt;/p&gt; 
+&lt;p&gt;7. After about 15 minutes, verify that events are streamed to your Log Analytics workspace.&lt;/p&gt; 
+&lt;p&gt;Navigate to the Log Analytics workspace&lt;/p&gt; 
+&lt;p&gt;- Sign in to the Azure portal.&lt;br&gt; - Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace. The workspace will open with a default query.&lt;/p&gt; 
+&lt;p&gt;Alert on Azure AD activity log data&lt;/p&gt; 
+&lt;p&gt;You can also set up alerts on your query. For example, to configure an alert when more than 10 applications have been used in the last week:&lt;/p&gt; 
+&lt;p&gt;1. From the workspace, select Set alert to open the Create rule page.&lt;/p&gt; 
+&lt;p&gt;2. Select the default alert criteria created in the alert and update the Threshold in the default metric to 10.&lt;/p&gt; 
+&lt;p&gt;3. Enter a name and description for the alert, and choose the severity level. For our example, we could set it to Informational.&lt;/p&gt; 
+&lt;p&gt;4. Select the Action Group that will be alerted when the signal occurs. You can choose to notify your team via email or text message, or you could automate the action using webhooks, Azure functions or logic apps. Learn more about creating and managing alert groups in the Azure portal.&lt;/p&gt; 
+&lt;p&gt;5. Once you have configured the alert, select Create alert to enable it.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Analyze Azure AD activity logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics#alert-on-azure-ad-activity-log-data"/>
+            <reference name="Integrate Azure AD logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Monitor logs are configured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD4" name="Create an organization specific custom banned password list" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create an organization specific custom banned password list&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, the Azure Active Directory (Azure AD) custom banned password list let you add specific strings to evaluate and block. A password change request fails if there is a match in the custom banned password list.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Note: To complete this guide, you need a working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.&lt;/p&gt; 
+&lt;p&gt;Configure custom banned passwords&lt;/p&gt; 
+&lt;p&gt;To enable the custom banned password list and add entries to it, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, then choose Security from the menu on the left-hand side.&lt;/p&gt; 
+&lt;p&gt;3. Under the Manage menu header, select Authentication methods, then Password protection.&lt;/p&gt; 
+&lt;p&gt;4. Set the option for Enforce custom list to Yes.&lt;/p&gt; 
+&lt;p&gt;5. Add strings to the Custom banned password list, one string per line. The following considerations and limitations apply to the custom banned password list:&lt;/p&gt; 
+&lt;p&gt;- The custom banned password list can contain up to 1000 terms.&lt;br&gt; - The custom banned password list is case-insensitive.&lt;br&gt; - The custom banned password list considers common character substitution, such as o and 0, or a and @.&lt;br&gt; - The minimum string length is four characters, and the maximum is 16 characters.&lt;/p&gt; 
+&lt;p&gt;Specify your own custom passwords to ban.&lt;/p&gt; 
+&lt;p&gt;6. Leave the option for Enable password protection on Windows Server Active Directory to No.&lt;/p&gt; 
+&lt;p&gt;7. To enable the custom banned passwords and your entries, select Save.&lt;/p&gt; 
+&lt;p&gt;It may take several hours for updates to the custom banned password list to be applied.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Configure custom banned passwords for Azure Active Directory password protection" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test custom banned password list&lt;/p&gt;
+
+  &lt;p&gt;To see the custom banned password list in action, try to change the password to a variation of one that you added in the Remediation section. When Azure AD tries to process the password change, the password is matched against an entry in the custom banned password list. An error is then displayed to the user.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD3" name="Designate more than one global administrator in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Designate more than one global administrator in Azure AD&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you cannot sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts cannot be used. Azure recommends that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create emergency access accounts&lt;/p&gt; 
+&lt;p&gt;Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.&lt;/p&gt; 
+&lt;p&gt;When configuring these accounts, the following requirements must be met:&lt;/p&gt; 
+&lt;p&gt;- The emergency access accounts should not be associated with any individual user in the organization. Make sure that your accounts are not connected with any employee-supplied mobile phones, hardware tokens that travel with individual employees, or other employee-specific credentials. This precaution covers instances where an individual employee is unreachable when the credential is needed. It is important to ensure that any registered devices are kept in a known, secure location that has multiple means of communicating with Azure AD.&lt;br&gt; - The authentication mechanism used for an emergency access account should be distinct from that used by your other administrative accounts, including other emergency access accounts. For example, if your normal administrator sign-in is via on-premises MFA, then Azure AD MFA would be a different mechanism. However if Azure AD MFA is your primary part of authentication for your administrative accounts, then consider a different approach for these, such as using Conditional Access with a third-party MFA provider via Custom controls.&lt;br&gt; - The device or credential must not expire or be in scope of automated cleanup due to lack of use.&lt;br&gt; - You should make the Global Administrator role assignment permanent for your emergency access accounts.&lt;/p&gt; 
+&lt;p&gt;Exclude at least one account from phone-based multi-factor authentication&lt;/p&gt; 
+&lt;p&gt;To reduce the risk of an attack resulting from a compromised password, Azure AD recommends that you require multi-factor authentication for all individual users. This group includes administrators and all others (for example, financial officers) whose compromised account would have a significant impact.&lt;/p&gt; 
+&lt;p&gt;However, at least one of your emergency access accounts should not have the same multi-factor authentication mechanism as your other non-emergency accounts. This includes third-party multi-factor authentication solutions. If you have a Conditional Access policy to require multi-factor authentication for every administrator for Azure AD and other connected software as a service (SaaS) apps, you should exclude emergency access accounts from this requirement, and configure a different mechanism instead. Additionally, you should make sure the accounts do not have a per-user multi-factor authentication policy.&lt;/p&gt; 
+&lt;p&gt;Exclude at least one account from Conditional Access policies&lt;/p&gt; 
+&lt;p&gt;During an emergency, you do not want a policy to potentially block your access to fix an issue. At least one emergency access account should be excluded from all Conditional Access policies.&lt;/p&gt; 
+&lt;p&gt;In addition you have to store the credentials for emergency access accounts safely and monitor sign-in and audit log activity.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Manage emergency access accounts in Azure AD" url="https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have at least two emergency access accounts.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD8" name="Disable end-user consent to applications" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Disable end-user consent to applications&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The admin consent workflow gives admins a secure way to grant access to applications that require admin approval so end users do not expose corporate data. Microsoft recommends disabling future user consent operations to help reduce your surface area and mitigate this risk.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To configure user consent settings through the Azure portal:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a Global Administrator.&lt;br&gt; 2. Select Azure Active Directory &amp;gt; Enterprise applications &amp;gt; Consent and permissions &amp;gt; User consent settings.&lt;br&gt; 3. Under User consent for applications, select "Do not allow user consent" &lt;br&gt; 4. Select Save to save your settings.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure how end-users consent to applications" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that end-user consent to applications is disabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.285">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD11" name="Enable Azure AD Identity Protection" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Active Directory Identity Protection&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Identity Protection is a tool that allows organizations to accomplish three key tasks:&lt;/p&gt;
+
+  &lt;p&gt;- Automate the detection and remediation of identity-based risks.&lt;br /&gt;
+- Investigate risks using data in the portal.&lt;br /&gt;
+- Export risk detection data to third-party utilities for further analysis.&lt;/p&gt;
+
+  &lt;p&gt;Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.&lt;/p&gt;
+
+  &lt;p&gt;The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Using this feature requires an Azure AD Premium P2 license.&lt;/p&gt;
+
+  &lt;p&gt;Then in the Azure portal under Azure Active Directory &gt; Security &gt; Identity Protection you can:&lt;/p&gt;
+
+  &lt;p&gt;- Configure the MFA registration policy&lt;br /&gt;
+- Configure risk policies&lt;br /&gt;
+- Configure notifications&lt;/p&gt;
+
+  &lt;p&gt;For more information please see Reference URLs.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Active Directory Identity Protection notifications" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications"/>
+            <reference name="How To: Configure and enable risk policies" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies"/>
+            <reference name="How To: Configure the Azure AD Multi-Factor Authentication registration policy" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy"/>
+            <reference name="What is Identity Protection?" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Active Directory Identity Protection is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD5" name="Enable combined security information registration in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable combined security information registration in Azure AD&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.&lt;br&gt; Note: Starting on August 15th 2020, all new Azure AD tenants will be automatically enabled for combined registration. Starting on December 14th 2020, all Azure AD tenants with one user will be automatically enabled for combined registration.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To enable combined registration, complete these steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a user administrator or global administrator.&lt;/p&gt; 
+&lt;p&gt;2. Go to Azure Active Directory &amp;gt; User settings &amp;gt; Manage user feature preview settings.&lt;/p&gt; 
+&lt;p&gt;3. Under Users can use the combined security information registration experience, choose to enable for a Selected group of users or for All users.&lt;/p&gt; 
+&lt;p&gt;Create a policy to require registration from a trusted location&lt;/p&gt; 
+&lt;p&gt;Complete the following steps to create a policy that applies to all selected users that attempt to register using the combined registration experience, and blocks access unless they are connecting from a location marked as trusted network:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;/p&gt; 
+&lt;p&gt;2. Select + New policy.&lt;/p&gt; 
+&lt;p&gt;3. Enter a name for this policy, such as Combined Security Info Registration on Trusted Networks.&lt;/p&gt; 
+&lt;p&gt;4. Under Assignments, select Users and groups. Choose the users and groups you want this policy to apply to, then select Done.&lt;/p&gt; 
+&lt;p&gt;Warning: Users must be enabled for combined registration.&lt;/p&gt; 
+&lt;p&gt;5. Under Cloud apps or actions, select User actions. Check Register security information, then select Done.&lt;/p&gt; 
+&lt;p&gt;6. Under Conditions &amp;gt; Locations, configure the following options:&lt;br&gt; a. Configure Yes.&lt;br&gt; b. Include Any location.&lt;br&gt; c. Exclude All trusted locations.&lt;/p&gt; 
+&lt;p&gt;7. Select Done on the Locations window, then select Done on the Conditions window.&lt;/p&gt; 
+&lt;p&gt;8. Under Access controls &amp;gt; Grant, choose Block access, then Select.&lt;/p&gt; 
+&lt;p&gt;9. Set Enable policy to On.&lt;/p&gt; 
+&lt;p&gt;10. To finalize the policy, select Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable combined security information registration in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that combined security information registration is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD14" name="Enable device based Conditional Access" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable device based Conditional Access&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Improve security and user experiences with device-based Conditional Access. This control ensures users can only access from devices that meet your standards for security and compliance. These devices are also known as managed devices. Managed devices can be Intune compliant or Hybrid Azure AD joined devices.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Managed devices&lt;/p&gt; 
+&lt;p&gt;In simple terms, managed devices are devices that are under some sort of organizational control. In Azure AD, the prerequisite for a managed device is that it has been registered with Azure AD. Registering a device creates an identity for the device in form of a device object. This object is used by Azure to track status information about a device. As an Azure AD administrator, you can already use this object to toggle (enable/disable) the state of a device.&lt;/p&gt; 
+&lt;p&gt;To get a device registered with Azure AD, you have three options:&lt;/p&gt; 
+&lt;p&gt;- Azure AD registered devices - to get a personal device registered with Azure AD&lt;br&gt; - Azure AD joined devices - to get an organizational Windows 10 device that is not joined to an on-premises AD registered with Azure AD.&lt;br&gt; - Hybrid Azure AD joined devices - to get a Windows 10 or supported down-level device that is joined to an on-premises AD registered with Azure AD.&lt;/p&gt; 
+&lt;p&gt;To become a managed device, a registered device must be either a Hybrid Azure AD joined device or a device that has been marked as compliant.&lt;/p&gt; 
+&lt;p&gt;Require Hybrid Azure AD joined devices&lt;/p&gt; 
+&lt;p&gt;In your Conditional Access policy, you can select Require Hybrid Azure AD joined device to state that the selected cloud apps can only be accessed using a managed device.&lt;/p&gt; 
+&lt;p&gt;This setting only applies to Windows 10 or down-level devices such as Windows 7 or Windows 8 that are joined to an on-premises AD. You can only register these devices with Azure AD using a Hybrid Azure AD join, which is an automated process to get a Windows 10 device registered.&lt;/p&gt; 
+&lt;p&gt;What makes a Hybrid Azure AD joined device a managed device? For devices that are joined to an on-premises AD, it is assumed that the control over these devices is enforced using management solutions such as Configuration Manager or group policy (GP) to manage them. Because there is no method for Azure AD to determine whether any of these methods has been applied to a device, requiring a hybrid Azure AD joined device is a relatively weak mechanism to require a managed device. It is up to you as an administrator to judge whether the methods that are applied to your on-premises domain-joined devices are strong enough to constitute a managed device if such a device is also a Hybrid Azure AD joined device.&lt;/p&gt; 
+&lt;p&gt;Require device to be marked as compliant&lt;/p&gt; 
+&lt;p&gt;The option to require a device to be marked as compliant is the strongest form to request a managed device.&lt;/p&gt; 
+&lt;p&gt;This option requires a device to be registered with Azure AD, and also to be marked as compliant by:&lt;br&gt; - Intune&lt;br&gt; - A third-party mobile device management (MDM) system that manages Windows 10 devices via Azure AD integration. Third-party MDM systems for device OS types other than Windows 10 are not supported.&lt;/p&gt; 
+&lt;p&gt;For a device that is marked as compliant, you can assume that:&lt;br&gt; - The mobile devices your workforce uses to access company data are managed&lt;br&gt; - Mobile apps your workforce uses are managed&lt;br&gt; - Your company information is protected by helping to control the way your workforce accesses and shares it&lt;br&gt; - The device and its apps are compliant with company security requirements&lt;/p&gt; 
+&lt;p&gt;Scenario: Require device enrollment for iOS and Android devices&lt;/p&gt; 
+&lt;p&gt;In this scenario, Contoso has decided that all mobile access to Microsoft 365 resources must use an enrolled device. All of their users already sign in with Azure AD credentials and have licenses assigned to them that include Azure AD Premium P1 or P2 and Microsoft Intune.&lt;/p&gt; 
+&lt;p&gt;Organizations must complete the following steps in order to require the use of an enrolled mobile device.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;br&gt; 3. Select New policy.&lt;br&gt; 4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.&lt;br&gt; 5. Under Assignments, select Users and groups&lt;br&gt; a. Under Include, select All users or the specific Users and groups you wish to apply this policy to.&lt;br&gt; b. Select Done.&lt;br&gt; 6. Under Cloud apps or actions &amp;gt; Include, select Office 365.&lt;br&gt; 7. Under Conditions, select Device platforms.&lt;br&gt; a. Set Configure to Yes.&lt;br&gt; b. Include Android and iOS.&lt;br&gt; 8. Under Access controls &amp;gt; Grant, select the following options:&lt;br&gt; - Require device to be marked as compliant&lt;br&gt; 9. Confirm your settings and set Enable policy to On.&lt;br&gt; 10. Select Create to create and enable your policy.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How To: Require managed devices for cloud app access with Conditional Access" url="https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices#require-hybrid-azure-ad-joined-devices"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that device based Conditional Access is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD16" name="Enable Microsoft's password guidance" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Microsoft's password guidance&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Password Guidance provides Microsoft's recommendations for password management based on current research and lessons from their own experience as one of the largest Identity Providers (IdPs) in the world. It covers recommendations for end users and identity administrators.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Download and enforce Microsoft's password guidance in your organization.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Password Guidance" url="https://www.microsoft.com/en-us/research/publication/password-guidance/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Microsoft's password guidance is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD7" name="Enable password writeback for SSPR if using hybrid identities" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable password writeback for SSPR if using hybrid identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; With Azure Active Directory (Azure AD) self-service password reset (SSPR), users can update their password or unlock their account using a web browser. In a hybrid environment where Azure AD is connected to an on-premises Active Directory Domain Services (AD DS) environment, this scenario can cause passwords to be different between the two directories.&lt;/p&gt; 
+&lt;p&gt;Password writeback can be used to synchronize password changes in Azure AD back to your on-premises AD DS environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Azure AD.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;/p&gt; 
+&lt;p&gt;Enable password writeback for SSPR&lt;/p&gt; 
+&lt;p&gt;Note: Before proceeding to the following steps, make sure you have enabled password writeback to Azure AD Connect first.&lt;/p&gt; 
+&lt;p&gt;With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.&lt;/p&gt; 
+&lt;p&gt;To enable password writeback in SSPR, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using a global administrator account.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, select Password reset, then choose On-premises integration.&lt;/p&gt; 
+&lt;p&gt;3. Set the option for Write back passwords to your on-premises directory? to Yes.&lt;/p&gt; 
+&lt;p&gt;4. Set the option for Allow users to unlock accounts without resetting their password? to Yes.&lt;/p&gt; 
+&lt;p&gt;5. When ready, select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Enable Azure Active Directory self-service password reset writeback to an on-premises environment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback#enable-password-writeback-for-sspr"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that password writeback for SSPR is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards>
+            <standard ref="1.1.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.1.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.1.3" supportedStandardRef="cis-azure-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Licensing requirements&lt;/p&gt;
+
+  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
+
+  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
+- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
+
+  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
+
+  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
+- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
+When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
+
+  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD2" name="Enable Security defaults for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Security defaults for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; Managing security can be difficult with common identity-related attacks like password spray, replay, and phishing becoming more and more popular. Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:&lt;/p&gt;&lt;p&gt;- Requiring all users to register for Azure AD Multi-Factor Authentication.&lt;br&gt; - Requiring administrators to perform multi-factor authentication.&lt;br&gt; - Blocking legacy authentication protocols.&lt;br&gt; - Requiring users to perform multi-factor authentication when necessary.&lt;br&gt; - Protecting privileged activities like access to the Azure portal.&lt;/p&gt;&lt;p&gt;Note: If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Enabling security defaults&lt;br&gt; To enable security defaults in your directory:&lt;/p&gt;&lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Properties.&lt;br&gt; 3. Select Manage security defaults.&lt;br&gt; 4. Set the Enable security defaults toggle to Yes.&lt;br&gt; 5. Select Save.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; Warning: Before you enable security defaults, make sure your administrators are not using older authentication protocols.&lt;/p&gt;&lt;p&gt;Who should use Conditional Access instead of Security defaults?&lt;br&gt; - If you are an organization currently using Conditional Access policies to bring signals together, to make decisions, and enforce organizational policies, security defaults are probably not right for you.&lt;br&gt; - If you are an organization with Azure Active Directory Premium licenses, security defaults are probably not right for you.&lt;br&gt; - If your organization has complex security requirements you should consider Conditional Access.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What are security defaults?" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults"/>
+          </references>
+          <standards>
+            <standard ref="1.1.1" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.1.1" supportedStandardRef="cis-azure-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To ensure that Security defaults are enabled:&lt;/p&gt;      &lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br /&gt;  2. Browse to Azure Active Directory &gt; Properties.&lt;br /&gt;  3. Select Manage security defaults.&lt;br /&gt;  4. Check that the Enable security defaults toggle is set to Yes.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD6" name="Enable self-service password reset (SSPR)" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable self-service password reset (SSPR)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Self-Service Password Reset (SSPR) is an Azure Active Directory (AD) feature that enables users to reset their passwords without contacting IT staff for help. The users can quickly unblock themselves and continue working no matter where they are or time of day. By allowing the employees to unblock themselves, your organization can reduce the non-productive time and high support costs for most common password-related issues.&lt;/p&gt; 
+&lt;p&gt;SSPR has the following key capabilities:&lt;/p&gt; 
+&lt;p&gt;- Self-service allows end users to reset their expired or non-expired passwords without contacting an administrator or helpdesk for support.&lt;br&gt; - Password Writeback allows management of on-premises passwords and resolution of account lockout though the cloud.&lt;br&gt; - Password management activity reports give administrators insight into password reset and registration activity occurring in their organization.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; This is how configure SSPR for a set of users in a test group. In the following example, the group SSPR-Test-Group is used. Provide your own Azure AD group as needed:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, then choose Password reset from the menu on the left-hand side.&lt;/p&gt; 
+&lt;p&gt;3. From the Properties page, under the option Self service password reset enabled, choose Select group&lt;/p&gt; 
+&lt;p&gt;4. Browse for and select your Azure AD group, such as SSPR-Test-Group, then choose Select.&lt;/p&gt; 
+&lt;p&gt;5. To enable SSPR for the select users, select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Plan an Azure Active Directory self-service password reset deployment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment"/>
+            <reference name="Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test self-service password reset&lt;/p&gt;
+
+  &lt;p&gt;With SSPR enabled and configured, test the SSPR process with a user that's part of the group you selected in the Remediation section, such as Test-SSPR-Group. In the following example, the testuser account is used. Provide your own user account that's part of the group you enabled for SSPR in the Remediation section.&lt;/p&gt;
+
+  &lt;p&gt;Note: When you test self-service password reset, use a non-administrator account. By default, admins are enabled for self-service password reset and are required to use two authentication methods to reset their password. For more information, see Administrator reset policy differences.&lt;/p&gt;
+
+  &lt;p&gt;1. To see the manual registration process, open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/ssprsetup. Users should be directed to this registration portal when they next sign-in.&lt;/p&gt;
+
+  &lt;p&gt;2. Sign in with a non-administrator test user, such as testuser, and register your authentication methods contact information.&lt;/p&gt;
+
+  &lt;p&gt;3. Once complete, select the button marked Looks good and close the browser window.&lt;/p&gt;
+
+  &lt;p&gt;4. Open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/sspr.&lt;/p&gt;
+
+  &lt;p&gt;5. Enter your non-administrator test users' account information, such as testuser, the characters from the CAPTCHA, and then select Next.&lt;/p&gt;
+
+  &lt;p&gt;6. Follow the verification steps to reset your password. When complete, you should receive an e-mail notification that your password was reset.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD17" name="Ensure there are no Azure Active Directory guest users if they are not needed" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.&lt;/p&gt;&lt;p&gt;Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.&lt;/p&gt;&lt;p&gt;Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely leading to a potential vulnerability.&lt;/p&gt;&lt;p&gt;Guest users should be review on a monthly basis to ensure that inactive and unneeded accounts are removed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Until you have a business need to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Delete all "Guest" users that are no longer required or are inactive.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;It is good practice to use a dynamic group to manage guest users. To create the dynamic group:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the Active Directory blade in the Azure Portal&lt;/li&gt;&lt;li&gt;Select the &lt;i&gt;Groups &lt;/i&gt;item&lt;/li&gt;&lt;li&gt;Create new&lt;/li&gt;&lt;li&gt;Type of &lt;i&gt;dynamic&lt;/i&gt;&lt;/li&gt;&lt;li&gt;Use the following dynamic selection rule. "(user.userType -eq "Guest")"&lt;/li&gt;&lt;li&gt;Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="PA-3" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Ensure that guest users listed are still required (USER TYPE = Guest)&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az ad user list --query "[?userType=='Guest']"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure all users listed are not inactive and still required.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using PowerShell&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Connect-AzureAD (Only needs to be performed once within the PowerShell session) Get-AzureADUser |Where-Object {$_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD9" name="Integrate supported SaaS applications from the gallery to Azure AD and enable SSO" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Integrate supported SaaS applications from the gallery to Azure AD and enable Single sign on (SSO)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure AD has a gallery that contains thousands of pre-integrated applications. Some of the applications your organization uses are probably in the gallery accessible directly from the Azure portal. Provide access to corporate SaaS applications remotely and securely with improved user experience (SSO).&lt;/p&gt; 
+&lt;p&gt;After integrating supported SaaS applications, you can automatically create user identities and roles in the cloud (SaaS) applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change, increasing your organization's security.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
+&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
+&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
+&lt;p&gt;3. In the Enterprise applications pane, select New application.&lt;/p&gt; 
+&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
+&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
+&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
+&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on.&lt;/p&gt; 
+&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
+&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
+&lt;p&gt;You have finished adding an application.&lt;/p&gt; 
+&lt;p&gt;How to set up automatic provisioning to an application&lt;/p&gt; 
+&lt;p&gt;For pre-integrated applications listed in the gallery, step-by-step guidance is available for setting up automatic provisioning. Please follow Reference URL for more details.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
+            <reference name="What is automated SaaS app user provisioning in Azure AD?" url="https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing supported SaaS applications integration&lt;/p&gt;
+
+  &lt;p&gt;Azure recommends using a non-production environment to test the steps in the description section.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD13" name="Secure legacy apps with Azure Active Directory" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure legacy apps with Azure Active Directory&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Publish and protect your on-premises and cloud legacy authentication applications by connecting them to Azure AD with your existing application delivery controller or network.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; You can protect your on-premises and cloud legacy authentication applications by connecting them to Azure Active Directory (AD) with:&lt;/p&gt; 
+&lt;p&gt;- Azure AD Application Proxy&lt;/p&gt; 
+&lt;p&gt;- Your existing application delivery controllers and networks&lt;/p&gt; 
+&lt;p&gt;- Virtual Private Network (VPN) and Software-Defined Perimeter (SDP) applications&lt;/p&gt; 
+&lt;p&gt;You can bridge the gap and strengthen your security posture across all applications with Azure AD capabilities like Azure AD Conditional Access and Azure AD Identity Protection.&lt;/p&gt; 
+&lt;p&gt;For more details please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure hybrid access: Secure legacy apps with Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/secure-hybrid-access"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your on-premises and cloud legacy authentication applications are secured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD15" name="Use Azure AD B2B to invite guest users" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure AD B2B to invite guest users&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Azure Active Directory (Azure AD) business-to-business (B2B) collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with guest users from any other organization, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources. Developers can use Azure AD business-to-business APIs to customize the invitation process or write applications like self-service sign-up portals.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Invite guest users from the Azure AD portal&lt;/p&gt;
+
+  &lt;p&gt;As an administrator, you can add guest users to your organization in the Azure portal.&lt;/p&gt;
+
+  &lt;p&gt;- Create a new guest user in Azure AD, similar to how you'd add a new user.&lt;br /&gt;
+- Assign guest users to apps or groups.&lt;br /&gt;
+- Send an invitation email that contains a redemption link, or send a direct link to an app you want to share.&lt;br /&gt;
+- Guest users follow a few simple redemption steps to sign in.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is guest user access in Azure Active Directory B2B?" url="https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure AD B2B is used to invite guest users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="50"/>
+                <countermeasure ref="AZ-A04" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD1" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD16" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD2" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD4" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD6" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD7" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="12"/>
+                <countermeasure ref="AZURE-AD1" mitigation="12"/>
+                <countermeasure ref="AZURE-AD16" mitigation="13"/>
+                <countermeasure ref="AZURE-AD2" mitigation="12"/>
+                <countermeasure ref="AZURE-AD4" mitigation="13"/>
+                <countermeasure ref="AZURE-AD6" mitigation="13"/>
+                <countermeasure ref="AZURE-AD7" mitigation="13"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD3" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZURE-AD3" mitigation="20"/>
+                <countermeasure ref="AZURE-AD5" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-16">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD18" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD18" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
+                                ports or security network configurations.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="no-alerts-access">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-DATA-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD8" mitigation="50"/>
+                    <countermeasure ref="AZURE-AD9" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD8" mitigation="50"/>
+                <countermeasure ref="AZURE-AD9" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-L01" mitigation="20"/>
+                    <countermeasure ref="AZ-L05" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD10" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD11" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-L01" mitigation="20"/>
+                <countermeasure ref="AZ-L05" mitigation="20"/>
+                <countermeasure ref="AZURE-AD10" mitigation="20"/>
+                <countermeasure ref="AZURE-AD11" mitigation="20"/>
+                <countermeasure ref="AZURE-AD12" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD13" mitigation="34"/>
+                    <countermeasure ref="AZURE-AD14" mitigation="33"/>
+                    <countermeasure ref="AZURE-AD15" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD13" mitigation="34"/>
+                <countermeasure ref="AZURE-AD14" mitigation="33"/>
+                <countermeasure ref="AZURE-AD15" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="17e1d146-ddd1-4fc7-8ee9-55fc9686f318" diagramComponentId="725a54fa-34f6-4418-a971-c9387f21718e" ref="550afa96-7bf8-47f9-81ba-151e8ff38483" name="Microsoft Azure Power BI" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-POWER-BI">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.114">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AZURE-POWER-BI1" name="Connect Power BI tenant to a Private link endpoint" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="alessia71@gmail.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Connect Power BI tenant to a Private link endpoint 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure networking provides the Azure Private Link feature that enables Power BI to provide secure access via Azure Networking private endpoints. With Azure Private Link and private endpoints, data traffic is sent privately using Microsoft's backbone network infrastructure, and thus the data doesn't traverse the Internet. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Private endpoints ensure that Power BI users use the Microsoft private network backbone when going to resources in the Power BI service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Power BI, you can configure and use an endpoint that enables your organization to access Power BI privately. To configure private endpoints you must be a Power BI administrator, and have permissions in Azure to create and configure resources such as Virtual Machines (VMs) and Virtual Networks (V-Net). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps that enable you to securely access Power BI from private endpoints are: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Enable private endpoints for Power BI 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Create a Power BI resource in the Azure portal 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Create a virtual network 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Create a virtual machine (VM) 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Create a private endpoint 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Connect to a VM using Remote Desktop (RDP) 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Access Power BI privately from the virtual machine 
+&lt;/div&gt; 
+&lt;div&gt;
+  8. Disable public access for Power BI 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For more information about each step, please see Refernce URL. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are a few considerations to keep in mind while working with private endpoints in Power BI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Any use of external images or themes are not available when using a private link environment. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - If Internet access is disabled, and if the dataset or dataflow is connecting to a Power BI dataset or dataflow as a data source, the connection will fail. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Usage metrics do not work when private endpoints are enabled. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Publish to Web is not supported when you enable Azure Private Link in Power BI. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Email subscriptions are not supported when you enable Block Public Internet Access in Power BI. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Microsoft Information Protection (MIP) does not currently support Private Links. This means that in Power BI Desktop running in an isolated network, the Sensitivity button will be grayed out, label information will not appear, and decryption of .pbix files will fail. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - To enable these capabilities in Power BI Desktop, admins can configure Service Tags for the underlying services that support MIP, EOP and AIP. Please make sure you understand the implications of using Service Tags in a Private Links isolated network. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Gateways enabled for Power BI private endpoints will not work properly with non-Power BI scenarios. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Private endpoints for accessing Power BI" url="https://docs.microsoft.com/en-us/power-bi/admin/service-security-private-links"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that your Power BI tenant is connected to a Private link endpoint and public internet access is disabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-01-21T18:11:47.083">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="alessia71@gmail.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="C-AZURE-POWER-BI1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AZURE-POWER-BI1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/external-user-access-through-vpn.xml b/Templates/Submitted_Templates/external-user-access-through-vpn.xml
new file mode 100644
index 0000000..ea7d356
--- /dev/null
+++ b/Templates/Submitted_Templates/external-user-access-through-vpn.xml
@@ -0,0 +1,19104 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="External user access through VPN" name="External user access through VPN" tags="Community">
+  <desc>&lt;p&gt;Remote Access Management&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTM4OCIgZHk9IjEwMDIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIxIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC41LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iQnVzaW5lc3MgQXBwIEhvc3RpbmciIHN0eWxlPSJpci5yZWY9ZmFmNjFkZDgtN2VhYi00YWMyLTkzYzgtYzQyZmQxZTg2MDQwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzhDOEM4Qztjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7c2tldGNoPTE7Z2xhc3M9MDtzaGFkb3c9MDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0MDEiIHk9Ii03NSIgd2lkdGg9IjY1MSIgaGVpZ2h0PSIzODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJCYWNrLWVuZCBzZXJ2ZXIiIHN0eWxlPSJpci5yZWY9MDE5M2VkODMtMzE5Mi00MDhkLTkzZDItZjIwNTM4MDk1Y2Y2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWJhY2stZW5kLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0ek9EQTFNemNnTUM0ek16azNORFJETUM0ek9EQTFNemNnTUM0ek1qWTBPRGtnTUM0ek9URXlPRElnTUM0ek1UVTNORFFnTUM0ME1EUTFNemNnTUM0ek1UVTNORFJJTUM0MU9EQTFNemRETUM0MU9UTTNPVElnTUM0ek1UVTNORFFnTUM0Mk1EUTFNemNnTUM0ek1qWTBPRGtnTUM0Mk1EUTFNemNnTUM0ek16azNORFJETUM0Mk1EUTFNemNnTUM0ek5USTVPVGtnTUM0MU9UTTNPVElnTUM0ek5qTTNORFFnTUM0MU9EQTFNemNnTUM0ek5qTTNORFJJTUM0ME1EUTFNemRETUM0ek9URXlPRElnTUM0ek5qTTNORFFnTUM0ek9EQTFNemNnTUM0ek5USTVPVGtnTUM0ek9EQTFNemNnTUM0ek16azNORFJhVFRBdU5EQTBOVE0zSURBdU5qWTNOelEwUXpBdU16a3hNamd5SURBdU5qWTNOelEwSURBdU16Z3dOVE0zSURBdU5qYzRORGc1SURBdU16Z3dOVE0zSURBdU5qa3hOelEwUXpBdU16Z3dOVE0zSURBdU56QTBPVGs1SURBdU16a3hNamd5SURBdU56RTFOelEwSURBdU5EQTBOVE0zSURBdU56RTFOelEwU0RBdU5URTBOVGsyUXpBdU5URTNORGszSURBdU5qazROek14SURBdU5USXlPVFkwSURBdU5qZ3lOVGswSURBdU5UTXdOVGczSURBdU5qWTNOelEwU0RBdU5EQTBOVE0zV2swd0xqVTJOelV5TmlBd0xqWXhPVGMwTkVnd0xqUXdORFV6TjBNd0xqTTVNVEk0TWlBd0xqWXhPVGMwTkNBd0xqTTRNRFV6TnlBd0xqWXdPRGs1T1NBd0xqTTRNRFV6TnlBd0xqVTVOVGMwTkVNd0xqTTRNRFV6TnlBd0xqVTRNalE0T1NBd0xqTTVNVEk0TWlBd0xqVTNNVGMwTkNBd0xqUXdORFV6TnlBd0xqVTNNVGMwTkVnd0xqVTRNRFV6TjBNd0xqVTVNek0xTlNBd0xqVTNNVGMwTkNBd0xqWXdNemd5TnlBd0xqVTRNVGM1TXlBd0xqWXdORFV3TXlBd0xqVTVORFEwTWtNd0xqVTVNVEF6TnlBd0xqWXdNVEl4TXlBd0xqVTNPRFl3T1NBd0xqWXdPVGMwT0NBd0xqVTJOelV5TmlBd0xqWXhPVGMwTkZwTk1DNDJNelkxTXpnZ01DNDFPREl5T0RSV01DNHlPRE0zTkRSRE1DNDJNelkxTXpnZ01DNHlOVGN5TXpVZ01DNDJNVFV3TkRjZ01DNHlNelUzTkRRZ01DNDFPRGcxTXpjZ01DNHlNelUzTkRSSU1DNHpPVFkxTXpkRE1DNHpOekF3TWpnZ01DNHlNelUzTkRRZ01DNHpORGcxTXpjZ01DNHlOVGN5TXpVZ01DNHpORGcxTXpjZ01DNHlPRE0zTkRSV01DNDNNekUzTkRSRE1DNHpORGcxTXpjZ01DNDNOVGd5TlRRZ01DNHpOekF3TWpnZ01DNDNOemszTkRRZ01DNHpPVFkxTXpjZ01DNDNOemszTkRSSU1DNDFNVFl3TVRaRE1DNDFNVGszTXpJZ01DNDNPVFk0TmpnZ01DNDFNall3TnlBd0xqZ3hNekF4TlNBd0xqVXpORFU0TnlBd0xqZ3lOemMwTkVnd0xqTTVOalV6TjBNd0xqTTBNelV4TnlBd0xqZ3lOemMwTkNBd0xqTXdNRFV6TnlBd0xqYzRORGMyTXlBd0xqTXdNRFV6TnlBd0xqY3pNVGMwTkZZd0xqSTRNemMwTkVNd0xqTXdNRFV6TnlBd0xqSXpNRGN5TlNBd0xqTTBNelV4TnlBd0xqRTROemMwTkNBd0xqTTVOalV6TnlBd0xqRTROemMwTkVnd0xqVTRPRFV6TjBNd0xqWTBNVFUxTnlBd0xqRTROemMwTkNBd0xqWTRORFV6TnlBd0xqSXpNRGN5TlNBd0xqWTRORFV6TnlBd0xqSTRNemMwTkZZd0xqVTNOamMyTmtNd0xqWTRNamc1TlNBd0xqVTNOamN4T1NBd0xqWTRNVEkwTmlBd0xqVTNOalk1TlNBd0xqWTNPVFU1TWlBd0xqVTNOalk1TlVNd0xqWTJORGN3TnlBd0xqVTNOalk1TlNBd0xqWTFNREkzTlNBd0xqVTNPRFl6T0NBd0xqWXpOalV6T0NBd0xqVTRNakk0TkZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzROREkxTnlBd0xqY3dOVGsyTjB3d0xqYzRNVEl6TlNBd0xqY3dORGc1TWt3d0xqYzFOVFk0TkNBd0xqWTFOams0TkVNd0xqYzBOVGt3TmlBd0xqWXpPRFkxSURBdU56STJPREU0SURBdU5qSTNNVGszSURBdU56QTJNRE01SURBdU5qSTNNVGszU0RBdU5qUXhOekEzUXpBdU5qRTNORGtnTUM0Mk1qY3hPVGNnTUM0MU9UVTVPRGtnTUM0Mk5ESTJPVFFnTUM0MU9EZ3pNeUF3TGpZMk5UWTJPVXd3TGpVM05qRTFNeUF3TGpjd01qSXdNa013TGpVMU5UWXpOQ0F3TGpjeE1EZzBNeUF3TGpVME1UYzBPQ0F3TGpjek1UQTNPU0F3TGpVME1UYzBPQ0F3TGpjMU5EQTFNVll3TGpjM09URXhNVU13TGpVME1UYzBPQ0F3TGpjNU5UQTROQ0F3TGpVMU1USTFOeUF3TGpnd09EZ3pOaUF3TGpVMk5Ea3lNaUF3TGpneE5UQXhOa013TGpVMk9EWXdOU0F3TGpnek5qRTNJREF1TlRnM01EVTNJREF1T0RVeU1qVTBJREF1TmpBNU1qWTFJREF1T0RVeU1qVTBRekF1TmpNd01qTTRJREF1T0RVeU1qVTBJREF1TmpRM09EWXhJREF1T0RNM09UQTVJREF1TmpVeU9EVTRJREF1T0RFNE5EazJTREF1TnpRMU56RTNRekF1TnpVd056RTBJREF1T0RNM09UQTVJREF1TnpZNE16TTNJREF1T0RVeU1qVTBJREF1TnpnNU16RWdNQzQ0TlRJeU5UUkRNQzQ0TVRFMU1Ua2dNQzQ0TlRJeU5UUWdNQzQ0TWprNU55QXdMamd6TmpFM0lEQXVPRE16TmpVeklEQXVPREUxTURFMlF6QXVPRFEzTXpFNElEQXVPREE0T0RNMklEQXVPRFUyT0RJM0lEQXVOemsxTURnMElEQXVPRFUyT0RJM0lEQXVOemM1TVRFeFZqQXVOemN4TkRnM1F6QXVPRFUyT0RJM0lEQXVOelEzTmpnMElEQXVPRFF4T0RRNElEQXVOekkyTkRVMklEQXVPREU1TkRJeUlEQXVOekU0TkRjNFREQXVOemcxTkRReUlEQXVOekEyTXpnNVZqQXVOekExT1RZM1NEQXVOemcwTWpVM1drMHdMall3T1RZNE1TQXdMalkzTWpjNE5rTXdMall4TkRJM05pQXdMalkxT1RBd01TQXdMall5TnpFM055QXdMalkwT1Rjd015QXdMalkwTVRjd055QXdMalkwT1Rjd00wZ3dMalkyTlRVeU9WWXdMamN3TlRrMk4wZ3dMalU1T0RZeU1Vd3dMall3T1RZNE1TQXdMalkzTWpjNE5scE5NQzQzTlRZek1ESWdNQzQzTURVNU5qZElNQzQyT0Rnd016VldNQzQyTkRrM01ETklNQzQzTURZd016bERNQzQzTVRnMU1EY2dNQzQyTkRrM01ETWdNQzQzTWprNU5Ua2dNQzQyTlRZMU56UWdNQzQzTXpVNE1qWWdNQzQyTmpjMU56Vk1NQzQzTlRZek1ESWdNQzQzTURVNU5qZGFUVEF1TlRnMk56VTVJREF1T0RBM01qUXpRekF1TlRnMk56VTVJREF1TnprME9ERXpJREF1TlRrMk9ETTFJREF1TnpnME56TTNJREF1TmpBNU1qWTFJREF1TnpnME56TTNRekF1TmpJeE5qazFJREF1TnpnME56TTNJREF1TmpNeE56Y3hJREF1TnprME9ERXpJREF1TmpNeE56Y3hJREF1T0RBM01qUXpRekF1TmpNeE56Y3hJREF1T0RFNU5qY3lJREF1TmpJeE5qazFJREF1T0RJNU56UTVJREF1TmpBNU1qWTFJREF1T0RJNU56UTVRekF1TlRrMk9ETTFJREF1T0RJNU56UTVJREF1TlRnMk56VTVJREF1T0RFNU5qY3lJREF1TlRnMk56VTVJREF1T0RBM01qUXpXazB3TGpjNE9UTXhJREF1TnpnME56TTNRekF1T0RBeE56UWdNQzQzT0RRM016Y2dNQzQ0TVRFNE1UWWdNQzQzT1RRNE1UTWdNQzQ0TVRFNE1UWWdNQzQ0TURjeU5ETkRNQzQ0TVRFNE1UWWdNQzQ0TVRrMk56SWdNQzQ0TURFM05DQXdMamd5T1RjME9TQXdMamM0T1RNeElEQXVPREk1TnpRNVF6QXVOemMyT0RneElEQXVPREk1TnpRNUlEQXVOelkyT0RBMElEQXVPREU1TmpjeUlEQXVOelkyT0RBMElEQXVPREEzTWpRelF6QXVOelkyT0RBMElEQXVOemswT0RFeklEQXVOemMyT0RneElEQXVOemcwTnpNM0lEQXVOemc1TXpFZ01DNDNPRFEzTXpkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnpZNElpQm9aV2xuYUhROUlqQXVOelk0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0eE1EZzJORE1nTUM0eE1qTTJOVGNwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtza2V0Y2g9MTsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyODkiIHk9IjE1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iV2ViIFNlcnZpY2UgLT4gQmFjay1lbmQgc2VydmVyIiBzdHlsZT0iaXIucmVmPWRmNzUzN2U2LTllZjQtNDBmNy1iZjQyLTM2ODBjMTVjNjY5OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIzIiBzb3VyY2U9IjciIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjciIHZhbHVlPSJXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj04ODg3MmNkOC04MWYwLTQ1MTgtYmI1OS1lM2VkNzhjNTZmMDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd055QXdMamcyTmpRM0lEQXVOVFk1TXpNMklEQXVPRGd6TXpZM1NEQXVNemcxTURFNVF6QXVNekl4TlRBM0lEQXVPRGd6TXpZM0lEQXVNamN3TURJZ01DNDRNekU0TnprZ01DNHlOekF3TWlBd0xqYzJPRE0yTjFZd0xqSXpNVFk1T1VNd0xqSTNNREF5SURBdU1UWTRNVGczSURBdU16SXhOVEEzSURBdU1URTJOams1SURBdU16ZzFNREU1SURBdU1URTJOams1U0RBdU5qRTFNREpETUM0Mk56ZzFNek1nTUM0eE1UWTJPVGtnTUM0M016QXdNaUF3TGpFMk9ERTROeUF3TGpjek1EQXlJREF1TWpNeE5qazVWakF1TmpJd05qQXhRekF1TnpJd05EVTVJREF1TmpFNE9EYzVJREF1TnpFd05qRXlJREF1TmpFM09UZ2dNQzQzTURBMU5UWWdNQzQyTVRjNU9FTXdMalk1TURrNU9TQXdMall4TnprNElEQXVOamd4TmpNeUlEQXVOakU0TnpreUlEQXVOamN5TlRJZ01DNDJNakF6TlRGYVRUQXVNelkxT0RVeklEQXVOakExTkRWRE1DNHpOalU0TlRNZ01DNDFPRGsxTnpFZ01DNHpOemczTWpVZ01DNDFOelkzSURBdU16azBOakF6SURBdU5UYzJOMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpVM05qY2dNQzQyTXpReE9EWWdNQzQxT0RrMU56RWdNQzQyTXpReE9EWWdNQzQyTURVME5VTXdMall6TkRFNE5pQXdMall5TVRNeU9DQXdMall5TVRNeE5DQXdMall6TkRJZ01DNDJNRFUwTXpZZ01DNDJNelF5U0RBdU16azBOakF6UXpBdU16YzROekkxSURBdU5qTTBNaUF3TGpNMk5UZzFNeUF3TGpZeU1UTXlPQ0F3TGpNMk5UZzFNeUF3TGpZd05UUTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJRekF1TnpJNE1qSTBJREF1T0Rjek1UWTVJREF1TnpFek5UZ3hJREF1T0RrNU5ETTBJREF1TmprNU1ESXlJREF1T0RrNU5ETTBRekF1TmpnME9UQXpJREF1T0RrNU5ETTBJREF1Tmpjd056QTNJREF1T0RjME56TTNJREF1TmpZek1Ua3pJREF1T0RNNE1EVTRUREF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJTREF1TmpZeU5UQTRXazB3TGpVNU16WTBOQ0F3TGpnek5EVTROa3d3TGpZME5EUXlPQ0F3TGpnek5EVTRORU13TGpZME9EY3pNU0F3TGpnMU9URTBNeUF3TGpZMU5qQXlNeUF3TGpnNE1EQXpOeUF3TGpZMk5UVTJOeUF3TGpnNU5EWTJRekF1TmpNMU16TTVJREF1T0RnMU56TXlJREF1TmpFd01UY3pJREF1T0RZMU1ETTFJREF1TlRrMU16Y2dNQzQ0TXpjNE56Wk1NQzQxT1RNMk5EUWdNQzQ0TXpRMU9EWmFUVEF1TnpVek5qRTFJREF1T0RNME5UZzBUREF1T0RBME16azVJREF1T0RNME5UZzJRekF1TnpnNU9EYzJJREF1T0RZek16WWdNQzQzTmpNNU1UUWdNQzQ0T0RVek56VWdNQzQzTXpJME9EZ2dNQzQ0T1RRMk5UVkRNQzQzTkRFek9EZ2dNQzQ0T0RFd01ERWdNQzQzTkRnek16SWdNQzQ0TmpFNE9UUWdNQzQzTlRJM01UVWdNQzQ0TXprME5EVk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUk1NQzQ0TURRek9Ua2dNQzQ0TXpRMU9EWk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUmFUVEF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhRekF1T0RFMk1UYzJJREF1TnpZMU5UTTBJREF1T0RFMk9UZzVJREF1Tnpjek5ESTBJREF1T0RFMk9UZzVJREF1TnpneE5UQTBRekF1T0RFMk9UZzVJREF1Tnprek9ETXpJREF1T0RFMU1EazNJREF1T0RBMU56SXhJREF1T0RFeE5UZzVJREF1T0RFMk9Ea3pTREF1TnpVMk1USXlRekF1TnpVM016WTBJREF1T0RBMU5UazRJREF1TnpVNE1ERTBJREF1Tnprek56TXlJREF1TnpVNE1ERTBJREF1TnpneE5UQTBRekF1TnpVNE1ERTBJREF1TnpjMk1UUTJJREF1TnpVM09EZzVJREF1Tnpjd09EVTJJREF1TnpVM05qUTBJREF1TnpZMU5qVTBUREF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhUREF1TnpVM01UZzRJREF1TnpVM09URTRXazB3TGpVNE16UXhOQ0F3TGpjMU56a3hNVXd3TGpZME1EZzFOaUF3TGpjMU56a3hPRU13TGpZME1ETXhJREF1TnpZMU5UZzBJREF1TmpRd01ESTVJREF1Tnpjek5EWTJJREF1TmpRd01ESTVJREF1TnpneE5UQTBRekF1TmpRd01ESTVJREF1TnpreE1qZzJJREF1TmpRd05EUTJJREF1T0RBd09ETTNJREF1TmpReE1qUTRJREF1T0RFd01EUTVUREF1TmpReE9USXlJREF1T0RFMk9Ea3pTREF1TlRnMk5EVTFRekF1TlRneU9UUTJJREF1T0RBMU56SXhJREF1TlRneE1EVTFJREF1Tnprek9ETXpJREF1TlRneE1EVTFJREF1TnpneE5UQTBRekF1TlRneE1EVTFJREF1Tnpjek5ESTBJREF1TlRneE9EWTNJREF1TnpZMU5UTTBJREF1TlRnek5ERTBJREF1TnpVM09URXhXazB3TGpZMU9EWXpJREF1TnpVM09URXlTREF1TnpNNU5ERXpRekF1TnpRd01EQTJJREF1TnpZMU5USTNJREF1TnpRd016SXlJREF1Tnpjek5ERTJJREF1TnpRd016SXlJREF1TnpneE5UQTBRekF1TnpRd016SXlJREF1TnpreE16ZzBJREF1TnpNNU9EVXhJREF1T0RBd09UWTJJREF1TnpNNE9UYzVJREF1T0RFd01URTFUREF1TnpNNE1qVXlJREF1T0RFMk9Ea3pTREF1TmpVNU56a3hRekF1TmpVNE5EVTRJREF1T0RBMU56TTRJREF1TmpVM056SXhJREF1Tnprek9EVTBJREF1TmpVM056SXhJREF1TnpneE5UQTBRekF1TmpVM056SXhJREF1TnpjMU5ETTRJREF1TmpVM09EazVJREF1TnpZNU5EZzBJREF1TmpVNE1qTTRJREF1TnpZek5qY3pUREF1TmpVNE5qTWdNQzQzTlRjNU1USklNQzQzTXprME1UTklNQzQyTlRnMk0xcE5NQzQzTXpNM05Ea2dNQzQyTnpBek5UaE1NQzQzTXpJME56Y2dNQzQyTmpnek5VTXdMamMyT0RBM055QXdMalkzT0RnMU9TQXdMamM1TmpZMk9DQXdMamN3TlRjeElEQXVPREE1TlRZeUlEQXVOelF3TWpFNVREQXVOelUxTkRFMElEQXVOelF3TWpJeVF6QXVOelV4TmpreUlEQXVOekV4TnpFMUlEQXVOelEwTVRNeUlEQXVOamczTWpNeklEQXVOek16TnpRNUlEQXVOamN3TXpVNFREQXVOek15TkRjM0lEQXVOalk0TXpWTU1DNDNNek0zTkRrZ01DNDJOekF6TlRoYVRUQXVOalkwTVRNZ01DNDJOamczT0RSTU1DNDJOalUxTmpZZ01DNDJOamd6TlVNd0xqWTFOVEUzT0NBd0xqWTROREkyTnlBd0xqWTBOelExTnlBd0xqY3dOell4TmlBd0xqWTBNek0xTmlBd0xqY3pOVEF6TkV3d0xqWTBNall6SURBdU56UXdNakl5VERBdU5UZzRORGd4SURBdU56UXdNakU1UXpBdU5qQXhNakF4SURBdU56QTJNVGMySURBdU5qSTVNVGs0SURBdU5qYzVOVGcwSURBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVXd3TGpZMk5ERXpJREF1TmpZNE56ZzBXazB3TGpZNU9UQXlNaUF3TGpZMk16VTNORU13TGpjeE5EVTNOeUF3TGpZMk16VTNOQ0F3TGpjek1ESXlOaUF3TGpZNU16VTFNeUF3TGpjek5qa3pJREF1TnpNMk5UQTJUREF1TnpNM05EZ3pJREF1TnpRd01qRTVTREF1TmpZd05UWXhRekF1TmpZMk9USXpJREF1TmprMU1qa3hJREF1Tmpnek1ESXlJREF1TmpZek5UYzBJREF1TmprNU1ESXlJREF1TmpZek5UYzBXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU1pSWdhR1ZwWjJoMFBTSXdMamt5SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05EQXdNemt4SURBdU1EUXdNRE01TVNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYzIiB5PSIyNzIiIHdpZHRoPSI2OCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJJbnRlcm5hbCBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9NzBmYmI0M2MtODUzOC00ZDJjLTlkYWMtMTdlMWExNzNkODgyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWludGVybmFsLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE15QXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE15QXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak01TkRZd015QXdMalk1TVRVM09FTXdMak0zT0RjeU5TQXdMalk1TVRVM09DQXdMak0yTlRnMU15QXdMamN3TkRRMUlEQXVNelkxT0RVeklEQXVOekl3TXpJNFF6QXVNelkxT0RVeklEQXVOek0yTWpBMklEQXVNemM0TnpJMUlEQXVOelE1TURjNElEQXVNemswTmpBeklEQXVOelE1TURjNFNEQXVOVGN3TURFNVZqQXVOamt4TlRjNFNEQXVNemswTmpBeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak13TWpFNElEQXVOakU1T1RFeFNEQXVOakF3TURFNVF6QXVOVGc1TWpZeklEQXVOakU1T1RFeElEQXVOVGM1T0RJNUlEQXVOakkxTlRjeUlEQXVOVGMwTlRNeklEQXVOak0wTURjNFNEQXVNemswTmpBelF6QXVNemM0TnpJMUlEQXVOak0wTURjNElEQXVNelkxT0RVeklEQXVOakl4TWpBMklEQXVNelkxT0RVeklEQXVOakExTXpJNFF6QXVNelkxT0RVeklEQXVOVGc1TkRVZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTlNBd0xqWXpOREU0TmlBd0xqWXdOVE15T0VNd0xqWXpOREU0TmlBd0xqWXhNRFkxTVNBd0xqWXpNamMwSURBdU5qRTFOak0ySURBdU5qTXdNakU0SURBdU5qRTVPVEV4V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qY3lOVEU1SURBdU5qRTVPVEV4VmpBdU1qTXhOVGMzUXpBdU5qY3lOVEU1SURBdU1UazVPREl4SURBdU5qUTJOemMySURBdU1UYzBNRGMzSURBdU5qRTFNREU1SURBdU1UYzBNRGMzU0RBdU16ZzFNREpETUM0ek5UTXlOak1nTUM0eE56UXdOemNnTUM0ek1qYzFNaUF3TGpFNU9UZ3lNU0F3TGpNeU56VXlJREF1TWpNeE5UYzNWakF1TnpZNE1qUTFRekF1TXpJM05USWdNQzQ0TURBd01ERWdNQzR6TlRNeU5qTWdNQzQ0TWpVM05EVWdNQzR6T0RVd01pQXdMamd5TlRjME5VZ3dMalUzTURBeE9WWXdMamc0TXpJME5VZ3dMak00TlRBeVF6QXVNekl4TlRBM0lEQXVPRGd6TWpRMUlEQXVNamN3TURJZ01DNDRNekUzTlRjZ01DNHlOekF3TWlBd0xqYzJPREkwTlZZd0xqSXpNVFUzTjBNd0xqSTNNREF5SURBdU1UWTRNRFkwSURBdU16SXhOVEEzSURBdU1URTJOVGMzSURBdU16ZzFNRElnTUM0eE1UWTFOemRJTUM0Mk1UVXdNVGxETUM0Mk56ZzFNeklnTUM0eE1UWTFOemNnTUM0M016QXdNVGtnTUM0eE5qZ3dOalFnTUM0M016QXdNVGtnTUM0eU16RTFOemRXTUM0Mk1UazVNVEZJTUM0Mk56STFNVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16TTBNekVnTUM0Mk5UQXdNalJETUM0Mk1UVXdNakVnTUM0Mk5UQXdNalFnTUM0Mk1EQXdPVGdnTUM0Mk5qUTFOelVnTUM0Mk1EQXdPVGdnTUM0Mk9ESTFNalJXTUM0NE9Ua3hPVEZETUM0Mk1EQXdPVGdnTUM0NU1EVXhOelFnTUM0Mk1EVXdOeklnTUM0NU1UQXdNalFnTUM0Mk1URXlNRGtnTUM0NU1UQXdNalJJTUM0Mk5EUTFOREpXTUM0NE5UVTROVGhETUM0Mk5EUTFORElnTUM0NE5EazROelVnTUM0Mk5EazFNVFlnTUM0NE5EVXdNalFnTUM0Mk5UVTJOVE1nTUM0NE5EVXdNalJJTUM0M05EUTFOREZETUM0M05UQTJOemNnTUM0NE5EVXdNalFnTUM0M05UVTJOVElnTUM0NE5EazROelVnTUM0M05UVTJOVElnTUM0NE5UVTROVGhXTUM0NU1UQXdNalJJTUM0M09EZzVPRFZETUM0M09UVXhNakVnTUM0NU1UQXdNalFnTUM0NE1EQXdPVFlnTUM0NU1EVXhOelFnTUM0NE1EQXdPVFlnTUM0NE9Ua3hPVEZXTUM0M09UQTROVGhETUM0NE1EQXdPVFlnTUM0M056STVNRGtnTUM0M09EVXhOeklnTUM0M05UZ3pOVGdnTUM0M05qWTNOak1nTUM0M05UZ3pOVGhJTUM0M05UVTJOVEpXTUM0Mk9ESTFNalJETUM0M05UVTJOVElnTUM0Mk5qUTFOelVnTUM0M05EQTNNamdnTUM0Mk5UQXdNalFnTUM0M01qSXpNVGtnTUM0Mk5UQXdNalJJTUM0Mk16TTBNekZhVFRBdU5qWTJOelkwSURBdU56QTBNVGt4UXpBdU5qWTJOelkwSURBdU56RXdNVGMwSURBdU5qWXhOemc1SURBdU56RTFNREkwSURBdU5qVTFOalV6SURBdU56RTFNREkwUXpBdU5qUTVOVEUySURBdU56RTFNREkwSURBdU5qUTBOVFF5SURBdU56RXdNVGMwSURBdU5qUTBOVFF5SURBdU56QTBNVGt4UXpBdU5qUTBOVFF5SURBdU5qazRNakE0SURBdU5qUTVOVEUySURBdU5qa3pNelU0SURBdU5qVTFOalV6SURBdU5qa3pNelU0UXpBdU5qWXhOemc1SURBdU5qa3pNelU0SURBdU5qWTJOelkwSURBdU5qazRNakE0SURBdU5qWTJOelkwSURBdU56QTBNVGt4V2swd0xqWTJOamMyTkNBd0xqYzFPRE0xT0VNd0xqWTJOamMyTkNBd0xqYzJORE0wTVNBd0xqWTJNVGM0T1NBd0xqYzJPVEU1TVNBd0xqWTFOVFkxTXlBd0xqYzJPVEU1TVVNd0xqWTBPVFV4TmlBd0xqYzJPVEU1TVNBd0xqWTBORFUwTWlBd0xqYzJORE0wTVNBd0xqWTBORFUwTWlBd0xqYzFPRE0xT0VNd0xqWTBORFUwTWlBd0xqYzFNak0zTlNBd0xqWTBPVFV4TmlBd0xqYzBOelV5TkNBd0xqWTFOVFkxTXlBd0xqYzBOelV5TkVNd0xqWTJNVGM0T1NBd0xqYzBOelV5TkNBd0xqWTJOamMyTkNBd0xqYzFNak0zTlNBd0xqWTJOamMyTkNBd0xqYzFPRE0xT0ZwTk1DNDJOalkzTmpRZ01DNDRNVEkxTWpSRE1DNDJOalkzTmpRZ01DNDRNVGcxTURnZ01DNDJOakUzT0RrZ01DNDRNak16TlRnZ01DNDJOVFUyTlRNZ01DNDRNak16TlRoRE1DNDJORGsxTVRZZ01DNDRNak16TlRnZ01DNDJORFExTkRJZ01DNDRNVGcxTURnZ01DNDJORFExTkRJZ01DNDRNVEkxTWpSRE1DNDJORFExTkRJZ01DNDRNRFkxTkRFZ01DNDJORGsxTVRZZ01DNDRNREUyT1RFZ01DNDJOVFUyTlRNZ01DNDRNREUyT1RGRE1DNDJOakUzT0RrZ01DNDRNREUyT1RFZ01DNDJOalkzTmpRZ01DNDRNRFkxTkRFZ01DNDJOalkzTmpRZ01DNDRNVEkxTWpSYVRUQXVOekV4TWpBNElEQXVOekEwTVRreFF6QXVOekV4TWpBNElEQXVOekV3TVRjMElEQXVOekEyTWpNeklEQXVOekUxTURJMElEQXVOekF3TURrM0lEQXVOekUxTURJMFF6QXVOamt6T1RZZ01DNDNNVFV3TWpRZ01DNDJPRGc1T0RZZ01DNDNNVEF4TnpRZ01DNDJPRGc1T0RZZ01DNDNNRFF4T1RGRE1DNDJPRGc1T0RZZ01DNDJPVGd5TURnZ01DNDJPVE01TmlBd0xqWTVNek0xT0NBd0xqY3dNREE1TnlBd0xqWTVNek0xT0VNd0xqY3dOakl6TXlBd0xqWTVNek0xT0NBd0xqY3hNVEl3T0NBd0xqWTVPREl3T0NBd0xqY3hNVEl3T0NBd0xqY3dOREU1TVZwTk1DNDNNVEV5TURnZ01DNDNOVGd6TlRoRE1DNDNNVEV5TURnZ01DNDNOalF6TkRFZ01DNDNNRFl5TXpNZ01DNDNOamt4T1RFZ01DNDNNREF3T1RjZ01DNDNOamt4T1RGRE1DNDJPVE01TmlBd0xqYzJPVEU1TVNBd0xqWTRPRGs0TmlBd0xqYzJORE0wTVNBd0xqWTRPRGs0TmlBd0xqYzFPRE0xT0VNd0xqWTRPRGs0TmlBd0xqYzFNak0zTlNBd0xqWTVNemsySURBdU56UTNOVEkwSURBdU56QXdNRGszSURBdU56UTNOVEkwUXpBdU56QTJNak16SURBdU56UTNOVEkwSURBdU56RXhNakE0SURBdU56VXlNemMxSURBdU56RXhNakE0SURBdU56VTRNelU0V2swd0xqY3hNVEl3T0NBd0xqZ3hNalV5TkVNd0xqY3hNVEl3T0NBd0xqZ3hPRFV3T0NBd0xqY3dOakl6TXlBd0xqZ3lNek0xT0NBd0xqY3dNREE1TnlBd0xqZ3lNek0xT0VNd0xqWTVNemsySURBdU9ESXpNelU0SURBdU5qZzRPVGcySURBdU9ERTROVEE0SURBdU5qZzRPVGcySURBdU9ERXlOVEkwUXpBdU5qZzRPVGcySURBdU9EQTJOVFF4SURBdU5qa3pPVFlnTUM0NE1ERTJPVEVnTUM0M01EQXdPVGNnTUM0NE1ERTJPVEZETUM0M01EWXlNek1nTUM0NE1ERTJPVEVnTUM0M01URXlNRGdnTUM0NE1EWTFOREVnTUM0M01URXlNRGdnTUM0NE1USTFNalJhVFRBdU56VTFOalV5SURBdU9ERXlOVEkwUXpBdU56VTFOalV5SURBdU9ERTROVEE0SURBdU56VXdOamMzSURBdU9ESXpNelU0SURBdU56UTBOVFF4SURBdU9ESXpNelU0UXpBdU56TTROREEwSURBdU9ESXpNelU0SURBdU56TXpORE1nTUM0NE1UZzFNRGdnTUM0M016TTBNeUF3TGpneE1qVXlORU13TGpjek16UXpJREF1T0RBMk5UUXhJREF1TnpNNE5EQTBJREF1T0RBeE5qa3hJREF1TnpRME5UUXhJREF1T0RBeE5qa3hRekF1TnpVd05qYzNJREF1T0RBeE5qa3hJREF1TnpVMU5qVXlJREF1T0RBMk5UUXhJREF1TnpVMU5qVXlJREF1T0RFeU5USTBXazB3TGpjek16UXpJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TnpFeE1qWTBWakF1T1RFd01ESTBTREF1TnpNek5ETmFUVEF1TmpnNU1EUXlJREF1T1RFd01ESTBWakF1T0RZMk5qa3hTREF1TmpZMk56WTBWakF1T1RFd01ESTBTREF1TmpnNU1EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqa3lJaUJvWldsbmFIUTlJakF1T1RJaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqQTBNREF6T1RFZ01DNHdOREF3TXpreEtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEyNiIgeT0iMjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyMSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC4yNjU7ZW50cnlZPTAuMTI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzaGFkb3c9MDtsYWJlbEJhY2tncm91bmRDb2xvcj1ub25lO2xhYmVsQm9yZGVyQ29sb3I9bm9uZTtmb250Q29sb3I9I0ZGRkZGRjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtzdHJva2VXaWR0aD0yO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jYjlkMGU2OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijk5IiB0YXJnZXQ9IjciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHg9Ii0wLjExMDgiIHk9IjEzIiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCBhcz0ib2Zmc2V0Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iIiBzdHlsZT0iZm9udENvbG9yPSM0NjQ5NUQ7dmVydGljYWxBbGlnbj10b3A7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbFBvc2l0aW9uPWNlbnRlcjthbGlnbj1jZW50ZXI7aHRtbD0xO291dGxpbmVDb25uZWN0PTA7ZmlsbENvbG9yPSNCMkM5QUI7c3Ryb2tlQ29sb3I9Izc4OEFBMztncmFkaWVudERpcmVjdGlvbj1ub3J0aDtzdHJva2VXaWR0aD0yO3NoYXBlPW14Z3JhcGgubmV0d29ya3MuZmlyZXdhbGw7c2tldGNoPTE7cm91bmRlZD0xOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ3IiB5PSIyOSIgd2lkdGg9Ijg3IiBoZWlnaHQ9IjgzIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzAwNkVBRjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9IzFiYTFlMjsiIHBhcmVudD0iMyIgc291cmNlPSI5NyIgdGFyZ2V0PSIxOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ0IiB2YWx1ZT0iTERBUCBEaXJlY3RvcnkiIHN0eWxlPSJpci5yZWY9NDI1YWI0ZjAtMzBhMi00MWJjLWJjZWYtODk0MDJmNWEyY2I1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWxkYXAtZGlyZWN0b3J5O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqTXhNak01TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVOamczT1RJeElEQXVNRGM1T1RVMk1TQXdMamcwTURFMU5pQXdMakUxTlRFek5pQXdMamcwTURFMU5pQXdMakkwTnprMU5sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalEwTlRFME15QXdMamMwTVRFelF6QXVORFF3TURJeklEQXVOelF6TmpZeklEQXVORE0wTURVZ01DNDNORFEyTWpNZ01DNDBNamN6TlRZZ01DNDNORFF3TXpaRE1DNDBNakExTVRJZ01DNDNORE16TWpVZ01DNDBNVE0zTWpFZ01DNDNOREkxTnlBd0xqUXdOams0TXlBd0xqYzBNVGMzUXpBdU5EQTNOREVnTUM0M016TTFOVFlnTUM0ME1EYzNOalVnTUM0M01qVTBOREVnTUM0ME1EZ3dOU0F3TGpjeE56UXlNME13TGpRd09ESTBOU0F3TGpjd09UWXhPU0F3TGpRd09ETTNPQ0F3TGpjd01Ua3dNeUF3TGpRd09EUTFJREF1TmprME1qYzJRekF1TkRBNE5ERTBJREF1TmpnMk9ESTNJREF1TkRBNE16UXpJREF1TmpjNU5EWTNJREF1TkRBNE1qTTJJREF1TmpjeU1UazJRekF1TkRBNE1EUXhJREF1TmpZMU1EZzFJREF1TkRBM09ERWdNQzQyTlRnd05EVWdNQzQwTURjMU5ETWdNQzQyTlRFd056WkRNQzQwTVRRMU1USWdNQzQyTlRJeU5qY2dNQzQwTWpFMU1EY2dNQzQyTlRNME1qTWdNQzQwTWpnMU15QXdMalkxTkRVME0wTXdMalF6TXprNU5pQXdMalkxTlRNM0lEQXVORE00T1RBeklEQXVOalUzTURVZ01DNDBORE14T1RZZ01DNDJOVGsxT0RORE1DNDBORGMxTVRZZ01DNDJOakl4TVRZZ01DNDBOVEV5TlNBd0xqWTJOVFV3TXlBd0xqUTFORE0zSURBdU5qWTVOemsyUXpBdU5EVTNORGtnTUM0Mk56UXdNellnTUM0ME5UazVORE1nTUM0Mk56ZzJNak1nTUM0ME5qRTJOU0F3TGpZNE16WXpOa013TGpRMk16TTFOaUF3TGpZNE9EY3dNeUF3TGpRMk5ETXhOaUF3TGpZNU5ESXlNeUF3TGpRMk5EVTFOaUF3TGpjd01ESXlNME13TGpRMk5EY3hOaUF3TGpjd05UWTVJREF1TkRZME1qRWdNQzQzTVRBNU5ETWdNQzQwTmpJNU9ETWdNQzQzTVRVNU9ETkRNQzQwTmpFNE16WWdNQzQzTWpFeE1ETWdNQzQwTlRrNE5qTWdNQzQzTWpVNU5UWWdNQzQwTlRjd016WWdNQzQzTXpBMU4wTXdMalExTkRNeE5pQXdMamN6TlRFd015QXdMalExTURNeE5pQXdMamN6T0RZeU15QXdMalEwTlRFME15QXdMamMwTVRFeldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFk1TURrZ01DNDJPVFl5TlVNd0xqVTNNVE00TXlBd0xqY3dNalF3TVNBd0xqVTNNelkyTnlBd0xqY3dPRFkxSURBdU5UYzFPVFF6SURBdU56RTBPVGsyUXpBdU5UWTVPREkzSURBdU56RTFOVFkxSURBdU5UWXpOamswSURBdU56RTJNRGs1SURBdU5UVTNOVFF6SURBdU56RTJOVGsyUXpBdU5UVXhNemt5SURBdU56RTJPVGczSURBdU5UUTFNak15SURBdU56RTNNelV5SURBdU5UTTVNRFl6SURBdU56RTNOamxETUM0MU5ERXpNakVnTUM0M01URXdNRFVnTUM0MU5ETTJNVFFnTUM0M01EUTBNVGtnTUM0MU5EVTVORE1nTUM0Mk9UYzVNME13TGpVME9ETXlOU0F3TGpZNU1UWXhPU0F3TGpVMU1EYzBNeUF3TGpZNE5UUXdOU0F3TGpVMU16RTVOaUF3TGpZM09USTVRekF1TlRVMU1Ea2dNQzQyTnpRME9TQXdMalUxTmpZeElEQXVOamN3TlRReklEQXVOVFUzTmpVZ01DNDJOamN6TVRaRE1DNDFOVGcyT1NBd0xqWTNNRGd4SURBdU5UWXdNVFUySURBdU5qYzBOVGNnTUM0MU5qSXdNak1nTUM0Mk56ZzJNak5ETUM0MU5qUXpPRGNnTUM0Mk9EUTBNREVnTUM0MU5qWTNORE1nTUM0Mk9UQXlOellnTUM0MU5qa3dPU0F3TGpZNU5qSTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBeE5ETTJJREF1TmpZeE5qbERNQzQyT1RnMk16WWdNQzQyTmpZMU55QXdMalk1TkRJek5pQXdMalkyT1RneU15QXdMalk0T0RJMk15QXdMalkzTVRRM05rTXdMalk0TXpFNU5pQXdMalkzTWpnMk15QXdMalkzT0RFeU1TQXdMalkzTkRJeU15QXdMalkzTXpBek5pQXdMalkzTlRVMU5rTXdMalkyTnpnNU9DQXdMalkzTmpnM01pQXdMalkyTWpjME15QXdMalkzT0RFMk1TQXdMalkxTnpVM0lEQXVOamM1TkRJelF6QXVOalUzT0RFNElEQXVOamN6TVRZMUlEQXVOalU0TVRBeklEQXVOalkyT1RjNUlEQXVOalU0TkRJeklEQXVOall3T0RZelF6QXVOalU0T0RVZ01DNDJOVFE1TWpVZ01DNDJOVGt6TXprZ01DNDJORGt3TmpjZ01DNDJOVGs0T1NBd0xqWTBNekk1UXpBdU5qWTBPRE15SURBdU5qUXhPRE15SURBdU5qWTVOelEzSURBdU5qUXdNek01SURBdU5qYzBOak0ySURBdU5qTTRPREZETUM0Mk56azBOVFFnTUM0Mk16Y3hPVElnTUM0Mk9EUXlOVFFnTUM0Mk16VTFNeUF3TGpZNE9UQXpOaUF3TGpZek16Z3lNME13TGpZNU5UQXpOaUF3TGpZek1UVTFOaUF3TGpZNU9URTNJREF1TmpNeE56RTJJREF1TnpBeE5UY2dNQzQyTXpRME1VTXdMamN3TkRFd015QXdMall6TnpBM05pQXdMamN3TlRNMU5pQXdMalkwTURnNUlEQXVOekExTXpneklEQXVOalExT1RnelF6QXVOekExTkRZeklEQXVOalV4TkRVZ01DNDNNRFF4T0RNZ01DNDJOVFkzTlRZZ01DNDNNREUwTXpZZ01DNDJOakUyT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESkRNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR4TmpBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQ0TkRBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TWprd09UQXpJREF1TnpJME9UZERNQzR5T1RBMk5UUWdNQzQzTWpreE15QXdMakk1TURRd05TQXdMamN6TXpJME5TQXdMakk1TURFMU5pQXdMamN6TnpNeE5rTXdMakk1TmpJNUlEQXVOek00TlRBM0lEQXVNekF5TkRVZ01DNDNNems0TkRFZ01DNHpNRGcyTXpZZ01DNDNOREV6TVRaRE1DNHpNVFE0TkRFZ01DNDNOREk1T0RjZ01DNHpNakV3TkRVZ01DNDNORFEzTXlBd0xqTXlOekkxSURBdU56UTJOVFF6UXpBdU16TXpORGtnTUM0M05EZzBNU0F3TGpNek9UYzBOeUF3TGpjMU1ETXdNeUF3TGpNME5qQXlNeUF3TGpjMU1qSXlNME13TGpNMU1qTXpOQ0F3TGpjMU5ERTBNeUF3TGpNMU9EWTRNU0F3TGpjMU5qQTBOU0F3TGpNMk5UQTJNeUF3TGpjMU56a3pRekF1TXpZMU56YzBJREF1TnpRNU9URXlJREF1TXpZMk5ETXlJREF1TnpReE9UZ3pJREF1TXpZM01ETTJJREF1TnpNME1UUXpRekF1TXpZeU1qQXhJREF1TnpNek1EUXhJREF1TXpVM05EQXhJREF1TnpNeE9UTWdNQzR6TlRJMk16WWdNQzQzTXpBNE1VTXdMak0wTnpnNUlEQXVOekk1TnpBM0lEQXVNelF6TVRZeElEQXVOekk0TmpBMUlEQXVNek00TkRVZ01DNDNNamMxTURORE1DNHpNek0zTnpRZ01DNDNNalkwTlRRZ01DNHpNamt3T1RnZ01DNDNNalUwTkRFZ01DNHpNalEwTWpNZ01DNDNNalEwTmpORE1DNHpNVGszT0RNZ01DNDNNak0xT1RJZ01DNHpNVFV4TlRJZ01DNDNNakkzT1RJZ01DNHpNVEExTXlBd0xqY3lNakEyTTBNd0xqTXhNRGcyTnlBd0xqY3hNelEzTmlBd0xqTXhNVEUyTVNBd0xqY3dORFkwTVNBd0xqTXhNVFF4SURBdU5qazFOVFUyUXpBdU16RXhOVE0wSURBdU5qZzJNREkzSURBdU16RXhOak15SURBdU5qYzJNelEzSURBdU16RXhOekF6SURBdU5qWTJOVEUyUXpBdU16RXhOekF6SURBdU5qVTJOalVnTUM0ek1URTJPRFVnTUM0Mk5EWTROeklnTUM0ek1URTJOU0F3TGpZek56RTRNME13TGpNeE1UVTVOaUF3TGpZeU56YzNPU0F3TGpNeE1UVXlOU0F3TGpZeE9EVXlOU0F3TGpNeE1UUXpOaUF3TGpZd09UUXlNME13TGpNd05EYzFNaUF3TGpZd056WXlOeUF3TGpJNU9EQTNOaUF3TGpZd05UZ3dOU0F3TGpJNU1UUXhJREF1TmpBek9UVTJUREF1TWpreE5EWXpJREF1TmpJd016Tk1NQzR5T1RFMU55QXdMall6TnprNE0wTXdMakk1TVRZd05TQXdMalkwTkRJME1TQXdMakk1TVRZMUlEQXVOalV3TmpBMUlEQXVNamt4TnpBeklEQXVOalUzTURjMlF6QXVNamt4TnpNNElEQXVOall6TmpFNUlEQXVNamt4TnpZMUlEQXVOamN3TVRJMUlEQXVNamt4TnpneklEQXVOamMyTlRrMlF6QXVNamt4T0RBeElEQXVOamd5T0RjeUlEQXVNamt4TnpreUlEQXVOamc1TURBMUlEQXVNamt4TnpVMklEQXVOamswT1RrMlF6QXVNamt4TmpnMUlEQXVOekF3TmpNeUlEQXVNamt4TlRrMklEQXVOekEyTURRMUlEQXVNamt4TkRrZ01DNDNNVEV5TXpaRE1DNHlPVEV6TVRJZ01DNDNNVFl3TURFZ01DNHlPVEV4TVRZZ01DNDNNakExTnprZ01DNHlPVEE1TURNZ01DNDNNalE1TjFwTk1DNDBNRFEwTnpZZ01DNDJNekUwTlVNd0xqTTVPREk1SURBdU5qTXdNakExSURBdU16a3lNVE1nTUM0Mk1qZzVNalVnTUM0ek9EVTVPVFlnTUM0Mk1qYzJNVU13TGpNNE5qSTBOU0F3TGpZek1qWTBNU0F3TGpNNE5qUTJOeUF3TGpZek56WTVJREF1TXpnMk5qWXpJREF1TmpReU56VTJRekF1TXpnMk9EUXhJREF1TmpRM09UTWdNQzR6T0RZNU9USWdNQzQyTlRNeE16a2dNQzR6T0RjeE1UWWdNQzQyTlRnek9ETkRNQzR6T0RjeU1EVWdNQzQyTmpNMk9Ua2dNQzR6T0RjeU56WWdNQzQyTmprd05Ua2dNQzR6T0Rjek15QXdMalkzTkRRMk0wTXdMak00TnpNeklEQXVOamM1T1RNNUlEQXVNemczTXpFeUlEQXVOamcxTkRVZ01DNHpPRGN5TnpZZ01DNDJPVEE1T1RaRE1DNHpPRGN4TnlBd0xqWTVOall6TWlBd0xqTTROekF6TmlBd0xqY3dNak13TXlBd0xqTTROamczTmlBd0xqY3dPREF4UXpBdU16ZzJOall6SURBdU56RXpPREExSURBdU16ZzJOREExSURBdU56RTVOalUwSURBdU16ZzJNVEF6SURBdU56STFOVFUyUXpBdU16ZzFOelEzSURBdU56TXhOVFEzSURBdU16ZzFNek00SURBdU56TTNOVGt5SURBdU16ZzBPRGMySURBdU56UXpOamxETUM0ek9EUXpORE1nTUM0M05EazVNVElnTUM0ek9ETTNORGNnTUM0M05UWXlNRFVnTUM0ek9ETXdPU0F3TGpjMk1qVTNRekF1TXpnNU5EVTBJREF1TnpZek56azJJREF1TXprMU9USTFJREF1TnpZME9Ea2dNQzQwTURJMU1ETWdNQzQzTmpVNE5VTXdMalF3T1RJMU9DQXdMamMyTmpVNU5pQXdMalF4TmpBM05pQXdMamMyTnpJMk15QXdMalF5TWprMU5pQXdMamMyTnpnMVF6QXVORE15TmpZeklEQXVOelk0TlRReklEQXVORFF4TkRZeklEQXVOelkzTlRneklEQXVORFE1TXpBeklEQXVOelkxTURjMlF6QXVORFUzTVRrMklEQXVOell5TlRFMklEQXVORFl6TlRjZ01DNDNOVGc1T1RZZ01DNDBOamcwTWpNZ01DNDNOVFEwT1VNd0xqUTNNekU1TmlBd0xqYzBPVGd5TXlBd0xqUTNOekE1SURBdU56UTBORE0ySURBdU5EZ3dNRGMySURBdU56TTRNek5ETUM0ME9ETXhORE1nTUM0M016SXhORE1nTUM0ME9EVXhOeUF3TGpjeU5UazFOaUF3TGpRNE5qSXhJREF1TnpFNU56ZERNQzQwT0Rjek15QXdMamN4TXpZNUlEQXVORGczTnpneklEQXVOekEzTlRVMklEQXVORGczTlRFMklEQXVOekF4TkRJelF6QXVORGczTVRrMklEQXVOamswT0RrZ01DNDBPRFl4TXlBd0xqWTRPRGM0TXlBd0xqUTRORE14TmlBd0xqWTRNekExUXpBdU5EZ3lOVGd6SURBdU5qYzNNamtnTUM0ME56azVNVFlnTUM0Mk56RTROU0F3TGpRM05qTTBNeUF3TGpZMk5qY3dNME13TGpRM01qZzNOaUF3TGpZMk1UVXdNeUF3TGpRMk9EWXpOaUF3TGpZMU5qZzVJREF1TkRZek56VTJJREF1TmpVeU9EWXpRekF1TkRVNE9EYzJJREF1TmpRNE9ERWdNQzQwTlRJNU5UWWdNQzQyTkRVeU1TQXdMalEwTlRrME15QXdMalkwTWpBek5rTXdMalF6T0RrNE15QXdMall6T0RneElEQXVORE14TkRFZ01DNDJNelkwTXpZZ01DNDBNak14TkRNZ01DNDJNelE1TjBNd0xqUXhOamt3TXlBd0xqWXpNemd4TkNBd0xqUXhNRFk0TVNBd0xqWXpNalkwTVNBd0xqUXdORFEzTmlBd0xqWXpNVFExV2swd0xqVTROekUwTXlBd0xqYzFNRFU1TmtNd0xqVTRPRFl4T0NBd0xqYzFOVGMzSURBdU5Ua3dNRGcxSURBdU56WXdPVGczSURBdU5Ua3hOVFF6SURBdU56WTJNalZETUM0MU9UZzRPRFVnTUM0M05qVXpOemtnTUM0Mk1EWXpNRGNnTUM0M05qUTBNREVnTUM0Mk1UTTRNU0F3TGpjMk16TXhOa013TGpZeE1qRTFOaUF3TGpjMU56TXdOeUF3TGpZeE1EUTROU0F3TGpjMU1UTTJNU0F3TGpZd09EYzVOaUF3TGpjME5UUTNOa013TGpZd056QTFOQ0F3TGpjek9UY3pOQ0F3TGpZd05USTVOQ0F3TGpjek5EQTBOU0F3TGpZd016VXhOaUF3TGpjeU9EUXhRekF1TmpBeE56TTRJREF1TnpJeU9URTJJREF1TlRrNU9UUXpJREF1TnpFM05EZzFJREF1TlRrNE1UTWdNQzQzTVRJeE1UWkRNQzQxT1RZek1UWWdNQzQzTURZNE5UUWdNQzQxT1RRMU1ETWdNQzQzTURFMk56SWdNQzQxT1RJMk9TQXdMalk1TmpVM1F6QXVOVGt3T0RjMklEQXVOamt4TlRjMElEQXVOVGc1TURZeklEQXVOamcyTmpVNUlEQXVOVGczTWpVZ01DNDJPREU0TWpORE1DNDFPRFUwTXpZZ01DNDJOemN3T1RRZ01DNDFPRE0yTURVZ01DNDJOekkwTXpZZ01DNDFPREUzTlRZZ01DNDJOamM0TlVNd0xqVTNPVGt3TnlBd0xqWTJNek00TnlBd0xqVTNPREF6TWlBd0xqWTFPRGszT1NBd0xqVTNOakV6SURBdU5qVTBOakl6UXpBdU5UYzBNVGt5SURBdU5qVXdNemMwSURBdU5UY3lNakVnTUM0Mk5EWXhOakVnTUM0MU56QXhPRE1nTUM0Mk5ERTVPRE5ETUM0MU5qRTRPVGdnTUM0Mk5ESTJOellnTUM0MU5UTTFPVFlnTUM0Mk5ETXpNelFnTUM0MU5EVXlOellnTUM0Mk5ETTVOVFpETUM0MU5ETXhOemdnTUM0Mk5EZzBNellnTUM0MU5ERXhNVFlnTUM0Mk5USTVNelFnTUM0MU16a3dPU0F3TGpZMU56UTFRekF1TlRNM01URTJJREF1TmpZeU1EY3lJREF1TlRNMU1UWXhJREF1TmpZMk56TTVJREF1TlRNek1qSXpJREF1TmpjeE5EVkRNQzQxTXpFek1qRWdNQzQyTnpZek1ETWdNQzQxTWprME1qY2dNQzQyT0RFeU1TQXdMalV5TnpVME15QXdMalk0TmpFM1F6QXVOVEkxTmpjMklEQXVOamt4TWprZ01DNDFNak00TVRnZ01DNDJPVFkwTnpJZ01DNDFNakU1TnlBd0xqY3dNVGN4TmtNd0xqVXlNREV5TVNBd0xqY3dOekE0TlNBd0xqVXhPREk1SURBdU56RXlOVEkxSURBdU5URTJORGMySURBdU56RTRNRE0yUXpBdU5URTBOamd4SURBdU56SXpOamtnTUM0MU1USTRPVFFnTUM0M01qa3pPVFlnTUM0MU1URXhNVFlnTUM0M016VXhOVFpETUM0MU1Ea3pOVFlnTUM0M05ERXdOREVnTUM0MU1EYzJNVFFnTUM0M05EWTVOemtnTUM0MU1EVTRPU0F3TGpjMU1qazNRekF1TlRBME1qQXhJREF1TnpVNU1EWTNJREF1TlRBeU5USXhJREF1TnpZMU1qRWdNQzQxTURBNE5TQXdMamMzTVRNNU5rTXdMalV3T0RjNU5pQXdMamMzTVRNM09TQXdMalV4TmpZeElEQXVOemN4TWpneElEQXVOVEkwTWprZ01DNDNOekV4TURORE1DNDFNalUyTURVZ01DNDNOalUyTkRVZ01DNDFNalk1TlRZZ01DNDNOakF5TWpNZ01DNDFNamd6TkRNZ01DNDNOVFE0TXpaRE1DNDFNamszT0RNZ01DNDNORGsxTXprZ01DNDFNekV5TkRFZ01DNDNORFF5T0RVZ01DNDFNekkzTVRZZ01DNDNNemt3TnpaRE1DNDFOREV3TnpJZ01DNDNNemcyTmpjZ01DNDFORGswTURFZ01DNDNNemd4T1RZZ01DNDFOVGMzTURNZ01DNDNNemMyTmpORE1DNDFOalU1T0RjZ01DNDNNemN3TURVZ01DNDFOelF5TmpNZ01DNDNNell5TmpjZ01DNDFPREkxTXlBd0xqY3pOVFExUXpBdU5UZzBNRGMySURBdU56UXdORFExSURBdU5UZzFOakUwSURBdU56UTFORGswSURBdU5UZzNNVFF6SURBdU56VXdOVGsyV2swd0xqWXpORE14TmlBd0xqYzBNRGszUXpBdU5qTTBNVEF6SURBdU56UTNNRGcxSURBdU5qTXpPRFl6SURBdU56VXpNall6SURBdU5qTXpOVGsySURBdU56VTVOVEF6UXpBdU5qUXhNVGNnTUM0M05UYzNPVFlnTUM0Mk5EZzNOeUF3TGpjMU5qQXpOaUF3TGpZMU5qTTVOaUF3TGpjMU5ESXlNME13TGpZMU5qVXpPQ0F3TGpjME5UQXpNaUF3TGpZMU5qWTJNeUF3TGpjek5UazBOeUF3TGpZMU5qYzNJREF1TnpJMk9UZERNQzQyTlRZNE5Ua2dNQzQzTVRneE55QXdMalkxTmprMk5TQXdMamN3T1RRM05pQXdMalkxTnpBNUlEQXVOekF3T0RsRE1DNDJOakl5TVNBd0xqWTVPVGN4TmlBd0xqWTJOek14TWlBd0xqWTVPRFV5TlNBd0xqWTNNak01TmlBd0xqWTVOek14TmtNd0xqWTNOelE0TVNBd0xqWTVOakE1SURBdU5qZ3lOVFEzSURBdU5qazBPRFl6SURBdU5qZzNOVGsySURBdU5qa3pOak0yUXpBdU5qazBOREl6SURBdU5qa3hPVFUySURBdU56QXdNekUySURBdU5qZzVORFVnTUM0M01EVXlOellnTUM0Mk9EWXhNVFpETUM0M01UQXlNU0F3TGpZNE1qZ3pOaUF3TGpjeE5ERTRNeUF3TGpZM09EY3pJREF1TnpFM01qSXpJREF1Tmpjek5qbERNQzQzTWpBeU5qTWdNQzQyTmpnMU55QXdMamN5TWpNNU5pQXdMalkyTXpBM05pQXdMamN5TXpVNU5pQXdMalkxTnpBMVF6QXVOekkwTnpFMklEQXVOalV3TnpNZ01DNDNNalV3TXpZZ01DNDJORFF3TVNBd0xqY3lORFl4SURBdU5qTTNNamxETUM0M01qUXlPU0F3TGpZek1EVTBNeUF3TGpjeU16UTVJREF1TmpJMU1qTTJJREF1TnpJeU1UTWdNQzQyTWpFeU9VTXdMamN5TURrd015QXdMall4TnpZNUlEQXVOekU1TURFZ01DNDJNVFV4TURNZ01DNDNNVFl6T1RZZ01DNDJNVE16TjBNd0xqY3hNemM0TXlBd0xqWXhNVFUxTmlBd0xqY3hNREkyTXlBd0xqWXhNRGt4TmlBd0xqY3dOVGd6TmlBd0xqWXhNVE0wTTBNd0xqY3dNVE00TXlBd0xqWXhNVFkyTXlBd0xqWTVOVGs1TmlBd0xqWXhNekEzTmlBd0xqWTRPVFl5TXlBd0xqWXhOVFV6UXpBdU5qZ3hPVEkxSURBdU5qRTRNelUySURBdU5qYzBNVGMwSURBdU5qSXhNVEl4SURBdU5qWTJNemNnTUM0Mk1qTTRNak5ETUM0Mk5UZzBNak1nTUM0Mk1qWXpOalVnTUM0Mk5UQXpOakVnTUM0Mk1qZzRNVGtnTUM0Mk5ESXhPRE1nTUM0Mk16RXhPRE5ETUM0Mk5ERXpORGNnTUM0Mk16VTFOelFnTUM0Mk5EQTFOVFlnTUM0Mk5EQXdNVGtnTUM0Mk16azRNU0F3TGpZME5EVXhOa013TGpZek9URTNJREF1TmpRNU1UYzBJREF1TmpNNE5UZ3pJREF1TmpVek9UQXpJREF1TmpNNE1EVWdNQzQyTlRnM01ETkRNQzQyTXpjMk1EVWdNQzQyTmpNMk5EVWdNQzQyTXpjeE9UWWdNQzQyTmpnMk5TQXdMall6TmpneU15QXdMalkzTXpjeE5rTXdMall6TmpVeU1TQXdMalkzT0Rrd055QXdMall6TmpJek5pQXdMalk0TkRFMU1pQXdMall6TlRrM0lEQXVOamc1TkRWRE1DNDJNelUzTlRZZ01DNDJPVFE0T1NBd0xqWXpOVFUyTVNBd0xqY3dNRE00TXlBd0xqWXpOVE00TXlBd0xqY3dOVGt6UXpBdU5qTTFNakExSURBdU56RXhOakF4SURBdU5qTTFNRE0ySURBdU56RTNNekkxSURBdU5qTTBPRGMySURBdU56SXpNVEF6UXpBdU5qTTBOams0SURBdU56STRPVGczSURBdU5qTTBOVEV5SURBdU56TTBPVFF6SURBdU5qTTBNekUySURBdU56UXdPVGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOSIgeT0iMjY1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkzIiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0NCIgeT0iNTkuNSIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5NCIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSM2YzhlYmY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYzsiIHBhcmVudD0iMyIgc291cmNlPSIyOCIgdGFyZ2V0PSI5MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNTc0IiB5PSItNC4zNTYzNjExNDkxMTA4NTMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9Ijg0My41MDAwMDAwMDAwMDA1IiB5PSItMy42MTkwMTUwNDc4Nzk2NTY4IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTciIHZhbHVlPSJSIiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSMwMDZFQUY7ZmlsbENvbG9yPSMxYmExZTI7Zm9udFNpemU9MTU7Zm9udENvbG9yPSNmZmZmZmY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTI5IiB5PSIxOTYiIHdpZHRoPSIxOSIgaGVpZ2h0PSIyMiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTgiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSMxYmExZTI7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iMjgiIHRhcmdldD0iOTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjUzOC40NzM5MDM5NjY1OTY5IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNTg2Ljg3NDczOTAzOTY2NjEiIHk9IjE5MCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7cmVjdXJzaXZlUmVzaXplPTA7dmVydGljYWxBbGlnbj10b3A7YWxpZ249cmlnaHQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM0NjQ5NUQ7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzk0IiB5PSIxMiIgd2lkdGg9IjI0OSIgaGVpZ2h0PSIyNjciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik9UIiBpZD0iMjAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0xMjBhOWEwNy1iZWExLTRlMmYtYjhmMy01ZTQyMzkwZTJkZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9aW90LWFwcGxpY2F0aW9uO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZETUM0Mk9UTXhPVGtnTUM0Mk56VXdOelFnTUM0M01ETXlOek1nTUM0Mk5qVXdNREVnTUM0M01UVTJPVGtnTUM0Mk5qVXdNREZETUM0M01qZ3hNalVnTUM0Mk5qVXdNREVnTUM0M016Z3hPVGtnTUM0Mk56VXdOelFnTUM0M016Z3hPVGtnTUM0Mk9EYzFNREZETUM0M016Z3hPVGtnTUM0Mk9UazVNamNnTUM0M01qZ3hNalVnTUM0M01UQXdNREVnTUM0M01UVTJPVGtnTUM0M01UQXdNREZETUM0M01ETXlOek1nTUM0M01UQXdNREVnTUM0Mk9UTXhPVGtnTUM0Mk9UazVNamNnTUM0Mk9UTXhPVGtnTUM0Mk9EYzFNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qTXpNVEkxSURBdU5qTTROamMzUXpBdU5qTXpNVEkxSURBdU5qSXdNRE0zSURBdU5qUTRNak0xSURBdU5qQTBPVEkzSURBdU5qWTJPRGMxSURBdU5qQTBPVEkzU0RBdU56WTBNemMxUXpBdU56Z3pNREUxSURBdU5qQTBPVEkzSURBdU56azRNVEkxSURBdU5qSXdNRE0zSURBdU56azRNVEkxSURBdU5qTTROamMzVmpBdU56TTJNVGMzUXpBdU56azRNVEkxSURBdU56VTBPREUySURBdU56Z3pNREUxSURBdU56WTVPVEkzSURBdU56WTBNemMxSURBdU56WTVPVEkzU0RBdU5qWTJPRGMxUXpBdU5qUTRNak0xSURBdU56WTVPVEkzSURBdU5qTXpNVEkxSURBdU56VTBPREUySURBdU5qTXpNVEkxSURBdU56TTJNVGMzVmpBdU5qTTROamMzV2swd0xqYzJNRFk1T1NBd0xqWTROelV3TVVNd0xqYzJNRFk1T1NBd0xqWTJNalkwT0NBd0xqYzBNRFUxTWlBd0xqWTBNalV3TVNBd0xqY3hOVFk1T1NBd0xqWTBNalV3TVVNd0xqWTVNRGcwTmlBd0xqWTBNalV3TVNBd0xqWTNNRFk1T1NBd0xqWTJNalkwT0NBd0xqWTNNRFk1T1NBd0xqWTROelV3TVVNd0xqWTNNRFk1T1NBd0xqY3hNak0xTkNBd0xqWTVNRGcwTmlBd0xqY3pNalV3TVNBd0xqY3hOVFk1T1NBd0xqY3pNalV3TVVNd0xqYzBNRFUxTWlBd0xqY3pNalV3TVNBd0xqYzJNRFk1T1NBd0xqY3hNak0xTkNBd0xqYzJNRFk1T1NBd0xqWTROelV3TVZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDNNVFUyTWpVZ01DNDVNRE13TlRKRE1DNDRNelEzTVRFZ01DNDVNRE13TlRJZ01DNDVNekV5TlNBd0xqZ3dOalV4TXlBd0xqa3pNVEkxSURBdU5qZzNOREkzUXpBdU9UTXhNalVnTUM0MU5qZ3pOQ0F3TGpnek5EY3hNU0F3TGpRM01UZ3dNaUF3TGpjeE5UWXlOU0F3TGpRM01UZ3dNa013TGpVNU5qVXpPU0F3TGpRM01UZ3dNaUF3TGpVZ01DNDFOamd6TkNBd0xqVWdNQzQyT0RjME1qZERNQzQxSURBdU9EQTJOVEV6SURBdU5UazJOVE01SURBdU9UQXpNRFV5SURBdU56RTFOakkxSURBdU9UQXpNRFV5V2swd0xqYzNOVFV5TWlBd0xqVTBOekUxUXpBdU56YzBOemMzSURBdU5UUXhOalU1SURBdU56Y3dNRGNnTUM0MU16YzBNamNnTUM0M05qUXpOelVnTUM0MU16YzBNamRNTUM0M05qSTRORGdnTUM0MU16YzFNamxNTUM0M05qRXpPRFFnTUM0MU16YzRNamxETUM0M05UWTJNak1nTUM0MU16a3hNemdnTUM0M05UTXhNalVnTUM0MU5ETTBPVGtnTUM0M05UTXhNalVnTUM0MU5EZzJOemRXTUM0MU9ESTBNVEpJTUM0M01qWTROa3d3TGpjeU5qZzNOU0F3TGpVME9EWTNOMHd3TGpjeU5qYzNNaUF3TGpVME56RTFRekF1TnpJMk1ESTNJREF1TlRReE5qVTVJREF1TnpJeE16SWdNQzQxTXpjME1qY2dNQzQzTVRVMk1qVWdNQzQxTXpjME1qZE1NQzQzTVRRd09UZ2dNQzQxTXpjMU1qbERNQzQzTURnMk1EY2dNQzQxTXpneU56UWdNQzQzTURRek56VWdNQzQxTkRJNU9ERWdNQzQzTURRek56VWdNQzQxTkRnMk56ZE1NQzQzTURRek5pQXdMalU0TWpReE1rZ3dMalkzT0RFeU5WWXdMalUwT0RZM04wd3dMalkzT0RBeU1pQXdMalUwTnpFMVF6QXVOamMzTWpjM0lEQXVOVFF4TmpVNUlEQXVOamN5TlRjZ01DNDFNemMwTWpjZ01DNDJOalk0TnpVZ01DNDFNemMwTWpkRE1DNDJOakEyTmpJZ01DNDFNemMwTWpjZ01DNDJOVFUyTWpVZ01DNDFOREkwTmpRZ01DNDJOVFUyTWpVZ01DNDFORGcyTnpkTU1DNDJOVFUyTXpJZ01DNDFPRE0xTlRGRE1DNDJNek0xT1RNZ01DNDFPRGd3TWpFZ01DNDJNVFl5TXpJZ01DNDJNRFV6TnpjZ01DNDJNVEUzTlRNZ01DNDJNamMwTVRKTU1DNDFOelk0TnpVZ01DNDJNamMwTWpkTU1DNDFOelV6TkRnZ01DNDJNamMxTWpsRE1DNDFOams0TlRjZ01DNDJNamd5TnpRZ01DNDFOalUyTWpVZ01DNDJNekk1T0RFZ01DNDFOalUyTWpVZ01DNDJNemcyTnpkTU1DNDFOalUzTWpnZ01DNDJOREF5TURORE1DNDFOalkwTnpNZ01DNDJORFUyT1RRZ01DNDFOekV4T0NBd0xqWTBPVGt5TnlBd0xqVTNOamczTlNBd0xqWTBPVGt5TjB3d0xqWXhNRFl5TlNBd0xqWTBPVGt4TWxZd0xqWTNOakUyTWt3d0xqVTNOamczTlNBd0xqWTNOakUzTjB3d0xqVTNOVE0wT0NBd0xqWTNOakkzT1VNd0xqVTJPVGcxTnlBd0xqWTNOekF5TkNBd0xqVTJOVFl5TlNBd0xqWTRNVGN6TVNBd0xqVTJOVFl5TlNBd0xqWTROelF5TjB3d0xqVTJOVGN5T0NBd0xqWTRPRGsxTTBNd0xqVTJOalEzTXlBd0xqWTVORFEwTkNBd0xqVTNNVEU0SURBdU5qazROamMzSURBdU5UYzJPRGMxSURBdU5qazROamMzVERBdU5qRXdOakkxSURBdU5qazROall5VmpBdU56STBPVEV5VERBdU5UYzJPRGMxSURBdU56STBPVEkzVERBdU5UYzFNelE0SURBdU56STFNREk1UXpBdU5UWTVPRFUzSURBdU56STFOemMwSURBdU5UWTFOakkxSURBdU56TXdORGd4SURBdU5UWTFOakkxSURBdU56TTJNVGMzUXpBdU5UWTFOakkxSURBdU56UXlNemtnTUM0MU56QTJOaklnTUM0M05EYzBNamNnTUM0MU56WTROelVnTUM0M05EYzBNamRNTUM0Mk1URTNOU0F3TGpjME56UXlOa013TGpZeE5qSXlOQ0F3TGpjMk9UUTJPU0F3TGpZek16VTRPQ0F3TGpjNE5qZ3pNU0F3TGpZMU5UWXpNaUF3TGpjNU1UTXdNMHd3TGpZMU5UWXlOU0F3TGpneU5qRTNOMHd3TGpZMU5UY3lPQ0F3TGpneU56Y3dNME13TGpZMU5qUTNNeUF3TGpnek16RTVOQ0F3TGpZMk1URTRJREF1T0RNM05ESTNJREF1TmpZMk9EYzFJREF1T0RNM05ESTNUREF1TmpZNE5EQXlJREF1T0RNM016STBRekF1Tmpjek9Ea3pJREF1T0RNMk5UYzVJREF1TmpjNE1USTFJREF1T0RNeE9EY3lJREF1TmpjNE1USTFJREF1T0RJMk1UYzNWakF1TnpreU5ERXlTREF1TnpBME16Wk1NQzQzTURRek56VWdNQzQ0TWpZeE56ZE1NQzQzTURRME56Z2dNQzQ0TWpjM01ETkRNQzQzTURVeU1qTWdNQzQ0TXpNeE9UUWdNQzQzTURrNU15QXdMamd6TnpReU55QXdMamN4TlRZeU5TQXdMamd6TnpReU4wd3dMamN4TnpFMU1pQXdMamd6TnpNeU5FTXdMamN5TWpZME15QXdMamd6TmpVM09TQXdMamN5TmpnM05TQXdMamd6TVRnM01pQXdMamN5TmpnM05TQXdMamd5TmpFM04wd3dMamN5TmpnMklEQXVOemt5TkRFeVNEQXVOelV6TVRJMVZqQXVPREkyTVRjM1REQXVOelV6TWpJNElEQXVPREkzTnpBelF6QXVOelV6T1RjeklEQXVPRE16TVRrMElEQXVOelU0TmpnZ01DNDRNemMwTWpjZ01DNDNOalF6TnpVZ01DNDRNemMwTWpkRE1DNDNOekExT0RnZ01DNDRNemMwTWpjZ01DNDNOelUyTWpVZ01DNDRNekl6T1NBd0xqYzNOVFl5TlNBd0xqZ3lOakUzTjB3d0xqYzNOVFl6TXlBd0xqYzVNVE5ETUM0M09UYzJOalVnTUM0M09EWTRNalFnTUM0NE1UVXdNaUF3TGpjMk9UUTNNU0F3TGpneE9UUTVOeUF3TGpjME56UXpPVXd3TGpnMU5ETTNOU0F3TGpjME56UXlOMHd3TGpnMU5Ua3dNaUF3TGpjME56TXlORU13TGpnMk1UTTVNeUF3TGpjME5qVTNPU0F3TGpnMk5UWXlOU0F3TGpjME1UZzNNaUF3TGpnMk5UWXlOU0F3TGpjek5qRTNOMHd3TGpnMk5UVXlNaUF3TGpjek5EWTFRekF1T0RZME56YzNJREF1TnpJNU1UVTVJREF1T0RZd01EY2dNQzQzTWpRNU1qY2dNQzQ0TlRRek56VWdNQzQzTWpRNU1qZElNQzQ0TWpBMk1qVldNQzQyT1RnMk56ZElNQzQ0TlRRek56Vk1NQzQ0TlRVNU1ESWdNQzQyT1RnMU56UkRNQzQ0TmpFek9UTWdNQzQyT1RjNE1qa2dNQzQ0TmpVMk1qVWdNQzQyT1RNeE1qSWdNQzQ0TmpVMk1qVWdNQzQyT0RjME1qZE1NQzQ0TmpVMU1qSWdNQzQyT0RVNVF6QXVPRFkwTnpjM0lEQXVOamd3TkRBNUlEQXVPRFl3TURjZ01DNDJOell4TnpjZ01DNDROVFF6TnpVZ01DNDJOell4TnpkSU1DNDRNakEyTWpWV01DNDJORGs1TWpkSU1DNDROVFF6TnpWTU1DNDROVFU1TURJZ01DNDJORGs0TWpSRE1DNDROakV6T1RNZ01DNDJORGt3TnprZ01DNDROalUyTWpVZ01DNDJORFF6TnpJZ01DNDROalUyTWpVZ01DNDJNemcyTnpkRE1DNDROalUyTWpVZ01DNDJNekkwTmpRZ01DNDROakExT0RnZ01DNDJNamMwTWpjZ01DNDROVFF6TnpVZ01DNDJNamMwTWpkTU1DNDRNVGsxSURBdU5qSTNORE5ETUM0NE1UVXdNamdnTUM0Mk1EVXpPVEVnTUM0M09UYzJOeUF3TGpVNE9EQXpJREF1TnpjMU5qTXpJREF1TlRnek5UVTBUREF1TnpjMU5qSTFJREF1TlRRNE5qYzNUREF1TnpjMU5USXlJREF1TlRRM01UVmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNVEEyT1RNZ01DNDBOVEkzT1RaRE1DNDNPVFF5T0RjZ01DNDBNakl6TkRFZ01DNDNOek0wTWpVZ01DNHpPVE0zT1RJZ01DNDNORGsxTXpJZ01DNHpOams0T1RoRE1DNDJNVEkyTkRjZ01DNHlNek13TVRRZ01DNHpPVEEzTVRRZ01DNHlNek13TVRRZ01DNHlOVE00TWprZ01DNHpOams0T1RoRE1DNHlNamN5T0RnZ01DNHpPVFkwTXprZ01DNHlNRFUyTWpnZ01DNDBNalkwTWlBd0xqRTRPRGs0TXlBd0xqUTFPVE15TjBNd0xqRTNPREl6TXlBd0xqUTRNRFU0SURBdU1UZzJOelEzSURBdU5UQTJOVEkwSURBdU1qQTRJREF1TlRFM01qYzBRekF1TWpJNU1qVXpJREF1TlRJNE1ESTBJREF1TWpVMU1UazNJREF1TlRFNU5UQTVJREF1TWpZMU9UUTNJREF1TkRrNE1qVTJRekF1TWpjNE5EZzBJREF1TkRjek5EY3hJREF1TWprME56WXhJREF1TkRVd09UUXlJREF1TXpFME9ERTJJREF1TkRNd09EZzJRekF1TkRFNE1ERTVJREF1TXpJM05qZ3pJREF1TlRnMU16UXlJREF1TXpJM05qZ3pJREF1TmpnNE5UUTFJREF1TkRNd09EZzJRekF1Tmprd01ERTVJREF1TkRNeU16WWdNQzQyT1RFME9DQXdMalF6TXpnMk1pQXdMalk1TWpreU9DQXdMalF6TlRNNE9VTXdMamN3TURRek5pQXdMalF6TkRjeE9TQXdMamN3T0RBMElEQXVORE0wTXpjMklEQXVOekUxTnpJeklEQXVORE0wTXpjMlF6QXVOelE1TXpBNUlEQXVORE0wTXpjMklEQXVOemd4TXpZM0lEQXVORFF3T1RFNElEQXVPREV3TmpreklEQXVORFV5TnprMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EYzNNamswSURBdU5qQXlNekF5UXpBdU5EWTNOemdnTUM0Mk1qZzVNalVnTUM0ME5qSTFPVGdnTUM0Mk5UYzJNRGdnTUM0ME5qSTFPVGdnTUM0Mk9EYzFNREpETUM0ME5qSTFPVGdnTUM0Mk9UYzBNak1nTUM0ME5qTXhOamtnTUM0M01EY3lNVEVnTUM0ME5qUXlOemtnTUM0M01UWTRNelZETUM0ME5qQTNOalFnTUM0M01UUTBPVFVnTUM0ME5UYzBNamNnTUM0M01URTNOelFnTUM0ME5UUXpNallnTUM0M01EZzJOek5ETUM0ME1qa3dORFlnTUM0Mk9ETXpPVFFnTUM0ME1qa3dORFlnTUM0Mk5ESTBNRGdnTUM0ME5UUXpNallnTUM0Mk1UY3hNamxETUM0ME5qRXdOalFnTUM0Mk1UQXpPU0F3TGpRMk9Ea3hPU0F3TGpZd05UUTBPQ0F3TGpRM056STVOQ0F3TGpZd01qTXdNbG9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMall3TmprNElEQXVORFU0T0RaRE1DNDFOelUxTkRZZ01DNDBOek00TXpZZ01DNDFORGMyT0RjZ01DNDBPVFV4TURRZ01DNDFNalV3TXpJZ01DNDFNakV3TXpWRE1DNDBPREl3TVRZZ01DNDFNVE0zTkRJZ01DNDBNell5TXpjZ01DNDFNalkyT1RZZ01DNDBNRE13TXpjZ01DNDFOVGs0T1RaRE1DNHpPVEV3TXpjZ01DNDFOekU0T1RVZ01DNHpPREV5TkRZZ01DNDFPRFkxT0RRZ01DNHpOelF3TkRrZ01DNDJNRE13TTBNd0xqTTJORFV3TWlBd0xqWXlORGcxSURBdU16TTVNRGMwSURBdU5qTTBOems1SURBdU16RTNNalUwSURBdU5qSTFNalV4UXpBdU1qazFORE0xSURBdU5qRTFOekEwSURBdU1qZzFORGcySURBdU5Ua3dNamMySURBdU1qazFNRE16SURBdU5UWTRORFUyUXpBdU16QTJORElnTUM0MU5ESTBNelFnTUM0ek1qSXlNRGdnTUM0MU1UZzNOU0F3TGpNME1qQTFJREF1TkRrNE9UQTRRekF1TkRFek56Y2dNQzQwTWpjeE9EY2dNQzQxTWpFM05UZ2dNQzQwTVRNNE16Z2dNQzQyTURZNU9DQXdMalExT0RnMldpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9USXpOekVnTUM0ek16ZzVNekpETUM0NU1EVTNNeUF3TGpNeE1qZzRNU0F3TGpnNE5UQTNPQ0F3TGpJNE56ZzVNU0F3TGpnMk16RTNNU0F3TGpJMk5UazRORU13TGpZMk1qUTVOeUF3TGpBMk5UTXhJREF1TXpNM01UUWdNQzR3TmpVek1TQXdMakV6TmpRMk5pQXdMakkyTlRrNE5FTXdMakV4TlRNM055QXdMakk0TnpBM015QXdMakE1TlRBd01EZ2dNQzR6TVRFNU9Ea2dNQzR3TnpZMU5ETXhJREF1TXpNNE5UazFRekF1TURZeU9UWTNNeUF3TGpNMU9ERTJOQ0F3TGpBMk56Z3lOVGdnTUM0ek9EVXdNek1nTUM0d09EY3pPVFE1SURBdU16azROakE1UXpBdU1UQTJPVFkwSURBdU5ERXlNVGcxSURBdU1UTXpPRE16SURBdU5EQTNNekkySURBdU1UUTNOREE1SURBdU16ZzNOelUzUXpBdU1UWXpNRGd5SURBdU16WTFNVFkwSURBdU1UZ3dNak01SURBdU16UTBNVGcySURBdU1UazNORFV6SURBdU16STJPVGN5UXpBdU16WTBORFExSURBdU1UVTVPVGdnTUM0Mk16VXhPVElnTUM0eE5UazVPQ0F3TGpnd01qRTRNeUF3TGpNeU5qazNNa013TGpneU1ETXhOU0F3TGpNME5URXdOQ0F3TGpnek56WTBOU0F3TGpNMk5qQTNNaUF3TGpnMU1qY3lOaUF3TGpNNE56a3lNME13TGpnMk5qSTFOQ0F3TGpRd056VXlOU0F3TGpnNU16RXhNaUF3TGpReE1qUTBPQ0F3TGpreE1qY3hNeUF3TGpNNU9Ea3hPVU13TGprek1qTXhOU0F3TGpNNE5UTTVNU0F3TGprek56SXpPQ0F3TGpNMU9EVXpNeUF3TGpreU16Y3hJREF1TXpNNE9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprek56VWlJR2hsYVdkb2REMGlNQzQ1TXpjMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNekV5TlNBd0xqQXpNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE1NSIgeT0iMTU0IiB3aWR0aD0iNzgiIGhlaWdodD0iNTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI2IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gSW9UIEFwcGxpY2F0aW9uIChpb3Qtc2VjdXJpdHktY29tcGxpYW5jZS1mcmFtZXdvcmspIiBzdHlsZT0iaXIucmVmPTQ4OTY2OTNhLTQ2YWYtNGM2Yy1hYzhkLTRkYjhlYTAxN2RmYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jNzg4QUEzO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7IiBwYXJlbnQ9IjIxIiBzb3VyY2U9IjI1IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU2VjdXJlIEdhdGV3YXkiIGlkPSIyNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTkwZjI5MDNjLTk0MmYtNDU1Ni05MDVhLTM5MWEzMjhhMjM3Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtza2V0Y2g9MTsiIHBhcmVudD0iMjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjMuNSIgeT0iMTQ1LjUiIHdpZHRoPSI4MSIgaGVpZ2h0PSI3NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzgiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSM3ODhBQTM7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjIxIiBzb3VyY2U9Ijk1IiB0YXJnZXQ9IjI1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzIiIHZhbHVlPSIiIHN0eWxlPSJmb250Q29sb3I9IzQ2NDk1RDt2ZXJ0aWNhbEFsaWduPXRvcDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsUG9zaXRpb249Y2VudGVyO2FsaWduPWNlbnRlcjtodG1sPTE7b3V0bGluZUNvbm5lY3Q9MDtmaWxsQ29sb3I9I0IyQzlBQjtzdHJva2VDb2xvcj0jNzg4QUEzO2dyYWRpZW50RGlyZWN0aW9uPW5vcnRoO3N0cm9rZVdpZHRoPTI7c2hhcGU9bXhncmFwaC5uZXR3b3Jrcy5maXJld2FsbDtza2V0Y2g9MTtyb3VuZGVkPTE7IiBwYXJlbnQ9IjIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIwLjUiIHk9IjE4IiB3aWR0aD0iODciIGhlaWdodD0iODMiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk1IiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmOyIgcGFyZW50PSIyMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1MiIgeT0iMTEyIiB3aWR0aD0iMTkiIGhlaWdodD0iMjIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk2IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIyMSIgc291cmNlPSIzMiIgdGFyZ2V0PSI5NSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iODg3IiB5PSI0Ny4wMDAwMDAwMDAwMDAyMyIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iODg3IiB5PSI4Mi41IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMzciIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3N0cm9rZUNvbG9yPSM2YzhlYmY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYztzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iOTMiIHRhcmdldD0iMzIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5OSIgdmFsdWU9IkQiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmb250U2l6ZT0xNTtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxODkiIHk9IjE3OCIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMjIiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuMjY1O2VudHJ5WT0wLjEyNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7c2hhZG93PTA7bGFiZWxCYWNrZ3JvdW5kQ29sb3I9bm9uZTtsYWJlbEJvcmRlckNvbG9yPW5vbmU7Zm9udENvbG9yPSNGRkZGRkY7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNiOWQwZTY7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9I2RiZWFmNzsiIHBhcmVudD0iMyIgc291cmNlPSIyOCIgdGFyZ2V0PSI5OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgeD0iLTAuMTEwOCIgeT0iMTMiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjUzNi45OTA1OTEwMTY1NDg1IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNjgyLjAyIiB5PSIyMDciIGFzPSJ0YXJnZXRQb2ludCIvPjxteFBvaW50IGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTQiIHZhbHVlPSJQdWJsaWMgQ2xvdWQiIHN0eWxlPSJpci5yZWY9YjYxZDY5MTEtMzM4ZC00NmE4LTlmMzktOGRjZDI0YWJmZTkxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSNiOWQwZTY7ZmlsbENvbG9yPSNkYmVhZjc7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM4QzhDOEM7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xNzQiIHk9IjE0MCIgd2lkdGg9IjQxMiIgaGVpZ2h0PSIzMDUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO3N0cm9rZUNvbG9yPSM5OUNDRkY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RhZThmYzt0YXJnZXRQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjE0IiBzb3VyY2U9IjMwIiB0YXJnZXQ9IjExIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE0IiB2YWx1ZT0iQXp1cmUgQUQgLT4gV1ZEIiBzdHlsZT0iaXIucmVmPTJiNDM1MDkyLTQ1ZWQtNDMwNC1iNDJlLTg5MTQwNjJlMDVkZDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7bGFiZWxCYWNrZ3JvdW5kQ29sb3I9bm9uZTtsYWJlbEJvcmRlckNvbG9yPW5vbmU7Zm9udENvbG9yPSNGRkZGRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7ZmlsbENvbG9yPSMxYmExZTI7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7IiBwYXJlbnQ9IjE0IiBzb3VyY2U9IjExIiB0YXJnZXQ9IjEwOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjg4IiB5PSIxMjciIGFzPSJzb3VyY2VQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgdmFsdWU9IkF6dXJlIEFEIiBzdHlsZT0iaXIucmVmPTc0ZWJmNjdmLWQ3YmMtNDAxMC1hMzQwLWY5MWVmZGJmZGIzODtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSNFNkU2RTY7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtYWN0aXZlLWRpcmVjdG9yeTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHdOekExTmpjM0lEQXVOVGN5TmpJM1REQXVOVEF6TnprNElEQXVPRFV6TnpnNFREQXVPVFEwTmpnM0lEQXVOVGN4TlRNelREQXVPVGs1T1RNMUlEQXVOak0yTURoTU1DNDFNRE0zT1RnZ01DNDVOVFUxTXpGTU1DNHdNVFV6TVRrNElEQXVOak0yTURoTU1DNHdOekExTmpjM0lEQXVOVGN5TmpJM1dpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1UQXpNek16SURBdU5UTTJOVFpNTUM0MU1ETTNORElnTUM0d05UazFOekF6VERBdU9URXlNelUzSURBdU5UTTNNVEEzVERBdU5UQXpOelF5SURBdU56azFNamswVERBdU1UQXpNek16SURBdU5UTTJOVFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF6TnpReUlEQXVNRFU1TlRjd00xWXdMamM1TlRJNU5Fd3dMakV3TXpNek15QXdMalV6TmpVMlREQXVOVEF6TnpReUlEQXVNRFU1TlRjd00xb2lJR1pwYkd3OUlpTTFNRVUyUmtZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNemM0TkNBd0xqQTFPVFUzTUROV01DNDNPVFV5T1RSTU1DNDVNVEkwSURBdU5UTTNNVEEzVERBdU5UQXpOemcwSURBdU1EVTVOVGN3TTFvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5Rd1gyeHBibVZoY2lraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNemM0TkNBd0xqUXpPVFk1TjB3d0xqa3hNalFnTUM0MU16Y3dOalJNTUM0MU1ETTNPRFFnTUM0M09UVXlOVEZXTUM0ME16azJPVGRhSWlCbWFXeHNQU0lqTlROQ01VVXdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTURNM05ESWdNQzQzT1RVeU5URk1NQzR4TURNek16TWdNQzQxTXpZMU1UZE1NQzQxTURNM05ESWdNQzQwTXprMk9UZFdNQzQzT1RVeU5URmFJaUJtYVd4c1BTSWpPVU5GUWtaR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNRE0zT0RRZ01DNDVOVFUxTXpGTU1DNDVPVGs1TWpFZ01DNDJNell3T0V3d0xqazBORFkzTXlBd0xqVTNNVFV6TTB3d0xqVXdNemM0TkNBd0xqZzFNemM0T0ZZd0xqazFOVFV6TVZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5ReFgyeHBibVZoY2lraUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlNQzQzTkRBd09USWlJSGt4UFNJd0xqY3lOelEyTlNJZ2VESTlJakF1TkRnMk9ESTVJaUI1TWowaU1DNHlORGMzTkNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUl6RTVPRGhFT1NJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMamtpSUhOMGIzQXRZMjlzYjNJOUlpTTFORUZGUmpBaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1WOXNhVzVsWVhJaUlIZ3hQU0l3TGpZek1USXpOeUlnZVRFOUlqQXVOVGczT1RReklpQjRNajBpTUM0NE1EWXlOemtpSUhreVBTSXdMamc0T1RnNU1TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRWlJSE4wYjNBdFkyOXNiM0k5SWlNMU5FRkZSakFpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1DNHlPU0lnYzNSdmNDMWpiMnh2Y2owaUl6UkdRVUpGUlNJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMalV4SWlCemRHOXdMV052Ykc5eVBTSWpOREZCTWtVNUlpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TnpRaUlITjBiM0F0WTI5c2IzSTlJaU15UVRrelJUQWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0NE9DSWdjM1J2Y0MxamIyeHZjajBpSXpFNU9EaEVPU0l2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFeElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNVFV6TVRrNElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xO2ZpbGxTdHlsZT1hdXRvOyIgcGFyZW50PSIxNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOTYiIHk9IjIzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMwIiB2YWx1ZT0iIiBzdHlsZT0ic2tldGNoPTE7cG9pbnRlckV2ZW50cz0xO3NoYWRvdz0wO2Rhc2hlZD0wO2h0bWw9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj0jMjZGOEZGO2xhYmVsUG9zaXRpb249Y2VudGVyO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207b3V0bGluZUNvbm5lY3Q9MDt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1jZW50ZXI7c2hhcGU9bXhncmFwaC5vZmZpY2UuY2xvdWRzLm9mZmljZV8zNjU7Zm9udENvbG9yPSM0NjQ5NUQ7cm91bmRlZD0xO2dyYWRpZW50Q29sb3I9bm9uZTsiIHBhcmVudD0iMTQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTYzIiB5PSIxOTUiIHdpZHRoPSIxMDEiIGhlaWdodD0iNjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlNhYVMgKFNhbGVzIEZvcmNlLCBBcmliYSwgSW50ZWxleCwgZXRjKSIgaWQ9IjUzIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9MDdmNzk4NTEtZTQ0ZS00MDY5LWI0YjQtZGY2ODkzZTk3OTBlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc29mdC1henVyZS13ZWItYXBwcztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOamc0TWpRZ01DNDROREl4TWpkRE1DNDJPREF4TVRnZ01DNDVNVEE0T1RrZ01DNDFOamMzTWpZZ01DNDVOREUyTVRjZ01DNDBOVFl6TnpNZ01DNDVNamMxTWpORE1DNHpORFV3TVRrZ01DNDVNVE0wTWprZ01DNHlORE00TWpVZ01DNDROVFUyTnpjZ01DNHhOelV3TlRJZ01DNDNOalk1TnpKRE1DNHhNRFl5TnprZ01DNDJOemd5TmpnZ01DNHdOelUxTmpBNUlEQXVOVFkxT0RjMklEQXVNRGc1TmpVMU1TQXdMalExTkRVeU0wTXdMakV3TXpjME9TQXdMak0wTXpFMk9TQXdMakUyTVRVd01TQXdMakkwTVRrM05pQXdMakkxTURJd055QXdMakUzTXpJd00wd3dMakkxTkRZNE5pQXdMakUzTURJeE4wTXdMak0wTXprZ01DNHhNRE0yTWpRZ01DNDBOVFUzTmpnZ01DNHdOelE0TnprNElEQXVOVFkyTURNMElEQXVNRGt3TWpFM05rTXdMalkzTmpNZ01DNHhNRFUxTlRVZ01DNDNOell3TnpZZ01DNHhOak0zTXprZ01DNDRORE0zTWpnZ01DNHlOVEl4TlRKRE1DNDVNVEV6T0RFZ01DNHpOREExTmpVZ01DNDVOREUwTlRjZ01DNDBOVEl3T0RFZ01DNDVNamMwTXpVZ01DNDFOakkxTWpKRE1DNDVNVE0wTVRNZ01DNDJOekk1TmpJZ01DNDROVFkwTWpRZ01DNDNOek0wTWpVZ01DNDNOamc0TWpRZ01DNDROREl4TWpjaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5Rd1gzSmhaR2xoYkNraUx6NG1JM2hoT3p4d1lYUm9JRzl3WVdOcGRIazlJakF1TmlJZ1pEMGlUVEF1TXprME5UZzBJREF1TkRFNU5UTkRNQzQxTVRReU5Ea2dNQzR6TURVM01Ua2dNQzQyTnpJNU1ETWdNQzR5TkRFNU56SWdNQzQ0TXpnd05EWWdNQzR5TkRFek5EaERNQzQ0TVRZek5UTWdNQzR5TVRRMU1UTWdNQzQzT1RFME5EY2dNQzR4T1RBME5ETWdNQzQzTmpNNE9EY2dNQzR4TmprMk56aERNQzQyT0RNMU5EY2dNQzR4TnpRMk16UWdNQzQyTURRMk1qVWdNQzR4T1RNeE5EUWdNQzQxTXpBME5pQXdMakl5TkRReU5rTXdMalExTkRFd01TQXdMakkxTnpJeU5TQXdMak00TlRBMk1pQXdMak13TkRrME15QXdMak15TnpNNU15QXdMak0yTkRjNE1VTXdMak0xTlRFeE1TQXdMak0zTlRNd01pQXdMak0zT0RZNE1pQXdMak01TkRVd09DQXdMak01TkRVNE5DQXdMalF4T1RVelZqQXVOREU1TlROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDJJaUJrUFNKTk1DNHhPRFE1T0RjZ01DNDFPRGs0TkRSRE1DNHhOamM0T0RnZ01DNDJNekl4T0RVZ01DNHhOVFF3TnpjZ01DNDJOelUzT0RFZ01DNHhORE0yTnpjZ01DNDNNakF5TkRWRE1DNHhOVEk0TmpZZ01DNDNNell5TVRrZ01DNHhOak14TnpnZ01DNDNOVEUxTWpFZ01DNHhOelExTXpVZ01DNDNOall3TXpSRE1DNHhPRE0wT1RRZ01DNDNOemMwT0RJZ01DNHhPVEU1TlRVZ01DNDNPRGM1TXpRZ01DNHlNREU1TURrZ01DNDNPVGd6T0RaRE1DNHlNVE01TXpVZ01DNDNNemt4TkRZZ01DNHlNekU1TkRVZ01DNDJPREV5T0NBd0xqSTFOVFkyTWlBd0xqWXlOVFkzT1VNd0xqSXlPVEE1TlNBd0xqWXlNRGt6TmlBd0xqSXdORFV4TkNBd0xqWXdPRFEzTWlBd0xqRTRORGs0TnlBd0xqVTRPVGcwTkZZd0xqVTRPVGcwTkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVTFJaUJrUFNKTk1DNHlNek00TmpZZ01DNHpOak00TlRaRE1DNHlNVFl6TURJZ01DNHpNVFkzTWpFZ01DNHlNRFEzTmpRZ01DNHlOamMxTlRjZ01DNHhPVGsxTWpRZ01DNHlNVGMxTWpsRE1DNHhOemcyTXpjZ01DNHlNemswTmpZZ01DNHhOakF5TnpNZ01DNHlOak0yTnpNZ01DNHhORFEzTnpVZ01DNHlPRGsyT1RkRE1DNHhOVEF6T1RRZ01DNHpNekF3TURRZ01DNHhOVGs0T1RRZ01DNHpOamsyTnpRZ01DNHhOek14TkRVZ01DNDBNRGd4TlRORE1DNHhPRGczTkRFZ01DNHpPRGM0T1RJZ01DNHlNRGs0TVRFZ01DNHpOekkxTWpFZ01DNHlNek00TmpZZ01DNHpOak00TlRaV01DNHpOak00TlRaYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU56azFOVE1nTUM0Mk1qYzNNRGRETUM0ek5UUTFPVFVnTUM0Mk1qYzNNRGNnTUM0ME1UVTBNamtnTUM0MU5qWTROelFnTUM0ME1UVTBNamtnTUM0ME9URTRNekpETUM0ME1UVTBNamtnTUM0ME1UWTNPU0F3TGpNMU5EVTVOU0F3TGpNMU5UazFOeUF3TGpJM09UVTFNeUF3TGpNMU5UazFOME13TGpJd05EVXhNU0F3TGpNMU5UazFOeUF3TGpFME16WTNOeUF3TGpReE5qYzVJREF1TVRRek5qYzNJREF1TkRreE9ETXlRekF1TVRRek5qYzNJREF1TlRZMk9EYzBJREF1TWpBME5URXhJREF1TmpJM056QTNJREF1TWpjNU5UVXpJREF1TmpJM056QTNXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkREZmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ2IzQmhZMmwwZVQwaU1DNDFOU0lnWkQwaVRUQXVORGMzTmpRNElEQXVOelF3TWpVMVF6QXVORGMzTmpZMklEQXVOekk0TkRVMklEQXVORGd3TURVMUlEQXVOekUyTnpneUlEQXVORGcwTmpjeUlEQXVOekExT1RJMFF6QXVORGc1TWpnNUlEQXVOamsxTURZMUlEQXVORGsyTURRZ01DNDJPRFV5TkRVZ01DNDFNRFExTWpRZ01DNDJOemN3TkRaRE1DNDBOVGcyTXprZ01DNDJOVEU0T1RZZ01DNDBNVFl5T1RVZ01DNDJNakEzTmpZZ01DNHpOemcyTURNZ01DNDFPRFEwTnpORE1DNHpOVGc1TURjZ01DNDJNRFUzT0RFZ01DNHpNekk1TWprZ01DNDJNakF5TlRNZ01DNHpNRFEwTkRNZ01DNDJNalUzT0RKRE1DNHpNalk0T1RjZ01DNDJORGczTmpjZ01DNHpOVEV3TVRrZ01DNDJOekF3TmpFZ01DNHpOelkyTVRJZ01DNDJPRGswT0RsRE1DNDBNRGcwTnprZ01DNDNNVE0xTlRNZ01DNDBOREkyTlRjZ01DNDNNelF6T1RNZ01DNDBOemcyTkRNZ01DNDNOVEUzTURORE1DNDBOemd3TmpVZ01DNDNORGM1TVRJZ01DNDBOemMzTXpNZ01DNDNORFF3T0RnZ01DNDBOemMyTkRnZ01DNDNOREF5TlRWYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalUxSWlCa1BTSk5NQzQzT1RFeU9USWdNQzQzTlRBMU5EWkRNQzQzTkRVd05DQXdMamMxTURVM05DQXdMalk1T0RrME1pQXdMamMwTlRJeU9TQXdMalkxTXpreU15QXdMamN6TkRZeE9VTXdMalkxTkRFMk9TQXdMamN6TmpRek5pQXdMalkxTkRFMk9TQXdMamN6T0RJM055QXdMalkxTXpreU15QXdMamMwTURBNU5FTXdMalkxTXprMU55QXdMamMxTVRVME5DQXdMalkxTVRjek1pQXdMamMyTWpnNE9TQXdMalkwTnpNM055QXdMamMzTXpRM09VTXdMalkwTXpBeU1TQXdMamM0TkRBMk9TQXdMall6TmpZeUlEQXVOemt6TmprMklEQXVOakk0TlRRZ01DNDRNREU0TVVNd0xqWTRORFUxTlNBd0xqZ3hNamt3T0NBd0xqYzBNVGMwTWlBd0xqZ3hOamt5TVNBd0xqYzVPRGMxT0NBd0xqZ3hNemMxTlVNd0xqZ3lNRGczTlNBd0xqYzVNemMxTVNBd0xqZzBNRGN6TmlBd0xqYzNNVE00TnlBd0xqZzFOems0TmlBd0xqYzBOekEyTWtNd0xqZ3pOVGcwTVNBd0xqYzBPVFV5SURBdU9ERXpOVGN5SURBdU56VXdOamd6SURBdU56a3hNamt5SURBdU56VXdOVFEyV2lJZ1ptbHNiRDBpSTBZeVJqSkdNaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRZMU9EZzVJREF1T0RJNE56azBRekF1TmpFME9ERTRJREF1T0RJNE56azBJREF1TmpVME5EZ3pJREF1TnpnNU1UTXhJREF1TmpVME5EZ3pJREF1TnpRd01qQXpRekF1TmpVME5EZ3pJREF1TmpreE1qYzFJREF1TmpFME9ERTRJREF1TmpVeE5qRXhJREF1TlRZMU9EZzVJREF1TmpVeE5qRXhRekF1TlRFMk9UWWdNQzQyTlRFMk1URWdNQzQwTnpjeU9UVWdNQzQyT1RFeU56VWdNQzQwTnpjeU9UVWdNQzQzTkRBeU1ETkRNQzQwTnpjeU9UVWdNQzQzT0RreE16RWdNQzQxTVRZNU5pQXdMamd5T0RjNU5DQXdMalUyTlRnNE9TQXdMamd5T0RjNU5Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXlYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU55SWdaRDBpVFRBdU5qYzBOelUzSURBdU5UQTBNVGd5UXpBdU5qYzVNVFV4SURBdU5EZzBOekUwSURBdU5qZzVPREUzSURBdU5EWTNNakkzSURBdU56QTFNVEUzSURBdU5EVTBOREV4UXpBdU5qSXpNVFkxSURBdU16azBPRE0wSURBdU5UUTROalF4SURBdU16STFOalUzSURBdU5EZ3pNVE00SURBdU1qUTRNelU1UXpBdU5EUTBPVFkxSURBdU1qQXpOVE1nTUM0ME1URTJNRElnTUM0eE5UUTRNaUF3TGpNNE16VTVOaUF3TGpFd016QXlOME13TGpNMk5UQXdOaUF3TGpFd09EWXdNU0F3TGpNME5qZzJPU0F3TGpFeE5UVTRPU0F3TGpNeU9UTTBOaUF3TGpFeU16a3pNVU13TGpNMU9UTXhOeUF3TGpFNE1ETXlOU0F3TGpNNU5URTROeUF3TGpJek16TTNPU0F3TGpRek5qTTFNeUF3TGpJNE1qSXdNME13TGpVd05qTXlNU0F3TGpNMk5UYzROQ0F3TGpVNE5qUXdNaUF3TGpRME1ETTBPU0F3TGpZM05EYzFOeUF3TGpVd05ERTRNbFl3TGpVd05ERTRNbG9pSUdacGJHdzlJaU5HTWtZeVJqSWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMyTnpJNE5pQXdMall4TlRFek4wTXdMamd4T1RJek9TQXdMall4TlRFek55QXdMamcyTVRNMU5TQXdMalUzTXpBeU1TQXdMamcyTVRNMU5TQXdMalV5TVRBMk9VTXdMamcyTVRNMU5TQXdMalEyT1RFeE55QXdMamd4T1RJek9TQXdMalF5TnpBd01pQXdMamMyTnpJNE5pQXdMalF5TnpBd01rTXdMamN4TlRNek5DQXdMalF5TnpBd01pQXdMalkzTXpJeE9DQXdMalEyT1RFeE55QXdMalkzTXpJeE9DQXdMalV5TVRBMk9VTXdMalkzTXpJeE9DQXdMalUzTXpBeU1TQXdMamN4TlRNek5DQXdMall4TlRFek55QXdMamMyTnpJNE5pQXdMall4TlRFek4xb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXpYMnhwYm1WaGNpa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU5UVWlJR1E5SWswd0xqa3lOVEE1TkNBd0xqVTRORFF6T0V3d0xqa3dOelkzTkNBd0xqVTNOVGszTjB3d0xqZzVNamMwTXlBd0xqVTJPREF4TkVnd0xqZzRPVGMxTjB3d0xqZzNOamd4TmlBd0xqVTFOelUyTWtnd0xqZzNNek16TWt3d0xqZzFOemt3TXlBd0xqVTBOell3TjBNd0xqZzFNalUxT1NBd0xqVTJOVGt6TkNBd0xqZzBNVE0zTXlBd0xqVTRNakF4TXlBd0xqZ3lOakExSURBdU5Ua3pNemszUXpBdU9ETXlNREl5SURBdU5UazNNemM1SURBdU9ETTRORGt6SURBdU5qQXdPRFl6SURBdU9EUTBPVFl6SURBdU5qQTBNelEzVERBdU9EUTRPVFExSURBdU5qQTJPRE0yVERBdU9EWTJNelkwSURBdU5qRTJNamt5VERBdU9UQTVNVFk0SURBdU5qTTROamxETUM0NU1UVXhPVGtnTUM0Mk1qQTJNVFVnTUM0NU1qQXdNakVnTUM0Mk1ESXhOVGdnTUM0NU1qTTJNREVnTUM0MU9ETTBORE5NTUM0NU1qVXdPVFFnTUM0MU9EUTBNemhhSWlCbWFXeHNQU0lqUmpKR01rWXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5TnprMU5UTWdNQzQyTWpjM01EZERNQzR6TlRRMU9UVWdNQzQyTWpjM01EY2dNQzQwTVRVME1qa2dNQzQxTmpZNE56UWdNQzQwTVRVME1qa2dNQzQwT1RFNE16SkRNQzQwTVRVME1qa2dNQzQwTVRZM09TQXdMak0xTkRVNU5TQXdMak0xTlRrMU55QXdMakkzT1RVMU15QXdMak0xTlRrMU4wTXdMakl3TkRVeE1TQXdMak0xTlRrMU55QXdMakUwTXpZM055QXdMalF4TmpjNUlEQXVNVFF6TmpjM0lEQXVORGt4T0RNeVF6QXVNVFF6TmpjM0lEQXVOVFkyT0RjMElEQXVNakEwTlRFeElEQXVOakkzTnpBM0lEQXVNamM1TlRVeklEQXVOakkzTnpBM1dpSWdabWxzYkQwaWRYSnNLQ053WVdsdWREUmZiR2x1WldGeUtTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFkxT0RnNUlEQXVPREk0TnprMFF6QXVOakUwT0RFNElEQXVPREk0TnprMElEQXVOalUwTkRneklEQXVOemc1TVRNeElEQXVOalUwTkRneklEQXVOelF3TWpBelF6QXVOalUwTkRneklEQXVOamt4TWpjMUlEQXVOakUwT0RFNElEQXVOalV4TmpFeElEQXVOVFkxT0RnNUlEQXVOalV4TmpFeFF6QXVOVEUyT1RZZ01DNDJOVEUyTVRFZ01DNDBOemN5T1RVZ01DNDJPVEV5TnpVZ01DNDBOemN5T1RVZ01DNDNOREF5TURORE1DNDBOemN5T1RVZ01DNDNPRGt4TXpFZ01DNDFNVFk1TmlBd0xqZ3lPRGM1TkNBd0xqVTJOVGc0T1NBd0xqZ3lPRGM1TkZvaUlHWnBiR3c5SW5WeWJDZ2pjR0ZwYm5RMVgyeHBibVZoY2lraUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BISmhaR2xoYkVkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmNtRmthV0ZzSWlCamVEMGlNQ0lnWTNrOUlqQWlJSEk5SWpFaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUJuY21Ga2FXVnVkRlJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5UQTVNRGt5SURBdU5UQTNOakUxS1NCelkyRnNaU2d3TGpReU16QTRNU2tpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqRTRJaUJ6ZEc5d0xXTnZiRzl5UFNJak5VVkJNRVZHSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqRWlJSE4wYjNBdFkyOXNiM0k5SWlNd01EYzRSRFFpTHo0bUkzaGhPend2Y21Ga2FXRnNSM0poWkdsbGJuUStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTVY5c2FXNWxZWElpSUhneFBTSXdMakk0TURVME9DSWdlVEU5SWpBdU5qTXhNVGt4SWlCNE1qMGlNQzR5Tnprd05UVWlJSGt5UFNJd0xqUXpORFU1TlNJZ1ozSmhaR2xsYm5SVmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlQaVlqZUdFN1BITjBiM0FnYzNSdmNDMWpiMnh2Y2owaUkwTkRRME5EUXlJdlBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXhJaUJ6ZEc5d0xXTnZiRzl5UFNJalJrTkdRMFpESWk4K0ppTjRZVHM4TDJ4cGJtVmhja2R5WVdScFpXNTBQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERKZmJHbHVaV0Z5SWlCNE1UMGlNQzQxTmpVNE9Ea2lJSGt4UFNJd0xqZ3lPRGM1TkNJZ2VESTlJakF1TlRZMU9EZzVJaUI1TWowaU1DNDJOVEl4TURraUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTkRRME5EUTBNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwWkRSa05HUXlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5RelgyeHBibVZoY2lJZ2VERTlJakF1TnpZM01qZzJJaUI1TVQwaU1DNDJNVFEyTXpraUlIZ3lQU0l3TGpjMk56STROaUlnZVRJOUlqQXVOREkzTURBeUlpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpRME5EUTBORElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTkdRMFpEUmtNaUx6NG1JM2hoT3p3dmJHbHVaV0Z5UjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME5GOXNhVzVsWVhJaUlIZ3hQU0l3TGpJNE1EVTBPQ0lnZVRFOUlqQXVOak14TVRreElpQjRNajBpTUM0eU56a3dOVFVpSUhreVBTSXdMalF6TkRVNU5TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJME5EUTBORFF5SXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpSa05HUTBaRElpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREVmZiR2x1WldGeUlpQjRNVDBpTUM0MU5qVTRPRGtpSUhreFBTSXdMamd5T0RjNU5DSWdlREk5SWpBdU5UWTFPRGc1SWlCNU1qMGlNQzQyTlRJeE1Ea2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5EUTBORFEwTWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpEUmtOR1F5SXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakV4SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01UVXpPREE1SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c2tldGNoPTE7IiBwYXJlbnQ9IjE0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI1IiB5PSIxNzAiIHdpZHRoPSIxMDciIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEwOSIgdmFsdWU9IldWRCIgc3R5bGU9ImlyLnJlZj0zMmEwODVlZi1iNjg3LTQ3N2MtYTYwZi0xMWEwY2U3ODk5NDE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVdJTkRPV1MtVk07aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMamN4T0RneU1TQXdMalV3TkRBeU5WWXdMakkyTnpVM09Fd3dMalF4TVRBeE1TQXdMalEwTnpFek5GWXdMamd3TmpJME5Vd3dMalV5TURBMklEQXVOelF5TWpkV01DNDFNRFF3TWpWSU1DNDNNVGc0TWpGYUlpQm1hV3hzUFNJak1EQTNPRVEwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M01UZzRPVEVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0ME5EZzFNVFpNTUM0eE1ETXlOekVnTUM0eU5qYzVNelJNTUM0ME1URXdPREVnTUM0d09EZ3pOemc1VERBdU56RTRPRGt4SURBdU1qWTNPVE0wV2lJZ1ptbHNiRDBpSXpnelFqbEdPU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRFeE1EZ3hJREF1TkRRNE1UWldNQzQ0TURZeU5EVk1NQzR4TURNeU56RWdNQzQyTWpVMk5qTldNQzR5TmpjMU56aE1NQzQwTVRFd09ERWdNQzQwTkRneE5sb2lJR1pwYkd3OUlpTTFSVUV3UlVZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRXdNekkzTVNBd0xqWXlOVGM1Tmt3d0xqUXhNVEE0TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zT1V3d0xqRXdNekkzTVNBd0xqWXlOVGM1TmxvaUlHWnBiR3c5SWlNNE0wSTVSamtpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNakF3TmlBd0xqVXhNRFV4TTB3d0xqUXhNVEF4TVNBd0xqUTBOekkyTmxZd0xqZ3dOak0zTjB3d0xqVXlNREEySURBdU56UXlOREF4VmpBdU5URXdOVEV6V2lJZ1ptbHNiRDBpSXpWRlFUQkZSaUl2UGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNelV4TlRZZ01DNDFNVGsxTXpGSU1DNDJPRGd5VmpBdU5qY3lOVGMyU0RBdU5UTTFNVFUyVmpBdU5URTVOVE14V2lJZ1ptbHNiRDBpSTBZek5UTXlOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpBek5UVXlJREF1TlRFNU5UTXhTREF1T0RVMk5Ua3pWakF1TmpjeU5UYzJTREF1TnpBek5UVXlWakF1TlRFNU5UTXhXaUlnWm1sc2JEMGlJemd4UWtNd05pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVE0xTVRVMklEQXVOamczTlVnd0xqWTRPREpXTUM0NE5EQTFORFpJTUM0MU16VXhOVFpXTUM0Mk9EYzFXaUlnWm1sc2JEMGlJekExUVRaR01DSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekF6TlRVeUlEQXVOamczTlVnd0xqZzFOalU1TTFZd0xqZzBNRFUwTmtnd0xqY3dNelUxTWxZd0xqWTROelZhSWlCbWFXeHNQU0lqUmtaQ1FUQTRJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU16VXlJaUJvWldsbmFIUTlJakF1TXpVeU1EQXlJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzQxTVRrNU5UZ2dNQzQxTURRek9UVXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2dyYWRpZW50Q29sb3I9I2ZmZmZmZjsiIHBhcmVudD0iMTQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzA0IiB5PSIxODAuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzOSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNDQ0U1RkY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9I2RiZWFmNztzaGFwZT1mbGV4QXJyb3c7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDkiIHRhcmdldD0iMzAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjE1OC45MjcyNTE3MzIxMDE3IiB5PSI1NC41IiBhcz0ic291cmNlUG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNTIiIHZhbHVlPSJQdWJsaWMiIHN0eWxlPSJpci5yZWY9NjM3NmQ1M2UtNjQ2MS00MTJiLThlMDQtN2IzZmUyYjM5N2RlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM0NjQ5NUQ7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FO3NrZXRjaD0xOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI2MCIgeT0iLTc1IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjUxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVlBOIEdhdGV3YXkiIGlkPSI0NyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPThjODQxYjY2LTkzYjMtNDhjMy1hOWExLWI0MTkwZDY2YTQ2Mjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NSUNST1NPRlQtQVpVUkUtVlBOLUdXO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOemN3TURnMUlEQXVORGcyTURJM1NEQXVOekkxTmpBeFZqQXVNelV3TnprNFF6QXVOekkxT1RnM0lEQXVNamczTWpnMElEQXVOekF5TXpVeUlEQXVNakkxT1RFeklEQXVOalU1TXpJZ01DNHhOemcyT0RoRE1DNDJNemt4T1RNZ01DNHhOVFUxTkRVZ01DNDJNVFF5TURZZ01DNHhNemNnTUM0MU9EWXdPVElnTUM0eE1qUXpNemxETUM0MU5UYzVOemtnTUM0eE1URTJOemdnTUM0MU1qYzBNVEVnTUM0eE1EVXlNRFFnTUM0ME9UWTFNU0F3TGpFd05UTTJOa013TGpRMk5UTXdPU0F3TGpFd05EazBPQ0F3TGpRek5ETTVOeUF3TGpFeE1USTVOeUF3TGpRd05UazFOaUF3TGpFeU16azJOME13TGpNM056VXhOaUF3TGpFek5qWXpOeUF3TGpNMU1qSTBNaUF3TGpFMU5UTXhOeUF3TGpNek1Ua3lJREF1TVRjNE5qZzRRekF1TWpnNE5UZzJJREF1TWpJMU56TXhJREF1TWpZME9UQTFJREF1TWpnM01qSXpJREF1TWpZMU5qTTVJREF1TXpVd056azRWakF1TkRnMk1ESTNTREF1TWpJNU5qQTNRekF1TWpJeE5UQXpJREF1TkRnMk1UUWdNQzR5TVRNM05qSWdNQzQwT0Rrek5qZ2dNQzR5TURnd016RWdNQzQwT1RVd01qVkRNQzR5TURJeU9Ua2dNQzQxTURBMk9ESWdNQzR4T1Rrd01qa2dNQzQxTURnek1qSWdNQzR4T1RnNU1UUWdNQzQxTVRZek1qRldNQzQ0TmpjMU5qVkRNQzR4T1Rrd01qa2dNQzQ0TnpVMU5qVWdNQzR5TURJeU9Ua2dNQzQ0T0RNeU1EUWdNQzR5TURnd016RWdNQzQ0T0RnNE5qRkRNQzR5TVRNM05qSWdNQzQ0T1RRMU1UZ2dNQzR5TWpFMU1ETWdNQzQ0T1RjM05EY2dNQzR5TWprMk1EY2dNQzQ0T1RjNE5rZ3dMamMzTURBNE5VTXdMamMzT0RJek1pQXdMamc1TnpjMUlEQXVOemcyTURJeElEQXVPRGswTlRNMklEQXVOemt4T0RJMElEQXVPRGc0T0RreFF6QXVOemszTmpJM0lEQXVPRGd6TWpRMUlEQXVPREF3T1RrMUlEQXVPRGMxTmpBMElEQXVPREF4TWpJeklEQXVPRFkzTlRZMVZqQXVOVEUyTXpJeFF6QXVPREF3T1RrMUlEQXVOVEE0TWpneUlEQXVOemszTmpJM0lEQXVOVEF3TmpReUlEQXVOemt4T0RJMElEQXVORGswT1RrMlF6QXVOemcyTURJeElEQXVORGc1TXpVZ01DNDNOemd5TXpJZ01DNDBPRFl4TXpjZ01DNDNOekF3T0RVZ01DNDBPRFl3TWpkV01DNDBPRFl3TWpkYVRUQXVOakl3TVRjMUlEQXVORGcyTURJM1NEQXVNemN5T0RRMVZqQXVNelE0TmpBeVF6QXVNemN6TWpRMUlEQXVNekV6TkRVZ01DNHpPRGN3TmpVZ01DNHlOemszTkNBd0xqUXhNVFUwTmlBd0xqSTFOREl3TmtNd0xqUXlNVGszSURBdU1qUXlOREV5SURBdU5ETTBPREU1SURBdU1qTXlPVFEwSURBdU5EUTVNak01SURBdU1qSTJORE0wUXpBdU5EWXpOalU1SURBdU1qRTVPVEl6SURBdU5EYzVNekU0SURBdU1qRTJOVEU1SURBdU5EazFNVGMxSURBdU1qRTJORFEzUXpBdU5URXhNRGt6SURBdU1qRTJOVFFnTUM0MU1qWTRNVElnTUM0eU1UazVOVElnTUM0MU5ERXpJREF1TWpJMk5EVTVRekF1TlRVMU56ZzVJREF1TWpNeU9UWTJJREF1TlRZNE56SXhJREF1TWpReU5ESXlJREF1TlRjNU1qVWdNQzR5TlRReU1EWkRNQzQxT0RRMU1qTWdNQzR5TmpBd09UUWdNQzQxT0RreU9EUWdNQzR5TmpZME1Ea2dNQzQxT1RNME9EUWdNQzR5TnpNd09EVldNQzR5TnpNd09EVkRNQzQyTVRBeE5qa2dNQzR5T1RRM05EUWdNQzQyTVRrMk5EZ2dNQzR6TWpBNU56SWdNQzQyTWpBMk1Ua2dNQzR6TkRneE5qTk1NQzQyTWpBeE56VWdNQzQwT0RZd01qZGFJaUJtYVd4c1BTSjFjbXdvSTNCaGFXNTBNRjlzYVc1bFlYSXBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTWpVMU56a2dNQzQwT0RZd09EUklNQzQzTnpBd05qTkRNQzQzTnpneU1TQXdMalE0TmpFNU5DQXdMamM0TlRrNU9TQXdMalE0T1RRd09DQXdMamM1TVRnd01pQXdMalE1TlRBMU0wTXdMamM1TnpZd05TQXdMalV3TURZNU9TQXdMamd3TURrM015QXdMalV3T0RNMElEQXVPREF4TWpBeUlEQXVOVEUyTXpjNVZqQXVPRFkzTmpJelF6QXVPREF3T1RjeklEQXVPRGMxTmpZeUlEQXVOemszTmpBMUlEQXVPRGd6TXpBeUlEQXVOemt4T0RBeUlEQXVPRGc0T1RRNFREQXVNakE0TURBNElEQXVORGsxTURnelF6QXVNakV6TnpNNUlEQXVORGc1TkRJMklEQXVNakl4TkRnZ01DNDBPRFl4T1RjZ01DNHlNamsxT0RRZ01DNDBPRFl3T0RSSU1DNHlOalUyTVRaSU1DNHpOekk0TWpKSU1DNDJNakF4TlRKSU1DNDNNalUxTnpsYUlpQm1hV3hzUFNJak5UQkZOa1pHSWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMaklpSUdROUlrMHdMamN5TlRZd05TQXdMalE0TmpNeU9FZ3dMamMzTURBNE9VTXdMamMzT0RJek55QXdMalE0TmpRek9DQXdMamM0TmpBeU5pQXdMalE0T1RZMU1pQXdMamM1TVRneU9TQXdMalE1TlRJNU4wd3dMakl3T0RBek1TQXdMamc0T1RFMk0wTXdMakl3TWpJNU9TQXdMamc0TXpVd05pQXdMakU1T1RBeU9TQXdMamczTlRnMk5pQXdMakU1T0RreE5DQXdMamcyTnpnMk4xWXdMalV4TmpZeU0wTXdMakU1T1RBeU9TQXdMalV3T0RZeU5DQXdMakl3TWpJNU9TQXdMalV3TURrNE5DQXdMakl3T0RBek1TQXdMalE1TlRNeU4wTXdMakl4TXpjMk1pQXdMalE0T1RZM0lEQXVNakl4TlRBeklEQXVORGcyTkRReUlEQXVNakk1TmpBNElEQXVORGcyTXpJNFNEQXVNalkxTmpSSU1DNHpOekk0TkRaSU1DNDJNakF4TnpoSU1DNDNNalUyTURWYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRRMk1UWXlJREF1TlRjeU5EZzNUREF1TkRrNU5UTTBJREF1TlRFNE5UVTRRekF1TlRBd01EazFJREF1TlRFNE1EZ3pJREF1TlRBd09EQXpJREF1TlRFM09ESXlJREF1TlRBeE5UTTFJREF1TlRFM09ESXlRekF1TlRBeU1qWTNJREF1TlRFM09ESXlJREF1TlRBeU9UYzJJREF1TlRFNE1EZ3pJREF1TlRBek5UTTNJREF1TlRFNE5UVTRUREF1TlRVMk5EWTBJREF1TlRjeU5EZzNRekF1TlRVMk9ETXhJREF1TlRjeU56TXpJREF1TlRVM01UTXlJREF1TlRjek1EWTNJREF1TlRVM016UWdNQzQxTnpNME5UbERNQzQxTlRjMU5EZ2dNQzQxTnpNNE5URWdNQzQxTlRjMk5UY2dNQzQxTnpReU9Ea2dNQzQxTlRjMk5UY2dNQzQxTnpRM016UkRNQzQxTlRjMk5UY2dNQzQxTnpVeE56a2dNQzQxTlRjMU5EZ2dNQzQxTnpVMk1UY2dNQzQxTlRjek5DQXdMalUzTmpBd09VTXdMalUxTnpFek1pQXdMalUzTmpRd01pQXdMalUxTmpnek1TQXdMalUzTmpjek5TQXdMalUxTmpRMk5DQXdMalUzTmprNE1VZ3dMalV5TlRNelF6QXVOVEkwTmpJeklEQXVOVGMyT1RneElEQXVOVEl6T1RRMElEQXVOVGMzTWpZMklEQXVOVEl6TkRReklEQXVOVGMzTnpjeFF6QXVOVEl5T1RReklEQXVOVGM0TWpjM0lEQXVOVEl5TmpZeUlEQXVOVGM0T1RZeklEQXVOVEl5TmpZeUlEQXVOVGM1TmpjNFZqQXVOalE0T0RnM1F6QXVOVEl5TmpZeUlEQXVOalE1TmpBeUlEQXVOVEl5TXpnZ01DNDJOVEF5T0RnZ01DNDFNakU0T0NBd0xqWTFNRGM1TTBNd0xqVXlNVE00SURBdU5qVXhNams1SURBdU5USXdOekF4SURBdU5qVXhOVGd6SURBdU5URTVPVGt6SURBdU5qVXhOVGd6U0RBdU5EZzBPRFUyUXpBdU5EZzBORGc1SURBdU5qVXhOalk1SURBdU5EZzBNVEExSURBdU5qVXhOalU1SURBdU5EZ3pOelF5SURBdU5qVXhOVFUwUXpBdU5EZ3pNemM1SURBdU5qVXhORFE1SURBdU5EZ3pNRFE1SURBdU5qVXhNalV6SURBdU5EZ3lOemd5SURBdU5qVXdPVGd6UXpBdU5EZ3lOVEUxSURBdU5qVXdOekV6SURBdU5EZ3lNeklnTUM0Mk5UQXpOemtnTUM0ME9ESXlNVFlnTUM0Mk5UQXdNVE5ETUM0ME9ESXhNVElnTUM0Mk5EazJORFlnTUM0ME9ESXhNRE1nTUM0Mk5Ea3lOVGdnTUM0ME9ESXhPRGdnTUM0Mk5EZzRPRGRXTUM0MU56azJOemhETUM0ME9ESXdPQ0F3TGpVM09Ea3lOQ0F3TGpRNE1UY3dOU0F3TGpVM09ESXpOU0F3TGpRNE1URXpNeUF3TGpVM056Y3pPVU13TGpRNE1EVTJJREF1TlRjM01qUXpJREF1TkRjNU9ESTVJREF1TlRjMk9UYzBJREF1TkRjNU1EYzFJREF1TlRjMk9UZ3hTREF1TkRRM09UUXhRekF1TkRRM05EUTBJREF1TlRjMk9UUXpJREF1TkRRMk9UWTNJREF1TlRjMk56WTFJREF1TkRRMk5UWTFJREF1TlRjMk5EWTJRekF1TkRRMk1UWXpJREF1TlRjMk1UWTRJREF1TkRRMU9EVXhJREF1TlRjMU56WXlJREF1TkRRMU5qWTJJREF1TlRjMU1qazBRekF1TkRRMU5EZ3hJREF1TlRjME9ESTJJREF1TkRRMU5ESTVJREF1TlRjME16RTFJREF1TkRRMU5URTNJREF1TlRjek9ERTVRekF1TkRRMU5qQTBJREF1TlRjek16SXpJREF1TkRRMU9ESTRJREF1TlRjeU9EWXlJREF1TkRRMk1UWXlJREF1TlRjeU5EZzNWakF1TlRjeU5EZzNXazB3TGpVMU5qQXhPU0F3TGpneE9EYzJNMHd3TGpVd016QTVNaUF3TGpnM01qSTBNa013TGpVd01qZzBNU0F3TGpnM01qVXlPU0F3TGpVd01qVXpOQ0F3TGpnM01qYzFPU0F3TGpVd01qRTRPQ0F3TGpnM01qa3hOa013TGpVd01UZzBNeUF3TGpnM016QTNOQ0F3TGpVd01UUTJPU0F3TGpnM016RTFOU0F3TGpVd01UQTVJREF1T0Rjek1UVTFRekF1TlRBd056RXlJREF1T0Rjek1UVTFJREF1TlRBd016TTRJREF1T0Rjek1EYzBJREF1TkRrNU9Ua3pJREF1T0RjeU9URTJRekF1TkRrNU5qUTNJREF1T0RjeU56VTVJREF1TkRrNU16TTVJREF1T0RjeU5USTVJREF1TkRrNU1EZzVJREF1T0RjeU1qUXlUREF1TkRRMk1UWXlJREF1T0RFNE56WXpRekF1TkRRMU56azFJREF1T0RFNE5URTNJREF1TkRRMU5EazBJREF1T0RFNE1UZ3pJREF1TkRRMU1qZzJJREF1T0RFM056a3hRekF1TkRRMU1EYzNJREF1T0RFM016azVJREF1TkRRME9UWTRJREF1T0RFMk9UWXhJREF1TkRRME9UWTRJREF1T0RFMk5URTJRekF1TkRRME9UWTRJREF1T0RFMk1EY3hJREF1TkRRMU1EYzNJREF1T0RFMU5qTXpJREF1TkRRMU1qZzJJREF1T0RFMU1qUXhRekF1TkRRMU5EazBJREF1T0RFME9EUTVJREF1TkRRMU56azFJREF1T0RFME5URTFJREF1TkRRMk1UWXlJREF1T0RFME1qWTVTREF1TkRjM01qazFRekF1TkRjNE1EVWdNQzQ0TVRReU56Y2dNQzQwTnpnM09ERWdNQzQ0TVRRd01EZ2dNQzQwTnprek5UUWdNQzQ0TVRNMU1USkRNQzQwTnprNU1qWWdNQzQ0TVRNd01UWWdNQzQwT0RBek1ERWdNQzQ0TVRJek1qY2dNQzQwT0RBME1Ea2dNQzQ0TVRFMU56SldNQzQzTkRFNU1UUkRNQzQwT0RBME1Ea2dNQzQzTkRFeE9Ua2dNQzQwT0RBMk9TQXdMamMwTURVeE15QXdMalE0TVRFNUlEQXVOelF3TURBM1F6QXVORGd4TmpreElEQXVOek01TlRBeUlEQXVORGd5TXpjZ01DNDNNemt5TVRnZ01DNDBPRE13TnpjZ01DNDNNemt5TVRoSU1DNDFNVFU1T1VNd0xqVXhOalk1T0NBd0xqY3pPVEl4T0NBd0xqVXhOek0zTnlBd0xqY3pPVFV3TWlBd0xqVXhOemczTnlBd0xqYzBNREF3TjBNd0xqVXhPRE0zT0NBd0xqYzBNRFV4TXlBd0xqVXhPRFkxT1NBd0xqYzBNVEU1T1NBd0xqVXhPRFkxT1NBd0xqYzBNVGt4TkZZd0xqZ3hNVFUzTWtNd0xqVXhPRFkxT1NBd0xqZ3hNakk0TnlBd0xqVXhPRGswSURBdU9ERXlPVGN6SURBdU5URTVORFFnTUM0NE1UTTBOemxETUM0MU1UazVOREVnTUM0NE1UTTVPRFVnTUM0MU1qQTJNaUF3TGpneE5ESTJPU0F3TGpVeU1UTXlOeUF3TGpneE5ESTJPVWd3TGpVMU1qUTJNVU13TGpVMU16QTFNU0F3TGpneE16YzVNaUF3TGpVMU16Z3dOQ0F3TGpneE16VTNNU0F3TGpVMU5EVTFOU0F3TGpneE16WTFOa013TGpVMU5UTXdOU0F3TGpneE16YzBJREF1TlRVMU9Ua3lJREF1T0RFME1USXlJREF1TlRVMk5EWTBJREF1T0RFME56RTRRekF1TlRVMk9UTTJJREF1T0RFMU16RTBJREF1TlRVM01UVTBJREF1T0RFMk1EYzFJREF1TlRVM01EY3hJREF1T0RFMk9ETTBRekF1TlRVMk9UZzNJREF1T0RFM05Ua3lJREF1TlRVMk5qQTVJREF1T0RFNE1qZzJJREF1TlRVMk1ERTVJREF1T0RFNE56WXpWakF1T0RFNE56WXpXazB3TGpNME5qazNPU0F3TGpjME9URXdOVll3TGpjeE56WTBOa013TGpNME5qazNPU0F3TGpjeE5qa3pNU0F3TGpNME5qWTVPQ0F3TGpjeE5qSTBOU0F3TGpNME5qRTVOeUF3TGpjeE5UY3pPVU13TGpNME5UWTVOeUF3TGpjeE5USXpOQ0F3TGpNME5UQXhPQ0F3TGpjeE5EazFJREF1TXpRME16RWdNQzQzTVRRNU5VZ3dMakkzTnpFMVF6QXVNamMyTkRReklEQXVOekUwT1RVZ01DNHlOelUzTmpRZ01DNDNNVFEyTmpZZ01DNHlOelV5TmpNZ01DNDNNVFF4TmtNd0xqSTNORGMyTXlBd0xqY3hNelkxTkNBd0xqSTNORFE0TWlBd0xqY3hNamsyT0NBd0xqSTNORFE0TWlBd0xqY3hNakkxTTFZd0xqWTRNRE0wTlVNd0xqSTNOREl5TlNBd0xqWTNPVGt3T0NBd0xqSTNOREE1TmlBd0xqWTNPVFF3TnlBd0xqSTNOREV4SURBdU5qYzRPRGs1UXpBdU1qYzBNVEl6SURBdU5qYzRNemt4SURBdU1qYzBNamM0SURBdU5qYzNPRGs0SURBdU1qYzBOVFUzSURBdU5qYzNORGMxUXpBdU1qYzBPRE0ySURBdU5qYzNNRFV5SURBdU1qYzFNakkzSURBdU5qYzJOekU0SURBdU1qYzFOamcySURBdU5qYzJOVEZETUM0eU56WXhORFVnTUM0Mk56WXpNRElnTUM0eU56WTJOVElnTUM0Mk56WXlNeUF3TGpJM056RTFJREF1TmpjMk16QXhTREF1TXpRME16RkRNQzR6TkRVd01UZ2dNQzQyTnpZek1ERWdNQzR6TkRVMk9UY2dNQzQyTnpZd01UWWdNQzR6TkRZeE9UY2dNQzQyTnpVMU1URkRNQzR6TkRZMk9UZ2dNQzQyTnpVd01EVWdNQzR6TkRZNU56a2dNQzQyTnpRek1Ua2dNQzR6TkRZNU56a2dNQzQyTnpNMk1EUldNQzQyTkRJeE5EWkRNQzR6TkRjd016VWdNQzQyTkRFMU9Ua2dNQzR6TkRjeU16RWdNQzQyTkRFd056Y2dNQzR6TkRjMU5EZ2dNQzQyTkRBMk16SkRNQzR6TkRjNE5qVWdNQzQyTkRBeE9EWWdNQzR6TkRneU9UTWdNQzQyTXprNE16SWdNQzR6TkRnM09EY2dNQzQyTXprMk1EVkRNQzR6TkRreU9ESWdNQzQyTXprek56Y2dNQzR6TkRrNE1qY2dNQzQyTXpreU9EVWdNQzR6TlRBek5qZ2dNQzQyTXprek16ZERNQzR6TlRBNU1Ea2dNQzQyTXprek9EZ2dNQzR6TlRFME1qY2dNQzQyTXprMU9ESWdNQzR6TlRFNE56RWdNQzQyTXprNE9UbE1NQzQwTURRM09UZ2dNQzQyT1RNNE1qZERNQzQwTURVeU16WWdNQzQyT1RRek1qSWdNQzQwTURVME56Z2dNQzQyT1RRNU5qSWdNQzQwTURVME56Z2dNQzQyT1RVMk1qVkRNQzQwTURVME56Z2dNQzQyT1RZeU9EZ2dNQzQwTURVeU16WWdNQzQyT1RZNU1qZ2dNQzQwTURRM09UZ2dNQzQyT1RjME1qTk1NQzR6TlRFNE56RWdNQzQzTlRFek5USkRNQzR6TlRFME1qY2dNQzQzTlRFMk5qZ2dNQzR6TlRBNU1Ea2dNQzQzTlRFNE5qSWdNQzR6TlRBek5qZ2dNQzQzTlRFNU1UUkRNQzR6TkRrNE1qY2dNQzQzTlRFNU5qVWdNQzR6TkRreU9ESWdNQzQzTlRFNE56TWdNQzR6TkRnM09EY2dNQzQzTlRFMk5EWkRNQzR6TkRneU9UTWdNQzQzTlRFME1UZ2dNQzR6TkRjNE5qVWdNQzQzTlRFd05qUWdNQzR6TkRjMU5EZ2dNQzQzTlRBMk1UaERNQzR6TkRjeU16RWdNQzQzTlRBeE56TWdNQzR6TkRjd016VWdNQzQzTkRrMk5URWdNQzR6TkRZNU56a2dNQzQzTkRreE1EVldNQzQzTkRreE1EVmFUVEF1TmpVMU1qQXlJREF1TmpReU1UUTJWakF1Tmpjek5qQTBRekF1TmpVMU1qQXlJREF1TmpjME16RTVJREF1TmpVMU5EZ3pJREF1TmpjMU1EQTFJREF1TmpVMU9UZzBJREF1TmpjMU5URXhRekF1TmpVMk5EZzBJREF1TmpjMk1ERTJJREF1TmpVM01UWXpJREF1TmpjMk16QXhJREF1TmpVM09EY3hJREF1TmpjMk16QXhTREF1TnpJMk16WTFRekF1TnpJMk16WTFJREF1TmpjMk16QXhJREF1TnpJNU5EYzRJREF1TmpjMk16QXhJREF1TnpJNU5EYzRJREF1TmpjNE9UazNWakF1TnpFeU1qVXpRekF1TnpJNU16Y3hJREF1TnpFek1EQTNJREF1TnpJNE9UazJJREF1TnpFek5qazNJREF1TnpJNE5ESXpJREF1TnpFME1Ua3lRekF1TnpJM09EVWdNQzQzTVRRMk9EZ2dNQzQzTWpjeE1Ua2dNQzQzTVRRNU5UY2dNQzQzTWpZek5qVWdNQzQzTVRRNU5VZ3dMalkxTnpnM01VTXdMalkxTnpVeUlEQXVOekUwT1RVZ01DNDJOVGN4TnpNZ01DNDNNVFV3TVRrZ01DNDJOVFk0TlNBd0xqY3hOVEUxTlVNd0xqWTFOalV5TmlBd0xqY3hOVEk1SURBdU5qVTJNak15SURBdU56RTFORGc1SURBdU5qVTFPVGcwSURBdU56RTFOek01UXpBdU5qVTFOek0ySURBdU56RTFPVGtnTUM0Mk5UVTFNemtnTUM0M01UWXlPRGNnTUM0Mk5UVTBNRFVnTUM0M01UWTJNVFJETUM0Mk5UVXlOekVnTUM0M01UWTVOREVnTUM0Mk5UVXlNRElnTUM0M01UY3lPVElnTUM0Mk5UVXlNRElnTUM0M01UYzJORFpXTUM0M05Ea3hNRFZETUM0Mk5UVXlOVEVnTUM0M05EazJORFVnTUM0Mk5UVXhNemdnTUM0M05UQXhPRGdnTUM0Mk5UUTROemNnTUM0M05UQTJOak5ETUM0Mk5UUTJNVFlnTUM0M05URXhNemNnTUM0Mk5UUXlNVGtnTUM0M05URTFNakVnTUM0Mk5UTTNNemdnTUM0M05URTNOalJETUM0Mk5UTXlOVGdnTUM0M05USXdNRGNnTUM0Mk5USTNNVFlnTUM0M05USXdPVGNnTUM0Mk5USXhPRE1nTUM0M05USXdNalJETUM0Mk5URTJOVEVnTUM0M05URTVOU0F3TGpZMU1URTFNeUF3TGpjMU1UY3hOaUF3TGpZMU1EYzFOQ0F3TGpjMU1UTTFNa3d3TGpVNU56Z3lOeUF3TGpZNU56UXlNMVl3TGpZNU16Z3lOMHd3TGpZMU1EYzFOQ0F3TGpZek9UZzVPVU13TGpZMU1EYzFOQ0F3TGpZek9UZzVPU0F3TGpZMU5USXdNaUF3TGpZek9UUTBPU0F3TGpZMU5USXdNaUF3TGpZME1qRTBObFl3TGpZME1qRTBObG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOFpHVm1jejRtSTNoaE96eHNhVzVsWVhKSGNtRmthV1Z1ZENCcFpEMGljR0ZwYm5Rd1gyeHBibVZoY2lJZ2VERTlJakF1TkRneU1qYzFJaUI1TVQwaUxUQXVNak0yTmpVNElpQjRNajBpTUM0MU1EVXlORE1pSUhreVBTSXdMams0TlRZNE1pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqSXlJaUJ6ZEc5d0xXTnZiRzl5UFNJak16SkVORVkxSWk4K0ppTjRZVHM4YzNSdmNDQnZabVp6WlhROUlqQXVORGNpSUhOMGIzQXRZMjlzYjNJOUlpTXpNVVF4UmpNaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNQzQyTXlJZ2MzUnZjQzFqYjJ4dmNqMGlJekpGUXpsRlFpSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l3TGpjM0lpQnpkRzl3TFdOdmJHOXlQU0lqTWpsQ1FVUkZJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpBdU9Ea2lJSE4wYjNBdFkyOXNiM0k5SWlNeU1rRTFRMElpTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpFNU9FRkNNeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1MiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMSIgeT0iMjQuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48b2JqZWN0IGxhYmVsPSJPa3RhIC0gTUZBIiBpZD0iMTIiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zZmQzYmQyYi05N2JkLTQzNDctOTdhMi0zODFmOGFkMGRmOGI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jNzg4QUEzO2ZpbGxDb2xvcj0jQjJDOUFCO2ZvbnRDb2xvcj0jNDY0OTVEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1MiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNC41IiB5PSIzODYiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNjkiIHZhbHVlPSImbHQ7ZGl2PkEzJmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM4MmIzNjY7ZmlsbENvbG9yPSNkNWU4ZDQ7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9IjUyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0LjUiIHk9IjI5NCIgd2lkdGg9IjIzIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9Izc4OEFBMztzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTsiIHBhcmVudD0iMSIgc291cmNlPSI3NCIgdGFyZ2V0PSIyOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jODJiMzY2O3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7c3RhcnRBcnJvdz1ub25lO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjY3IiB0YXJnZXQ9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTUiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzQ2NDk1RDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7c2tldGNoPTE7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDAxIiB5PSIzMjIiIHdpZHRoPSIyNjciIGhlaWdodD0iMTIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJIRUMiIGlkPSI1NCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTc3NjM4N2I4LTcxODQtNDE0ZS04MTgzLTNkNmQ2YmMxOWZmMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM3ODhBQTM7ZmlsbENvbG9yPSNCMkM5QUI7Zm9udENvbG9yPSM0NjQ5NUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NvZnQtYXp1cmUtd2ViLWFwcHM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTmpnNE1qUWdNQzQ0TkRJeE1qZERNQzQyT0RBeE1UZ2dNQzQ1TVRBNE9Ua2dNQzQxTmpjM01qWWdNQzQ1TkRFMk1UY2dNQzQwTlRZek56TWdNQzQ1TWpjMU1qTkRNQzR6TkRVd01Ua2dNQzQ1TVRNME1qa2dNQzR5TkRNNE1qVWdNQzQ0TlRVMk56Y2dNQzR4TnpVd05USWdNQzQzTmpZNU56SkRNQzR4TURZeU56a2dNQzQyTnpneU5qZ2dNQzR3TnpVMU5qQTVJREF1TlRZMU9EYzJJREF1TURnNU5qVTFNU0F3TGpRMU5EVXlNME13TGpFd016YzBPU0F3TGpNME16RTJPU0F3TGpFMk1UVXdNU0F3TGpJME1UazNOaUF3TGpJMU1ESXdOeUF3TGpFM016SXdNMHd3TGpJMU5EWTROaUF3TGpFM01ESXhOME13TGpNME16a2dNQzR4TURNMk1qUWdNQzQwTlRVM05qZ2dNQzR3TnpRNE56azRJREF1TlRZMk1ETTBJREF1TURrd01qRTNOa013TGpZM05qTWdNQzR4TURVMU5UVWdNQzQzTnpZd056WWdNQzR4TmpNM016a2dNQzQ0TkRNM01qZ2dNQzR5TlRJeE5USkRNQzQ1TVRFek9ERWdNQzR6TkRBMU5qVWdNQzQ1TkRFME5UY2dNQzQwTlRJd09ERWdNQzQ1TWpjME16VWdNQzQxTmpJMU1qSkRNQzQ1TVRNME1UTWdNQzQyTnpJNU5qSWdNQzQ0TlRZME1qUWdNQzQzTnpNME1qVWdNQzQzTmpnNE1qUWdNQzQ0TkRJeE1qY2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYM0poWkdsaGJDa2lMejRtSTNoaE96eHdZWFJvSUc5d1lXTnBkSGs5SWpBdU5pSWdaRDBpVFRBdU16azBOVGcwSURBdU5ERTVOVE5ETUM0MU1UUXlORGtnTUM0ek1EVTNNVGtnTUM0Mk56STVNRE1nTUM0eU5ERTVOeklnTUM0NE16Z3dORFlnTUM0eU5ERXpORGhETUM0NE1UWXpOVE1nTUM0eU1UUTFNVE1nTUM0M09URTBORGNnTUM0eE9UQTBORE1nTUM0M05qTTRPRGNnTUM0eE5qazJOemhETUM0Mk9ETTFORGNnTUM0eE56UTJNelFnTUM0Mk1EUTJNalVnTUM0eE9UTXhORFFnTUM0MU16QTBOaUF3TGpJeU5EUXlOa013TGpRMU5ERXdNU0F3TGpJMU56SXlOU0F3TGpNNE5UQTJNaUF3TGpNd05EazBNeUF3TGpNeU56TTVNeUF3TGpNMk5EYzRNVU13TGpNMU5URXhNU0F3TGpNM05UTXdNaUF3TGpNM09EWTRNaUF3TGpNNU5EVXdPQ0F3TGpNNU5EVTROQ0F3TGpReE9UVXpWakF1TkRFNU5UTmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzQySWlCa1BTSk5NQzR4T0RRNU9EY2dNQzQxT0RrNE5EUkRNQzR4TmpjNE9EZ2dNQzQyTXpJeE9EVWdNQzR4TlRRd056Y2dNQzQyTnpVM09ERWdNQzR4TkRNMk56Y2dNQzQzTWpBeU5EVkRNQzR4TlRJNE5qWWdNQzQzTXpZeU1Ua2dNQzR4TmpNeE56Z2dNQzQzTlRFMU1qRWdNQzR4TnpRMU16VWdNQzQzTmpZd016UkRNQzR4T0RNME9UUWdNQzQzTnpjME9ESWdNQzR4T1RFNU5UVWdNQzQzT0RjNU16UWdNQzR5TURFNU1Ea2dNQzQzT1Rnek9EWkRNQzR5TVRNNU16VWdNQzQzTXpreE5EWWdNQzR5TXpFNU5EVWdNQzQyT0RFeU9DQXdMakkxTlRZMk1pQXdMall5TlRZM09VTXdMakl5T1RBNU5TQXdMall5TURrek5pQXdMakl3TkRVeE5DQXdMall3T0RRM01pQXdMakU0TkRrNE55QXdMalU0T1RnME5GWXdMalU0T1RnME5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalUxSWlCa1BTSk5NQzR5TXpNNE5qWWdNQzR6TmpNNE5UWkRNQzR5TVRZek1ESWdNQzR6TVRZM01qRWdNQzR5TURRM05qUWdNQzR5TmpjMU5UY2dNQzR4T1RrMU1qUWdNQzR5TVRjMU1qbERNQzR4TnpnMk16Y2dNQzR5TXprME5qWWdNQzR4TmpBeU56TWdNQzR5TmpNMk56TWdNQzR4TkRRM056VWdNQzR5T0RrMk9UZERNQzR4TlRBek9UUWdNQzR6TXpBd01EUWdNQzR4TlRrNE9UUWdNQzR6TmprMk56UWdNQzR4TnpNeE5EVWdNQzQwTURneE5UTkRNQzR4T0RnM05ERWdNQzR6T0RjNE9USWdNQzR5TURrNE1URWdNQzR6TnpJMU1qRWdNQzR5TXpNNE5qWWdNQzR6TmpNNE5UWldNQzR6TmpNNE5UWmFJaUJtYVd4c1BTSWpSakpHTWtZeUlpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlOemsxTlRNZ01DNDJNamMzTURkRE1DNHpOVFExT1RVZ01DNDJNamMzTURjZ01DNDBNVFUwTWprZ01DNDFOalk0TnpRZ01DNDBNVFUwTWprZ01DNDBPVEU0TXpKRE1DNDBNVFUwTWprZ01DNDBNVFkzT1NBd0xqTTFORFU1TlNBd0xqTTFOVGsxTnlBd0xqSTNPVFUxTXlBd0xqTTFOVGsxTjBNd0xqSXdORFV4TVNBd0xqTTFOVGsxTnlBd0xqRTBNelkzTnlBd0xqUXhOamM1SURBdU1UUXpOamMzSURBdU5Ea3hPRE15UXpBdU1UUXpOamMzSURBdU5UWTJPRGMwSURBdU1qQTBOVEV4SURBdU5qSTNOekEzSURBdU1qYzVOVFV6SURBdU5qSTNOekEzV2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERGZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzQxTlNJZ1pEMGlUVEF1TkRjM05qUTRJREF1TnpRd01qVTFRekF1TkRjM05qWTJJREF1TnpJNE5EVTJJREF1TkRnd01EVTFJREF1TnpFMk56Z3lJREF1TkRnME5qY3lJREF1TnpBMU9USTBRekF1TkRnNU1qZzVJREF1TmprMU1EWTFJREF1TkRrMk1EUWdNQzQyT0RVeU5EVWdNQzQxTURRMU1qUWdNQzQyTnpjd05EWkRNQzQwTlRnMk16a2dNQzQyTlRFNE9UWWdNQzQwTVRZeU9UVWdNQzQyTWpBM05qWWdNQzR6TnpnMk1ETWdNQzQxT0RRME56TkRNQzR6TlRnNU1EY2dNQzQyTURVM09ERWdNQzR6TXpJNU1qa2dNQzQyTWpBeU5UTWdNQzR6TURRME5ETWdNQzQyTWpVM09ESkRNQzR6TWpZNE9UY2dNQzQyTkRnM05qY2dNQzR6TlRFd01Ua2dNQzQyTnpBd05qRWdNQzR6TnpZMk1USWdNQzQyT0RrME9EbERNQzQwTURnME56a2dNQzQzTVRNMU5UTWdNQzQwTkRJMk5UY2dNQzQzTXpRek9UTWdNQzQwTnpnMk5ETWdNQzQzTlRFM01ETkRNQzQwTnpnd05qVWdNQzQzTkRjNU1USWdNQzQwTnpjM016TWdNQzQzTkRRd09EZ2dNQzQwTnpjMk5EZ2dNQzQzTkRBeU5UVmFJaUJtYVd4c1BTSWpSakpHTWtZeUlpOCtKaU40WVRzOGNHRjBhQ0J2Y0dGamFYUjVQU0l3TGpVMUlpQmtQU0pOTUM0M09URXlPVElnTUM0M05UQTFORFpETUM0M05EVXdOQ0F3TGpjMU1EVTNOQ0F3TGpZNU9EazBNaUF3TGpjME5USXlPU0F3TGpZMU16a3lNeUF3TGpjek5EWXhPVU13TGpZMU5ERTJPU0F3TGpjek5qUXpOaUF3TGpZMU5ERTJPU0F3TGpjek9ESTNOeUF3TGpZMU16a3lNeUF3TGpjME1EQTVORU13TGpZMU16azFOeUF3TGpjMU1UVTBOQ0F3TGpZMU1UY3pNaUF3TGpjMk1qZzRPU0F3TGpZME56TTNOeUF3TGpjM016UTNPVU13TGpZME16QXlNU0F3TGpjNE5EQTJPU0F3TGpZek5qWXlJREF1Tnprek5qazJJREF1TmpJNE5UUWdNQzQ0TURFNE1VTXdMalk0TkRVMU5TQXdMamd4TWprd09DQXdMamMwTVRjME1pQXdMamd4TmpreU1TQXdMamM1T0RjMU9DQXdMamd4TXpjMU5VTXdMamd5TURnM05TQXdMamM1TXpjMU1TQXdMamcwTURjek5pQXdMamMzTVRNNE55QXdMamcxTnprNE5pQXdMamMwTnpBMk1rTXdMamd6TlRnME1TQXdMamMwT1RVeUlEQXVPREV6TlRjeUlEQXVOelV3TmpneklEQXVOemt4TWpreUlEQXVOelV3TlRRMldpSWdabWxzYkQwaUkwWXlSakpHTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UWTFPRGc1SURBdU9ESTROemswUXpBdU5qRTBPREU0SURBdU9ESTROemswSURBdU5qVTBORGd6SURBdU56ZzVNVE14SURBdU5qVTBORGd6SURBdU56UXdNakF6UXpBdU5qVTBORGd6SURBdU5qa3hNamMxSURBdU5qRTBPREU0SURBdU5qVXhOakV4SURBdU5UWTFPRGc1SURBdU5qVXhOakV4UXpBdU5URTJPVFlnTUM0Mk5URTJNVEVnTUM0ME56Y3lPVFVnTUM0Mk9URXlOelVnTUM0ME56Y3lPVFVnTUM0M05EQXlNRE5ETUM0ME56Y3lPVFVnTUM0M09Ea3hNekVnTUM0MU1UWTVOaUF3TGpneU9EYzVOQ0F3TGpVMk5UZzRPU0F3TGpneU9EYzVORm9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF5WDJ4cGJtVmhjaWtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOeUlnWkQwaVRUQXVOamMwTnpVM0lEQXVOVEEwTVRneVF6QXVOamM1TVRVeElEQXVORGcwTnpFMElEQXVOamc1T0RFM0lEQXVORFkzTWpJM0lEQXVOekExTVRFM0lEQXVORFUwTkRFeFF6QXVOakl6TVRZMUlEQXVNemswT0RNMElEQXVOVFE0TmpReElEQXVNekkxTmpVM0lEQXVORGd6TVRNNElEQXVNalE0TXpVNVF6QXVORFEwT1RZMUlEQXVNakF6TlRNZ01DNDBNVEUyTURJZ01DNHhOVFE0TWlBd0xqTTRNelU1TmlBd0xqRXdNekF5TjBNd0xqTTJOVEF3TmlBd0xqRXdPRFl3TVNBd0xqTTBOamcyT1NBd0xqRXhOVFU0T1NBd0xqTXlPVE0wTmlBd0xqRXlNemt6TVVNd0xqTTFPVE14TnlBd0xqRTRNRE15TlNBd0xqTTVOVEU0TnlBd0xqSXpNek0zT1NBd0xqUXpOak0xTXlBd0xqSTRNakl3TTBNd0xqVXdOak15TVNBd0xqTTJOVGM0TkNBd0xqVTROalF3TWlBd0xqUTBNRE0wT1NBd0xqWTNORGMxTnlBd0xqVXdOREU0TWxZd0xqVXdOREU0TWxvaUlHWnBiR3c5SWlOR01rWXlSaklpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjMk56STROaUF3TGpZeE5URXpOME13TGpneE9USXpPU0F3TGpZeE5URXpOeUF3TGpnMk1UTTFOU0F3TGpVM016QXlNU0F3TGpnMk1UTTFOU0F3TGpVeU1UQTJPVU13TGpnMk1UTTFOU0F3TGpRMk9URXhOeUF3TGpneE9USXpPU0F3TGpReU56QXdNaUF3TGpjMk56STROaUF3TGpReU56QXdNa013TGpjeE5UTXpOQ0F3TGpReU56QXdNaUF3TGpZM016SXhPQ0F3TGpRMk9URXhOeUF3TGpZM016SXhPQ0F3TGpVeU1UQTJPVU13TGpZM016SXhPQ0F3TGpVM016QXlNU0F3TGpjeE5UTXpOQ0F3TGpZeE5URXpOeUF3TGpjMk56STROaUF3TGpZeE5URXpOMW9pSUdacGJHdzlJblZ5YkNnamNHRnBiblF6WDJ4cGJtVmhjaWtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOVFVpSUdROUlrMHdMamt5TlRBNU5DQXdMalU0TkRRek9Fd3dMamt3TnpZM05DQXdMalUzTlRrM04wd3dMamc1TWpjME15QXdMalUyT0RBeE5FZ3dMamc0T1RjMU4wd3dMamczTmpneE5pQXdMalUxTnpVMk1rZ3dMamczTXpNek1rd3dMamcxTnprd015QXdMalUwTnpZd04wTXdMamcxTWpVMU9TQXdMalUyTlRrek5DQXdMamcwTVRNM015QXdMalU0TWpBeE15QXdMamd5TmpBMUlEQXVOVGt6TXprM1F6QXVPRE15TURJeUlEQXVOVGszTXpjNUlEQXVPRE00TkRreklEQXVOakF3T0RZeklEQXVPRFEwT1RZeklEQXVOakEwTXpRM1REQXVPRFE0T1RRMUlEQXVOakEyT0RNMlREQXVPRFkyTXpZMElEQXVOakUyTWpreVREQXVPVEE1TVRZNElEQXVOak00TmpsRE1DNDVNVFV4T1RrZ01DNDJNakEyTVRVZ01DNDVNakF3TWpFZ01DNDJNREl4TlRnZ01DNDVNak0yTURFZ01DNDFPRE0wTkROTU1DNDVNalV3T1RRZ01DNDFPRFEwTXpoYUlpQm1hV3hzUFNJalJqSkdNa1l5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0eU56azFOVE1nTUM0Mk1qYzNNRGRETUM0ek5UUTFPVFVnTUM0Mk1qYzNNRGNnTUM0ME1UVTBNamtnTUM0MU5qWTROelFnTUM0ME1UVTBNamtnTUM0ME9URTRNekpETUM0ME1UVTBNamtnTUM0ME1UWTNPU0F3TGpNMU5EVTVOU0F3TGpNMU5UazFOeUF3TGpJM09UVTFNeUF3TGpNMU5UazFOME13TGpJd05EVXhNU0F3TGpNMU5UazFOeUF3TGpFME16WTNOeUF3TGpReE5qYzVJREF1TVRRek5qYzNJREF1TkRreE9ETXlRekF1TVRRek5qYzNJREF1TlRZMk9EYzBJREF1TWpBME5URXhJREF1TmpJM056QTNJREF1TWpjNU5UVXpJREF1TmpJM056QTNXaUlnWm1sc2JEMGlkWEpzS0NOd1lXbHVkRFJmYkdsdVpXRnlLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRZMU9EZzVJREF1T0RJNE56azBRekF1TmpFME9ERTRJREF1T0RJNE56azBJREF1TmpVME5EZ3pJREF1TnpnNU1UTXhJREF1TmpVME5EZ3pJREF1TnpRd01qQXpRekF1TmpVME5EZ3pJREF1TmpreE1qYzFJREF1TmpFME9ERTRJREF1TmpVeE5qRXhJREF1TlRZMU9EZzVJREF1TmpVeE5qRXhRekF1TlRFMk9UWWdNQzQyTlRFMk1URWdNQzQwTnpjeU9UVWdNQzQyT1RFeU56VWdNQzQwTnpjeU9UVWdNQzQzTkRBeU1ETkRNQzQwTnpjeU9UVWdNQzQzT0RreE16RWdNQzQxTVRZNU5pQXdMamd5T0RjNU5DQXdMalUyTlRnNE9TQXdMamd5T0RjNU5Gb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUTFYMnhwYm1WaGNpa2lMejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQSEpoWkdsaGJFZHlZV1JwWlc1MElHbGtQU0p3WVdsdWREQmZjbUZrYVdGc0lpQmplRDBpTUNJZ1kzazlJakFpSUhJOUlqRWlJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWlCbmNtRmthV1Z1ZEZSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVEE1TURreUlEQXVOVEEzTmpFMUtTQnpZMkZzWlNnd0xqUXlNekE0TVNraVBpWWplR0U3UEhOMGIzQWdiMlptYzJWMFBTSXdMakU0SWlCemRHOXdMV052Ykc5eVBTSWpOVVZCTUVWR0lpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakVpSUhOMGIzQXRZMjlzYjNJOUlpTXdNRGM0UkRRaUx6NG1JM2hoT3p3dmNtRmthV0ZzUjNKaFpHbGxiblErSmlONFlUczhiR2x1WldGeVIzSmhaR2xsYm5RZ2FXUTlJbkJoYVc1ME1WOXNhVzVsWVhJaUlIZ3hQU0l3TGpJNE1EVTBPQ0lnZVRFOUlqQXVOak14TVRreElpQjRNajBpTUM0eU56a3dOVFVpSUhreVBTSXdMalF6TkRVNU5TSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJME5EUTBORFF5SXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpSa05HUTBaRElpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR3hwYm1WaGNrZHlZV1JwWlc1MElHbGtQU0p3WVdsdWRESmZiR2x1WldGeUlpQjRNVDBpTUM0MU5qVTRPRGtpSUhreFBTSXdMamd5T0RjNU5DSWdlREk5SWpBdU5UWTFPRGc1SWlCNU1qMGlNQzQyTlRJeE1Ea2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5EUTBORFEwTWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpEUmtOR1F5SXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhzYVc1bFlYSkhjbUZrYVdWdWRDQnBaRDBpY0dGcGJuUXpYMnhwYm1WaGNpSWdlREU5SWpBdU56WTNNamcySWlCNU1UMGlNQzQyTVRRMk16a2lJSGd5UFNJd0xqYzJOekk0TmlJZ2VUSTlJakF1TkRJM01EQXlJaUJuY21Ga2FXVnVkRlZ1YVhSelBTSjFjMlZ5VTNCaFkyVlBibFZ6WlNJK0ppTjRZVHM4YzNSdmNDQnpkRzl3TFdOdmJHOXlQU0lqUTBORFEwTkRJaTgrSmlONFlUczhjM1J2Y0NCdlptWnpaWFE5SWpFaUlITjBiM0F0WTI5c2IzSTlJaU5HUTBaRFJrTWlMejRtSTNoaE96d3ZiR2x1WldGeVIzSmhaR2xsYm5RK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBORjlzYVc1bFlYSWlJSGd4UFNJd0xqSTRNRFUwT0NJZ2VURTlJakF1TmpNeE1Ua3hJaUI0TWowaU1DNHlOemt3TlRVaUlIa3lQU0l3TGpRek5EVTVOU0lnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSTBORFEwTkRReUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqUmtOR1EwWkRJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkRFZmYkdsdVpXRnlJaUI0TVQwaU1DNDFOalU0T0RraUlIa3hQU0l3TGpneU9EYzVOQ0lnZURJOUlqQXVOVFkxT0RnNUlpQjVNajBpTUM0Mk5USXhNRGtpSUdkeVlXUnBaVzUwVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElqNG1JM2hoT3p4emRHOXdJSE4wYjNBdFkyOXNiM0k5SWlORFEwTkRRME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSTBaRFJrTkdReUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFeElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNVFV6T0RBNUlEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSI1NSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzOSIgeT0iMzIiIHdpZHRoPSIxOTMiIGhlaWdodD0iNTQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjU4IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jMDA2RUFGO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSMxYmExZTI7c3RhcnRBcnJvdz1ub25lOyIgcGFyZW50PSIxIiBzb3VyY2U9IjkxIiB0YXJnZXQ9IjU0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTA2IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7cm91bmRlZD0xO3NrZXRjaD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtmb250U2l6ZT0xMjtmb250Q29sb3I9bm9uZTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNGRkQ5NjY7c3Ryb2tlV2lkdGg9MTtmaWxsQ29sb3I9I0IyQzlBQjsiIHBhcmVudD0iMSIgdGFyZ2V0PSI0NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNDM1Ljc5OTk5OTk5OTk5OTciIHk9IjIwNi4wMDAwMDAwMDAwMDAyMyIgYXM9InNvdXJjZVBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY4IiB2YWx1ZT0iQSIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jODJiMzY2O2ZpbGxDb2xvcj0jZDVlOGQ0O2ZvbnRDb2xvcj0jOEM4QzhDOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzOCIgeT0iMjYwIiB3aWR0aD0iMTciIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iQTIiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzgyYjM2NjtmaWxsQ29sb3I9I2Q1ZThkNDtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIzNzkiIHk9IjEwOS41IiB3aWR0aD0iMjMiIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjcxIiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ3IiB0YXJnZXQ9IjY3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzNDguMTA4MTA4MTA4MTA3OSIgeT0iNDguNSIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNDMyLjI0MzI0MzI0MzI0MzM0IiB5PSIxOTAiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI3MiIgdmFsdWU9IkQxIiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM2YzhlYmY7ZmlsbENvbG9yPSNkYWU4ZmM7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTk5IiB5PSItMTQuNSIgd2lkdGg9IjIzIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3MyIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzZjOGViZjtzdHJva2VXaWR0aD0yO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhO3NoYXBlPWFycm93O3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO3N0YXJ0QXJyb3c9bm9uZTtmaWxsQ29sb3I9I2RhZThmYzsiIHBhcmVudD0iMSIgc291cmNlPSI3NiIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgeD0iMC4zMTgyIiB5PSItMjMiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjMxIiB5PSItNy42MDE3Njk5MTE1MDQ1NjIiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI3MSIgeT0iLTUuODMxODU4NDA3MDc5NjA4IiBhcz0idGFyZ2V0UG9pbnQiLz48bXhQb2ludCB5PSIxIiBhcz0ib2Zmc2V0Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iRCIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jNmM4ZWJmO2ZpbGxDb2xvcj0jZGFlOGZjO2ZvbnRDb2xvcj0jOEM4QzhDOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQwOSIgeT0iLTEzLjUiIHdpZHRoPSIxNyIgaGVpZ2h0PSIxOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNzUiIHZhbHVlPSIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9bm9uZTtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jNmM4ZWJmO3N0cm9rZVdpZHRoPTI7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZmlsbENvbG9yPSNkYWU4ZmM7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDciIHRhcmdldD0iNzQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjM3MCIgeT0iLTUuMTkyMzA3NjkyMzA3NjIyIiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSI0NDgiIHk9Ii00Ljc0Nzg2MzI0Nzg2MzI3OSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc2IiB2YWx1ZT0iQTEiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzgyYjM2NjtmaWxsQ29sb3I9I2Q1ZThkNDtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMTYiIHk9Ii0xNC41IiB3aWR0aD0iMjMiIGhlaWdodD0iMTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc3IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0yO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhO3NoYXBlPWFycm93O3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ5IiB0YXJnZXQ9Ijc2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSB4PSIwLjc2ODEiIHk9Ii0yMyIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzEiIHk9Ii03LjQyMTg0MTU0MTc1NjA2NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iMTk5IiB5PSItNS42MjMxMjYzMzgzMjk5MzkiIGFzPSJ0YXJnZXRQb2ludCIvPjxteFBvaW50IHk9IjEiIGFzPSJvZmZzZXQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iODAiIHZhbHVlPSIiIHN0eWxlPSJlbmRBcnJvdz1ub25lO2Rhc2hlZD0xO2h0bWw9MTtyb3VuZGVkPTE7c2tldGNoPTE7Zm9udENvbG9yPSM0NjQ5NUQ7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jYjg1NDUwO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPSNmOGNlY2M7Y3VydmVkPTE7aXIuc3luY2hyb25pemVkPTA7IiBwYXJlbnQ9IjEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHdpZHRoPSI1MCIgaGVpZ2h0PSI1MCIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjQwIiB5PSI1MzYiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI0MCIgeT0iLTI0NyIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjgxIiB2YWx1ZT0iJmx0O2k+Jmx0O2ZvbnQgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNXB4JnF1b3Q7PkludGVybmV0Jmx0Oy9mb250PiZsdDsvaT4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250Q29sb3I9IzQ2NDk1RDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNzUiIHk9Ii0yMDAiIHdpZHRoPSI2MCIgaGVpZ2h0PSIxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODIiIHZhbHVlPSImbHQ7ZGl2IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTVweCZxdW90OyBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PiZsdDtmb250IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTVweCZxdW90Oz4mbHQ7aT4mbHQ7Zm9udCBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE1cHgmcXVvdDs+JmFtcDtuYnNwO0NvbXBhbnkmbHQ7L2ZvbnQ+Jmx0Oy9pPiZsdDticj4mbHQ7L2ZvbnQ+Jmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249bGVmdDt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj1ub25lO2ZvbnRDb2xvcj0jNDY0OTVEOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0OCIgeT0iLTIwMCIgd2lkdGg9IjczIiBoZWlnaHQ9IjE4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSImbHQ7ZGl2PiZsdDtiPkxlZ2VuZCZsdDsvYj4mbHQ7L2Rpdj4iIGlyLnNvdXJjZVN0eWxlPSJ3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3JvdW5kZWQ9MTtza2V0Y2g9MDtmb250U2l6ZT0xNTtmb250Q29sb3I9IzQ2NDk1RDtzdHJva2VDb2xvcj0jNzg4QUEzO3N0cm9rZVdpZHRoPTM7ZmlsbENvbG9yPW5vbmU7Z3JhZGllbnRDb2xvcj1ub25lO3ZlcnRpY2FsQWxpZ249dG9wOyIgaWQ9Ijg2Ij48bXhDZWxsIHN0eWxlPSJ3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO3JvdW5kZWQ9MTtza2V0Y2g9MDtmb250U2l6ZT0xMztmb250Q29sb3I9IzQ2NDk1RDtzdHJva2VDb2xvcj0jMjBDOUUzO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPW5vbmU7Z3JhZGllbnRDb2xvcj1ub25lO3ZlcnRpY2FsQWxpZ249dG9wO2NvbnRhaW5lcj0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ijg0NSIgeT0iLTE5MSIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIxMDQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9Ijg1IiB2YWx1ZT0iJmx0O2RpdiBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PiZsdDtiPkEmbHQ7L2I+IC0gQXV0aGVudGljYXRpb24mYW1wO25ic3A7Jmx0Oy9kaXY+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPSM4MmIzNjY7ZmlsbENvbG9yPSNkNWU4ZDQ7Zm9udFNpemU9MTU7Zm9udENvbG9yPSM4QzhDOEM7IiBwYXJlbnQ9Ijg2IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjciIHk9IjI1IiB3aWR0aD0iMTI1IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NyIgdmFsdWU9IkQgLSBEYXRhIHRyYW5zZmVyIGUuZy4gZmlsZXMiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzZjOGViZjtmaWxsQ29sb3I9I2RhZThmYztmb250U2l6ZT0xNTtmb250Q29sb3I9IzhDOEM4QzsiIHBhcmVudD0iODYiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNyIgeT0iNDgiIHdpZHRoPSIxNjUiIGhlaWdodD0iMjIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iJmx0O2RpdiBhbGlnbj0mcXVvdDtsZWZ0JnF1b3Q7PlIgLSBSZW1vdGUgU2NyZWVuL1Rlcm1pbmFsJmx0O2JyPiZsdDsvZGl2PiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj0jMDA2RUFGO2ZpbGxDb2xvcj0jMWJhMWUyO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jZmZmZmZmO2ltYWdlV2lkdGg9MzA7IiBwYXJlbnQ9Ijg2IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjciIHk9IjcwIiB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MSIgdmFsdWU9IlIiIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9IzAwNkVBRjtmaWxsQ29sb3I9IzFiYTFlMjtmb250U2l6ZT0xNTtmb250Q29sb3I9I2ZmZmZmZjsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1MDQiIHk9IjE0OCIgd2lkdGg9IjE5IiBoZWlnaHQ9IjIyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MiIgdmFsdWU9IiIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1ub25lO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSMwMDZFQUY7c3Ryb2tlV2lkdGg9Mjtza2V0Y2g9MTtmb250Q29sb3I9IzQ2NDk1RDtmaWxsQ29sb3I9IzFiYTFlMjsiIHBhcmVudD0iMSIgc291cmNlPSIyOCIgdGFyZ2V0PSI5MSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNDk3LjM5NDk0MTYzNDI0MTE1IiB5PSI0NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNTMzLjM0ODI0OTAyNzIzNzciIHk9IjM1NCIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwMSIgdmFsdWU9IiZsdDtmb250IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMjRweCZxdW90Oz5Db250cmFjdG9yIFJlbW90ZSBBY2Nlc3MgdG8gQ29tcGFueSZsdDsvZm9udD4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250U2l6ZT0xNTtmb250Q29sb3I9IzQ2NDk1RDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI4NiIgeT0iLTI4OCIgd2lkdGg9IjM5NyIgaGVpZ2h0PSIyNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAyIiB2YWx1ZT0iVHJ1c3RlZCBQYXJ0bmVyIiBzdHlsZT0iaXIucmVmPTUzMTMxNWE3LTQxYTItNDBlZC1hYjg3LTIyYzNhNGMzYzdmZjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj1kZWZhdWx0O2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj1ub25lO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTtza2V0Y2g9MDtmb250U2l6ZT0xMjtub0xhYmVsPTE7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTE3NCIgeT0iLTc1IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjE4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQ29udHJhY3RvciIgaWQ9IjQ5Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9MmJhZDYyMGYtOGY0Yi00OGQyLWIzZmItY2M5YjU5NDM0NzAyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9Izc4OEFBMztmaWxsQ29sb3I9I0IyQzlBQjtmb250Q29sb3I9IzQ2NDk1RDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVuZC11c2VyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TWpZME5EZ2dNQzR6TkRFNU16TkRNQzR6TWpZME5EZ2dNQzR5TlRVNE16TWdNQzR6T1RZeU5EWWdNQzR4T0RZd016VWdNQzQwT0RJek5EWWdNQzR4T0RZd016VkRNQzQxTmpnME5EWWdNQzR4T0RZd016VWdNQzQyTXpneU5EUWdNQzR5TlRVNE16TWdNQzQyTXpneU5EUWdNQzR6TkRFNU16TkRNQzQyTXpneU5EUWdNQzQwTWpnd016SWdNQzQxTmpnME5EWWdNQzQwT1RjNE15QXdMalE0TWpNME5pQXdMalE1TnpnelF6QXVNemsyTWpRMklEQXVORGszT0RNZ01DNHpNalkwTkRnZ01DNDBNamd3TXpJZ01DNHpNalkwTkRnZ01DNHpOREU1TXpOYVRUQXVORGd5TXpRMklEQXVNakkxTURBNVF6QXVOREUzTnpjeElEQXVNakkxTURBNUlEQXVNelkxTkRJeklEQXVNamMzTXpVNElEQXVNelkxTkRJeklEQXVNelF4T1RNelF6QXVNelkxTkRJeklEQXVOREEyTlRBM0lEQXVOREUzTnpjeElEQXVORFU0T0RVMklEQXVORGd5TXpRMklEQXVORFU0T0RVMlF6QXVOVFEyT1RJeElEQXVORFU0T0RVMklEQXVOVGs1TWpZNUlEQXVOREEyTlRBM0lEQXVOVGs1TWpZNUlEQXVNelF4T1RNelF6QXVOVGs1TWpZNUlEQXVNamMzTXpVNElEQXVOVFEyT1RJeElEQXVNakkxTURBNUlEQXVORGd5TXpRMklEQXVNakkxTURBNVdrMHdMakl6TWpreElEQXVOakkyTkRJNFF6QXVNak15T1RFeElEQXVOVGc1T0RJNUlEQXVNall5TlRneElEQXVOVFl3TVRnNUlEQXVNams1TVRZMUlEQXVOVFl3TVRnNVNEQXVOalkxTlRJNVF6QXVOamc0T0RVeklEQXVOVFl3TVRnNUlEQXVOekE1TXpZNElEQXVOVGN5TWpNM0lEQXVOekl4TVRjMElEQXVOVGt3TkRVMlF6QXVOekE1TWpVeUlEQXVOVGczT0RRM0lEQXVOamsyT0RZNElEQXVOVGcyTkRjeUlEQXVOamcwTVRZeklEQXVOVGcyTkRjeVF6QXVOall4TVRVMklEQXVOVGcyTkRjeUlEQXVOak01TWpBMElEQXVOVGt3T1RneElEQXVOakU1TVRNNUlEQXVOVGs1TVRZelNEQXVNams1TVRZMVF6QXVNamcwTURreElEQXVOVGs1TVRZeklEQXVNamN4T0RnMElEQXVOakV4TXpjZ01DNHlOekU0T0RRZ01DNDJNalkwTWpoV01DNDJNemd4TXpkRE1DNHlOekU0T0RRZ01DNDJPREE1TWpNZ01DNHlPVE13T1NBd0xqY3hNekE1TkNBd0xqTXlPVGc0TVNBd0xqY3pOVFE1TWtNd0xqTTJOelEwTlNBd0xqYzFPRE0yTVNBd0xqUXlNVEEwTXlBd0xqYzNNRFkxSURBdU5EZ3lNelEySURBdU56Y3dOalZETUM0ME9USTFNVGtnTUM0M056QTJOU0F3TGpVd01qUTRNU0F3TGpjM01ETXhNaUF3TGpVeE1qRTVNaUF3TGpjMk9UWTBNME13TGpVeE16QXlNU0F3TGpjNE1qazJOeUF3TGpVeE5UTTJOU0F3TGpjNU5UZzRNaUF3TGpVeE9UQTFNaUF3TGpnd09ESXhOa013TGpVd056QXlNaUF3TGpnd09URTFPU0F3TGpRNU5EYzJNU0F3TGpnd09UWXlOU0F3TGpRNE1qTTBOaUF3TGpnd09UWXlOVU13TGpReE5qWTFNaUF3TGpnd09UWXlOU0F3TGpNMU5USTNOU0F3TGpjNU5qVTRNU0F3TGpNd09UWXhOQ0F3TGpjMk9EYzRNME13TGpJMk16RTRJREF1TnpRd05URTBJREF1TWpNeU9URWdNQzQyT1RZMk9EWWdNQzR5TXpJNU1TQXdMall6T0RFek4xWXdMall5TmpReU9Gb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamM0TkRBeE15QXdMamN3TlRrMk4wd3dMamM0TURrNU1TQXdMamN3TkRnNU1rd3dMamMxTlRRMElEQXVOalUyT1RnMFF6QXVOelExTmpZeUlEQXVOak00TmpVZ01DNDNNalkxTnpRZ01DNDJNamN4T1RjZ01DNDNNRFUzT1RVZ01DNDJNamN4T1RkSU1DNDJOREUwTmpORE1DNDJNVGN5TkRVZ01DNDJNamN4T1RjZ01DNDFPVFUzTkRVZ01DNDJOREkyT1RRZ01DNDFPRGd3T0RZZ01DNDJOalUyTmpsTU1DNDFOelU1TURrZ01DNDNNREl5TURKRE1DNDFOVFV6T1NBd0xqY3hNRGcwTXlBd0xqVTBNVFV3TkNBd0xqY3pNVEEzT1NBd0xqVTBNVFV3TkNBd0xqYzFOREExTVZZd0xqYzNPVEV4TVVNd0xqVTBNVFV3TkNBd0xqYzVOVEE0TkNBd0xqVTFNVEF4TXlBd0xqZ3dPRGd6TmlBd0xqVTJORFkzT0NBd0xqZ3hOVEF4TmtNd0xqVTJPRE0yTVNBd0xqZ3pOakUzSURBdU5UZzJPREV5SURBdU9EVXlNalUwSURBdU5qQTVNREl4SURBdU9EVXlNalUwUXpBdU5qSTVPVGswSURBdU9EVXlNalUwSURBdU5qUTNOakUzSURBdU9ETTNPVEE1SURBdU5qVXlOakUwSURBdU9ERTRORGsyU0RBdU56UTFORGN6UXpBdU56VXdORFk1SURBdU9ETTNPVEE1SURBdU56WTRNRGt6SURBdU9EVXlNalUwSURBdU56ZzVNRFkySURBdU9EVXlNalUwUXpBdU9ERXhNamMwSURBdU9EVXlNalUwSURBdU9ESTVOekkySURBdU9ETTJNVGNnTUM0NE16TTBNRGtnTUM0NE1UVXdNVFpETUM0NE5EY3dOelFnTUM0NE1EZzRNellnTUM0NE5UWTFPRE1nTUM0M09UVXdPRFFnTUM0NE5UWTFPRE1nTUM0M056a3hNVEZXTUM0M056RTBPRGRETUM0NE5UWTFPRE1nTUM0M05EYzJPRFFnTUM0NE5ERTJNRFFnTUM0M01qWTBOVFlnTUM0NE1Ua3hOemdnTUM0M01UZzBOemhNTUM0M09EVXhPVGdnTUM0M01EWXpPRGxXTUM0M01EVTVOamRJTUM0M09EUXdNVE5hVFRBdU5qQTVORE0zSURBdU5qY3lOemcyUXpBdU5qRTBNRE15SURBdU5qVTVNREF4SURBdU5qSTJPVE15SURBdU5qUTVOekF6SURBdU5qUXhORFl6SURBdU5qUTVOekF6U0RBdU5qWTFNamcxVmpBdU56QTFPVFkzU0RBdU5UazRNemMzVERBdU5qQTVORE0zSURBdU5qY3lOemcyV2swd0xqYzFOakExT0NBd0xqY3dOVGsyTjBnd0xqWTROemM1TVZZd0xqWTBPVGN3TTBnd0xqY3dOVGM1TlVNd0xqY3hPREkyTXlBd0xqWTBPVGN3TXlBd0xqY3lPVGN4TlNBd0xqWTFOalUzTkNBd0xqY3pOVFU0TWlBd0xqWTJOelUzTlV3d0xqYzFOakExT0NBd0xqY3dOVGsyTjFwTk1DNDFPRFkxTVRVZ01DNDRNRGN5TkRORE1DNDFPRFkxTVRVZ01DNDNPVFE0TVRNZ01DNDFPVFkxT1RFZ01DNDNPRFEzTXpjZ01DNDJNRGt3TWpFZ01DNDNPRFEzTXpkRE1DNDJNakUwTlNBd0xqYzRORGN6TnlBd0xqWXpNVFV5TmlBd0xqYzVORGd4TXlBd0xqWXpNVFV5TmlBd0xqZ3dOekkwTTBNd0xqWXpNVFV5TmlBd0xqZ3hPVFkzTWlBd0xqWXlNVFExSURBdU9ESTVOelE1SURBdU5qQTVNREl4SURBdU9ESTVOelE1UXpBdU5UazJOVGt4SURBdU9ESTVOelE1SURBdU5UZzJOVEUxSURBdU9ERTVOamN5SURBdU5UZzJOVEUxSURBdU9EQTNNalF6V2swd0xqYzRPVEEyTmlBd0xqYzRORGN6TjBNd0xqZ3dNVFE1TmlBd0xqYzRORGN6TnlBd0xqZ3hNVFUzTWlBd0xqYzVORGd4TXlBd0xqZ3hNVFUzTWlBd0xqZ3dOekkwTTBNd0xqZ3hNVFUzTWlBd0xqZ3hPVFkzTWlBd0xqZ3dNVFE1TmlBd0xqZ3lPVGMwT1NBd0xqYzRPVEEyTmlBd0xqZ3lPVGMwT1VNd0xqYzNOall6TmlBd0xqZ3lPVGMwT1NBd0xqYzJOalUySURBdU9ERTVOamN5SURBdU56WTJOVFlnTUM0NE1EY3lORE5ETUM0M05qWTFOaUF3TGpjNU5EZ3hNeUF3TGpjM05qWXpOaUF3TGpjNE5EY3pOeUF3TGpjNE9UQTJOaUF3TGpjNE5EY3pOMW9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDNOamdpSUdobGFXZG9kRDBpTUM0M05qZ2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakV3T0RNNU9DQXdMakV5TXpZMU55a2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3NrZXRjaD0xOyIgcGFyZW50PSIxMDIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTIyIiB5PSIyNC41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEwMyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO3JvdW5kZWQ9MTtza2V0Y2g9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuOTk5O2VudHJ5WT0wLjY2O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtmb250U2l6ZT0xMjtmb250Q29sb3I9bm9uZTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0xO2ZpbGxDb2xvcj0jZDVlOGQ0O3N0YXJ0QXJyb3c9bm9uZTsiIHBhcmVudD0iMSIgc291cmNlPSI2OSIgdGFyZ2V0PSIxMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTA0IiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7cm91bmRlZD0xO3NrZXRjaD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC45OTk7ZW50cnlZPTAuNjY7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO2ZvbnRTaXplPTEyO2ZvbnRDb2xvcj1ub25lO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9IzgyYjM2NjtzdHJva2VXaWR0aD0xO2ZpbGxDb2xvcj0jZDVlOGQ0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ0IiB0YXJnZXQ9IjY5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI0MDUiIHk9IjIzMi43OTU5MTgzNjczNDY3NiIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iMjExLjkxMDAwMDAwMDAwMDMiIHk9IjIyMS40MDAwMDAwMDAwMDAxIiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iMzEyIiB5PSIyMjkiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMDgiIHZhbHVlPSJBenVyZSBBY3RpdmUgRGlyZWN0b3J5IC0+IE9rdGEgLSBNRkEiIHN0eWxlPSJpci5yZWY9ZGZjNjA0Y2QtMzJlNS00MWU3LTk4ZmUtZGQzN2UxNDA4OWU0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSM2NkZGNjY7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9IzYwYTkxNztleGl0WD0wLjg3ODtleGl0WT0wLjkxMTtleGl0RHg9MDtleGl0RHk9MDtleGl0UGVyaW1ldGVyPTA7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTEiIHRhcmdldD0iMTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1OSIgdmFsdWU9IkNvbnRyYWN0b3IgLT4gU2FhUyAoU2FsZXMgRm9yY2UsIEFyaWJhLCBvdGhlcnMpIiBzdHlsZT0iaXIucmVmPTU3ZTVjM2FmLTg4MWEtNDkzNy04MGZhLTkwZGIwODk4NTc1NDtlZGdlU3R5bGU9bm9uZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7c3Ryb2tlQ29sb3I9Izk5Q0NGRjtzdHJva2VXaWR0aD0yO3NrZXRjaD0xO2ZvbnRDb2xvcj0jNDY0OTVEO2ZpbGxDb2xvcj0jZGFlOGZjO3JvdW5kZWQ9MDtzaGFwZT1mbGV4QXJyb3c7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ5IiB0YXJnZXQ9IjUzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE1IiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7bGFiZWxCb3JkZXJDb2xvcj1ub25lO2ZvbnRDb2xvcj0jRkZGRkZGO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO3N0cm9rZUNvbG9yPSMwMDFEQkM7c3Ryb2tlV2lkdGg9MjtmaWxsQ29sb3I9IzAwNTBlZjtzdGFydEFycm93PW5vbmU7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTE2IiB0YXJnZXQ9IjEwOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjQxOCIgeT0iMjUxIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTE2IiB2YWx1ZT0iUiIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2F1dG9zaXplPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3BvaW50cz1bXTtmaWxsQ29sb3I9IzY2QjJGRjtzdHJva2VDb2xvcj1kZWZhdWx0O3JvdW5kZWQ9MDtsYWJlbEJhY2tncm91bmRDb2xvcj1ub25lO2ZpbGxTdHlsZT1hdXRvO2ZvbnRDb2xvcj0jRkZGRkZGOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjQ0Ni41IiB5PSIxMDUiIHdpZHRoPSIxNyIgaGVpZ2h0PSIxOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTIwIiB2YWx1ZT0iIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2xhYmVsQmFja2dyb3VuZENvbG9yPW5vbmU7bGFiZWxCb3JkZXJDb2xvcj1ub25lO2ZvbnRDb2xvcj0jRkZGRkZGO2VuZEFycm93PW5vbmU7ZW5kRmlsbD0wO3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jMDAxREJDO3N0cm9rZVdpZHRoPTI7ZmlsbENvbG9yPSMwMDUwZWY7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjgiIHRhcmdldD0iMTE2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI0NzYuOTcyNjAyNzM5NzI1OTciIHk9IjQ2IiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSIyMjAiIHk9IjM0NC4yOTYyOTYyOTYyOTYzIiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48L3Jvb3Q+PC9teEdyYXBoTW9kZWw+</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+    <trustZone ref="TZ_SEGM" uuid="faf61dd8-7eab-4ac2-93c8-c42fd1e86040" name="Business App Hosting" desc="Virtualized Hosting Services (IHS Service) zone hosts non-CJ apps and virtualized servers." trustRating="90"/>
+    <trustZone ref="trusted-partner" uuid="531315a7-41a2-40ed-ab87-22c3a4c3c7ff" name="Trusted Partner" desc="Vetted and trusted partner" trustRating="30"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="Azure AD -&gt; WVD" ref="2b435092-45ed-4304-b42e-8914062e05dd" source="6a20a317-2616-4aaa-8931-c7b1406ec787" target="85ab5253-6d14-450d-a534-8f7341d4f3d6">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; IoT Application (iot-security-compliance-framework)" ref="4896693a-46af-4c6c-ac8d-4db8ea017dfc" source="fc0d51fe-a373-4d18-a293-8a2b873e9ef9" target="d85f98d6-9f53-455a-86f8-4d239429e392">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Contractor -&gt; SaaS (Sales Force, Ariba, others)" ref="57e5c3af-881a-4937-80fa-90db08985754" source="78aab505-4109-4e57-8b91-756696703a30" target="6ad37665-cc66-48ea-a5e5-6ed8dd861ac2">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Back-end server" ref="df7537e6-9ef4-40f7-bf42-3680c15c6699" source="40a5314d-c9ec-4089-ae5b-6fa194301861" target="5ca55fe8-d024-4416-b6b9-abd237a56b2e">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Azure Active Directory -&gt; Okta - MFA" ref="dfc604cd-32e5-41e7-98fe-dd37e14089e4" source="6a20a317-2616-4aaa-8931-c7b1406ec787" target="dface3e0-9147-420d-91bd-85bdb802b47b">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="49f10f14-6996-4e7a-b19a-f3d33560fe01" diagramComponentId="8c841b66-93b3-48c3-a9a1-b4190d66a462" ref="d15de196-655f-47cd-837e-43bdc4a23df0" name="VPN Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-VPN-GW">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.416">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:32.429">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="92162812-10e0-4cdb-adec-4a24174130dc" diagramComponentId="3fd3bd2b-97bd-4347-97a2-381f8ad0df8b" ref="dface3e0-9147-420d-91bd-85bdb802b47b" name="Okta - MFA" desc="" library="" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
+      <tags/>
+      <questions>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+        <question ref="saml.server.role.sp" answer="true" manuallyModified="false"/>
+        <question ref="saml.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets>
+        <asset name="Personally Identifiable Information" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.731">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-294" name="Authentication Bypass by Capture-replay" state="0" impact="100" issueId="" issueLink="">
+          <desc>A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.360">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.631">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.690">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.634">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.361">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.359">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.685">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.732">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.937">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.892">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.894">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.894">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.893">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
+&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
+&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
+&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
+ &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
+&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references>
+              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
+              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".
+ 
+</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.633">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.341">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.470">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.469">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.5.3" name="Authenticate SP to the IDP" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Since the Service Provider obtains artifacts from the user, a malicious site could impersonate the user at some new Service Provider site. The new Service Provider site would obtain assertions from the Identity Provider site and believe the malicious site to be the user. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The new Service Provider site will need to authenticate itself to the Identity Provider site so as to obtain the SAML assertions corresponding to the SAML artifacts. There are two cases to consider: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;If the new Service Provider site has no relationship with the Identity Provider site, it will be unable to authenticate and this step will fail.&lt;/li&gt; 
+  &lt;li&gt;If the new Service Provider site has an existing relationship with the Identity Provider site, the Identity Provider site will determine that assertions are being requested by a site other than that to which the artifacts were originally sent. In such a case, the Identity Provider site MUST not provide the assertions to the new Service Provider site.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.068">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.072">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.073">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.644">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" name="Check browser IP address against IP contained in authentication statement" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If a received authentication statement includes a &amp;lt;saml:SubjectLocality&amp;gt; element with the IP address of the user, the destination site MAY check the browser IP address against the IP address contained in the authentication statement. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the IP comparison is being done.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.5.1" name="Check validity period of all assertions obtained from the IDP" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The Service Provider site MUST check the validity period of all assertions obtained from the&amp;nbsp;Identity Provider site and reject expired assertions. A Service Provider site MAY choose to implement a stricter test of validity for SSO assertions, such as requiring the assertion's IssueInstant or AuthnInstant attribute value to be within a few minutes of the time at which the assertion is received at the Service Provider site.</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that when the Service Provider obtain an assertion from the Identity Provider the validity period is correct. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.683">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
+            <reference name="OWASP Security by Design Principles: Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
+          </references>
+          <standards>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="66" state="Required" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="RULES" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.472">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" name="Ensure confidentiality safeguards are implemented" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  In the case where the subject authenticates to the source site by revealing reusable authentication information, for example, in the form of a password, theft of the authentication information will enable an adversary to impersonate the subject. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   In order to avoid this problem, the connection between the subject's browser and the source site must implement a confidentiality safeguard. In addition, steps must be taken by either the subject or the destination site to ensure that the source site is genuinely the expected and trusted source site before revealing the authentication information. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Ensure a strong password or pass-phrase is used to protect access to the data.&lt;/li&gt; 
+  &lt;li&gt;Identify where is the sensitive data stored&lt;/li&gt; 
+  &lt;li&gt;Check that stored sensitive data is encrypted&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.082">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.1.3" name="Ensure &lt;inResponseTo&gt; attribute is used to correlate messages" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A fabricated request or response is inserted into the message stream. A false response such as a spurious "yes" reply to an authorization decision query or the return of false attribute information in response to an attribute query may result in inappropriate receiver action. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The ability to insert a request is not a threat at the SOAP binding level. The threat of inserting a false response can be a denial of service attack, for example returning SOAP Faults for responses, but this attack would become quickly obvious. The more subtle attack of returning fabricated responses is addressed in the SAML protocol, appropriate since according to the SOAP Binding definition each SOAP response must contain a single SAML protocol response unless it contains a fault. The SAML Protocol addresses this with two mechanisms, correlation of responses to requests using the required InResponseTo attribute, making an attack harder since requests must be intercepted to generate responses, and through the support origin authentication, either via signed SAML responses or through a secured transport connection such as SSL/TLS. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that the responses to requests use the InResponseTo attribute. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.2" name="Ensure &lt;Recipient&gt; attribute matches the URL" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Since the Service Provider site obtains bearer SAML assertions from the user by means of an HTML form, a malicious site could impersonate the user at some new Service Provider site. The new Service Provider site would believe the malicious site to be the subject of the assertion. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The Service Provider site MUST check the Recipient attribute of the SAML response to ensure that its value matches the "https://&amp;lt;assertion consumer host name and path&amp;gt;". As the response is digitally signed, the Recipient value cannot be altered by the malicious site.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-923-SEGREG" name="Ensure segregation of components of differing trust levels" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure segregation of components of differing trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
+                            happen.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
+                            behavior on the system.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
+                        practice and required minimum key lengths depend on the scenarios listed below.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
+            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
+            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
+                            &lt;br /&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
+                            bits&lt;/li&gt;
+                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.051">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
+&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
+&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
+  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
+  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
+  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
+            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
+            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
+ &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
+ &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;span&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
+              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;ul&gt;
+ &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
+ &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.2 Testing for default credentials (OTG-AUTHN-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.5 Test remember password functionality (OTG-AUTHN-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
+ &lt;/div&gt;
+ &lt;div&gt;
+   Options:
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
+ &lt;/div&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.475">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.807">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.1.6" name="Implement mTLS" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Man-in-the-middle attacks are particularly pernicious for this set of profiles. The MITM can relay requests, capture the returned assertion (or artifact), and relay back a false one. Then the original user cannot access the resource in question, but the MITM can do so using the captured resource. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Using a system that provides strong bilateral authentication will make it much more difficult for a MITM to insert himself into the conversation. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that in the communication between providers a mTLS configuration is used to mutually authenticate both parts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.3.1" name="Implement transient qualifiers" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A spurious entity could issue a redirect to a user agent so that the user agent would access a resource that disrupts single sign-on. For example, an attacker could redirect the user agent to a logout resource of a service provider causing the Principal to be logged out of all existing authentication sessions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Access to resources that produce side effects could be specified with a transient qualifier that must correspond to the current authentication session. A confirmation dialog could be interposed that relies on a transient qualifier with similar semantics 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure there is a mechanism to check a transient qualifier that is linked to the corresponding authentication session. 
+&lt;/div&gt; 
+&lt;div&gt;&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.052">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.074">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt; 
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.370">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.075">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.651">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.638">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.683">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" name="Set the HTTP security header 'Strict-Transport-Security' (HSTS)" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Modern browsers support the Strict-Transport-Security HTTP header. This header instructs the browser to only communicate over HTTPS for all subsequent requests to the domain, mitigating a number of attacks designed to force users to switch to unencrypted transport in order to expose data.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Add HTTP Strict Transport Security (HSTS) for all the requests and all the subdomains&lt;/li&gt;&lt;li&gt;Preload the URLs of the applications to the Strict Transport Security domain lists maintained by participating vendors&lt;/li&gt;&lt;li&gt;Encourage users to access the site with patched versions of the participating vendors.&lt;/li&gt;&lt;li&gt;Consider creating and pre-loading subdomains for critical applications prior to release to gain maximum advantage from HSTS pre-loading.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check that for every request to the service, the following header is returned:&lt;/li&gt;&lt;/ol&gt;&lt;blockquote&gt;&lt;p&gt;Strict-Transport-Security: max-age=31536000; includeSubDomains&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The attribute max-age should be of a reasonably long period (&amp;gt;1y).&amp;nbsp;The attribute includeSubDomains should also be present. &amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.682">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Strict Transport Security Cheat Sheet" url="https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.1" name="Synchronize clocks between SPs and IDPs" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The Identity Provider and Service Provider sites SHOULD make some reasonable effort to ensure that clock settings at both sites differ by at most a few minutes. Many forms of time synchronization service are available, both over the Internet and from proprietary sources. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the time both in the Service Provider and the Identity Provider and ensure it is the same.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.076">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-7.1.3" name="Use a common domain" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cookie poisoning attack, where parameters within the cookie are modified, to cause discovery of an fraudulent identity provider for example.&amp;nbsp;The specific mechanism of using a common domain limits the feasibility of this threat</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that the domain is common across all SAML services.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+          </references>
+          <standards>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.053">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.4" name="Use &lt;OneTimeUse&gt; assertion elements" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The browser/POST profile involves uploading of assertions from the web browser to a Service Provider site. This information is available as part of the web browser state and is usually stored in persistent storage on the user system in a completely unsecured fashion. The threat here is that the assertion may be "reused" at some later point in time. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Assertions communicated using this profile must always have short lifetimes and should have a &amp;lt;OneTimeUse&amp;gt; SAML assertion &amp;lt;Conditions&amp;gt; element. Service Provider sites are expected to ensure that the assertions are not re-used. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that the OneTimeUse attribute is used in the requests.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.1.2" name="Use SAML information to identify replay attacks" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>In general, the best way to prevent replay attacks is to prevent the message capture in the first place. Some of the transport-level schemes used to provide in-transit confidentiality will accomplish this goal. For example, if the SAML request-response conversation occurs over SOAP on HTTP/TLS, third parties are prevented from capturing the messages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note that since the potential replayer does not need to understand the message to replay it, schemes such as XML Encryption do not provide protection against replay. If an attacker can capture a SAML request that has been signed by the requester and encrypted to the responder, then the attacker can replay that request at any time without needing to be able to undo the encryption. The SAML request includes information about the issue time of the request, allowing a determination about whether replay is occurring. Alternatively, the unique key of the request (its ID) can be used to determine if this is a replay request or not.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional threats from the replay attack include cases where a "charge per request" model is in place. Replay could be used to run up large charges on a given account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Similarly, models where a client is allocated (or purchases) a fixed number of interactions with a system, the replay attack could exhaust these uses unless the issuer is careful to keep track of the unique key of each request.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that there is a mechanism to check SAML requests attributes to determine if a replay attack is happening. Then launch a replay attack to see if the mechanism is working properly. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:43.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.645">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" name="Use SOAP Message Security" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Change an AuthnRequest SOAP request so that it cannot be processed, such as by changing the PAOS header block service attribute value to an unknown value or by changing the ECP header block ProviderID or IDPList to cause the request to fail. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Provide integrity protection for the SOAP message, by using SOAP Message Security or SSL/TLS.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure the SOAP message uses the message protection mechanism defined in&amp;nbsp;Web Services Security: 3 SOAP Message Security 1.0</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references>
+              <reference name="Web Services Security: 3 SOAP Message Security 1.0" url="https://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.6" name="Use symmetric encryption to protect &lt;RelayState&gt; data" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Some of the messages may carry a &amp;lt;RelayState&amp;gt; element, which is recommended to be integrityprotected by the producer and optionally confidentiality- protected. If these practices are not followed, an adversary could trigger unwanted side effects. In addition, by not confidentiality-protecting the value of this element, a legitimate system entity could inadvertently expose information to the identity provider or a passive attacker. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Because the value of this element is both produced and consumed by the same 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   system entity, symmetric cryptographic primitives could be utilized. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the RelayState attribute is encrypted with a strong symmetric cipher like AES.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.1.1" name="Use XMLEnc and XMLSig to add in-transit confidentiality and integrity" issueId="" issueLink="" platform="" cost="0" risk="80" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Adding in-transit confidentiality at the SOAP level means constructing the SOAP message such that, regardless of SOAP transport, no one but the intended party will be able to access the message. The general solution to this problem is likely to be XML Encryption [XMLEnc]. This specification allows encryption of the SOAP message itself, which eliminates the risk of eavesdropping unless the key used in 
+&lt;/div&gt; 
+&lt;div&gt;
+  the encryption has been compromised. Alternatively, deployers can depend on the SOAP transport layer, or a layer beneath it, to provide in-transit confidentiality. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   The SAML protocol and the SOAP binding neither require nor forbid the 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   deployment of systems that guarantee in-transit message integrity, but due to this large threat, it is highly recommended that such a system be used. At the SOAP binding level, this can be accomplished by digitally signing requests and responses with a system such as XML Signature [XMLSig]. The SAML specification allows for such signatures; see the SAML assertion and protocol specification for further information. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   If messages are digitally signed (with a sensible key management infrastructure) then the recipient has a guarantee that the message has not been altered in transit, unless the key used has been compromised. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that the SOAP message contains the attributes defined in the official documentation about XML Encryption and XML Signatures. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.091">
+              <output/>
+            </source>
+            <references>
+              <reference name="XML Encryption Syntax and Processing Version 1.1" url="https://www.w3.org/TR/xmlenc-core/"/>
+              <reference name="XML Signature Syntax and Processing Version 1.1" url="https://www.w3.org/TR/xmldsig-core1/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-CS-C-2" name="Validate AuthnRequest and Response processing rules" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Validate AuthnRequest and Response processing rules.&amp;nbsp;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Refer to SAML Core (3.4.1.4) and&amp;nbsp;SAML Profiles (4.1.4.3) respectively for all AuthnRequest and Response processing rules.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-CS-C-1" name="Validate protocol usage" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  This is a common area for security gaps - see Google SSO vulnerability for a real life example. Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The SSO Web Browser Profile is most susceptible to attacks from trusted partners. This particular security flaw was exposed because the SAML Response did not contain all of the required data elements necessary for a secure message exchange. Following the SAML Profile usage requirements for AuthnRequest (4.1.4.1) and Response (4.1.4.2) will help counter this attack. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The AVANTSSAR team suggested the following data elements should be required: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;b&gt;AuthnRequest(ID, SP)&lt;/b&gt;: An AuthnRequest must contain and ID and SP. Where ID is a string uniquely identifying the request and an SP identifies the Service Provider that initiated the request. Furthermore, the request ID attribute must be returned in the response (InResponseTo="&amp;lt;requestId&amp;gt;"). InResponseTo helps guarantee authenticity of the response from the trusted IdP. This was one of the missing attributes that left Google's SSO vulnerable.&lt;/li&gt; 
+  &lt;li&gt;&lt;b&gt;Response(ID, SP, IdP, {AA} K -1/IdP)&lt;/b&gt;: A Response must contain all these elements. Where ID is a string uniquely identifying the response. SP identifies the recipient of the response. IdP identifies the identity provider authorizing the response. {AA} K -1/IdP is the assertion digitally signed with the private key of the IdP.&lt;/li&gt; 
+  &lt;li&gt;&lt;b&gt;AuthAssert(ID, C, IdP, SP)&lt;/b&gt;: An authentication assertion must exist within the Response. It must contain an ID, a client (C), an identity provider (IdP), and a service provider (SP) identifier.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.3" name="Verify SAML assertion signatures and authenticate the issuer" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The browser/POST profile requires the SAML response carrying SAML assertions to be signed, thus providing both message integrity and authentication. The Service Provider site MUST verify the signature and authenticate the issuer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   The following recommendations were proposed in response: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Always perform schema validation on the XML document prior to using it for any security--related purposes:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Always use local, trusted copies of schemas for validation.&lt;/li&gt; 
+    &lt;li&gt;Never allow automatic download of schemas from third party locations.&lt;/li&gt; 
+    &lt;li&gt;If possible, inspect schemas and perform schema hardening, to disable possible wildcard -type or relaxed processing statements.&lt;/li&gt; 
+   &lt;/ul&gt; 
+   &lt;li&gt;Securely validate the digital signature:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.&lt;/li&gt; 
+    &lt;li&gt;If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.&lt;/li&gt; 
+    &lt;li&gt;If you expect a heterogeneous signed documents (many certificates from many identity providers, multi-level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.&lt;/li&gt; 
+   &lt;/ul&gt; 
+   &lt;li&gt;Avoid signature-wrapping attacks.&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Never use getElementsByTagName to select security related elements in an XML document without prior validation.&lt;/li&gt; 
+    &lt;li&gt;Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:42.069">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="91" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Encryption should fail closed so that data does not get stored in an unprotected state. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
+            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
+                            &lt;br /&gt;
+                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
+                            the following conditions must be met: &lt;/p&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
+                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
+                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
+                            (e.g. gathered by different sessions or manipulation of session state) share a common
+                            divisor in the length.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:41.052">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="72" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;div&gt;
+   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:39.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:44.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
+                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" mitigation="25"/>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-693-STRICT-TRANSPORT-SECURITY" mitigation="25"/>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.
+                            </desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-636">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                <countermeasure ref="CWE-603" mitigation="25"/>
+                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-367">
+                  <countermeasures>
+                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint.
+&lt;br /&gt;
+&lt;br /&gt;While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-923">
+                  <countermeasures>
+                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
+&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-523">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
+                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-SC-C-6.1.3" mitigation="20"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.3.1" mitigation="16"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.4.2" mitigation="16"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="16"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" mitigation="16"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.5.3" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SAML-2.0-SC-C-6.1.3" mitigation="20"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.3.1" mitigation="16"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.2" mitigation="16"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="16"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.5.1-2" mitigation="16"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.5.3" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="identity-fraud" name="An attacker try to perform identity fraud" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Identity fraud is the use by one person of another person's personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person. Most identity fraud is committed in the context of financial advantages, such as accessing a victim's credit card, bank or loan accounts. False or forged identity documents have been used in criminal activity (such as to gain access to security areas) or in dealings with government agencies, such as immigration. Often today, the identities of real persons are used in the preparation of these false documents.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-SC-C-7.1.3" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-345">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-CS-C-1" mitigation="25"/>
+                    <countermeasure ref="SAML-2.0-CS-C-2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="SAML-2.0-CS-C-1" mitigation="25"/>
+                <countermeasure ref="SAML-2.0-CS-C-2" mitigation="25"/>
+                <countermeasure ref="SAML-2.0-SC-C-7.1.3" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-SC-C-6.1.1" mitigation="20"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.1.6" mitigation="20"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.4.6" mitigation="20"/>
+                    <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" mitigation="20"/>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SAML-2.0-SC-C-6.1.1" mitigation="20"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.1.6" mitigation="20"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.6" mitigation="20"/>
+                <countermeasure ref="SAML-2.0-SC-C-7.1.1.2" mitigation="20"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-367">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-SC-C-6.4.1" mitigation="50"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.4.4" mitigation="50"/>
+                    <countermeasure ref="SAML-2.0-SC-C-6.5.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.1" mitigation="50"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.4" mitigation="50"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.5.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-294">
+                  <countermeasures>
+                    <countermeasure ref="SAML-2.0-SC-C-6.1.2" mitigation="50"/>
+                    <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.1.2" mitigation="50"/>
+                <countermeasure ref="SAML-2.0-SC-C-7.1.2.2" mitigation="50"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                theft and then uses this key to forge signatures from the original signer to mislead a
+                                victim into performing actions that benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
+                                generation and then uses this key to forge signatures from the original signer to
+                                mislead a victim into performing actions which benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-330">
+                  <countermeasures>
+                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-345">
+                  <countermeasures>
+                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="crypto-operations" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="crypto-operations" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="826c51d7-30c1-48f3-9a13-56977e45f92b" diagramComponentId="32a085ef-b687-477c-a60f-11a0ce789941" ref="85ab5253-6d14-450d-a534-8f7341d4f3d6" name="WVD" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-WINDOWS-VM">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZURE-IDS-IPS" name="Deploy network-based IDS/IPS" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Select an offer from Azure Marketplace that supports IDS/IPS functionality with payload inspection capabilities. If intrusion detection and/or prevention based on payload inspection is not a requirement, Azure Firewall with Threat Intelligence can be used. Azure Firewall Threat intelligence-based filtering can alert and deny traffic to and from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall solution of your choice at each of your organization's network boundaries to detect and/or deny malicious traffic.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set up the network&lt;/p&gt; 
+&lt;p&gt;First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall&lt;/p&gt; 
+&lt;p&gt;Deploy the firewall into the VNet.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu or from the Home page, select Create a resource.&lt;/p&gt; 
+&lt;p&gt;2. Type firewall in the search box and press Enter.&lt;/p&gt; 
+&lt;p&gt;3. Select Firewall and then select Create.&lt;/p&gt; 
+&lt;p&gt;4. On the Create a Firewall page, use the following values to configure the firewall:&lt;/p&gt; 
+&lt;p&gt;Subscription: &lt;br&gt; Resource group: Test-FW-RG&lt;br&gt; Name: Test-FW01&lt;br&gt; Location: Select the same location that you used previously&lt;br&gt; Choose a virtual network: Use existing: Test-FW-VN&lt;br&gt; Public IP address: Add new&lt;br&gt; Name: fw-pip&lt;/p&gt; 
+&lt;p&gt;5. Select Review + create.&lt;/p&gt; 
+&lt;p&gt;6. Review the summary, and then select Create to create the firewall.&lt;/p&gt; 
+&lt;p&gt;This will take a few minutes to deploy.&lt;/p&gt; 
+&lt;p&gt;7. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.&lt;/p&gt; 
+&lt;p&gt;8. Note the firewall private and public IP addresses. You will use these addresses later.&lt;/p&gt; 
+&lt;p&gt;Create a default route&lt;/p&gt; 
+&lt;p&gt;For the Workload-SN subnet, configure the outbound default route to go through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select All services or search for and select All services from any page.&lt;/p&gt; 
+&lt;p&gt;2. Under Networking, select Route tables.&lt;/p&gt; 
+&lt;p&gt;3. Select Add.&lt;/p&gt; 
+&lt;p&gt;4. For Name, type Firewall-route.&lt;/p&gt; 
+&lt;p&gt;5. For Subscription, select your subscription.&lt;/p&gt; 
+&lt;p&gt;6. For Resource group, select Test-FW-RG.&lt;/p&gt; 
+&lt;p&gt;7. For Location, select the same location that you used previously.&lt;/p&gt; 
+&lt;p&gt;8. Select Create.&lt;/p&gt; 
+&lt;p&gt;9. Select Refresh, and then select the Firewall-route route table.&lt;/p&gt; 
+&lt;p&gt;10. Select Subnets and then select Associate.&lt;/p&gt; 
+&lt;p&gt;11. Select Virtual network &amp;gt; Test-FW-VN.&lt;/p&gt; 
+&lt;p&gt;12. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall will not work correctly.&lt;/p&gt; 
+&lt;p&gt;13. Select OK.&lt;/p&gt; 
+&lt;p&gt;14. Select Routes and then select Add.&lt;/p&gt; 
+&lt;p&gt;15. For Route name, type fw-dg.&lt;/p&gt; 
+&lt;p&gt;16. For Address prefix, type 0.0.0.0/0.&lt;/p&gt; 
+&lt;p&gt;17. For Next hop type, select Virtual appliance.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall is actually a managed service, but virtual appliance works in this situation.&lt;/p&gt; 
+&lt;p&gt;18. For Next hop address, type the private IP address for the firewall that you noted previously.&lt;/p&gt; 
+&lt;p&gt;19. Select OK.&lt;/p&gt; 
+&lt;p&gt;Configure an application rule&lt;/p&gt; 
+&lt;p&gt;This is the application rule that allows outbound access to www.google.com.&lt;/p&gt; 
+&lt;p&gt;1. Open the Test-FW-RG, and select the Test-FW01 firewall.&lt;br&gt; 2. On the Test-FW01 page, under Settings, select Rules.&lt;br&gt; 3. Select the Application rule collection tab.&lt;br&gt; 4. Select Add application rule collection.&lt;br&gt; 5. For Name, type App-Coll01.&lt;br&gt; 6. For Priority, type 200.&lt;br&gt; 7. For Action, select Allow.&lt;br&gt; 8. Under Rules, Target FQDNs, for Name, type Allow-Google.&lt;br&gt; 9. For Source type, select IP address.&lt;br&gt; 10. For Source, type 10.0.2.0/24.&lt;br&gt; 11. For Protocol:port, type http, https.&lt;br&gt; 12. For Target FQDNS, type www.google.com&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and cannot be used for other purposes. For more information, see Infrastructure FQDNs.&lt;/p&gt; 
+&lt;p&gt;Configure a network rule&lt;/p&gt; 
+&lt;p&gt;This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).&lt;/p&gt; 
+&lt;p&gt;1. Select the Network rule collection tab.&lt;/p&gt; 
+&lt;p&gt;2. Select Add network rule collection.&lt;/p&gt; 
+&lt;p&gt;3. For Name, type Net-Coll01.&lt;/p&gt; 
+&lt;p&gt;4. For Priority, type 200.&lt;/p&gt; 
+&lt;p&gt;5. For Action, select Allow.&lt;/p&gt; 
+&lt;p&gt;6. Under Rules, IP addresses, for Name, type Allow-DNS.&lt;/p&gt; 
+&lt;p&gt;7. For Protocol, select UDP.&lt;/p&gt; 
+&lt;p&gt;8. For Source type, select IP address.&lt;/p&gt; 
+&lt;p&gt;9. For Source, type 10.0.2.0/24.&lt;/p&gt; 
+&lt;p&gt;10. For Destination type select IP address.&lt;/p&gt; 
+&lt;p&gt;11. For Destination address, type 209.244.0.3,209.244.0.4&lt;/p&gt; 
+&lt;p&gt;These are public DNS servers operated by CenturyLink.&lt;/p&gt; 
+&lt;p&gt;12. For Destination Ports, type 53.&lt;/p&gt; 
+&lt;p&gt;13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Configure a DNAT rule&lt;/p&gt; 
+&lt;p&gt;This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.&lt;/p&gt; 
+&lt;p&gt;1. Select the NAT rule collection tab.&lt;br&gt; 2. Select Add NAT rule collection.&lt;br&gt; 3. For Name, type rdp.&lt;br&gt; 4. For Priority, type 200.&lt;br&gt; 5. Under Rules, for Name, type rdp-nat.&lt;br&gt; 6. For Protocol, select TCP.&lt;br&gt; 7. For Source type, select IP address.&lt;br&gt; 8. For Source, type *.&lt;br&gt; 9. For Destination address, type the firewall public IP address.&lt;br&gt; 10. For Destination Ports, type 3389.&lt;br&gt; 11. For Translated address, type the Srv-work private IP address.&lt;br&gt; 12. For Translated port, type 3389.&lt;br&gt; 13. Select Add.&lt;/p&gt; 
+&lt;p&gt;Change the primary and secondary DNS address for the Srv-Work network interface&lt;/p&gt; 
+&lt;p&gt;For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This is not a general Azure Firewall requirement.&lt;/p&gt; 
+&lt;p&gt;1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.&lt;br&gt; 2. Select the network interface for the Srv-Work virtual machine.&lt;br&gt; 3. Under Settings, select DNS servers.&lt;br&gt; 4. Under DNS servers, select Custom.&lt;br&gt; 5. Type 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.&lt;br&gt; 6. Select Save.&lt;br&gt; 7. Restart the Srv-Work virtual machine.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Deploy and configure Azure Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test the firewall&lt;/p&gt;
+
+  &lt;p&gt;Now, test the firewall to confirm that it works as expected.&lt;/p&gt;
+
+  &lt;p&gt;1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.&lt;/p&gt;
+
+  &lt;p&gt;2. Open Internet Explorer and browse to https://www.google.com.&lt;/p&gt;
+
+  &lt;p&gt;3. Select OK &gt; Close on the Internet Explorer security alerts.&lt;/p&gt;
+
+  &lt;p&gt;You should see the Google home page.&lt;/p&gt;
+
+  &lt;p&gt;4. Browse to https://www.microsoft.com.&lt;/p&gt;
+
+  &lt;p&gt;You should be blocked by the firewall.&lt;/p&gt;
+
+  &lt;p&gt;So now you've verified that the firewall rules are working:&lt;/p&gt;
+
+  &lt;p&gt;- You can browse to the one allowed FQDN, but not to any others.&lt;br /&gt;
+- You can resolve DNS names using the configured external DNS server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.554">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" name="Use Security Center's Adaptive Network Hardening" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Security Center's Adaptive Network Hardening&lt;/p&gt;
+
+	&lt;p&gt;Rationale:&lt;br /&gt;
+Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. In these cases, further improving the security posture can be achieved by hardening the NSG rules, based on the actual traffic patterns.&lt;/p&gt;
+
+	&lt;p&gt;Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.&lt;/p&gt;
+
+	&lt;p&gt;Note: Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215&lt;/p&gt;
+
+	&lt;p&gt;Remediation:&lt;br /&gt;
+View and manage hardening alerts and rules&lt;/p&gt;
+
+	&lt;p&gt;1. From Security Center's menu, open the Azure Defender dashboard and select the adaptive network hardening tile, or the insights panel item related to adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;Tip: The insights panel shows the percentage of your VMs currently defended with adaptive network hardening.&lt;/p&gt;
+
+	&lt;p&gt;The details page for the Adaptive Network Hardening recommendations should be applied on internet facing virtual machines recommendation opens with your network VMs grouped into three tabs:&lt;/p&gt;
+
+	&lt;p&gt;a. Unhealthy resources: VMs that currently have recommendations and alerts that were triggered by running the adaptive network hardening algorithm.&lt;/p&gt;
+
+	&lt;p&gt;b. Healthy resources: VMs without alerts and recommendations.&lt;/p&gt;
+
+	&lt;p&gt;c. Unscanned resources: VMs that the adaptive network hardening algorithm cannot be run on because of one of the following reasons:&lt;br /&gt;
+i. VMs are Classic VMs: Only Azure Resource Manager VMs are supported.&lt;br /&gt;
+ii. Not enough data is available: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.&lt;br /&gt;
+iii. VM is not protected by Azure Defender: Only VMs protected with Azure Defender for servers are eligible for this feature.&lt;/p&gt;
+
+	&lt;p&gt;3. From the Unhealthy resources tab, select a VM to view its alerts and the recommended hardening rules to apply.&lt;/p&gt;
+
+	&lt;p&gt;- The Rules tab lists the rules that adaptive network hardening recommends you add&lt;br /&gt;
+- The Alerts tab lists the alerts that were generated due to traffic, flowing to the resource, which is not within the IP range allowed in the recommended rules.&lt;/p&gt;
+
+	&lt;p&gt;4. Optionally, edit the rules:&lt;/p&gt;
+
+	&lt;p&gt;- Modify a rule&lt;br /&gt;
+- Delete a rule&lt;br /&gt;
+- Add a rule&lt;/p&gt;
+
+	&lt;p&gt;5. Select the rules that you want to apply on the NSG, and click Enforce.&lt;/p&gt;
+
+	&lt;p&gt;Tip: If the allowed source IP ranges shows as 'None', it means that recommended rule is a deny rule, otherwise, it is an allow rule.&lt;/p&gt;
+
+	&lt;p&gt;Note: The enforced rules are added to the &lt;acronym title="s"&gt;NSG&lt;/acronym&gt; protecting the VM. (A VM could be protected by an NSG that is associated to its NIC, or the subnet in which the VM resides, or both)&lt;/p&gt;
+
+	&lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Improve your network security posture with adaptive network hardening" url="https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Security Center's Adaptive Network Hardening recommendations are enforced  to your NSG configurations.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.555">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                    <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ADAPTIVE-NET-HARDENING" mitigation="50"/>
+                <countermeasure ref="AZURE-IDS-IPS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a15dc169-6293-4f11-acb7-a811ed096f3f" diagramComponentId="425ab4f0-30a2-41bc-bcef-89402f5a2cb5" ref="68fef763-8713-48ee-8097-f8f7fe179db1" name="LDAP Directory" desc="" library="" parentComponentRef="" componentDefinitionRef="ldap-directory">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_SEGM"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:51.136">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.923">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-90" name="Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an LDAP query using externally-influenced input from an
+                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
+                        could modify the intended LDAP query when it is sent to a downstream component.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.714">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" url="https://cwe.mitre.org/data/definitions/90.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:51.071">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-150-LDAP" name="Escape LDAP meta-characters in user input" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        All data received from the client-side should be considered tainted and a potential risk,
+                        regardless of the source or transport method.&amp;nbsp;As such, all data from the client side
+                        must be subjected to strict validation, sanitization, and encoding against expected syntactic
+                        and semantic criteria.
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        When using user supplied input in an LDAP query:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure that LDAP specific meta-characters are escaped before the query is executed.&lt;/li&gt;
+                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
+                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
+                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
+                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
+                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&lt;/li&gt;
+                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
+                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
+                        non-compliant data.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every part of the code which manages LDAP queries.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check it is correctly escaping the following characters: &amp;quot;\&amp;quot;,
+                            &amp;quot;(&amp;quot;, &amp;quot;|&amp;quot;, &amp;quot;&amp;lt;&amp;quot;, &amp;quot;/&amp;quot;,
+                            &amp;quot;)&amp;quot;, &amp;quot;=&amp;quot;, &amp;quot;~&amp;quot;, &amp;quot;&amp;amp;&amp;quot;,
+                            &amp;quot;&amp;gt;&amp;quot;, &amp;quot;*&amp;quot; .&lt;/li&gt;
+                            &lt;/ol&gt;A safe method to automatically escape those characters is to use a framework
+                            which allows LDAP prepared statements.&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-136" name="Attackers could access data for which they are not authorised through LDAP injection attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers could exploit LDAP injection vulnerabilities and gain access to data to
+                                which
+                                they are not authorized in the LDAP store.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-90">
+                  <countermeasures>
+                    <countermeasure ref="CWE-150-LDAP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-150-LDAP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b857f5f8-0d90-464a-83cb-29bd426d5113" diagramComponentId="2bad620f-8f4b-48d2-b3fb-cc9b59434702" ref="78aab505-4109-4e57-8b91-756696703a30" name="Contractor" desc="" library="" parentComponentRef="" componentDefinitionRef="end-user">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="trusted-partner"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CSMS-4.3.4-15.2" name="Defined security procedures are not followed" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; &lt;b&gt;Defined security procedures&lt;/b&gt; are not followed&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.4-15.1" name="Social engineering" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; Innocent victim (e.g. owner, operator or maintenance engineer) being &lt;b&gt;tricked into taking an action&lt;/b&gt; to&lt;b&gt; &lt;/b&gt;unintentionally load malware or enable an attack&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSMS-M19" name="Define security procedures" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Organizations shall ensure security procedures are defined and followed including logging of actions and access related to the management of the security functions&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53 PS-1 Personnel Security Policy and Procedures" url="https://nvd.nist.gov/800-53/Rev4/control/PS-1"/>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M19" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.331">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M18" name="Define user roles and access privileges" issueId="" issueLink="" platform="" cost="0" risk="87" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Measures shall be implemented for defining and controlling user roles and access privileges, based on the principle of least access privilege&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Role Definitions" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/01-Test_Role_Definitions"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M18" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
+          <threats>
+            <threat ref="CSMS-4.3.4-15" name="Unintended human actions carried out from outside of vehicles" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
+              <desc>This threat include: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Legitimate actors are able to take actions that would unwittingly facilitate a cyber-attack&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSMS-4.3.4-15.1">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M18" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CSMS-4.3.4-15.2">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M19" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSMS-M18" mitigation="50"/>
+                <countermeasure ref="CSMS-M19" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7793ea19-b048-4e76-9b8d-ed4e7a07a396" diagramComponentId="74ebf67f-d7bc-4010-a340-f91efdbfdb38" ref="6a20a317-2616-4aaa-8931-c7b1406ec787" name="Azure AD" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-active-directory">
+      <tags/>
+      <questions>
+        <question ref="azure.remote.workers.no" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Personally Identifiable Information" accessType="10"/>
+        <asset name="Personally Identifiable Information" accessType="20"/>
+        <asset name="Personally Identifiable Information" accessType="40"/>
+        <asset name="Personally Identifiable Information" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are typically introduced during the
+                        configuration of the software.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-DATA-01" name="Sensitive data are accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data are not encrypted and the sensitive data is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-alerts-access" name="There is no alert for unauthorized access" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There is no alert to notify about unauthorized access to the resources, and this access is not logged.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.608">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD1" name="Block legacy authentication for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Block legacy authentication for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; To give your users easy access to your cloud apps, Azure Active Directory (Azure AD) supports a broad variety of authentication protocols including legacy authentication. Legacy authentication is a term that refers to an authentication request made by:&lt;br&gt; - Older Office clients that do not use modern authentication (for example, Office 2010 client)&lt;br&gt; - Any client that uses legacy mail protocols such as IMAP/SMTP/POP3&lt;br&gt; Today, the majority of all compromising sign-in attempts come from legacy authentication. Legacy authentication does not support multi-factor authentication (MFA). Even if you have an MFA policy enabled on your directory, a bad actor can authenticate using a legacy protocol and bypass MFA. The best way to protect your account from malicious authentication requests made by legacy protocols is to block these attempts altogether.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Follow the steps below in order to block legacy authentication in your directory&lt;/p&gt;&lt;p&gt;Identify legacy authentication use&lt;/p&gt;&lt;p&gt;Before you can block legacy authentication in your directory, you need to first understand if your users have apps that use legacy authentication and how it affects your overall directory. Azure AD sign-in logs can be used to understand if you are using legacy authentication.&lt;/p&gt;&lt;p&gt;1. Navigate to the Azure portal &amp;gt; Azure Active Directory &amp;gt; Sign-ins.&lt;br&gt; 2. Add the Client App column if it is not shown by clicking on Columns &amp;gt; Client App.&lt;br&gt; 3. Filter by Client App &amp;gt; check all the Legacy Authentication Clients options presented.&lt;br&gt; 4. Filter by Status &amp;gt; Success.&lt;br&gt; 5. Expand your date range if necessary using the Date filter.&lt;/p&gt;&lt;p&gt;Filtering will only show you successful sign-in attempts that were made by the selected legacy authentication protocols. Clicking on each individual sign-in attempt will show you additional details. The Client App column or the Client App field under the Basic Info tab after selecting an individual row of data will indicate which legacy authentication protocol was used. These logs will indicate which users are still depending on legacy authentication and which applications are using legacy protocols to make authentication requests. For users that do not appear in these logs and are confirmed to not be using legacy authentication, implement a Conditional Access policy or enable the Baseline policy: block legacy authentication for these users only.&lt;/p&gt;&lt;p&gt;Moving away from legacy authentication&lt;/p&gt;&lt;p&gt;Once you have a better idea of who is using legacy authentication in your directory and which applications depend on it, the next step is upgrading your users to use modern authentication. Modern authentication is a method of identity management that offers more secure user authentication and authorization. If you have an MFA policy in place on your directory, modern authentication ensures that the user is prompted for MFA when required. It is the more secure alternative to legacy authentication protocols.&lt;/p&gt;&lt;p&gt;This section gives a step-by-step overview on how to update your environment to modern authentication. Read through the steps below before enabling a legacy authentication blocking policy in your organization.&lt;/p&gt;&lt;p&gt;Step 1: Enable modern authentication in your directory&lt;/p&gt;&lt;p&gt;The first step in enabling modern authentication is making sure your directory supports modern authentication. Modern authentication is enabled by default for directories created on or after August 1, 2017. If your directory was created prior to this date, you will need to manually enable modern authentication for your directory using the following steps:&lt;/p&gt;&lt;p&gt;1. Check to see if your directory already supports modern authentication by running Get-CsOAuthConfiguration from the Skype for Business Online PowerShell module.&lt;br&gt; 2. If your command returns an empty OAuthServers property, then Modern Authentication is disabled. Update the setting to enable modern authentication using Set-CsOAuthConfiguration. If your OAuthServers property contains an entry, you are good to go.&lt;/p&gt;&lt;p&gt;Be sure to complete this step before moving forward. It is critical that your directory configurations are changed first because they dictate which protocol will be used by all Office clients. Even if you are using Office clients that support modern authentication, they will default to using legacy protocols if modern authentication is disabled on your directory.&lt;/p&gt;&lt;p&gt;Step 2: Office applications&lt;/p&gt;&lt;p&gt;Once you have enabled modern authentication in your directory, you can start updating applications by enabling modern authentication for Office clients. Office 2016 or later clients support modern authentication by default. No extra steps are required.&lt;/p&gt;&lt;p&gt;If you are using Office 2013 Windows clients or older, Azure recommends upgrading to Office 2016 or later. Even after completing the prior step of enabling modern authentication in your directory, the older Office applications will continue to use legacy authentication protocols. If you are using Office 2013 clients and are unable to immediately upgrade to Office 2016 or later, follow the steps in the following article to Enable Modern Authentication for Office 2013 on Windows devices. To help protect your account while you are using legacy authentication, Azure recommends using strong passwords across your directory. Check out Azure AD password protection to ban weak passwords across your directory.&lt;/p&gt;&lt;p&gt;Office 2010 does not support modern authentication. You will need to upgrade any users with Office 2010 to a more recent version of Office. Azure recommends upgrading to Office 2016 or later, as it blocks legacy authentication by default.&lt;/p&gt;&lt;p&gt;If you are using macOS, Azure recommends upgrading to Office for Mac 2016 or later. If you are using the native mail client, you will need to have macOS version 10.14 or later on all devices.&lt;/p&gt;&lt;p&gt;Step 3: Exchange and SharePoint&lt;/p&gt;&lt;p&gt;For Windows-based Outlook clients to use modern authentication, Exchange Online must be modern authentication enabled as well. If modern authentication is disabled for Exchange Online, Windows-based Outlook clients that support modern authentication (Outlook 2013 or later) will use basic authentication to connect to Exchange Online mailboxes.&lt;/p&gt;&lt;p&gt;SharePoint Online is enabled for modern authentication default. For directories created after August 1, 2017, modern authentication is enabled by default in Exchange Online. However, if you had previously disabled modern authentication or are you using a directory created prior to this date, follow the steps in the "Enable modern authentication in Exchange Online" in Reference Url.&lt;/p&gt;&lt;p&gt;Step 4: Skype for Business&lt;/p&gt;&lt;p&gt;To prevent legacy authentication requests made by Skype for Business, it is necessary to enable modern authentication for Skype for Business Online. For directories created after August 1, 2017, modern authentication for Skype for Business is enabled by default.&lt;/p&gt;&lt;p&gt;Azure suggests you transition to Microsoft Teams, which supports modern authentication by default. However, if you are unable to migrate at this time, you will need to enable modern authentication for Skype for Business Online so that Skype for Business clients start using modern authentication.&lt;/p&gt;&lt;p&gt;In addition to enabling modern authentication for Skype for Business Online, Azure recommends enabling modern authentication for Exchange Online when enabling modern authentication for Skype for Business. This process will help synchronize the state of modern authentication in Exchange Online and Skype for Business online and will prevent multiple sign-in prompts for Skype for Business clients.&lt;/p&gt;&lt;p&gt;Step 5: Using mobile devices&lt;br&gt; Applications on your mobile device need to block legacy authentication as well. Azure recommends using Outlook for Mobile. Outlook for Mobile supports modern authentication by default and will satisfy other MFA baseline protection policies.&lt;/p&gt;&lt;p&gt;In order to use the native iOS mail client, you will need to be running iOS version 11.0 or later to ensure the mail client has been updated to block legacy authentication.&lt;/p&gt;&lt;p&gt;Step 6: On-premises clients&lt;/p&gt;&lt;p&gt;If you are a hybrid customer using Exchange Server on-premises and Skype for Business on-premises, both services will need to be updated to enable modern authentication. When using modern authentication in a hybrid environment, you are still authenticating users on-premises. The story of authorizing their access to resources (files or emails) changes.&lt;/p&gt;&lt;p&gt;Before you can begin enabling modern authentication on-premises, please be sure that you have met the pre-requisites. You are now ready to enable modern authentication on-premises.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blocking legacy authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-block-legacy-authentication"/>
+            <reference name="Enable or disable modern authentication for Outlook in Exchange Online" url="https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To check if your users have apps that use legacy authentication, follow again the steps of "Identify legacy authentication use" section:&lt;/p&gt;      &lt;p&gt;1. Navigate to the Azure portal &gt; Azure Active Directory &gt; Sign-ins.&lt;br /&gt;  2. Add the Client App column if it is not shown by clicking on Columns &gt; Client App.&lt;br /&gt;  3. Filter by Client App &gt; check all the Legacy Authentication Clients options presented.&lt;br /&gt;  4. Filter by Status &gt; Success.&lt;br /&gt;  5. Expand your date range if necessary using the Date filter.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD18" name="Configure Azure Active Directory settings" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure Active Directory.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is 'Disabled'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of methods required to reset' is set to '2'&lt;/li&gt;&lt;li&gt;Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0"&lt;/li&gt;&lt;li&gt;Ensure that 'Notify users on password resets?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can consent to apps accessing company data on their behalf' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can add gallery apps to their Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can register applications' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guest user permissions are limited' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Members can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Guests can invite' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict access to Azure AD administration portal' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create security groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Users can create Microsoft 365 groups in Azure Portals' is set to 'No'&lt;/li&gt;&lt;li&gt;Ensure that 'Require Multi-Factor Auth to join devices' is set to 'Yes'&lt;/li&gt;&lt;li&gt;Ensure that no custom subscription owner roles are created&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;ol&gt;&lt;li&gt;Go to Users&lt;ol&gt;&lt;li&gt;Go to Password reset&lt;ol&gt;&lt;li&gt;Go to Authentication methods&lt;ol&gt;&lt;li&gt;Set the Number of methods required to reset to 2&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Registration&lt;ol&gt;&lt;li&gt;Set the Number of days before users are asked to re-confirm their authentication information to your organization defined frequency&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Notification&lt;ol&gt;&lt;li&gt;Set Notify users on password resets? to Yes&lt;/li&gt;&lt;li&gt;Set Notify all admins when other admins reset their password? to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to All Users&lt;ol&gt;&lt;li&gt;Click on Multi-Factor Authentication button on the top bar&lt;/li&gt;&lt;li&gt;Click on service settings&lt;/li&gt;&lt;li&gt;Disable Allow users to remember multi-factor authentication on devices they trust&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to User settings&lt;ol&gt;&lt;li&gt;Click on Manage how end users launch and view their applications&lt;ol&gt;&lt;li&gt;Set Users can consent to apps accessing company data on their behalf to No&lt;/li&gt;&lt;li&gt;Set Users can add gallery apps to their Access Panel to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Set Users can register applications to No&lt;/li&gt;&lt;li&gt;Set Restrict access to Azure AD administration portal to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to External Identities&lt;ol&gt;&lt;li&gt;Go to External collaboration settings&lt;ol&gt;&lt;li&gt;Set Guest users permissions are limited to Yes&lt;/li&gt;&lt;li&gt;Set Members can invite to No&lt;/li&gt;&lt;li&gt;Set Guests can invite to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Groups&lt;ol&gt;&lt;li&gt;Go to General in setting&lt;ol&gt;&lt;li&gt;Ensure that Restrict user ability to access groups features in the Access Pane is set to No&lt;/li&gt;&lt;li&gt;Set Users can create security groups in Azure Portals to No&lt;/li&gt;&lt;li&gt;Set Owners can manage group membership requests in the Access Panel to No&lt;/li&gt;&lt;li&gt;Set Users can create Microsoft 365 groups in Azure Portals to No&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Go to Devices&lt;ol&gt;&lt;li&gt;Go to Device settings&lt;ol&gt;&lt;li&gt;Set Require Multi-Factor Auth to join devices to Yes&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.10" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.11" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.12" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.13" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.14" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.15" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.15" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.16" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.17" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.18" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.19" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.20" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.20" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.21" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.22" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.22" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="1.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="GS-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="IM-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-2" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-7" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD12" name="Configure Azure Monitor logs" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Configure Azure Monitor logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure Monitor logs allows you to query data to find particular events, analyze trends, and perform correlation across various data sources. You can also set up alerts on your query. With the integration of Azure AD activity logs in Azure Monitor logs, you can now perform tasks like:&lt;/p&gt; 
+&lt;p&gt;- Compare your Azure AD sign-in logs against security logs published by Azure Security Center&lt;br&gt; - Troubleshoot performance bottlenecks on your application's sign-in page by correlating application performance data from Azure Application Insights.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Using this feature requires an Azure AD Premium P1 or P2 license.&lt;/p&gt; 
+&lt;p&gt;Send logs to Azure Monitor&lt;/p&gt; 
+&lt;p&gt;1.Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. Select Azure Active Directory &amp;gt; Diagnostic settings -&amp;gt; Add diagnostic setting. You can also select Export Settings from the Audit Logs or Sign-ins page to get to the diagnostic settings configuration page.&lt;/p&gt; 
+&lt;p&gt;3. In the Diagnostic settings menu, select the Send to Log Analytics workspace check box, and then select Configure.&lt;/p&gt; 
+&lt;p&gt;4. Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.&lt;/p&gt; 
+&lt;p&gt;5. Do either or both of the following:&lt;/p&gt; 
+&lt;p&gt;- To send audit logs to the Log Analytics workspace, select the AuditLogs check box.&lt;br&gt; - To send sign-in logs to the Log Analytics workspace, select the SignInLogs check box.&lt;/p&gt; 
+&lt;p&gt;6. Select Save to save the setting.&lt;/p&gt; 
+&lt;p&gt;7. After about 15 minutes, verify that events are streamed to your Log Analytics workspace.&lt;/p&gt; 
+&lt;p&gt;Navigate to the Log Analytics workspace&lt;/p&gt; 
+&lt;p&gt;- Sign in to the Azure portal.&lt;br&gt; - Select Azure Active Directory, and then select Logs from the Monitoring section to open your Log Analytics workspace. The workspace will open with a default query.&lt;/p&gt; 
+&lt;p&gt;Alert on Azure AD activity log data&lt;/p&gt; 
+&lt;p&gt;You can also set up alerts on your query. For example, to configure an alert when more than 10 applications have been used in the last week:&lt;/p&gt; 
+&lt;p&gt;1. From the workspace, select Set alert to open the Create rule page.&lt;/p&gt; 
+&lt;p&gt;2. Select the default alert criteria created in the alert and update the Threshold in the default metric to 10.&lt;/p&gt; 
+&lt;p&gt;3. Enter a name and description for the alert, and choose the severity level. For our example, we could set it to Informational.&lt;/p&gt; 
+&lt;p&gt;4. Select the Action Group that will be alerted when the signal occurs. You can choose to notify your team via email or text message, or you could automate the action using webhooks, Azure functions or logic apps. Learn more about creating and managing alert groups in the Azure portal.&lt;/p&gt; 
+&lt;p&gt;5. Once you have configured the alert, select Create alert to enable it.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Analyze Azure AD activity logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics#alert-on-azure-ad-activity-log-data"/>
+            <reference name="Integrate Azure AD logs with Azure Monitor logs" url="https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Monitor logs are configured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD4" name="Create an organization specific custom banned password list" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create an organization specific custom banned password list&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, the Azure Active Directory (Azure AD) custom banned password list let you add specific strings to evaluate and block. A password change request fails if there is a match in the custom banned password list.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Note: To complete this guide, you need a working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.&lt;/p&gt; 
+&lt;p&gt;Configure custom banned passwords&lt;/p&gt; 
+&lt;p&gt;To enable the custom banned password list and add entries to it, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, then choose Security from the menu on the left-hand side.&lt;/p&gt; 
+&lt;p&gt;3. Under the Manage menu header, select Authentication methods, then Password protection.&lt;/p&gt; 
+&lt;p&gt;4. Set the option for Enforce custom list to Yes.&lt;/p&gt; 
+&lt;p&gt;5. Add strings to the Custom banned password list, one string per line. The following considerations and limitations apply to the custom banned password list:&lt;/p&gt; 
+&lt;p&gt;- The custom banned password list can contain up to 1000 terms.&lt;br&gt; - The custom banned password list is case-insensitive.&lt;br&gt; - The custom banned password list considers common character substitution, such as o and 0, or a and @.&lt;br&gt; - The minimum string length is four characters, and the maximum is 16 characters.&lt;/p&gt; 
+&lt;p&gt;Specify your own custom passwords to ban.&lt;/p&gt; 
+&lt;p&gt;6. Leave the option for Enable password protection on Windows Server Active Directory to No.&lt;/p&gt; 
+&lt;p&gt;7. To enable the custom banned passwords and your entries, select Save.&lt;/p&gt; 
+&lt;p&gt;It may take several hours for updates to the custom banned password list to be applied.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Configure custom banned passwords for Azure Active Directory password protection" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-configure-custom-password-protection"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test custom banned password list&lt;/p&gt;
+
+  &lt;p&gt;To see the custom banned password list in action, try to change the password to a variation of one that you added in the Remediation section. When Azure AD tries to process the password change, the password is matched against an entry in the custom banned password list. An error is then displayed to the user.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD3" name="Designate more than one global administrator in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Designate more than one global administrator in Azure AD&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you cannot sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.&lt;/p&gt; 
+&lt;p&gt;Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts cannot be used. Azure recommends that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create emergency access accounts&lt;/p&gt; 
+&lt;p&gt;Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.&lt;/p&gt; 
+&lt;p&gt;When configuring these accounts, the following requirements must be met:&lt;/p&gt; 
+&lt;p&gt;- The emergency access accounts should not be associated with any individual user in the organization. Make sure that your accounts are not connected with any employee-supplied mobile phones, hardware tokens that travel with individual employees, or other employee-specific credentials. This precaution covers instances where an individual employee is unreachable when the credential is needed. It is important to ensure that any registered devices are kept in a known, secure location that has multiple means of communicating with Azure AD.&lt;br&gt; - The authentication mechanism used for an emergency access account should be distinct from that used by your other administrative accounts, including other emergency access accounts. For example, if your normal administrator sign-in is via on-premises MFA, then Azure AD MFA would be a different mechanism. However if Azure AD MFA is your primary part of authentication for your administrative accounts, then consider a different approach for these, such as using Conditional Access with a third-party MFA provider via Custom controls.&lt;br&gt; - The device or credential must not expire or be in scope of automated cleanup due to lack of use.&lt;br&gt; - You should make the Global Administrator role assignment permanent for your emergency access accounts.&lt;/p&gt; 
+&lt;p&gt;Exclude at least one account from phone-based multi-factor authentication&lt;/p&gt; 
+&lt;p&gt;To reduce the risk of an attack resulting from a compromised password, Azure AD recommends that you require multi-factor authentication for all individual users. This group includes administrators and all others (for example, financial officers) whose compromised account would have a significant impact.&lt;/p&gt; 
+&lt;p&gt;However, at least one of your emergency access accounts should not have the same multi-factor authentication mechanism as your other non-emergency accounts. This includes third-party multi-factor authentication solutions. If you have a Conditional Access policy to require multi-factor authentication for every administrator for Azure AD and other connected software as a service (SaaS) apps, you should exclude emergency access accounts from this requirement, and configure a different mechanism instead. Additionally, you should make sure the accounts do not have a per-user multi-factor authentication policy.&lt;/p&gt; 
+&lt;p&gt;Exclude at least one account from Conditional Access policies&lt;/p&gt; 
+&lt;p&gt;During an emergency, you do not want a policy to potentially block your access to fix an issue. At least one emergency access account should be excluded from all Conditional Access policies.&lt;/p&gt; 
+&lt;p&gt;In addition you have to store the credentials for emergency access accounts safely and monitor sign-in and audit log activity.&lt;br&gt; For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Manage emergency access accounts in Azure AD" url="https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you have at least two emergency access accounts.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD8" name="Disable end-user consent to applications" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Disable end-user consent to applications&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The admin consent workflow gives admins a secure way to grant access to applications that require admin approval so end users do not expose corporate data. Microsoft recommends disabling future user consent operations to help reduce your surface area and mitigate this risk.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To configure user consent settings through the Azure portal:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a Global Administrator.&lt;br&gt; 2. Select Azure Active Directory &amp;gt; Enterprise applications &amp;gt; Consent and permissions &amp;gt; User consent settings.&lt;br&gt; 3. Under User consent for applications, select "Do not allow user consent" &lt;br&gt; 4. Select Save to save your settings.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure how end-users consent to applications" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that end-user consent to applications is disabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.610">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD11" name="Enable Azure AD Identity Protection" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Azure Active Directory Identity Protection&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Identity Protection is a tool that allows organizations to accomplish three key tasks:&lt;/p&gt;
+
+  &lt;p&gt;- Automate the detection and remediation of identity-based risks.&lt;br /&gt;
+- Investigate risks using data in the portal.&lt;br /&gt;
+- Export risk detection data to third-party utilities for further analysis.&lt;/p&gt;
+
+  &lt;p&gt;Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.&lt;/p&gt;
+
+  &lt;p&gt;The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Using this feature requires an Azure AD Premium P2 license.&lt;/p&gt;
+
+  &lt;p&gt;Then in the Azure portal under Azure Active Directory &gt; Security &gt; Identity Protection you can:&lt;/p&gt;
+
+  &lt;p&gt;- Configure the MFA registration policy&lt;br /&gt;
+- Configure risk policies&lt;br /&gt;
+- Configure notifications&lt;/p&gt;
+
+  &lt;p&gt;For more information please see Reference URLs.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Azure Active Directory Identity Protection notifications" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications"/>
+            <reference name="How To: Configure and enable risk policies" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies"/>
+            <reference name="How To: Configure the Azure AD Multi-Factor Authentication registration policy" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy"/>
+            <reference name="What is Identity Protection?" url="https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure Active Directory Identity Protection is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD5" name="Enable combined security information registration in Azure AD" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable combined security information registration in Azure AD&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.&lt;br&gt; Note: Starting on August 15th 2020, all new Azure AD tenants will be automatically enabled for combined registration. Starting on December 14th 2020, all Azure AD tenants with one user will be automatically enabled for combined registration.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To enable combined registration, complete these steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a user administrator or global administrator.&lt;/p&gt; 
+&lt;p&gt;2. Go to Azure Active Directory &amp;gt; User settings &amp;gt; Manage user feature preview settings.&lt;/p&gt; 
+&lt;p&gt;3. Under Users can use the combined security information registration experience, choose to enable for a Selected group of users or for All users.&lt;/p&gt; 
+&lt;p&gt;Create a policy to require registration from a trusted location&lt;/p&gt; 
+&lt;p&gt;Complete the following steps to create a policy that applies to all selected users that attempt to register using the combined registration experience, and blocks access unless they are connecting from a location marked as trusted network:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;/p&gt; 
+&lt;p&gt;2. Select + New policy.&lt;/p&gt; 
+&lt;p&gt;3. Enter a name for this policy, such as Combined Security Info Registration on Trusted Networks.&lt;/p&gt; 
+&lt;p&gt;4. Under Assignments, select Users and groups. Choose the users and groups you want this policy to apply to, then select Done.&lt;/p&gt; 
+&lt;p&gt;Warning: Users must be enabled for combined registration.&lt;/p&gt; 
+&lt;p&gt;5. Under Cloud apps or actions, select User actions. Check Register security information, then select Done.&lt;/p&gt; 
+&lt;p&gt;6. Under Conditions &amp;gt; Locations, configure the following options:&lt;br&gt; a. Configure Yes.&lt;br&gt; b. Include Any location.&lt;br&gt; c. Exclude All trusted locations.&lt;/p&gt; 
+&lt;p&gt;7. Select Done on the Locations window, then select Done on the Conditions window.&lt;/p&gt; 
+&lt;p&gt;8. Under Access controls &amp;gt; Grant, choose Block access, then Select.&lt;/p&gt; 
+&lt;p&gt;9. Set Enable policy to On.&lt;/p&gt; 
+&lt;p&gt;10. To finalize the policy, select Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable combined security information registration in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that combined security information registration is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD14" name="Enable device based Conditional Access" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable device based Conditional Access&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Improve security and user experiences with device-based Conditional Access. This control ensures users can only access from devices that meet your standards for security and compliance. These devices are also known as managed devices. Managed devices can be Intune compliant or Hybrid Azure AD joined devices.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Managed devices&lt;/p&gt; 
+&lt;p&gt;In simple terms, managed devices are devices that are under some sort of organizational control. In Azure AD, the prerequisite for a managed device is that it has been registered with Azure AD. Registering a device creates an identity for the device in form of a device object. This object is used by Azure to track status information about a device. As an Azure AD administrator, you can already use this object to toggle (enable/disable) the state of a device.&lt;/p&gt; 
+&lt;p&gt;To get a device registered with Azure AD, you have three options:&lt;/p&gt; 
+&lt;p&gt;- Azure AD registered devices - to get a personal device registered with Azure AD&lt;br&gt; - Azure AD joined devices - to get an organizational Windows 10 device that is not joined to an on-premises AD registered with Azure AD.&lt;br&gt; - Hybrid Azure AD joined devices - to get a Windows 10 or supported down-level device that is joined to an on-premises AD registered with Azure AD.&lt;/p&gt; 
+&lt;p&gt;To become a managed device, a registered device must be either a Hybrid Azure AD joined device or a device that has been marked as compliant.&lt;/p&gt; 
+&lt;p&gt;Require Hybrid Azure AD joined devices&lt;/p&gt; 
+&lt;p&gt;In your Conditional Access policy, you can select Require Hybrid Azure AD joined device to state that the selected cloud apps can only be accessed using a managed device.&lt;/p&gt; 
+&lt;p&gt;This setting only applies to Windows 10 or down-level devices such as Windows 7 or Windows 8 that are joined to an on-premises AD. You can only register these devices with Azure AD using a Hybrid Azure AD join, which is an automated process to get a Windows 10 device registered.&lt;/p&gt; 
+&lt;p&gt;What makes a Hybrid Azure AD joined device a managed device? For devices that are joined to an on-premises AD, it is assumed that the control over these devices is enforced using management solutions such as Configuration Manager or group policy (GP) to manage them. Because there is no method for Azure AD to determine whether any of these methods has been applied to a device, requiring a hybrid Azure AD joined device is a relatively weak mechanism to require a managed device. It is up to you as an administrator to judge whether the methods that are applied to your on-premises domain-joined devices are strong enough to constitute a managed device if such a device is also a Hybrid Azure AD joined device.&lt;/p&gt; 
+&lt;p&gt;Require device to be marked as compliant&lt;/p&gt; 
+&lt;p&gt;The option to require a device to be marked as compliant is the strongest form to request a managed device.&lt;/p&gt; 
+&lt;p&gt;This option requires a device to be registered with Azure AD, and also to be marked as compliant by:&lt;br&gt; - Intune&lt;br&gt; - A third-party mobile device management (MDM) system that manages Windows 10 devices via Azure AD integration. Third-party MDM systems for device OS types other than Windows 10 are not supported.&lt;/p&gt; 
+&lt;p&gt;For a device that is marked as compliant, you can assume that:&lt;br&gt; - The mobile devices your workforce uses to access company data are managed&lt;br&gt; - Mobile apps your workforce uses are managed&lt;br&gt; - Your company information is protected by helping to control the way your workforce accesses and shares it&lt;br&gt; - The device and its apps are compliant with company security requirements&lt;/p&gt; 
+&lt;p&gt;Scenario: Require device enrollment for iOS and Android devices&lt;/p&gt; 
+&lt;p&gt;In this scenario, Contoso has decided that all mobile access to Microsoft 365 resources must use an enrolled device. All of their users already sign in with Azure AD credentials and have licenses assigned to them that include Azure AD Premium P1 or P2 and Microsoft Intune.&lt;/p&gt; 
+&lt;p&gt;Organizations must complete the following steps in order to require the use of an enrolled mobile device.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Security &amp;gt; Conditional Access.&lt;br&gt; 3. Select New policy.&lt;br&gt; 4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.&lt;br&gt; 5. Under Assignments, select Users and groups&lt;br&gt; a. Under Include, select All users or the specific Users and groups you wish to apply this policy to.&lt;br&gt; b. Select Done.&lt;br&gt; 6. Under Cloud apps or actions &amp;gt; Include, select Office 365.&lt;br&gt; 7. Under Conditions, select Device platforms.&lt;br&gt; a. Set Configure to Yes.&lt;br&gt; b. Include Android and iOS.&lt;br&gt; 8. Under Access controls &amp;gt; Grant, select the following options:&lt;br&gt; - Require device to be marked as compliant&lt;br&gt; 9. Confirm your settings and set Enable policy to On.&lt;br&gt; 10. Select Create to create and enable your policy.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How To: Require managed devices for cloud app access with Conditional Access" url="https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/require-managed-devices#require-hybrid-azure-ad-joined-devices"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that device based Conditional Access is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD16" name="Enable Microsoft's password guidance" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Microsoft's password guidance&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Password Guidance provides Microsoft's recommendations for password management based on current research and lessons from their own experience as one of the largest Identity Providers (IdPs) in the world. It covers recommendations for end users and identity administrators.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Download and enforce Microsoft's password guidance in your organization.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Password Guidance" url="https://www.microsoft.com/en-us/research/publication/password-guidance/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Microsoft's password guidance is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD7" name="Enable password writeback for SSPR if using hybrid identities" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable password writeback for SSPR if using hybrid identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; With Azure Active Directory (Azure AD) self-service password reset (SSPR), users can update their password or unlock their account using a web browser. In a hybrid environment where Azure AD is connected to an on-premises Active Directory Domain Services (AD DS) environment, this scenario can cause passwords to be different between the two directories.&lt;/p&gt; 
+&lt;p&gt;Password writeback can be used to synchronize password changes in Azure AD back to your on-premises AD DS environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on-premises directory from Azure AD.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;/p&gt; 
+&lt;p&gt;Enable password writeback for SSPR&lt;/p&gt; 
+&lt;p&gt;Note: Before proceeding to the following steps, make sure you have enabled password writeback to Azure AD Connect first.&lt;/p&gt; 
+&lt;p&gt;With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.&lt;/p&gt; 
+&lt;p&gt;To enable password writeback in SSPR, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using a global administrator account.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, select Password reset, then choose On-premises integration.&lt;/p&gt; 
+&lt;p&gt;3. Set the option for Write back passwords to your on-premises directory? to Yes.&lt;/p&gt; 
+&lt;p&gt;4. Set the option for Allow users to unlock accounts without resetting their password? to Yes.&lt;/p&gt; 
+&lt;p&gt;5. When ready, select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Enable Azure Active Directory self-service password reset writeback to an on-premises environment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback#enable-password-writeback-for-sspr"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that password writeback for SSPR is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD10" name="Enable Privileged Identity Management for tracking admin role use" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Privileged Identity Management for tracking admin role use&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Use Privileged Identity Management (PIM) to manage, control, and monitor access within your Azure Active Directory (Azure AD) organization. With PIM you can provide as-needed and just-in-time access to Azure resources, Azure AD resources, and other Microsoft online services like Microsoft 365 or Microsoft Intune.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Licensing requirements&lt;/p&gt;
+
+  &lt;p&gt;To use Privileged Identity Management, your directory must have one of the following paid or trial licenses.&lt;/p&gt;
+
+  &lt;p&gt;- Azure AD Premium P2&lt;br /&gt;
+- Enterprise Mobility + Security (EMS) E5&lt;/p&gt;
+
+  &lt;p&gt;When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):&lt;/p&gt;
+
+  &lt;p&gt;- Azure automatically enables PIM for the organization&lt;br /&gt;
+- Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment&lt;br /&gt;
+When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.&lt;/p&gt;
+
+  &lt;p&gt;For more PIM configurations please see Reference URL.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Start using Privileged Identity Management" url="https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Privileged Identity Management is enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD2" name="Enable Security defaults for Azure AD" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Security defaults for Azure AD&lt;/p&gt;&lt;p&gt;Rationale:&lt;br&gt; Managing security can be difficult with common identity-related attacks like password spray, replay, and phishing becoming more and more popular. Security defaults make it easier to help protect your organization from these attacks with preconfigured security settings:&lt;/p&gt;&lt;p&gt;- Requiring all users to register for Azure AD Multi-Factor Authentication.&lt;br&gt; - Requiring administrators to perform multi-factor authentication.&lt;br&gt; - Blocking legacy authentication protocols.&lt;br&gt; - Requiring users to perform multi-factor authentication when necessary.&lt;br&gt; - Protecting privileged activities like access to the Azure portal.&lt;/p&gt;&lt;p&gt;Note: If your tenant was created on or after October 22, 2019, it is possible security defaults are already enabled in your tenant.&lt;/p&gt;&lt;p&gt;Remediation:&lt;br&gt; Enabling security defaults&lt;br&gt; To enable security defaults in your directory:&lt;/p&gt;&lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br&gt; 2. Browse to Azure Active Directory &amp;gt; Properties.&lt;br&gt; 3. Select Manage security defaults.&lt;br&gt; 4. Set the Enable security defaults toggle to Yes.&lt;br&gt; 5. Select Save.&lt;/p&gt;&lt;p&gt;Impact:&lt;br&gt; Warning: Before you enable security defaults, make sure your administrators are not using older authentication protocols.&lt;/p&gt;&lt;p&gt;Who should use Conditional Access instead of Security defaults?&lt;br&gt; - If you are an organization currently using Conditional Access policies to bring signals together, to make decisions, and enforce organizational policies, security defaults are probably not right for you.&lt;br&gt; - If you are an organization with Azure Active Directory Premium licenses, security defaults are probably not right for you.&lt;br&gt; - If your organization has complex security requirements you should consider Conditional Access.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What are security defaults?" url="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;To ensure that Security defaults are enabled:&lt;/p&gt;      &lt;p&gt;1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.&lt;br /&gt;  2. Browse to Azure Active Directory &gt; Properties.&lt;br /&gt;  3. Select Manage security defaults.&lt;br /&gt;  4. Check that the Enable security defaults toggle is set to Yes.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD6" name="Enable self-service password reset (SSPR)" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable self-service password reset (SSPR)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Self-Service Password Reset (SSPR) is an Azure Active Directory (AD) feature that enables users to reset their passwords without contacting IT staff for help. The users can quickly unblock themselves and continue working no matter where they are or time of day. By allowing the employees to unblock themselves, your organization can reduce the non-productive time and high support costs for most common password-related issues.&lt;/p&gt; 
+&lt;p&gt;SSPR has the following key capabilities:&lt;/p&gt; 
+&lt;p&gt;- Self-service allows end users to reset their expired or non-expired passwords without contacting an administrator or helpdesk for support.&lt;br&gt; - Password Writeback allows management of on-premises passwords and resolution of account lockout though the cloud.&lt;br&gt; - Password management activity reports give administrators insight into password reset and registration activity occurring in their organization.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; This is how configure SSPR for a set of users in a test group. In the following example, the group SSPR-Test-Group is used. Provide your own Azure AD group as needed:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account with global administrator permissions.&lt;/p&gt; 
+&lt;p&gt;2. Search for and select Azure Active Directory, then choose Password reset from the menu on the left-hand side.&lt;/p&gt; 
+&lt;p&gt;3. From the Properties page, under the option Self service password reset enabled, choose Select group&lt;/p&gt; 
+&lt;p&gt;4. Browse for and select your Azure AD group, such as SSPR-Test-Group, then choose Select.&lt;/p&gt; 
+&lt;p&gt;5. To enable SSPR for the select users, select Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Plan an Azure Active Directory self-service password reset deployment" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment"/>
+            <reference name="Tutorial: Enable users to unlock their account or reset passwords using Azure Active Directory self-service password reset" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Test self-service password reset&lt;/p&gt;
+
+  &lt;p&gt;With SSPR enabled and configured, test the SSPR process with a user that's part of the group you selected in the Remediation section, such as Test-SSPR-Group. In the following example, the testuser account is used. Provide your own user account that's part of the group you enabled for SSPR in the Remediation section.&lt;/p&gt;
+
+  &lt;p&gt;Note: When you test self-service password reset, use a non-administrator account. By default, admins are enabled for self-service password reset and are required to use two authentication methods to reset their password. For more information, see Administrator reset policy differences.&lt;/p&gt;
+
+  &lt;p&gt;1. To see the manual registration process, open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/ssprsetup. Users should be directed to this registration portal when they next sign-in.&lt;/p&gt;
+
+  &lt;p&gt;2. Sign in with a non-administrator test user, such as testuser, and register your authentication methods contact information.&lt;/p&gt;
+
+  &lt;p&gt;3. Once complete, select the button marked Looks good and close the browser window.&lt;/p&gt;
+
+  &lt;p&gt;4. Open a new browser window in InPrivate or incognito mode, and browse to https://aka.ms/sspr.&lt;/p&gt;
+
+  &lt;p&gt;5. Enter your non-administrator test users' account information, such as testuser, the characters from the CAPTCHA, and then select Next.&lt;/p&gt;
+
+  &lt;p&gt;6. Follow the verification steps to reset your password. When complete, you should receive an e-mail notification that your password was reset.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD17" name="Ensure there are no Azure Active Directory guest users if they are not needed" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.&lt;/p&gt;&lt;p&gt;Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.&lt;/p&gt;&lt;p&gt;Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely leading to a potential vulnerability.&lt;/p&gt;&lt;p&gt;Guest users should be review on a monthly basis to ensure that inactive and unneeded accounts are removed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Until you have a business need to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Delete all "Guest" users that are no longer required or are inactive.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;It is good practice to use a dynamic group to manage guest users. To create the dynamic group:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Navigate to the Active Directory blade in the Azure Portal&lt;/li&gt;&lt;li&gt;Select the &lt;i&gt;Groups &lt;/i&gt;item&lt;/li&gt;&lt;li&gt;Create new&lt;/li&gt;&lt;li&gt;Type of &lt;i&gt;dynamic&lt;/i&gt;&lt;/li&gt;&lt;li&gt;Use the following dynamic selection rule. "(user.userType -eq "Guest")"&lt;/li&gt;&lt;li&gt;Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="1.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="PA-3" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Azure Active Directory&lt;/li&gt;&lt;li&gt;Go to Users and group&lt;/li&gt;&lt;li&gt;Go to All Users&lt;/li&gt;&lt;li&gt;Click on Show drop down and select Guest users only&lt;/li&gt;&lt;li&gt;Ensure that guest users listed are still required (USER TYPE = Guest)&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface 2.0&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az ad user list --query "[?userType=='Guest']"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure all users listed are not inactive and still required.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using PowerShell&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Connect-AzureAD (Only needs to be performed once within the PowerShell session) Get-AzureADUser |Where-Object {$_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD9" name="Integrate supported SaaS applications from the gallery to Azure AD and enable SSO" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Integrate supported SaaS applications from the gallery to Azure AD and enable Single sign on (SSO)&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Azure AD has a gallery that contains thousands of pre-integrated applications. Some of the applications your organization uses are probably in the gallery accessible directly from the Azure portal. Provide access to corporate SaaS applications remotely and securely with improved user experience (SSO).&lt;/p&gt; 
+&lt;p&gt;After integrating supported SaaS applications, you can automatically create user identities and roles in the cloud (SaaS) applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change, increasing your organization's security.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Add an app to your Azure AD tenant&lt;/p&gt; 
+&lt;p&gt;To add an application to your Azure AD tenant:&lt;/p&gt; 
+&lt;p&gt;1. In the Azure portal, on the left navigation panel, select Azure Active Directory.&lt;/p&gt; 
+&lt;p&gt;2. In the Azure Active Directory pane, select Enterprise applications. The All applications pane opens and displays a random sample of the applications in your Azure AD tenant.&lt;/p&gt; 
+&lt;p&gt;3. In the Enterprise applications pane, select New application.&lt;/p&gt; 
+&lt;p&gt;4. Switch to the new gallery preview experience: In the banner at the top of the Add an application page, select the link that says Click here to try out the new and improved app gallery.&lt;/p&gt; 
+&lt;p&gt;5. The Browse Azure AD Gallery (Preview) pane opens and displays tiles for cloud platforms, on-premises applications, and featured applications. Applications listed in the Featured applications section have icons indicating whether they support federated single sign-on (SSO) and provisioning.&lt;/p&gt; 
+&lt;p&gt;6. You can browse the gallery for the application you want to add, or search for the application by entering its name in the search box. Then select the application from the results.&lt;/p&gt; 
+&lt;p&gt;7. The next step depends on the way the developer of the application implemented single sign-on (SSO). Single sign-on can be implemented by app developers in four ways. The four ways are SAML, OpenID Connect, Password, and Linked. When you add an app, you can choose to filter and see only apps using a particular SSO implementation as shown in the screenshot. For example, a popular standard to implement SSO is called Security Assertion Markup Language (SAML). Another standard that is popular is called OpenId Connect (OIDC). The way you configure SSO with these standards is different so take note of the type of SSO that is implemented by the app that you are adding.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the OIDC standard for SSO then select Sign Up. A setup page appears. Next, go to the quickstart on setting up OIDC-based single sign-on.&lt;/p&gt; 
+&lt;p&gt;- If the developer of the app used the SAML standard for SSO then select Create. A getting started page appears with the options for configuring the application for your organization. In the form, you can edit the name of the application to match the needs of your organization. Next, go to the quickstart on setting up SAML-based single sign-on.&lt;/p&gt; 
+&lt;p&gt;Important: There are some key differences between SAML-based and OIDC-based SSO implementations. With SAML-based apps you can add multiple instances of the same app. For example, GitHub1, GitHub2, etc.. For OIDC-based apps you can only add one instance of an app. If you have already added an OIDC-based app and try to add the same app again and provide consent twice, it will not be added again in the tenant.&lt;/p&gt; 
+&lt;p&gt;If the application you are looking for is not in the gallery then you can select the link Create your own application and then under What are you looking to do with your application? choose Integrate any other application you do not find in the gallery. Microsoft has already worked with many application developers to pre-configure them to work with Azure AD. The pre-configured apps show up in the gallery. But if the app you want to add is not listed then you can create a new, generic, app and then configure it yourself or with the guidance of the developer that created it.&lt;/p&gt; 
+&lt;p&gt;You have finished adding an application.&lt;/p&gt; 
+&lt;p&gt;How to set up automatic provisioning to an application&lt;/p&gt; 
+&lt;p&gt;For pre-integrated applications listed in the gallery, step-by-step guidance is available for setting up automatic provisioning. Please follow Reference URL for more details.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Quickstart: Add an application to your Azure Active Directory (Azure AD) tenant" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal"/>
+            <reference name="What is automated SaaS app user provisioning in Azure AD?" url="https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing supported SaaS applications integration&lt;/p&gt;
+
+  &lt;p&gt;Azure recommends using a non-production environment to test the steps in the description section.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD13" name="Secure legacy apps with Azure Active Directory" issueId="" issueLink="" platform="" cost="0" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure legacy apps with Azure Active Directory&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Publish and protect your on-premises and cloud legacy authentication applications by connecting them to Azure AD with your existing application delivery controller or network.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; You can protect your on-premises and cloud legacy authentication applications by connecting them to Azure Active Directory (AD) with:&lt;/p&gt; 
+&lt;p&gt;- Azure AD Application Proxy&lt;/p&gt; 
+&lt;p&gt;- Your existing application delivery controllers and networks&lt;/p&gt; 
+&lt;p&gt;- Virtual Private Network (VPN) and Software-Defined Perimeter (SDP) applications&lt;/p&gt; 
+&lt;p&gt;You can bridge the gap and strengthen your security posture across all applications with Azure AD capabilities like Azure AD Conditional Access and Azure AD Identity Protection.&lt;/p&gt; 
+&lt;p&gt;For more details please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure hybrid access: Secure legacy apps with Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/secure-hybrid-access"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your on-premises and cloud legacy authentication applications are secured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-AD15" name="Use Azure AD B2B to invite guest users" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure AD B2B to invite guest users&lt;/p&gt;
+
+  &lt;p&gt;Rationale:&lt;br /&gt;
+Azure Active Directory (Azure AD) business-to-business (B2B) collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with guest users from any other organization, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources. Developers can use Azure AD business-to-business APIs to customize the invitation process or write applications like self-service sign-up portals.&lt;/p&gt;
+
+  &lt;p&gt;Remediation:&lt;br /&gt;
+Invite guest users from the Azure AD portal&lt;/p&gt;
+
+  &lt;p&gt;As an administrator, you can add guest users to your organization in the Azure portal.&lt;/p&gt;
+
+  &lt;p&gt;- Create a new guest user in Azure AD, similar to how you'd add a new user.&lt;br /&gt;
+- Assign guest users to apps or groups.&lt;br /&gt;
+- Send an invitation email that contains a redemption link, or send a direct link to an app you want to share.&lt;br /&gt;
+- Guest users follow a few simple redemption steps to sign in.&lt;/p&gt;
+
+  &lt;p&gt;Impact:&lt;br /&gt;
+None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What is guest user access in Azure Active Directory B2B?" url="https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that Azure AD B2B is used to invite guest users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="50"/>
+                <countermeasure ref="AZ-A04" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD1" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD16" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD2" mitigation="12"/>
+                    <countermeasure ref="AZURE-AD4" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD6" mitigation="13"/>
+                    <countermeasure ref="AZURE-AD7" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="12"/>
+                <countermeasure ref="AZURE-AD1" mitigation="12"/>
+                <countermeasure ref="AZURE-AD16" mitigation="13"/>
+                <countermeasure ref="AZURE-AD2" mitigation="12"/>
+                <countermeasure ref="AZURE-AD4" mitigation="13"/>
+                <countermeasure ref="AZURE-AD6" mitigation="13"/>
+                <countermeasure ref="AZURE-AD7" mitigation="13"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD3" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZURE-AD3" mitigation="20"/>
+                <countermeasure ref="AZURE-AD5" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-16">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD18" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD18" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
+                                ports or security network configurations.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="no-alerts-access">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-DATA-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD8" mitigation="50"/>
+                    <countermeasure ref="AZURE-AD9" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD8" mitigation="50"/>
+                <countermeasure ref="AZURE-AD9" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-L01" mitigation="20"/>
+                    <countermeasure ref="AZ-L05" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD10" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD11" mitigation="20"/>
+                    <countermeasure ref="AZURE-AD12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-L01" mitigation="20"/>
+                <countermeasure ref="AZ-L05" mitigation="20"/>
+                <countermeasure ref="AZURE-AD10" mitigation="20"/>
+                <countermeasure ref="AZURE-AD11" mitigation="20"/>
+                <countermeasure ref="AZURE-AD12" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-AD13" mitigation="34"/>
+                    <countermeasure ref="AZURE-AD14" mitigation="33"/>
+                    <countermeasure ref="AZURE-AD15" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-AD13" mitigation="34"/>
+                <countermeasure ref="AZURE-AD14" mitigation="33"/>
+                <countermeasure ref="AZURE-AD15" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="824ea612-060b-4baf-a326-47c8456bf04b" diagramComponentId="0193ed83-3192-408d-93d2-f20538095cf6" ref="5ca55fe8-d024-4416-b6b9-abd237a56b2e" name="Back-end server" desc="" library="" parentComponentRef="" componentDefinitionRef="back-end-server">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_SEGM"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CSMS-4.3.1-1.1+3.1" name="Abuse of privileges by staff (insider attack)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.1-2.1" name="Attack on back-end server stops it functioning" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; For example it prevents it from interacting with vehicles and providing services they rely on&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.1-3.5" name="Information breach" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; &lt;b&gt;Information breach &lt;/b&gt;by unintended sharing of data (e.g. admin errors)&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.1-3.2" name="Loss of information in the cloud" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; Sensitive data may be lost due to attacks or accidents when data is stored by third-party cloud service providers&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.1-1.2+3.3" name="Unauthorized internet access to the server" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Enabled for example by backdoors, unpatched system software vulnerabilities, SQL attacks or other means&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CSMS-4.3.1-1.3+3.4" name="Unauthorized physical access to the server" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt; Conducted by for example USB sticks or other media connecting to the server&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:46.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSMS-M4" name="Minimize risks associated with cloud computing" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Security Controls are applied to minimize risks associated with cloud computing. Example Security Controls can be found in OWASP and NCSC cloud computing guidance&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cloud Penetration Testing Playbook" url="https://cloudsecurityalliance.org/artifacts/cloud-penetration-testing-playbook/"/>
+            <reference name="NCSC Cloud Security Guidance" url="https://www.ncsc.gov.uk/collection/cloud-security/implementing-the-cloud-security-principles"/>
+            <reference name="OWASP T10 Cloud Security" url="https://owasp.org/www-pdf-archive/Cloud-Top10-Security-Risks.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M4" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.961">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M1" name="Minimize the risk of insider attack" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Security controls are applied to back-end systems to minimize the risk of insider attack&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Insiders: The Threat is Already Within" url="https://owasp.org/www-pdf-archive//OWASPIL-2016-06-14_Insiders-TheThreatisAlreadyWithin_SagieDulce-ShiriMargel.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M1" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M2" name="Minimize unauthorized access" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Security Controls are applied to back-end systems to minimize unauthorized access. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP T10: A5:2017-Broken Access Control" url="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="5.4.1" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="5.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="6.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="6.4.7" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M2" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M3" name="Prepare recovery measures in case of system outage" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Security Controls are applied to back-end systems. Where back-end servers are critical to the provision of services there are recovery measures in case of system outage. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Anti Ransomware Guide" url="https://owasp.org/www-pdf-archive/Anti-RansomwareGuidev1-7.pdf"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M3" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M5" name="Prevent data breaches" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Security Controls are applied to back-end systems to prevent data breaches. Example Security Controls can be found in OWASP&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP T10 Privacy Risks" url="https://owasp.org/www-pdf-archive/OWASP_Top_10_Privacy_Countermeasures_v1.0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.4" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.5" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.6" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.7" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.8" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="8.9" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M5" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSMS-M8" name="Prevent unauthorized access through system design" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt; Through system design and access control it should not be possible for unauthorized personnel to access personal or system critical data&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP T10: A5:2017-Broken Access Control" url="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="10.4.2" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="10.4.3" supportedStandardRef="iso-sae-21434"/>
+            <standard ref="M8" supportedStandardRef="unece-wp29-csms"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="unece-wp-29-csms">
+          <threats>
+            <threat ref="CSMS-4.3.1-1" name="Back-end servers used as a means to attack a vehicle or extract data" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
+              <desc>This threat include: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Back-end servers as an attack vector&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSMS-4.3.1-1.1+3.1">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CSMS-4.3.1-1.2+3.3">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CSMS-4.3.1-1.3+3.4">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M8" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSMS-M1" mitigation="34"/>
+                <countermeasure ref="CSMS-M2" mitigation="33"/>
+                <countermeasure ref="CSMS-M8" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSMS-4.3.1-2" name="Services from back-end server being disrupted affecting the operation of a vehicle" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
+              <desc>This threat include: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Disruption of services from back-end&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSMS-4.3.1-2.1">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSMS-M3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSMS-4.3.1-3" name="Vehicle related data held on back-end servers being lost or compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="unece-wp-29-csms" editable="true">
+              <desc>This threat include: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Loss of back-end servers's vehicle related data&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CSMS-4.3.1-3.2">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CSMS-4.3.1-3.5">
+                  <countermeasures>
+                    <countermeasure ref="CSMS-M5" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSMS-M4" mitigation="50"/>
+                <countermeasure ref="CSMS-M5" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3cdf7296-17cc-4113-a6a5-0db620b7cb71" diagramComponentId="120a9a07-bea1-4e2f-b8f3-5e42390e2dd9" ref="d85f98d6-9f53-455a-86f8-4d239429e392" name="OT" desc="" library="" parentComponentRef="" componentDefinitionRef="iot-application">
+      <tags/>
+      <questions>
+        <question ref="cloud-hosted-no" answer="true" manuallyModified="false"/>
+        <question ref="iot-web-ui-no" answer="true" manuallyModified="false"/>
+        <question ref="mqtt-client-no" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-592" name="Authentication Bypass Issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly perform authentication, allowing it to be bypassed through various methods.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-592: Authentication Bypass Issues" url="https://cwe.mitre.org/data/definitions/592.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.715">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-209" name="Information Exposure Through an Error Message" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software generates an error message that includes sensitive information about its environment, users, or associated data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;This sensitive information may be valuable on its own (such as a password), or it may be useful for launching other deadlier attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-209: Information Exposure Through an Error Message" url="https://cwe.mitre.org/data/definitions/209.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NO-PASSWORD-CHANGE" name="Lack of password change facility" state="0" impact="100" issueId="" issueLink="">
+          <desc>When the application does not offer a password change facility, a compromise of the current user password will lead to an attacker having persistent access to the account.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
+          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.160">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNPATCHED-PRODUCT" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches and updates are not applied in a timely manner then a product (e.g. Operating System, Software or Mobile App) or a system could be vulnerable to known security issues. These issues could be leveraged by an attacker to gain access to the system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-307" name="The application does not implement anti-automation mechanisms to prevent automated long-time sustained probes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
+
+This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, to compromise program logic (such as limiting humans to a single vote), or for other purposes. For example, an authentication routine might not limit the number of times an attacker can guess a password, or a website might conduct a poll but only expect humans to vote a maximum of once a day.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:50.159">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-254-PROD" name="The product lacks key security features" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.497">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-400" name="Uncontrolled Resource Consumption ('Resource Exhaustion')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly restrict the size or amount of resources that are requested or
+                        influenced by an actor, which can be used to consume more resources than intended.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')" url="https://cwe.mitre.org/data/definitions/400.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="IOT2.4.13.3" name="All product related web servers have their web server HTTP trace and trace methods disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All product related web servers have their webserver HTTP trace and trace methods disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP trace method is normally used to return the full HTTP request back to the requesting client for proxy-debugging purposes. However, servers supporting the HTTP trace method are subject to cross-site scripting (XSS) attacks when used in conjunction with various weaknesses in browsers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Disable web servers' HTTP trace and trace methods. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, regarding an Apache2.0 server: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Modify the security.conf file located under /etc/apache2/conf.d/security and set the Track option to Off. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use curl to verify if HTTP TRACE was disabled in the server: 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;curl -v -X TRACE http://www.yourserver.com 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.889">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test HTTP Methods" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.14.1" name="All the production test and calibration software is erased, removed or secured before the product is dispatched from the factory" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All the production test and calibration software used during manufacture is erased, removed or secured before the product is dispatched from the factory.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The product should have all of the production test and calibration software used during manufacture erased, removed or secured before the product is dispatched from the factory. This is to prevent alteration of the product post manufacture when using authorized production software, for example, hacking of the RF characteristics for greater RF &lt;span class="caps"&gt;ERP&lt;/span&gt;. Where such functionality is required in a service center, it should be erased or removed upon completion of any servicing activities.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Erase, remove or secure all the production test and calibration software used during manufacture, before the product is dispatched from the factory.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.18" name="All the related servers and network elements prevent anonymous/guest access except for read only access to public information" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Read only access must be granted only for public information, so servers and network elements have to prevent all anonymous/guest access in order to prevent a potential theft or disclosure of sensitive information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all the related servers and network elements prevent anonymous/guest access except for read only access to public information. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>When you have identified an application interface, for example a Cisco router web interface or a WebLogic administrator portal, check that the known usernames and passwords for these devices do not result in successful authentication. To do this you can consult the manufacturer's documentation or, even simpler, you can find common credentials using a search engine or one of the sites or tools listed in the Reference section.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.890">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Default Credentials" url="https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/02-Testing_for_Default_Credentials"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.16" name="All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements store any passwords using a cryptographic implementation using industry standard cryptographic algorithms. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Passwords must be securely stored using only strong and approved cryptographic algorithms. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the product securely stores any passwords using an industry standard cryptographic algorithm. For example, see FIPS 140 or OWASP Password Storage Cheat Sheet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="FIPS PUB 140-2, Security Requirements for Cryptographic Modules, May 2001" url="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf"/>
+            <reference name="OWASP - Password Storage Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.16" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.890">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.17" name="All the related servers and network elements support access control measures" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the related servers and network elements support access control measures to restrict access to sensitive information or system processes to privileged accounts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sensitive information or system processes must be protected by means of access control measures implemented on servers and network elements. It is very important that users, devices, and systems be verified, authenticated and authorized before access to such critical data is granted, in order to prevent a potential theft or disclosure of sensitive information or system processes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all the related servers and network elements support access control measures. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NCSC CAF guidance - B.2 Identity and access control" url="https://www.ncsc.gov.uk/collection/caf/caf-principles-and-guidance/b-2-identity-and-access-control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.17" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Testing for role/privilege manipulation&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In every portion of the application where a user can create information in the database (e.g., making a payment, adding a contact, or sending a message), receive information (account statement, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record this functionality. The tester should try to access such functions as a different user in order to check if it is possible to access a function that should not be permitted for the user's role/privilege (but might be permitted as another user).&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://wiki.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.2" name="Any product related web servers have their webserver identification options switched off" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Any product related web servers have their webserver identification options (e.g. Apache or Linux) switched off. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When a web server is showing the world its type and possibly its version number, it allows attackers to launch targeted attacks against this specific web server and version. In addition, if the version of the web server is known to be vulnerable to a specific exploit, an attacker would just need to use the exploit as part of their attack. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Switch off the webserver identification options.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, to limit the information provided by an Apache server, modify the /etc/httpd/conf/httpd.conf file and change the following two lines: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ServerSignature Off 
+&lt;/div&gt; 
+&lt;div&gt;
+  ServerTokens Prod 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Save the file, exit, and restart your Apache web server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check what information the web sever is currently revealing. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, for an Apache server run: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  curl --head localhost 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you receive a response with a line similar to: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Server: Apache/2.2.15 (CentOS) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Then the web server is revealing too much information and should be reconfigured so that the output is: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Server: Apache 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="Fingerprint Web Server" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.5" name="Any product's port(s) that are not required for normal operation should be restricted or disabled" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If the product has any virtual port(s) that are not required for normal operation, they are only allowed to communicate with authorized and authenticated entities or are securely disabled when shipped.&lt;/p&gt; 
+&lt;p&gt; Where a port is used for field diagnostics, the port input commands are deactivated and the output provides no information which could compromise the device, such as credentials, memory addresses or function names. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have 80 or 443 open, or otherwise users will not be able to connect to use the web server. Thus, taking into account that every open port increases the attack surface, any product's port(s) that are not required for normal operation should be restricted or disabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Restrict or disable any port(s) that are not required for normal operation.&lt;/p&gt; 
+&lt;p&gt; Deactivate port input for port(s) that are used for field diagnostics and ensure their output provides no information which could compromise the device.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2014-I3 Insecure Network Services" url="https://www.owasp.org/index.php/Top_10_2014-I3_Insecure_Network_Services"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Checking for Insecure Network Services includes:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Determining if insecure network services exist by reviewing your device for open ports using a port scanner.&lt;/li&gt; 
+ &lt;li&gt;As open ports are identified, each can be tested using any number of automated tools that look for DoS vulnerabilities, vulnerabilities related to &lt;span class="caps"&gt;UDP&lt;/span&gt; services and vulnerabilities related to buffer overflow and fuzzing attacks.&lt;/li&gt; 
+ &lt;li&gt;Reviewing network ports to ensure they are absolutely necessary and if there are any ports being exposed to the internet using UPnP.&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.3-5.4" name="Implement Certificate pinning" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Certificate pinning is the process of associating the backend server with a particular X509 certificate or public key, instead of accepting any certificate signed by a trusted certificate authority. A mobile app that stores ("pins") the server certificate or public key will subsequently only establish connections to the known server. Verify that the server certificate is pinned. Pinning can be implemented in multiple ways:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Including server's certificate in the application bundle and performing verification on each connection. This requires an update mechanism whenever the certificate on the server is updated Limiting certificate issuer to e.g. one entity and bundling the intermediate CA's public key into the application. In this way we limit the attack surface and have a valid certificate.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Owning and managing your own PKI. The application would contain the intermediate CA's public key. This avoids updating the application every time you change the certificate on the server, due to e.g. expiration.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Note that using your own CA would cause the certificate to be self-singed. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Custom Certificate Stores and SSL Pinning" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4"/>
+            <reference name="OWASP MASVS - iOS - Testing Custom Certificate Stores and SSL Pinning" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-3-and-mstg-network-4"/>
+          </references>
+          <standards>
+            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Certificate pinning is implemented correctly.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.22" name="Input data validation should be maintained in accordance with industry practiced methods" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Input data validation should be maintained in accordance with industry practiced methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The failure to properly validate inputs is one of the most common software security weaknesses, specifically for web applications. This weakness leads to almost all of the major vulnerabilities in applications, such as cross site scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system attacks and buffer overflows. Input data should never be trusted, and therefore software should ensure that input data is strongly typed, has correct syntax, and that it is within length boundaries and contains only permitted characters or that numbers are correctly signed and within range boundaries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that input data validation is maintained in accordance with industry practiced methods as per NIST Special Publication 800-53 SI-10 (please see reference URL). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - SI-10 INFORMATION INPUT VALIDATION" url="https://nvd.nist.gov/800-53/Rev4/control/SI-10"/>
+            <reference name="OWASP Proactive Controls - C5 - Validate all inputs" url="https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.22" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that all areas that accept user data properly handle unexpected data such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;special characters (examples: &amp;lt; &amp;gt; $ % &amp;amp;)&lt;/li&gt; 
+  &lt;li&gt;values other than the default items (e.g. letters if the URL argument is normally a number)&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Testing Scope&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; Input Form Fields 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; Hidden Variables 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; URL Parameters 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Desired System Behavior&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Whenever unexpected data is received by the application, the application will gracefully handle the situation and not return a stack trace or display detailed system information to the user. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Invalid form data should result in a message shown to the user explaining how to complete the form correctly. Unexpected data in hidden fields or the URL should result in more generic messages such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;i&gt;&amp;nbsp;The requested operation could not be performed.&lt;/i&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Input Validation testing" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/"/>
+              <reference name="WebAppSec/Secure Coding QA Checklist" url="https://wiki.mozilla.org/WebAppSec/Secure_Coding_QA_Checklist"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.33" name="Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Memory locations used to store sensitive material (e.g. cryptographic keys, passwords/passphrases, etc.) are sanitized as soon as possible after they are no longer needed. These can include, but are not limited to, locations on the heap, the stack, and statically-allocated storage.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="ISO/IEC TR 24772:2013" url="https://www.iso.org/standard/61457.html"/>
+            <reference name="MEM03-C. Clear sensitive information stored in reusable resources" url="https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.33" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.2" name="Software images are digitally signed by the organization's approved signing authority. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where remote software upgrade can be supported by the device, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. A Certificate authority (CA) acts as a trusted third party, trusted both by the software author and by the device to verify the entity's identity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that, for remote software upgrades, the software images are digitally signed by the organization's approved signing authority.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting Software Integrity through code signing" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925977"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.4" name="Software images should be encrypted whilst being transferred to a device. (for remote software upgrade)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If remote software upgrades are supported by a device, software images should be encrypted whilst being transferred to it.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Data transmitted over a public network can be intercepted by unauthorized parties. A secure file transfer adds security features to the transmission by encrypting the file to preserve its confidentiality and integrity. This prevents eavesdroppers on the networks between the systems from accessing the file contents and reading or modifying them, necessitating the use of encryption for software images that are used for remote software upgrades.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Utilize encrypted protocols wherever possible to protect all data in transit. Where protocol encryption is not possible, consider encrypting data before the transfer.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Guide for Interconnecting Information Technology Systems" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-47.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.4" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.21" name="Software uses certificate pinning or public/private key equivalent for TCP/IP or UDP/IP connections" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the device software communicates with a product related webserver or application over &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP, the device software uses certificate pinning or public/private key equivalent, where appropriate.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Secure connections are a cornerstone for client/server communication. Users, developers, and applications expect end-to-end security for their secure channels, but some secure channels are not meeting this expectation. Specifically, channels built using well known protocols can be vulnerable to a number of attacks. For example, traditional certificate validation protects against many types of man-in-the-middle (&lt;span class="caps"&gt;MITM&lt;/span&gt;) attacks, but it doesn't prevent all of them.&lt;/p&gt; 
+&lt;p&gt;Certificate pinning can still prevent the interception of a program's network traffic. Pinning is the process of associating a host with their expected X509 certificate or public key, which can be added to an application during development, or it can be added upon first encountering the certificate or public key.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the device software uses certificate pinning or a public/private key equivalent for &lt;span class="caps"&gt;TCP&lt;/span&gt;/IP or &lt;span class="caps"&gt;UDP&lt;/span&gt;/IP connections.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate and Public Key Pinning" url="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What_Is_Pinning"/>
+            <reference name="Pinning Cheat Sheet" url="https://www.owasp.org/index.php/Pinning_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.21" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.26" name="Support for partially downloading updates is provided" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Support for partially downloading updates is provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions to a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially downloading updates may be provided for devices whose network access is limited or sporadic.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially downloading updates.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.25" name="Support for partially installing updates is provided" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Support for partially installing updates is provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both the Operating System and individual software programs. Updates can apply a wide range of revisions into a system, adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, support for partially installing updates may be provided for devices whose on-time is insufficient for the complete installation of a whole update.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software provides support for partially installing updates.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.15" name="The maximum permissible number of failed login attempts follows the recommendations of 3GPP TS33.117" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If web services allow users to enter passwords as many times as they want, an attacker may try to exploit this by using scripts that enter different combinations until the password cracks. To prevent this, the number of failed login attempts per user should be limited, for example, to 5 failed attempts, locking the user out as a result. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the maximum permissible number of consecutive failed user account login attempts follows the recommendations of 3GPP TS33.117. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.15" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Refer to the following test case in the 3GPP TS 33.117 document:&amp;nbsp;&amp;nbsp; 
+&lt;div&gt;
+  Test Name: TC_FAILED_LOGIN_ATTEMPTS&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="4.2.3.4.5 - Policy regarding consecutive failed login attempts" url="https://www.etsi.org/deliver/etsi_ts/133100_133199/133117/15.00.00_60/ts_133117v150000p.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.16" name="The product allows an authorized factory reset of the device's authorization information" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows an authorized factory reset of the device's authorization information.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The devices are often authorized to an account, based on license agreements with service providers. The device should have the option to be deauthorized and reset in case the user no longer wants to use it or if the user wants to authorize the device to another account.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows an authorized factory reset of the device's authorization information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.845">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.12" name="The product allows the factory issued or OEM login accounts to be disabled, erased or renamed" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; The factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts should be disabled, erased or renamed. This is to avoid the type of attacks where factory default logins and passwords are published on the web, which allows attackers to mount very simple scanning and dictionary attacks on devices.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product allows the factory issued or &lt;span class="caps"&gt;OEM&lt;/span&gt; login accounts to be disabled, erased or renamed when installed or commissioned.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.8" name="The product has protection against software reverting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product has protection against reverting the software to an earlier and potentially less secure version.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software updates perform numerous tasks and they are available for both Operating System and individual software programs. Updates can apply a wide range of revisions into a system such as adding new features, removing outdated features, updating drivers, fixing bugs, and most importantly, fixing security holes. For this reason, the product should have protection to prevent software reverting to an earlier, out-of-date and probably insecure version.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product has mechanisms against software reverting.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The importance of general software updates and patches" url="https://ie.norton.com/internetsecurity-how-to-the-importance-of-general-software-updates-and-patches.html"/>
+            <reference name="Why Software Updates Are So Important" url="https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/software-updates-important/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.8" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.11" name="The product only allows controlled user account access" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product only allows controlled user account access. Access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Product should not allow any unjustified anonymous or guest access in order to prevent potential theft or disclosure of sensitive information, therefore only controlled user account access should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product only allows controlled user account access and access using anonymous or guest user accounts is not supported without justification.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The best way to find out if an application has failed to properly restrict function level access is to verify every application function:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt;Does the UI show navigation to unauthorized functions?&lt;/li&gt; 
+ &lt;li&gt;Are server side authentication or authorization checks missing?&lt;/li&gt; 
+ &lt;li&gt;Are server side checks done that solely rely on information provided by the attacker?&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Using a proxy, browse your application with a privileged role. Then revisit restricted pages using a less privileged role. If the server responses are alike, you're probably vulnerable. Some testing proxies directly support this type of analysis.&lt;/p&gt; 
+&lt;p&gt;You can also check the access control implementation in the code. Try following a single privileged request through the code and verifying the authorization pattern. Then search the codebase to find where that pattern is not being followed.&lt;/p&gt; 
+&lt;p&gt; Automated tools are unlikely to find these problems.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.7" name="The product related web servers have repeated renegotiation of TLS connections disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The product related web servers have repeated renegotiation of TLS connections disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generally, a TLS renegotiation is a process that allows changing the details of a handshake after a connection is made with the server and it occurs when the session expires on either side and data continues to be sent. This means either that the session has simply expired due to timeout, or that a peer wants to change the cipher suite or wants to request a peer certificate and hasn't done so yet.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the case of web services, the server encrypts traffic using TLS, but allows a client to renegotiate the connection after the initial handshake. If the server does not&amp;nbsp; limit the number of renegotiations for a single TLS connection, then a client may open several simultaneous connections and repeatedly renegotiate them, which may exhaust the server's resources and lead to a Denial of Service (DoS) condition. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that web servers have repeated renegotiation of TLS connections disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tips for Securing SSL Renegotiation" url="https://www.mcafee.com/blogs/enterprise/tips-securing-ssl-renegotiation/"/>
+            <reference name="Transport Layer Security (TLS) Renegotiation Indication Extension" url="https://tools.ietf.org/html/rfc5746"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The following example demonstrates how to check if client-initiated renegotiation is supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -connect example.com:443 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Once the connection is established, the server will wait for us to type the next command. We can write the following two lines in order to initiate a renegotiation by specifying R in the second line, followed by enter or return. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -connect host:port 
+&lt;/div&gt; 
+&lt;div&gt;
+  HEAD / HTTP/1.0 
+&lt;/div&gt; 
+&lt;div&gt;
+  R 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;lt;Enter or Return key&amp;gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A system that does not support client-initiated renegotiation will return an error and end the connection or the connection will time out. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  RENEGOTIATING 
+&lt;/div&gt; 
+&lt;div&gt;
+  write:errno=104 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A system that supports client-initiated renegotiation will keep the connection active and respond to further commands.&amp;nbsp; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="Manually Testing SSL/TLS Weaknesses" url="https://www.contextis.com/us/blog/manually-testing-ssl-tls-weaknesses"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.6" name="The product/system enforces passwords to be compliant with 3GPP TS33.117 or similar recommendations" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Password entry follows industry standard practice such recommendations of the 3GPP TS33.117 Password policy. [ref. 1] or &lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3] on password length, characters from the groupings and special characters.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; A key concern when using passwords for authentication is password strength. A "strong" password policy makes it difficult or even improbable for one to guess the password through either manual or automated means. The main characteristics that define a strong password are length, complexity and topology (the pattern that a password is written).&lt;/p&gt; 
+&lt;p&gt;Passwords should not be vulnerable to dictionary attack, which is a type of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. &lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product/system enforces passwords to be compliant with 3GPP TS33.117 or similar (&lt;span class="caps"&gt;NIST&lt;/span&gt; SP800-63b [ref. 2] or &lt;span class="caps"&gt;NCSC&lt;/span&gt; [Ref 3]) recommendations to include: At least eight characters in length, characters from the groupings: alpha, numeric and special characters and should not be vulnerable to dictionary attack.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Catalogue of general security assurance requirements" url="https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2928"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="Password strategies that can help your organisation remain secure" url="https://www.ncsc.gov.uk/guidance/password-collection"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.6" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [3] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.5" name="The product will not allow new passwords containing the user account name with which the user account is associated" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The product will not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Weak passwords are a serious threat to computer security, and specifically the guessable ones should be forbidden through organizational policy and suitable technical measures. Using the user account name as password or part of a password is completely insecure and makes a brute-force attack against the login interface much easier.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the product does not allow new passwords containing the user account name with which the user account is associated.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Implement Proper Password Strength Controls" url="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"/>
+            <reference name="Testing for Default or Guessable User Account (OWASP-AT-003)" url="https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.5" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Please see reference [2] for &lt;span class="caps"&gt;OWASP&lt;/span&gt; testing methodology link.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.8" name="The related servers have unused IP ports disabled" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The related servers have unused IP ports disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  One of the most important principles in information security is to reduce the attack surface. Open ports are not always a security risk. For example, a web server has to have ports 80 or 443 open, or otherwise users will not be able to connect to use the web server. However, taking into account that every open port increases the attack surface, any related servers' port(s) that are not used should be disabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Disable the servers' unused IP ports.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - CM-7 LEAST FUNCTIONALITY" url="https://nvd.nist.gov/800-53/Rev4/control/CM-7"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.8" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  For example, the following command will look up, with a TCP connect scan, all open ports on IP 192.168.1.100 and will try to determine what services are bound to them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  nmap -PN -sT -sV -p0-65535 192.168.1.100 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Enumerate Applications on Webserver" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.24" name="The software has been designed to fail safely" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The software has been designed to meet the safety requirements identified in the risk assessment, i.e. in the case of unexpected invalid inputs, or erroneous software operations, the product does not become dangerous or compromise the security of other connected systems.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Software is expected to fail, but when it does it has to be in a safe way and security controls and settings must remain in effect. The confidentiality and integrity of a system should remain intact even if availability has been lost. Attackers must not be permitted to gain access rights to privileged objects during a failure when those objects are normally inaccessible. Upon failing, a system that reveals sensitive information about the failure to potential attackers could supply additional knowledge to launch an attack.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that software has been designed to fail safely. This typically involves several things:&lt;br /&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Secure defaults (default is to deny access).&lt;/li&gt; 
+ &lt;li&gt;Upon failure, undo changes and restore a secure state.&lt;/li&gt; 
+ &lt;li&gt;Always check return values for failure.&lt;/li&gt; 
+ &lt;li&gt;In conditional code/filters make sure that there is a default case that does the right thing.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Failing Securely" url="https://www.us-cert.gov/bsi/articles/knowledge/principles/failing-securely"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.24" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.4" name="Web servers' TLS certificate(s) are signed by trusted CAs, are within their validity period and processes are in place for their renewal" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  All the product related web servers' TLS certificate(s) are signed by trusted Certificate Authorities, are within their validity period and processes are in place for their renewal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The server validation component of TLS provides authentication between the server and the client via digital certificates. These certificates commonly include: 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Issuer: The entity that verified the information and issued the certificate (Certificate Authority). 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Valid to: The expiration date after which the certificate is no longer valid. 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Signature algorithm: The algorithm used to create the signature (keys) and prove its integrity. 
+&lt;/div&gt; 
+&lt;div&gt;
+  As mentioned above, the Certificate Authority (CA) is an entity that issues digital certificates and acts as a trusted third party, trusted both by the client and by the server, and which verifies the server's identity. Therefore, all web server certificates must be signed by a trusted Certificate Authority. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Expired or untrusted certificates that users usually ignore are an issue, as they are taken advantage of by attackers to expose users to DNS spoofing or Man-in-the-middle attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the web servers' TLS certificates are signed by trusted certificate authorities, their validity period has not elapsed, and that processes are in place for their renewal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Transport Layer Protection Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using OpenSSL, we can gather the server and intermediate certificates sent by a server using the following command: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  openssl s_client -showcerts -connect example.com:443 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="TLS/SSL Certificate Validity – Client and Server" url="https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_Transport_Layer_Security.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.30" name="When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When a device cannot verify the authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; To implement certain control capabilities into a system, you'll want to remotely reset the device so as to achieve a known-good state and recover from errors and implement new configuration changes. You may also want to be able to reset the device to a factory default configuration, which is useful when you want to decommission a device or as a more invasive way to recover from unknown error conditions.&lt;/p&gt; 
+&lt;p&gt;Lastly, issuing a command to update or reload firmware is very important in order maintain security of the remote device, implement feature enhancements, and patch bugs.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; When a device cannot verify authenticity of updates itself, it should be possible to revert to the last known good configuration which was stored on the device before the update was attempted.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Code of Practice for Consumer IoT Security" url="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/971440/Code_of_Practice_for_Consumer_IoT_Security_October_2018_V2.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.30" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.5.29" name="Where a device cannot verify the authenticity of updates itself, only local updates are permitted" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a device cannot verify the authenticity of updates itself (e.g. due to a lack of cryptographic capabilities), only local update by a physically present user is permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Code signing is the process of using a certificate-based digital signature to sign executables and scripts in order to confirm the software author and ensure that the code has not been altered or corrupted since it was signed. This process is used for remote updates too, where devices can verify the signature to confirm that the package is authentic and complete. For this reason, if a device cannot verify the authenticity of updates itself, only local updates should be permitted.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; If the device cannot verify the authenticity of updates, permit local updates only.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Top 10 2014-I9 Insecure Software/Firmware" url="https://www.owasp.org/index.php/Top_10_2014-I9_Insecure_Software/Firmware"/>
+          </references>
+          <standards>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.5.29" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.20" name="Where a Product or Service includes a critical functionality, the service's infrastructure shall incorporate protection against DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a Product or Service includes any safety-critical or life-impacting functionality, the service's infrastructure shall incorporate protection against Distributed Denial of Service (DDoS) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Denial of Service (DoS) attack focuses on making a resource (site, application, server, etc.) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may stop being available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles the resources it uses. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Distributed Denial of Service (DDoS) attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. The exploited machines can include computers and other networked resources such as IoT devices.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the services' infrastructure incorporates protection against Distributed Denial of Service (DDoS) attacks, such as dropping of traffic or sink-holing (please see NIST 800-53 SC-5, reference URL [1]). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - SC-5 DENIAL OF SERVICE PROTECTION" url="https://nvd.nist.gov/800-53/Rev4/control/SC-5"/>
+            <reference name="OWASP - Denial of Service" url="https://owasp.org/www-community/attacks/Denial_of_Service"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.20" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for Denial of Service" url="https://wiki.owasp.org/index.php/Testing_for_Denial_of_Service"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.21" name="Where a Product or Service includes critical functionality, the services' infrastructure shall incorporate redundancy to ensure service continuity and availability" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a Product or Service includes any safety-critical or life-impacting functionality, the services' infrastructure must incorporate redundancy to ensure service continuity and availability. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Since Web Services are susceptible to Denial of Service (DoS) attacks, it is important to replicate data and applications in a robust manner. Replication and redundancy can ensure access to critical data in the event of a failure. It will also enable the system to react in a coordinated way to deal with disruptions. Therefore, Web Services must be designed to include redundancy of critical functions, ensuring diversity among those critical functions implemented.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that, where a Product or Service includes a safety-critical or life-impacting functionality, the services' infrastructure incorporates redundancy to ensure service continuity and availability. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST - Guide to Secure Web Services" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-95.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.21" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.891">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.13.9" name="Where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Where a product related to a webserver encrypts communications using TLS and requests a client certificate, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In a traditional TLS handshake, the client authenticates the server, and the server doesn't know too much about the client. TLS Client Authentication is useful in cases where a server is keeping track of its numerous clients, as in IoT with millions of installs exchanging secure information. For example, an IoT company can issue a unique client certificate per device, and then limit the connections to their IoT infrastructure to only their devices by blocking connections where the client doesn't present a certificate signed by the company's Certificate Authority (CA). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that, where a TLS client certificate is requested, the server(s) only establishes a connection if the client certificate and its chain of trust are valid. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Client Authentication During SSL Handshake" url="https://docs.oracle.com/cd/E19424-01/820-4811/aakhe/index.html"/>
+            <reference name="OWASP - TLS Client Authentication" url="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.9" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that only users whose certificates are signed by the trusted certificate authority can successfully authenticate with the server using client certificates.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:48.892">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.3" name="Where a UI password is used for login authentication, the factory issued or reset password is unique to each device in the product family" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where a user interface password is used for login authentication, the factory issued or reset password is unique to each device in the product family.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Where a device needs a password to log in, a default password is usually provided that allows the device to be accessed during its initial setup, and then the user will be prompted to change it after he/she first logs on. An attacker with knowledge of the default password can log in, usually with root or administrative privileges and perform malicious actions. Therefore, all initial passwords and factory reset passwords issued should be unique to each user.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Apply a process which ensures that the initial user interface password or factory reset password is unique to each device in the product family. If a password-less authentication is used the same principles of uniqueness apply.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="US-CERT: Risks of Default Passwords on the Internet" url="https://www.us-cert.gov/ncas/alerts/TA13-175A"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.3" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.15" name="Where passwords are entered on a UI, the actual pass phrase is obscured by default" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where passwords are entered on a user interface, the actual pass phrase is obscured by default.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Password masking is the practice of obscuring the password characters when entered on a user interface, more often behind bullets (.), asterisks (*) or similar camouflaging characters. The idea behind password masking is primarily the protection against "shoulder surfing", in other words to prevent nearby observers reading the password "over the user's shoulder" and thus stolen, which is crucial for mobile devices. A second reason is to obscure the password in cases of shared screens, projectors, etc.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that the actual pass phrase is obscured by default where entered on a user interface.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Pros and Cons of Password Masking" url="https://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.15" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.2" name="Where the product has a secure source of time there is a method of validating its integrity" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Where the product has a secure source of time there is a method of validating its integrity.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Rationale:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Network Time Protocol (&lt;span class="caps"&gt;NTP&lt;/span&gt;) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, &lt;span class="caps"&gt;NTP&lt;/span&gt; is one of the oldest Internet protocols in current use. &lt;span class="caps"&gt;NTP&lt;/span&gt;sec is a fork implementation of &lt;span class="caps"&gt;NTP&lt;/span&gt; that has been systematically security-hardened.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;&lt;font size="4"&gt;Remediation:&lt;br /&gt;&lt;/font&gt;&lt;/b&gt; Ensure that where the product has a secure source of time there is a method of validating its integrity such as &lt;span class="caps"&gt;NTP&lt;/span&gt;sec (please see reference &lt;span class="caps"&gt;URL&lt;/span&gt; [1]).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NTPsec project - a secure, hardened, and improved implementation of Network Time Protocol derived from NTP" url="https://www.ntpsec.org/"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.2" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IOT2.4.8.17" name="Where the product  has the ability to remotely recover from an attack, it should rely on a known good state, to enable safe recovery and updating of the device" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;The ability to remotely recover from these situations should rely on a known good state, such as locally storing a known good version to enable safe recovery and updating of the device. This will avoid denial of service and costly recalls or maintenance visits, whilst managing the risk of potential takeover of the device by an attacker subverting update or other network communications mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Ensuring Software Integrity in IoT Devices" url="https://www.omicsonline.org/open-access/ensuring-software-integrity-in-iot-devices-2165-7866-1000217.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.17" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:49.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-control" name="Access control" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-37" name="An attacker examines a target system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-592">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-112" name="Attackers gain unauthorized access through Brute Force attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since eliminating patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-307">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                    <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="NO-PASSWORD-CHANGE">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.15" mitigation="100"/>
+                <countermeasure ref="IOT2.4.8.12" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.16" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.3" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.5" mitigation="20"/>
+                <countermeasure ref="IOT2.4.8.6" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.16" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="network-rate-limit" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
+                    <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.17" mitigation="50"/>
+                <countermeasure ref="IOT2.4.13.18" mitigation="50"/>
+                <countermeasure ref="IOT2.4.8.11" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-112-USERNAME" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>Attackers could perform a brute force attack against the login function by choosing a
+                                simple password that users are likely to use for the site, and that meets the site's
+                                password policy.
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
+                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
+                                through pure brute force means. &amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This type of attack cannot be defended against using an account lockout policy because
+                                each username is only attempted once.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="require-use-strong-passwords" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-256" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>A compromise of the storage system medium itself (device, server or database) could
+                                allow attackers full access to the data
+                                stored, including authentication credentials such as passwords.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-257">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="device-operation" name="Device operation" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="IOT-INSUF-SEC" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-209">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNPATCHED-PRODUCT">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
+                    <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
+                    <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
+                    <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.24" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.25" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.26" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.29" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.30" mitigation="15"/>
+                <countermeasure ref="IOT2.4.5.33" mitigation="14"/>
+                <countermeasure ref="IOT2.4.5.8" mitigation="13"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="OWASP A6:2017" name="Attackers attempt to exploit unpatched flaws to gain unauthorized access or knowledge of the system" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc., to gain unauthorized access or knowledge of the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.2" mitigation="33"/>
+                <countermeasure ref="IOT2.4.13.3" mitigation="33"/>
+                <countermeasure ref="IOT2.4.13.7" mitigation="34"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-400">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.20" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IOT-INSUF-SEC" name="Attackers gain access to the system exploiting insufficient or misconfigured security features" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>The product lacks key security features such as protection against tampering or unprotected storages, or it has other misconfigurations and omissions during production.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-254-PROD">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
+                    <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                    <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                    <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.21" mitigation="100"/>
+                <countermeasure ref="IOT2.4.8.15" mitigation="33"/>
+                <countermeasure ref="IOT2.4.8.17" mitigation="34"/>
+                <countermeasure ref="IOT2.4.8.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE" name="Attackers try to take advantage of a wide attack surface" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or other service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.14.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IOT-WIDE-ATTACK-SURFACE-OPEN-PORTS" name="Attackers try to retrieve banner information through the open ports to discover potential vulnerabilities" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;Every point of network interaction or another service is a potential part of the attack surface having exploitable vulnerabilities.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
+                    <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.8" mitigation="100"/>
+                <countermeasure ref="IOT2.4.5.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-94" name="Man in the Middle Attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>	&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.4" mitigation="50"/>
+                    <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
+                    <countermeasure ref="MASVS-5.3-5.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.4" mitigation="50"/>
+                <countermeasure ref="IOT2.4.5.21" mitigation="100"/>
+                <countermeasure ref="MASVS-5.3-5.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="read-or-post-data" name="Read or Post data" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-137" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&amp;amp;). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&amp;amp;new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.13.22" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="update-process" name="Update Process" desc="" library="iot-security-compliance-framework">
+          <threats>
+            <threat ref="CAPEC-122-UPDATE-PROCESS" name="An adversary is able to exploit the update process of the device to escalate its privileges" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.2" mitigation="50"/>
+                <countermeasure ref="IOT2.4.5.30" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-157" name="An attacker monitors information transmitted between logical or physical nodes of a network" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="iot-security-compliance-framework" editable="true">
+              <desc>&lt;p&gt;An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="IOT2.4.5.4" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="18099e0a-f9ae-4008-a7f6-23db907920c4" diagramComponentId="07f79851-e44e-4069-b4b4-df6893e9790e" ref="6ad37665-cc66-48ea-a5e5-6ed8dd861ac2" name="SaaS (Sales Force, Ariba, Intelex, etc)" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-web-apps">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are typically introduced during the
+                        configuration of the software.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.640">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.640">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            More information: Doc MS Azure
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.639">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.641">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WEBAPPS1" name="Configure App Service settings for each app" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure PostgreSQL databases.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure App Service Authentication is set on Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app is using the latest version of TLS encryption&lt;/li&gt;&lt;li&gt;Ensure the web app has 'Client Certificates (Incoming client certificates)&lt;/li&gt;&lt;li&gt;Ensure that Register with Azure Active Directory is enabled on App Service&lt;/li&gt;&lt;li&gt;Ensure that 'PHP version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Python version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Java version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'HTTP Version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure FTP deployments are disabled&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to Azure Portal using https://portal.azure.com&lt;/li&gt;&lt;li&gt;Go to App Services&lt;/li&gt;&lt;li&gt;Click on each App&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Authentication / Authorization&lt;ol&gt;&lt;li&gt;Set App Service Authentication to On&lt;/li&gt;&lt;li&gt;Choose other parameters as per your requirement and Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on SSL settings&lt;ol&gt;&lt;li&gt;Set HTTPS Only to On under Protocol Settings section&lt;/li&gt;&lt;li&gt;Set Minimum TLS Version to 1.2 under Protocol Settings section&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Configuration&lt;ol&gt;&lt;li&gt;Set the option Client certificate mode located under Incoming client certificates is set to Require&lt;/li&gt;&lt;li&gt;Set PHP version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Set HTTP version to 2.0 under General settings&lt;/li&gt;&lt;li&gt;Under Platform Settings, FTP state should be Disabled or FTPS Only&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Identity&lt;ol&gt;&lt;li&gt;Set Status to On&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Application settings&lt;ol&gt;&lt;li&gt;Set Python version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Under General settings, Set Java version to latest version available&lt;/li&gt;&lt;li&gt;Set Java minor version to latest version available&lt;/li&gt;&lt;li&gt;Set Java web container to the latest version of web container available&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Alternatively, some of these can be done with Azure CLI.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To set App Service Authentication for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp auth update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --enabled true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTPS-only traffic value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set httpsOnly=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set TLS Version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --min-tls-version 1.2&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Incoming client certificates value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set clientCertEnabled=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Register with Azure Active Directory feature for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp identity assign --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep php&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest PHP version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --php-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep python&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Python version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --python-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep java&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Java version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --java-version '1.8' --java-container 'Tomcat' --java-container-version '&amp;lt;VERSION&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTP 2.0 version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --http20-enabled true&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.10" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.10" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DP-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="IM-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="NS-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PV-3" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PV-7" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Configure the password expiration to force after a determinate time, the password code shall be
+                        changed for the users.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
+                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
+                        PowerShell. With the following command as the example:&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
+                        days. The users receive notification 14 days prior to that expiry.
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        More information:&amp;nbsp;
+                        &lt;a
+                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                        MS Azure&lt;/a&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;More information:
+                            &lt;a
+                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                            MS Azure&lt;/a&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Custom rules that you create 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a policy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
+&lt;/div&gt; 
+&lt;div&gt;
+  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Association tab, enter one of the following settings, then select Add: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select Review + create, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
+            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test the application gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Find the public IP address for the application gateway on its Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Copy the public IP address, and then paste it into the address bar of your browser. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Disable anonymous access 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow only authenticated requests 
+&lt;/div&gt; 
+&lt;div&gt;
+  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.303">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.304">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable WAF logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable logging through the Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. In the Azure portal, find your resource and select Diagnostic settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Application Gateway, three logs are available: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Access log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Performance log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Firewall log 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. To start collecting data, select Turn on diagnostics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Type a name for the settings, confirm the settings, and select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that all WAF logs are enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
+  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
+                            are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt;
+   Use encryption to protect traffic on external and public networks as it is critical for data protection 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Rationale: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Remediation: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Use a valid TLS/SSL certificate for custom domains. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Redirect HTTP to HTTPs 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enforce FTPS 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enable client certificates 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Impact: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
+            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
+            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test HTTPS 
+&lt;/div&gt; 
+&lt;div&gt;
+  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.305">
+              <output/>
+            </source>
+            <references>
+              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Secure application secrets 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
+  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
+  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
+  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
+  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
+  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
+   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0 is are blocked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:34.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="50"/>
+                <countermeasure ref="AZ-A04" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZ-A12" mitigation="20"/>
+                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-16">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
+                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
+                    <countermeasure ref="AZ-L01" mitigation="16"/>
+                    <countermeasure ref="AZ-L02" mitigation="16"/>
+                    <countermeasure ref="AZ-L04" mitigation="16"/>
+                    <countermeasure ref="AZ-L05" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
+                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
+                <countermeasure ref="AZ-L01" mitigation="16"/>
+                <countermeasure ref="AZ-L02" mitigation="16"/>
+                <countermeasure ref="AZ-L04" mitigation="16"/>
+                <countermeasure ref="AZ-L05" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N01" mitigation="25"/>
+                    <countermeasure ref="AZ-N02" mitigation="25"/>
+                    <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N01" mitigation="25"/>
+                <countermeasure ref="AZ-N02" mitigation="25"/>
+                <countermeasure ref="AZ-N09" mitigation="25"/>
+                <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="cea69cc8-f974-4239-aa9a-22e739f60d57" diagramComponentId="90f2903c-942f-4556-905a-391a328a2373" ref="fc0d51fe-a373-4d18-a293-8a2b873e9ef9" name="Secure Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.754">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.203">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.755">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.755">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.757">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.384">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.385">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.385">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.044">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:33.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7a416f1a-0eb6-42a0-88f4-a920d277b4c6" diagramComponentId="776387b8-7184-414e-8183-3d6d6bc19ff0" ref="ec1fcae8-4837-4946-a97e-8986b55870b2" name="HEC" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-azure-web-apps">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-16" name="Configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are typically introduced during the
+                        configuration of the software.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-UNSECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials used to access the resources are not securely stored and can be accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when there is a bad usage of the root
+                            account.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging into the console without using Multi-factor Authentication (MFA) and without being detected. The connection without MFA must be audited and monitored, the correct security group must be informed and the connection must be validated.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Alerts&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that there is any rule to notify when someone tries to login into the
+                            console without MFA.&lt;/li&gt;
+                            &lt;li&gt;Check if these rules are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZ-W04" name="Misconfigured Authentication Method for Administrator Accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator accounts is not configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-IDENTITY-03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Key security settings such as resetting the password and other password controls are not
+                        configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Password reset&amp;quot; &amp;gt; &amp;quot;Authentication Method&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the security confirmation measures and the security criteria are well
+                            filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-EXPIRATION-DATE" name="Misconfigured password expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password expiration is not configured and users are not obliged to change their passwords.
+                        Not change frequently the passwords gives facilities to attackers to obtain them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            More information: Doc MS Azure
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.710">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To
+                        avoid this, access to the network must be as restricted as possible, so that only the necessary
+                        ports are open and the minimum inbound traffic is accepted.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources have got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0&amp;nbsp;is blocked.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="AZ-A09" name="Apply RBAC with pre-defined policies added into groups or roles" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &amp;nbsp;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        All the users in an IAM group inherit the permissions assigned to the group. That way, you can
+                        make changes for everyone in a group in just one place. As people move around in your company,
+                        you can simply change what IAM group their IAM user belongs to. This method is known as Role
+                        Based Access Control (RBAC).&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Remove a user from a group:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click on the user name. All the groups the user belongs are there.&lt;/li&gt;
+                        &lt;li&gt;Choose the group and &amp;quot;Remove&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a group and add user:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;New Group&amp;quot; and fill the information.&lt;/li&gt;
+                        &lt;li&gt;Search and add the user.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WEBAPPS1" name="Configure App Service settings for each app" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are some options that must be configured properly to secure Azure PostgreSQL databases.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Checklist:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure App Service Authentication is set on Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service&lt;/li&gt;&lt;li&gt;Ensure web app is using the latest version of TLS encryption&lt;/li&gt;&lt;li&gt;Ensure the web app has 'Client Certificates (Incoming client certificates)&lt;/li&gt;&lt;li&gt;Ensure that Register with Azure Active Directory is enabled on App Service&lt;/li&gt;&lt;li&gt;Ensure that 'PHP version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Python version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'Java version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure that 'HTTP Version' is the latest, if used to run the web app&lt;/li&gt;&lt;li&gt;Ensure FTP deployments are disabled&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Azure Console&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to Azure Portal using https://portal.azure.com&lt;/li&gt;&lt;li&gt;Go to App Services&lt;/li&gt;&lt;li&gt;Click on each App&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Authentication / Authorization&lt;ol&gt;&lt;li&gt;Set App Service Authentication to On&lt;/li&gt;&lt;li&gt;Choose other parameters as per your requirement and Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on SSL settings&lt;ol&gt;&lt;li&gt;Set HTTPS Only to On under Protocol Settings section&lt;/li&gt;&lt;li&gt;Set Minimum TLS Version to 1.2 under Protocol Settings section&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Configuration&lt;ol&gt;&lt;li&gt;Set the option Client certificate mode located under Incoming client certificates is set to Require&lt;/li&gt;&lt;li&gt;Set PHP version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Set HTTP version to 2.0 under General settings&lt;/li&gt;&lt;li&gt;Under Platform Settings, FTP state should be Disabled or FTPS Only&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Identity&lt;ol&gt;&lt;li&gt;Set Status to On&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Under Setting section, Click on Application settings&lt;ol&gt;&lt;li&gt;Set Python version to latest version available under General settings&lt;/li&gt;&lt;li&gt;Under General settings, Set Java version to latest version available&lt;/li&gt;&lt;li&gt;Set Java minor version to latest version available&lt;/li&gt;&lt;li&gt;Set Java web container to the latest version of web container available&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Alternatively, some of these can be done with Azure CLI.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Using Azure Command Line Interface&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To set App Service Authentication for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp auth update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --enabled true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTPS-only traffic value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set httpsOnly=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set TLS Version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --min-tls-version 1.2&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Incoming client certificates value for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp update --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --set clientCertEnabled=true&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set Register with Azure Active Directory feature for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp identity assign --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep php&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest PHP version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --php-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep python&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Python version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --python-version &amp;lt;VERSION&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To see the list of supported runtimes:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp list-runtimes | grep java&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set latest Java version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --java-version '1.8' --java-container 'Tomcat' --java-container-version '&amp;lt;VERSION&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;To set HTTP 2.0 version for an existing app, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;az webapp config set --resource-group &amp;lt;RESOURCE_GROUP_NAME&amp;gt; --name &amp;lt;APP_NAME&amp;gt; --http20-enabled true&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.1" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.10" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.10" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.2" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.2" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.4" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.5" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.5" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.6" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.6" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.7" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.7" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.8" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.8" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="9.9" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="9.9" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DP-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="GS-6" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="IM-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="NS-1" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PA-5" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PV-3" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="PV-7" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Follow the paths detailed in the description and ensure that the values are the ones indicated.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A12" name="Configure password expiration" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Configure the password expiration to force after a determinate time, the password code shall be
+                        changed for the users.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Configure password management to match security criteria. This value is configurable
+                        using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows
+                        PowerShell. With the following command as the example:&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;This command updates the tenant so that all users passwords expire after 60
+                        days. The users receive notification 14 days prior to that expiry.
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        More information:&amp;nbsp;
+                        &lt;a
+                        href="https://docs.microsoft.com/en-us/powershell/module/msonline/set-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                        MS Azure&lt;/a&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Password policies and restrictions in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Check that the password expiration has got the correct values. Therefore, we can obtain the
+                            values using the Get-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for
+                            Windows PowerShell. With the following command:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            PS C:\&amp;gt; Get-MsolPasswordPolicy -DomainName contoso.com
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;More information:
+                            &lt;a
+                            href="https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolpasswordpolicy?view=azureadps-1.0"&gt;Doc
+                            MS Azure&lt;/a&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.477">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A11" name="Configure roles for the Cloud Service" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Define and create the roles for the Azure Cloud Service. For each role, define the permissions and also configure how that role runs. When you launch an Azure instance, you shall specify a role for the instance as a launch parameter. Applications that run on the Cloud instance use the role's credentials when they access Azure resources. This role's permissions determine what the application is allowed to do.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Configure an Azure cloud service from Solution Explorer in Visual Studio.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the roles for the Cloud Service are well assigned.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.477">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A03" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create an individual account for the administrator users and with this new accounts By creating individual Azure users for people accessing your account, you can give each Azure user a unique set of security credentials.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for the administrative actions and for giving or revoke credentials to the user's account. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Add New User&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Fill the required information and click &amp;quot;Create&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Add new users to Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/add-users-azure-active-directory"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got a user account assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A10" name="Create mechanisms to ensure the principle of least privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create the mechanisms to review periodically the group and user permissions to ensure the least privilege for the user accounts. Granting least privilege ensures that users only have the permissions required to complete their jobs rather than additional privileges that are not required. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Following this model ensures that, should an account be compromised, the blast radius of damage is limited&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Allocate privileges via groups or roles via the recommendation in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a group and add members in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-create-azure-portal"/>
+            <reference name="MS Azure - Use Role-Based Access Control to manage access to your Azure subscription resources" url="https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the principle of least privilege is achieved in the assignation of roles and
+                            groups to the users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-WAF-GW" name="Deploy a WAF with Azure Application Gateway" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Deploy a Web Application Firewall (WAF) with Azure Application Gateway in front of an Internet facing app 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable a Web Application Firewall on Application Gateway, you must create a WAF policy. This policy is where all of the managed rules, custom rules, exclusions, and other customizations such as file upload limit exist. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure a WAF policy and associate that policy to one or more application gateways for protection. A WAF policy consists of two types of security rules: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Custom rules that you create 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Managed rule sets that are a collection of Azure-managed pre-configured set of rules 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, and LOG. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A web application delivered by Application Gateway can have a WAF policy associated to it at the global level, at a per-site level, or at a per-URI level. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a policy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. On Create a WAF policy page, Basics tab, enter or select the following information, accept the defaults for the remaining settings, and then select Review + create: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy for&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Regional WAF (Application Gateway) 
+&lt;/div&gt; 
+&lt;div&gt;
+  Subscription&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your subscription name 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resource group&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your resource group 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policy name&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Type a unique name for your WAF policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. On the Association tab, enter one of the following settings, then select Add: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Setting&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Value 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Application Gateway&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Select your Application Gateway profile name. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Associate Listeners&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Select the name of your Application Gateway Listener, then select Add. 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you assign a policy to your Application Gateway (or listener) that already has a policy in place, the original policy is overwritten and replaced by the new policy. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select Review + create, then select Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tutorial: Create an application gateway with a Web Application Firewall using the Azure portal" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal"/>
+            <reference name="What is Azure Web Application Firewall on Azure Application Gateway?" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test the application gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Although IIS isn't required to create the application gateway, you installed it to verify whether Azure successfully created the application gateway. Use IIS to test the application gateway: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Find the public IP address for the application gateway on its Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Or, you can select All resources, enter myAGPublicIPAddress in the search box, and then select it in the search results. Azure displays the public IP address on the Overview page. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Copy the public IP address, and then paste it into the address bar of your browser. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Check the response. A valid response verifies that the application gateway was successfully created and it can successfully connect with the backend. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SERVICE1" name="Disable anonymous access" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Disable anonymous access 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Unless you need to support anonymous requests, disable anonymous access. Whenever possible, use the App Service authentication module instead of writing code to handle authentication and authorization 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Azure portal, you can configure App Service authorization with a number of behaviors when incoming request is not authenticated. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Allow only authenticated requests 
+&lt;/div&gt; 
+&lt;div&gt;
+  The option is Log in with &amp;lt;provider&amp;gt;. App Service redirects all anonymous requests to /.auth/login/&amp;lt;provider&amp;gt; for the provider you choose. If the anonymous request comes from a native mobile app, the returned response is an HTTP 401 Unauthorized. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With this option, you don't need to write any authentication code in your app. Finer authorization, such as role-specific authorization, can be handled by inspecting the user's claims. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Restricting access in this way applies to all calls to your app, which may not be desirable for apps wanting a publicly available home page, as in many single-page applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Authentication and authorization in Azure App Service and Azure Functions" url="https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>In the Azure portal, ensure that anonymous access is disabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-ALERTS" name="Enable alerts for anomalous activities" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable alerts for anomalous activities 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Security Center generates detailed security alerts and recommendations. You can view them in the portal or through programmatic tools. You may also need to export some or all of this information for tracking with other monitoring tools in your environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All high severity alerts are sent to an Azure Event Hub 
+&lt;/div&gt; 
+&lt;div&gt;
+  All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace 
+&lt;/div&gt; 
+&lt;div&gt;
+  Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Set up a continuous export 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure continuous export from the Security Center pages in Azure portal, via the Security Center REST API, or at scale using the supplied Azure Policy templates. Select the appropriate tab below for details of each. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure continuous export from the Security Center pages in Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The steps below are necessary whether you're setting up a continuous export to Log Analytics workspace or Azure Event Hubs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Security Center's sidebar, select Pricing &amp;amp; settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select the specific subscription for which you want to configure the data export. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. From the sidebar of the settings page for that subscription, select Continuous Export. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Here you see the export options. There's a tab for each available export target. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select the data type you'd like to export and choose from the filters on each type (for example, export only high severity alerts). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Optionally, if your selection includes one of these four recommendations, you can include the vulnerability assessment findings together with them: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL databases should be remediated 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerability Assessment findings on your SQL servers on machines should be remediated (Preview) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys) 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Vulnerabilities in your virtual machines should be remediated 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To include the findings with these recommendations, enable the include security findings option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  7. Select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Continuously export Security Center data" url="https://docs.microsoft.com/en-us/azure/security-center/continuous-export?tabs=azure-portal"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  View exported alerts and recommendations in Azure Monitor 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In some cases, you may choose to view the exported Security Alerts and/or recommendations in Azure Monitor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Azure Monitor provides a unified alerting experience for a variety of Azure alerts including Diagnostic Log, Metric alerts, and custom alerts based on Log Analytics workspace queries. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To view alerts and recommendations from Security Center in Azure Monitor, configure an Alert rule based on Log Analytics queries (Log Alert): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. From Azure Monitor's Alerts page, select New alert rule. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the create rule page, configure your new rule (in the same way you'd configure a log alert rule in Azure Monitor): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Resource, select the Log Analytics workspace to which you exported security alerts and recommendations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - For Condition, select Custom log search. In the page that appears, configure the query, look-back period, and frequency period. In the search query, you can type SecurityAlert or SecurityRecommendation to query the data types that Security Center continuously exports to as you enable the Continuous export to Log Analytics feature. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Optionally, configure the Action Group that you'd like to trigger. Action groups can trigger email sending, ITSM tickets, WebHooks, and more. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You'll now see new Azure Security Center alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L01" name="Enable diagnostic logs auditing for Microsoft Azure" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.&lt;/p&gt;&lt;p&gt;A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard"/>
+            <standard ref="5.3" supportedStandardRef="cis-azure-standard-level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="LT-4" supportedStandardRef="azure-security-benchmark"/>
+            <standard ref="LT-5" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Go to the resource&lt;/li&gt;&lt;li&gt;Click on Diagnostic settings&lt;/li&gt;&lt;li&gt;In the blade that appears, click "Add diagnostic setting"&lt;/li&gt;&lt;li&gt;Configure the diagnostic settings&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L04" name="Enable Failed Request Tracing" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable to obtain the detailed information on failed requests, including a trace of the IIS components used to process the request and the time taken in each component. This can be useful if you are attempting to increase site performance or isolate what is causing a specific HTTP error to be returned. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the "Failed request tracing".&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the &amp;quot;Failed request tracing&amp;quot; is enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A04" name="Enable MFA for Administrator &amp; Co Administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable multi-factor authentication (MFA) device enhances the security of the login process for the Administrator accounts. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the Service Administrator &amp;amp; Co Administrator accounts is to use MFA to increase the level of security of the login process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Azure Active Directory.&lt;/li&gt; 
+  &lt;li&gt;Go into "Users and groups" &amp;gt; "All users".&lt;/li&gt; 
+  &lt;li&gt;Select "Multi-Factor Authentication".&lt;/li&gt; 
+  &lt;li&gt;Choose all the Service Administrator &amp;amp; Co Administrator accounts and enable MFA.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to require two-step verification for a user or group" url="https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Multi-Factor Authentication&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check all Administrator accounts have got the MFA flag enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-USER-MFA" name="Enable per-user MFA" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable per-user MFA 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Multi-factor authentication (MFA) is a process where a user is prompted during a sign-in event for additional forms of identification. This prompt could be to enter a code on their cellphone or to provide a fingerprint scan. When you require a second form of authentication, security is increased as this additional factor isn't something that's easy for an attacker to obtain or duplicate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA). Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Features and licenses for Azure AD Multi-Factor Authentication" url="https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  1. Log into the Azure portal as an owner. 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Select Azure Active Directory. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. Go into "Users and groups" &amp;gt; "All users". 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Select "Multi-Factor Authentication". 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Ensure your users have the MFA flag enabled. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-ENABLE-WAF-LOGS" name="Enable WAF logs" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable WAF logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor Web Application Firewall resources using logs. You can save performance, access, and other data or consume it from a resource for monitoring purposes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable logging through the Azure portal 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. In the Azure portal, find your resource and select Diagnostic settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For Application Gateway, three logs are available: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Access log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Performance log 
+&lt;/div&gt; 
+&lt;div&gt;
+  - Firewall log 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. To start collecting data, select Turn on diagnostics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. The Diagnostics settings page provides the settings for the resource logs. In this example, Log Analytics stores the logs. You can also use event hubs and a storage account to save the resource logs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Type a name for the settings, confirm the settings, and select Save. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Resource logs for Azure Web Application Firewall" url="https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that all WAF logs are enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L02" name="Enable Web Server Logging" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable the Web Server logging to receive information about HTTP transactions using the W3C extended log file format. This is useful when determining overall site metrics such as the number of requests handled or how many requests are from a specific IP address. There are two ways to save the data: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;b&gt;File system: &lt;/b&gt;stores the application diagnostics information to the web app file system. These files can be accessed by FTP, or downloaded as a Zip archive by using the Azure PowerShell or Azure Command-Line Interface (Azure CLI).&lt;/li&gt; 
+  &lt;li&gt;&lt;b&gt;Storage:&lt;/b&gt; stores the application diagnostics information in the specified Azure Storage Account and the logs are only accessible with a client account.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the Azure portal.&lt;/li&gt; 
+  &lt;li&gt;Go to the blade for your web app and in "Monitoring" &amp;gt;&amp;gt; "Diagnostics logs".&lt;/li&gt; 
+  &lt;li&gt;Enable the type "Storage" or "File System" to activate this function.&lt;/li&gt; 
+  &lt;li&gt;Push "Save" to save the changes.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to the Azure portal.&lt;/li&gt;
+                            &lt;li&gt;Go to the blade for your web app and in &amp;quot;Monitoring&amp;quot; &amp;gt;&amp;gt;
+                            &amp;quot;Diagnostics logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that the type &amp;quot;Storage&amp;quot; or &amp;quot;File System&amp;quot;
+                            are enabled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" name="Encrypt Sensitive data in transit" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt;
+   Use encryption to protect traffic on external and public networks as it is critical for data protection 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Rationale: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Protect data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Remediation: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Use a valid TLS/SSL certificate for custom domains. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Ensure that any clients connecting to your Azure resources for HTTP traffic can negotiate TLS v1.2 or greater. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Use SSH (for Linux) or RDP/TLS (for Windows) for remote management, instead of unencrypted protocols 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. Disable obsoleted SSL/TLS/SSH versions, protocols, and weak ciphers 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Redirect HTTP to HTTPs 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   By default, clients can connect to web apps by using both HTTP or HTTPS. Microsoft Azure recommends redirecting HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enforce FTPS 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   In your app's resource page in Azure portal, select Configuration &amp;gt; General settings from the left navigation. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Enable client certificates 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   To set up your app to require client certificates, you can switch On the Require incoming certificate by selecting Configuration &amp;gt; General Settings from the Azure Portal or you need to set the clientCertEnabled setting for your app to true. To set the setting, run the following command in the Cloud Shell. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   az webapp update --set clientCertEnabled=true --name &amp;lt;app_name&amp;gt; --resource-group &amp;lt;group_name&amp;gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Impact: 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Add a TLS/SSL certificate in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate"/>
+            <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            <reference name="Configure TLS mutual authentication for Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth"/>
+            <reference name="Deploy your app to Azure App Service using FTP/S" url="https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp"/>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test HTTPS 
+&lt;/div&gt; 
+&lt;div&gt;
+  In various browsers, browse to https://&amp;lt;your.custom.domain&amp;gt; to verify that it serves up your app. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Your application code can inspect the protocol via the "x-appservice-proto" header. The header will have a value of http or https. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your app gives you certificate validation errors, you're probably using a self-signed certificate. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If that's not the case, you may have left out intermediate certificates when you export your certificate to the PFX file. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.479">
+              <output/>
+            </source>
+            <references>
+              <reference name="Azure App ServiceSecurity" url="https://docs.microsoft.com/en-us/azure/app-service/overview-security"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-L05" name="Export the Audit Logs to a storage account" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Export the information of Audit Logs to a storage account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to "Monitor" and then to "Activity Logs".&lt;/li&gt; 
+  &lt;li&gt;Push the button "Export".&lt;/li&gt; 
+  &lt;li&gt;Select "All Regions".&lt;/li&gt; 
+  &lt;li&gt;Select "Export to a storage account" and select your account.&lt;/li&gt; 
+  &lt;li&gt;Select the "Retention (days)" as minimum 90 days.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Enable diagnostics logging for web apps in Azure App Service" url="https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-enable-diagnostic-log"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Go to &amp;quot;Monitor&amp;quot; and then to &amp;quot;Activity Logs&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Push the button &amp;quot;Export&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;All Regions&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Export to a storage account&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are correctly filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N09" name="Isolate Azure instances into different VNets" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Specify a VNet for the Azure instance as a launch parameter. Applications that run on the Cloud instance can use the VNet security configuration when they access Azure resources.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure an Azure cloud service from Solution Explorer in Visual Studio. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Create a virtual network with multiple subnets" url="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-vnet-arm-pportal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Azure instances are into different VNets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-A07" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Do regular reviews of accounts on the system and verify that it doesn't exist stoled or fake
+                        accounts. With this process is ensured that there are not compromised accounts by former
+                        employees or by attackers.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                        &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                        &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist:&lt;/li&gt;
+                        &lt;li&gt;Select the user.&lt;/li&gt;
+                        &lt;li&gt;Click &amp;quot;Delete&amp;quot;.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - Assign a user or group to an enterprise app in Azure Active Directory" url="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-coreapps-assign-user-azure-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log in to the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got an assigned account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-APP-SECRETS" name="Secure application secrets" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Secure application secrets 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't store application secrets, such as database credentials, API tokens, or private keys in your code or configuration files. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The commonly accepted approach is to access application secrets as environment variables using the standard pattern in your language of choice. In Azure App Service, you can define environment variables through app settings and connection strings. App settings and connection strings are stored encrypted in Azure. The app settings are decrypted only before being injected into your app's process memory when the app starts. The encryption keys are rotated regularly. Alternatively, you can integrate your Azure App Service app with Azure Key Vault for advanced secrets management. By accessing the Key Vault with a managed identity, your App Service app can securely access the secrets you need. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security recommendations for App Service" url="https://docs.microsoft.com/en-us/azure/app-service/security-recommendations"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that application secrets, such as database credentials, API tokens, or private keys are not stored in your code or configuration files.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N01" name="Set Network Security Groups to be as restrictive as possible" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit all the traffic (ingress/egress) on the NSG in order to force the use of least privilege into the NSG.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Identify Azure resources for each NSG.&lt;/li&gt; 
+  &lt;li&gt;Create a set of least privilege NSG for those resources.&lt;/li&gt; 
+  &lt;li&gt;Place the resources in those security groups.&lt;/li&gt; 
+  &lt;li&gt;Change the inbound/outbound security rules to fulfill the least privilege.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check that each Azure resources has got their Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Check that a set of these groups achieve with the principle of the least
+                            privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the inbound/outbound security rules are enabled and correctly
+                            configured.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZ-N02" name="Use Network Security Groups to block inbound port traffic from 0.0.0.0/0" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use Network Security Groups (NSG) to filter the ingress/egress network traffic to Azure resources. Set the limit inbound access to all TCP or all ports to avoid undue exposure to risk.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt; 
+  &lt;li&gt;Select Network Security Groups.&lt;/li&gt; 
+  &lt;li&gt;Choose the NSG to edit (or create a new one).&lt;/li&gt; 
+  &lt;li&gt;In "Inbound security rules":&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Remove all rules that allow port traffic.&lt;/li&gt; 
+   &lt;li&gt;Add a rule to deny port traffic&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="MS Azure - How to open ports to a virtual machine with the Azure portal" url="https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Network Security Groups.&lt;/li&gt;
+                            &lt;li&gt;Choose the NSG to view one of them.&lt;/li&gt;
+                            &lt;li&gt;In &amp;quot;Inbound security rules&amp;quot;, check that all the traffic from
+                            0.0.0.0/0 is are blocked.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:47.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;div&gt;Attackers could gain unauthorized access to the administrator account due to a lack of configuration of the account and its security mechanisms, making it possible to modify credentials and add/remove user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZ-W04">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A04" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A03" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A03" mitigation="50"/>
+                <countermeasure ref="AZ-A04" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AZURE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to the lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-IDENTITY-03">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A07" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A07" mitigation="50"/>
+                <countermeasure ref="AZURE-USER-MFA" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A09" mitigation="20"/>
+                    <countermeasure ref="AZ-A10" mitigation="20"/>
+                    <countermeasure ref="AZ-A11" mitigation="20"/>
+                    <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="AZ-A12" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-A09" mitigation="20"/>
+                <countermeasure ref="AZ-A10" mitigation="20"/>
+                <countermeasure ref="AZ-A11" mitigation="20"/>
+                <countermeasure ref="AZ-A12" mitigation="20"/>
+                <countermeasure ref="AZURE-APP-SERVICE1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY" name="Attackers gain access to the system by exploiting weak security configurations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>Weak security configurations like using sharing passwords in plain text, using weak passwords, using obsolete encryption algorithms, etc. can lead attackers to gain access to the system.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-16">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-WEBAPPS1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-UNSECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-APP-SECRETS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
+                    <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
+                    <countermeasure ref="AZ-L01" mitigation="16"/>
+                    <countermeasure ref="AZ-L02" mitigation="16"/>
+                    <countermeasure ref="AZ-L04" mitigation="16"/>
+                    <countermeasure ref="AZ-L05" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-ENABLE-ALERTS" mitigation="20"/>
+                <countermeasure ref="AZ-ENABLE-WAF-LOGS" mitigation="16"/>
+                <countermeasure ref="AZ-L01" mitigation="16"/>
+                <countermeasure ref="AZ-L02" mitigation="16"/>
+                <countermeasure ref="AZ-L04" mitigation="16"/>
+                <countermeasure ref="AZ-L05" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N01" mitigation="25"/>
+                    <countermeasure ref="AZ-N02" mitigation="25"/>
+                    <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="AZ-N09" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZ-N01" mitigation="25"/>
+                <countermeasure ref="AZ-N02" mitigation="25"/>
+                <countermeasure ref="AZ-N09" mitigation="25"/>
+                <countermeasure ref="AZURE-WAF-GW" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-ENCRYPTION-TRANSIT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="45fff781-2c55-4178-bfba-7661def4ba12" diagramComponentId="88872cd8-81f0-4518-bb59-e3ed78c56f03" ref="40a5314d-c9ec-4089-ae5b-6fa194301861" name="Web Service" desc="" library="" parentComponentRef="" componentDefinitionRef="web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_SEGM"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.118">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.782">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.232">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.120">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.236">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.236">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.120">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.119">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.666">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.119">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.510">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.910">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.781">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.912">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.911">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.911">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.235">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.234">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.834">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.082">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.430">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.671">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.835">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.835">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.672">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.253">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.436">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.781">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.432">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.431">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.619">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.083">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="22" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:37.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="54" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:35.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:38.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.255">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.836">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:36.256">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1f68f86b-86fa-4791-a14d-bf2ba8a27f90" diagramComponentId="70fbb43c-8538-4d2c-9dac-17e1a173d882" ref="90fdbf5a-9d44-4b11-b469-a7a60f3928ee" name="Internal Server" desc="" library="" parentComponentRef="" componentDefinitionRef="internal-server">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_SEGM"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="20"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="UNPATCHED-SERVER" name="Recommended security patches are not applied" state="0" impact="100" issueId="" issueLink="">
+          <desc>When patches are not applied in a timely manner then the server or system could be vulnerable
+                        to known security issues. These issues could be used by an attacker to gain access to the
+                        system.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNNECESSARY-SERVICES" name="Unnecessary services are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application exposes unnecessary services which increase the attack surface.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PATCH-SERVER" name="Apply required security patches" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Vendors and other maintainers of software release patches in response to security flaws and
+                        other bugs in their products.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected
+                        failures or exploitation.&lt;/li&gt;
+                        &lt;li&gt;Clearly define an approach for testing and applying patches, in particular security
+                        patches, with expected timescales. &amp;nbsp;There is often a small window between release of a
+                        patch, and potentially malicious actors reverse-engineering the patch to identify and exploit
+                        the flaw.&lt;/li&gt;
+                        &lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting service to ensure
+                        the project team is aware of issues within the project or its components promptly.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Verify there is a processes for identifying, categorizing, and prioritizing
+                            security and other patches.&lt;/li&gt;
+                            &lt;li&gt;Review the testing and release process.&lt;/li&gt;
+                            &lt;li&gt;Verify patches are applied in a timely manner, in line with the policies and
+                            taking into account the associated risk.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.746">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INF-UNNECESSARY-SERVICES" name="Restrict access to required services only" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="kieran@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The attack surface, and therefore susceptibility to attack, should be minimized. In particular, services that are not explicitly required for the proper operation of the server or service should be disable, or access to them be restricted.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Any service, feature, or functionality that is not required should be disabled or removed. This applies equally to the operating system, middleware, web-server, or other software in use.&lt;/li&gt; 
+ &lt;li&gt;Access to the server and remaining services (in particular those that cannot be disabled or removed) should be controlled use host-based and/or network security controls; for example host firewalls, network firewalls, routers, or switches.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Conduct a host review to confirm the software and services running and exposed on the system. - Support the host review with network based scans across at least all &lt;span class="caps"&gt;TCP&lt;/span&gt; and &lt;span class="caps"&gt;UDP&lt;/span&gt; ports (0-65535), together with &lt;span class="caps"&gt;RPC&lt;/span&gt; and other remote call services.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify the running and accessible services against expected configuration for the system, and against the security principal of 'least privilege'.&lt;/li&gt; 
+ &lt;li&gt;Where a network or host based firewall is in use, it should be configured to drop connections rather than reject them. i.e. port-scans should identify only 'open' or 'filtered' services; no service should be identifiably 'closed'.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Note however that different network based security solutions exhibit different behavior in this regard.&lt;/li&gt; 
+&lt;/ul&gt; </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-09T10:29:45.747">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICES" name="Access services" desc="" library="CS-Default">
+          <threats>
+            <threat ref="SERVER-ATTACK" name="Data is compromised if the server itself is compromised" state="Expose" source="RULES" edited="false" owner="kieran@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If attackers compromise the server that hosts the service or data, then the data and
+                                the service itself could be at risk of compromise. The server could be compromised
+                                through any of the services that it exposes.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="UNNECESSARY-SERVICES">
+                  <countermeasures>
+                    <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNPATCHED-SERVER">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INF-UNNECESSARY-SERVICES" mitigation="20"/>
+                <countermeasure ref="PATCH-SERVER" mitigation="80"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/gcp-cloud-architecture.xml b/Templates/Submitted_Templates/gcp-cloud-architecture.xml
new file mode 100644
index 0000000..9b5faf2
--- /dev/null
+++ b/Templates/Submitted_Templates/gcp-cloud-architecture.xml
@@ -0,0 +1,2288 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="gcp-cloud-architecture" name="GCP - Cloud Architecture" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTYwOCIgZHk9IjEwODIiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC41LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHVibGljIiBzdHlsZT0iaXIucmVmPTYzNzZkNTNlLTY0NjEtNDEyYi04ZTA0LTdiM2ZlMmIzOTdkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMzcyIiB5PSItNDEiIHdpZHRoPSIxMTEyIiBoZWlnaHQ9IjY1MSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iR0NQIFBsYXRmb3JtIEVudmlyb25tZW50IiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z29vZ2xlLWNsb3VkLXBsYXRmb3JtLWVudmlyb25tZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk1qTTVNVE1nTUM0ek5UYzRPVFZNTUM0Mk5UQTFOelFnTUM0ek5UZ3pOVEpNTUM0M01qTXdNVFlnTUM0eU9EVTVNRGxNTUM0M01qWTFNamNnTUM0eU5UVXlNVGRETUM0Mk5qY3dNelVnTUM0eU1ESXhNRE1nTUM0MU9UQXdOVGNnTUM0eE56STNPRElnTUM0MU1UQXpNRFlnTUM0eE56STROVEpETUM0ek5qQXlNVGdnTUM0eE56STROVElnTUM0eU16TTFORElnTUM0eU56UTVOelFnTUM0eE9UWXdORFVnTUM0ME1UTXpNRFJETUM0eU1ETTVOVE1nTUM0ME1EYzNPRGdnTUM0eU1qQTROVGtnTUM0ME1URTVNallnTUM0eU1qQTROVGtnTUM0ME1URTVNalpNTUM0ek5qVTJNVFVnTUM0ek9EZ3hNalpETUM0ek5qVTJNVFVnTUM0ek9EZ3hNallnTUM0ek56TXdOVFFnTUM0ek56VTRNU0F3TGpNM05qZ3lOQ0F3TGpNM05qUXlNa013TGpReE1UQTFJREF1TXpNNE9ERTNJREF1TkRVNU5UUTVJREF1TXpFM016azFJREF1TlRFd016a3pJREF1TXpFM05ERTFRekF1TlRVek16RTBJREF1TXpFM05UQTFJREF1TlRreU9EVXhJREF1TXpNeU5qY2dNQzQyTWpNNU1TQXdMak0xTnpjMU9GWXdMak0xTnpnNU9FZ3dMall5TXpreE0xWXdMak0xTnpnNU5Wb2lJR1pwYkd3OUlpTkZRVFF6TXpVaUx6NG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TWpRMk55QXdMalF4TXpRNU9FTXdMamd3TnpnMU1pQXdMak0xTVRRMklEQXVOemN6TVRreUlEQXVNamsyTmpneElEQXVOekkyTkRFeUlEQXVNalUxTVRJM1REQXVOakl6T0RNMklEQXVNelUzTnpBelF6QXVOalkwT1RNMklEQXVNemt3T0RZM0lEQXVOamt4TWprNElEQXVORFF4TmpFMUlEQXVOamt4TWprNElEQXVORGs0TkRJMFZqQXVOVEUyTlRJNFF6QXVOelF4TWlBd0xqVXhOalV5T0NBd0xqYzRNVGMwSURBdU5UVTNNVFU0SURBdU56Z3hOelFnTUM0Mk1EWTVOME13TGpjNE1UYzBJREF1TmpVMk9EY3lJREF1TnpReE1URWdNQzQyT1RjME1UTWdNQzQyT1RFeU9UZ2dNQzQyT1RjME1UTklNQzQxTVRBME1UTk1NQzQwT1RJek1TQXdMamN4TlRZeU1WWXdMamd5TkRFMk9Fd3dMalV4TURReE15QXdMamcwTWpFM09VZ3dMalk1TVRJNU9FTXdMamd5TVRFeE9TQXdMamcwTVRrNU55QXdMamt5TmpNeE1pQXdMamN6Tmpnd055QXdMamt5TmpVd05pQXdMall3TmprNE5VTXdMamt5TmpReE5DQXdMalV5Tmprek5pQXdMamc0TmpFNE9DQXdMalExTmpFeE9DQXdMamd5TkRZM01pQXdMalF4TXpVeE0xWXdMalF4TXpWTU1DNDRNalEyTnlBd0xqUXhNelE1T0ZvaUlHWnBiR3c5SWlNME1qZzFSalFpTHo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpNamt6TmpjZ01DNDROREkwTWpKSU1DNDFNVEF4TkRsV01DNDJPVGMxTkRSSU1DNHpNamt6TmpkRE1DNHpNVFkxTWpJZ01DNDJPVGMxTkRZZ01DNHpNRE00TWprZ01DNDJPVFEzT0RjZ01DNHlPVEl4TkRVZ01DNDJPRGswTlROTU1DNHlOall3TkRNZ01DNDJPVGMwTlRGTU1DNHhPVE0yTURFZ01DNDNOams0T1V3d0xqRTROekkxTmlBd0xqYzVORE0wTVVNd0xqSXlPREEzT1NBd0xqZ3lOVFE0TkNBd0xqSTNPREF3T1NBd0xqZzBNak0wTkNBd0xqTXlPVE0xTnlBd0xqZzBNak14T1V3d0xqTXlPVE0zSURBdU9EUXlOREl5U0RBdU16STVNelkzV2lJZ1ptbHNiRDBpSXpNMFFUZzFNeUl2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTXlPVE15T0NBd0xqTTNNVGd5TmtNd0xqRTVPVFV3TlNBd0xqTTNNakV6T0NBd0xqQTVOREk1T0RVZ01DNDBOemN6TWprZ01DNHdPVFF4TVRZeUlEQXVOakEzTVRVMVF6QXVNRGswTVRFMk1pQXdMalk0TXpVek9TQXdMakV6TURjd05DQXdMamMxTVRRMU5pQXdMakU0TnpNeE5pQXdMamM1TkRRM09Fd3dMakk1TWpFNU15QXdMalk0T1RVNU9VTXdMakkxT1RjM0lEQXVOamMwT1RjMklEQXVNak00T1RFeUlEQXVOalF5TnpJMElEQXVNak00T0RneUlEQXVOakEzTVRVMVF6QXVNak00T0RneUlEQXVOVFUzTWpVeUlEQXVNamM1TlRFeklEQXVOVEUyTnpFeElEQXVNekk1TXpJMUlEQXVOVEUyTnpFeFF6QXVNelkySURBdU5URTJOekV4SURBdU16azNOVEk1SURBdU5UTTRPREl4SURBdU5ERXhOemd6SURBdU5UY3dNRE0zVERBdU5URTJOall5SURBdU5EWTFNVFU0UXpBdU5EY3pOalV4SURBdU5EQTROVFEwSURBdU5EQTFOekl5SURBdU16Y3hPVFU1SURBdU16STVNelFnTUM0ek56RTVOVGxNTUM0ek1qa3pNamdnTUM0ek56RTRNalphSWlCbWFXeHNQU0lqUmtKQ1F6QTFJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakEySWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01UVXpPREE1SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqZ3pNak0zTkNJZ2FHVnBaMmgwUFNJd0xqWTJPVFV6TmlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EazBNVEUyTWlBd0xqRTNNamcxTWlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWFjN2U0Mzg3LWYzN2EtNDFmYi1hMjFhLWI2MmEyZmQ4Y2NlNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nb29nbGUtY2xvdWQtcGxhdGZvcm0tZW52aXJvbm1lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMSIgeT0iNDgiIHdpZHRoPSIxMDE4IiBoZWlnaHQ9IjU1NSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iUmVnaW9uIDEiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9Mzg0MmExZGQtN2EyZC00YTVlLWFmNmYtMDQyMmQ2ZmQyNDY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQwIiB5PSI0MSIgd2lkdGg9IjY5OSIgaGVpZ2h0PSI0MjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjYiIHZhbHVlPSJab25lIDEgLSBhIiBzdHlsZT0iaXIucmVmPTgxMzQ1YTljLWNjZGItNDFkYS05OWU0LTM1NDJkMTQwOGUxYjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzOSIgeT0iNTMiIHdpZHRoPSIzMDkiIGhlaWdodD0iMzQ0IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3IiB2YWx1ZT0iWm9uZSAxIC0gYiIgc3R5bGU9ImlyLnJlZj1jMmY1ZDAwZi0zN2JiLTRkZGEtODA5Ni1mYjg1NzEyM2YwOGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzY2IiB5PSI1MCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSIzNDciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlJlZ2lvbiAyIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTlhNmU0YWFiLTUyMmMtNDlhMi05OWE4LWEwNDU0MWZiN2E4Yjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3NjkiIHk9IjM4IiB3aWR0aD0iMTk4IiBoZWlnaHQ9IjQyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iOCIgdmFsdWU9IlpvbmUgMiAtIGEiIHN0eWxlPSJpci5yZWY9ZDU2ZGJhM2UtM2U2Yy00OWM2LWFlNWMtOTI3NmE5NjMwYTg4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE4IiB5PSI2NiIgd2lkdGg9IjE2NyIgaGVpZ2h0PSIzMzUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="10"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows/>
+  <customFields/>
+  <components>
+    <component uuid="c694f9b6-9b15-428a-a490-00e0b66b75df" diagramComponentId="ac7e4387-f37a-41fb-a21a-b62a2fd8cce7" ref="225ed77d-0324-4a33-9df7-aa4ba51a588b" name="GCP Platform Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="google-cloud-platform-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="GOOGLE-LOGS03" name="Audit logs can be deleted" state="0" impact="100" issueId="" issueLink="">
+          <desc>There is no external backups of log records. If logs are deleted, there is no way to recover them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.424">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON02" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The administrator accounts are used for all actions, not only for the administrative ones. This is because these users do not have a personal or user account to perform their daily actions.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.011">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.425">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON03" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login to the console without using Multi-factor Authentication (MFA) is considered as suspicious activity. Therefore connection without MFA must be audited and monitored and the corresponding security group must be informed and must validate this connection.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="LOST-SECURITY-ALERTS" name="Misconfigured Security contact details" state="0" impact="100" issueId="" issueLink="">
+          <desc>The security contact details for the Azure subscription are not properly configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Access &amp;quot;Azure Security Center&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the &amp;quot;Recommendations&amp;quot; tab choose &amp;quot;Provide security
+                            contact details&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fields are filled.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-IAM03" name="Misconfigured User Account" state="0" impact="100" issueId="" issueLink="">
+          <desc>Key security settings such as resetting the password, and other password controls are not
+                        configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-IAM-01" name="Misconfigured authentication method for administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>The authentication method "Multi-factor Authentication" for the Administrator accounts is not
+                        configured.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE_IAM-02" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials for the groups and roles are incorrectly configured and there are user accounts with more privileges than necessary.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-EXPIRATION-DATE" name="Misconfigured security key expirations" state="0" impact="100" issueId="" issueLink="">
+          <desc>The password and security key expiration is not configured and users are not obliged to change
+                        their security credentials. Not frequently changing passwords, gives attackers the chance to
+                        obtain credentials and gain access to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-VNET01" name="Networks for Google Cloud resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-RESOURCES-STATUS" name="Undetected Resources status changes" state="0" impact="100" issueId="" issueLink="">
+          <desc>Changes to the system status are not controlled with the consequence of system failure.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON06" name="Undetected brute force attempts on the Google Cloud console" state="0" impact="100" issueId="" issueLink="">
+          <desc>Failed connection attempts (brute force) must be audited and monitored and the corresponding personnel must be alerted and informed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON05" name="Undetected changes in the data encryption configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Changes to the database encryption must be audited and monitored. When there are changes to the database encryption, the security group must be alerted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON07" name="Undetected changes in the network configuration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Changes in network configurations (NACLs, route and gateway tables) are not detected because monitoring and alerts of network configuration changes are not in place.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON01" name="Undetected changes in the security configurations" state="0" impact="100" issueId="" issueLink="">
+          <desc>Monitoring and alerting for security configurations are not configured and changes cannot be detected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-MON04" name="Undetected changes in the security groups" state="0" impact="100" issueId="" issueLink="">
+          <desc>Changes in the security groups must be traced and monitored and the corresponding personnel must approve these changes. If the configuration is not appropriate, attackers can gain access to security systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="GOOGLE-IAM03" name="Apply RBAC with pre-defined policies added into groups and roles" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Define and create groups that relate to job functions (administrators, developers, accounting,
+                        etc.) and assign the relevant permissions for each group, and then assign IAM users to those
+                        groups. All the users in an IAM group inherit the permissions assigned to the group. That way,
+                        you can make changes for everyone in a group in just one place. As people move around in your
+                        company, you can simply change what IAM group their IAM user belongs to. This method is known as
+                        Role Based Access Control (RBAC).&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        To add a team member and grant an IAM role to the member:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
+                        &lt;li&gt;Click Select a project.&lt;/li&gt;
+                        &lt;li&gt;Select a project and click Open.&lt;/li&gt;
+                        &lt;li&gt;Click Add to add new members to the project and set their permissions. In the Select a
+                        role drop-down menu, click on a service name to find the roles that belong to that service.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;To grant more than one role to the same project member:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
+                        &lt;li&gt;Click Select a project.&lt;/li&gt;
+                        &lt;li&gt;Select a project and click Open.&lt;/li&gt;
+                        &lt;li&gt;Enter the email address of the member and select all the roles that you want to grant
+                        to the member. Click Add.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;To grant a role to a member for more than one project:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Open the IAM and Admin Projects page in the Cloud Platform Console and open the IAM
+                        &amp;amp; ADMIN PROJECTS page.&lt;/li&gt;
+                        &lt;li&gt;Select all the projects for which you want to grant permissions.&lt;/li&gt;
+                        &lt;li&gt;In the IAM tab on the right pane, add the new member and select a role to grant the
+                        role for all selected projects.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Granting, changing, and revoking access to resources" url="https://cloud.google.com/iam/docs/granting-changing-revoking-access"/>
+          </references>
+          <standards>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Open the IAM page in the Cloud Platform Console and open the IAM page.&lt;/li&gt;
+                            &lt;li&gt;Click Select a project and click Open.&lt;/li&gt;
+                            &lt;li&gt;List all members from the project.&lt;/li&gt;
+                            &lt;li&gt;Check that each member has been assigned to the correct roles.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM08" name="Automatically rotate Google Service account keys" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The Google Service Keys shall be rotated to avoid unauthorized access.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        To enable automatic rotation of a key, set the rotation schedule with the following gcloud
+                        command-line syntax:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        gcloud kms keys update KEY_NAME \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --location LOCATION \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --keyring KEYRING_NAME \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --rotation-period ROTATION_PERIOD \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --next-rotation-time NEXT_ROTATION_TIME&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;For example:&amp;nbsp;
+                        &lt;div&gt;
+                        gcloud kms keys update KEY_NAME&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --rotation-period=30d&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --next-rotation-time=2016-10-12T12:34:56.1234Z
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: KMS rotation schedule" url="https://cloud.google.com/kms/docs/rotating-keys#kms-set-rotation-schedule-cli"/>
+          </references>
+          <standards>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check automatic rotation of keys is enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM19" name="Avoid assigning Service Account roles to IAM users at project level" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;is recommended to assign the Service Account User (iam.serviceAccountUser) and Service Account Token Creator (iam.serviceAccountTokenCreator) roles to a user for a specific service account rather than assigning the role to a user at project level.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A service account is a special Google account that belongs to an application or a virtual machine (VM), instead of to an individual end-user. Application/VM-Instance uses the service account to call the service's Google API so that users aren't directly involved. In addition to being an identity, a service account is a resource that has IAM policies attached to it. These policies determine who can use the service account.&lt;/p&gt;&lt;p&gt;Users with IAM roles to update the App Engine and Compute Engine instances (such as App Engine Deployer or Compute Instance Admin) can effectively run code as the service accounts used to run these instances, and indirectly gain access to all the resources for which the service accounts have access. Similarly, SSH access to a Compute Engine instance may also provide the ability to execute code as that instance/Service account.&lt;/p&gt;&lt;p&gt;Based on business needs, there could be multiple user-managed service accounts configured for a project. Granting the iam.serviceAccountUser or iam.serviceAserviceAccountTokenCreatorccountUser roles to a user for a project gives the user access to all service accounts in the project, including service accounts that may be created in the future. This can result in elevation of privileges by using service accounts and corresponding Compute Engine instances.&lt;/p&gt;&lt;p&gt;In order to implement least privileges best practices, IAM users should not be assigned the Service Account User or Service Account Token Creator roles at the project level. Instead, these roles should be assigned to a user for a specific service account, giving that user access to the service account. The Service Account User allows a user to bind a service account to a long-running job service, whereas the Service Account Token Creator role allows a user to directly impersonate (or assert) the identity of a service account.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;After revoking Service Account User or Service Account Token Creator roles at the project level from all impacted user account(s), these roles should be assigned to a user(s) for specific service account(s) according to business needs.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console by visiting: https://console.cloud.google.com/iam-admin/iam.&lt;/p&gt;&lt;p&gt;2. Click on the filter table text bar. Type Role: Service Account User&lt;/p&gt;&lt;p&gt;3. Click the Delete Bin icon in front of the role Service Account User for every user listed as a result of a filter.&lt;/p&gt;&lt;p&gt;4. Click on the filter table text bar. Type Role: Service Account Token Creator&lt;/p&gt;&lt;p&gt;5. Click the Delete Bin icon in front of the role Service Account Token Creator for every user listed as a result of a filter.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. Using a text editor, remove the bindings with the roles/iam.serviceAccountUser or roles/iam.serviceAccountTokenCreator.&lt;/p&gt;&lt;p&gt;2. Update the project's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects set-iam-policy PROJECT_ID iam.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.6" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.6" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console by visiting https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Click on the filter table text bar, Type Role: Service Account User.&lt;/p&gt;&lt;p&gt;3. Ensure no user is listed as a result of the filter.&lt;/p&gt;&lt;p&gt;4. Click on the filter table text bar, Type Role: Service Account Token Creator.&lt;/p&gt;&lt;p&gt;5. Ensure no user is listed as a result of the filter.&lt;/p&gt;&lt;p&gt;From Command Line: To ensure IAM users are not assigned Service Account User role at the project level:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountUser"&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountTokenCreator"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;These commands should not return any output.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM12" name="Avoid using API keys on a project" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys appear below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Deleting an API key will break dependent applications (if any).&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, to delete API Keys: Click the Delete Bin Icon in front of every API Key Name.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, no API key should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM09" name="Avoid using personal accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use corporate login credentials instead of personal accounts, such as Gmail accounts.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as personal accounts, should not be used for business purposes.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Follow the documentation and setup corporate login accounts.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.1" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For each Google Cloud Platform project, list the accounts that have been granted access to that project:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Also list the accounts added on each folder:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud resource-manager folders get-iam-policy FOLDER_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;And list your organization's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud organizations get-iam-policy ORGANIZATION_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM20" name="Block access to Cloud KMS cryptokeys from unauthorized access" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended that the IAM policy on Cloud KMS cryptokeys should restrict anonymous and/or public access.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Granting permissions to allUsers or allAuthenticatedUsers allows anyone to access the dataset. Such access might not be desirable if sensitive data is stored at the location. In this case, ensure that anonymous and/or public access to a Cloud KMS cryptokey is not allowed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removing the binding for allUsers and allAuthenticatedUsers members denies accessing cryptokeys to anonymous or public users.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all Cloud KMS Cryptokeys.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Remove IAM policy binding for a KMS key to remove access to allUsers and allAuthenticatedUsers using the below command.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allAuthenticatedUsers' --role='[role]'&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allUsers' --role='[role]'&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.9" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all Cloud KMS Cryptokeys.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure the below command's output does not contain allUsers and allAuthenticatedUsers.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud kms keys get-iam-policy [key_name] --keyring=[key_ring_name] --location=global --format=json | jq '.bindings[].members[]'&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET05" name="Configure Cloud DNS DNSSEC" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Cloud DNS by visiting https://console.cloud.google.com/net-services/dns/zones.&lt;/p&gt;&lt;p&gt;2. For each zone of Type Public, set DNSSEC to On.&lt;/p&gt;&lt;p&gt;From Command Line: Use the below command to enable DNSSEC for Cloud DNS Zone Name.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state on&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Ensure RSASHA1 is not used for the key-signing/zone-signing key.&lt;/p&gt;&lt;p&gt;1. If it is necessary to change the settings for a managed zone where it has been enabled, NSSEC must be turned off and re-enabled with different settings. To turn off DNSSEC, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state off&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. To update key-signing for a reported managed DNS Zone, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.3" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="3.4" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="3.5" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure the property algorithm for keyType zone signing is not using RSASHA1.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dns managed-zones describe --format="json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs)"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-LOG05" name="Configure Cloud DNS Logging" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Security monitoring and forensics cannot depend solely on IP addresses from VPC flow logs, especially when considering the dynamic IP usage of cloud resources, HTTP virtual host routing, and other technology that can obscure the DNS name used by a client from the IP address. Monitoring of Cloud DNS logs provides visibility to DNS names requested by the clients within the VPC. These logs can be monitored for anomalous domain names, evaluated against threat intelligence.&lt;/p&gt; 
+&lt;p&gt;Note: For full capture of DNS, firewall must block egress UDP/53 (DNS) and TCP/443 (DNS over HTTPS) to prevent client from using external DNS name server for resolution.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling logging for private managed zones&lt;/p&gt; 
+&lt;p&gt;Use DNS policies to enable or disable logging for your networks, or use the DNS managed zone itself to enable or disable logging for queries resolved by that zone.&lt;/p&gt; 
+&lt;p&gt;Note: When you enable query logging, every DNS query to a Cloud DNS managed zone is logged.&lt;/p&gt; 
+&lt;p&gt;To enable logging for a network that does not have a DNS policy, run the dns policies create command.&lt;/p&gt; 
+&lt;p&gt;gcloud dns policies create POLICY_NAME \ -networks=NETWORK \ -enable-logging \ -description=DESCRIPTION&lt;/p&gt; 
+&lt;p&gt;Replace the following:&lt;/p&gt; 
+&lt;p&gt;- POLICY_NAME: the name of the DNS policy&lt;br&gt; - NETWORK: one or more networks in a comma-separated list&lt;br&gt; - DESCRIPTION: a description of the policy&lt;/p&gt; 
+&lt;p&gt;To enable logging for a network that has an existing DNS policy, run the dns policies update command.&lt;/p&gt; 
+&lt;p&gt;gcloud dns policies update POLICY_NAME \ -networks=NETWORK \ -enable-logging&lt;/p&gt; 
+&lt;p&gt;Replace the following:&lt;/p&gt; 
+&lt;p&gt;- POLICY_NAME: the name of the DNS policy&lt;br&gt; - NETWORK: one or more networks in a comma-separated list&lt;/p&gt; 
+&lt;p&gt;Enabling and disabling logging for managed public zones&lt;/p&gt; 
+&lt;p&gt;To turn on logging for an existing managed public zone, run the dns managed-zones update command.&lt;/p&gt; 
+&lt;p&gt;gcloud dns managed-zones update ZONE_NAME -log-dns-queries \&lt;/p&gt; 
+&lt;p&gt;Replace ZONE_NAME with the name of the DNS managed zone that you want to enable logging for.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Enabling of Cloud DNS logging might result in your project being charged for the additional logs usage.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+            <reference name="Cloud DNS Logging and monitoring" url="https://cloud.google.com/dns/docs/monitoring"/>
+          </references>
+          <standards>
+            <standard ref="2.12" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.12" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;From Command Line:&lt;/p&gt;
+
+	&lt;p&gt;1. List all VPCs networks in a project: &lt;/p&gt;
+
+	&lt;p&gt;gcloud compute networks list -format="table[box,title='All VPC Networks'](name:label='VPC Network Name')"&lt;/p&gt;
+
+	&lt;p&gt;2. List all DNS policies, logging enablement, and associated VPC networks: &lt;/p&gt;
+
+	&lt;p&gt;gcloud dns policies list -flatten="networks[]" -format="table[box,title='All DNS Policies By VPC Network'](name:label='Policy Name',enableLogging:label='LoggingEnabled':align=center,networks.networkUrl.basename():label='VPC Network Name')"&lt;/p&gt;
+
+	&lt;p&gt;Each VPC Network should be associated with a DNS policy with logging enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-IAM-01" name="Configure essential contacts for organization" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Many Google Cloud services, such as Cloud Billing, send out notifications to share important information with Google Cloud users. By default, these notifications are sent to members with certain Identity and Access Management (IAM) roles. With Essential Contacts, you can customize who receives notifications by providing your own list of contacts.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts&lt;/li&gt;&lt;li&gt;Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.&lt;/li&gt;&lt;li&gt;Click +Add contact&lt;/li&gt;&lt;li&gt;In the Email and Confirm Email fields, enter the email address of the contact.&lt;/li&gt;&lt;li&gt;From the Notification categories drop-down menu, select the notification categories that you want the contact to receive communications for.&lt;/li&gt;&lt;li&gt;Click Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To add an organization Essential Contacts run a command:&lt;/li&gt;&lt;/ol&gt;&lt;blockquote&gt;&lt;p&gt;gcloud essential-contacts create --email="&amp;lt;EMAIL&amp;gt;" \ --notification-categories="&amp;lt;NOTIFICATION_CATEGORIES&amp;gt;" \ --organization=&amp;lt;ORGANIZATION_ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default, there are no Essential Contacts configured.&lt;/p&gt;&lt;p&gt;In the absence of an Essential Contact, the following IAM roles are used to identify users to notify for the following categories:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Legal: roles/billing.admin&lt;/li&gt;&lt;li&gt;Security: roles/resourcemanager.organizationAdmin&lt;/li&gt;&lt;li&gt;Suspension: roles/owner&lt;/li&gt;&lt;li&gt;Technical: roles/owner&lt;/li&gt;&lt;li&gt;Technical Incidents: roles/owner&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Managing notification contacts" url="https://cloud.google.com/resource-manager/docs/managing-notification-contacts"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.16" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts&lt;/li&gt;&lt;li&gt;Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.&lt;/li&gt;&lt;li&gt;Ensure that appropriate email addresses are configured for each of the following notification categories:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Legal&lt;/li&gt;&lt;li&gt;Security&lt;/li&gt;&lt;li&gt;Suspension&lt;/li&gt;&lt;li&gt;Technical&lt;/li&gt;&lt;li&gt;Technical Incidents&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Alternatively, appropriate email addresses can be configured for the All notification category to receive all possible important notifications.&amp;nbsp;&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To list all configured organization Essential Contacts run a command: gcloud essential-contacts list --organization=&amp;lt;ORGANIZATION_ID&amp;gt;&lt;/li&gt;&lt;li&gt;Ensure at least one appropriate email address is configured for each of the following notification categories:&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;LEGAL&lt;/li&gt;&lt;li&gt;SECURITY&lt;/li&gt;&lt;li&gt;SUSPENSION&lt;/li&gt;&lt;li&gt;TECHNICAL&lt;/li&gt;&lt;li&gt;TECHNICAL_INCIDENTS&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Alternatively, appropriate email addresses can be configured for the ALL notification category to receive all possible important notifications.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET04" name="Configure Firewall Rules for instances behind IAP" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed. To ensure that load balancing works correctly health checks should also be allowed.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;IAP ensure that access to VMs is controlled by authenticating incoming requests. However if the VM is still accessible from IP addresses other than the IAP it may still be possible to send unauthenticated requests to the instance. Care must be taken to ensure that loadbalancer health checks are not blocked as this would stop the loadbalancer from correctly knowing the health of the VM and loadbalancing correctly.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If firewall rules are not configured correctly, legitimate business services could be negatively impacted.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;/p&gt;&lt;p&gt;2. Select the checkbox next to the following rules:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;default-allow-http&lt;/li&gt;&lt;li&gt;default-allow-https&lt;/li&gt;&lt;li&gt;default-allow-internal&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;3. Click Delete.&lt;/p&gt;&lt;p&gt;4. Click Create firewall rule and set the following values:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Name: allow-iap-traffic&lt;/li&gt;&lt;li&gt;Targets: All instances in the network&lt;/li&gt;&lt;li&gt;Source IP ranges (press Enter after you paste each value in the box):&lt;ul&gt;&lt;li&gt;130.211.0.0/22&lt;/li&gt;&lt;li&gt;35.191.0.0/16&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Protocols and ports:&lt;ul&gt;&lt;li&gt;Specified protocols and ports&lt;/li&gt;&lt;li&gt;tcp:80&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;5. When you're finished updating values, click Create.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;/p&gt;&lt;p&gt;2. Verify that the only rules correspond to the following values:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Targets: All instances in the network&lt;/li&gt;&lt;li&gt;Source IP ranges (press Enter after you paste each value in the box):&lt;ul&gt;&lt;li&gt;130.211.0.0/22&lt;/li&gt;&lt;li&gt;35.191.0.0/16&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Protocols and ports:&lt;ul&gt;&lt;li&gt;Specified protocols and ports&lt;/li&gt;&lt;li&gt;tcp:80&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-LOG06" name="Configure sinks for all logs entries" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a sink (console)&lt;/p&gt; 
+&lt;p&gt;You can create up to 200 sinks per Cloud project.&lt;/p&gt; 
+&lt;p&gt;After you create the sink, ensure that Logging has the appropriate permissions to write logs to your sink's destination.&lt;/p&gt; 
+&lt;p&gt;To create a sink, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud console, go to the Logs Router page:&lt;/p&gt; 
+&lt;p&gt;2. Select an existing Cloud project.&lt;/p&gt; 
+&lt;p&gt;3. Select Create sink.&lt;/p&gt; 
+&lt;p&gt;4. In the Sink details panel, enter the following details:&lt;/p&gt; 
+&lt;p&gt;- Sink name: Provide an identifier for the sink; note that after you create the sink, you can't rename the sink but you can delete it and create a new sink.&lt;/p&gt; 
+&lt;p&gt;- Sink description (optional): Describe the purpose or use case for the sink.&lt;/p&gt; 
+&lt;p&gt;5. In the Sink destination panel, select the sink service and destination:&lt;/p&gt; 
+&lt;p&gt;- Select sink service: Select the service where you want your logs routed.&lt;/p&gt; 
+&lt;p&gt;Based on the service that you select, you can select from the following destinations:&lt;/p&gt; 
+&lt;p&gt;- Cloud Logging bucket: Select or create a Logging bucket.&lt;br&gt; - BigQuery table: Select or create the particular dataset to receive the routed logs. You also have the option to use partitioned tables.&lt;br&gt; - Cloud Storage bucket: Select or create the particular Cloud Storage bucket to receive the routed logs.&lt;br&gt; - Pub/Sub topic: Select or create the particular topic to receive the routed logs.&lt;br&gt; - Splunk: Select the Pub/Sub topic for your Splunk service.&lt;br&gt; - Other Cloud project: Manually add the Logging, BigQuery, Cloud Storage, or Pub/Sub service and destination information in the following format:&lt;/p&gt; 
+&lt;p&gt;SERVICE.googleapis.com/projects/PROJECT_ID/SINK_DESTINATION/DESTINATION_ID&lt;/p&gt; 
+&lt;p&gt;For example, if your sink destination is a BigQuery dataset, the sink destination would be the following:&lt;/p&gt; 
+&lt;p&gt;bigquery.googleapis.com/projects/PROJECT_ID/datasets/DATASET_ID&lt;/p&gt; 
+&lt;p&gt;Note that if you are routing logs between Cloud projects, you still need the appropriate destination permissions.&lt;/p&gt; 
+&lt;p&gt;6. In the Choose logs to include in sink panel, do the following:&lt;/p&gt; 
+&lt;p&gt;a. In the Build inclusion filter field, enter a filter expression that matches the log entries you want to include. If you don't set a filter, all logs from your selected resource are routed to the destination.&lt;/p&gt; 
+&lt;p&gt;For example, you might want to build a filter to route all Data Access logs to a single Logging bucket. This filter looks like the following:&lt;/p&gt; 
+&lt;p&gt;LOG_ID("cloudaudit.googleapis.com/data_access") OR LOG_ID("externalaudit.googleapis.com/data_access")&lt;/p&gt; 
+&lt;p&gt;Note that the length of a filter can't exceed 20,000 characters.&lt;/p&gt; 
+&lt;p&gt;b. To verify you entered the correct filter, select Preview logs. This opens the Logs Explorer in a new tab with the filter prepopulated.&lt;/p&gt; 
+&lt;p&gt;7. (Optional) In the Choose logs to filter out of sink panel, do the following:&lt;/p&gt; 
+&lt;p&gt;a. In the Exclusion filter name field, enter a name.&lt;/p&gt; 
+&lt;p&gt;b. In the Build an exclusion filter field, enter a filter expression that matches the log entries you want to exclude. You can also use the sample function to select a portion of the log entries to exclude.&lt;/p&gt; 
+&lt;p&gt;Key Point: If you want your exclusion filter to be disabled when the sink is created, then select Disable after you enter your filter expression. You can update the sink later to enable the exclusion filter.&lt;/p&gt; 
+&lt;p&gt;You can create up to 50 exclusion filters per sink. Note that the length of a filter can't exceed 20,000 characters.&lt;/p&gt; 
+&lt;p&gt;8. Select Create sink.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+            <reference name="Configure and manage sinks" url="https://cloud.google.com/logging/docs/export/configure_export_v2"/>
+          </references>
+          <standards>
+            <standard ref="2.2" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.2" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;From Console:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to Logging/Exports by visiting https://console.cloud.google.com/logs/exports.&lt;/p&gt;
+
+	&lt;p&gt;2. For every sink, click the 3-dot button for Menu options and select View Filter.&lt;/p&gt;
+
+	&lt;p&gt;3. Ensure there is at least one sink with an empty sink filter.&lt;/p&gt;
+
+	&lt;p&gt;4. Additionally, ensure that the resource configured as Destination exists.&lt;/p&gt;
+
+	&lt;p&gt;From Command Line:&lt;/p&gt;
+
+	&lt;p&gt;1. Ensure that a sink with an empty filter exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project: &lt;/p&gt;
+
+	&lt;p&gt;gcloud logging sinks list -folder=FOLDER_ID | -organization=ORGANIZATION_ID | -project=PROJECT_ID&lt;/p&gt;
+
+	&lt;p&gt;The output should list at least one sink with an empty filter.&lt;/p&gt;
+
+	&lt;p&gt;2. Additionally, ensure that the resource configured as Destination exists.&lt;/p&gt;
+
+	&lt;p&gt;See https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list for more information.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-GOV01" name="Configure the reset security challenge questions for Administrator accounts" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure configuration of the security challenge questions for the Administrator accounts recover or reset password process are secure.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to &lt;a href="https://myaccount.google.com/security#signin"&gt;Google Cloud Account&lt;/a&gt;.&lt;/li&gt; 
+  &lt;li&gt;Fill in the fields from the &amp;quot;Recover Account Options&amp;quot; sections and click &amp;quot;Save&amp;quot;.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: Security" url="https://myaccount.google.com/security#signin"/>
+          </references>
+          <standards>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to &lt;a href="https://myaccount.google.com/security#signin"&gt;Google Cloud
+                            account&lt;/a&gt;.&lt;/li&gt;
+                            &lt;li&gt;Check that all fields from the &amp;quot;Recover Account Options&amp;quot;
+                            sections are filled correctly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.880">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON06" name="Create alerts for changes in the security groups and in the security group configurations" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for changes in the security groups and in the security group configurations&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about changes to the Security Groups or the Security Groups configuration. It's vital that monitoring of Security Groups detects and reports any unauthorized changes in the security systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when security groups and their configurations are changed or modified.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON03" name="Create alerts for security policy changes" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for security policy changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the Security Policy changes. It's vital that monitoring of the Security Policy detects and reports any unauthorized changes in the security configurations. &lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section shall be set up. In this case, you have to add the condition for the next methods: projects.getIamPolicy, projects.setIamPolicy, organizations.getIamPolicy and organizations.setIamPolicy&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Modify IAM policy" url="https://cloud.google.com/logging/docs/audit/configure-data-access?hl=es-419#getiampolicy-setiampolicy"/>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify for security policy changes.&lt;br /&gt;
+5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON13" name="Create alerts for the Logging of configuration changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the Logging of configuration changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts for Logging changes to monitor, audit and notify about changes in this section by the corresponding personnel. It's vital that any unauthorized changes are detected and reported.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. You don't have to change it.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the Logging of configuration changes.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON10" name="Create alerts for the VPC route table changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for the VPC route table changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC Route Table changes. It's vital that monitoring of the VPC Route Table detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the VPC route table configuration changes.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON11" name="Create alerts for VPC gateway changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for VPC gateway changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC Gateway changes. It's vital that monitoring of the VPC Gateway detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;br&gt; 1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt;- The Conditions section is already set up. Fill the condition correctly.&lt;br&gt;- In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt;- In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the VPC gateway configuration changes.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.569">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON09" name="Create alerts for VPC NACL changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts for VPC NACL changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the VPC NACL (Network Access Control List) changes. It's vital that monitoring of VPC NACL detects and reports any unauthorized access to the security network systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the VPC NACL configuration changes.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON08" name="Create alerts to be notified about console login failure attempts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts to be notified about console login failure attempts&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and to be notified when there are several console login failure attempts. It's vital that monitoring of these connection attempts detects and reports any unauthorized access to the systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the console login failure attempts are greater than a fixed number.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON05" name="Create alerts to be notified about console login without 2FA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts to be notified about console login without 2FA&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when users log into the console without a Second Factor of Authentication. It's vital that monitoring of authentication to systems detects and reports any unauthorized access to them.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when users are logged into the console without using 2 Factor authentication&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON04" name="Create alerts to detect the changes of activity alerts" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts to detect the changes of activity alerts&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about the changes of Monitoring alerts. It's vital that the monitoring of alerts detects and reports any unauthorized changes in the Monitoring systems.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. You don't have to change it.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify about the changes of activity alerts.&lt;br /&gt;
+5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON02A" name="Create alerts to notify about improper usage of the root account" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts to notify about improper usage of the root account&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify about usage of the root account when this account is used frequently. It's vital that monitoring of root account usage detects and reports unauthorized or improper usage.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+            <reference name="Managing metric-based alerting policies" url="https://cloud.google.com/monitoring/alerts/using-alerting-ui"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify about improper usage of administrator accounts.&lt;br /&gt;
+5. Check this alert is configured correctly and notifications are configured to be sent to the corresponding users.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.567">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON07" name="Create alerts when the data encryption changes" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create alerts when the data encryption changes&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create alerts to monitor, audit and notify when the data encryption changes. It's vital that monitoring of data encryption detects and reports any unauthorized changes in the system configurations.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To create an alerting policy, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud Console, select Monitoring. &lt;br&gt; 2. Select Alerting.&lt;br&gt; 3. Click Create Policy to see the Create alerting policy page.&lt;br&gt; 4. Fill in the sections as follows:&lt;br&gt; - The Conditions section is already set up. Fill the condition correctly.&lt;br&gt; - In the Notifications section, click Add Notification and fill in your email address or another notification method.&lt;br&gt; - In the Name this policy section, you can accept the default.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring alerts" url="https://cloud.google.com/monitoring/alerts/"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br /&gt;
+2. In the navigation pane, select Alerting.&lt;br /&gt;
+3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;br /&gt;
+4. Check there exists an Alerting Policy to notify when the data encryption configuration changes.&lt;br /&gt;
+5. Check that this alert is configured correctly and its notifications are configured to be sent to the corresponding users&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.568">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-MON01" name="Create an uptime check to alert when the server is down" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create an uptime check to alert when the server is down&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Create an uptime check to verify your web server is always accessible. The alerting policy controls who is notified when the uptime check fails.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create an uptime check and an alerting policy&lt;/p&gt; 
+&lt;p&gt;To create an uptime check, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud console, select Monitoring.&lt;br&gt; 2. In the navigation pane, click Uptime checks.&lt;br&gt; 3. Click Create Uptime check.&lt;br&gt; 4. For the title, enter My Uptime Check and then click Next.&lt;br&gt; 5. Target:&lt;br&gt; a. Select HTTP as the protocol.&lt;br&gt; b. Select Instance as the Resource Type.&lt;br&gt; c. In the Applies To field, select Single and for the instance name select lamp-1-vm.&lt;br&gt; d. Leave all other fields at their default values and click Next.&lt;br&gt; 6. Response Validation: Leave these fields at their default values and click Next&lt;br&gt; 7. Alert &amp;amp; Notification:&lt;br&gt; a. Ensure that the toggle's label is Alerting is enabled.&lt;br&gt; b. Leave the name and duration fields at their default values.&lt;br&gt; c. To add a notification channel to the alerting policy, in the text box labeled Notification channels, click Menu. Select the channels to add and click OK. The notifications are grouped alphabetically for each channel type.&lt;br&gt; To add an entry to the checkbox list, click Manage notification channels and follow the instructions. When you return to this dialog, click Refresh.&lt;br&gt; 8. To verify your uptime check configuration, click Test. If you see a "Connection error - refused" message, you might have not installed the Apache HTTP Server or you might have specified the HTTPS check type rather than HTTP.&lt;br&gt; 9. Click Create. When the create action is successful, the message Check and alert created is displayed and then the Uptime checks dashboard page is displayed.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: monitoring gs checks" url="https://cloud.google.com/monitoring/quickstart-lamp#gs-checks"/>
+            <reference name="Monitor a Compute Engine virtual machine" url="https://cloud.google.com/monitoring/monitor-compute-engine-virtual-machine"/>
+          </references>
+          <standards>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;1. Check there exists an uptime Check alert to notify when the server is down.&lt;br /&gt;
+2. Check that this uptime Check alert is configured correctly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.567">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM07" name="Create a process to create and manage the Google Service Keys" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create a process or mechanism to create, manage, or revoke the assignment of keys to users and
+                        give them the least necessary access to resources. There are two types of service account keys:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;GCP-managed keys:&lt;/b&gt;&amp;nbsp;These keys are used by Cloud Platform
+                        services such as the App Engine and Compute Engine. These keys cannot be downloaded. Google will
+                        keep the keys and automatically rotate them daily.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;&lt;b&gt;User-managed keys:&amp;nbsp;&lt;/b&gt;These keys are created, downloadable,
+                        and managed by users. For user-managed keys, you need to ensure you have processes in place to
+                        address key management requirements such as:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key storage&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Key distribution&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Key revocation&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Key rotation&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Protecting the keys from unauthorized users.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: IAM manage account keys" url="https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check there exists a mechanism or process to create, manage or revoke the assignment of
+                            keys to users.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM05" name="Create Individual Accounts for the administrator users" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create individual accounts for administrator users and with these new accounts perform the necessary administrative actions. By creating service accounts for people accessing your account, you can give each Google user a unique set of security credentials and roles.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The administrator accounts shall be used for administrative actions and for giving or revoking credentials to users' accounts. The administrator account shall be not used as a normal user account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console and open the IAM page.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click Select a project.&lt;/li&gt; 
+  &lt;li&gt;Select your project and click Open.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click Create Service Account.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Enter a service account name, select a role you wish to grant to the service account and click Create.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: manage service accounts" url="https://cloud.google.com/iam/docs/creating-managing-service-accounts"/>
+          </references>
+          <standards>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console and open the IAM
+                            page.&lt;/li&gt;
+                            &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select your project and click Open.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Review that each administrator user has an individual Google Service Account.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-LOG04" name="Create log metric filters and alerts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create log metric filters and alerts&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use log-based alerts to notify you whenever a specific message appears in your included logs. For example, if you want to know when an audit log records a particular data-access message, you can create a log-based alert that matches the message and notifies you when it appears.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Create a log-based alert (Logs Explorer)&lt;/p&gt; 
+&lt;p&gt;You can create log-based alerts from the Logs Explorer page in the Google Cloud console or by using the Monitoring API.&lt;/p&gt; 
+&lt;p&gt;The Logs Explorer interface for creating and editing log-based alerts guides you through the following steps:&lt;/p&gt; 
+&lt;p&gt;- Provide a name and description for the alert.&lt;br&gt; - Choose the logs for which you want to receive a notification.&lt;br&gt; - Set the time between notifications.&lt;br&gt; - Set the time for automatic closure of incidents.&lt;br&gt; - Specify whom to notify.&lt;/p&gt; 
+&lt;p&gt;For example, assume that you have an application that writes a syslog log entry with NOTICE severity when the application changes a network address. The log entries for network-address changes include a JSON payload that looks like the following:&lt;/p&gt; 
+&lt;p&gt;"jsonPayload": { "type": "Configuration change", "action": "Set network address", "result": "IP_ADDRESS",&lt;br&gt; }&lt;/p&gt; 
+&lt;p&gt;You want to create a log-based alert that notifies you when an invalid IPv4 address appears in the jsonPayload.result field of log entries in syslog with NOTICE severity.&lt;/p&gt; 
+&lt;p&gt;To create the log-based alert, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the Cloud console, select Logging, and then select Logs Explorer:&lt;/p&gt; 
+&lt;p&gt;2. Use the Query pane to build a query that matches the message you want to use in your log-based alert.&lt;/p&gt; 
+&lt;p&gt;For example, to find log entries with a severity level of NOTICE in the syslog log that have invalid IP addresses in the JSON payload, you can use the following query:&lt;/p&gt; 
+&lt;p&gt;log_id("syslog")&lt;br&gt; severity = "NOTICE"&lt;br&gt; jsonPayload.result !~ "^((25[0-5]|2[0-4][0-9]|&lt;sup&gt;&lt;a&gt;01&lt;/a&gt;&lt;/sup&gt;?[0-9][0-9]?)(\.|$)){4}$"&lt;/p&gt; 
+&lt;p&gt;Use Run query in the Query results pane to validate the query.&lt;/p&gt; 
+&lt;p&gt;3. In the header of the Query results pane, click Create alert. When your window is narrow, the Create alert option might appear on the Actions menu instead.&lt;/p&gt; 
+&lt;p&gt;4. In the Alert details pane, give the alert a name and description:&lt;/p&gt; 
+&lt;p&gt;a. Enter a name for your alert in the Alert Name field. For example: "Network address: invalid IPv4 value".&lt;/p&gt; 
+&lt;p&gt;b. Enter a description of this alert. You can also include information that might help the recipient of a notification diagnose the problem. The following string summarizes the reason for the alert:&lt;/p&gt; 
+&lt;p&gt;Log-based alert in project ${project} detected an invalid IPv4 value..&lt;/p&gt; 
+&lt;p&gt;5. To advance to the next step, click Next.&lt;/p&gt; 
+&lt;p&gt;6. In the Choose logs to include in the alert pane, check the query and results by clicking Preview logs.&lt;/p&gt; 
+&lt;p&gt;Google Cloud recommends building the query in the Logs Explorer Query pane. The query you built in the Query pane is also displayed on this pane, for example:&lt;/p&gt; 
+&lt;p&gt;log_id("syslog")&lt;br&gt; severity = "NOTICE"&lt;br&gt; jsonPayload.result !~ "^((25[0-5]|2[0-4][0-9]|&lt;sup&gt;&lt;a&gt;01&lt;/a&gt;&lt;/sup&gt;?[0-9][0-9]?)(\.|$)){4}$"&lt;/p&gt; 
+&lt;p&gt;You can edit the query in this pane, if necessary. If you edit the query, then check the results by clicking Preview logs.&lt;/p&gt; 
+&lt;p&gt;7. Click Next.&lt;/p&gt; 
+&lt;p&gt;8. Select the minimum time between notifications. This value lets you control the number of notifications you get from this alert if it is triggered multiple times. For this example, select 5 min from the options.&lt;/p&gt; 
+&lt;p&gt;You can leave the incident auto-close duration at the default value, or you can set it to a different value by selecting a different option on the menu.&lt;/p&gt; 
+&lt;p&gt;9. Click Next.&lt;/p&gt; 
+&lt;p&gt;10. Select one or more notification channels for your alert. For this example, select an email notification channel.&lt;/p&gt; 
+&lt;p&gt;If you already have an email notification channel configured, then you can select it from the list. If not, click Manage notification channels and add an email channel. For information about creating notification channels, see Managing notification channels.&lt;/p&gt; 
+&lt;p&gt;11. Click Save.&lt;/p&gt; 
+&lt;p&gt;Your log-based alert is now ready to test.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+            <reference name="Managing log-based alerts" url="https://cloud.google.com/logging/docs/alerting/log-based-alerts"/>
+          </references>
+          <standards>
+            <standard ref="2.10" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.10" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.11" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.11" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.4" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.4" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.5" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.5" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.6" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.6" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.7" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.7" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.8" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.8" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="2.9" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.9" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Test the example log-based alert&lt;/p&gt;
+
+	&lt;p&gt;To test the alert you created in the Description section, you can manually write a log entry that matches the query. To write the log entry, do the following:&lt;/p&gt;
+
+	&lt;p&gt;1. Configure the following log entry by changing the PROJECT_ID variable to your project ID:&lt;/p&gt;
+
+	&lt;p&gt;{
+  "entries": [
+  {
+    "logName": "projects/PROJECT_ID/logs/syslog",
+    "jsonPayload": {
+      "type": "Configuration change",
+      "action": "Set network address",
+      "result": "999.027.405.1",
+    },
+    "severity": "NOTICE",
+    "resource": {
+      "type": "generic_task",
+      "labels" : {
+        "project_id": "PROJECT_ID",
+        "location": "us-east1",
+        "namespace": "fake-task-2",
+        "job": "write-log-entry",
+        "task_id": "11",
+      },
+    },
+  ],&lt;br /&gt;
+}&lt;/p&gt;
+
+	&lt;p&gt;2. Go to the logEntries.write reference page, or click the following button:&lt;/p&gt;
+
+	&lt;p&gt;3. Copy the log entry you configured previously.&lt;/p&gt;
+
+	&lt;p&gt;4. In the Try this API pane, do the following:&lt;/p&gt;
+
+	&lt;p&gt;a. Replace the content of the Request body field in APIs Explorer with the log entry you copied in the previous step.&lt;/p&gt;
+
+	&lt;p&gt;b. Click Execute. If prompted, follow the authentication flow.&lt;/p&gt;
+
+	&lt;p&gt;If the logEntries.write call is successful, then you get an HTTP 200 response code and an empty response body, {}.&lt;/p&gt;
+
+	&lt;p&gt;The log entry matches the filter specified for the alert in the following ways:&lt;/p&gt;
+
+	&lt;p&gt;- The logName value specifies the syslog log in your Cloud project.&lt;br /&gt;
+- The severity value for this log entry is NOTICE.&lt;br /&gt;
+- The jsonPayload.result value is not a valid IPv4 address.&lt;/p&gt;
+
+	&lt;p&gt;After you write the log entry, the following sequence occurs:&lt;/p&gt;
+
+	&lt;p&gt;- The new log entry appears in the Logs Explorer and triggers the alert.&lt;br /&gt;
+- An incident is opened in Cloud Monitoring.&lt;br /&gt;
+- You receive a notification for the incident. If you configured an email notification channel, then the notification looks like the following screenshot:&lt;/p&gt;
+
+	&lt;p&gt;You can click View incident in the email to see the incident in Cloud Monitoring.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM04" name="Create mechanisms to ensure Least Privilege is applied" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create mechanisms to periodically review the group and user permissions to ensure the least
+                        privilege for the user accounts. Granting least privilege ensures that users only have the
+                        permissions required to complete their tasks rather than additional privileges that are not
+                        required. Following this model ensures that, should an account be compromised, the blast radius
+                        of damage is limited.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC with
+                        pre-defined policies added into groups or roles&amp;quot;.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Open the IAM page in the Google Cloud Platform Console and open the IAM page.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select a project and click Open.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Review the groups and users with access to the project and their permissions.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;If there is a user with more privileges, revoke the access as following:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Select the user to revoke privileges.&lt;/li&gt;
+                        &lt;li&gt;In the Roles(s) drop-down menu in the member's row, uncheck the roles you want to
+                        revoke and click Save.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Granting, changing, and revoking access to resources" url="https://cloud.google.com/iam/docs/granting-changing-revoking-access"/>
+          </references>
+          <standards>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check there is a mechanism in place to ensure the enforcement of the Least Privilege
+                            principle.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM02" name="Define roles for the Google Service Accounts" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Define and create the roles for the Google Cloud. For each role, you can use one of the
+                        predefined roles or create a new custom role to ensure that each role has got the least minimum
+                        permissions.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;List all predefined roles and review them.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;If it's necessary, create new custom roles to ensure users have the least privileges.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;List all roles.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all fulfill the least privilege principle.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all roles are defined correctly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-LOG-03" name="Enable Access Approval" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Controlling access to your information is one of the foundations of information security. Google Employees do have access to your organizations' projects for support reasons. With Access Approval, organizations can then be certain that their information is accessed by only approved Google Personnel.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To use Access Approval your organization will need have enabled Access Transparency and have at one of the following support level: Enhanced or Premium. There will be subscription costs associated with these support levels, as well as increased storage costs for storing the logs. You will also not be able to turn the Access Transparency which Access Approval depends on, off yourself. To do so you will need to submit a service request to Google Cloud Support. There will also be additional overhead in managing user permissions. There may also be a potential delay in support times as Google Personnel will have to wait for their access to be approved.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be displayed here. On this screen, there is an option to click Enroll. If it is greyed out and you see an error bar at the top of the screen that says Access Transparency is not enabled please view the corresponding reference within this section to enable it.&lt;/li&gt;&lt;li&gt;In the second screen click Enroll.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Grant an IAM Group or User the role with permissions to Add Users to be Access Approval message Recipients&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the IAM and Admin. Select IAM in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button the says +add at the top of the screen.&lt;/li&gt;&lt;li&gt;In the principals field, select a user or group by typing in their associated email address.&lt;/li&gt;&lt;li&gt;Click on the role field to expand it. In the filter field enter Access Approval Approver and select it.&lt;/li&gt;&lt;li&gt;Click save.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Add a Group or User as an Approver for Access Approval Requests&lt;/p&gt;&lt;ol&gt;&lt;li&gt;As a user with the Access Approval Approver permission, within the project where you wish to add an email address to which request will be sent, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click Manage Settings&lt;/li&gt;&lt;li&gt;Under Set up approval notifications, enter the email address associated with a Google Cloud User or Group you wish to send Access Approval requests to. All future access approvals will be sent as emails to this address.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From CLI:&lt;/p&gt;&lt;p&gt;To update all services in an entire project, run the following command from an account that has permissions as an 'Approver for Access Approval Requests'&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud access-approval settings update --project=&amp;lt;project name&amp;gt; --enrolled_services=all --notification_emails='&amp;lt;email recipient for access approval requests&amp;gt;@&amp;lt;domain name&amp;gt;'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Access Approval and its dependency of Access Transparency are not enabled.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Access Approval" url="https://cloud.google.com/cloud-provider-access-management/access-approval/docs/overview"/>
+          </references>
+          <standards>
+            <standard ref="2.15" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Determine if Access Transparency is Enabled as it is a Dependency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home inside the project you wish to audit, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status should be "Enabled' under the heading Access Transparency&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Determine if Access Approval is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be displayed here. If you see a screen saying you need to enroll in Access Approval, it is not enabled.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From CLI:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Determine if Access Approval is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;From within the project you wish to audit, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud access-approval settings get&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;The status will be displayed in the output.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-LOG-02" name="Enable Access Transparency" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Controlling access to your information is one of the foundations of information security. Given that Google Employees do have access to your organizations' projects for support reasons, you should have logging in place to view who, when, and why your information is being accessed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;To use Access Transparency your organization will need to have at one of the following support level: Premium, Enterprise, Platinum, or Gold. There will be subscription costs associated with support, as well as increased storage costs for storing the logs. You will also not be able to turn Access Transparency off yourself, and you will need to submit a service request to Google Cloud Support.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Add privileges to enable Access Transparency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the 'IAM and Admin'. Select IAM in the top of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button the says +add at the top of the screen.&lt;/li&gt;&lt;li&gt;In the principals field, select a user or group by typing in their associated email address.&lt;/li&gt;&lt;li&gt;Click on the role field to expand it. In the filter field enter Access Transparency Admin and select it.&lt;/li&gt;&lt;li&gt;Click save.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Verify that the Google Cloud project is associated with a billing account&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Select Billing.&lt;/li&gt;&lt;li&gt;If you see This project is not associated with a billing account you will need to enter billing information or switch to a project with a billing account.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Enable Access Transparency&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;Click the blue button labeled Enable Access Transparency for Organization&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Access Transparency is not enabled.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Access Transparency" url="https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/overview"/>
+          </references>
+          <standards>
+            <standard ref="2.14" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.14" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Determine if Access Transparency is Enabled&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM &amp;amp; Admin Menu. Select settings in the middle of the column that opens.&lt;/li&gt;&lt;li&gt;The status will be under the heading Access Transparency. Status should be Enabled&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-LOG01" name="Enable all access logs" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable all access logs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Enable all audit logs in the Google Cloud Platform to control and monitor the access of users and the configuration changes in the systems. &lt;br&gt; First, you have to know there are two types of audit logs in the Google Cloud Platform: &lt;br&gt; - Admin Activity audit logs that are enabled for all services and cannot be configured.&lt;br&gt; - Data Access audit logs that are not enabled by default and they shall be configured.&lt;/p&gt; 
+&lt;p&gt;Remediation: &lt;br&gt; Configure Data Access audit logs with the Cloud console&lt;/p&gt; 
+&lt;p&gt;You can also use the API or the Google Cloud CLI to perform these tasks programmatically.&lt;/p&gt; 
+&lt;p&gt;To access audit log configuration options in the Cloud console, follow these steps:&lt;/p&gt; 
+&lt;p&gt;1. From the Cloud console, select IAM &amp;amp; Admin &amp;gt; Audit Logs:&lt;/p&gt; 
+&lt;p&gt;2. Select an existing Cloud project, folder, or organization at the top of the page.&lt;/p&gt; 
+&lt;p&gt;Enable audit logs&lt;/p&gt; 
+&lt;p&gt;To enable Data Access audit logs, do the following:&lt;/p&gt; 
+&lt;p&gt;1. In the main table on the Audit Logs page, select one or more Google Cloud services from the Title column.&lt;/p&gt; 
+&lt;p&gt;2. In the Log Type tab, select the Data Access audit log types that you want to enable and then click Save.&lt;/p&gt; 
+&lt;p&gt;3. Where you have successfully enabled audit logs, the table includes a checkmark. In the following example, you see that, for the Cloud Composer API service, Admin Read and Data Read audit logs are enabled:&lt;/p&gt; 
+&lt;p&gt;You can also enable audit logs for all Google Cloud services that produce Data Access audit logs. In the main table on the Audit Logs page, select all Google Cloud services.&lt;/p&gt; 
+&lt;p&gt;Note that this bulk configuration method applies only to the Google Cloud services that are currently available. If a new Google Cloud service is added, it inherits your default audit configuration.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure Data Access audit logs" url="https://cloud.google.com/logging/docs/audit/configure-data-access#config-console"/>
+            <reference name="Google Cloud docs: data access" url="https://cloud.google.com/logging/docs/audit/configure-data-access#project-and-organization"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Check that all audit logs in the Google Cloud Platform are enabled and configured.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-LOG-01" name="Enable Cloud Asset Inventory" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;It is recommended GCP Cloud Asset Inventory be enabled for all GCP projects.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;1Go to API &amp;amp; Services/Library by visiting https://console.cloud.google.com/apis/library&lt;/li&gt;&lt;li&gt;Search for Cloud Asset API and select the result for Cloud Asset API&lt;/li&gt;&lt;li&gt;Click the ENABLE button.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API:&lt;/p&gt;&lt;p&gt;Enable the Cloud Asset API through the services interface:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services enable cloudasset.googleapis.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The Cloud Asset Inventory API is disabled by default in each project.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Asset Inventory" url="https://cloud.google.com/asset-inventory/docs"/>
+          </references>
+          <standards>
+            <standard ref="2.13" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.13" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that the Cloud Asset API is enabled:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to API &amp;amp; Services/Library by visiting https://console.cloud.google.com/apis/library&lt;/li&gt;&lt;li&gt;Search for Cloud Asset API and select the result for Cloud Asset API&lt;/li&gt;&lt;li&gt;Ensure that API Enabled is displayed.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that the Cloud Asset API is enabled:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Query enabled services:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services list --enabled --filter=name:cloudasset.googleapis.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If the API is listed, then it is enabled. If the response is Listed 0 items the API is not enabled.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM15" name="Enable MFA for all non-service accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/li&gt;&lt;li&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Load balancers are used to efficiently distribute traffic across multiple servers. Both SSL proxy and HTTPS load balancers are external load balancers, meaning they distribute traffic from the Internet to a GCP network. GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible cipher suites. To comply with users using outdated protocols, GCP load balancers can be configured to permit insecure cipher suites. In fact, the GCP default SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites. As a result, it is easy for customers to configure a load balancer without even knowing that they are permitting outdated cipher suites.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Creating more secure SSL policies can prevent clients using older TLS versions from establishing a connection.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console: If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy.&lt;/p&gt;&lt;p&gt;1. Navigate to the SSL Policies page by visiting: https://console.cloud.google.com/net-security/sslpolicies&lt;/p&gt;&lt;p&gt;2. Click on the name of the insecure policy to go to its SSL policy details page.&lt;/p&gt;&lt;p&gt;3. Click EDIT.&lt;/p&gt;&lt;p&gt;4. Set Minimum TLS version to TLS 1.2.&lt;/p&gt;&lt;p&gt;5. Set Profile to Modern or Restricted.&lt;/p&gt;&lt;p&gt;6. Alternatively, if teh user selects the profile Custom, make sure that the following features are disabled:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. For each insecure SSL policy, update it to use secure cyphers:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute ssl-policies update NAME [--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] --min-tls-version 1.2 [--custom-features FEATURES]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. If the target proxy has a GCP default SSL policy, use the following command corresponding to the proxy type to update it.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME --ssl-policy SSL_POLICY_NAME&amp;nbsp;&lt;/p&gt;&lt;p&gt;gcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME --ssl-policy SSL_POLICY_NAME&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.2" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.2" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. See all load balancers by visiting https://console.cloud.google.com/net-services/loadbalancing/loadBalancers/list.&lt;/p&gt;&lt;p&gt;2. For each load balancer for SSL (Proxy) or HTTPS, click on its name to go the Load balancer details page.&lt;/p&gt;&lt;p&gt;3. Ensure that each target proxy entry in the Frontend table has an SSL Policy configured.&lt;/p&gt;&lt;p&gt;4. Click on each SSL policy to go to its SSL policy details page.&lt;/p&gt;&lt;p&gt;5. Ensure that the SSL policy satisfies one of the following conditions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;has a Min TLS set to TLS 1.2 and Profile set to Modern profile, or&lt;/li&gt;&lt;li&gt;has Profile set to Restricted. Note that a Restricted profile effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version, or&lt;/li&gt;&lt;li&gt;has Profile set to Custom and the following features are all disabled:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all TargetHttpsProxies and TargetSslProxies.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-https-proxies list gcloud compute target-ssl-proxies list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. For each target proxy, list its properties:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute target-https-proxies describe TARGET_HTTPS_PROXY_NAME gcloud compute target-ssl-proxies describe TARGET_SSL_PROXY_NAME&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;3. Ensure that the sslPolicy field is present and identifies the name of the SSL policy: sslPolicy: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/sslPolicies/SSL_POLICY_NAME&lt;/p&gt;&lt;p&gt;If the sslPolicy field is missing from the configuration, it means that the GCP default policy is used, which is insecure.&lt;/p&gt;&lt;p&gt;4. Describe the SSL policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute ssl-policies describe SSL_POLICY_NAME&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;5. Ensure that the policy satisfies one of the following conditions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;has Profile set to Modern and minTlsVersion set to TLS_1_2, or&lt;/li&gt;&lt;li&gt;has Profile set to Restricted, or&lt;/li&gt;&lt;li&gt;has Profile set to Custom and enabledFeatures does not contain any of the following values:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_GCM_SHA256&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_GCM_SHA384&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_128_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_AES_256_CBC_SHA&amp;nbsp;&lt;/p&gt;&lt;p&gt;TLS_RSA_WITH_3DES_EDE_CBC_SHA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM16" name="Enable Security Key Enforcement for all admin accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Setup Security Key Enforcement for Google Cloud Platform admin accounts.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Google Cloud Platform users with Organization Administrator roles have the highest level of privilege in the organization. These accounts should be protected with the strongest form of two-factor authentication: Security Key Enforcement. Ensure that admins use Security Keys to log in instead of weaker second factors like SMS or one-time passwords (OTP). Security Keys are actual physical keys used to access Google Organization Administrator Accounts. They send an encrypted signature rather than a code, ensuring that logins cannot be phished.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If an organization administrator loses access to their security key, the user could lose access to their account. For this reason, it is important to set up backup security keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Step 1: Identify users with the Organization Administrator role.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Step 2: Setup Security Key Enforcement for each account. Learn more at: https://cloud.google.com/security-key/&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.3" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Step 1: Identify users with Organization Administrator privileges:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud organizations get-iam-policy ORGANIZATION_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Look for members granted the role "roles/resourcemanager.organizationAdmin".&amp;nbsp;&lt;/p&gt;&lt;p&gt;Step 2: Manually verify that Security Key Enforcement has been enabled for each account.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET08" name="Enable VPC Flow Logs for every subnet in a VPC Network" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;VPC networks and subnetworks not reserved for internal HTTP(S) load balancing provide logically isolated and secure network partitions where GCP resources can be launched. When Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows. Each VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet. If two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows.&lt;/p&gt;&lt;p&gt;Flow Logs supports the following use cases:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Network monitoring&lt;/li&gt;&lt;li&gt;Understanding network usage and optimizing network traffic expenses&lt;/li&gt;&lt;li&gt;Network forensics&lt;/li&gt;&lt;li&gt;Real-time security analysis&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Flow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows.&lt;/p&gt;&lt;p&gt;Note: Subnets reserved for use by internal HTTP(S) load balancers do not support VPC flow logs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference: https://cloud.google.com/vpc/&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list&lt;/p&gt;&lt;p&gt;2. Click the name of a subnet, The Subnet details page displays.&lt;/p&gt;&lt;p&gt;3. Click the EDIT button.&lt;/p&gt;&lt;p&gt;4. Set Flow Logs to On.&lt;/p&gt;&lt;p&gt;5. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;To set Private Google access for a network subnet, run the following command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks subnets update [SUBNET_NAME] --region [REGION] --enable-flow-logs&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.8" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list&lt;/p&gt;&lt;p&gt;2. From the list of network subnets, make sure for each subnet Flow Logs is set to On&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks list --format json | \ jq -r '.[].subnetworks | .[]' | \ xargs -I {} gcloud compute networks subnets describe {} --format json | \ jq -r '. | "Subnet: \(.name) Purpose: \(.purpose) VPC Flow Log Enabled: \(has("enableFlowLogs"))"'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The output of the above command will list each subnet, the subnet's purpose, and a true or false value if Flow Logs are enabled. If the subnet's purpose is PRIVATE then Flow Logs should be true.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-IAM-02" name="Encrypt Dataproc Cluster using Customer-Managed Encryption Key" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Cloud services offer the ability to protect data related to those services using encryption keys managed by the customer within Cloud KMS. These encryption keys are called customer-managed encryption keys (CMEK). When you protect data in Google Cloud services with CMEK, the CMEK key is within your control.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.&lt;/li&gt;&lt;li&gt;Select the project from the projects dropdown list.&lt;/li&gt;&lt;li&gt;On the Dataproc Cluster page, click on the Create Cluster to create a new cluster with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;On Create a cluster page, perform below steps:&lt;ol&gt;&lt;li&gt;Inside Set up cluster section perform below steps: -In the Name textbox, provide a name for your cluster.&lt;ol&gt;&lt;li&gt;From Location select the location in which you want to deploy a cluster.&lt;/li&gt;&lt;li&gt;Configure other configurations as per your requirements.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Inside Configure Nodes and Customize cluster section configure the settings as per your requirements.&lt;/li&gt;&lt;li&gt;Inside Manage security section, perform below steps:&lt;ol&gt;&lt;li&gt;From Encryption, select Customer-managed key.&lt;/li&gt;&lt;li&gt;Select a customer-managed key from dropdown list.&lt;/li&gt;&lt;li&gt;Ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account ("serviceAccount:service-&amp;lt;project_number&amp;gt;@compute-system.iam.gserviceaccount.com").&lt;/li&gt;&lt;li&gt;Click on Create to create a cluster.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Once the cluster is created migrate all your workloads from the older cluster to the new cluster and delete the old cluster by performing the below steps:&lt;ol&gt;&lt;li&gt;On the Clusters page, select the old cluster and click on Delete cluster.&lt;/li&gt;&lt;li&gt;On the Confirm deletion window, click on Confirm to delete the cluster.&lt;/li&gt;&lt;li&gt;Repeat step above for other Dataproc clusters available in the selected project.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Change the project from the project dropdown list and repeat the remediation procedure for other Dataproc clusters available in other projects.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;p&gt;Before creating cluster ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account ("serviceAccount:service-&amp;lt;project_number&amp;gt;@compute-system.iam.gserviceaccount.com"). Run clusters create command to create new cluster with customer-managed key:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters create &amp;lt;cluster_name&amp;gt; --region=us-central1 --gce-pd-kms-key=&amp;lt;key_resource_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The above command will create a new cluster in the selected region. Once the cluster is created migrate all your workloads from the older cluster to the new cluster and Run clusters delete command to delete cluster:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters delete &amp;lt;cluster_name&amp;gt; --region=us-central1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Repeat step no. 1 to create a new Dataproc cluster. Change the project by running the below command and repeat the remediation procedure for other projects:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;project_ID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Encryption at rest in Google Cloud" url="https://cloud.google.com/security/encryption-at-rest/default-encryption"/>
+          </references>
+          <standards>
+            <standard ref="1.17" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.&lt;/li&gt;&lt;li&gt;Select the project from the project dropdown list.&lt;/li&gt;&lt;li&gt;On the Dataproc Clusters page, select the cluster and click on the Name attribute value that you want to examine.&lt;/li&gt;&lt;li&gt;On the details page, select the Configurations tab.&lt;/li&gt;&lt;li&gt;On the Configurations tab, check the Encryption type configuration attribute value. If the value is set to Google-managed key, then Dataproc Cluster is not encrypted with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;Repeat step no. 3 - 5 for other Dataproc Clusters available in the selected project.&lt;/li&gt;&lt;li&gt;Change the project from the project dropdown list and repeat the audit procedure for other projects.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Run clusters list command to list all the Dataproc Clusters available in the region:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters list --region='us-central1'&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Run clusters describe command to get the key details of the selected cluster:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud dataproc clusters describe &amp;lt;cluster_name&amp;gt; --region=us-central1 --flatten=config.encryptionConfig.gcePdKmsKeyName&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;If the above command output return "null", then the selected cluster is not encrypted with Customer managed encryption keys.&lt;/li&gt;&lt;li&gt;Repeat step no. 2 and 3 for other Dataproc Clusters available in the selected region. Change the region by updating --region and repeat step no. 2 for other clusters available in the project. Change the project by running the below command and repeat the audit procedure for other Dataproc clusters available in other projects:&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;project_ID&amp;gt;"&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM11" name="Enforce separation of duties" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;The built-in/predefined IAM role Cloud KMS Admin allows the user/identity to create, delete, and manage service account(s). The built-in/predefined IAM role Cloud KMS CryptoKey Encrypter/Decrypter allows the user/identity (with adequate privileges on concerned resources) to encrypt and decrypt data at rest using an encryption key(s).&lt;/p&gt;&lt;p&gt;The built-in/predefined IAM role Cloud KMS CryptoKey Encrypter allows the user/identity (with adequate privileges on concerned resources) to encrypt data at rest using an encryption key(s). The built-in/predefined IAM role Cloud KMS CryptoKey Decrypter allows the user/identity (with adequate privileges on concerned resources) to decrypt data at rest using an encryption key(s).&lt;/p&gt;&lt;p&gt;Separation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action. In Cloud KMS, this could be an action such as using a key to access and decrypt data a user should not normally have access to. Separation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors. It is considered best practice.&lt;/p&gt;&lt;p&gt;No user(s) should have Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter roles assigned at the same time.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removed roles should be assigned to another user based on business needs.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; Admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. For any member having Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter roles granted/assigned, click the Delete Bin icon to remove the role from the member.&lt;/p&gt;&lt;p&gt;Note: Removing a role should be done based on the business requirement.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="1.8" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; Admin/IAM by visiting: https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Ensure no member has the roles Cloud KMS Admin and any of the Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter assigned.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all users and role assignments:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. Ensure that there are no common users found in the member section for roles cloudkms.admin and any one of Cloud KMS CryptoKey Encrypter/Decrypter, Cloud KMS CryptoKey Encrypter, Cloud KMS CryptoKey Decrypter&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET02" name="Isolate Google Cloud resources into separate VNets by function" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Place the resources into separate VNets according to their use or function (production,
+                        development, test). Placing such resources accordingly ensures that a resource of a high
+                        security level is not exposed by the security settings of a lower labeled VNet.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Identify the resources that exist in an incorrect VNet.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Migrate or move it to the correct VNet.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Isolate resources" url="https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#use_projects_to_fully_isolate_resources"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Google Cloud resources are isolated and separated in several VNets by the
+                            function of the resources.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET01" name="Isolate groups of VM instances" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Use networks within projects to isolate groups of VM instances.
+
+                        Each project supports up to five isolated networks. Each network constitutes a global IP address
+                        space. This means that you can create resources, such as Google Compute Engine Virtual Machine
+                        (VM) instances, in multiple geographic regions, and the resources will share the same IP address
+                        space because they are on the same virtual network. Note that, despite the flat network address
+                        space, you still incur normal egress charges when you leave your zone. You can request a quota
+                        increase to support up to 15 isolated networks in each project.</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Isolate resources" url="https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#use_projects_to_fully_isolate_resources"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the projects are isolated using groups of VM instances.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM01" name="Recertify user access" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Do regular reviews of service accounts on the system and verify they do not contain stolen or
+                        fake accounts. This process ensures there are not any compromised accounts by former employees
+                        or attackers.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least every 90 days complete the following:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Select your project and click Open. All service accounts are listed in the Service
+                        Accounts page.&lt;/li&gt;
+                        &lt;li&gt;For any user that should not exist, select the user and click the Delete button.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: manage service accounts" url="https://cloud.google.com/iam/docs/creating-managing-service-accounts"/>
+          </references>
+          <standards>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Open the Service Accounts page in the Cloud Platform Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click Select a project.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select your project and click Open. All service accounts are listed in the Service
+                            Accounts page.&lt;/li&gt;
+                            &lt;li&gt;Check that the necessary users appear in the list.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;And check that there is a process to review the access users at least every 90
+                            days.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM18" name="Remove Admin privileges on Service Account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Service accounts represent service-level security of the Resources (application or a VM) which can be determined by the roles assigned to it. Enrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM. A ServiceAccount Access holder can perform critical actions like delete, update change settings, etc. without user intervention. For this reason, it's recommended that service accounts not have Admin rights.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Removing *Admin or *adminorEditororOwner` role assignments from service accounts may break functionality that uses impacted service accounts. Required role(s) should be assigned to impacted service accounts in order to restore broken functionalities.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Go to the Members&lt;/p&gt;&lt;p&gt;3. Identify User-Managed user created service account with roles containing *Admin or *admin or role matching Editor or role matching Owner&lt;/p&gt;&lt;p&gt;4. Click the Delete bin icon to remove the role from the member (service account in this case)&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects get-iam-policy PROJECT_ID --format json &amp;gt; iam.json&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;1. Using a text editor, Remove Role which contains roles/*Admin or roles/*admin or matched roles/editor or matches 'roles/owner`. Add a role to the bindings array that defines the group members and the role for those members.&lt;/p&gt;&lt;p&gt;2. Update the project's IAM policy:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud projects set-iam-policy PROJECT_ID iam.json&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.5" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to IAM &amp;amp; admin/IAM using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. Go to the Members&lt;/p&gt;&lt;p&gt;3. Ensure that there are no User-Managed user created service account(s) with roles containing *Admin or *admin or role matching Editor or role matching Owner&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. Get the policy that you want to modify, and write it to a JSON file: gcloud projects get-iam-policy PROJECT_ID --format json &amp;gt; iam.json&lt;/p&gt;&lt;p&gt;2. The contents of the JSON file will look similar to the following. Note that role of members group associated with each serviceaccount does not contain *Admin or *admin or does not match roles/editor or does not match roles/owner.&lt;/p&gt;&lt;p&gt;This recommendation is only applicable to User-Managed user-created service accounts. These accounts have the nomenclature: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com. Note that some Google-managed, Google-created service accounts have the same naming format, and should be excluded (e.g., appsdev-apps-dev-script-auth@system.gserviceaccount.com which needs the Owner role).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET03" name="Remove default and legacy networks" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;order to prevent use of legacy networks, a project should not have a legacy network configured.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. The network is global in scope and spans all cloud regions. Subnetworks cannot be created in a legacy network and are unable to switch from legacy to auto or custom subnet networks. Legacy networks can have an impact for high network traffic projects and are subject to a single point of contention or failure.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;For each Google Cloud Platform project,&lt;/p&gt;&lt;p&gt;1. Follow the documentation and create a non-legacy network suitable for the organization's requirements.&lt;/p&gt;&lt;p&gt;2. Follow the documentation and delete the networks in the legacy mode.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="3.2" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For each Google Cloud Platform project,&lt;/p&gt;&lt;p&gt;1. Set the project name in the Google Cloud Shell:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud config set project &amp;lt;Project-ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. List the networks configured in that project:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute networks list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;None of the listed networks should be in the legacy mode.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.633">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM14" name="Restrict API key usage to call only APIs required by an application" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;API keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys are below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;In light of these potential risks, Google recommends using the standard authentication flow instead of API-Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;In order to reduce attack surfaces by providing least privileges, API-Keys can be restricted to use (call) only APIs required by an application.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Setting API restrictions may break existing application functioning, if not done carefully.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. In the Key restrictions section go to API restrictions.&lt;/p&gt;&lt;p&gt;4. Click the Select API drop-down to choose an API.&lt;/p&gt;&lt;p&gt;5. Click Save.&lt;/p&gt;&lt;p&gt;6. Repeat steps 2,3,4,5 for every unrestricted API key&lt;/p&gt;&lt;p&gt;Note: Do not set API restrictions to Google Cloud APIs, as this option allows access to all services offered by Google cloud.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.14" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. For every API Key, ensure the section Key restrictions parameter API restrictions is not set to None.&lt;/p&gt;&lt;p&gt;Or, Ensure API restrictions is not set to Google Cloud APIs&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note: Google Cloud APIs represents the API collection of all cloud services/APIs offered by Google cloud.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM13" name="Restrict API key usage to trusted hosts and apps" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys appear below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;In light of these potential risks, Google recommends using the standard authentication flow instead of API keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;In order to reduce attack vectors, API-Keys can be restricted only to trusted hosts, HTTP referrers and applications.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Setting Application Restrictions may break existing application functioning, if not done carefully.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. In the Key restrictions section, set the application restrictions to any of HTTP referrers, IP Adresses, Android Apps, iOs Apps.&lt;/p&gt;&lt;p&gt;4. Click Save.&lt;/p&gt;&lt;p&gt;5. Repeat steps 2,3,4 for every unrestricted API key. Note: Do not set HTTP referrers to wild-cards (* or *.[TLD] or .[TLD]/) allowing access to any/wide HTTP referrer(s) Do not set IP addresses and referrer to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.13" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/p&gt;&lt;p&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/p&gt;&lt;p&gt;3. For every API Key, ensure the section Key restrictions parameter Application restrictions is not set to None.&lt;/p&gt;&lt;p&gt;Or,&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure Application restrictions is set to HTTP referrers and the referrer is not set to wild-cards (* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Or,&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure Application restrictions is set to IP addresses and referrer is not set to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET07" name="Restrict RDP access from the Internet" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;/p&gt;&lt;p&gt;Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the Internet to a VPC or VM instance using RDP on Port 3389 can be avoided.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;GCP Firewall Rules within a VPC Network. These rules apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through RDP with the default Port 3389. Generic access from the Internet to a specific IP Range should be restricted.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;All Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where secure shell access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to RDP port for the concerned VPC(s).&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC Network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Click the Firewall Rule to be modified.&lt;/p&gt;&lt;p&gt;4. Click Edit.&lt;/p&gt;&lt;p&gt;5. Modify Source IP ranges to specific IP.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;1.Update RDP Firewall rule with new SOURCE_RANGE from the below command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.7" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Ensure Port is not equal to 3389 and Action is not Allow.&lt;/p&gt;&lt;p&gt;4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;&lt;p&gt;From Command Line: gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed.ports)'&lt;/p&gt;&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;SOURCE_RANGES is 0.0.0.0/0&lt;/li&gt;&lt;li&gt;AND DIRECTION is INGRESS&lt;/li&gt;&lt;li&gt;AND IPProtocol is TCP or ALL&lt;/li&gt;&lt;li&gt;AND PORTS is set to 3389 or range containing 3389 or Null (not set)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;li&gt;When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-NET06" name="Restrict SSH access from the Internet" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;/p&gt;&lt;p&gt;Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the internet to VPC or VM instance using SSH on Port 22 can be avoided.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;GCP Firewall Rules within a VPC Network apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through SSH with the default Port 22. Generic access from the Internet to a specific IP Range needs to be restricted.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;All Secure Shell (SSH) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH port for the concerned VPC(s).&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC Network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Click the Firewall Rule you want to modify.&lt;/p&gt;&lt;p&gt;4. Click Edit.&lt;/p&gt;&lt;p&gt;5. Modify Source IP ranges to specific IP.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line: 1.Update the Firewall rule with the new SOURCE_RANGE from the below command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From the Console:&lt;/p&gt;&lt;p&gt;1. Go to VPC network.&lt;/p&gt;&lt;p&gt;2. Go to the Firewall Rules.&lt;/p&gt;&lt;p&gt;3. Ensure that Port is not equal to 22 and Action is not set to Allow.&lt;/p&gt;&lt;p&gt;4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;&lt;p&gt;From Command Line: gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed)'&lt;/p&gt;&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;SOURCE_RANGES is 0.0.0.0/0&lt;/li&gt;&lt;li&gt;AND DIRECTION is INGRESS&lt;/li&gt;&lt;li&gt;AND IPProtocol is tcp or ALL&lt;/li&gt;&lt;li&gt;AND PORTS is set to 22 or range containing 22 or Null (not set)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;li&gt;When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM10" name="Rotate keys within a period of 90 days" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.&lt;/p&gt;&lt;p&gt;Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.&lt;/p&gt;&lt;p&gt;The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in ISO or RFC3339 format, and the rotation period must be in the form INTEGER[UNIT], where units can be one of seconds (s), minutes (m), hours (h) or days (d).&lt;/p&gt;&lt;p&gt;It is recommended to rotate API keys every 90 days.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Security risks involved in using API-Keys are listed below:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;API keys are simple encrypted strings&lt;/li&gt;&lt;li&gt;API keys do not identify the user or the application making the API request&lt;/li&gt;&lt;li&gt;API keys are typically accessible to clients, making it easy to discover and steal an API key&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Because of these potential risks, Google recommends using the standard authentication flow instead of API Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.&lt;/p&gt;&lt;p&gt;Once a key is stolen, it has no expiration, meaning it may be used indefinitely unless the project owner revokes or regenerates the key. Rotating API keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used.&lt;/p&gt;&lt;p&gt;API keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Regenerating Key may break existing client connectivity as the client will try to connect with older API keys they have stored on devices.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;For user-managed/external keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Delete any external (user-managed) Service Account Key older than 90 days:&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. In the Section Service Account Keys, for every external (user-managed) service account key where creation date is greater than or equal to the past 90 days, click Delete Bin Icon to Delete Service Account key&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Create a new external (user-managed) Service Account Key for a Service Account:&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. Click Create Credentials and Select Service Account Key.&lt;/li&gt;&lt;li&gt;3. Choose the service account in the drop-down list for which an External (user-managed) Service Account key needs to be created.&lt;/li&gt;&lt;li&gt;4. Select the desired key type format among JSON or P12.&lt;/li&gt;&lt;li&gt;5. Click Create. It will download the private key. Keep it safe.&lt;/li&gt;&lt;li&gt;6. Click Close if prompted.&lt;/li&gt;&lt;li&gt;7. The site will redirect to the APIs &amp;amp; Services\Credentials page. Make a note of the new ID displayed in the Service account keys section.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For KMS keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;1. Go to Cryptographic Keys by visiting: https://console.cloud.google.com/security/kms.&lt;/li&gt;&lt;li&gt;2. Click on the specific key ring&lt;/li&gt;&lt;li&gt;3. From the list of keys, choose the specific key and Click on Right side pop up the blade (3 dots).&lt;/li&gt;&lt;li&gt;4. Click on Edit rotation period.&lt;/li&gt;&lt;li&gt;5. On the pop-up window, Select a new rotation period in days which should be less than 90 and then choose Starting on date (date from which the rotation period begins).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API keys:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;1. Go to APIs &amp;amp; Services\Credentials using https://console.cloud.google.com/apis/credentials&lt;/li&gt;&lt;li&gt;2. In the section API Keys, Click the API Key Name. The API Key properties display on a new page.&lt;/li&gt;&lt;li&gt;3. Click REGENERATE KEY to rotate API key.&lt;/li&gt;&lt;li&gt;4. Click Save.&lt;/li&gt;&lt;li&gt;5. Repeat steps 2,3,4 for every API key that has not been rotated in the last 90 days.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Note: Do not set HTTP referrers to wild-cards (* or *.[TLD] or .[TLD]/) allowing access to any/wide HTTP referrer(s) Do not set IP addresses and referrer to any host (0.0.0.0 or 0.0.0.0/0 or ::0)&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;For KMS keys:&lt;/p&gt;&lt;p&gt;1. Update and schedule rotation by ROTATION_PERIOD and NEXT_ROTATION_TIME for each key: gcloud kms keys update new --keyring=KEY_RING --location=LOCATION --next-rotation-time=NEXT_ROTATION_TIME --rotation-period=ROTATION_PERIOD&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.10" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="1.15" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.15" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="1.7" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.7" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that all keys have a rotation period of 90 days.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-LOG07" name="Use Bucket Lock to configure retention policies" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Logs can be exported by creating one or more sinks that include a log filter and a destination. As Cloud Logging receives new log entries, they are compared against each sink. If a log entry matches a sink's filter, then a copy of the log entry is written to the destination.&lt;/p&gt; 
+&lt;p&gt;Sinks can be configured to export logs in storage buckets. It is recommended to configure a data retention policy for these cloud storage buckets and to lock the data retention policy; thus permanently preventing the policy from being reduced or removed. This way, if the system is ever compromised by an attacker or a malicious insider who wants to cover their tracks, the activity logs are definitely preserved for forensics and security investigations.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Set a retention policy on a bucket&lt;/p&gt; 
+&lt;p&gt;To add, modify, or remove a retention policy on a bucket:&lt;/p&gt; 
+&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt; 
+&lt;p&gt;2. In the list of buckets, click on the name of the bucket whose retention policy you want to change.&lt;/p&gt; 
+&lt;p&gt;3. Select the Protection tab near the top of the page.&lt;/p&gt; 
+&lt;p&gt;4. In the Retention policy section, set your retention policy:&lt;/p&gt; 
+&lt;p&gt;a. If no retention policy currently applies to the bucket, click the + Set Retention Policy link. Choose a unit of time and a length of time for your retention period.&lt;/p&gt; 
+&lt;p&gt;b. If a retention policy currently applies to a bucket, it appears in the section. Click Edit to modify the retention time or Delete to remove the retention policy entirely.&lt;/p&gt; 
+&lt;p&gt;Lock a bucket&lt;/p&gt; 
+&lt;p&gt;To lock a bucket and permanently restrict edits to the bucket's retention policy:&lt;/p&gt; 
+&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt; 
+&lt;p&gt;2. In the list of buckets, click on the name of the bucket that you want to lock the retention policy for.&lt;/p&gt; 
+&lt;p&gt;3. Select the Protection tab near the top of the page.&lt;/p&gt; 
+&lt;p&gt;4. In the Retention policy section, click the Lock button.&lt;/p&gt; 
+&lt;p&gt;The Lock retention policy? dialog box appears.&lt;/p&gt; 
+&lt;p&gt;5. Read the Permanent notice.&lt;/p&gt; 
+&lt;p&gt;6. In the Bucket name text box, type in the name of your bucket.&lt;/p&gt; 
+&lt;p&gt;7. Click Lock policy.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Locking a bucket is an irreversible action. Once you lock a bucket, you cannot remove the retention policy from the bucket or decrease the retention period for the policy.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+            <reference name="Retention policies and retention policy locks" url="https://cloud.google.com/storage/docs/bucket-lock"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="2.3" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;View a bucket's retention policy and lock status&lt;/p&gt;
+
+	&lt;p&gt;To view what, if any, retention policy is set on a bucket and whether that retention policy is locked:&lt;/p&gt;
+
+	&lt;p&gt;1. In the Google Cloud console, go to the Cloud Storage Browser page.&lt;/p&gt;
+
+	&lt;p&gt;2. In the Column display options menu (Column options icon.), make sure Retention policy is checked.&lt;/p&gt;
+
+	&lt;p&gt;3. In the list of buckets, if a bucket has a retention policy, the retention period is displayed in the Protection column for the bucket. If the retention policy is locked, an image of a lock appears directly to the left of the retention period.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:42.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM17" name="Use GCP-managed service account keys only for each service account" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;User managed service accounts should not have user-managed keys.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Anyone who has access to the keys will be able to access resources through the service account. GCP-managed keys are used by Cloud Platform services such as App Engine and Compute Engine. These keys cannot be downloaded. Google will keep the keys and automatically rotate them on an approximately weekly basis. User-managed keys are created, downloadable, and managed by users. They expire 10 years from creation.&lt;/p&gt;&lt;p&gt;For user-managed keys, the user has to take ownership of key management activities which include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Key storage&lt;/li&gt;&lt;li&gt;Key distribution&lt;/li&gt;&lt;li&gt;Key revocation&lt;/li&gt;&lt;li&gt;Key rotation&lt;/li&gt;&lt;li&gt;Protecting the keys from unauthorized users&lt;/li&gt;&lt;li&gt;Key recovery&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Even with key owner precautions, keys can be easily leaked by common development malpractices like checking keys into the source code or leaving them in the Downloads directory, or accidentally leaving them on support blogs/channels.&lt;/p&gt;&lt;p&gt;It is recommended to prevent user-managed service account keys.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Deleting user-managed Service Account Keys may break communication with the applications using the corresponding keys.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. In the left navigation pane, click Service accounts. All service accounts and their corresponding keys are listed.&lt;/p&gt;&lt;p&gt;3. Click the service account.&lt;/p&gt;&lt;p&gt;4. Click the edit and delete the keys.&lt;/p&gt;&lt;p&gt;From CLI: To delete a user managed Service Account Key,&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts keys delete --iam-account=&amp;lt;user-managed-service-account-EMAIL&amp;gt; &amp;lt;KEY-ID&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.4" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to the IAM page in the GCP Console using https://console.cloud.google.com/iam-admin/iam&lt;/p&gt;&lt;p&gt;2. In the left navigation pane, click Service accounts. All service accounts and their corresponding keys are listed.&lt;/p&gt;&lt;p&gt;3. Click the service accounts and check if keys exist.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;List All the service accounts:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts list&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Identify user-managed service accounts as such account EMAIL ends with iam.gserviceaccount.com&amp;nbsp;&lt;/p&gt;&lt;p&gt;For each user-managed service account, list the keys managed by the user:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud iam service-accounts keys list --iam-account=&amp;lt;Service Account&amp;gt; --managed-by=user&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;No keys should be listed.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GCP-IAM-03" name="Use secret manager to avoid storing secrets in cloud functions environment variables" issueId="" issueLink="" platform="" cost="0" risk="53" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Rationale&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;It is recommended to use the Secret Manager, because environment variables are stored unencrypted, and accessible for all users who have access to the code.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Impact&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;There should be no impact on the Cloud Function. There are minor costs after 10,000 requests a month to the Secret Manager API as well for a high use of other functions. Modifying the Cloud Function to use the Secret Manager may prevent it running to completion as its environment variables are.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Enable Secret Manager API for your Project&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project you wish to enable, select the Navigation hamburger menu in the top left. Hover over 'APIs &amp;amp; Services' to under the heading 'Serverless', then select 'Enabled APIs &amp;amp; Services' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the button '+ Enable APIS and Services'&lt;/li&gt;&lt;li&gt;In the Search bar, search for 'Secret Manager API' and select it.&lt;/li&gt;&lt;li&gt;Click the blue box that says 'Enable'.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Within the project you wish to enable the API in, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services enable Secret Manager API&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Reviewing Environment Variables That Should Be Migrated to Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)&lt;/li&gt;&lt;li&gt;Go to Cloud Functions&lt;/li&gt;&lt;li&gt;Click on a function name from the list&lt;/li&gt;&lt;li&gt;Click on Edit and review the Runtime environment for variables that should be secrets. Leave this list open for the next step.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;To view a list of your cloud functions run cloud functions list&lt;/li&gt;&lt;li&gt;For each cloud function run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions describe &amp;lt;function_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Review the settings of the buildEnvironmentVariables and environmentVariables. Keep this information for the next step.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Migrating Environment Variables to Secrets within the Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Go to the Secret Manager page in the Cloud Console.&lt;/li&gt;&lt;li&gt;On the Secret Manager page, click Create Secret.&lt;/li&gt;&lt;li&gt;On the Create secret page, under Name, enter the name of the Environment Variable you are replacing. This will then be the Secret Variable you will reference in your code.&lt;/li&gt;&lt;li&gt;You will also need to add a version. This is the actual value of the variable that will be referenced from the code. To add a secret version when creating the initial secret, in the Secret value field, enter the value from the Environment Variable you are replacing.&lt;/li&gt;&lt;li&gt;Leave the Regions section unchanged.&lt;/li&gt;&lt;li&gt;Click the Create secret button.&lt;/li&gt;&lt;li&gt;Repeat for all Environment Variables&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Run the following command with the Environment Variable name you are replacing in the &amp;lt;secret-id&amp;gt;. It is most secure to point this command to a file with the Environment Variable value located in it, as if you entered it via command line it would show up in your shell's command history.&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud secrets create &amp;lt;secret-id&amp;gt; --data-file="/path/to/file.txt"&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;Granting your Runtime's Service Account Access to Secrets&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project containing your runtime login with account that has the 'roles/secretmanager.secretAccessor' permission.&lt;/li&gt;&lt;li&gt;Select the Navigation hamburger menu in the top left. Hover over 'Security' to under the then select 'Secret Manager' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the name of a secret listed in this screen.&lt;/li&gt;&lt;li&gt;If it is not already open, click Show Info Panel in this screen to open the panel. 5.In the info panel, click Add principal. 6.In the New principals field, enter the service account your function uses for its identity. (If you need help locating or updating your runtime's service account, please see the 'docs/securing/function-identity#runtime_service_account' reference.)&lt;/li&gt;&lt;li&gt;In the Select a role dropdown, choose Secret Manager and then Secret Manager Secret Accessor.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&amp;nbsp;&lt;/p&gt;&lt;p&gt;As of the time of writing, using Google CLI to list Runtime variables is only in beta. Because this is likely to change we are not including it here.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Modifying the Code to use the Secrets in Secret Manager&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;p&gt;This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the '/docs/creating-and-accessing-secrets#access' reference for language specific instructions.&amp;nbsp;&lt;/p&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;p&gt;This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the' /docs/creating-and-accessing-secrets#access' reference for language specific instructions.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Deleting the Insecure Environment Variables&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Be certain to do this step last. Removing variables from code actively referencing them will prevent it from completing successfully.&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Select the Navigation hamburger menu in the top left. Hover over 'Security' then select 'Secret Manager' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the name of a function. Click Edit.&lt;/li&gt;&lt;li&gt;Click Runtime, build and connections settings to expand the advanced configuration options.&lt;/li&gt;&lt;li&gt;Click 'Security'. Hover over the secret you want to remove, then click 'Delete'.&lt;/li&gt;&lt;li&gt;Click Next. Click Deploy. The latest version of the runtime will now reference the secrets in Secret Manager.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions deploy &amp;lt;Function name&amp;gt;--remove-env-vars &amp;lt;env vars&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If you need to find the env vars to remove, they are from the step where 'gcloud functions describe &amp;lt;function_name&amp;gt;' was run.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Default Value:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;By default Secret Manager is not enabled.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Managing secrets" url="https://cloud.google.com/functions/docs/configuring/env-var#managing_secrets"/>
+            <reference name="Google Cloud docs: Secret Manager Overview" url="https://cloud.google.com/secret-manager/docs/overview"/>
+          </references>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="1.18" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Determine if Confidential Information is Stored in your Functions in Cleartext&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)&lt;/li&gt;&lt;li&gt;Within the project you wish to audit, select the Navigation hamburger menu in the top left. Scroll down to under the heading 'Serverless', then select 'Cloud Functions'&lt;/li&gt;&lt;li&gt;Click on a function name from the list&lt;/li&gt;&lt;li&gt;Open the Variables tab and you will see both buildEnvironmentVariables and environmentVariables&lt;/li&gt;&lt;li&gt;Review the variables whether they are secrets&lt;/li&gt;&lt;li&gt;Repeat step 3-5 until all functions are reviewed&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;To view a list of your cloud functions run&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions list&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;For each cloud function in the list run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud functions describe &amp;lt;function_name&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Review the settings of the buildEnvironmentVariables and environmentVariables. Determine if this is data that should not be publicly accessible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Determine if Secret Manager API is 'Enabled' for your Project&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;From Console&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Within the project you wish to audit, select the Navigation hamburger menu in the top left. Hover over 'APIs &amp;amp; Services' to under the heading 'Serverless', then select 'Enabled APIs &amp;amp; Services' in the menu that opens up.&lt;/li&gt;&lt;li&gt;Click the button '+ Enable APIS and Services'&lt;/li&gt;&lt;li&gt;In the Search bar, search for 'Secret Manager API' and select it.&lt;/li&gt;&lt;li&gt;If it is enabled, the blue box that normally says 'Enable' will instead say 'Manage'.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;From Command Line&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Within the project you wish to audit, run the following command.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;gcloud services list&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;If 'Secret Manager API' is in the list, it is enabled.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-IAM06" name="Use Security Key for 2-Step Verification for administrator or co-administrator accounts" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the users with administrator and co-administrator accounts activate and configure the second factor authentication provided by Google. With 2-Step Verification, you can log into Google with a security key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To activate and configure 2 Factor Authentication, you shall follow the following steps: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Go to the 2-Step Verification page section of &lt;a href="https://myaccount.google.com/signinoptions/two-step-verification"&gt;My Account&lt;/a&gt;.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click Add security key.&lt;/li&gt; 
+  &lt;li&gt;Follow the on-screen instructions.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud: mobile account" url="https://support.google.com/accounts/answer/6103523?co=GENIE.Platform%3DAndroid#phone"/>
+            <reference name="Google support: answers" url="https://support.google.com/accounts/answer/6103534"/>
+          </references>
+          <standards>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Go to the 2-Step Verification page section of My Account.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that 2-Step Verification authentication is enabled and configured correctly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-12-12T15:24:41.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACTIVITY LOGS ALERTS" name="Activity Logs alerts" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-SYSTEMS" name="Attackers access the systems without being detected" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected and consequently, changes made by attackers can not be audited or detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="25" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON02A" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON03">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON05" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON04">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON06" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON05">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON07" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON06">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON08" mitigation="17"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-RESOURCES-STATUS">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON01" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-MON01" mitigation="17"/>
+                <countermeasure ref="GOOGLE-MON02A" mitigation="17"/>
+                <countermeasure ref="GOOGLE-MON05" mitigation="17"/>
+                <countermeasure ref="GOOGLE-MON06" mitigation="16"/>
+                <countermeasure ref="GOOGLE-MON07" mitigation="16"/>
+                <countermeasure ref="GOOGLE-MON08" mitigation="17"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>Attackers could gain undetected access to the security system configurations and
+                                changes made by attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-MON01">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON03" mitigation="34"/>
+                    <countermeasure ref="GOOGLE-MON04" mitigation="33"/>
+                    <countermeasure ref="GOOGLE-MON13" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-MON03" mitigation="34"/>
+                <countermeasure ref="GOOGLE-MON04" mitigation="33"/>
+                <countermeasure ref="GOOGLE-MON13" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-MON07">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-MON09" mitigation="34"/>
+                    <countermeasure ref="GOOGLE-MON10" mitigation="33"/>
+                    <countermeasure ref="GOOGLE-MON11" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-MON09" mitigation="34"/>
+                <countermeasure ref="GOOGLE-MON10" mitigation="33"/>
+                <countermeasure ref="GOOGLE-MON11" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="GOOGLE-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the administrator account due to lack of configuration of the account and its security mechanisms, such as modifying credentials and adding/removing user accounts.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-IAM-01">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-IAM06" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON01">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-IAM09" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM10" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM11" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM12" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM13" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM14" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM15" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM16" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM17" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM18" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM19" mitigation="6"/>
+                    <countermeasure ref="GOOGLE-IAM20" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-MON02">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-IAM05" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="LOST-SECURITY-ALERTS">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-GOV01" mitigation="6"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-GOV01" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM05" mitigation="16"/>
+                <countermeasure ref="GOOGLE-IAM06" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM09" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM10" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM11" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM12" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM13" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM14" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM15" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM16" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM17" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM18" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM19" mitigation="6"/>
+                <countermeasure ref="GOOGLE-IAM20" mitigation="6"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="GOOGLE-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to lack of configuration of the account, for example, the security question to reset the password is configured incorrectly.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-IAM03">
+                  <countermeasures>
+                    <countermeasure ref="C-GCP-IAM-01" mitigation="25"/>
+                    <countermeasure ref="C-GCP-IAM-02" mitigation="25"/>
+                    <countermeasure ref="C-GCP-IAM-03" mitigation="25"/>
+                    <countermeasure ref="GOOGLE-IAM01" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GCP-IAM-01" mitigation="25"/>
+                <countermeasure ref="C-GCP-IAM-02" mitigation="25"/>
+                <countermeasure ref="C-GCP-IAM-03" mitigation="25"/>
+                <countermeasure ref="GOOGLE-IAM01" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-EXPIRATION-DATE">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-IAM08" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE_IAM-02">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-IAM02" mitigation="20"/>
+                    <countermeasure ref="GOOGLE-IAM03" mitigation="20"/>
+                    <countermeasure ref="GOOGLE-IAM04" mitigation="20"/>
+                    <countermeasure ref="GOOGLE-IAM07" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-IAM02" mitigation="20"/>
+                <countermeasure ref="GOOGLE-IAM03" mitigation="20"/>
+                <countermeasure ref="GOOGLE-IAM04" mitigation="20"/>
+                <countermeasure ref="GOOGLE-IAM07" mitigation="20"/>
+                <countermeasure ref="GOOGLE-IAM08" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-GCP-LOG-01" mitigation="12"/>
+                    <countermeasure ref="C-GCP-LOG-02" mitigation="12"/>
+                    <countermeasure ref="C-GCP-LOG-03" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-LOG01" mitigation="16"/>
+                    <countermeasure ref="GOOGLE-LOG04" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-LOG05" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-LOGS03">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-LOG06" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-LOG07" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GCP-LOG-01" mitigation="12"/>
+                <countermeasure ref="C-GCP-LOG-02" mitigation="12"/>
+                <countermeasure ref="C-GCP-LOG-03" mitigation="12"/>
+                <countermeasure ref="GOOGLE-LOG01" mitigation="16"/>
+                <countermeasure ref="GOOGLE-LOG04" mitigation="12"/>
+                <countermeasure ref="GOOGLE-LOG05" mitigation="12"/>
+                <countermeasure ref="GOOGLE-LOG06" mitigation="12"/>
+                <countermeasure ref="GOOGLE-LOG07" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="" library="Google Cloud Platform" editable="true">
+              <desc>Attackers could gain unauthorized connection to the resources through misconfigured
+                                ports or security network configurations.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-NET01" mitigation="16"/>
+                    <countermeasure ref="GOOGLE-NET02" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET03" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET04" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET05" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET06" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET07" mitigation="12"/>
+                    <countermeasure ref="GOOGLE-NET08" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-NET01" mitigation="16"/>
+                <countermeasure ref="GOOGLE-NET02" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET03" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET04" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET05" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET06" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET07" mitigation="12"/>
+                <countermeasure ref="GOOGLE-NET08" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="eb630716-ac69-4883-8499-00b7e6a60b72" diagramComponentId="9a6e4aab-522c-49a2-99a8-a04541fb7a8b" ref="3fa5c6ab-2549-49a1-94d9-a69704190e83" name="Region 2" desc="" library="" parentComponentRef="225ed77d-0324-4a33-9df7-aa4ba51a588b" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="a311c67f-8b37-4021-9c21-343c7a31b28a" diagramComponentId="3842a1dd-7a2d-4a5e-af6f-0422d6fd2466" ref="61951b97-69d9-449a-9702-b4679bd8b8f4" name="Region 1" desc="" library="" parentComponentRef="225ed77d-0324-4a33-9df7-aa4ba51a588b" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="67d1022a-f78c-4d25-bbec-8ef2a6244ebd" diagramComponentId="c2f5d00f-37bb-4dda-8096-fb857123f08a" ref="252ff667-19d7-429b-a99b-3fe3c51db42e" name="Zone 1 - b" desc="" library="" parentComponentRef="61951b97-69d9-449a-9702-b4679bd8b8f4" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="ebff2d9d-f5d3-495f-abd2-476c5e2c31a1" diagramComponentId="d56dba3e-3e6c-49c6-ae5c-9276a9630a88" ref="46934b86-3288-4cc2-8094-1cdd1e438674" name="Zone 2 - a" desc="" library="" parentComponentRef="3fa5c6ab-2549-49a1-94d9-a69704190e83" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="dc110ce8-c840-4737-971c-d790c4a1cd3f" diagramComponentId="81345a9c-ccdb-41da-99e4-3542d1408e1b" ref="97f7f8b8-feb1-43b5-9c3f-36dfa1f62ef5" name="Zone 1 - a" desc="" library="" parentComponentRef="61951b97-69d9-449a-9702-b4679bd8b8f4" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/generic-web-service.xml b/Templates/Submitted_Templates/generic-web-service.xml
new file mode 100644
index 0000000..65fc499
--- /dev/null
+++ b/Templates/Submitted_Templates/generic-web-service.xml
@@ -0,0 +1,14942 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="testing-template-121" name="Generic Web Service" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBncmlkPSIwIiBwYWdlPSIwIiBpckRyYXdpb1ZlcnNpb249Im51bGwiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDktOSIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMjQ2IiB5PSItNCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIzNTEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWEzYzY3MzFjLTM1M2MtNGI1My04MWQxLWIzNThiZWU2MWFkYy0zIiB2YWx1ZT0iV2ViIENsaWVudCIgc3R5bGU9ImlyLnJlZj1hM2M2NzMxYy0zNTNjLTRiNTMtODFkMS1iMzU4YmVlNjFhZGM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSIyMDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3LTI1IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQiIHN0eWxlPSJpci5yZWY9ZGUxZGQxNWQtNTI0Mi00ZDBlLTkxM2MtMDlkMmQzODFkZmI3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vYmlsZS1kZXZpY2UtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR6TlRBMk1qY2dNQzR4TWprMk16bERNQzR5T1RnME1qTWdNQzR4TWprMk16a2dNQzR5TlRZeE1EUWdNQzR4TnpFNU5UZ2dNQzR5TlRZeE1EUWdNQzR5TWpReE5qRldNQzQzT1RFeU9UZERNQzR5TlRZeE1EUWdNQzQ0TkRNMU1ERWdNQzR5T1RnME1qTWdNQzQ0T0RVNE1pQXdMak0xTURZeU55QXdMamc0TlRneVNEQXVOak0wTVRrMlF6QXVOamcyTXprNUlEQXVPRGcxT0RJZ01DNDNNamczTVRrZ01DNDRORE0xTURFZ01DNDNNamczTVRrZ01DNDNPVEV5T1RkV01DNHlNalF4TmpGRE1DNDNNamczTVRrZ01DNHhOekU1TlRnZ01DNDJPRFl6T1RrZ01DNHhNamsyTXprZ01DNDJNelF4T1RZZ01DNHhNamsyTXpsSU1DNHpOVEEyTWpkYVRUQXVNekkyT1RrMklEQXVNakV5TXpRMlF6QXVNekkyT1RrMklEQXVNVGs1TWprMUlEQXVNek0zTlRjMklEQXVNVGc0TnpFMUlEQXVNelV3TmpJM0lEQXVNVGc0TnpFMVNEQXVOak0wTVRrMlF6QXVOalEzTWpRM0lEQXVNVGc0TnpFMUlEQXVOalUzT0RJM0lEQXVNVGs1TWprMUlEQXVOalUzT0RJM0lEQXVNakV5TXpRMlZqQXVOek15TWpJeFF6QXVOalUzT0RJM0lEQXVOelExTWpjeElEQXVOalEzTWpRM0lEQXVOelUxT0RVeElEQXVOak0wTVRrMklEQXVOelUxT0RVeFNEQXVNelV3TmpJM1F6QXVNek0zTlRjMklEQXVOelUxT0RVeElEQXVNekkyT1RrMklEQXVOelExTWpjeElEQXVNekkyT1RrMklEQXVOek15TWpJeFZqQXVNakV5TXpRMldrMHdMalEyTkRnME1pQXdMamcxTURNM05FTXdMalEwT1RZeE5pQXdMamcxTURNM05DQXdMalF6TnpJM015QXdMamd6T0RBeklEQXVORE0zTWpjeklEQXVPREl5T0RBMFF6QXVORE0zTWpjeklEQXVPREEzTlRjNElEQXVORFE1TmpFMklEQXVOemsxTWpNMUlEQXVORFkwT0RReUlEQXVOemsxTWpNMVNEQXVOVEU1T1RoRE1DNDFNelV5TURZZ01DNDNPVFV5TXpVZ01DNDFORGMxTlNBd0xqZ3dOelUzT0NBd0xqVTBOelUxSURBdU9ESXlPREEwUXpBdU5UUTNOVFVnTUM0NE16Z3dNeUF3TGpVek5USXdOaUF3TGpnMU1ETTNOQ0F3TGpVeE9UazRJREF1T0RVd016YzBTREF1TkRZME9EUXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EQXdNalEwTVRReElEQXVNREUxTXpnd09Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDktOSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NiIgeT0iNDciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3NSIgeT0iLTM1IiB3aWR0aD0iNzk1IiBoZWlnaHQ9IjQyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYWZkMmNiMjMtZWQ3Mi00ODhkLWFkOTktY2ZmZDEzOGY1ZDU4LTI5IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSAtPiBXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj1mN2M4YmVjZi02NzJiLTRiNDktYmQ4Ni01ZTE1ZTJmOWVlZmY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2LTciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTRhMGNjZmM1LTY4NDItNGI1MC1iZDg4LWY1MjFhZWYxNjZhNC0yOCIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIC0+IFdlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWQ3OTlkNDI5LTkyOTMtNGJmNS1hNjdmLWRjZjRiNDYxOTc0YTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQyNjA0ODZmLTUyYjMtNDk0Ni1iYWUxLWI5NjdiZWE5MzZjMy02IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWItMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj0yNjg4YzhmYi0zNjQ1LTQ2ZDMtODBkMy05NTNlYjdkZmQyZmE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhLTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzMtMjIiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhIHN0b3JlIiBzdHlsZT0iaXIucmVmPWExMWY2MTQzLTNmNzMtNGM4OS1hMTI0LWY1ZDkwMjE1ODRjNztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWMtMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS02ZDQ4NmYyMi05ZDU1LTQ0NzktODIzZS00Nzg1ZDMzN2RiY2ItMjQiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBNaWNyb3NvZnQgQXp1cmUgU2VydmljZSBCdXMgTWVzc2FnaW5nIiBzdHlsZT0iaXIucmVmPWUwODRiNjBiLTBjYzEtNDk2OC1hZjJlLWMzMGEzMWY5ODdhODtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTEtMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQzMTg5MTg3LWQyZWUtNGI1Yy04M2EyLWZiMDI4N2Y4YjczYS00IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTExZTQ4OGItNjY0My00ZmE2LTlhNWUtNzk5OGNmMmM2YjFjLTExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hNGIwMGFmZi03MjU1LTRkYmYtYTM3ZS0yM2QyZTNkMjBmNzctMTYiIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0+IFJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9MzUyMmFiNDAtZjAzYy00ZjFhLWI4NGEtMjgwMTY1NzUwMDc0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMS0yNyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjA4IiB5PSIxMjAuNzQxOTM1NDgzODcwOTgiIGFzPSJzb3VyY2VQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kNjNiODhhYy02MjUxLTQ4MTYtOWU3Ni0yYWNmZGU0YmFjZDItMTciIHZhbHVlPSJMb2FkIEJhbGFuY2VyIC0+IFdlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIiBzdHlsZT0iaXIucmVmPWMwMDdlODhkLWU4MWYtNDRkZi1iMTFkLThlNDBmMTE3YjUxZDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS03ZWYwM2M0MC1lMDI1LTQ0NWMtOWVmNi0zYWM5MTBhYWM4MjEtMjciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzLTYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjIwOCIgeT0iMTcwLjMyMjU4MDY0NTE2MTIyIiBhcz0ic291cmNlUG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExLTIzIiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFNlcnZpY2UgQnVzIE1lc3NhZ2luZyIgc3R5bGU9ImlyLnJlZj1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVNFUi1CVVMtTVNHO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM01EbGZNalV5TlRNcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTVNems1TmlBd0xqSXdOemMyTkVnd0xqSTBNemM0TTFZd0xqTTBOVFUwTmtNd0xqSTBNemM0TXlBd0xqTTBPRFV4TkNBd0xqSTBNall3TXlBd0xqTTFNVE0yTVNBd0xqSTBNRFV3TkNBd0xqTTFNelEyUXpBdU1qTTROREExSURBdU16VTFOVFU1SURBdU1qTTFOVFU1SURBdU16VTJOek00SURBdU1qTXlOVGtnTUM0ek5UWTNNemhJTUM0eE9ETXhPRGxETUM0eE9EQXlNakVnTUM0ek5UWTNNemdnTUM0eE56Y3pOelFnTUM0ek5UVTFOVGtnTUM0eE56VXlOelVnTUM0ek5UTTBOa013TGpFM016RTNOaUF3TGpNMU1UTTJNU0F3TGpFM01UazVOeUF3TGpNME9EVXhOQ0F3TGpFM01UazVOeUF3TGpNME5UVTBObFl3TGpJeU9UYzJNa013TGpFM01UazVOeUF3TGpJeU16a3lPQ0F3TGpFM05ETXhOU0F3TGpJeE9ETXpNeUF3TGpFM09EUTBJREF1TWpFME1qQTNRekF1TVRneU5UWTJJREF1TWpFd01EZ3hJREF1TVRnNE1UWXhJREF1TWpBM056WTBJREF1TVRrek9UazJJREF1TWpBM056WTBWakF1TWpBM056WTBXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0MUlpQmtQU0pOTUM0eE9UTTVPVFlnTUM0eU1EYzNOalJJTUM0eU5ETTNPRE5XTUM0ek5EVTFORFpETUM0eU5ETTNPRE1nTUM0ek5EZzFNVFFnTUM0eU5ESTJNRE1nTUM0ek5URXpOakVnTUM0eU5EQTFNRFFnTUM0ek5UTTBOa013TGpJek9EUXdOU0F3TGpNMU5UVTFPU0F3TGpJek5UVTFPU0F3TGpNMU5qY3pPQ0F3TGpJek1qVTVJREF1TXpVMk56TTRTREF1TVRnek1UZzVRekF1TVRnd01qSXhJREF1TXpVMk56TTRJREF1TVRjM016YzBJREF1TXpVMU5UVTVJREF1TVRjMU1qYzFJREF1TXpVek5EWkRNQzR4TnpNeE56WWdNQzR6TlRFek5qRWdNQzR4TnpFNU9UY2dNQzR6TkRnMU1UUWdNQzR4TnpFNU9UY2dNQzR6TkRVMU5EWldNQzR5TWprM05qSkRNQzR4TnpFNU9UY2dNQzR5TWpNNU1qZ2dNQzR4TnpRek1UVWdNQzR5TVRnek16TWdNQzR4TnpnME5DQXdMakl4TkRJd04wTXdMakU0TWpVMk5pQXdMakl4TURBNE1TQXdMakU0T0RFMk1TQXdMakl3TnpjMk5DQXdMakU1TXprNU5pQXdMakl3TnpjMk5GWXdMakl3TnpjMk5Gb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVWlJR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpneE1qVWdNQzR5TWprM05qSldNQzR5Tnpnd01EVk1NQzR4TnpJd01qUWdNQzR5Tnpnd01EVldNQzR5TWprM05qSkRNQzR4TnpJd01qUWdNQzR5TWpNNU1qZ2dNQzR4TnpRek5ESWdNQzR5TVRnek16SWdNQzR4TnpnME5qY2dNQzR5TVRReU1EZERNQzR4T0RJMU9UTWdNQzR5TVRBd09ERWdNQzR4T0RneE9EZ2dNQzR5TURjM05qUWdNQzR4T1RRd01qTWdNQzR5TURjM05qUk1NQzQ0TURZMU1USWdNQzR5TURjM05qUkRNQzQ0TVRJeU9DQXdMakl3TnpnMk5TQXdMamd4TnpjM05pQXdMakl4TURJeU55QXdMamd5TVRneE9TQXdMakl4TkRNME1rTXdMamd5TlRnMk1TQXdMakl4T0RRMU5pQXdMamd5T0RFeU5pQXdMakl5TXprNU5DQXdMamd5T0RFeU5TQXdMakl5T1RjMk1sWXdMakl5T1RjMk1sb2lJR1pwYkd3OUlpTTVORGswT1RRaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTRNekkxSURBdU5qUXhPRFEyU0RBdU1qTXpNRE0yUXpBdU1qTTJNREExSURBdU5qUXhPRFEySURBdU1qTTRPRFV4SURBdU5qUXpNREkxSURBdU1qUXdPVFVnTUM0Mk5EVXhNalJETUM0eU5ETXdORGtnTUM0Mk5EY3lNak1nTUM0eU5EUXlNamtnTUM0Mk5UQXdOeUF3TGpJME5ESXlPU0F3TGpZMU16QXpPRll3TGpjNU1UazNOMGd3TGpFNU5EQTFOa013TGpFNU1URTJOeUF3TGpjNU1UazNOeUF3TGpFNE9ETXdOaUF3TGpjNU1UUXdPQ0F3TGpFNE5UWXpOeUF3TGpjNU1ETXdNa013TGpFNE1qazJPQ0F3TGpjNE9URTVOeUF3TGpFNE1EVTBNeUF3TGpjNE56VTNOaUF3TGpFM09EVWdNQzQzT0RVMU16UkRNQzR4TnpRek56VWdNQzQzT0RFME1EZ2dNQzR4TnpJd05UY2dNQzQzTnpVNE1UTWdNQzR4TnpJd05UY2dNQzQzTmprNU56aFdNQzQyTlRReE9UWkRNQzR4TnpFNE9UUWdNQzQyTlRJMk16SWdNQzR4TnpJd05qTWdNQzQyTlRFd05URWdNQzR4TnpJMU5USWdNQzQyTkRrMU5UZERNQzR4TnpNd05ERWdNQzQyTkRnd05qSWdNQzR4TnpNNE5DQXdMalkwTmpZNE55QXdMakUzTkRnNU5pQXdMalkwTlRVeU1rTXdMakUzTlRrMU1pQXdMalkwTkRNMU55QXdMakUzTnpJME1pQXdMalkwTXpReU55QXdMakUzT0RZNE1TQXdMalkwTWpjNU5FTXdMakU0TURFeUlEQXVOalF5TVRZZ01DNHhPREUyTnpjZ01DNDJOREU0TXpjZ01DNHhPRE15TlNBd0xqWTBNVGcwTmxZd0xqWTBNVGcwTmxvaUlHWnBiR3c5SWlNNU9UazVPVGtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOU0lnWkQwaVRUQXVNVGd6TWpVZ01DNDJOREU0TkRaSU1DNHlNek13TXpaRE1DNHlNell3TURVZ01DNDJOREU0TkRZZ01DNHlNemc0TlRFZ01DNDJORE13TWpVZ01DNHlOREE1TlNBd0xqWTBOVEV5TkVNd0xqSTBNekEwT1NBd0xqWTBOekl5TXlBd0xqSTBOREl5T1NBd0xqWTFNREEzSURBdU1qUTBNakk1SURBdU5qVXpNRE00VmpBdU56a3hPVGMzU0RBdU1UazBNRFUyUXpBdU1Ua3hNVFkzSURBdU56a3hPVGMzSURBdU1UZzRNekEySURBdU56a3hOREE0SURBdU1UZzFOak0zSURBdU56a3dNekF5UXpBdU1UZ3lPVFk0SURBdU56ZzVNVGszSURBdU1UZ3dOVFF6SURBdU56ZzNOVGMySURBdU1UYzROU0F3TGpjNE5UVXpORU13TGpFM05ETTNOU0F3TGpjNE1UUXdPQ0F3TGpFM01qQTFOeUF3TGpjM05UZ3hNeUF3TGpFM01qQTFOeUF3TGpjMk9UazNPRll3TGpZMU5ERTVOa013TGpFM01UZzVOQ0F3TGpZMU1qWXpNaUF3TGpFM01qQTJNeUF3TGpZMU1UQTFNU0F3TGpFM01qVTFNaUF3TGpZME9UVTFOME13TGpFM016QTBNU0F3TGpZME9EQTJNaUF3TGpFM016ZzBJREF1TmpRMk5qZzNJREF1TVRjME9EazJJREF1TmpRMU5USXlRekF1TVRjMU9UVXlJREF1TmpRME16VTNJREF1TVRjM01qUXlJREF1TmpRek5ESTNJREF1TVRjNE5qZ3hJREF1TmpReU56azBRekF1TVRnd01USWdNQzQyTkRJeE5pQXdMakU0TVRZM055QXdMalkwTVRnek55QXdMakU0TXpJMUlEQXVOalF4T0RRMlZqQXVOalF4T0RRMldpSWdabWxzYkQwaUl6azVPVGs1T1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56WTNNakUxSURBdU5qUXhPRFEyU0RBdU9ERTNNREF5UXpBdU9ERTVPVGNnTUM0Mk5ERTRORFlnTUM0NE1qSTRNVGNnTUM0Mk5ETXdNalVnTUM0NE1qUTVNVFlnTUM0Mk5EVXhNalJETUM0NE1qY3dNVFVnTUM0Mk5EY3lNak1nTUM0NE1qZ3hPVFFnTUM0Mk5UQXdOeUF3TGpneU9ERTVOQ0F3TGpZMU16QXpPRll3TGpjMk9EZ3lRekF1T0RJNE1UazBJREF1TnpjME5qVTFJREF1T0RJMU9EYzNJREF1Tnpnd01qVWdNQzQ0TWpFM05URWdNQzQzT0RRek56VkRNQzQ0TVRjMk1qVWdNQzQzT0RnMU1ERWdNQzQ0TVRJd015QXdMamM1TURneE9TQXdMamd3TmpFNU5TQXdMamM1TURneE9VZ3dMamMxTmpRd09GWXdMalkxTkRFNU5rTXdMamMxTmpJME9DQXdMalkxTWpZMk5DQXdMamMxTmpRd05pQXdMalkxTVRFeE5TQXdMamMxTmpnM01pQXdMalkwT1RZME4wTXdMamMxTnpNek9DQXdMalkwT0RFM09TQXdMamMxT0RFd015QXdMalkwTmpneU1pQXdMamMxT1RFeE55QXdMalkwTlRZMk0wTXdMamMyTURFek1TQXdMalkwTkRVd05DQXdMamMyTVRNM05DQXdMalkwTXpVMk5pQXdMamMyTWpjMk9DQXdMalkwTWpreFF6QXVOelkwTVRZeElEQXVOalF5TWpVeklEQXVOelkxTmpjMUlEQXVOalF4T0RrZ01DNDNOamN5TVRVZ01DNDJOREU0TkRaV01DNDJOREU0TkRaYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMyTnpJeE5TQXdMalkwTVRnME5rZ3dMamd4TnpBd01rTXdMamd4T1RrM0lEQXVOalF4T0RRMklEQXVPREl5T0RFM0lEQXVOalF6TURJMUlEQXVPREkwT1RFMklEQXVOalExTVRJMFF6QXVPREkzTURFMUlEQXVOalEzTWpJeklEQXVPREk0TVRrMElEQXVOalV3TURjZ01DNDRNamd4T1RRZ01DNDJOVE13TXpoV01DNDNOamc0TWtNd0xqZ3lPREU1TkNBd0xqYzNORFkxTlNBd0xqZ3lOVGczTnlBd0xqYzRNREkxSURBdU9ESXhOelV4SURBdU56ZzBNemMxUXpBdU9ERTNOakkxSURBdU56ZzROVEF4SURBdU9ERXlNRE1nTUM0M09UQTRNVGtnTUM0NE1EWXhPVFVnTUM0M09UQTRNVGxJTUM0M05UWTBNRGhXTUM0Mk5UUXhPVFpETUM0M05UWXlORGdnTUM0Mk5USTJOalFnTUM0M05UWTBNRFlnTUM0Mk5URXhNVFVnTUM0M05UWTROeklnTUM0Mk5EazJORGRETUM0M05UY3pNemdnTUM0Mk5EZ3hOemtnTUM0M05UZ3hNRE1nTUM0Mk5EWTRNaklnTUM0M05Ua3hNVGNnTUM0Mk5EVTJOak5ETUM0M05qQXhNekVnTUM0Mk5EUTFNRFFnTUM0M05qRXpOelFnTUM0Mk5ETTFOallnTUM0M05qSTNOamdnTUM0Mk5ESTVNVU13TGpjMk5ERTJNU0F3TGpZME1qSTFNeUF3TGpjMk5UWTNOU0F3TGpZME1UZzVJREF1TnpZM01qRTFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVGN4T1RrM0lEQXVOelk1T1RrMFZqQXVOekl4TnpVeVNEQXVPREk0TURrNVZqQXVOelk1T1RrMFF6QXVPREk0TURrNUlEQXVOemMxT0RJNElEQXVPREkxTnpneElEQXVOemd4TkRJeklEQXVPREl4TmpVMklEQXVOemcxTlRRNVF6QXVPREUzTlRNZ01DNDNPRGsyTnpRZ01DNDRNVEU1TXpVZ01DNDNPVEU1T1RJZ01DNDRNRFl4SURBdU56a3hPVGt5U0RBdU1Ua3pPVGsyUXpBdU1UZzRNVFl4SURBdU56a3hPVGt5SURBdU1UZ3lOVFkySURBdU56ZzVOamMwSURBdU1UYzRORFFnTUM0M09EVTFORGxETUM0eE56UXpNVFVnTUM0M09ERTBNak1nTUM0eE56RTVPVGNnTUM0M056VTRNamdnTUM0eE56RTVPVGNnTUM0M05qazVPVFJXTUM0M05qazVPVFJhSWlCbWFXeHNQU0lqT1RRNU5EazBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RJME9DQXdMak0yTURNMU1sWXdMall6TWpjNU9Vd3dMalE1TnpZd015QXdMalE1TmpZNU4wd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6TXlRa1ZFUkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56QXlOamd4SURBdU16WXdOREUyVERBdU5EazNOVFU1SURBdU5EazJOelpNTUM0M01ESTVNalFnTUM0Mk16STJNVGhETUM0M01ESTBNemdnTUM0Mk1qY3lOekVnTUM0M01ESTJPREVnTUM0ek5UVTFOVFVnTUM0M01ESTJPREVnTUM0ek5qQTBNVFphSWlCbWFXeHNQU0lqTVRrNFFVSXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RZNE56VWdNQzQwT1RZNE1qWk1NQzR5T1RJME9DQXdMall6TWpZNE9FZ3dMamN3TWpRNE5WWXdMall6TWpRME5Vd3dMalE1TmpnM05TQXdMalE1TmpneU5sb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNsOHhOekE1WHpJMU1qVXpLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TWpreU5EZ2dNQzR6TmpBek5USklNQzQzTURJM01qWk1NQzQwT1RrM09TQXdMalV4T1RjNE5VTXdMalE1T0RVMk5pQXdMalV5TURjeE1pQXdMalE1TnpBM015QXdMalV5TVRJeE15QXdMalE1TlRVek55QXdMalV5TVRJeE0wTXdMalE1TkRBd01pQXdMalV5TVRJeE15QXdMalE1TWpVd09DQXdMalV5TURjeE1pQXdMalE1TVRJNE5DQXdMalV4T1RjNE5Vd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWEpmTVRjd09WOHlOVEkxTXlJZ2VERTlJakF1TkRrM05qQTBJaUI1TVQwaU1DNDBPVFk0TWpZaUlIZ3lQU0l3TGpRNU56WXdOQ0lnZVRJOUlqQXVOak15T1RNeElpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpNREExUWtFeElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TWpZaUlITjBiM0F0WTI5c2IzSTlJaU13TURVNE9VUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0MU15SWdjM1J2Y0MxamIyeHZjajBpSXpBd05FWTVNQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqZ2lJSE4wYjNBdFkyOXNiM0k5SWlNd01ETkdOME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpBd016QTJOeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1UY3dPVjh5TlRJMU15SStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0RBd01ERWlJR2hsYVdkb2REMGlNQzQ0T0RBd01ERWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEyTURBMU9EWWdNQzR3TmpBd05UZzJLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0NSIgeT0iMjgzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTdlZjAzYzQwLWUwMjUtNDQ1Yy05ZWY2LTNhYzkxMGFhYzgyMS0yNyIgdmFsdWU9IkxvYWQgQmFsYW5jZXIiIHN0eWxlPSJpci5yZWY9N2VmMDNjNDAtZTAyNS00NDVjLTllZjYtM2FjOTEwYWFjODIxO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUxPQUQtQkFMQU5DRVI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCMmFXVjNRbTk0UFNJd0lEQWdNU0F4SWlCbWFXeHNQU0p1YjI1bElpQjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaVBqeG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TUY4eU5EVTNYekl6TWpBd0tTSStQSEJoZEdnZ1pEMGlUVEF1TXpVd09ETXlJREF1TWpjNU5UYzFRekF1TXpVM05UQXhJREF1TWpBMk1EVXpJREF1TkRFNU5qazRJREF1TVRRNE5ETTRJREF1TkRrMU5EUWdNQzR4TkRnME16aERNQzQxTnpFeE9ESWdNQzR4TkRnME16Z2dNQzQyTXpNek56a2dNQzR5TURZd05UTWdNQzQyTkRBd05EZ2dNQzR5TnprMU56VklNQzQyTkRNNU5FTXdMamN3TURRek9TQXdMakkzT1RVM05TQXdMamMwTmpJMElEQXVNekkxTURjM0lEQXVOelEyTWpRZ01DNHpPREV5TURaRE1DNDNORFl5TkNBd0xqUXpOek16TmlBd0xqY3dNRFF6T1NBd0xqUTRNamd6TnlBd0xqWTBNemswSURBdU5EZ3lPRE0zU0RBdU16UTJPVFJETUM0eU9UQTBOREVnTUM0ME9ESTRNemNnTUM0eU5EUTJOQ0F3TGpRek56TXpOaUF3TGpJME5EWTBJREF1TXpneE1qQTJRekF1TWpRME5qUWdNQzR6TWpVd056Y2dNQzR5T1RBME5ERWdNQzR5TnprMU56VWdNQzR6TkRZNU5DQXdMakkzT1RVM05VZ3dMak0xTURnek1scE5NQzQwT1RVME5DQXdMakU0TVRJeU1rTXdMalF6TXpRM05DQXdMakU0TVRJeU1pQXdMak00TXpJMElEQXVNak14TVRJM0lEQXVNemd6TWpRZ01DNHlPVEkyT0RoV01DNHlPVFU1TmpkRE1DNHpPRE15TkNBd0xqTXdOVEF5SURBdU16YzFPRFV6SURBdU16RXlNelU1SURBdU16WTJOelFnTUM0ek1USXpOVGxJTUM0ek5EWTVORU13TGpNd09EWTJOeUF3TGpNeE1qTTFPU0F3TGpJM056WTBJREF1TXpRek1UZ3pJREF1TWpjM05qUWdNQzR6T0RFeU1EWkRNQzR5TnpjMk5DQXdMalF4T1RJeU9TQXdMak13T0RZMk55QXdMalExTURBMU15QXdMak0wTmprMElEQXVORFV3TURVelNEQXVOalF6T1RSRE1DNDJPREl5TVRNZ01DNDBOVEF3TlRNZ01DNDNNVE15TkNBd0xqUXhPVEl5T1NBd0xqY3hNekkwSURBdU16Z3hNakEyUXpBdU56RXpNalFnTUM0ek5ETXhPRE1nTUM0Mk9ESXlNVE1nTUM0ek1USXpOVGtnTUM0Mk5ETTVOQ0F3TGpNeE1qTTFPVWd3TGpZeU5ERTBRekF1TmpFMU1ESTNJREF1TXpFeU16VTVJREF1TmpBM05qUWdNQzR6TURVd01pQXdMall3TnpZMElEQXVNamsxT1RZM1ZqQXVNamt5TmpnNFF6QXVOakEzTmpRZ01DNHlNekV4TWpjZ01DNDFOVGMwTURZZ01DNHhPREV5TWpJZ01DNDBPVFUwTkNBd0xqRTRNVEl5TWxvaUlHWnBiR3c5SWlNd1FrRXdRamNpTHo0OGNHRjBhQ0JrUFNKTk1DNDBPVEV3TkNBd0xqUTJOVEl6TjBnd0xqVXdPRFkwVmpBdU5qWTNOak0zU0RBdU5Ea3hNRFJXTUM0ME5qVXlNemRhSWlCbWFXeHNQU0lqTUVKQk1FSTNJaTgrUEhCaGRHZ2daRDBpVFRBdU1qazNORFFnTUM0MU9EZzBNemRETUM0eU9UYzBOQ0F3TGpVNE16VTNOeUF3TGpNd01UTTRJREF1TlRjNU5qTTNJREF1TXpBMk1qUWdNQzQxTnprMk16ZERNQzR6TVRFeElEQXVOVGM1TmpNM0lEQXVNekUxTURRZ01DNDFPRE0xTnpjZ01DNHpNVFV3TkNBd0xqVTRPRFF6TjFZd0xqWTJOell6TjBNd0xqTXhOVEEwSURBdU5qY3lORGs0SURBdU16RXhNU0F3TGpZM05qUXpOeUF3TGpNd05qSTBJREF1TmpjMk5ETTNRekF1TXpBeE16Z2dNQzQyTnpZME16Y2dNQzR5T1RjME5DQXdMalkzTWpRNU9DQXdMakk1TnpRMElEQXVOalkzTmpNM1ZqQXVOVGc0TkRNM1dpSWdabWxzYkQwaUl6QkNRVEJDTnlJdlBqeHdZWFJvSUdROUlrMHdMalk1TXpRMElEQXVOVGc0TkRNM1F6QXVOamt6TkRRZ01DNDFPRE0xTnpjZ01DNDJPVGN6T0NBd0xqVTNPVFl6TnlBd0xqY3dNakkwSURBdU5UYzVOak0zUXpBdU56QTNNU0F3TGpVM09UWXpOeUF3TGpjeE1UQTBJREF1TlRnek5UYzNJREF1TnpFeE1EUWdNQzQxT0RnME16ZFdNQzQyTmpjMk16ZERNQzQzTVRFd05DQXdMalkzTWpRNU9DQXdMamN3TnpFZ01DNDJOelkwTXpjZ01DNDNNREl5TkNBd0xqWTNOalF6TjBNd0xqWTVOek00SURBdU5qYzJORE0zSURBdU5qa3pORFFnTUM0Mk56STBPVGdnTUM0Mk9UTTBOQ0F3TGpZMk56WXpOMVl3TGpVNE9EUXpOMW9pSUdacGJHdzlJaU13UWtFd1FqY2lMejQ4Y0dGMGFDQmtQU0pOTUM0M01ESXlOQ0F3TGpVM09UWXpOMVl3TGpVNU56SXpOMGd3TGpNd05qSTBWakF1TlRjNU5qTTNTREF1TnpBeU1qUmFJaUJtYVd4c1BTSWpNRUpCTUVJM0lpOCtQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqSTFNelEwSURBdU5qZzFNak0zVmpBdU56a3dPRE0zU0RBdU16VTVNRFJXTUM0Mk9EVXlNemRJTUM0eU5UTTBORnBOTUM0eU5EUTJOQ0F3TGpZMk56WXpOME13TGpJek9UYzRJREF1TmpZM05qTTNJREF1TWpNMU9EUWdNQzQyTnpFMU56Y2dNQzR5TXpVNE5DQXdMalkzTmpRek4xWXdMamM1T1RZek4wTXdMakl6TlRnMElEQXVPREEwTkRrNElEQXVNak01TnpnZ01DNDRNRGcwTXpjZ01DNHlORFEyTkNBd0xqZ3dPRFF6TjBnd0xqTTJOemcwUXpBdU16Y3lOeUF3TGpnd09EUXpOeUF3TGpNM05qWTBJREF1T0RBME5EazRJREF1TXpjMk5qUWdNQzQzT1RrMk16ZFdNQzQyTnpZME16ZERNQzR6TnpZMk5DQXdMalkzTVRVM055QXdMak0zTWpjZ01DNDJOamMyTXpjZ01DNHpOamM0TkNBd0xqWTJOell6TjBnd0xqSTBORFkwV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGp4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRrME5DQXdMalk0TlRJek4xWXdMamM1TURnek4wZ3dMamMxTlRBMFZqQXVOamcxTWpNM1NEQXVOalE1TkRSYVRUQXVOalF3TmpRZ01DNDJOamMyTXpkRE1DNDJNelUzT0NBd0xqWTJOell6TnlBd0xqWXpNVGcwSURBdU5qY3hOVGMzSURBdU5qTXhPRFFnTUM0Mk56WTBNemRXTUM0M09UazJNemRETUM0Mk16RTROQ0F3TGpnd05EUTVPQ0F3TGpZek5UYzRJREF1T0RBNE5ETTNJREF1TmpRd05qUWdNQzQ0TURnME16ZElNQzQzTmpNNE5FTXdMamMyT0RjZ01DNDRNRGcwTXpjZ01DNDNOekkyTkNBd0xqZ3dORFE1T0NBd0xqYzNNalkwSURBdU56azVOak0zVmpBdU5qYzJORE0zUXpBdU56Y3lOalFnTUM0Mk56RTFOemNnTUM0M05qZzNJREF1TmpZM05qTTNJREF1TnpZek9EUWdNQzQyTmpjMk16ZElNQzQyTkRBMk5Gb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NDhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5EazVPRFFnTUM0M09UQTRNemRNTUM0MU5qQTRNRGdnTUM0Mk9EVXlNemRJTUM0ME16ZzROekpNTUM0ME9UazROQ0F3TGpjNU1EZ3pOMXBOTUM0ME9USXlNVGtnTUM0NE1USTRNemRETUM0ME9UVTJNRFlnTUM0NE1UZzNNRFFnTUM0MU1EUXdOelFnTUM0NE1UZzNNRFFnTUM0MU1EYzBOakVnTUM0NE1USTRNemRNTUM0MU9ETTJOekVnTUM0Mk9EQTRNemRETUM0MU9EY3dOVGdnTUM0Mk56UTVOekVnTUM0MU9ESTRNalFnTUM0Mk5qYzJNemNnTUM0MU56WXdOU0F3TGpZMk56WXpOMGd3TGpReU16WXpRekF1TkRFMk9EVTFJREF1TmpZM05qTTNJREF1TkRFeU5qSXlJREF1TmpjME9UY3hJREF1TkRFMk1EQTVJREF1Tmpnd09ETTNUREF1TkRreU1qRTVJREF1T0RFeU9ETTNXaUlnWm1sc2JEMGlJekJDUVRCQ055SXZQand2Wno0OFpHVm1jejQ4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3WHpJME5UZGZNak15TURBaVBqeHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOTciIHk9Ijk4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE4NzBhN2MwLTFkOWQtNDhlYS04MDA4LTBlM2ZmZTFkNDA2MS0xNSIgdmFsdWU9IldlYiBDbGllbnQgLT4gTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj0wZjAyOGU1ZC1hZmIzLTQ2OGEtOWQzMy01YTlmM2ExNzM0NTc7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VudHJ5WD0wO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7IiBwYXJlbnQ9IjEiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtN2VmMDNjNDAtZTAyNS00NDVjLTllZjYtM2FjOTEwYWFjODIxLTI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIyMDUiIHk9IjEyMy44NTAyMDI0MjkxNDk3IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtMjg1NGQ0OGYtM2NhZi00NzVkLTk4OGItOGI1OTViODdmNDYwLTI2IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQgLT4gTG9hZCBCYWxhbmNlciIgc3R5bGU9ImlyLnJlZj03Y2RlNzVlYy01NGVhLTQwYzgtOTc0MS0wODgwMTUxMmRjYmM7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LWRlMWRkMTVkLTUyNDItNGQwZS05MTNjLTA5ZDJkMzgxZGZiNy0yNSIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS03ZWYwM2M0MC1lMDI1LTQ0NWMtOWVmNi0zYWM5MTBhYWM4MjEtMjciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjIwNSIgeT0iMTA4Ljg4MTE3NDg5OTg2NjQ0IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="hospitals" uuid="0d73657e-ca3a-410d-8921-e8bb90856a24" name="Hospitals" desc="" trustRating="1"/>
+  </trustZones>
+  <questions>
+    <wizardQuestion ref="Amazon Web Services" answer="true" manuallyModified="false"/>
+  </questions>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Web Client -&gt; Load Balancer" ref="0f028e5d-afb3-468a-9d33-5a9f3a173457" source="a076c1e1-f412-473c-85af-2bc811522b81" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other database" ref="2688c8fb-3645-46d3-80d3-953eb7dfd2fa" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Load Balancer -&gt; RESTful Web Service" ref="3522ab40-f03c-4f1a-b84a-280165750074" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Mobile Device Client -&gt; Load Balancer" ref="7cde75ec-54ea-40c8-9741-08801512dcbc" source="84938d4c-4d32-4de6-a1be-c852de621214" target="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other data store" ref="a11f6143-3f73-4c89-a124-f5d9021584c7" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Load Balancer -&gt; Web Application - Server side" ref="c007e88d-e81f-44df-b11d-8e40f117b51d" source="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" target="6466e1cd-f115-44bf-9962-548b27fca47a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; Web Service" ref="d799d429-9293-4bf5-a67f-dcf4b461974a" source="6466e1cd-f115-44bf-9962-548b27fca47a" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="e084b60b-0cc1-4968-af2e-c30a31f987a8" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="RESTful Web Service -&gt; Web Service" ref="f7c8becf-672b-4b49-bd86-5e15e2f9eeff" source="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" target="b4ab3358-66e5-4e92-b5a6-f2d97821a49a">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="6fd2012c-290a-4155-a0fb-02ef2d8bab89" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.480">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.092">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.292">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.038">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:58.273">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:10.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="51c726cf-9993-4244-a0e7-9bba115402ad" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.256">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.831">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.453">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.825">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.927">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.541">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.312">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.826">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.455">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.454">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.144">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.528">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.447">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.147">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.529">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.879">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:08.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:06.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.062">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.061">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:09.146">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:07.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1a65a7ea-0512-40c9-86d1-0d4771ba9693" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.420">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.970">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.057">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.589">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.972">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.936">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.225">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.937">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.514">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.651">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.134">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.840">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.508">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:57.517">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:54.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:56.659">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:55.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d361b243-c73c-42d8-a3fe-6d4c5768847d" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The API is vulnerable to injection flaws if:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
+  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.917">
+              <output/>
+            </source>
+            <references>
+              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
+              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
+              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
+              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.721">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.541">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.744">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
+          <desc>Product A handles inputs or steps differently than Product B,
+          which causes A to perform incorrect actions based on its perception of B's
+          state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.160">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.746">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.998">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.168">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.745">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.543">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.177">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.311">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.311">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.721">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
+              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.695">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
+            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API5:2023-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
+              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API2:2023-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
+              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.696">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API9:2023-Improper Inventory Management" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.723">
+              <output/>
+            </source>
+            <references>
+              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.697">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.111">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:04.477">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:05.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.697">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:02.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.997">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.996">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.179">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:03.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="review-api-responses" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="review-api-responses" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
+                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-authentication">
+                  <countermeasures>
+                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
+          <threats>
+            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
+                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-285">
+                  <countermeasures>
+                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-object-level-authorization">
+                  <countermeasures>
+                    <countermeasure ref="object-level-authorization" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                <countermeasure ref="object-level-authorization" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
+                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="api-vulnerable-injection">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-436">
+                  <countermeasures>
+                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="rest-content-type-val" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
+&lt;/div&gt;
+&lt;div&gt;
+  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-assets-inventory">
+                  <countermeasures>
+                    <countermeasure ref="inventory-api" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="inventory-api" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b4dc9515-e6f8-453f-a134-6e2d33364199" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.397">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AZURE-SER-BUS-MSG1" name="Use Azure Private Link to enable private access to Service Bus" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Private Link to enable private access to Service Bus&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Azure Private Link to enable private access to Service Bus from your virtual networks without crossing the internet.&lt;br&gt; Private access is an additional defense in depth measure to the authentication and traffic security offered by Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To integrate a Service Bus namespace with Azure Private Link, you'll need the following entities or permissions:&lt;/p&gt; 
+&lt;p&gt;- A Service Bus namespace.&lt;br&gt; - An Azure virtual network.&lt;br&gt; - A subnet in the virtual network. You can use the default subnet.&lt;br&gt; - Owner or contributor permissions for both the Service Bus namespace and the virtual network.&lt;/p&gt; 
+&lt;p&gt;Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your Service Bus namespace can be in a different region. And, Your private endpoint uses a private IP address in your virtual network.&lt;/p&gt; 
+&lt;p&gt;If you already have an existing namespace, you can create a private endpoint by following these steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. In the search bar, type in Service Bus.&lt;/p&gt; 
+&lt;p&gt;3. Select the namespace from the list to which you want to add a private endpoint.&lt;/p&gt; 
+&lt;p&gt;4. On the left menu, select Networking option under Settings. By default, the Selected networks option is selected.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; You see the Networking tab only for premium namespaces.&lt;/p&gt; 
+&lt;p&gt;Warning&lt;br&gt; If you don't add at least one IP firewall rule or a virtual network on this page, the namespace can be accessed over public internet (using the access key).&lt;/p&gt; 
+&lt;p&gt;If you select the All networks option, your Service Bus namespace accepts connections from any IP address (using the access key). This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.&lt;/p&gt; 
+&lt;p&gt;5. To allow access to the namespace via private endpoints, select the Private endpoint connections tab at the top of the page&lt;/p&gt; 
+&lt;p&gt;6. Select the + Private Endpoint button at the top of the page.&lt;/p&gt; 
+&lt;p&gt;7. On the Basics page, follow these steps:&lt;/p&gt; 
+&lt;p&gt;a. Select the Azure subscription in which you want to create the private endpoint.&lt;/p&gt; 
+&lt;p&gt;b. Select the resource group for the private endpoint resource.&lt;/p&gt; 
+&lt;p&gt;c. Enter a name for the private endpoint.&lt;/p&gt; 
+&lt;p&gt;d. Select a region for the private endpoint. Your private endpoint must be in the same region as your virtual network, but can be in a different region from the private link resource that you are connecting to.&lt;/p&gt; 
+&lt;p&gt;e. Select Next: Resource &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;8. On the Resource page, follow these steps:&lt;/p&gt; 
+&lt;p&gt;a. For connection method, if you select Connect to an Azure resource in my directory, follow these steps:&lt;/p&gt; 
+&lt;p&gt;i. Select the Azure subscription in which your Service Bus namespace exists.&lt;/p&gt; 
+&lt;p&gt;ii. For Resource type, Select Microsoft.ServiceBus/namespaces for the Resource type.&lt;/p&gt; 
+&lt;p&gt;iii. For Resource, select a Service Bus namespace from the drop-down list.&lt;/p&gt; 
+&lt;p&gt;iv. Confirm that the Target subresource is set to namespace.&lt;/p&gt; 
+&lt;p&gt;v. Select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;b. If you select Connect to an Azure resource by resource ID or alias, follow these steps:&lt;/p&gt; 
+&lt;p&gt;i. Enter the resource ID or alias. It can be the resource ID or alias that someone has shared with you. The easiest way to get the resource ID is to navigate to the Service Bus namespace in the Azure portal and copy the portion of URI starting from /subscriptions/. See the following image for an example.&lt;/p&gt; 
+&lt;p&gt;ii. For Target sub-resource, enter namespace. It's the type of the sub-resource that your private endpoint can access.&lt;/p&gt; 
+&lt;p&gt;iii.(optional) Enter a request message. The resource owner sees this message while managing private endpoint connection.&lt;/p&gt; 
+&lt;p&gt;iv. Then, select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;9. On the Configuration page, you select the subnet in a virtual network to where you want to deploy the private endpoint.&lt;/p&gt; 
+&lt;p&gt;a. Select a virtual network. Only virtual networks in the currently selected subscription and location are listed in the drop-down list.&lt;/p&gt; 
+&lt;p&gt;b. Select a subnet in the virtual network you selected.&lt;/p&gt; 
+&lt;p&gt;c. Select Next: Tags &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;10. On the Tags page, create any tags (names and values) that you want to associate with the private endpoint resource. Then, select Review + create button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;11. On the Review + create, review all the settings, and select Create to create the private endpoint.&lt;/p&gt; 
+&lt;p&gt;12. Confirm that the private endpoint is created. If you are the owner of the resource and had selected Connect to an Azure resource in my directory option for the Connection method, the endpoint connection should be auto-approved. If it's in the pending state, please see the Manage private endpoints using Azure portal section at Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allow access to Azure Service Bus namespaces via private endpoints" url="https://docs.microsoft.com/en-us/azure/service-bus-messaging/private-link-service"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate that the private link connection works&lt;/p&gt;
+
+	&lt;p&gt;You should validate that resources within the virtual network of the private endpoint are connecting to your Service Bus namespace over a private IP address, and that they have the correct private DNS zone integration.&lt;/p&gt;
+
+	&lt;p&gt;First, create a Windows virtual machine in the Azure portal&lt;/p&gt;
+
+	&lt;p&gt;In the Networking tab:&lt;/p&gt;
+
+	&lt;p&gt;1. Specify Virtual network and Subnet. You must select the Virtual Network on which you deployed the private endpoint.&lt;br /&gt;
+2. Specify a public IP resource.&lt;br /&gt;
+3. For NIC network security group, select None.&lt;br /&gt;
+4 For Load balancing, select No.&lt;/p&gt;
+
+	&lt;p&gt;Connect to the VM, open the command line, and run the following command:&lt;/p&gt;
+
+	&lt;p&gt;nslookup &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;
+
+	&lt;p&gt;You should see a result that looks like the following.&lt;/p&gt;
+
+	&lt;p&gt;Non-authoritative answer:&lt;br /&gt;
+Name:    &lt;service-bus-namespace-name&gt;.privatelink.servicebus.windows.net&lt;br /&gt;
+Address:  10.0.0.4 (private IP address associated with the private endpoint)&lt;br /&gt;
+Aliases:  &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
+&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
+&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
+&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
+&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
+&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
+          </references>
+          <standards>
+            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:54.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="4c9bae06-45d5-4b5f-9815-62b71b4e3d9b" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
+                        common that they deserve a special kingdom of their own. As with "API Abuse", there
+                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
+                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
+                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
+                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
+                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
+                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
+                        without restricting how much is copied. Other variants exist, but the existence of a classic
+                        overflow strongly suggests that the programmer is not considering even the most basic of
+                        security protections.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
+              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software provides an Applications Programming Interface (API) or similar interface for
+                        interaction with external actors, but the interface includes a dangerous method or function that
+                        is not properly restricted.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
+                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
+                        leverage them to obtain information about the app.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.191">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
+                        attackers can leverage them to obtain information about the app.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.188">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application can be deployed with active debugging code that can create unintended entry
+                        points.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.189">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
+                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:59.190">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For Android:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For iOS:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the set of protocol handlers are deactivated.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the exceptions are well-designed and are catched and handled well.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-3 - Checking for Weaknesses in Third Party Libraries" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0042/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CODE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; or &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-2 - Testing Enforced Updating" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0036/"/>
+          </references>
+          <standards>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-CODE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
+&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
+&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing Local Storage for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0001/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-1 - Testing the Device-Access-Security Policy" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0012/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-STORAGE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app verifies the mobile device complies with the minimum
+                            device-access-security policy.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the application denies access to the session when the exceptions appear.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Search in the code the following instruction:
+                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
+                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;For iOS:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
+                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
+                            setJavaScriptEnabled:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [conf setPreferences:pref]; _webView = [[WKWebView
+                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
+                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [_webView loadRequest:request];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [self.view addSubview:_webView]; }
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Embedded Services" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0004/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether Sensitive Data Is Shared with Third Parties via Notifications" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0005/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Determining Whether the Keyboard Cache Is Disabled for Text Input Fields" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0006/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Backups for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0009/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Logs for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0003/"/>
+            <reference name="OWASP MASTG - MASVS-STORAGE-2 - Testing Memory for Sensitive Data" url="https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0011/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+            <standard ref="MASVS-STORAGE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the clipboard is disabled when sensitive data is used.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
+                        Android O and the behavior of MAC addresses have changed in Android N.
+
+                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
+                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
+                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
+                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
+                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
+                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
+                        they request the Build.Serial.
+                    </desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
+                            authenticate).&lt;/li&gt;
+                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;ol&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;exit the current user&lt;/li&gt;
+                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
+                            shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
+                            working properly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Log Class&lt;/li&gt; 
+ &lt;li&gt;Logger Class&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
+&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;NSLog Method&lt;/li&gt; 
+ &lt;li&gt;printf-like function&lt;/li&gt; 
+ &lt;li&gt;NSAssert-like function&lt;/li&gt; 
+ &lt;li&gt;Macro&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all executable files and libraries belonging to the app are encrypted or
+                            packed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that sensitive data is not stored in plain text.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.777">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.6" name="Ensure that no sensitive stored data has been exposed via IPC mechanisms" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Inter Process Communication (IPC) allows processes to send each other messages and data. For processes that need to communicate with each other, there are different ways to implement IPC on iOS:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;XPC Services: XPC is a structured, asynchronous library that provides basic interprocess communication. It is managed by launchd. It is the most secure and flexible implementation of IPC on iOS and should be the preferred method. It runs in the most restricted environment possible: sandboxed with no root privilege escalation and minimal file system access and network access. Two different APIs are used with XPC Services:&lt;ul&gt;&lt;li&gt;NSXPCConnection API&lt;/li&gt;&lt;li&gt;XPC Services API&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Mach Ports: All IPC communication ultimately relies on the Mach Kernel API. Mach Ports allow local communication (intra-device communication) only. They can be implemented either natively or via Core Foundation (CFMachPort) and Foundation (NSMachPort) wrappers.&lt;/li&gt;&lt;li&gt;NSFileCoordinator: The class NSFileCoordinator can be used to manage and send data to and from apps via files that are available on the local file system to various processes. NSFileCoordinator methods run synchronously, so your code will be blocked until they stop executing. That's convenient because you don't have to wait for an asynchronous block callback, but it also means that the methods block the running thread.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;No sensitive data should be exposed via IPC mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;For Android:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The first step is to look at AndroidManifest.xml to detect content providers exposed by the app. You can identify content providers by the &amp;lt;provider&amp;gt; element. Complete the following steps:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Determine whether the value of the export tag (android:exported) is "true". Even if it is not, the tag will be set to "true" automatically if an &amp;lt;intent-filter&amp;gt; has been defined for the tag. If the content is meant to be accessed only by the app itself, set android:exported to "false". If not, set the flag to "true" and define proper read/write permissions.&lt;/li&gt;&lt;li&gt;Determine whether the data is being protected by a permission tag (android:permission). Permission tags limit exposure to other apps.&lt;/li&gt;&lt;li&gt;Determine whether the android:protectionLevel attribute has the value signature. This setting indicates that the data is intended to be accessed only by apps from the same enterprise (i.e., signed with the same key). To make the data accessible to other apps, apply a security policy with the &amp;lt;permission&amp;gt; element and set a proper android:protectionLevel. If you use android:permission, other applications must declare corresponding &amp;lt;uses-permission&amp;gt; elements in their manifests to interact with your content provider. You can use the android:grantUriPermissions attribute to grant more specific access to other apps; you can limit access with the &amp;lt;grant-uri-permission&amp;gt; element.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Inspect the source code to understand how the content provider is meant to be used. Search for the following keywords:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;android.content.ContentProvider&lt;/li&gt;&lt;li&gt;android.database.Cursor&lt;/li&gt;&lt;li&gt;android.database.sqlite&lt;/li&gt;&lt;li&gt;.query&lt;/li&gt;&lt;li&gt;.update&lt;/li&gt;&lt;li&gt;.delete&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;To avoid SQL injection attacks within the app, use parameterized query methods, such as query, update, and delete. Be sure to properly sanitize all method arguments; for example, the selection argument could lead to SQL injection if it is made up of concatenated user input.&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If you expose a content provider, determine whether parameterized &lt;a href="https://developer.android.com/reference/android/content/ContentProvider.html#query%28android.net.Uri%2C%20java.lang.String%5B%5D%2C%20java.lang.String%2C%20java.lang.String%5B%5D%2C%20java.lang.String%29"&gt;query methods&lt;/a&gt; (query, update, and delete) are being used to prevent SQL injection. If so, make sure all their arguments are properly sanitized.&lt;/p&gt;&lt;p&gt;We will use the vulnerable password manager app &lt;a href="https://github.com/mwrlabs/drozer/releases/download/2.3.4/sieve.apk"&gt;Sieve&lt;/a&gt; as an example of a vulnerable content provider.&lt;/p&gt;&lt;h4&gt;Inspect the Android Manifest&lt;/h4&gt;&lt;p&gt;Identify all defined &amp;lt;provider&amp;gt; elements:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.DBContentProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".DBContentProvider"&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;&amp;lt;path-permission&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:path="/Keys"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:readPermission="com.mwr.example.sieve.READ_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;android:writePermission="com.mwr.example.sieve.WRITE_KEYS"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; /&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;/provider&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;lt;provider&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:authorities="com.mwr.example.sieve.FileBackupProvider"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:exported="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:multiprocess="true"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp;android:name=".FileBackupProvider"&lt;/p&gt;&lt;p&gt;/&amp;gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;As shown in the AndroidManifest.xml above, the application exports two content providers. Note that one path ("/Keys") is protected by read and write permissions.&lt;/p&gt;&lt;h4&gt;Inspect the source code&lt;/h4&gt;&lt;p&gt;Inspect the query function in the DBContentProvider.java file to determine whether any sensitive information is being leaked:&lt;/p&gt;&lt;p&gt;Example in Java:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;public Cursor query(final Uri uri, final String[] array, final String s, final String[] array2, final String s2) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final int match = this.sUriMatcher.match(uri);&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;final SQLiteQueryBuilder sqLiteQueryBuilder = new SQLiteQueryBuilder();&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Passwords");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.setTables("Key");&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, (String)null, (String)null, s2);&lt;/p&gt;&lt;p&gt;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Example in Kotlin:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;fun query(uri: Uri?, array: Array&amp;lt;String?&amp;gt;?, s: String?, array2: Array&amp;lt;String?&amp;gt;?, s2: String?): Cursor {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val match: Int = this.sUriMatcher.match(uri)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;val sqLiteQueryBuilder = SQLiteQueryBuilder()&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;if (match &amp;gt;= 100 &amp;amp;&amp;amp; match &amp;lt; 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Passwords"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;} else if (match &amp;gt;= 200) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;sqLiteQueryBuilder.tables = "Key"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;return sqLiteQueryBuilder.query(this.pwdb.getReadableDatabase(), array, s, array2, null as String?, null as String?, s2)&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;}&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Here we see that there are actually two paths, "/Keys" and "/Passwords", and the latter is not being protected in the manifest and is therefore vulnerable.&lt;/p&gt;&lt;p&gt;When accessing a URI, the query statement returns all passwords and the path Passwords/. We will address this in the "Dynamic Analysis" section and show the exact URI that is required.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;h4&gt;Testing Content Providers&lt;/h4&gt;&lt;p&gt;To dynamically analyze an application's content providers, first enumerate the attack surface: pass the app's package name to the Drozer module app.provider.info:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.info -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Package: com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.DBContentProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path Permissions:&lt;/p&gt;&lt;p&gt;&amp;nbsp;Path: /Keys&lt;/p&gt;&lt;p&gt;&amp;nbsp;Type: PATTERN_LITERAL&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: com.mwr.example.sieve.READ_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: com.mwr.example.sieve.WRITE_KEYS&lt;/p&gt;&lt;p&gt;&amp;nbsp;Authority: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Read Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Write Permission: null&lt;/p&gt;&lt;p&gt;&amp;nbsp;Content Provider: com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;p&gt;&amp;nbsp;Multiprocess Allowed: True&lt;/p&gt;&lt;p&gt;&amp;nbsp;Grant Uri Permissions: False&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In this example, two content providers are exported. Both can be accessed without permission, except for the /Keys path in the DBContentProvider. With this information, you can reconstruct part of the content URIs to access the DBContentProvider (the URIs begin with content://).&lt;/p&gt;&lt;p&gt;To identify content provider URIs within the application, use Drozer's scanner.provider.finduris module. This module guesses paths and determines accessible content URIs in several ways:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.finduris -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;p&gt;Unable to Query content://com.mwr.example.sieve.DBContentProvider/Keys&lt;/p&gt;&lt;p&gt;Accessible content URIs:&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Once you have a list of accessible content providers, try to extract data from each provider with the app.provider.query module:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --vertical&lt;/p&gt;&lt;p&gt;_id: 1&lt;/p&gt;&lt;p&gt;service: Email&lt;/p&gt;&lt;p&gt;username: incognitoguy50&lt;/p&gt;&lt;p&gt;password: PSFjqXIMVa5NJFudgDuuLVgJYFD+8w== (Base64 - encoded)&lt;/p&gt;&lt;p&gt;email: incognitoguy50@gmail.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can also use Drozer to insert, update, and delete records from a vulnerable content provider:&lt;/p&gt;&lt;p&gt;Insert record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.insert content://com.vulnerable.im/messages&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string date 1331763850325&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--string type 0&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer _id 7&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Update record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.update content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args assisted_gps_enabled&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--integer value 0&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Delete record&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.delete content://settings/secure&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection "name=?"&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;--selection-args my_setting&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;SQL Injection in Content Providers&lt;/h4&gt;&lt;p&gt;The Android platform promotes SQLite databases for storing user data. Because these databases are based on SQL, they may be vulnerable to SQL injection. You can use the Drozer module app.provider.query to test for SQL injection by manipulating the projection and selection fields that are passed to the content provider:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "' FROM Passwords" (code 1): , while compiling: SELECT ' FROM Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --selection "'"&lt;/p&gt;&lt;p&gt;unrecognized token: "')" (code 1): , while compiling: SELECT * FROM Passwords WHERE (')
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If an application is vulnerable to SQL Injection, it will return a verbose error message. SQL Injection on Android may be used to modify or query data from the vulnerable content provider. In the following example, the Drozer module app.provider.query is used to list all the database tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "*&lt;/p&gt;&lt;p&gt;FROM SQLITE_MASTER WHERE type='table';--"&lt;/p&gt;&lt;p&gt;| type &amp;nbsp;| name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | tbl_name &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; | rootpage | sql &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;|&lt;/p&gt;&lt;p&gt;| table | android_metadata | android_metadata | 3 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Passwords &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 4 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |&lt;/p&gt;&lt;p&gt;| table | Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| Key &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| 5 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| CREATE TABLE ... |
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;SQL Injection may also be used to retrieve data from otherwise protected tables:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --projection "* FROM Key;--"&lt;/p&gt;&lt;p&gt;| Password | pin |&lt;/p&gt;&lt;p&gt;| thisismypassword | 9876 |&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;You can automate these steps with the scanner.provider.injection module, which automatically finds vulnerable content providers within an app:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.injection -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Injection in Projection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/&lt;/p&gt;&lt;p&gt;Injection in Selection:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Keys/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.DBContentProvider/Passwords/
+&lt;/p&gt;&lt;/blockquote&gt;&lt;h4&gt;File System Based Content Providers&lt;/h4&gt;&lt;p&gt;Content providers can provide access to the underlying filesystem. This allows apps to share files (the Android sandbox normally prevents this). You can use the Drozer modules app.provider.read and app.provider.download to read and download files, respectively, from exported file-based content providers. These content providers are susceptible to directory traversal, which allows otherwise protected files in the target application's sandbox to be read.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run app.provider.download content://com.vulnerable.app.FileProvider/../../../../../../../../data/data/com.vulnerable.app/database.db /home/user/database.db
+Written 24488 bytes
+&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Use the scanner.provider.traversal module to automate the process of finding content providers that are susceptible to directory traversal:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;dz&amp;gt; run scanner.provider.traversal -a com.mwr.example.sieve&lt;/p&gt;&lt;p&gt;Scanning com.mwr.example.sieve...&lt;/p&gt;&lt;p&gt;Vulnerable Providers:&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider/&lt;/p&gt;&lt;p&gt;&amp;nbsp;content://com.mwr.example.sieve.FileBackupProvider&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note that adb can also be used to query content providers:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;$ adb shell content query --uri content://com.owaspomtg.vulnapp.provider.CredentialProvider/credentials&lt;/p&gt;&lt;p&gt;Row: 0 id=1, username=admin, password=StrongPwd&lt;/p&gt;&lt;p&gt;Row: 1 id=2, username=test, password=test&lt;/p&gt;&lt;p&gt;...&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;strong&gt;For iOS:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following section summarizes keywords that you should look for to identify IPC implementations within iOS source code.&lt;/p&gt;&lt;h4&gt;XPC Services&lt;/h4&gt;&lt;p&gt;Several classes may be used to implement the NSXPCConnection API:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSXPCConnection&lt;/li&gt;&lt;li&gt;NSXPCInterface&lt;/li&gt;&lt;li&gt;NSXPCListener&lt;/li&gt;&lt;li&gt;NSXPCListenerEndpoint&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;You can set security attributes for the connection. The attributes should be verified.&lt;/p&gt;&lt;p&gt;Check for the following two files in the Xcode project for the XPC Services API (which is C-based):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;xpc.h&lt;/li&gt;&lt;li&gt;connection.h&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;Mach Ports&lt;/h4&gt;&lt;p&gt;Keywords to look for in low-level implementations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;mach_port_t&lt;/li&gt;&lt;li&gt;mach_msg_*&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Keywords to look for in high-level implementations (Core Foundation and Foundation wrappers):&lt;/p&gt;&lt;ul&gt;&lt;li&gt;CFMachPort&lt;/li&gt;&lt;li&gt;CFMessagePort&lt;/li&gt;&lt;li&gt;NSMachPort&lt;/li&gt;&lt;li&gt;NSMessagePort&lt;/li&gt;&lt;/ul&gt;&lt;h4&gt;NSFileCoordinator&lt;/h4&gt;&lt;p&gt;Keywords to look for:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;NSFileCoordinator&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Verify IPC mechanisms with static analysis of the iOS source code. No iOS tool is currently available to verify IPC usage.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
+                        including stealthy responses that don't simply terminate the app.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the app implements multiple different responses to tampering, debugging and
+                            emulation, including stealthy responses that don't simply terminate the app.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Data Encryption on the Network" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0019/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing Endpoint Identify Verification" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0021/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the Security Provider" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0023/"/>
+            <reference name="OWASP MASTG - MASVS-NETWORK-1 - Testing the TLS Settings" url="https://mas.owasp.org/MASTG/tests/android/MASVS-NETWORK/MASTG-TEST-0020/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-NETWORK-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
+                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
+                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
+                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
+                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
+                        the goal of protecting against memory patches applied during runtime. This includes unwanted
+                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
+                        well as rogue code loaded into process memory.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;div&gt;
+                        Integrity can be verified either by:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
+                        values.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
+                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
+                            responds accordingly.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
+                        the app is running inside an emulator, the app shall terminate the session.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Emulator Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-1 - Testing Root Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
+                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
+                        is detected, the app shall force termination of the session.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Launch the app systematically with various apps and frameworks installed, such as the
+                            following:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
+                        features can be preventive or reactive. As the name implies, preventive anti-debugging
+                        techniques prevent the debugger from attaching in the first place, while reactive techniques
+                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
+                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
+                        combine multiple methods of prevention and detection which operate on different API layers and
+                        are distributed throughout the app.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Anti-Debugging Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0046/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing Reverse Engineering Tools Detection" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0048/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-4 - Testing whether the App is Debuggable" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0039/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
+                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
+                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
+                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
+                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
+                            or other sources);&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
+                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Remove the debugging code, log verbose errors or debugging messages in the production version.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
+                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing JavaScript Execution in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0031/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebView Protocol Handlers" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0032/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing WebViews Cleanup" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0037/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-2 - Testing for Java Objects Exposed Through WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0033/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-PLATFORM-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>- Produce a JavaScript payload.
+                            - Inject it into the file that the app is requesting. The injection could be done either
+                            through a MITM attack or by directly modifying the file in case it is stored on external
+                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
+                            exploitation payload) which is able to install a full agent, injecting a limited agent into
+                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
+                            - Check that only the JavaScript provided with the app is allowed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>As a general rule of thumb, as little explanative information as possible should be provided
+                        along with the compiled code. Some metadata such as debugging information, line numbers and
+                        descriptive function or method names make the binary or bytecode easier to understand for the
+                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
+                        discarded without impacting the functionality of the app.
+
+                        This data shall be removed from the release version or shall be obfuscated in order to be
+                        inaccessible to the reverse engineer.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing Obfuscation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0051/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Code and Verbose Error Logging" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0041/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-3 - Testing for Debugging Symbols" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0040/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-RESILIENCE-3" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Symbols are usually stripped during the build process, so you need the compiled byte-code
+                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
+                            nm binary in your Android NDK and export it (or create an alias).
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            export $NM =
+                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            To display debug symbols:
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ $NM -a
+                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
+                            libfoo.so: no symbols&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;To display dynamic symbols:
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            $ $NM -D libfoo.so&amp;nbsp;
+                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
+                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
+                            Adding this flag causes gcc to discard the function names while still preserving the names
+                            of functions declared as JNIEXPORT.&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            Check if the following was added to build.gradle:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
+                            binutils and can be installed via Homebrew on Mac OS X.
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0007/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing Deep Links" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0028/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for App Permissions" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0024/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Sensitive Functionality Exposure Through IPC" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0029/"/>
+            <reference name="OWASP MASTG - MASVS-PLATFORM-1 - Testing for Vulnerable Implementation of PendingIntent" url="https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/"/>
+          </references>
+          <standards>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-PLATFORM-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android applications:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
+                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
+                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
+                            permissions needed by the application.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
+  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This kind of vulnerability occurs in a number of ways: 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Make Sure That Free Security Features Are Activated" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0044/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Memory Corruption Bugs" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0043/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Implicit Intents" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0026/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Local Storage for Input Validation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0002/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing Object Persistence" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0034/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for Injection Flaws" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0025/"/>
+            <reference name="OWASP MASTG - MASVS-CODE-4 - Testing for URL Loading in WebViews" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CODE/MASTG-TEST-0027/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CODE-4" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
+                            gain access to the system.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Making Sure that the App is Properly Signed" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0038/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing File Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0047/"/>
+            <reference name="OWASP MASTG - MASVS-RESILIENCE-2 - Testing Runtime Integrity Checks" url="https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0050/"/>
+          </references>
+          <standards>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="MASVS-RESILIENCE-2" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app is correctly signed.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:16:58.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker attempts to invoke all common switches and options in the target
+                                application for the purpose of discovering weaknesses in the target. For example, in
+                                some applications, adding the --debug switch causes debugging information to be
+                                displayed, which can sometimes reveal sensitive processing or configuration information
+                                to an attacker.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This attack differs from other forms of API abuse in that the attacker is blindly
+                                attempting to invoke options in the hope that one of them will work rather than
+                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
+                                with the published options of a targeted application this attack method may still be
+                                fruitful as it might discover unpublicized functionality.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-489">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-656">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MEMORY-LEAKAGE">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="OUTDATED-LIBRARIES">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of an object, resource,
+                                or system by using a variety of analysis techniques to effectively determine how the
+                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
+                                duplicate the function, or a part of the function, of an object in order to duplicate or
+                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
+                                or software, although the methodology and techniques involved in each type of analysis
+                                differ widely. When adversaries are reverse engineering software, methodologies fall
+                                into two broad categories, 'white box' and 'black box.' White box techniques involve
+                                methods which can be applied to a piece of software when an executable or some other
+                                compiled object can be directly subjected to analysis, revealing at least a portion of
+                                its machine instructions that can be observed upon execution.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                'Black Box' methods involve interacting with the software indirectly, in the absence of
+                                the ability to measure, instrument, or analyze an executable object directly. Such
+                                analysis typically involves interacting with the software at the boundaries of where the
+                                software interfaces with a larger execution environment, such as input-output vectors,
+                                libraries, or APIs.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="MASVS-EMULATION-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                <countermeasure ref="MASVS-8.7" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>If the mobile application requests permissions or access to components that are not
+                                strictly needed by the application, then users can lose trust in the security of the
+                                application with an associated impact on the trust placed in the application provider.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                <countermeasure ref="MASVS-8.1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                <countermeasure ref="MASVS-4.9" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker employs forceful browsing to access portions of a website that are
+                                otherwise unreachable through direct URL entry.
+
+                                Usually, a front controller or similar design pattern is employed to protect access to
+                                portions of a web application.
+
+                                Forceful browsing enables an attacker to access information, perform privileged
+                                operations and otherwise reach sections of the web application that have been improperly
+                                protected.
+                            </desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-749">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-83">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                <countermeasure ref="MASVS-6.7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Errors and error handling represent a class of API. Errors related to error handling
+                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
+                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-388">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                <countermeasure ref="MASVS-7.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="OWASP-MASVS" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-120">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="35cfc692-3b5d-4a87-bdea-ec64da7b3d8d" diagramComponentId="" ref="general-threats" name="General Threats" desc="This component is used to group threats, weaknesses, and countermeasures on global scope, not to any specific component." library="" parentComponentRef="" componentDefinitionRef="">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="hospitals"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2018-05-29T09:16:01.113">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="MASVS-3.4" name="Frequently review the used cryptographic protocols and controls to ensure they are not deprecated" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the cryptographic protocols or algorithms used are widely considered suitable for
+                        security purposes. Frequently review all cryptographic protocols and algorithms to verify they
+                        are not deprecated.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the cryptographic protocols or algorithms used are not deprecated for security
+                            purposes.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-3.3-KEY-AES" name="Use other block modes rather than ECB mode for AES encryption" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
+          <desc>Advanced Encryption Standard (AES) is the widely accepted standard for symmetric encryption in
+                        mobile apps. It's an iterative block cipher that is based on a series of linked mathematical
+                        operations. AES performs a variable number of rounds on the input, each of which involve
+                        substitution and permutation of the bytes in the input block. Each round uses a 128-bit round
+                        key which is derived from the original AES key. As of this writing, no efficient cryptanalytic
+                        attacks against AES have been discovered. However, implementation details and configurable
+                        parameters such as the block cipher mode leave some margin for error.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        You shall configure AES encryption with Cipher Block Chaining (CBC) mode instead of ECB mode.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        In CBC mode, plaintext blocks are XORed with the previous ciphertext block. This ensures each
+                        encrypted block is unique and randomized even if blocks contain the same information. When
+                        storing encrypted data, we recommend using a block mode that also protects the integrity of the
+                        stored data, such as Galois/Counter Mode (GCM). The latter has the additional benefit that the
+                        algorithm is mandatory for each TLSv1.2 implementation, and thus is available on all modern
+                        platforms.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>If AES encryption is used, verify it's not configured with ECB mode.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-3.2" name="Use proven implementations of cryptographic primitives" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="jesperon@iriusrisk.com" library="" source="MANUAL" edited="false" stateChangeSource="" priority="">
+          <desc>It's recommended to use well-known algorithms that are widely regarded as secure. Mobile
+                        operating systems offer standard cryptographic APIs that implement those algorithms.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Random Number Generation" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0016/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing Symmetric Cryptography" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0013/"/>
+            <reference name="OWASP MASTG - MASVS-CRYPTO-1 - Testing the Configuration of Cryptographic Standard Algorithms" url="https://mas.owasp.org/MASTG/tests/android/MASVS-CRYPTO/MASTG-TEST-0014/"/>
+          </references>
+          <standards>
+            <standard ref="MASVS-CRYPTO-1" supportedStandardRef="owasp-masvs-testing-guide"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Carefully inspect all the cryptographic methods used within the source code, especially
+                            those that are directly applied to sensitive data. All cryptographic operations should use
+                            standard cryptographic APIs for Android and iOS.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2016-08-02T10:21:32.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general-threats" name="General Threats" desc="This component is used to group threats, weaknesses, and countermeasures on global scope, not to any specific component." library="">
+          <threats>
+            <threat ref="CAPEC-97" name="An attacker leverages Cryptanalysis to gain access to sensitive data" state="Expose" source="MANUAL" edited="false" owner="jesperon@iriusrisk.com" library="" editable="true">
+              <desc>Cryptanalysis is the process of finding weaknesses in cryptographic algorithms and
+                                using these weaknesses to decipher the ciphertext without knowing the secret key
+                                (instance deduction). Sometimes the weakness is not in the cryptographic algorithm
+                                itself, but rather in how it is applied that makes cryptanalysis successful. An attacker
+                                may have other goals as well, such as:
+                                The goal of the attacker performing cryptanalysis will depend on the specific needs of
+                                the attacker in a given attack context. In most cases, if cryptanalysis is successful at
+                                all, an attacker will not be able to go past being able to deduce some information about
+                                the plaintext (goal 3). However, that may be sufficient for an attacker, depending on
+                                the context.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-3.2" mitigation="34"/>
+                    <countermeasure ref="MASVS-3.3-KEY-AES" mitigation="33"/>
+                    <countermeasure ref="MASVS-3.4" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-3.2" mitigation="34"/>
+                <countermeasure ref="MASVS-3.3-KEY-AES" mitigation="33"/>
+                <countermeasure ref="MASVS-3.4" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="28dedef7-48d7-4986-a0b6-ee0c2bb399ef" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.583">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.930">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.931">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.931">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.715">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:00.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="75060b01-634d-49bf-addd-bb25d27f1724" diagramComponentId="7ef03c40-e025-445c-9ef6-3ac910aac821" ref="98c7aa8c-1a6c-4027-b40d-fdfbbcd895fc" name="Load Balancer" desc="" library="IR-Network-Components" parentComponentRef="" componentDefinitionRef="CD-LOAD-BALANCER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-LOAD-BALANCER2" name="Enable all access logs for Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="IR-Network-Components" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable all access logs for Load Balancers&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Logging should be configured to meet your organizational security and privacy policies. Enabling detailed logging to include information about events, event sources, timestamps, and users may assist in incident response activities.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable all access logs for Load Balancers.&lt;/p&gt; 
+&lt;p&gt;Please see Reference links for more information and examples.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Logging with Load Balancer" url="https://www.ibm.com/docs/en/was-zos/9.0.5?topic=SS7K4U_9.0.5/com.ibm.websphere.edge.doc/lb/tprf_log.htm"/>
+            <reference name="Securing Network Infrastructure Devices" url="https://www.cisa.gov/uscert/ncas/tips/ST18-001"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that the access logs are created when a user is visiting the load balancer.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.852">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-LOAD-BALANCER1" name="Use SSL Load Balancers" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="IR-Network-Components" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use SSL Load Balancers&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; An SSL load balancer is a load balancer that also performs encryption and decryption of data transported via HTTPS, which uses the Secure Sockets Layer (SSL) protocol or its successor, the Transport Layer Security (TLS) protocol, to secure HTTP data as it crosses the network. Encryption of sensitive information protects against potential attackers and man-in-the-middle attacks.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; An SSL load balancer acts as the server-side SSL endpoint for connections with clients, meaning that it performs the decryption of requests and encryption of responses that the web or application server would otherwise have to do. The process varies somewhat depending on the security of the network between the load balancer and server:&lt;/p&gt; 
+&lt;p&gt;- If the load balancer and server are on the same secured network (generally this means being behind a firewall), the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and forward the request to the server in the clear (unencrypted). It encrypts the server's response before returning it to the client.&lt;br&gt; - If the network between the load balancer and server is not secure, the SSL load balancer is usually configured to decrypt the request, extract the information needed for load balancing, and re-encrypt the request before forwarding it to the server. The process is reversed for the response from server to client.&lt;/p&gt; 
+&lt;p&gt;Offloading the decryption and encryption process, which is computationally intensive, frees web and application servers to perform the work they are designed for, which speeds content delivery and improves the overall user experience. If the network between load balancer and servers is secure, you only need to install and manage the SSL certificates on the load balancer instead of every web and application server. This significantly reduces administrative overhead if the group of servers is large.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="What Is an SSL Load Balancer?" url="https://www.nginx.com/resources/glossary/ssl-load-balancer/#:~:text=An%20SSL%20load%20balancer%20is,as%20it%20crosses%20the%20network."/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that you are using an SSL load balancer.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-02T20:38:56.851">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-LOAD-BALANCER2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="IR-Network-Components">
+          <threats>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="jesperon@iriusrisk.com" library="IR-Network-Components" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-LOAD-BALANCER1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="307606c7-312c-4080-a7e1-b83404c29dff" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.545">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.158">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="jesperon@iriusrisk.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-26T15:17:01.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="jesperon@iriusrisk.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/kubernetes-deployment.xml b/Templates/Submitted_Templates/kubernetes-deployment.xml
new file mode 100644
index 0000000..3290979
--- /dev/null
+++ b/Templates/Submitted_Templates/kubernetes-deployment.xml
@@ -0,0 +1,10601 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="kubernetes-deployment" name="Kubernetes Deployment" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTg5NCIgZHk9Ijg5MSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjAuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjIiIHZhbHVlPSJJbnRyYW5ldCBPZmZpY2UgbmV0d29ya3MiIHN0eWxlPSJpci5yZWY9MTIyMjc3ZjItN2E0Mi00NGFkLTk3ODYtZWMxMDA0MTA3MDMwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjYwIiB5PSIzNTAiIHdpZHRoPSI3MjAiIGhlaWdodD0iNjYwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNiIgdmFsdWU9IkJyb3dzZXIgLT4gQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0zMTI3NDc5NC1kOTVkLTQ2MmEtYTQ4MC1kN2FhNWJkOTA3NWI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyIiBzb3VyY2U9IjMiIHRhcmdldD0iMTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0zYjE3YjM3OS1hY2FhLTRiYTAtODg3OS0xOGUwNTJkNGViZGI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEwMS41IiB5PSI2MCIgd2lkdGg9IjEyOC41IiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj1mYzkxNmIxMy05MGM3LTRiNzgtYjJhZi1mOGY1ZDBlNDJmZWI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NDAiIHk9IjI2Mi41IiB3aWR0aD0iMTAwIiBoZWlnaHQ9Ijc3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJLOFMgQ2x1c3RlciIgaXIuc291cmNlU3R5bGU9IndoaXRlU3BhY2U9d3JhcDtodG1sPTE7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9I2I5ZDBlNjtzdHJva2VXaWR0aD0zO2ZpbGxDb2xvcj0jZGJlYWY3O2FsaWduPWxlZnQ7dmVydGljYWxBbGlnbj10b3A7IiBpZD0iNSI+PG14Q2VsbCBzdHlsZT0id2hpdGVTcGFjZT13cmFwO2h0bWw9MTtmb250Q29sb3I9IzhDOEM4QztzdHJva2VDb2xvcj0jMjBDOUUzO3N0cm9rZVdpZHRoPTE7ZmlsbENvbG9yPSNkYmVhZjc7YWxpZ249bGVmdDt2ZXJ0aWNhbEFsaWduPXRvcDtjb250YWluZXI9MTtyb3VuZGVkPTE7YXJjU2l6ZT0zO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7Zm9udFNpemU9MTM7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIwIiB5PSIyMzAiIHdpZHRoPSI0NjAiIGhlaWdodD0iMzUwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI2IiB2YWx1ZT0iTWljcm9zZXJ2aWNlIC0+IE1pY3Jvc2VydmljZSIgc3R5bGU9ImlyLnJlZj1lYzUyMDFmZi1iMzQzLTQ5MDEtODIxYi02NjI4MWU5OTM2OWU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI1IiBzb3VyY2U9IjciIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI0MDAiIHk9IjE1MCIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik1pY3Jvc2VydmljZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZjMwYjliNGEtNTNmNC00NDg3LWFiZjQtYzhjNWFiZjVkZWY4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI4MCIgeT0iMTgwIiB3aWR0aD0iMTMwIiBoZWlnaHQ9IjE1MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iOCIgdmFsdWU9Ik9BdXRoMiBBdXRob3JpemF0aW9uIFNlcnZlciIgc3R5bGU9ImlyLnJlZj01MmMwZjk5MC0zNGRlLTQ0ZDgtYTg1NS0yMzJlMzY2NWY5ODY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSI3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjMwIiB5PSIyOSIgd2lkdGg9Ijc0IiBoZWlnaHQ9IjY2LjUiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkiIHZhbHVlPSJNaWNyb3NlcnZpY2UgLT4gTWljcm9zZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWQ2M2U1NmY3LWMxMzctNDY3MS1iNDM4LWViMDVmODMwNmU1NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjI1O2VudHJ5WT0wO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjUiIHNvdXJjZT0iMTAiIHRhcmdldD0iNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjMwMCIgeT0iMTUwIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iTWljcm9zZXJ2aWNlIiBpci5zb3VyY2VTdHlsZT0iaXIucmVmPTY4MzFjZDYyLWQ4ODktNDgwOC1hMDZlLTc5YmI2NjBiOTQ4NTtyb3VuZGVkPTA7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNGNUY1RjU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTA7IiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zYzAxMGQ2ZC02ZjFkLTQyMzEtOGZiNi01OWM0MTg2M2I5MTg7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2NvbnRhaW5lcj0wOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjMwMCIgeT0iNDIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI1OCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTEiIHZhbHVlPSJBUEkgZ2F0ZXdheSAtPiBNaWNyb3NlcnZpY2UiIHN0eWxlPSJpci5yZWY9NGE3MTNiOGEtMjgzMS00NzU3LTk3NDEtYTQ5NmI1OGY2NzYzO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjUiIHNvdXJjZT0iMTIiIHRhcmdldD0iMTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMiIgdmFsdWU9IkFQSSBnYXRld2F5IiBzdHlsZT0iaXIucmVmPTc0MWJlYzU0LWRjNWUtNGE0Ny05MzhjLTVmZDA1MDBhN2YzNztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTQ2O2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI5Mi4yNSIgeT0iMzEiIHdpZHRoPSIxMDciIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEzIiB2YWx1ZT0iTWljcm9zZXJ2aWNlIC0+IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9MjdhZWNmOTQtMGIyZC00Zjg2LTkwNDgtM2JkMDk2ZmJkYTJmO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMTAiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0IiB2YWx1ZT0iQnJvd3NlciAtPiBMb2FkIEJhbGFuY2VyIiBzdHlsZT0iaXIucmVmPTVhYTBhOWQ3LWNjOTctNGVkMi1hYWFlLTVjOTcyODNhOWU2ZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnRhZ3M9Z2l0LHRlc3Qsc25tcDsiIHBhcmVudD0iMiIgc291cmNlPSIzIiB0YXJnZXQ9IjEyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxNjUiIHk9IjI3MiIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjE1IiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj1iZDVkMDE3NS0xYWU0LTQ2MDAtODlmNy1kNzkzODJiNDUyMWI7cm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2ZvbnRDb2xvcj0jOEM4QzhDO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xMDciIHk9IjYwIiB3aWR0aD0iMTI4LjUiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="TZ_CAMPN" uuid="122277f2-7a42-44ad-9786-ec1004107030" name="Intranet Office networks" desc="All intranet subnets allocated to user campuses, with exception of DC LAN." trustRating="75"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Microservice -&gt; PostgreSQL" ref="27aecf94-0b2d-4f86-9048-3bd096fbda2f" source="fc4bb90d-5fd7-41c7-86d5-f525405e131c" target="c9a60958-03d9-4f6b-9eb5-f4d45d2e8ee7">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Browser -&gt; Browser" ref="31274794-d95d-462a-a480-d7aa5bd9075b" source="7a006981-9b19-4f28-9179-8d188d0287bb" target="97fc3a11-542f-405d-936a-0e5db5bfd099">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="API gateway -&gt; Microservice" ref="4a713b8a-2831-4757-9741-a496b58f6763" source="f77649d4-e989-4cc1-a2fa-1563a46cbfab" target="fc4bb90d-5fd7-41c7-86d5-f525405e131c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Browser -&gt; Load Balancer" ref="5aa0a9d7-cc97-4ed2-aaae-5c97283a9e6f" source="7a006981-9b19-4f28-9179-8d188d0287bb" target="f77649d4-e989-4cc1-a2fa-1563a46cbfab">
+      <assets/>
+      <tags>
+        <tag tag="git"/>
+        <tag tag="snmp"/>
+        <tag tag="test"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Microservice -&gt; Microservice" ref="d63e56f7-c137-4671-b438-eb05f8306e57" source="fc4bb90d-5fd7-41c7-86d5-f525405e131c" target="8739495e-2db8-472a-b6b1-03d575b0f774">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Microservice -&gt; Microservice" ref="ec5201ff-b343-4901-821b-66281e99369e" source="8739495e-2db8-472a-b6b1-03d575b0f774" target="fc4bb90d-5fd7-41c7-86d5-f525405e131c">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="b2ee1f6e-67d1-4ac8-b32e-e1ca1fda5a56" diagramComponentId="52c0f990-34de-44d8-a855-232e3665f986" ref="3d2dd5b4-2170-459e-b72b-8e09b0ce946d" name="OAuth2 Authorization Server" desc="" library="" parentComponentRef="8739495e-2db8-472a-b6b1-03d575b0f774" componentDefinitionRef="oauth2-authorization-server">
+      <tags/>
+      <questions>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.478">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.761">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.883">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.811">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.665">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".
+ 
+</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.480">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.763">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.479">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="29" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;
+ &lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;
+ &lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:37.035">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.573">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="50" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt;
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="43" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="49" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;
+&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;
+&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;
+&lt;ol&gt;
+ &lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;
+ &lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;
+ &lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;
+&lt;/ol&gt;
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="28" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:40.828">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+              <reference name="RFC7636" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:37.288">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="29" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:40.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:41.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="28" state="Implemented" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against the following threats:&amp;nbsp; 
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;online guessing (a short expiration time will reduce the likelihood of success)&amp;nbsp;&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt; Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:41.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:42.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="c38d0231-a456-4fd6-9399-1d0b31f44fde" diagramComponentId="bd5d0175-1ae4-4600-89f7-d79382b4521b" ref="97fc3a11-542f-405d-936a-0e5db5bfd099" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.156">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.388">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.041">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.386">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.705">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.388">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:11.157">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.171">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.919">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:14.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:13.821">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3d0c92b1-1ff1-44be-b49d-aa4fd959c279" diagramComponentId="3c010d6d-6f1d-4231-8fb6-59c41863b918" ref="fc4bb90d-5fd7-41c7-86d5-f525405e131c" name="Microservice" desc="" library="" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.180">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.179">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.750">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.748">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="43" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.170">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.060">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.603">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.604">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.061">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:46.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7b5eaf70-b951-4ce2-8af1-b62ae46bdae3" diagramComponentId="fc916b13-90c7-4b78-b2af-f8f5d0e42feb" ref="c9a60958-03d9-4f6b-9eb5-f4d45d2e8ee7" name="PostgreSQL" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.619">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.229">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.913">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.231">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.231">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.932">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.934">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:48.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3dfa5b94-2832-42e4-a457-294bf620838e" diagramComponentId="741bec54-dc5e-4a47-938c-5fd0500a7f37" ref="f77649d4-e989-4cc1-a2fa-1563a46cbfab" name="API gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.675">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="47" state="Required" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes>&lt;p&gt;mycomment-test-notes-3&lt;/p&gt;</notes>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="47" state="Rejected" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes>&lt;p&gt;mycomment-test-notes&lt;/p&gt;</notes>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:47.585">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6993393c-beaf-4d29-b8f3-f59d269cb3f0" diagramComponentId="f30b9b4a-53f4-4487-abf4-c8c5abf5def8" ref="8739495e-2db8-472a-b6b1-03d575b0f774" name="Microservice" desc="" library="" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.592">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.714">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.283">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.715">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec).
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Rationale&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:49.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.496">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.163">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="31" state="Implemented" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Rationale&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="31" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.165">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:52.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:49.632">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Partly-Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1e7ef724-93f2-4129-a7ae-5f8b3ca344c3" diagramComponentId="3b17b379-acaa-4ba0-8879-18e052d4ebdb" ref="7a006981-9b19-4f28-9179-8d188d0287bb" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions>
+        <question ref="authentication.browser.login.yes" answer="true" manuallyModified="false"/>
+        <question ref="authn.browser.sf" answer="true" manuallyModified="false"/>
+        <question ref="bespokeImplementationOfStandardCrypto" answer="true" manuallyModified="false"/>
+        <question ref="browser.data.json" answer="true" manuallyModified="false"/>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="jquery" answer="true" manuallyModified="false"/>
+        <question ref="react" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
+        <question ref="tp.content" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="TZ_CAMPN"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-942-CORS_PERMISSIVE" name="CORS Access-Control-Allow-Origin policy is set to *" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses a cross-domain policy file that includes domains that should not be trusted.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A cross-domain policy file ("crossdomain.xml" in Flash and "clientaccesspolicy.xml" in Silverlight) defines a whitelist of domains to which a server is allowed to make cross-domain requests. When making a cross-domain request, the Flash or Silverlight client will first look for the policy file on the target server. If it is found, and the domain hosting the application is explicitly allowed to make requests, the request is made.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if a cross-domain policy file includes domains that should not be trusted, such as when using wildcards, then the application could be attacked by these untrusted domains. An overly permissive policy file allows many of the same types of attacks seen in Cross-Site Scripting (CWE-79). Once a user has executed a malicious Flash or Silverlight application, they are vulnerable to a variety of attacks. The attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker could also potentially send malicious requests to a website on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. In many of these cases, the attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-942: Overly Permissive Cross-domain Whitelist" url="https://cwe.mitre.org/data/definitions/942.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.592">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.102">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-233" name="Improper Handling of Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-525" name="Information Exposure Through Browser Caching" state="0" impact="100" issueId="" issueLink="">
+          <desc>For each web page, the application should have an appropriate caching policy specifying the
+                        extent to which the page and its form fields should be cached.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-525: Information Exposure Through Browser Caching" url="https://cwe.mitre.org/data/definitions/525.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores sensitive information without properly limiting read or write access by
+                        unauthorized actors.
+                        If read access is not properly restricted, then attackers can steal the sensitive information.
+                        If write access is not properly restricted, then attackers can modify and possibly delete the
+                        data, causing incorrect results and possibly a denial of service.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.066">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-613" name="Insufficient Session Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.597">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-613: Insufficient Session Expiration" url="https://cwe.mitre.org/data/definitions/613.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.557">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:32.443">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM" name="No consent mechanism (conform GDPR &amp; E-privacy Regulation)" state="0" impact="100" issueId="" issueLink="">
+          <desc>No consent mechanisms (or a consent mechanism that does not comply with the GDPR and E-privacy legislation consent requirements) so the organization is unable prove to data protection authorities that the processing is legitimate/legal.
+          </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY" name="No export functionality" state="0" impact="100" issueId="" issueLink="">
+          <desc>No exportability functionality (for users or admins) which would allow the user to (directly or indirectly via an admin) export his personal data in a clear, readable format and transport it to another data controller. </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.864">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.104">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-94" name="The application executes code retrieved from untrusted data sources" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The execution of untrusted code potentially grants direct control over the application; allowing an attacker to perform arbitrary operations, steal sensitive data, or use the application to launch other malicious attacks.&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.349">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-94: Improper Control of Generation of Code ('Code Injection')" url="https://cwe.mitre.org/data/definitions/94.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-598" name="The application sends sensitive information using the URL query string" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application uses the GET method to process requests that contain sensitive
+                        information, which can expose that information through the browser's history, Referers, web
+                        logs, and other sources.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.865">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-598: Information Exposure Through Query Strings in GET Request" url="https://cwe.mitre.org/data/definitions/598.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.559">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:10.170">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.594">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.637">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.472">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" name="Create a consent mechanism" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a consent mechanism which allows data subjects (persons of whom personal data is processed) to give their consent for certain processing activities. This is mainly used for cookies and secondary purposes such as direct marketing, newsletters, ...&lt;br/&gt; 
+          &lt;br/&gt;The consent mechanism often consists of a check box. These check boxes are required for every single secondary purpose (not allowed to implement one consent box for all purposes). The consent boxes should: &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;be inactive by default (the data subject should active the box)&lt;/li&gt;
+              &lt;li&gt;revocable (the data subject must be able to revoke the consent in a way that is as easy as it was to give consent, this can be done by implementing a platform on which the data subject can actively manage his/her consents) &lt;/li&gt;
+              &lt;li&gt;Traceable (a consent database is required to track when consent was given and revoked. This must include timestamps) &lt;/li&gt;
+              &lt;/ul&gt;
+              &lt;br /&gt;You must involve the DPO and/or legal department to decide on the legitimation that can be used.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.6" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.7" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify appropriate user personal data consent mechanisms are in place and are not pre-granted.&lt;/li&gt;
+                &lt;li&gt;Verify users can modify their data consent choices in a manner as easy as giving consent.&lt;/li&gt;
+                &lt;li&gt;Verify the above above user activities have been appropriately logged.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.178">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="not-store-sensitive-data-client-side" name="Do not store sensitive data on the client-side and remove sensitive authentication data" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Browsers and extensions provide a number of local storage options to persist data during HTTP interactions, including (but not limited to) Cookies, HTML5 local storage, session storage, IndexedDB, Flash cookies, and Silverlight isolated storage. These storage options may all be accessed by subsequent users of the browser or computer, and due to this some have experienced unauthorized and/or remote access to their contents. It is important that sensitive, private, and otherwise restricted data is handled with care on the client-side, and is not stored in insecure locations which may expose it to attack.&lt;/p&gt;&lt;p&gt;Sensitive data should not be persistently stored on the client-side due to the risk of exposure. However, during normal application operation, authenticated and other sensitive data is passed, stored in transient form, and displayed to users. It is important that any such temporary storage is purged in a timely manner and actively at the end of a user session.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do not store sensitive data in any kind of persistent, client-side storage.&lt;/li&gt;&lt;li&gt;Review any application or browser layer caching or temporary storage to ensure it doesn't expose data.&lt;/li&gt;&lt;li&gt;Sensitive data (including any authenticated content) stored in client-side objects such as the browser DOM should be cleared and removed actively at the end of user session (e.g. using the logout function), and where possible cleared through hard termination of the browser (e.g. closing the window or tab without using the proper application function).&lt;/li&gt;&lt;li&gt;Ensure any storage used during application interaction is temporary, and automatically cleared by the browser.&lt;/li&gt;&lt;li&gt;Where possible, set expiration times on client-side data to prevent accidental or malicious storage or disclosure.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify application functionality where sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application.&lt;/li&gt;&lt;li&gt;Ensure that authentication data is removed after the session termination, to test it, use the following steps:&lt;ul&gt;&lt;li&gt;Access the application as an authenticated user.&lt;/li&gt;&lt;li&gt;Manually or programmatically browse the site and use authenticated functionality&lt;/li&gt;&lt;li&gt;In particular, identify application functionality in which sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application. For example, review the HTML5 objects localStorage and sessionStorage for any sensitive data which is saved and not deleted after the logout&lt;/li&gt;&lt;li&gt;Alternatively, a Javascript console can be used with the command: &lt;i&gt;sessionStorage//Storage {length: 0}localStorage//Storage {length: 0}&lt;/i&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Required" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.221">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
+                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
+                            within the application.&lt;/li&gt;
+                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
+                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
+                            or PUT request).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
+                        practice and required minimum key lengths depend on the scenarios listed below.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
+            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
+            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
+                            &lt;br /&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
+                            bits&lt;/li&gt;
+                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
+&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
+&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
+  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
+  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
+  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
+            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
+            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+            <reference name="OWASP Top 10 Proactive Controls C8: Protect Data Everywhere" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
+ &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
+ &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;span&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
+              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" name="Implement a method to remove or export user data on demand" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data gathered from a user should be exportable. This does not include derived fields that were created by the organization, such as customer segmentation fields.&amp;nbsp;&lt;br&gt;&lt;br&gt;Provide or develop the means to facilitate data portability requests, such as download tools or Application Programming Interfaces (API).&amp;nbsp;&lt;br&gt;&lt;br&gt;Guarantees should be in place that personal data is transmitted in a structured, commonly used and machine-readable format, and ensure the interoperability of the data format, provided in the exercise of a data portability request.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="A Complete Guide to GDPR, CCPA and International Privacy Laws" url="https://secureprivacy.ai/complete-guide-to-international-data-privacy-laws/"/>
+          </references>
+          <standards>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Verify users have the functionality to request personal data transfer and/or download their own data.&lt;/li&gt;
+                        &lt;li&gt;Verify data is in a form acceptable to the Data Protection Practitioner.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.376">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="29" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="minimise-parameters-request" name="Minimize the number of parameters in a request" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP requests should contain only the necessary parameters to perform the action (such as hidden fields, Ajax variables, cookies and header values). And the response only return the required information. If unnecessary information is included in the HTTP request, the attack surface is enlarged unnecessarily.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify all requests have only the necessary parameters needed to work correctly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.377">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Overwrite memory with zeros or random data before release.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
+          </references>
+          <standards>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
+                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
+                            soon as they are not needed anymore.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:05.762">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="42" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.473">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-942-CORS" name="Restrict Cross Domain Origin policy through HTTP headers" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        If an overly permissive policy is specified then an attacker may be able to execute malicious
+                        code hosted on a third party site in the victim's browser under the security trust of the
+                        legitimate application. To prevent this:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Set the Access-Control-Allow-Origin header to only permit explicitly required trusted
+                        domains.&lt;/li&gt;
+                        &lt;li&gt;This set should be as small as possible, and follow the 'least privilege' paradigm.&lt;/li&gt;
+                        &lt;li&gt;Do not use untrusted or tainted user-data from untrusted domains in CORS responses
+                        without proper validation and sanitization.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;Access-Control-Allow-Origin:
+                            valid_host_name&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's end-points.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite, Fiddler)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Modify the Host: header in transit&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:32.218">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
+                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
+                        directives to control what data may be cached, where, and for how long. It is important to specify
+                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
+                        of authenticated and otherwise restricted access data, either in the users' browser or other
+                        devices.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
+                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
+                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:04.368">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.181">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+          </references>
+          <standards>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-94" name="Use JSON.parse to safely parse JSON objects" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AJAX requests used to pass data between the client and server may contain any data, including malicious executable content. This data must be parsed in a safe manner to prevent malicious code being executed compromising the application or it's users. Utilizing eval based solutions to process input data places the application at risk, as the malicious user has control over the data passed to the eval function, and could execute arbitrary code as a result. JSON.parse provides a means to convert the JSON payloads into an object without risk of execution.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure all tainted and potentially malicious data is processed using JSON.parse.&lt;/li&gt;&lt;li&gt;Data should be validated and sanitized using appropriate syntactic and semantic checks, ideally against a white-list of known-good input.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Identify application components receiving JSON as an input data.&lt;/li&gt;
+                            &lt;li&gt;Ensure the code interpreting the object is using the JSON.parse method.&lt;/li&gt;
+                            &lt;li&gt;If it is using an eval function the test should fail.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="35" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:35.835">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-05T09:49:36.223">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="74" state="Recommended" owner="evgeniiworkst@gmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Encryption should fail closed so that data does not get stored in an unprotected state. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
+            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
+                            &lt;br /&gt;
+                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
+                            the following conditions must be met: &lt;/p&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
+                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
+                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
+                            (e.g. gathered by different sessions or manipulation of session state) share a common
+                            divisor in the length.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-16T07:30:09.876">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-204-AUTOCOMPLETE" name="Attackers with access to a victim's client could read locally stored credentials" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>If the application accepts sensitive data through forms, then browsers could cache that data and play it if an attacker views the same form in the same browser. This requires the attacker to have access to the victim's browser.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-525">
+                  <countermeasures>
+                    <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-922">
+                  <countermeasures>
+                    <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
+                <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-ILLEGAL-PROCESSING-PERSONAL-DATA" name="Illegal processing of personal data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Processing personal data without legal grounds which makes it possible for data subjects to file a complaint at local Data Protection Authority which might lead to administrative fines.
+              </desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="WEB-QUERY-PARAM" name="Sensitive data is compromised through query parameters in the URL" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Sensitive data directly inserted as a parameters in the URL string could all too easily leak that data inside logs, browser history, etc.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Additionally this information could potentially be leveraged by an attacker to gain access to the entire system or user data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-598">
+                  <countermeasures>
+                    <countermeasure ref="CWE-598" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-598" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.
+                            </desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>If the component handles credentials and it does not do a proper clean-up of them in
+                                memory, they could be accessed by an attacker by inspecting the memory or reading
+                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-226" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-226" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-602">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-233">
+                  <countermeasures>
+                    <countermeasure ref="minimise-parameters-request" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="minimise-parameters-request" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ASVS-2014-3.3" name="Attackers could gain access to an open session, if they have access to a user's browser" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>If a user steps away from their browser for a few minutes and there is an
+                                opportunity for
+                                an attacker to access the browser, then they could gain access to the user's logged
+                                in
+                                session and perform operations on their behalf.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="10"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-613">
+                  <countermeasures>
+                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-942-CORS_PERMISSIVE" name="Attackers could gain access to sensitive data through a too permissive CORS policy" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An overly permissive policy file may allow many types of attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Once a user has visited a malicious site, they are vulnerable to a variety of attacks. For example, the attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker may be able to send malicious requests to a web site on behalf of the victim, which could be especially dangerous if the victim has administrator privileges to manage that site.&lt;/p&gt;&lt;p&gt;In many cases, these types of attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-942-CORS_PERMISSIVE">
+                  <countermeasures>
+                    <countermeasure ref="CWE-942-CORS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-942-CORS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="WEB-CLIENT-INJ" name="Attackers gain access to the system through Client-Side Code Injection" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an attacker is able to mix controlled input with Client-Side code he could direct attacks to steal sensitive data from users.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-94">
+                  <countermeasures>
+                    <countermeasure ref="CWE-94" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-94" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-SUBJECT-RIGTHS" name="Subjects cannot exercise their rights over their personal data" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Data subject cannot exercise their rights which makes it possible for them to file a complaint at the local Data Protection Authority which might lead to administrative fines.&amp;nbsp;&lt;br&gt;&lt;br&gt;Data subject = person of whom personal data is processed&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY">
+                  <countermeasures>
+                    <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                theft and then uses this key to forge signatures from the original signer to mislead a
+                                victim into performing actions that benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
+                                generation and then uses this key to forge signatures from the original signer to
+                                mislead a victim into performing actions which benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-330">
+                  <countermeasures>
+                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-345">
+                  <countermeasures>
+                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="crypto-operations" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="crypto-operations" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="evgeniiworkst@gmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/llm-template-template.xml b/Templates/Submitted_Templates/llm-template-template.xml
new file mode 100644
index 0000000..9333492
--- /dev/null
+++ b/Templates/Submitted_Templates/llm-template-template.xml
@@ -0,0 +1,7269 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="llm-template-template" name="llm-template template" tags="">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iNDY4NCIgZHk9IjIyNzkiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0ibnVsbCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjIiIHZhbHVlPSJQdWJsaWMiIHN0eWxlPSJpci5yZWY9NjM3NmQ1M2UtNjQ2MS00MTJiLThlMDQtN2IzZmUyYjM5N2RlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0xNDAyIiB5PSItNDk3IiB3aWR0aD0iMjY4NyIgaGVpZ2h0PSIxNTU2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJMTE0gQXBwbGljYXRpb24iIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjMiPjxteENlbGwgc3R5bGU9ImlyLnJlZj04YTY0ZTJmZi1jYThmLTQyYzItOTkzZi0xMTMyZjYyMGExNGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzM0IiB5PSI1NyIgd2lkdGg9IjE5MDciIGhlaWdodD0iMTIyNiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJMTE0gUHJvZHVjdGlvbiBTZXJ2aWNlcyAtPiBBcHBsaWNhdGlvbiBTZXJ2aWNlcyIgc3R5bGU9ImlyLnJlZj04ODk4ZTY2Zi0wYjgzLTQ4ODEtYTE0My1jODFhN2ZlZGFiZWE7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPS0wLjAyMTtleGl0WT0wLjU4MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MS4wMDM7ZW50cnlZPTAuNTQ4O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZXhpdFBlcmltZXRlcj0wO2VudHJ5UGVyaW1ldGVyPTA7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iOCIgdGFyZ2V0PSIxNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ijc3MCIgeT0iNTc5Ii8+PG14UG9pbnQgeD0iNzcwIiB5PSI1ODMiLz48bXhQb2ludCB4PSI0NTEiIHk9IjU4MyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iTExNIFByb2R1Y3Rpb24gU2VydmljZXMgLT4gUGx1Z2luL0V4dGVuc2lvbnMiIHN0eWxlPSJpci5yZWY9NTQ5NzlkODMtZmFlYS00YTAyLTkwMDYtNjUzNmE2OGZhNGM5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSI4IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjgiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1lZDIzYTFjMC0wNmZjLTRlMTctYmYwMS1mNDRjYjdiOWQxMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTA4OSIgeT0iMjY1IiB3aWR0aD0iMjYwIiBoZWlnaHQ9IjU0MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzkiIHZhbHVlPSJMTE0gQXV0b21hdGlvbiAoQWdlbnRzKSAtPiBMTE0gTW9kZWwiIHN0eWxlPSJpci5yZWY9Yzc4MTg2MjktYTE4NC00MzU5LWFiMGMtMDg4YWJmZDg2M2VkO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iOCIgc291cmNlPSI5IiB0YXJnZXQ9IjE0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOSIgdmFsdWU9IkxMTSBBdXRvbWF0aW9uIChBZ2VudHMpIiBzdHlsZT0iaXIucmVmPTFjZDU3MjNiLTI3ZTItNDNiNi1iMWVmLWEwODIxYjYxOTJmOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijg1IiB5PSIxMzEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzgiIHZhbHVlPSJMTE0gTW9kZWwgLT4gTExNIEF1dG9tYXRpb24gKEFnZW50cykiIHN0eWxlPSJpci5yZWY9NGVmNTBjZGEtZWQzZS00YzdiLWEyY2UtMzEwODg0ZDhlYTQ1O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjgiIHNvdXJjZT0iMTQiIHRhcmdldD0iOSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjIxNiIgeT0iMzg2Ii8+PG14UG9pbnQgeD0iMjE2IiB5PSIxNzYiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxNCIgdmFsdWU9IkxMTSBNb2RlbCIgc3R5bGU9ImlyLnJlZj0zODkxMzY1MS1hNjc5LTQ5NGUtYjQ5MS1mYWI5OTA1NmJiMDQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iOTAiIHk9IjM0MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IlRyYWluaW5nIERhdGFzZXQgJmFtcDsgUHJvY2Vzc2luZyAtPiBMTE0gUHJvZHVjdGlvbiBTZXJ2aWNlcyIgc3R5bGU9ImlyLnJlZj0wZTQ0Y2Y2NC1jZGQ4LTQ4MGEtYjZlZS1kM2Y3MWUxMTQyOTM7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxMSIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iVHJhaW5pbmcgRGF0YXNldCAmYW1wOyBQcm9jZXNzaW5nIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSIxMSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTE2MjRiY2FmLWI4MmUtNGZiOC1hM2UwLWU4MjA5NjFjZjNiMztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NTQiIHk9IjkxMSIgd2lkdGg9Ijg4OCIgaGVpZ2h0PSIyNzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iRmluZS1UdW5pbmcgRGF0YSIgc3R5bGU9ImlyLnJlZj1lNjU4MDkzNC03NDBmLTQ5NzQtOTdjZS01MWM4YzgyYWQ3MTQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjExIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE1MiIgeT0iODAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTMiIHZhbHVlPSJUcmFpbmluZyBEYXRhIiBzdHlsZT0iaXIucmVmPTI4ZmJmYjEzLWZiZmItNGRhNC05ZTljLWE1YTY5NjI2MzQwZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1vdGhlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TURFMU5pQXdMalF4TlRrMU5rTXdMalk0TnpreU1TQXdMalF4TlRrMU5pQXdMamcwTURFMU5pQXdMak0wTURjM05pQXdMamcwTURFMU5pQXdMakkwTnprMU5rTXdMamcwTURFMU5pQXdMakUxTlRFek5pQXdMalk0TnpreU1TQXdMakEzT1RrMU5qRWdNQzQxTURBeE5UWWdNQzR3TnprNU5UWXhRekF1TXpFeU16a3hJREF1TURjNU9UVTJNU0F3TGpFMk1ERTFOaUF3TGpFMU5URXpOaUF3TGpFMk1ERTFOaUF3TGpJME56azFOa013TGpFMk1ERTFOaUF3TGpNME1EYzNOaUF3TGpNeE1qTTVNU0F3TGpReE5UazFOaUF3TGpVd01ERTFOaUF3TGpReE5UazFObHBOTUM0M05qa3dPVFlnTUM0ME1qTXdPVFpETUM0M09UUTNOemdnTUM0ME1UQTJNek1nTUM0NE1UZzJOelFnTUM0ek9UUTROVGNnTUM0NE5EQXhOVFlnTUM0ek56WXhPREpXTUM0M05URTVOVFpETUM0NE5EQXhOVFlnTUM0NE5EUTNOellnTUM0Mk9EYzVNakVnTUM0NU1UazVOVFlnTUM0MU1EQXhOVFlnTUM0NU1UazVOVFpETUM0ek1USXpPVEVnTUM0NU1UazVOVFlnTUM0eE5qQXhOVFlnTUM0NE5EUTNOellnTUM0eE5qQXhOVFlnTUM0M05URTVOVFpXTUM0ek56WXhPREpETUM0eE9ERTJNemtnTUM0ek9UUTROVGNnTUM0eU1EVTFNelFnTUM0ME1UQTJNek1nTUM0eU16RXlNVFlnTUM0ME1qTXdPVFpETUM0ek1ETXpPREVnTUM0ME5UZzNNVElnTUM0ek9UZzBPVFlnTUM0ME56ZzVOVFlnTUM0MU1EQXhOVFlnTUM0ME56ZzVOVFpETUM0Mk1ERTRNVFlnTUM0ME56ZzVOVFlnTUM0Mk9UWTVNekVnTUM0ME5UZzNNVElnTUM0M05qa3dPVFlnTUM0ME1qTXdPVFphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTMxIiB5PSI4MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkFwcGxpY2F0aW9uIFNlcnZpY2VzIC0+IFRyYWluaW5nIERhdGFzZXQgJmFtcDsgUHJvY2Vzc2luZyIgc3R5bGU9ImlyLnJlZj05NDg4ZjdiYi04ZGUyLTQzMzgtOWE4ZS0wZmFmMWZmODFkNmU7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxNSIgdGFyZ2V0PSIxMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE4IiB2YWx1ZT0iQXBwbGljYXRpb24gU2VydmljZXMgLT4gTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIHN0eWxlPSJpci5yZWY9ZDA3MTU5ZjktYmI1Yi00MWM0LWFlZTYtNzM4NTFmOWMxZjYzO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSIxNSIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQXBwbGljYXRpb24gU2VydmljZXMiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9OTgzOGUzNzUtMWQxMy00MzY2LWI5OGQtNzZkOTBhYjYwMWYyO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE0OCIgeT0iMjQ1IiB3aWR0aD0iMzAyIiBoZWlnaHQ9IjYyMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTYiIHZhbHVlPSJDb3JlL0dyZWVuZmllbGQiIHN0eWxlPSJpci5yZWY9NDIyOWIzOTYtYmViOS00NjVjLWE3M2ItNTA2ZDhhYjY0N2VkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjE1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjEwOSIgeT0iMjc3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iUGx1Z2luL0V4dGVuc2lvbnMgLT4gTExNIFByb2R1Y3Rpb24gU2VydmljZXMiIHN0eWxlPSJpci5yZWY9YzI4MGRiMTEtY2RhNy00Zjk2LTkzMDItNmExNzI4ODFjMjhjO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuOTg3O2VudHJ5WT0wLjc3MjtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iMjAiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IlBsdWdpbi9FeHRlbnNpb25zIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSIyMCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTRjOWY4NDlkLTI3NTYtNDNmNC05YjdiLTJkZTg3YmJjZjZiMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNTMyIiB5PSIyNTkiIHdpZHRoPSIyNzUiIGhlaWdodD0iNTYxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI3IiB2YWx1ZT0iUGx1Z2luIFN5c3RlbSIgc3R5bGU9ImlyLnJlZj00NTIwOWU2NC1iYjM4LTQ2OWUtYjhmYS1mYjAzNTE5YmI2NTI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtUExVR0lOLVNZU1RFTTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijk1IiB5PSIyMzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzEiIHZhbHVlPSJMTE0wMSZhbXA7bmJzcDsmbHQ7YnI+UHJvbXB0IEluamVjdGlvbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU0MSIgeT0iMTA5IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMyIiB2YWx1ZT0iTExNMDQmbHQ7YnI+TW9kZWwgRG9TIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNjk4IiB5PSIxMDkiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDIiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iNDEiIHRhcmdldD0iOCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQxIiB2YWx1ZT0iTExNMDgmbHQ7YnI+RXhjZXNzaXZlIEFnZW5jeSIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjExMzMiIHk9IjkyIiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQzIiB2YWx1ZT0iTExNMDYmbHQ7YnI+U2Vuc2l0aXZlIEluZm9ybWF0aW9uIERpc2Nsb3N1cmUiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMzQyIiB5PSIyNiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI0NCIgdmFsdWU9IkxMTTAyJmx0O2JyPiZhbXA7bmJzcDtJbnNlY3VyZSBPdXRwdXQgSGFuZGxpbmciIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxMzQyIiB5PSIxMjMiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDYiIHZhbHVlPSJMTE0wOSZsdDticj5PdmVycmVsaWFuY2UiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNDg4IiB5PSIyNiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4MCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iNzciIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIxNjc0IiB5PSIxMDgzIi8+PG14UG9pbnQgeD0iMTY3NCIgeT0iOTMyIi8+PG14UG9pbnQgeD0iMTY3MCIgeT0iOTMyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNzciIHZhbHVlPSJMTE0wOCZsdDticj5FeGNlc3NpdmUgQWdlbmN5IiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTc4NyIgeT0iMTA0MyIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI3OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijc4IiB0YXJnZXQ9IjIwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNzgiIHZhbHVlPSJMTE0wNyAmbHQ7YnI+SW5zZWN1cmUgUGx1Z2luIERlc2lnbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE3ODciIHk9Ijg3OSIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NiIgdmFsdWU9IkxMTTAxJmx0O2JyPlByb21wdCZhbXA7bmJzcDsmbHQ7YnI+SW5qZWN0aW9uIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTUzNSIgeT0iODY2IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg3IiB2YWx1ZT0iTExNMDQmbHQ7YnI+TW9kZWwgRG9TIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iMTU0MSIgeT0iOTc2IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iTExNMDkmbHQ7YnI+T3ZlcnJlbGlhbmNlIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iOTMwIiB5PSI3MDgiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTEiIHZhbHVlPSJMTE0wMiZsdDticj5JbnNlY3VyZSBPdXRwdXQgSGFuZGxpbmciIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI3NDUiIHk9IjcwOCIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5MiIgdmFsdWU9IkxMTTA2Jmx0O2JyPlNlbnNpdGl2ZSBJbmZvcm1hdGlvbiBEaXNjbG9zdXJlIiBzdHlsZT0iZWxsaXBzZTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FzcGVjdD1maXhlZDtzaGFkb3c9MTtzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTE7Zm9udENvbG9yPSMwMDAwMDA7ZmlsbENvbG9yPSMzMzk5RkY7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTUyIiB5PSI3MDgiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTYiIHZhbHVlPSJMTE0wMyZsdDticj5UcmFpbmluZyBEYXRhIFBvaXNvbmluZyIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU3IiB5PSIxMDc1IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk3IiB2YWx1ZT0iTExNMDYmbHQ7YnI+U2Vuc2l0aXZlIEluZm9ybWF0aW9uIERpc2Nsb3N1cmUiIHN0eWxlPSJlbGxpcHNlO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YXNwZWN0PWZpeGVkO3NoYWRvdz0xO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzAwMDAwMDtmaWxsQ29sb3I9IzMzOTlGRjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNzUiIHk9IjEwNzUiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRG93bnN0cmVhbSBTZXJ2aWNlcyIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWVtcHR5LWNvbXBvbmVudDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iNCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTdkNDkxMWQxLWY5M2YtNGQ2OS05MGMwLWE1MjRkMjk2M2RmNjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1lbXB0eS1jb21wb25lbnQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMjk0IiB5PSIzNjQiIHdpZHRoPSIzMDEiIGhlaWdodD0iNjk2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI1IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9YWM5MDhmZDUtMDdiNS00YWZkLWJmYjEtMWQ3NmRkNTkwMmM1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjExMCIgeT0iMTAxIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJXZWIgU2VydmljZSIgc3R5bGU9ImlyLnJlZj05Y2VlMjNlMC01YTZiLTRiOTgtOGFhNC1mMDBjZGZkZjIwMjQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd055QXdMamcyTmpRM0lEQXVOVFk1TXpNMklEQXVPRGd6TXpZM1NEQXVNemcxTURFNVF6QXVNekl4TlRBM0lEQXVPRGd6TXpZM0lEQXVNamN3TURJZ01DNDRNekU0TnprZ01DNHlOekF3TWlBd0xqYzJPRE0yTjFZd0xqSXpNVFk1T1VNd0xqSTNNREF5SURBdU1UWTRNVGczSURBdU16SXhOVEEzSURBdU1URTJOams1SURBdU16ZzFNREU1SURBdU1URTJOams1U0RBdU5qRTFNREpETUM0Mk56ZzFNek1nTUM0eE1UWTJPVGtnTUM0M016QXdNaUF3TGpFMk9ERTROeUF3TGpjek1EQXlJREF1TWpNeE5qazVWakF1TmpJd05qQXhRekF1TnpJd05EVTVJREF1TmpFNE9EYzVJREF1TnpFd05qRXlJREF1TmpFM09UZ2dNQzQzTURBMU5UWWdNQzQyTVRjNU9FTXdMalk1TURrNU9TQXdMall4TnprNElEQXVOamd4TmpNeUlEQXVOakU0TnpreUlEQXVOamN5TlRJZ01DNDJNakF6TlRGYVRUQXVNelkxT0RVeklEQXVOakExTkRWRE1DNHpOalU0TlRNZ01DNDFPRGsxTnpFZ01DNHpOemczTWpVZ01DNDFOelkzSURBdU16azBOakF6SURBdU5UYzJOMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpVM05qY2dNQzQyTXpReE9EWWdNQzQxT0RrMU56RWdNQzQyTXpReE9EWWdNQzQyTURVME5VTXdMall6TkRFNE5pQXdMall5TVRNeU9DQXdMall5TVRNeE5DQXdMall6TkRJZ01DNDJNRFUwTXpZZ01DNDJNelF5U0RBdU16azBOakF6UXpBdU16YzROekkxSURBdU5qTTBNaUF3TGpNMk5UZzFNeUF3TGpZeU1UTXlPQ0F3TGpNMk5UZzFNeUF3TGpZd05UUTFXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJRekF1TnpJNE1qSTBJREF1T0Rjek1UWTVJREF1TnpFek5UZ3hJREF1T0RrNU5ETTBJREF1TmprNU1ESXlJREF1T0RrNU5ETTBRekF1TmpnME9UQXpJREF1T0RrNU5ETTBJREF1Tmpjd056QTNJREF1T0RjME56TTNJREF1TmpZek1Ua3pJREF1T0RNNE1EVTRUREF1TmpZeU5UQTRJREF1T0RNME5UZzBTREF1TnpNMU5UTTJTREF1TmpZeU5UQTRXazB3TGpVNU16WTBOQ0F3TGpnek5EVTROa3d3TGpZME5EUXlPQ0F3TGpnek5EVTRORU13TGpZME9EY3pNU0F3TGpnMU9URTBNeUF3TGpZMU5qQXlNeUF3TGpnNE1EQXpOeUF3TGpZMk5UVTJOeUF3TGpnNU5EWTJRekF1TmpNMU16TTVJREF1T0RnMU56TXlJREF1TmpFd01UY3pJREF1T0RZMU1ETTFJREF1TlRrMU16Y2dNQzQ0TXpjNE56Wk1NQzQxT1RNMk5EUWdNQzQ0TXpRMU9EWmFUVEF1TnpVek5qRTFJREF1T0RNME5UZzBUREF1T0RBME16azVJREF1T0RNME5UZzJRekF1TnpnNU9EYzJJREF1T0RZek16WWdNQzQzTmpNNU1UUWdNQzQ0T0RVek56VWdNQzQzTXpJME9EZ2dNQzQ0T1RRMk5UVkRNQzQzTkRFek9EZ2dNQzQ0T0RFd01ERWdNQzQzTkRnek16SWdNQzQ0TmpFNE9UUWdNQzQzTlRJM01UVWdNQzQ0TXprME5EVk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUk1NQzQ0TURRek9Ua2dNQzQ0TXpRMU9EWk1NQzQzTlRNMk1UVWdNQzQ0TXpRMU9EUmFUVEF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhRekF1T0RFMk1UYzJJREF1TnpZMU5UTTBJREF1T0RFMk9UZzVJREF1Tnpjek5ESTBJREF1T0RFMk9UZzVJREF1TnpneE5UQTBRekF1T0RFMk9UZzVJREF1Tnprek9ETXpJREF1T0RFMU1EazNJREF1T0RBMU56SXhJREF1T0RFeE5UZzVJREF1T0RFMk9Ea3pTREF1TnpVMk1USXlRekF1TnpVM016WTBJREF1T0RBMU5UazRJREF1TnpVNE1ERTBJREF1Tnprek56TXlJREF1TnpVNE1ERTBJREF1TnpneE5UQTBRekF1TnpVNE1ERTBJREF1TnpjMk1UUTJJREF1TnpVM09EZzVJREF1Tnpjd09EVTJJREF1TnpVM05qUTBJREF1TnpZMU5qVTBUREF1TnpVM01UZzRJREF1TnpVM09URTRUREF1T0RFME5qSTVJREF1TnpVM09URXhUREF1TnpVM01UZzRJREF1TnpVM09URTRXazB3TGpVNE16UXhOQ0F3TGpjMU56a3hNVXd3TGpZME1EZzFOaUF3TGpjMU56a3hPRU13TGpZME1ETXhJREF1TnpZMU5UZzBJREF1TmpRd01ESTVJREF1Tnpjek5EWTJJREF1TmpRd01ESTVJREF1TnpneE5UQTBRekF1TmpRd01ESTVJREF1TnpreE1qZzJJREF1TmpRd05EUTJJREF1T0RBd09ETTNJREF1TmpReE1qUTRJREF1T0RFd01EUTVUREF1TmpReE9USXlJREF1T0RFMk9Ea3pTREF1TlRnMk5EVTFRekF1TlRneU9UUTJJREF1T0RBMU56SXhJREF1TlRneE1EVTFJREF1Tnprek9ETXpJREF1TlRneE1EVTFJREF1TnpneE5UQTBRekF1TlRneE1EVTFJREF1Tnpjek5ESTBJREF1TlRneE9EWTNJREF1TnpZMU5UTTBJREF1TlRnek5ERTBJREF1TnpVM09URXhXazB3TGpZMU9EWXpJREF1TnpVM09URXlTREF1TnpNNU5ERXpRekF1TnpRd01EQTJJREF1TnpZMU5USTNJREF1TnpRd016SXlJREF1Tnpjek5ERTJJREF1TnpRd016SXlJREF1TnpneE5UQTBRekF1TnpRd016SXlJREF1TnpreE16ZzBJREF1TnpNNU9EVXhJREF1T0RBd09UWTJJREF1TnpNNE9UYzVJREF1T0RFd01URTFUREF1TnpNNE1qVXlJREF1T0RFMk9Ea3pTREF1TmpVNU56a3hRekF1TmpVNE5EVTRJREF1T0RBMU56TTRJREF1TmpVM056SXhJREF1Tnprek9EVTBJREF1TmpVM056SXhJREF1TnpneE5UQTBRekF1TmpVM056SXhJREF1TnpjMU5ETTRJREF1TmpVM09EazVJREF1TnpZNU5EZzBJREF1TmpVNE1qTTRJREF1TnpZek5qY3pUREF1TmpVNE5qTWdNQzQzTlRjNU1USklNQzQzTXprME1UTklNQzQyTlRnMk0xcE5NQzQzTXpNM05Ea2dNQzQyTnpBek5UaE1NQzQzTXpJME56Y2dNQzQyTmpnek5VTXdMamMyT0RBM055QXdMalkzT0RnMU9TQXdMamM1TmpZMk9DQXdMamN3TlRjeElEQXVPREE1TlRZeUlEQXVOelF3TWpFNVREQXVOelUxTkRFMElEQXVOelF3TWpJeVF6QXVOelV4TmpreUlEQXVOekV4TnpFMUlEQXVOelEwTVRNeUlEQXVOamczTWpNeklEQXVOek16TnpRNUlEQXVOamN3TXpVNFREQXVOek15TkRjM0lEQXVOalk0TXpWTU1DNDNNek0zTkRrZ01DNDJOekF6TlRoYVRUQXVOalkwTVRNZ01DNDJOamczT0RSTU1DNDJOalUxTmpZZ01DNDJOamd6TlVNd0xqWTFOVEUzT0NBd0xqWTROREkyTnlBd0xqWTBOelExTnlBd0xqY3dOell4TmlBd0xqWTBNek0xTmlBd0xqY3pOVEF6TkV3d0xqWTBNall6SURBdU56UXdNakl5VERBdU5UZzRORGd4SURBdU56UXdNakU1UXpBdU5qQXhNakF4SURBdU56QTJNVGMySURBdU5qSTVNVGs0SURBdU5qYzVOVGcwSURBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVXd3TGpZMk5ERXpJREF1TmpZNE56ZzBXazB3TGpZNU9UQXlNaUF3TGpZMk16VTNORU13TGpjeE5EVTNOeUF3TGpZMk16VTNOQ0F3TGpjek1ESXlOaUF3TGpZNU16VTFNeUF3TGpjek5qa3pJREF1TnpNMk5UQTJUREF1TnpNM05EZ3pJREF1TnpRd01qRTVTREF1TmpZd05UWXhRekF1TmpZMk9USXpJREF1TmprMU1qa3hJREF1Tmpnek1ESXlJREF1TmpZek5UYzBJREF1TmprNU1ESXlJREF1TmpZek5UYzBXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNU0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU1pSWdhR1ZwWjJoMFBTSXdMamt5SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05EQXdNemt4SURBdU1EUXdNRE01TVNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDYiIHk9IjM1NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMyIgdmFsdWU9IlBsdWdpbi9FeHRlbnNpb25zIC0+IE90aGVyIGRhdGFiYXNlIiBzdHlsZT0iaXIucmVmPTdmN2I5MmJkLTU4OTItNDYwNi04YjhiLTZkYTMxZWYwMDRlZDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjAiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0IiB2YWx1ZT0iUGx1Z2luL0V4dGVuc2lvbnMgLT4gV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9NmZiMTQyNzctYmU4OS00NjY5LWFhNzItZGRhNmE1ODRiM2E0O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMiIgc291cmNlPSIyMCIgdGFyZ2V0PSI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjYiIHZhbHVlPSJFeHRlcm5hbCBEYXRhIFNvdXJjZXMgLT4gVHJhaW5pbmcgRGF0YXNldCAmYW1wOyBQcm9jZXNzaW5nIiBzdHlsZT0iaXIucmVmPWIxNzgzZGI2LTk1YjctNDM3Yy05MTkwLTJhMDJkMGVlMWRjMDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjUiIHRhcmdldD0iMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNSIgdmFsdWU9IkV4dGVybmFsIERhdGEgU291cmNlcyIgc3R5bGU9ImlyLnJlZj02ZDg2NjVjZC0wNGVlLTQxMDctYmM1Mi03ZDRkMTI5OWE3Yzc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVd01ERTFOaUF3TGpReE5UazFOa013TGpZNE56a3lNU0F3TGpReE5UazFOaUF3TGpnME1ERTFOaUF3TGpNME1EYzNOaUF3TGpnME1ERTFOaUF3TGpJME56azFOa013TGpnME1ERTFOaUF3TGpFMU5URXpOaUF3TGpZNE56a3lNU0F3TGpBM09UazFOakVnTUM0MU1EQXhOVFlnTUM0d056azVOVFl4UXpBdU16RXlNemt4SURBdU1EYzVPVFUyTVNBd0xqRTJNREUxTmlBd0xqRTFOVEV6TmlBd0xqRTJNREUxTmlBd0xqSTBOemsxTmtNd0xqRTJNREUxTmlBd0xqTTBNRGMzTmlBd0xqTXhNak01TVNBd0xqUXhOVGsxTmlBd0xqVXdNREUxTmlBd0xqUXhOVGsxTmxwTk1DNDNOamt3T1RZZ01DNDBNak13T1RaRE1DNDNPVFEzTnpnZ01DNDBNVEEyTXpNZ01DNDRNVGcyTnpRZ01DNHpPVFE0TlRjZ01DNDROREF4TlRZZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNDROREF4TlRZZ01DNDRORFEzTnpZZ01DNDJPRGM1TWpFZ01DNDVNVGs1TlRZZ01DNDFNREF4TlRZZ01DNDVNVGs1TlRaRE1DNHpNVEl6T1RFZ01DNDVNVGs1TlRZZ01DNHhOakF4TlRZZ01DNDRORFEzTnpZZ01DNHhOakF4TlRZZ01DNDNOVEU1TlRaV01DNHpOell4T0RKRE1DNHhPREUyTXprZ01DNHpPVFE0TlRjZ01DNHlNRFUxTXpRZ01DNDBNVEEyTXpNZ01DNHlNekV5TVRZZ01DNDBNak13T1RaRE1DNHpNRE16T0RFZ01DNDBOVGczTVRJZ01DNHpPVGcwT1RZZ01DNDBOemc1TlRZZ01DNDFNREF4TlRZZ01DNDBOemc1TlRaRE1DNDJNREU0TVRZZ01DNDBOemc1TlRZZ01DNDJPVFk1TXpFZ01DNDBOVGczTVRJZ01DNDNOamt3T1RZZ01DNDBNak13T1RaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTM5MCIgeT0iMTM5NiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyOSIgdmFsdWU9IkVuZCBVc2VyIC0+IEFwcGxpY2F0aW9uIFNlcnZpY2VzIiBzdHlsZT0iaXIucmVmPTk0MjBkNGYwLWJlZTktNDhiMS05ZTAyLWFlOWFlODVkNGFmYTtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iMjgiIHRhcmdldD0iMTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzNzQiIHk9IjU3NCIvPjxteFBvaW50IHg9IjM3NCIgeT0iNjEzIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjgiIHZhbHVlPSJFbmQgVXNlciIgc3R5bGU9ImlyLnJlZj05ZTU2ZjZkMC03NTc1LTQyOGUtYTcwYS00Nzg4ZDk2N2I3NDE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9ZW1wdHktY29tcG9uZW50O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDAiIHk9IjUyOSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9IkxMTTEwJmFtcDtuYnNwOyZsdDticj5Nb2RlbCBUaGVmdCIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIyMCIgeT0iMzY5IiB3aWR0aD0iODAiIGhlaWdodD0iODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgxIiB2YWx1ZT0iTExNMDgmbHQ7YnI+RXhjZXNzaXZlIEFnZW5jeSIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjI0MDgiIHk9IjE0MiIgd2lkdGg9IjgwIiBoZWlnaHQ9IjgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4NCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjIiIHNvdXJjZT0iODMiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg1IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO2VudHJ5WD0wLjk5ODtlbnRyeVk9MC45NTM7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIyIiBzb3VyY2U9IjgzIiB0YXJnZXQ9IjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI4MyIgdmFsdWU9IkxMTTA1Jmx0O2JyPlN1cHBseSBDaGFpbiIgc3R5bGU9ImVsbGlwc2U7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthc3BlY3Q9Zml4ZWQ7c2hhZG93PTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jMDAwMDAwO2ZpbGxDb2xvcj0jMzM5OUZGOyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjIzOTkiIHk9IjEyMDEiIHdpZHRoPSI4MCIgaGVpZ2h0PSI4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMzMiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMzAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii0xMTAyLjU1NTQ4MDk1NzAzMTIiIHk9IjcxLjQ0NDM5Njk3MjY1NjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMzQiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMzEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii00MTUuNDQ0MzM1OTM3NSIgeT0iLTQ0LjExMTE0NTAxOTUzMTI1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTQ5NCIgeT0iLTE0NSIvPjxteFBvaW50IHg9Ii00MTUiIHk9Ii0xNDUiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIzMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTQxNS40NDQzMzU5Mzc1IiB5PSItNDAuNTU1NjAzMDI3MzQzNzUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMzI0IiB5PSItMTQ1Ii8+PG14UG9pbnQgeD0iLTQxNSIgeT0iLTE0NSIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjMyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxNTQuMzMzNDk2MDkzNzUiIHk9IjEwMS42NjY2MjU5NzY1NjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE1NiIgeT0iLTI5MSIvPjxteFBvaW50IHg9Ii0xNTYiIHk9IjEwMiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjQ3IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzMTQiIHk9Ii0zNi4xMTEwODM5ODQzNzUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI0OCIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI0MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzY5LjQ0NDU4MDA3ODEyNSIgeT0iLTM1LjIyMjIyOTAwMzkwNjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNDkiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQxMS4yMjI0MTIxMDkzNzUiIHk9Ii0zOS42NjY2ODcwMTE3MTg3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjUwIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQzIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIzODUuNDQ0NTgwMDc4MTI1IiB5PSIyNDUuNjY2Njg3MDExNzE4NzUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzOTEiIHk9Ii0zNzQiLz48bXhQb2ludCB4PSIzOTEiIHk9IjI0NiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjgyIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjgxIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIxMDQ2IiB5PSItMTMzLjg4ODg4NTQ5ODA0Njg4IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iODgiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iODYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQxNi41NTU2NjQwNjI1IiB5PSIyNDIuMTExMTQ1MDE5NTMxMjUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI4OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI4NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzUzLjQ0NDMzNTkzNzUiIHk9IjI0Ny40NDQ1MTkwNDI5Njg3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjkzIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjkwIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItOTEuMDAwMTIyMDcwMzEyNSIgeT0iMTQwLjc3NzgzMjAzMTI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTQiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii0yODMiIHk9IjEzNy4yMjIyOTAwMzkwNjI1IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iOTUiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii00NzYiIHk9IjE0Mi41NTU2MDMwMjczNDM3NSIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9Ijk4IiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9Ijk3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItMTY5LjIyMjE2Nzk2ODc1IiB5PSI4MTkiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItODUzIiB5PSI4OTQiLz48bXhQb2ludCB4PSItMTY5IiB5PSI4OTQiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSI5OSIgc3R5bGU9ImVkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSMwMDAwMDA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI5NiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iLTE2OS4yMjIxNjc5Njg3NSIgeT0iODIwLjc3Nzk1NDEwMTU2MjUiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItOTcxIiB5PSI4OTMiLz48bXhQb2ludCB4PSItMTY5IiB5PSI4OTMiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxMDAiIHN0eWxlPSJlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDAwMDAwO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iOTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii03NjkuMjIyMTY3OTY4NzUiIHk9IjUzNS40NDQ1MTkwNDI5Njg4IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTg1MyIgeT0iNTM1Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAxIiBzdHlsZT0iZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtmb250Q29sb3I9IzAwMDAwMDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9Ijk2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNzczLjY2NjYyNTk3NjU2MjUiIHk9IjUzNi4zMzMzNzQwMjM0Mzc1IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTk3MSIgeT0iNTM2Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="1"/>
+  </trustZones>
+  <questions>
+    <wizardQuestion ref="Status - NO" answer="true" manuallyModified="false"/>
+  </questions>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Training Dataset &amp; Processing -&gt; LLM Production Services" ref="0e44cf64-cdd8-480a-b6ee-d3f71e114293" source="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="LLM Model -&gt; LLM Automation (Agents)" ref="4ef50cda-ed3e-4c7b-a2ce-310884d8ea45" source="73fe679a-bbbf-41bc-a55e-2da6fff146ac" target="2d6db6bd-47e5-499d-a2cc-619112e664da">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="LLM Production Services -&gt; Plugin/Extensions" ref="54979d83-faea-4a02-9006-6536a68fa4c9" source="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" target="3050c74a-3bf7-4651-8413-63042ef8a1ff">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Plugin/Extensions -&gt; Web Service" ref="6fb14277-be89-4669-aa72-dda6a584b3a4" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="394f4bdf-cef5-4645-87b5-58d84f31c9ce">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Plugin/Extensions -&gt; Other database" ref="7f7b92bd-5892-4606-8b8b-6da31ef004ed" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="142aae3e-3ef4-4de4-9998-df16e6a7d62f">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="LLM Production Services -&gt; Application Services" ref="8898e66f-0b83-4881-a143-c81a7fedabea" source="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" target="c29771c0-8015-45c8-a153-319a23bb832b">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="End User -&gt; Application Services" ref="9420d4f0-bee9-48b1-9e02-ae9ae85d4afa" source="5d7cea0c-20cb-4d5b-8b11-47a6c2f5c748" target="c29771c0-8015-45c8-a153-319a23bb832b">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Application Services -&gt; Training Dataset &amp; Processing" ref="9488f7bb-8de2-4338-9a8e-0faf1ff81d6e" source="c29771c0-8015-45c8-a153-319a23bb832b" target="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="External Data Sources -&gt; Training Dataset &amp; Processing" ref="b1783db6-95b7-437c-9190-2a02d0ee1dc0" source="d0b398bc-1f18-465f-ab22-4c054bf72d0c" target="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Plugin/Extensions -&gt; LLM Production Services" ref="c280db11-cda7-4f96-9302-6a172881c28c" source="3050c74a-3bf7-4651-8413-63042ef8a1ff" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="LLM Automation (Agents) -&gt; LLM Model" ref="c7818629-a184-4359-ab0c-088abfd863ed" source="2d6db6bd-47e5-499d-a2cc-619112e664da" target="73fe679a-bbbf-41bc-a55e-2da6fff146ac">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Application Services -&gt; LLM Production Services" ref="d07159f9-bb5b-41c4-aee6-73851f9c1f63" source="c29771c0-8015-45c8-a153-319a23bb832b" target="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields>
+    <customField ref="Business Line" value=""/>
+    <customField ref="Message" value=""/>
+    <customField ref="Milestone 1" value=""/>
+    <customField ref="Milestone 1 - Deadline" value=""/>
+    <customField ref="Milestone 2" value=""/>
+    <customField ref="Milestone 2 - Deadline" value=""/>
+    <customField ref="Milestone 3" value=""/>
+    <customField ref="Milestone 3 - Deadline" value=""/>
+    <customField ref="NT - Custom Field" value=""/>
+    <customField ref="Project Management Details" value=""/>
+    <customField ref="Project Manager" value=""/>
+    <customField ref="Project Owner Email" value="jrabe@iriusrisk.com"/>
+    <customField ref="Release Date" value=""/>
+    <customField ref="Standard" value=""/>
+    <customField ref="Starting WF State" value=""/>
+    <customField ref="Test" value=""/>
+    <customField ref="Use Case" value=""/>
+    <customField ref="User" value=""/>
+    <customField ref="User Email Field" value=""/>
+    <customField ref="prod-sec-eng" value=""/>
+    <customField ref="workflow-testing" value=""/>
+  </customFields>
+  <components>
+    <component uuid="fc17be11-85cc-4bbc-8d12-5c1324a66682" diagramComponentId="9838e375-1d13-4366-b98d-76d90ab601f2" ref="c29771c0-8015-45c8-a153-319a23bb832b" name="Application Services" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="30fcef9c-0638-465c-bb7e-a80ce4b21456" diagramComponentId="4229b396-beb9-465c-a73b-506d8ab647ed" ref="d9e5487d-9f19-4fdb-bc79-858c23748be1" name="Core/Greenfield" desc="" library="CS-Default" parentComponentRef="c29771c0-8015-45c8-a153-319a23bb832b" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="c0742e70-143a-46b7-b6a9-58cfe9d548e5" diagramComponentId="7d4911d1-f93f-4d69-90c0-a524d2963df6" ref="d5c2ada9-ff09-4e53-a3e7-56212684e587" name="Downstream Services" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="c829c637-2bc8-4cdd-a3df-47685727c835" diagramComponentId="9e56f6d0-7575-428e-a70a-4788d967b741" ref="5d7cea0c-20cb-4d5b-8b11-47a6c2f5c748" name="End User" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="9fec8811-7c57-4e5e-bb48-6927ab82e942" diagramComponentId="6d8665cd-04ee-4107-bc52-7d4d1299a7c7" ref="d0b398bc-1f18-465f-ab22-4c054bf72d0c" name="External Data Sources" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.658">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.657">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.658">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="43ea5335-6867-458a-bed5-3a67b7c0b7a4" diagramComponentId="e6580934-740f-4974-97ce-51c8c82ad714" ref="ac7e20a0-6a22-4c8c-813f-e729fd8a8d0a" name="Fine-Tuning Data" desc="" library="CS-Default" parentComponentRef="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.034">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.664">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7f59eb83-e2fd-4392-898f-51e43fa10804" diagramComponentId="8a64e2ff-ca8f-42c2-993f-1132f620a14a" ref="a0ac1685-fc5d-45ce-9746-204f5b12b111" name="LLM Application" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="127a0791-f8f2-484a-951f-c82f617af821" diagramComponentId="1cd5723b-27e2-43b6-b1ef-a0821b6192f9" ref="2d6db6bd-47e5-499d-a2cc-619112e664da" name="LLM Automation (Agents)" desc="" library="CS-Default" parentComponentRef="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:07.377">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f8f45584-d668-4b9e-bbfe-c14f87ba4ea8" diagramComponentId="38913651-a679-494e-b491-fab99056bb04" ref="73fe679a-bbbf-41bc-a55e-2da6fff146ac" name="LLM Model" desc="" library="CS-Default" parentComponentRef="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.014">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.762">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.762">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.956">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.637">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.638">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6fbbddb2-f720-4f16-a78c-10d42bbcf940" diagramComponentId="ed23a1c0-06fc-4e17-bf01-f44cb7b9d111" ref="7fbe2f0a-3bfa-4bf8-9563-cf15364720c1" name="LLM Production Services" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="d31943c8-e615-468e-b528-af213d9363ab" diagramComponentId="ac908fd5-07b5-4afd-bfb1-1d76dd5902c5" ref="142aae3e-3ef4-4de4-9998-df16e6a7d62f" name="Other database" desc="" library="CS-Default" parentComponentRef="d5c2ada9-ff09-4e53-a3e7-56212684e587" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.598">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.912">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:02.913">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="470acbc1-382a-439b-8bb8-3c65ad447110" diagramComponentId="4c9f849d-2756-43f4-9b7b-2de87bbcf6b0" ref="3050c74a-3bf7-4651-8413-63042ef8a1ff" name="Plugin/Extensions" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.106">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.025">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="45ebb509-eb40-48bb-98bf-d2a6ec32d2df" diagramComponentId="45209e64-bb38-469e-b8fa-fb03519bb652" ref="cedb6ad1-7374-46a0-8c7d-9534fcc468ab" name="Plugin System" desc="" library="IR-Functional-Components" parentComponentRef="3050c74a-3bf7-4651-8413-63042ef8a1ff" componentDefinitionRef="CD-PLUGIN-SYSTEM">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.818">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.817">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-94" name="The application executes code retrieved from untrusted data sources" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The execution of untrusted code potentially grants direct control over the application; allowing an attacker to perform arbitrary operations, steal sensitive data, or use the application to launch other malicious attacks.&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.819">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-94: Improper Control of Generation of Code ('Code Injection')" url="https://cwe.mitre.org/data/definitions/94.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-PLUGIN-PERMISSIONS" name="Assign specific permissions and privileges to plugins based on their intended functionality" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Assign specific permissions and privileges to plugins based on their intended functionality&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Assigning specific permissions and privileges to plugins can help to limit the resources and actions that plugins are able to access or perform within the system. This can help to prevent malicious plugins from accessing sensitive resources or performing unauthorized actions that could compromise the security of the system.&lt;/p&gt;&lt;p&gt;When assigning permissions and privileges to plugins, it is important to consider the specific functionality and requirements of each plugin. For example, a plugin that provides read-only access to a database may only require read permissions, while a plugin that performs write operations may require write permissions.&lt;/p&gt;&lt;p&gt;By assigning specific permissions and privileges to plugins based on their intended functionality, you can help to ensure that plugins are only able to access or perform the actions that are necessary for their intended purpose, reducing the risk of plugin-related attacks and protecting the security of the system.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the specific functionality and requirements of each plugin. This can be done by reviewing the plugin documentation or by analyzing the plugin code.&lt;/li&gt;&lt;li&gt;Assign specific permissions and privileges to each plugin based on its intended functionality. This can involve creating custom roles or permissions for each plugin, or using existing roles or permissions that are appropriate for the plugin.&lt;/li&gt;&lt;li&gt;Configure access controls and permissions for the plugin system to ensure that plugins are only able to access or perform the actions that are necessary for their intended purpose. This can involve using role-based access controls, attribute-based access controls, or other access control mechanisms.&lt;/li&gt;&lt;li&gt;Regularly review and update the permissions and privileges assigned to plugins to ensure that they remain appropriate and relevant to their intended functionality.&lt;/li&gt;&lt;li&gt;Monitor plugin activity and resource usage to detect any unusual or unauthorized behavior that could indicate a security breach or compromise.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Assigning specific permissions and privileges to plugins can have an impact on the performance. This is because the access control mechanisms used to enforce these permissions and privileges require additional computation and resource usage to check and enforce access.&lt;/p&gt;&lt;p&gt;To minimize the impact, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when assigning permissions and privileges to plugins. This may involve using lightweight access control mechanisms, optimizing the access control process for maximum efficiency, and monitoring resource usage to prevent excessive resource consumption.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the plugin documentation: Familiarize yourself with the documentation provided by the plugin developers. Look for any information regarding the specific permissions and privileges required for each plugin.&lt;/li&gt;&lt;li&gt;Identify the intended functionality of each plugin: Determine the intended purpose and functionality of each plugin. Understand the specific actions the plugins are designed to perform and the resources they may require access to.&lt;/li&gt;&lt;li&gt;Develop a permissions matrix: Create a matrix that lists all the plugins being used and their intended functionality. Identify the permissions and privileges required by each plugin to fulfill its intended purpose.&lt;/li&gt;&lt;li&gt;Configure permissions and privileges: Access the system or platform where the plugins are installed and configure the permissions and privileges accordingly. Ensure that the assigned permissions align with the intended functionality of each plugin as identified in the permissions matrix.&lt;/li&gt;&lt;li&gt;Test plugin functionality: Test each plugin to verify that it can perform its intended actions and access the necessary resources. Execute various scenarios and use cases to validate that the permissions and privileges assigned to the plugins do not hinder their functionality.&lt;/li&gt;&lt;li&gt;Test restricted functionality: Verify that the plugins are appropriately restricted from performing actions outside their intended functionality. Attempt to execute actions or access resources that are not within the scope of each plugin's permissions. The system should prevent or deny such unauthorized actions.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.731">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-PLUGIN-SANDBOX" name="Consider using a sandboxed environment or runtime that restricts the execution environment" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Consider using a sandboxed environment or runtime that restricts the execution environment.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;A sandboxed environment is a controlled environment that limits the resources and permissions available to an application or process, preventing it from accessing sensitive data or system resources. By using a sandboxed environment or runtime for plugins, the execution of plugins can be restricted to a secure and isolated environment, preventing them from accessing sensitive data or system resources outside of the sandbox. This can help to mitigate the risk of malicious plugins executing unauthorized code and compromising the security of the system.&lt;/p&gt;&lt;p&gt;Implementing a sandboxed environment or runtime for plugins requires careful consideration of the requirements and limitations of the plugin system and the specific use case. It may involve configuring access controls, limiting resource usage, and monitoring plugin activity within the sandbox.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the plugin systems and applications that are most critical to the security of your software environment. These are the systems that should be prioritized for sandboxing.&lt;/li&gt;&lt;li&gt;Research and evaluate sandboxing tools or runtimes that are suitable for your plugin systems and applications. Consider factors such as compatibility, security features, and ease of use.&lt;/li&gt;&lt;li&gt;Develop a sandboxing strategy that outlines how plugins will be sandboxed, what resources will be restricted, and how access controls will be configured.&lt;/li&gt;&lt;li&gt;Configure access controls to limit the resources and permissions available to plugins within the sandbox. This may include restricting network access, file system access, and system privileges.&lt;/li&gt;&lt;li&gt;Monitor plugin activity within the sandbox to detect any unusual or suspicious behavior. This can be done using monitoring tools or by implementing logging and auditing mechanisms.&lt;/li&gt;&lt;li&gt;Limit resource usage within the sandbox to prevent plugins from consuming excessive resources. This can help to prevent denial-of-service attacks and other resource-intensive attacks.&lt;/li&gt;&lt;li&gt;Ensure that plugins are properly authenticated, validated, and authorized before they are executed within the sandbox. This can help to prevent the execution of malicious plugins.&lt;/li&gt;&lt;li&gt;Download plugins only from trusted sources and verify their authenticity before installing them within the sandbox.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing a sandboxed environment or runtime for plugins can have an impact on the performance of the application. To minimize it, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when implementing a sandboxed environment or runtime. This may involve configuring access controls to balance security and performance, monitoring resource usage within the sandbox, and optimizing the sandboxing process for maximum efficiency.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CWE CATEGORY: Privilege / Sandbox Issues" url="https://cwe.mitre.org/data/definitions/265.html"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify that a sandboxed environment or runtime has been implemented for the plugin system. This can be done by reviewing the system architecture and configuration.&lt;/li&gt;&lt;li&gt;Verify that access controls have been configured to limit the resources and permissions available to plugins within the sandbox. This can be done by attempting to access restricted resources or perform unauthorized actions within the sandbox.&lt;/li&gt;&lt;li&gt;Verify that resource usage within the sandbox is being monitored and limited to prevent plugins from consuming excessive resources. This can be done by monitoring resource usage metrics and attempting to perform resource-intensive actions within the sandbox.&lt;/li&gt;&lt;li&gt;Verify that plugins are being properly authenticated, validated, and authorized before they are executed within the sandbox. This can be done by attempting to execute a malicious plugin or a plugin that has not been properly authenticated or authorized.&lt;/li&gt;&lt;li&gt;Verify that plugins are being downloaded only from trusted sources and that their authenticity is being verified before installation within the sandbox. This can be done by attempting to download and install a plugin from an untrusted source or a plugin that has not been properly verified.&lt;/li&gt;&lt;li&gt;Attempt to execute a plugin outside of the sandboxed environment or runtime and verify that it is unable to access restricted resources or perform unauthorized actions.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.731">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" name="Encrypt sensitive data at rest and in transit within the plugin system" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Encrypt sensitive data at rest and in transit within the plugin system&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest and in transit involves the implementation of encryption techniques to protect sensitive data stored and transmitted within the plugin system. Encryption ensures that data is transformed into a secure and unreadable format, providing confidentiality and integrity.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Encrypting data at rest: It involves applying encryption to sensitive data when it is stored or persisted within the plugin system. This could include encrypting data in databases, file systems, or any other storage mechanisms used by the plugins. Encryption prevents unauthorized access to the data even if the storage medium is compromised.&lt;/li&gt;&lt;li&gt;Encrypting data in transit: It focuses on securing data as it is transmitted between different components or systems within the plugin environment. This includes encrypting data sent over networks, APIs, or any communication channels utilized by the plugins. Encryption safeguards the data from interception or tampering during transit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Encryption algorithms and protocols: Select strong encryption algorithms and protocols that are considered secure and widely accepted within the industry. Examples include AES (Advanced Encryption Standard) for data at rest and TLS (Transport Layer Security) for data in transit.&lt;/li&gt;&lt;li&gt;Key management: Develop robust key management practices to ensure the secure generation, storage, distribution, rotation, and revocation of encryption keys. Proper key management is essential for maintaining the confidentiality and integrity of the encrypted data.&lt;/li&gt;&lt;li&gt;Data classification and scope: Identify and classify the sensitive data that requires encryption within the plugin system. Clearly define the scope of what data needs to be encrypted, taking into account regulatory requirements and privacy considerations.&lt;/li&gt;&lt;li&gt;Encryption implementation: Implement encryption mechanisms at appropriate points within the plugin system. This may involve integrating encryption libraries, utilizing encryption modules or APIs, or leveraging encryption capabilities provided by the underlying infrastructure or platform.&lt;/li&gt;&lt;li&gt;Certificate management: When encrypting data in transit, employ digital certificates for secure communication channels. Properly manage and validate certificates to ensure the authenticity and integrity of the encryption process.&lt;/li&gt;&lt;li&gt;Testing and validation: Conduct thorough testing to verify the effectiveness and correctness of the encryption implementation. Validate that sensitive data is encrypted both at rest and in transit, and that decryption is only possible with authorized access and proper authentication.&lt;/li&gt;&lt;li&gt;Compliance and auditing: Ensure that the encryption practices implemented align with relevant regulatory requirements and industry standards. Maintain proper documentation and conduct periodic audits to validate compliance and adherence to encryption policies.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing encryption within the plugin system can have an impact on the performance of the application. The extent of the impact depends on various factors, including the encryption algorithms used, the size and complexity of the data being encrypted, the processing power of the system, and the efficiency of the encryption implementation.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Special Publication 800-111: Guide to Storage Encryption Technologies for End User Devices" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf"/>
+            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sensitive data: Determine the types of sensitive data that need encryption within the plugin system.&lt;/li&gt;&lt;li&gt;Data at rest testing: Verify that the selected sensitive data is properly encrypted when stored or persisted within the plugin system.&lt;/li&gt;&lt;li&gt;Data in transit testing: Ensure that sensitive data is transmitted over secure communication channels using appropriate encryption protocols, such as TLS/SSL.&lt;/li&gt;&lt;li&gt;Key management testing: Evaluate the secure generation, storage, rotation, and revocation of encryption keys.&lt;/li&gt;&lt;li&gt;Performance impact assessment: Measure the impact of encryption on system performance, including encryption/decryption time and network latency.&lt;/li&gt;&lt;li&gt;Compliance validation: Confirm that the encryption implementation aligns with relevant regulatory requirements and industry standards.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing TLS/SSL encryption" url="https://testssl.sh/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-PLUGIN-CODE-REVIEW" name="Implement a thorough code review process for all plugins before allowing them to be installed or executed" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement a thorough code review process for all plugins before allowing them to be installed or executed&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Implement a code review process involves conducting a comprehensive examination of the code within plugins before permitting their installation or execution. This process aims to identify and mitigate potential security vulnerabilities, malicious code, or unintended functionality that could pose a threat to the system or platform.&lt;/p&gt;&lt;p&gt;By implementing a thorough code review process, organizations can gain better control over the quality and security of the plugins being utilized, ensuring that they align with the intended functionality and meet the required security standards. This countermeasure provides an additional layer of protection against potential risks associated with plugins, as it allows for the identification and removal of any malicious or vulnerable code.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Establish code review guidelines: Develop a set of guidelines or standards that define the criteria for code review. These guidelines should encompass security best practices, coding standards, and compliance requirements specific to the organization or platform.&lt;/li&gt;&lt;li&gt;Assign trained reviewers: Designate individuals or a team with expertise in code analysis and security to conduct the reviews. Ensure that they have the necessary knowledge and skills to identify potential security issues, vulnerabilities, and coding flaws.&lt;/li&gt;&lt;li&gt;Review process integration: Incorporate the code review process into the overall software development lifecycle (SDLC) or plugin management process. Define at which stage of the process the code review should occur to minimize any delays in installation or execution.&lt;/li&gt;&lt;li&gt;Review tools and automation: Leverage code analysis and review tools to assist in the review process. These tools can help identify common security vulnerabilities and coding errors more efficiently, increasing the effectiveness and speed of the code review.&lt;/li&gt;&lt;li&gt;Security-focused code review: Focus the code review process on identifying security-related issues, such as input validation flaws, access control vulnerabilities, insecure data handling, and potential injection attacks. Look for any indicators of malicious code, including backdoors, logic bombs, or unauthorized data exfiltration.&lt;/li&gt;&lt;li&gt;Documentation and tracking: Maintain thorough documentation of the code review process, including any identified issues, their severity, and the corresponding actions taken to address them. Track the progress of each code review to ensure that all plugins undergo the necessary scrutiny before installation or execution.&lt;/li&gt;&lt;li&gt;Ongoing code review: Establish a process for periodic or regular code reviews of installed plugins. This ensures that any code changes or updates to plugins are also subject to review, reducing the risk of introducing vulnerabilities through subsequent modifications.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing a thorough code review process for all plugins before allowing them to be installed or executed can have an impact on the performance of the application. The extent of the impact depends on various factors such as the size and complexity of the plugins, the frequency of code reviews, and the efficiency of the code review process itself.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Understand the code review process: Gain a clear understanding of the defined code review process and its requirements.&lt;/li&gt;&lt;li&gt;Review documentation: Evaluate the documentation that outlines the code review process, including guidelines and checklists.&lt;/li&gt;&lt;li&gt;Perform sample code reviews: Simulate the code review process by conducting sample reviews on representative plugins.&lt;/li&gt;&lt;li&gt;Review documentation and tracking: Validate that comprehensive documentation is maintained, capturing identified issues, severity, and actions taken to address them. Verify the accuracy of the code review tracking process.&lt;/li&gt;&lt;li&gt;Assess code review integration: Ensure that the code review process is seamlessly integrated into the overall software development or plugin management process.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" name="Implement mechanisms to verify the integrity of plugin code at runtime" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement mechanisms to verify the integrity of plugin code at runtime&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Verifying the integrity of plugin code at runtime involves checking that the code has not been modified or tampered with since it was installed or last verified. This can help to prevent malicious plugins from executing unauthorized code and compromising the security of the system.&lt;/p&gt;&lt;p&gt;Implementing mechanisms to verify the integrity of plugin code at runtime may involve using techniques such as code signing, checksum verification, or digital signatures. These techniques can be used to ensure that the plugin code has not been modified or tampered with since it was signed or verified.&lt;/p&gt;&lt;p&gt;By implementing mechanisms to verify the integrity of plugin code at runtime, you can help to ensure that only trusted and authorized plugins are executed within the system, and that the security of the system is not compromised by malicious plugins.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement code signing for plugins. This involves signing the plugin code using a digital certificate, which can be verified at runtime to ensure that the code has not been modified or tampered with.&lt;/li&gt;&lt;li&gt;Use checksum verification to verify the integrity of plugin code at runtime. This involves calculating a checksum value for the plugin code at install time, and then verifying that the checksum value matches at runtime to ensure that the code has not been modified.&lt;/li&gt;&lt;li&gt;Use digital signatures to verify the integrity of plugin code at runtime. This involves using cryptographic techniques to sign the plugin code and verify the signature at runtime to ensure that the code has not been modified or tampered with.&lt;/li&gt;&lt;li&gt;Implement runtime integrity checking mechanisms that monitor the execution of plugins and detect any unauthorized modifications or tampering.&lt;/li&gt;&lt;li&gt;Limit access to plugin installation directories and files to prevent unauthorized modification or tampering of plugin code.&lt;/li&gt;&lt;li&gt;Regularly update and patch the plugin system and its dependencies to address any known vulnerabilities or weaknesses that could be exploited by attackers.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing mechanisms to verify the integrity of plugin code can have an impact on the performance. This is because the verification process involves additional computation and resource usage to check the integrity of the plugin code.&lt;/p&gt;&lt;p&gt;To minimize the impact, it is important to carefully consider the requirements and limitations of the plugin system and the specific use case when implementing mechanisms to verify the integrity of plugin code at runtime. This may involve using lightweight verification mechanisms, optimizing the verification process for maximum efficiency, and monitoring resource usage to prevent excessive resource consumption.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting Software Integrity through code signing" url="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925977"/>
+            <reference name="Top 25 Series - Rank 20 - Download of Code Without Integrity Check" url="https://software-security.sans.org/blog/2010/04/05/top-25-series-rank-20-download-code-integrity-check/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify that the plugin code is signed or checksummed at install time. This can be done by reviewing the installation process and verifying that the code is signed or checksummed.&lt;/li&gt;&lt;li&gt;Verify that the plugin code is verified at runtime to ensure that it has not been modified or tampered with. This can be done by monitoring the verification process and verifying that it detects any unauthorized modifications or tampering.&lt;/li&gt;&lt;li&gt;Verify that access to plugin installation directories and files is limited to prevent unauthorized modification or tampering of plugin code. This can be done by attempting to modify or tamper with the plugin code within the installation directories and files.&lt;/li&gt;&lt;li&gt;Verify that runtime integrity checking mechanisms are in place and are able to detect any unauthorized modifications or tampering of plugin code. This can be done by attempting to modify or tamper with the plugin code at runtime and verifying that the mechanisms detect the unauthorized changes.&lt;/li&gt;&lt;li&gt;Verify that the plugin system and its dependencies are regularly updated and patched to address any known vulnerabilities or weaknesses that could be exploited by attackers. This can be done by reviewing the update and patching process and verifying that it is effective in addressing vulnerabilities and weaknesses.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.730">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-HASHING-THECHNIQUES" name="Use code signing or hashing techniques to detect any modifications or tampering" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use code signing or hashing techniques to detect any modifications or tampering&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Code signing entails digitally signing the code with a cryptographic signature, using a trusted certificate, to verify its authenticity and integrity. Hashing techniques generate unique hash values or checksums for the code, allowing subsequent comparisons to detect any alterations or tampering. This countermeasure help protect against unauthorized modifications, ensure the code's integrity, and establish trust in the software or code's source and integrity.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implementation of Code Signing: Obtain a digital certificate from a trusted certificate authority (CA) and use it to digitally sign the code. This process involves generating a cryptographic signature that validates the authenticity and integrity of the code.&lt;/li&gt;&lt;li&gt;Verification of Code Signatures: Implement a verification process to validate the digital signatures of the code during runtime or installation. This ensures that the code has not been tampered with or modified since it was signed.&lt;/li&gt;&lt;li&gt;Secure Storage of Certificates: Safely store the digital certificates used for code signing in a secure location, protecting them from unauthorized access or tampering.&lt;/li&gt;&lt;li&gt;Periodic Certificate Renewal: Regularly review the expiration dates of the digital certificates and renew them in a timely manner to maintain the validity of code signatures.&lt;/li&gt;&lt;li&gt;Secure Distribution of Code: Establish secure distribution channels for the code, ensuring that it is not compromised during transit. Implement measures such as secure file transfer protocols (e.g., HTTPS) or code signing during deployment to maintain the integrity of the code.&lt;/li&gt;&lt;li&gt;Hash Verification: Implement hashing techniques to compute and store hash values or checksums for the code files. Periodically compare these hash values against the current versions to detect any modifications or tampering.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;Implementing code signing or hashing techniques have a minimal impact on the performance.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Introduction to Code Signing" url="https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537361(v=vs.85)"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify code signature validation, including testing for tampered or invalid signatures.&lt;/li&gt;&lt;li&gt;Compare hash values to detect unauthorized modifications.&lt;/li&gt;&lt;li&gt;Test code distribution channels for integrity and tampering detection.&lt;/li&gt;&lt;li&gt;Validate certificate validity and renewal processes.&lt;/li&gt;&lt;li&gt;Evaluate performance impact of the control.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:03.729">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="JamesRabe" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-02-22T18:19:36.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
+          <threats>
+            <threat ref="CAPEC-122-PLUGIN-SYSTEM" name="An adversary is able to exploit features of the plugin system that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An adversary takes advantage of a vulnerability in a plugin system to execute malicious code. Plugin systems are used in many software applications to extend functionality, and they typically allow third-party developers to create and add their own plugins to the system. However, if the plugin system is not designed or implemented securely, it can be vulnerable to attack.&lt;/p&gt;&lt;p&gt;An attacker can exploit a vulnerability in the plugin system to execute code that is not authorized by the application or the user. This can allow the attacker to steal sensitive information, modify or delete data, or take control of the targeted system. Plugin system attacks often involve the use of malicious plugins that are disguised as legitimate ones or are downloaded from untrusted sources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="C-PLUGIN-PERMISSIONS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-PLUGIN-PERMISSIONS" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-242-CODE-INJECTION" name="An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An attacker exploits a vulnerability in input validation to inject malicious code into a system. This can allow the attacker to execute arbitrary commands, steal sensitive information, or take control of the targeted system. Code injection attacks can occur in a variety of contexts, such as web applications, operating systems, and mobile devices. The attack works by tricking the system into executing the injected code as if it were legitimate, often by exploiting weaknesses in programming languages or operating system features. Code injection attacks are a common and serious threat to the security of computer systems and proper input validation and sanitization techniques are essential to prevent them.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="C-PLUGIN-SANDBOX" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="C-HASHING-THECHNIQUES" mitigation="25"/>
+                    <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-94">
+                  <countermeasures>
+                    <countermeasure ref="C-PLUGIN-CODE-REVIEW" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-HASHING-THECHNIQUES" mitigation="25"/>
+                <countermeasure ref="C-INTEGRITY-PLUGIN-CODE" mitigation="25"/>
+                <countermeasure ref="C-PLUGIN-CODE-REVIEW" mitigation="25"/>
+                <countermeasure ref="C-PLUGIN-SANDBOX" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-37-PLUGIN-SYSTEM" name="An attacker examines the plugin system to find sensitive data that has been embedded within it" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An adversary creates a plugin that appears to be legitimate but is actually designed to execute malicious code on the target system. The malicious plugin is then distributed to users or added to a repository, where it can be downloaded and installed by unsuspecting users.&lt;/p&gt;&lt;p&gt;Once the malicious plugin is installed, it can be used by the attacker to steal sensitive information, modify or delete data, or take control of the targeted system. The attacker may also use the malicious plugin to create a backdoor into the system, allowing them to access it in the future without detection.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-PLUGIN-DATA-ENCRYPTION" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-492-REDOS" name="An adversary may execute an attack on a program that uses a poor Regular Expression implementation by choosing input that results in an extreme situation for the Regex" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression (Regex) to enter these extreme situations and then hang for a very long time.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="a21ff4ea-8962-4a97-83f5-0eb65e18dace" diagramComponentId="28fbfb13-fbfb-4da4-9e9c-a5a69626340e" ref="e20863d2-1b1d-4681-b6ad-077a9a907c6a" name="Training Data" desc="" library="CS-Default" parentComponentRef="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.209">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.338">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:08.339">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="e723106b-31a5-42eb-a0dd-0d1b15ae8fc0" diagramComponentId="1624bcaf-b82e-4fb8-a3e0-e820961cf3b3" ref="849df57b-b4ce-4b8a-a00b-bcb4141ddfcc" name="Training Dataset &amp; Processing" desc="" library="CS-Default" parentComponentRef="a0ac1685-fc5d-45ce-9746-204f5b12b111" componentDefinitionRef="empty-component">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.396">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="IR-Dataflows" source="DATAFLOW_RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:06.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="IR-Dataflows">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="DATAFLOW_RULES" edited="false" owner="JamesRabe" library="IR-Dataflows" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="c24df590-a2b2-4fe5-85d4-fc3adad953d8" diagramComponentId="9cee23e0-5a6b-4b98-8aa4-f00cdfdf2024" ref="394f4bdf-cef5-4645-87b5-58d84f31c9ce" name="Web Service" desc="" library="CS-Default" parentComponentRef="d5c2ada9-ff09-4e53-a3e7-56212684e587" componentDefinitionRef="web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.062">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.590">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.557">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.825">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.365">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.063">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.184">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.635">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:11.810">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.557">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors 'self' https://trusted.embedder&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;frame-ancestors: *&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.142">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.962">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2023-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.296">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.299">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.18" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.19" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.311">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.296">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.141">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:13.310">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.565">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:09.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.926">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="JamesRabe" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="Compensating Controls" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-16T17:40:12.295">
+              <output/>
+            </source>
+            <references/>
+            <customFields>
+              <customField ref="Documentation Links" value=""/>
+            </customFields>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="JamesRabe" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="Attack Complexity" value=""/>
+                <customField ref="Attack Vector" value=""/>
+                <customField ref="CFMEA-ID" value=""/>
+                <customField ref="Mitre" value=""/>
+                <customField ref="Privileges Required" value=""/>
+                <customField ref="Records" value=""/>
+                <customField ref="STRIDE" value=""/>
+                <customField ref="User Interaction" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/ml-ai-example-template.xml b/Templates/Submitted_Templates/ml-ai-example-template.xml
new file mode 100644
index 0000000..3c53d23
--- /dev/null
+++ b/Templates/Submitted_Templates/ml-ai-example-template.xml
@@ -0,0 +1,8202 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="ml-ai-example-template" name="ml-ai-example template" tags="">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjIzMiIgZHk9IjEwMTEiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODI3IiBwYWdlSGVpZ2h0PSIxMTY5IiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNi4wLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48b2JqZWN0IGxhYmVsPSIiIGlkPSI3NyI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1O2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEgMjtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSItNDg4IiB5PSItNjUiIHdpZHRoPSIxMTc2IiBoZWlnaHQ9IjE1NyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7c3Ryb2tlQ29sb3I9Izk5OTlGRjtzdHJva2VXaWR0aD0yO2ZvbnRTaXplPTE1O2ZvbnRDb2xvcj0jMDA3RkZGO2ZpbGxDb2xvcj0jRkZGRkZGO2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEyIDEyOyIgaWQ9IjE1Ij48bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTtzdHJva2VDb2xvcj0jOTk5OUZGO3N0cm9rZVdpZHRoPTI7Zm9udFNpemU9MTQ7Zm9udENvbG9yPSMwMDdGRkY7ZmlsbENvbG9yPSNGRkZGRkY7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49MTIgMTI7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTQ4MCIgeT0iMTE0IiB3aWR0aD0iMjYyIiBoZWlnaHQ9IjE0NyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTAwIiB5PSItMTE4IiB3aWR0aD0iMzA0IiBoZWlnaHQ9IjYxNCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJXZWIgVUkiIHN0eWxlPSJpci5yZWY9MjlkOGYxOTItMzVlOC00NzlkLThiZmQtMzQ1NWY0ZDNjYmU1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xNDtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi11aTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16WXpOalkwSURBdU16ZzJOekZETUM0ek9UazJOemNnTUM0ek9EWTNNU0F3TGpReU9URTFOeUF3TGpReE5EWTRPU0F3TGpRek1UVTFNU0F3TGpRMU1EQTVOa3d3TGpRek1UY3dPQ0F3TGpRMU5EYzFORll3TGpnd01qVXpOa013TGpRek1UY3dPQ0F3TGpnek9EVTBPU0F3TGpRd016Y3lPU0F3TGpnMk9EQXlPU0F3TGpNMk9ETXlNaUF3TGpnM01EUXlNMHd3TGpNMk16WTJOQ0F3TGpnM01EVTRTREF1TVRrM05ETTRRekF1TVRZeE5ESTFJREF1T0Rjd05UZ2dNQzR4TXpFNU5EWWdNQzQ0TkRJMk1ERWdNQzR4TWprMU5USWdNQzQ0TURjeE9UUk1NQzR4TWprek9UVWdNQzQ0TURJMU16WldNQzQwTlRRM05UUkRNQzR4TWprek9UVWdNQzQwTVRnM05DQXdMakUxTnpNM015QXdMak00T1RJMk1TQXdMakU1TWpjNElEQXVNemcyT0RZM1REQXVNVGszTkRNNElEQXVNemcyTnpGSU1DNHpOak0yTmpSYVRUQXVNell6TmpZMElEQXVORE15TURjelNEQXVNVGszTkRNNFF6QXVNVGcxT1RVMklEQXVORE15TURjeklEQXVNVGMyTkRZMklEQXVORFF3TmpBMklEQXVNVGMwT1RZMElEQXVORFV4TmpjM1REQXVNVGMwTnpVM0lEQXVORFUwTnpVMFZqQXVPREF5TlRNMlF6QXVNVGMwTnpVM0lEQXVPREUwTURFNElEQXVNVGd6TWprZ01DNDRNak0xTURnZ01DNHhPVFF6TmpFZ01DNDRNalV3TVV3d0xqRTVOelF6T0NBd0xqZ3lOVEl4TjBnd0xqTTJNelkyTkVNd0xqTTNOVEUwTmlBd0xqZ3lOVEl4TnlBd0xqTTRORFl6TmlBd0xqZ3hOalk0TkNBd0xqTTROakV6T0NBd0xqZ3dOVFl4TTB3d0xqTTROak0wTlNBd0xqZ3dNalV6TmxZd0xqUTFORGMxTkVNd0xqTTROak0wTlNBd0xqUTBNekkzTWlBd0xqTTNOemd4TWlBd0xqUXpNemM0TWlBd0xqTTJOamMwTVNBd0xqUXpNakk0VERBdU16WXpOalkwSURBdU5ETXlNRGN6V2swd0xqTXdNekk0TkNBd0xqY3pORFE1TVVNd0xqTXhOVGd4TVNBd0xqY3pORFE1TVNBd0xqTXlOVGsyTlNBd0xqYzBORFkwTmlBd0xqTXlOVGsyTlNBd0xqYzFOekUzTTBNd0xqTXlOVGsyTlNBd0xqYzJPRFkxTlNBd0xqTXhOelF6TXlBd0xqYzNPREUwTlNBd0xqTXdOak0yTWlBd0xqYzNPVFkwTjB3d0xqTXdNekk0TkNBd0xqYzNPVGcxTkVnd0xqSTFOemc0TjBNd0xqSTBOVE0ySURBdU56YzVPRFUwSURBdU1qTTFNakExSURBdU56WTVOams1SURBdU1qTTFNakExSURBdU56VTNNVGN6UXpBdU1qTTFNakExSURBdU56UTFOamtnTUM0eU5ETTNNemdnTUM0M016WXlJREF1TWpVME9EQTVJREF1TnpNME5qazRUREF1TWpVM09EZzNJREF1TnpNME5Ea3hTREF1TXpBek1qZzBXazB3TGpjNE56SXpNU0F3TGpFME5EYzNOVU13TGpneU16STBOU0F3TGpFME5EYzNOU0F3TGpnMU1qY3lOQ0F3TGpFM01qYzFOQ0F3TGpnMU5URXhPQ0F3TGpJd09ERTJNVXd3TGpnMU5USTNOU0F3TGpJeE1qZ3lWakF1TlRVek1EUkRNQzQ0TlRVeU56VWdNQzQxT0Rrd05UUWdNQzQ0TWpjeU9UY2dNQzQyTVRnMU16TWdNQzQzT1RFNE9TQXdMall5TURreU9Fd3dMamM0TnpJek1TQXdMall5TVRBNE5FZ3dMalkwTXpRME0xWXdMamN3TkRJMVNEQXVOamd4TXpBMlF6QXVOamt6T0RNeklEQXVOekEwTWpVZ01DNDNNRE01T0RjZ01DNDNNVFEwTURRZ01DNDNNRE01T0RjZ01DNDNNalk1TXpGRE1DNDNNRE01T0RjZ01DNDNNemcwTVRRZ01DNDJPVFUwTlRRZ01DNDNORGM1TURNZ01DNDJPRFF6T0RRZ01DNDNORGswTURWTU1DNDJPREV6TURZZ01DNDNORGsyTVRKSU1DNDBOakl3TlRSV01DNDNNRFF5TlVnd0xqVTVPREE0TVZZd0xqWXlNVEE0TkVnd0xqUTJNakExTkZZd0xqVTNOVGN5TWtnd0xqYzROekl6TVVNd0xqYzVPRGN4TkNBd0xqVTNOVGN5TWlBd0xqZ3dPREl3TkNBd0xqVTJOekU0T1NBd0xqZ3dPVGN3TmlBd0xqVTFOakV4T0V3d0xqZ3dPVGt4TXlBd0xqVTFNekEwVmpBdU1qRXlPREpETUM0NE1EazVNVE1nTUM0eU1ERXpNemNnTUM0NE1ERXpPQ0F3TGpFNU1UZzBOeUF3TGpjNU1ETXdPU0F3TGpFNU1ETTBOVXd3TGpjNE56SXpNU0F3TGpFNU1ERXpPRWd3TGpJNE9ERTJORU13TGpJM05qWTRNU0F3TGpFNU1ERXpPQ0F3TGpJMk56RTVNU0F3TGpFNU9EWTNNU0F3TGpJMk5UWTRPU0F3TGpJd09UYzBNa3d3TGpJMk5UUTRNaUF3TGpJeE1qZ3lWakF1TXpVMk5EWTRTREF1TWpJd01USldNQzR5TVRJNE1rTXdMakl5TURFeUlEQXVNVGMyT0RBMklEQXVNalE0TURrNElEQXVNVFEzTXpJMklEQXVNamd6TlRBMUlEQXVNVFEwT1RNeVREQXVNamc0TVRZMElEQXVNVFEwTnpjMVNEQXVOemczTWpNeFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprNE5EWXhOU0lnYUdWcFoyaDBQU0l3TGprNE5EWXhOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREFnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREVpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9EUTJOelk1SWlCb1pXbG5hSFE5SWpBdU9EUTJOelk1SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05qZzRORGMzSURBdU1EZzBNelV3TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49MTIgMTI7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxNTgiIHk9IjI1MiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzNyIgdmFsdWU9IiIgc3R5bGU9Imdyb3VwO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIyIiB2ZXJ0ZXg9IjEiIGNvbm5lY3RhYmxlPSIwIj48bXhHZW9tZXRyeSB4PSI1MyIgeT0iMjYzIiB3aWR0aD0iNjYiIGhlaWdodD0iODgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjExIiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFETUFBQUF6Q0FZQUFBQTZvVEFxQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJkYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pVeExDSjVJam93ZlN4N0luZ2lPalV4TENKNUlqbzFNWDBzZXlKNElqb3dMQ0o1SWpvMU1YMWRmV041SHNvQUFBamtTVVJCVkdoRDdWbHRiTlZYR2YvZDk3N1lsdFp0TFdWbWhVSzdnQmtUd1RBakpEcFpBaGlYU0dTV2pJSm1JY1lQWmliNjNjelBaQzZSTHpZTzVzcGcxY2pRclIxVFVkUzFZeU50R1dYdDJJRGJOOWJTMjl2MysvN2k4enpubkh0dlYyNjV2ZitTc1lWZmMrNTUvNS9uZDU3bk9XKzFKUW40Z3NDdTR5OEU3cEc1VzNIbnliQkhtbkNIY1VjV0FQNWtPQnpHM053Y3BxYW1FSTFFNFhhN1ViYWlETVZGeFhCNzNMRFpiTHIxOG1IWnlUQ0pvYUVobkgvbkhmVDE5bUp3ZUJqQllCQ0ZCUVdvcWFuQnVycDEyTExsRzVSZURaZkxxWHN0RDVhTlRDS2V3Q2NqbjZDdHJRMXYvdlUxOUYyNWdrUTRpRmc4U1ZwUWJSeDJPeHdGaFhob3pWcjhxS0VCMjdkdng2cnFWWEE0SGFxQlJTd0xtV1FpaWY2QmZodytmQmh2dGJYQ0hvdkFhYzl1Ump5aXkrM0NONy96Qkg3KzdMT29yNnNuU1hTbEJWaGVBQktKQklhR2g5RGNmQnhuejdUQzhXa2lXaTFKVzNvb0xvcEZvM2o3bjIraHBhVUZNek16dXNZYXJKR2hHZmI1ZkRoMjlDaGVlL1VWMGtpVVRFa1RZWWt6bk54MmkrVXNUdTI1MzhsWFR5SVFDT2pTL0dHSkRGdG9UMDhQL2s2bUZaNVRzNXVwQVJIL2xsYWNKamxMV21scStqM2EyOXQxU2Y2d1JDWVVEdUVmWjk2RWYreW01QTBSRTVORHBzdFlOeW1paW1EUzdvRGJZWWZ2eGcwMHYvd3kvT00rS2M4WGxzaU1qWTJoczdNTHlYaE04bXhLWWs1a1hrWWZ0bVJDaE9hWWd5bzBtbEd0aWx3T1hPcTZnT3ZYdmFMdGZKRS9HUnB6Y0hBUVV4UGprcEZacHpLbXc2YkY0aWFOMEprQ2NobG5LYmJSNG1HS2dxRXdCbWwvaXNmalVwWVA4aWRqUytMYXRXdVluWm9rWVpUUUxIeEtBMHlJU1hBWlM4OXRPQWd4Q2hUekJMRFdHUFpvQklNRFhsb1VQZ3N5QkIrWkdTK3hUSVVGRnhKR2FJSVIxR2hHakpBMUtQV2FlRUlKejBXVFV6UFVWTFhOQjViSVJJbUlBV3RGQWxOamdTaHROQ1FhRU9HMXRrVGdoVUxIWXpFcS9ZeklsSmVXeUw3Q3c0dmdMTERLcFVSU3BxZEppTUl5aEdWMWNDQndkUkVkUXUwNm53L3lKNU8wWWRWRE5YQ1RBTVkwbENha2t0SlNSRWdMSjFyTHlBc0QzWmZYdzhxcVN0aU5hZWFCL01tUVRIVjFkZmp5L1ZVNlR3Vm1Wak5tMTJpRXVGUEVnbk5ldFJYell4OGl1QXVMOFBEYVdrdUhUa3RtOW1CMU5iNjIrZXV3T1YycEdXYWhXUU95TEZPWnlqTXBybFJ0VEN3TEFJVkFOSUZITm0zR0dqcHcydWxrblM4c2tYRjdQUGpXdG0ya25RY29wNFEzL3NGQi9JVnJOQWVCYUUyMVpkQ0JHdzlVVnVMSko3K1A4dkp5S2NzWGxzallhQmEzYk42TTdZL3ZnS2VvU0JlU29GcGVwUTJWVm9GK2hJUWl3bkFWRm1MZmdZUFk4ZDNINFhSYXU2eFpJMFBDVlZaVm8zSC8wOWhHaE1RSDBuSXFNQWtHVjJodEdUK3hPUno0OWhNNzBkaTRIeXZLSzZUTUNpeVJZZGhwYVY2OXBoWUhEaDdFK2tjM2dieUFaTmFNTkpIMEtxWUMrNG1kaUt6OTZrWTAwSTJ6ckxSTTExa0RtZmFDdVZ3UytISVdqVVJrNGovNitDTTB2L1FTM2o3M0wweFArT2tHU3J0N3lyUVVXQnRmS2x1QkhUdS9oNzE3Zm9EVjYrcmdjRGpsNW1uRitSbVd5UEE1YW1Ua0JucjdlbEZTc2dLYkh0MklNVHJHdDdhMjRmWFRwekV5NkVVb0dDUW5KMDJRb0lXRnhianZ3YTlnOTY3ZCtPSGV2U2d0S1VGM2R4ZG1adWRrbWErcXFyTGtOL21Sb1I3VE05TWtTRGRhVHJ5Q2kxMmRxTGp2ZnZ6aWw3L0NZMXUzaXJhdWtwWXU5L2JpNnRYckNFMVBvTGlrRkxYMTlkanc4SHJVcks0UjM3bnczZ1g4N29Ybk1YcGpHT3MzYk1DZWhuM1l1dlV4RkJjWGl6OHVGVXNuUTYwSEJnZHc1TWdSbkRuMVo4VG82bXVHclZpNUNzLzg5R2ZZdlhzWExiTVZVcDZnSTMwaVFkZHBoMHRXUC9hZjZlbHAvT1hrQ1J3N2ZoeitvWDdWbVZCSTJuMXFmeVA1MFQ1VTB4NjJWRGR5L0pxZzB6a2hHQXpnRDAxTitPUFJGK0hnVFM5andNbkpLVng4LzVMNFFHMXRMVHdGQmVMb0R0NVVxV0dDTnBVSjhxVS90YlRnaGQ4K0QvL05VYmpvcG1rUUNnWFIzZFVGaDh1RGpXU3kvSEM0Rk9Tc0dYNU9HaUFmT0hYcU5FNjgySVRBYlBwRkpVa3piaTVhTVdySG0rbjZSemJLcmw1UHBsVmFXaXJhdU56VGc4c1h1L0FCeFZHNmNtZDdqbks2UFhqcXdJL1JTUHZQeXFxVnBOSGNWSlF6bVltSkNmem11ZWR3OW8zVGNsUm55SFZZMzBjWXZIK28wN1BhMmFNVStPRG9jZG9SalNjUUk1UHo1TGhnOFdQaG5vYW5jZWpRSVZUU0NTRVg1UFJwZnExODkveTdPTnYyT2dMaDlCMG1UVVROSEJNeEd5SlBwcHVTVHBEUGtGL1prL09KcUhhcUgwK0t1Y2l4bGhseE1qbCtVT3pvNk1qNUtwM3grVnVEVnlhdjE0c204cE53S0FTUHc2ZzhVL1ZLdWFJWlRyTWpVZUFWYVdIcmhmMVVyTkxHWEJtVEk4TzBieDJUdCt0Y0RPaTJaR1puWjlINnh0OXc1ZjNPZVRiT001aTZGb3VBdW80SHpSeFlFMHNGVFZhWm96cmFNQUVoUWVWR00xekgrUGpEWG5TMC93L0JIQjRKRnlYRHN6SFE3OFc1Ly93M2ZVWFdRckdKY1dCaDVMaFBRcElEcHVvRmhwZ214OHV5bUJmbFRUOGhOYTg5SjlUM0dHeHVIZTBkOEkzeks5RGlXSlJNSkJMRmU3U3hYZm5nMHZ5VlJ3dkhZTE1TRWlvekQwTFNDRW93aTROb2c5TEd4K1RzUnUyRWFBcmNUL1h0N3V5VURmcDJXSlJNWUc1V2x0TUV6VTRLTERnUHpDWm1CSlZ4aFphYVVBb2M2VnFDYWNjK3BCcGtDcTdLS05aa1ZUMzEwZDBtYm83Z1BDMEV0L09ickdUWThjZjlmdmxYQlMrekFoYllDQ0Vtb1FObmFlUk1ZZmd1d3pWQ2tGTVpnckFtcFMyVDQ5alVNUUVkcDh0dENJVWorTEN2RDM3LzRxYTJLSm5SMFJINEtZaUZtWUZTb05rejJza1FUcTdKcVZsbm9VZ2cwOWNJemZqVTk0UzArUTduK1J1NkRiOEFlY2wzKzY5N0paOE5XY253amo4OVBTT25Yc25ManhxTUIrWmh6T3hsYW9zMVlueElFWkVrdFVrTGI5cHpiUHpLa0RBRXpEalVpb3BzQ05OaGRYUnNUT3F5SVN1Wk9LMVVNMFFtRUE3TEVTWGw1QVJEUW9MSnA4QmxHVUczUy9XWE5BbEszMHpTWmlqbHBvNlJtU2ZyNEdTQ2ZrS1JHTVo5UHJHWWJLQnZaWDRwalJCdGtPZitmWTZPK00wSWhNSkVPeXR2R3B4Q2V1SnZEeU53dG05eUhXdUlCZWY5aklsSFF0ai9rMmV3YzljdU9zamUramtxS3htZWdWazZUUHBwRVZBelphUmRTcHBqaGtubjJvK1JUZ3QzK3F1b0tFZFpXYm14eEFYSVN1YnppRVZzNS9PSGUyVHVWdHdqYzNjQytEOXo1R25TaUd2L1dBQUFBQUJKUlU1RXJrSmdnZz09O2ZvbnRTaXplPTE0OyIgcGFyZW50PSIzNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB3aWR0aD0iNjYiIGhlaWdodD0iNjYiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iJmx0O3NwYW4gc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz4mbHQ7Zm9udCBjb2xvcj0mcXVvdDsjMDA3ZmZmJnF1b3Q7IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTRweDsmcXVvdDs+VHJhZGVyJmx0Oy9mb250PiZsdDsvc3Bhbj4iIHN0eWxlPSJ0ZXh0O2h0bWw9MTthbGlnbj1jZW50ZXI7dmVydGljYWxBbGlnbj1taWRkbGU7cmVzaXphYmxlPTA7cG9pbnRzPVtdO2F1dG9zaXplPTE7c3Ryb2tlQ29sb3I9bm9uZTtmaWxsQ29sb3I9bm9uZTtmb250Q29sb3I9IzIwQzlFMztmb250U2l6ZT0xNDtmb250U3R5bGU9MCIgcGFyZW50PSIzNyIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSI1LjUiIHk9IjU2IiB3aWR0aD0iNTYiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9Ik91dCBPZiBTY29wZSIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW91dC1vZi1zY29wZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJMk5DSWdhR1ZwWjJoMFBTSTJOQ0lnZG1sbGQwSnZlRDBpTUNBd0lEWTBJRFkwSWlCbWFXeHNQU0p1YjI1bElqNG1JM2hoT3p4emRIbHNaVDRtSTNoaE95QWdJQ0F1YVdOdmJpMW1hV3hzSUhzbUkzaGhPeUFnSUNBZ0lDQWdabWxzYkRvZ0l6RXhRVGhEUmpzbUkzaGhPeUFnSUNCOUppTjRZVHM4TDNOMGVXeGxQaVlqZUdFN1BIQmhkR2dnWkQwaVRUTXhMams1T1RnZ09TNDFPVFk1TWtNek9DNHdNelFnT1M0MU9UWTVNaUEwTXk0MU1URWdNVEV1T1RneU5pQTBOeTQxTXpreElERTFMamcyTWpGRE5EY3VOalUwSURFMUxqazBNVGNnTkRjdU56WXpNU0F4Tmk0d016STFJRFEzTGpnMk5USWdNVFl1TVRNME5rTTBOeTQ1TmpjeklERTJMakl6TmpjZ05EZ3VNRFU0TVNBeE5pNHpORFU0SURRNExqRXpOellnTVRZdU5EWXdOVU0xTWk0d01UY3pJREl3TGpRNE9Ea2dOVFF1TkRBeU9TQXlOUzQ1TmpVNUlEVTBMalF3TWprZ016SkROVFF1TkRBeU9TQTBOQzR6TnpNZ05EUXVNemN5TnlBMU5DNDBNRE15SURNeExqazVPVGdnTlRRdU5EQXpNa014T1M0Mk1qWTVJRFUwTGpRd016SWdPUzQxT1RZMk9DQTBOQzR6TnpNZ09TNDFPVFkyT0NBek1rTTVMalU1TmpZNElERTVMall5TnpFZ01Ua3VOakkyT1NBNUxqVTVOamt5SURNeExqazVPVGdnT1M0MU9UWTVNbHBOTkRZdU1EWXpJREl4TGpJM01qWk1NakV1TWpjeU5DQTBOaTR3TmpNeVF6STBMakkwTnprZ05EZ3VNek0yTkNBeU55NDVOall5SURRNUxqWTROamNnTXpFdU9UazVPQ0EwT1M0Mk9EWTNRelF4TGpjMk56a2dORGt1TmpnMk55QTBPUzQyT0RZMUlEUXhMamMyT0RFZ05Ea3VOamcyTlNBek1rTTBPUzQyT0RZMUlESTRMakV5TnpnZ05EZ3VORFF5TVNBeU5DNDFORFl4SURRMkxqTXpNVE1nTWpFdU5qTXpNa3cwTmk0d05qTWdNakV1TWpjeU5scE5NekV1T1RrNU9DQXhOQzR6TVRNMFF6SXlMakl6TVRjZ01UUXVNekV6TkNBeE5DNHpNVE14SURJeUxqSXpNaUF4TkM0ek1UTXhJRE15UXpFMExqTXhNekVnTXpZdU1ETXpOeUF4TlM0Mk5qTTBJRE01TGpjMU1pQXhOeTQ1TXpZMklEUXlMamN5TnpWTU5ESXVOekkzTWlBeE55NDVNelk1UXpNNUxqYzFNVGNnTVRVdU5qWXpOeUF6Tmk0d016TTBJREUwTGpNeE16UWdNekV1T1RrNU9DQXhOQzR6TVRNMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI0MSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTBmYzAxNjI4LTQ1ZTEtNGFmMS1iZTE1LWI5YmZlMjJmMzI0Mjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1vdXQtb2Ytc2NvcGU7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyOSIgeT0iNDE5IiB3aWR0aD0iMjQ2IiBoZWlnaHQ9IjE2NiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDIiIHZhbHVlPSJBUEkgRW5kcG9pbnQgLSBCcm9rZXIgc2l0ZSIgc3R5bGU9ImlyLnJlZj1iYzQ5NDM1ZS02MjlhLTQyZGQtYjY2MS0xOWQzZjIyYWIzYzg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTE0O3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQVBJLUVORFBPSU5UO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpZMU9WOHlNelU0TXlraVBqeG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVY4eU5qVTVYekl6TlRnektTSStQSEJoZEdnZ1pEMGlUVEF1TnpVNE5qZ2dNQzQwTkRReE9USklNQzQzTkRNME56SkRNQzQzTXprNU5qSWdNQzQwTXpJME9UTWdNQzQzTXpZME5USWdNQzQwTWpBM09UUWdNQzQzTXpFM056TWdNQzQwTVRBeU5qVkRNQzQzTWpjd09UTWdNQzR6T1RrM016WWdNQzQzTWpJME1UTWdNQzR6T1RBek56Y2dNQzQzTVRZMU5qUWdNQzR6TnprNE5EaE1NQzQzTWpVNU1qTWdNQzR6TnpBME9EbERNQzQzTWprME16TWdNQzR6TmpZNU56a2dNQzQzTXpBMk1ETWdNQzR6TmpNME55QXdMamN6TURZd015QXdMak0xT0RjNVF6QXVOek13TmpBeklEQXVNelUwTVRFeElEQXVOekk1TkRNeklEQXVNelV3TmpBeElEQXVOekkxT1RJeklEQXVNelEzTURreFREQXVOamN3T1RNNElEQXVNamt5TVRBMlF6QXVOalkzTkRJNUlEQXVNamc0TlRrM0lEQXVOall6T1RFNUlEQXVNamczTkRJM0lEQXVOalU1TWpNNUlEQXVNamczTkRJM1F6QXVOalUwTlRZZ01DNHlPRGMwTWpjZ01DNDJOVEV3TlNBd0xqSTRPRFU1TnlBd0xqWTBOelUwSURBdU1qa3lNVEEyVERBdU5qTTVNelV4SURBdU16QXhORFkxUXpBdU5qSTVPVGt5SURBdU1qazFOakUySURBdU5qSXdOak16SURBdU1qa3dPVE0ySURBdU5qRXdNVEEwSURBdU1qZzJNalUzUXpBdU5UazROREExSURBdU1qZ3hOVGMzSURBdU5UZzJOekEySURBdU1qYzJPRGs0SURBdU5UY3pPRE0zSURBdU1qY3pNemc0VmpBdU1qWXdOVEU1UXpBdU5UY3pPRE0zSURBdU1qVXhNVFlnTUM0MU5qWTRNVGdnTUM0eU5EUXhOREVnTUM0MU5UYzBOVGtnTUM0eU5EUXhOREZJTUM0ME9EQXlORFpETUM0ME56QTRPRGNnTUM0eU5EUXhOREVnTUM0ME5qTTROamNnTUM0eU5URXhOaUF3TGpRMk16ZzJOeUF3TGpJMk1EVXhPVll3TGpJNE9UYzJOa2d3TGpRNE56STJOVll3TGpJMk56VXpPRWd3TGpVMU1EUXpPVll3TGpJM09USXpOME13TGpVMU1EUXpPU0F3TGpJNE56UXlOeUF3TGpVMU5URXhPU0F3TGpJNU16STNOaUF3TGpVMk16TXdPQ0F3TGpJNU5EUTBOa013TGpVM05qRTNOeUF3TGpJNU5qYzROaUF3TGpVNE9UQTBOaUF3TGpNd01UUTJOU0F3TGpZd01EYzBOU0F3TGpNd056TXhOVU13TGpZeE1USTNOQ0F3TGpNeE1UazVOQ0F3TGpZeU1UZ3dNeUF3TGpNeE56ZzBOQ0F3TGpZek1URTJNaUF3TGpNeU16WTVNME13TGpZek56QXhNU0F3TGpNeU9ETTNNeUF3TGpZME5qTTNJREF1TXpJM01qQXpJREF1TmpVeE1EVWdNQzR6TWpFek5UUk1NQzQyTlRreU16a2dNQzR6TVRNeE5qUk1NQzQzTURNMk9UVWdNQzR6TlRjMk1rd3dMalk1TkRNek5pQXdMak0yTlRnd09VTXdMalk0T0RRNE55QXdMak0zTURRNE9TQXdMalk0T0RRNE55QXdMak0zT0RZM09DQXdMalk1TVRrNU5pQXdMak00TlRZNU9FTXdMalk1TnpnME5pQXdMak01TmpJeU55QXdMamN3TXpZNU5TQXdMalF3TmpjMU5pQXdMamN3T0RNM05TQXdMalF4TnpJNE5VTXdMamN4TXpBMU5DQXdMalF5T0RrNE5DQXdMamN4Tnpjek5DQXdMalEwTURZNE15QXdMamN5TURBM05DQXdMalExTXpVMU1VTXdMamN5TWpReE15QXdMalEyTURVM01TQXdMamN5T0RJMk15QXdMalEyTlRJMUlEQXVOek0xTWpneUlEQXVORFkxTWpWSU1DNDNORGt6TWpGV01DNDFNamsxT1RSSU1DNDNNelV5T0RKRE1DNDNNamd5TmpNZ01DNDFNamsxT1RRZ01DNDNNakV5TkRRZ01DNDFNelF5TnpRZ01DNDNNakF3TnpRZ01DNDFOREV5T1RORE1DNDNNVFkxTmpRZ01DNDFOVEk1T1RJZ01DNDNNVE13TlRRZ01DNDFOalU0TmpFZ01DNDNNRGd6TnpVZ01DNDFOemMxTmtNd0xqY3dNelk1TlNBd0xqVTRPREE0T1NBd0xqWTVOemcwTmlBd0xqVTVPVGM0T0NBd0xqWTVNVGs1TmlBd0xqWXdPVEUwTjBNd0xqWTRPRFE0TnlBd0xqWXhORGs1TnlBd0xqWTRPVFkxTmlBd0xqWXlNekU0TmlBd0xqWTVORE16TmlBd0xqWXlPVEF6TlV3d0xqY3dNelk1TlNBd0xqWXpOekl5TkV3d0xqWTFPVEl6T1NBd0xqWTRNVFk0VERBdU5qVXlNaklnTUM0Mk56Y3dNREZETUM0Mk5EWXpOeUF3TGpZM01URTFNU0F3TGpZek9ERTRNU0F3TGpZM01URTFNU0F3TGpZek1qTXpNaUF3TGpZM05EWTJNVU13TGpZeU1qazNNeUF3TGpZNE1EVXhNU0F3TGpZeE1qUTBOQ0F3TGpZNE5qTTJJREF1TmpBeE9URTFJREF1TmpreE1EUkRNQzQxT1RBeU1UWWdNQzQyT1RZNE9Ea2dNQzQxTnpjek5EY2dNQzQzTURBek9Ua2dNQzQxTmpRME56Z2dNQzQzTURNNU1EaERNQzQxTlRjME5Ua2dNQzQzTURVd056Z2dNQzQxTlRFMk1Ea2dNQzQzTVRJd09UZ2dNQzQxTlRFMk1Ea2dNQzQzTVRreE1UZFdNQzQzTXpBNE1UWklNQzQwT0RjeU5qVldNQzQzTURnMU9EaElNQzQwTmpNNE5qZFdNQzQzTXpjNE16VkRNQzQwTmpNNE5qY2dNQzQzTkRjeE9UUWdNQzQwTnpBNE9EY2dNQzQzTlRReU1UUWdNQzQwT0RBeU5EWWdNQzQzTlRReU1UUklNQzQxTlRjME5UbERNQzQxTmpZNE1UZ2dNQzQzTlRReU1UUWdNQzQxTnpNNE16Y2dNQzQzTkRjeE9UUWdNQzQxTnpNNE16Y2dNQzQzTXpjNE16VldNQzQzTWpRNU5qWkRNQzQxT0RZM01EWWdNQzQzTWpFME5UY2dNQzQxT1RnME1EVWdNQzQzTVRjNU5EY2dNQzQyTVRBeE1EUWdNQzQzTVRJd09UaERNQzQyTVRrME5qTWdNQzQzTURjME1UZ2dNQzQyTWprNU9USWdNQzQzTURJM016Z2dNQzQyTXprek5URWdNQzQyT1RZNE9EbE1NQzQyTkRnM01TQXdMamN3TmpJME9FTXdMalkxTkRVMklEQXVOekV5TURrNElEQXVOalkxTURnNUlEQXVOekV5TURrNElEQXVOamN5TVRBNElEQXVOekEyTWpRNFREQXVOekkzTURreklEQXVOalV4TWpZelF6QXVOek13TmpBeklEQXVOalEzTnpVMElEQXVOek14TnpjeklEQXVOalEwTWpRMElEQXVOek14TnpjeklEQXVOak01TlRZMFF6QXVOek14TnpjeklEQXVOak0wT0RnMUlEQXVOekk1TkRNeklEQXVOak14TXpjMUlEQXVOekkzTURreklEQXVOakkzT0RZMVREQXVOekUzTnpNMElEQXVOakU0TlRBMlF6QXVOekl6TlRneklEQXVOakE1TVRRM0lEQXVOekk0TWpZeklEQXVOVGs0TmpFNElEQXVOek15T1RReUlEQXVOVGc1TWpVNVF6QXVOek0zTmpJeUlEQXVOVGM0TnpNZ01DNDNOREV4TXpJZ01DNDFOamN3TXpFZ01DNDNORFEyTkRFZ01DNDFOVFV6TXpKSU1DNDNOVGs0TlVNd0xqYzJORFV6SURBdU5UVTFNek15SURBdU56WTRNRE01SURBdU5UVTBNVFl5SURBdU56Y3hOVFE1SURBdU5UVXdOalV5UXpBdU56YzFNRFU1SURBdU5UUTNNVFF6SURBdU56YzJNakk1SURBdU5UUXpOak16SURBdU56YzJNakk1SURBdU5UTTRPVFUwVmpBdU5EVTVOREF4UXpBdU56YzFNRFU1SURBdU5EVXhNakV5SURBdU56WTRNRE01SURBdU5EUTBNVGt5SURBdU56VTROamdnTUM0ME5EUXhPVEphSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVORGd6TnpVZ01DNDJNemcxTWpaRE1DNDBPVFkyTVRrZ01DNDJOREl3TXpVZ01DNDFNRGswT0RnZ01DNDJORFF6TnpVZ01DNDFNakl6TlRjZ01DNDJORFF6TnpWRE1DNDJNREU1TVNBd0xqWTBORE0zTlNBd0xqWTJOakkxTkNBd0xqVTRNREF6TVNBd0xqWTJOakkxTkNBd0xqVXdNRFEzT0VNd0xqWTJOakkxTkNBd0xqUXlNRGt5TmlBd0xqWXdNVGt4SURBdU16VTFOREV5SURBdU5USXlNelUzSURBdU16VTFOREV5UXpBdU5UQTRNekU0SURBdU16VTFOREV5SURBdU5EazFORFE1SURBdU16VTNOelV5SURBdU5EZ3lOVGd4SURBdU16WXhNall4VERBdU5EZ3pOelVnTUM0ek5qQXdPVEZNTUM0ME5qRTFNak1nTUM0ek5ESTFORE5JTUM0ek1ESTBNVGRETUM0ek1ERXlORGNnTUM0ek16WTJPVE1nTUM0eU9UYzNNemdnTUM0ek16QTRORFFnTUM0eU9URTRPRGdnTUM0ek1qWXhOalJETUM0eU9ESTFNamtnTUM0ek1qQXpNVFVnTUM0eU5qazJOaUF3TGpNeU1ETXhOU0F3TGpJMk1ETXdNU0F3TGpNeU5qRTJORU13TGpJMU1qRXhNaUF3TGpNek1qQXhOQ0F3TGpJME56UXpNaUF3TGpNME1UTTNNeUF3TGpJME56UXpNaUF3TGpNMU1EY3pNa013TGpJME56UXpNaUF3TGpNMk1EQTVNU0F3TGpJMU1qRXhNaUF3TGpNMk9UUTFJREF1TWpZd016QXhJREF1TXpjMU0wTXdMakkyTkRrNE1TQXdMak0zT0RneElEQXVNamN3T0RNZ01DNHpOems1TnprZ01DNHlOelkyT0NBd0xqTTNPVGszT1VNd0xqSTRNalV5T1NBd0xqTTNPVGszT1NBd0xqSTRPRE0zT0NBd0xqTTNPRGd4SURBdU1qa3pNRFU0SURBdU16YzFNME13TGpJNU9Ea3dOeUF3TGpNM01UYzVJREF1TXpBeU5ERTNJREF1TXpZMU9UUXhJREF1TXpBek5UZzNJREF1TXpVNE9USXhTREF1TkRVMU5qY3pUREF1TkRZMU1ETXlJREF1TXpZM01URXhRekF1TkRNNU1qazFJREF1TXpjNE9ERWdNQzQwTVRneU16WWdNQzR6T1RZek5UZ2dNQzQwTURNd01qZ2dNQzQwTVRrM05UWklNQzR6TkRreU1UTldNQzQwTWpBNU1qWkRNQzR6TkRVM01ETWdNQzQwTURnd05UY2dNQzR6TXpRd01EUWdNQzR6T1RnMk9UZ2dNQzR6TWpFeE16VWdNQzR6T1RnMk9UaERNQzR6TURRM05UY2dNQzR6T1RnMk9UZ2dNQzR5T1RFNE9EZ2dNQzQwTVRFMU5qY2dNQzR5T1RFNE9EZ2dNQzQwTWpjNU5EVkRNQzR5T1RFNE9EZ2dNQzQwTkRRek1qUWdNQzR6TURRM05UY2dNQzQwTlRjeE9USWdNQzR6TWpFeE16VWdNQzQwTlRjeE9USkRNQzR6TXpVeE56UWdNQzQwTlRjeE9USWdNQzR6TkRZNE56TWdNQzQwTkRjNE16TWdNQzR6TkRreU1UTWdNQzQwTXpRNU5qUldNQzQwTXpZeE16UklNQzR6T1RJME9UbERNQzR6T0RRek1TQXdMalExTWpVeE15QXdMak0zT1RZeklEQXVORGN3TURZeElEQXVNemM0TkRZZ01DNDBPRGczTnpsSU1DNHlPRGd6TnpoRE1DNHlPRGN5TURrZ01DNDBPRFF4SURBdU1qZzBPRFk1SURBdU5EYzVORElnTUM0eU9ERXpOVGtnTUM0ME56Y3dPREZETUM0eU5qazJOaUF3TGpRMk5UTTRNaUF3TGpJMU1EazBNaUF3TGpRMk5UTTRNaUF3TGpJek9USTBNeUF3TGpRM056QTRNVU13TGpJeU56VTBOQ0F3TGpRNE9EYzNPU0F3TGpJeU56VTBOQ0F3TGpVd056UTVPQ0F3TGpJek9USTBNeUF3TGpVeE9URTVOME13TGpJME5UQTVNaUF3TGpVeU5UQTBOaUF3TGpJMU1qRXhNaUF3TGpVeU56TTROaUF3TGpJMk1ETXdNU0F3TGpVeU56TTROa013TGpJMk9EUTVJREF1TlRJM016ZzJJREF1TWpjMU5URWdNQzQxTWpVd05EWWdNQzR5T0RFek5Ua2dNQzQxTVRreE9UZERNQzR5T0RRNE5qa2dNQzQxTVRVMk9EY2dNQzR5T0RjeU1Ea2dNQzQxTVRFd01EY2dNQzR5T0Rnek56Z2dNQzQxTURjME9UaElNQzR6TnprMk0wTXdMak00TURnZ01DNDFNall5TVRZZ01DNHpPRFUwT0NBd0xqVTBNemMyTkNBd0xqTTVNelkyT1NBd0xqVTJNVE14TTBnd0xqTTFNRE00TTFZd0xqVTJNalE0TTBNd0xqTTBOamczTXlBd0xqVTBPVFl4TkNBd0xqTXpOVEUzTkNBd0xqVTBNREkxTlNBd0xqTXlNak13TlNBd0xqVTBNREkxTlVNd0xqTXdOVGt5TnlBd0xqVTBNREkxTlNBd0xqSTVNekExT0NBd0xqVTFNekV5TkNBd0xqSTVNekExT0NBd0xqVTJPVFV3TWtNd0xqSTVNekExT0NBd0xqVTROVGc0TVNBd0xqTXdOVGt5TnlBd0xqVTVPRGMwT1NBd0xqTXlNak13TlNBd0xqVTVPRGMwT1VNd0xqTXpOak0wTkNBd0xqVTVPRGMwT1NBd0xqTTBPREEwTXlBd0xqVTRPVE01SURBdU16VXdNemd6SURBdU5UYzJOVEl4VmpBdU5UYzNOamt4U0RBdU5EQTBNVGs0UXpBdU5ERTVOREEySURBdU5qQXhNRGc1SURBdU5EUXhOak0wSURBdU5qRTROak00SURBdU5EWTJNakF5SURBdU5qSTVNVFkzVERBdU5EVTJPRFF6SURBdU5qTTNNelUyU0RBdU16QTBOelUzUXpBdU16QXlOREUzSURBdU5qTXhOVEEySURBdU1qazRPVEEzSURBdU5qSTFOalUzSURBdU1qazBNakk0SURBdU5qSXlNVFEzUXpBdU1qZzBPRFk1SURBdU5qRTFNVEk0SURBdU1qY3lJREF1TmpFMU1USTRJREF1TWpZeE5EY3hJREF1TmpJeU1UUTNRekF1TWpVek1qZ3lJREF1TmpJM09UazNJREF1TWpRNE5qQXlJREF1TmpNM016VTJJREF1TWpRNE5qQXlJREF1TmpRMk56RTFRekF1TWpRNE5qQXlJREF1TmpVMk1EYzBJREF1TWpVek1qZ3lJREF1TmpZMU5ETXpJREF1TWpZeE5EY3hJREF1TmpjeE1qZ3pRekF1TWpZME9UZ3hJREF1TmpjME56a3lJREF1TWpZNU5qWWdNQzQyTnpjeE16SWdNQzR5TnpVMU1TQXdMalkzTnpFek1rTXdMakk0TVRNMU9TQXdMalkzTnpFek1pQXdMakk0TnpJd09TQXdMalkzTkRjNU1pQXdMakk1TVRnNE9DQXdMalkzTWpRMU0wTXdMakk1Tnpjek9DQXdMalkyT0RrME15QXdMak13TVRJME55QXdMalkyTXpBNU15QXdMak13TWpReE55QXdMalkxTnpJME5FZ3dMalEyTURNMU0wd3dMalE0TXpjMUlEQXVOak00TlRJMldrMHdMakk0TVRNMU9TQXdMak0yTVRJMk1VTXdMakkzTnpnME9TQXdMak0yTXpZd01TQXdMakkzTXpFM0lEQXVNell6TmpBeElEQXVNalk1TmpZZ01DNHpOakV5TmpGRE1DNHlOamN6TWlBd0xqTTFPRGt5TVNBd0xqSTJORGs0TVNBd0xqTTFOVFF4TWlBd0xqSTJORGs0TVNBd0xqTTFNRGN6TWtNd0xqSTJORGs0TVNBd0xqTTBOakExTXlBd0xqSTJOek15SURBdU16UXlOVFF6SURBdU1qWTVOallnTUM0ek5EQXlNRE5ETUM0eU56TXhOeUF3TGpNek56ZzJNeUF3TGpJM056ZzBPU0F3TGpNek56ZzJNeUF3TGpJNE1UTTFPU0F3TGpNME1ESXdNME13TGpJNE5EZzJPU0F3TGpNME1qVTBNeUF3TGpJNE5qQXpPU0F3TGpNME5qQTFNeUF3TGpJNE5qQXpPU0F3TGpNMU1EY3pNa013TGpJNE5qQXpPU0F3TGpNMU5UUXhNaUF3TGpJNE5EZzJPU0F3TGpNMU9Ea3lNU0F3TGpJNE1UTTFPU0F3TGpNMk1USTJNVnBOTUM0ek1UazVOallnTUM0ME5EQTRNVFJETUM0ek1USTVORFlnTUM0ME5EQTRNVFFnTUM0ek1EZ3lOamNnTUM0ME16UTVOalFnTUM0ek1EZ3lOamNnTUM0ME1qa3hNVFZETUM0ek1EZ3lOamNnTUM0ME1qTXlOallnTUM0ek1UUXhNVFlnTUM0ME1UYzBNVFlnTUM0ek1UazVOallnTUM0ME1UYzBNVFpETUM0ek1qVTRNVFVnTUM0ME1UYzBNVFlnTUM0ek16RTJOalFnTUM0ME1qTXlOallnTUM0ek16RTJOalFnTUM0ME1qa3hNVFZETUM0ek16STRNelFnTUM0ME16UTVOalFnTUM0ek1qWTVPRFVnTUM0ME5EQTRNVFFnTUM0ek1UazVOallnTUM0ME5EQTRNVFJhVFRBdU1qWTRORGtnTUM0MU1EYzBPVGhETUM0eU5qTTRNVEVnTUM0MU1USXhOemNnTUM0eU5UVTJNakVnTUM0MU1USXhOemNnTUM0eU5UQTVORElnTUM0MU1EYzBPVGhETUM0eU5EWXlOaklnTUM0MU1ESTRNVGdnTUM0eU5EWXlOaklnTUM0ME9UUTJNamtnTUM0eU5UQTVORElnTUM0ME9EazVORGxETUM0eU5UTXlPRElnTUM0ME9EYzJNU0F3TGpJMU5qYzVNU0F3TGpRNE5qUTBJREF1TWpVNU1UTXhJREF1TkRnMk5EUkRNQzR5TmpFME56RWdNQzQwT0RZME5DQXdMakkyTkRrNE1TQXdMalE0TnpZeElEQXVNalkzTXpJZ01DNDBPRGs1TkRsRE1DNHlOamsyTmlBd0xqUTVNakk0T1NBd0xqSTNNRGd6SURBdU5EazFOems1SURBdU1qY3dPRE1nTUM0ME9UZ3hNemxETUM0eU56QTRNeUF3TGpVd01EUTNPQ0F3TGpJM01EZ3pJREF1TlRBMU1UVTRJREF1TWpZNE5Ea2dNQzQxTURjME9UaGFUVEF1TXpFNU9UWTJJREF1TlRneU16Y3hRekF1TXpFeU9UUTJJREF1TlRneU16Y3hJREF1TXpBNE1qWTNJREF1TlRjMk5USXhJREF1TXpBNE1qWTNJREF1TlRjd05qY3lRekF1TXpBNE1qWTNJREF1TlRZME9ESXpJREF1TXpFME1URTJJREF1TlRVNE9UY3pJREF1TXpFNU9UWTJJREF1TlRVNE9UY3pRekF1TXpJMU9ERTFJREF1TlRVNE9UY3pJREF1TXpNeE5qWTBJREF1TlRZME9ESXpJREF1TXpNeE5qWTBJREF1TlRjd05qY3lRekF1TXpNeE5qWTBJREF1TlRjMk5USXhJREF1TXpJMk9UZzFJREF1TlRneU16Y3hJREF1TXpFNU9UWTJJREF1TlRneU16Y3hXazB3TGpVNU5qQTJJREF1TkRZeE9EY3lWakF1TlRNMk56UTFRekF1TlRrMk1EWWdNQzQxTkRBeU5UVWdNQzQxT1RJMU5TQXdMalUwTXpjMk5DQXdMalU0T1RBME1TQXdMalUwTXpjMk5FTXdMalU0TlRVek1TQXdMalUwTXpjMk5DQXdMalU0TURnMU1pQXdMalUwTURJMU5TQXdMalU0TURnMU1pQXdMalV6TmpjME5WWXdMalEyTVRnM01rTXdMalU0TURnMU1pQXdMalExT0RNMk1pQXdMalU0TkRNMk1TQXdMalExTkRnMU15QXdMalU0TnpnM01TQXdMalExTkRnMU0wTXdMalU1TVRNNE1TQXdMalExTkRnMU15QXdMalU1TmpBMklEQXVORFU0TXpZeUlEQXVOVGsyTURZZ01DNDBOakU0TnpKYVRUQXVOVFkzT1RneklEQXVORFkyTlRVeVF6QXVOVGN5TmpZeUlEQXVORGN5TkRBeElEQXVOVGN6T0RNeUlEQXVORGM1TkRJZ01DNDFOek00TXpJZ01DNDBPRFV5TjBNd0xqVTNNemd6TWlBd0xqUTVNVEV4T1NBd0xqVTNNalkyTWlBd0xqUTVOVGM1T1NBd0xqVTJPVEUxTXlBd0xqVXdNRFEzT0VNd0xqVTJNek13TXlBd0xqVXdPVGd6T0NBd0xqVTFNemswTkNBd0xqVXhORFV4TnlBd0xqVTBNakkwTlNBd0xqVXhORFV4TjBnd0xqVXlNak0xTjFZd0xqVXpOamMwTlVNd0xqVXlNak0xTnlBd0xqVTBNREkxTlNBd0xqVXhPRGcwTnlBd0xqVTBNemMyTkNBd0xqVXhOVE16T0NBd0xqVTBNemMyTkVNd0xqVXhNVGd5T0NBd0xqVTBNemMyTkNBd0xqVXdPRE14T0NBd0xqVTBNREkxTlNBd0xqVXdPRE14T0NBd0xqVXpOamMwTlZZd0xqUTJOVE00TWtNd0xqVXdPRE14T0NBd0xqUTFPVFV6TWlBd0xqVXhNams1T0NBd0xqUTFNelk0TXlBd0xqVXlNREF4TnlBd0xqUTFNelk0TTBnd0xqVTBNelF4TlVNd0xqVTFNemswTkNBd0xqUTFORGcxTXlBd0xqVTJNek13TXlBd0xqUTFPVFV6TWlBd0xqVTJOems0TXlBd0xqUTJOalUxTWxwTk1DNDBPVGc1TlRrZ01DNDFORE0zTmpSRE1DNDBPVFUwTkRrZ01DNDFORFE1TXpRZ01DNDBPVEEzTnlBd0xqVTBNemMyTkNBd0xqUTRPVFlnTUM0MU16a3dPRFZNTUM0ME5qWXlNRElnTUM0ME56Y3dPREZNTUM0ME5ESTRNRFFnTUM0MU16a3dPRFZETUM0ME5ERTJNelFnTUM0MU5ERTBNalVnTUM0ME16a3lPVFVnTUM0MU5ETTNOalFnTUM0ME16VTNPRFVnTUM0MU5ETTNOalJETUM0ME16UTJNVFVnTUM0MU5ETTNOalFnTUM0ME16UTJNVFVnTUM0MU5ETTNOalFnTUM0ME16TTBORFVnTUM0MU5ETTNOalJETUM0ME1qazVNelVnTUM0MU5ESTFPVFVnTUM0ME1qYzFPVFlnTUM0MU16YzVNVFVnTUM0ME1qZzNOallnTUM0MU16UTBNRFZNTUM0ME5UWTRORE1nTUM0ME5qQTNNREpETUM0ME5UZ3dNVE1nTUM0ME5UY3hPVElnTUM0ME5qRTFNak1nTUM0ME5UUTROVE1nTUM0ME5qWXlNRElnTUM0ME5UUTROVE5ETUM0ME56QTRPRElnTUM0ME5UUTROVE1nTUM0ME56UXpPVEVnTUM0ME5UY3hPVElnTUM0ME56VTFOakVnTUM0ME5qQTNNREpNTUM0MU1ESTBOamtnTUM0MU16UTBNRFZETUM0MU1EUTRNRGtnTUM0MU16YzVNVFVnTUM0MU1ETTJNemtnTUM0MU5ESTFPVFVnTUM0ME9UZzVOVGtnTUM0MU5ETTNOalJhVFRBdU1qZ3hNelU1SURBdU5qVTNNalEwUXpBdU1qYzNPRFE1SURBdU5qVTVOVGcwSURBdU1qY3pNVGNnTUM0Mk5UazFPRFFnTUM0eU5qazJOaUF3TGpZMU56STBORU13TGpJMk56TXlJREF1TmpVME9UQTBJREF1TWpZME9UZ3hJREF1TmpVeE16azFJREF1TWpZME9UZ3hJREF1TmpRM09EZzFRekF1TWpZME9UZ3hJREF1TmpRME16YzFJREF1TWpZM016SWdNQzQyTXprMk9UWWdNQzR5TmprMk5pQXdMall6TnpNMU5rTXdMakkzTURneklEQXVOak0yTVRnMklEQXVNamN6TVRjZ01DNDJNelV3TVRZZ01DNHlOelUxTVNBd0xqWXpOVEF4TmtNd0xqSTNOemcwT1NBd0xqWXpOVEF4TmlBd0xqSTNPVEF4T1NBd0xqWXpOVEF4TmlBd0xqSTRNVE0xT1NBd0xqWXpOek0xTmtNd0xqSTRORGcyT1NBd0xqWXpPVFk1TmlBd0xqSTROakF6T1NBd0xqWTBNekl3TlNBd0xqSTROakF6T1NBd0xqWTBOemc0TlVNd0xqSTROakF6T1NBd0xqWTFNalUyTkNBd0xqSTRORGcyT1NBd0xqWTFORGt3TkNBd0xqSTRNVE0xT1NBd0xqWTFOekkwTkZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NDhjR0YwYUNCa1BTSk5NQzQxTlRjek5qUWdNQzQwT1RNMU5qSkRNQzQxTlRnMU16UWdNQzQwT1RFeU1qSWdNQzQxTlRrM01EUWdNQzQwT0RjM01USWdNQzQxTlRrM01EUWdNQzQwT0RVek56TkRNQzQxTlRrM01EUWdNQzQwT0RFNE5qTWdNQzQxTlRnMU16UWdNQzQwTnpnek5UTWdNQzQxTlRZeE9UUWdNQzQwTnpRNE5EUkRNQzQxTlRNNE5UVWdNQzQwTnpFek16UWdNQzQxTkRnd01EVWdNQzQwTmpnNU9UUWdNQzQxTkRNek1qWWdNQzQwTmpnNU9UUklNQzQxTWpNME16aFdNQzQxTURBMU9ERklNQzQxTkRNek1qWkRNQzQxTkRreE56VWdNQzQxTURBMU9ERWdNQzQxTlRVd01qVWdNQzQwT1RneU5ERWdNQzQxTlRjek5qUWdNQzQwT1RNMU5qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqd3ZaejQ4WkdWbWN6NDhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdYekkyTlRsZk1qTTFPRE1pUGp4eVpXTjBJSGRwWkhSb1BTSXdMalk0SWlCb1pXbG5hSFE5SWpBdU5qZ2lJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakUyTWpFd09TQXdMakUyTWpVNU9Da2lMejQ4TDJOc2FYQlFZWFJvUGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RGZk1qWTFPVjh5TXpVNE15SStQSEpsWTNRZ2QybGtkR2c5SWpBdU5UUTBJaUJvWldsbmFIUTlJakF1TlRFd01EY3pJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR5TWprME9USWdNQzR5TkRReE5ERXBJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0MSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NiIgeT0iMzYiIHdpZHRoPSIxNTQiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiB2YWx1ZT0iIiBzdHlsZT0iZ3JvdXA7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjIiIHZlcnRleD0iMSIgY29ubmVjdGFibGU9IjAiPjxteEdlb21ldHJ5IHg9IjEwNiIgeT0iNjIiIHdpZHRoPSI4Ny4wMDAwMDAwMDAwMDAwMSIgaGVpZ2h0PSIxMjAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjciIHZhbHVlPSImbHQ7c3BhbiBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE0cHg7JnF1b3Q7PiZsdDtmb250IGNvbG9yPSZxdW90OyMwMDdmZmYmcXVvdDsgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5EYXRhIFNvdXJjZSZsdDsvZm9udD4mbHQ7L3NwYW4+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjQwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii0wLjk5OTk5OTk5OTk5OTk4NTgiIHk9IjkxIiB3aWR0aD0iODgiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjM5IiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFRVUFBQUVtQ0FZQUFBQnJyb1VKQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJoYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pJMk1Td2llU0k2TUgwc2V5SjRJam95TmpFc0lua2lPakk1Tkgwc2V5SjRJam93TENKNUlqb3lPVFI5WFgya3pFem1BQUNpRTBsRVFWUjRYdTM5QzlpdDJWWFhpWTUxLzI3N1dyZFVwWkpVaFJBakpoQWptaUNRb0FKeWxhdUlJaGRQZTVTbTZkUG5lT3R6YkxVajNRL3FZOXMyeituMmFMZTI4TFFOallvZ2lOS28wQ0kzTVNBR1NFSlNxU1NWVkZWcVYrM0x0L2QzV2ZkMS9yLy9uUE5kNy9wcTc2cTlhMWNsVlpYNTMzdCs4emJtbU5jeDVwanpmZGRhblpVUUZSVVZGUm5kN0ZkVVZGUVlWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FLaVlnTlZLVlJVVkd5Z0tvV0tpb29OVktWUVVWR3hnYW9VS2lvcU5sQ1ZRa1ZGeFFhcVVxaW9xTmhBL1Q2RkZ4blNiS1FwV2NyRExaUzRXQzVqSmplWG15em1jVFNkeCtOSDA3aHdjQlNQeTEwNFBGYjRPRDUrZUJSUEhSekc1ZU9KYUh2bXQ0cU8rYTFXWGZGTHZFUGh6bnlXd2kxczlWV0dmeUtiOVR1dUg2eFd5eFFBblk0NTduVVcwZTkyWXRqcnhXalFpNzN0clRpN3V4MW41RTZOUnZGcHZiN2lXM0gzM2s3Y2RVcDVXNlBZR2ZaTTMxTzVnWnhZaVZmeTF6Z1pyL2hFb2lxRjV4SHRrV1JZNXhJdUMvRjhFVmVQeC9IWTVmMzQwQk5QeGtPUFB4bVBYNzRTdjNMcEtBNG4wemllUzlnWGkxZ3NWaEw4aGNwMm9pdXAyT3N0SlJ6ZFdJamZSRUk1bFQrV2ozaUtLazR2bE9kNjVIZDdzZXdQWWlWQlhGSkdQSG91MFRJR3BRZ1NrcitVVUQ0VDJtYmt5V1ZDdkQ5UVM2UTFsdXJqVXUxT0E3QlV2WW52WkRVUE5VVnhxU1dOUVdjK2liN2FQMVRmK21Rc2Q5VlA4UkY5djl1Tm5zSTkrK0g4L3RiTStTTXBrVHQzVDhYOWQ5OFJiM25nTmZINlY5d1Y5NTArRmZkSnlReWt4RkF3SFZ5dXQwRXIrc3c5cldpaktvVm5RRE13T2JCRXlDVzhrK2tzSG52cVl2emN4eTdFTHovMDRmalE0NC9GNDA5ZGlURTdiN2Nma3NlWWllNW9QdGNPdjRxcEV1WmE1TE9WQkxmWEZSZnQySWpjY0pnWXMySXA1SldyOUxSOUtqaFFVQ0pGMkdrbEw3dWxoSDRwSCtFV0hmUWhwWkQ0eVJKWVhSVVpFWlV6QzlIWVY1cnk1NE5ubnZyZS9PbjU3ZVd5bE1EbVVPT1RsR2lVMXRtVlEzSElyVkFhY2xZZXFEbVEybVZ6eEhuWkwya01QTHh3em9OUFNsWkNkQTR1V1luMCsvM1kwcmh1RFFlMmRIWTFybGd0cjk4YnhZT3ZlRVc4K2JVUHh1dnZmVVc4NHV6cDJOc2F4a0JLaGxGSmY5WTRFZjJVeGFlOFVuRG5OUVNzdWVQWkxDNWN1Um9QZmV6UitNQkhQaGEvOE1GSDQ3RW5MOGJGcTFlVk4vZlNSNWduRXY1ajdmQlhkaytuOGl3bkJGTUwwN3V4VjVkMnZaV0VsQjJjdUFSNmhkQXFibUdRWUhhRysxbG9LWUpRWXpaRGw5SldxNlEwdXRjVGFxVk50Y0RYUW9LdmRPcTNJTW5YVHBzZ0JVRjlLbC9xQTR0R3FLOFA1UGxweTZNZGwrSkxFRS96elhsV0FGSjkwNkhMNHpxcXE5TlZ2dWcwMms3clNXazVUOG1vU1NZQmxXa29QSjJxNTZKUGFwUTAyVWVxYzdYQU1wSENQWDFhYlZBNXpVMHMxRmZhZzlJQnRHZCtWWXhsZVlqbGx1clpFYzg5eFhla3VMRStWcjJGampvNzhicjdYeEcvNC9XZkZwLzVhUS9HQTNmZnBTUFByaFZIVHp6V281VndNdjV5eE10ZUtaVE8wVXRNK2Yyam8valFvNC9HcjMzZ29malpYM3RmUEhMaFFsellQNGhyazFtTVdZZ1NuT2tTODNzWll3dXhsaU83cjNhanRBdVhaYUhGZkR6M0x0V1R3MlRudkk0QzZQZUhrbjNPODRwSXdGZnM4UFlSZkRueFNDWitGbHJ6RkEwK05LV083YU4xT3N2UkNnZjFJVjlZMEI0RGdXY0JrMVBDb2I1SVFGeTI4SVpIOWdFQzlVeEFPWjFjSHExNHY3dGxvZTVxckx5TXBBenNvMkdGanM0QlBscDRoNmN0Sk1wWmVKVzJrQ1VrV3Q5WFVJNzJsR09JM0hBcjhWMllYb0lQWC9FcGlxMXpuSlFkbzJFQkZoOHRhSmRaY2UreXJRd2RXMkltaTRvNldBM3dGcDhPYmUyaytrUEhtcDc0OTVhVEdFZ1Rib3Y5MXFBZnAySW43amwvSmo3OVZmZkdaMzc2YStNelgvZEF2UGErZStPT1U3dStGM0V6VkJ5VUlYMDU0R1dqRkVvbkVNeWo4U1Nldkh3NWZ1SlgzaDN2ZnVpRDhSOGYra0I4NUlrTGNUQ2Q2dXd0czFrMGN4YmY4RHg3bGtaQnk2b0lQa0xySFZlTHFLT0ZxTjIvb3pKcHJ4S3RsWVNFVDI2NUtIRzVJc3gycVMyZFNEdTl6ZjhzeUVrd1VualUzZldpdHJEYk9sQTlYbDB1RUpNZEZySmdVME1vVmtETzc0NjRjOGg1b0FpamRtVFNaMzFKUlpNdjMySGFtdEtHaGU4Tk1GT1gyamk1VlBxVEpJRFV1OHJXQVJZQndDaVlkOGNheGl6d1RzejF1d3pqcStNRjVRQUtBYUhPZ2c5V09uNkpzTldIekFzRkFVdVVxdWxMbkRiSXQ3SmJ4bUMxSzUwd1ZiTFMxYTZ1bEJSRHY1aExTY0I3T1VyMG91MnBiRWRyb3J1Y1JRZHJKTGpqa1dKWFhTdFprQjN4NmF1K25VRTNUc2xDTzcyN0hmZkpvbmp6R3o0OVB2ZTN2em5lSkV2ajN2UG5ZaVJsc2g3Vk5BOHZOYnprbEVLN3NaajBqMSs2SE8vNmpmZkV2LzJsWDQ3LytQNkg0dU5YcmtrcFRPTklDbUIvTUVxTGtublI3aDFEVFJnN09BazJNN2ZTZ21PeDl2RVJUaHdGNUdtWDZUWnA2VktQWGQ4VHJmaG90TzFkREFWanF3QUZJdVZDR2VUTnh3Qm9pNE9QRlVqYXpia2lORmlwcHNsU2FBVWowdG1PNmNnM3ZkSTcxRUdhaEd2ZW1ZbGw1cVVrTGVOMWNhVXRvbGdTUUhVVW9Gd0E3YmxaWEdlWkRIbFN3WmhrUWNVcVFMQkwyb2dqZ3hVR2pwMWNWYXJ1a2ovQnZJY21zNVpkb1ZheTh5UFV3bUkzV1JvNEJOOVlLOEpCZDZGcU5mNElPWUt2dW4zY0VELzRENVlEbGVXNk40MkxVcFd1VVpMZ28zQjZzaFRjRmlrUkxJZEdxY3BEc2M2eE10UWVGSjJWaHR4S1IwYzd6Zm13TjVDUk1aR0NtVW5CZCtLTWxNWDVuWjI0LzY0NzQzV3lMcjc4Qzk0ZXIzL2cxZkdLODJkalN4dE9ialpUKzZMR2kxNHBsTVpOcGEwL3F0MytGMy8xM2ZIVHYvaUw4YXZ2ZTE5ODlHZ1oxNDRuTWRYa3Jib3kyWWZENlBSSEVqVU51d3AySlprOXpEd3QzcTRzQUFRSEV4dGhaV0ZOa0VFT3puak1sTUlzQUdRbENkVzVWRVpTNWgzY1BKSUFLbFU3eDFocDFNSGxZc2xuMlFJdDdTM3RSQTFTYWlxYjBKSFNTZ3M4S1FYWGs5dUc0QzRHV3BSa0V5K0tBMHNHS05pYjdpYjVWcG1sKzhGb3FRd2QwS0x1b1IwYVFDaUtWZ09XMnZXZUNaMVpGczZNcHk4VkNXcVJhRU5oQkN0ZFJxU3dzMVdubTZmNjJ0WUo0d2NkTkZrb3lVVndFZXhsT1Y1Uk9HVW95QTZmK1U4ekw4cXJIUm81ODdGbGdFQVBjajcwbE9QZXdadUJvS3llMmttZnJNeG9uMzE0aUtIcnl2VzRIeXFISlNNeXpaTDkyVUpLMThwSWZCbEtGTmRVU3NKeklPWDAxRFRPblQwZDUzYUdjZWZPS043OHVnZmppei92cmZIV04zOW0zSFhIZWQ5YnZCanhvbE1LTklZV0hVa0QvL3YzZnloKytwZmVGVC81czc4WUQzMzBZN0YvZE95ZHVUOFlSRzg0aWxrMzdZUnBSMFlReXJtZEtaT25mT2JhUW9Zd3lVKzBhVElhQVV4YVFQRjBFVWNieXFVY3p1czRDMnpadGFrRGp6d3VCNGxRM29tdW56MnYxSlB5bmQ1cVg4cE83WFkrZWZMTGhhTFRRRllFalpVQ2xMWkMrRW84dDVkalRxSGhCT1I4b2cxZDlrSGJrTGdlVnJrZElPK2lqUS9VZE1OQ0pFRWdyeWdFZ3BtVUplYWQyT0djTDNSMS9FckxMNlZocXEvNUkyenl5QzlDS1o5N0EwTmg2emVFSEJyVHBYQzU0N0FDZEI0RlV2bEcwTzJ5MGpIZk5mL1VYa2lwSzlIN1dDUCszRmtVeFdMK3RNUDBwVHcwNUVuWlNERjVXWmE0TDBOMVZGSGE3dlpXdk9uK1Y4ZVhmdDdiNGt1a0tON3dtbGZHaml4WmoxdHJpajRaZUZFb0JSckFZNzczUGZ4dy9JdC84elB4MHovL1MvSCtEMzhrcm5aSGNlWHFnUmY1YUdkYmRPemVvczVDc3V3TnMxRHlKd2xYV3lud2VERDVXZEJFMTFZS25oM1FVZ3I0Rmk3eFE2d2J4YUV5UlNtd0ZrZ2plWm5waWF5VlFoSlFKZGlIeHVuVWw5dWU2T1NBZmFYbnRqWDhjblpqUWFoRnFlN0VZOFZxQTZVL3BrbmwwNGFjK3dmZ2FXL050K24vRFpITHFCcVdTVm5jQmtLaTRrMGNvU0NNN3poaCtHT2FFMDBDaytpZFlLV1FTRlBaNHB1M014S3Y1cDRCQVlRZnZ2a0krQkxrUmxnekg5UFFmc2hNazhvM1NnSHdTTmYrV3FoVE8xdUtKNWR0SzRWQ2cxSklZY1lvbFcveldXb0R5OFB1OGlnRmZJNUp6QU4zR3gyMVp5RGE4MXU5K013SEg0Z3ZmY2ZueHBlODR4M3g0S3Z1MS9GTTYxZmx5M1I5b3ZCSlVRcFVTSzFQWHQyUFgvd1B2eG8vL0JNL0VULzNxNzhlajE2K0hNY3pEV3AvSU5uUmVYQ3VNNklHcGorUzhJdCt6bnNBQ0kzU0xCeTlaSDY3QXhMc0pEaEp1Tkxpejdzbm80cmdXQ2dWMFdJdHdwNkVUT21FRzZHbWdBUWFaUUdVVmdTektCOVFlR3lXelhVcXY2dTJiRm9TS2Q5MG9KLzVOd29oMWRQa1p3V1MrclZXQ09reVVyQlNTSXJIZWVLVDJwVEt3Y2Z0RTF3M0tENmdYVGNCU3BURlg1WUxWVnRCV3lCTGVoWThkbGVoa3pTVDhoQW0rZDc5RlRDTmxJTDlYRllDWngraHNvOGpzMVdtRWJ6RXY3U2xDQ3Q1aldKeCtscTRyNnNVU2hyV2pmT1NwV0xsUng5SUEvSnArMG5GME01dkt3WHk2SytmbXFna28yQWxKZjcyUmNQZHg2S24vUHpFcFV2L3AxSlNzNm1Vd1NEdXZlTmMvTzdYLzliNDJxLzgwbmo3MjM1WDNISDZGTk5wWGk4MFBxRktnWXU2Snk1ZWlSLy9sejhkMy85RFB4Sy9mdUh4dVBqeEMwbWdkdmNrRzFrZ2ROYU92c0pIaHdwTFFVZ0pKRk5PZVFvN3JuQW43OFF1azVVQ3dwK1VnTVNvazVXSGFiSlF5OW1hQUFxbnZLSWtVdjFKZ0JKdkhBTkVHNjBrc3FKSTlDbHZyVEJVM240dTN5aVZ0UkpxSzRVVnIrNWRWeUdrdXBmT0YxUSsxU1YrcHFNUGtLWDhGRmRaUjVKU012S1p0ZEFuSHNrSFdXWnZpS0pjV0NMRlNtZ3JodVlDejhLaFBCWjhFWHo5dHhDUlF6bk5tTXNoUExsOEoxc0t4V1MzUUx0TXBzbjVoSGt5NERTRVJ6N3Q4VDFLcm9OMEM3emk2N3BLSHVGU1BwZHh2dEphK1c2di9JWS90SFNZZExrTmEwQndIZVE1b2pRL1FVbjNJZTZQbjRJNDBpaURGTTdsKzBwemUwcWJOQ0g0S0pQWlBBYnpsWjltYk10ZytLelh2emIrYjkvNGRmSEY3L2o4T0xlM3A3bFIwOHpsK2NjTHJoUmdmanlleEMrODY1ZmplMy93aCtKbmYvay94aE02RWt4bEJYUzJkcng3ZDN0OXZ4ZmdOVEFZcHQ1T1pCVnNKeUV3ZUdUb2tWQWFUVmE1VG1lUThpUWNuTnU5MkxXUWsxQkR5bzF2RWdoYkRTcmpQTXhhK1VVNGl0QTJRdTN5UFhscklWcGJBcG5XeGRMeHBGMjI3TmIwZ1ZocVV5NlQ2VXI1RGF1QjhncGJFT0dqOExJb0ZkT1RMeS9UZU5KWWZTNmYrMVBxTHZVcWJEcFNGRy9xelh5VWtPSTNBdlNNTlV6S01tRlJGNllHZ3NDQ1Z5S0wyOGlXUVZyN0RqaU9zTGVFcUNnTjB0YkhnaVE0aHA4S3JBVzhyUmlBQlNvRnpLTXQxRTE5dWF6TDJNOEM2SEk1ano2UWxpMkZvbFNhOXVWeWlhLzRsSFRvN1N0ZStwUHJMMHJGZHloT0owMWg4MDAweStNRGIzcDlyR0xSdWp2Vzl2Q1VQNTlFU0haNmc1NFVReWZteDlkaVIvNlgvcDYzeHpkK3pWZkZGMy91NS9vMWI4LzE4NGdYVENud3ZzQVRGeS9IOS8vakg0ci83Ui8rbzNqa3dzVTRuTTlqcmdYZEhZMjA0TldabVJheDEyWVdQZ2wrVDRQRVl1UXhYMjhvODFzNXZ0QkI2Q1dFSG1RTnhQYjJYb3pINDFRWjVSRWdDOEphMERpQ1VOUUNrWVhOZ2tGWVFFbUE1Z0lQWVNNZmw2MFFuSGRVNVNXbGtnWEplYW45RnRqQ3Q1UzNwUUFaUzJ3dHBLVU80bFkwZWZmSE5RcUJOS0Y1T2tBNk5EbHNYc0lxSHovTXE3RWkxRWF6Sy93ektHUFhpdWQ2YmdqVENHV0o0Qk5zbGd5cldGeGFnc3Y4V0NDSmU2Y1VUSjhFQXFGcDB0Z0Z0TnNuWlVCZWkwWmVLVitVUVZ2b0VMUk5KU05hNkJWZld3cXR1b3BTZ0s2VWFiZXZxU01yRlNldjQ0a210Ylh3UllINTJBS2djNzdTbkpmYXkzajRrYWZTM0EveXBFekkzOVZjelpHSldYcnN5cU5zbnBheDNqbDZkRkVFczRtT0Z1S2hZMFZ2cFhLTGVTd21remk5dHhPLzlkNTc0ay8rc1crTHIveVNMNG83enB4dXB2WjI4YndyQlpoZGtETDRPLy9yOThVUC9NUlB4c01mZWlTR3AvWnNDaDhkSGtaZjRmN1dNTVlIQjFyL2U4MEM1cTFBSGgwUzUwTkJTVzFLc0hTK0l0K21PQmFGWHpwUkxUeCtaQUJ6K2FjcEJjcUluanhQUGVrV1Nsd1dMQXV2Mm96MFpvRnRhRlIzVitucFRtQ2QxOVFqSktXUTBndE5VanBKMkhoWkJqVDhLUzhhdDVjc0xCMlhvM3ptbzNyTmczSVcrbHlmazByNzVBdlpTMjBBYXB2YkFhZ0Q2Nm9nODJ4OFVDeXRHNkdZQkN3UmdtV3BaTDlSQnNKYWVKS2dPV3pUVDY0SW9ZVWRtaVFjVHNlVkp4YUVLVzhhQ1pVRUF6NUp1RkpaQ3hiNVFtTXBlTDJrc2tYQkpNV2d0UUlwOUpRdi9QRmRqbmpMWmQ1dDZ3UTBkVnJvaXdLamJVb24zM201Ykx0OStQU0JkaXBJbTN5MGtGSkFDZkJ1WEhuUnpLOXUrMzJMWkgxMHJORFZqdU5qSDVuTlFQeTBlbnhCaWZJWVNCWjQ2dnJLODJmaU83N3RXK05idnVIcnBDeDIwMUs1RFR5dlNtRThuY1VQL3RNZmplLzUyLzlMdk85REQ4ZHhkMWZyV010OEpQT0ljOUl3Q3dlZDV4aytMd3JRWWZjNU40TjhqZ2JxZEhjeHN2YWNjY0VvNlJ4c2J5ay9IVFZJbjF0ZWlvQmw0U21Db0hCUkNzMDdCQllvaUZNN3lNTlpqenRQN1NrMENxc1Z6NmdVb3B2ZVdOd3NtL1AxbnhlTHdFbWxnSi9hbFlWUzRlc3JCZlVsODBxK2FFRHhjMWVMc3ZDRkpvQ1dQbkl2SXhSK2JnTndQdDR6S3dXZWJuZ1JsN2twd2xUaTNtbXpFQXRGTWZnb1FEbVVndlBrWEZacm9PSFJDcmZ6aWxJQU9tS2FUaWc3ZFBGZHo3TXBoWEo4eUdVYUdqelM5VDl0UG9McEV2MWF3VUd3cnB2eXRvU0lDNnY4OU9La1VrajFFNldOU21lY1JISlNLVVJmTWlCTHdPOVBVQURIa1lTNjFFanVGR2F6bWZhL1ljeW00anVkUm1lNHBmSXF5K1pJL3c0UFlsZUtvRHMrampjKzhKcjRiLzc4ZnhsZjhQYlBsOUxJYStFNTRIbFRDazljdWhMZi9sLytWL0d2Zi9HWDRsakt3Y0lNYXkvRXRORDl1bkF4YVJHRUxNQkZhSk9nWkFFQ2xIRmFXdlNONENFRUZCSHRTVXVoblAxSnM2REp1VzdGUzVnZDFjaDBmQTZCY0xxbkVBMTVsQ21QTk1sejJ4T1AxS2FjTGxjRWV0M094Ti85aFE1ZWFuTXBuMmh5T0N1b3BseEpsK2VHT0o3VFQ1WjNYd3ROU2M4K3lmcm52cmNzakkzK0k0QXVDM0VxMDRDNTgzc0tMR2pDTFdkaE0xVkNGb2dpZkd1aFlZR1RScDc0bEh3bkpSb2pDMXk1dWFkZENJODNFcERMTmI1b0VnOU05YnlydTN5cW8vQXA2YVZNQ1pmMjBTWm8zSDJFMmZGMFVRaTlCUmRRM21YWC9KM2M4TVN0Mjlmd1Y5ajhpZWU2MGppazhpN1RMaXRYckpUU1AvSTlNN2w5dEpNNE5DdmVwcFRDUUxYUGpvNWpwRTFrVjdMM1I3LzFtK0s3L3Q5L0pzNXM1MDNyRnBGWHgrM2hrVWNmaTIvL1UzODJmdnhmL210LzdtQ3VzNzZQQUJXM2h5S29GdHdUcnFBZGJrUHBWZ0NDRmRNSkpDV0pRa3YrMDV5VnlETzRrbjhkbUdkQnUweHhUazUreFhQSFZ2NlU2QnlyUVVxQ0QrY2REUWJ4UDh0Uy8wLys4ejhWRnkvdlo4cGJ3MjByaFd1SGgvSG4vL0ozeFkvL3lJL0pIQnFxamNzWW5UN2xNMC9GN1FQaEtjNENWWVNwcERsNEhlRnVwVHRQUXB5c2hCUmZ2NWFkckNQT3NNWFprbkM0V0NpaWNackNPVzQvVmRLNHBpNG41L1FVMmNndk5CVzNoL0cxYS9vejFuUjBZekFheFhnMmRYaXhzeDAvL3EvK1Zienp2LzN1T01hYXVFWGNsbEtRaFJOLzkzdS9MLzc1VC8xTTlPNjh5MjhkNmhEa20xTStpRkp4ZTdpaDhKQ2U4OXFDVnB6KzJKWHd5Znp5OGhOaEZsSDVrQlhPU29NMEJKOXd6cU9NYVFvdE5DWHRPcTd3TCtHVHVGSDZCbTVFY3pObFB3WFFINDZpdDd1YmpoS2FLK1R4NlBqSTRkR3BVL0YvL0tOL0hQL1h6L3ljODI4RnQ2VVVNRm0rL3gvL2NDeTQvTk5KNStEU1piVzA3OGVKelhtdzRyYlFGcDZUUXZac2dzVlNNQTBMUnE3NEphMXhMVHA4RkVCUkhFWkp6N1NLYkZ3cFhBL21sMEg0WlB5V0FIM21jY3RsWDhhWWMzZkhyWXFzZ2ZuUmtSVjhmM3RMc3JpSy9XdFhZOUVieE4vOXZ1L0wxRGVQMjFJS3ZJdkFsNU5jZS9LcEdHM3ZhT0prZXVyWXdObW1PMml1eGl1ZUozaEh1QVd0andCZDd6NWhuY2IwSitmM0hGWjhhTG1kbHVCNmM0eXl0N3J6M0dxN04zQURKVkNWQS90dmV0TzN3K041SFIvbWk3bGRsNmRPY3Z2N1YrSTNmdk0zTS9YTmc5bC96bUJpTGx5NkVuSHFUQnhjTzRpdDgrZDhTNHJXcW5oK2NFTmhhZ25hMDJoeWZKa0ZtY2VxaEs2cklPQ1RmZWdTbkVLaS9pWWVCbnh4cGt2cEordHV0K2xrWHNHTjBpdHVEZjF1THhhVDlDVXkzT0g1eFQrTjdZS1grdVNmdWV2TzJEKzhkVm04TGFVQVh2LzZOL2dlQVF0aGZHVmZHbXZicjI0dVNhdDR3WEZTQ0s4cmNLUzEwd21qS0tCM05PZWRwR3VRMDl0MExaeXN1K0ZYOFlLQ04zcEgyOXN4a0tYQVJyemd4U2UvbTdLSzN0WW9ya2toUEplNXVDMmx3TG56aWQvM2JSR3YvVjJ4OWNTbDJPbU1ZN2k2cEJ5eDdjbjhYRTNscldMWTYvaWJhL3pjdXJ2Z2U4aUNieXJ6bDJGQXJiTVFMcDFaMVFrNm9pRFBhbkU4Tnk1aHNsc2IxUTNCWUxEejhhRVp2bmRncVNxWDNSUmVpUkVPUGpqeko1eWZMenVjK1Yrdm1wTTc3dE4yNEpad21JOGE0c2xKdHJmaUtleDZSSkNNZDg3THhFbGN1Z0Vteis4OEFMNjFpR3gvZVl6Qy91aTBzaE5kZnFiT2V3VThEcVllUEw2Um1jK1pxTTd1ZkI0ZHpFdk5ROWN2aEltQWhTVEh0d2xadWVOMFZyVnpQbnpvQjIybVdlSXYzMDc1NWJtNTY4MjJDZTFpM1BtVUtHQU11cm0vOU1GcC9xTjI1WEx1czBwelcwRzNFajg4UlR4ZVdmR283K1NYeGE0VSsyM2trZ21zcVR5dzVVNmlPTllBRFVsckpZMDNjWHFSZXBLUXlYSS8xbW4wbndNWGZXQmM4SG5MMDNFNTAvbTlCSEZUSGFUeGtpdGZXKyt3ZVBRVVlsYlQvSytkMjkzVkhIVDU1cWlaWEhwL2dqSGwzNEEzMTNxTG1DeU9ZN1lVblJTRE84QkNINTdTZlBaaWRPVkNuRjU4Z3A4K3NORDJQdU8zeGRZM2ZWMk1QK2QzeHRGaUsxWlB6bUpYRFJwc3dicXZNODdLMy8rL2NFZlZrWGsvK29kYTFGZFcwVmRIVUFaY1NpNzkrbkpyT3ZPa1h3OWxRVHdiVkdNRFQySkJxL3hKWHUxNG1zaWJnTWJCNVlwcjRZWnQ1Y1VVKzNteHQ5eEdXL1BpS3ZDaUZFSEQxMzRwSU5xU2prQWpUQVc1amN4WktZdWdQNU9EVi9MVG9tN3pzQUlsVFNocGdNVmUrUHVOd3V1Z1BhYUZGaEJ1eXVKbm5vQXg4YmhJZVpEM3RQbk1aWEh0UmIwNWxtdVlQM240VHNpdW9CMStBZUQ2bndVZGY4Vi9YL3FocnpGTEw1NGg5NmdKWEhjNGdzaEtIOFZPdi9tMFVFK0tZRFUrOEZOQUs1aGJ4RzBwQmRVWWo2ZzlZeW1HMDkvMHJiSDFaWDh3cG1mdWo4TjlhYS9EdzloZWRHTW96ZFhsZFdDT0ZYeFBvczVCUFNtSHZlM2RXTXlrTEJwbG9HNlR4MXVPZEtTMUlNcGtwNGw4RHJNbFhrM1pteXhmSnUxcGRlTmFiWFA4SkVoUytucFhZZWRJZmdQbGxUcmFLRk5vSVpOalVaYzMyL0FwNHp3eThQV2Z2QlRHSlZvN2RsL0hLWWVTU0Q2N3V5MkV2SXZkMEtFTXNPYk1XK1hnNFhLSlYxRU81cGZyTHUwcmIrWlJGdDhmRExLZmFFcWVvYkRMS0Zpc2dBMWh0aFdSL0RLbVRvTkhteTdEdklVMGR2NWovdXUybkNpVWFleEttd3BPMG1ZOGpjY3pvRTE3c3R5TitKRGVXMGdoTENVUHE3NjZpVXMyU1BLWkFva3YxcU5rWnRBZnhGQmowcDhleCtMYWxWaGRmTUt2U0tmdmRMZzEzSlpTMFBENmE5TldzKzBZM2ZmRzJQM2lyNHc3dnVtYlkvaTJkMmhHVGtWSEp1ank2RGhpL3lBR090OE1aS0oyWlRWTWV0TTRHRTdUZ0RBbVVnSTI1eFQzYldwT2N4MDNHRFJsUEdOZWdYZTZreURwUm1WYmFJUWFwN0RiVllxeGVBb1BmTGttMzNIKzA1ZE5ZVWhDQ3RGYUFCeEhLRnFMMXVrOFhKSnZ2bDRPeVFkZTVPYUZnQkpXT242VG5zTnlTU0RVRHR4aTdkSkhoVy9zT0dxa2p3ckxsL0xtRTNwdW8rSjJ5aXV2TWx2cGlHZHExN290YnI4VkRINXFsMm1MSWpGOW9tdjZuY3Nwb0x5a2ZEYVVTUTRianVlNUVaM3JCdzJQVFREbTY3blVuNmVUcERhMVVPb3RybzNyMVFHdVIxdHdQUjV0VjdDWWFRWEpDbGgvaGdUZ2EreFFpaHJYbml3RjJkdFNJRklBaHdjeDJkZngvYXJjK0pvVndpZGNLUUIrMm16cmFCWFQvV1ZjTzNWM2pONysrK0wrUC9UTmNmYXIvMGdjdmY3ZW1OKzVwNmxkeHZ4b0hNUEpOSFkwb1lQT1ZJMDlkSWQ4YXlySFpDNWxPYXlrU0ZpOGZLN2hackV4b0sxQlRjS1VPdGtzaEFLVHRoUFdLT240YVVHZTRNK2lJVTllRWdLSUU3M3pVK0gxNGhLaGFSRnNKNlhGZmxQOG9XTVJtQzRKVWhLUWxKWStiSlBEQ0dNcGo5Qlo4RVdmZmJlMUtBZWNoUHhtbk84Y1JJK1NTSlpDVWhoT2c2ZkNhUnhVRi9XV090VWVGRUxxV3hIcW5FODc5VjhCeDB2N05zWUJaNGlQL2xxZ0dUc25GUnFGUzVrQzhvcWYrZUlYM3VzNkVwbVJ3MmwrcUVkbzgyeGhveTdoYVh5dmgrdmszWWkycEJkKzdyc2FpSTJnemlTbk5hSERldlJtMDVoZHV4cmpTeGRqZHZtaVB5REZuUkcvMDFsNDNDcTBrVDZIVWhtOHAzRFhqL3g2WEpacGM2ZmNvWTRJdzlWUmJHK2QxbEhnVWd5ZitvMjQ5cEZINC9KL2ZHL01mL05ERVU5YzBQbG5ITjJkWVl4MlJuRThrN2oyKzlFYjVxOWZVei9vT2xhRHczSStFNVVQOGpRZjlsRTVyQXN1SnpQTjB6NDZMWlF2V2FGTStiQ1MrWERaSlo5UEZib3NRMDU2dTd3YzMreVU2Q2lmd3VRM0wvYVVQTnJqdk5hbk11VTZucnlVbC9obmZwd1BUVExNUG1WeTN3b2RQT1Fwa1BKek9aZUhWbGdtS1pHVFVpMDhBRHpJeVBHVTU0RGp4U2Y5bWVCWG9GRTBoRmttQ0xUQUFrMXgrQ3RmWWVKWVpjbFBkRndLcGtEYTdWMCtDeWNYZEVzYXBiQjVJTHh0Q3dORmFGNUpxVGpjV0JlWnY4dHpySEZFY3BMek16K1hFNUsxazlwSFdhZTdqdFIySS9OZVd6TktQNUdIUXJYaVV0dW9FeXVKSGlaK20rV0IwNXZqRjJucCtKTXNyZlZScUswb20vNEtYVmtLTEFWNDl6dzJmTFNhQytEMEtjdis0VGltc3RTWHZBSXc0N3RGVmpHUTh6akx6V1JsUFBEQUEvSHd3dzgvNjF5M2NmdEs0Y2MrR0plR3l6ZzNPZGJDMVRFQ00yWjBOZzc2VitPZVhqZEdhbHovNkRER2ozNGs5ai93bTNINW9mZkY4cU1mamJoeU9XSjNOekZpb2ZlSFZnN2NLZkQ1aVRtRFlBSFFnaTVDVndRSFgrblBwaFM0b0RFOVVCa0xwaHpDNDBHaVREdnZSSGtMSVhDWjNJYTIwcEJMOVdkRlVmSXlYLzlNR2tDUlpQNytlRFA4bkpHLzR0MzhWZGI4UllQWUtXaWxRTDVTRWwxUk9pVHovWThhSStjTHFpUGw1VFlETHFneXZRSC9BcVdiNXpPQU5rTGhSVXVZT1FFc2NnUXFqNCtYa09ZTTJMSXBTNnI0Rm9vc0hIS04waWdOSzRMa2haOW9KRjFKd0lEeTJnb0IvZ3d0VnJVU0VyMXBGTTQwcVJoMUlXeUt1OTZjQnozNVJTbTRmRXR4Q1lRbG5nNDM3UlAvb2hTYU1zcE8vVTgwMTFVS1dFMUdLays1WjFVS2NsbzE1dXRqSEY4M01CM0xrdWE0enNldHBWaDBKUGVidytMUFV2R1A4Nm84ZDNXOHhDUm1WZ29mL09BSG4zV3UyN2hOcFJCeCtwOStPQTY3QjNHdU80bnUxazZNZEV4WXJjNW9QVTVpTkRrZm5TMDFabGVON2gvSDl2d2dlcGN1eE9Rakg0bkRSejhXMDEvOTFkaS9kaTJPWmY3NEJwWEhLbHRiL3NJVm1yWCtqc0lzTUcyZlJYMFRTcUhrUDU5S3dmV1JYOG9qOU8yeU9iMnJoWjNTRWNCU1I2dk5XU2xZTnVpVCtSTXBkWm1OZWZvYmxlQ1RyUVZEdmlmUCtiUkJRWlpTeVVjcEZqUnB1QkordHFtbkFYa2hnNndVR2lVQmYrZmxCYzNDTHJzb3k0cHFuRTFDV3ZoRitOS3l5eDFrNFRzdkM0VENTWEdrdUk5ZHppY3ZLUVhpU2hYZFdvaE9Lb1dpcUpveUpROWV3bzJVQXJRSXJEaW5mUHB0T3ZrSU9NcTRsSUZQNFN0L1F5bEFYOG9ZVDFjS0xrczdsTjd3QVU1UHg3VU9qNHQ1SVdsOEZLdGpXUVVUTElOWjlFVHJ4L2s4bmhZOVZmbStTT0cwdm1ieG10ZTg1aE90RkZaeDZvZmZGOGRiM1RncjgyWGFHOFhPaWwvZTJkTjhIK29vb1VuVHZQYzErVU10eW9HRW5MUE9RQTJrTThQSG40aHJPZ2RkZXZTUnVQTEloK0xvaVkvRy9OS1RzVHE2R2t0cHc4NnBQUXNldjgzWUc2U25GMWdOY3ltUU9RTTlVa2ZwckhqNnE5SVVUbCtaUnIzeTUrbmJtZmlKdC9JZGovUzJURGIzRnVrZGlmVDdFTTNPUlhuUnp2dEtOWDhXcnh5RkVkNThEN0xNM3hRRmpZWFN3YlhRMnNKeCtlS3lNaElOdnRzQktPUDBUSStqckpLZHJmajZleWpTa1FlczFGZXZTZ0NQNHBNbUdqLzFFWW9WWDlwMXN5ajFBQyswM055eXc4bEFUUUVXZXN2M3dnY1diSUVGajdKd2VsWWdwR2RoOFJKc0MwTXA1MTlvRWtwZTJhR0JCTFVubVhIUVpaSXdsRjBYK0Z1TnFKdDBUSDNDMUptRlhDdkVkTTQzYjlMbHd3OWdyaE5XV1JZSVA1VVBiL01SYlgrYXZwbkw5WXVBK2FUK3Nvd0dZNjBKZUNzTmN6KzFMZFh0dmpBOTlFME9KY2czT25lMDdoZFNBaXYxZmZmSnAzeFJtSDdSS24vSVVHV2JhVEVyMnBQNlRwN3JsMitsSnF2OWszSjh1Rldsd0srem9SUm81QTVmV3FtQjdHdncrOGVITVpXQzJQLzRvM0g1OFkvRzRlVXI4ZmdIMysvdlpvaXhKb2VYYW5vRERhU1V3MmdVQTVYdERib2FXZ1pDVG53OUtXNVpHcUFZbkhJc0NVa1NQUDlhbFBoUS85eEp5bFJobC9SUUlJd1NXcFJLUHdrZ3pnWmF5VmNlYVVrb1ZSNWhLL3hiSnI2SHRnaThhZUF0QjQrU1Z0RFF5WGNjK2pWTnNUVEswU0xWcjR3VWtZT29sRTIrdjlQU0lVaFNtMUtrK0NYd0xNaE1HbUVYS0xuK0tUZWg1QlhmWTZXZFVaNEZUa2dDeXY2ZXhxWUliTElzc2pEaUE4SVM0TFlsc002VE5BZ29CZWZsdWJQUU5HMFViVlk2cFBtQzBuNnEwNHB0S2hQYzVTWFFDQ3RsWEU5SzQ0dDduWTVDMFZuRkx5cjVSYTRrNUJ6bktHOGVva21XUVJKY08xNGt3cXFBblZ3NWZya3RRcCtqd0p6SDhod05wam9XeU1yMnkyUHAyNWkycFJDb3grT3N2aFNsa0JnS3NGYjhKYVVVUmhwR3k0RldJMHFCcnh3c1NnRXMrbElLU3QrU3N0Z1I0WlpXUjk5djFtbHdwQmxYRng2TGcvMnI4ZFNUVDhTVEZ6NGVWeTQrRlFkWDltT1pQMGNlZkFpTDVyT1REOUtYdnJLREYwRnFmb1JGWUtlbG94d0R5Z0RHVHY0dFNWeGJHQW5qc3diaGhSTEFMRmRRa1hVWmpqZDBzTVJMT1FubHBoQzI4NkF2YWRtOGQzdlhmTXBSSUszYzNDN1JGTVZBWnFNVUFEenRVd2MrTkNpdTB1WU0wdTBuTDFsQXo0Q3lORHh3T1p6aFJiZlNZaTRvK1VVb0hWZEZ2aHNvYVdYeHNqTXFybTAyTFQrdmJxYzM1Umw4anBTZzVEbWNhWVd1WkVRUng4MUhPMjNpbC9nMzcxaGtJWlJVcGVISmFUMGJBaW1QY3MxZGdmSVNQNlVoNktxYjM2amcrT0doczdXeDBLYVMrZEkya2NPWDNaNXkxRC9Ya2RyOE9OOVRodlpnL1JCWCtyYU8yZ3NKN3BJbmJsSUcvSWh0UTZ0Mmxla3BWbFpiS2FUMkVYMkpLWVV0TDFKZXU5QVJRQjBwU2dGUm9KRWplaTBlWEk3MHRYcFJIRnRLRy9UN291dkdtUzJWcDhNeXFaYlQ0NWdkSFVncHlKcTQ5RlFjWHR1UHh6N3drVGcrUG82clY2L0dFVGV3RENqZEtXNXZWeFhwdnhRRlh5UFBKemM1WHBTZGRBbzliYkFpVWFzUXVHUVBLbGR1a0pTRzd3NVVoamI3cTlzSytKbXZESi81N2E4RnNaTXRFdUxwaVFSOHlKU2pyakxydVQxcnhRR044cXdVQktjVlJaT3NGR0FGa2NPdTMwRjRPR2xkSmtlVFJPUk1lNFh3QmlDYlJaMWhRZFBZbEZMRkFuQUZqRm1MbGppdmNKdWVjbHJCeVRJb1pWcjBwbGt2N0VZQmxKMmVPTFF3d29kRy9McUwxQktYYXltRXd0ZjJIVmtJTnV0SXpnb2hDNDdIaWp5UWVlQlRMdkVrWFdrV1V2aGhMUWlVVWY0Q29hZGZ5dVBYcm5xaVEzbjRHS0Mwby9rVjAvSUtlV2VpdGNaUDR1T3o0WWxtaUhXaE11a0hheVVENG9hY1VCYU0yU0NGY2d4eWcxVHZrbllLdkw5QU8xOXlTZ0U1d0ZMZ1cyYzVrN1dWd3ZiaTJKLzA2bXZISGZKV2xvalprNVBUQU9oTXpKRmpTeWIvcm80S2ZQZjlJT1pXRUdqV2tjYjNXTXBnZjM4L0xsKytiSGZwMHFXNGN1VktIQjhjeGxPSFYvTlhhS09CeFErRmdBTGdHQ0tCR2tqb2FZY3Y3NVRIM1VJU21yU0RqVk5RdENxSDRFSXJYME92UkdHWUxBaGcwNzRJTExUQVJ3V0JNa3B1bmpBNExhVWJUcU9Pek45NStzUE1lc2RQaXFYZEJpTXJEVitDUWc5VCszalVsZXNYS04vd3VVbTRMd1ZGMEhMWHZXeTRTTTNMeDAwbG5PbEF5V3NFbmpsMWZsclVuVWFva3pEYU5UUUNTaHM0VCtrZ0N5NUlGMnlLaXo3eFQyRUxzcURWNS9iNmJVb0UyY0tkZGwzbytTeU1RUm40bHJLd2doL2pWK3J6b3c0VWtjb2l6RXJyZDJUeUs5ekJvcEdnZDdRbVZ6cVNsRytoWGh4ZlRrcEVhN0JQZWZXbkoxcnE1MEp5ekowQ1NrRThHRCtQcmNxUjUyUERYR0htVzVscGZGTmJtcmREWHc1S0FVc0JrU3BLWVdlUU5DRUtnQStIc05mMkpDQW9DSlJGajR0Q2RkS1dSR2NSMjFybjJ4SzBnUmpCYjF0bE9DN3d1WElzQ3lZVnkrRklDZ0gvNDljdTI0SzRjblUvcmx5KzZpK2UyTDkyR0lmSFJ6SGhhNm9takp3bUZJZEFzUWgwcEdudUZQamRCUVlUb1pVaTRjS3kzRWN3YkhOK29OU0RMWG9yRlpXUnd3YzhoNGZXRjMwV1VvUlN0SlJYV3ZIcHVhRStPMDNCcEJ6VUx2TlA3WEFlMW9UekUxMFR6Z3BKU3lTWFVTbmFrK3NCellWampwZm9qZER3ejM0aitJS0ZUUm5OOGtHZ2hMU2pKU3haeEFWRnVFcWF3K3BYTzE1b1VBenl5eTlJWVdVay91ektTUkJTV09WemZjWEViaXNZbDgvS2hMWVhoVkRPOURNK25FY3Y0ZUZkWGdLVkZRZjBIZC8rU3pnUmNya09lUkpnZmppVzlON3NLTldwdEpoSmtDV0U1WGhBRzRkY2xvc1BzOXZUR29PV2RZNFFNNlpYZWxJaXROUDlTV01LRFFxQmR2UnkvMDhxaFplVnBYRHlUb0d3TjIveU5EbDlDVUc2ZXhDOU1yWVcyWEtBRHNVZ3pUN1VRaWVQWjdMOU9TOXNNT2hjWUthMFFSWXMwaWFEZ1c5dng5T3BmNjZlNzdCRFdSd2NIbHNwWEw1eXpmNDF4UThQVVJaajUvT1JWTjRiMXd5cmt5d0VPVG9DRUc3aUROdXVqaGVBQnFJWTZGZFdDSVRYUXFneWRCUWZXbnhBbWdBdFMxVUI1V2MrQWhQalBLS1VVYmhZQ1Q0NmVIRVhaVUIyc2pMb1BiQ2VUS3dhR3NQODBpNzZUSEM5UWtQWFdpcGVkTW92QzdCWlJnaFlScFBHWWk0K2FTMGE0bFl3SmEvUVFpTkhxd3NmTmdpSHMxQllLUWpYVXdpa2NwRUkzSDdsMGM3Q24zQnZ5ZU56dFQ4ckE3OFBZRis4VURxVGd5U2djcnptYllXa2ZBcy9kTEpZcVZkL3pNZjF1eDBwcmEvMTJ5Z3gxV0hhdk12VHB2RnFyTFE4eUlKV3NIMkVuWHA1TTlFUXIzYi9tbnVRbDdKUzRFNmhyUlNLcFRDYWpaS1NZT2ZQMXNCQW5ScG9iSkNYN2pMOTZBWEhDNFMrbkJHUkIzYkJyWjdNcnF3SXVDbjI1R3V5aXFrNDdvODh1RXBSQWJXQ1I0aml3bDBDeW1JaWk0VDFOVk1jSlRDYnplTm9Jc1Z3TkltcEZNbHkvMkpNbFk2U0dJK2xVS2FUbUl4bk1aRnltV3VSakxWVGlMRW5nWDlKQXVYVERvWjFLS3VEeVVDUTNXajFQRFZlQkVLSkN3aHlPb0prd1ZZNVd3cmwrR0E2bGFPZldUR29RdWR4ejJFYTVlTUQrcGtHcFBCeU1DSFROUDZOY0oybDRZVjlBdlEvQ1hiT0t6UzAyV2xaaVdhaE1laWJ4aXVWUzR2ZGFORTBpNTF3WHV6cm93aHBqRWNSbUNRUStpT1g2NU9wbmhTV3l1WTFBZjlDdjNWNDJYVnh2dWNJMENnRmpnUEs3ODcyVTc3U2lqVnJJYy90R21rYTRNMzZZcDNOY3h0TDJvSWZKc2x3RzhoakxESzIrUzBIcFZueGFJSTZjbzR6QkVycnBKdFVPT1UycC82VjQwTWExaGVsVW5oL1VncFRLWVgrVUVwQjVuNVdDajR1cURIY0ZXQUpjSVRDeDFMZ2N3OWRLUUh1R1Fpak5GSjZva0hJUi9KUkRpWGYxZ1E4c3BKQVRhUnltakNOQWxPdzBNQXVOSUFhUnI4VnlYVDZkeW9WWjAwd3pQaGdhcUdSTUVLandpcG1BY1BzUjRobTBzU1V4Y3FZcWRCWVBrcGlCbi94bU9ZN2k2bE1SNVRLUkQ3S2hQQmNFeldhWGt0S0NhZXkvbkNLQ2pMa2FSSnpRN3gyVkNIdFlmTGNMUDZvdDhRTjhwTUY1SmpDaTFIT2h6VFR0U2VmbDZNU1VocGpDN2dBcEtvWlg4alJLbHQ0TS9aQXF0TitJc0xMOFJ4dDZqYThRbE93OUl1WG01ekdLcGRQZVh3ck84M3Rja2Q1N2ZGSUM5b3ZBQWs5THVDVTV1SHg1R0M1d1UvbDVXL04wMDd1eVZDWlJKZk80d2p1OE9BS0thWnRsQWtLb05TbjlNWnZDWjdib0dLMHcvbVpoK3ZLY2Fjem40NlVkaWMrRGtPVythZDQ1bFhhSWZEZEMrYVo2YWl6ME5NbjVzTjl5VzBUb1drNFBwakd6YUhlek5ObFUxNVZDczlSS1l3OWdHbUhuYXNkakR0MHhJdFN3R2NxT0xQeis1Y01Gb3JETkxKa0ZpZ09MUTVleldaK1haZDJHaVp6Y256RkUrU0pGVTN5MHdUaXVBeHQ4am1yeWw5cXQzSWNHdFVMQ0RjTEovdGdZcGxMWVM5Qyt6a2dMRHZiL0hVZWk4S1h0MFphWEpOc2NWai9DTkFVUHFEOFZxWHB2U2dGalZsQitTbDV5bmdYRXhpWmRwdmdUWndaS1gwb1F0VFhtQ1JhT2VYUjc4TGYrVHkvRjF5M3hoV2F0Y1dnZEQ2aFMxeGptbWcwZTdETGltSFFlcm1xS29XMGxtNEduOUpLNGRobnRtUVpvQlJLdVdJcGNDbklsTXhKMXlqTjVOTG5NcFNuY25QZU5OTVlhQnJNSncyazZsR0k5SjRhaCsrSlZhWDJGUytDeTlNVDRxYlJCSktQSzR2Ukw2M2tCZFBtUVFkSW02blArSVhtWkpoMkcrSUhFSXprVXk4bWJtcmZPaTJIYzdrY0Zad3BYK1VMVDQzNVFHZDJ4anlWa3lOUDZVMTVWVnVVQlgxdVhpNFNEV1U2YzQ1ZmlTWUpWT0pQSG1sWXowV3BtSm55RUs3U2h0VlNTcTJNR1gwVG5YL2ZNby9UVXFjM3crVlNuVlVwUERzK3BaVkNPVDQ0WGVGU2pqaEt3VWRMKzBvWGFWc3BvRGdXZmRKWkxJbGZtbGJtS3FXVkNiSVRVM3dveXBEM1ptbVNVOXhNTFRCRkVEcjVJZ3lVOG1VQk9TMzdMSml5WUwySTVNTmpvZDRXQmVTMndJTWVLZ21hSkFRcG43THROTnh5bW5uUkkva2lXdGV2ZHJLVHAzU2gxTnZRS2tsSHB0SVg2azFsNVJPSGx0ZUlCY0tOMExRRXNjT1pIRHJ6VURwOUZBOEx2dElYUFZsdThsTjZxZ3M3anpHZ0gyUFByNkJ3VlFxVXZEa2dSNSt5NEpMU1puWDJ5OEFWbjhIMVlBdUZqc2VmdkdLTlk5cjhocVRJbVROUG4zeU9IVE10R0hhNjNrSUtiQzVsSjMrNFVIbUZCL0tIMnVYODlZbWl3ODI0cjlBWmVxTGRsd3ROWDJweU56SFBsNkQ1Y3BUZjFQQnhSYzRDeEhGREx2MlFLWXNIcFNMR1duQThzVUVZT3JKb1dPQjh3UTAvYTI3QjBJTHBxOUU0WHJyeGl6Y0ljY3VOVkJiSEpUQStMOXUwM1VwS0hZZjZXZkZkZ25McVNlTldIYlZOYVhZS0UxOTFjeG5lRWVob204aHVsVjEwK0lxeDVKYWRMYnQ1ZDVqRGlXYlpWWjdjUlB4d1V5bS9tZmpoaVBPb0ViL2l1ZUZUV2ltZ2hVODZsRUR4aTdJQUpUMDlwVWpPUUJ1Z0ZRUnV3NkhIT3VycEh5KzY0TkR5ZmlOV1BocmNPNXJDZkRpTXB5czltVlI5bVVROUxDQzU5TzZGckNOL3ZtT1Ezc09RSys5QytLMU1sUzBLaXpEMThvU2lVWER5UldBSFhkb0ZGYWU5T2V4ZHJUanZNSnRPaE9LVjYyQmJBcklRN0lTRkZDTDNMRnpTRXVaZEpGL1VPbDFWaytmMHR0UHVwN2JoejN6cWwzS1VJenhmOVNUZ2ZWbHdPcHBwYWM1RU04VXBqRTBCN1ZSSHVvbnkrUmtVSHZhb3BlS0ZCWmg4NnNaUFQyc3FuZ3MrcFpXQ0JTTzdndXVGaTVXQXNCWXJBWWVnSVIrK2NCTnRNUm10SEFnT2RjVFF1WGFsTXcvblcvdlphWDNIZkRhT3hYd2lNM3VtelhzaUF1M1FGZ2RjRWp6YVFLaTAwL0dzdEdRditOOWNGc0FpTzc3Wmw3aS80VmNDWkFVaEh3SHRjckVvb1VuOTZVczRsU2NGZzF0SkdlSHpjWFVMbE1LWTUzTUVXS3RrWmtGV214Rll4UkZDRG9VNHFUSlpKUXFya3gzNWRrdnQrblRZNlhKTmVnbzdMaTcwV1NNaVg1YUYrb0tablk0SGlEdDlFRTFIS3NFKzFnZDBXQit5ZEJheTJxUkljRVB4RlZlcGxoVG5YOFZ6dzZlMFVrZ0NzK2tRL3VLSUZ4Umh4R0c2NC9ja1pMeDVDVzAvZjZFSkw2Q2dIQWhQTVdtbE5TYVl0WExFN1dRK1QyUTYrRzRFeTBDemtPNWZVQ2paNUpmakxxUW9BQlNEMjVPdEFWeHZJREhnVTU5eWZQclREbVpaMk4xZVdURytPQlVQWDVEQ1N6NnUzSlA0cmtRMCtMNHJrYmphcWJxaUNQQlJETnk5ekJGbjZwZFEyaUhvY2oyRVVjZWluclp3WEZmYVpMQlFYRHhUT2s3anBEVG8rYkZCT3duOFFIejdLRU9GZVltTnRHNVhkb01VUW8rdy9DNktRSDV5U3VNOWhLbkdUQTBuekFlY2VvcjNzNnQ0Ym5ocEt3VXRETzh5N29aMkJpMUt3MXUybG5VV2F2emkydkVTUGdrRXA3anJvU21MME9vZkFqT1ZrTTlVNzhMbmJQSWs2R3BlWDhLQkc0cG9JQXRpSUw4dng4ZCtsMUlrT01RQjhaQW9xSHlLNDlJYmU5ckZ4WER6Y2d4RklUZVhzTXZ4d1NEZWpQTkxOOHJuTHNFZnlzbnRUTWVCZEJ4cUt6dnNHUndmUnVOSVkxOXhxUmJIK1JLUHZuamhCbEl3ZHFJWmlGZGZZVDRGaUZQUDFXNVpPK3I3UWtwUFRiSHJFTmI1bm5RYit2aWFNOTh0eUtGY2ZLUlFQNWxKdFZ6cHhKV09nc0hNa3RLeGt4V3lzaHRLMldtczVIakxiU1hYNlV2eFNhdHk4VHVUbXc2a2tPVXpCMTRLSjhDS3dUMGIwdmRyTVA1NTdNMk1zTm92OTNMRlMxc3BWRlJVUE8rb1NxR2lvbUlEVlNsVVZGUnNvQ3FGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2FvVUtpb3FObENWUWtWRnhRYXFVcWlvcU5oQVZRb1ZGUlVicUVxaG9xSmlBMVVwVkZSVWJLQXFoWXFLaWcxVXBWQlJVYkdCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FLaVlnTlZLVlJVVkd5Z0tvV0tpb29OVktWUVVWR3hnYW9VS2lvcU5uQmJTcUVqOTlXdjNJcytnWXFLaWhjZDN2S1d0K1RRemVQMmxFS25FMy90dDkwWmYvYXVYb3g2M1poMFJuRXdQQlhMd1RnRzNVbkU3RGlXbzFWYzdJL2pjbjhXNDk0cWVzdUlVZlNqdTRnWTk2Y3g3UzFpR2ZOWXJaU3hYRVYzMllsZXB4L0QzdEQ4aXl2MWxiQ3g2dXNQWFZEWkVNT09IRmhCMDB2aGlvb1hLU1phdHpNdDM3bVc2a0wrSWxiNmw5ZDV2eGVyeFV4TGUyNlprY1RFWURtSXJnb001NFBZV282VU41R3N6Q1UyVTIzUTh4aU5ldEZaTGFJbldYcnRwejBRZitrdi9hWDQyMy83YjIvS3pFM2d0cFFDdUg5dkZIL2h6US9Hajc3dHdmZ3Y3b3U0ZTNreExzMm04VlR2WEp6dG5ZbnRvMUdjUGRxT080OTM0K3hrVzQwZXhsVXBod3RieTlpYmoySm5Qb3pSYWhDRFZWZWRrVHlyVTR2RklpWXpEVWhGeGNzWUNCOXJuczJ3STRlLzFOcGZ6aVRvT0RJSEhTbVBXUnhMQWN3R2k1ajE1bkhVbWNSQ215MXlnc0IzdTkxWVRLZmFVRmZ4am5lOEkzN3dILzVndk92Zi8vdDQ1enZmR1hmZGRaZnJ1aFYwVmtJTzN4WmdNbFdqSGptYXgwODllalgrNmNOUHhLTkt2RHBmUm4rd0V6dTluZGlhTG1VaGpHTTVYRWJuVkM5T1g2VlRHaHhweWw2dkV3TXNDVzMrWGJoMWxyR2xIVjhHaUxSaFY1cHl4ZmpJVjF4cGZhVjFwUjlKRzRpMjE1V1ZvYnlGeWl6VURuRzI1aVcreENjdWpUdFRkNWUySkpLbXBqYlM1eDNSbEhLS1E2S20yMStvT2JpWjNGTGxvWUhIUWhwWk5vNWNLcitTbGFNQkZaRUtNY0hTNElBaDlxUUQrV1hJVnd0S0NrNlRsYU4wL0laV1lXaGRQb2NUTGUwV2FKL1NHQy9UaVYrS3E4ZW03ZGhmYXJkUklPMUFTeTI2WmNwWHJ0bFFIMmxOMitUTVI3VEF0QXF2ODlidEFwUmY1OG5QN2UvbWVrcWZFazNtSTdoZG9FMURwekl0MW1RcVQ3bmNadWVsZGpHTHRMdTB6VE9kNlZlMFBjK3o4M0o1U1YxRGd4Q2xOUG5NYXVadGVncXlFRnhldkV4VDJwWnBtR2NUbEhqaTR6QmRORzF5emZ5VmRnRG1YelNHMGxKZnNrK3pzS0lWN2c5Nk1aOXJidVcyZHJkZGZ2TFVVN0c5dlJ1ejhUaGU4OENEOGEzZjhpM3hUZC80aCtNMXIzbU41RWtXUStMNm5QQzhLWVUyNk9leHh2RVhMeDNFeno1NklYNXAvekNla0gzVWlhM1k2VXFzRjlPWWFVSHNkazlaK0pjeSsvdGRCSHVwWTBnUzlLNUdaU2hKckVyaHhLSXlMZTBXYUovU3FsSklQRjlxU3FFelZaM01TWTRYMnBJLzFBQmN1M1pORzJWWENtQTd4dU9qbUI5Y2pXNi9IM2ZlOTRwNCsrLzgzUGpPLyt3L2k3ZitydCtsbzhNb3RmbDV3QXVpRkFyZ3pMUmYwdUQreHY1Qi9KdUhQeGEvZW5FL0xnMkhjVFRVdVdpNnd4Q0tRaE9yQVJpcFY5c2FKQjB5WXFqVW9jeWlxaFFTZlZVS3VjM09TKzFpRmwvS1NxRS9LL3hWS3RNVkI3cmpTZXpzYk1YeDRiV1lIQjdFblhmZUVXOS94K2ZGSC92V2I0M2Y4M3Qrci9KMk5BaWFVMU0vZjNoQmxVSWJWRExYbjhzYTMxODVtTVFQL3Rxdng0WFZic3hsNnF5a0NVTkMzWkhrRFRYSkk2MlZnU1pVVmxOVkNrNXJMU3JUMG02QjlpbXRLb1hFODZXbUZIcWVsalQycktVRmN5REFCUXhYM1poZXVSS2Y4L2JQajMvOEQvNWVuRGwxT25aMGZIQ3Rtc3NYQ3NqUkp3UjBBUUcrVzFMOStYdWplT3RrRWZQM3ZqY1dIL3hBREo2OEVGdEh4N0dsZ1VNWjhQU2gwNmxQRHlwZTNrQm5TVVY0RDFuSXNUbXVocjNvYkEyanN6MktxWTRNL1FjZmpMZi9nYStJczNmZUhUdDdPMWJzTDZSQ0FMMTNja1g1Q1FKYWNUcWJ4UysvK3ozeGwvN2lkOFV2L3F1ZmpZOTg2T0c0ZXZsS3pLZmFWVkVJM1g2TStzTVk5RWVLejZPci9uYzFDR2l2SG1INUpZMS9wUFdrbGtuVGZ3MHh1MlAyUzd5VmppNG1ES1M3OVRlbks2a3BsNUpSOVBieGNLbHNwckh6M3BHY0s4K21ITE10UW5hTkF1OGNvUGlnN1BoT1d4TTB0QzFpYWpQYXRObHpuU0R6VzlPbW5HSlpsUE5yMmFsS09lcEx1MWhPeUxEVms5RU9ueVJjdHpjang5ZGxydCtueHVJeENvMytaSkpOdmluUzBCQW1wRHBLUFUyL2dkT2FrV21OeVpxbTRXKy9WYi9na3EzMkY1ckdGenA1Zk5meFZuZ2ROTlp0V3lldWJGbWt0ZE9SK2RzZDlHT2dvL1Z3YXhSOXVkV2RkOFZnZHl2KzdjLy9mUHk3ZC8xeXZPcVZyNHo3N3I0bmVxSmQ5K3o1aDhhek5Vb3ZBR0F2QXkvZSs2RVB4Ly8zNzMxZi9MTi8vaFB4K09GaHJMWjJvai92S3c5TnFTWm9RTHBuOXVLdSsrK0xWejN3WU56NWludml6S3MvM1Rlc08zdDdNZFJncmJTbzArS1ZScFVXT0RVOThPT1lmbDlsKzlLd3lzY1VtL05ZeDZaWXZ6aytNUEJMSFRubVNwOHBIOWVKa2VLeVdEUTVwcEdHd2ZoR1dWQVB4eDNvYWIrZHlsTUsvdVJCdDRDbjJzOHhncVpoUWxJWlhWb3NaNm05QXVuRlJBZE94OFFGTEE1TVZLWGhtd2ZJSmlldUhoOXltNTJYMm9WZzBPNGJIUjlZR3lYT1VjQithUWRZVGpXSGxKVlRXZHF6MEVaVWxQbXA2YTU5NkRIdjhlZlpkL29zaWFaWGg5SzdLdXUyZUx3WGNYb3hjL3RtcXROSFZGcXM5WUlWelBvOWlsTmE5MUlHbzJGMGh3T0hXWU02U01BOWVsTzFhWjc1SFkyak4xdkUvYklXdnY0YnZ5Rys4NDkvVzd6NjdqTnBUajBTeng5ZU1LVUEwNlBKTkg3d2gzOGsvcWUvKzczeDN2ZC9JTWFEVVd5ZlBXZEJ3ZzFXT2lLb1U3eTRNV1ZSOHJJR0M1N25raEx5M2oydmlUdnV1Q05lL2VwWHgzMzN2OHJQWEUrZFBodTd1N3RXRXYzbHNRY0ZIcUJNR0JNSVpocExsQUlLM2RPT0FLc2VMbldZckdWbmxOSVZSK0VRNXQ0QW9lY1o4R293YUNaVi96MnBubHp4eDBlN2s0WlNtTGx1VlVxR05aQWluZlVDYWdzZWNIb1d1clJRTFFIMm9UVllyRTdUZ3MvaFJKdjZoL3lRVnBWQzRubFNLZERmRWk5S0llM21DUWdkWUR3UlBQZExxd0IrWUVaWTlMWkVxRmM4dUllZ0RXRFpubC9hMUxRanBSMVBKeEorbElER25hZHVjdDIraE4rS1FkYnY5aDNKN0tYZDhoZml3ZHJ5WEtodUxWWlp6cjBZeWkzRjZ3eVBJSStQWXYrUmo4WGVIZWZqYzk3MFFIem5uL2dUOFlYdmVJZXNhNDdjU1E1dUY4KzdVb0RadGVOeC9OWC80WHZpQjM3MG44ZkhIbjQ0dG5RZTZzc3lPSnFxb3hvVTVNYkR6b2hqTWtuNHVsSUVUSW1HUitPZk84ZWtwWGt6M2JZVXdyMzMzU2NsOFVEY2VlZWQ4WXJYdkNLMnRyWmlUNWJFYUdmYk93TURXaXlGT1JNaHE0S0JubXJBcWRjS2drbVNPNXhwQXJMU1FJNlpUdWwybFU5Q010YlFNRHhZQlZnS3E2ek1hQ09YaWlpT29oVFlYNVpsd1ZTbDRQUlB0bEp3T1dGZFRuNUtNbFpUeGljSlBtOE9kcmxOWm14RnF3SXhIWTVkVGtUUjB5TG8rOGFaZDIzZ296a2ZZZ2tteTVGMnpKWEd1aWpMZDZaMUdSMnR3VjVQUndOWkE3dy9rSzBFaUxUdHVVMmVEOVdmL0x3bWxHN01aN0tFQnpHL2RxQjJMV0puZTBkSGJkNWsxQ3lQajFUSkpGNTMveXZpLy9Pbi8xL3g5Vi81NVRHOHpYY1V3UE9xRkdiU2JELzhMMzR5M3ZrM3Z5Yys4TkdQUlU4ZG1NeW1NUnB0eDFSNUs1bEMzZUdPQmtsV1FuOFVrMzVhckhhc2N6UWR4NEd1bEFTbW53WVBYNG5pclVIejR3QTVMaUdWUGppMUcrZk9uWXQ3WDNsZnZGTG5yVHZ2dml2T25qMGIyM3ZKa3VpT2VHUWpMU3UySEJNbW1sQ3NDQVFjRFcybG9HV1lsRlFXYk5YR2dCQ2ZJbTVxRy9rOHRhQjZ5cnFNSnBVRlkrdEJUYVFzM2VoU1dCV3kwT3J4SWRWVCtwUm9NaC9oaFZZS29NU1pSTk9rcWcwMkFBQlA5MVVUWEt3QzBwYTk0eWEvV0FuNHhNR1JWZ2pyYXlYWFFSaDdBK21Ba1RvdWkwRHI4M2g3eTJQdU5hek5DZGlLZFIzeTU5eWp5V2VCbVNlK2ltc1V1RFdZVTJROGxrVXg4cXZPTTIyMnRxWkZ1elhhaXZGa0VYdTcyekUva3NMNCtNZmlMVy85SGZIWHYrdS9qcmU5NWJlci9IUEg4NllVRGc2UDQwLy9oWGZHRC82VEg0MXJPN3RNanhUQUtKWlNDc0huR0lxV1ZHMHJEY2hBaW1JMlluQnk5Ukl5Qmc4OXgxOHc2Y3Q4UXN0S1V6SzRDQ0tBRDdUVHNYaExTNmMzd3pScU9wdnRTQ21jdit2T09IMzZkTngxMzZ0a1JaeU9jK2ZQeDZueloyTW9hMldsTTl0TWsyREIwQVNpTUdncjg4SWk0YTdCeHd1NXVTYVpLckVtdUhmd0k4bTA5T1EwZFZKeWJVdUJ2bm5CVktYZzlCZkw4U0hSUEgzOCt6MnRuMUlYZmhINFBHNHoxcFhBR3ZIVEFSeGx0YUY0S1E1MlZhZFdyTlpubDdXQ1VzQTZsZFVMM1ZJQ1hPcWxyNng3QlpJVC95anJQeEZIQjZXRXJ6VFlMeVFHSzE3M2gxNXQ2ZWdZMFplYlRhU3N6R01McXRqYUhzYnMydFU0UFpMdGNlMXkvTUd2LzVyNG0zL2x1Mk1rMlhrdWVGNlV3b1dMRitPUGZlZi9NMzc2Vi81RHJFYTdVbTdxaURSWmFIY2ZiRzlyZFdpbmw4YmpMTldUdVUrVnkyTjFiRWRhVlJOSFBvUEpKS0lVckN0Rk14K212SFR1S3JxUGVISURUUUxLQWFkbFlYTWU1d0VISFozZk5JZ2RIVSsyZG5maTFMbnpjWWNVeGgxMzNoVTdwL2Jpek5ueitjWjN5ejZUQ1I4dExibE9YSnRxSXRRbTdpS1lKcFFDeWdNYWk2S2FoVkt3TXRHaTVmaVF0TDR5Q05malE2YkxBbSthekVmNFJDa0ZIUE5pdjdSREdFNnVpVytpWVYySlFtRzRDaHc3dFM2NGEvTGxINDhMWmVFdStxS1hEOW13ZjY2aHBTd2J4Nm81Z21qamM3dmtxRnVyaHJwOTk1QUtLWVY1WkJKVk93NTZLeVozM01lRWRPeFFuVjVYODdTK3RSbjFCcjBZN1o2Sm8wYytHcDB6cDZJekc4Znk4Q0R1dXVOc0hGL2RqeS80bkxmRy8vRjMvbGJzSW4rM2lOdFdDc2ZhcmIvbE83NHpmdlJmLzFSTXR4QnlDUmZ2R1dpZzJPWG5PaE1oK055d2Nubkk4UGc1b3FydDk3VnpLMmpCMDVUaW93QzZXVUZNYVpvRW5rK01vUzZTY2toMGFHc3ZaS0I0U1NzODhFZml6eHo1ek1kRXVUSzZLeC9lc2xhR0dyU2QwNmRpNzh6Wk9DWHJZdnZVNmRqYVVUcVBoazZmUzA4MXZBT29MK0xwbDVib2c2eVZJNWwvNWZoUUxocFp0QWdqMVREdFpYaEpyMG9CbXZXWXZOQkt3ZVdFVWc2MGp3OXpDUmRZYW00OWF2SlpPOXdkZWFsc1M5aFlWMVRFM0NPYzVEc3FDM0hNdUNyaWV1Um9GL1VRMTRiZ080cmNIeXNEMnFvNDh3T21SNm4vcE5HdTBuNFVoTWREZVg1VXIvSTlyVVA0THFiYVhDbERtNDhQWWx0VzhQSEZwN1NPZDhSakdaUERRL1BaR1kzaW0zLy9PK0o3L3ZwZmwvTFM1bmdMdUcybDhOOS96OStPdi95My9sWk10T3ZUSU5ubzZ1MHF0blYwbU92TTNodEtvS1RWRUpyNVhCMVM1N282YXkwMWFkMTUrbmgwR21oOE1WU1lNeG1UME9tc1B6Nk5jZ0FNYVVsYjhGNTBBYzl1Q3kyT3BCV0RnVldodU9ydDlZZjVzYU9HalFXcnJaOEoxMS9QSGFTdVIyM25jaWkyOTJJZ1JiZXplMHJCUFpscHU5SGYydGJSWnlpRk5vemVLU2tkTG56WVNWUkhCMHRJdkZHSVRQSjhNZlVrQXhabFZRclFySVgxaFZZSzNsVXpFRFQzdi9oeTEvYk9LRU1iRlFLR3lTOXJFYjhvaDg1RUFpa2tzMThGOGQwV3dxayt0NGQrTEtkdUIzT0JjUEx1ek5nTFdyRDFLZ2NkUnhMbVR6eTJGdG9VYzN1WFBBckZGMDFTQ3FzWXFnMStKT2w4OVVlVzkxQ1dBeDhlUEw1NlZXdDY0VXY2MmRHeGxxMzZJZG8rRzdHT0hCd3p6czh1eDkvNUgvK24rS292L1RMMzkyWnhXMHFCb20vK2txK0p4OTd6U0N5M1ZuRnBjaXJpOUU3RTFzZmp2aWNtOGZqWnJHbWhaYUNaakh6ZWN0aVhOR21TME01SklaQ1FhYk1qanVMQWQ1ekJrdThMbk15cjhQZHhRYjZHM2Zud05mL0NWNzdyY3JITUw1ZmZxRXZnVTJrR2Nlb2l2OVFqREdSVmNGZkNSYW9WaFpRSkw1NDR6RDBLcHAvS1lmbHdvakRFbnpUcTZua25TZVBJT0xEQWVXVHF1SnhPaWsyKy9taGRyUVhENmN0MFpqVnJmTktWWHhiVlVmZklRa0NZTTNORGd4TVduS21Gb2lUYVBoak0wZzVqSVhTNjdDS1ZoVWFCcHY0MmpZVmJTZER3dWY1Q2I1N0Z6Mm5sTldIenkybWw3YUF2WHZEVFg1ZmpIUUo4bnVORHN6MGZlZHc0Nzl2SnRDOWg3KzdkZXoyWGZBUVpwUzFKa2JJblhXRWNOOGRDR3BQVXZyYnk4MUdRZmdsT3MwRFR0cHlmbFFMOTlkaVFwdkpVM2RBRGhUdXRmc09UZnBaSDUwbGh3Q2Y1ZG1MS1VhU01KWXJFN2N3MFR1dE5GSmVuemEyblRuTW5RVHAzWEF4dGR6YU5ML2pzejRwLzlRKy92eXpabThKdEs0VzdQdXNkY2VucXhZamRzZUwzeHM2c0gwZWpDOUVmYkdsTXRPTUR0YWd0dFBibG5xdFNvQXpQZjE4b3BjQ0F1b3lwQkxmcjZVckJCRzREZVRtT2I2ZStjNjhpcGRIaDVTb3BDRjZ5UWxuMFpUMXh0QnJrdHNIRGlrTFdUbEVZOUZHOUZxTTB6aXdpd0NJcFdHSjVDVlRIUW9HbUxDSmFOWnV2bFlMelczUk95NVpNMnhXRlFIakU3WG9Pcy91dEJUb0x5bnpROENwblp2MWhVVGwvSmpxWGhSYmZaVk1ldEllWUFpNlQwTFE5SjAxa2FaYjFrY1pKUEJnYlR3V1BBalcvbXBzT2M0Q2x5SWRsQ0RQSGNqc3pyVUcxRENXQ0FLWVgwZEs3QUtvb0MzMFN2TnRSQ21WTWlsSkllY0lMclJRNm1oODhzZUdSS2ZWN1UzRWlMejlONHNGNzdvcjMvOExQYUx4U1ZUZUQyMVlLWno3cmkrTGc2SW1JVjBncFhOMkswWDQzSm5jeU1mM29qSE5MUEpGcm9TMHQ1SEx4WnBRQ3k3bXRGTktrUDd0U1NMUXB2cUVVV0taS0swcUJBV2dyQlM4MDhndi9YQjlsMW5US2w5WGpjTzZIcGszcCttOWE4ZUUrSlIrRmtpdnRWUnJ0OGNUSzE0TDJZajV4QkJwSWtaZzhwN1dkS0tNemxOV1JaNC9YdnUzbk9JdXBMRG92K3V6bkZuanUrdVAxOGVha0R6cFNLb0MwOWZFbCtVNWJxTi80cHNtTEh1VWdzSUFQczFJQnBRMmxmckFjNWsxRFNLMWZ0eC9NdXJJNkJmckw2S2Exc2lhWWE4eEtXMnhCV1BEa0ZNZjF0Vk02SDlWQUdwWVdKanhoQUYvQ0NGc3VoMUl3TXYwektnWGx1VGtXMGsrR1V1REpSS0xwNm9oQ0dpckJDUW9OanlaeDc5a3o4YUgvOE8veUdONGNia3NwOE5qdWpqL3d4K1BLdTk4VnZkMUxPanBwa2xjNmo1L1dEcmt2NGRtU0VBSTE2TGtxaFVTNGFTbFlTTW5Yb25CY2JvTy80UHgydlBDMXI3cWNuL0pLK2NRcjE1WFRtL3F5VWlqOEhLYng1cGVGbktXTmJ5RlhHcjU1NUQzZlF3MTljcDN0YlhtcER1ZklMOGVNTkMxWmFKcTY0YnMrTm5FTERpaFhsRUxoQjJaYy9HWTRYU3hMSGhpVi90OEFxMm5pbnhhaEZqMitCR3k5VU5OemZLTzl3NHJLNGJYTXAzWGE4c0dLUjhxQXhRNWNOZ0doMGNrNDh5ejNJQWgxRVhvSkJ5WnpFUkE1ek9ja0pDbHQxZEc1R3lCOHNIYWV6dnVFQmQ1ZE1haS9wUlFvNjFINlJDZ0YwNmE4dGxKQXZQbS9IdXVuSzRWMGQ2VDJ1dTIwVS9rMEhOTkIrZHVYRCtLTzA2ZmlrZmY4NnNhOFB4dHVVeWxFdk9uLzl3UHhubi8wSXhHLy9uT3hlL1pzekhTZW5uYkdjWHAyWjF6dHIxOURQaW0waEo4dnBVQUgydndUdjFUK2VzY0hLd1hZSXJnT2tIOGRwUUJJSTk1V0N2aEN0NTh1UWltRE1Ic3BrVlhvR0ZyQ1ZnNktBOGRsWVlpZmg5NjA5RDMzMzNFNTBFdWZsMi9TaWwveTZYZ0pGejZGSG95MjErR1N2aEhQOUFYdHNKRXNGZmVqTEdBdnZwd1dPcjZ3Q0J6UHdsQUVrRENQb1oxSGVxRWpuUDFzdm04NEwvenMvSElQNFZiZEpSK0o0UjBZb0NDV0U4S09FUGtEZFBLUHVET0JGa0ZWT1Q2YXorV3BoVXR1VGtHWEo1N3F1RldsWUw2T2Jpb0Y4eUNjQ2lzc1hxSTFIOUZ1S0lXbVh5MSt0RTMvbjBrcFNIcXNMSmRMN3A1eVhWSUlLRDRzb3UybnJzYWRaMC9GUjk3L1hrM3R5Ym05TWJRcWJnOWJiLzdNNkgzVlY4ZldHejh2anVkblluYWtocXZSeTRGNmxKRTYxWEkzQ1plN0R0cnBONks1bVhxZXJXeFJPa253bis2NDdlV0cyNXFhQlpRbjNwRFg0Y011Y3J5L2JqMUVPY0JpZ2Y0RVAvMVoremg0UWNmdE5ZL1B1UGpFOFVLTEwwRkxHUlJLU3lIZ09JcU10VkNQNTlIRngwMjBHT1g0eHA4dXI1enpQc214QkFmL2VtNjZMLytLRHZmeXAvS0pUNjhsZjZaZFdMeEQvSUpIYzdnbXJMSVQxYnZzUlgvUmk1NWNGOGNyZWpNSnJGekhIeWJLTHAyOTBycm04alc3cnFTOEsrbnBTZkgxNWZmVnI0SDhnU1JsUUI5NWQyY28ycEVFWXpDUG1aUUFHOUo0ZFJUOFMyUEcrTWx4aTY5eDVBWi9MdGM4bWJqQkdyamgycmdPVEN1SGZ5dmxLSE05M0N5UDdpcHZMQUFQWlRPZGFjNjFHUitPWTNsMDZDZEF0NHJiVXdwcXlGTnNCbTk0Uyt4OTlSK001V2YvemxqZGNiZTQ5dVBnU0lzSWtodDE4QllHenp5eXU1VkJ2MW5hd2gvL1Z2aGp4dk1PZXFPRktjc2tJTEFvQ3dudjBndFFaMXNXS0ZvKzgvZlp1QWlEZ21uM1dpOWdYRiswdUs1Y3RvZldUcnNCejhGOXdhU0ZUOWp2NUl1UFA3UWpQcjNaUFByaTAxVWJldHJsOE51dXIwVTFpSjYvTk5kTzVnNWY3RkVjWHdMQ1hXQVBYakxWZVN1OUw5NkRISWErcnp6UytrcURycTgwWHNuRitZa0g3Yzl0Y252cEwyRmxzV0M5ZzVZZDB3TWhyN2dWZTJGZjVMTEVGbDBKdEJTeGxBbHYrdUxTMjJUeTFSYjdQczVoRFdMTmFXbjdvNnlNaWZMRXNLczBQbi9BaFcrUGw5VUtxRHU3VzVuLzFPYW40NVo0M0FaOFlkcUlzT3BFQVU0bXNicDZFS3RMK3pIbkZXblQzQnB1Ky9odzF3Ly9TbHpxblkvNzc5NksvYVBIWXZZdmZ6ekdQL1Zqc1gxMUhzZThjQUVRbW1KMkY1L2svQm94UW5XOTQwT0R4dXd2UEhBU1JuWkg1eWZ6UCtYbDQwTk9kMzJnbVBDVVpjV1IxemJwUy9tbUxybUNYTjhHbllFRm9IYm9PRUFhajBueGZlYm5lZmRLcTVVZG0zUUptWlpjS2xiNndSdVgrS0p4R2RWVDdnczRqdlNYNlhqRmNVWXk1L3gwRElLSGlpM1c0OGNqTitjVkIwbStDRFVQNmlsNUtWczdmaElNdCs4RXpIT3ByZGptYUZybzVhV2JaQ3JEaGlkT1NLTVQ5Vi81TElva2haTDFkWjY3YnA5QUN2Zm02VFZ3YXJldnNzMXlWSGk1VEdOaG52Q1M3MFZPWE5qSzMyekY1VnE2YzBnK3I2bUQva0lDUWxobDhaUFRuT1I4ajczemNlS2JhVXQrWTY0TDVuUHkrT0JMUzBVTDNkUEtwN0xFcjN0OGFQTGxGeDV1aXh3RHJDSmw3RkdjSjQ4UC9LS0JMM1pYc2c3a2Q2ZVRpSU9EV0Z5UkZTZUZ3THUyRHo3d21uam80UTllZDQ1dmhOdFVDcXU0NjUrK1gwcGhGZHZIUnpFOGN6N3U2Sy9pcVNldXh0VVAvM0pzL2RqL0h1T0RRelZ3Nms5NjhSaHVvVjR1K3Qzb2ozZ0tqNW1CTUVoSWZDaVh6NE5rM2lBVUxlZWliZ2V0cnJPdGFGaVd2SWJxejBEUTdLMjArTHdyMEdtRTB3S0pZaEFmN1Z3V0NndEN2aXZJUWdkOUVrRHhkRDUwV1ZqeEJYOFNqU3kza1hRRVRIbUVCWDhRaG5JdW50NC9jRnNFMHVmbFYzSW9BMS94YWRvakplR3ZvaUtidHRsWFBOZHRPc1lncy9DNHFOd0diWDVUemZ3UXJkd3V2LzBKY2h3MGZOeU9oT1pPNVVaZ0VaN0F4bkpaNWpNOUtPbnRNajdyNGl1dENBMHJIVi8vc1daQVdmU2duT2tONXlkaFNEU1pCNzdRc2FZa1NVb0tHbmk3cmxTK0VVcWxsVXU4OGhRRllmT1p2aWdEWEJib1VnN3VwalhQVkI3RjV6aDVLQVVoMVYzeU02M1E1VDBDbEJWUjlhVXJKV2NyVG92Szc1eEllVUlQSDE4WWVnelVGOWRNbnVhUll3NXR4T3B4dFhsdXhXZW5keTBXVWdTem82TllXczUwWkpyTVpJMUpTWWlXaTlRSEhuZ2dIbjc0NGJSZWJoSzNyUlRPLy9CdnhzSE9JSFowZnBuMVIzRnVzSXF0N3A3eW5vck93WWZpNG04K0hOZit3M3NpSHZsNGpJNTAxbEduNXdPZDdhUkliQjJ3azFvSnNKUEswWFk2SURmUVB3MlZ4MFFKU1dCNEkzSXcwZ2xsRVBPSkJrS0M2RXU3TEV5TmdpREk2OVlLSTlnV1RJU0VQTXJrT2l4OFdSa1UzMm5pSTZvc2NKUVhYNFdMVWtqbGxDZmhOaStubGZKSk1hRDhqTkltNVp0V2NGbXNGN0NSbCtvQjZlbkNabDFOUFNYZnBDbmVLTHhNbThuU1dnS1pyNkVnNC9OTVlEY0RKNWRJaVhOVloyUWhhWHpsZTRmTFFvTlVVTE90aWtLRHNDc0tMOU0yd3A4RUNqcC9Ga0Q1cnM4dWw4Y1NvWnlFek9VekhUelhiVWpXRFBGVVJ5cUw3L3FVeGx1MWlkWUp5bmVEeks5SkZ4eDMvbHBCYVZVcDJsSVFyRlNVV0dtLzZZK1RuNU5rem5rY1V2Tlo3Ym1jYWFRWUlHU3g1LzRGOXo1bXozMktqbk9FNmF1T2hkeUpMQTZlVEVwRFI0YmdRMUxjTmFrTmJCdTBiNjRqNGlkY0tWRDBuSlRDdGUxK25KYkdPcFp3Nzg2UFk2dC9La1pEbld0T25kSzVjeDZkSzFmaTJzTWZpQ2QvN1QvRy9LSDNSMXk2bUFhNnc0ZWwxQUVXUFJZNG40blFRazY3bWpTbGxJSjNYM1pFK1VzdmVtVXlFR2pWYmtySE1yRENLQjJYeGVCeVRLQ1MyRGt0VkpJUyt4WU9DWmY1aVpYaVJhQWJhMEdnWGFUYldvQldibE00VVJKUVpvRldXZnN1cHpNdy9RRk9VeG5TNmFEckZ4dGtNaXVWMGdZbW94SDZ0bEt4bjl2bThva2Z3MkcveEVIdVYrTTNOQzJJQjJmc1o4U0pwWEZ5cWF5UEJ6Z0ViazNqMmpDMzgyNlk4cGczQXBvN2FCeFZYSm1OUXNoQ3BzTEtMd0tZeXJaM1pQaDBzM0FaNG1uYVF1Tnd5bTllKzg0OGtxSW9hZGxsd2IrZVFtam9zaEpBNEp4bVMwWlp1VTNyL2xGMnJVQUtuZWU1NU9NUVlraEZhMlZpcHpCdEZNOGVUVkdZTjBPNzdQNzhRTXprS0diVHNZdzBsVDNNbjVaa25GSEF1ZTNjVi9HYTlWdzBueFJMWWZzSGZ5Mm1LQVUxWWpuYWlaMFp0NzQ2NjhhbE9OVzVSN3VsQ0xjV3NidlRqYjNPTExvWExzU0YzL2oxdVBDK0Q4YnhCeDd4UjZ0WGZ2UTBsMnhMSTJyZDh4c1FEUHlreDJja2RFYWtRemlFQkFKMlNBUkRaKzRrVUdWeEswMWh2MEVvUmNMVEFlY3JPWDNtSFVza0NSemx5VU40R1lDaU5NdzNDNTlDcVY0dEt3c3Q5Y2haRVpEZTRuVlNNZUNLVXVENGtjb2svc1c4dDFJQVNuZFpBYVhVRGlmZUlQVzVLQTZqc1RUNFE1c0o1emJCSS9NeENwK1M1UHd5YnRjSGdseHd2V1hTeWUvckcxN0lndUpOT1MxeThva2pPRWxJa29DWUxwZEpOR3ZCSlE4VW9lSWVvZVQ1U1E4alFEcG11R2tUTDhMcHpvQWsvaUJzdVQwcWF4bzJGR0JhTWdncmpiWmtHdGVqdkdJcG1aZnFKYTFZSEM1YkxDSEhjN3Z0Q0d1cHl2eUhydHgzSkpDSDRDUE10SS8rTUphRTZSOXRTUFZ2eldXTlNEYVc0Mk1kRTQ2aW80MTNPWlVpbU9qWXZaaEZmN250Y1lXVyt2RTFJdUtXZUs0a1c1OFVwWEQ2bjd3dkRuVjhPRDJieEtRL2pOT3JhUXk2dTVMZi9laE9kMk1rNGVRcjJKZnppWVY5WjJjVUk3bXV6dHM3RHowY1QzMzg4ZmlvcklnblB2TGhXRHoxaEV3bTN1ZGUrSkZUdDU5ZTd2R0NaczFMQ0tnVDA0bnpVbTk3ei9rSUhKZDhYakFzZElTWDhwekoxVTd2dk9KUlRQK1RpaUdsNVdNQVFpZVA4c3B3bWdmSUFwb0VVNW5KTnczUnhIZXRHQWhMRVdTaFRUeFNYUmIwa2lZNis1RERRMkdYei9YNmZYMmlLQVRTNlp2OVRKOVltWmI5c08yM3NWWmlLVjc4VHZ2dG9tZkIwNWFKNHdnZ1BVc3dEVUtWNGFjUFdxQ2s0MmlkL2J5anBYTWQ1WXBBU1NEd0NHdk44TFFpbFVzME5zL3pncWNlbm1TWVZzRDNjY1Z4WnpnOXRTZkhVUWlLRjM0Yk5OU2RmWGloRUZJNzVFaW5IR1dLTDVUUG9td29CUHFHTDNSbVdnTU9KM3BsS2srT2RhcTJEckJ3TTAvS2RUaENjUGtxNTZQSnRVUEp2aXlDR1VjRDdpY21HbE0rZjhLZEFkOTh2bXYrT1A5dWhQaHZLQ0RKM0NmblR1R2ZmVEFPWkNsd3B6RHU5dU1NNzZGMWVEMzFVdXhJay9FcFNTNFlhU3huSXQ2aUcyRithMENINTJiK0pCamZOZEVkaitQbzRoUHh4SWMrRkI5NzZLSFlmL3p4aUN1WVJ4b1VIdEVoVnJJQUJoSTBPc2d2U0IwcmpjWE9GMXp3RVdjc0JqcmpnZExVcHk5MllTa0tqVkFuU1dvRXNnaVI0czBURUFTdWdMd2lsSVVIU1lVV2tIZENNU0NJS0RGVjVMaVBJRVdvYzUxOFVLZmRoZzJGUVoxdC91VGh3emluZDJVNXVXOEN2RjJINnJjU2FLUEVLZDlHdTUvWGdWcVZRMmxNMjNDOHc0ZUFXbm5adDNDQjRndU5KWkFWQW1HNGw3SWJabm9XNGlLWWxHWDlPTDN3bEZCd2NaZm9sV3p6bVhCTHNSUmxBTEpDU1BGczJqTjZ6aTU1eVhmN2l6SUFwczFLQStITlBKTlNVSnl3MHBvK2xIWXUwZ2pTZm1hS0I2elVzZVQxZHhUY1FoYXl5dkQ3a2V6cXE2bWNsQUJoZFNpNnNnamNiK1YzcElEOUFUUGFTcDNpenlOYTBCN0hGNFZTMlAyaDk4UllTbUZYSFZsdTdjUnBLWVhPWWhqeitRVlpEY05ZYmNtTWwrTTdCL3JxejJrRnppMEhjV3JaaTBjSFYzeUJnbUxZSFF4alo5Q05MUWtkejcwWitDc1BmU0F1WFh3eUh2dm94K0tweHg2TGd5dVhZOFZiY2g1a0tRUHhUTTlxMVJFcEpILzNnUlFIN1hLM2VCcmh6THdEUzdEU283a2tERDR5Z0NMUWpWTEFLWTJKYmNjZGxpL1BhYVdNZWJSb05pd0c4cFF1SkVXVUZVQ09GeHBiTTVSaCtaUnk5c1hmdkhPNHBBa2RXVjZKdHZETWlvNGtGQytIYXVDeUdRUkxQTGZyUmtBdTJuamFVdUZTZ0RFQ3lpdkNXR29qRy9nUzBYa3M2RHczQ0E3dHp1WFh1eTFDUnhDbGtOcHZuZ3E3bk9nTExTL3ZHRmtZMlQzeEcxNEZMaWRlMUFWLzgxQTRYVHJJMFZlVlJWQVZaeVFUUDZMRXN4TFJUbDRVZ29WWlBEM1U1cUU2M1pkY0QyQ3VGZVp4WkYvbWZnL2g1cWlNSmFDTmJuSjh6Y2VGbU1rcHJZT3k4R1VoWThDRnZSUzlsSjM3NUVGTlkwQzlGdjRsc3BESFFPQnBqS2MzRFp1VXh2RW5SeW1jK3VIM3haR1V3aWtwaGJHT0Q2Y1cvQXo5Ymd6NlYyT2lSVGNRemJZYXp1L2E4R1lhbHlBcjdaQjhCOEY5MDBFYVVNRjNqRHBTRENTd3RKOHVuRHZYazNhVjhEUDQ0MGtjU2lsY2V2U3hlT0tqSDVXeXVLandvekdaVE9JSWpjckFJaUJTQ21ZZ3ZyMFJYN2VXQk1acE4xUUtPYzEwUmZDRU11REVpOEE3RDFxOG5FOFpsODFXQWpTVWxkOU1ScE9YeWhEMjhRRFlUenhJUjBGa3kzb2p6MjJ3cnlSYkRIbjJRZTVUbzZRRVA1V0J0bzFTM3NobGJnVWJ5MFZqRHBUV1ZnaGxUam56MjF3V25KYUZkaTNzcVNGckljN0NSNWpqZzhqTWs3UXNiSVdXa254dlJWRUlwc3Y4TGFBRmpxZXlqZURpaWtJQXJieWlmRXAvbEdnNjJrQmRWZ29Jc3BEdU44aHVLUnJxc3AvRGZxTlNpa0RDM3NNUzBIcGRzckdoQUh6OFVsbGVzSkxDWVRQa2lRc1dCZlVUOWs4UWlJLzFGY09wTldBZi9uSG8rdDErS1lRdWoyaVZ6Z3RuWUw3NHBDbUY5OGZ4VmpmT1RzY3hsVkxZVVNkN25UMzE2TkQzZ2owMWhvOEkwMUhlcE1mbnZvQjNBTHJhU3JnbEpaeCsvbzMwUk1QNzYzMXBUSmVYb0cvSkNpaU9zeGdXeG5SNlRZcmlhbHg4NGtJOGVlSGpjZkhDay9Ia3BhZmlrcFRId2RGUkREVklDdzI0TFFjMWhzOHFJR1FNTU4vRU5HQ0E4eTVyVXgvQlVqN3p5TENzK2dvb3pqR2s1UGsrb2huZkxLd3VtMTFyN0h2TDlIbi85b3RERGtPRDcvY3ljaGgzTXN3QW5raFBTaU9sNlFDMnpoZEtlcE9mRmRDTndLdkRKOUZlRGd1TmRRUFNpeXRBYWxtUUphMkVTNXl4Y3RnREtwZUYwcERRWi9NMzFabDQyYXJJTkw3blVSZ3EwMmc5d0tjSUx1WTA4Qm1mTXRDU2xzc3Z1bWxudHlKeEhqVGlqeS9NWk1rYVRtOEpmQzYvR3BRamlVQzYxaEtDWHRyWDZYR3BycmdXRkU4R3VoUFZKK0h2YUlPQ1YyZi80MjRucmxFYXhSZjRFa0VmRDNKYTZhZnp4Vk85VHhaQk9ib3dOdnhWV3hLdlJJOGw0cmpMRnNXcmJGa25MenVsc0sxRnpiSW1USDRxeTJDeXgzVmlhNnNUUXkyOExTNHpWUmtEZHpRNWptdUhCM0VrYmZ6eER6OFdWNjVkalNjdlBpVmxjVkhobE82djRkTEE5bnRiMXNRc0ZBMUZFbTcxZ2U5clpCRDVmVXFQdFhJQlZnZENhSitNeHJwb09ZUy9vTHdIUUJwNThEY2RlZm96eU4rZlJ6aWpQWG11MS9UWmFUeklMMjVSTEJueVduN2g0VHVTa3lpMHdyUG9ESFZ4VFF1YXBaTDlkbGRKSTc4SURHQTVuOXh4OGRzMGE1NmFCNGZsU3BwZlRzcENUaHJ6aEc5YVpSVTcyWG01ZkVzcFdQc0RvcVE3T2ZGSTdXS25WcEt0Qm5rSXZQMlUxdlhsbmdtOXMvdExURlNQdjJCVmFaUHBWZVdsT1BkZXZEcnVGN0x3bFQ5WUhhdm9lbHpjMStJTFZTbW9hN2VxRlBqZ0wrdTJLSVhpU0VNcDlIcHozbVR3ajJYMFZSRHJ3UllsdzZpMkRZZnB0L3o1NGM2cEJ2Vll4NHo5ZzhPNGZPVktIQjRmeFlXUFB4VmpLWWxyQndkT1A1UjFNZUZ4RDBjUjdVcit4aVFtVGZ4OFB5R0xnVWVkdkFOaC90bGtSM1lZZENqSkt4TXdVNXVjbnZNWjZCSUhIcEZNUzNvcFYvekZNTzlrR1NXOWdLOE9hM0NkOG1rSlpaeklBNDNTYUtXMXdlY2JuZ2tyelIvamF5RVM0TmFPTjk4WDBGclEzclVGRnEyL3dsejBoZ1ZkWVdqWERKUkdIbjRTbmcxcnc0OGZ5QzlsaWVPVFNIaVE4MXRwOG0xTkNMMFZ2NlhBR1YwZGxSQnlIUEIzWUxpK1Zlenh3U0xscDNTZURGQzNmTkdTdnB5Tm16Nlgrd1kvOHFTODBOWDZkSjVjVlFyUGsxSVkwam1WNlVuUS9KUkNPeTArUEZFSzNlNHMrcEpJN2gyOE1EU1FHbVlMS2RPK2xCWEJvS0xJdWVqMFI3WFZxTVJWOVVqQUoxSUEzRXVnTUk0bk0vdGorWE10Z2t1UFBlSGZyVGpXNGpnYVQySThUVzZ1ZkoxZG5pNU1STmwraTJWUWRsclM4aEVEcFZFVUI3ODhaU2hjMHRwdW1zc1RidnVBOEtKWUtpbmhhZjdKY2lmTHo0dWxBVnA1QlR3U0JPMXliU3lXMmttdkF4WWtTQXFWZ0JMeXJsNU0vdzBRYnlzUTVsTGdHeStodGJwVk9zY0VlS0l6MHYzQlpwbEc4QlNtRGF5TEV2Y2xvZ1UvclJQU2g4dWlGSGhrUGhPTitLTVVzcEJ0ODlxdzRFZW9yaVB4VUtiNTgyUElBRnFFVWJYWWQ1MUMrZDVGWEZVS3o1TlMyR0ZuVnBrYldRckw1WEdNSk9nY0gyeVphK0RtcXA5aDFIakYyT1luWTZkaFZSMzRmTEJ1cGtGbHNDZThUODdRcTNDNlUxRE5LcktVTUhDNTArUExaNlVjSmxvb0hETm1TdWUzQUtZNk8wNlZkblRwY29wTFFXQng4RE5oS0JqU1BKbEhTV2pTeE11eG9FcVlZUitrenk0OERlcXYwY3Y1eEZFczh0dVd5S3FmampsdHRPTnpicnFGZGxvNzdEdUpad0tDZklML0JteCtuMWcrN2FqbUlnZHl1dUw0THJPTWdVMEZrbG9DemN4bG5rVzVsUEd5WUxRV2ZYL0tCNnBVVnVITlhUcnQ1Q0doTjA5NGEwNmM3L1FrckgzdUFFUk4rY1FIeFlQU2dRZHZHUi9iWitVWUttc0ZKY0Mvd3hmL2loYkhkcFIrTDBTOGxVOGEzeDVROHB2K0ZWK29Ta0ZkdTFXbDBMNVRTT1hXU29GT2ozUys0UGpBanVESjBrQ2lFbFJBd3MwVDNiNkVHVXNoQ1RrNlFMbHlUS0oyYWk0YTFRZCtKazVEeWR6WTk0ZXVWTzVBVk1SZG8vaHhmQ0FHUDE2ZzRndGJLVTk0S3VWUlhxcnlSQ3Fkcnp2ek8rbzRMZUNabE1kc2xoNUhRWFBFTC92UUhvWGJqckp1RnlhcmZGRFM5Q2M1UUp2YUtPa1ovZFpGWWVIVFJwZUx3QlpPMGl3YXFid0JwRFFvZzFBVnBNV2J3TE4xKzZSQkpKOUZXOXE1UFZIN3N3VmhQbm14TTVkdVM5NlZIZGE0bUEvQ20rc1l5R0pqNXVCYjhxREZGaVJ0bVpXQ2hWcHhQL1hJL0doTzF6OGJsK296RDlvRzFBN1cySUdPSjY0NzgvTXFjZm5VaHE1MW9sSkp5M21ld3h6ZXlaL053RUdQYno3NFFsVUs2dHF0S29YMm5RTEhocUlVMnNjSExocEhPbHUzTFFVL3h0RkFMWmJhYVVYTEkwS1dobi9KeVhsTTVESm0zVkVqeUN3SCt1TWZmcEdQVXBnTWhwNFU4OUlvMlVlQnFDenBrM3lSV0FhUWNreGhDUS9VSnRwUG1FWG9pY1VwRG9vUWVDR2RjQzR2b1dxbkZRVlQ4djMrdTBENHBBUDhLQ2tvOFhZZWFGNGZGa3BlTzE0ZUhZSjJla0dQczdoQUd2M0RUK1Z5ZVJLRll2YnJUOU4yQkxVM1I1a1hua25vTFFDRkZ5L3hBS1dYSnd3K011UTZ5alA4UmxFME5QQm5MdWxqNG9VRndGd2c4TlRwWUc1TFVqNjVqUXFYcjhwZmFYN3RLdysvMUtlWVNtdCtmUHhLOVpYNjRXR2IxR21wWE1uSEwrMERWU21vYTdkemZFamxjcDdTMmhlTjhMZjF6MENJSDBLYlRMbGtIdE5PckFSK2V5S2xwNGtkaTV2bmtqVEZtUVlyQ3drK2s3SFFzUVNyd2MrSmNhd1owWlYzRUs0dTF4ZDlEQ0o4aXNJZ1BGM3hxZENVN3ZPNWZDYTNMUHB5dnI2ZUE4TkZPdE9DazNuNHZCbmFUaS8xNGtDbjlic1RKYjJkdjlLYzJjOXBKOHR2Y2VFcU5QU3RQUHhPcTN4NzBaYzBSc2NqclRCbmVvUUswOXdYZTZaSkM5WFdBK1ZrTlRSOEdGR1ZLY0tnUklWRlIxNm1HZk10TUlKcHhDUDU1Q1hGTWwvbTc2ak0rWjVBd3JtZUNWOThpcUJsbnZCUDg1WEtEeVphUDlrYVNrNTlFWUhiQzUyVUZ1blFXdW1ZTmZGVVp0WkorYVpST241cE8zaXhLZ1hrNjBXTEJXZHpYOVl3Q1hTY0RtdGcxT04weDdhK2xDdXVqVlZucnIxV2xvQ1V6NEszLzVUTk5RUDNDenhENzZDVXhJdGk2YW1GSmdrV0VuaC9YYmpxa21RcEg1cGtjVURNcFNWM0UwUC9CTzFFNVNaYUFPT1lLYTZsd0ZScVVuUmlWNFZjUnVFNDR2ampyM0x3NG00QU9LdzhkallPSnoyMVlhQis0dGlwK0NBc2p4N3puS2VGa0JmM1JGWURMbGsvV0JFek83N25ZTFdZS0l3QU1vN3FWM1orYVNhN01tYTJ1c1RibDdhbHZWU2g3aGFYeGg2aGxBOS9PVDd3aFdOYzhIa2h6Yis5d0ZncW5INWprME9FMmdFUFRacS9ERWFXWGZyUkZhWExVWjVYdnVrZVJ4WXJkc1VRRStZcjhlakVWRzFsZEtlaW1XbDYrbEw2M1VWZlRpTW92OE43SDNZRDlWdWJqdFlPanRJSUlHK0FkckQ1UGM4Ni9xbFJRNVhsYm9QKzlpbWpNZU1sSUY2OFduUTFobEljaTA2YTR5VkN2cHpZTFJjb3hMUjJXQ1A4TEQzMjVrelc2MFIxelB4TE5ocUk0Z3FTQmtudVJZcFdheXNxS2lxcVVxaW9xRGlCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU204ak1FN0NJQ1hXZnlTUzM0dm9hUzlOT0FYQVZMUXkxWHU1TFAvaXVjVnR6V3lMNVZsVlZIeHFZcXlDZHdLcXJxdHFLallRRlVLRlJVVkc2aEtvYUtpWWdOVktWUlVWR3lnS29XS2lvb05WS1ZRVVZHeGdhb1VLaW9xTmxDVlFrVkZ4UWFxVXFpb3FOaEFWUW9WRlJVYnFFcWhvcUppQTFVcFZGUlViS0FxaFlxS2lnMVVwVkJSVWJHQnFoUXFLaW8yVUpWQ1JVWEZCcXBTcUtpbzJFQlZDaFVWRlJ1b1NxR2lvbUlEVlNsVVZGUnNvQ3FGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2R0U0NoMzlPeHJ1eDZwekpwYXpzOUh2UlF3R25WaDE5MlBXRzJlcU5aYkxwUjNvOVVSY1VWRnhRNnhXcXh4S0tQSlQwdm1aK1c2M0szbnJTdjVtald5SklMcUR2bVhzdWNqWjdWa0txdnhzNXlDMlZzY3hpRmtjZHlMMjU1MllUZnB4OS95TUc5L3VBQTNzOS9zT3o5U0ppb3FLRzZPdEFBQUtvQ2lDNHMvSDQxZ2VqNk1qdWRyZTJiRjhxV0RNSlY5dCtic1YzS2FsRUhIUGRCbmoxVGl1N0VUTVl4bGJpNjZGLy9MaVdxSlI0Mm5ZWXJHd1h6clVhTFdLaW9wbkJUSlRYQkgwNlhTcWpHN3NuRDVsWlhCOGJkOXkxdXYxbzl0WldjWmUvZXBYbS9aV2NGdEtZYTRHdnZMTW1iaHJYLzY0SHdOWkNZdlRXOUcvWXhSRFdROTBvSzBFNW5PcERmbkVyZEVxS2lwdUNEYlhJajhBWlZDc0I5d3BXUVl5Q1pKeVdDMHdKV0xRazh6cHhGQms3NjY3N25MWlc4RnRLWVcrMnZvdG4zWnZuRHQ5T1I0ZlBSbWo3aktHRjZaeGZHRVduY0c1cGdQbGJGT1VBMm1sb3hVVkZkZEhFZjYyQTBYZ0o1T0o1R3dnaXozZE5adzV2V2M1Vzh6bWNkOHI3b2x2K1padmliL3hOLzdHTGN2YWJSOGZ2dmsxOThmUGY5bGI0My80OUR2anRiMHJjV2xuRmxmMnRtUFpUMHFoS0FFc2cySWRsS05FUlVYRmpZR2N0R1VJSU9DTmt6SVlEbnJPWDh3bU1SNlA0KzQ3NzRvLzkrZitiTHpyWGI4U2YvL3YvLzI0Ly83N1hlNVdjSHNYalFJTTd0Q2ZiMy85YStMbnYraDN4Ny84SFEvR0YrOWNqc3ZMZDhmVzFwWWJQSk41czVLUGRxdW9xTGc1RkVXQTNKUmpCR2tvQzQ0TUV5bUJxYXlGMHpwR2ZQbVhmVm44OUwvK3FYam9vWWZpdTcvN3I4VGRkOS90c3M4Rno1dVVZcUZzaTlzNzd0MktmL2E3M3hpUHZmM3Q4Zld2T2gvM2J3OWpNWjNJU1RGd0NTTEN2anBZN3hRcUtwNFo1ZGpkUG43YmVwQXM3U3IrMXJlOU5YN2crNzgvUHZib3grTEhmdXlmeGR2ZTlyYUc3bmJRa2VaNTRleDR0Sm9hK0lIRHEvR2pIL3RvL0o4WHJzYUhqM3F4MTcwejl1SjB4UHhpOUxwU0VvT0lRVytsTUc0WmZaWHBLTHk3MkpMV1N2RitMR0lrbGlNcG5sR3ZLK1VTc1Z6TjVYZGpJQ2Z5cEVXRE9oVjJQZ1pXTnhZcm1WY3l0aGJMaUpsb1NJZDIydUdjcHJCb1pwekx4R011QjUwTU5wVlRudmdzU0pPYnlTMWRoL2dxQTc1ejBjM1Zyam04bG1xMzhrTSt6RmJpU2oyNERuRjhaUmNzNS9teHJQTVdIaTk4YUEyRm0vSTVuR2p6a3h0NXBIVlZrK2tXYW8zajJkeFVPL0NYUzdWUXZrM09aVEpKU2FmbmdQcElTN3lWSm1jK29nV21WWGlkdDI0WEtIMUxlZkp6Kzd1NW50S25SSlA1Q0c0WGFOUFFxVXpiOVpDVWNybk56a3Z0MGlpNzNhVnR6SGFoWDlGMkprOXdYaTRmbVJiWExXMXl2YVdOaFJmOVdyY1ZHbzlSanBNKzY2anVYTDdMQXFIY1BOR3dIbWZMaWVZaVF6UTlaY0dYUExEZk9YQmNZcHg0eU9GN0FjSjNkaGhuOWs3Rms0OC9IdDMrU091K0Y1LzVwamZIZi9xZmZudDg3ZGQ5VGV6dDdZb2h4NGpuRnkrc1VtaUJXc2JxNjBmR3EvaXBweTdIajMvd1E3RTQveXF0RVFtakxBblpROUdaeldKYkFyNDk2TWRRbW1LeG1NbXFpR1JaYU5yNlVnTFlGNFFSaEpFaS9XNVBnOVdQZ1h3Vy9Vd1RPVU1KSURpZG5nWGJ3cHZIZXFxSnJVb2hDNWpLQWVxclN1RTVLQVd0UjhDY29oUW9VM3d3V3gzYjk1ekRNL05nelJQdWROTDZLTHhKZzY3VXlWWTJuODdpZGE5OU1MNzduZDhWWC83Rlh4amJPcEpiRFpSS1hnQThiOGVIWjRQV1kyejNJbjdMYmlmK2lJNFZYN0UxamFkKy9kMXgvTkVQeDQ0VXdqMDd1M0h2dWZPeHM3MGJNODNuL3VHeEo2ckFKcEVVQmJldFhRMU1UM1NrTVlEeitkd3ZRK0U4NkhsUVN4cjU1ZEttd1B3cUttNERiRWc0ck5XeW50QkQzamkwMXFSUzdOZ3cyQ2V3WUpleWpGZmE2UllEV2J0emxaWHJMdVJXZWJ2ckRxUFRsK0FQdDJNKzJJN3Q4L2ZFbDN6bDE4YlgvNEd2a0d4c3AzcFNWUzhZZXU4VWN2Z0ZCNE0xa1hEKzhpKzlLLzY3UC84WDRsMC84Ky9paWZlK040NCs5a2lNOXkvR2NqYU8vblkvOXU0NEhhZnZPUnZEc1k0SFVsdGRsVnRwVjFuSmNrQ1RhbVRTT1dzNXM5YjA1T1N6bEZTQ2xJcXNCZTNDSFUwV2V0c3FRbUZHYytYSlM2UEtoS1Z3S2tjTXRVRVZoSzN6OVQrRmMxNU9UODc3V25LdzBZb3daMVlHaE01SktCYUM4ek80ZkUyQjVvLzl0VFhSQkZ5YjBhYk5Yc016V3hCcjJwUlRMQXZHQjB1bUtNMVNqdnFjbG9zVjJPckphSWRQRXE3Ym01SGo2ekxYNzFOajhSaUZSbjh5eVNiZkZHbG9DQk5TSGFXZXB0L0FhZXZSWG8vSm1xYmhiNzlWdjBESmpUNHJXTWF0QWZHY1R0azBocXdLK1dMUTBacGw5L2ZSVnRhQjU1dDg2TUJTTnAyczRJWFc3a3JXOFhJMGpOZ2F4VW91UnFQb243cFRpcVFiajM3OENWbkFxM2p3VmErTUhTd0ZMaDBUaHhjRTZuZHA0UXNEbUtNMUgzdml5ZmorSC9yaCtKLy93ZmZISXdwM3VuM3Yra3NKTklPeDJ0Nkovcm16Y2ZxK1Y4WmRyM3BWbkw3enJualQ2OTRZMjl0YnNidTdHOE9oYU5SVWJsMW5zNGwzL2RPRGprd2Q3aHZrc3JaZVNST1hPd1dPQVJ3QkVQaHlMT0JPQVI5ZTRpS2Y1VktQRDdhaWNodWhOUjlNY01HMHhaUjIzcnBkb1BRdDVjblA3WCs1SHgvNHZFR1RMNlRhMWhocWZpbXo4V2d4RXpFWDArRVdBWjF5dFdISnNYYTlDMmFhM2tyNUdxUEZsU3N4bEdXeEp3dmpMWi94aHZpV1AvVDE4Y1cvOS9mRzNYZmNRZkhuSFMrWVVrQjRwdk5GL0p1Zis0WDRuci8xZCtKbmZ1bFhwTzIwWEVkYjBSL3BpTUJnOVMrckJYeGdRd09CSkRNYU1wbUdveDBwQVduTFY3d2l6cCsvTSs1NzFmMSszbnJYM1hmSDJmUG5ZdmYwS1NuU1VSeGQzZCs0YUdUd3k1MkNoajhMdDBYRWdveTRzQXdSYUREMkFxaEtnZnE4NEhNYm9UVWZCRXN3YlJFUTU2M2JCVXJmVXA3ODNQNlh1MUxveWVIanlHUHpLM0hjVU92ZGVYbWNBNkhYTGw4ZU1SNXV5eklvNlkxMDA1NWN6OEVrK251bnRMaTBPc2RIbkllanJ6RmpYbDU1OXozeGpyZCtkdnlwLy93NzR3MnZlMjFtVVhqY0hsNFFwWEJ3ZkJULzloZCtJYjc3ci8ydGVQZERINGlyazNIRXFWMnBQcDJidE5QM3VqS05OT3lUb1lTaVA0eXUwdnNkcFdnUkx5V1ZUQTVyWXpwVUozbDBLVXRpdUwwYnUyZFB4NTEzM3hWMzNYT3ZsY05yWC85NnNkMkxPODZjalQxWkdtQThtOGJSZEtJanhEd21VMm5aSXRpcUQyRm5HVnFNMU8xcUthUjZxSzhxaGRMR3dvdCtyZHNLelVtbE1HSUU1WXZLZVNnRisyVSsrbHFUa2xhL240TWk2T3VJaTBYQVBNaE56VW1BRnI0c1BIelZoVDhjZG1ONjdjRGhMVm5NdEc5Nk5JN0ZkS3lhTzdFdCtkZzZQSXd2K3ZJdmpULzNuZDhSbnlrcmdrdjUyOFh6cWhSZzlTdnZmbmY4dDMvdHI4YS8rZGwvRzVmN1ozdzVpQ1IwZWZOS096bmlHZHRLMHdMdXpNOTcwTndBVkoyV2M0aU96MkQ3M0RRNzlJQnlycklnMEZUNDZWdzEwTG1yczNzcXpwNCtFL2RKYTk0cmQrZWRkOGE1TysrSU0zZWNqOTFUZTlKQncrQUpFUXBpcWdHZnpoWXhuczlqTGdsbjhtYXFyaXFGSk5SZThMbU4wSm9QZ2lXWXRnaUk4OWJ0QXFWdktVOStidi9MWFNtc3hoT1BLV2EvQlY5aGZPS2tIKzJldHU4MW50YzVhNGEraUZuMDVwb3B0MS8xZWRHbGVyRjZXU2VUeFZYelJLRm9BYWY4M3REMENkcHN0YWE3bXZkejR2LzFYL25sOFdmK0g5OFpyMzNnMVdsd25pT2VONlZ3TkozRk8vLzZmeDkvLzN2L1FlenJLTURTWERDckFwLzNwbk1kV1FSbEVNa0hKZTVqQkQ1M0RhUjVMTkNxaVk0ODdpRktXZE13U1NuVGltUnJlenYyVHArT1UyZlB4TGJDZDcveTFYSHExS2s0SnlWeCt1ejUyT0dqcGNPQnFocVk5MFZwQURqNERURVVod1lZdnh3dlpnaSs2a0FKT0VsdHRCTFFwQ2JCR3JFTXZVQ1NNa20wK0tBL2tNL2lrZlB6YTAyODI2eEpKVzJSaFJoNHZ6SHRlaUY2b1dTVWhXQmVDdUozbDFkelBQSHpaVllPVThkaUlBWHF1dkpDYndRanA2WHBXWmR2OGxKZHNkUmVsdU8wTDRWMUlNdjFkelFvakdDSkYrVWpRc2VIRXlyUW9zLzVhNFdRMmp3dmovUnlIWVhPaWxWWXppZTVYTTR2YlNGTjRlR0NHL3RVQnBmbUpPY0x4MTN4RngzdFU2S0VKNVh6aXBJL0gyZ1hkbFpLYjVmSG5UcE1TcHU1VmJZRVdtcEhGaTFZZFhzeDNqdXR4aWNGc0dLSmEwM3hmbzNYcXRJMHZTcVk1NUE2U0pEZnpmUEE1YmtoNW0ybFZmcGZGSmg1a0s0a3hzRGpUSU9XYXAvcUFheVZ6dkVrWG5QZksrSy8rdE4vS3I3NUQzMWR5TkI0VGxEOXBRWFBIZnN5Y2I3eGovM3grTmxmZlhmTUpiampxNGN4M0R1amZUSU42czBxaFdSYXBhY0lDT0d6S1lVdWRDblR3bW4wa3FYQjA0bEZkK0M3aCszZG5kamEyWXU5dmIwNGRlYTBGTWRaSzQwdFdSZGNZRzd0Yk91RXNtM3piaW1lV0FNTXkwVWRQelJkNWozWHhNdzFFVk5ORG5jbFhrQTZCbW5hWEMyS0JMcGlYVGlOYzZCQXRHaC9MOUNjeGh1ZVpmZ3RkUGhGVWdXL3Z5RVVZZEFmK3poNFlhZHNwR1c2Um1sTThxSnpmdDRKY3oxcElTWTZJeXVVUkp0Y1dieU1zdjBzMUc2anluUFVBK2FkeXpRTFdjQ0M4ZUlWMWtwRk94dHgwWEJoWE5xQWEvY1R1SCtDOHpKZHlTTzhYSTN0Ri9jMG9XN2tVV1ZLWHU0bi9IcjVvbEFwS1U5dWtYMkhCM256OFlhVlhOZVdMMExmaTVrY1pYTXRLZHpSeHFDeWhwOUJ2bkJLb2JjMWlNVlkxb0tzMzY3a1pLVDJqQSt1eFo3YStBMWYvelh4UC83Vi95YTJlS0p4aTdodHBUQ1ZoZkNmZk1kM3hELzZGeitwTTVJR2E4Q05hdDlDTmw2a2IxKzZrVklnblBMbHEwTnRwVkMwN1RNcEJTZWpuZk5FSVl3SXRVSGM2aHZlaXBOSldJSWZReDAvK0hUWjlpZ3JqVjBwaWpPeEk2V3hzM2ZLQ2dPTG9uZkgzZUxmMXpGRXU0T09OWnE2ZkRKSUNvQ05CQjlMWTZGSjRwSnpyckIzRmsza2x2TFNwQ2FmQ1ZVZ3BkRkVURUtCT0VKakg0SExhU010TU1NTG9TeWFGQWJVVTNncGtQeGNGK2hyNXlCc2dWSkxYVDh0TG1tWnArT0ZiNHQvVDBRV2VJWE5zeWd4MmlXNmJtZ3NuZGRTT1BqbXVZaEpYdlRFL1ZpWnNrcTNENlJjZ2VPNVhLT2NoSzUyUXNLT0Y3L1FDYjN1Y1pPUEsyTlUzTGJNZXdDMTh4MVNGZG52SFd0TzFUbWY4Ym4xWngyeVZ1VXp6MGRickZkb1dJdXNUUlZTUEtFYmZiV2ZQck9KdUc3VjRMSExjNmd6cGRxYnhsSU5lTjZWQWoxaHZDdzNNMTdzNi9qRnYrbmhzWTRtOC9ndnZ2M2I0cnYrNGwvVWtzOHlkSk80TGFWQXdmL2w3LzM5K0RQLzlUdmpXTzBleXB3Nk9oNTdWNTZwa2N2Y2xwdFJDZ2c4azNFclNxSHdZdUwweDVOR1haaHhLSXNGTDVBUzE2RHdGTUlUNDFhbjluaE51d201RHF3TVdRN0RiWlRHS0daOVdSQlNHcVB0M1JqdGJrdVg3TVJnUjNtaUdReUcwVmQvcWRPS1NXM3IrQzRrdFpHMkhSMjF6ZFBOQll2cjhUSDRFbWR4aVlZSkp3NzZNdCtiL0N3c1JaQU5yOUlFQ3lYcG1SN0lyckZsNG5Jc1ZQdEpvSTNDSzVlbC9rWTVDSHhSUjFtWXVPWmVBeDRBY3h4a1B2U2h0SVA2V01hcC9sVE9xcFR5MUMvRjB1V1lhZHFrbEJ4dUtZWHR3cGU0MGkxNGhETnRiNWFVQWloMEpRNG0yWkpocnBjOTFvM29ORGRwblNrYzJrVUprNGJnc0U2WU84THlsN09pOUZxODFRNzZxNGlFUG4vbElPR3NLRDAyeEVIYUhWTFlaWjlucFVEekpHZXVjNkxGcEhCUGxzRkE2NWczSWMrcEcvL29CLzYzZVB2bmZrNWE1amVKMjFJS2FNZ3YrSkt2akovL2xWK05ub1JtS2xPR3l6K05hS3lrcVhnUEFUeVRVaWh4WlhvaTJuY0t5YzhDeTJTZFVBcUU3VnZJSVZKWG9FZTROYkdkM3FqaFpScVE2MUNHTEFBWGNwaDY2QTloN3hiNE03VkZ2QnBoN3lmaDUvdnZPR3AwUjl1dWh3OTNEV1I5OURVaGZTa1RyQXdVeGVEc251dkh3Wk1qalJWSVRsdWlTUVZQUWJZS0xMd1pTeTA2NytqS0w0c2orWEpnZG1qdnBFTEF1VnluQ0hGWlhGbmhtSDZwTmFWNXl2VDZrOEl0b2V6b3pMK21UNHMxK2FsTmJGUzB1MDJqUC9xZit0TFhlbVdFelpjMDJpMTYyZ3Y0M0gvS283M0pUM3h5dml3VEk2ZVpMcGNsek1Wdkd4N25GdWFETTZ5SXRMN2svRGFoZ280RHpiL2o0cld3QXFUZDhzbW1ycVRUTTFMNzA1MlFuUEpqb2VOaG93eWdvZi95Y3Y5ZmNLWEFWbWY1V05wS0lHK3VJNW41YVN4Mk5aZS85L00rSjM3bys3L3ZhV1B6VExndHBiQlFwZWNmZkgzd1h1RnkySk81dUpKQWpHSis2WEpzM1htM2xGZDY2SEt6U3FGOWZMZ3BwY0FNU0RoN1hTNFBKZFFlTmZHQVZ2bExUQlg1UlJHUWxuYUIzQTVOWXBkSG9hNVgvY2tqVVJUSWFLWDZDS3Q4NGMyT1V5NHFtU2JTT1dLNEh2SHArT3laNnA5djZTZ2xPbWo5UlpvNEZBTktSdms3Z3ozWGt5d04xV1RhMUcrbmk2NmdDR0s1a3dDcjJkVVUwTGc3anpRdm9rVFUwMjdoZUY1dzdQVEZDdkNDc3d6bnNoUlRIaldYTkY4MG1wYTQ4cHhlRmlyMXFYMVpLU1RGSkliNDFoYWFtZ25jMXZtRUZVbDBBaytCR2pnOThTM1k3eVU2ejF2MmFXY1puNFA4R0xxTmttZXMwdmdDdGNMOG1TL1hJNzh2UzhONTZqZHBHd0l2MThzeXk3Z1pHak9QVVI3UFpTY0p1UWVTZHJ1OHdrcEw0NUhUQU9Ibld5bE14dEhmMlluNVJQM1FKc3o2bEluZ1RiRXZXWnRmM0k4M3ZQN1Q0ajMvL21kZDltWnhXMHBoTHFYd2lqZDhWbHk4OUdUMHpwNk54ZkdSTFFWWWFwazN3blVqcFlBUXBIdzErWVJTc0NDVDkweEtBUklMWXVMTHhJdVIveHVEOUs1NFVRVEFOTXlUMmpqWTJUVVBsMVdBQldOZVdBRnEyMER4a2c1bmJweGRmMjYzQXExMlprdEh2dnNEU0N0OW9RenRvTDF1T3dzOVdUSTQ2eExSUUdZbG9iUkZQK2VyY3ROazM2eEpIK1Y2Qk1iYlBnMFZuSyt0TkUwdkM1aytwTVhOb2dTTFdXdkJDa2x3RTF4dW5zL2toTXRDTGdKQWVyNWphQ3lIWW9rd3l2SjdNczlUcTFLOEhEOFMvVEptV0hRQzhlS244cWtmMCswMFp3QStaUXdLK0tKZ1VNb1VIeEJlNVl0YXQ3Y2w3STdqejdMNXI3ajV5dTlsMzhsZHlxUTIwMWY2bDRRMmphUHZHekkvQkp3blRPNmo1SUsrckswUEFicm5XU21rWmRXTitVSGFIUHBiMjE0L2xKa2RINGNPdmJFNzZzWEgzLy91WnQzY0RHNUxLV0J1My9zWm54MFg5aTlwc1hkaWVHclBMMWR3YlBEQVpFRzhHYVZnV3RKdlJTbncrV2wzRnY2SnhvS0lVTXV0bG1uUldYbEFRMzJGeGtscHh5Zk5kdzZJUG5uUWtNNU94ZkJRWG0zM0phWDdsQ2VxcnpNcDlidTl1VndwVDVGVk9qNlJiMFdSSGNza2pjT09mWk5vVlJMdVpBa2hQQnZzcGpEL0ZDK3ZjdlBVQlJ3UDEvV2pGTWhyZnpobk9zaGpLV2cwN1B1ZUlNT2ZMTTFobGtISktvSzNaQkVYZ1diaG8xVHdzMUNnTFQxcVdYQ0s0a2pLWlJsVGxDaHgwMmc5a0Y0c0N3Vm4vSUcwb0lSem00TkhtcFF4Nyt3c0lJbXdPODBYMlVwMy9XM0JONjRrRC9yaXlGSytxMllabEhSWkxUMDVQOXFUenhoTXV1SnZmclNEdFVDL2xhKy9sRjlPeGNCNThGTVpLUTc2V0pUZm5NRjVBWlVDL0hvYTQ4Vnk1aU1zVnN4UzFrT1hqdzlNcEJBUEZuSCs3RTQ4OWZCN21uVndNN2c5UzBFRGRPZGYrWUhZLzZIdmo1My84SE14dUdjdjVydTlPRnlkMFl4cHNHeithckZLS29jV1hKblVTcklHOVlEbFJXM0JSSml5Nzk3cmp4MkVRaEU0ZHR2TUs0V0ZScERseURNdFJiTlFLdDdzNU9ZUEhmbFNNaVpOUjQ0TlBySUN1S1IwdW9sTFhxNGI1N3djSnd5TncvajhUMEtKaFZIeTIveFFTTFpPekMvUldBa1dHclhQNVltU2xoVW5iVXR4T2ZKS0d5aHJuMFNGUGY0RTFRNzZvanJnbHh4SG9aUjlJeUFZemZKZ0VRcEo0Qk9XaS94MFEyRVVBM21teitmc0pxNEZueForV2VTb2RTM2cxcDFCRVM3VHdwT2duMDZrZUtGeC9kQUtOdmNCQXB2TGxqcmRKbzQvbEMwMHBLdE1hVU5TUXZnbGZwSi9GcjdjcHRKR3Q0MHdIOUFEcFV5TEZwb1VkMEMwcENmK2JBdTBJUjFGMHBncWxubG5QcFJxenJQYXNsQUtVZ0syU014M0dRc3NtUUthekhpa0hWQ1QxNDI5Q3grTysrNjdMOTczdnZkNXptOFdXam5QSFYwMVlPOE5iNHo0OGkrS283ZDhWdXp6QVk0bnA3RXpWV2RIR3JCcm1wU3hGc0pzRVJPZGI3bGpXUEFTRDdlK2tjN2JhUUVMREo1Tk5EU3gvcEZYMHR0b3hUM3dHUTYzU1U4VXV4NjhlSzVIdDhIbkJveE9sajFKbHVQVTBYYVVTMGdMbyt6SzEwWGVWUjJVNThXUUYwemoyeXZoMWlMeEltT1JVRVp6d0tKa2tjdjNqb0tRa1BZTUx0R3BEUXE3SGUyMDdPQnZIeHJITTkrU1Rqc29TeHhmN1diaHd5TTFrN2JuY0FaOVRmMU82V21jQzgwbTdZM1Jvc3YxbHphczU2MEpQQTJsclEwVUxPWEl1eFhCU1gxWjQyVDhobkFiTko3eWtYWHVzOWdJVjF5UVl3MFAyRlRWRXI1cndBcDBGWHovQ0c5UGRLYkgvc3FBVzFFR0JiZlN0NmVCTnMvTzNCdmRML3l5MlByRDN4YngyZStJdytIcE9EbzRqdFcxL1lodG5ZbUgycTFISTM4a3RMTzFHOXVEVTdFbnMydjdpcFJHM2luWU1idWNMMzNHMU00SVl4WVd1Tjc0a2NaQVFTZXNKemtqcHplK0YySmFES1l0NlFJOHpLYzRGa0lyLzJtOFcyZ210NVF0eU9FbW4wbFNrQjJpNGVlOEpHeko1VjJVeFp6YjRGMEZJY3Q1TnQraElhMTk2KzAwQXJSWDZUbHNjOVc3SGJRb2hMVFQrT3l2WGU1bVhDcWY2Zkd6OHl2YXpKRmR1NDZjeG1KdUs1NlM1L0w0YWlPTy90SmU5MFhqSTk5V3h3a0Z4OUpHZ1pZbG5zWVJQcW9Ea0NBK2pGUFppYzBYWks4Z2pYTUdZZGU5dGhMSXY1R3lmdHA2dUE1ZG9kbW81d2E0RVkzVG03NnQxOGxTekhFTE5kRFpESk1zd2E2MHdVaHAzZms0bGdkWFlyWC9sRDlSM0R6QnVRWGNsbEpnaHE3dUg4YnljQ3ZPLzViZkhlZi80TGZHempmK2tZZzN2bG5hUWxyc2VCeTl5U3gyWlIzc2FVMk1kTTZaSFY2SjQrVmh6TGtZenVQaGlkYUUrQ3lWQndrTlZ5YUdRUzZ1bVlSV1hoa3dsN1ZMZVVibUJ3cGQ0cE45Z2ZwTHVJSDVaSG92RmpuOEVpNGdYcERMdUg3S0VXZ3Q5RlMvSnFtaGc1RDhuSVp2ZnN3MDhlVEtZazExNThWTHV1bHlPb0pXZUlxUGFjZzNUN2tOd2MwQ3lvMzFNN2dPQzBvK242bnc1d0FvSzRjWlc1VFZ1ajNVayt0SG9KMldYYXZ0cVgwbDNJNm5jZHJnSTNoc0dpVGhTT2Z2VEFkeWZjeGhVUWpOZkdZK2h2bVhNdkliT3BVM2twOHVZbk1hZExrOWFmNVVSbkg4TXM4ZzFaMFVsMUhxdVFrVXZzVVYrSmlIVHhMOTlhWkF2K1VXc3NKbEhYQU1IUFQ2TVZEZTh2Z281bGN2eCtyZ3NtVHZxcTJ4eGlLN0JkeWVVaEJHeTBrTXJoeEwyRHV4ZU9Xbnhma3YvNnE0VDFiRDFsZDhRd3hPbll2NWJCbkhUMTZMenJXajRBRlNaMXQwcHhleU1LWitVNUNyTHJUWmtzWEhZdFNnY0dtRzljQUFYVmRqNTRFakQ1b3ljTTFDQUpxVUpCaUpoamlkaGNabHNrODZ2c1BGVVM2bldXR2RRSnFrVEFzeWZhT01jcmp3OVhtUk5DYXorSEtOZ2pESzVNblAvRmo4M2pFVlR3S1RuUmNHd3FvOG5PSXBYd0xodU9wRWdDbXYycE5nd1NmVlN4ekhPZldabk91UkkxekttRmRKNTBLT2N5LzFxd2FQaTlyQVJSM09kYnJ2eWl2OWF3dGMwNStXUW1BODRKOFZrY0ZZNUx5a0VQSjRlQkl6THdGTEtzMlphQnFyaWd4OEFoa2xMSjVsRGdyL29yd0oyMlZRRmU2NlF1OXlhK2R4eURDdjY2Q3A0em9vWmRMZGovamhsNk0yNXdnUGRwZlhMS0luaTIxMmVDMG1seS9IYlA5eUxIbGhUZ3FqWEN6ZnFQNW53bTFkTlBLSnIxZjh5SHZqYW44b1MyQ2hvOE9XQkg4Y3U2TmRaVDRWcHg5NWJ6eitHKytKeTcvODdvaEhIL2R6VlQvODNWWmhIamROMDhzLzZRbEFQL3hJVXFMTDVSc0Q1cGVHY3R4bm8zeEp5TVZkTTFDUTVuUXUzbmpTUVI2ZDh2c0R6b2VCYU1qUGwyMXBiTlBGSDlvMlhkcmxpMEI0b1VLYWkweG9TbDZtQmVSdlhQcWxPcFNoTU1XMFNPQ1QyOWFVaFU1cDY0dkdGRyszRTVUWGlJbVhDOGptd2pTbm16ZDFPRzNkTitycWNCR1Y4OU9ZMEErSkRMd2dhYS9lNjBFOElXa1dhUkdFc21SNHR6K2J0a2xCcXo2RkxXZ0N2ZWYvK29LeENDRGxsWnQzc2JaQ29LempoTW5NdkZLYXd2S0xZbWlXcnROUzNvYWl6UXF5YVlQajZ6cGRsOExyT2x0MVU0ZkRFS2pNaVh3bEtGbHJXV2lYOVJnUUY5dyt1OVMyUWxPc21YUUhrOXVDb2lTdjBKcUJ3Z0lLS3lucGRPR1k3bmpFYTZ6Tm1GZTU1ZnZ4c2NyMXBBeWg0UktYN2o3NDRJUHh3UTkrMFBOK3M3Z3RwY0FqeVZQLzVOZmphTGlJMDl4dzlFOUY3K0JheE9CY3hPNDB0Z2ZMR1BMamwwOWVpT09IUGhEWDN2UGVPSHI0b1ZoZGZGSUtRaDA1alhZUUpGeThFTVRMUFZZSzdIZ01CTisybEJleUJhYWxGSUNWaWVKcmdZVm04NGxCVXpZTEU0ckFTaWVIZ1IrWnRtak1SK0cxMEtaNDRsTUVNS1czSDZHdUJUYTFTN1BaMERpOWxIY2UzdE9WVnJzTjNwV2d6VUxmVmd5cFh5NmVhQ2puc0h5WEVhbUM3aXRvM3FuSUNhSXBXVGZDaW5rcEN4U3drT1dLTGlsNVR0Tk0yV2ZSeW5jNkZiQ3dpVU5iRm53V1ROS1QwaW5wYmFITDZabUdQQXUxaEtldHFFd3JmajU2V25Cb1J4WlF5RjBXbW5YZFRidjV3SjdDcHNXeXlPSFN2bFcrL2VlSkJUelcxZ1J0a21uZStwUm4wM2JXTHZsS2IwejNwdTdTUDhWSmZnYWw0UDc1M2tobDFPOE94em5jYkphT2J6cVN6NDR2aXBYb3VXVFVvUENJR2N0dHVVamZTd3BlKzlyWHhnYys4QUd2bDV2RmJWb0txN2pqLy94dzdQY09ZekE5aU01d0owN1BPanBTM0tFandVRU1KcnV4ZTJZN1JqbzNkQlpYbzNOd0lUb1hIb3Y5aDM0ejlqLzg0VGg4LzN2OTAxZitOQ0RqNTB2SjdmU2JFRnFRYVZEVkdRdUEvS3dVVUFJczlxSVVGRXE3TnVHV0lGdm9WYzd4SEM3QzdVSEtnblJkcGNEdXF2UWtmT3R5Rm1xUWVWamdjM3hkWHI3NVo2WGcvSnlYQlp4OHYxUWxZVTE5eStWTVEza29DUXM1dlZFS3BnR0tFNlN1MGorbjVmejgwWFdua1lkaWFPaHh6ekwxYmwrbXdTTmNmSUZIelY3c1dwQVdCQzltTFdLVGtNNzhDZEN3MkVuTEFvWmpobHdPSVNTTnV3NThBUUdVZURuY2xKZGZyQVNuMGFjc3FIWTV2SDRQUUdXVm5QSlQrUTJsa04vWUxJSzZLWnp5bkU0NCt5MmxRRjBva25LRUxlV2IvZ2szcFJSeVhhVmUzOWtRaHdlV0htUEMwd1VzQWo3ZndQc0h2Q2tzUmRDUC9CNkc1aGVGQ1R2NEl4Zkl5SHgyL01sUkNxZC8rUDF4dk5XTnM5TnhUSFdNMkZHSGU1MDl0Zk13dGxqNFdsZDlOWnEzQS9ueFM4NUJBOUxsbGcrOUo2NDg5V1E4K2VHSDQ5SWpINGk0b0NQRzRiNFlqMk5BcTNaT3U0TjhYTFhiRzRrbmxvU0VVMHo1aVBKOEpFRVFJRTBDcTBDakhPVDR2RDExS2EzczFzVlVUNE5Vek8yVURwMEhsRHBFTyt0cGNlVXlwUHNvSUhpeEloQjBDdEJKK0ZGblN5aTdQUjY5RWxCY1BGSWJrNkx4RG01MnFTMndvOTZVbDVVUkwwd1ptV2RKcDJ4dUwzQ1o3SnNQdEk2clRvY1NHbVdTUGIvMzhBeGdjUlk4Ylprb25yN2NMb01GM2ZhRkZlLys1K09GQlFXaGNnYXRGVmp3YXJtRjBUUWxQeW1Xd3I3cy9HNVFvUVU4SFFHdVV6emJQRWpUSURNeXBpZGVGRUttS1VyQjVVcDVqeVMrY0pUNUF4UmNrNS9RR2MvTm16ck1OeXNFaDBtYnFPN2NmenVzRWFQNHJGK1Y4YmpBUS8za3N3dmNyOGtDMkQyNDZoM2ZQNlpFbXRxTkV0SXN1elNXak90WHZlNmo2MG1XR25SWURKL3c0OE96S1FWK3ZBVjVRU2tNdFNBNVlRendTVmNqeisvb2VLQkJXQndkeFB6S1UzSHd4T054NWJHUHh1WEhQeGFIbHkvSDBhT1BlY3o4NkpMVkxzR013Y2dYbE53M2xOZU9yVGg2S1F5WmhzaGF1dHNacE1Hd29paENtUldKZ3F2OGdTMExIY05BWThXTGIyeWlETDlxSlFZS1k3bWdUSkxRNGl6VThJVW5vS3p6VkUrVEJOOU00N2FsOHFZVi9FWWR5TUplMnBiNGk2WW9oVlplUXd1VVQ3alVoM0lESmMwS3NDRG5GVnFqbmY5c3VONHlXY21VemNsZW5BcDdRYWFrOVU1WmhFUytkMFI0NlgrSEczVEJaZTBYNFUrTHZKTS9SZG5zL0pRMUw0aTFKaXlFTHBqaStDMGExMGNhY1JTUncwbmhrTjR2SDhpU2tOb252OURKRGJnemdWYjU5Q1VKSFBsRnFOTVJ6LzNrZm9IampkZHFLdDlsenVVWHhlVCtrZWRHeXpDV3p1R1l2Smp4bXlkVEtkR0poblFtUjNnV0l4MVBYSy9DNmY2bEtMWEVMdzNsUzFncHNLbWVWQW9MQ1EyL2VyTTNITVl1cjBrejRPT2ptQjRkeG13OGpzbEhQaGpYOWkvSGswOWNpS2N1ZkR5dVNsRXNEdzlrVGttYk12ajliUmhaa1BrdXh4N2ZxcFRmNHZOZ0tlakJVTUJDbklVUncwK0YvQjZGeTN2QTVNcFErTTFCQ1YrWE93MnlrN0NiaHcveW1RNUxKUXVXQlpFeStPTHRlak9hTzRYR3g0bFBLdHJFVXhtbDU3TEZVbGdybWxRKzBjbW4zd0x0Y3IzWkIxYUFhbXNUVDE2cXYwRXFmMFBRelpQTFl5UGViT1hKTHdKYi9JeEdHWlQwSWxTMkZBU1hMMHBEZVptTzgzR3pQTE1ndEpXR2hkQjVSUkF0SmNuUmVMTE5LNlVsZ1VxS2gvS2pwbnExanZzQnBmTUtjYW16bi8xVVZ4YlFyRUNnWGZtekVmQ0VLTGZid3V0Q21oOEpzOHR5K1NkNjdnYkVKMTBVcm1MbmFLendMSDFhVk1xZ081Y3lVUDNRSXVpVFRtb0xTcEZaODVNSStFaVJKRVdVMnZhU1ZBbzlyY2oyOGFFb2hTMCtvVWdIMUVrVUJ6OEh0eVBoSG1rSDU3Y2NkcnRURGRqRVNtSjZjQzBPcjE2Sy9TZWZpQ3NYTDhUaHRhdHg4YkdMY1hSMHBQQTFLUlBlZzFkWHVJL3duWVFFcUs4NERWQmQvbVJpdWN6TUFqaGxweElkWm40eXJUa2lNQnhwUjE4VjgxcENpVFdDNzNTRVcvQUhaZ0J4cGFlWnk0cUJLUDBqWGJ6YmlzRUM2blRxeXZRVzRrVGI3UEFsUGRPVSt0UG5OSWkyaE5wMFlwRjlvMUUwQ1kxaWFOSmE1YStIOXNxNDNqTEpGMjFHenJmZ1pTQ2o2b0VYYWNyM0ttYTFab0tVM3R3VEZPR21ZdEliTXZYWVNjeE9GajZRYi84ZHB5d29pZ0dRUkZ3b0NnRkZVbmJ1WHY3Q0Q5ZU5CU0VmWVN2dFNYN1RDTWVoS1drTFBwRUluQWVQVkllbkZVd1BFcjl5THlBTEFKK0xROTc5NkM4bTZvS0VXSllBN2VPRlJRN0lXRnk0YS9sNGcxTGc4eTVGS2ZDWmxOUk9qUzUxdjVTVmdoOVF5QzkzQ252cU5ENGY0cEg0S00rbmF2bHBNZk14NDRFSzdRMzdjV28waUMwK3dqWkxsc1RrK0RpV0I4ZHhlSGdZbHk1ZGtxSzRGSmRsU2VDdVhyMGF4OG8vT3BheVlGSFFSUVFOSzRKdmFVSnd4SCtnOW5xd2lobWVoWTlIbWZqcHk5UUVhTGdvTkpKd20xNUM2ZkpDZVV4cVd2V0JjQkhhb2hBYXhZRGpncEZ6YWk0UGYvTmt3QVR6Z3M1UUd2eFVmc01DVU5qV2krQ3l4Vy9TVXBzM0ZFV0IrYVc2YmdRV1pzSDFsc2txV3dwRllLRzM3MVRMbVpnVVJVRDVIQzZDNWpTaHBEbGFhTVEzMy83RDAvV1hjc1UvYVNsUXlJSXBSNzJZL3dxN0g5QkFMNyswZDlud3crbFBVVllTTXFmNU94NVRXcU5VNUh2ckVQMkFyK3VEajRRUDN2aitQSWZidFl3aDd3ekFWM0ZlQk92NGRXVFIrdE9VcTVodVpXRkd1WWt2dnpVSnZTOVoxUWFPa09UN3JzR3RVRG0zSTcyVTlKSldDbGdCYU1DaUZJcWxNT3hNTFBoRFpYRG5vS1V1QlVKbnlZL1k3Wi9XUFBBSVpob1k4bHZTTE5zU3RDMHhRWE9lbG9EREJ5WENJTTBtVXl1RS9jdFhyQ3lldUhJeGptVkJrSGJsMmtGY2xVVnhJSVZ5ZkhpY2JuRjVKSWpTOENKUTR4QmlXUmxkOVlOMkxmblc2YkxFVlkrRkRFV1FMUW0rcGpXWjdrbjR5azVlZG4wTHA4Sk9nMGJoUmpFSUtJVkdjRE4veWpBU1RpTkxDWlJQZkpTdnBGS21PVFk0TGRjSExiQ1g2SXhjWitrT2RNMTdFRGRBV3lrVWJDd1h2azlBSUswb0JPQ0ZLekNzUmhZK0ZuZWlVUnpQRGNabi9FbGdMbEpaeW5UWXlUTlA3ODdPWTBjbnpwL0UxelNsc2t3RDBwMUVGcWlzRUZMYlVuMUxGcUxMNHFjOFAyR1F6d3dzVjFvanhLR2hQR2Y3RnAvZWNmcU9TRnNQN041WklaVDNGMGJhbU14VHhYblVXUGl6dDFIdTJpaVBSNjRQbUw4YzY3bXNheCt6b0ZORHJkRHlPTDRrbFVKNSt0QzJGRmpXV0FwQUJvQVZRVmQySWorc2dlSVlxamQ4blJTS1luczVjaWY1ZmorWGs3aytsQm1QbVlWU0dISFJKWi9YUElkeUF3U2FmUEZrSWc3bGVQOGJSWENnODl2UitOZytDbU04bmNTbEMwLzRrZWpSb2RLVU41RlM4UzlRYVFmZ0JsaWo3WGF1QlkySzFXaDh1ZTV3MEFna1BVRVpvRENLQVBKTlA4cDFQQWx0enN0Q0RXbEtUenUvOHdXSDZVTmVLWVVtaGRmOHkxSnFMQUhSTldqWDAwYWhGV2p0TTZHZGU3MWxZa0hOU01JbXRPaEtHZkpNNnpoQ0paOWdvYlZQbWh4OE10OE8xcFRTMXVaOFVTcUpSNmt6NWFYZFc2c3k4UkJLdm4yVmJiY0QybDQzcFpVWGd2ejhINkUwdmVya201WGdhVUhWZXNpbWYrRzFPTTdmZk1WTVVKWFM3UVBxeU4vWFlDV21ObE9uaFpvMkNGT3QzOGJVRTdxNXYrV3BBc2N6KzdUTEZHdWw4SksxRkxaOUR0ZmczMEFwYksrMEkydXhEN1YyK2FuNUFXWHhKWXc5MGZSVUhoWm9URy9pY2dNSlFsZGFBV1V5NmlhbGdCTHdOenQ3OGpSQWVaQTZvNzN3MTdHcmZqOXFsTkpRVHN3azhITmUvcEQ1eXcvUUhuR3BPWmxaVVhEc09OU3g1R2d5anNYbFMzNGtoS0lZeTZGQStJR1o4a08yMC9JbEh2U25DS0NGTG9mUmVnQ0JMa0tLajhNeUdjaVJUZHRGay94a2JTUWtTMExOZHhxOVRnb2dsV3NmSFVDakhMSnZCU1ZRM2lqNWdHRDVFczBib0ZuZ3d2V1dpVi8rS1NBZmtreUhJS1IyNXJsUXlNS0F3Q25Ob0dHbEhHa1d4aVF3aGpxNHZtK0FSd2tubWlUa0ZKWXpYd1NlS0g4MGRpcnZ1alBmNGp0TndmNzRxbW45OWZ1YVo1LzFNZTlaUjZMdHJvN2M3cVE0VkVBMCtDZ1J5bXNsS0ZmSS9XcS9qVWk3WjFxMFJSbXdYaFpaeVBuMlN1cmRtMnNiSkM0THc3OFpvbW9UcmRqb3oxTHJHN3lzTGhxdEJOUVlmdGJOVm9ESzRLTVVVQWEyRUZBYUN2c2kwdW1KeHBhQWZKUkJ5U2NkTWV2N3doSzFNTGVTZ0wvcFNGSDl2SDVOMjVZU0tIOVh2OHBwR2ozWC9KWWtTc0x0VndQTGo4RXNWSjc1OURsT2Njb2NTMUg0bDZabXlZM25mQVJjeWtIK2pIUGgvaFhub3lSUUhCTXRLUHlwZkQ3TDBaTmlTUm85TFlvMDIybnlERVdCdjJCRlNaNTBqd0h0VzhYRTM0eWQyb3JQT0pUSnBhOFR2bm1KT096a2sxUHlXUlR6bnNvRDU5TU9JbW1CT1pUZnFDdzhHdDdaNXdkdUVsaDkrRm5vQUFKUXRBMXBwVStBTUZGMGtsZDZUbXNLazZZd1g2NEJUSi9UekJkZjYwUm1PRTFnOXJ4TUVRamxNNTZnbTcvUHdSTkxPZVdYOHpqbFQwMk9rbHBDYUN4NFNtZkhOeCtFT3lzVmZGWkk1azhhUFZzZmQyQ1M1ekRIVTcycTA1RmNKdk54R0xMTVA4VXpyNkxrQklROXJZdE1BNnRNVDU5WTRXNTdicHNJVGNQSDNrM2o1bEJ2NXVteUthOHFCWVdmaTFJNDBxQ3BvWTRYcFFCZFVRcnMyaTdMZUtzTy8xS1ZTa0JER2I0a2swbEQwL1BWN2c1VGR3N1BEL2U5Z09lMlRPWis5T1JkUVExaDJLYzZzdURqK0NpeUZ3RDVlV0tuM2luVHhJTzBhSjNnK0p4QjhXSnB3Zms1UE1pdmtiTjZoR2JYVFJIOXlVSUo4cUp4Y2tZNkRwWDZrMUpSUzczZ0FQY3VnUHhTTGkzZUJJU3dYYWRIRmRyY250NDg3ZVNKTjMxYkN3Z3p4bnNFQm1sWk1QeVpCUE1RUDc0Q1hvcURjU01QdnFiSjQ3K3Q0NEg1bDNKS0swb0IyRElvK1EzL1ZBYitWU2s4Qjd6VWxjS3hMNFNTVW1CWFpOejlCYnlLUTBKWmVQRWpNQ2dHbEFLLy9nUU52Q1pxQjhPSG93NEdIcFBlRTZtMExUWFcrWXA3OGxXbzVMRm8vTWxRbDlkRUttK2hTU3hISHhaeGVXT09obEVPeCtJd0wyR21YZ0hUdUV4cW1IMWhMdjROOGtLeWladEJmd3d2T0M4RyswWk9BN1NWRVdTaDBkWUdMZnEwYUlYc1U5ZHcwbnBsRjR1aHFTZnhTQi9CSmorM21YR1EzL0Rpblg3QmVVVVFNZzNvMnBMSTQ2RjhadFdDbk1kNVdiN0RFbjZNcDN3dUJJR1ZVQmtyMHJQZ1ZhWGdzWUhiYzhOTFhTbndXNUlvQmRKUkN2eWd5NDJVQXRPaEphaThSRU9aY1crUUprMXBtZ3J6QkpRaGpYZlBRWmtrUUt2TEJDMDR2d3JORGlvYUpqV0xhblQ0VktuZzh0a3ZDd2cwUHpzblp6OHY4b1pPNW5YaXFiQmFtTXFxSjVsR1hUQUlsN1EyLzJpKzJEWHhaUkU3THd2NFhFb25LWXBVaGw3WlZ4N29UYWF1SDFDdi9qZ2ZQZ2FmN011OHpEZnpMNHFuVTM0V3J0VjI4ODgwekN6cHpBRUNUUDMrMFJuRlNUdVdJVlBxTDBvQjVWSEcxKzhJVUMrOHMrQlZwY0I2L0JRR0ExNU1mZngybUFYdit3RTU3Z3h3cExYcCtqSWYrTGxJdnZDekx3SHFjcy9BczJpZVhzanh2WlFES1JZY05PUjc5OHY1bllrbVcyNDFGcjlqOFQ2ZXlNMWljaml4NDI2aXVJbnF4M0dITWRlaXdPZDllSDlFVm83dk0vUUNRakZrNWNEalh5dEx1UTJGSzFmQ09CNzM4aWk0ci9MNGR1TFowMDZNNnl2YzF3TGpoMHk3aTZuNm9YUzVrZWlrRnUxNEc3V3ZkbzNFWTVERFloUXJYaURqSlM5V0tSL1FrbHYyNUxwcWUxOWpyWFIrY3hUbk5Ma1Y1VHJxcCtod2ZLZW5mZkZaS0IrM0ZNMWNjVDZmZ28vK1dFZ0pFSitwem9YeWkwSkU2QkFxNG1YQk44cWk0bW40bEZZSzE0TVhVWVovYjNKcnk3OFN4VzlPOHVsTlA4WElXcGNuS1doN0M1RkdzaEV5bmNWdDJVZ1o0SVk2VStDakhDUUh5SW92dWZqdHY2RjRZZW1rY00rV0Q0OXljYnhFNVordDg1dVJQZFduR3JsUlo0UGluSktCdk5HbVlvWFFSaXdweWFjVkJic09Yd0pLdUtRNVBUdnZtTkNnV0xKTFg1cTYzcm5hTHUybzhpVlpmRHMwanN0U3JENWxzci9aOFoyQ3VMbUVGQ0ZlT0k0U1FJQ1ZMcC9IdG91ZUxEcmk4bkc4YzBRYTFsdmpOSzRvQnh6ZkFqM1RtRTlWUjNFVE9hZXIvOGxQODhpWWdQWk9tYk1xYm9CUGFhVlFCS2o0T0M3UGlpdldBYzY3c0FWaFRUdlg4UWZuM1lxd2RpenZXaElNNzJMYVhlZmFhYWNyOFpBSk9GZjZTaXNTMTVFUU9GMU9lNkRMKzJVbTd1NnlZMEh6bHBzM1dSWXk5ZE51d2pZbmM3cHdVbWpkWG5IQThVVEZuN3hrdXZIOUJpZUhyZVQ4Z3pqNFdRbjVYUWhvQ012NVRWREYvUWFuNGtzK2lNYVRHL0VxZGJnZU9ZNWNKVjdBODNkQXUybWZ3N1IvTlpDU1V4NXZhZVd3NDZoV3BmV2srSEQwa1ZlU2VabXBXeHh0WDZsdHl1ZDloaTQ4UEZiUXAzeDZ6SHpSUytvdVl3VktPeXFlanZYTWZRcWk3Smh0Z1dxN05rcThuVC9UbXNUTnRkcG1tTE55VSsyS0UwbnlWRW9oUmxya1E0bXh6SVlWVHVzV005ZHJXYlQyNVRCMU1abm5XYm5Nc3ZNT3IvYXBNanN2N0x6UXNRUjhyNkt3RlZWTEFOWmdlck9BU2xEOHVKWFh0U1U0S0ljQ1IxVzI5TGp3NUVwT3FzcDNLT2srSmQyck9BMGpnM3lWcFh6YitkSldQb0xNNzBXbXIyMlRMMFZRMG16U3kwZXd1N0w3dTFZQXNvcVVqeW5SVTlwUWVYYnExVUNLeXNjeEtZeVJmSnl0TU1VSFVtcnBicW12R0dWNnlrdGpjeEpXcUMyLzR1bDRTU3VGc25pTE81bjJiTGdSWFZzQmtGK3NpYUlNQVBIUlZPZG5TUXk3bWI5d1JJdTVMNXQ0T0IvRTFueUlkR2poYTRndENHazN3MS94S0k0OHlpMUpRMXRBeTI2SEVLVTBIZ25pa0NHc0NENkFKVHRFVGhhR3p0eVNOVHRnZ2RTNWduOSsvVmdPODk1NVhENHAzWDJSMlUwZnJCQlZCZ2V3SzBCbVo1cSt5alZIb2h6bUhjNlN4bERZb2JleTdsTEZhU3hheXFuVTBiWWUwcHVaNlk1aDFaUExZUTJtOUJWOXpWYVkrc3BSZ1F2a0diMVhtRGlPeTJoUSt1VCt5L0tDRHZ1cnpCWDE1K254V0hJVUtjZUxad0x2c0NBaWliZm9YWVl3Rjd6cEtjYkxFUzlwcFZCUlVmSDhveXFGaW9xS0RWU2xVRkZSc1lHcUZDb3FLalpRbFVKRlJjVUdxbEtvcUtqWVFGVUtGUlVWRzZoS29hS2lZZ05WS1ZSVVZHeWdLb1dLaW9vTlZLVlFVVkd4Z2FvVUtpb3FObENWUWtWRnhRYXFVcWlvcU5oQVZRb1ZGUlVicUVxaG9xSmlBMVVwVkZSVWJLQXFoWXFLaWcxVXBWQlJVYkdCcWhRcUtpbzJVSlZDUlVYRkJxcFNxS2lvMkVCVkNoVVZGUnVvU3FHaW9tSURWU2xVVkZSc29DcUZpb3FLRFZTbFVGRlJzWUdxRkNvcUtqWlFsVUpGUmNVR3FsS29xS2pZUUZVS0ZSVVZHNmhLb2FMaVJZclZhaFdkVHFkeEphMmdIUzQ0U2Y5Y1VKVkNSVVhGQnFwU3FLaW8yRUJWQ2hVVkZSdW9TcUdpb21JRFZTbFVWRlJzb0NxRmlvcUtEVlNsVUZIeE1zYWIzdlNtSExwNTNKWlM2SFk2OGMvZmRuZDgzdklncnZWMjQzRHJycmcyT2h1ei90WG9kcTlHYnptT1RreGkxWjNFb2p1TEdlSGxMSHFMV1F6bnMraXJ6R0xXajk1cUZOMUZMMWFMbFJ1MFdNMmp0ejFJbFZSVXZFd3hXNjRrRzcyWXk1L05aamxWV013bFB4RkxpY0M4dHhUZFF2S3pqTzVvRUV1bHp4V1g4TVZBZWN2WlVYUzZDL25IMGVrc1ltdllGOEVzenB6ZWl6LzZSLzlvL00yLytUZHYrWjJGMjFJS1ZQWDU5NTJMLy8wTDN4Ui8rY0dJVDU5OUlKYUxpOUdaajJKMGNENE9CcWRqdWR5TjdhT3R1T1BxTU80NEdNWm9NWXlqNFRDZU9LVWVkdy9ranRSaG5BWUZQZERYSUtrVHg1T3A2NmlvZUxrQ1llMUsrZ2VEUVl4R28rajFldEdSZ2xndWw3eVpKTm1lU1o2a0FEb3BiWEowSEl2cGxLZ2RMeThOSkV1VTYvYjc1bmZxMUtuNHYvL0pQeEUvK1M5L01yNzNlNzgzWHZ2YTErYmFiaDRkTVg3NmExSFBBVEM1cVBiL3hFZWZpSC80Z1NmaS9mTmhYTzV2VytzTXBEMkc4bmVrUm5aa0RZemsrdk5GVEhjdVNRZjBZbmRyVzlwTmpWa3NZOWdadU1PanZxeUgxVGg2WXREcmFPREVvNjlhcEFkVnBoTjlwWFdsR1FlcVlhQXdkRjJWazg2VXBZRmJLZHlWMzFFSzRVNklmY3lVdmxRYW1DZ0h2VWo2WEpVdU5DR0ZEcEo1OXRWY3U1bmMwbnpGVXhuVU14ZHZOZDNsVjhzT0F5b2lGV0p5VjBteE1jUk10aUcvRFBsS080TGhOQTJlMHZFYldvV2hkZmtjVHJTMFc2QjlTdXVxRGFZVHZ4UlhqMDNic2I5Y3FoNzVmdE5OdXd3TGpIVGxtazJ6RUV2YjVNeUhIVWt3cmNMcnZIVzdBT1hYZWZKeis3dTVudEtuUkpQNUNHNFhhTlBRcVV5ckRkQitLcGZiN0x6VUxtYVJkcGUyZWFZei9ZcTI1M2wyWGk0dktXdG91cVZOcnJlMHNmQVNXQWd1TDE2bUtXM0xOTXl6Q1VvODhYR1lMcG8ydVdiK1Nqc29ScnBvNkFOemlPVzluREZYaXhoSzJHZlF5cXFlVENadXkyZzRpR0YvSUdVeGllT2pJOG1Ga3FVa2RyWjM0czIvL1MzeEhkLytKK01ydnZ3cjR2U1owK0toOFJHLzU0TG5UU2tVd094UTduMVhEdUx2UHZUeGVOL1Y0N2cwVzhnRXd0d1pSTDhyYzJBbGdaWTd2VDJOQlpwUStVelFicmNmcDRaYk1SS3RMS09ZRHFkVktUaXR0YWhNUzdzRjJxZTBxaFFTejVlYVVvQitQdGNZeUdkTk16K0w2VXdrT2o1cnMxeDExRGVLYUFQdDliWEFSWGQwK2FJU0lzN2RkVmU4OHQ1WHhCLzlwbStLYi9yRGZ5UmVlZDk5WWlnZTVueDdlTjZWUWdIRHc2UWNhangvZmY5YS9PU0Z4K05ucmx5T0MrTk9qTHJic2RNWnh2RlVKbzg2MjVjYmFsQzIxYVV0TGV3dGpYMFBaZEhYWUZTbFlGZVZRbTZ6ODFLN21NV1hzbExZSG81aVBCN0hRdFpCVndWWXY1U0pQQzdUNmRnV3cvajRTRlVzNDlUdWR0eC8zeXZqYTcvbXErSVBmdTNYeFJ2ZjlFYVY2ejVuaStCR2VNR1V3Z2JvcDd6RCtTb2VPanlPWDN6eXlYalh4YWZpZUhGT1NtTVpoeXRweDJGUHJaR2dLNzZuOHhIQ1BwcE9xbEp3V210Um1aWjJDN1JQYVZVcEpKNHZOYVdBaFV6Nys5MWU2SDhxVDUwYWw2bU9CVElSWWxkSGc3dGxGWHpEMTMxTmZMT3NndGMrK0lEV2V1OTVWd1J0ZkdLVVFndFVSbzBJMlpPVFJUeHk5VnE4Ky9FTDhjaHNHdnM2V2x5VDR1aDJoektyc0JiMFI2TmJsSUlNcXFvVVRFdTdCZHFudEtvVUVzK1htbEpnN1FKb3gwY0hNVHM2OXNYaCtmTm40b0g3WHgxZi83VmZGVi8zMVY4VnIzN1YvYjZRekxXOTRQaUVLNFdUb0hhV3hvSEcrMFBYanVMWEhyOFVUeHd2SmJDRE9Gckp0UExDMWZMVkFNOTBwT2lxUUZFS1BJTHBhMkNyVWtnMFZTbVUrdVJvZTU1bjV4Vmh6TFM0VDdaU1dFM256YmpmY2ZaMHZPTnpQemYreURkOGZYemU1N3cxenAwNW8vbEtmZnhFNDVPdUZOcG9Ca3YrWEtiQ3c1TENEejU1TVI2OXRCL3ovaWptZzFGY2xYWEJVaHFNdG1Pa284aXlKK1Z4ZUJTbmRuWjlMaHVQajJKN3BIT1l6bXFYZHN6T2w1bSswQ1FzM3ZEbkltY3hsbUJMb1V3MCtoT04va3ppaE9DdldFeTRtWTR2ZzM1TTFSYWVKVXNieVYvRVpEN1R5SFdsQ0xhc0ZGQTBLQVhXSVVxaHM1TENFdmxpT1hHZDFNZUNNZkpDQWJldkZLUU9sSTR5TkYxZThHdWxrTXErY0VvaExkbDFYcTVYK2FDN1NFcXA5S25rMlJlNFVBTXByL1EvdDAxcHlHQXF2K2JkMEZKTzdwbVVBaW5NZzh0a2djWTBaODlsTEdhem5wS3lZTUtQT1JUVHBjcVNOdEw4bUQrOFZiL0wwWDRwQzliVGFDbWJINzc4VmJtRmVNOVpaeDNSYW1lZktvLzdBc3B3UkZqSkdwNGQ4ZTdPS3M2Zk94ZWYvV212aXErU0pmQ0Z2Ky8zeGF0ZTlXby9tZ1JwVkQ5NWVGRXBoVGJTSktkbGk1dG83QzlQWi9ISS90VjQvT2dvRGpWSnZiRm9OSkRIRXRydWNDQ2FaVndlSDhkTUUzRDErQ2oyOUcraExkNjdPWXRBakRSRnNqam1NZEY1Ym11a2RDMFU5bk9VdzFMQ3pFTDMrcHd2NHVMV1NKTXJwVENidVV5blA5REU4ektKNnVhWnN0cWpkZDhvaFdJcEZLVXdYNHpwU3VvTEN4SjRVYWR3VlFvdnJGTG9JSWdTWU9aeXFUSUlkWTk1eWtJOTZQVk5XeFJER3BmRUd5eW1LaVBoNXZpS01rSEFsNHVaanJGSnFaRG5jcHBIK0NqcXZQbGltcDRxc0dhZ0V3M3BEN3p5dnZqeUwvcWkrT3F2L0lyNGJXOTRmZXhxOHhLQmNsNWNlTkVxaGV1Q3RaR0RCTFRSeDZFbTZva3IrM0h4NkRBT05kRThEcDFKZUs5SUtReG11ekdlNlNpaTJib21BYm9pYzIzVzZVdVcrbkVzcmQwZFhKT3hsNDRKY3lrUEd4TVNiQlp6RC9xQndxTDNJbU5oU05nbm1temVQdk5PMDhzS0J4NVpLZmlVYU9WUWxjSW5XeWx3SEdTSGR2OVVCcVhnSjN0U0VuNkRjTUZiZ0NnS3hqR1ZSVUV3bnFRdit6c3hQUjc3UFFGNGo3U3VUS3QyVS81NGVoakQwY2pIMmVWRUc0VFdZazk4YU5kb09JelgzM04zZk5tWC9QNzRzdC8veGZGYlAvM1RZMmQ3eTNrTXU5aS9hUEhTVWdvbjRLWXp1dlFnZTNQOXVhWUordmpsSy9HKytkamhaVmZIQ2EyQnk1ZVB0Q0lHc2J1MXF3WFRpYWZHKzNFcytubS83L2NvSmxvc0N5NDZWejAvNnJtd08vYU9NbU8zVVQ1TGNUSDMwb3RlZDJBcjQzcEtvVmdLcy9teFlxbWRYdVRBaXpxRnExSjRZWlhDWFBPR05jRDRUS1pqSzRPQkJKaTVZVjU3ZzdUVFl6bGdBWmdIYldXY1JEUFRic0hMZFZpRjdQcHpXWWE4WWNpOUZqVGp5VlZabXlPWXhZNDJtcmU4OFRQaXE3NzBTK1AzZk43bnhhdnZ1OWN2R3pIRUwyWUZjRDI4cEpYQ0RhRWUwU2t2R2prWkM3SFBIY1dWSy9HaHc4TjRVZ3ZzeW13U08rUGRPTkRpT2RCQ094VDFzUXBNVkhDaVJYS3M5Ym8zbnlaRm9jWGY2NDk4d1Noanc4Y0ZXdzNkMmRPVVFqMCs0TDg0bEFJc3NBNDRQc3dsOUlTSE1oWFk3U25IaHBES3E2OWk1bkZVbTFBZXlvamhhcHJMVHRPN0JNb2ZxUHpaVTZmaVZmZmVHMS83cFY4WW4vUFpueDF2K0xSUGk3MmQ3VWFadUdFdllidzhsY0oxNEU0eTZUbk1zcnFtd0pPUy9nOWR1aHdmMGhIa0tabUVSMW93VTgwcWlxRzMyb2xyeDVPWWNyVGc3a0lXeE5HaUs1Y3VGd2VkU1doL2NWaDdpQmJVV2ltd0lsLzRwdzlWS1R5VFVpaDNDcFRweWtLdzZTL2xNSnRNMDNzQUErM3k0bXVlVmdUejZNZzZnQS9IanRQZGNady9jeVkrNDdmOGx2ajh0NzAxM3ZiWmI0a0hYL1VxV1pvaktSSFZybWE5MUt5QW04R25qRks0SVZodjZ5RHJNQ1l5TFE1MTdQaTE2U1ErckdQSXg2NWVpMHRLdTZ3RnRpK2k0MDQvcHZKN3M1SDhwQlFtV2x4TEtRdUdjNGt3c0tnN2FkR1Q1a1VPdktoVHVDcUZGMVlwZEhWMFlOYzNMMjNoN1BZTFdZaTJHSFRtNytqNFNKODVEcHpiM1luUGVOM3I0dk4rNSsrTXQ3N2x6UkwrKytPdWMyZWtTRlJMUy9KZmhqcmdhYWhLNFFaZ1VEQUYwK0Jva1drNWNGOXhKTVZ3UlFyanlhTkovT0RqQi9ISTBUU2UwcG5pU0F0MUpzV0JNbGpLWXNEblBZcW1OQXNUeUxmQ0lDaWx3SHNQUzlJYW9haEtnWHlQd1cwcUJlNFVpcVdnSHZyZGxsZmVmVWY4cnM5OFUzejJtMzVidlAyM3ZUYnV2Zk91T0wyeks4dkFWOFJ1QTByZ1UwSDRiNFNxRkc0REd3T25ZWlNoNE1lVjQvazhEcWV6K1BWWk56NTY1U0ErOU5UbGVIVC9LUFpucXpoWTllTkkybVdzeGFyRGlGL0lta2w0T3JJKyt2MlI1TElUVXo1QUprVXo2cWM3Q2NBMExZdlFaWFFPV2V3cHI2UzN3MXVkcTM0MGhpT0ZSMmk4NVZWb09yUDFSV2pibFRRK2YzSXlyemd3VUI5QVNTdktwcVR4cVRicWxuUktlbm5SckNNRmhrVWx4YVMwcVQ4Snl5TEVTYm1KSFM4VVFVUDVJMFFUM2xLZXBQc1JuM3c3Q2ZsOGZDbUdzZ1k0Rm5Ta1lMWjF4SHZOUFhmSEcxLy8rdmd0cjMwZ1B1ZlRYeFgzM0hXM2pnQm4vVFFBcFFpS1gzRjlWS1h3QW1BOW9JU2V2Z0FaY1hKNGJ3TGxjQ0N6OW9yT3VSZkg0M2p5OENnZVB6aUlKNjhleEs5Y1BJNERLUWNlZy9KU0REc2Y3MHNnZkR4dW0vVW1VaFNid2xxbUUzODRTNDlUUVVjS0FhVXdsOEF0eEE5M2ZxNHp0WUNsQWsrL3JZa3ZCL3lhdVhBOTNxQTdPN0ovby96VlVIS3N2dkZ4WUt3Q2xBSXZBWEh2UWgzek9FNVdEcnM1dXovUGhrV0hraGgwTzNHS1I0QzlWV3pKditmOCtYamQvYStNVDMvZ05mR2ErKzZOZSs4NEg2KzY0NXpQOThOKzMyZjhwOGs2N1ZEYXAvYStmK3VvU3VGRkFJbFREb0ViTEdDVHJPa0lvVlQ0OWg0ZW1mcjlpY1poZlN6aXlyd1RFd25rTWMvVXBYU3VIUi9INWF2WDRzbkwrL0hVdGF2eGZna21MMzVCejV1YUMvRkpDaWNyaU1uNjZVbEJPOXlaSDJ6c3VvMHlrZklaeU4wLzZjVE9hQ2p6ZkNmdVBITTY3cEVnMzNYMmJKeloyNVV3RCtOZW5lTzM1ZStNUnJFbE92elJRQmFUckpuckN2a0pWRkYvWVZDVndzc0YxNW5GZk9TL05kemlhcmllNERZcjZ0bUVHcm9xMlM4NlZLVlFVVkd4Z1h6bFdsRlJVUUVpL3YvSzNJRU9MM2U1T3dBQUFBQkpSVTVFcmtKZ2dnPT07Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjQwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHdpZHRoPSI4My40NSIgaGVpZ2h0PSI5NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMyIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTEwOSIgeT0iLTkwIiB3aWR0aD0iOTM0IiBoZWlnaHQ9IjU1NCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iIiBpci5zb3VyY2VTdHlsZT0iZ3JvdXA7Zm9udFNpemU9MTQ7IiBpZD0iNzAiPjxteENlbGwgc3R5bGU9Imdyb3VwO2ZvbnRTaXplPTEzO2NvbnRhaW5lcj0xO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt2ZXJ0aWNhbEFsaWduPXRvcDtzdHJva2VXaWR0aD0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBjb25uZWN0YWJsZT0iMCI+PG14R2VvbWV0cnkgeD0iNDkiIHk9IjM0MiIgd2lkdGg9IjcyNCIgaGVpZ2h0PSIyMDQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IiIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2Rhc2hlZD0xO2Rhc2hQYXR0ZXJuPTEyIDEyO3N0cm9rZUNvbG9yPSM4QzhDOEM7c3Ryb2tlV2lkdGg9MTtmb250Q29sb3I9IzY2QjJGRjtmaWxsQ29sb3I9I0YwRjBGRjsiIGlkPSI2MyI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7ZGFzaFBhdHRlcm49MTIgMTI7c3Ryb2tlQ29sb3I9IzIwQzlFMztzdHJva2VXaWR0aD0xO2ZvbnRDb2xvcj0jNjZCMkZGO2ZpbGxDb2xvcj0jRjBGMEZGO2NvbnRhaW5lcj0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3ZlcnRpY2FsQWxpZ249dG9wO2ZvbnRTaXplPTE0O2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSI3MCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB5PSIzMi42OTIzMDc2OTIzMDc3IiB3aWR0aD0iNzI0IiBoZWlnaHQ9IjE3MS4zMDc2OTIzMDc2OTIzNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNzMiIHZhbHVlPSJTaW11bGF0b3IgU2VydmljZS4gUHJlZGljdGVkIGFjdGlvbnMsIGUuZy4sIGJ1eS9zZWxsIiBzdHlsZT0iaXIucmVmPTQ0ZmZiZmZjLThjYWEtNGY2NS1iYmU5LWEzMjdmYWE1YzhlYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd09TQXdMamcyTmpRM01TQXdMalUyT1RNek9DQXdMamc0TXpNMk4wZ3dMak00TlRBeE9VTXdMak15TVRVd055QXdMamc0TXpNMk55QXdMakkzTURBeUlEQXVPRE14T0RjNUlEQXVNamN3TURJZ01DNDNOamd6TmpkV01DNHlNekUyT1RsRE1DNHlOekF3TWlBd0xqRTJPREU0TnlBd0xqTXlNVFV3TnlBd0xqRXhOalk1T1NBd0xqTTROVEF4T1NBd0xqRXhOalk1T1Vnd0xqWXhOVEF5UXpBdU5qYzROVE16SURBdU1URTJOams1SURBdU56TXdNRElnTUM0eE5qZ3hPRGNnTUM0M016QXdNaUF3TGpJek1UWTVPVll3TGpZeU1EWXdNVU13TGpjeU1EUTFPU0F3TGpZeE9EZzNPU0F3TGpjeE1EWXhNaUF3TGpZeE56azRJREF1TnpBd05UVTJJREF1TmpFM09UaERNQzQyT1RBNU9Ua2dNQzQyTVRjNU9DQXdMalk0TVRZek1pQXdMall4T0RjNU1pQXdMalkzTWpVeUlEQXVOakl3TXpVeFdrMHdMak0yTlRnMU15QXdMall3TlRRMVF6QXVNelkxT0RVeklEQXVOVGc1TlRjeElEQXVNemM0TnpJMUlEQXVOVGMyTnlBd0xqTTVORFl3TXlBd0xqVTNOamRJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTNJREF1TmpNME1UZzJJREF1TlRnNU5UY3hJREF1TmpNME1UZzJJREF1TmpBMU5EVkRNQzQyTXpReE9EWWdNQzQyTWpFek1qZ2dNQzQyTWpFek1UUWdNQzQyTXpReUlEQXVOakExTkRNMklEQXVOak0wTWtnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqWXpORElnTUM0ek5qVTROVE1nTUM0Mk1qRXpNamdnTUM0ek5qVTROVE1nTUM0Mk1EVTBOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk1qYzFOU0F3TGpjMU1USTVPVU13TGpVMk1EUXpOaUF3TGpjMk1UWTNPU0F3TGpVMU9USXdOU0F3TGpjM01qSTNNaUF3TGpVMU9UQTRNaUF3TGpjNE1qa3dOa013TGpVMU9USXdPQ0F3TGpjNU16Z3dOU0F3TGpVMk1EUXpPQ0F3TGpnd05EUXdPU0F3TGpVMk1qYzFOQ0F3TGpneE5EZ3dNVU13TGpVMk16YzJOQ0F3TGpneE9UTXpOU0F3TGpVMk56VTFJREF1T0RJeU56STNJREF1TlRjeU1UYzJJREF1T0RJek1qUXlUREF1TlRrME16STBJREF1T0RJMU56QTJRekF1TmpBd05qWXlJREF1T0RJMk5ERTBJREF1TmpBMk1qa3lJREF1T0RNd01EZ3pJREF1TmpBNU5EazFJREF1T0RNMU5Ua3pRekF1TmpFeU56TTBJREF1T0RReE1USTNJREF1TmpFek1USXlJREF1T0RRM09ETTVJREF1TmpFd05UVTFJREF1T0RVek5qYzNUREF1TmpBeE5qSTFJREF1T0Rjek9UWTJRekF1TlRrNU56WTNJREF1T0RjNE1UZzNJREF1TmpBd056Z2dNQzQ0T0RNeE1UZ2dNQzQyTURReE5URWdNQzQ0T0RZeU5qbERNQzQyTVRrNE5EUWdNQzQ1TURBNU16UWdNQzQyTXpnMk5qWWdNQzQ1TVRFNE5UWWdNQzQyTlRreE9Ua2dNQzQ1TVRneU1UTkRNQzQyTmpNMk1qa2dNQzQ1TVRrMU9EUWdNQzQyTmpnME5EUWdNQzQ1TVRnd01EUWdNQzQyTnpFeE9UTWdNQzQ1TVRReU56Vk1NQzQyT0RRME5qZ2dNQzQ0T1RZeU56SkRNQzQyT0RneU5TQXdMamc1TVRFek5DQXdMalk1TkRJME9TQXdMamc0T0RFd05DQXdMamN3TURZeU9DQXdMamc0T0RFd05FTXdMamN3TnpBd055QXdMamc0T0RFd05DQXdMamN4TXpBd05pQXdMamc1TVRFek5DQXdMamN4TmpjNE15QXdMamc1TmpJMk5Vd3dMamN6TURBNElEQXVPVEUwTWpjNVF6QXVOek15T0RJNUlEQXVPVEU0TURBeklEQXVOek0zTmpNM0lEQXVPVEU1TlRneUlEQXVOelF5TURZMElEQXVPVEU0TWpFMVF6QXVOell5TmpFMklEQXVPVEV4T0RZNUlEQXVOemd4TkRVNElEQXVPVEF3T1RVeklEQXVOemszTVRjeUlEQXVPRGcyTWpnNFF6QXVPREF3TlRRMUlEQXVPRGd6TVRReElEQXVPREF4TlRZeElEQXVPRGM0TWpFeUlEQXVOems1TnpBNElEQXVPRGN6T1RsTU1DNDNPVEEzTmpJZ01DNDROVE0yTVVNd0xqYzRPREl5SURBdU9EUTNPQ0F3TGpjNE9EVTVNeUF3TGpnME1URXhOeUF3TGpjNU1UYzNNaUF3TGpnek5UWXhNa013TGpjNU5EazFNaUF3TGpnek1ERXdPQ0F3TGpnd01EVTJJREF1T0RJMk5ETTJJREF1T0RBMk9EZzFJREF1T0RJMU56RTRUREF1T0RJNU1ERTBJREF1T0RJek1qY3lRekF1T0RNek5UZzBJREF1T0RJeU56WTJJREF1T0RNM016UTBJREF1T0RFNU5EVXhJREF1T0RNNE5EQTRJREF1T0RFME9UZzJRekF1T0RRek5ERXhJREF1TnprMElEQXVPRFF6TkRFeElEQXVOemN5TVRNMklEQXVPRE00TkRBNElEQXVOelV4TVRWRE1DNDRNemN6TkRRZ01DNDNORFkyT0RVZ01DNDRNek0xT0RRZ01DNDNORE16TmprZ01DNDRNamt3TVRRZ01DNDNOREk0TmpSTU1DNDRNRFk0TlRJZ01DNDNOREEwTVRWRE1DNDRNREExTVRVZ01DNDNNemszTVRVZ01DNDNPVFE0T1NBd0xqY3pOakEwT0NBd0xqYzVNVGNnTUM0M016QTFNemxETUM0M09EZzFNU0F3TGpjeU5UQXpNU0F3TGpjNE9ERXpOU0F3TGpjeE9ETXpOaUF3TGpjNU1EWTVNU0F3TGpjeE1qVXdOMHd3TGpjNU9UWXpOaUF3TGpZNU1qRXpNVU13TGpnd01UUTRPQ0F3TGpZNE56a3hNU0F3TGpnd01EUTNNeUF3TGpZNE1qazRNeUF3TGpjNU56RXdNaUF3TGpZM09UZ3pOVU13TGpjNE1UUXdOaUF3TGpZMk5URTNPU0F3TGpjMk1qVTROaUF3TGpZMU5ESTJNeUF3TGpjME1qQTFOeUF3TGpZME56a3dPVU13TGpjek56WXlPQ0F3TGpZME5qVXpPQ0F3TGpjek1qZ3hOaUF3TGpZME9ERXhOeUF3TGpjek1EQTJOaUF3TGpZMU1UZzBNa3d3TGpjeE5qYzNOeUF3TGpZMk9UZzBOVU13TGpjeE1qazVNaUF3TGpZM05EazROeUF3TGpjd05qazVNeUF3TGpZM09EQXhPQ0F3TGpjd01EWXhNeUF3TGpZM09EQXhPRU13TGpZNU5ESXpOQ0F3TGpZM09EQXhPQ0F3TGpZNE9ESXpOU0F3TGpZM05EazROeUF3TGpZNE5EUTFPQ0F3TGpZMk9UZzFOa3d3TGpZM01URTNOQ0F3TGpZMU1UZzJPVU13TGpZMk9EUXlNeUF3TGpZME9ERTBOU0F3TGpZMk16WXhNaUF3TGpZME5qVTJOeUF3TGpZMU9URTROQ0F3TGpZME56a3pPRU13TGpZek9EWTFNU0F3TGpZMU5ESTVOU0F3TGpZeE9UZ3pJREF1TmpZMU1qRTNJREF1TmpBME1UTTNJREF1TmpjNU9EZ3lRekF1TmpBd056WTFJREF1Tmpnek1ETXlJREF1TlRrNU56VXlJREF1TmpnM09UWTBJREF1TmpBeE5qRWdNQzQyT1RJeE9EUk1NQzQyTVRBMU5ESWdNQzQzTVRJME56ZERNQzQyTVRFMk5qZ2dNQzQzTVRVd01UY2dNQzQyTVRJeU5ERWdNQzQzTVRjM016VWdNQzQyTVRJeU16Y2dNQzQzTWpBME9ETkRNQzQyTVRJeU1qWWdNQzQzTXpBM01EY2dNQzQyTURRMU1UZ2dNQzQzTXpreU9ETWdNQzQxT1RRek5ERWdNQzQzTkRBek9UbE1NQzQxTnpJeE56WWdNQzQzTkRJNE5qVkRNQzQxTmpjMU5UTWdNQzQzTkRNek9DQXdMalUyTXpjMk9DQXdMamMwTmpjMk9DQXdMalUyTWpjMU5TQXdMamMxTVRJNU9WcE5NQzQzTkRjNE1ERWdNQzQzT0RNd05qRkRNQzQzTkRjNE1ERWdNQzQ0TURreE1UY2dNQzQzTWpZMk56Z2dNQzQ0TXpBeU5DQXdMamN3TURZeU1TQXdMamd6TURJMFF6QXVOamMwTlRZMElEQXVPRE13TWpRZ01DNDJOVE0wTkRFZ01DNDRNRGt4TVRjZ01DNDJOVE0wTkRFZ01DNDNPRE13TmpGRE1DNDJOVE0wTkRFZ01DNDNOVGN3TURRZ01DNDJOelExTmpRZ01DNDNNelU0T0RFZ01DNDNNREEyTWpFZ01DNDNNelU0T0RGRE1DNDNNalkyTnpnZ01DNDNNelU0T0RFZ01DNDNORGM0TURFZ01DNDNOVGN3TURRZ01DNDNORGM0TURFZ01DNDNPRE13TmpGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj0xMiAxMjtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI2MyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3OCIgeT0iMTAiIHdpZHRoPSIxODkiIGhlaWdodD0iMTE3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI2OSIgdmFsdWU9IiZsdDtmb250IGNvbG9yPSZxdW90OyMwMDdmZmYmcXVvdDsgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5TaW11bGF0b3IgRW52aXJvbm1lbnQmbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjcwIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9Ii04IiB5PSI2LjY2MjQ5Mzk4MTcwNDM4MDUiIHdpZHRoPSIxNTQiIGhlaWdodD0iMjkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjkwIiB2YWx1ZT0iTW9kZWwgb3V0cHV0cyIgc3R5bGU9ImlyLnJlZj1lMjQyMDA5MC05ZGViLTQ5ZGItODc1OS02MTM1NGE2YzQ3ZGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktTU9ERUwtT1VUUFVUUzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7ZGFzaGVkPTE7ZGFzaFBhdHRlcm49OCA4OyIgcGFyZW50PSI3MCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTciIHk9IjU3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iTW9kZWwgb3V0cHV0cyAtPiBHZW5lcmljIFNlcnZpY2UgUHJlZGljdGVkIGFjdGlvbiwgZS5nLiwgYnV5L3NlbGwiIHN0eWxlPSJpci5yZWY9MzAyY2NjN2YtOWFmNy00NjQzLTliNWUtZTUxNzU2YjM0M2M3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2ZvbnRDb2xvcj0jMDA3RkZGO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7Zm9udFNpemU9MTQ7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7IiBwYXJlbnQ9IjcwIiBzb3VyY2U9IjkwIiB0YXJnZXQ9IjczIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSI1MDgiIHk9IjEwMSIgYXM9InNvdXJjZVBvaW50Ii8+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9IjM4MiIgeT0iMTIxLjE2MzYzNjM2MzYzNjM5Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAwIiB2YWx1ZT0iQnVpbGQgYW4gQXJ0aWZpY2lhbCBJbnRlbGxpZ2VuY2UgbW9kZWwgLT4gRGVwbG95bWVudCBTZXR1cCIgc3R5bGU9ImlyLnJlZj1lYjk1ZTYxYy04YjMyLTQ5NGMtOWZhNi0wMTg1ZWJjYmM1YjE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjc5OTtlbnRyeVk9MC4wMTk7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbnRyeVBlcmltZXRlcj0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzIiBzb3VyY2U9Ijc5IiB0YXJnZXQ9Ijg3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQnVpbGQgYW4gQXJ0aWZpY2lhbCBJbnRlbGxpZ2VuY2UgbW9kZWwiIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NTC1BSS1NT0RFTC1CVUlMRDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iNzkiPjxteENlbGwgc3R5bGU9ImlyLnJlZj1mMjg4ODc4NC02YWJjLTQzYzEtYjdiYS0wNzA0ZmE5ZmE2OGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktTU9ERUwtQlVJTEQ7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0ODIiIHk9IjUwIiB3aWR0aD0iMjc3IiBoZWlnaHQ9IjExNiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSIiIHN0eWxlPSJzaGFwZT1pbWFnZTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsQmFja2dyb3VuZENvbG9yPWRlZmF1bHQ7dmVydGljYWxBbGlnbj10b3A7YXNwZWN0PWZpeGVkO2ltYWdlQXNwZWN0PTA7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQU9FQUFBRGhDQU1BQUFBSmJTSklBQUFBZ1ZCTVZFWC8vLzhBQUFCMWRYV3pzN01sSlNYWTJOajgvUHlrcEtTR2hvYUtpb3F1cnE3ejgvUDI5dmJ1N3U0M056ZmQzZDJVbEpUbTV1YkV4TVNhbXBwOGZIek96czdVMU5ScmEydnE2dXFnb0tBdkx5Kyt2cjZQajQ5a1pHUnZiMjhSRVJFL1B6OVNVbElaR1JsTVRFeGFXbG9ORFExSFIwY2dJQ0JJU0VnNU9Ua3FLaXBwa2l5QUFBQVhXVWxFUVZSNG5OVWQxMkx5dks2c0FJRVFDSnV3Q3gyOC93TWVobVRMTTNJUyt2MUhkeTFPWXRuYWt1V1BqM2RCTk84MmorZHI0N3JaVGJPaFpjQXdtKzQyOTkvUHgyWjNIcjF0SHUrQ2JOOVFZSmRyT0dRN2RjQSsremNUTFFueGI4T0FVWXNNeUk3bWdOLzRuODAzRk9ZM2Mvb1BPS1l3WUxpekQ3ak4vK204dVJETjdOTi93R3VYMHF0endPei9nQjhuRnZxVDBMK1BtUHNHSENmL0dvRWlTSDNUdjBPdmNFUmEvSkYvQ1FzNjEwczhUNktQWk5GYWtuOU9DWlB1V292a0kwcm04WVUrdHZqWFNQaUE3TTl0bmNqL1I3RXBmSzdqZ1J5UVRMLy9MM1p4Y0paYnBZbU1xSzhoZUZxcEE0WmI4ZE41OFBGZmhSUE9zVzNaaGx4QmNHY082SWoxdWJ4L3FseUlCcE1zei9ONThyVEsxbUovckRLZm9uaXl2dTBUZis0Ky9od204L3U3czhuZ24ybVFZVGFUbXVIVXl6cmU2ZCtCRUtwREp3Z2k2R1E5Z1c3ak9MUGF0ZStHWkV0a2d3SWoxNXBING9tZWE0VEYybnZDOS9iUGVYUHNtTW9kVnM2SHVqakVLUzFYN3RkTzM0S0hDMUtINWZtQWx2dXhBZTZ5ZTBqdWZ2SG1EN1ZJeXowTkp4TStBY2gwNWhuaU1NcWZrTmVNaHhQV25razRXWXhPMytjbVRYd3YveVAvS3FiZi9QN2FMUysvWitZa21xOHhIa0ttbTNqK3ZTeDNQNHBBOHo1WkZ4RFg0S3NMckJHbHdyVDB1bmdjREdFVEwzRUtNam50ZnNsUC9vSFJLaTJ6alJwMzJMeisyL0U5ek1Id1k3Sy9mWFpWZ1p4dDhLUHQ5MnRHRVgvWmF6K0FlUFVLUEJhR3ZpZjlVcW9XRURRNjFuOFpNY2lvUElaU0FYdUpwQVk0T3BmeTlQckJHektyZ09GSEQ3NzhXZVpoUHFDSGV6Ui9ndkJNMS9kNEZRekY0cjVYOFNNWFdpem42ZXNYcjhhdmhDRnF5cmR5NHVEZy9naHVyOXNzcllnaFVzbjVuZUlVNVl6TitSbGNpNmRmaE9IUTYwSGdKcjR6cXRyelVlS3ltQkc5R0xaMm0vTzUvYlYyRXdFSXMzN0lsQVBoNGtOaVhpd0lQQmdTWTNlWldINS9BSGhmYnd4eURFR3JPMVRTazA4TVBVbkJpV0ZDRExPR1UrVkFGT0gyUGtaTVhsKzR1dFk0bjgzOEdTUVhoZ005WG1DbjR3UUVuZXY3MVFFdzNKUitnUU5EUy9EQ2JocHQzb3JoTU9rQUgveVdmb2NEUXoyV2VvZTI5WGxZaWJpVDFFMm9nM24vSW4zQXVqRzBCbWVzZnFiYzYrOUxmMTVmY0dxK095c2ZyMHlsMDdSRElFV0w4OXdhREJZbjMwYzJ5anpPeTNyeXhyRVJOVHlVNW9PbS9pcGw0WWJLR0l2V1NjNzZNOS9WNHhyWlJuL3BIY1BTNU9IRkVFeVZDR3dqeS82Z0xGWFdwZG8rRHZibUs2dG9YQytHMmlDYldYR3hQZGVzSUhWU3k1bzFxZ2hyRm9iQWxyWUljR0o5OEZ3NmI2eEZaOCsvbDJhdnYyVTRCcXU0K1NUdTc5MjZvNFQ0dlJqaVNOZ29PNGUxdHYxZVV3bnVQYUFrcFNweDMwdmNZWExmTVA2a0QyN0daTXU5R01LbVlaYlY2MEVNT21yZXVGU3NPSlBQWHozMnZnN2R0akYxdWV1QVlmdDNST0QzUU1kTlVIUVhMdWhxVFdvNlNuaFVKUGJzTmFaVlNLM0pJeUg0N1JwZkVNdFhOeFlwZjVZNEkvbWhZRjZNaEpZSXFmOVF3dUVTdHZpN0hjUElvcEdZb1Y5WjI3SUp6YU9pbmRGWXVrWjBGb1pNN1ZsbStnQ1J5M0RZcFphRWsvT3pPaXlOai9CQTVIT2JqZ0hKVDhNUWQwNDVrbWtqREhGc0xFMUFhRnVVWUlVRlVuSHpuVXY1YTB3MUlzTHRNTXNuRDN0OXZWRlh5ZWtCYTR0ekMxRzV1SXZIZ0dlRUhIVW1ySEdQcFpUdXlLVHByU1VmeTVwTElzbmRVUXdsWTdjTHNsSUVHNGRvUll3cE9HTXVRcFhNWGtJOUlYVG1xYjd6eEdrbWd0b3VvZm9iTmVnWC94RU1mYnBqcjBPSlVMUFZVclJ2NldoaWxLMzd2V21yaEUySWk4UG5ST1FLajlMdE5oeFFPWDlZQXJBK2dCME5INEpaNHBXL2ppcFN2MjFSQ3NOSko0L2p2T05UeThBamJBbU1ST3BQZ2RoMFE1RjFFSTVodWhVNi9iaDFUZ2c1a1pzaGhocTZuNEpoVXdQQndtQjBLSWFwVnBseGN1SDQ4L3A5Ni9oWkI1QWJoU1U2SFRXTWV5bG05RUFNTFRaU3p5Nm9ZYldadm5uRTMvTDhKRDdkNUZCSUVJWmFIQnhwMVNwcmtiRjR4bWtTTWpySnA3MW1mejNuOFhnSWhpdlREWHVDTmVLT3U4SlROYUROYjZ6QllSQ0E0ZENJcXlGWUEyRmdVZkdNaFRpSXBvTWdBRU5pUkl4MnplWnVKUCsyemN3Yit0QUJUTVJBYjRUQXZKWE43VUVCUG9iUzA5eS9RajFSUjZvbkN4NGdsTmFzQ1lKY0tsdnRPSGk1SFp1cGhaallHR0k2dlhFbEFub2hZdE1tMXdkTkdrSUQzcUlLRDBqeTZoazRzakZFVjJPanZHS0kydC9VZTkwUURLY2hHMjdBb0NIaFc3Zmh1QmlpUTNUVmJDUjgrZFY0WWwwQ1E2NTlvSUVhdE5WdzRXS0k2czFnT0l4M0dPYnZObVJiWU1OZDhZc0NpTlJ6VHlveVhBeGhrVVVTTVJLNkdkNXVpTUY5Q0d0QmNDL0FuMVJBT1JpaytXeGNESUdYSVl3NXVEL1dCRjBPMUdpVWZoMlpiNlpUUExBR1cyQzFiZTVrclBaSWYrSmllRkJvOGFrS2YxL2JDRjZFRVRzOFdOYlRDZWkvOCtQY0prUzVDTnRRWHVKaUNJKys5aTJuRDBHKytLeVpaeGkvNWhtUEVSaUVGUk9zd2tVbS93dkU4TFZSUUpndjF3eFNpRmR0K2RIU1pJYUZnV3VyVnNoaDdwSEl2YmZ0SVN5blh0WHJBbGcwWnlpUkNXanZFN2tYaUNHc3pZWnducDBQVVg5eXJaVFFtSUFMUU9hVDh5TmNERSt2Y1NoTDc1Nyt6aXRMc2FLUVhYb0tybWRKalNnQTJKOVVTM0l4QktLekZOVWNLVk1LZ0xBM1Y4R2xZN1J3SzlZZW9ZMGxwUUt2Vm45c2xjTlBRSnRHbFlJb1NiLzduRTFja09BUEpldDVIb3d2T3JIU3VHUmdtSjNrOXcxL1hnU2kxWCtUbE1DbGlMVlMrbjRpSTlMSFpELzF6ZzhGTURDbUNSZzZjOUlUdmY1cnBDZzRsMitoeEc2ZDhiam5HN1FQQ0NKQldYV1lodVJNZ1A4Sk53R0d1MzdQQm4xTE1jbU5XQ2tkNGVkcnM5RGltajNuSkR2YW1UdFp4eW5TaVkxMlFCRVM4RCtwS1BaV0tqaGdCamltY3FkMHBhQVhvV3djeHB1ZW9tNUs2cUxXOUNjMzY0M0xRdVpUQnNQN1NpLzcvUjFaZmJNSWU2VlhObG4zUVFtL2pzYUtCelpRT2xud0RQZ1ZQa09rQlcwOTRJV3ZPSEVFRSs5a1pFMFlMY1lqT3NnU2ZxY0lMZzJCcEo2cDVOaHpHU0pJSTJQV0lqSURyay9DbkRoUVBEZzlnZ1Y5dmVGQkVobXp0SkZoUnlHd2drampJQ1hCY0NyYU9GVDYwNEk5V2xrclZ6WStsMmRDUHFEdG9rd0gzbHdLSllySm92cE94cWhIVEpVUEZXUFlvd3RpeWVBVmtjOUM4cXZDaXd2ZUcySVpoM2J2b25yS1d6VWdBY05tMXdHWnBuQTdtdjQ0TVR4Y3VTeGs4RkFnWG1DY2sycE0xMUlNbFNtTlZLa1Fuai9zOUlRQUdmVjRIcnlnUitLQUNDWXMvclJVS1E3RnFPaW1vNlo3eStTQW95VHJydGZkTEdFYlZFSXNpbkkxMFhPRjQxN0pZOEIydlRna2lzVUlTTDRwajY5RHJFOFJpWjNuMUF2NzVtai9YUkJKMDF5Q1A4SlE4Q0lVUE9HVTdVY2NUQkJpeWJIbHJWSGplcHhacTBiK0NzTVBGUHN2eVd5SnAvZ0I2ZnpxcWthSlhDenpaeGdxRlVGNG5vTmREU2lKSVBpWVhGMFlEaWJ6Zko3Nkd0ZUFmZmpNcHVLT0JKVDJZY0VOTXp3cG9SWU1PMzBzc3o3Mm5QNHVMYndEbjk1N2ZsY0hYSlhRREZ3TkdNNVBEUW9qbHpjTncvWXk1aGYyMVZHWWNFS29qT0hBYkgzeVpkZGFzQW5YU0d4bldCUUdJMEtCeC8rclltaHYxMmQ5SFZvZUtXckgwUE5vb05jRFUrRVZNWFMxNS9HZGMydWh4UllxRnNHZExLb00wNkFhaHU2R2k3WVhBbUpiTkdoQ1B3b0s1enpQNG00M3pqdThsbU9WTUtRVzcvZnYxeTg5VTJmaEZtREVDeDdwQ3oyUlFkcnJ2V0RUYkJVSGNDcGhLSS9pekJhUDlZdzZmV0VEVzhxYllNZEhIMGJVbGdrL0ZtSzVGQjNPcVlLaFlFSVNDa3RFNE1jVUNKaFRRSkVScUx0amZRdVJldnpCeGlvWVlreER0YjFFdDBXRFN6QWUvZUVhNElPNTdaQUxRTnRIN3hVd3hOcDVQYmlBRnFTeHRPaUtsOWpEcUNEYTBpeFZxMThFOEtpZS9CVTFlNFpVeCtZQjRYdzQ4V3pnQ3piT2x4WGxMVHdBa3RNOFpZWVdwSTQ2K1BYZm1KQmp5OUpNUWFieC9ibWZ6WlkvMm1sbzE5c0F3M003SEJyS1RxVDcydzZzN3VHMy9ac3cwU01hM2x6Q29XYkZZWitMM1pya1N4b1hkK3hTdWFnK0FjZ252MHhOU0NJQ0JubzVGQmhyTzh6Yk1Hc3R5UTZldTVvRG5IVEpzV0g3TGxiR0VBVHBTeldDRXV6Yk1RQVJORVV5OWpSckpFRDZCSTh0OGlTU25YTHRLWFZmVTBRV0FCcndsMUtOb2tlWlFGeTBSSWFZVXg4a1BGK25NRW1GR0xLMldLbThoMUJhMEtZWWpoWGtFU1JlMFFGeExRWXh3WjFUSWNnemVyWTZoOG9ZZ2s1NDhkaFdlYWttWllFMno1RUlSREhLdWdXTmVvczBSRmpjd29xVk1iekMwajZrQjJ3YUZrTnF3dTBrcDRyU3NiaU1BVFdQcFk4ekJXUzJieWVHYXVjUEZxRG5oSGhFS1hKQnh6ci9sSXhITDZHNGVnYStVdGphQkxNZ1poU25nazBEMUg4MGZvQUYxVVFsYXQ0QitZT3hpYS9vVEtINWcrdG4xdEZWd0JBajlicmFReEpVWFhpY3drdkE0allmQzcrUzNQWFFnV0g5b05JdzlINEZEQk0wS05SaUlTRWIxUDNST2hDaStHTUVYUVlzK3hYYldodlNxNHIzSkhRdDlTS0VCYUxLQmt6UzRnVEVPdFRXekE2L29BZndxbUFvazFxaTdpbVY2VXhGbll1QWp0N01vYjYya2hoUzBWR3BGTVVnRnVOeEZ1Y3g2ZHF1Q2pXTFZoTW5WTUtER1E0QUFhZGJVdFZpYlphV1lBQks1YXpvNkVHUGdNbmxxZWxPSWxDZHVrcXNHQzkxR1F3S3Z6dHdrY3ZqT0tRWkNMaU85aW1Xam5uYmQ1Rkdib2F5TGtnTEFaL0VEKzI0RGxLRmwybU1YVGx2WWVzR1R6VWthVXhtcEpyb2tkVGJ0UEl0WVJzTG9kU1JleHJvbEhvaCs1R1NpaCt6WGpnNnFVOXVscjN0ZUx6dDllSlN5TnBENlhYa0R5ZGJXY0IybTlGZ2QwUkNuTFpMUkNKWFdkMVBtVzVoeTdkaCtMQzZXOXRaYzlhUFUzVm1SSjNzcmRzeU1KRjdRV0VYcFltWm1nT1pvTmx0NzgzamsvSlI2NmE0YjVvNitsK2MzYlhwU1M5YWdNeU50cFR2eFpCZXEyQ3hYVHhYYVhtZDQyaHZYNFZIV2MyMTdBbkxra0NVeWNGUUNFWXVpWUF2Z0p1Z0ZXL1VES3hhZWZsVHNpVWhsOHJDNkFJaWJienBSOXBWU2dKOWJKaUltajlXSFB2OTlUU3lNbEtqUEZIdFBnSUNYczN6ZUQyZXJsdTVOd2duQlRlckRxQU1oc05KYTdyZFRsc3BUNlRMYUo5aWpRc2UvUXJUREZMOThyTGs0Umd1bWtLTHQ1c3M3MjRnanVuU3ZjR1pCcloxazRsMVptRU5WdERHamdyYVhGdmd1WmFIUFhKd2pKQnppR2VEY2pTMHVTeXUxcGw3M0xRNG1yZ25Fc3RtZ3l3WmV5Qk9DY2hwb1QwZW1QWENJRkNidlRDY2VPa0liMkNaV0MrVmFqUDhBclRQWlgwci9DT284T3REeG5mNFpVUE04eGJMQnpFNjJzT3lBaEdvR2ZCdlpLZkFFNVZvNVFXMEptQ2ZLTG10VTllMWJoeGVRb3lRYmNFVUNHMWlqYlFRMERlNVhGVC9kNy9kN3NuaEM4WkJTaERBdVBqd2NHaWhJWEF2OTNSeFdRenhCRVlxdmZmaTNoQVE3RHUrL3NMcXhOQkFHL2pNSWVvYlQrZHQremJZMms3bmtWbWx3cjRvSkJ2VUR1cGZvWjR1UEJiQ3ZVVWFmN1hWTGtQK1ZTWVZvWG9zdEMvVVhRTzJETzZEQVM4SmllcHdUc25TamRTUDNXT3lzM2czZ01CZW9nWmM0NEtjbVFrbGlKdDMwbmtxVEV0aklMcnhoVUhQSFIwSFR3V2ZUZjltZm94QTRHbDFTejBlN0UxaFljWGVnbUdJVEh3Q2tGTklMNkxBamdQdzZ1VCtwUXNZT25CZXBmRGlycVVGdytEYnZzRGpDcWt1THRjMTRra3M0TkZpMTRnaUgraVR2Z0dQWElmSzBoS21VSlhPSDYra21xUHpodzZZMzN2TkxheTNDM2tMUEJkZ3pyNnRlNHNPV284ZDk0VVNma0FqZzEvT0hvamhhMzRaZllpNWgvQU05a242b29zVUFDSTh4ejZqejhYd3JQRGgwdzM5ZW0wb3BPU0xPc3RzVmZMQ0lJMXJlSlN2N2ZzclVyQ0tlekZ4SnoyNEdPNlUxdzVub3VjMDY0YStEMEdXS09leFZNRVJJbWc5aGxzdEhoa2wzd2puZWY2UVlpNGpQckNibWFVaVo4T2lOeFNDd25NOWVCWW05ZWxZV29zNVcrZDV0K2MzQTdnWVd0b3h2QUFEOXdYeEdsRFZaL0dQcmZzNWtRdXdlNCtrR0ZFQlI1aWMzVlVRdlFqTkpNU1RoR1pYUVFWd0MyV2tGL1hGMFRXbGhyTmhxK002QkVjeEp6dWFpRWR0dnhXWk9VQ0R0U0JYaEJFeTRoU2d5TkFERWlTWTU3SUV6WTdRRDNEd0NSdkRvWWhoRUxxU3dVdS9KTVgwQmJXMGhkeFhvbTBSS2VmNGNyNDBzL1N2dURsY1ZINUVXS2F6bDR1bktUSmN5Q0NQWHp1SlJ4VVNGNDBJS0lyRVUvTzljMmhzbzltNE5CaERXazY4dWV6M0YzSkN3Ty9uQ2VtblVsMGtIcGNrTHRzdkxBc011cWhMdm4rZXV1Mk5BQXl0VjdPOENNUTdHN25jR3RWSkd2OEZTN3F3ZTRJQ3EyeTgzMTMyMjl6cjhvZmtMUktsMzR5RWIxK1FoalJSTnhRREliVlR0N01hZHR4RHkwTlFabVp3c2lINGFVVXdTb2JESktXM1VGaU1aU1hTZDJpTGtGQ2Q5MkFINXA0czJ0WWVmdTYzRCsyMmt1TzFSaXpzd2N4YUw2UVB6YTVOdENENXpzNEQ1c3dkSVJsYlRWVzk2ZHJ3L09Ga0xIVHl6OWpCNDJZUmlUUFJZSjRrcnRvNlVZTlNXZTVWK3JqQkkzWDd2RnBmMzhiVmswTXphcXBxdnREMFBYbDh0ZWxQbyttUGlFOW1OS2xWVXkybWdEZFZLdENicGl3OVkzUVlaRE8wMWtvMkxYZkRtekJFN3ZxY1pjeEVHS3IvMm0rSExzUncySmt2d29zL2tVejVtaHRjb3VBNFA4SmROSFNuMCs1ZFBHZy8rREdNNHBmYmM1aUZwc0hBaU9WZjV3QlVXdWJ1Z0dIV1Y1cXkvL1pvWlpRWFE5cTMwWG05dWgyNGtYQUV2SFkzdkhKL3ZyY2wzNWVDZW53WXFtTDhHbVJLZ2ZkWEZHTVVBQzcvZDJqVDJkeGhLOHN1TWg0TWpSUi95UHJpbm5CWnVGd2lZK0hFNzRuamN4L2RHSTZOSjg0aDl5b0RYM0cxRzdnWkFZMmpQbHpSREFLUFF3Qk9EQ2VXQjBJNnBnTUZjTlViMktjQkY2elNMclZPK0UzZEdNcmpQVC9TOHcxbzdBOWVDRGRzRDg1OTBLWGVxcU16V3ZhbjA5NU9kOVBuOE9aWksxWkJoRmE2OTQxT1VSZ0h0UGZwaG0wN3JIU1F5U1l4dkxTSWpPakVKNHFpZXJ1SENmQkpLSC9oblM5L1FoNkdvWkloWmdKMjVCa2JwRFhadXNxM0RNQ2dPMmJyK1o4UHpOU1gyY09YcEJsYjVkL0FGUm5YUVpBbC9NMjNHZ014Qkc0SnRJL1RidXhVb0JPdkpxa0JRN0NIdUZUcXViNjlOTERxdmRBUVJzdWYvM3FnRXE1aE9nM2JjaDY0N250V0FJSkNwOWRmQVhmYjdjSTJCUVJUYUxrcGJ4SVBXRTdIS2doejRjSDdReHdaVU5ZSllWSnVDVEQya0twNCtZTU9VbFdZSEM3UVB5OWxzb1R2S0s0Q254Z29wUnExUWVyQjBIWmlKNkNFQ1JqWEd3NVhBT0llNWU4SHRFUFBqYUdOVFFPTU5wRCsvQ3NiTVkxZXk0RlpDWWtIdzQrVGptQkFNZ0ZMRnZuU243Yk5xQlAySGd5alMya0VSY1l3d0tVRWt6bTA4cnNJTWcrR3F2OTFDZ3BIUVk0MndJNFZhZlM2dzM3KzE0b0s0Y0RiMVRIQUUrSU1ZY0xVMmUyNUpCUXUzQ3ByNWFFaVhLUXRncDdDb0VMcGdLSWRqdUdMWFF5b1M0TThkbmtwU2EzR0tRck1XakhFelFpbE45RTd2dGJaN09wL1oxeDZvc0o0S251bnJBM3EzME94RStGV05KcDZkNmVyUHNYZkxzTXhIb2hrdlVpSit5aGx1blRraXo4SG9ROHZEQ21hOTcyL0l3OURsVEpPeUgweE01ZWJFWThhWno0WkkxM3dENjkwRDQyalM3Y2s1QnFha25sQUdsNnhwSU9pdEI4b2I1RXN6c1ZEWHdCbVRyOWo3bVJLcjlrcGVYZXhGc2YrMmk3a1RrWnBOcE1rd3FWVTRVQXdEVWhacWZVN3kxTDVsV1N4cGExWXFxZzA3YUt5NitpMDcyMjNzOTJYZW9DVmE0V0lwNWpXb0ZxQ2NQdmF6YmJiM3Y0MDBvNS9WUkxOK21WemRtQVNpWnd3MDFSaVJTSGJGVXVhSXN1dFVnWXdMMGVXcjlKdmJuUUFKNVJjZ3k1Ym5Jby93eUpUMmpXZVJWaDZuWXdGVHZWRVd2UnoveWF3cUk2bUNGbXVYR0hIMnMvNmlnb25mV3UxNTJpTmhNZmdoWlh5S0VQV1lNSnV0clpHekRmOXVwckw0ZmZXYXJMc3MvbklNV0Zta3hFRFVxTVVETlk5d2RBN0ltbXJxZERSWnJldXMyUlN3RERwNU4zcG8rSEpmSVdpQWltcGtMSDBHeklMQTNuNEFISkFzcHEzMXZldmQvTk9VbnVoandkRTdyZEFpUXVwSVpLaEJaYWtpS0MrWmJOQ0FPTm4vazRIRTFUU0oybnVlc1ZnZ3BvaStHaHI3U0Iwd01qanZ3Z0U3MHdsenNQNGRtY2xCdFdjV2lnRGdzSE96aG5MUm1vUFAwU3FPU2VoZGtSRmM3MGhuWklnYTMzc1Brd2tJL2F2aEowMDZCMEdpZlRiL2oyTlBpQ1NkdjdSRXVqTTVabWFJL3hMcnNtNVplS1l5U1NWKzZUTzN3Szl1dmVycFlTOFZtdlNrMFFjd0tZOUdrZHJSWEVQV3NRdnV2MEhtUEFGaVdJaWYwM3o5STdtb05NYUsvZmRranRKMVRhVXgzSGVHVHp2MkowcWJsL2RDY3dxTVBoc0ZNSkZvVGpHM2NlZmY2blhDNkhZeWRKOXlPSTZ1SCtDaUFjeTczVGJwbnBmK08rcnFidUl2Z2FJM0syYUhXcGs3WDVnK3g4Um9ob2tXMnYzcXMzVXhWRERxWFVmdjdmL0lSR2p3VERYSmNpNXFkOUVyVUNVTmJXd1VtT3ZOOTc3cjBIVWlYdW4yNkZ4UFd3dTJ6Z3RwcllvamZ1WHplSGFPTnhPdmRnU0dhMEkvd05CY0JuWFd4VkZuUUFBQUFCSlJVNUVya0pnZ2c9PTtmb250U2l6ZT0xNDsiIHBhcmVudD0iNzkiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNTQiIHk9IjM1LjQyIiB3aWR0aD0iNjQuNTgiIGhlaWdodD0iNjQuNTgiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI3IiB2YWx1ZT0iIiBzdHlsZT0ic2hhcGU9aW1hZ2U7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTtsYWJlbEJhY2tncm91bmRDb2xvcj1kZWZhdWx0O3ZlcnRpY2FsQWxpZ249dG9wO2FzcGVjdD1maXhlZDtpbWFnZUFzcGVjdD0wO2ltYWdlPWRhdGE6aW1hZ2UvcG5nLGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFGY0FBQUJiQ0FZQUFBQUdDaGtYQUFBQUFYTlNSMElBcnM0YzZRQUFBQVJuUVUxQkFBQ3hqd3Y4WVFVQUFBQUpjRWhaY3dBQUZpVUFBQllsQVVsU0pQQUFBQUJkYVZSWWRGTnVhWEJOWlhSaFpHRjBZUUFBQUFBQWV5SmpiR2x3VUc5cGJuUnpJanBiZXlKNElqb3dMQ0o1SWpvd2ZTeDdJbmdpT2pnM0xDSjVJam93ZlN4N0luZ2lPamczTENKNUlqbzVNWDBzZXlKNElqb3dMQ0o1SWpvNU1YMWRmZHNiZFRnQUFCWlJTVVJCVkhoZTdWd0plRnZWbGY2MWI3WnN5WXRzSjJRSEFvRWtCQUtocGRDVWtoQ2dKVUFoVUdnb3BXVXBoQzB3ZElBcHBSMitsbEk2aFRLVVBVQXBUSWVXNlVJcGF5Q0JRQllTRWtMSW5wQUY3N3Uxci9PZkt6bVJaVW1XYkNud05mNUJzZjBrdlhmdmY4ODk1ei8zbnZjME1RTERLQXEwaVovREtBS0d5UzBpaHNrdElvYkpMU0tHeVMwaWhza3RJb2JKTFNLR3lTMGloc2t0SWc2T0RJMDlMR2czTmZ4ZnczOEd3RUZCYnJpMUErNGw3eUpZWHcrTlRpWnJHbUwya1NVamtmZzFHUW1hREs1cVdFODVDY2FxQ3ZWM05od1U1UHEyYkVQREhUK0Q3K05QRUVrY0d3eGtXQ3hISEE3WG5iZWpaUEpFL3BYZGVnOEtuNnVoS2NiQ0liN0NRMzlGb3JSSUdhS0IzY0pCUVc1OGJnckZoWUZXdVpDQnovYkZJWmR0RlE4Vm9YVkVRaUZFYVNFRlkyTmdJOHNMa2NSZ0RZUUQ3M041dFNnSmhOK1BjRTgzd2sydGlMUjNJTkxSZ2JESGkyaFhOMklrVjJ1MVFsTmlnOEZ1aDk1UkRrT05DN3JLQ21oTVJtak01a1JneWcyK3pkdFEvKzkzd2t1Znl5RWJOSlRQUGZJSTFOMTFHNnhUam9vZnpJSURScTVjSnRydFFYRFhMcmhYcm9aLzB4WUU5K3hGcUxFSlVaK2YvaXpFc0I3M2FiRW8vWnBPQjQxZVhucEFwNGV1M0E3VGlEb1lEeGtCNjlUSnNFeWJDbjFORFhRbVErSUttUkhjVzQvV3h4WWhzSDFuL0lCV3JJNHZYZ2RhcldwYjROUGRDRFUxWjUwcys4ajk2ZTJ3VGo2U2YyVzMzdUtUeTdOSGFLWHV0OTlCeDR0L1IzRHJOZ1JvcGJGZ2tKMWpvTW5qOGtwYmtndzlyVnBQS1dROWJob3FMNWtIdzdneDBCbU1HZnNhaTBRUTZYRURuQkY5cmladDR6SFAwbVZvZWZCaEJGcmFFbStrUnkrNU5YZFJMVXlaRkQrWUJVVWpOeG9LSTB5cjlGQmZkckh4N3VVclNYSWc4VzVoSUozVlZ6aFJldEtKc0o4NkU1WVRqb1dockl4dlpMY29CWFk3M08xRzE5OWVSdE5EanlIYzFwYlZhZ1g1dWdYNWZHRWgxdERkQTgvcUQ5SHkyNGZSY1AvdjBFV3JMVFN4QXZHZm9iWjJkTDc4R2hydmZ4QWRmM2dCZ1cwN2Nwb05ZYmNIbnZmZVI4Zi92cGdUc2NtSXFTa3k4RGNLVG02WUFhbnJUMzlGQzBudGVQVU5oTHE2RXU5a2h6UkVsL2dwVFpmZmUvL09CdW1pVEczZjlrL1IrdXp6YVB6TmcvQjlzbGxwMGt5SUJzUG9XZm9lV3A5OEZyNXQyL01pVmhELy9NQ3pvM0J1Z2FjSk5UU2k1WkZGYVAvelh4QUpNa0JsZ0dwV3IrOTBPbUFZVVFzOWc1V2h1Z3FHcWtwb3pTYXFoMDVhWllkS1dVUDFEWWd3MkVRNnVoQ21yeDZveWJhSmg2SHlCNWZCUHZOa2FFdXNpYU54aEwxKzlMenlPaHJ2dnBkK3VLZGZ4aVp0TTdJdDFpbEhvK3ZOdHhFTjdKOXhNdER4Z0VhM01Qa0FxUVdKN3FIbVZyUS85U3phLy9naVFoNVA0cDIra0lackthT01yaXFZeDR5RzhaZ3BLSjB4SGFheG82Q2w1TkpTSWZRQld4WUxCaFRKL2syYjBmUCtTb1EyYjFGV0dpYjVTdEtsZ1FTK2txT09nUFBTaTFFMisrdEt2c201SWo0dlBNcy9RUE92N3FmRjdrZ3J5d3djOElyTHZnTkRYUTJhZm40ZmdtNEd3Z1I2eWEyOTZ3N1lwaHpCdjdKYjc1REpqVEhpQnovN0RHM1BQSS9PRi80UElhOHY4VTVmNkMxbW1BOC9ETGJqajRXTkZtVVpjd2gwREQ1S2F1V0lLSzAyMU5vRzc5cjE4TktQdS9renNIdVBHdHhVYURremJCeThFVCs3QTZieDQ1VGM2MXE4Qk8yTGZnL3ZKeHZqU1VvS0RHVjJsSjE1T3FxdS9KNEt3RTAvdTRmazdqZVUvZVRlUm5LTEhOQmtYSUtmMWFQOXVSZlE5ZGQvcENWVzlLcUZWbEI1NWVXb3UrOXVWTjk0RFVxbVRXR1VaMEtRQjdFQ3JkRUlVMTB0eXM4NERhNjdmNHhSOS80bkhHZk1ockcwdE04U29LU244cm5TcjUwQ1hWMGRJbDR2dWpuRm0rOTdBTjcxRzlJU3E2UEZPaTQ4RDlVTGZnaDlwWk0ybWRrcTQrbnZ3QmdTdVJGYWc1Y3lxL3YxeFFoMTlnOWNPaEpiUXQ5VmVkWDM0ZnoyK2JBY01sSk4vVnpXUXJOQk9xNDNHR0ErK2toVVgzTUZTZmtXekNQcjFIbmx6QWJLTS9zMzVxRHNyTm5DQkx4VUxtM1Avbzh5aEhTdVFHc3lvZlRMSjZEaXZITmdjTm9SazVOa2FXTkVmV0RnQ1Q5b2NzVWQrRmF0UVRPbldXRFBaLzB1cGFPZkt6dHpOa2JjOHhPVW4zZFdYSDhXR0JxTkZzYXhvMUYxOWZlVXNMY2VPUkU2V3JmenV4ZWpZdjZGMERvcjRIN2xEVFRkODEvd3JsdWZsbGg5U1FrcUw1NEgxNjAzd1RocXBDSlZ5eUhLNWkwMTZrd0RHOGlneUZWK2RzZE9ORC8wT0VLNzkvWnJpS0cwQkdWelpxSG0xaHRoSE0xZ1pURDFiUXUvcjE1REJjK3BvV1hxU0ZESmw0NUg3UzAzd0hYOTFhaGtRTkphTEhDL3RSU045eko0YmQzT1RMYy90WHAreGpudlhGUXV1QnBtSVRZcCtSQjNsZ2xGY3d0Q1pJVGF0Zk9sVjVuS2J1MG5aY1JpUzA3K01xb3UvWGJjcjZhTWNEUVNabWVaQW0vYWhrakFuemc2ZEdpMU9saFBuQTdIWlpkUVlZVGdmbThsMmhZOWcxQkxTd1pWWUVISmwyZHdWczJGd1daT0hOMFBTWmt6b1dodVFZS0JiOWtLZFAzOVpZU1NJcWxBeXdCVmNzSjB1SzY3QXFhSkU1UlZKU1BzRDhLemJDWHFiN3NMZS8vakxyaGZlbzBFWjliRCtVTDVjcjY2WG40VnpmYy9CTTlIREY2Sjk1SmhzTm5nbUg4UlhBc1h3REp1ZE9Kb01tSnE5aG5HaklLRmJxZjNaZUxMS0w3ZFRHbVhBL0tVWW5RSGJWMW8vc1d2MFBsUEVwT1NLSmhyWEtpKzgzWTR2bmFTNm1ReXdpVFIvZHFiYUhud0VmZy8zYVU2YmFYV3JmblJRcFNjTkFNYVEzN0tJUjFrNFAxcjFtTDN3dHNSYW1xaTUrbmJOV21SVGx6QlJlZWordG9yb2JOWityVlRnVitUOURqYTNxbldiclV5VytuZnRiRW9OYk9PQVpPSlRnNnJjWGxaYnBSK01yeHpKenpyUHFibTdFdXNqbFpiZXVwWFVUcnQ2TDROWnVNaTRRaXRmWG1jMkYyNzQ1M215MCtOMnZMNEl2Z2sySVF5cDZzRGdxZUxobmdOcW9MR1g5eVhsbGlCbmhaclArMXJxTGo0QXZwcFptN3BpQlh3c0w3VXhnQlhCOHZvT3BqR2pJQjFkQzBUbnhFdzFkYmtSS3dnZDNLRmoyNFB1aW5ldzVRMHlVMlhKc3FVY2JMUnNyQ2RqTERmQjkveVZXcGh4U2NXbXhSWW92UnI3ZzgreE40NzcwYjNQMTZodEFzbTNza0RiRWdrNklkdnhTbzAzUE5yZURac1NtdXh4dkp5dG04ZXFtNjRHbnBYRFZOZm53ck1XU0hrcDN2bGlKekpGZThSclA4TXZvODNxcDJDWk1oVWt5Qm1vREpJaGxvcmxZajlheEs3YVd0YWVhUE95MVMwNWVFbjRIbDNHYytkaHdVcllrUHdyMWlOcGtjWE1mUGEzRThWQ0JYS1l1ZWNCaWZsbWFUZTNnL1hjakJmUml3cHRTMEdjaWVYZWJ5UFZpR0wzY2x4Vk1NMDAwUVpVM0x5U1F4b3ZmS0Y3c1BqUTllTEw2SCtwNytFOStNTmFZbnRSWVR2K1hidVF0UDkvNjBTa2x3SmxyVUY4ZU1Odi93TlBDcy9TQnZoVFZXVnFLQ0NxTHJxY3ZwWUszcmVmQmROZEIxdFROVjltN2VxQVNvV2NpWTM2dlBDdjNFeklpa0tRY2lWUWdsRGRTV3RKRDVsSW00ZjNHOHVSdXZqVHlQVTNwNVQrNFY4My9hZGFIbm9VYmhYclU2clM1TVJvNlJ6MHhVMDBZL0xzbUZhSFd1M28rTDczMFhGSlhSWFRnZTZGeTlGNjZOUHdFOVN3dzJONnFkSXcySWhaM0lqYnEvYTg0cUYrdnBGOFp0ZWt0N3ozZ3BhVW9TdUlBanY4aFZvZmVwNUJxemRhWWtWeWFSTDQ3dGsvOHhMZ3RzNHhYMXJQMHE3SUtOY2dRUkkrdXFXM3o2Q29BVElOTDVUVHgzcllBcHMvK1ljYUprZCtqWjhndmFubjZONzJvS3c3Tlg1QXdqd3V6Ri80YlIyS25RL0lSSy9ad2JiSHR5MUJ4Mnk2dFhla1RpNEg3SXc0dCt3a1hMS2dOQ09YV2k0Nzdmd2I5L1JqMWloVS9SaitkbG5VY0NmaUdoemMzeHZLeG0wNEhBOXJlcVRqVEJVVlZOWGp0eS8wOHNUaGttS1ovSGJxUC9KenhFUUY1WEczUmdwQ1N1K2ZRRlQ0SXRocUhUeVhKdlFkTzhEOUxYcjlsazROU2gwRGdkSzJRNWRpVTBkS3pSeXN0d1kvNHUwY25yN01vK3lUUC9XSjU1RzQwT1BNZkExcENlMnZBejJNMllyLzFkeDZVVndrQUJaYzBoZHlJbkliTmk4VGUzWWV0WjhpR2dpMFlnRUEvQ1RvTGFuL29BZ3AzVzZoVzY5eVFUSE9kK0VnNW1YMFZYSnFjWEJhbXBHZUcvZjlRKzVoaXpJUnpNc2tSWUN1YmtGdGtwU1hyVmptd244VEpDcHBxdzg5YmNsVGhHeDJIUFBWc0hGT0tKR3BjYjJPYk5WRk5mVGNsS2RoQVJRRHdOaDI1UFB3clBxQTJaeWREZXIxeWxWNGVVc1NhZGpKZlcyei80NkhQUE9oYkd1bXIxajkyajE0aFpnVE1tcStQMW9Udyt6ek9JcGhwd3RWemJ4a3JjODBpSU5xOHBpMldubnZHK2g0cXJMWUdGV0pxdFpraG9iYTZ0UnZlQXF2bmRlM0lMalg5a0hTU3g2M2xtR3BsODlRQ3QrQ3ZVLytqRThzb3VjTXNqcUdtWXpIT2VmZytwYnJvZXB6c1dleFpXTHpBcTl2UlE2ZTBtLzgwdWRCT2htcEgvRlFHNldLNWZQc2llV0RRWnFZTnVYWnNCeHdUbEt5UGRaZVdMSHhTYzZ2M09oV3A3VVV5cWxRcWF2aHo2ejVYZVB3OS9ZbExaS1VVOWliU2NlajRxTExvQ0pxaVZPOTM1SWFpM2JTLzNJSmFLeFVOcmpoVUNPNUJJeXhmSWNZRm5kTHo5L0xpcHZ2QWFtUTBZa2p2YUhzYVlHenNzdlJmbFpweXZCbnc2U2tLU0RTaERvQ21SQjNqaU9TVXdhRlNJdVFjTzI5SWVJeDh4TGkwTkY3dVNxTnZkbFZ5elBNb0s1TjZPejZOMTlrS2xJUHlvUnUzTGh0YkJOUERUcitxaWMyMFEvWEhIbDVaUlBKRGlIUlJ4cGpwN3V4bkgybWFpNmFRR3NVeWZ4R3VtL0p4bGx6SmMrY0dtTDVCSUV1WkhMNjh0V2lDYmh4M29oV3phbUl3NVhDK05HS1pKTEhKZlYvZEtaSnpOaW42M2NRbUprc2tJbEk3VXVsTk0zMjA2WXJuWVVza0dJdFU0L0RzNkx6bE9xUVB4NEprUVpES05NZnZxN0ZQRzI3Sk5hbnkwOGNpSlhacHJPem9CajdMc2FKQ0pmWG1XelpxTGllL09WREpKRmFPZTM1cUw2dXF0Z0hIc0lQNVY3dzJXd3pCTVBnK3VXRzFBdUtvSUVwb1BzSk1zaWQ4MGROOE40cUt3YlorNkdaSDdSSG85YVFreUZiSkJxMGl5VUZ3cTVXVzRpOEdoU3JFa0V1WlIveG1nMWpubm5VQTF3V3JQVGxkZjhBT1pSbzlUdVFMN1FVanBaU0xBTVR1bXNyNnVOeUY3SU1Ja3FLRC96ZEZRdnZBR1djV1BWRm5wV2hDTHg2c1VVdHlBdVRVc1ZJZTRyai9IUEM3bFpybHpkVVE0dEc1THFvYUxVdjVLbjZ3d21PQys1VUcwV0drcExoOVpnZnRkUVY0ZXF5K2NyRlNCN1hRSlJCZGJqajBYWi9QTkpTdnpZUUloS1Vjbk9uWWd4aTB4dWt1eWE2SnhPcFNLS2had3RWMWZoVkx1anlaWWtDTk55L1Z1MkllcjNVYXZTRWlvcGhRcGdDV3ExN2ZBSmNOMTBIY3JubmdVVFo0N1VGYmh1dlJHV1F3L0w3UnAwQ2NIV05yVk1LalVWeVlhaE5SdGhrSzErR3cyaFNNaU5YRUpUWW9WeHpKaCtoUndSVHJmQWpwMnF2S2lmV1E4RkpFOThzT1d3Q2FqOC9ueTRibHlBeWdWWGtOangwR1ZRQmFtUTVvUjNmQXIvMXUxcUxTRVpXcU1KNXJHam9MSGt0cXN3R09STXJ0SEtLWG4wa2NxQ2s0MG13aXpLdDNFekFwczNzek9GWkRjQlBTMllGdWFnWGphVTJoTUhjME9NMWlvWlhtb3hpSTZKakdIQ09GaU9tc1FCSFByZVhTYmtUQzVOVnRWSm1RNC90TytYYUJGUzNkaTkrQjFLbnVJdDMrVUwyY0x4YjkyR25pWEwrbG10SkVTbDA0K0ZmdnpZeElIaUlIZTN3TkhXVkZUQXlraXVwUlJLaHJMZXRldlZGUHlpSU9MeHcvMytLb1JiVy92dW5QQ2xMeXVENWRpcFZCNm0rTUVpSVhmTEpYVFVoQ1duZkFXR2tTT1VsRW1HN09TMlB2Y0NPOU9lT1BJNWdVYXFWdEJXclVUM3EyLzBxMmhYdFJWVUlPWnBVeE5IaW9lOHlKVUFJN1ZaTms0cHFUaE1odXhuOWJ6MURycGVYNXc0OHZsQmlxV2w2dEsvblJJc2NVd2c1aURGMWFYZm5FTlpWMXlyRmVSRnJrQlc3YVdJdzFoWDAwOE55ZjBKVXUwUzJybExaVWFmQjJUTHgvUDJVbmhXclZIMXZNbVFKTWpDb0d5ZU1DRnhwTGpJbTF6Um4rWmpqMEVaMDFOam1iMFB3Wkt4ZWRhc1ErT0RqOEsvUWU1THlMN0pXRWpJWUVhb0RqeHZMVUhMb2o4b2ZaczZ3TVp5T3l4VHA2ak55Z09Cdk1rVk5tVmh1Mnp1TjlRNmJlb0pvcUVRZXBhK2k5YkhuMFNBK3ZKQVFiYUN1bDliak1ZSEhrYWdzU210S0F6SlhVYnZyMEJnNDViRWtlSWl0dzNLRkVnd2syMGJyYzBHNzBmcjQ3ZVVKdDRUeUk1RnFMNFJFVVpxcTJoSnRZM0RVVW4xSTBORjRxS3lhZWw3YjduYWMvTnVrVnFFOUM0cEZvNGczTnlpZGxXc2s0NkFWbVplU21BdUpBWkZya0RjZzY3R0JRT0pDMnhqaGthclNJWllzR1JHN25lWEswNk5vdytCUnBZdEMwaXlyTWdGZCs5Rys1UFBvRVcyNCtuck14SGJDOW1iQy9KemdlMDdZS3F0WlIrcXM2NnFEUVdESmxjZzJZMitza0tjTFVKTWdXV0xQUlhSenM1NFZYY3dCSU5zOHdqQnNqTXdXSXNoZDFJZkllbTJmKzFIYUg3c0tYUzk5QXJDYVc0YnlBU2hQOXpVb25hUUxVeUtaRDJrR0JZODlMdDUrUFVRRzlyNTU3K2liZEd6Q0haM0o5N3BDMGs4ck9QSHFmdDE1ZjR3STMvWDJVdEpOTk5QZGl4cjUzZ055YmhrMFZ2dTVnbXMrNGdaNFJMNDFtK0EvN09HcklYSzJhRGpRTnRuZmdXdXE2K0U0ZEJ4MU1DRnRlQWhrOXNMc1NRcFgrcDg4VzhJVXBKbE9xbVFLR1dZSW9rc2srSXZmVzBsZlRqOUh5MWF0RFQ0VWsvbG9JVktyVVNvcTFQSk85bFNsM28xLzhaTlBKWitFUE9Gem1oQXlZemoxZTFSMW1PbU1NdlBmdzA2RXdwR3JweEdwbHJIbi82Q3R0OC9qeERKem5aaVdSU1haeXJJdldnR3VoWURmWit1dkV4dEVVbUNFbmE3VlYxYW1KWWFaQkNLY01Da2RrSzIyd3ZVNUgwUWdtMlVsN1UvdWhubWlkVEFCWElSQlNOWElLZUs5SGpnb1JScisrT0xxbndvdGNZZ0UvYnRLUFIyTE5FcytUZHR6VmlCSVROSzduNnZ2ZjVhbUNZZHZyK0VhZ2dvS0xtOWtJQVQyRk9QamllZlprcThCSUZPZWZvSFNTNzRsZGdCRG9yNGN5bThDM1gxOU12SzhvR1V3SlljZnh6cTdyZ1Z4bkdqaDZ3aWlrS3VBazhiN25IRHZYWWRnaCt1Ui9kYlMrR25vb2lxQ3BlaFE3cXRwZFlXUDJtZmVRbzB0UzU0L3ZrNmVsNTdFNkVNMitpNVFHdlFvK3pVbVhCZGV5Vk00OGNvL3o5WUZJL2NYdkRza1FpMTVkNEcrRmF0UnMrU2QrQlpzVnBWZGN0MFQxZWxtQWw2cWRiUjZtQVlXUWY3S1NmQmRzSng2bkVzT2tjWnI2TkJzS2taYmRTODdmVDVrVFJscGJsQ0NDNDljWVlpMkNKUEJCbWtEeTQrdVFuRVlsRVZqTUllTnkzNVkzV1RzMi9OV2lZQmV5ZzFLS1VTelpCU1pIbElsYTQzMDJESDVCME5zMEh6K0xFb21UNE5wYWVmcHJidHRSYWJDb3k5RUxrbXNuRDNnb1hNSEQ4ZTBnelIwVVhZcUNKRy92d3VHRnhWaWFQNTRZQ1Jtd3E1YkpoSmh5cnZiR2hTZGIveS9BTjVOQXJOVGowd1NJalRPNTF4TlZGWEc5L2VUOW5EUzRXYzE3c21YZzNwV2JrYTRhRzRDUHBjcVorb3Brd3pUaGlmdDB6NzNNak5DTG9LWmFuN0N2YnluNUp5UDFxUXFiZGtiOTF5djV4VU13NFM2bzdRR1NmQWRmbDhtRGhya21mS1FCaTYzaWcwYUMzeEtDMmtEczdYQ1FIR2NXTlVxWk01ZGM4dlQ2aGRqUS9Xb1AwdmYrOWZCVDhBdm5qa0ZnaGFKZ2JXcVZOUWM5c3RzTXR6RjFKS3NmS0JQUG1rODVVMzBQMlBmMll2QUUvQnZ5eTVBdEd0dG1NbXc3WHdPc3Fycnc2cHMxS3gwL1AyTXJYWWt5ditwY2tWU0JDU2ZUL24vSXRnT2VySXZIeG1NbVJwS05MWXFHcmpjc1cvUExrQ3NXRExsTW1vdmUxbWxNODZWYTJHRFFacTlTMlBWUHlnSUZjZ0JKc25UNExqMG9zWi9hY1BxdU9xYUM5bDF6c2JEaHB5QlZKUWJhTnJxUDdoRDJDVnpDNFBGeUUzSlJvbmpJUFI1VW9jR1JnSEZia0NLZUEyVHprS0krNzRONVNkUGt1VnBRNEVFWVQ2cWtyWTU4eUNMb2RubGZmaW9DTlhJSm1Ya2ZwWEhqUmtuVGFGUVM1NzVtVndPbEIrNWl4WWp6dEdMVTNtaWk5ZWhuWUFvUjVac0hvdDJwOTRSaFdSU0RxZURFbG01Sm05anJsbm9XenVtVENtS2VQS2hvT2FYSUhjdFI3ZTI0RHVkNWZEcytRZGhIYnZVYzl3a0pKK3kvaHg2Z2w1Wmxxc29WVEsrL1BMR0E5NmNnV0tBcWE1Z1paV2hQalNSSVRjY2hncnl0V3RyZHFVYXZwY01VeHVId2dWdmRhWi9QdmdjRkFHdE14SUpuTm94QXFHeVMwaWhza3RJb2JKTFNLR3lTMGloc2t0R29EL0J5SVBuSDlYS1N5Q0FBQUFBRWxGVGtTdVFtQ0M7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9Ijc5IiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjE1NSIgeT0iMzQuODUiIHdpZHRoPSI2Mi4yOSIgaGVpZ2h0PSI2NS4xNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODYiIHZhbHVlPSJEYXRhIFByZXBhcmF0aW9uIGZvciBBcnRpZmljaWFsIEludGVsbGlnZW5jZSBNb2RlbGluZyAtPiBCdWlsZCBhbiBBcnRpZmljaWFsIEludGVsbGlnZW5jZSBtb2RlbCIgc3R5bGU9ImlyLnJlZj1hZDhkYWE5My0zMzEwLTQyNDAtOWZhMi1kOGE0MTAzN2EzNWQ7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMyIgc291cmNlPSI4NCIgdGFyZ2V0PSI3OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhdGEgUHJlcGFyYXRpb24gZm9yIEFydGlmaWNpYWwgSW50ZWxsaWdlbmNlIE1vZGVsaW5nIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREFUQS1QUkVQQVJBVElPTi1GT1ItQUktTU9ERUw7dmVydGljYWxMYWJlbFBvc2l0aW9uPW1pZGRsZTt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtpci5zeW5jaHJvbml6ZWQ9MDtzdHJva2VXaWR0aD0xOyIgaWQ9Ijg0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YWI0ZDEyOWQtZGI5NC00NjE0LThjZjgtZDZiOGM3ZDBiOGFlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1MLUFJLURBVEEtUFJFUEFSQVRJT04tRk9SLUFJLU1PREVMO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjgiIHk9IjUxIiB3aWR0aD0iMzY3IiBoZWlnaHQ9IjExNSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iODMiIHZhbHVlPSIiIHN0eWxlPSJzaGFwZT1pbWFnZTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO2xhYmVsQmFja2dyb3VuZENvbG9yPWRlZmF1bHQ7dmVydGljYWxBbGlnbj10b3A7YXNwZWN0PWZpeGVkO2ltYWdlQXNwZWN0PTA7aW1hZ2U9ZGF0YTppbWFnZS9wbmcsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUZVQUFBQS9DQVlBQUFDUm1vUm1BQUFBQVhOU1IwSUFyczRjNlFBQUFBUm5RVTFCQUFDeGp3djhZUVVBQUFBSmNFaFpjd0FBRmlVQUFCWWxBVWxTSlBBQUFBQmRhVlJZZEZOdWFYQk5aWFJoWkdGMFlRQUFBQUFBZXlKamJHbHdVRzlwYm5SeklqcGJleUo0SWpvd0xDSjVJam93ZlN4N0luZ2lPamcyTENKNUlqb3dmU3g3SW5naU9qZzJMQ0o1SWpvMk0zMHNleUo0SWpvd0xDSjVJam8yTTMxZGZmUmphb1FBQUNDYlNVUkJWSGhlN1hzSGVGM1ZsZlY2VDArOVY2dkxrbnVSRGJaeHdRVUNHQmNNT0FQSlFFS0FTVWlCTUlGUUJ3SVRNZ2xoUWdoSkNQeEpTTUtRQ1NrMFk4QzRVOTE3bFh1UkxjbXlaY3ZxWFhyNjE5cm5QVW0yWmVEL2dlL3psNDl0MzNmUFBYV2ZkZmJaNWR3clR5Y0o1eFNKSFQ5dkllN1J3N1NvMCt2dVZzNHJrQy91UFoyK1FMcVRKWjN3ZXJ6d2QzYkE0MkdaeC9XamZIUXlnM2VQeHhveHFUNVZpV21OaWNEeko2UnpGTlFnQlNjckNvQXFkZ2w0cDZjZGZnSG03MFJMTzRGaXRsM280RThJdkY0UFFsanMwVDliQUsvZ1pKdE9oS2hPRjdGZkE1ZDF0QXIvdEtDS0k1TWt4NXI5QmlVMUtMa2tQd0dwckczQ3IzKzFFUHNPVnBxaytqczhDQS9yeEUwM1RNTGtTUU1RSHVvazFXT1FxcWNnaUV4Ylh3SXgyTGZLUHptb2dkN09KUXBJaTU4WEp5KzVFbmgrcGdSYUo3ZHdwL0paN3FHVXRqZTNZOXYyY3J6endRRzh2YXdVNzY0c3dZcTFoM0drdkpaMUpNRzZYRjkrUDl1cFBYdVRlcUNpc0dlL0Z1TlRBbFIwRG9McTlLSkpaMkNTYlIyZGFHMFRDTzNNNGRhVkJIT3JkaEMwMWhZL210dDhWQWRocGorMTNUdW9ZeHZhUXRETU1nRm14THFpZHQ3YjJ0dFlWLzFwcWRRVkpWWkNHNmo2U2VtYzIvNEdhRUM2eEZodFl5dFdyTnFQYmR0S2NPVVZJNUhmTndrMU5TM1l2ck1jdTNZZHc0bzErN0I2WFRucUdsb0lqcE5pTDBIcW54K1BrWVhabURRK0h5T0daeUl2SjVIQzZzV3FOZnV4WTBlNTlaV2JtNGhRbjdkYng4bzRtbDc5WkhUdWdXcmNVR3dJVGx1N0gvT1diTWVmbmwrSnZmdVBZdnJVRVpneXFSODJieTdCc3RXSFVIYWtGclYxVFd3amlaVHU5QklUNlU0SlppY0JBMUpUWWpDb2Z3cmI1VE1kanhkZlhvc2RlMDdncWl2T3c0MWZIWU9oQTFJUUl1M0FWdDUvVmtNbFBTaUd0TFhYYlRxTUh6d3lCenYzMWhEZ1RzUkcrNUNXRW8yS0UvV29iNVJVcW9Vek51WW1HU0R1THFCZG1SYytTbU5pZkFqaVlpTlJWbDVIdFFBKyt6Qmo2bURjZjlmbHlFeUx0VllocGd6L1NVRnRKMHZyTnBYaXdmOThDZHQzVlhIQzhrTTFZMGxpVVBuNUJXVWdyWVVJSVNpZDZPaGdQaVhPVDBtM09xWm4zUlNkV2xXK1doSlpwcjk1NDJnOGZPOE1SRVJRYlhnNXppZkgxRVk0cDBnN1VDQkVSWVFpSnpzZElUNWZZSjRFMU5TQzI5N2NyQWFjREU1WXFCZHB5V0hva3hLR3JQUUl4RVNId3NjOWJidVpFdXNNa3RxNVBPdUh6M0d4bE42RUtCbzUxK09uUmVmbTlpZExiZTBkS0tMdXUrK2hPZGk4clp3UTBLSG5GaGUzWXBpdVBXSmpPakdxc0E5R24xK0F2UHhzeE1mUi9hS2tIaXV2eHJaZDVkaTBwWVQrYXpYYTJtVHRwUktrZHdXdm40c1dnbGt6QzNIZm5aY2lOeVBleWsybmZncllucU9nYXR0Mm92eDRJMjY1L1JXczJWRE1FbTFQaHA2U01tN3BvUU5UTUh2V0NGdzFjd1N5cytJWlBWRnFPUk5kYmZ4cGFHakYvdjBuOExlWDFtTEJrdDA0ZnJMSjJtcHhOT1hveUJEY2VQMVkzSGZISmFhci9mUU1wQ2crRFRybnRyOFJZL2UyZGc5V3JENkF6VnNPbW9SNTVLejcvYVl6QnhiRTRlN3ZUY1ZOWHgySHZPd0VoQkVRU29jMUZXeUVDUEZSWVRpUHJ0U3QzNWlDYTJhUFFqeU5sTDh6ek9xSW1wcmFzR3psUHBTVVNHZEx0WkErSmZIcUhWUjFiZ1B3SjVnMnB2WGNNNi9ueFo5Z21hZ3IvN1NyMTh6dVM5dFFFNnlwYTBWUlVUSDZGeVJoK09BNERCMFVUK2xNeHBpUm1mamVkeTdGdE1zR0lUNG1vRys5a214M01lUW5HODR6Q0tIRUZ2Uk54TGUvUGdGWFh6R0VaZTNNMXpqMExyaFErdzlXWVRuOTFrQ0d1d2RaTVFvKzlMdyttbnJmL3N4Uk5xTTZDNC9GdUlWeFRIajg3ZndKdGJWMTZsOTVLbE9oTXllS1ZWVGRaaVpkcG54TEJzcFlwTW4zU2dhSURrazZVRlhiZ3BZMjVla2lhTnJpVEdZa2hjTkw0NlMwZW5OK3BzWVV3K1JQcDFaa1FQMm9xZm9zS2EzQlRkLzVIK3JhYW1zVnBLdW05OGV2bjdnZVVhSHNoQkl2S2RPeStxbCszYWxCa0JRZ0tPZHNqSGZUbWFEMmVPcmdkbXZrcklTajJJdWtjZy9sREZycGxMZTJkbkE3ZWVoZ2V4QVJwZzNub2YvWGJvWkNpRVdHZVJrU0FwV1ZEUXd4bVpEZktPQzdCdmdJNWxqTmFraHl0VEFCTnVQaUl1aGpSaEJJV1g4dXEwNmp0QkQ2UjBTOEZzYktCVk1PeDlTZEJlMWs1b21uM3NiVGYxeE4zclZTS3ZGaXlJQlUzSFBQNVVpSkMwZHlVaFFHNUNlYndlcmtQTld2a2JseHVqNGhxSDRDK3Y2SzNWajQ5bTZHaFUwSURRM0J6VGRNcE1VTng1dzNOdUpReVVrRGNQUjVlWmcxb3hEdkx0dHQxcmF1cnBsMUluREZ6SkdvcUtqRDh5OHNRMzE5T3gxd1B5Zm1PZytlY2Y2L2ttQWFPcWdQSHJ4bkd2S3lVczRBVlRzcnhJWndFNWZCbytjYVdCUVAzbDlWalB0LzhBcjJIMjVncVpOSkgxbEpqQTlEZUZnSFZjUXdQSEQzVllnSUY0OEJJQ3gwVmZyamd4cnlDQ21RN2dKVVZGdmZqRHZ2ZnhYekZ1eEEwWTRqT0hLa0FwTXZIRXhBTitDWlA2NWkzbEhzM0hPY2xqTUVtVmxKdVAraEY3Rjg1V0VVN2E3Q2lSTW5rWjJaZ0NWdkYzRmh5aXpjOUhyRGJXSWRmbDRVSmo4djduQkxmNXlybmJ1RkhhRHk1RW5FeGNSaTVQQXMyalB0ajNiZUNSREx2QjVLb0FIZ0ZpMDRIVzBRUVZIZjFNN1l2eGlsNVUzSzVVVmwxTm1PUmhxdDJycDJGTkF0bTNySlFBSk4xUklFVlkwdGtPQmxlTnJQaDlLcGtocEk2WGJzZUEybVh2azA0K1ZJWEgvOVJBeW5KUzNvbTRwYmIvc1RmYjlhM1BpMUN6SHUvQnhrcEVUaEFDM29MZDk5QWVNdUdJQ3ZYVDhHV1FTMG5WTDhYLys5RVBWMXRRd0ZwMkgwbVA0SVpiOGROQWc2UUZac0xyM2F3YnUyc2lUTnNldCt4WllrVE56WUp1YUNTQjdWYnRHU3JhaXVic0cxWHh5RlBxblIxTFh5REh4TzlnaDBVQXBObVpQVXQzNzM3Sy9BQTQrOGlmZFhsaGhXcHIvcEs0UjQyOGlYSDEvOVVpRWUrL0cxMUsvaVI3MnduT0E2MDBrSzNENktOSG8zOVd4a0FQc3g5YktSK05MVjUySDhlUm0yVFFUSWdQNnBtRFYxS0M0YzJ4ZjVCV253aHZnUVJ6MTM2U1g5OFlYSkEraktaQ0VoSVpydFBiVGVxUmcxc2k5U0VpS1F3RHJKU1pGSVlqcVYraXM1TVFwcFNkRzhSeUtGYVQwcmJjOVc3dXFuOGtxek8vTVlBVFUyZCtDcFo5L0RjMzlaaVpyYVZnSXRIZHFUZVZzR2x5UVpLQVN3cFZYK2F6T2YvRnhJU3JpTUdxVlZ1MGUxVzl1NTdFcklpNkJQREMrOUJhWUZyTnNCSDQ5T0JWWEU4Y1dlUWpjZlM2T2pGUEp4elNnSmR0akxVajNyY21zb3FZTTloOUZvK1dqbVRlb0NHMERTNXRYMkpMbFRJTWUzSFF5ZjVlb21ONTVkd1J2NzErbCtaV1VyNXJ5NUNWdXBtcnc2c0dZNzhlT24yU1prZ1hhdUwwbTlycHJxSmxSVnRSSkVIeThGQVd4SG5tSWlHYkpHTXpTT2RJQllmVnNZUGJNUCtjaThBdDE5SkowS3FocXBEL2RrbmRzVzVIOE5ZNXVVbmV2VVhHUU1XSXFrYXJhTnlTZ0xBczBDcExON09WT3l1azZLVkJaWUkwc0hqK3hFUVJCMHVReVhKNmtTZUY1YVppL0JQVnhhajUvOVlqRTJiRDRjV0F5T29mNWtvS3lOV3p3QnBGT3ZEK2pzbHg2dFoxdDFLZUJEN0Zqd04wOWVqeGVmL3hadSs5WWtHaXd0dmdDWDFQcDQ1NXoweGtCVzhHUFMyV3VTc2FBL0xITGcydlE1S0FmUll3QTg2VVpkS2d0aEluakEzTjNjZytNTU9WK2V1d1ZiR01ldlhWK01OK2V2dzlIS0ppeGJ0UmZyTngzR2x1MUg4ZnI4VFRRaXRWaTM4UkNXcjk2SGhzWVd3dUdrMXdCaVA3WVZsU0l5MG9jYnRwYmo3b2RleGU1OXg4a3Z5d04xZzJjSUl0MzJGcC9FYTVUczFyWjJidjFXNDFkaU1teHdQRWFQeU1MSnFnWXNYN1lIei85MURaNTdZUlc5bGxXOHI4U3JiMnhDWlZVai9YU2I0TWNpS2FPelVMZms5Q1JqUmx4MkZicEppQUtZRzJuSzJqYVdKaEFIeTJyeDJDOFc0THByeDV1bFhiVjZHMzZXbTRkWFh0dUlsT1I0NnVRb3ZQbldSdHgvVHh4V3JLUWJWOXVNL0x4a2hNV0V3Q2NYVE4wSlZFcFhhQ2dsU0M1QlNDZ05ZZ2lLZGxYaGhYK3N4VjEzVEVWU0xQMGhWU1l6dHZDVTNvcVRyZmpiMzllaXVMU1J2RW85cUI4dnBkS0Q4d3R6Y2VEZ0NUeit5d1dNc09xNWdJU0VIb0ZVbHA5ajVPVkVJYjkvSnVLcDc5MEVQNW8rUktaNzY4Q2g1Nnp5bWVRa3c1V1pHZ2dvZDJWSGhudVJuUkdOQkRuWkNhSEl5b2hEVkxnSGlZa3hab3ppWTMzSTdCT09tQWd2a3VMRGFhakM3ZVErVlBqWTRraW5DUXJRRThuR3hIRTV5RWtQUTI2R2ovMUcwbFhhaXlXTE42UHlSSTNqZ0Q4S1h2WWVyTWF6enkzRFM2OXZGaWRjWVBiRFJmSlNXZ2YxaThYd0VYbDQrNE05ZHByVjBOS0pKZ1kxTGZUZm1scGJRQStNYmhobm9uRXR0SFR6K1NqNkVFazlFemduS2JyMzNybGFDTmdnck81eWxKMmRoQWZ1dXdvWmZlTHRzR1RLNUh5NlhuRzQvcG94Q0F1blcwTmhIRkdZZ2Z6c05QUkppNkVFZGlBMlBvNWRPSjlURmx1WDN2VVhEa3JEang2NkNzZFBOQkE0NlZIcXdJNTJCaHZWV1BqdUhsdzljd1JpR0tRb3RuL205KzlnNmZ2N1VWWFRiRkxxdUtkUml2Smg4c1QrU0lyejRjQ0JJMXhzUm1yY2huN3F2S1lXSDJycVc2MnVKRmF6T0JPTnMxT3ZraG9FSlNSZ3RZUFUxWEh2bUxLQ3M2YkJZaWRYYmhvS0VzYlF0Y3Btb0pDZkY0OFJ3L3R5NHFIb1IvY3NOeWVKMHBhSUVVTnlFUjhmeVMyWGpINzVhUVNiVzVXRDZwS1prN1VXRStGaEJIWklCaTY2c0I4dW9RdDMyYVFDWER4NUVLSVlGTHo0NmhxczNWaHNmbkxScnFOWThsNHhUbFF5ZlBhSGtqZW5oMldnNUNWVTEvSXBMQkpmKzhxRitPa2pzL0hUSDg3R3ozNzhSY3krZWpRWDJkV1QzK3RtMFN0VXZWS3ZOWU9nbk9yZU9CS3dINzc5WFIyVGFqdmdFSE5NYy9mVTFqYWhzYUdGVnh0ZG13YTBOdnRSUjkzWlVOZUVwcVpXVkRNY2JxTWhhV3hxWnQxR3RMVzJjenZYVytqYjJOQkJjQnJacHQzNmFXaHNzM0ZxV1NadkpKVHhwbHkybzhmcUdPbVZHNmh0cmExb2JtNGxMODdqVVBRa0l5ZHFZait2dmJFT2I4emJoQ2tUQm1EVzlLRzRZdm9RekxoOENQM3NKSVNHQk00SFpQMDVMWW9MbjNxZjkrbjBJZkE3YUU2bE0wSHVqUUlDNWRKeVl2bi94TWxtUFAzc08xaSthaC9lcFE3VHR0eFBBL0hHdkhXWXQyZzd3OW05K01Qejc5Rm9uTVRDcFR2eHl0eU5PRWlML2JzL3ZzZXlmVmk5ZGgrZVpYbng0Wk40L2EzTldNQTZoMmo4L3ZqbkZRVHhwQnRINHhFQnQ3YU9BeGxKQjZSQWNubnVtTkI5YTlYWXlPQkI4VEtyeVd1eGZhWStyS1piRE9mWldMTDdFcDN5eko5QStrTmxPaUI0WGRTbFUwOHZDSkNZdENKZTRrUE0yMGs3MDNLUEZyKzlIZHVLU3JGdFJ6a1dMTjZDc29wbXJGcFhTaGZyQUhic3JtRDVUcFJYMUdMejlpTTBQQWRRY2J5QmVVWFlzZk9JdVV5TGx1NmdKTmJUNVNyR2hpM0ZxS3h1eElJbDIxR21yMUVjWnh6VHlaUTJ1anRyOE5vTHdTUkdnL201eVpSb0o3RTY3YjlpMmxCYzkrV3hwdFBWdXVKNEpmYnNQVWJkTEM5QjBIU0NxaHBsUjJwb3lJNmpycDZ1RlhXOWV5V3Vmbmh4TVpYV21ycDdVT21kUnNHRk9aMVUyWUhWZXczMlp4VlVhbFBrangxNE1DTTZPaHlYWHpvVVF3Zm5ZUGpRTEV5OXRCQ1pxWkc0WUV3ZVJwMlhpOEVEMDNIcEY0YWFrZEtKL1lTeEJZenJvM0NaMnRBd0RSclFCMU8vTUJoOVVtSXdkblF1Um8xSVF5SkQ0V21YRGtGR2VvejV6QnBOeDVFNnU5VmR4aTgxMlVlOW00Y2ZQakFMai94Z09pYU96U1RBUHR6OGxiRjB3YWFoSUMvUitCTnQzRktDQjM4MEYzOTVjVDM5V1RlTEV5Y2I4Tk1ubHBvN1dIcEVid2tFcW1hbitVbG9tQmFZUFp6NlhxMi9LM2E2cHlkWkI3b0hPajBiYWZ1N0dnb0d0S0pBRXYyODI3NDVGUkUwUGdxQkoweklwNkdLUkU1V0RQVGxpSXppaEF0b3ZLTERrSldkek9IOWRMbEM4ZDF2WHVyYXNLL3pSK1p5Y1NLUWtSYXJjM0pFMHYzNjVyOWRoTWlZQ0Z0SU42SThCRW9yeHgwOE1CVVAzanNEZ3dabElDOHIza3JEUTZlZ3FPZ2dycng2QWwyeXVNQStJdkUyb3JBdkNndVBZTVhhNWVUWngyM2ZZYWRqaDB1T2NrRUxrSm1lU01sU0M0YnRob0VEOVFTREdPbjluTndVaHVvZnNmMkQwSnhPWjVOVUxia2JqSGRXOFhEbTJnNENWbEtUbUJDQjZLaHdSRWVHMmtGelpLaUgyekNDVnpqamJwY1hScTdpb2tJUlI1Y29sRlplZWRGUllieDhkaUFUempZeDlIVmptQ2NMTGI4M092QmxuL2lWYjJ3blN4eHd5T0Fzeko0NUZNUDZwU0E2SXBTWER4ZFBISUJ2ZmVNeTVOR2Q4OWxyR0tJV2FKT2VHb2Z2M25veFpsdzJpRHpUUTJDb0doa1JaaThJYjducFFzVEdSZ1lreHRXWFYxSldYbytuZnY4KzNseTRsWExnUXZpemIzKzVIMmRnR2dUekxHQXpYOTVrc0phaUdURW1hcWh2eGlicXdVUGxWU2d1cWFTMEhFRnRmWnQ5em5PNHRCSkh5bXV3YldjSjlWWXpEdkg1d0NHbnc3WVVIVVpKR2N1UDFtTHI5c1BtSWV4aG0wTTBXTlYxTGRUUFIxaXZoU003NWFSdEwvYTBxSHJOWW9jNVlzaXRNbldxMTNhQVR3SmdCZlFhdUdIdFJRcnpVaGlSWFRON0RMSXpvd2hzQjhhTnpjWFhiNWpJd0NSZXZYZDFKWEJyYTlzdzk2M3RlSDNlTmpTM3RBWHdvdnJSN1hTeXNsNXdzNzVjOHF6a0JtUXQ5NTlieUxrbSt3L1g0SUZIM3NCYjg3ZGp6aHRiOE9qUDUyUHZvUnI4OWsvTE1KZlBpOS9laGY5K1lqNzIwQ040WmU0Vy9QWEZEZGgzb0JxUFBqNFBieXpZamlYdjdzSlBmcjZRdm1jRmZ2dUg5L0RTbkRYWXMrczRmdkw0QXRZN3BrRnRIQUZsZ09tUnZFaHRtTytzdEpTdEZRVHFxcDVDNEVEYXZZZHJ4OFR4K2JqcCtqSFUzZW00NWVhSjlLTzU3VFV4MWZkU3Nqay9uWGk5OHZvV095UEk2Qk9EQzBiMWg4K255WE9ST2hSRDkwcCtWanBWNVFiNDdQcnRqVlJpTE50UHQxN3VvUDlaemFpbXFia045ZlJMYTJycTdMMlJKRk0rcXM0NXEvV2lyN1VUelUyTmZHNUNDNVcvL05sNityV05MWDdVMXRCUFpSaFp6N0lhK3EzK3poYjZ1VFYyOEMzU1RwRTBtZlBFTE1sZzhBTUp1VVdPNitBc0Foa1dmZ29ueXJwNVVGUTlWRW0zM0RRSnYvdkZsM0h4aER5cW1VQkxyb3dmb1dpanFYOXI4UTc4NW5mdnNTd0UzLy9lTkV4aWRCYWl6NGJZdjIvRmloV1lOR21TMnlhbmtGNldPU2tMa3ZnVHVZKy96cVNBUytvcXNqdjYzOHdMNDkyRHZybEplT1MreTVEVE53Zk5IYTBZUHpvYi9YT2pjZU5YSmpEdUQ2VXVqY0NBZ21RTXlJdEQ1TFRoREFJODZKY2JqM3YvZlNiU001TlpIa0k5R0kwaGc1THRYVmwwWkNUU3NoSnc1KzFYSXBQUmw0YlUySUxWUzRDQ3ZKcUlFbUhuZ3dZcWRaRzJ2SFNxdm52Vk1SOXdzS3pPb3FqY2pEaEdmNmxPZW50TVZ5Z1ZsOVpRUWxlZ3Fyb0YzN2h4TkM0YzM1ZTZua1pMcjJBNWpuZlZ5cFVvS3l0ekxUNkNnbFpmNFY1dkpLa3dRNlZKa1JHei9JR3lwTVJJekxwaU5BcUhwek5jemNHTTZlY2pKVEVXVXlZT3hIbUYrUmcyS0JNekx5OUVha29zemo4L0gyUHBDYVF3UFdONkljc3o3SVhmekJramtaNmV3UEIwa0xsaFdUUXNpb0RTa3lKTmlzaVpnU25CRmJqNmIyUmx6TFR0cll2TVVWOXFQdjRPblVaNXVVUGE4TDh2cjhmWGJua09ELzl3TG5idVBtR0hLNEdYWXpZUHZXdGJ2ZjR3SHZqUDEzQzQ3Q1MrT0dzdzh1aVN2VWIxdFdFTG96aDZMQnJUZTgrOTl5SW5KMGREbjBFK256TXlINWRrZVowcWR5UUpEYUZPTlNuaVFpaDA3TlNNeWFzK2pkU2twSDJVcFMrY05RZkpncUpKYldrclo3NG1KQytpUTE5VE03L2R5aHcrN1l5R3RHM2RNcXNtS1NpMlo1RDZVbHNadEc3QjBDdjA1V3NPNFVlUExjV3V2VFY0Wi9sQlBQYkVQQVlxNVRZZmRkWEIzYWtQalo5OCtsMnNXbjBRczdpYnJ2dlNlQ3hsY1BJd2JjVWlCaUVkZWhVdlVLVVRUaWVEcFd2LzlLRGU4bnFRVFZSVitDT2UzWUdNQy9OcTYxczU4RzRVN1M2amxUK0t4WXVMVUhhMEhtdlhIY1NHVGNYTVA0WWw3K3pDVVZyNURWdExzWHJOUVJ3OVVZZEYxRjFGdThxd2UvOHhMSDVuTTQ0eHlscS9zUVFiTjVlZ3NySWVTOTh0UXNrUmhxa2MzQ1NQUElRS2h0NVlsUW9nWTFJREVsNERpdzIyN1NqRm4vKzZITFZWMWZSRm96QmlXRGFXRTdqL2VlRURIR1YwcGZyMURhMllPMjh6Tm0wK1NDRk13YjllT3g1WmZlTGtUaE40WWVqQXQrMnYrK25rQ3ZXZVhxTGZnNnlBTjZGM0Znck94ZFVJR2tHUGZTRDJ4RlB6c1lTaDZJSkZXL0hvTDk2aVZKekEzMTlaaVpkZTI0aDMzdHVKWHorOUNEdjNWbURlZ2kzNDg5OVgwS3BYNGZHbkZtRGhrbDE0YjhVQi9QSTM3OXFCOGo5ZVhZTzU4emZqSUhYYnI1NTVHenZvQmNnTmx3WFhBcmFkaFQycEJFbHFCMFU4QkswMnY4WHY3TVJkUDNnZFM5OC9pS3RuRGNOdm43d1dqejQ4a3hGZHJvWEZ2L3pkK3d5UksvSFh2NjNGaTY5dVFGNU9ISDd5MEV4Y01ESWJvYUVPUHAwamlOeHlCWGZOV2Voc2dpbm1lNk11UTJYc2R3T3NWQmd0YUdxS2wxRlVHR0laU1NVblI5c1hMN0d4VVVpSUFhSVlBQ1F3Nm9wUUhzc1RFNkxNMFU5TmlXWVVGUXI1M2FuSllmWlJSM3hjR0JKaTI4em5USWlQZFI4L0JFWVN1YW1kU2JMZGVqc3FhbTd4WXVXNlEzajBDWUZXUXozZkI0OCs4aThZUDQ1UjFkQjAvTWZkczNEUnBBR1k4L3BHM0hyUFhEcjR5MDNmZi9mMmFaZ3d2b0RJQldab0xwbDhlczZjYUFxYlhzTlVSNzB4RmhTQjNrWEIzSmVBRk92VzgyZ2hPVGtLZDMvL2kwaExUakFHUnArZmhmNERVcENVTUlIVzFrdnJIa3JqazROK09jbU0rZVBzRTZLTWpIamNjOGRNcEtiR0lJUUFEeDZZZ1lMOEZIejUyZ3VoTDB2NmNKTDMzREVWZmZNU2JHeW5BalF4OFhBbWp5YXB6RzZpZTdkeDNXRTg4K3g3MkY5Y2djTEJ5YlRpazhsYmxPbHIrY0oxdFkzNDF5OU5zbSt3dGhZZFlNVG53K3dyeGlFckpSNGJOcFlpS1ltUkh2UGNnWXBnN01hclYwbDF4V0xxVEdERlZPK0Fpd0p0ZUZNTmJUWU5LUE1WVFpkbzdQa0Y1bG9WNUNWemUvVkhDcVZ4Q0lFYTNMOFBDcGd2cnlDUlhrSy9naFFNRzV5T3BQaElPdUI1ZHJxVW01R0UwYVB5ellzWU5pZ1ZBd3RTS2JFUkdEc3FseEtVWUtPWlY5TEZXdSs4K3duQ3BrMGwrSTlINW1MRm1tSk1IcCtKaHgrNEVwT25EREQ5Mk5uWmhwODlPUjkzUGZBQ090c2FjZDlkMHpGcGZCNnV1M1lVcnJsNkZGWENWbnpuemhmeGYzNy9EazVXTlpuN0ZYd1hGNlJlUVRYY3lOU3B2cXUwa1JoMUJpR1F4Y3RKaUQwR3NsVXRhQWlNbE9CMjZWQWVLMWt6L2VzNWJ6VzJNdjdqeEx2YnVwVDFwM0pkTm5uTDVuSXhyYnYxRmVUUXBVK2xnRkpnZzJQSDZsQnh2QWJqeHVUaTlsc3ZzN09GVitkc3BMNnVJQ0JlMU5hMW9vWWhhQWY5Nlluajh2SFEvVFB3N2E5UFFXSlNsSDNjVnNNZ3BhR3AzZmkwbmkyQTZCNnZWMUFkdVFsMFVRQUE1WmhPUGEzSVBmTFgycmpURytrd1NhdHFWQnl2d3o5ZVhtT3ZvMWV0MjAvZmJqMHRlVDBXMFNXUjc3ZHBleW5tek51Q0l4VzFwdXVXcmRpTjhtTTFlR251UnZzcmxXMHNmL1gxRFNncHE4VkNlZ2tyNlRXVUhhMWtxTGpaemxoN3pJbVRFa2NCaGdNVVhFd1BGMWZ2cnk2YWxJYzdicnNFNXczUHRnL3JudnJ0RW16ZGRjTFVpS1puclQwK25LU0hjZnhFTTBwTHE5SGMzRUlnWGFIS05WVmRwdlo2MElkcy8rNktUa1Z4c0M3R2UzaWpTb2dSdXprSVdabFJqZEkrNXJtdGNhaWtDbzg5UGgrTEdNUFBuYmNUdjN4Nk1Zb1orLy92MzFaaTRlTDF0UDY3OGV0bmxxRDRjRFVXTHRxQWwrZHV3c0hpYXZ5SzlSWXRMYUwxMzAvci96YjI3RHVPUDcvd1B1YSt0Umw3OXJMOE53dlp6MG1xR1Mwa09lUFBxY0xnMHM2NGNxRzVYWWNPN1lNN2I1dU9JZjBaaWJGZE0wUG5xcXBtK3M3aVZTcEV3T3JZMGtzVmNRQzNmdTh2K09HamMxREJSZGJSbjV0bGNBeDkwc2ttM1lqMERxcXI3amY5SXdwdTArNW1RZkNZbzRUMm8yNmNqRE5Xcm1ad2Nqby9qWXdNUS85K2ZkQW5PUTVaR1RFME9CbDJuSmVibllUVXRHU3pyUDBLMHV5dlVsTFRVcENWbVlSSWJzdjgvRDVJUzR0SFNsSTArdVVuMjdGaFhtNktuYWxHUjZ2UGRETWltcFQ5TTcycThkM1laNUlYK251QUYxOVppMmYrc054Q3poQlp2ZURrMk16VUMvL3BGWGM3blM5OVZxcGdwYXVDUUxmK0EzYyt1MzNnNkVPMlAwY3g1a2lzTDRDYzNtSUgxbDdxd1cxenEyc1U2TnlpRlVwRlFFcWx5UE56RXZGZkQ4M0d6R2xEN1E4Zzd2bitWT1RtSmVHV202Zmd5cG1GbUhySllMUGsvV25kWjg4cXhIWFhqRUpCUVRJZXZIczZvNWRodUdUS1lMbzVNekI0U0RxK2NmUEY5aDMva0lISnVQZk82UmlRbjlURnFpZ29CTjNUZEJTQTNWNE82anVzMTZodWpsZldtVzRNbWcvbk9TamljczhtR01HWGw5cDlscSs1c1NmVHBXcklBWHNNZGlxb1lvYVg0MG1uOFpad1JJRDBtbGlsUVNCbDFVWHUwMGhMQnNwY0gyNGRLUVZrSmpiV2gvT0daU0VyUFI1NTJZbTA3bG1JbzRUMXowOUZibGFTdlJJWk5qakRQaXJPeTBxa3hVOUJQSDNhNGZRWnM5TGprSjRXZytGRHNwQklIM1VBZ2MvTFNVSnNYRFFLaDJRaU1qYkNkb1BHbGxUWnQxUWNQN2prUVJMWUJqaUJVeHl2dXRwWkRDdGRCWkl6ZFU0WXFBQlkxY01nUWVWdVJ1N3N5NmtaUDZWTU9UYlRIcXQ2S3FqaWdKZmR1QW82WmRJSHNhMksyVTJQcXJFcThGbitoNUdiZ0ZaYmYrbnNzalVaVGRLTDZ1cDYrNFRIL2l4Y3VUWTIreUd6U2tvU3JFdEt0NU1DdFhhWCsrbG0xc29EZFJ4Q3l0TVBZV0RjWFZsWlMzNEpDQjN5Z0NydHFoNGs4U0JPYkFsc1I3aytnb2RFVnAvUDh1MzFWWXBHMS9lcm9DSndwUTRKa1Y3WnVLOEJuYmdGcVZmblgwM2tXa2dDNXk4NWlOek1aSXhreEpHYWtjZ3lEM2J0T1lHM0Z1ekNsTWw5R2VWRWlRZFVWclV3ZHQrSGdyNHAxSk9KYUdwdXRlTzZsZXRLOGVPZkw4WGxsd3hrVk9YZVdqcVd1aitBMDBlL1FkTEJpVWlUY3FSRWtPVmdwcDdkd29uVTVqaXQ5TjlmMllJcWJtZjl0Vit3bWZNRVZOOUV3bDRLMm9tV3gzMWNvVlVPL2lsUmtQUXFSbXhRUkd3TUxZTUQzVDNwTXVLaW1KQUViSW9qOTdsR3J4UVc1ckV0dDIxWEtaNTgrcGlCZGV2dFZ5Q0RBSzlZVTRyblh2Z0FDNWR1d2hjdUdvQXhZd2JTZ0hpd2ZzTmUrelE5TnlzZS96SjdqTDBGM2J6NU1ONy9ZQWZXcmQ5bFcwMEhHR0lrK0RXMVNKTTFpUXVRZVJGZDRMcDZhbU5iVE5tYUNDbG9TTldYVHJVYW03eElvVkdUNnBDT2RPcVJQOUx0a2tyYis3eFpQcTAyMi9mQThoUnlUWFhLMXZQOGc1elNlN0JkYWtPN3hucGpMR0NGclhnOUExUzNGZlJDTGdyZnZtVUszbDEyMFA0TU1UemNpOWd3UDI3NDZrU0wzM1ZBcTc0VmV3OWtCSFRIYlZPeGUrOHhDeTlqb2lPUm5ocUZHNjY3d0l4SVE2UE9Mams0NStUK0lEZGd3R2dBN09NemZRdkZSMjFMQWViT1JnTjhrMU45aXlyZ3BRTTdaVFE2OWRvN0lQVTZKN1Q0bXdEUUNLVFJLeGczVHJFNXN3UzZCalhxbHV3WWVoRDV1WEhzTjhUT0hGS1RZMUE0TEJOSmpOQWs1UDJvcy9WOVFIeGNKTUlwTEJjeW90THI4aWg2R3hucENSaFJtSTYrZlpNUUV4dUtZVVBTN0dDbWIzYTg4U255RUVTWE9vMHNwdVZsZXRMWTBkL1ArK0NqQ0xSUWYra3ZuZldQQWcxZm1JOWdkZGlmQW1tcmlERWRvTWpQVTQ1TmgwRHFVTXhQQ2RIZlhRVW5hTkJwcnh0Qzd0R29SM0ZYT2tqTTAwdEZad1RaRThleEhwV20xRWgrZEt5aDhVeU5jR3g5bkdZejVVOXpjenVPbld3eVh0SVp3M3U1MEpXTmJVaU1EMmM0SFlwak5Td2pVUEhSRWRvR2FLQXFrOWVsRjRacVc5dlNpWmhRWGx5UStoYk9pM1gxRmpnOFhINDVoenNicUovVC96OXBrM3hPbnpKOUR1cG5RSitEK2huUTU2QitCdlE1cUo4QmZRN3FaMENmZy9xcEUvQi9BV2tNWWJlbjdocDdBQUFBQUVsRlRrU3VRbUNDO2ZvbnRTaXplPTE0OyIgcGFyZW50PSI4NCIgdmVydGV4PSIxIj48bXhHZW9tZXRyeSB4PSIxNDIuMzQiIHk9IjM1Ljk0IiB3aWR0aD0iODIuMzEiIGhlaWdodD0iNjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgyIiB2YWx1ZT0iJmx0O2ZvbnQgc3R5bGU9JnF1b3Q7Zm9udC1zaXplOiAxNHB4OyZxdW90Oz5EYXRhIGNvbGxlY3Rpb24sIHByZS1wcm9jZXNzaW5nLCBhbmQgcHJlcGFyYXRpb24gZm9yIGxlYXJuaW5nJmx0Oy9mb250PiIgc3R5bGU9InRleHQ7aHRtbD0xO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTtyZXNpemFibGU9MDtwb2ludHM9W107YXV0b3NpemU9MTtzdHJva2VDb2xvcj1ub25lO2ZpbGxDb2xvcj1ub25lO2ZvbnRDb2xvcj0jMDA3RkZGO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiPjxteEdlb21ldHJ5IHg9IjU2IiB5PSIyMSIgd2lkdGg9IjM2OSIgaGVpZ2h0PSIyOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODAiIHZhbHVlPSImbHQ7Zm9udCBzdHlsZT0mcXVvdDtmb250LXNpemU6IDE0cHg7JnF1b3Q7Pk1vZGVsIGNyZWF0aW9uICZhbXA7YW1wOyBvcHRpbWl6YXRpb24mbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSMwMDdGRkY7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjMiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNDc2Ljk5ODYyMDY4OTY1NTEiIHk9IjI1IiB3aWR0aD0iMTkzIiBoZWlnaHQ9IjI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEZXBsb3ltZW50IFNldHVwIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREVQTE9ZTUVOVC1TRVRVUDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249bWlkZGxlO3ZlcnRpY2FsQWxpZ249bWlkZGxlO2lyLnN5bmNocm9uaXplZD0wO3N0cm9rZVdpZHRoPTE7IiBpZD0iODciPjxteENlbGwgc3R5bGU9ImlyLnJlZj0yMWQwZGU0Yi05N2ZjLTQ0NDYtYjBkYy1mMDdiZTJlNWQ5MDM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUwtQUktREVQTE9ZTUVOVC1TRVRVUDt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2NvbnRhaW5lcj0xO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7cmVjdXJzaXZlUmVzaXplPTA7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY5IiB5PSIxOTkiIHdpZHRoPSI2OTAiIGhlaWdodD0iMTQ2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI5MyIgdmFsdWU9IlRyYWRlIFNlcnZpY2UgLT4gVXNlcnMgSW5wdXQiIHN0eWxlPSJpci5yZWY9MTQxNjZjZmEtMDYxMC00YzAzLTg1Y2UtMTkxNmZiODg5NzYxO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjE5IiB0YXJnZXQ9Ijg4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTkiIHZhbHVlPSJUcmFkZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWZiZTVhOGRkLWE4NDUtNGYyNC04YzY1LTQwNTdhZjcyOGQxYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTQ7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLXNlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWm1sc2JDMXlkV3hsUFNKbGRtVnViMlJrSWlCamJHbHdMWEoxYkdVOUltVjJaVzV2WkdRaUlHUTlJazB3TGpNMk5UZzFNeUF3TGpJNU9EYzRNME13TGpNMk5UZzFNeUF3TGpJNE1qa3dOU0F3TGpNM09EY3lOU0F3TGpJM01EQXpNeUF3TGpNNU5EWXdNeUF3TGpJM01EQXpNMGd3TGpZd05UUXpOa013TGpZeU1UTXhOQ0F3TGpJM01EQXpNeUF3TGpZek5ERTROaUF3TGpJNE1qa3dOU0F3TGpZek5ERTROaUF3TGpJNU9EYzRNME13TGpZek5ERTROaUF3TGpNeE5EWTJNU0F3TGpZeU1UTXhOQ0F3TGpNeU56VXpNeUF3TGpZd05UUXpOaUF3TGpNeU56VXpNMGd3TGpNNU5EWXdNME13TGpNM09EY3lOU0F3TGpNeU56VXpNeUF3TGpNMk5UZzFNeUF3TGpNeE5EWTJNU0F3TGpNMk5UZzFNeUF3TGpJNU9EYzRNMXBOTUM0ek9UUTJNRE1nTUM0Mk9URTNRekF1TXpjNE56STFJREF1TmpreE55QXdMak0yTlRnMU15QXdMamN3TkRVM01pQXdMak0yTlRnMU15QXdMamN5TURRMVF6QXVNelkxT0RVeklEQXVOek0yTXpJNElEQXVNemM0TnpJMUlEQXVOelE1TWlBd0xqTTVORFl3TXlBd0xqYzBPVEpJTUM0MU16ZzVNVE5ETUM0MU5ETXlOeklnTUM0M01qZ3pNVE1nTUM0MU5URTFOemtnTUM0M01EZzROelFnTUM0MU5qTXdNVFVnTUM0Mk9URTNTREF1TXprME5qQXpXazB3TGpZM01qVXlJREF1TmpJd016VXhWakF1TWpNeE5qazVRekF1TmpjeU5USWdNQzR4T1RrNU5ETWdNQzQyTkRZM056WWdNQzR4TnpReE9Ua2dNQzQyTVRVd01pQXdMakUzTkRFNU9VZ3dMak00TlRBeE9VTXdMak0xTXpJMk15QXdMakUzTkRFNU9TQXdMak15TnpVeE9TQXdMakU1T1RrME15QXdMak15TnpVeE9TQXdMakl6TVRZNU9WWXdMamMyT0RNMk4wTXdMak15TnpVeE9TQXdMamd3TURFeU15QXdMak0xTXpJMk15QXdMamd5TlRnMk55QXdMak00TlRBeE9TQXdMamd5TlRnMk4wZ3dMalUwTVRBeE9FTXdMalUwTmpZMk9DQXdMamcwTnpBd05DQXdMalUxTmpRd09TQXdMamcyTmpRM01TQXdMalUyT1RNek9DQXdMamc0TXpNMk4wZ3dMak00TlRBeE9VTXdMak15TVRVd055QXdMamc0TXpNMk55QXdMakkzTURBeUlEQXVPRE14T0RjNUlEQXVNamN3TURJZ01DNDNOamd6TmpkV01DNHlNekUyT1RsRE1DNHlOekF3TWlBd0xqRTJPREU0TnlBd0xqTXlNVFV3TnlBd0xqRXhOalk1T1NBd0xqTTROVEF4T1NBd0xqRXhOalk1T1Vnd0xqWXhOVEF5UXpBdU5qYzROVE16SURBdU1URTJOams1SURBdU56TXdNRElnTUM0eE5qZ3hPRGNnTUM0M016QXdNaUF3TGpJek1UWTVPVll3TGpZeU1EWXdNVU13TGpjeU1EUTFPU0F3TGpZeE9EZzNPU0F3TGpjeE1EWXhNaUF3TGpZeE56azRJREF1TnpBd05UVTJJREF1TmpFM09UaERNQzQyT1RBNU9Ua2dNQzQyTVRjNU9DQXdMalk0TVRZek1pQXdMall4T0RjNU1pQXdMalkzTWpVeUlEQXVOakl3TXpVeFdrMHdMak0yTlRnMU15QXdMall3TlRRMVF6QXVNelkxT0RVeklEQXVOVGc1TlRjeElEQXVNemM0TnpJMUlEQXVOVGMyTnlBd0xqTTVORFl3TXlBd0xqVTNOamRJTUM0Mk1EVTBNelpETUM0Mk1qRXpNVFFnTUM0MU56WTNJREF1TmpNME1UZzJJREF1TlRnNU5UY3hJREF1TmpNME1UZzJJREF1TmpBMU5EVkRNQzQyTXpReE9EWWdNQzQyTWpFek1qZ2dNQzQyTWpFek1UUWdNQzQyTXpReUlEQXVOakExTkRNMklEQXVOak0wTWtnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqWXpORElnTUM0ek5qVTROVE1nTUM0Mk1qRXpNamdnTUM0ek5qVTROVE1nTUM0Mk1EVTBOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk1qYzFOU0F3TGpjMU1USTVPVU13TGpVMk1EUXpOaUF3TGpjMk1UWTNPU0F3TGpVMU9USXdOU0F3TGpjM01qSTNNaUF3TGpVMU9UQTRNaUF3TGpjNE1qa3dOa013TGpVMU9USXdPQ0F3TGpjNU16Z3dOU0F3TGpVMk1EUXpPQ0F3TGpnd05EUXdPU0F3TGpVMk1qYzFOQ0F3TGpneE5EZ3dNVU13TGpVMk16YzJOQ0F3TGpneE9UTXpOU0F3TGpVMk56VTFJREF1T0RJeU56STNJREF1TlRjeU1UYzJJREF1T0RJek1qUXlUREF1TlRrME16STBJREF1T0RJMU56QTJRekF1TmpBd05qWXlJREF1T0RJMk5ERTBJREF1TmpBMk1qa3lJREF1T0RNd01EZ3pJREF1TmpBNU5EazFJREF1T0RNMU5Ua3pRekF1TmpFeU56TTBJREF1T0RReE1USTNJREF1TmpFek1USXlJREF1T0RRM09ETTVJREF1TmpFd05UVTFJREF1T0RVek5qYzNUREF1TmpBeE5qSTFJREF1T0Rjek9UWTJRekF1TlRrNU56WTNJREF1T0RjNE1UZzNJREF1TmpBd056Z2dNQzQ0T0RNeE1UZ2dNQzQyTURReE5URWdNQzQ0T0RZeU5qbERNQzQyTVRrNE5EUWdNQzQ1TURBNU16UWdNQzQyTXpnMk5qWWdNQzQ1TVRFNE5UWWdNQzQyTlRreE9Ua2dNQzQ1TVRneU1UTkRNQzQyTmpNMk1qa2dNQzQ1TVRrMU9EUWdNQzQyTmpnME5EUWdNQzQ1TVRnd01EUWdNQzQyTnpFeE9UTWdNQzQ1TVRReU56Vk1NQzQyT0RRME5qZ2dNQzQ0T1RZeU56SkRNQzQyT0RneU5TQXdMamc1TVRFek5DQXdMalk1TkRJME9TQXdMamc0T0RFd05DQXdMamN3TURZeU9DQXdMamc0T0RFd05FTXdMamN3TnpBd055QXdMamc0T0RFd05DQXdMamN4TXpBd05pQXdMamc1TVRFek5DQXdMamN4TmpjNE15QXdMamc1TmpJMk5Vd3dMamN6TURBNElEQXVPVEUwTWpjNVF6QXVOek15T0RJNUlEQXVPVEU0TURBeklEQXVOek0zTmpNM0lEQXVPVEU1TlRneUlEQXVOelF5TURZMElEQXVPVEU0TWpFMVF6QXVOell5TmpFMklEQXVPVEV4T0RZNUlEQXVOemd4TkRVNElEQXVPVEF3T1RVeklEQXVOemszTVRjeUlEQXVPRGcyTWpnNFF6QXVPREF3TlRRMUlEQXVPRGd6TVRReElEQXVPREF4TlRZeElEQXVPRGM0TWpFeUlEQXVOems1TnpBNElEQXVPRGN6T1RsTU1DNDNPVEEzTmpJZ01DNDROVE0yTVVNd0xqYzRPREl5SURBdU9EUTNPQ0F3TGpjNE9EVTVNeUF3TGpnME1URXhOeUF3TGpjNU1UYzNNaUF3TGpnek5UWXhNa013TGpjNU5EazFNaUF3TGpnek1ERXdPQ0F3TGpnd01EVTJJREF1T0RJMk5ETTJJREF1T0RBMk9EZzFJREF1T0RJMU56RTRUREF1T0RJNU1ERTBJREF1T0RJek1qY3lRekF1T0RNek5UZzBJREF1T0RJeU56WTJJREF1T0RNM016UTBJREF1T0RFNU5EVXhJREF1T0RNNE5EQTRJREF1T0RFME9UZzJRekF1T0RRek5ERXhJREF1TnprMElEQXVPRFF6TkRFeElEQXVOemN5TVRNMklEQXVPRE00TkRBNElEQXVOelV4TVRWRE1DNDRNemN6TkRRZ01DNDNORFkyT0RVZ01DNDRNek0xT0RRZ01DNDNORE16TmprZ01DNDRNamt3TVRRZ01DNDNOREk0TmpSTU1DNDRNRFk0TlRJZ01DNDNOREEwTVRWRE1DNDRNREExTVRVZ01DNDNNemszTVRVZ01DNDNPVFE0T1NBd0xqY3pOakEwT0NBd0xqYzVNVGNnTUM0M016QTFNemxETUM0M09EZzFNU0F3TGpjeU5UQXpNU0F3TGpjNE9ERXpOU0F3TGpjeE9ETXpOaUF3TGpjNU1EWTVNU0F3TGpjeE1qVXdOMHd3TGpjNU9UWXpOaUF3TGpZNU1qRXpNVU13TGpnd01UUTRPQ0F3TGpZNE56a3hNU0F3TGpnd01EUTNNeUF3TGpZNE1qazRNeUF3TGpjNU56RXdNaUF3TGpZM09UZ3pOVU13TGpjNE1UUXdOaUF3TGpZMk5URTNPU0F3TGpjMk1qVTROaUF3TGpZMU5ESTJNeUF3TGpjME1qQTFOeUF3TGpZME56a3dPVU13TGpjek56WXlPQ0F3TGpZME5qVXpPQ0F3TGpjek1qZ3hOaUF3TGpZME9ERXhOeUF3TGpjek1EQTJOaUF3TGpZMU1UZzBNa3d3TGpjeE5qYzNOeUF3TGpZMk9UZzBOVU13TGpjeE1qazVNaUF3TGpZM05EazROeUF3TGpjd05qazVNeUF3TGpZM09EQXhPQ0F3TGpjd01EWXhNeUF3TGpZM09EQXhPRU13TGpZNU5ESXpOQ0F3TGpZM09EQXhPQ0F3TGpZNE9ESXpOU0F3TGpZM05EazROeUF3TGpZNE5EUTFPQ0F3TGpZMk9UZzFOa3d3TGpZM01URTNOQ0F3TGpZMU1UZzJPVU13TGpZMk9EUXlNeUF3TGpZME9ERTBOU0F3TGpZMk16WXhNaUF3TGpZME5qVTJOeUF3TGpZMU9URTROQ0F3TGpZME56a3pPRU13TGpZek9EWTFNU0F3TGpZMU5ESTVOU0F3TGpZeE9UZ3pJREF1TmpZMU1qRTNJREF1TmpBME1UTTNJREF1TmpjNU9EZ3lRekF1TmpBd056WTFJREF1Tmpnek1ETXlJREF1TlRrNU56VXlJREF1TmpnM09UWTBJREF1TmpBeE5qRWdNQzQyT1RJeE9EUk1NQzQyTVRBMU5ESWdNQzQzTVRJME56ZERNQzQyTVRFMk5qZ2dNQzQzTVRVd01UY2dNQzQyTVRJeU5ERWdNQzQzTVRjM016VWdNQzQyTVRJeU16Y2dNQzQzTWpBME9ETkRNQzQyTVRJeU1qWWdNQzQzTXpBM01EY2dNQzQyTURRMU1UZ2dNQzQzTXpreU9ETWdNQzQxT1RRek5ERWdNQzQzTkRBek9UbE1NQzQxTnpJeE56WWdNQzQzTkRJNE5qVkRNQzQxTmpjMU5UTWdNQzQzTkRNek9DQXdMalUyTXpjMk9DQXdMamMwTmpjMk9DQXdMalUyTWpjMU5TQXdMamMxTVRJNU9WcE5NQzQzTkRjNE1ERWdNQzQzT0RNd05qRkRNQzQzTkRjNE1ERWdNQzQ0TURreE1UY2dNQzQzTWpZMk56Z2dNQzQ0TXpBeU5DQXdMamN3TURZeU1TQXdMamd6TURJMFF6QXVOamMwTlRZMElEQXVPRE13TWpRZ01DNDJOVE0wTkRFZ01DNDRNRGt4TVRjZ01DNDJOVE0wTkRFZ01DNDNPRE13TmpGRE1DNDJOVE0wTkRFZ01DNDNOVGN3TURRZ01DNDJOelExTmpRZ01DNDNNelU0T0RFZ01DNDNNREEyTWpFZ01DNDNNelU0T0RGRE1DNDNNalkyTnpnZ01DNDNNelU0T0RFZ01DNDNORGM0TURFZ01DNDNOVGN3TURRZ01DNDNORGM0TURFZ01DNDNPRE13TmpGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj0xMiAxMjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI4NyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MyIgeT0iMzEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTIiIHZhbHVlPSJVc2VycyBJbnB1dCAtPiBUcmFpbmVkIE1vZGVsIiBzdHlsZT0iaXIucmVmPTczMmIwMjc5LTdkMjItNDE2NC1iZmUzLTE5ZWJjZDA5ZWNiMDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI4NyIgc291cmNlPSI4OCIgdGFyZ2V0PSI4OSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9Ijg4IiB2YWx1ZT0iVXNlcnMgSW5wdXQiIHN0eWxlPSJpci5yZWY9YTFkMDNiYWUtZTZiNy00MmNlLThjY2QtOGI5N2QwZTdjZDM4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELU1MLUFJLVVTRVJTLUlOUFVUO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj04IDg7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI3NiIgeT0iMjgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iODkiIHZhbHVlPSJUcmFpbmVkIE1vZGVsIiBzdHlsZT0iaXIucmVmPTc3MWJmOWZjLTFlODctNGMzNi05OTIwLTZhMDkwYjA2YWI2Yjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1NTC1BSS1UUkFJTkVELU1PREVMO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1taWRkbGU7dmVydGljYWxBbGlnbj1taWRkbGU7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtkYXNoZWQ9MTtkYXNoUGF0dGVybj04IDg7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ4OSIgeT0iMjgiIHdpZHRoPSI5MSIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iOTEiIHZhbHVlPSJUcmFpbmVkIE1vZGVsIC0+IE1vZGVsIG91dHB1dHMiIHN0eWxlPSJpci5yZWY9ODNjNWM1ODItNTQzZC00N2E3LWE1NjEtMDE3ODIyYTIwZWM0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MTtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMiIHNvdXJjZT0iODkiIHRhcmdldD0iOTAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSI3MjQiIHk9IjM2MCIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY2IiB2YWx1ZT0iR2VuZXJpYyBTZXJ2aWNlIFByZWRpY3RlZCBhY3Rpb24sIGUuZy4sIGJ1eS9zZWxsIC0+IE91dCBPZiBTY29wZSIgc3R5bGU9ImlyLnJlZj05MDQwOTcwNS1hZmU4LTQ0ZWEtOTEyMi05MjQ3ZDg4ZDJjNGY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSM2NkIyRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtmb250U2l6ZT0xNDsiIHBhcmVudD0iMSIgc291cmNlPSI3MyIgdGFyZ2V0PSI0MSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xMzkiIHk9IjM5NyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iT3V0IE9mIFNjb3BlIC0+IEdlbmVyaWMgU2VydmljZSBQcmVkaWN0ZWQgYWN0aW9uLCBlLmcuLCBidXkvc2VsbCIgc3R5bGU9ImlyLnJlZj01NjQyNzkzMC02MTRlLTQ3N2YtYTEzYi1jYjk3ZTc3NjhmN2Q7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjAwNTtlbnRyeVk9MC42MzI7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7Zm9udENvbG9yPSM2NkIyRkY7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtlbnRyeVBlcmltZXRlcj0wO2ZvbnRTaXplPTE0OyIgcGFyZW50PSIxIiBzb3VyY2U9IjQxIiB0YXJnZXQ9IjczIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE0NCIgeT0iMzQyIi8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iNzgiIHZhbHVlPSImbHQ7Zm9udCBjb2xvcj0mcXVvdDsjMDA3ZmZmJnF1b3Q7IHN0eWxlPSZxdW90O2ZvbnQtc2l6ZTogMTRweDsmcXVvdDs+RGF0YSBwaXBlbGluZSAmYW1wO2FtcDsgbW9kZWwgY3JlYXRpb24mbHQ7L2ZvbnQ+IiBzdHlsZT0idGV4dDtodG1sPTE7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3Jlc2l6YWJsZT0wO3BvaW50cz1bXTthdXRvc2l6ZT0xO3N0cm9rZUNvbG9yPW5vbmU7ZmlsbENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7Zm9udFNpemU9MTQ7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iLTMzNSIgeT0iLTkzLjk5NTQ4Mzg3MDk2Nzc1IiB3aWR0aD0iMTk4IiBoZWlnaHQ9IjI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5NiIgdmFsdWU9IldlYiBVSSAtPiBUcmFkZSBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPTlmYzk0MTkzLTdhYmYtNDc3Yy05OGM2LWYxMDgxNmYzZjlhNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjE5IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTE0NCIgeT0iMjA0Ii8+PC9BcnJheT48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMTAxIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0wO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIzOSIgdGFyZ2V0PSI4NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PEFycmF5IGFzPSJwb2ludHMiPjxteFBvaW50IHg9Ii0xNTgiIHk9Ii0xMyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjEwMiIgdmFsdWU9IlRyYWRlIFNlcnZpY2UgLT4gV2ViIFVJIiBzdHlsZT0iaXIucmVmPTE0ZDE4MTUyLWEzYmMtNGZlZi1hNjI4LWZlMTAxMTMyYjNlYjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTkiIHRhcmdldD0iMTciIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItOTgiIHk9IjE1NiIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="100"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Trade Service -&gt; Users Input" ref="14166cfa-0610-4c03-85ce-1916fb889761" source="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" target="239ba369-2d9f-4e4c-8129-d86e8da7d042">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Trade Service -&gt; Web UI" ref="14d18152-a3bc-4fef-a628-fe101132b3eb" source="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" target="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Model outputs -&gt; Generic Service Predicted action, e.g., buy/sell" ref="302ccc7f-9af7-4643-9b5e-e51756b343c7" source="c80c37c8-4b1a-45e7-95c3-6005285c2b88" target="a4358da6-d80b-485c-b27c-2313a9e9e45d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Out Of Scope -&gt; Generic Service Predicted action, e.g., buy/sell" ref="56427930-614e-477f-a13b-cb97e7768f7d" source="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" target="a4358da6-d80b-485c-b27c-2313a9e9e45d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Users Input -&gt; Trained Model" ref="732b0279-7d22-4164-bfe3-19ebcd09ecb0" source="239ba369-2d9f-4e4c-8129-d86e8da7d042" target="4d33876c-2161-4cc7-875c-e6dd1667d7b9">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Trained Model -&gt; Model outputs" ref="83c5c582-543d-47a7-a561-017822a20ec4" source="4d33876c-2161-4cc7-875c-e6dd1667d7b9" target="c80c37c8-4b1a-45e7-95c3-6005285c2b88">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Generic Service Predicted action, e.g., buy/sell -&gt; Out Of Scope" ref="90409705-afe8-44ea-9122-9247d88d2c4f" source="a4358da6-d80b-485c-b27c-2313a9e9e45d" target="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web UI -&gt; Trade Service" ref="9fc94193-7abf-477c-98c6-f10816f3f9a4" source="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987" target="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Data Preparation for Artificial Intelligence Modeling -&gt; Build an Artificial Intelligence model" ref="ad8daa93-3310-4240-9fa2-d8a41037a35d" source="4f45bca0-5751-4558-8273-f3b5838931f8" target="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Build an Artificial Intelligence model -&gt; Deployment Setup" ref="eb95e61c-8b32-494c-9fa6-0185ebcbc5b1" source="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c" target="93188c58-de74-4bed-8fb8-21fe54a69945">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields>
+    <customField ref="qa_cf" value=""/>
+  </customFields>
+  <components>
+    <component uuid="d644ada8-e95a-4f79-a073-250c8e6d5ea3" diagramComponentId="bc49435e-629a-42dd-b661-19d3f22ab3c8" ref="33c42d7e-6bce-446e-ac2e-006b934959e6" name="API Endpoint - Broker site" desc="" library="IR-Functional-Components" parentComponentRef="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" componentDefinitionRef="CD-API-ENDPOINT">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures>
+        <countermeasure ref="CWE-285" name="Apply authorization checks to segregate and control access to user data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications protecting sensitive or otherwise restricted resources must ensure that only appropriate and authorized users can access the application data. It is important that an application prevent unauthorized users gaining inappropriate access to each other's data. Although user A and user B may both be trusted to access data within the application, they may be only authorized to access different subsets of the protected resources.&amp;nbsp; E.g. user A should not be able to access user B's personal data by manipulating a request (typical examples are the manipulation of an ID value or other object reference sent in the URL or body of an HTTP request).&lt;/p&gt;&lt;p&gt;It is not sufficient to rely on obscurity, for example obfuscated or secret URLs or filenames. The application must validate each request for protected data against the proven identity of the user. Before providing access to restricted resources the application must:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure the user has undergone appropriate authentication (identification and verification, or ID&amp;amp;V). E.g. they must have provided their identity and confirmed this with a password, token, or other verification. Typically this is done by checking the validity of the session token issued after login.&lt;/li&gt;&lt;li&gt;Confirm the user is authorized to access the data or resource they are requesting. E.g. their confirmed identify is checked against a server-side access control matrix to determine whether they may access the requested resource.&lt;/li&gt;&lt;li&gt;Access controls should be granular and make it possible to issue to individual resources to individual users or roles.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;URL and asset based access control is provided by most web-frameworks, and it is preferable to use an established and proven framework.&lt;/p&gt;&lt;p&gt;Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA CM-07 Least Functionality" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/158-08_02_CM-07"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.18" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.2" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.3" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="CM-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Using two different browsers configured with an intercepting proxy:&lt;/li&gt;&lt;li&gt;Login as user A in browser A.&lt;/li&gt;&lt;li&gt;Login as user B in browser B.&lt;/li&gt;&lt;li&gt;For every operation that displays sensitive data belonging to user A:&lt;ol&gt;&lt;li&gt;Perform the operation as user A and view their sensitive data.&lt;/li&gt;&lt;li&gt;Obtain the session ID of user B.&lt;/li&gt;&lt;li&gt;Configure the proxy to intercept.&lt;/li&gt;&lt;li&gt;Perform the operation as user A again, but this time intercept all the requests and replace user A's session ID with that of user B.&lt;/li&gt;&lt;li&gt;Ensure that user A's sensitive data is &lt;strong&gt;not &lt;/strong&gt;visible.&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To ensure object-level authorization checks are in place:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.013">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.014">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-MINIMIZE-CLIENT-PROCESSING" name="Minimize the information that each client receives from the server side to accomplish its intended action" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Servers are often designed to send more data to the client than is really required, so it's necessary to send the minimum data from the server to the client. It's an easy way to send all information from server to client and then filter in the client's own, but this behaviour can lead to further data leak, in case that an attacker obtains this information, for example by intercepting requests or accessing the browser, so this could increase the risk of a future attack.&lt;/p&gt;&lt;p&gt;It is a good idea to have different endpoints that return different data, according to needs.&lt;/p&gt;&lt;p&gt;An example of bad code in JSP:&lt;/p&gt;&lt;p&gt;&lt;i&gt;Social Security Number: &amp;lt;%= ssn %&amp;gt;&amp;lt;/br&amp;gt;Credit Card Number: &amp;lt;%= ccn %&amp;gt;&lt;/i&gt;&lt;/p&gt;&lt;p&gt;This is a bad code, because it displays a user's credit card and social security numbers, even though they aren't absolutely necessary.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CWE-213: Exposure of Sensitive Information Due to Incompatible Policies" url="https://cwe.mitre.org/data/definitions/213.html"/>
+          </references>
+          <standards>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Use a proxy to pass browser requests through it and check the responses to see what data the server is sending. Can you get unnecessary data?&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Proxy can be replaced using DevTools from your browser.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.012">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.002">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="laouad" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:00.013">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
+          <threats>
+            <threat ref="CAPEC-180-BROKEN-ACCESS-CONTROL" name="An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the application" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An Access Control functionality often spans many areas of software depending on the complexity of the access control system. For example, managing access control metadata or building caching for scalability purposes are often additional components in an access control system that need to be built or managed. Vulnerabilities appear when a user is able to successfully request access to something they usually shouldn't have access to. Oftentimes this is found when the authorization is not implemented properly. A typical example would be a certain endpoint on a website that throws a 403 forbidden error which is then bypassed by adding an X-Forwarded-For: "127.0.0.1" header.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="CWE-285" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="no-security-procedures-monitoring" name="Attackers gain access to the system and are not detected" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and are not detected. Therefore, they can make changes to the systems and remain undetected. Data integrity is destroyed.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="security-logging" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-137-INJECTION" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Some of the most common types of injection attacks are SQL injections, cross-site scripting (XSS), code injection, OS command injection, host header injection, and more. A large part of vulnerabilities that exist in web applications can be classified as injection vulnerabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Scenario #1: An application uses untrusted data in the construction of the following vulnerable SQL call:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;String query = "SELECT * FROM accounts WHERE custID='' request.getParameter("id") + '';&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Scenario #2: Similarly, an application's blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)):&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;Query HQLQuery = session.createQuery("FROM accounts WHERE custID=' '+ request.getParameter("id") + "'");&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In both cases, the attacker modifies the 'id' parameter value in their browser to send: ' or '1'='1. For example:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;http://example.com/app/accountView?id=''or '1'='1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data, or even invoke stored procedures.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="DATA-VAL" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-157-DATA-DISCLOSURE" name="An attacker can inspect the HTTP responses using a proxy to access to sensitive information that is not directly visible in the client application" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;APIs retrieve necessary data from back end systems when client applications make an API call. However, most of the backend systems were not designed to handover the exact data that the client requested. Rather, the API serves more data than what is needed by the client and then a filtering mechanism is used in the client app code to mask or discard unwanted data. If an attacker launches the underlying API and examines the response patterns, they are able to access the redundant data which could contain sensitive information.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Besides returning excessive data records in response to a client request, an API may also expose certain references to the platform technologies used by the application. This allows hackers to look for vulnerabilities on such software and attack the system using that information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-MINIMIZE-CLIENT-PROCESSING" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="14f84dd5-8b27-4788-9739-5ff2afc3e156" diagramComponentId="f2888784-6abc-43c1-b7ba-0704fa9fa68e" ref="e4ee0eca-a5b9-4f0a-b59f-6b43df89790c" name="Build an Artificial Intelligence model" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-MODEL-BUILD">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-MODEL-CHOICE" name="Carefully consider the model choice" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Models can be built using different approaches or algorithms. Overall, choosing the right algorithm depends on several factors, including business considerations, data size, accuracy, training time, parameters, and inference performance, among others.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;In general, the right choice is typically a combination of these aspects. In terms of security, however, the main algorithmic concern is about the nature of the data, where certain algorithms are more vulnerable to data leaks than others.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Depending on your privacy concerns, and/or compliance considerations, e.g., GPDR, &amp;nbsp;consider auditing the data privacy of the models under consideration, e.g., using tools like Privacy Meter.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Privacy Meter" url="https://github.com/privacytrustlab/ml_privacy_meter"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ROBUST-LEARNING" name="Consider robust learning and defenses against poisoning attacks for online models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Robustness verification, robust learning techniques, and other defenses against adversarial perturbations have become important aspects when developing an ML/AI model. Techniques for achieving robustness include adversarial training and learning techniques in the presence of outliers or noise. Robust statistics such as stochastic approximation approaches, which have shown to be robust against data poisoning attacks, e.g., training with stochastic gradient descent, is an example.&lt;/p&gt;
+&lt;p&gt;Depending on the domain area and the underlying ML/AI framework used, there are a number of tools that can help assess models against adversarial threats, including adversarial tampering. These include the Adversarial Robustness Toolbox, DeepRobust, or AutoAttack.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Adversarial Robustness Toolbox (ART)" url="https://adversarial-robustness-toolbox.readthedocs.io/en/latest/"/>
+            <reference name="Adversarial Robustness Tools" url="https://github.com/EthicalML/awesome-production-machine-learning#adversarial-robustness"/>
+            <reference name="Robust Machine Learning Models and Their Applications" url="https://dspace.mit.edu/bitstream/handle/1721.1/130760/1252059420-MIT.pdf?sequence=1&amp;isAllowed=y"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ENV-SETUP" name="Consider the right framework, model, and language for an application" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Setting up the right tool stack for your ML/AI projects is very important to work efficiently and be able to deliver results.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;The best ML/AI toolbox would include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Various flavors of Jupyter Notebooks which allow for quick experiments and visualization, and exchanging ideas between team members,&lt;/li&gt;
+ &lt;li&gt;Appropriate IDEs with ease of use and possible connectivity with third-party platforms/clouds or useful extensions, e.g., Pycharm or Visual Studio,&lt;/li&gt;
+ &lt;li&gt;Code and data versioning, e.g., Github, or Data Version Control (DVC),&lt;/li&gt;
+ &lt;li&gt;The framework that provides the right functionality. Scikit-learn, R, TensorFlow, and PyTorch have been some of the favorites of ML/AI teams,&amp;nbsp; 
+  &lt;ul&gt;
+   &lt;li&gt;For more specialized areas, such as NLP or Computer Vision, more specialized frameworks and libraries exist such as Huggingface, Spacy, NLTK, Gensim, or OpenCV.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+ &lt;li&gt;For operationalizing models and managing their lifecycle, tools such as MLflow or Kubeflow are being used to manage ML/AI workflows and pipelines end-to-end.&lt;/li&gt;
+ &lt;li&gt;In terms of larger and cloud-based platforms, Amazon SageMaker and Azure ML are the two biggest names. They provide fully-managed cloud services for predictive analytics&lt;/li&gt;
+ &lt;li&gt;Running models in production and at scale also involves the language, the programming paradigm, and hosts: 
+  &lt;ul&gt;
+   &lt;li&gt;While most models are written in Python or R, these might be too slow for production models! Using faster languages such as C/C++ or Java might be a challenge.&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Use powerful hosts and parallel processing, e.g., Apache Spark, to perform iterative and heavy computational operations.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;The above only scratches the surface regarding what tools, libraries, and frameworks are available to build your model. &amp;nbsp;The landscape is also rapidly evolving. Make sure to consider the pros and cons of several alternatives before landing on a final solution.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Awesome Production Machine Learning - a curated list of tools to help setup ML/AI projects" url="https://github.com/EthicalML/awesome-production-machine-learning"/>
+            <reference name="Guidance and resources on building the right ML/AI platform - Neptune.ai's blog" url="https://neptune.ai/blog"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.018">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-EVALUATION-METRICS" name="Consider using data sets with well-known error rates for the model evaluation, in addition to well-established performance evaluation techniques" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When evaluating an ML/AI model for real-world uses, two fundamental questions arise: 1) Is the model good enough? and 2) Is it better than other alternatives?&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;To obtain reliable answers to these questions, special care should be taken in the process of selecting data, selecting and building the model, as well as the evaluation metrics used.&lt;/p&gt;
+&lt;p&gt;The validation/evaluation strategy of ML/AI models involves the following two main aspects:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Resampling methods, which are techniques of rearranging data samples to inspect if the model performs well. These include: 
+  &lt;ul&gt;
+   &lt;li&gt;Random Split,&lt;/li&gt;
+   &lt;li&gt;Time-Based Split,&lt;/li&gt;
+   &lt;li&gt;K-Fold Cross-Validation,&lt;/li&gt;
+   &lt;li&gt;Stratified K-Fold, and&lt;/li&gt;
+   &lt;li&gt;Bootstrap.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+ &lt;li&gt;Classification metrics, &amp;nbsp;including: 
+  &lt;ul&gt;
+   &lt;li&gt;Accuracy: sensitive to the sum of true positives+true negatives and to the total number of data points. Not sensitive to class imbalance.&lt;/li&gt;
+   &lt;li&gt;Precision: sensitive to true positives and false positives. Not sensitive to false negatives or true negatives.&lt;/li&gt;
+   &lt;li&gt;Recall: sensitive to true positives and false negatives. Not sensitive to false positives or true negatives.&lt;/li&gt;
+   &lt;li&gt;F-score: sensitive to true positives, false positives, and false negatives. Not sensitive to true negatives.&lt;/li&gt;
+   &lt;li&gt;Overlap: sensitive to the intersection and overlap of predicted and actual.&lt;/li&gt;
+   &lt;li&gt;Likelihood: sensitive to the probability that the model assigns to the test data.&lt;/li&gt;
+   &lt;li&gt;Distance: sensitive to the distance between the prediction and the actual value.&lt;/li&gt;
+   &lt;li&gt;Correlation: sensitive to each of true positives, true negatives, false positives, and false negatives, but unlike Accuracy metrics they factor in the degree of agreement that would be expected by chance.&lt;/li&gt;
+   &lt;li&gt;AUC: Does not rely on a specific classification threshold, but instead calculates the area under a curve parameterized by different thresholds.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Other measures include:&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Probabilistic measures, e.g., Akaike Information Criterion (AIC),&lt;/li&gt;
+ &lt;li&gt;Regression metrics, e.g., Mean Squared Error or MSE, or&lt;/li&gt;
+ &lt;li&gt;Clustering metrics, e.g., Elbow method.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The Ultimate Guide to Evaluation and Selection of Models in Machine Learning" url="https://neptune.ai/blog/ml-model-evaluation-and-selection"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PARAMETERS-PROTECTION" name="Perform sensitivity analyses and lock in the set of model parameters and hyperparameters" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Consider the following to assess and protect parameters and hyperparameters:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Mechanisms in place to protect and lock parameters and hyperparameters.&lt;/li&gt;
+ &lt;li&gt;Sensitivity analysis to show how changes in model parameters affect model outputs.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Sensitivity Analysis Library" url="https://github.com/SALib/SALib"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-REPRESENTATION-ROBUSTNESS" name="Review the representation robustness" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Depending on the model used, randomization and encoding techniques have been proposed to potentially increase the resilience of models to adversarial attacks.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;For instance, assigning different encoded labels for each classifier in an ensemble structure has been shown to improve the classification performance on adversarial attacks. It has also been demonstrated that randomized defenses against adversarial attacks are more efficient than deterministic ones.&lt;/p&gt;
+&lt;p&gt;Representational robustness can manifest in decisions as basic as using word2vec embedding in an NLP system versus one-hot vector encodings, which can help combat some blind spot risks.&lt;/p&gt;
+&lt;p&gt;On the purely performance side, initialization strategies based on the properties of the statistical distribution of the data on which the models are trained have also been proposed.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data Driven Initialization for Machine Learning Classification Models" url="https://repository.urosario.edu.co/server/api/core/bitstreams/bb7de9d7-1410-49f2-a27f-70aaf4824dbe/content"/>
+            <reference name="Ensemble of Random Binary Output Encoding for Adversarial Robustness" url="https://ieeexplore.ieee.org/document/8813035"/>
+            <reference name="Randomization matters - How to defend against strong adversarial attacks" url="https://dl.acm.org/doi/pdf/10.5555/3524938.3525653"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:24.771">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-CATASTROPHIC-FORGETTING" name="Use strategies to counter potential catastrophic forgetting" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Consider using mechanisms to counter potential catastrophic forgetting, such as:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Complement the model with a memory storing previous information, for example, by using memory replay to consolidate internal representations,&lt;/li&gt;
+ &lt;li&gt;Train the network while regularizing, and&lt;/li&gt;
+ &lt;li&gt;Expand the model if necessary to represent new tasks.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Learn, don’t forget: constructive methods for effective continual learning" url="https://upcommons.upc.edu/bitstream/handle/2117/374177/thesis%20Aitor%20Ganuza.pdf?sequence=1&amp;isAllowed=y"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:26:25.017">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-CATASTROPHIC-INTERFERENCE" name="Models may be subject to catastrophic interference" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;A model is subject to abruptly and drastically forgetting previously learned information upon learning new information. Nowadays, this is more of an issue with autonomous and continuous learning, i.e., without any humans in the loop.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="75" easeOfExploitation="50"/>
+              <references>
+                <reference name="Continual Learning of Natural Language Processing Tasks: A Survey" url="https://arxiv.org/pdf/2211.12701.pdf"/>
+                <reference name="Overcoming catastrophic forgetting in neural networks" url="https://www.pnas.org/doi/10.1073/pnas.1611835114"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-CATASTROPHIC-FORGETTING" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-MANIPULATE-ONLINE-SYSTEM" name="An adversary may be able to manipulate an online learning system" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Online models continue to learn during operations. This might lead to a drift from the initial purpose or use case. Attackers might be able to lead the system in the wrong direction with specially crafted data, a.k.a data poisoning.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="75"/>
+              <references>
+                <reference name="Concealed Data Poisoning Attacks on NLP Models" url="https://aclanthology.org/2021.naacl-main.13.pdf"/>
+                <reference name="ML Attack Models: Adversarial Attacks and Data Poisoning Attacks" url="https://arxiv.org/ftp/arxiv/papers/2112/2112.02797.pdf"/>
+                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
+                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ROBUST-LEARNING" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-DATA-REPRESENTATION" name="Adversaries may exploit algorithmic leakage or data representation issues to extract data or attack the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Some algorithms are unsuited for processing confidential information. The choice of an algorithm should take into account the nature of the input data as well as how the algorithm represents and store the training data.&lt;/p&gt;
+&lt;p&gt;On the other hand, the model initialization and data representation might have an effect on how to defend against strong adversarial attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="Confidential machine learning on untrusted platforms: a survey" url="https://cybersecurity.springeropen.com/articles/10.1186/s42400-021-00092-8"/>
+                <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
+                <reference name="Machine Learning with Confidential Computing: A Systematization of Knowledge" url="https://arxiv.org/pdf/2208.10134.pdf"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-REPRESENTATION-ROBUSTNESS" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-SCALABILITY-ISSUES" name="Models may be subject to failures due to scalability issues" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;The algorithm may not scale in performance in the real world, e.g., prediction time might be too important compared to the rate at which input data comes in. This might lead to denial of service situations.&lt;/p&gt;
+&lt;p&gt;There are a number of challenges in the way of scaling and accelerating ML/AI workloads:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Getting feature engineering right, while especially having in mind how they could be efficiently calculated and continuously monitored in production,&lt;/li&gt;
+ &lt;li&gt;The tools and setup, especially in terms of programming language, processing power (single machine or distributed computing), and deployment technologies (e.g., containerization),&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;The maintenance of the model over time as it will need frequent fine-tuning and retraining, which might also be time-consuming and computationally expensive.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="How to Scale ML Projects – Lessons Learned from Experience" url="https://neptune.ai/blog/how-to-scale-ml-projects"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ENV-SETUP" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-EVALUATION-ISSUES" name="Models may be subject to overfitting, or bad evaluation sets" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;A number of risks must be considered when evaluating models' performance, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Overfitting: one of the most prevalent issues in ML/AI systems. This means the model is excellent with training data but does not generalize well.&lt;/li&gt;
+ &lt;li&gt;Bad evaluation data: does test data reflect the data expected in production?&lt;/li&gt;
+ &lt;li&gt;Bad upstream data: as the expression goes, "garbage in, garbage out". Issues in data upstream make both training and subsequent evaluation difficult.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Note that evaluation might be motivated by various stakeholder perspectives and interests. Always optimizing for the most common static tests would fail to account for the changes in societal, linguistic, and other relevant factors of the ecosystem and the application at hand. Make sure you validate that the metrics you selected properly measure what you are trying to achieve.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="Evaluation Gaps in Machine Learning Practice" url="https://arxiv.org/abs/2205.05256"/>
+                <reference name="What Is Overfitting?" url="https://www.ibm.com/topics/overfitting"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-EVALUATION-METRICS" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-MANIPULATE-PARAMETERS" name="An adversary may be able to manipulate model parameters or hyperparameters" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;ML/AI systems have a number of parameters and hyperparameters that might not be easy to understand or comprehensively test. Setting up and tuning models can be regarded as more of a black art than actual science, which make them subject to attacker influence.&lt;/p&gt;
+&lt;p&gt;If an attacker can manipulate either the hyperparameters (used to control the learning process) or the parameters (learned by the model to map the input into the desired output), this will have a devastating effect on the performance and reliability of the ML/AI model.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PARAMETERS-PROTECTION" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="50939219-14a2-4311-b44f-a032b5efc0ec" diagramComponentId="ab4d129d-db94-4614-8cf8-d6b8c7d0b8ae" ref="4f45bca0-5751-4558-8273-f3b5838931f8" name="Data Preparation for Artificial Intelligence Modeling" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-DATA-PREPARATION-FOR-AI-MODEL">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.653">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-359" name="Exposure of Private Information ('Privacy Violation')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.653">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.652">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores sensitive information without properly limiting read or write access by
+                        unauthorized actors.
+                        If read access is not properly restricted, then attackers can steal the sensitive information.
+                        If write access is not properly restricted, then attackers can modify and possibly delete the
+                        data, causing incorrect results and possibly a denial of service.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.323">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.322">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-AVOID-DIRECT-LOOPING" name="Avoid direct loops in the data pipeline" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A beneficial feedback loop typically involves bringing in unbiased, external information into your system, which would ensure that, over time, the models do not degrade due to being retrained on biased data that is strongly correlated to the outputs and does not reflect the true data distribution.&lt;/p&gt;
+&lt;p&gt;Human-in-the-loop, or human-on-the-loop (only holding overall control over the system), are generally good ideas in ML/AI systems.&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Human-in-the-Loop in Machine Learning: A Handful of Arguments in Favor" url="https://labelyourdata.com/articles/human-in-the-loop-in-machine-learning"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-REDUNDANCY" name="Build and maintain redundant data streams" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Avoid central points of failure or compromise for all critical components of your system including the data stream.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Internally, this involves network pathway, power, geographic, and data redundancy, and can even be extended to individuals, i.e., key staff looking after the data pipeline!&lt;/p&gt;
+&lt;p&gt;In addition, when possible, avoid 'vendor lock-in' and consider alternative data sources.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PROTECT-SOURCES" name="Carefully select and protect data sources when possible" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When selecting data sources, their security (availability and integrity, and possibly confidentiality) is of paramount importance. This involves:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Analyze the source, e.g., reputation,&lt;/li&gt;
+ &lt;li&gt;Evaluate the data quality,&lt;/li&gt;
+ &lt;li&gt;Verify the data formats and accessibility options,&lt;/li&gt;
+ &lt;li&gt;Verify the reliability of the data, including in terms of their security aspects, as well as legitimacy and biases,&lt;/li&gt;
+ &lt;li&gt;Verify the security of the data source, e.g., compliance with security standards and regulations.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to find reliable data sources" url="https://earlygrowthfinancialservices.com/blog/how-to-find-reliable-data-sources/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-MODEL-SELECTION" name="Consider model selection techniques for more reliable and reproducible inference and predictions" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Model selection in ML/AI is the process of selecting the best algorithm and model architecture for a specific job and/or data. It entails assessing and contrasting various models to identify the one that best fits the data at hand and produces the best results.&lt;/p&gt;
+&lt;p&gt;This involves some testing with modeling, as opposed to only relying on the characteristics of the data itself. Selection techniques include model performance comparisons with measurements such as the F-score, accuracy, precision, recall, or the area beneath the receiver's operating characteristic curve (AUC-ROC). Several model performance and validation strategies are used to assess each model's generalization, including sampling and splitting techniques.&lt;/p&gt;
+&lt;p&gt;Note that the selection step is a must even though it increases the computational cost and time, such as cross-validation for instance, which requires training and testing multiple times with varied parameters.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Model selection for machine learning" url="https://www.scholarhat.com/tutorial/machinelearning/model-selection-for-machine-learning"/>
+            <reference name="The Ultimate Guide to Evaluation and Selection of Models in Machine Learning" url="https://neptune.ai/blog/ml-model-evaluation-and-selection"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" name="Consider possible trojanized versions when acquiring shared models" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Never assume what you are downloading is safe! Malicious actors often use trojanized versions of popular applications in an effort to steal information and compromise systems.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;In this case, you might be fine-tuning a model with possibly a Trojan that includes sneaky behavior that is unanticipated.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Basic practices include carefully checking the source of the model, as well as using cryptographic methods like digital signatures and secure hashes to verify the authenticity and file integrity.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Verify Downloaded Files" url="https://www.digitalocean.com/community/tutorials/how-to-verify-downloaded-files"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" name="Consider potential privacy issues such as de-identification early on" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Consider how sensitive the input data is and how to protect it early on in the design and model development process. Best practices include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;De-identification and removal of PII (Personal Identifiable Information) in the training data,&lt;/li&gt;
+ &lt;li&gt;Obfuscation, or other techniques that might reduce the exposure of the data later on, including randomized/shuffled data, regularization, or restricting/reducing the training sets.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;One example of data anonymization technique used to protect individual privacy in a dataset is k-anonymization. &amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Example tool: ARX Data Anonymization" url="https://github.com/arx-deidentifier/arx"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-TEST-PACKAGES" name="Consider the security of the data and model supply chain" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In addition to inherent modelization risks, there are additional ones associated with security engineering, software security, and supply chain security. These include trojanization or backdooring of base models or other packages.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Understand and maintain the full list of dependencies and harden the verification and patching pipelines. &amp;nbsp;Consider the following:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Verification of digital signatures/ cryptographic hashes,&lt;/li&gt;
+ &lt;li&gt;Use secure repos,&lt;/li&gt;
+ &lt;li&gt;Keep packages up-to-date,&lt;/li&gt;
+ &lt;li&gt;Use segregated virtual environments,&lt;/li&gt;
+ &lt;li&gt;Perform regular code reviews of packages and libraries,&lt;/li&gt;
+ &lt;li&gt;Use package verification tools, and&lt;/li&gt;
+ &lt;li&gt;Educate users.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure at every step: What is software supply chain security and why does it matter?" url="https://github.blog/2020-09-02-secure-your-software-supply-chain-and-protect-against-supply-chain-threats-github-blog/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-DATA-VERSION-CONTROL" name="Consider using version control to manage datasets" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data versioning should be treated in the same manner as code versioning.&lt;/p&gt;
+&lt;p&gt;There exist several data version control libraries such as DVC which is dedicated to ML/AI data and systems or lakeFS which provides a Git-like functionality for data using S3 or Google Cloud Storage (GCS).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="(Not Just) Data Version Control" url="https://dvc.org/"/>
+            <reference name="Best 7 Data Version Control Tools That Improve Your Workflow With Machine Learning Projects" url="https://neptune.ai/blog/best-data-version-control-tools"/>
+            <reference name="Model and Data Versioning" url="https://github.com/EthicalML/awesome-production-machine-learning#model-and-data-versioning"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
+&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.580">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PROPER-SLICING" name="Ensure the split data originate from similar data with careful consideration for overlaps" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Make sure that the training, validation, and test sets are 'the same' from data integrity, trustworthiness, and mathematical perspectives.&lt;/p&gt;
+&lt;p&gt;Too much overlap or similarity between these sets may lead to overfitting. By contrast, when the evaluation set is too different from the eventual future inputs during operations, it will not measure the true performance.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Use best practices, including when using built-in methods within your favorite ML/AI framework.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Splits and Slicing (TensorFlow)" url="https://www.tensorflow.org/datasets/splits"/>
+            <reference name="Train Test Validation Split: How To &amp; Best Practices" url="https://www.v7labs.com/blog/train-validation-test-set"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" name="Harden the data and feedback pipeline" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data pipelines are at the heart of building a robust data practice. It includes the processing of the data, triggering model retraining, notifying when feedback/ metric is received/ reached, etc.&lt;/p&gt;
+&lt;p&gt;When considering data and feedback collectors in a production environment, there are several aspects to ensure the security of the deployment. Best practices and considerations include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Secure encrypted end-to-end communication,&lt;/li&gt;
+ &lt;li&gt;User identity management,&lt;/li&gt;
+ &lt;li&gt;Secure credentials,&lt;/li&gt;
+ &lt;li&gt;Audit and log activities,&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Limit the exposure of the automation stages, e.g., scripts that perform data and feedback transformations,&lt;/li&gt;
+ &lt;li&gt;Secure storage, and&lt;/li&gt;
+ &lt;li&gt;Secure streaming system and pipeline.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Depending on your use case and infrastructure, you will have several options for data orchestration, including cloud-based options, such as AWS Glue or Azure Data Factory, among others.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Building a secure data pipeline in AWS Glue" url="https://docs.aws.amazon.com/whitepapers/latest/aws-glue-best-practices-build-secure-data-pipeline/building-a-secure-data-pipeline.html"/>
+            <reference name="Security considerations for data movement in Azure Data Factory" url="https://learn.microsoft.com/en-us/azure/data-factory/data-movement-security-considerations"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.580">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-IDENTIFY-BIAS" name="Identify potential bias in the data" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Measuring and mitigating the effects of potential biases and discriminatory patterns in the data is an important step to make ML/AI models fairer, especially in socially sensitive decision processes.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Bias Testing for Generalized Machine Learning Applications" url="https://github.com/pymetrics/audit-ai"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.030">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-MAINTAIN-QUALITY" name="Maintain data quality and integrity during data pre-processing" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintaining data quality is an essential practice when developing ML/AI models. This allows for a reliable data pipeline, including the data cleaning and feature engineering steps.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Developers might not always be aware of best practices for preparing or transforming the data for a given model type, which can lead to suboptimal representations of input features.&lt;/p&gt;
+&lt;p&gt;Many data issues can be identified with some lightweight automation. Some examples include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Numerical features on widely differing scales,&lt;/li&gt;
+ &lt;li&gt;Values assigned special meanings, e.g., to represent missing data,&lt;/li&gt;
+ &lt;li&gt;Malformed values of special string types, such as dates.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;This is far from being an exhaustive list. A schema or a set of constraints should be defined for this data validation step, which would depend on the initial data, how it is expected to evolve, and the model type.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Deequ - Unit Tests for Data" url="https://github.com/awslabs/deequ"/>
+            <reference name="The Data Linter: Lightweight, Automated Sanity Checking for ML Data Sets" url="http://learningsys.org/nips17/assets/papers/paper_19.pdf"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.031">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-MONITOR-DATA-DRIFT" name="Monitor for data drift, especially for new data and online models" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data drift is a type of model drift where the properties of the independent variables change, i.e., input distribution changes.&lt;/p&gt;
+&lt;p&gt;There are some basic monitoring measures to consider, including the use of statistical tests over time:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Compare the cumulative distributions of the initial training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Measure how a variable distribution changes, e.g., Population stability Index,&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Compare the feature distribution between the training data and post-training data, e.g., Z-score.&lt;/li&gt;
+ &lt;li&gt;Compute the observed values and their mean, compared to a threshold value, e.g., the Page-Hinkley test.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;There are libraries and built-in verification and validation methods in ML/AI frameworks, such as TensorFlow for instance.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Frouros: A Python library for drift detection" url="https://arxiv.org/pdf/2208.06868.pdf"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.031">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-INPUT-MANIPULATION" name="Protect input from manipulation and poisoned data samples" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Always ensure that the training data is validated and verified before it is used to train the model. This involves the following considerations:&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Ensure that the data pipeline is properly managed and secure enough, e.g., versioning and security controls such as access control,&lt;/li&gt;
+ &lt;li&gt;Secure storage,&lt;/li&gt;
+ &lt;li&gt;Data monitoring, e.g., for changes in the data distribution, and&lt;/li&gt;
+ &lt;li&gt;Logging and auditing.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-CONSISTENT-REPRESENTATION" name="Reviews of data representations, periodic validation, as well as future featurization options for the data being collected so that it is consistently represented" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Experimentations in the literature have revealed a strong correlation between data consistency and the performance of the ML/AI model. The following is helpful to maintain a consistent representation of the data throughout the ML/AI system lifecycle:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Measure the consistency of the labels assigned to similar items,&lt;/li&gt;
+ &lt;li&gt;Detect issues such as low-quality/ambiguous examples or non-IID (independent and identically distributed) sampling,&lt;/li&gt;
+ &lt;li&gt;Periodic automated validation to detect labeling errors, duplicates, outliers, etc.,&lt;/li&gt;
+ &lt;li&gt;Account for possible changes in the data and alternatives on how to featurize it, and&lt;/li&gt;
+ &lt;li&gt;Ensure data integrity while processing and migrating the data, over the network or into a new schema, for instance.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;There exist tools around aspects like labeling or validation that can help further automate and speed up the process. Additionaly, consider the use of frameworks for creating portable and production-ready ML/AI pipelines.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Argilla - MLOps for NLP: from data labeling to model monitoring" url="https://github.com/argilla-io/argilla"/>
+            <reference name="Cleanlab: clean data and labels by automatically detecting issues in a ML dataset" url="https://github.com/cleanlab/cleanlab"/>
+            <reference name="Model Training Orchestration" url="https://github.com/EthicalML/awesome-production-machine-learning#model-training-orchestration"/>
+            <reference name="TensorFlow Data Validation" url="https://github.com/tensorflow/data-validation"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-SECURE-STORAGE" name="Secure data storage" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Take measures to protect storage resources and the data stored on them, both on-premises and externally, e.g., on the cloud. This involves:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Access control to regulate who can use the data. The environment should identify, verify, and authorize a user before they access the data. Additional policies can dictate where the data can be copied and under which conditions.&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Storage encryption, which can be built in by the service provider. Otherwise, on-premise encryption should be considered.&lt;/li&gt;
+ &lt;li&gt;Isolate data from other systems and networks.&lt;/li&gt;
+ &lt;li&gt;Immutable storage as an extra protection layer that can help prevent bad actors from tampering with data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.227">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-SECURE-TRANSFER" name="Secure data transfer" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When data transfer is needed, various secure methods can be employed, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;SSH&lt;/li&gt;
+ &lt;li&gt;SSL/TLS&lt;/li&gt;
+ &lt;li&gt;VPN&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Also, do not forget to have a backup of your data before starting any migration process.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-VALIDATE-DATA" name="Validate data algorithmically before feeding it into the data pipeline" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Maintaining data quality is an essential practice when developing ML/AI models.&lt;/p&gt;
+&lt;p&gt;Best practices for monitoring and validating the data include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Consistent scale across the data variables,&lt;/li&gt;
+ &lt;li&gt;Data balancing to remove bias,&lt;/li&gt;
+ &lt;li&gt;Data sensitivity tests,&lt;/li&gt;
+ &lt;li&gt;Outliers recognition,&lt;/li&gt;
+ &lt;li&gt;Common statistical checks such as data sparseness or variance, etc. including for assessing the data representativeness for the target application,&lt;/li&gt;
+ &lt;li&gt;Checking against the restrictions as to how the acquired data can be used,&lt;/li&gt;
+ &lt;li&gt;Others, such as the validity of characters in text, or the correlation between variables, etc.&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;These might also depend on the domain area and target modeling.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data Validation Tool" url="https://github.com/GoogleCloudPlatform/professional-services-data-validator"/>
+            <reference name="TensorFlow Data Validation" url="https://github.com/tensorflow/data-validation"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:28:54.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-DATA-POISONING" name="An adversary may be able to manipulate training data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Data is subject to poisoning whereby attackers may intentionally inject malicious data to cause ML/AI training to go awry.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Data engineers should consider what training data in their pipeline an attacker might be able to control and to what extent.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-INPUT-MANIPULATION" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-CHANGING-DATA" name="Changing data distribution and properties will affect the performance of the future model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;How the data will evolve over time is an important aspect to consider early on, which might affect pre-processing steps, as well as the future model behavior.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-MONITOR-DATA-DRIFT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-RAW-POISONING" name="Data sources may be unreliable due to data poisoning" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Data poisoning is one of the main concerns in adversarial ML/AI. It involves the intentional supply of wrong or misleading data to impact the quality of ML/AI models. The manipulation of the data is aimed at controlling the behavior of the model and delivering false results.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PROTECT-SOURCES" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-DATA-PRE-PROCESSING" name="Data encoding, normalization, filtering, feature selection, and annotation, may all introduce biases or affect the predictive and generalization qualities of the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Raw data needs to be properly pre-processed in order to be processed by a learning algorithm. It will impact both the performance and security of the future ML/AI model. Important aspects to take into consideration are:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Feature discovery/engineering: transforming raw data into features that are easier to interpret and feed into the ML/AI model. This mostly relies on the type of data.&lt;/li&gt;
+ &lt;li&gt;Encoding: both data and feature encoding should be carefully considered, e.g., to avoid information loss.&lt;/li&gt;
+ &lt;li&gt;Normalization: essentially to use a common scale throughout the data.&lt;/li&gt;
+ &lt;li&gt;Partitioning: care must be taken when creating data partitions.&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Other data manipulation or helpers: such as data filters or randomness, which plays an important role in stochastic systems.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="A Comprehensive Guide to Data Preprocessing" url="https://neptune.ai/blog/data-preprocessing-guide"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-IDENTIFY-BIAS" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-MAINTAIN-QUALITY" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-UNRELIABLE-SOURCES" name="Data sources may be biased, unbalanced, not representative or properly encoded, or even include copyrighted or illegal material" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Multiple issues can occur with raw input data, including:&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Bias, which can have ethical and moral implications,&lt;/li&gt;
+ &lt;li&gt;Imbalance, which reflects unequal distributions of classes within the dataset and will likely result in unstable models and poor performance (biased towards the overrepresented class),&lt;/li&gt;
+ &lt;li&gt;Encoding and transformation, which might result in information loss, errors, or inconsistencies,&lt;/li&gt;
+ &lt;li&gt;Representativity, which might not have proper coverage or distribution of the target population, and&lt;/li&gt;
+ &lt;li&gt;Legality, such as copyrighted material or non-compliance with regulation, e.g., GDPR.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-VALIDATE-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-INPUT-INFERENCE" name="An adversary may be able to conduct input inference attacks later on to get information from training data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Data engineers should keep in mind that inference attacks are one of the most widespread attacks on ML/AI systems, and plan for it early on. The goals of these attacks are espionage and confidentiality.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;There are a number of inference attack types, including input inference. These attacks extract data from the training dataset, which represents a big issue in terms of privacy and GDPR compliance for instance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="ML04:2023 Membership Inference Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML04_2023-Membership_Inference_Attack.html"/>
+                <reference name="Membership Inference Attacks on Machine Learning: A Survey" url="https://arxiv.org/pdf/2103.07853.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-359">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PRIVACY-TRAINING-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-LACK-VERSION-CONTROL" name="Insufficient or lack of version control of the data can disrupt the system and lead to inconsistencies and failures" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Insufficient or lack of version control carries multiple risks including working from the wrong data, losing previous states and creating rework, &amp;nbsp;and increasing the risk of inconsistencies, errors, or even total failures of the system without the possibility of rolling back to older data/versions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Why Use a Version Control System?" url="https://www.git-tower.com/learn/git/ebook/en/desktop-gui/basics/why-use-version-control"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-DATA-VERSION-CONTROL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-INSECURE-STORE-TRANSFER" name="Data confidentiality and integrity can be jeopardized by an adversary taking advantage of data that is insecurely stored or managed" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Data sources that are not sufficiently protected might be manipulated or poisoned, whether at rest or during transfers.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-SECURE-TRANSFER" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-922">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-SECURE-TRANSFER" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-FEATURE-ENGINEERING" name="Consider how feature engineering and data representations and encodings might impact the future system output" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Data transformation into features, i.e., in a form that can be easily digested and interpreted by the ML/AI algorithm, is a key aspect in building performant and secure models.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;This involves a number of steps, including feature extraction and encoding, and a number of transformations such as dealing with missing values. Care must be taken early on to build a featurization pipeline that is likely to result in more robust systems.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="Feature Engineering" url="https://www.kaggle.com/learn/feature-engineering"/>
+                <reference name="Robust Feature Alignment (an example from image classification)" url="https://github.com/safreita1/unmask"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-CONSISTENT-REPRESENTATION" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-DISABLED-DATA-SOURCES" name="An adversary may target and disable data sources that the system depends on" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Beyond data integrity, confidentiality, and quality; availability is of critical importance, especially when it comes to public data sources.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Data sources, which might be used both during training and post-deployment, can be vulnerable to attacks, including denial of service type of attacks.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references>
+                <reference name="Understanding Denial-of-Service Attacks" url="https://www.us-cert.gov/ncas/tips/ST04-015"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-REDUNDANCY" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-DATA-SIMILARITY" name="(Di)similarity in training, test, and validation sets can result in overfitting, wrong evaluations, or simply erroneous models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;If the training, validation, and test sets are not similar from a data integrity, trustworthiness, and mathematical perspective, the model cannot be properly assessed and will ultimately exhibit poor behavior when it is fielded.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PROPER-SLICING" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-RAW-DATA-PROPERTIES" name="Raw data properties affect the design, selection, and outputs of ML/AI models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Have you properly vetted the data being considered, including how it matches the algorithm under consideration? Data properties and quality should be a major consideration in order to reduce the impact of 'garbage in, garbage out'. Is the data fit to serve its purpose in the context of future modeling, i.e., the considered ML/AI technique?&lt;/p&gt;
+&lt;p&gt;'Summarized' data via its statistical characteristics, as well as visualization, can be useful to select appropriate cleaning, feature processing, and modeling techniques.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-MODEL-SELECTION" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-LOOPING" name="For future online systems, they may be exposed to using their own output as input data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;There may be unexpected behavior if data output from the future model is directly used as input, which is referred to as looping.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-AVOID-DIRECT-LOOPING" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-MODEL-SKEWING" name="An adversary may be able to slowly retrain the system with malicious introductions" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;In an online system, an attacker might be able to slowly 'retrain' the system to shift its behavior in unintended directions. This might happen if an attacker compromises the feedback loop in the model lifecycle, e.g., MLOps system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML08:2023 Model Skewing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML08_2023-Model_Skewing.html"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-BACKDOORING" name="An adversary may be able to use a base model or an underlying package as a means of attack ('backdooring')" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;If the model is not built from scratch, consider the possibility that the base models might be trojanized. Adversaries may introduce a backdoor by training the model with poisoned data, or injecting a payload into the model.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;The aim is that the model learns to associate an adversary trigger with the adversary's desired output.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="ML06:2023 Corrupted Packages" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML06_2023-Corrupted_Packages.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="33"/>
+                <countermeasure ref="C-ML-AI-TEST-PACKAGES" mitigation="33"/>
+                <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="34"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="df5de558-aa4f-48e5-9a04-6717f7d8e65f" diagramComponentId="21d0de4b-97fc-4446-b0dc-f07be2e5d903" ref="93188c58-de74-4bed-8fb8-21fe54a69945" name="Deployment Setup" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-DEPLOYMENT-SETUP">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-799" name="Improper Control of Interaction Frequency" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly limit the number or frequency of interactions that it has with
+                        an actor, such as the number of incoming requests.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;This can allow the actor to perform actions more frequently than expected. The actor
+                        could be a human or an automated process such as a virus or bot. This could be used to cause a
+                        denial of service, compromise program logic (such as limiting humans to a single vote), or other
+                        consequences. For example, an authentication routine might not limit the number of times an
+                        attacker can guess a password. Or, a web site might conduct a poll but only expect humans to
+                        vote a maximum of once a day.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.737">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-799: Improper Control of Interaction Frequency" url="https://cwe.mitre.org/data/definitions/799.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.733">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-PROTECT-DEPLOYMENT" name="Consider possible defenses at the deployment stage to secure the outputs or the model" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There is an increasing demand for privacy-preserving techniques in ML/AI, at all levels, from training to inference. While there is no silver bullet when it comes to achieving privacy in ML/AI, certain mechanisms can be used to further secure the outputs or the model, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Obfuscation, e.g., especially for shipped/on-device models, as opposed to remote or cloud-hosted models,&lt;/li&gt;
+ &lt;li&gt;Encryption, e.g., homomorphic encryption where training, inference, and output can be based on/generate encrypted data,&lt;/li&gt;
+ &lt;li&gt;Decentralizes the data, such as with federated machine learning that strengthens both input and output privacy,&lt;/li&gt;
+ &lt;li&gt;Added noise or the use of regularization which has been shown to strengthen anonymization without compromising model accuracy.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;A number of ML/AI tools have now integrated privacy-preserving mechanisms such as Tensorflow or PyTorch. There are also tools dedicated to model deployment that can offer security and monitoring features, such as Seldon Core or Evidently.&lt;/p&gt;
+&lt;p&gt;In addition to ML/AI-specific solutions, data engineering solutions can also contribute to supporting output and model privacy. These include strong authentication, authorization, and proxy/token-based access to inference.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Model Serving and Monitoring" url="https://github.com/EthicalML/awesome-production-machine-learning#model-serving-and-monitoring"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
+&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-RECOVERY" name="Models in production should be able to recover to a known state, reset, or be 'cleaned' if necessary" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Make sure to have a failover mechanism and a business continuity plan. Best practices include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Manage your code base locally, backed by a remote repository,&lt;/li&gt;
+ &lt;li&gt;Backup all data, including generated versioned models, important notebooks, and any configuration files,&lt;/li&gt;
+ &lt;li&gt;Automate (script out) deployments, and&lt;/li&gt;
+ &lt;li&gt;Make use of geo-replication for data storage/accounts if you are using your own deployment setup on a Cloud platform.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Disaster Recovery: Best Practices" url="https://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-453495.pdf"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-MONITOR-DRIFT" name="Monitor for model drift by continuously tracking the model's performance metrics in production" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Model drift detection is an active research field. New methods are continuously being proposed in the literature. There are, however, some basic monitoring measures to consider, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Continually monitoring the accuracy of the model when possible, e.g., using F-score,&lt;/li&gt;
+ &lt;li&gt;Use statistical tests to: 
+  &lt;ul&gt;
+   &lt;li&gt;Compare the cumulative distributions of the training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Measure how a variable distribution has changed over time, e.g., Population stability Index, or&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Compare the feature distribution between the training and live data, e.g., Z-score.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Addressing model drift would then involve setting up the right schedule to retrain your model.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Drift detection in the literature - sciencedirect" url="https://www.sciencedirect.com/topics/computer-science/concept-drift-detection"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" name="Restrict the number of model queries" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Define a resource access policy especially to limit the size and frequency of user queries. There are different ways that you can approach rate limiting, especially for APIs. This would involve:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limits focused on controlling traffic from individual sources and making sure that users are staying within their prescribed limits, and&lt;/li&gt;&lt;li&gt;Global limits in relation to all the traffic coming into the system from all sources, and ensure that the overall rate limit (e.g., tested capacity of the system or what makes sense with regard to the model's task) is not exceeded.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Ideally, both are used to secure the system, including against denial of service attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-SECURE-STORAGE" name="Secure data storage" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Take measures to protect storage resources and the data stored on them, both on-premises and externally, e.g., on the cloud. This involves:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Access control to regulate who can use the data. The environment should identify, verify, and authorize a user before they access the data. Additional policies can dictate where the data can be copied and under which conditions.&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Storage encryption, which can be built in by the service provider. Otherwise, on-premise encryption should be considered.&lt;/li&gt;
+ &lt;li&gt;Isolate data from other systems and networks.&lt;/li&gt;
+ &lt;li&gt;Immutable storage as an extra protection layer that can help prevent bad actors from tampering with data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.651">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" name="Sufficiently isolate production models, with proper security controls and monitoring" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;ML/AI models are exposed by nature. The following should be considered when deploying models to production:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Host segregation to allow for more efficient monitoring,&lt;/li&gt;
+ &lt;li&gt;Host protections, e.g., using endpoint security solutions,&lt;/li&gt;
+ &lt;li&gt;Secure configuration and proper maintenance, e.g., patch/vulnerability management,&lt;/li&gt;
+ &lt;li&gt;Proper access control, and&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Minimal exposure of services.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;On the other hand, the user should have a clear understanding of his/her responsibility when using third parties hosted MLOps tools / MLaaS (Machine Learning as a Service) offerings to develop and deploy ML/AI models.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Model Serving and Monitoring" url="https://github.com/EthicalML/awesome-production-machine-learning#model-serving-and-monitoring"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-HOST-COMPROMISE" name="An adversary may be able to exploit the host of the ML/AI system" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Where and how is the model deployed and operating? Attackers might target host servers that are not sufficiently isolated and protected.&lt;br&gt;Note that there is a plethora of tools and platforms (MLOps tools) that are used for model development, deployment, and monitoring (cf. examples in the below reference). This will involve a shared responsibility model with the provider.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="75"/>
+              <references>
+                <reference name="MLOps landscape" url="https://neptune.ai/blog/mlops-tools-platforms-landscape"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ISOLATE-CONTROL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-GARBAGE-DATA" name="Spamming the system with garbage data" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Adversaries may spam the system with data to produce output noise. This may also affect the model behavior in the long run.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-799">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-RESTRICT-QUERIES" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-EXTRACTION" name="An adversary may be able to conduct input inference or model inversion/extraction attacks" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Extraction attacks are quite common and are one of the simplest forms of privacy leakage for ML/AI models. Also called 'inference attacks' or 'model inversion'.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;An attacker might be able to extract details of the data corpus the model was trained on, the inputs (e.g., inferring sensitive data features/input from publicly available results of a model), or the model itself by uncovering its behavior and parameters. This might have serious privacy implications.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="ML03:2023 Model Inversion Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML03_2023-Model_Inversion_Attack.html"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PROTECT-DEPLOYMENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-ERRONEOUS-MODEL" name="An adversary may be able to manipulate online production models" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Online production systems are subject to manipulation or complete shutdown by an ill-intentioned actor, or any other error or failure. Manipulation of online models might involve data provenance and integrity that results in model drift.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references>
+                <reference name="Plan for business continuity and resilience" url="https://www.ready.gov/it-disaster-recovery-plan"/>
+                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-MONITOR-DRIFT" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-RECOVERY" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-MODEL-STEALING" name="An adversary may be able to steal the model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;An attacker may be able to gain access to the model itself or the model's parameters, including via an environment breach. The attacker can use this information to recreate the model.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML05:2023 Model Stealing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML05_2023-Model_Stealing.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="50"/>
+                    <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-SECURE-STORAGE" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="afe71945-8447-45e8-9bec-e8289a74c114" diagramComponentId="e2420090-9deb-49db-8759-61354a6c47de" ref="c80c37c8-4b1a-45e7-95c3-6005285c2b88" name="Model outputs" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="" componentDefinitionRef="CD-ML-AI-MODEL-OUTPUTS">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-300" name="Channel Accessible by Non-Endpoint ('Man-in-the-Middle')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Inadequate or inconsistent verification may result in insufficient or incorrect identification of either communicating entity. This can have negative consequences such as misplaced trust in the entity at the other end of the channel. An attacker can leverage this by interposing between the communicating entities and masquerading as the original entity. In the absence of sufficient verification of an identity, an attacker could potentially eavesdrop and modify &amp;nbsp;communication between the original entities.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.280">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-EXPLAINABILITY" name="Consider improving and providing explainability" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Allowing users to comprehend and trust the results of the model does not only help transparency, but the overall security of the system as well.&amp;nbsp;&lt;br&gt;Certain models are explainable by nature, e.g., decision trees, but many others are not. Making inherently opaque models explainable can be done via a number of techniques, called post-hoc explainability techniques, such as:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Learning to generate text explanations,&lt;/li&gt;
+ &lt;li&gt;Visualize the model's behavior vi dimensionality reduction for instance,&lt;/li&gt;
+ &lt;li&gt;Segmenting the solution space into less complex solution subspaces,&lt;/li&gt;
+ &lt;li&gt;Extracting representative examples of the inner relationships and correlations found by the model,&lt;/li&gt;
+ &lt;li&gt;Compute the relevance score of features which would unveil the importance granted by the model to each of the variables.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="&quot;Why Should I Trust You?&quot;: Explaining the Predictions of Any Classifier" url="https://arxiv.org/abs/1602.04938"/>
+            <reference name="Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI" url="https://arxiv.org/abs/1910.10045"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" name="Harden the data and feedback pipeline" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data pipelines are at the heart of building a robust data practice. It includes the processing of the data, triggering model retraining, notifying when feedback/ metric is received/ reached, etc.&lt;/p&gt;
+&lt;p&gt;When considering data and feedback collectors in a production environment, there are several aspects to ensure the security of the deployment. Best practices and considerations include:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Secure encrypted end-to-end communication,&lt;/li&gt;
+ &lt;li&gt;User identity management,&lt;/li&gt;
+ &lt;li&gt;Secure credentials,&lt;/li&gt;
+ &lt;li&gt;Audit and log activities,&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Limit the exposure of the automation stages, e.g., scripts that perform data and feedback transformations,&lt;/li&gt;
+ &lt;li&gt;Secure storage, and&lt;/li&gt;
+ &lt;li&gt;Secure streaming system and pipeline.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Depending on your use case and infrastructure, you will have several options for data orchestration, including cloud-based options, such as AWS Glue or Azure Data Factory, among others.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Building a secure data pipeline in AWS Glue" url="https://docs.aws.amazon.com/whitepapers/latest/aws-glue-best-practices-build-secure-data-pipeline/building-a-secure-data-pipeline.html"/>
+            <reference name="Security considerations for data movement in Azure Data Factory" url="https://learn.microsoft.com/en-us/azure/data-factory/data-movement-security-considerations"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-MONITOR-DRIFT" name="Monitor for model drift by continuously tracking the model's performance metrics in production" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Model drift detection is an active research field. New methods are continuously being proposed in the literature. There are, however, some basic monitoring measures to consider, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Continually monitoring the accuracy of the model when possible, e.g., using F-score,&lt;/li&gt;
+ &lt;li&gt;Use statistical tests to: 
+  &lt;ul&gt;
+   &lt;li&gt;Compare the cumulative distributions of the training data and the post-training data, e.g., Kolmogorov-Smirnov test,&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Measure how a variable distribution has changed over time, e.g., Population stability Index, or&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Compare the feature distribution between the training and live data, e.g., Z-score.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Addressing model drift would then involve setting up the right schedule to retrain your model.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Drift detection in the literature - sciencedirect" url="https://www.sciencedirect.com/topics/computer-science/concept-drift-detection"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-MODEL-DRIFT" name="Model drift may occur when the data changes becoming unstable and producing unreliable predictions" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Model drift is one of the most prominent issues in ML/AI deployments. It represents the decay of the model's predictive power as a result of the changes in real-world conditions or attacks introducing malicious shifts in the distribution of training data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="Understand model drift" url="https://datatron.com/what-is-model-drift/"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-MONITOR-DRIFT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-MITM-MODEL-OUTPUT" name="An adversary may be able to interpose between the model output and the intended receiver" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Output integrity might be hard to verify given the black-box model most data-driven systems operate in. An attacker might be able to execute a man-in-the-middle type of attack and hijack the model output without alerting the end user or even the model publisher monitoring the system&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML09:2023 Output Integrity Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML09_2023-Output_Integrity_Attack.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-300">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-HARDEN-DATA-PIPELINE" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-OPACITY" name="Opaque systems may less accepted and make it easier for adversaries to inject erroneous outputs" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Interpretability and transparency might not be the main concerns initially, given that accuracy is what the data engineer would look for the most. This, however, makes attacks a much easier endeavor, since it will be harder to discern if anything has gone wrong. Additionally, the lack of transparency and/or the impossibility of interpretable outputs by humans is likely to increase skepticism about ML/AI systems. &amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="75" availability="25" easeOfExploitation="75"/>
+              <references>
+                <reference name="Artificial intelligence, transparency, and public decision-making" url="https://link.springer.com/article/10.1007/s00146-020-00960-w"/>
+                <reference name="What is explainable AI" url="https://www.ibm.com/watson/explainable-ai"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-EXPLAINABILITY" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3d36f35c-336e-4b99-ab42-8fecd30a6941" diagramComponentId="0fc01628-45e1-4af1-be15-b9bfe22f3242" ref="d5efa9cf-fe64-4ee1-bb46-4db4e978c37d" name="Out Of Scope" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="out-of-scope">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+    <component uuid="6d28e216-ecbd-4255-ab8d-b09dedbf879d" diagramComponentId="44ffbffc-8caa-4f65-bbe9-a327faa5c8ec" ref="a4358da6-d80b-485c-b27c-2313a9e9e45d" name="Simulator Service. Predicted actions, e.g., buy/sell" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.444">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.864">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.445">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.210">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.863">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.421">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.208">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.582">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.446">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.762">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.763">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.209">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.564">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.952">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.&lt;/p&gt;&lt;p&gt;One of the ways to enforce this is by following the deny-by-default principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny-by-default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from untrusted data in logs" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.563">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.531">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.567">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.564">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.565">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.566">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.954">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.378">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:06.565">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.698">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.956">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.&lt;/p&gt;&lt;p&gt;Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.227">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.226">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:07.225">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
+                    <countermeasure ref="CWE-662" mitigation="16"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
+                    <countermeasure ref="security-logging" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
+                <countermeasure ref="CWE-662" mitigation="16"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
+                <countermeasure ref="security-logging" mitigation="16"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="df631004-6ac9-405d-ac55-39c9fe623577" diagramComponentId="fbe5a8dd-a845-4f24-8c65-4057af728d1c" ref="bc3f8050-e04c-4f35-95f6-e4290a8cfa2a" name="Trade Service" desc="" library="CS-Default" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="generic-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.492">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.199">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.494">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.198">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:01.968">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.873">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.200">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.244">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.493">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.557">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.559">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.560">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.561">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.875">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.841">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.512">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.&lt;/p&gt;&lt;p&gt;One of the ways to enforce this is by following the deny-by-default principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny-by-default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from untrusted data in logs" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.839">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.175">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.5" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API4:2023-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.515">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Actions to do:&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;&lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Log considerations:&lt;ul&gt;&lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2023-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.32" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.841">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="8.15" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.513">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.514">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:01.816">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="24" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API3:2023-Broken Object Property Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:02.410">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:03.516">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.&lt;/p&gt;&lt;p&gt;Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
+                    <countermeasure ref="CWE-662" mitigation="16"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
+                    <countermeasure ref="security-logging" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="20"/>
+                <countermeasure ref="CWE-662" mitigation="16"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="16"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="16"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="16"/>
+                <countermeasure ref="security-logging" mitigation="16"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1f594d5a-0d4d-4ab7-af41-acc5d5cc76e5" diagramComponentId="771bf9fc-1e87-4c36-9920-6a090b06ab6b" ref="4d33876c-2161-4cc7-875c-e6dd1667d7b9" name="Trained Model" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="CD-ML-AI-TRAINED-MODEL">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-506" name="Embedded Malicious Code" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains code that appears to be malicious in
+                        nature.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-359" name="Exposure of Private Information ('Privacy Violation')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.059">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-MODEL-CHOICE" name="Carefully consider the model choice" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Models can be built using different approaches or algorithms. Overall, choosing the right algorithm depends on several factors, including business considerations, data size, accuracy, training time, parameters, and inference performance, among others.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;In general, the right choice is typically a combination of these aspects. In terms of security, however, the main algorithmic concern is about the nature of the data, where certain algorithms are more vulnerable to data leaks than others.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Depending on your privacy concerns, and/or compliance considerations, e.g., GPDR, &amp;nbsp;consider auditing the data privacy of the models under consideration, e.g., using tools like Privacy Meter.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Privacy Meter" url="https://github.com/privacytrustlab/ml_privacy_meter"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.984">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" name="Consider possible trojanized versions when acquiring shared models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Never assume what you are downloading is safe! Malicious actors often use trojanized versions of popular applications in an effort to steal information and compromise systems.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;In this case, you might be fine-tuning a model with possibly a Trojan that includes sneaky behavior that is unanticipated.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Basic practices include carefully checking the source of the model, as well as using cryptographic methods like digital signatures and secure hashes to verify the authenticity and file integrity.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Verify Downloaded Files" url="https://www.digitalocean.com/community/tutorials/how-to-verify-downloaded-files"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" name="Consider privacy-preserving techniques and strategies" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Privacy-preserving or privacy-enhancing techniques are designed to prevent the exposure of the model and data.&lt;/p&gt;
+&lt;p&gt;First, there are two types of access an adversary might have; 1) White Box, where information about the model or its original training data is available, and 2) Black Box, where there is no knowledge about the model or data. In this case, attackers would explore the model by providing carefully crafted inputs and observing outputs.&lt;/p&gt;
+&lt;p&gt;There are a number of attack types, which involve inferring information about the model and data, e.g., model inversion or membership inference.&lt;/p&gt;
+&lt;p&gt;Some of the defenses aiming to protect confidentiality and privacy in ML/AI-based systems are:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Differential Privacy: one of the state-of-the-art methods for providing access to information free from inferences. There are two main privacy-preserving model-training approaches in the literature: 1) using noisy stochastic gradient descent (noisy SGD), and 2) Private Aggregation of Teacher Ensembles (PATE).&lt;/li&gt;
+ &lt;li&gt;Cryptography; e.g., privacy-enhancing tools based on secure multi-party computation (SMC) and fully homomorphic encryption (FHE) have been proposed to securely train supervised machine learning models.&lt;/li&gt;
+ &lt;li&gt;Trusted environments (engineering/setup solution).&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Other techniques in this space include dropout, weight normalization, dimensionality reduction, selective gradient sharing, etc.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="An Overview of Privacy in Machine Learning" url="https://arxiv.org/pdf/2005.08679.pdf"/>
+            <reference name="ML03:2023 Model Inversion Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML03_2023-Model_Inversion_Attack.html"/>
+            <reference name="ML04:2023 Membership Inference Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML04_2023-Membership_Inference_Attack.html"/>
+            <reference name="ML05:2023 Model Stealing" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML05_2023-Model_Stealing.html"/>
+            <reference name="Privacy Preserving ML" url="https://github.com/EthicalML/awesome-production-machine-learning#privacy-preserving-ml"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-KEEP-LOGS" name="Keep a history of queries to the model" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Keeping a history of queries to the system is highly recommended. Logging user interaction with the model is not only a powerful tool for user research (behavior study, usability, system metrics analysis, etc.) but will also allow reviews to make sure the system is not unintentionally leaking confidential information.&amp;nbsp;&lt;br&gt;Care must be taken on how you store the logs! Logging can itself introduce a security/privacy risk.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top seven logging and monitoring best practices" url="https://www.synopsys.com/blogs/software-security/logging-and-monitoring-best-practices/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.984">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PROTECT-SHARED" name="Protect data and IP when sharing or shipping models" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Models sharing or shipping can be treated the same as software delivery and protection:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Consider training data as traditional source code.&lt;/li&gt;
+ &lt;li&gt;Consider the model files as compiled executables.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;A number of mechanisms/options can be used, including:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Encryption, e.g., for on-device models, only unpacking in memory when the model is running,&lt;/li&gt;
+ &lt;li&gt;Obfuscation, e.g., adding random noise to existing samples, or augmenting the dataset with new samples,&amp;nbsp;&lt;/li&gt;
+ &lt;li&gt;Copyright traps, or&lt;/li&gt;
+ &lt;li&gt;Confidential computing, e.g., built-in hardware-based security.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="ML Model Watermarking" url="https://github.com/SAP/ml-model-watermarking"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:05.985">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-SHARING-TRANSFER" name="An adversary may take advantage of model sharing and/or transfer" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Models storage and transfer may lead to the possibility that what is being reused may be a Trojaned (or otherwise damaged) version of the model. This risk is more pronounced in the case of using ready-to-use models.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML06:2023 Corrupted Packages" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML06_2023-Corrupted_Packages.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-PROTECT-SHARED" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-506">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PROTECT-SHARED" mitigation="50"/>
+                <countermeasure ref="C-ML-AI-TROJANIZED-VERSIONS" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-PRIVACY" name="An adversary may be able to reveal sensitive information available in the model or the data used to build it" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;ML/AI models incorporate information and representations of the data ingested during training, some of which might be sensitive.&lt;br&gt;Algorithm choice might be a key factor to limit the risk, e.g., using a non-parametric method like k-nearest neighbors in a situation with sensitive medical records is probably a bad idea since exemplars will have to be stored on production hosts.&amp;nbsp;&lt;br&gt;In general, however, remember that any model is susceptible to memorizing information present within the training sets.&amp;nbsp;&lt;br&gt;You should also be aware of what outputs the model is producing and how it may reveal sensitive aspects of the training data, e.g., using monitoring.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="An Overview of Privacy in Machine Learning" url="https://arxiv.org/pdf/2005.08679.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-359">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-KEEP-LOGS" mitigation="33"/>
+                    <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="33"/>
+                    <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-KEEP-LOGS" mitigation="33"/>
+                <countermeasure ref="C-ML-AI-MODEL-CHOICE" mitigation="33"/>
+                <countermeasure ref="C-ML-AI-PRIVACY-PRESERVING" mitigation="34"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ce54bad8-7bcc-40d9-8e11-b7c4b19edaa9" diagramComponentId="a1d03bae-e6b7-42ce-8ccd-8b97d0e7cd38" ref="239ba369-2d9f-4e4c-8129-d86e8da7d042" name="Users Input" desc="" library="IR-Machine-Learning-Artificial-Intelligence" parentComponentRef="93188c58-de74-4bed-8fb8-21fe54a69945" componentDefinitionRef="CD-ML-AI-USERS-INPUT">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.525">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-ML-AI-ADVERSARIAL-ATTACKS" name="Consider defenses against adversarial tampering such as adversarial training methods or data preprocessing-based approaches" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Adversarial attacks and defenses are an active and rapidly growing research area. Thousands of research papers have been published in recent years (1200 in 2022!) documenting both attacks and defense techniques. These, however, can be classified into the following categories of defenses:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Model-oriented, including: 
+  &lt;ul&gt;
+   &lt;li&gt;Robustness improvement for models, e.g., adversarial training methods,&amp;nbsp;&lt;/li&gt;
+   &lt;li&gt;Adversarial attack detection, e.g., detect adversarial perturbations of commonly used attack methods, and&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+ &lt;li&gt;Data-oriented: essentially preprocessing functions: e.g., input cleansing or denoising.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Depending on the domain area and the underlying ML/AI framework used, there are a number of tools that can help assess models against adversarial threats, including adversarial tampering. These include the Adversarial Robustness Toolbox, DeepRobust, or AutoAttack.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey" url="https://arxiv.org/abs/2303.06302"/>
+            <reference name="Adversarial Robustness Toolbox (ART)" url="https://adversarial-robustness-toolbox.readthedocs.io/en/latest/"/>
+            <reference name="Adversarial Robustness Tools" url="https://github.com/EthicalML/awesome-production-machine-learning#adversarial-robustness"/>
+            <reference name="AutoAttack" url="https://github.com/fra31/auto-attack"/>
+            <reference name="DeepRobust" url="https://github.com/DSE-MSU/DeepRobust"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-ACCESS-CONTROL" name="Control the access to data, models, and components" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;On the back-end/ server side, there should be strong controls on who has access to the model, its code and data, and related components and materials (such as designs, or test and validation plans).&lt;/p&gt;
+&lt;p&gt;On the client side, users of the model should be authenticated before the system allows them access to using the model.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="A01:2021 – Broken Access Control - How to Prevent?" url="https://owasp.org/Top10/A01_2021-Broken_Access_Control/"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-INPUT-VALIDATION" name="Perform input validation by applying anomaly detection" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;This can be considered as part of the data preprocessing functions already mentioned in the overall defenses against adversarial tampering, except that it would attempt to validate the input without further processing.&lt;/p&gt;
+&lt;p&gt;Anomaly detection can be a powerful defense mechanism in this case. It would allow to model the distribution of the clean data, i.e., expected values or patterns, and consequently allows to (potentially) reject anomalous inputs that are likely to be malicious.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Anomaly Detection Learning Resources" url="https://github.com/yzhao062/anomaly-detection-resources"/>
+            <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
+            <reference name="Outlier and Anomaly Detection" url="https://github.com/EthicalML/awesome-production-machine-learning#outlier-and-anomaly-detection"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ML-AI-PROTECT-DATA-STREAMS" name="Protect the data stream and consider multiple independent sensors if possible" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;By design, input data will be structured and pre-processed similarly to the training data to be ingested by the model and make predictions. Protecting this input data stream and processing is of prime importance.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;Options include using a multi-modal input stream/system which will be harder to completely control. One way to carry this out might be to use multiple sensors that are not similarly designed or that do not have the same engineering failure conditions.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-07T14:34:06.476">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="IR-Machine-Learning-Artificial-Intelligence">
+          <threats>
+            <threat ref="T-ML-AI-INPUT-STREAM" name="An adversary may take control of the input stream/pipeline" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;An ML/AI system that takes its input data from open and potentially unprotected sources may be purposefully manipulated or completely controlled by an attacker. If the data is used in retraining, the model will take in the poisoned/manipulated data and produce incorrect predictions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="75"/>
+              <references>
+                <reference name="ML02:2023 Data Poisoning Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML02_2023-Data_Poisoning_Attack.html"/>
+              </references>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-PROTECT-DATA-STREAMS" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="T-ML-AI-ADVERSARIAL-EXAMPLES" name="An adversary may input adversarial examples to the deployed model" state="Expose" source="RULES" edited="false" owner="laouad" library="IR-Machine-Learning-Artificial-Intelligence" editable="true">
+              <desc>&lt;p&gt;Probably the most prevalent attack type on ML/AI models. &amp;nbsp;Adversarial examples are specially crafted inputs with the purpose of confusing a model, resulting essentially in misclassification. Making false predictions as a result of these perturbations will render the model useless.&amp;nbsp;&lt;/p&gt;
+&lt;p&gt;In the age of large language models, this includes prompt injection, where input text may trick the system into ignoring instructions, performing unintended actions, or even executing malicious code or instructions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="LLM01: Prompt Injection (LLM OWASP Top 10)" url="https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_0_1.pdf"/>
+                <reference name="ML01:2023 Input Manipulation Attack" url="https://owasp.org/www-project-machine-learning-security-top-10/docs/ML01_2023-Input_Manipulation_Attack.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="C-ML-AI-INPUT-VALIDATION" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-ML-AI-ACCESS-CONTROL" mitigation="34"/>
+                <countermeasure ref="C-ML-AI-ADVERSARIAL-ATTACKS" mitigation="33"/>
+                <countermeasure ref="C-ML-AI-INPUT-VALIDATION" mitigation="33"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="cf231b15-b15a-48b0-8f14-752222084701" diagramComponentId="29d8f192-35e8-479d-8bfd-3455f4d3cbe5" ref="ea7cf3e2-8fc6-4dcb-aa4a-f1c1a9d9a987" name="Web UI" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-ui">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software includes web functionality (such as a web widget)
+                        from another domain, which causes it to operate within the domain of the
+                        software, potentially granting total access and control of the software to the
+                        untrusted source.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.162">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Review periodically all assets which are accessed by the application and ensure that these
+                        assets are hosted by the application. If this is not the case and there are assets in external
+                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
+                        from external providers or CDNs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
+          </references>
+          <standards>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all assets are hosted by the application, and not by external providers.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:04.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="laouad" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="c1" value="default"/>
+            <customField ref="c2" value=""/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-11-06T15:20:05.041">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="general" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="laouad" library="CS-Default" editable="true">
+              <desc>Web applications typically make extensive use of 3rd party web resources such as
+                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
+                                repositories, or even Content Delivery Networks that host these libraries, then they
+                                could gain access to applications that use this content.
+                                &lt;div&gt;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-830">
+                  <countermeasures>
+                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="202030957" value=""/>
+                <customField ref="cfThreat" value=""/>
+                <customField ref="qa" value=""/>
+                <customField ref="safety" value=""/>
+                <customField ref="threat_custom_field_qa" value=""/>
+                <customField ref="threat_custom_field_qa_1" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/mobile-client-to-kubernetes-cluster-with-istio.xml b/Templates/Submitted_Templates/mobile-client-to-kubernetes-cluster-with-istio.xml
new file mode 100644
index 0000000..c88c660
--- /dev/null
+++ b/Templates/Submitted_Templates/mobile-client-to-kubernetes-cluster-with-istio.xml
@@ -0,0 +1,17032 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="Mobile Client to Kubernetes cluster with Istio" name="Mobile Client to Kubernetes cluster with Istio" tags="Community">
+  <desc>&lt;p&gt;AWS RDS + KUB&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjY2NSIgZHk9IjIwNjgiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNC4zLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIxNyIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTI0IiB5PSItNzg5IiB3aWR0aD0iMjY4IiBoZWlnaHQ9IjQxOSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTc5IiB2YWx1ZT0iTW9iaWxlIERldmljZSBDbGllbnQgKFRoaW4pIiBzdHlsZT0iaXIucmVmPTc0ODY4MTVlLTFlMDMtNDNkMC1iNDI3LTY0MzdkMTI4NjM3Zjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1tb2JpbGUtZGV2aWNlLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0ek5UQTJNamNnTUM0eE1qazJNemxETUM0eU9UZzBNak1nTUM0eE1qazJNemtnTUM0eU5UWXhNRFFnTUM0eE56RTVOVGdnTUM0eU5UWXhNRFFnTUM0eU1qUXhOakZXTUM0M09URXlPVGRETUM0eU5UWXhNRFFnTUM0NE5ETTFNREVnTUM0eU9UZzBNak1nTUM0NE9EVTRNaUF3TGpNMU1EWXlOeUF3TGpnNE5UZ3lTREF1TmpNME1UazJRekF1TmpnMk16azVJREF1T0RnMU9ESWdNQzQzTWpnM01Ua2dNQzQ0TkRNMU1ERWdNQzQzTWpnM01Ua2dNQzQzT1RFeU9UZFdNQzR5TWpReE5qRkRNQzQzTWpnM01Ua2dNQzR4TnpFNU5UZ2dNQzQyT0RZek9Ua2dNQzR4TWprMk16a2dNQzQyTXpReE9UWWdNQzR4TWprMk16bElNQzR6TlRBMk1qZGFUVEF1TXpJMk9UazJJREF1TWpFeU16UTJRekF1TXpJMk9UazJJREF1TVRrNU1qazFJREF1TXpNM05UYzJJREF1TVRnNE56RTFJREF1TXpVd05qSTNJREF1TVRnNE56RTFTREF1TmpNME1UazJRekF1TmpRM01qUTNJREF1TVRnNE56RTFJREF1TmpVM09ESTNJREF1TVRrNU1qazFJREF1TmpVM09ESTNJREF1TWpFeU16UTJWakF1TnpNeU1qSXhRekF1TmpVM09ESTNJREF1TnpRMU1qY3hJREF1TmpRM01qUTNJREF1TnpVMU9EVXhJREF1TmpNME1UazJJREF1TnpVMU9EVXhTREF1TXpVd05qSTNRekF1TXpNM05UYzJJREF1TnpVMU9EVXhJREF1TXpJMk9UazJJREF1TnpRMU1qY3hJREF1TXpJMk9UazJJREF1TnpNeU1qSXhWakF1TWpFeU16UTJXazB3TGpRMk5EZzBNaUF3TGpnMU1ETTNORU13TGpRME9UWXhOaUF3TGpnMU1ETTNOQ0F3TGpRek56STNNeUF3TGpnek9EQXpJREF1TkRNM01qY3pJREF1T0RJeU9EQTBRekF1TkRNM01qY3pJREF1T0RBM05UYzRJREF1TkRRNU5qRTJJREF1TnprMU1qTTFJREF1TkRZME9EUXlJREF1TnprMU1qTTFTREF1TlRFNU9UaERNQzQxTXpVeU1EWWdNQzQzT1RVeU16VWdNQzQxTkRjMU5TQXdMamd3TnpVM09DQXdMalUwTnpVMUlEQXVPREl5T0RBMFF6QXVOVFEzTlRVZ01DNDRNemd3TXlBd0xqVXpOVEl3TmlBd0xqZzFNRE0zTkNBd0xqVXhPVGs0SURBdU9EVXdNemMwU0RBdU5EWTBPRFF5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNREF3TWpRME1UUXhJREF1TURFMU16Z3dPU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtkYXNoZWQ9MTsiIHBhcmVudD0iMTciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODAiIHk9IjExMiIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9Ik1vYmlsZSBEZXZpY2UgQ2xpZW50IChUaGluKSAtPiBBV1MgQVBJIEdhdGV3YXkiIHN0eWxlPSJpci5yZWY9MzQ1Njg3ZmYtNmNlNy00NjNmLTgwOTAtZGE0Yjk5YjkzZmNjO2VuZEFycm93PWNsYXNzaWM7aHRtbD0xO2ZvbnRDb2xvcj0jRkYzMzMzO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2N1cnZlZD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0tMC4wMzM7ZW50cnlZPTAuNTc4O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMSIgc291cmNlPSIxNzkiIHRhcmdldD0iNiIgZWRnZT0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgd2lkdGg9IjUwIiBoZWlnaHQ9IjUwIiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItMjU1IiB5PSItNTc5IiBhcz0ic291cmNlUG9pbnQiLz48bXhQb2ludCB4PSIzMCIgeT0iLTYxNiIgYXM9InRhcmdldFBvaW50Ii8+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjI1MSIgdmFsdWU9IlB1YmxpYyBDbG91ZCIgc3R5bGU9ImlyLnJlZj1iNjFkNjkxMS0zMzhkLTQ2YTgtOWYzOS04ZGNkMjRhYmZlOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTE5MSIgeT0iLTExMjYiIHdpZHRoPSIxMDk1IiBoZWlnaHQ9Ijk2MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNiIgdmFsdWU9IkFXUyBBUEkgR2F0ZXdheSIgc3R5bGU9ImlyLnJlZj03NTE3ZjM2Ni05MDk2LTRlOTUtYmQ3Yy0wZjRhNzM3ZmQxZGE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJORFkzTmpjZ01DNDRNakF3TnpGRE1DNDJORE01TkRNZ01DNDRNakF3T0RFZ01DNDJOREV4T0RnZ01DNDRNVGt4T1RRZ01DNDJNemc1TURFZ01DNDRNVGMxTXpkRE1DNDJNemN4TnpnZ01DNDRNVFl6TVNBd0xqWXpOVGMzTVNBd0xqZ3hORFk1TVNBd0xqWXpORGM1TnlBd0xqZ3hNamd4TTBNd0xqWXpNemd5TkNBd0xqZ3hNRGt6TlNBd0xqWXpNek14TVNBd0xqZ3dPRGcxTXlBd0xqWXpNek13TVNBd0xqZ3dOamN6TjFZd0xqRTVNelF3TkVNd0xqWXpNek14SURBdU1Ua3hNVEkxSURBdU5qTXpPVEEwSURBdU1UZzRPRGczSURBdU5qTTFNREkwSURBdU1UZzJPVEF6UXpBdU5qTTJNVFEwSURBdU1UZzBPVEU1SURBdU5qTTNOelUxSURBdU1UZ3pNalUxSURBdU5qTTVOekF4SURBdU1UZ3lNRGN4UXpBdU5qUXhOalk1SURBdU1UZ3dOemszSURBdU5qUXpPVE0zSURBdU1UZ3dNRFkxSURBdU5qUTJNamM0SURBdU1UYzVPVFE0UXpBdU5qUTROakU1SURBdU1UYzVPRE14SURBdU5qVXdPVFE1SURBdU1UZ3dNek16SURBdU5qVXpNRE0wSURBdU1UZ3hOREEwVERBdU9ESTJNelkzSURBdU1qWTJNRGN4UXpBdU9ESTROVGt4SURBdU1qWTNNVFlnTUM0NE16QTBOamdnTUM0eU5qZzRORGNnTUM0NE16RTNPRFlnTUM0eU56QTVORE5ETUM0NE16TXhNRFVnTUM0eU56TXdNemtnTUM0NE16TTRNVFFnTUM0eU56VTBOakVnTUM0NE16TTRNelFnTUM0eU56YzVNemRXTUM0M05Ea3hNemRETUM0NE16TTVOemNnTUM0M05USXdOakVnTUM0NE16TXhOVFFnTUM0M05UUTVOVEVnTUM0NE16RTBPVEVnTUM0M05UY3pOakZETUM0NE1qazRNamdnTUM0M05UazNOekVnTUM0NE1qYzBNVGtnTUM0M05qRTFOallnTUM0NE1qUTJNelFnTUM0M05qSTBOekZNTUM0Mk5URXpNREVnTUM0NE1qQXdOekZETUM0Mk5EazNPVGNnTUM0NE1qQXlPRGNnTUM0Mk5EZ3lOekVnTUM0NE1qQXlPRGNnTUM0Mk5EWTNOamNnTUM0NE1qQXdOekZhVFRBdU5qWXdNVEF4SURBdU1qRTBPRGN4VmpBdU56ZzRNakEwVERBdU9EQTJOelkzSURBdU56TTVOVE0zVmpBdU1qZzJNakEwVERBdU5qWXdNVEF4SURBdU1qRTBPRGN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMak0xTXpRek15QXdMamd5TURBM1F6QXVNelV5TURFM0lEQXVPREl3TWpZeklEQXVNelV3TlRneUlEQXVPREl3TWpZeklEQXVNelE1TVRZMklEQXVPREl3TURkTU1DNHhOelU0TXpNZ01DNDNOakkwTjBNd0xqRTNNekEzTXlBd0xqYzJNVFUwTXlBd0xqRTNNRFk1TXlBd0xqYzFPVGN6TnlBd0xqRTJPVEExTmlBd0xqYzFOek16UXpBdU1UWTNOREU1SURBdU56VTBPVEl5SURBdU1UWTJOakUwSURBdU56VXlNRFExSURBdU1UWTJOelkySURBdU56UTVNVE0zVmpBdU1qYzNPVE0zUXpBdU1UWTJOemcySURBdU1qYzFORFl4SURBdU1UWTNORGsxSURBdU1qY3pNRE01SURBdU1UWTRPREUwSURBdU1qY3dPVFF6UXpBdU1UY3dNVE16SURBdU1qWTRPRFEzSURBdU1UY3lNREE1SURBdU1qWTNNVFlnTUM0eE56UXlNek1nTUM0eU5qWXdOekZNTUM0ek5EYzFOallnTUM0eE9ERTBNRFJETUM0ek5EazJOVEVnTUM0eE9EQXpNek1nTUM0ek5URTVPREVnTUM0eE56azRNekVnTUM0ek5UUXpNaklnTUM0eE56azVORGhETUM0ek5UWTJOak1nTUM0eE9EQXdOalVnTUM0ek5UZzVNeklnTUM0eE9EQTNPVGNnTUM0ek5qQTRPVGtnTUM0eE9ESXdOekZETUM0ek5qSTRNakVnTUM0eE9ETXlOekVnTUM0ek5qUTBNRFVnTUM0eE9EUTVORElnTUM0ek5qVTFNREVnTUM0eE9EWTVNalZETUM0ek5qWTFPVGdnTUM0eE9EZzVNRGdnTUM0ek5qY3hOekVnTUM0eE9URXhNemdnTUM0ek5qY3hOallnTUM0eE9UTTBNRFJXTUM0NE1EWTNNemRETUM0ek5qY3hOVFlnTUM0NE1EZzROVElnTUM0ek5qWTJORE1nTUM0NE1UQTVNelVnTUM0ek5qVTJOeUF3TGpneE1qZ3hNME13TGpNMk5EWTVOaUF3TGpneE5EWTVNU0F3TGpNMk16STRPU0F3TGpneE5qTXhJREF1TXpZeE5UWTJJREF1T0RFM05UTTNRekF1TXpVNU1qTTBJREF1T0RFNU16QTFJREF1TXpVMk16VTNJREF1T0RJd01qQXlJREF1TXpVek5ETXpJREF1T0RJd01EZFdNQzQ0TWpBd04xcE5NQzR4T1RNME16TWdNQzQzTkRBd04wd3dMak0wTURFZ01DNDNPRGczTXpkV01DNHlNVFUwTURSTU1DNHhPVE0wTXpNZ01DNHlPRGN3TURSV01DNDNOREF3TjFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpNeU56SWdNQzR6TmpZMk16SklNQzQxT1RNeU56SldNQzR6TXprNU5qWklNQzQyTXpNeU56SldNQzR6TmpZMk16SmFUVEF1TlRVek1qY3lJREF1TXpZMk5qTXlTREF1TlRFek1qY3lWakF1TXpNNU9UWTJTREF1TlRVek1qY3lWakF1TXpZMk5qTXlXazB3TGpRM016STNNaUF3TGpNMk5qWXpNa2d3TGpRek16STNNbFl3TGpNek9UazJOa2d3TGpRM016STNNbFl3TGpNMk5qWXpNbHBOTUM0ek9UTXlOekVnTUM0ek5qWTJNekpJTUM0ek5UTXlOekZXTUM0ek16azVOalpJTUM0ek9UTXlOekZXTUM0ek5qWTJNekphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOak16TWpjeUlEQXVOall3TURnNVNEQXVOVGt6TWpjeVZqQXVOak16TkRJelNEQXVOak16TWpjeVZqQXVOall3TURnNVdrMHdMalUxTXpJM01pQXdMalkyTURBNE9VZ3dMalV4TXpJM01sWXdMall6TXpReU0wZ3dMalUxTXpJM01sWXdMalkyTURBNE9WcE5NQzQwTnpNeU56SWdNQzQyTmpBd09EbElNQzQwTXpNeU56SldNQzQyTXpNME1qTklNQzQwTnpNeU56SldNQzQyTmpBd09EbGFUVEF1TXprek1qY3hJREF1TmpZd01EZzVTREF1TXpVek1qY3hWakF1TmpNek5ESXpTREF1TXprek1qY3hWakF1TmpZd01EZzVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTBNVFV5SURBdU5UUTFPVE5NTUM0ek9URXpPRFlnTUM0MU1ETXhNME13TGpNNE9Ua3lNeUF3TGpVd01UZzNPQ0F3TGpNNE9EYzBPQ0F3TGpVd01ETXlOQ0F3TGpNNE56azBNaUF3TGpRNU9EVTNOVU13TGpNNE56RXpOaUF3TGpRNU5qZ3lOaUF3TGpNNE5qY3hPU0F3TGpRNU5Ea3lNeUF3TGpNNE5qY3hPU0F3TGpRNU1qazVOME13TGpNNE5qY3hPU0F3TGpRNU1UQTNNU0F3TGpNNE56RXpOaUF3TGpRNE9URTJPQ0F3TGpNNE56azBNaUF3TGpRNE56UXhPRU13TGpNNE9EYzBPQ0F3TGpRNE5UWTJPU0F3TGpNNE9Ua3lNeUF3TGpRNE5ERXhOU0F3TGpNNU1UTTROaUF3TGpRNE1qZzJNMHd3TGpRME1UTTROaUF3TGpRME1EQTJNMHd3TGpRMU9EY3lJREF1TkRZd016Tk1NQzQwTWpBMU9EWWdNQzQwT1RNek9UZE1NQzQwTlRnM01pQXdMalV5TmpBMk0wd3dMalEwTVRVeUlEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRVNE56STJJREF1TlRRMU9UTk1NQzQxTkRFek9UTWdNQzQxTWpVMk5qTk1NQzQxTnprMU1qVWdNQzQwT1RNek9UZE1NQzQxTkRFeU5pQXdMalEyTURnMk0wd3dMalUxT0RVNU15QXdMalEwTURBMk0wd3dMall3T0RjeU5TQXdMalE0TWpjelF6QXVOakV3TVRnNElEQXVORGd6T1RneUlEQXVOakV4TXpZeklEQXVORGcxTlRNMklEQXVOakV5TVRZNUlEQXVORGczTWpnMVF6QXVOakV5T1RjMUlEQXVORGc1TURNMElEQXVOakV6TXpreUlEQXVORGt3T1RNNElEQXVOakV6TXpreUlEQXVORGt5T0RZelF6QXVOakV6TXpreUlEQXVORGswTnpnNUlEQXVOakV5T1RjMUlEQXVORGsyTmpreklEQXVOakV5TVRZNUlEQXVORGs0TkRReVF6QXVOakV4TXpZeklEQXVOVEF3TVRreElEQXVOakV3TVRnNElEQXVOVEF4TnpRMUlEQXVOakE0TnpJMUlEQXVOVEF5T1RrM1REQXVOVFU0TnpJMklEQXVOVFExT1ROYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TlRFek5qZzVJREF1TkRFM01qSTJUREF1TkRZd05qa3pJREF1TlRjek9UYzFUREF1TkRnMU9UVTFJREF1TlRneU5URTFUREF1TlRNNE9UVXhJREF1TkRJMU56WTNUREF1TlRFek5qZzVJREF1TkRFM01qSTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHeHBibVZoY2tkeVlXUnBaVzUwSUdsa1BTSndZV2x1ZERCZmJHbHVaV0Z5SWlCNE1UMGlMVEF1TWpBM01EWTNJaUI1TVQwaU1TNHlNRGN4TVNJZ2VESTlJakV1TWpBM01UVWlJSGt5UFNJdE1DNHlNRGN4TURjaUlHZHlZV1JwWlc1MFZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJajRtSTNoaE96eHpkRzl3SUhOMGIzQXRZMjlzYjNJOUlpTTBSREkzUVRnaUx6NG1JM2hoT3p4emRHOXdJRzltWm5ObGREMGlNU0lnYzNSdmNDMWpiMnh2Y2owaUkwRXhOalpHUmlJdlBpWWplR0U3UEM5c2FXNWxZWEpIY21Ga2FXVnVkRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzYiIHk9IjQ0OSIgd2lkdGg9Ijg1IiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMjUiIHZhbHVlPSJBV1MgQVBJIEdhdGV3YXkgLT4gQVdTIEVMQiAoRWxhc3RpYyBMb2FkIEJhbGFuY2VyKSIgc3R5bGU9ImlyLnJlZj0xMDk1OTAzMC0xYWMzLTRkODEtOGQzYi1iYmU3M2ZkNmYwZjk7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyNTEiIHNvdXJjZT0iNiIgdGFyZ2V0PSIxNDgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNTAiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIyNTEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTg0IiB5PSI4MyIgd2lkdGg9Ijg4NiIgaGVpZ2h0PSI4MjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI0MCIgdmFsdWU9Ik9BdXRoMiBBdXRob3JpemF0aW9uIFNlcnZlciIgc3R5bGU9ImlyLnJlZj04MjRhZDczNC1kZGYxLTRiYmUtOTU5MC01ODcyYTNhYmY2Mzk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b2F1dGgyLWF1dGhvcml6YXRpb24tc2VydmVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RRd05UZzRJREF1TkRnME16Z3hRekF1T0RRd05UZzRJREF1TWpnM09Ua2dNQzQyT0RFek9ESWdNQzR4TWpnM09EUWdNQzQwT0RRNU9URWdNQzR4TWpnM09EUkRNQzR5T0RnMk1ERWdNQzR4TWpnM09EUWdNQzR4TWprek9UVWdNQzR5T0RjNU9TQXdMakV5T1RNNU5TQXdMalE0TkRNNE1VTXdMakV5T1RNNU5TQXdMalk0TURjM01pQXdMakk0T0RZd01TQXdMamd6T1RrM09DQXdMalE0TkRrNU1TQXdMamd6T1RrM09FTXdMalV3TmpFeE5TQXdMamd6T1RrM09DQXdMalV5Tmpnd09DQXdMamd6T0RFek5pQXdMalUwTmpreUlEQXVPRE0wTmpBMFF6QXVOVE0yTlRReklEQXVPREl5TURnMElEQXVOVEkzTmpNeUlEQXVPREE0TXpBMElEQXVOVEl3TkRVZ01DNDNPVE0xTTBNd0xqVXdPRGd4TXlBd0xqYzVORGcxSURBdU5EazJPVGd4SURBdU56azFOVEk0SURBdU5EZzBPVGt4SURBdU56azFOVEk0UXpBdU16RXpNVFVnTUM0M09UVTFNamdnTUM0eE56TTRORFFnTUM0Mk5UWXlNak1nTUM0eE56TTRORFFnTUM0ME9EUXpPREZETUM0eE56TTRORFFnTUM0ek1USTFNemtnTUM0ek1UTXhOU0F3TGpFM016SXpOQ0F3TGpRNE5EazVNU0F3TGpFM016SXpORU13TGpZMU5qZ3pNeUF3TGpFM016SXpOQ0F3TGpjNU5qRXpPU0F3TGpNeE1qVXpPU0F3TGpjNU5qRXpPU0F3TGpRNE5ETTRNVU13TGpjNU5qRXpPU0F3TGpRNU5qWTJJREF1TnprMU5ESTRJREF1TlRBNE56Y3pJREF1TnprME1EUTBJREF1TlRJd05qaERNQzQ0TURnM09UZ2dNQzQxTWpjNU1ETWdNQzQ0TWpJMU5UTWdNQzQxTXpZNE5URWdNQzQ0TXpVd05EWWdNQzQxTkRjeU5qSkRNQzQ0TXpnMk9EZ2dNQzQxTWpZNE5USWdNQzQ0TkRBMU9EZ2dNQzQxTURVNE16Z2dNQzQ0TkRBMU9EZ2dNQzQwT0RRek9ERmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTXpnMU1ERWdNQzQwTURJek1EZERNQzQyTkRjeE9DQXdMak01TXpZeU9DQXdMalkwTnpFNElEQXVNemM1TlRVMklEQXVOak00TlRBeElEQXVNemN3T0RjM1F6QXVOakk1T0RJeElEQXVNell5TVRrM0lEQXVOakUxTnpRNUlEQXVNell5TVRrM0lEQXVOakEzTURjZ01DNHpOekE0TnpkTU1DNDBNamN5TURjZ01DNDFOVEEzTkV3d0xqTTJNamt4TXlBd0xqUTROalEwTmtNd0xqTTFOREl6TkNBd0xqUTNOemMyTmlBd0xqTTBNREUyTWlBd0xqUTNOemMyTmlBd0xqTXpNVFE0TWlBd0xqUTROalEwTmtNd0xqTXlNamd3TXlBd0xqUTVOVEV5TlNBd0xqTXlNamd3TXlBd0xqVXdPVEU1TnlBd0xqTXpNVFE0TWlBd0xqVXhOemczTmt3d0xqUXhNVFE1TWlBd0xqVTVOemc0TlVNd0xqUXlNREUzTVNBd0xqWXdOalUyTlNBd0xqUXpOREkwTXlBd0xqWXdOalUyTlNBd0xqUTBNamt5TWlBd0xqVTVOemc0TlV3d0xqWXpPRFV3TVNBd0xqUXdNak13TjFvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNaWtpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM05ERXpJREF1TlRNek56SkRNQzQzTnpZeE5EVWdNQzQxTWpneU5qRWdNQzQ0TWpnek5EY2dNQzQxTmpZM09Ea2dNQzQ0TlRneE9UWWdNQzQyTVRNM016RkRNQzQ0TnpNeE5qTWdNQzQyTXpjeU5qY2dNQzQ0T0RjNE5EY2dNQzQyTnpNd01UUWdNQzQ0T0RjNU1UVWdNQzQzTURrM05EUkRNQzQ0T0RjNU9EY2dNQzQzTkRrMk5URWdNQzQ0TnpVd05Ua2dNQzQzT0RReU1TQXdMamcxT0RFNU5pQXdMamd3T1RVMk4wTXdMamcwTURnMk5pQXdMamd6TlRZeU9TQXdMamd4T0RRME9DQXdMamcxTnpFMU5TQXdMamM1TURNM09DQXdMamczTVRJNE9VTXdMamMwTXpRMU5pQXdMamc1TkRreE55QXdMalkzTnpnNElEQXVPRGsxTlRZeklEQXVOak0wT1RJNUlEQXVPRGN5T0RFMFF6QXVOVGczTURrMElEQXVPRFEzTkRjNElEQXVOVFV3TXpFMUlEQXVPREV4TXpFM0lEQXVOVE0yTmpNZ01DNDNORGcyTURWRE1DNDFNekV4TlRNZ01DNDNNak0xTURrZ01DNDFNekExTWpNZ01DNDJPVEV3T0RJZ01DNDFNemd4TlRNZ01DNDJOak15TmpGRE1DNDFNems1TkRRZ01DNDJOVFkzTXpVZ01DNDFORE14T1RnZ01DNDJORGs0TmpZZ01DNDFORFUzTnpRZ01DNDJORE0wTkRsRE1DNDFOVGd4TlRJZ01DNDJNVEkyTVNBd0xqVTNPVEl5TVNBd0xqVTROVGM1TlNBd0xqWXdOVEl4SURBdU5UWTNNalE0UXpBdU5qRTFOalUwSURBdU5UVTVOemsxSURBdU5qSTRNekl6SURBdU5UVXlNemd6SURBdU5qTTVOVEF4SURBdU5UUTNORE0yUXpBdU5qVXpOREE1SURBdU5UUXhNamdnTUM0Mk56WTRNalVnTUM0MU16VXhORGNnTUM0Mk9UYzBNVE1nTUM0MU16TTNNbG9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRORFk0TkRrZ01DNDNNVFF4T1RkRE1DNDRORFk0TkRrZ01DNDNPRGcyTURjZ01DNDNPRFkxTWprZ01DNDRORGc1TWpRZ01DNDNNVEl4TWpFZ01DNDRORGc1TWpSRE1DNDJNemMzTVRJZ01DNDRORGc1TWpRZ01DNDFOemN6T1RNZ01DNDNPRGcyTURjZ01DNDFOemN6T1RNZ01DNDNNVFF4T1RkRE1DNDFOemN6T1RNZ01DNDJNemszT0RrZ01DNDJNemMzTVRJZ01DNDFOemswTmpnZ01DNDNNVEl4TWpFZ01DNDFOemswTmpoRE1DNDNPRFkxTWpnZ01DNDFOemswTmpnZ01DNDRORFk0TkRrZ01DNDJNemszT0RrZ01DNDRORFk0TkRrZ01DNDNNVFF4T1RkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprM09UQXhJREF1TlRNek56SkRNQzQzTnpZMk16SWdNQzQxTWpneU5qRWdNQzQ0TWpnNE16VWdNQzQxTmpZM09Ea2dNQzQ0TlRnMk9EUWdNQzQyTVRNM016RkRNQzQ0TnpNMk5TQXdMall6TnpJMk55QXdMamc0T0RNek5TQXdMalkzTXpBeE5DQXdMamc0T0RRd01pQXdMamN3T1RjME5FTXdMamc0T0RRM05TQXdMamMwT1RZMU1TQXdMamczTlRVME55QXdMamM0TkRJeElEQXVPRFU0TmpnMElEQXVPREE1TlRZM1F6QXVPRFF4TXpVeklEQXVPRE0xTmpJNUlEQXVPREU0T1RNMklEQXVPRFUzTVRVMUlEQXVOemt3T0RZMklEQXVPRGN4TWpsRE1DNDNORE01TkRRZ01DNDRPVFE1TVRjZ01DNDJOemd6TmpnZ01DNDRPVFUxTmpNZ01DNDJNelUwTVRZZ01DNDROekk0TVRSRE1DNDFPRGMxT0RJZ01DNDRORGMwTnprZ01DNDFOVEE0TURRZ01DNDRNVEV6TVRjZ01DNDFNemN4TVRnZ01DNDNORGcyTURaRE1DNDFNekUyTkRFZ01DNDNNak0xTURrZ01DNDFNekV3TVRJZ01DNDJPVEV3T0RNZ01DNDFNemcyTkRJZ01DNDJOak15TmpKRE1DNDFOREEwTXpJZ01DNDJOVFkzTXpVZ01DNDFORE0yT0RZZ01DNDJORGs0TmpjZ01DNDFORFl5TmpJZ01DNDJORE0wTlVNd0xqVTFPRFkwSURBdU5qRXlOakV4SURBdU5UYzVOekE1SURBdU5UZzFOemsxSURBdU5qQTFOams1SURBdU5UWTNNalE0UXpBdU5qRTJNVFF5SURBdU5UVTVOemsySURBdU5qSTRPREV5SURBdU5UVXlNemcwSURBdU5qTTVPVGc1SURBdU5UUTNORE0yUXpBdU5qVXpPRGszSURBdU5UUXhNamdnTUM0Mk56Y3pNVE1nTUM0MU16VXhORGNnTUM0Mk9UYzVNREVnTUM0MU16TTNNbHBOTUM0Mk56RXlNeUF3TGpVME5qWTNORU13TGpZME1UazROeUF3TGpVMU5ESTFOaUF3TGpZeU1EVTBOU0F3TGpVMk56Z3pPU0F3TGpZd01UZzRPQ0F3TGpVNE1qUTRPRU13TGpVM05EazROU0F3TGpZd016WXhNaUF3TGpVMU56Z3pOQ0F3TGpZek16QTVNU0F3TGpVME56YzROaUF3TGpZMk9EVTVORU13TGpVek5qWXdOeUF3TGpjd09EQTVOQ0F3TGpVME16YzRPQ0F3TGpjMU5UZzVNeUF3TGpVMU9USXhOaUF3TGpjNE5UazBNME13TGpVM05USXhOaUF3TGpneE56RXdOeUF3TGpVNU5qWTVPQ0F3TGpnME1USTVOeUF3TGpZeU56QXpOQ0F3TGpnMU9ETXpORU13TGpZMU5qVTBPU0F3TGpnM05Ea3dPU0F3TGpZNU9EQTJJREF1T0RnMU5UVXhJREF1TnpReE16TTNJREF1T0RjM016ZzBRekF1TnpjNU56ZzFJREF1T0Rjd01USTRJREF1T0RBNE9UZzNJREF1T0RVek16YzRJREF1T0RNeU56YzNJREF1T0RJNE5qRTJRekF1T0RZME5qQTFJREF1TnprMU5EZzFJREF1T0Rrd01UZzJJREF1TnpNME5EWXlJREF1T0Rjek1UWTBJREF1Tmpjd01URTVRekF1T0RZNE5qRXlJREF1TmpVeU9USXlJREF1T0RZeU5qWTBJREF1TmpNME9UazVJREF1T0RVek16VXhJREF1TmpFNU9ESTJRekF1T0RRNE16SWdNQzQyTVRFMk15QXdMamcwTURrek5TQXdMall3TXpVMk5TQXdMamd6TXpVek9TQXdMalU1TlRRME1rTXdMamd3TlRZeU1pQXdMalUyTkRjNE5DQXdMamMyTURVd01TQXdMalV6T0RNMk5TQXdMamN3TWpRM05DQXdMalUwTWpFd01VTXdMalk1TVRReklEQXVOVFF5T0RFeUlEQXVOamd4TnpJMUlEQXVOVFF6T1RVeklEQXVOamN4TWpNZ01DNDFORFkyTnpSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNak01TlRjZ01DNDFPVFl4T0RKRE1DNDRNRGs1TkRVZ01DNDFPREl4TnlBd0xqYzVNamN4T0NBd0xqVTJPVFUwTXlBd0xqYzNNakUwSURBdU5UWXhPRGt4UXpBdU56VXdPREV4SURBdU5UVXpPVFlnTUM0M01qWTJPRElnTUM0MU5EY3lOelFnTUM0Mk9UZ3lNallnTUM0MU5EazJPVGxETUM0Mk5USTRPVFlnTUM0MU5UTTFOaklnTUM0Mk1qRXdOamdnTUM0MU56TTVNREVnTUM0MU9UWTROemtnTUM0MU9UYzNNRFZETUM0MU56azVNellnTUM0Mk1UUXpOemdnTUM0MU5qY3hPVEVnTUM0Mk16UTRNRGtnTUM0MU5UZzNOemtnTUM0Mk5UZzJOalpETUM0MU5EWTBNamNnTUM0Mk9UTTJPVFVnTUM0MU5EY3hOemNnTUM0M016VXdOREVnTUM0MU5qRXdOalVnTUM0M056QTJPREZETUM0MU56STVNVElnTUM0NE1ERXdPRElnTUM0MU9USXpNREVnTUM0NE1qVTJNRElnTUM0Mk1UazNNemtnTUM0NE5EUTFPVFpETUM0Mk5EVTFNek1nTUM0NE5qSTBOVE1nTUM0Mk9ESTFOVFFnTUM0NE56WXpNRE1nTUM0M01qUXhNelFnTUM0NE56STNPVEZETUM0M056UTNOemNnTUM0NE5qZzFNVE1nTUM0NE1URTRNeklnTUM0NE5ESTFNekVnTUM0NE16WXhORGdnTUM0NE1USTFPVEpETUM0NE5ESXpOamtnTUM0NE1EUTVNek1nTUM0NE5EZzFOVFlnTUM0M09UWXlOelVnTUM0NE5USXhOU0F3TGpjNE5Ua3lNa013TGpnMU5UWTNNaUF3TGpjM09EUTJNU0F3TGpnMU56TTVOU0F3TGpjM016TTVNU0F3TGpnMU9UQXdPQ0F3TGpjM01EWTRNVU13TGpnMk5UYzJNU0F3TGpjMU5UVTBPQ0F3TGpnMk9UTTBNU0F3TGpjek9UVTRJREF1T0Rjd05ETTNJREF1TnpJeE9URXpRekF1T0Rjek9ERTFJREF1TmpZM05UYzJJREF1T0RVeU9UQTRJREF1TmpJMU1UTXpJREF1T0RJek9UVTNJREF1TlRrMk1UZ3lXazB3TGpnd09UQXpNU0F3TGpjMk1UY3pNa013TGpnd09Ea3pOU0F3TGpjMk1Ua3pPU0F3TGpnd09EZzBPU0F3TGpjMk1qRXpNaUF3TGpnd09EYzBOeUF3TGpjMk1qTTBORU13TGpnd05qSXpOU0F3TGpjMk9UVXpOQ0F3TGpnd01Ua3dOaUF3TGpjM05UVTBOU0F3TGpjNU56VTFPQ0F3TGpjNE1EZzJOVU13TGpjNE1EVTFJREF1T0RBeE5qVXpJREF1TnpVME5qTTVJREF1T0RFNU5qazFJREF1TnpFNU1qSXpJREF1T0RJeU5qWTJRekF1Tmprd01UUTFJREF1T0RJMU1UQXpJREF1TmpZME1qVTJJREF1T0RFMU5EZzNJREF1TmpRMk1qRTRJREF1T0RBek1EZzNRekF1TmpNd05UUTBJREF1TnpreU16RXlJREF1TmpFNE5qSTVJREF1TnpjNE9UYzBJREF1TmpFd01qYzBJREF1TnpZeU9UUTFRekF1TmpBNU56WTBJREF1TnpZeE9UZ2dNQzQyTURRNU1USWdNQzQzTlRBNE1ESWdNQzQyTURRNE9UZ2dNQzQzTlRBek1EbERNQzQxT1RneU56a2dNQzQzTWprM056Z2dNQzQxT1RjM01EUWdNQzQyT1RZM05qWWdNQzQyTURRME9UZ2dNQzQyTnpZNU5UUkRNQzQyTURrd016RWdNQzQyTmpNM016TWdNQzQyTVRZMU9EZ2dNQzQyTkRrME1qWWdNQzQyTWpZMU9UVWdNQzQyTXpnd09USkRNQzQyTkRBME1UTWdNQzQyTWpJME5ESWdNQzQyTlRReU5ERWdNQzQyTVRJME1UUWdNQzQyTnpZeE1qWWdNQzQyTURVek1qWkRNQzQyT0RZeE1Ua2dNQzQyTURJd09Ea2dNQzQyT1RVd05qUWdNQzQxT1RnM09UVWdNQzQzTURjek5qZ2dNQzQxT1RnME5qaERNQzQzTXpjek56SWdNQzQxT1RjMk5qa2dNQzQzTmpjNU1qWWdNQzQyTVRFeE5DQXdMamM0TkRNek1TQXdMall5TlRsRE1DNDNPVGswTURjZ01DNDJNemswTmpNZ01DNDRNVFkxT0RnZ01DNDJOalU0T0RNZ01DNDRNakE1TURnZ01DNDJPVEEyTjBNd0xqZ3lOVE0xTlNBd0xqY3hOakU0TXlBd0xqZ3lNRFl4SURBdU56UXhNRGt5SURBdU9EQTVNRE14SURBdU56WXhOek15V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qSXdNall4SURBdU5qQTJPVGhNTUM0Mk1qQXlNVGNnTUM0Mk1EWTVNakZETUM0Mk1UVTRPRFVnTUM0Mk1EQTVPRElnTUM0Mk1UY3hOVFlnTUM0MU9USTJOelVnTUM0Mk1qTTFNemdnTUM0MU9EZ3dNVGhETUM0Mk1qazVNVGtnTUM0MU9ETXpOaUF3TGpZek9ERXhOeUF3TGpVNE5EWTJOeUF3TGpZME1qUTFJREF1TlRrd05qQTJUREF1TmpReU5Ea3pJREF1TlRrd05qWTBRekF1TmpRMk9ESTJJREF1TlRrMk5qQXpJREF1TmpRMU5UVTFJREF1TmpBME9URXhJREF1TmpNNU1UY3pJREF1TmpBNU5UWTRRekF1TmpNeU56a3hJREF1TmpFME1qSTFJREF1TmpJME5UazBJREF1TmpFeU9URTVJREF1TmpJd01qWXhJREF1TmpBMk9UaGFUVEF1TmpNMk5qZzNJREF1TlRrME9Ua3pUREF1TmpNMk5qUXpJREF1TlRrME9UTTBRekF1TmpNME5EWTJJREF1TlRreE9UVWdNQzQyTXpBME1USWdNQzQxT1RBNU1qUWdNQzQyTWpjeU5URWdNQzQxT1RNeU16RkRNQzQyTWpReE1pQXdMalU1TlRVeE5pQXdMall5TXpnM05pQXdMalU1T1RVNE9DQXdMall5TmpBMU15QXdMall3TWpVM01rd3dMall5TmpBNU5pQXdMall3TWpZek1VTXdMall5T0RJM05TQXdMall3TlRZeE5DQXdMall6TWpNeU9DQXdMall3TmpZME1TQXdMall6TlRRMU9TQXdMall3TkRNMU5rTXdMall6T0RZeU1TQXdMall3TWpBME9TQXdMall6T0RnMk5DQXdMalU1TnprM055QXdMall6TmpZNE55QXdMalU1TkRrNU0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5qRTVNak1nTUM0MU5qZ3dNRGhNTUM0Mk5qZzBNellnTUM0MU5qVTVNVGhNTUM0Mk9EWTJPVElnTUM0MU9EY3hOREZNTUM0Mk56azBORGdnTUM0MU9EazBOalZNTUM0Mk56WXlOellnTUM0MU9EVTJPREZNTUM0Mk5qWTROeklnTUM0MU9EZzJPVGxNTUM0Mk5qWTFNamdnTUM0MU9UTTJNVEZNTUM0Mk5UazBNalFnTUM0MU9UVTRPVXd3TGpZMk1Ua3lNeUF3TGpVMk9EQXdPRnBOTUM0Mk56STJNemdnTUM0MU9ERXdORGxNTUM0Mk5qYzJPVGdnTUM0MU56UTVPVXd3TGpZMk56RTNJREF1TlRneU9EQXpUREF1TmpjeU5qTTRJREF1TlRneE1EUTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTVPRGN6TVNBd0xqVTNORFF6TTB3d0xqWTVPRGM0T0NBd0xqVTJNREExT1V3d0xqY3dOVGs1TXlBd0xqVTJNREE0TjB3d0xqY3dOVGt6TnlBd0xqVTNORE14TlVNd0xqY3dOVGt5TWlBd0xqVTNPREF3T1NBd0xqY3dOemM0SURBdU5UYzVOemN5SURBdU56RXdOak0wSURBdU5UYzVOemcwUXpBdU56RXpORGczSURBdU5UYzVOemsxSURBdU56RTFNelU0SURBdU5UYzRNVElnTUM0M01UVXpOeklnTUM0MU56UTFNelpNTUM0M01UVTBNeUF3TGpVMk1ERXlOVXd3TGpjeU1qWXpOU0F3TGpVMk1ERTFORXd3TGpjeU1qVTNPU0F3TGpVM05ETTBOVU13TGpjeU1qVTBOeUF3TGpVNE1qWXhNU0F3TGpjeE56Z3hOQ0F3TGpVNE5qSXhNeUF3TGpjeE1EVXpOU0F3TGpVNE5qRTRORU13TGpjd016STFOaUF3TGpVNE5qRTFOU0F3TGpZNU9EWTVPU0F3TGpVNE1qUTBNeUF3TGpZNU9EY3pNU0F3TGpVM05EUXpNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNORGd6TVRJZ01DNDFOekU1TURsTU1DNDNOREE1TmpjZ01DNDFOamsyTmpoTU1DNDNOREkzT0RFZ01DNDFOak0zTWpGTU1DNDNOalF5TlRnZ01DNDFOekF5TnpaTU1DNDNOakkwTkRVZ01DNDFOell5TWpKTU1DNDNOVFV3T1RnZ01DNDFOek01T0RGTU1DNDNORGswTXprZ01DNDFPVEkxTWt3d0xqYzBNalkxTXlBd0xqVTVNRFEwT1V3d0xqYzBPRE14TWlBd0xqVTNNVGt3T1ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzT0RNM01UWWdNQzQxTnpnMk1UTk1NQzQzT0RrMk1qTWdNQzQxT0RJMU5EUk1NQzQzT0RRek1UVWdNQzQxT1RBMU1qSk1NQzQzT1RFNE9UY2dNQzQxT1RVMU5qZE1NQzQzT1RjeU1EWWdNQzQxT0RjMU9EbE1NQzQ0TURNeE1UUWdNQzQxT1RFMU1qRk1NQzQzT0RnNU1qa2dNQzQyTVRJNE16Wk1NQzQzT0RNd01qRWdNQzQyTURnNU1EUk1NQzQzT0RnME1TQXdMall3TURnd05Vd3dMamM0TURneU9TQXdMalU1TlRjMU9Vd3dMamMzTlRRek9TQXdMall3TXpnMU9Fd3dMamMyT1RVek1TQXdMalU1T1RreU4wd3dMamM0TXpjeE5pQXdMalUzT0RZeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0NE1EUXlNallnTUM0NE1URTJORE5NTUM0NE1EUXlOamtnTUM0NE1URTNNREZETUM0NE1EZzRNamNnTUM0NE1UYzBOeUF3TGpnd056ZzNNeUF3TGpneU5UZ3lNU0F3TGpnd01UWTNOQ0F3TGpnek1EY3hPRU13TGpjNU5UUTNOaUF3TGpnek5UWXhOaUF3TGpjNE56SXpNeUF3TGpnek5EWXlNeUF3TGpjNE1qWTNOU0F3TGpneU9EZzFORXd3TGpjNE1qWXpNU0F3TGpneU9EYzVOa013TGpjM09EQTNNeUF3TGpneU16QXlOeUF3TGpjM09UQXlOeUF3TGpneE5EWTNOaUF3TGpjNE5USXlOaUF3TGpnd09UYzNPVU13TGpjNU1UUXlOQ0F3TGpnd05EZzRNeUF3TGpjNU9UWTJPQ0F3TGpnd05UZzNOU0F3TGpnd05ESXlOaUF3TGpneE1UWTBNMXBOTUM0M09EZ3lOamNnTUM0NE1qUXlOVXd3TGpjNE9ETXhNaUF3TGpneU5ETXdPRU13TGpjNU1EWXdNaUF3TGpneU56SXdOeUF3TGpjNU5EWTVNaUF3TGpneU9EQTNPQ0F3TGpjNU56YzJOQ0F3TGpneU5UWTFNVU13TGpnd01EZ3dOaUF3TGpneU16STBPQ0F3TGpnd01EZzVOQ0F3TGpneE9URTJPU0F3TGpjNU9EWXdOQ0F3TGpneE5qSTNNVXd3TGpjNU9EVTFPQ0F3TGpneE5qSXhNME13TGpjNU5qSTJPU0F3TGpneE16TXhOU0F3TGpjNU1qRTNPQ0F3TGpneE1qUTBOQ0F3TGpjNE9URXpOeUF3TGpneE5EZzBOME13TGpjNE5qQTJOU0F3TGpneE56STNOQ0F3TGpjNE5UazNPQ0F3TGpneU1UTTFNU0F3TGpjNE9ESTJOeUF3TGpneU5ESTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzJORE0xTmlBd0xqZzFNakU0TkV3d0xqYzFOemswTWlBd0xqZzFORFUxTjB3d0xqY3pPRGMzSURBdU9ETTBNVFU1VERBdU56UTFPVEF6SURBdU9ETXhOVEU0VERBdU56UTVNak01SURBdU9ETTFNVFU0VERBdU56VTROVEF4SURBdU9ETXhOek5NTUM0M05UZzJNamdnTUM0NE1qWTRNRGxNTUM0M05qVTJNalVnTUM0NE1qUXlNVGxNTUM0M05qUXpOVFlnTUM0NE5USXhPRFJhVFRBdU56VXpNRGM0SURBdU9ETTVOakkzVERBdU56VTRNamdnTUM0NE5EVTBOak5NTUM0M05UZzBOak1nTUM0NE16YzJNek5NTUM0M05UTXdOemdnTUM0NE16azJNamRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOekkzTmprMElEQXVPRFEzTXpjeFREQXVOekk0TXpJM0lEQXVPRFl4TnpNeVREQXVOekl4TVRJNElEQXVPRFl5TURWTU1DNDNNakExTURJZ01DNDRORGM0TXpWRE1DNDNNakF6TXpnZ01DNDRORFF4TkRVZ01DNDNNVGd6T1RnZ01DNDROREkwTnpRZ01DNDNNVFUxTkRnZ01DNDROREkxT1RsRE1DNDNNVEkyT1RjZ01DNDROREkzTWpVZ01DNDNNVEE1TURnZ01DNDRORFEwT0RrZ01DNDNNVEV3TmpZZ01DNDRORGd3TmpsTU1DNDNNVEUzTURJZ01DNDROakkwTmpWTU1DNDNNRFExTURRZ01DNDROakkzT0ROTU1DNDNNRE00TnpnZ01DNDRORGcyTURaRE1DNDNNRE0xTVRNZ01DNDROREF6TkRnZ01DNDNNRGd3TmpjZ01DNDRNelkxTWpJZ01DNDNNVFV6TXpnZ01DNDRNell5TURKRE1DNDNNakkyTURrZ01DNDRNelU0T0NBd0xqY3lOek0wSURBdU9ETTVNelk1SURBdU56STNOamswSURBdU9EUTNNemN4V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkzTnpVeElEQXVPRFV4T1RnNFREQXVOamcwT1RJMklEQXVPRFV6T1RsTU1DNDJPRE16TURVZ01DNDROVGs1T1RSTU1DNDJOakUyTWpFZ01DNDROVFF4TkV3d0xqWTJNekkwTWlBd0xqZzBPREV6Tmt3d0xqWTNNRFkxT0NBd0xqZzFNREV6T0V3d0xqWTNOVGN4SURBdU9ETXhOREl4VERBdU5qZ3lOVFl4SURBdU9ETXpNamN4VERBdU5qYzNOVEVnTUM0NE5URTVPRGhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalF5TlRReklEQXVPRFEyT0RBMlREQXVOak0yTkRVMklEQXVPRFF6TVRVNVREQXVOalF4TXpneklEQXVPRE0wT1RNNVREQXVOak16TlRjeElEQXVPRE13TWpVMlREQXVOakk0TmpRMUlEQXVPRE00TkRjMlREQXVOakl5TlRVNUlEQXVPRE0wT0RJNFREQXVOak0xTnpJeUlEQXVPREV5T0RZMlREQXVOalF4T0RBNElEQXVPREUyTlRFMVREQXVOak0yT0RBMklEQXVPREkwT0RaTU1DNDJORFEyTVRnZ01DNDRNamsxTkROTU1DNDJORGsyTWlBd0xqZ3lNVEU1TjB3d0xqWTFOVGN3TnlBd0xqZ3lORGcwTlV3d0xqWTBNalUwTXlBd0xqZzBOamd3TmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRjNU5Ua2dNQzQzT0RFMk56WldNQzQzTmpBeE5UaE1NQzQyTnpjMk1EWWdNQzQzTkRJek9ESkRNQzQzTVRBNE1UY2dNQzQzTVRJMk56Z2dNQzQzTWpZNU5UWWdNQzQyT1RVMk1EUWdNQzQzTWpjME1qVWdNQzQyTnpjNE1qbERNQzQzTWpjME1qVWdNQzQyTmpVME16TWdNQzQzTVRrNU5DQXdMalkxTlRZd09TQXdMamN3TWpNNU9DQXdMalkxTlRZd09VTXdMalk0T1RNd01TQXdMalkxTlRZd09TQXdMalkzTnpnMElEQXVOall5TVRVNElEQXVOalk1T0RnM0lEQXVOalk0TWpNNVREQXVOalU1T0RNZ01DNDJOREkzTkRaRE1DNDJOekV5T1RFZ01DNDJNelF3T1RJZ01DNDJPRGt3TmpZZ01DNDJNamN3TnpVZ01DNDNNRGsyTkRrZ01DNDJNamN3TnpWRE1DNDNORFF3TXpFZ01DNDJNamN3TnpVZ01DNDNOakk1TnpZZ01DNDJORGN4T0RrZ01DNDNOakk1TnpZZ01DNDJOelEzT0RsRE1DNDNOakk1TnpZZ01DNDNNREF5T0RNZ01DNDNORFEwT1RrZ01DNDNNakEyTXpFZ01DNDNNakkxTVRNZ01DNDNOREF5TnpoTU1DNDNNRGcwT0NBd0xqYzFNVGszTTFZd0xqYzFNalEwTVVnd0xqYzJOVGM0TTFZd0xqYzRNVFkzTjBnd0xqWTFOemsxT1ZZd0xqYzRNVFkzTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOemNpSUdobGFXZG9kRDBpTUM0M055SWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNVEl3TVRFM0lEQXVNVEU1T1RrMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RJaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVNellpSUdobGFXZG9kRDBpTUM0ek5pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOVE13TURJNUlEQXVOVE13TURJNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjU3IiB5PSIzMzUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjE2IiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIiBzdHlsZT0iaXIucmVmPTM1NjUyYTljLTcxOGItNGU5OC1iYjVjLWY1ZWQ3NzY0ZTdlYjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIyNDAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9Ii03NSIgeT0iLTYyMS45MTE5MjQxMTkyNDExIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjU3IiB2YWx1ZT0iU2VydmljZSBtZXNoIChJc3RpbykgLT4gU29tcnlzdC1BUEkiIHN0eWxlPSJpci5yZWY9MTM1MzE1YWEtYmU3MC00NDcxLWJhNGEtYjI4ZTJhMjZjZDM4O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjE5MiIgdGFyZ2V0PSIzMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE0OCIgdmFsdWU9IkFXUyBFTEIgKEVsYXN0aWMgTG9hZCBCYWxhbmNlcikiIHN0eWxlPSJpci5yZWY9MDI1MzJjZjctZWU0Yy00NWZkLWFjNzItOGQwNDlkYmNiMmQwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWxvYWQtYmFsYW5jZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNVWd4VmpCYUlpQm1hV3hzUFNKMWNtd29JM0JoYVc1ME1GOXNhVzVsWVhJcElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOakEwTnpRZ01DNDFNVE15TjBNd0xqWTJNemd5TkNBd0xqVXpNemd6TmlBd0xqWTNORGM1TkNBd0xqVTFNak00T0NBd0xqWTVNVElnTUM0MU5qVXlNelJETUM0M01EYzJNRGNnTUM0MU56Z3dPQ0F3TGpjeU9ESTBPQ0F3TGpVNE5ESTRJREF1TnpRNU1ERTNJREF1TlRneU5rTXdMamMyT1RjNE55QXdMalU0TURreE9TQXdMamM0T1RFMk15QXdMalUzTVRRNE1pQXdMamd3TXpJNUlEQXVOVFUyTVRZMVF6QXVPREUzTkRFNElEQXVOVFF3T0RRNElEQXVPREkxTWpZeUlEQXVOVEl3TnpjMElEQXVPREkxTWpZeUlEQXVORGs1T1RNMlF6QXVPREkxTWpZeUlEQXVORGM1TURrNUlEQXVPREUzTkRFNElEQXVORFU1TURJMUlEQXVPREF6TWprZ01DNDBORE0zTURoRE1DNDNPRGt4TmpNZ01DNDBNamd6T1RFZ01DNDNOamszT0RjZ01DNDBNVGc1TlRNZ01DNDNORGt3TVRjZ01DNDBNVGN5TnpORE1DNDNNamd5TkRnZ01DNDBNVFUxT1RJZ01DNDNNRGMyTURjZ01DNDBNakUzT1RJZ01DNDJPVEV5SURBdU5ETTBOak00UXpBdU5qYzBOemswSURBdU5EUTNORGcxSURBdU5qWXpPREkwSURBdU5EWTJNRE0ySURBdU5qWXdORGMwSURBdU5EZzJOakF6U0RBdU5UWXhNREE0UXpBdU5UVTVORFkxSURBdU5EWXlNRFUwSURBdU5UVXpNVEl6SURBdU5ETTRNRFExSURBdU5UUXlNelF4SURBdU5ERTFPVE0yVERBdU5qWXlNelF4SURBdU16RTBORFk1UXpBdU5qYzNNRFkySURBdU16STJNVEl6SURBdU5qazFNekV4SURBdU16TXlORE0wSURBdU56RTBNRGtnTUM0ek16SXpOME13TGpjek1qZzJPU0F3TGpNek1qTXdOeUF3TGpjMU1UQTNJREF1TXpJMU9EY3hJREF1TnpZMU56RTJJREF1TXpFME1URTRRekF1Tnpnd016WXhJREF1TXpBeU16WTBJREF1Tnprd05UZzBJREF1TWpnMU9UZzRJREF1TnprME56RXlJREF1TWpZM05qWTRRekF1TnprNE9EUWdNQzR5TkRrek5EZ2dNQzQzT1RZMk1qa2dNQzR5TXpBeE55QXdMamM0T0RRMElEQXVNakV6TWpjeFF6QXVOemd3TWpVZ01DNHhPVFl6TnpJZ01DNDNOalkxTmpnZ01DNHhPREkzTlRJZ01DNDNORGsyTXpFZ01DNHhOelEyTkVNd0xqY3pNalk1TlNBd0xqRTJOalV5T1NBd0xqY3hNelV3TnlBd0xqRTJORFF3TlNBd0xqWTVOVEl3TmlBd0xqRTJPRFl4TjBNd0xqWTNOamt3TmlBd0xqRTNNamd5T1NBd0xqWTJNRFUzTnlBd0xqRTRNekV5TnlBd0xqWTBPRGc1SURBdU1UazNPREkzUXpBdU5qTTNNakEwSURBdU1qRXlOVEkySURBdU5qTXdPRFV5SURBdU1qTXdOelUzSURBdU5qTXdPRGMwSURBdU1qUTVOVE0yUXpBdU5qTXdOekU0SURBdU1qWTFOak0ySURBdU5qTTFNellnTUM0eU9ERTBNVGNnTUM0Mk5EUXlNRGdnTUM0eU9UUTROamxNTUM0MU1qZ3lNRGdnTUM0ek9USTJNRE5ETUM0MU1EVXhOemNnTUM0ek5UZ3dPVGdnTUM0ME56RTJOVGdnTUM0ek16RTVNVGNnTUM0ME16STJNRE1nTUM0ek1UYzVNamRETUM0ek9UTTFORGdnTUM0ek1ETTVNemdnTUM0ek5URXdNamtnTUM0ek1ESTRPREVnTUM0ek1URXpNamdnTUM0ek1UUTVNVFJETUM0eU56RTJNamNnTUM0ek1qWTVORGNnTUM0eU16WTRORGtnTUM0ek5URTBNekVnTUM0eU1USXhNek1nTUM0ek9EUTNORGxETUM0eE9EYzBNVFlnTUM0ME1UZ3dOamNnTUM0eE56UXdOeklnTUM0ME5UZzBOVEVnTUM0eE56UXdOeklnTUM0ME9UazVNelpETUM0eE56UXdOeklnTUM0MU5ERTBNakVnTUM0eE9EYzBNVFlnTUM0MU9ERTRNRFlnTUM0eU1USXhNek1nTUM0Mk1UVXhNalJETUM0eU16WTRORGtnTUM0Mk5EZzBOREVnTUM0eU56RTJNamNnTUM0Mk56STVNallnTUM0ek1URXpNamdnTUM0Mk9EUTVOVGhETUM0ek5URXdNamtnTUM0Mk9UWTVPVEVnTUM0ek9UTTFORGdnTUM0Mk9UVTVNelVnTUM0ME16STJNRE1nTUM0Mk9ERTVORFZETUM0ME56RTJOVGdnTUM0Mk5qYzVOVFVnTUM0MU1EVXhOemNnTUM0Mk5ERTNOelFnTUM0MU1qZ3lNRGdnTUM0Mk1EY3lOMHd3TGpZME5ESXdPQ0F3TGpjd05UQXdNME13TGpZek5UTTJJREF1TnpFNE5EVTFJREF1TmpNd056RTRJREF1TnpNME1qTTNJREF1TmpNd09EYzBJREF1TnpVd016TTNRekF1TmpNd09EWTNJREF1TnpZNU1EZ2dNQzQyTXpjeU1Ua2dNQzQzT0RjeU56RWdNQzQyTkRnNE9URWdNQzQ0TURFNU16WkRNQzQyTmpBMU5qUWdNQzQ0TVRZMk1ERWdNQzQyTnpZNE5qY2dNQzQ0TWpZNE56RWdNQzQyT1RVeE16UWdNQzQ0TXpFd05qaERNQzQzTVRNME1ERWdNQzQ0TXpVeU5qVWdNQzQzTXpJMU5USWdNQzQ0TXpNeE5DQXdMamMwT1RRMU5TQXdMamd5TlRBMFF6QXVOelkyTXpVNElEQXVPREUyT1RReElEQXVOemd3TURFeUlEQXVPREF6TXpRMklEQXVOemc0TVRnMklEQXVOemcyTkRjNVF6QXVOemsyTXpZZ01DNDNOamsyTVRJZ01DNDNPVGcxTmprZ01DNDNOVEEwTnpFZ01DNDNPVFEwTlRNZ01DNDNNekl4T0RWRE1DNDNPVEF6TXpZZ01DNDNNVE00T1RrZ01DNDNPREF4TXpjZ01DNDJPVGMxTlRJZ01DNDNOalUxTWpRZ01DNDJPRFU0TVRSRE1DNDNOVEE1TVRFZ01DNDJOelF3TnpjZ01DNDNNekkzTkRjZ01DNDJOamMyTkRZZ01DNDNNVFF3TURRZ01DNDJOamMxTnpGRE1DNDJPVFV5TmpFZ01DNDJOamMwT1RZZ01DNDJOemN3TkRjZ01DNDJOek0zT0RNZ01DNDJOakl6TkRFZ01DNDJPRFUwTUROTU1DNDFOREl6TkRFZ01DNDFPRE01TXpaRE1DNDFOVE14TWpNZ01DNDFOakU0TWpnZ01DNDFOVGswTmpVZ01DNDFNemM0TVRrZ01DNDFOakV3TURnZ01DNDFNVE15TjBnd0xqWTJNRFEzTkZwTk1DNDNOREl3TnpRZ01DNDBORE0yTmpsRE1DNDNOVE15TURrZ01DNDBORE0yTkRNZ01DNDNOalF4SURBdU5EUTJPVEl4SURBdU56Y3pNemN4SURBdU5EVXpNRGczUXpBdU56Z3lOalF4SURBdU5EVTVNalUwSURBdU56ZzVPRGMwSURBdU5EWTRNRE15SURBdU56azBNVFV6SURBdU5EYzRNekV4UXpBdU56azRORE15SURBdU5EZzROVGtnTUM0M09UazFOalVnTUM0ME9UazVNRGdnTUM0M09UYzBNRGtnTUM0MU1UQTRNekZETUM0M09UVXlOVE1nTUM0MU1qRTNOVFVnTUM0M09EazVNRFVnTUM0MU16RTNPVE1nTUM0M09ESXdOREVnTUM0MU16azJOelZETUM0M056UXhOemdnTUM0MU5EYzFOVGdnTUM0M05qUXhOVElnTUM0MU5USTVNeUF3TGpjMU16SXpOQ0F3TGpVMU5URXhNa013TGpjME1qTXhOaUF3TGpVMU56STVOQ0F3TGpjek1EazVOU0F3TGpVMU5qRTROeUF3TGpjeU1EY3dOaUF3TGpVMU1Ua3pNME13TGpjeE1EUXhOeUF3TGpVME56WTNPQ0F3TGpjd01UWXlNaUF3TGpVME1EUTJOaUF3TGpZNU5UUXpNeUF3TGpVek1USXhRekF1TmpnNU1qUTBJREF1TlRJeE9UVTBJREF1TmpnMU9UUXhJREF1TlRFeE1EY2dNQzQyT0RVNU5ERWdNQzQwT1RrNU16WkRNQzQyT0RVNU5ERWdNQzQwT0RVd016WWdNQzQyT1RFNE5URWdNQzQwTnpBM05EVWdNQzQzTURJek56UWdNQzQwTmpBeE9UZERNQzQzTVRJNE9UY2dNQzQwTkRrMk5EZ2dNQzQzTWpjeE56VWdNQzQwTkRNM01EVWdNQzQzTkRJd056UWdNQzQwTkRNMk5qbFdNQzQwTkRNMk5qbGFUVEF1TnpFME16UXhJREF1TVRrek1qWTVRekF1TnpJMU5EY2dNQzR4T1RNeU5qa2dNQzQzTXpZek5EZ2dNQzR4T1RZMU5qa2dNQzQzTkRVMk1ERWdNQzR5TURJM05USkRNQzQzTlRRNE5UUWdNQzR5TURnNU16UWdNQzQzTmpJd05qWWdNQzR5TVRjM01qSWdNQzQzTmpZek1qVWdNQzR5TWpnd01ETkRNQzQzTnpBMU9ETWdNQzR5TXpneU9EVWdNQzQzTnpFMk9UZ2dNQzR5TkRrMU9UZ2dNQzQzTmprMU1qY2dNQzR5TmpBMU1UTkRNQzQzTmpjek5UVWdNQzR5TnpFME1qZ2dNQzQzTmpFNU9UY2dNQzR5T0RFME5UTWdNQzQzTlRReE1qZ2dNQzR5T0Rrek1qSkRNQzQzTkRZeU5Ua2dNQzR5T1RjeE9USWdNQzQzTXpZeU16TWdNQzR6TURJMU5TQXdMamN5TlRNeE9DQXdMak13TkRjeU1VTXdMamN4TkRRd015QXdMak13TmpnNU15QXdMamN3TXpBNUlEQXVNekExTnpjNElEQXVOamt5T0RBNUlEQXVNekF4TlRKRE1DNDJPREkxTWpjZ01DNHlPVGN5TmpFZ01DNDJOek0zTkNBd0xqSTVNREEwT1NBd0xqWTJOelUxTnlBd0xqSTRNRGM1TmtNd0xqWTJNVE0zTkNBd0xqSTNNVFUwTXlBd0xqWTFPREEzTkNBd0xqSTJNRFkyTkNBd0xqWTFPREEzTkNBd0xqSTBPVFV6TmtNd0xqWTFPREEzTkNBd0xqSXpORFl4TXlBd0xqWTJOREF3TWlBd0xqSXlNRE13TVNBd0xqWTNORFUxTkNBd0xqSXdPVGMwT1VNd0xqWTROVEV3TnlBd0xqRTVPVEU1TnlBd0xqWTVPVFF4T0NBd0xqRTVNekkyT1NBd0xqY3hORE0wTVNBd0xqRTVNekkyT1ZwTk1DNDNNVFF6TkRFZ01DNDJPVFF5TURORE1DNDNNalUwTnpVZ01DNDJPVFF5TURNZ01DNDNNell6TlRrZ01DNDJPVGMxTURjZ01DNDNORFUyTVRVZ01DNDNNRE0yT1RWRE1DNDNOVFE0TnpFZ01DNDNNRGs0T0RRZ01DNDNOakl3T0RNZ01DNDNNVGcyTnprZ01DNDNOall6TXpjZ01DNDNNamc1TmpsRE1DNDNOekExT1RJZ01DNDNNemt5TlRnZ01DNDNOekUyT1RnZ01DNDNOVEExTnpnZ01DNDNOamsxTVRjZ01DNDNOakUwT1RaRE1DNDNOamN6TXpVZ01DNDNOekkwTVRVZ01DNDNOakU1TmpNZ01DNDNPREkwTkNBd0xqYzFOREE0SURBdU56a3dNekEwUXpBdU56UTJNVGs0SURBdU56azRNVFkzSURBdU56TTJNVFlnTUM0NE1ETTFNVFlnTUM0M01qVXlNellnTUM0NE1EVTJOekpETUM0M01UUXpNVE1nTUM0NE1EYzRNamdnTUM0M01ESTVPVFVnTUM0NE1EWTJPVFFnTUM0Mk9USTNNVFlnTUM0NE1ESTBNVFZETUM0Mk9ESTBNemNnTUM0M09UZ3hNellnTUM0Mk56TTJOVGtnTUM0M09UQTVNRFFnTUM0Mk5qYzBPVElnTUM0M09ERTJNek5ETUM0Mk5qRXpNallnTUM0M056SXpOaklnTUM0Mk5UZ3dORGdnTUM0M05qRTBOekVnTUM0Mk5UZ3dOelFnTUM0M05UQXpNemRETUM0Mk5UZ3hNU0F3TGpjek5UUXpOeUF3TGpZMk5EQTFNeUF3TGpjeU1URTFPU0F3TGpZM05EWXdNaUF3TGpjeE1EWXpOa013TGpZNE5URTFJREF1TnpBd01URXpJREF1TmprNU5EUXhJREF1TmprME1qQXpJREF1TnpFME16UXhJREF1TmprME1qQXpXazB3TGpNMk9ESXdPQ0F3TGpZMk5qWXdNME13TGpNek5USTBOQ0F3TGpZMk5qWXdNeUF3TGpNd016QXlNU0F3TGpZMU5qZ3lPQ0F3TGpJM05UWXhNeUF3TGpZek9EVXhOVU13TGpJME9ESXdOU0F3TGpZeU1ESXdNU0F3TGpJeU5qZzBNaUF3TGpVNU5ERTNNU0F3TGpJeE5ESXlPQ0F3TGpVMk16Y3hOME13TGpJd01UWXhNeUF3TGpVek16STJNeUF3TGpFNU9ETXhNeUF3TGpRNU9UYzFNU0F3TGpJd05EYzBOQ0F3TGpRMk56UXlNVU13TGpJeE1URTNOQ0F3TGpRek5UQTVNU0F3TGpJeU56QTBPQ0F3TGpRd05UTTVOQ0F3TGpJMU1ETTFOeUF3TGpNNE1qQTROVU13TGpJM016WTJOU0F3TGpNMU9EYzNOaUF3TGpNd016TTJNeUF3TGpNME1qa3dNeUF3TGpNek5UWTVNeUF3TGpNek5qUTNNa013TGpNMk9EQXlNeUF3TGpNek1EQTBNU0F3TGpRd01UVXpOQ0F3TGpNek16TTBNU0F3TGpRek1UazRPQ0F3TGpNME5UazFOa013TGpRMk1qUTBNeUF3TGpNMU9EVTNNU0F3TGpRNE9EUTNNaUF3TGpNM09Ua3pNeUF3TGpVd05qYzROaUF3TGpRd056TTBNVU13TGpVeU5URWdNQzQwTXpRM05Ea2dNQzQxTXpRNE56UWdNQzQwTmpZNU56TWdNQzQxTXpRNE56UWdNQzQwT1RrNU16WkRNQzQxTXpRNE1EUWdNQzQxTkRReE1UY2dNQzQxTVRjeU1qSWdNQzQxT0RZME5qa2dNQzQwT0RVNU9ERWdNQzQyTVRjM01VTXdMalExTkRjMElEQXVOalE0T1RVeElEQXVOREV5TXpnNUlEQXVOalkyTlRNeklEQXVNelk0TWpBNElEQXVOalkyTmpBelZqQXVOalkyTmpBeldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEd4cGJtVmhja2R5WVdScFpXNTBJR2xrUFNKd1lXbHVkREJmYkdsdVpXRnlJaUI0TVQwaUxUQXVNakEzTWlJZ2VURTlJakV1TWpBM01pSWdlREk5SWpFdU1qQTNNRGNpSUhreVBTSXRNQzR5TURjd05qY2lJR2R5WVdScFpXNTBWVzVwZEhNOUluVnpaWEpUY0dGalpVOXVWWE5sSWo0bUkzaGhPenh6ZEc5d0lITjBiM0F0WTI5c2IzSTlJaU5ET0RVeE1VSWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTVNJZ2MzUnZjQzFqYjJ4dmNqMGlJMFpHT1Rrd01DSXZQaVlqZUdFN1BDOXNhVzVsWVhKSGNtRmthV1Z1ZEQ0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjUwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY3IiB5PSIzNjUuNSIgd2lkdGg9Ijg5IiBoZWlnaHQ9Ijg3IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxNTEiIHZhbHVlPSJBV1MgRUxCIChFbGFzdGljIExvYWQgQmFsYW5jZXIpIC0+IFNvbXJ5c3QtQVBJIiBzdHlsZT0iaXIucmVmPWFkOTJiMTFjLTQzN2QtNDgyOC04NjJhLTI4MGNhZmU5MWQxZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIxNDgiIHRhcmdldD0iMTkyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSItNDQxIiB5PSItNjgwIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjExIiB2YWx1ZT0iU2VydmljZSBtZXNoIChJc3RpbykgLT4gU29tcnlzdC1BUEkiIHN0eWxlPSJpci5yZWY9YzEyMmY0YTMtMDVhYi00NjkxLTgyNDktNmY2MWUxNDU1ZmRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjE5MiIgdGFyZ2V0PSIxNDYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMjYiIHZhbHVlPSJLdWJlcm5ldGVzIENsdXN0ZXIgVVMtV2VzdDItcHJvZC1la3MtY2x1c3RlciAtPiBEb2NrZXIgTGludXggSG9zdCIgc3R5bGU9ImlyLnJlZj1iMDMwNDczOC01NWIxLTQzOWYtYmUwOC04NGE3NTg5NDk2YjU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIyNTAiIHNvdXJjZT0iMTQ2IiB0YXJnZXQ9IjI3NCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNjk1IiB5PSI4OTUiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIyNTIiIHZhbHVlPSJPQXV0aDIgQXV0aG9yaXphdGlvbiBTZXJ2ZXIgLT4gQWNjZXNzLVJpZ2h0cyAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9ZGU3NmQ3ZGMtNzE1OS00Zjc4LWE4NGQtMmVmNWU3YzM3MmQ0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjc1O2V4aXRZPTA7ZXhpdER4PTA7ZXhpdER5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIyNTAiIHNvdXJjZT0iMjQwIiB0YXJnZXQ9IjE5NyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iNjQwIiB5PSI4OCIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iNzA4IiB5PSItNTYiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzMiIgdmFsdWU9IkJGRiBBUEkiIHN0eWxlPSJpci5yZWY9MGI5NTdjMzMtNmViZi00NjZjLThiNzAtNmNhNDBlMjc5NDdmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7Zm9udENvbG9yPSMzMzMzMzM7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtmaWxsQ29sb3I9I2Y1ZjVmNTtzdHJva2VDb2xvcj0jNjY2NjY2OyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDU2IiB5PSIzNjguNSIgd2lkdGg9IjgxIiBoZWlnaHQ9IjgxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNTUiIHZhbHVlPSJTb21yeXN0LUFQSSAtPiBNQU1JIChNeVNRTCkiIHN0eWxlPSJpci5yZWY9M2FmZjIwYTgtZDJkMC00OGIyLThkMzEtOTNjNjAzM2JkMDVkO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2V4aXRYPTA7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDsiIHBhcmVudD0iMjUwIiBzb3VyY2U9IjMyIiB0YXJnZXQ9IjE5MyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMzk4IiB5PSIxMzMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjI2MSIgeT0iLTY5IiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjU0IiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gUEFQSSAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9ZGEwYjQyZTktNzE1OC00OTI5LTllYjYtOTFlNzgwNjY1ZmY2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIxOTUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjQ0OC43NSIgeT0iOTMiIGFzPSJzb3VyY2VQb2ludCIvPjxteFBvaW50IHg9IjUzMSIgeT0iLTUzIiBhcz0idGFyZ2V0UG9pbnQiLz48L214R2VvbWV0cnk+PC9teENlbGw+PG14Q2VsbCBpZD0iMjUzIiB2YWx1ZT0iU29tcnlzdC1BUEkgLT4gQXV0aC1TZXJ2aWNlIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj00YTUyZTkwMy00YWMwLTQzYjAtYjIxMy0yMDgxMWY1Njg0OTg7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNzU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjI1MCIgc291cmNlPSIzMiIgdGFyZ2V0PSIxOTYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxteFBvaW50IHg9IjkxNiIgeT0iMzMuNSIgYXM9InNvdXJjZVBvaW50Ii8+PG14UG9pbnQgeD0iOTg3IiB5PSItOTYiIGFzPSJ0YXJnZXRQb2ludCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIxOTIiIHZhbHVlPSJJc3RpbyAoRGVmYXVsdCBHVykiIHN0eWxlPSJpci5yZWY9Njc2Yjk4Y2ItNDA5My00YzZlLTg1OGItNThlMzZkNjYwMDJlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXNlcnZpY2UtbWVzaDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalV3TURFeE9DQXdMalV6TkRKTU1DNHpOemM1TlRnZ01DNDJOVFl6TmtNd0xqTTNOemsxT0NBd0xqWTBOalU0TnlBd0xqTTJPREU0TlNBd0xqWXpOamd4TkNBd0xqTTJNekk1T1NBd0xqWXlOekEwTVVNd0xqTTFPRFF4TXlBd0xqWXhOekkyT1NBd0xqTTFNelV5TmlBd0xqWXhOekkyT1NBd0xqTTBPRFkwSURBdU5qRTNNalk1VERBdU5EWTFPVEV6SURBdU5EazVPVGsyVERBdU16TTRPRFkzSURBdU16Y3lPVFZETUM0ek5EWTJOVElnTUM0ek5qazVOekVnTUM0ek5UTTNNakVnTUM0ek5qVXpPRFlnTUM0ek5UazJNVFFnTUM0ek5UazBPVEpETUM0ek5qVTFNRGdnTUM0ek5UTTFPVGtnTUM0ek56QXdPVE1nTUM0ek5EWTFNamtnTUM0ek56TXdOeklnTUM0ek16ZzNORFZNTUM0MU1EQXhNVGdnTUM0ME5qVTNPVEZNTUM0Mk1qY3hOalFnTUM0ek16ZzNORFZETUM0Mk16SXdOU0F3TGpNME9EVXhPQ0F3TGpZek1qQTFJREF1TXpVek5EQTBJREF1TmpReE9ESXpJREF1TXpVNE1qa3hRekF1TmpRNU1UYzJJREF1TXpZeE9UUTJJREF1TmpVMU9DQXdMak0yTmpreE5DQXdMalkyTVRNMk9DQXdMak0zTWprMVREQXVOVE0wTXpJeUlEQXVORGs1T1RrMlREQXVOalUyTkRneUlEQXVOakl5TVRVMVF6QXVOalE0TVRZNElEQXVOakkwT0RZMUlEQXVOalF3T0RreUlEQXVOak13TURjeUlEQXVOak0xTmpRMUlEQXVOak0zTURZM1F6QXVOak13TXprNElEQXVOalEwTURZeklEQXVOakkzTkRNM0lEQXVOalV5TlRBMklEQXVOakkzTVRZMElEQXVOall4TWpRMlREQXVOVEF3TVRFNElEQXVOVE0wTWxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTXlPVEV3TWlBd0xqY3lORGMyVERBdU5ETTJOakF5SURBdU9ETXlNalU1VmpBdU9ESTNNemN6UXpBdU5ETTNORGNnTUM0NE1EWTVOallnTUM0ME5EWXlNeUF3TGpjNE56WTVOU0F3TGpRMk1UQXpOU0F3TGpjM016WXlNMHd3TGpNM016QTNPU0F3TGpZNE5UWTJPVU13TGpNM01EVTRJREF1TmprMU9EYzNJREF1TXpZMU1ETTFJREF1TnpBMU1EZ3pJREF1TXpVM01UZ2dNQzQzTVRJd05qVkRNQzR6TkRrek1qVWdNQzQzTVRrd05EY2dNQzR6TXprMU16SWdNQzQzTWpNME56VWdNQzR6TWpreE1ESWdNQzQzTWpRM05sWXdMamN5TkRjMldpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVFkzT1RZNUlEQXVOVFU0TmpFeVREQXVNamN3TlRneUlEQXVOalkyTVRFeVF6QXVNamN4TVRJMElEQXVOalUyTVRZNUlEQXVNamMwTmprZ01DNDJORFkyTXlBd0xqSTRNRGd3TXlBd0xqWXpPRGMzTVVNd0xqSTROamt4TmlBd0xqWXpNRGt4TVNBd0xqSTVOVEk0TkNBd0xqWXlOVEV3TnlBd0xqTXdORGM0TmlBd0xqWXlNakV6TkV3d0xqSXlNVGN4T1NBd0xqVXpOREU0UXpBdU1qQTNOalEzSURBdU5UUTRPVGcwSURBdU1UZzRNemMxSURBdU5UVTNOelEwSURBdU1UWTNPVFk1SURBdU5UVTROakV5VmpBdU5UVTROakV5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU1qY3dOVGN5SURBdU16TXpPRFl5VERBdU1UZ3lOakUzSURBdU5ESXhPREUyUXpBdU1Ua3lOelU0SURBdU5ESXpOakkxSURBdU1qQXlNemd5SURBdU5ESTNOakl6SURBdU1qRXdPREl4SURBdU5ETXpOVE5ETUM0eU1Ua3lOaUF3TGpRek9UUXpOeUF3TGpJeU5qTXhJREF1TkRRM01URXhJREF1TWpNeE5EZ3hJREF1TkRVMk1ESk1NQzR6TVRRMU5TQXdMak0zTWprMU0wd3dMakk0TlRJek1TQXdMak0xT0RJNU5FTXdMakk0TURNME5TQXdMak0wT0RVeU1TQXdMakkzTlRRMU9DQXdMak0wTXpZek5TQXdMakkzTURVM01pQXdMak16TXpnMk1sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF6TmpVNU9DQXdMakUyTnpjeU5Vd3dMak16TXprNE5DQXdMakkzTURNek9FTXdMak0wTXpRMU1TQXdMakkzTWpZMU9DQXdMak0xTWpFd01TQXdMakkzTnpVeU9DQXdMak0xT0RrNU15QXdMakk0TkRReVF6QXVNelkxT0RnMUlEQXVNamt4TXpFeUlEQXVNemN3TnpVMUlEQXVNams1T1RZeUlEQXVNemN6TURjMUlEQXVNekE1TkRJNVREQXVORFl4TURJNUlEQXVNakl4TkRjMFF6QXVORFV6TWpneElEQXVNakUwT0RReElEQXVORFEzTURjNElEQXVNakEyTlRreUlEQXVORFF5T0RVNElEQXVNVGszTXpBM1F6QXVORE00TmpNM0lEQXVNVGc0TURJeElEQXVORE0yTlNBd0xqRTNOemt5TkNBd0xqUXpOalU1T0NBd0xqRTJOemN5TlZZd0xqRTJOemN5TlZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTNNVFE0SURBdU1qY3dNek0xVERBdU5UY3pOelV5SURBdU1UY3lOakEzUXpBdU5UY3lPVEF5SURBdU1UZ3lORFExSURBdU5UWTVPREU1SURBdU1Ua3hPVFlnTUM0MU5qUTNNemtnTUM0eU1EQTBNamRETUM0MU5UazJOVGdnTUM0eU1EZzRPVFFnTUM0MU5USTNNVFFnTUM0eU1UWXdPVEVnTUM0MU5EUTBNelFnTUM0eU1qRTBOekZNTUM0Mk16SXpPRGtnTUM0ek1EazBNalpETUM0Mk16UTNNRGdnTUM0eU9UazVOVGtnTUM0Mk16azFOemtnTUM0eU9URXpNRGtnTUM0Mk5EWTBOekVnTUM0eU9EUTBNVGRETUM0Mk5UTXpOak1nTUM0eU56YzFNalVnTUM0Mk5qSXdNVE1nTUM0eU56STJOVFFnTUM0Mk56RTBPQ0F3TGpJM01ETXpOVll3TGpJM01ETXpOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpneU56Y3pNU0F3TGpReU5qY3dNVXd3TGpjek5EZzVNU0F3TGpNek16ZzJNa013TGpjek1qVTNNaUF3TGpNME16TXlPU0F3TGpjeU56Y3dNU0F3TGpNMU1UazNPQ0F3TGpjeU1EZ3dPU0F3TGpNMU9EZzNRekF1TnpFek9URTNJREF1TXpZMU56WXlJREF1TnpBMU1qWTNJREF1TXpjd05qTXpJREF1TmprMU9EQXhJREF1TXpjeU9UVXlUREF1Tnpnek56VTBJREF1TkRZd09UQTFRekF1TnpnM016RWdNQzQwTlRFM05qTWdNQzQzT1RNeU56Y2dNQzQwTkRNM05UUWdNQzQ0TURFd01pQXdMalF6Tnpjek1rTXdMamd3T0RjMk5DQXdMalF6TVRjd09TQXdMamd4TnprNU5DQXdMalF5TnpnNU55QXdMamd5Tnpjek1TQXdMalF5Tmpjd01WWXdMalF5Tmpjd01Wb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamM0TXpJMk5DQXdMalV6T1RBMk1rd3dMamN3TURFNU5TQXdMall5TWpFek1VTXdMamN3T1RrMk9DQXdMall5TnpBeE55QXdMamN4TkRnMU5TQXdMall5TnpBeE55QXdMamN4T1RjME1TQXdMall6TmpjNVF6QXVOekkwTlRFMUlEQXVOalF4TURrZ01DNDNNamd5T1RrZ01DNDJORFl6TnpVZ01DNDNNekE0TXlBd0xqWTFNakk0TVVNd0xqY3pNek0yTVNBd0xqWTFPREU0TnlBd0xqY3pORFUzT1NBd0xqWTJORFUzTWlBd0xqY3pORFFnTUM0Mk56QTVPVFJNTUM0NE16Y3dNVFVnTUM0MU5qZ3pPREZETUM0NE1UWTBNaUF3TGpVMk5EWXhOeUF3TGpjNU56VTNPQ0F3TGpVMU5ETTBJREF1Tnpnek1qWTBJREF1TlRNNU1EWXlXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpNeU16ZzBJREF1Tmprd05UVXlUREF1TlRRNU16RTJJREF1Tnpjek5qSXhUREF1TlRVME1qQXpJREF1TnpjNE5UQTNRekF1TlRZd09ERTFJREF1TnpnME56UXpJREF1TlRZMU9UZzVJREF1TnpreU16UTFJREF1TlRZNU16WTFJREF1T0RBd056ZzBRekF1TlRjeU56UWdNQzQ0TURreU1qSWdNQzQxTnpReU16WWdNQzQ0TVRneU9UWWdNQzQxTnpNM05EZ2dNQzQ0TWpjek56Rk1NQzQyTnpZek5qRWdNQzQzTWpRM05UZERNQzQyTmprNU16Z2dNQzQzTWpRNU16WWdNQzQyTmpNMU5UTWdNQzQzTWpNM01UZ2dNQzQyTlRjMk5EZ2dNQzQzTWpFeE9EZERNQzQyTlRFM05ESWdNQzQzTVRnMk5UVWdNQzQyTkRZME5UWWdNQzQzTVRRNE56SWdNQzQyTkRJeE5UY2dNQzQzTVRBd09UZERNQzQyTXpjd01UY2dNQzQzTURRM01EWWdNQzQyTXpNMk1UTWdNQzQyT1RjNE9UZ2dNQzQyTXpJek9EUWdNQzQyT1RBMU5USldNQzQyT1RBMU5USmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TWpReU56SWdNQzR6T1RjME5EWkRNQzR6TmpRM05USWdNQzR6T1RjME5EWWdNQzR6T1RjMU5qZ2dNQzR6TmpRMk16RWdNQzR6T1RjMU5qZ2dNQzR6TWpReE5VTXdMak01TnpVMk9DQXdMakk0TXpZM0lEQXVNelkwTnpVeUlEQXVNalV3T0RVMElEQXVNekkwTWpjeUlEQXVNalV3T0RVMFF6QXVNamd6TnpreUlEQXVNalV3T0RVMElEQXVNalV3T1RjM0lEQXVNamd6TmpjZ01DNHlOVEE1TnpjZ01DNHpNalF4TlVNd0xqSTFNRGszTnlBd0xqTTJORFl6TVNBd0xqSTRNemM1TWlBd0xqTTVOelEwTmlBd0xqTXlOREkzTWlBd0xqTTVOelEwTmxvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTNOVGd6TXlBd0xqTTVOelEwTmtNd0xqY3hOak14TXlBd0xqTTVOelEwTmlBd0xqYzBPVEV5T0NBd0xqTTJORFl6TVNBd0xqYzBPVEV5T0NBd0xqTXlOREUxUXpBdU56UTVNVEk0SURBdU1qZ3pOamNnTUM0M01UWXpNVE1nTUM0eU5UQTROVFFnTUM0Mk56VTRNek1nTUM0eU5UQTROVFJETUM0Mk16VXpOVFFnTUM0eU5UQTROVFFnTUM0Mk1ESTFNemtnTUM0eU9ETTJOeUF3TGpZd01qVXpPU0F3TGpNeU5ERTFRekF1TmpBeU5UTTVJREF1TXpZME5qTXhJREF1TmpNMU16VTBJREF1TXprM05EUTJJREF1TmpjMU9ETXpJREF1TXprM05EUTJXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpJME1qY3lJREF1TnpRNU1qVkRNQzR6TmpRM05USWdNQzQzTkRreU5TQXdMak01TnpVMk9DQXdMamN4TmpRek5TQXdMak01TnpVMk9DQXdMalkzTlRrMU5VTXdMak01TnpVMk9DQXdMall6TlRRM05pQXdMak0yTkRjMU1pQXdMall3TWpZMk1TQXdMak15TkRJM01pQXdMall3TWpZMk1VTXdMakk0TXpjNU1pQXdMall3TWpZMk1TQXdMakkxTURrM055QXdMall6TlRRM05pQXdMakkxTURrM055QXdMalkzTlRrMU5VTXdMakkxTURrM055QXdMamN4TmpRek5TQXdMakk0TXpjNU1pQXdMamMwT1RJMUlEQXVNekkwTWpjeUlEQXVOelE1TWpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOelU0TXpNZ01DNDNORGt5TlVNd0xqY3hOak14TXlBd0xqYzBPVEkxSURBdU56UTVNVEk0SURBdU56RTJORE0xSURBdU56UTVNVEk0SURBdU5qYzFPVFUxUXpBdU56UTVNVEk0SURBdU5qTTFORGMySURBdU56RTJNekV6SURBdU5qQXlOall4SURBdU5qYzFPRE16SURBdU5qQXlOall4UXpBdU5qTTFNelUwSURBdU5qQXlOall4SURBdU5qQXlOVE01SURBdU5qTTFORGMySURBdU5qQXlOVE01SURBdU5qYzFPVFUxUXpBdU5qQXlOVE01SURBdU56RTJORE0xSURBdU5qTTFNelUwSURBdU56UTVNalVnTUM0Mk56VTRNek1nTUM0M05Ea3lOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpFMk56VTBPQ0F3TGpRd056RXdORU13TGpFNE5Ua3hJREF1TkRBM01UQTBJREF1TWpBek9EWWdNQzQwTVRJMU5Ea2dNQzR5TVRreE1qZ2dNQzQwTWpJM05URkRNQzR5TXpRek9UVWdNQzQwTXpJNU5USWdNQzR5TkRZeU9UVWdNQzQwTkRjME5USWdNQzR5TlRNek1qSWdNQzQwTmpRME1UWkRNQzR5TmpBek5Ea2dNQzQwT0RFek9ERWdNQzR5TmpJeE9EY2dNQzQxTURBd05EZ2dNQzR5TlRnMk1EVWdNQzQxTVRnd05UZERNQzR5TlRVd01qTWdNQzQxTXpZd05qWWdNQzR5TkRZeE9ERWdNQzQxTlRJMk1Ea2dNQzR5TXpNeE9UY2dNQzQxTmpVMU9UTkRNQzR5TWpBeU1USWdNQzQxTnpnMU56Y2dNQzR5TURNMk55QXdMalU0TnpReE9TQXdMakU0TlRZMklEQXVOVGt4TURBeFF6QXVNVFkzTmpVeElEQXVOVGswTlRnMElEQXVNVFE0T1RnMElEQXVOVGt5TnpRMUlEQXVNVE15TURFNUlEQXVOVGcxTnpFNFF6QXVNVEUxTURVMUlEQXVOVGM0TmpreElEQXVNVEF3TlRVMUlEQXVOVFkyTnpreUlEQXVNRGt3TXpVek5pQXdMalUxTVRVeU5FTXdMakE0TURFMU1qRWdNQzQxTXpZeU5UY2dNQzR3TnpRM01EY2dNQzQxTVRnek1EY2dNQzR3TnpRM01EY2dNQzQwT1RrNU5EVkRNQzR3TnpRM01EY2dNQzQwTnpVek1qSWdNQzR3T0RRME9EZzFJREF1TkRVeE56QTRJREF1TVRBeE9TQXdMalF6TkRJNU4wTXdMakV4T1RNeE1TQXdMalF4TmpnNE5pQXdMakUwTWpreU5TQXdMalF3TnpFd05DQXdMakUyTnpVME9DQXdMalF3TnpFd05GWXdMalF3TnpFd05GcE5NQzQ0TXpJd09UUWdNQzQwTURjeE1EUkRNQzQ0TlRBME5UWWdNQzQwTURjeE1EUWdNQzQ0TmpnME1EWWdNQzQwTVRJMU5Ea2dNQzQ0T0RNMk56UWdNQzQwTWpJM05URkRNQzQ0T1RnNU5ESWdNQzQwTXpJNU5USWdNQzQ1TVRBNE5ERWdNQzQwTkRjME5USWdNQzQ1TVRjNE5qZ2dNQzQwTmpRME1UWkRNQzQ1TWpRNE9UVWdNQzQwT0RFek9ERWdNQzQ1TWpZM016UWdNQzQxTURBd05EZ2dNQzQ1TWpNeE5URWdNQzQxTVRnd05UZERNQzQ1TVRrMU5qa2dNQzQxTXpZd05qWWdNQzQ1TVRBM01qY2dNQzQxTlRJMk1Ea2dNQzQ0T1RjM05ETWdNQzQxTmpVMU9UTkRNQzQ0T0RRM05Ua2dNQzQxTnpnMU56Y2dNQzQ0TmpneU1UWWdNQzQxT0RjME1Ua2dNQzQ0TlRBeU1EY2dNQzQxT1RFd01ERkRNQzQ0TXpJeE9UY2dNQzQxT1RRMU9EUWdNQzQ0TVRNMU15QXdMalU1TWpjME5TQXdMamM1TmpVMk5TQXdMalU0TlRjeE9FTXdMamMzT1RZd01TQXdMalUzT0RZNU1TQXdMamMyTlRFd01TQXdMalUyTmpjNU1pQXdMamMxTkRrZ01DNDFOVEUxTWpSRE1DNDNORFEyT1RnZ01DNDFNell5TlRjZ01DNDNNemt5TlRNZ01DNDFNVGd6TURjZ01DNDNNemt5TlRNZ01DNDBPVGs1TkRWRE1DNDNNemt5TlRNZ01DNDBOelV6TWpJZ01DNDNORGt3TXpVZ01DNDBOVEUzTURnZ01DNDNOalkwTkRZZ01DNDBNelF5T1RkRE1DNDNPRE00TlRjZ01DNDBNVFk0T0RZZ01DNDRNRGMwTnpFZ01DNDBNRGN4TURRZ01DNDRNekl3T1RRZ01DNDBNRGN4TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFNREF3TmpjZ01DNHdOelE1TlRFeVF6QXVOVEU0TkRNZ01DNHdOelE1TlRFeUlEQXVOVE0yTXpnZ01DNHdPREF6T1RZeUlEQXVOVFV4TmpRM0lEQXVNRGt3TlRrM04wTXdMalUyTmpreE5TQXdMakV3TURjNU9TQXdMalUzT0RneE5DQXdMakV4TlRJNU9TQXdMalU0TlRnME1TQXdMakV6TWpJMk0wTXdMalU1TWpnMk9DQXdMakUwT1RJeU9DQXdMalU1TkRjd055QXdMakUyTnpnNU5TQXdMalU1TVRFeU5TQXdMakU0TlRrd05FTXdMalU0TnpVME1pQXdMakl3TXpreE5DQXdMalUzT0RjZ01DNHlNakEwTlRZZ01DNDFOalUzTVRZZ01DNHlNek0wTkRGRE1DNDFOVEkzTXpJZ01DNHlORFkwTWpVZ01DNDFNell4T0RrZ01DNHlOVFV5TmpjZ01DNDFNVGd4T0NBd0xqSTFPRGcwT1VNd0xqVXdNREUzSURBdU1qWXlORE14SURBdU5EZ3hOVEF6SURBdU1qWXdOVGt6SURBdU5EWTBOVE01SURBdU1qVXpOVFkyUXpBdU5EUTNOVGMwSURBdU1qUTJOVE01SURBdU5ETXpNRGMxSURBdU1qTTBOak01SURBdU5ESXlPRGN6SURBdU1qRTVNemN5UXpBdU5ERXlOamN5SURBdU1qQTBNVEEwSURBdU5EQTNNakkzSURBdU1UZzJNVFUwSURBdU5EQTNNakkzSURBdU1UWTNOemt5UXpBdU5EQTNNakkzSURBdU1UUXpNVFk1SURBdU5ERTNNREE0SURBdU1URTVOVFUxSURBdU5ETTBOREU1SURBdU1UQXlNVFEwUXpBdU5EVXhPRE1nTUM0d09EUTNNekkySURBdU5EYzFORFExSURBdU1EYzBPVFV4TWlBd0xqVXdNREEyTnlBd0xqQTNORGsxTVRKV01DNHdOelE1TlRFeVdrMHdMalV3TURBMk55QXdMamN6T1RRNU4wTXdMalV4T0RReklEQXVOek01TkRrM0lEQXVOVE0yTXpnZ01DNDNORFE1TkRJZ01DNDFOVEUyTkRjZ01DNDNOVFV4TkRORE1DNDFOalk1TVRVZ01DNDNOalV6TkRVZ01DNDFOemc0TVRRZ01DNDNOems0TkRRZ01DNDFPRFU0TkRFZ01DNDNPVFk0TURsRE1DNDFPVEk0TmpnZ01DNDRNVE0zTnpNZ01DNDFPVFEzTURjZ01DNDRNekkwTkNBd0xqVTVNVEV5TlNBd0xqZzFNRFExUXpBdU5UZzNOVFF5SURBdU9EWTRORFU1SURBdU5UYzROeUF3TGpnNE5UQXdNaUF3TGpVMk5UY3hOaUF3TGpnNU56azROa013TGpVMU1qY3pNaUF3TGpreE1EazNJREF1TlRNMk1UZzVJREF1T1RFNU9ERXlJREF1TlRFNE1UZ2dNQzQ1TWpNek9UUkRNQzQxTURBeE55QXdMamt5TmprM055QXdMalE0TVRVd015QXdMamt5TlRFek9DQXdMalEyTkRVek9TQXdMamt4T0RFeE1VTXdMalEwTnpVM05DQXdMamt4TVRBNE5DQXdMalF6TXpBM05TQXdMamc1T1RFNE5TQXdMalF5TWpnM015QXdMamc0TXpreE4wTXdMalF4TWpZM01pQXdMamcyT0RZMUlEQXVOREEzTWpJM0lEQXVPRFV3TnlBd0xqUXdOekl5TnlBd0xqZ3pNak16TjBNd0xqUXdOekl5TnlBd0xqZ3dOemN4TlNBd0xqUXhOekF3T0NBd0xqYzROREVnTUM0ME16UTBNVGtnTUM0M05qWTJPRGxETUM0ME5URTRNeUF3TGpjME9USTNPQ0F3TGpRM05UUTBOU0F3TGpjek9UUTVOeUF3TGpVd01EQTJOeUF3TGpjek9UUTVOMW9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDROaUlnYUdWcFoyaDBQU0l3TGpnMklpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOams0TWpReUlEQXVNRGN3TURZNE5Da2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2Rhc2hlZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYxIiB5PSIzNjUuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNzQiIHZhbHVlPSJEb2NrZXIgRW52aXJvbm1lbnQiIHN0eWxlPSJpci5yZWY9NzI3NmE1ZTYtY2FlMC00ZmViLTgwMWItNWRlOGZhMGI5ZTVlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWRvY2tlci1lbnZpcm9ubWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDVNVEUyTWpJZ01DNDBORE01TWpsRE1DNDVNRGswTkRrZ01DNDBOREl4TVRnZ01DNDRPRGs0T0RnZ01DNDBNamN5TmpZZ01DNDRORGM0TmpjZ01DNDBNamN5TmpaRE1DNDRNemNnTUM0ME1qY3lOallnTUM0NE1qVTNOeUF3TGpReU9ETTFNeUF3TGpneE5Ea3dNeUF3TGpRek1ERTJORU13TGpnd05qa3pOQ0F3TGpNM05EYzBNU0F3TGpjMk1Ea3lPU0F3TGpNME56a3pOU0F3TGpjMU9URXhPQ0F3TGpNME5qUTROa3d3TGpjME56ZzRPQ0F3TGpNek9UazJOa3d3TGpjME1EWTBNeUF3TGpNMU1EUTNNVU13TGpjek1UVTROeUF3TGpNMk5EVTVPQ0F3TGpjeU5EY3dOQ0F3TGpNNE1EVXpOeUF3TGpjeU1EY3lJREF1TXprMk9ETTRRekF1TnpFek1URXpJREF1TkRJNE16VXpJREF1TnpFM09ESXlJREF1TkRVNE1EVTNJREF1TnpNek56WWdNQzQwT0RNME1UUkRNQzQzTVRRMU5qSWdNQzQwT1RReU9ERWdNQzQyT0RNME1Ea2dNQzQwT1RZNE1UY2dNQzQyTnpZNE9EZ2dNQzQwT1RjeE56bElNQzR4TmpJMU1ERkRNQzR4TkRrd09UZ2dNQzQwT1RjeE56a2dNQzR4TXpneU16RWdNQzQxTURnd05EWWdNQzR4TXpneU16RWdNQzQxTWpFME5EbERNQzR4TXpjMU1EWWdNQzQxTmpZek5qY2dNQzR4TkRVeE1UUWdNQzQyTVRFeU9EWWdNQzR4TmpBMk9TQXdMalkxTXpZMk9FTXdMakUzT0RRMElEQXVOekF3TURNMUlEQXVNakEwT0RnMElEQXVOek0wTkRRNElEQXVNak00T1RNMUlEQXVOelUxTkRVNFF6QXVNamMzTXpNeklEQXVOemM1TURBMElEQXVNelF3TURBeElEQXVOemt5TkRBM0lEQXVOREV3TmpNNUlEQXVOemt5TkRBM1F6QXVORFF5TlRFMklEQXVOemt5TkRBM0lEQXVORGMwTXprMElEQXVOemc1TlRBNUlEQXVOVEExT1RBNUlEQXVOemd6TnpFelF6QXVOVFE1TnpRZ01DNDNOelUzTkRRZ01DNDFPVEUzTmpFZ01DNDNOakExTXlBd0xqWXpNRFV5TVNBd0xqY3pPRFF6TTBNd0xqWTJNak01T0NBd0xqY3hPVGsxT1NBd0xqWTVNVEF4TmlBd0xqWTVOalF4TXlBd0xqY3hOVEk0TmlBd0xqWTJPRGc0TWtNd0xqYzFOakl5SURBdU5qSXlPRGMzSURBdU56Z3dORGtnTUM0MU56RTBNemtnTUM0M09UZ3lOQ0F3TGpVeU5UYzVOa013TGpnd01EYzNOaUF3TGpVeU5UYzVOaUF3TGpnd01qazBPU0F3TGpVeU5UYzVOaUF3TGpnd05UUTROU0F3TGpVeU5UYzVOa013TGpnMU1EQTBNU0F3TGpVeU5UYzVOaUF3TGpnM056VTNNU0F3TGpVd09EQTBOaUF3TGpnNU1qYzROaUF3TGpRNU1qZ3pNa013TGprd01qa3lPU0F3TGpRNE16UXhOQ0F3TGpreE1EVXpOaUF3TGpRM01UZ3lNaUF3TGpreE5UazJPU0F3TGpRMU9EYzRNVXd3TGpreE9USXpJREF1TkRRNU16WXpUREF1T1RFeE5qSXlJREF1TkRRek9USTVXaUlnWm1sc2JEMGlJekF3T1RGRk1pSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNakV3TWpZZ01DNDBPREl5TWpOSU1DNHlOemt3T0RaRE1DNHlPREl6TkRZZ01DNDBPREl5TWpNZ01DNHlPRFV5TkRRZ01DNDBOemsyT0RjZ01DNHlPRFV5TkRRZ01DNDBOell3TmpWV01DNDBNVFEwT0RORE1DNHlPRFV5TkRRZ01DNDBNVEV5TWpNZ01DNHlPREkzTURrZ01DNDBNRGd6TWpVZ01DNHlOemt3T0RZZ01DNDBNRGd6TWpWSU1DNHlNVEF5TmtNd0xqSXdOeUF3TGpRd09ETXlOU0F3TGpJd05ERXdNaUF3TGpReE1EZzJNU0F3TGpJd05ERXdNaUF3TGpReE5EUTRNMVl3TGpRM05qQTJOVU13TGpJd05EUTJOQ0F3TGpRM09UWTROeUF3TGpJd055QXdMalE0TWpJeU15QXdMakl4TURJMklEQXVORGd5TWpJeldpSWdabWxzYkQwaUl6QXdPVEZGTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU16QTFNak1nTUM0ME9ESXlNak5JTUM0ek56UXdOVGRETUM0ek56Y3pNVGdnTUM0ME9ESXlNak1nTUM0ek9EQXlNVFVnTUM0ME56azJPRGNnTUM0ek9EQXlNVFVnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0ek9EQXlNVFVnTUM0ME1URXlNak1nTUM0ek56YzJPQ0F3TGpRd09ETXlOU0F3TGpNM05EQTFOeUF3TGpRd09ETXlOVWd3TGpNd05USXpRekF1TXpBeE9UY2dNQzQwTURnek1qVWdNQzR5T1Rrd056SWdNQzQwTVRBNE5qRWdNQzR5T1Rrd056SWdNQzQwTVRRME9ETldNQzQwTnpZd05qVkRNQzR5T1RrME16VWdNQzQwTnprMk9EY2dNQzR6TURFNU55QXdMalE0TWpJeU15QXdMak13TlRJeklEQXVORGd5TWpJeldpSWdabWxzYkQwaUl6QXdPVEZGTWlJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EQXhPVEVnTUM0ME9ESXlNak5JTUM0ME56QTNNelpETUM0ME56TTVPVFlnTUM0ME9ESXlNak1nTUM0ME56WTRPVFFnTUM0ME56azJPRGNnTUM0ME56WTRPVFFnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0ME56WTRPVFFnTUM0ME1URXlNak1nTUM0ME56UXpOVGdnTUM0ME1EZ3pNalVnTUM0ME56QTNNellnTUM0ME1EZ3pNalZJTUM0ME1ERTVNVU13TGpNNU9EWTFJREF1TkRBNE16STFJREF1TXprMU56VXlJREF1TkRFd09EWXhJREF1TXprMU56VXlJREF1TkRFME5EZ3pWakF1TkRjMk1EWTFRekF1TXprMU56VXlJREF1TkRjNU5qZzNJREF1TXprNE1qZzRJREF1TkRneU1qSXpJREF1TkRBeE9URWdNQzQwT0RJeU1qTmFJaUJtYVd4c1BTSWpNREE1TVVVeUlpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBPVGN4TWpVZ01DNDBPREl5TWpOSU1DNDFOalU1TlVNd0xqVTJPVEl4SURBdU5EZ3lNakl6SURBdU5UY3lNVEE0SURBdU5EYzVOamczSURBdU5UY3lNVEE0SURBdU5EYzJNRFkxVmpBdU5ERTBORGd6UXpBdU5UY3lNVEE0SURBdU5ERXhNakl6SURBdU5UWTVOVGN5SURBdU5EQTRNekkxSURBdU5UWTFPVFVnTUM0ME1EZ3pNalZJTUM0ME9UY3hNalZETUM0ME9UTTROalVnTUM0ME1EZ3pNalVnTUM0ME9UQTVOamNnTUM0ME1UQTROakVnTUM0ME9UQTVOamNnTUM0ME1UUTBPRE5XTUM0ME56WXdOalZETUM0ME9UQTVOamNnTUM0ME56azJPRGNnTUM0ME9UTTROalVnTUM0ME9ESXlNak1nTUM0ME9UY3hNalVnTUM0ME9ESXlNak5hSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TURVeU15QXdMak01TkRNek1rZ3dMak0zTkRBMU4wTXdMak0zTnpNeE9DQXdMak01TkRNek1pQXdMak00TURJeE5TQXdMak01TVRRek5DQXdMak00TURJeE5TQXdMak00T0RFM05GWXdMak15TmpVNU0wTXdMak00TURJeE5TQXdMak15TXpNek15QXdMak0zTnpZNElEQXVNekl3TkRNMUlEQXVNemMwTURVM0lEQXVNekl3TkRNMVNEQXVNekExTWpORE1DNHpNREU1TnlBd0xqTXlNRFF6TlNBd0xqSTVPVEEzTWlBd0xqTXlNamszSURBdU1qazVNRGN5SURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU1qazVORE0xSURBdU16a3hORE0wSURBdU16QXhPVGNnTUM0ek9UUXpNeklnTUM0ek1EVXlNeUF3TGpNNU5ETXpNbG9pSUdacGJHdzlJaU13TURreFJUSWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF3TVRreElEQXVNemswTXpNeVNEQXVORGN3TnpNMlF6QXVORGN6T1RrMklEQXVNemswTXpNeUlEQXVORGMyT0RrMElEQXVNemt4TkRNMElEQXVORGMyT0RrMElEQXVNemc0TVRjMFZqQXVNekkyTlRrelF6QXVORGMyT0RrMElEQXVNekl6TXpNeklEQXVORGMwTXpVNElEQXVNekl3TkRNMUlEQXVORGN3TnpNMklEQXVNekl3TkRNMVNEQXVOREF4T1RGRE1DNHpPVGcyTlNBd0xqTXlNRFF6TlNBd0xqTTVOVGMxTWlBd0xqTXlNamszSURBdU16azFOelV5SURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU16azFOelV5SURBdU16a3hORE0wSURBdU16azRNamc0SURBdU16azBNek15SURBdU5EQXhPVEVnTUM0ek9UUXpNekphSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RjeE1qVWdNQzR6T1RRek16SklNQzQxTmpVNU5VTXdMalUyT1RJeElEQXVNemswTXpNeUlEQXVOVGN5TVRBNElEQXVNemt4TkRNMElEQXVOVGN5TVRBNElEQXVNemc0TVRjMFZqQXVNekkyTlRrelF6QXVOVGN5TVRBNElEQXVNekl6TXpNeklEQXVOVFk1TWpFZ01DNHpNakEwTXpVZ01DNDFOalU1TlNBd0xqTXlNRFF6TlVnd0xqUTVOekV5TlVNd0xqUTVNemcyTlNBd0xqTXlNRFF6TlNBd0xqUTVNRGsyTnlBd0xqTXlNamszSURBdU5Ea3dPVFkzSURBdU16STJOVGt6VmpBdU16ZzRNVGMwUXpBdU5Ea3dPVFkzSURBdU16a3hORE0wSURBdU5Ea3pPRFkxSURBdU16azBNek15SURBdU5EazNNVEkxSURBdU16azBNek15V2lJZ1ptbHNiRDBpSXpBd09URkZNaUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrM01USTFJREF1TXpBMU9ETXhTREF1TlRZMU9UVkRNQzQxTmpreU1TQXdMak13TlRnek1TQXdMalUzTWpFd09DQXdMak13TXpJNU5TQXdMalUzTWpFd09DQXdMakk1T1RZM00xWXdMakl6T0RBNU1rTXdMalUzTWpFd09DQXdMakl6TkRnek1pQXdMalUyT1RJeElEQXVNak14T1RNMElEQXVOVFkxT1RVZ01DNHlNekU1TXpSSU1DNDBPVGN4TWpWRE1DNDBPVE00TmpVZ01DNHlNekU1TXpRZ01DNDBPVEE1TmpjZ01DNHlNelEwTmprZ01DNDBPVEE1TmpjZ01DNHlNemd3T1RKV01DNHlPVGsyTnpORE1DNDBPVEE1TmpjZ01DNHpNREk1TXpNZ01DNDBPVE00TmpVZ01DNHpNRFU0TXpFZ01DNDBPVGN4TWpVZ01DNHpNRFU0TXpGYUlpQm1hV3hzUFNJak1EQTVNVVV5SWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU9UTXdOeklnTUM0ME9ESXlNak5JTUM0Mk5qRTRPVGxETUM0Mk5qVXhOVGtnTUM0ME9ESXlNak1nTUM0Mk5qZ3dOVGNnTUM0ME56azJPRGNnTUM0Mk5qZ3dOVGNnTUM0ME56WXdOalZXTUM0ME1UUTBPRE5ETUM0Mk5qZ3dOVGNnTUM0ME1URXlNak1nTUM0Mk5qVTFNaklnTUM0ME1EZ3pNalVnTUM0Mk5qRTRPVGtnTUM0ME1EZ3pNalZJTUM0MU9UTXdOekpETUM0MU9EazRNVElnTUM0ME1EZ3pNalVnTUM0MU9EWTVNVFFnTUM0ME1UQTROakVnTUM0MU9EWTVNVFFnTUM0ME1UUTBPRE5XTUM0ME56WXdOalZETUM0MU9EY3lOellnTUM0ME56azJPRGNnTUM0MU9EazRNVElnTUM0ME9ESXlNak1nTUM0MU9UTXdOeklnTUM0ME9ESXlNak5hSWlCbWFXeHNQU0lqTURBNU1VVXlJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjU0IiB5PSI1NTAiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iS3ViZXJuZXRlcyZhbXA7bmJzcDsiIGlyLnNvdXJjZVN0eWxlPSJncm91cDtmb250Q29sb3I9IzhDOEM4QztmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jMDAwMDAwO2NvbnRhaW5lcj0wO3JlY3Vyc2l2ZVJlc2l6ZT0xO3ZlcnRpY2FsQWxpZ249bWlkZGxlO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtzdHJva2VXaWR0aD0xO2ZvbnRTaXplPTEzO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7ZGFzaGVkPTE7IiBpZD0iMTU4Ij48bXhDZWxsIHN0eWxlPSJncm91cDtmb250Q29sb3I9IzhDOEM4QztmaWxsQ29sb3I9I2RiZWFmNztzdHJva2VDb2xvcj0jMjBDOUUzO2NvbnRhaW5lcj0xO3JlY3Vyc2l2ZVJlc2l6ZT0wO3ZlcnRpY2FsQWxpZ249dG9wO3JvdW5kZWQ9MTthcmNTaXplPTM7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtzdHJva2VXaWR0aD0xO2ZvbnRTaXplPTEzO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDt0ZXh0RGlyZWN0aW9uPWx0cjtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7IiBwYXJlbnQ9IjI1MCIgdmVydGV4PSIxIiBjb25uZWN0YWJsZT0iMCI+PG14R2VvbWV0cnkgeD0iNzQiIHk9IjUzNCIgd2lkdGg9IjQzOCIgaGVpZ2h0PSIyMTciIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjE0NiIgdmFsdWU9Ikt1YmVybmV0ZXMgQ2x1c3RlciIgc3R5bGU9ImlyLnJlZj03MWNkNTQwNC1lMmVmLTRjNTktYjhjOS04YWQxYTIxOTU0MGY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9a3ViZXJuZXRlcy1jbHVzdGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVORGsyTnpFeElEQXVNREE0TVRReU1qZERNQzQwT0RneE1UVWdNQzR3TURnMU9EZ3hOaUF3TGpRM09UWTVNeUF3TGpBeE1EYzRNamdnTUM0ME56RTVNemtnTUM0d01UUTFPVGMwVERBdU1UTXpPVEE1SURBdU1UZ3dPVEUyUXpBdU1USTFNVFlnTUM0eE9EVXlNVGdnTUM0eE1UYzBOek1nTUM0eE9URTBOemtnTUM0eE1URTBNVGdnTUM0eE9Ua3lNekpETUM0eE1EVXpOak1nTUM0eU1EWTVPRFVnTUM0eE1ERXdPVFlnTUM0eU1UWXdNeklnTUM0d09UZzVNelEwSURBdU1qSTFOekF4VERBdU1ERTFOVFFnTUM0MU9Ua3lPVFJETUM0d01UTTJNVFF6SURBdU5qQTNPVEF5SURBdU1ERXpNems0T0NBd0xqWXhOamd4TmlBd0xqQXhORGt3TmpJZ01DNDJNalUxTVRGRE1DNHdNVFkwTVRNM0lEQXVOak0wTWpBMUlEQXVNREU1TmpFek5DQXdMalkwTWpVd01pQXdMakF5TkRNeE5qRWdNQzQyTkRrNU1URkRNQzR3TWpVME5UWTBJREF1TmpVeE56SXlJREF1TURJMk5qZ3lPQ0F3TGpZMU16UTNOU0F3TGpBeU56azVNRGdnTUM0Mk5UVXhOalJNTUM0eU5qRTVOaklnTUM0NU5UUTNNalJETUM0eU5qZ3dNVGdnTUM0NU5qSTBOellnTUM0eU56VTNNRFlnTUM0NU5qZzNNelFnTUM0eU9EUTBOVFlnTUM0NU56TXdNelJETUM0eU9UTXlNRFVnTUM0NU56Y3pNelVnTUM0ek1ESTNPU0F3TGprM09UVTJOeUF3TGpNeE1qVWdNQzQ1TnprMU5qVk1NQzQyT0RjM01TQXdMamszT1RRM05rTXdMalk1TnpReE5pQXdMamszT1RRNE15QXdMamN3TmprNU9TQXdMamszTnpJMU9DQXdMamN4TlRjME9DQXdMamszTWprMk5rTXdMamN5TkRRNU55QXdMamsyT0RZM015QXdMamN6TWpFNE55QXdMamsyTWpReU15QXdMamN6T0RJME9DQXdMamsxTkRZNFREQXVPVGN5TVRNeUlEQXVOalUxTURjMVF6QXVPVGM0TVRreUlEQXVOalEzTXpJZ01DNDVPREkwTmpJZ01DNDJNemd5TnlBd0xqazRORFl5TlNBd0xqWXlPRFU1TjBNd0xqazROamM0T0NBd0xqWXhPRGt5TkNBd0xqazROamM0T0NBd0xqWXdPRGczT0NBd0xqazRORFl5TmlBd0xqVTVPVEl3TlV3d0xqa3dNVEV3TWlBd0xqSXlOVFl4TWtNd0xqZzVPRGswTVNBd0xqSXhOVGswTXlBd0xqZzVORFkzTkNBd0xqSXdOamc1TmlBd0xqZzRPRFl4T1NBd0xqRTVPVEUwTTBNd0xqZzRNalUyTkNBd0xqRTVNVE01SURBdU9EYzBPRGMzSURBdU1UZzFNVEk1SURBdU9EWTJNVEk0SURBdU1UZ3dPREkzVERBdU5USTRNRFUwSURBdU1ERTBOVGszTkVNd0xqVXhPRE13TVNBd0xqQXdPVGM1T0RreElEQXVOVEEzTlRJeklEQXVNREEzTlRjNU16SWdNQzQwT1RZM01URWdNQzR3TURneE5ESXlOMVl3TGpBd09ERTBNakkzV2lJZ1ptbHNiRDBpSXpNeU5rTkZOU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRrNU9UUTFJREF1TVRNMU1qVTBRekF1TkRnNE56Y3hJREF1TVRNMU1qVTFJREF1TkRjNU56RXhJREF1TVRRMU5qRTVJREF1TkRjNU56RXlJREF1TVRVNE5EQXpRekF1TkRjNU56RXlJREF1TVRVNE5UazVJREF1TkRjNU56VXhJREF1TVRVNE56ZzNJREF1TkRjNU56VTFJREF1TVRVNE9UZ3lRekF1TkRjNU56TTVJREF1TVRZd056RTVJREF1TkRjNU5qVTNJREF1TVRZeU9ERXlJREF1TkRjNU56RXlJREF1TVRZME16STBRekF1TkRjNU9UYzVJREF1TVRjeE5qazRJREF1TkRneE5UUWdNQzR4Tnpjek5ERWdNQzQwT0RJME56a2dNQzR4T0RReE16UkRNQzQwT0RReE9ERWdNQzR4T1RnMk56VWdNQzQwT0RVMk1EY2dNQzR5TVRBM01qY2dNQzQwT0RRM01qY2dNQzR5TWpFNU0wTXdMalE0TXpnM01TQXdMakl5TmpFMU5DQXdMalE0TURnMUlEQXVNak13TURFNElEQXVORGM0TVRVMklEQXVNak15TnpBelREQXVORGMzTmpnZ01DNHlOREUxTVRoRE1DNDBOalUxTXpnZ01DNHlOREkxTlRRZ01DNDBOVE16TVRVZ01DNHlORFEwTlRFZ01DNDBOREV4TURZZ01DNHlORGN6TURWRE1DNHpPRGcxTnpFZ01DNHlOVGsxT0RnZ01DNHpORE16TkNBd0xqSTROelExTkNBd0xqTXdPRGt3TXlBd0xqTXlOVEEzT0VNd0xqTXdOalkyT0NBd0xqTXlNelV3T0NBd0xqTXdNamMxT1NBd0xqTXlNRFl5SURBdU16QXhOVGszSURBdU16RTVOek0yUXpBdU1qazNPVGcwSURBdU16SXdNak00SURBdU1qazBNek16SURBdU16SXhNemcySURBdU1qZzVOVGM0SURBdU16RTROVE0wUXpBdU1qZ3dOVEkwSURBdU16RXlNalU0SURBdU1qY3lNamMzSURBdU16QXpOVGswSURBdU1qWXlNams1SURBdU1qa3pNVFU1UXpBdU1qVTNOekkzSURBdU1qZzRNVFkzSURBdU1qVTBOREUySURBdU1qZ3pOREV6SURBdU1qUTRPVGd6SURBdU1qYzROakF4UXpBdU1qUTNOelVnTUM0eU56YzFNRGdnTUM0eU5EVTROamNnTUM0eU56WXdNekVnTUM0eU5EUTBPRGNnTUM0eU56UTVNRFpETUM0eU5EQXlOQ0F3TGpJM01UUXlJREF1TWpNMU1qTXhJREF1TWpZNU5qQXhJREF1TWpNd016azBJREF1TWpZNU5ETXhRekF1TWpJME1UYzBJREF1TWpZNU1qRXhJREF1TWpFNE1UZzJJREF1TWpjeE56RTFJREF1TWpFME1qWTRJREF1TWpjMk56YzJRekF1TWpBM016QXlJREF1TWpnMU56Y3pJREF1TWpBNU5UTXpJREF1TWprNU5USTBJREF1TWpFNU1qUWdNQzR6TURjME9UTkRNQzR5TVRrek16Z2dNQzR6TURjMU56UWdNQzR5TVRrME5ETWdNQzR6TURjMk16Y2dNQzR5TVRrMU5ESWdNQzR6TURjM01UWkRNQzR5TWpBNE56WWdNQzR6TURnNE1qa2dNQzR5TWpJMU1TQXdMak14TURJMU5pQXdMakl5TXpjek5pQXdMak14TVRFNE9FTXdMakl5T1RVd01TQXdMak14TlRVM01TQXdMakl6TkRjMk5pQXdMak14TnpneE5TQXdMakkwTURVeElEQXVNekl4TWprMFF6QXVNalV5TmpFeElEQXVNekk0T1RnNUlEQXVNall5TmpReUlEQXVNek0xTXpjZ01DNHlOekExT1RrZ01DNHpORE13TmpORE1DNHlOek0zTURjZ01DNHpORFkwTnpRZ01DNHlOelF5TlNBd0xqTTFNalE0TkNBd0xqSTNORFkyTXlBd0xqTTFOVEE0TTB3d0xqSTRNVEUwT0NBd0xqTTJNVEEwT0VNd0xqSTBOalF6TXlBd0xqUXhORGcwTlNBd0xqSXpNRE0yTnlBd0xqUTRNVEk1TlNBd0xqSXpPVGcyTWlBd0xqVTBPVEF3TWt3d0xqSXpNVE00T0NBd0xqVTFNVFUwUXpBdU1qSTVNVFUxSURBdU5UVTBOVEVnTUM0eU1qVTVPVGtnTUM0MU5Ua3hPRElnTUM0eU1qSTJPVGdnTUM0MU5qQTFOemRETUM0eU1USXlPRGdnTUM0MU5qTTVOVFFnTUM0eU1EQTFOeklnTUM0MU5qVXhPVE1nTUM0eE9EWTBNamNnTUM0MU5qWTNNa013TGpFM09UYzROaUF3TGpVMk56STRPU0F3TGpFM05EQTFOaUF3TGpVMk5qazFJREF1TVRZM01ERTJJREF1TlRZNE16SXpRekF1TVRZMU5EWTJJREF1TlRZNE5qSTFJREF1TVRZek16QTNJREF1TlRZNU1qQTFJREF1TVRZeE5qRXlJREF1TlRZNU5qRTBRekF1TVRZeE5UVXpJREF1TlRZNU5qSTNJREF1TVRZeE5EazRJREF1TlRZNU5qUTFJREF1TVRZeE5ETTVJREF1TlRZNU5qVTVRekF1TVRZeE16UTJJREF1TlRZNU5qZ3hJREF1TVRZeE1qSTFJREF1TlRZNU56STNJREF1TVRZeE1UTTJJREF1TlRZNU56UTRRekF1TVRRNU1qRXhJREF1TlRjeU56RTFJREF1TVRReE5UVWdNQzQxT0RRd01ESWdNQzR4TkRRd01UWWdNQzQxT1RVeE1qTkRNQzR4TkRZME9ETWdNQzQyTURZeU5EWWdNQzR4TlRneE16SWdNQzQyTVRNd01URWdNQzR4TnpBeE1qZ2dNQzQyTVRBek5EaERNQzR4TnpBeU1UVWdNQzQyTVRBek1qY2dNQzR4TnpBek5ERWdNQzQyTVRBek1qUWdNQzR4TnpBME16RWdNQzQyTVRBek1ETkRNQzR4TnpBMU5qWWdNQzQyTVRBeU56RWdNQzR4TnpBMk9EWWdNQzQyTVRBeU1EUWdNQzR4TnpBNE1pQXdMall4TURFM1F6QXVNVGN5TkRreUlEQXVOakE1TnpreUlEQXVNVGMwTlRnNElEQXVOakE1TXpjeElEQXVNVGMyTURVeElEQXVOakE0T1RZNFF6QXVNVGd5T1RjeklEQXVOakEzTURZZ01DNHhPRGM1T0RZZ01DNDJNRFF5TlRVZ01DNHhPVFF5TURrZ01DNDJNREU0TURGRE1DNHlNRGMxT1RZZ01DNDFPVFk0TlRZZ01DNHlNVGcyT0RRZ01DNDFPVEkzTWpZZ01DNHlNamswT0RZZ01DNDFPVEV4TVRaRE1DNHlNek01T1RjZ01DNDFPVEEzTlRJZ01DNHlNemczTlRFZ01DNDFPVE01T0RNZ01DNHlOREV4TVRVZ01DNDFPVFV6TkRWTU1DNHlORGs1TXpVZ01DNDFPVE0zT0RkRE1DNHlOekF5TXlBd0xqWTFPRFU0TVNBd0xqTXhNamMyTVNBd0xqY3hNRGsxTVNBd0xqTTJOall4TnlBd0xqYzBNemd4TWt3d0xqTTJNamswTXlBd0xqYzFNamc1TkVNd0xqTTJOREkyTnlBd0xqYzFOalF5SURBdU16WTFOekk0SURBdU56WXhNVGt5SURBdU16WTBOelF5SURBdU56WTBOamMwUXpBdU16WXdPREUwSURBdU56YzFNVFl4SURBdU16VTBNRGc0SURBdU56ZzJNakk1SURBdU16UTJOREk0SURBdU56azROVFk1UXpBdU16UXlOekU1SURBdU9EQTBNamNnTUM0ek16ZzVNalFnTUM0NE1EZzJPVFVnTUM0ek16VTFOemNnTUM0NE1UVXlNVGxETUM0ek16UTNOellnTUM0NE1UWTNPQ0F3TGpNek16YzFOaUF3TGpneE9URTNPQ0F3TGpNek1qazRNeUF3TGpneU1EZ3lPRU13TGpNeU56YzRNeUF3TGpnek1qSTROU0F3TGpNek1UVTVOeUF3TGpnME5UUTRNU0F3TGpNME1UVTROaUF3TGpnMU1EUXpNa013TGpNMU1UWXpPQ0F3TGpnMU5UUXhOU0F3TGpNMk5ERXhOQ0F3TGpnMU1ERTJJREF1TXpZNU5URTBJREF1T0RNNE5qaERNQzR6TmprMU1qSWdNQzQ0TXpnMk5qUWdNQzR6TmprMU5TQXdMamd6T0RZMU1TQXdMak0yT1RVMU55QXdMamd6T0RZek5VTXdMak0yT1RVMk15QXdMamd6T0RZeU1pQXdMak0yT1RVMU1pQXdMamd6T0RZd015QXdMak0yT1RVMU55QXdMamd6T0RVNU1VTXdMak0zTURNeU5pQXdMamd6TmprMk15QXdMak0zTVRReE5pQXdMamd6TkRneU5DQXdMak0zTWpBMk5TQXdMamd6TXpJNU0wTXdMak0zTkRrek1TQXdMamd5TmpVek1TQXdMak0zTlRnNE5TQXdMamd5TURjek5pQXdMak0zTnprd01TQXdMamd4TkRFNU5VTXdMak00TXpJMU5DQXdMamd3TURNME9DQXdMak00TmpFNU5TQXdMamM0TlRneE9TQXdMak01TXpVMk5TQXdMamMzTmpjMk5rTXdMak01TlRVNE15QXdMamMzTkRJNE55QXdMak01T0RnM015QXdMamMzTXpNek15QXdMalF3TWpJNE5DQXdMamMzTWpNNU0wd3dMalF3TmpnMk5pQXdMamMyTXpnME5VTXdMalExTXpneE55QXdMamM0TWpRd015QXdMalV3TmpNM01TQXdMamM0TnpNNE15QXdMalUxT0RnM0lEQXVOemMxTVRBNFF6QXVOVGN3T0RRMklEQXVOemN5TXpBNElEQXVOVGd5TkRBNElEQXVOelk0TmpnMElEQXVOVGt6TlRnMUlEQXVOelkwTXpNMVF6QXVOVGswT0RjeklEQXVOelkyTmpnNElEQXVOVGszTWpZMklEQXVOemN4TWpFZ01DNDFPVGM1TURnZ01DNDNOekl6TkRoRE1DNDJNREV6TnpRZ01DNDNOek0xTVNBd0xqWXdOVEUxT0NBd0xqYzNOREV3T1NBd0xqWXdPREkwTVNBd0xqYzNPRGd3TTBNd0xqWXhNemMxTkNBd0xqYzRPRFV3TXlBd0xqWXhOelV5TlNBd0xqYzVPVGszT0NBd0xqWXlNakV4T0NBd0xqZ3hNemd6T1VNd0xqWXlOREV6TkNBd0xqZ3lNRE0zT1NBd0xqWXlOVEV6TVNBd0xqZ3lOakUzTlNBd0xqWXlOems1T0NBd0xqZ3pNamt6TjBNd0xqWXlPRFkxTVNBd0xqZ3pORFEzT0NBd0xqWXlPVGN6TlNBd0xqZ3pOalkwT0NBd0xqWXpNRFV3TlNBd0xqZ3pPREkzT1VNd0xqWXpOVGc1TXlBd0xqZzBPVGM1TnlBd0xqWTBPRFF3T1NBd0xqZzFOVEEzSURBdU5qVTRORGMySURBdU9EVXdNRGMyUXpBdU5qWTRORFkwSURBdU9EUTFNVEl5SURBdU5qY3lNamd5SURBdU9ETXhPVEk0SURBdU5qWTNNRGM1SURBdU9ESXdORGN5UXpBdU5qWTJNekEySURBdU9ERTRPREl5SURBdU5qWTFNalF6SURBdU9ERTJOREkwSURBdU5qWTBORFF5SURBdU9ERTBPRFl6UXpBdU5qWXhNRGsxSURBdU9EQTRNek01SURBdU5qVTNNeUF3TGpnd016azFPQ0F3TGpZMU16VTVNU0F3TGpjNU9ESTFPRU13TGpZME5Ua3pNU0F3TGpjNE5Ua3hPQ0F3TGpZek9UVTNOeUF3TGpjM05UWTJOeUF3TGpZek5UWTFJREF1TnpZMU1UZ3hRekF1TmpNME1EQTNJREF1TnpVNU56Y3lJREF1TmpNMU9USTNJREF1TnpVMk5EQTVJREF1TmpNM01qQTJJREF1TnpVeU9EazBRekF1TmpNMk5EUWdNQzQzTlRFNU9TQXdMall6TkRnZ01DNDNORFk0T0RJZ01DNDJNek00TXpRZ01DNDNORFEwT0VNd0xqWTRPVGd3TXlBd0xqY3hNRFExSURBdU56TXhNRGcySURBdU5qVTJNVEkzSURBdU56VXdORGMwSURBdU5Ua3pNemczUXpBdU56VXpNRGt5SURBdU5Ua3pPREVnTUM0M05UYzJORElnTUM0MU9UUTJNemtnTUM0M05Ua3hNaUF3TGpVNU5EazBOVU13TGpjMk1qRTJNeUF3TGpVNU1qZzNPQ0F3TGpjMk5EazJNU0F3TGpVNU1ERTRNaUF3TGpjM01EUTBOeUF3TGpVNU1EWXlOME13TGpjNE1USTBPU0F3TGpVNU1qSXpOaUF3TGpjNU1qTXpOaUF3TGpVNU5qTTJOeUF3TGpnd05UY3lOQ0F3TGpZd01UTXhNVU13TGpneE1UazBOeUF3TGpZd016YzJOaUF3TGpneE5qazJJREF1TmpBMk5qRTFJREF1T0RJek9EZ3hJREF1TmpBNE5USXpRekF1T0RJMU16UTBJREF1TmpBNE9USTJJREF1T0RJM05EUWdNQzQyTURrek1ESWdNQzQ0TWpreE1USWdNQzQyTURrMk9FTXdMamd5T1RJME55QXdMall3T1RjeE5DQXdMamd5T1RNMk5pQXdMall3T1RjNE1pQXdMamd5T1RVd01pQXdMall3T1RneE5FTXdMamd5T1RVNU1pQXdMall3T1Rnek5TQXdMamd5T1RjeE9DQXdMall3T1Rnek9DQXdMamd5T1Rnd05DQXdMall3T1RnMU9FTXdMamcwTVRnd01pQXdMall4TWpVeE9DQXdMamcxTXpRMU1pQXdMall3TlRjMU55QXdMamcxTlRreE5pQXdMalU1TkRZek0wTXdMamcxT0RNNElEQXVOVGd6TlRFeUlEQXVPRFV3TnpJeUlEQXVOVGN5TWpJeUlEQXVPRE00TnprMklEQXVOVFk1TWpVNFF6QXVPRE0zTURZeUlEQXVOVFk0T0RVeUlEQXVPRE0wTmpBeUlEQXVOVFk0TVRZeUlEQXVPRE15T1RFM0lEQXVOVFkzT0RNelF6QXVPREkxT0RjMklEQXVOVFkyTkRZZ01DNDRNakF4TkRjZ01DNDFOalkzT1RrZ01DNDRNVE0xTURZZ01DNDFOall5TXpGRE1DNDNPVGt6TmpFZ01DNDFOalEzTURVZ01DNDNPRGMyTkRVZ01DNDFOak0wTmpNZ01DNDNOemN5TXpRZ01DNDFOakF3T0RkRE1DNDNOekk1T0RrZ01DNDFOVGd6T1RJZ01DNDNOams1TnlBd0xqVTFNekU1TVNBd0xqYzJPRFV3TVNBd0xqVTFNVEExVERBdU56WXdNek1nTUM0MU5EZzJNREpETUM0M05qUTFOamNnTUM0MU1UY3dOREVnTUM0M05qTTBNalFnTUM0ME9EUXhPVFVnTUM0M05UWXdPVFFnTUM0ME5URXpNME13TGpjME9EWTVOU0F3TGpReE9ERTJJREF1TnpNMU5qRTVJREF1TXpnM09ESXlJREF1TnpFNE1UYzVJREF1TXpZeE1Ea3pRekF1TnpJd01qYzFJREF1TXpVNU1UTXhJREF1TnpJME1qTXpJREF1TXpVMU5USXhJREF1TnpJMU16VTJJREF1TXpVME5EWkRNQzQzTWpVMk9EUWdNQzR6TlRBM01qRWdNQzQzTWpVME1ESWdNQzR6TkRZNE1ESWdNQzQzTWpreE5pQXdMak0wTWpZMk1rTXdMamN6TnpFeE55QXdMak16TkRrMk9TQXdMamMwTnpFME9TQXdMak15T0RVNE9TQXdMamMxT1RJMUlEQXVNekl3T0RrelF6QXVOelkwT1RreklEQXVNekUzTkRFMElEQXVOemN3TXpBeUlEQXVNekUxTVRjeElEQXVOemMyTURZM0lEQXVNekV3TnpnNFF6QXVOemMzTXpjZ01DNHpNRGszT1RZZ01DNDNOemt4TlNBd0xqTXdPREl5TnlBd0xqYzRNRFV5SURBdU16QTNNRGt6UXpBdU56a3dNakkxSURBdU1qazVNVElnTUM0M09USTBOVGtnTUM0eU9EVXpOeUF3TGpjNE5UUTVNU0F3TGpJM05qTTNOVU13TGpjM09EVXlNeUF3TGpJMk56TTRNU0F3TGpjMk5UQXlNU0F3TGpJMk5qVXpNeUF3TGpjMU5UTXhOU0F3TGpJM05EVXdOa013TGpjMU16a3pOQ0F3TGpJM05UWXpNaUF3TGpjMU1qQTJJREF1TWpjM01UQXlJREF1TnpVd09ERTVJREF1TWpjNE1qQXhRekF1TnpRMU16ZzNJREF1TWpnek1ERXpJREF1TnpReU1ETXpJREF1TWpnM056WTJJREF1TnpNM05EWXhJREF1TWpreU56VTRRekF1TnpJM05EZ3pJREF1TXpBek1UazBJREF1TnpFNU1qTTFJREF1TXpFeE9UQXhJREF1TnpFd01UZ3hJREF1TXpFNE1UYzRRekF1TnpBMk1qVTRJREF1TXpJd05UTWdNQzQzTURBMU1URWdNQzR6TVRrM01UWWdNQzQyT1RjNU1ETWdNQzR6TVRrMU5UaE1NQzQyT1RBeU1EZ2dNQzR6TWpVeU1URkRNQzQyTkRZek1qZ2dNQzR5TnpjNE1qa2dNQzQxT0RZMU9ETWdNQzR5TkRjMU16WWdNQzQxTWpJeU5USWdNQzR5TkRFMk5URkRNQzQxTWpJd056TWdNQzR5TXpnNE56VWdNQzQxTWpFNE16Y2dNQzR5TXpNNE5UY2dNQzQxTWpFM056Y2dNQzR5TXpJek5EZERNQzQxTVRreE5ETWdNQzR5TWprM05USWdNQzQxTVRVNU5qSWdNQzR5TWpjMU16Y2dNQzQxTVRVeE5qSWdNQzR5TWpFNU0wTXdMalV4TkRJNE1pQXdMakl4TURjeU55QXdMalV4TlRjMU1pQXdMakU1T0RZM05TQXdMalV4TnpRMU5DQXdMakU0TkRFek5FTXdMalV4T0RNNU15QXdMakUzTnpNME1TQXdMalV4T1RrMU5DQXdMakUzTVRZNU9DQXdMalV5TURJeU1TQXdMakUyTkRNeU5FTXdMalV5TURJNE1TQXdMakUyTWpZME9DQXdMalV5TURFNE5DQXdMakUyTURJeE5pQXdMalV5TURFM055QXdMakUxT0RRd00wTXdMalV5TURFM05pQXdMakUwTlRZeE9TQXdMalV4TVRFeE9TQXdMakV6TlRJMU15QXdMalE1T1RrME5TQXdMakV6TlRJMU5FZ3dMalE1T1RrME5WcE5NQzQwTnpRMk1URWdNQzR5T1RZNE5UUk1NQzQwTmpnMk1ESWdNQzQwTURZeE5EVk1NQzQwTmpneE5qa2dNQzQwTURZek5qZERNQzQwTmpjM05qWWdNQzQwTVRZeE5EVWdNQzQwTlRrNU5USWdNQzQwTWpNNU5USWdNQzQwTlRBek5UZ2dNQzQwTWpNNU5USkRNQzQwTkRZME1qZ2dNQzQwTWpNNU5USWdNQzQwTkRJNElEQXVOREl5TmpVeUlEQXVORE01T0RVeUlEQXVOREl3TkRNMVREQXVORE01TmpjNUlEQXVOREl3TlRJMFREQXVNelV5TmpVMElEQXVNelUyT1RrM1F6QXVNemM1TkNBd0xqTXlPVGt4TkNBd0xqUXhNell4TVNBd0xqTXdPVGtnTUM0ME5UTXdNemdnTUM0ek1EQTJPREpETUM0ME5qQXlOQ0F3TGpJNU9EazVPQ0F3TGpRMk56UXpPU0F3TGpJNU56YzBPU0F3TGpRM05EWXhNU0F3TGpJNU5qZzFORnBOTUM0MU1qVXpNaklnTUM0eU9UWTROVFJETUM0MU56RXpOVE1nTUM0ek1ESTJPRE1nTUM0Mk1UTTVNak1nTUM0ek1qUXhORGNnTUM0Mk5EWTFORFFnTUM0ek5UY3dOREpNTUM0MU5qQXdPQ0F3TGpReU1ERTJPRXd3TGpVMU9UYzNPQ0F3TGpReU1EQXpORU13TGpVMU1qRXdNeUF3TGpReU5UZ3dOaUF3TGpVME1USTVJREF1TkRJME16YzBJREF1TlRNMU16QTRJREF1TkRFMk5qVXhRekF1TlRNeU9EVTRJREF1TkRFek5EZzNJREF1TlRNeE5UY3lJREF1TkRBNU56WTNJREF1TlRNeE5ERTRJREF1TkRBMk1ERXhUREF1TlRNeE16TXhJREF1TkRBMU9UWTNUREF1TlRJMU16SXlJREF1TWprMk9EVTBXazB3TGpNeU1UQTVOQ0F3TGpNNU56Z3lUREF1TkRBd05UVTFJREF1TkRjeE1EQTNUREF1TkRBd05EWTRJREF1TkRjeE5EVXlRekF1TkRBM05qUWdNQzQwTnpjNE56TWdNQzQwTURnMk9UZ2dNQzQwT0Rrd01UUWdNQzQwTURJM01UWWdNQzQwT1RZM016aERNQzQwTURBeU5qWWdNQzQwT1RrNU1ESWdNQzR6T1RZNU9EWWdNQzQxTURJd01qVWdNQzR6T1RNME5qVWdNQzQxTURNd01UVk1NQzR6T1RNek56Z2dNQzQxTURNek56Sk1NQzR5T1RFMU1qUWdNQzQxTXpNMk5EUkRNQzR5T0RZek5DQXdMalE0TkRnek1TQXdMakk1TnpVeE1pQXdMalF6TnpNNElEQXVNekl4TURrMElEQXVNemszT0RKYVRUQXVOamM0TWpNeklEQXVNemszT0RZMFF6QXVOamt3TURNNUlEQXVOREUzTlRjZ01DNDJPVGc1T0NBd0xqUXpPVFUzT1NBd0xqY3dORE13TWlBd0xqUTJNelF6T1VNd0xqY3dPVFUySURBdU5EZzNNREV6SURBdU56RXdPRGdnTUM0MU1UQTFORFVnTUM0M01EZzNNVElnTUM0MU16TXlPRGRNTUM0Mk1EWXpNemtnTUM0MU1ESTVNalpNTUM0Mk1EWXlOVElnTUM0MU1ESTBPREZETUM0MU9UY3dPRFVnTUM0ME9UazVNREVnTUM0MU9URTBOVEVnTUM0ME9UQXlPVGtnTUM0MU9UTTFPRFVnTUM0ME9EQTJOamRETUM0MU9UUTBOVGtnTUM0ME56WTNNaklnTUM0MU9UWTBPVE1nTUM0ME56TXpPRFFnTUM0MU9Ua3lORGdnTUM0ME56QTVNVGhNTUM0MU9Ua3lNRFVnTUM0ME56QTJPVFZNTUM0Mk56Z3lNek1nTUM0ek9UYzROalJJTUM0Mk56Z3lNek5hVFRBdU5EZ3pOalEySURBdU5EYzJOall4U0RBdU5URTJNa3d3TGpVek5qUXpNeUF3TGpVd01qY3dORXd3TGpVeU9URTNJREF1TlRNMU1qQXlUREF1TkRrNU9UUTFJREF1TlRRNU5qZE1NQzQwTnpBMk16UWdNQzQxTXpVeE5UZE1NQzQwTmpNek56RWdNQzQxTURJMk5UbE1NQzQwT0RNMk5EWWdNQzQwTnpZMk5qRmFUVEF1TlRnNE1EQTRJREF1TlRZMU56ZzFRekF1TlRnNU16a3lJREF1TlRZMU56RTBJREF1TlRrd056WTVJREF1TlRZMU9EUXlJREF1TlRreU1URTFJREF1TlRZMk1EazNUREF1TlRreU1qZzRJREF1TlRZMU9EYzFUREF1TmprM05qUTBJREF1TlRnME1qRTJRekF1TmpneU1qSTFJREF1TmpJNE9ESTBJREF1TmpVeU56SXhJREF1TmpZM05EWTRJREF1TmpFek1qazVJREF1Tmprek16STVUREF1TlRjeU5EQXhJREF1TlRreE5qQTJUREF1TlRjeU5UTXhJREF1TlRreE5ESTRRekF1TlRZNE56YzBJREF1TlRneU5ETTVJREF1TlRjeU5UTTBJREF1TlRjeE9EazRJREF1TlRneE1UYzNJREF1TlRZM05qRXhRekF1TlRnek16a2dNQzQxTmpZMU1UTWdNQzQxT0RVM01ESWdNQzQxTmpVNU1EVWdNQzQxT0Rnd01EZ2dNQzQxTmpVM09EVklNQzQxT0Rnd01EaGFUVEF1TkRFeE1EWWdNQzQxTmpZeU16RkRNQzQwTVRreElEQXVOVFkyTXpRM0lEQXVOREkyTXpFeUlEQXVOVGN5TURreklEQXVOREk0TVRnZ01DNDFPREExTWpGRE1DNDBNamt3TlRRZ01DNDFPRFEwTmpZZ01DNDBNamcyTWprZ01DNDFPRGd6TnpZZ01DNDBNamN4T0RVZ01DNDFPVEU0TWpoTU1DNDBNamMwT0RnZ01DNDFPVEl5TWpsTU1DNHpPRGN3TWpNZ01DNDJPVEk1TWpoRE1DNHpORGt4T1NBd0xqWTJOemt5T1NBd0xqTXhPVEExTnlBd0xqWXpNRFE1T0NBd0xqTXdNamt6TnlBd0xqVTRORFUzTWt3d0xqUXdOek00TlNBd0xqVTJOak15VERBdU5EQTNOVFU0SURBdU5UWTJOVFF5UXpBdU5EQTROekkySURBdU5UWTJNekl4SURBdU5EQTVPVEV4SURBdU5UWTJNakUwSURBdU5ERXhNRFlnTUM0MU5qWXlNekZXTUM0MU5qWXlNekZhVFRBdU5EazVNamsySURBdU5qRXdNelE0UXpBdU5UQXlNRGszSURBdU5qRXdNalF5SURBdU5UQTBPVE01SURBdU5qRXdPRE0wSURBdU5UQTNOalFnTUM0Mk1USXhOek5ETUM0MU1URXhPREVnTUM0Mk1UTTVNamtnTUM0MU1UTTVNVFlnTUM0Mk1UWTJPVFFnTUM0MU1UVTJNemdnTUM0Mk1qQXdNRGhJTUM0MU1UWXdNamRNTUM0MU5qYzFNVFlnTUM0M01UVTRNVEZETUM0MU5qQTRNelFnTUM0M01UZ3hNVGNnTUM0MU5UTTVOalFnTUM0M01qQXdPRGtnTUM0MU5EWTVNemdnTUM0M01qRTNNekZETUM0MU1EYzFOVGtnTUM0M016QTVNemdnTUM0ME5qZ3pNRFlnTUM0M01qZ3hORGtnTUM0ME16STNOaklnTUM0M01UVTJOemRNTUM0ME9EUXhNaklnTUM0Mk1qQXdOVE5JTUM0ME9EUXlNRGhETUM0ME9EY3lPU0F3TGpZeE5ERXlJREF1TkRrek1UTTFJREF1TmpFd05UZ3hJREF1TkRrNU1qazJJREF1TmpFd016UTRXaUlnWm1sc2JEMGlkMmhwZEdVaUlITjBjbTlyWlQwaWQyaHBkR1VpSUhOMGNtOXJaUzEzYVdSMGFEMGlNQzR3TURJeE9EYzRNU0l2UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2Rhc2hlZD0xOyIgcGFyZW50PSIxNTgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTg1LjAwMDAwMDAwMDAwMDA2IiB5PSIxOCIgd2lkdGg9Ijg5LjMxIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJOYW1lc3BhY2U6IHByb2QmbHQ7YnI+TmFtZTogVVMtV2VzdDItcHJvZC1la3MtY2x1c3RlciIgaWQ9IjI3NiI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0wO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0zO2ZpbGxDb2xvcj0jRjVGNUY1O3NoYWRvdz0wOyIgcGFyZW50PSIxNTgiIHZlcnRleD0iMSI+PG14R2VvbWV0cnkgeD0iNDciIHk9IjE1NSIgd2lkdGg9IjM1NSIgaGVpZ2h0PSI1MyIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iQW1hem9uIFJEUyIgaWQ9IjI1NiI+PG14Q2VsbCBzdHlsZT0iZ3JvdXA7Zm9udENvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNkYmVhZjc7c3Ryb2tlQ29sb3I9IzIwQzlFMztjb250YWluZXI9MTtyZWN1cnNpdmVSZXNpemU9MDt2ZXJ0aWNhbEFsaWduPXRvcDtyb3VuZGVkPTE7YXJjU2l6ZT0zO3BlcmltZXRlcj1yZWN0YW5nbGVQZXJpbWV0ZXI7c3Ryb2tlV2lkdGg9MTtmb250U2l6ZT0xMzt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIyNTAiIHZlcnRleD0iMSIgY29ubmVjdGFibGU9IjAiPjxteEdlb21ldHJ5IHg9IjE2MiIgeT0iNTMiIHdpZHRoPSI2NzkiIGhlaWdodD0iMjQyIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxOTMiIHZhbHVlPSJNQU1JIChNeVNRTCkiIHN0eWxlPSJpci5yZWY9NTcxNzhhY2EtYmUzMS00YTE5LTg2MzMtODcxYjE3YjcxNWVmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW15c3FsO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQ0TkRBMk5EVWdNQzR5TkRnd056aERNQzQ0TkRBMk5EVWdNQzR6TkRBNE9UZ2dNQzQyT0RnME1TQXdMalF4TmpBM09DQXdMalV3TURZME5TQXdMalF4TmpBM09FTXdMak14TWpnNElEQXVOREUyTURjNElEQXVNVFl3TmpRMUlEQXVNelF3T0RrNElEQXVNVFl3TmpRMUlEQXVNalE0TURjNFF6QXVNVFl3TmpRMUlEQXVNVFUxTWpVNElEQXVNekV5T0RnZ01DNHdPREF3TnpneElEQXVOVEF3TmpRMUlEQXVNRGd3TURjNE1VTXdMalk0T0RReElEQXVNRGd3TURjNE1TQXdMamcwTURZME5TQXdMakUxTlRJMU9DQXdMamcwTURZME5TQXdMakkwT0RBM09GcE5NQzQ0TkRBMk5EVWdNQzR6TnpZek1EUkRNQzQ0TVRreE5qSWdNQzR6T1RRNU56a2dNQzQzT1RVeU5qY2dNQzQwTVRBM05UVWdNQzQzTmprMU9EVWdNQzQwTWpNeU1UaERNQzQyT1RjME1Ua2dNQzQwTlRnNE16UWdNQzQyTURJek1EUWdNQzQwTnprd056Z2dNQzQxTURBMk5EVWdNQzQwTnprd056aERNQzR6T1RnNU9EVWdNQzQwTnprd056Z2dNQzR6TURNNE5qa2dNQzQwTlRnNE16UWdNQzR5TXpFM01EVWdNQzQwTWpNeU1UaERNQzR5TURZd01qSWdNQzQwTVRBM05UVWdNQzR4T0RJeE1qY2dNQzR6T1RRNU56a2dNQzR4TmpBMk5EVWdNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TmpBMk5EVWdNQzQ0TkRRNE9UZ2dNQzR6TVRJNE9DQXdMamt5TURBM09DQXdMalV3TURZME5TQXdMamt5TURBM09FTXdMalk0T0RReElEQXVPVEl3TURjNElEQXVPRFF3TmpRMUlEQXVPRFEwT0RrNElEQXVPRFF3TmpRMUlEQXVOelV5TURjNFZqQXVNemMyTXpBMFdrMHdMall5T0RVMk5DQXdMamM0TkRVNU1VTXdMalkwTURZM05pQXdMamMzT1RRNE5TQXdMalkxTkRnMElEQXVOemMzTnpVNElEQXVOamN6TXpnNUlEQXVOemM0TWpZMFF6QXVOamN5T1RReUlEQXVOemMwTlRRMklEQXVOalkxT0RReUlEQXVOemN3TWpBM0lEQXVOall3T1RZM0lEQXVOelkzTWpJNFF6QXVOalU1TlRreklEQXVOelkyTXpnNElEQXVOalU0TXprMUlEQXVOelkxTmpVMklEQXVOalUzTlRjeklEQXVOelkxTURjM1F6QXVOalUyTURNM0lEQXVOell6T1RrMUlEQXVOalUwTkRreElEQXVOell5T0RrMElEQXVOalV5T1RNMUlEQXVOell4TnpnMVF6QXVOalEyT1RBeElEQXVOelUzTkRnNElEQXVOalF3TnpFeUlEQXVOelV6TURneElEQXVOak0wTXpZM0lEQXVOelE1TWpVeVF6QXVOak14TmpjeElEQXVOelEzTmpNZ01DNDJNamMzTURjZ01DNDNORFl5TkRRZ01DNDJNalF3TkRrZ01DNDNORFE1TmpaRE1DNDJNakl3TXpRZ01DNDNORFF5TmpJZ01DNDJNakF4TVRFZ01DNDNORE0xT0RrZ01DNDJNVGcxTkRVZ01DNDNOREk1TWpoRE1DNDJNVFkxT1RjZ01DNDNOREl4TURRZ01DNDJNVE01TWpjZ01DNDNOREV5T1NBd0xqWXhNVEEyTVNBd0xqYzBNRFF4TlVNd0xqWXdORFkyTWlBd0xqY3pPRFEyTXlBd0xqVTVOekk0T1NBd0xqY3pOakl4TkNBd0xqVTVORGd4TWlBd0xqY3pNamt3TmtNd0xqVTRPRE0xTkNBd0xqY3lOREkzT0NBd0xqVTRNemM1TlNBd0xqY3hNemt4TWlBd0xqVTNPVEl6SURBdU56QXpOVE01VERBdU5UYzRORFl4SURBdU56QXhOemc1UXpBdU5UYzJNVFV5SURBdU5qazJOVFEzSURBdU5UY3pOVFVnTUM0Mk9URXhOelVnTUM0MU56QTVNekVnTUM0Mk9EVTNOME13TGpVMk9EQTJOeUF3TGpZM09UZzFOaUF3TGpVMk5URTRNeUF3TGpZM016a3dNaUF3TGpVMk1qWTBOQ0F3TGpZMk9EQXpOME13TGpVMk1UWTFNeUF3TGpZMk5UYzBOeUF3TGpVMk1EZzNJREF1TmpZek5UVXlJREF1TlRZd01UQXhJREF1TmpZeE16azJRekF1TlRVNE9UazVJREF1TmpVNE16RXhJREF1TlRVM09USTJJREF1TmpVMU16QTFJREF1TlRVMk16RTJJREF1TmpVeU1qRTJRekF1TlRNNU16RTJJREF1TmpFNU5qSXpJREF1TlRFME5EWXlJREF1TlRreU16QTBJREF1TkRnME1EWTJJREF1TlRjek1UQTVRekF1TkRjME1Ea3hJREF1TlRZMk9EQTVJREF1TkRZek1UQTBJREF1TlRZeE1ERXlJREF1TkRVd09EUTBJREF1TlRVM01qZzNRekF1TkRRM01UUWdNQzQxTlRZeE5qSWdNQzQwTkRNd05ETWdNQzQxTlRVNU56TWdNQzQwTXpnNE9Ua2dNQzQxTlRVM09ESkRNQzQwTXpVeU9ERWdNQzQxTlRVMk1UVWdNQzQwTXpFMk1qWWdNQzQxTlRVME5EY2dNQzQwTWpneE5qVWdNQzQxTlRRMk5USklNQzQwTWpNME1UbERNQzQwTWpBM05DQXdMalUxTXpnMk5TQXdMalF4T0RNME1pQXdMalUxTVRjMU5DQXdMalF4TmpBMU5pQXdMalUwT1RjME1rTXdMalF4TkRjNU5TQXdMalUwT0RZek1pQXdMalF4TXpVMk9DQXdMalUwTnpVMU1pQXdMalF4TWpNME5pQXdMalUwTmpjME1VTXdMalF3TlRFNE1TQXdMalUwTVRrNU5TQXdMak01T0RFeU1pQXdMalV6T0RZME9TQXdMak00T1RZMk5TQXdMalV6TlRFek5rTXdMak00TmpRNElEQXVOVE16T0RFMElEQXVNemMzT1RZeElEQXVOVE13TmpjeElEQXVNemMwT1RBeUlEQXVOVE16TURORE1DNHpOek14TVNBd0xqVXpNell5TWlBd0xqTTNNak13TlNBd0xqVXpORE0zT1NBd0xqTTNNVGN6TnlBd0xqVXpOakU1TWtNd0xqTTJPVGsxTXlBd0xqVXpPRGc0TWlBd0xqTTNNVFU0T1NBd0xqVTBNekEzTVNBd0xqTTNNamM1TkNBd0xqVTBOVFk0TjBNd0xqTTNOVEE1SURBdU5UVXdOamN4SURBdU16YzRNRGMzSURBdU5UVTBNek0ySURBdU16Z3hNVEl6SURBdU5UVTRNRGMwUXpBdU16Z3lOVGMxSURBdU5UVTVPRFUySURBdU16ZzBNRFFnTUM0MU5qRTJOVFFnTUM0ek9EVTBOU0F3TGpVMk16WXlRekF1TXpnMU9Ua3lJREF1TlRZME16Y3pJREF1TXpnMk5UVWdNQzQxTmpVeE5ERWdNQzR6T0RjeE1UWWdNQzQxTmpVNU1qRkRNQzR6T1RBMk9ESWdNQzQxTnpBNE1qY2dNQzR6T1RRMU9UZ2dNQzQxTnpZeU1UY2dNQzR6T1Rjd05UUWdNQzQxT0RFMU5VTXdMalF3TURFek15QXdMalU0T0RJME15QXdMalF3TWpNeU5pQXdMalU1TlRNeE9TQXdMalF3TkRVd09DQXdMall3TWpNMk1rTXdMalF3TmpVME1TQXdMall3T0RreU5TQXdMalF3T0RVMk5TQXdMall4TlRRMU9DQXdMalF4TVRJNE9TQXdMall5TVRZeU5rTXdMalF4TXpRMk5TQXdMall5TmpVMElEQXVOREUyTlRrMUlEQXVOak15TVRRZ01DNDBNVGszTXpNZ01DNDJNell6T1RSRE1DNDBNakEyTkRFZ01DNDJNemMyTWpnZ01DNDBNakU0TURVZ01DNDJNemczTlRRZ01DNDBNakk1T1NBd0xqWXpPVGc1T1VNd0xqUXlOVEV3T0NBd0xqWTBNVGswTnlBd0xqUXlOekk0TnlBd0xqWTBOREExTkNBd0xqUXlPREUyT0NBd0xqWTBOamswTTBNd0xqUXpNRFExTkNBd0xqWTFNRFV6TXlBd0xqUXlOalF6TkNBd0xqWTJNRGs1TVNBd0xqUXlNemc1T1NBd0xqWTJOelU0TlVNd0xqUXlNekkwTlNBd0xqWTJPVEk0TmlBd0xqUXlNalk1SURBdU5qY3dOek1nTUM0ME1qSXpOamdnTUM0Mk56RTNNekpETUM0ME1UWXlPVElnTUM0Mk9UQTJNVFlnTUM0ME1UYzFOellnTUM0M01UY3dNamNnTUM0ME1qUTBOemtnTUM0M016TTBNek5ETUM0ME1qUTJPRGdnTUM0M016TTVNeklnTUM0ME1qUTRPVGNnTUM0M016UTBNemNnTUM0ME1qVXhNRGdnTUM0M016UTVORFZETUM0ME1qYzJNelVnTUM0M05ERXdOU0F3TGpRek1ETTFOQ0F3TGpjME56WXhPQ0F3TGpRek56RXpOaUF3TGpjME9USTFNa013TGpRek56WTNPU0F3TGpjME9EZ3pNU0F3TGpRek56STJPQ0F3TGpjME9UQTFPQ0F3TGpRek9ERTVNaUF3TGpjME9EY3lPRU13TGpRek9EVXdOQ0F3TGpjME5qSXhNeUF3TGpRek9EYzNOU0F3TGpjME16Y3hOaUF3TGpRek9UQTBNaUF3TGpjME1USTFNVU13TGpRME1ERXhPU0F3TGpjek1UTXpNaUF3TGpRME1URTBNU0F3TGpjeU1Ua3lNeUF3TGpRME5EVXlJREF1TnpFek9USXlRekF1TkRRMk1UVTRJREF1TnpFd01EUWdNQzQwTkRnM01UZ2dNQzQzTURZNU1UZ2dNQzQwTlRFeU5ERWdNQzQzTURNNE5FTXdMalExTWpjM09TQXdMamN3TVRrMk5DQXdMalExTkRNd015QXdMamN3TURFd05DQXdMalExTlRVNU5pQXdMalk1T0RGRE1DNDBOVGN5TnpVZ01DNDJPVGt3TmpjZ01DNDBOVGM0TWpFZ01DNDNNREV5T0RNZ01DNDBOVGd6TmpFZ01DNDNNRE0wTnpoRE1DNDBOVGcyTWpVZ01DNDNNRFExTlRNZ01DNDBOVGc0T0RjZ01DNDNNRFUyTWpNZ01DNDBOVGt5T0RJZ01DNDNNRFkxTXpoRE1DNDBOVGszT1RjZ01DNDNNRGMzTXpRZ01DNDBOakF6TVRVZ01DNDNNRGc1TkRZZ01DNDBOakE0TXpjZ01DNDNNVEF4TmpsRE1DNDBOak0wTnpNZ01DNDNNVFl6TXpRZ01DNDBOall5TWpJZ01DNDNNakkzTmpVZ01DNDBOamt6TURjZ01DNDNNamcyT1VNd0xqUTNOekEwTlNBd0xqYzBNelUxTWlBd0xqUTROVFV6TnlBd0xqYzFOemd6TVNBd0xqUTVOVEUwT0NBd0xqYzNNRGczTjBNd0xqUTVPRFUxT1NBd0xqYzNOVFV4TWlBd0xqVXdNekUwT0NBd0xqYzRNRFUwTWlBd0xqVXdOekkzTlNBd0xqYzRORFU0T0VNd0xqVXdOemswTXlBd0xqYzROVEkwTkNBd0xqVXdPRFkzSURBdU56ZzFOemM1SURBdU5UQTVNemc1SURBdU56ZzJNekE0UXpBdU5URXdOVFUwSURBdU56ZzNNVFkySURBdU5URXhOeUF3TGpjNE9EQXdPU0F3TGpVeE1qVTBPQ0F3TGpjNE9UTXpNVWd3TGpVeE16QTNOVll3TGpjNE9UZzJNVU13TGpVd09EVXlNU0F3TGpjNE9ETXdOQ0F3TGpVd05URXhNaUF3TGpjNE5EYzVNeUF3TGpVd01UZ3dNaUF3TGpjNE1UTTRORU13TGpRNU9UazJOQ0F3TGpjM09UUTVJREF1TkRrNE1UVTJJREF1TnpjM05qSTRJREF1TkRrMk1pQXdMamMzTmpFMVF6QXVORGcxTmpNeElEQXVOelk0TVRjeUlEQXVORGN6TVRZMklEQXVOelUyTXpRM0lEQXVORFkyTVRNNUlEQXVOelExTURNeFREQXVORFUyTmpRMElEQXVOekkyTURRM1ZqQXVOekkxTlRFNVF6QXVORFUxT0RBMElEQXVOekkyTmpRZ01DNDBOVFUyTmpVZ01DNDNNamM0TXlBd0xqUTFOVFV3TXlBd0xqY3lPVEl5TkVNd0xqUTFOVFF3T1NBd0xqY3pNREF5TXlBd0xqUTFOVE13T0NBd0xqY3pNRGc0T1NBd0xqUTFOVEEyTXlBd0xqY3pNVGcwTjBNd0xqUTFOREl4TlNBd0xqY3pOVEUwTnlBd0xqUTFNemM1TmlBd0xqY3pPRFUzTWlBd0xqUTFNek01TWlBd0xqYzBNVGc0TWtNd0xqUTFNak0zTkNBd0xqYzFNREl4TkNBd0xqUTFNVFEwTmlBd0xqYzFOemd4TmlBd0xqUTBNems0TnlBd0xqYzJNRGcxTWtNd0xqUXpNakEzTkNBd0xqYzJOVGN4TWlBd0xqUXlNelF3TmlBd0xqYzFNekExSURBdU5ERTVOek1nTUM0M05EY3hOREZETUM0ME1EYzNOREVnTUM0M01qYzVNRGtnTUM0ME1EUTJNeUF3TGpZNU5UWXdOaUF3TGpReE1qZzNNeUF3TGpZMk9UWXhPVU13TGpReE16VXdPU0F3TGpZMk56WXhNaUF3TGpReE16azBOeUF3TGpZMk5UUTBOeUF3TGpReE5ETTROQ0F3TGpZMk16STROa013TGpReE5USXdNeUF3TGpZMU9USXpJREF1TkRFMk1ESWdNQzQyTlRVeE9EWWdNQzQwTVRneE5ETWdNQzQyTlRJeU1UTkRNQzQwTVRjM09UUWdNQzQyTkRrME9EZ2dNQzQwTVRZeU1ERWdNQzQyTkRnd05pQXdMalF4TkRZd01TQXdMalkwTmpZeU4wTXdMalF4TXpjNU9DQXdMalkwTlRrd09DQXdMalF4TWprNU5DQXdMalkwTlRFNE9DQXdMalF4TWpNME5pQXdMalkwTkRNd01rTXdMalF3T1RFM05pQXdMall6T1RrNE15QXdMalF3TmpReE15QXdMall6TkRnNU55QXdMalF3TXprd09DQXdMall6TURBMk5FTXdMalF3TURJM055QXdMall5TXpBM05pQXdMak01TnpVeE5DQXdMall4TlRFNElEQXVNemswTnpreklEQXVOakEzTXprNFF6QXVNemt6TnprM0lEQXVOakEwTlRVeElEQXVNemt5T0RBM0lEQXVOakF4TnpFNUlEQXVNemt4TnpneElEQXVOVGs0T1RVelF6QXVNemt4TURreklEQXVOVGszTVRBMElEQXVNemt3TmpRNElEQXVOVGsxTWprMklEQXVNemt3TWpBNElEQXVOVGt6TlRFMFF6QXVNemc1TmpVeElEQXVOVGt4TWpVMUlEQXVNemc1TVRBMElEQXVOVGc1TURNMklEQXVNemc0TURnMklEQXVOVGcyT0RKRE1DNHpPRFU1TURZZ01DNDFPREl3TmprZ01DNHpPREl6TmpRZ01DNDFOemN6TWprZ01DNHpOemt3TmpVZ01DNDFOekk1TVRKRE1DNHpOemd4TnpZZ01DNDFOekUzTWpJZ01DNHpOemN6TURVZ01DNDFOekExTlRZZ01DNHpOelkwT0RNZ01DNDFOamswTWtNd0xqTTNOVFU1TnlBd0xqVTJPREU1TWlBd0xqTTNORFExTkNBd0xqVTJOamM0TVNBd0xqTTNNekU0TnlBd0xqVTJOVEl4TlVNd0xqTTJOalUyTmlBd0xqVTFOekF6TnlBd0xqTTFOalV5TnlBd0xqVTBORFl6TnlBd0xqTTJNVGN5TVNBd0xqVXpNVGszTmtNd0xqTTNNVFV4TlNBd0xqVXdPREEzT0NBd0xqUXdOVFEwTmlBd0xqVXlOakkxTkNBd0xqUXhPRFkzTkNBd0xqVXpORFl4TVVNd0xqUXlNREEwTWlBd0xqVXpOVFEzTnlBd0xqUXlNVFEzTWlBd0xqVXpOamN5TWlBd0xqUXlNamt5TnlBd0xqVXpOems0T1VNd0xqUXlOVEF3TkNBd0xqVXpPVGM1T1NBd0xqUXlOekV6TlNBd0xqVTBNVFkxTkNBd0xqUXlPVEl4T1NBd0xqVTBNalV5TWt3d0xqUTBOall5SURBdU5UUXpOVGM1UXpBdU5EUTNPVE0zSURBdU5UUXpPRGt5SURBdU5EUTVNalExSURBdU5UUTBNVGsxSURBdU5EVXdOVFF6SURBdU5UUTBORGszUXpBdU5EVTVPRGs0SURBdU5UUTJOalk1SURBdU5EWTROamsySURBdU5UUTROekV4SURBdU5EYzJNVFU0SURBdU5UVXpNRGMwUXpBdU5URTJNRGcySURBdU5UYzJORE14SURBdU5UUXhPRFlnTUM0Mk1EQXhPVEVnTUM0MU5qVTRNRFlnTUM0Mk16azFOakZETUM0MU5qa3hOQ0F3TGpZME5UQTBOU0F3TGpVM01UUXhOQ0F3TGpZMU1EZzVNU0F3TGpVM016YzFJREF1TmpVMk9EazFRekF1TlRjME9UQTRJREF1TmpVNU9EYzJJREF1TlRjMk1EZ3lJREF1TmpZeU9EazFJREF1TlRjM05EQTVJREF1TmpZMU9USTVRekF1TlRnek1qYzBJREF1TmpjNU16UXpJREF1TlRnNU56YzBJREF1Tmprek1qWTFJREF1TlRrMk16azBJREF1TnpBMk1ERTBRekF1TlRrM05EQXlJREF1TnpBM09UVTBJREF1TlRrNE16RTFJREF1TnpBNU9UUTVJREF1TlRrNU1qSTBJREF1TnpFeE9UTTJRekF1TmpBeE1UWTJJREF1TnpFMk1UYzVJREF1TmpBek1Ea2dNQzQzTWpBek9EVWdNQzQyTURVNE9ETWdNQzQzTWpNNU5ERkRNQzQyTURjd01UZ2dNQzQzTWpVek9EY2dNQzQyTURrek9URWdNQzQzTWpZeE9ERWdNQzQyTVRFMk15QXdMamN5Tmprek1VTXdMall4TWpnd05pQXdMamN5TnpNeU5DQXdMall4TXprME5pQXdMamN5Tnpjd05pQXdMall4TkRnMUlEQXVOekk0TVRZelF6QXVOakUzT0RRMElEQXVOekk1TmpjMElEQXVOakl4TURJNElEQXVOek14TURRNUlEQXVOakkwTWpNeElEQXVOek15TkRNelF6QXVOakk1TXpjM0lEQXVOek0wTmpVMklEQXVOak0wTlRjeklEQXVOek0yT1RBeElEQXVOak01TVRFeElEQXVOek01TnpZelF6QXVOalV5TXpneElEQXVOelE0TVRReUlEQXVOalkxTWpZNElEQXVOelU0TVRnNElEQXVOamMzTURjNElEQXVOelk0TWpReVF6QXVOamM1TmpNeUlEQXVOemN3TkRFM0lEQXVOamd4TmpnMUlEQXVOemN6TVRZeklEQXVOamd6TnpNNElEQXVOemMxT1RBMlF6QXVOamcxTXpFeElEQXVOemM0TURBNUlEQXVOamcyT0RneklEQXVOemd3TVRFZ01DNDJPRGcyTnprZ01DNDNPREU1TlROV01DNDNPRFF3TmpGTU1DNDJOemMyTURZZ01DNDNPRGN5TWpaRE1DNDJOek0xTkRJZ01DNDNPRGd5TnpVZ01DNDJOamszTlNBd0xqYzRPRFkyT0NBd0xqWTJOVGs1TVNBd0xqYzRPVEExT0VNd0xqWTJNakUzTnlBd0xqYzRPVFExTXlBd0xqWTFPRE01TnlBd0xqYzRPVGcwTlNBd0xqWTFORFF3TXlBd0xqYzVNRGt4TlVNd0xqWTFNelUwSURBdU56a3hNVFEzSURBdU5qVXlOak0wSURBdU56a3hNems0SURBdU5qVXhOams1SURBdU56a3hOalUzUXpBdU5qUTNOVEl4SURBdU56a3lPREUySURBdU5qUXlOelU1SURBdU56azBNVE0zSURBdU5qTTROVGdnTUM0M09UUTJNVXd3TGpZek9URXdPQ0F3TGpjNU5URXpOME13TGpZME1USTVNeUF3TGpnd01USXpOQ0F3TGpZMU1EUXhNaUF3TGpnd05qVTVNeUF3TGpZMU9EQXdNaUF3TGpneE1UQTFORU13TGpZMk1EZzFPU0F3TGpneE1qY3pOQ0F3TGpZMk16VWdNQzQ0TVRReU9EWWdNQzQyTmpVME56TWdNQzQ0TVRVM01ESkRNQzQyTnpRMU1pQXdMamd5TWpFNU1TQXdMalk0TXpBeklEQXVPRE13TURBNElEQXVOamc1TnpNMElEQXVPRE00T1RBMVREQXVOamsyTlRnNUlEQXVPRFExTnpZeVF6QXVOamszTXpJeUlEQXVPRFEyT0RJeklEQXVOamszT0RBMklEQXVPRFE0TURReElEQXVOams0TWpreElEQXVPRFE1TWpVNVF6QXVOams0T0RNM0lEQXVPRFV3TmpNeElEQXVOams1TXpneklEQXVPRFV5TURBeklEQXVOekF3TWpneUlEQXVPRFV6TVRRNFZqQXVPRFV6TmpjelF6QXVOams0TWpFMUlEQXVPRFV5T1RReElEQXVOamsyTnpnNElEQXVPRFV4TlRFMklEQXVOamsxTXpjMklEQXVPRFV3TVRBNFF6QXVOamswTlRneUlEQXVPRFE1TXpFMUlEQXVOamt6TnpreklEQXVPRFE0TlRJM0lEQXVOamt5T0RrNElEQXVPRFEzT0RkRE1DNDJPVEUwTXpFZ01DNDRORFkzT1RRZ01DNDJPRGs1TlRjZ01DNDRORFUyT0RFZ01DNDJPRGcwTnpZZ01DNDRORFExTmpORE1DNDJPRFE0T0RNZ01DNDROREU0TlRJZ01DNDJPREV5TlRNZ01DNDRNemt4TVRJZ01DNDJOemMyTURZZ01DNDRNelkzT1RkRE1DNDJOek14TVRRZ01DNDRNek01TkRjZ01DNDJOamd5TlRNZ01DNDRNekUzTWpjZ01DNDJOak16TlRjZ01DNDRNamswT1VNd0xqWTFPRGN5T1NBd0xqZ3lOek0zTmlBd0xqWTFOREEyT1NBd0xqZ3lOVEkwTnlBd0xqWTBPVFkxT1NBd0xqZ3lNalUxT1VNd0xqWTBOVEkwT0NBd0xqZ3hPVGczSURBdU5qUXdPVGcySURBdU9ERTJOak0ySURBdU5qTTJPRE0ySURBdU9ERXpORGczUXpBdU5qTTJNVGcxSURBdU9ERXlPVGt6SURBdU5qTTFOVE0xSURBdU9ERXlOU0F3TGpZek5EZzRPU0F3TGpneE1qQXhNME13TGpZek1EVXpNU0F3TGpnd09EY3lOaUF3TGpZeU5UWTFJREF1T0RBeU5EVWdNQzQyTWpJM05Ua2dNQzQzT1RjM056VkRNQzQyTWpJeE16SWdNQzQzT1RZM05UZ2dNQzQyTWpFM01UWWdNQzQzT1RVMk5URWdNQzQyTWpFek1EVWdNQzQzT1RRMU5qSkRNQzQyTWpBM016SWdNQzQzT1RNd016Z2dNQzQyTWpBeE56TWdNQzQzT1RFMU5Ea2dNQzQyTVRrd05qa2dNQzQzT1RBek9UTkRNQzQyTVRrME9EWWdNQzQzT0RjeU1ESWdNQzQyTWpJMk1ETWdNQzQzT0RZek5URWdNQzQyTWpVMU9TQXdMamM0TlRVek5rTXdMall5TmpZek9DQXdMamM0TlRJME9TQXdMall5TnpZM0lEQXVOemcwT1RZNElEQXVOakk0TlRZMElEQXVOemcwTlRreFdrMHdMalF5T0RFMk15QXdMalUzT0RNNVF6QXVORE14TURVMElEQXVOVGMzTnpZZ01DNDBNek0zT0RrZ01DNDFOemN5TmpZZ01DNDBNemMyTlRjZ01DNDFOemN6TXpsRE1DNDBNemsxTmlBd0xqVTNPVEUzTnlBd0xqUTBNalEzTmlBd0xqVTRNRFF5TXlBd0xqUTBNemszT1NBd0xqVTRNall4TlVNd0xqUTBORFEzTXlBd0xqVTRNek16TVNBd0xqUTBORGM0T1NBd0xqVTROREEyTWlBd0xqUTBOVEE1TmlBd0xqVTRORGMzTTBNd0xqUTBOVFE1TkNBd0xqVTROVFk1TkNBd0xqUTBOVGczTmlBd0xqVTROalU0TWlBd0xqUTBOall4TkNBd0xqVTROek0xT0VNd0xqUTBOall6TXlBd0xqVTVNams0SURBdU5EUTFNVE01SURBdU5UazJOalU0SURBdU5EUXhPRGN4SURBdU5UazRPVFl6VERBdU5EUXhNelEySURBdU5UazVORGcxVERBdU5ETTJNRGNnTUM0MU9EZzBNVEpETUM0ME16VXhOamtnTUM0MU9EY3hNaklnTUM0ME16UXhNVFVnTUM0MU9EVTVOaUF3TGpRek16QTFOeUF3TGpVNE5EYzVNME13TGpRek1UUXpOeUF3TGpVNE16QXdOeUF3TGpReU9UZ3dOaUF3TGpVNE1USXdPQ0F3TGpReU9EWTVJREF1TlRjNE9URTNTREF1TkRJNE1UWXpWakF1TlRjNE16bGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjM2IiB5PSI1MSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOTUiIHZhbHVlPSJQQVBJIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj03MjUzMGZmMy0wMTNlLTQ5ZjctYmMzNS1hZDM4ZDVmMTQ5M2U7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjE5MiIgeT0iNDgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTk2IiB2YWx1ZT0iQXV0aC1TZXJ2aWNlIChQb3N0Z3JlU1FMKSIgc3R5bGU9ImlyLnJlZj05NmVmYzAzMi1mYzExLTQ3YzgtOTM1My0zYzM1MTdlODkwMzY7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9cG9zdGdyZXNxbDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0NE16azJOamdnTUM0eU5EYzVOVFpETUM0NE16azJOamdnTUM0ek5EQTNOellnTUM0Mk9EYzBNek1nTUM0ME1UVTVOVFlnTUM0ME9UazJOamdnTUM0ME1UVTVOVFpETUM0ek1URTVNRE1nTUM0ME1UVTVOVFlnTUM0eE5UazJOamdnTUM0ek5EQTNOellnTUM0eE5UazJOamdnTUM0eU5EYzVOVFpETUM0eE5UazJOamdnTUM0eE5UVXhNellnTUM0ek1URTVNRE1nTUM0d056azVOVFl4SURBdU5EazVOalk0SURBdU1EYzVPVFUyTVVNd0xqWTROelF6TXlBd0xqQTNPVGsxTmpFZ01DNDRNemsyTmpnZ01DNHhOVFV4TXpZZ01DNDRNemsyTmpnZ01DNHlORGM1TlRaYVRUQXVPRE01TmpZNElEQXVNemMyTVRneVF6QXVPREU0TVRnMklEQXVNemswT0RVM0lEQXVOemswTWpreElEQXVOREV3TmpNeklEQXVOelk0TmpBNElEQXVOREl6TURrMlF6QXVOamsyTkRReklEQXVORFU0TnpFeUlEQXVOakF4TXpJNElEQXVORGM0T1RVMklEQXVORGs1TmpZNElEQXVORGM0T1RVMlF6QXVNems0TURBNElEQXVORGM0T1RVMklEQXVNekF5T0RreklEQXVORFU0TnpFeUlEQXVNak13TnpJNElEQXVOREl6TURrMlF6QXVNakExTURRMklEQXVOREV3TmpNeklEQXVNVGd4TVRVZ01DNHpPVFE0TlRjZ01DNHhOVGsyTmpnZ01DNHpOell4T0RKV01DNDNOVEU1TlRaRE1DNHhOVGsyTmpnZ01DNDRORFEzTnpZZ01DNHpNVEU1TURNZ01DNDVNVGs1TlRZZ01DNDBPVGsyTmpnZ01DNDVNVGs1TlRaRE1DNDJPRGMwTXpNZ01DNDVNVGs1TlRZZ01DNDRNemsyTmpnZ01DNDRORFEzTnpZZ01DNDRNemsyTmpnZ01DNDNOVEU1TlRaV01DNHpOell4T0RKYVRUQXVOVGcwTnpZMElEQXVOVEU1T1RjNFNEQXVOVGczTVRnNFF6QXVOakV5TkRRNUlEQXVOVEl3TVRjM0lEQXVOalF5TlRreElEQXVOVEkzTkRFMElEQXVOalkwT0RZMUlEQXVOVFUxT0RrMVF6QXVOalkzTnpBeklEQXVOVFU1TlRFMElEQXVOalk1T1RJM0lEQXVOVFk0TVRjM0lEQXVOalk1TnpZeElEQXVOVGd3TVRJNFF6QXVOalk1TlRZeElEQXVOVGt5TURjNElEQXVOalkzTWpnNElEQXVOakEzTVRZMUlEQXVOall6TURBMUlEQXVOakl6T0RFeVF6QXVOalUxTURBMUlEQXVOalUwTnpNMElEQXVOalF3TURBeElEQXVOamt4SURBdU5qRTVNVGczSURBdU56SXpOemhNTUM0Mk1UY3lPVFVnTUM0M01qRXpPVU13TGpZeU5URTJNeUF3TGpjd09ETXlPQ0F3TGpZeU5qWXlNeUF3TGpZNU5UQXhOaUF3TGpZeU5qQXlOaUF3TGpZNE1qbERNQzQyTWpVM05USWdNQzQyTnpjeklEQXVOakkxTVRFeklEQXVOamN4T1RBeklEQXVOakkwTlRBeklEQXVOalkyTnpZMlF6QXVOakl6TnpBNUlEQXVOall3TURjeUlEQXVOakl5T1RZM0lEQXVOalV6T0RFNUlEQXVOakl6TVRVMUlEQXVOalE0TVRJNFF6QXVOakl6TXpRMElEQXVOalF5TURJeUlEQXVOakkwTVRRNElEQXVOak0yTmprMElEQXVOakkwT1RRM0lEQXVOak14TkRBeVF6QXVOakkxT1RZeUlEQXVOakkwTmpZNUlEQXVOakkyT1RZNElEQXVOakUzT1RrMUlEQXVOakkyTmprZ01DNDJNRGs0TlRSTU1DNDJNalkzT0RrZ01DNDJNRGsyTXpoRE1DNDJNamN3TlRVZ01DNDJNRGcxTWpZZ01DNDJNamN3TWpJZ01DNDJNRGM0TnprZ01DNDJNalk1T0RnZ01DNDJNRGN5TkRoRE1DNDJNalk1TURVZ01DNDJNRFU1T0RjZ01DNDJNalkyTnpNZ01DNDJNRFEzTnpVZ01DNDJNall6TWpVZ01DNDJNRE16TXpGRE1DNDJNalUyTWpnZ01DNDJNREEwTmlBd0xqWXlORE01T1NBd0xqVTVOamMxT0NBd0xqWXlNalUzTkNBd0xqVTVNak0zTjBNd0xqWXhOemMwTnlBd0xqVTRNRGszSURBdU5qRXhOREk1SURBdU5UY3dNalUxSURBdU5qQXpOemcxSURBdU5UWXdOVEE1UXpBdU5Ua3lOemd4SURBdU5UUTJORE0xSURBdU5UYzNNVFl6SURBdU5UTXlNekkzSURBdU5UVTJORGd5SURBdU5USXpNVFkxUXpBdU5UWTFOemd5SURBdU5USXhNVGM0SURBdU5UYzFNalUxSURBdU5USXdNVEV4SURBdU5UZzBOelkwSURBdU5URTVPVGM0V2swd0xqUTJNek15SURBdU5UTTVNRGd5UXpBdU5EY3pPVGt4SURBdU5UTXdNakF5SURBdU5EZzRNRFkzSURBdU5USTBNamMzSURBdU5UQTNOamcxSURBdU5USTBNakkzVmpBdU5USTBNalpJTUM0MU1EazFPVFJETUM0MU5URXpNaUF3TGpVeU5EazBNU0F3TGpVM09ETXlOQ0F3TGpVME5qQTROaUF3TGpVNU5UQXdOU0F3TGpVMk56UXhORU13TGpZd01qQXlNeUF3TGpVM05qTTNNeUF3TGpZd056Z3pNeUF3TGpVNE5qSXhOeUF3TGpZeE1qSTRNeUF3TGpVNU5qWTVNa013TGpZeE1qazRPQ0F3TGpVNU9ETTJOU0F3TGpZeE16TTJOaUF3TGpVNU9UVTRNU0F3TGpZeE16Y3pPU0F3TGpZd01EYzRNa013TGpZeE16ZzROQ0F3TGpZd01USTBPU0F3TGpZeE5EQXlPU0F3TGpZd01UY3hOQ0F3TGpZeE5ERTVNaUF3TGpZd01qSXdNa013TGpVNU5EVXdOeUF3TGpZd01ESXhNU0F3TGpVNE1UTTVOU0F3TGpZd016YzJNeUF3TGpVM016a3lOaUF3TGpZeE1qTXlOME13TGpVMk5UUTVOU0F3TGpZeU1UazNJREF1TlRZMU9UYzJJREF1TmpNMU5qUTNJREF1TlRZNU1qWXlJREF1TmpRNE9EVTRRekF1TlRjeU5UWTFJREF1TmpZeU1EZzJJREF1TlRjNE9USXlJREF1TmpjMU5qWXpJREF1TlRnME56WTBJREF1TmpnMk9EWTNRekF1TlRnM016STNJREF1TmpreE56Y3pJREF1TlRnNU56ZzNJREF1TmprMk1qQTNJREF1TlRreE9EUXpJREF1TmprNU9URk1NQzQxT1RJMk9ERWdNQzQzTURFME1qTk1NQzQxT1RZNU5EY2dNQzQzTURrME5FTXdMalU1T1RjeklEQXVOekUyTURJeUlEQXVOakF6TkRVMUlEQXVOekl5TVRZMklEQXVOakE0TURBeElEQXVOekkzTmpoTU1DNDJNVEl3TXpRZ01DNDNNek13TnpSRE1DNDJNVEE0TWpNZ01DNDNNek0wTWpNZ01DNDJNRGt6TkRVZ01DNDNNek01TURRZ01DNDJNRGMzTmpnZ01DNDNNelEyTVRoRE1DNDJNRFEyTVRVZ01DNDNNell3TkRVZ01DNDJNREE1TmpRZ01DNDNNemcyT0RRZ01DNDFPVGcyTURZZ01DNDNORE5ETUM0MU9UWXpNVFlnTUM0M05EY3hPVGtnTUM0MU9UVXlOVFFnTUM0M05USTNNRGtnTUM0MU9UVTFPRFlnTUM0M05UazRPRU13TGpVNU5EZzFOU0F3TGpjMk9UTTVJREF1TlRnNE9ERTBJREF1T0RFNU9UTWdNQzQxT0RVNE1TQXdMamd6TnpNMU4wTXdMalU0TXpnd01TQXdMamcwT0RrNU1pQXdMalU0TURZMk5TQXdMamcxTmpVNU5DQXdMalUzTlRReE9TQXdMamcyTWpBMU5FTXdMalUzTURFMU9DQXdMamcyTnpVeE5TQXdMalUyTWpJNU1TQXdMamczTVRNeE5pQXdMalUwT1RVME5DQXdMamczTkRBMU5FTXdMalV6TkRnek9TQXdMamczTnpJd09DQXdMalV5TmpjNE9TQXdMamczTkRBMU5DQXdMalV5TVRFM09TQXdMamcyT1RNME1VTXdMalV4TlRVMk9TQXdMamcyTkRZeElEQXVOVEV5TkRZMUlEQXVPRFUzTmpVMklEQXVOVEV3TXpReElEQXVPRFV5TXpRMVF6QXVOVEE1TmpreklEQXVPRFV3TnpVeElEQXVOVEE0TmpnZ01DNDRORFl3TXpnZ01DNDFNRGM1TmpjZ01DNDRNems0TkRkRE1DNDFNRGN5TlRRZ01DNDRNek0yTXprZ01DNDFNRFkyT0RrZ01DNDRNalUzTnpJZ01DNDFNRFl6TURnZ01DNDRNVFk0TkRORE1DNDFNRFUxTXpRZ01DNDNPVFl4TnlBd0xqVXdOVFEyTXlBd0xqYzNOVFEzT0NBd0xqVXdOakE1TVNBd0xqYzFORGd3TVVNd0xqVXdOakV4T0NBd0xqYzFOREE0TXlBd0xqVXdOakF3TlNBd0xqYzFNek0yTnlBd0xqVXdOVGMxT1NBd0xqYzFNalk1TTBNd0xqVXdOVFV5TnlBd0xqYzFNVEExSURBdU5UQTFNVEk1SURBdU56UTVORFUySURBdU5UQTBOVGd4SURBdU56UTNPVGM1UXpBdU5UQXlORGN6SURBdU56UXlNek0ySURBdU5EazROVGN6SURBdU56TTNNemtnTUM0ME9USTRPVFlnTUM0M016VXdNek5ETUM0ME9URXdNemNnTUM0M016UXlNellnTUM0ME9EYzVNVGNnTUM0M016STVNRGdnTUM0ME9ETTVNek1nTUM0M016TXlORXd3TGpRNE1UYzVNaUF3TGpjek16WTNNa013TGpRNE16TXhNaUF3TGpjeU56azNJREF1TkRnMU1UUTJJREF1TnpJeU16VTNJREF1TkRnM01qZzNJREF1TnpFMk9EVTVRekF1TkRnNE1UTTJJREF1TnpFME5UY3pJREF1TkRnNU1qQTJJREF1TnpFeU1UYzJJREF1TkRrd016Y2dNQzQzTURrMU5qaERNQzQwT1RZNU16SWdNQzQyT1RRNE5qSWdNQzQxTURZME9Ea2dNQzQyTnpNME5EVWdNQzQwT1RZMU5qVWdNQzQyTWpjMU0wTXdMalE1TkRFeU5DQXdMall4TmpJM055QXdMalE0TnpRd015QXdMall3T0RnMU9DQXdMalEzT1RJM0lEQXVOakExTnpBMVF6QXVORGN4TVRNM0lEQXVOakF5TlRVeElEQXVORFl5TVRVNElEQXVOakF6TVRRNElEQXVORFV6T0RJMklEQXVOakExTURVM1F6QXVORFExTkRrMElEQXVOakEyT1RneklEQXVORE0zTnpFZ01DNDJNVEF6TURJZ01DNDBNekUzT0RVZ01DNDJNVE0yTWpKTU1DNDBNekUxTmpnZ01DNDJNVE0zTlRWRE1DNDBNekl6TkRnZ01DNDJNRE0zTWprZ01DNDBNelF6TWpNZ01DNDFPRGc1TlRnZ01DNDBOREF3T0RNZ01DNDFOek0yT0RoRE1DNDBORFE1TWprZ01DNDFOakE0TWpVZ01DNDBOVEl6TVRVZ01DNDFORGd5TmlBd0xqUTJNek15SURBdU5UTTVNRGd5V2swd0xqTTVNVEV6TnlBd0xqVXlOVEkzTTB3d0xqTTVOelEwTkNBd0xqVXlOVEE1VERBdU5EQXpOek0wSURBdU5USTFNalUyUXpBdU5ESXpNeklnTUM0MU1qWXlNVGtnTUM0ME5ERTBNVEVnTUM0MU16RXpNekVnTUM0ME5URTJNRElnTUM0MU16UTJPRE5ETUM0ME5ERXlNamdnTUM0MU5EUTROREVnTUM0ME16UXpNRGNnTUM0MU5UY3pPRGtnTUM0ME1qazJOaUF3TGpVMk9UY3pPRU13TGpReU16RTBPU0F3TGpVNE56Y3dNaUF3TGpReE9UZ3lOQ0F3TGpZd05qWTRJREF1TkRFNU9ETTBJREF1TmpJMU56ZzRUREF1TkRFNU9EVWdNQzQyTWpVNE9EZFdNQzQyTWpVNU4xWXdMall5TmpJNE5rTXdMalF4T1RnMUlEQXVOakkzT1RJNUlEQXVOREU1T1RjM0lEQXVOak13TURFMklEQXVOREl3TVRNMUlEQXVOak15TmpFelF6QXVOREl3TXpJNUlEQXVOak0xT0RFeklEQXVOREl3TlRjZ01DNDJNemszT0RZZ01DNDBNakEyT0NBd0xqWTBORFkxT1VNd0xqUXlNRGczT1NBd0xqWTFNemN5TVNBd0xqUXlNRFkwT0NBd0xqWTJOVEU1SURBdU5ERTRPVE00SURBdU5qYzNORFUyUXpBdU5ERTNOVEU1SURBdU5qZzNNRGsySURBdU5ERTROVFE1SURBdU5qazJPVE00SURBdU5ESXhPVE16SURBdU56QTJNRGMxUXpBdU5ESTFNekU1SURBdU56RTFNakV5SURBdU5ETXdPVFE1SURBdU56SXpNelVnTUM0ME16Z3pNRGNnTUM0M01qazNNemhETUM0ME1qYzVNemdnTUM0M05EQTNOU0F3TGpReE56a3hPQ0F3TGpjMU1qQTROaUF3TGpRd09ESTJOU0F3TGpjMk16Y3pRekF1TkRBeU9UY2dNQzQzTnpBd09EY2dNQzR6T1RnMk16a2dNQzQzTnpJeE5qSWdNQzR6T1RVd016Y2dNQzQzTnpJek1qaERNQzR6T1RFME5USWdNQzQzTnpJME56Y2dNQzR6T0RjMU1ESWdNQzQzTnpBM01ERWdNQzR6T0RJNU5UUWdNQzQzTmpZek1ETkRNQzR6TnpNNU1qVWdNQzQzTlRjMU1EWWdNQzR6TmpRME1UUWdNQzQzTXpnNU1UY2dNQzR6TlRZMU5qUWdNQzQzTVRjMU5UWkRNQzR6TkRnM015QXdMalk1TmpFNU5TQXdMak0wTWpJd055QXdMalkzTWpBeE1pQXdMak16TnpZd09TQXdMalkxTVRRMk5FTXdMak16TWprNU5TQXdMall6TURreE5pQXdMak16TURNd05pQXdMall4TXpZeU1pQXdMak15T1RrNU1TQXdMall3TnpRME4wTXdMak15T0RNMk5DQXdMalUzTkRnek15QXdMak16TlRnek5DQXdMalUxTlRFek1pQXdMak0wTnpFNE5pQXdMalUwTXpFeE5VTXdMak0xT0RVeU1pQXdMalV6TVRBNU9DQXdMak0zTkRNM015QXdMalV5TmpJek5TQXdMak01TVRFek55QXdMalV5TlRJM00xcE5NQzQxT0RJek1EZ2dNQzQyTVRrMk1UTkRNQzQxT0RVMk1qZ2dNQzQyTVRVNE1UTWdNQzQxT1RFNU5URWdNQzQyTVRJNU1EZ2dNQzQyTURNeU1qRWdNQzQyTVRJM05UbERNQzQyTURjek1qY2dNQzQyTVRJM05qRWdNQzQyTVRFME15QXdMall4TXpBeU9DQXdMall4TlRVd015QXdMall4TXpVMU5VTXdMall4TlRNNE5DQXdMall4T0RjMk9DQXdMall4TkRZNE55QXdMall5TXpVNE55QXdMall4TXprME1pQXdMall5T0Rjek4wTXdMall4TXpFeU5pQXdMall6TkRNM055QXdMall4TWpJMU1pQXdMalkwTURReE15QXdMall4TWpBeE9DQXdMalkwTnpjNU5rTXdMall4TVRjM09TQXdMalkxTlRBek1TQXdMall4TWpZMU5DQXdMalkyTWpJeE1pQXdMall4TXpVeE9TQXdMalkyT1RNeE5VTXdMall4TkRBNU9DQXdMalkzTkRBM05DQXdMall4TkRZM015QXdMalkzT0RjNU9TQXdMall4TkRrd05TQXdMalk0TXpRNE1VTXdMall4TlRNMU5DQXdMalk1TWprd09DQXdMall4TkRVM015QXdMamN3TVRrMU5DQXdMall4TURJd09TQXdMamN4TVRFMk5rTXdMall3T1RFM09TQXdMamN3T1RNMElEQXVOakE0TVRZM0lEQXVOekEzTXpneElEQXVOakEzTWpVMElEQXVOekExTVRVM1F6QXVOakEyTXpjMklEQXVOekF6TURNMUlEQXVOakExTURBMklEQXVOekF3TlRnNUlEQXVOakF6TVRZNUlEQXVOamszTXpBNVREQXVOakF5TkRBM0lEQXVOamsxT1RRMlF6QXVOakF3TWlBd0xqWTVNVGszT1NBd0xqVTVOelEyTWlBd0xqWTROekE1T1NBd0xqVTVORFkwSURBdU5qZ3hOamN5UXpBdU5UZzRPVGszSURBdU5qY3dPRE0wSURBdU5UZ3lPVGc0SURBdU5qVTNOemc0SURBdU5UZ3dNRGcwSURBdU5qUTJNVEpETUM0MU56Y3hOak1nTUM0Mk16UTBOamdnTUM0MU56YzJNVEVnTUM0Mk1qVXdNRGdnTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5hVFRBdU5EVTJNek15SURBdU5qRTFPRGsyUXpBdU5EVTVOamcwSURBdU5qRTFNVEV4SURBdU5EWXpNVEV6SURBdU5qRTBOams1SURBdU5EWTJOVFUzSURBdU5qRTBOalkzUXpBdU5EWTVOVEUySURBdU5qRTBOakF5SURBdU5EY3lORFl6SURBdU5qRTFNRGMwSURBdU5EYzFNalV6SURBdU5qRTJNRFl4UXpBdU5EZ3dNak15SURBdU5qRTNPVGczSURBdU5EZ3pPRFVnTUM0Mk1qRTBNRFlnTUM0ME9EVTJOemNnTUM0Mk1qazROekZETUM0ME9UUTVNVFlnTUM0Mk56STJNaklnTUM0ME9EYzBOQ0F3TGpZNE9UQTNNeUF3TGpRNE1EYzJOU0F3TGpjd016YzFPVU13TGpRM09UTTNNU0F3TGpjd05qZ3lPQ0F3TGpRM09EQXhNU0F3TGpjd09UZ3lJREF1TkRjMk9EUTNJREF1TnpFeU9UVTRRekF1TkRjME5USXpJREF1TnpFNU1UZ3lJREF1TkRjeU1UazVJREF1TnpJMU1Ea3hJREF1TkRjd056ZzVJREF1TnpNd09URTNRekF1TkRRMk5UZzVJREF1TnpNd09EZzBJREF1TkRJMU9Ua3lJREF1TnpBM016Z3hJREF1TkRJNU9UVTRJREF1TmpjNE9UazVRekF1TkRNeE56ZzFJREF1TmpZMU9UTTNJREF1TkRNeU1ERTJJREF1TmpVek9EY3hJREF1TkRNeE9ERTNJREF1TmpRME5ERkRNQzQwTXpFMk56TWdNQzQyTXpneE5EUWdNQzQwTXpFek9DQXdMall6TXpNek15QXdMalF6TVRFNU1pQXdMall6TURJek5rTXdMalF6TVRFeU1TQXdMall5T1RBMklEQXVORE14TURZMUlEQXVOakk0TVRNeElEQXVORE14TURNM0lEQXVOakkzTkRZMFREQXVORE14TkRBeUlEQXVOakkzTVRNeVF6QXVORE16TWpJeElEQXVOakkxTnpBMklEQXVORE0xTVRVNUlEQXVOakkwTkRRZ01DNDBNemN4T1RVZ01DNDJNak16TkRoRE1DNDBORE15TVRRZ01DNDJNakF3TWpVZ01DNDBORGsyTlRFZ01DNDJNVGMxTVRrZ01DNDBOVFl6TXpJZ01DNDJNVFU0T1RaYVRUQXVOVGs0TnpnNUlEQXVOakU0TURVelNEQXVOVGszT1RaV01DNDJNVGd3TUROTU1DNDFPVFV6TURRZ01DNDJNVGd5TVRsRE1DNDFPVEk0TmpRZ01DNDJNVGcxT0RRZ01DNDFPVEEzTURZZ01DNDJNVGt5TkRnZ01DNDFPRGt4TVRJZ01DNDJNakF4TkRSRE1DNDFPRGd6TnpVZ01DNDJNakExTVRJZ01DNDFPRGMzTVRVZ01DNDJNakV3TVRrZ01DNDFPRGN4TnpFZ01DNDJNakUyTXpoTU1DNDFPRFkyTURNZ01DNDJNakkyTWpoTU1DNDFPRFkwTnpNZ01DNDJNak0zTmpORE1DNDFPRFkyTWlBd0xqWXlORFUwT1NBd0xqVTROams0TXlBd0xqWXlOVEkzT0NBd0xqVTROelV5SURBdU5qSTFPRGN4UXpBdU5UZzNOemd4SURBdU5qSTJNVGc0SURBdU5UZzRNRFl4SURBdU5qSTJORGc1SURBdU5UZzRNelU1SURBdU5qSTJOemN5UXpBdU5UZzROelk0SURBdU5qSTNNVFlnTUM0MU9Ea3lNRGtnTUM0Mk1qYzFNVFFnTUM0MU9EazJOemNnTUM0Mk1qYzRNamxETUM0MU9URTJOVGNnTUM0Mk1qa3lNaUF3TGpVNU5EQTRJREF1TmpJNU9ESTVJREF1TlRrMk5EZ3lJREF1TmpJNU5UTTVRekF1TlRrNE9UVWdNQzQyTWpreE1USWdNQzQyTURFeU1EVWdNQzQyTWpjNE56UWdNQzQyTURJNE9Ea2dNQzQyTWpZd01rTXdMall3TXpNeU1TQXdMall5TlRVM05pQXdMall3TXpjeE5pQXdMall5TlRBNU55QXdMall3TkRBMk9DQXdMall5TkRVNE9FTXdMall3TkRNd015QXdMall5TkRJME9DQXdMall3TkRVeE9TQXdMall5TXpnNU5TQXdMall3TkRjeE5DQXdMall5TXpVelF6QXVOakExTVRJMUlEQXVOakl5T0RVNElEQXVOakExTXpJNElEQXVOakl5TURjNElEQXVOakExTWprMUlEQXVOakl4TWpsTU1DNDJNRFV6TVRJZ01DNDJNakV4TlRkTU1DNDJNRFE0T0RNZ01DNDJNakF4TVRKTU1DNDJNRFF3TmpjZ01DNDJNVGt6TXpGRE1DNDJNRE0zTnpNZ01DNDJNVGt4TXpnZ01DNDJNRE0wTlRFZ01DNDJNVGc1TnlBd0xqWXdNekE1T1NBd0xqWXhPRGd5TlVNd0xqWXdNalk1TlNBd0xqWXhPRFkxT1NBd0xqWXdNakkxTlNBd0xqWXhPRFV5TlNBd0xqWXdNVGMzTnlBd0xqWXhPRFF4T0VNd0xqWXdNVEE1TmlBd0xqWXhPREkxTVNBd0xqWXdNRE16TmlBd0xqWXhPREUwTkNBd0xqVTVPVFV4T1NBd0xqWXhPREE0T0VNd0xqVTVPVEk0SURBdU5qRTRNRGN5SURBdU5UazVNRE0zSURBdU5qRTRNRFl4SURBdU5UazROemc1SURBdU5qRTRNRFV6V2swd0xqUTNNRGt5TWlBd0xqWXlNVEExTjB3d0xqUTJPREUyTmlBd0xqWXlNRGcwTWt3d0xqUTJPREUwT1NBd0xqWXlNRGt3T0VNd0xqUTJOalF5TlNBd0xqWXlNRGd5TVNBd0xqUTJORFk1T1NBd0xqWXlNVEEwTmlBd0xqUTJNekExTkNBd0xqWXlNVFUzTWtNd0xqUTJNVFl4SURBdU5qSXlNRGcySURBdU5EWXdNVE16SURBdU5qSXpNREUySURBdU5EVTVPRGcwSURBdU5qSTBPREE0UXpBdU5EVTVOemM0SURBdU5qSTFPRE0ySURBdU5EWXdNREUzSURBdU5qSTJPRGNnTUM0ME5qQTFOalVnTUM0Mk1qYzNORFpETUM0ME5qRXdPRFFnTUM0Mk1qZzNORElnTUM0ME5qRTNORE1nTUM0Mk1qazJOVGtnTUM0ME5qSTFNak1nTUM0Mk16QTBOamhETUM0ME5qUXpOVFVnTUM0Mk16STBOemdnTUM0ME5qWTRNU0F3TGpZek16Z3hNU0F3TGpRMk9UUTVOQ0F3TGpZek5ESTFNa013TGpRM01qRXhPU0F3TGpZek5EVTNOU0F3TGpRM05EYzNNU0F3TGpZek16a3dOaUF3TGpRM05qa3pJREF1TmpNeU16YzNRekF1TkRjM09ESTBJREF1TmpNeE56Z2dNQzQwTnpnMk1qUWdNQzQyTXpFd05UTWdNQzQwTnprek1ETWdNQzQyTXpBeU1UbERNQzQwTnprNU5UWWdNQzQyTWprMU1EVWdNQzQwT0RBek9Ea2dNQzQyTWpnMk1UZ2dNQzQwT0RBMU5EZ2dNQzQyTWpjMk5qTkRNQzQwT0RBMU56SWdNQzQyTWpjME1qa2dNQzQwT0RBMU56UWdNQzQyTWpjeE9UUWdNQzQwT0RBMU5UUWdNQzQyTWpZNU5qRkRNQzQwT0RBMU16RWdNQzQyTWpZMk9Ea2dNQzQwT0RBME56Y2dNQzQyTWpZME1pQXdMalE0TURNNU5DQXdMall5TmpFMU9VTXdMalE0TURJMElEQXVOakkxTmpjeklEQXVORGM1T1RnM0lEQXVOakkxTWpJMUlEQXVORGM1TmpVeElEQXVOakkwT0RReVF6QXVORGM1TURNMUlEQXVOakkwTVRFNUlEQXVORGM0TWpnMklEQXVOakl6TlRJeUlEQXVORGMzTkRRMElEQXVOakl6TURneVF6QXVORGMxTnpFNElEQXVOakl5TURnMklEQXVORGN6TkRZeElEQXVOakl4TkRBMklEQXVORGN3T1RJeUlEQXVOakl4TURVM1drMHdMall4T0RRNUlEQXVOelF5TnpNMFREQXVOakU0TlRRZ01DNDNOREkzTVRoRE1DNDJNakF5TURNZ01DNDNORFF3T1NBd0xqWXlNakEySURBdU56UTFNVGt5SURBdU5qSTBNRFV4SURBdU56UTJNREl4UXpBdU5qTXlNRFk0SURBdU56UTVNekl6SURBdU5qUTFNVFEySURBdU56VXdOakF5SURBdU5qWTRNalkySURBdU56UTFPREl4UXpBdU5qWXpOVFkwSURBdU56UTVPVFUwSURBdU5qVTRNamt6SURBdU56VXpNemt4SURBdU5qVXlOakUySURBdU56VTJNREk1UXpBdU5qUTFOamswSURBdU56VTVNalE1SURBdU5qTXlOalkxSURBdU56WXhOekl5SURBdU5qSXlNRGMxSURBdU56WXhPRE00UXpBdU5qRTJOelkwSURBdU56WXhPVEl4SURBdU5qRXlJREF1TnpZeE16VTNJREF1TmpBNU1UWXlJREF1TnpZd05EazBRekF1TmpBNE1qZzNJREF1TnpZd01qUXhJREF1TmpBM05EVTNJREF1TnpVNU9EUTVJREF1TmpBMk56QTNJREF1TnpVNU16TXlRekF1TmpBMk5EUXhJREF1TnpVek5UY3lJREF1TmpBM016TTNJREF1TnpVd01UZzJJREF1TmpBNE16Z3lJREF1TnpRNE1qYzRRekF1TmpBNU1qSTJJREF1TnpRMk5qUTVJREF1TmpFd05qTTRJREF1TnpRMU16ZzFJREF1TmpFeU16VWdNQzQzTkRRM01qWkRNQzQyTVRNeU56WWdNQzQzTkRRek1UY2dNQzQyTVRReU9Ua2dNQzQzTkRRd01qSWdNQzQyTVRVME16VWdNQzQzTkRNMk9UVkRNQzQyTVRZek56SWdNQzQzTkRNME1qVWdNQzQyTVRjek9EY2dNQzQzTkRNeE16SWdNQzQyTVRnME9TQXdMamMwTWpjek5GcE5NQzQwT0RRNE9UY2dNQzQzTkRReU56aElNQzQwT0RVeU5EVldNQzQzTkRRek1URkRNQzQwT0RZd01USWdNQzQzTkRRME1EWWdNQzQwT0RZM05qY2dNQzQzTkRRMU9ESWdNQzQwT0RjME9UUWdNQzQzTkRRNE16WkRNQzQwT0RjNE9ESWdNQzQzTkRRNU56RWdNQzQwT0RneU5qRWdNQzQzTkRVeE1qZ2dNQzQwT0RnMk16RWdNQzQzTkRVek1EZERNQzQwT1RBME1qTWdNQzQzTkRZd05UUWdNQzQwT1RJNU5qTWdNQzQzTkRnM01qWWdNQzQwT1RReE1qUWdNQzQzTlRFNE0wTXdMalE1TlRJM0lEQXVOelUwT1RNeklEQXVORGsxTVRJeElEQXVOelUzT0RJeUlEQXVORGt6TnpJM0lEQXVOelU1TnpoRE1DNDBPRFUyTkRNZ01DNDNOekV4TVRZZ01DNDBOell4TmpZZ01DNDNOelUwT0RFZ01DNDBOamN3TlRRZ01DNDNOemN3TkRGRE1DNDBOVGM1TkRJZ01DNDNOemcxT0RVZ01DNDBORGt5TVRJZ01DNDNOemN3TkRFZ01DNDBORE01SURBdU56YzFOekUwUXpBdU5EUXlNREkxSURBdU56YzFNak15SURBdU5ETTVOekF4SURBdU56YzBNelV6SURBdU5ETTNPRGt5SURBdU56Y3pNelUzUXpBdU5ETTNNVFl4SURBdU56Y3lPVGMxSURBdU5ETTNNakV5SURBdU56Y3lPRGMySURBdU5ETTJOek1nTUM0M056STBOemRETUM0ME16Z3lNalFnTUM0M056RTNOak1nTUM0ME5EQTBOalVnTUM0M056QTRPRFFnTUM0ME5EUXpPRElnTUM0M056QXdPRGRETUM0ME5UWTNORGNnTUM0M05qYzFORGdnTUM0ME5qSTVNemdnTUM0M05qVTFNak1nTUM0ME5qYzNNREVnTUM0M05qRTNNemxETUM0ME56QTJNVE1nTUM0M05UazBNVFVnTUM0ME56STFNREVnTUM0M05UWTVPVE1nTUM0ME56UTRORGdnTUM0M05UTTVPRE5ETUM0ME56WXpOREVnTUM0M05USXdOamdnTUM0ME56Z3dNaUF3TGpjME9Ua3hOU0F3TGpRNE1ESTJOaUF3TGpjME56TTVPRU13TGpRNE1qY3pPQ0F3TGpjME5EWTJJREF1TkRnME1ERTJJREF1TnpRME16WXhJREF1TkRnME9EazNJREF1TnpRME1qYzRXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iMjU2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjM1NiIgeT0iNTEiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTk3IiB2YWx1ZT0iQWNjZXNzLVJpZ2h0cyAoUG9zdGdyZVNRTCkiIHN0eWxlPSJpci5yZWY9MzJiMTlkYTgtMmUwZS00NDY2LWJhM2QtYjgxMGJkODk3ZGNlO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjI1NiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTIiIHk9IjQ4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="AWS API Gateway -&gt; AWS ELB (Elastic Load Balancer)" ref="10959030-1ac3-4d81-8d3b-bbe73fd6f0f9" source="ccb00b1b-d74c-493e-b274-1a53a5a1755e" target="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Service mesh (Istio) -&gt; Somryst-API" ref="135315aa-be70-4471-ba4a-b28e2a26cd38" source="8d17dfe4-5356-46dd-a180-c69b965f58d8" target="b6dd5f39-9243-4289-b561-566f0a1ff4fb">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Mobile Device Client (Thin) -&gt; AWS API Gateway" ref="345687ff-6ce7-463f-8090-da4b99b93fcc" source="13c2109b-c9ef-4146-aa1c-a802b47d48c8" target="ccb00b1b-d74c-493e-b274-1a53a5a1755e">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Somryst-API -&gt; OAuth2 Authorization Server" ref="35652a9c-718b-4e98-bb5c-f5ed7764e7eb" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="c2a79ff4-f7f6-4927-8def-8b3ba9094b09">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Somryst-API -&gt; MAMI (MySQL)" ref="3aff20a8-d2d0-48b2-8d31-93c6033bd05d" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="002e1e5c-362a-4bda-99d7-8cef7bbaa4a0">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Somryst-API -&gt; Auth-Service (PostgreSQL)" ref="4a52e903-4ac0-43b0-b213-20811f568498" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="2a0c2a53-d710-4930-986d-4db95b02f292">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="AWS ELB (Elastic Load Balancer) -&gt; Somryst-API" ref="ad92b11c-437d-4828-862a-280cafe91d1f" source="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe" target="8d17dfe4-5356-46dd-a180-c69b965f58d8">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Kubernetes Cluster US-West2-prod-eks-cluster -&gt; Docker Linux Host" ref="b0304738-55b1-439f-be08-84a7589496b5" source="dcee0e0c-aaa9-4890-aebe-b79381151d49" target="a928a2dc-08c7-4b68-a594-2fa6325ab3d3">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Service mesh (Istio) -&gt; Somryst-API" ref="c122f4a3-05ab-4691-8249-6f61e1455fdc" source="8d17dfe4-5356-46dd-a180-c69b965f58d8" target="dcee0e0c-aaa9-4890-aebe-b79381151d49">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Somryst-API -&gt; PAPI (PostgreSQL)" ref="da0b42e9-7158-4929-9eb6-91e780665ff6" source="b6dd5f39-9243-4289-b561-566f0a1ff4fb" target="f6ea0329-f94b-4e27-a510-eadd4157f49c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="OAuth2 Authorization Server -&gt; Access-Rights (PostgreSQL)" ref="de76d7dc-7159-4f78-a84d-2ef5e7c372d4" source="c2a79ff4-f7f6-4927-8def-8b3ba9094b09" target="27c24a08-02f8-4fb7-b790-7e3db361c53d">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="17f18480-efb8-46bc-a81d-b878afc47c0d" diagramComponentId="824ad734-ddf1-4bbe-9590-5872a3abf639" ref="c2a79ff4-f7f6-4927-8def-8b3ba9094b09" name="OAuth2 Authorization Server" desc="" library="" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
+      <tags/>
+      <questions>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.223">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.868">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.672">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.047">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.224">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.873">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.363">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.874">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.673">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.597">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.605">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.336">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.030">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.035">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.437">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt; 
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.035">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.343">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.606">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.998">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.607">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:16.036">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:14.155">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:15.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="984463db-0f9d-4428-9b99-1c0a97bb41c0" diagramComponentId="71cd5404-e2ef-4c59-b8c9-8ad1a219540f" ref="dcee0e0c-aaa9-4890-aebe-b79381151d49" name="Kubernetes Cluster" desc="" library="" parentComponentRef="" componentDefinitionRef="kubernetes-cluster">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CP-AC-1.1" name="Default permissions are changed to become more permissive" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  File permissions are granted to users other than the owner.&amp;nbsp; By default this access is tightly controlled by Kubernetes.&amp;nbsp; This should not be changed as it protects access to PKI and other security critical information such as cluster administration.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.093">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AS-1.1" name="Exposure of environment variables" state="0" impact="100" issueId="" issueLink="">
+          <desc>Secrets stored as environment variables may be exposed by other Kubernetes processes such as the behavior of apps.&amp;nbsp; Alternative ways of storing secrets may be more suitable.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CP-AC-1.2" name="File ownership is extended to users unnecessarily" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  File ownership is granted to users other than root.&amp;nbsp; Granting unintended parties complete and full control over the file and allowing them to then grant access others may expose security critical data such as credentials and certificates.&amp;nbsp; Adversaries may also be able to change the way the cluster is administered. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-LM-1.1" name="Forensics capabilities are difficult to determine at early stages" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that system policies include forensics capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling. The absence of such capabilities can result in diminishing incident response and detection capabilities. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-LM-1.2" name="Forensics capabilities not integrated into existing architectures" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that forensics capabilities are integrated into existing applications and architectures is a challenge due to lack of resources to help with the modification and lack of the necessary guidance to do so. The absence can result in diminishing incident response and detection capabilities 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-3.1" name="Hosts which are not properly configured threaten the integrity of the container architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring trust in host systems that store images and launch containers is a challenge. The absence of host-hardening processes can result in the compromise of images, runtime environments, and stored data 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-1.1" name="Image provenance not verified" state="0" impact="100" issueId="" issueLink="">
+          <desc>Not allowing Kubernetes to ensure that images are verified can increase the risk of vulnerabilities being introduced to a cluster through images.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AA-1.1" name="Inadequate or missing infrastructure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Lack of infrastructure may result in insecure communications between containers are secured, lack of network traffic monitoring, and unauthorized access to the network traffic, resources, and configurations. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AC-1.2" name="Insufficient boundaries around namespaces" state="0" impact="100" issueId="" issueLink="">
+          <desc>Kubernetes supports multiple virtual clusters backed by the same physical cluster. These virtual clusters are called namespaces, and they provide a way to divide cluster resources between multiple users.&amp;nbsp; Namespaces which are not carefully managed can result in objects having access to parts of the cluster which should be beyond their scope.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AS-1.3" name="Kubernetes secrets management may be insufficient" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The in-built Kubernetes secret storage may not be sufficiently robust.&amp;nbsp; Depending on needs of individual systems, it may be necessary to configure alternative mechanisms. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CP-LA-1.1" name="Logging not carried out by default" state="0" impact="100" issueId="" issueLink="">
+          <desc>Logging must be deliberately set on Kubernetes as it is not a default configuration.&amp;nbsp; However the logging requirements must be carefully balanced against the resources that logging will consume.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-N-2.1" name="Missing or incomplete infrastructure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the complexities of container architectures and a lack of network tooling and data storage. The absence can result in diminished incident response and detection capabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-N-1.1" name="Namespace network policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>Despite the importance of network policies in securing pods, and therefore clusters, they are not created by default in Kubernetes.&amp;nbsp; Strong network policies should be designed and then applied to all namespaces in a cluster.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-1.2" name="Pipelines or build chains not secured" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-3.2" name="Resource mismanagement compromises quality of service" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  In addition to authorized resource usage, the operator faces a challenge to ensure resources are not overused or abused, because this will affect usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AC-1.1" name="Roles and service accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>Service accounts and role based access controls are methods which control access to cluster resources based on object identification.&amp;nbsp; Assigning permissions to objects which should be beyond their scope can result in them being misused by adversaries.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-2.1" name="Seccomp disabled" state="0" impact="100" issueId="" issueLink="">
+          <desc>Seccomp can be used to control cluster workloads by restricting the set of system calls that applications can make.&amp;nbsp; Kubernetes disables it by default, it should be manually configured instead.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-AS-1.2" name="Secrets management not configured across all areas of the system" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring the ability to automate the configuration of the secret management tool and dynamically generate secrets required by the application in a Continuous Integration/ Continuous Deployment (CI/CD) environment is a challenge because of the lack of best practices, tooling and automation for "key zero" (the first key in the key management system that is usually handled manually). The absence can result in the compromise of the application and/or data. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="W-NIST-800-190-01" name="Unauthorized hosts joining the cluster and running containers" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Unauthorized hosts should not run containers without appropriate authentication and authorization.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.755">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CP-AA-1.1" name="Unrevoked security certificates" state="0" impact="100" issueId="" issueLink="">
+          <desc>While security certificates are, in general, an effective security measure for a system, they are only useful if they are properly managed and controlled.&amp;nbsp; If security certificates are not revoked they may continue to be used long after a user's access should have ceased.&amp;nbsp; &amp;nbsp; The greater the number of historical unrevoked credentials there are, the greater the likelihood that an adversary will find a way to exploit the vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PO-G-1.3" name="Vulnerability definitions may not be up to date" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-NSA-HG-05" name="Apply security patches and updates and remove components when they are no longer needed" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Following the hardening guidance outlined in this document is a step toward ensuring the security of applications running on Kubernetes orchestrated containers. However, security is an ongoing process, and it is vital to keep up with patches, updates, and upgrades. The specific software components vary depending on the individual configuration, but each piece of the overall system should be kept as secure as possible. This includes updating: Kubernetes, hypervisors, virtualization software, plugins, operating systems on which the environment is running, applications running on the servers, and any other software hosted in the Kubernetes environment. &amp;nbsp;&lt;/p&gt;&lt;p&gt;As updates are deployed, administrators should also keep up with removing any old components that are no longer needed from the environment. Using a managed Kubernetes service can help to automate upgrades and patches for Kubernetes, operating systems, and networking protocols. However, administrators must still patch and upgrade their containerized applications.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;The Center for Internet Security (CIS) publishes benchmarks for securing software. Administrators should adhere to the CIS benchmarks for Kubernetes and any other relevant system components. Administrators should check periodically to ensure their system's security is compliant with the current security experts' consensus on best practices. Periodic vulnerability scans and penetration tests should be performed on the various system components to proactively look for insecure configurations and zero-day vulnerabilities. Any discoveries should be promptly remediated before potential cyber actors can discover and exploit them.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-3.1.1" name="Client certificate authentication should not be used for users" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Kubernetes client certificate authentication does not allow for this due to a lack of support for certificate revocation. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   External mechanisms for authentication generally require additional software to be deployed. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Authenticating" url="https://kubernetes.io/docs/reference/access-authn-authz/authentication/"/>
+          </references>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="3.1.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-NSA-HG-04" name="Configure a metrics logger" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Kubernetes does not natively support alerting; however, several monitoring tools with alerting capabilities are compatible with Kubernetes. If Kubernetes administrators choose to configure an alerting tool to work within a Kubernetes environment, there are several metrics for which administrators should monitor and configure alerts. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Alerting when storage is low can help avoid performance issues and log loss due to limited resources and help identify malicious cryptojacking attempts. Cases of privileged Pod execution can be investigated to determine if an administrator made a mistake, an authentic use case necessitates escalated privileges, or a malicious actor deployed a privileged Pod. Suspicious Pod creation source IP addresses could indicate that a malicious cyber actor has broken out of a container and is attempting to create a malicious Pod. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Integrating Kubernetes with an organization's existing SIEM platform, especially those with machine learning/big data capabilities, can be useful in identifying irregularities in audit logs and cutting down on false alerts. If configuring such a tool to work with Kubernetes, it should be configured so that these cases and any others applicable to the use case are configured to trigger alerts. &amp;nbsp;&lt;/p&gt;&lt;p&gt;Systems capable of acting automatically when suspected intrusions occur could potentially be configured to take steps to mitigate compromises while administrators respond to alerts. In the case of a Pod IP being listed as the source ID of a Pod creation request, one mitigation that could be implemented to keep the application available but temporarily stop any compromises of the cluster would be to automatically evict the Pod. Doing so would allow a clean version of the Pod to be rescheduled onto one of the nodes. Investigators can then examine the logs to determine if a breach occurred and, if so, how the malicious actors executed the compromise so that a patch can be deployed.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Examples of cases that could trigger alerts include but are not limited to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;low disk space on any of the machines in the environment,&lt;/li&gt;&lt;li&gt;available storage space on a logging volume running low,&lt;/li&gt;&lt;li&gt;external logging service going offline,&lt;/li&gt;&lt;li&gt;a Pod or application running with root permissions,&lt;/li&gt;&lt;li&gt;requests being made by an account for resources they do not have permission for,&lt;/li&gt;&lt;li&gt;an anonymous account being used or gaining privileges,&lt;/li&gt;&lt;li&gt;Pod or Worker Node IP addresses being listed as the source ID of a Pod creation request,&lt;/li&gt;&lt;li&gt;unusual system calls or failed API calls,&lt;/li&gt;&lt;li&gt;user/admin behavior that is abnormal (i.e. at unusual times or from an unusual location), and&lt;/li&gt;&lt;li&gt;significant deviations from the standard operation metrics baseline.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-NSA-HG-03" name="Configure control plane components to use authenticated, encrypted communications using Transport Layer Security (TLS) certificates" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The control plane is the core of Kubernetes and gives users the ability to view containers, schedule new Pods, read Secrets, and execute commands in the cluster. Because of these sensitive capabilities, the control plane should be highly protected. In addition to secure configurations such as TLS encryption, RBAC, and a strong authentication method, network separation can help prevent unauthorized users from accessing the control plane.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Kubernetes API server runs on ports 6443 and 8080, which should be protected by a firewall to accept only expected traffic. Port 8080, by default, is accessible without TLS encryption from the local machine, and the request bypasses authentication and authorization modules.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The insecure port can be disabled using the API server flag --insecure-port=0. The Kubernetes API server should not be exposed to the Internet or an untrusted network. Network policies can be applied to the kube-system namespace to limit internet access to the kube-system. If a default deny policy is implemented to all namespaces, the kube-system namespace must still be able to communicate with other control plane segments and worker nodes.&lt;/p&gt;&lt;p&gt;The following table lists the control plane ports and services:&lt;/p&gt;&lt;p&gt;Protocol Direction Port Range Purpose&lt;/p&gt;&lt;p&gt;TCP Inbound 6443 or 8080 if not disabled Kubernetes API server&lt;/p&gt;&lt;p&gt;TCP Inbound 2379-2380 etcd server client API&lt;/p&gt;&lt;p&gt;TCP Inbound 10250 kubelet API&lt;/p&gt;&lt;p&gt;TCP Inbound 10251 kube-scheduler&lt;/p&gt;&lt;p&gt;TCP Inbound 10252 kube-controller-manager&lt;/p&gt;&lt;p&gt;TCP Inbound 10258 cloud-controller-manager (optional)&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NSA Kubernetes Hardening Guidance" url="https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1. Set up TLS encryption&lt;/p&gt;&lt;p&gt;2. Set up strong authentication methods&lt;/p&gt;&lt;p&gt;3. Disable access to internet and unnecessary, or untrusted networks&lt;/p&gt;&lt;p&gt;4. Use RBAC policies to restrict access&lt;/p&gt;&lt;p&gt;5. Secure the etcd datastore with authentication and RBAC policies&lt;/p&gt;&lt;p&gt;6. Protect kubeconfig files from unauthorized modifications&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.5.1" name="Configure Image Provenance using ImagePolicyWebhook admission controller" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Configure Image Provenance for your deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Follow the Kubernetes documentation and setup image provenance. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   You need to regularly maintain your provenance configuration based on container image updates. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Docker: Anchore Toolbox" url="https://hub.docker.com/r/dnurmi/anchore-toolbox/"/>
+            <reference name="Kubernetes docs: Admission Controllers" url="https://kubernetes.io/docs/admin/admission-controllers/"/>
+            <reference name="Kubernetes issues: #22888" url="https://github.com/kubernetes/kubernetes/issues/22888"/>
+          </references>
+          <standards>
+            <standard ref="5.5.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the pod definitions in your cluster and verify that image provenance is configured as appropriate.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.4.2" name="Consider external secret storage" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes supports secrets as first-class objects, but care needs to be taken to ensure that access to secrets is carefully limited. Using an external secrets provider can ease the management of access to secrets, especially where secrets are used across both Kubernetes and non-Kubernetes environments. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Refer to the secrets management options offered by your cloud provider or a third-party secrets management solution. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.4.2" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your secrets management implementation</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.7.1" name="Create administrative boundaries between resources using namespaces" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use namespaces to isolate your Kubernetes objects. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Limiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups.&amp;nbsp; Resources created in one namespace can be hidden from other namespaces. 
+&lt;/div&gt; 
+&lt;div&gt;
+  By default, each resource created by a user in Kubernetes cluster runs in a default namespace, called default. You can create additional namespaces and attach resources and users to them. You can use Kubernetes Authorization plugins to create policies that segregate access to namespace resources between different users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Follow the documentation and create namespaces for objects in your deployment as you need them. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   You need to switch between namespaces for administration. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes blog: Deployment Best Practices" url="https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/"/>
+            <reference name="Kubernetes docs: Namespaces" url="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"/>
+          </references>
+          <standards>
+            <standard ref="5.7.1" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="5.7.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command and review the namespaces created in the cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl get namespaces 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that these namespaces are the ones you need and are adequately administered as per your requirements. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.3.2" name="Ensure that all Namespaces have Network Policies defined" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use network policies to isolate traffic in your cluster network. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Follow the documentation and create NetworkPolicy objects as you need them. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Once network policies are in use within a given namespace, traffic not explicitly allowed by a network policy will be denied. As such it is important to ensure that, when introducing network policies, legitimate traffic is not blocked. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Declare Network Policy" url="https://kubernetes.io/docs/tasks/configure-pod-container/declare-network-policy/"/>
+            <reference name="Kubernetes docs: Network Policies" url="https://kubernetes.io/docs/concepts/services-networking/networkpolicies/"/>
+            <reference name="Octetz.com" url="https://octetz.com/docs/2019/2019-04-22-netpol-api-k8s/"/>
+          </references>
+          <standards>
+            <standard ref="5.3.2" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command and review the NetworkPolicy objects created in the cluster. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl --all-namespaces get networkpolicy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that each namespace defined in the cluster has at least one Network Policy. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-3.2.1" name="Ensure that a minimal audit policy is created" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes can audit the details of requests made to the API server. The --audit-policy-file flag must be set for this logging to be enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging is an important detective control for all systems, to detect potential unauthorized access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Create an audit policy file for your cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Audit logs will be created on the master nodes, which will consume disk space. Care should be taken to avoid generating too large volumes of log information as this could impact the availability of the cluster nodes. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Auditing" url="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/"/>
+          </references>
+          <standards>
+            <standard ref="3.2.1" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="3.2.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command on one of the cluster master nodes: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ps -ef | grep kube-apiserver 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the --audit-policy-file is set. Review the contents of the file specified and ensure that it contains a valid audit policy. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.1.5" name="Ensure that default service accounts are not actively used" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. 
+&lt;/div&gt; 
+&lt;div&gt;
+  The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Modify the configuration of each default service account to include this value automountServiceAccountToken: false 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   All workloads which require access to the Kubernetes API will require an explicit service account to be created. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Configure Service Account" url="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"/>
+          </references>
+          <standards>
+            <standard ref="5.1.5" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  For each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additionally ensure that the automountServiceAccountToken: false setting is in place for each default service account. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-NIST-800-190-02" name="Ensure that nodes are securely introduced to the cluster" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Orchestration platforms should be configured to provide features that create a secure environment for all the apps they run. Orchestrators should ensure that nodes are securely introduced to the cluster, have a persistent identity throughout their lifecycle, and can also provide an accurate inventory of nodes and their connectivity states. Organizations should ensure that orchestration platforms are designed specifically to be resilient to compromise of individual nodes without compromising the overall security of the cluster. A compromised node must be able to be isolated and removed from the cluster without disrupting or degrading overall cluster operations. Finally, organizations should choose orchestrators that provide mutually authenticated network connections between cluster members and end-to-end encryption of intra-cluster traffic. Because of the portability of containers, many deployments may occur across networks organizations do not directly control, so a secure-by-default posture is particularly important for this scenario.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-190" url="https://csrc.nist.gov/publications/detail/sp/800-190/final"/>
+          </references>
+          <standards>
+            <standard ref="4.3.5" supportedStandardRef="nist-800-190"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.351">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-1.1.14" name="Ensure that the admin.conf file ownership is set to root:root" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the admin.conf file ownership is set to root:root. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The admin.conf file contains the admin credentials for the cluster. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Run the below command (based on the file location on your system) on the master node. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   chown root:root /etc/kubernetes/admin.conf 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: kubeadm" url="https://kubernetes.io/docs/admin/kubeadm/"/>
+          </references>
+          <standards>
+            <standard ref="1.1.14" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="1.1.14" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command (based on the file location on your system) on the master node. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  stat -c %U:%G /etc/kubernetes/admin.conf 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the ownership is set to root:root. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-1.1.13" name="Ensure that the admin.conf file permissions are set to 644 or more restrictive" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the admin.conf file has permissions of 644 or more restrictive. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The admin.conf is the administrator kubeconfig file defining various settings for the administration of the cluster. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Run the below command (based on the file location on your system) on the master node. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   chmod 644 /etc/kubernetes/admin.conf 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Create Cluster Kubeadm" url="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/"/>
+          </references>
+          <standards>
+            <standard ref="1.1.13" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="1.1.13" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command (based on the file location on your system) on the master node.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  stat -c %a /etc/kubernetes/admin.conf 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the permissions are 644 or more restrictive. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-3.2.2" name="Ensure that the audit policy covers key security concerns" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the audit policy created for the cluster covers key security concerns. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Consider modification of the audit policy in use on the cluster to include these items, at a minimum. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Increasing audit logging will consume resources on the nodes or other log destination. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Audit Policy" url="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/"/>
+            <reference name="Kubernetes: configure-helper.sh" url="https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh"/>
+            <reference name="k8scop: k8s-security-dashboard" url="https://github.com/k8scop/k8s-security-dashboard/blob/master/configs/kubernetes/adv-audit.yaml"/>
+          </references>
+          <standards>
+            <standard ref="3.2.2" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Review the audit policy provided for the cluster and ensure that it covers at least the following areas : 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Access to Secrets managed by the cluster.&amp;nbsp; Care should be taken to only log Metadata for requests to&amp;nbsp; &amp;nbsp; &amp;nbsp;Secrets, ConfigMaps, and TokenReviews, in order to avoid the risk of logging sensitive data.&lt;/li&gt; 
+  &lt;li&gt;Modification of pod and deployment objects.&lt;/li&gt; 
+  &lt;li&gt;Use of pods/exec, pods/portforward, pods/proxy and services/proxy.&lt;/li&gt; 
+  &lt;li&gt;Roles and RoleBindings, ClusterRoles / ClusterRoleBindings&lt;/li&gt; 
+  &lt;li&gt;ConfigMaps&lt;/li&gt; 
+  &lt;li&gt;Secrets&lt;/li&gt; 
+  &lt;li&gt;Workloads: Deployments, DaemonSets, Pods,&lt;/li&gt; 
+  &lt;li&gt;Cluster's certificates&lt;/li&gt; 
+  &lt;li&gt;The resources within each apiVersion&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;div&gt;
+  For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.1.1" name="Ensure that the cluster-admin role is only used where required" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as cluster-admin provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as cluster-admin allow super-user access to perform any action on any resource. When used in a ClusterRoleBinding, it gives full control over every resource in the cluster and in all namespaces. When used in a RoleBinding, it gives full control over every resource in the rolebinding's namespace, including the namespace itself. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Where possible, first bind users to a lower privileged role and then remove the cluster rolebinding to the cluster-admin role : 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   kubectl delete clusterrolebinding [name] 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt; Impact: &lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Care should be taken before removing any clusterrolebindings from the environment to ensure they were not required for operation of the cluster. Specifically, modifications should not be made to clusterrolebindings with the system: prefix as they are required for the operation of system components. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: User Facing Roles" url="https://kubernetes.io/docs/admin/authorization/rbac/"/>
+          </references>
+          <standards>
+            <standard ref="5.1.1" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Obtain a list of the principals who have access to the cluster-admin role by reviewing the clusterrolebinding output for each role binding that has access to the cluster-admin role. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;kubectl get clusterrolebindings -o=custom-columns= 
+&lt;/div&gt; 
+&lt;div&gt;
+  NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-1.1.20" name="Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that Kubernetes PKI certificate files have permissions of 644 or more restrictive. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes makes use of a number of certificate files as part of the operation of its components. The permissions on these files should be set to 644 or more restrictive to protect their integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Run the below command (based on the file location on your system) on the master node. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   chmod -R 644 /etc/kubernetes/pki/*.crt 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
+          </references>
+          <standards>
+            <standard ref="1.1.20" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="1.1.20" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command (based on the file location on your system) on the master node. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  find /etc/kubernetes/pki -name "*.crt" | xargs stat -c '%n %a' 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the permissions are 644 or more restrictive. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-1.1.19" name="Ensure that the Kubernetes PKI directory and file ownership is set to root:root" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that the Kubernetes PKI directory and file ownership is set to root:root. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes makes use of a number of certificates as part of its operation. You should set the ownership of the directory containing the PKI information and all files in that directory to maintain their integrity. The directory and files should be owned by root:root. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Run the below command (based on the file location on your system) on the master node. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   chown -R root:root /etc/kubernetes/pki/ 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
+          </references>
+          <standards>
+            <standard ref="1.1.19" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="1.1.19" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command (based on the file location on your system) on the master node. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  ls -laR /etc/kubernetes/pki/ 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the ownership of all files and directories in this hierarchy is set to root:root. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-1.1.21" name="Ensure that the Kubernetes PKI key file permissions are set to 600" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that Kubernetes PKI key files have permissions of 600. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes makes use of a number of key files as part of the operation of its components. The permissions on these files should be set to 600 to protect their integrity and confidentiality. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Run the below command (based on the file location on your system) on the master node. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   chmod -R 600 /etc/kubernetes/pki/*.key 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: kube apiserver" url="https://kubernetes.io/docs/admin/kube-apiserver/"/>
+          </references>
+          <standards>
+            <standard ref="1.1.21" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="1.1.21" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the below command (based on the file location on your system) on the master node. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  find /etc/kubernetes/pki -name "*.key" | xargs stat -c '%n %a' 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Verify that the permissions are 600. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:23.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.7.2" name="Ensure that the seccomp profile is set to docker/default in your pod definitions" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable docker/default seccomp profile in your pod definitions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. You should enable it to ensure that the workloads have restricted actions available within the container. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you would need to enable alpha features in the apiserver by passing "--feature-gates=AllAlpha=true" argument. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS parameter to "--feature-gates=AllAlpha=true" 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   KUBE_API_ARGS="--feature-gates=AllAlpha=true" 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Based on your system, restart the kube-apiserver service. For example: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   systemctl restart kube-apiserver.service 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use annotations to enable the docker/default seccomp profile in your pod definitions. An example is as below: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   apiVersion: v1 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   kind: Pod 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   metadata: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;name: trustworthy-pod 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;annotations: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;seccomp.security.alpha.kubernetes.io/pod: docker/default 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   spec: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;containers: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;- name: trustworthy-container 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;span style="white-space:pre"&gt; &lt;/span&gt;image: sotrustworthy:latest 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   If the docker/default seccomp profile is too restrictive for you, you would have to create/manage your own seccomp profiles. Also, you need to enable all alpha features for this to work. There is no individual switch to turn on this feature. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Docker docs: Seccomp" url="https://docs.docker.com/engine/security/seccomp/"/>
+            <reference name="Kubernetes issues: #39845" url="https://github.com/kubernetes/kubernetes/issues/39845"/>
+            <reference name="Kubernetes: Disable seccomp policy by default" url="https://github.com/kubernetes/kubernetes/pull/21790"/>
+          </references>
+          <standards>
+            <standard ref="5.7.2" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Review the pod definitions in your cluster. It should create a line as below: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  annotations: 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp;seccomp.security.alpha.kubernetes.io/pod: docker/default 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:5" name="For existing infrastructure, the operator should manage a gradual roll-out of capabilities, starting with capturing data (i.e., network traffic, disk and memory artifacts)" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Integrating forensics capabilities into an existing infrastructure should be part of the maintenance and&amp;nbsp; change management activities of the operator. This should be done as part of due diligence and compliance, as well as to satisfy rules and regulations. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The integration of forensics capabilities will help the operator meet due diligence requirements, compliance measures, rules, and regulations. These capabilities will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the forensics plan for available forensics capabilities and verify that they have been fully integrated according to the steps outlined. 
+&lt;br&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:4" name="For new infrastructure, the operator should implement planned forensics capabilities" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The design and implementation of planned forensics capabilities should take place along with the rest of the infrastructure and should be integrated with corporate incident response, business continuity and disaster recovery plans. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The design and implementation of forensics capabilities will help to verify the plan and revise the designs if needed to accommodate changes. These capabilities will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the forensics plan for available forensics capabilities and verify that they have been applied to the system.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:2" name="In a multi-tenant environment, the operator should ensure balanced resource consumption" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Quality of service should always be upheld at the expense of multi-tenancy 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This allows fulfillment of at least one service-level agreement (SLA). It can be beneficial to work with developers and/or vendors to refine resource requests. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="display: inline !important; float: none; background-color: transparent; color: rgb(0, 0, 0); font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;"&gt;The method of verifying balanced resource consumption will depend on the organizational policies and available tools.&amp;nbsp; Ensure that developers have been involved in determining resource requirements.&lt;/span&gt; 
+&lt;br&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:3" name="In a multi-tenant environment, the operator should ensure that the CMP optimizes cluster resource consumption" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring predictable platform behavior under conditions of varying resource availability can be a challenge, an operator needs to evaluate setting resource constraints to preserve environment stability when resources availability fluctuates. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Balancing the resource consumption facilitates sustainable execution, which in turn minimizes the resource contention. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The method of verifying balanced resource consumption will depend on the CMP being used to manage the system.&amp;nbsp; Check the relevant documentation for the CMP and any organizational policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.1.2" name="Minimize access to secrets" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Where possible, remove get, list and watch access to secret objects in the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Care should be taken not to remove access to secrets to system components which require this for their operation 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.1.2" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the users who have get, list or watch access to secrets objects in the Kubernetes API.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.1.3" name="Minimize wildcard use in Roles and ClusterRoles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard "*" which matches all items. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The principle of least privilege recommends that users are provided only the access required for their role and nothing more. The use of wildcard rights grants is likely to provide excessive rights to the Kubernetes API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.1.3" supportedStandardRef="cis-kubernetes-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Retrieve the roles defined across each namespaces in the cluster and review for wildcards&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl get roles --all-namespaces -o yaml 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Retrieve the cluster roles defined in the cluster and review for wildcards 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl get clusterroles -o yaml 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:3" name="Operators should design the secret management architecture by integrating with deployment tools or scripts and container orchestration tools" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Secret management deployment and initial seeding utilizing deployment time and user inputs can be handled by closely integrating it with the specific container orchestration scripts, as well as the 
+&lt;/div&gt; 
+&lt;div&gt;
+  corresponding deployment scripts in scenarios where deployment is triggered by a human user. In the case of a completely automated deployment, the use of a key management server (KMS) or a hardware secure module (HSM) should be utilized to bootstrap the secret management server with the initial bootstrapping secrets required. For instance, virtual machine (VM) metadata that has been bound to a specific role can be used to authenticate to an HSM to obtain secrets from an HSM during VM boot up.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Bootstrapping of secrets is always a chicken-and-egg issue and utilizing some auto-generated data, such as VM metadata, to obtain the first secret from the HSM/KMS is a way to overcome this issue. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Once the secret management system has been bootstrapped with deployment-time or boot-up time secrets, it is armed to handle dynamic generation of secrets. For instance, in order to dynamically generate database account credentials for applications it needs to use the database admin credentials obtained at deployment time to authorize the creation of a new user account and then pass these on to the application that needs to use it. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are a number of secrets management tools available.&amp;nbsp; Ensure that tools chosen is robust and that it has been correctly integrated with deployment tools and any other relevant features.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.349">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.8:1" name="Operators should ensure the availability of the capability to validate image signatures before deployment" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;/b&gt;Images should be signed as part of the build process and validated before used. Signing and validation can be achieved by using GPG&amp;nbsp; signatures on image contents or through similar methods. Developers should ensure that their images are signed as part of the build process.&amp;nbsp; Operators should ensure the availability of the capability to validate image signatures before deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;/b&gt;Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered&amp;nbsp; with between build and runtime. 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.8" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that there is a suitable image signing capability such as GPG&amp;nbsp; signatures for the system, and that developers and operators are aware of its existence and how to use it. 
+&lt;span style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-style: normal; font-variant: normal; font-weight: 400; text-decoration: none; word-spacing: 0px; display: inline !important; white-space: normal; orphans: 2; float: none; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.1:2" name="Operators should leverage a container management platform to securely move images across environments" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In a production container environment, there are many components to manage in addition to management of application code and container images. A CMP that can support the organization's scale across one or more environments and/or locations should have capabilities to securely synchronize container images. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the Operator must have the ability to validate and verify the code and/or binary artifacts between environments and promotion phases utilizing digital certificates and/or digital signatures provided by the developer or the orchestration engine.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the consistency of an application deployed by the build chain, the operator must also have the ability to synchronize the application code across all locations where the application is running or being consumed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using a CMP to manage container images, users of the platform can confidently expect appropriate versions of a container image to be available for execution across their environments. This minimizes confusion around versions of an application that is running in different environments. When coupled with the best practice of using a root of trust, users of the platform can ensure provenance and integrity of the container images across their environments. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a suitable CMP exists and is in use in your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.8:5" name="Operators should use trusted hosts that are securely hardened and, where container engine is securely configured, to store images and run containers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Operators will need to harden the OS and the container engine before storing images and running containers on them. It is important to only deploy the necessary packages on the host and to regularly apply security updates and kernel patches.&amp;nbsp; Operators will want to harden the container engine according to vendor's security best practices.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring that host OS and container engine are properly patched and securely configured will reduce the container's attack surface and exposure to known vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.8" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Please follow the best security practices according to your specific vendor.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.4.1" name="Prefer using secrets as files over secrets as environment variables" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes supports mounting secrets as data volumes or as environment variables. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Minimize the use of environment variable secrets. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is reasonably common for application code to log out its environment (particularly in the event of an error). This will include any secret values passed in as environment variables, so secrets can easily be exposed to any user or entity who has access to the logs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Application code which expects to read secrets in the form of environment variables would need modification 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Kubernetes docs: Using Secrets" url="https://kubernetes.io/docs/concepts/configuration/secret"/>
+          </references>
+          <standards>
+            <standard ref="5.4.1" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command to find references to objects which use environment variables defined from secrets. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} 
+&lt;/div&gt; 
+&lt;div&gt;
+  {.metadata.name} {"\n"}{end}' -A 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CIS-K-5.7.4" name="The default namespace should not be used" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Impact:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   None 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.7.4" supportedStandardRef="cis-kubernetes-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run this command to list objects in default namespace 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  kubectl get all 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The only entries there should be system managed resources such as the kubernetes service 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.5:2" name="The operator must provide authentication and authorization infrastructure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The Operator should provide the means to not only encrypt traffic, but at the same time ensure the identity of the containers and the actions that they can take. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Using a solution such as TLS with mutual authentication would ensure both the confidentiality of the traffic and the identity of the containers. Authorization mechanisms would be provided based on an RBAC such as LDAP, which leverages the identity provided by the authentication mechanism. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="4.3.2" supportedStandardRef="nist-800-190"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Individual container technologies will have their own methods for checking and applying encryption for communications.&amp;nbsp; Follow the relevant documentation for the technology in question. 
+&lt;br&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.5:3" name="The operator must provide network monitoring infrastructure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitoring network traffic and configurations provides the means to detect the tampering of network traffic and configurations besides potentially malicious traffic.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network monitoring challenges may be mitigated by defining standard semantics and syntax for network monitoring for containers, specifying "must report" events for compliance, and addressing the accuracy or relevance of network activity/events to network health for containers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Providing a record of network traffic (i.e., netflows) and configuration changes ensures that only expected behaviors and actions take place within a given environment. This helps in maintaining incident response and detection capabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Individual systems will have their own methods for monitoring network traffic.&amp;nbsp; Ensure that suitable methods are in use to secure both the container architecture and the underlying network technology. 
+&lt;br&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:4" name="The operator should design into infrastructure the ability to only allow the use of signed and approved images" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Operators should design an infrastructure that will accept only signed and approved images. The image approval can be tied to the organization's software acceptance policy (e.g., quality, security, stability, etc.), or to any acceptance criteria that is applicable. It should be possible for an operator to prevent running an image even if it is properly signed but otherwise fails to meet acceptance criteria. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Checking for signature validation ensures that image data was not tampered with between build and the time image is running. Preventing the use of unauthorized or unacceptable images (even if signed) provides further validation of images before they run. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="display: inline !important; float: none; background-color: transparent; color: rgb(0, 0, 0); font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;"&gt;Verify that there is a suitable image signing capability such as GPG&amp;nbsp; signatures for the system, and that developers and operators are aware of its existence and how to use it. They system should be configured to prevent access to images which are unsigned.&lt;/span&gt; 
+&lt;br&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:5" name="The operator should design the infrastructure to continuously identify newly published vulnerabilities" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The operator should provide an infrastructure that continuously identifies image vulnerabilities in the following cases: images that are stored in a registry, images that are stored locally on the host, and images that are running as containers. Once a new vulnerability is identified, mitigation actions should take place based on the vulnerability severity and its impact on the application. Instead of patching running containers, it is preferable to apply the patch on a new image version and deploy the new image to the container runtime environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There is a need to continuously rescan images since new vulnerabilities are found and published over time. The scan should include all the images in the image registry, images on local machines (waiting to run), and images that are already running as containers. Applying patches by creating a new image version instead of updating running containers will provide better visibility into the process and ensure consistency between containers and their images. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that a vulnerability scanner exists which is robust, appropriate for the technology in question, can be automated, and can be applied to all stages of the build pipeline.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:3" name="The operator should include forensics capability planning for container environments" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Forensics planning should include the instrumentation, human resources, sources of evidence (i.e., network, disk, memory), processes, and procedures. The volatile nature of the container environment necessitates a more agile framework to capture and analyze the evidence.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Forensics capabilities are the basis for any incident response and mitigation activity. Forensics can provide the necessary evidence to determine the root cause of an incident and increase the speed of mitigation. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Integrating forensics capabilities into an incident response plan and procedures will provide the means to acquire and process evidence, decrease the time to determine root cause, and minimize exposure to a compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; text-decoration: none; word-spacing: 0px; white-space: normal; orphans: 2; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;
+  Verify that a forensics plan exists, that it is comprehensive, and that it includes identification of the forensics capabilities which can be applied to the system. 
+&lt;/div&gt; 
+&lt;div style="text-align: left; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: Times New Roman; font-size: 16px; font-style: normal; font-variant: normal; text-decoration: none; word-spacing: 0px; white-space: normal; orphans: 2; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:3" name="The operator should provide infrastructure that isolates network traffic of different users and applications" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic for different users and applications needs to be segregated to limit lateral movement from potentially compromised users or applications.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This network isolation limits the threat vector of lateral movement. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the instructions in the relevant documentation for the container technology in use.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:2" name="The operator should provide infrastructure that supports resource management, access control, and monitoring of container volumes" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The management of volume resources includes following volume management service activities: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+&lt;ul&gt;
+&lt;li&gt;Creating, provisioning, and updating volume resource&lt;/li&gt;
+&lt;li&gt;Enrolling, accessing, and denying volume resource&lt;/li&gt;
+&lt;li&gt;Decommissioning and terminating volume resource&lt;/li&gt;
+&lt;li&gt;Troubleshooting volume resource&lt;/li&gt;
+&lt;li&gt;Monitoring, reporting, auditing, inventorying, validating, and verifying volume resource&lt;/li&gt;
+&lt;li&gt;Migrating volume resource&lt;/li&gt;
+&lt;li&gt;Encrypting volume resource&lt;/li&gt;
+&lt;li&gt;Recovering volume resource&lt;/li&gt;
+&lt;li&gt;Performance tuning volume resource&lt;/li&gt;
+&lt;/ul&gt;
+&lt;/div&gt; 
+&lt;div&gt;
+  The relationship between assets (i.e., people, groups, containers, network, host, and volumes) should be explicitly known and mapped to volume management service activities (as outlined in the CSA document referenced by this countermeasure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   The granular breakdown of "resources management" is concretely identified as a potential standard practice for consistent management of volume resource management activities. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the current infrastructure to ensure that&amp;nbsp;volume management service activities are mapped according to the guidelines in the related standard documentation.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:24.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-control" name="Access control" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="CP-AC-1" name="Attackers gain access to configuration files without necessary privileges" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>An adversary is able to exploit misconfigured file access to gain access to the master node configuration files which control credentials and certificates.&amp;nbsp; &amp;nbsp;The Kubernetes default is to reserve access to these files to root and to configure strong permissions.&amp;nbsp; These permissions may be changed by administrators in order to ease workflow but this can have serious implications for security.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CP-AC-1.1">
+                  <countermeasures>
+                    <countermeasure ref="C-NSA-HG-03" mitigation="16"/>
+                    <countermeasure ref="CIS-K-1.1.13" mitigation="20"/>
+                    <countermeasure ref="CIS-K-1.1.20" mitigation="16"/>
+                    <countermeasure ref="CIS-K-1.1.21" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CP-AC-1.2">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-1.1.14" mitigation="16"/>
+                    <countermeasure ref="CIS-K-1.1.19" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-NSA-HG-03" mitigation="16"/>
+                <countermeasure ref="CIS-K-1.1.13" mitigation="20"/>
+                <countermeasure ref="CIS-K-1.1.14" mitigation="16"/>
+                <countermeasure ref="CIS-K-1.1.19" mitigation="16"/>
+                <countermeasure ref="CIS-K-1.1.20" mitigation="16"/>
+                <countermeasure ref="CIS-K-1.1.21" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="T-NIST-800-190-01" name="Attackers take advantage of bad orchestrator configurations that expose the orchestrator and all other container technology components" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>&lt;p&gt;Maintenance of trust between the nodes in the environment requires special care. The orchestrator is the most foundational node. Weak orchestrator configurations can expose the orchestrator and all other container technology components to increased risk. Examples of possible consequences include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Unauthorized hosts joining the cluster and running containers&lt;/li&gt;&lt;li&gt;The compromise of a single cluster host implying compromise of the entire cluster-for example, if the same key pairs used for authentication are shared across all nodes&lt;/li&gt;&lt;li&gt;Communications between the orchestrator and DevOps personnel, administrators, and hosts being unencrypted and unauthenticated&lt;/li&gt;&lt;/ul&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST 800-190" url="https://csrc.nist.gov/publications/detail/sp/800-190/final"/>
+              </references>
+              <weaknesses>
+                <weakness ref="W-NIST-800-190-01">
+                  <countermeasures>
+                    <countermeasure ref="C-NIST-800-190-02" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-NIST-800-190-02" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="PO-AC-1" name="Misconfigured or incorrectly applied cluster wide roles may result in privilege escalation" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>There are a number of cluster wide roles which can be used to ensure security and integrity within a cluster.&amp;nbsp; Administration of these can be difficult as they can have overlapping interests, and because changes in one area can have implications for others.&amp;nbsp; It is essential to manage these appropriately in order to control access to objects in the cluster.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-AC-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.1.1" mitigation="20"/>
+                    <countermeasure ref="CIS-K-5.1.2" mitigation="16"/>
+                    <countermeasure ref="CIS-K-5.1.3" mitigation="16"/>
+                    <countermeasure ref="CIS-K-5.1.5" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-AC-1.2">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.7.1" mitigation="16"/>
+                    <countermeasure ref="CIS-K-5.7.4" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-5.1.1" mitigation="20"/>
+                <countermeasure ref="CIS-K-5.1.2" mitigation="16"/>
+                <countermeasure ref="CIS-K-5.1.3" mitigation="16"/>
+                <countermeasure ref="CIS-K-5.1.5" mitigation="16"/>
+                <countermeasure ref="CIS-K-5.7.1" mitigation="16"/>
+                <countermeasure ref="CIS-K-5.7.4" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="PO-AS-1" name="Kubernetes uses Secrets to store and manage sensitive information.  If an attacker gains access to these they can use it to attack many other parts of the cluster" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>Kubernetes allows sensitive data such as passwords, tokens or keys to be stored outside of their objects or configuration files. This is a useful security feature, however these secrets must be well protected in order to adequately secure the cluster.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-AS-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.4.1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-AS-1.2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-AS-1.3">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.4.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-5.4.1" mitigation="34"/>
+                <countermeasure ref="CIS-K-5.4.2" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.10:3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="CP-AA-1" name="Client credentials may be exploited to allow attackers to gain access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>The exploitation of client credentials is a major threat in any system.&amp;nbsp; An adversary with access to client credentials can carry out any activity that the client can.&amp;nbsp; Their activities may also be missed by logging and other security measures as their activities may appear valid.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CP-AA-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-3.1.1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-3.1.1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="PO-AA-1" name="Lack of cluster wide authentication and authorization protocols may result in security gaps from individual development activities" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>&lt;div&gt;
+  In container networking, communications between containers must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled. In terms of applications, communications between containers affect access control-limiting access to network 
+&lt;/div&gt; 
+&lt;div&gt;
+  traffic, resources, and configurations.&amp;nbsp; The absence of cluster wide policies make these difficult to implement on an individual level.&amp;nbsp; This absence can result in information spillage and system compromise. 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-AA-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="PO-G-3" name="Complex requirements for configuring infrastructure may result in critical activities not being carried out" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>There are number of security risks which may be overlooked in container architectures.&amp;nbsp; This may compromise performance or integrity or clusters.&amp;nbsp;&amp;nbsp;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-G-3.1">
+                  <countermeasures>
+                    <countermeasure ref="C-NSA-HG-05" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.8:5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-G-3.2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.12:3" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.9:2" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-NSA-HG-05" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.12:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.12:3" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.8:5" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.9:2" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="PO-G-1" name="Malicious images may compromise security" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>One of the benefits of Kubernetes is the ability to share, download and re-use images.&amp;nbsp; This can greatly improve development and operation time and support collaboration.&amp;nbsp; However images which are not secured can be a mechanism for introducing malicious code etc.&amp;nbsp; to a cluster.&amp;nbsp;&amp;nbsp;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-G-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.5.1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-G-1.2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.1:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.8:1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-G-1.3">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:5" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-5.5.1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.1:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.6:4" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.6:5" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.8:1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="PO-G-2" name="Unrestricted access to system calls make the cluster vulnerable to a variety of attack mechanisms" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>System calls allow programs to request services from the kernel of the operating system they are executed on.&amp;nbsp; &amp;nbsp;They are the only entry points into the kernel system and, if not properly managed, can result in unintentional system complications or targeted attacks from outside.&amp;nbsp;&amp;nbsp;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-G-2.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.7.2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-5.7.2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-auditing" name="Logging and Auditing" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="CP-LA-1" name="Attackers make undetected or unaudited changes or ingress to cluster via the control plane" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>It is very difficult to make sure that no vulnerabilities remain in a system, no matter how good those responsible for security are.&amp;nbsp; This makes it extremely important that logging and monitoring are carried out in order to ensure that exploits are noticed and managed quickly. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In Kubernetes, logging should be configured via the control plane as this allows many other areas of the cluster to be monitored. 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CP-LA-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-3.2.1" mitigation="50"/>
+                    <countermeasure ref="CIS-K-3.2.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-3.2.1" mitigation="50"/>
+                <countermeasure ref="CIS-K-3.2.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="PO-LM-1" name="Lack of infrastructure wide forensics capabilities may result in a lack of sufficient data for security analytics" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>&lt;div&gt;
+  It is vital that the container infrastructure supports digital forensics capabilities that can be integrated into an incident response plan. Applications include image forensics (i.e., investigating the contents of an image), network forensics (i.e., investigating network traffic related to containers by collecting and analyzing netflows and full packet capture), memory forensics (i.e., investigating binaries and related activities in runtime for possible compromise), and log forensics (i.e., investigating host, container, and other infrastructure logs for anomalies and possible signs of compromise). It also ensures the infrastructure collects and provides access to the necessary data sources. 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-LM-1.1">
+                  <countermeasures>
+                    <countermeasure ref="C-NSA-HG-04" mitigation="25"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:3" mitigation="25"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="PO-LM-1.2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:5" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-NSA-HG-04" mitigation="25"/>
+                <countermeasure ref="CSA-SACA-3.1.7:3" mitigation="25"/>
+                <countermeasure ref="CSA-SACA-3.1.7:4" mitigation="25"/>
+                <countermeasure ref="CSA-SACA-3.1.7:5" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="kubernetes-library-devops">
+          <threats>
+            <threat ref="PO-N-1" name="Incorrect network policies may allow dangerous connections between objects in the cluster" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>&lt;div&gt; 
+ &lt;div&gt;
+   Network policies are used to specify how groups of pods are allowed to communicate with each other and other network endpoints. NetworkPolicy resources use labels to select pods and define rules which specify what traffic is allowed to the selected pods.&amp;nbsp; &amp;nbsp;Running objects in a cluster without adequate network policies can result in unrestricted access.&amp;nbsp; This is a highly exploitable vulnerability which could be used to target many other areas of the cluster. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt;&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-N-1.1">
+                  <countermeasures>
+                    <countermeasure ref="CIS-K-5.3.2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CIS-K-5.3.2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="PO-N-2" name="Network traffic may be exposed to adversaries" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="kubernetes-library-devops" editable="true">
+              <desc>&lt;div&gt;
+  Microservices have a higher requirement for secure communication between components than that found in legacy applications. Operators can be challenged to provide a flexible secure network transport between selected components. The absence can result in information spillage and system compromise 
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PO-N-2.1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:3" mitigation="50"/>
+                    <countermeasure ref="CSA-SACA-3.1.9:3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:3" mitigation="50"/>
+                <countermeasure ref="CSA-SACA-3.1.9:3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1006e968-1ec3-4c63-8a76-b10ae091e8da" diagramComponentId="7486815e-1e03-43d0-b427-6437d128637f" ref="13c2109b-c9ef-4146-aa1c-a802b47d48c8" name="Mobile Device Client (Thin)" desc="" library="" parentComponentRef="" componentDefinitionRef="mobile-device-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
+                        common that they deserve a special kingdom of their own. As with "API Abuse", there
+                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
+                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
+                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
+                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
+                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
+                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
+                        without restricting how much is copied. Other variants exist, but the existence of a classic
+                        overflow strongly suggests that the programmer is not considering even the most basic of
+                        security protections.
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
+              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software provides an Applications Programming Interface (API) or similar interface for
+                        interaction with external actors, but the interface includes a dangerous method or function that
+                        is not properly restricted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
+                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
+                        leverage them to obtain information about the app.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
+                        attackers can leverage them to obtain information about the app.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.913">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application can be deployed with active debugging code that can create unintended entry
+                        points.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.914">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
+                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.915">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For Android:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For iOS:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
+            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+          </references>
+          <standards>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
+            <reference name="OWASP MASVS - iOS - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the set of protocol handlers are deactivated.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.262">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.6" name="Anonymize all data that is sent to 3rd Party services" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data that is sent to 3rd Party services shall be anonymized, so no PII data is available that would allow the 3rd party to identify the user account. Also all other data, like IDs in an application that can be mapped to a user account or session should not be sent to a third party.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+            <reference name="OWASP MASVS - iOS - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#determining-whether-sensitive-data-is-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+          </references>
+          <standards>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all data that is sent to 3rd Party services is anonymized.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
+          </references>
+          <standards>
+            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
+            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the exceptions are well-designed and are catched and handled well.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#checking-for-weaknesses-in-third-party-libraries-mstg-code-5"/>
+            <reference name="OWASP MASVS - iOS - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings"/>
+          </references>
+          <standards>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; or &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Platform Interaction Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x11-v6-interaction_with_the_environment"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
+            <reference name="OWASP MASVS - iOS - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Best Practices for Passwords" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
+&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
+&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#testing-the-device-access-security-policy-mstg-storage-11"/>
+            <reference name="OWASP MASVS - iOS - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-local-data-storage-mstg-storage-1-and-mstg-storage-2"/>
+          </references>
+          <standards>
+            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app verifies the mobile device complies with the minimum
+                            device-access-security policy.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
+            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the application denies access to the session when the exceptions appear.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-javascript-execution-in-webviews-mstg-platform-5"/>
+            <reference name="OWASP MASVS - iOS - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-ios-webviews-mstg-platform-5"/>
+          </references>
+          <standards>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Search in the code the following instruction:
+                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
+                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;For iOS:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
+                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
+                            setJavaScriptEnabled:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [conf setPreferences:pref]; _webView = [[WKWebView
+                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
+                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [_webView loadRequest:request];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [self.view addSubview:_webView]; }
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
+          </references>
+          <standards>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the clipboard is disabled when sensitive data is used.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
+                        Android O and the behavior of MAC addresses have changed in Android N.
+
+                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
+                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
+                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
+                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
+                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
+                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
+                        they request the Build.Serial.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-device-binding-mstg-resilience-10"/>
+            <reference name="OWASP MASVS - iOS - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#device-binding-mstg-resilience-10"/>
+          </references>
+          <standards>
+            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
+                            authenticate).&lt;/li&gt;
+                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;ol&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;exit the current user&lt;/li&gt;
+                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
+                            shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
+                            working properly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Log Class&lt;/li&gt; 
+ &lt;li&gt;Logger Class&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
+&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;NSLog Method&lt;/li&gt; 
+ &lt;li&gt;printf-like function&lt;/li&gt; 
+ &lt;li&gt;NSAssert-like function&lt;/li&gt; 
+ &lt;li&gt;Macro&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage"/>
+            <reference name="OWASP MASVS - iOS - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+          </references>
+          <standards>
+            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all executable files and libraries belonging to the app are encrypted or
+                            packed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that sensitive data is not stored in plain text.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
+                        including stealthy responses that don't simply terminate the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05c-reverse-engineering-and-tampering"/>
+            <reference name="OWASP MASVS - iOS - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06c-reverse-engineering-and-tampering"/>
+          </references>
+          <standards>
+            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the app implements multiple different responses to tampering, debugging and
+                            emulation, including stealthy responses that don't simply terminate the app.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing the Security Provider" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-the-security-provider-mstg-network-6"/>
+          </references>
+          <standards>
+            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-root-detection-mstg-resilience-1"/>
+            <reference name="OWASP MASVS - iOS - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#jailbreak-detection-mstg-resilience-1"/>
+          </references>
+          <standards>
+            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
+                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
+            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
+          </references>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
+                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
+                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
+                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
+                        the goal of protecting against memory patches applied during runtime. This includes unwanted
+                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
+                        well as rogue code loaded into process memory.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;div&gt;
+                        Integrity can be verified either by:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
+                        values.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
+            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
+          </references>
+          <standards>
+            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
+                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
+                            responds accordingly.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
+                        the app is running inside an emulator, the app shall terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
+          </references>
+          <standards>
+            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
+                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
+                        is detected, the app shall force termination of the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
+            <reference name="OWASP MASVS - iOS - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
+          </references>
+          <standards>
+            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Launch the app systematically with various apps and frameworks installed, such as the
+                            following:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
+                        features can be preventive or reactive. As the name implies, preventive anti-debugging
+                        techniques prevent the debugger from attaching in the first place, while reactive techniques
+                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
+                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
+                        combine multiple methods of prevention and detection which operate on different API layers and
+                        are distributed throughout the app.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
+            <reference name="OWASP MASVS - iOS - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
+          </references>
+          <standards>
+            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
+                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
+                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
+                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
+                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
+                            or other sources);&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
+                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Remove the debugging code, log verbose errors or debugging messages in the production version.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing for Debugging Code and Verbose Error Logging" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+          </references>
+          <standards>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
+                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+          </references>
+          <standards>
+            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Java Objects Are Exposed Through WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#determining-whether-java-objects-are-exposed-through-webviews-mstg-platform-7"/>
+          </references>
+          <standards>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>- Produce a JavaScript payload.
+                            - Inject it into the file that the app is requesting. The injection could be done either
+                            through a MITM attack or by directly modifying the file in case it is stored on external
+                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
+                            exploitation payload) which is able to install a full agent, injecting a limited agent into
+                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
+                            - Check that only the JavaScript provided with the app is allowed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.263">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>As a general rule of thumb, as little explanative information as possible should be provided
+                        along with the compiled code. Some metadata such as debugging information, line numbers and
+                        descriptive function or method names make the binary or bytecode easier to understand for the
+                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
+                        discarded without impacting the functionality of the app.
+
+                        This data shall be removed from the release version or shall be obfuscated in order to be
+                        inaccessible to the reverse engineer.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
+            <reference name="OWASP MASVS - iOS - Testing for Debugging Symbols" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-symbols-mstg-code-3"/>
+          </references>
+          <standards>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Symbols are usually stripped during the build process, so you need the compiled byte-code
+                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
+                            nm binary in your Android NDK and export it (or create an alias).
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            export $NM =
+                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            To display debug symbols:
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ $NM -a
+                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
+                            libfoo.so: no symbols&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;To display dynamic symbols:
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            $ $NM -D libfoo.so&amp;nbsp;
+                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
+                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
+                            Adding this flag causes gcc to discard the function names while still preserving the names
+                            of functions declared as JNIEXPORT.&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            Check if the following was added to build.gradle:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
+                            binutils and can be installed via Homebrew on Mac OS X.
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing App Permissions" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide"/>
+            <reference name="OWASP MASVS - iOS - Testing Custom URL Schemes" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-app-permissions-mstg-platform-1"/>
+          </references>
+          <standards>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android applications:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
+                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
+                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
+                            permissions needed by the application.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Verifying Data Encryption on the Network" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04f-testing-network-communication"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
+  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This kind of vulnerability occurs in a number of ways: 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing for Memory Management Bugs" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04h-testing-code-quality#memory-corruption-bugs-mstg-code-8"/>
+          </references>
+          <standards>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
+                            gain access to the system.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.261">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
+          </references>
+          <standards>
+            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
+            <reference name="OWASP MASVS - iOS - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
+          </references>
+          <standards>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app is correctly signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:21.264">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker attempts to invoke all common switches and options in the target
+                                application for the purpose of discovering weaknesses in the target. For example, in
+                                some applications, adding the --debug switch causes debugging information to be
+                                displayed, which can sometimes reveal sensitive processing or configuration information
+                                to an attacker.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This attack differs from other forms of API abuse in that the attacker is blindly
+                                attempting to invoke options in the hope that one of them will work rather than
+                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
+                                with the published options of a targeted application this attack method may still be
+                                fruitful as it might discover unpublicized functionality.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-489">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-656">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MEMORY-LEAKAGE">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="OUTDATED-LIBRARIES">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of an object, resource,
+                                or system by using a variety of analysis techniques to effectively determine how the
+                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
+                                duplicate the function, or a part of the function, of an object in order to duplicate or
+                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
+                                or software, although the methodology and techniques involved in each type of analysis
+                                differ widely. When adversaries are reverse engineering software, methodologies fall
+                                into two broad categories, 'white box' and 'black box.' White box techniques involve
+                                methods which can be applied to a piece of software when an executable or some other
+                                compiled object can be directly subjected to analysis, revealing at least a portion of
+                                its machine instructions that can be observed upon execution.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                'Black Box' methods involve interacting with the software indirectly, in the absence of
+                                the ability to measure, instrument, or analyze an executable object directly. Such
+                                analysis typically involves interacting with the software at the boundaries of where the
+                                software interfaces with a larger execution environment, such as input-output vectors,
+                                libraries, or APIs.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="MASVS-EMULATION-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                <countermeasure ref="MASVS-8.7" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>If the mobile application requests permissions or access to components that are not
+                                strictly needed by the application, then users can lose trust in the security of the
+                                application with an associated impact on the trust placed in the application provider.</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                <countermeasure ref="MASVS-8.1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                <countermeasure ref="MASVS-4.9" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker employs forceful browsing to access portions of a website that are
+                                otherwise unreachable through direct URL entry.
+
+                                Usually, a front controller or similar design pattern is employed to protect access to
+                                portions of a web application.
+
+                                Forceful browsing enables an attacker to access information, perform privileged
+                                operations and otherwise reach sections of the web application that have been improperly
+                                protected.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-749">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-83">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                <countermeasure ref="MASVS-6.7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>Errors and error handling represent a class of API. Errors related to error handling
+                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
+                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-388">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                <countermeasure ref="MASVS-7.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="OWASP-MASVS" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-120">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="610557e7-471f-40e5-9ccf-ffe2e2693a10" diagramComponentId="72530ff3-013e-49f7-bc35-ad38d5f1493e" ref="f6ea0329-f94b-4e27-a510-eadd4157f49c" name="PAPI (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.439">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.261">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.032">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.262">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.262">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.378">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.122">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:20.123">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.958">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="0f839a14-0407-49f1-8bd1-c67e0b76c630" diagramComponentId="7517f366-9096-4e95-bd7c-0f4a737fd1da" ref="ccb00b1b-d74c-493e-b274-1a53a5a1755e" name="AWS API Gateway" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-IAM-2.2" name="Excessive use of administrator accounts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The administrator accounts are used for all actions, not only for administrative actions. This
+                        is because these users have not got a personal or a user account to do the daily actions.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.557">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.162">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-77" name="Improper Neutralization of Special Elements used in a Command ('Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of a command using
+                    externally-influenced input from an upstream component, but it does not
+                    neutralize or incorrectly neutralizes special elements that could modify the
+                    intended command when it is sent to a downstream
+                    component.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.163">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.559">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.163">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-522" name="Insufficiently Protected Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>This weakness occurs when the application transmits or stores
+                    authentication credentials and uses an insecure method that is susceptible to
+                    unauthorized interception and/or retrieval.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-522: Insufficiently Protected Credentials" url="https://cwe.mitre.org/data/definitions/522.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.8" name="Lack of 2FA" state="0" impact="100" issueId="" issueLink="">
+          <desc>Access to sensitive systems without using MFA to log into the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.1" name="The Authentication Method for Administrator Accounts is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The authentication method &amp;quot;Multi-factor Authentication&amp;quot; for the Administrator
+                        accounts are not configured.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.6" name="The User Account is not configured" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Key security settings such as the resetting of the password and other password controls are not configured.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.558">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:55.164">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.10" name="Apply setting MFA for sensitive API calls" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>To the extent that it is practical consider enforcing MFA access for sensitive API calls. For example, you can require that a user has authenticated with an MFA device in order to be allowed to terminate an Amazon EC2 instance. This ensures that such high level changes to your AWS environment are protected with an extra layer of security thus helping to prevent accidental or malicious damage. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;The following is an example of how to create a policy that enforces MFA to terminate EC2 instances: 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt; 
+  &lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt; 
+  &lt;li&gt;Select "Policies".&lt;/li&gt; 
+  &lt;li&gt;Select "Create Policy".&lt;/li&gt; 
+  &lt;li&gt;Select "Create your own policy".&lt;/li&gt; 
+  &lt;li&gt;Provide a policy name and description.&lt;/li&gt; 
+  &lt;li&gt;In the policy document add the following:&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; {&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Version": "2012-10-17",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Statement": [{&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Effect": "Allow",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Action": [&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:StopInstances",&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "ec2:TerminateInstances"&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; ],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Resource": ["*"],&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt; }]&lt;/i&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;i&gt;}&lt;/i&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click "Create policy".&lt;/li&gt; 
+  &lt;li&gt;The policy may now be added to a group by following the outlines in "Use RBAC with pre-defined policies added into groups or roles".&lt;/li&gt; 
+ &lt;/ul&gt; &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring MFA-Protected API Access" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that MFA is forced on a policy:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with IAM update privileges).&lt;/li&gt;
+                            &lt;li&gt;Go to IAM Service on the AWS Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Policies&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;In the filter select &amp;quot;Customer Managed Policies&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select the policy to check.&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line: &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:MultiFactorAuthPresent&amp;quot;: &amp;quot;true&amp;quot;}}&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.5" name="Avoid API keys for root account" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. However, do not use your AWS account (root) access key. The access key for your AWS account gives full access to all your resources for all AWS services, including your billing information. You cannot restrict the permissions associated with your AWS account access key.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console as Root.&lt;/li&gt; 
+  &lt;li&gt;Click on Account Name at the top left and select Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;On the pop up screen Click on Continue to Security Credentials.&lt;/li&gt; 
+  &lt;li&gt;Click on Access Keys.&lt;/li&gt; 
+  &lt;li&gt;Under the Status column if there are any Keys which are "Active".&lt;/li&gt; 
+  &lt;li&gt;Click on "Make Inactive" and click "Delete".&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;Run the following command: aws iam get-credential-report --query 'Content'
+                            --output text | base64 -D | egrep &amp;quot;root|access&amp;quot; | awk -F, '{print
+                            $1,$9,$14}'&lt;/li&gt;
+                            &lt;li&gt;For the &amp;lt;root_account&amp;gt; user ensure access_key_1_active and
+                            access_key_2_active are false.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.1" name="Avoid the use of the root account unless absolutely necessary" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The root account is the one which was used to open the AWS account with Amazon. Therefore it has full unrestricted access to all resources within the account including billing information. Reducing the use of this account and instead using personalized accounts with restricted permissions ensures the principles of least privilege and can help prevent accidental disclosure of credentials or unintended changes. 
+&lt;br&gt; 
+&lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt;Follow the remediation in "Create Individual Accounts". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.7" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.7" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws iam create-credential-report
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws iam get-credential-report --query 'Content' --output text | base64 -D | cut -d,
+                            -f1,5,11,16 | grep -B1 '&amp;lt;root_account&amp;gt;'&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;From the above determine the &amp;quot;password_last_used&amp;quot; time In
+                            addition to the above set up a metric filter as described elsewhere in this library to
+                            determine ad-hoc use of root.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW7" name="Choose a minimum TLS version for a custom domain in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Choose a minimum TLS version for a custom domain in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For greater security, you can choose a minimum Transport Layer Security (TLS) protocol version to be enforced for your API Gateway custom domain. You can choose either a TLS version 1.2 or TLS version 1.0 security policy. WebSocket APIs and HTTP APIs support only TLS 1.2. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  When you create a custom domain, you specify the security policy for it. 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can change the security policy by updating the domain name settings. To change the minimum TLS version, use one of the following commands, specifying the new TLS version (TLS_1_0 or TLS_1_2) in the securityPolicy parameter. Allow up to 60 minutes for the update to be completed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Choosing a minimum TLS version for a custom domain in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure when creating a custom domain name, that you specify the minimum TLS version by choosing the "Choose a minimum TLS version" option.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
+              <output/>
+            </source>
+            <references>
+              <reference name="Creating an edge-optimized custom domain name" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-edge-optimized-custom-domain-name.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW1" name="Control access to an API using supported mechanisms" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Control and manage access to a REST API in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway supports multiple mechanisms for controlling and managing access to your API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use the following mechanisms for authentication and authorization: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from specified source IP addresses or VPC endpoints. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods. IAM roles and policies can be used for controlling who can create and manage your APIs, as well as who can invoke them. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. IAM tags can be used together with IAM policies to control access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. Endpoint policies for interface VPC endpoints allow you to attach IAM resource policies to interface VPC endpoints to improve the security of your private APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  5. Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication-as well as information described by headers, paths, query strings, stage variables, or context variables request parameters. Lambda authorizers are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  6. Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs. Amazon Cognito user pools are used to control who can invoke REST API methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Controlling and managing access to a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing IAM Policies with the IAM Policy Simulator" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.6" name="Create a Password Policy enforcing strong passwords" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enforcing a strong password policy increases resiliency and reduces the chances of the password being compromised either through brute force attempts, keystroke logging tools or stolen credentials amongst others.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to AWS Console (ensure you have permissions to update IAM).&lt;/li&gt;&lt;li&gt;Go to IAM Service on the AWS Console.&lt;/li&gt;&lt;li&gt;Click on Account Settings.&lt;/li&gt;&lt;li&gt;Set "Minimum password length" to 14 or greater.&lt;/li&gt;&lt;li&gt;Check "Require at least one uppercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one lowercase letter".&lt;/li&gt;&lt;li&gt;Check "Require at least one number".&lt;/li&gt;&lt;li&gt;Check "Require at least one non-alphanumeric character"&lt;/li&gt;&lt;li&gt;Check "Enable password expiration" and set the period to at least 90 days.&lt;/li&gt;&lt;li&gt;Check "Prevent password reuse" and set the number to at least 10.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.8" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.8" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.9" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.2.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="8.3.9" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Validate that mechanisms exist to ensure that created passwords are strong enough.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Monitoring-4.9" name="Create AWS Config configuration change alerts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When cloudtrail is configured and sending alerts to cloudwatch logs these logs can be queried
+                        to identify suspicious API activity. One such activity that should be monitored is AWS Config
+                        changes. AWS config tracks configuration changes within the environment and is a useful change
+                        management tool. Therefore alerting on config changes ensures the continued visibility of AWS
+                        configuration items.
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a metric filter that checks for AWS Config changes:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws logs put-metric-filter&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --log-group-name &amp;lt;group&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-name &amp;lt;name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric- transformations &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --filter-pattern '{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                        (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                        tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}'&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create an SNS topic for notifications: aws sns create-topic --name &amp;lt;topic_name&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an SNS subscription to the topic created above: aws sns subscribe --topic-arn
+                        &amp;lt;topic_arn&amp;gt; --protocol email --notification-endpoint &amp;lt;email@example.com&amp;gt;&lt;/li&gt;
+                        &lt;li&gt;Create an alarm based on the above steps:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        aws cloudwatch put-metric-alarm&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        --alarm-name &amp;lt;value&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --metric-name &amp;lt;metric_filter_name&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --statistic Sum&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --period 300&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --threshold 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --comparison-operator GreaterThanOrEqualToThreshold&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --evaluation-periods 1&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --namespace &amp;lt;CloudTrailMetrics&amp;gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        --alarm-actions &amp;lt;topic_arn&amp;gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.9" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Identify the log group name: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Note the &amp;lt;group&amp;gt; value associated with CloudWatchLogsLogGroupArn.&lt;/li&gt;
+                            &lt;li&gt;Get a list of all associated metric filters for this &amp;lt;group&amp;gt;: aws
+                            logs describe-metric-filters --log-group-name &amp;quot;&amp;lt;group&amp;gt;&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the output contains the following:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;quot;filterPattern&amp;quot;: &amp;quot;{($.eventSource = config.amazonaws.com) &amp;amp;&amp;amp;
+                            (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.even
+                            tName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}&amp;quot;&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Note the metricName value associated with the filterPattern found in step 4.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Get a list of CloudWatch alarms and filter on the metricName captured in step 4:
+                            aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==`&amp;lt;metricName&amp;gt;`]'&lt;/li&gt;
+                            &lt;li&gt;Note the AlarmActions value - this will provide the SNS topic ARN value.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure there is at least one subscriber to the SNS topic: aws sns
+                            list-subscriptions-by-topic --topic-arn &amp;lt;topic_arm&amp;gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.3" name="Create Individual Accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user's permissions any time. (If you give out your AWS root credentials, it can be difficult to revoke them, and it is impossible to restrict their permissions.). 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+  &lt;li&gt;Select IAM.&lt;/li&gt; 
+  &lt;li&gt;Select Users.&lt;/li&gt; 
+  &lt;li&gt;Click "Create New Users".&lt;/li&gt; 
+  &lt;li&gt;Complete the required information.&lt;/li&gt; 
+  &lt;li&gt;Uncheck "Create access key for users".&lt;/li&gt; 
+  &lt;li&gt;Click "Create".&lt;/li&gt; 
+  &lt;li&gt;Select the user.&lt;/li&gt; 
+  &lt;li&gt;Click "Manage Password".&lt;/li&gt; 
+  &lt;li&gt;Select the required options and click "apply".&lt;/li&gt; 
+  &lt;li&gt;Select "Show User Security Credentials".&lt;/li&gt; 
+  &lt;li&gt;Securely supply the password to your user.&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that each user has got the corresponding account with the corresponding
+                            credentials.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW5" name="Create Route 53 alias records for API endpoints" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Create Route 53 alias records for API endpoints 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attackers sometimes hijack traffic to internet endpoints such as web servers by intercepting DNS queries and returning their own IP addresses to DNS resolvers in place of the actual IP addresses for those endpoints. Users are then routed to the IP addresses provided by the attackers in the spoofed response, for example, to fake websites. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can protect your domain from this type of attack, known as DNS spoofing or a man-in-the-middle attack, by configuring Domain Name System Security Extensions (DNSSEC), a protocol for securing DNS traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon Route 53 offers a special type of record called an 'Alias' record that lets you map your zone apex (example.com) DNS name to your Amazon API Gateway DNS name (i.e. api-id.execute-api.region.amazonaws.com/stage). IP addresses associated with Amazon API Gateway can change at any time due to scaling up, scaling down, or software updates. Route 53 responds to each request for an Alias record with one or more IP addresses for the API Gateway. There is no additional charge for queries to Alias records that are mapped to Amazon API Gateways. These queries are listed as "Intra-AWS-DNS-Queries" on the Route 53 usage report. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon API Gateway lets you create, publish, maintain, monitor, and secure APIs. You can create APIs that access AWS services or other web services, as well as data stored in the AWS Cloud. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The method that you use to route domain traffic to an API Gateway API depends on whether you created a regional API Gateway endpoint or an edge-optimized API Gateway endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regional API endpoint: You create a Route 53 alias record that routes traffic to the regional API endpoint. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Edge-optimized API endpoint: You create a Route 53 alias record that routes traffic to the edge-optimized API. This causes traffic to be routed to the CloudFront distribution that's associated with the edge-optimized API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An alias record is a Route 53 extension to DNS that's similar to a CNAME record. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your API by using the name of the alias record that you created in this procedure.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
+              <output/>
+            </source>
+            <references>
+              <reference name="Configuring Route 53 to route traffic to a regional API Gateway endpoint" url="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-api-gateway.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW12" name="Do not put sensitive data into AWS API Gateway free-form fields" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Do not put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS strongly recommends that you never put sensitive identifying information, such as your customers' account numbers, into free-form fields such as a Name field. This includes when you work with API Gateway or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into AWS services might get picked up for inclusion in diagnostic logs. When you provide a URL to an external server, don't include credentials information in the URL to validate your request to that server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that free-form fields do not contain sensitive data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data protection in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW16" name="Enable API Gateway X-Ray Tracing" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have active tracing support for AWS X-Ray enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Because X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray. You can also configure sampling rules to tell X-Ray which requests to record and at what sampling rates, according to criteria that you specify. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you call an API Gateway API from a service that's already being traced, API Gateway passes the trace through, even if X-Ray tracing isn't enabled on the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable X-Ray for an API stage by using the API Gateway console, or by using the API Gateway API or CLI. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Tracing user requests to REST APIs using X-Ray" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-xray.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up AWS X-Ray with API Gateway REST APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enabling-xray.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW14" name="Enable APIs CloudWatch Logs" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have AWS CloudWatch logging enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To set up CloudWatch API logging, you must have deployed the API to a stage. You must also have configured an appropriate CloudWatch Logs role ARN for your account. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a REST API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Settings from the primary navigation panel and enter an ARN of an IAM role with appropriate permissions in CloudWatch log role ARN. You need to do this once. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Do one of the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create an API and deploy it to a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Logs/Tracing in the Stage Editor. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable execution logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable CloudWatch Logs under CloudWatch Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Error or Info from the dropdown menu. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If desired, choose Enable Detailed CloudWatch Metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For more information about CloudWatch metrics, see Monitoring REST API execution with Amazon CloudWatch metrics. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable access logging: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Enable Access Logging under Custom Access Logging. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter the ARN of a log group in Access Log Destination ARN. The ARN format is arn:aws:logs:{region}:{account-id}:log-group:log-group-name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enter a log format in Log Format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can enable execution logging and access logging independent of each other. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway is now ready to log requests to your API. You don't need to redeploy the API when you update the stage settings, logs, or stage variables. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up CloudWatch logging for a REST API in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test your logging setup&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Send a new request to your API using your client application or a tool such as the Postman app or wscat (for WebSocket APIs). 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the CloudWatch console, in the left navigation pane, under Logs, choose Log Groups. 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the list of Log Groups, choose the log group of the API that you're debugging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a REST API, the log group's name is in this format: API-Gateway-Execution-Logs_apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  For a WebSocket API, the log group's name is in this format: /aws/apigateway/apiId/stageName. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: The access logs are located in the log group whose ARN you specified when you enabled access logging. 
+&lt;/div&gt; 
+&lt;div&gt;
+  4. In the list of Log Streams, choose the logs stream with the latest Last Event Time to see messages with the execution or access details of your request. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="How do I enable CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?" url="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cloudwatch-logs/"/>
+              <reference name="View API Gateway log events in the CloudWatch console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/view-cloudwatch-log-events-in-cloudwatch-console.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW15" name="Enable APIs CloudWatch Metrics" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Monitor REST API execution with Amazon CloudWatch metrics 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can monitor API execution by using CloudWatch, which collects and processes raw data from API Gateway into readable, near-real-time metrics. These statistics are recorded for a period of 15 months so you can access historical information and gain a better perspective on how your web application or service is performing. By default, API Gateway metric data is automatically sent to CloudWatch in one-minute periods.The metrics reported by API Gateway provide information that you can analyze in different ways. The following list shows some common uses for the metrics that are suggestions to get you started: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the IntegrationLatency metrics to measure the responsiveness of the backend. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the Latency metrics to measure the overall responsiveness of your API calls. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Monitor the CacheHitCount and CacheMissCount metrics to optimize cache capacities to achieve a desired performance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can access CloudWatch using any of the following methods: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Amazon CloudWatch console 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS CLI&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  CloudWatch API 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS SDKs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that detailed CloudWatch metrics are enabled for all APIs created with AWS API Gateway service. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Monitoring REST API execution with Amazon CloudWatch metrics" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can use the API dashboard in the API Gateway Console to display the CloudWatch metrics of your deployed API in API Gateway. These are shown as a summary of API activity over time. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Examine API activities in the dashboard&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose the name of the API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. Under the selected API, choose Dashboard. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. To display a summary of API activity over time, for Stage, choose the desired stage. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Use From and To to enter the date range. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   6. Refresh, if needed, and view individual metrics displayed in separate graphs titled API Calls, Integration Latency, Latency, 4xx Error and 5xx Error. The CacheHitCount and CacheMissCount graphs will be displayed only if API caching has been enabled. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="View CloudWatch metrics with the API dashboard in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-dashboard.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.9" name="Enable AWS Config across all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS Config tracks configuration changes to resources as they occur and is therefore a good
+                        source of identifying whether unintentional or malicious changes have occurred to resources with
+                        the AWS account.
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;br /&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions).&lt;/li&gt;
+                        &lt;li&gt;Select Config from the services menu.&lt;/li&gt;
+                        &lt;li&gt;Define which resources you want to record in the selected region.&lt;/li&gt;
+                        &lt;li&gt;Choose to include global resources (IAM resources).&lt;/li&gt;
+                        &lt;li&gt;Specify an S3 bucket.&lt;/li&gt;
+                        &lt;li&gt;Create an SNS Topic&amp;nbsp;&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;br /&gt;&amp;nbsp;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="12.10.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with Config update permissions)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Select Config from the services menu&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;If presented with Setup AWS Config follow the procedure highlighted in the
+                            remediation section&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;On the Resource inventory page, Click on &amp;quot;edit&amp;quot;&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure 1 or both check-boxes under &amp;quot;All Resources&amp;quot; is checked.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Include global resources related to IAM resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;which needs to be enabled in 1 region only.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure the correct S3 bucket has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Ensure the correct SNS topic has been defined.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Repeat steps 2 to 7 for each region (you'll need to change region in the top right
+                            corner of the AWS management console to do this).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Logging-3.1" name="Enable Cloudtrail in all regions" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Cloudtrail records events of all API calls made within a AWS account. This enables security
+                        analysis, resource change tracking, and compliance auditing. Cloudtrail should be enabled in all
+                        regions, even if they are not being used, to identify unintended or accidental changes.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;:
+                        &lt;br /&gt;Create a global trail using a previously created S3 bucket:
+                        &lt;br /&gt;
+                        &lt;blockquote&gt;
+                        aws cloudtrail create-trail --name &amp;lt;trail_name&amp;gt; --s3-bucket-name &amp;lt;s3-bucket-name&amp;gt;
+                        --is-multi-region-trail
+                        &lt;/blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.5" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.6" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.1.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="10.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws cloudtrail describe-trails&lt;/li&gt;
+                            &lt;li&gt;Ensure &amp;quot;IsMultiRegionTrail&amp;quot; = TRUE&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW6" name="Enable Content Encoding for API Responses" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure APIs created with Amazon API Gateway have Content Encoding feature enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content encoding allows API clients to request content to be compressed before being sent back in the response to an API request. This reduces the amount of data that is sent from API Gateway to API clients and decreases the time it takes to transfer the data. You can enable content encoding in the API definition. You can also set the minimum response size that triggers compression. By default, APIs do not have content encoding support enabled.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable payload compression by using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose an existing API or create a new one. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the primary navigation pane, choose Settings under the API you chose or the one you created. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under the Content Encoding section in the Settings pane, select the Content Encoding enabled option to enable payload compression. Enter a number for the minimum compression size (in bytes) next to Minimum body size required for compression. To disable the compression, clear the Content Encoding enabled option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Another way is to use AWS CLI to create a new API and enable compression. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The compression types supported by Amazon API Gateway service are gzip, deflate and identity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that Content Encoding enable option is selected into the API Gateway console. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you want the compression applied on a payload of any size, set the minimumCompressionSize value to zero. However, compressing data of a small size might actually increase the final data size. Furthermore, compression in API Gateway and decompression in the client might increase overall latency and require more computing times. You should run test cases against your API to determine an optimal value. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Test a method with the API Gateway console&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   1. Sign in to the API Gateway console. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   2. Choose a REST API. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   3. In the Resources pane, choose the method you want to test. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   4. In the Method Execution pane, in the Client box, choose TEST. Type values in any of the displayed boxes (such as Query Strings, Headers, and Request Body). The console includes these values in the method request in default application/json form. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   For additional options you may need to specify, contact the API owner. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   5. Choose Test. The following information will be displayed: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request is the resource's path that was called for the method.&lt;/li&gt; 
+   &lt;li&gt;Status is the response's HTTP status code.&lt;/li&gt; 
+   &lt;li&gt;Latency is the time between the receipt of the request from the caller and the returned response.&lt;/li&gt; 
+   &lt;li&gt;Response Body is the HTTP response body.&lt;/li&gt; 
+   &lt;li&gt;Response Headers are the HTTP response headers.&lt;/li&gt; 
+   &lt;li&gt;Logs are the simulated Amazon CloudWatch Logs entries that would have been written if this method were called outside of the API Gateway console.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enable payload compression for an API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html"/>
+              <reference name="Use the API Gateway console to test a REST API method" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW11" name="Enable data encryption at rest in AWS API Gateway" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If you choose to enable caching for a REST API, you can enable cache encryption. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you anticipate that a method that you are caching will receive sensitive data in its responses, in Cache Settings, choose Encrypt cache data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To configure API caching for individual methods using the console: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Go to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stages list for the API, expand the stage and choose a method in the API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Override for this method in Settings. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Cache Settings area, you can set or clear Enable Method Cache or customize any other desired options. (This section is shown only if stage-level caching is enabled.) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Data encryption in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/data-protection-encryption.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Ensure that in Cache Settings, "Encrypt cache data" option is enabled into the API Gateway console. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="Enabling API caching to enhance responsiveness" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.4" name="Enable MFA for IAM console users" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for all console login accounts is to use MFA to increase the level of security of the login process. 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+   &lt;b&gt;Remediation:&lt;/b&gt; 
+   &lt;br&gt; 
+   &lt;ol&gt; 
+    &lt;li&gt;Login to the AWS Management Console as an administrator.&lt;/li&gt; 
+    &lt;li&gt;Select IAM.&lt;/li&gt; 
+    &lt;li&gt;Select Users.&lt;/li&gt; 
+    &lt;li&gt;For each user:&lt;/li&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Select the user.&lt;/li&gt; 
+     &lt;li&gt;Under "Sign-In Credentials" if "Password" is set to "Yes".&lt;/li&gt; 
+     &lt;li&gt;Select "Manage MFA Device".&lt;/li&gt; 
+     &lt;li&gt;Choose the type of MFA.&lt;/li&gt; 
+     &lt;li&gt;Either scan the code or enter your device secret key.&lt;/li&gt; 
+     &lt;li&gt;Enter the Authentication code in "Authentication Code 1" box.&lt;/li&gt; 
+     &lt;li&gt;Wait for the code to change and enter the next code in "Authentication Code 2" box.&lt;/li&gt; 
+     &lt;li&gt;Click Activate MFA.&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/ol&gt;
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Generate a credential report with the command: aws iam generate-credential-report&lt;/li&gt;
+                            &lt;li&gt;The following command displays a list of all IAM users along with their password
+                            and MFA status: aws iam get-credential-report --output text | base64 -D | cut - d, -f1,4,8&lt;/li&gt;
+                            &lt;li&gt;For any column having password_enabled set to true ensure mfa_active is also set
+                            to true.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-IAM-2.2" name="Enable MFA for root accounts" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Root is highly privileged and therefore using a multi-factor authentication (MFA) device enhances the security of the login process. With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their username and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device. The recommendation for the root account is to use a hardware based device as it has a smaller attack surface and cannot be duplicated. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console as root.&lt;/li&gt; 
+  &lt;li&gt;Select "Dashboard" and under "Security Status" choose "Activate MFA" on your root account.&lt;/li&gt; 
+  &lt;li&gt;Select Activate MFA".&lt;/li&gt; 
+  &lt;li&gt;In the wizard, choose "A hardware MFA" device and then select Next Step.&lt;/li&gt; 
+  &lt;li&gt;In the Serial Number box, enter the serial number that is found on the back of the MFA device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;In the Authentication Code 1 box, enter the six-digit number displayed by the MFA device.&lt;/li&gt; 
+  &lt;li&gt;Wait until the device refreshes the code, and then enter the next six-digit number into the Authentication Code 2 box.&lt;/li&gt; 
+  &lt;li&gt;Select "Next Step".&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;The MFA device is now associated with the AWS account.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; 
+ &lt;br&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="1.6" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="8.4.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Run: aws iam get-account-summary&lt;/li&gt;
+                            &lt;li&gt;Ensure the AccountMFAEnabled property is 1.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW8" name="Enable request validation in API Gateway" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Enable request validation in API Gateway 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway can be configured to perform basic validation of an API request before proceeding with the integration request. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs. This reduces unnecessary calls to the backend. More importantly, it lets you focus on the validation efforts specific to your application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can set up request validators in an API's OpenAPI definition file and then import the OpenAPI definitions into API Gateway. You can also set them up in the API Gateway console or by calling the API Gateway REST API, the AWS CLI, or one of the AWS SDKs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Enable Request Validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html"/>
+            <reference name="Set up basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-set-up.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Test basic request validation using the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The following steps describe how to test basic request validation in the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To test the request validation on a method using TestInvoke in the API Gateway console 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  While signed in to the API Gateway console, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Resources for the API that you've configured a request validators map for. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose a method for which you have enabled the request validation with a specified request validator. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Method Execution, in the Client box, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Try different values for required request parameter or applicable body, and then choose Test to see the response. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When the method call passes validation, you should get expected responses. If validation fails, the following error message returns if the payload is not the correct format: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Invalid request body" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the request parameters aren't valid, the following error message returns: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "message": "Missing required request parameters: [p1]" 
+&lt;/div&gt; 
+&lt;div&gt;
+  } 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="Test basic request validation in API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-test.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW17" name="Review the use of stars in Lambda Authorizer's policyDocument objects" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;These are a few of our recommendations in decreasing order of priority to ensure your serverless APIs in AWS are not vulnerable to the problems described in this blog post:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the use of stars in the&amp;nbsp;&lt;i&gt;policyDocument&amp;nbsp;&lt;/i&gt;object. The rule of thumb is that if a star is used at all at the last part of the ARN, it should be in the form of a "/*" at the very end of the resource string (i.e.: "arn:aws:execute-api:us-west-1:12345678:myApiId/test/GET/foo/bar/*"). You can obtain the API ID, stage name and HTTP method dynamically from the input provided to the lambda authorizer. Create one resource string in the policy for each allowed HTTP method.&lt;/li&gt;&lt;li&gt;Consider adding Deny statements that help limit the impact or scope of star expansions on the&amp;nbsp;&lt;i&gt;policyDocument.&amp;nbsp;&lt;/i&gt;Remember that AWS IAM always gives precedence to Deny over Allow if multiple statements match an operation.&lt;/li&gt;&lt;li&gt;Whenever feasible, use defense in depth and check again that the user is authorized to call an endpoint in the lambda that implements it. Don't rely on the lambda authorizer policy as your only method of authorization unless you are sure you can do it securely.&lt;/li&gt;&lt;li&gt;Make sure any code imported from the previous version of the lambda authorizer blueprints is updated to the latest version.&lt;/li&gt;&lt;li&gt;If you use URL path parameters in your APIs, avoid cases where the valid values expected to be submitted to them can be chosen by potential attackers. Prefer backend-generated IDs instead of user-chosen names for entities, for example.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion" url="https://www.tenchisecurity.com/blog/thefaultinourstars"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Imagine an API that needs to allow a user to access any HTTP verb on a single endpoint "/business/op". The developer might be tempted to write the &lt;i&gt;policyDocument&lt;/i&gt; as follows: "arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/*/business/op"&lt;/p&gt;&lt;p&gt;All of the following ARNs would be allowed by the example policy. But item 6 most likely would not be expected by a developer that read this part of the documentation.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PATCH/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/DELETE/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/PUT/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/POST/business/op&lt;/li&gt;&lt;li&gt;arn:aws:execute-api:us-west-1:12345678:myApiId/myStage/GET/foo/bar/business/op&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So having the HTTP verb as a star makes it so that the endpoint resource is no longer anchored to the beginning of the URL path.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW4" name="Rotate Expiring SSL Client Certificates" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Ensure that SSL certificates associated with API Gateway REST APIs are rotated periodically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  The client certificate generated by API Gateway is valid for 365 days. You must rotate the certificate before a client certificate on an API stage expires to avoid any downtime for the API. You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Generate a new client certificate by calling clientcertificate:generate of the API Gateway REST API or the AWS CLI command of generate-client-certificate. In this tutorial, we assume that the new client certificate ID is ndiqef. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to include the new client certificate. Don't remove the existing client certificate yet. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some servers might require a restart to finish the update. Consult the server documentation to see if you must restart the server during the update. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the API stage to use the new client certificate by calling stage:update of the API Gateway REST API, with the new client certificate ID (ndiqef): 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  PATCH /restapis/{restapi-id}/stages/stage1 HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Content-Type: application/json 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: apigateway.us-east-1.amazonaws.com 
+&lt;/div&gt; 
+&lt;div&gt;
+  X-Amz-Date: 20170603T200400Z 
+&lt;/div&gt; 
+&lt;div&gt;
+  Authorization: AWS4-HMAC-SHA256 Credential=... 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; "patchOperations" : [ 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; { 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "op" : "replace", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "path" : "/clientCertificateId", 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; "value" : "ndiqef" 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; &amp;nbsp; } 
+&lt;/div&gt; 
+&lt;div&gt;
+  &amp;nbsp; ] 
+&lt;/div&gt; 
+&lt;div&gt;
+  }&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of update-stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update the backend server to remove the old certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Delete the old certificate from API Gateway by calling the clientcertificate:delete of the API Gateway REST API, specifying the clientCertificateId (a1b2c3) of the old certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  DELETE /clientcertificates/a1b2c3&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt;
+  or by calling the CLI command of delete-client-certificate: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  aws apigateway delete-client-certificate --client-certificate-id a1b2c3 
+&lt;/div&gt; 
+&lt;div&gt;
+  To rotate a client certificate in the console for a previously deployed API, do the following: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the main navigation pane, choose Client Certificates. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Client Certificates pane, choose Generate Client Certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Open the API for which you want to use the client certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Stages under the selected API and then choose a stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  In the Stage Editor panel, select the new certificate under the Client Certificate section. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To save the settings, choose Save Changes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You need to redeploy the API for the changes to take effect. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>You can check the expiration date of certificate by calling clientCertificate:by-id of the API Gateway REST API or the AWS CLI command of get-client-certificate and inspecting the returned expirationDate property.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.909">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW13" name="Set up a stage for a REST API" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Set up a stage for a REST API 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Create a new stage 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  After the initial deployment, you can add more stages and associate them with existing deployments. You can use the API Gateway console to create a new stage, or you can choose an existing stage while deploying an API. In general, you can add a new stage to an API deployment before redeploying the API. To create a new stage using the API Gateway console, follow these steps:. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the API Gateway console at https://console.aws.amazon.com/apigateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the APIs navigation pane, choose Stages under an API. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Stages navigation pane, choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Under Create Stage, enter a stage name, for example, prod, for Stage name. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Stage names can only contain alphanumeric characters, hyphens, and underscores. Maximum length is 128 characters. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Optionally, enter a stage description for Stage description. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  From the Deployment drop-down list, choose the date and time of the existing API deployment you want to associate with this stage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Choose Create. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Setting up a stage for a REST API" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  To see your Stages follow the steps below: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Sign in to the API Gateway console. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. In the APIs pane, choose the API, and then choose Stages. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  3. In the Stages pane, choose the name of the stage. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
+              <output/>
+            </source>
+            <references>
+              <reference name="Setting up a stage using the API Gateway console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW2" name="Use AWS Secrets Manager to securely rotate, manage, and retrieve database credentials, API keys, and other secrets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Securely rotate, manage, and retrieve database credentials, API keys, and other secrets. AWS recommends to use AWS Secrets Manager for this purpose. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Using Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  To get started with AWS Secrets Manager: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Identify your secrets and locate where they are used in your applications. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Sign in to the AWS Management Console using your AWS credentials and navigate to the Secrets Manager console. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Use the Secrets Manager console to upload the secret you identified. Alternatively, you can use the AWS SDK or AWS CLI to upload a secret (once per secret). You can also write a script to upload multiple secrets. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If your secret is not in use yet, follow the instructions on the console to configure automatic rotation. If applications are using your secret, complete steps (5) and (6) before configuring automatic rotation. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If other users or applications need to retrieve the secret, write an IAM policy to grant permissions to the secret. 
+&lt;/div&gt; 
+&lt;div&gt;
+  Update your applications to retrieve secrets from Secrets Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Secrets Manager" url="https://aws.amazon.com/secrets-manager/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How do I know when AWS Secrets Manager rotates a database credential?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can configure Amazon CloudWatch Events to receive a notification when AWS Secrets Manager rotates a secret. You can also see when Secrets Manager last rotated a secret using the Secrets Manager console or APIs. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.346">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Secrets Manager FAQs" url="https://aws.amazon.com/secrets-manager/faqs/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW9" name="Use AWS Shield for DDoS protection" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS Shield for protection against most common DDoS attacks, and access to tools and best practices to build a DDoS resilient architecture. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your web site or applications. When you use AWS Shield Standard with Amazon CloudFront and Amazon Route 53, you receive comprehensive availability protection against all known infrastructure (Layer 3 and 4) attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Amazon Route 53 charges. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Shield Advanced is available globally on all Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 edge locations. You can protect your web applications hosted anywhere in the world by deploying Amazon CloudFront in front of your application. Your origin servers can be Amazon S3, Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), or a custom server outside of AWS. You can also enable AWS Shield Advanced directly on an Elastic IP or Elastic Load Balancing (ELB) in the following AWS Regions - Northern Virginia, Ohio, Oregon, Northern California, Montreal, Sao Paulo, Ireland, Frankfurt, London, Paris, Stockholm, Singapore, Tokyo, Sydney, Seoul, and Mumbai. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Enable AWS Shield. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Shield Managed DDoS protection" url="https://aws.amazon.com/shield/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;How can I test AWS Shield?&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS Acceptable Use Policy describes permitted and prohibited behavior on AWS, and it includes descriptions of prohibited security violations and network abuse. However, because penetration testing and other simulated events are frequently indistinguishable from these activities, AWS has established a policy for customers to request permission to conduct penetration tests and vulnerability scans to or originating from the AWS environment. Visit AWS Penetration testing page to request permissions (see link in References). 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
+              <output/>
+            </source>
+            <references>
+              <reference name="AWS Shield FAQs" url="https://aws.amazon.com/shield/faqs/"/>
+              <reference name="Penetration Testing - Test the AWS environment against defined security standards" url="https://aws.amazon.com/security/penetration-testing/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-Network-5.1" name="Use AWS VPC for networking" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>AWS virtual private cloud is the de-facto standard for networking AWS as it provides additional security controls such as Security Groups, Network Access Control Lists (NACL's) and routing. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  However the use of VPC is not compulsory and resources such as EC2 can be created outside of VPC (usingEC2 Classic). It is the recommendation to make all resources a member of a VPC if possible to benefit from the increased security controls they offer and reduce undue network exposure.&amp;nbsp; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt; 
+  &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;Move or migrate the resources to a VPC. 
+ &lt;/div&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that each AWS resource you own that is able to exist in a VPC does so.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW10" name="Use AWS WAF to protect APIs" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use AWS WAF to protect Amazon API Gateway APIs from common web exploits. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that AWS Web Application Firewall (WAF) is integrated with Amazon API Gateway to protect your APIs from common web exploits such as SQL injection attacks, cross-site scripting (XSS) attacks and Cross-Site Request Forgery (CSRF) attacks that could affect API availability and performance, compromise API data security or consume excessive resources. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using AWS WAF to protect your APIs" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>To ensure that you don't accidentally configure AWS WAF to block web requests that you want to allow or allow requests that you want to block, AWS recommends that you test your web ACL thoroughly before you start using it on your website or web application. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can do this by: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Counting the web requests that match the rules in a web ACL&amp;nbsp;in an Amazon CloudWatch graph.&lt;/li&gt; 
+  &lt;li&gt;Viewing a sample of web requests in the AWS WAF console.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing web ACLs" url="https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-API-GW3" name="Use client-side SSL certificates for HTTP backend authentication" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use client-side SSL certificates for HTTP backend authentication within AWS API Gateway. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Rationale: 
+&lt;/div&gt; 
+&lt;div&gt;
+  Client-side SSL certificates can be used to verify that HTTP requests to your backend system are from API Gateway. It is strongly recommended to use client-side SSL certificates to verify the requester's authenticity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Remediation: 
+&lt;/div&gt; 
+&lt;div&gt;
+  You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some backend servers might not support SSL client authentication as API Gateway does and could return an SSL certificate error. For a list of incompatible backend servers, see Amazon API Gateway important notes. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: 
+&lt;/div&gt; 
+&lt;div&gt;
+  None 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Generate and configure an SSL certificate for backend authentication" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt; 
+ &lt;b&gt;Test invoke to verify the client certificate configuration&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  1. Choose an API method. In Client, choose Test. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  2. From Client Certificate, choose Test to invoke the method request. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  API Gateway presents the chosen SSL certificate for the HTTP backend to authenticate the API. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.910">
+              <output/>
+            </source>
+            <references>
+              <reference name="Rotate an expiring client certificate" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.1-1.2-1.3" name="Use the principle of least privilege on key ownership and usage" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&amp;nbsp;&lt;br&gt;AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK. You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).Customer created CMKs can be used for:&amp;nbsp;&lt;br&gt;- AWS Service level encryption(e.g. EBS, RDS, S3).&amp;nbsp;&lt;br&gt;- Key management for file/application level encryption.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Rationale&lt;/strong&gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Ensures principle of least privilege on key ownership and usage.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;Using the Amazon unified command line interface:&amp;nbsp;&lt;br&gt;- If there is no alias listed for Web tier, create a new KMS key and note the "KeyId" element:&lt;/p&gt; 
+&lt;p&gt;aws kms create-key&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;- Create an alias for the Web tier key using the above KeyId:&amp;nbsp;&lt;br&gt;aws kms create-alias --alias-name &amp;lt;tier_kms_alias&amp;gt; --target-key-id &amp;lt;tier_kms_key&amp;gt;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS CLI Command Reference:create-alias" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html"/>
+            <reference name="AWS CLI Command Reference:create-key" url="https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html"/>
+            <reference name="AWS CLI Command Reference:list-aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Run the following command via the Amazon unified command line interface to determine if a web-tier KMS key exists: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  aws kms list-aliases --query 'Aliases[?AliasName == '&amp;lt;web_tier_kms_alias&amp;gt;']' 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;If such a key exists, an AliasArnproperty will be displayed in the output.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T13:48:54.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication" name="Authentication" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW17" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW1" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.10" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW2" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-ROOT" name="Attackers gain unauthorized access to the root account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                Attackers could gain unauthorized access to the administrator account due to the lack of
+                                the account and its security mechanisms, like modifying credentials and adding/removing
+                                user accounts.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.1">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.1" mitigation="33"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.2" mitigation="34"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.3" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOST-ACCESS-USER" name="Attackers gain unauthorized access to the user account due to the lack of configuration of the account" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the user account due to a lack of configuration of the account, such as an incorrect configuration of the security question to reset the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.6">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-IAM-2.8">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-IAM-2.4" mitigation="50"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.6" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-ENCRYPTION-KEYS" name="Attackers obtain access to encryption keys and are able to decrypt ciphertext" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Cryptography is intrinsically related to the secure management of cryptographic keys which need to be protected and securely stored by applications. Leaking cryptographic keys diminishes any advantage of cryptography, allowing attackers to break message confidentiality and integrity, and to authenticate as legitimate users or impersonate legitimate services.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-1.1-1.2-1.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW13" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                    <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-Logging-3.1" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Logging-3.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Monitoring-4.9" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-Network-5.1" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-522">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW11" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW12" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW2" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                    <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW14" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW15" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW16" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                    <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW3" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW4" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW6" mitigation="25"/>
+                <countermeasure ref="AWS-API-GW7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-248" name="An attacker injects new items into an existing command to execute a command of their choosing" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-77">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                    <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-API-GW10" mitigation="33"/>
+                <countermeasure ref="AWS-API-GW5" mitigation="34"/>
+                <countermeasure ref="AWS-API-GW9" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="e4d3929a-d4a5-4161-ba39-a0ee4e7deff4" diagramComponentId="02532cf7-ee4c-45fd-ac72-8d049dbcb2d0" ref="6f23541b-1557-4ab6-8c6a-1ebee42a5fbe" name="AWS ELB (Elastic Load Balancer)" desc="" library="" parentComponentRef="" componentDefinitionRef="load-balancer">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-295" name="Improper Certificate Validation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not validate, or incorrectly validates, a certificate.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-295: Improper Certificate Validation" url="https://cwe.mitre.org/data/definitions/295.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.1" name="Insufficient resource identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and/or additional unidentified resources exist. As such, additional weakness might be introduced.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Logging-3.4" name="Non-auditable actions in the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>The actions in the resources are not audited and not recorded in the logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.058">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.056">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-NET-01" name="Unauthorized connection attempts are allowed on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Receiving unauthorized connections to open ports makes systems vulnerable to attacks. To avoid this, access to network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="unknown-resource-status" name="Unknown resource status" state="0" impact="100" issueId="" issueLink="">
+          <desc>We do not have our resources current status and as a result lose control of some resources,
+                        for example, we may believe these resources are inactive when in fact the status has changed and we are unaware.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.057">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="aws-tier-1.12" name="Add SSL/TLS Certificate to App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;br&gt; 
+&lt;br&gt; The SSL\TLS protocol uses an X.509 certificate (SSL\TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;br&gt; 
+&lt;br&gt; You can create a certificate using a Third Party Certificate Authority, AWS Certificate Manager or a self signed certificate like OpenSSL. 
+&lt;br&gt; 
+&lt;br&gt; Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;br&gt; 
+&lt;br&gt; All the application traffic between the Web Tier instances and the App Tier ELB nodes should be encrypted using an SSL\TLS certificate. 
+&lt;br&gt; 
+&lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;br&gt; 
+&lt;br&gt; Using the Amazon unified command line interface: 
+&lt;ul&gt; 
+ &lt;li&gt;Adding a HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80): &lt;br&gt; 
+  &lt;blockquote&gt;
+    aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+  &lt;/blockquote&gt; &lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.12" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions is empty, the ELB does not have a listener configured with a SSL\TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.9" name="Add SSL/TLS Certificate to Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  All the application traffic between the clients and the Web Tier ELB nodes should be encrypted using a SSL/TLS certificate. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Adding a HTTPS listener configured with a SSL/TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB add/delete listeners" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-add-or-delete-listeners.html#add-listener-cli"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Note that if the ListenerDescriptions element is empty, the ELB does not have a listener configured with a SSL/TLS certificate, or a TCP listener (TCP pass-through):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.SSLCertificateId != null ||&amp;nbsp; Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.13" name="Allow connectivity to the VPC Internet Gateway (IGW) and associate the Routing Table with Web tier ELB subnet (by default route (0.0.0.0/0))" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The default route (0.0.0.0/0) should be pointing to the Internet Gateway in order to provide internet connectivity for the Web tier ELB. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) exists but it doesn't have an IGW configured as gateway:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 replace-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For the above route tables, if the default route (0.0.0.0/0) doesn't exist:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 create-route --route-table-id &amp;lt;route_table_id&amp;gt; --destination-cidr-block 0.0.0.0/0 --gateway-id &amp;lt;vpc_igw&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: EC2 replace route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/replace-route.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create route" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-route.html"/>
+            <reference name="Describe route tables" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-route-tables.html"/>
+          </references>
+          <standards>
+            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the routes of the route tables associated with the above subnets, and check if the default route (0.0.0.0/0) has an IGW configured as gateway:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=&amp;lt;web_tier_elb_subnet1&amp;gt;,&amp;lt;web_tier_elb_subnet2&amp;gt; --query &amp;quot;RouteTables[*].{RouteTableId:RouteTableId, Routes:Routes}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.15" name="Associate App Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --scheme internal --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;app_tier_subnet1&amp;gt; &amp;lt;app_tier_subnet2&amp;gt; --security-groups &amp;lt;app_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;app_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.1" name="Associate each Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;elb_name&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;application_subnet&amp;gt; --security-groups &amp;lt;application_security_groups&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;elb_name&amp;gt; --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.14" name="Associate Web Tier Auto-Scaling Group to ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  It enables greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic across 1 or more Availability Zones within a VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing must be integrated with Auto Scaling Groups to ensure that you have availability of compute resources in the event of a failure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Integrating Auto Scaling Groups with an Elastic Load Balancer will help provide high availability and back-end EC2 instance scaling. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Through Auto-Scaling Group configuration you can define: 
+  minimum / maximum number of EC2 instances to be launched by the Auto-Scaling Group 
+  Availability Zones / subnets used 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;List existing load balancers:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName}' 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   or 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new load balancer:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners &amp;lt;listener_config&amp;gt; --subnets &amp;lt;web_tier_elb_subnet1&amp;gt; &amp;lt;web_tier_elb_subnet2&amp;gt; --security-groups &amp;lt;web_tier_elb_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Attached load balancer from previous steps to autoscaling group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling attach-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: attach load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/attach-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe autoscaling load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify Autoscaling Group Name and associated ELB name:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-auto-scaling-groups&amp;nbsp; --query 'AutoScalingGroups[*].{ELB:LoadBalancerNames, ASGName:AutoScalingGroupName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify current status of the ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-load-balancers --auto-scaling-group-name &amp;lt;web_tier_autoscaling_group_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-ELB1" name="Configure ALB to redirect all HTTP requests to HTTPS" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Before you start to use your Application Load Balancer, you must add one or more listeners. A listener is a process that uses the configured protocol and port to check for connection requests. Listeners support both the HTTP and HTTPS protocols. You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer. To enforce encryption in transit, you should use redirect actions with Application Load Balancers to redirect client HTTP requests to an HTTPS request on port 443.&lt;/p&gt;&lt;p&gt;If you use Application Load Balancers with an HTTP listener, ensure that the listener is redirected to HTTPS for any nonconsole administrative access. Allowing unencrypted authentication over HTTP for administrators of the cardholder data environment might violate the requirement to encrypt all nonconsole administrative access using strong cryptography.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;To remediate this issue, you redirect HTTP request to HTTPS.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;To redirect HTTP requests to HTTPS on an Application Load Balancer&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.&lt;/li&gt;&lt;li&gt;In the navigation pane, under &lt;strong&gt;Load Balancing&lt;/strong&gt;, choose &lt;strong&gt;Load balancers&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose an Application Load Balancer.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Listeners&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Select the check box for an HTTP listener (port 80 TCP) and then choose &lt;strong&gt;Edit&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;If there is an existing rule, you must delete it. Otherwise, choose &lt;strong&gt;Add action&lt;/strong&gt; and then choose &lt;strong&gt;Redirect to...&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;HTTPS&lt;/strong&gt; and then enter &lt;strong&gt;443&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose the check mark in a circle symbol and then choose &lt;strong&gt;Update&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.7" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.302">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.10" name="Configure Health Check for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempts connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensures availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify App tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB healthchecks" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-healthchecks.html"/>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.9" name="Configure Health Check for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  By default, an Auto-Scaling Group periodically uses the results of the EC2 instance status checks to determine the health status of each instance. If an instance fails the EC2 instance status checks, Auto-Scaling marks the instance as unhealthy and replaces the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  However, if you have attached one or more Elastic Load Balancing (ELB) load balancers to your Auto-Scaling Group and the instance fails the ELB health checks, Auto-Scaling does not replace the instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon ELB will periodically sends pings, attempt connections, or sends requests to test the EC2 instances, these tests are called health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of the instances that are healthy at the time of the health check is InService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The status of any instances that are unhealthy at the time of the health check is OutOfService. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  The load balancer performs health checks on all registered instances, whether the instance is in a healthy state or an unhealthy state. The load balancer routes requests only to the healthy instances. When the load balancer determines that an instance is unhealthy, it stops routing requests to that instance. The load balancer resumes routing requests to the instance when it has been restored to a healthy state 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Ensure availability of back-end EC2 instances associated with an Amazon ELB through application layer health check (ex: http) instead of TCP health checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ELBhealthcheck.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Target": "&amp;lt;string&amp;gt;", 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Interval": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "Timeout": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "UnhealthyThreshold": &amp;lt;integer&amp;gt;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; "HealthyThreshold": &amp;lt;integer&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify Web tier ELB to include appropriate health check:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb configure-health-check --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --health-check file:///tmp/ELBhealthcheck.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: configure health check" url="https://docs.aws.amazon.com/cli/latest/reference/elb/configure-health-check.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Describe autoscaling groups" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-auto-scaling-groups.html"/>
+          </references>
+          <standards>
+            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.9" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Identify if health check is in place on the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query 'LoadBalancerDescriptions[*].{ELBName:LoadBalancerName,HealthCheck:HealthCheck}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.13" name="Configure the latest SSL Security Policies for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div style=""&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;(Note that you should replace &amp;lt;app\_tier\_elb&amp;gt; with your App-tier ELB name, and &amp;lt;latest\_ssl\_policy&amp;gt; with the proper policy name)&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.10" name="Configure the latest SSL Security Policies for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a security policy, to negotiate SSL/TLS connections between a client and the load balancer. A security policy is a combination of SSL/TLS protocols, ciphers, and the Server Order Preference option. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Elastic Load Balancing supports configuring your load balancer to use either predefined or custom security policies. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In the Elastic Load Balancing documentation, we refer to both SSL and TLS protocols as the SSL protocol. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an SSL certificate configured on the ELB and an SSL Security Policy is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Making sure the latest ELB SSL Security Policy is used will ensure the SSL/TLS connection will be negotiated using only the appropriate cryptographic protocols deemed safe with no proven vulnerabilities. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   (Note that you should replace &amp;lt;web\_tier\_elb&amp;gt; with your Web-tier ELB name, and _&amp;lt;latest\_ssl\_policy&amp;gt;_ with the proper policy name) 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;div style=""&gt;
+    aws elb set-load-balancer-policies-of-listener --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --load-balancer-port 443 --policy-names&amp;nbsp; &amp;lt;latest_ssl_policy&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener policy" url="https://aws.amazon.com/premiumsupport/knowledge-center/elb-listener-policy-cli/"/>
+            <reference name="Amazon docs: ELB security policy options" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html"/>
+            <reference name="Amazon docs: describe load balancer policies" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-policies.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: set load balancer policies of listener" url="https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html"/>
+          </references>
+          <standards>
+            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.10" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find all the SSL security policies associated with your load balancer listener:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-policies --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName,ReferenceSecurityPolicy:PolicyAttributeDescriptions[0].AttributeValue}' --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Find which of the above policies is currently active, and check on AWS documentation if it is the latest (note that for the TCP listeners the PolicyNames element will be empty, but the TCP listener is still compliant when using SSL certificates on the back-end EC2 instances):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{CompliantListeners:ListenerDescriptions[?Listener.SSLCertificateId != null || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.5" name="Create subnets for the Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        You can create a VPC that spans multiple Availability Zones. After creating a VPC, you can add
+                        one or more subnets in each Availability Zone. Each subnet must reside entirely within one
+                        Availability Zone and cannot span zones. Availability Zones are distinct locations that are
+                        engineered to be isolated from failures in other Availability Zones. By launching instances in
+                        separate Availability Zones, you can protect your applications from the failure of a single
+                        location. AWS assigns a unique ID to each subnet.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        When you create a subnet, you specify the CIDR block for the subnet. The CIDR block of a subnet
+                        shouldn't be the same as the CIDR block for the VPC (for a single subnet in the VPC). The
+                        allowed block size is between a /28 netmask and /16 netmask. If you create more than one subnet
+                        in a VPC, the CIDR blocks of the subnets must not overlap.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Some AWS regions have more than 2 availability zones and it is recommended to use more than 2
+                        where possible.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        At least 2 subnets in 2 different availability zones (AZ) should be created in order to have
+                        fault tolerance and high availability from the perspective of resource deployment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create subnets for Web tier ELB, and note the subnet id:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-subnet --vpc-id application_vpc
+                        --cidr-block desired_cidr
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Tag the above subnets with the Web tier ELB tags:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 create-tags --resources web_tier_elb_subnet1
+                        web_tier_elb_subnet2 --tags Key=public_tier_tag,Value=public_tier_tag_value
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create subnet" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-subnet.html"/>
+            <reference name="Amazon docs: create tags" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html"/>
+            <reference name="Describe subnets" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-subnets.html"/>
+          </references>
+          <standards>
+            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].Subnets&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  OR 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the subnets created for the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-subnets --filters Name=tag:public_tier_tag,Values=public_tier_tag_value --query &amp;quot;Subnets[*].SubnetId&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.26" name="Create the App tier ELB as Internal" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  An internal load balancer routes traffic to your EC2 instances in private subnets using private IP addresses. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create an internal load balancer and register the database servers with it. The web servers receive requests from the Internet-facing load balancer and send requests for the database servers to the internal load balancer. The database servers receive requests from the internal load balancer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  When an internal load balancer is created, it receives a public DNS name with the following form: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   internal-name-123456789.region.elb.amazonaws.com 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  The DNS servers resolve the DNS name of your load balancer to the private IP addresses of the load balancer nodes for your internal load balancer. Each load balancer node is connected to the private IP addresses of the back-end instances that are in its Availability Zone using elastic network interfaces. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Creating the App tier ELB as internal will prevent access to the app tier from the Internet and will allow access from the Web tier instances. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new internal ELB for your App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer --load-balancer-name app_tier_elb --scheme internal --listeners listener_config --subnets app_tier_subnet1 app_tier_subnet2 --security-groups app_tier_elb_security_group 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Register App tier instances with the new App tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb register-instances-with-load-balancer --load-balancer-name app_tier_elb --instances &amp;lt;app_tier_instance1&amp;gt; &amp;lt;app_tier_instance2&amp;gt; &amp;lt;app_tier_instance3&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB internal load balancers" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internal-load-balancers.html"/>
+            <reference name="Amazon docs: create load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: register instances with load balancer" url="https://docs.aws.amazon.com/cli/latest/reference/elb/register-instances-with-load-balancer.html"/>
+          </references>
+          <standards>
+            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.26" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check the Scheme of your App tier ELB, and make sure it is &amp;quot;internal&amp;quot;:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, Scheme:Scheme}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.21" name="Create the App tier ELB Security Group to only accept HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The SG associated with the App tier ELB should allow connectivity from the security group
+                        associated with Web tier instances only for the HTTP (TCP 80) and HTTPS (TCP 443) ports.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The defaults for HTTP and HTTPS are used as an example, any other ports would apply depending on
+                        the application design.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the security group associated with the App tier
+                        ELB:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_elb_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_elb_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;create locally the below json file containing ingress rules for HTTP (TCP 80) and
+                        HTTPS (TCP 443) ports only from and name it IpPermissions.json:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; },
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [],
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; {
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserId&amp;quot;:
+                        &amp;quot;&amp;lt;&amp;lt;em&amp;gt;aws_account_number&amp;gt;&amp;lt;/em&amp;gt;&amp;quot;,
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;GroupId&amp;quot;:
+                        &amp;quot;&amp;lt;span style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;&amp;lt;&amp;lt;/span&amp;gt;&amp;lt;span
+                        style=&amp;quot;font-style: italic;&amp;quot;&amp;gt;web_tier_security_group&amp;lt;/span&amp;gt;&amp;gt;&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &amp;nbsp; &amp;nbsp; }
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        ]
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add to the security group associated with the App tier ELB the above ingress rules:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_elb_security_group&amp;nbsp;
+                        --ip-permissions file:///PathTo/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.21" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the App tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, AppTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table&amp;nbsp; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;AppTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from Web tier Security Group:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;app_tier_elb_security_group&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.22" name="Create the App tier Security Group to allow inbound connections from App tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        A security group acts as a virtual firewall for your instance to control inbound and outbound
+                        traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the
+                        instance to up to five security groups. Security groups act at the instance level, not the
+                        subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different
+                        set of security groups. If you don't specify a particular group at launch time, the instance is
+                        automatically assigned to the default security group for the VPC.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        For each security group, you add rules that control the inbound traffic to instances, and a
+                        separate set of rules that control the outbound traffic.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This is required for both the configured port and protocol for the listener on the back-end
+                        instance and the port and protocol used for the health check.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        This protects the App-server tier from unauthorized access, it is recommended to add inbound
+                        security group rules that allow traffic for the specific application protocol and ports by
+                        referencing as source the security group associated with the App tier ELB.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        Using the Amazon unified command line interface:
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;First remove all the ingress rules for the App tier security group (use the &amp;quot;AppTierSecurityGroup&amp;quot;
+                        element from Audit procedure):&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 describe-security-groups --group-id app_tier_security_group
+                        --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div style=""&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 revoke-security-group-ingress --group-id app_tier_security_group
+                        --ip-permissions file:///tmp/IpPermissions.json
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the
+                        App tier ELB security group as the source of the connections:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &lt;div style=""&gt;
+                        aws ec2 authorize-security-group-ingress --group-id app_tier_security_group
+                        --protocol tcp --port specific_port
+                        --source-group app_tier_elb_security_group
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.22" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List the ingress rules for the above security group, and make sure that allows
+                            connections only from App tier ELB security group on specific ports:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws ec2 describe-security-groups --filters Name=tag:app_tier_tag,Values=app_tier_tag_value
+                            --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions,
+                            AppTierSecurityGroup:GroupId}&amp;quot; --output table
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.19" name="Create the Web tier Security Group to allow inbound connections from Web tier ELB Security Group for explicit ports" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A security group acts as a virtual firewall for your instance to control inbound and 
+  outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance to up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. This is required for both the configured port and protocol for the listener on the back-end instance and the port and protocol used for the health check. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;First remove all the ingress rules for the Web tier security group (use the "WebTierSecurityGroup" element from Audit procedure):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-id &amp;lt;web_tier_security_group&amp;gt; --query "SecurityGroups[0].IpPermissions" &amp;gt; /tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 revoke-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; --ippermissions file:///tmp/IpPermissions.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Add an ingress rule for a specific port, using --source-group option to specify the Web tier ELB security group as the source of the connections:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 authorize-security-group-ingress --group-id &amp;lt;web_tier_security_group&amp;gt; -- protocol tcp --port &amp;lt;specific_port&amp;gt; --source-group &amp;lt;web_tier_elb_security_group&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: authorize security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/authorize-security-group-ingress.html"/>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe security groups" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html"/>
+            <reference name="Revoke security group ingress" url="https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html"/>
+          </references>
+          <standards>
+            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.19" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the Web tier security group, and make sure that allows connections only from Web tier ELB security group on specific ports:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --filters Name=tag:&amp;lt;web_tier_tag&amp;gt;,Values=&amp;lt;web_tier_tag_value&amp;gt; --query "SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions, WebTierSecurityGroup:GroupId}" --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-9" name="Deploy AWS WAF policies to protect the ALB" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;For additional layers of defense, you can deploy AWS WAF policies to protect the Application Load Balancer. Having edge policies, application policies, and even private or internal policy enforcement layers adds to the visibility of communication requests and provides unified policy enforcement. For more information, see the blog post Deploying defense in depth using AWS Managed Rules for AWS WAF.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+            <reference name="Deploying defense in depth using AWS Managed Rules for AWS WAF" url="https://aws.amazon.com/blogs/security/deploying-defense-in-depth-using-aws-managed-rules-for-aws-waf-part-2/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that AWS WAF is blocking potentially dangerous requests.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.18" name="Do not use Web tier ELB Security Group in the Auto Scaling launch configuration of any other tier (Web, App)" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  When you use the AWS Management Console to create a load balancer in a VPC, you can choose an existing security group for the VPC or create a new security group for the VPC. If you choose an existing security group, it must allow traffic in both directions to the listener and health check ports for the load balancer. If you choose to create a security group, the console automatically adds rules to allow all traffic on these ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer. When you delete your load balancer, this security group is not deleted automatically. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  If you add a listener to an existing load balancer, you must review your security groups to ensure they allow traffic on the new listener port in both directions. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The web-tier ELB is the only one that is public facing and should have rules to allow inbound traffic to the application ports (ex: HTTP and HTTPS) from any IP source (0.0.0.0/0). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The outbound security group rules for the web-tier ELB should be restricted to only the backend web-server instances for the appropriate application ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Associating the web-tier ELB security group to any other instances that shouldn't be publicly accessible exposes them to unauthorized access. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create new launch configuration using the correct security groups for Web and/or App tier:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws autoscaling create-launch-configuration --launch-configuration-name &amp;lt;web_tier_launch_config&amp;gt; --image-id &amp;lt;web_tier_ami&amp;gt; --key-name &amp;lt;your_key_pair&amp;gt; --security-groups &amp;lt;web_tier_security_group&amp;gt;/&amp;lt;app_tier_security_group --instance-type &amp;lt;desired_instance_type&amp;gt; --iam-instance-profile &amp;lt;web_tier_instance_profile&amp;gt;/&amp;lt;app_tier_instance_profile&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-launch-configurations.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Create launch configuration" url="https://docs.aws.amazon.com/cli/latest/reference/autoscaling/create-launch-configuration.html"/>
+          </references>
+          <standards>
+            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.18" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, WebTierELBSecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the &amp;quot;WebTierELBSecurityGroups&amp;quot; from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security groups associated with all Autoscaling launch configurations and make sure that the above Web tier ELB security group is not present:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws autoscaling describe-launch-configurations --query &amp;quot;LaunchConfigurations[*].{SecurityGroups:SecurityGroups, LaunchConfigurationName:LaunchConfigurationName}&amp;quot; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.2" name="Enable the ELB logging" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the a VPC. It enables you to achieve greater levels of fault tolerance in your applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  AWS Elastic Load Balancers (ELBs) can record all incoming requests sent to the load balancer and store within logs on S3. This allows for diagnosing application failures and analyzing web traffic and security analysis of incoming traffic 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a JSON file containing the attributes you want to modify and save it locally as /tmp/ElbLogs.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;quot;AccessLog&amp;quot;: { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;Enabled&amp;quot;: true, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketName&amp;quot;: &amp;quot;string&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;EmitInterval&amp;quot;: integer, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;quot;S3BucketPrefix&amp;quot;: &amp;quot;string&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the Load Balancer attributes:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb modify-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; --load-balancer-attributes file:///tmp/ElbLogs.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancer-attributes.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+            <reference name="Amazon docs: elb describe tags" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-tags.html"/>
+            <reference name="Amazon docs: enable access logs" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-access-logs.html"/>
+            <reference name="Amazon docs: modify load balancer attributes" url="https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html"/>
+          </references>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.2" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Via Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all ELB's:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --query 'LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Confirm correct ELB is selected by review ELB tags:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-tags --load-balancer-names &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Review selected ELB attributes and ensure Access Log is enabled:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancer-attributes --load-balancer-name &amp;lt;elb_name&amp;gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.15" name="Implement mechanism to check that Public Web Tier SSL\TLS certificates are &gt;30 days from expiration" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;Public SSL\TLS certificates that are used for AWS resources such as the ELB or CloudFront should always be renewed prior to expiration both as a security best practice and to ensure the reputation of the web application is not impacted by an expired certificate. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation&lt;/b&gt;: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Request a certificate renewal from your CA, and upload the new certificate in IAM:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     aws iam upload-server-certificate --server-certificate-name &amp;lt;ssl_certificate_name&amp;gt; --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For Amazon Certificate Manager users the renewal is managed by ACM service&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Describe certificate" url="https://docs.aws.amazon.com/cli/latest/reference/acm/describe-certificate.html"/>
+            <reference name="Id credentials server certs" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html"/>
+            <reference name="Id credentials server certs manage" url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs_manage.html"/>
+            <reference name="List certificates" url="https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html"/>
+            <reference name="List server certificates" url="https://docs.aws.amazon.com/cli/latest/reference/iam/list-server-certificates.html"/>
+            <reference name="Upload server certs" url="https://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html"/>
+          </references>
+          <standards>
+            <standard ref="1.15" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all SSL\TLS certificates stored in IAM and check the Expiration field&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws iam list-server-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  For Amazon Certificate Manager users: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List ACM certificates and note the CertificateArnvalue of the certificates used by the app:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm list-certificates 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Get the details of the desired certificate and check the ExpirationDatevalue (the certificate expiration time as an Epoch timestamp):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws acm describe-certificate --certificate-arn &amp;lt;ssl_certificate_arn&amp;gt; --query "Certificate.{ExpirationDate:NotAfter, Status:Status, SubjectAlternativeNames:SubjectAlternativeNames, DomainName:DomainName}"&amp;nbsp; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-02" name="Select the Server Order Preference option" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Within Elastic Load Balancing ensure the use of newer and stronger cipher suites when
+                        establishing a new connection supporting the Server Order Preference option. When this option is
+                        selected, the load balancer selects the first cipher in its list that is in the client's list of
+                        ciphers.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt; &lt;b&gt;Remediation:&lt;/b&gt; &lt;/b&gt;
+                        &lt;br /&gt;To enable Server Order Preference:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;For SSL Options, select Server Order Preference.&lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Click Save. &lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Open the Amazon EC2 console.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Under LOAD BALANCING, choose Load Balancers.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;Select your Load Balancer.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Listeners tab, for Cipher, choose Change.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;On the Select a Cipher page, select Custom Security Policy.&lt;br /&gt;&lt;/li&gt;
+                            &lt;li&gt;For SSL Options, check that the option Server Order Preference is selected. &lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.13" name="Set a HTTPS connection from all CloudFront Distributions to the Web Tier ELB origin" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Configure the Origin Protocol Policy for the Web tier ELB origin either to require that CloudFront fetches objects from your origin by using HTTPS or to require that CloudFront uses the protocol that the viewer used to request the objects. For example, if you choose Match Viewer for the Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  In order to use HTTPS, an SSL\TLS certificate must be attached. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  To ensure that objects are encrypted from edge locations to the Web-Tier ELB origin according to the data classification policy, use Match Viewer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;For configuring "OriginProtocolPolicy"first save locally the current distribution config:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id application_cfn_distribution_id&amp;nbsp; --query "DistributionConfig" &amp;gt; /tmp/cf-distribution.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   Edit and replace "OriginProtocolPolicy"element in /tmp/cf-distribution.json with the below section: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt;
+   "OriginProtocolPolicy": "https-only", 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Retrieve the current ETag of your CloudFront distribution:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront get-distribution-config --id &amp;lt;application_cfn_distribution_id&amp;gt;&amp;nbsp; --query "ETag" 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Update the CloudFront distribution using the edited config and the above Etag:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws cloudfront update-distribution --id &amp;lt;application_cfn_distribution_id&amp;gt; --distribution-config file:///tmp/cf-distribution.json --if-match &amp;lt;application_cfn_distribution_etag&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get streaming distribution config" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-streaming-distribution-config.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Secure Connections" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html"/>
+            <reference name="Update distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html"/>
+          </references>
+          <standards>
+            <standard ref="3.13" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check the &amp;quot;OriginProtocolPolicy&amp;quot; used by application Cloudfront
+                            distributions (it should be set as https-only):&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws cloudfront list-distributions --query &amp;quot;DistributionList.Items[*].{Id:Id,
+                            OriginProtocolPolicy:Origins.Items[*].CustomOriginConfig.OriginProtocolPolicy}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.300">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-5.1" name="Tag all resources" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;b&gt;Description&lt;/b&gt;:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Tags enable customers to categorize AWS resources in different ways, for example, by purpose, owner, or environment.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  Each tag consists of a key and an optional value, both of which customer's define.
+  You should define a set of tags for the following items to help you track each instance's owner and operating environment, cost center, and other items.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ol&gt;
+  &lt;li&gt;Amazon EC2 instances&lt;/li&gt;
+  &lt;li&gt;ELB&lt;/li&gt;
+  &lt;li&gt;EBS Volumes&lt;/li&gt;
+  &lt;li&gt;S3 Buckets&lt;/li&gt;
+ &lt;/ol&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+  A resource may have up to 10 tags associated with key &amp;amp; value such as:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Key=tier, Value=app&lt;/li&gt;
+  &lt;li&gt;Key=environment, Value=production&lt;/li&gt;
+  &lt;li&gt;Key=costcenter, Value=sales&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;div&gt;
+  &lt;b&gt;Remediation:&lt;/b&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt;
+  Tag all your 3 tier Web Application resources based on their tier membership (Web, App, Data), and your organizational requirements.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="PCI Cloud Compliance" url="https://d0.awsstatic.com/whitepapers/compliance/AWS_Anitian_Wookbook_PCI_Cloud_Compliance.pdf"/>
+            <reference name="Resource groups and tagging" url="https://aws.amazon.com/blogs/aws/resource-groups-and-tagging/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="5.1" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify tags are being used.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.17" name="Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in the AWS Virtual Private Cloud (VPC), you can assign the instance up to five security groups. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  The SG associated with the Web tier ELB should allow connectivity from any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;First remove all the ingress rules for the security group associated with the Web tier ELB:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 describe-security-groups --group-id &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[0].IpPermissions&amp;quot; &amp;gt; /tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+  &lt;div style=""&gt; 
+   &lt;br /&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 revoke-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt; --ip-permissions file:///tmp/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;create locally the below json file containing ingress rules for any source IP (0.0.0.0/0) only for the HTTP (TCP 80) and HTTPS (TCP 443) ports and name it IpPermissions.json:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 80, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; }, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;PrefixListIds&amp;quot;: [], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;FromPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpRanges&amp;quot;: [ 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; { 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;CidrIp&amp;quot;: &amp;quot;0.0.0.0/0&amp;quot; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; ], 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;ToPort&amp;quot;: 443, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;IpProtocol&amp;quot;: &amp;quot;tcp&amp;quot;, 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;quot;UserIdGroupPairs&amp;quot;: [] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     &amp;nbsp; &amp;nbsp; } 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     ] 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Add to the security group associated with the Web tier ELB the above ingress rules:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws ec2 authorize-security-group-ingress --group-id &amp;lt;security_group_id&amp;gt;&amp;nbsp; --ip-permissions file:///PathTo/IpPermissions.json 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.17" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the security group associated with the Web tier ELB:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-name &amp;lt;your_web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{DNSName:DNSName, SecurityGroups:SecurityGroups, SourceSecurityGroup:SourceSecurityGroup}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt;
+  note the security group id from the output 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the ingress rules for the above security group, and make sure that only HTTP (TCP 80) and HTTPS (TCP 443) traffic is allowed from any source IP (0.0.0.0/0)any source IP (0.0.0.0/0):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws ec2 describe-security-groups --group-ids&amp;nbsp; &amp;lt;security_group_id&amp;gt; --query &amp;quot;SecurityGroups[*].{GroupName:GroupName, IpPermissions:IpPermissions}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.14" name="Use HTTPS listener for App Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the App Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the App Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;app_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.14" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;app_tier_elb&amp;gt; with your App tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the App Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;app_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.11" name="Use HTTPS listener for Web Tier ELB" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A load balancer takes requests from clients and distributes them across the EC2 instances that are registered with the load balancer (also known as back-end instances). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Note: an HTTPS listener configured on the ELB is not mandatory if you are terminating SSL connections directly on the Web Tier EC2 instances, and using a TCP listener on the ELB (TCP pass-through) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using an HTTPS Elastic Load Balancer listener will make sure the application traffic between the client and the Web Tier ELB is encrypted over the SSL\TLS channel. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;div&gt;
+    Using the Amazon unified command line interface: 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If the ListenerDescription field is missing, add a new HTTPS listener configured with a SSL\TLS certificate (the listener forwards traffic to the backend instances on port 80, but this can be modified by editing InstancePort=80):&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt; 
+    &lt;div&gt;
+      aws elb create-load-balancer-listeners --load-balancer-name &amp;lt;web_tier_elb&amp;gt; --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80, SSLCertificateId=ssl_certificate_arn 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: ELB listener configuration" url="https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html"/>
+            <reference name="Amazon docs: create load balancer listeners" url="https://docs.aws.amazon.com/cli/latest/reference/elb/create-load-balancer-listeners.html"/>
+            <reference name="Amazon docs: describe load balancers" url="https://docs.aws.amazon.com/cli/latest/reference/elb/describe-load-balancers.html"/>
+          </references>
+          <standards>
+            <standard ref="1.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+  (Note that you should replace &amp;lt;web_tier_elb&amp;gt; with your Web-tier ELB name) 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Check if the Web Tier ELB is using an HTTPS or TCP listener. Note if the ListenerDescription field is missing or not:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws elb describe-load-balancers --load-balancer-names &amp;lt;web_tier_elb&amp;gt; --query &amp;quot;LoadBalancerDescriptions[*].{LoadBalancerName:LoadBalancerName, DNSName:DNSName, Scheme:Scheme, ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol = 'TCP']}&amp;quot; --output table 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-ELB-01" name="Use the Perfect Forward Secrecy feature" issueId="" issueLink="" platform="" cost="1" risk="62" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>For greater communication privacy Elastic Load Balancing allows the use of Perfect Forward
+                        Secrecy. This feature provides additional safeguards against eavesdropping on encrypted data,
+                        through the use of a unique random session key, and therefore prevents the decoding of captured
+                        data, even if the secret long-term key is compromised.
+                        &lt;br /&gt;
+                        &lt;br /&gt;
+                        &lt;b&gt;To begin using Perfect Forward Secrecy: &lt;br /&gt;&lt;/b&gt;Configure your load
+                        balancer with the newly added Elliptic Curve Cryptography (ECDHE) cipher suites.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that your load balancer is configured with the newly added Elliptic Curve
+                            Cryptography (ECDHE) cipher suites.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:18.301">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="EAVESDROPPING-COMMUNICATIONS" name="An attacker eavesdrops on the communication between the client and server and decrypts the data" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Eavesdropping on communication is a network attack that captures network packets transmitted by other computers and reads the data content. This type of network attack is most effective when weak encryption services are used. An attacker could eavesdrop on the communication between the client and server and decrypt the encrypted data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-295">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                    <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-ELB-01" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-ELB-02" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.10" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.11" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.12" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.13" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.14" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.15" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.9" mitigation="10"/>
+                <countermeasure ref="aws-tier-3.13" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.13" mitigation="9"/>
+                    <countermeasure ref="aws-tier-6.17" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.19" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.21" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.22" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.1">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.1" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.1" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.14" mitigation="7"/>
+                    <countermeasure ref="aws-tier-3.15" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.18" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.26" mitigation="7"/>
+                    <countermeasure ref="aws-tier-6.5" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AWS-ELB1" mitigation="7"/>
+                <countermeasure ref="C-AWS-SRA-9" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.1" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.14" mitigation="7"/>
+                <countermeasure ref="aws-tier-3.15" mitigation="7"/>
+                <countermeasure ref="aws-tier-5.1" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.13" mitigation="9"/>
+                <countermeasure ref="aws-tier-6.17" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.18" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.19" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.21" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.22" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.26" mitigation="7"/>
+                <countermeasure ref="aws-tier-6.5" mitigation="7"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUDITABLE-CHANGES-RESOURCES-AWS" name="Attackers make undetected and unaudited changes in the resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;div&gt;
+                                If audit trails in the resources are not enabled or not protected, attackers could gain
+                                access to the system and modify or delete data from the resources and the changes are
+                                not detected.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Logging-3.4">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="unknown-resource-status">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                    <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.10" mitigation="34"/>
+                <countermeasure ref="aws-tier-3.9" mitigation="33"/>
+                <countermeasure ref="aws-tier-5.2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="814fa76c-86db-4a48-9df4-2a82622be208" diagramComponentId="57178aca-be31-4a19-8633-871b17b715ef" ref="002e1e5c-362a-4bda-99d7-8cef7bbaa4a0" name="MAMI (MySQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="mysql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.173">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.892">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.525">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.894">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.893">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:11.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.651">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:12.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="38a708d4-aa61-41fe-8799-181f8b863c2e" diagramComponentId="676b98cb-4093-4c6e-858b-58e36d66002e" ref="8d17dfe4-5356-46dd-a180-c69b965f58d8" name="Istio (Default GW)" desc="" library="" parentComponentRef="" componentDefinitionRef="service-mesh">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="SM-LM-1" name="Complexity of configuring infrastructure wide forensics capabilities may result in a lack of sufficient data for security analytics" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice whose performance must be monitored, both for security and performance purposes.&amp;nbsp; In complex architectures it can be difficult to track and use metrics effectively. Monitoring and logging capabilities which are not centralized take much longer to review and increase the risk of critical information being overlooked.&amp;nbsp; This increases the risk of poor performance, and of malicious activities being carried out undetected.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SM-G-1" name="Insufficient configuration of architecture may degrade performance" state="0" impact="100" issueId="" issueLink="">
+          <desc>Security risks for microservices includes not only access to unauthorized information, but also&amp;nbsp; protection of the features which affect performance, integrity, and quality of service.&amp;nbsp; Architectures must be configured to take these factors into account. With microservices, service-to-service communication becomes a fundamental determining factor for how applications behave at runtime.&amp;nbsp; This has implications both for security and performance. Microservices must be configured to ensure that only authorized users can access resources, and that resources are not overused or abused.&amp;nbsp; &amp;nbsp;Overuse will effect the resource usage of others in a shared environment. The absence of such configurations may result in a DOS-style scenario.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SM-AC-1" name="Multiple services create challenges for access control" state="0" impact="100" issueId="" issueLink="">
+          <desc>With a service mesh, it is possible to ensure that encryption and granular access control rules are put into place across an organization, in a way that can be centrally controlled.&amp;nbsp; However configuring this kind of access can be a challenge due to the amount and variety of internal services.&amp;nbsp;&amp;nbsp; Access policies need to be robust in order to ensure that access is controlled throughout the microservice.&amp;nbsp; Inadequate policies may result in gaps in security which allow unauthorized access to the system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SM-N-1" name="Network traffic is vulnerable to adversaries" state="0" impact="100" issueId="" issueLink="">
+          <desc>The tremendous increase in the number of components in a microservices-based application system, combined with complex network environments comprised of various interaction styles among components,&amp;nbsp; makes secure network configuration difficult.&amp;nbsp; Implementing this into core infrastructure frameworks such as a service mesh can provide mitigation. To secure connected systems, networks need to segment traffic between logical zones.&amp;nbsp; This can protect applications from adversaries, as well as limit the 'blast radius' in the case of a breach.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:20.156">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MM-SS-13(6)" name="Configure Layer 3 network segmentation to complement the Layer 5 network segmentation" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Layer 3 network segmentation must be configured within the orchestrator platform to complement the Layer 5 network segmentation achieved throughout the service mesh layer. This countermeasure helps mitigate the threat of malicious actors circumventing or bypassing the sidecar proxy that the service mesh uses for firewalling and blocking network traffic.&amp;nbsp; This applies to highly sensitive microservices-based applications</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-13(1)" name="Provide policy support for designating communication protocol and specifying the traffic load between services" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A service mesh should facilitate management of service-to-service communication in a way that makes it visible, manageable, and controlled.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policies should provide support for this based on the needs of the specific architecture in question. This allows the relevant logic to be decoupled from applications.&amp;nbsp; Removing this responsibility from developers of individual applications makes it more likely that the correct protocols will be applied consistently and comprehensively across the architecture. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-13(5)" name="Service mesh deployments should have configuration capabilities to collect and send environment metrics" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A service mesh is a networking infrastructure that leverages "sidecar" proxies for microservice deployments. Sidecar proxies should be able to capture both upstream and downstream communication, providing complete visibility into the external performance of all the services. Service mesh deployments should have configuration capabilities to collect and send environment metrics, including request metrics, to a centralized service for monitoring. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This insight into service traffic means that a service mesh and can expose metrics in a consistent way, irrespective of different programming languages and frameworks.&amp;nbsp; It is important to choose a service mesh which offers these capabilities, and to fully utilize them in any deployments. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Policies should allow for specifying either a single service mesh or multiple service meshes (each with their own control plane) for multi-cluster microservices environments to ensure high availability and resiliency in those scenarios. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-13(4)" name="Service mesh deployments should have configuration capabilities to specify resource usage limits for its components" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Service mesh deployments should have configuration capabilities to specify resource usage limits for its components. The absence of this feature creates the potential for these components to impact the resiliency and availability of the overall microservices application.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-13(2)" name="The default configuration should always enable access control policies for all services" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Controls should be applied at the earliest possible stages in order to ensure that all eventualities are covered.&amp;nbsp; Insisting that all access control is enabled by default for all services reduces the risk of objects being created or launched without strong levels of protection.&amp;nbsp; This forces developers and operators to ensure that services are protected and reduces the risk of controls being overlooked either accidentally, or to ease workflow and development time.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-13" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual service mesh in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T14:00:19.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-control" name="Access control" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNUSED-ENDPOINTS" name="Attackers exploit deprecated or unused endpoints to access unauthorized resources" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>Endpoints that are exposed when they shouldn't be or have been forgotten but haven't any kind of security control might be a vector attack</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SM-AC-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-13(2)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-13(2)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-13(1)" mitigation="50"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-13(4)" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-13(1)" mitigation="50"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-13(4)" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SM-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-13(5)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-13(5)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CWE-311" name="Attackers gain unauthorised access to the administrative interface by sniffing the network" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>An attacker can sniff the credentials which are transmitted over the network and hence
+                                gain access
+                                to the administration interface.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SM-N-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MM-SS-13(6)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MM-SS-13(6)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="59aac4bf-e1c3-4e8d-9705-2a8b7a8103e7" diagramComponentId="96efc032-fc11-47c8-9353-3c3517e89036" ref="2a0c2a53-d710-4930-986d-4db95b02f292" name="Auth-Service (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.388">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.772">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.544">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:19.475">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="505ad18d-9ef9-409c-9258-2edbef1d68a1" diagramComponentId="32b19da8-2e0e-4466-ba3d-b810bd897dce" ref="27c24a08-02f8-4fb7-b790-7e3db361c53d" name="Access-Rights (PostgreSQL)" desc="" library="" parentComponentRef="" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.160">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.627">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.095">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.259">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-21T15:52:13.548">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="4629a842-2b18-4685-aa10-656bfd206e8d" diagramComponentId="0b957c33-6ebf-466c-8b70-6ca40e27947f" ref="b6dd5f39-9243-4289-b561-566f0a1ff4fb" name="BFF API" desc="" library="" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.400">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.399">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.343">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-09-12T16:05:15.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="robert.sargavakian@peartherapeutics.com" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="9ed1fb76-665a-4e06-970c-215d3b4441c8" diagramComponentId="7276a5e6-cae0-4feb-801b-5de8fa0b9e5e" ref="a928a2dc-08c7-4b68-a594-2fa6325ab3d3" name="Docker Environment" desc="" library="" parentComponentRef="" componentDefinitionRef="docker-environment">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures/>
+      <usecases/>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/nwe-autorizacion-de-operaciones.xml b/Templates/Submitted_Templates/nwe-autorizacion-de-operaciones.xml
new file mode 100644
index 0000000..b9b95aa
--- /dev/null
+++ b/Templates/Submitted_Templates/nwe-autorizacion-de-operaciones.xml
@@ -0,0 +1,17529 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="nwe-autorizacion-de-operaciones" name="NWE-Autorizacion de Operaciones" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iNTY2MSIgZHk9IjI0MzQiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS4yLjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTMiIHk9Ii0yMDkiIHdpZHRoPSIzOTEiIGhlaWdodD0iMjQ5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJCYWFTIiBpZD0iMTAiPjxteENlbGwgc3R5bGU9ImlyLnJlZj01NmY5NjlkNS05YjQwLTQ5NjUtYWU4My1hYzc4MzE5YjU5OTQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI5IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj1hMmZmNTY0Yi00NDdlLTQ3ZmEtOTVhMi02NTU3Yzc4NDlhNWY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iOSIgc291cmNlPSIxMSIgdGFyZ2V0PSIxMCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBpZD0iMTEiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03NDM3MzQ5NS00YjgwLTRlMTgtOThiZi1hZjZiYWIwMDUzZDA7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXktbWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EZzNNRElnTUM0Mk5ESTVNemRETUM0Mk5UWXlPRE1nTUM0Mk16UTBOemdnTUM0Mk5qUTJPRGNnTUM0Mk1qWTRNREVnTUM0Mk56TTNOemtnTUM0Mk1qQXdNME13TGpZM056YzBPQ0F3TGpZeE56QTNOQ0F3TGpZNE16QTBOeUF3TGpZeE5qa3dOaUF3TGpZNE5qazJOeUF3TGpZeE9UWXhNVXd3TGpjd05UYzJNeUF3TGpZek1qVTRNME13TGpjeE5ETTRNaUF3TGpZek9EVTFNaUF3TGpjeU5qTTFNaUF3TGpZek5qZzJOU0F3TGpjek16VTFOeUF3TGpZeU9EWTJNVU13TGpjek5UUTVOU0F3TGpZeU5qUTFOeUF3TGpjek5qazJPQ0F3TGpZeU16ZzROeUF3TGpjek56ZzRPU0F3TGpZeU1UQTRPRXd3TGpjME5UTWdNQzQxT1RnM05qVkRNQzQzTkRZNE5ERWdNQzQxT1RReE1qSWdNQzQzTlRFd09USWdNQzQxT1RBNE5EUWdNQzQzTlRVNU1EVWdNQzQxT1RBMU9EaERNQzQzTnpnek1EY2dNQzQxT0Rrek9UY2dNQzQ0TURBME9ERWdNQzQxT1RNek1qTWdNQzQ0TWpBM05pQXdMall3TWpBM1F6QXVPREkxTVRNeklEQXVOakF6T1RVMUlEQXVPREkzTnpJMklEQXVOakE0TkRZNUlEQXVPREkzTWpJeElEQXVOakV6TXpFMVREQXVPREkwTnpnMElEQXVOak0yTnpJelF6QXVPREkwTURjNUlEQXVOalF6TXpreUlEQXVPREkyTlRZeUlEQXVOalE1T0RjeklEQXVPRE14TkRjeUlEQXVOalUwTVRjM1F6QXVPRE0yTXpneUlEQXVOalU0TkRnZ01DNDRORE14TXpNZ01DNDJOakF3T1RNZ01DNDRORGsyTmpZZ01DNDJOVGcxTVRkTU1DNDROekkxTmpjZ01DNDJOVE13TWpORE1DNDROemN6TURjZ01DNDJOVEU0T0RZZ01DNDRPREl4TWpJZ01DNDJOVE00TmpVZ01DNDRPRFExTmpZZ01DNDJOVGM1TlRORE1DNDRPVFU0T1RNZ01DNDJOelk1TURZZ01DNDVNREkyT1RRZ01DNDJPVGd6TmprZ01DNDVNRFEwTlRjZ01DNDNNakEzTWpsRE1DNDVNRFE0TXpVZ01DNDNNalUxTXpJZ01DNDVNREl4TkRnZ01DNDNNekF4TnpNZ01DNDRPVGMzTlRFZ01DNDNNekl6TVROTU1DNDROelkxTWpNZ01DNDNOREkyTkRORE1DNDROekEwTlRNZ01DNDNORFUyTURFZ01DNDROall3TWpnZ01DNDNOVEV5TXlBd0xqZzJORFl3TlNBd0xqYzFOemd3TmtNd0xqZzJNekU0TWlBd0xqYzJORE00TXlBd0xqZzJORGt6SURBdU56Y3hNVEl5SURBdU9EWTVNekUySURBdU56YzFPVFU1VERBdU9EZzBOalE0SURBdU56a3lPRGM0UXpBdU9EZzNPREV4SURBdU56azJNelkzSURBdU9EZzRNemNnTUM0NE1ERTFOallnTUM0NE9EWXdORGNnTUM0NE1EVTROamxETUM0NE56VXhNak1nTUM0NE1qWXdPVGtnTUM0NE5UazNNekVnTUM0NE5ETTJOVGtnTUM0NE5ERXhNRGdnTUM0NE5UY3hNemhETUM0NE16Y3hORFlnTUM0NE5qQXdNRFlnTUM0NE16RTVNVGdnTUM0NE5qQXhNek1nTUM0NE1qZ3dORFVnTUM0NE5UYzBOVFpNTUM0NE1Ea3lPVEVnTUM0NE5EUTBPVEZETUM0NE1ETTVNVGNnTUM0NE5EQTRNREVnTUM0M09UY3dNVFlnTUM0NE16azVOallnTUM0M09UQTJPVFFnTUM0NE5ESXlORE5ETUM0M09EUXpOeklnTUM0NE5EUTFNVGtnTUM0M056a3pPQ0F3TGpnME9UWXpOU0F3TGpjM056STBOaUF3TGpnMU5qQXhOa3d3TGpjMk9UYzROU0F3TGpnM09EUXhPVU13TGpjMk9ESTBJREF1T0Rnek1EVTVJREF1TnpZek9UZzNJREF1T0RnMk16TXlJREF1TnpVNU1UYzJJREF1T0RnMk5UZzFRekF1TnpNMk56VTRJREF1T0RnM056WXhJREF1TnpFME5UY3hJREF1T0Rnek9ERTNJREF1TmprME1qZzJJREF1T0RjMU1EUTVRekF1TmpnNU9URTJJREF1T0Rjek1UWXhJREF1TmpnM016STNJREF1T0RZNE5qUTRJREF1TmpnM09ETXpJREF1T0RZek9EQTBUREF1Tmprd01qZ2dNQzQ0TkRBek5qWkRNQzQyT1RBNU9EUWdNQzQ0TXpNMk9UY2dNQzQyT0RnMU1ERWdNQzQ0TWpjeU1UWWdNQzQyT0RNMU9URWdNQzQ0TWpJNU1UTkRNQzQyTnpnMk9ERWdNQzQ0TVRnMk1Ea2dNQzQyTnpFNU15QXdMamd4TmprNU5pQXdMalkyTlRRd01pQXdMamd4T0RVM01Vd3dMalkwTWpVeE15QXdMamd5TkRBM05FTXdMall6TnpjM01TQXdMamd5TlRJeE5DQXdMall6TWprMU15QXdMamd5TXpJek5pQXdMall6TURVd09DQXdMamd4T1RFME5VTXdMall4T1RFNElEQXVPREF3TVRnNElEQXVOakV5TXpneUlEQXVOemM0TnpFNUlEQXVOakV3TmpJM0lEQXVOelUyTXpVMFF6QXVOakV3TWpVZ01DNDNOVEUxTkRrZ01DNDJNVEk1TkRJZ01DNDNORFk1TURZZ01DNDJNVGN6TkRNZ01DNDNORFEzTmpsTU1DNDJNemcwT1RrZ01DNDNNelEwT1RoRE1DNDJORFExT0RVZ01DNDNNekUxTkRFZ01DNDJORGt3TVRFZ01DNDNNalU0T1NBd0xqWTFNRFF4TkNBd0xqY3hPVEkxT1VNd0xqWTFNVGd5T0NBd0xqY3hNalkzTXlBd0xqWTFNREEzTnlBd0xqY3dOVGt5T1NBd0xqWTBOVFk1T0NBd0xqY3dNVEE0TkV3d0xqWXpNRE00TlNBd0xqWTROREUyTkVNd0xqWXlOekU0TnlBd0xqWTRNRFl6TVNBd0xqWXlOalkyTWlBd0xqWTNOVE0xTWlBd0xqWXlPVEEzTmlBd0xqWTNNVEF5T1VNd0xqWXpORFl3T1NBd0xqWTJNVEV5TVNBd0xqWTBNVEV5TnlBd0xqWTFNVGMzTkNBd0xqWTBPRGN3TWlBd0xqWTBNamt6TjFwTk1DNDNPRFl4TURFZ01DNDNPVGswTkVNd0xqZ3hPVGMyTlNBd0xqYzRNelkyTVNBd0xqZ3pOREkyTXlBd0xqYzBNelU0TVNBd0xqZ3hPRFE0TkNBd0xqY3dPVGt4T0VNd0xqZ3dNamN3TlNBd0xqWTNOakkxTlNBd0xqYzJNall5TkNBd0xqWTJNVGMxT0NBd0xqY3lPRGsySURBdU5qYzNOVE0yUXpBdU5qazFNamsySURBdU5qa3pNekUxSURBdU5qZ3dOems0SURBdU56TXpNemsySURBdU5qazJOVGMzSURBdU56WTNNRFU0UXpBdU56RXlNelUySURBdU9EQXdOekl4SURBdU56VXlORE0zSURBdU9ERTFNakU1SURBdU56ZzJNVEF4SURBdU56azVORFJhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpRNU16SWdNQzQzTmpJME9ERldNQzQzTlRZd05qUkRNQzQzTnpBeU1qWWdNQzQzTmpFek5qa2dNQzQzTmpRMk1qRWdNQzQzTmpRd01qRWdNQzQzTlRneE1Ua2dNQzQzTmpRd01qRkRNQzQzTlRJMk5ETWdNQzQzTmpRd01qRWdNQzQzTkRnME5TQXdMamMyTVRnMElEQXVOelExTlRReElEQXVOelUzTkRjMlZqQXVOemd5T0RnM1REQXVOek0wTXpjMUlEQXVOemc0TVRRNVZqQXVOamsyT0RrNVNEQXVOelExTlRReFZqQXVOek0yTkRJNFF6QXVOelExTlRReElEQXVOelF6TURFMklEQXVOelEyTmprMklEQXVOelEzTlRVeElEQXVOelE1TURBMklEQXVOelV3TURNeVF6QXVOelV4TkRBeUlEQXVOelV5TkRJNElEQXVOelUwT1RrMklEQXVOelV6TmpJMklEQXVOelU1TnpnM0lEQXVOelV6TmpJMlF6QXVOelk1T0RnMElEQXVOelV6TmpJMklEQXVOemMwT1RNeUlEQXVOelEzT1RjNUlEQXVOemMwT1RNeUlEQXVOek0yTmpnMVZqQXVOamsyT0RrNVNEQXVOemcyTURrNFZqQXVOell5TkRneFNEQXVOemMwT1RNeVdpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXlLU0krSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU16QTJOVEl5SURBdU1UVXdOakEzUXpBdU16STVNek0xSURBdU1UUXlOamM0SURBdU16VXlPVEV6SURBdU1UTTNNVFE0SURBdU16YzJPRGMxSURBdU1UTTBNVEE0UXpBdU16ZzNNek0xSURBdU1UTXlOemd4SURBdU16azNORGtnTUM0eE16Z3lOVFlnTUM0ME1ESXhOU0F3TGpFME56Y3pOa3d3TGpReU5EUTVNaUF3TGpFNU16RTRPVU13TGpRek5EY3hOU0F3TGpJeE5EQTNJREF1TkRVNE9UYzBJREF1TWpJek9UTXlJREF1TkRnd09ESTBJREF1TWpFMk1EYzVRekF1TkRnMk5qazRJREF1TWpFek9UY3lJREF1TkRreU1EWTBJREF1TWpFd05qVXpJREF1TkRrMk5qSXlJREF1TWpBMk1qa3lUREF1TlRNek1EazFJREF1TVRjeE5UYzVRekF1TlRRd05qZ3hJREF1TVRZME16WWdNQzQxTlRFNU9UWWdNQzR4TmpJM01qVWdNQzQxTmpFek1qUWdNQzR4TmpjMU1ERkRNQzQyTURRM05ESWdNQzR4T0RrM015QXdMalkwTWpVM015QXdMakl5TVRVeU5pQXdMalkzTVRrMk9TQXdMakkyTURRNU5VTXdMalkzT0RNd09DQXdMakkyT0RnNU9DQXdMalkzT0RZME5DQXdMakk0TURNNU1pQXdMalkzTWpnd05pQXdMakk0T1RFek4wd3dMalkwTkRZeE1pQXdMak16TVRNM01rTXdMall6TmpVMU9TQXdMak0wTXpNNU5DQXdMall6TkRjd05pQXdMak0xT0RVME15QXdMall6T1RZeUlEQXVNemN5TVRjeVF6QXVOalEwTlRNMElEQXVNemcxT0NBd0xqWTFOVFl5T0NBd0xqTTVOakk0TVNBd0xqWTJPVFV6SURBdU5EQXdOREEzVERBdU56RTRNakkzSURBdU5ERTBPVEk1UXpBdU56STRNekEwSURBdU5ERTNPVE0xSURBdU56TTFNemd6SURBdU5ESTJPVGs1SURBdU56TTFPRFkySURBdU5ETTNOVEUyUXpBdU56TTRNVEEwSURBdU5EZzJNalk1SURBdU56STVNamd4SURBdU5UTTBPRGd5SURBdU56RXdNRFU1SURBdU5UYzVOekF6UXpBdU56QTFPVE14SURBdU5UZzVNekk1SURBdU5qazJNVGcySURBdU5UazFNamswSURBdU5qZzFOelF6SURBdU5UazBOVGczVERBdU5qTTFNekkwSURBdU5Ua3hNVGMwUXpBdU5qSXdPVEF5SURBdU5Ua3dNakEwSURBdU5qQTJPRGc0SURBdU5UazJNVFl4SURBdU5UazNOVGMySURBdU5qQTNNakU1UXpBdU5UZzRNalkwSURBdU5qRTRNamMzSURBdU5UZzBOelkxSURBdU5qTXpNVEU0SURBdU5UZzRNVFV4SURBdU5qUTNNVGsxVERBdU5UazVPVGc0SURBdU5qazJOREk1UXpBdU5qQXlOREk1SURBdU56QTJOVGd4SURBdU5UazRNalF4SURBdU56RTNNVFkySURBdU5UZzVOVEkwSURBdU56SXlPRGM1UXpBdU5UUTROVFEwSURBdU56UTVOek14SURBdU5UQXhPRE16SURBdU56WTJOVGN6SURBdU5EVXpNVFEySURBdU56Y3lNRFV4UXpBdU5EUXlOemc1SURBdU56Y3pNakUySURBdU5ETXlPREE1SURBdU56WTNOek01SURBdU5ESTRNakVnTUM0M05UZ3pOalZNTUM0ME1EVTVNemdnTUM0M01USTVOekpETUM0ek9UazFNeklnTUM0M01EQXdNVE1nTUM0ek9EY3pOamdnTUM0Mk9UQTROakVnTUM0ek56TXhOVGtnTUM0Mk9EZ3pNRGxETUM0ek5UZzVOVEVnTUM0Mk9EVTNOVGdnTUM0ek5EUXpPRFVnTUM0Mk9UQXhNRGtnTUM0ek16TTVNekVnTUM0M01EQXdNVFJNTUM0eU9UY3lPRE1nTUM0M016UTRNalZETUM0eU9EazJPVElnTUM0M05ESXdNelVnTUM0eU56Z3pOemtnTUM0M05ETTJOaUF3TGpJMk9UQTFOeUF3TGpjek9EZzNPVU13TGpJeU5UWXlOQ0F3TGpjeE5qWXdOU0F3TGpFNE56YzRPU0F3TGpZNE5EYzJNU0F3TGpFMU9EUXdNU0F3TGpZME5UYzBNME13TGpFMU1qQTNNaUF3TGpZek56TXpPU0F3TGpFMU1UYzBNaUF3TGpZeU5UZzFJREF1TVRVM05UYzVJREF1TmpFM01URk1NQzR4T0RVNE1qRWdNQzQxTnpRNE1qZERNQzR4T1RNNE56TWdNQzQxTmpJNE1EVWdNQzR4T1RVM01qY2dNQzQxTkRjMk5UWWdNQzR4T1RBNE1UTWdNQzQxTXpRd01qaERNQzR4T0RVNE9Ua2dNQzQxTWpBek9Ua2dNQzR4TnpRNE1EUWdNQzQxTURrNU1UZ2dNQzR4TmpBNU1UVWdNQzQxTURVM09UWk1NQzR4TVRJeU15QXdMalE1TVRNd05VTXdMakV3TWpFME5pQXdMalE0T0RNd015QXdMakE1TlRBMU9Ua2dNQzQwTnpreU16VWdNQzR3T1RRMU56YzFJREF1TkRZNE56RXpRekF1TURreU16UXlJREF1TkRFNU9UVXhJREF1TVRBeE1UYzNJREF1TXpjeE16TWdNQzR4TWpBME1Ua2dNQzR6TWpZMU1EaERNQzR4TWpRMU5UTWdNQzR6TVRZNE56Z2dNQzR4TXpRek1EZ2dNQzR6TVRBNU1UWWdNQzR4TkRRM05UWWdNQzR6TVRFMk16Tk1NQzR4T1RRNU9DQXdMak14TlRBNE0wTXdMakl3T1RReU9TQXdMak14TmpBM0lEQXVNakl6TkRZNUlEQXVNekV3TURjeUlEQXVNak15TnprM0lEQXVNams0T0RnNFF6QXVNalF5TVRBeUlEQXVNamczT0RBeUlEQXVNalExTmpBeUlEQXVNamN5T1RRM0lEQXVNalF5TWpNeklEQXVNalU0T0RZeVREQXVNak13TkRNM0lEQXVNakE1TmpRNVF6QXVNakkzT1RjMElEQXVNVGs1TXpjeElEQXVNak15TXpBMElEQXVNVGc0TmpjZ01DNHlOREV5TVRJZ01DNHhPRE13TVRsRE1DNHlOakUyTXlBd0xqRTNNREEyTnlBd0xqSTRNek16TlNBd0xqRTFPVEkzSURBdU16QTJOVEl5SURBdU1UVXdOakEzV2swd0xqUXhOVFF5TWlBd0xqWXlNVGMzTTBNd0xqVXdPRFl5SURBdU5qSXhOemN6SURBdU5UZzBNVGN4SURBdU5UUTJNakl4SURBdU5UZzBNVGN4SURBdU5EVXpNREkwUXpBdU5UZzBNVGN4SURBdU16VTVPREkySURBdU5UQTROaklnTUM0eU9EUXlOelVnTUM0ME1UVTBNaklnTUM0eU9EUXlOelZETUM0ek1qSXlNak1nTUM0eU9EUXlOelVnTUM0eU5EWTJOeklnTUM0ek5UazRNallnTUM0eU5EWTJOeklnTUM0ME5UTXdNalJETUM0eU5EWTJOeklnTUM0MU5EWXlNakVnTUM0ek1qSXlNak1nTUM0Mk1qRTNOek1nTUM0ME1UVTBNaklnTUM0Mk1qRTNOek5hSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TnpVMk1pQXdMalE1T1RrMU9Fd3dMak0yT0RjNU5TQXdMalE0TWpFd09FZ3dMak16TkRJM05rd3dMak15TnpRMU1TQXdMalE1T1RrMU9FZ3dMak13TlRZMk5Fd3dMak0wTVRnNE9TQXdMalF3T0RBNE1VZ3dMak0yTVRBMU1Vd3dMak01TnpRd055QXdMalE1T1RrMU9FZ3dMak0zTlRZeVdrMHdMak0yTWpFd01TQXdMalEyTXpjek1rd3dMak0xTkRJeU5pQXdMalEwTXpreE0wTXdMak0xTXpBd01TQXdMalEwTURrek9DQXdMak0xTWpBNE1pQXdMalF6T0RNMU55QXdMak0xTVRRM0lEQXVORE0yTVRZNVF6QXVNelV4TVRJZ01DNDBNemMyTlRjZ01DNHpOVEF5TURFZ01DNDBOREF5TXpnZ01DNHpORGczTVRRZ01DNDBORE01TVROTU1DNHpOREE0TXprZ01DNDBOak0zTXpKSU1DNHpOakl4TURGYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME1Ea3hORFFnTUM0ME9UazVOVGhXTUM0ME1EZ3dPREZJTUM0ME5EazRNekZETUM0ME5qQTNOamdnTUM0ME1EZ3dPREVnTUM0ME5qZzRNVGdnTUM0ME1UQTVNalVnTUM0ME56TTVPQ0F3TGpReE5qWXhNa013TGpRM09USXpJREF1TkRJeU15QXdMalE0TVRnMU5TQXdMalF5T1RNZ01DNDBPREU0TlRVZ01DNDBNemMyTVRORE1DNDBPREU0TlRVZ01DNDBOREV5SURBdU5EZ3hNalF6SURBdU5EUTBOekF4SURBdU5EZ3dNREU0SURBdU5EUTRNVEV6UXpBdU5EYzROemt6SURBdU5EVXhORE00SURBdU5EYzJPVFUxSURBdU5EVTBOVFEwSURBdU5EYzBOVEExSURBdU5EVTNORE15UXpBdU5EY3lNRFUxSURBdU5EWXdNeklnTUM0ME5qZzJPRGNnTUM0ME5qSTJNemdnTUM0ME5qUXpPVGtnTUM0ME5qUXpPRGhETUM0ME5qQXhNVElnTUM0ME5qWXhNemdnTUM0ME5UVXlOVFlnTUM0ME5qY3dNVE1nTUM0ME5EazRNekVnTUM0ME5qY3dNVE5JTUM0ME1qa3dPVE5XTUM0ME9UazVOVGhJTUM0ME1Ea3hORFJhVFRBdU5EVXdOakU0SURBdU5EUTRNalEwUXpBdU5EVTBNVEU0SURBdU5EUTRNalEwSURBdU5EVTJOelF6SURBdU5EUTNNVGswSURBdU5EVTRORGt6SURBdU5EUTFNRGswUXpBdU5EWXdNalF6SURBdU5EUXlPVGswSURBdU5EWXhNVEU0SURBdU5EUXdOU0F3TGpRMk1URXhPQ0F3TGpRek56WXhNME13TGpRMk1URXhPQ0F3TGpRek5EZ3hNeUF3TGpRMk1ESTROeUF3TGpRek1qTTJNeUF3TGpRMU9EWXlOQ0F3TGpRek1ESTJNME13TGpRMU5qazJNaUF3TGpReU9EQTNOU0F3TGpRMU5ESTVNeUF3TGpReU5qazRNU0F3TGpRMU1EWXhPQ0F3TGpReU5qazRNVWd3TGpReU9UQTVNMVl3TGpRME9ESTBORWd3TGpRMU1EWXhPRm9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TkRFek55QXdMalE1T1RrMU9GWXdMalF3T0RBNE1VZ3dMalV4TkRBNE4xWXdMalE1T1RrMU9FZ3dMalE1TkRFek4xb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TXpjMUlpQm9aV2xuYUhROUlqQXVPVE0zTlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ETXhNalVnTUM0d016RXlOU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpJNE9UY3lOaUlnYUdWcFoyaDBQU0l3TGpJNE9UY3lNaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TmpFeU56a3pJREF1TlRrek56VXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01pSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQyTlRZeU5TSWdhR1ZwWjJoMFBTSXdMalkxTmpJMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdPRGMwTURJeklEQXVNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iOSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4MSIgeT0iNzkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI0IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1MTMiIHk9IjI5NSIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSI4Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9NWQ3MmUxN2ItNjAzYi00MGUyLWI3MmYtMTg3MjhjZDlhOTQ4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjIyNCIgeT0iNzkuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzMiIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIC0+IEJhYVMiIHN0eWxlPSJpci5yZWY9Yzg1MjA5MGEtMTk0Ny00NTM4LThkY2UtMzIxYjI2M2QyMTA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQiIHNvdXJjZT0iNyIgdGFyZ2V0PSI4IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YTg4YjZkMzMtOGFiMC00NWMyLTg3YTktODZkZGU4YjBlZmM3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODEiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNiIgdmFsdWU9IkludGVybmV0IiBzdHlsZT0iaXIucmVmPWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMTAyMCIgeT0iLTI4OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSIxODAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkNsaWVudGVzIiBpZD0iMiI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTgyYTdmMDFlLTIwZTEtNDMxMy1iZTYzLTI1YjQ5NTRkOTIxMTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nZW5lcmljLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0eU5UWXpNemNnTUM0Mk9UUXlPVEpETUM0eU5ERTBOeUF3TGpZNU5ESTVNaUF3TGpJeU56ZzROaUF3TGpZNE9EZ3dNeUF3TGpJeE56VXdNaUF3TGpZM09UYzBNME13TGpJeE1Ua3hJREF1TmpjME9EWTBJREF1TWpBM01qUTJJREF1TmpZNE9UUTVJREF1TWpBek9ERWdNQzQyTmpJeU9UaERNQzR4T1RrMk1qUWdNQzQyTlRReE9UVWdNQzR4T1RjeU5qRWdNQzQyTkRRNU9Ua2dNQzR4T1RjeU5qRWdNQzQyTXpVeU5URldNQzR5T0RFeE5qaERNQzR4T1RjeU5qRWdNQzR5TkRnMU5pQXdMakl5TXpjeElEQXVNakl5TVRJM0lEQXVNalUyTXpNM0lEQXVNakl5TVRJM1REQXVOak0wTkRRM0lEQXVNakl5TVRJM1REQXVOVGsxTmpBM0lEQXVNVFl6TURnMlREQXVNalUyTXpNM0lEQXVNVFl6TURnMlF6QXVNVGt4TURneklEQXVNVFl6TURnMklEQXVNVE00TVRnMElEQXVNakUxT1RVeklEQXVNVE00TVRnMElEQXVNamd4TVRZNFZqQXVOak0xTWpVeFF6QXVNVE00TVRnMElEQXVOalE0TXpjeklEQXVNVFF3TXpJMklEQXVOall3T1RrMklEQXVNVFEwTWpjNUlEQXVOamN5TnpnNVF6QXVNVFV3TVRRNUlEQXVOamt3TWprNElEQXVNVFl3TURFeklEQXVOekExT1RjNElEQXVNVGN5TnprZ01DNDNNVGczTkRkRE1DNHhPVFF4TnpJZ01DNDNOREF4TVRZZ01DNHlNak0zTVNBd0xqYzFNek16TXlBd0xqSTFOak16TnlBd0xqYzFNek16TTBnd0xqTTNORGM0TjFZd0xqZ3hNekF3TlV3d0xqSTROakl5T1NBd0xqZ3hNekF3TlVNd0xqSTJPVGt4TmlBd0xqZ3hNekF3TmlBd0xqSTFOalk1TVNBd0xqZ3lOakl5TWlBd0xqSTFOalk1TVNBd0xqZzBNalV5TmtNd0xqSTFOalk1TVNBd0xqZzFPRGd6SURBdU1qWTVPVEUySURBdU9EY3lNRFEySURBdU1qZzJNak1nTUM0NE56SXdORFpNTUM0Mk9UazFOQ0F3TGpnM01qQTBNME13TGpjeE5UZzFOQ0F3TGpnM01qQTBNeUF3TGpjeU9UQTNPU0F3TGpnMU9EZ3lOaUF3TGpjeU9UQTNPU0F3TGpnME1qVXlNa013TGpjeU9UQTNPQ0F3TGpneU5qSXhPU0F3TGpjeE5UZzFNeUF3TGpneE16QXdNaUF3TGpZNU9UVTBJREF1T0RFek1EQXlUREF1TmpFd09UY3lJREF1T0RFek1EQXpWakF1TnpVek16TXpTREF1TnpJNE9UVXpRekF1TnpReU9EVXpJREF1TnpVek16TXpJREF1TnpVMk1Ua3pJREF1TnpVd09UTTBJREF1TnpZNE5UZ2dNQzQzTkRZMU1qZERNQzQ0TURjd056VWdNQzQzTXpJNE16VWdNQzQ0TXpZek56RWdNQzQyT1RrM05UY2dNQzQ0TkRRM01EWWdNQzQyTlRrd05EbERNQzQ0TkRZeU9DQXdMalkxTVRNMk1pQXdMamcwTnpFd055QXdMalkwTXpRd015QXdMamcwTnpFd055QXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMamcwTnpFd055QXdMakl4TlRrMU15QXdMamM1TkRJd055QXdMakUyTXpBNE5pQXdMamN5T0RrMU15QXdMakUyTXpBNE5rZ3dMalU1TlRZd04wd3dMall6TkRRME55QXdMakl5TWpFeU4wZ3dMamN5T0RrMU0wTXdMamMyTVRVNElEQXVNakl5TVRJM0lEQXVOemc0TURNZ01DNHlORGcxTmlBd0xqYzRPREF6SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU56ZzRNRE1nTUM0Mk5EUTVPVGtnTUM0M09EVTJOallnTUM0Mk5UUXhPVFVnTUM0M09ERTBPQ0F3TGpZMk1qSTVPRU13TGpjM05ESTRPU0F3TGpZM05qSXhPQ0F3TGpjMk1UY3lNU0F3TGpZNE5qa3hNeUF3TGpjME5qVXlNU0F3TGpZNU1UWXpOME13TGpjME1EazNNU0F3TGpZNU16TTJNaUF3TGpjek5UQTNNU0F3TGpZNU5ESTVNaUF3TGpjeU9EazFNeUF3TGpZNU5ESTVNa2d3TGpJMU5qTXpOMXBOTUM0ME16TTROalFnTUM0NE1UTXdNRFJNTUM0MU5URTRPVFVnTUM0NE1UTXdNRE5XTUM0M05UTXpNek5JTUM0ME16TTROalJXTUM0NE1UTXdNRFJhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdNREF5TkRReE5ERWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI2IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSI0OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxNSIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTU2IiB5PSItMTE5IiB3aWR0aD0iMzkxIiBoZWlnaHQ9IjI0OSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQmFhUyIgaWQ9IjE2Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9MGEwYjBiYTMtYzUzMC00YzRkLWIxNDItMWZmMzQ2Zjk0NWEwO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIxNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyMjQiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMzAiIHZhbHVlPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyAtPiBCYWFTIiBzdHlsZT0iaXIucmVmPTEzZjhlMWRhLTFkNTEtNDQ5MC04MDliLTAzNjJkMmRiZjk2NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxNSIgc291cmNlPSIxNyIgdGFyZ2V0PSIxNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBpZD0iMTciPjxteENlbGwgc3R5bGU9ImlyLnJlZj02ZmYwMTkyNy1mYTM5LTQ5MzktOWViZi1mNzBhNTFiODc0ZjU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9YXBpLWdhdGV3YXktbWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNERXBJajRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0Mk5EZzNNRElnTUM0Mk5ESTVNemRETUM0Mk5UWXlPRE1nTUM0Mk16UTBOemdnTUM0Mk5qUTJPRGNnTUM0Mk1qWTRNREVnTUM0Mk56TTNOemtnTUM0Mk1qQXdNME13TGpZM056YzBPQ0F3TGpZeE56QTNOQ0F3TGpZNE16QTBOeUF3TGpZeE5qa3dOaUF3TGpZNE5qazJOeUF3TGpZeE9UWXhNVXd3TGpjd05UYzJNeUF3TGpZek1qVTRNME13TGpjeE5ETTRNaUF3TGpZek9EVTFNaUF3TGpjeU5qTTFNaUF3TGpZek5qZzJOU0F3TGpjek16VTFOeUF3TGpZeU9EWTJNVU13TGpjek5UUTVOU0F3TGpZeU5qUTFOeUF3TGpjek5qazJPQ0F3TGpZeU16ZzROeUF3TGpjek56ZzRPU0F3TGpZeU1UQTRPRXd3TGpjME5UTWdNQzQxT1RnM05qVkRNQzQzTkRZNE5ERWdNQzQxT1RReE1qSWdNQzQzTlRFd09USWdNQzQxT1RBNE5EUWdNQzQzTlRVNU1EVWdNQzQxT1RBMU9EaERNQzQzTnpnek1EY2dNQzQxT0Rrek9UY2dNQzQ0TURBME9ERWdNQzQxT1RNek1qTWdNQzQ0TWpBM05pQXdMall3TWpBM1F6QXVPREkxTVRNeklEQXVOakF6T1RVMUlEQXVPREkzTnpJMklEQXVOakE0TkRZNUlEQXVPREkzTWpJeElEQXVOakV6TXpFMVREQXVPREkwTnpnMElEQXVOak0yTnpJelF6QXVPREkwTURjNUlEQXVOalF6TXpreUlEQXVPREkyTlRZeUlEQXVOalE1T0RjeklEQXVPRE14TkRjeUlEQXVOalUwTVRjM1F6QXVPRE0yTXpneUlEQXVOalU0TkRnZ01DNDRORE14TXpNZ01DNDJOakF3T1RNZ01DNDRORGsyTmpZZ01DNDJOVGcxTVRkTU1DNDROekkxTmpjZ01DNDJOVE13TWpORE1DNDROemN6TURjZ01DNDJOVEU0T0RZZ01DNDRPREl4TWpJZ01DNDJOVE00TmpVZ01DNDRPRFExTmpZZ01DNDJOVGM1TlRORE1DNDRPVFU0T1RNZ01DNDJOelk1TURZZ01DNDVNREkyT1RRZ01DNDJPVGd6TmprZ01DNDVNRFEwTlRjZ01DNDNNakEzTWpsRE1DNDVNRFE0TXpVZ01DNDNNalUxTXpJZ01DNDVNREl4TkRnZ01DNDNNekF4TnpNZ01DNDRPVGMzTlRFZ01DNDNNekl6TVROTU1DNDROelkxTWpNZ01DNDNOREkyTkRORE1DNDROekEwTlRNZ01DNDNORFUyTURFZ01DNDROall3TWpnZ01DNDNOVEV5TXlBd0xqZzJORFl3TlNBd0xqYzFOemd3TmtNd0xqZzJNekU0TWlBd0xqYzJORE00TXlBd0xqZzJORGt6SURBdU56Y3hNVEl5SURBdU9EWTVNekUySURBdU56YzFPVFU1VERBdU9EZzBOalE0SURBdU56a3lPRGM0UXpBdU9EZzNPREV4SURBdU56azJNelkzSURBdU9EZzRNemNnTUM0NE1ERTFOallnTUM0NE9EWXdORGNnTUM0NE1EVTROamxETUM0NE56VXhNak1nTUM0NE1qWXdPVGtnTUM0NE5UazNNekVnTUM0NE5ETTJOVGtnTUM0NE5ERXhNRGdnTUM0NE5UY3hNemhETUM0NE16Y3hORFlnTUM0NE5qQXdNRFlnTUM0NE16RTVNVGdnTUM0NE5qQXhNek1nTUM0NE1qZ3dORFVnTUM0NE5UYzBOVFpNTUM0NE1Ea3lPVEVnTUM0NE5EUTBPVEZETUM0NE1ETTVNVGNnTUM0NE5EQTRNREVnTUM0M09UY3dNVFlnTUM0NE16azVOallnTUM0M09UQTJPVFFnTUM0NE5ESXlORE5ETUM0M09EUXpOeklnTUM0NE5EUTFNVGtnTUM0M056a3pPQ0F3TGpnME9UWXpOU0F3TGpjM056STBOaUF3TGpnMU5qQXhOa3d3TGpjMk9UYzROU0F3TGpnM09EUXhPVU13TGpjMk9ESTBJREF1T0Rnek1EVTVJREF1TnpZek9UZzNJREF1T0RnMk16TXlJREF1TnpVNU1UYzJJREF1T0RnMk5UZzFRekF1TnpNMk56VTRJREF1T0RnM056WXhJREF1TnpFME5UY3hJREF1T0Rnek9ERTNJREF1TmprME1qZzJJREF1T0RjMU1EUTVRekF1TmpnNU9URTJJREF1T0Rjek1UWXhJREF1TmpnM016STNJREF1T0RZNE5qUTRJREF1TmpnM09ETXpJREF1T0RZek9EQTBUREF1Tmprd01qZ2dNQzQ0TkRBek5qWkRNQzQyT1RBNU9EUWdNQzQ0TXpNMk9UY2dNQzQyT0RnMU1ERWdNQzQ0TWpjeU1UWWdNQzQyT0RNMU9URWdNQzQ0TWpJNU1UTkRNQzQyTnpnMk9ERWdNQzQ0TVRnMk1Ea2dNQzQyTnpFNU15QXdMamd4TmprNU5pQXdMalkyTlRRd01pQXdMamd4T0RVM01Vd3dMalkwTWpVeE15QXdMamd5TkRBM05FTXdMall6TnpjM01TQXdMamd5TlRJeE5DQXdMall6TWprMU15QXdMamd5TXpJek5pQXdMall6TURVd09DQXdMamd4T1RFME5VTXdMall4T1RFNElEQXVPREF3TVRnNElEQXVOakV5TXpneUlEQXVOemM0TnpFNUlEQXVOakV3TmpJM0lEQXVOelUyTXpVMFF6QXVOakV3TWpVZ01DNDNOVEUxTkRrZ01DNDJNVEk1TkRJZ01DNDNORFk1TURZZ01DNDJNVGN6TkRNZ01DNDNORFEzTmpsTU1DNDJNemcwT1RrZ01DNDNNelEwT1RoRE1DNDJORFExT0RVZ01DNDNNekUxTkRFZ01DNDJORGt3TVRFZ01DNDNNalU0T1NBd0xqWTFNRFF4TkNBd0xqY3hPVEkxT1VNd0xqWTFNVGd5T0NBd0xqY3hNalkzTXlBd0xqWTFNREEzTnlBd0xqY3dOVGt5T1NBd0xqWTBOVFk1T0NBd0xqY3dNVEE0TkV3d0xqWXpNRE00TlNBd0xqWTROREUyTkVNd0xqWXlOekU0TnlBd0xqWTRNRFl6TVNBd0xqWXlOalkyTWlBd0xqWTNOVE0xTWlBd0xqWXlPVEEzTmlBd0xqWTNNVEF5T1VNd0xqWXpORFl3T1NBd0xqWTJNVEV5TVNBd0xqWTBNVEV5TnlBd0xqWTFNVGMzTkNBd0xqWTBPRGN3TWlBd0xqWTBNamt6TjFwTk1DNDNPRFl4TURFZ01DNDNPVGswTkVNd0xqZ3hPVGMyTlNBd0xqYzRNelkyTVNBd0xqZ3pOREkyTXlBd0xqYzBNelU0TVNBd0xqZ3hPRFE0TkNBd0xqY3dPVGt4T0VNd0xqZ3dNamN3TlNBd0xqWTNOakkxTlNBd0xqYzJNall5TkNBd0xqWTJNVGMxT0NBd0xqY3lPRGsySURBdU5qYzNOVE0yUXpBdU5qazFNamsySURBdU5qa3pNekUxSURBdU5qZ3dOems0SURBdU56TXpNemsySURBdU5qazJOVGMzSURBdU56WTNNRFU0UXpBdU56RXlNelUySURBdU9EQXdOekl4SURBdU56VXlORE0zSURBdU9ERTFNakU1SURBdU56ZzJNVEF4SURBdU56azVORFJhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpRNU16SWdNQzQzTmpJME9ERldNQzQzTlRZd05qUkRNQzQzTnpBeU1qWWdNQzQzTmpFek5qa2dNQzQzTmpRMk1qRWdNQzQzTmpRd01qRWdNQzQzTlRneE1Ua2dNQzQzTmpRd01qRkRNQzQzTlRJMk5ETWdNQzQzTmpRd01qRWdNQzQzTkRnME5TQXdMamMyTVRnMElEQXVOelExTlRReElEQXVOelUzTkRjMlZqQXVOemd5T0RnM1REQXVOek0wTXpjMUlEQXVOemc0TVRRNVZqQXVOamsyT0RrNVNEQXVOelExTlRReFZqQXVOek0yTkRJNFF6QXVOelExTlRReElEQXVOelF6TURFMklEQXVOelEyTmprMklEQXVOelEzTlRVeElEQXVOelE1TURBMklEQXVOelV3TURNeVF6QXVOelV4TkRBeUlEQXVOelV5TkRJNElEQXVOelUwT1RrMklEQXVOelV6TmpJMklEQXVOelU1TnpnM0lEQXVOelV6TmpJMlF6QXVOelk1T0RnMElEQXVOelV6TmpJMklEQXVOemMwT1RNeUlEQXVOelEzT1RjNUlEQXVOemMwT1RNeUlEQXVOek0yTmpnMVZqQXVOamsyT0RrNVNEQXVOemcyTURrNFZqQXVOell5TkRneFNEQXVOemMwT1RNeVdpSWdabWxzYkQwaUl6RXhRVGhEUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXlLU0krSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU16QTJOVEl5SURBdU1UVXdOakEzUXpBdU16STVNek0xSURBdU1UUXlOamM0SURBdU16VXlPVEV6SURBdU1UTTNNVFE0SURBdU16YzJPRGMxSURBdU1UTTBNVEE0UXpBdU16ZzNNek0xSURBdU1UTXlOemd4SURBdU16azNORGtnTUM0eE16Z3lOVFlnTUM0ME1ESXhOU0F3TGpFME56Y3pOa3d3TGpReU5EUTVNaUF3TGpFNU16RTRPVU13TGpRek5EY3hOU0F3TGpJeE5EQTNJREF1TkRVNE9UYzBJREF1TWpJek9UTXlJREF1TkRnd09ESTBJREF1TWpFMk1EYzVRekF1TkRnMk5qazRJREF1TWpFek9UY3lJREF1TkRreU1EWTBJREF1TWpFd05qVXpJREF1TkRrMk5qSXlJREF1TWpBMk1qa3lUREF1TlRNek1EazFJREF1TVRjeE5UYzVRekF1TlRRd05qZ3hJREF1TVRZME16WWdNQzQxTlRFNU9UWWdNQzR4TmpJM01qVWdNQzQxTmpFek1qUWdNQzR4TmpjMU1ERkRNQzQyTURRM05ESWdNQzR4T0RrM015QXdMalkwTWpVM015QXdMakl5TVRVeU5pQXdMalkzTVRrMk9TQXdMakkyTURRNU5VTXdMalkzT0RNd09DQXdMakkyT0RnNU9DQXdMalkzT0RZME5DQXdMakk0TURNNU1pQXdMalkzTWpnd05pQXdMakk0T1RFek4wd3dMalkwTkRZeE1pQXdMak16TVRNM01rTXdMall6TmpVMU9TQXdMak0wTXpNNU5DQXdMall6TkRjd05pQXdMak0xT0RVME15QXdMall6T1RZeUlEQXVNemN5TVRjeVF6QXVOalEwTlRNMElEQXVNemcxT0NBd0xqWTFOVFl5T0NBd0xqTTVOakk0TVNBd0xqWTJPVFV6SURBdU5EQXdOREEzVERBdU56RTRNakkzSURBdU5ERTBPVEk1UXpBdU56STRNekEwSURBdU5ERTNPVE0xSURBdU56TTFNemd6SURBdU5ESTJPVGs1SURBdU56TTFPRFkySURBdU5ETTNOVEUyUXpBdU56TTRNVEEwSURBdU5EZzJNalk1SURBdU56STVNamd4SURBdU5UTTBPRGd5SURBdU56RXdNRFU1SURBdU5UYzVOekF6UXpBdU56QTFPVE14SURBdU5UZzVNekk1SURBdU5qazJNVGcySURBdU5UazFNamswSURBdU5qZzFOelF6SURBdU5UazBOVGczVERBdU5qTTFNekkwSURBdU5Ua3hNVGMwUXpBdU5qSXdPVEF5SURBdU5Ua3dNakEwSURBdU5qQTJPRGc0SURBdU5UazJNVFl4SURBdU5UazNOVGMySURBdU5qQTNNakU1UXpBdU5UZzRNalkwSURBdU5qRTRNamMzSURBdU5UZzBOelkxSURBdU5qTXpNVEU0SURBdU5UZzRNVFV4SURBdU5qUTNNVGsxVERBdU5UazVPVGc0SURBdU5qazJOREk1UXpBdU5qQXlOREk1SURBdU56QTJOVGd4SURBdU5UazRNalF4SURBdU56RTNNVFkySURBdU5UZzVOVEkwSURBdU56SXlPRGM1UXpBdU5UUTROVFEwSURBdU56UTVOek14SURBdU5UQXhPRE16SURBdU56WTJOVGN6SURBdU5EVXpNVFEySURBdU56Y3lNRFV4UXpBdU5EUXlOemc1SURBdU56Y3pNakUySURBdU5ETXlPREE1SURBdU56WTNOek01SURBdU5ESTRNakVnTUM0M05UZ3pOalZNTUM0ME1EVTVNemdnTUM0M01USTVOekpETUM0ek9UazFNeklnTUM0M01EQXdNVE1nTUM0ek9EY3pOamdnTUM0Mk9UQTROakVnTUM0ek56TXhOVGtnTUM0Mk9EZ3pNRGxETUM0ek5UZzVOVEVnTUM0Mk9EVTNOVGdnTUM0ek5EUXpPRFVnTUM0Mk9UQXhNRGtnTUM0ek16TTVNekVnTUM0M01EQXdNVFJNTUM0eU9UY3lPRE1nTUM0M016UTRNalZETUM0eU9EazJPVElnTUM0M05ESXdNelVnTUM0eU56Z3pOemtnTUM0M05ETTJOaUF3TGpJMk9UQTFOeUF3TGpjek9EZzNPVU13TGpJeU5UWXlOQ0F3TGpjeE5qWXdOU0F3TGpFNE56YzRPU0F3TGpZNE5EYzJNU0F3TGpFMU9EUXdNU0F3TGpZME5UYzBNME13TGpFMU1qQTNNaUF3TGpZek56TXpPU0F3TGpFMU1UYzBNaUF3TGpZeU5UZzFJREF1TVRVM05UYzVJREF1TmpFM01URk1NQzR4T0RVNE1qRWdNQzQxTnpRNE1qZERNQzR4T1RNNE56TWdNQzQxTmpJNE1EVWdNQzR4T1RVM01qY2dNQzQxTkRjMk5UWWdNQzR4T1RBNE1UTWdNQzQxTXpRd01qaERNQzR4T0RVNE9Ua2dNQzQxTWpBek9Ua2dNQzR4TnpRNE1EUWdNQzQxTURrNU1UZ2dNQzR4TmpBNU1UVWdNQzQxTURVM09UWk1NQzR4TVRJeU15QXdMalE1TVRNd05VTXdMakV3TWpFME5pQXdMalE0T0RNd015QXdMakE1TlRBMU9Ua2dNQzQwTnpreU16VWdNQzR3T1RRMU56YzFJREF1TkRZNE56RXpRekF1TURreU16UXlJREF1TkRFNU9UVXhJREF1TVRBeE1UYzNJREF1TXpjeE16TWdNQzR4TWpBME1Ua2dNQzR6TWpZMU1EaERNQzR4TWpRMU5UTWdNQzR6TVRZNE56Z2dNQzR4TXpRek1EZ2dNQzR6TVRBNU1UWWdNQzR4TkRRM05UWWdNQzR6TVRFMk16Tk1NQzR4T1RRNU9DQXdMak14TlRBNE0wTXdMakl3T1RReU9TQXdMak14TmpBM0lEQXVNakl6TkRZNUlEQXVNekV3TURjeUlEQXVNak15TnprM0lEQXVNams0T0RnNFF6QXVNalF5TVRBeUlEQXVNamczT0RBeUlEQXVNalExTmpBeUlEQXVNamN5T1RRM0lEQXVNalF5TWpNeklEQXVNalU0T0RZeVREQXVNak13TkRNM0lEQXVNakE1TmpRNVF6QXVNakkzT1RjMElEQXVNVGs1TXpjeElEQXVNak15TXpBMElEQXVNVGc0TmpjZ01DNHlOREV5TVRJZ01DNHhPRE13TVRsRE1DNHlOakUyTXlBd0xqRTNNREEyTnlBd0xqSTRNek16TlNBd0xqRTFPVEkzSURBdU16QTJOVEl5SURBdU1UVXdOakEzV2swd0xqUXhOVFF5TWlBd0xqWXlNVGMzTTBNd0xqVXdPRFl5SURBdU5qSXhOemN6SURBdU5UZzBNVGN4SURBdU5UUTJNakl4SURBdU5UZzBNVGN4SURBdU5EVXpNREkwUXpBdU5UZzBNVGN4SURBdU16VTVPREkySURBdU5UQTROaklnTUM0eU9EUXlOelVnTUM0ME1UVTBNaklnTUM0eU9EUXlOelZETUM0ek1qSXlNak1nTUM0eU9EUXlOelVnTUM0eU5EWTJOeklnTUM0ek5UazRNallnTUM0eU5EWTJOeklnTUM0ME5UTXdNalJETUM0eU5EWTJOeklnTUM0MU5EWXlNakVnTUM0ek1qSXlNak1nTUM0Mk1qRTNOek1nTUM0ME1UVTBNaklnTUM0Mk1qRTNOek5hSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR6TnpVMk1pQXdMalE1T1RrMU9Fd3dMak0yT0RjNU5TQXdMalE0TWpFd09FZ3dMak16TkRJM05rd3dMak15TnpRMU1TQXdMalE1T1RrMU9FZ3dMak13TlRZMk5Fd3dMak0wTVRnNE9TQXdMalF3T0RBNE1VZ3dMak0yTVRBMU1Vd3dMak01TnpRd055QXdMalE1T1RrMU9FZ3dMak0zTlRZeVdrMHdMak0yTWpFd01TQXdMalEyTXpjek1rd3dMak0xTkRJeU5pQXdMalEwTXpreE0wTXdMak0xTXpBd01TQXdMalEwTURrek9DQXdMak0xTWpBNE1pQXdMalF6T0RNMU55QXdMak0xTVRRM0lEQXVORE0yTVRZNVF6QXVNelV4TVRJZ01DNDBNemMyTlRjZ01DNHpOVEF5TURFZ01DNDBOREF5TXpnZ01DNHpORGczTVRRZ01DNDBORE01TVROTU1DNHpOREE0TXprZ01DNDBOak0zTXpKSU1DNHpOakl4TURGYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME1Ea3hORFFnTUM0ME9UazVOVGhXTUM0ME1EZ3dPREZJTUM0ME5EazRNekZETUM0ME5qQTNOamdnTUM0ME1EZ3dPREVnTUM0ME5qZzRNVGdnTUM0ME1UQTVNalVnTUM0ME56TTVPQ0F3TGpReE5qWXhNa013TGpRM09USXpJREF1TkRJeU15QXdMalE0TVRnMU5TQXdMalF5T1RNZ01DNDBPREU0TlRVZ01DNDBNemMyTVRORE1DNDBPREU0TlRVZ01DNDBOREV5SURBdU5EZ3hNalF6SURBdU5EUTBOekF4SURBdU5EZ3dNREU0SURBdU5EUTRNVEV6UXpBdU5EYzROemt6SURBdU5EVXhORE00SURBdU5EYzJPVFUxSURBdU5EVTBOVFEwSURBdU5EYzBOVEExSURBdU5EVTNORE15UXpBdU5EY3lNRFUxSURBdU5EWXdNeklnTUM0ME5qZzJPRGNnTUM0ME5qSTJNemdnTUM0ME5qUXpPVGtnTUM0ME5qUXpPRGhETUM0ME5qQXhNVElnTUM0ME5qWXhNemdnTUM0ME5UVXlOVFlnTUM0ME5qY3dNVE1nTUM0ME5EazRNekVnTUM0ME5qY3dNVE5JTUM0ME1qa3dPVE5XTUM0ME9UazVOVGhJTUM0ME1Ea3hORFJhVFRBdU5EVXdOakU0SURBdU5EUTRNalEwUXpBdU5EVTBNVEU0SURBdU5EUTRNalEwSURBdU5EVTJOelF6SURBdU5EUTNNVGswSURBdU5EVTRORGt6SURBdU5EUTFNRGswUXpBdU5EWXdNalF6SURBdU5EUXlPVGswSURBdU5EWXhNVEU0SURBdU5EUXdOU0F3TGpRMk1URXhPQ0F3TGpRek56WXhNME13TGpRMk1URXhPQ0F3TGpRek5EZ3hNeUF3TGpRMk1ESTROeUF3TGpRek1qTTJNeUF3TGpRMU9EWXlOQ0F3TGpRek1ESTJNME13TGpRMU5qazJNaUF3TGpReU9EQTNOU0F3TGpRMU5ESTVNeUF3TGpReU5qazRNU0F3TGpRMU1EWXhPQ0F3TGpReU5qazRNVWd3TGpReU9UQTVNMVl3TGpRME9ESTBORWd3TGpRMU1EWXhPRm9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalE1TkRFek55QXdMalE1T1RrMU9GWXdMalF3T0RBNE1VZ3dMalV4TkRBNE4xWXdMalE1T1RrMU9FZ3dMalE1TkRFek4xb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TXpjMUlpQm9aV2xuYUhROUlqQXVPVE0zTlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1ETXhNalVnTUM0d016RXlOU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpJNE9UY3lOaUlnYUdWcFoyaDBQU0l3TGpJNE9UY3lNaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TmpFeU56a3pJREF1TlRrek56VXBJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01pSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQyTlRZeU5TSWdhR1ZwWjJoMFBTSXdMalkxTmpJMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdPRGMwTURJeklEQXVNVEkxS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODEiIHk9Ijc5LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iMTgiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjUxMyIgeT0iLTUzMiIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIxOSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTQ1YjllMzRhLTUwYWItNDBjNi04NjY2LTg0YjkyN2E4OGY5NDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTgiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI4IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj0zNGRlMDc1Yi1kNDMxLTQ0MzMtOWZjMC04M2E5MWFlNDBkZTk7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTgiIHNvdXJjZT0iMjAiIHRhcmdldD0iMTkiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjIwIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9NTI5ZTcxNWYtNjNlNi00NTdiLWJlNjktZDQ2MTcwZGY0ZDI1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjE4IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjEyIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MDAiIHk9Ii0yOSIgd2lkdGg9IjM5MSIgaGVpZ2h0PSIyNDkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIxMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTAzZDViNTRiLWQxYzgtNDQ0MS1iNWQwLWI2ZTk4OGIxZTM2Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTIiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjI0IiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj0wZDAxYjA0Ny0wZGMyLTQwZTUtOGFmNi03ZjZmNWQ1Yjc0YzE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTIiIHNvdXJjZT0iMTQiIHRhcmdldD0iMTMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjE0Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZDBhYjlmYjYtNjgyYy00NmY0LWJhYzQtMWRjMWM4Zjg2MDM5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWFwaS1nYXRld2F5LW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREVwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDJORGczTURJZ01DNDJOREk1TXpkRE1DNDJOVFl5T0RNZ01DNDJNelEwTnpnZ01DNDJOalEyT0RjZ01DNDJNalk0TURFZ01DNDJOek0zTnprZ01DNDJNakF3TTBNd0xqWTNOemMwT0NBd0xqWXhOekEzTkNBd0xqWTRNekEwTnlBd0xqWXhOamt3TmlBd0xqWTROamsyTnlBd0xqWXhPVFl4TVV3d0xqY3dOVGMyTXlBd0xqWXpNalU0TTBNd0xqY3hORE00TWlBd0xqWXpPRFUxTWlBd0xqY3lOak0xTWlBd0xqWXpOamcyTlNBd0xqY3pNelUxTnlBd0xqWXlPRFkyTVVNd0xqY3pOVFE1TlNBd0xqWXlOalExTnlBd0xqY3pOamsyT0NBd0xqWXlNemc0TnlBd0xqY3pOemc0T1NBd0xqWXlNVEE0T0V3d0xqYzBOVE1nTUM0MU9UZzNOalZETUM0M05EWTROREVnTUM0MU9UUXhNaklnTUM0M05URXdPVElnTUM0MU9UQTRORFFnTUM0M05UVTVNRFVnTUM0MU9UQTFPRGhETUM0M056Z3pNRGNnTUM0MU9Ea3pPVGNnTUM0NE1EQTBPREVnTUM0MU9UTXpNak1nTUM0NE1qQTNOaUF3TGpZd01qQTNRekF1T0RJMU1UTXpJREF1TmpBek9UVTFJREF1T0RJM056STJJREF1TmpBNE5EWTVJREF1T0RJM01qSXhJREF1TmpFek16RTFUREF1T0RJME56ZzBJREF1TmpNMk56SXpRekF1T0RJME1EYzVJREF1TmpRek16a3lJREF1T0RJMk5UWXlJREF1TmpRNU9EY3pJREF1T0RNeE5EY3lJREF1TmpVME1UYzNRekF1T0RNMk16Z3lJREF1TmpVNE5EZ2dNQzQ0TkRNeE16TWdNQzQyTmpBd09UTWdNQzQ0TkRrMk5qWWdNQzQyTlRnMU1UZE1NQzQ0TnpJMU5qY2dNQzQyTlRNd01qTkRNQzQ0Tnpjek1EY2dNQzQyTlRFNE9EWWdNQzQ0T0RJeE1qSWdNQzQyTlRNNE5qVWdNQzQ0T0RRMU5qWWdNQzQyTlRjNU5UTkRNQzQ0T1RVNE9UTWdNQzQyTnpZNU1EWWdNQzQ1TURJMk9UUWdNQzQyT1Rnek5qa2dNQzQ1TURRME5UY2dNQzQzTWpBM01qbERNQzQ1TURRNE16VWdNQzQzTWpVMU16SWdNQzQ1TURJeE5EZ2dNQzQzTXpBeE56TWdNQzQ0T1RjM05URWdNQzQzTXpJek1UTk1NQzQ0TnpZMU1qTWdNQzQzTkRJMk5ETkRNQzQ0TnpBME5UTWdNQzQzTkRVMk1ERWdNQzQ0TmpZd01qZ2dNQzQzTlRFeU15QXdMamcyTkRZd05TQXdMamMxTnpnd05rTXdMamcyTXpFNE1pQXdMamMyTkRNNE15QXdMamcyTkRreklEQXVOemN4TVRJeUlEQXVPRFk1TXpFMklEQXVOemMxT1RVNVREQXVPRGcwTmpRNElEQXVOemt5T0RjNFF6QXVPRGczT0RFeElEQXVOemsyTXpZM0lEQXVPRGc0TXpjZ01DNDRNREUxTmpZZ01DNDRPRFl3TkRjZ01DNDRNRFU0TmpsRE1DNDROelV4TWpNZ01DNDRNall3T1RrZ01DNDROVGszTXpFZ01DNDRORE0yTlRrZ01DNDROREV4TURnZ01DNDROVGN4TXpoRE1DNDRNemN4TkRZZ01DNDROakF3TURZZ01DNDRNekU1TVRnZ01DNDROakF4TXpNZ01DNDRNamd3TkRVZ01DNDROVGMwTlRaTU1DNDRNRGt5T1RFZ01DNDRORFEwT1RGRE1DNDRNRE01TVRjZ01DNDROREE0TURFZ01DNDNPVGN3TVRZZ01DNDRNems1TmpZZ01DNDNPVEEyT1RRZ01DNDROREl5TkRORE1DNDNPRFF6TnpJZ01DNDRORFExTVRrZ01DNDNOemt6T0NBd0xqZzBPVFl6TlNBd0xqYzNOekkwTmlBd0xqZzFOakF4Tmt3d0xqYzJPVGM0TlNBd0xqZzNPRFF4T1VNd0xqYzJPREkwSURBdU9EZ3pNRFU1SURBdU56WXpPVGczSURBdU9EZzJNek15SURBdU56VTVNVGMySURBdU9EZzJOVGcxUXpBdU56TTJOelU0SURBdU9EZzNOell4SURBdU56RTBOVGN4SURBdU9EZ3pPREUzSURBdU5qazBNamcySURBdU9EYzFNRFE1UXpBdU5qZzVPVEUySURBdU9EY3pNVFl4SURBdU5qZzNNekkzSURBdU9EWTROalE0SURBdU5qZzNPRE16SURBdU9EWXpPREEwVERBdU5qa3dNamdnTUM0NE5EQXpOalpETUM0Mk9UQTVPRFFnTUM0NE16TTJPVGNnTUM0Mk9EZzFNREVnTUM0NE1qY3lNVFlnTUM0Mk9ETTFPVEVnTUM0NE1qSTVNVE5ETUM0Mk56ZzJPREVnTUM0NE1UZzJNRGtnTUM0Mk56RTVNeUF3TGpneE5qazVOaUF3TGpZMk5UUXdNaUF3TGpneE9EVTNNVXd3TGpZME1qVXhNeUF3TGpneU5EQTNORU13TGpZek56YzNNU0F3TGpneU5USXhOQ0F3TGpZek1qazFNeUF3TGpneU16SXpOaUF3TGpZek1EVXdPQ0F3TGpneE9URTBOVU13TGpZeE9URTRJREF1T0RBd01UZzRJREF1TmpFeU16Z3lJREF1TnpjNE56RTVJREF1TmpFd05qSTNJREF1TnpVMk16VTBRekF1TmpFd01qVWdNQzQzTlRFMU5Ea2dNQzQyTVRJNU5ESWdNQzQzTkRZNU1EWWdNQzQyTVRjek5ETWdNQzQzTkRRM05qbE1NQzQyTXpnME9Ua2dNQzQzTXpRME9UaERNQzQyTkRRMU9EVWdNQzQzTXpFMU5ERWdNQzQyTkRrd01URWdNQzQzTWpVNE9TQXdMalkxTURReE5DQXdMamN4T1RJMU9VTXdMalkxTVRneU9DQXdMamN4TWpZM015QXdMalkxTURBM055QXdMamN3TlRreU9TQXdMalkwTlRZNU9DQXdMamN3TVRBNE5Fd3dMall6TURNNE5TQXdMalk0TkRFMk5FTXdMall5TnpFNE55QXdMalk0TURZek1TQXdMall5TmpZMk1pQXdMalkzTlRNMU1pQXdMall5T1RBM05pQXdMalkzTVRBeU9VTXdMall6TkRZd09TQXdMalkyTVRFeU1TQXdMalkwTVRFeU55QXdMalkxTVRjM05DQXdMalkwT0Rjd01pQXdMalkwTWprek4xcE5NQzQzT0RZeE1ERWdNQzQzT1RrME5FTXdMamd4T1RjMk5TQXdMamM0TXpZMk1TQXdMamd6TkRJMk15QXdMamMwTXpVNE1TQXdMamd4T0RRNE5DQXdMamN3T1RreE9FTXdMamd3TWpjd05TQXdMalkzTmpJMU5TQXdMamMyTWpZeU5DQXdMalkyTVRjMU9DQXdMamN5T0RrMklEQXVOamMzTlRNMlF6QXVOamsxTWprMklEQXVOamt6TXpFMUlEQXVOamd3TnprNElEQXVOek16TXprMklEQXVOamsyTlRjM0lEQXVOelkzTURVNFF6QXVOekV5TXpVMklEQXVPREF3TnpJeElEQXVOelV5TkRNM0lEQXVPREUxTWpFNUlEQXVOemcyTVRBeElEQXVOems1TkRSYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M056UTVNeklnTUM0M05qSTBPREZXTUM0M05UWXdOalJETUM0M056QXlNallnTUM0M05qRXpOamtnTUM0M05qUTJNakVnTUM0M05qUXdNakVnTUM0M05UZ3hNVGtnTUM0M05qUXdNakZETUM0M05USTJORE1nTUM0M05qUXdNakVnTUM0M05EZzBOU0F3TGpjMk1UZzBJREF1TnpRMU5UUXhJREF1TnpVM05EYzJWakF1TnpneU9EZzNUREF1TnpNME16YzFJREF1TnpnNE1UUTVWakF1TmprMk9EazVTREF1TnpRMU5UUXhWakF1TnpNMk5ESTRRekF1TnpRMU5UUXhJREF1TnpRek1ERTJJREF1TnpRMk5qazJJREF1TnpRM05UVXhJREF1TnpRNU1EQTJJREF1TnpVd01ETXlRekF1TnpVeE5EQXlJREF1TnpVeU5ESTRJREF1TnpVME9UazJJREF1TnpVek5qSTJJREF1TnpVNU56ZzNJREF1TnpVek5qSTJRekF1TnpZNU9EZzBJREF1TnpVek5qSTJJREF1TnpjME9UTXlJREF1TnpRM09UYzVJREF1TnpjME9UTXlJREF1TnpNMk5qZzFWakF1TmprMk9EazVTREF1TnpnMk1EazRWakF1TnpZeU5EZ3hTREF1TnpjME9UTXlXaUlnWm1sc2JEMGlJekV4UVRoRFJpSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF5S1NJK0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVNekEyTlRJeUlEQXVNVFV3TmpBM1F6QXVNekk1TXpNMUlEQXVNVFF5TmpjNElEQXVNelV5T1RFeklEQXVNVE0zTVRRNElEQXVNemMyT0RjMUlEQXVNVE0wTVRBNFF6QXVNemczTXpNMUlEQXVNVE15TnpneElEQXVNemszTkRrZ01DNHhNemd5TlRZZ01DNDBNREl4TlNBd0xqRTBOemN6Tmt3d0xqUXlORFE1TWlBd0xqRTVNekU0T1VNd0xqUXpORGN4TlNBd0xqSXhOREEzSURBdU5EVTRPVGMwSURBdU1qSXpPVE15SURBdU5EZ3dPREkwSURBdU1qRTJNRGM1UXpBdU5EZzJOams0SURBdU1qRXpPVGN5SURBdU5Ea3lNRFkwSURBdU1qRXdOalV6SURBdU5EazJOakl5SURBdU1qQTJNamt5VERBdU5UTXpNRGsxSURBdU1UY3hOVGM1UXpBdU5UUXdOamd4SURBdU1UWTBNellnTUM0MU5URTVPVFlnTUM0eE5qSTNNalVnTUM0MU5qRXpNalFnTUM0eE5qYzFNREZETUM0Mk1EUTNORElnTUM0eE9EazNNeUF3TGpZME1qVTNNeUF3TGpJeU1UVXlOaUF3TGpZM01UazJPU0F3TGpJMk1EUTVOVU13TGpZM09ETXdPQ0F3TGpJMk9EZzVPQ0F3TGpZM09EWTBOQ0F3TGpJNE1ETTVNaUF3TGpZM01qZ3dOaUF3TGpJNE9URXpOMHd3TGpZME5EWXhNaUF3TGpNek1UTTNNa013TGpZek5qVTFPU0F3TGpNME16TTVOQ0F3TGpZek5EY3dOaUF3TGpNMU9EVTBNeUF3TGpZek9UWXlJREF1TXpjeU1UY3lRekF1TmpRME5UTTBJREF1TXpnMU9DQXdMalkxTlRZeU9DQXdMak01TmpJNE1TQXdMalkyT1RVeklEQXVOREF3TkRBM1REQXVOekU0TWpJM0lEQXVOREUwT1RJNVF6QXVOekk0TXpBMElEQXVOREUzT1RNMUlEQXVOek0xTXpneklEQXVOREkyT1RrNUlEQXVOek0xT0RZMklEQXVORE0zTlRFMlF6QXVOek00TVRBMElEQXVORGcyTWpZNUlEQXVOekk1TWpneElEQXVOVE0wT0RneUlEQXVOekV3TURVNUlEQXVOVGM1TnpBelF6QXVOekExT1RNeElEQXVOVGc1TXpJNUlEQXVOamsyTVRnMklEQXVOVGsxTWprMElEQXVOamcxTnpReklEQXVOVGswTlRnM1REQXVOak0xTXpJMElEQXVOVGt4TVRjMFF6QXVOakl3T1RBeUlEQXVOVGt3TWpBMElEQXVOakEyT0RnNElEQXVOVGsyTVRZeElEQXVOVGszTlRjMklEQXVOakEzTWpFNVF6QXVOVGc0TWpZMElEQXVOakU0TWpjM0lEQXVOVGcwTnpZMUlEQXVOak16TVRFNElEQXVOVGc0TVRVeElEQXVOalEzTVRrMVREQXVOVGs1T1RnNElEQXVOamsyTkRJNVF6QXVOakF5TkRJNUlEQXVOekEyTlRneElEQXVOVGs0TWpReElEQXVOekUzTVRZMklEQXVOVGc1TlRJMElEQXVOekl5T0RjNVF6QXVOVFE0TlRRMElEQXVOelE1TnpNeElEQXVOVEF4T0RNeklEQXVOelkyTlRjeklEQXVORFV6TVRRMklEQXVOemN5TURVeFF6QXVORFF5TnpnNUlEQXVOemN6TWpFMklEQXVORE15T0RBNUlEQXVOelkzTnpNNUlEQXVOREk0TWpFZ01DNDNOVGd6TmpWTU1DNDBNRFU1TXpnZ01DNDNNVEk1TnpKRE1DNHpPVGsxTXpJZ01DNDNNREF3TVRNZ01DNHpPRGN6TmpnZ01DNDJPVEE0TmpFZ01DNHpOek14TlRrZ01DNDJPRGd6TURsRE1DNHpOVGc1TlRFZ01DNDJPRFUzTlRnZ01DNHpORFF6T0RVZ01DNDJPVEF4TURrZ01DNHpNek01TXpFZ01DNDNNREF3TVRSTU1DNHlPVGN5T0RNZ01DNDNNelE0TWpWRE1DNHlPRGsyT1RJZ01DNDNOREl3TXpVZ01DNHlOemd6TnprZ01DNDNORE0yTmlBd0xqSTJPVEExTnlBd0xqY3pPRGczT1VNd0xqSXlOVFl5TkNBd0xqY3hOall3TlNBd0xqRTROemM0T1NBd0xqWTRORGMyTVNBd0xqRTFPRFF3TVNBd0xqWTBOVGMwTTBNd0xqRTFNakEzTWlBd0xqWXpOek16T1NBd0xqRTFNVGMwTWlBd0xqWXlOVGcxSURBdU1UVTNOVGM1SURBdU5qRTNNVEZNTUM0eE9EVTRNakVnTUM0MU56UTRNamRETUM0eE9UTTROek1nTUM0MU5qSTRNRFVnTUM0eE9UVTNNamNnTUM0MU5EYzJOVFlnTUM0eE9UQTRNVE1nTUM0MU16UXdNamhETUM0eE9EVTRPVGtnTUM0MU1qQXpPVGtnTUM0eE56UTRNRFFnTUM0MU1EazVNVGdnTUM0eE5qQTVNVFVnTUM0MU1EVTNPVFpNTUM0eE1USXlNeUF3TGpRNU1UTXdOVU13TGpFd01qRTBOaUF3TGpRNE9ETXdNeUF3TGpBNU5UQTFPVGtnTUM0ME56a3lNelVnTUM0d09UUTFOemMxSURBdU5EWTROekV6UXpBdU1Ea3lNelF5SURBdU5ERTVPVFV4SURBdU1UQXhNVGMzSURBdU16Y3hNek1nTUM0eE1qQTBNVGtnTUM0ek1qWTFNRGhETUM0eE1qUTFOVE1nTUM0ek1UWTROemdnTUM0eE16UXpNRGdnTUM0ek1UQTVNVFlnTUM0eE5EUTNOVFlnTUM0ek1URTJNek5NTUM0eE9UUTVPQ0F3TGpNeE5UQTRNME13TGpJd09UUXlPU0F3TGpNeE5qQTNJREF1TWpJek5EWTVJREF1TXpFd01EY3lJREF1TWpNeU56azNJREF1TWprNE9EZzRRekF1TWpReU1UQXlJREF1TWpnM09EQXlJREF1TWpRMU5qQXlJREF1TWpjeU9UUTNJREF1TWpReU1qTXpJREF1TWpVNE9EWXlUREF1TWpNd05ETTNJREF1TWpBNU5qUTVRekF1TWpJM09UYzBJREF1TVRrNU16Y3hJREF1TWpNeU16QTBJREF1TVRnNE5qY2dNQzR5TkRFeU1USWdNQzR4T0RNd01UbERNQzR5TmpFMk15QXdMakUzTURBMk55QXdMakk0TXpNek5TQXdMakUxT1RJM0lEQXVNekEyTlRJeUlEQXVNVFV3TmpBM1drMHdMalF4TlRReU1pQXdMall5TVRjM00wTXdMalV3T0RZeUlEQXVOakl4TnpjeklEQXVOVGcwTVRjeElEQXVOVFEyTWpJeElEQXVOVGcwTVRjeElEQXVORFV6TURJMFF6QXVOVGcwTVRjeElEQXVNelU1T0RJMklEQXVOVEE0TmpJZ01DNHlPRFF5TnpVZ01DNDBNVFUwTWpJZ01DNHlPRFF5TnpWRE1DNHpNakl5TWpNZ01DNHlPRFF5TnpVZ01DNHlORFkyTnpJZ01DNHpOVGs0TWpZZ01DNHlORFkyTnpJZ01DNDBOVE13TWpSRE1DNHlORFkyTnpJZ01DNDFORFl5TWpFZ01DNHpNakl5TWpNZ01DNDJNakUzTnpNZ01DNDBNVFUwTWpJZ01DNDJNakUzTnpOYUlpQm1hV3hzUFNJak1URkJPRU5HSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek56VTJNaUF3TGpRNU9UazFPRXd3TGpNMk9EYzVOU0F3TGpRNE1qRXdPRWd3TGpNek5ESTNOa3d3TGpNeU56UTFNU0F3TGpRNU9UazFPRWd3TGpNd05UWTJORXd3TGpNME1UZzRPU0F3TGpRd09EQTRNVWd3TGpNMk1UQTFNVXd3TGpNNU56UXdOeUF3TGpRNU9UazFPRWd3TGpNM05UWXlXazB3TGpNMk1qRXdNU0F3TGpRMk16Y3pNa3d3TGpNMU5ESXlOaUF3TGpRME16a3hNME13TGpNMU16QXdNU0F3TGpRME1Ea3pPQ0F3TGpNMU1qQTRNaUF3TGpRek9ETTFOeUF3TGpNMU1UUTNJREF1TkRNMk1UWTVRekF1TXpVeE1USWdNQzQwTXpjMk5UY2dNQzR6TlRBeU1ERWdNQzQwTkRBeU16Z2dNQzR6TkRnM01UUWdNQzQwTkRNNU1UTk1NQzR6TkRBNE16a2dNQzQwTmpNM016SklNQzR6TmpJeE1ERmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBNRGt4TkRRZ01DNDBPVGs1TlRoV01DNDBNRGd3T0RGSU1DNDBORGs0TXpGRE1DNDBOakEzTmpnZ01DNDBNRGd3T0RFZ01DNDBOamc0TVRnZ01DNDBNVEE1TWpVZ01DNDBOek01T0NBd0xqUXhOall4TWtNd0xqUTNPVEl6SURBdU5ESXlNeUF3TGpRNE1UZzFOU0F3TGpReU9UTWdNQzQwT0RFNE5UVWdNQzQwTXpjMk1UTkRNQzQwT0RFNE5UVWdNQzQwTkRFeUlEQXVORGd4TWpReklEQXVORFEwTnpBeElEQXVORGd3TURFNElEQXVORFE0TVRFelF6QXVORGM0TnpreklEQXVORFV4TkRNNElEQXVORGMyT1RVMUlEQXVORFUwTlRRMElEQXVORGMwTlRBMUlEQXVORFUzTkRNeVF6QXVORGN5TURVMUlEQXVORFl3TXpJZ01DNDBOamcyT0RjZ01DNDBOakkyTXpnZ01DNDBOalF6T1RrZ01DNDBOalF6T0RoRE1DNDBOakF4TVRJZ01DNDBOall4TXpnZ01DNDBOVFV5TlRZZ01DNDBOamN3TVRNZ01DNDBORGs0TXpFZ01DNDBOamN3TVROSU1DNDBNamt3T1ROV01DNDBPVGs1TlRoSU1DNDBNRGt4TkRSYVRUQXVORFV3TmpFNElEQXVORFE0TWpRMFF6QXVORFUwTVRFNElEQXVORFE0TWpRMElEQXVORFUyTnpReklEQXVORFEzTVRrMElEQXVORFU0TkRreklEQXVORFExTURrMFF6QXVORFl3TWpReklEQXVORFF5T1RrMElEQXVORFl4TVRFNElEQXVORFF3TlNBd0xqUTJNVEV4T0NBd0xqUXpOell4TTBNd0xqUTJNVEV4T0NBd0xqUXpORGd4TXlBd0xqUTJNREk0TnlBd0xqUXpNak0yTXlBd0xqUTFPRFl5TkNBd0xqUXpNREkyTTBNd0xqUTFOamsyTWlBd0xqUXlPREEzTlNBd0xqUTFOREk1TXlBd0xqUXlOams0TVNBd0xqUTFNRFl4T0NBd0xqUXlOams0TVVnd0xqUXlPVEE1TTFZd0xqUTBPREkwTkVnd0xqUTFNRFl4T0ZvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRNU5ERXpOeUF3TGpRNU9UazFPRll3TGpRd09EQTRNVWd3TGpVeE5EQTROMVl3TGpRNU9UazFPRWd3TGpRNU5ERXpOMW9pSUdacGJHdzlJaU14TVVFNFEwWWlMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NU16YzFJaUJvWldsbmFIUTlJakF1T1RNM05TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRE14TWpVZ01DNHdNekV5TlNraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqSTRPVGN5TmlJZ2FHVnBaMmgwUFNJd0xqSTRPVGN5TWlJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU5qRXlOemt6SURBdU5Ua3pOelVwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNaUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0Mk5UWXlOU0lnYUdWcFoyaDBQU0l3TGpZMU5qSTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3T0RjME1ESXpJREF1TVRJMUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjEyIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI3OS41IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNjExIiB5PSItMzY1IiB3aWR0aD0iNzY5IiBoZWlnaHQ9IjQwOCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNDEiIHZhbHVlPSJTUEEgT3BlcmFjaW9uZXMgUGVuZGllbnRlcyAtPiBEYXJ3aW4gR2F0ZXdheSBXZWIiIHN0eWxlPSJpci5yZWY9ZGFlYThkMTYtZmQxNS00YjI5LTljZDEtMmRjNWNiNTExZjk5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjMzIiBzb3VyY2U9IjIzIiB0YXJnZXQ9IjI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU1BBIE9wZXJhY2lvbmVzIFBlbmRpZW50ZXMiIGlkPSIyMyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWExMmY0OWE1LTA0MWEtNGM0Yy1iYzNmLWVlNjYyOTg5OTJkZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2OCIgeT0iMTI3IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkJGRiIgaWQ9IjIxIj48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZjNjZjQ4MDktNGIwYy00ZWI3LWJjNDAtN2IxMTE3NmU4ZjBjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NTYiIHk9IjU4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxvYmplY3QgbGFiZWw9IkJhYVMiIGlkPSIyNCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTg2YTMzYzgzLWUwZGItNDE4Yi1hODQ4LTMwMDNkM2ViNzhmYTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMzMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTU3IiB5PSIyMjciIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDIiIHZhbHVlPSJEYXJ3aW4gR2F0ZXdheSBXZWIgLT4gQkZGIiBzdHlsZT0iaXIucmVmPWNlNzNlOTdhLThhYzgtNDQwMy05YjhmLTE0YTE3ZDdmNzAxNDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIzMyIgc291cmNlPSIyNiIgdGFyZ2V0PSIyMSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxvYmplY3QgbGFiZWw9IkRhcndpbiBHYXRld2F5IFdlYiIgaWQ9IjI2Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9Y2ZmNWU4ZjMtOTQyMi00NjRlLThjZmMtZTcyMTc4NDVjZThjO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMjgiIHk9IjU4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjU3IiB2YWx1ZT0iRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMgLT4gQmFhUyIgc3R5bGU9ImlyLnJlZj1hY2QwMzM3Yy01YmY3LTQzOWUtYWEyNC1kYTk4MTQwODUzOTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMzMiIHNvdXJjZT0iMjUiIHRhcmdldD0iMjQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgaWQ9IjI1Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9ZWFiYjM1ZTUtOWY3Ni00Y2M3LTgyNTQtNGZlYjZjOTBmYzg4O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1pY3Jvc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0MU56SXpOVGtnTUM0Mk1EY3dOamxXTUM0MU56VXdOamxETUM0MU5EZzRPVElnTUM0Mk1ERTFNak1nTUM0MU1qQTVORFVnTUM0Mk1UUTNORGtnTUM0ME9EZzFNVGdnTUM0Mk1UUTNORGxETUM0ME5qRXlNVEVnTUM0Mk1UUTNORGtnTUM0ME5EQXpNRFFnTUM0Mk1ETTROamtnTUM0ME1qVTNPVGdnTUM0MU9ESXhNRGxXTUM0M01EZzRNamxNTUM0ek56QXhNVGNnTUM0M016VXdOamxXTUM0eU9EQXdNamxJTUM0ME1qVTNPVGhXTUM0ME56Y3hORGxETUM0ME1qVTNPVGdnTUM0MU1UQXdNRE1nTUM0ME16RTFOVGdnTUM0MU16STJNVFlnTUM0ME5ETXdOemdnTUM0MU5EUTVPRGxETUM0ME5UVXdNalVnTUM0MU5UWTVNellnTUM0ME56STVORFVnTUM0MU5qSTVNRGtnTUM0ME9UWTRNemdnTUM0MU5qSTVNRGxETUM0MU5EY3hPRFVnTUM0MU5qSTVNRGtnTUM0MU56SXpOVGtnTUM0MU16UTNORGtnTUM0MU56SXpOVGtnTUM0ME56ZzBNamxXTUM0eU9EQXdNamxJTUM0Mk1qZ3dNemxXTUM0Mk1EY3dOamxJTUM0MU56SXpOVGxhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIzMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIzMjgiIHk9IjIyNyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIzNSIgdmFsdWU9IkJGRiAtPiBJQk0gRGIyIiBzdHlsZT0iaXIucmVmPWQ2YjVlNGNmLWNiNjUtNGE0ZS04YTU0LTc0MWM2ZjlmOGQyNDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIxIiBzb3VyY2U9IjIxIiB0YXJnZXQ9IjU1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij48bXhQb2ludCB4PSIyMjEiIHk9Ii01MTgiIGFzPSJ0YXJnZXRQb2ludCIvPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMTAiIHk9Ii0xNzgiLz48bXhQb2ludCB4PSIyMjAiIHk9Ii0xNzgiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNiIgdmFsdWU9IkJhYVMgLT4gSUJNIERiMiIgc3R5bGU9ImlyLnJlZj1lODI1MDNkNy1lMWUwLTQ2ZTAtOTNkZi1iZmYyMjA0YjU3OGE7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0wO2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDsiIHBhcmVudD0iMSIgc291cmNlPSIyNCIgdGFyZ2V0PSI1NSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgeD0iMjI0IiB5PSItNTE4IiBhcz0idGFyZ2V0UG9pbnQiLz48QXJyYXkgYXM9InBvaW50cyI+PG14UG9pbnQgeD0iLTkiIHk9Ii0xNzciLz48bXhQb2ludCB4PSIyMjAiIHk9Ii0xNzciLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzNyIgdmFsdWU9IkJhYVMgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9ZWE4YWI3ODctOGYyYy00NTE1LTgxNTAtOTIyYTgzZTI0NDRlO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjQiIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzOCIgdmFsdWU9IkJhYVMgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9NGY0OWYzMzQtMDZjMi00MWYwLTlmNTctODY0YmJkNGNmYmE5O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMjQiIHRhcmdldD0iMTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSIzMTUiIHk9Ii05MyIvPjxteFBvaW50IHg9IjMxNSIgeT0iOTYiLz48L0FycmF5PjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIzOSIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFNpc3RlbWFzIC0+IERhcndpbiBHYXRld2F5IFNpc3RlbWFzIiBzdHlsZT0iaXIucmVmPTBlY2YxZmIyLWIzZjktNGQwOC1iNTM4LTViNjMwMDllNDE1NDtlZGdlU3R5bGU9b3J0aG9nb25hbEVkZ2VTdHlsZTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjc1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjU7ZW50cnlZPTE7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxNCIgdGFyZ2V0PSIyNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQwIiB2YWx1ZT0iQ2xpZW50ZXMgLT4gU1BBIE9wZXJhY2lvbmVzIFBlbmRpZW50ZXMiIHN0eWxlPSJpci5yZWY9NjY0MTUyMDgtNzBjMC00Mjk4LWFlMjctZWU4ZTdkYjQ0Y2UzO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMiIgdGFyZ2V0PSIyMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNzk1IiB5PSIyNjciIHdpZHRoPSI2OTAiIGhlaWdodD0iMzA1IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJCRkYiIGlkPSI0NCI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTFiMDQxMTQ0LWFiOTAtNDJjMS1hM2FlLTExMGUxZTIzODIyYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iNDMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTExIiB5PSIxMDcuNSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSI1MCIgdmFsdWU9IkRhcndpbiBHYXRld2F5IFdlYiAtPiBCRkYiIHN0eWxlPSJpci5yZWY9NjIxYTQ3Y2YtOTk2ZC00YmU5LWEyMTYtZTQzOTI5ZWYxZGQ0O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQzIiBzb3VyY2U9IjQ1IiB0YXJnZXQ9IjQ0IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iRGFyd2luIEdhdGV3YXkgV2ViIiBpZD0iNDUiPjxteENlbGwgc3R5bGU9ImlyLnJlZj0zODdkZTU3YS02YjA3LTRmNjQtOTgyNi1lYzBiZmQyN2RlYjg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjI5NyIgeT0iMTA3LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDkiIHZhbHVlPSJTUEEgQXV0b3JpemFjacOzbiBkZSBPcGVyYWNpb25lcyAtPiBEYXJ3aW4gR2F0ZXdheSBXZWIiIHN0eWxlPSJpci5yZWY9NzNhMWIyY2MtMjZkNi00ZjA0LTg4MDItMDcwMjE2NGRlNTU3O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjQzIiBzb3VyY2U9IjQ3IiB0YXJnZXQ9IjQ1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU1BBIEF1dG9yaXphY2nDs24gZGUgT3BlcmFjaW9uZXMiIGlkPSI0NyI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPWQ4YmQ0MDI1LWQzNDMtNGEyOC05OTE5LTAxMmZiNTY3OTZlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI0MyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI4MyIgeT0iMTA3LjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG14Q2VsbCBpZD0iNDgiIHZhbHVlPSJDbGllbnRlcyAtPiBTUEEgQXV0b3JpemFjacOzbiBkZSBPcGVyYWNpb25lcyIgc3R5bGU9ImlyLnJlZj0yNjg2OGVkMy1hOGE3LTRjMmEtOWM4ZS00M2UyNTFhYWVjMTY7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIyIiB0YXJnZXQ9IjQ3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTIiIHZhbHVlPSJCRkYgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9MjAyNzhmMGQtY2ZkMi00YjNjLWExZjUtNDVkOTU4NGFmODQxO2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC41O2VudHJ5WT0xO2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDQiIHRhcmdldD0iMjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1MyIgdmFsdWU9IkJGRiAtPiBEYXJ3aW4gR2F0ZXdheSBTaXN0ZW1hcyIgc3R5bGU9ImlyLnJlZj03YzkwMzQyMi04NDNiLTQ2YmEtODFjOC0wNDE4OTdjMThmM2Q7ZWRnZVN0eWxlPW9ydGhvZ29uYWxFZGdlU3R5bGU7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI0NCIgdGFyZ2V0PSI3IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNTQiIHZhbHVlPSJCRkYgLT4gRGFyd2luIEdhdGV3YXkgU2lzdGVtYXMiIHN0eWxlPSJpci5yZWY9MWI2MWU4ZjEtMGZjOS00NTg5LTgzM2MtZGU1ODU4NmJlZjY2O2VkZ2VTdHlsZT1vcnRob2dvbmFsRWRnZVN0eWxlO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDQiIHRhcmdldD0iMjAiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPjxBcnJheSBhcz0icG9pbnRzIj48bXhQb2ludCB4PSItMjM5IiB5PSI1MjMiLz48bXhQb2ludCB4PSIzNzQiIHk9IjUyMyIvPjxteFBvaW50IHg9IjM3NCIgeT0iLTQwNyIvPjwvQXJyYXk+PC9teEdlb21ldHJ5PjwvbXhDZWxsPjxteENlbGwgaWQ9IjU2IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxMDUiIHk9Ii03MTEiIHdpZHRoPSIyMzAiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI1NSIgdmFsdWU9IklCTSBEYjIiIHN0eWxlPSJpci5yZWY9ODc5YzgyNjYtMGYzNy00ZTM0LWJhMzgtOWI3MjY4ZDQ5NjRmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUlCTS1EQjI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdYekl6TVROZk1qSXpOelFwSWo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpjek5qVTFNU0F3TGpRek1qTTVPRU13TGpjMU9URTFNU0F3TGpReU1UUXpJREF1Tnpnd01UYzVJREF1TkRBM05UUTRJREF1TnprNU1EZzBJREF1TXpreE1URXpWakF1TnpJeE56azBRekF1TnprNU1EZzBJREF1T0RBek5EYzJJREF1TmpZMU1URTNJREF1T0RZNU5qTTBJREF1TkRrNU9EZzBJREF1T0RZNU5qTTBRekF1TXpNME5qVWdNQzQ0TmprMk16UWdNQzR5TURBMk9EUWdNQzQ0TURNME56WWdNQzR5TURBMk9EUWdNQzQzTWpFM09UUldNQzR6T1RFeE1UTkRNQzR5TVRrMU9EZ2dNQzQwTURjMU5EZ2dNQzR5TkRBMk1UWWdNQzQwTWpFME15QXdMakkyTXpJeE5pQXdMalF6TWpNNU9FTXdMak15TmpjeU1pQXdMalEyTXpjMElEQXVOREV3TkRJeklEQXVORGd4TlRVMElEQXVORGs1T0RnMElEQXVORGd4TlRVMFF6QXVOVGc1TXpRMElEQXVORGd4TlRVMElEQXVOamN6TURRMklEQXVORFl6TnpRZ01DNDNNelkxTlRFZ01DNDBNekl6T1RoYUlpQm1hV3hzUFNJak1EQTVRVEpESWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M016WTFOVEVnTUM0ME16SXpPVGhETUM0M05Ua3hOVEVnTUM0ME1qRTBNeUF3TGpjNE1ERTNPU0F3TGpRd056VTBPQ0F3TGpjNU9UQTROQ0F3TGpNNU1URXhNMVl3TGpVM01qRTVORU13TGpjNU9UQTROQ0F3TGpZMU16ZzNOaUF3TGpZMk5URXhOeUF3TGpjeU1EQXpOQ0F3TGpRNU9UZzROQ0F3TGpjeU1EQXpORU13TGpNek5EWTFJREF1TnpJd01ETTBJREF1TWpBd05qZzBJREF1TmpVek9EYzJJREF1TWpBd05qZzBJREF1TlRjeU1UazBWakF1TXpreE1URXpRekF1TWpFNU5UZzRJREF1TkRBM05UUTRJREF1TWpRd05qRTJJREF1TkRJeE5ETWdNQzR5TmpNeU1UWWdNQzQwTXpJek9UaERNQzR6TWpZM01qSWdNQzQwTmpNM05DQXdMalF4TURReU15QXdMalE0TVRVMU5DQXdMalE1T1RnNE5DQXdMalE0TVRVMU5FTXdMalU0T1RNME5DQXdMalE0TVRVMU5DQXdMalkzTXpBME5pQXdMalEyTXpjMElEQXVOek0yTlRVeElEQXVORE15TXprNFdpSWdabWxzYkQwaVlteGhZMnNpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJNU56ZzFNaUF3TGpRNU1UTTJOME13TGpNeU16UTRPU0F3TGpRNU56Y3dPQ0F3TGpNME9UTXpOaUF3TGpVd016Z3hOaUF3TGpNM05UTTVNaUF3TGpVd09UWTVRekF1TXpjMU5qVXpJREF1TlRFeU9EWXhJREF1TXpjMU9URTFJREF1TlRFMk1EVTNJREF1TXpjMk1UYzNJREF1TlRFNU1qaERNQzR6TkRrNU5qUWdNQzQxTVRNM055QXdMak15TXprMklEQXVOVEE0TURJMklEQXVNams0TVRZMUlEQXVOVEF5TURRNVF6QXVNams0TURZeElEQXVORGs0TkRZeUlEQXVNamszT1RVMklEQXVORGswT1RBeUlEQXVNamszT0RVeUlEQXVORGt4TXpZM1drMHdMak00TmpZNU15QXdMalV4TVRrMU1VTXdMak00TmprMU5TQXdMalV4TlRBeE9DQXdMak00TnpJeE5pQXdMalV4T0RFMk1pQXdMak00TnpRM09DQXdMalV5TVRNNE5VTXdMalF5TmpNZ01DNDFNalkyT0RjZ01DNDBOalU0TWprZ01DNDFNekF5TWpJZ01DNDFNRFl3TmpRZ01DNDFNekU1T0RsRE1DNDFNRFl3TmpRZ01DNDFNekU1T0RrZ01DNDBPVEk0TURFZ01DNDFNak13TWpNZ01DNDBOelkzTVRJZ01DNDFNakkxTlRWRE1DNDBORFl4TlRZZ01DNDFNakF3TURnZ01DNDBNVFl4TlNBd0xqVXhOalEzTXlBd0xqTTROalk1TXlBd0xqVXhNVGsxTVZwTk1DNDFNekEzTURnZ01DNDFNakkwTnpkRE1DNDFNekEzTURnZ01DNDFNalUwTkNBd0xqVXpNRGN3T0NBd0xqVXlPRFF3TWlBd0xqVXpNRGN3T0NBd0xqVXpNVE0yTlVNd0xqVTFOVFkyTlNBd0xqVXlPVFU1T0NBd0xqVTRNREkxTmlBd0xqVXlOekl3TnlBd0xqWXdORFE0TVNBd0xqVXlOREU1TWtNd0xqWXdNelF6TkNBd0xqVXlNVEk0TVNBd0xqWXdNalEwSURBdU5URTRNemNnTUM0Mk1ERTBPVGdnTUM0MU1UVTBOVGxETUM0MU56Z3lNVFVnTUM0MU1UZ3pOeUF3TGpVMU5EWXhPQ0F3TGpVeU1EY3dPU0F3TGpVek1EY3dPQ0F3TGpVeU1qUTNOMXBOTUM0M01URTBOVElnTUM0ME9URXlNVEZETUM0Mk9USTNOek1nTUM0ME9UWXdPVGNnTUM0Mk56TTNNamdnTUM0MU1EQTROemtnTUM0Mk5UUXpNVGNnTUM0MU1EVTFOVGRETUM0Mk5USTFNemdnTUM0MU1Ea3dPVElnTUM0Mk5UQTRNVEVnTUM0MU1USTJOVE1nTUM0Mk5Ea3hNemNnTUM0MU1UWXlNemxETUM0Mk56QXdOalVnTUM0MU1URTFNRGtnTUM0Mk9UQTFOelVnTUM0MU1EWTNNREVnTUM0M01UQTJOamNnTUM0MU1ERTRNVFZETUM0M01UQTVNamdnTUM0ME9UZ3lPQ0F3TGpjeE1URTVJREF1TkRrME56UTJJREF1TnpFeE5EVXlJREF1TkRreE1qRXhXazB3TGpJNU9EUTNPU0F3TGpVeE1qSTJNME13TGpNeU5EUXpNU0F3TGpVeE56azRNU0F3TGpNMU1EVTJOU0F3TGpVeU16UTJOQ0F3TGpNM05qZzRNeUF3TGpVeU9EY3hORU13TGpNM056QTVNaUF3TGpVek1qQTVNeUF3TGpNM056TXdNU0F3TGpVek5UUTNNaUF3TGpNM056VXhNU0F3TGpVek9EZzFRekF1TXpVeE1EZzVJREF1TlRNek9EWWdNQzR6TWpRNE5Ea2dNQzQxTWpnMk16WWdNQzR5T1RnM09UTWdNQzQxTWpNeE56aERNQzR5T1RnMk9Ea2dNQzQxTVRrMU5DQXdMakk1T0RVNE5DQXdMalV4TlRrd01TQXdMakk1T0RRM09TQXdMalV4TWpJMk0xcE5NQzR6T0RnNE9URWdNQzQxTkRBNFF6QXVORE15TXpjZ01DNDFORFU1TkRZZ01DNDBOelkwTnpjZ01DNDFORGt3TXpnZ01DNDFNakV5TVRFZ01DNDFOVEF3TnpoRE1DNDFNakV5TVRFZ01DNDFOVEF3TnpnZ01DNDFNVGszT1RrZ01DNDFOREkxT1RNZ01DNDFNVFkyTlRrZ01DNDFOREEyTkRSRE1DNDBOek13TnpZZ01DNDFNemt6TkRRZ01DNDBNekF5TnpjZ01DNDFNell3TmprZ01DNHpPRGd5TmpNZ01DNDFNekE0TWtNd0xqTTRPRFEzTWlBd0xqVXpOREUwTmlBd0xqTTRPRFk0TVNBd0xqVXpOelEzTXlBd0xqTTRPRGc1TVNBd0xqVTBNRGhhVFRBdU5UTXdOekE0SURBdU5UUTVOelkyUXpBdU5UVTNOakF4SURBdU5UUTNPRGsxSURBdU5UZzBNVEk0SURBdU5UUTFNelE0SURBdU5qRXdNamc0SURBdU5UUXlNVEkxUXpBdU5qQTVORFV4SURBdU5UTTRPVFUwSURBdU5qQTROVGc0SURBdU5UTTFPREVnTUM0Mk1EYzJPVGdnTUM0MU16STJPVEZETUM0MU9ESTBNamNnTUM0MU16VTRNU0F3TGpVMU5qYzJOQ0F3TGpVek9ETXdOU0F3TGpVek1EY3dPQ0F3TGpVME1ERTNOa013TGpVek1EY3dPQ0F3TGpVME16TTBOeUF3TGpVek1EY3dPQ0F3TGpVME5qVTBNeUF3TGpVek1EY3dPQ0F3TGpVME9UYzJObHBOTUM0M01EazFOamdnTUM0MU1qSTNNVEZETUM0M01EazNOemNnTUM0MU1Ua3hNalFnTUM0M01EazVOaUF3TGpVeE5UVXpOeUF3TGpjeE1ERXhOeUF3TGpVeE1UazFNVU13TGpZNE9EVXdPU0F3TGpVeE5qZzRPU0F3TGpZMk5qUTFOU0F3TGpVeU1UY3lNeUF3TGpZME16azFOeUF3TGpVeU5qUTFNME13TGpZME1qUTVNaUF3TGpVek1EQTBJREF1TmpReE1EVXpJREF1TlRNek5qSTJJREF1TmpNNU5qUXhJREF1TlRNM01qRXpRekF1TmpZek16azBJREF1TlRNeU5UTTFJREF1TmpnMk56QTBJREF1TlRJM056QXhJREF1TnpBNU5UWTRJREF1TlRJeU56RXhXazB3TGpNeU1UY3hJREF1TlRNM05USTFRekF1TXpNek1EWTBJREF1TlRNNU56WWdNQzR6TkRRME55QXdMalUwTVRrMk9TQXdMak0xTlRreU9DQXdMalUwTkRFMU1rTXdMak0xTmpBNE5TQXdMalUwTnpZNE55QXdMak0xTmpJeE5pQXdMalUxTVRJeU1pQXdMak0xTmpNeU1TQXdMalUxTkRjMU5rTXdMak0wTkRnMk1pQXdMalUxTWpZeU5TQXdMak16TXpReklEQXVOVFV3TkRZNElEQXVNekl5TURJMElEQXVOVFE0TWpnMVF6QXVNekl4T1RFNUlEQXVOVFEwTmprNElEQXVNekl4T0RFMUlEQXVOVFF4TVRFeUlEQXVNekl4TnpFZ01DNDFNemMxTWpWYVRUQXVOREV5T1RnMUlEQXVOVFV6TWpjMVF6QXVOREkwTnpVM0lEQXVOVFUwTmpJMklEQXVORE0yTlRneUlEQXVOVFUxT0RRNElEQXVORFE0TkRVNElEQXVOVFUyT1RNNVF6QXVORFE0TmpZNElEQXVOVFl3TXpjZ01DNDBORGc0TlRFZ01DNDFOak0zTnpVZ01DNDBORGt3TURnZ01DNDFOamN4TlRORE1DNDBNemN4T0RNZ01DNDFOall4TVRRZ01DNDBNalV6T0RVZ01DNDFOalE1TkRRZ01DNDBNVE0yTVRJZ01DNDFOak0yTkRWRE1DNDBNVE0wTURNZ01DNDFOakF4TmpJZ01DNDBNVE14T1RRZ01DNDFOVFkzTURVZ01DNDBNVEk1T0RVZ01DNDFOVE15TnpWYVRUQXVORGcwTWpRMklEQXVOVFk1TURJMVF6QXVORGsyTWpJNElEQXVOVFk1TVRneElEQXVOVEE0TWpBNUlEQXVOVFk1TVRneElEQXVOVEl3TVRreElEQXVOVFk1TURJMVF6QXVOVEl3TVRreElEQXVOVFk1TURJMUlEQXVOVEl5TmpJMElEQXVOVFl6TlRZM0lEQXVOVEl5TlRRMUlEQXVOVFU0T0RnNVF6QXVOVEE1TmpJeUlEQXVOVFU1TURRMUlEQXVORGsyTmprNUlEQXVOVFU1TURRMUlEQXVORGd6TnpjMUlEQXVOVFU0T0RnNVF6QXVORGd6T0RnZ01DNDFOakl5TmpjZ01DNDBPRFF3TVRFZ01DNDFOalUyTkRZZ01DNDBPRFF4TmpnZ01DNDFOamt3TWpWRE1DNDBPRFF5TWlBd0xqVTJPVEF5TlNBd0xqUTROREkwTmlBd0xqVTJPVEF5TlNBd0xqUTROREkwTmlBd0xqVTJPVEF5TlZwTk1DNDFOVFV3TXpjZ01DNDFOVGN4TnpORE1DNDFOVFE1T0RVZ01DNDFOakEyTURRZ01DNDFOVFE1TlRrZ01DNDFOalF3TURrZ01DNDFOVFE1TlRrZ01DNDFOamN6T0RkRE1DNDFOelU0TXpVZ01DNDFOalUwTVRJZ01DNDFPVFkwTnpVZ01DNDFOak13TnpNZ01DNDJNVFk0T0RFZ01DNDFOakF6TjBNd0xqWXhOVFkzTnlBd0xqVTFOekUwTnlBd0xqWXhORFV5TmlBd0xqVTFNemc1T1NBd0xqWXhNelF5T0NBd0xqVTFNRFl5TkVNd0xqVTVOREl5TmlBd0xqVTFNekUzTVNBd0xqVTNORGMyTWlBd0xqVTFOVE0xTkNBd0xqVTFOVEF6TnlBd0xqVTFOekUzTTFwTk1DNDJNekE1TWprZ01DNDFOVGd4TURsRE1DNDJOVEExTlNBd0xqVTFORFUzTkNBd0xqWTJPVGt3T0NBd0xqVTFNRGt4SURBdU5qZzVNREEySURBdU5UUTNNVEUxUXpBdU5qZzVNVFl6SURBdU5UUXpOak16SURBdU5qZzVNeklnTUM0MU5EQXdPVGdnTUM0Mk9EazBOemNnTUM0MU16WTFNVEZETUM0Mk56RTNOQ0F3TGpVME1ERTFJREF1TmpVek56RTFJREF1TlRRek5qVTVJREF1TmpNMU5EQXpJREF1TlRRM01ETTNRekF1TmpNek9EZzFJREF1TlRVd056Z2dNQzQyTXpJek9UUWdNQzQxTlRRME55QXdMall6TURreU9TQXdMalUxT0RFd09WcE5NQzR6TWpJeU5Ua2dNQzQxTlRnMk5UVkRNQzR6TXpNM01UZ2dNQzQxTmpBM09EWWdNQzR6TkRVeU1ESWdNQzQxTmpJNU1UY2dNQzR6TlRZM01UTWdNQzQxTmpVd05EaERNQzR6TlRZNE55QXdMalUyT0RZNE55QXdMak0xTnpBd01TQXdMalUzTWpNeU5TQXdMak0xTnpFd05TQXdMalUzTlRrMk5FTXdMak0wTlRVME1pQXdMalUzTXpnNE5TQXdMak16TkRBek1pQXdMalUzTVRjNElEQXVNekl5TlRjeklEQXVOVFk1TmpRNFF6QXVNekl5TkRZNUlEQXVOVFkxT1RVNElEQXVNekl5TXpZMElEQXVOVFl5TWpreklEQXVNekl5TWpVNUlEQXVOVFU0TmpVMVdrMHdMalF4TkRVMU5DQXdMalU0TkRZNU4wTXdMalEwTkRrd01TQXdMalU0TnpNNU9TQXdMalEzTlRNMU1pQXdMalU0T1RFNU15QXdMalV3TlRrd055QXdMalU1TURBM05rTXdMalV3TlRrd055QXdMalU1TURBM05pQXdMalV4TXpFeU9DQXdMalU0TkRFMU1TQXdMalV4TlRRd05DQXdMalUzT1RFMk1VTXdMalE0TVRRME55QXdMalUzT0RRNE5TQXdMalEwTnpZM05DQXdMalUzTmpZMk5pQXdMalF4TkRBNE15QXdMalUzTXpjd00wTXdMalF4TkRJMElEQXVOVGMzTXpReElEQXVOREUwTXprM0lEQXVOVGd4TURBMklEQXVOREUwTlRVMElEQXVOVGcwTmprM1drMHdMall5TXpNeE5pQXdMalUzT0RVek4wTXdMall5TWpReU55QXdMalUzTlRZeU5pQXdMall5TVRVek55QXdMalUzTWpjeE5TQXdMall5TURZME9DQXdMalUyT1Rnd05FTXdMalU1T1RBek9TQXdMalUzTWpjMk55QXdMalUzTnpFeE55QXdMalUzTlRJNE9DQXdMalUxTkRnNElEQXVOVGMzTXpZM1F6QXVOVFUwT0RnZ01DNDFPREE1TlRRZ01DNDFOVFE1TURZZ01DNDFPRFExTmpjZ01DNDFOVFE1TlRrZ01DNDFPRGd5TURWRE1DNDFOalkyTWpZZ01DNDFPRGN5TVRnZ01DNDFOemd5TkRJZ01DNDFPRFl4SURBdU5UZzVPREExSURBdU5UZzBPRFV5UXpBdU5UZzVPRFUzSURBdU5UZ3lOekl4SURBdU5UZzVPRGd6SURBdU5UZ3dOalF5SURBdU5UZzVPRGd6SURBdU5UYzROakUxUXpBdU5Ua3dOalk0SURBdU5UZ3dOVE00SURBdU5Ua3hORFV6SURBdU5UZ3lOVEV6SURBdU5Ua3lNak0zSURBdU5UZzBOVFF4UXpBdU5qRXpNVFkySURBdU5UZ3hOak1nTUM0Mk16TTRNRGNnTUM0MU56ZzBNRGNnTUM0Mk5UUXhOaUF3TGpVM05EZzNNa013TGpZMU5EZzVNaUF3TGpVM01qVTROU0F3TGpZMU5UWTFNU0F3TGpVM01ETTFJREF1TmpVMk5ETTJJREF1TlRZNE1UWTNRekF1TmpVMk16Z3pJREF1TlRjd01qUTJJREF1TmpVMk16TXhJREF1TlRjeU16STFJREF1TmpVMk1qYzVJREF1TlRjME5EQTFRekF1TmpZM01EVTNJREF1TlRjeU16YzNJREF1TmpjM056Z3pJREF1TlRjd01qazRJREF1TmpnNE5EVTJJREF1TlRZNE1UWTNRekF1TmpnNE5UWXhJREF1TlRZME5UZ2dNQzQyT0RnMk16a2dNQzQxTmpBNU5qZ2dNQzQyT0RnMk9USWdNQzQxTlRjek1qbERNQzQyTmpnek9URWdNQzQxTmpFeU9DQXdMalkwTnpjM055QXdMalUyTlRFZ01DNDJNalk0TkRnZ01DNDFOamczT1RGRE1DNDJNalUyT1RjZ01DNDFOekl3TmpVZ01DNDJNalExTWlBd0xqVTNOVE14TkNBd0xqWXlNek14TmlBd0xqVTNPRFV6TjFwTk1DNHpNakk0TURrZ01DNDFPREF4TnpSRE1DNHpNelF6TWlBd0xqVTRNak13TlNBd0xqTTBOVGcxTmlBd0xqVTRORFF6TnlBd0xqTTFOelF4T1NBd0xqVTROalUyT0VNd0xqTTFOelV5TkNBd0xqVTVNREkxT0NBd0xqTTFOell5T1NBd0xqVTVOREF3TVNBd0xqTTFOemN6TXlBd0xqVTVOemM1TlVNd0xqTTBOakV4T0NBd0xqVTVOVFkyTkNBd0xqTXpORFV5T1NBd0xqVTVNelE0TVNBd0xqTXlNamsyTmlBd0xqVTVNVEkwTmtNd0xqTXlNamt4TXlBd0xqVTROelV3TXlBd0xqTXlNamcyTVNBd0xqVTRNemd4TXlBd0xqTXlNamd3T1NBd0xqVTRNREUzTkZwTk1DNDBNVFV6TXprZ01DNDJNRFkzTmpKRE1DNDBORGc1TWprZ01DNDJNRGszTWpVZ01DNDBPREkxT1RnZ01DNDJNVEUwTmpZZ01DNDFNVFl6TkRVZ01DNDJNVEU1T0RaRE1DNDFNVE0zTlRVZ01DNDJNRFkyTURZZ01DNDFNRFl4TkRNZ01DNDJNREEzTlRnZ01DNDFNRFl4TkRNZ01DNDJNREEzTlRoRE1DNDBOelUyT1RJZ01DNDFPVGs0TnpVZ01DNDBORFV5T1RNZ01DNDFPVGd3T0RFZ01DNDBNVFE1TkRjZ01DNDFPVFV6TnpoRE1DNDBNVFV4TURRZ01DNDFPVGt4TWpFZ01DNDBNVFV5TXpRZ01DNDJNREk1TVRVZ01DNDBNVFV6TXprZ01DNDJNRFkzTmpKYVRUQXVOVFUxTVRFMUlEQXVOVGs0TnpNeFF6QXVOVFkyTnpNeElEQXVOVGszTnpReklEQXVOVGM0TXpJZ01DNDFPVFkyTWpZZ01DNDFPRGs0T0RNZ01DNDFPVFV6TnpoRE1DNDFPRGs0T0RNZ01DNDFPVGt4TWpFZ01DNDFPRGs1TURrZ01DNDJNREk0T0RrZ01DNDFPRGs1TmpFZ01DNDJNRFkyT0RSRE1DNDFOemcxTURNZ01DNDJNRGM1T0RNZ01DNDFOalk1TmpZZ01DNDJNRGt4TWpjZ01DNDFOVFV6TlRFZ01DNDJNVEF4TVRWRE1DNDFOVFV5TkRZZ01DNDJNRFl5TmpnZ01DNDFOVFV4TmpnZ01DNDJNREkwTnpRZ01DNDFOVFV4TVRVZ01DNDFPVGczTXpGYVRUQXVOalV3TlRVZ01DNDFPRFU0TmpaRE1DNDJNekkzTURnZ01DNDFPRGc1T0RVZ01DNDJNVFEyTXpFZ01DNDFPVEU0T1RZZ01DNDFPVFl6TVRrZ01DNDFPVFExT1RsRE1DNDFPVGMzTXpFZ01DNDFPVGd4T0RVZ01DNDFPVGt4TkRRZ01DNDJNREUzTnpJZ01DNDJNREExTlRjZ01DNDJNRFV6TlRoRE1DNDJNVFl3T1RZZ01DNDJNRE13TVRrZ01DNDJNekUwTnpnZ01DNDJNREEwTnpJZ01DNDJORFkzTURRZ01DNDFPVGMzTVRkRE1DNDJORGd3TVRJZ01DNDFPVE0zTmpjZ01DNDJORGt5T1RRZ01DNDFPRGs0TVRjZ01DNDJOVEExTlNBd0xqVTROVGcyTmxwTk1DNDJOVFUyTlRFZ01DNDFPRFE1TTBNd0xqWTJOalF5T1NBd0xqVTRNamM1T1NBd0xqWTNOekV5T1NBd0xqVTRNRFk1TkNBd0xqWTROemMxSURBdU5UYzROakUxUXpBdU5qZzNOelVnTUM0MU9ESXlNRElnTUM0Mk9EYzNOU0F3TGpVNE5UZ3hOQ0F3TGpZNE56YzFJREF1TlRnNU5EVXpRekF1TmpjM01USTVJREF1TlRreE5qTTJJREF1TmpZMk5ESTVJREF1TlRrek56a3pJREF1TmpVMU5qVXhJREF1TlRrMU9USTBRekF1TmpVMU5qVXhJREF1TlRreU1qTTBJREF1TmpVMU5qVXhJREF1TlRnNE5UWTVJREF1TmpVMU5qVXhJREF1TlRnME9UTmFUVEF1TXpJek1qQXhJREF1TmpBeE9EVkRNQzR6TXpRM05qUWdNQzQyTURReE16Y2dNQzR6TkRZek5UTWdNQzQyTURZek9UZ2dNQzR6TlRjNU5qa2dNQzQyTURnMk16TkRNQzR6TlRnd056TWdNQzQyTVRJMU16SWdNQzR6TlRneE56Z2dNQzQyTVRZME15QXdMak0xT0RJNE15QXdMall5TURNeU9VTXdMak0wTmpZeE5TQXdMall4TnprNUlEQXVNek0wT1RjMElEQXVOakUxTlRrNUlEQXVNekl6TXpVNElEQXVOakV6TVRVMVF6QXVNekl6TXpBMklEQXVOakE1TkRFeklEQXVNekl6TWpVMElEQXVOakExTmpRMElEQXVNekl6TWpBeElEQXVOakF4T0RWYVRUQXVOREUxTnpNeElEQXVOakUzT0RNMFF6QXVOREkzTlRBMElEQXVOakU1TVRNeklEQXVORE01TXpBeUlEQXVOakl3TXpBeklEQXVORFV4TVRJM0lEQXVOakl4TXpReVF6QXVORFV4TWpnMElEQXVOakkxTXpRMUlEQXVORFV4TkRFMUlEQXVOakk1TXprNUlEQXVORFV4TlRFNUlEQXVOak16TlRBMlF6QXVORE01TmprMUlEQXVOak15TkRZMklEQXVOREkzT0RjZ01DNDJNekV5TkRRZ01DNDBNVFl3TkRVZ01DNDJNams0TkRGRE1DNDBNVFU1TkRFZ01DNDJNalU0TXprZ01DNDBNVFU0TXpZZ01DNDJNakU0TXpZZ01DNDBNVFUzTXpFZ01DNDJNVGM0TXpSYVRUQXVOVEl4TmpBMElEQXVOakl5T1RoRE1DNDFNRGszTnprZ01DNDJNak14TXpZZ01DNDBPVGM1TlRRZ01DNDJNak14TmpJZ01DNDBPRFl4TXlBd0xqWXlNekExT0VNd0xqUTROakl6TkNBd0xqWXlOekEySURBdU5EZzJNelkxSURBdU5qTXhNVEUwSURBdU5EZzJOVEl5SURBdU5qTTFNakl4UXpBdU5EazVNVGcwSURBdU5qTTFNekkxSURBdU5URXhPRFEySURBdU5qTTFNamN6SURBdU5USTBOVEE0SURBdU5qTTFNRFkxUXpBdU5USTBNamN5SURBdU5qSTVNamsxSURBdU5USXhOakEwSURBdU5qSXlPVGdnTUM0MU1qRTJNRFFnTUM0Mk1qSTVPRnBOTUM0MU5UVTJOalVnTUM0Mk1qRXlOalJETUM0MU5qY3lNamdnTUM0Mk1qQXlNalVnTUM0MU56ZzNOalVnTUM0Mk1Ua3dOVFVnTUM0MU9UQXlOelVnTUM0Mk1UYzNOVFpETUM0MU9UQXpPQ0F3TGpZeU1UY3dOaUF3TGpVNU1EVXhNU0F3TGpZeU5UWTRNeUF3TGpVNU1EWTJPQ0F3TGpZeU9UWTROVU13TGpVM09USXdPU0F3TGpZek1UQXpOeUF3TGpVMk56WTNNeUF3TGpZek1qSXpNaUF3TGpVMU5qQTFOeUF3TGpZek16STNNa013TGpVMU5Ua2dNQzQyTWpreU1UY2dNQzQxTlRVM05qa2dNQzQyTWpVeU1UVWdNQzQxTlRVMk5qVWdNQzQyTWpFeU5qUmFUVEF1TmpRek5EQTRJREF1TmpBNU1UQXhRekF1TmpNd05EZzBJREF1TmpFeE5Ea3lJREF1TmpFM05EVTJJREF1TmpFek56STNJREF1TmpBME16STBJREF1TmpFMU9EQTJRekF1TmpBMU56ZzVJREF1TmpFNU5UUTVJREF1TmpBM01qZ2dNQzQyTWpNeU9USWdNQzQyTURnM09UY2dNQzQyTWpjd016UkRNQzQyTVRreE5UY2dNQzQyTWpVeU5qY2dNQzQyTWprME9TQXdMall5TXpNNU5TQXdMall6T1RjNU9DQXdMall5TVRReVF6QXVOalF4TURBeElEQXVOakUzTWpZeUlEQXVOalF5TWpBMElEQXVOakV6TVRVMUlEQXVOalF6TkRBNElEQXVOakE1TVRBeFdrMHdMalkxTlRnd09DQXdMall3TmpZd05rTXdMalkyTmpVek5DQXdMall3TkRNeE9TQXdMalkzTnpJd055QXdMall3TWpBek1pQXdMalk0TnpneU9DQXdMalU1T1RjME5VTXdMalk0TnpnNE1TQXdMall3TXpRek5TQXdMalk0Tnprek15QXdMall3TnpFeU5pQXdMalk0TnprNE5TQXdMall4TURneE5rTXdMalkzTnpReE55QXdMall4TXpJd055QXdMalkyTmpjMk9TQXdMall4TlRVNU9TQXdMalkxTmpBME15QXdMall4TnprNVF6QXVOalUxT1RNNUlEQXVOakUwTVRrMUlEQXVOalUxT0RZZ01DNDJNVEEwTURFZ01DNDJOVFU0TURnZ01DNDJNRFkyTURaYVRUQXVNekF3T0RNMElEQXVOakU0TXpjNVF6QXVNekkzTmpjMUlEQXVOakkwTWpVeklEQXVNelUwTmpJZ01DNDJNams1TVRrZ01DNHpPREUyTnlBd0xqWXpOVE0zTjBNd0xqTTRNVGN5TXlBd0xqWXpPVFE0TXlBd0xqTTRNVGd3TVNBd0xqWTBNelU1SURBdU16Z3hPVEEySURBdU5qUTNOamsyUXpBdU16VTBPREF6SURBdU5qUXhPREl5SURBdU16STNPRE15SURBdU5qTTFOelF4SURBdU16QXdPVGt4SURBdU5qSTVORFV4UXpBdU16QXdPVE01SURBdU5qSTFPREV6SURBdU16QXdPRGcySURBdU5qSXlNVEl5SURBdU16QXdPRE0wSURBdU5qRTRNemM1V2swd0xqVXlNemN5TXlBd0xqWTBOakV6TjBNd0xqUTNPVGt6SURBdU5qUTFOREE1SURBdU5ETTJNakUxSURBdU5qUXlORGN5SURBdU16a3lOVGM1SURBdU5qTTNNekkyUXpBdU16a3lOamcwSURBdU5qUXhORGcwSURBdU16a3lOell5SURBdU5qUTFOakUzSURBdU16a3lPREUxSURBdU5qUTVOekl6UXpBdU5ETTFNRGtnTUM0Mk5UUTVOek1nTUM0ME56YzBOekVnTUM0Mk5UZ3dOQ0F3TGpVeE9UazFOaUF3TGpZMU9Ea3lORU13TGpVeU1qTXhJREF1TmpVMk1qY3pJREF1TlRJek56SXpJREF1TmpRMk1UTTNJREF1TlRJek56SXpJREF1TmpRMk1UTTNXazB3TGpVek16VXpNeUF3TGpZME5UYzBOME13TGpVMU1qZzVNaUF3TGpZME5EUTBOeUF3TGpVM01qQTVOQ0F3TGpZME1qY3pNaUF3TGpVNU1URXpPU0F3TGpZME1EWXdNVU13TGpVNU1UTTBPQ0F3TGpZME5EYzFPU0F3TGpVNU1UVTFOeUF3TGpZME9Ea3hPQ0F3TGpVNU1UYzJOeUF3TGpZMU16QTNOa013TGpVM01qY3lNaUF3TGpZMU5UTXhNU0F3TGpVMU16UTVOQ0F3TGpZMU56QTNPQ0F3TGpVek5EQTRNaUF3TGpZMU9ETTNPRU13TGpVek16ZzNNeUF3TGpZMU5ERTJOeUF3TGpVek16WTVJREF1TmpRNU9UVTNJREF1TlRNek5UTXpJREF1TmpRMU56UTNXazB3TGpZek5qRXdPU0F3TGpZek1qZ3dORU13TGpZeU9ETTJOU0F3TGpZek5ETTJNeUF3TGpZeU1EVTBNeUF3TGpZek5UZzNNU0F3TGpZeE1qWTBNeUF3TGpZek56TXlOa013TGpZeE5ESTJOU0F3TGpZME1URTNNeUF3TGpZeE5UZzJNU0F3TGpZME5UQXhPU0F3TGpZeE56UXpJREF1TmpRNE9EWTJRekF1TmpJeU5UVTRJREF1TmpRM09ESTJJREF1TmpJM05qVTVJREF1TmpRMk56ZzJJREF1TmpNeU56TTBJREF1TmpRMU56UTNRekF1TmpNek9ETXpJREF1TmpReE5ETXlJREF1TmpNME9UVTRJREF1TmpNM01URTRJREF1TmpNMk1UQTVJREF1TmpNeU9EQTBXazB3TGpZMU5qTTFOeUF3TGpZeU9ETTJRekF1TmpjME1UUTJJREF1TmpJME1EUTFJREF1TmpreE9EQTFJREF1TmpFNU56Z3pJREF1TnpBNU16TXpJREF1TmpFMU5UY3pRekF1TnpBNU16ZzFJREF1TmpFNU1UVTVJREF1TnpBNU5EWXpJREF1TmpJeU5qazBJREF1TnpBNU5UWTRJREF1TmpJMk1UYzJRekF1TmpreU1UUTFJREF1TmpNd09EQXpJREF1TmpjME5Ua3hJREF1TmpNMU5ESTVJREF1TmpVMk9UQTNJREF1TmpRd01EVTFRekF1TmpVMk56VWdNQzQyTXpZeE5UY2dNQzQyTlRZMU5qY2dNQzQyTXpJeU5UZ2dNQzQyTlRZek5UY2dNQzQyTWpnek5scE5NQzR6TURFd05qa2dNQzQyTkRBeE16TkRNQzR6TWpjNU5qSWdNQzQyTkRZNU9UUWdNQzR6TlRRNU9EWWdNQzQyTlRNMU55QXdMak00TWpFME1TQXdMalkxT1RnMU9VTXdMak00TWpFNU5DQXdMalkyTkRFM05DQXdMak00TWpJM01pQXdMalkyT0RRNE9DQXdMak00TWpNM055QXdMalkzTWpnd01rTXdMak0xTlRFM0lEQXVOalkxT1RReElEQXVNekk0TURreklEQXVOalU0TnpZNElEQXVNekF4TVRRNElEQXVOalV4TWpnelF6QXVNekF4TVRRNElEQXVOalEzTlRRZ01DNHpNREV4TWpJZ01DNDJORE00TWpRZ01DNHpNREV3TmprZ01DNDJOREF4TXpOYVRUQXVOVEV3TmprMUlEQXVOamN4TmpNelF6QXVORGN4TXpRNUlEQXVOamN3TkRNM0lEQXVORE15TVRZZ01DNDJOamN5TkNBd0xqTTVNekV5T1NBd0xqWTJNakEwTWtNd0xqTTVNekU0TVNBd0xqWTJOalF3T1NBd0xqTTVNekkxT1NBd0xqWTNNRGMzTlNBd0xqTTVNek0yTkNBd0xqWTNOVEUwTVVNd0xqUXlNekkwSURBdU5qYzVOekUySURBdU5EVXpNaklnTUM0Mk9ESTVNemdnTUM0ME9ETXpNRFFnTUM0Mk9EUTRNVU13TGpRNU9UUTNNaUF3TGpZNE5EazJOaUF3TGpVeE1EWTVOU0F3TGpZM01UWXpNeUF3TGpVeE1EWTVOU0F3TGpZM01UWXpNMXBOTUM0MU16UTJNeklnTUM0Mk56QTVNekZETUM0MU5UUXhORGdnTUM0Mk5qazFNamdnTUM0MU56TTBOVFFnTUM0Mk5qYzNNRGdnTUM0MU9USTFOVEVnTUM0Mk5qVTBOek5ETUM0MU9USTROalVnTUM0Mk5qazRNemtnTUM0MU9UTXhOemtnTUM0Mk56UXlNRFlnTUM0MU9UTTBPVE1nTUM0Mk56ZzFOekpETUM0MU56UXpORFFnTUM0Mk9EQTVNVEVnTUM0MU5UUTVOVGtnTUM0Mk9ESTNPRElnTUM0MU16VXpNemdnTUM0Mk9EUXhPRFpETUM0MU16VXhNamtnTUM0Mk56azNOamdnTUM0MU16UTRPVE1nTUM0Mk56VXpORGtnTUM0MU16UTJNeklnTUM0Mk56QTVNekZhVFRBdU5qSTNNVFl5SURBdU5qY3lNVGM0UXpBdU5qSTRNVFUySURBdU5qWTNOU0F3TGpZeU9URTNOaUF3TGpZMk1qa3lOaUF3TGpZek1ESXlNeUF3TGpZMU9EUTFOa013TGpZeU56TTBOU0F3TGpZMU9UQTRJREF1TmpJME5EWTNJREF1TmpVNU56QXpJREF1TmpJeE5Ua2dNQzQyTmpBek1qZERNQzQyTWpNeU1USWdNQzQyTmpReU56Z2dNQzQyTWpRNE9EWWdNQzQyTmpneU5UUWdNQzQyTWpZMk1UTWdNQzQyTnpJeU5UWkRNQzQyTWpZM055QXdMalkzTWpJd05DQXdMall5TmprMU15QXdMalkzTWpFM09DQXdMall5TnpFMk1pQXdMalkzTWpFM09GcE5NQzQyTlRjMU16UWdNQzQyTlRFMU9UUkRNQzQyTnpVeE1UUWdNQzQyTkRZMU5USWdNQzQyT1RJMU5qUWdNQzQyTkRFME9EUWdNQzQzTURrNE9ESWdNQzQyTXpZek9VTXdMamN3T1RrNE55QXdMall6T1RrM055QXdMamN4TURFeE55QXdMalkwTXpVek9DQXdMamN4TURJM05DQXdMalkwTnpBM01rTXdMalk1TXpBMk1TQXdMalkxTWpZNE5pQXdMalkzTlRjME1pQXdMalkxT0RJME9DQXdMalkxT0RNeE9TQXdMalkyTXpjMU9FTXdMalkxT0RBMU9DQXdMalkxT1Rjd015QXdMalkxTnpjNU5pQXdMalkxTlRZME9TQXdMalkxTnpVek5DQXdMalkxTVRVNU5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ME9UazRPRFFnTUM0ME1qWXdOVEZETUM0Mk5qVXhNVGNnTUM0ME1qWXdOVEVnTUM0M09Ua3dPRFFnTUM0ek5UazRPVE1nTUM0M09Ua3dPRFFnTUM0eU56Z3lNVEZETUM0M09Ua3dPRFFnTUM0eE9UWTFNamtnTUM0Mk5qVXhNVGNnTUM0eE16QXpOekVnTUM0ME9UazRPRFFnTUM0eE16QXpOekZETUM0ek16UTJOU0F3TGpFek1ETTNNU0F3TGpJd01EWTROQ0F3TGpFNU5qVXlPU0F3TGpJd01EWTROQ0F3TGpJM09ESXhNVU13TGpJd01EWTROQ0F3TGpNMU9UZzVNeUF3TGpNek5EWTFJREF1TkRJMk1EVXhJREF1TkRrNU9EZzBJREF1TkRJMk1EVXhXaUlnWm1sc2JEMGlZbXhoWTJzaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNOamsxTXlBd0xqZ3pNVFUwTkVNd0xqTTNOamsxTXlBd0xqYzVOekV6TmlBd0xqTTNOamsxTXlBd0xqYzJNamd4TmlBd0xqTTNOamsxTXlBd0xqY3lPRGMyUXpBdU16ZzNOREkxSURBdU56TXdOVElnTUM0ek9UYzVPRFVnTUM0M016SXpOamdnTUM0ME1EZzJNek1nTUM0M016UXhNamhETUM0ME5ERXpOamtnTUM0M016ZzNPVElnTUM0ME5UYzJORGtnTUM0M05UVTNOellnTUM0ME5UYzJORGtnTUM0M09EZzFNVEpETUM0ME5UYzJORGtnTUM0NE1EUTNPVElnTUM0ME5UTXdOek1nTUM0NE1UYzVNRFFnTUM0ME5ETTRNek1nTUM0NE1qYzBNRGhETUM0ME16UTJPREVnTUM0NE16WTNNellnTUM0ME1qSTRPRGtnTUM0NE5EQXhOamdnTUM0ME1EZzBOVGNnTUM0NE16YzFNamhETUM0ek9UYzRPVGNnTUM0NE16VTFNRFFnTUM0ek9EY3pNemNnTUM0NE16TTJOVFlnTUM0ek56WTVOVE1nTUM0NE16RTJNekpXTUM0NE16RTFORFJhVFRBdU16azJORGc1SURBdU56UTVNelV5UXpBdU16azJORGc1SURBdU56Y3hNelV5SURBdU16azJORGc1SURBdU56a3pOemt5SURBdU16azJORGc1SURBdU9ERTJOVGcwUXpBdU5EQXdNREE1SURBdU9ERTNNaUF3TGpRd016WXhOeUF3TGpneE56Y3lPQ0F3TGpRd056SXlOU0F3TGpneE9ETTBORU13TGpReE5qVTFNeUF3TGpneE9UZzBJREF1TkRJek56WTVJREF1T0RFM05EWTBJREF1TkRJNU1UTTNJREF1T0RFeE9ETXlRekF1TkRNME5ERTNJREF1T0RBMU9UTTJJREF1TkRNM01UUTFJREF1TnprM05UYzJJREF1TkRNM01UUTFJREF1TnpnMk56VXlRekF1TkRNM01UUTFJREF1TnpjMk5UUTBJREF1TkRNME16STVJREF1TnpZNE1qY3lJREF1TkRJNE56ZzFJREF1TnpZeU1URXlRekF1TkRJek1qUXhJREF1TnpVMU9EWTBJREF1TkRFMk1URXpJREF1TnpVeU1qVTJJREF1TkRBM01qSTFJREF1TnpVd09UTTJRekF1TkRBek5qRTNJREF1TnpVd05EQTRJREF1TkRBd01EQTVJREF1TnpRNU9EZ2dNQzR6T1RZME9Ea2dNQzQzTkRrek5USmFUVEF1TkRjek1UTTNJREF1T0RRMk5qaERNQzQwTnpNeE16Y2dNQzQ0TURnNU1qZ2dNQzQwTnpNeE16Y2dNQzQzTnpNNU1EUWdNQzQwTnpNeE16Y2dNQzQzTkRFMk9UWkRNQzQwT0RRd05Ea2dNQzQzTkRJeE16WWdNQzQwT1RRNU5qRWdNQzQzTkRJMElEQXVOVEExT0RjeklEQXVOelF5TXpFeVF6QXVOVEUxT0RFM0lEQXVOelF4T1RZZ01DNDFNak0xTmpFZ01DNDNORE16TmpnZ01DNDFNamt3TVRjZ01DNDNORFk0T0RoRE1DNDFNelEwTnpNZ01DNDNOVEEwTURnZ01DNDFNemN5TURFZ01DNDNOVFUxTVRJZ01DNDFNemN5TURFZ01DNDNOakkzTWpoRE1DNDFNemN5TURFZ01DNDNOamd5TnpJZ01DNDFNelUwTkRFZ01DNDNOek14TVRJZ01DNDFNekl3T1RjZ01DNDNOemMwTWpSRE1DNDFNamczTlRNZ01DNDNPREU1TVRJZ01DNDFNalExTWprZ01DNDNPRFE1T1RJZ01DNDFNVGt6TXpjZ01DNDNPRFk1TWpoRE1DNDFNVGt6TXpjZ01DNDNPRFk1TWpnZ01DNDFNVGt6TXpjZ01DNDNPRGN3TVRZZ01DNDFNVGt6TXpjZ01DNDNPRGN4T1RKRE1DNDFNalUzTmpFZ01DNDNPRGM0T1RZZ01DNDFNekE1TlRNZ01DNDNPVEF5TnpJZ01DNDFNelE1TVRNZ01DNDNPVFExT0RSRE1DNDFNemcyT1RjZ01DNDNPVGc0T1RZZ01DNDFOREE0TURrZ01DNDRNRFEyTVRZZ01DNDFOREE0TURrZ01DNDRNVEUzTkRSRE1DNDFOREE0TURrZ01DNDRNakU1TlRJZ01DNDFNemM0TVRjZ01DNDRNekEwSURBdU5UTXhPRE16SURBdU9ETTNNRGc0UXpBdU5USTFPVE0zSURBdU9EUXpPVFV5SURBdU5URTNOelV6SURBdU9EUTNOek0ySURBdU5UQTNOVFExSURBdU9EUTRRekF1TkRrMk1ERTNJREF1T0RRM09URXlJREF1TkRnME5UYzNJREF1T0RRM05UWWdNQzQwTnpNeE16Y2dNQzQ0TkRZNE5UWkRNQzQwTnpNeE16Y2dNQzQ0TkRZM05qZ2dNQzQwTnpNeE16Y2dNQzQ0TkRZMk9DQXdMalEzTXpFek55QXdMamcwTmpZNFdrMHdMalE1TWpjMk1TQXdMamMxTnpBNU5rTXdMalE1TWpjMk1TQXdMamMyTlRBeE5pQXdMalE1TWpjMk1TQXdMamMzTXpJNE9DQXdMalE1TWpjMk1TQXdMamM0TVRVMlF6QXVORGsxT0RReElEQXVOemd4TlRZZ01DNDBPVGc1TWpFZ01DNDNPREUyTkRnZ01DNDFNREl3T0RrZ01DNDNPREUyTkRoRE1DNDFNRFkxTnpjZ01DNDNPREUxTmlBd0xqVXhNREE1TnlBd0xqYzRNRE15T0NBd0xqVXhNalkwT1NBd0xqYzNOemcyTkVNd0xqVXhOVEk0T1NBd0xqYzNOVFFnTUM0MU1UWTJNRGtnTUM0M056SXdOVFlnTUM0MU1UWTJNRGtnTUM0M05qYzVNa013TGpVeE5qWXdPU0F3TGpjMk1EUTBJREF1TlRFeE5ERTNJREF1TnpVMk9ETXlJREF1TlRBeE1USXhJREF1TnpVM01EQTRRekF1TkRrNE16QTFJREF1TnpVM01EazJJREF1TkRrMU5EZzVJREF1TnpVM01EazJJREF1TkRreU56WXhJREF1TnpVM01EazJXazB3TGpRNU1qYzJNU0F3TGpjNU9ESTRRekF1TkRreU56WXhJREF1T0RBNE1qSTBJREF1TkRreU56WXhJREF1T0RFNE5ETXlJREF1TkRreU56WXhJREF1T0RJNE9ERTJRekF1TkRrMk5qTXpJREF1T0RJNE9ERTJJREF1TlRBd05UQTFJREF1T0RJNE9UQTBJREF1TlRBME5EWTFJREF1T0RJNE9UQTBRekF1TlRBNU16a3pJREF1T0RJNE9ERTJJREF1TlRFek1qWTFJREF1T0RJM05EQTRJREF1TlRFMU9Ua3pJREF1T0RJME5ERTJRekF1TlRFNE9EQTVJREF1T0RJeE16TTJJREF1TlRJd01qRTNJREF1T0RFM05UVXlJREF1TlRJd01qRTNJREF1T0RFeU5UTTJRekF1TlRJd01qRTNJREF1T0RBM056ZzBJREF1TlRFNE9EQTVJREF1T0RBME16VXlJREF1TlRFMU9Ua3pJREF1T0RBeE9EZzRRekF1TlRFek1UYzNJREF1TnprNU5URXlJREF1TlRBNU16QTFJREF1TnprNE1qZ2dNQzQxTURReE1UTWdNQzQzT1Rnek5qaERNQzQxTURBek1qa2dNQzQzT1Rnek5qZ2dNQzQwT1RZMU5EVWdNQzQzT1RneU9DQXdMalE1TWpjMk1TQXdMamM1T0RJNFdrMHdMalUzTkRFMk1TQXdMamd5TVRjM05rTXdMalU0TnpFNE5TQXdMamd4T1RnMElEQXVOakF3TWprM0lEQXVPREUzT0RFMklEQXVOakV6TXpJeElEQXVPREUxTmpFMlF6QXVOakV6TXpJeElEQXVPREl4T1RVeUlEQXVOakV6TXpJeElEQXVPREk0TWlBd0xqWXhNek15TVNBd0xqZ3pORFV6TmtNd0xqVTVNamt3TlNBd0xqZ3pPREExTmlBd0xqVTNNalF3TVNBd0xqZzBNVFFnTUM0MU5URTRPVGNnTUM0NE5EUTBPRU13TGpVMU1UZzVOeUF3TGpnME1UVTNOaUF3TGpVMU1UZzVOeUF3TGpnek9EWTNNaUF3TGpVMU1UZzVOeUF3TGpnek5UZzFOa013TGpVMU1UZzVOeUF3TGpneU9UZzNNaUF3TGpVMU1qZzJOU0F3TGpneU5ESTBJREF1TlRVME56RXpJREF1T0RFNU5FTXdMalUxTmpRM015QXdMamd4TkRJNU5pQXdMalUxT0RnME9TQXdMamd3T1RZek1pQXdMalUyTVRreU9TQXdMamd3TlRJek1rTXdMalUyTlRBNU55QXdMamd3TURjME5DQXdMalUyT1RnME9TQXdMamM1TlRZMElEQXVOVGMyTXpZeElEQXVOemc1TkRoRE1DNDFPREl6TkRVZ01DNDNPRE0xT0RRZ01DNDFPRFl6T1RNZ01DNDNOemcxTmpnZ01DNDFPRGc0TlRjZ01DNDNOelF5TlRaRE1DNDFPVEV5TXpNZ01DNDNOekF4TWlBd0xqVTVNalEyTlNBd0xqYzJOVGs0TkNBd0xqVTVNalEyTlNBd0xqYzJNVFU0TkVNd0xqVTVNalEyTlNBd0xqYzFNalF6TWlBd0xqVTROemc0T1NBd0xqYzBPRFkwT0NBd0xqVTNPRGd5TlNBd0xqYzBPVGsyT0VNd0xqVTNNRGt3TlNBd0xqYzFNVEV4TWlBd0xqVTJNek16TnlBd0xqYzFOVFF5TkNBd0xqVTFOakV5TVNBd0xqYzJNekE0UXpBdU5UVTJNVEl4SURBdU56VTJPRE15SURBdU5UVTJNVEl4SURBdU56VXdPRFE0SURBdU5UVTJNVEl4SURBdU56UTBPRFkwUXpBdU5UWTBNakUzSURBdU56TTRNelV5SURBdU5UY3pNVGt6SURBdU56TTBNemt5SURBdU5UZ3pNakkxSURBdU56TXlPREE0UXpBdU5Ua3lOVFV6SURBdU56TXhNekV5SURBdU5UazVPRFUzSURBdU56TXlOVFEwSURBdU5qQTFNVE0zSURBdU56TTJOamhETUM0Mk1UQTFNRFVnTUM0M05EQTVPVElnTUM0Mk1UTXlNek1nTUM0M05EYzJPQ0F3TGpZeE16SXpNeUF3TGpjMU5qZ3pNa013TGpZeE16SXpNeUF3TGpjMk1qRXhNaUF3TGpZeE1qUTBNU0F3TGpjMk5qazFNaUF3TGpZeE1EZzFOeUF3TGpjM01URTNOa013TGpZd09UTTJNU0F3TGpjM05UWTJOQ0F3TGpZd056QTNNeUF3TGpjNE1EQTJOQ0F3TGpZd05ERTJPU0F3TGpjNE5ESTRPRU13TGpZd01USTJOU0F3TGpjNE9EUXlOQ0F3TGpVNU5qWXdNU0F3TGpjNU16WXhOaUF3TGpVNU1EQXdNU0F3TGpjNU9UZzJORU13TGpVNE16ZzBNU0F3TGpnd05Ua3pOaUF3TGpVM09UWXhOeUF3TGpneE1EVXhNaUF3TGpVM056VXdOU0F3TGpneE16YzJPRU13TGpVM05UTTVNeUF3TGpneE5qa3pOaUF3TGpVM05ERTJNU0F3TGpneE9UUWdNQzQxTnpReE5qRWdNQzQ0TWpFM056WmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd1h6SXpNVE5mTWpJek56UWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSI1NiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MCIgeT0iNDUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="0d01b047-0dc2-40e5-8af6-7f6f5d5b74c1" source="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" target="ee01b296-281d-4c3b-9221-3520645a764c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; Darwin Gateway Sistemas" ref="0ecf1fb2-b3f9-4d08-b538-5b63009e4154" source="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" target="6ba9fa4e-3ff7-4b36-88d5-24fc50931802">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="13f8e1da-1d51-4490-809b-0362d2dbf967" source="2e15b9d8-0834-4052-85b9-faa3e90c123b" target="66d3a807-377b-4abc-a7e7-6a52763dfe1c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="1b61e8f1-0fc9-4589-833c-de58586bef66" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="20278f0d-cfd2-4b3c-a1f5-45d9584af841" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="6ba9fa4e-3ff7-4b36-88d5-24fc50931802">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Clientes -&gt; SPA Autorización de Operaciones" ref="26868ed3-a8a7-4c2a-9c8e-43e251aaec16" source="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" target="c56c54d1-cfc5-4a4a-9d59-970521002185">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="34de075b-d431-4433-9fc0-83a91ae40de9" source="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1" target="362e3b48-5761-4c75-b085-db8646b8b3f2">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BaaS -&gt; Darwin Gateway Sistemas" ref="4f49f334-06c2-41f0-9f57-864bbd4cfba9" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Web -&gt; BFF" ref="621a47cf-996d-4be9-a216-e43929ef1dd4" source="1aca92e8-55db-42eb-b24b-3a35fdebd151" target="366dc6c1-bc87-4ef9-920d-79fe2305ba66">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Clientes -&gt; SPA Operaciones Pendientes" ref="66415208-70c0-4298-ae27-ee8e7db44ce3" source="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" target="2028f9ba-9244-423f-be5e-e12c9dbe8a54">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="SPA Autorización de Operaciones -&gt; Darwin Gateway Web" ref="73a1b2cc-26d6-4f04-8802-0702164de557" source="c56c54d1-cfc5-4a4a-9d59-970521002185" target="1aca92e8-55db-42eb-b24b-3a35fdebd151">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BFF -&gt; Darwin Gateway Sistemas" ref="7c903422-843b-46ba-81c8-041897c18f3d" source="366dc6c1-bc87-4ef9-920d-79fe2305ba66" target="91e8385d-cf7d-4917-a707-b247579b5f00">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="a2ff564b-447e-47fa-95a2-6557c7849a5f" source="08d65c86-43f0-472d-9790-dbf0831b425b" target="32a29c1f-3e79-472d-8051-a6642869b784">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="acd0337c-5bf7-439e-aa24-da9814085391" source="6ba9fa4e-3ff7-4b36-88d5-24fc50931802" target="8631069e-e3ae-4432-9628-12b7f2212ee8">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Sistemas -&gt; BaaS" ref="c852090a-1947-4538-8dce-321b263d2106" source="91e8385d-cf7d-4917-a707-b247579b5f00" target="7d59b3f7-d74d-4951-906c-49d1fa61ea05">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Darwin Gateway Web -&gt; BFF" ref="ce73e97a-8ac8-4403-9b8f-14a17d7f7014" source="9d4463a3-9a1f-418d-bea7-07798d2a8ccb" target="daf212bc-3f3a-4a06-9d44-06ac753fd4f3">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BFF -&gt; IBM Db2" ref="d6b5e4cf-cb65-4a4e-8a54-741c6f9f8d24" source="daf212bc-3f3a-4a06-9d44-06ac753fd4f3" target="5a703a97-9d25-4332-91f7-948f8055e807">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="SPA Operaciones Pendientes -&gt; Darwin Gateway Web" ref="daea8d16-fd15-4b29-9cd1-2dc5cb511f99" source="2028f9ba-9244-423f-be5e-e12c9dbe8a54" target="9d4463a3-9a1f-418d-bea7-07798d2a8ccb">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BaaS -&gt; IBM Db2" ref="e82503d7-e1e0-46e0-93df-bff2204b578a" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="5a703a97-9d25-4332-91f7-948f8055e807">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="BaaS -&gt; Darwin Gateway Sistemas" ref="ea8ab787-8f2c-4515-8150-922a83e2444e" source="8631069e-e3ae-4432-9628-12b7f2212ee8" target="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="12734c7b-80d1-4db9-aba3-85f76c1de1e6" diagramComponentId="d0ab9fb6-682c-46f4-bac4-1dc1c8f86039" ref="4e4f538f-9fe3-4eac-aa96-5f8bad00b49c" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.650">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.589">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.591">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6cde4fb4-cb28-404f-8f7f-ba11e323ca6e" diagramComponentId="5d72e17b-603b-40e2-b72f-18728cd9a948" ref="7d59b3f7-d74d-4951-906c-49d1fa61ea05" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.051">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.323">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.050">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.325">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.324">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.647">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.325">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.646">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.245">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.960">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.532">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.962">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.963">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.964">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="512f9cb8-7b1b-411a-8b40-0f72b987ce2f" diagramComponentId="6ff01927-fa39-4939-9ebf-f70a51b874f5" ref="2e15b9d8-0834-4052-85b9-faa3e90c123b" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.287">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.286">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="21b3e0c9-8143-404e-89f6-5b1577948354" diagramComponentId="387de57a-6b07-4f64-9826-ec0bfd27deb8" ref="1aca92e8-55db-42eb-b24b-3a35fdebd151" name="Darwin Gateway Web" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.389">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.390">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.028">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.704">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.027">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.706">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.705">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.388">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.390">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.706">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.635">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.265">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.919">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:26.637">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f70648dd-29aa-4888-b57d-fff7a1866f6a" diagramComponentId="0a0b0ba3-c530-4c4d-b142-1ff346f945a0" ref="66d3a807-377b-4abc-a7e7-6a52763dfe1c" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.583">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.582">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.975">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.309">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.974">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.857">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.858">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.239">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.485">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:36.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="95763d7e-6496-45d9-a508-56d096aa92ee" diagramComponentId="eabb35e5-9f76-4cc7-8254-4feb6c90fc88" ref="6ba9fa4e-3ff7-4b36-88d5-24fc50931802" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.347">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.348">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.014">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.266">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.901">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.903">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.539">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.540">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:25.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3fde4eb5-f010-4197-a7ab-f2d205d3652e" diagramComponentId="45b9e34a-50ab-40c6-8666-84b927a88f94" ref="362e3b48-5761-4c75-b085-db8646b8b3f2" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.134">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.135">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.453">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.716">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.717">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.023">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.454">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7d54e716-f1d6-4470-aa6e-054f75dbb525" diagramComponentId="cff5e8f3-9422-464e-8cfc-e7217845ce8c" ref="9d4463a3-9a1f-418d-bea7-07798d2a8ccb" name="Darwin Gateway Web" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.356">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.132">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.815">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.358">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.813">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.296">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.045">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.697">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.297">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.046">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.700">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.048">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:35.298">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="960e6014-9ab6-40da-93d2-4c3b27dcc38c" diagramComponentId="529e715f-63e6-457b-be69-d46170df4d25" ref="9902a3e2-a6f5-402d-bf0a-6a04a8518cb1" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.167">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.166">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7250bfc0-f114-453d-a657-f9464e828d1b" diagramComponentId="86a33c83-e0db-418b-a848-3003d3eb78fa" ref="8631069e-e3ae-4432-9628-12b7f2212ee8" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.173">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.861">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.576">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.860">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.510">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.084">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.085">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.761">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:29.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.511">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ec377dd7-06b4-449a-aee2-064c3f86acfe" diagramComponentId="a88b6d33-8ab0-45c2-87a9-86dde8b0efc7" ref="91e8385d-cf7d-4917-a707-b247579b5f00" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.464">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.462">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.389">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.390">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.390">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.391">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:34.391">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3cdc8d5b-074a-4021-8929-eb51f3b7d11a" diagramComponentId="1b041144-ab90-42c1-a3ae-110e1e23822c" ref="366dc6c1-bc87-4ef9-920d-79fe2305ba66" name="BFF" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.472">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.719">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.077">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.473">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.720">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.079">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.721">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.722">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.080">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.081">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.081">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.722">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:30.474">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="adce88c6-2156-4010-a1c1-57cb8b9b4317" diagramComponentId="f3cf4809-4b0c-4eb7-bc40-7b11176e8f0c" ref="daf212bc-3f3a-4a06-9d44-06ac753fd4f3" name="BFF" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.581">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.580">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.844">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.255">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="57" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.487">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.148">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.149">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.150">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.489">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.151">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.490">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.152">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.491">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:33.779">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="df6273b0-7f26-442f-827d-6c023db57b1e" diagramComponentId="82a7f01e-20e1-4313-be63-25b4954d9211" ref="c4431c6d-1b3d-4fd8-8562-85f343e4bc78" name="Clientes" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.892">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.503">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.894">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.616">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.458">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.618">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f035051a-8f3b-41cb-b892-d6f51866ba5c" diagramComponentId="879c8266-0f37-4e34-ba38-9b7268d4964f" ref="5a703a97-9d25-4332-91f7-948f8055e807" name="IBM Db2" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-IBM-DB2">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.653">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.300">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.018">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.017">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.564">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:31.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:32.173">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="92e79fa6-9404-4e32-90f1-5dcede678b2a" diagramComponentId="03d5b54b-d1c8-4441-b5d0-b6e988b1e363" ref="ee01b296-281d-4c3b-9221-3520645a764c" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.893">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.598">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.892">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.599">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.257">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.255">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.532">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.798">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.124">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.533">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.126">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.127">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:24.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="57fcb2d6-e0b2-4d80-876b-77086ff46a46" diagramComponentId="56f969d5-9b40-4965-ae83-ac78319b5994" ref="32a29c1f-3e79-472d-8051-a6642869b784" name="BaaS" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.974">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.973">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.021">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.022">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.602">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="52" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.481">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.871">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.872">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.873">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.528">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.528">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.873">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.530">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.531">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:19.532">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:20.486">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="00098462-e7f6-4c67-b304-64ade1dfa6ad" diagramComponentId="74373495-4b80-4e18-98bf-af6bab0053d0" ref="08d65c86-43f0-472d-9790-dbf0831b425b" name="Darwin Gateway Sistemas" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.045">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:28.044">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.969">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="bm40@gcloud.ua.es" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:27.970">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="eec41e6b-7904-4209-8839-697022c6beb0" diagramComponentId="a12f49a5-041a-4c4c-bc3f-ee66298992de" ref="2028f9ba-9244-423f-be5e-e12c9dbe8a54" name="SPA Operaciones Pendientes" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.534">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.122">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.843">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.535">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.248">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.255">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.792">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.255">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.950">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:23.254">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="2715fb43-0e9e-438c-b7d0-e5225fa116dd" diagramComponentId="d8bd4025-d343-4a28-9919-012fb56796e0" ref="c56c54d1-cfc5-4a4a-9d59-970521002185" name="SPA Autorización de Operaciones" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.140">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.571">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.143">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.142">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.142">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.143">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.771">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="83" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.773">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.470">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="51" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:22.350">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="bm40@gcloud.ua.es" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-06-01T08:33:21.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="bm40@gcloud.ua.es" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/sample-system-template.xml b/Templates/Submitted_Templates/sample-system-template.xml
new file mode 100644
index 0000000..c3cb1fb
--- /dev/null
+++ b/Templates/Submitted_Templates/sample-system-template.xml
@@ -0,0 +1,17730 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="sample-system-template" name="sample-system template" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTE0MCIgZHk9IjgxOCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4NTAiIHBhZ2VIZWlnaHQ9IjExMDAiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjEuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ii0yNDYiIHk9Ii00IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjM1MSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHZhbHVlPSJXZWIgQ2xpZW50IiBzdHlsZT0iaXIucmVmPWEzYzY3MzFjLTM1M2MtNGI1My04MWQxLWIzNThiZWU2MWFkYztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORE01SURBdU1UWXpNRGcyU0RBdU1qVTJNRGt6UXpBdU1Ua3dPRE01SURBdU1UWXpNRGcySURBdU1UTTNPVE01SURBdU1qRTFPVFV6SURBdU1UTTNPVE01SURBdU1qZ3hNVFkzVmpBdU5qTTFNalV4UXpBdU1UTTNPVE01SURBdU56QXdORFkySURBdU1Ua3dPRE01SURBdU56VXpNek15SURBdU1qVTJNRGt6SURBdU56VXpNek15U0RBdU16YzBOVFF6VmpBdU9ERXpNREEwVERBdU1qZzFPVGcxSURBdU9ERXpNREExUXpBdU1qWTVOamN4SURBdU9ERXpNREExSURBdU1qVTJORFEzSURBdU9ESTJNakl5SURBdU1qVTJORFEzSURBdU9EUXlOVEkyUXpBdU1qVTJORFEzSURBdU9EVTRPREk1SURBdU1qWTVOamN5SURBdU9EY3lNRFEySURBdU1qZzFPVGcySURBdU9EY3lNRFEyVERBdU5qazVNamsySURBdU9EY3lNRFF6UXpBdU56RTFOakVnTUM0NE56SXdORElnTUM0M01qZzRNelFnTUM0NE5UZzRNallnTUM0M01qZzRNelFnTUM0NE5ESTFNakpETUM0M01qZzRNelFnTUM0NE1qWXlNVGdnTUM0M01UVTJNRGtnTUM0NE1UTXdNRElnTUM0Mk9Ua3lPVFVnTUM0NE1UTXdNREpNTUM0Mk1UQTNNamdnTUM0NE1UTXdNRE5XTUM0M05UTXpNekpJTUM0M01qZzNNRGxETUM0M09UTTVOak1nTUM0M05UTXpNeklnTUM0NE5EWTROaklnTUM0M01EQTBOallnTUM0NE5EWTROaklnTUM0Mk16VXlOVEZXTUM0Mk1qQXlNamhETUM0NE1qWTROVGNnTUM0Mk16WTNNemtnTUM0NE1EUTROREVnTUM0Mk5UQTVNRE1nTUM0M09ERXlNellnTUM0Mk5qSXlPVGhETUM0M056RTBNVGtnTUM0Mk9ERXpJREF1TnpVeE5UZ3lJREF1TmprME1qa3lJREF1TnpJNE56QTVJREF1TmprME1qa3lTREF1TmpVd016azRXazB3TGpVMU1UWTFNU0F3TGpneE16QXdNMHd3TGpRek16WXlJREF1T0RFek1EQTBWakF1TnpVek16TXlTREF1TlRVeE5qVXhWakF1T0RFek1EQXpXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqWXlPVEF5TVNBd0xqWTBNekk1TmtNd0xqYzNOVEkwTmlBd0xqWTBNekk1TmlBd0xqZzVNemM0TkNBd0xqVXlORGMxTnlBd0xqZzVNemM0TkNBd0xqTTNPRFV6TWtNd0xqZzVNemM0TkNBd0xqSXpNak13T0NBd0xqYzNOVEkwTmlBd0xqRXhNemMzSURBdU5qSTVNREl4SURBdU1URXpOemRETUM0ME9ESTNPVFlnTUM0eE1UTTNOeUF3TGpNMk5ESTFPQ0F3TGpJek1qTXdPQ0F3TGpNMk5ESTFPQ0F3TGpNM09EVXpNa013TGpNMk5ESTFPQ0F3TGpVeU5EYzFOeUF3TGpRNE1qYzVOaUF3TGpZME16STVOaUF3TGpZeU9UQXlNU0F3TGpZME16STVObHBOTUM0M09EVTBOVFlnTUM0ek56ZzFNVFpETUM0M09EVTBOVFlnTUM0ME5qUTVNakVnTUM0M01UVTBNU0F3TGpVek5EazJOaUF3TGpZeU9UQXdOU0F3TGpVek5EazJOa013TGpVME1qWXdNU0F3TGpVek5EazJOaUF3TGpRM01qVTFOU0F3TGpRMk5Ea3lNU0F3TGpRM01qVTFOU0F3TGpNM09EVXhOa013TGpRM01qVTFOU0F3TGpJNU1qRXhNU0F3TGpVME1qWXdNU0F3TGpJeU1qQTJOaUF3TGpZeU9UQXdOU0F3TGpJeU1qQTJOa013TGpjeE5UUXhJREF1TWpJeU1EWTJJREF1TnpnMU5EVTJJREF1TWpreU1URXhJREF1TnpnMU5EVTJJREF1TXpjNE5URTJXazB3TGpZMk5qSTNNU0F3TGpJNE1EUTNORU13TGpZMU5EVXhPQ0F3TGpJMU5UQXhJREF1TmpRd05UTTFJREF1TWpRME5ERTJJREF1TmpJNU1EQTFJREF1TWpRME5ERTJRekF1TmpFM05EYzJJREF1TWpRME5ERTJJREF1TmpBek5Ea3pJREF1TWpVMU1ERWdNQzQxT1RFM05DQXdMakk0TURRM05FTXdMalU0TnpVMk5DQXdMakk0T1RVeU15QXdMalU0TXprek5TQXdMakk1T1RrMU15QXdMalU0TVRBeE9DQXdMak14TVRRMk5rZ3dMalkzTmprNU1rTXdMalkzTkRBM05pQXdMakk1T1RrMU15QXdMalkzTURRME5pQXdMakk0T1RVeU15QXdMalkyTmpJM01TQXdMakk0TURRM05GcE5NQzQxTlRnd01qa2dNQzR6TVRFME5qWkRNQzQxTmpFME5ETWdNQzR5T1RZMU56UWdNQzQxTmpVNU56a2dNQzR5T0RJNU5UY2dNQzQxTnpFME5EY2dNQzR5TnpFeE1EaERNQzQxTnpRek9ERWdNQzR5TmpRM05UUWdNQzQxTnpjM0lEQXVNalU0TmpnMUlEQXVOVGd4TXprZ01DNHlOVE14TVRaRE1DNDFOVEl6T0RjZ01DNHlOalF4TXpRZ01DNDFNamd4T1RnZ01DNHlPRFE1TWpVZ01DNDFNVEk0TkRZZ01DNHpNVEUwTmpaSU1DNDFOVGd3TWpsYVRUQXVOVFV3TnpneElEQXVNemM0TlRFMlF6QXVOVFV3TnpneElEQXVNell6TURJNUlEQXVOVFV4T0RZeklEQXVNelE0TURFMElEQXVOVFV6T0RrMklEQXVNek16T0RFMlNEQXVOVEF5TlRNMVF6QXVORGszTlRrMUlEQXVNelEzTnprM0lEQXVORGswT1RBMUlEQXVNell5T0RReklEQXVORGswT1RBMUlEQXVNemM0TlRFMlF6QXVORGswT1RBMUlEQXVNemswTVRrZ01DNDBPVGMxT1RVZ01DNDBNRGt5TXpVZ01DNDFNREkxTXpVZ01DNDBNak15TVRaSU1DNDFOVE00T1RaRE1DNDFOVEU0TmpNZ01DNDBNRGt3TVRrZ01DNDFOVEEzT0RFZ01DNHpPVFF3TURRZ01DNDFOVEEzT0RFZ01DNHpOemcxTVRaYVRUQXVOVGN4TkRRM0lEQXVORGcxT1RJMFF6QXVOVFkxT1RjNUlEQXVORGMwTURjMklEQXVOVFl4TkRReklEQXVORFl3TkRVNUlEQXVOVFU0TURJNUlEQXVORFExTlRZM1NEQXVOVEV5T0RRMlF6QXVOVEk0TVRrNElEQXVORGN5TVRBNElEQXVOVFV5TXpnM0lEQXVORGt5T0RrNElEQXVOVGd4TXprZ01DNDFNRE01TVRkRE1DNDFOemMzSURBdU5EazRNelE0SURBdU5UYzBNemd4SURBdU5Ea3lNamM1SURBdU5UY3hORFEzSURBdU5EZzFPVEkwV2swd0xqWTJOakkzTVNBd0xqUTNOalUxT1VNd0xqWTNNRFEwTmlBd0xqUTJOelV4SURBdU5qYzBNRGMySURBdU5EVTNNRGdnTUM0Mk56WTVPVElnTUM0ME5EVTFOamRJTUM0MU9ERXdNVGhETUM0MU9ETTVNelVnTUM0ME5UY3dPQ0F3TGpVNE56VTJOQ0F3TGpRMk56VXhJREF1TlRreE56UWdNQzQwTnpZMU5UbERNQzQyTURNME9UTWdNQzQxTURJd01qSWdNQzQyTVRjME56WWdNQzQxTVRJMk1UY2dNQzQyTWprd01EVWdNQzQxTVRJMk1UZERNQzQyTkRBMU16VWdNQzQxTVRJMk1UY2dNQzQyTlRRMU1UZ2dNQzQxTURJd01qSWdNQzQyTmpZeU56RWdNQzQwTnpZMU5UbGFUVEF1TlRjek1UTWdNQzR6TnpnMU1UWkRNQzQxTnpNeE15QXdMak01TkRJek9DQXdMalUzTkRNeU5DQXdMalF3T1RJMk9DQXdMalUzTmpRNU1pQXdMalF5TXpJeE5rZ3dMalk0TVRVeE9VTXdMalk0TXpZNE55QXdMalF3T1RJMk9DQXdMalk0TkRnNE1TQXdMak01TkRJek9DQXdMalk0TkRnNE1TQXdMak0zT0RVeE5rTXdMalk0TkRnNE1TQXdMak0yTWpjNU5TQXdMalk0TXpZNE55QXdMak0wTnpjMk5TQXdMalk0TVRVeE9TQXdMak16TXpneE5rZ3dMalUzTmpRNU1rTXdMalUzTkRNeU5DQXdMak0wTnpjMk5TQXdMalUzTXpFeklEQXVNell5TnprMUlEQXVOVGN6TVRNZ01DNHpOemcxTVRaYVRUQXVOelExTVRZMUlEQXVORFExTlRZM1NEQXVOams1T1RneVF6QXVOamsyTlRZNElEQXVORFl3TkRVNUlEQXVOamt5TURNeUlEQXVORGMwTURjMklEQXVOamcyTlRZeklEQXVORGcxT1RJMFF6QXVOamd6TmpNZ01DNDBPVEl5TnprZ01DNDJPREF6TVRNZ01DNDBPVGd6TkRnZ01DNDJOelkyTWpJZ01DNDFNRE01TVRkRE1DNDNNRFUyTWpRZ01DNDBPVEk0T1RnZ01DNDNNams0TVRNZ01DNDBOekl4TURnZ01DNDNORFV4TmpVZ01DNDBORFUxTmpkYVRUQXVOekEwTVRFMUlEQXVOREl6TWpFMlNEQXVOelUxTkRjMlF6QXVOell3TkRFMklEQXVOREE1TWpNMUlEQXVOell6TVRBMUlEQXVNemswTVRrZ01DNDNOak14TURVZ01DNHpOemcxTVRaRE1DNDNOak14TURVZ01DNHpOakk0TkRNZ01DNDNOakEwTVRZZ01DNHpORGMzT1RjZ01DNDNOVFUwTnpZZ01DNHpNek00TVRaSU1DNDNNRFF4TVRWRE1DNDNNRFl4TkRnZ01DNHpORGd3TVRRZ01DNDNNRGN5TXpJZ01DNHpOak13TWprZ01DNDNNRGN5TXpJZ01DNHpOemcxTVRaRE1DNDNNRGN5TXpJZ01DNHpPVFF3TURRZ01DNDNNRFl4TkRnZ01DNDBNRGt3TVRrZ01DNDNNRFF4TVRVZ01DNDBNak15TVRaYVRUQXVOelExTVRZMUlEQXVNekV4TkRZMlF6QXVOekk1T0RFeklEQXVNamcwT1RJMUlEQXVOekExTmpJMElEQXVNalkwTVRNMElEQXVOamMyTmpJeUlEQXVNalV6TVRFMlF6QXVOamd3TXpFeklEQXVNalU0TmpnMUlEQXVOamd6TmpNZ01DNHlOalEzTlRRZ01DNDJPRFkxTmpNZ01DNHlOekV4TURoRE1DNDJPVEl3TXpJZ01DNHlPREk1TlRjZ01DNDJPVFkxTmpnZ01DNHlPVFkxTnpRZ01DNDJPVGs1T0RJZ01DNHpNVEUwTmpaSU1DNDNORFV4TmpWYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQ0F3TGpBeE5UTTRNRGtwSWk4K0ppTjRZVHM4TDJOc2FYQlFZWFJvUGlZamVHRTdQQzlrWldaelBpWWplR0U3UEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5LTkiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNzAiIHk9IjIwOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kZTFkZDE1ZC01MjQyLTRkMGUtOTEzYy0wOWQyZDM4MWRmYjctMjUiIHZhbHVlPSJNb2JpbGUgRGV2aWNlIENsaWVudCIgc3R5bGU9ImlyLnJlZj1kZTFkZDE1ZC01MjQyLTRkMGUtOTEzYy0wOWQyZDM4MWRmYjc7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bW9iaWxlLWRldmljZS1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHpOVEEyTWpjZ01DNHhNamsyTXpsRE1DNHlPVGcwTWpNZ01DNHhNamsyTXprZ01DNHlOVFl4TURRZ01DNHhOekU1TlRnZ01DNHlOVFl4TURRZ01DNHlNalF4TmpGV01DNDNPVEV5T1RkRE1DNHlOVFl4TURRZ01DNDRORE0xTURFZ01DNHlPVGcwTWpNZ01DNDRPRFU0TWlBd0xqTTFNRFl5TnlBd0xqZzROVGd5U0RBdU5qTTBNVGsyUXpBdU5qZzJNems1SURBdU9EZzFPRElnTUM0M01qZzNNVGtnTUM0NE5ETTFNREVnTUM0M01qZzNNVGtnTUM0M09URXlPVGRXTUM0eU1qUXhOakZETUM0M01qZzNNVGtnTUM0eE56RTVOVGdnTUM0Mk9EWXpPVGtnTUM0eE1qazJNemtnTUM0Mk16UXhPVFlnTUM0eE1qazJNemxJTUM0ek5UQTJNamRhVFRBdU16STJPVGsySURBdU1qRXlNelEyUXpBdU16STJPVGsySURBdU1UazVNamsxSURBdU16TTNOVGMySURBdU1UZzROekUxSURBdU16VXdOakkzSURBdU1UZzROekUxU0RBdU5qTTBNVGsyUXpBdU5qUTNNalEzSURBdU1UZzROekUxSURBdU5qVTNPREkzSURBdU1UazVNamsxSURBdU5qVTNPREkzSURBdU1qRXlNelEyVmpBdU56TXlNakl4UXpBdU5qVTNPREkzSURBdU56UTFNamN4SURBdU5qUTNNalEzSURBdU56VTFPRFV4SURBdU5qTTBNVGsySURBdU56VTFPRFV4U0RBdU16VXdOakkzUXpBdU16TTNOVGMySURBdU56VTFPRFV4SURBdU16STJPVGsySURBdU56UTFNamN4SURBdU16STJPVGsySURBdU56TXlNakl4VmpBdU1qRXlNelEyV2swd0xqUTJORGcwTWlBd0xqZzFNRE0zTkVNd0xqUTBPVFl4TmlBd0xqZzFNRE0zTkNBd0xqUXpOekkzTXlBd0xqZ3pPREF6SURBdU5ETTNNamN6SURBdU9ESXlPREEwUXpBdU5ETTNNamN6SURBdU9EQTNOVGM0SURBdU5EUTVOakUySURBdU56azFNak0xSURBdU5EWTBPRFF5SURBdU56azFNak0xU0RBdU5URTVPVGhETUM0MU16VXlNRFlnTUM0M09UVXlNelVnTUM0MU5EYzFOU0F3TGpnd056VTNPQ0F3TGpVME56VTFJREF1T0RJeU9EQTBRekF1TlRRM05UVWdNQzQ0TXpnd015QXdMalV6TlRJd05pQXdMamcxTURNM05DQXdMalV4T1RrNElEQXVPRFV3TXpjMFNEQXVORFkwT0RReVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGprNE5EWXhOU0lnYUdWcFoyaDBQU0l3TGprNE5EWXhOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURBd01qUTBNVFF4SURBdU1ERTFNemd3T1NraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LWYwYmE3NzIyLTM5YjYtNGM4MS04MjkwLWEzMGEyNDhiYjhkOS05IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY2IiB5PSI0NyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZhbHVlPSJQcml2YXRlIFNlY3VyZWQiIHN0eWxlPSJpci5yZWY9MmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9Ijc1IiB5PSItMzUiIHdpZHRoPSI3OTUiIGhlaWdodD0iNDI5IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xOCIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2LTciIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtMTIiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgdmFsdWU9IlJFU1RmdWwgV2ViIFNlcnZpY2UiIHN0eWxlPSJpci5yZWY9YzM1YWRjOTYtMzk2OC00MjQ4LTg0MjItYjM2ZjY4MDVlOGY2O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjIwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE5IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTA7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VudHJ5UGVyaW1ldGVyPTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQyNjA0ODZmLTUyYjMtNDk0Ni1iYWUxLWI5NjdiZWE5MzZjMy02IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9ZDI2MDQ4NmYtNTJiMy00OTQ2LWJhZTEtYjk2N2JlYTkzNmMzO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXdlYi1hcHBsaWNhdGlvbi1zZXJ2ZXItc2lkZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RZMk1VTXdMak0yTlRnMU15QXdMakk0TWpjNE1pQXdMak0zT0RjeU5TQXdMakkyT1RreE1TQXdMak01TkRZd015QXdMakkyT1RreE1VZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkyT1RreE1TQXdMall6TkRFNE5pQXdMakk0TWpjNE1pQXdMall6TkRFNE5pQXdMakk1T0RZMk1VTXdMall6TkRFNE5pQXdMak14TkRVek9TQXdMall5TVRNeE5DQXdMak15TnpReE1TQXdMall3TlRRek5pQXdMak15TnpReE1VZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpReE1TQXdMak0yTlRnMU15QXdMak14TkRVek9TQXdMak0yTlRnMU15QXdMakk1T0RZMk1WcE5NQzR6T1RRMk1ETWdNQzQyT1RFMU56aERNQzR6TnpnM01qVWdNQzQyT1RFMU56Z2dNQzR6TmpVNE5UTWdNQzQzTURRME5TQXdMak0yTlRnMU15QXdMamN5TURNeU9FTXdMak0yTlRnMU15QXdMamN6TmpJd05pQXdMak0zT0RjeU5TQXdMamMwT1RBM09DQXdMak01TkRZd015QXdMamMwT1RBM09FZ3dMalUxTURBeE9WWXdMalk1TVRVM09FZ3dMak01TkRZd00xcE5NQzQyTWpBek5URWdNQzQyTWprNU1URklNQzQyTURRMU5qVkRNQzQxT1RjeE5EUWdNQzQyTWprNU1URWdNQzQxT1RBd05qZ2dNQzQyTXpFek9UTWdNQzQxT0RNMk1Ua2dNQzQyTXpRd056aElNQzR6T1RRMk1ETkRNQzR6TnpnM01qVWdNQzQyTXpRd056Z2dNQzR6TmpVNE5UTWdNQzQyTWpFeU1EWWdNQzR6TmpVNE5UTWdNQzQyTURVek1qaERNQzR6TmpVNE5UTWdNQzQxT0RrME5Ea2dNQzR6TnpnM01qVWdNQzQxTnpZMU56Z2dNQzR6T1RRMk1ETWdNQzQxTnpZMU56aElNQzQyTURVME16WkRNQzQyTWpFek1UUWdNQzQxTnpZMU56Z2dNQzQyTXpReE9EWWdNQzQxT0RrME5Ea2dNQzQyTXpReE9EWWdNQzQyTURVek1qaERNQzQyTXpReE9EWWdNQzQyTVRVM05EVWdNQzQyTWpnMk5EWWdNQzQyTWpRNE5qZ2dNQzQyTWpBek5URWdNQzQyTWprNU1URmFUVEF1TmpjeU5URTVJREF1TmpJNU9URXhWakF1TWpNeE5UYzNRekF1TmpjeU5URTVJREF1TVRrNU9ESXhJREF1TmpRMk56YzJJREF1TVRjME1EYzNJREF1TmpFMU1ERTVJREF1TVRjME1EYzNTREF1TXpnMU1ESkRNQzR6TlRNeU5qTWdNQzR4TnpRd056Y2dNQzR6TWpjMU1pQXdMakU1T1RneU1TQXdMak15TnpVeUlEQXVNak14TlRjM1ZqQXVOelk0TWpRMVF6QXVNekkzTlRJZ01DNDRNREF3TURFZ01DNHpOVE15TmpNZ01DNDRNalUzTkRVZ01DNHpPRFV3TWlBd0xqZ3lOVGMwTlVnd0xqVTFNREF4T1ZZd0xqZzNOVE0yTmtNd0xqVTFNREF4T1NBd0xqZzNPREEwTWlBd0xqVTFNREl4TWlBd0xqZzRNRFkzTWlBd0xqVTFNRFU0TkNBd0xqZzRNekkwTlVnd0xqTTROVEF5UXpBdU16SXhOVEEzSURBdU9EZ3pNalExSURBdU1qY3dNRElnTUM0NE16RTNOVGNnTUM0eU56QXdNaUF3TGpjMk9ESTBOVll3TGpJek1UVTNOME13TGpJM01EQXlJREF1TVRZNE1EWTBJREF1TXpJeE5UQTNJREF1TVRFMk5UYzNJREF1TXpnMU1ESWdNQzR4TVRZMU56ZElNQzQyTVRVd01UbERNQzQyTnpnMU16SWdNQzR4TVRZMU56Y2dNQzQzTXpBd01Ua2dNQzR4Tmpnd05qUWdNQzQzTXpBd01Ua2dNQzR5TXpFMU56ZFdNQzQyTWprNU1URklNQzQyTnpJMU1UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTnpjMU1qUWdNQzQyTmpJM01rd3dMamMzT1RrMU9TQXdMalkyTWpjNE9FTXdMamd3TVRjek5pQXdMalkyTkRBd05TQXdMamd4T1RFMk9DQXdMalk0TVRRek55QXdMamd5TURNNE5pQXdMamN3TXpFNU9Fd3dMamd5TURRMU15QXdMamN3TlRZek0xWXdMamcxTnpRNE1rd3dMamd5TURNNE5pQXdMamcxT1RreE4wTXdMamd4T1RFMk9DQXdMamc0TVRZM09DQXdMamd3TVRjek55QXdMamc1T1RFeElEQXVOemM1T1RjMUlEQXVPVEF3TXpJNFREQXVOemMzTlRRZ01DNDVNREF6T1RaSU1DNDJNalUyTnpkRE1DNDJNREkzT1RRZ01DNDVNREF6T1RZZ01DNDFPRFF3T1RRZ01DNDRPREkwT0RRZ01DNDFPREk0TXpJZ01DNDROVGs1TVRkTU1DNDFPREkzTmpRZ01DNDROVGMwT0RKV01DNDNNRFUyTXpORE1DNDFPREkzTmpRZ01DNDJPREkzTlNBd0xqWXdNRFkzTkNBd0xqWTJOREExSURBdU5qSXpNalF5SURBdU5qWXlOemc0VERBdU5qSTFOamMzSURBdU5qWXlOekpJTUM0M056YzFNalJhVFRBdU56azBNREk1SURBdU56STROelF4U0RBdU5qQTVNVGc0VERBdU5qQTVNVGN5SURBdU9EVTNORGd5UXpBdU5qQTVNVGN5SURBdU9EWTJNREk0SURBdU5qRTFOalkzSURBdU9EY3pNRFUySURBdU5qSXpPVGc1SURBdU9EY3pPVEF4VERBdU5qSTFOamMzSURBdU9EY3pPVGczU0RBdU56YzNOVFJNTUM0M056a3lNamdnTUM0NE56TTVNREZETUM0M09EWTVPVFlnTUM0NE56TXhNVE1nTUM0M09UTXhOekVnTUM0NE5qWTVNemNnTUM0M09UTTVOaUF3TGpnMU9URTNUREF1TnprME1EUTFJREF1T0RVM05EZ3lUREF1TnprME1ESTVJREF1TnpJNE56UXhXazB3TGpZM09EUTVNeUF3TGpjME9EVTBOME13TGpZNE16VXdOeUF3TGpjME9EVTBOeUF3TGpZNE56WTFJREF1TnpVeU1qY3pJREF1TmpnNE16QTJJREF1TnpVM01UQTNUREF1TmpnNE16azNJREF1TnpVNE5EVldNQzQ0TlRBNE9FTXdMalk0T0RNNU55QXdMamcxTlRnNU15QXdMalk0TkRZM01TQXdMamcyTURBek55QXdMalkzT1Rnek55QXdMamcyTURZNU0wd3dMalkzT0RRNU15QXdMamcyTURjNE0wZ3dMall6TWpJM09VTXdMall5TnpJMk5pQXdMamcyTURjNE15QXdMall5TXpFeU1pQXdMamcxTnpBMU55QXdMall5TWpRMk5pQXdMamcxTWpJeU5Fd3dMall5TWpNM05pQXdMamcxTURnNFZqQXVOelU0TkRWRE1DNDJNakl6TnpZZ01DNDNOVE0wTXpjZ01DNDJNall4TURJZ01DNDNORGt5T1RNZ01DNDJNekE1TXpVZ01DNDNORGcyTXpoTU1DNDJNekl5TnprZ01DNDNORGcxTkRkSU1DNDJOemcwT1ROYVRUQXVOalk0TlRrZ01DNDNOamd6TlRSSU1DNDJOREl4T0RKV01DNDROREE1TnpkSU1DNDJOamcxT1ZZd0xqYzJPRE0xTkZwTk1DNDNOVGMzTVRnZ01DNDNPRGd4T1RsRE1DNDNOak14T0RjZ01DNDNPRGd4T1RrZ01DNDNOamMyTWpFZ01DNDNPVEkyTXpNZ01DNDNOamMyTWpFZ01DNDNPVGd4TURORE1DNDNOamMyTWpFZ01DNDRNRE14TVRZZ01DNDNOak00T1RZZ01DNDRNRGN5TmlBd0xqYzFPVEEyTWlBd0xqZ3dOemt4TlV3d0xqYzFOemN4T0NBd0xqZ3dPREF3Tmtnd0xqY3hNVFUyTWtNd0xqY3dOakE1TXlBd0xqZ3dPREF3TmlBd0xqY3dNVFkxT1NBd0xqZ3dNelUzTWlBd0xqY3dNVFkxT1NBd0xqYzVPREV3TTBNd0xqY3dNVFkxT1NBd0xqYzVNekE0T1NBd0xqY3dOVE00TkNBd0xqYzRPRGswTmlBd0xqY3hNREl4T0NBd0xqYzRPREk1VERBdU56RXhOVFl5SURBdU56ZzRNVGs1U0RBdU56VTNOekU0V2swd0xqYzNNRGt5TWlBd0xqYzBPRFUwTjBNd0xqYzNOak01TWlBd0xqYzBPRFUwTnlBd0xqYzRNRGd5TlNBd0xqYzFNams0TVNBd0xqYzRNRGd5TlNBd0xqYzFPRFExUXpBdU56Z3dPREkxSURBdU56WXpORFkwSURBdU56YzNNU0F3TGpjMk56WXdOeUF3TGpjM01qSTJOaUF3TGpjMk9ESTJNMHd3TGpjM01Ea3lNaUF3TGpjMk9ETTFORWd3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpjMk9ETTFOQ0F3TGpjd01UWTFPU0F3TGpjMk16a3lJREF1TnpBeE5qVTVJREF1TnpVNE5EVkRNQzQzTURFMk5Ua2dNQzQzTlRNME16Y2dNQzQzTURVek9EUWdNQzQzTkRreU9UTWdNQzQzTVRBeU1UZ2dNQzQzTkRnMk16aE1NQzQzTVRFMU5qSWdNQzQzTkRnMU5EZElNQzQzTnpBNU1qSmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXhJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpreUlpQm9aV2xuYUhROUlqQXVPVElpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBME1EQXpPVEVnTUM0d05EQXdNemt4S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyNTkiIHk9IjE3OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xZDU2ZWMyYS04YTY2LTRmZTMtOTI5My1hMzc5YTQ0NzA0ZWItMjEiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhYmFzZSIgc3R5bGU9ImlyLnJlZj1jNDcyZmUxNC1hOTUzLTRiOGYtYmJkNy1lN2E3MTNiZjY5MTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhLTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYjBiOGYzZi02NGZjLTQ5MTUtOTdiOC1kMjFlMGRiZTY2MzMtMjIiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBPdGhlciBkYXRhIHN0b3JlIiBzdHlsZT0iaXIucmVmPTY2NzAxY2RiLTI5NTQtNGY5ZC05YjFiLTY3YWJhYmY4MmJhZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWMtMTEiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS02ZDQ4NmYyMi05ZDU1LTQ0NzktODIzZS00Nzg1ZDMzN2RiY2ItMjQiIHZhbHVlPSJXZWIgU2VydmljZSAtPiBNaWNyb3NvZnQgQXp1cmUgU2VydmljZSBCdXMgTWVzc2FnaW5nIiBzdHlsZT0iaXIucmVmPTA3MjIxNzRlLTFmNzYtNDMxZC1hYzcxLWEyOTgzZGZkM2Q2NztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTEtMjMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMWI5YjQxZC03OGE2LTRjNTctOTNjMi0zZWZhOGM1NmVkNTctOCIgdmFsdWU9IldlYiBTZXJ2aWNlIiBzdHlsZT0iaXIucmVmPWMxYjliNDFkLTc4YTYtNGM1Ny05M2MyLTNlZmE4YzU2ZWQ1Nztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak0yTlRnMU15QXdMakk1T0RjNE0wTXdMak0yTlRnMU15QXdMakk0TWprd05TQXdMak0zT0RjeU5TQXdMakkzTURBek15QXdMak01TkRZd015QXdMakkzTURBek0wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMakkzTURBek15QXdMall6TkRFNE5pQXdMakk0TWprd05TQXdMall6TkRFNE5pQXdMakk1T0RjNE0wTXdMall6TkRFNE5pQXdMak14TkRZMk1TQXdMall5TVRNeE5DQXdMak15TnpVek15QXdMall3TlRRek5pQXdMak15TnpVek0wZ3dMak01TkRZd00wTXdMak0zT0RjeU5TQXdMak15TnpVek15QXdMak0yTlRnMU15QXdMak14TkRZMk1TQXdMak0yTlRnMU15QXdMakk1T0RjNE0xcE5NQzR6T1RRMk1ETWdNQzQyT1RFM1F6QXVNemM0TnpJMUlEQXVOamt4TnlBd0xqTTJOVGcxTXlBd0xqY3dORFUzTWlBd0xqTTJOVGcxTXlBd0xqY3lNRFExUXpBdU16WTFPRFV6SURBdU56TTJNekk0SURBdU16YzROekkxSURBdU56UTVNaUF3TGpNNU5EWXdNeUF3TGpjME9USklNQzQxTXpnNU1UTkRNQzQxTkRNeU56SWdNQzQzTWpnek1UTWdNQzQxTlRFMU56a2dNQzQzTURnNE56UWdNQzQxTmpNd01UVWdNQzQyT1RFM1NEQXVNemswTmpBeldrMHdMalkzTWpVeUlEQXVOakl3TXpVeFZqQXVNak14TmprNVF6QXVOamN5TlRJZ01DNHhPVGs1TkRNZ01DNDJORFkzTnpZZ01DNHhOelF4T1RrZ01DNDJNVFV3TWlBd0xqRTNOREU1T1Vnd0xqTTROVEF4T1VNd0xqTTFNekkyTXlBd0xqRTNOREU1T1NBd0xqTXlOelV4T1NBd0xqRTVPVGswTXlBd0xqTXlOelV4T1NBd0xqSXpNVFk1T1ZZd0xqYzJPRE0yTjBNd0xqTXlOelV4T1NBd0xqZ3dNREV5TXlBd0xqTTFNekkyTXlBd0xqZ3lOVGcyTnlBd0xqTTROVEF4T1NBd0xqZ3lOVGcyTjBnd0xqVTBNVEF4T0VNd0xqVTBOalkyT0NBd0xqZzBOekF3TkNBd0xqVTFOalF3TnlBd0xqZzJOalEzSURBdU5UWTVNek0ySURBdU9EZ3pNelkzU0RBdU16ZzFNREU1UXpBdU16SXhOVEEzSURBdU9EZ3pNelkzSURBdU1qY3dNRElnTUM0NE16RTROemtnTUM0eU56QXdNaUF3TGpjMk9ETTJOMVl3TGpJek1UWTVPVU13TGpJM01EQXlJREF1TVRZNE1UZzNJREF1TXpJeE5UQTNJREF1TVRFMk5qazVJREF1TXpnMU1ERTVJREF1TVRFMk5qazVTREF1TmpFMU1ESkRNQzQyTnpnMU16TWdNQzR4TVRZMk9Ua2dNQzQzTXpBd01pQXdMakUyT0RFNE55QXdMamN6TURBeUlEQXVNak14TmprNVZqQXVOakl3TmpBeFF6QXVOekl3TkRVNUlEQXVOakU0T0RjNUlEQXVOekV3TmpFeUlEQXVOakUzT1RnZ01DNDNNREExTlRZZ01DNDJNVGM1T0VNd0xqWTVNRGs1T1NBd0xqWXhOems0SURBdU5qZ3hOak15SURBdU5qRTROemt5SURBdU5qY3lOVElnTUM0Mk1qQXpOVEZhVFRBdU16WTFPRFV6SURBdU5qQTFORFZETUM0ek5qVTROVE1nTUM0MU9EazFOekVnTUM0ek56ZzNNalVnTUM0MU56WTNJREF1TXprME5qQXpJREF1TlRjMk4wZ3dMall3TlRRek5rTXdMall5TVRNeE5DQXdMalUzTmpjZ01DNDJNelF4T0RZZ01DNDFPRGsxTnpFZ01DNDJNelF4T0RZZ01DNDJNRFUwTlVNd0xqWXpOREU0TmlBd0xqWXlNVE15T0NBd0xqWXlNVE14TkNBd0xqWXpORElnTUM0Mk1EVTBNellnTUM0Mk16UXlTREF1TXprME5qQXpRekF1TXpjNE56STFJREF1TmpNME1pQXdMak0yTlRnMU15QXdMall5TVRNeU9DQXdMak0yTlRnMU15QXdMall3TlRRMVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlF6QXVOekk0TWpJMElEQXVPRGN6TVRZNUlEQXVOekV6TlRneElEQXVPRGs1TkRNMElEQXVOams1TURJeUlEQXVPRGs1TkRNMFF6QXVOamcwT1RBeklEQXVPRGs1TkRNMElEQXVOamN3TnpBM0lEQXVPRGMwTnpNM0lEQXVOall6TVRreklEQXVPRE00TURVNFREQXVOall5TlRBNElEQXVPRE0wTlRnMFNEQXVOek0xTlRNMlNEQXVOall5TlRBNFdrMHdMalU1TXpZME5DQXdMamd6TkRVNE5rd3dMalkwTkRReU9DQXdMamd6TkRVNE5FTXdMalkwT0Rjek1TQXdMamcxT1RFME15QXdMalkxTmpBeU15QXdMamc0TURBek55QXdMalkyTlRVMk55QXdMamc1TkRZMlF6QXVOak0xTXpNNUlEQXVPRGcxTnpNeUlEQXVOakV3TVRjeklEQXVPRFkxTURNMUlEQXVOVGsxTXpjZ01DNDRNemM0TnpaTU1DNDFPVE0yTkRRZ01DNDRNelExT0RaYVRUQXVOelV6TmpFMUlEQXVPRE0wTlRnMFREQXVPREEwTXprNUlEQXVPRE0wTlRnMlF6QXVOemc1T0RjMklEQXVPRFl6TXpZZ01DNDNOak01TVRRZ01DNDRPRFV6TnpVZ01DNDNNekkwT0RnZ01DNDRPVFEyTlRWRE1DNDNOREV6T0RnZ01DNDRPREV3TURFZ01DNDNORGd6TXpJZ01DNDROakU0T1RRZ01DNDNOVEkzTVRVZ01DNDRNemswTkRWTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSTU1DNDRNRFF6T1RrZ01DNDRNelExT0RaTU1DNDNOVE0yTVRVZ01DNDRNelExT0RSYVRUQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFF6QXVPREUyTVRjMklEQXVOelkxTlRNMElEQXVPREUyT1RnNUlEQXVOemN6TkRJMElEQXVPREUyT1RnNUlEQXVOemd4TlRBMFF6QXVPREUyT1RnNUlEQXVOemt6T0RNeklEQXVPREUxTURrM0lEQXVPREExTnpJeElEQXVPREV4TlRnNUlEQXVPREUyT0RrelNEQXVOelUyTVRJeVF6QXVOelUzTXpZMElEQXVPREExTlRrNElEQXVOelU0TURFMElEQXVOemt6TnpNeUlEQXVOelU0TURFMElEQXVOemd4TlRBMFF6QXVOelU0TURFMElEQXVOemMyTVRRMklEQXVOelUzT0RnNUlEQXVOemN3T0RVMklEQXVOelUzTmpRMElEQXVOelkxTmpVMFREQXVOelUzTVRnNElEQXVOelUzT1RFNFREQXVPREUwTmpJNUlEQXVOelUzT1RFeFREQXVOelUzTVRnNElEQXVOelUzT1RFNFdrMHdMalU0TXpReE5DQXdMamMxTnpreE1Vd3dMalkwTURnMU5pQXdMamMxTnpreE9FTXdMalkwTURNeElEQXVOelkxTlRnMElEQXVOalF3TURJNUlEQXVOemN6TkRZMklEQXVOalF3TURJNUlEQXVOemd4TlRBMFF6QXVOalF3TURJNUlEQXVOemt4TWpnMklEQXVOalF3TkRRMklEQXVPREF3T0RNM0lEQXVOalF4TWpRNElEQXVPREV3TURRNVREQXVOalF4T1RJeUlEQXVPREUyT0RrelNEQXVOVGcyTkRVMVF6QXVOVGd5T1RRMklEQXVPREExTnpJeElEQXVOVGd4TURVMUlEQXVOemt6T0RNeklEQXVOVGd4TURVMUlEQXVOemd4TlRBMFF6QXVOVGd4TURVMUlEQXVOemN6TkRJMElEQXVOVGd4T0RZM0lEQXVOelkxTlRNMElEQXVOVGd6TkRFMElEQXVOelUzT1RFeFdrMHdMalkxT0RZeklEQXVOelUzT1RFeVNEQXVOek01TkRFelF6QXVOelF3TURBMklEQXVOelkxTlRJM0lEQXVOelF3TXpJeUlEQXVOemN6TkRFMklEQXVOelF3TXpJeUlEQXVOemd4TlRBMFF6QXVOelF3TXpJeUlEQXVOemt4TXpnMElEQXVOek01T0RVeElEQXVPREF3T1RZMklEQXVOek00T1RjNUlEQXVPREV3TVRFMVREQXVOek00TWpVeUlEQXVPREUyT0RrelNEQXVOalU1TnpreFF6QXVOalU0TkRVNElEQXVPREExTnpNNElEQXVOalUzTnpJeElEQXVOemt6T0RVMElEQXVOalUzTnpJeElEQXVOemd4TlRBMFF6QXVOalUzTnpJeElEQXVOemMxTkRNNElEQXVOalUzT0RrNUlEQXVOelk1TkRnMElEQXVOalU0TWpNNElEQXVOell6TmpjelREQXVOalU0TmpNZ01DNDNOVGM1TVRKSU1DNDNNemswTVROSU1DNDJOVGcyTTFwTk1DNDNNek0zTkRrZ01DNDJOekF6TlRoTU1DNDNNekkwTnpjZ01DNDJOamd6TlVNd0xqYzJPREEzTnlBd0xqWTNPRGcxT1NBd0xqYzVOalkyT0NBd0xqY3dOVGN4SURBdU9EQTVOVFl5SURBdU56UXdNakU1VERBdU56VTFOREUwSURBdU56UXdNakl5UXpBdU56VXhOamt5SURBdU56RXhOekUxSURBdU56UTBNVE15SURBdU5qZzNNak16SURBdU56TXpOelE1SURBdU5qY3dNelU0VERBdU56TXlORGMzSURBdU5qWTRNelZNTUM0M016TTNORGtnTUM0Mk56QXpOVGhhVFRBdU5qWTBNVE1nTUM0Mk5qZzNPRFJNTUM0Mk5qVTFOallnTUM0Mk5qZ3pOVU13TGpZMU5URTNPQ0F3TGpZNE5ESTJOeUF3TGpZME56UTFOeUF3TGpjd056WXhOaUF3TGpZME16TTFOaUF3TGpjek5UQXpORXd3TGpZME1qWXpJREF1TnpRd01qSXlUREF1TlRnNE5EZ3hJREF1TnpRd01qRTVRekF1TmpBeE1qQXhJREF1TnpBMk1UYzJJREF1TmpJNU1UazRJREF1TmpjNU5UZzBJREF1TmpZME1UTWdNQzQyTmpnM09EUk1NQzQyTmpVMU5qWWdNQzQyTmpnek5Vd3dMalkyTkRFeklEQXVOalk0TnpnMFdrMHdMalk1T1RBeU1pQXdMalkyTXpVM05FTXdMamN4TkRVM055QXdMalkyTXpVM05DQXdMamN6TURJeU5pQXdMalk1TXpVMU15QXdMamN6TmpreklEQXVOek0yTlRBMlREQXVOek0zTkRneklEQXVOelF3TWpFNVNEQXVOall3TlRZeFF6QXVOalkyT1RJeklEQXVOamsxTWpreElEQXVOamd6TURJeUlEQXVOall6TlRjMElEQXVOams1TURJeUlEQXVOall6TlRjMFdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BDOW5QaVlqZUdFN1BDOW5QaVlqZUdFN1BHUmxabk0rSmlONFlUczhZMnhwY0ZCaGRHZ2dhV1E5SW1Oc2FYQXdJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01TSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1TWlJZ2FHVnBaMmgwUFNJd0xqa3lJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TkRBd016a3hJREF1TURRd01ETTVNU2tpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjQ2NCIgeT0iMTQ2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LWQzMTg5MTg3LWQyZWUtNGI1Yy04M2EyLWZiMDI4N2Y4YjczYS00IiB2YWx1ZT0iT3RoZXIgZGF0YWJhc2UiIHN0eWxlPSJpci5yZWY9ZDMxODkxODctZDJlZS00YjVjLTgzYTItZmIwMjg3ZjhiNzNhO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW90aGVyO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqVXdNREUxTmlBd0xqUXhOVGsxTmtNd0xqWTROemt5TVNBd0xqUXhOVGsxTmlBd0xqZzBNREUxTmlBd0xqTTBNRGMzTmlBd0xqZzBNREUxTmlBd0xqSTBOemsxTmtNd0xqZzBNREUxTmlBd0xqRTFOVEV6TmlBd0xqWTROemt5TVNBd0xqQTNPVGsxTmpFZ01DNDFNREF4TlRZZ01DNHdOems1TlRZeFF6QXVNekV5TXpreElEQXVNRGM1T1RVMk1TQXdMakUyTURFMU5pQXdMakUxTlRFek5pQXdMakUyTURFMU5pQXdMakkwTnprMU5rTXdMakUyTURFMU5pQXdMak0wTURjM05pQXdMak14TWpNNU1TQXdMalF4TlRrMU5pQXdMalV3TURFMU5pQXdMalF4TlRrMU5scE5NQzQzTmprd09UWWdNQzQwTWpNd09UWkRNQzQzT1RRM056Z2dNQzQwTVRBMk16TWdNQzQ0TVRnMk56UWdNQzR6T1RRNE5UY2dNQzQ0TkRBeE5UWWdNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzQ0TkRBeE5UWWdNQzQ0TkRRM056WWdNQzQyT0RjNU1qRWdNQzQ1TVRrNU5UWWdNQzQxTURBeE5UWWdNQzQ1TVRrNU5UWkRNQzR6TVRJek9URWdNQzQ1TVRrNU5UWWdNQzR4TmpBeE5UWWdNQzQ0TkRRM056WWdNQzR4TmpBeE5UWWdNQzQzTlRFNU5UWldNQzR6TnpZeE9ESkRNQzR4T0RFMk16a2dNQzR6T1RRNE5UY2dNQzR5TURVMU16UWdNQzQwTVRBMk16TWdNQzR5TXpFeU1UWWdNQzQwTWpNd09UWkRNQzR6TURNek9ERWdNQzQwTlRnM01USWdNQzR6T1RnME9UWWdNQzQwTnpnNU5UWWdNQzQxTURBeE5UWWdNQzQwTnpnNU5UWkRNQzQyTURFNE1UWWdNQzQwTnpnNU5UWWdNQzQyT1RZNU16RWdNQzQwTlRnM01USWdNQzQzTmprd09UWWdNQzQwTWpNd09UWmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0MSIgeT0iMjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtYTExZTQ4OGItNjY0My00ZmE2LTlhNWUtNzk5OGNmMmM2YjFjLTExIiB2YWx1ZT0iT3RoZXIgZGF0YSBzdG9yZSIgc3R5bGU9ImlyLnJlZj1hMTFlNDg4Yi02NjQzLTRmYTYtOWE1ZS03OTk4Y2YyYzZiMWM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9b3RoZXItZGF0YWJhc2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDFNREEyTkRVZ01DNDBNVFl3TnpoRE1DNDJPRGcwTVNBd0xqUXhOakEzT0NBd0xqZzBNRFkwTlNBd0xqTTBNRGc1T0NBd0xqZzBNRFkwTlNBd0xqSTBPREEzT0VNd0xqZzBNRFkwTlNBd0xqRTFOVEkxT0NBd0xqWTRPRFF4SURBdU1EZ3dNRGM0TVNBd0xqVXdNRFkwTlNBd0xqQTRNREEzT0RGRE1DNHpNVEk0T0NBd0xqQTRNREEzT0RFZ01DNHhOakEyTkRVZ01DNHhOVFV5TlRnZ01DNHhOakEyTkRVZ01DNHlORGd3TnpoRE1DNHhOakEyTkRVZ01DNHpOREE0T1RnZ01DNHpNVEk0T0NBd0xqUXhOakEzT0NBd0xqVXdNRFkwTlNBd0xqUXhOakEzT0ZwTk1DNDNOamsxT0RVZ01DNDBNak15TVRoRE1DNDNPVFV5TmpjZ01DNDBNVEEzTlRVZ01DNDRNVGt4TmpJZ01DNHpPVFE1TnprZ01DNDROREEyTkRVZ01DNHpOell6TURSV01DNDFNREF3TmpoRE1DNDRNVGt4TmpFZ01DNDFNVGczTkRRZ01DNDNPVFV5TmpjZ01DNDFNelExTVRrZ01DNDNOamsxT0RVZ01DNDFORFk1T0RKRE1DNDJPVGMwTVRrZ01DNDFPREkxT1RnZ01DNDJNREl6TURRZ01DNDJNREk0TkRJZ01DNDFNREEyTkRVZ01DNDJNREk0TkRKRE1DNHpPVGc1T0RVZ01DNDJNREk0TkRJZ01DNHpNRE00TmprZ01DNDFPREkxT1RnZ01DNHlNekUzTURVZ01DNDFORFk1T0RKRE1DNHlNRFl3TWpJZ01DNDFNelExTVRrZ01DNHhPREl4TWpjZ01DNDFNVGczTkRRZ01DNHhOakEyTkRVZ01DNDFNREF3TmpoV01DNHpOell6TURSRE1DNHhPREl4TWpjZ01DNHpPVFE1TnprZ01DNHlNRFl3TWpJZ01DNDBNVEEzTlRVZ01DNHlNekUzTURVZ01DNDBNak15TVRoRE1DNHpNRE00TmprZ01DNDBOVGc0TXpRZ01DNHpPVGc1T0RVZ01DNDBOemt3TnpnZ01DNDFNREEyTkRVZ01DNDBOemt3TnpoRE1DNDJNREl6TURRZ01DNDBOemt3TnpnZ01DNDJPVGMwTVRrZ01DNDBOVGc0TXpRZ01DNDNOamsxT0RVZ01DNDBNak15TVRoYVRUQXVOelk1TlRnMUlEQXVOVGc0TnpVM1F6QXVOemsxTWpZM0lEQXVOVGMyTWpreklEQXVPREU1TVRZeElEQXVOVFl3TlRFNElEQXVPRFF3TmpRMUlEQXVOVFF4T0RReVZqQXVOalV3TURZNVF6QXVPREU1TVRZeElEQXVOalk0TnpRMUlEQXVOemsxTWpZM0lEQXVOamcwTlRJZ01DNDNOamsxT0RVZ01DNDJPVFk1T0RSRE1DNDJPVGMwTVRrZ01DNDNNekkxT1RrZ01DNDJNREl6TURRZ01DNDNOVEk0TkRNZ01DNDFNREEyTkRVZ01DNDNOVEk0TkRORE1DNHpPVGc1T0RVZ01DNDNOVEk0TkRNZ01DNHpNRE00TmprZ01DNDNNekkxT1RrZ01DNHlNekUzTURVZ01DNDJPVFk1T0RSRE1DNHlNRFl3TWpJZ01DNDJPRFExTWlBd0xqRTRNakV5TnlBd0xqWTJPRGMwTlNBd0xqRTJNRFkwTlNBd0xqWTFNREEyT1ZZd0xqVTBNVGcwTWtNd0xqRTRNakV5TnlBd0xqVTJNRFV4T0NBd0xqSXdOakF5TWlBd0xqVTNOakk1TXlBd0xqSXpNVGN3TlNBd0xqVTRPRGMxTjBNd0xqTXdNemcyT1NBd0xqWXlORE0zTWlBd0xqTTVPRGs0TlNBd0xqWTBORFl4TmlBd0xqVXdNRFkwTlNBd0xqWTBORFl4TmtNd0xqWXdNak13TkNBd0xqWTBORFl4TmlBd0xqWTVOelF4T1NBd0xqWXlORE0zTWlBd0xqYzJPVFU0TlNBd0xqVTRPRGMxTjFwTk1DNHhOakEyTkRVZ01DNDJPVEU0TkRSV01DNDNOVEl3TnpoRE1DNHhOakEyTkRVZ01DNDRORFE0T1RnZ01DNHpNVEk0T0NBd0xqa3lNREEzT0NBd0xqVXdNRFkwTlNBd0xqa3lNREEzT0VNd0xqWTRPRFF4SURBdU9USXdNRGM0SURBdU9EUXdOalExSURBdU9EUTBPRGs0SURBdU9EUXdOalExSURBdU56VXlNRGM0VmpBdU5qa3hPRFEwUXpBdU9ERTVNVFl4SURBdU56RXdOVEU1SURBdU56azFNalkzSURBdU56STJNamsxSURBdU56WTVOVGcxSURBdU56TTROelU0UXpBdU5qazNOREU1SURBdU56YzBNemMwSURBdU5qQXlNekEwSURBdU56azBOakU0SURBdU5UQXdOalExSURBdU56azBOakU0UXpBdU16azRPVGcxSURBdU56azBOakU0SURBdU16QXpPRFk1SURBdU56YzBNemMwSURBdU1qTXhOekExSURBdU56TTROelU0UXpBdU1qQTJNREl5SURBdU56STJNamsxSURBdU1UZ3lNVEkzSURBdU56RXdOVEU1SURBdU1UWXdOalExSURBdU5qa3hPRFEwV2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2NDEiIHk9IjE1NCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yMCIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtMTIiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtYzFiOWI0MWQtNzhhNi00YzU3LTkzYzItM2VmYThjNTZlZDU3LTgiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMiIgdmFsdWU9IiIgc3R5bGU9Im91dGxpbmVDb25uZWN0PTA7ZGFzaGVkPTA7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1jZW50ZXI7aHRtbD0xO3NoYXBlPW14Z3JhcGguYXdzMy5hcHBsaWNhdGlvbl9sb2FkX2JhbGFuY2VyO2ZpbGxDb2xvcj0jRjU4NTM0O2dyYWRpZW50Q29sb3I9bm9uZTtmb250Q29sb3I9IzhDOEM4QztzdHJva2VDb2xvcj0jOEM4QzhDO3N0cm9rZVdpZHRoPTM7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI0NjkiIHk9IjI1IiB3aWR0aD0iNjkiIGhlaWdodD0iNzIiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE2IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1jMzVhZGM5Ni0zOTY4LTQyNDgtODQyMi1iMzZmNjgwNWU4ZjYtNyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE3IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9InRlbXBsYXRlLTE2NTQyMDY1LTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZC0xMCIgc291cmNlPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS1kMjYwNDg2Zi01MmIzLTQ5NDYtYmFlMS1iOTY3YmVhOTM2YzMtNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTEzIiB2YWx1ZT0iIiBzdHlsZT0ib3V0bGluZUNvbm5lY3Q9MDtkYXNoZWQ9MDt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWNlbnRlcjtodG1sPTE7c2hhcGU9bXhncmFwaC5hd3MzLmNsYXNzaWNfbG9hZF9iYWxhbmNlcjtmaWxsQ29sb3I9I0Y1ODUzNDtncmFkaWVudENvbG9yPW5vbmU7Zm9udENvbG9yPSM4QzhDOEM7c3Ryb2tlQ29sb3I9IzhDOEM4QztzdHJva2VXaWR0aD0zOyIgcGFyZW50PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQtMTAiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTMwIiB5PSIxMTAiIHdpZHRoPSI2OSIgaGVpZ2h0PSI3MiIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0idGVtcGxhdGUtMTY1NDIwNjUtZTRiYzdhNmQtOWVjMi00NzEzLThhZGQtNDAxYmM3Mjg3YTExLTIzIiB2YWx1ZT0iTWljcm9zb2Z0IEF6dXJlIFNlcnZpY2UgQnVzIE1lc3NhZ2luZyIgc3R5bGU9ImlyLnJlZj1lNGJjN2E2ZC05ZWMyLTQ3MTMtOGFkZC00MDFiYzcyODdhMTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTUlDUk9TT0ZULUFaVVJFLVNFUi1CVVMtTVNHO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM01EbGZNalV5TlRNcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTVNems1TmlBd0xqSXdOemMyTkVnd0xqSTBNemM0TTFZd0xqTTBOVFUwTmtNd0xqSTBNemM0TXlBd0xqTTBPRFV4TkNBd0xqSTBNall3TXlBd0xqTTFNVE0yTVNBd0xqSTBNRFV3TkNBd0xqTTFNelEyUXpBdU1qTTROREExSURBdU16VTFOVFU1SURBdU1qTTFOVFU1SURBdU16VTJOek00SURBdU1qTXlOVGtnTUM0ek5UWTNNemhJTUM0eE9ETXhPRGxETUM0eE9EQXlNakVnTUM0ek5UWTNNemdnTUM0eE56Y3pOelFnTUM0ek5UVTFOVGtnTUM0eE56VXlOelVnTUM0ek5UTTBOa013TGpFM016RTNOaUF3TGpNMU1UTTJNU0F3TGpFM01UazVOeUF3TGpNME9EVXhOQ0F3TGpFM01UazVOeUF3TGpNME5UVTBObFl3TGpJeU9UYzJNa013TGpFM01UazVOeUF3TGpJeU16a3lPQ0F3TGpFM05ETXhOU0F3TGpJeE9ETXpNeUF3TGpFM09EUTBJREF1TWpFME1qQTNRekF1TVRneU5UWTJJREF1TWpFd01EZ3hJREF1TVRnNE1UWXhJREF1TWpBM056WTBJREF1TVRrek9UazJJREF1TWpBM056WTBWakF1TWpBM056WTBXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0MUlpQmtQU0pOTUM0eE9UTTVPVFlnTUM0eU1EYzNOalJJTUM0eU5ETTNPRE5XTUM0ek5EVTFORFpETUM0eU5ETTNPRE1nTUM0ek5EZzFNVFFnTUM0eU5ESTJNRE1nTUM0ek5URXpOakVnTUM0eU5EQTFNRFFnTUM0ek5UTTBOa013TGpJek9EUXdOU0F3TGpNMU5UVTFPU0F3TGpJek5UVTFPU0F3TGpNMU5qY3pPQ0F3TGpJek1qVTVJREF1TXpVMk56TTRTREF1TVRnek1UZzVRekF1TVRnd01qSXhJREF1TXpVMk56TTRJREF1TVRjM016YzBJREF1TXpVMU5UVTVJREF1TVRjMU1qYzFJREF1TXpVek5EWkRNQzR4TnpNeE56WWdNQzR6TlRFek5qRWdNQzR4TnpFNU9UY2dNQzR6TkRnMU1UUWdNQzR4TnpFNU9UY2dNQzR6TkRVMU5EWldNQzR5TWprM05qSkRNQzR4TnpFNU9UY2dNQzR5TWpNNU1qZ2dNQzR4TnpRek1UVWdNQzR5TVRnek16TWdNQzR4TnpnME5DQXdMakl4TkRJd04wTXdMakU0TWpVMk5pQXdMakl4TURBNE1TQXdMakU0T0RFMk1TQXdMakl3TnpjMk5DQXdMakU1TXprNU5pQXdMakl3TnpjMk5GWXdMakl3TnpjMk5Gb2lJR1pwYkd3OUlpTTVPVGs1T1RraUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCdmNHRmphWFI1UFNJd0xqVWlJR1E5SWswd0xqYzFOak0wT0NBd0xqSXdOemMyTkVnd0xqZ3dOakV6TkVNd0xqZ3hNVGsyT1NBd0xqSXdOemMyTkNBd0xqZ3hOelUyTkNBd0xqSXhNREE0TVNBd0xqZ3lNVFk1SURBdU1qRTBNakEzUXpBdU9ESTFPREUxSURBdU1qRTRNek16SURBdU9ESTRNVE16SURBdU1qSXpPVEk0SURBdU9ESTRNVE16SURBdU1qSTVOell5VmpBdU16UTFOVFEyUXpBdU9ESTRNVE16SURBdU16UTROVEUwSURBdU9ESTJPVFUwSURBdU16VXhNell4SURBdU9ESTBPRFUxSURBdU16VXpORFpETUM0NE1qSTNOVFlnTUM0ek5UVTFOVGtnTUM0NE1UazVNRGtnTUM0ek5UWTNNemdnTUM0NE1UWTVOREVnTUM0ek5UWTNNemhJTUM0M05qY3hOVFJETUM0M05qUXlOVE1nTUM0ek5UWTJNemdnTUM0M05qRTFNRFFnTUM0ek5UVTBNVFVnTUM0M05UazBPRGdnTUM0ek5UTXpNalpETUM0M05UYzBOeklnTUM0ek5URXlNemdnTUM0M05UWXpORFlnTUM0ek5EZzBORGdnTUM0M05UWXpORGdnTUM0ek5EVTFORFpXTUM0eU1EYzNOalJhSWlCbWFXeHNQU0lqT1RrNU9UazVJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpneE1qVWdNQzR5TWprM05qSldNQzR5Tnpnd01EVk1NQzR4TnpJd01qUWdNQzR5Tnpnd01EVldNQzR5TWprM05qSkRNQzR4TnpJd01qUWdNQzR5TWpNNU1qZ2dNQzR4TnpRek5ESWdNQzR5TVRnek16SWdNQzR4TnpnME5qY2dNQzR5TVRReU1EZERNQzR4T0RJMU9UTWdNQzR5TVRBd09ERWdNQzR4T0RneE9EZ2dNQzR5TURjM05qUWdNQzR4T1RRd01qTWdNQzR5TURjM05qUk1NQzQ0TURZMU1USWdNQzR5TURjM05qUkRNQzQ0TVRJeU9DQXdMakl3TnpnMk5TQXdMamd4TnpjM05pQXdMakl4TURJeU55QXdMamd5TVRneE9TQXdMakl4TkRNME1rTXdMamd5TlRnMk1TQXdMakl4T0RRMU5pQXdMamd5T0RFeU5pQXdMakl5TXprNU5DQXdMamd5T0RFeU5TQXdMakl5T1RjMk1sWXdMakl5T1RjMk1sb2lJR1pwYkd3OUlpTTVORGswT1RRaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqRTRNekkxSURBdU5qUXhPRFEyU0RBdU1qTXpNRE0yUXpBdU1qTTJNREExSURBdU5qUXhPRFEySURBdU1qTTRPRFV4SURBdU5qUXpNREkxSURBdU1qUXdPVFVnTUM0Mk5EVXhNalJETUM0eU5ETXdORGtnTUM0Mk5EY3lNak1nTUM0eU5EUXlNamtnTUM0Mk5UQXdOeUF3TGpJME5ESXlPU0F3TGpZMU16QXpPRll3TGpjNU1UazNOMGd3TGpFNU5EQTFOa013TGpFNU1URTJOeUF3TGpjNU1UazNOeUF3TGpFNE9ETXdOaUF3TGpjNU1UUXdPQ0F3TGpFNE5UWXpOeUF3TGpjNU1ETXdNa013TGpFNE1qazJPQ0F3TGpjNE9URTVOeUF3TGpFNE1EVTBNeUF3TGpjNE56VTNOaUF3TGpFM09EVWdNQzQzT0RVMU16UkRNQzR4TnpRek56VWdNQzQzT0RFME1EZ2dNQzR4TnpJd05UY2dNQzQzTnpVNE1UTWdNQzR4TnpJd05UY2dNQzQzTmprNU56aFdNQzQyTlRReE9UWkRNQzR4TnpFNE9UUWdNQzQyTlRJMk16SWdNQzR4TnpJd05qTWdNQzQyTlRFd05URWdNQzR4TnpJMU5USWdNQzQyTkRrMU5UZERNQzR4TnpNd05ERWdNQzQyTkRnd05qSWdNQzR4TnpNNE5DQXdMalkwTmpZNE55QXdMakUzTkRnNU5pQXdMalkwTlRVeU1rTXdMakUzTlRrMU1pQXdMalkwTkRNMU55QXdMakUzTnpJME1pQXdMalkwTXpReU55QXdMakUzT0RZNE1TQXdMalkwTWpjNU5FTXdMakU0TURFeUlEQXVOalF5TVRZZ01DNHhPREUyTnpjZ01DNDJOREU0TXpjZ01DNHhPRE15TlNBd0xqWTBNVGcwTmxZd0xqWTBNVGcwTmxvaUlHWnBiR3c5SWlNNU9UazVPVGtpTHo0bUkzaGhPenh3WVhSb0lHOXdZV05wZEhrOUlqQXVOU0lnWkQwaVRUQXVNVGd6TWpVZ01DNDJOREU0TkRaSU1DNHlNek13TXpaRE1DNHlNell3TURVZ01DNDJOREU0TkRZZ01DNHlNemc0TlRFZ01DNDJORE13TWpVZ01DNHlOREE1TlNBd0xqWTBOVEV5TkVNd0xqSTBNekEwT1NBd0xqWTBOekl5TXlBd0xqSTBOREl5T1NBd0xqWTFNREEzSURBdU1qUTBNakk1SURBdU5qVXpNRE00VmpBdU56a3hPVGMzU0RBdU1UazBNRFUyUXpBdU1Ua3hNVFkzSURBdU56a3hPVGMzSURBdU1UZzRNekEySURBdU56a3hOREE0SURBdU1UZzFOak0zSURBdU56a3dNekF5UXpBdU1UZ3lPVFk0SURBdU56ZzVNVGszSURBdU1UZ3dOVFF6SURBdU56ZzNOVGMySURBdU1UYzROU0F3TGpjNE5UVXpORU13TGpFM05ETTNOU0F3TGpjNE1UUXdPQ0F3TGpFM01qQTFOeUF3TGpjM05UZ3hNeUF3TGpFM01qQTFOeUF3TGpjMk9UazNPRll3TGpZMU5ERTVOa013TGpFM01UZzVOQ0F3TGpZMU1qWXpNaUF3TGpFM01qQTJNeUF3TGpZMU1UQTFNU0F3TGpFM01qVTFNaUF3TGpZME9UVTFOME13TGpFM016QTBNU0F3TGpZME9EQTJNaUF3TGpFM016ZzBJREF1TmpRMk5qZzNJREF1TVRjME9EazJJREF1TmpRMU5USXlRekF1TVRjMU9UVXlJREF1TmpRME16VTNJREF1TVRjM01qUXlJREF1TmpRek5ESTNJREF1TVRjNE5qZ3hJREF1TmpReU56azBRekF1TVRnd01USWdNQzQyTkRJeE5pQXdMakU0TVRZM055QXdMalkwTVRnek55QXdMakU0TXpJMUlEQXVOalF4T0RRMlZqQXVOalF4T0RRMldpSWdabWxzYkQwaUl6azVPVGs1T1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56WTNNakUxSURBdU5qUXhPRFEyU0RBdU9ERTNNREF5UXpBdU9ERTVPVGNnTUM0Mk5ERTRORFlnTUM0NE1qSTRNVGNnTUM0Mk5ETXdNalVnTUM0NE1qUTVNVFlnTUM0Mk5EVXhNalJETUM0NE1qY3dNVFVnTUM0Mk5EY3lNak1nTUM0NE1qZ3hPVFFnTUM0Mk5UQXdOeUF3TGpneU9ERTVOQ0F3TGpZMU16QXpPRll3TGpjMk9EZ3lRekF1T0RJNE1UazBJREF1TnpjME5qVTFJREF1T0RJMU9EYzNJREF1Tnpnd01qVWdNQzQ0TWpFM05URWdNQzQzT0RRek56VkRNQzQ0TVRjMk1qVWdNQzQzT0RnMU1ERWdNQzQ0TVRJd015QXdMamM1TURneE9TQXdMamd3TmpFNU5TQXdMamM1TURneE9VZ3dMamMxTmpRd09GWXdMalkxTkRFNU5rTXdMamMxTmpJME9DQXdMalkxTWpZMk5DQXdMamMxTmpRd05pQXdMalkxTVRFeE5TQXdMamMxTmpnM01pQXdMalkwT1RZME4wTXdMamMxTnpNek9DQXdMalkwT0RFM09TQXdMamMxT0RFd015QXdMalkwTmpneU1pQXdMamMxT1RFeE55QXdMalkwTlRZMk0wTXdMamMyTURFek1TQXdMalkwTkRVd05DQXdMamMyTVRNM05DQXdMalkwTXpVMk5pQXdMamMyTWpjMk9DQXdMalkwTWpreFF6QXVOelkwTVRZeElEQXVOalF5TWpVeklEQXVOelkxTmpjMUlEQXVOalF4T0RrZ01DNDNOamN5TVRVZ01DNDJOREU0TkRaV01DNDJOREU0TkRaYUlpQm1hV3hzUFNJak9UazVPVGs1SWk4K0ppTjRZVHM4Y0dGMGFDQnZjR0ZqYVhSNVBTSXdMalVpSUdROUlrMHdMamMyTnpJeE5TQXdMalkwTVRnME5rZ3dMamd4TnpBd01rTXdMamd4T1RrM0lEQXVOalF4T0RRMklEQXVPREl5T0RFM0lEQXVOalF6TURJMUlEQXVPREkwT1RFMklEQXVOalExTVRJMFF6QXVPREkzTURFMUlEQXVOalEzTWpJeklEQXVPREk0TVRrMElEQXVOalV3TURjZ01DNDRNamd4T1RRZ01DNDJOVE13TXpoV01DNDNOamc0TWtNd0xqZ3lPREU1TkNBd0xqYzNORFkxTlNBd0xqZ3lOVGczTnlBd0xqYzRNREkxSURBdU9ESXhOelV4SURBdU56ZzBNemMxUXpBdU9ERTNOakkxSURBdU56ZzROVEF4SURBdU9ERXlNRE1nTUM0M09UQTRNVGtnTUM0NE1EWXhPVFVnTUM0M09UQTRNVGxJTUM0M05UWTBNRGhXTUM0Mk5UUXhPVFpETUM0M05UWXlORGdnTUM0Mk5USTJOalFnTUM0M05UWTBNRFlnTUM0Mk5URXhNVFVnTUM0M05UWTROeklnTUM0Mk5EazJORGRETUM0M05UY3pNemdnTUM0Mk5EZ3hOemtnTUM0M05UZ3hNRE1nTUM0Mk5EWTRNaklnTUM0M05Ua3hNVGNnTUM0Mk5EVTJOak5ETUM0M05qQXhNekVnTUM0Mk5EUTFNRFFnTUM0M05qRXpOelFnTUM0Mk5ETTFOallnTUM0M05qSTNOamdnTUM0Mk5ESTVNVU13TGpjMk5ERTJNU0F3TGpZME1qSTFNeUF3TGpjMk5UWTNOU0F3TGpZME1UZzVJREF1TnpZM01qRTFJREF1TmpReE9EUTJWakF1TmpReE9EUTJXaUlnWm1sc2JEMGlJems1T1RrNU9TSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNVGN4T1RrM0lEQXVOelk1T1RrMFZqQXVOekl4TnpVeVNEQXVPREk0TURrNVZqQXVOelk1T1RrMFF6QXVPREk0TURrNUlEQXVOemMxT0RJNElEQXVPREkxTnpneElEQXVOemd4TkRJeklEQXVPREl4TmpVMklEQXVOemcxTlRRNVF6QXVPREUzTlRNZ01DNDNPRGsyTnpRZ01DNDRNVEU1TXpVZ01DNDNPVEU1T1RJZ01DNDRNRFl4SURBdU56a3hPVGt5U0RBdU1Ua3pPVGsyUXpBdU1UZzRNVFl4SURBdU56a3hPVGt5SURBdU1UZ3lOVFkySURBdU56ZzVOamMwSURBdU1UYzRORFFnTUM0M09EVTFORGxETUM0eE56UXpNVFVnTUM0M09ERTBNak1nTUM0eE56RTVPVGNnTUM0M056VTRNamdnTUM0eE56RTVPVGNnTUM0M05qazVPVFJXTUM0M05qazVPVFJhSWlCbWFXeHNQU0lqT1RRNU5EazBJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RJME9DQXdMak0yTURNMU1sWXdMall6TWpjNU9Vd3dMalE1TnpZd015QXdMalE1TmpZNU4wd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6TXlRa1ZFUkNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU56QXlOamd4SURBdU16WXdOREUyVERBdU5EazNOVFU1SURBdU5EazJOelpNTUM0M01ESTVNalFnTUM0Mk16STJNVGhETUM0M01ESTBNemdnTUM0Mk1qY3lOekVnTUM0M01ESTJPREVnTUM0ek5UVTFOVFVnTUM0M01ESTJPREVnTUM0ek5qQTBNVFphSWlCbWFXeHNQU0lqTVRrNFFVSXpJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwT1RZNE56VWdNQzQwT1RZNE1qWk1NQzR5T1RJME9DQXdMall6TWpZNE9FZ3dMamN3TWpRNE5WWXdMall6TWpRME5Vd3dMalE1TmpnM05TQXdMalE1TmpneU5sb2lJR1pwYkd3OUluVnliQ2dqY0dGcGJuUXdYMnhwYm1WaGNsOHhOekE1WHpJMU1qVXpLU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TWpreU5EZ2dNQzR6TmpBek5USklNQzQzTURJM01qWk1NQzQwT1RrM09TQXdMalV4T1RjNE5VTXdMalE1T0RVMk5pQXdMalV5TURjeE1pQXdMalE1TnpBM015QXdMalV5TVRJeE15QXdMalE1TlRVek55QXdMalV5TVRJeE0wTXdMalE1TkRBd01pQXdMalV5TVRJeE15QXdMalE1TWpVd09DQXdMalV5TURjeE1pQXdMalE1TVRJNE5DQXdMalV4T1RjNE5Vd3dMakk1TWpRNElEQXVNell3TXpVeVdpSWdabWxzYkQwaUl6VXdSVFpHUmlJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOGJHbHVaV0Z5UjNKaFpHbGxiblFnYVdROUluQmhhVzUwTUY5c2FXNWxZWEpmTVRjd09WOHlOVEkxTXlJZ2VERTlJakF1TkRrM05qQTBJaUI1TVQwaU1DNDBPVFk0TWpZaUlIZ3lQU0l3TGpRNU56WXdOQ0lnZVRJOUlqQXVOak15T1RNeElpQm5jbUZrYVdWdWRGVnVhWFJ6UFNKMWMyVnlVM0JoWTJWUGJsVnpaU0krSmlONFlUczhjM1J2Y0NCemRHOXdMV052Ykc5eVBTSWpNREExUWtFeElpOCtKaU40WVRzOGMzUnZjQ0J2Wm1aelpYUTlJakF1TWpZaUlITjBiM0F0WTI5c2IzSTlJaU13TURVNE9VUWlMejRtSTNoaE96eHpkRzl3SUc5bVpuTmxkRDBpTUM0MU15SWdjM1J2Y0MxamIyeHZjajBpSXpBd05FWTVNQ0l2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJd0xqZ2lJSE4wYjNBdFkyOXNiM0k5SWlNd01ETkdOME1pTHo0bUkzaGhPenh6ZEc5d0lHOW1abk5sZEQwaU1TSWdjM1J2Y0MxamIyeHZjajBpSXpBd016QTJOeUl2UGlZamVHRTdQQzlzYVc1bFlYSkhjbUZrYVdWdWRENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1UY3dPVjh5TlRJMU15SStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0RBd01ERWlJR2hsYVdkb2REMGlNQzQ0T0RBd01ERWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEyTURBMU9EWWdNQzR3TmpBd05UZzJLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0idGVtcGxhdGUtMTY1NDIwNjUtMmFiNGVmZmEtNDBiNy00Y2QyLWJhODEtODI0N2QyOWE2ZjJkLTEwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY0NSIgeT0iMjgzIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9InRlbXBsYXRlLTE2NTQyMDY1LTE1IiBzdHlsZT0iaXIuYXNzZXRzPTtpci50YWdzPTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7IiBwYXJlbnQ9IjEiIHNvdXJjZT0idGVtcGxhdGUtMTY1NDIwNjUtYTNjNjczMWMtMzUzYy00YjUzLTgxZDEtYjM1OGJlZTYxYWRjLTMiIHRhcmdldD0idGVtcGxhdGUtMTY1NDIwNjUtMTMiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSJ0ZW1wbGF0ZS0xNjU0MjA2NS0yNiIgc3R5bGU9ImlyLmFzc2V0cz07aXIudGFncz07ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSIxIiBzb3VyY2U9InRlbXBsYXRlLTE2NTQyMDY1LWRlMWRkMTVkLTUyNDItNGQwZS05MTNjLTA5ZDJkMzgxZGZiNy0yNSIgdGFyZ2V0PSJ0ZW1wbGF0ZS0xNjU0MjA2NS0xMyIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvcm9vdD48L214R3JhcGhNb2RlbD4=</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions>
+    <wizardQuestion ref="template_16542065" answer="true" manuallyModified="false"/>
+  </questions>
+  <assets>
+    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
+      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
+    </asset>
+    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="Web Service -&gt; Microsoft Azure Service Bus Messaging" ref="0722174e-1f76-431d-ac71-a2983dfd3d67" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="aa19a301-3655-4958-8fa9-12f6c8f76746">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other data store" ref="66701cdb-2954-4f9d-9b1b-67ababf82baf" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="7e40a8c4-d66d-4fda-97b0-cf32743724f1">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Service -&gt; Other database" ref="c472fe14-a953-4b8f-bbd7-e7a713bf6911" source="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" target="972a00a0-b3ef-4a79-b494-8088f1d45f57">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="6901d605-405e-40d3-a16c-fed2bf7325e9" diagramComponentId="a3c6731c-353c-4b53-81d1-b358bee61adc" ref="a076c1e1-f412-473c-85af-2bc811522b81" name="Web Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read
+                        the code or reverse engineer it if it is compiled in any form. If the client side code includes
+                        secret keys, sensitive business logic (like client authentication) or proprietary information,
+                        all of this is directly exposed to the user, allowing them to get the sensitive information or
+                        study the business logic with the aim of bypassing it.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Some examples of this vulnerability are:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a
+                        cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt;
+                        &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client
+                        calls without a proxy.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:53.614">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
+                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
+                        required security controls are implemented correctly, operating as intended, enforcing the
+                        desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.794">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can
+                        be leaked to users with access to the code. This access can be incidentally granted by
+                        publishing the source code on a package-form or an online, public repository.
+
+                        The unauthorized access to any of those secrets could lead to a compromise of sensitive data or
+                        a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been
+                        actively reviewed or maintained.
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.013">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.014">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
+                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
+                        encryption between the client and server, terminating within a secure environment on the
+                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
+                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
+                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
+                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
+                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
+                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
+                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
+                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side
+                        technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or
+                        client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and
+                            Silverlight.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and
+                        subject to manipulation by a malicious actor, regardless of the controls in place (e.g.
+                        encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application
+                        logic decisions, such as access controls, and data considered sensitive or secret, such as
+                        encryption keys. While controls may be duplicated on the client-side to improve the user
+                        experience, it is important to have these enforced on the server-side.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt;
+                        &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required
+                        should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be
+                        considered tainted, and security decisions should not be made solely on this data. For example,
+                        an insecure implementation could include a compiled application (e.g. Flash!) performing
+                        authentication on the client-side against a stored password. The decompilation of the binary (in
+                        this case flv file) or the interception and modification of controls between the client and
+                        server could expose the password or allow unauthorized access to the authenticated application
+                        content.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly
+                            where client-side controls are implemented.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no
+                            inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span
+                            class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side
+                        software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or
+                        sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side
+                        must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online
+                        repositories, services, and other associated restricted content must have appropriate access
+                        controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server
+                        side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending
+                        on the use case, this encryption may be asymmetric or public key, or symmetric using a shared
+                        secret. Note however that reversible encryption on the client-side and in-memory storage are
+                        still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular
+                            expression patterns within the code, configuration and other files exposed on the client and
+                            server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be
+                            triggered before the code is published (in particular for public/open source code) as once
+                            published it is likely to be archived (and any disclosed secrets would be exposed and/or
+                            have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary
+                            or persistent storage of sensitive or secret data on the client-side, and the protections in
+                            place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Use periodically a static code analysis tool to analyze the code and detect potentially
+                        malicious code, such as time functions, unsafe file operations and networks connections. With
+                        the scanning of static code, we ensure the integrity of the application.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Verify that a code analysis tool is in use and it is configured to detect potentially
+                            malicious code, such as time functions, unsafe file operations and network connections.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
+                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
+                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
+                        connection, using approved cryptographic algorithms.&lt;/p&gt;
+                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
+                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
+                        authentication system, most typically identified as a separate entity in a Federated
+                        authentication system. A CSP may be an independent third party, or may issue credentials for its
+                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
+                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
+                        but whose users may be subsequently authenticated to other sites, applications or services
+                        without further action on their part.&lt;/p&gt;
+                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
+                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
+                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
+                        the claimant's possession and control of one or two authenticators, using an authentication
+                        protocol.&lt;/p&gt;
+                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
+                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
+                        to process a transaction or grant access to information or a system.&lt;/p&gt;
+                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
+                        identity proofing.&lt;/p&gt;
+                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
+                        authentication protocols.&lt;/p&gt;
+                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
+                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
+                            with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:53.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically
+                        secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid
+                        certificates expose the application and its users to spoofing attacks such as Man In The Middle
+                        (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence
+                        in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a
+                        trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is
+                        legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use
+                        throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a
+                            positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use
+                            TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL
+                            Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan
+                            tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool:
+                            https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate
+                            all security issues and warnings relating to the server certificate, and those in the trust
+                            chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in
+                        use, which have undergone extensive review and testing by the developers, as well as
+                        third-parties in the development, security, and cryptography space. Typically, these widely used
+                        implementations have a lower risk of exploitation compared with privately developed - or less
+                        known - implementations (although vulnerabilities such as Heartbleed highlight this is not
+                        universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify
+                        the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify
+                        the veracity of the implementations, and review third party validations together with security
+                        advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries
+                        are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven
+                        implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a
+                            publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If
+                            not, assurance of the security of the implementation should be sought, or the risk
+                            quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the
+                            server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm
+                            that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use
+                            TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL
+                            Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan
+                            tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool:
+                            https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate
+                            all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security
+                            mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment,
+                                allowing developers to monitor their code regularly in order to avoid security
+                                vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                As programming languages evolve, functions occasionally become obsolete due to:
+                                &lt;/div&gt;
+                                &lt;ul&gt;
+                                &lt;li&gt;Advances in the language.&lt;/li&gt;
+                                &lt;li&gt;Improved understanding of how operations should be performed effectively and
+                                securely.&lt;/li&gt;
+                                &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+                                &lt;/ul&gt;
+                                &lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that
+                                perform the same task in some different and hopefully improved way.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components
+                                (typically client and server). The attacker places himself in the communication channel
+                                between the two components. Whenever one component attempts to communicate with the
+                                other (data flow, authentication challenges, etc.), the data first goes to the attacker,
+                                who has the opportunity to observe or alter it, and it is then passed to the other
+                                component as if it were never intercepted. This interposition is transparent leaving the
+                                two compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="74e341fb-b28c-4e24-93c9-18ed9657d476" diagramComponentId="c1b9b41d-78a6-4c57-93c2-3efa8c56ed57" ref="b4ab3358-66e5-4e92-b5a6-f2d97821a49a" name="Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
+                        actor without imposing any restrictions on how many resources can be allocated, in violation of
+                        the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.
+
+                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
+                        network traffic can often be sniffed by any attacker who has access to a network interface. This
+                        significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.241">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a
+                        user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an
+                        unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
+                        is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but
+                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
+                        intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
+                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
+                        arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
+                        a file or directory that is located underneath a restricted parent directory, but the software
+                        does not properly neutralize special elements within the pathname that can cause the pathname to
+                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
+                        file operations are intended to take place within a restricted directory. By using special
+                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
+                        location to access files or directories that are elsewhere on the system. One of the most common
+                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
+                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
+                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
+                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
+                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
+                        truncate a generated filename to widen the scope of attack. For example, the software may add
+                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
+                        effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or
+                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
+                        "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an
+                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
+                        could modify the intended OS command when it is sent to a downstream component. This could allow
+                        attackers to execute unexpected, dangerous commands directly on the operating system. This
+                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
+                        access to the operating system, such as in web applications.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
+                        specify commands that normally would not be accessible, or to call alternate commands with
+                        privileges that the attacker does not have. The problem is exacerbated if the compromised
+                        process does not follow the principle of least privilege, because the attacker-controlled
+                        commands may run with special system privileges that increases the amount of damage.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        There are at least two subtypes of OS command injection:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
+                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
+                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
+                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
+                        from executing. However, if the program does not remove command separators from the HOSTNAME
+                        argument, attackers could place the separators into the arguments, which allows them to execute
+                        their own program after nslookup has finished executing.The application accepts an input that it
+                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
+                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
+                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
+                        execute arbitrary commands or programs. If the command is being executed using functions like
+                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
+                        in the same line. From a weakness standpoint, these variants represent distinct programmer
+                        errors.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
+                        will be part of the arguments in the command to be executed. In the second variant, the
+                        programmer does not intend for the command to be accessible to any untrusted party, but the
+                        programmer probably has not accounted for alternate ways in which malicious attackers can
+                        provide input.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.781">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
+                        attributes, properties, or fields that are to be initialized or updated in an object, but it
+                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
+                        the object contains attributes that were only intended for internal use, then their unexpected
+                        modification could lead to a vulnerability. This weakness is sometimes known by the
+                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
+                        object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
+                        an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.781">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits
+                        important details about the event when logging it. When critical security events are not logged
+                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
+                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
+                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
+                        required security controls are implemented correctly, operating as intended, enforcing the
+                        desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.524">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
+                        immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.780">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
+                        a security decision, but it does not properly ensure that the IP address is truly associated
+                        with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.607">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
+                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
+                        expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.884">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
+                        down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in
+                        a way that is observable to an unauthorized actor, which exposes security-relevant information
+                        about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.498">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
+                        passwords, as well as sensitive information pertaining to the application and system. The source
+                        code can also be sent back to a client because of an error condition or an improperly configured
+                        handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.239">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.422">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.357">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
+                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.355">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
+                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
+                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:30.356">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
+                        Where there is no alternative, any user input being included must be sanitized or sandboxed
+                        before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
+                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
+                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
+                            will execute the code with the same permissions, potentially including operation system
+                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
+                            procedures that want to invoke a large number of functions, or set a large number of
+                            variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
+                        is denied. There are many ways this rule will manifest in application code. Some examples of
+                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
+                        new users/roles start with minimal or no permissions and users/roles do not receive access to
+                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
+                        an error or exception while processing access control requests. In these cases access control
+                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
+                        registers for a new account, that account should have minimal or no access by default until that
+                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
+                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
+                            every portion of the application in which a user can create information inside the database
+                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
+                            (statement of account, order details, etc.), or delete information (drop users, messages,
+                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method. Many flaws in applications result from
+                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
+                        disclosure. Use of filenames or other direct references to objects such as files on the
+                        server-side increases the risk of compromise of the system or unauthorized access to other
+                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
+                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
+                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
+                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
+                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
+                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
+                        references are used to access files from within the web-root deviating from recommended security
+                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
+                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
+                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
+                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
+                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
+                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
+                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
+                            way and if so, it should not be possible to access locations outside of this domain (i.e.
+                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
+                            etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.978">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but
+                        depending on the resource type the headers may vary. Identify the type of resource the web
+                        service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                        subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin:
+                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin:
+                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be
+                        omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data
+                        personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API
+                        endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized
+                        resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials:
+                        true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a
+                        href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods:
+                        POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...:
+                        ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers
+                        from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources
+                        that are intended for cross-origin no-cors embedding, but which don't intend to be directly
+                        legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated
+                        documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
+                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
+                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
+                        Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest,
+                        Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting
+                        Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents
+                        that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
+                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to
+                        be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
+                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
+                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
+                        that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
+                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
+                            properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some
+                            external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
+                            href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic
+                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
+                            href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just
+                            open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.469">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
+                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
+                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
+                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
+                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
+                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
+                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
+                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
+                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
+                        the usage of automated tools is detected, the application should respond by denying access and
+                        notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.045">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
+                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
+                        database records and database fields. Sensitive information can be extracted from data mining
+                        operations. When information is personally identifiable information, it may lead to
+                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
+                        data mining activities, organizations determine whether such activities are authorized.
+                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
+                        policies that address data mining requirements. Organizational personnel consult with the senior
+                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
+                        mining prevention and detection techniques include limiting the number and frequency of database
+                        queries to increase the work factor needed to determine the contents of databases, limiting
+                        types of responses provided to database queries, applying differential privacy techniques or
+                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
+                        occur. Data mining protection focuses on protecting information from data mining while such
+                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
+                        organizational information that may have been mined or otherwise obtained from data stores and
+                        is available as open-source information residing on external sites, such as social networking or
+                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
+                        threat program for deterring, detecting, and mitigating insider threats, including the
+                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
+                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
+                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
+                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
+                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
+                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
+                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
+                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
+                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or
+                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
+                        client-side actions. This can expose the application to attack through remote or local
+                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
+                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
+                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
+                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
+                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
+                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
+                            are untrusted, make sure there is a validation and sanitization mechanism before sending
+                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
+                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
+                        encryption between the client and server, terminating within a secure environment on the
+                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
+                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
+                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
+                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
+                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
+                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
+                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
+                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
+                        controllers, services, and other resources. This implies protection against spoofing and
+                        elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
+                            the database (e.g., making a payment, adding a contact, or sending a message), or can
+                            receive information (statement of account, order details, etc.), or delete information (drop
+                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
+                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
+                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
+                            may be used in applications for:&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
+                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
+                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
+                        applications. These HTTP methods can be used for nefarious purposes if the web server is
+                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
+                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
+                        and POST are by far the most common methods that are used to access information provided by a
+                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
+                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
+                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
+                        of these methods can potentially pose a security risk for a web application, as they allow an
+                        attacker to modify the files stored on the web server and, in some scenarios, steal the
+                        credentials of legitimate users. More specifically, the methods that should be disabled are the
+                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
+                        client to upload new files onto the web server. An attacker may exploit this by uploading
+                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
+                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
+                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
+                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
+                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
+                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
+                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
+                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
+                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
+                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
+                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
+                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
+                        DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.679">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
+                        secure deployment of the application, particularly if the application infrastructure is software
+                        defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
+                            configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
+                            (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Web server and application server configurations play a key role in the security of a web
+                        application. These servers are responsible for serving content and invoking applications that
+                        generate content. In addition, many application servers provide a number of services that web
+                        applications can use, including data storage, directory services, mail, messaging, and more.
+                        Failure to manage the proper configuration of your servers can lead to a wide variety of
+                        security problems.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Authorized administrators need to ensure the integrity of all security-relevant configurations
+                        to detect tampering.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            In order to evaluate the readiness of the application platform, testing for configuration
+                            management includes the following sections:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
+                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
+                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
+                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
+                        is directly written to a log file, then this data could contain newline or other meta-characters
+                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
+                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
+                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
+                        header) should be included with requests. This security header was designed to prevent
+                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
+                        fetch originates from. It doesn't include any path information, but only the server name. It is
+                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
+                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
+                        Content-Disposition response header tells the browser to download a file rather than displaying
+                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
+                        but does not specify a character set, then the browser may analyze the HTML and attempt to
+                        determine which character set it appears to be using. Even if the majority of the HTML actually
+                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
+                        in the response may cause the browser to interpret the content using a different character set.
+                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
+                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
+                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
+                        use the Origin header for authentication or access control decisions, as the Origin header can
+                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
+                        header for file downloading in all API responses with the following directives:
+                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
+                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
+                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
+                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
+                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
+                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
+                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
+                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
+                            insecure configurations; for example, when the server returns back the Origin header in the
+                            Access-Control-Allow-Origin without any additional checks AND returns
+                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
+                            that this configuration is very insecure, and is not acceptable in general terms, except in
+                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
+                            Reflected File Download input payloads to launch commands on the client machine. Reflected
+                            File Download is an attack combining URL path segments (now deprecated) with pages that
+                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
+                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
+                            popular misuse; namely, being used for encoding malicious injection strings in a way that
+                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
+                            validation filters, or take advantage of particular ways in which browsers render encoded
+                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
+                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
+                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
+                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
+                        Protections can include ensuring that DNS names used by applications are regularly checked for
+                        expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
+                            the connection to the DNS was authenticated successfully by username/password or certificate
+                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
+                        time that the application requires to function properly while minimizing the resources employed
+                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
+                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
+                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
+                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
+                        distinguishing between malicious and legitimate traffic. Many of the most common protection
+                        measures or systems focus on the network or transport layer, and as such, they would not be
+                        efficient when the target of the attack is the application layer. It is even difficult for the
+                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
+                        we have indicated, this type of attack is very specific, and generally require fewer resources
+                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
+                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
+                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
+                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
+                        application to identify "heavy" requests that are resource consuming. For example, if the web
+                        application has a search engine, an attack could be to carry out searches that require a high
+                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
+                        a challenge to the device making the network request in order to test whether or not it is a
+                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
+                        account online. By giving a requirement such as a JavaScript computational challenge, many
+                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
+                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
+                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
+                            application attack is Slowloris, which targets web servers. Verify that the implemented
+                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.377">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
+                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
+                        bypass important steps in the flow. This business logic limits provide us protection against
+                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
+                        business actions or transactions that exceed the established limits, should be recorded in the
+                        logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
+                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
+                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
+                            logic perspective.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
+                        to enumerate or attempt to exploit flaws in an application, for example, sending common
+                        passwords to multiple target accounts within an application. By profiling normal traffic
+                        volumes, and applying rate limiting, the application can be built to actively mitigate such
+                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
+                        rate-limiting based on the source IP address can be used to restrict attacks against the
+                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
+                        result in temporarily blocking or dropping traffic from the source. Note however that some
+                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
+                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
+                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
+                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
+                        failures than usual), and appropriate actions taken. For example, when the application detects
+                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
+                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
+                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
+                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
+                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
+                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
+                        detects a set number of failure login attempts, the account shall be locked for a certain time
+                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
+                        the application detects an account is locked more times than usual, this account should be
+                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
+                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
+                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
+                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
+                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
+                        the user successfully authenticates, the previous failed attempts shall be reset for that user
+                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
+                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
+                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
+                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
+                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
+                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
+                            log alerting function for an unusual amount of failed login attempts, even if they
+                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
+                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
+                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
+                        error handling does not give an attacker any information which can be leveraged for attacking
+                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
+                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
+                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
+                        an infrastructure for consistent error reporting proves more difficult than error handling. All
+                        exceptions should be caught as events with the severity of the error. These events will be
+                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
+                        corresponding error or system message in a consistent manner, depending on the severity of the
+                        error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
+                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
+                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
+                        However, proper logging practices can provide the crucial forensics needed to investigate after
+                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
+                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
+                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
+                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
+                        should be written using a format suited to be consumed by a log management solution, and include
+                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
+                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
+                        a monitoring system to continuously monitor the infrastructure, network, and the API
+                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
+                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
+                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
+                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
+                            confirm that the organization's logging policies, processes, and procedures are being
+                            followed properly both at the infrastructure level and the system level throughout the
+                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
+                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
+                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
+                            or others performing testing and validation can review the logging configuration and
+                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
+                            representative sampling of systems and infrastructure servers to ensure that they comply
+                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
+                            the direction of auditors) or others performing testing and validation can create security
+                            events on a representative sampling of systems through vulnerability scanning, penetration
+                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
+                            log data those activities should generate exist and are handled according to the
+                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
+                        little computational effort) force the server to expend relatively large computational work. If
+                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
+                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
+                        availability by sending unintelligible data. In a variation of this attack, an attacker
+                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
+                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
+                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
+                        the application traffic for signs of attack traffic or violations of policy at an application
+                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
+                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
+                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
+                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
+                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            and the options you should use will depend greatly on your testing requirements. Below are
+                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
+                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
+                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
+                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
+                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
+                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
+                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
+                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.377">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
+                        files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Data validation failures, together with access control violations, are symptomatic of malicious
+                        activity where an attacker is attempting to subvert the protections in place. It is therefore
+                        likely that unexpected input detected by the application relates to an attack. Rejecting and
+                        logging such activity, and ideally terminating the session, increases the likelihood of
+                        detecting and inhibiting structured attacks against the application.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
+                        the logs and subsequent access to them.&lt;/li&gt;
+                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
+                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
+                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
+                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
+                            relating to the event must be carefully sanitized and encoded; by definition the data could
+                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
+                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
+                        etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
+                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
+                            there is no company policy, check that at least the following data is included: timestamp
+                            event, status, error codes, service/command/application username or system account
+                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
+                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
+                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
+                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be
+                        precise enough to know who changed what and when). This includes data access from the
+                        application as well as data access from privileged accounts, such as database admins. In
+                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
+                            administrators and malicious actors.&lt;/li&gt;
+                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
+                            sufficiently detailed.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
+                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
+                        control and restrict access to the source. Application services may unexpectedly expose code,
+                        for example a service providing files to a user could be manipulated to access source code if
+                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
+                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
+                        configuration files are not downloadable directly from the service, and cannot be read and
+                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
+                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
+                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
+                            handlers which manage the source code interpretation before sending it to the client. If
+                            those handlers are not properly configured, the plain source code could be sent as a
+                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
+                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
+                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
+                        web site, email, blog, instant message, or program causes a user's web browser to perform an
+                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
+                        browser requests automatically include any credentials associated with the site, such as the
+                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
+                        site cannot distinguish between the forged or legitimate request sent by the victim. A
+                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
+                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
+                        re-authentication of sensitive functions is an effective way to protect your application against
+                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
+                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
+                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
+                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
+                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
+                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
+                        the server-side is problematic, an alternative defense is to use the double-submit cookie
+                        technique. This technique is easy to implement and is stateless. In this technique, a random
+                        value is sent in both a cookie and as a request parameter, with the server verifying if the
+                        cookie value and request value match. When a user visits (even before authenticating to prevent
+                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
+                        it as a cookie on the user's machine separate from the session identifier. The site then
+                        requires that every transaction request include this pseudo-random value as a hidden form value
+                        (or other request parameter/header). If both of them match on the server-side, the server
+                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
+                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
+                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
+                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
+                        determining the origin the request is going to (target origin). On the server-side verify if
+                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
+                        origin request) and if they don't, discard the request (meaning that the request originated from
+                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
+                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
+                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
+                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
+                            request and server response, and verify a unique strong token is being sent and verified
+                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
+                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
+                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
+                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
+                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
+                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
+                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
+                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
+                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
+                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
+                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
+                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
+                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
+                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
+                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
+                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
+                        or using hardware then this configuration may not be enough. The configuration will also cause
+                        denial of service to other users when under attack even from single source, as we are limiting
+                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
+                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
+                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
+                        block outgoing connections but we do not want it to become channel from where people start
+                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
+                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
+                        disabling the ICMP functionality of the targeted router, computer or other device. A network
+                        administrator can access the administrative interface of the device and disable its ability to
+                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
+                        request and the Echo Reply. The consequence of this is that all network activities that involve
+                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
+                        other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
+                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.378">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
+                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
+                        This may include elevating privileges or accessing sensitive data and functionality, such as
+                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
+                        critical functions and sensitive data should be further protected from attack using a risk-based
+                        authentication model requiring re-authentication via multi-factor authentication, or use of a
+                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
+                        re-authentication on key functions (such as requiring the old password before setting a new
+                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
+                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
+                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
+                        signing technologies or tokens that enable the server-side to verify the authenticity of a
+                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.980">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
+                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
+                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
+                        allowing them to prematurely enter or skip required sections of the application potentially
+                        allowing actions/transactions to be completed without successfully completing the entire
+                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
+                            order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.046">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Use periodically a static code analysis tool to analyze the code and detect potentially
+                        malicious code, such as time functions, unsafe file operations and networks connections. With
+                        the scanning of static code, we ensure the integrity of the application.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Verify that a code analysis tool is in use and it is configured to detect potentially
+                            malicious code, such as time functions, unsafe file operations and network connections.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to
+                        trick error-free programs, which follow best practices, into leaking their secrets. In fact, the
+                        safety checks of said best practices actually increase the attack surface and may make
+                        applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce
+                        potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to
+                        respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to
+                        the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict
+                        attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin
+                        resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when
+                        necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as
+                        a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or
+                        CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder,
+                        for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle
+                        to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case,
+                        you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or
+                        unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion
+                        attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read
+                        blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and
+                        globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
+                            properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.470">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
+                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
+                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
+                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
+                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
+                        control is critical in identifying application events (including attacks) through logging, and
+                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
+                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
+                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
+                        to detect possible situations in which the system has been compromised and give an appropriate
+                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.575">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
+                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
+                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                        &lt;li&gt;Use available features of the language or framework that allow specification of white
+                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
+                        (white list) or attr_protected (black list) macros in each class that may be used in mass
+                        assignment.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
+                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
+                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
+                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
+                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
+                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
+                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
+                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
+                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
+                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
+                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
+                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
+                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
+                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
+                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
+                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
+                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
+                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
+                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
+                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
+                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
+                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
+                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
+                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
+                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.378">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
+                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
+                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
+                        connection, using approved cryptographic algorithms.&lt;/p&gt;
+                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
+                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
+                        authentication system, most typically identified as a separate entity in a Federated
+                        authentication system. A CSP may be an independent third party, or may issue credentials for its
+                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
+                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
+                        but whose users may be subsequently authenticated to other sites, applications or services
+                        without further action on their part.&lt;/p&gt;
+                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
+                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
+                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
+                        the claimant's possession and control of one or two authenticators, using an authentication
+                        protocol.&lt;/p&gt;
+                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
+                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
+                        to process a transaction or grant access to information or a system.&lt;/p&gt;
+                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
+                        identity proofing.&lt;/p&gt;
+                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
+                        authentication protocols.&lt;/p&gt;
+                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
+                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
+                            with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
+                        two general types of encoding errors. If the byte sequence is not valid for the specified
+                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
+                        equivalent character sequence then an unmappable character has been encountered.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
+                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
+                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
+                        transmission will result in an error. Encoding and decoding errors typically result in data
+                        corruption.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;
+                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
+                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
+                        attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
+                        the source or transport method. For example, while hidden form fields, cookies or other headers
+                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
+                        forms. These can be modified by the user on the client-side in memory, or in transit on the
+                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
+                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
+                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
+                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
+                        data from the client side must be subjected to strict validation, sanitization, and encoding
+                        against expected syntactic and semantic criteria.
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
+                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
+                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
+                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
+                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
+                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
+                        non-compliant data.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
+                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
+                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
+                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
+                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
+                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
+                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
+                        server side, X- headers, and other platform specific data objects passed between the client and
+                        server.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
+                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
+                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
+                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;To test data validation:&amp;nbsp;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
+                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
+                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
+                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
+                            Fiddler, etc.).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.680">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk,
+                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
+                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
+                        the server. For example, injection of parameters into strings or cookies sent to the application
+                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
+                        logic and flow.
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
+                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
+                        the following HTTP request:&lt;/p&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
+                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
+                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
+                        whereas the actual operation used the second occurrence.&lt;/p&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
+                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
+                            the application in which those parameters are duplicated, or passed through other methods
+                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
+                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
+                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
+                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
+                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
+                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
+                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
+                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
+                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
+                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
+                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
+                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:29.979">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
+                        whitelisting can also be achieved by applying regular expressions. The application should only
+                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
+                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
+                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
+                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
+                            the input value which will be part of the Location header to redirect to domains which
+                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.681">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer
+                                software through black box analysis techniques. 'Black Box' methods involve interacting
+                                with the software indirectly, in the absence of direct access to the executable object.
+                                Such analysis typically involves interacting with the software at the boundaries of
+                                where the software interfaces with a larger execution environment, such as input-output
+                                vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service
+                                itself.
+                                &lt;br&gt;
+                                &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
+                                still critical to the security of the product that is being created. Because the issues
+                                covered by this section are not directly related to source code, we separated it from
+                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
+                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
+                                application's functionality; particularly URL's for web-apps. In cases in which the
+                                administrator failed to specify an ACL for a particular element, an attacker may be able
+                                to access it with impunity. An attacker with the ability to access functionality not
+                                properly constrained by ACLs can obtain sensitive information and possibly compromise
+                                the entire application. Such an attacker could potentially access resources that should
+                                only be available to users of a higher privilege level, or access management sections of
+                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
+                                application and observes any stack traces produced by error messages. Fuzzing techniques
+                                involve sending random or malformed messages to a target and monitoring the target's
+                                response. The attacker does not initially know how a target will respond to individual
+                                messages but by attempting a large number of message variants they may find a variant
+                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
+                                the targeted application to return an error including a stack trace, although fuzzing a
+                                target can also sometimes cause the target to enter an unstable state, causing a crash.
+                                The stack trace enumerates the chain of methods that led up to the point where the error
+                                was encountered. This can not only reveal the names of the methods (some of which may
+                                have known weaknesses) but possibly also the location of class files and libraries as
+                                well as parameter values. In some cases, the stack trace might even disclose sensitive
+                                configuration or user information.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment,
+                                allowing developers to monitor their code regularly in order to avoid security
+                                vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
+                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
+                                Service Provider it points to, some of these services will allow unverified users to
+                                claim these sub-domains as their own.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
+                                used inside the Service Provider.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;div&gt;
+                                &lt;b&gt;Attack Scenario&lt;/b&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;ol&gt;
+                                &lt;li&gt;Your company starts using a new service, eg an external Support
+                                Ticketing-service.&lt;/li&gt;
+                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
+                                support.your-domain.com&lt;/li&gt;
+                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
+                                redirection pointing to the ticketing system.&lt;/li&gt;
+                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
+                                verification is done by the Service Provider, and the DNS-setup is already correctly
+                                setup.&lt;/li&gt;
+                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
+                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
+                                destroy business credibility for your company.&lt;/li&gt;
+                                &lt;/ol&gt;
+                                &lt;/div&gt;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
+                                returned by the service, and this code contains confidential information such as
+                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
+                                files that can be downloaded from the service could also be leveraged to gain access to
+                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
+                                attempt to bypass this order so that they can perform operations for which they are not
+                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
+                                the attackers' request, thereby reducing the resources available for legitimate services
+                                and degrading or denying services. Usually, this attack focuses on memory allocation,
+                                but any finite resource on the target could be the attacked, including bandwidth,
+                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
+                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
+                                small number of requests that are carefully formatted to force the target to allocate
+                                excessive resources to service this request(s). Often this attack takes advantage of a
+                                bug in the target to cause the target to allocate resources vastly beyond what would be
+                                needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
+                                reserved for privileged users or administrators but are exposed to use by lower or
+                                non-privileged accounts. Access to sensitive information and functionality must be
+                                controlled to ensure that only authorized users are able to access these resources. If
+                                access control mechanisms are absent or misconfigured, a user may be able to access
+                                resources that are intended only for higher level users. An adversary may be able to
+                                exploit this to utilize a less trusted account to gain information and perform
+                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
+                                attacks in that the adversary never actually escalates their privileges but instead is
+                                able to use a lesser degree of privilege to access resources that should be (but are
+                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
+                                trust or subvert systems - all control functionality is working as configured but the
+                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
+                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
+                                log audit, cover traces of attack, or perform other malicious actions. The target host
+                                is not properly controlling log access. As a result tainted data is resulting in the log
+                                files leading to a failure in accountability, non-repudiation and incident forensics
+                                capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
+                                subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
+                                resources. The attacker can supply - or modify - a URL which the code running on the
+                                server will read or submit data to, and by carefully selecting the URLs, the attacker
+                                may be able to read server configuration details such as AWS metadata, connect to
+                                internal services like http enabled databases, or perform post requests towards internal
+                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files,
+                                when the executable loads the resource (such as an image file or configuration file) the
+                                attacker has modified the file to either execute malicious code directly or manipulate
+                                the target process (e.g. application server) to execute based on the malicious
+                                configuration parameters. Since systems are increasingly interrelated mashing up
+                                resources from local and remote sources the possibility of this attack occurring is
+                                high.
+                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
+                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
+                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
+                                into the browser. Another example targets clients reading pdf files. In this case the
+                                attacker simply appends javascript to the end of a legitimate url for a pdf
+                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
+                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
+                                modified the resource and loaded executable javascript into the client's browser
+                                process.
+                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
+                                or configuration file, for example a web.xml file used to configure security permissions
+                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
+                                the public role the ability to use the administration functionality.
+                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
+                                manipulated, the attacker gains full control.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which
+                                affect the behavior of that application. For example, many applications use external
+                                configuration files and libraries - modification of these entities or otherwise
+                                affecting the application's ability to use them would constitute a
+                                configuration/environment manipulation attack.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
+                                under his control and mix it with executed code on the server side by modifying the
+                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
+                                on the code isolation, this event could grant the user access to system resources and
+                                data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
+                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
+                                the target software to generate HTML text or other potentially executable content. Many
+                                websites rely on user-generated content and dynamically build resources like files,
+                                filenames, and URL links directly from user supplied data. In this attack pattern, the
+                                attacker uploads code that can execute in the client browser and/or redirect the client
+                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
+                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static,
+                                binary format for saving to disk or transferring over a network. These objects are then
+                                deserialized when needed to recover the data/state. By injecting a malformed object into
+                                a vulnerable application, an adversary can potentially compromise the application by
+                                manipulating the deserialization process. This can result in a number of unwanted
+                                outcomes, including remote code execution.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
+                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
+                                execute the malicious action against some third-party application. If successful, the
+                                action embedded in the malicious link will be processed and accepted by the targeted
+                                application with the users' privilege level.
+                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
+                                user session cookies by many web applications today. In such an architecture, once the
+                                user authenticates to an application and a session cookie is created on the user's
+                                system, all following transactions for that session are authenticated using that cookie
+                                including potential actions initiated by an attacker and simply "riding" the existing
+                                session cookie.
+                                &lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
+                                another specified URL. By modifying this URL value to point towards a malicious site, an
+                                attacker may successfully launch a phishing scam and steal user credentials. Because the
+                                server name in the modified link is identical to the original site, phishing attempts
+                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
+                                and submitting it to applications not expecting or effective at validating this
+                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could
+                                potentially set fields on those objects that were not designed to be modified by the
+                                user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d16d50e6-8880-42db-a078-f9f07936fa5e" diagramComponentId="d260486f-52b3-4946-bae1-b967bea936c3" ref="6466e1cd-f115-44bf-9962-548b27fca47a" name="Web Application - Server side" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
+                        actor without imposing any restrictions on how many resources can be allocated, in violation of
+                        the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.
+
+                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
+                        network traffic can often be sniffed by any attacker who has access to a network interface. This
+                        significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a
+                        user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an
+                        unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
+                        is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but
+                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
+                        intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
+                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
+                        arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
+                        a file or directory that is located underneath a restricted parent directory, but the software
+                        does not properly neutralize special elements within the pathname that can cause the pathname to
+                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
+                        file operations are intended to take place within a restricted directory. By using special
+                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
+                        location to access files or directories that are elsewhere on the system. One of the most common
+                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
+                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
+                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
+                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
+                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
+                        truncate a generated filename to widen the scope of attack. For example, the software may add
+                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
+                        effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or
+                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
+                        "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an
+                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
+                        could modify the intended OS command when it is sent to a downstream component. This could allow
+                        attackers to execute unexpected, dangerous commands directly on the operating system. This
+                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
+                        access to the operating system, such as in web applications.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
+                        specify commands that normally would not be accessible, or to call alternate commands with
+                        privileges that the attacker does not have. The problem is exacerbated if the compromised
+                        process does not follow the principle of least privilege, because the attacker-controlled
+                        commands may run with special system privileges that increases the amount of damage.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        There are at least two subtypes of OS command injection:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
+                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
+                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
+                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
+                        from executing. However, if the program does not remove command separators from the HOSTNAME
+                        argument, attackers could place the separators into the arguments, which allows them to execute
+                        their own program after nslookup has finished executing.The application accepts an input that it
+                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
+                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
+                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
+                        execute arbitrary commands or programs. If the command is being executed using functions like
+                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
+                        in the same line. From a weakness standpoint, these variants represent distinct programmer
+                        errors.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
+                        will be part of the arguments in the command to be executed. In the second variant, the
+                        programmer does not intend for the command to be accessible to any untrusted party, but the
+                        programmer probably has not accounted for alternate ways in which malicious attackers can
+                        provide input.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
+                        attributes, properties, or fields that are to be initialized or updated in an object, but it
+                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
+                        the object contains attributes that were only intended for internal use, then their unexpected
+                        modification could lead to a vulnerability. This weakness is sometimes known by the
+                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
+                        object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
+                        an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits
+                        important details about the event when logging it. When critical security events are not logged
+                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
+                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.576">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
+                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
+                        required security controls are implemented correctly, operating as intended, enforcing the
+                        desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.682">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
+                        immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.577">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
+                        a security decision, but it does not properly ensure that the IP address is truly associated
+                        with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.427">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
+                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
+                        expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.166">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
+                        down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.822">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
+                        passwords, as well as sensitive information pertaining to the application and system. The source
+                        code can also be sent back to a client because of an error condition or an improperly configured
+                        handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.107">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.823">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
+                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.634">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
+                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
+                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.635">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
+                        Where there is no alternative, any user input being included must be sanitized or sandboxed
+                        before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
+                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
+                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
+                            will execute the code with the same permissions, potentially including operation system
+                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
+                            procedures that want to invoke a large number of functions, or set a large number of
+                            variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
+                        is denied. There are many ways this rule will manifest in application code. Some examples of
+                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
+                        new users/roles start with minimal or no permissions and users/roles do not receive access to
+                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
+                        an error or exception while processing access control requests. In these cases access control
+                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
+                        registers for a new account, that account should have minimal or no access by default until that
+                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
+                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
+                            every portion of the application in which a user can create information inside the database
+                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
+                            (statement of account, order details, etc.), or delete information (drop users, messages,
+                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method. Many flaws in applications result from
+                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
+                        disclosure. Use of filenames or other direct references to objects such as files on the
+                        server-side increases the risk of compromise of the system or unauthorized access to other
+                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
+                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
+                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
+                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
+                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
+                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
+                        references are used to access files from within the web-root deviating from recommended security
+                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
+                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
+                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
+                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
+                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
+                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
+                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
+                            way and if so, it should not be possible to access locations outside of this domain (i.e.
+                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
+                            etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.385">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
+                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
+                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
+                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
+                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
+                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
+                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
+                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
+                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
+                        the usage of automated tools is detected, the application should respond by denying access and
+                        notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.904">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
+                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
+                        database records and database fields. Sensitive information can be extracted from data mining
+                        operations. When information is personally identifiable information, it may lead to
+                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
+                        data mining activities, organizations determine whether such activities are authorized.
+                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
+                        policies that address data mining requirements. Organizational personnel consult with the senior
+                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
+                        mining prevention and detection techniques include limiting the number and frequency of database
+                        queries to increase the work factor needed to determine the contents of databases, limiting
+                        types of responses provided to database queries, applying differential privacy techniques or
+                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
+                        occur. Data mining protection focuses on protecting information from data mining while such
+                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
+                        organizational information that may have been mined or otherwise obtained from data stores and
+                        is available as open-source information residing on external sites, such as social networking or
+                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
+                        threat program for deterring, detecting, and mitigating insider threats, including the
+                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
+                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
+                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
+                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
+                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
+                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
+                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
+                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
+                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or
+                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
+                        client-side actions. This can expose the application to attack through remote or local
+                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
+                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
+                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
+                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
+                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
+                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
+                            are untrusted, make sure there is a validation and sanitization mechanism before sending
+                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
+                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
+                        encryption between the client and server, terminating within a secure environment on the
+                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
+                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
+                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
+                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
+                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
+                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
+                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
+                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
+                        controllers, services, and other resources. This implies protection against spoofing and
+                        elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
+                            the database (e.g., making a payment, adding a contact, or sending a message), or can
+                            receive information (statement of account, order details, etc.), or delete information (drop
+                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
+                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
+                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
+                            may be used in applications for:&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
+                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
+                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
+                        applications. These HTTP methods can be used for nefarious purposes if the web server is
+                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
+                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
+                        and POST are by far the most common methods that are used to access information provided by a
+                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
+                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
+                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
+                        of these methods can potentially pose a security risk for a web application, as they allow an
+                        attacker to modify the files stored on the web server and, in some scenarios, steal the
+                        credentials of legitimate users. More specifically, the methods that should be disabled are the
+                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
+                        client to upload new files onto the web server. An attacker may exploit this by uploading
+                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
+                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
+                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
+                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
+                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
+                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
+                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
+                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
+                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
+                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
+                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
+                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
+                        DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.938">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
+                        secure deployment of the application, particularly if the application infrastructure is software
+                        defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
+                            configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
+                            (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Web server and application server configurations play a key role in the security of a web
+                        application. These servers are responsible for serving content and invoking applications that
+                        generate content. In addition, many application servers provide a number of services that web
+                        applications can use, including data storage, directory services, mail, messaging, and more.
+                        Failure to manage the proper configuration of your servers can lead to a wide variety of
+                        security problems.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Authorized administrators need to ensure the integrity of all security-relevant configurations
+                        to detect tampering.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            In order to evaluate the readiness of the application platform, testing for configuration
+                            management includes the following sections:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
+                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
+                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
+                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
+                        is directly written to a log file, then this data could contain newline or other meta-characters
+                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
+                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
+                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
+                        header) should be included with requests. This security header was designed to prevent
+                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
+                        fetch originates from. It doesn't include any path information, but only the server name. It is
+                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
+                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
+                        Content-Disposition response header tells the browser to download a file rather than displaying
+                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
+                        but does not specify a character set, then the browser may analyze the HTML and attempt to
+                        determine which character set it appears to be using. Even if the majority of the HTML actually
+                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
+                        in the response may cause the browser to interpret the content using a different character set.
+                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
+                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
+                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
+                        use the Origin header for authentication or access control decisions, as the Origin header can
+                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
+                        header for file downloading in all API responses with the following directives:
+                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
+                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
+                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
+                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
+                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
+                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
+                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
+                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
+                            insecure configurations; for example, when the server returns back the Origin header in the
+                            Access-Control-Allow-Origin without any additional checks AND returns
+                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
+                            that this configuration is very insecure, and is not acceptable in general terms, except in
+                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
+                            Reflected File Download input payloads to launch commands on the client machine. Reflected
+                            File Download is an attack combining URL path segments (now deprecated) with pages that
+                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
+                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
+                            popular misuse; namely, being used for encoding malicious injection strings in a way that
+                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
+                            validation filters, or take advantage of particular ways in which browsers render encoded
+                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
+                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
+                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
+                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
+                        Protections can include ensuring that DNS names used by applications are regularly checked for
+                        expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
+                            the connection to the DNS was authenticated successfully by username/password or certificate
+                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.269">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
+                        time that the application requires to function properly while minimizing the resources employed
+                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
+                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
+                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
+                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
+                        distinguishing between malicious and legitimate traffic. Many of the most common protection
+                        measures or systems focus on the network or transport layer, and as such, they would not be
+                        efficient when the target of the attack is the application layer. It is even difficult for the
+                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
+                        we have indicated, this type of attack is very specific, and generally require fewer resources
+                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
+                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
+                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
+                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
+                        application to identify "heavy" requests that are resource consuming. For example, if the web
+                        application has a search engine, an attack could be to carry out searches that require a high
+                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
+                        a challenge to the device making the network request in order to test whether or not it is a
+                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
+                        account online. By giving a requirement such as a JavaScript computational challenge, many
+                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
+                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
+                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
+                            application attack is Slowloris, which targets web servers. Verify that the implemented
+                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
+                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
+                        bypass important steps in the flow. This business logic limits provide us protection against
+                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
+                        business actions or transactions that exceed the established limits, should be recorded in the
+                        logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
+                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
+                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
+                            logic perspective.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
+                        to enumerate or attempt to exploit flaws in an application, for example, sending common
+                        passwords to multiple target accounts within an application. By profiling normal traffic
+                        volumes, and applying rate limiting, the application can be built to actively mitigate such
+                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
+                        rate-limiting based on the source IP address can be used to restrict attacks against the
+                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
+                        result in temporarily blocking or dropping traffic from the source. Note however that some
+                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
+                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
+                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
+                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
+                        failures than usual), and appropriate actions taken. For example, when the application detects
+                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
+                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
+                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
+                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
+                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
+                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
+                        detects a set number of failure login attempts, the account shall be locked for a certain time
+                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
+                        the application detects an account is locked more times than usual, this account should be
+                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
+                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
+                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
+                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
+                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
+                        the user successfully authenticates, the previous failed attempts shall be reset for that user
+                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
+                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
+                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
+                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
+                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
+                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
+                            log alerting function for an unusual amount of failed login attempts, even if they
+                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
+                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
+                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
+                        error handling does not give an attacker any information which can be leveraged for attacking
+                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
+                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
+                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
+                        an infrastructure for consistent error reporting proves more difficult than error handling. All
+                        exceptions should be caught as events with the severity of the error. These events will be
+                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
+                        corresponding error or system message in a consistent manner, depending on the severity of the
+                        error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
+                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
+                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
+                        However, proper logging practices can provide the crucial forensics needed to investigate after
+                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
+                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
+                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
+                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
+                        should be written using a format suited to be consumed by a log management solution, and include
+                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
+                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
+                        a monitoring system to continuously monitor the infrastructure, network, and the API
+                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
+                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
+                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
+                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
+                            confirm that the organization's logging policies, processes, and procedures are being
+                            followed properly both at the infrastructure level and the system level throughout the
+                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
+                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
+                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
+                            or others performing testing and validation can review the logging configuration and
+                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
+                            representative sampling of systems and infrastructure servers to ensure that they comply
+                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
+                            the direction of auditors) or others performing testing and validation can create security
+                            events on a representative sampling of systems through vulnerability scanning, penetration
+                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
+                            log data those activities should generate exist and are handled according to the
+                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
+                        little computational effort) force the server to expend relatively large computational work. If
+                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
+                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
+                        availability by sending unintelligible data. In a variation of this attack, an attacker
+                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
+                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
+                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
+                        the application traffic for signs of attack traffic or violations of policy at an application
+                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
+                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
+                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
+                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
+                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            and the options you should use will depend greatly on your testing requirements. Below are
+                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
+                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
+                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
+                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
+                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
+                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
+                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
+                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
+                        files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Data validation failures, together with access control violations, are symptomatic of malicious
+                        activity where an attacker is attempting to subvert the protections in place. It is therefore
+                        likely that unexpected input detected by the application relates to an attack. Rejecting and
+                        logging such activity, and ideally terminating the session, increases the likelihood of
+                        detecting and inhibiting structured attacks against the application.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
+                        the logs and subsequent access to them.&lt;/li&gt;
+                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
+                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
+                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
+                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
+                            relating to the event must be carefully sanitized and encoded; by definition the data could
+                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
+                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
+                        etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
+                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
+                            there is no company policy, check that at least the following data is included: timestamp
+                            event, status, error codes, service/command/application username or system account
+                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
+                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
+                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
+                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be
+                        precise enough to know who changed what and when). This includes data access from the
+                        application as well as data access from privileged accounts, such as database admins. In
+                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
+                            administrators and malicious actors.&lt;/li&gt;
+                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
+                            sufficiently detailed.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
+                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
+                        control and restrict access to the source. Application services may unexpectedly expose code,
+                        for example a service providing files to a user could be manipulated to access source code if
+                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
+                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
+                        configuration files are not downloadable directly from the service, and cannot be read and
+                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
+                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
+                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
+                            handlers which manage the source code interpretation before sending it to the client. If
+                            those handlers are not properly configured, the plain source code could be sent as a
+                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
+                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
+                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
+                        web site, email, blog, instant message, or program causes a user's web browser to perform an
+                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
+                        browser requests automatically include any credentials associated with the site, such as the
+                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
+                        site cannot distinguish between the forged or legitimate request sent by the victim. A
+                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
+                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
+                        re-authentication of sensitive functions is an effective way to protect your application against
+                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
+                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
+                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
+                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
+                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
+                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
+                        the server-side is problematic, an alternative defense is to use the double-submit cookie
+                        technique. This technique is easy to implement and is stateless. In this technique, a random
+                        value is sent in both a cookie and as a request parameter, with the server verifying if the
+                        cookie value and request value match. When a user visits (even before authenticating to prevent
+                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
+                        it as a cookie on the user's machine separate from the session identifier. The site then
+                        requires that every transaction request include this pseudo-random value as a hidden form value
+                        (or other request parameter/header). If both of them match on the server-side, the server
+                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
+                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
+                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
+                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
+                        determining the origin the request is going to (target origin). On the server-side verify if
+                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
+                        origin request) and if they don't, discard the request (meaning that the request originated from
+                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
+                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
+                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
+                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
+                            request and server response, and verify a unique strong token is being sent and verified
+                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
+                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
+                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
+                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
+                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
+                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
+                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
+                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
+                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
+                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
+                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
+                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
+                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
+                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
+                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
+                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
+                        or using hardware then this configuration may not be enough. The configuration will also cause
+                        denial of service to other users when under attack even from single source, as we are limiting
+                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
+                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
+                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
+                        block outgoing connections but we do not want it to become channel from where people start
+                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
+                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
+                        disabling the ICMP functionality of the targeted router, computer or other device. A network
+                        administrator can access the administrative interface of the device and disable its ability to
+                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
+                        request and the Echo Reply. The consequence of this is that all network activities that involve
+                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
+                        other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
+                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
+                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
+                        This may include elevating privileges or accessing sensitive data and functionality, such as
+                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
+                        critical functions and sensitive data should be further protected from attack using a risk-based
+                        authentication model requiring re-authentication via multi-factor authentication, or use of a
+                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
+                        re-authentication on key functions (such as requiring the old password before setting a new
+                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
+                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
+                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
+                        signing technologies or tokens that enable the server-side to verify the authenticity of a
+                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
+                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
+                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
+                        allowing them to prematurely enter or skip required sections of the application potentially
+                        allowing actions/transactions to be completed without successfully completing the entire
+                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
+                            order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.905">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Use periodically a static code analysis tool to analyze the code and detect potentially
+                        malicious code, such as time functions, unsafe file operations and networks connections. With
+                        the scanning of static code, we ensure the integrity of the application.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Verify that a code analysis tool is in use and it is configured to detect potentially
+                            malicious code, such as time functions, unsafe file operations and network connections.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:22.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
+                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
+                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
+                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
+                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
+                        control is critical in identifying application events (including attacks) through logging, and
+                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
+                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
+                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
+                        to detect possible situations in which the system has been compromised and give an appropriate
+                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
+                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
+                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                        &lt;li&gt;Use available features of the language or framework that allow specification of white
+                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
+                        (white list) or attr_protected (black list) macros in each class that may be used in mass
+                        assignment.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
+                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
+                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
+                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
+                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
+                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
+                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
+                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
+                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
+                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
+                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
+                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
+                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
+                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
+                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
+                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
+                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
+                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
+                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
+                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
+                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
+                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
+                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
+                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
+                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
+                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
+                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
+                        connection, using approved cryptographic algorithms.&lt;/p&gt;
+                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
+                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
+                        authentication system, most typically identified as a separate entity in a Federated
+                        authentication system. A CSP may be an independent third party, or may issue credentials for its
+                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
+                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
+                        but whose users may be subsequently authenticated to other sites, applications or services
+                        without further action on their part.&lt;/p&gt;
+                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
+                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
+                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
+                        the claimant's possession and control of one or two authenticators, using an authentication
+                        protocol.&lt;/p&gt;
+                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
+                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
+                        to process a transaction or grant access to information or a system.&lt;/p&gt;
+                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
+                        identity proofing.&lt;/p&gt;
+                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
+                        authentication protocols.&lt;/p&gt;
+                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
+                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
+                            with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
+                        two general types of encoding errors. If the byte sequence is not valid for the specified
+                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
+                        equivalent character sequence then an unmappable character has been encountered.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
+                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
+                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
+                        transmission will result in an error. Encoding and decoding errors typically result in data
+                        corruption.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;
+                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
+                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
+                        attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
+                        the source or transport method. For example, while hidden form fields, cookies or other headers
+                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
+                        forms. These can be modified by the user on the client-side in memory, or in transit on the
+                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
+                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
+                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
+                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
+                        data from the client side must be subjected to strict validation, sanitization, and encoding
+                        against expected syntactic and semantic criteria.
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
+                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
+                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
+                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
+                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
+                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
+                        non-compliant data.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
+                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
+                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
+                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
+                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
+                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
+                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
+                        server side, X- headers, and other platform specific data objects passed between the client and
+                        server.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
+                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
+                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
+                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;To test data validation:&amp;nbsp;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
+                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
+                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
+                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
+                            Fiddler, etc.).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.939">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk,
+                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
+                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
+                        the server. For example, injection of parameters into strings or cookies sent to the application
+                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
+                        logic and flow.
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
+                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
+                        the following HTTP request:&lt;/p&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
+                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
+                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
+                        whereas the actual operation used the second occurrence.&lt;/p&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
+                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
+                            the application in which those parameters are duplicated, or passed through other methods
+                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
+                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
+                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
+                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
+                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
+                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
+                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
+                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
+                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
+                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
+                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
+                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:26.387">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
+                        whitelisting can also be achieved by applying regular expressions. The application should only
+                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
+                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
+                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
+                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
+                            the input value which will be part of the Location header to redirect to domains which
+                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:25.941">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service
+                                itself.
+                                &lt;br&gt;
+                                &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
+                                still critical to the security of the product that is being created. Because the issues
+                                covered by this section are not directly related to source code, we separated it from
+                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
+                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
+                                application's functionality; particularly URL's for web-apps. In cases in which the
+                                administrator failed to specify an ACL for a particular element, an attacker may be able
+                                to access it with impunity. An attacker with the ability to access functionality not
+                                properly constrained by ACLs can obtain sensitive information and possibly compromise
+                                the entire application. Such an attacker could potentially access resources that should
+                                only be available to users of a higher privilege level, or access management sections of
+                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
+                                application and observes any stack traces produced by error messages. Fuzzing techniques
+                                involve sending random or malformed messages to a target and monitoring the target's
+                                response. The attacker does not initially know how a target will respond to individual
+                                messages but by attempting a large number of message variants they may find a variant
+                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
+                                the targeted application to return an error including a stack trace, although fuzzing a
+                                target can also sometimes cause the target to enter an unstable state, causing a crash.
+                                The stack trace enumerates the chain of methods that led up to the point where the error
+                                was encountered. This can not only reveal the names of the methods (some of which may
+                                have known weaknesses) but possibly also the location of class files and libraries as
+                                well as parameter values. In some cases, the stack trace might even disclose sensitive
+                                configuration or user information.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment,
+                                allowing developers to monitor their code regularly in order to avoid security
+                                vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
+                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
+                                Service Provider it points to, some of these services will allow unverified users to
+                                claim these sub-domains as their own.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
+                                used inside the Service Provider.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;div&gt;
+                                &lt;b&gt;Attack Scenario&lt;/b&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;ol&gt;
+                                &lt;li&gt;Your company starts using a new service, eg an external Support
+                                Ticketing-service.&lt;/li&gt;
+                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
+                                support.your-domain.com&lt;/li&gt;
+                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
+                                redirection pointing to the ticketing system.&lt;/li&gt;
+                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
+                                verification is done by the Service Provider, and the DNS-setup is already correctly
+                                setup.&lt;/li&gt;
+                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
+                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
+                                destroy business credibility for your company.&lt;/li&gt;
+                                &lt;/ol&gt;
+                                &lt;/div&gt;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
+                                returned by the service, and this code contains confidential information such as
+                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
+                                files that can be downloaded from the service could also be leveraged to gain access to
+                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
+                                attempt to bypass this order so that they can perform operations for which they are not
+                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
+                                the attackers' request, thereby reducing the resources available for legitimate services
+                                and degrading or denying services. Usually, this attack focuses on memory allocation,
+                                but any finite resource on the target could be the attacked, including bandwidth,
+                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
+                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
+                                small number of requests that are carefully formatted to force the target to allocate
+                                excessive resources to service this request(s). Often this attack takes advantage of a
+                                bug in the target to cause the target to allocate resources vastly beyond what would be
+                                needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
+                                reserved for privileged users or administrators but are exposed to use by lower or
+                                non-privileged accounts. Access to sensitive information and functionality must be
+                                controlled to ensure that only authorized users are able to access these resources. If
+                                access control mechanisms are absent or misconfigured, a user may be able to access
+                                resources that are intended only for higher level users. An adversary may be able to
+                                exploit this to utilize a less trusted account to gain information and perform
+                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
+                                attacks in that the adversary never actually escalates their privileges but instead is
+                                able to use a lesser degree of privilege to access resources that should be (but are
+                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
+                                trust or subvert systems - all control functionality is working as configured but the
+                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
+                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
+                                log audit, cover traces of attack, or perform other malicious actions. The target host
+                                is not properly controlling log access. As a result tainted data is resulting in the log
+                                files leading to a failure in accountability, non-repudiation and incident forensics
+                                capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
+                                subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
+                                resources. The attacker can supply - or modify - a URL which the code running on the
+                                server will read or submit data to, and by carefully selecting the URLs, the attacker
+                                may be able to read server configuration details such as AWS metadata, connect to
+                                internal services like http enabled databases, or perform post requests towards internal
+                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files,
+                                when the executable loads the resource (such as an image file or configuration file) the
+                                attacker has modified the file to either execute malicious code directly or manipulate
+                                the target process (e.g. application server) to execute based on the malicious
+                                configuration parameters. Since systems are increasingly interrelated mashing up
+                                resources from local and remote sources the possibility of this attack occurring is
+                                high.
+                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
+                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
+                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
+                                into the browser. Another example targets clients reading pdf files. In this case the
+                                attacker simply appends javascript to the end of a legitimate url for a pdf
+                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
+                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
+                                modified the resource and loaded executable javascript into the client's browser
+                                process.
+                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
+                                or configuration file, for example a web.xml file used to configure security permissions
+                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
+                                the public role the ability to use the administration functionality.
+                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
+                                manipulated, the attacker gains full control.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which
+                                affect the behavior of that application. For example, many applications use external
+                                configuration files and libraries - modification of these entities or otherwise
+                                affecting the application's ability to use them would constitute a
+                                configuration/environment manipulation attack.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
+                                under his control and mix it with executed code on the server side by modifying the
+                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
+                                on the code isolation, this event could grant the user access to system resources and
+                                data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
+                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
+                                the target software to generate HTML text or other potentially executable content. Many
+                                websites rely on user-generated content and dynamically build resources like files,
+                                filenames, and URL links directly from user supplied data. In this attack pattern, the
+                                attacker uploads code that can execute in the client browser and/or redirect the client
+                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
+                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static,
+                                binary format for saving to disk or transferring over a network. These objects are then
+                                deserialized when needed to recover the data/state. By injecting a malformed object into
+                                a vulnerable application, an adversary can potentially compromise the application by
+                                manipulating the deserialization process. This can result in a number of unwanted
+                                outcomes, including remote code execution.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
+                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
+                                execute the malicious action against some third-party application. If successful, the
+                                action embedded in the malicious link will be processed and accepted by the targeted
+                                application with the users' privilege level.
+                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
+                                user session cookies by many web applications today. In such an architecture, once the
+                                user authenticates to an application and a session cookie is created on the user's
+                                system, all following transactions for that session are authenticated using that cookie
+                                including potential actions initiated by an attacker and simply "riding" the existing
+                                session cookie.
+                                &lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
+                                another specified URL. By modifying this URL value to point towards a malicious site, an
+                                attacker may successfully launch a phishing scam and steal user credentials. Because the
+                                server name in the modified link is identical to the original site, phishing attempts
+                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
+                                and submitting it to applications not expecting or effective at validating this
+                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could
+                                potentially set fields on those objects that were not designed to be modified by the
+                                user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="8d190ba8-a2ab-4a3f-a437-b0440293f81f" diagramComponentId="c35adc96-3968-4248-8422-b36f6805e8f6" ref="66e5a95a-0f71-43a9-bd27-b5b0fd5710d9" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization
+                        and access control mechanisms in modern applications are complex and wide-spread. Even if the
+                        application implements a proper infrastructure for authorization checks, developers might forget
+                        to use these checks before accessing a sensitive object. Access control detection is not
+                        typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access
+                        can result in data disclosure to unauthorized parties, data loss, or data manipulation.
+                        Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object
+                        level authorization is an access control mechanism that is usually implemented at the code level
+                        to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every
+                        API endpoint that receives an ID of an object, and performs any type of action on the object,
+                        should implement object-level authorization checks. These checks should validate that the
+                        logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures
+                        in this mechanism typically leads to unauthorized information disclosure, modification, or
+                        destruction of data.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An
+                        API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the
+                        attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to
+                        perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits
+                        weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as
+                        authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the
+                        authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens
+                        ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text,
+                        encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The API is vulnerable to injection flaws if:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+                        &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS
+                        commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
+                        &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated,
+                        filtered, or sanitized by the API.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br&gt;
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
+              <output/>
+            </source>
+            <references>
+              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
+              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
+              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
+              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an
+                        actor without imposing any restrictions on how many resources can be allocated, in violation of
+                        the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.
+
+                        Many communication channels can be "sniffed" by attackers during data transmission. For example,
+                        network traffic can often be sniffed by any attacker who has access to a network interface. This
+                        significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a
+                        user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an
+                        unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when
+                        an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception
+                        is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but
+                        encoding or escaping of the data is either missing or done incorrectly. As a result, the
+                        intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.259">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative
+                        encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or
+                        arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify
+                        a file or directory that is located underneath a restricted parent directory, but the software
+                        does not properly neutralize special elements within the pathname that can cause the pathname to
+                        resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many
+                        file operations are intended to take place within a restricted directory. By using special
+                        elements such as ".." and "/" separators, attackers can escape outside of the restricted
+                        location to access files or directories that are elsewhere on the system. One of the most common
+                        special elements is the "../" sequence, which in most modern operating systems is interpreted as
+                        the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path
+                        traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be
+                        useful in accessing unexpected files. This is referred to as absolute path traversal. In many
+                        programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to
+                        truncate a generated filename to widen the scope of attack. For example, the software may add
+                        ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may
+                        effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or
+                        incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g.
+                        "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an
+                        upstream component, but it does not neutralize or incorrectly neutralizes special elements that
+                        could modify the intended OS command when it is sent to a downstream component. This could allow
+                        attackers to execute unexpected, dangerous commands directly on the operating system. This
+                        weakness can lead to a vulnerability in environments in which the attacker does not have direct
+                        access to the operating system, such as in web applications.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Alternately, if the weakness occurs in a privileged program, it could allow the attacker to
+                        specify commands that normally would not be accessible, or to call alternate commands with
+                        privileges that the attacker does not have. The problem is exacerbated if the compromised
+                        process does not follow the principle of least privilege, because the attacker-controlled
+                        commands may run with special system privileges that increases the amount of damage.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        There are at least two subtypes of OS command injection:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The application intends to execute a single, fixed program that is under its own
+                        control. It intends to use externally-supplied inputs as arguments to that program. For example,
+                        the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow
+                        the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
+                        from executing. However, if the program does not remove command separators from the HOSTNAME
+                        argument, attackers could place the separators into the arguments, which allows them to execute
+                        their own program after nslookup has finished executing.The application accepts an input that it
+                        uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The application simply redirects this entire command to the operating system. For
+                        example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that
+                        was supplied by the user. If the COMMAND is under attacker control, then the attacker can
+                        execute arbitrary commands or programs. If the command is being executed using functions like
+                        exec() and CreateProcess(), the attacker might not be able to combine multiple commands together
+                        in the same line. From a weakness standpoint, these variants represent distinct programmer
+                        errors.&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties
+                        will be part of the arguments in the command to be executed. In the second variant, the
+                        programmer does not intend for the command to be accessible to any untrusted party, but the
+                        programmer probably has not accounted for alternate ways in which malicious attackers can
+                        provide input.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple
+                        attributes, properties, or fields that are to be initialized or updated in an object, but it
+                        does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If
+                        the object contains attributes that were only intended for internal use, then their unexpected
+                        modification could lead to a vulnerability. This weakness is sometimes known by the
+                        language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or
+                        object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to
+                        an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.879">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits
+                        important details about the event when logging it. When critical security events are not logged
+                        properly, such as in the case of a failed login attempt, this can make malicious behavior more
+                        difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.031">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
+          <desc>Product A handles inputs or steps differently than Product B,
+                        which causes A to perform incorrect actions based on its perception of B's
+                        state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.614">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched
+                        systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API
+                        hosts because of modern concepts like microservices, which make applications easy to deploy and
+                        independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.615">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the
+                        system development life cycle. Such testing/evaluation is necessary because it confirms that the
+                        required security controls are implemented correctly, operating as intended, enforcing the
+                        desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.186">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped
+                        immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.447">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:35.032">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make
+                        a security decision, but it does not properly ensure that the IP address is truly associated
+                        with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.110">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the
+                        contents of this URL, but it does not sufficiently ensure that the request is being sent to the
+                        expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.260">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service
+                        down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in
+                        a way that is observable to an unauthorized actor, which exposes security-relevant information
+                        about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.438">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and
+                        passwords, as well as sensitive information pertaining to the application and system. The source
+                        code can also be sent back to a client because of an error condition or an improperly configured
+                        handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.446">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.993">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.992">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external
+                        site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all
+                        connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                        buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two
+                        different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.878">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features.
+                        Where there is no alternative, any user input being included must be sanitized or sandboxed
+                        before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page
+                            parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an
+                            eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack
+                            will execute the code with the same permissions, potentially including operation system
+                            commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch
+                            procedures that want to invoke a large number of functions, or set a large number of
+                            variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it
+                        is denied. There are many ways this rule will manifest in application code. Some examples of
+                        this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby
+                        new users/roles start with minimal or no permissions and users/roles do not receive access to
+                        new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw
+                        an error or exception while processing access control requests. In these cases access control
+                        should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user
+                        registers for a new account, that account should have minimal or no access by default until that
+                        access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all
+                        users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In
+                            every portion of the application in which a user can create information inside the database
+                            (e.g., making a payment, adding a contact, or sending a message), or can receive information
+                            (statement of account, order details, etc.), or delete information (drop users, messages,
+                            etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method. Many flaws in applications result from
+                        unsafe handling of filenames or path data, for example directory traversal and arbitrary file
+                        disclosure. Use of filenames or other direct references to objects such as files on the
+                        server-side increases the risk of compromise of the system or unauthorized access to other
+                        files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to
+                        files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and
+                        then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files
+                        should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do
+                        not use obscurity to prevent access; for example do not rely on renaming a file to include a
+                        random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct
+                        references are used to access files from within the web-root deviating from recommended security
+                        practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input
+                        validation must be applied.&amp;nbsp; Identify and filter for directory traversal
+                        meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use
+                        of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in
+                            the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain
+                            access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example:
+                            www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that
+                            way and if so, it should not be possible to access locations outside of this domain (i.e.
+                            file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;,
+                            etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.675">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but
+                        depending on the resource type the headers may vary. Identify the type of resource the web
+                        service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                        subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin:
+                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin:
+                        *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be
+                        omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data
+                        personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API
+                        endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized
+                        resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials:
+                        true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a
+                        href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods:
+                        POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...:
+                        ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers
+                        from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources
+                        that are intended for cross-origin no-cors embedding, but which don't intend to be directly
+                        legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated
+                        documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
+                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
+                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
+                        Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest,
+                        Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting
+                        Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents
+                        that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
+                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to
+                        be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary:
+                        Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options:
+                        nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents
+                        that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy:
+                        same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy:
+                        unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode,
+                        Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options:
+                        ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
+                            properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some
+                            external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
+                            href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic
+                            subresources&lt;ul&gt;&lt;li&gt;&lt;a
+                            href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a
+                            href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just
+                            open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema
+                        (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will
+                        mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure
+                        input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema
+                        before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data
+                        could have unexpected impact on the behavior of the application, and may facilitate attacks such
+                        as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or
+                        output timing and detect the usage of automated tools or unusual behavior, such as actions not
+                        performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When
+                        the usage of automated tools is detected, the application should respond by denying access and
+                        notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns
+                        in large data sets for the purpose of data or knowledge discovery. Data storage objects include
+                        database records and database fields. Sensitive information can be extracted from data mining
+                        operations. When information is personally identifiable information, it may lead to
+                        unanticipated revelations about individuals and give rise to privacy risks. Prior to performing
+                        data mining activities, organizations determine whether such activities are authorized.
+                        Organizations may be subject to applicable laws, executive orders, directives, regulations, or
+                        policies that address data mining requirements. Organizational personnel consult with the senior
+                        agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data
+                        mining prevention and detection techniques include limiting the number and frequency of database
+                        queries to increase the work factor needed to determine the contents of databases, limiting
+                        types of responses provided to database queries, applying differential privacy techniques or
+                        homomorphic encryption, and notifying personnel when atypical database queries or accesses
+                        occur. Data mining protection focuses on protecting information from data mining while such
+                        information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for
+                        organizational information that may have been mined or otherwise obtained from data stores and
+                        is available as open-source information residing on external sites, such as social networking or
+                        social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider
+                        threat program for deterring, detecting, and mitigating insider threats, including the
+                        safeguarding of sensitive information from exploitation, compromise, or other unauthorized
+                        disclosure. Data mining protection requires organizations to identify appropriate techniques to
+                        prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an
+                        insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such
+                            as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content
+                        on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable
+                        directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict
+                        access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file
+                        for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or
+                        other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on
+                        client-side actions. This can expose the application to attack through remote or local
+                        file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class
+                        loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side
+                        data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where
+                        server-side operations are dependent on client-side input, this should be mapped to pre-defined
+                        operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify
+                            them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they
+                            are untrusted, make sure there is a validation and sanitization mechanism before sending
+                            this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in
+                        transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end
+                        encryption between the client and server, terminating within a secure environment on the
+                        server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of
+                        (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively,
+                        asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested
+                        implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established
+                            encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only
+                            strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use
+                            unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review
+                            configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs,
+                        controllers, services, and other resources. This implies protection against spoofing and
+                        elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside
+                            the database (e.g., making a payment, adding a contact, or sending a message), or can
+                            receive information (statement of account, order details, etc.), or delete information (drop
+                            users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try
+                            to access such functions as another user in order to verify if it is possible to access a
+                            function that should not be permitted by the user's role/privilege (but might be permitted
+                            as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is
+                        not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data
+                        is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They
+                            may be used in applications for:&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+                            &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+                            &lt;li&gt;Caching/Persistence&lt;/li&gt;
+                            &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+                            &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data
+                        sources, sometimes developers try to implement them in a generic way without thinking about the
+                        sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never
+                        rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the
+                        API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and
+                        enforce data returned by all API methods, including errors. Whenever possible: use schema's for
+                        responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all
+                        sensitive and personally identifiable information (PII) that your application stores and
+                        processes and review all API calls returning such information, to see if these responses could
+                        be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by
+                            sniffing (covertly observing) the traffic to analyze API responses, looking for any
+                            sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools
+                            usually can't detect this type of vulnerability because it's hard to differentiate between
+                            legitimate data returned from the API, and sensitive data that should not be returned
+                            without a deep understanding of the application. However, you can use a "man-in-the-middle
+                            proxy" like OWASP Zap to manually explore your application to find sensitive data in API
+                            responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your
+                            application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the
+                            Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In
+                            the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select
+                            the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore
+                            your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click
+                            the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs
+                            accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request
+                            from the left side panel and get the information via the right-side "Request" and "Response"
+                            tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.521">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
+              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web
+                        server. Many of theses methods are designed to aid developers in deploying and testing HTTP
+                        applications. These HTTP methods can be used for nefarious purposes if the web server is
+                        misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the
+                        server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET
+                        and POST are by far the most common methods that are used to access information provided by a
+                        web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less
+                        known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines
+                        the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some
+                        of these methods can potentially pose a security risk for a web application, as they allow an
+                        attacker to modify the files stored on the web server and, in some scenarios, steal the
+                        credentials of legitimate users. More specifically, the methods that should be disabled are the
+                        following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a
+                        client to upload new files onto the web server. An attacker may exploit this by uploading
+                        malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply
+                        using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt;
+                        This method allows a client to delete a file on the web server. An attacker may exploit it as a
+                        very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT:
+                        &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE:
+                        &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the
+                        server, and is used mainly for debugging purposes. This method, originally assumed harmless, can
+                        be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah
+                        Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application
+                        needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE),
+                        it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure
+                        the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and
+                        DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.130">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the
+                        secure deployment of the application, particularly if the application infrastructure is software
+                        defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for
+                            configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information
+                            (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Web server and application server configurations play a key role in the security of a web
+                        application. These servers are responsible for serving content and invoking applications that
+                        generate content. In addition, many application servers provide a number of services that web
+                        applications can use, including data storage, directory services, mail, messaging, and more.
+                        Failure to manage the proper configuration of your servers can lead to a wide variety of
+                        security problems.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Authorized administrators need to ensure the integrity of all security-relevant configurations
+                        to detect tampering.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Understanding the deployed configuration of the server hosting the web application is almost
+                            as important as the application security testing itself. After all, an application chain is
+                            only as strong as its weakest link. Application platforms are wide and varied, but some key
+                            platform configuration errors can compromise the application in the same way an unsecured
+                            application can compromise the server.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            In order to evaluate the readiness of the application platform, testing for configuration
+                            management includes the following sections:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify
+                            the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared
+                            buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of
+                            two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify
+                            they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection,
+                        is directly written to a log file, then this data could contain newline or other meta-characters
+                        that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should
+                        first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header.
+                        Otherwise this could cause misinterpretation on the consumer/producer side and lead to code
+                        injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly
+                        check incoming Content-Type for REST services are the expected ones, such as application/xml or
+                        application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the
+                            server or not. For example: modify "content application/JSON" to "application/XML" and
+                            insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The
+                        Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer
+                        header) should be included with requests. This security header was designed to prevent
+                        cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a
+                        fetch originates from. It doesn't include any path information, but only the server name. It is
+                        sent with CORS requests, as well as with POST requests. It is similar to the Referer header,
+                        but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The
+                        Content-Disposition response header tells the browser to download a file rather than displaying
+                        it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content
+                        but does not specify a character set, then the browser may analyze the HTML and attempt to
+                        determine which character set it appears to be using. Even if the majority of the HTML actually
+                        employs a standard character set such as UTF-8, the presence of non-standard characters anywhere
+                        in the response may cause the browser to interpret the content using a different character set.
+                        This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which
+                        non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use
+                        a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't
+                        use the Origin header for authentication or access control decisions, as the Origin header can
+                        easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response
+                        header for file downloading in all API responses with the following directives:
+                        Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the
+                        content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set
+                        (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response
+                            headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press
+                            Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a
+                            section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header
+                            exists in HTTP responses and has the right directives to prevent cross-domain Referrer
+                            leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for
+                            insecure configurations; for example, when the server returns back the Origin header in the
+                            Access-Control-Allow-Origin without any additional checks AND returns
+                            Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note
+                            that this configuration is very insecure, and is not acceptable in general terms, except in
+                            the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try
+                            Reflected File Download input payloads to launch commands on the client machine. Reflected
+                            File Download is an attack combining URL path segments (now deprecated) with pages that
+                            reflect user inputs in the response. Generally web services vulnerable to JSONP Injection
+                            are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a
+                            popular misuse; namely, being used for encoding malicious injection strings in a way that
+                            obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input
+                            validation filters, or take advantage of particular ways in which browsers render encoded
+                            text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application
+                        relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS
+                        pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs,
+                        serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar.
+                        Protections can include ensuring that DNS names used by applications are regularly checked for
+                        expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify
+                            the connection to the DNS was authenticated successfully by username/password or certificate
+                            and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.080">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process
+                        time that the application requires to function properly while minimizing the resources employed
+                        by the attacker by using vulnerabilities or flaws in the application. The main characteristics
+                        of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth
+                        compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary
+                        to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in
+                        distinguishing between malicious and legitimate traffic. Many of the most common protection
+                        measures or systems focus on the network or transport layer, and as such, they would not be
+                        efficient when the target of the attack is the application layer. It is even difficult for the
+                        defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As
+                        we have indicated, this type of attack is very specific, and generally require fewer resources
+                        from the attacker to achieve devastating effects in the systems attacked. However, this type of
+                        attack requires more time to analyze the targeted system in order to discover vulnerabilities or
+                        bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze
+                        weaknesses or bottlenecks in the design, the implementation, or even the functioning of the
+                        application to identify "heavy" requests that are resource consuming. For example, if the web
+                        application has a search engine, an attack could be to carry out searches that require a high
+                        level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement
+                        a challenge to the device making the network request in order to test whether or not it is a
+                        bot. This is done through a test much like the CAPTCHA test commonly found when creating an
+                        account online. By giving a requirement such as a JavaScript computational challenge, many
+                        attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and
+                        filtering traffic through an IP reputation database, and through on-the-fly network analysis by
+                        engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known
+                            application attack is Slowloris, which targets web servers. Verify that the implemented
+                            Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.950">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via
+                        configuration, and sometimes at the code level. Implementing proper checks can be a confusing
+                        task, since modern applications can contain many types of roles or groups and complex user
+                        hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your
+                        application should have a consistent and easy to analyze authorization module that is invoked
+                        from all your business functions. Frequently, such protection is provided by one or more
+                        components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement
+                        mechanism(s) should deny all access by default, requiring explicit grants to specific roles for
+                        access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level
+                        authorization flaws, while keeping in mind the business logic of the application and groups
+                        hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from
+                        an administrative abstract controller that implements authorization checks based on the user's
+                        group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller
+                        implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
+            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API
+                            endpoint that they should not have access to. These endpoints might be exposed to anonymous
+                            users or regular, non-privileged users. It's easier to discover these flaws in APIs since
+                            APIs are more structured, and the way to access certain functions is more predictable (e.g.,
+                            replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to
+                            "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't
+                            assume that an API endpoint is regular or administrative only based on the URL path. While
+                            developers might choose to expose most of the administrative endpoints under a specific
+                            relative path, like api/admins, it's very common to find these administrative endpoints
+                            under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The
+                            best way to find broken function-level authorization issues is to perform deep analysis of
+                            the authorization mechanism, while keeping in mind the user hierarchy, different roles or
+                            groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can
+                            access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive
+                            actions (e.g., creation, modification, or erasure) that they should not have access to by
+                            simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a
+                            user from group X can access a function that should be exposed only to users from group Y,
+                            by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
+              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and
+                        transactions, to enforce the correct usage of the application for each user ensuring they cannot
+                        bypass important steps in the flow. This business logic limits provide us protection against
+                        likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All
+                        business actions or transactions that exceed the established limits, should be recorded in the
+                        logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Verify the application has appropriate limits for specific business actions or
+                            transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+                            &lt;li&gt;Verify the application has business logic limits or validation to protect against
+                            likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+                            &lt;li&gt;Verify the application monitors for unusual events or activity from a business
+                            logic perspective.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests
+                        to enumerate or attempt to exploit flaws in an application, for example, sending common
+                        passwords to multiple target accounts within an application. By profiling normal traffic
+                        volumes, and applying rate limiting, the application can be built to actively mitigate such
+                        attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection
+                        rate-limiting based on the source IP address can be used to restrict attacks against the
+                        authentication or registration systems. Multiple failures (or attempts) from a single IP should
+                        result in temporarily blocking or dropping traffic from the source. Note however that some
+                        corporate and ISP environments may place multiple valid and discrete clients behind the same IP
+                        address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other
+                        IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class
+                        of attack, Indicators of Compromise should be monitored (for example a higher rate of login
+                        failures than usual), and appropriate actions taken. For example, when the application detects
+                        active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could
+                        be used to block attacks sharing a signature from pattern matching or deep packet inspection
+                        (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application
+                        could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is
+                        detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement
+                        the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application
+                        detects a set number of failure login attempts, the account shall be locked for a certain time
+                        period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When
+                        the application detects an account is locked more times than usual, this account should be
+                        disabled (no more than 100 failure attempts). A disabled account should only be restored by an
+                        administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the
+                        application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting
+                        authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a
+                        white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If
+                        the user successfully authenticates, the previous failed attempts shall be reset for that user
+                        from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;,
+                            &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt;
+                            or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute
+                            force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform
+                            a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the
+                            function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a
+                            log alerting function for an unusual amount of failed login attempts, even if they
+                            originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out
+                        authentication strategy. An API built without protection from malicious threats through
+                        authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know
+                        all the possible flows to authenticate to the API (mobile / web / deep links that implement
+                        one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand
+                        deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and
+                        neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token
+                        generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential
+                        recovery / forget password endpoints should be treated as login endpoints in terms of brute
+                        force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication
+                        Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement
+                        anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force
+                        attacks on your authentication endpoints. This mechanism should be stricter than the regular
+                        rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha
+                        mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API
+                        keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the
+                            authentication process works and using that information to circumvent the authentication
+                            mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are
+                            transferred via an encrypted channel (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test
+                            for default credentials of common applications (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt
+                            an invalid login by using incorrect passwords a number of times to test the account lockout
+                            mechanism's ability to mitigate brute force password guessing (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify
+                            user input parameters to gain access to protected areas without providing valid credentials
+                            (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify
+                            that the credentials are only sent during the login phase, and not sent together with every
+                            request to the application (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check
+                            that the application does not leak any sensitive data into the browser cache. In order to do
+                            that, use a proxy (such as WebScarab) and search through the server responses that belong to
+                            the session, checking that for every page which contains sensitive information, the server
+                            instructed the browser not to cache any data (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine
+                            the resistance of the application against brute force password guessing using available
+                            password dictionaries by evaluating the length, complexity, reuse and aging requirements of
+                            passwords (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try
+                            to create security questions by creating a new account or by configuring your existing
+                            account's password recovery properties, to find weak self-generated questions (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine
+                            the resistance of the passwords reset functionality against guessing or bypassing (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully
+                            test the website's primary authentication functions. This should identify how accounts are
+                            issued, created or changed and how passwords are recovered, reset, or changed. Additionally
+                            knowledge of any elevated privilege authentication and authentication protection measures
+                            should be known (&lt;a
+                            href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner
+                        and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A
+                        well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good
+                        error handling does not give an attacker any information which can be leveraged for attacking
+                        the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain
+                        and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information
+                        leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building
+                        an infrastructure for consistent error reporting proves more difficult than error handling. All
+                        exceptions should be caught as events with the severity of the error. These events will be
+                        logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the
+                        corresponding error or system message in a consistent manner, depending on the severity of the
+                        error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and
+                            exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all
+                            errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and
+                        hierarchy. Object-level authorization checks should be considered in every function that
+                        accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor
+                        not using an ID that has been sent from the client, but instead use an ID that is stored in the
+                        session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an
+                        authorization mechanism to check if the logged-in user has access to perform the requested
+                        action on the record in every function that uses an input from the client to access a record in
+                        the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write
+                        tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these
+                        tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used
+                            to reference objects directly. For example, locations where user input is used to access a
+                            database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the
+                            parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess
+                            whether it is possible to retrieve objects belonging to other users or otherwise bypass
+                            authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
+              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations.
+                        However, proper logging practices can provide the crucial forensics needed to investigate after
+                        a breach, and perhaps more importantly, to detect security issues as they happen. Most
+                        developers are already familiar with logging for debugging and diagnostic purposes, so it should
+                        be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log
+                        all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs
+                        should be written using a format suited to be consumed by a log management solution, and include
+                        enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as
+                        sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure
+                        a monitoring system to continuously monitor the infrastructure, network, and the API
+                        functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system
+                        to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure
+                        custom dashboards and alerts, making it possible to detect and respond to suspicious activity as
+                        early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to
+                            confirm that the organization's logging policies, processes, and procedures are being
+                            followed properly both at the infrastructure level and the system level throughout the
+                            organization.&amp;nbsp; Log management audits can identify deficiencies in policies,
+                            procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most
+                            common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors
+                            or others performing testing and validation can review the logging configuration and
+                            settings, as well as the system logs, infrastructure logs, and archived logs, for a
+                            representative sampling of systems and infrastructure servers to ensure that they comply
+                            with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under
+                            the direction of auditors) or others performing testing and validation can create security
+                            events on a representative sampling of systems through vulnerability scanning, penetration
+                            testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the
+                            log data those activities should generate exist and are handled according to the
+                            organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.811">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with
+                        little computational effort) force the server to expend relatively large computational work. If
+                        a web application is delivered over TLS, an attacker can also choose to attack the TLS
+                        negotiation process. TLS is computationally expensive so an attacker can reduce a server's
+                        availability by sending unintelligible data. In a variation of this attack, an attacker
+                        completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker
+                        can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To
+                        mitigate consider options like offloading the SSL from the origin infrastructure and inspecting
+                        the application traffic for signs of attack traffic or violations of policy at an application
+                        delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then
+                        re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever
+                        residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required
+                            tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There
+                            are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            and the options you should use will depend greatly on your testing requirements. Below are
+                            some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;
+                            command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test
+                            Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S
+                            -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to
+                            HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt;
+                            OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh
+                            -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same
+                            as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E
+                            192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.950">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining,
+                        upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks
+                        and performance attributes). The asset inventory makes up the first part of a chain in many risk
+                        management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory
+                        all API hosts and document important aspects of each one of them, focusing on the API
+                        environment (e.g., production, staging, test, development), who should have network access to
+                        the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory
+                        integrated services and document important aspects such as their role in the system, what data
+                        is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your
+                        API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing
+                        (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate
+                        documentation automatically by adopting open standards. Include the documentation build in your
+                        CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use
+                        the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for
+                        all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid
+                        using production data with non-production API deployments. If this is unavoidable, these
+                        endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When
+                        newer versions of APIs include security improvements, perform risk analysis to make the decision
+                        of the mitigation actions required for the older versions: for example, whether it is possible
+                        to backport the improvements without breaking API compatibility, or simply take the older
+                        versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Make sure the API host inventory and API documentation are updated and available to
+                            stakeholders. To check the validity of this documentation you can use an active/passive
+                            discovery tool to identify undocumented API hosts or endpoints.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.522">
+              <output/>
+            </source>
+            <references>
+              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs
+                        files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Data validation failures, together with access control violations, are symptomatic of malicious
+                        activity where an attacker is attempting to subvert the protections in place. It is therefore
+                        likely that unexpected input detected by the application relates to an attack. Rejecting and
+                        logging such activity, and ideally terminating the session, increases the likelihood of
+                        detecting and inhibiting structured attacks against the application.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+                        &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against
+                        the logs and subsequent access to them.&lt;/li&gt;
+                        &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+                        &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker
+                        enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may
+                            indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm
+                            security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged
+                            relating to the event must be carefully sanitized and encoded; by definition the data could
+                            be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify
+                            actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser,
+                        etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect
+                            the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If
+                            there is no company policy, check that at least the following data is included: timestamp
+                            event, status, error codes, service/command/application username or system account
+                            associated with an eventDevice used (e.g. source and destination IPs, terminal session ID,
+                            web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a
+                            href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;
+                            https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be
+                        precise enough to know who changed what and when). This includes data access from the
+                        application as well as data access from privileged accounts, such as database admins. In
+                        practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees,
+                            administrators and malicious actors.&lt;/li&gt;
+                            &lt;li&gt;Verify appropriate logging of all the above activities are successful and
+                            sufficiently detailed.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.811">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs
+                        or vulnerabilities in the code or logic. For closed-source projects it is therefore important to
+                        control and restrict access to the source. Application services may unexpectedly expose code,
+                        for example a service providing files to a user could be manipulated to access source code if
+                        implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source
+                        code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check
+                        configuration files are not downloadable directly from the service, and cannot be read and
+                        viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and
+                        version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases
+                            in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called
+                            handlers which manage the source code interpretation before sending it to the client. If
+                            those handlers are not properly configured, the plain source code could be sent as a
+                            default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the
+                            types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is
+                            not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.250">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious
+                        web site, email, blog, instant message, or program causes a user's web browser to perform an
+                        unwanted action on a trusted site when the user is authenticated. A CSRF attack works because
+                        browser requests automatically include any credentials associated with the site, such as the
+                        user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the
+                        site cannot distinguish between the forged or legitimate request sent by the victim. A
+                        token/identifier that is not accessible to the attacker is needed to mitigate this and would not
+                        be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring
+                        re-authentication of sensitive functions is an effective way to protect your application against
+                        a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies
+                        from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF
+                        nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key'
+                        (which is valid only once) that must be validated in any sensitive form submission. For maximum
+                        security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple
+                        or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on
+                        the server-side is problematic, an alternative defense is to use the double-submit cookie
+                        technique. This technique is easy to implement and is stateless. In this technique, a random
+                        value is sent in both a cookie and as a request parameter, with the server verifying if the
+                        cookie value and request value match. When a user visits (even before authenticating to prevent
+                        login CSRF), the site should generate a (cryptographically strong) pseudo random value and set
+                        it as a cookie on the user's machine separate from the session identifier. The site then
+                        requires that every transaction request include this pseudo-random value as a hidden form value
+                        (or other request parameter/header). If both of them match on the server-side, the server
+                        accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN
+                        request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely
+                        on examining an HTTP request header value. Firstly, determining the origin the request is coming
+                        from (source origin). This can be achieved via Origin and/or referer headers. Secondly,
+                        determining the origin the request is going to (target origin). On the server-side verify if
+                        both of these match. If they do, we accept the request as legitimate (meaning it's the same
+                        origin request) and if they don't, discard the request (meaning that the request originated from
+                        a cross-domain). Reliability of these headers comes from the fact they cannot be altered
+                        programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list
+                        (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.-
+                            Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser
+                            request and server response, and verify a unique strong token is being sent and verified
+                            with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way
+                            resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.-
+                            Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change
+                            or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt
+                            to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a
+                            request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser
+                            requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions
+                            such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3
+                        infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's
+                        bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP
+                        traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For
+                        example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against
+                        ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p
+                        icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above
+                        lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect
+                        against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This
+                        is only good enough to protect against PC to PC attacks. If flood is done using multiple sources
+                        or using hardware then this configuration may not be enough. The configuration will also cause
+                        denial of service to other users when under attack even from single source, as we are limiting
+                        based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables
+                        can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A
+                        OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above
+                        example we are limiting outgoing connections to port 80. This is useful when we can't completely
+                        block outgoing connections but we do not want it to become channel from where people start
+                        browsing net or downloading. The limit module can also be used in rate limiting incoming traffic
+                        for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by
+                        disabling the ICMP functionality of the targeted router, computer or other device. A network
+                        administrator can access the administrative interface of the device and disable its ability to
+                        send and receive any requests using the ICMP, effectively eliminating both the processing of the
+                        request and the Echo Reply. The consequence of this is that all network activities that involve
+                        ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and
+                        other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can execute a Smurf attack (denial-of-service attack that floods a target
+                            system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or
+                        cross-site scripting, an attack may compromise data and functionality accessible to the victim.
+                        This may include elevating privileges or accessing sensitive data and functionality, such as
+                        changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These
+                        critical functions and sensitive data should be further protected from attack using a risk-based
+                        authentication model requiring re-authentication via multi-factor authentication, or use of a
+                        token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement
+                        re-authentication on key functions (such as requiring the old password before setting a new
+                        one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow
+                        financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require
+                        multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of
+                        signing technologies or tokens that enable the server-side to verify the authenticity of a
+                        request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.677">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process
+                        flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without
+                        this safeguard in place attackers may be able to bypass or circumvent work-flows and checks
+                        allowing them to prematurely enter or skip required sections of the application potentially
+                        allowing actions/transactions to be completed without successfully completing the entire
+                        business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step
+                            order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Use periodically a static code analysis tool to analyze the code and detect potentially
+                        malicious code, such as time functions, unsafe file operations and networks connections. With
+                        the scanning of static code, we ensure the integrity of the application.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Verify that a code analysis tool is in use and it is configured to detect potentially
+                            malicious code, such as time functions, unsafe file operations and network connections.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.162">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to
+                        trick error-free programs, which follow best practices, into leaking their secrets. In fact, the
+                        safety checks of said best practices actually increase the attack surface and may make
+                        applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce
+                        potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to
+                        respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to
+                        the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict
+                        attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin
+                        resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when
+                        necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as
+                        a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or
+                        CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder,
+                        for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle
+                        to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case,
+                        you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or
+                        unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion
+                        attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read
+                        blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and
+                        globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set
+                            properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.413">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and
+                        to preserve forensic quality of the logs, it is important a unified and trusted synchronized
+                        time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers
+                        should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized
+                        source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This
+                        control is critical in identifying application events (including attacks) through logging, and
+                        in conducting post-event analysis, and in particular to track the entire user (or attacker)
+                        journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It
+                        is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged
+                        to detect possible situations in which the system has been compromised and give an appropriate
+                        response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential
+                        risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or
+                        auto-binding when accepting values from an untrusted source and mapping them to trusted server
+                        side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                        &lt;li&gt;Use available features of the language or framework that allow specification of white
+                        lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible
+                        (white list) or attr_protected (black list) macros in each class that may be used in mass
+                        assignment.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check
+                            if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify
+                            if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used
+                        by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes
+                        the site in question completely inaccessible to all traffic, both malicious attack traffic and
+                        legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the
+                        ISP to protect other customers on its network from the adverse effects of DDoS attacks such as
+                        slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack.
+                        For Smurf attack a simple solution is to disable IP broadcasting addresses at each network
+                        router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting
+                        by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable
+                        broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered
+                        Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone
+                        routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0
+                        254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4
+                        address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static
+                        routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set
+                        origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher
+                        than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set
+                        community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't
+                        want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to
+                        192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the
+                        route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null
+                        route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route
+                        50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for
+                        example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and
+                            monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the
+                            implemented availability protection is effective. One useful tool to execute this kind of
+                            test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
+                            interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP
+                            echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the
+                            ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For
+                            example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3
+                            VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.951">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications
+                        between RA (Registration Authority) and CSP (Credential Service Provider), should be
+                        authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS
+                        connection, using approved cryptographic algorithms.&lt;/p&gt;
+                        &lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+                        &lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity
+                        that issues security tokens or electronic credentials to subscribers. A CSP forms part of an
+                        authentication system, most typically identified as a separate entity in a Federated
+                        authentication system. A CSP may be an independent third party, or may issue credentials for its
+                        own use. Credential Service Provider is typically also the Identity Provider (IDP). An example
+                        of a CSP would be an online site whose primary purpose may be, for example, internet banking -
+                        but whose users may be subsequently authenticated to other sites, applications or services
+                        without further action on their part.&lt;/p&gt;
+                        &lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the
+                        identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be
+                        independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+                        &lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying
+                        the claimant's possession and control of one or two authenticators, using an authentication
+                        protocol.&lt;/p&gt;
+                        &lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's
+                        authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically
+                        to process a transaction or grant access to information or a system.&lt;/p&gt;
+                        &lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and
+                        identity proofing.&lt;/p&gt;
+                        &lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more
+                        authentication protocols.&lt;/p&gt;
+                        &lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator
+                        from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example
+                            with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Errors may occur when converting between differently coded character data.&amp;nbsp; There are
+                        two general types of encoding errors. If the byte sequence is not valid for the specified
+                        charset then the input is considered malformed. If the byte sequence cannot be mapped to an
+                        equivalent character sequence then an unmappable character has been encountered.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Special care should be taken when decoding untrusted byte data to ensure that malformed input or
+                        unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding
+                        errors can also occur, for example, encoding a cryptographic key containing malformed input for
+                        transmission will result in an error. Encoding and decoding errors typically result in data
+                        corruption.&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation&lt;/b&gt;
+                        &lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing
+                        attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI
+                        attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.132">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of
+                        the source or transport method. For example, while hidden form fields, cookies or other headers
+                        may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated
+                        forms. These can be modified by the user on the client-side in memory, or in transit on the
+                        network. Similarly, data passed from binary or compiled components can be modified in situ or in
+                        transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit
+                        between the two ends of the encrypted tunnel (one of which is typically controlled by the
+                        client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all
+                        data from the client side must be subjected to strict validation, sanitization, and encoding
+                        against expected syntactic and semantic criteria.
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax
+                        (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a
+                        specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be
+                        syntactically valid because it only contains alphanumeric characters, but it is not valid if the
+                        input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the
+                        strict criteria for each input are accepted, and reject, transform, or encapsulate any
+                        non-compliant data.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific
+                        malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive
+                        and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to
+                        obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be
+                        useful for detecting and logging potential attacks, or determining which inputs are so malformed
+                        that they should be rejected outright.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Validate all data received from the client, including values such as &lt;span
+                        class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the
+                        server side, X- headers, and other platform specific data objects passed between the client and
+                        server.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Serialized Java objects&lt;/li&gt;
+                            &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;
+                            &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined
+                            whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;To test data validation:&amp;nbsp;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it
+                            (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing:
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a browser extension which allows you to modify the request and responses on
+                            the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e.
+                            &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp,
+                            Fiddler, etc.).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:34.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk,
+                        regardless of the source or transport method. HTTP Parameter Pollution attacks result when
+                        parameters are added or inserted into requests, and are inappropriately or unsafely handled by
+                        the server. For example, injection of parameters into strings or cookies sent to the application
+                        can result in the variables being interpreted out of sequence, exploiting flaws in the business
+                        logic and flow.
+                        &lt;div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this
+                        vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using
+                        the following HTTP request:&lt;/p&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker
+                        email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the
+                        security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter,
+                        whereas the actual operation used the second occurrence.&lt;/p&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication
+                            decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to
+                            the application in which those parameters are duplicated, or passed through other methods
+                            (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review
+                            the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the
+                            decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods
+                            result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and
+                            result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application
+                            should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the
+                            user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of
+                            tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly
+                            inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension
+                            which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using
+                            a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP,
+                            Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This
+                        whitelisting can also be achieved by applying regular expressions. The application should only
+                        allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes
+                            place. Redirections are usually indicated by the use of the "Location" HTTP header along
+                            with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is
+                            coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify
+                            the input value which will be part of the Location header to redirect to domains which
+                            should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:33.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer
+                                software through black box analysis techniques. 'Black Box' methods involve interacting
+                                with the software indirectly, in the absence of direct access to the executable object.
+                                Such analysis typically involves interacting with the software at the boundaries of
+                                where the software interfaces with a larger execution environment, such as input-output
+                                vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sniff-api-responses" name="Attackers sniff the traffic to analyze API responses, looking for sensitive data" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is
+                                usually performed by sniffing (covertly observing) the traffic to analyze API responses,
+                                looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The
+                                API may return sensitive data to the client by design. This data is usually filtered on
+                                the client side before being presented to the user. An attacker could potentially sniff
+                                this traffic and see the sensitive data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="review-api-responses" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="review-api-responses" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and
+                                security engineers might have misconceptions about the boundaries of authentication and
+                                how to implement it correctly. In addition, the authentication mechanism is a prime
+                                target for attackers, since it's exposed to everyone. These two points make the
+                                authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
+                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-authentication">
+                  <countermeasures>
+                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
+          <threats>
+            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken
+                                object-level authorization by manipulating the ID of an object that is sent within the
+                                request. This may lead to unauthorized access to sensitive data. This issue is extremely
+                                common in API-based applications because the server component usually does not fully
+                                track the client's state, and instead, relies more on parameters like object IDs, that
+                                are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
+                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-285">
+                  <countermeasures>
+                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-object-level-authorization">
+                  <countermeasures>
+                    <countermeasure ref="object-level-authorization" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                <countermeasure ref="object-level-authorization" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service
+                                itself.
+                                &lt;br&gt;
+                                &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is
+                                still critical to the security of the product that is being created. Because the issues
+                                covered by this section are not directly related to source code, we separated it from
+                                the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is
+                                mitigated by the authorization framework, whose job it is to map ACLs to elements of the
+                                application's functionality; particularly URL's for web-apps. In cases in which the
+                                administrator failed to specify an ACL for a particular element, an attacker may be able
+                                to access it with impunity. An attacker with the ability to access functionality not
+                                properly constrained by ACLs can obtain sensitive information and possibly compromise
+                                the entire application. Such an attacker could potentially access resources that should
+                                only be available to users of a higher privilege level, or access management sections of
+                                the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target
+                                application and observes any stack traces produced by error messages. Fuzzing techniques
+                                involve sending random or malformed messages to a target and monitoring the target's
+                                response. The attacker does not initially know how a target will respond to individual
+                                messages but by attempting a large number of message variants they may find a variant
+                                that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause
+                                the targeted application to return an error including a stack trace, although fuzzing a
+                                target can also sometimes cause the target to enter an unstable state, causing a crash.
+                                The stack trace enumerates the chain of methods that led up to the point where the error
+                                was encountered. This can not only reveal the names of the methods (some of which may
+                                have known weaknesses) but possibly also the location of class files and libraries as
+                                well as parameter values. In some cases, the stack trace might even disclose sensitive
+                                configuration or user information.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment,
+                                allowing developers to monitor their code regularly in order to avoid security
+                                vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This attack vector utilizes DNS entries pointing to Service Providers where the pointed
+                                sub-domain is currently not in use. Depending on the DNS-entry configuration and which
+                                Service Provider it points to, some of these services will allow unverified users to
+                                claim these sub-domains as their own.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL
+                                used inside the Service Provider.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;div&gt;
+                                &lt;b&gt;Attack Scenario&lt;/b&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;ol&gt;
+                                &lt;li&gt;Your company starts using a new service, eg an external Support
+                                Ticketing-service.&lt;/li&gt;
+                                &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg
+                                support.your-domain.com&lt;/li&gt;
+                                &lt;li&gt;Your company stops using this service but does not remove the sub-domain
+                                redirection pointing to the ticketing system.&lt;/li&gt;
+                                &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No
+                                verification is done by the Service Provider, and the DNS-setup is already correctly
+                                setup.&lt;/li&gt;
+                                &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form,
+                                redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely
+                                destroy business credibility for your company.&lt;/li&gt;
+                                &lt;/ol&gt;
+                                &lt;/div&gt;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code
+                                returned by the service, and this code contains confidential information such as
+                                authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration
+                                files that can be downloaded from the service could also be leveraged to gain access to
+                                sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could
+                                attempt to bypass this order so that they can perform operations for which they are not
+                                authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing
+                                the attackers' request, thereby reducing the resources available for legitimate services
+                                and degrading or denying services. Usually, this attack focuses on memory allocation,
+                                but any finite resource on the target could be the attacked, including bandwidth,
+                                processing cycles, or other resources.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack does not attempt to force this allocation through a large number of
+                                requests (that would be Resource Depletion through Flooding) but instead uses one or a
+                                small number of requests that are carefully formatted to force the target to allocate
+                                excessive resources to service this request(s). Often this attack takes advantage of a
+                                bug in the target to cause the target to allocate resources vastly beyond what would be
+                                needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be
+                                reserved for privileged users or administrators but are exposed to use by lower or
+                                non-privileged accounts. Access to sensitive information and functionality must be
+                                controlled to ensure that only authorized users are able to access these resources. If
+                                access control mechanisms are absent or misconfigured, a user may be able to access
+                                resources that are intended only for higher level users. An adversary may be able to
+                                exploit this to utilize a less trusted account to gain information and perform
+                                activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt;
+                                &lt;p&gt;This attack differs from privilege escalation and other privilege stealing
+                                attacks in that the adversary never actually escalates their privileges but instead is
+                                able to use a lesser degree of privilege to access resources that should be (but are
+                                not) reserved for higher privilege accounts. Likewise, the adversary does not exploit
+                                trust or subvert systems - all control functionality is working as configured but the
+                                configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects,
+                                manipulates or forges malicious log entries in the log file, allowing him to mislead a
+                                log audit, cover traces of attack, or perform other malicious actions. The target host
+                                is not properly controlling log access. As a result tainted data is resulting in the log
+                                files leading to a failure in accountability, non-repudiation and incident forensics
+                                capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
+                                subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal
+                                resources. The attacker can supply - or modify - a URL which the code running on the
+                                server will read or submit data to, and by carefully selecting the URLs, the attacker
+                                may be able to read server configuration details such as AWS metadata, connect to
+                                internal services like http enabled databases, or perform post requests towards internal
+                                services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files,
+                                when the executable loads the resource (such as an image file or configuration file) the
+                                attacker has modified the file to either execute malicious code directly or manipulate
+                                the target process (e.g. application server) to execute based on the malicious
+                                configuration parameters. Since systems are increasingly interrelated mashing up
+                                resources from local and remote sources the possibility of this attack occurring is
+                                high.
+                                &lt;br /&gt;The attack can be directed at a client system, such as causing buffer
+                                overrun through loading seemingly benign image files, as in Microsoft Security Bulletin
+                                MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded
+                                into the browser. Another example targets clients reading pdf files. In this case the
+                                attacker simply appends javascript to the end of a legitimate url for a pdf
+                                (http://www.gnucitizen.org/blog/danger-danger-danger/)
+                                &lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+                                &lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has
+                                modified the resource and loaded executable javascript into the client's browser
+                                process.
+                                &lt;br /&gt;The attack can also target server processes. The attacker edits the resource
+                                or configuration file, for example a web.xml file used to configure security permissions
+                                for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with
+                                the public role the ability to use the administration functionality.
+                                &lt;br /&gt;The server trusts its configuration file to be correct, but when they are
+                                manipulated, the attacker gains full control.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which
+                                affect the behavior of that application. For example, many applications use external
+                                configuration files and libraries - modification of these entities or otherwise
+                                affecting the application's ability to use them would constitute a
+                                configuration/environment manipulation attack.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input
+                                under his control and mix it with executed code on the server side by modifying the
+                                logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending
+                                on the code isolation, this event could grant the user access to system resources and
+                                data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters
+                                (such as a XSS redirection) into a filename, directly or indirectly that is then used by
+                                the target software to generate HTML text or other potentially executable content. Many
+                                websites rely on user-generated content and dynamically build resources like files,
+                                filenames, and URL links directly from user supplied data. In this attack pattern, the
+                                attacker uploads code that can execute in the client browser and/or redirect the client
+                                browser to a site that the attacker owns. All XSS attack payload variants can be used to
+                                exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static,
+                                binary format for saving to disk or transferring over a network. These objects are then
+                                deserialized when needed to recover the data/state. By injecting a malformed object into
+                                a vulnerable application, an adversary can potentially compromise the application by
+                                manipulating the deserialization process. This can result in a number of unwanted
+                                outcomes, including remote code execution.
+                                &lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email,
+                                etc.), typically in a targeted manner, hoping to induce users to click on the link and
+                                execute the malicious action against some third-party application. If successful, the
+                                action embedded in the malicious link will be processed and accepted by the targeted
+                                application with the users' privilege level.
+                                &lt;br&gt;This type of attack leverages the persistence and implicit trust placed in
+                                user session cookies by many web applications today. In such an architecture, once the
+                                user authenticates to an application and a session cookie is created on the user's
+                                system, all following transactions for that session are authenticated using that cookie
+                                including potential actions initiated by an attacker and simply "riding" the existing
+                                session cookie.
+                                &lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to
+                                another specified URL. By modifying this URL value to point towards a malicious site, an
+                                attacker may successfully launch a phishing scam and steal user credentials. Because the
+                                server name in the modified link is identical to the original site, phishing attempts
+                                have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input
+                                and submitting it to applications not expecting or effective at validating this
+                                encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL
+                                queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover
+                                when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection
+                                exploits can lead to information disclosure and data loss. It could also lead to DoS, or
+                                complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
+                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="api-vulnerable-injection">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted
+                                differently by intermediaries than it is by the target browser. To achieve this takes
+                                advantage of inconsistent or incorrect interpretations of the HTTP protocol by various
+                                applications. For example, using different block terminating characters (CR or LF
+                                alone), adding duplicate header fields that browsers interpret as belonging to separate
+                                responses, or other techniques. Consequences of this attack can include
+                                response-splitting, cross-site scripting, defacement, cache poisoning, or similar
+                                actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-436">
+                  <countermeasures>
+                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="rest-content-type-val" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                Old API versions are usually unpatched and are an easy way to compromise systems without
+                                having to fight state-of-the-art security mechanisms, which might be in place to protect
+                                the most recent API versions.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br&gt;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-assets-inventory">
+                  <countermeasures>
+                    <countermeasure ref="inventory-api" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="inventory-api" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could
+                                potentially set fields on those objects that were not designed to be modified by the
+                                user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="4dcfce29-0282-4abd-8b6e-67650ff2c4d5" diagramComponentId="e4bc7a6d-9ec2-4713-8add-401bc7287a11" ref="aa19a301-3655-4958-8fa9-12f6c8f76746" name="Microsoft Azure Service Bus Messaging" desc="" library="Microsoft-Azure" parentComponentRef="" componentDefinitionRef="CD-MICROSOFT-AZURE-SER-BUS-MSG">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AZURE-ACCESS-01" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        The credentials for groups and roles are not correctly configured and there are user accounts with more privileges than necessary.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Log into the Azure portal as an owner.&lt;/li&gt;
+                            &lt;li&gt;Select Azure Active Directory.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All users&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each user has got assigned the correct groups.&lt;/li&gt;
+                            &lt;li&gt;Go into &amp;quot;Users and groups&amp;quot; &amp;gt; &amp;quot;All groups&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Check that each group has got assigned the correct roles to achieve principle of
+                            least privilege.&lt;/li&gt;
+                            &lt;li&gt;Check that the roles for the Cloud Service are well assigned.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;div&gt;
+                            &lt;/div&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:50.190">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AZURE-VNET01" name="Networks for Azure resources are not properly segmented. Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Resources in the same VNet are compromised because when one of them is attacked and the
+                        attackers gain access, they also gain access to all resources.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Identify the resources and the Microsoft Azure instances.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the resources are in the correct VNet.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            Check that the Microsoft Azure instances&amp;nbsp;are into different VNets.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-AZURE-SER-BUS-MSG1" name="Use Azure Private Link to enable private access to Service Bus" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="ccumming@synopsys.com" library="Microsoft-Azure" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Azure Private Link to enable private access to Service Bus&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Azure Private Link to enable private access to Service Bus from your virtual networks without crossing the internet.&lt;br&gt; Private access is an additional defense in depth measure to the authentication and traffic security offered by Azure services.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To integrate a Service Bus namespace with Azure Private Link, you'll need the following entities or permissions:&lt;/p&gt; 
+&lt;p&gt;- A Service Bus namespace.&lt;br&gt; - An Azure virtual network.&lt;br&gt; - A subnet in the virtual network. You can use the default subnet.&lt;br&gt; - Owner or contributor permissions for both the Service Bus namespace and the virtual network.&lt;/p&gt; 
+&lt;p&gt;Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your Service Bus namespace can be in a different region. And, Your private endpoint uses a private IP address in your virtual network.&lt;/p&gt; 
+&lt;p&gt;If you already have an existing namespace, you can create a private endpoint by following these steps:&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal.&lt;/p&gt; 
+&lt;p&gt;2. In the search bar, type in Service Bus.&lt;/p&gt; 
+&lt;p&gt;3. Select the namespace from the list to which you want to add a private endpoint.&lt;/p&gt; 
+&lt;p&gt;4. On the left menu, select Networking option under Settings. By default, the Selected networks option is selected.&lt;/p&gt; 
+&lt;p&gt;Note&lt;br&gt; You see the Networking tab only for premium namespaces.&lt;/p&gt; 
+&lt;p&gt;Warning&lt;br&gt; If you don't add at least one IP firewall rule or a virtual network on this page, the namespace can be accessed over public internet (using the access key).&lt;/p&gt; 
+&lt;p&gt;If you select the All networks option, your Service Bus namespace accepts connections from any IP address (using the access key). This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range.&lt;/p&gt; 
+&lt;p&gt;5. To allow access to the namespace via private endpoints, select the Private endpoint connections tab at the top of the page&lt;/p&gt; 
+&lt;p&gt;6. Select the + Private Endpoint button at the top of the page.&lt;/p&gt; 
+&lt;p&gt;7. On the Basics page, follow these steps:&lt;/p&gt; 
+&lt;p&gt;a. Select the Azure subscription in which you want to create the private endpoint.&lt;/p&gt; 
+&lt;p&gt;b. Select the resource group for the private endpoint resource.&lt;/p&gt; 
+&lt;p&gt;c. Enter a name for the private endpoint.&lt;/p&gt; 
+&lt;p&gt;d. Select a region for the private endpoint. Your private endpoint must be in the same region as your virtual network, but can be in a different region from the private link resource that you are connecting to.&lt;/p&gt; 
+&lt;p&gt;e. Select Next: Resource &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;8. On the Resource page, follow these steps:&lt;/p&gt; 
+&lt;p&gt;a. For connection method, if you select Connect to an Azure resource in my directory, follow these steps:&lt;/p&gt; 
+&lt;p&gt;i. Select the Azure subscription in which your Service Bus namespace exists.&lt;/p&gt; 
+&lt;p&gt;ii. For Resource type, Select Microsoft.ServiceBus/namespaces for the Resource type.&lt;/p&gt; 
+&lt;p&gt;iii. For Resource, select a Service Bus namespace from the drop-down list.&lt;/p&gt; 
+&lt;p&gt;iv. Confirm that the Target subresource is set to namespace.&lt;/p&gt; 
+&lt;p&gt;v. Select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;b. If you select Connect to an Azure resource by resource ID or alias, follow these steps:&lt;/p&gt; 
+&lt;p&gt;i. Enter the resource ID or alias. It can be the resource ID or alias that someone has shared with you. The easiest way to get the resource ID is to navigate to the Service Bus namespace in the Azure portal and copy the portion of URI starting from /subscriptions/. See the following image for an example.&lt;/p&gt; 
+&lt;p&gt;ii. For Target sub-resource, enter namespace. It's the type of the sub-resource that your private endpoint can access.&lt;/p&gt; 
+&lt;p&gt;iii.(optional) Enter a request message. The resource owner sees this message while managing private endpoint connection.&lt;/p&gt; 
+&lt;p&gt;iv. Then, select Next: Configuration &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;9. On the Configuration page, you select the subnet in a virtual network to where you want to deploy the private endpoint.&lt;/p&gt; 
+&lt;p&gt;a. Select a virtual network. Only virtual networks in the currently selected subscription and location are listed in the drop-down list.&lt;/p&gt; 
+&lt;p&gt;b. Select a subnet in the virtual network you selected.&lt;/p&gt; 
+&lt;p&gt;c. Select Next: Tags &amp;gt; button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;10. On the Tags page, create any tags (names and values) that you want to associate with the private endpoint resource. Then, select Review + create button at the bottom of the page.&lt;/p&gt; 
+&lt;p&gt;11. On the Review + create, review all the settings, and select Create to create the private endpoint.&lt;/p&gt; 
+&lt;p&gt;12. Confirm that the private endpoint is created. If you are the owner of the resource and had selected Connect to an Azure resource in my directory option for the Connection method, the endpoint connection should be auto-approved. If it's in the pending state, please see the Manage private endpoints using Azure portal section at Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Allow access to Azure Service Bus namespaces via private endpoints" url="https://docs.microsoft.com/en-us/azure/service-bus-messaging/private-link-service"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate that the private link connection works&lt;/p&gt;
+
+	&lt;p&gt;You should validate that resources within the virtual network of the private endpoint are connecting to your Service Bus namespace over a private IP address, and that they have the correct private DNS zone integration.&lt;/p&gt;
+
+	&lt;p&gt;First, create a Windows virtual machine in the Azure portal&lt;/p&gt;
+
+	&lt;p&gt;In the Networking tab:&lt;/p&gt;
+
+	&lt;p&gt;1. Specify Virtual network and Subnet. You must select the Virtual Network on which you deployed the private endpoint.&lt;br /&gt;
+2. Specify a public IP resource.&lt;br /&gt;
+3. For NIC network security group, select None.&lt;br /&gt;
+4 For Load balancing, select No.&lt;/p&gt;
+
+	&lt;p&gt;Connect to the VM, open the command line, and run the following command:&lt;/p&gt;
+
+	&lt;p&gt;nslookup &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;
+
+	&lt;p&gt;You should see a result that looks like the following.&lt;/p&gt;
+
+	&lt;p&gt;Non-authoritative answer:&lt;br /&gt;
+Name:    &lt;service-bus-namespace-name&gt;.privatelink.servicebus.windows.net&lt;br /&gt;
+Address:  10.0.0.4 (private IP address associated with the private endpoint)&lt;br /&gt;
+Aliases:  &lt;service-bus-namespace-name&gt;.servicebus.windows.net&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:32.818">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AZURE-MANAGED-ID" name="Use Managed Identities" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="ccumming@synopsys.com" library="Microsoft-Azure" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Managed Identities&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Use Managed Identities to provide Azure services with an automatically managed identity in Azure AD. Managed Identities allows you to authenticate to any service that supports Azure AD authentication to Azure Resource Manager and can be used with API/Azure Portal/CLI/PowerShell.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enable system-assigned managed identity during creation of a VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM during its creation, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;- Under the Management tab in the Identity section, switch Managed service identity to On.&lt;/p&gt; 
+&lt;p&gt;Enable system-assigned managed identity on an existing VM&lt;/p&gt; 
+&lt;p&gt;To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired Virtual Machine and select Identity.&lt;/p&gt; 
+&lt;p&gt;3. Under System assigned, Status, select On and then click Save:&lt;/p&gt; 
+&lt;p&gt;Assign a user-assigned managed identity to an existing VM&lt;/p&gt; 
+&lt;p&gt;To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No additional Azure AD directory role assignments are required.&lt;/p&gt; 
+&lt;p&gt;1. Sign in to the Azure portal using an account associated with the Azure subscription that contains the VM.&lt;/p&gt; 
+&lt;p&gt;2. Navigate to the desired VM and click Identity, User assigned and then +Add.&lt;/p&gt; 
+&lt;p&gt;3. Click the user-assigned identity you want to add to the VM and then click Add.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configure managed identities for Azure resources on a VM using the Azure portal" url="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm"/>
+          </references>
+          <standards>
+            <standard ref="IM-3" supportedStandardRef="azure-security-benchmark"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that you manage identities securely and automatically.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-05-18T23:34:50.095">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHORIZATION" name="Authorization" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="LOSS-CONTROL_ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="ccumming@synopsys.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could potentially gain unauthorized access to the control of the environment, due to user accounts - or role groups - not being well defined and configured. As a consequence attackers may be able to make changes without root approval.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-ACCESS-01">
+                  <countermeasures>
+                    <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AZURE-MANAGED-ID" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Microsoft-Azure">
+          <threats>
+            <threat ref="AZURE-UNAUTHORISED-CONNECTION" name="Attackers perform unauthorized network access" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="Microsoft-Azure" editable="true">
+              <desc>&lt;p&gt;Attackers could perform unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AZURE-VNET01">
+                  <countermeasures>
+                    <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-AZURE-SER-BUS-MSG1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="9819df95-566d-4144-875d-7852fbffb68c" diagramComponentId="de1dd15d-5242-4d0e-913c-09d2d381dfb7" ref="84938d4c-4d32-4de6-a1be-c852de621214" name="Mobile Device Client" desc="" library="OWASP-MASVS" parentComponentRef="" componentDefinitionRef="mobile-device-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-388" name="An error condition is not properly handled (Error Handling)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Errors and error handling represent a class of API. Errors related to error handling are so
+                        common that they deserve a special kingdom of their own. As with "API Abuse", there
+                        are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-388: An error condition is not properly handled (Error Handling)" url="https://cwe.mitre.org/data/definitions/388.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-120" name="Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The program copies an input buffer to an output buffer without verifying that the size of the
+                        input buffer is less than the size of the output buffer, leading to a buffer overflow.
+                        &lt;br /&gt;A buffer overflow condition exists when a program attempts to put more data in a
+                        buffer than it can hold, or when a program attempts to put data in a memory area outside of the
+                        boundaries of a buffer. The simplest type of error, and the most common cause of buffer
+                        overflows, is the &amp;quot;classic&amp;quot; case in which the program copies the buffer
+                        without restricting how much is copied. Other variants exist, but the existence of a classic
+                        overflow strongly suggests that the programmer is not considering even the most basic of
+                        security protections.
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" url="https://cwe.mitre.org/data/definitions/120.html"/>
+              <reference name="Smashing The Stack For Fun And Profit" url="https://insecure.org/stf/smashstack.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-494" name="Download of Code Without Integrity Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product downloads source code or an executable from a remote location and executes the
+                        code without sufficiently verifying the origin and integrity of the code.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-494: Download of Code Without Integrity Check" url="https://cwe.mitre.org/data/definitions/494.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-749" name="Exposed Dangerous Method or Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software provides an Applications Programming Interface (API) or similar interface for
+                        interaction with external actors, but the interface includes a dangerous method or function that
+                        is not properly restricted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-749: Exposed Dangerous Method or Function" url="https://cwe.mitre.org/data/definitions/749.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-83" name="Improper Neutralization of Script in Attributes in a Web Page" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from
+                        dangerous attributes within tags, such as onmouseover, onload, onerror, or style.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-83: Improper Neutralization of Script in Attributes in a Web Page" url="https://cwe.mitre.org/data/definitions/83.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-EMULATION-TOOLS" name="Inappropriate use of emulation tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of emulation tools are not detected by the app, and attackers can
+                        leverage them to obtain information about the app.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.612">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS" name="Inappropriate use of reverse engineering tools" state="0" impact="100" issueId="" issueLink="">
+          <desc>The inappropriate use of the reverse engineering tools is not detected by the app, and
+                        attackers can leverage them to obtain information about the app.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-732" name="Incorrect Permission Assignment for Critical Resource" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
+
+When a resource is given a permission setting that provides access to a wider range of actors than required, it can lead to the exposure of sensitive information or to the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution or sensitive user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.609">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-732: Incorrect Permission Assignment for Critical Resource" url="https://cwe.mitre.org/data/definitions/732.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-215" name="Information Exposure Through Debug Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application contains debugging code that can expose sensitive information to untrusted parties.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-215: Information Exposure Through Debug Information" url="https://cwe.mitre.org/data/definitions/215.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-489" name="Leftover Debug Code" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application can be deployed with active debugging code that can create unintended entry
+                        points.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-489: Leftover Debug Code" url="https://cwe.mitre.org/data/definitions/489.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="MEMORY-LEAKAGE" name="Memory Leakage" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="OUTDATED-LIBRARIES" name="Outdated libraries" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-656" name="Reliance on Security Through Obscurity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software uses a protection mechanism whose strength depends heavily on its obscurity, such
+                        that knowledge of its algorithms or key data is sufficient to defeat the mechanism.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:09.611">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-656: Reliance on Security Through Obscurity" url="https://cwe.mitre.org/data/definitions/656.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="MASVS-7.9" name="Activate the Free Security Features" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>For Android:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate the Obfuscation of the code and strip unneeded debugging information.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For iOS:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;We shall activate:&amp;nbsp;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;ARC (Automatic Reference Counting): memory management feature, adds retain and release messages when required.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Stack Canary: helps prevent buffer overflow attacks.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;PIE (Position Independent Executable): enables full ASLR for binary.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
+            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+          </references>
+          <standards>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.6" name="Allow only the minimum set of protocol handlers required" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Configure the WebViews to allow only the minimum set of protocol handlers required (ideally, only https). Potentially dangerous handlers, such as file, tel and app-id, are disabled.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
+            <reference name="OWASP MASVS - iOS - Testing WebView Protocol Handlers" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-webview-protocol-handlers-mstg-platform-6"/>
+          </references>
+          <standards>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the set of protocol handlers are deactivated.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.6" name="Anonymize all data that is sent to 3rd Party services" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>All data that is sent to 3rd Party services shall be anonymized, so no PII data is available that would allow the 3rd party to identify the user account. Also all other data, like IDs in an application that can be mapped to a user account or session should not be sent to a third party.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+            <reference name="OWASP MASVS - iOS - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#determining-whether-sensitive-data-is-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+          </references>
+          <standards>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all data that is sent to 3rd Party services is anonymized.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.9" name="Apply 2FA Authentication on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.13" name="Apply application level payload encryption" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;As a defense in depth, next to having solid hardening of the communicating parties, application level payload encryption can be applied to further impede eavesdropping.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
+          </references>
+          <standards>
+            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.6" name="Catch and handle the possible exceptions" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a well-designed and unified scheme to handle exceptions. Make sure the application has centralized handlers for exceptions that result in similar behavior. This can be a static class for instance. For specific exceptions given the methods context, specific catch blocks should be provided.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
+            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the exceptions are well-designed and are catched and handled well.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.5" name="Check for weaknesses in 3rd party libraries" issueId="" issueLink="" platform="" cost="0" risk="89" state="Implemented" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;br&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;iOS applications often make use of third party libraries. These third party libraries accelerate development as the developer has to write less code in order to solve a problem. There are two categories of libraries:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are not (or should not) be packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;OHHTTPStubs&lt;/code&gt;&lt;/span&gt;&lt;span&gt; used for testing.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Libraries that are packed within the actual production application, such as &lt;/span&gt;&lt;span&gt;&lt;code&gt;Alamofire&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;These libraries can lead to unwanted side-effects:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;A library can contain a vulnerability, which will make the application vulnerable. A good example is &lt;/span&gt;&lt;span&gt;&lt;code&gt;AFNetworking&lt;/code&gt;&lt;/span&gt;&lt;span&gt; version 2.5.1, which contained a bug that disabled certificate validation. This vulnerability would allow attackers to execute man-in-the-middle attacks against apps that are using the library to connect to their APIs.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can no longer be maintained or hardly be used, which is why no vulnerabilities are reported and/or fixed. This can lead to having bad and/or vulnerable code in your application through the library.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;A library can use a license, such as LGPL2.1, which requires the application author to provide access to the source code for those who use the application and request insight in its sources. In fact the application should then be allowed to be redistributed with modifications to its source code. This can endanger the intellectual property (IP) of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Note: there are two widely used package management tools: Carthage and CocoaPods. Please note that this issue can hold on multiple levels: When you use webviews with JavaScript running in the webview, the JavaScript libraries can have these issues as well. The same holds for plugins/libraries for Cordova, React-native and Xamarin apps.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#checking-for-weaknesses-in-third-party-libraries-mstg-code-5"/>
+            <reference name="OWASP MASVS - iOS - Checking for Weaknesses in Third Party Libraries" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings"/>
+          </references>
+          <standards>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;The dynamic analysis of this section comprises validating whether the copyrights of the licenses have been adhered to. This often means that the application should have an &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;about&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; or &lt;/span&gt; 
+&lt;span&gt;&lt;code&gt;EULA&lt;/code&gt;&lt;/span&gt; 
+&lt;span&gt; section in which the copy-right statements are noted as required by the license of the third party library.&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.15" name="Clean local storage after several failed attempts to authenticate user" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>The app's local storage should be wiped after an excessive number of failed authentication attempts.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.15" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that local storage is cleaned after failed attempts to authenticate</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.10" name="Clear WebView's resources" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;A WebView's cache, storage, and loaded resources (JavaScript, etc.) should be cleared before the WebView is destroyed.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Platform Interaction Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x11-v6-interaction_with_the_environment"/>
+          </references>
+          <standards>
+            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-1.9" name="Create a mechanism to force updates on application" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Starting from Android 5.0 (API level 21), together with the Play Core Library, apps can be forced to be updated. This mechanism is based on using the &lt;/span&gt;&lt;span&gt;&lt;code&gt;AppUpdateManager&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. Before that, other mechanisms were used, such as doing http calls to the Google Play Store, which are not as reliable as the APIs of the Play Store might change. Alternatively, Firebase could be used to check for possible forced updates as well (see this &lt;/span&gt;&lt;/span&gt;&lt;a href="https://medium.com/@sembozdemir/force-your-users-to-update-your-app-with-using-firebase-33f1e0bcec5a" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blog&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;). Enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;For iOS, enforced updating can be really helpful when it comes to public key pinning (see the Testing Network communication for more details) when a pin has to be refreshed due to a certificate/public key rotation. Next, vulnerabilities are easily patched by means of forced updates. The challenge with iOS however, is that Apple does not provide any APIs yet to automate this process, instead, developers will have to create their own mechanism, such as described at various &lt;/span&gt;&lt;/span&gt;&lt;a href="https://mobikul.com/show-update-application-latest-version-functionality-ios-app-swift-3/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;blogs&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; which boil down to looking up properties of the app using &lt;/span&gt;&lt;span&gt;&lt;code&gt;http://itunes.apple.com/lookup\?id\&amp;lt;BundleId&amp;gt;&lt;/code&gt;&lt;/span&gt;&lt;span&gt; or third party libraries, such as &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/ArtSabintsev/Siren" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Siren&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; and &lt;/span&gt;&lt;/span&gt;&lt;a href="https://www.npmjs.com/package/react-native-appstore-version-checker" target="_blank"&gt;&lt;span&gt;&lt;span&gt;react-native-appstore-version-checker&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;. Most of these implementations will require a certain given version offered by an API or just "latest in the appstore", which means users can be frustrated with having to update the app, even though no business/security need for an update is truly there.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Please note that newer versions of an application will not fix security issues that are living in the backends to which the app communicates. Allowing an app not to communicate with it might not be enough. Having proper API-lifecycle management is key here. Similarly, when a user is not forced to update, do not forget to test older versions of your app against your API and/or use proper API versioning.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
+            <reference name="OWASP MASVS - iOS - Testing enforced updating" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-enforced-updating-mstg-arch-9"/>
+          </references>
+          <standards>
+            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="1.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span style="white-space: pre;"&gt;In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store. Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend. Lastly, see if you can play with the version number of a man-in-the-middled app and see how the backend responds to this (and if it is recorded at all for instance).&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.12" name="Create an authorization model on remote endpoints" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Authorization models should be defined and enforced at the remote endpoint.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.5-4.6" name="Create a strong password policy" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;Password strength is a key concern when passwords are used for authentication. The password policy defines requirements to which end users should adhere. A password policy typically specifies password length, password complexity, and password topologies. A "strong" password policy makes manual or automated password cracking difficult or impossible.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Best Practices for Passwords" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;Automated password guessing attacks can be performed using a number of tools. For HTTP(S) services, using an interception proxy is a viable option. For example, you can use &lt;/span&gt; 
+&lt;a href="https://portswigger.net/burp/help/intruder_using.html" target="_blank"&gt;&lt;span&gt;Burp Suite Intruder&lt;/span&gt;&lt;/a&gt; 
+&lt;span&gt; to perform both wordlist-based and brute-force attacks.&lt;/span&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Execute the following steps for a wordlist based brute force attack with Burp Intruder:&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Start Burp Suite Professional.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Create a new project (or open an existing one).&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Set up your mobile device to use Burp as the HTTP/HTTPS proxy. Log into the mobile app and intercept the authentication request sent to the backend service.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right-click this request on the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Proxy/HTTP History&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab and select &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Send to Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; in the context menu.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Intruder&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab. For further information on how to use &lt;/span&gt;&lt;/span&gt;&lt;a href="https://portswigger.net/burp/documentation/desktop/tools/intruder/using" target="_blank"&gt;&lt;span&gt;&lt;span&gt;Burp Intruder&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt; read the official documentation on Portswigger.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Make sure all parameters in the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Target&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Positions&lt;/strong&gt;&lt;/span&gt;&lt;span&gt;, and &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Options&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tabs are appropriately set and select the &lt;/span&gt;&lt;span&gt;&lt;strong&gt;Payload&lt;/strong&gt;&lt;/span&gt;&lt;span&gt; tab.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+   &lt;li&gt; 
+    &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+     &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Load or paste the list of passwords you want to try. There are several resources available that offer password lists, like &lt;/span&gt;&lt;/span&gt;&lt;a href="https://github.com/fuzzdb-project/fuzzdb/" target="_blank"&gt;&lt;span&gt;&lt;span&gt;FuzzDB&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;span&gt;&lt;span&gt;, the built-in lists in Burp Intruder or the files available in &lt;/span&gt;&lt;span&gt;&lt;code&gt;/usr/share/wordlists&lt;/code&gt;&lt;/span&gt;&lt;span&gt; on Kali Linux.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+    &lt;/div&gt;&lt;/li&gt; 
+  &lt;/ul&gt;&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Once everything is configured and you have a word-list selected, you're ready to start the attack!&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;/span&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.11" name="Create the functionality to verify the app uses a minimum device-access-security policy" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Different checks on the Android device can be implemented by querying different system preferences from Settings.Secure. The Device Administration API offers different mechanisms to create security aware applications, that are able to enforce password policies or encryption of the device.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#testing-the-device-access-security-policy-mstg-storage-11"/>
+            <reference name="OWASP MASVS - iOS - Testing the Device-Access-Security Policy" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-local-data-storage-mstg-storage-1-and-mstg-storage-2"/>
+          </references>
+          <standards>
+            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app verifies the mobile device complies with the minimum
+                            device-access-security policy.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.7" name="Deny the access by default when an uncaught exception appears" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Deny the access by default to prevent the app crashing because of uncaught exception and to avoid unauthorized access.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Exception Handling" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6-and-mstg-code-7"/>
+            <reference name="OWASP MASVS - iOS - Testing Error Handling in Security Controls" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#testing-exception-handling-mstg-code-6"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the application denies access to the session when the exceptions appear.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.5" name="Disable JavaScript by default in a WebView if it is not necessary" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>JavaScript is disabled by default in a WebView and if not needed shouldn't be enabled. This reduces the attack surface and potential threats to the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#testing-javascript-execution-in-webviews-mstg-platform-5"/>
+            <reference name="OWASP MASVS - iOS - Testing JavaScript Execution in WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-ios-webviews-mstg-platform-5"/>
+          </references>
+          <standards>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Search in the code the following instruction:
+                            webview.getSettings().setJavaScriptEnabled(true);&lt;/li&gt;
+                            &lt;li&gt;Check that this instruction doesn't exist in the code.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;For iOS:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the JavaScript is disabled and configured as following:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            #import &amp;quot;ViewController.h&amp;quot;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            #import @interface ViewController () @property(strong,nonatomic) WKWebView *webView;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            @end @implementation ViewController - (void)viewDidLoad { NSURL *url = [NSURL
+                            URLWithString:@&amp;quot;http://www.example.com/&amp;quot;];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            NSURLRequest *request = [NSURLRequest requestWithURL:url];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKPreferences *pref = [[WKPreferences alloc] init]; //Disable javascript execution: [pref
+                            setJavaScriptEnabled:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [pref setJavaScriptCanOpenWindowsAutomatically:NO];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            WKWebViewConfiguration *conf = [[WKWebViewConfiguration alloc] init];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [conf setPreferences:pref]; _webView = [[WKWebView
+                            alloc]initWithFrame:CGRectMake(self.view.frame.origin.x,85, self.view.frame.size.width,
+                            self.view.frame.size.height-85) configuration:conf] ;&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [_webView loadRequest:request];&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            [self.view addSubview:_webView]; }
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.799">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.5" name="Disable keyboard cache on sensitive data text inputs" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>A general best practice is overwriting different functions in the input field to disable the clipboard specifically for it. Also longclickable should be deactivated for the input field.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Sensitive Data Is Exposed via IPC Mechanisms" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-sensitive-stored-data-has-been-exposed-via-ipc-mechanisms-mstg-storage-6"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
+          </references>
+          <standards>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the clipboard is disabled when sensitive data is used.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.10" name="Do not use the SSAID for 'device binding'" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Do not use the SSAID for device binding because the behavior of the SSAID has changed since
+                        Android O and the behavior of MAC addresses have changed in Android N.
+
+                        Google has set a new set of recommendations in their SDK documentation regarding identifiers as
+                        well. Because of this new behavior, we recommend developers not rely on the SSAID alone, as the
+                        identifier has become less stable. For instance: The SSAID might change upon a factory reset or
+                        when the app is reinstalled after the upgrade to Android O. Please note that there are a number
+                        of devices which have the same ANDROID_ID and/or have an ANDROID_ID that can be overridden.
+                        Also, the Build.Serial was often used but now apps targeting Android O will get "UNKNOWN" when
+                        they request the Build.Serial.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-device-binding-mstg-resilience-10"/>
+            <reference name="OWASP MASVS - iOS - Testing Device Binding" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#device-binding-mstg-resilience-10"/>
+          </references>
+          <standards>
+            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Dynamic Analysis using an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Run the application on an Emulator.&lt;/li&gt;
+                            &lt;li&gt;Make sure you can raise the trust in the instance of the application (e.g.
+                            authenticate).&lt;/li&gt;
+                            &lt;li&gt;Retrieve the data from the Emulator. This has a few steps:&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;ol&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the contents of cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;exit the current user&lt;/li&gt;
+                            &lt;li&gt;copy the contents of /dat/data//cache &amp;amp; shared-preferences to the sdcard&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;use ADB or the DDMS to pull the contents&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Install the application on another Emulator&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;&amp;nbsp;Overwrite the data from step 3 in the data folder of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the contents of step 3 to the sdcard of the second emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;ssh to your emulator using ADB shell&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;run-as&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;chmod 777 the folders cache and shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;copy the older contents of the sdcard to /dat/data//cache &amp;amp;
+                            shared-preferences&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Can you continue in an authenticated state? If so, then binding might not be
+                            working properly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.3" name="Don't write any sensitive data on logs" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;There are many legitimate reasons for creating log files on a mobile device, including keeping track of crashes or errors that are stored locally while the device is offline (so that they can be sent to the app's developer once online), and storing usage statistics. However, logging sensitive data, such as credit card numbers and session information, may expose the data to attackers or malicious applications. Log files can be created in several ways.&amp;nbsp;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;The following list includes two classes that are available for Android:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Log Class&lt;/li&gt; 
+ &lt;li&gt;Logger Class&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Use a centralized logging class and mechanism and remove logging statements from the production release because other applications may be able to read them.&lt;/p&gt; 
+&lt;p&gt;The following list shows the methods available on iOS:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;NSLog Method&lt;/li&gt; 
+ &lt;li&gt;printf-like function&lt;/li&gt; 
+ &lt;li&gt;NSAssert-like function&lt;/li&gt; 
+ &lt;li&gt;Macro&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;p&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage"/>
+            <reference name="OWASP MASVS - iOS - Testing Data Storage" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage"/>
+          </references>
+          <standards>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M2: Insecure Data Storage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt; 
+ &lt;li&gt;Review app logs in search of sensitive data&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.11" name="Encrypt and pack all executable files and libraries belonging to the app" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that all executable files and libraries belonging to the app are encrypted on the file level and/or important code and data segments inside the executables are encrypted or packed.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+          </references>
+          <standards>
+            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all executable files and libraries belonging to the app are encrypted or
+                            packed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.803">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.14" name="Encrypt sensitive data stored locally" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>If sensitive data is still required to be stored locally, it should be encrypted using a key derived from hardware backed storage which requires authentication</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.14" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that sensitive data is not stored in plain text.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-2.13" name="Ensure sensitive data is not stored locally on the mobile device" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>No sensitive data should be stored locally on the mobile device. Instead, data should be retrieved from a remote endpoint when needed and only be kept in memory.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.13" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if any sensitive data is stored on the device and analyze if it is necessary.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.7" name="Ensure that the app responds correctly against tampering, debugging and emulation" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the app implements multiple different responses to tampering, debugging and emulation,
+                        including stealthy responses that don't simply terminate the app.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05c-reverse-engineering-and-tampering"/>
+            <reference name="OWASP MASVS - iOS - Verifying the Variability of Tampering Responses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06c-reverse-engineering-and-tampering"/>
+          </references>
+          <standards>
+            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the app implements multiple different responses to tampering, debugging and
+                            emulation, including stealthy responses that don't simply terminate the app.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.6" name="Ensure the app only depends on up-to-date connectivity and security libraries" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Android relies on a security provider to provide SSL/TLS-based connections. The problem with this kind of security provider (one example is OpenSSL), which comes with the device, is that it often has bugs and/or vulnerabilities. To avoid known vulnerabilities, developers need to make sure that the application will install a proper security provider. Since July 11, 2016, Google has been rejecting Play Store application submissions (both new applications and updates) that use vulnerable versions of OpenSSL.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing the Security Provider" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05g-testing-network-communication#testing-the-security-provider-mstg-network-6"/>
+          </references>
+          <standards>
+            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Run the application in debug mode, then create a breakpoint where the app will first contact the endpoint(s).&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Right click the highlighted code and select &lt;/span&gt;&lt;span&gt;&lt;code&gt;Evaluate Expression&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Type &lt;/span&gt;&lt;span&gt;&lt;code&gt;Security.getProviders()&lt;/code&gt;&lt;/span&gt;&lt;span&gt; and press enter.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Check the providers and try to find &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which should be the new top-listed provider.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;When you do not have the source code:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Use Xposed to hook into the &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; package, then hook into &lt;/span&gt;&lt;span&gt;&lt;code&gt;java.security.Security&lt;/code&gt;&lt;/span&gt;&lt;span&gt; with the method &lt;/span&gt;&lt;span&gt;&lt;code&gt;getProviders&lt;/code&gt;&lt;/span&gt;&lt;span&gt; (with no arguments). The return value will be an array of &lt;/span&gt;&lt;span&gt;&lt;code&gt;Provider&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;Determine whether the first provider is &lt;/span&gt;&lt;span&gt;&lt;code&gt;GmsCore_OpenSSL&lt;/code&gt;&lt;/span&gt;&lt;span&gt;.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.4" name="Ensure the logout functionality terminates the session" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The purpose of this test case is verifying logout functionality and determining whether it effectively terminates the session on both client and server and invalidates a stateless token.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Failing to destroy the server-side session is one of the most common logout functionality implementation errors. This error keeps the session or token alive, even after the user logs out of the application. An attacker who gets valid authentication information can continue to use it and hijack a user's account.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Many mobile apps don't automatically log users out. There can be various reasons, such as: because it is inconvenient for customers, or because of decisions made when implementing stateless authentication. The application should still have a logout function, and it should be implemented according to best practices, destroying all locally stored tokens or session identifiers. If session information is stored on the server, it should also be destroyed by sending a logout request to that server. In case of a high-risk application, tokens should be blacklisted. Not removing tokens or session identifiers can result in unauthorized access to the application in case the tokens are leaked. Note that other sensitive types of information should be removed as well, as any information that is not properly cleared may be leaked later, for example during a device backup.&lt;/span&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Use an interception proxy for dynamic application analysis and execute the following steps to check whether the logout is implemented properly:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log in to the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Access a resource that requires authentication, typically a request for private information belonging to your account.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Log out of the application.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Try to access the data again by resending the request from step 2.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;If the logout is correctly implemented on the server, an error message or redirect to the login page will be sent back to the client. On the other hand, if you receive the same response you got in step 2, the token or session ID is still valid and hasn't been correctly terminated on the server.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.11" name="Implement a device blocking functionality" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For applications which require L2 protection, the MASVS states that they should inform the user about all login activities within the app with the possibility of blocking certain devices. This can be broken down into various scenarios:&lt;/span&gt;&lt;/p&gt; 
+&lt;ol&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides a push notification the moment their account is used on another device to notify the user of different activities. The user can then block this device after opening the app via the push-notification.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login. If the previous session was with a different configuration (e.g. location, device, app-version) compared to the current configuration, then the user should have the option to report suspicious activities and block devices used in the previous session.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application provides an overview of the last session after login at all times.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application has a self-service portal in which the user can see an audit-log. This allows the user to manage the different devices that are logged in.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ol&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The developer can make use of specific meta-information and associate it to each different activity or event within the application. This will make it easier for the user to spot suspicious behavior and block the corresponding device. The meta-information may include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Device: The user can clearly identify all devices where the app is being used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Date and Time: The user can clearly see the latest date and time when the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Location: The user can clearly identify the latest locations where the app was used.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;The application can provide a list of activities history which will be updated after each sensitive activity within the application. The choice of which activities to audit needs to be done for each application based on the data it handles and the level of security risk the team is willing to have. Below is a list of common sensitive activities that are usually audited:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Login attempts&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Password changes&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Personal Identifiable Information changes (name, email address, telephone number, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Sensitive activities (purchase, accessing important resources, etc.)&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Consent to Terms and Conditions clauses&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Paid content requires special care, and additional meta-information (e.g., operation cost, credit, etc.) might be used to ensure user's knowledge about the whole operation's parameters.&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;In addition, non-repudiation mechanisms should be applied to sensitive transactions (e.g. payed content access, given consent to Terms and Conditions clauses, etc.) in order to prove that a specific transaction was in fact performed (integrity) and by whom (authentication).&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing Login Activity and Device Blocking" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04e-testing-authentication-and-session-management"/>
+          </references>
+          <standards>
+            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.11" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In all cases, you should verify whether different devices are detected correctly. Therefore, the binding of the application to the actual device should be tested. In iOS, a developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;, which is related to the bundle ID: the moment you change a bundle ID, the method will return a different value. When the app is ran for the first time, make sure you store the value returned by&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;identifierForVendor&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;to the KeyChain, so that changes to it can be detected at an early stage.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;&lt;span&gt;&lt;span&gt;In Android, the developer can use&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Settings.Secure.ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;till Android 8.0 (API level 26) to identify an application instance. Note that starting at Android 8.0 (API level 26),&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;is no longer a device unique ID. Instead, it becomes scoped by the combination of app signing key, user and device. So validating&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for device blocking could be tricky for these Android versions. Because if an app changes its signing key, the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;will change and it won't be able to recognize old users devices. Therefore, it's better to store the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;encrypted and privately in a private a shared preferences file using a randomly generated key from the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;AndroidKeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;and preferably AES_GCM encryption. The moment the app signature changes, the application can check for a delta and register the new&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;ANDROID_ID&lt;/code&gt;&lt;/span&gt;&lt;span&gt;. The moment this new ID changes without a new application signing key, it should indicate that something else is wrong. Next, the device binding can be extended by signing requests with a key stored in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;Keychain&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;for iOS and in the&amp;nbsp;&lt;/span&gt;&lt;span&gt;&lt;code&gt;KeyStore&lt;/code&gt;&lt;/span&gt;&lt;span&gt;&amp;nbsp;in Android can reassure strong device binding. You should also test if using different IPs, different locations and/or different time-slots will trigger the right type of information in all scenarios.&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Lastly, the blocking of the devices should be tested, by blocking a registered instance of the app and see if it is then no longer allowed to authenticate. Note: in case of an application which requires L2 protection, it can be a good idea to warn a user even before the first authentication on a new device. Instead: warn the user already when a second instance of the app is registered.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.1" name="Implement detection and response functionalities for root detection" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement detection and response functionalities to detect rooted devices and if the device is rooted, the app shall respond in two ways:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The app notifies the user that their device is rooted and it's not secure to continue with the app.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Terminate the session and the app, because sensitive data is vulnerable.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-root-detection-mstg-resilience-1"/>
+            <reference name="OWASP MASVS - iOS - Testing Advanced Root Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#jailbreak-detection-mstg-resilience-1"/>
+          </references>
+          <standards>
+            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that the app has two or more functionalities with independent methods to
+                            detect a rooted device.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that if the device is rooted, the user is alerted or the app is terminated.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.804">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.3" name="Implement functionality to alert when the app code changes" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to detect, notify and respond when the app is modified by executable files or by anti-debugging tools within its own sandbox. When the injection is detected the app shall alert the user and terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
+            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
+          </references>
+          <standards>
+            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For the application source integrity checks, run the app on the device in an
+                            unmodified state and make sure that everything works.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then apply simple patches to the classes.dex and any .so libraries contained in
+                            the app package. Re-package and re-sign the app.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app alerts the user and/or terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.6" name="Implement functionality to detect and respond to, modifications of process memory" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect &amp;quot;hostile&amp;quot; code in its memory and respond
+                        accordingly. Controls in this category verify the integrity of the app's own memory space, with
+                        the goal of protecting against memory patches applied during runtime. This includes unwanted
+                        changes to binary code or bytecode, functions pointer tables, and important data structures, as
+                        well as rogue code loaded into process memory.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;div&gt;
+                        Integrity can be verified either by:&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Comparing the contents of memory, or a checksum over the contents, with known good
+                        values.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Searching memory for signatures of unwanted modifications.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing File Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-file-integrity-checks-mstg-resilience-3"/>
+            <reference name="OWASP MASVS - iOS - Testing Memory Integrity Checks" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#file-integrity-checks-mstg-resilience-3-and-mstg-resilience-11"/>
+          </references>
+          <standards>
+            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.6" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Disable all file-based detection of reverse engineering tools.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Then inject code using Xposed, Frida and Substrate, and attempt to install native
+                            hooks and Java method hooks.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that the app detects the &amp;quot;hostile&amp;quot; code in its memory and
+                            responds accordingly.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.5" name="Implement functionality to detect if the app is being run inside an emulator" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Create and implement functionality to detect when the app is being run inside an emulator. If
+                        the app is running inside an emulator, the app shall terminate the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Emulator Detection" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-emulator-detection-mstg-resilience-5"/>
+          </references>
+          <standards>
+            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Install and run the app within an emulator.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the app detects this and terminates the session.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.4" name="Implement functionality to detect the presence of widely used reverse engineering tools" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Create functionality to detect the presence of widely used reverse engineering tools, such as
+                        code injection tools, hooking frameworks and debugging servers. If any reverse engineering tool
+                        is detected, the app shall force termination of the session.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
+            <reference name="OWASP MASVS - iOS - Testing Detection of Reverse Engineering Tools" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-reverse-engineering-tools-detection-mstg-resilience-4"/>
+          </references>
+          <standards>
+            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Launch the app systematically with various apps and frameworks installed, such as the
+                            following:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Substrate for Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Xposed&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Frida&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Introspy-Android&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Drozer&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;RootCloak&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Android SSL Trust Killer&amp;nbsp;&lt;/li&gt;
+                            &lt;/ul&gt;The app should alert the user and/or terminate the app.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.2" name="Implement functionality to notify when debugging mechanisms are presented within the app" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement anti-debugging mechanisms to prohibit debug mode being activated. Anti-debugging
+                        features can be preventive or reactive. As the name implies, preventive anti-debugging
+                        techniques prevent the debugger from attaching in the first place, while reactive techniques
+                        attempt to detect whether a debugger is present and react to it in some way (e.g. terminating
+                        the app, or triggering some kind of hidden behavior).&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The &amp;quot;more-is-better&amp;quot; rule applies: To maximize effectiveness, defenders
+                        combine multiple methods of prevention and detection which operate on different API layers and
+                        are distributed throughout the app.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
+            <reference name="OWASP MASVS - iOS - Testing Debugging Defenses" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2"/>
+          </references>
+          <standards>
+            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M9: Reverse Engineering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check for the presence of anti-debugging mechanisms and verify if with the following
+                            criteria the anti-debugging mechanisms are bypassed:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Attaching JDB and ptrace based debuggers either fails or causes the app to
+                            terminate or malfunction&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Multiple detection methods are scattered throughout the app (as opposed to putting
+                            everything into a single method or function);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The anti-debugging defenses operate on multiple API layers (Java, native library
+                            functions, Assembler/system calls);&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;The mechanisms show some level of originality (vs. copy/paste from StackOverflow
+                            or other sources);&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.4" name="Insert the condition DEVELOPER-MODE to remove the debugging code, log verbose errors or debugging messages in the production version" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Insert the policy in the if statement with DEVELOPER_MODE as condition. The DEVELOPER_MODE has
+                        to be disabled for release build in order to disable StrictMode too.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Remove the debugging code, log verbose errors or debugging messages in the production version.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing for Debugging Code and Verbose Error Logging" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+            <reference name="OWASP MASVS - iOS - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-code-and-verbose-error-logging-mstg-code-4"/>
+          </references>
+          <standards>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M10: Extraneous Functionality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Check that there is only one method to activate the DEVELOPMENT_MODE.&lt;/li&gt;
+                            &lt;li&gt;Check that the debugging code was removed.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.9-8.12" name="Obfuscate all executable files, libraries, important code and data segments" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Obfuscation is the process of transforming code and data in order to make it more difficult to comprehend. It is an integral part of every software protection scheme. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods, considering currently published research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-based isolation features are preferred over obfuscation whenever possible. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Advanced Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+            <reference name="OWASP MASVS - iOS - Testing Simple Obfuscation" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06j-testing-resiliency-against-reverse-engineering#testing-obfuscation-mstg-resilience-9"/>
+          </references>
+          <standards>
+            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.12" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.9" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;Attempt to decompile the byte-code, disassemble any included library files, and perform static analysis. At the very least, the app's core functionality (i.e., the functionality meant to be obfuscated) shouldn't be easily discerned. Verify that&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;meaningful identifiers, such as class names, method names, and variable names, have been discarded,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;string resources and strings in binaries are encrypted,&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+ &lt;li&gt; 
+  &lt;div class="reset-3c756112--listItemContent-756c9114"&gt; 
+   &lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;code and data related to the protected functionality is encrypted, packed, or otherwise concealed.&lt;/span&gt;&lt;/p&gt; 
+  &lt;/div&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"&gt;For a more detailed assessment, you need a detailed understanding of the relevant threats and the obfuscation methods used.&lt;/span&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.809">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.7" name="Only JavaScript provided with the app code is allowed" issueId="" issueLink="" platform="" cost="1" risk="77" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether Java Objects Are Exposed Through WebViews" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05h-testing-platform-interaction#determining-whether-java-objects-are-exposed-through-webviews-mstg-platform-7"/>
+          </references>
+          <standards>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.7" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>- Produce a JavaScript payload.
+                            - Inject it into the file that the app is requesting. The injection could be done either
+                            through a MITM attack or by directly modifying the file in case it is stored on external
+                            storage. The whole process could be done through Drozer that uses weasel (MWR's advanced
+                            exploitation payload) which is able to install a full agent, injecting a limited agent into
+                            a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
+                            - Check that only the JavaScript provided with the app is allowed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.800">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-4.1" name="Perform authentication process on remote services" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Authentication and Session Management Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x09-v4-authentication_and_session_management_requirements"/>
+          </references>
+          <standards>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M6: Insecure Authorization" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.3" name="Remove or obfuscate the debugging symbols from native binaries" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>As a general rule of thumb, as little explanative information as possible should be provided
+                        along with the compiled code. Some metadata such as debugging information, line numbers and
+                        descriptive function or method names make the binary or bytecode easier to understand for the
+                        reverse engineer, but isn't actually needed in a release build and can therefore be safely
+                        discarded without impacting the functionality of the app.
+
+                        This data shall be removed from the release version or shall be obfuscated in order to be
+                        inaccessible to the reverse engineer.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying Compiler Settings" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#testing-for-debugging-symbols-mstg-code-3"/>
+            <reference name="OWASP MASVS - iOS - Testing for Debugging Symbols" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#finding-debugging-symbols-mstg-code-3"/>
+          </references>
+          <standards>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.3" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Symbols are usually stripped during the build process, so you need the compiled byte-code
+                            and libraries to verify whether any unnecessary metadata has been discarded. First find the
+                            nm binary in your Android NDK and export it (or create an alias).
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            export $NM =
+                            $ANDROID_NDK_DIR/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            To display debug symbols:
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ $NM -a
+                            libfoo.so/tmp/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-nm:
+                            libfoo.so: no symbols&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;To display dynamic symbols:
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            $ $NM -D libfoo.so&amp;nbsp;
+                            &lt;/blockquote&gt;Alternatively, open the file in your favorite disassembler and check the
+                            symbol tables manually. Dynamic symbols can be stripped using the visibility compiler flag.
+                            Adding this flag causes gcc to discard the function names while still preserving the names
+                            of functions declared as JNIEXPORT.&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            Check if the following was added to build.gradle:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            externalNativeBuild { cmake { cppFlags &amp;quot;-fvisibility=hidden&amp;quot; } }&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;br /&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;For iOS:&amp;nbsp;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            Use gobjdump to inspect the main binary and any included dylibs for Stabs and DWARF symbols.
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            $ gobjdump --stabs --dwarf TargetApp&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;In archive MyTargetApp:&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            - armv5te: file format mach-o-arm - aarch64: file format mach-o-arm64 Gobjdump is part of
+                            binutils and can be installed via Homebrew on Mac OS X.
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-6.1" name="Request only the minimum required permissions from the mobile operating system" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Security best practice dictates the practice of least-privilege is followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Request only the minimum required permissions from the mobile operating system. For example, if there is no requirement to use the camera then the application should not request this permission. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Review features and functionality present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them and associated OS permissions. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing App Permissions" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide"/>
+            <reference name="OWASP MASVS - iOS - Testing Custom URL Schemes" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#testing-app-permissions-mstg-platform-1"/>
+          </references>
+          <standards>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="6.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M1: Improper Platform Usage" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M4: Insecure Authentication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+            <standard ref="M7: Client Code Quality" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>For Android applications:&amp;nbsp;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and review the permissions the application is asking for.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check they are actually needed.&lt;/li&gt;
+                            &lt;/ol&gt;For iOS applications:&amp;nbsp;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Install the application and use its main functionality, iOS will ask for the
+                            permission when it is needed.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify those permissions requests are in accordance with the minimum set of
+                            permissions needed by the application.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-5.1-5.2" name="Secure channels with TLS" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  One of the core mobile app functions is sending/receiving data over untrusted networks like the Internet. If the data is not properly protected in transit, an attacker with access to any part of the network infrastructure (e.g., a Wi-Fi access point) may intercept, read, or modify it. This is why plaintext network protocols are rarely advisable. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The vast majority of apps rely on HTTP for communication with the backend. HTTPS wraps HTTP in an encrypted connection (the acronym HTTPS originally referred to HTTP over Secure Socket Layer (SSL); SSL is the deprecated predecessor of TLS). TLS allows authentication of the backend service and ensures confidentiality and integrity of the network data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensuring proper TLS configuration on the server side is also important. The SSL protocol is deprecated and should no longer be used. Also TLS v1.0 and TLS v1.1 have known vulnerabilities and their usage is deprecated in all major browsers by 2020. TLS v1.2 and TLS v1.3 are considered best practice for secure transmission of data. Starting with Android 10 (API level 29) TLS v1.3 will be enabled by default for faster and secure communication. The major change with TLS v1.3 is that customizing cipher suites is no longer possible and that all of them are enabled when TLS v1.3 is enabled, whereas Zero Round Trip (0-RTT) mode isn't supported. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When both the client and server are controlled by the same organization and used only for communicating with one another, you can increase security by hardening the configuration. 
+&lt;/div&gt; 
+&lt;div&gt;
+  If a mobile application connects to a specific server, its networking stack can be tuned to ensure the highest possible security level for the server's configuration. Lack of support in the underlying operating system may force the mobile application to use a weaker configuration. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Verifying Data Encryption on the Network" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04f-testing-network-communication"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M3: Insecure Communication" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted. You can intercept network traffic in any of the following ways: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Capture all HTTP(S) and Websocket traffic with an interception proxy like OWASP ZAP or Burp Suite and make sure all requests are made via HTTPS instead of HTTP.&lt;/li&gt; 
+  &lt;li&gt;Interception proxies like Burp and OWASP ZAP will show HTTP(S) traffic only. You can, however, use a Burp plugin such as Burp-non-HTTP-Extension or the tool mitm-relay to decode and visualize communication via XMPP and other protocols.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.8" name="Secure in the unmanaged code, the allocated memory, freed memory and used memory" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Memory corruption bugs are a popular mainstay for hackers. This class of bug results from a programming error that causes the program to access an unintended memory location. Under the right conditions, attackers can capitalize on this behavior to hijack the execution flow of the vulnerable program and execute arbitrary code.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This kind of vulnerability occurs in a number of ways: 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;b&gt;Buffer overflows:&lt;/b&gt; This describes a programming error where an app writes beyond an allocated memory range for a particular operation. An attacker can use this flaw to overwrite important control data located in adjacent memory, such as function pointers. Buffer overflows were formerly the most common type of memory corruption flaw, but have become less prevalent over the years due to a number of factors. Notably, awareness among developers of the risks in using unsafe C library functions is now a common best practice plus, catching buffer overflow bugs is relatively simple. However, it is still worth testing for such defects.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Out-of-bounds-access: &lt;/b&gt;Buggy pointer arithmetic may cause a pointer or index to reference a position beyond the bounds of the intended memory structure (e.g. buffer or list). When an app attempts to write to an out-of-bounds address, a crash or unintended behavior occurs. If the attacker can control the target offset and manipulate the content written to some extent, code execution exploit is likely possible.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Dangling pointers:&lt;/b&gt; These occur when an object with an incoming reference to a memory location is deleted or deallocated, but the object pointer is not reset. If the program later uses the dangling pointer to call a virtual function of the already deallocated object, it is possible to hijack execution by overwriting the original vtable pointer. Alternatively, it is possible to read or write object variables or other memory structures referenced by a dangling pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Use-after-free:&lt;/b&gt; This refers to a special case of dangling pointers referencing released (deallocated) memory. After a memory address is cleared, all pointers referencing the location become invalid, causing the memory manager to return the address to a pool of available memory. When this memory location is eventually re-allocated, accessing the original pointer will read or write the data contained in the newly allocated memory. This usually leads to data corruption and undefined behavior, but crafty attackers can set up the appropriate memory locations to leverage control of the instruction pointer.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Integer overflows: &lt;/b&gt;When the result of an arithmetic operation exceeds the maximum value for the integer type defined by the programmer, this results in the value "wrapping around" the maximum integer value, inevitably resulting in a small value being stored. Conversely, when the result of an arithmetic operation is smaller than the minimum value of the integer type, an integer underflow occurs where the result is larger than expected. Whether a particular integer overflow/underflow bug is exploitable depends on how the integer is used - for example, if the integer type were to represent the length of a buffer, this could create a buffer overflow vulnerability.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;&lt;b&gt;Format string vulnerabilities: &lt;/b&gt;When unchecked user input is passed to the format string parameter of the printf() family of C functions, attackers may inject format tokens such as '%c' and '%n' to access memory. Format string bugs are convenient to exploit due to their flexibility. Should a program output the result of the string formatting operation, the attacker can read and write to memory arbitrarily, thus bypassing protection features such as ASLR.&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   A best practice to fix the Memory Corruption Bugs are the following:&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;When using integer variables for array indexing, buffer length calculations, or any other security-critical operation, verify that unsigned integer types are used and perform precondition tests to prevent the possibility of integer wrapping.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Ensure the app does not use unsafe string functions such as strcpy, most other functions beginning with the "str" prefix, sprint, vsprintf, gets, etc.; If the app contains C++ code, ANSI C++ string classes are used; iOS apps written in Objective-C use NSString class. C apps on iOS should use CFString, the Core Foundation representation of a string. No untrusted data is concatenated into format strings.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Testing for Memory Management Bugs" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/general-mobile-app-testing-guide/0x04h-testing-code-quality#memory-corruption-bugs-mstg-code-8"/>
+          </references>
+          <standards>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if some of the different Memory Corruption bugs appear when you try to use them to
+                            gain access to the system.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.787">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-8.8" name="Set the detection mechanism to trigger different alarms" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span style="white-space: pre;"&gt;The detection mechanisms trigger responses of different types, including delayed and stealthy responses.&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Resilience Requirements" url="https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements"/>
+          </references>
+          <standards>
+            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="8.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.810">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="MASVS-7.1" name="Sign the app and provision with valid certificate with a properly protected key" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="ccumming@synopsys.com" library="OWASP-MASVS" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Code signing your app assures users that it is from a known source and the app hasn't been modified since it was last signed. This process can prevent an app from being tampered with, or modified to include malicious code.</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
+            <reference name="OWASP MASVS - iOS - Verifying That the App is Properly Signed" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06i-testing-code-quality-and-build-settings#making-sure-that-the-app-is-properly-signed-mstg-code-1"/>
+          </references>
+          <standards>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="7.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="M8: Code Tampering" supportedStandardRef="owasp-mobile-top-10-2016"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the app is correctly signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T19:14:08.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-133" name="An attacker attempts to invoke all common switches and options to discover weaknesses" state="Partly-Mitigate" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker attempts to invoke all common switches and options in the target
+                                application for the purpose of discovering weaknesses in the target. For example, in
+                                some applications, adding the --debug switch causes debugging information to be
+                                displayed, which can sometimes reveal sensitive processing or configuration information
+                                to an attacker.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This attack differs from other forms of API abuse in that the attacker is blindly
+                                attempting to invoke options in the hope that one of them will work rather than
+                                specifically targeting a known option. Nonetheless, even if the attacker is familiar
+                                with the published options of a targeted application this attack method may still be
+                                fruitful as it might discover unpublicized functionality.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-215">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-489">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-656">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                    <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MEMORY-LEAKAGE">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                    <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                    <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="OUTDATED-LIBRARIES">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                    <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                    <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-1.9" mitigation="5"/>
+                <countermeasure ref="MASVS-2.13" mitigation="5"/>
+                <countermeasure ref="MASVS-2.14" mitigation="5"/>
+                <countermeasure ref="MASVS-2.15" mitigation="5"/>
+                <countermeasure ref="MASVS-2.3" mitigation="5"/>
+                <countermeasure ref="MASVS-2.5" mitigation="5"/>
+                <countermeasure ref="MASVS-4.4" mitigation="5"/>
+                <countermeasure ref="MASVS-5.1-5.2" mitigation="5"/>
+                <countermeasure ref="MASVS-5.6" mitigation="5"/>
+                <countermeasure ref="MASVS-7.3" mitigation="15"/>
+                <countermeasure ref="MASVS-7.4" mitigation="5"/>
+                <countermeasure ref="MASVS-7.5" mitigation="5"/>
+                <countermeasure ref="MASVS-7.9" mitigation="5"/>
+                <countermeasure ref="MASVS-8.11" mitigation="5"/>
+                <countermeasure ref="MASVS-8.13" mitigation="5"/>
+                <countermeasure ref="MASVS-8.2" mitigation="5"/>
+                <countermeasure ref="MASVS-8.8" mitigation="5"/>
+                <countermeasure ref="MASVS-8.9-8.12" mitigation="5"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-494">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                    <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.1" mitigation="34"/>
+                <countermeasure ref="MASVS-8.3" mitigation="33"/>
+                <countermeasure ref="use-analysis-static-code" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-188" name="Attacker gains access to sensitive data by modifying the application's expected behavior" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of an object, resource,
+                                or system by using a variety of analysis techniques to effectively determine how the
+                                analyzed entity was constructed or operates. The goal of reverse engineering is often to
+                                duplicate the function, or a part of the function, of an object in order to duplicate or
+                                &amp;quot;back engineer&amp;quot; some aspect of its functioning.&amp;nbsp;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Reverse engineering techniques can be applied to mechanical objects, electronic devices,
+                                or software, although the methodology and techniques involved in each type of analysis
+                                differ widely. When adversaries are reverse engineering software, methodologies fall
+                                into two broad categories, 'white box' and 'black box.' White box techniques involve
+                                methods which can be applied to a piece of software when an executable or some other
+                                compiled object can be directly subjected to analysis, revealing at least a portion of
+                                its machine instructions that can be observed upon execution.
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                'Black Box' methods involve interacting with the software indirectly, in the absence of
+                                the ability to measure, instrument, or analyze an executable object directly. Such
+                                analysis typically involves interacting with the software at the boundaries of where the
+                                software interfaces with a larger execution environment, such as input-output vectors,
+                                libraries, or APIs.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="MASVS-EMULATION-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.7" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="MASVS-REVERSE-ENGINEERING-TOOLS">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-8.10" mitigation="20"/>
+                <countermeasure ref="MASVS-8.4" mitigation="20"/>
+                <countermeasure ref="MASVS-8.5" mitigation="20"/>
+                <countermeasure ref="MASVS-8.6" mitigation="20"/>
+                <countermeasure ref="MASVS-8.7" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122-MOBILE" name="Users lose trust in the application because it requests unnecessary privileges" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>If the mobile application requests permissions or access to components that are not
+                                strictly needed by the application, then users can lose trust in the security of the
+                                application with an associated impact on the trust placed in the application provider.</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                    <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                    <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                    <countermeasure ref="MASVS-8.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.11" mitigation="20"/>
+                <countermeasure ref="MASVS-4.5-4.6" mitigation="20"/>
+                <countermeasure ref="MASVS-6.1" mitigation="20"/>
+                <countermeasure ref="MASVS-8.1" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PROVIDE MOBILE ACCESS TO SERVICES" name="Provide mobile access to services" desc="" library="OWASP-MASVS">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-732">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                    <countermeasure ref="MASVS-4.9" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-2.6" mitigation="25"/>
+                <countermeasure ref="MASVS-4.1" mitigation="25"/>
+                <countermeasure ref="MASVS-4.12" mitigation="25"/>
+                <countermeasure ref="MASVS-4.9" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-WEBVIEW" name="Attackers gain access to the data through the WebView functionality" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>An attacker employs forceful browsing to access portions of a website that are
+                                otherwise unreachable through direct URL entry.
+
+                                Usually, a front controller or similar design pattern is employed to protect access to
+                                portions of a web application.
+
+                                Forceful browsing enables an attacker to access information, perform privileged
+                                operations and otherwise reach sections of the web application that have been improperly
+                                protected.</desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-749">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                    <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-83">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-6.10" mitigation="25"/>
+                <countermeasure ref="MASVS-6.5" mitigation="25"/>
+                <countermeasure ref="MASVS-6.6" mitigation="25"/>
+                <countermeasure ref="MASVS-6.7" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-ErrorH" name="Attackers gain unauthorised access to the application through an error handling flaw" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>Errors and error handling represent a class of API. Errors related to error handling
+                                are so common that they deserve a special kingdom of their own. As with API Abuse, there are two ways to introduce an error-related security vulnerability: the most common
+                                one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-388">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                    <countermeasure ref="MASVS-7.7" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.6" mitigation="50"/>
+                <countermeasure ref="MASVS-7.7" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-100" name="Attackers gain unauthorised access to the application through buffer overflow flaws" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="OWASP-MASVS" editable="true">
+              <desc>Buffer Overflow attacks target improper or missing bounds checking on buffer
+                                operations, typically triggered by input injected by an attacker. As a consequence, an
+                                attacker is able to write past the boundaries of allocated buffer regions in memory,
+                                causing a program crash or potentially redirection of execution as per the attackers'
+                                choice.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-120">
+                  <countermeasures>
+                    <countermeasure ref="MASVS-7.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="MASVS-7.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="d43b8baa-f67a-4026-b681-b260f0ea7fa0" diagramComponentId="a11e488b-6643-4fa6-9a5e-7998cf2c6b1c" ref="7e40a8c4-d66d-4fda-97b0-cf32743724f1" name="Other data store" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other-database">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.226">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an
+                        unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable
+                        user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt;
+                        &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.386">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data
+                        store. The account should not be able to perform operations that are not explicitly required by
+                        the component that performs these operations. For example, if a web application needs to read
+                        data from certain tables and insert and update data from others, then a database account with
+                        only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt;
+                            &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt;
+                            &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary
+                            permissions are assigned.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.183">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security
+                        flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known
+                        security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public
+                        domain, they get included in automated exploitation suites like Metasploit and a wider less
+                        skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply
+                        patches and other software updates in a timely manner to prevent unexpected failures or
+                        exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches,
+                        in particular security patches, with expected timescales. &amp;nbsp;There is often a small
+                        window between the release of a patch, and potentially malicious actors reverse-engineering the
+                        patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence,
+                        vulnerability scanning, or other alerting services to ensure the project team is promptly aware
+                        of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.279">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why
+                        encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries,
+                        taking into account the data use, and do not invent your own.
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+                        &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so
+                        they cannot be recovered easily&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest
+                            (e.g. databases).&lt;/li&gt;
+                            &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining
+                            the reasoning for that decision.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification
+                        (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data.
+                        For less sensitive but still restricted data, simple verification of the location of the user
+                        may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but
+                        non-public data, access could be restricted by IP address, limiting access to internal networks,
+                        workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side
+                        certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is
+                        handled, a full authentication process to identify and validate users with single or
+                        multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Try to obtain access to this information without any type of authentication, for
+                            example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of
+                        the service and its attack surface; and the likelihood of a malicious actor gaining access to
+                        the system.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Apply network layer security controls so that only the necessary and expected IP
+                        addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the network access to the service is only allowed for the components
+                            which need it.&lt;/li&gt;
+                            &lt;li&gt;There should be a firewall protecting the network segment in which the service is
+                            installed.&lt;/li&gt;
+                            &lt;li&gt;Check that the firewall restricts all access and only permits the minimum
+                            connections required using the principal of least privilege.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:31.284">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the
+                                privileges of an authorized or privileged user by evading - or circumventing - an
+                                authentication mechanism. The attacker is therefore able to access protected data
+                                without authentication ever having taken place. This refers to an attacker gaining
+                                access equivalent to an authenticated user without ever going through an authentication
+                                procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected
+                                access procedure that does not go through the proper checkpoints where authentication
+                                should occur. For example, a web site might assume that all users will click through a
+                                given link in order to access secure material and simply authenticate everyone that
+                                clicks the link. However, an attacker might be able to reach secured web content by
+                                explicitly entering the path to the content rather than clicking through the
+                                authentication link, thereby avoiding the check entirely. This attack pattern differs
+                                from other authentication attacks in that attacks of this pattern avoid authentication
+                                entirely, rather than faking authentication by exploiting flaws or by stealing
+                                credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
+                                subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="abe82b73-b22d-4aa0-b368-15b292ce5587" diagramComponentId="d3189187-d2ee-4b5c-83a2-fb0287f8b73a" ref="972a00a0-b3ef-4a79-b494-8088f1d45f57" name="Other database" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="other">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.049">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an
+                        unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.221">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable
+                        user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt;
+                        &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data
+                        store. The account should not be able to perform operations that are not explicitly required by
+                        the component that performs these operations. For example, if a web application needs to read
+                        data from certain tables and insert and update data from others, then a database account with
+                        only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt;
+                            &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt;
+                            &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary
+                            permissions are assigned.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:27.988">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security
+                        flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known
+                        security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public
+                        domain, they get included in automated exploitation suites like Metasploit and a wider less
+                        skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply
+                        patches and other software updates in a timely manner to prevent unexpected failures or
+                        exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches,
+                        in particular security patches, with expected timescales. &amp;nbsp;There is often a small
+                        window between the release of a patch, and potentially malicious actors reverse-engineering the
+                        patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence,
+                        vulnerability scanning, or other alerting services to ensure the project team is promptly aware
+                        of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why
+                        encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries,
+                        taking into account the data use, and do not invent your own.
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+                        &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so
+                        they cannot be recovered easily&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest
+                            (e.g. databases).&lt;/li&gt;
+                            &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining
+                            the reasoning for that decision.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.114">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification
+                        (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data.
+                        For less sensitive but still restricted data, simple verification of the location of the user
+                        may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but
+                        non-public data, access could be restricted by IP address, limiting access to internal networks,
+                        workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side
+                        certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is
+                        handled, a full authentication process to identify and validate users with single or
+                        multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Try to obtain access to this information without any type of authentication, for
+                            example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="84" state="Recommended" owner="ccumming@synopsys.com" library="CS-Default" source="TEMPLATE" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of
+                        the service and its attack surface; and the likelihood of a malicious actor gaining access to
+                        the system.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Apply network layer security controls so that only the necessary and expected IP
+                        addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the network access to the service is only allowed for the components
+                            which need it.&lt;/li&gt;
+                            &lt;li&gt;There should be a firewall protecting the network segment in which the service is
+                            installed.&lt;/li&gt;
+                            &lt;li&gt;Check that the firewall restricts all access and only permits the minimum
+                            connections required using the principal of least privilege.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-05-17T17:45:28.113">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the
+                                privileges of an authorized or privileged user by evading - or circumventing - an
+                                authentication mechanism. The attacker is therefore able to access protected data
+                                without authentication ever having taken place. This refers to an attacker gaining
+                                access equivalent to an authenticated user without ever going through an authentication
+                                procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected
+                                access procedure that does not go through the proper checkpoints where authentication
+                                should occur. For example, a web site might assume that all users will click through a
+                                given link in order to access secure material and simply authenticate everyone that
+                                clicks the link. However, an attacker might be able to reach secured web content by
+                                explicitly entering the path to the content rather than clicking through the
+                                authentication link, thereby avoiding the check entirely. This attack pattern differs
+                                from other authentication attacks in that attacks of this pattern avoid authentication
+                                entirely, rather than faking authentication by exploiting flaws or by stealing
+                                credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data
+                                subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="TEMPLATE" edited="false" owner="ccumming@synopsys.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/sap-hana-on-gcp.xml b/Templates/Submitted_Templates/sap-hana-on-gcp.xml
new file mode 100644
index 0000000..db3a032
--- /dev/null
+++ b/Templates/Submitted_Templates/sap-hana-on-gcp.xml
@@ -0,0 +1,6400 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="sap-hana-on-gcp" name="SAP HANA on GCP" tags="">
+  <desc>&lt;p&gt;See https://cloud.google.com/solutions/sap/docs/architectures/sap-s4hana-on-gcp&lt;/p&gt;</desc>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTMwNSIgZHk9IjEzMDgiIGdyaWQ9IjAiIGdyaWRTaXplPSIxMCIgZ3VpZGVzPSIxIiB0b29sdGlwcz0iMSIgY29ubmVjdD0iMSIgYXJyb3dzPSIxIiBmb2xkPSIxIiBwYWdlPSIwIiBwYWdlU2NhbGU9IjEiIHBhZ2VXaWR0aD0iODUwIiBwYWdlSGVpZ2h0PSIxMTAwIiBtYXRoPSIwIiBzaGFkb3c9IjAiIGlyRHJhd2lvVmVyc2lvbj0iNS42LjAiPjxyb290PjxteENlbGwgaWQ9IjAiLz48bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz48bXhDZWxsIGlkPSIzIiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI1NyIgeT0iNTgiIHdpZHRoPSI1OTYiIGhlaWdodD0iNTc4IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48b2JqZWN0IGxhYmVsPSJHQ1AgVlBDIChWaXJ0dWFsIFByaXZhdGUgQ2xvdWQpIiBpci5zb3VyY2VTdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELVZQQztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6RTVORFpmTWpVME16Y3BJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMamt5T1RRMU5TQXdMalExT1RZeU5Fd3dMamMwT0RZME1pQXdMakUwTlRFMk1VTXdMamMwTVRnME15QXdMakV6TXpFd015QXdMamN6TWpBeE1TQXdMakV5TXpBeklEQXVOekl3TVRJeElEQXVNVEUxT1RNNVF6QXVOekE0TWpNeUlEQXVNVEE0T0RRNUlEQXVOamswTmprMklEQXVNVEEwT1RnM0lEQXVOamd3T0RVMUlEQXVNVEEwTnpNMlNEQXVNekU1TVRZeFF6QXVNekExTXpFNElEQXVNVEEwT1RnZ01DNHlPVEUzT0NBd0xqRXdPRGd6T1NBd0xqSTNPVGc0T1NBd0xqRXhOVGt6UXpBdU1qWTNPVGs0SURBdU1USXpNREl4SURBdU1qVTRNVFk0SURBdU1UTXpNRGs0SURBdU1qVXhNemMwSURBdU1UUTFNVFl4VERBdU1EY3dORGt5TXlBd0xqUTFPRGM1T1VNd0xqQTJNell4TmpFZ01DNDBOekEzTmpRZ01DNHdOVGs1T1RjMklEQXVORGcwTXpJeklEQXVNRFU1T1RrM05pQXdMalE1T0RFeU5FTXdMakExT1RrNU56WWdNQzQxTVRFNU1qUWdNQzR3TmpNMk1UWXhJREF1TlRJMU5EZ3pJREF1TURjd05Ea3lNeUF3TGpVek56UTBPVXd3TGpJMU1UTXdOU0F3TGpnMU16WTVPVU13TGpJMU9EQXpNaUF3TGpnMk5Ua3pNeUF3TGpJMk56Z3hJREF1T0RjMk1qRTRJREF1TWpjNU5qZzRJREF1T0Rnek5UVTBRekF1TWpreE5UWTNJREF1T0Rrd09Ea3hJREF1TXpBMU1UUXhJREF1T0RrMU1ESTVJREF1TXpFNU1Ea3lJREF1T0RrMU5UWTRTREF1Tmpnd056ZzJRekF1TmprME56TTFJREF1T0RrMU1EZzVJREF1TnpBNE16SXhJREF1T0Rrd09UazRJREF1TnpJd01qRTFJREF1T0Rnek5qazFRekF1TnpNeU1UQTVJREF1T0RjMk16a3lJREF1TnpReE9UQTBJREF1T0RZMk1USTRJREF1TnpRNE5qUXlJREF1T0RVek9UQTFUREF1T1RJNU5EVTFJREF1TlRNNU5EUXpRekF1T1RNMk16Z3hJREF1TlRJM01qZ3lJREF1T1RRd01ESXlJREF1TlRFek5USTRJREF1T1RRd01ESXlJREF1TkRrNU5UTXpRekF1T1RRd01ESXlJREF1TkRnMU5UTTRJREF1T1RNMk16Z3hJREF1TkRjeE56ZzFJREF1T1RJNU5EVTFJREF1TkRVNU5qSTBWakF1TkRVNU5qSTBXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU5qWXlOVEEySURBdU16TTNNVFU0VERBdU5URTROelE1SURBdU5EQTJNalV5VERBdU5EUTVPVGs1SURBdU16TTNOVEF5VERBdU16TTNOall5SURBdU5EVXdNemc1VERBdU5ERXlORFl5SURBdU5USTFNVGc1VERBdU16TTNOVEkwSURBdU5qWXlOamc1VERBdU5UY3dORFE1SURBdU9EazFOREE0U0RBdU5qZ3dOemt6UXpBdU5qazBOelF5SURBdU9EazBPVEk1SURBdU56QTRNekk0SURBdU9Ea3dPRE01SURBdU56SXdNakl5SURBdU9EZ3pOVE0yUXpBdU56TXlNVEUySURBdU9EYzJNak16SURBdU56UXhPVEV4SURBdU9EWTFPVFk0SURBdU56UTROalE1SURBdU9EVXpOelEyVERBdU9UQTFOakEySURBdU5UZ3dORFkwVERBdU5qWXlOVEEySURBdU16TTNNVFU0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalF4TnpRNU15QXdMalF6TkRneE5FZ3dMak00TXpFeE9GWXdMalUyT0RnM04wZ3dMalF4TnpRNU0xWXdMalF6TkRneE5Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk1UWTRNek1nTUM0ME1UZzBOVGRJTUM0MU9ESTBOVGhXTUM0MU5qZzBOamxJTUM0Mk1UWTRNek5XTUM0ME1UZzBOVGRhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVFkyTVRJeElEQXVNemd6TXpBeFNEQXVORE16TnpjM1ZqQXVOREUzTmpjMlNEQXVOVFkyTVRJeFZqQXVNemd6TXpBeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVMk5qRXlNU0F3TGpVNE1qVXlTREF1TkRNek56YzNWakF1TmpFMk9EazBTREF1TlRZMk1USXhWakF1TlRneU5USmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5EUTBPVFl4SURBdU16TTFNakExU0RBdU16UXhPRE0yUXpBdU16TTRNRE01SURBdU16TTFNakExSURBdU16TTBPVFl4SURBdU16TTRNamd6SURBdU16TTBPVFl4SURBdU16UXlNRGhXTUM0ME5EVXlNRFZETUM0ek16UTVOakVnTUM0ME5Ea3dNRElnTUM0ek16Z3dNemtnTUM0ME5USXdPQ0F3TGpNME1UZ3pOaUF3TGpRMU1qQTRTREF1TkRRME9UWXhRekF1TkRRNE56VTRJREF1TkRVeU1EZ2dNQzQwTlRFNE16WWdNQzQwTkRrd01ESWdNQzQwTlRFNE16WWdNQzQwTkRVeU1EVldNQzR6TkRJd09FTXdMalExTVRnek5pQXdMak16T0RJNE15QXdMalEwT0RjMU9DQXdMak16TlRJd05TQXdMalEwTkRrMk1TQXdMak16TlRJd05Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5UZ3dNelVnTUM0ek16VXlNRFZJTUM0MU5UUTVNVU13TGpVMU1URXhNeUF3TGpNek5USXdOU0F3TGpVME9EQXpOU0F3TGpNek9ESTRNeUF3TGpVME9EQXpOU0F3TGpNME1qQTRWakF1TkRRMU1qQTFRekF1TlRRNE1ETTFJREF1TkRRNU1EQXlJREF1TlRVeE1URXpJREF1TkRVeU1EZ2dNQzQxTlRRNU1TQXdMalExTWpBNFNEQXVOalU0TURNMVF6QXVOall4T0RNeUlEQXVORFV5TURnZ01DNDJOalE1TVNBd0xqUTBPVEF3TWlBd0xqWTJORGt4SURBdU5EUTFNakExVmpBdU16UXlNRGhETUM0Mk5qUTVNU0F3TGpNek9ESTRNeUF3TGpZMk1UZ3pNaUF3TGpNek5USXdOU0F3TGpZMU9EQXpOU0F3TGpNek5USXdOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDBORFE1TmpFZ01DNDFORGd6TkVnd0xqTTBNVGd6TmtNd0xqTXpPREF6T1NBd0xqVTBPRE0wSURBdU16TTBPVFl4SURBdU5UVXhOREU0SURBdU16TTBPVFl4SURBdU5UVTFNakUxVmpBdU5qVTRNelJETUM0ek16UTVOakVnTUM0Mk5qSXhNemNnTUM0ek16Z3dNemtnTUM0Mk5qVXlNVFVnTUM0ek5ERTRNellnTUM0Mk5qVXlNVFZJTUM0ME5EUTVOakZETUM0ME5EZzNOVGdnTUM0Mk5qVXlNVFVnTUM0ME5URTRNellnTUM0Mk5qSXhNemNnTUM0ME5URTRNellnTUM0Mk5UZ3pORll3TGpVMU5USXhOVU13TGpRMU1UZ3pOaUF3TGpVMU1UUXhPQ0F3TGpRME9EYzFPQ0F3TGpVME9ETTBJREF1TkRRME9UWXhJREF1TlRRNE16UmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qVTRNRE0xSURBdU5UUTRNelJJTUM0MU5UUTVNVU13TGpVMU1URXhNeUF3TGpVME9ETTBJREF1TlRRNE1ETTFJREF1TlRVeE5ERTRJREF1TlRRNE1ETTFJREF1TlRVMU1qRTFWakF1TmpVNE16UkRNQzQxTkRnd016VWdNQzQyTmpJeE16Y2dNQzQxTlRFeE1UTWdNQzQyTmpVeU1UVWdNQzQxTlRRNU1TQXdMalkyTlRJeE5VZ3dMalkxT0RBek5VTXdMalkyTVRnek1pQXdMalkyTlRJeE5TQXdMalkyTkRreElEQXVOall5TVRNM0lEQXVOalkwT1RFZ01DNDJOVGd6TkZZd0xqVTFOVEl4TlVNd0xqWTJORGt4SURBdU5UVXhOREU0SURBdU5qWXhPRE15SURBdU5UUTRNelFnTUM0Mk5UZ3dNelVnTUM0MU5EZ3pORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNVGswTmw4eU5UUXpOeUkrSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTUM0NE9DSWdhR1ZwWjJoMFBTSXdMamc0SWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d05UazVPVGMySURBdU1EWXdNRFU0TmlraUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4TDJSbFpuTStKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7c3Ryb2tlV2lkdGg9MTsiIGlkPSI3Ij48bXhDZWxsIHN0eWxlPSJpci5yZWY9YzRkNjNmZjEtOWJmZS00MThmLWJhNmQtMWQ4M2JjOWJkYmQ1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWxlZnQ7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMztzb3VyY2U9Y3VzdG9tO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUdPT0dMRS1DTE9VRC1WUEM7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjsiIHBhcmVudD0iMyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIxOSIgeT0iMjYiIHdpZHRoPSI1NTUiIGhlaWdodD0iNTI2IiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIxMyIgdmFsdWU9IlB1YmxpYyIgc3R5bGU9ImlyLnJlZj02Mzc2ZDUzZS02NDYxLTQxMmItOGUwNC03YjNmZTJiMzk3ZGU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjYiIHk9IjMwIiB3aWR0aD0iMjUyIiBoZWlnaHQ9IjQ2MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iQmFzdGlvbiBTZXJ2ZXIiIGlkPSIxMiI+PG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELUNPTVBVVEUtRU5HSU5FO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpJek5EaGZNak14TURBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVFl5TkV3d0xqYzBPRGN3TXlBd0xqRTBOVEUyTVVNd0xqYzBNVGt3TkNBd0xqRXpNekV3TXlBd0xqY3pNakEzTWlBd0xqRXlNekF6SURBdU56SXdNVGd5SURBdU1URTFPVE01UXpBdU56QTRNamt6SURBdU1UQTRPRFE1SURBdU5qazBOelUzSURBdU1UQTBPVGczSURBdU5qZ3dPVEUySURBdU1UQTBOek0yU0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBPVGdnTUM0eU9URTROREVnTUM0eE1EZzRNemtnTUM0eU56azVOU0F3TGpFeE5Ua3pRekF1TWpZNE1EVTVJREF1TVRJek1ESXhJREF1TWpVNE1qSTVJREF1TVRNek1EazRJREF1TWpVeE5ETTFJREF1TVRRMU1UWXhUREF1TURjd05UVXpNeUF3TGpRMU9EYzVPVU13TGpBMk16WTNOeklnTUM0ME56QTNOalFnTUM0d05qQXdOVGcySURBdU5EZzBNekl6SURBdU1EWXdNRFU0TmlBd0xqUTVPREV5TkVNd0xqQTJNREExT0RZZ01DNDFNVEU1TWpRZ01DNHdOak0yTnpjeUlEQXVOVEkxTkRneklEQXVNRGN3TlRVek15QXdMalV6TnpRME9Vd3dMakkxTVRNMk5pQXdMamcxTXpZNU9VTXdMakkxT0RBNU15QXdMamcyTlRrek15QXdMakkyTnpnM01TQXdMamczTmpJeE9DQXdMakkzT1RjME9TQXdMamc0TXpVMU5FTXdMakk1TVRZeU9DQXdMamc1TURnNU1TQXdMak13TlRJd01pQXdMamc1TlRBeU9TQXdMak14T1RFMU15QXdMamc1TlRVMk9FZ3dMalk0TURnME4wTXdMalk1TkRjNU5pQXdMamc1TlRBNE9TQXdMamN3T0RNNE1pQXdMamc1TURrNU9DQXdMamN5TURJM05pQXdMamc0TXpZNU5VTXdMamN6TWpFM0lEQXVPRGMyTXpreUlEQXVOelF4T1RZMUlEQXVPRFkyTVRJNElEQXVOelE0TnpBeklEQXVPRFV6T1RBMVREQXVPVEk1TlRFMklEQXVOVE01TkRRelF6QXVPVE0yTkRReUlEQXVOVEkzTWpneUlEQXVPVFF3TURnMElEQXVOVEV6TlRJNElEQXVPVFF3TURnMElEQXVORGs1TlRNelF6QXVPVFF3TURnMElEQXVORGcxTlRNNElEQXVPVE0yTkRReUlEQXVORGN4TnpnMUlEQXVPVEk1TlRFMklEQXVORFU1TmpJMFZqQXVORFU1TmpJMFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T0RjM05qSTBJREF1TmpJNU16WTRUREF1TlRnd01EYzBJREF1TXpNeE56UTVUREF1TlRVNE56WXlJREF1TXpjM09UUTVUREF1TlRFeU1qZzNJREF1TXpNeE5UUXpUREF1TkRrd09ETTNJREF1TXpjM05UTTNUREF1TkRRMU1EUTVJREF1TXpNeE5qaE1NQzQwTXpNMk16Y2dNQzR6T0RjeU0wd3dMak01TWpjNU9TQXdMak01TkRFd05Vd3dMak00TkRNME15QXdMalF6TURRd05Vd3dMak16TVRVME15QXdMalEwTXpBMU5Vd3dMak0zT0RnME15QXdMalE1TURNMU5Vd3dMak16TWpBeU5DQXdMalV4TURrNFREQXVNemM0T0RReklEQXVOVFUzTnprNVREQXVNek14TnpRNUlEQXVOVGM0TXpVMVREQXVOalE0TmpnM0lEQXVPRGsxTWprelNEQXVOamd3T0RZeVF6QXVOamswT0RFeElEQXVPRGswT0RFMElEQXVOekE0TXprMklEQXVPRGt3TnpJeklEQXVOekl3TWprZ01DNDRPRE0wTWpGRE1DNDNNekl4T0RVZ01DNDROell4TVRnZ01DNDNOREU1T0NBd0xqZzJOVGcxTXlBd0xqYzBPRGN4T0NBd0xqZzFNell6VERBdU9EYzNOakkwSURBdU5qSTVNelk0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalUwTURFek1pQXdMalExTWpZek4wZ3dMalEyTVRZNE9FTXdMalExT1RRNE55QXdMalExTWpZMU5TQXdMalExTnpNNE1pQXdMalExTXpVek55QXdMalExTlRneU5TQXdMalExTlRBNU0wTXdMalExTkRJMk9TQXdMalExTmpZME9TQXdMalExTXpNNE55QXdMalExT0RjMU5TQXdMalExTXpNMk9TQXdMalEyTURrMU5WWXdMalV6T1RNNU9VTXdMalExTXpNMk9TQXdMalUwTVRZeE1pQXdMalExTkRJME15QXdMalUwTXpjek5TQXdMalExTlRnd01TQXdMalUwTlRNd05rTXdMalExTnpNMklEQXVOVFEyT0RjM0lEQXVORFU1TkRjMUlEQXVOVFEzTnpZNUlEQXVORFl4TmpnNElEQXVOVFEzTnpnM1NEQXVOVFF3TVRNeVF6QXVOVFF5TWprMklEQXVOVFEzTmprNElEQXVOVFEwTXpReUlEQXVOVFEyTnpjMUlEQXVOVFExT0RReElEQXVOVFExTWpFeVF6QXVOVFEzTXpReElEQXVOVFF6TmpRNElEQXVOVFE0TVRjM0lEQXVOVFF4TlRZMUlEQXVOVFE0TVRjMUlEQXVOVE01TXprNVZqQXVORFl3T1RVMVF6QXVOVFE0TVRVM0lEQXVORFU0TnpVMUlEQXVOVFEzTWpjMUlEQXVORFUyTmpRNUlEQXVOVFExTnpFNUlEQXVORFUxTURrelF6QXVOVFEwTVRZeklEQXVORFV6TlRNM0lEQXVOVFF5TURVM0lEQXVORFV5TmpVMUlEQXVOVE01T0RVM0lEQXVORFV5TmpNM0lpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZME16UXhJREF1TkRRMk16VTRRekF1TmpZMU16TTNJREF1TkRRMk16YzNJREF1TmpZMk16STJJREF1TkRRMk1UazJJREF1TmpZM01qVXhJREF1TkRRMU9ESTRRekF1TmpZNE1UYzJJREF1TkRRMU5EWWdNQzQyTmprd01UZ2dNQzQwTkRRNU1URWdNQzQyTmprM01qa2dNQzQwTkRReU1UTkRNQzQyTnpBME16a2dNQzQwTkRNMU1UVWdNQzQyTnpFd01EUWdNQzQwTkRJMk9ETWdNQzQyTnpFek9Ea2dNQzQwTkRFM05qVkRNQzQyTnpFM056UWdNQzQwTkRBNE5EWWdNQzQyTnpFNU56SWdNQzQwTXprNE5qRWdNQzQyTnpFNU56SWdNQzQwTXpnNE5qVldNQzQwTWpZMk1qZERNQzQyTnpFNU56SWdNQzQwTWpRMk5DQXdMalkzTVRFNE15QXdMalF5TWpjek5DQXdMalkyT1RjM055QXdMalF5TVRNeU9FTXdMalkyT0RNM01pQXdMalF4T1RreU15QXdMalkyTmpRMk5pQXdMalF4T1RFek5DQXdMalkyTkRRM09TQXdMalF4T1RFek5FZ3dMall5TmpFNE5WWXdMak00TXpJME5rTXdMall5TmpFMk55QXdMak00TVRBME5TQXdMall5TlRJNE5TQXdMak0zT0RrMElEQXVOakl6TnpJNElEQXVNemMzTXpnMFF6QXVOakl5TVRjeUlEQXVNemMxT0RJM0lEQXVOakl3TURZM0lEQXVNemMwT1RRMUlEQXVOakUzT0RZMklEQXVNemMwT1RJM1NEQXVOVGd5TURRM1ZqQXVNek0yT0RSRE1DNDFPREl3TkRjZ01DNHpNelE0TlRJZ01DNDFPREV5TlRnZ01DNHpNekk1TkRZZ01DNDFOems0TlRJZ01DNHpNekUxTkRGRE1DNDFOemcwTkRjZ01DNHpNekF4TXpZZ01DNDFOelkxTkRFZ01DNHpNamt6TkRZZ01DNDFOelExTlRNZ01DNHpNamt6TkRaSU1DNDFOakl6TVRaRE1DNDFOakF6TnpjZ01DNHpNamswTVRjZ01DNDFOVGcxTkNBd0xqTXpNREl6T0NBd0xqVTFOekU1TkNBd0xqTXpNVFl6TmtNd0xqVTFOVGcwT0NBd0xqTXpNekF6TXlBd0xqVTFOVEE1TmlBd0xqTXpORGc1T1NBd0xqVTFOVEE1TnlBd0xqTXpOamcwVmpBdU16YzFNVE0wU0RBdU5URTBOVE0xVmpBdU16TTJPRFJETUM0MU1UUTFNelVnTUM0ek16VTROU0F3TGpVeE5ETXpPU0F3TGpNek5EZzNJREF1TlRFek9UVTRJREF1TXpNek9UVTJRekF1TlRFek5UYzNJREF1TXpNek1EUXlJREF1TlRFek1ERTVJREF1TXpNeU1qRXpJREF1TlRFeU16RTJJREF1TXpNeE5URTJRekF1TlRFeE5qRXlJREF1TXpNd09ESWdNQzQxTVRBM056Z2dNQzR6TXpBeU5qa2dNQzQxTURrNE5qRWdNQzR6TWprNE9UZERNQzQxTURnNU5EUWdNQzR6TWprMU1qUWdNQzQxTURjNU5qSWdNQzR6TWprek16Y2dNQzQxTURZNU56SWdNQzR6TWprek5EWklNQzQwT1RRNE56SkRNQzQwT1RJNE9EVWdNQzR6TWprek5EWWdNQzQwT1RBNU56a2dNQzR6TXpBeE16WWdNQzQwT0RrMU56TWdNQzR6TXpFMU5ERkRNQzQwT0RneE5qZ2dNQzR6TXpJNU5EWWdNQzQwT0Rjek56Z2dNQzR6TXpRNE5USWdNQzQwT0Rjek56Z2dNQzR6TXpZNE5GWXdMak0zTlRFek5FZ3dMalEwTnpBNU1WWXdMak16TmpnMFF6QXVORFEzTURreElEQXVNek0wT0RVeUlEQXVORFEyTXpBeElEQXVNek15T1RRMklEQXVORFEwT0RrMklEQXVNek14TlRReFF6QXVORFF6TkRreElEQXVNek13TVRNMklEQXVORFF4TlRnMUlEQXVNekk1TXpRMklEQXVORE01TlRrM0lEQXVNekk1TXpRMlNEQXVOREkzTXpaRE1DNDBNall6TnpZZ01DNHpNamt6TkRZZ01DNDBNalUwTURFZ01DNHpNamsxTkNBd0xqUXlORFE1TWlBd0xqTXlPVGt4TmtNd0xqUXlNelU0TXlBd0xqTXpNREk1TXlBd0xqUXlNamMxTnlBd0xqTXpNRGcwTlNBd0xqUXlNakEyTVNBd0xqTXpNVFUwTVVNd0xqUXlNVE0yTlNBd0xqTXpNakl6TnlBd0xqUXlNRGd4TXlBd0xqTXpNekEyTXlBd0xqUXlNRFF6TmlBd0xqTXpNemszTWtNd0xqUXlNREEySURBdU16TTBPRGd4SURBdU5ERTVPRFkySURBdU16TTFPRFUySURBdU5ERTVPRFkySURBdU16TTJPRFJXTUM0ek56VXhNelJJTUM0ek9EUXhNVFpETUM0ek9ERTVNemdnTUM0ek56VXhNeklnTUM0ek56azRORFlnTUM0ek56VTVOemdnTUM0ek56Z3lPQ0F3TGpNM056UTVNa013TGpNM05qY3hOU0F3TGpNM09UQXdOaUF3TGpNM05UZ2dNQzR6T0RFd055QXdMak0zTlRjeU9DQXdMak00TXpJME5sWXdMalF4T0RreU4wZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalF4T0RreU55QXdMak16TXpZM09TQXdMalF4T1RjeE55QXdMak16TWpJM015QXdMalF5TVRFeU1rTXdMak16TURnMk9DQXdMalF5TWpVeU55QXdMak16TURBM09DQXdMalF5TkRRek5DQXdMak16TURBM09DQXdMalF5TmpReU1WWXdMalF6T0RZMU9FTXdMak16TURBM09DQXdMalEwTURZME5pQXdMak16TURnMk9DQXdMalEwTWpVMU1pQXdMak16TWpJM015QXdMalEwTXprMU4wTXdMak16TXpZM09TQXdMalEwTlRNMk15QXdMak16TlRVNE5TQXdMalEwTmpFMU1pQXdMak16TnpVM01pQXdMalEwTmpFMU1rZ3dMak0zTlRjeU9GWXdMalE0TmpNM01VZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalE0TmpNM01TQXdMak16TXpZM09TQXdMalE0TnpFMklEQXVNek15TWpjeklEQXVORGc0TlRZMlF6QXVNek13T0RZNElEQXVORGc1T1RjeElEQXVNek13TURjNElEQXVORGt4T0RjM0lEQXVNek13TURjNElEQXVORGt6T0RZMVZqQXVOVEEyTXpBNFF6QXVNek13TURZNUlEQXVOVEEzTWprNElEQXVNek13TWpVMklEQXVOVEE0TWpnZ01DNHpNekEyTWprZ01DNDFNRGt4T1RkRE1DNHpNekV3TURJZ01DNDFNVEF4TVRRZ01DNHpNekUxTlRJZ01DNDFNVEE1TkRrZ01DNHpNekl5TkRrZ01DNDFNVEUyTlRKRE1DNHpNekk1TkRZZ01DNDFNVEl6TlRVZ01DNHpNek0zTnpVZ01DNDFNVEk1TVRNZ01DNHpNelEyT0RnZ01DNDFNVE15T1RSRE1DNHpNelUyTURJZ01DNDFNVE0yTnpVZ01DNHpNelkxT0RJZ01DNDFNVE00TnpFZ01DNHpNemMxTnpJZ01DNDFNVE00TnpGSU1DNHpOelUzTWpoV01DNDFOVFF4TlRoSU1DNHpNemMxTnpKRE1DNHpNelUxT0RVZ01DNDFOVFF4TlRnZ01DNHpNek0yTnprZ01DNDFOVFE1TkRnZ01DNHpNekl5TnpNZ01DNDFOVFl6TlRORE1DNHpNekE0TmpnZ01DNDFOVGMzTlRrZ01DNHpNekF3TnpnZ01DNDFOVGsyTmpVZ01DNHpNekF3TnpnZ01DNDFOakUyTlRKV01DNDFOek00T1VNd0xqTXpNREEzT0NBd0xqVTNOVGczTnlBd0xqTXpNRGcyT0NBd0xqVTNOemM0TXlBd0xqTXpNakkzTXlBd0xqVTNPVEU0T1VNd0xqTXpNelkzT1NBd0xqVTRNRFU1TkNBd0xqTXpOVFU0TlNBd0xqVTRNVE00TXlBd0xqTXpOelUzTWlBd0xqVTRNVE00TTBnd0xqTTNOVGN5T0ZZd0xqWXhOams1TmtNd0xqTTNOVGMwTmlBd0xqWXhPVEU1TnlBd0xqTTNOall5T1NBd0xqWXlNVE13TWlBd0xqTTNPREU0TlNBd0xqWXlNamcxT0VNd0xqTTNPVGMwTVNBd0xqWXlORFF4TlNBd0xqTTRNVGcwTmlBd0xqWXlOVEk1TnlBd0xqTTROREEwTnlBd0xqWXlOVE14TlVnd0xqUXhPVGcyTmxZd0xqWTJNell3T0VNd0xqUXhPVGcyTmlBd0xqWTJORFU1TXlBd0xqUXlNREEySURBdU5qWTFOVFkzSURBdU5ESXdORE0ySURBdU5qWTJORGMyUXpBdU5ESXdPREV6SURBdU5qWTNNemcxSURBdU5ESXhNelkxSURBdU5qWTRNakV4SURBdU5ESXlNRFl4SURBdU5qWTRPVEEzUXpBdU5ESXlOelUzSURBdU5qWTVOakF6SURBdU5ESXpOVGd6SURBdU5qY3dNVFUxSURBdU5ESTBORGt5SURBdU5qY3dOVE15UXpBdU5ESTFOREF4SURBdU5qY3dPVEE0SURBdU5ESTJNemMySURBdU5qY3hNVEF5SURBdU5ESTNNellnTUM0Mk56RXhNREpJTUM0ME16azFPVGRETUM0ME5EQTFPREVnTUM0Mk56RXhNRElnTUM0ME5ERTFOVFlnTUM0Mk56QTVNRGdnTUM0ME5ESTBOalVnTUM0Mk56QTFNekpETUM0ME5ETXpOelFnTUM0Mk56QXhOVFVnTUM0ME5EUXlJREF1TmpZNU5qQXpJREF1TkRRME9EazJJREF1TmpZNE9UQTNRekF1TkRRMU5Ua3lJREF1TmpZNE1qRXhJREF1TkRRMk1UUTBJREF1TmpZM016ZzFJREF1TkRRMk5USXhJREF1TmpZMk5EYzJRekF1TkRRMk9EazNJREF1TmpZMU5UWTNJREF1TkRRM01Ea3hJREF1TmpZME5Ua3pJREF1TkRRM01Ea3hJREF1TmpZek5qQTRWakF1TmpJMU16RTFTREF1TkRnM016YzRWakF1TmpZek5qQTRRekF1TkRnM016YzRJREF1TmpZMU5UazJJREF1TkRnNE1UWTRJREF1TmpZM05UQXlJREF1TkRnNU5UY3pJREF1TmpZNE9UQTNRekF1TkRrd09UYzVJREF1Tmpjd016RXpJREF1TkRreU9EZzFJREF1TmpjeE1UQXlJREF1TkRrME9EY3lJREF1TmpjeE1UQXlTREF1TlRBMk9UY3lRekF1TlRBNE9UWWdNQzQyTnpFeE1ESWdNQzQxTVRBNE5qWWdNQzQyTnpBek1UTWdNQzQxTVRJeU56RWdNQzQyTmpnNU1EZERNQzQxTVRNMk56WWdNQzQyTmpjMU1ESWdNQzQxTVRRME5qWWdNQzQyTmpVMU9UWWdNQzQxTVRRME5qWWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQxTlRVd09UZFdNQzQyTmpNMk1EaERNQzQxTlRVd09UY2dNQzQyTmpVMU9UWWdNQzQxTlRVNE9EY2dNQzQyTmpjMU1ESWdNQzQxTlRjeU9USWdNQzQyTmpnNU1EZERNQzQxTlRnMk9UY2dNQzQyTnpBek1UTWdNQzQxTmpBMk1ETWdNQzQyTnpFeE1ESWdNQzQxTmpJMU9URWdNQzQyTnpFeE1ESklNQzQxTnpRNE1qbERNQzQxTnpZNE1UWWdNQzQyTnpFeE1ESWdNQzQxTnpnM01qSWdNQzQyTnpBek1UTWdNQzQxT0RBeE1qY2dNQzQyTmpnNU1EZERNQzQxT0RFMU16TWdNQzQyTmpjMU1ESWdNQzQxT0RJek1qSWdNQzQyTmpVMU9UWWdNQzQxT0RJek1qSWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQyTVRneE5ERkRNQzQyTWpBeU9UUWdNQzQyTWpVeU1qWWdNQzQyTWpJek15QXdMall5TkRNeE15QXdMall5TXpneU55QXdMall5TWpjMk5VTXdMall5TlRNeU5TQXdMall5TVRJeE5pQXdMall5TmpFMk9TQXdMall4T1RFMUlEQXVOakkyTVRnMUlEQXVOakUyT1RrMlZqQXVOVGd4TXpFMVNEQXVOalkwTXpReFF6QXVOalkxTXpNM0lEQXVOVGd4TXpNeklEQXVOalkyTXpJMklEQXVOVGd4TVRVeklEQXVOalkzTWpVeElEQXVOVGd3TnpnMFF6QXVOalk0TVRjMklEQXVOVGd3TkRFMklEQXVOalk1TURFNElEQXVOVGM1T0RZM0lEQXVOalk1TnpJNUlEQXVOVGM1TVRZNVF6QXVOamN3TkRNNUlEQXVOVGM0TkRjeElEQXVOamN4TURBMElEQXVOVGMzTmpNNUlEQXVOamN4TXpnNUlEQXVOVGMyTnpJeFF6QXVOamN4TnpjMElEQXVOVGMxT0RBeklEQXVOamN4T1RjeUlEQXVOVGMwT0RFM0lEQXVOamN4T1RjeUlEQXVOVGN6T0RJeFZqQXVOVFl4TlRnelF6QXVOamN4T1RjeUlEQXVOVFU1TlRrMklEQXVOamN4TVRneklEQXVOVFUzTmprZ01DNDJOamszTnpjZ01DNDFOVFl5T0RWRE1DNDJOamd6TnpJZ01DNDFOVFE0TnprZ01DNDJOalkwTmpZZ01DNDFOVFF3T1NBd0xqWTJORFEzT1NBd0xqVTFOREE1U0RBdU5qSTJNVGcxVmpBdU5URXpPRGN4U0RBdU5qWTBNelF4UXpBdU5qWTFNelF5SURBdU5URXpPRGc1SURBdU5qWTJNek0zSURBdU5URXpOekEzSURBdU5qWTNNalkzSURBdU5URXpNek0wUXpBdU5qWTRNVGszSURBdU5URXlPVFl5SURBdU5qWTVNRFF5SURBdU5URXlOREEySURBdU5qWTVOelUwSURBdU5URXhOekF4UXpBdU5qY3dORFkxSURBdU5URXdPVGsySURBdU5qY3hNREk0SURBdU5URXdNVFUySURBdU5qY3hOREE1SURBdU5UQTVNak5ETUM0Mk56RTNPU0F3TGpVd09ETXdNeUF3TGpZM01UazRNaUF3TGpVd056TXhJREF1TmpjeE9UY3lJREF1TlRBMk16QTRWakF1TkRrME1UUkRNQzQyTnpJd01TQXdMalE1TXpFeU1TQXdMalkzTVRnek9TQXdMalE1TWpFd05TQXdMalkzTVRRM01TQXdMalE1TVRFMU5VTXdMalkzTVRFd01pQXdMalE1TURJd05TQXdMalkzTURVME5DQXdMalE0T1RNek9TQXdMalkyT1RneklEQXVORGc0TmpFeVF6QXVOalk1TVRFMUlEQXVORGczT0RnMUlEQXVOalk0TWpZZ01DNDBPRGN6TVRFZ01DNDJOamN6TVRZZ01DNDBPRFk1TWpaRE1DNDJOall6TnpNZ01DNDBPRFkxTkNBd0xqWTJOVE0ySURBdU5EZzJNelV5SURBdU5qWTBNelF4SURBdU5EZzJNemN4U0RBdU5qSTJNVGcxVmpBdU5EUTJNelU0U0RBdU5qWTBNelF4V2swd0xqVTVOems1TnlBd0xqVTVOell3T0Vnd0xqUXdNemcwTjFZd0xqUXdNekU0TkVnd0xqVTVOems1TjFZd0xqVTVOell3T0ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpNME9GOHlNekV3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDRPQ0lnYUdWcFoyaDBQU0l3TGpnNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOakF3TlRnMklEQXVNRFl3TURVNE5pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIucmVmPThjM2M3NDIwLTAyZDctNDljMi04ZWJlLTJkODgxM2I4NjI3MDsiIHBhcmVudD0iMTMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTQ1IiB5PSIxODUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iU0FQIFJvdXRlciIgaWQ9IjUiPjxteENlbGwgc3R5bGU9ImlyLnJlZj03ZTdkY2U4Zi04OTM5LTQ2NjQtYTYxNi0wMGFjNjJjMjA1MjU7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtR09PR0xFLUNMT1VELUNPTVBVVEUtRU5HSU5FO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpJek5EaGZNak14TURBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVFl5TkV3d0xqYzBPRGN3TXlBd0xqRTBOVEUyTVVNd0xqYzBNVGt3TkNBd0xqRXpNekV3TXlBd0xqY3pNakEzTWlBd0xqRXlNekF6SURBdU56SXdNVGd5SURBdU1URTFPVE01UXpBdU56QTRNamt6SURBdU1UQTRPRFE1SURBdU5qazBOelUzSURBdU1UQTBPVGczSURBdU5qZ3dPVEUySURBdU1UQTBOek0yU0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBPVGdnTUM0eU9URTROREVnTUM0eE1EZzRNemtnTUM0eU56azVOU0F3TGpFeE5Ua3pRekF1TWpZNE1EVTVJREF1TVRJek1ESXhJREF1TWpVNE1qSTVJREF1TVRNek1EazRJREF1TWpVeE5ETTFJREF1TVRRMU1UWXhUREF1TURjd05UVXpNeUF3TGpRMU9EYzVPVU13TGpBMk16WTNOeklnTUM0ME56QTNOalFnTUM0d05qQXdOVGcySURBdU5EZzBNekl6SURBdU1EWXdNRFU0TmlBd0xqUTVPREV5TkVNd0xqQTJNREExT0RZZ01DNDFNVEU1TWpRZ01DNHdOak0yTnpjeUlEQXVOVEkxTkRneklEQXVNRGN3TlRVek15QXdMalV6TnpRME9Vd3dMakkxTVRNMk5pQXdMamcxTXpZNU9VTXdMakkxT0RBNU15QXdMamcyTlRrek15QXdMakkyTnpnM01TQXdMamczTmpJeE9DQXdMakkzT1RjME9TQXdMamc0TXpVMU5FTXdMakk1TVRZeU9DQXdMamc1TURnNU1TQXdMak13TlRJd01pQXdMamc1TlRBeU9TQXdMak14T1RFMU15QXdMamc1TlRVMk9FZ3dMalk0TURnME4wTXdMalk1TkRjNU5pQXdMamc1TlRBNE9TQXdMamN3T0RNNE1pQXdMamc1TURrNU9DQXdMamN5TURJM05pQXdMamc0TXpZNU5VTXdMamN6TWpFM0lEQXVPRGMyTXpreUlEQXVOelF4T1RZMUlEQXVPRFkyTVRJNElEQXVOelE0TnpBeklEQXVPRFV6T1RBMVREQXVPVEk1TlRFMklEQXVOVE01TkRRelF6QXVPVE0yTkRReUlEQXVOVEkzTWpneUlEQXVPVFF3TURnMElEQXVOVEV6TlRJNElEQXVPVFF3TURnMElEQXVORGs1TlRNelF6QXVPVFF3TURnMElEQXVORGcxTlRNNElEQXVPVE0yTkRReUlEQXVORGN4TnpnMUlEQXVPVEk1TlRFMklEQXVORFU1TmpJMFZqQXVORFU1TmpJMFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T0RjM05qSTBJREF1TmpJNU16WTRUREF1TlRnd01EYzBJREF1TXpNeE56UTVUREF1TlRVNE56WXlJREF1TXpjM09UUTVUREF1TlRFeU1qZzNJREF1TXpNeE5UUXpUREF1TkRrd09ETTNJREF1TXpjM05UTTNUREF1TkRRMU1EUTVJREF1TXpNeE5qaE1NQzQwTXpNMk16Y2dNQzR6T0RjeU0wd3dMak01TWpjNU9TQXdMak01TkRFd05Vd3dMak00TkRNME15QXdMalF6TURRd05Vd3dMak16TVRVME15QXdMalEwTXpBMU5Vd3dMak0zT0RnME15QXdMalE1TURNMU5Vd3dMak16TWpBeU5DQXdMalV4TURrNFREQXVNemM0T0RReklEQXVOVFUzTnprNVREQXVNek14TnpRNUlEQXVOVGM0TXpVMVREQXVOalE0TmpnM0lEQXVPRGsxTWprelNEQXVOamd3T0RZeVF6QXVOamswT0RFeElEQXVPRGswT0RFMElEQXVOekE0TXprMklEQXVPRGt3TnpJeklEQXVOekl3TWprZ01DNDRPRE0wTWpGRE1DNDNNekl4T0RVZ01DNDROell4TVRnZ01DNDNOREU1T0NBd0xqZzJOVGcxTXlBd0xqYzBPRGN4T0NBd0xqZzFNell6VERBdU9EYzNOakkwSURBdU5qSTVNelk0V2lJZ1ptbHNiRDBpWW14aFkyc2lMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalUwTURFek1pQXdMalExTWpZek4wZ3dMalEyTVRZNE9FTXdMalExT1RRNE55QXdMalExTWpZMU5TQXdMalExTnpNNE1pQXdMalExTXpVek55QXdMalExTlRneU5TQXdMalExTlRBNU0wTXdMalExTkRJMk9TQXdMalExTmpZME9TQXdMalExTXpNNE55QXdMalExT0RjMU5TQXdMalExTXpNMk9TQXdMalEyTURrMU5WWXdMalV6T1RNNU9VTXdMalExTXpNMk9TQXdMalUwTVRZeE1pQXdMalExTkRJME15QXdMalUwTXpjek5TQXdMalExTlRnd01TQXdMalUwTlRNd05rTXdMalExTnpNMklEQXVOVFEyT0RjM0lEQXVORFU1TkRjMUlEQXVOVFEzTnpZNUlEQXVORFl4TmpnNElEQXVOVFEzTnpnM1NEQXVOVFF3TVRNeVF6QXVOVFF5TWprMklEQXVOVFEzTmprNElEQXVOVFEwTXpReUlEQXVOVFEyTnpjMUlEQXVOVFExT0RReElEQXVOVFExTWpFeVF6QXVOVFEzTXpReElEQXVOVFF6TmpRNElEQXVOVFE0TVRjM0lEQXVOVFF4TlRZMUlEQXVOVFE0TVRjMUlEQXVOVE01TXprNVZqQXVORFl3T1RVMVF6QXVOVFE0TVRVM0lEQXVORFU0TnpVMUlEQXVOVFEzTWpjMUlEQXVORFUyTmpRNUlEQXVOVFExTnpFNUlEQXVORFUxTURrelF6QXVOVFEwTVRZeklEQXVORFV6TlRNM0lEQXVOVFF5TURVM0lEQXVORFV5TmpVMUlEQXVOVE01T0RVM0lEQXVORFV5TmpNM0lpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpZME16UXhJREF1TkRRMk16VTRRekF1TmpZMU16TTNJREF1TkRRMk16YzNJREF1TmpZMk16STJJREF1TkRRMk1UazJJREF1TmpZM01qVXhJREF1TkRRMU9ESTRRekF1TmpZNE1UYzJJREF1TkRRMU5EWWdNQzQyTmprd01UZ2dNQzQwTkRRNU1URWdNQzQyTmprM01qa2dNQzQwTkRReU1UTkRNQzQyTnpBME16a2dNQzQwTkRNMU1UVWdNQzQyTnpFd01EUWdNQzQwTkRJMk9ETWdNQzQyTnpFek9Ea2dNQzQwTkRFM05qVkRNQzQyTnpFM056UWdNQzQwTkRBNE5EWWdNQzQyTnpFNU56SWdNQzQwTXprNE5qRWdNQzQyTnpFNU56SWdNQzQwTXpnNE5qVldNQzQwTWpZMk1qZERNQzQyTnpFNU56SWdNQzQwTWpRMk5DQXdMalkzTVRFNE15QXdMalF5TWpjek5DQXdMalkyT1RjM055QXdMalF5TVRNeU9FTXdMalkyT0RNM01pQXdMalF4T1RreU15QXdMalkyTmpRMk5pQXdMalF4T1RFek5DQXdMalkyTkRRM09TQXdMalF4T1RFek5FZ3dMall5TmpFNE5WWXdMak00TXpJME5rTXdMall5TmpFMk55QXdMak00TVRBME5TQXdMall5TlRJNE5TQXdMak0zT0RrMElEQXVOakl6TnpJNElEQXVNemMzTXpnMFF6QXVOakl5TVRjeUlEQXVNemMxT0RJM0lEQXVOakl3TURZM0lEQXVNemMwT1RRMUlEQXVOakUzT0RZMklEQXVNemMwT1RJM1NEQXVOVGd5TURRM1ZqQXVNek0yT0RSRE1DNDFPREl3TkRjZ01DNHpNelE0TlRJZ01DNDFPREV5TlRnZ01DNHpNekk1TkRZZ01DNDFOems0TlRJZ01DNHpNekUxTkRGRE1DNDFOemcwTkRjZ01DNHpNekF4TXpZZ01DNDFOelkxTkRFZ01DNHpNamt6TkRZZ01DNDFOelExTlRNZ01DNHpNamt6TkRaSU1DNDFOakl6TVRaRE1DNDFOakF6TnpjZ01DNHpNamswTVRjZ01DNDFOVGcxTkNBd0xqTXpNREl6T0NBd0xqVTFOekU1TkNBd0xqTXpNVFl6TmtNd0xqVTFOVGcwT0NBd0xqTXpNekF6TXlBd0xqVTFOVEE1TmlBd0xqTXpORGc1T1NBd0xqVTFOVEE1TnlBd0xqTXpOamcwVmpBdU16YzFNVE0wU0RBdU5URTBOVE0xVmpBdU16TTJPRFJETUM0MU1UUTFNelVnTUM0ek16VTROU0F3TGpVeE5ETXpPU0F3TGpNek5EZzNJREF1TlRFek9UVTRJREF1TXpNek9UVTJRekF1TlRFek5UYzNJREF1TXpNek1EUXlJREF1TlRFek1ERTVJREF1TXpNeU1qRXpJREF1TlRFeU16RTJJREF1TXpNeE5URTJRekF1TlRFeE5qRXlJREF1TXpNd09ESWdNQzQxTVRBM056Z2dNQzR6TXpBeU5qa2dNQzQxTURrNE5qRWdNQzR6TWprNE9UZERNQzQxTURnNU5EUWdNQzR6TWprMU1qUWdNQzQxTURjNU5qSWdNQzR6TWprek16Y2dNQzQxTURZNU56SWdNQzR6TWprek5EWklNQzQwT1RRNE56SkRNQzQwT1RJNE9EVWdNQzR6TWprek5EWWdNQzQwT1RBNU56a2dNQzR6TXpBeE16WWdNQzQwT0RrMU56TWdNQzR6TXpFMU5ERkRNQzQwT0RneE5qZ2dNQzR6TXpJNU5EWWdNQzQwT0Rjek56Z2dNQzR6TXpRNE5USWdNQzQwT0Rjek56Z2dNQzR6TXpZNE5GWXdMak0zTlRFek5FZ3dMalEwTnpBNU1WWXdMak16TmpnMFF6QXVORFEzTURreElEQXVNek0wT0RVeUlEQXVORFEyTXpBeElEQXVNek15T1RRMklEQXVORFEwT0RrMklEQXVNek14TlRReFF6QXVORFF6TkRreElEQXVNek13TVRNMklEQXVORFF4TlRnMUlEQXVNekk1TXpRMklEQXVORE01TlRrM0lEQXVNekk1TXpRMlNEQXVOREkzTXpaRE1DNDBNall6TnpZZ01DNHpNamt6TkRZZ01DNDBNalUwTURFZ01DNHpNamsxTkNBd0xqUXlORFE1TWlBd0xqTXlPVGt4TmtNd0xqUXlNelU0TXlBd0xqTXpNREk1TXlBd0xqUXlNamMxTnlBd0xqTXpNRGcwTlNBd0xqUXlNakEyTVNBd0xqTXpNVFUwTVVNd0xqUXlNVE0yTlNBd0xqTXpNakl6TnlBd0xqUXlNRGd4TXlBd0xqTXpNekEyTXlBd0xqUXlNRFF6TmlBd0xqTXpNemszTWtNd0xqUXlNREEySURBdU16TTBPRGd4SURBdU5ERTVPRFkySURBdU16TTFPRFUySURBdU5ERTVPRFkySURBdU16TTJPRFJXTUM0ek56VXhNelJJTUM0ek9EUXhNVFpETUM0ek9ERTVNemdnTUM0ek56VXhNeklnTUM0ek56azRORFlnTUM0ek56VTVOemdnTUM0ek56Z3lPQ0F3TGpNM056UTVNa013TGpNM05qY3hOU0F3TGpNM09UQXdOaUF3TGpNM05UZ2dNQzR6T0RFd055QXdMak0zTlRjeU9DQXdMak00TXpJME5sWXdMalF4T0RreU4wZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalF4T0RreU55QXdMak16TXpZM09TQXdMalF4T1RjeE55QXdMak16TWpJM015QXdMalF5TVRFeU1rTXdMak16TURnMk9DQXdMalF5TWpVeU55QXdMak16TURBM09DQXdMalF5TkRRek5DQXdMak16TURBM09DQXdMalF5TmpReU1WWXdMalF6T0RZMU9FTXdMak16TURBM09DQXdMalEwTURZME5pQXdMak16TURnMk9DQXdMalEwTWpVMU1pQXdMak16TWpJM015QXdMalEwTXprMU4wTXdMak16TXpZM09TQXdMalEwTlRNMk15QXdMak16TlRVNE5TQXdMalEwTmpFMU1pQXdMak16TnpVM01pQXdMalEwTmpFMU1rZ3dMak0zTlRjeU9GWXdMalE0TmpNM01VZ3dMak16TnpVM01rTXdMak16TlRVNE5TQXdMalE0TmpNM01TQXdMak16TXpZM09TQXdMalE0TnpFMklEQXVNek15TWpjeklEQXVORGc0TlRZMlF6QXVNek13T0RZNElEQXVORGc1T1RjeElEQXVNek13TURjNElEQXVORGt4T0RjM0lEQXVNek13TURjNElEQXVORGt6T0RZMVZqQXVOVEEyTXpBNFF6QXVNek13TURZNUlEQXVOVEEzTWprNElEQXVNek13TWpVMklEQXVOVEE0TWpnZ01DNHpNekEyTWprZ01DNDFNRGt4T1RkRE1DNHpNekV3TURJZ01DNDFNVEF4TVRRZ01DNHpNekUxTlRJZ01DNDFNVEE1TkRrZ01DNHpNekl5TkRrZ01DNDFNVEUyTlRKRE1DNHpNekk1TkRZZ01DNDFNVEl6TlRVZ01DNHpNek0zTnpVZ01DNDFNVEk1TVRNZ01DNHpNelEyT0RnZ01DNDFNVE15T1RSRE1DNHpNelUyTURJZ01DNDFNVE0yTnpVZ01DNHpNelkxT0RJZ01DNDFNVE00TnpFZ01DNHpNemMxTnpJZ01DNDFNVE00TnpGSU1DNHpOelUzTWpoV01DNDFOVFF4TlRoSU1DNHpNemMxTnpKRE1DNHpNelUxT0RVZ01DNDFOVFF4TlRnZ01DNHpNek0yTnprZ01DNDFOVFE1TkRnZ01DNHpNekl5TnpNZ01DNDFOVFl6TlRORE1DNHpNekE0TmpnZ01DNDFOVGMzTlRrZ01DNHpNekF3TnpnZ01DNDFOVGsyTmpVZ01DNHpNekF3TnpnZ01DNDFOakUyTlRKV01DNDFOek00T1VNd0xqTXpNREEzT0NBd0xqVTNOVGczTnlBd0xqTXpNRGcyT0NBd0xqVTNOemM0TXlBd0xqTXpNakkzTXlBd0xqVTNPVEU0T1VNd0xqTXpNelkzT1NBd0xqVTRNRFU1TkNBd0xqTXpOVFU0TlNBd0xqVTRNVE00TXlBd0xqTXpOelUzTWlBd0xqVTRNVE00TTBnd0xqTTNOVGN5T0ZZd0xqWXhOams1TmtNd0xqTTNOVGMwTmlBd0xqWXhPVEU1TnlBd0xqTTNOall5T1NBd0xqWXlNVE13TWlBd0xqTTNPREU0TlNBd0xqWXlNamcxT0VNd0xqTTNPVGMwTVNBd0xqWXlORFF4TlNBd0xqTTRNVGcwTmlBd0xqWXlOVEk1TnlBd0xqTTROREEwTnlBd0xqWXlOVE14TlVnd0xqUXhPVGcyTmxZd0xqWTJNell3T0VNd0xqUXhPVGcyTmlBd0xqWTJORFU1TXlBd0xqUXlNREEySURBdU5qWTFOVFkzSURBdU5ESXdORE0ySURBdU5qWTJORGMyUXpBdU5ESXdPREV6SURBdU5qWTNNemcxSURBdU5ESXhNelkxSURBdU5qWTRNakV4SURBdU5ESXlNRFl4SURBdU5qWTRPVEEzUXpBdU5ESXlOelUzSURBdU5qWTVOakF6SURBdU5ESXpOVGd6SURBdU5qY3dNVFUxSURBdU5ESTBORGt5SURBdU5qY3dOVE15UXpBdU5ESTFOREF4SURBdU5qY3dPVEE0SURBdU5ESTJNemMySURBdU5qY3hNVEF5SURBdU5ESTNNellnTUM0Mk56RXhNREpJTUM0ME16azFPVGRETUM0ME5EQTFPREVnTUM0Mk56RXhNRElnTUM0ME5ERTFOVFlnTUM0Mk56QTVNRGdnTUM0ME5ESTBOalVnTUM0Mk56QTFNekpETUM0ME5ETXpOelFnTUM0Mk56QXhOVFVnTUM0ME5EUXlJREF1TmpZNU5qQXpJREF1TkRRME9EazJJREF1TmpZNE9UQTNRekF1TkRRMU5Ua3lJREF1TmpZNE1qRXhJREF1TkRRMk1UUTBJREF1TmpZM016ZzFJREF1TkRRMk5USXhJREF1TmpZMk5EYzJRekF1TkRRMk9EazNJREF1TmpZMU5UWTNJREF1TkRRM01Ea3hJREF1TmpZME5Ua3pJREF1TkRRM01Ea3hJREF1TmpZek5qQTRWakF1TmpJMU16RTFTREF1TkRnM016YzRWakF1TmpZek5qQTRRekF1TkRnM016YzRJREF1TmpZMU5UazJJREF1TkRnNE1UWTRJREF1TmpZM05UQXlJREF1TkRnNU5UY3pJREF1TmpZNE9UQTNRekF1TkRrd09UYzVJREF1Tmpjd016RXpJREF1TkRreU9EZzFJREF1TmpjeE1UQXlJREF1TkRrME9EY3lJREF1TmpjeE1UQXlTREF1TlRBMk9UY3lRekF1TlRBNE9UWWdNQzQyTnpFeE1ESWdNQzQxTVRBNE5qWWdNQzQyTnpBek1UTWdNQzQxTVRJeU56RWdNQzQyTmpnNU1EZERNQzQxTVRNMk56WWdNQzQyTmpjMU1ESWdNQzQxTVRRME5qWWdNQzQyTmpVMU9UWWdNQzQxTVRRME5qWWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQxTlRVd09UZFdNQzQyTmpNMk1EaERNQzQxTlRVd09UY2dNQzQyTmpVMU9UWWdNQzQxTlRVNE9EY2dNQzQyTmpjMU1ESWdNQzQxTlRjeU9USWdNQzQyTmpnNU1EZERNQzQxTlRnMk9UY2dNQzQyTnpBek1UTWdNQzQxTmpBMk1ETWdNQzQyTnpFeE1ESWdNQzQxTmpJMU9URWdNQzQyTnpFeE1ESklNQzQxTnpRNE1qbERNQzQxTnpZNE1UWWdNQzQyTnpFeE1ESWdNQzQxTnpnM01qSWdNQzQyTnpBek1UTWdNQzQxT0RBeE1qY2dNQzQyTmpnNU1EZERNQzQxT0RFMU16TWdNQzQyTmpjMU1ESWdNQzQxT0RJek1qSWdNQzQyTmpVMU9UWWdNQzQxT0RJek1qSWdNQzQyTmpNMk1EaFdNQzQyTWpVek1UVklNQzQyTVRneE5ERkRNQzQyTWpBeU9UUWdNQzQyTWpVeU1qWWdNQzQyTWpJek15QXdMall5TkRNeE15QXdMall5TXpneU55QXdMall5TWpjMk5VTXdMall5TlRNeU5TQXdMall5TVRJeE5pQXdMall5TmpFMk9TQXdMall4T1RFMUlEQXVOakkyTVRnMUlEQXVOakUyT1RrMlZqQXVOVGd4TXpFMVNEQXVOalkwTXpReFF6QXVOalkxTXpNM0lEQXVOVGd4TXpNeklEQXVOalkyTXpJMklEQXVOVGd4TVRVeklEQXVOalkzTWpVeElEQXVOVGd3TnpnMFF6QXVOalk0TVRjMklEQXVOVGd3TkRFMklEQXVOalk1TURFNElEQXVOVGM1T0RZM0lEQXVOalk1TnpJNUlEQXVOVGM1TVRZNVF6QXVOamN3TkRNNUlEQXVOVGM0TkRjeElEQXVOamN4TURBMElEQXVOVGMzTmpNNUlEQXVOamN4TXpnNUlEQXVOVGMyTnpJeFF6QXVOamN4TnpjMElEQXVOVGMxT0RBeklEQXVOamN4T1RjeUlEQXVOVGMwT0RFM0lEQXVOamN4T1RjeUlEQXVOVGN6T0RJeFZqQXVOVFl4TlRnelF6QXVOamN4T1RjeUlEQXVOVFU1TlRrMklEQXVOamN4TVRneklEQXVOVFUzTmprZ01DNDJOamszTnpjZ01DNDFOVFl5T0RWRE1DNDJOamd6TnpJZ01DNDFOVFE0TnprZ01DNDJOalkwTmpZZ01DNDFOVFF3T1NBd0xqWTJORFEzT1NBd0xqVTFOREE1U0RBdU5qSTJNVGcxVmpBdU5URXpPRGN4U0RBdU5qWTBNelF4UXpBdU5qWTFNelF5SURBdU5URXpPRGc1SURBdU5qWTJNek0zSURBdU5URXpOekEzSURBdU5qWTNNalkzSURBdU5URXpNek0wUXpBdU5qWTRNVGszSURBdU5URXlPVFl5SURBdU5qWTVNRFF5SURBdU5URXlOREEySURBdU5qWTVOelUwSURBdU5URXhOekF4UXpBdU5qY3dORFkxSURBdU5URXdPVGsySURBdU5qY3hNREk0SURBdU5URXdNVFUySURBdU5qY3hOREE1SURBdU5UQTVNak5ETUM0Mk56RTNPU0F3TGpVd09ETXdNeUF3TGpZM01UazRNaUF3TGpVd056TXhJREF1TmpjeE9UY3lJREF1TlRBMk16QTRWakF1TkRrME1UUkRNQzQyTnpJd01TQXdMalE1TXpFeU1TQXdMalkzTVRnek9TQXdMalE1TWpFd05TQXdMalkzTVRRM01TQXdMalE1TVRFMU5VTXdMalkzTVRFd01pQXdMalE1TURJd05TQXdMalkzTURVME5DQXdMalE0T1RNek9TQXdMalkyT1RneklEQXVORGc0TmpFeVF6QXVOalk1TVRFMUlEQXVORGczT0RnMUlEQXVOalk0TWpZZ01DNDBPRGN6TVRFZ01DNDJOamN6TVRZZ01DNDBPRFk1TWpaRE1DNDJOall6TnpNZ01DNDBPRFkxTkNBd0xqWTJOVE0ySURBdU5EZzJNelV5SURBdU5qWTBNelF4SURBdU5EZzJNemN4U0RBdU5qSTJNVGcxVmpBdU5EUTJNelU0U0RBdU5qWTBNelF4V2swd0xqVTVOems1TnlBd0xqVTVOell3T0Vnd0xqUXdNemcwTjFZd0xqUXdNekU0TkVnd0xqVTVOems1TjFZd0xqVTVOell3T0ZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpNME9GOHlNekV3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDRPQ0lnYUdWcFoyaDBQU0l3TGpnNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOakF3TlRnMklEQXVNRFl3TURVNE5pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjEzIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjgxIiB5PSI0MCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48L29iamVjdD48bXhDZWxsIGlkPSIyNyIgdmFsdWU9IkdDUCBWUE4gLT4gQmFzdGlvbiBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9ODUzYWZlNTQtZGEwYS00MzI3LTgyMDgtMGRlNDY4OWViNjQ0O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMTMiIHNvdXJjZT0iNiIgdGFyZ2V0PSIxMiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJHQ1AgVlBOIiBzdHlsZT0iaXIucmVmPTE2NzYxYzQ3LWQyMTQtNDJjZS1iODllLThmYWM2ZTQzOWRlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1HT09HTEUtQ0xPVUQtVlBOO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3WHpFM09EQmZNalV3TXpZcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqa3lPVFV4TmlBd0xqUTFPVE00VERBdU56UTROekF6SURBdU1UUTBPVEUzUXpBdU56UXhPVEEwSURBdU1UTXlPRFU1SURBdU56TXlNRGN5SURBdU1USXlOemcySURBdU56SXdNVGd5SURBdU1URTFOamsxUXpBdU56QTRNamt6SURBdU1UQTROakExSURBdU5qazBOelUzSURBdU1UQTBOelF6SURBdU5qZ3dPVEUySURBdU1UQTBORGt5U0RBdU16RTVNakl5UXpBdU16QTFNemM1SURBdU1UQTBOek0ySURBdU1qa3hPRFF4SURBdU1UQTROVGsxSURBdU1qYzVPVFVnTUM0eE1UVTJPRFpETUM0eU5qZ3dOVGtnTUM0eE1qSTNOemNnTUM0eU5UZ3lNamtnTUM0eE16STROVFFnTUM0eU5URTBNelVnTUM0eE5EUTVNVGRNTUM0d056QTFOVE16SURBdU5EVTROamt5UXpBdU1EWXpOamMzTWlBd0xqUTNNRFkxT0NBd0xqQTJNREExT0RZZ01DNDBPRFF5TVRjZ01DNHdOakF3TlRnMklEQXVORGs0TURFM1F6QXVNRFl3TURVNE5pQXdMalV4TVRneE9DQXdMakEyTXpZM056SWdNQzQxTWpVek56Y2dNQzR3TnpBMU5UTXpJREF1TlRNM016UXlUREF1TWpVeE16WTJJREF1T0RVek5Ua3lRekF1TWpVNE1Ea3pJREF1T0RZMU9ESTJJREF1TWpZM09EY3hJREF1T0RjMk1URXhJREF1TWpjNU56UTVJREF1T0Rnek5EUTRRekF1TWpreE5qSTRJREF1T0Rrd056ZzBJREF1TXpBMU1qQXlJREF1T0RrME9USXpJREF1TXpFNU1UVXpJREF1T0RrMU5EWXhTREF1Tmpnd09EUTNRekF1TmprME56azJJREF1T0RrME9UZ3lJREF1TnpBNE16Z3lJREF1T0Rrd09Ea3hJREF1TnpJd01qYzJJREF1T0Rnek5UZzRRekF1TnpNeU1UY2dNQzQ0TnpZeU9EWWdNQzQzTkRFNU5qVWdNQzQ0TmpZd01qRWdNQzQzTkRnM01ETWdNQzQ0TlRNM09UaE1NQzQ1TWprMU1UWWdNQzQxTXprek16WkRNQzQ1TXpZME5qY2dNQzQxTWpjeE5Ua2dNQzQ1TkRBeE1qTWdNQzQxTVRNek56a2dNQzQ1TkRBeE1qTWdNQzQwT1Rrek5UaERNQzQ1TkRBeE1qTWdNQzQwT0RVek16WWdNQzQ1TXpZME5qY2dNQzQwTnpFMU5UY2dNQzQ1TWprMU1UWWdNQzQwTlRrek9GWXdMalExT1RNNFdpSWdabWxzYkQwaUl6UXlPRFZHTkNJdlBpWWplR0U3UEhCaGRHZ2diM0JoWTJsMGVUMGlNQzR3TnlJZ1pEMGlUVEF1T1RNNU9UWXpJREF1TkRrME1UY3pUREF1TmprNE16YzFJREF1TWpVeU9UTk1NQzQxT0RVME9EZ2dNQzR6TmpVMk1URk1NQzQyTkRJZ01DNDBNakl4TWpOV01DNDBPVFkxTVRGTU1DNDFPRFV3TURZZ01DNDFNRGMxTVRGTU1DNDFNemM1TVRNZ01DNDBOakEwTVRkTU1DNDBPRFUyTmpNZ01DNDBOVGMxTTB3d0xqUXlOVGN4TXlBd0xqVXdNalE1TWt3d0xqTTJOalExSURBdU5EUXpNak5NTUM0eU5UTTVNRFlnTUM0MU5UWXpNak5NTUM0MU9USTNOelVnTUM0NE9UVXlOakZJTUM0Mk9EQTNOelZETUM0Mk9UUTNNalFnTUM0NE9UUTNPRElnTUM0M01EZ3pNU0F3TGpnNU1EWTVNU0F3TGpjeU1ESXdOQ0F3TGpnNE16TTRPVU13TGpjek1qQTVPQ0F3TGpnM05qQTROaUF3TGpjME1UZzVNeUF3TGpnMk5UZ3lNU0F3TGpjME9EWXpNU0F3TGpnMU16VTVPRXd3TGpreU9UUTBOQ0F3TGpVek9URXpOa013TGprek56TXlNeUF3TGpVeU5UVXlJREF1T1RRd09UZzBJREF1TlRBNU9EY3lJREF1T1RNNU9UWXpJREF1TkRrME1UY3pWakF1TkRrME1UY3pXaUlnWm1sc2JEMGlZbXhoWTJzaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTBPRGs0TnlBd0xqUTRNalkyTmtnd0xqVTBORFUxTmxZd0xqVXhOekEwTVVnd0xqWTBPRGs0TjFZd0xqUTRNalkyTmxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyTlRreU5UTWdNQzR6TlRNM05rZ3dMall5TkRnM09GWXdMalkwTmpJeU1rZ3dMalkxT1RJMU0xWXdMak0xTXpjMldpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZNU16WTNNaUF3TGpZek16YzRPVWd3TGpVNU1EWXhOVU13TGpVNE5qZ3hPQ0F3TGpZek16YzRPU0F3TGpVNE16YzBJREF1TmpNMk9EWTNJREF1TlRnek56UWdNQzQyTkRBMk5qUldNQzQzTkRNM01rTXdMalU0TXpjMElEQXVOelEzTlRFM0lEQXVOVGcyT0RFNElEQXVOelV3TlRrMUlEQXVOVGt3TmpFMUlEQXVOelV3TlRrMVNEQXVOamt6TmpjeVF6QXVOamszTkRZNUlEQXVOelV3TlRrMUlEQXVOekF3TlRRM0lEQXVOelEzTlRFM0lEQXVOekF3TlRRM0lEQXVOelF6TnpKV01DNDJOREEyTmpSRE1DNDNNREExTkRjZ01DNDJNelk0TmpjZ01DNDJPVGMwTmprZ01DNDJNek0zT0RrZ01DNDJPVE0yTnpJZ01DNDJNek0zT0RsYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1Tmprek5qY3lJREF1TWpVd09UYzNTREF1TlRrd05qRTFRekF1TlRnMk9ERTRJREF1TWpVd09UYzNJREF1TlRnek56UWdNQzR5TlRRd05UVWdNQzQxT0RNM05DQXdMakkxTnpnMU1sWXdMak0yTURrd09FTXdMalU0TXpjMElEQXVNelkwTnpBMUlEQXVOVGcyT0RFNElEQXVNelkzTnpneklEQXVOVGt3TmpFMUlEQXVNelkzTnpnelNEQXVOamt6TmpjeVF6QXVOamszTkRZNUlEQXVNelkzTnpneklEQXVOekF3TlRRM0lEQXVNelkwTnpBMUlEQXVOekF3TlRRM0lEQXVNell3T1RBNFZqQXVNalUzT0RVeVF6QXVOekF3TlRRM0lEQXVNalUwTURVMUlEQXVOamszTkRZNUlEQXVNalV3T1RjM0lEQXVOamt6TmpjeUlEQXVNalV3T1RjM1dpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpRMU56Y3pOaUF3TGpRNE1qWTJOa2d3TGpNMU1EZ3pWakF1TlRFM01EUXhTREF1TkRVM056TTJWakF1TkRneU5qWTJXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTJNakF3TmlBd0xqUTBNVFF3Tmtnd0xqSTFPRGsxUXpBdU1qVTFNVFV6SURBdU5EUXhOREEySURBdU1qVXlNRGMxSURBdU5EUTBORGcwSURBdU1qVXlNRGMxSURBdU5EUTRNamd4VmpBdU5UVXhNek0zUXpBdU1qVXlNRGMxSURBdU5UVTFNVE0wSURBdU1qVTFNVFV6SURBdU5UVTRNakV5SURBdU1qVTRPVFVnTUM0MU5UZ3lNVEpJTUM0ek5qSXdNRFpETUM0ek5qVTRNRE1nTUM0MU5UZ3lNVElnTUM0ek5qZzRPREVnTUM0MU5UVXhNelFnTUM0ek5qZzRPREVnTUM0MU5URXpNemRXTUM0ME5EZ3lPREZETUM0ek5qZzRPREVnTUM0ME5EUTBPRFFnTUM0ek5qVTRNRE1nTUM0ME5ERTBNRFlnTUM0ek5qSXdNRFlnTUM0ME5ERTBNRFphSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOVEF3TURZNElEQXVOVFUxTURZNFF6QXVORGc1TVRrZ01DNDFOVFV3TmpnZ01DNDBOemcxTlRjZ01DNDFOVEU0TkRNZ01DNDBOamsxTVRJZ01DNDFORFUzT1RsRE1DNDBOakEwTmpjZ01DNDFNemszTlRZZ01DNDBOVE0wTVRnZ01DNDFNekV4TmpZZ01DNDBORGt5TlRVZ01DNDFNakV4TVRaRE1DNDBORFV3T1RJZ01DNDFNVEV3TmpZZ01DNDBORFF3TURNZ01DNDFNREF3TURjZ01DNDBORFl4TWpVZ01DNDBPRGt6TXpoRE1DNDBORGd5TkRjZ01DNDBOemcyTmprZ01DNDBOVE0wT0RZZ01DNDBOamc0TmprZ01DNDBOakV4TnpnZ01DNDBOakV4TnpoRE1DNDBOamc0TmprZ01DNDBOVE0wT0RZZ01DNDBOemcyTmprZ01DNDBORGd5TkRjZ01DNDBPRGt6TXpnZ01DNDBORFl4TWpWRE1DNDFNREF3TURjZ01DNDBORFF3TURNZ01DNDFNVEV3TmpZZ01DNDBORFV3T1RJZ01DNDFNakV4TVRZZ01DNDBORGt5TlRWRE1DNDFNekV4TmpZZ01DNDBOVE0wTVRnZ01DNDFNemszTlRZZ01DNDBOakEwTmpjZ01DNDFORFUzT1RrZ01DNDBOamsxTVRKRE1DNDFOVEU0TkRNZ01DNDBOemcxTlRjZ01DNDFOVFV3TmpnZ01DNDBPRGt4T1NBd0xqVTFOVEEyT0NBd0xqVXdNREEyT0VNd0xqVTFOVEEyT0NBd0xqVXhORFkxTlNBd0xqVTBPVEkzTkNBd0xqVXlPRFkwTlNBd0xqVXpPRGsxT1NBd0xqVXpPRGsxT1VNd0xqVXlPRFkwTlNBd0xqVTBPVEkzTkNBd0xqVXhORFkxTlNBd0xqVTFOVEEyT0NBd0xqVXdNREEyT0NBd0xqVTFOVEEyT0ZZd0xqVTFOVEEyT0ZwTk1DNDFNREF3TmpnZ01DNDBOalUyT1RORE1DNDBPVE15TnlBd0xqUTJOVFk1TXlBd0xqUTROall5TkNBd0xqUTJOemN3T1NBd0xqUTRNRGszTVNBd0xqUTNNVFE0TjBNd0xqUTNOVE14T0NBd0xqUTNOVEkyTkNBd0xqUTNNRGt4TWlBd0xqUTRNRFl6TWlBd0xqUTJPRE14SURBdU5EZzJPVEUwUXpBdU5EWTFOekE0SURBdU5Ea3pNVGsxSURBdU5EWTFNREk0SURBdU5UQXdNVEEzSURBdU5EWTJNelUwSURBdU5UQTJOemMxUXpBdU5EWTNOamdnTUM0MU1UTTBORE1nTUM0ME56QTVOVFFnTUM0MU1UazFOamdnTUM0ME56VTNOaklnTUM0MU1qUXpOelZETUM0ME9EQTFOamtnTUM0MU1qa3hPRE1nTUM0ME9EWTJPVFFnTUM0MU16STBOVFlnTUM0ME9UTXpOaklnTUM0MU16TTNPRE5ETUM0MU1EQXdNeUF3TGpVek5URXdPU0F3TGpVd05qazBNaUF3TGpVek5EUXlPU0F3TGpVeE16SXlNeUF3TGpVek1UZ3lOME13TGpVeE9UVXdOQ0F3TGpVeU9USXlOU0F3TGpVeU5EZzNNeUF3TGpVeU5EZ3hPU0F3TGpVeU9EWTFJREF1TlRFNU1UWTJRekF1TlRNeU5ESTNJREF1TlRFek5URXpJREF1TlRNME5EUXpJREF1TlRBMk9EWTNJREF1TlRNME5EUXpJREF1TlRBd01EWTRRekF1TlRNME5EUXpJREF1TkRrd09UVXlJREF1TlRNd09ESXlJREF1TkRneU1qQTRJREF1TlRJME16YzFJREF1TkRjMU56WXlRekF1TlRFM09USTVJREF1TkRZNU16RTFJREF1TlRBNU1UZzFJREF1TkRZMU5qa3pJREF1TlRBd01EWTRJREF1TkRZMU5qa3pXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01GOHhOemd3WHpJMU1ETTJJajRtSTNoaE96eHlaV04wSUhkcFpIUm9QU0l3TGpnNElpQm9aV2xuYUhROUlqQXVPRGdpSUdacGJHdzlJbmRvYVhSbElpQjBjbUZ1YzJadmNtMDlJblJ5WVc1emJHRjBaU2d3TGpBMk1EQTFPRFlnTUM0d05qQXdOVGcyS1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMTMiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMTkiIHk9IjE4NSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxMSIgdmFsdWU9IlByaXZhdGUgU2VjdXJlZCIgc3R5bGU9ImlyLnJlZj0yYWI0ZWZmYS00MGI3LTRjZDItYmE4MS04MjQ3ZDI5YTZmMmQ7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMzAzIiB5PSIyNyIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI0NjQiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI1IiB2YWx1ZT0iU0FQIENJICsgV0QgKyBIQU5BIC0+IEdDUCBTdG9yYWdlIiBzdHlsZT0iaXIucmVmPTYwNjA4NmMxLTA3Y2UtNGU5YS05NTY1LTZlNDA4NTVkMmZhZjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjExIiBzb3VyY2U9IjE0IiB0YXJnZXQ9IjE1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG9iamVjdCBsYWJlbD0iU0FQIENJICsgV0QgKyBIQU5BIiBpZD0iMTQiPjxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUdPT0dMRS1DTE9VRC1DT01QVVRFLUVOR0lORTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd1h6SXpORGhmTWpNeE1EQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMamt5T1RVeE5pQXdMalExT1RZeU5Fd3dMamMwT0Rjd015QXdMakUwTlRFMk1VTXdMamMwTVRrd05DQXdMakV6TXpFd015QXdMamN6TWpBM01pQXdMakV5TXpBeklEQXVOekl3TVRneUlEQXVNVEUxT1RNNVF6QXVOekE0TWpreklEQXVNVEE0T0RRNUlEQXVOamswTnpVM0lEQXVNVEEwT1RnM0lEQXVOamd3T1RFMklEQXVNVEEwTnpNMlNEQXVNekU1TWpJeVF6QXVNekExTXpjNUlEQXVNVEEwT1RnZ01DNHlPVEU0TkRFZ01DNHhNRGc0TXprZ01DNHlOems1TlNBd0xqRXhOVGt6UXpBdU1qWTRNRFU1SURBdU1USXpNREl4SURBdU1qVTRNakk1SURBdU1UTXpNRGs0SURBdU1qVXhORE0xSURBdU1UUTFNVFl4VERBdU1EY3dOVFV6TXlBd0xqUTFPRGM1T1VNd0xqQTJNelkzTnpJZ01DNDBOekEzTmpRZ01DNHdOakF3TlRnMklEQXVORGcwTXpJeklEQXVNRFl3TURVNE5pQXdMalE1T0RFeU5FTXdMakEyTURBMU9EWWdNQzQxTVRFNU1qUWdNQzR3TmpNMk56Y3lJREF1TlRJMU5EZ3pJREF1TURjd05UVXpNeUF3TGpVek56UTBPVXd3TGpJMU1UTTJOaUF3TGpnMU16WTVPVU13TGpJMU9EQTVNeUF3TGpnMk5Ua3pNeUF3TGpJMk56ZzNNU0F3TGpnM05qSXhPQ0F3TGpJM09UYzBPU0F3TGpnNE16VTFORU13TGpJNU1UWXlPQ0F3TGpnNU1EZzVNU0F3TGpNd05USXdNaUF3TGpnNU5UQXlPU0F3TGpNeE9URTFNeUF3TGpnNU5UVTJPRWd3TGpZNE1EZzBOME13TGpZNU5EYzVOaUF3TGpnNU5UQTRPU0F3TGpjd09ETTRNaUF3TGpnNU1EazVPQ0F3TGpjeU1ESTNOaUF3TGpnNE16WTVOVU13TGpjek1qRTNJREF1T0RjMk16a3lJREF1TnpReE9UWTFJREF1T0RZMk1USTRJREF1TnpRNE56QXpJREF1T0RVek9UQTFUREF1T1RJNU5URTJJREF1TlRNNU5EUXpRekF1T1RNMk5EUXlJREF1TlRJM01qZ3lJREF1T1RRd01EZzBJREF1TlRFek5USTRJREF1T1RRd01EZzBJREF1TkRrNU5UTXpRekF1T1RRd01EZzBJREF1TkRnMU5UTTRJREF1T1RNMk5EUXlJREF1TkRjeE56ZzFJREF1T1RJNU5URTJJREF1TkRVNU5qSTBWakF1TkRVNU5qSTBXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU9EYzNOakkwSURBdU5qSTVNelk0VERBdU5UZ3dNRGMwSURBdU16TXhOelE1VERBdU5UVTROell5SURBdU16YzNPVFE1VERBdU5URXlNamczSURBdU16TXhOVFF6VERBdU5Ea3dPRE0zSURBdU16YzNOVE0zVERBdU5EUTFNRFE1SURBdU16TXhOamhNTUM0ME16TTJNemNnTUM0ek9EY3lNMHd3TGpNNU1qYzVPU0F3TGpNNU5ERXdOVXd3TGpNNE5ETTBNeUF3TGpRek1EUXdOVXd3TGpNek1UVTBNeUF3TGpRME16QTFOVXd3TGpNM09EZzBNeUF3TGpRNU1ETTFOVXd3TGpNek1qQXlOQ0F3TGpVeE1EazRUREF1TXpjNE9EUXpJREF1TlRVM056azVUREF1TXpNeE56UTVJREF1TlRjNE16VTFUREF1TmpRNE5qZzNJREF1T0RrMU1qa3pTREF1Tmpnd09EWXlRekF1TmprME9ERXhJREF1T0RrME9ERTBJREF1TnpBNE16azJJREF1T0Rrd056SXpJREF1TnpJd01qa2dNQzQ0T0RNME1qRkRNQzQzTXpJeE9EVWdNQzQ0TnpZeE1UZ2dNQzQzTkRFNU9DQXdMamcyTlRnMU15QXdMamMwT0RjeE9DQXdMamcxTXpZelREQXVPRGMzTmpJMElEQXVOakk1TXpZNFdpSWdabWxzYkQwaVlteGhZMnNpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpVME1ERXpNaUF3TGpRMU1qWXpOMGd3TGpRMk1UWTRPRU13TGpRMU9UUTROeUF3TGpRMU1qWTFOU0F3TGpRMU56TTRNaUF3TGpRMU16VXpOeUF3TGpRMU5UZ3lOU0F3TGpRMU5UQTVNME13TGpRMU5ESTJPU0F3TGpRMU5qWTBPU0F3TGpRMU16TTROeUF3TGpRMU9EYzFOU0F3TGpRMU16TTJPU0F3TGpRMk1EazFOVll3TGpVek9UTTVPVU13TGpRMU16TTJPU0F3TGpVME1UWXhNaUF3TGpRMU5ESTBNeUF3TGpVME16Y3pOU0F3TGpRMU5UZ3dNU0F3TGpVME5UTXdOa013TGpRMU56TTJJREF1TlRRMk9EYzNJREF1TkRVNU5EYzFJREF1TlRRM056WTVJREF1TkRZeE5qZzRJREF1TlRRM056ZzNTREF1TlRRd01UTXlRekF1TlRReU1qazJJREF1TlRRM05qazRJREF1TlRRME16UXlJREF1TlRRMk56YzFJREF1TlRRMU9EUXhJREF1TlRRMU1qRXlRekF1TlRRM016UXhJREF1TlRRek5qUTRJREF1TlRRNE1UYzNJREF1TlRReE5UWTFJREF1TlRRNE1UYzFJREF1TlRNNU16azVWakF1TkRZd09UVTFRekF1TlRRNE1UVTNJREF1TkRVNE56VTFJREF1TlRRM01qYzFJREF1TkRVMk5qUTVJREF1TlRRMU56RTVJREF1TkRVMU1Ea3pRekF1TlRRME1UWXpJREF1TkRVek5UTTNJREF1TlRReU1EVTNJREF1TkRVeU5qVTFJREF1TlRNNU9EVTNJREF1TkRVeU5qTTNJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qWTBNelF4SURBdU5EUTJNelU0UXpBdU5qWTFNek0zSURBdU5EUTJNemMzSURBdU5qWTJNekkySURBdU5EUTJNVGsySURBdU5qWTNNalV4SURBdU5EUTFPREk0UXpBdU5qWTRNVGMySURBdU5EUTFORFlnTUM0Mk5qa3dNVGdnTUM0ME5EUTVNVEVnTUM0Mk5qazNNamtnTUM0ME5EUXlNVE5ETUM0Mk56QTBNemtnTUM0ME5ETTFNVFVnTUM0Mk56RXdNRFFnTUM0ME5ESTJPRE1nTUM0Mk56RXpPRGtnTUM0ME5ERTNOalZETUM0Mk56RTNOelFnTUM0ME5EQTRORFlnTUM0Mk56RTVOeklnTUM0ME16azROakVnTUM0Mk56RTVOeklnTUM0ME16ZzROalZXTUM0ME1qWTJNamRETUM0Mk56RTVOeklnTUM0ME1qUTJOQ0F3TGpZM01URTRNeUF3TGpReU1qY3pOQ0F3TGpZMk9UYzNOeUF3TGpReU1UTXlPRU13TGpZMk9ETTNNaUF3TGpReE9Ua3lNeUF3TGpZMk5qUTJOaUF3TGpReE9URXpOQ0F3TGpZMk5EUTNPU0F3TGpReE9URXpORWd3TGpZeU5qRTROVll3TGpNNE16STBOa013TGpZeU5qRTJOeUF3TGpNNE1UQTBOU0F3TGpZeU5USTROU0F3TGpNM09EazBJREF1TmpJek56STRJREF1TXpjM016ZzBRekF1TmpJeU1UY3lJREF1TXpjMU9ESTNJREF1TmpJd01EWTNJREF1TXpjME9UUTFJREF1TmpFM09EWTJJREF1TXpjME9USTNTREF1TlRneU1EUTNWakF1TXpNMk9EUkRNQzQxT0RJd05EY2dNQzR6TXpRNE5USWdNQzQxT0RFeU5UZ2dNQzR6TXpJNU5EWWdNQzQxTnprNE5USWdNQzR6TXpFMU5ERkRNQzQxTnpnME5EY2dNQzR6TXpBeE16WWdNQzQxTnpZMU5ERWdNQzR6TWprek5EWWdNQzQxTnpRMU5UTWdNQzR6TWprek5EWklNQzQxTmpJek1UWkRNQzQxTmpBek56Y2dNQzR6TWprME1UY2dNQzQxTlRnMU5DQXdMak16TURJek9DQXdMalUxTnpFNU5DQXdMak16TVRZek5rTXdMalUxTlRnME9DQXdMak16TXpBek15QXdMalUxTlRBNU5pQXdMak16TkRnNU9TQXdMalUxTlRBNU55QXdMak16TmpnMFZqQXVNemMxTVRNMFNEQXVOVEUwTlRNMVZqQXVNek0yT0RSRE1DNDFNVFExTXpVZ01DNHpNelU0TlNBd0xqVXhORE16T1NBd0xqTXpORGczSURBdU5URXpPVFU0SURBdU16TXpPVFUyUXpBdU5URXpOVGMzSURBdU16TXpNRFF5SURBdU5URXpNREU1SURBdU16TXlNakV6SURBdU5URXlNekUySURBdU16TXhOVEUyUXpBdU5URXhOakV5SURBdU16TXdPRElnTUM0MU1UQTNOemdnTUM0ek16QXlOamtnTUM0MU1EazROakVnTUM0ek1qazRPVGRETUM0MU1EZzVORFFnTUM0ek1qazFNalFnTUM0MU1EYzVOaklnTUM0ek1qa3pNemNnTUM0MU1EWTVOeklnTUM0ek1qa3pORFpJTUM0ME9UUTROekpETUM0ME9USTRPRFVnTUM0ek1qa3pORFlnTUM0ME9UQTVOemtnTUM0ek16QXhNellnTUM0ME9EazFOek1nTUM0ek16RTFOREZETUM0ME9EZ3hOamdnTUM0ek16STVORFlnTUM0ME9EY3pOemdnTUM0ek16UTROVElnTUM0ME9EY3pOemdnTUM0ek16WTRORll3TGpNM05URXpORWd3TGpRME56QTVNVll3TGpNek5qZzBRekF1TkRRM01Ea3hJREF1TXpNME9EVXlJREF1TkRRMk16QXhJREF1TXpNeU9UUTJJREF1TkRRME9EazJJREF1TXpNeE5UUXhRekF1TkRRek5Ea3hJREF1TXpNd01UTTJJREF1TkRReE5UZzFJREF1TXpJNU16UTJJREF1TkRNNU5UazNJREF1TXpJNU16UTJTREF1TkRJM016WkRNQzQwTWpZek56WWdNQzR6TWprek5EWWdNQzQwTWpVME1ERWdNQzR6TWprMU5DQXdMalF5TkRRNU1pQXdMak15T1RreE5rTXdMalF5TXpVNE15QXdMak16TURJNU15QXdMalF5TWpjMU55QXdMak16TURnME5TQXdMalF5TWpBMk1TQXdMak16TVRVME1VTXdMalF5TVRNMk5TQXdMak16TWpJek55QXdMalF5TURneE15QXdMak16TXpBMk15QXdMalF5TURRek5pQXdMak16TXprM01rTXdMalF5TURBMklEQXVNek0wT0RneElEQXVOREU1T0RZMklEQXVNek0xT0RVMklEQXVOREU1T0RZMklEQXVNek0yT0RSV01DNHpOelV4TXpSSU1DNHpPRFF4TVRaRE1DNHpPREU1TXpnZ01DNHpOelV4TXpJZ01DNHpOems0TkRZZ01DNHpOelU1TnpnZ01DNHpOemd5T0NBd0xqTTNOelE1TWtNd0xqTTNOamN4TlNBd0xqTTNPVEF3TmlBd0xqTTNOVGdnTUM0ek9ERXdOeUF3TGpNM05UY3lPQ0F3TGpNNE16STBObFl3TGpReE9Ea3lOMGd3TGpNek56VTNNa013TGpNek5UVTROU0F3TGpReE9Ea3lOeUF3TGpNek16WTNPU0F3TGpReE9UY3hOeUF3TGpNek1qSTNNeUF3TGpReU1URXlNa013TGpNek1EZzJPQ0F3TGpReU1qVXlOeUF3TGpNek1EQTNPQ0F3TGpReU5EUXpOQ0F3TGpNek1EQTNPQ0F3TGpReU5qUXlNVll3TGpRek9EWTFPRU13TGpNek1EQTNPQ0F3TGpRME1EWTBOaUF3TGpNek1EZzJPQ0F3TGpRME1qVTFNaUF3TGpNek1qSTNNeUF3TGpRME16azFOME13TGpNek16WTNPU0F3TGpRME5UTTJNeUF3TGpNek5UVTROU0F3TGpRME5qRTFNaUF3TGpNek56VTNNaUF3TGpRME5qRTFNa2d3TGpNM05UY3lPRll3TGpRNE5qTTNNVWd3TGpNek56VTNNa013TGpNek5UVTROU0F3TGpRNE5qTTNNU0F3TGpNek16WTNPU0F3TGpRNE56RTJJREF1TXpNeU1qY3pJREF1TkRnNE5UWTJRekF1TXpNd09EWTRJREF1TkRnNU9UY3hJREF1TXpNd01EYzRJREF1TkRreE9EYzNJREF1TXpNd01EYzRJREF1TkRrek9EWTFWakF1TlRBMk16QTRRekF1TXpNd01EWTVJREF1TlRBM01qazRJREF1TXpNd01qVTJJREF1TlRBNE1qZ2dNQzR6TXpBMk1qa2dNQzQxTURreE9UZERNQzR6TXpFd01ESWdNQzQxTVRBeE1UUWdNQzR6TXpFMU5USWdNQzQxTVRBNU5Ea2dNQzR6TXpJeU5Ea2dNQzQxTVRFMk5USkRNQzR6TXpJNU5EWWdNQzQxTVRJek5UVWdNQzR6TXpNM056VWdNQzQxTVRJNU1UTWdNQzR6TXpRMk9EZ2dNQzQxTVRNeU9UUkRNQzR6TXpVMk1ESWdNQzQxTVRNMk56VWdNQzR6TXpZMU9ESWdNQzQxTVRNNE56RWdNQzR6TXpjMU56SWdNQzQxTVRNNE56RklNQzR6TnpVM01qaFdNQzQxTlRReE5UaElNQzR6TXpjMU56SkRNQzR6TXpVMU9EVWdNQzQxTlRReE5UZ2dNQzR6TXpNMk56a2dNQzQxTlRRNU5EZ2dNQzR6TXpJeU56TWdNQzQxTlRZek5UTkRNQzR6TXpBNE5qZ2dNQzQxTlRjM05Ua2dNQzR6TXpBd056Z2dNQzQxTlRrMk5qVWdNQzR6TXpBd056Z2dNQzQxTmpFMk5USldNQzQxTnpNNE9VTXdMak16TURBM09DQXdMalUzTlRnM055QXdMak16TURnMk9DQXdMalUzTnpjNE15QXdMak16TWpJM015QXdMalUzT1RFNE9VTXdMak16TXpZM09TQXdMalU0TURVNU5DQXdMak16TlRVNE5TQXdMalU0TVRNNE15QXdMak16TnpVM01pQXdMalU0TVRNNE0wZ3dMak0zTlRjeU9GWXdMall4TmprNU5rTXdMak0zTlRjME5pQXdMall4T1RFNU55QXdMak0zTmpZeU9TQXdMall5TVRNd01pQXdMak0zT0RFNE5TQXdMall5TWpnMU9FTXdMak0zT1RjME1TQXdMall5TkRReE5TQXdMak00TVRnME5pQXdMall5TlRJNU55QXdMak00TkRBME55QXdMall5TlRNeE5VZ3dMalF4T1RnMk5sWXdMalkyTXpZd09FTXdMalF4T1RnMk5pQXdMalkyTkRVNU15QXdMalF5TURBMklEQXVOalkxTlRZM0lEQXVOREl3TkRNMklEQXVOalkyTkRjMlF6QXVOREl3T0RFeklEQXVOalkzTXpnMUlEQXVOREl4TXpZMUlEQXVOalk0TWpFeElEQXVOREl5TURZeElEQXVOalk0T1RBM1F6QXVOREl5TnpVM0lEQXVOalk1TmpBeklEQXVOREl6TlRneklEQXVOamN3TVRVMUlEQXVOREkwTkRreUlEQXVOamN3TlRNeVF6QXVOREkxTkRBeElEQXVOamN3T1RBNElEQXVOREkyTXpjMklEQXVOamN4TVRBeUlEQXVOREkzTXpZZ01DNDJOekV4TURKSU1DNDBNemsxT1RkRE1DNDBOREExT0RFZ01DNDJOekV4TURJZ01DNDBOREUxTlRZZ01DNDJOekE1TURnZ01DNDBOREkwTmpVZ01DNDJOekExTXpKRE1DNDBORE16TnpRZ01DNDJOekF4TlRVZ01DNDBORFF5SURBdU5qWTVOakF6SURBdU5EUTBPRGsySURBdU5qWTRPVEEzUXpBdU5EUTFOVGt5SURBdU5qWTRNakV4SURBdU5EUTJNVFEwSURBdU5qWTNNemcxSURBdU5EUTJOVEl4SURBdU5qWTJORGMyUXpBdU5EUTJPRGszSURBdU5qWTFOVFkzSURBdU5EUTNNRGt4SURBdU5qWTBOVGt6SURBdU5EUTNNRGt4SURBdU5qWXpOakE0VmpBdU5qSTFNekUxU0RBdU5EZzNNemM0VmpBdU5qWXpOakE0UXpBdU5EZzNNemM0SURBdU5qWTFOVGsySURBdU5EZzRNVFk0SURBdU5qWTNOVEF5SURBdU5EZzVOVGN6SURBdU5qWTRPVEEzUXpBdU5Ea3dPVGM1SURBdU5qY3dNekV6SURBdU5Ea3lPRGcxSURBdU5qY3hNVEF5SURBdU5EazBPRGN5SURBdU5qY3hNVEF5U0RBdU5UQTJPVGN5UXpBdU5UQTRPVFlnTUM0Mk56RXhNRElnTUM0MU1UQTROallnTUM0Mk56QXpNVE1nTUM0MU1USXlOekVnTUM0Mk5qZzVNRGRETUM0MU1UTTJOellnTUM0Mk5qYzFNRElnTUM0MU1UUTBOallnTUM0Mk5qVTFPVFlnTUM0MU1UUTBOallnTUM0Mk5qTTJNRGhXTUM0Mk1qVXpNVFZJTUM0MU5UVXdPVGRXTUM0Mk5qTTJNRGhETUM0MU5UVXdPVGNnTUM0Mk5qVTFPVFlnTUM0MU5UVTRPRGNnTUM0Mk5qYzFNRElnTUM0MU5UY3lPVElnTUM0Mk5qZzVNRGRETUM0MU5UZzJPVGNnTUM0Mk56QXpNVE1nTUM0MU5qQTJNRE1nTUM0Mk56RXhNRElnTUM0MU5qSTFPVEVnTUM0Mk56RXhNREpJTUM0MU56UTRNamxETUM0MU56WTRNVFlnTUM0Mk56RXhNRElnTUM0MU56ZzNNaklnTUM0Mk56QXpNVE1nTUM0MU9EQXhNamNnTUM0Mk5qZzVNRGRETUM0MU9ERTFNek1nTUM0Mk5qYzFNRElnTUM0MU9ESXpNaklnTUM0Mk5qVTFPVFlnTUM0MU9ESXpNaklnTUM0Mk5qTTJNRGhXTUM0Mk1qVXpNVFZJTUM0Mk1UZ3hOREZETUM0Mk1qQXlPVFFnTUM0Mk1qVXlNallnTUM0Mk1qSXpNeUF3TGpZeU5ETXhNeUF3TGpZeU16Z3lOeUF3TGpZeU1qYzJOVU13TGpZeU5UTXlOU0F3TGpZeU1USXhOaUF3TGpZeU5qRTJPU0F3TGpZeE9URTFJREF1TmpJMk1UZzFJREF1TmpFMk9UazJWakF1TlRneE16RTFTREF1TmpZME16UXhRekF1TmpZMU16TTNJREF1TlRneE16TXpJREF1TmpZMk16STJJREF1TlRneE1UVXpJREF1TmpZM01qVXhJREF1TlRnd056ZzBRekF1TmpZNE1UYzJJREF1TlRnd05ERTJJREF1TmpZNU1ERTRJREF1TlRjNU9EWTNJREF1TmpZNU56STVJREF1TlRjNU1UWTVRekF1Tmpjd05ETTVJREF1TlRjNE5EY3hJREF1TmpjeE1EQTBJREF1TlRjM05qTTVJREF1TmpjeE16ZzVJREF1TlRjMk56SXhRekF1TmpjeE56YzBJREF1TlRjMU9EQXpJREF1TmpjeE9UY3lJREF1TlRjME9ERTNJREF1TmpjeE9UY3lJREF1TlRjek9ESXhWakF1TlRZeE5UZ3pRekF1TmpjeE9UY3lJREF1TlRVNU5UazJJREF1TmpjeE1UZ3pJREF1TlRVM05qa2dNQzQyTmprM056Y2dNQzQxTlRZeU9EVkRNQzQyTmpnek56SWdNQzQxTlRRNE56a2dNQzQyTmpZME5qWWdNQzQxTlRRd09TQXdMalkyTkRRM09TQXdMalUxTkRBNVNEQXVOakkyTVRnMVZqQXVOVEV6T0RjeFNEQXVOalkwTXpReFF6QXVOalkxTXpReUlEQXVOVEV6T0RnNUlEQXVOalkyTXpNM0lEQXVOVEV6TnpBM0lEQXVOalkzTWpZM0lEQXVOVEV6TXpNMFF6QXVOalk0TVRrM0lEQXVOVEV5T1RZeUlEQXVOalk1TURReUlEQXVOVEV5TkRBMklEQXVOalk1TnpVMElEQXVOVEV4TnpBeFF6QXVOamN3TkRZMUlEQXVOVEV3T1RrMklEQXVOamN4TURJNElEQXVOVEV3TVRVMklEQXVOamN4TkRBNUlEQXVOVEE1TWpORE1DNDJOekUzT1NBd0xqVXdPRE13TXlBd0xqWTNNVGs0TWlBd0xqVXdOek14SURBdU5qY3hPVGN5SURBdU5UQTJNekE0VmpBdU5EazBNVFJETUM0Mk56SXdNU0F3TGpRNU16RXlNU0F3TGpZM01UZ3pPU0F3TGpRNU1qRXdOU0F3TGpZM01UUTNNU0F3TGpRNU1URTFOVU13TGpZM01URXdNaUF3TGpRNU1ESXdOU0F3TGpZM01EVTBOQ0F3TGpRNE9UTXpPU0F3TGpZMk9UZ3pJREF1TkRnNE5qRXlRekF1TmpZNU1URTFJREF1TkRnM09EZzFJREF1TmpZNE1qWWdNQzQwT0Rjek1URWdNQzQyTmpjek1UWWdNQzQwT0RZNU1qWkRNQzQyTmpZek56TWdNQzQwT0RZMU5DQXdMalkyTlRNMklEQXVORGcyTXpVeUlEQXVOalkwTXpReElEQXVORGcyTXpjeFNEQXVOakkyTVRnMVZqQXVORFEyTXpVNFNEQXVOalkwTXpReFdrMHdMalU1TnprNU55QXdMalU1TnpZd09FZ3dMalF3TXpnME4xWXdMalF3TXpFNE5FZ3dMalU1TnprNU4xWXdMalU1TnpZd09Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qTTBPRjh5TXpFd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ0T0NJZ2FHVnBaMmgwUFNJd0xqZzRJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpBd05UZzJJREF1TURZd01EVTROaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnJlZj0zNGMxODlhOS0xODgyLTQ5NzctOTk1MS00OGYwYjY1MjIxYWI7IiBwYXJlbnQ9IjExIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjcwIiB5PSIxMDUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9vYmplY3Q+PG9iamVjdCBsYWJlbD0iR0NQIFN0b3JhZ2UiIGlkPSIxNSI+PG14Q2VsbCBzdHlsZT0iaXIucmVmPTkwNzI5NDJkLTE0YTAtNDViNi04MzY4LThkNjAyOTAxZmU4MDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1nb29nbGUtc3RvcmFnZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBd0tTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDVPRGd6TWpVZ01DNDBOakkxTUROTU1DNDNPRFl3TVRjZ01DNHhNVEEyTmtNd0xqYzNPRFF3T1NBd0xqQTVOekUyT0RJZ01DNDNOamMwTURnZ01DNHdPRFU0T1RjM0lEQXVOelUwTVRBMUlEQXVNRGMzT1RZME5FTXdMamMwTURnd01pQXdMakEzTURBek1URWdNQzQzTWpVMk5UY2dNQzR3TmpVM01UQXpJREF1TnpFd01UY2dNQzR3TmpVME1qazNTREF1TXpBMU5EYzNRekF1TWpnNU9UZzVJREF1TURZMU56QXlOaUF3TGpJM05EZzBNU0F3TGpBM01EQXlNRE1nTUM0eU5qRTFNellnTUM0d056YzVOVFF6UXpBdU1qUTRNak15SURBdU1EZzFPRGc0TkNBd0xqSXpOekl6TXlBd0xqQTVOekUyTXpFZ01DNHlNamsyTXpFZ01DNHhNVEEyTmt3d0xqQXlOekkwTlRNZ01DNDBOakUxT0VNd0xqQXhPVFUxTVRjZ01DNDBOelE1TmpjZ01DNHdNVFUxTURJNUlEQXVORGt3TVRNNElEQXVNREUxTlRBeU9TQXdMalV3TlRVM09VTXdMakF4TlRVd01qa2dNQzQxTWpFd01pQXdMakF4T1RVMU1UY2dNQzQxTXpZeE9URWdNQzR3TWpjeU5EVXpJREF1TlRRNU5UYzVUREF1TWpJNU5UVTBJREF1T1RBek5ESXlRekF1TWpNM01EZ3hJREF1T1RFM01URWdNQzR5TkRnd01qRWdNQzQ1TWpnMk1UZ2dNQzR5TmpFek1USWdNQzQ1TXpZNE1qWkRNQzR5TnpRMk1ESWdNQzQ1TkRVd016VWdNQzR5T0RrM09TQXdMamswT1RZMk5TQXdMak13TlRRZ01DNDVOVEF5TmpkSU1DNDNNVEF3T1RSRE1DNDNNalUzTURFZ01DNDVORGszTXpJZ01DNDNOREE1TURJZ01DNDVORFV4TlRVZ01DNDNOVFF5TVNBd0xqa3pOams0TkVNd0xqYzJOelV4T0NBd0xqa3lPRGd4TXlBd0xqYzNPRFEzTnlBd0xqa3hOek15T0NBd0xqYzROakF4TnlBd0xqa3dNelkxTTB3d0xqazRPRE15TlNBd0xqVTFNVGd4UXpBdU9UazJNRGMwSURBdU5UTTRNakF6SURFdU1EQXdNVFVnTUM0MU1qSTRNVFVnTVM0d01EQXhOU0F3TGpVd056RTFOa014TGpBd01ERTFJREF1TkRreE5EazRJREF1T1RrMk1EYzBJREF1TkRjMk1UQTVJREF1T1RnNE16STFJREF1TkRZeU5UQXpWakF1TkRZeU5UQXpXaUlnWm1sc2JEMGlJelF5T0RWR05DSXZQaVlqZUdFN1BIQmhkR2dnYjNCaFkybDBlVDBpTUM0d055SWdaRDBpVFRBdU5qY3lPVGMwSURBdU5EQTBNamszVERBdU16azBOalkySURBdU5ESTVPVEV5VERBdU16UXdPRElnTUM0ME9ETTNOVGhNTUM0ek9EWTVOelFnTUM0MU1qazVNVEZNTUM0ek5ERXlNRFVnTUM0Mk1UQXdOalJNTUM0Mk9ERXlNRFVnTUM0NU5UQXdOakZJTUM0M01EazVOelJETUM0M01qVTFPREVnTUM0NU5EazFNalVnTUM0M05EQTNPRElnTUM0NU5EUTVORGdnTUM0M05UUXdPU0F3TGprek5qYzNOME13TGpjMk56TTVPQ0F3TGpreU9EWXdOeUF3TGpjM09ETTFPQ0F3TGpreE56RXlNaUF3TGpjNE5UZzVOeUF3TGprd016UTBOa3d3TGpreU5qZzVOeUF3TGpZMU9ESXhPRXd3TGpZM01qazNOQ0F3TGpRd05ESTVOMW9pSUdacGJHdzlJbUpzWVdOcklpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOalk0TkNBd0xqUXdNakV3TlVnd0xqTTBPREEzTVVNd0xqTTBOamd5SURBdU5EQXlNRFkwSURBdU16UTFOVGN5SURBdU5EQXlNamN6SURBdU16UTBOREF6SURBdU5EQXlOekl5UXpBdU16UXpNak0wSURBdU5EQXpNVGNnTUM0ek5ESXhOallnTUM0ME1ETTRORGdnTUM0ek5ERXlOak1nTUM0ME1EUTNNVFZETUM0ek5EQXpOaUF3TGpRd05UVTRNeUF3TGpNek9UWXpPU0F3TGpRd05qWXlNaUF3TGpNek9URTBOQ0F3TGpRd056YzNNa013TGpNek9EWTBPU0F3TGpRd09Ea3lNaUF3TGpNek9ETTRPQ0F3TGpReE1ERTJJREF1TXpNNE16YzVJREF1TkRFeE5ERXlWakF1TkRjM016TTFRekF1TXpNNE16YzVJREF1TkRjNU9EQXpJREF1TXpNNU16WWdNQzQwT0RJeE56RWdNQzR6TkRFeE1EVWdNQzQwT0RNNU1UWkRNQzR6TkRJNE5URWdNQzQwT0RVMk5qSWdNQzR6TkRVeU1UZ2dNQzQwT0RZMk5ESWdNQzR6TkRjMk9EY2dNQzQwT0RZMk5ESklNQzQyTmpZNE5FTXdMalkyT1RNd015QXdMalE0TmpZeU1pQXdMalkzTVRZMU9TQXdMalE0TlRZek5TQXdMalkzTXpRZ01DNDBPRE00T1RSRE1DNDJOelV4TkRFZ01DNDBPREl4TlRNZ01DNDJOell4TWpnZ01DNDBOemszT1RjZ01DNDJOell4TkRnZ01DNDBOemN6TXpWV01DNDBNVEUwTVRKRE1DNDJOell4TWpnZ01DNDBNRGc1TlNBd0xqWTNOVEUwTVNBd0xqUXdOalU1TkNBd0xqWTNNelFnTUM0ME1EUTROVE5ETUM0Mk56RTJOVGtnTUM0ME1ETXhNVElnTUM0Mk5qa3pNRE1nTUM0ME1ESXhNalVnTUM0Mk5qWTROQ0F3TGpRd01qRXdOVll3TGpRd01qRXdOVnBOTUM0Mk1UYzFNek1nTUM0ME5qTTJORE5ETUM0Mk1UTTNOaUF3TGpRMk16WTBNeUF3TGpZeE1EQTNNU0F3TGpRMk1qVXlOQ0F3TGpZd05qa3pOQ0F3TGpRMk1EUXlPRU13TGpZd016YzVOeUF3TGpRMU9ETXpNU0F3TGpZd01UTTFNaUF3TGpRMU5UTTFNaUF3TGpVNU9Ua3dPQ0F3TGpRMU1UZzJOa013TGpVNU9EUTJOQ0F3TGpRME9ETTRJREF1TlRrNE1EZzJJREF1TkRRME5UUTFJREF1TlRrNE9ESXlJREF1TkRRd09EUTBRekF1TlRrNU5UVTRJREF1TkRNM01UUTBJREF1TmpBeE16YzFJREF1TkRNek56UTBJREF1TmpBME1EUXpJREF1TkRNeE1EYzNRekF1TmpBMk56RXhJREF1TkRJNE5EQTVJREF1TmpFd01URWdNQzQwTWpZMU9USWdNQzQyTVRNNE1URWdNQzQwTWpVNE5UWkRNQzQyTVRjMU1USWdNQzQwTWpVeE1pQXdMall5TVRNME55QXdMalF5TlRRNU55QXdMall5TkRnek15QXdMalF5TmprME1VTXdMall5T0RNeE9TQXdMalF5T0RNNE5TQXdMall6TVRJNU9DQXdMalF6TURneklEQXVOak16TXprMUlEQXVORE16T1RZM1F6QXVOak0xTkRreElEQXVORE0zTVRBMElEQXVOak0yTmpFZ01DNDBOREEzT1RNZ01DNDJNelkyTVNBd0xqUTBORFUyTmtNd0xqWXpOall4SURBdU5EUTNNRGN4SURBdU5qTTJNVEUySURBdU5EUTVOVFV5SURBdU5qTTFNVFU0SURBdU5EVXhPRFkyUXpBdU5qTTBNVGs1SURBdU5EVTBNVGd4SURBdU5qTXlOemswSURBdU5EVTJNamcwSURBdU5qTXhNREl5SURBdU5EVTRNRFUxUXpBdU5qSTVNalV4SURBdU5EVTVPREkzSURBdU5qSTNNVFE0SURBdU5EWXhNak15SURBdU5qSTBPRE16SURBdU5EWXlNVGxETUM0Mk1qSTFNVGtnTUM0ME5qTXhORGtnTUM0Mk1qQXdNemdnTUM0ME5qTTJORE1nTUM0Mk1UYzFNek1nTUM0ME5qTTJORE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOalkyT0RRMklEQXVOVEk0T0RFMFNEQXVNelE0TURjMlF6QXVNelEyTnpreUlEQXVOVEk0TnpjeElEQXVNelExTlRFeklEQXVOVEk0T1RreUlEQXVNelEwTXpFM0lEQXVOVEk1TkRZMFF6QXVNelF6TVRJeUlEQXVOVEk1T1RNMklEQXVNelF5TURNMklEQXVOVE13TmpRNUlEQXVNelF4TVRJNElEQXVOVE14TlRVM1F6QXVNelF3TWpFNUlEQXVOVE15TkRZMklEQXVNek01TlRBM0lEQXVOVE16TlRVeUlEQXVNek01TURNMUlEQXVOVE0wTnpRM1F6QXVNek00TlRZeklEQXVOVE0xT1RReUlEQXVNek00TXpReElEQXVOVE0zTWpJeUlEQXVNek00TXpnMElEQXVOVE00TlRBMlZqQXVOakEwTkRJNFF6QXVNek00TkRBMElEQXVOakEyT0RreElEQXVNek01TXpreElEQXVOakE1TWpRM0lEQXVNelF4TVRNeUlEQXVOakV3T1RnNFF6QXVNelF5T0RjMElEQXVOakV5TnpJNUlEQXVNelExTWpJNUlEQXVOakV6TnpFMklEQXVNelEzTmpreUlEQXVOakV6TnpNMlNEQXVOalkyT0RRMlF6QXVOalk1TXpBNElEQXVOakV6TnpFMklEQXVOamN4TmpZMElEQXVOakV5TnpJNUlEQXVOamN6TkRBMUlEQXVOakV3T1RnNFF6QXVOamMxTVRRMklEQXVOakE1TWpRM0lEQXVOamMyTVRNeklEQXVOakEyT0RreElEQXVOamMyTVRVeklEQXVOakEwTkRJNFZqQXVOVE00TVRJeFF6QXVOamMyTVRNeklEQXVOVE0xTmpVNUlEQXVOamMxTVRRMklEQXVOVE16TXpBeklEQXVOamN6TkRBMUlEQXVOVE14TlRZeVF6QXVOamN4TmpZMElEQXVOVEk1T0RJeElEQXVOalk1TXpBNElEQXVOVEk0T0RNMElEQXVOalkyT0RRMklEQXVOVEk0T0RFMFZqQXVOVEk0T0RFMFdrMHdMall4TnpVek9DQXdMalU1TURNMU1rTXdMall4TXpjMk5TQXdMalU1TURNMU1pQXdMall4TURBM055QXdMalU0T1RJek15QXdMall3Tmprek9TQXdMalU0TnpFek4wTXdMall3TXpnd01pQXdMalU0TlRBME1TQXdMall3TVRNMU55QXdMalU0TWpBMk1TQXdMalU1T1RreE15QXdMalUzT0RVM05VTXdMalU1T0RRMk9TQXdMalUzTlRBNE9TQXdMalU1T0RBNU1pQXdMalUzTVRJMU5DQXdMalU1T0RneU9DQXdMalUyTnpVMU0wTXdMalU1T1RVMk5DQXdMalUyTXpnMU15QXdMall3TVRNNE1TQXdMalUyTURRMU5DQXdMall3TkRBME9TQXdMalUxTnpjNE5rTXdMall3TmpjeE55QXdMalUxTlRFeE9DQXdMall4TURFeE5pQXdMalUxTXpNd01TQXdMall4TXpneE5pQXdMalUxTWpVMk5VTXdMall4TnpVeE55QXdMalUxTVRneU9TQXdMall5TVRNMU15QXdMalUxTWpJd05pQXdMall5TkRnek9DQXdMalUxTXpZMVF6QXVOakk0TXpJMElEQXVOVFUxTURrMElEQXVOak14TXpBMElEQXVOVFUzTlRNNUlEQXVOak16TkNBd0xqVTJNRFkzTjBNd0xqWXpOVFE1TmlBd0xqVTJNemd4TkNBd0xqWXpOall4TlNBd0xqVTJOelV3TWlBd0xqWXpOall4TlNBd0xqVTNNVEkzTlVNd0xqWXpOall4TlNBd0xqVTNNemM0SURBdU5qTTJNVEl4SURBdU5UYzJNall4SURBdU5qTTFNVFl6SURBdU5UYzROVGMxUXpBdU5qTTBNakEwSURBdU5UZ3dPRGtnTUM0Mk16STNPVGtnTUM0MU9ESTVPVE1nTUM0Mk16RXdNamNnTUM0MU9EUTNOalJETUM0Mk1qa3lOVFlnTUM0MU9EWTFNellnTUM0Mk1qY3hOVE1nTUM0MU9EYzVOREVnTUM0Mk1qUTRNemdnTUM0MU9EZzVRekF1TmpJeU5USTBJREF1TlRnNU9EVTRJREF1TmpJd01EUXpJREF1TlRrd016VXlJREF1TmpFM05UTTRJREF1TlRrd016VXlXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4a1pXWnpQaVlqZUdFN1BHTnNhWEJRWVhSb0lHbGtQU0pqYkdsd01DSStKaU40WVRzOGNtVmpkQ0IzYVdSMGFEMGlNQzQ1T0RRMk1UVWlJR2hsYVdkb2REMGlNQzQ1T0RRMk1EWWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakF4TlRNNE1Ea2dNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xOyIgcGFyZW50PSIxMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI3MCIgeT0iMjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjwvb2JqZWN0PjxteENlbGwgaWQ9IjI2IiB2YWx1ZT0iU0FQIFJvdXRlciAtPiBTQVAgQ0kgKyBXRCArIEhBTkEiIHN0eWxlPSJpci5yZWY9NmUyMTYwNjItYjQ5OC00Y2U2LWE4YmQtMmIzMGM3M2MyYWRiO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjciIHNvdXJjZT0iNSIgdGFyZ2V0PSIxNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMyIiB2YWx1ZT0iQmFzdGlvbiBTZXJ2ZXIgLT4gR0NQIFN0b3JhZ2UiIHN0eWxlPSJpci5yZWY9ZTI4ZDVkMzAtODBmMC00OGZiLWI5YTMtY2M1OWQyZDkxZWRjO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNyIgc291cmNlPSIxMiIgdGFyZ2V0PSIxNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMzIiB2YWx1ZT0iQmFzdGlvbiBTZXJ2ZXIgLT4gU0FQIENJICsgV0QgKyBIQU5BIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9Yzk1OGNhMjUtYmVlYS00ZmEzLThhODctN2RlMjI5MmVkMjQ4O2lyLnRhZ3M9YWRtaW47IiBwYXJlbnQ9IjciIHNvdXJjZT0iMTIiIHRhcmdldD0iMTQiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHg9IjAuMTI3NiIgeT0iOSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+PG14UG9pbnQgYXM9Im9mZnNldCIvPjwvbXhHZW9tZXRyeT48L214Q2VsbD48bXhDZWxsIGlkPSIyIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItMjIxIiB5PSI1OCIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI1NzkiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjgiIHZhbHVlPSJCcm93c2VyIiBzdHlsZT0iaXIucmVmPTViOGVjYWMxLTU1ZmUtNGY5Mi1hYTA0LTI1YzkzZjc3MmM2Mztyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1CUk9XU0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpVd05WOHlNekl5T0NraVBqeHdZWFJvSUdROUlrMHdMakl3TURnd05pQXdMakk1T0RZME4wTXdMakl3TURnd05pQXdMakl6T1RneU5DQXdMakkwT0RBeU55QXdMakU1TWpFek9TQXdMak13TmpJM055QXdMakU1TWpFek9VZ3dMalk0TlRrM00wTXdMamMwTkRJeU15QXdMakU1TWpFek9TQXdMamM1TVRRME5DQXdMakl6T1RneU5DQXdMamM1TVRRME5DQXdMakk1T0RZME4xWXdMalE1Tmpjd05rTXdMamMzT0RNNU5pQXdMalE0T0RVME55QXdMamMyTkRJMElEQXVORGd5TURJMUlEQXVOelE1TWpVMUlEQXVORGMzTkRJeVZqQXVNell5TlRVeFNEQXVNalF5T1RrMFZqQXVOamd5TURjMVF6QXVNalF5T1RrMElEQXVOekUzTXpZNUlEQXVNamN4TXpJM0lEQXVOelExT1RnZ01DNHpNRFl5TnpjZ01DNDNORFU1T0Vnd0xqVTBNamt6TlVNd0xqVTFNalU1TkNBd0xqYzJNVGszTWlBd0xqVTJORFl6SURBdU56YzJNelFnTUM0MU56ZzFORGNnTUM0M09EZzFPRE5JTUM0ek1EWXlOemRETUM0eU5EZ3dNamNnTUM0M09EZzFPRE1nTUM0eU1EQTRNRFlnTUM0M05EQTRPVGdnTUM0eU1EQTRNRFlnTUM0Mk9ESXdOelZXTUM0eU9UZzJORGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVOalUxTkRZM0lEQXVOekkwT0RJeFNEQXVOelE0TXpjM1F6QXVOek01TURjMElEQXVOemMwTXprMElEQXVOekl3TkRRMUlEQXVPREE0TVRNNUlEQXVOekF4T1RJeUlEQXVPREE0TVRNNVF6QXVOamd6T1RZZ01DNDRNRGd4TXprZ01DNDJOalU0T1RrZ01DNDNOelkwTURnZ01DNDJOVFl6TXpnZ01DNDNNamt5T0RSTU1DNDJOVFUwTmpjZ01DNDNNalE0TWpGSU1DNDNORGd6TnpkSU1DNDJOVFUwTmpkYVRUQXVOVFkzT0RVMUlEQXVOekkwT0RJMFREQXVOak15TkRZMklEQXVOekkwT0RKRE1DNDJNemM1TXprZ01DNDNOVFl6TnpRZ01DNDJORGN5TVRjZ01DNDNPRE15TVRnZ01DNDJOVGt6TlRrZ01DNDRNREl3TURSRE1DNDJNakE1TURFZ01DNDNPVEExTXpVZ01DNDFPRGc0T0RNZ01DNDNOak01TkRNZ01DNDFOekF3TlRFZ01DNDNNamt3TlV3d0xqVTJOemcxTlNBd0xqY3lORGd5TkZwTk1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkVNd0xqZ3hOelV4TWlBd0xqYzJNVGM1TWlBd0xqYzRORFE0TVNBd0xqYzVNREEzTmlBd0xqYzBORFVnTUM0NE1ERTVPVGxETUM0M05UVTRNak1nTUM0M09EUTBOVGNnTUM0M05qUTJOVGNnTUM0M05UazVNRGdnTUM0M056QXlNek1nTUM0M016RXdOalpNTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORXd3TGpjM01UTTNPQ0F3TGpjeU5EZ3lXazB3TGpjM05Ua3lOQ0F3TGpZeU5qTXlNMHd3TGpnME9UQXdOQ0F3TGpZeU5qTXhNME13TGpnMU1EazNNaUF3TGpZek5qRXdOeUF3TGpnMU1qQXdOaUF3TGpZME5qSTBOQ0F3TGpnMU1qQXdOaUF3TGpZMU5qWXlOVU13TGpnMU1qQXdOaUF3TGpZM01qUTJOU0F3TGpnME9UVTVPU0F3TGpZNE56Y3pPQ0F3TGpnME5URXpOU0F3TGpjd01qQTVNa2d3TGpjM05EVTJOME13TGpjM05qRTBOeUF3TGpZNE56VTRNU0F3TGpjM05qazNOU0F3TGpZM01qTXpOU0F3TGpjM05qazNOU0F3TGpZMU5qWXlOVU13TGpjM05qazNOU0F3TGpZME9UYzBJREF1TnpjMk9ERTJJREF1TmpReU9UUTFJREF1TnpjMk5UQTFJREF1TmpNMk1qWXhUREF1TnpjMU9USTBJREF1TmpJMk16SXpUREF1T0RRNU1EQTBJREF1TmpJMk16RXpUREF1TnpjMU9USTBJREF1TmpJMk16SXpXazB3TGpVMU5EZzBJREF1TmpJMk16RXpUREF1TmpJM09USWdNQzQyTWpZek1qTkRNQzQyTWpjeU1qWWdNQzQyTXpZeE56SWdNQzQyTWpZNE5qZ2dNQzQyTkRZeU9UZ2dNQzQyTWpZNE5qZ2dNQzQyTlRZMk1qVkRNQzQyTWpZNE5qZ2dNQzQyTmpreE9UTWdNQzQyTWpjek9UZ2dNQzQyT0RFME5qUWdNQzQyTWpnME1Ua2dNQzQyT1RNeU9UbE1NQzQyTWpreU56WWdNQzQzTURJd09USklNQzQxTlRnM01EbERNQzQxTlRReU5EVWdNQzQyT0RjM016Z2dNQzQxTlRFNE16Z2dNQzQyTnpJME5qVWdNQzQxTlRFNE16Z2dNQzQyTlRZMk1qVkRNQzQxTlRFNE16Z2dNQzQyTkRZeU5EUWdNQzQxTlRJNE56SWdNQzQyTXpZeE1EY2dNQzQxTlRRNE5DQXdMall5TmpNeE0xcE5NQzQyTlRBMU16UWdNQzQyTWpZek1UUklNQzQzTlRNek1VTXdMamMxTkRBMk5DQXdMall6TmpBNU9DQXdMamMxTkRRMk5pQXdMalkwTmpJek15QXdMamMxTkRRMk5pQXdMalkxTmpZeU5VTXdMamMxTkRRMk5pQXdMalkyT1RNeE9DQXdMamMxTXpnMk55QXdMalk0TVRZeU9TQXdMamMxTWpjMU9DQXdMalk1TXpNNE0wd3dMamMxTVRnek15QXdMamN3TWpBNU1rZ3dMalkxTWpBeE1VTXdMalkxTURNeE5TQXdMalk0TnpjMklEQXVOalE1TXpjM0lEQXVOamN5TkRreUlEQXVOalE1TXpjM0lEQXVOalUyTmpJMVF6QXVOalE1TXpjM0lEQXVOalE0T0RNeElEQXVOalE1TmpBMElEQXVOalF4TVRneElEQXVOalV3TURNMUlEQXVOak16TnpFMlREQXVOalV3TlRNMElEQXVOakkyTXpFMFNEQXVOelV6TXpGSU1DNDJOVEExTXpSYVRUQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1F6QXVOemc1TnpjNElEQXVOVEkwTnpRNElEQXVPREkyTVRVeklEQXVOVFU1TWpRM0lEQXVPRFF5TlRVM0lEQXVOakF6TlRneVREQXVOemN6TmpZMklEQXVOakF6TlRnM1F6QXVOelk0T1RNeElEQXVOVFkyT1RZeUlEQXVOelU1TXpFeklEQXVOVE0xTlRBNElEQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1REQXVOelEyTVRBMElEQXVOVEV6T0RJMldrMHdMalkxTnpVek1TQXdMalV4TVRnd05Vd3dMalkxT1RNMU9DQXdMalV4TVRJME4wTXdMalkwTmpFME1TQXdMalV6TVRZNU55QXdMall6TmpNeE9DQXdMalUyTVRZNU5pQXdMall6TVRFd01TQXdMalU1TmpreU1rd3dMall6TURFM055QXdMall3TXpVNE4wd3dMalUyTVRJNE5pQXdMall3TXpVNE1rTXdMalUzTnpRM0lEQXVOVFU1T0RRMUlEQXVOakV6TURnNElEQXVOVEkxTmpneElEQXVOalUzTlRNeElEQXVOVEV4T0RBMVREQXVOalU1TXpVNElEQXVOVEV4TWpRM1REQXVOalUzTlRNeElEQXVOVEV4T0RBMVdrMHdMamN3TVRreU1pQXdMalV3TlRFeE1VTXdMamN5TVRjeE1pQXdMalV3TlRFeE1TQXdMamMwTVRZeU1pQXdMalUwTXpZeU9DQXdMamMxTURFMU1TQXdMalU1T0RneE0wd3dMamMxTURnMU5DQXdMall3TXpVNE0wZ3dMalkxTWprNVF6QXVOall4TURnMElEQXVOVFExT0RZZ01DNDJPREUxTmpjZ01DNDFNRFV4TVRFZ01DNDNNREU1TWpJZ01DNDFNRFV4TVRGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQQzluUGp4a1pXWnpQanhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpVd05WOHlNekl5T0NJK1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iMjQ0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE2IiB2YWx1ZT0iUmljaCBDbGllbnQiIHN0eWxlPSJpci5yZWY9MzZhOWVjYjktMDA0MS00MTk2LWJlMDctYTJmYzE0ZmZlMmM1O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJpY2gtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqWTFNRE01T0NBd0xqWTVOREk1TWtNd0xqWTBOamszTmlBd0xqWTVORE01T0NBd0xqWTBNelUwTVNBd0xqWTVORFExTWlBd0xqWTBNREE1TXlBd0xqWTVORFExTWtNd0xqWXpOalkwTmlBd0xqWTVORFExTWlBd0xqWXpNekl4TVNBd0xqWTVORE01T0NBd0xqWXlPVGM0T1NBd0xqWTVOREk1TWtnd0xqSTFOakE1TTBNd0xqSXlNelEyTmlBd0xqWTVOREk1TWlBd0xqRTVOekF4TmlBd0xqWTJOemcxT0NBd0xqRTVOekF4TmlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqRTVOekF4TmlBd0xqSTBPRFUySURBdU1qSXpORFkySURBdU1qSXlNVEkzSURBdU1qVTJNRGt6SURBdU1qSXlNVEkzU0RBdU16VXdOVGs1UXpBdU16WXhOREEwSURBdU1qQXhNREF6SURBdU16YzBORFUySURBdU1UZ3hNakU0SURBdU16ZzVORFFnTUM0eE5qTXdPRFpJTUM0eU5UWXdPVE5ETUM0eE9UQTRNemtnTUM0eE5qTXdPRFlnTUM0eE16YzVNemtnTUM0eU1UVTVOVE1nTUM0eE16YzVNemtnTUM0eU9ERXhOamRXTUM0Mk16VXlOVEZETUM0eE16YzVNemtnTUM0M01EQTBOallnTUM0eE9UQTRNemtnTUM0M05UTXpNeklnTUM0eU5UWXdPVE1nTUM0M05UTXpNekpJTUM0ek56UTFORE5XTUM0NE1UTXdNRFJNTUM0eU9EVTVPRFVnTUM0NE1UTXdNRFZETUM0eU5qazJOeklnTUM0NE1UTXdNRFVnTUM0eU5UWTBORGNnTUM0NE1qWXlNaklnTUM0eU5UWTBORGNnTUM0NE5ESTFNalpETUM0eU5UWTBORGNnTUM0NE5UZzRNamtnTUM0eU5qazJOeklnTUM0NE56SXdORFlnTUM0eU9EVTVPRFlnTUM0NE56SXdORFpNTUM0Mk9Ua3lPVFlnTUM0NE56SXdORE5ETUM0M01UVTJNU0F3TGpnM01qQTBNaUF3TGpjeU9EZ3pOU0F3TGpnMU9EZ3lOaUF3TGpjeU9EZ3pOQ0F3TGpnME1qVXlNa013TGpjeU9EZ3pOQ0F3TGpneU5qSXhPQ0F3TGpjeE5UWXdPU0F3TGpneE16QXdNaUF3TGpZNU9USTVOaUF3TGpneE16QXdNa3d3TGpZeE1EY3lPQ0F3TGpneE16QXdNMVl3TGpjMU16TXpNa2d3TGpjeU9EY3dPVU13TGpjNU16azJNeUF3TGpjMU16TXpNaUF3TGpnME5qZzJNeUF3TGpjd01EUTJOaUF3TGpnME5qZzJNeUF3TGpZek5USTFNVll3TGpZeU1ESXlPRU13TGpneU5qZzFPQ0F3TGpZek5qY3pPU0F3TGpnd05EZzBNU0F3TGpZMU1Ea3dNeUF3TGpjNE1USXpOaUF3TGpZMk1qSTVPRU13TGpjM01UUXhPU0F3TGpZNE1UTWdNQzQzTlRFMU9ESWdNQzQyT1RReU9USWdNQzQzTWpnM01Ea2dNQzQyT1RReU9USklNQzQyTlRBek9UaGFUVEF1TlRVeE5qVXhJREF1T0RFek1EQXpUREF1TkRNek5qSWdNQzQ0TVRNd01EUldNQzQzTlRNek16SklNQzQxTlRFMk5URldNQzQ0TVRNd01ETmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCbWFXeHNMWEoxYkdVOUltVjJaVzV2WkdRaUlHTnNhWEF0Y25Wc1pUMGlaWFpsYm05a1pDSWdaRDBpVFRBdU5qSTVNREE1SURBdU5qUXpNamMwUXpBdU56YzFNakk1SURBdU5qUXpNamMwSURBdU9Ea3pOell6SURBdU5USTBOelFnTUM0NE9UTTNOak1nTUM0ek56ZzFNakZETUM0NE9UTTNOak1nTUM0eU16SXpNRE1nTUM0M056VXlNamtnTUM0eE1UTTNOeUF3TGpZeU9UQXdPU0F3TGpFeE16YzNRekF1TkRneU56a3lJREF1TVRFek56Y2dNQzR6TmpReU5UZ2dNQzR5TXpJek1ETWdNQzR6TmpReU5UZ2dNQzR6TnpnMU1qRkRNQzR6TmpReU5UZ2dNQzQxTWpRM05DQXdMalE0TWpjNU1pQXdMalkwTXpJM05DQXdMall5T1RBd09TQXdMalkwTXpJM05GcE5NQzQyT1RFME5qa2dNQzR5TXpJeU1EZERNQzQyT1RBMk9UTWdNQzR5TWpZME9DQXdMalk0TlRjNE15QXdMakl5TWpBMk5pQXdMalkzT1RnME5DQXdMakl5TWpBMk5rd3dMalkzT0RJMU1TQXdMakl5TWpFM00wd3dMalkzTmpjeU15QXdMakl5TWpRNE5VTXdMalkzTVRjMU9TQXdMakl5TXpnMU1TQXdMalkyT0RFeElEQXVNakk0TXprNUlEQXVOalk0TVRFZ01DNHlNek0zT1RsV01DNHlOamc1T0ROSU1DNDJOREEzTVRkTU1DNDJOREEzTXpJZ01DNHlNek0zT1RsTU1DNDJOREEyTWpVZ01DNHlNekl5TURkRE1DNDJNems0TkRrZ01DNHlNalkwT0NBd0xqWXpORGt6T1NBd0xqSXlNakEyTmlBd0xqWXlPU0F3TGpJeU1qQTJOa3d3TGpZeU56UXdOeUF3TGpJeU1qRTNNME13TGpZeU1UWTNPU0F3TGpJeU1qazFJREF1TmpFM01qWTJJREF1TWpJM09EVTVJREF1TmpFM01qWTJJREF1TWpNek56azVUREF1TmpFM01qVWdNQzR5TmpnNU9ETklNQzQxT0RrNE9EaFdNQzR5TXpNM09UbE1NQzQxT0RrM09ERWdNQzR5TXpJeU1EZERNQzQxT0Rrd01EVWdNQzR5TWpZME9DQXdMalU0TkRBNU5TQXdMakl5TWpBMk5pQXdMalUzT0RFMU5pQXdMakl5TWpBMk5rTXdMalUzTVRZM05DQXdMakl5TWpBMk5pQXdMalUyTmpReU1pQXdMakl5TnpNeE9TQXdMalUyTmpReU1pQXdMakl6TXpjNU9Vd3dMalUyTmpReU9TQXdMakkzTURFM01VTXdMalUwTXpRME5DQXdMakkzTkRnek5DQXdMalV5TlRNek55QXdMakk1TWprek5TQXdMalV5TURZMk5DQXdMak14TlRreE4wd3dMalE0TkRJNE9TQXdMak14TlRrek1rd3dMalE0TWpZNU55QXdMak14TmpBMFF6QXVORGMyT1RZNUlEQXVNekUyT0RFMklEQXVORGN5TlRVMUlEQXVNekl4TnpJMUlEQXVORGN5TlRVMUlEQXVNekkzTmpZMVREQXVORGN5TmpZeUlEQXVNekk1TWpVM1F6QXVORGN6TkRNNElEQXVNek0wT1RnMUlEQXVORGM0TXpRNElEQXVNek01TXprNUlEQXVORGcwTWpnNUlEQXVNek01TXprNVREQXVOVEU1TkRnNUlEQXVNek01TXpnelZqQXVNelkyTnpZeFREQXVORGcwTWpnNUlEQXVNelkyTnpjMlREQXVORGd5TmprM0lEQXVNelkyT0RnMFF6QXVORGMyT1RZNUlEQXVNelkzTmpZeElEQXVORGN5TlRVMUlEQXVNemN5TlRjZ01DNDBOekkxTlRVZ01DNHpOemcxTVV3d0xqUTNNalkyTWlBd0xqTTRNREV3TWtNd0xqUTNNelF6T0NBd0xqTTROVGd5T1NBd0xqUTNPRE0wT0NBd0xqTTVNREkwTXlBd0xqUTROREk0T1NBd0xqTTVNREkwTTB3d0xqVXhPVFE0T1NBd0xqTTVNREl5TjFZd0xqUXhOell3TlV3d0xqUTROREk0T1NBd0xqUXhOell5TVV3d0xqUTRNalk1TnlBd0xqUXhOemN5T0VNd0xqUTNOamsyT1NBd0xqUXhPRFV3TlNBd0xqUTNNalUxTlNBd0xqUXlNelF4TkNBd0xqUTNNalUxTlNBd0xqUXlPVE0xTkVNd0xqUTNNalUxTlNBd0xqUXpOVGd6TkNBd0xqUTNOemd3T0NBd0xqUTBNVEE0TnlBd0xqUTROREk0T1NBd0xqUTBNVEE0TjB3d0xqVXlNRFkyTWlBd0xqUTBNVEE0TjBNd0xqVXlOVE15T0NBd0xqUTJOREEzTnlBd0xqVTBNelF6T0NBd0xqUTRNakU0TlNBd0xqVTJOalF5T1NBd0xqUTROamcwT0V3d0xqVTJOalF5TWlBd0xqVXlNekl5TVV3d0xqVTJOalV5T0NBd0xqVXlORGd4TTBNd0xqVTJOek13TnlBd0xqVXpNRFUwSURBdU5UY3lNakUwSURBdU5UTTBPVFUwSURBdU5UYzRNVFUySURBdU5UTTBPVFUwVERBdU5UYzVOelEySURBdU5UTTBPRFEzUXpBdU5UZzFORGMwSURBdU5UTTBNRGNnTUM0MU9EazRPRGdnTUM0MU1qa3hOaUF3TGpVNE9UZzRPQ0F3TGpVeU16SXlNVll3TGpRNE9EQXdOVWd3TGpZeE56STFUREF1TmpFM01qWTJJREF1TlRJek1qSXhUREF1TmpFM016Y3pJREF1TlRJME9ERXpRekF1TmpFNE1UVXhJREF1TlRNd05UUWdNQzQyTWpNd05UZ2dNQzQxTXpRNU5UUWdNQzQyTWprZ01DNDFNelE1TlRSTU1DNDJNekExT1NBd0xqVXpORGcwTjBNd0xqWXpOak14T0NBd0xqVXpOREEzSURBdU5qUXdOek15SURBdU5USTVNVFlnTUM0Mk5EQTNNeklnTUM0MU1qTXlNakZNTUM0Mk5EQTNNVGNnTUM0ME9EZ3dNRFZJTUM0Mk5qZ3hNVll3TGpVeU16SXlNVXd3TGpZMk9ESXhOeUF3TGpVeU5EZ3hNME13TGpZMk9EazVOU0F3TGpVek1EVTBJREF1Tmpjek9UQXpJREF1TlRNME9UVTBJREF1TmpjNU9EUTBJREF1TlRNME9UVTBRekF1TmpnMk16SXpJREF1TlRNME9UVTBJREF1TmpreE5UYzJJREF1TlRJNU56QXhJREF1TmpreE5UYzJJREF1TlRJek1qSXhUREF1TmpreE5UZzJJREF1TkRnMk9EUTFRekF1TnpFME5UWXpJREF1TkRneU1UYzNJREF1TnpNeU5qWTBJREF1TkRZME1EYzRJREF1TnpNM016TXpJREF1TkRReE1Vd3dMamMzTXpjeElEQXVORFF4TURnM1REQXVOemMxTXpBeklEQXVORFF3T1RoRE1DNDNPREV3TWprZ01DNDBOREF5TURNZ01DNDNPRFUwTkRJZ01DNDBNelV5T1RRZ01DNDNPRFUwTkRJZ01DNDBNamt6TlRSTU1DNDNPRFV6TXpZZ01DNDBNamMzTmpKRE1DNDNPRFExTlRrZ01DNDBNakl3TXpVZ01DNDNOemsyTlNBd0xqUXhOell5TVNBd0xqYzNNemN4SURBdU5ERTNOakl4U0RBdU56TTROVEZXTUM0ek9UQXlORE5JTUM0M056TTNNVXd3TGpjM05UTXdNeUF3TGpNNU1ERXpOa013TGpjNE1UQXlPU0F3TGpNNE9UTTFPU0F3TGpjNE5UUTBNaUF3TGpNNE5EUTFJREF1TnpnMU5EUXlJREF1TXpjNE5URk1NQzQzT0RVek16WWdNQzR6TnpZNU1UaERNQzQzT0RRMU5Ua2dNQzR6TnpFeE9URWdNQzQzTnprMk5TQXdMak0yTmpjM05pQXdMamMzTXpjeElEQXVNelkyTnpjMlNEQXVOek00TlRGV01DNHpNemt6T1RsSU1DNDNOek0zTVV3d0xqYzNOVE13TXlBd0xqTXpPVEk1TWtNd0xqYzRNVEF5T1NBd0xqTXpPRFV4TlNBd0xqYzROVFEwTWlBd0xqTXpNell3TmlBd0xqYzROVFEwTWlBd0xqTXlOelkyTlVNd0xqYzROVFEwTWlBd0xqTXlNVEU0TmlBd0xqYzRNREU1SURBdU16RTFPVE15SURBdU56Y3pOekVnTUM0ek1UVTVNekpNTUM0M016Y3pNemNnTUM0ek1UVTVNelZETUM0M016STJOeklnTUM0eU9USTVOU0F3TGpjeE5EVTJPU0F3TGpJM05EZzBNeUF3TGpZNU1UVTROaUF3TGpJM01ERTNOVXd3TGpZNU1UVTNOaUF3TGpJek16YzVPVXd3TGpZNU1UUTJPU0F3TGpJek1qSXdOMXBOTUM0MU5ESTVOVFVnTUM0ek1qYzJOalZETUM0MU5ESTVOVFVnTUM0ek1EZ3lNalVnTUM0MU5UZzNNVFFnTUM0eU9USTBOallnTUM0MU56Z3hOVFlnTUM0eU9USTBOalpJTUM0Mk56azRORFJETUM0Mk9Ua3lPRFFnTUM0eU9USTBOallnTUM0M01UVXdORFFnTUM0ek1EZ3lNalVnTUM0M01UVXdORFFnTUM0ek1qYzJOalZXTUM0ME1qa3pOVFJETUM0M01UVXdORFFnTUM0ME5EZzNPVFFnTUM0Mk9Ua3lPRFFnTUM0ME5qUTFOVFFnTUM0Mk56azRORFFnTUM0ME5qUTFOVFJJTUM0MU56Z3hOVFpETUM0MU5UZzNNVFFnTUM0ME5qUTFOVFFnTUM0MU5ESTVOVFVnTUM0ME5EZzNPVFFnTUM0MU5ESTVOVFVnTUM0ME1qa3pOVFJXTUM0ek1qYzJOalZhVFRBdU5qYzJNREVnTUM0ek56ZzFPRGRETUM0Mk56WXdNU0F3TGpNMU1qWTJOaUF3TGpZMU5EazVOeUF3TGpNek1UWTFOQ0F3TGpZeU9UQTNOaUF3TGpNek1UWTFORU13TGpZd016RTFOU0F3TGpNek1UWTFOQ0F3TGpVNE1qRTBOQ0F3TGpNMU1qWTJOaUF3TGpVNE1qRTBOQ0F3TGpNM09EVTROME13TGpVNE1qRTBOQ0F3TGpRd05EVXdPQ0F3TGpZd016RTFOU0F3TGpReU5UVXlJREF1TmpJNU1EYzJJREF1TkRJMU5USkRNQzQyTlRRNU9UY2dNQzQwTWpVMU1pQXdMalkzTmpBeElEQXVOREEwTlRBNElEQXVOamMyTURFZ01DNHpOemcxT0RkYVRUQXVOakExTmpFZ01DNHpOemcxT0RkRE1DNDJNRFUyTVNBd0xqTTJOVFl5TnlBd0xqWXhOakV4TmlBd0xqTTFOVEV5SURBdU5qSTVNRGMySURBdU16VTFNVEpETUM0Mk5ESXdNellnTUM0ek5UVXhNaUF3TGpZMU1qVTBNaUF3TGpNMk5UWXlOeUF3TGpZMU1qVTBNaUF3TGpNM09EVTROME13TGpZMU1qVTBNaUF3TGpNNU1UVTBOeUF3TGpZME1qQXpOaUF3TGpRd01qQTFNeUF3TGpZeU9UQTNOaUF3TGpRd01qQTFNME13TGpZeE5qRXhOaUF3TGpRd01qQTFNeUF3TGpZd05UWXhJREF1TXpreE5UUTNJREF1TmpBMU5qRWdNQzR6TnpnMU9EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iODgiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMTciIHZhbHVlPSJHZW5lcmljIENsaWVudCIgc3R5bGU9ImlyLnJlZj01ZDlkMmZlNC02ZDg5LTQzYTAtODU2NC1jODA2MjNhNzYzNDg7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Z2VuZXJpYy1jbGllbnQ7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNHlOVFl6TXpjZ01DNDJPVFF5T1RKRE1DNHlOREUwTnlBd0xqWTVOREk1TWlBd0xqSXlOemc0TmlBd0xqWTRPRGd3TXlBd0xqSXhOelV3TWlBd0xqWTNPVGMwTTBNd0xqSXhNVGt4SURBdU5qYzBPRFkwSURBdU1qQTNNalEySURBdU5qWTRPVFE1SURBdU1qQXpPREVnTUM0Mk5qSXlPVGhETUM0eE9UazJNalFnTUM0Mk5UUXhPVFVnTUM0eE9UY3lOakVnTUM0Mk5EUTVPVGtnTUM0eE9UY3lOakVnTUM0Mk16VXlOVEZXTUM0eU9ERXhOamhETUM0eE9UY3lOakVnTUM0eU5EZzFOaUF3TGpJeU16Y3hJREF1TWpJeU1USTNJREF1TWpVMk16TTNJREF1TWpJeU1USTNUREF1TmpNME5EUTNJREF1TWpJeU1USTNUREF1TlRrMU5qQTNJREF1TVRZek1EZzJUREF1TWpVMk16TTNJREF1TVRZek1EZzJRekF1TVRreE1EZ3pJREF1TVRZek1EZzJJREF1TVRNNE1UZzBJREF1TWpFMU9UVXpJREF1TVRNNE1UZzBJREF1TWpneE1UWTRWakF1TmpNMU1qVXhRekF1TVRNNE1UZzBJREF1TmpRNE16Y3pJREF1TVRRd016STJJREF1TmpZd09UazJJREF1TVRRME1qYzVJREF1TmpjeU56ZzVRekF1TVRVd01UUTVJREF1Tmprd01qazRJREF1TVRZd01ERXpJREF1TnpBMU9UYzRJREF1TVRjeU56a2dNQzQzTVRnM05EZERNQzR4T1RReE56SWdNQzQzTkRBeE1UWWdNQzR5TWpNM01TQXdMamMxTXpNek15QXdMakkxTmpNek55QXdMamMxTXpNek0wZ3dMak0zTkRjNE4xWXdMamd4TXpBd05Vd3dMakk0TmpJeU9TQXdMamd4TXpBd05VTXdMakkyT1RreE5pQXdMamd4TXpBd05pQXdMakkxTmpZNU1TQXdMamd5TmpJeU1pQXdMakkxTmpZNU1TQXdMamcwTWpVeU5rTXdMakkxTmpZNU1TQXdMamcxT0RneklEQXVNalk1T1RFMklEQXVPRGN5TURRMklEQXVNamcyTWpNZ01DNDROekl3TkRaTU1DNDJPVGsxTkNBd0xqZzNNakEwTTBNd0xqY3hOVGcxTkNBd0xqZzNNakEwTXlBd0xqY3lPVEEzT1NBd0xqZzFPRGd5TmlBd0xqY3lPVEEzT1NBd0xqZzBNalV5TWtNd0xqY3lPVEEzT0NBd0xqZ3lOakl4T1NBd0xqY3hOVGcxTXlBd0xqZ3hNekF3TWlBd0xqWTVPVFUwSURBdU9ERXpNREF5VERBdU5qRXdPVGN5SURBdU9ERXpNREF6VmpBdU56VXpNek16U0RBdU56STRPVFV6UXpBdU56UXlPRFV6SURBdU56VXpNek16SURBdU56VTJNVGt6SURBdU56VXdPVE0wSURBdU56WTROVGdnTUM0M05EWTFNamRETUM0NE1EY3dOelVnTUM0M016STRNelVnTUM0NE16WXpOekVnTUM0Mk9UazNOVGNnTUM0NE5EUTNNRFlnTUM0Mk5Ua3dORGxETUM0NE5EWXlPQ0F3TGpZMU1UTTJNaUF3TGpnME56RXdOeUF3TGpZME16UXdNeUF3TGpnME56RXdOeUF3TGpZek5USTFNVll3TGpJNE1URTJOME13TGpnME56RXdOeUF3TGpJeE5UazFNeUF3TGpjNU5ESXdOeUF3TGpFMk16QTROaUF3TGpjeU9EazFNeUF3TGpFMk16QTROa2d3TGpVNU5UWXdOMHd3TGpZek5EUTBOeUF3TGpJeU1qRXlOMGd3TGpjeU9EazFNME13TGpjMk1UVTRJREF1TWpJeU1USTNJREF1TnpnNE1ETWdNQzR5TkRnMU5pQXdMamM0T0RBeklEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVOemc0TURNZ01DNDJORFE1T1RrZ01DNDNPRFUyTmpZZ01DNDJOVFF4T1RVZ01DNDNPREUwT0NBd0xqWTJNakk1T0VNd0xqYzNOREk0T1NBd0xqWTNOakl4T0NBd0xqYzJNVGN5TVNBd0xqWTROamt4TXlBd0xqYzBOalV5TVNBd0xqWTVNVFl6TjBNd0xqYzBNRGszTVNBd0xqWTVNek0yTWlBd0xqY3pOVEEzTVNBd0xqWTVOREk1TWlBd0xqY3lPRGsxTXlBd0xqWTVOREk1TWtnd0xqSTFOak16TjFwTk1DNDBNek00TmpRZ01DNDRNVE13TURSTU1DNDFOVEU0T1RVZ01DNDRNVE13TUROV01DNDNOVE16TXpOSU1DNDBNek00TmpSV01DNDRNVE13TURSYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T1RnME5qRTFJaUJvWldsbmFIUTlJakF1T1RnME5qRTFJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TURBeU5EUXhOREVnTUM0d01UVXpPREE1S1NJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTsiIHBhcmVudD0iMiIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSI2MyIgeT0iNDAwIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjQiIHZhbHVlPSJJbnRlcm5ldCIgc3R5bGU9ImlyLnJlZj1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNTciIHk9Ii0xNjciIHdpZHRoPSI1OTIiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSI5IiB2YWx1ZT0iQnJvd3NlciIgc3R5bGU9ImlyLnJlZj0yNzk4NjIxOC00ZjIzLTQ1MDItOWI4OC1lNzU3YmE0YzEyNmI7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUIyYVdWM1FtOTRQU0l3SURBZ01TQXhJaUJtYVd4c1BTSnViMjVsSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4emRIbHNaVDRnSUNBZ0xtbGpiMjR0Wm1sc2JDQjdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lBZ0lDQjlQQzl6ZEhsc1pUNDhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RCZk1qVXdOVjh5TXpJeU9Da2lQanh3WVhSb0lHUTlJazB3TGpJd01EZ3dOaUF3TGpJNU9EWTBOME13TGpJd01EZ3dOaUF3TGpJek9UZ3lOQ0F3TGpJME9EQXlOeUF3TGpFNU1qRXpPU0F3TGpNd05qSTNOeUF3TGpFNU1qRXpPVWd3TGpZNE5UazNNME13TGpjME5ESXlNeUF3TGpFNU1qRXpPU0F3TGpjNU1UUTBOQ0F3TGpJek9UZ3lOQ0F3TGpjNU1UUTBOQ0F3TGpJNU9EWTBOMVl3TGpRNU5qY3dOa013TGpjM09ETTVOaUF3TGpRNE9EVTBOeUF3TGpjMk5ESTBJREF1TkRneU1ESTFJREF1TnpRNU1qVTFJREF1TkRjM05ESXlWakF1TXpZeU5UVXhTREF1TWpReU9UazBWakF1TmpneU1EYzFRekF1TWpReU9UazBJREF1TnpFM016WTVJREF1TWpjeE16STNJREF1TnpRMU9UZ2dNQzR6TURZeU56Y2dNQzQzTkRVNU9FZ3dMalUwTWprek5VTXdMalUxTWpVNU5DQXdMamMyTVRrM01pQXdMalUyTkRZeklEQXVOemMyTXpRZ01DNDFOemcxTkRjZ01DNDNPRGcxT0ROSU1DNHpNRFl5TnpkRE1DNHlORGd3TWpjZ01DNDNPRGcxT0RNZ01DNHlNREE0TURZZ01DNDNOREE0T1RnZ01DNHlNREE0TURZZ01DNDJPREl3TnpWV01DNHlPVGcyTkRkYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQSEJoZEdnZ1pEMGlUVEF1TmpVMU5EWTNJREF1TnpJME9ESXhTREF1TnpRNE16YzNRekF1TnpNNU1EYzBJREF1TnpjME16azBJREF1TnpJd05EUTFJREF1T0RBNE1UTTVJREF1TnpBeE9USXlJREF1T0RBNE1UTTVRekF1Tmpnek9UWWdNQzQ0TURneE16a2dNQzQyTmpVNE9Ua2dNQzQzTnpZME1EZ2dNQzQyTlRZek16Z2dNQzQzTWpreU9EUk1NQzQyTlRVME5qY2dNQzQzTWpRNE1qRklNQzQzTkRnek56ZElNQzQyTlRVME5qZGFUVEF1TlRZM09EVTFJREF1TnpJME9ESTBUREF1TmpNeU5EWTJJREF1TnpJME9ESkRNQzQyTXpjNU16a2dNQzQzTlRZek56UWdNQzQyTkRjeU1UY2dNQzQzT0RNeU1UZ2dNQzQyTlRrek5Ua2dNQzQ0TURJd01EUkRNQzQyTWpBNU1ERWdNQzQzT1RBMU16VWdNQzQxT0RnNE9ETWdNQzQzTmpNNU5ETWdNQzQxTnpBd05URWdNQzQzTWprd05Vd3dMalUyTnpnMU5TQXdMamN5TkRneU5GcE5NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5FTXdMamd4TnpVeE1pQXdMamMyTVRjNU1pQXdMamM0TkRRNE1TQXdMamM1TURBM05pQXdMamMwTkRVZ01DNDRNREU1T1RsRE1DNDNOVFU0TWpNZ01DNDNPRFEwTlRjZ01DNDNOalEyTlRjZ01DNDNOVGs1TURnZ01DNDNOekF5TXpNZ01DNDNNekV3TmpaTU1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkV3d0xqYzNNVE0zT0NBd0xqY3lORGd5V2swd0xqYzNOVGt5TkNBd0xqWXlOak15TTB3d0xqZzBPVEF3TkNBd0xqWXlOak14TTBNd0xqZzFNRGszTWlBd0xqWXpOakV3TnlBd0xqZzFNakF3TmlBd0xqWTBOakkwTkNBd0xqZzFNakF3TmlBd0xqWTFOall5TlVNd0xqZzFNakF3TmlBd0xqWTNNalEyTlNBd0xqZzBPVFU1T1NBd0xqWTROemN6T0NBd0xqZzBOVEV6TlNBd0xqY3dNakE1TWtnd0xqYzNORFUyTjBNd0xqYzNOakUwTnlBd0xqWTROelU0TVNBd0xqYzNOamszTlNBd0xqWTNNak16TlNBd0xqYzNOamszTlNBd0xqWTFOall5TlVNd0xqYzNOamszTlNBd0xqWTBPVGMwSURBdU56YzJPREUySURBdU5qUXlPVFExSURBdU56YzJOVEExSURBdU5qTTJNall4VERBdU56YzFPVEkwSURBdU5qSTJNekl6VERBdU9EUTVNREEwSURBdU5qSTJNekV6VERBdU56YzFPVEkwSURBdU5qSTJNekl6V2swd0xqVTFORGcwSURBdU5qSTJNekV6VERBdU5qSTNPVElnTUM0Mk1qWXpNak5ETUM0Mk1qY3lNallnTUM0Mk16WXhOeklnTUM0Mk1qWTROamdnTUM0Mk5EWXlPVGdnTUM0Mk1qWTROamdnTUM0Mk5UWTJNalZETUM0Mk1qWTROamdnTUM0Mk5qa3hPVE1nTUM0Mk1qY3pPVGdnTUM0Mk9ERTBOalFnTUM0Mk1qZzBNVGtnTUM0Mk9UTXlPVGxNTUM0Mk1qa3lOellnTUM0M01ESXdPVEpJTUM0MU5UZzNNRGxETUM0MU5UUXlORFVnTUM0Mk9EYzNNemdnTUM0MU5URTRNemdnTUM0Mk56STBOalVnTUM0MU5URTRNemdnTUM0Mk5UWTJNalZETUM0MU5URTRNemdnTUM0Mk5EWXlORFFnTUM0MU5USTROeklnTUM0Mk16WXhNRGNnTUM0MU5UUTROQ0F3TGpZeU5qTXhNMXBOTUM0Mk5UQTFNelFnTUM0Mk1qWXpNVFJJTUM0M05UTXpNVU13TGpjMU5EQTJOQ0F3TGpZek5qQTVPQ0F3TGpjMU5EUTJOaUF3TGpZME5qSXpNeUF3TGpjMU5EUTJOaUF3TGpZMU5qWXlOVU13TGpjMU5EUTJOaUF3TGpZMk9UTXhPQ0F3TGpjMU16ZzJOeUF3TGpZNE1UWXlPU0F3TGpjMU1qYzFPQ0F3TGpZNU16TTRNMHd3TGpjMU1UZ3pNeUF3TGpjd01qQTVNa2d3TGpZMU1qQXhNVU13TGpZMU1ETXhOU0F3TGpZNE56YzJJREF1TmpRNU16YzNJREF1TmpjeU5Ea3lJREF1TmpRNU16YzNJREF1TmpVMk5qSTFRekF1TmpRNU16YzNJREF1TmpRNE9ETXhJREF1TmpRNU5qQTBJREF1TmpReE1UZ3hJREF1TmpVd01ETTFJREF1TmpNek56RTJUREF1TmpVd05UTTBJREF1TmpJMk16RTBTREF1TnpVek16RklNQzQyTlRBMU16UmFUVEF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNRekF1TnpnNU56YzRJREF1TlRJME56UTRJREF1T0RJMk1UVXpJREF1TlRVNU1qUTNJREF1T0RReU5UVTNJREF1TmpBek5UZ3lUREF1Tnpjek5qWTJJREF1TmpBek5UZzNRekF1TnpZNE9UTXhJREF1TlRZMk9UWXlJREF1TnpVNU16RXpJREF1TlRNMU5UQTRJREF1TnpRMk1UQTBJREF1TlRFek9ESTJUREF1TnpRME5EZzFJREF1TlRFeE1qUTNUREF1TnpRMk1UQTBJREF1TlRFek9ESTJXazB3TGpZMU56VXpNU0F3TGpVeE1UZ3dOVXd3TGpZMU9UTTFPQ0F3TGpVeE1USTBOME13TGpZME5qRTBNU0F3TGpVek1UWTVOeUF3TGpZek5qTXhPQ0F3TGpVMk1UWTVOaUF3TGpZek1URXdNU0F3TGpVNU5qa3lNa3d3TGpZek1ERTNOeUF3TGpZd016VTROMHd3TGpVMk1USTROaUF3TGpZd016VTRNa013TGpVM056UTNJREF1TlRVNU9EUTFJREF1TmpFek1EZzRJREF1TlRJMU5qZ3hJREF1TmpVM05UTXhJREF1TlRFeE9EQTFUREF1TmpVNU16VTRJREF1TlRFeE1qUTNUREF1TmpVM05UTXhJREF1TlRFeE9EQTFXazB3TGpjd01Ua3lNaUF3TGpVd05URXhNVU13TGpjeU1UY3hNaUF3TGpVd05URXhNU0F3TGpjME1UWXlNaUF3TGpVME16WXlPQ0F3TGpjMU1ERTFNU0F3TGpVNU9EZ3hNMHd3TGpjMU1EZzFOQ0F3TGpZd016VTRNMGd3TGpZMU1qazVRekF1TmpZeE1EZzBJREF1TlRRMU9EWWdNQzQyT0RFMU5qY2dNQzQxTURVeE1URWdNQzQzTURFNU1qSWdNQzQxTURVeE1URmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEM5blBqeGtaV1p6UGp4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RCZk1qVXdOVjh5TXpJeU9DSStQSEpsWTNRZ2QybGtkR2c5SWpBdU9EZ2lJR2hsYVdkb2REMGlNQzQ0T0NJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBdU1EWXdNRFU0TmlBd0xqQTJNREExT0RZcElpOCtQQzlqYkdsd1VHRjBhRDQ4TDJSbFpuTStQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iMjUxIiB5PSIyOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIxOCIgdmFsdWU9IlJpY2ggQ2xpZW50IiBzdHlsZT0iaXIucmVmPThmNWU3NWExLTJlYTEtNGUxOC1hYWZiLWNhYTZiN2ZhOWQ2Zjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1yaWNoLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRRZ01DNHhOak13T0RaSU1DNHlOVFl3T1RORE1DNHhPVEE0TXprZ01DNHhOak13T0RZZ01DNHhNemM1TXprZ01DNHlNVFU1TlRNZ01DNHhNemM1TXprZ01DNHlPREV4TmpkV01DNDJNelV5TlRGRE1DNHhNemM1TXprZ01DNDNNREEwTmpZZ01DNHhPVEE0TXprZ01DNDNOVE16TXpJZ01DNHlOVFl3T1RNZ01DNDNOVE16TXpKSU1DNHpOelExTkROV01DNDRNVE13TURSTU1DNHlPRFU1T0RVZ01DNDRNVE13TURWRE1DNHlOamsyTnpJZ01DNDRNVE13TURVZ01DNHlOVFkwTkRjZ01DNDRNall5TWpJZ01DNHlOVFkwTkRjZ01DNDROREkxTWpaRE1DNHlOVFkwTkRjZ01DNDROVGc0TWprZ01DNHlOamsyTnpJZ01DNDROekl3TkRZZ01DNHlPRFU1T0RZZ01DNDROekl3TkRaTU1DNDJPVGt5T1RZZ01DNDROekl3TkRORE1DNDNNVFUyTVNBd0xqZzNNakEwTWlBd0xqY3lPRGd6TlNBd0xqZzFPRGd5TmlBd0xqY3lPRGd6TkNBd0xqZzBNalV5TWtNd0xqY3lPRGd6TkNBd0xqZ3lOakl4T0NBd0xqY3hOVFl3T1NBd0xqZ3hNekF3TWlBd0xqWTVPVEk1TmlBd0xqZ3hNekF3TWt3d0xqWXhNRGN5T0NBd0xqZ3hNekF3TTFZd0xqYzFNek16TWtnd0xqY3lPRGN3T1VNd0xqYzVNemsyTXlBd0xqYzFNek16TWlBd0xqZzBOamcyTXlBd0xqY3dNRFEyTmlBd0xqZzBOamcyTXlBd0xqWXpOVEkxTVZZd0xqWXlNREl5T0VNd0xqZ3lOamcxT0NBd0xqWXpOamN6T1NBd0xqZ3dORGcwTVNBd0xqWTFNRGt3TXlBd0xqYzRNVEl6TmlBd0xqWTJNakk1T0VNd0xqYzNNVFF4T1NBd0xqWTRNVE1nTUM0M05URTFPRElnTUM0Mk9UUXlPVElnTUM0M01qZzNNRGtnTUM0Mk9UUXlPVEpJTUM0Mk5UQXpPVGhhVFRBdU5UVXhOalV4SURBdU9ERXpNREF6VERBdU5ETXpOaklnTUM0NE1UTXdNRFJXTUM0M05UTXpNekpJTUM0MU5URTJOVEZXTUM0NE1UTXdNRE5hSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQm1hV3hzTFhKMWJHVTlJbVYyWlc1dlpHUWlJR05zYVhBdGNuVnNaVDBpWlhabGJtOWtaQ0lnWkQwaVRUQXVOakk1TURBNUlEQXVOalF6TWpjMFF6QXVOemMxTWpJNUlEQXVOalF6TWpjMElEQXVPRGt6TnpZeklEQXVOVEkwTnpRZ01DNDRPVE0zTmpNZ01DNHpOemcxTWpGRE1DNDRPVE0zTmpNZ01DNHlNekl6TURNZ01DNDNOelV5TWprZ01DNHhNVE0zTnlBd0xqWXlPVEF3T1NBd0xqRXhNemMzUXpBdU5EZ3lOemt5SURBdU1URXpOemNnTUM0ek5qUXlOVGdnTUM0eU16SXpNRE1nTUM0ek5qUXlOVGdnTUM0ek56ZzFNakZETUM0ek5qUXlOVGdnTUM0MU1qUTNOQ0F3TGpRNE1qYzVNaUF3TGpZME16STNOQ0F3TGpZeU9UQXdPU0F3TGpZME16STNORnBOTUM0Mk9URTBOamtnTUM0eU16SXlNRGRETUM0Mk9UQTJPVE1nTUM0eU1qWTBPQ0F3TGpZNE5UYzRNeUF3TGpJeU1qQTJOaUF3TGpZM09UZzBOQ0F3TGpJeU1qQTJOa3d3TGpZM09ESTFNU0F3TGpJeU1qRTNNMHd3TGpZM05qY3lNeUF3TGpJeU1qUTROVU13TGpZM01UYzFPU0F3TGpJeU16ZzFNU0F3TGpZMk9ERXhJREF1TWpJNE16azVJREF1TmpZNE1URWdNQzR5TXpNM09UbFdNQzR5TmpnNU9ETklNQzQyTkRBM01UZE1NQzQyTkRBM016SWdNQzR5TXpNM09UbE1NQzQyTkRBMk1qVWdNQzR5TXpJeU1EZERNQzQyTXprNE5Ea2dNQzR5TWpZME9DQXdMall6TkRrek9TQXdMakl5TWpBMk5pQXdMall5T1NBd0xqSXlNakEyTmt3d0xqWXlOelF3TnlBd0xqSXlNakUzTTBNd0xqWXlNVFkzT1NBd0xqSXlNamsxSURBdU5qRTNNalkySURBdU1qSTNPRFU1SURBdU5qRTNNalkySURBdU1qTXpOems1VERBdU5qRTNNalVnTUM0eU5qZzVPRE5JTUM0MU9EazRPRGhXTUM0eU16TTNPVGxNTUM0MU9EazNPREVnTUM0eU16SXlNRGRETUM0MU9Ea3dNRFVnTUM0eU1qWTBPQ0F3TGpVNE5EQTVOU0F3TGpJeU1qQTJOaUF3TGpVM09ERTFOaUF3TGpJeU1qQTJOa013TGpVM01UWTNOQ0F3TGpJeU1qQTJOaUF3TGpVMk5qUXlNaUF3TGpJeU56TXhPU0F3TGpVMk5qUXlNaUF3TGpJek16YzVPVXd3TGpVMk5qUXlPU0F3TGpJM01ERTNNVU13TGpVME16UTBOQ0F3TGpJM05EZ3pOQ0F3TGpVeU5UTXpOeUF3TGpJNU1qa3pOU0F3TGpVeU1EWTJOQ0F3TGpNeE5Ua3hOMHd3TGpRNE5ESTRPU0F3TGpNeE5Ua3pNa3d3TGpRNE1qWTVOeUF3TGpNeE5qQTBRekF1TkRjMk9UWTVJREF1TXpFMk9ERTJJREF1TkRjeU5UVTFJREF1TXpJeE56STFJREF1TkRjeU5UVTFJREF1TXpJM05qWTFUREF1TkRjeU5qWXlJREF1TXpJNU1qVTNRekF1TkRjek5ETTRJREF1TXpNME9UZzFJREF1TkRjNE16UTRJREF1TXpNNU16azVJREF1TkRnME1qZzVJREF1TXpNNU16azVUREF1TlRFNU5EZzVJREF1TXpNNU16Z3pWakF1TXpZMk56WXhUREF1TkRnME1qZzVJREF1TXpZMk56YzJUREF1TkRneU5qazNJREF1TXpZMk9EZzBRekF1TkRjMk9UWTVJREF1TXpZM05qWXhJREF1TkRjeU5UVTFJREF1TXpjeU5UY2dNQzQwTnpJMU5UVWdNQzR6TnpnMU1Vd3dMalEzTWpZMk1pQXdMak00TURFd01rTXdMalEzTXpRek9DQXdMak00TlRneU9TQXdMalEzT0RNME9DQXdMak01TURJME15QXdMalE0TkRJNE9TQXdMak01TURJME0wd3dMalV4T1RRNE9TQXdMak01TURJeU4xWXdMalF4TnpZd05Vd3dMalE0TkRJNE9TQXdMalF4TnpZeU1Vd3dMalE0TWpZNU55QXdMalF4TnpjeU9FTXdMalEzTmprMk9TQXdMalF4T0RVd05TQXdMalEzTWpVMU5TQXdMalF5TXpReE5DQXdMalEzTWpVMU5TQXdMalF5T1RNMU5FTXdMalEzTWpVMU5TQXdMalF6TlRnek5DQXdMalEzTnpnd09DQXdMalEwTVRBNE55QXdMalE0TkRJNE9TQXdMalEwTVRBNE4wd3dMalV5TURZMk1pQXdMalEwTVRBNE4wTXdMalV5TlRNeU9DQXdMalEyTkRBM055QXdMalUwTXpRek9DQXdMalE0TWpFNE5TQXdMalUyTmpReU9TQXdMalE0TmpnME9Fd3dMalUyTmpReU1pQXdMalV5TXpJeU1Vd3dMalUyTmpVeU9DQXdMalV5TkRneE0wTXdMalUyTnpNd055QXdMalV6TURVMElEQXVOVGN5TWpFMElEQXVOVE0wT1RVMElEQXVOVGM0TVRVMklEQXVOVE0wT1RVMFREQXVOVGM1TnpRMklEQXVOVE0wT0RRM1F6QXVOVGcxTkRjMElEQXVOVE0wTURjZ01DNDFPRGs0T0RnZ01DNDFNamt4TmlBd0xqVTRPVGc0T0NBd0xqVXlNekl5TVZZd0xqUTRPREF3TlVnd0xqWXhOekkxVERBdU5qRTNNalkySURBdU5USXpNakl4VERBdU5qRTNNemN6SURBdU5USTBPREV6UXpBdU5qRTRNVFV4SURBdU5UTXdOVFFnTUM0Mk1qTXdOVGdnTUM0MU16UTVOVFFnTUM0Mk1qa2dNQzQxTXpRNU5UUk1NQzQyTXpBMU9TQXdMalV6TkRnME4wTXdMall6TmpNeE9DQXdMalV6TkRBM0lEQXVOalF3TnpNeUlEQXVOVEk1TVRZZ01DNDJOREEzTXpJZ01DNDFNak15TWpGTU1DNDJOREEzTVRjZ01DNDBPRGd3TURWSU1DNDJOamd4TVZZd0xqVXlNekl5TVV3d0xqWTJPREl4TnlBd0xqVXlORGd4TTBNd0xqWTJPRGs1TlNBd0xqVXpNRFUwSURBdU5qY3pPVEF6SURBdU5UTTBPVFUwSURBdU5qYzVPRFEwSURBdU5UTTBPVFUwUXpBdU5qZzJNekl6SURBdU5UTTBPVFUwSURBdU5qa3hOVGMySURBdU5USTVOekF4SURBdU5qa3hOVGMySURBdU5USXpNakl4VERBdU5qa3hOVGcySURBdU5EZzJPRFExUXpBdU56RTBOVFl6SURBdU5EZ3lNVGMzSURBdU56TXlOalkwSURBdU5EWTBNRGM0SURBdU56TTNNek16SURBdU5EUXhNVXd3TGpjM016Y3hJREF1TkRReE1EZzNUREF1TnpjMU16QXpJREF1TkRRd09UaERNQzQzT0RFd01qa2dNQzQwTkRBeU1ETWdNQzQzT0RVME5ESWdNQzQwTXpVeU9UUWdNQzQzT0RVME5ESWdNQzQwTWprek5UUk1NQzQzT0RVek16WWdNQzQwTWpjM05qSkRNQzQzT0RRMU5Ua2dNQzQwTWpJd016VWdNQzQzTnprMk5TQXdMalF4TnpZeU1TQXdMamMzTXpjeElEQXVOREUzTmpJeFNEQXVOek00TlRGV01DNHpPVEF5TkROSU1DNDNOek0zTVV3d0xqYzNOVE13TXlBd0xqTTVNREV6TmtNd0xqYzRNVEF5T1NBd0xqTTRPVE0xT1NBd0xqYzROVFEwTWlBd0xqTTRORFExSURBdU56ZzFORFF5SURBdU16YzROVEZNTUM0M09EVXpNellnTUM0ek56WTVNVGhETUM0M09EUTFOVGtnTUM0ek56RXhPVEVnTUM0M056azJOU0F3TGpNMk5qYzNOaUF3TGpjM016Y3hJREF1TXpZMk56YzJTREF1TnpNNE5URldNQzR6TXprek9UbElNQzQzTnpNM01Vd3dMamMzTlRNd015QXdMak16T1RJNU1rTXdMamM0TVRBeU9TQXdMak16T0RVeE5TQXdMamM0TlRRME1pQXdMak16TXpZd05pQXdMamM0TlRRME1pQXdMak15TnpZMk5VTXdMamM0TlRRME1pQXdMak15TVRFNE5pQXdMamM0TURFNUlEQXVNekUxT1RNeUlEQXVOemN6TnpFZ01DNHpNVFU1TXpKTU1DNDNNemN6TXpjZ01DNHpNVFU1TXpWRE1DNDNNekkyTnpJZ01DNHlPVEk1TlNBd0xqY3hORFUyT1NBd0xqSTNORGcwTXlBd0xqWTVNVFU0TmlBd0xqSTNNREUzTlV3d0xqWTVNVFUzTmlBd0xqSXpNemM1T1V3d0xqWTVNVFEyT1NBd0xqSXpNakl3TjFwTk1DNDFOREk1TlRVZ01DNHpNamMyTmpWRE1DNDFOREk1TlRVZ01DNHpNRGd5TWpVZ01DNDFOVGczTVRRZ01DNHlPVEkwTmpZZ01DNDFOemd4TlRZZ01DNHlPVEkwTmpaSU1DNDJOems0TkRSRE1DNDJPVGt5T0RRZ01DNHlPVEkwTmpZZ01DNDNNVFV3TkRRZ01DNHpNRGd5TWpVZ01DNDNNVFV3TkRRZ01DNHpNamMyTmpWV01DNDBNamt6TlRSRE1DNDNNVFV3TkRRZ01DNDBORGczT1RRZ01DNDJPVGt5T0RRZ01DNDBOalExTlRRZ01DNDJOems0TkRRZ01DNDBOalExTlRSSU1DNDFOemd4TlRaRE1DNDFOVGczTVRRZ01DNDBOalExTlRRZ01DNDFOREk1TlRVZ01DNDBORGczT1RRZ01DNDFOREk1TlRVZ01DNDBNamt6TlRSV01DNHpNamMyTmpWYVRUQXVOamMyTURFZ01DNHpOemcxT0RkRE1DNDJOell3TVNBd0xqTTFNalkyTmlBd0xqWTFORGs1TnlBd0xqTXpNVFkxTkNBd0xqWXlPVEEzTmlBd0xqTXpNVFkxTkVNd0xqWXdNekUxTlNBd0xqTXpNVFkxTkNBd0xqVTRNakUwTkNBd0xqTTFNalkyTmlBd0xqVTRNakUwTkNBd0xqTTNPRFU0TjBNd0xqVTRNakUwTkNBd0xqUXdORFV3T0NBd0xqWXdNekUxTlNBd0xqUXlOVFV5SURBdU5qSTVNRGMySURBdU5ESTFOVEpETUM0Mk5UUTVPVGNnTUM0ME1qVTFNaUF3TGpZM05qQXhJREF1TkRBME5UQTRJREF1TmpjMk1ERWdNQzR6TnpnMU9EZGFUVEF1TmpBMU5qRWdNQzR6TnpnMU9EZERNQzQyTURVMk1TQXdMak0yTlRZeU55QXdMall4TmpFeE5pQXdMak0xTlRFeUlEQXVOakk1TURjMklEQXVNelUxTVRKRE1DNDJOREl3TXpZZ01DNHpOVFV4TWlBd0xqWTFNalUwTWlBd0xqTTJOVFl5TnlBd0xqWTFNalUwTWlBd0xqTTNPRFU0TjBNd0xqWTFNalUwTWlBd0xqTTVNVFUwTnlBd0xqWTBNakF6TmlBd0xqUXdNakExTXlBd0xqWXlPVEEzTmlBd0xqUXdNakExTTBNd0xqWXhOakV4TmlBd0xqUXdNakExTXlBd0xqWXdOVFl4SURBdU16a3hOVFEzSURBdU5qQTFOakVnTUM0ek56ZzFPRGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPVGcwTmpFMUlpQm9aV2xuYUhROUlqQXVPVGcwTmpFMUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DQXdMakF4TlRNNE1Ea3BJaTgrSmlONFlUczhMMk5zYVhCUVlYUm9QaVlqZUdFN1BDOWtaV1p6UGlZamVHRTdQQzl6ZG1jKzt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iODkiIHk9IjI4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjE5IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQiIHN0eWxlPSJpci5yZWY9YWExMTAyZTctMjJhNC00N2Q0LTk1ZTUtZjI4OWFiOTIxM2I3O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPWdlbmVyaWMtY2xpZW50O2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzR5TlRZek16Y2dNQzQyT1RReU9USkRNQzR5TkRFME55QXdMalk1TkRJNU1pQXdMakl5TnpnNE5pQXdMalk0T0Rnd015QXdMakl4TnpVd01pQXdMalkzT1RjME0wTXdMakl4TVRreElEQXVOamMwT0RZMElEQXVNakEzTWpRMklEQXVOalk0T1RRNUlEQXVNakF6T0RFZ01DNDJOakl5T1RoRE1DNHhPVGsyTWpRZ01DNDJOVFF4T1RVZ01DNHhPVGN5TmpFZ01DNDJORFE1T1RrZ01DNHhPVGN5TmpFZ01DNDJNelV5TlRGV01DNHlPREV4TmpoRE1DNHhPVGN5TmpFZ01DNHlORGcxTmlBd0xqSXlNemN4SURBdU1qSXlNVEkzSURBdU1qVTJNek0zSURBdU1qSXlNVEkzVERBdU5qTTBORFEzSURBdU1qSXlNVEkzVERBdU5UazFOakEzSURBdU1UWXpNRGcyVERBdU1qVTJNek0zSURBdU1UWXpNRGcyUXpBdU1Ua3hNRGd6SURBdU1UWXpNRGcySURBdU1UTTRNVGcwSURBdU1qRTFPVFV6SURBdU1UTTRNVGcwSURBdU1qZ3hNVFk0VmpBdU5qTTFNalV4UXpBdU1UTTRNVGcwSURBdU5qUTRNemN6SURBdU1UUXdNekkySURBdU5qWXdPVGsySURBdU1UUTBNamM1SURBdU5qY3lOemc1UXpBdU1UVXdNVFE1SURBdU5qa3dNams0SURBdU1UWXdNREV6SURBdU56QTFPVGM0SURBdU1UY3lOemtnTUM0M01UZzNORGRETUM0eE9UUXhOeklnTUM0M05EQXhNVFlnTUM0eU1qTTNNU0F3TGpjMU16TXpNeUF3TGpJMU5qTXpOeUF3TGpjMU16TXpNMGd3TGpNM05EYzROMVl3TGpneE16QXdOVXd3TGpJNE5qSXlPU0F3TGpneE16QXdOVU13TGpJMk9Ua3hOaUF3TGpneE16QXdOaUF3TGpJMU5qWTVNU0F3TGpneU5qSXlNaUF3TGpJMU5qWTVNU0F3TGpnME1qVXlOa013TGpJMU5qWTVNU0F3TGpnMU9EZ3pJREF1TWpZNU9URTJJREF1T0RjeU1EUTJJREF1TWpnMk1qTWdNQzQ0TnpJd05EWk1NQzQyT1RrMU5DQXdMamczTWpBME0wTXdMamN4TlRnMU5DQXdMamczTWpBME15QXdMamN5T1RBM09TQXdMamcxT0RneU5pQXdMamN5T1RBM09TQXdMamcwTWpVeU1rTXdMamN5T1RBM09DQXdMamd5TmpJeE9TQXdMamN4TlRnMU15QXdMamd4TXpBd01pQXdMalk1T1RVMElEQXVPREV6TURBeVREQXVOakV3T1RjeUlEQXVPREV6TURBelZqQXVOelV6TXpNelNEQXVOekk0T1RVelF6QXVOelF5T0RVeklEQXVOelV6TXpNeklEQXVOelUyTVRreklEQXVOelV3T1RNMElEQXVOelk0TlRnZ01DNDNORFkxTWpkRE1DNDRNRGN3TnpVZ01DNDNNekk0TXpVZ01DNDRNell6TnpFZ01DNDJPVGszTlRjZ01DNDRORFEzTURZZ01DNDJOVGt3TkRsRE1DNDRORFl5T0NBd0xqWTFNVE0yTWlBd0xqZzBOekV3TnlBd0xqWTBNelF3TXlBd0xqZzBOekV3TnlBd0xqWXpOVEkxTVZZd0xqSTRNVEUyTjBNd0xqZzBOekV3TnlBd0xqSXhOVGsxTXlBd0xqYzVOREl3TnlBd0xqRTJNekE0TmlBd0xqY3lPRGsxTXlBd0xqRTJNekE0Tmtnd0xqVTVOVFl3TjB3d0xqWXpORFEwTnlBd0xqSXlNakV5TjBnd0xqY3lPRGsxTTBNd0xqYzJNVFU0SURBdU1qSXlNVEkzSURBdU56ZzRNRE1nTUM0eU5EZzFOaUF3TGpjNE9EQXpJREF1TWpneE1UWTNWakF1TmpNMU1qVXhRekF1TnpnNE1ETWdNQzQyTkRRNU9Ua2dNQzQzT0RVMk5qWWdNQzQyTlRReE9UVWdNQzQzT0RFME9DQXdMalkyTWpJNU9FTXdMamMzTkRJNE9TQXdMalkzTmpJeE9DQXdMamMyTVRjeU1TQXdMalk0TmpreE15QXdMamMwTmpVeU1TQXdMalk1TVRZek4wTXdMamMwTURrM01TQXdMalk1TXpNMk1pQXdMamN6TlRBM01TQXdMalk1TkRJNU1pQXdMamN5T0RrMU15QXdMalk1TkRJNU1rZ3dMakkxTmpNek4xcE5NQzQwTXpNNE5qUWdNQzQ0TVRNd01EUk1NQzQxTlRFNE9UVWdNQzQ0TVRNd01ETldNQzQzTlRNek16TklNQzQwTXpNNE5qUldNQzQ0TVRNd01EUmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d01EQXlORFF4TkRFZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p3dlpHVm1jejRtSTNoaE96d3ZjM1puUGc9PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7IiBwYXJlbnQ9IjQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNDEzIiB5PSIyOCIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IlJpY2ggQ2xpZW50IC0+IFNBUCBSb3V0ZXIiIHN0eWxlPSJpci5yZWY9NWVjN2M3ODMtYzQ1OS00OTAwLTgyMTYtODI1ZDM4ODZmMGMwO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjc1O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTgiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iQnJvd3NlciAtPiBTQVAgUm91dGVyIiBzdHlsZT0iaXIucmVmPWQ2NTQyODEyLTYyMmUtNGFlNi05ZjUwLTI2YzE2NTc0M2VkYztlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0xO2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjkiIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIyIiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gU0FQIFJvdXRlciIgc3R5bGU9ImlyLnJlZj1hODk3NzI2Ni04ZGM4LTQzMDMtODA4My1lZGVkOWMxMWMyZDI7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxOSIgdGFyZ2V0PSI1IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iMjMiIHZhbHVlPSJSaWNoIENsaWVudCAtPiBTQVAgUm91dGVyIiBzdHlsZT0iaXIucmVmPWI0M2U3N2E0LTI4MmUtNDMwMy1hMWZiLTg2MDZmYWIwODI4OTtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE2IiB0YXJnZXQ9IjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyNCIgdmFsdWU9IkJyb3dzZXIgLT4gU0FQIFJvdXRlciIgc3R5bGU9ImlyLnJlZj00MmNhMTliZC1kNDZhLTQ0MDUtOWQ0MC1jZjE0MTFlN2I0NGU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSI4IiB0YXJnZXQ9IjUiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyOCIgdmFsdWU9IkdlbmVyaWMgQ2xpZW50IC0+IFNBUCBSb3V0ZXIiIHN0eWxlPSJpci5yZWY9Y2QxMmYzNTctYmQ5My00ZDBlLTg1ZGQtMzRkNjEyYjg5N2M3O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iMTciIHRhcmdldD0iNSIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjI5IiB2YWx1ZT0iR2VuZXJpYyBDbGllbnQgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj05NTEwMzgyOC05YjU0LTQwYzMtOWRmMi0wZTdhNjUyMjljYTE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjE3IiB0YXJnZXQ9IjYiIGVkZ2U9IjEiPjxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIzMCIgdmFsdWU9IkJyb3dzZXIgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj0wY2ZiMjZiMC03ZWY4LTRlOGYtODU4Zi0zMmUxMGZmNjNmODY7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSIxIiBzb3VyY2U9IjgiIHRhcmdldD0iNiIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iUmljaCBDbGllbnQgLT4gR0NQIFZQTiIgc3R5bGU9ImlyLnJlZj0zY2JhZTc5OC00MDA3LTQ5YTctYWU2Zi0xZTZmODIwOGZmMmU7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iMSIgc291cmNlPSIxNiIgdGFyZ2V0PSI2IiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="100"/>
+    <trustZone ref="public" uuid="6376d53e-6461-412b-8e04-7b3fe2b397de" name="Public" desc="Untrusted public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="60"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Browser -&gt; GCP VPN" ref="0cfb26b0-7ef8-4e8f-858f-32e10ff63f86" source="00449516-33db-479d-a201-3582f48fd42b" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Rich Client -&gt; GCP VPN" ref="3cbae798-4007-49a7-ae6f-1e6f8208ff2e" source="b740e9e6-5afd-46b4-aecc-6037cfd51e04" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Browser -&gt; SAP Router" ref="42ca19bd-d46a-4405-9d40-cf1411e7b44e" source="00449516-33db-479d-a201-3582f48fd42b" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Rich Client -&gt; SAP Router" ref="5ec7c783-c459-4900-8216-825d3886f0c0" source="91280f47-7175-45c8-9dc4-6e3692293927" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="SAP CI + WD + HANA -&gt; GCP Storage" ref="606086c1-07ce-4e9a-9565-6e40855d2faf" source="9f247536-92d4-42dc-8f7a-0d5b8da02525" target="63f25813-9611-4061-8a55-7e8d91ebbf0e">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="SAP Router -&gt; SAP CI + WD + HANA" ref="6e216062-b498-4ce6-a8bd-2b30c73c2adb" source="d78e6be7-fa53-4f74-b420-98ea83d4c688" target="9f247536-92d4-42dc-8f7a-0d5b8da02525">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="GCP VPN -&gt; Bastion Server" ref="853afe54-da0a-4327-8208-0de4689eb644" source="eabd8d49-ff06-4c69-b250-3017f4f79c31" target="ce03b78b-c465-485b-ad9a-3e72ab140581">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; GCP VPN" ref="95103828-9b54-40c3-9df2-0e7a65229ca1" source="6dd70f5e-d8b5-4c38-94de-192c64730327" target="eabd8d49-ff06-4c69-b250-3017f4f79c31">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; SAP Router" ref="a8977266-8dc8-4303-8083-eded9c11c2d2" source="9ced54cb-300b-4cea-9dba-c1eb433ee864" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Rich Client -&gt; SAP Router" ref="b43e77a4-282e-4303-a1fb-8606fab08289" source="b740e9e6-5afd-46b4-aecc-6037cfd51e04" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Bastion Server -&gt; SAP CI + WD + HANA" ref="c958ca25-beea-4fa3-8a87-7de2292ed248" source="ce03b78b-c465-485b-ad9a-3e72ab140581" target="9f247536-92d4-42dc-8f7a-0d5b8da02525">
+      <assets/>
+      <tags>
+        <tag tag="admin"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Generic Client -&gt; SAP Router" ref="cd12f357-bd93-4d0e-85dd-34d612b897c7" source="6dd70f5e-d8b5-4c38-94de-192c64730327" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Browser -&gt; SAP Router" ref="d6542812-622e-4ae6-9f50-26c165743edc" source="2a4f86ab-abb0-449b-a498-d403a62a3948" target="d78e6be7-fa53-4f74-b420-98ea83d4c688">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Bastion Server -&gt; GCP Storage" ref="e28d5d30-80f0-48fb-b9a3-cc59d2d91edc" source="ce03b78b-c465-485b-ad9a-3e72ab140581" target="63f25813-9611-4061-8a55-7e8d91ebbf0e">
+      <assets/>
+      <tags/>
+    </dataflow>
+  </dataflows>
+  <customFields>
+    <customField ref="project-owner" value=""/>
+  </customFields>
+  <components>
+    <component uuid="9c986469-36ab-49d0-94ab-de5a0e3311f7" diagramComponentId="8c3c7420-02d7-49c2-8ebe-2d8813b86270" ref="ce03b78b-c465-485b-ad9a-3e72ab140581" name="Bastion Server" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.847">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
+&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
+&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
+&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
+&lt;p&gt;gcloud components update&lt;/p&gt; 
+&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
+&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
+&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
+&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
+&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
+
+	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
+
+	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
+
+
+	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
+  -query-path="hostkeys/" \
+  -zone=ZONE&lt;br /&gt;
+Replace the following:&lt;/p&gt;
+
+	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
+- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
+
+
+	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
+
+	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
+2. Select serial port 1.&lt;br /&gt;
+3. Search for the following message:&lt;/p&gt;
+
+	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
+
+	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.790">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="bbda0c87-b2aa-4919-9cd0-4965c21a6fe8" diagramComponentId="16761c47-d214-42ce-b89e-8fac6e439de0" ref="eabd8d49-ff06-4c69-b250-3017f4f79c31" name="GCP VPN" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-VPN">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to open ports is most likely an attack. To avoid this, access to the network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.631">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPN2" name="Define monitoring alerts for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Define monitoring alerts for Cloud VPN&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; To view metrics and create alerts related to your VPN tunnels, use Cloud Monitoring.&lt;br&gt; In addition to the predefined dashboards in Cloud Monitoring, you can create custom dashboards, set up alerts, and query the metrics by using the Monitoring API or the Cloud Console.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; You can create alerting policies to monitor the values of metrics and to notify you when those metrics violate a condition.&lt;/p&gt; 
+&lt;p&gt;To create an alerting policy that monitors one or more Cloud VPN gateway resources, follow these steps:&lt;/p&gt; 
+&lt;p&gt;1. In the Google Cloud Console, go to the Monitoring page.&lt;br&gt; 2. In the Monitoring navigation pane, select notificationsAlerting, and then select Create policy.&lt;br&gt; 3. If the button Return to Legacy UI is displayed and if you want to follow these instructions, then click it. You can create an alerting policy by using the Preview interface; however, these instructions are for the Legacy UI.&lt;br&gt; 4. Click Add condition:&lt;br&gt; a. The settings in the Target pane specify the resource and metric to be monitored. In the Find resource type and metric field, select the resource Cloud VPN gateway. Next, select a metric from the metrics list.&lt;br&gt; b. The settings in the Configuration pane of the alerting policy determine when the alert is triggered. Most fields in this pane are populated with default values.&lt;br&gt; c. Click Add.&lt;br&gt; 5. To advance to the notifications section, click Next.&lt;br&gt; 6. Optional: To add notifications to your alerting policy, click Notification channels. In the dialog, select one or more notification channels from the menu, and then click OK.&lt;br&gt; If a notification channel that you want to add isn't listed, then click Manage notification channels. You are taken to the Notification channels page in a new browser tab. From this page, you can update the configured notification channels. After you have completed your updates, return to the original tab, click autorenewRefresh, and then select the notification channels to add to the alerting policy.&lt;br&gt; 7. To advance to the documentation section, click Next.&lt;br&gt; 8. Click Name and enter a name for the alerting policy.&lt;br&gt; 9. Optional: Click Documentation, and then add any information that you want included in a notification message.&lt;br&gt; 10. Click Save.&lt;/p&gt; 
+&lt;p&gt;Define alerts for VPN tunnel bandwidth&lt;/p&gt; 
+&lt;p&gt;To create alerting policies for the bytes per second (bps) and packets per second (pps) limits described in Network bandwidth, use Monitoring Query Language (MQL).&lt;/p&gt; 
+&lt;p&gt;When entering your queries, follow the instructions in Creating MQL alerting policies (console) and see the following examples:&lt;/p&gt; 
+&lt;p&gt;- Query for bps: This example query notifies you when the sum of sent_bytes_count and received_bytes_count exceeds 80% of the 3-Gbps (375 MBps) limit for a given VPN tunnel. "MBy" specifies megabytes as the unit of measurement. The value of 300 "MBy" is automatically scaled to compare to val(), which has the unit "Bytes". Please note that the align rate should be scaled appropriately to capture the necessary data. It can be set to as low as (1s), and scaled higher, if more data sampling points over a longer period of days, are needed.&lt;/p&gt; 
+&lt;p&gt;fetch vpn_gateway | { metric vpn.googleapis.com/network/sent_bytes_count &lt;/p&gt;
+&lt;dl&gt; 
+ &lt;dt&gt;
+  metric vpn.googleapis.com/network/received_bytes_count } | align rate (1m) | filter (metric.tunnel_name == 'TUNNEL_NAME') | outer_join 0,0 | value val(0) + val(1) | condition val() &amp;gt; 300 "MBy/s"
+ &lt;/dt&gt; 
+&lt;/dl&gt;
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;- Query for pps: This example query notifies you when the sum of sent_packets_count and received_packets_count exceeds 80% of the maximum recommended packet rate of 250,000 pps for a given VPN tunnel.&lt;/p&gt; 
+&lt;p&gt;fetch vpn_gateway | { metric vpn.googleapis.com/network/sent_packets_count &lt;/p&gt;
+&lt;dl&gt; 
+ &lt;dt&gt;
+  metric vpn.googleapis.com/network/received_packets_count } | filter (metric.tunnel_name == 'TUNNEL_NAME') | outer_join 0,0 | value val(0) + val(1) | condition val() &amp;gt; 200000
+ &lt;/dt&gt; 
+&lt;/dl&gt;
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="View logs and metrics" url="https://cloud.google.com/network-connectivity/docs/vpn/how-to/viewing-logs-metrics"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;View alerting policy&lt;/p&gt;
+
+	&lt;p&gt;1. In the Cloud Console, select Monitoring.&lt;/p&gt;
+
+	&lt;p&gt;2. In the navigation pane, select notifications Alerting.&lt;/p&gt;
+
+	&lt;p&gt;3. To see all policies and to enable filtering, click See all policies in the Policies pane.&lt;/p&gt;
+
+	&lt;p&gt;4. Find the policy that you want to view, and then select it.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPN1" name="Enable Firewall Rules Logging for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Firewall Rules Logging for Cloud VPN&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Logging is also useful if you need to determine how many connections are affected by a given firewall rule.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling firewall rules logging&lt;/p&gt; 
+&lt;p&gt;1. Go to the Firewall page in the Google Cloud Console.&lt;br&gt; 2. In the Logs column, determine if firewall logging is on or off for each firewall rule.&lt;br&gt; 3. To enable logging for one or more firewall rules, select the checkbox next to each one.&lt;br&gt; 4. In the Firewall rules action bar, click Configure logs.&lt;br&gt; 5. In the Configure logs dialog, select On.&lt;br&gt; 6. To omit the metadata fields, expand Logs details and then clear Include metadata.&lt;br&gt; 7. Click Save configuration.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using Firewall Rules Logging" url="https://cloud.google.com/vpc/docs/using-firewall-rules-logging"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Viewing logs&lt;/p&gt;
+
+	&lt;p&gt;Firewall rule logs are created in the project that hosts the network containing the VM instances and firewall rules. With Shared VPC, VM instances are created in service projects, but they use a Shared VPC Network located in the host project. Firewall rules logs are stored in that host project.&lt;/p&gt;
+
+	&lt;p&gt;Use the Logs section of the Cloud Console to view firewall rule logs.&lt;/p&gt;
+
+	&lt;p&gt;The following filters demonstrate how you can search for specific firewall events.&lt;/p&gt;
+
+	&lt;p&gt;All firewall logs&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. Select Subnetwork in the first pull-down menu.&lt;br /&gt;
+3. Select compute.googleapis.com/firewall in the second pull-down menu.&lt;br /&gt;
+4. Click OK.&lt;/p&gt;
+
+	&lt;p&gt;Alternatively:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
+3. Paste the following into the field. Replace PROJECT_ID with your project ID.&lt;/p&gt;
+
+	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
+logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;/p&gt;
+
+
+	&lt;p&gt;Specific subnets&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. In the first pull-down menu, move the cursor to Subnetwork, then move it to the right to open up the individual subnet selection menu.&lt;br /&gt;
+3. In the second pull-down menu, select compute.googleapis.com/firewall.&lt;br /&gt;
+4. Click OK.&lt;/p&gt;
+
+	&lt;p&gt;Alternatively:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
+3. Paste the following into the field. Replace PROJECT_ID with your project ID and SUBNET_NAME with your subnetwork.&lt;/p&gt;
+
+	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
+logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
+resource.labels.subnetwork_name="SUBNET_NAME"&lt;/p&gt;
+
+
+	&lt;p&gt;Specific VMs&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
+3. Paste the following into the field. Replace PROJECT_ID with your project ID and INSTANCE_NAME with your VM.&lt;/p&gt;
+
+	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
+logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
+jsonPayload.instance.vm_name="INSTANCE_NAME"&lt;/p&gt;
+
+
+	&lt;p&gt;Connections from a specific country&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud Console.&lt;br /&gt;
+2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
+3. Paste the following into the field. Replace PROJECT_ID with your project ID and COUNTRY with the ISO 3166-1 alpha-3 code.&lt;/p&gt;
+
+	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
+logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"&lt;br /&gt;
+jsonPayload.remote_location.country=COUNTRY&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.573">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPN4" name="Generate a strong pre-shared key for Cloud VPN" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Generate a strong pre-shared key for Cloud VPN&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; You can use a pre-shared key (also called a shared secret or PSK) to authenticate the Cloud VPN tunnel to your peer VPN gateway. As a security best practice, Google Cloud recommends that you generate a strong 32-character pre-shared key.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Generation methods&lt;/p&gt; 
+&lt;p&gt;Use the following methods to generate a strong 32-character pre-shared key.&lt;/p&gt; 
+&lt;p&gt;OpenSSL&lt;/p&gt; 
+&lt;p&gt;On a Linux or macOS system, run the following OpenSSL command:&lt;/p&gt; 
+&lt;p&gt;openssl rand -base64 24&lt;/p&gt; 
+&lt;p&gt;/dev/urandom&lt;/p&gt; 
+&lt;p&gt;On a Linux or macOS system, you can also use /dev/urandom as a pseudorandom source to generate a pre-shared key:&lt;/p&gt; 
+&lt;p&gt;- On Linux or macOS, send the random input to base64:&lt;/p&gt; 
+&lt;p&gt;head -c 24 /dev/urandom | base64&lt;/p&gt; 
+&lt;p&gt;Pass the random input through a hashing function, such as sha256:&lt;/p&gt; 
+&lt;p&gt;- On Linux:&lt;/p&gt; 
+&lt;p&gt;head -c 4096 /dev/urandom | sha256sum | cut -b1-32&lt;/p&gt; 
+&lt;p&gt;- On macOS:&lt;/p&gt; 
+&lt;p&gt;head -c 4096 /dev/urandom | openssl sha256 | cut -b1-32&lt;/p&gt; 
+&lt;p&gt;JavaScript&lt;/p&gt; 
+&lt;p&gt;You can generate the pre-shared key directly in a document by using JavaScript with the W3C Web Cryptography API. This API uses the Crypto.getRandomValues() method, which provides a cryptographically sound way of generating a pre-shared key.&lt;/p&gt; 
+&lt;p&gt;The following code creates an array of 24 random bytes, and then base64 encodes those bytes to produce a random 32-character string:&lt;/p&gt; 
+&lt;p&gt;var a = new Uint8Array(24);&lt;br&gt; window.crypto.getRandomValues(a);&lt;/p&gt; 
+&lt;p&gt;console.log(btoa(String.fromCharCode.apply(null, a)));&lt;/p&gt; 
+&lt;p&gt;Generated for you&lt;/p&gt; 
+&lt;p&gt;Your browser generates a random string by using the JavaScript snippet at the end of this page. It is 24 bytes from Crypto.getRandomValues, and is base64-encoded to create a 32-character pre-shared key. For more information, please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Generate a strong pre-shared key" url="https://cloud.google.com/network-connectivity/docs/vpn/how-to/generating-pre-shared-key"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that a strong pre-shared key is generated for Cloud VPN.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPN3" name="Set up firewall rules for Cloud VPN gateways" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Set up firewall rules for Cloud VPN gateways&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; VPC firewall rules let you allow or deny connections to or from your virtual machine (VM) instances based on a configuration that you specify. Enabled VPC firewall rules are always enforced, protecting your instances regardless of their configuration and operating system, even if they have not started up.&lt;br&gt; Every VPC network functions as a distributed firewall. While firewall rules are defined at the network level, connections are allowed or denied on a per-instance basis. You can think of the VPC firewall rules as existing not only between your instances and other networks, but also between individual instances within the same network.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Creating firewall rules&lt;/p&gt; 
+&lt;p&gt;1. Go to the Firewall page in the Google Cloud Console.&lt;br&gt; 2. Click Create firewall rule.&lt;br&gt; 3. Enter a Name for the firewall rule.&lt;br&gt; This name must be unique for the project.&lt;br&gt; 4. (Optional) You can enable firewall rules logging:&lt;br&gt; - Click Logs &amp;gt; On.&lt;br&gt; - To omit metadata, expand Logs details and then clear Include metadata.&lt;br&gt; 5. Specify the Network for the firewall rule.&lt;br&gt; 6. Specify the Priority of the rule.&lt;br&gt; The lower the number, the higher the priority.&lt;br&gt; 7. For the Direction of traffic, choose ingress or egress.&lt;br&gt; 8. For the Action on match, choose allow or deny.&lt;br&gt; 9. Specify the Targets of the rule.&lt;br&gt; - If you want the rule to apply to all instances in the network, choose All instances in the network.&lt;br&gt; - If you want the rule to apply to select instances by network (target) tags, choose Specified target tags, then type the tags to which the rule should apply into the Target tags field.&lt;br&gt; - If you want the rule to apply to select instances by associated service account, choose Specified service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Target service account field.&lt;br&gt; 10. For an ingress rule, specify the Source filter:&lt;br&gt; - Choose IP ranges and type the CIDR blocks into the Source IP ranges field to define the source for incoming traffic by IP address ranges. Use 0.0.0.0/0 for a source from any network.&lt;br&gt; - To limit source by network tag, choose Source tags, then type the network tags in to the Source tags field. For the limit on the number of source tags, see Per network limits. Filtering by source tag is only available if the target is not specified by service account. For more information, see filtering by service account versus network tag.&lt;br&gt; - To limit source by service account, choose Service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Source service account field. Filtering by source service account is only available if the target is not specified by network tag. For more information, see filtering by service account versus network tag.&lt;br&gt; - Specify a Second source filter if desired. Secondary source filters cannot use the same filter criteria as the primary one. Source IP ranges can be used together with Source tags or Source service account. The effective source set is the union of the source range IP addresses and the instances identified by network tags or service accounts. That is, if either the source IP range, or the source tags (or source service accounts) match the filter criteria, the source is included in the effective source set.&lt;br&gt; - Source tags and Source service account can't be used together.&lt;br&gt; 11. For an egress rule, specify the Destination filter:&lt;br&gt; - Choose IP ranges and type the CIDR blocks into the Destination IP ranges field to define the destination for outgoing traffic by IP address ranges. Use 0.0.0.0/0 to mean everywhere.&lt;br&gt; 12. Define the Protocols and ports to which the rule applies:&lt;br&gt; - Select Allow all or Deny all, depending on the action, to have the rule apply to all protocols and destination ports.&lt;br&gt; - Define specific protocols and destination ports:&lt;br&gt; a. Select tcp to include the TCP protocol and destination ports. Enter all or a comma-delimited list of destination ports, such as 20-22, 80, 8080.&lt;br&gt; b. Select udp to include the UDP protocol and destination ports. Enter all or a comma-delimited list of destination ports, such as 67-69, 123.&lt;br&gt; c. Select Other protocols to include protocols such as icmp or sctp.&lt;br&gt; 13. (Optional) You can create the firewall rule but not enforce it by setting its enforcement state to disabled. Click Disable rule, then select Disabled.&lt;br&gt; 14. Click Create.&lt;/p&gt; 
+&lt;p&gt;For more information, please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using firewall rules" url="https://cloud.google.com/vpc/docs/using-firewalls"/>
+            <reference name="VPC firewall rules overview" url="https://cloud.google.com/vpc/docs/firewalls"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;To show all firewall rules for all networks in your project:&lt;/p&gt;
+
+	&lt;p&gt;- Go to the Firewall page in the Google Cloud Console.&lt;/p&gt;
+
+	&lt;p&gt;To show firewall rules in a particular network:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the VPC networks page in the Google Cloud Console.&lt;br /&gt;
+2. Click the Name of a VPC network to go to its details page.&lt;br /&gt;
+3. On the details page for the network, click the Firewall rules tab.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.574">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPN1" mitigation="50"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPN2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPN1" mitigation="50"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPN2" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="GOOGLE-UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers could gain an unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPN3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPN3" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPN4" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPN4" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="0070f36f-9561-41de-9ea4-7ba0f39c6cf0" diagramComponentId="34c189a9-1882-4977-9951-48f0b65221ab" ref="9f247536-92d4-42dc-8f7a-0d5b8da02525" name="SAP CI + WD + HANA" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
+&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
+&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
+&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
+&lt;p&gt;gcloud components update&lt;/p&gt; 
+&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
+&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
+&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
+&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
+&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
+
+	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
+
+	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
+
+
+	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
+  -query-path="hostkeys/" \
+  -zone=ZONE&lt;br /&gt;
+Replace the following:&lt;/p&gt;
+
+	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
+- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
+
+
+	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
+
+	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
+2. Select serial port 1.&lt;br /&gt;
+3. Search for the following message:&lt;/p&gt;
+
+	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
+
+	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.740">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="62b4d68b-934d-40cf-8f54-c7145bb31257" diagramComponentId="7e7dce8f-8939-4664-a616-00ac62c20525" ref="d78e6be7-fa53-4f74-b420-98ea83d4c688" name="SAP Router" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="CD-GOOGLE-CLOUD-COMPUTE-ENGINE">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="DATA-TRANSMIT-CLEAR" name="Data is transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>Data is not protected when transmitted to applications or customers and it can be read or modified by unauthorized actors.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.025">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" name="Store host keys as guest attributes for Compute Engine VMs" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Store host keys as guest attributes for Compute Engine VMs&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A host key is a key pair that identifies a particular host or machine. When you connect to a remote host, the host key is used to verify that you're connecting to the intended machine.&lt;br&gt; Storing SSH host keys as guest attributes improves the security of your connections by helping to protect against vulnerabilities such as man-in-the-middle (MITM) attacks. On the initial boot of a VM, if guest attributes are enabled, Compute Engine stores your generated host keys as guest attributes. After that, Compute Engine uses these stored host keys to verify all subsequent connections to the VM.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; To store host guest attributes, complete the following steps:&lt;/p&gt; 
+&lt;p&gt;1. After you enable guest attributes for a project or VM, the Guest OS agent automatically publishes the host key as a guest attribute. If you use gcloud compute ssh instead of a plain SSH client, then the gcloud CLI automatically reads the attributes and updates the known_hosts file the next time you connect.&lt;/p&gt; 
+&lt;p&gt;2. Before you boot your VM for the first time, enable guest attributes either on select VMs during VM creation or on your entire project.&lt;/p&gt; 
+&lt;p&gt;3. Connect to your VM by using gcloud compute ssh.&lt;/p&gt; 
+&lt;p&gt;a. Ensure that you have the latest version of the Google Cloud CLI:&lt;/p&gt; 
+&lt;p&gt;gcloud components update&lt;/p&gt; 
+&lt;p&gt;b. Connect to the VM:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh -project=PROJECT_ID&lt;/p&gt; \ -zone=ZONE \ VM_NAME 
+&lt;p&gt;Replace the following:&lt;/p&gt; PROJECT_ID: the ID of the project that contains the VM ZONE: the name of the zone in which the VM is located VM_NAME: the name of the VM 
+&lt;p&gt;If you have set default properties for the Google Cloud CLI, you can omit the -project and -zone flags from this command. For example:&lt;/p&gt; 
+&lt;p&gt;gcloud compute ssh VM_NAME&lt;/p&gt; 
+&lt;p&gt;c. Review the startup message. For example, a Debian operating system might display the following message:&lt;/p&gt; 
+&lt;p&gt;Writing 3 keys to YOUR_HOME_DIRECTORY/.ssh/google_compute_known_hosts&lt;br&gt; Linux host-key-2 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u3 (2019-06-16) x8&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="GCP Compute Engine storing host keys" url="https://cloud.google.com/solutions/connecting-securely"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;To confirm that host keys are stored as guest attributes for this VM, either review the host key values to verify that SSH keys are written to guest attributes for the VM (Option 1), or review the serial port for the presence of host keys (Option 2):&lt;/p&gt;
+
+	&lt;p&gt;Option 1: Review the host key values&lt;/p&gt;
+
+	&lt;p&gt;You can use the Google Cloud CLI to verify that SSH keys are written to guest attributes:&lt;/p&gt;
+
+
+	&lt;p&gt;gcloud compute instances get-guest-attributes VM_NAME \
+  -query-path="hostkeys/" \
+  -zone=ZONE&lt;br /&gt;
+Replace the following:&lt;/p&gt;
+
+	&lt;p&gt;- VM_NAME: the name of the VM&lt;br /&gt;
+- ZONE: the name of the zone in which the VM is located&lt;/p&gt;
+
+
+	&lt;p&gt;Option 2: Review the serial port&lt;/p&gt;
+
+	&lt;p&gt;1. View the serial port output.&lt;br /&gt;
+2. Select serial port 1.&lt;br /&gt;
+3. Search for the following message:&lt;/p&gt;
+
+	&lt;p&gt;INFO Wrote ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;If your image uses a supported operating system but the guest attributes setting wasn't enabled before the first VM boot, you might see the following message:&lt;/p&gt;
+
+	&lt;p&gt;Unable to write ssh-rsa host key to guest attributes&lt;/p&gt;
+
+	&lt;p&gt;This means that host keys aren't stored as guest attributes for this VM. If you want to store host keys for additional VMs that you plan to create, enable guest attributes before the first boot of the VM.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.984">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="DATA-EXPOSED-CHANNEL" name="The data is exposed through the transmission channel" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers can obtain the data through the transmitted channel because this does not have the security measures in place to protect the data&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="DATA-TRANSMIT-CLEAR">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-COMPUTE-ENGINE1" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1defa9ac-b2b7-4a06-a9ee-4339ea45389a" diagramComponentId="c4d63ff1-9bfe-418f-ba6d-1d83bc9bdbd5" ref="93f9dc70-a190-41c5-9943-76a0ce03cc41" name="GCP VPC (Virtual Private Cloud)" desc="" library="Google Cloud Platform" parentComponentRef="" componentDefinitionRef="CD-GOOGLE-CLOUD-VPC">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.562">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-NON-IDENTIFY" name="Non-identify the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>Resources are not registered in the safety net systems, and there are more unidentified resources. This can be a problem because these unidentified resources can have unknown weaknesses.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.563">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-NET-01" name="Unauthorized connection attempts on open ports" state="0" impact="100" issueId="" issueLink="">
+          <desc>Receiving unauthorized connections to open ports is most likely an attack. To avoid this, access to the network must be as restricted as possible, so that only the necessary ports are open and the minimum inbound traffic is accepted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.563">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC9" name="Configure network tags for all resources" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Configure network tags for all resources&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; A tag is simply a character string added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or instance templates. A tag is not a separate resource, so you cannot create it separately. All resources with that string are considered to have that tag. Tags enable you to make firewall rules and routes applicable to specific VM instances.&lt;br&gt; You can assign network tags to new VMs at creation time, or you can edit the set of assigned tags at any time later. You can edit network tags without stopping a VM.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Adding tags when creating a VM&lt;/p&gt; 
+&lt;p&gt;1. Go to the VM instances page.&lt;br&gt; 2. Click Create instance.&lt;br&gt; 3. Click Management, security, disks, networking, sole tenancy to open that section.&lt;br&gt; 4. Click the Networking tab.&lt;br&gt; 5. In the Network tags field, specify one or more tags, separated by commas.&lt;br&gt; 6. Populate other fields for the VM.&lt;br&gt; 7. Click Create.&lt;/p&gt; 
+&lt;p&gt;Adding tags to an existing VM&lt;/p&gt; 
+&lt;p&gt;1. Go to the VM instances page.&lt;br&gt; 2. Click an instance name.&lt;br&gt; 3. On the VM instance details page, click Edit.&lt;br&gt; 4. In the Network tags section, specify one or more tags, separated by commas.&lt;br&gt; 5. Click Save.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Configuring network tags" url="https://cloud.google.com/vpc/docs/add-remove-network-tags"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Viewing tags&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the VM instances page.&lt;br /&gt;
+2. View tags in the Network tags column.&lt;br /&gt;
+If needed, click Column display options to add the Network tags column.&lt;br /&gt;
+3. To view instances that are tagged with a specific tag, in the filter, select the property Network tags and enter the tags you want to filter on.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.429">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC2" name="Enable Firewall Rules Logging" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enable Firewall Rules Logging&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Firewall Rules Logging lets you audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule.&lt;br&gt; Google Cloud recommends as a best practice to turn on Firewall Rules Logging and use Firewall Insights to verify that firewall rules are being used in the intended way.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; Enabling firewall rules logging&lt;/p&gt; 
+&lt;p&gt;1. Go to the Firewall page in the Google Cloud console.&lt;br&gt; 2. In the Logs column, determine if firewall logging is on or off for each firewall rule.&lt;br&gt; 3. To enable logging for one or more firewall rules, select the checkbox next to each one.&lt;br&gt; 4. In the Firewall rules action bar, click Configure logs.&lt;br&gt; 5. In the Configure logs dialog, select On.&lt;br&gt; 6. To omit the metadata fields, expand Logs details and then clear Include metadata.&lt;br&gt; 7. Click Save configuration.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Firewall Rules Logging can incur costs, so you might want to consider using it selectively.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using Firewall Rules Logging" url="https://cloud.google.com/vpc/docs/using-firewall-rules-logging"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Viewing logs&lt;/p&gt;
+
+	&lt;p&gt;Firewall rule logs are created in the project that hosts the network containing the VM instances and firewall rules. With Shared VPC, VM instances are created in service projects, but they use a Shared VPC Network located in the host project. Firewall rules logs are stored in that host project.&lt;/p&gt;
+
+	&lt;p&gt;Use the Logs section of the Cloud console to view firewall rule logs.&lt;/p&gt;
+
+	&lt;p&gt;The following filters demonstrate how you can search for specific firewall events.&lt;/p&gt;
+
+	&lt;p&gt;All firewall logs&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud console.&lt;br /&gt;
+2. Select Subnetwork in the first pull-down menu.&lt;br /&gt;
+3. Select compute.googleapis.com/firewall in the second pull-down menu.&lt;br /&gt;
+4. Click OK.&lt;/p&gt;
+
+	&lt;p&gt;Alternatively:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the Logs Explorer in the Google Cloud console.&lt;br /&gt;
+2. In right side of the Filter by label or text search field, click the down arrow and select Convert to advanced filter.&lt;br /&gt;
+3. Paste the following into the field. Replace PROJECT_ID with your project ID.&lt;/p&gt;
+
+	&lt;p&gt;resource.type="gce_subnetwork"&lt;br /&gt;
+logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall" &lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.427">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC4" name="Ensure legacy networks do not exist for older projects" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. The network is global in scope and spans all cloud regions. &lt;br&gt; Subnetworks cannot be created in a legacy network and are unable to switch from legacy to auto or custom subnet networks. Legacy networks can have an impact for high network traffic projects and are subject to a single point of contention or failure.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; For each Google Cloud Platform project:&lt;br&gt; 1. Create a non-legacy network suitable for the organization's requirements.&lt;/p&gt; 
+&lt;p&gt;Note: You can no longer create a legacy network.&lt;br&gt; If you try to create a legacy network, this error is displayed:&lt;br&gt; Creation of legacy mode networks is deprecated. Please create a subnet mode&lt;br&gt; network instead by removing the IPv4Range field and adding the&lt;br&gt; autoCreateSubnetworks field to your network insert request.&lt;/p&gt; 
+&lt;p&gt;2. Delete the networks in the legacy mode.&lt;/p&gt; 
+&lt;p&gt;For a legacy network, you can explicitly delete the network only if the network is not in use by any resources.&lt;/p&gt; 
+&lt;p&gt;To delete the network:&lt;/p&gt; 
+&lt;p&gt;gcloud compute networks delete LEGACY_NETWORK_NAME&lt;/p&gt; 
+&lt;p&gt;Replace the following:&lt;/p&gt; 
+&lt;p&gt;LEGACY_NETWORK_NAME: the name of the legacy network that you want to delete.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Creating a legacy network" url="https://cloud.google.com/vpc/docs/using-legacy#creating_a_legacy_network"/>
+            <reference name="Deleting a legacy network" url="https://cloud.google.com/vpc/docs/using-legacy#deleting_a_legacy_network"/>
+          </references>
+          <standards>
+            <standard ref="3.2" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;For each Google Cloud Platform project:&lt;/p&gt;
+
+	&lt;p&gt;1. Set the project name in the Google Cloud Shell:&lt;/p&gt;
+
+	&lt;p&gt;gcloud config set project &lt;Project-ID&gt; &lt;/p&gt;
+
+	&lt;p&gt;2. List the networks configured in that project:&lt;/p&gt;
+
+	&lt;p&gt;gcloud compute networks list &lt;/p&gt;
+
+	&lt;p&gt;None of the listed networks should be in the legacy mode.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC5" name="Ensure that SSH and RDP access is restricted from the internet" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.&lt;br&gt; Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the internet to VPC or VM instance using SSH on Port 22 and/or RDP on Port 3389 can be avoided.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; GCP Firewall Rules within a VPC Network apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general (0.0.0.0/0) destination IP Range specified from the Internet through SSH with the default Port 22 and/or RDP on Port 3389. Generic access from the Internet to a specific IP Range needs to be restricted.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; From the Console:&lt;br&gt; 1. Go to VPC Network.&lt;br&gt; 2. Go to the Firewall Rules.&lt;br&gt; 3. Click the Firewall Rule you want to modify.&lt;br&gt; 4. Click Edit.&lt;br&gt; 5. Modify Source IP ranges to specific IP.&lt;br&gt; 6. Click Save.&lt;/p&gt; 
+&lt;p&gt;From Command Line:&lt;br&gt; 1.Update the Firewall rule with the new SOURCE_RANGE from the below command:&lt;/p&gt; 
+&lt;p&gt;gcloud compute firewall-rules update FirewallName -allow=[PROTOCOL[:PORT[-PORT]],...] -source-ranges=[CIDR_RANGE,...]&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; All Secure Shell (SSH) and/or Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH and/or RDP port for the concerned VPC.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blocked and limited traffic" url="https://cloud.google.com/vpc/docs/firewalls#blockedtraffic"/>
+            <reference name="Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts" url="https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts"/>
+          </references>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="3.7" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;From the Console:&lt;br /&gt;
+1. Go to VPC network.&lt;br /&gt;
+2. Go to the Firewall Rules.&lt;br /&gt;
+3. Ensure that Port is not equal to 22 and/or 3389 and Action is not set to Allow.&lt;br /&gt;
+4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters.&lt;/p&gt;
+
+	&lt;p&gt;From Command Line:&lt;br /&gt;
+gcloud compute firewall-rules list -&lt;br /&gt;
+format=table'(name,direction,sourceRanges,allowed)'&lt;/p&gt;
+
+	&lt;p&gt;Ensure that there is no rule matching the below criteria:&lt;/p&gt;
+
+	&lt;p&gt;- SOURCE_RANGES is 0.0.0.0/0&lt;br /&gt;
+- AND DIRECTION is INGRESS&lt;br /&gt;
+- AND IPProtocol is tcp or ALL&lt;br /&gt;
+- AND PORTS is set to 22 or range containing 22 or 3389 or range containing 3389 or Null (not set)&lt;/p&gt;
+
+	&lt;p&gt;Note:&lt;br /&gt;
+- When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL)&lt;br /&gt;
+- When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC3" name="Ensure that the default network does not exist in a project" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To prevent use of default network, a project should not have a default network.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; The default network has a preconfigured network configuration and automatically generates the following insecure firewall rules:&lt;br&gt; - default-allow-internal: Allows ingress connections for all protocols and ports among instances in the network.&lt;br&gt; - default-allow-ssh: Allows ingress connections on TCP port 22(SSH) from any source to any instance in the network.&lt;br&gt; - default-allow-rdp: Allows ingress connections on TCP port 3389(RDP) from any source to any instance in the network.&lt;br&gt; - default-allow-icmp: Allows ingress ICMP traffic from any source to any instance in the network.&lt;br&gt; These automatically created firewall rules do not get audit logged and cannot be configured to enable firewall rule logging.&lt;br&gt; Furthermore, the default network is an auto mode network, which means that its subnets use the same predefined range of IP addresses, and as a result, it's not possible to use Cloud VPN or VPC Network Peering with the default network.&lt;br&gt; Based on organization security and networking requirements, the organization should create a new network and delete the default network&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; From Console:&lt;br&gt; 1. Go to the VPC networks page by visiting: &lt;br&gt; https://console.cloud.google.com/networking/networks/list.&lt;br&gt; 2. Click the network named default.&lt;br&gt; 3. On the network detail page, click EDIT.&lt;br&gt; 4. Click DELETE VPC NETWORK.&lt;br&gt; 5. If needed, create a new network to replace the default network.&lt;/p&gt; 
+&lt;p&gt;From Command Line:&lt;br&gt; For each Google Cloud Platform project,&lt;br&gt; 1. Delete the default network:&lt;br&gt; gcloud compute networks delete default&lt;br&gt; 2. If needed, create a new network to replace it:&lt;br&gt; gcloud compute networks create NETWORK_NAME&lt;/p&gt; 
+&lt;p&gt;Prevention:&lt;br&gt; The user can prevent the default network and its insecure default firewall rules from being created by setting up an Organization Policy to Skip default network creation at https://console.cloud.google.com/iam-admin/orgpolicies/compute skipDefaultNetworkCreation.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; When an organization deletes the default network, it may need to migrate or service onto a new network&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Method: networks.delete" url="https://cloud.google.com/compute/docs/reference/rest/v1/networks/delete"/>
+            <reference name="Method: networks.insert" url="https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert"/>
+            <reference name="VPC network overview - Default network" url="https://cloud.google.com/vpc/docs/vpc#default-network"/>
+            <reference name="VPC network overview - Firewall rules" url="https://cloud.google.com/vpc/docs/vpc#firewall_rules"/>
+            <reference name="gcloud compute networks delete" url="https://cloud.google.com/sdk/gcloud/reference/compute/networks/delete"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;From Console:&lt;br /&gt;
+1. Go to the VPC networks page by visiting: &lt;br /&gt;
+https://console.cloud.google.com/networking/networks/list.&lt;br /&gt;
+2. Ensure that a network with the name default is not present.&lt;/p&gt;
+
+	&lt;p&gt;From Command Line:&lt;br /&gt;
+1. Set the project name in the Google Cloud Shell:&lt;br /&gt;
+gcloud config set project PROJECT_ID &lt;br /&gt;
+2. List the networks configured in that project:&lt;br /&gt;
+gcloud compute networks list &lt;br /&gt;
+It should not list default as one of the available networks in that project&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.427">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC1" name="Ensure that VPC flow Logs is enabled for every subnet in a VPC  network" issueId="" issueLink="" platform="" cost="0" risk="45" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; VPC networks and subnetworks not reserved for internal HTTP load balancing provide logically isolated and secure network partitions where GCP resources can be launched. &lt;br&gt; When Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows. Each VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet. If two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows.&lt;br&gt; Flow Logs supports the following use cases:&lt;br&gt; - Network monitoring&lt;br&gt; - Understanding network usage and optimizing network traffic expenses&lt;br&gt; - Network forensics&lt;br&gt; - Real-time security analysis&lt;br&gt; Flow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows.&lt;br&gt; The Flow Logs must be configured such that all network traffic is logged, the interval of logging is granular to provide detailed information on the connections, no logs are filtered, and metadata to facilitate investigations are included.&lt;/p&gt; 
+&lt;p&gt;Note: Subnets reserved for use by internal HTTP load balancers do not support VPC flow logs.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; From Console:&lt;/p&gt; 
+&lt;p&gt;1. Go to the VPC network GCP Console visiting &lt;br&gt; https://console.cloud.google.com/networking/networks/list&lt;br&gt; 2. Click the name of a subnet, The Subnet details page displays.&lt;br&gt; 3. Click the EDIT button.&lt;br&gt; 4. Set Flow Logs to On.&lt;br&gt; 5. Expand the Configure Logs section.&lt;br&gt; 6. Set Aggregation Interval to 5 SEC.&lt;br&gt; 7. Check the box beside Include metadata.&lt;br&gt; 8. Set Sample rate to 100.&lt;br&gt; 9. Click Save.&lt;/p&gt; 
+&lt;p&gt;Note: It is not possible to configure a Log filter from the console.&lt;/p&gt; 
+&lt;p&gt;From Command Line:&lt;/p&gt; 
+&lt;p&gt;To enable VPC Flow Logs for a network subnet, run the following command:&lt;br&gt; gcloud compute networks subnets update [SUBNET_NAME] -region [REGION] -&lt;br&gt; enable-flow-logs -logging-aggregation-interval=interval-5-sec -logging flow-sampling=1 -logging-metadata=include-all&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference:&lt;br&gt; https://cloud.google.com/vpc/&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Using VPC Flow Logs" url="https://cloud.google.com/vpc/docs/using-flow-logs#enabling_vpc_flow_logging"/>
+            <reference name="Virtual Private Cloud (VPC)" url="https://cloud.google.com/vpc/"/>
+          </references>
+          <standards>
+            <standard ref="3.8" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;From Console:&lt;/p&gt;
+
+	&lt;p&gt;1. Go to the VPC network GCP Console visiting &lt;br /&gt;
+https://console.cloud.google.com/networking/networks/list&lt;br /&gt;
+2. From the list of network subnets, make sure for each subnet:&lt;br /&gt;
+- Flow Logs is set to On&lt;br /&gt;
+- Aggregation Interval is set to 5 sec&lt;br /&gt;
+- Include metadata checkbox is checked&lt;br /&gt;
+- Sample rate is set to 100%&lt;/p&gt;
+
+	&lt;p&gt;Note: It is not possible to determine if a Log filter has been defined from the console.&lt;/p&gt;
+
+
+	&lt;p&gt;From Command Line:&lt;/p&gt;
+
+	&lt;p&gt;gcloud compute networks subnets list -format json | \
+ jq -r &lt;br /&gt;
+'(["Subnet","Purpose","Flow_Logs","Aggregation_Interval","Flow_Sampling","Met&lt;br /&gt;
+adata","Logs_Filtered"] | (., map(length*"-"))), 
+ (.[] | 
+ [
+ .name, 
+ .purpose,
+ (if has("enableFlowLogs") and .enableFlowLogs == true then &lt;br /&gt;
+"Enabled" else "Disabled" end),
+ (if has("logConfig") then .logConfig.aggregationInterval else &lt;br /&gt;
+"N/A" end),
+ (if has("logConfig") then .logConfig.flowSampling else "N/A" &lt;br /&gt;
+end),
+ (if has("logConfig") then .logConfig.metadata else "N/A" end),
+ (if has("logConfig") then (.logConfig | has("filterExpr")) else &lt;br /&gt;
+"N/A" end)
+ ]
+ ) | 
+ @tsv' | \
+ column -t&lt;/p&gt;
+
+	&lt;p&gt;The output of the above command will list:&lt;br /&gt;
+- each subnet&lt;br /&gt;
+- the subnet's purpose&lt;br /&gt;
+- a Enabled or Disabled value if Flow Logs are enabled&lt;br /&gt;
+- the value for Aggregation Interval or N/A if disabled, the value for Flow Sampling&lt;br /&gt;
+or N/A if disabled&lt;br /&gt;
+- the value for Metadata or N/A if disabled&lt;br /&gt;
+- 'true' or 'false' if a Logging Filter is configured or 'N/A' if disabled.&lt;br /&gt;
+If the subnet's purpose is PRIVATE then Flow Logs should be Enabled.&lt;br /&gt;
+If Flow Logs is enabled then:&lt;br /&gt;
+- Aggregation_Interval should be INTERVAL_5_SEC&lt;br /&gt;
+- Flow_Sampling should be 1&lt;br /&gt;
+- Metadata should be INCLUDE_ALL_METADATA&lt;br /&gt;
+- Logs_Filtered should be false.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.426">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC7" name="Follow best practices for VPC firewall rules" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Follow best practices for VPC firewall rules&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; VPC firewall rules let you allow or deny connections to or from your virtual machine (VM) instances based on a configuration that you specify. Enabled VPC firewall rules are always enforced, protecting your instances regardless of their configuration and operating system, even if they have not started up.&lt;br&gt; Every VPC network functions as a distributed firewall. While firewall rules are defined at the network level, connections are allowed or denied on a per-instance basis. You can think of the VPC firewall rules as existing not only between your instances and other networks, but also between individual instances within the same network.&lt;br&gt; Google Cloud recommends to follow the best practices for firewall rules.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; When designing and evaluating your firewall rules, keep in mind the following best practices:&lt;/p&gt; 
+&lt;p&gt;- Implement least-privilege principles. Block all traffic by default and only allow the specific traffic you need. This includes limiting the rule to just the protocols and ports you need.&lt;br&gt; - Use hierarchical firewall policy rules to block traffic that should never be allowed at an organization or folder level.&lt;br&gt; - For "allow" rules, restrict them to specific VMs by specifying the service account of the VMs.&lt;br&gt; - If you need to create rules based on IP addresses, try to minimize the number of rules. It's easier to track one rule that allows traffic to a range of 16 VMs than it is to track 16 separate rules.&lt;/p&gt; 
+&lt;p&gt;For more information please see Reference URL.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="VPC firewall rules overview" url="https://cloud.google.com/vpc/docs/firewalls"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that you are following VPC firewall best practices.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC6" name="Use Identity Aware Proxy (IAP) to ensure only traffic from Google  IP addresses are allowed" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; IAP ensure that access to VMs is controlled by authenticating incoming requests. Access to your apps and the VMs should be restricted by firewall rules that allow only the proxy IAP IP addresses contained in the 35.235.240.0/20 subnet. Otherwise, unauthenticated requests can be made to your apps. To ensure that load balancing works correctly health checks should also be allowed.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; From the Console:&lt;br&gt; 1. Go to the Cloud Console VPC network &amp;gt; Firewall rules.&lt;br&gt; 2. Select the checkbox next to the following rules:&lt;br&gt;- default-allow-http&lt;br&gt;- default-allow-https&lt;br&gt;- default-allow-internal&lt;br&gt; 3. Click Delete.&lt;br&gt; 4. Click Create firewall rule and set the following values:&lt;br&gt;-&lt;br&gt; Name: allow-iap-traffic&lt;br&gt;-&lt;br&gt; Targets: All instances in the network&lt;/p&gt; 
+&lt;p&gt;- Source IP ranges (press Enter after you paste each value in the box, copy the value below the bold text including the dash):&lt;br&gt; IAP Proxy Addresses&lt;br&gt; - 35.235.240.0/20&lt;br&gt; Google Health Check&lt;br&gt;- 130.211.0.0/22 **```Google Health Check&lt;br&gt;-&lt;br&gt; Protocols and ports:&lt;br&gt;- Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by;&lt;br&gt;- tcp:80 (Default HTTP Health Check port)&lt;br&gt;- tcp:443-(Default HTTPS Health Check port)&lt;br&gt; Note: if you have custom ports used by your load balancers, you will need to list them here&lt;br&gt; 5. When you're finished updating values, click Create.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; If firewall rules are not configured correctly, legitimate business services could be negatively impacted. It is recommended to make these changes during a time of low usage.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts" url="https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts"/>
+            <reference name="Creating health checks" url="https://cloud.google.com/load-balancing/docs/health-checks"/>
+            <reference name="Identity-Aware Proxy overview" url="https://cloud.google.com/iap/docs/concepts-overview"/>
+            <reference name="Setting up an external HTTPS load balancer" url="https://cloud.google.com/iap/docs/load-balancer-howto"/>
+          </references>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="cis-gcp-standard-level-2"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From the Console:&lt;br&gt; 1. For each of your apps that have IAP enabled go to the Cloud Console VPC network &amp;gt; &lt;br&gt; Firewall rules.&lt;br&gt; 2. Verify that the only rules correspond to the following values:&lt;br&gt;-&lt;br&gt; Targets: All instances in the network&lt;br&gt;-&lt;br&gt; Source IP ranges&lt;br&gt; IAP Proxy Addresses&lt;br&gt;- 35.235.240.0/20&lt;br&gt; Google Health Check&lt;br&gt;- 130.211.0.0/22&lt;br&gt; Google Health Check&lt;br&gt;- 35.191.0.0/16&lt;br&gt;-&lt;br&gt; Protocols and ports:&lt;br&gt;- Specified protocols and ports required for access and management of &lt;br&gt; your app. For example most health check connection protocols would &lt;br&gt; be covered by;&lt;br&gt;- tcp:80 (Default HTTP Health Check port)&lt;br&gt;- tcp:443-(Default HTTPS Health Check port)&lt;/p&gt; 
+&lt;p&gt;Note: if you have custom ports used by your load balancers, you will &lt;br&gt; need to list them here&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-GOOGLE-CLOUD-VPC8" name="Use Shared VPC to connect resources from multiple projects to a common VPC network" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use Shared VPC to connect resources from multiple projects to a common VPC network&lt;/p&gt; 
+&lt;p&gt;Rationale:&lt;br&gt; Shared VPC allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network, so that they can communicate with each other securely and efficiently using internal IPs from that network. When you use Shared VPC, you designate a project as a host project and attach one or more other service projects to it. The VPC networks in the host project are called Shared VPC networks. Eligible resources from service projects can use subnets in the Shared VPC network.&lt;br&gt; Shared VPC lets organization administrators delegate administrative responsibilities, such as creating and managing instances, to Service Project Admins while maintaining centralized control over network resources like subnets, routes, and firewalls.&lt;/p&gt; 
+&lt;p&gt;Remediation:&lt;br&gt; A Shared VPC network is a VPC network defined in a host project and made available as a centrally shared network for eligible resources in service projects. Shared VPC networks can be either auto or custom mode, but legacy networks are not supported.&lt;/p&gt; 
+&lt;p&gt;When a host project is enabled, you have two options for sharing networks:&lt;br&gt; - You can share all host project subnets. If you select this option, then any new subnets created in the host project, including subnets in new networks, will also be shared.&lt;br&gt; - You can specify individual subnets to share. If you share subnets individually, then only those subnets are shared unless you manually change the list.&lt;/p&gt; 
+&lt;p&gt;Host and service projects are connected by attachments at the project level. Subnets of the Shared VPC networks in the host project are accessible by Service Project Admins&lt;/p&gt; 
+&lt;p&gt;For detailed information on setting up Shared VPC please see Reference URLs.&lt;/p&gt; 
+&lt;p&gt;Impact:&lt;br&gt; None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Provisioning Shared VPC" url="https://cloud.google.com/vpc/docs/provisioning-shared-vpc"/>
+            <reference name="Shared VPC overview" url="https://cloud.google.com/vpc/docs/shared-vpc"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>	&lt;p&gt;Ensure that you are using Shared VPC to connect resources from multiple projects to a common VPC network.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.428">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="LOGGING AND MONITORING" name="Logging and Monitoring" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="OWASP-A10-2017" name="Exploitation of insufficient logging and monitoring" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC1" mitigation="50"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC1" mitigation="50"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC2" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="NETWORKING" name="Networking" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="GOOGLE-UNAUTHORISED-CONNECTION" name="Attackers gain unauthorized connection to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers could gain an unauthorized connection to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-NET-01">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC3" mitigation="15"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC4" mitigation="15"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC5" mitigation="14"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC6" mitigation="14"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC7" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-NON-IDENTIFY">
+                  <countermeasures>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC8" mitigation="14"/>
+                    <countermeasure ref="C-GOOGLE-CLOUD-VPC9" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC3" mitigation="15"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC4" mitigation="15"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC5" mitigation="14"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC6" mitigation="14"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC7" mitigation="14"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC8" mitigation="14"/>
+                <countermeasure ref="C-GOOGLE-CLOUD-VPC9" mitigation="14"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="588091d9-34f1-43d1-a85c-90e395ce4e52" diagramComponentId="9072942d-14a0-45b6-8368-8d602901fe80" ref="63f25813-9611-4061-8a55-7e8d91ebbf0e" name="GCP Storage" desc="" library="Google Cloud Platform" parentComponentRef="93f9dc70-a190-41c5-9943-76a0ce03cc41" componentDefinitionRef="google-storage">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="GOOGLE-USECURE-CREDENTIALS" name="Credentials are not securely stored" state="0" impact="100" issueId="" issueLink="">
+          <desc>The credentials that are used to access the resources are not securely stored and can be
+                        accessed by unauthorized personnel.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-OBSOLETE-APPS-ACCESS" name="Obsolete applications have access to the resources" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are obsolete applications that no one uses, with permissions to access the resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-EASY-FIND-RESOURCES" name="Resources are exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>When you are into a VNet, you can search its resources, but that shall be used only when you
+                        know the resource name. The problem occurs when you don't know these names and you can easily
+                        find the resources. Therefore anyone with access to the system could easily find all the
+                        resources and gain access, regardless of having any information about them.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.204">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="GOOGLE-BACKUP" name="There is no recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no processes or mechanisms to regularly save the data to another place in order to
+                        have an older version of the data to restore in case of loss. Consequently the data cannot be
+                        easily recovered or they cannot be recovered at all.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.203">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="GOOGLE-STO05" name="Block access to Cloud Storage buckets from unauthorized access" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;No storage buckets would be publicly accessible. You would have to explicitly administer bucket access.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser.&lt;/p&gt;&lt;p&gt;2. Click on the bucket name to go to its Bucket details page.&lt;/p&gt;&lt;p&gt;3. Click on the Permissions tab.&lt;/p&gt;&lt;p&gt;4. Click Delete button in front of allUsers and allAuthenticatedUsers to remove that particular role assignment.&lt;/p&gt;&lt;p&gt;From Command Line:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remove allUsers and allAuthenticatedUsers access.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil iam ch -d allUsers gs://BUCKET_NAME&amp;nbsp;&lt;/p&gt;&lt;p&gt;gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="cis-gcp-standard"/>
+            <standard ref="5.1" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser.&lt;/p&gt;&lt;p&gt;2. Click on each bucket name to go to its Bucket details page.&lt;/p&gt;&lt;p&gt;3. Click on the Permissions tab.&lt;/p&gt;&lt;p&gt;4. Ensure that allUsers and allAuthenticatedUsers are not in the Members list.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all buckets in a project gsutil ls&lt;/p&gt;&lt;p&gt;2. Check the IAM Policy for each bucket: gsutil iam get gs://BUCKET_NAME&lt;/p&gt;&lt;p&gt;No role should contain allUsers and/or allAuthenticatedUsers as a member.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-STO04" name="Enable Data Storage versioning" issueId="" issueLink="" platform="" cost="1" risk="27" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Enable data storage versioning to make data backups and avoid accidental or intentional
+                        removal of the data.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&lt;/b&gt;&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        To enable Object Versioning on a bucket:&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Using GSUTIL: Use the gsutil versioning set on command, replacing [VALUES_IN_BRACKETS]
+                        with the appropriate values: gsutil versioning set on gs://[BUCKET_NAME]&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Using REST APIS:&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;JSON API:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Get an authorization access token from the OAuth 2.0 Playground. Configure the
+                        playground to use your own OAuth credentials.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create a .json file that contains the following information: {&amp;quot;versioning&amp;quot;:
+                        { &amp;quot;enabled&amp;quot;: true }}&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Use cURL to call the JSON API with a PATCH Bucket request, replacing
+                        [VALUES_IN_BRACKETS] with the appropriate values:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        curl -X PATCH --data-binary @[JSON_FILE_NAME].json \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        -H &amp;quot;Authorization: Bearer [OAUTH2_TOKEN]&amp;quot; \&amp;nbsp;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        -H &amp;quot;Content-Type: application/json&amp;quot; \ &amp;quot;https://www.googleapis.com/storage/v1/b/[BUCKET_NAME]?fields=versioning&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;XML API:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Get an authorization access token from the OAuth 2.0 Playground. Configure the
+                        playground to use your own OAuth credentials.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Create an .xml file that contains the following information, replacing
+                        [VALUES_IN_BRACKETS] with the appropriate values: Enabled&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Use cURL to call the XML API, with a PUT Bucket request and versioning query string
+                        parameter, replacing [VALUES_IN_BRACKETS] with the appropriate values:&amp;nbsp;&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        curl -X PUT --data-binary @[XML_FILE_NAME].xml \
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        -H &amp;quot;Authorization: Bearer [OAUTH2_TOKEN]&amp;quot; \
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;div&gt;
+                        &amp;quot;https://storage.googleapis.com/[BUCKET_NAME]?versioning&amp;quot;
+                        &lt;/div&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: enable versioning" url="https://cloud.google.com/storage/docs/using-object-versioning#enable-object-versioning-xml"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that Data Storage versioning is enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-STO06" name="Enable uniform bucket-level access for Cloud Storage buckets" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;It is recommended to use uniform bucket-level access to unify and simplify how you grant access to your Cloud Storage resources.&lt;/p&gt;&lt;p&gt;Cloud Storage offers two systems for granting users permission to access your buckets and objects: Cloud Identity and Access Management (Cloud IAM) and Access Control Lists (ACLs). These systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission. Cloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels. ACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis.&lt;/p&gt;&lt;p&gt;In order to support a uniform permissioning system, Cloud Storage has uniform bucket-level access. Using this feature disables ACLs for all Cloud Storage resources: access to Cloud Storage resources then is granted exclusively through Cloud IAM. Enabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible either.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;If you enable uniform bucket-level access, you revoke access from users who gain their access solely through object ACLs.&lt;/p&gt;&lt;p&gt;Certain Google Cloud services, such as Stackdriver, Cloud Audit Logs, and Datastore, cannot export to Cloud Storage buckets that have uniform bucket-level access enabled.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Open the Cloud Storage browser in the Google Cloud Console by visiting: https://console.cloud.google.com/storage/browser&lt;/p&gt;&lt;p&gt;2. In the list of buckets, click on the name of the desired bucket.&lt;/p&gt;&lt;p&gt;3. Select the Permissions tab near the top of the page.&lt;/p&gt;&lt;p&gt;4. In the text box that starts with This bucket uses fine-grained access control..., click Edit.&lt;/p&gt;&lt;p&gt;5. In the pop-up menu that appears, select Uniform.&lt;/p&gt;&lt;p&gt;6. Click Save.&lt;/p&gt;&lt;p&gt;From Command Line: Use the on option in a uniformbucketlevelaccess set command:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil uniformbucketlevelaccess set on gs://BUCKET_NAME/&lt;/p&gt;&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="CIS Google Cloud Platform Benchmark" url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform/"/>
+          </references>
+          <standards>
+            <standard ref="5.2" supportedStandardRef="cis-gcp-standard-level-2"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;From Console:&lt;/p&gt;&lt;p&gt;1. Open the Cloud Storage browser in the Google Cloud Console by visiting: https://console.cloud.google.com/storage/browser&lt;/p&gt;&lt;p&gt;2. For each bucket, make sure that Access control column has the value Uniform.&lt;/p&gt;&lt;p&gt;From Command Line:&lt;/p&gt;&lt;p&gt;1. List all buckets in a project&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil ls&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. For each bucket, verify that uniform bucket-level access is enabled.&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;gsutil uniformbucketlevelaccess get gs://BUCKET_NAME/&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If uniform bucket-level access is enabled, the response looks like:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Uniform bucket-level access setting for gs://BUCKET_NAME/:&amp;nbsp;&lt;/p&gt;&lt;p&gt;Enabled: True&amp;nbsp;&lt;/p&gt;&lt;p&gt;LockedTime: LOCK_DATE&lt;/p&gt;&lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-STO01" name="Revoke access to Storage for unnecessary applications" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Create a mechanism or process to review all applications with access to the Data Storage and
+                        verify that these applications should have access. If an application should not have access to
+                        the data storage, you have to revoke the access from this application.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;b&gt;Remediation:&amp;nbsp;&lt;/b&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;To revoke the access from an application, go to the &lt;a
+                        href="https://www.google.com/accounts/ManageAccount"&gt;Google Account&lt;/a&gt;.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Click in to Authorizing applications and sites.&lt;/li&gt;
+                        &lt;li&gt;In the next page, you can revoke access for applications by clicking Revoke Access
+                        next to the application.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Best practices Storage" url="https://cloud.google.com/storage/docs/best-practices#security"/>
+          </references>
+          <standards>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that there are only the necessary accesses from applications to the data storages.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.136">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-STO02" name="Securely store your credentials" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that you securely store your credentials. This can be done differently depending on
+                        your environment and where you store your credentials. For example, if you store your
+                        credentials in a configuration file, make sure that you set appropriate permissions on that file
+                        to prevent unwanted access. If you are using Google App Engine, consider using StorageByKeyName
+                        to store your credentials.</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Best practices storage" url="https://cloud.google.com/storage/docs/best-practices"/>
+          </references>
+          <standards>
+            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the credentials are stored securely.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="GOOGLE-STO03" name="Use apropriate names for the buckets" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="wgildersleeve" library="Google Cloud Platform" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Google Cloud Storage requests refer to buckets and objects by their names. As a result, even
+                        though ACLs will prevent unauthorized third parties from operating on buckets or objects, a
+                        third party can attempt requests with bucket or object names and determine their existence by
+                        observing the error responses.&amp;nbsp;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        It can then be possible for information in bucket or object names to be leaked. If you are
+                        concerned about the privacy of your bucket or object names, you should take appropriate
+                        precautions, such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Choosing bucket and object names that are difficult to guess. For example, a bucket
+                        named mybucket-gtbytul3 is random enough that unauthorized third parties cannot feasibly guess
+                        it or enumerate other bucket names from it.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Avoiding use of sensitive information as part of bucket or object names. For example,
+                        instead of naming your bucket mysecretproject-prodbucket, name it somemeaninglesscodename-prod.
+                        In some applications, you may want to keep sensitive metadata in custom Google Cloud Storage
+                        headers such as x-goog-meta, rather than encoding the metadata in object names.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Google Cloud docs: Best practices Storage" url="https://cloud.google.com/storage/docs/best-practices#security"/>
+          </references>
+          <standards/>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all buckets are named appropriately.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GOOGLE CLOUD PLATFORM" name="Google Cloud Platform" desc="" library="Google Cloud Platform">
+          <threats>
+            <threat ref="LOSS-DATA-REMOVED" name="Attackers destroy the data and the data cannot be recovered" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;Attackers gain access to the systems and data with excessive permissions and they remove all the information from the system, which might lead to permanent loss of data, including sensitive or personal data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-BACKUP">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-STO04" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-STO04" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="ACCESS-TO-RESOURCES" name="Attackers gain access to the resources" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>Explicit naming of resources, missing security policies or misconfigurations on user permissions can lead attackers to exploit resources.</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-EASY-FIND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-STO03" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-STO03" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="ACCESS-TO-DATA" name="Sensitive data is compromised through unauthorized access to data storage" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="Google Cloud Platform" editable="true">
+              <desc>&lt;p&gt;A data breach is a security violation in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Sensitive data could be exposed due to a bad configuration in user permissions.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="GOOGLE-EASY-FIND-RESOURCES">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-STO05" mitigation="25"/>
+                    <countermeasure ref="GOOGLE-STO06" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-OBSOLETE-APPS-ACCESS">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-STO01" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="GOOGLE-USECURE-CREDENTIALS">
+                  <countermeasures>
+                    <countermeasure ref="GOOGLE-STO02" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="GOOGLE-STO01" mitigation="25"/>
+                <countermeasure ref="GOOGLE-STO02" mitigation="25"/>
+                <countermeasure ref="GOOGLE-STO05" mitigation="25"/>
+                <countermeasure ref="GOOGLE-STO06" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f4004de3-8b6b-40c0-a318-c0adda21927f" diagramComponentId="8f5e75a1-2ea1-4e18-aafb-caa6b7fa9d6f" ref="91280f47-7175-45c8-9dc4-6e3692293927" name="Rich Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rich-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.382">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.129">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.381">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.381">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.380">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.382">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.252">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:58.253">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="dc6515dc-53ae-4268-bdd3-1dda865358d8" diagramComponentId="27986218-4f23-4502-9b88-e757ba4c126b" ref="2a4f86ab-abb0-449b-a498-d403a62a3948" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.473">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.071">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.465">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.072">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:53.603">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.071">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.471">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.472">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.161">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="62" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.786">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.159">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:52.895">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.787">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
+&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.783">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.785">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.321">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:54.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b432c1a5-c433-481f-b625-9efb3d320609" diagramComponentId="5d9d2fe4-6d89-43a0-8564-c80623a76348" ref="6dd70f5e-d8b5-4c38-94de-192c64730327" name="Generic Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.753">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.093">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.095">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.896">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.685">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.897">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:55.898">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="798a6555-6507-492d-a99e-c9383cf2ceea" diagramComponentId="5b8ecac1-55fe-4f92-aa04-25c93f772c63" ref="00449516-33db-479d-a201-3582f48fd42b" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.019">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.695">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.404">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.020">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.374">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.375">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.242">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="28" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.807">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.361">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.808">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
+&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="25" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.8" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2023-Server Side Request Forgery" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:56.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.243">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ff707509-f1f3-478d-99c9-581a1ef162f9" diagramComponentId="36a9ecb9-0041-4196-be07-a2fc14ffe2c5" ref="b740e9e6-5afd-46b4-aecc-6037cfd51e04" name="Rich Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rich-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.932">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.237">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.238">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.115">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:59.872">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.116">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:26:00.117">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7f63eb6d-8f3a-470f-a055-4db92b3a8db1" diagramComponentId="aa1102e7-22a4-47d4-95e5-f289ab9213b7" ref="9ced54cb-300b-4cea-9dba-c1eb433ee864" name="Generic Client" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="generic-client">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.638">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.865">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.866">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="5.17" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.730">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.24" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.730">
+              <output/>
+            </source>
+            <references>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.587">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.732">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="wgildersleeve" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.14" supportedStandardRef="iso-27002-2022"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields>
+            <customField ref="countermeasure-action-state" value="False"/>
+          </customFields>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-10-27T10:25:57.731">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="wgildersleeve" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields>
+                <customField ref="is-relevant" value=""/>
+              </customFields>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/simple-3-tier-web-application.xml b/Templates/Submitted_Templates/simple-3-tier-web-application.xml
new file mode 100644
index 0000000..4dfc53f
--- /dev/null
+++ b/Templates/Submitted_Templates/simple-3-tier-web-application.xml
@@ -0,0 +1,10151 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="Simple 3 Tier Web Application" name="Simple 3 Tier Web Application" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTQzNCIgZHk9IjgxMyIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIGJhY2tncm91bmQ9Im5vbmUiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjEuMCI+PHJvb3Q+PG14Q2VsbCBpZD0iMCIvPjxteENlbGwgaWQ9IjEiIHBhcmVudD0iMCIvPjxteENlbGwgaWQ9IjUiIHZhbHVlPSJJbnRlcm5ldCIgc3R5bGU9ImlyLnJlZj1mMGJhNzcyMi0zOWI2LTRjODEtODI5MC1hMzBhMjQ4YmI4ZDk7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtyZWN1cnNpdmVSZXNpemU9MDtodG1sPTE7dmVydGljYWxBbGlnbj10b3A7YWxpZ249bGVmdDtkYXNoZWQ9MTtzdHJva2VXaWR0aD0xO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzcGFjaW5nVG9wPTE7c3BhY2luZ0xlZnQ9MzI7c3Ryb2tlQ29sb3I9Izc1NzVFQjtmaWxsQ29sb3I9I0YwRjBGRjtmaWxsT3BhY2l0eT0zMDtmb250Q29sb3I9IzU2NTFFMDtjb25uZWN0YWJsZT0wO2NvbnRhaW5lcj0xO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1UUlVTVFpPTkU7IiBwYXJlbnQ9IjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iLTU5NiIgeT0iLTYzIiB3aWR0aD0iNDIxIiBoZWlnaHQ9IjE4MCIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PG14Q2VsbCBpZD0iNCIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWFwcGxpY2F0aW9uLXNlcnZlci1zaWRlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVVNd0xqTTJOVGcxTXlBd0xqSTRNamM0TWlBd0xqTTNPRGN5TlNBd0xqSTJPVGt4TVNBd0xqTTVORFl3TXlBd0xqSTJPVGt4TVVnd0xqWXdOVFF6TmtNd0xqWXlNVE14TkNBd0xqSTJPVGt4TVNBd0xqWXpOREU0TmlBd0xqSTRNamM0TWlBd0xqWXpOREU0TmlBd0xqSTVPRFkyTVVNd0xqWXpOREU0TmlBd0xqTXhORFV6T1NBd0xqWXlNVE14TkNBd0xqTXlOelF4TVNBd0xqWXdOVFF6TmlBd0xqTXlOelF4TVVnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqTXlOelF4TVNBd0xqTTJOVGcxTXlBd0xqTXhORFV6T1NBd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVZwTk1DNHpPVFEyTURNZ01DNDJPVEUxTnpoRE1DNHpOemczTWpVZ01DNDJPVEUxTnpnZ01DNHpOalU0TlRNZ01DNDNNRFEwTlNBd0xqTTJOVGcxTXlBd0xqY3lNRE15T0VNd0xqTTJOVGcxTXlBd0xqY3pOakl3TmlBd0xqTTNPRGN5TlNBd0xqYzBPVEEzT0NBd0xqTTVORFl3TXlBd0xqYzBPVEEzT0Vnd0xqVTFNREF4T1ZZd0xqWTVNVFUzT0Vnd0xqTTVORFl3TTFwTk1DNDJNakF6TlRFZ01DNDJNams1TVRGSU1DNDJNRFExTmpWRE1DNDFPVGN4TkRRZ01DNDJNams1TVRFZ01DNDFPVEF3TmpnZ01DNDJNekV6T1RNZ01DNDFPRE0yTVRrZ01DNDJNelF3TnpoSU1DNHpPVFEyTURORE1DNHpOemczTWpVZ01DNDJNelF3TnpnZ01DNHpOalU0TlRNZ01DNDJNakV5TURZZ01DNHpOalU0TlRNZ01DNDJNRFV6TWpoRE1DNHpOalU0TlRNZ01DNDFPRGswTkRrZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTkRrZ01DNDJNelF4T0RZZ01DNDJNRFV6TWpoRE1DNDJNelF4T0RZZ01DNDJNVFUzTkRVZ01DNDJNamcyTkRZZ01DNDJNalE0TmpnZ01DNDJNakF6TlRFZ01DNDJNams1TVRGYVRUQXVOamN5TlRFNUlEQXVOakk1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVMU1EQXhPVll3TGpnM05UTTJOa013TGpVMU1EQXhPU0F3TGpnM09EQTBNaUF3TGpVMU1ESXhNaUF3TGpnNE1EWTNNaUF3TGpVMU1EVTROQ0F3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNams1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOemMxTWpRZ01DNDJOakkzTWt3d0xqYzNPVGsxT1NBd0xqWTJNamM0T0VNd0xqZ3dNVGN6TmlBd0xqWTJOREF3TlNBd0xqZ3hPVEUyT0NBd0xqWTRNVFF6TnlBd0xqZ3lNRE00TmlBd0xqY3dNekU1T0V3d0xqZ3lNRFExTXlBd0xqY3dOVFl6TTFZd0xqZzFOelE0TWt3d0xqZ3lNRE00TmlBd0xqZzFPVGt4TjBNd0xqZ3hPVEUyT0NBd0xqZzRNVFkzT0NBd0xqZ3dNVGN6TnlBd0xqZzVPVEV4SURBdU56YzVPVGMxSURBdU9UQXdNekk0VERBdU56YzNOVFFnTUM0NU1EQXpPVFpJTUM0Mk1qVTJOemRETUM0Mk1ESTNPVFFnTUM0NU1EQXpPVFlnTUM0MU9EUXdPVFFnTUM0NE9ESTBPRFFnTUM0MU9ESTRNeklnTUM0NE5UazVNVGRNTUM0MU9ESTNOalFnTUM0NE5UYzBPREpXTUM0M01EVTJNek5ETUM0MU9ESTNOalFnTUM0Mk9ESTNOU0F3TGpZd01EWTNOQ0F3TGpZMk5EQTFJREF1TmpJek1qUXlJREF1TmpZeU56ZzRUREF1TmpJMU5qYzNJREF1TmpZeU56SklNQzQzTnpjMU1qUmFUVEF1TnprME1ESTVJREF1TnpJNE56UXhTREF1TmpBNU1UZzRUREF1TmpBNU1UY3lJREF1T0RVM05EZ3lRekF1TmpBNU1UY3lJREF1T0RZMk1ESTRJREF1TmpFMU5qWTNJREF1T0Rjek1EVTJJREF1TmpJek9UZzVJREF1T0Rjek9UQXhUREF1TmpJMU5qYzNJREF1T0Rjek9UZzNTREF1TnpjM05UUk1NQzQzTnpreU1qZ2dNQzQ0TnpNNU1ERkRNQzQzT0RZNU9UWWdNQzQ0TnpNeE1UTWdNQzQzT1RNeE56RWdNQzQ0TmpZNU16Y2dNQzQzT1RNNU5pQXdMamcxT1RFM1REQXVOemswTURRMUlEQXVPRFUzTkRneVREQXVOemswTURJNUlEQXVOekk0TnpReFdrMHdMalkzT0RRNU15QXdMamMwT0RVME4wTXdMalk0TXpVd055QXdMamMwT0RVME55QXdMalk0TnpZMUlEQXVOelV5TWpjeklEQXVOamc0TXpBMklEQXVOelUzTVRBM1REQXVOamc0TXprM0lEQXVOelU0TkRWV01DNDROVEE0T0VNd0xqWTRPRE01TnlBd0xqZzFOVGc1TXlBd0xqWTRORFkzTVNBd0xqZzJNREF6TnlBd0xqWTNPVGd6TnlBd0xqZzJNRFk1TTB3d0xqWTNPRFE1TXlBd0xqZzJNRGM0TTBnd0xqWXpNakkzT1VNd0xqWXlOekkyTmlBd0xqZzJNRGM0TXlBd0xqWXlNekV5TWlBd0xqZzFOekExTnlBd0xqWXlNalEyTmlBd0xqZzFNakl5TkV3d0xqWXlNak0zTmlBd0xqZzFNRGc0VmpBdU56VTRORFZETUM0Mk1qSXpOellnTUM0M05UTTBNemNnTUM0Mk1qWXhNRElnTUM0M05Ea3lPVE1nTUM0Mk16QTVNelVnTUM0M05EZzJNemhNTUM0Mk16SXlOemtnTUM0M05EZzFORGRJTUM0Mk56ZzBPVE5hVFRBdU5qWTROVGtnTUM0M05qZ3pOVFJJTUM0Mk5ESXhPREpXTUM0NE5EQTVOemRJTUM0Mk5qZzFPVll3TGpjMk9ETTFORnBOTUM0M05UYzNNVGdnTUM0M09EZ3hPVGxETUM0M05qTXhPRGNnTUM0M09EZ3hPVGtnTUM0M05qYzJNakVnTUM0M09USTJNek1nTUM0M05qYzJNakVnTUM0M09UZ3hNRE5ETUM0M05qYzJNakVnTUM0NE1ETXhNVFlnTUM0M05qTTRPVFlnTUM0NE1EY3lOaUF3TGpjMU9UQTJNaUF3TGpnd056a3hOVXd3TGpjMU56Y3hPQ0F3TGpnd09EQXdOa2d3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpnd09EQXdOaUF3TGpjd01UWTFPU0F3TGpnd016VTNNaUF3TGpjd01UWTFPU0F3TGpjNU9ERXdNME13TGpjd01UWTFPU0F3TGpjNU16QTRPU0F3TGpjd05UTTROQ0F3TGpjNE9EazBOaUF3TGpjeE1ESXhPQ0F3TGpjNE9ESTVUREF1TnpFeE5UWXlJREF1TnpnNE1UazVTREF1TnpVM056RTRXazB3TGpjM01Ea3lNaUF3TGpjME9EVTBOME13TGpjM05qTTVNaUF3TGpjME9EVTBOeUF3TGpjNE1EZ3lOU0F3TGpjMU1qazRNU0F3TGpjNE1EZ3lOU0F3TGpjMU9EUTFRekF1Tnpnd09ESTFJREF1TnpZek5EWTBJREF1TnpjM01TQXdMamMyTnpZd055QXdMamMzTWpJMk5pQXdMamMyT0RJMk0wd3dMamMzTURreU1pQXdMamMyT0RNMU5FZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamMyT0RNMU5DQXdMamN3TVRZMU9TQXdMamMyTXpreUlEQXVOekF4TmpVNUlEQXVOelU0TkRWRE1DNDNNREUyTlRrZ01DNDNOVE0wTXpjZ01DNDNNRFV6T0RRZ01DNDNORGt5T1RNZ01DNDNNVEF5TVRnZ01DNDNORGcyTXpoTU1DNDNNVEUxTmpJZ01DNDNORGcxTkRkSU1DNDNOekE1TWpKYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9NzI5YzE3OWUtMjc4OS00MjVmLTkxY2EtNDMzMjRjNTk3OTIxOyIgcGFyZW50PSI1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPjxteEdlb21ldHJ5IHg9IjY2IiB5PSIzMyIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMCIgdmFsdWU9IldlYiBDbGllbnQgLT4gV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTA2MmY3MDI1LWRlZDUtNGU4NC1hNGNiLWViMmNlNzgzYzljMztpci5hc3NldHM9Q3JlZGl0IENhcmQgRGF0YTtpci50YWdzPUhUVFBTOyIgcGFyZW50PSI1IiBzb3VyY2U9IjYiIHRhcmdldD0iNCIgZWRnZT0iMSI+PG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjYiIHZhbHVlPSJXZWIgQ2xpZW50IiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWNsaWVudDtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eHdZWFJvSUdROUlrMHdMalkxTURNNU9DQXdMalk1TkRJNU1rTXdMalkwTmprM05pQXdMalk1TkRNNU9DQXdMalkwTXpVME1TQXdMalk1TkRRMU1pQXdMalkwTURBNU15QXdMalk1TkRRMU1rTXdMall6TmpZME5pQXdMalk1TkRRMU1pQXdMall6TXpJeE1TQXdMalk1TkRNNU9DQXdMall5T1RjNE9TQXdMalk1TkRJNU1rZ3dMakkxTmpBNU0wTXdMakl5TXpRMk5pQXdMalk1TkRJNU1pQXdMakU1TnpBeE5pQXdMalkyTnpnMU9DQXdMakU1TnpBeE5pQXdMall6TlRJMU1WWXdMakk0TVRFMk4wTXdMakU1TnpBeE5pQXdMakkwT0RVMklEQXVNakl6TkRZMklEQXVNakl5TVRJM0lEQXVNalUyTURreklEQXVNakl5TVRJM1NEQXVNelV3TlRrNVF6QXVNell4TkRBMElEQXVNakF4TURBeklEQXVNemMwTkRVMklEQXVNVGd4TWpFNElEQXVNemc1TkRNNUlEQXVNVFl6TURnMlNEQXVNalUyTURrelF6QXVNVGt3T0RNNUlEQXVNVFl6TURnMklEQXVNVE0zT1RNNUlEQXVNakUxT1RVeklEQXVNVE0zT1RNNUlEQXVNamd4TVRZM1ZqQXVOak0xTWpVeFF6QXVNVE0zT1RNNUlEQXVOekF3TkRZMklEQXVNVGt3T0RNNUlEQXVOelV6TXpNeUlEQXVNalUyTURreklEQXVOelV6TXpNeVNEQXVNemMwTlRRelZqQXVPREV6TURBMFREQXVNamcxT1RnMUlEQXVPREV6TURBMVF6QXVNalk1TmpjeElEQXVPREV6TURBMUlEQXVNalUyTkRRM0lEQXVPREkyTWpJeUlEQXVNalUyTkRRM0lEQXVPRFF5TlRJMlF6QXVNalUyTkRRM0lEQXVPRFU0T0RJNUlEQXVNalk1TmpjeUlEQXVPRGN5TURRMklEQXVNamcxT1RnMklEQXVPRGN5TURRMlREQXVOams1TWprMklEQXVPRGN5TURRelF6QXVOekUxTmpFZ01DNDROekl3TkRJZ01DNDNNamc0TXpRZ01DNDROVGc0TWpZZ01DNDNNamc0TXpRZ01DNDROREkxTWpKRE1DNDNNamc0TXpRZ01DNDRNall5TVRnZ01DNDNNVFUyTURrZ01DNDRNVE13TURJZ01DNDJPVGt5T1RVZ01DNDRNVE13TURKTU1DNDJNVEEzTWpnZ01DNDRNVE13TUROV01DNDNOVE16TXpKSU1DNDNNamczTURsRE1DNDNPVE01TmpNZ01DNDNOVE16TXpJZ01DNDRORFk0TmpJZ01DNDNNREEwTmpZZ01DNDRORFk0TmpJZ01DNDJNelV5TlRGV01DNDJNakF5TWpoRE1DNDRNalk0TlRjZ01DNDJNelkzTXprZ01DNDRNRFE0TkRFZ01DNDJOVEE1TURNZ01DNDNPREV5TXpZZ01DNDJOakl5T1RoRE1DNDNOekUwTVRrZ01DNDJPREV6SURBdU56VXhOVGd5SURBdU5qazBNamt5SURBdU56STROekE1SURBdU5qazBNamt5U0RBdU5qVXdNems0V2swd0xqVTFNVFkxTVNBd0xqZ3hNekF3TTB3d0xqUXpNell5SURBdU9ERXpNREEwVmpBdU56VXpNek15U0RBdU5UVXhOalV4VmpBdU9ERXpNREF6V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMall5T1RBeU1TQXdMalkwTXpJNU5rTXdMamMzTlRJME5pQXdMalkwTXpJNU5pQXdMamc1TXpjNE5DQXdMalV5TkRjMU55QXdMamc1TXpjNE5DQXdMak0zT0RVek1rTXdMamc1TXpjNE5DQXdMakl6TWpNd09DQXdMamMzTlRJME5pQXdMakV4TXpjM0lEQXVOakk1TURJeElEQXVNVEV6TnpkRE1DNDBPREkzT1RZZ01DNHhNVE0zTnlBd0xqTTJOREkxT0NBd0xqSXpNak13T0NBd0xqTTJOREkxT0NBd0xqTTNPRFV6TWtNd0xqTTJOREkxT0NBd0xqVXlORGMxTnlBd0xqUTRNamM1TmlBd0xqWTBNekk1TmlBd0xqWXlPVEF5TVNBd0xqWTBNekk1TmxwTk1DNDNPRFUwTlRZZ01DNHpOemcxTVRaRE1DNDNPRFUwTlRZZ01DNDBOalE1TWpFZ01DNDNNVFUwTVNBd0xqVXpORGsyTmlBd0xqWXlPVEF3TlNBd0xqVXpORGsyTmtNd0xqVTBNall3TVNBd0xqVXpORGsyTmlBd0xqUTNNalUxTlNBd0xqUTJORGt5TVNBd0xqUTNNalUxTlNBd0xqTTNPRFV4TmtNd0xqUTNNalUxTlNBd0xqSTVNakV4TVNBd0xqVTBNall3TVNBd0xqSXlNakEyTmlBd0xqWXlPVEF3TlNBd0xqSXlNakEyTmtNd0xqY3hOVFF4SURBdU1qSXlNRFkySURBdU56ZzFORFUySURBdU1qa3lNVEV4SURBdU56ZzFORFUySURBdU16YzROVEUyV2swd0xqWTJOakkzTVNBd0xqSTRNRFEzTkVNd0xqWTFORFV4T0NBd0xqSTFOVEF4SURBdU5qUXdOVE0xSURBdU1qUTBOREUySURBdU5qSTVNREExSURBdU1qUTBOREUyUXpBdU5qRTNORGMySURBdU1qUTBOREUySURBdU5qQXpORGt6SURBdU1qVTFNREVnTUM0MU9URTNOQ0F3TGpJNE1EUTNORU13TGpVNE56VTJOQ0F3TGpJNE9UVXlNeUF3TGpVNE16a3pOU0F3TGpJNU9UazFNeUF3TGpVNE1UQXhPQ0F3TGpNeE1UUTJOa2d3TGpZM05qazVNa013TGpZM05EQTNOaUF3TGpJNU9UazFNeUF3TGpZM01EUTBOaUF3TGpJNE9UVXlNeUF3TGpZMk5qSTNNU0F3TGpJNE1EUTNORnBOTUM0MU5UZ3dNamtnTUM0ek1URTBOalpETUM0MU5qRTBORE1nTUM0eU9UWTFOelFnTUM0MU5qVTVOemtnTUM0eU9ESTVOVGNnTUM0MU56RTBORGNnTUM0eU56RXhNRGhETUM0MU56UXpPREVnTUM0eU5qUTNOVFFnTUM0MU56YzNJREF1TWpVNE5qZzFJREF1TlRneE16a2dNQzR5TlRNeE1UWkRNQzQxTlRJek9EY2dNQzR5TmpReE16UWdNQzQxTWpneE9UZ2dNQzR5T0RRNU1qVWdNQzQxTVRJNE5EWWdNQzR6TVRFME5qWklNQzQxTlRnd01qbGFUVEF1TlRVd056Z3hJREF1TXpjNE5URTJRekF1TlRVd056Z3hJREF1TXpZek1ESTVJREF1TlRVeE9EWXpJREF1TXpRNE1ERTBJREF1TlRVek9EazJJREF1TXpNek9ERTJTREF1TlRBeU5UTTFRekF1TkRrM05UazFJREF1TXpRM056azNJREF1TkRrME9UQTFJREF1TXpZeU9EUXpJREF1TkRrME9UQTFJREF1TXpjNE5URTJRekF1TkRrME9UQTFJREF1TXprME1Ua2dNQzQwT1RjMU9UVWdNQzQwTURreU16VWdNQzQxTURJMU16VWdNQzQwTWpNeU1UWklNQzQxTlRNNE9UWkRNQzQxTlRFNE5qTWdNQzQwTURrd01Ua2dNQzQxTlRBM09ERWdNQzR6T1RRd01EUWdNQzQxTlRBM09ERWdNQzR6TnpnMU1UWmFUVEF1TlRjeE5EUTNJREF1TkRnMU9USTBRekF1TlRZMU9UYzVJREF1TkRjME1EYzJJREF1TlRZeE5EUXpJREF1TkRZd05EVTVJREF1TlRVNE1ESTVJREF1TkRRMU5UWTNTREF1TlRFeU9EUTJRekF1TlRJNE1UazRJREF1TkRjeU1UQTRJREF1TlRVeU16ZzNJREF1TkRreU9EazRJREF1TlRneE16a2dNQzQxTURNNU1UZERNQzQxTnpjM0lEQXVORGs0TXpRNElEQXVOVGMwTXpneElEQXVORGt5TWpjNUlEQXVOVGN4TkRRM0lEQXVORGcxT1RJMFdrMHdMalkyTmpJM01TQXdMalEzTmpVMU9VTXdMalkzTURRME5pQXdMalEyTnpVeElEQXVOamMwTURjMklEQXVORFUzTURnZ01DNDJOelk1T1RJZ01DNDBORFUxTmpkSU1DNDFPREV3TVRoRE1DNDFPRE01TXpVZ01DNDBOVGN3T0NBd0xqVTROelUyTkNBd0xqUTJOelV4SURBdU5Ua3hOelFnTUM0ME56WTFOVGxETUM0Mk1ETTBPVE1nTUM0MU1ESXdNaklnTUM0Mk1UYzBOellnTUM0MU1USTJNVGNnTUM0Mk1qa3dNRFVnTUM0MU1USTJNVGRETUM0Mk5EQTFNelVnTUM0MU1USTJNVGNnTUM0Mk5UUTFNVGdnTUM0MU1ESXdNaklnTUM0Mk5qWXlOekVnTUM0ME56WTFOVGxhVFRBdU5UY3pNVE1nTUM0ek56ZzFNVFpETUM0MU56TXhNeUF3TGpNNU5ESXpPQ0F3TGpVM05ETXlOQ0F3TGpRd09USTJPQ0F3TGpVM05qUTVNaUF3TGpReU16SXhOa2d3TGpZNE1UVXhPVU13TGpZNE16WTROeUF3TGpRd09USTJPQ0F3TGpZNE5EZzRNU0F3TGpNNU5ESXpPQ0F3TGpZNE5EZzRNU0F3TGpNM09EVXhOa013TGpZNE5EZzRNU0F3TGpNMk1qYzVOU0F3TGpZNE16WTROeUF3TGpNME56YzJOU0F3TGpZNE1UVXhPU0F3TGpNek16Z3hOa2d3TGpVM05qUTVNa013TGpVM05ETXlOQ0F3TGpNME56YzJOU0F3TGpVM016RXpJREF1TXpZeU56azFJREF1TlRjek1UTWdNQzR6TnpnMU1UWmFUVEF1TnpRMU1UWTFJREF1TkRRMU5UWTNTREF1TmprNU9UZ3lRekF1TmprMk5UWTRJREF1TkRZd05EVTVJREF1TmpreU1ETXlJREF1TkRjME1EYzJJREF1TmpnMk5UWXpJREF1TkRnMU9USTBRekF1Tmpnek5qTWdNQzQwT1RJeU56a2dNQzQyT0RBek1UTWdNQzQwT1Rnek5EZ2dNQzQyTnpZMk1qSWdNQzQxTURNNU1UZERNQzQzTURVMk1qUWdNQzQwT1RJNE9UZ2dNQzQzTWprNE1UTWdNQzQwTnpJeE1EZ2dNQzQzTkRVeE5qVWdNQzQwTkRVMU5qZGFUVEF1TnpBME1URTFJREF1TkRJek1qRTJTREF1TnpVMU5EYzJRekF1TnpZd05ERTJJREF1TkRBNU1qTTFJREF1TnpZek1UQTFJREF1TXprME1Ua2dNQzQzTmpNeE1EVWdNQzR6TnpnMU1UWkRNQzQzTmpNeE1EVWdNQzR6TmpJNE5ETWdNQzQzTmpBME1UWWdNQzR6TkRjM09UY2dNQzQzTlRVME56WWdNQzR6TXpNNE1UWklNQzQzTURReE1UVkRNQzQzTURZeE5EZ2dNQzR6TkRnd01UUWdNQzQzTURjeU16SWdNQzR6TmpNd01qa2dNQzQzTURjeU16SWdNQzR6TnpnMU1UWkRNQzQzTURjeU16SWdNQzR6T1RRd01EUWdNQzQzTURZeE5EZ2dNQzQwTURrd01Ua2dNQzQzTURReE1UVWdNQzQwTWpNeU1UWmFUVEF1TnpRMU1UWTFJREF1TXpFeE5EWTJRekF1TnpJNU9ERXpJREF1TWpnME9USTFJREF1TnpBMU5qSTBJREF1TWpZME1UTTBJREF1TmpjMk5qSXlJREF1TWpVek1URTJRekF1Tmpnd016RXpJREF1TWpVNE5qZzFJREF1Tmpnek5qTWdNQzR5TmpRM05UUWdNQzQyT0RZMU5qTWdNQzR5TnpFeE1EaERNQzQyT1RJd016SWdNQzR5T0RJNU5UY2dNQzQyT1RZMU5qZ2dNQzR5T1RZMU56UWdNQzQyT1RrNU9ESWdNQzR6TVRFME5qWklNQzQzTkRVeE5qVmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpBdU9UZzBOakUxSWlCb1pXbG5hSFE5SWpBdU9UZzBOakUxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUNBd0xqQXhOVE00TURrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTVhNmY2ZWQ1LTFjZjAtNDE2Yy1hOWRjLTY0MTQ3YzlkYTA0ZjsiIHBhcmVudD0iNSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSIyODciIHk9IjI4IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjIxIiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj48bXhHZW9tZXRyeSB4PSItNTk4IiB5PSIxNjMiIHdpZHRoPSIyMzAiIGhlaWdodD0iMTgwIiBhcz0iZ2VvbWV0cnkiLz48L214Q2VsbD48bXhDZWxsIGlkPSIyMiIgdmFsdWU9Ik1pY3Jvc29mdCBTUUwgU2VydmVyIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zb2Z0LXNxbC1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGd3TnpoRE1DNDRNemsyTmpnZ01DNHpOREE0T1RnZ01DNDJPRGMwTXpNZ01DNDBNVFl3TnpnZ01DNDBPVGsyTmpnZ01DNDBNVFl3TnpoRE1DNHpNVEU1TURNZ01DNDBNVFl3TnpnZ01DNHhOVGsyTmpnZ01DNHpOREE0T1RnZ01DNHhOVGsyTmpnZ01DNHlORGd3TnpoRE1DNHhOVGsyTmpnZ01DNHhOVFV5TlRnZ01DNHpNVEU1TURNZ01DNHdPREF3TnpneElEQXVORGs1TmpZNElEQXVNRGd3TURjNE1VTXdMalk0TnpRek15QXdMakE0TURBM09ERWdNQzQ0TXprMk5qZ2dNQzR4TlRVeU5UZ2dNQzQ0TXprMk5qZ2dNQzR5TkRnd056aGFUVEF1T0RNNU5qWTRJREF1TXpjMk16QTBRekF1T0RFNE1UZzJJREF1TXprME9UYzVJREF1TnprME1qa3hJREF1TkRFd056VTFJREF1TnpZNE5qQTRJREF1TkRJek1qRTRRekF1TmprMk5EUXpJREF1TkRVNE9ETTBJREF1TmpBeE16STRJREF1TkRjNU1EYzRJREF1TkRrNU5qWTRJREF1TkRjNU1EYzRRekF1TXprNE1EQTRJREF1TkRjNU1EYzRJREF1TXpBeU9Ea3pJREF1TkRVNE9ETTBJREF1TWpNd056STRJREF1TkRJek1qRTRRekF1TWpBMU1EUTJJREF1TkRFd056VTFJREF1TVRneE1UVWdNQzR6T1RRNU56a2dNQzR4TlRrMk5qZ2dNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TlRrMk5qZ2dNQzQ0TkRRNE9UZ2dNQzR6TVRFNU1ETWdNQzQ1TWpBd056Z2dNQzQwT1RrMk5qZ2dNQzQ1TWpBd056aERNQzQyT0RjME16TWdNQzQ1TWpBd056Z2dNQzQ0TXprMk5qZ2dNQzQ0TkRRNE9UZ2dNQzQ0TXprMk5qZ2dNQzQzTlRJd056aFdNQzR6TnpZek1EUmFUVEF1TlRBNE56TWdNQzQxTWpFeU56ZERNQzQxTURjMU5qZ2dNQzQxTWpFeE1qRWdNQzQwT0RnNE16RWdNQzQxTWpjNE56WWdNQzQwTnpZM05EUWdNQzQxTXpJM09EUkRNQzQwTmpBME16SWdNQzQxTXprME16Y2dNQzQwTkRjM05qVWdNQzQxTkRVM056RWdNQzQwTXprNU5UTWdNQzQxTlRFeU5UbERNQzQwTXpjME16VWdNQzQxTlRNd05EUWdNQzQwTXpRek5qSWdNQzQxTlRZd01Ua2dNQzQwTXpNeU1USWdNQzQxTlRjM01EZE1NQzQwTXpNd01UWWdNQzQxTlRnd01UUk1NQzQwTXpJNE1qY2dNQzQxTlRnek9EUkRNQzQwTXpJMk1UY2dNQzQxTlRnNU1UTWdNQzQwTXpJMU1TQXdMalUxT1RVME5pQXdMalF6TWpVeElEQXVOVFl3TVRjNVREQXVORE15TmpneUlEQXVOVFl3TXpReFF6QXVORE15TnpJNElEQXVOVFl3T1RBMklEQXVORE15T0RZeklEQXVOVFl4TlRReklEQXVORE16TVRRMElEQXVOVFl5TWpNNVF6QXVORE16T0RNZ01DNDFOak01TWpjZ01DNDBNelU0TXpjZ01DNDFOalU1T0RVZ01DNDBNemd4TURVZ01DNDFOamd3T1RkRE1DNDBNemd4TURVZ01DNDFOamd3T1RjZ01DNDBOakUxT1RRZ01DNDFPVEV3TURRZ01DNDBOalEwTkRNZ01DNDFPVFF5TnpkRE1DNDBOemMwTWpnZ01DNDJNRGt5TmpjZ01DNDBPRE13TnpZZ01DNDJNalF3TkRjZ01DNDBPRE0yTURRZ01DNDJORFEwTWpGRE1DNDBPRE01TWpFZ01DNDJOVGMxTVRFZ01DNDBPREUwTkNBd0xqWTJPVEF4T0NBd0xqUTNOVEkyTkNBd0xqWTRNak0zTkVNd0xqUTJOREk0TlNBd0xqY3dOak16TmlBd0xqUTBNVFk0TVNBd0xqY3pNalU1TWlBd0xqUXdOVGswTnlBd0xqYzJNVGt6T1V3d0xqUXdOVEV4TlNBd0xqYzJNall3TWtNd0xqUXdNek0xTnlBd0xqYzJNems1TXlBd0xqUXdNVEkwT1NBd0xqYzJOVGc0TXlBd0xqTTVPVEUxTXlBd0xqYzJOemt3TjBNd0xqTTVOakUxTkNBd0xqYzNNRGdnTUM0ek9UTXhPREVnTUM0M056TTVOalFnTUM0ek9URXlPRGNnTUM0M056WXpNalpETUM0ek9EWTBPRElnTUM0M09ESXpORE1nTUM0ek9ESTJPRE1nTUM0M09EZzNNamtnTUM0ek9ERXdORFlnTUM0M09UTTJNemxETUM0ek56Z3hORE1nTUM0NE1ESTFNRGdnTUM0ek56azFOamdnTUM0NE1URTBPQ0F3TGpNNE5URTJOQ0F3TGpneE9UYzJOME13TGpNNU1qTTBNaUF3TGpnek1ETXlNeUF3TGpRd05qWTBOeUF3TGpnME1UQTVNaUF3TGpReU16TXlOU0F3TGpnME9EUXlOME13TGpRek1UZ3lOQ0F3TGpnMU1qRTNOeUF3TGpRME5qRXlPU0F3TGpnMU5qazRJREF1TkRVMk9EazJJREF1T0RVNU5qY3hRekF1TkRjME56ZzVJREF1T0RZME1qRXhJREF1TlRBNU5ERTFJREF1T0RZNU1USWdNQzQxTWpnME5qa2dNQzQ0TmprNE5UaERNQzQxTXpJek1qSWdNQzQ0TnpBd01UY2dNQzQxTXprMU56a2dNQzQ0TmprNU56Y2dNQzQxTXprMU56a2dNQzQ0TmprNU56ZERNQzQxTXprMU56a2dNQzQ0TmprNU56Y2dNQzQxTkRFd09EUWdNQzQ0TmpNNU5EY2dNQzQxTkRRMU1UWWdNQzQ0TlRZNU1qWkRNQzQxTkRRMU1UWWdNQzQ0TlRZNU1qWWdNQzQxTlRnNE56SWdNQzQ0TVRrd09TQXdMalUyTkRjek1pQXdMamM1T1RrM09Vd3dMalUyTlRrMk9DQXdMamM1TlRrMk9FTXdMalUzTURreU5TQXdMamMzT1Rrd05pQXdMalUzTWprNU5DQXdMamMzTXpJZ01DNDFOelExTnprZ01DNDNORGs1TnpoRE1DNDFOell5TkRFZ01DNDNNalUyTnpJZ01DNDFOell4TkRFZ01DNDNNak00TkRjZ01DNDFOelU0TkRRZ01DNDNNVGcwTmpSTU1DNDFOelU0TVRVZ01DNDNNVGM1TkRsRE1DNDFOelV6TkNBd0xqY3dPRFEwT1NBd0xqVTNORFE1TlNBd0xqY3dNRGMwTVNBd0xqVTNNekUzTnlBd0xqWTVNekU1TkV3d0xqVTNNamszTVNBd0xqWTVNVFU0UXpBdU5qRTFNemd6SURBdU5qYzRPVGd5SURBdU5qWXlNamd4SURBdU5qWTNOVGszSURBdU5qa3pNelkxSURBdU5qWXlPRFF5VERBdU5qazRNVFk0SURBdU5qWXlNVEEwVERBdU5qazNORE1nTUM0Mk5qQTVORE5ETUM0Mk9UTXlNRGNnTUM0Mk5UUXpPVGNnTUM0Mk9UQXpNRFFnTUM0Mk5UQXpNeklnTUM0Mk9EWTRNVGtnTUM0Mk5EWXdNRFJETUM0Mk56WTJPRFVnTUM0Mk16TTBORElnTUM0Mk5qUXpPRGtnTUM0Mk1qTXlOVFVnTUM0Mk5Ea3pORE1nTUM0Mk1UUTRNVU13TGpZeU9EWTFNeUF3TGpZd016STFNU0F3TGpZd01UZzVNU0F3TGpVNU5ESXlOU0F3TGpVMk9EQXdOU0F3TGpVNE56VXlNVXd3TGpVMU5EQTNOU0F3TGpVNE5Vd3dMalV6TmpFNE9DQXdMalU0TWpBNE4wd3dMalV6TlRFeU1pQXdMalU0TURFNE5FTXdMalV5T0RnNU15QXdMalUyT1RJd05TQXdMalV5TWpBek1pQXdMalUxTlRVNE5pQXdMalV4T0RBeU1TQXdMalUwTmpRd01rd3dMalV4TlRjeE1TQXdMalUwTURnMVF6QXVOVEV6TkRrNElEQXVOVE0xTWpZNUlEQXVOVEV4TlRNMklEQXVOVEk1TlRVeklEQXVOVEV3TXpFeklEQXVOVEkxTVRNeVF6QXVOVEE1TkRFM0lEQXVOVEl4TlRReUlEQXVOVEE1TXpFZ01DNDFNakV6TXlBd0xqVXdPRGN6SURBdU5USXhNamMzV2swd0xqUTBOemMwTWlBd0xqVTNNVEU1Tmt3d0xqUTBOalU0TVNBd0xqVTNNRGcwT1V3d0xqUTBPVEUyTnlBd0xqVTNNamt3TjBNd0xqUTJNRFEyTXlBd0xqVTRNVGMzTkNBd0xqUTNNREl5T0NBd0xqVTVNamd3TmlBd0xqUTNOalF3TWlBd0xqWXdNelkzT0VNd0xqUTNOekE0T1NBd0xqWXdORGc1TXlBd0xqUTNOelkyT1NBd0xqWXdOVGM1TWlBd0xqUTNOemN5TWlBd0xqWXdOVGN6T0VNd0xqUTNOemMzTmlBd0xqWXdOVGN6T0NBd0xqUTNOekkwTnlBd0xqWXdNell5TnlBd0xqUTNOalUyTWlBd0xqWXdNVEUwTlV3d0xqUTNNelF3TmlBd0xqVTVNRFEzTjBNd0xqUTNNVFF3TVNBd0xqVTRNemsxTWlBd0xqUTJPVEk1TkNBd0xqVTNOelF4SURBdU5EWTVNRFkzSURBdU5UYzNNVGd6VERBdU5EWTRNalkwSURBdU5UYzJPVGN5VERBdU5EWXpNakEzSURBdU5UYzFOalV5VERBdU5EVTJNalFnTUM0MU56TTRNRFZNTUM0ME5EZzFPRGNnTUM0MU56RTBPREpNTUM0ME5EYzNORElnTUM0MU56RXhPVFphVFRBdU5EYzFNems1SURBdU5UYzROVEF4VERBdU5EY3lOVFE1SURBdU5UYzRNREk0VERBdU5EY3lOVEV4SURBdU5UYzRNRE00VERBdU5EY3pOVFV6SURBdU5UZ3dOREF4UXpBdU5EYzNNVFF5SURBdU5UZzRNRFUxSURBdU5EZ3hNU0F3TGpVNU9Ea3lPU0F3TGpRNE15QXdMall3TmpJMk5Vd3dMalE0TXpVNE1pQXdMall3T0RJM01Vd3dMalE0TmpRek1TQXdMall3TlRRM00wTXdMalE0T1RReU5DQXdMall3TWpRNE1pQXdMalE1TXpNeklEQXVOVGs1TWpJNElEQXVORGszTnpFMUlEQXVOVGsyTURjMFREQXVOVEF4TXpZNUlEQXVOVGt6TlRRMFF6QXVOVEF6TmpreElEQXVOVGt4T1RZeElEQXVOVEV3TnpFeUlEQXVOVGczTnpreUlEQXVOVEV5TkRVeklEQXVOVGcyT0RrMVREQXVOVEV6T0RnZ01DNDFPRFU1T1RkTU1DNDFNVE15TmpJZ01DNDFPRFUzT0RKTU1DNDFNVEEzTmpNZ01DNDFPRFV6TVVNd0xqVXdNRFEzTVNBd0xqVTRNelUyT1NBd0xqUTRORE0zTXlBd0xqVTRNRFV3T0NBd0xqUTNOVE01T1NBd0xqVTNPRFV3TVZwTk1DNDFNVGd5TlRrZ01DNDFPRFkzTXpkTU1DNDFNVGczTnlBd0xqVTROemN6TlV3d0xqVXlNREUxT1NBd0xqVTVNalU1TlVNd0xqVXlNakV4TWlBd0xqWXdNREkwT1NBd0xqVXlNekF4SURBdU5qQTROems1SURBdU5USXlOamswSURBdU5qRTJOemRNTUM0MU1qSXpOelVnTUM0Mk1qRXpNVXd3TGpVeU1qSXhPU0F3TGpZeU1UZ3pOa3d3TGpVeE9UUTNOQ0F3TGpZeU1EazBUREF1TlRBMk1EUXlJREF1TmpFMk9EbE1NQzQwT1RZM056Y2dNQzQyTVRReU16VkRNQzQwT1RJeU9TQXdMall4TXpBeU1pQXdMalE0T0RZME9TQXdMall4TVRreE5DQXdMalE0T0RZME9TQXdMall4TVRnd04wTXdMalE0T0RZME9TQXdMall4TVRRNU1TQXdMalE1TlRFNU15QXdMall3TkRrME55QXdMalE1TnprNU1pQXdMall3TWpRMk5VTXdMalV3TXpNeU1TQXdMalU1TnpjMk55QXdMalV4TnpjNE5DQXdMalU0TmpVM055QXdMalV4T0RJMU9TQXdMalU0Tmpjek4xcE5NQzQxTlRNMk1qTWdNQzQxT1RJM05UTkRNQzQxTkRNM05UTWdNQzQxT1RBNE5UTWdNQzQxTWpJd05pQXdMalU0TnpFd05TQXdMalV5TVRrd01pQXdMalU0TnpJMk5Fd3dMalV5TWpVek5TQXdMalU0T0RrMU0wTXdMalV5TmpJeklEQXVOVGszTlRBMElEQXVOVEk0TWpNMklEQXVOakEzTmpNNElEQXVOVEk0TWpNMklEQXVOakUzTmpZM1REQXVOVEk0TXpReElEQXVOakl4TURRMVREQXVOVE16TXpVMklEQXVOakUzTnpjeVF6QXVOVFF6TmpRNElEQXVOakV3T1RFeElEQXVOVFV6T1RreklEQXVOakExTWpZeklEQXVOVFkzT1RJNElEQXVOVGs0T1RneVREQXVOVGN4TlRrMklEQXVOVGszTWpNelF6QXVOVGN5TWpJM0lEQXVOVGsyT0RnMklEQXVOVGN5TkRFeElEQXVOVGsyTnpFeElEQXVOVGN5TWpVMklEQXVOVGsyTmpVNVF6QXVOVGN4TmpJeklEQXVOVGsyTXprMklEQXVOVFl3T1RZeElEQXVOVGswTVRjNElEQXVOVFV6TmpJeklEQXVOVGt5TnpVeldrMHdMalUzT0RBd09TQXdMalU1T0RNME9VTXdMalUzT0RFMk55QXdMalU1T0RVd055QXdMalUzTnpRNElEQXVOakF5TnpneUlEQXVOVGMyT0RRM0lEQXVOakExTXpFMVF6QXVOVGMwT1RRM0lEQXVOakV6TVRneElEQXVOVFk1T0RJNElEQXVOakkwT0RRMklEQXVOVFl6TlRRM0lEQXVOak0xT0RJMVREQXVOVFl4TXpJNUlEQXVOak01TkRFMFREQXVOVFU0TVRZeklEQXVOak0zTnpJMFF6QXVOVFV5TURRZ01DNDJNelF4TXpVZ01DNDFORFV3TnpNZ01DNDJNekEzTlRjZ01DNDFNemMwTnpJZ01DNDJNamMxT0RsTU1DNDFNelUzTXpnZ01DNDJNalk0Tmt3d0xqVXpNelEyTVNBd0xqWXlOVGcwT1VNd0xqVXpNekE1TVNBd0xqWXlOVFV6TVNBd0xqVTFNREE0TnlBd0xqWXhOREk0T1NBd0xqVTFPVEEyTVNBd0xqWXdPRGt3TkVNd0xqVTJOakU0TnlBd0xqWXdORFUzTnlBd0xqVTNOemM1TnlBd0xqVTVPREV6TnlBd0xqVTNPREF3T1NBd0xqVTVPRE0wT1ZwTk1DNDFPVGN4TVRZZ01DNDJNRE13T1RoTU1DNDFPVEkxTlRZZ01DNDJNREUzT0RoTU1DNDFPREl3TWlBd0xqVTVPRGs0TWtNd0xqVTRNVGt5TXlBd0xqVTVPRGs0TWlBd0xqVTRNVGd5TlNBd0xqVTVPVEk0TWlBd0xqVTRNVGMxTXlBd0xqVTVPVGMwTmtNd0xqVTRNVGN3TnlBd0xqWXdNREF6TmlBd0xqVTRNVFkzTVNBd0xqWXdNRE01SURBdU5UZ3hOalVnTUM0Mk1EQTNOelZETUM0MU9EQTNOVE1nTUM0Mk1URTBNemtnTUM0MU56Y3hNVElnTUM0Mk1qTTVORGdnTUM0MU56RTBOalVnTUM0Mk16VTVNME13TGpVM01URXdPQ0F3TGpZek5qWTVPQ0F3TGpVM01EYzVNeUF3TGpZek56TTVOaUF3TGpVM01EVTRPU0F3TGpZek56ZzRPRU13TGpVM01EUWdNQzQyTXpnek5ETWdNQzQxTnpBek1EVWdNQzQyTXpnMk1qTWdNQzQxTnpBek5UWWdNQzQyTXpnMk1qTk1NQzQxTnpNek5qUWdNQzQyTXpjME5qRkRNQzQxT1RJeE1ESWdNQzQyTWprNE5pQXdMall4TVRVeU5pQXdMall5TXpnME15QXdMall6TkRJeU1pQXdMall4T0RZeE4wd3dMall6TmpreE15QXdMall4TnprNE0wd3dMall6TXpBMklEQXVOakUyTWpReVF6QXVOakl6TnpjeUlEQXVOakV5TURFNUlEQXVOakE1TlRJZ01DNDJNRFkzT1RVZ01DNDFPVGN4TVRZZ01DNDJNRE13T1RoYVRUQXVORGt5T1RjMUlEQXVOakl5TXpZMlREQXVORGszT0RNeklEQXVOakl6TmpNeFF6QXVOVEF6T0RRNUlEQXVOakkxTXpJeElEQXVOVEUyTmpJeklEQXVOakk1TlRrMUlEQXVOVEUyTmpJeklEQXVOakk1T1RFeVREQXVOVEUwT1RnMklEQXVOak14TXpjeFREQXVOVEV6TlRFZ01DNDJNekkyTlRkRE1DNDFNRFkxT1RZZ01DNDJNemcwTVRFZ01DNDBPVGs1TkRVZ01DNDJORFEwT0NBd0xqUTVNVGszTkNBd0xqWTFNakU0Tmt3d0xqUTROelE0T0NBd0xqWTFOak13TkVNd0xqUTROek00TVNBd0xqWTFOak13TkNBd0xqUTROek15T1NBd0xqWTFOVGs0TnlBd0xqUTROek00TVNBd0xqWTFOVFUyTkVNd0xqUTRPRFU1TmlBd0xqWTBOalk1TnlBd0xqUTRPRE16TXlBd0xqWXpOVEk1TmlBd0xqUTROalkwTXlBd0xqWXlNemN6Tmt3d0xqUTROalV6TmlBd0xqWXlNamMyTjB3d0xqUTROak00SURBdU5qSXdPVFJETUM0ME9EWTBPRE1nTUM0Mk1qQTRNemNnTUM0ME9EazJOelFnTUM0Mk1qRTFOU0F3TGpRNU1qazNOU0F3TGpZeU1qTTJObHBOTUM0Mk16a3hOelFnTUM0Mk1qTTBOalZNTUM0Mk5EQTFOVFlnTUM0Mk1qRXdPVGhETUM0Mk5EQTBOVEVnTUM0Mk1qQTVPVEVnTUM0Mk16TTJORElnTUM0Mk1qSTVORFFnTUM0Mk1qY3lOVFFnTUM0Mk1qUTVOVEZETUM0Mk1UVXdOakVnTUM0Mk1qZzJPVGtnTUM0MU9UZzRNRFlnTUM0Mk16UTFNRFVnTUM0MU9EWTROellnTUM0Mk16a3pOakZETUM0MU9EQXdOamNnTUM0Mk5ESXhNRFlnTUM0MU56RXdPVFVnTUM0Mk5EVTVOVGdnTUM0MU56RXdPVFVnTUM0Mk5EWXhNVGRNTUM0MU56SXhOVEVnTUM0Mk5EY3dNVE5NTUM0MU56WXdOVFlnTUM0Mk5UQXhPREZETUM0MU9EUTBORGdnTUM0Mk5UY3hORGtnTUM0MU9URTFNaklnTUM0Mk5qUTVNRGdnTUM0MU9UYzBNek1nTUM0Mk56TTNOelZNTUM0MU9UZzVNVEVnTUM0Mk56VTRPRFZNTUM0Mk1ERXdNRFFnTUM0Mk56TXpNREpNTUM0Mk1ESTRNVGdnTUM0Mk56RXdNekZNTUM0Mk1UWTJORFlnTUM0Mk5UTTFOVGxETUM0Mk1qY3hOU0F3TGpZME1ETTJOQ0F3TGpZek1UYzVOaUF3TGpZek5ETTBOaUF3TGpZek5EazJNaUF3TGpZeU9UZ3dOMHd3TGpZek9URTNOQ0F3TGpZeU16UTJOVnBOTUM0Mk5EUTJNakVnTUM0Mk1qSXhOVE5NTUM0Mk5EVTBNRE1nTUM0Mk1qSTBNalpNTUM0Mk5EYzJNamtnTUM0Mk1qTTJNekZETUM0Mk5qQTBOVFlnTUM0Mk16QTVOamNnTUM0Mk56TXdNVGdnTUM0Mk5EQTBNVFlnTUM0Mk9ESTVOREVnTUM0Mk5UQXhNamhETUM0Mk9EVTNOQ0F3TGpZMU1qZzNNeUF3TGpZNU1qWTFOQ0F3TGpZMk1EQTFNaUF3TGpZNU1qVTBOeUF3TGpZMk1ERXdNMHd3TGpZNE56STJPU0F3TGpZMk1EVXlOME13TGpZMk5UQTBPU0F3TGpZMk1qSXhOeUF3TGpZek5qVTVPU0F3TGpZMk5qa3hNeUF3TGpZd09USTFOeUF3TGpZM016VXhUREF1TmpBMU5qWTNJREF1TmpjME16QXlRekF1TmpBMU5UWXlJREF1TmpjME16QXlJREF1TmpBM05qSWdNQzQyTnpJeU5EUWdNQzQyTVRBeU1Ea2dNQzQyTmprM05qUkRNQzQyTWpZeU5UTWdNQzQyTlRReU9UY2dNQzQyTXpNMU9URWdNQzQyTkRRMU16UWdNQzQyTkRJeU5EWWdNQzQyTWpjeE1UUk1NQzQyTkRRMk1qRWdNQzQyTWpJeE5UTmFUVEF1TlRNNU9EUTRJREF1TmpRd01UVXlRekF1TlRNME5qYzJJREF1TmpNM05UWTJJREF1TlRJM09ERXpJREF1TmpNME16UTJJREF1TlRJM01EY3pJREF1TmpNME1UZzRRekF1TlRJMk9URTNJREF1TmpNME1UZzRJREF1TlRJMk56QTFJREF1TmpNME56RTNJREF1TlRJMk5EazFJREF1TmpNMU5UQTRRekF1TlRJME16TWdNQzQyTkRVMU9EZ2dNQzQxTWpBMU1qa2dNQzQyTlRVNU16UWdNQzQxTVRVM056a2dNQzQyTmpRMU9EbERNQzQxTVRRek5UTWdNQzQyTmpjeE56WWdNQzQxTVRRek1ERWdNQzQyTmpjek9Ea2dNQzQxTVRRMU1UTWdNQzQyTmpjek9EbE1NQzQxTVRreU1Ea2dNQzQyTmpRMU9EbERNQzQxTWpnd056Z2dNQzQyTlRreU1EY2dNQzQxTXpZMU56VWdNQzQyTlRRMU1Ea2dNQzQxTkRZME9Ua2dNQzQyTkRrMU5EaERNQzQxTkRrMk1USWdNQzQyTkRnd01UWWdNQzQxTlRJeE5EVWdNQzQyTkRZMk9UY2dNQzQxTlRJd09UUWdNQzQyTkRZMk5EVk1NQzQxTkRreE5qZ2dNQzQyTkRVd01ERk1NQzQxTXprNE5EZ2dNQzQyTkRBeE5USmFUVEF1TlRJd01qRXlJREF1TmpNMU5EVTFRekF1TlRJd016Y2dNQzQyTXpVMk1UTWdNQzQxTVRnMU56WWdNQzQyTkRJeE1EWWdNQzQxTVRjME5qY2dNQzQyTkRVMk5ESkRNQzQxTVRVek1ETWdNQzQyTlRJek5EUWdNQzQxTVRFMk5qSWdNQzQyTmpBM016Y2dNQzQxTURneE1qVWdNQzQyTmpjd056Rk1NQzQxTURZNE5qWWdNQzQyTmpreU5URk1NQzQxTURVek1qY2dNQzQyTnpFNU1qZE1NQzQxTURRd01EY2dNQzQyTnpRd016aE1NQzQxTURFd05UTWdNQzQyTnpFeE9EbE1NQzQwT1RreE1ESWdNQzQyTmprek56VkRNQzQwT1RjM09Ua2dNQzQyTmpneU1qRWdNQzQwT1RZMU5UVWdNQzQyTmpjeU16a2dNQzQwT1RVeU56VWdNQzQyTmpZek5UbE1NQzQwT1RNeU9ESWdNQzQyTmpVd09EVk1NQzQwT1RFeU16WWdNQzQyTmpNNU5UWk1NQzQwT0RnM01ERWdNQzQyTmpJME9FTXdMalE0T0Rjd01TQXdMalkyTWpBMU5pQXdMalE1TnpjeU5pQXdMalkxTXpnM05pQXdMalV3TkRZME1TQXdMalkwTnprMk5Vd3dMalV4TXpBNE5pQXdMalkwTURrMk4wTXdMalV4TlRVek5pQXdMall6T0RrNE9DQXdMalV4TnpjNE55QXdMall6TnpJd05pQXdMalV4T1RBM09TQXdMall6TmpJek1rTXdMalV4T1RjMk5pQXdMall6TlRjeE5DQXdMalV5TURFNE1pQXdMall6TlRReU5DQXdMalV5TURJeE1pQXdMall6TlRRMU5WcE5NQzQxTmpRM05qSWdNQzQyTlRRME1EUk1NQzQxTmpJeE56WWdNQzQyTlRJM01UUk1NQzQxTmpBek1qZ2dNQzQyTlRVMU5qUkRNQzQxTlRFeE5EUWdNQzQyTmprek5ERWdNQzQxTXpnM09USWdNQzQyT0RNME9EY2dNQzQxTWpRNE5UY2dNQzQyT1RZek1USk1NQzQxTWpBMk1UVWdNQzQzTURBeU5ESk1NQzQxTVRrNE5qTWdNQzQzTURFd05USk1NQzQxTWlBd0xqY3dNVEEyTkV3d0xqVXlORFkwTnlBd0xqWTVPVFF5TjBNd0xqVTBOalEwTmlBd0xqWTVNVFF3TlNBd0xqVTJOVEV6SURBdU5qZzFORE01SURBdU5UZzVNekEySURBdU5qYzROek0yVERBdU5Ua3pOVGdnTUM0Mk56YzFNak5NTUM0MU9USTVORGNnTUM0Mk56WTRNelpETUM0MU9URTNPRFVnTUM0Mk56VTFOeUF3TGpVNE5UazNPU0F3TGpZM01ETTBOQ0F3TGpVNE1qazNNaUF3TGpZMk56ZzJNa013TGpVM056WXpPU0F3TGpZMk16TTNOaUF3TGpVM01EWTNNeUF3TGpZMU9ESTFOeUF3TGpVMk5EYzJNaUF3TGpZMU5EUXdORnBOTUM0MU5URXhORFFnTUM0Mk5UVTBOVGxNTUM0MU5EZzFJREF1TmpVNU16VTVUREF1TlRNNU5qZzRJREF1TmpjeE5UQTFRekF1TlRNME5URTFJREF1TmpjNE16WTJJREF1TlRJMU16TXhJREF1TmpnNU9EY3pJREF1TlRFNE9UazNJREF1TmprM016WTNUREF1TlRFek9UZzFJREF1TnpBek1USXlUREF1TlRFek9EYzJJREF1TnpBeU9UZ3hUREF1TlRFek56azRJREF1TnpBeU16TTJUREF1TlRFek56Y3pJREF1TnpBeE1UWTVRekF1TlRFek56Y3pJREF1TmprME56Z3hJREF1TlRFeU1UTTJJREF1TmpnM09UY3lJREF1TlRBNU1qZzNJREF1TmpneU1UWTRRekF1TlRBNE1EY3lJREF1TmpjNU56TTVJREF1TlRBM09EWWdNQzQyTnpreE5UZ2dNQzQxTURneE1qVWdNQzQyTnpnNE9UVkRNQzQxTURnM01pQXdMalkzT0RNMk1pQXdMalV4TkRNMU15QXdMalkzTlRBM0lEQXVOVEl3T0RZMElEQXVOamN4TXpnNVREQXVOVE0wTVRrNUlEQXVOalkwTURGRE1DNDFOREEzTkRVZ01DNDJOakExTWpjZ01DNDFOVEE1T0RNZ01DNDJOVFV6TlRRZ01DNDFOVEV4TkRRZ01DNDJOVFUwTlRsYVRUQXVORGczTVRjeElEQXVOamN6TVRrelREQXVORGcwTkRJMUlEQXVOamN4T0RJeVF6QXVORGcwTXpJZ01DNDJOekU0TWpJZ01DNDBPRE0zT1RFZ01DNDJOekk1T0RRZ01DNDBPRE16TnlBd0xqWTNORFV4TTB3d0xqUTRNRGcyT1NBd0xqWTRNVEU1TjB3d0xqUTNPRGt6TnlBd0xqWTROVFUwTlVNd0xqUTNOekE0T1NBd0xqWTRPVE01T0NBd0xqUTNOVE0wT0NBd0xqWTVNalF3T0NBd0xqUTNNVGcyTXlBd0xqWTVOemN6T1VNd0xqUTNNVE16TmlBd0xqWTVPRFV6TVNBd0xqUTNNVFE1TXlBd0xqWTVPRFF5TkNBd0xqUTNOakV6T1NBd0xqWTVORGN5T1VNd0xqUTRNRFUzTkNBd0xqWTVNVEU1TXlBd0xqUTRPREUzTXlBd0xqWTROVFF6T1NBd0xqUTVNekU0TnlBd0xqWTRNVGcxTVV3d0xqUTVOVEk0TXlBd0xqWTRNREkwTjB3d0xqUTVOakF5TXlBd0xqWTNPVFl4TlV3d0xqUTVOakkwT0NBd0xqWTNPVE14T0VNd0xqUTVNelUxTnlBd0xqWTNOekVnTUM0ME9UQTFORGtnTUM0Mk56VXdORElnTUM0ME9EY3hOekVnTUM0Mk56TXhPVE5hVFRBdU5UQXlNakUwSURBdU5qZzFOelUzVERBdU5UQXlORE00SURBdU5qZzFPRE16VERBdU5UQXlOekVnTUM0Mk9EWXhNak5NTUM0MU1EUXhPRGNnTUM0Mk9EZ3lOREpNTUM0MU1EUXlNVGtnTUM0Mk9EZ3lPVU13TGpVd056SXlOeUF3TGpZNU1qYzNOaUF3TGpVd09UVTFJREF1TmprNE56azBJREF1TlRFd01UTXlJREF1TnpBek5qVk1NQzQxTVRBeU16Y2dNQzQzTURRM01EZE1NQzQxTURNd01EWWdNQzQzTURjMU1ETkRNQzQwT1RBd056UWdNQzQzTVRJMU1UY2dNQzQwTnpneE5EWWdNQzQzTVRjME9DQXdMalEzTURBMk9DQXdMamN5TVRFM00wd3dMalEyTVRJMU5DQXdMamN5TlRNNU9FTXdMalExT0RZMk9DQXdMamN5TmpjeE5pQXdMalExTmpVMU5pQXdMamN5TnpjeE9TQXdMalExTmpVMU5pQXdMamN5TnpZMk5Vd3dMalEyTURFNU55QXdMamN5TkRreU1VTXdMalEzTlRrNE1TQXdMamN4TXpRMk55QXdMalE0T1RZMU1TQXdMamN3TURrd05TQXdMalE1T1RnNU1TQXdMalk0T0RNME5Fd3dMalV3TURRNE5pQXdMalk0TnpZek1rd3dMalV3TWpFd09DQXdMalk0TlRjMU4wZ3dMalV3TWpJeE5GcE5NQzQwT0RReE1TQXdMalk1T0RrMU1rTXdMalE0TmpVeE1TQXdMalk1TmpVeUlEQXVORGc1TlRZeElEQXVOamt6TVRnNElEQXVORGt4TmpReUlEQXVOamt3TnprMFF6QXVORGt6TVRJNElEQXVOamc1TURnMElEQXVORGswTVRJZ01DNDJPRGM0TlNBd0xqUTVOREF6TWlBd0xqWTROemMyTWtNd0xqUTVNemd5TWlBd0xqWTROelUxSURBdU5EYzFPVEk1SURBdU5qazVOamtnTUM0ME5qZ3hOeUF3TGpjd05USTROME13TGpRMk5USTJOU0F3TGpjd056TTBOU0F3TGpRMk5EZzVOU0F3TGpjd056Y3hOU0F3TGpRMk1qZzVNU0F3TGpjeE1ETXdNVXd3TGpRMU9EWTROeUF3TGpjeE5UVTFUREF1TkRVek56VTRJREF1TnpJeE1USXhUREF1TkRRNU5EWTVJREF1TnpJMU56azBRekF1TkRRNE5qRTRJREF1TnpJMk56TXhJREF1TkRRNE1qTTJJREF1TnpJM01UWTRJREF1TkRRNE1URTBJREF1TnpJM016UXlRekF1TkRRNE1ETWdNQzQzTWpjME5qSWdNQzQwTkRnd055QXdMamN5TnpRMU5pQXdMalEwT0RFMk5DQXdMamN5TnpRd01rd3dMalEwT1RZM055QXdMamN5TmpRME5Vd3dMalExTVRNeklEQXVOekkxTXprNFF6QXVORFl6T0RRZ01DNDNNVGMwT0NBd0xqUTNNemt5TXlBd0xqY3dPVE0xTVNBd0xqUTROREV4SURBdU5qazRPVFV5V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPWUyM2M0OTI4LWI2MTYtNDlmMy04ZGMzLWQxODhlMjZjY2Y4MTsiIHBhcmVudD0iMjEiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+PG14R2VvbWV0cnkgeD0iNjgiIHk9IjQyIiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPjwvbXhDZWxsPjxteENlbGwgaWQ9IjMxIiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLT4gTWljcm9zb2Z0IFNRTCBTZXJ2ZXIiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj00MTAyYzQyOC0wNjJhLTQwMzYtOGJiZC1iYWViNTliMWJkZTQ7aXIuYXNzZXRzPUNyZWRpdCBDYXJkIERhdGE7aXIudGFncz1IVFRQUzsiIHBhcmVudD0iMSIgc291cmNlPSI0IiB0YXJnZXQ9IjIyIiBlZGdlPSIxIj48bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+PC9teENlbGw+PC9yb290PjwvbXhHcmFwaE1vZGVsPg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
+      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
+    </asset>
+    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="Web Client -&gt; Web Application - Server side" ref="062f7025-ded5-4e84-a4cb-eb2ce783c9c3" source="8f1524bf-126c-4a18-9e88-22a4b9a90c24" target="75a5767d-29f5-4152-bfb5-ce45ff21ba2b">
+      <assets>
+        <asset name="Credit Card Data"/>
+      </assets>
+      <tags>
+        <tag tag="HTTPS"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; Microsoft SQL Server" ref="4102c428-062a-4036-8bbd-baeb59b1bde4" source="75a5767d-29f5-4152-bfb5-ce45ff21ba2b" target="a4c3de22-7059-4bf5-ac1b-bce95e7e98a4">
+      <assets>
+        <asset name="Credit Card Data"/>
+      </assets>
+      <tags>
+        <tag tag="HTTPS"/>
+      </tags>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="34db91e7-f20f-4386-9c59-c505c6206e49" diagramComponentId="729c179e-2789-425f-91ca-43324c597921" ref="75a5767d-29f5-4152-bfb5-ce45ff21ba2b" name="Web Application - Server side" desc="" library="" parentComponentRef="" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="feature.service.thirdparty.no" answer="true" manuallyModified="false"/>
+        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
+        <question ref="framework.node" answer="true" manuallyModified="false"/>
+        <question ref="lang.csharp" answer="true" manuallyModified="false"/>
+        <question ref="lang.javascript" answer="true" manuallyModified="false"/>
+        <question ref="lang.php" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+        <question ref="openid.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.no" answer="true" manuallyModified="false"/>
+        <question ref="server.dotnet" answer="true" manuallyModified="false"/>
+        <question ref="server.iis" answer="true" manuallyModified="false"/>
+        <question ref="server.session.building.no" answer="true" manuallyModified="false"/>
+        <question ref="service.data.json" answer="true" manuallyModified="false"/>
+        <question ref="use.fedramp.low.no" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="20"/>
+        <asset name="Credit Card Data" accessType="20"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.735">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-384" name="Application allows for leveraging a session ID not produced by the application" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                    Authenticating a user, or otherwise establishing a new user session, without invalidating any session identifier gives an attacker the opportunity to steal authenticated sessions. Such a scenario is commonly observed when:
+                    &lt;/div&gt;
+                    &lt;div&gt;
+                    &lt;ul&gt;
+                    &lt;li&gt;A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.&lt;/li&gt;
+                    &lt;li&gt;An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.&lt;/li&gt;
+                    &lt;li&gt;The application or container uses predictable session identifiers. In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.&lt;/li&gt;
+                    &lt;/ul&gt;
+                    &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.715">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PCI-R6-6.5" name="Applications are vulnerable to known flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>The applications are vulnerable to injection flaws, particularly SQL injections. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.965">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-639" name="Authorization Bypass Through User-Controlled Key" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user related record stored in the system and would be used to look up that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system. One manifestation of this weakness would be if a system used sequential or otherwise easily guessable session ids that would allow one user to easily switch to another user's session and read/modify their data.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-639: Authorization Bypass Through User-Controlled Key" url="https://cwe.mitre.org/data/definitions/639.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-425" name="Direct Request ('Forced Browsing')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not adequately enforce appropriate authorization on all restricted
+                        URLs, scripts, or files.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;Web applications susceptible to direct request attacks often make the false
+                        assumption that such resources can only be reached through a given navigation path and so only
+                        apply authorization at certain points in the path.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-425: Direct Request ('Forced Browsing')" url="https://cwe.mitre.org/data/definitions/425.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.757">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.280">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.713">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.979">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-209" name="Information Exposure Through an Error Message" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software generates an error message that includes sensitive information about its environment, users, or associated data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;This sensitive information may be valuable on its own (such as a password), or it may be useful for launching other deadlier attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-209: Information Exposure Through an Error Message" url="https://cwe.mitre.org/data/definitions/209.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.219">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.360">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.561">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.411">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.736">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-275" name="Permission Issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Weaknesses in this category are related to improper assignment - or handling - of permissions.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.162">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PCI-R6-6.3" name="Security is not included in the Software Development Life Cycle" state="0" impact="100" issueId="" issueLink="">
+          <desc>Security is missing during the requirement definition, design, analysis, and testing phases of software development.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.965">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-1004" name="Sensitive Cookie Without 'HttpOnly' Flag" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag. &lt;div&gt;  The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies. Including the HttpOnly flag in the Set-Cookie HTTP response header helps mitigate the risk associated with Cross-Site Scripting (XSS) where an attacker's script code might attempt to read the contents of a cookie and exfiltrate information obtained. When set, browsers that support the flag will not reveal the contents of the cookie to a third party via client-side script executed via XSS. &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-614" name="Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" state="0" impact="100" issueId="" issueLink="">
+          <desc>The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the
+                        user agent to send those cookies in plaintext over an HTTP session.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.716">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" url="https://cwe.mitre.org/data/definitions/614.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.712">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SRV-JSON-SIG" name="The application does not implement any integrity control on transmitted JSON data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If JSON data is not validated for authenticity and integrity then the application functionality could be subverted which may lead to sensitive data leaks or bypassing of critical business logic.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.492">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.235">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:37.560">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.236">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.236">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.235">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
+&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
+&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
+&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
+ &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
+&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
+              <output/>
+            </source>
+            <references>
+              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
+              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.282">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.281">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.980">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.412">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-308" name="Use of Single-factor Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of single-factor authentication can lead to unnecessary risk of compromise when
+                        compared with the benefits of a dual-factor authentication scheme.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.413">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-308: Use of Single-factor Authentication" url="https://cwe.mitre.org/data/definitions/308.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.649">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.648">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:32.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PCI-R6-6.5.6-C" name="Address all &quot;high risk&quot; vulnerabilities detected" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All vulnerabilities identified by an organization's vulnerability risk-ranking
+                        process (defined
+                        in Requirement 6.1) as "high risk" that could affect the application should
+                        be 
+                        addressed during application development.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.6: Examine software-development policies and procedures and interview responsible personnel to verify that coding techniques address any "high risk" vulnerabilities that could affect the application, as identified in PCI DSS Requirement 6.1.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.867">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-285" name="Apply authorization checks to segregate and control access to user data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Applications protecting sensitive or otherwise restricted resources must ensure that only appropriate
+                        and authorized users can access the application data. It is important that an application
+                        prevent unauthorized users gaining inappropriate access to each other's data. Although user A
+                        and user B may both be trusted to access data within the application, they may be only authorized to
+                        access different subsets of the protected resources.&amp;nbsp; E.g. user A should not be
+                        able to access user B's personal data by manipulating a request (typical examples are the
+                        manipulation of an ID value or other object reference sent in the URL or body of an HTTP
+                        request).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        It is not sufficient to rely on obscurity, for example obfuscated or secret URLs or filenames.
+                        The application must validate each request for protected data against the proven identity of the
+                        user. Before providing access to restricted resources the application must:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure the user has undergone appropriate authentication (identification and
+                        verification, or ID&amp;amp;V). E.g. they must have provided their identity and confirmed this
+                        with a password, token, or other verification. Typically this is done by checking the
+                        validity of the session token issued after login.&lt;/li&gt;
+                        &lt;li&gt;Confirm the user is authorized to access the data or resource they are requesting. E.g.
+                        their confirmed identify is checked against a server-side access control matrix to determine
+                        whether they may access the requested resource.&lt;/li&gt;
+                        &lt;li&gt;Access controls should be granular and make it possible to issue to individual resources 
+                        to individual users or roles.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        URL and asset based access control is provided by most web-frameworks, and it is preferable to
+                        use an established and proven framework.
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA CM-07 Least Functionality" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/158-08_02_CM-07"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="CM-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Using two different browsers configured with an intercepting proxy:&lt;/li&gt;
+                            &lt;li&gt;Login as user A in browser A.&lt;/li&gt;
+                            &lt;li&gt;Login as user B in browser B.&lt;/li&gt;
+                            &lt;li&gt;For every operation that displays sensitive data belonging to user A:&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Perform the operation as user A and view their sensitive data.&lt;/li&gt;
+                            &lt;li&gt;Obtain the session ID of user B.&lt;/li&gt;
+                            &lt;li&gt;Configure the proxy to intercept.&lt;/li&gt;
+                            &lt;li&gt;Perform the operation as user A again, but this time intercept all the requests
+                            and replace user A's session ID with that of user B.&lt;/li&gt;
+                            &lt;li&gt;Ensure that user A's sensitive data is &lt;b&gt;not &lt;/b&gt;visible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.240">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.445">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.766">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.017">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3.1-C" name="Clean up development and testing data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This data may give away information about the functioning of an application or system and is an easy target for unauthorized individuals to exploit to gain access to systems. Possession of such information could facilitate compromise of the system and related account data.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.6.a: Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.b: Observe testing processes for both off-theshelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.c: Examine data and accounts for recently installed or updated off-the-shelf software and inhouse applications to verify there is no test data or test accounts on systems in production.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="59" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.560">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
+            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
+          </references>
+          <standards>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.435">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.923">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.018">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="61" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.018">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.4-C" name="Do not transmit data over insecure channels" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications that fail to adequately encrypt network traffic using strong
+                        cryptography are at
+                        increased risk of being compromised and exposing cardholder data. If an attacker is able to
+                        exploit weak
+                        cryptographic processes, they may be able to gain control of an application or even gain
+                        clear-text access
+                        to encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="pci-sss"/>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.4: Examine software-development policies and procedures and interview responsible personnel to verify that insecure communications are addressed by means of coding techniques that properly authenticate and encrypt all sensitive communications.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.3-C" name="Do not use insecure cryptographic storage" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications that do not utilize strong cryptographic functions properly to store
+                        data are at
+                        increased risk of being compromised and exposing authentication credentials and/or cardholder
+                        data. If an
+                        attacker is able to exploit weak cryptographic processes, they may be able to gain clear-text
+                        access to
+                        encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="7.1" supportedStandardRef="pci-sss"/>
+            <standard ref="7.2" supportedStandardRef="pci-sss"/>
+            <standard ref="7.3" supportedStandardRef="pci-sss"/>
+            <standard ref="7.4" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.3: Examine software-development policies and procedures and interview responsible personnel to verify that insecure cryptographic storage is addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Prevent cryptographic flaws.&lt;/li&gt;&lt;li&gt;Use strong cryptographic algorithms and keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;7.1.a: The assessor shall examine the vendor evidence to confirm that, where cryptography is relied upon (in whole or in part) for the security of the critical assets:&lt;ul&gt;&lt;li&gt;Industry-accepted cryptographic algorithms and modes of operation are used in the software as the primary means for protecting critical assets; and&lt;/li&gt;&lt;li&gt;Use of any unapproved algorithms must be in conjunction with approved algorithms and implemented in a manner that does not reduce the equivalent cryptographic key strength provided by the approved algorithms.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.b: The assessor shall examine vendor evidence, including the vendor threat information, and test the software to confirm that:&lt;ul&gt;&lt;li&gt;Only documented cryptographic algorithms and modes are used in the software and are implemented correctly, and&lt;/li&gt;&lt;li&gt;Protections are incorporated to prevent common cryptographic attacks such as the use of the software as a decryption oracle, brute-force or dictionary attacks against the input domain of the sensitive data, the re-use of security parameters such as IVs, or the re-encryption of multiple datasets using linearly applied key values (such as XOR'd key values in stream ciphers or one-time pads).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.c: Where any algorithm or mode of operation requires a unique value per encryption operation or session, the assessor shall examine current publicly available literature or industry standards to identify security vulnerabilities in their implementation and test the software to confirm correct implementation. For example, this may include the use of a unique IV for a stream cipher mode of operation, a unique (and random) "k" value for a digital signature.&lt;/li&gt;&lt;li&gt;7.1.d: Where padding is used prior to/during encryption, the assessor shall examine vendor evidence and test the software to confirm that the encryption operation always incorporates an industry-accepted standard padding method.&lt;/li&gt;&lt;li&gt;7.1.e: Where hash functions are used within the software, the assessor shall:&lt;ul&gt;&lt;li&gt;Examine publicly available literature and research to identify vulnerable algorithms that can be exploited, and&lt;/li&gt;&lt;li&gt;Test the software to confirm that only approved, collision-resistant hash algorithms and methods are used with a salt value of appropriate strength, generated using a secure random number generator.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.a: The assessor shall examine vendor evidence and test the software to confirm that:&lt;ul&gt;&lt;li&gt;All cryptographic keys that are used for providing security to critical assets-including both confidentiality and authenticity-as well as for providing other security services to the software (such as authentication of end-point or software updates) have a unique purpose. For example, no key may be used for both encryption and authentication operations.&lt;/li&gt;&lt;li&gt;All keys have defined generation methods, and no secret or private cryptographic keys relied upon for security of critical assets are shared between software instances, except when a common secret or private key is used for securing the storage of other cryptographic keys that are generated during the installation, initialization, or first use of the software (e.g., white-box cryptography).&lt;/li&gt;&lt;li&gt;All cryptographic keys have an equivalent bit strength of at least 128 bits in accordance with industry standards.&lt;/li&gt;&lt;li&gt;All keys have a defined crypto-period aligned with industry standards, and methods are implemented to retire and/or update each key at the end of the defined crypto-period.&lt;/li&gt;&lt;li&gt;The integrity and confidentiality of all secret and private cryptographic keys managed by the software are protected when stored (e.g., encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and is stored separately from the data-encrypting key, or as at least two full-length key components or key shares, in accordance with an industry-accepted method).&lt;/li&gt;&lt;li&gt;All keys have a defined generation or injection process, and this process ensures sufficient entropy for the key.&lt;/li&gt;&lt;li&gt;All key-generation functions must implement one-way functions or other irreversible key-generation processes, and no reversible key calculation modes (such as key variants) are used to directly create new keys from an existing key.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.b: Where cryptography is used to protect a key, the assessor shall examine vendor evidence and test the software to confirm that security is not provided to any key by a key of lesser strength (e.g., by encrypting a 256-bit AES key with a 128-bit AES key).&lt;/li&gt;&lt;li&gt;7.2.c: Where any public keys are used by the system, the assessor shall examine vendor evidence and test the software to confirm that the vendor maintains an inventory of all cryptographic keys used by the software and that the authenticity of all public keys is maintained. Vendor evidence must identify:&lt;ul&gt;&lt;li&gt;Key label or name&lt;/li&gt;&lt;li&gt;Key location&lt;/li&gt;&lt;li&gt;Effective and expiration date&lt;/li&gt;&lt;li&gt;Key purpose/type&lt;/li&gt;&lt;li&gt;Key length&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.d: Where public or white-box keys are not unique per software instantiation the assessor shall examine vendor evidence and test the software to confirm that methods and procedures to revoke and/or replace such keys (or key pairs) exist.&lt;/li&gt;&lt;li&gt;7.2.e: Where the software relies upon external files or other data elements for key material (such as for public TLS certificates), the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to install such key material in accordance with this standard-including details noting any security requirements for such key material-is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;7.2.f: Where public keys are used, the assessor shall examine vendor evidence and test the software to confirm that public keys manually loaded or used as root keys are installed and stored in a way that provides dual control (to a level that is feasible on the execution environment), preventing a single user from replacing a key to facilitate a man-in-the-middle attack, easy decryption of stored data, etc. Where complete dual control is not feasible (e.g., due to a limitation of the execution environment), the assessor shall confirm that the methods implemented are appropriate to protect the public keys.&lt;/li&gt;&lt;li&gt;7.2.g: The assessor shall examine vendor evidence and test the software to confirm that any secret and/or private keys are managed in a way that ensures split knowledge over the key, to a level that is feasible given the platform on which the software is executed. Where absolute split knowledge is not feasible, the assessor shall confirm that methods implemented are reasonable to protect secrets and/or private keys.&lt;/li&gt;&lt;li&gt;7.2.h: The assessor shall examine vendor evidence and test the software to confirm that methods are implemented to "roll" any keys at the end of their defined crypto-period that ensure the security of the sensitive data (both cryptographic keys and data secured through use of these keys) is in line with the requirements of this standard.&lt;/li&gt;&lt;li&gt;7.3.a: The assessor shall examine vendor evidence to confirm that all random number generation methods implemented in the software:&lt;ul&gt;&lt;li&gt;Use at least 128 bits of entropy prior to the output of any random numbers from the random number generator.&lt;/li&gt;&lt;li&gt;Ensure it is not possible for the system to provide or produce reduced entropy upon start-up or entry of other predictable states of the system.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.3.b: Where the vendor is relying upon previous assessment of the random number generator, or source of initial entropy, the assessor shall examine the approval records of the previous assessment and test the software to confirm that this scheme and specific approval include the correct areas of the software in the scope of its assessment, and that the vendor claims do not exceed the scope of the evaluation or approval of that software. For example, some cryptographic implementations approved under FIPS 140-2 or 140-3 require seeding from an external entropy source to correctly output random data.&lt;/li&gt;&lt;li&gt;7.3.c: Where third-party software, platforms, or libraries are used for all or part of the random number generation process, the assessor shall examine current publicly available literature to confirm that there are no publicly known vulnerabilities or concerns with the software that may compromise its use for generating random values in the software under test. Where problems are known, but have been mitigated by the software vendor, the assessor shall examine vendor evidence and test the software to confirm that the vulnerabilities have been sufficiently mitigated. The assessor shall test the software to confirm that third-party software, platforms, or libraries are correctly integrated, implemented, and configured.&lt;/li&gt;&lt;li&gt;7.3.d: The assessor shall examine vendor evidence and test the software to confirm that methods have been implemented to prevent or detect (and respond) the interception, or "hooking," of random number calls that are serviced from third-party software, or the platform on which the software is executed.&lt;/li&gt;&lt;li&gt;7.3.e: The assessor shall test the software to obtain 128MB of data output from each random number generator implemented in the system to confirm the lack of statistical correlation in the output. This data may be generated by the assessor directly, or supplied by the vendor, but the assessor must confirm that the generation method implemented ensures that the data is produced as it would be produced by the software during normal operation.&lt;/li&gt;&lt;li&gt;7.4.a: The assessor shall examine vendor evidence and test the software to confirm that the methods used for the generation of all cryptographic keys and other material (such as IVs, "k" values for digital signatures, etc.) have entropy that meets the minimum effective strength requirements of the cryptographic primitives and keys.&lt;/li&gt;&lt;li&gt;7.4.b: Where cryptographic keys are generated through processes which require direct user interaction, such as through the entry of a passphrase or the use of "random" user interaction with the software, the assessor shall examine vendor evidence and test the software to confirm that these processes are implemented in such a way that they provide sufficient entropy. Specifically, the assessor shall confirm that:&lt;ul&gt;&lt;li&gt;Any methods used for generating keys directly from a password/passphrase enforces an input domain that is able to provide sufficient entropy, such that the total possible inputs are at least equal to that of the equivalent bit strength of the key being generated (e.g., a 32-hex-digit input field for an AES128 key).&lt;/li&gt;&lt;li&gt;The passphrase is passed through an industry-standard key-derivation function, such as PBKDF2 or bcrypt, which extends the work factor for any attempt to brute-force the passphrase value. The assessor shall confirm that a work factor of at least 10,000 is applied to any such implementation.&lt;/li&gt;&lt;li&gt;Clear and sufficient guidance is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 that any passphrase used must be:&lt;ul&gt;&lt;li&gt;Randomly generated itself, using a valid and secure random process: an online random number generator must not be used for this purpose.&lt;/li&gt;&lt;li&gt;Never implemented by a single person, such that one person has an advantage in recovering the clear key value; violating the requirements for split knowledge.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.4.c: Where any third-party software or platforms are relied upon by the software and do not meet the entropy requirements, the assessor shall examine vendor evidence and test the software to confirm that sufficient mitigations are implemented, and that clear and sufficient guidance on the secure configuration and usage of these software components is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="69" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.444">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.855">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-923-SEGREG" name="Ensure segregation of components of differing trust levels" issueId="" issueLink="" platform="" cost="0" risk="72" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure segregation of components of differing trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.1" name="Ensure sensitive data is not revealed through error output messages" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the application does not output error messages or stack traces containing sensitive
+                        data that could assist an attacker, including the session id, software/framework versions and
+                        personal information.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application does not output error massages or stack traces containing sensitive data.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" name="Ensure that access control mechanisms are centralized" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access control, authentication and authorization procedures should be centralized, and all roles, permissions, groups and users shall be controlled - or gain access - through this mechanism.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To ensure roles, groups and permissions are assigned properly to users, we need to have centralized access control, to grant or deny access easily and securely.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that access control mechanisms are centralized.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
+                            happen.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
+                            behavior on the system.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="FEAT-ACC-CTRL" name="Ensure that attribute or feature-based access control is used" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles.
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="C7 OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.570">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;ul&gt;
+ &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
+ &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.2 Testing for default credentials (OTG-AUTHN-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.5 Test remember password functionality (OTG-AUTHN-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
+ &lt;/div&gt;
+ &lt;div&gt;
+   Options:
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
+ &lt;/div&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.122">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="revoke-compromised-authentication-tokens" name="Implement an effective process to revoke compromised authentication tokens" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Theft or loss of an authentication token can undermine security in any multi-factor authentication process. Loss of a physical token or mobile device with soft-tokens, or compromise of a client-side certificate could mean an attacker has all of the factors required to authenticate to a system and bypass the protections provided by multi-factor authentication.&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Define an organization process to identify or report lost or compromised authentication tokens/factors&lt;/li&gt; 
+ &lt;li&gt;Implement technical controls to suspend or revoke compromised tokens or accounts&lt;/li&gt; 
+ &lt;li&gt;These processes should be implementable in a timely manner to reduce the attack window&lt;/li&gt; 
+ &lt;li&gt;Implement mechanisms to renew authentication tokens/factors within a sufficient timeframe before they are revoked.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.5.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.5.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.8" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.1.2.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.1.4" supportedStandardRef="nist-800-63"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify there is a working process in place to revoke a given token in a timely manner.&lt;/li&gt;&lt;li&gt;Verify the renewal of authentication tokens/factors is completed in sufficient time.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="75" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.578">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.7-C" name="Implement cross-site scripting (XSS) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;XSS flaws occur whenever an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser, which can hijack user sessions, deface websites, possibly introduce worms, etc.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.7" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.7: Examine software-development policies and procedures and interview responsible personnel to verify that cross-site scripting (XSS) is addressed by means of coding techniques that validate all parameters before inclusion and use context-sensitive escaping, among other things.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SRV-JSON-WEB-SIGN" name="Implement JSON Web Signing for sensitive or authentication data" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Data received from the client-side may have been modified at source or in transit. JSON Web
+                        Signing functionality is available to prevent (or rather detect) such modification.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Sensitive data, in particular any relied on for making access control or other
+                        security decisions, should be signed. This provides assurance that:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The data comes from the trusted source and not from an untrusted actor.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The data received is that produced by the trusted party and has not been modified in
+                        transit.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the functions of the service which handle JSON data.&lt;/li&gt;&lt;li&gt;If the JSON data is used to make authentication decisions or part of a sensitive business logic flow, then check JSON Web Signing - leveraging JSON Web Tokens - is in use.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="JSON Web Signing - RFC" url="https://tools.ietf.org/html/rfc7515"/>
+              <reference name="JSON Web Tokens - RFC" url="https://tools.ietf.org/html/rfc7519"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="look-up-secret-auth" name="Implement Look-Up Secret Authentication" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Verifiers of look-up secrets should prompt the claimant for the next secret from their authenticator or for a specific secret. A given secret from an authenticator must be used successfully only once. If the look-up secret is derived from a grid card, each cell of the grid shall be used only once.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Verifiers should store look-up secrets in a form that is resistant to offline attacks and have:&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;At least 112 bits entropy and hashed with an approved one-way function.&lt;/li&gt; 
+ &lt;li&gt;With fewer than 112 bits of entropy, it should be salted and hashed using a suitable one-way key derivation function, and salt value of at least 32 bits in length and arbitrarily chosen so as to minimize salt value collisions among stored hashes.&lt;/li&gt; 
+ &lt;li&gt;Less than 64 bits of entropy, the verifier must implement a rate limiting mechanisms that effectively limits the number of failed authentication attempts that can be made on the subscriber's account&lt;/li&gt; 
+&lt;/ul&gt; 
+ 
+&lt;div&gt; 
+ &lt;div&gt;
+   Look up secrets: pre-generated lists of secret codes, similar to Transaction Authorization Numbers (TAN), social media recovery codes, or a grid containing a set of random values. These are distributed securely to users. These lookup codes are used once, and once all used, the lookup secret list is discarded. This type of authenticator is considered "something you have". 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   https://pages.nist.gov/800-63-3/sp800-63b.html 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Verifier: An entity that verifies the claimant's identity by verifying the claimant's possession and control of a token using an authentication protocol. To do this, the Verifier may also need to validate credentials that link the token and identity and check their status. 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   https://csrc.nist.gov/glossary/term/verifier&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+          </references>
+          <standards>
+            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.6.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.6.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.2.2" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify that:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The look-up secret are only able to be used once.&lt;/li&gt;&lt;li&gt;The random generation of the look-up secrets has at least 112 bits of entropy.&lt;/li&gt;&lt;li&gt;If the entropy is lower than&amp;nbsp;112 but higher than 64 bits, it leverages a hashed with a one-way key derivation function and salted with at least 32 bits in length.&lt;/li&gt;&lt;li&gt;If the entropy is lower than 64 bits, a rate limiting mechanisms is in place to limit the number of failed authentication attempts.,&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.241">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.10-C" name="Implement robust authentication and session management" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure authentication and session management prevent unauthorized individuals from compromising legitimate account credentials, keys, or session tokens that would otherwise enable an intruder to assume the identity of an authorized user.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="pci-sss"/>
+            <standard ref="5.2" supportedStandardRef="pci-sss"/>
+            <standard ref="5.3" supportedStandardRef="pci-sss"/>
+            <standard ref="5.4" supportedStandardRef="pci-sss"/>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.10" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.10: Examine software development policies and procedures and interview responsible personnel to verify that broken authentication and session management are addressed via coding techniques that commonly include:&lt;ul&gt;&lt;li&gt;Flagging session tokens (for example cookies) as "secure".&lt;/li&gt;&lt;li&gt;Not exposing session IDs in the URL.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;5.1.a: The assessor shall examine vendor evidence to confirm that the vendor has identified authentication requirements (i.e., type and number of factors) for all roles based on critical asset classification, the type of access (e.g., local, non-console, remote) and level of privilege. Note: The assessor should refer to evidence obtained in the testing of Control Objective 1.3 to determine the classifications for all critical assets.&lt;/li&gt;&lt;li&gt;5.1.b: The assessor shall examine vendor evidence and test the software to confirm that all access to critical assets is authenticated and authentication mechanisms are implemented correctly.&lt;/li&gt;&lt;li&gt;5.1.c: Where the software recommends, suggests, relies on, or otherwise facilitates the use of additional mechanisms (such as third-party VPNs, remote desktop features, etc.) to facilitate secure non-console access to the system on which the software is executed or directly to the software itself, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to configure authentication mechanisms correctly is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.1.d: The assessor shall examine vendor evidence to confirm that any sensitive data associated with credentials, including public keys, is identified as a critical asset.&lt;/li&gt;&lt;li&gt;5.2.a: The assessor shall examine vendor evidence and test the software to confirm that all implemented authentication methods require unique identification.&lt;/li&gt;&lt;li&gt;5.2.b: Where interfaces, such as APIs, allow for automated access to critical assets, the assessor shall examine vendor evidence and test the software to confirm that unique identification of different programs or systems accessing the critical assets is required (for example, through use of multiple public keys) and that guidance on configuring a unique credential for each program or system is included in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.2.c: Where identification is supplied across a non-console interface, the assessor shall test the software to confirm that authentication mechanisms are protected.&lt;/li&gt;&lt;li&gt;5.2.d: The assessor shall examine vendor evidence to confirm that the software vendor's implementation guidance provided to stakeholders per Control Objective 12.1 specifically notes that identification and authentication parameters must not be shared between individuals, programs, or in any way that prevents the unique identification of each access to a critical asset.&lt;/li&gt;&lt;li&gt;5.2.e: The assessor shall examine vendor evidence, including source code of the software, to confirm that there are no additional methods for accessing critical assets.&lt;/li&gt;&lt;li&gt;5.3.a: The assessor shall examine vendor evidence to confirm that all implemented authentication methods were evaluated to identify the details of known vulnerabilities or attack methods on the authentication method, and how the implementation mitigates against such attacks. The evidence must also illustrate that the implementation used in the software was considered. For example, a fingerprint may be uniquely identifiable to an individual, but the ability to spoof or otherwise bypass such technology can be highly dependent on the way the solution is implemented.&lt;/li&gt;&lt;li&gt;5.3.b: The assessor shall examine vendor evidence to confirm that implemented authentication methods are robust and that robustness of the authentication methods was evaluated using industry-accepted methods.&lt;/li&gt;&lt;li&gt;5.3.c: The assessor shall test the software to confirm the authentication methods are implemented correctly and do not expose vulnerabilities.&lt;/li&gt;&lt;li&gt;5.4.a: The assessor shall examine vendor evidence to confirm that the vendor has clearly identified and reasonably justified the required access for all critical assets.&lt;/li&gt;&lt;li&gt;5.4.b: The assessor shall examine vendor evidence and test the software to identify what access is provided to critical assets and confirm that such access correlates with the vendor evidence. The test to confirm access is restricted should include attempts to access critical assets through user accounts, roles, or services which should not have the required privileges.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.869">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.5-C" name="Implement robust error handling" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications can unintentionally leak information about their configuration or internal workings, or expose privileged information through improper error handling methods. Attackers use this weakness to steal sensitive data or compromise the system altogether. If a malicious individual can create errors that the application does not handle properly, they can gain detailed system information, create denial-of-service interruptions, cause security to fail, or crash the server. For example, the message "incorrect password provided" tells an attacker that the user ID provided was accurate and they should focus their efforts only on the password. Use more generic error messages, like "data could not be verified."&amp;nbsp;&lt;/p&gt;&lt;p&gt;Another common technique used by attackers to compromise sensitive data that is stored, processed, or transmitted by software is to manipulate the software in a way that generates unhandled exceptions.&lt;/p&gt;&lt;p&gt;Unhandled exceptions are error conditions that the software vendor has not anticipated and, therefore, has not factored into the software design. If an attacker can manipulate a software function that is known to handle sensitive data in a way that generates a condition that the software does not handle properly, it is possible that the software may output an error that includes sensitive data.&lt;/p&gt;&lt;p&gt;To protect against attacks involving unhandled exceptions, all terminal software functions handling sensitive data should include processes or routines that instruct the software how to treat unknown exceptions. These processes should determine what information to include in any error codes or values. The disclosure of sensitive data through error conditions or error reporting, whether intentional or accidental, should be avoided.&lt;/p&gt;&lt;p&gt;Race conditions can arise when the software requires sequential processing of data to perform some software function. For example, a "time-of-use, time-of-check race condition" exists when a file is checked at one point and used immediately after, with the assumption that the previous check is still valid. This assumption may not be correct if the system allows the file to be modified in between.&lt;/p&gt;&lt;p&gt;If an attacker can identify and manipulate the software to take advantage of a race condition, they may be able to execute arbitrary code or generate other conditions that the attacker could exploit further.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="B.3.2" supportedStandardRef="pci-sss"/>
+            <standard ref="B.3.3" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.5: Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by means of coding techniques that do not leak information via error messages (for example, by returning generic error details rather than specific ones).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;B.3.2.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that handle the sensitive data predefined in Control Objective 1.2. For each of the noted software functions, the assessor shall confirm that each function:&lt;ul&gt;&lt;li&gt;Checks return values for the presence of sensitive data&lt;/li&gt;&lt;li&gt;Processes the return values in a way that does not inadvertently "leak" sensitive data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;B.3.2.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that handles sensitive data by attempting to manipulate the software in a manner that generates an unhandled exception to confirm that error conditions do not expose sensitive data.&lt;/li&gt;&lt;li&gt;B.3.3.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that rely on synchronous processing. For each of the noted functions, the assessor shall confirm that protection mechanisms have been implemented in the software to mitigate race conditions.&lt;/li&gt;&lt;li&gt;B.3.3.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that relies on synchronous processing by attempting to generate a race condition (such as through specially-crafted attacks intended to exploit the timing of synchronous events) to confirm that the software is resistant to such attacks.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.8-C" name="Implement robust server side access control" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Improper access control refers to cases such as insecure direct object references, failure to
+                        restrict URL
+                        access, directory traversal, and failure to restrict user access to functions.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt; &lt;/p&gt;
+                        &lt;p&gt;A direct object reference occurs when a developer exposes a reference to an internal
+                        implementation
+                        object, such as a file, directory, database record, or key, as a URL or form parameter.
+                        Attackers can
+                        manipulate those references to access other objects without authorization.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Consistently enforce access control in the presentation layer and business logic for all
+                        URLs.
+                        Frequently, the only way an application protects a sensitive functionality is by preventing the
+                        display of
+                        links or URLs to unauthorized users. Attackers can use this weakness to perform
+                        unauthorized
+                        operations by accessing those URLs directly.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;An attacker may be able to enumerate and navigate the directory structure of a website
+                        (directory
+                        traversal) thus gaining access to unauthorized information as well as further insight
+                        into the
+                        workings of the site for later exploitation.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;If user interfaces permit access to unauthorized functions, this access could result in
+                        unauthorized individuals gaining access to privileged credentials or cardholder data. Only
+                        authorized users
+                        should be permitted to access direct object references to sensitive resources. Limiting access
+                        to data
+                        resources will help prevent cardholder data from being presented to unauthorized resources.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.8" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.8: Examine software-development policies and procedures and interview responsible personnel to verify that improper access control-such as insecure direct object references, failure to restrict URL access, and directory traversal-is addressed by means of a coding technique that includes:&lt;ul&gt;&lt;li&gt;Proper authentication of users&lt;/li&gt;&lt;li&gt;Input sanitization&lt;/li&gt;&lt;li&gt;Protection against the exposure of internal object references to users&lt;/li&gt;&lt;li&gt;User interfaces that do not permit access to unauthorized functions.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt; 
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.767">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.924">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.1a-C" name="Perform input validation for all untrusted data" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Injection flaws, particularly SQL injections, are a commonly used method for
+                        compromising
+                        applications. An injection occurs when user-supplied data is sent to an interpreter as part of a
+                        command or
+                        query. The attacker's hostile data tricks the interpreter into executing unintended commands or
+                        changing
+                        data, and allows the attacker to attack components inside the network through the application
+                        to initiate
+                        attacks such as buffer overflows, or to reveal both confidential information and server
+                        application
+                        functionalities.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Information should be validated before being sent to the application-for example,
+                        by
+                        checking for
+                        all alpha characters, mixes of alpha and numeric characters, etc.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3" supportedStandardRef="pci-sss"/>
+            <standard ref="6.5.1a" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="B.3.1" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.a: Examine software-development policies and procedures to verify that developers have to complete up-to-date training in secure coding techniques at least annually, based on industry best practices and guidance.&lt;/li&gt;&lt;li&gt;6.5.b: Examine records of training to verify that software developers receive up-to-date training on secure coding techniques at least annually, including how to avoid common coding vulnerabilities.&lt;/li&gt;&lt;li&gt;6.5.c: Verify that processes are in place to protect applications from, at a minimum, the following vulnerabilities:&lt;ul&gt;&lt;li&gt;Injection flaws, particularly SQL injection.&lt;/li&gt;&lt;li&gt;Buffer overflows&lt;/li&gt;&lt;li&gt;Insecure cryptographic storage&lt;/li&gt;&lt;li&gt;Insecure communications&lt;/li&gt;&lt;li&gt;Improper error handling&lt;/li&gt;&lt;li&gt;All "high risk" vulnerabilities identified in the vulnerability identification process&lt;/li&gt;&lt;li&gt;Cross-site scripting (XSS)&lt;/li&gt;&lt;li&gt;Improper access control&lt;/li&gt;&lt;li&gt;Cross-site request forgery (CSRF)&lt;/li&gt;&lt;li&gt;Broken authentication and session management.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;6.3.a: The assessor shall examine vendor evidence and test the software to confirm that each use of cryptography-where cryptography is relied upon (in whole or in part) for the security of critical assets-is compliant to Control Objective 7.&lt;/li&gt;&lt;li&gt;6.3.b: Where cryptographic methods provided by third-party software or aspects of the execution environment or platform on which the application is run are relied upon for the protection of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 provides clear and sufficient detail for correctly configuring these methods during the installation, initialization, or first use of the software.&lt;/li&gt;&lt;li&gt;6.3.c: Where asymmetric cryptography such as RSA or ECC is used for protecting the confidentiality of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that private keys are not used for providing confidentiality protection to the data.&lt;/li&gt;&lt;li&gt;B.3.1.a: The assessor shall examine all relevant software documentation and source code necessary to identify all external inputs to the software. For each user or other external input, the assessor shall examine all relevant software documentation and source code to confirm that inputs conform to a list of expected characteristics and that all input that does not conform to expected characteristics is rejected by the software or otherwise handled securely.&lt;/li&gt;&lt;li&gt;B.3.1.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.) the assessor shall test the software by attempting to supply each user or other external input with invalid or unexpected characteristics to confirm that the software validates all inputs and either rejects or securely handles all unexpected characteristics.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.444">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-FED" name="Provide a section with a list of all active sessions and information about them" issueId="" issueLink="" platform="" cost="0" risk="75" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The application should provide a section with a list of all the active sessions. That list should contain as much information as possible and should allow the user to invalidate all sessions or any of them selectively.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-10 Concurrent Session Control" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/32-08_02_AC-10"/>
+            <reference name="OSA AC-11 Session Lock" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/33-08_02_AC-11"/>
+            <reference name="OSA AC-12 Session Termination" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/34-08_02_AC-12"/>
+          </references>
+          <standards>
+            <standard ref="3.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="AC-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-10" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Find the section with the list of active sessions within the application features&lt;/li&gt;&lt;li&gt;Open an authenticated session on two or three different browsers.&lt;/li&gt;&lt;li&gt;Check the sessions are listed.&lt;/li&gt;&lt;li&gt;Close the sessions by logging out of the application.&lt;/li&gt;&lt;li&gt;Check the sessions listed relating to the ones you created have now disappeared.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.183">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.561">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.561">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.445">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3.2-C" name="Review custom code prior to release to production" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Security vulnerabilities in bespoke and custom software are commonly exploited by malicious individuals to gain access to a network and compromise account data.&lt;/p&gt;&lt;p&gt;Vulnerable code is far more difficult and expensive to address after it has been deployed or released into production environments. Requiring a formal review and signoff by management prior to release helps to ensure that code is approved and has been developed in accordance with policies and procedures.&lt;/p&gt;&lt;p&gt;Having code reviewed by someone other than the original author, who is both experienced in code reviews and knowledgeable about secure coding practices, minimizes the possibility that code containing security or logic errors that could affect the security of cardholder data is released into a production environment. Requiring management approval that the code was reviewed limits the ability for the process to be bypassed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following items should be considered for inclusion in code reviews:&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Searching for undocumented features (implant tools, backdoors).&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Confirming that software securely uses external components' functions (libraries, frameworks, APIs, etc.). For example, if a third-party library providing cryptographic functions is used, verify that it was integrated securely.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking for correct use of logging to prevent sensitive data from getting into logs.&lt;/p&gt;&lt;p&gt;&amp;nbsp; - Analysis of insecure code structures that may contain potential vulnerabilities related to common software attacks identified in Requirements 6.2.5.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking the application's behavior to detect logical vulnerabilities.&lt;/p&gt;&lt;p&gt;Having a formal review methodology and review checklists has been found to improve the quality of the code review process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Code review is a tiring process, and for this reason, it is most effective when reviewers only review small amounts of code at a time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To maintain the effectiveness of code reviews, it is beneficial to monitor the general workload of reviewers and to have them review applications they are familiar with.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Code reviews may be performed using either manual or automated processes, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Entitles that rely solely on manual code review should ensure that reviewers maintain their skills through regular training as new vulnerabilities are found, and new secure coding methods are recommended.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See the OWASP Code Review Guide.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.2.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.3.a: Examine documented software development procedures and interview responsible personnel to verify that processes are defined that require all bespoke and custom software to be reviewed in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.b: Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;6.2.3.1.a: If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel to verify that processes are defined for manual code reviews to be conducted in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.1.b: Examine evidence of changes to bespoke and custom software and interview personnel to verify that manual code reviews were conducted in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.333">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-2014-3.6" name="Session ID's should be transmitted securely" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly. Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, it should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (either standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value 'GET' parameter.&lt;/li&gt;&lt;li&gt;Specifically, never send the session ID token in the URL or over unencrypted transport.&lt;/li&gt;&lt;li&gt;Pass data only in appropriately protected fields in the body or headers, for example:&lt;ul&gt;&lt;li&gt;A session Cookie (e.g. JSESSIONID, ASP.NET_SessionID)&lt;/li&gt;&lt;li&gt;A POST parameter (e.g. a token in the HTTP request body, or JSON parameter)&lt;/li&gt;&lt;li&gt;A standard or bespoke HTTP header (Authorization: X-Session header)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Using a browser, authenticate to the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;For every authenticated request, check that the session ID is never part of the
+                            URL and is only sent as an HTTP header (i.e. a cookie).&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.579">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="92" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.768">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5-C" name="Train developers in up-to-date secure coding techniques" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Having staff knowledgeable in secure coding methods, including techniques defined in Requirement 6.2.4, will help minimize the number of security vulnerabilities introduced through poor coding practices.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Training for developers may be provided in-house or by third parties.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Training should include, but is not limited to, development languages in use, secure software design, secure coding techniques, use of techniques/methods for finding vulnerabilities in code, processes to prevent reintroducing previously resolved vulnerabilities, and how to use any automated security testing tools for detecting vulnerabilities in software.&amp;nbsp;&lt;/p&gt;&lt;p&gt;As industry-accepted secure coding practices change, organizational coding practices and developer training may need to be updated to address new threats.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.2.a: Examine software development procedures to verify that processes are defined for training of software development personnel developing bespoke and custom software that includes all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.2.b: Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.9-C" name="Use anti cross-site request forgery (CSRF) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request
+                        to a
+                        vulnerable web application, which then enables the attacker to perform any state-changing
+                        operations the
+                        victim is authorized to perform (such as updating account details, making purchases, or even
+                        authenticating
+                        to the application).&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.9" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.9: Examine software development policies and procedures and interview responsible personnel to verify that cross-site request forgery (CSRF) is addressed by means of coding techniques that ensure applications do not rely on authorization credentials and tokens automatically submitted by browsers.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3-C" name="Use a secure coding methodology" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Bespoke and custom software are developed securely, as follows:&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Based on industry standards and/or best practices for secure development.&amp;nbsp;&lt;/p&gt;&lt;p&gt;- In accordance with PCI DSS (for example, secure authentication and logging).&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Incorporating consideration of information security issues during each stage of the software development lifecycle.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Without the inclusion of security during the requirements definition, design, analysis, and testing phases of software development, security vulnerabilities can be inadvertently or maliciously introduced into the production environment.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Understanding how sensitive data is handled by the application- including when stored, transmitted, and in memory-can help identify where data needs to be protected. PCI DSS requirements must be considered when developing software to meet those requirements by design, rather than trying to retrofit the software later.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Secure software lifecycle management methodologies and frameworks include PCI Software Security Framework, BSIMM, OPENSAMM, and works from NIST, ISO, and SAFECode.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.1: Examine documented software development procedures to verify that processes are defined that include all elements specified in this requirement&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.925">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:29.184">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.1b-C" name="Use parameterized queries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The use of prepared statements with variable binding (aka parameterized queries) is how all
+                        developers
+                        should first be taught how to write database queries. They are simple to write and easier to
+                        understand
+                        than dynamic queries. Parameterized queries force the developer to first define all the SQL
+                        code, and then
+                        pass each parameter to the query later. This coding style allows the database to distinguish
+                        between code
+                        and data, regardless of what user input is supplied.</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.1b" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.1: Examine software-development policies and procedures and interview responsible personnel to verify that injection flaws are addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Validate input to verify that user data cannot modify the meaning of commands and queries.&lt;/li&gt;&lt;li&gt;Use parameterized queries.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="69" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:34.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.689">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="98" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.571">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.2-C" name="Validate buffer boundaries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Buffer overflows occur when an application does not have appropriate bounds checking
+                        on its
+                        buffer space. This can cause the information in the buffer to be pushed out of the buffer's
+                        memory space and
+                        into executable memory space. When this occurs, the attacker has the ability to insert malicious
+                        code at the
+                        end of the buffer and then push that malicious code into executable memory space by overflowing
+                        the buffer.
+                        The malicious code is then executed and often gives the attacker remote access to the
+                        application and/or
+                        infected system.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.870">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="78" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;div&gt;
+   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:28.856">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:33.019">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="vulnerable-session-management" name="An attacker can obtain a valid session identifier to impersonate legitimate users" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Session management for Web applications is an application layer responsibility. Session security is critical to the overall security of the application. Vulnerabilities that are specific to session management are great threats to any web application and are also among the most challenging to find and fix.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Sessions are targets for malicious users because they can be used to gain access to a system without having to authenticate.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references>
+                <reference name="Secure Session Management: Preventing Security Voids in Web Applications" url="https://www.sans.org/reading-room/whitepapers/webservers/paper/1594"/>
+                <reference name="WASC-04" url="http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-614">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-232" name="Anonymous users could gain access to sensitive data" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could access data for which they are not authorized by connecting directly
+                                to the resource, without authenticating. E.g.: GET /userdetails?ID=145 to gain direct
+                                access to that user's personal information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references>
+                <reference name="OWASP Development Guide: Authorization" url="https://www.owasp.org/index.php/Guide_to_Authorization"/>
+                <reference name="OWASP Top Ten" url="https://www.owasp.org/index.php/Top_10_2007-Failure_to_Restrict_URL_Access"/>
+                <reference name="WASC-02" url="http://projects.webappsec.org/w/page/13246940/Insufficient%20Authorization"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-285" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-308">
+                  <countermeasures>
+                    <countermeasure ref="look-up-secret-auth" mitigation="33"/>
+                    <countermeasure ref="revoke-compromised-authentication-tokens" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-285" mitigation="34"/>
+                <countermeasure ref="look-up-secret-auth" mitigation="33"/>
+                <countermeasure ref="revoke-compromised-authentication-tokens" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ASVS-2014-3.12" name="Attackers could compromise users' sessions by compromising the session cookie" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>If the same session cookie is used for multiple applications, and one of those
+                                applications has a vulnerability which discloses the session ID. Then by compromising
+                                the session cookie in one application, the attacker would have access to the ID for the
+                                other.</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-1004">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-384">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-2014-3.6" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-2014-3.6" mitigation="50"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-87" name="Attackers gain access to data or services by directly accessing the resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker employs forceful browsing to access portions of a website that are
+                                otherwise unreachable through direct URL entry.&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Usually, a front controller or similar design pattern is employed to protect
+                                access to portions of a web application.&amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Forceful browsing enables an attacker to access information, perform
+                                privileged operations and otherwise reach sections of the web application that have been
+                                improperly protected.
+                                &lt;br /&gt;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-384">
+                  <countermeasures>
+                    <countermeasure ref="CSD-SESS-FED" mitigation="34"/>
+                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-425">
+                  <countermeasures>
+                    <countermeasure ref="CWE-285" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-SESS-FED" mitigation="34"/>
+                <countermeasure ref="CWE-285" mitigation="33"/>
+                <countermeasure ref="secure-session-generation-and-expiration" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-215" name="Attackers gain access to services or data by sending malformed, or otherwise unexpected messages to a target application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's their desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can potentially learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-209">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-636">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.1" mitigation="50"/>
+                <countermeasure ref="ASVS-8.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references>
+                <reference name="OWASP Developers Guide: Authorization" url="https://www.owasp.org/index.php/Guide_to_Authorization"/>
+                <reference name="WASC-02" url="http://projects.webappsec.org/w/page/13246940/Insufficient%20Authorization"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-275">
+                  <countermeasures>
+                    <countermeasure ref="FEAT-ACC-CTRL" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-639">
+                  <countermeasures>
+                    <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="34"/>
+                    <countermeasure ref="CWE-285" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="34"/>
+                <countermeasure ref="CWE-285" mitigation="33"/>
+                <countermeasure ref="FEAT-ACC-CTRL" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-636">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                <countermeasure ref="CWE-603" mitigation="25"/>
+                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-367">
+                  <countermeasures>
+                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint.
+&lt;br /&gt;
+&lt;br /&gt;While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-923">
+                  <countermeasures>
+                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
+&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-523">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-59" name="The session ID, and hence the users' session is compromised through brute force attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could use brute force techniques to attempt to guess valid session
+                                IDs.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-330">
+                  <countermeasures>
+                    <countermeasure ref="look-up-secret-auth" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="look-up-secret-auth" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
+          <threats>
+            <threat ref="pci-dss-vuln-prevention" name="An attacker gains access to cardholder data through a vulnerable system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
+              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R6-6.3">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
+                    <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
+                    <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
+                <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
+                <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="pci-dss-vuln-detection" name="An attacker gains access to cardholder data through security flaws in the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
+              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R6-6.5">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ DATA" name="Read data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="SRV-JSON-SIG" name="Attackers gain access to user data by tampering with data in transit" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If the integrity of the data in transit is not protected, an attacker could modify this data causing the recipient to behave unexpectedly and potentially gain access to user data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SRV-JSON-SIG">
+                  <countermeasures>
+                    <countermeasure ref="SRV-JSON-WEB-SIGN" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SRV-JSON-WEB-SIGN" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="269f6777-3b2b-4b67-8bf3-5f30e27648fe" diagramComponentId="e23c4928-b616-49f3-8dc3-d188e26ccf81" ref="a4c3de22-7059-4bf5-ac1b-bce95e7e98a4" name="Microsoft SQL Server" desc="" library="" parentComponentRef="" componentDefinitionRef="microsoft-sql-server">
+      <tags/>
+      <questions>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
+        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="10"/>
+        <asset name="Credit Card Data" accessType="10"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="PCI-R3-3.x" name="Cardholder data is unprotected on the system" state="0" impact="100" issueId="" issueLink="">
+          <desc>This covers 3.1 and 3.5 from PCI-DSS</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
+                        data transmission. For example, network traffic can often be sniffed by any attacker who has
+                        access to a network interface. This significantly lowers the difficulty of exploitation by
+                        attackers.
+                        &lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.320">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.142">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.981">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.193">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.993">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.500">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.192">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.191">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.500">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.992">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.990">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="64" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.072">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.635">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="49" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.853">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
+  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
+  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.415">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="56" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.240">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.414">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="54" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
+          &lt;br /&gt;&lt;br /&gt;
+          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA.</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
+                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.415">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.1-C" name="Keep cardholder data storage to a minimum" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;A formal data retention policy identifies what data needs to be retained, for how long, and where that data resides so it can be securely destroyed or deleted as soon as it is no longer needed. The only account data that may be stored after authorization is the primary account number or PAN (rendered unreadable), expiration date, cardholder name, and service code.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The storage of SAD data prior to the completion of the authorization process is also included in the data retention and disposal policy so that storage of this sensitive data is kept to minimum, and only retained for the defined amount of time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;When identifying locations of stored account data, consider all processes and personnel with access to the data, as data could have been moved and stored in different locations than originally defined. Storage locations that are often overlooked include backup and archive systems, removable data storage devices, paper-based media, and audio recordings.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To define appropriate retention requirements, an entity first needs to understand its own business needs as well as any legal or regulatory obligations that apply to its industry or to the type of data being retained. Implementing an automated process to ensure data is automatically and securely deleted upon its defined retention limit can help ensure that account data is not retained beyond what is necessary for business, legal, or regulatory purposes.&lt;/p&gt;&lt;p&gt;Methods of eliminating data when it exceeds the retention period include secure deletion to complete removal of the data or rendering it unrecoverable and unable to be reconstructed. Identifying and securely eliminating stored data that has exceeded its specified retention period prevents unnecessary retention of data that is no longer needed. This process may be automated, manual, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The deletion function in most operating systems is not "secure deletion" as it allows deleted data to be recovered, so instead, a dedicated secure deletion function or application must be used to make data unrecoverable.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remember, if you don't need it, don't store it!&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;An automated, programmatic procedure could be run to locate and remove data, or a manual review of data storage areas could be performed. Whichever method is used, it is a good idea to monitor the process to ensure it is completed successfully, and that the results are recorded and validated as being complete. Implementing secure deletion methods ensures that the data cannot be retrieved when it is no longer needed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="pci-sss"/>
+            <standard ref="3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.2" supportedStandardRef="pci-sss"/>
+            <standard ref="3.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="3.3" supportedStandardRef="pci-sss"/>
+            <standard ref="3.4" supportedStandardRef="pci-sss"/>
+            <standard ref="3.5" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.2.1.a: Examine the data retention and disposal policies, procedures, and processes and interview personnel to verify processes are defined to include all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;3.2.1.b: Examine files and system records on system components where account data is stored to verify that the data storage amount and retention time does not exceed the requirements defined in the data retention policy.&lt;/li&gt;&lt;li&gt;3.2.1.c: Observe the mechanisms used to render account data unrecoverable to verify data cannot be recovered.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;3.1.a: The assessor shall examine vendor evidence to identify what sensitive data is collected by the software for use beyond any one transaction, the default time period for which it is retained, and whether the retention period is user-configurable, and to confirm vendor evidence includes reasonable justification for retaining the sensitive data.&lt;/li&gt;&lt;li&gt;3.1.b: The assessor shall test the software to confirm that all available functions or services designed for the retention of sensitive data are supported by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.1.c: The assessor shall test the software to confirm that sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected during storage in accordance with Control Objective 6. Any such functionality that allows for storage of sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user and retained only for the duration necessary in accordance with reasonable vendor criteria. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any sensitive data is securely deleted per Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.1.d: Where user input or interaction is required to configure the retention period of sensitive data, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.2.a: The assessor shall examine vendor evidence to identify all sensitive data that is retained by the software for transient use, what triggers the secure deletion of this data, and confirm reasonable justification exists for retaining the data. This includes data that is stored only in memory during the operation of the software.&lt;/li&gt;&lt;li&gt;3.2.b: The assessor shall test the software to confirm that all available functions or services that retain transient sensitive data are supported by vendor evidence and do not use immutable objects.&lt;/li&gt;&lt;li&gt;3.2.c: The assessor shall test the software to confirm that transient sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected in accordance with Control Objective 6. Any such functionality that allows for the storage of transient sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any transient sensitive data is securely deleted in accordance with Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.2.d: Where users can configure retention of transient sensitive data, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on this process is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.3.a: The assessor shall examine the vendor evidence to identify the protection methods implemented for all sensitive data during storage and transmission.&lt;/li&gt;&lt;li&gt;3.3.b: The assessor shall test the software to confirm that no additional storage of sensitive data is included.&lt;/li&gt;&lt;li&gt;3.3.c: Where sensitive data is stored outside of temporary variables within the code itself, the assessor shall test the software to confirm that sensitive data is protected using either strong cryptography or other methods that provide an equivalent level of security.&lt;/li&gt;&lt;li&gt;3.3.d: Where protection methods use cryptography, the assessor shall examine vendor evidence and test the software to confirm that the cryptographic implementation complies with Control Objective 7 of this standard.&lt;/li&gt;&lt;li&gt;3.3.e: Where sensitive data is protected using methods other than strong cryptography, the assessor shall examine vendor evidence and test the software to confirm that the protections are present in all environments where the software is designed to be executed, are correctly implemented, and are covered by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.3.f: Where users are required to configure protection methods, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.4.a: The assessor shall examine vendor evidence to identify all secure deletion methods implemented by the software for all non-transient sensitive data.&lt;/li&gt;&lt;li&gt;3.4.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the secure deletion of non-transient sensitive data and to confirm that any non-transient sensitive data is securely deleted using a method that ensures that the data is unrecoverable after deletion. Methods may include (but are not necessarily limited to) overwriting the data, deletion of cryptographic keys (of sufficient strength) which have been used to encrypt the data, or platform specific functions which provide for secure deletion. Methods must accommodate for platform specific issues, such as flash wear-leveling algorithms or SSD over-provisioning, which may complicate simple over-writing methods.&lt;/li&gt;&lt;li&gt;3.4.c: The assessor shall test the software using forensic tools to identify any non-transient sensitive data residue in the execution environment, and to confirm that the methods attested by the software vendor are correctly implemented and applied to all sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data (e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements), as well as covering all non-transient sensitive data types.&lt;/li&gt;&lt;li&gt;3.5.a: The assessor shall examine vendor evidence to identify all secure deletion methods for all transient sensitive data and to confirm that these methods ensure that the data is unrecoverable after deletion.&lt;/li&gt;&lt;li&gt;3.5.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the erasure of such transient sensitive data-such as abstraction layers between the code and the hardware execution environment-and to confirm what methods have been implemented to minimize the risk posed by these complications.&lt;/li&gt;&lt;li&gt;3.5.c: The assessor shall test the software, including usage of forensic tools, to identify any sensitive data residue in the execution environment to confirm that the methods attested by the software vendor are correctly implemented and applied to all transient sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data-e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements-as well as cover all non-transient sensitive data types.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.639">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.481">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="64" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.636">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.853">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.854">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="65" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.5.4-C" name="Store cryptographic keys in the fewest possible locations" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing any cryptographic keys in the fewest locations helps an organization track and monitor all key locations and minimizes the potential for keys to be exposed to unauthorized parties.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.6.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.4: Examine key storage locations and observe processes to verify that keys are stored in the fewest possible locations.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.5.3-C" name="Store securely secret and private keys used to encrypt/decrypt" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing cryptographic keys securely prevents unauthorized or unnecessary access that could result in the exposure of stored account data. Storing keys separately means they are stored such that if the location of one key is compromised, the second key is not also compromised.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Where data-encrypting keys are stored in an HSM, the HSM interaction channel should be protected to prevent interception of encryption or decryption operations.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.6.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.2.a: Examine documented procedures to verify it is defined that cryptographic keys used to encrypt/decrypt stored account data must exist only in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.b: Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.c: Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Key-encrypting keys are at least as strong as the data-encrypting keys they protect.&lt;/li&gt;&lt;li&gt;Key-encrypting keys are stored separately from data-encrypting keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:18.642">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:14.491">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:22.883">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                    <countermeasure ref="CWE-662" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                <countermeasure ref="CWE-662" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319-AUTH">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
+          <threats>
+            <threat ref="sensitive-auth-data-stealing" name="Attackers gain access to the personal identification number (PIN) or the encrypted PIN block after authorization" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
+              <desc>If full track data is stored, malicious individuals who obtain that data can use it to reproduce payment cards and complete fraudulent transactions. The purpose of the card validation code is to protect "card-not-present" transactions-Internet or mail order/telephone order (MO/TO) transactions-where the consumer and the card are not present. If this data is stolen, malicious individuals can execute fraudulent Internet and MO/TO transactions. These values should be known only to the card owner or bank that issued the card. If this data is stolen, malicious individuals can execute fraudulent PIN-based debit transactions (for example, ATM withdrawals).</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R3-3.x">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
+                    <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
+                    <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
+                <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
+                <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
+                                that data.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                    <countermeasure ref="store-backups-securely" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                <countermeasure ref="store-backups-securely" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>If sensitive data is stored or processed on the host, then should the host itself be
+                                compromised by an attacker, the confidentiality and/or the integrity of the data would
+                                also be at risk.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="b98ce640-adf4-43ad-b1f2-6137a490583f" diagramComponentId="5a6f6ed5-1cf0-416c-a9dc-64147c9da04f" ref="8f1524bf-126c-4a18-9e88-22a4b9a90c24" name="Web Client" desc="" library="" parentComponentRef="" componentDefinitionRef="web-client">
+      <tags/>
+      <questions>
+        <question ref="channelEncryption" answer="true" manuallyModified="false"/>
+        <question ref="client.auth.no" answer="true" manuallyModified="false"/>
+        <question ref="client.authz.no" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="fipsCryptolibraries" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="20"/>
+        <asset name="Customer Data" accessType="40"/>
+        <asset name="Credit Card Data" accessType="20"/>
+        <asset name="Credit Card Data" accessType="40"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="PCI-R6-6.5" name="Applications are vulnerable to known flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>The applications are vulnerable to injection flaws, particularly SQL injections. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.423">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.361">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-370" name="Missing Check for Certificate Revocation after Initial Check" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not check the revocation status of a
+                        certificate after its initial revocation check, which can cause the software to
+                        perform privileged actions even after the certificate is revoked at a later
+                        time.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.846">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="PCI-R6-6.3" name="Security is not included in the Software Development Life Cycle" state="0" impact="100" issueId="" issueLink="">
+          <desc>Security is missing during the requirement definition, design, analysis, and testing phases of software development.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.586">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.123">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:27.424">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.124">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-CIPHERS" name="Use of weak TLS cipher suites" state="0" impact="100" issueId="" issueLink="">
+          <desc>A weak TLS cipher suite could allow an attacker to sniff the transmission by exploiting this weakness.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.845">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SSL-WEAK-PROTOCOL" name="Use of weak TLS protocols" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A cryptographically weak SSL/TLS protocol could allow an attacker to covertly observe "sniff" the traffic or impersonate the server.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.845">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="PCI-R6-6.5.6-C" name="Address all &quot;high risk&quot; vulnerabilities detected" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All vulnerabilities identified by an organization's vulnerability risk-ranking
+                        process (defined
+                        in Requirement 6.1) as "high risk" that could affect the application should
+                        be 
+                        addressed during application development.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.6: Examine software-development policies and procedures and interview responsible personnel to verify that coding techniques address any "high risk" vulnerabilities that could affect the application, as identified in PCI DSS Requirement 6.1.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.436">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3.1-C" name="Clean up development and testing data" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This data may give away information about the functioning of an application or system and is an easy target for unauthorized individuals to exploit to gain access to systems. Possession of such information could facilitate compromise of the system and related account data.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="6.5.6" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.6.a: Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.b: Observe testing processes for both off-theshelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.5.6.c: Examine data and accounts for recently installed or updated off-the-shelf software and inhouse applications to verify there is no test data or test accounts on systems in production.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.438">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" name="Configure and enable appropriate certification revocation" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
+          <desc>&lt;div&gt;
+                        Configure and enable appropriate certification revocation for each certificate created, such as
+                        Online Certificate Status Protocol (OCSP) Stapling.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        OCSP is a protocol to check if an SSL certificate has been revoked. Instead of the client
+                        downloading a large list of revoked certificates, they can simply submit a request to a CA
+                        server, which returns a signed response with the certificate current status.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Certificate revocation" url="https://medium.com/@alexeysamoshkin/how-ssl-certificate-revocation-is-broken-in-practice-af3b63b9cb3"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that appropriate certification revocation is enabled and configured.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.4-C" name="Do not transmit data over insecure channels" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications that fail to adequately encrypt network traffic using strong
+                        cryptography are at
+                        increased risk of being compromised and exposing cardholder data. If an attacker is able to
+                        exploit weak
+                        cryptographic processes, they may be able to gain control of an application or even gain
+                        clear-text access
+                        to encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.6" supportedStandardRef="pci-sss"/>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.4: Examine software-development policies and procedures and interview responsible personnel to verify that insecure communications are addressed by means of coding techniques that properly authenticate and encrypt all sensitive communications.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.3-C" name="Do not use insecure cryptographic storage" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications that do not utilize strong cryptographic functions properly to store
+                        data are at
+                        increased risk of being compromised and exposing authentication credentials and/or cardholder
+                        data. If an
+                        attacker is able to exploit weak cryptographic processes, they may be able to gain clear-text
+                        access to
+                        encrypted data.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="7.1" supportedStandardRef="pci-sss"/>
+            <standard ref="7.2" supportedStandardRef="pci-sss"/>
+            <standard ref="7.3" supportedStandardRef="pci-sss"/>
+            <standard ref="7.4" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.3: Examine software-development policies and procedures and interview responsible personnel to verify that insecure cryptographic storage is addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Prevent cryptographic flaws.&lt;/li&gt;&lt;li&gt;Use strong cryptographic algorithms and keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;7.1.a: The assessor shall examine the vendor evidence to confirm that, where cryptography is relied upon (in whole or in part) for the security of the critical assets:&lt;ul&gt;&lt;li&gt;Industry-accepted cryptographic algorithms and modes of operation are used in the software as the primary means for protecting critical assets; and&lt;/li&gt;&lt;li&gt;Use of any unapproved algorithms must be in conjunction with approved algorithms and implemented in a manner that does not reduce the equivalent cryptographic key strength provided by the approved algorithms.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.b: The assessor shall examine vendor evidence, including the vendor threat information, and test the software to confirm that:&lt;ul&gt;&lt;li&gt;Only documented cryptographic algorithms and modes are used in the software and are implemented correctly, and&lt;/li&gt;&lt;li&gt;Protections are incorporated to prevent common cryptographic attacks such as the use of the software as a decryption oracle, brute-force or dictionary attacks against the input domain of the sensitive data, the re-use of security parameters such as IVs, or the re-encryption of multiple datasets using linearly applied key values (such as XOR'd key values in stream ciphers or one-time pads).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.1.c: Where any algorithm or mode of operation requires a unique value per encryption operation or session, the assessor shall examine current publicly available literature or industry standards to identify security vulnerabilities in their implementation and test the software to confirm correct implementation. For example, this may include the use of a unique IV for a stream cipher mode of operation, a unique (and random) "k" value for a digital signature.&lt;/li&gt;&lt;li&gt;7.1.d: Where padding is used prior to/during encryption, the assessor shall examine vendor evidence and test the software to confirm that the encryption operation always incorporates an industry-accepted standard padding method.&lt;/li&gt;&lt;li&gt;7.1.e: Where hash functions are used within the software, the assessor shall:&lt;ul&gt;&lt;li&gt;Examine publicly available literature and research to identify vulnerable algorithms that can be exploited, and&lt;/li&gt;&lt;li&gt;Test the software to confirm that only approved, collision-resistant hash algorithms and methods are used with a salt value of appropriate strength, generated using a secure random number generator.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.a: The assessor shall examine vendor evidence and test the software to confirm that:&lt;ul&gt;&lt;li&gt;All cryptographic keys that are used for providing security to critical assets-including both confidentiality and authenticity-as well as for providing other security services to the software (such as authentication of end-point or software updates) have a unique purpose. For example, no key may be used for both encryption and authentication operations.&lt;/li&gt;&lt;li&gt;All keys have defined generation methods, and no secret or private cryptographic keys relied upon for security of critical assets are shared between software instances, except when a common secret or private key is used for securing the storage of other cryptographic keys that are generated during the installation, initialization, or first use of the software (e.g., white-box cryptography).&lt;/li&gt;&lt;li&gt;All cryptographic keys have an equivalent bit strength of at least 128 bits in accordance with industry standards.&lt;/li&gt;&lt;li&gt;All keys have a defined crypto-period aligned with industry standards, and methods are implemented to retire and/or update each key at the end of the defined crypto-period.&lt;/li&gt;&lt;li&gt;The integrity and confidentiality of all secret and private cryptographic keys managed by the software are protected when stored (e.g., encrypted with a key-encrypting key that is at least as strong as the data-encrypting key and is stored separately from the data-encrypting key, or as at least two full-length key components or key shares, in accordance with an industry-accepted method).&lt;/li&gt;&lt;li&gt;All keys have a defined generation or injection process, and this process ensures sufficient entropy for the key.&lt;/li&gt;&lt;li&gt;All key-generation functions must implement one-way functions or other irreversible key-generation processes, and no reversible key calculation modes (such as key variants) are used to directly create new keys from an existing key.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.b: Where cryptography is used to protect a key, the assessor shall examine vendor evidence and test the software to confirm that security is not provided to any key by a key of lesser strength (e.g., by encrypting a 256-bit AES key with a 128-bit AES key).&lt;/li&gt;&lt;li&gt;7.2.c: Where any public keys are used by the system, the assessor shall examine vendor evidence and test the software to confirm that the vendor maintains an inventory of all cryptographic keys used by the software and that the authenticity of all public keys is maintained. Vendor evidence must identify:&lt;ul&gt;&lt;li&gt;Key label or name&lt;/li&gt;&lt;li&gt;Key location&lt;/li&gt;&lt;li&gt;Effective and expiration date&lt;/li&gt;&lt;li&gt;Key purpose/type&lt;/li&gt;&lt;li&gt;Key length&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.2.d: Where public or white-box keys are not unique per software instantiation the assessor shall examine vendor evidence and test the software to confirm that methods and procedures to revoke and/or replace such keys (or key pairs) exist.&lt;/li&gt;&lt;li&gt;7.2.e: Where the software relies upon external files or other data elements for key material (such as for public TLS certificates), the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to install such key material in accordance with this standard-including details noting any security requirements for such key material-is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;7.2.f: Where public keys are used, the assessor shall examine vendor evidence and test the software to confirm that public keys manually loaded or used as root keys are installed and stored in a way that provides dual control (to a level that is feasible on the execution environment), preventing a single user from replacing a key to facilitate a man-in-the-middle attack, easy decryption of stored data, etc. Where complete dual control is not feasible (e.g., due to a limitation of the execution environment), the assessor shall confirm that the methods implemented are appropriate to protect the public keys.&lt;/li&gt;&lt;li&gt;7.2.g: The assessor shall examine vendor evidence and test the software to confirm that any secret and/or private keys are managed in a way that ensures split knowledge over the key, to a level that is feasible given the platform on which the software is executed. Where absolute split knowledge is not feasible, the assessor shall confirm that methods implemented are reasonable to protect secrets and/or private keys.&lt;/li&gt;&lt;li&gt;7.2.h: The assessor shall examine vendor evidence and test the software to confirm that methods are implemented to "roll" any keys at the end of their defined crypto-period that ensure the security of the sensitive data (both cryptographic keys and data secured through use of these keys) is in line with the requirements of this standard.&lt;/li&gt;&lt;li&gt;7.3.a: The assessor shall examine vendor evidence to confirm that all random number generation methods implemented in the software:&lt;ul&gt;&lt;li&gt;Use at least 128 bits of entropy prior to the output of any random numbers from the random number generator.&lt;/li&gt;&lt;li&gt;Ensure it is not possible for the system to provide or produce reduced entropy upon start-up or entry of other predictable states of the system.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.3.b: Where the vendor is relying upon previous assessment of the random number generator, or source of initial entropy, the assessor shall examine the approval records of the previous assessment and test the software to confirm that this scheme and specific approval include the correct areas of the software in the scope of its assessment, and that the vendor claims do not exceed the scope of the evaluation or approval of that software. For example, some cryptographic implementations approved under FIPS 140-2 or 140-3 require seeding from an external entropy source to correctly output random data.&lt;/li&gt;&lt;li&gt;7.3.c: Where third-party software, platforms, or libraries are used for all or part of the random number generation process, the assessor shall examine current publicly available literature to confirm that there are no publicly known vulnerabilities or concerns with the software that may compromise its use for generating random values in the software under test. Where problems are known, but have been mitigated by the software vendor, the assessor shall examine vendor evidence and test the software to confirm that the vulnerabilities have been sufficiently mitigated. The assessor shall test the software to confirm that third-party software, platforms, or libraries are correctly integrated, implemented, and configured.&lt;/li&gt;&lt;li&gt;7.3.d: The assessor shall examine vendor evidence and test the software to confirm that methods have been implemented to prevent or detect (and respond) the interception, or "hooking," of random number calls that are serviced from third-party software, or the platform on which the software is executed.&lt;/li&gt;&lt;li&gt;7.3.e: The assessor shall test the software to obtain 128MB of data output from each random number generator implemented in the system to confirm the lack of statistical correlation in the output. This data may be generated by the assessor directly, or supplied by the vendor, but the assessor must confirm that the generation method implemented ensures that the data is produced as it would be produced by the software during normal operation.&lt;/li&gt;&lt;li&gt;7.4.a: The assessor shall examine vendor evidence and test the software to confirm that the methods used for the generation of all cryptographic keys and other material (such as IVs, "k" values for digital signatures, etc.) have entropy that meets the minimum effective strength requirements of the cryptographic primitives and keys.&lt;/li&gt;&lt;li&gt;7.4.b: Where cryptographic keys are generated through processes which require direct user interaction, such as through the entry of a passphrase or the use of "random" user interaction with the software, the assessor shall examine vendor evidence and test the software to confirm that these processes are implemented in such a way that they provide sufficient entropy. Specifically, the assessor shall confirm that:&lt;ul&gt;&lt;li&gt;Any methods used for generating keys directly from a password/passphrase enforces an input domain that is able to provide sufficient entropy, such that the total possible inputs are at least equal to that of the equivalent bit strength of the key being generated (e.g., a 32-hex-digit input field for an AES128 key).&lt;/li&gt;&lt;li&gt;The passphrase is passed through an industry-standard key-derivation function, such as PBKDF2 or bcrypt, which extends the work factor for any attempt to brute-force the passphrase value. The assessor shall confirm that a work factor of at least 10,000 is applied to any such implementation.&lt;/li&gt;&lt;li&gt;Clear and sufficient guidance is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 that any passphrase used must be:&lt;ul&gt;&lt;li&gt;Randomly generated itself, using a valid and secure random process: an online random number generator must not be used for this purpose.&lt;/li&gt;&lt;li&gt;Never implemented by a single person, such that one person has an advantage in recovering the clear key value; violating the requirements for split knowledge.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;7.4.c: Where any third-party software or platforms are relied upon by the software and do not meet the entropy requirements, the assessor shall examine vendor evidence and test the software to confirm that sufficient mitigations are implemented, and that clear and sufficient guidance on the secure configuration and usage of these software components is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="85" state="Required" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.480">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
+                        practice and required minimum key lengths depend on the scenarios listed below.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
+            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
+            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
+                            &lt;br /&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
+                            bits&lt;/li&gt;
+                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="66" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
+&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
+&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
+  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
+  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
+  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
+            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
+            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
+ &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
+ &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;span&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
+              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.7-C" name="Implement cross-site scripting (XSS) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;XSS flaws occur whenever an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser, which can hijack user sessions, deface websites, possibly introduce worms, etc.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.7" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.7: Examine software-development policies and procedures and interview responsible personnel to verify that cross-site scripting (XSS) is addressed by means of coding techniques that validate all parameters before inclusion and use context-sensitive escaping, among other things.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.10-C" name="Implement robust authentication and session management" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secure authentication and session management prevent unauthorized individuals from compromising legitimate account credentials, keys, or session tokens that would otherwise enable an intruder to assume the identity of an authorized user.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="5.1" supportedStandardRef="pci-sss"/>
+            <standard ref="5.2" supportedStandardRef="pci-sss"/>
+            <standard ref="5.3" supportedStandardRef="pci-sss"/>
+            <standard ref="5.4" supportedStandardRef="pci-sss"/>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.10" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.10: Examine software development policies and procedures and interview responsible personnel to verify that broken authentication and session management are addressed via coding techniques that commonly include:&lt;ul&gt;&lt;li&gt;Flagging session tokens (for example cookies) as "secure".&lt;/li&gt;&lt;li&gt;Not exposing session IDs in the URL.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;5.1.a: The assessor shall examine vendor evidence to confirm that the vendor has identified authentication requirements (i.e., type and number of factors) for all roles based on critical asset classification, the type of access (e.g., local, non-console, remote) and level of privilege. Note: The assessor should refer to evidence obtained in the testing of Control Objective 1.3 to determine the classifications for all critical assets.&lt;/li&gt;&lt;li&gt;5.1.b: The assessor shall examine vendor evidence and test the software to confirm that all access to critical assets is authenticated and authentication mechanisms are implemented correctly.&lt;/li&gt;&lt;li&gt;5.1.c: Where the software recommends, suggests, relies on, or otherwise facilitates the use of additional mechanisms (such as third-party VPNs, remote desktop features, etc.) to facilitate secure non-console access to the system on which the software is executed or directly to the software itself, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on how to configure authentication mechanisms correctly is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.1.d: The assessor shall examine vendor evidence to confirm that any sensitive data associated with credentials, including public keys, is identified as a critical asset.&lt;/li&gt;&lt;li&gt;5.2.a: The assessor shall examine vendor evidence and test the software to confirm that all implemented authentication methods require unique identification.&lt;/li&gt;&lt;li&gt;5.2.b: Where interfaces, such as APIs, allow for automated access to critical assets, the assessor shall examine vendor evidence and test the software to confirm that unique identification of different programs or systems accessing the critical assets is required (for example, through use of multiple public keys) and that guidance on configuring a unique credential for each program or system is included in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;5.2.c: Where identification is supplied across a non-console interface, the assessor shall test the software to confirm that authentication mechanisms are protected.&lt;/li&gt;&lt;li&gt;5.2.d: The assessor shall examine vendor evidence to confirm that the software vendor's implementation guidance provided to stakeholders per Control Objective 12.1 specifically notes that identification and authentication parameters must not be shared between individuals, programs, or in any way that prevents the unique identification of each access to a critical asset.&lt;/li&gt;&lt;li&gt;5.2.e: The assessor shall examine vendor evidence, including source code of the software, to confirm that there are no additional methods for accessing critical assets.&lt;/li&gt;&lt;li&gt;5.3.a: The assessor shall examine vendor evidence to confirm that all implemented authentication methods were evaluated to identify the details of known vulnerabilities or attack methods on the authentication method, and how the implementation mitigates against such attacks. The evidence must also illustrate that the implementation used in the software was considered. For example, a fingerprint may be uniquely identifiable to an individual, but the ability to spoof or otherwise bypass such technology can be highly dependent on the way the solution is implemented.&lt;/li&gt;&lt;li&gt;5.3.b: The assessor shall examine vendor evidence to confirm that implemented authentication methods are robust and that robustness of the authentication methods was evaluated using industry-accepted methods.&lt;/li&gt;&lt;li&gt;5.3.c: The assessor shall test the software to confirm the authentication methods are implemented correctly and do not expose vulnerabilities.&lt;/li&gt;&lt;li&gt;5.4.a: The assessor shall examine vendor evidence to confirm that the vendor has clearly identified and reasonably justified the required access for all critical assets.&lt;/li&gt;&lt;li&gt;5.4.b: The assessor shall examine vendor evidence and test the software to identify what access is provided to critical assets and confirm that such access correlates with the vendor evidence. The test to confirm access is restricted should include attempts to access critical assets through user accounts, roles, or services which should not have the required privileges.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.5-C" name="Implement robust error handling" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications can unintentionally leak information about their configuration or internal workings, or expose privileged information through improper error handling methods. Attackers use this weakness to steal sensitive data or compromise the system altogether. If a malicious individual can create errors that the application does not handle properly, they can gain detailed system information, create denial-of-service interruptions, cause security to fail, or crash the server. For example, the message "incorrect password provided" tells an attacker that the user ID provided was accurate and they should focus their efforts only on the password. Use more generic error messages, like "data could not be verified."&amp;nbsp;&lt;/p&gt;&lt;p&gt;Another common technique used by attackers to compromise sensitive data that is stored, processed, or transmitted by software is to manipulate the software in a way that generates unhandled exceptions.&lt;/p&gt;&lt;p&gt;Unhandled exceptions are error conditions that the software vendor has not anticipated and, therefore, has not factored into the software design. If an attacker can manipulate a software function that is known to handle sensitive data in a way that generates a condition that the software does not handle properly, it is possible that the software may output an error that includes sensitive data.&lt;/p&gt;&lt;p&gt;To protect against attacks involving unhandled exceptions, all terminal software functions handling sensitive data should include processes or routines that instruct the software how to treat unknown exceptions. These processes should determine what information to include in any error codes or values. The disclosure of sensitive data through error conditions or error reporting, whether intentional or accidental, should be avoided.&lt;/p&gt;&lt;p&gt;Race conditions can arise when the software requires sequential processing of data to perform some software function. For example, a "time-of-use, time-of-check race condition" exists when a file is checked at one point and used immediately after, with the assumption that the previous check is still valid. This assumption may not be correct if the system allows the file to be modified in between.&lt;/p&gt;&lt;p&gt;If an attacker can identify and manipulate the software to take advantage of a race condition, they may be able to execute arbitrary code or generate other conditions that the attacker could exploit further.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="B.3.2" supportedStandardRef="pci-sss"/>
+            <standard ref="B.3.3" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.5: Examine software-development policies and procedures and interview responsible personnel to verify that improper error handling is addressed by means of coding techniques that do not leak information via error messages (for example, by returning generic error details rather than specific ones).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;B.3.2.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that handle the sensitive data predefined in Control Objective 1.2. For each of the noted software functions, the assessor shall confirm that each function:&lt;ul&gt;&lt;li&gt;Checks return values for the presence of sensitive data&lt;/li&gt;&lt;li&gt;Processes the return values in a way that does not inadvertently "leak" sensitive data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;B.3.2.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that handles sensitive data by attempting to manipulate the software in a manner that generates an unhandled exception to confirm that error conditions do not expose sensitive data.&lt;/li&gt;&lt;li&gt;B.3.3.a: The assessor shall examine all relevant software documentation and source code necessary to identify all software functions that rely on synchronous processing. For each of the noted functions, the assessor shall confirm that protection mechanisms have been implemented in the software to mitigate race conditions.&lt;/li&gt;&lt;li&gt;B.3.3.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.), the assessor shall test each software function that relies on synchronous processing by attempting to generate a race condition (such as through specially-crafted attacks intended to exploit the timing of synchronous events) to confirm that the software is resistant to such attacks.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.8-C" name="Implement robust server side access control" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Improper access control refers to cases such as insecure direct object references, failure to
+                        restrict URL
+                        access, directory traversal, and failure to restrict user access to functions.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt; &lt;/p&gt;
+                        &lt;p&gt;A direct object reference occurs when a developer exposes a reference to an internal
+                        implementation
+                        object, such as a file, directory, database record, or key, as a URL or form parameter.
+                        Attackers can
+                        manipulate those references to access other objects without authorization.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Consistently enforce access control in the presentation layer and business logic for all
+                        URLs.
+                        Frequently, the only way an application protects a sensitive functionality is by preventing the
+                        display of
+                        links or URLs to unauthorized users. Attackers can use this weakness to perform
+                        unauthorized
+                        operations by accessing those URLs directly.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;An attacker may be able to enumerate and navigate the directory structure of a website
+                        (directory
+                        traversal) thus gaining access to unauthorized information as well as further insight
+                        into the
+                        workings of the site for later exploitation.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;If user interfaces permit access to unauthorized functions, this access could result in
+                        unauthorized individuals gaining access to privileged credentials or cardholder data. Only
+                        authorized users
+                        should be permitted to access direct object references to sensitive resources. Limiting access
+                        to data
+                        resources will help prevent cardholder data from being presented to unauthorized resources.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.8" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.8: Examine software-development policies and procedures and interview responsible personnel to verify that improper access control-such as insecure direct object references, failure to restrict URL access, and directory traversal-is addressed by means of a coding technique that includes:&lt;ul&gt;&lt;li&gt;Proper authentication of users&lt;/li&gt;&lt;li&gt;Input sanitization&lt;/li&gt;&lt;li&gt;Protection against the exposure of internal object references to users&lt;/li&gt;&lt;li&gt;User interfaces that do not permit access to unauthorized functions.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.1a-C" name="Perform input validation for all untrusted data" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Injection flaws, particularly SQL injections, are a commonly used method for
+                        compromising
+                        applications. An injection occurs when user-supplied data is sent to an interpreter as part of a
+                        command or
+                        query. The attacker's hostile data tricks the interpreter into executing unintended commands or
+                        changing
+                        data, and allows the attacker to attack components inside the network through the application
+                        to initiate
+                        attacks such as buffer overflows, or to reveal both confidential information and server
+                        application
+                        functionalities.&amp;nbsp;&lt;/p&gt;
+                        &lt;p&gt;Information should be validated before being sent to the application-for example,
+                        by
+                        checking for
+                        all alpha characters, mixes of alpha and numeric characters, etc.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3" supportedStandardRef="pci-sss"/>
+            <standard ref="6.5.1a" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="B.3.1" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.a: Examine software-development policies and procedures to verify that developers have to complete up-to-date training in secure coding techniques at least annually, based on industry best practices and guidance.&lt;/li&gt;&lt;li&gt;6.5.b: Examine records of training to verify that software developers receive up-to-date training on secure coding techniques at least annually, including how to avoid common coding vulnerabilities.&lt;/li&gt;&lt;li&gt;6.5.c: Verify that processes are in place to protect applications from, at a minimum, the following vulnerabilities:&lt;ul&gt;&lt;li&gt;Injection flaws, particularly SQL injection.&lt;/li&gt;&lt;li&gt;Buffer overflows&lt;/li&gt;&lt;li&gt;Insecure cryptographic storage&lt;/li&gt;&lt;li&gt;Insecure communications&lt;/li&gt;&lt;li&gt;Improper error handling&lt;/li&gt;&lt;li&gt;All "high risk" vulnerabilities identified in the vulnerability identification process&lt;/li&gt;&lt;li&gt;Cross-site scripting (XSS)&lt;/li&gt;&lt;li&gt;Improper access control&lt;/li&gt;&lt;li&gt;Cross-site request forgery (CSRF)&lt;/li&gt;&lt;li&gt;Broken authentication and session management.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;6.3.a: The assessor shall examine vendor evidence and test the software to confirm that each use of cryptography-where cryptography is relied upon (in whole or in part) for the security of critical assets-is compliant to Control Objective 7.&lt;/li&gt;&lt;li&gt;6.3.b: Where cryptographic methods provided by third-party software or aspects of the execution environment or platform on which the application is run are relied upon for the protection of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1 provides clear and sufficient detail for correctly configuring these methods during the installation, initialization, or first use of the software.&lt;/li&gt;&lt;li&gt;6.3.c: Where asymmetric cryptography such as RSA or ECC is used for protecting the confidentiality of sensitive data, the assessor shall examine vendor evidence and test the software to confirm that private keys are not used for providing confidentiality protection to the data.&lt;/li&gt;&lt;li&gt;B.3.1.a: The assessor shall examine all relevant software documentation and source code necessary to identify all external inputs to the software. For each user or other external input, the assessor shall examine all relevant software documentation and source code to confirm that inputs conform to a list of expected characteristics and that all input that does not conform to expected characteristics is rejected by the software or otherwise handled securely.&lt;/li&gt;&lt;li&gt;B.3.1.b: The assessor shall install and configure the software in accordance with the software vendor's implementation guidance required in Control Objectives 12.1 and B.5.1. Using an appropriate "test platform" and suitable forensic tools and/or methods (commercial tools, scripts, etc.) the assessor shall test the software by attempting to supply each user or other external input with invalid or unexpected characteristics to confirm that the software validates all inputs and either rejects or securely handles all unexpected characteristics.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-PROTOCOLS" name="Require cryptographically secure protocols (e.g. TLSv1.2 and above)" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of 'known good' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols. Disable SSLv3 and earlier protocols on the service.&lt;/li&gt;
+ &lt;li&gt;Ideally, only TLSv1.2 and newer versions should be supported.&lt;/li&gt;
+ &lt;li&gt;If TLSv1.1 or 1.0 are required, known secure configurations and ciphers should be selected.&lt;/li&gt;
+ &lt;li&gt;SSLv3.0 and earlier should not be used.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all of the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that TLSv1.2 is supported.&lt;/li&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.770">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="TLS-STRONG-CIPHERS" name="Require cryptographically strong TLS cipher suites" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Only cryptographically strong ciphers should be used. Best-practice dictates that a subset of ' &lt;i&gt;known good&lt;/i&gt;' ciphers and protocols must be defined and enforced on the server. &amp;nbsp;This may, however, cause compatibility issues with older browsers, requiring a balance between accessibility and security.&amp;nbsp;&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Define and enforce a list of acceptable ciphers and protocols.&lt;/li&gt;
+ &lt;li&gt;Explicitly disable known-bad ciphers and protocols, such as:
+  &lt;ul&gt;
+   &lt;li&gt;Null and export ciphers.&lt;/li&gt;
+   &lt;li&gt;DH, MD5 and other weak cryptography.&lt;/li&gt;
+   &lt;li&gt;Ciphers with keys smaller than 128 bits.&lt;/li&gt;
+   &lt;li&gt;CBC ciphers with TLSv1.0 or earlier.&lt;/li&gt;
+  &lt;/ul&gt;&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+            <reference name="SSL Labs - SSL/TLS Deployment Best Practices" url="https://www.ssllabs.com/projects/best-practices/"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.2" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Use automated tools to identify all the SSL/TLS protocols supported by the
+                            service.&lt;/li&gt;
+                            &lt;li&gt;Verify that cryptographically weak (also known as &amp;quot;export&amp;quot;
+                            class) ciphers are not supported.&lt;/li&gt;
+                            &lt;ol&gt;
+                            &lt;br /&gt;
+                            &lt;/ol&gt;
+                            &lt;/ol&gt;Some of the tools that can perform these tests are:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;&lt;a href="https://www.continuumsecurity.net/bdd-security/" rel="nofollow"&gt;BDD-Security&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://www.ssllabs.com/" rel="nofollow"&gt;SSLabs&lt;/a&gt;&lt;/li&gt;
+                            &lt;li&gt;&lt;a href="https://github.com/mozilla/cipherscan" rel="nofollow"&gt;cipherscan&lt;/a&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2022-06-15T20:31:23.770">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3.2-C" name="Review custom code prior to release to production" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Security vulnerabilities in bespoke and custom software are commonly exploited by malicious individuals to gain access to a network and compromise account data.&lt;/p&gt;&lt;p&gt;Vulnerable code is far more difficult and expensive to address after it has been deployed or released into production environments. Requiring a formal review and signoff by management prior to release helps to ensure that code is approved and has been developed in accordance with policies and procedures.&lt;/p&gt;&lt;p&gt;Having code reviewed by someone other than the original author, who is both experienced in code reviews and knowledgeable about secure coding practices, minimizes the possibility that code containing security or logic errors that could affect the security of cardholder data is released into a production environment. Requiring management approval that the code was reviewed limits the ability for the process to be bypassed.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;The following items should be considered for inclusion in code reviews:&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Searching for undocumented features (implant tools, backdoors).&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Confirming that software securely uses external components' functions (libraries, frameworks, APIs, etc.). For example, if a third-party library providing cryptographic functions is used, verify that it was integrated securely.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking for correct use of logging to prevent sensitive data from getting into logs.&lt;/p&gt;&lt;p&gt;&amp;nbsp; - Analysis of insecure code structures that may contain potential vulnerabilities related to common software attacks identified in Requirements 6.2.5.&lt;/p&gt;&lt;p&gt;&amp;nbsp; &amp;nbsp;- Checking the application's behavior to detect logical vulnerabilities.&lt;/p&gt;&lt;p&gt;Having a formal review methodology and review checklists has been found to improve the quality of the code review process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Code review is a tiring process, and for this reason, it is most effective when reviewers only review small amounts of code at a time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To maintain the effectiveness of code reviews, it is beneficial to monitor the general workload of reviewers and to have them review applications they are familiar with.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Code reviews may be performed using either manual or automated processes, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Entitles that rely solely on manual code review should ensure that reviewers maintain their skills through regular training as new vulnerabilities are found, and new secure coding methods are recommended.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See the OWASP Code Review Guide.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.3" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.2.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.3.a: Examine documented software development procedures and interview responsible personnel to verify that processes are defined that require all bespoke and custom software to be reviewed in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.b: Examine evidence of changes to bespoke and custom software to verify that the code changes were reviewed in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;6.2.3.1.a: If manual code reviews are performed for bespoke and custom software prior to release to production, examine documented software development procedures and interview responsible personnel to verify that processes are defined for manual code reviews to be conducted in accordance with all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.3.1.b: Examine evidence of changes to bespoke and custom software and interview personnel to verify that manual code reviews were conducted in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="MANUAL" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.320">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5-C" name="Train developers in up-to-date secure coding techniques" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Having staff knowledgeable in secure coding methods, including techniques defined in Requirement 6.2.4, will help minimize the number of security vulnerabilities introduced through poor coding practices.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Training for developers may be provided in-house or by third parties.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Training should include, but is not limited to, development languages in use, secure software design, secure coding techniques, use of techniques/methods for finding vulnerabilities in code, processes to prevent reintroducing previously resolved vulnerabilities, and how to use any automated security testing tools for detecting vulnerabilities in software.&amp;nbsp;&lt;/p&gt;&lt;p&gt;As industry-accepted secure coding practices change, organizational coding practices and developer training may need to be updated to address new threats.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.2.a: Examine software development procedures to verify that processes are defined for training of software development personnel developing bespoke and custom software that includes all elements specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;6.2.2.b: Examine training records and interview personnel to verify that software development personnel working on bespoke and custom software received software security training that is relevant to their job function and development languages in accordance with all elements specified in this requirement.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+          </references>
+          <standards>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.956">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.9-C" name="Use anti cross-site request forgery (CSRF) mechanisms" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request
+                        to a
+                        vulnerable web application, which then enables the attacker to perform any state-changing
+                        operations the
+                        victim is authorized to perform (such as updating account details, making purchases, or even
+                        authenticating
+                        to the application).&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.9" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.9: Examine software development policies and procedures and interview responsible personnel to verify that cross-site request forgery (CSRF) is addressed by means of coding techniques that ensure applications do not rely on authorization credentials and tokens automatically submitted by browsers.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.3-C" name="Use a secure coding methodology" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Bespoke and custom software are developed securely, as follows:&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Based on industry standards and/or best practices for secure development.&amp;nbsp;&lt;/p&gt;&lt;p&gt;- In accordance with PCI DSS (for example, secure authentication and logging).&amp;nbsp;&lt;/p&gt;&lt;p&gt;- Incorporating consideration of information security issues during each stage of the software development lifecycle.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Without the inclusion of security during the requirements definition, design, analysis, and testing phases of software development, security vulnerabilities can be inadvertently or maliciously introduced into the production environment.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Understanding how sensitive data is handled by the application- including when stored, transmitted, and in memory-can help identify where data needs to be protected. PCI DSS requirements must be considered when developing software to meet those requirements by design, rather than trying to retrofit the software later.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Secure software lifecycle management methodologies and frameworks include PCI Software Security Framework, BSIMM, OPENSAMM, and works from NIST, ISO, and SAFECode.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.2.1: Examine documented software development procedures to verify that processes are defined that include all elements specified in this requirement&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.1b-C" name="Use parameterized queries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The use of prepared statements with variable binding (aka parameterized queries) is how all
+                        developers
+                        should first be taught how to write database queries. They are simple to write and easier to
+                        understand
+                        than dynamic queries. Parameterized queries force the developer to first define all the SQL
+                        code, and then
+                        pass each parameter to the query later. This coding style allows the database to distinguish
+                        between code
+                        and data, regardless of what user input is supplied.</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.1b" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;6.5.1: Examine software-development policies and procedures and interview responsible personnel to verify that injection flaws are addressed by means of coding techniques that:&lt;ul&gt;&lt;li&gt;Validate input to verify that user data cannot modify the meaning of commands and queries.&lt;/li&gt;&lt;li&gt;Use parameterized queries.&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R6-6.5.2-C" name="Validate buffer boundaries" issueId="" issueLink="" platform="" cost="0" risk="98" state="Recommended" owner="femi73@hotmail.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Buffer overflows occur when an application does not have appropriate bounds checking
+                        on its
+                        buffer space. This can cause the information in the buffer to be pushed out of the buffer's
+                        memory space and
+                        into executable memory space. When this occurs, the attacker has the ability to insert malicious
+                        code at the
+                        end of the buffer and then push that malicious code into executable memory space by overflowing
+                        the buffer.
+                        The malicious code is then executed and often gives the attacker remote access to the
+                        application and/or
+                        infected system.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="6.5.2" supportedStandardRef="PCI-DSS-v3.2.1"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="85" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:24.483">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="94" state="Recommended" owner="femi73@hotmail.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Encryption should fail closed so that data does not get stored in an unprotected state. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
+            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
+                            &lt;br /&gt;
+                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
+                            the following conditions must be met: &lt;/p&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
+                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
+                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
+                            (e.g. gathered by different sessions or manipulation of session state) share a common
+                            divisor in the length.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2022-06-15T20:31:23.955">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-217" name="Sensitive data is compromised through attacks against SSL/TLS" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Attackers could gain access to sensitive data in transit over an SSL connection by
+                                exploiting weaknesses in the SSL configuration. The use of cryptographically weak
+                                protocols and/or ciphers could be used to decrypt or otherwise gain access to the
+                                encrypted data.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SSL-WEAK-CIPHERS">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="SSL-WEAK-PROTOCOL">
+                  <countermeasures>
+                    <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="TLS-STRONG-CIPHERS" mitigation="50"/>
+                <countermeasure ref="TLS-STRONG-PROTOCOLS" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="IRIUS-TRUST-SERVICE" name="Users lose trust in the system due to a perceived lack of security" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Users lose trust in the system because a key security mechanism, such as certificate
+                                validation is not present and visible.&amp;nbsp; For example, should a TLS certificate
+                                expire or become invalid then this is clearly displayed in the browser as a security
+                                warning.&amp;nbsp; This could cause users to abandon the system.</desc>
+              <riskRating confidentiality="25" integrity="50" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-370">
+                  <countermeasures>
+                    <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PROPER-REVOCATION-CERTIFICATE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="funds-intercepted" name="Funds Intercepted" state="Expose" source="MANUAL" edited="false" owner="femi73@hotmail.com" library="" editable="true">
+              <desc/>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures/>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
+          <threats>
+            <threat ref="pci-dss-vuln-prevention" name="An attacker gains access to cardholder data through a vulnerable system" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
+              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
+              <riskRating confidentiality="75" integrity="100" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R6-6.3">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
+                    <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
+                    <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R6-6.3-C" mitigation="34"/>
+                <countermeasure ref="PCI-R6-6.3.1-C" mitigation="33"/>
+                <countermeasure ref="PCI-R6-6.3.2-C" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="pci-dss-vuln-detection" name="An attacker gains access to cardholder data through security flaws in the application" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="PCI-DSS" editable="true">
+              <desc>Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R6-6.5">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
+                    <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
+                    <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R6-6.5-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.10-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.1a-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.1b-C" mitigation="9"/>
+                <countermeasure ref="PCI-R6-6.5.2-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.3-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.4-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.5-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.6-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.7-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.8-C" mitigation="8"/>
+                <countermeasure ref="PCI-R6-6.5.9-C" mitigation="8"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                theft and then uses this key to forge signatures from the original signer to mislead a
+                                victim into performing actions that benefit the attacker.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
+                                generation and then uses this key to forge signatures from the original signer to
+                                mislead a victim into performing actions which benefit the attacker.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-330">
+                  <countermeasures>
+                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-345">
+                  <countermeasures>
+                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="femi73@hotmail.com" library="CS-Default" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="crypto-operations" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="crypto-operations" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/simple-web-app.xml b/Templates/Submitted_Templates/simple-web-app.xml
new file mode 100644
index 0000000..5d0792e
--- /dev/null
+++ b/Templates/Submitted_Templates/simple-web-app.xml
@@ -0,0 +1,12339 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="simple-web-app" name="Simple Web Application" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMTE3NSIgZHk9Ijc1OSIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI1LjMuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjQ0IiB2YWx1ZT0iSW50ZXJuZXQiIHN0eWxlPSJpci5yZWY9ZjBiYTc3MjItMzliNi00YzgxLTgyOTAtYTMwYTI0OGJiOGQ5O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7cmVjdXJzaXZlUmVzaXplPTA7aHRtbD0xO3ZlcnRpY2FsQWxpZ249dG9wO2FsaWduPWxlZnQ7ZGFzaGVkPTE7c3Ryb2tlV2lkdGg9MTthcmNTaXplPTM7YWJzb2x1dGVBcmNTaXplPTE7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyO3N0cm9rZUNvbG9yPSM3NTc1RUI7ZmlsbENvbG9yPSNGMEYwRkY7ZmlsbE9wYWNpdHk9MzA7Zm9udENvbG9yPSM1NjUxRTA7Y29ubmVjdGFibGU9MDtjb250YWluZXI9MTtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9VFJVU1RaT05FOyIgcGFyZW50PSIxIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSItMjMwIiB5PSItNSIgd2lkdGg9IjE2NyIgaGVpZ2h0PSIzNDYiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OCIgdmFsdWU9IkJyb3dzZXIgLSZndDsgV2ViIFVJIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0wO2VudHJ5WT0wLjI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTc0YTUwM2E5LTQyNWItNDkzNC05MGJkLTFiNDJhMDRmNzM1Zjtpci50YWdzPWxvZ2luLFJlZ2lzdGVyO2lyLmFzc2V0cz1DdXN0b21lciBEYXRhOyIgcGFyZW50PSI0NCIgc291cmNlPSI0NiIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQnJvd3NlciIgaWQ9IjQ2Ij4KICAgICAgPG14Q2VsbCBzdHlsZT0iaXIucmVmPTliMTVlMTI1LTM3YWUtNDRlZi1hODAzLTZjNmIzOGFmOTQ2ZTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1DRC1CUk9XU0VSO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQjJhV1YzUW05NFBTSXdJREFnTVNBeElpQm1hV3hzUFNKdWIyNWxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lQanh6ZEhsc1pUNGdJQ0FnTG1samIyNHRabWxzYkNCN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeUFnSUNCOVBDOXpkSGxzWlQ0OFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREJmTWpVd05WOHlNekl5T0NraVBqeHdZWFJvSUdROUlrMHdMakl3TURnd05pQXdMakk1T0RZME4wTXdMakl3TURnd05pQXdMakl6T1RneU5DQXdMakkwT0RBeU55QXdMakU1TWpFek9TQXdMak13TmpJM055QXdMakU1TWpFek9VZ3dMalk0TlRrM00wTXdMamMwTkRJeU15QXdMakU1TWpFek9TQXdMamM1TVRRME5DQXdMakl6T1RneU5DQXdMamM1TVRRME5DQXdMakk1T0RZME4xWXdMalE1Tmpjd05rTXdMamMzT0RNNU5pQXdMalE0T0RVME55QXdMamMyTkRJMElEQXVORGd5TURJMUlEQXVOelE1TWpVMUlEQXVORGMzTkRJeVZqQXVNell5TlRVeFNEQXVNalF5T1RrMFZqQXVOamd5TURjMVF6QXVNalF5T1RrMElEQXVOekUzTXpZNUlEQXVNamN4TXpJM0lEQXVOelExT1RnZ01DNHpNRFl5TnpjZ01DNDNORFU1T0Vnd0xqVTBNamt6TlVNd0xqVTFNalU1TkNBd0xqYzJNVGszTWlBd0xqVTJORFl6SURBdU56YzJNelFnTUM0MU56ZzFORGNnTUM0M09EZzFPRE5JTUM0ek1EWXlOemRETUM0eU5EZ3dNamNnTUM0M09EZzFPRE1nTUM0eU1EQTRNRFlnTUM0M05EQTRPVGdnTUM0eU1EQTRNRFlnTUM0Mk9ESXdOelZXTUM0eU9UZzJORGRhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BIQmhkR2dnWkQwaVRUQXVOalUxTkRZM0lEQXVOekkwT0RJeFNEQXVOelE0TXpjM1F6QXVOek01TURjMElEQXVOemMwTXprMElEQXVOekl3TkRRMUlEQXVPREE0TVRNNUlEQXVOekF4T1RJeUlEQXVPREE0TVRNNVF6QXVOamd6T1RZZ01DNDRNRGd4TXprZ01DNDJOalU0T1RrZ01DNDNOelkwTURnZ01DNDJOVFl6TXpnZ01DNDNNamt5T0RSTU1DNDJOVFUwTmpjZ01DNDNNalE0TWpGSU1DNDNORGd6TnpkSU1DNDJOVFUwTmpkYVRUQXVOVFkzT0RVMUlEQXVOekkwT0RJMFREQXVOak15TkRZMklEQXVOekkwT0RKRE1DNDJNemM1TXprZ01DNDNOVFl6TnpRZ01DNDJORGN5TVRjZ01DNDNPRE15TVRnZ01DNDJOVGt6TlRrZ01DNDRNREl3TURSRE1DNDJNakE1TURFZ01DNDNPVEExTXpVZ01DNDFPRGc0T0RNZ01DNDNOak01TkRNZ01DNDFOekF3TlRFZ01DNDNNamt3TlV3d0xqVTJOemcxTlNBd0xqY3lORGd5TkZwTk1DNDNOekV6TnpnZ01DNDNNalE0TWt3d0xqZ3pOVGs0T1NBd0xqY3lORGd5TkVNd0xqZ3hOelV4TWlBd0xqYzJNVGM1TWlBd0xqYzRORFE0TVNBd0xqYzVNREEzTmlBd0xqYzBORFVnTUM0NE1ERTVPVGxETUM0M05UVTRNak1nTUM0M09EUTBOVGNnTUM0M05qUTJOVGNnTUM0M05UazVNRGdnTUM0M056QXlNek1nTUM0M016RXdOalpNTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORXd3TGpjM01UTTNPQ0F3TGpjeU5EZ3lXazB3TGpjM05Ua3lOQ0F3TGpZeU5qTXlNMHd3TGpnME9UQXdOQ0F3TGpZeU5qTXhNME13TGpnMU1EazNNaUF3TGpZek5qRXdOeUF3TGpnMU1qQXdOaUF3TGpZME5qSTBOQ0F3TGpnMU1qQXdOaUF3TGpZMU5qWXlOVU13TGpnMU1qQXdOaUF3TGpZM01qUTJOU0F3TGpnME9UVTVPU0F3TGpZNE56Y3pPQ0F3TGpnME5URXpOU0F3TGpjd01qQTVNa2d3TGpjM05EVTJOME13TGpjM05qRTBOeUF3TGpZNE56VTRNU0F3TGpjM05qazNOU0F3TGpZM01qTXpOU0F3TGpjM05qazNOU0F3TGpZMU5qWXlOVU13TGpjM05qazNOU0F3TGpZME9UYzBJREF1TnpjMk9ERTJJREF1TmpReU9UUTFJREF1TnpjMk5UQTFJREF1TmpNMk1qWXhUREF1TnpjMU9USTBJREF1TmpJMk16SXpUREF1T0RRNU1EQTBJREF1TmpJMk16RXpUREF1TnpjMU9USTBJREF1TmpJMk16SXpXazB3TGpVMU5EZzBJREF1TmpJMk16RXpUREF1TmpJM09USWdNQzQyTWpZek1qTkRNQzQyTWpjeU1qWWdNQzQyTXpZeE56SWdNQzQyTWpZNE5qZ2dNQzQyTkRZeU9UZ2dNQzQyTWpZNE5qZ2dNQzQyTlRZMk1qVkRNQzQyTWpZNE5qZ2dNQzQyTmpreE9UTWdNQzQyTWpjek9UZ2dNQzQyT0RFME5qUWdNQzQyTWpnME1Ua2dNQzQyT1RNeU9UbE1NQzQyTWpreU56WWdNQzQzTURJd09USklNQzQxTlRnM01EbERNQzQxTlRReU5EVWdNQzQyT0RjM016Z2dNQzQxTlRFNE16Z2dNQzQyTnpJME5qVWdNQzQxTlRFNE16Z2dNQzQyTlRZMk1qVkRNQzQxTlRFNE16Z2dNQzQyTkRZeU5EUWdNQzQxTlRJNE56SWdNQzQyTXpZeE1EY2dNQzQxTlRRNE5DQXdMall5TmpNeE0xcE5NQzQyTlRBMU16UWdNQzQyTWpZek1UUklNQzQzTlRNek1VTXdMamMxTkRBMk5DQXdMall6TmpBNU9DQXdMamMxTkRRMk5pQXdMalkwTmpJek15QXdMamMxTkRRMk5pQXdMalkxTmpZeU5VTXdMamMxTkRRMk5pQXdMalkyT1RNeE9DQXdMamMxTXpnMk55QXdMalk0TVRZeU9TQXdMamMxTWpjMU9DQXdMalk1TXpNNE0wd3dMamMxTVRnek15QXdMamN3TWpBNU1rZ3dMalkxTWpBeE1VTXdMalkxTURNeE5TQXdMalk0TnpjMklEQXVOalE1TXpjM0lEQXVOamN5TkRreUlEQXVOalE1TXpjM0lEQXVOalUyTmpJMVF6QXVOalE1TXpjM0lEQXVOalE0T0RNeElEQXVOalE1TmpBMElEQXVOalF4TVRneElEQXVOalV3TURNMUlEQXVOak16TnpFMlREQXVOalV3TlRNMElEQXVOakkyTXpFMFNEQXVOelV6TXpGSU1DNDJOVEExTXpSYVRUQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1F6QXVOemc1TnpjNElEQXVOVEkwTnpRNElEQXVPREkyTVRVeklEQXVOVFU1TWpRM0lEQXVPRFF5TlRVM0lEQXVOakF6TlRneVREQXVOemN6TmpZMklEQXVOakF6TlRnM1F6QXVOelk0T1RNeElEQXVOVFkyT1RZeUlEQXVOelU1TXpFeklEQXVOVE0xTlRBNElEQXVOelEyTVRBMElEQXVOVEV6T0RJMlREQXVOelEwTkRnMUlEQXVOVEV4TWpRM1REQXVOelEyTVRBMElEQXVOVEV6T0RJMldrMHdMalkxTnpVek1TQXdMalV4TVRnd05Vd3dMalkxT1RNMU9DQXdMalV4TVRJME4wTXdMalkwTmpFME1TQXdMalV6TVRZNU55QXdMall6TmpNeE9DQXdMalUyTVRZNU5pQXdMall6TVRFd01TQXdMalU1TmpreU1rd3dMall6TURFM055QXdMall3TXpVNE4wd3dMalUyTVRJNE5pQXdMall3TXpVNE1rTXdMalUzTnpRM0lEQXVOVFU1T0RRMUlEQXVOakV6TURnNElEQXVOVEkxTmpneElEQXVOalUzTlRNeElEQXVOVEV4T0RBMVREQXVOalU1TXpVNElEQXVOVEV4TWpRM1REQXVOalUzTlRNeElEQXVOVEV4T0RBMVdrMHdMamN3TVRreU1pQXdMalV3TlRFeE1VTXdMamN5TVRjeE1pQXdMalV3TlRFeE1TQXdMamMwTVRZeU1pQXdMalUwTXpZeU9DQXdMamMxTURFMU1TQXdMalU1T0RneE0wd3dMamMxTURnMU5DQXdMall3TXpVNE0wZ3dMalkxTWprNVF6QXVOall4TURnMElEQXVOVFExT0RZZ01DNDJPREUxTmpjZ01DNDFNRFV4TVRFZ01DNDNNREU1TWpJZ01DNDFNRFV4TVRGYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtQQzluUGp4a1pXWnpQanhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREJmTWpVd05WOHlNekl5T0NJK1BISmxZM1FnZDJsa2RHZzlJakF1T0RnaUlHaGxhV2RvZEQwaU1DNDRPQ0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURZd01EVTROaUF3TGpBMk1EQTFPRFlwSWk4K1BDOWpiR2x3VUdGMGFENDhMMlJsWm5NK1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci50YWdzPWFueTsiIHBhcmVudD0iNDQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iMzguNSIgeT0iMzIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NyIgdmFsdWU9ImFueSIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDYiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OSIgdmFsdWU9IldlYiBVSSAtJmd0OyBCcm93c2VyIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTE5ZDNjYzUzLTc5ODUtNDIyYy05YzY2LWE3ZDViZTBmZjNlYTtpci50YWdzPXJlc3BvbnNlOyIgcGFyZW50PSI0NCIgc291cmNlPSI0NyIgdGFyZ2V0PSI0NiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iV2ViIFVJIiBpZD0iNDciPgogICAgICA8bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj13ZWItdWk7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenhuSUdOc2FYQXRjR0YwYUQwaWRYSnNLQ05qYkdsd01Ta2lQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNell6TmpZMElEQXVNemcyTnpGRE1DNHpPVGsyTnpjZ01DNHpPRFkzTVNBd0xqUXlPVEUxTnlBd0xqUXhORFk0T1NBd0xqUXpNVFUxTVNBd0xqUTFNREE1Tmt3d0xqUXpNVGN3T0NBd0xqUTFORGMxTkZZd0xqZ3dNalV6TmtNd0xqUXpNVGN3T0NBd0xqZ3pPRFUwT1NBd0xqUXdNemN5T1NBd0xqZzJPREF5T1NBd0xqTTJPRE15TWlBd0xqZzNNRFF5TTB3d0xqTTJNelkyTkNBd0xqZzNNRFU0U0RBdU1UazNORE00UXpBdU1UWXhOREkxSURBdU9EY3dOVGdnTUM0eE16RTVORFlnTUM0NE5ESTJNREVnTUM0eE1qazFOVElnTUM0NE1EY3hPVFJNTUM0eE1qa3pPVFVnTUM0NE1ESTFNelpXTUM0ME5UUTNOVFJETUM0eE1qa3pPVFVnTUM0ME1UZzNOQ0F3TGpFMU56TTNNeUF3TGpNNE9USTJNU0F3TGpFNU1qYzRJREF1TXpnMk9EWTNUREF1TVRrM05ETTRJREF1TXpnMk56RklNQzR6TmpNMk5qUmFUVEF1TXpZek5qWTBJREF1TkRNeU1EY3pTREF1TVRrM05ETTRRekF1TVRnMU9UVTJJREF1TkRNeU1EY3pJREF1TVRjMk5EWTJJREF1TkRRd05qQTJJREF1TVRjME9UWTBJREF1TkRVeE5qYzNUREF1TVRjME56VTNJREF1TkRVME56VTBWakF1T0RBeU5UTTJRekF1TVRjME56VTNJREF1T0RFME1ERTRJREF1TVRnek1qa2dNQzQ0TWpNMU1EZ2dNQzR4T1RRek5qRWdNQzQ0TWpVd01Vd3dMakU1TnpRek9DQXdMamd5TlRJeE4wZ3dMak0yTXpZMk5FTXdMak0zTlRFME5pQXdMamd5TlRJeE55QXdMak00TkRZek5pQXdMamd4TmpZNE5DQXdMak00TmpFek9DQXdMamd3TlRZeE0wd3dMak00TmpNME5TQXdMamd3TWpVek5sWXdMalExTkRjMU5FTXdMak00TmpNME5TQXdMalEwTXpJM01pQXdMak0zTnpneE1pQXdMalF6TXpjNE1pQXdMak0yTmpjME1TQXdMalF6TWpJNFREQXVNell6TmpZMElEQXVORE15TURjeldrMHdMak13TXpJNE5DQXdMamN6TkRRNU1VTXdMak14TlRneE1TQXdMamN6TkRRNU1TQXdMak15TlRrMk5TQXdMamMwTkRZME5pQXdMak15TlRrMk5TQXdMamMxTnpFM00wTXdMak15TlRrMk5TQXdMamMyT0RZMU5TQXdMak14TnpRek15QXdMamMzT0RFME5TQXdMak13TmpNMk1pQXdMamMzT1RZME4wd3dMak13TXpJNE5DQXdMamMzT1RnMU5FZ3dMakkxTnpnNE4wTXdMakkwTlRNMklEQXVOemM1T0RVMElEQXVNak0xTWpBMUlEQXVOelk1TmprNUlEQXVNak0xTWpBMUlEQXVOelUzTVRjelF6QXVNak0xTWpBMUlEQXVOelExTmprZ01DNHlORE0zTXpnZ01DNDNNell5SURBdU1qVTBPREE1SURBdU56TTBOams0VERBdU1qVTNPRGczSURBdU56TTBORGt4U0RBdU16QXpNamcwV2swd0xqYzROekl6TVNBd0xqRTBORGMzTlVNd0xqZ3lNekkwTlNBd0xqRTBORGMzTlNBd0xqZzFNamN5TkNBd0xqRTNNamMxTkNBd0xqZzFOVEV4T0NBd0xqSXdPREUyTVV3d0xqZzFOVEkzTlNBd0xqSXhNamd5VmpBdU5UVXpNRFJETUM0NE5UVXlOelVnTUM0MU9Ea3dOVFFnTUM0NE1qY3lPVGNnTUM0Mk1UZzFNek1nTUM0M09URTRPU0F3TGpZeU1Ea3lPRXd3TGpjNE56SXpNU0F3TGpZeU1UQTRORWd3TGpZME16UTBNMVl3TGpjd05ESTFTREF1TmpneE16QTJRekF1Tmprek9ETXpJREF1TnpBME1qVWdNQzQzTURNNU9EY2dNQzQzTVRRME1EUWdNQzQzTURNNU9EY2dNQzQzTWpZNU16RkRNQzQzTURNNU9EY2dNQzQzTXpnME1UUWdNQzQyT1RVME5UUWdNQzQzTkRjNU1ETWdNQzQyT0RRek9EUWdNQzQzTkRrME1EVk1NQzQyT0RFek1EWWdNQzQzTkRrMk1USklNQzQwTmpJd05UUldNQzQzTURReU5VZ3dMalU1T0RBNE1WWXdMall5TVRBNE5FZ3dMalEyTWpBMU5GWXdMalUzTlRjeU1rZ3dMamM0TnpJek1VTXdMamM1T0RjeE5DQXdMalUzTlRjeU1pQXdMamd3T0RJd05DQXdMalUyTnpFNE9TQXdMamd3T1Rjd05pQXdMalUxTmpFeE9Fd3dMamd3T1RreE15QXdMalUxTXpBMFZqQXVNakV5T0RKRE1DNDRNRGs1TVRNZ01DNHlNREV6TXpjZ01DNDRNREV6T0NBd0xqRTVNVGcwTnlBd0xqYzVNRE13T1NBd0xqRTVNRE0wTlV3d0xqYzROekl6TVNBd0xqRTVNREV6T0Vnd0xqSTRPREUyTkVNd0xqSTNOalk0TVNBd0xqRTVNREV6T0NBd0xqSTJOekU1TVNBd0xqRTVPRFkzTVNBd0xqSTJOVFk0T1NBd0xqSXdPVGMwTWt3d0xqSTJOVFE0TWlBd0xqSXhNamd5VmpBdU16VTJORFk0U0RBdU1qSXdNVEpXTUM0eU1USTRNa013TGpJeU1ERXlJREF1TVRjMk9EQTJJREF1TWpRNE1EazRJREF1TVRRM016STJJREF1TWpnek5UQTFJREF1TVRRME9UTXlUREF1TWpnNE1UWTBJREF1TVRRME56YzFTREF1TnpnM01qTXhXaUlnWTJ4aGMzTTlJbWxqYjI0dFptbHNiQ0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqazRORFl4TlNJZ2FHVnBaMmgwUFNJd0xqazRORFl4TlNJZ1ptbHNiRDBpZDJocGRHVWlJSFJ5WVc1elptOXliVDBpZEhKaGJuTnNZWFJsS0RBZ01DNHdNVFV6T0RBNUtTSXZQaVlqZUdFN1BDOWpiR2x3VUdGMGFENG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RFaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVPRFEyTnpZNUlpQm9aV2xuYUhROUlqQXVPRFEyTnpZNUlpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHdOamc0TkRjM0lEQXVNRGcwTXpVd05pa2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOEwyUmxabk0rSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZVdpZHRoPTE7aXIudGFncz1SZWdpc3Rlcixsb2dpbjtpci5yZWY9ZjVlMzdiNTYtODhmZi00Zjk0LTk3MGMtZGY4MGFlNTdkMGZjOyIgcGFyZW50PSI0NCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIzOC41IiB5PSIyMjIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NiIgdmFsdWU9IlJlZ2lzdGVyLGxvZ2luIiBzdHlsZT0idGV4dDtodG1sPTE7cmVzaXphYmxlPTA7ZWRpdGFibGU9MDtkZWxldGFibGU9MDtjb25uZWN0YWJsZT0wO3BvaW50cz1bXTtpci50eXBlPUNPTVBPTkVOVF9UQUc7YWxpZ249Y2VudGVyO3ZlcnRpY2FsQWxpZ249bWlkZGxlOyIgcGFyZW50PSI0NyIgdmVydGV4PSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMS4zIiB5PSIwLjQ1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjQ1IiB2YWx1ZT0iUHVibGljIENsb3VkIiBzdHlsZT0iaXIucmVmPWI2MWQ2OTExLTMzOGQtNDZhOC05ZjM5LThkY2QyNGFiZmU5MTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTQ0IiB5PSItMyIgd2lkdGg9IjUzNiIgaGVpZ2h0PSIzMzkiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2NCIgdmFsdWU9IkFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9MGZlNDAyMTItMTA5MC00ZjA5LThhNzYtMjBjZjU1ZmM2M2JlO2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC44NTY7ZW50cnlZPTAuOTM5O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTsiIHBhcmVudD0iNDUiIHNvdXJjZT0iNDgiIHRhcmdldD0iNTAiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9IkFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkiIGlkPSI0OCI+CiAgICAgIDxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJkcztpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQRzFoYzJzZ2FXUTlJbTFoYzJzd0lpQnRZWE5yTFhSNWNHVTlJbUZzY0doaElpQnRZWE5yVlc1cGRITTlJblZ6WlhKVGNHRmpaVTl1VlhObElpQjRQU0l3SWlCNVBTSXdJaUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWo0bUkzaGhPenhqYVhKamJHVWdZM2c5SWpBdU5TSWdZM2s5SWpBdU5TSWdjajBpTUM0MUlpQm1hV3hzUFNKaWJHRmpheUl2UGlZamVHRTdQQzl0WVhOclBpWWplR0U3UEdjZ2JXRnphejBpZFhKc0tDTnRZWE5yTUNraVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhjR0YwYUNCa1BTSk5NU0F3U0RCV01VZ3hWakJhSWlCbWFXeHNQU0oxY213b0kzQmhhVzUwTUY5c2FXNWxZWElwSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5EWXdNRE1nTUM0ek56WTBOemxETUM0Mk5EWXdNRE1nTUM0ek16YzRNVE1nTUM0MU56QXhNemNnTUM0ek1UazVORFlnTUM0ME9Ua3pNemNnTUM0ek1UazVORFpETUM0ME1qZzFNemNnTUM0ek1UazVORFlnTUM0ek5USTJOeUF3TGpNek56Z3hNeUF3TGpNMU1qWTNJREF1TXpjMk5EYzVRekF1TXpVeU5qRXlJREF1TXpjNE5ERXpJREF1TXpVeU9ETTNJREF1TXpnd016UTBJREF1TXpVek16TTNJREF1TXpneU1qRXpWakF1TmpJeU9EYzVRekF1TXpVeU5qY2dNQzQyTmpJNE56a2dNQzQwTWpnMk55QXdMalkzT1RrME5TQXdMalV3TURBd015QXdMalkzT1RrME5VTXdMalUzTVRNek55QXdMalkzT1RrME5TQXdMalkwTmpZM0lEQXVOall5TXpRMUlEQXVOalEyTmpjZ01DNDJNak0yTnpsV01DNHpOelkwTnpsSU1DNDJORFl3TUROYVRUQXVORGs1TmpBeklEQXVNelEyTnpRMlF6QXVOVGMzTXpNM0lEQXVNelEyTnpRMklEQXVOakU1TmpBeklEQXVNelkzT1RRMklEQXVOakU1TmpBeklEQXVNemMyTmpFelF6QXVOakU1TmpBeklEQXVNemcxTWpjNUlEQXVOVGMzTmpBeklEQXVOREEyTkRjNUlEQXVORGs1TmpBeklEQXVOREEyTkRjNVF6QXVOREl4TmpBeklEQXVOREEyTkRjNUlEQXVNemM1TmpBeklEQXVNemcxTkRFeklEQXVNemM1TmpBeklEQXVNemMyTmpFelF6QXVNemM1TmpBeklEQXVNelkzT0RFeklEQXVOREl4T0RjZ01DNHpORFkzTkRZZ01DNDBPVGsyTURNZ01DNHpORFkzTkRaYVRUQXVOakU1TmpBeklEQXVOakl6T0RFeVF6QXVOakU1TmpBeklEQXVOak15TXpRMUlEQXVOVGMzTkRjZ01DNDJOVE0wTVRJZ01DNDBPVGsyTURNZ01DNDJOVE0wTVRKRE1DNDBNakUzTXpjZ01DNDJOVE0wTVRJZ01DNHpOemsyTURNZ01DNDJNekl6TkRVZ01DNHpOemsyTURNZ01DNDJNak00TVRKV01DNDFPREUyTnpsRE1DNDBNRGMzTXpjZ01DNDFPVGN3TVRJZ01DNDBOVFE1TXpjZ01DNDJNRFF6TkRVZ01DNDBPVGsyTURNZ01DNDJNRFF6TkRWRE1DNDFORFF5TnlBd0xqWXdORE0wTlNBd0xqVTVNVEEzSURBdU5UazNNVFExSURBdU5qRTVOakF6SURBdU5UZ3lNRGM1VmpBdU5qSXpPREV5V2swd0xqWXhPVFl3TXlBd0xqVTBOemswTmtNd0xqWXhPVFl3TXlBd0xqVTFOalEzT1NBd0xqVTNOell3TXlBd0xqVTNOemd4TWlBd0xqUTVPVFl3TXlBd0xqVTNOemd4TWtNd0xqUXlNVFl3TXlBd0xqVTNOemd4TWlBd0xqTTNPVFl3TXlBd0xqVTFOalEzT1NBd0xqTTNPVFl3TXlBd0xqVTBOemswTmtnd0xqTTRNREF3TTFZd0xqUTVOekF4TWtNd0xqUXdPREV6TnlBd0xqVXhNakl4TWlBd0xqUTFOVE16TnlBd0xqVXhPVFUwTmlBd0xqVXdNREF3TXlBd0xqVXhPVFUwTmtNd0xqVTBORFkzSURBdU5URTVOVFEySURBdU5Ua3hORGNnTUM0MU1USXpORFlnTUM0Mk1qQXdNRE1nTUM0ME9UY3lOemxNTUM0Mk1UazJNRE1nTUM0MU5EYzVORFphVFRBdU5qRTVOakF6SURBdU5EWXpNREV6UXpBdU5qRTVOakF6SURBdU5EY3hOamM1SURBdU5UYzNOakF6SURBdU5Ea3pNREV5SURBdU5EazVOakF6SURBdU5Ea3pNREV5UXpBdU5ESXhOakF6SURBdU5Ea3pNREV5SURBdU16YzVOakF6SURBdU5EY3hOamM1SURBdU16YzVOakF6SURBdU5EWXpNREV6U0RBdU16Z3dNREF6VmpBdU5ERXhNREV6UXpBdU5EQTROREF6SURBdU5ESTJNRGM1SURBdU5EVTFNRGNnTUM0ME16TXdNVE1nTUM0MU1EQXdNRE1nTUM0ME16TXdNVE5ETUM0MU5EUTVNemNnTUM0ME16TXdNVE1nTUM0MU9USXhNemNnTUM0ME1qVTRNVE1nTUM0Mk1qQXdNRE1nTUM0ME1UQTBOemxNTUM0Mk1UazJNRE1nTUM0ME5qTXdNVE5hSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVNakV5TURreklEQXVPREEyT0Vnd0xqSTVPVGsxT1ZZd0xqZ3pNelEyTmtnd0xqRTNPVGsxT1VNd0xqRTNOalF5TXlBd0xqZ3pNelEyTmlBd0xqRTNNekF6TWlBd0xqZ3pNakEyTVNBd0xqRTNNRFV6TVNBd0xqZ3lPVFUyTVVNd0xqRTJPREF6TVNBd0xqZ3lOekEyTVNBd0xqRTJOall5TmlBd0xqZ3lNelkyT1NBd0xqRTJOall5TmlBd0xqZ3lNREV6TTFZd0xqY3dNREV6TTBnd0xqRTVNekk1TTFZd0xqYzROemN6TTB3d0xqSTVNekk1TXlBd0xqWTROemcyTmt3d0xqTXhNVGsxT1NBd0xqY3dOalkyTmt3d0xqSXhNakE1TXlBd0xqZ3dOamhhSWlCbWFXeHNQU0ozYUdsMFpTSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVPRE16TXpNeElEQXVOekF3TVRNeFZqQXVPREl3TVRNeFF6QXVPRE16TXpNeElEQXVPREl6TmpZM0lEQXVPRE14T1RJMklEQXVPREkzTURVNUlEQXVPREk1TkRJMklEQXVPREk1TlRVNVF6QXVPREkyT1RJMUlEQXVPRE15TURZZ01DNDRNak0xTXpRZ01DNDRNek0wTmpRZ01DNDRNVGs1T1RnZ01DNDRNek0wTmpSSU1DNDJPVGs1T1RoV01DNDRNRFkzT1RoSU1DNDNPRGM0TmpSTU1DNDJPRGt6TXpFZ01DNDNNRGM1T1RoTU1DNDNNRGd4TXpFZ01DNDJPRGt6TXpGTU1DNDRNRFkyTmpRZ01DNDNPRGMzTXpGV01DNDNNREF4TXpGSU1DNDRNek16TXpGYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1T0RNek16TXhJREF1TVRnd01qQTBWakF1TXpBd01qQTBTREF1T0RBMk5qWTBWakF1TWpFeU1qQTBUREF1TnpBNE1UTXhJREF1TXpFd056TTRUREF1TmpnNU16TXhJREF1TWpreE9UTTRUREF1TnpnM056TXhJREF1TVRrek5UTTNTREF1TmprNU9UazRWakF1TVRZMk9EZElNQzQ0TVRrNU9UaERNQzQ0TWpNMU16UWdNQzR4TmpZNE55QXdMamd5TmpreU5TQXdMakUyT0RJM05TQXdMamd5T1RReU5pQXdMakUzTURjM05VTXdMamd6TVRreU5pQXdMakUzTXpJM05pQXdMamd6TXpNek1TQXdMakUzTmpZMk55QXdMamd6TXpNek1TQXdMakU0TURJd05Gb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0ek1URTVOVGtnTUM0eU9UTXpNRFJNTUM0eU9UTXlPVE1nTUM0ek1URTVOekZNTUM0eE9UTXlPVE1nTUM0eU1USXhNRFJXTUM0eU9UazRNemRJTUM0eE5qWTJNalpXTUM0eE56azRNemRETUM0eE5qWTJNallnTUM0eE56WXpNREVnTUM0eE5qZ3dNekVnTUM0eE56STVNU0F3TGpFM01EVXpNU0F3TGpFM01EUXdPVU13TGpFM016QXpNaUF3TGpFMk56a3dPU0F3TGpFM05qUXlNeUF3TGpFMk5qVXdOQ0F3TGpFM09UazFPU0F3TGpFMk5qVXdORWd3TGpJNU9UazFPVll3TGpFNU16RTNNVWd3TGpJeE1qQTVNMHd3TGpNeE1UazFPU0F3TGpJNU16TXdORm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlPVFUwT1RFZ01DNDJNVGsxTURORE1DNHlNVFF3TWpVZ01DNDFPVEF4TnlBd0xqRTJOek0xT0NBd0xqVTBOVE0yT1NBd0xqRTJOek0xT0NBd0xqUTVOamN3TWtNd0xqRTJOek0xT0NBd0xqUTBPREF6TlNBd0xqSXhOREF5TlNBd0xqUXdNek0yT0NBd0xqSTVOVFE1TVNBd0xqTTNNemt3TVV3d0xqTXdORFUxTnlBd0xqTTVPRGsyT0VNd0xqSXpOVE0xT0NBd0xqUXlNemt3TWlBd0xqRTVOREF5TlNBd0xqUTJNRFF6TlNBd0xqRTVOREF5TlNBd0xqUTVOamN3TWtNd0xqRTVOREF5TlNBd0xqVXpNamsyT1NBd0xqSXpOVE0xT0NBd0xqVTJPVFV3TXlBd0xqTXdORFUxTnlBd0xqVTVORFF6TjB3d0xqSTVOVFE1TVNBd0xqWXhPVFV3TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQyT1RjeE16SWdNQzQyTWpJME5Fd3dMalk0T0RVNU9TQXdMalU1TnpFd04wTXdMamMyTWpVNU9TQXdMalUzTWpFM015QXdMamd3Tmpjek1pQXdMalV6TkRVM015QXdMamd3Tmpjek1pQXdMalE1Tmpjd05rTXdMamd3Tmpjek1pQXdMalExT0Rnek9TQXdMamMyTWpVNU9TQXdMalF5TVRJek9TQXdMalk0T0RVNU9TQXdMak01TmpFM01rd3dMalk1TnpFek1pQXdMak0zTURrM01rTXdMamM0TXpZMk5TQXdMalF3TURBek9TQXdMamd6TXpNNU9TQXdMalEwTmpFM01pQXdMamd6TXpNNU9TQXdMalE1Tmpjd05rTXdMamd6TXpNNU9TQXdMalUwTnpJMElEQXVOemd6TmpZMUlEQXVOVGt6TVRBM0lEQXVOamszTVRNeUlEQXVOakl5TkRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTNJaUI0TWowaU1TNHlNRGN5SWlCNU1qMGlMVEF1TWpBM01pSWdaM0poWkdsbGJuUlZibWwwY3owaWRYTmxjbE53WVdObFQyNVZjMlVpUGlZamVHRTdQSE4wYjNBZ2MzUnZjQzFqYjJ4dmNqMGlJekpGTWpkQlJDSXZQaVlqZUdFN1BITjBiM0FnYjJabWMyVjBQU0l4SWlCemRHOXdMV052Ykc5eVBTSWpOVEkzUmtaR0lpOCtKaU40WVRzOEwyeHBibVZoY2tkeVlXUnBaVzUwUGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9TG9naW4gQ3JlZGVudGlhbHMsVXNlcnMscGVyc29uYWxseSBpZGVudGlmaWFibGUgaW5mb3JtYXRpb247aXIucmVmPWM1MTJjN2UxLThmYWMtNDQxZS04NTA3LTE4ZGM3NDA5YTYzZDsiIHBhcmVudD0iNDUiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgICAgPG14R2VvbWV0cnkgeD0iNDM3IiB5PSI2IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNTMiIHZhbHVlPSJMb2dpbiBDcmVkZW50aWFscyxVc2VycyxwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBpbmZvcm1hdGlvbiIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDgiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2NiIgdmFsdWU9Ik1vbmdvREIgTm9TUUwgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj03NGUyOWRiZS1jYmFjLTRlYzAtYjhlZS1kN2U4Yzk4ODUxMzA7aXIudGFncz1xdWVyeSByZXN1bHRzLHBheW1lbnQgcmVzcG9uc2UscmVzcG9uc2U7IiBwYXJlbnQ9IjQ1IiBzb3VyY2U9IjQ5IiB0YXJnZXQ9IjUwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMjcwIiB5PSIyMTgiLz4KICAgICAgICA8L0FycmF5PgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9Ik1vbmdvREIgTm9TUUwiIGlkPSI0OSI+CiAgICAgIDxteENlbGwgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW1vbmdvZGItbm9zcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGd3TnpoRE1DNDRNemsyTmpnZ01DNHpOREE0T1RnZ01DNDJPRGMwTXpNZ01DNDBNVFl3TnpnZ01DNDBPVGsyTmpnZ01DNDBNVFl3TnpoRE1DNHpNVEU1TURNZ01DNDBNVFl3TnpnZ01DNHhOVGsyTmpnZ01DNHpOREE0T1RnZ01DNHhOVGsyTmpnZ01DNHlORGd3TnpoRE1DNHhOVGsyTmpnZ01DNHhOVFV5TlRnZ01DNHpNVEU1TURNZ01DNHdPREF3TnpneElEQXVORGs1TmpZNElEQXVNRGd3TURjNE1VTXdMalk0TnpRek15QXdMakE0TURBM09ERWdNQzQ0TXprMk5qZ2dNQzR4TlRVeU5UZ2dNQzQ0TXprMk5qZ2dNQzR5TkRnd056aGFUVEF1T0RNNU5qWTRJREF1TXpjMk16QTBRekF1T0RFNE1UZzJJREF1TXprME9UYzVJREF1TnprME1qa3hJREF1TkRFd056VTFJREF1TnpZNE5qQTRJREF1TkRJek1qRTRRekF1TmprMk5EUXpJREF1TkRVNE9ETTBJREF1TmpBeE16STRJREF1TkRjNU1EYzRJREF1TkRrNU5qWTRJREF1TkRjNU1EYzRRekF1TXprNE1EQTRJREF1TkRjNU1EYzRJREF1TXpBeU9Ea3pJREF1TkRVNE9ETTBJREF1TWpNd056STRJREF1TkRJek1qRTRRekF1TWpBMU1EUTJJREF1TkRFd056VTFJREF1TVRneE1UVWdNQzR6T1RRNU56a2dNQzR4TlRrMk5qZ2dNQzR6TnpZek1EUldNQzQzTlRJd056aERNQzR4TlRrMk5qZ2dNQzQ0TkRRNE9UZ2dNQzR6TVRFNU1ETWdNQzQ1TWpBd056Z2dNQzQwT1RrMk5qZ2dNQzQ1TWpBd056aERNQzQyT0RjME16TWdNQzQ1TWpBd056Z2dNQzQ0TXprMk5qZ2dNQzQ0TkRRNE9UZ2dNQzQ0TXprMk5qZ2dNQzQzTlRJd056aFdNQzR6TnpZek1EUmFUVEF1TlRBeE5EQXlJREF1TlRNeE1qRTJRekF1TlRBeE1EZzVJREF1TlRNd09Ea2dNQzQxTURBM056Y2dNQzQxTXpBMU5qUWdNQzQxTURBME5qVWdNQzQxTXpFeE9EaE1NQzQxTURBME5qSWdNQzQxTXpFM05ERk1NQzQwT1RFMk56Z2dNQzQxTkRneU16ZERNQzQwT0RrM01ETWdNQzQxTlRFeU9ESWdNQzQwT0RjMU5qTWdNQzQxTlRNNU56Z2dNQzQwT0RVd05ETWdNQzQxTlRZME9EbERNQzQwTnpjMk5USWdNQzQxTmpNM09EY2dNQzQwTnpBM05qTWdNQzQxTnpFMU56WWdNQzQwTmpRME1qTWdNQzQxTnprNE1EUkRNQzQwTkRrMU16UWdNQzQxT1Rrek5UTWdNQzQwTXprME9UTWdNQzQyTWpFd05qTWdNQzQwTXpJek1qSWdNQzQyTkRRMU5ESkRNQzQwTWpnd01pQXdMalkxT0RnNE5TQXdMalF5TlRZNE5TQXdMalkzTXpVNU9TQXdMalF5TlRVeElEQXVOamc0TkRjM1F6QXVOREkwTnpnNUlEQXVOek15T1RVMklEQXVORFF3TURNNElEQXVOemN4TVRRNUlEQXVORGN3TnpneElEQXVPREF5T0RreFF6QXVORGMxTnpneUlEQXVPREEzT1RJMUlEQXVORGd4TVRnMUlEQXVPREV5TlRReklEQXVORGcyT1RNMklEQXVPREUyTmprNVREQXVORGczTVRrMklEQXVPREUyTmprelF6QXVORGc1TXpRMUlEQXVPREl3TURrM0lEQXVORGt4TXpFNUlEQXVPREl6TlRFeUlEQXVORGt4TmpjNUlEQXVPREkzTmpJMlREQXVORGt4TmpnNUlEQXVPREkzTmpNMlREQXVORGt4T0RrZ01DNDRNamt3TmpkRE1DNDBPVEl5TVRVZ01DNDRNekV6TXpRZ01DNDBPVEkxTlRRZ01DNDRNek0yT1RjZ01DNDBPVEkwTVNBd0xqZ3pOakEzTkZZd0xqZzFNalUzTjB3d0xqUTVNVGczTlNBd0xqZzFPRFE1TTBNd0xqUTVNVGczTlNBd0xqZzFPVEl4TkNBd0xqUTVNakEwT1NBd0xqZzJNREV3T1NBd0xqUTVNekV6SURBdU9EWXdNVEE1UXpBdU5EazBNVFFnTUM0NE5Ua3pOVGtnTUM0ME9UVXlNekVnTUM0NE5Ua3dORE1nTUM0ME9UWXlPRGtnTUM0NE5UZzNNemRNTUM0ME9UYzJNVFlnTUM0NE5UZ3pNVGxETUM0ME9UazBNRFlnTUM0NE5UYzFPVFlnTUM0MU1EQXlOVFVnTUM0NE5UYzBOalFnTUM0MU1EQTJOVFlnTUM0NE5UWTVOamxETUM0MU1ERXdNVGNnTUM0NE5UWTFNalFnTUM0MU1ERXdNVFVnTUM0NE5UVTNPRFVnTUM0MU1ERXdNVEVnTUM0NE5UUXdOakZXTUM0NE5UTTBPRE5XTUM0NE5EazRPREZETUM0MU1ERTFOVFlnTUM0NE5EQXdNVFFnTUM0MU1ESTBOREVnTUM0NE16QXpNeklnTUM0MU1EVTJOeklnTUM0NE1qQTRNalZNTUM0MU1EVTRORGNnTUM0NE1UazNOVFZETUM0MU1URTBNRE1nTUM0NE1UVTBORFFnTUM0MU1UWTNOelFnTUM0NE1UQTVOVGdnTUM0MU1qRTNPVFVnTUM0NE1EWXhNakpETUM0MU5ESXlNemtnTUM0M09EWXdNemdnTUM0MU5UZ3dNaklnTUM0M05qSTRPVGdnTUM0MU5qWTRNU0F3TGpjek5USTRNa013TGpVM01EQXpJREF1TnpJME9EZ2dNQzQxTnpReE5UWWdNQzQyT0RnNE1qY2dNQzQxTnpNeU5pQXdMalkzT0RZeFF6QXVOVGN4TXpBMUlEQXVOalV3TWpnMElEQXVOVFkwTkRFeUlEQXVOakl6TXpjNElEQXVOVFV4TURNMklEQXVOVGs0TWpjelF6QXVOVFF3T1RnMElEQXVOVGM1TmpFNUlEQXVOVEk0TkRNeElEQXVOVFl5T1RRZ01DNDFNVEkwT0RRZ01DNDFORGt4TXpKTU1DNDFNVEUxTWpFZ01DNDFORGd5T1RWRE1DNDFNRGc1T0RJZ01DNDFORFl3T1NBd0xqVXdOalV4TVNBd0xqVTBNemswTlNBd0xqVXdORFU1TWlBd0xqVTBNVEkwTVVNd0xqVXdNall5TmlBd0xqVXpPREUzTkNBd0xqVXdNVE0zTVNBd0xqVXpORGsyTkNBd0xqVXdNVFUwTmlBd0xqVXpNVE0yTTB3d0xqVXdNVFF3TWlBd0xqVXpNVEl4TmxwTk1DNDBPVFUzTVRZZ01DNDFOekV3TXpWTU1DNDBPVFUzTnpFZ01DNDFOVEV3TVRORE1DNDBPVE0yTkRJZ01DNDFOVFF5T0RZZ01DNDBPVEV6TURJZ01DNDFOVGN5TXpNZ01DNDBPRGcxTXpFZ01DNDFOVGs1T1RKTU1DNDBPRGcxTVRjZ01DNDFOakF3TURkRE1DNDBPREV5T0RnZ01DNDFOamN4TkRVZ01DNDBOelExTlNBd0xqVTNORGMyTkNBd0xqUTJPRE0wT1NBd0xqVTRNamd4TVVNd0xqUTFNemc1T0NBd0xqWXdNVGM0TnlBd0xqUTBOREE1TkNBd0xqWXlNamt5T1NBd0xqUXpOekExTkNBd0xqWTBOVGszTmtNd0xqUXpNamc0TVNBd0xqWTFPVGc1TXlBd0xqUXpNRFl5TXlBd0xqWTNOREUwTkNBd0xqUXpNRFExTkNBd0xqWTRPRFV6TlZZd0xqWTRPRFUxTjBNd0xqUXlPVGMxTlNBd0xqY3pNVGN3T0NBd0xqUTBORFE1SURBdU56WTROakk1SURBdU5EYzBNekV5SURBdU56azVOREk0UXpBdU5EYzRORFl5SURBdU9EQXpOakEwSURBdU5EZ3lPVEF4SURBdU9EQTNORGd6SURBdU5EZzNOVGt6SURBdU9ERXhNRE0xVERBdU5EZzNOakEySURBdU9ERXhNREUyVERBdU5EZzRNemszSURBdU9EQTVOek0zUXpBdU5Ea3dNemN4SURBdU9EQTJNamc0SURBdU5Ea3hOamcySURBdU9EQXlOVEF4SURBdU5Ea3lNamN5SURBdU56azROVGRNTUM0ME9USXlPU0F3TGpjNU9EUTBPRXd3TGpRNU1qTXhOU0F3TGpjNU9ETXlOME13TGpRNU16TTFOaUF3TGpjNU16RTBNU0F3TGpRNU16azNPU0F3TGpjNE9ESXpOaUF3TGpRNU16WTJPU0F3TGpjNE16STVNMHd3TGpRNU16WTFPU0F3TGpjNE16RXpOMVl3TGpjM09UTTROVXd3TGpRNU16WTVOeUF3TGpjM09UTXdNVXd3TGpRNU16Y3pNaUF3TGpjM056VXhOVXd3TGpRNU16ZzFOQ0F3TGpjMk9UWXhNMHd3TGpRNU5ESXdOU0F3TGpjME1UVXdNVXd3TGpRNU5UQTROQ0F3TGpZMU5qTXpNVXd3TGpRNU5UY3hOaUF3TGpVM01UQXpOVm9pSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXhJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEM5amJHbHdVR0YwYUQ0bUkzaGhPend2WkdWbWN6NG1JM2hoT3p3dmMzWm5QZz09O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7c3Ryb2tlV2lkdGg9MTtpci50YWdzPVBheW1lbnRzO2lyLnJlZj04MDdlYjhmYS0yZjM2LTQwYzItODliYS03NmU5NTJkYzNmMTQ7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjQyOCIgeT0iMjE0IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNTQiIHZhbHVlPSJQYXltZW50cyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNDkiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2MiIgdmFsdWU9IldlYiBBcHBsaWNhdGlvbiAtIFNlcnZlciBzaWRlIC0mZ3Q7IEFXUyBSRFMgKFJlbGF0aW9uYWwgRGF0YWJhc2UgU2VydmljZSkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9MjZhNGJmMGQtM2RkOC00ZGUzLWJjMDctN2U4NzExYjcwYmVlO2lyLnRhZ3M9cmVzcG9uc2Usb3JkZXIgc3RhdHVzOyIgcGFyZW50PSI0NSIgc291cmNlPSI1MCIgdGFyZ2V0PSI0OCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNjUiIHZhbHVlPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSAtJmd0OyBNb25nb0RCIE5vU1FMIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj03MDE4YzBhYS04OTUzLTRhMjQtODRkZi0xMDE5Zjg5NDhjMDQ7aXIudGFncz1QYXltZW50cztpci5hc3NldHM9Q3JlZGl0IENhcmQgRGF0YTsiIHBhcmVudD0iNDUiIHNvdXJjZT0iNTAiIHRhcmdldD0iNDkiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjY3IiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MDtlbnRyeVk9MC4yNTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O2lyLnJlZj0yNjNkZGE4Ny1iMDRiLTRmMjktODg3Mi1mNjVkODg5NGI1M2E7aXIudGFncz1xdWVyeSBmcm9udCBlbmQgZmlsZXM7IiBwYXJlbnQ9IjQ1IiBzb3VyY2U9IjUwIiB0YXJnZXQ9IjUxIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSIgaWQ9IjUwIj4KICAgICAgPG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLWFwcGxpY2F0aW9uLXNlcnZlci1zaWRlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1ptbHNiQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmpiR2x3TFhKMWJHVTlJbVYyWlc1dlpHUWlJR1E5SWswd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVVNd0xqTTJOVGcxTXlBd0xqSTRNamM0TWlBd0xqTTNPRGN5TlNBd0xqSTJPVGt4TVNBd0xqTTVORFl3TXlBd0xqSTJPVGt4TVVnd0xqWXdOVFF6TmtNd0xqWXlNVE14TkNBd0xqSTJPVGt4TVNBd0xqWXpOREU0TmlBd0xqSTRNamM0TWlBd0xqWXpOREU0TmlBd0xqSTVPRFkyTVVNd0xqWXpOREU0TmlBd0xqTXhORFV6T1NBd0xqWXlNVE14TkNBd0xqTXlOelF4TVNBd0xqWXdOVFF6TmlBd0xqTXlOelF4TVVnd0xqTTVORFl3TTBNd0xqTTNPRGN5TlNBd0xqTXlOelF4TVNBd0xqTTJOVGcxTXlBd0xqTXhORFV6T1NBd0xqTTJOVGcxTXlBd0xqSTVPRFkyTVZwTk1DNHpPVFEyTURNZ01DNDJPVEUxTnpoRE1DNHpOemczTWpVZ01DNDJPVEUxTnpnZ01DNHpOalU0TlRNZ01DNDNNRFEwTlNBd0xqTTJOVGcxTXlBd0xqY3lNRE15T0VNd0xqTTJOVGcxTXlBd0xqY3pOakl3TmlBd0xqTTNPRGN5TlNBd0xqYzBPVEEzT0NBd0xqTTVORFl3TXlBd0xqYzBPVEEzT0Vnd0xqVTFNREF4T1ZZd0xqWTVNVFUzT0Vnd0xqTTVORFl3TTFwTk1DNDJNakF6TlRFZ01DNDJNams1TVRGSU1DNDJNRFExTmpWRE1DNDFPVGN4TkRRZ01DNDJNams1TVRFZ01DNDFPVEF3TmpnZ01DNDJNekV6T1RNZ01DNDFPRE0yTVRrZ01DNDJNelF3TnpoSU1DNHpPVFEyTURORE1DNHpOemczTWpVZ01DNDJNelF3TnpnZ01DNHpOalU0TlRNZ01DNDJNakV5TURZZ01DNHpOalU0TlRNZ01DNDJNRFV6TWpoRE1DNHpOalU0TlRNZ01DNDFPRGswTkRrZ01DNHpOemczTWpVZ01DNDFOelkxTnpnZ01DNHpPVFEyTURNZ01DNDFOelkxTnpoSU1DNDJNRFUwTXpaRE1DNDJNakV6TVRRZ01DNDFOelkxTnpnZ01DNDJNelF4T0RZZ01DNDFPRGswTkRrZ01DNDJNelF4T0RZZ01DNDJNRFV6TWpoRE1DNDJNelF4T0RZZ01DNDJNVFUzTkRVZ01DNDJNamcyTkRZZ01DNDJNalE0TmpnZ01DNDJNakF6TlRFZ01DNDJNams1TVRGYVRUQXVOamN5TlRFNUlEQXVOakk1T1RFeFZqQXVNak14TlRjM1F6QXVOamN5TlRFNUlEQXVNVGs1T0RJeElEQXVOalEyTnpjMklEQXVNVGMwTURjM0lEQXVOakUxTURFNUlEQXVNVGMwTURjM1NEQXVNemcxTURKRE1DNHpOVE15TmpNZ01DNHhOelF3TnpjZ01DNHpNamMxTWlBd0xqRTVPVGd5TVNBd0xqTXlOelV5SURBdU1qTXhOVGMzVmpBdU56WTRNalExUXpBdU16STNOVElnTUM0NE1EQXdNREVnTUM0ek5UTXlOak1nTUM0NE1qVTNORFVnTUM0ek9EVXdNaUF3TGpneU5UYzBOVWd3TGpVMU1EQXhPVll3TGpnM05UTTJOa013TGpVMU1EQXhPU0F3TGpnM09EQTBNaUF3TGpVMU1ESXhNaUF3TGpnNE1EWTNNaUF3TGpVMU1EVTROQ0F3TGpnNE16STBOVWd3TGpNNE5UQXlRekF1TXpJeE5UQTNJREF1T0Rnek1qUTFJREF1TWpjd01ESWdNQzQ0TXpFM05UY2dNQzR5TnpBd01pQXdMamMyT0RJME5WWXdMakl6TVRVM04wTXdMakkzTURBeUlEQXVNVFk0TURZMElEQXVNekl4TlRBM0lEQXVNVEUyTlRjM0lEQXVNemcxTURJZ01DNHhNVFkxTnpkSU1DNDJNVFV3TVRsRE1DNDJOemcxTXpJZ01DNHhNVFkxTnpjZ01DNDNNekF3TVRrZ01DNHhOamd3TmpRZ01DNDNNekF3TVRrZ01DNHlNekUxTnpkV01DNDJNams1TVRGSU1DNDJOekkxTVRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOemMxTWpRZ01DNDJOakkzTWt3d0xqYzNPVGsxT1NBd0xqWTJNamM0T0VNd0xqZ3dNVGN6TmlBd0xqWTJOREF3TlNBd0xqZ3hPVEUyT0NBd0xqWTRNVFF6TnlBd0xqZ3lNRE00TmlBd0xqY3dNekU1T0V3d0xqZ3lNRFExTXlBd0xqY3dOVFl6TTFZd0xqZzFOelE0TWt3d0xqZ3lNRE00TmlBd0xqZzFPVGt4TjBNd0xqZ3hPVEUyT0NBd0xqZzRNVFkzT0NBd0xqZ3dNVGN6TnlBd0xqZzVPVEV4SURBdU56YzVPVGMxSURBdU9UQXdNekk0VERBdU56YzNOVFFnTUM0NU1EQXpPVFpJTUM0Mk1qVTJOemRETUM0Mk1ESTNPVFFnTUM0NU1EQXpPVFlnTUM0MU9EUXdPVFFnTUM0NE9ESTBPRFFnTUM0MU9ESTRNeklnTUM0NE5UazVNVGRNTUM0MU9ESTNOalFnTUM0NE5UYzBPREpXTUM0M01EVTJNek5ETUM0MU9ESTNOalFnTUM0Mk9ESTNOU0F3TGpZd01EWTNOQ0F3TGpZMk5EQTFJREF1TmpJek1qUXlJREF1TmpZeU56ZzRUREF1TmpJMU5qYzNJREF1TmpZeU56SklNQzQzTnpjMU1qUmFUVEF1TnprME1ESTVJREF1TnpJNE56UXhTREF1TmpBNU1UZzRUREF1TmpBNU1UY3lJREF1T0RVM05EZ3lRekF1TmpBNU1UY3lJREF1T0RZMk1ESTRJREF1TmpFMU5qWTNJREF1T0Rjek1EVTJJREF1TmpJek9UZzVJREF1T0Rjek9UQXhUREF1TmpJMU5qYzNJREF1T0Rjek9UZzNTREF1TnpjM05UUk1NQzQzTnpreU1qZ2dNQzQ0TnpNNU1ERkRNQzQzT0RZNU9UWWdNQzQ0TnpNeE1UTWdNQzQzT1RNeE56RWdNQzQ0TmpZNU16Y2dNQzQzT1RNNU5pQXdMamcxT1RFM1REQXVOemswTURRMUlEQXVPRFUzTkRneVREQXVOemswTURJNUlEQXVOekk0TnpReFdrMHdMalkzT0RRNU15QXdMamMwT0RVME4wTXdMalk0TXpVd055QXdMamMwT0RVME55QXdMalk0TnpZMUlEQXVOelV5TWpjeklEQXVOamc0TXpBMklEQXVOelUzTVRBM1REQXVOamc0TXprM0lEQXVOelU0TkRWV01DNDROVEE0T0VNd0xqWTRPRE01TnlBd0xqZzFOVGc1TXlBd0xqWTRORFkzTVNBd0xqZzJNREF6TnlBd0xqWTNPVGd6TnlBd0xqZzJNRFk1TTB3d0xqWTNPRFE1TXlBd0xqZzJNRGM0TTBnd0xqWXpNakkzT1VNd0xqWXlOekkyTmlBd0xqZzJNRGM0TXlBd0xqWXlNekV5TWlBd0xqZzFOekExTnlBd0xqWXlNalEyTmlBd0xqZzFNakl5TkV3d0xqWXlNak0zTmlBd0xqZzFNRGc0VmpBdU56VTRORFZETUM0Mk1qSXpOellnTUM0M05UTTBNemNnTUM0Mk1qWXhNRElnTUM0M05Ea3lPVE1nTUM0Mk16QTVNelVnTUM0M05EZzJNemhNTUM0Mk16SXlOemtnTUM0M05EZzFORGRJTUM0Mk56ZzBPVE5hVFRBdU5qWTROVGtnTUM0M05qZ3pOVFJJTUM0Mk5ESXhPREpXTUM0NE5EQTVOemRJTUM0Mk5qZzFPVll3TGpjMk9ETTFORnBOTUM0M05UYzNNVGdnTUM0M09EZ3hPVGxETUM0M05qTXhPRGNnTUM0M09EZ3hPVGtnTUM0M05qYzJNakVnTUM0M09USTJNek1nTUM0M05qYzJNakVnTUM0M09UZ3hNRE5ETUM0M05qYzJNakVnTUM0NE1ETXhNVFlnTUM0M05qTTRPVFlnTUM0NE1EY3lOaUF3TGpjMU9UQTJNaUF3TGpnd056a3hOVXd3TGpjMU56Y3hPQ0F3TGpnd09EQXdOa2d3TGpjeE1UVTJNa013TGpjd05qQTVNeUF3TGpnd09EQXdOaUF3TGpjd01UWTFPU0F3TGpnd016VTNNaUF3TGpjd01UWTFPU0F3TGpjNU9ERXdNME13TGpjd01UWTFPU0F3TGpjNU16QTRPU0F3TGpjd05UTTROQ0F3TGpjNE9EazBOaUF3TGpjeE1ESXhPQ0F3TGpjNE9ESTVUREF1TnpFeE5UWXlJREF1TnpnNE1UazVTREF1TnpVM056RTRXazB3TGpjM01Ea3lNaUF3TGpjME9EVTBOME13TGpjM05qTTVNaUF3TGpjME9EVTBOeUF3TGpjNE1EZ3lOU0F3TGpjMU1qazRNU0F3TGpjNE1EZ3lOU0F3TGpjMU9EUTFRekF1Tnpnd09ESTFJREF1TnpZek5EWTBJREF1TnpjM01TQXdMamMyTnpZd055QXdMamMzTWpJMk5pQXdMamMyT0RJMk0wd3dMamMzTURreU1pQXdMamMyT0RNMU5FZ3dMamN4TVRVMk1rTXdMamN3TmpBNU15QXdMamMyT0RNMU5DQXdMamN3TVRZMU9TQXdMamMyTXpreUlEQXVOekF4TmpVNUlEQXVOelU0TkRWRE1DNDNNREUyTlRrZ01DNDNOVE0wTXpjZ01DNDNNRFV6T0RRZ01DNDNORGt5T1RNZ01DNDNNVEF5TVRnZ01DNDNORGcyTXpoTU1DNDNNVEUxTmpJZ01DNDNORGcxTkRkSU1DNDNOekE1TWpKYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwyYytKaU40WVRzOEwyYytKaU40WVRzOFpHVm1jejRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakVpSUdobGFXZG9kRDBpTVNJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMamt5SWlCb1pXbG5hSFE5SWpBdU9USWlJR1pwYkd3OUluZG9hWFJsSWlCMGNtRnVjMlp2Y20wOUluUnlZVzV6YkdGMFpTZ3dMakEwTURBek9URWdNQzR3TkRBd016a3hLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9ZXhwcmVzc2pzO2lyLnJlZj00MjE2MzdkMy1hYTNjLTQwNjItOGJjMi1kMmM5YTE1YzQwZGQ7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjEwNSIgeT0iMTYiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1MiIgdmFsdWU9ImV4cHJlc3NqcyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNTAiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2OCIgdmFsdWU9IkFXUyBTMyAoU2ltcGxlIFN0b3JhZ2UgU2VydmljZSkgLSZndDsgV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUiIHN0eWxlPSJpci5yZWY9MmU5ZGJkNWYtZTlhNy00NDQ0LTg2ODUtYmU5ZGRiY2IxYjg1O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05OyIgcGFyZW50PSI0NSIgc291cmNlPSI1MSIgdGFyZ2V0PSI1MCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQVdTIFMzIChTaW1wbGUgU3RvcmFnZSBTZXJ2aWNlKSIgaWQ9IjUxIj4KICAgICAgPG14Q2VsbCBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9czM7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dJaUJ0WVhOckxYUjVjR1U5SW1Gc2NHaGhJaUJ0WVhOclZXNXBkSE05SW5WelpYSlRjR0ZqWlU5dVZYTmxJaUI0UFNJd0lpQjVQU0l3SWlCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElqNG1JM2hoT3p4amFYSmpiR1VnWTNnOUlqQXVOU0lnWTNrOUlqQXVOU0lnY2owaU1DNDFJaUJtYVd4c1BTSmliR0ZqYXlJdlBpWWplR0U3UEM5dFlYTnJQaVlqZUdFN1BHY2diV0Z6YXowaWRYSnNLQ050WVhOck1Da2lQaVlqZUdFN1BHY2dZMnhwY0Mxd1lYUm9QU0oxY213b0kyTnNhWEF3S1NJK0ppTjRZVHM4Y0dGMGFDQmtQU0pOTVNBd1NEQldNQzQ1T1RrNU9UVklNVll3V2lJZ1ptbHNiRDBpZFhKc0tDTndZV2x1ZERCZmJHbHVaV0Z5S1NJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9ERTVNRFV4SURBdU5UTTBNVGc0UXpBdU9ERTFNVGcwSURBdU5URXpNalUxSURBdU56a3hORFV4SURBdU5EazRORFUxSURBdU56YzFNVGcwSURBdU5EZzNPVEl5UXpBdU56WTVPVGcwSURBdU5EZzBOVGc1SURBdU56VTFOekU0SURBdU5EYzVNalUxSURBdU56VTBOVEU0SURBdU5EYzBOVGc1UXpBdU56VTBORE0ySURBdU5EY3hNalVnTUM0M05UUTRPRFlnTUM0ME5qYzVNVGtnTUM0M05UVTROVEVnTUM0ME5qUTNNakpNTUM0M05qa3hPRFFnTUM0ek5qZzROVFpETUM0M056TXdOVEVnTUM0ek5EQTNNaklnTUM0M056WTNPRFFnTUM0ek1USTFPRGtnTUM0M09EQTJOVEVnTUM0eU9EUTBOVFpETUM0M09EUXhNVGdnTUM0eU5UZzFPRGtnTUM0M056RTNNVGdnTUM0eU5ERXlOVFlnTUM0M05UQTJOVEVnTUM0eU1qWTNNak5ETUM0M01EYzNNVGdnTUM0eE9UWTVPRGtnTUM0Mk5URTNNVGdnTUM0eE9EUTVPU0F3TGpZd01URTROQ0F3TGpFM05qY3lNME13TGpVek56Z3hNU0F3TGpFMk5qTTNOaUF3TGpRM016TTJOU0F3TGpFMk5ESTNJREF1TkRBNU5EVXhJREF1TVRjd05EVTJRekF1TXpVeE9UWTJJREF1TVRjME5qYzBJREF1TWprMU5UUTJJREF1TVRnNE1UZ3pJREF1TWpReU16ZzBJREF1TWpFd05EVTJRekF1TWpFek9EVXhJREF1TWpJek56ZzVJREF1TVRjMk5URTRJREF1TWpRME5UZzVJREF1TVRneE1UZzBJREF1TWpnd09UZzVRekF1TVRrME5URTRJREF1TXpnNU1qVTJJREF1TWpFd01qVXhJREF1TkRrM01qVTFJREF1TWpJME56ZzBJREF1TmpBMU16ZzRRekF1TWpNeE5EVXhJREF1TmpVME9EVTFJREF1TWpNNE1URTRJREF1TnpBME16SXhJREF1TWpRME56ZzBJREF1TnpVek56ZzRRekF1TWpRMU9EWWdNQzQzTmpNME1pQXdMakkwT1RRMklEQXVOemN5TlRrNElEQXVNalUxTWpFNUlEQXVOemd3TXprMFF6QXVNall3T1RjNElEQXVOemc0TVRrZ01DNHlOamcyT1RNZ01DNDNPVFF6TWpnZ01DNHlOemMxT0RRZ01DNDNPVGd4T0RoRE1DNHpNVGc1TVRnZ01DNDRNakExT0RnZ01DNHpOekF4TVRnZ01DNDRNalk1T0RnZ01DNDBNVFl5TlRFZ01DNDRNekV5TlRSRE1DNDBOemMxT0RNZ01DNDRNelkzT1RRZ01DNDFNemt6T0RJZ01DNDRNelF3TlRnZ01DNDFPVGs1T0RRZ01DNDRNak14TWpGRE1DNDJNemd6T0RRZ01DNDRNVFl3TlRRZ01DNDNNRGs0TlRFZ01DNDRNRFEwTlRRZ01DNDNNVFU1T0RRZ01DNDNOVFkwTlRSRE1DNDNNak0xT0RRZ01DNDJPVFk1T0RnZ01DNDNNekU1T0RRZ01DNDJNemMxTWpFZ01DNDNNems1T0RRZ01DNDFOemd4T0RoTU1DNDNOREk1TVRnZ01DNDFOakF3TlRWRE1DNDNOalEyTlRFZ01DNDFOalV5TlRVZ01DNDRNalkyTlRFZ01DNDFOell6TWpJZ01DNDRNVGt3TlRFZ01DNDFNelF4T0RoYVRUQXVORGd3TmpVeElEQXVNVGt6TXpnNVF6QXVOVFl3TmpVeElEQXVNVGt6TXpnNUlEQXVOalV5TWpVeElEQXVNakF5TkRVMklEQXVOekl6T1RnMElEQXVNalF4T1RJelF6QXVOek0xTURVeElEQXVNalE0TURVMklEQXVOell3TnpnMElEQXVNall4TnpnNUlEQXVOelV6TURVeElEQXVNamM0TURVMlF6QXVOelExTXpFNElEQXVNamswTXpJeklEQXVOekl4TXpFNElEQXVNekF5TkRVMklEQXVOekEyTmpVeElEQXVNekE0TXpJeVF6QXVOamcxTnpBNElEQXVNekUyTURVNUlEQXVOalkwTVRjZ01DNHpNakl3TnpnZ01DNDJOREl5TlRFZ01DNHpNall6TWpKRE1DNDFORGN3TnpRZ01DNHpORFV4TnpZZ01DNDBORGt6TWprZ01DNHpORGN5TURjZ01DNHpOVE0wTlRFZ01DNHpNekl6TWpKRE1DNHpNVEF4TlRnZ01DNHpNamM0TlRnZ01DNHlOamd3TkRRZ01DNHpNVFUxTWpJZ01DNHlNamt4T0RRZ01DNHlPVFU1TWpORE1DNHlNVGsxT0RRZ01DNHlPVEEwTlRZZ01DNHlNRE0zTVRnZ01DNHlPREExT0RrZ01DNHlNRGd4TVRnZ01DNHlOamMxTWpORE1DNHlNVEUyTURNZ01DNHlOakExTURJZ01DNHlNVGN3TnpRZ01DNHlOVFEyTmlBd0xqSXlNemcxTVNBd0xqSTFNRGN5TTBNd0xqSTFNekV6TnlBd0xqSXpNVGc0T1NBd0xqSTROVGN3TXlBd0xqSXhPRGN5TnlBd0xqTXhPVGcxTVNBd0xqSXhNVGt5TTBNd0xqTTNNalV3TnlBd0xqRTVPVEk0TWlBd0xqUXlOalVnTUM0eE9UTXdOVGtnTUM0ME9EQTJOVEVnTUM0eE9UTXpPRGxXTUM0eE9UTXpPRGxhVFRBdU5qZzVOekU0SURBdU56VTFNemc0UXpBdU5qZzNOekU0SURBdU56Y3dPVGc0SURBdU5qWXhPVGcwSURBdU56YzROekl4SURBdU5qUTVOekU0SURBdU56Z3pNVEl4UXpBdU5qSTBNalV4SURBdU56a3hOalFnTUM0MU9UYzVPRElnTUM0M09UYzFNemNnTUM0MU56RXpNVGdnTUM0NE1EQTNNakZETUM0MU1USXhOVFlnTUM0NE1EZzFPRGNnTUM0ME5USXlNVE1nTUM0NE1EZzFPRGNnTUM0ek9UTXdOVEVnTUM0NE1EQTNNakZETUM0ek5UVTVPVFlnTUM0M09UYzRORFlnTUM0ek1UazRNVElnTUM0M09EZ3dNekVnTUM0eU9EWXpPRFFnTUM0M056RTNPRGhETUM0eU9ERTRNellnTUM0M05qazRNVEVnTUM0eU56YzVNeUF3TGpjMk5qWXdOU0F3TGpJM05URXdNeUF3TGpjMk1qVXpRekF1TWpjeU1qYzNJREF1TnpVNE5EVTJJREF1TWpjd05qUXpJREF1TnpVek5qY3pJREF1TWpjd016ZzBJREF1TnpRNE56SXhRekF1TWpVM01EVXhJREF1TmpReU9UZzRJREF1TWpReE9EVXhJREF1TlRNM01qVTFJREF1TWpJM05UZzBJREF1TkRNeE5USXlUREF1TWpFeU1URTRJREF1TXpFMk9EVTJRekF1TWpReU5ESTVJREF1TXpNek5UZzNJREF1TWpjMU16STVJREF1TXpRMU1USTBJREF1TXpBNU5EVXhJREF1TXpVd09UZzVRekF1TXpRMU9UazRJREF1TXpVNE5ESTNJREF1TXpnek1ESXlJREF1TXpZek1qZ3pJREF1TkRJd01qVXhJREF1TXpZMU5USXlRekF1TkRrek16RTFJREF1TXpjd056VTRJREF1TlRZMk56UTVJREF1TXpZMk5qZ3hJREF1TmpNNE56ZzBJREF1TXpVek16ZzVRekF1TmpjM01UWTNJREF1TXpRM09EWTRJREF1TnpFME1qUTJJREF1TXpNMU5EazBJREF1TnpRNE1qVXhJREF1TXpFMk9EVTJUREF1TnpFNU9UZzBJREF1TlRJMk1UZzRRekF1TmpVeU5ERTRJREF1TlRBek9USTRJREF1TlRnMk5EQTJJREF1TkRjM01qQXpJREF1TlRJeU16ZzBJREF1TkRRMk1UZzVRekF1TlRFNU5UYzFJREF1TkRRMU1URTNJREF1TlRFMk9EVTJJREF1TkRRek9ESTBJREF1TlRFME1qVXhJREF1TkRReU16SXlRekF1TlRFd05qVXhJREF1TkRNNU5qVTFJREF1TlRFeE5UZzBJREF1TkRRd09UZzVJREF1TlRBNU9EVXhJREF1TkRNMk9EVTFRekF1TlRBMk5URTRJREF1TkRJNU1qVTFJREF1TlRBMU56RTRJREF1TkRJek5USXlJREF1TkRrNE5qVXhJREF1TkRFM01qVTFRekF1TkRrME9ETTJJREF1TkRFME1pQXdMalE1TURNek1pQXdMalF4TWpFeU15QXdMalE0TlRVek1TQXdMalF4TVRJd05VTXdMalE0TURjeklEQXVOREV3TWpnM0lEQXVORGMxTnpjNElEQXVOREV3TlRVMklEQXVORGN4TVRBMUlEQXVOREV4T1RnNFF6QXVORFkyTkRNeElEQXVOREV6TkRJeElEQXVORFl5TVRjNUlEQXVOREUxT1RjMElEQXVORFU0TnpFM0lEQXVOREU1TkRJMFF6QXVORFUxTWpVMklEQXVOREl5T0RjMUlEQXVORFV5TmprZ01DNDBNamN4TVRrZ01DNDBOVEV5TkRJZ01DNDBNekUzT0RoRE1DNDBORGszT1RVZ01DNDBNelkwTlRjZ01DNDBORGsxTVNBd0xqUTBNVFF3T0NBd0xqUTFNRFF4TXlBd0xqUTBOakl4TWtNd0xqUTFNVE14TmlBd0xqUTFNVEF4TmlBd0xqUTFNek0zT1NBd0xqUTFOVFV5TmlBd0xqUTFOalF5TWlBd0xqUTFPVE0xTVVNd0xqUTFPVFEyTmlBd0xqUTJNekUzTlNBd0xqUTJNek01T0NBd0xqUTJOakU1T1NBd0xqUTJOemczTmlBd0xqUTJPREUxTjBNd0xqUTNNak0xTkNBd0xqUTNNREV4TmlBd0xqUTNOekkwTXlBd0xqUTNNRGsxSURBdU5EZ3lNVEU0SURBdU5EY3dOVGc1UXpBdU5EZzJOekUwSURBdU5EWTVPREkySURBdU5Ea3hNVGswSURBdU5EWTRORGd5SURBdU5EazFORFV4SURBdU5EWTJOVGc1UXpBdU5UQXdOalV4SURBdU5EWTBPVGc1SURBdU5UQXdOalV4SURBdU5EWTFNalUxSURBdU5UQTJNVEU0SURBdU5EWTNOemc1UXpBdU5UY3dPVFl5SURBdU5EazVOREE0SURBdU5qTTNOelkySURBdU5USTJPRFF5SURBdU56QTJNVEU0SURBdU5UUTVPVEl5UXpBdU56RTJNemcwSURBdU5UVXpNalUxSURBdU56RTJNalV4SURBdU5UUTVPVEl5SURBdU56RTJNalV4SURBdU5UVTRORFUxUXpBdU56RTFPREU0SURBdU5UWTBPVFEzSURBdU56RTBPVGN5SURBdU5UY3hOREEwSURBdU56RXpOekU0SURBdU5UYzNOemc0VERBdU56QTFNVGcwSURBdU5qUXhNemc0VERBdU5qZzVOekU0SURBdU56VTFNemc0V2swd0xqUTRNems0TkNBd0xqUTBNREExTlVNd0xqUTRNems0TkNBd0xqUTBNelkxTlNBd0xqUTNPRGt4T0NBd0xqUTBNekkxTlNBd0xqUTNOelU0TkNBd0xqUTBNRGs0T1VNd0xqUTNOakkxTVNBd0xqUXpPRGN5TWlBd0xqUTRNems0TkNBd0xqUXpORGs0T1NBd0xqUTRNems0TkNBd0xqUTBNREExTlZwTk1DNDNORFkyTlRFZ01DNDFNek16T0RoTU1DNDNOVEEyTlRFZ01DNDFNRE01TWpKRE1DNDNOak01T0RRZ01DNDFNVEUxTWpJZ01DNDNPRFkyTlRFZ01DNDFNakk1T0RnZ01DNDNPVEkyTlRFZ01DNDFNemd4T0RoRE1DNDNOemsxT0RRZ01DNDFORE0xTWpJZ01DNDNOVGc1TVRnZ01DNDFNelkwTlRVZ01DNDNORFkyTlRFZ01DNDFNek16T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4YkdsdVpXRnlSM0poWkdsbGJuUWdhV1E5SW5CaGFXNTBNRjlzYVc1bFlYSWlJSGd4UFNJdE1DNHlNRGN3TmpjaUlIa3hQU0l4TGpJd056QTJJaUI0TWowaU1TNHlNRGN3TmlJZ2VUSTlJaTB3TGpJd056QTNNaUlnWjNKaFpHbGxiblJWYm1sMGN6MGlkWE5sY2xOd1lXTmxUMjVWYzJVaVBpWWplR0U3UEhOMGIzQWdjM1J2Y0MxamIyeHZjajBpSXpGQ05qWXdSaUl2UGlZamVHRTdQSE4wYjNBZ2IyWm1jMlYwUFNJeElpQnpkRzl3TFdOdmJHOXlQU0lqTmtOQlJUTkZJaTgrSmlONFlUczhMMnhwYm1WaGNrZHlZV1JwWlc1MFBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1TSWdhR1ZwWjJoMFBTSXdMams1T1RrNU5TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtzdHJva2VXaWR0aD0xO2lyLnRhZ3M9ZnJvbnQgZW5kIGZpbGVzO2lyLnJlZj04YmE3ODNhMC00YmRmLTQ5MmItODU2YS0yOTU5OTU1NWFhMTg7IiBwYXJlbnQ9IjQ1IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICAgIDxteEdlb21ldHJ5IHg9IjM4IiB5PSIyMTQiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI1NSIgdmFsdWU9ImZyb250IGVuZCBmaWxlcyIgc3R5bGU9InRleHQ7aHRtbD0xO3Jlc2l6YWJsZT0wO2VkaXRhYmxlPTA7ZGVsZXRhYmxlPTA7Y29ubmVjdGFibGU9MDtwb2ludHM9W107aXIudHlwZT1DT01QT05FTlRfVEFHO2FsaWduPWNlbnRlcjt2ZXJ0aWNhbEFsaWduPW1pZGRsZTsiIHBhcmVudD0iNTEiIHZlcnRleD0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEuMyIgeT0iMC40NSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2MCIgdmFsdWU9IldlYiBVSSAtJmd0OyBXZWIgQXBwbGljYXRpb24gLSBTZXJ2ZXIgc2lkZSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtlbnRyeVg9MC4wMjg7ZW50cnlZPTAuMzY3O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW50cnlQZXJpbWV0ZXI9MDtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtpci5yZWY9ODA5NjBkZjEtMjkzMS00MjU0LTgwNjYtY2MyYTJjMzEyYjhhO2lyLnRhZ3M9UGF5bWVudHMsT3JkZXJzLGxvZ2luLFJlZ2lzdGVyO2lyLmFzc2V0cz1QZXJzb25hbGx5IElkZW50aWZpYWJsZSBJbmZvcm1hdGlvbixDdXN0b21lciBEYXRhLENyZWRpdCBDYXJkIERhdGE7IiBwYXJlbnQ9IjEiIHNvdXJjZT0iNDciIHRhcmdldD0iNTAiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSB4PSIwLjM0MzkiIHk9IjM1IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCBhcz0ib2Zmc2V0Ii8+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iLTI0IiB5PSIxMjMiLz4KICAgICAgICA8L0FycmF5PgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjYxIiB2YWx1ZT0iV2ViIEFwcGxpY2F0aW9uIC0gU2VydmVyIHNpZGUgLSZndDsgV2ViIFVJIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2VudHJ5WD0xO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7aXIucmVmPTI0ZTQzMWQzLWRjZmYtNDQ0Ni04MTIzLWE5ZTVjZDY2NTVhZTtpci50YWdzPWZyb250IGVuZCBmaWxlczsiIHBhcmVudD0iMSIgc291cmNlPSI1MCIgdGFyZ2V0PSI0NyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogIDwvcm9vdD4KPC9teEdyYXBoTW9kZWw+Cg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="internet" uuid="f0ba7722-39b6-4c81-8290-a30a248bb8d9" name="Internet" desc="Untrusted Internet public zone" trustRating="1"/>
+    <trustZone ref="public-cloud" uuid="b61d6911-338d-46a8-9f39-8dcd24abfe91" name="Public Cloud" desc="Public cloud services" trustRating="20"/>
+  </trustZones>
+  <questions/>
+  <assets>
+    <asset type="" name="Credit Card Data" desc="Card holder data including the full PAN and CVV number." identifier="">
+      <classification name="Cardholder data" desc="Credit card data under the remit of PCI" confidentiality="100" integrity="100" availability="30"/>
+    </asset>
+    <asset type="" name="Customer Data" desc="Data that uniquely identifies customers." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+    <asset type="" name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject') an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity." identifier="">
+      <classification name="Personally Identifiable Information" desc="Any information relating to an identified or identifiable natural person ('Data Subject');&#10;                an identifiable person is one who can be identified, directly or indirectly,&#10;                in particular by reference to an identification number or to one or more factors specific to his&#10;                physical, physiological, mental, economic, cultural or social identity." confidentiality="80" integrity="80" availability="20"/>
+    </asset>
+  </assets>
+  <settings/>
+  <dataflows>
+    <dataflow name="AWS RDS (Relational Database Service) -&gt; Web Application - Server side" ref="0fe40212-1090-4f09-8a76-20cf55fc63be" source="359eac88-b8b9-4af4-a01a-5291c0ecf82d" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web UI -&gt; Browser" ref="19d3cc53-7985-422c-9c66-a7d5be0ff3ea" source="d68365c1-2067-4110-917c-0443ea467645" target="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4">
+      <assets/>
+      <tags>
+        <tag tag="response"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; Web UI" ref="24e431d3-dcff-4446-8123-a9e5cd6655ae" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="d68365c1-2067-4110-917c-0443ea467645">
+      <assets/>
+      <tags>
+        <tag tag="front end files"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; AWS S3 (Simple Storage Service)" ref="263dda87-b04b-4f29-8872-f65d8894b53a" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7">
+      <assets/>
+      <tags>
+        <tag tag="query front end files"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; AWS RDS (Relational Database Service)" ref="26a4bf0d-3dd8-4de3-bc07-7e8711b70bee" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="359eac88-b8b9-4af4-a01a-5291c0ecf82d">
+      <assets/>
+      <tags>
+        <tag tag="order status"/>
+        <tag tag="response"/>
+      </tags>
+    </dataflow>
+    <dataflow name="AWS S3 (Simple Storage Service) -&gt; Web Application - Server side" ref="2e9dbd5f-e9a7-4444-8685-be9ddbcb1b85" source="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Web Application - Server side -&gt; MongoDB NoSQL" ref="7018c0aa-8953-4a24-84df-1019f8948c04" source="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" target="0dabda18-f39e-4929-96e0-83f231b84abe">
+      <assets>
+        <asset name="Credit Card Data"/>
+      </assets>
+      <tags>
+        <tag tag="Payments"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Browser -&gt; Web UI" ref="74a503a9-425b-4934-90bd-1b42a04f735f" source="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4" target="d68365c1-2067-4110-917c-0443ea467645">
+      <assets>
+        <asset name="Customer Data"/>
+      </assets>
+      <tags>
+        <tag tag="login"/>
+        <tag tag="Register"/>
+      </tags>
+    </dataflow>
+    <dataflow name="MongoDB NoSQL -&gt; Web Application - Server side" ref="74e29dbe-cbac-4ec0-b8ee-d7e8c9885130" source="0dabda18-f39e-4929-96e0-83f231b84abe" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
+      <assets/>
+      <tags>
+        <tag tag="payment response"/>
+        <tag tag="query results"/>
+        <tag tag="response"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Web UI -&gt; Web Application - Server side" ref="80960df1-2931-4254-8066-cc2a2c312b8a" source="d68365c1-2067-4110-917c-0443ea467645" target="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f">
+      <assets>
+        <asset name="Credit Card Data"/>
+        <asset name="Customer Data"/>
+        <asset name="Personally Identifiable Information"/>
+      </assets>
+      <tags>
+        <tag tag="login"/>
+        <tag tag="Orders"/>
+        <tag tag="Payments"/>
+        <tag tag="Register"/>
+      </tags>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="3546f256-0749-4868-ac0b-df22007600aa" diagramComponentId="f5e37b56-88ff-4f94-970c-df80ae57d0fc" ref="d68365c1-2067-4110-917c-0443ea467645" name="Web UI" desc="" library="" parentComponentRef="" componentDefinitionRef="web-ui">
+      <tags/>
+      <questions>
+        <question ref="authentication.browser.login.yes" answer="true" manuallyModified="false"/>
+        <question ref="authn.browser.sf" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="jquery" answer="true" manuallyModified="false"/>
+        <question ref="tp.content" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-942-CORS_PERMISSIVE" name="CORS Access-Control-Allow-Origin policy is set to *" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses a cross-domain policy file that includes domains that should not be trusted.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A cross-domain policy file ("crossdomain.xml" in Flash and "clientaccesspolicy.xml" in Silverlight) defines a whitelist of domains to which a server is allowed to make cross-domain requests. When making a cross-domain request, the Flash or Silverlight client will first look for the policy file on the target server. If it is found, and the domain hosting the application is explicitly allowed to make requests, the request is made.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if a cross-domain policy file includes domains that should not be trusted, such as when using wildcards, then the application could be attacked by these untrusted domains. An overly permissive policy file allows many of the same types of attacks seen in Cross-Site Scripting (CWE-79). Once a user has executed a malicious Flash or Silverlight application, they are vulnerable to a variety of attacks. The attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker could also potentially send malicious requests to a website on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. In many of these cases, the attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-942: Overly Permissive Cross-domain Whitelist" url="https://cwe.mitre.org/data/definitions/942.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.844">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-602" name="Client-side Enforcement of Server-Side Security" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software is composed because of a server that relies on the client to implement a mechanism that is intended to protect the server.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.809">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-233" name="Improper Handling of Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.511">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software includes web functionality (such as a web widget)
+                        from another domain, which causes it to operate within the domain of the
+                        software, potentially granting total access and control of the software to the
+                        untrusted source.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-525" name="Information Exposure Through Browser Caching" state="0" impact="100" issueId="" issueLink="">
+          <desc>For each web page, the application should have an appropriate caching policy specifying the
+                        extent to which the page and its form fields should be cached.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-525: Information Exposure Through Browser Caching" url="https://cwe.mitre.org/data/definitions/525.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-922" name="Information Exposure Through Local Storage" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores sensitive information without properly limiting read or write access by
+                        unauthorized actors.
+                        If read access is not properly restricted, then attackers can steal the sensitive information.
+                        If write access is not properly restricted, then attackers can modify and possibly delete the
+                        data, causing incorrect results and possibly a denial of service.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-922: Insecure Storage of Sensitive Information" url="https://cwe.mitre.org/data/definitions/922.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.276">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-613" name="Insufficient Session Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.213">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-613: Insufficient Session Expiration" url="https://cwe.mitre.org/data/definitions/613.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.509">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.963">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM" name="No consent mechanism (conform GDPR &amp; E-privacy Regulation)" state="0" impact="100" issueId="" issueLink="">
+          <desc>No consent mechanisms (or a consent mechanism that does not comply with the GDPR and E-privacy legislation consent requirements) so the organization is unable prove to data protection authorities that the processing is legitimate/legal.
+          </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.465">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY" name="No export functionality" state="0" impact="100" issueId="" issueLink="">
+          <desc>No exportability functionality (for users or admins) which would allow the user to (directly or indirectly via an admin) export his personal data in a clear, readable format and transport it to another data controller. </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.463">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.810">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-598" name="The application sends sensitive information using the URL query string" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application uses the GET method to process requests that contain sensitive
+                        information, which can expose that information through the browser's history, Referers, web
+                        logs, and other sources.
+                        &lt;br /&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.466">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-598: Information Exposure Through Query Strings in GET Request" url="https://cwe.mitre.org/data/definitions/598.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.510">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.844">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.846">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" name="Create a consent mechanism" issueId="" issueLink="" platform="" cost="0" risk="71" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement a consent mechanism which allows data subjects (persons of whom personal data is processed) to give their consent for certain processing activities. This is mainly used for cookies and secondary purposes such as direct marketing, newsletters, ...&lt;br/&gt; 
+          &lt;br/&gt;The consent mechanism often consists of a check box. These check boxes are required for every single secondary purpose (not allowed to implement one consent box for all purposes). The consent boxes should: &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;be inactive by default (the data subject should active the box)&lt;/li&gt;
+              &lt;li&gt;revocable (the data subject must be able to revoke the consent in a way that is as easy as it was to give consent, this can be done by implementing a platform on which the data subject can actively manage his/her consents) &lt;/li&gt;
+              &lt;li&gt;Traceable (a consent database is required to track when consent was given and revoked. This must include timestamps) &lt;/li&gt;
+              &lt;/ul&gt;
+              &lt;br /&gt;You must involve the DPO and/or legal department to decide on the legitimation that can be used.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.6" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.7" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify appropriate user personal data consent mechanisms are in place and are not pre-granted.&lt;/li&gt;
+                &lt;li&gt;Verify users can modify their data consent choices in a manner as easy as giving consent.&lt;/li&gt;
+                &lt;li&gt;Verify the above above user activities have been appropriately logged.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.368">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Deploy a robust server-side validation and authentication system" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When authentication is performed solely on the client-side, the user's credentials (e.g., username and password) are sent to the server for verification. However, an attacker can intercept and modify these credentials before they are sent to the server, allowing them to gain unauthorized access to the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Furthermore, client-side authentication does not provide any protection against attacks that target the server-side of the application. For example, an attacker could exploit a vulnerability in the server-side code to gain access to sensitive data or functionality without needing to authenticate at all.&lt;/p&gt;&lt;p&gt;All data on the client-side must be considered tainted. As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.714">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="not-store-sensitive-data-client-side" name="Do not store sensitive data on the client-side and remove sensitive authentication data" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Browsers and extensions provide a number of local storage options to persist data during HTTP interactions, including (but not limited to) Cookies, HTML5 local storage, session storage, IndexedDB, Flash cookies, and Silverlight isolated storage. These storage options may all be accessed by subsequent users of the browser or computer, and due to this some have experienced unauthorized and/or remote access to their contents. It is important that sensitive, private, and otherwise restricted data is handled with care on the client-side, and is not stored in insecure locations which may expose it to attack.&lt;/p&gt;&lt;p&gt;Sensitive data should not be persistently stored on the client-side due to the risk of exposure. However, during normal application operation, authenticated and other sensitive data is passed, stored in transient form, and displayed to users. It is important that any such temporary storage is purged in a timely manner and actively at the end of a user session.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do not store sensitive data in any kind of persistent, client-side storage.&lt;/li&gt;&lt;li&gt;Review any application or browser layer caching or temporary storage to ensure it doesn't expose data.&lt;/li&gt;&lt;li&gt;Sensitive data (including any authenticated content) stored in client-side objects such as the browser DOM should be cleared and removed actively at the end of user session (e.g. using the logout function), and where possible cleared through hard termination of the browser (e.g. closing the window or tab without using the proper application function).&lt;/li&gt;&lt;li&gt;Ensure any storage used during application interaction is temporary, and automatically cleared by the browser.&lt;/li&gt;&lt;li&gt;Where possible, set expiration times on client-side data to prevent accidental or malicious storage or disclosure.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SA-08 Security Engineering Principles" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/58-08_02_SA-08"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify application functionality where sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application.&lt;/li&gt;&lt;li&gt;Ensure that authentication data is removed after the session termination, to test it, use the following steps:&lt;ul&gt;&lt;li&gt;Access the application as an authenticated user.&lt;/li&gt;&lt;li&gt;Manually or programmatically browse the site and use authenticated functionality&lt;/li&gt;&lt;li&gt;In particular, identify application functionality in which sensitive or secret data is held by the browser. This may include credit card PAN or other data held in the viewstate or DOM whilst data is gathered from the user.&lt;/li&gt;&lt;li&gt;Ensure this data is not stored persistently (e.g. on disk, in persistent cookies, HTML5 stores, Flash or Silverlight storage etc.).&lt;/li&gt;&lt;li&gt;Review local storage in the browser Web Developer Console during and after use of the application. For example, review the HTML5 objects localStorage and sessionStorage for any sensitive data which is saved and not deleted after the logout&lt;/li&gt;&lt;li&gt;Alternatively, a Javascript console can be used with the command: &lt;i&gt;sessionStorage//Storage {length: 0}localStorage//Storage {length: 0}&lt;/i&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.675">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
+                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
+                            within the application.&lt;/li&gt;
+                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
+                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
+                            or PUT request).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.330">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Review periodically all assets which are accessed by the application and ensure that these
+                        assets are hosted by the application. If this is not the case and there are assets in external
+                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
+                        from external providers or CDNs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
+          </references>
+          <standards>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all assets are hosted by the application, and not by external providers.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.047">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" name="Implement a method to remove or export user data on demand" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data gathered from a user should be exportable. This does not include derived fields that were created by the organization, such as customer segmentation fields.&amp;nbsp;&lt;br&gt;&lt;br&gt;Provide or develop the means to facilitate data portability requests, such as download tools or Application Programming Interfaces (API).&amp;nbsp;&lt;br&gt;&lt;br&gt;Guarantees should be in place that personal data is transmitted in a structured, commonly used and machine-readable format, and ensure the interoperability of the data format, provided in the exercise of a data portability request.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="A Complete Guide to GDPR, CCPA and International Privacy Laws" url="https://secureprivacy.ai/complete-guide-to-international-data-privacy-laws/"/>
+          </references>
+          <standards>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                        &lt;ol&gt;
+                        &lt;li&gt;Verify users have the functionality to request personal data transfer and/or download their own data.&lt;/li&gt;
+                        &lt;li&gt;Verify data is in a form acceptable to the Data Protection Practitioner.&lt;/li&gt;
+                        &lt;/ol&gt;
+                        &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="52" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP CheatSheet Series: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.139">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="minimise-parameters-request" name="Minimize the number of parameters in a request" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP requests should contain only the necessary parameters to perform the action (such as hidden fields, Ajax variables, cookies and header values). And the response only return the required information. If unnecessary information is included in the HTTP request, the attack surface is enlarged unnecessarily.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify all requests have only the necessary parameters needed to work correctly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.332">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-226" name="Overwrite data in memory before release" issueId="" issueLink="" platform="" cost="1" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Memory chunks released by an application are not actively overwritten, they are simply de-referenced with the data left until the memory is reallocated and used by another process. As such, sensitive data that is stored in memory may be exposed to an attacker with the ability to inspect that memory; for example through use of an uninitialized variable or other process.&amp;nbsp;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Overwrite memory with zeros or random data before release.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Pay particular attention to sensitive data, such as passwords or other credentials, or sensitive personal information.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#checking-memory-for-sensitive-data-mstg-storage-10"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in Memory" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#testing-memory-for-sensitive-data-mstg-storage-10"/>
+          </references>
+          <standards>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the parts of the code that handles authentication and very sensitive data
+                            (i.e. credit card data).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that the buffers holding that data are overwritten with zeros and freed as
+                            soon as they are not needed anymore.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.714">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.370">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-942-CORS" name="Restrict Cross Domain Origin policy through HTTP headers" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        If an overly permissive policy is specified then an attacker may be able to execute malicious
+                        code hosted on a third party site in the victim's browser under the security trust of the
+                        legitimate application. To prevent this:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Set the Access-Control-Allow-Origin header to only permit explicitly required trusted
+                        domains.&lt;/li&gt;
+                        &lt;li&gt;This set should be as small as possible, and follow the 'least privilege' paradigm.&lt;/li&gt;
+                        &lt;li&gt;Do not use untrusted or tainted user-data from untrusted domains in CORS responses
+                        without proper validation and sanitization.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;Access-Control-Allow-Origin:
+                            valid_host_name&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's end-points.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite, Fiddler)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Modify the Host: header in transit&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.331">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.922">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.370">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="77" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
+                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
+                        directives to control what data may be cached, where, and for how long. It is important to specify
+                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
+                        of authenticated and otherwise restricted access data, either in the users' browser or other
+                        devices.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
+                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
+                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:00.331">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
+&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.369">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.176">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.676">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:01.677">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-204-AUTOCOMPLETE" name="Attackers with access to a victim's client could read locally stored credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If the application accepts sensitive data through forms, then browsers could cache that data and play it if an attacker views the same form in the same browser. This requires the attacker to have access to the victim's browser.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-525">
+                  <countermeasures>
+                    <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-922">
+                  <countermeasures>
+                    <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
+                <countermeasure ref="not-store-sensitive-data-client-side" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-ILLEGAL-PROCESSING-PERSONAL-DATA" name="Illegal processing of personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Processing personal data without legal grounds which makes it possible for data subjects to file a complaint at local Data Protection Authority which might lead to administrative fines.
+              </desc>
+              <riskRating confidentiality="75" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-NO-CONSENT-MECHANISM">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-CONSENT-MECHANISM" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="WEB-QUERY-PARAM" name="Sensitive data is compromised through query parameters in the URL" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Sensitive data directly inserted as a parameters in the URL string could all too easily leak that data inside logs, browser history, etc.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Additionally this information could potentially be leveraged by an attacker to gain access to the entire system or user data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-598">
+                  <countermeasures>
+                    <countermeasure ref="CWE-598" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-598" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-PWD-MEM" name="Attackers gain access to in-memory passwords/credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If the component handles credentials and it does not do a proper clean-up of them in
+                                memory, they could be accessed by an attacker by inspecting the memory or reading
+                                segments of the disk in which a swapped memory page could have been saved.&amp;nbsp;
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-226" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-226" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-21" name="Attackers manipulate session IDs and resource IDs to take advantage of the fact that some software accepts user input without verifying its authenticity" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attacks on session IDs and resource IDs take advantage of the fact that some software accepts user input without verifying its authenticity. For example, a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, the information in the message (such group or role membership), or indeed the process that wrote the message to the queue are authentic and authorized to do so.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Many server side processes are vulnerable to these attacks because the server to server communications have not been analyzed from a security perspective or the processes "trust" other systems because they are behind a firewall. In a similar way servers that use easy to guess or spoofable schemes for representing digital identity can also be vulnerable. Such systems frequently use schemes without cryptography and digital signatures (or with broken cryptography). Session IDs may be guessed due to insufficient randomness, poor protection (passed in the clear), lack of integrity (unsigned), or improperly correlated with access control policy enforcement points.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Exposed configuration and properties files that contain system passwords, database connection strings, and such may also give an attacker an edge to enumerate these identifiers.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The net result is that spoofing and impersonation may be possible leading to an attacker's ability to break authentication, authorization, and audit controls on the system.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-602">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Web applications typically make extensive use of 3rd party web resources such as
+                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
+                                repositories, or even Content Delivery Networks that host these libraries, then they
+                                could gain access to applications that use this content.
+                                &lt;div&gt;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-830">
+                  <countermeasures>
+                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-39" name="Attacker gains access by manipulation of an authentication token or other sensitive data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In circumstances in which an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) this data could potentially be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-233">
+                  <countermeasures>
+                    <countermeasure ref="minimise-parameters-request" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="minimise-parameters-request" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ASVS-2014-3.3" name="Attackers could gain access to an open session, if they have access to a user's browser" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If a user steps away from their browser for a few minutes and there is an
+                                opportunity for
+                                an attacker to access the browser, then they could gain access to the user's logged
+                                in
+                                session and perform operations on their behalf.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="10"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-613">
+                  <countermeasures>
+                    <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-session-generation-and-expiration" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-942-CORS_PERMISSIVE" name="Attackers could gain access to sensitive data through a too permissive CORS policy" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An overly permissive policy file may allow many types of attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Once a user has visited a malicious site, they are vulnerable to a variety of attacks. For example, the attacker could potentially transfer private information, such as cookies, that may include session information, from the victim's machine to the attacker. The attacker may be able to send malicious requests to a web site on behalf of the victim, which could be especially dangerous if the victim has administrator privileges to manage that site.&lt;/p&gt;&lt;p&gt;In many cases, these types of attack can be launched without the victim even being aware of it.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-942-CORS_PERMISSIVE">
+                  <countermeasures>
+                    <countermeasure ref="CWE-942-CORS" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-942-CORS" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-SUBJECT-RIGTHS" name="Subjects cannot exercise their rights over their personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Data subject cannot exercise their rights which makes it possible for them to file a complaint at the local Data Protection Authority which might lead to administrative fines.&amp;nbsp;&lt;br&gt;&lt;br&gt;Data subject = person of whom personal data is processed&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-NOT-EXPORT-FUNCTIONALITY">
+                  <countermeasures>
+                    <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EXPORT-DELETE-FUNCTIONALITY" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="fb13b9fa-08fa-4631-b65d-551d1c7a34dd" diagramComponentId="9b15e125-37ae-44ef-a803-6c6b38af946e" ref="a080f18f-c6c8-4d24-a9d5-9ba93fd5ead4" name="Browser" desc="" library="" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="internet"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.880">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.175">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.431">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.432">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.948">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.881">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.433">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.881">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.882">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.256">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.628">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.630">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="74" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.259">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="88" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="94" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.899">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.259">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'frame-ancestors' from the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes the X-Frame-Options header for supporting browsers.&lt;/p&gt;&lt;p&gt;The CSP frame-ancestors directive specifies valid parents that may embed a page using &amp;lt;frame&amp;gt;, &amp;lt;iframe&amp;gt;, &amp;lt;object&amp;gt;, &amp;lt;embed&amp;gt;, or &amp;lt;applet&amp;gt;.&lt;/p&gt;&lt;p&gt;Setting this directive to 'none' is similar to X-Frame-Options: deny (which is also supported in older browsers).&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: DENY&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'none'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;If necessary, you can enable framing within your application's origin by setting the headers as follows:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;X-Frame-Options: SAMEORIGIN
+&lt;/p&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors 'self'&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;For APIs the current best practices is to allow framing by specific origins (if necessary):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Content-Security-Policy: frame-ancestors https://website1.com https://website2.com&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Note: frame-ancestors allows you to specify what parent source may embed a page. This differs from frame-src, which allows you to specify where iframes in a page may be loaded from.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;frame-ancestors: none/self &lt;/i&gt;header is returned as configured.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.258">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.630">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="56" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.038">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="81" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:59.629">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="5b323e5c-94ca-4fc3-9c69-bc201d27a7dd" diagramComponentId="421637d3-aa3c-4062-8bc2-d2c9a15c40dd" ref="ade12ff7-9a4c-40d6-bdda-12c2ef0cbb7f" name="Web Application - Server side" desc="" library="" parentComponentRef="" componentDefinitionRef="web-application-server-side">
+      <tags/>
+      <questions>
+        <question ref="emailExistingPwd" answer="true" manuallyModified="false"/>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="secret.management.crypto.yes" answer="true" manuallyModified="false"/>
+        <question ref="server.authentication.building.yes" answer="true" manuallyModified="false"/>
+        <question ref="server.javascript" answer="true" manuallyModified="false"/>
+        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.343">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-178-AUTH" name="Application does not distinguish between upper and lower case passwords" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The complexity of guessing a password is directly related to the character set being used. Not differentiating between upper and lower case passwords dramatically reduces this complexity.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-603" name="Authentication controls are enforced on the client side but not on server side" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Open authenticated endpoints that rely on authentication performed by a client are easily identifiable and exploitable by accessing them directly. Clients may be subverted by an attacker who could have full control over them so they must be treated as an untrusted element.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;A client/server product that performs authentication within client code but not in server code, potentially allows server-side authentication to be bypassed via a modified client that bypasses the authentication check. Client-side only authentication is considered extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319-PWD" name="Authentication credentials transmitted in clear text" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many communication channels can be surreptitiously observed ("sniffed") by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.380">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
+                        data transmission. For example, network traffic can often be sniffed by any attacker who has
+                        access to a network interface. This significantly lowers the difficulty of exploitation by
+                        attackers.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.837">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.343">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.344">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.880">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-287" name="Improper Authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>When an actor claims to have a given identity, the software does not prove or insufficiently
+                        proves that the claim is correct.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-287: Improper Authentication" url="https://cwe.mitre.org/data/definitions/287.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.345">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.696">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.881">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-923" name="Improper Restriction of Communication Channel to Intended Endpoints" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.522">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-923: Improper Restriction of Communication Channel to Intended Endpoints" url="https://cwe.mitre.org/data/definitions/923.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.698">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-326" name="Inadequate Encryption Strength" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.702">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.700">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.460">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-345" name="Insufficient Verification of Data Authenticity" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.401">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-320" name="Key Management Errors" state="0" impact="100" issueId="" issueLink="">
+          <desc>Weaknesses in this category are related to errors in the management of cryptographic keys.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.401">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.226">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.344">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.461">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.958">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-636" name="Not Failing Securely ('Failing Open')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-916" name="Password hashes can be reverted over a reasonable period of time" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort to make password cracking attacks infeasible or expensive. Many password storage mechanisms compute a hash and store the hash, instead of storing the original password in plaintext. In this design, authentication involves accepting an incoming password, computing its hash, and comparing it to the stored hash.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Many hash algorithms are designed to execute quickly with minimal overhead, even cryptographic hashes. However, this efficiency is a problem for password storage, because it can reduce an attacker's workload for brute-force password cracking. If an attacker can obtain the hashes through some other method (such as SQL injection on a database that stores hashes), then the attacker can store the hashes offline and use various techniques to crack the passwords by computing hashes efficiently. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing (such as cloud computing) and GPU, ASIC, or FPGA hardware. In such a scenario, an efficient hash algorithm helps the attacker. There are several properties of a hash scheme that are relevant to its strength against an offline, massively-parallel attack:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The amount of CPU time required to compute the hash (&amp;quot;stretching&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The amount of memory required to compute the hash (&amp;quot;memory-hard&amp;quot; operations)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Including a random value, along with the password, as input to the hash computation (&amp;quot;salting&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Given a hash, there is no known way of determining a password that produces this hash value, other than by guessing possible passwords (&amp;quot;one-way&amp;quot; hashing)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Relative to the number of all possible hashes that can be generated by the scheme, there is a low likelihood of producing the same hash for multiple different inputs (&amp;quot;collision resistance&amp;quot;)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Note that the security requirements for the software may vary depending on the environment and the value of the passwords. Different schemes might not provide all of these properties, yet may still provide sufficient security for the environment. Conversely, a solution might be very strong in preserving one property, which still being very weak for an attack against another property, or it might not be able to significantly reduce the efficiency of a massively-parallel attack. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.820">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-916" url="https://cwe.mitre.org/data/definitions/916.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-257" name="Plaintext Storage of a Password" state="0" impact="100" issueId="" issueLink="">
+          <desc>The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.771">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-257: Storing Passwords in a Recoverable Format" url="https://cwe.mitre.org/data/definitions/257.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.823">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693" name="Protection Mechanism Failure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection
+                        mechanism that provides sufficient defense against directed attacks against the
+                        product.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.027">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-654" name="Reliance on a Single Factor in a Security Decision" state="0" impact="100" issueId="" issueLink="">
+          <desc>A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-654: Reliance on a Single Factor in a Security Decision" url="https://cwe.mitre.org/data/definitions/654.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-204" name="Response Discrepancy Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software provides different responses to incoming requests in a way that allows an actor
+                        to determine system state information that is outside of that actor's control sphere.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;This issue frequently occurs during authentication, where a difference in
+                        failed-login messages could allow an attacker to determine if the username is valid or not.
+                        These exposures can be inadvertent (bug) or intentional (design).
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.823">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-204: Response Discrepancy Information Exposure" url="https://cwe.mitre.org/data/definitions/204.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.882">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-307" name="The application does not implement anti-automation mechanisms to prevent automated long-time sustained probes" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
+
+This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, to compromise program logic (such as limiting humans to a single vote), or for other purposes. For example, an authentication routine might not limit the number of times an attacker can guess a password, or a website might conduct a poll but only expect humans to vote a maximum of once a day.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.821">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-255" name="The application does not wipe used and not needed passwords or key material" state="0" impact="100" issueId="" issueLink="">
+          <desc>When using password or key material within an application, these are copied in memory and can be copied back to the disk depending on several factors.
+
+If the application handles passwords or key material, an attacker with access to the system could inspect the memory or the hard disk to retrieve back those secrets on its original form.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.821">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Top 10 - A5 Security Missconfiguration" url="https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.157">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CS-EMAIL-COMP" name="The application uses a weak credential recovery method for email access" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Using weak credential recovery methods (like sending an SMS or transmitting the new password over insecure channels, more generally), may be leveraged to compromise access to an email account.&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.379">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.342">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-367" name="Time-of-check Time-of-use (TOCTOU) Race Condition" state="0" impact="75" issueId="" issueLink="">
+          <desc>The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Black Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Testing for race conditions is problematic due to their nature, and external influences on testing including server load, network latency, etc. will all play a part in the presence and detection of the condition. &lt;/p&gt;
+&lt;p&gt;However, testing can be focused on specific transactional areas of the application, where time-of-read to time-of-use of specific data variables could be adversely affected by concurrency issues. &lt;/p&gt;
+&lt;p&gt;Black Box testing attempts to force a race condition may include the ability to make multiple simultaneous requests while observing the outcome for unexpected behavior. &lt;/p&gt;
+&lt;p&gt;Examples of such areas are illustrated in the paper &amp;quot;On Race Vulnerabilities in Web Applications&amp;quot;, cited in the further reading section. The authors suggest that it may be possible in certain circumstances to: &lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt; Create multiple user accounts with the same username.&lt;/li&gt;
+ &lt;li&gt; Bypass account lockouts against brute forcing.&lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;Testers should be aware of the security implications of race conditions and their factors surrounding their difficulty of testing. &lt;/p&gt;
+&lt;h2&gt;&lt;span class="mw-headline"&gt;&lt;font size="4"&gt;Gray Box testing and example&lt;/font&gt;&lt;/span&gt;&lt;/h2&gt;
+&lt;p&gt;Code review may reveal likely areas of concern for concurrency issues. More information on reviewing code for concurrency issues can be seen at OWASP Code Review Guide's &lt;a href="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions" title="Reviewing Code for Race Conditions"&gt;Reviewing Code for Race Conditions&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="Reviewing Code for Race Conditions" url="https://www.owasp.org/index.php/Reviewing_Code_for_Race_Conditions"/>
+              <reference name="Testing for Race Conditions (OWASP-AT-010)" url="https://www.owasp.org/index.php/Testing_for_Race_Conditions_(OWASP-AT-010)"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.701">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.699">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.698">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-523" name="Unprotected Transport of Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.524">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-620" name="Unverified Password Change" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;When setting a new password for a user, the product does not require knowledge of the original password, or use of another form of authentication.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.822">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-330" name="Use of Insufficiently Random Values" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.400">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.402">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-654" name="Authenticate users (multi - or two-factor - authentication [2FA])" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For more sensitive applications hosting data or functionality requiring greater assurance over the identification of users, a multi - or two-factor - authentication process is recommended. Together with asserting their identity and a password/phrase/PIN (something you know), such systems require additional factors, such as biometric validation (something you are), user-initiated action such as a button press on a FIDO hardware key or a token (something you have).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement multi-factor authentication for applications providing access to sensitive data or functionality, and for highly privileged user access (e.g. administrators).&lt;/li&gt;&lt;li&gt;This should leverage something such as a soft or hard-token verification in addition to the secret password/pass-phrase for example.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+          </references>
+          <standards>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5.2.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.5" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.9" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.1.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check for authentication functions of the component.&lt;/li&gt;&lt;li&gt;Verify at least a combination of the following factors is used within the authentication process.&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Something that you are: mainly biometric characteristics of yourself such as fingerprint, facial recognition, iris recognition, etc.)&lt;/li&gt;&lt;li&gt;Something that you know: a PIN, password, pass phrase, etc.&lt;/li&gt;&lt;li&gt;Something that you have: a hardware token, a card, a dongle, a mobile phone, etc.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.501">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.217">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="73" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.2" name="Deny access by default if a security control fails with an exception" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If a security control fails, the application should not allow the user access to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Therefore, if in the security control an exception is launched the system should stay in a secure state, meaning access is denied to the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Conversely, access will only be granted if there is no security failure / exception.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Fail securely" url="https://www.owasp.org/index.php/Fail_securely"/>
+            <reference name="OWASP Security by Design Principles: Fail securely" url="https://www.owasp.org/index.php/Security_by_Design_Principles#Fail_securely"/>
+          </references>
+          <standards>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if the security controls fail, access is denied to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that if a security control fails or throws an exception access is denied to the application for that user&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Deploy a robust server-side validation and authentication system" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;When authentication is performed solely on the client-side, the user's credentials (e.g., username and password) are sent to the server for verification. However, an attacker can intercept and modify these credentials before they are sent to the server, allowing them to gain unauthorized access to the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Furthermore, client-side authentication does not provide any protection against attacks that target the server-side of the application. For example, an attacker could exploit a vulnerability in the server-side code to gain access to sensitive data or functionality without needing to authenticate at all.&lt;/p&gt;&lt;p&gt;All data on the client-side must be considered tainted. As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.339">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.098">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.102">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.129">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.218">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="51" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-2.17" name="Do not transmit password in email or other unencrypted channels" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Data passed between the user and application without appropriate encryption, in particular in
+                        emails, may be intercepted or monitored by malicious parties.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Do not send plaintext passwords in emails or other unencrypted transport (e.g. a web
+                        page server over HTTP).&lt;/li&gt;
+                        &lt;li&gt;Password recovery processes should not send either the old or a new password to users
+                        (the former is particular bad due to the penchant for people to reuse the same password across
+                        multiple systems or applications).&lt;/li&gt;
+                        &lt;li&gt;If the recovery process is built on sending a temporary random password to users, the
+                        risk can be partly mitigated (but not eliminated) by:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensuring the random password is single use (one time password), and forcing the user
+                        to change the password on first login.&lt;/li&gt;
+                        &lt;li&gt;Making the password valid only for a short-time (time limited).&lt;/li&gt;
+                        &lt;li&gt;Requiring a further validation or identification step when the time limited one time
+                        password is used.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Review all password-provisioning mechanisms that are implemented by the
+                            application. &lt;br /&gt;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.872">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.130">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.724">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-204-USERNAME-LOGIN" name="Ensure application errors do not reveal account status" issueId="" issueLink="" platform="" cost="0" risk="47" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Error messages can reveal information of use to an attacker, particularly in the cases relating to login, registration and recovery processes.&amp;nbsp; Explicit errors stating accounts are valid or not, or whether they are locked out, are useful to an attacker in enumerating usernames for subsequent attacks. Even small variations in errors returned to the user can be used to infer how the application operates, or enforces security controls.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To prevent a malicious user using error conditions to determine how the application functions in order to subvert it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Trap and log all known error conditions on the server-side&lt;/li&gt;&lt;li&gt;Create a generic trap for unexpected errors&lt;/li&gt;&lt;li&gt;E.g. Error messages during the login process should not disclose which authentication token was incorrect, instead a generic message simply stating that authentication failed should be displayed.&lt;/li&gt;&lt;li&gt;Ensure the error message returned to the user is generic, or contains only an obfuscated reference that can be correlated with the logged errors on the server-side. &amp;nbsp;In the case of applications delivered over HTTP, the HTTP header should also be generic to prevent enumeration (e.g. all error pages should produce a consistent HTTP 500 error)&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify error conditions within the application (i.e. Unexpected data types, unexpected data length, requests from an unexpected state, etc.).&lt;/li&gt;&lt;li&gt;And verify the responses do not reveal any information on the internals of the applications (i.e. they do not expose a full stack trace with all the methods called or the sql string sent to a database, etc.).&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.497">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-367-TOCTOU" name="Ensure that all high-value business logic flows, including authentication, session management and access control are thread safe and resistant to time-of-check and time-of-use race conditions" issueId="" issueLink="" platform="" cost="1" risk="59" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;ul&gt;&lt;li&gt;Do not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but simply gives a false sense of security given by the check.&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Limit the interleaving of operations on files from multiple processes.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Recheck the resource after the use call to verify that the action was taken appropriately.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that some environmental locking mechanism can be used to protect resources effectively. Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&gt;&lt;br&gt;&amp;nbsp;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.11.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the areas of the application where concurrent access to resources can
+                            happen.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify that unexpected input, timing or action sequence is not causing unexpected
+                            behavior on the system.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" name="Ensure that only strong algorithms, cyphers and protocols are used" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Ensure that the application is using strong algorithms, cyphers and protocols. The general
+                        practice and required minimum key lengths depend on the scenarios listed below.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                        &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                        &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                        &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                        &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="NIST SP 800-175b" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175b.pdf"/>
+            <reference name="NIST SP 800-57" url="https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"/>
+            <reference name="OSA SC-01 System And Communications Protection Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/61-08_02_SC-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP cryptographic storage" url="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet"/>
+            <reference name="OWASP key management" url="https://www.owasp.org/index.php/Key_Management_Cheat_Sheet"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the Cryptographic protocols comply to the best practices listed bellow:
+                            &lt;br /&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Key exchange: Diffie-Hellman key exchange with minimum 2048
+                            bits&lt;/li&gt;
+                            &lt;li&gt;Message Integrity: HMAC-SHA2&lt;/li&gt;
+                            &lt;li&gt;Message Hash: SHA2 256 bits&lt;/li&gt;
+                            &lt;li&gt;Asymmetric encryption: RSA 2048 bits&lt;/li&gt;
+                            &lt;li&gt;Symmetric-key algorithm: AES 128 bits&lt;/li&gt;
+                            &lt;li&gt;Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.&lt;br /&gt;&lt;/li&gt;
+                            &lt;/ul&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.176">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.101">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.682">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="crypto-operations" name="Ensure the application is implementing known good cryptographic operations" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptography (or crypto) is one of the more advanced topics of information security, and one whose understanding requires the most schooling and experience. It is difficult to get right because there are many approaches to encryption, each with advantages and disadvantages that need to be thoroughly understood by web solution architects and developers. In addition, serious cryptography research is typically based in advanced mathematics and number theory, providing a serious barrier to entry.&lt;/p&gt;
+&lt;p&gt;Instead of building cryptographic capability from scratch, it is strongly recommended that peer reviewed and open solutions be used, such as the Google Tink project, Libsodium, and secure storage capability built into many software frameworks and cloud services.&lt;/p&gt;
+&lt;p&gt;Using crypto in a secure way is more complicated than choosing the right crypto algorithms. It also requires secure deployments, secure APIs, secure key-management, secure randomness generation, and secure protocols.&lt;/p&gt;
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Random number, encryption or hashing algorithms, key lengths, rounds, ciphers or modes, shall be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks.&lt;/li&gt;
+  &lt;li&gt;Nonces, initialization vectors, and other single use numbers must not be used more than once with a given encryption key. The method of generation must be appropriate for the algorithm being used.&lt;/li&gt;
+  &lt;li&gt;Encrypted data shall be authenticated via signatures, authenticated cipher modes, or HMAC to ensure that ciphertext is not altered by an unauthorized party.&lt;/li&gt;
+  &lt;li&gt;Cryptographic operations shall be constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.&lt;br /&gt;&lt;/li&gt;
+ &lt;/ul&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Cryptographic Storage Cheat_Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"/>
+            <reference name="OWASP Guide to Cryptography" url="https://www.owasp.org/index.php/Guide_to_Cryptography"/>
+            <reference name="OWASP Proactive Controls (C8: Protect Data Everywhere)" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+            <reference name="OWASP Top 10 Proactive Controls C8: Protect Data Everywhere" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c8-protect-data-everywhere.html"/>
+          </references>
+          <standards>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.2.8" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Review the source code:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for the following keywords to check if any weak encryption algorithm is used: &lt;/li&gt;
+&lt;/ul&gt;
+&lt;p&gt;MD4, MD5, RC4, RC2, DES, Blowfish, SHA-1, ECB&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Searching for &amp;quot;ECB&amp;quot; or &amp;quot;Cipher.getInstance&amp;quot;, the ECB should not be used in symmetric encryption.&lt;/li&gt;
+ &lt;li&gt;Review if different IV (initial Vector) is used.&lt;/li&gt;
+ &lt;li&gt;Use static code analysis tool to do source code review related with insecure crypto modes of operation. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;span&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Codereview practices for Crytography" url="https://www.owasp.org/index.php/Codereview-Cryptography"/>
+              <reference name="OWASP Testing for Weak Encryption (OTG-CRYPST-004)" url="https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-AUTH" name="Ensure the application uses a single vetted authentication mechanism that is known to be secure" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;ul&gt;
+ &lt;li&gt;Ensure that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.&lt;/li&gt;
+ &lt;li&gt;Ensure that all authentication pathways and identity management APIs implement consistent authentication security control strength, such that there are no weaker alternatives per the risk of the application.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.1 Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.2 Testing for default credentials (OTG-AUTHN-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.3 Testing for Weak lock out mechanism (OTG-AUTHN-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.4 Testing for bypassing authentication schema (OTG-AUTHN-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.5 Test remember password functionality (OTG-AUTHN-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.6 Testing for Browser cache weakness (OTG-AUTHN-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.7 Testing for Weak password policy (OTG-AUTHN-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.8 Testing for Weak security question/answer (OTG-AUTHN-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.9 Testing for weak password change or reset functionalities (OTG-AUTHN-009)
+&lt;/div&gt;
+&lt;div&gt;
+  4.5.10 Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+   Test For Authentication On All EndPoints. You can automate this process using DAST tools like OWASP ZAP. It includes an API scanning script to automate security scanning of APIs defined using OpenAPI/Swagger or SOAP.&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;br /&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+   Usage: zap-api-scan.py -t &amp;lt;target&amp;gt; -f &amp;lt;format&amp;gt; [options]
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -t target&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;target API definition, currently only an OpenAPI URL, eg https://www.example.com/openapi.json
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -f format&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;either openapi or soap
+ &lt;/div&gt;
+ &lt;div&gt;
+   Options:
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -h&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; print this help message
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -c config_file&amp;nbsp; &amp;nbsp; config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -u config_url&amp;nbsp; &amp;nbsp; &amp;nbsp;URL of config file to use to INFO, IGNORE or FAIL warnings
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -g gen_file&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;generate default config file (all rules set to WARN)
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -r report_html&amp;nbsp; &amp;nbsp; file to write the full ZAP HTML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -w report_md&amp;nbsp; &amp;nbsp; &amp;nbsp; file to write the full ZAP Wiki (Markdown) report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -x report_xml&amp;nbsp; &amp;nbsp; &amp;nbsp;file to write the full ZAP XML report
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -J report_json&amp;nbsp; &amp;nbsp; file to write the full ZAP JSON document
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -a&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; include the alpha passive scan rules as well
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -d&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; show debug messages
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -P&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; specify listen port
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -D&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; delay in seconds to wait for passive scanning&amp;nbsp;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -i&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; default rules not in the config file to INFO
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -l level&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; minimum level to show: PASS, IGNORE, INFO, WARN or FAIL, use with -s to hide example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -n context_file&amp;nbsp; &amp;nbsp;context file which will be loaded prior to scanning the target
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -p progress_file&amp;nbsp; progress file which specifies issues that are being addressed
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -s&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; short output format - don't show PASSes or example URLs
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -S&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; safe mode this will skip the active scan and perform a baseline scan
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -T&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; max time in minutes to wait for ZAP to start and the passive scan to run
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -O&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; the hostname to override in the (remote) OpenAPI spec
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; -z zap_options&amp;nbsp; &amp;nbsp; ZAP command line options e.g. -z &amp;quot;-config aaa=bbb -config ccc=ddd&amp;quot;
+ &lt;/div&gt;
+ &lt;div&gt;
+   &amp;nbsp; &amp;nbsp; --hook&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; path to python file that define your custom hooks
+ &lt;/div&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-923-SEGREG" name="Ensure the segregation of components of different trust levels" issueId="" issueLink="" platform="" cost="0" risk="64" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the segregation of components of different trust levels through well-defined security controls, firewall rules, API gateways, reverse proxies, cloud-based security groups, or similar mechanisms.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.340">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.093">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.101">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;For API rate limiting there are several methods that can be applied:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Throttling: based on certain rules a request can be slowed down considerably to allow other requests to be served first&lt;/li&gt;&lt;li&gt;Request queues: limit the number of request in a given period of time (e.g. five requests per second)&lt;/li&gt;&lt;li&gt;Token bucket: commonly used in public APIs, each user has a number of tokens to call the API. After all tokens have been used the user has to wait until the number of tokens are renewed&lt;/li&gt;&lt;li&gt;Fixed window: requests that exceed a fixed limit in a period of time will be blocked temporarily&lt;/li&gt;&lt;li&gt;Leaky bucket: requests are put in a FIFO queue and will be served accordingly&lt;/li&gt;&lt;li&gt;Sliding log: a time-stamped log is used to identify user actions, so the rate limit can be applied for a specified user to avoid more than X actions in a period of time&lt;/li&gt;&lt;li&gt;Sliding window: combination of fixed window and sliding log&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;From a user perspective, implementing timeouts and calling paginated endpoints can reduce the impact of having a very large response that can freeze the system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like THC-Hydra, OWASP ZAP or Burp Suite to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="password-reset-email-best-practices" name="Implement Password reset email design best practices" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Passwords should not be sent in plain text (for example in an email), as they may be intercepted or monitored.&lt;/li&gt;&lt;li&gt;The client-side and the server-side should communicate by a secured and independent channel.&lt;/li&gt;&lt;li&gt;The application should verify the user's identity, and leverage a time-limited (not longer than 10 minutes) one-time password token (TOTP) from the user.&lt;/li&gt;&lt;li&gt;Alternatively, the application could require the user enters a soft-token (e.g. Google authenticator), a mobile-push / SMS code, or previously established off-line recovery mechanism (for example a list of pre-defined recovery codes).&amp;nbsp;&lt;/li&gt;&lt;li&gt;It should be noted that use of a random value in an e-mail or SMS has known weaknesses, and should be considered a less secure option.&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through the use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;The application should then require they choose a new password or phrase in line with the chosen policy.&lt;/li&gt;&lt;li&gt;For change and reset password functionality it is recommended to keep a history of old passwords (salted hashes used). These can be leveraged to prevent password reuse, or an attacker alternating between a selection of passwords (Monday1, Tuesday2 etc.).&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.10" supportedStandardRef="nist-800-63"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+ &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Go through the password reset method implemented by the application.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
+ &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Check if the current or new passwords are revealed or sent in plain text at any point.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
+ &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Check that the application requires you to introduce the old password, a new password and the new password confirmation.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt;
+&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.873">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="follow-jwt-standard-generation-token" name="Implement token generation for stateless server following the recommendation of the JWT standard" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. A JWT token is created during authentication and is verified by the server (or servers) before any processing.&lt;/p&gt;&lt;p&gt;However, JWT's are often not saved by the server after initial creation. JWT's are typically created and then handed to a client without being saved by the server in any way. The integrity of the token is maintained through the use of digital signatures so a server can later verify that the JWT is still valid and not been tampered with since its creation.&lt;/p&gt;&lt;p&gt;This approach is both stateless and portable in the way that client and server technologies can be different yet still interact.&lt;/p&gt;&lt;p&gt;Ensure implementation of the following requirements to protect the stateless token for digital signatures, encryption and other countermeasures following the requirements of JWT standard.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;To create a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Create a JWT Claims Set containing the desired claims.&amp;nbsp; Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Let the Message be the octets of the UTF-8 representation of the JWT Claims Set.&lt;/li&gt;&lt;li&gt;Create a JOSE Header containing the desired set of Header Parameters. The JWT MUST conform to either the [JWS] or [JWE] specifications. Note that whitespace is explicitly allowed in the representation and no canonicalization need be performed before encoding.&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, create a JWS using the Message as the JWS Payload; all steps specified in [JWS] for creating a JWS MUST be followed.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, create a JWE using the Message as the plaintext for the JWE; all steps specified in [JWE] for creating a JWE MUST be followed.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If a nested signing or encryption operation will be performed, let the Message be the JWS or JWE, and return to Step 3, using a "cty" (content type) value of "JWT" in the new JOSE Header created in that step.&lt;/li&gt;&lt;li&gt;Otherwise, let the resulting JWT be the JWS or JWE.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC 7519" url="https://tools.ietf.org/html/rfc7519"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the stateless token uses digital signatures, encryption and other countermeasures to protect against tampering, enveloping, relay, null cipher and key substitution attacks.&lt;/p&gt;&lt;p&gt;When validating a JWT, the following steps are performed. The order of the steps is not significant in cases where there are no dependencies between the inputs and outputs of the steps.&amp;nbsp; If any of the listed steps fail, then the JWT MUST be rejected -- that is, treated by the application as an invalid input.&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Verify that the JWT contains at least one period ('.') character.&lt;/li&gt;&lt;li&gt;Let the Encoded JOSE Header be the portion of the JWT before the first period ('.') character.&lt;/li&gt;&lt;li&gt;Base64url decode the Encoded JOSE Header following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JOSE Header be this JSON object.&lt;/li&gt;&lt;li&gt;Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood.&lt;/li&gt;&lt;li&gt;Determine whether the JWT is a JWS or a JWE using any of the methods described in Section 9 of [JWE].&lt;/li&gt;&lt;li&gt;Depending upon whether the JWT is a JWS or JWE, there are two cases:&lt;ul&gt;&lt;li&gt;If the JWT is a JWS, follow the steps specified in [JWS] for validating a JWS.&amp;nbsp; Let the Message be the result of base64url decoding the JWS Payload.&lt;/li&gt;&lt;li&gt;Else, if the JWT is a JWE, follow the steps specified in [JWE] for validating a JWE.&amp;nbsp; Let the Message be the resulting plaintext.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations.&amp;nbsp; In this case, return to Step 1, using the Message as the JWT.&lt;/li&gt;&lt;li&gt;Otherwise, base64url decode the Message following the restriction that no line breaks, whitespace, or other additional characters have been used.&lt;/li&gt;&lt;li&gt;Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Finally, note that it is an application decision which algorithms may be used in a given context.&amp;nbsp; Even if a JWT can be successfully validated, unless the algorithms used in the JWT are acceptable to the application, it SHOULD reject the JWT.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-KEY-MGMT" name="Isolate cryptographic processes - including master secrets - and consider the use of a virtualized or physical hardware key vaults (HSM)" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cryptographic processes require the use of a private key or a secret. If the private key is stored poorly in the same service to be accessed, a compromise of the system could lead to this private key or secret being stolen. This would give the attacker access to all information.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The way to prevent this is to keep cryptographic functionalities on a separate service that performs the encryption/decryption on demand. It is better if this service uses virtualized or physical hardware key vaults like a Hardware Security Module because those devices store the private key and secrets securely.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Key vaults and such implement security measures to prevent this information being extracted from them&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Identify the parts of your component which are using cryptographic functions.&lt;/li&gt;&lt;li&gt;Check these are implemented by an external service which is configured securely.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.177">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.131">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.132">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.132">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="password-change-facility" name="Offer a password change facility" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Users must retain control of their credentials in a single factor system, and to facilitate this they must have the ability to change their password. This is particularly important should the user determine their password has been compromised, potentially allowing a third party to access the system impersonating them. Furthermore, accountability is adversely affected where users cannot change their passwords, as they can plausibly claim that even though they knew their account credentials were compromised, there was no way for them to prevent unauthorized use of the account.&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Users should be allowed to change their passwords, ideally within the application&lt;/li&gt;
+ &lt;li&gt;Password change should require re-authentication to prevent abuse of a compromised or unattended session. I.e. the user should be required to enter their existing password in order to change it.&lt;/li&gt;
+ &lt;li&gt;After a successful password change, the application should terminate all other active sessions.&lt;/li&gt;
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+          </references>
+          <standards>
+            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check on the application if there is a password change feature.&lt;/li&gt;&lt;li&gt;Check the previous password is needed and is validated before doing the actual change.&lt;/li&gt;&lt;li&gt;Check all active sessions are terminated after changing the password.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.500">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="57" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.099">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-255" name="Remove default credentials and role-based accounts from the application" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Security is often compromised through default or predictable account credentials, such as
+                        'admin/admin'. Best-practice dictates that accounts are only enabled when required, do not have
+                        common account names, and force users to choose unique strong passwords rather than using vendor
+                        defaults.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Ensure all default application and software accounts are disabled or removed if not
+                        required&lt;/li&gt;
+                        &lt;li&gt;Strong passwords should be set on accounts that are required, default credentials must
+                        be changed.&lt;/li&gt;
+                        &lt;li&gt;Build application accounts from a least-privilege perspective.&amp;nbsp;&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Accounts should only be enabled if required.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Users should have individual accounts rather than role-based ones (e.g. dave-admin,
+                        sue-admin rather than a shared 'admin' user)&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SC-12 Cryptographic Key Establishment And Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/72-08_02_SC-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify all the authentication points for this component.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that authentication with default credentials is not possible.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.222">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords-with-ui" name="Require the use of strong passwords with UI" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Passwords used either as sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password complexity. This should include:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt;&lt;li&gt;Use of pass-phrases using multiple words, achieving longer memorable passwords more resistant to attack.&lt;/li&gt;&lt;li&gt;Use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt;&lt;li&gt;Preventing or discouraging use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password length:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Password length considers the minimum and maximum length of characters comprising the password. For ease of changing this length, its implementation could be configurable using a properties file or xml configuration file.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Minimum length.&lt;/strong&gt;&lt;ul&gt;&lt;li&gt;Memory secrets should be at least 8 characters long.&lt;/li&gt;&lt;li&gt;Memory secrets generated automatically should be at least 6 numeric characters.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Maximum length.&amp;nbsp;&lt;/strong&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length.&amp;nbsp;Passwords with 64 characters or longer should be permitted.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password Complexity:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Passwords with consecutive multiple spaces should be coalesced and converted into only one space. After this modification, the password length should still be at least 12 characters long.&lt;/li&gt;&lt;li&gt;Unicode characters will be permitted in the password. A single Unicode code point is considered a character.&lt;/li&gt;&lt;li&gt;Reject those passwords commonly used and those leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords:&amp;nbsp;&lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt;&lt;li&gt;Plain text passwords must not be stored, to protect them against brute forcing if the database is compromised and screen reader support enabled.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;UI features:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Allow the "paste" functionality, browser password helpers, and external password managers.&lt;/li&gt;&lt;li&gt;Mask the entire password as typed, or show briefly the last typed character of the password on platforms that do no have this as native functionality.&lt;/li&gt;&lt;li&gt;Include a password strength meter in pages in which the password is created, to help users generate a stronger password.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Password Topologies:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ban commonly used password topologies.&lt;/li&gt;&lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt;&lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Additional Information:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems truncate the password at a length shorter than the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt;&lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt;&lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="NIST 800-63: Memorised secrets" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+            <reference name="Owasp CheatSheetSeries: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.11" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.12" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify passwords comply with the company policy for strong passwords.&lt;/li&gt;&lt;li&gt;If there is no policy, check the strength against industry standards such as NIST or OWASP.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;An example of strong password policy (&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt;&lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt;&lt;li&gt;at least 1 digit (0-9)&lt;/li&gt;&lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as a special character too&lt;/li&gt;&lt;li&gt;at least 10 characters&lt;/li&gt;&lt;li&gt;at most 128 characters&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;no more than 2 identical characters in a row (e.g., 111 not allowed).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.500">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.100">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.158">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PWD-RECOVER-OTP" name="Send time expired one time password/token (TOTP) in email" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks. Resetting passwords over email presents a risk of monitoring and interception, these threats can in part by mitigated by the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Create a unique token or password that compromises at least 128 bits of provably random data.&lt;/li&gt;&lt;li&gt;This token should be emailed to the registered email address of the user; for example, in&amp;nbsp;the form of a one time password, or a unique identifier in a URL.&lt;/li&gt;&lt;li&gt;The token should expire after a short period of time (long enough for the user to receive and process the email - 15 minutes at most and preferably less).&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;The password or token must be single use; the user must be required to choose a new password and the token should be immediately invalidated.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform the password reset process implemented by the component.&lt;/li&gt;&lt;li&gt;Check the recovery is done by using a one time token in an email.&lt;/li&gt;&lt;li&gt;For this one time token check it cannot be reused and it cannot be used after a short period of time.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.307">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.678">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-178-AUTH" name="The login function should distinguish between upper and lower case passwords" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Passwords used either as sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and use of strong passwords is critical. In addition to password quality criteria, it is important that the verification of passwords by the application does not reduce the character space, and therefore quality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The login function should distinguish between upper and lowercase passwords; for example PASSWORD should be considered different to password, Password, PASSword etc.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Reducing the character set by considering an uppercase or a lowercase as equivalent also reduces the Computational Complexity.&lt;/li&gt;&lt;li&gt;Reduction in character space reduces computational cost of brute-force or dictionary attacks against the credentials.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Create a user or if it is created change its password to "UPPERCASEPASSWORD".&lt;/li&gt;&lt;li&gt;Logout of the application.&lt;/li&gt;&lt;li&gt;Check if it is possible to log in again with this username and the password "uppercasepassword".&lt;/li&gt;&lt;li&gt;It should be denied.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.499">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="pseudo-random-number-generator" name="Use a cryptographically secure pseudo-random number generator" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use a well-vetted algorithm that is currently considered to be strong and secure by experts in the field and ensure well-tested implementation with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in a security-sensitive context.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure that all random numbers, especially those used for cryptographic parameters (keys, IV's, MAC tags), random file names, random GUIDs, and random strings are generated in a cryptographically strong fashion.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ensure that random algorithms are seeded with sufficient entropy, containing at least 112 bits of entropy (typically a six digit random number is sufficient).&amp;nbsp; If less than 112 bits of entropy, ensure salting with a unique and random 32-bit salt and hashed with an approved one-way hash.&lt;/p&gt;&lt;p&gt;Use a secure pseudo-random number generator ensuring it leverages an appropriate length seed. The recommendation by FIPS 140-2 is 256-bit seed.&lt;/p&gt;&lt;p&gt;Ensure that the challenge nonce was generated with at least 64 bits and it is unique over the lifetime of the cryptographic device.&lt;/p&gt;&lt;p&gt;Tools like NIST RNG Test tool (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The following libraries are considered weak random numbers generators and should not be used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;C library: random(), rand() instead use getrandom(2)&amp;nbsp;&lt;/p&gt;&lt;p&gt;Java library: java.util.Random() instead use java.security.SecureRandom&lt;/p&gt;&lt;p&gt;For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG, HASH-DRBG, HMAC-DRBG. Refer to NIST SP800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, and the testing toolkit.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST Security Policies for Random and Pseudorandom Number Generators for Cryptographic Applications" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+          </references>
+          <standards>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Check that an adequately strong algorithm is used to generate random values, and that those random values are of a minimum 256-bit seed.&lt;/span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-recovery-token-reset-account" name="Use a secure recovery token to reset an account password (such as a TOTP)" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The password/account recovery process must have equivalent security to the normal authentication process. It should be resistant to brute-force or network monitoring attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Having identified the user through secret questions/answers, the application should proceed with a secure reset process.&lt;/li&gt;&lt;li&gt;Passwords should not be sent in plain text (for example in an email), as they may be intercepted or monitored.&lt;/li&gt;&lt;li&gt;Instead, the application should verify the user's identity, and use a time-limited one-time password token (TOTP).&lt;/li&gt;&lt;li&gt;If a time-based multi factor OTP token is re-used during the validity period, it should be logged and rejected with secure notifications sent to the holder of the device.&lt;/li&gt;&lt;li&gt;Alternatively, the application could require the user enters a soft-token (e.g. Google authenticator), a mobile-push / SMS code, or previously established off-line recovery mechanism (for example a list of pre-defined recovery codes). It should be noted that use of a random value in an e-mail or SMS has known weaknesses, and should be considered a less secure option.&lt;/li&gt;&lt;li&gt;When the user provides the token, the application should verify their identity (for example through the use of a 'secret question', or verification of recent activity or transaction information).&lt;/li&gt;&lt;li&gt;If any token OTP has been sent in cases of theft or other loss, the validity of the token must be immediately and effectively revoked across the logged-in sessions.&lt;/li&gt;&lt;li&gt;The application should then require they choose a new password or phrase in line with the chosen policy.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Navigate through the password recovery process.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Check that a Time-Based One-Time Password token or a push message with a unique, one-use-only and valid for a given time (typically 1h) is used.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Check if a Time-Based One-Time Password token is used more than once, it is logged and notified.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.308">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="39" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:58.133">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:54.094">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.102">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:57.683">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-7.2" name="Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding" issueId="" issueLink="" platform="" cost="1" risk="89" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Encryption should fail closed so that data does not get stored in an unprotected state. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A padding oracle is a function of an application which decrypts encrypted data provided by the client, e.g. internal session state stored on the client, and leaks the state of the validity of the padding after decryption. The existence of a padding oracle allows an attacker to decrypt encrypted data and encrypt arbitrary data without knowledge of the key used for these cryptographic operations. This can lead to leakage of sensible data or to privilege escalation vulnerabilities, if integrity of the encrypted data is assumed by the application. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To protect against padding oracles you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct, it is cryptographically unlikely that the padding has been tampered with. 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note that padding oracle attacks are usually targeting services or protocols which can return a state about the encryption being done correctly or not, so encryption-in-transit architectures must be reviewed in detail to ensure no information about padding errors is exposed. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP WSTG: Testing Weak Cryptography" url="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography"/>
+            <reference name="SEI CERT Oracle Coding Standard for Java. MSC61-J. Do not use insecure or weak cryptographic algorithms" url="https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms"/>
+          </references>
+          <standards>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;b&gt;Testing for padding oracle vulnerabilities: &lt;/b&gt;
+                            &lt;br /&gt;
+                            &lt;p&gt; First the possible input points for padding oracles must be identified. Generally
+                            the following conditions must be met: &lt;/p&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt; The data is encrypted. Good candidates are values which appear to be random.&lt;/li&gt;
+                            &lt;li&gt; A block cipher is used. The length of the decoded (Base64 is used often) cipher
+                            text is a multiple of common cipher block sizes like 8 or 16 bytes. Different cipher texts
+                            (e.g. gathered by different sessions or manipulation of session state) share a common
+                            divisor in the length.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:53.178">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide. Testing for Padding Oracle (OTG-CRYPST-002)" url="https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-FEATURES" name="Verify the application correctly implements the security features needed according to its security level" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+ &lt;div&gt;
+   The security controls in place will in part be defined by the nature of the application. A low security unauthenticated application will have different requirements to an application providing transactional capabilities in a finance system, for example.
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+   &lt;li&gt;Implement features around security like authentication, access control, confidentiality, cryptography, and privilege management based on the principle of 'fit for purpose' (appropriate to the application).&lt;/li&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the application implementation against the design and security features needed.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:55.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="76" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:56.221">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CSD-DEF-PWD" name="Attackers gain access to the system using default passwords" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Default passwords are usually public or can be obtained from manuals or technical data sheets. An attacker may use them to gain access to a system or user data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-255">
+                  <countermeasures>
+                    <countermeasure ref="CWE-255" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-255" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-AUTH-HASH" name="Attackers gain access to user accounts by accessing the password database" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker with access to the plain, readable credential database would have access
+                                to the system as any of those users.&amp;nbsp;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-916">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-AUTH_BYPASS" name="Attackers gain access to user accounts by exploiting flaws in the authentication function" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The authentication mechanism itself can be attacked in order to exploit flaws in its design or implementation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-636">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.2" mitigation="25"/>
+                <countermeasure ref="CWE-306-AUTH" mitigation="25"/>
+                <countermeasure ref="CWE-603" mitigation="25"/>
+                <countermeasure ref="SEC-FEATURES" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="7k-CWE-TimeState" name="Attackers gain unauthorised access to the application because of time and state management issues" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This weakness is related to the&amp;nbsp;improper&amp;nbsp;management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.&lt;/p&gt;&lt;p&gt;Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all of this takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to&amp;nbsp;unexpected&amp;nbsp;interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-367">
+                  <countermeasures>
+                    <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-367-TOCTOU" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SPOOF-ENDPOINT" name="Attackers might be able to spoof a component from a different system or process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The vulnerability allows attackers to spoof a component from a different system or process, thereby gaining the same level of access as the intended endpoint. Spoofing refers to the act of falsifying or mimicking the identity of a legitimate user or system. This component can be also known as an endpoint. In IT, an endpoint is a remote computing device that communicates back and forth with a network to which it is connected, which should not be mistaken by an API endpoint, which is an URIs (Uniform Resource Identifiers) on an API that an application can access.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Attackers can use various techniques to spoof the identity of the intended endpoint, such as IP address spoofing or DNS spoofing. By spoofing the endpoint, attackers can trick the system into thinking that they have the same level of access as the intended endpoint. This vulnerability is a significant threat to the security of network-based communication systems. It can allow attackers to gain unauthorized access to sensitive data or systems, and even take control over the targeted device or network.&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, an attacker could use this vulnerability to gain access to a corporate network or steal sensitive information transmitted between two endpoints.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-923">
+                  <countermeasures>
+                    <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-923-SEGREG" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319-AUTH">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-178-AUTH">
+                  <countermeasures>
+                    <countermeasure ref="CWE-178-AUTH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-620">
+                  <countermeasures>
+                    <countermeasure ref="password-change-facility" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-654">
+                  <countermeasures>
+                    <countermeasure ref="CWE-654" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-178-AUTH" mitigation="25"/>
+                <countermeasure ref="CWE-654" mitigation="25"/>
+                <countermeasure ref="password-change-facility" mitigation="25"/>
+                <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-102" name="Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Session side-jacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim.
+&lt;br /&gt;This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-523">
+                  <countermeasures>
+                    <countermeasure ref="CWE-603" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-603" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-112-USERNAME" name="User accounts compromised through username guessing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Attackers could perform a brute force attack against the login function by choosing a
+                                simple password that users are likely to use for the site, and that meets the site's
+                                password policy.
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Then they could use an automated script to iterate through a list of
+                                possible usernames. &amp;nbsp;These could be obtained from a dictionary, or generated
+                                through pure brute force means. &amp;nbsp;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                This type of attack cannot be defended against using an account lockout policy because
+                                each username is only attempted once.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-307">
+                  <countermeasures>
+                    <countermeasure ref="network-rate-limit" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="network-rate-limit" mitigation="50"/>
+                <countermeasure ref="require-use-strong-passwords-with-ui" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-204-USERNAME-LOGIN" name="Usernames could be enumerated through login responses" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Usernames could be enumerated through the login feature if it returns error messages that allow attackers to infer whether the username or password was incorrect.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;For example, consider the following behavior: An attacker attempts a username that existed on the system, but an incorrect password, and the system responds with the message: "Incorrect password". Then the attacker attempts a username that definitely does not exist in the system, and the system responds with the message: "Username not recognized".&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Then the attacker can use automated scripts and typical usernames to create a list of usernames registered in the system.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-204">
+                  <countermeasures>
+                    <countermeasure ref="CWE-204-USERNAME-LOGIN" mitigation="50"/>
+                    <countermeasure ref="error-handling-centralized" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-204-USERNAME-LOGIN" mitigation="50"/>
+                <countermeasure ref="error-handling-centralized" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="PASSWORD RESET" name="Password reset" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-633" name="An adversary exploits a weakness in authentication to create an access token to associate a process/thread" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="password-reset-email-best-practices" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="password-reset-email-best-practices" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-AUTH-PWD" name="Attackers gain access to the system by accessing current user's password" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If an attacker has access to the password exchange method when the user resets his
+                                password, he would have access to the system as this user.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-2.17" mitigation="50"/>
+                    <countermeasure ref="password-reset-email-best-practices" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-2.17" mitigation="50"/>
+                <countermeasure ref="password-reset-email-best-practices" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-158-PWD-IN-EMAIL" name="Password sent over email or SMS is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;If the user's password is sent to them in email then attackers could perform network sniffing attacks if they are on the same network as the victim, for example, on the same WiFi network. Attackers would then be able to access the users' account without the user's knowledge.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CS-EMAIL-COMP">
+                  <countermeasures>
+                    <countermeasure ref="secure-recovery-token-reset-account" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-319-PWD">
+                  <countermeasures>
+                    <countermeasure ref="PWD-RECOVER-OTP" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PWD-RECOVER-OTP" mitigation="50"/>
+                <countermeasure ref="secure-recovery-token-reset-account" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="SENSITIVE READ OR POST DATA" name="Sensitive Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CWE-256" name="Users' passwords are compromised if the storage medium is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>A compromise of the storage system medium itself (device, server or database) could
+                                allow attackers full access to the data
+                                stored, including authentication credentials such as passwords.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-257">
+                  <countermeasures>
+                    <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE-SENSITIVE-DATA" name="Store sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-151" name="An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an attacker may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the identity of the message, but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-287">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-474" name="An attacker obtains an authoritative or reputable signer's private signature key by theft" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                theft and then uses this key to forge signatures from the original signer to mislead a
+                                victim into performing actions that benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-320">
+                  <countermeasures>
+                    <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSD-KEY-MGMT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-485" name="An attacker obtains an authoritative signer's private signature key by exploiting a cryptographic weaknesses" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker obtains an authoritative or reputable signer's private signature key by
+                                exploiting a cryptographic weakness in the signature algorithm or pseudorandom number
+                                generation and then uses this key to forge signatures from the original signer to
+                                mislead a victim into performing actions which benefit the attacker.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-330">
+                  <countermeasures>
+                    <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-345">
+                  <countermeasures>
+                    <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-693">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-7.2" mitigation="25"/>
+                <countermeasure ref="STRONG-ALGORITHMS-PROTOCOLS" mitigation="25"/>
+                <countermeasure ref="follow-jwt-standard-generation-token" mitigation="25"/>
+                <countermeasure ref="pseudo-random-number-generator" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-20" name="Attackers perform an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-326">
+                  <countermeasures>
+                    <countermeasure ref="crypto-operations" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="crypto-operations" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="6f118fe6-16ab-4f20-9fa3-02963db2cd15" diagramComponentId="c512c7e1-8fac-441e-8507-18dc7409a63d" ref="359eac88-b8b9-4af4-a01a-5291c0ecf82d" name="AWS RDS (Relational Database Service)" desc="" library="" parentComponentRef="" componentDefinitionRef="rds">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Customer Data" accessType="10"/>
+        <asset name="Customer Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="database-publically-accesible" name="Database is publically accesible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Everyone can access the RDS database and obtain the data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.251">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-IAM-2.7" name="Misconfigured credentials for groups and roles" state="0" impact="100" issueId="" issueLink="">
+          <desc>Credentials for groups and roles not properly configured. User accounts are configured with excessive privileges.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-Network-5.2" name="Networks for Amazon resources are not properly segmented" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Without proper segmentation, when attackers gain access to one resource, any other resources in the same VNet are compromised.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.246">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-notification-incident" name="No notification when an incident occurs" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no notifications when a security incident occurs. Therefore, we do not know when an
+                        attacker gains access to our systems and/or security systems
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="no-access-control-onrds" name="Not access control on RDS databases" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no access control mechanisms on the RDS database resources and any user can gain access
+                        to them and exfiltrate the data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.247">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="NOT_BACKUP_POLICIES" name="Not backup retention policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no data backup retention policies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.249">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-EC2-6.2" name="The instances are not patched with the latest vendor updates or are misconfigured" state="0" impact="100" issueId="" issueLink="">
+          <desc>The latest vendor updates that ensure that the systems are not vulnerable have not been applied to the systems.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.248">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-RDS-02" name="Assign to IAM roles the permissions for RDS instances" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The following AWS managed policies, which you can attach to users in your account, are
+                        specific to Amazon RDS:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;AmazonRDSReadOnlyAccess:&lt;/b&gt; Grants read-only access to all Amazon RDS
+                        resources for the root AWS account.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;&lt;b&gt;AmazonRDSFullAccess:&lt;/b&gt; Grants full access to all Amazon RDS resources
+                        for the root AWS account.&lt;/li&gt;
+                        &lt;/ul&gt;You can also create custom IAM policies that allow users to access the required
+                        Amazon RDS API actions and resources. You can attach these custom policies to the IAM users or
+                        groups that require those permissions.
+                        &lt;br /&gt;
+                        &lt;br /&gt;The permissions above shall be assigned to roles or groups:
+                        &lt;br /&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;The roles or groups only do calls to the API to get information, the
+                        AmazonRDSReadOnlyAccess permission shall be assigned.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The roles or groups who are responsible of managing the RDS instances shall be
+                        assigned the AmazonRDSFullAccess permission.&lt;/li&gt;
+                        &lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+                            &lt;li&gt;Review the IAM roles and groups.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check that all roles or groups have got the AmazonRDSReadOnlyAccess permission.&lt;/li&gt;
+                            &lt;li&gt;Check that only the appropriate personnel have got AmazonRDSFullAccess permissions
+                            to manage the RDS instances.&lt;/li&gt;
+                            &lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.103">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.34" name="Configure RDS database to leverage the Data Tier Security Group" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+  Customers can deploy RDS databases within a VPC through the configuration of: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
+  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
+  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
+  &lt;li&gt;Network access to the managed Data-Tier must be tightly controlled using Security Groups for RDS and non local accessibility of the DB instance.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation: &lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each non-compliant DB instance, and configure it to use the Data Tier Security Group:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --vpc-security-group-ids &amp;lt;data_tier_security_group&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.34" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are configured to use the Data Tier
+                            Security Group:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{VpcSecurityGroups:VpcSecurityGroups,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.30" name="Do not allow the RDS database to be publically accessible" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt;Customers can deploy RDS databases within a VPC through the configuration of: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Subnet Group for RDS, this group will be used for deployment of single or Multi-AZ RDS instances.&lt;/li&gt; 
+  &lt;li&gt;Network access through configuration of Security Groups for RDS&lt;/li&gt; 
+  &lt;li&gt;Access from outside the VPC hosting the DB instance by enabling/disabling a Public IP address&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each publicly accessible DB instance, and make it private:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --no-publicly-accessible 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.3.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="6.30" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are publicly available:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{PubliclyAccessible:PubliclyAccessible,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.6" name="Enable Auto Minor Version Upgrade on RDS" issueId="" issueLink="" platform="" cost="1" risk="75" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair.&lt;/p&gt; 
+&lt;p&gt;There are 6 database engines available for customers to run their database workloads on:&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+ &lt;li&gt;MySQL&lt;/li&gt; 
+ &lt;li&gt;MariaDB&lt;/li&gt; 
+ &lt;li&gt;Oracle&lt;/li&gt; 
+ &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+ &lt;li&gt;PostgreSQL&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;If the database engine used by your application supports it, ensure that the RDS Instances have Auto Minor Version Upgrade Enabled.&lt;/p&gt; 
+&lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt; 
+&lt;p&gt;Using the Amazon unified command line interface:&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Modify each DB instance with auto-minor-version-upgrade set to False, and enable auto-minor-version-upgrade:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;p&gt;aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --auto-minor-version-upgrade&lt;/p&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="2.3.2" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.6" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances have Auto Minor Version Upgrade enabled:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{AutoMinorVersionUpgrade:AutoMinorVersionUpgrade,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.4" name="Enable encryption at rest for Databases running on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon RDS instances and snapshots can be encrypted at rest by enabling the encryption option on the Amazon RDS DB instance. Data that is encrypted at rest includes the underlying storage for a DB instance, its automated backups, read replicas, and snapshots. Encryption at rest should be enabled. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+  Using the Amazon unified CLI: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Perform a snapshot of the DB instance:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds create-db-snapshot --db-snapshot-identifier db_snapshot --db-instance-identifier your_db_instance 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Confirm created snapshot is available (once snapshot process has completed):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds describe-db-snapshots --query 'DBSnapshots[*].{DBSnapshotIdentifier:DBSnapshotIdentifier, DBInstanceIdentifier:DBInstanceIdentifier, Snapshotstatus:Status}' 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List all KMS Customer Managed Keys:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws kms list-aliases 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Copy to source RDS snapshot (from previous step) to a destination snapshot which will be encrypted:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt;
+   aws rds copy-db-snapshot --source-db-snapshot-identifier db_snapshot&amp;nbsp; --target-db-snapshot-identifier encrypted_db_snapshot --kms-key-id data_tier_kms_key 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Restore a snapshot to the target DB instance(from previous step) with the same values as original db instance with additional encrypted storage values:&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws rds restore-db-instance-from-db-snapshot --db-instance-identifier your_db_instance --db-snapshot-identifier encrypted_db_snapshot 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: copy db snapshot" url="https://docs.aws.amazon.com/cli/latest/reference/rds/copy-db-snapshot.html"/>
+            <reference name="Amazon docs: copy snapshot" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html"/>
+            <reference name="Amazon docs: create db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html"/>
+            <reference name="Amazon docs: create db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-snapshot.html"/>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: describe db snapshots" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-snapshots.html"/>
+            <reference name="Amazon docs: encryption" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html"/>
+            <reference name="Amazon docs: list aliases" url="https://docs.aws.amazon.com/cli/latest/reference/kms/list-aliases.html"/>
+          </references>
+          <standards>
+            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.3.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all current RDS instances and review the encryption status of the DB
+                            instance:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws rds describe-db-instances --query 'DBInstances[*].{DBName:DBName,
+                            EncryptionEnabled:StorageEncrypted, CMK:KmsKeyId}'
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.4" name="Enable event subscriptions for DataBase security on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;AWS Relational Database Services offers customers a managed database engine solution
+                        for hosting customer created databases which can allow for a reduction in operational burden on
+                        customers.&lt;/p&gt;
+                        &lt;p&gt;RDS event subscriptions provide notification of selected event changes at a DB security
+                        group level.&lt;/p&gt;
+                        &lt;p&gt;Event subscriptions are designed to provide incident notification of events which may
+                        affect the network availability of the RDS instance.&lt;/p&gt;
+                        &lt;p&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;/p&gt;
+                        &lt;p&gt;Using the Amazon unified CLI:&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Create a new event subscription for DB Security Group events:&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;p&gt;aws rds create-event-subscription --subscription-name rds_event_subscription
+                        --sns-topic-arn
+                        sns_topic_arn
+                        --source-type db-security-group --event-categories rds_events
+                        --source-ids events_source_ids --enabled&lt;/p&gt;
+                        &lt;/blockquote&gt;
+                        &lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.4" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified CLI:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-security-group&amp;quot;
+                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-event-subscriptions --query
+                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
+                            EventCategoriesList:EventCategoriesList}'
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
+                            reported on
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
+                            instances)
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.105">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-4.3" name="Enable Event subscriptions for Instance level events on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  AWS Relational Database Services offers customers a managed database engine solution for hosting customer created databases which can allow for a reduction in operational burden on customers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  RDS event subscriptions provide notification of selected event changes at DataBase engine level such as: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Deletion&lt;/li&gt; 
+  &lt;li&gt;Failure&lt;/li&gt; 
+  &lt;li&gt;Failover&lt;/li&gt; 
+  &lt;li&gt;Low Storage&lt;/li&gt; 
+  &lt;li&gt;Maintenance&lt;/li&gt; 
+ &lt;/ul&gt; 
+  Event subscriptions are designed to provide incident notification of events which may affect the availability of a RDS database instance. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified CLI: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Create a new event subscription for DB instance level events:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds create-event-subscription --subscription-name &amp;lt;rds_event_subscription&amp;gt; --sns-topic-arn sns_topic_arn --source-type &amp;lt;db-instance&amp;gt; --event-categories &amp;lt;rds_events&amp;gt; --source-ids &amp;lt;events_source_ids&amp;gt; --enabled 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: create event subscription" url="https://docs.aws.amazon.com/cli/latest/reference/rds/create-event-subscription.html"/>
+            <reference name="Amazon docs: describe event subcriptions" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-event-subscriptions.html"/>
+            <reference name="Amazon docs: user event messages" url="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html#USER_Events.Messages"/>
+          </references>
+          <standards>
+            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="4.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified CLI:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all present event subscriptions and review the value of &amp;quot;db-instance&amp;quot;
+                            associated with &amp;quot;SourceType&amp;quot; element:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-event-subscriptions --query
+                            'EventSubscriptionsList[*].{SourceType:SourceType, SourceIdsList:SourceIdsList,
+                            EventCategoriesList:EventCategoriesList}'
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &amp;quot;EventCategoriesList&amp;quot; will list all event categories which will be
+                            reported on
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &amp;quot;SourceIdsList&amp;quot; will list all RDS DB instances included (null=all
+                            instances)
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.5" name="Enable Multi-AZ on RDS" issueId="" issueLink="" platform="" cost="1" risk="55" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Provides AWS managed high availability of the Database Tier across 2 availability zones within a region through asynchronous replication at the data layer. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br /&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each no-multi-az DB instance, and make it Multi-AZ enabled:&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --multi-az 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.5" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances are Multi-AZ enabled:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{MultiAZ:MultiAZ,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.8" name="Set Backup retention policy on RDS" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Amazon Relational Database Service (RDS) is a managed relational database service which handles routine database tasks such as provisioning, patching, backup, recovery, failure detection, and repair. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  There are 6 database engines available for customer to run their database workloads on: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Amazon Aurora (MySQL Compatible)&lt;/li&gt; 
+  &lt;li&gt;MySQL&lt;/li&gt; 
+  &lt;li&gt;MariaDB&lt;/li&gt; 
+  &lt;li&gt;Oracle&lt;/li&gt; 
+  &lt;li&gt;Microsoft SQL Server&lt;/li&gt; 
+  &lt;li&gt;PostgreSQL&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Provides a managed backup function of the RDS Database, it is possible to define the backup window and retention period of the backup. Each customer should have a retention policy set for the type of data being stored. It is recommended to set this to at least 7. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Possible values are from 0 to 35 days. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Using the Amazon unified command line interface: 
+ &lt;/div&gt; 
+ &lt;div style=""&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Modify each DB instance with a Backup Retention Period of 0, and set a desired Backup Retention Period in days (recommended value = 7):&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div style=""&gt;
+     aws rds modify-db-instance --db-instance-identifier &amp;lt;your_db_instance&amp;gt; --backup-retention-period &amp;lt;backup_retention_period&amp;gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon docs: describe db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"/>
+            <reference name="Amazon docs: modify db instances" url="https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html"/>
+          </references>
+          <standards>
+            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.8" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check if your application DB instances have a Backup Retention Period set (0 =
+                            there is no backup retention in place, 7 = there are 7 daily backups retained):&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;div&gt;
+                            aws rds describe-db-instances --filters Name=tag:data_tier_tag,Values=data_tier_tag_value
+                            --query &amp;quot;DBInstances[*].{BackupRetentionPeriod:BackupRetentionPeriod,
+                            DBInstanceIdentifier:DBInstanceIdentifier}&amp;quot;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-RDS-01" name="Use SSL to Encrypt the connection to a DB Instance" issueId="" issueLink="" platform="" cost="1" risk="69" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Use SSL from your application to encrypt a connection to a DB instance running MySQL, MariaDB,
+                        Amazon Aurora, SQL Server, Oracle, or PostgreSQL. Each DB engine has its own process for
+                        implementing SSL. To learn how to implement SSL for your particular DB instance, please see link
+                        provided in &amp;quot;References&amp;quot; section.</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the SSL protocol is used to encrypt the data in transit.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON WEB SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="NON-UPDATED-SYSTEMS-AWS" name="Attackers gain unauthorized access to data on EC2 instances" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>Attackers gain access to data on EC2 instances by exploiting weaknesses in non-updated or misconfigured systems.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-EC2-6.2">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.6" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.6" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AWS-LOSS-CONTROL-ENV" name="Attackers gain unauthorized access to the control of the environment" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized access to the control of the environment, due to improper definition and configuration of user accounts or role groups.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="75" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-IAM-2.7">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-RDS-02" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-CONECTIONS-AWS" name="Attackers gain unauthorized network access" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers could gain unauthorized network access to the resources through misconfigured ports or security network configurations.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-Network-5.2">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.5" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="database-publically-accesible">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.30" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="no-access-control-onrds">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.34" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.5" mitigation="34"/>
+                <countermeasure ref="aws-tier-6.30" mitigation="33"/>
+                <countermeasure ref="aws-tier-6.34" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-SECURITY-SYSTEMS-AWS" name="Attackers gain undetected access to the security system configurations" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers gain undetected access to the security configurations and changes made by the attackers are undetected and unaudited.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="no-notification-incident">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-4.3" mitigation="50"/>
+                    <countermeasure ref="aws-tier-4.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-4.3" mitigation="50"/>
+                <countermeasure ref="aws-tier-4.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="NOT_BACKUP_POLICIES">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-3.8" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-3.8" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-1.4" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="Hydras-AWS-RDS-01" mitigation="50"/>
+                <countermeasure ref="aws-tier-1.4" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="c44e3e92-8a8c-4efc-8c00-0762ea4d8889" diagramComponentId="807eb8fa-2f36-40c2-89ba-76e952dc3f14" ref="0dabda18-f39e-4929-96e0-83f231b84abe" name="MongoDB NoSQL" desc="" library="" parentComponentRef="" componentDefinitionRef="mongodb-nosql">
+      <tags/>
+      <questions>
+        <question ref="encryptedTransport" answer="true" manuallyModified="false"/>
+        <question ref="userPassAuth" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets>
+        <asset name="Credit Card Data" accessType="10"/>
+        <asset name="Credit Card Data" accessType="50"/>
+      </assets>
+      <settings/>
+      <weaknesses>
+        <weakness ref="PCI-R3-3.x" name="Cardholder data is unprotected on the system" state="0" impact="100" issueId="" issueLink="">
+          <desc>This covers 3.1 and 3.5 from PCI-DSS</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.228">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319-AUTH" name="Cleartext Transmission of Authentication Credentials" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication
+                        channel that can be sniffed by unauthorized actors.&amp;nbsp;&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;Many communication channels can be &amp;quot;sniffed&amp;quot; by attackers during
+                        data transmission. For example, network traffic can often be sniffed by any attacker who has
+                        access to a network interface. This significantly lowers the difficulty of exploitation by
+                        attackers.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.538">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-319: Cleartext Transmission of Sensitive Information" url="https://cwe.mitre.org/data/definitions/319.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.100">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-943" name="Improper Neutralization of Special Elements in Data Query Logic" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.&lt;/p&gt;&lt;p&gt;Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated&lt;/li&gt;&lt;li&gt;Append additional commands to the query&lt;/li&gt;&lt;li&gt;Return more entities than intended&lt;/li&gt;&lt;li&gt;Return fewer entities than intended&lt;/li&gt;&lt;li&gt;Cause entities to be sorted in an unexpected way&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The ability to execute additional commands or change which entities are returned has obvious risks. But when the application logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the application query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges.&lt;/p&gt;&lt;p&gt;While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and NoSQL languages.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.465">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-943: Improper Neutralization of Special Elements in Data Query Logic" url="https://cwe.mitre.org/data/definitions/943.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.334">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.833">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.833">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-521" name="Poor quality passwords in use" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not enforce a strong password policy, which makes it easier for attackers to compromise user accounts through brute force or dictionary based attacks.
+
+An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.334">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-521: Weak Password Requirements" url="https://cwe.mitre.org/data/definitions/521.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="UNRESTRICTED-NETWORK" name="Service is exposed to a wide attack surface" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product is exposed or reachable by an unnecessarily large group of potential attackers. An over-exposure of a component increases the chance of an attacker gaining access to the system through a vulnerability.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:50.333">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA" name="Unrecovered sensitive data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The sensitive data cannot be recovered after the data has been accidentally or intentionally deleted due to non-existent data backup.
+          </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.831">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="71" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.010">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-backups-securely" name="Encrypt Backups securely on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Sensitive data and Backups of sensitive data shall be stored securely by encryption (data at rest).
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption should be used to protect the data.&lt;/li&gt;
+  &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent storage.&lt;/li&gt;
+  &lt;li&gt;The key for encrypting and decrypting the data should not be accessible from the same host.&amp;nbsp;&lt;/li&gt;
+  &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+  &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference to a bespoke implementation).&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="8.1.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check the functions of the application which are storing backups with sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.710">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="63" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.382">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-311-AT-REST" name="Encrypt data stored on the host (data at rest)" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        &lt;div&gt;
+                        Data stored on the server or the client must be protected by encryption (data
+                        &lt;i&gt;at rest&lt;/i&gt;).
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographically strong symmetric or asymmetric (public-key) encryption&amp;nbsp;should
+                        be used to protect the data.&lt;/li&gt;
+                        &lt;li&gt;Encryption should be performed before the data is written to disk or other persistent
+                        storage.&lt;/li&gt;
+                        &lt;li&gt;The key for encrypting and decrypting the data should &lt;i&gt;not&lt;/i&gt; be
+                        accessible from the same host.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The encryption and decryption operation should be performed on a different host.&lt;/li&gt;
+                        &lt;li&gt;A recognized, proven, and tested implementation/library should be used (in preference
+                        to a bespoke implementation).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="6.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the functions of the application which are storing sensitive data.&lt;/li&gt;&lt;li&gt;For each of the functions check they are using an external service to encrypt the data.&lt;/li&gt;&lt;li&gt;Check that neither the sensitive data nor the keys used to encrypt the data are stored on the host after the encryption process completes.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.708">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="60" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.625">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-BACKUP" name="Implement a Backup and Recovery process" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure backup policy is active and tested.The policy should describe the required recovery time objective (RTO) and recovery point objective (RPO) so that the availability of personal data can be restored in a timely manner (based upon the requirements specified by the DPO/CISO).
+          &lt;br /&gt;&lt;br /&gt;
+          Ensure an SLA has been defined for data availability. How 'timely manner' will be interpreted depends on your SLA. 
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="8.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                &lt;ol&gt;
+                &lt;li&gt;Verify backup policy documentation exists that are up-to-date and in compliance with the requirements of the Data Protection Practitioner.&lt;/li&gt;
+                &lt;li&gt;Regularly test data backup procedures and data restoration.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.711">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.1-C" name="Keep cardholder data storage to a minimum" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;A formal data retention policy identifies what data needs to be retained, for how long, and where that data resides so it can be securely destroyed or deleted as soon as it is no longer needed. The only account data that may be stored after authorization is the primary account number or PAN (rendered unreadable), expiration date, cardholder name, and service code.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The storage of SAD data prior to the completion of the authorization process is also included in the data retention and disposal policy so that storage of this sensitive data is kept to minimum, and only retained for the defined amount of time.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;When identifying locations of stored account data, consider all processes and personnel with access to the data, as data could have been moved and stored in different locations than originally defined. Storage locations that are often overlooked include backup and archive systems, removable data storage devices, paper-based media, and audio recordings.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To define appropriate retention requirements, an entity first needs to understand its own business needs as well as any legal or regulatory obligations that apply to its industry or to the type of data being retained. Implementing an automated process to ensure data is automatically and securely deleted upon its defined retention limit can help ensure that account data is not retained beyond what is necessary for business, legal, or regulatory purposes.&lt;/p&gt;&lt;p&gt;Methods of eliminating data when it exceeds the retention period include secure deletion to complete removal of the data or rendering it unrecoverable and unable to be reconstructed. Identifying and securely eliminating stored data that has exceeded its specified retention period prevents unnecessary retention of data that is no longer needed. This process may be automated, manual, or a combination of both.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The deletion function in most operating systems is not "secure deletion" as it allows deleted data to be recovered, so instead, a dedicated secure deletion function or application must be used to make data unrecoverable.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Remember, if you don't need it, don't store it!&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;An automated, programmatic procedure could be run to locate and remove data, or a manual review of data storage areas could be performed. Whichever method is used, it is a good idea to monitor the process to ensure it is completed successfully, and that the results are recorded and validated as being complete. Implementing secure deletion methods ensures that the data cannot be retrieved when it is no longer needed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Further Information&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;See NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.1" supportedStandardRef="pci-sss"/>
+            <standard ref="3.1" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.2" supportedStandardRef="pci-sss"/>
+            <standard ref="3.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="3.3" supportedStandardRef="pci-sss"/>
+            <standard ref="3.4" supportedStandardRef="pci-sss"/>
+            <standard ref="3.5" supportedStandardRef="pci-sss"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.2.1.a: Examine the data retention and disposal policies, procedures, and processes and interview personnel to verify processes are defined to include all elements specified in this requirement.&lt;/li&gt;&lt;li&gt;3.2.1.b: Examine files and system records on system components where account data is stored to verify that the data storage amount and retention time does not exceed the requirements defined in the data retention policy.&lt;/li&gt;&lt;li&gt;3.2.1.c: Observe the mechanisms used to render account data unrecoverable to verify data cannot be recovered.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;PCI-SSS Requirements:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;3.1.a: The assessor shall examine vendor evidence to identify what sensitive data is collected by the software for use beyond any one transaction, the default time period for which it is retained, and whether the retention period is user-configurable, and to confirm vendor evidence includes reasonable justification for retaining the sensitive data.&lt;/li&gt;&lt;li&gt;3.1.b: The assessor shall test the software to confirm that all available functions or services designed for the retention of sensitive data are supported by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.1.c: The assessor shall test the software to confirm that sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected during storage in accordance with Control Objective 6. Any such functionality that allows for storage of sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user and retained only for the duration necessary in accordance with reasonable vendor criteria. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any sensitive data is securely deleted per Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.1.d: Where user input or interaction is required to configure the retention period of sensitive data, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.2.a: The assessor shall examine vendor evidence to identify all sensitive data that is retained by the software for transient use, what triggers the secure deletion of this data, and confirm reasonable justification exists for retaining the data. This includes data that is stored only in memory during the operation of the software.&lt;/li&gt;&lt;li&gt;3.2.b: The assessor shall test the software to confirm that all available functions or services that retain transient sensitive data are supported by vendor evidence and do not use immutable objects.&lt;/li&gt;&lt;li&gt;3.2.c: The assessor shall test the software to confirm that transient sensitive data stored solely for the purposes of debugging, error finding, or testing of systems is protected in accordance with Control Objective 6. Any such functionality that allows for the storage of transient sensitive data must be explicitly enabled through an interface that requires interaction and authorization by the user. Closure of the software must result in termination of this debugging state, such that it requires explicit re-enablement when the software is next executed; and any transient sensitive data is securely deleted in accordance with Control Objective 3.4.&lt;/li&gt;&lt;li&gt;3.2.d: Where users can configure retention of transient sensitive data, the assessor shall examine vendor evidence to confirm that clear and sufficient guidance on this process is provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.3.a: The assessor shall examine the vendor evidence to identify the protection methods implemented for all sensitive data during storage and transmission.&lt;/li&gt;&lt;li&gt;3.3.b: The assessor shall test the software to confirm that no additional storage of sensitive data is included.&lt;/li&gt;&lt;li&gt;3.3.c: Where sensitive data is stored outside of temporary variables within the code itself, the assessor shall test the software to confirm that sensitive data is protected using either strong cryptography or other methods that provide an equivalent level of security.&lt;/li&gt;&lt;li&gt;3.3.d: Where protection methods use cryptography, the assessor shall examine vendor evidence and test the software to confirm that the cryptographic implementation complies with Control Objective 7 of this standard.&lt;/li&gt;&lt;li&gt;3.3.e: Where sensitive data is protected using methods other than strong cryptography, the assessor shall examine vendor evidence and test the software to confirm that the protections are present in all environments where the software is designed to be executed, are correctly implemented, and are covered by the vendor evidence.&lt;/li&gt;&lt;li&gt;3.3.f: Where users are required to configure protection methods, the assessor shall examine vendor evidence to confirm that there is clear and sufficient guidance on this process provided in the software vendor's implementation guidance made available to stakeholders per Control Objective 12.1.&lt;/li&gt;&lt;li&gt;3.4.a: The assessor shall examine vendor evidence to identify all secure deletion methods implemented by the software for all non-transient sensitive data.&lt;/li&gt;&lt;li&gt;3.4.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the secure deletion of non-transient sensitive data and to confirm that any non-transient sensitive data is securely deleted using a method that ensures that the data is unrecoverable after deletion. Methods may include (but are not necessarily limited to) overwriting the data, deletion of cryptographic keys (of sufficient strength) which have been used to encrypt the data, or platform specific functions which provide for secure deletion. Methods must accommodate for platform specific issues, such as flash wear-leveling algorithms or SSD over-provisioning, which may complicate simple over-writing methods.&lt;/li&gt;&lt;li&gt;3.4.c: The assessor shall test the software using forensic tools to identify any non-transient sensitive data residue in the execution environment, and to confirm that the methods attested by the software vendor are correctly implemented and applied to all sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data (e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements), as well as covering all non-transient sensitive data types.&lt;/li&gt;&lt;li&gt;3.5.a: The assessor shall examine vendor evidence to identify all secure deletion methods for all transient sensitive data and to confirm that these methods ensure that the data is unrecoverable after deletion.&lt;/li&gt;&lt;li&gt;3.5.b: The assessor shall examine vendor evidence and test the software to identify any platform or implementation level issues that complicate the erasure of such transient sensitive data-such as abstraction layers between the code and the hardware execution environment-and to confirm what methods have been implemented to minimize the risk posed by these complications.&lt;/li&gt;&lt;li&gt;3.5.c: The assessor shall test the software, including usage of forensic tools, to identify any sensitive data residue in the execution environment to confirm that the methods attested by the software vendor are correctly implemented and applied to all transient sensitive data. This analysis should accommodate for the data structures and methods used to store the sensitive data-e.g., by examining file systems at the allocation level, and translating data formats to identify sensitive data elements-as well as cover all non-transient sensitive data types.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.123">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.348">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="71" state="Required" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.625">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="70" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="NIST 800-63: Memorised secrets" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C6]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+            <reference name="Owasp CheatSheetSeries: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.360">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.359">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.5.4-C" name="Store cryptographic keys in the fewest possible locations" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing any cryptographic keys in the fewest locations helps an organization track and monitor all key locations and minimizes the potential for keys to be exposed to unauthorized parties.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.5.4" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.6.1.4" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.4: Examine key storage locations and observe processes to verify that keys are stored in the fewest possible locations.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PCI-R3-3.5.3-C" name="Store securely secret and private keys used to encrypt/decrypt" issueId="" issueLink="" platform="" cost="0" risk="86" state="Recommended" owner="rgy@demandbase.com" library="PCI-DSS" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Storing cryptographic keys securely prevents unauthorized or unnecessary access that could result in the exposure of stored account data. Storing keys separately means they are stored such that if the location of one key is compromised, the second key is not also compromised.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Good Practice&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Where data-encrypting keys are stored in an HSM, the HSM interaction channel should be protected to prevent interception of encryption or decryption operations.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Payment Card Industry Data Security Standard (PCI-DSS) v4.0" url="https://www.pcisecuritystandards.org/documents/PCI-DSS-v4_0.pdf"/>
+          </references>
+          <standards>
+            <standard ref="3.5.3" supportedStandardRef="PCI-DSS-v3.2.1"/>
+            <standard ref="3.6.1.2" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;3.6.1.2.a: Examine documented procedures to verify it is defined that cryptographic keys used to encrypt/decrypt stored account data must exist only in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.b: Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.&amp;nbsp;&lt;/li&gt;&lt;li&gt;3.6.1.2.c: Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:&amp;nbsp;&lt;ul&gt;&lt;li&gt;Key-encrypting keys are at least as strong as the data-encrypting keys they protect.&lt;/li&gt;&lt;li&gt;Key-encrypting keys are stored separately from data-encrypting keys.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:51.125">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="44" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:49.359">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.220">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="93" state="Recommended" owner="rgy@demandbase.com" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Forms with user input (including hidden fields)&lt;/li&gt;&lt;li&gt;API calls&lt;/li&gt;&lt;li&gt;HTTP Headers&lt;/li&gt;&lt;li&gt;Application states such as ASP Viewstates&lt;/li&gt;&lt;li&gt;Serialized Java objects&lt;/li&gt;&lt;li&gt;Any data structure received from the client-side&lt;/li&gt;&lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt;&lt;li&gt;Where possible, define a white-list of accepted input or characters&lt;/li&gt;&lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To test data validation:&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;A number of tools can be used to aid in testing:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly from your browser with the Developer Tools.&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:24:52.221">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="AUTHENTICATION" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                    <countermeasure ref="CWE-662" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="80"/>
+                <countermeasure ref="CWE-662" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-158-AUTH" name="Authentication credentials compromised through network sniffing" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker with access to the network path between the user and the server could use network sniffing to read clear text data traversing the network.&lt;/p&gt;&lt;p&gt;&lt;br&gt;The networks used by users are the most likely points of attack since these are often shared by many other users, e.g. corporate networks or public and untrusted such as public WiFi access points.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319-AUTH">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-16" name="Dictionary-based or brute force password attack" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker tries each word in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user is a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-521">
+                  <countermeasures>
+                    <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="UNRESTRICTED-NETWORK">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                <countermeasure ref="require-use-strong-passwords" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-341" name="Attackers gain access to user data by manipulating server-side code" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server-side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-943">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
+                    <countermeasure ref="DATA-VAL" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
+                <countermeasure ref="DATA-VAL" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="pci-dss-dev" name="PCI-DSS Development" desc="" library="PCI-DSS">
+          <threats>
+            <threat ref="sensitive-auth-data-stealing" name="Attackers gain access to the personal identification number (PIN) or the encrypted PIN block after authorization" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="PCI-DSS" editable="true">
+              <desc>If full track data is stored, malicious individuals who obtain that data can use it to reproduce payment cards and complete fraudulent transactions. The purpose of the card validation code is to protect "card-not-present" transactions-Internet or mail order/telephone order (MO/TO) transactions-where the consumer and the card are not present. If this data is stolen, malicious individuals can execute fraudulent Internet and MO/TO transactions. These values should be known only to the card owner or bank that issued the card. If this data is stolen, malicious individuals can execute fraudulent PIN-based debit transactions (for example, ATM withdrawals).</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="PCI-R3-3.x">
+                  <countermeasures>
+                    <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
+                    <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
+                    <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PCI-R3-3.1-C" mitigation="34"/>
+                <countermeasure ref="PCI-R3-3.5.3-C" mitigation="33"/>
+                <countermeasure ref="PCI-R3-3.5.4-C" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="STORE SENSITIVE DATA" name="Storing sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="EU-GDPR-LOSS-PERSONAL-DATA" name="Loss of personal data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Personal data can be lost by (accidental or malicious) deletion and system failures.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-UNRECOVERED-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-BACKUP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="BACKUP-COMPROMISE" name="Sensitive data is compromised if a backup of the data is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>Sensitive data could be compromised if an attacker gained access to a backup copy of
+                                that data.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                    <countermeasure ref="store-backups-securely" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="50"/>
+                <countermeasure ref="store-backups-securely" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="HOST-COMPROMISE" name="Sensitive data is compromised if the host itself is compromised" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="CS-Default" editable="true">
+              <desc>If sensitive data is stored or processed on the host, then should the host itself be
+                                compromised by an attacker, the confidentiality and/or the integrity of the data would
+                                also be at risk.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-311-AT-REST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="982e7bf3-f767-430e-be32-2dd53d45de11" diagramComponentId="8ba783a0-4bdf-492b-856a-29599555aa18" ref="0deb4b9d-5bfb-4d10-bcba-ef32491e6ea7" name="AWS S3 (Simple Storage Service)" desc="" library="" parentComponentRef="" componentDefinitionRef="s3">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="public-cloud"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AWS-S3-7.2" name="Data is easily removed" state="0" impact="100" issueId="" issueLink="">
+          <desc>Someone without credentials can remove sensitive data, the remove function is not protected
+                        for an MFA.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="misconfigured-s3-access-policies" name="Misconfigured S3 access policies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+                        Amazon S3 buckets use misconfigured policies that allow unauthorized users to:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt; Read sensitive information. &lt;br /&gt;&lt;/li&gt;
+                        &lt;li&gt;Add malicious content to a bucket and overwrite content.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.4" name="Sensitive data is accessible" state="0" impact="100" issueId="" issueLink="">
+          <desc>Sensitive data is not encrypted and is exposed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.689">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.3" name="Sensitive data is exposed in transit" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Sensitive data is not encrypted in transit with HTTPS or SSL, and is accessible while traversing the network.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="SYSTEM-VUL-DOS" name="System is vulnerable to a denial of service attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>Attackers can perform a successful denial of service on the system</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.687">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AWS-S3-7.1" name="There is not a recover or backup mechanism" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;There are not any processes or mechanisms to regularly save the data to another place in order to have an older version of the data to restore in case of loss. Consequently, the data cannot be easily recovered or they cannot be recovered at all.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="Hydras-AWS-IAM-2.7" name="Allocate privileges via groups or roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Granting least privilege ensures that users only have the permissions required to complete
+                their jobs rather than additional privileges that are not required. Following this model ensures
+                that, should an account be compromised, the blast radius of damage is limited.
+                &lt;br /&gt;
+                &lt;br /&gt;
+                &lt;b&gt;Remediation:&lt;/b&gt;
+                &lt;div&gt;
+                &lt;ul&gt;
+                &lt;li&gt;Allocate privileges via groups or roles via the recommendation in &amp;quot;Use RBAC
+                with pre-defined policies added into groups or roles&amp;quot;.&lt;/li&gt;
+                &lt;/ul&gt;
+                &lt;/div&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Lambda Permissions Model" url="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html"/>
+            <reference name="AWS Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Configure Lambda Authorizer Using the API Gateway Console" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html"/>
+            <reference name="Security best practices in Amazon API Gateway" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html"/>
+            <reference name="Use API Gateway Lambda Authorizers" url="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html"/>
+            <reference name="Using Identity-Based Policies (IAM Policies) for AWS Lambda" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html"/>
+            <reference name="Using Resource-Based Policies for AWS Lambda (Lambda Function Policies)" url="https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Follow the audit check in &amp;quot;Use RBAC with pre-defined policies added into
+                            groups or roles&amp;quot;.&lt;/li&gt;
+                            &lt;li&gt;Ensure the privileges granted to these groups or roles only give the user the
+                            ability to perform their and no more.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-EC2-6.3" name="Apply IAM roles" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Applications that run on an Amazon EC2/S3 instance need credentials in order to access other AWS services. To provide credentials to the application in a secure way, use IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do. In the case of Amazon EC2/S3, IAM dynamically provides temporary credentials to the EC2/S3 instance, and these credentials are automatically rotated for you. 
+&lt;br /&gt; 
+&lt;br /&gt;When you launch an EC2/S3 instance, you can specify a role for the instance as a launch parameter. Applications that run on the EC2/S3 instance can use the role's credentials when they access AWS resources. The role's permissions determine what the application is allowed to do. It is recommended that all EC2/S3 instances are launched with a role, even if the role has no permissions (as they can be added later if desired). 
+&lt;div&gt; 
+ &lt;br /&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;br /&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt; 
+  &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt; 
+  &lt;li&gt;Select &amp;quot;Launch Instance&amp;quot;.&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard until step 3 at which point ensure an IAM role is selected for the &amp;quot;IAM role&amp;quot; option (note the role must already exist).&lt;/li&gt; 
+  &lt;li&gt;Complete the wizard to launch the instance.&lt;/li&gt; 
+ &lt;/ol&gt;NB: You cannot add a role to an instance that has been launched without one. In these cases create an AMI from an existing instance and launch a new instance, assigning an IAM role as detailed above. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; &lt;br /&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.18" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Login to the AWS Management Console.&lt;/li&gt;
+                            &lt;li&gt;Select EC2/S3 from the services menu.&lt;/li&gt;
+                            &lt;li&gt;Select &amp;quot;Instances&amp;quot; from the left hand menu.&lt;/li&gt;
+                            &lt;li&gt;For each instance in the list:&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;select the instance&lt;/li&gt;
+                            &lt;li&gt;in the preview pane confirm the instance has an &amp;quot;IAM Role&amp;quot;
+                            assigned (if a hyphen &amp;quot;-&amp;quot; is shown then your instance has no role
+                            assigned).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-3.11" name="Configure S3 bucket versioning for sensitive data" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To add an extra layer of security to data stored within S3 it is possible to enable object versioning. Object versioning enables the recovery of objects from accidental overwrite or accidental deletion. If an object is deleted, instead of being removed, S3 write a delete marker which becomes the current version that means previous versions can always be recovered. It is recommended that versioning be enabled for buckets storing sensitive data. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;div&gt;
+   aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled 
+ &lt;/div&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-versioning.html"/>
+            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket versioning" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html"/>
+            <reference name="S3 Versioning" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html"/>
+          </references>
+          <standards>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="3.11" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;If you don't see &amp;quot;Status&amp;quot;: &amp;quot;Enabled&amp;quot;
+                            then your bucket has no versioning enabled.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-1" name="Discover, classify and secure all data" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Using a Cloud service or 3rd Party software to continuously monitor and automate the process of data discovery and classification for S3 buckets using machine learning and pattern matching is a strong defense in protecting that information.&lt;/p&gt;&lt;p&gt;Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Perform the steps below to enable and configure Amazon Macie From Console:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Log on to the Macie console at https://console.aws.amazon.com/macie/&lt;/li&gt;&lt;li&gt;Click Get started.&lt;/li&gt;&lt;li&gt;Click Enable Macie.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Setup a repository for sensitive data discovery results&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the Left pane, under Settings, click Discovery results.&lt;/li&gt;&lt;li&gt;Make sure Create bucket is selected.&lt;/li&gt;&lt;li&gt;Create a bucket, enter a name for the bucket. The name must be unique across all S3 buckets. In addition, the name must start with a lowercase letter or a number.&lt;/li&gt;&lt;li&gt;Click on Advanced.&lt;/li&gt;&lt;li&gt;Block all public access, make sure Yes is selected.&lt;/li&gt;&lt;li&gt;KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric, customer master key (CMK) that's in the same Region as the S3 bucket.&lt;/li&gt;&lt;li&gt;Click on Save&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Create a job to discover sensitive data&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click S3 buckets. Macie displays a list of all the S3 buckets for your account.&lt;/li&gt;&lt;li&gt;Select the check box for each bucket that you want Macie to analyze as part of the job&lt;/li&gt;&lt;li&gt;Click Create job.&lt;/li&gt;&lt;li&gt;Click Quick create.&lt;/li&gt;&lt;li&gt;For the Name and description step, enter a name and, optionally, a description of the job.&lt;/li&gt;&lt;li&gt;Then click Next.&lt;/li&gt;&lt;li&gt;For the Review and create step, click Submit.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Review your findings&lt;/p&gt;&lt;ol&gt;&lt;li&gt;In the left pane, click Findings.&lt;/li&gt;&lt;li&gt;To view the details of a specific finding, choose any field other than the check box for the finding.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;If you are using a 3rd Party tool to manage and protect your s3 data, follow the Vendor documentation for implementing and configuring that tool.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.4" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform the following steps to determine if Macie is running: From Console:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the Macie console at https://console.aws.amazon.com/macie/&amp;nbsp;&lt;/li&gt;&lt;li&gt;In the left hand pane click on By job under findings.&amp;nbsp;&lt;/li&gt;&lt;li&gt;Confirm that you have a Job setup for your S3 Buckets&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;When you log into the Macie console if you aren't taken to the summary page and you don't have a job setup and running then refer to the remediation procedure below. If you are using a 3rd Party tool to manage and protect your s3 data you meet this recommendation.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-3" name="Enable cross-region replication on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Enabling cross-Region replication on S3 buckets ensures that multiple versions of the data are available in different distinct Regions. This allows you to store data at even greater distances, minimize latency, increase operational efficiency, and protect against DDoS and data corruption events.&lt;/p&gt;&lt;p&gt;This is one method used to implement system hardening configuration.&lt;/p&gt;&lt;h3&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;To enable S3 bucket replication&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Amazon S3 console at https://console.aws.amazon.com/s3/.&lt;/li&gt;&lt;li&gt;Choose the S3 bucket that does not have cross-region replication enabled.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Management&lt;/strong&gt;, then choose &lt;strong&gt;Replication&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Add rule&lt;/strong&gt;. If versioning is not already enabled, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose your source bucket - &lt;strong&gt;Entire bucket&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose your destination bucket. If versioning is not already enabled on the destination bucket for your account, you are prompted to enable it.&lt;/li&gt;&lt;li&gt;Choose an IAM role. For more information on setting up permissions for replication, see the &lt;i&gt;Amazon Simple Storage Service User Guide&lt;/i&gt;.&lt;/li&gt;&lt;li&gt;Enter a rule name, choose &lt;strong&gt;Enabled&lt;/strong&gt; for the status, then choose &lt;strong&gt;Next&lt;/strong&gt;.&lt;/li&gt;&lt;li&gt;Choose &lt;strong&gt;Save&lt;/strong&gt;.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS PCI-DSS Controls" url="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.552">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AWS-S3-2" name="Enable Object-level logging for read and write events" issueId="" issueLink="" platform="" cost="0" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;Click on the Object-level logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link https://console.aws.amazon.com/cloudtrail/&lt;/li&gt;&lt;li&gt;Once the Cloudtrail is selected, check the Write event checkbox, so that object-level logging for Write events is enabled.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;To enable object-level data events logging for S3 buckets within your AWS account, run put-event-selectors command using the name of the trail that you want to reconfigure as identifier: aws cloudtrail put-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":true, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::&amp;lt;s3-bucket-name&amp;gt;/"] }] }]'&lt;/li&gt;&lt;li&gt;The command output will be object-level event trail configuration.&lt;/li&gt;&lt;li&gt;If you want to enable it for all buckets at once then change Values parameter to ["arn:aws:s3"] in command given above.&lt;/li&gt;&lt;li&gt;Repeat step 1 for each s3 bucket to update object-level logging of write events.&lt;/li&gt;&lt;li&gt;Change the AWS region by updating the --region command parameter and perform the process for other regions.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.10" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="3.11" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;From Console:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Login to the AWS Management Console and navigate to S3 dashboard at https://console.aws.amazon.com/s3/&lt;/li&gt;&lt;li&gt;In the left navigation panel, click buckets and then click on the S3 Bucket Name that you want to examine.&lt;/li&gt;&lt;li&gt;Click Properties tab to see in detail bucket configuration.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Disabled, then object-level logging of read/write events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;If the current status for Object-level logging is set to Enabled, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.&lt;/li&gt;&lt;li&gt;Repeat steps 2 to 5 to verify object level logging status of other S3 buckets.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;strong&gt;From Command Line:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;1. Run list-trails command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail list-trails --region &amp;lt;region-name&amp;gt; --query Trails[*].Name&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;2. The command output will be a list of the requested trail names.&lt;/p&gt;&lt;p&gt;3. Run get-event-selectors command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3bucket resources:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;aws cloudtrail get-event-selectors --region &amp;lt;region-name&amp;gt; --trail-name &amp;lt;trail-name&amp;gt; --query EventSelectors[*].DataResources[]&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;4. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.&lt;/p&gt;&lt;p&gt;5. If the get-event-selectors command returns an empty array '[]', the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.&lt;/p&gt;&lt;p&gt;6. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.&lt;/p&gt;&lt;p&gt;7. Change the AWS region by updating the --region command parameter and perform the audit process for other regions.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.547">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.4" name="Encrypt sensitive data at rest for Amazon S3" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Encrypt sensitive data at rest for Amazon S3&lt;/p&gt;&lt;p&gt;Rationale:&lt;/p&gt;&lt;p&gt;Data protection at rest refers to protecting data while it is stored on disks in Amazon S3 data centers.&lt;/p&gt;&lt;p&gt;You have the following options for protecting data at rest in Amazon S3:&lt;/p&gt;&lt;p&gt;- Server-Side Encryption - Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.&lt;/p&gt;&lt;p&gt;- Client-Side Encryption - Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.&lt;/p&gt;&lt;p&gt;Remediation:&lt;/p&gt;&lt;p&gt;Server-Side Encryption&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;You can't apply different types of server-side encryption to the same object simultaneously.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)&lt;/p&gt;&lt;p&gt;When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key. As an additional safeguard, it encrypts the key itself with a root key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256) GCM, to encrypt your data. For objects encrypted prior to AES-GCM, AES-CBC is still supported to decrypt those objects.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS)&lt;/p&gt;&lt;p&gt;Server-Side Encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. There are separate permissions for the use of a KMS key that provides added protection against unauthorized access of your objects in Amazon S3. SSE-KMS also provides you with an audit trail that shows when your KMS key was used and by whom. Additionally, you can create and manage customer managed keys or use AWS managed keys that are unique to you, your service, and your Region.&lt;/p&gt;&lt;p&gt;Server-Side Encryption with Customer-Provided Keys (SSE-C)&lt;/p&gt;&lt;p&gt;With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.&lt;/p&gt;&lt;p&gt;Client-Side Encryption&lt;/p&gt;&lt;p&gt;To enable client-side encryption, you have the following options:&lt;/p&gt;&lt;p&gt;- Use a key stored in AWS Key Management Service (AWS KMS).&lt;/p&gt;&lt;p&gt;- Use a key that you store within your application.&lt;/p&gt;&lt;p&gt;Note&lt;/p&gt;&lt;p&gt;Amazon S3 supports only symmetric encryption KMS keys, and not asymmetric KMS keys.&lt;/p&gt;&lt;p&gt;For more information about each encryption option, please see Reference URLs.&lt;/p&gt;&lt;p&gt;Impact:&lt;/p&gt;&lt;p&gt;None&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Protecting data using Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html"/>
+            <reference name="Protecting data using client-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html"/>
+            <reference name="Protecting data using server-side encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt; 
+ &lt;p&gt;aws s3api head-object --bucket my-bucket --key my-key &lt;/p&gt; 
+&lt;/blockquote&gt; 
+&lt;p&gt; Look for the line "ServerSideEncryption" and verify that it is set to "aws:kms" which indicates KMS Encryption.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.553">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-audit-s3" name="Identify and audit all your Amazon S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identification of your IT assets is a crucial aspect of governance and security. You need to have visibility of all your Amazon S3 resources to assess their security posture and take action on potential areas of weakness. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Use Tag Editor to identify security-sensitive or audit-sensitive resources, then use those tags when you need to search for these resources. For more information, see Searching for Resources to Tag. 
+&lt;/div&gt; 
+&lt;br /&gt;Use Amazon S3 inventory to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. For more information, see Amazon S3 Inventory. 
+&lt;br /&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+  Create resource groups for your Amazon S3 resources. For more information, see What Is AWS Resource Groups? 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            <reference name="Searching for Resources to Tag" url="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html"/>
+            <reference name="What Is AWS Resource Groups?" url="https://docs.aws.amazon.com/ARG/latest/userguide/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Use Amazon S3 inventory tool to review the replication and encryption status of your S3 buckets. 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon S3 Inventory" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-1.16" name="Require server-side and in transit encryption" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Data in transit is data being accessed over the network, and therefore could be intercepted by someone else on the network or with access to the physical media the network uses. On an ethernet network, that could be someone with the ability to tap a cable, configure a switch to mirror traffic, or fool your client or a router into directing traffic to them before it moves on to the final destination. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Server-side encryption (SSE) is about data encryption at rest-that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; Amazon S3 offers 3 options of encrypting data at rest, depending on how you choose to manage the encryption keys: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use SSE with Amazon S3-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with AWS KMS-Managed Keys&lt;/li&gt; 
+  &lt;li&gt;Use SSE with Customer-Provided Keys&lt;/li&gt; 
+ &lt;/ul&gt; At the time of object creation-that is, when you are uploading a new object or making a copy of an existing object-you can specify if you want Amazon S3 to encrypt your data by adding the "x-amz-server-side-encryptionheader" to the request. Set the value of the header to the encryption algorithm AES256 that Amazon S3 supports. Amazon S3 confirms that your object is stored using server-side encryption by returning the response header "x-amz-server-side-encryption". 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; No matter which of the three options you choose, you can create and attach a S3 bucket policy, that will deny any object creation S3 API (PUT Object, PUT Object - Copy, POST Object, Initiate Multipart Upload), if the request does not include the "x-amz-server-sideencryption" header requesting server-side encryption, and if the request was not done using SSL\TLS. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Rationale&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; When it comes to data at rest, if kept unencrypted, there are a few threats that one can think of, especially when the data is stored in the cloud: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;the threat that attackers are able to compromise Amazon S3 and gain access to the data that is stored in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the "insider threat" where a malicious or rogue administrator steals a physical disk drive or server that contains data a customer has in the Amazon S3 buckets.&lt;/li&gt; 
+  &lt;li&gt;the threat that a government uses a subpoena or warrant to get access to a customer's data in Amazon S3 without their knowledge.&lt;/li&gt; 
+ &lt;/ul&gt; If data in transit is kept unencrypted: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Malicious users may intercept or monitor plaintext data transmitting across unencrypted network and gain unauthorized access to that jeopardize the confidentiality of the sensitive data.&lt;/li&gt; 
+ &lt;/ul&gt; In all of these scenarios, encrypting data at rest and in transit, and properly managing the encryption keys can help mitigate the risk of unauthorized access to that data. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;br&gt; 
+  &lt;/div&gt; 
+  &lt;div&gt; 
+   &lt;div&gt;
+     Perform the following to ensure all objects placed in S3 are encrypted in transit and at rest: 
+   &lt;/div&gt; 
+   &lt;div&gt; 
+    &lt;ul&gt; 
+     &lt;li&gt;Create a new file, add the following to it, and save it as policy.json:&lt;/li&gt; 
+    &lt;/ul&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       { 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Version":"2012-10-17", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Id":"PutObjPolicy", 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;"Statement":{ 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Sid":"DenyUnEncryptedObjectUploads", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Effect":"Deny", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Principal":"*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Action":"s3:PutObject", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Resource":"arn:aws:s3:::&amp;lt;s3_bucket_name&amp;gt;/*", 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;"Condition":{ 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Null":{ "s3:x-amz-server-side-encryption":"true" }, 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt; 
+        &lt;div&gt;
+          &amp;nbsp;"Bool": { "aws:SecureTransport": "false" } 
+        &lt;/div&gt; 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt; 
+       &lt;div&gt;
+         &amp;nbsp;} 
+       &lt;/div&gt; 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt; 
+      &lt;div&gt;
+        &amp;nbsp;} 
+      &lt;/div&gt; 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt; 
+     &lt;div&gt;
+       } 
+     &lt;/div&gt; 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;div&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Attach the above bucket policy to each S3 bucket:&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/div&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;div&gt; 
+    &lt;div&gt;
+      aws s3api put-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --policy file://policy.json 
+    &lt;/div&gt; 
+   &lt;/div&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Get bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy.html"/>
+            <reference name="List buckets" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html"/>
+            <reference name="Put bucket policy" url="https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html"/>
+            <reference name="Using Server-side Encryption" url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="3.5.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Using the Amazon unified command line interface:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;List all the S3 buckets from the AWS account:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api list-buckets --output table
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;For each S3 bucket, list the bucket policy and verify that a policy exists, the policy contains a statement to deny PutObject calls that do not require server-side encryption, and the policy denies requests that do not occur over a secure transport:&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            aws s3api get-bucket-policy --bucket &amp;lt;s3_bucket_name&amp;gt; --query 'Policy'
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            ...
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;{
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Sid": "DenyUnEncryptedObjectUploads",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Effect": "Deny",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Principal": "*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Action": "s3:PutObject",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Resource": "arn:aws:s3:::/*",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Condition": {
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Null": { "s3:x-amz-server-side-encryption": "true",
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;"Bool": { "aws:SecureTransport": "false" }
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;/blockquote&gt;
+                            &lt;blockquote&gt;
+                            &amp;nbsp;}
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            &lt;br&gt;
+                            &lt;/div&gt;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.546">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="restrict-s3-bucket-access" name="Restrict Amazon S3 Bucket Access" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Unless you explicitly require anyone on the Internet to be able to read or write to your S3 bucket, you shall ensure that your S3 bucket is not public. The following are some of the steps you can take: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use Amazon S3 block public access. Account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. For more information, see Using Amazon S3 Block Public Access.&lt;/li&gt; 
+  &lt;li&gt;Identify Amazon S3 bucket policies that allow a wildcard identity such as Principal "*" (which effectively means "anyone") or allows a wildcard action "*" (which effectively allows the user to perform any action in the Amazon S3 bucket).&lt;/li&gt; 
+  &lt;li&gt;Similarly, note Amazon S3 bucket access control lists (ACLs) that provide read, write, or full-access to "Everyone" or "Any authenticated AWS user."&lt;/li&gt; 
+  &lt;li&gt;Use the ListBuckets API to scan all of your Amazon S3 buckets. Then use GetBucketAcl, GetBucketWebsite, and GetBucketPolicy to determine whether the bucket has compliant access controls and configuration.&lt;/li&gt; 
+  &lt;li&gt;Use AWS Trusted Advisor to inspect your Amazon S3 implementation.&lt;/li&gt; 
+  &lt;li&gt;Consider implementing on-going detective controls using the s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited managed AWS Config Rules.&lt;br&gt;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;br&gt; 
+&lt;br&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Checklist" url="https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Checklist.pdf"/>
+            <reference name="Amazon S3 Security Best Practices" url="https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/security-best-practices.md"/>
+            <reference name="Introduction to Managing Access Permissions to Your Amazon S3 Resources" url="https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-managing-access-s3-resources.html"/>
+            <reference name="Setting Bucket and Object Access Permissions" url="https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html"/>
+          </references>
+          <standards>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="1.16" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+            <standard ref="1.3.1" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.3.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.2" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="1.4.4" supportedStandardRef="PCI-DSS-v4.0"/>
+            <standard ref="2.1.5" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.1.5" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            Prowler is a command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
+                            It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (49 checks) and has 40 additional checks including related to GDPR and HIPAA.
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            If you'd like to check there are no S3 buckets open to the Everyone or Any AWS user you can run the tool with the following arguments:
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            ./prowler -c extra73
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;
+                            &lt;div&gt;
+                            &lt;br /&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
+              <output/>
+            </source>
+            <references>
+              <reference name="Prowler: AWS CIS Benchmark Tool" url="https://github.com/toniblyx/prowler"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.3" name="Set HTTPS for sensitive information" issueId="" issueLink="" platform="" cost="1" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br&gt; 
+&lt;br&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br&gt; 
+&lt;br&gt;To ensure that data is only accessible via HTTPS (as opposed to both HTTP and HTTPS) it is possible to add a condition to the S3 bucket policy. It is recommended to enable this for any bucket containing sensitive data to ensure that data is encrypted in transit. 
+&lt;div&gt; 
+ &lt;br&gt; 
+ &lt;b&gt;Remediation:&lt;br&gt;&lt;/b&gt;The following is an example of how to create an S3 bucket policy that enforces HTTPS/SSL only 
+ &lt;br&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Go to the S3 Service on the AWS Console&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Select a bucket under "All buckets"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Click the properties tab&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Under the permissions select "Add a bucket policy"&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Add the following policy to ensure all objects are accessed via https only&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; {&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt; "Statement":[&lt;/i&gt; 
+   &lt;i&gt;{&lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; "Action": "s3:*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Effect":"Allow",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Principal": "*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Resource":"arn:aws:s3:::bucketname/*",&lt;/i&gt; 
+    &lt;/div&gt; 
+    &lt;div&gt; 
+     &lt;i&gt;"Condition":{&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;div&gt; 
+       &lt;i&gt;"Bool":&lt;/i&gt; 
+      &lt;/div&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;{&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;"aws:SecureTransport": true&amp;nbsp;&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;blockquote&gt; 
+       &lt;div&gt; 
+        &lt;i&gt;}&lt;/i&gt; 
+       &lt;/div&gt; 
+      &lt;/blockquote&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;blockquote&gt; 
+     &lt;blockquote&gt; 
+      &lt;i&gt;}&lt;/i&gt; 
+     &lt;/blockquote&gt; 
+    &lt;/blockquote&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;blockquote&gt; 
+   &lt;blockquote&gt; 
+    &lt;div&gt; 
+     &lt;i&gt; }&lt;/i&gt; 
+     &lt;i&gt;]&lt;/i&gt; 
+    &lt;/div&gt; 
+   &lt;/blockquote&gt; 
+  &lt;/blockquote&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt; 
+   &lt;i&gt;} &lt;/i&gt; 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Click ""Save"&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+  
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.2" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+            <standard ref="4.2.1" supportedStandardRef="PCI-DSS-v4.0"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>The following checks that HTTPS is forced on a bucket policy:&amp;nbsp;
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Sign in to the AWS Management Console (with S3 update privileges).&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Go to the S3 Service on the AWS Console.&lt;/li&gt;
+                            &lt;li&gt;Select the S3 bucket under &amp;quot;All buckets&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Click the &amp;quot;properties&amp;quot; tab.&lt;/li&gt;
+                            &lt;li&gt;Click &amp;quot;edit bucket policy&amp;quot;.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the policy document check for the presence of the line &amp;quot;Condition&amp;quot;:
+                            {&amp;quot;Bool&amp;quot;: {&amp;quot;aws:SecureTransport&amp;quot;: &amp;quot;true&amp;quot;}}&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;In the same statement as &amp;quot;Effect&amp;quot;:&amp;quot;Allow&amp;quot;,&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AWS-SRA-4" name="Use AWS Macie to scan for sensitive data on S3 buckets" issueId="" issueLink="" platform="" cost="0" risk="67" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Macie findings flow to AWS Security Hub for review and analysis. Macie also integrates with Amazon EventBridge to facilitate automated responses to findings such as alerts, feeds to security information and event management (SIEM) systems, and automated remediation.&lt;/p&gt;&lt;p&gt;If S3 objects are encrypted with an AWS Key Management Service (AWS KMS) customer master key (CMK) that you manage, you can add the Macie service-linked role as a key user to that CMK to enable Macie to scan the data.&lt;/p&gt;&lt;p&gt;Macie is optimized for scanning objects in Amazon S3. As a result, any Macie-supported object type that can be placed in Amazon S3 (permanently or temporarily) can be scanned for sensitive data. This means that data from other sources-for example, periodic snapshot exports of Amazon Relational Database Service (Amazon RDS) or Amazon Aurora databases, exported Amazon DynamoDB tables, or extracted text files from native or third-party applications-can be moved to Amazon S3 and evaluated by Macie.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="AWS Security Reference Architecture" url="https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/welcome.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure Macie is used to scan S3 buckets.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.548">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="aws-tier-6.3" name="Use Cloudfront CDN" issueId="" issueLink="" platform="" cost="0" risk="89" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt; Description&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront can be used to deliver either the entire website, including dynamic, 
+  static, streaming, and interactive content using a global network of edge locations. 
+  Requests for your content are automatically routed to the nearest edge location, so content 
+  is delivered with the best possible performance. Amazon CloudFront is optimized to work 
+  with other Amazon Web Services, like Amazon Simple Storage Service (Amazon S3), 
+  Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Load Balancing, and 
+  Amazon Route 53. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Amazon CloudFront gives you three options for accelerating your entire website while 
+  delivering your content securely over HTTPS from all of CloudFront's edge locations. In 
+  addition to delivering securely from the edge, you can also configure CloudFront to use 
+  HTTPS connections for origin fetches so that your data is encrypted end-to-end from your 
+  origin to your end users. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt; Remediation&lt;/b&gt;: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;You can either create a Cloudfront distribution only by specifying the origin domain name (ELB, S3 bucket or web server):&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --origin-domain-name &amp;lt;your_original_domain_name&amp;gt; -- default-root-object index.html 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Or by creating locally a distribution config file distconfig.json with all the Cloudfront distribution parameters:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront create-distribution --distribution-config file://distconfig.json 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Create distribution" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html"/>
+            <reference name="List distributions" url="https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html"/>
+            <reference name="Working with distributions" url="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html"/>
+          </references>
+          <standards>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark"/>
+            <standard ref="6.3" supportedStandardRef="cis-amazon-web-services-three-tier-web-architecture-benchmark-level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Using the Amazon unified command line interface: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;List the Cloudfront distributions present in the AWS account, and check in the aliases field for the presence of the domain name used by the application:&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt; 
+&lt;blockquote&gt; 
+ &lt;blockquote&gt; 
+  &lt;div&gt;
+    aws cloudfront list-distributions --query "DistributionList.Items[*].{Id:Id, Status:Status, DomainName:DomainName, Aliases:Aliases.Items}" 
+  &lt;/div&gt; 
+ &lt;/blockquote&gt; 
+&lt;/blockquote&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.550">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="Hydras-AWS-S3-7.2" name="Use S3 MFA to delete sensitive information" issueId="" issueLink="" platform="" cost="1" risk="68" state="Recommended" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. 
+&lt;br /&gt; 
+&lt;br /&gt;Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web. It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites. 
+&lt;br /&gt; 
+&lt;br /&gt;To add an extra layer of security to data stored within S3 the account owner (root) can enable MFA Delete which means that buckets and the objects within them can only be deleted with the use of Multi-factor authentication device. It is recommended to enable MFA Delete on any buckets containing sensitive data to protect against accidental deletion 
+&lt;br /&gt;Remediation 
+&lt;br /&gt;1. aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled,MFADelete=Enabled 
+&lt;br /&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="2.1.3" supportedStandardRef="CIS AWS Standard"/>
+            <standard ref="2.1.3" supportedStandardRef="CIS-AWS-Standard-Level-2"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;blockquote&gt;
+                            aws s3api get-bucket-versioning --bucket my-bucket&amp;nbsp;
+                            &lt;/blockquote&gt;
+                            &lt;div&gt;
+                            If you don't see &amp;quot;MFADelete&amp;quot;: &amp;quot;Enabled&amp;quot; then your bucket
+                            has no MFA delete enabled.
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-07-17T09:25:02.545">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="AMAZON-WEB-SERVICES" name="Amazon Web Services" desc="" library="Hydras-AWS-Foundation">
+          <threats>
+            <threat ref="AWS-CF-DOS" name="Attackers perform a denial of service" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;A Denial of Service (DoS) attack is a deliberate attempt to make your website unavailable. Attackers use a variety of techniques that consume large amount of resources.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="SYSTEM-VUL-DOS">
+                  <countermeasures>
+                    <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="aws-tier-6.3" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DATA-DELETED-EASY-AWS" name="Data is intentionally or accidentally deleted" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Data can be deleted intentionally or accidentally and cannot be recovered. Attackers could rely on the lack of backup and recovery mechanisms.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.1">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-3" mitigation="25"/>
+                    <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.2">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-2" mitigation="25"/>
+                <countermeasure ref="AWS-S3-3" mitigation="25"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="25"/>
+                <countermeasure ref="aws-tier-3.11" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="ACCESS-TO-DATA-AWS" name="Sensitive data is compromised through unauthorized access to data" state="Expose" source="RULES" edited="false" owner="rgy@demandbase.com" library="Hydras-AWS-Foundation" editable="true">
+              <desc>&lt;p&gt;Attackers can gain access to sensitive data when the data is in transit in clear text, or when the data is stored without encryption.&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="25" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AWS-S3-7.3">
+                  <countermeasures>
+                    <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AWS-S3-7.4">
+                  <countermeasures>
+                    <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="misconfigured-s3-access-policies">
+                  <countermeasures>
+                    <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                    <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                    <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                    <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                    <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AWS-S3-1" mitigation="10"/>
+                <countermeasure ref="C-AWS-SRA-4" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-EC2-6.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-IAM-2.7" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.2" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.3" mitigation="10"/>
+                <countermeasure ref="Hydras-AWS-S3-7.4" mitigation="10"/>
+                <countermeasure ref="aws-tier-1.16" mitigation="10"/>
+                <countermeasure ref="identify-audit-s3" mitigation="10"/>
+                <countermeasure ref="restrict-s3-bucket-access" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>
diff --git a/Templates/Submitted_Templates/st-generator-form-template.xml b/Templates/Submitted_Templates/st-generator-form-template.xml
new file mode 100644
index 0000000..a62f6cd
--- /dev/null
+++ b/Templates/Submitted_Templates/st-generator-form-template.xml
@@ -0,0 +1,19625 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<template ref="st-generator-form-template" name="st-generator-form template" tags="Community">
+  <desc/>
+  <diagram draft="false">
+    <schema>PG14R3JhcGhNb2RlbCBkeD0iMjY0OCIgZHk9IjMyMCIgZ3JpZD0iMCIgZ3JpZFNpemU9IjEwIiBndWlkZXM9IjEiIHRvb2x0aXBzPSIxIiBjb25uZWN0PSIxIiBhcnJvd3M9IjEiIGZvbGQ9IjEiIHBhZ2U9IjAiIHBhZ2VTY2FsZT0iMSIgcGFnZVdpZHRoPSI4MjciIHBhZ2VIZWlnaHQ9IjExNjkiIG1hdGg9IjAiIHNoYWRvdz0iMCIgaXJEcmF3aW9WZXJzaW9uPSI0LjkuMCI+CiAgPHJvb3Q+CiAgICA8bXhDZWxsIGlkPSIwIi8+CiAgICA8bXhDZWxsIGlkPSIxIiBwYXJlbnQ9IjAiLz4KICAgIDxteENlbGwgaWQ9IjM0IiB2YWx1ZT0iUHJpdmF0ZSBTZWN1cmVkIiBzdHlsZT0iaXIucmVmPTJhYjRlZmZhLTQwYjctNGNkMi1iYTgxLTgyNDdkMjlhNmYyZDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO3JlY3Vyc2l2ZVJlc2l6ZT0wO2h0bWw9MTt2ZXJ0aWNhbEFsaWduPXRvcDthbGlnbj1sZWZ0O2Rhc2hlZD0xO3N0cm9rZVdpZHRoPTE7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtzdHJva2VDb2xvcj0jNzU3NUVCO2ZpbGxDb2xvcj0jRjBGMEZGO2ZpbGxPcGFjaXR5PTMwO2ZvbnRDb2xvcj0jNTY1MUUwO2Nvbm5lY3RhYmxlPTA7Y29udGFpbmVyPTE7c291cmNlPWlyaXVzcmlzaztpci50eXBlPVRSVVNUWk9ORTsiIHBhcmVudD0iMSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTExNTEiIHk9IjQzMSIgd2lkdGg9IjEzMTAiIGhlaWdodD0iOTEyIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG9iamVjdCBsYWJlbD0iQnJvd3NlciIgaXIuc291cmNlU3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPUNELUJST1dTRVI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUIzYVdSMGFEMGlNU0lnYUdWcFoyaDBQU0l4SWlCMmFXVjNRbTk0UFNJd0lEQWdNU0F4SWlCbWFXeHNQU0p1YjI1bElpQjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaVBqeHpkSGxzWlQ0Z0lDQWdMbWxqYjI0dFptbHNiQ0I3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095QWdJQ0I5UEM5emRIbHNaVDQ4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQmZNalV3TlY4eU16SXlPQ2tpUGp4d1lYUm9JR1E5SWswd0xqSXdNRGd3TmlBd0xqSTVPRFkwTjBNd0xqSXdNRGd3TmlBd0xqSXpPVGd5TkNBd0xqSTBPREF5TnlBd0xqRTVNakV6T1NBd0xqTXdOakkzTnlBd0xqRTVNakV6T1Vnd0xqWTROVGszTTBNd0xqYzBOREl5TXlBd0xqRTVNakV6T1NBd0xqYzVNVFEwTkNBd0xqSXpPVGd5TkNBd0xqYzVNVFEwTkNBd0xqSTVPRFkwTjFZd0xqUTVOamN3TmtNd0xqYzNPRE01TmlBd0xqUTRPRFUwTnlBd0xqYzJOREkwSURBdU5EZ3lNREkxSURBdU56UTVNalUxSURBdU5EYzNOREl5VmpBdU16WXlOVFV4U0RBdU1qUXlPVGswVmpBdU5qZ3lNRGMxUXpBdU1qUXlPVGswSURBdU56RTNNelk1SURBdU1qY3hNekkzSURBdU56UTFPVGdnTUM0ek1EWXlOemNnTUM0M05EVTVPRWd3TGpVME1qa3pOVU13TGpVMU1qVTVOQ0F3TGpjMk1UazNNaUF3TGpVMk5EWXpJREF1TnpjMk16UWdNQzQxTnpnMU5EY2dNQzQzT0RnMU9ETklNQzR6TURZeU56ZERNQzR5TkRnd01qY2dNQzQzT0RnMU9ETWdNQzR5TURBNE1EWWdNQzQzTkRBNE9UZ2dNQzR5TURBNE1EWWdNQzQyT0RJd056VldNQzR5T1RnMk5EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrUEhCaGRHZ2daRDBpVFRBdU5qVTFORFkzSURBdU56STBPREl4U0RBdU56UTRNemMzUXpBdU56TTVNRGMwSURBdU56YzBNemswSURBdU56SXdORFExSURBdU9EQTRNVE01SURBdU56QXhPVEl5SURBdU9EQTRNVE01UXpBdU5qZ3pPVFlnTUM0NE1EZ3hNemtnTUM0Mk5qVTRPVGtnTUM0M056WTBNRGdnTUM0Mk5UWXpNemdnTUM0M01qa3lPRFJNTUM0Mk5UVTBOamNnTUM0M01qUTRNakZJTUM0M05EZ3pOemRJTUM0Mk5UVTBOamRhVFRBdU5UWTNPRFUxSURBdU56STBPREkwVERBdU5qTXlORFkySURBdU56STBPREpETUM0Mk16YzVNemtnTUM0M05UWXpOelFnTUM0Mk5EY3lNVGNnTUM0M09ETXlNVGdnTUM0Mk5Ua3pOVGtnTUM0NE1ESXdNRFJETUM0Mk1qQTVNREVnTUM0M09UQTFNelVnTUM0MU9EZzRPRE1nTUM0M05qTTVORE1nTUM0MU56QXdOVEVnTUM0M01qa3dOVXd3TGpVMk56ZzFOU0F3TGpjeU5EZ3lORnBOTUM0M056RXpOemdnTUM0M01qUTRNa3d3TGpnek5UazRPU0F3TGpjeU5EZ3lORU13TGpneE56VXhNaUF3TGpjMk1UYzVNaUF3TGpjNE5EUTRNU0F3TGpjNU1EQTNOaUF3TGpjME5EVWdNQzQ0TURFNU9UbERNQzQzTlRVNE1qTWdNQzQzT0RRME5UY2dNQzQzTmpRMk5UY2dNQzQzTlRrNU1EZ2dNQzQzTnpBeU16TWdNQzQzTXpFd05qWk1NQzQzTnpFek56Z2dNQzQzTWpRNE1rd3dMamd6TlRrNE9TQXdMamN5TkRneU5Fd3dMamMzTVRNM09DQXdMamN5TkRneVdrMHdMamMzTlRreU5DQXdMall5TmpNeU0wd3dMamcwT1RBd05DQXdMall5TmpNeE0wTXdMamcxTURrM01pQXdMall6TmpFd055QXdMamcxTWpBd05pQXdMalkwTmpJME5DQXdMamcxTWpBd05pQXdMalkxTmpZeU5VTXdMamcxTWpBd05pQXdMalkzTWpRMk5TQXdMamcwT1RVNU9TQXdMalk0Tnpjek9DQXdMamcwTlRFek5TQXdMamN3TWpBNU1rZ3dMamMzTkRVMk4wTXdMamMzTmpFME55QXdMalk0TnpVNE1TQXdMamMzTmprM05TQXdMalkzTWpNek5TQXdMamMzTmprM05TQXdMalkxTmpZeU5VTXdMamMzTmprM05TQXdMalkwT1RjMElEQXVOemMyT0RFMklEQXVOalF5T1RRMUlEQXVOemMyTlRBMUlEQXVOak0yTWpZeFREQXVOemMxT1RJMElEQXVOakkyTXpJelREQXVPRFE1TURBMElEQXVOakkyTXpFelREQXVOemMxT1RJMElEQXVOakkyTXpJeldrMHdMalUxTkRnMElEQXVOakkyTXpFelREQXVOakkzT1RJZ01DNDJNall6TWpORE1DNDJNamN5TWpZZ01DNDJNell4TnpJZ01DNDJNalk0TmpnZ01DNDJORFl5T1RnZ01DNDJNalk0TmpnZ01DNDJOVFkyTWpWRE1DNDJNalk0TmpnZ01DNDJOamt4T1RNZ01DNDJNamN6T1RnZ01DNDJPREUwTmpRZ01DNDJNamcwTVRrZ01DNDJPVE15T1RsTU1DNDJNamt5TnpZZ01DNDNNREl3T1RKSU1DNDFOVGczTURsRE1DNDFOVFF5TkRVZ01DNDJPRGMzTXpnZ01DNDFOVEU0TXpnZ01DNDJOekkwTmpVZ01DNDFOVEU0TXpnZ01DNDJOVFkyTWpWRE1DNDFOVEU0TXpnZ01DNDJORFl5TkRRZ01DNDFOVEk0TnpJZ01DNDJNell4TURjZ01DNDFOVFE0TkNBd0xqWXlOak14TTFwTk1DNDJOVEExTXpRZ01DNDJNall6TVRSSU1DNDNOVE16TVVNd0xqYzFOREEyTkNBd0xqWXpOakE1T0NBd0xqYzFORFEyTmlBd0xqWTBOakl6TXlBd0xqYzFORFEyTmlBd0xqWTFOall5TlVNd0xqYzFORFEyTmlBd0xqWTJPVE14T0NBd0xqYzFNemcyTnlBd0xqWTRNVFl5T1NBd0xqYzFNamMxT0NBd0xqWTVNek00TTB3d0xqYzFNVGd6TXlBd0xqY3dNakE1TWtnd0xqWTFNakF4TVVNd0xqWTFNRE14TlNBd0xqWTROemMySURBdU5qUTVNemMzSURBdU5qY3lORGt5SURBdU5qUTVNemMzSURBdU5qVTJOakkxUXpBdU5qUTVNemMzSURBdU5qUTRPRE14SURBdU5qUTVOakEwSURBdU5qUXhNVGd4SURBdU5qVXdNRE0xSURBdU5qTXpOekUyVERBdU5qVXdOVE0wSURBdU5qSTJNekUwU0RBdU56VXpNekZJTUM0Mk5UQTFNelJhVFRBdU56UTJNVEEwSURBdU5URXpPREkyVERBdU56UTBORGcxSURBdU5URXhNalEzUXpBdU56ZzVOemM0SURBdU5USTBOelE0SURBdU9ESTJNVFV6SURBdU5UVTVNalEzSURBdU9EUXlOVFUzSURBdU5qQXpOVGd5VERBdU56Y3pOalkySURBdU5qQXpOVGczUXpBdU56WTRPVE14SURBdU5UWTJPVFl5SURBdU56VTVNekV6SURBdU5UTTFOVEE0SURBdU56UTJNVEEwSURBdU5URXpPREkyVERBdU56UTBORGcxSURBdU5URXhNalEzVERBdU56UTJNVEEwSURBdU5URXpPREkyV2swd0xqWTFOelV6TVNBd0xqVXhNVGd3TlV3d0xqWTFPVE0xT0NBd0xqVXhNVEkwTjBNd0xqWTBOakUwTVNBd0xqVXpNVFk1TnlBd0xqWXpOak14T0NBd0xqVTJNVFk1TmlBd0xqWXpNVEV3TVNBd0xqVTVOamt5TWt3d0xqWXpNREUzTnlBd0xqWXdNelU0TjB3d0xqVTJNVEk0TmlBd0xqWXdNelU0TWtNd0xqVTNOelEzSURBdU5UVTVPRFExSURBdU5qRXpNRGc0SURBdU5USTFOamd4SURBdU5qVTNOVE14SURBdU5URXhPREExVERBdU5qVTVNelU0SURBdU5URXhNalEzVERBdU5qVTNOVE14SURBdU5URXhPREExV2swd0xqY3dNVGt5TWlBd0xqVXdOVEV4TVVNd0xqY3lNVGN4TWlBd0xqVXdOVEV4TVNBd0xqYzBNVFl5TWlBd0xqVTBNell5T0NBd0xqYzFNREUxTVNBd0xqVTVPRGd4TTB3d0xqYzFNRGcxTkNBd0xqWXdNelU0TTBnd0xqWTFNams1UXpBdU5qWXhNRGcwSURBdU5UUTFPRFlnTUM0Mk9ERTFOamNnTUM0MU1EVXhNVEVnTUM0M01ERTVNaklnTUM0MU1EVXhNVEZhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K1BDOW5QanhrWldaelBqeGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNEQmZNalV3TlY4eU16SXlPQ0krUEhKbFkzUWdkMmxrZEdnOUlqQXVPRGdpSUdobGFXZG9kRDBpTUM0NE9DSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVNRFl3TURVNE5pQXdMakEyTURBMU9EWXBJaTgrUEM5amJHbHdVR0YwYUQ0OEwyUmxabk0rUEM5emRtYys7dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MDsiIGlkPSI0NSI+CiAgICAgIDxteENlbGwgc3R5bGU9ImlyLnJlZj0zZWI4NzQ0My0zYjJiLTRlYzUtOTcwNi0yZmI0MjM5YWIwOTE7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249bGVmdDtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9MzthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEzO3NvdXJjZT1jdXN0b207aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtQlJPV1NFUjt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtjb250YWluZXI9MTtwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZVdpZHRoPTE7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSI1IiB5PSIzNTgiIHdpZHRoPSIyMDYiIGhlaWdodD0iMTk2IiBhcz0iZ2VvbWV0cnkiLz4KICAgICAgPC9teENlbGw+CiAgICA8L29iamVjdD4KICAgIDxteENlbGwgaWQ9IjcyIiB2YWx1ZT0iV2ViIFVJIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9d2ViLXVpO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RBcElqNG1JM2hoT3p4bklHTnNhWEF0Y0dGMGFEMGlkWEpzS0NOamJHbHdNU2tpUGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TXpZek5qWTBJREF1TXpnMk56RkRNQzR6T1RrMk56Y2dNQzR6T0RZM01TQXdMalF5T1RFMU55QXdMalF4TkRZNE9TQXdMalF6TVRVMU1TQXdMalExTURBNU5rd3dMalF6TVRjd09DQXdMalExTkRjMU5GWXdMamd3TWpVek5rTXdMalF6TVRjd09DQXdMamd6T0RVME9TQXdMalF3TXpjeU9TQXdMamcyT0RBeU9TQXdMak0yT0RNeU1pQXdMamczTURReU0wd3dMak0yTXpZMk5DQXdMamczTURVNFNEQXVNVGszTkRNNFF6QXVNVFl4TkRJMUlEQXVPRGN3TlRnZ01DNHhNekU1TkRZZ01DNDROREkyTURFZ01DNHhNamsxTlRJZ01DNDRNRGN4T1RSTU1DNHhNamt6T1RVZ01DNDRNREkxTXpaV01DNDBOVFEzTlRSRE1DNHhNamt6T1RVZ01DNDBNVGczTkNBd0xqRTFOek0zTXlBd0xqTTRPVEkyTVNBd0xqRTVNamM0SURBdU16ZzJPRFkzVERBdU1UazNORE00SURBdU16ZzJOekZJTUM0ek5qTTJOalJhVFRBdU16WXpOalkwSURBdU5ETXlNRGN6U0RBdU1UazNORE00UXpBdU1UZzFPVFUySURBdU5ETXlNRGN6SURBdU1UYzJORFkySURBdU5EUXdOakEySURBdU1UYzBPVFkwSURBdU5EVXhOamMzVERBdU1UYzBOelUzSURBdU5EVTBOelUwVmpBdU9EQXlOVE0yUXpBdU1UYzBOelUzSURBdU9ERTBNREU0SURBdU1UZ3pNamtnTUM0NE1qTTFNRGdnTUM0eE9UUXpOakVnTUM0NE1qVXdNVXd3TGpFNU56UXpPQ0F3TGpneU5USXhOMGd3TGpNMk16WTJORU13TGpNM05URTBOaUF3TGpneU5USXhOeUF3TGpNNE5EWXpOaUF3TGpneE5qWTROQ0F3TGpNNE5qRXpPQ0F3TGpnd05UWXhNMHd3TGpNNE5qTTBOU0F3TGpnd01qVXpObFl3TGpRMU5EYzFORU13TGpNNE5qTTBOU0F3TGpRME16STNNaUF3TGpNM056Z3hNaUF3TGpRek16YzRNaUF3TGpNMk5qYzBNU0F3TGpRek1qSTRUREF1TXpZek5qWTBJREF1TkRNeU1EY3pXazB3TGpNd016STROQ0F3TGpjek5EUTVNVU13TGpNeE5UZ3hNU0F3TGpjek5EUTVNU0F3TGpNeU5UazJOU0F3TGpjME5EWTBOaUF3TGpNeU5UazJOU0F3TGpjMU56RTNNME13TGpNeU5UazJOU0F3TGpjMk9EWTFOU0F3TGpNeE56UXpNeUF3TGpjM09ERTBOU0F3TGpNd05qTTJNaUF3TGpjM09UWTBOMHd3TGpNd016STROQ0F3TGpjM09UZzFORWd3TGpJMU56ZzROME13TGpJME5UTTJJREF1TnpjNU9EVTBJREF1TWpNMU1qQTFJREF1TnpZNU5qazVJREF1TWpNMU1qQTFJREF1TnpVM01UY3pRekF1TWpNMU1qQTFJREF1TnpRMU5qa2dNQzR5TkRNM016Z2dNQzQzTXpZeUlEQXVNalUwT0RBNUlEQXVOek0wTmprNFREQXVNalUzT0RnM0lEQXVOek0wTkRreFNEQXVNekF6TWpnMFdrMHdMamM0TnpJek1TQXdMakUwTkRjM05VTXdMamd5TXpJME5TQXdMakUwTkRjM05TQXdMamcxTWpjeU5DQXdMakUzTWpjMU5DQXdMamcxTlRFeE9DQXdMakl3T0RFMk1Vd3dMamcxTlRJM05TQXdMakl4TWpneVZqQXVOVFV6TURSRE1DNDROVFV5TnpVZ01DNDFPRGt3TlRRZ01DNDRNamN5T1RjZ01DNDJNVGcxTXpNZ01DNDNPVEU0T1NBd0xqWXlNRGt5T0V3d0xqYzROekl6TVNBd0xqWXlNVEE0TkVnd0xqWTBNelEwTTFZd0xqY3dOREkxU0RBdU5qZ3hNekEyUXpBdU5qa3pPRE16SURBdU56QTBNalVnTUM0M01ETTVPRGNnTUM0M01UUTBNRFFnTUM0M01ETTVPRGNnTUM0M01qWTVNekZETUM0M01ETTVPRGNnTUM0M016ZzBNVFFnTUM0Mk9UVTBOVFFnTUM0M05EYzVNRE1nTUM0Mk9EUXpPRFFnTUM0M05EazBNRFZNTUM0Mk9ERXpNRFlnTUM0M05EazJNVEpJTUM0ME5qSXdOVFJXTUM0M01EUXlOVWd3TGpVNU9EQTRNVll3TGpZeU1UQTRORWd3TGpRMk1qQTFORll3TGpVM05UY3lNa2d3TGpjNE56SXpNVU13TGpjNU9EY3hOQ0F3TGpVM05UY3lNaUF3TGpnd09ESXdOQ0F3TGpVMk56RTRPU0F3TGpnd09UY3dOaUF3TGpVMU5qRXhPRXd3TGpnd09Ua3hNeUF3TGpVMU16QTBWakF1TWpFeU9ESkRNQzQ0TURrNU1UTWdNQzR5TURFek16Y2dNQzQ0TURFek9DQXdMakU1TVRnME55QXdMamM1TURNd09TQXdMakU1TURNME5Vd3dMamM0TnpJek1TQXdMakU1TURFek9FZ3dMakk0T0RFMk5FTXdMakkzTmpZNE1TQXdMakU1TURFek9DQXdMakkyTnpFNU1TQXdMakU1T0RZM01TQXdMakkyTlRZNE9TQXdMakl3T1RjME1rd3dMakkyTlRRNE1pQXdMakl4TWpneVZqQXVNelUyTkRZNFNEQXVNakl3TVRKV01DNHlNVEk0TWtNd0xqSXlNREV5SURBdU1UYzJPREEySURBdU1qUTRNRGs0SURBdU1UUTNNekkySURBdU1qZ3pOVEExSURBdU1UUTBPVE15VERBdU1qZzRNVFkwSURBdU1UUTBOemMxU0RBdU56ZzNNak14V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMams0TkRZeE5TSWdhR1ZwWjJoMFBTSXdMams0TkRZeE5TSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQWdNQzR3TVRVek9EQTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1T0RRMk56WTVJaUJvWldsbmFIUTlJakF1T0RRMk56WTVJaUJtYVd4c1BTSjNhR2wwWlNJZ2RISmhibk5tYjNKdFBTSjBjbUZ1YzJ4aGRHVW9NQzR3TmpnNE5EYzNJREF1TURnME16VXdOaWtpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTtpci5yZWY9NDUzNmI3OGItZTFhMC00YjJkLTg0MTUtYzczZGZiOWM5OTk3OyIgcGFyZW50PSI0NSIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMTgiIHk9IjMyLjI1IiB3aWR0aD0iMTU5IiBoZWlnaHQ9IjEzMy43NSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9IjgzIiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSIgc3R5bGU9InJvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXJlc3QtZnVsbC13ZWItc2VydmljZTtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2dabWxzYkMxeWRXeGxQU0psZG1WdWIyUmtJaUJqYkdsd0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdROUlrMHdMak00TmpFNE1pQXdMakkwT1RNME5rTXdMak00TmpFNE1pQXdMakl6TlRnNE5DQXdMak01TnpBNU5TQXdMakl5TkRrM01TQXdMalF4TURVMU55QXdMakl5TkRrM01VZ3dMalU0T1RNd04wTXdMall3TWpjMk9TQXdMakl5TkRrM01TQXdMall4TXpZNE1pQXdMakl6TlRnNE5DQXdMall4TXpZNE1pQXdMakkwT1RNME5rTXdMall4TXpZNE1pQXdMakkyTWpnd09DQXdMall3TWpjMk9TQXdMakkzTXpjeU1TQXdMalU0T1RNd055QXdMakkzTXpjeU1VZ3dMalF4TURVMU4wTXdMak01TnpBNU5TQXdMakkzTXpjeU1TQXdMak00TmpFNE1pQXdMakkyTWpnd09DQXdMak00TmpFNE1pQXdMakkwT1RNME5scE5NQzQwTVRBMU5UY2dNQzQxT0RJME56RkRNQzR6T1Rjd09UVWdNQzQxT0RJME56RWdNQzR6T0RZeE9ESWdNQzQxT1RNek9EUWdNQzR6T0RZeE9ESWdNQzQyTURZNE5EWkRNQzR6T0RZeE9ESWdNQzQyTWpBek1EY2dNQzR6T1Rjd09UVWdNQzQyTXpFeU1qRWdNQzQwTVRBMU5UY2dNQzQyTXpFeU1qRklNQzQxTXpJNU5UTkRNQzQxTXpZMk5EY2dNQzQyTVRNMU1UTWdNQzQxTkRNMk9EWWdNQzQxT1Rjd016SWdNQzQxTlRNek9DQXdMalU0TWpRM01VZ3dMalF4TURVMU4xcE5NQzQyTkRZeE9ESWdNQzQxTWpFNU4xWXdMakU1TWpRM01VTXdMalkwTmpFNE1pQXdMakUyTlRVME55QXdMall5TkRNMU5TQXdMakUwTXpjeU1TQXdMalU1TnpRek1TQXdMakUwTXpjeU1VZ3dMalF3TWpRek1VTXdMak0zTlRVd055QXdMakUwTXpjeU1TQXdMak0xTXpZNE1pQXdMakUyTlRVME55QXdMak0xTXpZNE1pQXdMakU1TWpRM01WWXdMalkwTnpRM1F6QXVNelV6TmpneUlEQXVOamMwTXprMElEQXVNemMxTlRBM0lEQXVOamsyTWpJeElEQXVOREF5TkRNeElEQXVOamsyTWpJeFNEQXVOVE0wTnpRMlF6QXVOVE01TlRNNUlEQXVOekUwTVRReUlEQXVOVFEzT0RBeElEQXVOek13TmpRMklEQXVOVFU0TnpZMUlEQXVOelEwT1RjeFNEQXVOREF5TkRNeFF6QXVNelE0TlRnMElEQXVOelEwT1RjeElEQXVNekEwT1RNeUlEQXVOekF4TXpFNElEQXVNekEwT1RNeUlEQXVOalEzTkRkV01DNHhPVEkwTnpGRE1DNHpNRFE1TXpJZ01DNHhNemcyTWpNZ01DNHpORGcxT0RRZ01DNHdPVFE1TnpBM0lEQXVOREF5TkRNeElEQXVNRGswT1Rjd04wZ3dMalU1TnpRek1VTXdMalkxTVRJM09TQXdMakE1TkRrM01EY2dNQzQyT1RRNU16SWdNQzR4TXpnMk1qTWdNQzQyT1RRNU16SWdNQzR4T1RJME56RldNQzQxTWpJeE5qVkRNQzQyT0RZNE5ETWdNQzQxTWpBM01URWdNQzQyTnpnMU1USWdNQzQxTVRrNU5USWdNQzQyTnpBd01EUWdNQzQxTVRrNU5USkRNQzQyTmpFNE9ETWdNQzQxTVRrNU5USWdNQzQyTlRNNU1qUWdNQzQxTWpBMk5ETWdNQzQyTkRZeE9ESWdNQzQxTWpFNU4xcE5NQzR6T0RZeE9ESWdNQzQxTURrek5EWkRNQzR6T0RZeE9ESWdNQzQwT1RVNE9EUWdNQzR6T1Rjd09UVWdNQzQwT0RRNU56RWdNQzQwTVRBMU5UY2dNQzQwT0RRNU56RklNQzQxT0Rrek1EZERNQzQyTURJM05qa2dNQzQwT0RRNU56RWdNQzQyTVRNMk9ESWdNQzQwT1RVNE9EUWdNQzQyTVRNMk9ESWdNQzQxTURrek5EWkRNQzQyTVRNMk9ESWdNQzQxTWpJNE1EZ2dNQzQyTURJM05qa2dNQzQxTXpNM01pQXdMalU0T1RNd055QXdMalV6TXpjeVNEQXVOREV3TlRVM1F6QXVNemszTURrMUlEQXVOVE16TnpJZ01DNHpPRFl4T0RJZ01DNDFNakk0TURnZ01DNHpPRFl4T0RJZ01DNDFNRGt6TkRaYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJNemc0T0RFZ01DNDNNRFV3TkRkSU1DNDNNREEzT1RSRE1DNDJPVFExT1RVZ01DNDNNemMzTmlBd0xqWTRNakU0TVNBd0xqYzJNREF5T0NBd0xqWTJPVGd6T0NBd0xqYzJNREF5T0VNd0xqWTFOemcyT0NBd0xqYzJNREF5T0NBd0xqWTBOVGd6TWlBd0xqY3pPVEE0T1NBd0xqWXpPVFEyTVNBd0xqY3dOems1TVV3d0xqWXpPRGc0TVNBd0xqY3dOVEEwTjBnd0xqY3dNRGM1TkVnd0xqWXpPRGc0TVZwTk1DNDFPREEwT1RnZ01DNDNNRFV3TkRoTU1DNDJNak0xTlRNZ01DNDNNRFV3TkRaRE1DNDJNamN5TURFZ01DNDNNalU0TmpnZ01DNDJNek16T0RNZ01DNDNORE0xT0RNZ01DNDJOREUwTnpVZ01DNDNOVFU1T0VNd0xqWXhOVGcwTnlBd0xqYzBPRFF4TVNBd0xqVTVORFV4TVNBd0xqY3pNRGcyTkNBd0xqVTRNVGsyTVNBd0xqY3dOemd6TjB3d0xqVTRNRFE1T0NBd0xqY3dOVEEwT0ZwTk1DNDNNVFl4TWpJZ01DNDNNRFV3TkRaTU1DNDNOVGt4TnpnZ01DNDNNRFV3TkRoRE1DNDNORFk0TmpVZ01DNDNNamswTkRRZ01DNDNNalE0TlRRZ01DNDNORGd4TURrZ01DNDJPVGd5TVRFZ01DNDNOVFU1TnpkRE1DNDNNRFUzTlRZZ01DNDNORFEwSURBdU56RXhOalF6SURBdU56STRNakF4SURBdU56RTFNelU1SURBdU56QTVNVFkzVERBdU56RTJNVEl5SURBdU56QTFNRFEyVERBdU56VTVNVGM0SURBdU56QTFNRFE0VERBdU56RTJNVEl5SURBdU56QTFNRFEyV2swd0xqY3hPVEUxTVNBd0xqWTBNREEwTjB3d0xqYzJOemcxSURBdU5qUXdNRFF4UXpBdU56WTVNVFl5SURBdU5qUTJOVEEwSURBdU56WTVPRFV4SURBdU5qVXpNVGt6SURBdU56WTVPRFV4SURBdU5qWXdNRFF6UXpBdU56WTVPRFV4SURBdU5qY3dORGszSURBdU56WTRNalEzSURBdU5qZ3dOVGMxSURBdU56WTFNamN6SURBdU5qa3dNRFEzU0RBdU56RTRNalEzUXpBdU56RTVNeUF3TGpZNE1EUTNNU0F3TGpjeE9UZzFNaUF3TGpZM01EUXhJREF1TnpFNU9EVXlJREF1TmpZd01EUXpRekF1TnpFNU9EVXlJREF1TmpVMU5TQXdMamN4T1RjME5pQXdMalkxTVRBeE5pQXdMamN4T1RVek9DQXdMalkwTmpZd05Vd3dMamN4T1RFMU1TQXdMalkwTURBME4wd3dMamMyTnpnMUlEQXVOalF3TURReFREQXVOekU1TVRVeElEQXVOalF3TURRM1drMHdMalUzTVRneU5TQXdMalkwTURBME1Vd3dMall5TURVeU5DQXdMalkwTURBME4wTXdMall5TURBMk1pQXdMalkwTmpVME5pQXdMall4T1RneU15QXdMalkxTXpJeU9TQXdMall4T1RneU15QXdMalkyTURBME0wTXdMall4T1RneU15QXdMalkyT0RNek55QXdMall5TURFM05pQXdMalkzTmpRek5TQXdMall5TURnMU55QXdMalk0TkRJME5Vd3dMall5TVRReU9DQXdMalk1TURBME4wZ3dMalUzTkRRd01rTXdMalUzTVRReU9DQXdMalk0TURVM05TQXdMalUyT1RneU5DQXdMalkzTURRNU55QXdMalUyT1RneU5DQXdMalkyTURBME0wTXdMalUyT1RneU5DQXdMalkxTXpFNU15QXdMalUzTURVeE15QXdMalkwTmpVd05DQXdMalUzTVRneU5TQXdMalkwTURBME1WcE5NQzQyTXpVMU9UTWdNQzQyTkRBd05ERklNQzQzTURRd09ESkRNQzQzTURRMU9EUWdNQzQyTkRZME9UY2dNQzQzTURRNE5USWdNQzQyTlRNeE9EWWdNQzQzTURRNE5USWdNQzQyTmpBd05ETkRNQzQzTURRNE5USWdNQzQyTmpnME1pQXdMamN3TkRRMU15QXdMalkzTmpVME5DQXdMamN3TXpjeE5DQXdMalk0TkRNd01Vd3dMamN3TXpBNU55QXdMalk1TURBME9FZ3dMall6TmpVM09FTXdMall6TlRRME55QXdMalk0TURVNUlEQXVOak0wT0RJeklEQXVOamN3TlRFMElEQXVOak0wT0RJeklEQXVOall3TURRelF6QXVOak0wT0RJeklEQXVOalUwT1NBd0xqWXpORGszTkNBd0xqWTBPVGcxTWlBd0xqWXpOVEkyTVNBd0xqWTBORGt5Tmt3d0xqWXpOVFU1TXlBd0xqWTBNREEwTVVnd0xqY3dOREE0TWtnd0xqWXpOVFU1TTFwTk1DNDJPVGt5T0NBd0xqVTJOVGd4VERBdU5qazRNakF4SURBdU5UWTBNVEEzUXpBdU56STRNemd6SURBdU5UY3pNREUzSURBdU56VXlOakl6SURBdU5UazFOemd6SURBdU56WXpOVFUxSURBdU5qSTFNRFJNTUM0M01UYzJORGNnTUM0Mk1qVXdORE5ETUM0M01UUTBPVElnTUM0Mk1EQTROelFnTUM0M01EZ3dPRElnTUM0MU9EQXhNVGNnTUM0Mk9Ua3lPQ0F3TGpVMk5UZ3hUREF1TmprNE1qQXhJREF1TlRZME1UQTNUREF1TmprNU1qZ2dNQzQxTmpVNE1WcE5NQzQyTkRBeU5UWWdNQzQxTmpRME56Wk1NQzQyTkRFME56UWdNQzQxTmpReE1EaERNQzQyTXpJMk5qWWdNQzQxTnpjMk1ETWdNQzQyTWpZeE1pQXdMalU1TnpNNU9TQXdMall5TWpZME5DQXdMall5TURZME5Vd3dMall5TWpBeU9DQXdMall5TlRBME0wd3dMalUzTmpFeUlEQXVOakkxTURSRE1DNDFPRFk1TURVZ01DNDFPVFl4TnpnZ01DNDJNVEEyTkNBd0xqVTNNell6TXlBd0xqWTBNREkxTmlBd0xqVTJORFEzTmt3d0xqWTBNVFEzTkNBd0xqVTJOREV3T0V3d0xqWTBNREkxTmlBd0xqVTJORFEzTmxwTk1DNDJOams0TXpnZ01DNDFOakF3TlRsRE1DNDJPRE13TWpVZ01DNDFOakF3TlRrZ01DNDJPVFl5T1RNZ01DNDFPRFUwTnpZZ01DNDNNREU1TnpjZ01DNDJNakU0T1ROTU1DNDNNREkwTkRVZ01DNDJNalV3TkRGSU1DNDJNemN5TTBNd0xqWTBNall5TkNBd0xqVTROamswT1NBd0xqWTFOakkzTXlBd0xqVTJNREExT1NBd0xqWTJPVGd6T0NBd0xqVTJNREExT1ZvaUlHTnNZWE56UFNKcFkyOXVMV1pwYkd3aUx6NG1JM2hoT3p3dlp6NG1JM2hoT3p4eVpXTjBJSGc5SWpBdU1UazVPVFV4SWlCNVBTSXdMamd5T1RrMU5pSWdkMmxrZEdnOUlqQXVOakF5TmpZaUlHaGxhV2RvZEQwaU1DNHhOREl5TXpjaUlISjRQU0l3TGpBM01URXhPRFFpSUdOc1lYTnpQU0pwWTI5dUxXWnBiR3dpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpJM05URTFJREF1T1RVeU1qRXpRekF1TWpZMk9URWdNQzQ1TlRJd05UTWdNQzR5TmpBME15QXdMamswT1RVM015QXdMakkxTlRjeElEQXVPVFEwTnpjelF6QXVNalV4TURjZ01DNDVOREF3TlRRZ01DNHlORGczTlNBd0xqa3pNekUzTkNBd0xqSTBPRGMxSURBdU9USTBNVE0wVmpBdU9URTJOamswUXpBdU1qUTROelVnTUM0NU1UTTVOelFnTUM0eU5EZ3lNeUF3TGpreE1UZzFOQ0F3TGpJME56RTVJREF1T1RFd016TTBRekF1TWpRMk1UVWdNQzQ1TURnM016UWdNQzR5TkRRMk55QXdMamt3Tnprek5DQXdMakkwTWpjMUlEQXVPVEEzT1RNMFNEQXVNak01T1RsV01DNDRPVFV6TXpWSU1DNHlOREkzTlVNd0xqSTBORFkzSURBdU9EazFNek0xSURBdU1qUTJNVFVnTUM0NE9UUTFNelVnTUM0eU5EY3hPU0F3TGpnNU1qa3pOVU13TGpJME9ESXpJREF1T0RreE16TTFJREF1TWpRNE56VWdNQzQ0T0RreU1UVWdNQzR5TkRnM05TQXdMamc0TmpVM05WWXdMamczT1RJMU5VTXdMakkwT0RjMUlEQXVPRGN3TWpFMUlEQXVNalV4TURjZ01DNDROak16TXpVZ01DNHlOVFUzTVNBd0xqZzFPRFl4TlVNd0xqSTJNRFF6SURBdU9EVXpPRGsxSURBdU1qWTJPVEVnTUM0NE5URTBNVFlnTUM0eU56VXhOU0F3TGpnMU1URTNObFl3TGpnMk16YzNOVU13TGpJMk5qa3hJREF1T0RZME1qVTFJREF1TWpZeU56a2dNQzQ0TmpnMk9UVWdNQzR5TmpJM09TQXdMamczTnpBNU5WWXdMamc0TlRNM05VTXdMakkyTWpjNUlEQXVPRGt3TkRFMUlEQXVNall4T1RVZ01DNDRPVFF5TVRVZ01DNHlOakF5TnlBd0xqZzVOamMzTlVNd0xqSTFPRFkzSURBdU9EazVNalUwSURBdU1qVTJNak1nTUM0NU1EQTRPVFFnTUM0eU5USTVOU0F3TGprd01UWTVORU13TGpJMU9UVXhJREF1T1RBek16YzBJREF1TWpZeU56a2dNQzQ1TURnNE1UUWdNQzR5TmpJM09TQXdMamt4T0RBeE5GWXdMamt5TmpJNU5FTXdMakkyTWpjNUlEQXVPVE0wT0RVMElEQXVNalkyT1RFZ01DNDVNemt5T1RRZ01DNHlOelV4TlNBd0xqa3pPVFl4TkZZd0xqazFNakl4TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzR5T1RBeE5UWWdNQzQ1TXpZMk1UUldNQzQ0TlRJMk1UWklNQzR6TWpjek5UWkRNQzR6TXpjd016WWdNQzQ0TlRJMk1UWWdNQzR6TkRRd016WWdNQzQ0TlRVd01UVWdNQzR6TkRnek5UWWdNQzQ0TlRrNE1UVkRNQzR6TlRJM05UWWdNQzQ0TmpRMk1UVWdNQzR6TlRRNU5UWWdNQzQ0TnpBM016VWdNQzR6TlRRNU5UWWdNQzQ0TnpneE56VkRNQzR6TlRRNU5UWWdNQzQ0T0RNek56VWdNQzR6TlRNME56WWdNQzQ0T0RneU5UVWdNQzR6TlRBMU1UWWdNQzQ0T1RJNE1UVkRNQzR6TkRjMU5UWWdNQzQ0T1Rjek56VWdNQzR6TkRNeU56WWdNQzQ1TURBME9UUWdNQzR6TXpjMk56WWdNQzQ1TURJeE56Uk1NQzR6TlRRME56WWdNQzQ1TXpZMk1UUklNQzR6TXpneU56Wk1NQzR6TWpJd056WWdNQzQ1TURNM016UklNQzR6TURRMU5UWldNQzQ1TXpZMk1UUklNQzR5T1RBeE5UWmFUVEF1TXpBME5UVTJJREF1T0Rrd01EVTFTREF1TXpJM05UazJRekF1TXpNeE9URTJJREF1T0Rrd01EVTFJREF1TXpNMU1EYzJJREF1T0RnNE9UTTFJREF1TXpNM01EYzJJREF1T0RnMk5qazFRekF1TXpNNU1EYzJJREF1T0RnME5EVTFJREF1TXpRd01EYzJJREF1T0RneE5qRTFJREF1TXpRd01EYzJJREF1T0RjNE1UYzFRekF1TXpRd01EYzJJREF1T0RjME9ERTFJREF1TXpNNU1URTJJREF1T0RjeU1ERTFJREF1TXpNM01UazJJREF1T0RZNU56YzFRekF1TXpNMU1qYzJJREF1T0RZM05EVTFJREF1TXpNeU1EYzJJREF1T0RZMk1qazFJREF1TXpJM05UazJJREF1T0RZMk1qazFTREF1TXpBME5UVTJWakF1T0Rrd01EVTFXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqTTNNak13TkNBd0xqa3pOall4TkZZd0xqZzFNall4Tmtnd0xqUXlOekF5TkZZd0xqZzJOakUzTlVnd0xqTTROamN3TkZZd0xqZzROalExTlVnd0xqUXhNVFUwTkZZd0xqa3dNREF4TkVnd0xqTTROamN3TkZZd0xqa3lNekExTkVnd0xqUXlPVFkyTkZZd0xqa3pOall4TkVnd0xqTTNNak13TkZvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTnpJM056Z2dNQzQ1TXpnd05UUkRNQzQwTmpVd09UZ2dNQzQ1TXpnd05UUWdNQzQwTlRnME5UZ2dNQzQ1TXpZeE16UWdNQzQwTlRJNE5UZ2dNQzQ1TXpJeU9UUkRNQzQwTkRjek16Z2dNQzQ1TWpnek56UWdNQzQwTkRNME1UZ2dNQzQ1TWpNd05UUWdNQzQwTkRFd09UZ2dNQzQ1TVRZek16Uk1NQzQwTlRRME1UZ2dNQzQ1TVRFME1UUkRNQzQwTlRZeE56Z2dNQzQ1TVRVek16UWdNQzQwTlRnMk9UZ2dNQzQ1TVRnME9UUWdNQzQwTmpFNU56Z2dNQzQ1TWpBNE9UUkRNQzQwTmpVeU5UZ2dNQzQ1TWpNeU1UUWdNQzQwTmprd01UZ2dNQzQ1TWpRek56UWdNQzQwTnpNeU5UZ2dNQzQ1TWpRek56UkRNQzQwTnpjMk5UZ2dNQzQ1TWpRek56UWdNQzQwT0RFeE16Z2dNQzQ1TWpNek56UWdNQzQwT0RNMk9UZ2dNQzQ1TWpFek56UkRNQzQwT0RZek16Z2dNQzQ1TVRrek56UWdNQzQwT0RjMk5UZ2dNQzQ1TVRZME9UUWdNQzQwT0RjMk5UZ2dNQzQ1TVRJM016UkRNQzQwT0RjMk5UZ2dNQzQ1TVRFeU1UUWdNQzQwT0RjeU9UZ2dNQzQ1TURrNE1UUWdNQzQwT0RZMU56Z2dNQzQ1TURnMU16UkRNQzQwT0RVNE5UZ2dNQzQ1TURjeE56UWdNQzQwT0RVd01UZ2dNQzQ1TURZd05UUWdNQzQwT0RRd05UZ2dNQzQ1TURVeE56UkRNQzQwT0RNeE56Z2dNQzQ1TURReU9UUWdNQzQwT0RFNE1UZ2dNQzQ1TURNME1UUWdNQzQwTnprNU56Z2dNQzQ1TURJMU16UkRNQzQwTnpneE16Z2dNQzQ1TURFMk5UUWdNQzQwTnpZMU56Z2dNQzQ1TURBNU56UWdNQzQwTnpVeU9UZ2dNQzQ1TURBME9UUkRNQzQwTnpRd01UZ2dNQzQ0T1RrNU16UWdNQzQwTnpJeE16Z2dNQzQ0T1RreU5UUWdNQzQwTmprMk5UZ2dNQzQ0T1RnME5UUkRNQzQwTmpZME5UZ2dNQzQ0T1Rjek16VWdNQzQwTmpNNU56Z2dNQzQ0T1RZME5UVWdNQzQwTmpJeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwTmpBMU16Z2dNQzQ0T1RVeE56VWdNQzQwTlRnek16Z2dNQzQ0T1RReE16VWdNQzQwTlRVMk1UZ2dNQzQ0T1RJMk9UVkRNQzQwTlRJNU56Z2dNQzQ0T1RFeE56VWdNQzQwTlRBNU16Z2dNQzQ0T0RrMk5UVWdNQzQwTkRrME9UZ2dNQzQ0T0RneE16VkRNQzQwTkRneE16Z2dNQzQ0T0RZMk1UVWdNQzQwTkRZNE9UZ2dNQzQ0T0RRMk1UVWdNQzQwTkRVM056Z2dNQzQ0T0RJeE16VkRNQzQwTkRRM016Z2dNQzQ0TnprMU56VWdNQzQwTkRReU1UZ2dNQzQ0TnpZM056VWdNQzQwTkRReU1UZ2dNQzQ0TnpNM016VkRNQzQwTkRReU1UZ2dNQzQ0Tmpjek16VWdNQzQwTkRZMk9UZ2dNQzQ0TmpFNU56VWdNQzQwTlRFMk5UZ2dNQzQ0TlRjMk5UVkRNQzQwTlRZMk1UZ2dNQzQ0TlRNek16WWdNQzQwTmpNek16Z2dNQzQ0TlRFeE56WWdNQzQwTnpFNE1UZ2dNQzQ0TlRFeE56WkRNQzQwTnpnNE5UZ2dNQzQ0TlRFeE56WWdNQzQwT0RRMk9UZ2dNQzQ0TlRJNE5UWWdNQzQwT0Rrek16Z2dNQzQ0TlRZeU1UVkRNQzQwT1RNNU56Z2dNQzQ0TlRrME9UVWdNQzQwT1Rjd09UZ2dNQzQ0TmpNNE1UVWdNQzQwT1RnMk9UZ2dNQzQ0TmpreE56Vk1NQzQwT0RVM016Z2dNQzQ0TnpNME9UVkRNQzQwT0RNeE56Z2dNQzQ0TmpjM016VWdNQzQwTnpneU1UZ2dNQzQ0TmpRNE5UVWdNQzQwTnpBNE5UZ2dNQzQ0TmpRNE5UVkRNQzQwTmpjd09UZ2dNQzQ0TmpRNE5UVWdNQzQwTmpReE16Z2dNQzQ0TmpVMk5UVWdNQzQwTmpFNU56Z2dNQzQ0TmpjeU5UVkRNQzQwTlRrNE9UZ2dNQzQ0TmpnM056VWdNQzQwTlRnNE5UZ2dNQzQ0TnpBNU56VWdNQzQwTlRnNE5UZ2dNQzQ0TnpNNE5UVkRNQzQwTlRnNE5UZ2dNQzQ0TnpVM056VWdNQzQwTlRrMk5UZ2dNQzQ0TnpjME9UVWdNQzQwTmpFeU5UZ2dNQzQ0Tnprd01UVkRNQzQwTmpJNU16Z2dNQzQ0T0RBMU16VWdNQzQwTmpRMk9UZ2dNQzQ0T0RFMk9UVWdNQzQwTmpZMU16Z2dNQzQ0T0RJME9UVkRNQzQwTmpnME5UZ2dNQzQ0T0RNeU1UVWdNQzQwTnpFeU5UZ2dNQzQ0T0RReE56VWdNQzQwTnpRNU16Z2dNQzQ0T0RVek56VkRNQzQwTnpjek16Z2dNQzQ0T0RZeU5UVWdNQzQwTnpreE16Z2dNQzQ0T0RZNU16VWdNQzQwT0RBek16Z2dNQzQ0T0RjME1UVkRNQzQwT0RFMk1UZ2dNQzQ0T0RjNE1UVWdNQzQwT0RNek56Z2dNQzQ0T0RnMU16VWdNQzQwT0RVMk1UZ2dNQzQ0T0RrMU56VkRNQzQwT0RjNE5UZ2dNQzQ0T1RBMk1UVWdNQzQwT0RrMk1UZ2dNQzQ0T1RFMU56VWdNQzQwT1RBNE9UZ2dNQzQ0T1RJME5UVkRNQzQwT1RJeE56Z2dNQzQ0T1RNeU5UVWdNQzQwT1RNMk1UZ2dNQzQ0T1RRek56VWdNQzQwT1RVeU1UZ2dNQzQ0T1RVNE1UVkRNQzQwT1RZNE9UZ2dNQzQ0T1RjeU5UVWdNQzQwT1RneE56Z2dNQzQ0T1RnM056UWdNQzQwT1Rrd05UZ2dNQzQ1TURBek56UkRNQzQwT1RrNU16Z2dNQzQ1TURFNE9UUWdNQzQxTURBMk9UZ2dNQzQ1TURNM016UWdNQzQxTURFek16Z2dNQzQ1TURVNE9UUkRNQzQxTURFNU56Z2dNQzQ1TURjNU56UWdNQzQxTURJeU9UZ2dNQzQ1TVRBeU5UUWdNQzQxTURJeU9UZ2dNQzQ1TVRJM016UkRNQzQxTURJeU9UZ2dNQzQ1TWpBMU56UWdNQzQwT1RrME9UZ2dNQzQ1TWpZM056UWdNQzQwT1RNNE9UZ2dNQzQ1TXpFek16UkRNQzQwT0Rnek56Z2dNQzQ1TXpVNE1UUWdNQzQwT0RFek16Z2dNQzQ1TXpnd05UUWdNQzQwTnpJM056Z2dNQzQ1TXpnd05UUmFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5UVXlNRElnTUM0NE5qWTBNVFZXTUM0NU16WTJNVFJJTUM0MU16YzJNbFl3TGpnMk5qUXhOVWd3TGpVeE16YzBWakF1T0RVeU5qRTJTREF1TlRjMU9WWXdMamcyTmpReE5VZ3dMalUxTWpBeVdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZd05UUXpOU0F3TGpnNE56VXpOVll3TGprek5qWXhORWd3TGpVNU1UTTVOVll3TGpnNE56VXpOVWd3TGpVNE1qVXhOVll3TGpnM05USTVOVWd3TGpVNU1UTTVOVll3TGpnMk5UWTVOVU13TGpVNU1UTTVOU0F3TGpnMU5qQXhOU0F3TGpVNU5qSXpOU0F3TGpnMU1URTNOaUF3TGpZd05Ua3hOU0F3TGpnMU1URTNOa013TGpZeE1EYzVOU0F3TGpnMU1URTNOaUF3TGpZeE5URXhOU0F3TGpnMU1qRXpOaUF3TGpZeE9EZzNOU0F3TGpnMU5EQTFOVll3TGpnMk5UVTNOVU13TGpZeE5UVTVOU0F3TGpnMk5ESXhOU0F3TGpZeE1qWTNOU0F3TGpnMk16VXpOU0F3TGpZeE1ERXhOU0F3TGpnMk16VXpOVU13TGpZd05qazVOU0F3TGpnMk16VXpOU0F3TGpZd05UUXpOU0F3TGpnMk5URXpOU0F3TGpZd05UUXpOU0F3TGpnMk9ETXpOVll3TGpnM05USTVOVWd3TGpZeE9EZzNOVll3TGpnNE56VXpOVWd3TGpZd05UUXpOVm9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOall6TlRRZ01DNDVNelkyTVRSV01DNDVNekEzTXpSRE1DNDJOakkxTVRRZ01DNDVNelUyTVRRZ01DNDJOVGN4TlRRZ01DNDVNemd3TlRRZ01DNDJOVEF5TnpRZ01DNDVNemd3TlRSRE1DNDJORE00TnpRZ01DNDVNemd3TlRRZ01DNDJNemcyTXpRZ01DNDVNell3TlRRZ01DNDJNelExTlRRZ01DNDVNekl3TlRSRE1DNDJNekEwTnpRZ01DNDVNamM1TnpRZ01DNDJNamcwTXpRZ01DNDVNakUxTnpRZ01DNDJNamcwTXpRZ01DNDVNVEk0TlRSV01DNDROelV5T1RWSU1DNDJOREkwTnpSV01DNDVNVEF6TXpSRE1DNDJOREkwTnpRZ01DNDVNVGs0TlRRZ01DNDJORFl6TVRRZ01DNDVNalEyTVRRZ01DNDJOVE01T1RRZ01DNDVNalEyTVRSRE1DNDJOakl5TXpRZ01DNDVNalEyTVRRZ01DNDJOall6TlRRZ01DNDVNVGs1TXpRZ01DNDJOall6TlRRZ01DNDVNVEExTnpSV01DNDROelV5T1RWSU1DNDJPREF6T1RSV01DNDVNelkyTVRSSU1DNDJOall6TlRSYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmprNU1EQTVJREF1T1RNMk5qRTBWakF1T0RVMk5UYzFUREF1TnpFek1EUTVJREF1T0RRNU9UYzJWakF1T1RNMk5qRTBTREF1TmprNU1EQTVXaUlnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqY3lOelE1SURBdU9UVXlNakV6VmpBdU9UTTVOakUwUXpBdU56TTFPREVnTUM0NU16a3lNVFFnTUM0M016azVOeUF3TGprek5EYzNOQ0F3TGpjek9UazNJREF1T1RJMk1qazBWakF1T1RFNE1ERTBRekF1TnpNNU9UY2dNQzQ1TURnNE1UUWdNQzQzTkRNeU5TQXdMamt3TXpNM05DQXdMamMwT1RneElEQXVPVEF4TmprMFF6QXVOelEyTlRNZ01DNDVNREE0T1RRZ01DNDNORFF3TlNBd0xqZzVPVEkxTkNBd0xqYzBNak0zSURBdU9EazJOemMxUXpBdU56UXdOemNnTUM0NE9UUXlNVFVnTUM0M016azVOeUF3TGpnNU1EUXhOU0F3TGpjek9UazNJREF1T0RnMU16YzFWakF1T0RjM01EazFRekF1TnpNNU9UY2dNQzQ0TmpnMk9UVWdNQzQzTXpVNE1TQXdMamcyTkRJMU5TQXdMamN5TnpRNUlEQXVPRFl6TnpjMVZqQXVPRFV4TVRjMlF6QXVOek0xTnpNZ01DNDROVEUwTVRZZ01DNDNOREl5TVNBd0xqZzFNemt6TlNBd0xqYzBOamt6SURBdU9EVTROek0xUXpBdU56VXhOalVnTUM0NE5qTTBOVFVnTUM0M05UUXdNU0F3TGpnM01ESTVOU0F3TGpjMU5EQXhJREF1T0RjNU1qVTFWakF1T0RnMk5UYzFRekF1TnpVME1ERWdNQzQ0T0RreU1UVWdNQzQzTlRRMU15QXdMamc1TVRNek5TQXdMamMxTlRVM0lEQXVPRGt5T1RNMVF6QXVOelUyTmpFZ01DNDRPVFExTXpVZ01DNDNOVGd3T1NBd0xqZzVOVE16TlNBd0xqYzJNREF4SURBdU9EazFNek0xU0RBdU56WXlOalZXTUM0NU1EYzVNelJJTUM0M05qQXdNVU13TGpjMU9EQTVJREF1T1RBM09UTTBJREF1TnpVMk5qRWdNQzQ1TURnM016UWdNQzQzTlRVMU55QXdMamt4TURNek5FTXdMamMxTkRVeklEQXVPVEV4T0RVMElEQXVOelUwTURFZ01DNDVNVE01TnpRZ01DNDNOVFF3TVNBd0xqa3hOalk1TkZZd0xqa3lOREV6TkVNd0xqYzFOREF4SURBdU9UTXpNVGMwSURBdU56VXhOalVnTUM0NU5EQXdOVFFnTUM0M05EWTVNeUF3TGprME5EYzNNME13TGpjME1qSXhJREF1T1RRNU5UY3pJREF1TnpNMU56TWdNQzQ1TlRJd05UTWdNQzQzTWpjME9TQXdMamsxTWpJeE0xb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4TDJjK0ppTjRZVHM4WkdWbWN6NG1JM2hoT3p4amJHbHdVR0YwYUNCcFpEMGlZMnhwY0RBaVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqRWlJR2hsYVdkb2REMGlNU0lnWm1sc2JEMGlkMmhwZEdVaUx6NG1JM2hoT3p3dlkyeHBjRkJoZEdnK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF4SWo0bUkzaGhPenh5WldOMElIZHBaSFJvUFNJd0xqYzRJaUJvWldsbmFIUTlJakF1TnpnaUlHWnBiR3c5SW5kb2FYUmxJaUIwY21GdWMyWnZjbTA5SW5SeVlXNXpiR0YwWlNnd0xqRXdPVGcyTXlBd0xqQXpNREF5T1RNcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPWM1ZTQ3NjUwLWZiOWUtNDljYi1iMDg1LTM5MDAxN2JmNTdjMTsiIHBhcmVudD0iMzQiIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ2IiB5PSIxNDIiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxvYmplY3QgbGFiZWw9Ikt1YmVybmV0ZXMgQ2x1c3RlciIgaXIuc291cmNlU3R5bGU9InZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aHRtbD0xO3NoYXBlPW14Z3JhcGguYmFzaWMucmVjdDtmaWxsQ29sb3IyPW5vbmU7c3Ryb2tlV2lkdGg9MTtzaXplPTIwO2luZGVudD01O2ZvbnRDb2xvcj0jOEM4QzhDO2ZpbGxDb2xvcj0jRjVGNUY1OyIgaWQ9Ijg3Ij4KICAgICAgPG14Q2VsbCBzdHlsZT0idmVydGljYWxBbGlnbj10b3A7aHRtbD0xO2ZpbGxDb2xvcjI9bm9uZTtzdHJva2VXaWR0aD0xO3NpemU9MjA7aW5kZW50PTU7Zm9udENvbG9yPSM4QzhDOEM7ZmlsbENvbG9yPSNGNUY1RjU7Y29udGFpbmVyPTE7cm91bmRlZD0xO2FyY1NpemU9MztwZXJpbWV0ZXI9cmVjdGFuZ2xlUGVyaW1ldGVyO3JlY3Vyc2l2ZVJlc2l6ZT0wO3N0cm9rZUNvbG9yPSMyMEM5RTM7Zm9udFNpemU9MTM7d2hpdGVTcGFjZT13cmFwO2FsaWduPWxlZnQ7dGV4dERpcmVjdGlvbj1sdHI7c3BhY2luZ1RvcD0xO3NwYWNpbmdMZWZ0PTMyOyIgcGFyZW50PSIzNCIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSI0MjMiIHk9IjEzIiB3aWR0aD0iODY1IiBoZWlnaHQ9Ijg4NCIgYXM9Imdlb21ldHJ5Ii8+CiAgICAgIDwvbXhDZWxsPgogICAgPC9vYmplY3Q+CiAgICA8bXhDZWxsIGlkPSI2MyIgdmFsdWU9IkFQSSBnYXRld2F5IiBzdHlsZT0iaXIucmVmPTY5YTExMDY4LTk3YzUtNDQzYS05ZjJmLTNkMjdiZjhkZGFjOTtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1hcGktZ2F0ZXdheS1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEdjZ1kyeHBjQzF3WVhSb1BTSjFjbXdvSTJOc2FYQXdLU0krSmlONFlUczhaeUJqYkdsd0xYQmhkR2c5SW5WeWJDZ2pZMnhwY0RFcElqNG1JM2hoT3p4d1lYUm9JR1pwYkd3dGNuVnNaVDBpWlhabGJtOWtaQ0lnWTJ4cGNDMXlkV3hsUFNKbGRtVnViMlJrSWlCa1BTSk5NQzQyTkRnM01ESWdNQzQyTkRJNU16ZERNQzQyTlRZeU9ETWdNQzQyTXpRME56Z2dNQzQyTmpRMk9EY2dNQzQyTWpZNE1ERWdNQzQyTnpNM056a2dNQzQyTWpBd00wTXdMalkzTnpjME9DQXdMall4TnpBM05DQXdMalk0TXpBME55QXdMall4Tmprd05pQXdMalk0TmprMk55QXdMall4T1RZeE1Vd3dMamN3TlRjMk15QXdMall6TWpVNE0wTXdMamN4TkRNNE1pQXdMall6T0RVMU1pQXdMamN5TmpNMU1pQXdMall6TmpnMk5TQXdMamN6TXpVMU55QXdMall5T0RZMk1VTXdMamN6TlRRNU5TQXdMall5TmpRMU55QXdMamN6TmprMk9DQXdMall5TXpnNE55QXdMamN6TnpnNE9TQXdMall5TVRBNE9Fd3dMamMwTlRNZ01DNDFPVGczTmpWRE1DNDNORFk0TkRFZ01DNDFPVFF4TWpJZ01DNDNOVEV3T1RJZ01DNDFPVEE0TkRRZ01DNDNOVFU1TURVZ01DNDFPVEExT0RoRE1DNDNOemd6TURjZ01DNDFPRGt6T1RjZ01DNDRNREEwT0RFZ01DNDFPVE16TWpNZ01DNDRNakEzTmlBd0xqWXdNakEzUXpBdU9ESTFNVE16SURBdU5qQXpPVFUxSURBdU9ESTNOekkySURBdU5qQTRORFk1SURBdU9ESTNNakl4SURBdU5qRXpNekUxVERBdU9ESTBOemcwSURBdU5qTTJOekl6UXpBdU9ESTBNRGM1SURBdU5qUXpNemt5SURBdU9ESTJOVFl5SURBdU5qUTVPRGN6SURBdU9ETXhORGN5SURBdU5qVTBNVGMzUXpBdU9ETTJNemd5SURBdU5qVTRORGdnTUM0NE5ETXhNek1nTUM0Mk5qQXdPVE1nTUM0NE5EazJOallnTUM0Mk5UZzFNVGRNTUM0NE56STFOamNnTUM0Mk5UTXdNak5ETUM0NE56Y3pNRGNnTUM0Mk5URTRPRFlnTUM0NE9ESXhNaklnTUM0Mk5UTTROalVnTUM0NE9EUTFOallnTUM0Mk5UYzVOVE5ETUM0NE9UVTRPVE1nTUM0Mk56WTVNRFlnTUM0NU1ESTJPVFFnTUM0Mk9UZ3pOamtnTUM0NU1EUTBOVGNnTUM0M01qQTNNamxETUM0NU1EUTRNelVnTUM0M01qVTFNeklnTUM0NU1ESXhORGdnTUM0M016QXhOek1nTUM0NE9UYzNOVEVnTUM0M016SXpNVE5NTUM0NE56WTFNak1nTUM0M05ESTJORE5ETUM0NE56QTBOVE1nTUM0M05EVTJNREVnTUM0NE5qWXdNamdnTUM0M05URXlNeUF3TGpnMk5EWXdOU0F3TGpjMU56Z3dOa013TGpnMk16RTRNaUF3TGpjMk5ETTRNeUF3TGpnMk5Ea3pJREF1TnpjeE1USXlJREF1T0RZNU16RTJJREF1TnpjMU9UVTVUREF1T0RnME5qUTRJREF1TnpreU9EYzRRekF1T0RnM09ERXhJREF1TnprMk16WTNJREF1T0RnNE16Y2dNQzQ0TURFMU5qWWdNQzQ0T0RZd05EY2dNQzQ0TURVNE5qbERNQzQ0TnpVeE1qTWdNQzQ0TWpZd09Ua2dNQzQ0TlRrM016RWdNQzQ0TkRNMk5Ua2dNQzQ0TkRFeE1EZ2dNQzQ0TlRjeE16aERNQzQ0TXpjeE5EWWdNQzQ0TmpBd01EWWdNQzQ0TXpFNU1UZ2dNQzQ0TmpBeE16TWdNQzQ0TWpnd05EVWdNQzQ0TlRjME5UWk1NQzQ0TURreU9URWdNQzQ0TkRRME9URkRNQzQ0TURNNU1UY2dNQzQ0TkRBNE1ERWdNQzQzT1Rjd01UWWdNQzQ0TXprNU5qWWdNQzQzT1RBMk9UUWdNQzQ0TkRJeU5ETkRNQzQzT0RRek56SWdNQzQ0TkRRMU1Ua2dNQzQzTnprek9DQXdMamcwT1RZek5TQXdMamMzTnpJME5pQXdMamcxTmpBeE5rd3dMamMyT1RjNE5TQXdMamczT0RReE9VTXdMamMyT0RJMElEQXVPRGd6TURVNUlEQXVOell6T1RnM0lEQXVPRGcyTXpNeUlEQXVOelU1TVRjMklEQXVPRGcyTlRnMVF6QXVOek0yTnpVNElEQXVPRGczTnpZeElEQXVOekUwTlRjeElEQXVPRGd6T0RFM0lEQXVOamswTWpnMklEQXVPRGMxTURRNVF6QXVOamc1T1RFMklEQXVPRGN6TVRZeElEQXVOamczTXpJM0lEQXVPRFk0TmpRNElEQXVOamczT0RNeklEQXVPRFl6T0RBMFREQXVOamt3TWpnZ01DNDROREF6TmpaRE1DNDJPVEE1T0RRZ01DNDRNek0yT1RjZ01DNDJPRGcxTURFZ01DNDRNamN5TVRZZ01DNDJPRE0xT1RFZ01DNDRNakk1TVRORE1DNDJOemcyT0RFZ01DNDRNVGcyTURrZ01DNDJOekU1TXlBd0xqZ3hOams1TmlBd0xqWTJOVFF3TWlBd0xqZ3hPRFUzTVV3d0xqWTBNalV4TXlBd0xqZ3lOREEzTkVNd0xqWXpOemMzTVNBd0xqZ3lOVEl4TkNBd0xqWXpNamsxTXlBd0xqZ3lNekl6TmlBd0xqWXpNRFV3T0NBd0xqZ3hPVEUwTlVNd0xqWXhPVEU0SURBdU9EQXdNVGc0SURBdU5qRXlNemd5SURBdU56YzROekU1SURBdU5qRXdOakkzSURBdU56VTJNelUwUXpBdU5qRXdNalVnTUM0M05URTFORGtnTUM0Mk1USTVORElnTUM0M05EWTVNRFlnTUM0Mk1UY3pORE1nTUM0M05EUTNOamxNTUM0Mk16ZzBPVGtnTUM0M016UTBPVGhETUM0Mk5EUTFPRFVnTUM0M016RTFOREVnTUM0Mk5Ea3dNVEVnTUM0M01qVTRPU0F3TGpZMU1EUXhOQ0F3TGpjeE9USTFPVU13TGpZMU1UZ3lPQ0F3TGpjeE1qWTNNeUF3TGpZMU1EQTNOeUF3TGpjd05Ua3lPU0F3TGpZME5UWTVPQ0F3TGpjd01UQTRORXd3TGpZek1ETTROU0F3TGpZNE5ERTJORU13TGpZeU56RTROeUF3TGpZNE1EWXpNU0F3TGpZeU5qWTJNaUF3TGpZM05UTTFNaUF3TGpZeU9UQTNOaUF3TGpZM01UQXlPVU13TGpZek5EWXdPU0F3TGpZMk1URXlNU0F3TGpZME1URXlOeUF3TGpZMU1UYzNOQ0F3TGpZME9EY3dNaUF3TGpZME1qa3pOMXBOTUM0M09EWXhNREVnTUM0M09UazBORU13TGpneE9UYzJOU0F3TGpjNE16WTJNU0F3TGpnek5ESTJNeUF3TGpjME16VTRNU0F3TGpneE9EUTROQ0F3TGpjd09Ua3hPRU13TGpnd01qY3dOU0F3TGpZM05qSTFOU0F3TGpjMk1qWXlOQ0F3TGpZMk1UYzFPQ0F3TGpjeU9EazJJREF1TmpjM05UTTJRekF1TmprMU1qazJJREF1Tmprek16RTFJREF1Tmpnd056azRJREF1TnpNek16azJJREF1TmprMk5UYzNJREF1TnpZM01EVTRRekF1TnpFeU16VTJJREF1T0RBd056SXhJREF1TnpVeU5ETTNJREF1T0RFMU1qRTVJREF1TnpnMk1UQXhJREF1TnprNU5EUmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDNOelE1TXpJZ01DNDNOakkwT0RGV01DNDNOVFl3TmpSRE1DNDNOekF5TWpZZ01DNDNOakV6TmprZ01DNDNOalEyTWpFZ01DNDNOalF3TWpFZ01DNDNOVGd4TVRrZ01DNDNOalF3TWpGRE1DNDNOVEkyTkRNZ01DNDNOalF3TWpFZ01DNDNORGcwTlNBd0xqYzJNVGcwSURBdU56UTFOVFF4SURBdU56VTNORGMyVmpBdU56Z3lPRGczVERBdU56TTBNemMxSURBdU56ZzRNVFE1VmpBdU5qazJPRGs1U0RBdU56UTFOVFF4VmpBdU56TTJOREk0UXpBdU56UTFOVFF4SURBdU56UXpNREUySURBdU56UTJOamsySURBdU56UTNOVFV4SURBdU56UTVNREEySURBdU56VXdNRE15UXpBdU56VXhOREF5SURBdU56VXlOREk0SURBdU56VTBPVGsySURBdU56VXpOakkySURBdU56VTVOemczSURBdU56VXpOakkyUXpBdU56WTVPRGcwSURBdU56VXpOakkySURBdU56YzBPVE15SURBdU56UTNPVGM1SURBdU56YzBPVE15SURBdU56TTJOamcxVmpBdU5qazJPRGs1U0RBdU56ZzJNRGs0VmpBdU56WXlORGd4U0RBdU56YzBPVE15V2lJZ1ptbHNiRDBpSXpFeFFUaERSaUl2UGlZamVHRTdQQzluUGlZamVHRTdQR2NnWTJ4cGNDMXdZWFJvUFNKMWNtd29JMk5zYVhBeUtTSStKaU40WVRzOGNHRjBhQ0JtYVd4c0xYSjFiR1U5SW1WMlpXNXZaR1FpSUdOc2FYQXRjblZzWlQwaVpYWmxibTlrWkNJZ1pEMGlUVEF1TXpBMk5USXlJREF1TVRVd05qQTNRekF1TXpJNU16TTFJREF1TVRReU5qYzRJREF1TXpVeU9URXpJREF1TVRNM01UUTRJREF1TXpjMk9EYzFJREF1TVRNME1UQTRRekF1TXpnM016TTFJREF1TVRNeU56Z3hJREF1TXprM05Ea2dNQzR4TXpneU5UWWdNQzQwTURJeE5TQXdMakUwTnpjek5rd3dMalF5TkRRNU1pQXdMakU1TXpFNE9VTXdMalF6TkRjeE5TQXdMakl4TkRBM0lEQXVORFU0T1RjMElEQXVNakl6T1RNeUlEQXVORGd3T0RJMElEQXVNakUyTURjNVF6QXVORGcyTmprNElEQXVNakV6T1RjeUlEQXVORGt5TURZMElEQXVNakV3TmpVeklEQXVORGsyTmpJeUlEQXVNakEyTWpreVREQXVOVE16TURrMUlEQXVNVGN4TlRjNVF6QXVOVFF3TmpneElEQXVNVFkwTXpZZ01DNDFOVEU1T1RZZ01DNHhOakkzTWpVZ01DNDFOakV6TWpRZ01DNHhOamMxTURGRE1DNDJNRFEzTkRJZ01DNHhPRGszTXlBd0xqWTBNalUzTXlBd0xqSXlNVFV5TmlBd0xqWTNNVGsyT1NBd0xqSTJNRFE1TlVNd0xqWTNPRE13T0NBd0xqSTJPRGc1T0NBd0xqWTNPRFkwTkNBd0xqSTRNRE01TWlBd0xqWTNNamd3TmlBd0xqSTRPVEV6TjB3d0xqWTBORFl4TWlBd0xqTXpNVE0zTWtNd0xqWXpOalUxT1NBd0xqTTBNek01TkNBd0xqWXpORGN3TmlBd0xqTTFPRFUwTXlBd0xqWXpPVFl5SURBdU16Y3lNVGN5UXpBdU5qUTBOVE0wSURBdU16ZzFPQ0F3TGpZMU5UWXlPQ0F3TGpNNU5qSTRNU0F3TGpZMk9UVXpJREF1TkRBd05EQTNUREF1TnpFNE1qSTNJREF1TkRFME9USTVRekF1TnpJNE16QTBJREF1TkRFM09UTTFJREF1TnpNMU16Z3pJREF1TkRJMk9UazVJREF1TnpNMU9EWTJJREF1TkRNM05URTJRekF1TnpNNE1UQTBJREF1TkRnMk1qWTVJREF1TnpJNU1qZ3hJREF1TlRNME9EZ3lJREF1TnpFd01EVTVJREF1TlRjNU56QXpRekF1TnpBMU9UTXhJREF1TlRnNU16STVJREF1TmprMk1UZzJJREF1TlRrMU1qazBJREF1TmpnMU56UXpJREF1TlRrME5UZzNUREF1TmpNMU16STBJREF1TlRreE1UYzBRekF1TmpJd09UQXlJREF1TlRrd01qQTBJREF1TmpBMk9EZzRJREF1TlRrMk1UWXhJREF1TlRrM05UYzJJREF1TmpBM01qRTVRekF1TlRnNE1qWTBJREF1TmpFNE1qYzNJREF1TlRnME56WTFJREF1TmpNek1URTRJREF1TlRnNE1UVXhJREF1TmpRM01UazFUREF1TlRrNU9UZzRJREF1TmprMk5ESTVRekF1TmpBeU5ESTVJREF1TnpBMk5UZ3hJREF1TlRrNE1qUXhJREF1TnpFM01UWTJJREF1TlRnNU5USTBJREF1TnpJeU9EYzVRekF1TlRRNE5UUTBJREF1TnpRNU56TXhJREF1TlRBeE9ETXpJREF1TnpZMk5UY3pJREF1TkRVek1UUTJJREF1TnpjeU1EVXhRekF1TkRReU56ZzVJREF1Tnpjek1qRTJJREF1TkRNeU9EQTVJREF1TnpZM056TTVJREF1TkRJNE1qRWdNQzQzTlRnek5qVk1NQzQwTURVNU16Z2dNQzQzTVRJNU56SkRNQzR6T1RrMU16SWdNQzQzTURBd01UTWdNQzR6T0Rjek5qZ2dNQzQyT1RBNE5qRWdNQzR6TnpNeE5Ua2dNQzQyT0Rnek1EbERNQzR6TlRnNU5URWdNQzQyT0RVM05UZ2dNQzR6TkRRek9EVWdNQzQyT1RBeE1Ea2dNQzR6TXpNNU16RWdNQzQzTURBd01UUk1NQzR5T1RjeU9ETWdNQzQzTXpRNE1qVkRNQzR5T0RrMk9USWdNQzQzTkRJd016VWdNQzR5Tnpnek56a2dNQzQzTkRNMk5pQXdMakkyT1RBMU55QXdMamN6T0RnM09VTXdMakl5TlRZeU5DQXdMamN4TmpZd05TQXdMakU0TnpjNE9TQXdMalk0TkRjMk1TQXdMakUxT0RRd01TQXdMalkwTlRjME0wTXdMakUxTWpBM01pQXdMall6TnpNek9TQXdMakUxTVRjME1pQXdMall5TlRnMUlEQXVNVFUzTlRjNUlEQXVOakUzTVRGTU1DNHhPRFU0TWpFZ01DNDFOelE0TWpkRE1DNHhPVE00TnpNZ01DNDFOakk0TURVZ01DNHhPVFUzTWpjZ01DNDFORGMyTlRZZ01DNHhPVEE0TVRNZ01DNDFNelF3TWpoRE1DNHhPRFU0T1RrZ01DNDFNakF6T1RrZ01DNHhOelE0TURRZ01DNDFNRGs1TVRnZ01DNHhOakE1TVRVZ01DNDFNRFUzT1RaTU1DNHhNVEl5TXlBd0xqUTVNVE13TlVNd0xqRXdNakUwTmlBd0xqUTRPRE13TXlBd0xqQTVOVEExT1RrZ01DNDBOemt5TXpVZ01DNHdPVFExTnpjMUlEQXVORFk0TnpFelF6QXVNRGt5TXpReUlEQXVOREU1T1RVeElEQXVNVEF4TVRjM0lEQXVNemN4TXpNZ01DNHhNakEwTVRrZ01DNHpNalkxTURoRE1DNHhNalExTlRNZ01DNHpNVFk0TnpnZ01DNHhNelF6TURnZ01DNHpNVEE1TVRZZ01DNHhORFEzTlRZZ01DNHpNVEUyTXpOTU1DNHhPVFE1T0NBd0xqTXhOVEE0TTBNd0xqSXdPVFF5T1NBd0xqTXhOakEzSURBdU1qSXpORFk1SURBdU16RXdNRGN5SURBdU1qTXlOemszSURBdU1qazRPRGc0UXpBdU1qUXlNVEF5SURBdU1qZzNPREF5SURBdU1qUTFOakF5SURBdU1qY3lPVFEzSURBdU1qUXlNak16SURBdU1qVTRPRFl5VERBdU1qTXdORE0zSURBdU1qQTVOalE1UXpBdU1qSTNPVGMwSURBdU1UazVNemN4SURBdU1qTXlNekEwSURBdU1UZzROamNnTUM0eU5ERXlNVElnTUM0eE9ETXdNVGxETUM0eU5qRTJNeUF3TGpFM01EQTJOeUF3TGpJNE16TXpOU0F3TGpFMU9USTNJREF1TXpBMk5USXlJREF1TVRVd05qQTNXazB3TGpReE5UUXlNaUF3TGpZeU1UYzNNME13TGpVd09EWXlJREF1TmpJeE56Y3pJREF1TlRnME1UY3hJREF1TlRRMk1qSXhJREF1TlRnME1UY3hJREF1TkRVek1ESTBRekF1TlRnME1UY3hJREF1TXpVNU9ESTJJREF1TlRBNE5qSWdNQzR5T0RReU56VWdNQzQwTVRVME1qSWdNQzR5T0RReU56VkRNQzR6TWpJeU1qTWdNQzR5T0RReU56VWdNQzR5TkRZMk56SWdNQzR6TlRrNE1qWWdNQzR5TkRZMk56SWdNQzQwTlRNd01qUkRNQzR5TkRZMk56SWdNQzQxTkRZeU1qRWdNQzR6TWpJeU1qTWdNQzQyTWpFM056TWdNQzQwTVRVME1qSWdNQzQyTWpFM056TmFJaUJtYVd4c1BTSWpNVEZCT0VOR0lpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHpOelUyTWlBd0xqUTVPVGsxT0V3d0xqTTJPRGM1TlNBd0xqUTRNakV3T0Vnd0xqTXpOREkzTmt3d0xqTXlOelExTVNBd0xqUTVPVGsxT0Vnd0xqTXdOVFkyTkV3d0xqTTBNVGc0T1NBd0xqUXdPREE0TVVnd0xqTTJNVEExTVV3d0xqTTVOelF3TnlBd0xqUTVPVGsxT0Vnd0xqTTNOVFl5V2swd0xqTTJNakV3TVNBd0xqUTJNemN6TWt3d0xqTTFOREl5TmlBd0xqUTBNemt4TTBNd0xqTTFNekF3TVNBd0xqUTBNRGt6T0NBd0xqTTFNakE0TWlBd0xqUXpPRE0xTnlBd0xqTTFNVFEzSURBdU5ETTJNVFk1UXpBdU16VXhNVElnTUM0ME16YzJOVGNnTUM0ek5UQXlNREVnTUM0ME5EQXlNemdnTUM0ek5EZzNNVFFnTUM0ME5ETTVNVE5NTUM0ek5EQTRNemtnTUM0ME5qTTNNekpJTUM0ek5qSXhNREZhSWlCbWFXeHNQU0lqTVRGQk9FTkdJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQwTURreE5EUWdNQzQwT1RrNU5UaFdNQzQwTURnd09ERklNQzQwTkRrNE16RkRNQzQwTmpBM05qZ2dNQzQwTURnd09ERWdNQzQwTmpnNE1UZ2dNQzQwTVRBNU1qVWdNQzQwTnpNNU9DQXdMalF4TmpZeE1rTXdMalEzT1RJeklEQXVOREl5TXlBd0xqUTRNVGcxTlNBd0xqUXlPVE1nTUM0ME9ERTROVFVnTUM0ME16YzJNVE5ETUM0ME9ERTROVFVnTUM0ME5ERXlJREF1TkRneE1qUXpJREF1TkRRME56QXhJREF1TkRnd01ERTRJREF1TkRRNE1URXpRekF1TkRjNE56a3pJREF1TkRVeE5ETTRJREF1TkRjMk9UVTFJREF1TkRVME5UUTBJREF1TkRjME5UQTFJREF1TkRVM05ETXlRekF1TkRjeU1EVTFJREF1TkRZd016SWdNQzQwTmpnMk9EY2dNQzQwTmpJMk16Z2dNQzQwTmpRek9Ua2dNQzQwTmpRek9EaERNQzQwTmpBeE1USWdNQzQwTmpZeE16Z2dNQzQwTlRVeU5UWWdNQzQwTmpjd01UTWdNQzQwTkRrNE16RWdNQzQwTmpjd01UTklNQzQwTWprd09UTldNQzQwT1RrNU5UaElNQzQwTURreE5EUmFUVEF1TkRVd05qRTRJREF1TkRRNE1qUTBRekF1TkRVME1URTRJREF1TkRRNE1qUTBJREF1TkRVMk56UXpJREF1TkRRM01UazBJREF1TkRVNE5Ea3pJREF1TkRRMU1EazBRekF1TkRZd01qUXpJREF1TkRReU9UazBJREF1TkRZeE1URTRJREF1TkRRd05TQXdMalEyTVRFeE9DQXdMalF6TnpZeE0wTXdMalEyTVRFeE9DQXdMalF6TkRneE15QXdMalEyTURJNE55QXdMalF6TWpNMk15QXdMalExT0RZeU5DQXdMalF6TURJMk0wTXdMalExTmprMk1pQXdMalF5T0RBM05TQXdMalExTkRJNU15QXdMalF5TmprNE1TQXdMalExTURZeE9DQXdMalF5TmprNE1VZ3dMalF5T1RBNU0xWXdMalEwT0RJME5FZ3dMalExTURZeE9Gb2lJR1pwYkd3OUlpTXhNVUU0UTBZaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUTVOREV6TnlBd0xqUTVPVGsxT0ZZd0xqUXdPREE0TVVnd0xqVXhOREE0TjFZd0xqUTVPVGsxT0Vnd0xqUTVOREV6TjFvaUlHWnBiR3c5SWlNeE1VRTRRMFlpTHo0bUkzaGhPend2Wno0bUkzaGhPend2Wno0bUkzaGhPenhrWldaelBpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TUNJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDVNemMxSWlCb1pXbG5hSFE5SWpBdU9UTTNOU0lnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TURNeE1qVWdNQzR3TXpFeU5Ta2lMejRtSTNoaE96d3ZZMnhwY0ZCaGRHZytKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBeElqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXdMakk0T1RjeU5pSWdhR1ZwWjJoMFBTSXdMakk0T1RjeU1pSWdabWxzYkQwaWQyaHBkR1VpSUhSeVlXNXpabTl5YlQwaWRISmhibk5zWVhSbEtEQXVOakV5TnpreklEQXVOVGt6TnpVcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEdOc2FYQlFZWFJvSUdsa1BTSmpiR2x3TWlJK0ppTjRZVHM4Y21WamRDQjNhV1IwYUQwaU1DNDJOVFl5TlNJZ2FHVnBaMmgwUFNJd0xqWTFOakkxSWlCbWFXeHNQU0ozYUdsMFpTSWdkSEpoYm5ObWIzSnRQU0owY21GdWMyeGhkR1VvTUM0d09EYzBNREl6SURBdU1USTFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjEzMiIgeT0iMzU5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8b2JqZWN0IGxhYmVsPSJTdHVkaW8iIGlyLnNvdXJjZVN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTA7IiBpZD0iNzAiPgogICAgICA8bXhDZWxsIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1sZWZ0O2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT0zO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTM7c291cmNlPWN1c3RvbTtpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7Y29udGFpbmVyPTE7cGVyaW1ldGVyPXJlY3RhbmdsZVBlcmltZXRlcjtyZWN1cnNpdmVSZXNpemU9MDtzdHJva2VXaWR0aD0xO3RleHREaXJlY3Rpb249bHRyO3NwYWNpbmdUb3A9MTtzcGFjaW5nTGVmdD0zMjtpci5yZWY9N2VjODgzOTMtZmFmZC00M2Q2LWIyMDUtY2ZhNTFkOGNmMTc1OyIgcGFyZW50PSI4NyIgdmVydGV4PSIxIiBpc1RodW1iPSIwIj4KICAgICAgICA8bXhHZW9tZXRyeSB4PSIxMTAiIHk9IjcyNSIgd2lkdGg9IjEzNCIgaGVpZ2h0PSIxMDUiIGFzPSJnZW9tZXRyeSIvPgogICAgICA8L214Q2VsbD4KICAgIDwvb2JqZWN0PgogICAgPG14Q2VsbCBpZD0iNDkiIHZhbHVlPSJMb2dpbiIgc3R5bGU9ImlyLnJlZj0xNjE3YzZjNC0wMTBjLTQ1YzgtOTA4NS0xODM3YTFkNjAwYzM7cm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9Q0QtTE9HSU47aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEcxaGMyc2dhV1E5SW0xaGMyc3dYekUwTlRCZk1qTTBNRGtpSUhOMGVXeGxQU0p0WVhOckxYUjVjR1U2WVd4d2FHRWlJRzFoYzJ0VmJtbDBjejBpZFhObGNsTndZV05sVDI1VmMyVWlJSGc5SWpBaUlIazlJakFpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaVBpWWplR0U3UEdOcGNtTnNaU0JqZUQwaU1DNDFJaUJqZVQwaU1DNDFJaUJ5UFNJd0xqVWlJR1pwYkd3OUltSnNZV05ySWk4K0ppTjRZVHM4TDIxaGMycytKaU40WVRzOFp5QnRZWE5yUFNKMWNtd29JMjFoYzJzd1h6RTBOVEJmTWpNME1Ea3BJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TUY4eE5EVXdYekl6TkRBNUtTSStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNHlNVGMzTnpNZ01DNDFNalExTWpKTU1DNDBNekV5T0RJZ01DNDFNalExTkRsTU1DNHpPREU0TmpNZ01DNDFOekk0TVRKRE1DNHpOelF5TWpRZ01DNDFPREF5TmpnZ01DNHpOek0xTXpJZ01DNDFPVEU1TXpRZ01DNHpOemszT0RRZ01DNDJNREF4TlRSTU1DNHpPREU0TmpnZ01DNDJNREkxTURsRE1DNHpPRGsxTURrZ01DNDJNRGs1TmpNZ01DNDBNREUwTmpRZ01DNDJNVEEyTXpnZ01DNDBNRGs0T0RjZ01DNDJNRFExTXpkTU1DNDBNVEl6SURBdU5qQXlOVEEwVERBdU5EazRNamM1SURBdU5URTROVGMwUXpBdU5UQTFPVEV4SURBdU5URXhNVEkwSURBdU5UQTJOakVnTUM0ME9UazBOekVnTUM0MU1EQXpOek1nTUM0ME9URXlOVEZNTUM0ME9UZ3lPVFFnTUM0ME9EZzRPVFpNTUM0ME1USXpNVFVnTUM0ME1EUTRNRFJETUM0ME1ETTVNakVnTUM0ek9UWTFPVFFnTUM0ek9UQXlPVFlnTUM0ek9UWTFOemtnTUM0ek9ERTRPRE1nTUM0ME1EUTNOME13TGpNM05ESXpOQ0F3TGpReE1qSXhOaUF3TGpNM016VXlOaUF3TGpReU16ZzRNaUF3TGpNM09UYzJOeUF3TGpRek1qRXdPVXd3TGpNNE1UZzBPQ0F3TGpRek5EUTJOMHd3TGpRek1EazVOaUF3TGpRNE1qVTFNVXd3TGpJeE56YzNNeUF3TGpRNE1qVXlORll3TGpVeU5EVXlNbG9pSUdacGJHdzlJaU13UWtFd1FqY2lMejRtSTNoaE96eHdZWFJvSUdacGJHd3RjblZzWlQwaVpYWmxibTlrWkNJZ1kyeHBjQzF5ZFd4bFBTSmxkbVZ1YjJSa0lpQmtQU0pOTUM0MU1qWTFPU0F3TGpjek5EWXhPVWd3TGpVeU5UVTFNVU13TGpVeE5ERTBOU0F3TGpjek5ETTFJREF1TlRBME5UazFJREF1TnpJMU1qSTFJREF1TlRBME5UazFJREF1TnpFek5qSXhWakF1TWprMk5UVTRRekF1TlRBME5UazFJREF1TWpnek5TQXdMalV4TmpZM09TQXdMakkzTXpZd09DQXdMalV5T1RnMU55QXdMakkzTlRnM09Vd3dMamMzTXpjek9TQXdMak14TnpreE0wTXdMamM0TkRBeU1TQXdMak14T1RZNE5TQXdMamM1TVRVeE5TQXdMak15T0RRd05DQXdMamM1TVRVeE5TQXdMak16T0RVNU1sWXdMalkzTkRVMFF6QXVOemt4TlRFMUlEQXVOamcwT0RJMElEQXVOemd6T0RneklEQXVOamt6TlRrMUlEQXVOemN6TkRneklEQXVOamsxTWpZeFREQXVOVEk1TmpBeElEQXVOek0wTXpRelF6QXVOVEk0TlRnNUlEQXVOek0wTlRBMUlEQXVOVEkzTlRneklEQXVOek0wTlRrMklEQXVOVEkyTlRrZ01DNDNNelEyTVRsYVRUQXVOak16TnpBNUlEQXVORGcxTkRnNVF6QXVOak16TnpBNUlEQXVOVEF3T1RnMklEQXVOakl3T0RNMklEQXVOVEV6TlRRNElEQXVOakEwT1RVMklEQXVOVEV6TlRRNFF6QXVOVGc1TURjMUlEQXVOVEV6TlRRNElEQXVOVGMyTWpBeUlEQXVOVEF3T1RnMklEQXVOVGMyTWpBeUlEQXVORGcxTkRnNVF6QXVOVGMyTWpBeUlEQXVORFk1T1RreklEQXVOVGc1TURjMUlEQXVORFUzTkRNZ01DNDJNRFE1TlRZZ01DNDBOVGMwTTBNd0xqWXlNRGd6TmlBd0xqUTFOelF6SURBdU5qTXpOekE1SURBdU5EWTVPVGt6SURBdU5qTXpOekE1SURBdU5EZzFORGc1V2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TkRVek9UVWdNQzR6TVRjMU1UZE1NQzQwTnpVNU1ETWdNQzR6TVRjMU1qSk1NQzQwTnpVNE5qUWdNQzQwTkRFM01qVk1NQzQwTXpJMU9UVWdNQzR6T1RrME9EZE1NQzQwTXpJME16RWdNQzR6TXpnMU5URkRNQzQwTXpJME1UTWdNQzR6TWpjNU1EY2dNQzQwTkRBMU1URWdNQzR6TVRreE1ESWdNQzQwTlRFd01qWWdNQzR6TVRjM01EbE1NQzQwTlRNNU5TQXdMak14TnpVeE4xb2lJR1pwYkd3OUlpTXdRa0V3UWpjaUx6NG1JM2hoT3p4d1lYUm9JR1E5SWswd0xqUXpNekF3TVNBd0xqWTNORFUzTlV3d0xqUXpNamt3TWlBd0xqWXhNekl6T1V3d0xqUTNOVGczTVNBd0xqVTNNVEl4TWt3d0xqUTNOVGt3TXlBd0xqVTVNVEl6TlZZd0xqWTVOVFV6T1V3d0xqUTFORFV5SURBdU5qazFOVE01UXpBdU5EUXpOak01SURBdU5qazFOVE01SURBdU5ETTBOalF4SURBdU5qZzNOalUzSURBdU5ETXpNakF5SURBdU5qYzNOREl4VERBdU5ETXpNREF4SURBdU5qYzBOVGMxV2lJZ1ptbHNiRDBpSXpCQ1FUQkNOeUl2UGlZamVHRTdQQzluUGlZamVHRTdQQzluUGlZamVHRTdQR1JsWm5NK0ppTjRZVHM4WTJ4cGNGQmhkR2dnYVdROUltTnNhWEF3WHpFME5UQmZNak0wTURraVBpWWplR0U3UEhKbFkzUWdkMmxrZEdnOUlqQXVOamc0TmpBNElpQm9aV2xuYUhROUlqQXVOamc0TmpBNElpQm1hV3hzUFNKM2FHbDBaU0lnZEhKaGJuTm1iM0p0UFNKMGNtRnVjMnhoZEdVb01DNHhOakF4TlRZZ01DNHhOakE0T0RrcElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9IjcwIiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIxMC41IiB5PSIyOCIgd2lkdGg9Ijc0IiBoZWlnaHQ9IjU0LjUiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3MyIgdmFsdWU9IkFQSSBnYXRld2F5IC0mZ3Q7IExvZ2luIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC4yNTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj0xMjhhMGU4Yi1iZTY0LTRkYzMtYTlhYi0yNDhkOTE1MDVhYmE7aXIudGFncz14bWwsSlNPTixIVFRQOyIgcGFyZW50PSI4NyIgc291cmNlPSI2MyIgdGFyZ2V0PSI0OSIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNzYiIHZhbHVlPSJTdHVkaW8gLSZndDsgQVBJIGdhdGV3YXkiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTA7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj0wZTNlZTIwOS02MTMzLTQxZmUtYWI3ZC00NzdmNWVjZDQyNzQ7aXIudGFncz1BY2Nlc3MgVG9rZW4sSlNPTixIVFRQOyIgcGFyZW50PSI4NyIgc291cmNlPSI3MCIgdGFyZ2V0PSI2MyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjAuNDUwNiIgeT0iLTE4IiByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8bXhQb2ludCBhcz0ib2Zmc2V0Ii8+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNTEiIHZhbHVlPSJPQXV0aDIgQXV0aG9yaXphdGlvbiBTZXJ2ZXIiIHN0eWxlPSJpci5yZWY9MDdlZGFmMzgtODVkNS00ZmMyLTk3YTEtZmZmZmM5MjFjOGM0O3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPW9hdXRoMi1hdXRob3JpemF0aW9uLXNlcnZlcjtpbWFnZT1kYXRhOmltYWdlL3N2Zyt4bWwsUEhOMlp5QjRiV3h1Y3owaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzl6ZG1jaUlIZHBaSFJvUFNJeElpQm9aV2xuYUhROUlqRWlJSFpwWlhkQ2IzZzlJakFnTUNBeElERWlJR1pwYkd3OUltNXZibVVpUGlZamVHRTdQSE4wZVd4bFBpWWplR0U3SUNBZ0lDNXBZMjl1TFdacGJHd2dleVlqZUdFN0lDQWdJQ0FnSUNCbWFXeHNPaUFqTVRGQk9FTkdPeVlqZUdFN0lDQWdJSDBtSTNoaE96d3ZjM1I1YkdVK0ppTjRZVHM4WnlCamJHbHdMWEJoZEdnOUluVnliQ2dqWTJ4cGNEQXBJajRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TVNraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU9EUXdOVGc0SURBdU5EZzBNemd4UXpBdU9EUXdOVGc0SURBdU1qZzNPVGtnTUM0Mk9ERXpPRElnTUM0eE1qZzNPRFFnTUM0ME9EUTVPVEVnTUM0eE1qZzNPRFJETUM0eU9EZzJNREVnTUM0eE1qZzNPRFFnTUM0eE1qa3pPVFVnTUM0eU9EYzVPU0F3TGpFeU9UTTVOU0F3TGpRNE5ETTRNVU13TGpFeU9UTTVOU0F3TGpZNE1EYzNNaUF3TGpJNE9EWXdNU0F3TGpnek9UazNPQ0F3TGpRNE5EazVNU0F3TGpnek9UazNPRU13TGpVd05qRXhOU0F3TGpnek9UazNPQ0F3TGpVeU5qZ3dPQ0F3TGpnek9ERXpOaUF3TGpVME5qa3lJREF1T0RNME5qQTBRekF1TlRNMk5UUXpJREF1T0RJeU1EZzBJREF1TlRJM05qTXlJREF1T0RBNE16QTBJREF1TlRJd05EVWdNQzQzT1RNMU0wTXdMalV3T0RneE15QXdMamM1TkRnMUlEQXVORGsyT1RneElEQXVOemsxTlRJNElEQXVORGcwT1RreElEQXVOemsxTlRJNFF6QXVNekV6TVRVZ01DNDNPVFUxTWpnZ01DNHhOek00TkRRZ01DNDJOVFl5TWpNZ01DNHhOek00TkRRZ01DNDBPRFF6T0RGRE1DNHhOek00TkRRZ01DNHpNVEkxTXprZ01DNHpNVE14TlNBd0xqRTNNekl6TkNBd0xqUTRORGs1TVNBd0xqRTNNekl6TkVNd0xqWTFOamd6TXlBd0xqRTNNekl6TkNBd0xqYzVOakV6T1NBd0xqTXhNalV6T1NBd0xqYzVOakV6T1NBd0xqUTRORE00TVVNd0xqYzVOakV6T1NBd0xqUTVOalkySURBdU56azFOREk0SURBdU5UQTROemN6SURBdU56azBNRFEwSURBdU5USXdOamhETUM0NE1EZzNPVGdnTUM0MU1qYzVNRE1nTUM0NE1qSTFOVE1nTUM0MU16WTROVEVnTUM0NE16VXdORFlnTUM0MU5EY3lOakpETUM0NE16ZzJPRGdnTUM0MU1qWTROVElnTUM0NE5EQTFPRGdnTUM0MU1EVTRNemdnTUM0NE5EQTFPRGdnTUM0ME9EUXpPREZhSWlCamJHRnpjejBpYVdOdmJpMW1hV3hzSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk16ZzFNREVnTUM0ME1ESXpNRGRETUM0Mk5EY3hPQ0F3TGpNNU16WXlPQ0F3TGpZME56RTRJREF1TXpjNU5UVTJJREF1TmpNNE5UQXhJREF1TXpjd09EYzNRekF1TmpJNU9ESXhJREF1TXpZeU1UazNJREF1TmpFMU56UTVJREF1TXpZeU1UazNJREF1TmpBM01EY2dNQzR6TnpBNE56ZE1NQzQwTWpjeU1EY2dNQzQxTlRBM05Fd3dMak0yTWpreE15QXdMalE0TmpRME5rTXdMak0xTkRJek5DQXdMalEzTnpjMk5pQXdMak0wTURFMk1pQXdMalEzTnpjMk5pQXdMak16TVRRNE1pQXdMalE0TmpRME5rTXdMak15TWpnd015QXdMalE1TlRFeU5TQXdMak15TWpnd015QXdMalV3T1RFNU55QXdMak16TVRRNE1pQXdMalV4TnpnM05rd3dMalF4TVRRNU1pQXdMalU1TnpnNE5VTXdMalF5TURFM01TQXdMall3TmpVMk5TQXdMalF6TkRJME15QXdMall3TmpVMk5TQXdMalEwTWpreU1pQXdMalU1TnpnNE5Vd3dMall6T0RVd01TQXdMalF3TWpNd04xb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96eG5JR05zYVhBdGNHRjBhRDBpZFhKc0tDTmpiR2x3TWlraVBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qazNOREV6SURBdU5UTXpOekpETUM0M056WXhORFVnTUM0MU1qZ3lOakVnTUM0NE1qZ3pORGNnTUM0MU5qWTNPRGtnTUM0NE5UZ3hPVFlnTUM0Mk1UTTNNekZETUM0NE56TXhOak1nTUM0Mk16Y3lOamNnTUM0NE9EYzRORGNnTUM0Mk56TXdNVFFnTUM0NE9EYzVNVFVnTUM0M01EazNORFJETUM0NE9EYzVPRGNnTUM0M05EazJOVEVnTUM0NE56VXdOVGtnTUM0M09EUXlNU0F3TGpnMU9ERTVOaUF3TGpnd09UVTJOME13TGpnME1EZzJOaUF3TGpnek5UWXlPU0F3TGpneE9EUTBPQ0F3TGpnMU56RTFOU0F3TGpjNU1ETTNPQ0F3TGpnM01USTRPVU13TGpjME16UTFOaUF3TGpnNU5Ea3hOeUF3TGpZM056ZzRJREF1T0RrMU5UWXpJREF1TmpNME9USTVJREF1T0RjeU9ERTBRekF1TlRnM01EazBJREF1T0RRM05EYzRJREF1TlRVd016RTFJREF1T0RFeE16RTNJREF1TlRNMk5qTWdNQzQzTkRnMk1EVkRNQzQxTXpFeE5UTWdNQzQzTWpNMU1Ea2dNQzQxTXpBMU1qTWdNQzQyT1RFd09ESWdNQzQxTXpneE5UTWdNQzQyTmpNeU5qRkRNQzQxTXprNU5EUWdNQzQyTlRZM016VWdNQzQxTkRNeE9UZ2dNQzQyTkRrNE5qWWdNQzQxTkRVM056UWdNQzQyTkRNME5EbERNQzQxTlRneE5USWdNQzQyTVRJMk1TQXdMalUzT1RJeU1TQXdMalU0TlRjNU5TQXdMall3TlRJeElEQXVOVFkzTWpRNFF6QXVOakUxTmpVMElEQXVOVFU1TnprMUlEQXVOakk0TXpJeklEQXVOVFV5TXpneklEQXVOak01TlRBeElEQXVOVFEzTkRNMlF6QXVOalV6TkRBNUlEQXVOVFF4TWpnZ01DNDJOelk0TWpVZ01DNDFNelV4TkRjZ01DNDJPVGMwTVRNZ01DNDFNek0zTWxvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TkRZNE5Ea2dNQzQzTVRReE9UZERNQzQ0TkRZNE5Ea2dNQzQzT0RnMk1EY2dNQzQzT0RZMU1qa2dNQzQ0TkRnNU1qUWdNQzQzTVRJeE1qRWdNQzQ0TkRnNU1qUkRNQzQyTXpjM01USWdNQzQ0TkRnNU1qUWdNQzQxTnpjek9UTWdNQzQzT0RnMk1EY2dNQzQxTnpjek9UTWdNQzQzTVRReE9UZERNQzQxTnpjek9UTWdNQzQyTXprM09Ea2dNQzQyTXpjM01USWdNQzQxTnprME5qZ2dNQzQzTVRJeE1qRWdNQzQxTnprME5qaERNQzQzT0RZMU1qZ2dNQzQxTnprME5qZ2dNQzQ0TkRZNE5Ea2dNQzQyTXprM09Ea2dNQzQ0TkRZNE5Ea2dNQzQzTVRReE9UZGFJaUJtYVd4c1BTSjNhR2wwWlNJdlBpWWplR0U3UEhCaGRHZ2daRDBpVFRBdU5qazNPVEF4SURBdU5UTXpOekpETUM0M056WTJNeklnTUM0MU1qZ3lOakVnTUM0NE1qZzRNelVnTUM0MU5qWTNPRGtnTUM0NE5UZzJPRFFnTUM0Mk1UTTNNekZETUM0NE56TTJOU0F3TGpZek56STJOeUF3TGpnNE9ETXpOU0F3TGpZM016QXhOQ0F3TGpnNE9EUXdNaUF3TGpjd09UYzBORU13TGpnNE9EUTNOU0F3TGpjME9UWTFNU0F3TGpnM05UVTBOeUF3TGpjNE5ESXhJREF1T0RVNE5qZzBJREF1T0RBNU5UWTNRekF1T0RReE16VXpJREF1T0RNMU5qSTVJREF1T0RFNE9UTTJJREF1T0RVM01UVTFJREF1Tnprd09EWTJJREF1T0RjeE1qbERNQzQzTkRNNU5EUWdNQzQ0T1RRNU1UY2dNQzQyTnpnek5qZ2dNQzQ0T1RVMU5qTWdNQzQyTXpVME1UWWdNQzQ0TnpJNE1UUkRNQzQxT0RjMU9ESWdNQzQ0TkRjME56a2dNQzQxTlRBNE1EUWdNQzQ0TVRFek1UY2dNQzQxTXpjeE1UZ2dNQzQzTkRnMk1EWkRNQzQxTXpFMk5ERWdNQzQzTWpNMU1Ea2dNQzQxTXpFd01USWdNQzQyT1RFd09ETWdNQzQxTXpnMk5ESWdNQzQyTmpNeU5qSkRNQzQxTkRBME16SWdNQzQyTlRZM016VWdNQzQxTkRNMk9EWWdNQzQyTkRrNE5qY2dNQzQxTkRZeU5qSWdNQzQyTkRNME5VTXdMalUxT0RZMElEQXVOakV5TmpFeElEQXVOVGM1TnpBNUlEQXVOVGcxTnprMUlEQXVOakExTmprNUlEQXVOVFkzTWpRNFF6QXVOakUyTVRReUlEQXVOVFU1TnprMklEQXVOakk0T0RFeUlEQXVOVFV5TXpnMElEQXVOak01T1RnNUlEQXVOVFEzTkRNMlF6QXVOalV6T0RrM0lEQXVOVFF4TWpnZ01DNDJOemN6TVRNZ01DNDFNelV4TkRjZ01DNDJPVGM1TURFZ01DNDFNek0zTWxwTk1DNDJOekV5TXlBd0xqVTBOalkzTkVNd0xqWTBNVGs0TnlBd0xqVTFOREkxTmlBd0xqWXlNRFUwTlNBd0xqVTJOemd6T1NBd0xqWXdNVGc0T0NBd0xqVTRNalE0T0VNd0xqVTNORGs0TlNBd0xqWXdNell4TWlBd0xqVTFOemd6TkNBd0xqWXpNekE1TVNBd0xqVTBOemM0TmlBd0xqWTJPRFU1TkVNd0xqVXpOall3TnlBd0xqY3dPREE1TkNBd0xqVTBNemM0T0NBd0xqYzFOVGc1TXlBd0xqVTFPVEl4TmlBd0xqYzROVGswTTBNd0xqVTNOVEl4TmlBd0xqZ3hOekV3TnlBd0xqVTVOalk1T0NBd0xqZzBNVEk1TnlBd0xqWXlOekF6TkNBd0xqZzFPRE16TkVNd0xqWTFOalUwT1NBd0xqZzNORGt3T1NBd0xqWTVPREEySURBdU9EZzFOVFV4SURBdU56UXhNek0zSURBdU9EYzNNemcwUXpBdU56YzVOemcxSURBdU9EY3dNVEk0SURBdU9EQTRPVGczSURBdU9EVXpNemM0SURBdU9ETXlOemMzSURBdU9ESTROakUyUXpBdU9EWTBOakExSURBdU56azFORGcxSURBdU9Ea3dNVGcySURBdU56TTBORFl5SURBdU9EY3pNVFkwSURBdU5qY3dNVEU1UXpBdU9EWTROakV5SURBdU5qVXlPVEl5SURBdU9EWXlOalkwSURBdU5qTTBPVGs1SURBdU9EVXpNelV4SURBdU5qRTVPREkyUXpBdU9EUTRNeklnTUM0Mk1URTJNeUF3TGpnME1Ea3pOU0F3TGpZd016VTJOU0F3TGpnek16VXpPU0F3TGpVNU5UUTBNa013TGpnd05UWXlNaUF3TGpVMk5EYzROQ0F3TGpjMk1EVXdNU0F3TGpVek9ETTJOU0F3TGpjd01qUTNOQ0F3TGpVME1qRXdNVU13TGpZNU1UUXpJREF1TlRReU9ERXlJREF1TmpneE56STFJREF1TlRRek9UVXpJREF1TmpjeE1qTWdNQzQxTkRZMk56UmFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQ0TWpNNU5UY2dNQzQxT1RZeE9ESkRNQzQ0TURrNU5EVWdNQzQxT0RJeE55QXdMamM1TWpjeE9DQXdMalUyT1RVME15QXdMamMzTWpFMElEQXVOVFl4T0RreFF6QXVOelV3T0RFeElEQXVOVFV6T1RZZ01DNDNNalkyT0RJZ01DNDFORGN5TnpRZ01DNDJPVGd5TWpZZ01DNDFORGsyT1RsRE1DNDJOVEk0T1RZZ01DNDFOVE0xTmpJZ01DNDJNakV3TmpnZ01DNDFOek01TURFZ01DNDFPVFk0TnprZ01DNDFPVGMzTURWRE1DNDFOems1TXpZZ01DNDJNVFF6TnpnZ01DNDFOamN4T1RFZ01DNDJNelE0TURrZ01DNDFOVGczTnprZ01DNDJOVGcyTmpaRE1DNDFORFkwTWpjZ01DNDJPVE0yT1RVZ01DNDFORGN4TnpjZ01DNDNNelV3TkRFZ01DNDFOakV3TmpVZ01DNDNOekEyT0RGRE1DNDFOekk1TVRJZ01DNDRNREV3T0RJZ01DNDFPVEl6TURFZ01DNDRNalUyTURJZ01DNDJNVGszTXprZ01DNDRORFExT1RaRE1DNDJORFUxTXpNZ01DNDROakkwTlRNZ01DNDJPREkxTlRRZ01DNDROell6TURNZ01DNDNNalF4TXpRZ01DNDROekkzT1RGRE1DNDNOelEzTnpjZ01DNDROamcxTVRNZ01DNDRNVEU0TXpJZ01DNDROREkxTXpFZ01DNDRNell4TkRnZ01DNDRNVEkxT1RKRE1DNDROREl6TmprZ01DNDRNRFE1TXpNZ01DNDRORGcxTlRZZ01DNDNPVFl5TnpVZ01DNDROVEl4TlNBd0xqYzROVGt5TWtNd0xqZzFOVFkzTWlBd0xqYzNPRFEyTVNBd0xqZzFOek01TlNBd0xqYzNNek01TVNBd0xqZzFPVEF3T0NBd0xqYzNNRFk0TVVNd0xqZzJOVGMyTVNBd0xqYzFOVFUwT0NBd0xqZzJPVE0wTVNBd0xqY3pPVFU0SURBdU9EY3dORE0zSURBdU56SXhPVEV6UXpBdU9EY3pPREUxSURBdU5qWTNOVGMySURBdU9EVXlPVEE0SURBdU5qSTFNVE16SURBdU9ESXpPVFUzSURBdU5UazJNVGd5V2swd0xqZ3dPVEF6TVNBd0xqYzJNVGN6TWtNd0xqZ3dPRGt6TlNBd0xqYzJNVGt6T1NBd0xqZ3dPRGcwT1NBd0xqYzJNakV6TWlBd0xqZ3dPRGMwTnlBd0xqYzJNak0wTkVNd0xqZ3dOakl6TlNBd0xqYzJPVFV6TkNBd0xqZ3dNVGt3TmlBd0xqYzNOVFUwTlNBd0xqYzVOelUxT0NBd0xqYzRNRGcyTlVNd0xqYzRNRFUxSURBdU9EQXhOalV6SURBdU56VTBOak01SURBdU9ERTVOamsxSURBdU56RTVNakl6SURBdU9ESXlOalkyUXpBdU5qa3dNVFExSURBdU9ESTFNVEF6SURBdU5qWTBNalUySURBdU9ERTFORGczSURBdU5qUTJNakU0SURBdU9EQXpNRGczUXpBdU5qTXdOVFEwSURBdU56a3lNekV5SURBdU5qRTROakk1SURBdU56YzRPVGMwSURBdU5qRXdNamMwSURBdU56WXlPVFExUXpBdU5qQTVOelkwSURBdU56WXhPVGdnTUM0Mk1EUTVNVElnTUM0M05UQTRNRElnTUM0Mk1EUTRPVGdnTUM0M05UQXpNRGxETUM0MU9UZ3lOemtnTUM0M01qazNOemdnTUM0MU9UYzNNRFFnTUM0Mk9UWTNOallnTUM0Mk1EUTBPVGdnTUM0Mk56WTVOVFJETUM0Mk1Ea3dNekVnTUM0Mk5qTTNNek1nTUM0Mk1UWTFPRGdnTUM0Mk5EazBNallnTUM0Mk1qWTFPVFVnTUM0Mk16Z3dPVEpETUM0Mk5EQTBNVE1nTUM0Mk1qSTBORElnTUM0Mk5UUXlOREVnTUM0Mk1USTBNVFFnTUM0Mk56WXhNallnTUM0Mk1EVXpNalpETUM0Mk9EWXhNVGtnTUM0Mk1ESXdPRGtnTUM0Mk9UVXdOalFnTUM0MU9UZzNPVFVnTUM0M01EY3pOamdnTUM0MU9UZzBOamhETUM0M016Y3pOeklnTUM0MU9UYzJOamtnTUM0M05qYzVNallnTUM0Mk1URXhOQ0F3TGpjNE5ETXpNU0F3TGpZeU5UbERNQzQzT1RrME1EY2dNQzQyTXprME5qTWdNQzQ0TVRZMU9EZ2dNQzQyTmpVNE9ETWdNQzQ0TWpBNU1EZ2dNQzQyT1RBMk4wTXdMamd5TlRNMU5TQXdMamN4TmpFNE15QXdMamd5TURZeElEQXVOelF4TURreUlEQXVPREE1TURNeElEQXVOell4TnpNeVdpSWdZMnhoYzNNOUltbGpiMjR0Wm1sc2JDSXZQaVlqZUdFN1BIQmhkR2dnWkQwaVRUQXVOakl3TWpZeElEQXVOakEyT1RoTU1DNDJNakF5TVRjZ01DNDJNRFk1TWpGRE1DNDJNVFU0T0RVZ01DNDJNREE1T0RJZ01DNDJNVGN4TlRZZ01DNDFPVEkyTnpVZ01DNDJNak0xTXpnZ01DNDFPRGd3TVRoRE1DNDJNams1TVRrZ01DNDFPRE16TmlBd0xqWXpPREV4TnlBd0xqVTRORFkyTnlBd0xqWTBNalExSURBdU5Ua3dOakEyVERBdU5qUXlORGt6SURBdU5Ua3dOalkwUXpBdU5qUTJPREkySURBdU5UazJOakF6SURBdU5qUTFOVFUxSURBdU5qQTBPVEV4SURBdU5qTTVNVGN6SURBdU5qQTVOVFk0UXpBdU5qTXlOemt4SURBdU5qRTBNakkxSURBdU5qSTBOVGswSURBdU5qRXlPVEU1SURBdU5qSXdNall4SURBdU5qQTJPVGhhVFRBdU5qTTJOamczSURBdU5UazBPVGt6VERBdU5qTTJOalF6SURBdU5UazBPVE0wUXpBdU5qTTBORFkySURBdU5Ua3hPVFVnTUM0Mk16QTBNVElnTUM0MU9UQTVNalFnTUM0Mk1qY3lOVEVnTUM0MU9UTXlNekZETUM0Mk1qUXhNaUF3TGpVNU5UVXhOaUF3TGpZeU16ZzNOaUF3TGpVNU9UVTRPQ0F3TGpZeU5qQTFNeUF3TGpZd01qVTNNa3d3TGpZeU5qQTVOaUF3TGpZd01qWXpNVU13TGpZeU9ESTNOU0F3TGpZd05UWXhOQ0F3TGpZek1qTXlPQ0F3TGpZd05qWTBNU0F3TGpZek5UUTFPU0F3TGpZd05ETTFOa013TGpZek9EWXlNU0F3TGpZd01qQTBPU0F3TGpZek9EZzJOQ0F3TGpVNU56azNOeUF3TGpZek5qWTROeUF3TGpVNU5EazVNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDJOakU1TWpNZ01DNDFOamd3TURoTU1DNDJOamcwTXpZZ01DNDFOalU1TVRoTU1DNDJPRFkyT1RJZ01DNDFPRGN4TkRGTU1DNDJOemswTkRnZ01DNDFPRGswTmpWTU1DNDJOell5TnpZZ01DNDFPRFUyT0RGTU1DNDJOalk0TnpJZ01DNDFPRGcyT1RsTU1DNDJOalkxTWpnZ01DNDFPVE0yTVRGTU1DNDJOVGswTWpRZ01DNDFPVFU0T1V3d0xqWTJNVGt5TXlBd0xqVTJPREF3T0ZwTk1DNDJOekkyTXpnZ01DNDFPREV3TkRsTU1DNDJOamMyT1RnZ01DNDFOelE1T1V3d0xqWTJOekUzSURBdU5UZ3lPREF6VERBdU5qY3lOak00SURBdU5UZ3hNRFE1V2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMalk1T0Rjek1TQXdMalUzTkRRek0wd3dMalk1T0RjNE9DQXdMalUyTURBMU9Vd3dMamN3TlRrNU15QXdMalUyTURBNE4wd3dMamN3TlRrek55QXdMalUzTkRNeE5VTXdMamN3TlRreU1pQXdMalUzT0RBd09TQXdMamN3TnpjNElEQXVOVGM1TnpjeUlEQXVOekV3TmpNMElEQXVOVGM1TnpnMFF6QXVOekV6TkRnM0lEQXVOVGM1TnprMUlEQXVOekUxTXpVNElEQXVOVGM0TVRJZ01DNDNNVFV6TnpJZ01DNDFOelExTXpaTU1DNDNNVFUwTXlBd0xqVTJNREV5TlV3d0xqY3lNall6TlNBd0xqVTJNREUxTkV3d0xqY3lNalUzT1NBd0xqVTNORE0wTlVNd0xqY3lNalUwTnlBd0xqVTRNall4TVNBd0xqY3hOemd4TkNBd0xqVTROakl4TXlBd0xqY3hNRFV6TlNBd0xqVTROakU0TkVNd0xqY3dNekkxTmlBd0xqVTROakUxTlNBd0xqWTVPRFk1T1NBd0xqVTRNalEwTXlBd0xqWTVPRGN6TVNBd0xqVTNORFF6TTFvaUlHWnBiR3c5SW5kb2FYUmxJaTgrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQzTkRnek1USWdNQzQxTnpFNU1EbE1NQzQzTkRBNU5qY2dNQzQxTmprMk5qaE1NQzQzTkRJM09ERWdNQzQxTmpNM01qRk1NQzQzTmpReU5UZ2dNQzQxTnpBeU56Wk1NQzQzTmpJME5EVWdNQzQxTnpZeU1qSk1NQzQzTlRVd09UZ2dNQzQxTnpNNU9ERk1NQzQzTkRrME16a2dNQzQxT1RJMU1rd3dMamMwTWpZMU15QXdMalU1TURRME9Vd3dMamMwT0RNeE1pQXdMalUzTVRrd09Wb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0M09ETTNNVFlnTUM0MU56ZzJNVE5NTUM0M09EazJNak1nTUM0MU9ESTFORFJNTUM0M09EUXpNVFVnTUM0MU9UQTFNakpNTUM0M09URTRPVGNnTUM0MU9UVTFOamRNTUM0M09UY3lNRFlnTUM0MU9EYzFPRGxNTUM0NE1ETXhNVFFnTUM0MU9URTFNakZNTUM0M09EZzVNamtnTUM0Mk1USTRNelpNTUM0M09ETXdNakVnTUM0Mk1EZzVNRFJNTUM0M09EZzBNU0F3TGpZd01EZ3dOVXd3TGpjNE1EZ3lPU0F3TGpVNU5UYzFPVXd3TGpjM05UUXpPU0F3TGpZd016ZzFPRXd3TGpjMk9UVXpNU0F3TGpVNU9Ua3lOMHd3TGpjNE16Y3hOaUF3TGpVM09EWXhNMW9pSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDRNRFF5TWpZZ01DNDRNVEUyTkROTU1DNDRNRFF5TmprZ01DNDRNVEUzTURGRE1DNDRNRGc0TWpjZ01DNDRNVGMwTnlBd0xqZ3dOemczTXlBd0xqZ3lOVGd5TVNBd0xqZ3dNVFkzTkNBd0xqZ3pNRGN4T0VNd0xqYzVOVFEzTmlBd0xqZ3pOVFl4TmlBd0xqYzROekl6TXlBd0xqZ3pORFl5TXlBd0xqYzRNalkzTlNBd0xqZ3lPRGcxTkV3d0xqYzRNall6TVNBd0xqZ3lPRGM1TmtNd0xqYzNPREEzTXlBd0xqZ3lNekF5TnlBd0xqYzNPVEF5TnlBd0xqZ3hORFkzTmlBd0xqYzROVEl5TmlBd0xqZ3dPVGMzT1VNd0xqYzVNVFF5TkNBd0xqZ3dORGc0TXlBd0xqYzVPVFkyT0NBd0xqZ3dOVGczTlNBd0xqZ3dOREl5TmlBd0xqZ3hNVFkwTTFwTk1DNDNPRGd5TmpjZ01DNDRNalF5TlV3d0xqYzRPRE14TWlBd0xqZ3lORE13T0VNd0xqYzVNRFl3TWlBd0xqZ3lOekl3TnlBd0xqYzVORFk1TWlBd0xqZ3lPREEzT0NBd0xqYzVOemMyTkNBd0xqZ3lOVFkxTVVNd0xqZ3dNRGd3TmlBd0xqZ3lNekkwT0NBd0xqZ3dNRGc1TkNBd0xqZ3hPVEUyT1NBd0xqYzVPRFl3TkNBd0xqZ3hOakkzTVV3d0xqYzVPRFUxT0NBd0xqZ3hOakl4TTBNd0xqYzVOakkyT1NBd0xqZ3hNek14TlNBd0xqYzVNakUzT0NBd0xqZ3hNalEwTkNBd0xqYzRPVEV6TnlBd0xqZ3hORGcwTjBNd0xqYzROakEyTlNBd0xqZ3hOekkzTkNBd0xqYzROVGszT0NBd0xqZ3lNVE0xTVNBd0xqYzRPREkyTnlBd0xqZ3lOREkxV2lJZ1ptbHNiRDBpZDJocGRHVWlMejRtSTNoaE96eHdZWFJvSUdROUlrMHdMamMyTkRNMU5pQXdMamcxTWpFNE5Fd3dMamMxTnprME1pQXdMamcxTkRVMU4wd3dMamN6T0RjM0lEQXVPRE0wTVRVNVREQXVOelExT1RBeklEQXVPRE14TlRFNFREQXVOelE1TWpNNUlEQXVPRE0xTVRVNFREQXVOelU0TlRBeElEQXVPRE14TnpOTU1DNDNOVGcyTWpnZ01DNDRNalk0TURsTU1DNDNOalUyTWpVZ01DNDRNalF5TVRsTU1DNDNOalF6TlRZZ01DNDROVEl4T0RSYVRUQXVOelV6TURjNElEQXVPRE01TmpJM1REQXVOelU0TWpnZ01DNDRORFUwTmpOTU1DNDNOVGcwTmpNZ01DNDRNemMyTXpOTU1DNDNOVE13TnpnZ01DNDRNemsyTWpkYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TnpJM05qazBJREF1T0RRM016Y3hUREF1TnpJNE16STNJREF1T0RZeE56TXlUREF1TnpJeE1USTRJREF1T0RZeU1EVk1NQzQzTWpBMU1ESWdNQzQ0TkRjNE16VkRNQzQzTWpBek16Z2dNQzQ0TkRReE5EVWdNQzQzTVRnek9UZ2dNQzQ0TkRJME56UWdNQzQzTVRVMU5EZ2dNQzQ0TkRJMU9UbERNQzQzTVRJMk9UY2dNQzQ0TkRJM01qVWdNQzQzTVRBNU1EZ2dNQzQ0TkRRME9Ea2dNQzQzTVRFd05qWWdNQzQ0TkRnd05qbE1NQzQzTVRFM01ESWdNQzQ0TmpJME5qVk1NQzQzTURRMU1EUWdNQzQ0TmpJM09ETk1NQzQzTURNNE56Z2dNQzQ0TkRnMk1EWkRNQzQzTURNMU1UTWdNQzQ0TkRBek5EZ2dNQzQzTURnd05qY2dNQzQ0TXpZMU1qSWdNQzQzTVRVek16Z2dNQzQ0TXpZeU1ESkRNQzQzTWpJMk1Ea2dNQzQ0TXpVNE9DQXdMamN5TnpNMElEQXVPRE01TXpZNUlEQXVOekkzTmprMElEQXVPRFEzTXpjeFdpSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPenh3WVhSb0lHUTlJazB3TGpZM056VXhJREF1T0RVeE9UZzRUREF1TmpnME9USTJJREF1T0RVek9UbE1NQzQyT0RNek1EVWdNQzQ0TlRrNU9UUk1NQzQyTmpFMk1qRWdNQzQ0TlRReE5Fd3dMalkyTXpJME1pQXdMamcwT0RFek5rd3dMalkzTURZMU9DQXdMamcxTURFek9Fd3dMalkzTlRjeElEQXVPRE14TkRJeFREQXVOamd5TlRZeElEQXVPRE16TWpjeFREQXVOamMzTlRFZ01DNDROVEU1T0RoYUlpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQSEJoZEdnZ1pEMGlUVEF1TmpReU5UUXpJREF1T0RRMk9EQTJUREF1TmpNMk5EVTJJREF1T0RRek1UVTVUREF1TmpReE16Z3pJREF1T0RNME9UTTVUREF1TmpNek5UY3hJREF1T0RNd01qVTJUREF1TmpJNE5qUTFJREF1T0RNNE5EYzJUREF1TmpJeU5UVTVJREF1T0RNME9ESTRUREF1TmpNMU56SXlJREF1T0RFeU9EWTJUREF1TmpReE9EQTRJREF1T0RFMk5URTFUREF1TmpNMk9EQTJJREF1T0RJME9EWk1NQzQyTkRRMk1UZ2dNQzQ0TWprMU5ETk1NQzQyTkRrMk1pQXdMamd5TVRFNU4wd3dMalkxTlRjd055QXdMamd5TkRnME5Vd3dMalkwTWpVME15QXdMamcwTmpnd05sb2lJR1pwYkd3OUluZG9hWFJsSWk4K0ppTjRZVHM4Y0dGMGFDQmtQU0pOTUM0Mk5UYzVOVGtnTUM0M09ERTJOelpXTUM0M05qQXhOVGhNTUM0Mk56YzJNRFlnTUM0M05ESXpPREpETUM0M01UQTRNVGNnTUM0M01USTJOemdnTUM0M01qWTVOVFlnTUM0Mk9UVTJNRFFnTUM0M01qYzBNalVnTUM0Mk56YzRNamxETUM0M01qYzBNalVnTUM0Mk5qVTBNek1nTUM0M01UazVOQ0F3TGpZMU5UWXdPU0F3TGpjd01qTTVPQ0F3TGpZMU5UWXdPVU13TGpZNE9UTXdNU0F3TGpZMU5UWXdPU0F3TGpZM056ZzBJREF1TmpZeU1UVTRJREF1TmpZNU9EZzNJREF1TmpZNE1qTTVUREF1TmpVNU9ETWdNQzQyTkRJM05EWkRNQzQyTnpFeU9URWdNQzQyTXpRd09USWdNQzQyT0Rrd05qWWdNQzQyTWpjd056VWdNQzQzTURrMk5Ea2dNQzQyTWpjd056VkRNQzQzTkRRd016RWdNQzQyTWpjd056VWdNQzQzTmpJNU56WWdNQzQyTkRjeE9Ea2dNQzQzTmpJNU56WWdNQzQyTnpRM09EbERNQzQzTmpJNU56WWdNQzQzTURBeU9ETWdNQzQzTkRRME9Ua2dNQzQzTWpBMk16RWdNQzQzTWpJMU1UTWdNQzQzTkRBeU56aE1NQzQzTURnME9DQXdMamMxTVRrM00xWXdMamMxTWpRME1VZ3dMamMyTlRjNE0xWXdMamM0TVRZM04wZ3dMalkxTnprMU9WWXdMamM0TVRZM05sb2lJR05zWVhOelBTSnBZMjl1TFdacGJHd2lMejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96d3ZaejRtSTNoaE96eGtaV1p6UGlZamVHRTdQR05zYVhCUVlYUm9JR2xrUFNKamJHbHdNQ0krSmlONFlUczhjbVZqZENCM2FXUjBhRDBpTVNJZ2FHVnBaMmgwUFNJeElpQm1hV3hzUFNKM2FHbDBaU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNERWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TnpjaUlHaGxhV2RvZEQwaU1DNDNOeUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TVRJd01URTNJREF1TVRFNU9UazFLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96eGpiR2x3VUdGMGFDQnBaRDBpWTJ4cGNESWlQaVlqZUdFN1BISmxZM1FnZDJsa2RHZzlJakF1TXpZaUlHaGxhV2RvZEQwaU1DNHpOaUlnWm1sc2JEMGlkMmhwZEdVaUlIUnlZVzV6Wm05eWJUMGlkSEpoYm5Oc1lYUmxLREF1TlRNd01ESTVJREF1TlRNd01ESTVLU0l2UGlZamVHRTdQQzlqYkdsd1VHRjBhRDRtSTNoaE96d3ZaR1ZtY3o0bUkzaGhPend2YzNablBnPT07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjUwMSIgeT0iNzMyLjUiIHdpZHRoPSI5MCIgaGVpZ2h0PSI5MCIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc0IiB2YWx1ZT0iTG9naW4gLSZndDsgT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC4yNTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTk4MTllM2Y3LTI1Y2UtNDQ3NC1hNGEyLTYwYzAyMzYwN2E4Yztpci50YWdzPUpTT04sSFRUUDsiIHBhcmVudD0iODciIHNvdXJjZT0iNDkiIHRhcmdldD0iNTEiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc3IiB2YWx1ZT0iT0F1dGgyIEF1dGhvcml6YXRpb24gU2VydmVyIC0mZ3Q7IFN0dWRpbyIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuNzU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNzU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9NTJjYzJkMTgtNzNiZS00ZmQ4LTgxYWUtZGUzNGFiMmUxNjkxO2lyLnRhZ3M9SlNPTixIVFRQLHJldHVybiBhY2Nlc3NfdG9rZW47IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjUxIiB0YXJnZXQ9IjcwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyNiIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IiIHN0eWxlPSJyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7aXIucmVmPTEzZGZmOGI5LTc4YjItNDllNy05M2ViLTBhZjQzNDk4M2I0MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQ5IiB5PSI0OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNjciIHZhbHVlPSJBUEkgZ2F0ZXdheSAtJmd0OyBzdmMtY29tbW9uLWZvcm0tZ2VuZXJhdG9yIiBzdHlsZT0iaXIucmVmPWViOGRmNjFmLWQwYTQtNDkxYi1hNWI4LWY0Mzg3NWFjNGQ0NjtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC4yNTtleGl0WT0wO2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjc1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIudGFncz1BY2Nlc3MgVG9rZW4seG1sLEpTT04sSFRUUDsiIHBhcmVudD0iODciIHNvdXJjZT0iNjMiIHRhcmdldD0iMjYiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSB4PSIwLjEwMzciIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjQxIiB5PSIzMDQiLz4KICAgICAgICA8L0FycmF5PgogICAgICAgIDxteFBvaW50IGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI2OCIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgQVBJIGdhdGV3YXkiIHN0eWxlPSJpci5yZWY9ZTIwNmEwYjktM2U2ZS00N2VlLWExYTYtZDE4ZmQ5ZWRhZDM2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjI1O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTAuNzU7ZW50cnlZPTA7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci50YWdzPXhtbCxKU09OLEhUVFA7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI2IiB0YXJnZXQ9IjcwIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMTY4IiB5PSIyOTQiLz4KICAgICAgICAgIDxteFBvaW50IHg9IjM2NiIgeT0iNTE0Ii8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIyOCIgdmFsdWU9InN2Yy1iaXotc2VkLXNlcnZpY2UtaW52b2tlIiBzdHlsZT0icm91bmRlZD0xO3doaXRlU3BhY2U9d3JhcDtodG1sPTE7YWxpZ249Y2VudGVyO2ltYWdlQWxpZ249Y2VudGVyO2ltYWdlV2lkdGg9ODI7aW1hZ2VIZWlnaHQ9ODI7YXJjU2l6ZT05MDthYnNvbHV0ZUFyY1NpemU9MTtzdHJva2VDb2xvcj0jMjBDOUUzO2ZpbGxDb2xvcj0jRTNGQ0ZDO2ZvbnRDb2xvcj0jMDA4NEFEO2ZvbnRTaXplPTEyO3NvdXJjZT1pcml1c3Jpc2s7aXIudHlwZT1DT01QT05FTlQ7aXIuY29tcG9uZW50RGVmaW5pdGlvbi5yZWY9bWljcm9zZXJ2aWNlO2ltYWdlPWRhdGE6aW1hZ2Uvc3ZnK3htbCxQSE4yWnlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpSUhkcFpIUm9QU0l4SWlCb1pXbG5hSFE5SWpFaUlIWnBaWGRDYjNnOUlqQWdNQ0F4SURFaUlHWnBiR3c5SW01dmJtVWlQaVlqZUdFN1BITjBlV3hsUGlZamVHRTdJQ0FnSUM1cFkyOXVMV1pwYkd3Z2V5WWplR0U3SUNBZ0lDQWdJQ0JtYVd4c09pQWpNVEZCT0VOR095WWplR0U3SUNBZ0lIMG1JM2hoT3p3dmMzUjViR1UrSmlONFlUczhjR0YwYUNCa1BTSk5NQzQxTnpJek5Ua2dNQzQyTURjd05qbFdNQzQxTnpVd05qbERNQzQxTkRnNE9USWdNQzQyTURFMU1qTWdNQzQxTWpBNU5EVWdNQzQyTVRRM05Ea2dNQzQwT0RnMU1UZ2dNQzQyTVRRM05EbERNQzQwTmpFeU1URWdNQzQyTVRRM05Ea2dNQzQwTkRBek1EUWdNQzQyTURNNE5qa2dNQzQwTWpVM09UZ2dNQzQxT0RJeE1EbFdNQzQzTURnNE1qbE1NQzR6TnpBeE1UY2dNQzQzTXpVd05qbFdNQzR5T0RBd01qbElNQzQwTWpVM09UaFdNQzQwTnpjeE5EbERNQzQwTWpVM09UZ2dNQzQxTVRBd01ETWdNQzQwTXpFMU5UZ2dNQzQxTXpJMk1UWWdNQzQwTkRNd056Z2dNQzQxTkRRNU9EbERNQzQwTlRVd01qVWdNQzQxTlRZNU16WWdNQzQwTnpJNU5EVWdNQzQxTmpJNU1Ea2dNQzQwT1RZNE16Z2dNQzQxTmpJNU1EbERNQzQxTkRjeE9EVWdNQzQxTmpJNU1Ea2dNQzQxTnpJek5Ua2dNQzQxTXpRM05Ea2dNQzQxTnpJek5Ua2dNQzQwTnpnME1qbFdNQzR5T0RBd01qbElNQzQyTWpnd016bFdNQzQyTURjd05qbElNQzQxTnpJek5UbGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMM04yWno0PTt2ZXJ0aWNhbExhYmVsUG9zaXRpb249Ym90dG9tO3ZlcnRpY2FsQWxpZ249dG9wO2lyLnN5bmNocm9uaXplZD0xO2lyLnJlZj1mNjk4MzczYi1mZmY5LTRiNGQtYjJiYy03MzA1N2M3YmE4MDQ7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSIzODQiIHk9IjQ5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzMyIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgc3ZjLWJpei1zZWQtc2VydmljZS1pbnZva2UiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjI1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wO2VudHJ5WT0wLjI1O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIucmVmPTQ2NGI3NTBhLTJhYzktNDI1Zi1iNDEzLWJiMDBmMjViYTFhNjtpci50YWdzPUFjY2VzcyBUb2tlbixKU09OLFJFU1RhcGk7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI2IiB0YXJnZXQ9IjI4IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTAuMDEyMiIgeT0iMjEiIHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxteFBvaW50IHk9IjEiIGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzMiIgdmFsdWU9InN2Yy1iaXotc2VkLXNlcnZpY2UtaW52b2tlIC0mZ3Q7IHN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IiIHN0eWxlPSJlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MDtleGl0WT0wLjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj1mOTM2YjU0Ny00M2I1LTRkOTAtOTNmOC05ZWI2OTZjNWEyYTE7aXIudGFncz1KU09OLEhUVFA7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI4IiB0YXJnZXQ9IjI2IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iMC4wMTExIiB5PSIyMSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPG14UG9pbnQgYXM9Im9mZnNldCIvPgogICAgICA8L214R2VvbWV0cnk+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijc5IiB2YWx1ZT0iUmVkaXMgU2VydmVyIiBzdHlsZT0iaXIucmVmPTg1YTY5MzZhLTg5YzQtNDIxOC05YmRjLWNkMWEzNGM4YmZlMDtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1yZWRpcy1zZXJ2ZXI7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TkRBeE9URTVJREF1TmpnNE5UVTNRekF1TXpZNU16QXpJREF1TmpjMU1EVTRJREF1TXpNMU9UUTRJREF1TmpZeE1qVTBJREF1TXpJMU9ETTNJREF1TmpVMk5ESTFRekF1TXpFMk1EUWdNQzQyTlRFMk56VWdNQzR6TVRBMElEQXVOalEzT0RFMUlEQXVNekE1T0RBMklEQXVOalEwTWpVelZqQXVOakEyTlRWSU1DNHpNVEEwUXpBdU16RXdOQ0F3TGpZd01qWTVJREF1TXpFMU56UXpJREF1TlRrNU5ESTFJREF1TXpJMU1qUXpJREF1TlRrMU5UWTFRekF1TXpRME9ETTNJREF1TlRnM09EUTNJREF1TkRVek56a3hJREF1TlRRMU1EazJJREF1TkRjMk9UUTNJREF1TlRNMk56ZzBRekF1TlRBd01UQXpJREF1TlRJNE5EY3hJREF1TlRBNE1URTVJREF1TlRJNE1UYzFJREF1TlRJM056RXlJREF1TlRNMU0wTXdMalV6TmpJMk15QXdMalV6T0RVek9DQXdMalUyTURZME5TQXdMalUwT0RFeElEQXVOVGczTURFMklEQXVOVFU0TkRZeVF6QXVOakl4TURjeklEQXVOVGN4T0RNeElEQXVOalU0TkRRMUlEQXVOVGcyTlRBeklEQXVOalk1TXpJeElEQXVOVGt3TlRFNFF6QXVOamM1TVRFNElEQXVOVGswTURneElEQXVOamcwTVRZMUlEQXVOVGszTXpRMklEQXVOamcwTVRZMUlEQXVOakF4TWpBMlZqQXVOak00TXpFMVF6QXVOamcwTVRZMUlEQXVOalF4T0RjNElEQXVOamM1TnpFeUlEQXVOalEyTURNMElEQXVOalk1TmpFNUlEQXVOalV4TXpjNFF6QXVOall3TURNNUlEQXVOalUyTXpneUlEQXVOak14TVRFeUlEQXVOalk0TnpVeklEQXVOakF4TWpRZ01DNDJPREUxTWpoRE1DNDFOamt3T0RVZ01DNDJPVFV5T0NBd0xqVXpOVGd6TlNBd0xqY3dPVFVnTUM0MU1qUTBORFlnTUM0M01UVTFNRE5ETUM0MU1ESTBOemdnTUM0M01qWTNPRFFnTUM0ME9UQXdNRGtnTUM0M01qWTNPRFFnTUM0ME56STNPVEVnTUM0M01UZzBOekpETUM0ME5qUXpNalFnTUM0M01UUXpPRFVnTUM0ME16TTBOamNnTUM0M01ERTJNVFFnTUM0ME1ERTVNVGtnTUM0Mk9EZzFOVGRhVFRBdU5EUTBPRGcwSURBdU5qTTJPRE14VERBdU5UQTFNVFVnTUM0Mk5qRTNOamhNTUM0MU16RXlOelVnTUM0Mk1qTTBOekZNTUM0ME5EUTRPRFFnTUM0Mk16WTRNekZhVFRBdU5UZzFNREE1SURBdU5qSXlOVGd4VERBdU5qTTJNRGN4SURBdU5qQXlNemt6VERBdU5UZzFNREE1SURBdU5UZ3lNakEyVERBdU5USTRNekEySURBdU5qQTBORGN4VERBdU5UYzVNelk1SURBdU5qSTBOalU1VERBdU5UZzFNREE1SURBdU5qSXlOVGd4V2swd0xqUTNOelUwSURBdU5UUTVPRFEyVERBdU5EZzFPRFV6SURBdU5UWTFNamcwVERBdU5EVTRNalF6SURBdU5UYzFOamMxVERBdU5EazFOalE1SURBdU5UYzRPVFJNTUM0MU1EY3lNamdnTUM0MU9UZ3lNemRNTUM0MU1UUXpOVE1nTUM0MU9EQTNNakZNTUM0MU5EWTNNVElnTUM0MU56YzBOVFpNTUM0MU1qRTNOelFnTUM0MU5qYzVOVFpNTUM0MU1qZ3pNRFlnTUM0MU5URTVNalJNTUM0MU1ETTJOalVnTUM0MU5UazVORXd3TGpRM056VTBJREF1TlRRNU9EUTJXazB3TGpRMk56YzBNeUF3TGpZd05EYzJPRU13TGpRMk56YzBNeUF3TGpVNU5EazNNU0F3TGpRME5qazJNaUF3TGpVNE5qazFOaUF3TGpReU1UUXpNU0F3TGpVNE5qazFOa013TGpNNU5Ua2dNQzQxT0RZNU5UWWdNQzR6TnpVeE1UZ2dNQzQxT1RRNU56RWdNQzR6TnpVeE1UZ2dNQzQyTURRM05qaERNQzR6TnpVeE1UZ2dNQzQyTVRRMU5qVWdNQzR6T1RVNUlEQXVOakl5TlRneElEQXVOREl4TkRNeElEQXVOakl5TlRneFF6QXVORFEyT1RZeUlEQXVOakl5TlRneElEQXVORFkzTnpReklEQXVOakUwTlRZMUlEQXVORFkzTnpReklEQXVOakEwTnpZNFdrMHdMalU1TnpreU1pQXdMamN3T1RJME4wTXdMall5T0RreU1pQXdMalk1TlRreUlEQXVOalU1TmpZNUlEQXVOamd5TnlBd0xqWTJPVFl4T1NBd0xqWTNOelV3TTBNd0xqWTNPVFF4TmlBd0xqWTNNalExTmlBd0xqWTROREUyTlNBd0xqWTJPREk1T1NBd0xqWTROREUyTlNBd0xqWTJOVEF6TkZZd0xqY3dNakUwTTBNd0xqWTROREUyTlNBd0xqY3dOVGN3TmlBd0xqWTNPVGN4TWlBd0xqY3dPVGcyTWlBd0xqWTJPVFl4T1NBd0xqY3hOVEl3TmtNd0xqWTJNREF6T1NBd0xqY3lNREl4SURBdU5qTXhNVEVnTUM0M016STFPRElnTUM0Mk1ERXlNemdnTUM0M05EVXpOVGhETUM0MU5qa3dPRE1nTUM0M05Ua3hNRGtnTUM0MU16VTRNelVnTUM0M056TXpNamtnTUM0MU1qUTBORFlnTUM0M056a3pNekZETUM0MU1ESTBOemdnTUM0M09UQTJNVElnTUM0ME9UQXdNRGtnTUM0M09UQTJNVElnTUM0ME56STNPVEVnTUM0M09ESXpRekF1TkRZME16STFJREF1TnpjNE1qRXpJREF1TkRNek5EWTVJREF1TnpZMU5EUXlJREF1TkRBeE9USXhJREF1TnpVeU16ZzJRekF1TXpZNU16QTBJREF1TnpNNE9EZzNJREF1TXpNMU9UUTRJREF1TnpJMU1EZ3lJREF1TXpJMU9ETTNJREF1TnpJd01qVXpRekF1TXpFMk1EUWdNQzQzTVRVMU1ETWdNQzR6TVRBMElEQXVOekV4TmpReklEQXVNekV3TkNBd0xqY3dOemM0TkZZd0xqWTNNREE0TVVNd0xqTXhNRFFnTUM0Mk56TTVOQ0F3TGpNeE5qQTBJREF1TmpjM056azVJREF1TXpJMk1UTTBJREF1TmpneU5UUTVRekF1TXpNMk16RTRJREF1TmpnM05EZzNJREF1TXpjeE1EUTNJREF1TnpBeE9ERWdNQzQwTURRME55QXdMamN4TlRVNU5FTXdMalF6TlRNME9TQXdMamN5T0RNeU9TQXdMalEyTlRFeE5pQXdMamMwTURZd05TQXdMalEzTXpNNE5DQXdMamMwTkRVNU5rTXdMalE1TURZd01pQXdMamMxTWprd09TQXdMalV3TWpjM05DQXdMamMxTXpJd05pQXdMalV5TkRjME15QXdMamMwTVRZeU9FTXdMalV6TlRjeU15QXdMamN6TlRrNE9TQXdMalUyTmprME9DQXdMamN5TWpVMk5DQXdMalU1TnpreU1pQXdMamN3T1RJME4xcE5NQzQxT1RjNU1qSWdNQzQzTnpBM1F6QXVOakk0T1RJeUlEQXVOelUzTXpjeklEQXVOalU1TmpZNUlEQXVOelEwTVRVeklEQXVOalk1TmpFNUlEQXVOek00T1RVMlF6QXVOamM1TkRFMklEQXVOek16T1RBNUlEQXVOamcwTVRZMUlEQXVOek13TURVZ01DNDJPRFF4TmpVZ01DNDNNalkwT0RkV01DNDNOak0xT1RkRE1DNDJPRFF4TmpVZ01DNDNOamN4TlRrZ01DNDJOemszTVRJZ01DNDNOekV6TVRVZ01DNDJOamsyTVRrZ01DNDNOelkyTlRsRE1DNDJOakF3TXprZ01DNDNPREUyTmpNZ01DNDJNekV4TVNBd0xqYzVOREF6TlNBd0xqWXdNVEl6T0NBd0xqZ3dOamd4TVVNd0xqVTJPVEE0TXlBd0xqZ3lNRFUyTWlBd0xqVXpOVGd6TlNBd0xqZ3pORGM0TWlBd0xqVXlORFEwTmlBd0xqZzBNRGM0TkVNd0xqVXdNalEzT0NBd0xqZzFNakEyTlNBd0xqUTVNREF3T1NBd0xqZzFNakEyTlNBd0xqUTNNamM1TVNBd0xqZzBNemMxTTBNd0xqUTJORE15TlNBd0xqZ3pPVFkyTmlBd0xqUXpNelEzTVNBd0xqZ3lOamc1TmlBd0xqUXdNVGt5TlNBd0xqZ3hNemcwTVVNd0xqTTJPVE13TnlBd0xqZ3dNRE0wTVNBd0xqTXpOVGswT1NBd0xqYzROalV6TlNBd0xqTXlOVGd6TnlBd0xqYzRNVGN3TmtNd0xqTXhOakEwSURBdU56YzJPVFUySURBdU16RXdOQ0F3TGpjM016QTVOaUF3TGpNeE1EUWdNQzQzTmpreU16ZFdNQzQzTXpFMU16UkRNQzR6TVRBMElEQXVOek0xTXpreklEQXVNekUyTURRZ01DNDNNemsxTlNBd0xqTXlOakV6TkNBd0xqYzBOREF3TTBNd0xqTXpOak14T0NBd0xqYzBPRGswSURBdU16Y3hNRFEzSURBdU56WXpNall6SURBdU5EQTBORGNnTUM0M056Y3dORGRETUM0ME16VXpORGtnTUM0M09EazNPRElnTUM0ME5qVXhNVFlnTUM0NE1ESXdOVGdnTUM0ME56TXpPRFFnTUM0NE1EWXdOVU13TGpRNU1EWXdNaUF3TGpneE5ETTJNaUF3TGpVd01qYzNOQ0F3TGpneE5EWTFPU0F3TGpVeU5EYzBNeUF3TGpnd016QTRNVU13TGpVek5UY3lNeUF3TGpjNU56UTBNaUF3TGpVMk5qazBPQ0F3TGpjNE5EQXhOeUF3TGpVNU56a3lNaUF3TGpjM01EZGFJaUJqYkdGemN6MGlhV052YmkxbWFXeHNJaTgrSmlONFlUczhMMmMrSmlONFlUczhaR1ZtY3o0bUkzaGhPenhqYkdsd1VHRjBhQ0JwWkQwaVkyeHBjREFpUGlZamVHRTdQSEpsWTNRZ2QybGtkR2c5SWpFaUlHaGxhV2RvZEQwaU1TSWdabWxzYkQwaWQyaHBkR1VpTHo0bUkzaGhPend2WTJ4cGNGQmhkR2crSmlONFlUczhMMlJsWm5NK0ppTjRZVHM4TDNOMlp6ND07dmVydGljYWxMYWJlbFBvc2l0aW9uPWJvdHRvbTt2ZXJ0aWNhbEFsaWduPXRvcDtpci5zeW5jaHJvbml6ZWQ9MTsiIHBhcmVudD0iODciIHZlcnRleD0iMSIgaXNUaHVtYj0iMCI+CiAgICAgIDxteEdlb21ldHJ5IHg9IjQyMSIgeT0iMzU1IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI4MCIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgUmVkaXMgU2VydmVyIiBzdHlsZT0iaXIucmVmPTFjYTcwM2JhLTgxZWEtNGM2MC1hOGNjLWM1ZDViYjllM2EzNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MC41O2V4aXRZPTE7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTA7ZW50cnlZPTAuMjU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iODciIHNvdXJjZT0iMjYiIHRhcmdldD0iNzkiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8QXJyYXkgYXM9InBvaW50cyI+CiAgICAgICAgICA8bXhQb2ludCB4PSIyMzQiIHk9IjM2MCIvPgogICAgICAgIDwvQXJyYXk+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iODEiIHZhbHVlPSJSZWRpcyBTZXJ2ZXIgLSZndDsgc3ZjLWNvbW1vbi1mb3JtLWdlbmVyYXRvciIgc3R5bGU9ImlyLnJlZj1kYjkzMWJiMC01ZWExLTQzZTUtYTBiZi1jOTg1NWY2ODY2MzE7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTAuMjU7ZXhpdFk9MDtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MTtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yOyIgcGFyZW50PSI4NyIgc291cmNlPSI3OSIgdGFyZ2V0PSIyNiIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjI2OCIgeT0iMzIwIi8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSIzNyIgdmFsdWU9IlBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9MGNjMjZhYzItYmUxOS00NTMzLTgyYjItMWQ4NmNkNGUyNDBmO3JvdW5kZWQ9MTt3aGl0ZVNwYWNlPXdyYXA7aHRtbD0xO2FsaWduPWNlbnRlcjtpbWFnZUFsaWduPWNlbnRlcjtpbWFnZVdpZHRoPTgyO2ltYWdlSGVpZ2h0PTgyO2FyY1NpemU9OTA7YWJzb2x1dGVBcmNTaXplPTE7c3Ryb2tlQ29sb3I9IzIwQzlFMztmaWxsQ29sb3I9I0UzRkNGQztmb250Q29sb3I9IzAwODRBRDtmb250U2l6ZT0xMjtzb3VyY2U9aXJpdXNyaXNrO2lyLnR5cGU9Q09NUE9ORU5UO2lyLmNvbXBvbmVudERlZmluaXRpb24ucmVmPXBvc3RncmVzcWw7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOFp5QmpiR2x3TFhCaGRHZzlJblZ5YkNnalkyeHBjREFwSWo0bUkzaGhPenh3WVhSb0lHWnBiR3d0Y25Wc1pUMGlaWFpsYm05a1pDSWdZMnhwY0MxeWRXeGxQU0psZG1WdWIyUmtJaUJrUFNKTk1DNDRNemsyTmpnZ01DNHlORGM1TlRaRE1DNDRNemsyTmpnZ01DNHpOREEzTnpZZ01DNDJPRGMwTXpNZ01DNDBNVFU1TlRZZ01DNDBPVGsyTmpnZ01DNDBNVFU1TlRaRE1DNHpNVEU1TURNZ01DNDBNVFU1TlRZZ01DNHhOVGsyTmpnZ01DNHpOREEzTnpZZ01DNHhOVGsyTmpnZ01DNHlORGM1TlRaRE1DNHhOVGsyTmpnZ01DNHhOVFV4TXpZZ01DNHpNVEU1TURNZ01DNHdOems1TlRZeElEQXVORGs1TmpZNElEQXVNRGM1T1RVMk1VTXdMalk0TnpRek15QXdMakEzT1RrMU5qRWdNQzQ0TXprMk5qZ2dNQzR4TlRVeE16WWdNQzQ0TXprMk5qZ2dNQzR5TkRjNU5UWmFUVEF1T0RNNU5qWTRJREF1TXpjMk1UZ3lRekF1T0RFNE1UZzJJREF1TXprME9EVTNJREF1TnprME1qa3hJREF1TkRFd05qTXpJREF1TnpZNE5qQTRJREF1TkRJek1EazJRekF1TmprMk5EUXpJREF1TkRVNE56RXlJREF1TmpBeE16STRJREF1TkRjNE9UVTJJREF1TkRrNU5qWTRJREF1TkRjNE9UVTJRekF1TXprNE1EQTRJREF1TkRjNE9UVTJJREF1TXpBeU9Ea3pJREF1TkRVNE56RXlJREF1TWpNd056STRJREF1TkRJek1EazJRekF1TWpBMU1EUTJJREF1TkRFd05qTXpJREF1TVRneE1UVWdNQzR6T1RRNE5UY2dNQzR4TlRrMk5qZ2dNQzR6TnpZeE9ESldNQzQzTlRFNU5UWkRNQzR4TlRrMk5qZ2dNQzQ0TkRRM056WWdNQzR6TVRFNU1ETWdNQzQ1TVRrNU5UWWdNQzQwT1RrMk5qZ2dNQzQ1TVRrNU5UWkRNQzQyT0RjME16TWdNQzQ1TVRrNU5UWWdNQzQ0TXprMk5qZ2dNQzQ0TkRRM056WWdNQzQ0TXprMk5qZ2dNQzQzTlRFNU5UWldNQzR6TnpZeE9ESmFUVEF1TlRnME56WTBJREF1TlRFNU9UYzRTREF1TlRnM01UZzRRekF1TmpFeU5EUTVJREF1TlRJd01UYzNJREF1TmpReU5Ua3hJREF1TlRJM05ERTBJREF1TmpZME9EWTFJREF1TlRVMU9EazFRekF1TmpZM056QXpJREF1TlRVNU5URTBJREF1TmpZNU9USTNJREF1TlRZNE1UYzNJREF1TmpZNU56WXhJREF1TlRnd01USTRRekF1TmpZNU5UWXhJREF1TlRreU1EYzRJREF1TmpZM01qZzRJREF1TmpBM01UWTFJREF1TmpZek1EQTFJREF1TmpJek9ERXlRekF1TmpVMU1EQTFJREF1TmpVME56TTBJREF1TmpRd01EQXhJREF1TmpreElEQXVOakU1TVRnM0lEQXVOekl6TnpoTU1DNDJNVGN5T1RVZ01DNDNNakV6T1VNd0xqWXlOVEUyTXlBd0xqY3dPRE15T0NBd0xqWXlOall5TXlBd0xqWTVOVEF4TmlBd0xqWXlOakF5TmlBd0xqWTRNamxETUM0Mk1qVTNOVElnTUM0Mk56Y3pJREF1TmpJMU1URXpJREF1TmpjeE9UQXpJREF1TmpJME5UQXpJREF1TmpZMk56WTJRekF1TmpJek56QTVJREF1TmpZd01EY3lJREF1TmpJeU9UWTNJREF1TmpVek9ERTVJREF1TmpJek1UVTFJREF1TmpRNE1USTRRekF1TmpJek16UTBJREF1TmpReU1ESXlJREF1TmpJME1UUTRJREF1TmpNMk5qazBJREF1TmpJME9UUTNJREF1TmpNeE5EQXlRekF1TmpJMU9UWXlJREF1TmpJME5qWTVJREF1TmpJMk9UWTRJREF1TmpFM09UazFJREF1TmpJMk5qa2dNQzQyTURrNE5UUk1NQzQyTWpZM09Ea2dNQzQyTURrMk16aERNQzQyTWpjd05UVWdNQzQyTURnMU1qWWdNQzQyTWpjd01qSWdNQzQyTURjNE56a2dNQzQyTWpZNU9EZ2dNQzQyTURjeU5EaERNQzQyTWpZNU1EVWdNQzQyTURVNU9EY2dNQzQyTWpZMk56TWdNQzQyTURRM056VWdNQzQyTWpZek1qVWdNQzQyTURNek16RkRNQzQyTWpVMk1qZ2dNQzQyTURBME5pQXdMall5TkRNNU9TQXdMalU1TmpjMU9DQXdMall5TWpVM05DQXdMalU1TWpNM04wTXdMall4TnpjME55QXdMalU0TURrM0lEQXVOakV4TkRJNUlEQXVOVGN3TWpVMUlEQXVOakF6TnpnMUlEQXVOVFl3TlRBNVF6QXVOVGt5TnpneElEQXVOVFEyTkRNMUlEQXVOVGMzTVRZeklEQXVOVE15TXpJM0lEQXVOVFUyTkRneUlEQXVOVEl6TVRZMVF6QXVOVFkxTnpneUlEQXVOVEl4TVRjNElEQXVOVGMxTWpVMUlEQXVOVEl3TVRFeElEQXVOVGcwTnpZMElEQXVOVEU1T1RjNFdrMHdMalEyTXpNeUlEQXVOVE01TURneVF6QXVORGN6T1RreElEQXVOVE13TWpBeUlEQXVORGc0TURZM0lEQXVOVEkwTWpjM0lEQXVOVEEzTmpnMUlEQXVOVEkwTWpJM1ZqQXVOVEkwTWpaSU1DNDFNRGsxT1RSRE1DNDFOVEV6TWlBd0xqVXlORGswTVNBd0xqVTNPRE15TkNBd0xqVTBOakE0TmlBd0xqVTVOVEF3TlNBd0xqVTJOelF4TkVNd0xqWXdNakF5TXlBd0xqVTNOak0zTXlBd0xqWXdOemd6TXlBd0xqVTROakl4TnlBd0xqWXhNakk0TXlBd0xqVTVOalk1TWtNd0xqWXhNams0T0NBd0xqVTVPRE0yTlNBd0xqWXhNek0yTmlBd0xqVTVPVFU0TVNBd0xqWXhNemN6T1NBd0xqWXdNRGM0TWtNd0xqWXhNemc0TkNBd0xqWXdNVEkwT1NBd0xqWXhOREF5T1NBd0xqWXdNVGN4TkNBd0xqWXhOREU1TWlBd0xqWXdNakl3TWtNd0xqVTVORFV3TnlBd0xqWXdNREl4TVNBd0xqVTRNVE01TlNBd0xqWXdNemMyTXlBd0xqVTNNemt5TmlBd0xqWXhNak15TjBNd0xqVTJOVFE1TlNBd0xqWXlNVGszSURBdU5UWTFPVGMySURBdU5qTTFOalEzSURBdU5UWTVNall5SURBdU5qUTRPRFU0UXpBdU5UY3lOVFkxSURBdU5qWXlNRGcySURBdU5UYzRPVEl5SURBdU5qYzFOall6SURBdU5UZzBOelkwSURBdU5qZzJPRFkzUXpBdU5UZzNNekkzSURBdU5qa3hOemN6SURBdU5UZzVOemczSURBdU5qazJNakEzSURBdU5Ua3hPRFF6SURBdU5qazVPVEZNTUM0MU9USTJPREVnTUM0M01ERTBNak5NTUM0MU9UWTVORGNnTUM0M01EazBORU13TGpVNU9UY3pJREF1TnpFMk1ESXlJREF1TmpBek5EVTFJREF1TnpJeU1UWTJJREF1TmpBNE1EQXhJREF1TnpJM05qaE1NQzQyTVRJd016UWdNQzQzTXpNd056UkRNQzQyTVRBNE1qTWdNQzQzTXpNME1qTWdNQzQyTURrek5EVWdNQzQzTXpNNU1EUWdNQzQyTURjM05qZ2dNQzQzTXpRMk1UaERNQzQyTURRMk1UVWdNQzQzTXpZd05EVWdNQzQyTURBNU5qUWdNQzQzTXpnMk9EUWdNQzQxT1RnMk1EWWdNQzQzTkRORE1DNDFPVFl6TVRZZ01DNDNORGN4T1RrZ01DNDFPVFV5TlRRZ01DNDNOVEkzTURrZ01DNDFPVFUxT0RZZ01DNDNOVGs0T0VNd0xqVTVORGcxTlNBd0xqYzJPVE01SURBdU5UZzRPREUwSURBdU9ERTVPVE1nTUM0MU9EVTRNU0F3TGpnek56TTFOME13TGpVNE16Z3dNU0F3TGpnME9EazVNaUF3TGpVNE1EWTJOU0F3TGpnMU5qVTVOQ0F3TGpVM05UUXhPU0F3TGpnMk1qQTFORU13TGpVM01ERTFPQ0F3TGpnMk56VXhOU0F3TGpVMk1qSTVNU0F3TGpnM01UTXhOaUF3TGpVME9UVTBOQ0F3TGpnM05EQTFORU13TGpVek5EZ3pPU0F3TGpnM056SXdPQ0F3TGpVeU5qYzRPU0F3TGpnM05EQTFOQ0F3TGpVeU1URTNPU0F3TGpnMk9UTTBNVU13TGpVeE5UVTJPU0F3TGpnMk5EWXhJREF1TlRFeU5EWTFJREF1T0RVM05qVTJJREF1TlRFd016UXhJREF1T0RVeU16UTFRekF1TlRBNU5qa3pJREF1T0RVd056VXhJREF1TlRBNE5qZ2dNQzQ0TkRZd016Z2dNQzQxTURjNU5qY2dNQzQ0TXprNE5EZERNQzQxTURjeU5UUWdNQzQ0TXpNMk16a2dNQzQxTURZMk9Ea2dNQzQ0TWpVM056SWdNQzQxTURZek1EZ2dNQzQ0TVRZNE5ETkRNQzQxTURVMU16UWdNQzQzT1RZeE55QXdMalV3TlRRMk15QXdMamMzTlRRM09DQXdMalV3TmpBNU1TQXdMamMxTkRnd01VTXdMalV3TmpFeE9DQXdMamMxTkRBNE15QXdMalV3TmpBd05TQXdMamMxTXpNMk55QXdMalV3TlRjMU9TQXdMamMxTWpZNU0wTXdMalV3TlRVeU55QXdMamMxTVRBMUlEQXVOVEExTVRJNUlEQXVOelE1TkRVMklEQXVOVEEwTlRneElEQXVOelEzT1RjNVF6QXVOVEF5TkRjeklEQXVOelF5TXpNMklEQXVORGs0TlRjeklEQXVOek0zTXprZ01DNDBPVEk0T1RZZ01DNDNNelV3TXpORE1DNDBPVEV3TXpjZ01DNDNNelF5TXpZZ01DNDBPRGM1TVRjZ01DNDNNekk1TURnZ01DNDBPRE01TXpNZ01DNDNNek15TkV3d0xqUTRNVGM1TWlBd0xqY3pNelkzTWtNd0xqUTRNek14TWlBd0xqY3lOemszSURBdU5EZzFNVFEySURBdU56SXlNelUzSURBdU5EZzNNamczSURBdU56RTJPRFU1UXpBdU5EZzRNVE0ySURBdU56RTBOVGN6SURBdU5EZzVNakEySURBdU56RXlNVGMySURBdU5Ea3dNemNnTUM0M01EazFOamhETUM0ME9UWTVNeklnTUM0Mk9UUTROaklnTUM0MU1EWTBPRGtnTUM0Mk56TTBORFVnTUM0ME9UWTFOalVnTUM0Mk1qYzFNME13TGpRNU5ERXlOQ0F3TGpZeE5qSTNOeUF3TGpRNE56UXdNeUF3TGpZd09EZzFPQ0F3TGpRM09USTNJREF1TmpBMU56QTFRekF1TkRjeE1UTTNJREF1TmpBeU5UVXhJREF1TkRZeU1UVTRJREF1TmpBek1UUTRJREF1TkRVek9ESTJJREF1TmpBMU1EVTNRekF1TkRRMU5EazBJREF1TmpBMk9UZ3pJREF1TkRNM056RWdNQzQyTVRBek1ESWdNQzQwTXpFM09EVWdNQzQyTVRNMk1qSk1NQzQwTXpFMU5qZ2dNQzQyTVRNM05UVkRNQzQwTXpJek5EZ2dNQzQyTURNM01qa2dNQzQwTXpRek1qTWdNQzQxT0RnNU5UZ2dNQzQwTkRBd09ETWdNQzQxTnpNMk9EaERNQzQwTkRRNU1qa2dNQzQxTmpBNE1qVWdNQzQwTlRJek1UVWdNQzQxTkRneU5pQXdMalEyTXpNeUlEQXVOVE01TURneVdrMHdMak01TVRFek55QXdMalV5TlRJM00wd3dMak01TnpRME5DQXdMalV5TlRBNVREQXVOREF6TnpNMElEQXVOVEkxTWpVMlF6QXVOREl6TXpJZ01DNDFNall5TVRrZ01DNDBOREUwTVRFZ01DNDFNekV6TXpFZ01DNDBOVEUyTURJZ01DNDFNelEyT0RORE1DNDBOREV5TWpnZ01DNDFORFE0TkRFZ01DNDBNelF6TURjZ01DNDFOVGN6T0RrZ01DNDBNamsyTmlBd0xqVTJPVGN6T0VNd0xqUXlNekUwT1NBd0xqVTROemN3TWlBd0xqUXhPVGd5TkNBd0xqWXdOalk0SURBdU5ERTVPRE0wSURBdU5qSTFOemc0VERBdU5ERTVPRFVnTUM0Mk1qVTRPRGRXTUM0Mk1qVTVOMVl3TGpZeU5qSTROa013TGpReE9UZzFJREF1TmpJM09USTVJREF1TkRFNU9UYzNJREF1TmpNd01ERTJJREF1TkRJd01UTTFJREF1TmpNeU5qRXpRekF1TkRJd016STVJREF1TmpNMU9ERXpJREF1TkRJd05UY2dNQzQyTXprM09EWWdNQzQwTWpBMk9DQXdMalkwTkRZMU9VTXdMalF5TURnM09TQXdMalkxTXpjeU1TQXdMalF5TURZME9DQXdMalkyTlRFNUlEQXVOREU0T1RNNElEQXVOamMzTkRVMlF6QXVOREUzTlRFNUlEQXVOamczTURrMklEQXVOREU0TlRRNUlEQXVOamsyT1RNNElEQXVOREl4T1RNeklEQXVOekEyTURjMVF6QXVOREkxTXpFNUlEQXVOekUxTWpFeUlEQXVORE13T1RRNUlEQXVOekl6TXpVZ01DNDBNemd6TURjZ01DNDNNamszTXpoRE1DNDBNamM1TXpnZ01DNDNOREEzTlNBd0xqUXhOemt4T0NBd0xqYzFNakE0TmlBd0xqUXdPREkyTlNBd0xqYzJNemN6UXpBdU5EQXlPVGNnTUM0M056QXdPRGNnTUM0ek9UZzJNemtnTUM0M056SXhOaklnTUM0ek9UVXdNemNnTUM0M056SXpNamhETUM0ek9URTBOVElnTUM0M056STBOemNnTUM0ek9EYzFNRElnTUM0M056QTNNREVnTUM0ek9ESTVOVFFnTUM0M05qWXpNRE5ETUM0ek56TTVNalVnTUM0M05UYzFNRFlnTUM0ek5qUTBNVFFnTUM0M016ZzVNVGNnTUM0ek5UWTFOalFnTUM0M01UYzFOVFpETUM0ek5EZzNNeUF3TGpZNU5qRTVOU0F3TGpNME1qSXdOeUF3TGpZM01qQXhNaUF3TGpNek56WXdPU0F3TGpZMU1UUTJORU13TGpNek1qazVOU0F3TGpZek1Ea3hOaUF3TGpNek1ETXdOaUF3TGpZeE16WXlNaUF3TGpNeU9UazVNU0F3TGpZd056UTBOME13TGpNeU9ETTJOQ0F3TGpVM05EZ3pNeUF3TGpNek5UZ3pOQ0F3TGpVMU5URXpNaUF3TGpNME56RTROaUF3TGpVME16RXhOVU13TGpNMU9EVXlNaUF3TGpVek1UQTVPQ0F3TGpNM05ETTNNeUF3TGpVeU5qSXpOU0F3TGpNNU1URXpOeUF3TGpVeU5USTNNMXBOTUM0MU9ESXpNRGdnTUM0Mk1UazJNVE5ETUM0MU9EVTJNamdnTUM0Mk1UVTRNVE1nTUM0MU9URTVOVEVnTUM0Mk1USTVNRGdnTUM0Mk1ETXlNakVnTUM0Mk1USTNOVGxETUM0Mk1EY3pNamNnTUM0Mk1USTNOakVnTUM0Mk1URTBNeUF3TGpZeE16QXlPQ0F3TGpZeE5UVXdNeUF3TGpZeE16VTFOVU13TGpZeE5UTTROQ0F3TGpZeE9EYzJPQ0F3TGpZeE5EWTROeUF3TGpZeU16VTROeUF3TGpZeE16azBNaUF3TGpZeU9EY3pOME13TGpZeE16RXlOaUF3TGpZek5ETTNOeUF3TGpZeE1qSTFNaUF3TGpZME1EUXhNeUF3TGpZeE1qQXhPQ0F3TGpZME56YzVOa013TGpZeE1UYzNPU0F3TGpZMU5UQXpNU0F3TGpZeE1qWTFOQ0F3TGpZMk1qSXhNaUF3TGpZeE16VXhPU0F3TGpZMk9UTXhOVU13TGpZeE5EQTVPQ0F3TGpZM05EQTNOQ0F3TGpZeE5EWTNNeUF3TGpZM09EYzVPU0F3TGpZeE5Ea3dOU0F3TGpZNE16UTRNVU13TGpZeE5UTTFOQ0F3TGpZNU1qa3dPQ0F3TGpZeE5EVTNNeUF3TGpjd01UazFOQ0F3TGpZeE1ESXdPU0F3TGpjeE1URTJOa013TGpZd09URTNPU0F3TGpjd09UTTBJREF1TmpBNE1UWTNJREF1TnpBM016Z3hJREF1TmpBM01qVTBJREF1TnpBMU1UVTNRekF1TmpBMk16YzJJREF1TnpBek1ETTFJREF1TmpBMU1EQTJJREF1TnpBd05UZzVJREF1TmpBek1UWTVJREF1TmprM016QTVUREF1TmpBeU5EQTNJREF1TmprMU9UUTJRekF1TmpBd01pQXdMalk1TVRrM09TQXdMalU1TnpRMk1pQXdMalk0TnpBNU9TQXdMalU1TkRZMElEQXVOamd4TmpjeVF6QXVOVGc0T1RrM0lEQXVOamN3T0RNMElEQXVOVGd5T1RnNElEQXVOalUzTnpnNElEQXVOVGd3TURnMElEQXVOalEyTVRKRE1DNDFOemN4TmpNZ01DNDJNelEwTmpnZ01DNDFOemMyTVRFZ01DNDJNalV3TURnZ01DNDFPREl6TURnZ01DNDJNVGsyTVROYVRUQXVORFUyTXpNeUlEQXVOakUxT0RrMlF6QXVORFU1TmpnMElEQXVOakUxTVRFeElEQXVORFl6TVRFeklEQXVOakUwTmprNUlEQXVORFkyTlRVM0lEQXVOakUwTmpZM1F6QXVORFk1TlRFMklEQXVOakUwTmpBeUlEQXVORGN5TkRZeklEQXVOakUxTURjMElEQXVORGMxTWpVeklEQXVOakUyTURZeFF6QXVORGd3TWpNeUlEQXVOakUzT1RnM0lEQXVORGd6T0RVZ01DNDJNakUwTURZZ01DNDBPRFUyTnpjZ01DNDJNams0TnpGRE1DNDBPVFE1TVRZZ01DNDJOekkyTWpJZ01DNDBPRGMwTkNBd0xqWTRPVEEzTXlBd0xqUTRNRGMyTlNBd0xqY3dNemMxT1VNd0xqUTNPVE0zTVNBd0xqY3dOamd5T0NBd0xqUTNPREF4TVNBd0xqY3dPVGd5SURBdU5EYzJPRFEzSURBdU56RXlPVFU0UXpBdU5EYzBOVEl6SURBdU56RTVNVGd5SURBdU5EY3lNVGs1SURBdU56STFNRGt4SURBdU5EY3dOemc1SURBdU56TXdPVEUzUXpBdU5EUTJOVGc1SURBdU56TXdPRGcwSURBdU5ESTFPVGt5SURBdU56QTNNemd4SURBdU5ESTVPVFU0SURBdU5qYzRPVGs1UXpBdU5ETXhOemcxSURBdU5qWTFPVE0zSURBdU5ETXlNREUySURBdU5qVXpPRGN4SURBdU5ETXhPREUzSURBdU5qUTBOREZETUM0ME16RTJOek1nTUM0Mk16Z3hORFFnTUM0ME16RXpPQ0F3TGpZek16TXpNeUF3TGpRek1URTVNaUF3TGpZek1ESXpOa013TGpRek1URXlNU0F3TGpZeU9UQTJJREF1TkRNeE1EWTFJREF1TmpJNE1UTXhJREF1TkRNeE1ETTNJREF1TmpJM05EWTBUREF1TkRNeE5EQXlJREF1TmpJM01UTXlRekF1TkRNek1qSXhJREF1TmpJMU56QTJJREF1TkRNMU1UVTVJREF1TmpJME5EUWdNQzQwTXpjeE9UVWdNQzQyTWpNek5EaERNQzQwTkRNeU1UUWdNQzQyTWpBd01qVWdNQzQwTkRrMk5URWdNQzQyTVRjMU1Ua2dNQzQwTlRZek16SWdNQzQyTVRVNE9UWmFUVEF1TlRrNE56ZzVJREF1TmpFNE1EVXpTREF1TlRrM09UWldNQzQyTVRnd01ETk1NQzQxT1RVek1EUWdNQzQyTVRneU1UbERNQzQxT1RJNE5qUWdNQzQyTVRnMU9EUWdNQzQxT1RBM01EWWdNQzQyTVRreU5EZ2dNQzQxT0RreE1USWdNQzQyTWpBeE5EUkRNQzQxT0Rnek56VWdNQzQyTWpBMU1USWdNQzQxT0RjM01UVWdNQzQyTWpFd01Ua2dNQzQxT0RjeE56RWdNQzQyTWpFMk16aE1NQzQxT0RZMk1ETWdNQzQyTWpJMk1qaE1NQzQxT0RZME56TWdNQzQyTWpNM05qTkRNQzQxT0RZMk1pQXdMall5TkRVME9TQXdMalU0TmprNE15QXdMall5TlRJM09DQXdMalU0TnpVeUlEQXVOakkxT0RjeFF6QXVOVGczTnpneElEQXVOakkyTVRnNElEQXVOVGc0TURZeElEQXVOakkyTkRnNUlEQXVOVGc0TXpVNUlEQXVOakkyTnpjeVF6QXVOVGc0TnpZNElEQXVOakkzTVRZZ01DNDFPRGt5TURrZ01DNDJNamMxTVRRZ01DNDFPRGsyTnpjZ01DNDJNamM0TWpsRE1DNDFPVEUyTlRjZ01DNDJNamt5TWlBd0xqVTVOREE0SURBdU5qSTVPREk1SURBdU5UazJORGd5SURBdU5qSTVOVE01UXpBdU5UazRPVFVnTUM0Mk1qa3hNVElnTUM0Mk1ERXlNRFVnTUM0Mk1qYzROelFnTUM0Mk1ESTRPRGtnTUM0Mk1qWXdNa013TGpZd016TXlNU0F3TGpZeU5UVTNOaUF3TGpZd016Y3hOaUF3TGpZeU5UQTVOeUF3TGpZd05EQTJPQ0F3TGpZeU5EVTRPRU13TGpZd05ETXdNeUF3TGpZeU5ESTBPQ0F3TGpZd05EVXhPU0F3TGpZeU16ZzVOU0F3TGpZd05EY3hOQ0F3TGpZeU16VXpRekF1TmpBMU1USTFJREF1TmpJeU9EVTRJREF1TmpBMU16STRJREF1TmpJeU1EYzRJREF1TmpBMU1qazFJREF1TmpJeE1qbE1NQzQyTURVek1USWdNQzQyTWpFeE5UZE1NQzQyTURRNE9ETWdNQzQyTWpBeE1USk1NQzQyTURRd05qY2dNQzQyTVRrek16RkRNQzQyTURNM056TWdNQzQyTVRreE16Z2dNQzQyTURNME5URWdNQzQyTVRnNU55QXdMall3TXpBNU9TQXdMall4T0RneU5VTXdMall3TWpZNU5TQXdMall4T0RZMU9TQXdMall3TWpJMU5TQXdMall4T0RVeU5TQXdMall3TVRjM055QXdMall4T0RReE9FTXdMall3TVRBNU5pQXdMall4T0RJMU1TQXdMall3TURNek5pQXdMall4T0RFME5DQXdMalU1T1RVeE9TQXdMall4T0RBNE9FTXdMalU1T1RJNElEQXVOakU0TURjeUlEQXVOVGs1TURNM0lEQXVOakU0TURZeElEQXVOVGs0TnpnNUlEQXVOakU0TURVeldrMHdMalEzTURreU1pQXdMall5TVRBMU4wd3dMalEyT0RFMk5pQXdMall5TURnME1rd3dMalEyT0RFME9TQXdMall5TURrd09FTXdMalEyTmpReU5TQXdMall5TURneU1TQXdMalEyTkRZNU9TQXdMall5TVRBME5pQXdMalEyTXpBMU5DQXdMall5TVRVM01rTXdMalEyTVRZeElEQXVOakl5TURnMklEQXVORFl3TVRNeklEQXVOakl6TURFMklEQXVORFU1T0RnMElEQXVOakkwT0RBNFF6QXVORFU1TnpjNElEQXVOakkxT0RNMklEQXVORFl3TURFM0lEQXVOakkyT0RjZ01DNDBOakExTmpVZ01DNDJNamMzTkRaRE1DNDBOakV3T0RRZ01DNDJNamczTkRJZ01DNDBOakUzTkRNZ01DNDJNamsyTlRrZ01DNDBOakkxTWpNZ01DNDJNekEwTmpoRE1DNDBOalF6TlRVZ01DNDJNekkwTnpnZ01DNDBOalk0TVNBd0xqWXpNemd4TVNBd0xqUTJPVFE1TkNBd0xqWXpOREkxTWtNd0xqUTNNakV4T1NBd0xqWXpORFUzTlNBd0xqUTNORGMzTVNBd0xqWXpNemt3TmlBd0xqUTNOamt6SURBdU5qTXlNemMzUXpBdU5EYzNPREkwSURBdU5qTXhOemdnTUM0ME56ZzJNalFnTUM0Mk16RXdOVE1nTUM0ME56a3pNRE1nTUM0Mk16QXlNVGxETUM0ME56azVOVFlnTUM0Mk1qazFNRFVnTUM0ME9EQXpPRGtnTUM0Mk1qZzJNVGdnTUM0ME9EQTFORGdnTUM0Mk1qYzJOak5ETUM0ME9EQTFOeklnTUM0Mk1qYzBNamtnTUM0ME9EQTFOelFnTUM0Mk1qY3hPVFFnTUM0ME9EQTFOVFFnTUM0Mk1qWTVOakZETUM0ME9EQTFNekVnTUM0Mk1qWTJPRGtnTUM0ME9EQTBOemNnTUM0Mk1qWTBNaUF3TGpRNE1ETTVOQ0F3TGpZeU5qRTFPVU13TGpRNE1ESTBJREF1TmpJMU5qY3pJREF1TkRjNU9UZzNJREF1TmpJMU1qSTFJREF1TkRjNU5qVXhJREF1TmpJME9EUXlRekF1TkRjNU1ETTFJREF1TmpJME1URTVJREF1TkRjNE1qZzJJREF1TmpJek5USXlJREF1TkRjM05EUTBJREF1TmpJek1EZ3lRekF1TkRjMU56RTRJREF1TmpJeU1EZzJJREF1TkRjek5EWXhJREF1TmpJeE5EQTJJREF1TkRjd09USXlJREF1TmpJeE1EVTNXazB3TGpZeE9EUTVJREF1TnpReU56TTBUREF1TmpFNE5UUWdNQzQzTkRJM01UaERNQzQyTWpBeU1ETWdNQzQzTkRRd09TQXdMall5TWpBMklEQXVOelExTVRreUlEQXVOakkwTURVeElEQXVOelEyTURJeFF6QXVOak15TURZNElEQXVOelE1TXpJeklEQXVOalExTVRRMklEQXVOelV3TmpBeUlEQXVOalk0TWpZMklEQXVOelExT0RJeFF6QXVOall6TlRZMElEQXVOelE1T1RVMElEQXVOalU0TWpreklEQXVOelV6TXpreElEQXVOalV5TmpFMklEQXVOelUyTURJNVF6QXVOalExTmprMElEQXVOelU1TWpRNUlEQXVOak15TmpZMUlEQXVOell4TnpJeUlEQXVOakl5TURjMUlEQXVOell4T0RNNFF6QXVOakUyTnpZMElEQXVOell4T1RJeElEQXVOakV5SURBdU56WXhNelUzSURBdU5qQTVNVFl5SURBdU56WXdORGswUXpBdU5qQTRNamczSURBdU56WXdNalF4SURBdU5qQTNORFUzSURBdU56VTVPRFE1SURBdU5qQTJOekEzSURBdU56VTVNek15UXpBdU5qQTJORFF4SURBdU56VXpOVGN5SURBdU5qQTNNek0zSURBdU56VXdNVGcySURBdU5qQTRNemd5SURBdU56UTRNamM0UXpBdU5qQTVNakkySURBdU56UTJOalE1SURBdU5qRXdOak00SURBdU56UTFNemcxSURBdU5qRXlNelVnTUM0M05EUTNNalpETUM0Mk1UTXlOellnTUM0M05EUXpNVGNnTUM0Mk1UUXlPVGtnTUM0M05EUXdNaklnTUM0Mk1UVTBNelVnTUM0M05ETTJPVFZETUM0Mk1UWXpOeklnTUM0M05ETTBNalVnTUM0Mk1UY3pPRGNnTUM0M05ETXhNeklnTUM0Mk1UZzBPU0F3TGpjME1qY3pORnBOTUM0ME9EUTRPVGNnTUM0M05EUXlOemhJTUM0ME9EVXlORFZXTUM0M05EUXpNVEZETUM0ME9EWXdNVElnTUM0M05EUTBNRFlnTUM0ME9EWTNOamNnTUM0M05EUTFPRElnTUM0ME9EYzBPVFFnTUM0M05EUTRNelpETUM0ME9EYzRPRElnTUM0M05EUTVOekVnTUM0ME9EZ3lOakVnTUM0M05EVXhNamdnTUM0ME9EZzJNekVnTUM0M05EVXpNRGRETUM0ME9UQTBNak1nTUM0M05EWXdOVFFnTUM0ME9USTVOak1nTUM0M05EZzNNallnTUM0ME9UUXhNalFnTUM0M05URTRNME13TGpRNU5USTNJREF1TnpVME9UTXpJREF1TkRrMU1USXhJREF1TnpVM09ESXlJREF1TkRrek56STNJREF1TnpVNU56aERNQzQwT0RVMk5ETWdNQzQzTnpFeE1UWWdNQzQwTnpZeE5qWWdNQzQzTnpVME9ERWdNQzQwTmpjd05UUWdNQzQzTnpjd05ERkRNQzQwTlRjNU5ESWdNQzQzTnpnMU9EVWdNQzQwTkRreU1USWdNQzQzTnpjd05ERWdNQzQwTkRNNUlEQXVOemMxTnpFMFF6QXVORFF5TURJMUlEQXVOemMxTWpNeUlEQXVORE01TnpBeElEQXVOemMwTXpVeklEQXVORE0zT0RreUlEQXVOemN6TXpVM1F6QXVORE0zTVRZeElEQXVOemN5T1RjMUlEQXVORE0zTWpFeUlEQXVOemN5T0RjMklEQXVORE0yTnpNZ01DNDNOekkwTnpkRE1DNDBNemd5TWpRZ01DNDNOekUzTmpNZ01DNDBOREEwTmpVZ01DNDNOekE0T0RRZ01DNDBORFF6T0RJZ01DNDNOekF3T0RkRE1DNDBOVFkzTkRjZ01DNDNOamMxTkRnZ01DNDBOakk1TXpnZ01DNDNOalUxTWpNZ01DNDBOamMzTURFZ01DNDNOakUzTXpsRE1DNDBOekEyTVRNZ01DNDNOVGswTVRVZ01DNDBOekkxTURFZ01DNDNOVFk1T1RNZ01DNDBOelE0TkRnZ01DNDNOVE01T0RORE1DNDBOell6TkRFZ01DNDNOVEl3TmpnZ01DNDBOemd3TWlBd0xqYzBPVGt4TlNBd0xqUTRNREkyTmlBd0xqYzBOek01T0VNd0xqUTRNamN6T0NBd0xqYzBORFkySURBdU5EZzBNREUySURBdU56UTBNell4SURBdU5EZzBPRGszSURBdU56UTBNamM0V2lJZ1kyeGhjM005SW1samIyNHRabWxzYkNJdlBpWWplR0U3UEM5blBpWWplR0U3UEdSbFpuTStKaU40WVRzOFkyeHBjRkJoZEdnZ2FXUTlJbU5zYVhBd0lqNG1JM2hoT3p4eVpXTjBJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUdacGJHdzlJbmRvYVhSbElpOCtKaU40WVRzOEwyTnNhWEJRWVhSb1BpWWplR0U3UEM5a1pXWnpQaVlqZUdFN1BDOXpkbWMrO3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2MzUiIHk9IjM1OSIgd2lkdGg9IjkwIiBoZWlnaHQ9IjkwIiBhcz0iZ2VvbWV0cnkiLz4KICAgIDwvbXhDZWxsPgogICAgPG14Q2VsbCBpZD0iNDMiIHZhbHVlPSJzdmMtYml6LXNlZC1zZXJ2aWNlLWludm9rZSAtJmd0OyBQb3N0Z3JlU1FMIiBzdHlsZT0iaXIucmVmPTc0NTZlODkyLWIzYWItNGRjMS05N2FkLTJhN2JjNDA3NDFhNDtlZGdlU3R5bGU9bm9uZTtjdXJ2ZWQ9MTtodG1sPTE7aXIuc3luY2hyb25pemVkPTE7ZXhpdFg9MTtleGl0WT0wLjc1O2V4aXREeD0wO2V4aXREeT0wO2VudHJ5WD0wLjU7ZW50cnlZPTA7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci50YWdzPUpEQkM7IiBwYXJlbnQ9Ijg3IiBzb3VyY2U9IjI4IiB0YXJnZXQ9IjM3IiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI0MiIgdmFsdWU9InN2Yy1jb21tb24tZm9ybS1nZW5lcmF0b3IgLSZndDsgUG9zdGdyZVNRTCIgc3R5bGU9ImlyLnJlZj03NGRhYWNhZi1jZjg2LTRhZmUtYjYxNC1lNjM3YWU4OTU2Y2I7ZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC43NTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MDtlbnRyeVk9MC41O2VudHJ5RHg9MDtlbnRyeUR5PTA7ZW5kQXJyb3c9b3BlbjtlbmRGaWxsPTA7ZW5kU2l6ZT00O3NvdXJjZVBlcmltZXRlclNwYWNpbmc9OTtzdHJva2VDb2xvcj0jQkZCRkJGO3N0cm9rZVdpZHRoPTI7aXIudGFncz1KREJDOyIgcGFyZW50PSI4NyIgc291cmNlPSIyNiIgdGFyZ2V0PSIzNyIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHJlbGF0aXZlPSIxIiBhcz0iZ2VvbWV0cnkiPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjQyOSIgeT0iMzA3Ii8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OCIgdmFsdWU9Ik1pZ3JhdGlvbiBtaWNyb3NlcnZpY2VzIiBzdHlsZT0iaXIucmVmPWJjZTVhNTA1LTJmY2UtNDEzMy1hMDE5LWEyNGE5NDgyNWZhYjtyb3VuZGVkPTE7d2hpdGVTcGFjZT13cmFwO2h0bWw9MTthbGlnbj1jZW50ZXI7aW1hZ2VBbGlnbj1jZW50ZXI7aW1hZ2VXaWR0aD04MjtpbWFnZUhlaWdodD04MjthcmNTaXplPTkwO2Fic29sdXRlQXJjU2l6ZT0xO3N0cm9rZUNvbG9yPSMyMEM5RTM7ZmlsbENvbG9yPSNFM0ZDRkM7Zm9udENvbG9yPSMwMDg0QUQ7Zm9udFNpemU9MTI7c291cmNlPWlyaXVzcmlzaztpci50eXBlPUNPTVBPTkVOVDtpci5jb21wb25lbnREZWZpbml0aW9uLnJlZj1taWNyb3NlcnZpY2U7aW1hZ2U9ZGF0YTppbWFnZS9zdmcreG1sLFBITjJaeUI0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM5emRtY2lJSGRwWkhSb1BTSXhJaUJvWldsbmFIUTlJakVpSUhacFpYZENiM2c5SWpBZ01DQXhJREVpSUdacGJHdzlJbTV2Ym1VaVBpWWplR0U3UEhOMGVXeGxQaVlqZUdFN0lDQWdJQzVwWTI5dUxXWnBiR3dnZXlZamVHRTdJQ0FnSUNBZ0lDQm1hV3hzT2lBak1URkJPRU5HT3lZamVHRTdJQ0FnSUgwbUkzaGhPend2YzNSNWJHVStKaU40WVRzOGNHRjBhQ0JrUFNKTk1DNDFOekl6TlRrZ01DNDJNRGN3TmpsV01DNDFOelV3TmpsRE1DNDFORGc0T1RJZ01DNDJNREUxTWpNZ01DNDFNakE1TkRVZ01DNDJNVFEzTkRrZ01DNDBPRGcxTVRnZ01DNDJNVFEzTkRsRE1DNDBOakV5TVRFZ01DNDJNVFEzTkRrZ01DNDBOREF6TURRZ01DNDJNRE00TmprZ01DNDBNalUzT1RnZ01DNDFPREl4TURsV01DNDNNRGc0TWpsTU1DNHpOekF4TVRjZ01DNDNNelV3TmpsV01DNHlPREF3TWpsSU1DNDBNalUzT1RoV01DNDBOemN4TkRsRE1DNDBNalUzT1RnZ01DNDFNVEF3TURNZ01DNDBNekUxTlRnZ01DNDFNekkyTVRZZ01DNDBORE13TnpnZ01DNDFORFE1T0RsRE1DNDBOVFV3TWpVZ01DNDFOVFk1TXpZZ01DNDBOekk1TkRVZ01DNDFOakk1TURrZ01DNDBPVFk0TXpnZ01DNDFOakk1TURsRE1DNDFORGN4T0RVZ01DNDFOakk1TURrZ01DNDFOekl6TlRrZ01DNDFNelEzTkRrZ01DNDFOekl6TlRrZ01DNDBOemcwTWpsV01DNHlPREF3TWpsSU1DNDJNamd3TXpsV01DNDJNRGN3TmpsSU1DNDFOekl6TlRsYUlpQmpiR0Z6Y3owaWFXTnZiaTFtYVd4c0lpOCtKaU40WVRzOEwzTjJaejQ9O3ZlcnRpY2FsTGFiZWxQb3NpdGlvbj1ib3R0b207dmVydGljYWxBbGlnbj10b3A7aXIuc3luY2hyb25pemVkPTE7IiBwYXJlbnQ9Ijg3IiB2ZXJ0ZXg9IjEiIGlzVGh1bWI9IjAiPgogICAgICA8bXhHZW9tZXRyeSB4PSI2NzQiIHk9IjQ5IiB3aWR0aD0iOTAiIGhlaWdodD0iOTAiIGFzPSJnZW9tZXRyeSIvPgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1OSIgdmFsdWU9Ik1pZ3JhdGlvbiBtaWNyb3NlcnZpY2VzIC0mZ3Q7IFBvc3RncmVTUUwiIHN0eWxlPSJpci5yZWY9NTE1MTQ1NjUtODExNy00ZWE4LThkYzctNzBjMThjNDE4MjA2O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wLjU7ZXhpdFk9MTtleGl0RHg9MDtleGl0RHk9MDtlbnRyeVg9MC43NTtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnRhZ3M9SkRCQzsiIHBhcmVudD0iODciIHNvdXJjZT0iNTgiIHRhcmdldD0iMzciIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ii8+CiAgICA8L214Q2VsbD4KICAgIDxteENlbGwgaWQ9Ijg0IiB2YWx1ZT0iUkVTVGZ1bCBXZWIgU2VydmljZSAtJmd0OyBBUEkgZ2F0ZXdheSIgc3R5bGU9ImVkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0xO2V4aXRZPTAuNTtleGl0RHg9MDtleGl0RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9Mjtpci5yZWY9NzkxNmQ3ZDgtYWYyOC00MzJiLWI0ZjQtNDQwZDVhYTBlYzVhO2lyLnRhZ3M9QWNjZXNzIFRva2VuLHhtbCxKU09OLEhUVFBTLFJFU1RhcGk7IiBwYXJlbnQ9IjM0IiBzb3VyY2U9IjgzIiB0YXJnZXQ9IjYzIiBlZGdlPSIxIj4KICAgICAgPG14R2VvbWV0cnkgeD0iLTAuNDg4IiB5PSIyMyIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPEFycmF5IGFzPSJwb2ludHMiPgogICAgICAgICAgPG14UG9pbnQgeD0iMjY3IiB5PSIzNzUiLz4KICAgICAgICA8L0FycmF5PgogICAgICAgIDxteFBvaW50IGFzPSJvZmZzZXQiLz4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI1NCIgdmFsdWU9IlN0dWRpbyAtJmd0OyBzdmMtY29tbW9uLWZvcm0tZ2VuZXJhdG9yIiBzdHlsZT0iZWRnZVN0eWxlPW5vbmU7Y3VydmVkPTE7aHRtbD0xO2lyLnN5bmNocm9uaXplZD0xO2V4aXRYPTE7ZXhpdFk9MC41O2V4aXREeD0wO2V4aXREeT0wO2VuZEFycm93PW9wZW47ZW5kRmlsbD0wO2VuZFNpemU9NDtzb3VyY2VQZXJpbWV0ZXJTcGFjaW5nPTk7c3Ryb2tlQ29sb3I9I0JGQkZCRjtzdHJva2VXaWR0aD0yO2lyLnJlZj02N2E3NDVlYi00NGFmLTQ5N2ItYjk5MS05ZjExMzNlMTEyZjY7aXIudGFncz14bWwsSlNPTixIVFRQUztlbnRyeVg9MDtlbnRyeVk9MDtlbnRyeUR4PTA7ZW50cnlEeT0wOyIgcGFyZW50PSIzNCIgc291cmNlPSI3MiIgdGFyZ2V0PSI3MCIgZWRnZT0iMSI+CiAgICAgIDxteEdlb21ldHJ5IHg9Ii0wLjEzOTkiIHk9Ii0xOSIgcmVsYXRpdmU9IjEiIGFzPSJnZW9tZXRyeSI+CiAgICAgICAgPG14UG9pbnQgeD0iMzU3IiB5PSI4NC4xMjUiIGFzPSJzb3VyY2VQb2ludCIvPgogICAgICAgIDxteFBvaW50IHg9IjUyMCIgeT0iNDc3IiBhcz0idGFyZ2V0UG9pbnQiLz4KICAgICAgICA8bXhQb2ludCB4PSItMSIgYXM9Im9mZnNldCIvPgogICAgICAgIDxBcnJheSBhcz0icG9pbnRzIj4KICAgICAgICAgIDxteFBvaW50IHg9IjM3MSIgeT0iNTgwIi8+CiAgICAgICAgPC9BcnJheT4KICAgICAgPC9teEdlb21ldHJ5PgogICAgPC9teENlbGw+CiAgICA8bXhDZWxsIGlkPSI3NSIgdmFsdWU9IlN0dWRpbyAtJmd0OyBXZWIgVUkiIHN0eWxlPSJpci5yZWY9ZDgxODMzZjAtMmNhYS00MWY1LWI0OGYtOTJiMTBhNmEyYjc1O2VkZ2VTdHlsZT1ub25lO2N1cnZlZD0xO2h0bWw9MTtpci5zeW5jaHJvbml6ZWQ9MTtleGl0WD0wO2V4aXRZPTAuMjU7ZXhpdER4PTA7ZXhpdER5PTA7ZW50cnlYPTE7ZW50cnlZPTAuNzU7ZW50cnlEeD0wO2VudHJ5RHk9MDtlbmRBcnJvdz1vcGVuO2VuZEZpbGw9MDtlbmRTaXplPTQ7c291cmNlUGVyaW1ldGVyU3BhY2luZz05O3N0cm9rZUNvbG9yPSNCRkJGQkY7c3Ryb2tlV2lkdGg9MjsiIHBhcmVudD0iMzQiIHNvdXJjZT0iNzAiIHRhcmdldD0iNzIiIGVkZ2U9IjEiPgogICAgICA8bXhHZW9tZXRyeSByZWxhdGl2ZT0iMSIgYXM9Imdlb21ldHJ5Ij4KICAgICAgICA8QXJyYXkgYXM9InBvaW50cyI+CiAgICAgICAgICA8bXhQb2ludCB4PSIyMjYiIHk9IjcwMSIvPgogICAgICAgIDwvQXJyYXk+CiAgICAgIDwvbXhHZW9tZXRyeT4KICAgIDwvbXhDZWxsPgogIDwvcm9vdD4KPC9teEdyYXBoTW9kZWw+Cg==</schema>
+  </diagram>
+  <trustZones>
+    <trustZone ref="private-secured" uuid="2ab4effa-40b7-4cd2-ba81-8247d29a6f2d" name="Private Secured" desc="A secured zone within a trusted private zone" trustRating="40"/>
+  </trustZones>
+  <questions/>
+  <assets/>
+  <settings/>
+  <dataflows>
+    <dataflow name="Studio -&gt; API gateway" ref="0e3ee209-6133-41fe-ab7d-477f5ecd4274" source="1109d524-d643-4eca-92e2-38b9ccf070f7" target="c31bf547-b418-44fb-8d64-f592cbea254d">
+      <assets/>
+      <tags>
+        <tag tag="Access Token"/>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+      </tags>
+    </dataflow>
+    <dataflow name="API gateway -&gt; Login" ref="128a0e8b-be64-4dc3-a9ab-248d91505aba" source="c31bf547-b418-44fb-8d64-f592cbea254d" target="d8b0b4ff-d891-43e6-8637-fa76bed6da36">
+      <assets/>
+      <tags>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+        <tag tag="xml"/>
+      </tags>
+    </dataflow>
+    <dataflow name="svc-common-form-generator -&gt; Redis Server" ref="1ca703ba-81ea-4c60-a8cc-c5d5bb9e3a34" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="85a95b22-8293-49eb-be6d-aaa441e54e11">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="svc-common-form-generator -&gt; svc-biz-sed-service-invoke" ref="464b750a-2ac9-425f-b413-bb00f25ba1a6" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="0dd85c2b-afa1-409c-b6ff-39941d67abf8">
+      <assets/>
+      <tags>
+        <tag tag="Access Token"/>
+        <tag tag="JSON"/>
+        <tag tag="RESTapi"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Migration microservices -&gt; PostgreSQL" ref="51514565-8117-4ea8-8dc7-70c18c418206" source="159009df-8374-4463-8b8c-8f8c38f279ae" target="df661557-3440-41ad-a563-621fc3f3e0cb">
+      <assets/>
+      <tags>
+        <tag tag="JDBC"/>
+      </tags>
+    </dataflow>
+    <dataflow name="OAuth2 Authorization Server -&gt; Studio" ref="52cc2d18-73be-4fd8-81ae-de34ab2e1691" source="efa06989-4844-444d-9db0-effc951e280c" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
+      <assets/>
+      <tags>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+        <tag tag="return access_token"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Studio -&gt; svc-common-form-generator" ref="67a745eb-44af-497b-b991-9f1133e112f6" source="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
+      <assets/>
+      <tags>
+        <tag tag="HTTPS"/>
+        <tag tag="JSON"/>
+        <tag tag="xml"/>
+      </tags>
+    </dataflow>
+    <dataflow name="svc-biz-sed-service-invoke -&gt; PostgreSQL" ref="7456e892-b3ab-4dc1-97ad-2a7bc40741a4" source="0dd85c2b-afa1-409c-b6ff-39941d67abf8" target="df661557-3440-41ad-a563-621fc3f3e0cb">
+      <assets/>
+      <tags>
+        <tag tag="JDBC"/>
+      </tags>
+    </dataflow>
+    <dataflow name="svc-common-form-generator -&gt; PostgreSQL" ref="74daacaf-cf86-4afe-b614-e637ae8956cb" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="df661557-3440-41ad-a563-621fc3f3e0cb">
+      <assets/>
+      <tags>
+        <tag tag="JDBC"/>
+      </tags>
+    </dataflow>
+    <dataflow name="RESTful Web Service -&gt; API gateway" ref="7916d7d8-af28-432b-b4f4-440d5aa0ec5a" source="54c2adc5-954b-49bd-9f1c-295b16a74473" target="c31bf547-b418-44fb-8d64-f592cbea254d">
+      <assets/>
+      <tags>
+        <tag tag="Access Token"/>
+        <tag tag="HTTPS"/>
+        <tag tag="JSON"/>
+        <tag tag="RESTapi"/>
+        <tag tag="xml"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Login -&gt; OAuth2 Authorization Server" ref="9819e3f7-25ce-4474-a4a2-60c023607a8c" source="d8b0b4ff-d891-43e6-8637-fa76bed6da36" target="efa06989-4844-444d-9db0-effc951e280c">
+      <assets/>
+      <tags>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+      </tags>
+    </dataflow>
+    <dataflow name="Studio -&gt; Web UI" ref="d81833f0-2caa-41f5-b48f-92b10a6a2b75" source="1109d524-d643-4eca-92e2-38b9ccf070f7" target="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="Redis Server -&gt; svc-common-form-generator" ref="db931bb0-5ea1-43e5-a0bf-c9855f686631" source="85a95b22-8293-49eb-be6d-aaa441e54e11" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
+      <assets/>
+      <tags/>
+    </dataflow>
+    <dataflow name="svc-common-form-generator -&gt; API gateway" ref="e206a0b9-3e6e-47ee-a1a6-d18fd9edad36" source="79ecf6b7-7801-4bf8-8946-781e16059de9" target="1109d524-d643-4eca-92e2-38b9ccf070f7">
+      <assets/>
+      <tags>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+        <tag tag="xml"/>
+      </tags>
+    </dataflow>
+    <dataflow name="API gateway -&gt; svc-common-form-generator" ref="eb8df61f-d0a4-491b-a5b8-f43875ac4d46" source="c31bf547-b418-44fb-8d64-f592cbea254d" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
+      <assets/>
+      <tags>
+        <tag tag="Access Token"/>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+        <tag tag="xml"/>
+      </tags>
+    </dataflow>
+    <dataflow name="svc-biz-sed-service-invoke -&gt; svc-common-form-generator" ref="f936b547-43b5-4d90-93f8-9eb696c5a2a1" source="0dd85c2b-afa1-409c-b6ff-39941d67abf8" target="79ecf6b7-7801-4bf8-8946-781e16059de9">
+      <assets/>
+      <tags>
+        <tag tag="HTTP"/>
+        <tag tag="JSON"/>
+      </tags>
+    </dataflow>
+  </dataflows>
+  <customFields/>
+  <components>
+    <component uuid="7a5e9411-bc0d-4aee-ad35-341bf4d0013c" diagramComponentId="07edaf38-85d5-4fc2-97a1-ffffc921c8c4" ref="efa06989-4844-444d-9db0-effc951e280c" name="OAuth2 Authorization Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="oauth2-authorization-server">
+      <tags/>
+      <questions>
+        <question ref="oauth2.0.usage.yes" answer="true" manuallyModified="false"/>
+        <question ref="oauth2.role.authorization.server" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="RFC6819-4.4.3.1" name="Accidental exposure of passwords at client site" state="0" impact="100" issueId="" issueLink="">
+          <desc>If the client does not provide enough protection, an attacker or
+   disgruntled employee could retrieve the passwords for a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.341">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.5" name="Authorization code phishing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A hostile party could impersonate the client site and get access to the authorization "code". This could be achieved using DNS or ARP spoofing. This applies to clients, which are web applications; thus, the redirect URI is not local to the host where the user's browser is running.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: This affects web applications and may lead to a disclosure of authorization "codes" and, potentially, the corresponding access and refresh tokens. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.3.3" name="Client obtains refresh token through automatic authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>All interaction with the resource owner is performed by the client. Thus it might, intentionally or unintentionally, happen that the client obtains a long-term authorization represented by a refresh token even if the resource owner did not intend so.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.12" name="DoS using manufactured authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker who owns a botnet can locate the redirect URIs of clients that listen on HTTP, access them with random authorization "codes", and cause a large number of HTTPS connections to be concentrated onto the authorization server. This can result in a denial-of-service (DoS) attack on the authorization server. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This attack can still be effective even when CSRF defense/the "state" parameter (see 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#section-4.4.1.8"&gt;Section 4.4.1.8&lt;/a&gt;) is deployed on the client side. With such a defense, the attacker might need to incur an additional HTTP request to obtain a valid CSRF code/"state" parameter. This apparently cuts down the effectiveness of the attack by a factor of 2. However, if the HTTPS/HTTP cost ratio is higher than 2 (the cost factor is estimated to be around 3.5x at [ 
+ &lt;a href="https://tools.ietf.org/html/rfc6819#ref-SSL-Latency" title="&amp;quot;SSL handshake latency and HTTPS optimizations&amp;quot;"&gt;SSL-Latency&lt;/a&gt;]), the attacker still achieves a magnification of resource utilization at the expense of the authorization server. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Impact: There are a few effects that the attacker can accomplish with this OAuth flow that they cannot easily achieve otherwise. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Connection laundering: With the clients as the relay between the attacker and the authorization server, the authorization server learns little or no information about the identity of the attacker. Defenses such as rate-limiting on the offending attacker machines are less effective because it is difficult to identify the attacking machines. Although an attacker could also launder its connections through an anonymizing system such as Tor, the effectiveness of that approach depends on the capacity of the anonymizing system. On the other hand, a potentially large number of OAuth clients could be utilized for this attack.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Asymmetric resource utilization: The attacker incurs the cost of an HTTP connection and causes an HTTPS connection to be made on the authorization server; the attacker can coordinate the timing of such HTTPS connections across multiple clients relatively easily. Although the attacker could achieve something similar, say, by including an iFrame pointing to the HTTPS URL of the authorization server in an HTTP web page and luring web users to visit that page, timing attacks using such a scheme may be more difficult, as it seems nontrivial to synchronize a large number of users to simultaneously visit a particular site under the attacker's control.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.1" name="Eavesdropped or leaked authorization codes" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could try to eavesdrop transmission of the authorization "code" between the authorization server and client. Furthermore, authorization "codes" are passed via the browser, which may unintentionally leak those codes to untrusted web sites and attackers in different ways: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Referrer headers: Browsers frequently pass a "referer" header when a web page embeds content, or when a user travels from one web page to another web page. These referrer headers may be sent even when the origin site does not trust the destination site. The referrer header is commonly logged for traffic analysis purposes.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Request logs: Web server request logs commonly include query parameters on requests.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Open redirectors: Web sites sometimes need to send users to another destination via a redirector. Open redirectors pose a particular risk to web-based delegation protocols because the redirector can leak verification codes to untrusted destination sites.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Browser history: Web browsers commonly record visited URLs in the browser history. Another user of the same web browser may be able to view URLs that were visited by previous users.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.159">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.11" name="Exhausted resources by a DoS attack" state="0" impact="100" issueId="" issueLink="">
+          <desc>If an authorization server includes a nontrivial amount of entropy in authorization "codes" or access tokens (limiting the number of possible codes/tokens) and automatically grants either without user intervention and has no limit on codes or access tokens per user, an attacker could exhaust the pool of authorization "codes" by repeatedly directing the user's browser to request authorization "codes" or access tokens.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.599">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.919">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-347" name="Improper Verification of Cryptographic Signature" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not verify, or incorrectly verifies, the cryptographic signature for data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.598">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.921">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.3" name="Insufficient Token Expiration" state="0" impact="100" issueId="" issueLink="">
+          <desc>Where the token is a handle, the attacker may attempt to guess the access token values based on knowledge they have from other access tokens.
+ Impact: Access to a single user's data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:38.516">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.7" name="Leaked authorization code through counterfeit client" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker leverages the authorization "code" grant type in an attempt to get another user (victim) to log in, authorize access to his/her resources, and subsequently obtain the authorization "code" and inject it into a client application using the attacker's account. The goal is to associate an access authorization for resources of the victim with the user account of the attacker on a client site. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker abuses an existing client application and combines it with his own counterfeit client web site. The attacker depends on the victim expecting the client application to request access to a certain resource server. The victim, seeing only a normal request from an expected application, approves the request. The attacker then uses the victim's authorization to gain access to the information unknowingly authorized by the victim. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The attacker conducts the following flow:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;The attacker accesses the client web site (or application) and initiates data access to a particular resource server. The client web site in turn initiates an authorization request to the resource server's authorization server. Instead of proceeding with the authorization process, the attacker modifies the authorization server end-user authorization URL as constructed by the client to include a redirect URI parameter referring to a web site under his control (attacker's web site).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker tricks another user (the victim) into opening that modified end-user authorization URI and authorizing access (e.g., via an email link or blog link). The way the attacker achieves this goal is out of scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Having clicked the link, the victim is requested to authenticate and authorize the client site to have access.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;After completion of the authorization process, the authorization server redirects the user agent to the attacker's web site instead of the original client web site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker obtains the authorization "code" from his web site by means that are out of scope of this document.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;He then constructs a redirect URI to the target web site (or application) based on the original authorization request's redirect URI and the newly obtained authorization "code", and directs his user agent to this URL. The authorization "code" is injected into the original client site (or application).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The client site uses the authorization "code" to fetch a token from the authorization server and associates this token with the attacker's user account on this site.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The attacker may now access the victim's resources using the client site.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Impact: The attacker gains access to the victim's resources as associated with his account on the client site. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.600">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.4" name="Malicious client obtains authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>A malicious client could pretend to be a valid client and obtain an access authorization in this way. The malicious client could even utilize screen-scraping techniques in order to simulate a user's consent in the authorization flow. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Assumption: It is not the task of the authorization server to protect the end-user's device from malicious software. This is the responsibility of the platform running on the particular device, probably in cooperation with other components of the respective ecosystem (e.g., an application management infrastructure). The sole responsibility of the authorization server is to control access to the end-user's resources maintained in resource servers and to prevent unauthorized access to them via the OAuth protocol. Based on this assumption, the following countermeasures are available to cope with the threat. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.1.1" name="Obtaining client secrets" state="0" impact="100" issueId="" issueLink="">
+          <desc>The attacker could try to get access to the secret of a particular client in order to:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay its refresh tokens and authorization "codes", or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;obtain tokens on behalf of the attacked client with the privileges of that "client_id" acting as an instance of the client.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;The resulting impact would be the following:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Client authentication of access to the authorization server can be bypassed.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Stolen refresh tokens or authorization "codes" can be replayed.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Depending on the client category, the following attacks could be utilized to obtain the client secret.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Attack: Obtain Secret From Source Code or Binary:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This applies for all client types. For open source projects, secrets can be extracted directly from source code in their public repositories. Secrets can be extracted from application binaries just as easily when the published source is not available to the attacker. Even if an application takes significant measures to obfuscate secrets in their application distribution, one should consider that the secret can still be reverse-engineered by anyone with access to a complete functioning application bundle or binary. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.1" name="Password phishing by counterfeit authorization server" state="0" impact="100" issueId="" issueLink="">
+          <desc>OAuth makes no attempt to verify the authenticity of the
+   authorization server.  A hostile party could take advantage of this
+   by intercepting the client's requests and returning misleading or
+   otherwise incorrect responses.  This could be achieved using DNS or
+   Address Resolution Protocol (ARP) spoofing.  Wide deployment of OAuth
+   and similar protocols may cause users to become inured to the
+   practice of being redirected to web sites where they are asked to
+   enter their passwords.  If users are not careful to verify the
+   authenticity of these web sites before entering their credentials, it
+   will be possible for attackers to exploit this practice to steal
+   users' passwords.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.342">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.654">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.2" name="Replay of authorized resource server requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>An attacker could attempt to replay valid requests in order to obtain
+   or to modify/destroy user data.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.4.1.10" name="Resource owner impersonation" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a client requests access to protected resources, the authorization flow normally involves the resource owner's explicit response to the access request, either granting or denying access to the protected resources. A malicious client can exploit knowledge of the structure of this flow in order to gain authorization without the resource owner's consent, by transmitting the necessary requests programmatically and simulating the flow against the authorization server. That way, the client may gain access to the victim's resources without her approval. An authorization server will be vulnerable to this threat if it uses non-interactive authentication mechanisms or splits the authorization flow across multiple pages.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The malicious client might embed a hidden HTML user agent, interpret the HTML forms sent by the authorization server, and automatically send the corresponding form HTTP POST requests. As a prerequisite, the attacker must be able to execute the authorization process in the context of an already-authenticated session of the resource owner with the authorization server. There are different ways to achieve this:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The malicious client could abuse an existing session in an external browser or cross-browser cookies on the particular device.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The malicious client could also request authorization for an initial scope acceptable to the user and then silently abuse the resulting session in his browser instance to "silently" request another scope.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Alternatively, the attacker might exploit an authorization server's ability to authenticate the resource owner automatically and without user interactions, e.g., based on certificates.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In all cases, such an attack is limited to clients running on the victim's device, either within the user agent or as a native app.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Please note: Such attacks cannot be prevented using CSRF countermeasures, since the attacker just "executes" the URLs as prepared by the authorization server including any nonce, etc. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.599">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.842">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.6.7" name="Token leakage via log files and HTTP referrers" state="0" impact="100" issueId="" issueLink="">
+          <desc>If access tokens are sent via URI query parameters, such tokens may
+   leak to log files and the HTTP "referer".
+ 
+</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.161">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="RFC6819-4.2.2" name="User unintentionally grants too much access scope" state="0" impact="100" issueId="" issueLink="">
+          <desc>When obtaining end-user authorization, the end user may not
+   understand the scope of the access being granted and to whom, or they
+   may end up providing a client with access to resources that should
+   not be permitted.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.160">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.334">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.1" name="Automatic processing of repeated authorizations requires client validation" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should NOT automatically process repeat authorizations where the client is not authenticated through a client secret or some other authentication mechanism such as a signed authentication assertion certificate ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.7"&gt;Section 5.2.3.7&lt;/a&gt;) or validation of a pre-registered redirect URI ( 
+&lt;a href="https://tools.ietf.org/html/rfc6819#section-5.2.3.5"&gt;Section 5.2.3.5&lt;/a&gt;).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is authenticated before giving repeated authorization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.993">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.1.1" name="Automatic revocation of derived tokens if abuse is detected" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If an authorization server observes multiple attempts to redeem an authorization grant (e.g., such as an authorization "code"), the authorization server may want to revoke all tokens granted based on the authorization grant.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that tokens are revoked after unsuccessful access attempts.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-3" name="Avoid passing bearer tokens in query parameters" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: 
+&lt;div&gt;
+  Bearer tokens in query parameters are no longer allowed in OAuth2.1 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC6570" url="https://tools.ietf.org/html/rfc6750"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  When sending the access token in the HTTP request URI, the client adds the access token to the request URI query component as defined by "Uniform Resource Identifier (URI): Generic Syntax" [RFC3986], using the "access_token" parameter. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, the client makes the following HTTP request using transport-layer security: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  GET /resource?access_token=mF_9.B5f-4.1JqM HTTP/1.1 
+&lt;/div&gt; 
+&lt;div&gt;
+  Host: server.example.com 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The HTTP request URI query can include other request-specific parameters, in which case the "access_token" parameter MUST be properly separated from the request-specific parameters using "&amp;amp;" character(s) (ASCII code 38). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Check that the access token is not passed using this way. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.521">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.3.1-C1" name="Avoid using &quot;resource owner password credentials&quot; and &quot;implicit&quot; flows" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Considerations to migrate to OAuth2.1: Use other flows that do not rely on the client's cooperation for resource owner interaction. Moreover, in OAuth2.1 the implicit and resource owner password flows have been removed and they can't be used anymore.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>There are three different flows that can be used: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Authorization code based flow&lt;/li&gt; 
+  &lt;li&gt;Device flow&lt;/li&gt; 
+  &lt;li&gt;Client credentials flow&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Ensure that the system is using one of them. 
+ &lt;/div&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.277">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.10-C1" name="Configure approval notifications to the resource owner to detect abuse" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should decide, based on an analysis of the risk associated with this threat, whether to detect and prevent this threat. In order to prevent such an attack, the authorization server may force a user interaction based on non-predictable input values as part of the user consent approval. The authorization server could 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;combine password authentication and user consent in a single form,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;make use of CAPTCHAs, or&lt;/li&gt; 
+  &lt;li&gt;use one-time secrets sent out of band to the resource owner (e.g., via text or instant message).&lt;/li&gt; 
+ &lt;/ul&gt;Alternatively, in order to allow the resource owner to detect abuse, the authorization server could notify the resource owner of any approval by appropriate means, e.g., text or instant message, or email. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that any resource owner can receive access attempts to their resources by any means (e.g., text or instant message, or email) and that the received information is complete enough to identify a threat.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.994">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.12-C2" name="Delay response after repeated unsuccessful authentication attempts" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should send an error response to the client reporting an invalid authorization "code" and rate-limit or disallow connections from clients whose number of invalid requests exceeds a threshold.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that after repeated unsuccessful attempts the authorization server response starts to slow down until the access attempts are non-viable.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.333">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.2" name="Determine expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Tokens should generally expire after a reasonable duration. This complements and strengthens other security measures (such as signatures) and reduces the impact of all kinds of token leaks. Depending on the risk associated with token leakage, tokens may expire after a few minutes (e.g., for payment transactions) or stay valid for hours (e.g., read access to contacts).&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The expiration time is determined by several factors, including:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;risk associated with token leakage,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration of the underlying access grant,&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;duration until the modification of an access grant should take effect, and&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;time required for an attacker to guess or produce a valid token.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.522">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.1" name="Don't issue secrets to clients with inappropiate security policy" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not issue secrets to clients that cannot protect secrets ("public" clients). This reduces the probability of the server treating the client as strongly authenticated.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For example, it is of limited benefit to create a single client id and secret that are shared by all installations of a native application. Such a scenario requires that this secret must be transmitted from the developer via the respective distribution channel, e.g., an application market, to all installations of the application on end-user devices. A secret, burned into the source code of the application or an associated resource bundle, is not protected from reverse engineering. Secondly, such secrets cannot be revoked, since this would immediately put all installations out of work. Moreover, since the authorization server cannot really trust the client's identifier, it would be dangerous to indicate to end users the trustworthiness of the client.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are other ways to achieve a reasonable security level, as described in the following sections. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that public clients don't store client secrets.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.334">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.607">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.773">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.2" name="Informed decisions based on transparency" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should clearly explain to the end user what happens in the authorization process and what the consequences are. For example, the user should understand what access he is about to grant to which client for what duration. It should also be obvious to the user whether the server is able to reliably certify certain client properties (web site URL, security policy).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+            <reference name="The Authorization Interface" url="https://www.oauth.com/oauth2-servers/authorization/the-authorization-interface/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  The authorization interface is the screen users will see when they are presented with an authorization request from a third-party app. Since the user is being asked to grant some level of access to a third-party app, you need to ensure the user has all the information they need to make an informed decision about authorizing the application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An authorization interface typically has the following components: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Website name and logo&lt;/li&gt; 
+  &lt;li&gt;User identification&lt;/li&gt; 
+  &lt;li&gt;Application details&lt;/li&gt; 
+  &lt;li&gt;The requested scope&lt;/li&gt; 
+  &lt;li&gt;The requested or effective lifetime&lt;/li&gt; 
+  &lt;li&gt;Allow / Deny buttons&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.4" name="Issue installation-specific client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may issue separate client identifiers and corresponding secrets to the different installations of a particular client (i.e., software package). The effect of such an approach would be to turn otherwise "public" clients back into "confidential" clients. 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For web applications, this could mean creating one "client_id" and "client_secret" for each web site on which a software package is installed. So, the provider of that particular site could request a client id and secret from the authorization server during the setup of the web site. This would also allow the validation of some of the properties of that web site, such as redirect URI, web site URL, and whatever else proves useful. The web site provider has to ensure the security of the client secret on the site. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For native applications, things are more complicated because every copy of a particular application on any device is a different installation. Installation-specific secrets in this scenario will require obtaining a "client_id" and "client_secret" either 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;during the download process from the application market, or&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;during installation on the device.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ol&gt;Either approach will require an automated mechanism for issuing client ids and secrets, which is currently not defined by OAuth.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The first approach would allow the achievement of a certain level of trust in the authenticity of the application, whereas the second option only allows the authentication of the installation but not the validation of properties of the client. But this would at least help to prevent several replay attacks. Moreover, installation-specific "client_ids" and secrets allow the selective revocation of all refresh tokens of a specific installation at once. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the client is connecting the authorization server using a "client_id" previously issued by the authorization server, and that the latter has enough information to ensure that the "client_id" is not forged in any way.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.4" name="Limit number of usages or one-time usage" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may restrict the number of requests or operations that can be performed with a certain token. This mechanism can be used to mitigate the following threats:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay of tokens&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;guessing&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;For example, if an authorization server observes more than one attempt to redeem an authorization "code", the authorization server may want to revoke all access tokens granted based on the authorization "code" as well as reject the current request.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  As with the authorization "code", access tokens may also have a limited number of operations. This either forces client applications to re-authenticate and use a refresh token to obtain a fresh access token, or forces the client to re-authorize the access token by involving the user. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to ensure that the number of usages of a token doesn't exceed the configured threshold.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.4.1.11-C1" name="Limit the number of access tokens granted per user" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server should consider limiting the number of access tokens granted per user.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the authorization server policies to find how many tokens are issued for every user.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.1" name="Limit token scope" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide to reduce or limit the scope associated with a token. The basis of this decision is out of scope; examples are: o a client-specific policy, e.g., issue only less powerful tokens to public clients, o a service-specific policy, e.g., it is a very sensitive service, o a resource-owner-specific setting, or o combinations of such policies and preferences. 
+&lt;div&gt; 
+ &lt;br&gt; The authorization server may allow different scopes dependent on the grant type. For example, end-user authorization via direct interaction with the end user (authorization "code") might be considered more reliable than direct authorization via grant type "username"/"password". This means will reduce the impact of the following threats: o token leakage o token issuance to malicious software o unintended issuance of powerful tokens with resource owner credentials flow 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that issued tokens are only valid for its purpose and cannot be used to access resources out of scope.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:40.334">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-4.2.1-C1" name="Provide mechanisms to confirm server authenticity" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should attempt to educate users about the risks posed by phishing attacks and should provide mechanisms that make it easy for users to confirm the authenticity of their sites.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that a message alerting about possible phishing attacks appears when trying to retrieve an authorization token from an authorization server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-2" name="Redirect URIs must be compared using exact string matching" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Considerations to migrate to OAuth2.1:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The complexity of implementing and managing pattern matching correctly obviously causes security issues. This document therefore advises to simplify the required logic and configuration by using exact redirect URI matching only. This means the authorization server MUST compare the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Additional recommendations: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Servers on which callbacks are hosted MUST NOT expose open redirectors (see Section 4.9).&lt;/li&gt; 
+  &lt;li&gt;Browsers reattach URL fragments to Location redirection URLs only if the URL in the Location header does not already contain a fragment. Therefore, servers MAY prevent browsers from reattaching fragments to redirection URLs by attaching an arbitrary fragment identifier, for example "#_", to URLs in Location headers.&lt;/li&gt; 
+  &lt;li&gt;Clients SHOULD use the authorization code response type instead of response types causing access token issuance at the authorization endpoint. This offers countermeasures against reuse of leaked credentials through the exchange process with the authorization server and token replay through sender-constraining of the access tokens.&lt;/li&gt; 
+ &lt;/ul&gt;If the origin and integrity of the authorization request containing the redirect URI can be verified, for example when using [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-26" title="&amp;quot;The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)&amp;quot;"&gt;I-D.ietf-oauth-jwsreq&lt;/a&gt;] or [ &lt;a href="http://www.ietf.org/internet-drafts/draft-ietf-oauth-par-02.txt" title="&amp;quot;OAuth 2.0 Pushed Authorization Requests&amp;quot;"&gt;I-D.ietf-oauth-par&lt;/a&gt;] with client authentication, the authorization server MAY trust the redirect URI without further checks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;ol&gt; 
+  &lt;/ol&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth 2.0 Pushed Authorization Requests" url="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20"/>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="RFC3986" url="https://tools.ietf.org/html/rfc3986"/>
+            <reference name="The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)" url="https://tools.ietf.org/html/draft-ietf-oauth-par-01"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the authorization server compares the two URIs using simple string comparison as defined in [RFC3986], Section 6.2.1. 
+&lt;div&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;Select an OAuth provider, Start Intercepting, Press Connect Button.&lt;/li&gt; 
+  &lt;li&gt;Forward until you see a request to the IDP corresponding to Step 2. in the above diagram.&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;It's possible that you won't see a redirect_uri parameter here. If this is the case, it's likely registered to a single URI, but you can add it and try anyways.&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Alter the redirect_uri URL parameter and replace it with the top level domain:&lt;/li&gt; 
+  &lt;ol&gt; 
+   &lt;li&gt;aws.console.amazon.com/myservice -&gt; aws.console.amazon.com&lt;/li&gt; 
+  &lt;/ol&gt; 
+  &lt;li&gt;Continue through the OAuth flow, authenticating and granting access.&lt;/li&gt; 
+  &lt;li&gt;If after the OAuth dance, the Browser is redirected to the top level domain, then the site is vulnerable to this attack.&lt;/li&gt; 
+ &lt;/ol&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references>
+              <reference name="Penetration Tester's Guide to Evaluating OAuth 2.0" url="https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-4" name="Refresh tokens must be sender-constrained" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner. This is to prevent privilege escalation by the legitimate client and reduce the impact of refresh token leakage. Authorization server MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients:&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance by utilizing [ &lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [ &lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response. The previous refresh token is invalidated but information about the relationship is retained by the authorization server. If a refresh token is compromised and subsequently used by both the attacker and the legitimate client, one of them will present an invalidated refresh token, which will inform the authorization server of the breach. The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token. This stops the attack at the cost of forcing the legitimate client to obtain a fresh authorization grant.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;Implementation note: the grant to which a refresh token belongs may be encoded into the refresh token itself. This can enable an authorization server to efficiently determine the grant to which a refresh token belongs, and by extension, all refresh tokens that need to be revoked. Authorization servers MUST ensure the integrity of the refresh token value in this case, for example, using signatures. 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check at least one of the following: 
+&lt;br&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;The authorization server cryptographically binds the refresh token to a certain client instance by utilizing [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#ref-I-D.ietf-oauth-token-binding" title="&amp;quot;OAuth 2.0 Token Binding&amp;quot;"&gt;I-D.ietf-oauth-token-binding&lt;/a&gt;] or [&amp;nbsp;&lt;a href="https://tools.ietf.org/html/rfc8705" title="&amp;quot;OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens&amp;quot;"&gt;RFC8705&lt;/a&gt;].&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;The authorization server issues a new refresh token with every access token refresh response.&lt;/li&gt; 
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references>
+              <reference name="RFC8705" url="https://tools.ietf.org/html/rfc8705"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.2" name="Require user consent for public clients without secret" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Authorization servers should not allow automatic authorization for public clients. The authorization server may issue an individual client id but should require that all authorizations are approved by the end user.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  For clients without secrets, this is a countermeasure against the following threat: Impersonation of public client applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Check that public clients cannot be authorized until the end user approves the access explicitly.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Public clients could be: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Single-page apps&lt;/li&gt; 
+  &lt;li&gt;Browser-based apps&lt;/li&gt; 
+  &lt;li&gt;Mobile apps&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.334">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.2.1" name="Restrict issuance of refresh tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The authorization server may decide, based on an appropriate policy, not to issue refresh tokens. Since refresh tokens are long-term credentials, they may be subject to theft. For example, if the authorization server does not trust a client to securely store such tokens, it may refuse to issue such a client a refresh token.</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the refresh policies of the authorization server to restrict the behavior.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.3.6" name="Revoke client secrets" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may revoke a client's secret in order to prevent abuse of a revealed secret.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Note: This measure will immediately invalidate any authorization "code" or refresh token issued to the respective client. This might unintentionally impact client identifiers and secrets used across multiple deployments of a particular native or web application.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This is a countermeasure against: Abuse of revealed client secrets for private clients 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that when a secret is abused the authorization server revokes access tokens, refresh tokens and all kinds of client secrets that can be used to continue accessing the server.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:38.482">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="oauth2.1-cons-1" name="Send PKCE challenge with the authorization request" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Considerations to migrate to OAuth2.1:&lt;/p&gt; 
+&lt;p&gt;PKCE requires an additional one-time code to be sent to the OAuth server. This is used to validate the request has not been intercepted or modified.&lt;/p&gt; 
+&lt;p&gt;The OAuth 2.1 draft specification requires that the PKCE challenge must be used with every Authorization Code grant, protecting against the authorization code being hijacked by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OAuth2.0 Security Topics" url="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15"/>
+            <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that PKCE is being used as indicated in RFC7636.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.995">
+              <output/>
+            </source>
+            <references>
+              <reference name="Proof Key for Code Exchange by OAuth Public Clients" url="https://tools.ietf.org/html/rfc7636"/>
+              <reference name="RFC7636" url="https://tools.ietf.org/html/rfc7636"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.4.3" name="Sign requests to resource server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A resource server may decide to accept signed requests only, either to replace transport-level security measures or to complement such measures. Every signed request should be uniquely identifiable and should not be processed twice by the resource server.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  This countermeasure helps to mitigate:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;modifications of the message and&lt;/li&gt; 
+   &lt;li&gt;replay attempts&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all requests sent from the authorization server to the resource servers are signed.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.996">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.9" name="Sign self-contained tokens" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Self-contained tokens should be signed in order to detect any attempt to modify or produce faked tokens (e.g., Hash-based Message Authentication Code or digital signatures).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the signature of the self-contained token with a tool that can verify a hash.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.2.4.4" name="Token binding" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>An authorization server may bind a token to a certain client identifier. This identifier should be validated for every request with that token. This technique can be used to 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;detect token leakage and&lt;/li&gt; 
+  &lt;li&gt;prevent token abuse.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;div&gt;
+   Note: Validating the client identifier may require the target server to authenticate the client's identifier. This authentication can be based on secrets managed independently of the token (e.g., pre-registered client id/secret on authorization server) or sent with the token itself (e.g., as part of the encrypted token content).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should match every refresh token to the identifier of the client to whom it was issued. The authorization server should check that the same "client_id" is present for every request to refresh the access token. If possible (e.g., confidential clients), the authorization server should authenticate the respective client. This is a countermeasure against refresh token theft or leakage.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server may require the binding of authentication credentials to a device identifier. The International Mobile Station Equipment Identity [ 
+  &lt;a href="https://tools.ietf.org/html/rfc6819#ref-IMEI" title="&amp;quot;International Mobile station Equipment Identities (IMEI)&amp;quot;"&gt;IMEI&lt;/a&gt;] is one example of such an identifier; there are also operating system-specific identifiers. The authorization server could include such an identifier when authenticating user credentials in order to detect token theft from a particular device. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: Any implementation should consider potential privacy implications of using device identifiers.&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   The authorization server should bind every authorization "code" to the id of the respective client that initiated the end-user authorization process. This measure is a countermeasure against: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Replay of authorization "codes" with different client credentials, since an attacker cannot use another "client_id" to exchange an authorization "code" into a token&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Online guessing of authorization "codes"&amp;nbsp;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Note: This binding should be protected from unauthorized modifications (e.g., using protected memory and/or a secure database).&amp;nbsp; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   &amp;nbsp; 
+  &lt;br&gt;The authorization server should be able to bind every authorization "code" to the actual redirect URI used as the redirect target of the client in the end-user authorization process. This binding should be validated when the client attempts to exchange the respective authorization "code" for an access token. This measure is a countermeasure against authorization "code" leakage through counterfeit web sites, since an attacker cannot use another redirect URI to exchange an authorization "code" into a token. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the following bindings are set: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Binding of authorization "code" to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Binding of authorization "code" to "redirect_uri"&lt;/li&gt; 
+  &lt;li&gt;Binding of refresh token to "client_id"&lt;/li&gt; 
+  &lt;li&gt;Bind tokens to a particular resource server (Audience)&lt;/li&gt; 
+  &lt;li&gt;Issue a "client_id" only in combination with "redirect_uri"&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.996">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.774">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:40.335">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:38.278">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:48:39.523">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-counterfeiting" name="Attacker generates an ID token or modifies an existing one to obtain unauthorized access" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>To gain unauthorized access to a resource an adversary could create a fake token or modify the scope of an existing one</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-347">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.9" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="authz-bypass" name="Attackers attempt to bypass authorization flow" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An adversary exploits a weakness to bypass authorization system</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.2.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.2.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.10">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.4">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                    <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.2.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.10-C1" mitigation="12"/>
+                <countermeasure ref="RFC6819-4.4.3.1-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.2.1.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.1" mitigation="12"/>
+                <countermeasure ref="RFC6819-5.2.4.2" mitigation="16"/>
+                <countermeasure ref="oauth2.1-cons-1" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-2" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-3" mitigation="12"/>
+                <countermeasure ref="oauth2.1-cons-4" mitigation="12"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="impersonation-attempts" name="Attackers attempt to impersonate a privileged user to access to the resources" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An adversary attempts to impersonate a privileged user to access to the resources</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.4.1.5">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.3.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.2">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.6.7">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.2.1" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.3.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.2.4.4" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.4.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="token-guessing" name="Attackers attempt to retrieve token by guessing" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An adversary attempts to retrieve tokens by guessing</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.6.3">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                    <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.2" mitigation="50"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="common-vuln-exploitation" name="Attackers gain access by stealing user information through common vulnerabilities" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An adversary exploits common weaknesses like phishing, spoofing, etc. to escalate privileges</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="RFC6819-4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                    <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.1">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-5.1.5.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.1" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.2" mitigation="25"/>
+                <countermeasure ref="RFC6819-5.2.3.6" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.11">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="RFC6819-4.4.1.12">
+                  <countermeasures>
+                    <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RFC6819-4.4.1.11-C1" mitigation="50"/>
+                <countermeasure ref="RFC6819-4.4.1.12-C2" mitigation="50"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="769af225-d13b-4813-96ef-d48038e1a699" diagramComponentId="1617c6c4-010c-45c8-9085-1837a1d600c3" ref="d8b0b4ff-d891-43e6-8637-fa76bed6da36" name="Login" desc="" library="IR-Functional-Components" parentComponentRef="1109d524-d643-4eca-92e2-38b9ccf070f7" componentDefinitionRef="CD-LOGIN">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses/>
+      <countermeasures>
+        <countermeasure ref="C-SET-TIMESTAMP-ON-REQUEST" name="Attach timestamps or sequence numbers to each sent message" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To avoid replay attacks, a type of man in the middle attack, it is recommended to add a timestamp or sequence numbers in the exchanged messages, this will allow the receiver to discard messages with a duplicated sequence number or timestamp.&lt;/p&gt;&lt;p&gt;An example of sequence number in its messages is the TCP protocol with its ACK.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Transaction Authorization Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Review code application.&lt;/li&gt;&lt;li&gt;Check the exchanged messages and verifies if there is a timestamp or sequence number and that no duplicates are allowed.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-654" name="Authenticate users (multi - or two-factor - authentication [2FA])" issueId="" issueLink="" platform="" cost="1" risk="0" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For more sensitive applications hosting data or functionality requiring greater assurance over the identification of users, a multi - or two-factor - authentication process is recommended. Together with asserting their identity and a password/phrase/PIN (something you know), such systems require additional factors, such as biometric validation (something you are), user-initiated action such as a button press on a FIDO hardware key or a token (something you have).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement multi-factor authentication for applications providing access to sensitive data or functionality, and for highly privileged user access (e.g. administrators).&lt;/li&gt;&lt;li&gt;This should leverage something such as a soft or hard-token verification in addition to the secret password/pass-phrase for example.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+          </references>
+          <standards>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.8" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5.2.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.5" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.9" supportedStandardRef="nist-800-63"/>
+            <standard ref="6.1.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check for authentication functions of the component.&lt;/li&gt;&lt;li&gt;Verify at least a combination of the following factors is used within the authentication process.&lt;/li&gt;&lt;/ol&gt;&lt;ul&gt;&lt;li&gt;Something that you are: mainly biometric characteristics of yourself such as fingerprint, facial recognition, iris recognition, etc.)&lt;/li&gt;&lt;li&gt;Something that you know: a PIN, password, pass phrase, etc.&lt;/li&gt;&lt;li&gt;Something that you have: a hardware token, a card, a dongle, a mobile phone, etc.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-AUTHZ-AFTER-AUTHN" name="Authorize after you authenticate" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Authorization should be conducted as an explicit check, and as necessary even after an initial authentication has been completed. Authorization depends not only on the privileges associated with an authenticated user, but also on the context of the request. The time of the request and the location of the requesting user may both need to be taken into account.&lt;/p&gt;&lt;p&gt;Sometimes a user's authorization for a system or service needs to be revoked, for example, when an employee leaves a company. If the authorization mechanism fails to allow for such revocation, the system is vulnerable to abuse by authenticated users exercising out-of-date authorizations.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Authorize After You Authenticate" url="https://cybersecurity.ieee.org/blog/2015/11/13/authorize-after-you-authenticate/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Validate that no authorization process is conducted before an authentication process has previously finished.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-SAML-VERIFY-IDP-X509" name="Check if the X509Certificate entity is really the correct certificate for your Identity Provider" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It is necessary to ensure the identity of the supplier by verifying the certificate of the messages, to ensure that it is the correct one.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="SAML Raider - SAML2 Burp Extension" url="https://github.com/portswigger/saml-raider"/>
+            <reference name="SAML Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check if it is possible to remove the signature&lt;/li&gt;&lt;li&gt;Sign the SAML Response with own certificate&lt;/li&gt;&lt;li&gt;Check the signature algorithm in use&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-524" name="Clear caches of sensitive data" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Applications storing or caching data locally are at risk of attack and compromise of that data. Local temporary storage, thumbnail images, and configuration files often contain excerpts of sensitive information that may be left on the device during or after the application is used.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure all temporary files, caches, and storage are purged after use and when the application is closed.&lt;/li&gt;&lt;li&gt;Do not allow the application to cache sensitive information outside of the OS provided secure stores.&lt;/li&gt;&lt;li&gt;Use OS controls to restrict thumbnails of the application in cases where sensitive information is displayed.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP MASVS - Android - Testing Whether the Keyboard Cache Is Disabled for Text Input Fields" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05d-testing-data-storage#determining-whether-the-keyboard-cache-is-disabled-for-text-input-fields-mstg-storage-5"/>
+            <reference name="OWASP MASVS - iOS - Testing for Sensitive Data in the Clipboard" url="https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06d-testing-data-storage#finding-sensitive-data-in-the-keyboard-cache-mstg-storage-5"/>
+          </references>
+          <standards>
+            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="2.4" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check the application for the use of caching.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify they are periodically emptied.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.858">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-IMPLEMENT-SSO" name="Consider using Single Sign-on (SSO)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Single Sign-on (SSO) occurs when a user logs in to one application and is then signed in to other applications automatically, regardless of the platform, technology, or domain the user is using. The user signs in only one time, hence the name of the feature (Single Sign-on).&lt;/p&gt;&lt;p&gt;SSO provides a seamless experience for users when using your applications and services. Instead of having to remember separate sets of credentials for each application or service, users can simply log in once and access your full suite of applications.&lt;/p&gt;&lt;p&gt;Whenever users go to a domain that requires authentication, they are redirected to the authentication domain where they may be asked to log in. If the user is already logged in at the authentication domain, they can be immediately redirected to the original domain without signing in again.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Single Sign-On" url="https://auth0.com/docs/authenticate/single-sign-on"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if there is any chance to connect to a SSO from your application&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-603" name="Enforce authentication on the server-side" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data on the client-side must be considered tainted. &amp;nbsp;As such, decisions on authentication (or Identification and Verification - ID&amp;amp;V) must be made or validated on the server-side to prevent their subversion.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure credentials are passed securely from client-to server.&lt;/li&gt;&lt;li&gt;The server should compare the credentials with those stored on the server-side (e.g. the hashed password compared against those stored for the claimed identity).&lt;/li&gt;&lt;li&gt;Implement controls to mitigate brute-force attacks; for example through rate-limiting, account lockouts, or escalating timeouts.&lt;/li&gt;&lt;li&gt;Once authenticated, a non-predictable and cryptographically secure token should be passed securely to the client-side to validate further interaction with the server.&lt;/li&gt;&lt;li&gt;Messages returned to the user during authentication, in particular when the process fails, should not reveal to the user whether the username was valid. &amp;nbsp;Returning generic errors prevents an attacker enumerating valid account IDs for subsequent attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(d)" supportedStandardRef="hipaa-required"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.7.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.3.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify which functions the service provides which are authenticated or performing a privileged action.&lt;/li&gt;&lt;li&gt;Try to access them without providing any type of authentication.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A clear example of what you should look for would be an API endpoint which allows a client to update a resource, you should ensure this call checks the authentication on the server side (by checking the session having validated the authentication credentials previously).&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-598" name="Ensure no sensitive data is sent in the URL" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed in the URL (address bar) between client and server is likely to be exposed in logs on the server, or intermediate devices (such as proxies or other network devices), or in local browser logs/history. A common mistake is, for example, to pass a SessionID value as a parameter in the URL of a get request between hosts. To mitigate the risk of exposure of sensitive data, this sensitive data should only be sent in the body of an HTTP message (for example a POST request), or in the HTTP headers (i.e. standard headers such as the Cookie values, or a custom X- header).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure sensitive, private, or otherwise restricted data is not sent in a URL value.&lt;/li&gt;&lt;li&gt;Pass sensitive data only in appropriately protected fields in the body or headers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Sensitive Data Exposure" url="https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A02:2021-Cryptographic Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A3:2017-Sensitive Data Exposure" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy.&lt;/li&gt;
+                            &lt;li&gt;Programmatically or manually visit all authenticated content and functionality
+                            within the application.&lt;/li&gt;
+                            &lt;li&gt;Review logs to determine if sensitive data is sent in the URL at any point. If
+                            should only be sent in HTTP headers (i.e. a cookie) or as part of the body (e.g. in a POST
+                            or PUT request).&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                            &lt;ol&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.213">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.1" name="Ensure sensitive data is not revealed through error output messages" issueId="" issueLink="" platform="" cost="0" risk="37" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure the application does not output error messages or stack traces containing sensitive
+                        data that could assist an attacker, including the session id, software/framework versions and
+                        personal information.</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+          </references>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application does not output error massages or stack traces containing sensitive data.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.361">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" name="Ensure that access control mechanisms are centralized" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access control, authentication and authorization procedures should be centralized, and all roles, permissions, groups and users shall be controlled - or gain access - through this mechanism.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To ensure roles, groups and permissions are assigned properly to users, we need to have centralized access control, to grant or deny access easily and securely.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that access control mechanisms are centralized.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.360">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.038">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.037">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-FORCE-LOGOUT" name="Force logout if account permissions have been revoked" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Active sessions could be used by a malicious actor even after the account has been removed or blocked from the system. This could open the door to MitM attacks and session hijacking attacks while the application connects to the IdP to confirm that the session has no more rights to operate.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Man-in-the-middle Attack" url="https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack"/>
+            <reference name="Session Hijacking Attack" url="https://owasp.org/www-community/attacks/Session_hijacking_attack"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check periodically the session status with the SSO/IdP and force the log off process in case the active account was blocked/deleted.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="37" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-session-generation-and-expiration" name="Implement a secure Session Generation and Expiration" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of Session Generation and Expiration which is tracked in a session. This session is typically stored on the server for traditional web based session management. A session identifier is then given to the user so they can identify which server-side session contains the correct user data. The client only needs to maintain this session identifier, which also keeps sensitive server-side session data off of the client.&lt;/p&gt;&lt;p&gt;Here are a few controls to consider when building or implementing session management solutions:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure that the session id is long, unique and random. The session ID length must be at least 128 bits (16 bytes)&lt;/li&gt;&lt;li&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks such as when an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good PRNG (Pseudo Random Number Generator) must be used. The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).&lt;/li&gt;&lt;li&gt;The application should generate a new session or at least rotate the session id during authentication and re-authentication.&lt;/li&gt;&lt;li&gt;The application should not treat OAuth and refresh tokens as their own session identifiers. Moreover, it should allow users to terminate trust relationships with linked applications.&lt;/li&gt;&lt;li&gt;The CSPs (Credential Service Provider) should re-authenticate the subscriber if it has not been authenticated since a given inactivity period. CSPs should inform the RP (Relying Parties) the last authentication time, to know if re-authentication is needed.&lt;/li&gt;&lt;li&gt;When a user chooses to log out (or otherwise has their session terminated), the user session must be terminated on the server-side, not solely at the client-side (for example by deleting or reissuing a session ID token/cookie).&lt;ul&gt;&lt;li&gt;Revoke user sessions on the server-side.&lt;/li&gt;&lt;li&gt;Redirect users to the login page, or provide a login prompt.&lt;/li&gt;&lt;li&gt;Where possible, ensure the session is not reused by the application server.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should implement an idle timeout after a period of inactivity and an absolute maximum lifetime for each session, after which users must re-authenticate. If the application has implemented a functionality to be always logged in, the application must force users to re-authenticate for more sensitive actions.&lt;/li&gt;&lt;li&gt;The length of the timeouts should be inversely proportional with the value of the data protected.&lt;ul&gt;&lt;li&gt;30 days&lt;/li&gt;&lt;li&gt;12 hours or 30 minutes of inactivity, 2FA optional&lt;/li&gt;&lt;li&gt;12 hours or 15 minutes of inactivity, with 2FA&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.6.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.2.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Check that sessions are renewed following the steps below:&lt;ul&gt;&lt;li&gt;Log in to the application.&lt;/li&gt;&lt;li&gt;Open another browser and go to the login page.&lt;/li&gt;&lt;li&gt;Log in to the application for the second time.&lt;/li&gt;&lt;li&gt;Check that the old session and session id are removed.&lt;/li&gt;&lt;li&gt;Check that a new session is created with new session id.&lt;/li&gt;&lt;li&gt;Check that the old and new session ids are different.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that sessions tokens are generated from a source with sufficient entropy and they are not predictable.&lt;/li&gt;&lt;li&gt;Check that the refresh tokens and OAuth sessions with linked applications have not been terminated by users.&lt;/li&gt;&lt;li&gt;Check the CSPs force the RP to re-authenticate after a certain period of inactivity.&lt;/li&gt;&lt;li&gt;Check that the logout and expiration invalidate the session token, following the steps below:&lt;ul&gt;&lt;li&gt;Open a browser.&lt;/li&gt;&lt;li&gt;Authenticate as a user A.&lt;/li&gt;&lt;li&gt;Get the Session ID and note it.&lt;/li&gt;&lt;li&gt;Logout of the service.&lt;/li&gt;&lt;li&gt;Set up the noted Session ID.&lt;/li&gt;&lt;li&gt;Try to access an authenticated section of the service and you should not be able to do it as user A.&lt;/li&gt;&lt;li&gt;To edit the cookies you can either use a proxy (i.e. OWASP ZAP, Burp, Fiddler, etc.) or a browser extension which allows you to tamper the cookies (i.e. Tamper Data, Cookie Manager, etc.).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that the session expires after a certain period of inactivity following the steps below:&lt;ul&gt;&lt;li&gt;Verify the expected inactive timeout.&lt;/li&gt;&lt;li&gt;Check 'normal' use through a browser:&lt;ul&gt;&lt;li&gt;Go to the authentication feature of the component.&lt;/li&gt;&lt;li&gt;Authenticate as a user.&lt;/li&gt;&lt;li&gt;Leave the session open for a given time (check the expiration time that has been agreed to be implemented).&lt;/li&gt;&lt;li&gt;Revisit an authenticated page and determine if the session has expired (e.g. the session is no longer authenticated).&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check the control is enforced on the server side and not using code in the browser:&lt;ul&gt;&lt;li&gt;Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and determine which cookies or other tokens are used to maintain session state. Alternatively, capture an authenticated application request for replay.&lt;/li&gt;&lt;li&gt;Store and replay the request after the timeout period to see if the application responds with authenticated data.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Review application operation and determine if any behavior artificially holds the session open, for example, heartbeat requests or calls to update data feeds sent from the client to the server are sometimes mistakenly interpreted as user activity, holding the session open.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.364">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="37" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.364">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-THREAD-CONCURRENCY" name="Implement threading, concurrency and asynchronicity" issueId="" issueLink="" platform="" cost="0" risk="37" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to make your application more responsive to a user and maximize the performance of your user's computer, we have different coding techniques. Not so long ago, apps got faster simply by buying a newer PC or server and then that trend has reversed. Users still want responsive UI and business owners want servers that scale with their business. The transition to mobile and cloud and an internet-connected population of &amp;gt;3B users has resulted in a new set of software patterns.&lt;/p&gt;&lt;p&gt;Using multiple threads of execution is one of the most powerful ways to keep your application responsive to the user and at the same time make use of the processor in between or even during user events.&lt;/p&gt;&lt;p&gt;We use concurrency to take advantage of the hardware, so you can parallelize your code to distribute work across multiple processors.&lt;/p&gt;&lt;p&gt;Async programming is a key technique that makes it straightforward to handle blocking I/O and concurrent operations on multiple cores.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Parallel Processing, Concurrency, and Async Programming in .NET" url="https://docs.microsoft.com/en-us/dotnet/standard/parallel-processing-and-concurrency"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for bottlenecks in the workflow of the application that may cause a denial of service attack if exploited such as a misconfigured file reader that blocks the main thread if more than one file is uploaded to the application.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ACCOUNT-LOCKDOWN" name="Instead of completely locking out an account, place it in a lockdown mode with limited capabilities" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Depending on how critical the application is, accounts can be entirely locked out or just flagged to have most of their permissions removed. This is useful to ensure that the user experience remains good while at the same time protect the system of potential attacks due to an account misuse.&lt;/p&gt;&lt;p&gt;Developers should check that this lockdown mode doesn't reveal any potential information that could be relevant to an attacker as well as the actions that the user can do. Developers must provide a process to recover the account to its normal behavior.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Attempt to login several times with a wrong password&lt;/li&gt;&lt;li&gt;Login with the right password and check if the behavior is the same with and without having failed the login attempts.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-TOKEN-TIMEOUT" name="Invalidate a session after a predefined idle time has passed" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to keep the authenticated state and track the users progress, applications provide users with a session identifier or token which binds the user authentication credentials to the user HTTP traffic and the appropriate access controls enforced by the web application.&lt;/p&gt;&lt;p&gt;It is mandatory to set expiration timeouts for every session, establishing the amount of time a session will remain active. Insufficient session expiration by the web application increases the exposure of other session-based attacks, as for the attacker to be able to reuse a valid session ID and hijack the associated session.&lt;/p&gt;&lt;p&gt;The session expiration timeout values must be set accordingly with the purpose and nature of the web application, and balance security and usability. There are two automatic session expiration, iddle timeout and absolute timeout. Both values are highly dependent on how critical the web application and its data are. Common idle timeouts ranges are 2-5 minutes for high-value applications and 15-30 minutes for low risk applications. Absolute timeouts depend on how long a user usually uses the application. If the application is intended to be used by an office worker for a full day, an appropriate absolute timeout range could be between 4 and 8 hours.&lt;/p&gt;&lt;p&gt;When a session expires, the web application must take active actions to invalidate the session on both sides, client and server. The latter is the most relevant and mandatory from a security perspective.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Set session timeout to the minimal value possible depending on the context of the application.&lt;/li&gt;&lt;li&gt;Avoid "infinite" session timeout.&lt;/li&gt;&lt;li&gt;Prefer declarative definition of the session timeout in order to apply a global timeout for all application sessions.&lt;/li&gt;&lt;li&gt;Trace session creation/destruction in order to analyse the creation trend and try to detect a normal number of session creations (application profiling phase in a attack).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-OTP-BRUTE-FORCE" name="Prevent brute force attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement appropriate protection to prevent users from brute-forcing token generation and token checking with mechanisms such as rate limiting or CAPTCHA. And remember that OTP length must be at least 6 characters long and a combination of different characters (not only numbers, not only letters, ...).&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Protect Against Automated Attacks" url="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#protect-against-automated-attacks"/>
+          </references>
+          <standards>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if there is any captcha enabled and investigate if making continuous requests with an automated tool like Burp it is still accepting the request and generating or checking OTPs.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:53.905">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-OTP-INVALID" name="Prevent old or used OTPs from being reused by invalidating them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;One-time passwords (OTP) are secrets used during operations that need added security or as part of user enrollment processes. Despite their short lifespan, only one OTP should be valid at any given time, and therefore, all previous OTPs should be invalidated whenever a new one is generated or after the OTP has expired.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Forgot Password Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html"/>
+            <reference name="Invalidate Previous OTPs" url="https://docs.fluidattacks.com/criteria/requirements/347"/>
+          </references>
+          <standards>
+            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.8.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Request an OTP and try to use it a couple of times. Verify that the OTP cannot be used twice or more.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:53.906">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-PREVENT-SIMULTANEOUS-LOGIN" name="Prevent Simultaneous Logins" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;It's possible that the application needs or wants to have simultaneous session, in this case, please control the number of the total active session and limit it.&lt;/p&gt;&lt;p&gt;If the application does not want to allow simultaneous session logons, it must take effective actions after each new authentication event, implicitly terminating the previously available session, or asking the user (through the old, new or both sessions) about the session that must remain active.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Open different browsers, or a "normal" tab and an "anonymous" tab, and check the following points:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Have you received some notification in some tab?&lt;/li&gt;&lt;li&gt;Was it possible to log in on the new login attempt? if the answer is yes, then has the previously open session been closed?&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If the first session has been closed, it is recommended to check that it has been carried out correctly. To do this, use a proxy in the process, and forward requests prior to logout and check the response.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-SESSION-ID-ON-PARAMETER" name="Prevent the attacker from making the user use his session by accepting session IDs only from cookies, not from GET or POST parameters" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The preferred session ID exchange mechanism should allow defining advanced token properties, such as the token expiration date and time, or granular usage constraints. This is one of the reasons why cookies (RFCs 2109 &amp;amp; 2965 &amp;amp; 6265) are one of the most extensively used session ID exchange mechanisms, offering advanced capabilities not available in other methods.&lt;/p&gt;&lt;p&gt;The usage of specific session ID exchange mechanisms, such as those where the ID is included in the URL, might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines), as well as facilitate other attacks, such as the manipulation of the ID or session fixation attacks.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Review the code and check where the session ID is set.&lt;/li&gt;&lt;li&gt;Functional test, review the traffic (requests and responses), and verify thtat the session ID only appears in the cookie.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="require-use-strong-passwords" name="Require the use of strong passwords" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords used either as a sole verification credentials, or as part of a multi-factor authentication, are a key aspect of application security, and strong password selection should be encouraged and enforced. The application should allow flexibility in user password selection, and enforce minimum criteria for password quality. This should include:&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Minimum password length requirements, to mitigate brute-force and dictionary attacks.&lt;/li&gt; 
+ &lt;li&gt;Encourage use of pass-phrases using multiple words, achieving longer passwords more resistant to attack.&lt;/li&gt; 
+ &lt;li&gt;Enforce use of mixed case, numeric and/or special characters to increase complexity.&lt;/li&gt; 
+ &lt;li&gt;Prevent or discourage use of dictionary words and common passwords through black-lists. For example, a set of commonly used passwords can be found on SecLists at &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&amp;nbsp;&lt;/a&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password length:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password length considers the minimum and maximum length of characters comprising the password of your users. For ease of changing this length, its implementation can be configurable possibly using a properties file or xml configuration file.&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;&lt;b&gt;Minimum length. &lt;/b&gt;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Memory secrets shall be at least 8 characters long. &lt;/li&gt; 
+  &lt;li&gt;Memory secrets generated automatically shall be at least 6 numeric characters.&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Maximum length. &lt;/b&gt;People tend to forget their passwords easily. The longer the password, the more likely people are to enter them incorrectly for the system. However, long pass-phrases can be easily remembered, and should not be prevented through unnecessarily strict upper restrictions on length. &lt;/span&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Passwords with 64 characters or longer shall be permitted.&amp;nbsp;&lt;/span&gt;&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;b&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt;&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;Password Complexity:&lt;/span&gt;&lt;/p&gt;&lt;/b&gt; 
+&lt;ul&gt; 
+ &lt;ul&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Passwords with consecutive multiple spaces shall be coalesced and converter into only one space. After this modification, the password length shall be at least 12 characters long.&lt;/li&gt; 
+ &lt;li&gt;Unicode characters shall be allowed in the password. A single Unicode code point is considered a character.&lt;/li&gt; 
+ &lt;li&gt;Reject those passwords whose are commonly used and they have been already been leaked in a previous compromise. You may choose to block the top 1000 or 10000 most common passwords which meet the above length requirements and are found in compromised password lists. The following link contains the most commonly found passwords: &lt;a href="https://github.com/danielmiessler/SecLists/tree/master/Passwords"&gt;https://github.com/danielmiessler/SecLists/tree/master/Passwords&lt;/a&gt;&lt;/li&gt; 
+ &lt;li&gt;Actual passwords must not be stored, to protect them against brute forcing if the database is compromised Screen reader support enabled.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Password Topologies:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Ban commonly used password topologies.&lt;/li&gt; 
+ &lt;li&gt;Force multiple users to use different password topologies.&lt;/li&gt; 
+ &lt;li&gt;Require a minimum topology change between old and new passwords.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;span style="font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline;"&gt;&lt;b&gt;Additional Information:&lt;/b&gt;&lt;/span&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Make sure that every character the user types in is actually included in the password. We've seen systems that truncate the password at a length shorter than what the user provided (e.g., truncated at 15 characters when they entered 20).&lt;/li&gt; 
+ &lt;li&gt;As application's require more complex password policies, they need to be very clear about what these policies are. The required policy needs to be explicitly stated on the password change page&lt;/li&gt; 
+ &lt;li&gt;If the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with, not just the 1st rule it doesn't comply with.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;ul&gt; 
+&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Blacklist Top Leaked Passwords" url="https://github.com/danielmiessler/SecLists/tree/master/Passwords"/>
+            <reference name="NIST 800-63-B: 5.1.2.2" url="https://pages.nist.gov/800-63-3/sp800-63b.html"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="Owasp CheatSheet: Authentication" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.1.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.1" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.3" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.13.14" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.4" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="A.3" supportedStandardRef="nist-800-63"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt; 
+ &lt;li&gt;Verify the passwords comply with the company policy for strong passwords.&lt;/li&gt; 
+ &lt;li&gt;If there is no policy, check the strength against industry standards as NIST or OWASP.&lt;/li&gt; 
+&lt;/ol&gt;An example of strong password policy (&amp;nbsp; 
+&lt;a href="https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls"&gt;from the OWASP Authentication Cheat Sheet&lt;/a&gt;) is: Password must meet at least 3 out of the following 4 complexity rules: 
+&lt;ul&gt; 
+ &lt;li&gt;at least 1 uppercase character (A-Z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 lowercase character (a-z)&lt;/li&gt; 
+ &lt;li&gt;at least 1 digit (0-9)&lt;/li&gt; 
+ &lt;li&gt;at least 1 special character (punctuation). Do not forget to treat space as special characters too&lt;/li&gt; 
+ &lt;li&gt;at least 10 characters&lt;/li&gt; 
+ &lt;li&gt;at most 128 characters&lt;/li&gt; 
+&lt;/ul&gt;not more than 2 identical characters in a row (e.g., 111 not allowed).</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-NEW-LOCATION-LOGIN-ALERT" name="Send a message to the user each time the system detects that the user is logging in from a new device or IP" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Aside from the IP address, there are a number of different factors that can be used to attempt to fingerprint a device. Some of these can be obtained passively by the server from the HTTP headers (particularly the "User-Agent" header), including:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Operating system&lt;/li&gt;&lt;li&gt;Browser&lt;/li&gt;&lt;li&gt;Language&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Using JavaScript it is possible to access far more information, such as:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Screen resolution&lt;/li&gt;&lt;li&gt;Installed fonts&lt;/li&gt;&lt;li&gt;Installed browser plugins&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Using these various attributes, it is possible to create a fingerprint of the device. This fingerprint can then be matched against any browser attempting to login to the account, and if it doesn't match then the user can be prompted for additional authentication. Many users will have multiple devices or browsers that they use, so it is not practical to block attempts that do not match the existing fingerprints.&lt;/p&gt;&lt;p&gt;To take in mind: data submitted from client can be spoofed by an attacker.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Credential Stuffing Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use the application and try to log in from different devices. Note the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Does the notification arrive?&lt;/li&gt;&lt;li&gt;Are the user's trusted devices saved in server (DB)?&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-525-CACHING" name="Set Cache-Control headers on sensitive and authenticated content" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Browsers, servers, and upstream/intermediate devices may cache (temporarily store) data sent in
+                        HTTP sessions for performance reasons. The protocol allows for a number of HTTP headers and
+                        directives to control what data may be cached, where, and for how long. It is important to specify
+                        cache-controls to prevent the exposure of sensitive data through the inappropriate caching
+                        of authenticated and otherwise restricted access data, either in the users' browser or other
+                        devices.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Configure the server or application to set cache-control headers on sensitive content.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;The following headers are recommended:&lt;/li&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;
+                        &lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;
+                        &lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;
+                        &lt;li&gt;Pragma: no-cache&amp;nbsp;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+          </references>
+          <standards>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure appropriate cache directives are returned for all sensitive and authenticated content.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the cache controls returned as part of these responses.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze cache headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;The following is an example of what should be set to prevent a disclosure of sensitive data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Expires: Tue, 03 Jul 2001 06:00:00 GMT 9.4&lt;/li&gt;&lt;li&gt;Last-Modified: {now} GMT&lt;/li&gt;&lt;li&gt;Cache-Control: no-store, no-cache, must-revalidate, max-age=0&lt;/li&gt;&lt;li&gt;Cache-Control: post-check=0, pre-check=0&lt;/li&gt;&lt;li&gt;Pragma: no-cache&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.859">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="store-passwords-unrecoverable-form" name="Store passwords in an unrecoverable form" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;span&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-family: Arial; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;To protect user passwords from accidental or deliberate exposure, the application should store cryptographic hashes of passwords instead of the actual passwords.&lt;/span&gt;&lt;/p&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Do not store actual passwords in the data storage for verification during login.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Instead, create a cryptographic hash of the password using a strong hash function that includes a work factor and a built in 'salt' value, like bcrypt or scrypt. This reduces the risk of brute-force attacks and rainbow tables, and allows flexibility to adapt the hashing function to balance security and performance. Establish some restrictions, depending on the used function:&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;The salt length must be at least 32 bits.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If bcrypt is used, the work factor must be as large as verification server performance allows, typically at least 13.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+   &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;If we use the PBKDF2, the iteration count shall be as large as verification server performance allows, and it will typically allow at least 100,000 iterations.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+  &lt;li&gt;&lt;p&gt;&lt;span style="font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;Alternatively, use a strong hash function like SHA-384 together with a unique 'salt' value for every account.&amp;nbsp; Apply multiple iterations of the hash to create the additional computational work required to mitigate brute-force attacks. The secret 'salt' value must be stored separately from the hashed passwords.&lt;/span&gt;&lt;/p&gt;&lt;/li&gt; 
+ &lt;/ul&gt;&lt;/span&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="Owasp CheatSheetSeries: Password Storage" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"/>
+          </references>
+          <standards>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.6" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.5" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.8" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="9.3.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;span&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Review the mechanism for matching credentials from the client-side to stored credentials for a user.&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt; 
+ &lt;ul&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;&lt;span&gt;Best practices dictate that the system should match a strong salted hash (SHA256 or greater and a unique hash for each account) to the one stored at the time the password was set.&lt;/span&gt;&lt;/li&gt; 
+   &lt;li&gt;For example, it is recommended to use a system salt of 32 bits or more, a keyed HMAC hash using &lt;span style="font-family: Arial; font-size: 11pt; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt;SHA-2 or SHA-3,&lt;/span&gt;&lt;span style="font-family: Arial; font-size: 11pt; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;"&gt; and the stretching algorithm PBKDF2 with at least 10,000 iterations.&lt;/span&gt;&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/ul&gt; 
+ &lt;ol&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not a clear-text password&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm the stored credential is not an encrypted password which may be recovered (decrypted) at the server- or client- side.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hashing algorithm in use is cryptographically secure (e.g. is not SHA1/MD5 or a flawed algorithm).&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Confirm that the hash is created from the password together with a unique salt value for the user. This prevents the use of rainbow tables, or the identification of password collisions among users.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+  &lt;li&gt;&lt;span&gt;&lt;span style="font-size: 11pt; white-space: pre-wrap; font-family: Arial;"&gt;Consider using an algorithm with a configurable work factor, set to a high value to inhibit attacks.&lt;/span&gt;&lt;/span&gt;&lt;/li&gt; 
+ &lt;/ol&gt;&lt;/span&gt; 
+&lt;span&gt;&lt;/span&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:55.110">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-IMPLEMENT-LOGOUT" name="The logout function should be prominently visible to the user" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Developers must create a logout functionality that is clearly visible for the user when navigating the application.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check if the logout functionality is accessible and how hard it is to disconnect from the application.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-SIGN-REQUESTS" name="Use of digital signatures to make it easier for the receiver to authenticate if the sender is really the person they think they are" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Making use of digital signatures on exchanged messages will make it more difficult for man-in-the-middle attacks to occur, so add a digital signature to your important messages if you want to verify the sender identity.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Top Ten Proactive Controls 2018 - C6: Implement Digital Identity" url="https://owasp.org/www-project-proactive-controls/v3/en/c6-digital-identity"/>
+            <reference name="RFC7515" url="https://tools.ietf.org/html/rfc7515"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Review code application and configuration&lt;/li&gt;&lt;li&gt;Check the exchanged messages and verify if signature is being used.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-ONE-TIME-PASSWORD" name="Use one-time passwords" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Use One Time Password (TOTP) codes. This can be achieved with:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Hardware&lt;/li&gt;&lt;li&gt;Software (cheaper option).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Software option would typically involve the user installing a TOTP application on their mobile phone, and then scanning a QR code provided by the web application which provides the initial seed. The authenticator app then generates a six digit number every 30 or 60 seconds.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Multi-Factor Authentication Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Try logging into the application several times:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Do you use the same password all the time?&lt;/li&gt;&lt;li&gt;Or do you use a different password each time?&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.038">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="C-RANDOM-SESSION-KEYS" name="Use random-session session keys, which are time-specific and will change with time making it difficult for an attacker to fool the receiver with an old message" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID must be unpredictable (random enough) to prevent guessing attacks, where an attacker is able to guess or predict the ID of a valid session through statistical analysis techniques. For this purpose, a good Cryptographically Secure Pseudorandom Number Generator must be used.&lt;/p&gt;&lt;p&gt;Additionally, a random session ID is not enough; it must also be unique to avoid duplicated IDs. A random session ID must not already exist in the current session ID space.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Session Management Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Log in and log out, while saving the session IDs and check:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The session id is different in every log in to the application?&lt;/li&gt;&lt;li&gt;Is it predictable? For example, one session ID is 123ABC&lt;strong&gt;D&lt;/strong&gt; and the next 123ABC&lt;strong&gt;E&lt;/strong&gt; (the example contains a short key to understanding).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To perform these checks it is possible to use DevTools from the browser or an easier way using a proxy to logall requests.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.362">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RFC6819-5.1.5.3" name="Use short expiration time" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>A short expiration time for tokens is a means of protection against
+   the following threats:&amp;nbsp;  
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;replay&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;token leak (a short expiration time will reduce impact)&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;online guessing (a short expiration time will reduce the
+      likelihood of success)&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;
+Note: Short token duration requires more precise clock synchronization between the authorization server and resource server. Furthermore, shorter duration may require more token refreshes (access token) or repeated end-user authorization processes (authorization "code" and refresh token).</desc>
+          <implementations/>
+          <references>
+            <reference name="RFC6819" url="https://tools.ietf.org/html/rfc6819"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the token expiration time in the authorization server policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:54.038">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="FILE-DATA-CHECK" name="Validate the file format before processing" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Attackers may attempt to bypass controls on uploaded content by renaming, embedding, or otherwise manipulating benign files with malicious content. As with client-side data, the application should screen uploaded content before processing it.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;File contents and file-system path data must be checked for safety.&lt;/li&gt;&lt;li&gt;Consider directory traversal, local file inclusion, and OS injection attacks when validating filenames.&lt;/li&gt;&lt;li&gt;Verify the MIME type is correct and appropriate, and matches content.&lt;/li&gt;&lt;li&gt;Files with an structured format should be checked against the expected format/definition (e.g. XML against a XSD or DTD).&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: XXE" url="https://pwning.owasp-juice.shop/part2/xxe.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A4:2017-XML External Entities (XXE)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify structured data being processed by your component which is coming from untrusted sources.&lt;/li&gt;&lt;li&gt;Check there is a validation method for the format and the structure.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Examples of this is to check JSON against a JSON schema, XML against an XSD or a DTD, or checking that a received file which is purported to be an image is actually an image.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.038">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAML-2.0-SC-C-6.4.3" name="Verify SAML assertion signatures and authenticate the issuer" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="IR-Functional-Components" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  The browser/POST profile requires the SAML response carrying SAML assertions to be signed, thus providing both message integrity and authentication. The Service Provider site MUST verify the signature and authenticate the issuer. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   The following recommendations were proposed in response: 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Always perform schema validation on the XML document prior to using it for any security--related purposes:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Always use local, trusted copies of schemas for validation.&lt;/li&gt; 
+    &lt;li&gt;Never allow automatic download of schemas from third party locations.&lt;/li&gt; 
+    &lt;li&gt;If possible, inspect schemas and perform schema hardening, to disable possible wildcard -type or relaxed processing statements.&lt;/li&gt; 
+   &lt;/ul&gt; 
+   &lt;li&gt;Securely validate the digital signature:&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;If you expect only one signing key, use StaticKeySelector. Obtain the key directly from the identity provider, store it in local file and ignore any KeyInfo elements in the document.&lt;/li&gt; 
+    &lt;li&gt;If you expect more than one signing key, use X509KeySelector (the JKS variant). Obtain these keys directly form the identity providers, store them in local JKS and ignore any KeyInfo elements in the document.&lt;/li&gt; 
+    &lt;li&gt;If you expect a heterogeneous signed documents (many certificates from many identity providers, multi-level validation paths), implement full trust establishment model based on PKIX and trusted root certificates.&lt;/li&gt; 
+   &lt;/ul&gt; 
+   &lt;li&gt;Avoid signature-wrapping attacks.&lt;/li&gt; 
+   &lt;ul&gt; 
+    &lt;li&gt;Never use getElementsByTagName to select security related elements in an XML document without prior validation.&lt;/li&gt; 
+    &lt;li&gt;Always use absolute XPath expressions to select elements, unless a hardened schema is used for validation.&lt;/li&gt; 
+   &lt;/ul&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Assertions and Protocols for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"/>
+            <reference name="OWASP SAML Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md"/>
+            <reference name="Profiles for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf"/>
+            <reference name="Security and Privacy Considerations for SAML 2.0" url="https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:54.363">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="IR-Functional-Components">
+          <threats>
+            <threat ref="CAPEC-37-CRACK-PASSWORD-HASH" name="A malicious user has access to the users' password hashes and tries to crack the passwords" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Although it is not possible to "decrypt" password hashes to obtain the original passwords, it is possible to "crack" the hashes in some circumstances.&lt;/p&gt;&lt;p&gt;The basic steps are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Select a password you think the victim has chosen (e.g.password1!).&lt;/li&gt;&lt;li&gt;Calculate the hash.&lt;/li&gt;&lt;li&gt;Compare the hash you calculated with the hash of the victim. If they match, you have correctly "cracked" the hash and now know the plaintext value of their password.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This process is repeated for a large number of potential passwords. Different methods can be used to select candidate passwords, including:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Lists of passwords obtained from other compromised sites.&lt;/li&gt;&lt;li&gt;Brute force (trying every possible candidate).&lt;/li&gt;&lt;li&gt;Dictionaries or wordlists of common passwords&lt;/li&gt;&lt;/ul&gt;</desc>
+              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="store-passwords-unrecoverable-form" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-600-SESSION-REUSE" name="An attacker can reuse old session credentials or session IDs for authorization" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;At his town's public library, John logs onto his bank's Web site to transfer money from his checking account to his savings account. Once John completes his transaction he gets distracted, forgets to sign off from his bank's Web site, and walks away from the computer.&amp;nbsp;&lt;/p&gt;&lt;p&gt;A second user, Malcolm, now uses the same computer as John. Instead of using the browser to navigate to a new site, Malcolm simply explores the browser history to return to the previous URL where John's account information was displayed.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Because John's session is still active Malcolm can now transfer money, open new accounts, order additional credit cards, or perform any other actions available to John via the bank's Web site.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-IMPLEMENT-LOGOUT" mitigation="50"/>
+                <countermeasure ref="C-TOKEN-TIMEOUT" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-112-OTP-GENERATION-ABUSE" name="An attacker can send a lot of OTP requests to increase the likelihood of matching one of the generated codes in a later brute force attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;For example, in a password reset functionality based on the delivery of a code by email or SMS to the user, an attacker can send a lot of requests to it, generating a lot of valid codes with the goal of increasing the chances of matching the code in a brute force attack. The attack takes place in the following steps:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Automation of requests to the password reset functionality (new codes don't invalidate older ones).&lt;/li&gt;&lt;li&gt;Creation of a custom dictionary to try to match valid codes (e.g.: if a code has only 5 numbers, the dictionary is as follows: [00000, 00001,..., 99999]).&lt;/li&gt;&lt;li&gt;Brute force attack on the functionality to check the OTP and find a match.&lt;/li&gt;&lt;li&gt;Once the attacker knows a valid code he/she can proceed with the password change.&lt;/li&gt;&lt;/ol&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-OTP-BRUTE-FORCE" mitigation="50"/>
+                <countermeasure ref="C-OTP-INVALID" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-593-SSO-SYNC" name="Attackers are able to keep their application session active after the SSO/IdP blocks/deletes their account" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;If a user successfully logs in via SSO and falls prey to a phishing attack, the attacker gets access to all the endpoints of the external applications within the cloud that the user is provisioned for.&lt;/p&gt;&lt;p&gt;If the attack is detected, the user account can be disabled. However, the user may still remain logged in. This could allow the attacker to stay logged on with access to the linked application.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-FORCE-LOGOUT" mitigation="50"/>
+                <countermeasure ref="security-logging" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-49-BRUTE-FORCE-AUTH" name="Attackers can brute force the authentication system to find valid credentials" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Hackers launch brute-force attacks using widely available tools that utilize wordlists and smart rulesets to intelligently and automatically guess user passwords. Although such attacks are easy to detect, they are not so easy to prevent.&lt;/p&gt;&lt;p&gt;For example, many HTTP brute-force tools can relay requests through a list of open proxy servers. Since each request appears to come from a different IP address, you cannot block these attacks simply by blocking the IP address. To further complicate things, some tools try a different username and password on each attempt, so you cannot lock out a single account for failed password attempts.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.1" mitigation="16"/>
+                <countermeasure ref="C-ACCOUNT-LOCKDOWN" mitigation="16"/>
+                <countermeasure ref="CWE-654" mitigation="16"/>
+                <countermeasure ref="network-rate-limit" mitigation="20"/>
+                <countermeasure ref="require-use-strong-passwords" mitigation="16"/>
+                <countermeasure ref="security-logging" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115-LOGIN-BYPASS" name="Attackers can bypass the login system using a less hardened alternative for accessing the system" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;The basic way to take advantage of the application's access control flaws is called "forced browsing".&lt;/p&gt;&lt;p&gt;Let's say that the website http://mysite.com It is a website that supports the authenticity of the user and the administrator will be taken to the appropriate webpage after validation. But if an attacker knows the URL, he or she can enter it in their browser, for example&lt;/p&gt;&lt;p&gt;http://mysite.com/admin_page or http://mysite.com/user_page&lt;/p&gt;&lt;p&gt;If it is a secure website, it will be redirected to the login page. But if those pages are allowed to be accessed, it will be incomplete access control and will cause damage.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ACCESS-CONTROL-CENTRALIZED" mitigation="20"/>
+                <countermeasure ref="C-AUTHZ-AFTER-AUTHN" mitigation="20"/>
+                <countermeasure ref="CWE-603" mitigation="20"/>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="20"/>
+                <countermeasure ref="security-logging" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-575-ENUM-USERS" name="Attackers can enumerate the existence of valid accounts in the system using error/informational messages" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;If your login page has different error messages for unrecognized usernames and incorrect passwords, an attacker can write a script to submit lengthy lists of common usernames and test the response. With those results, the attacker can then infer which usernames are valid.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.1" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="security-logging" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130-DOS-AUTH" name="Attackers can execute Denial of Service attacks to prevent valid users from accessing the system" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An attacker leverages the security functionality of the system aimed at thwarting potential attacks (like automatic block of accounts after a number of failed login attempts) to launch a denial of service attack against a legitimate system user.&lt;/p&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.1" mitigation="25"/>
+                <countermeasure ref="C-THREAD-CONCURRENCY" mitigation="25"/>
+                <countermeasure ref="network-rate-limit" mitigation="25"/>
+                <countermeasure ref="security-logging" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-180-SAML-SPOOFING" name="Attackers can modify the SAML response from the Identify Provider and change assertions' values to impersonate valid users in the Service Provider" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Sometimes not only does the Service Provider fail to check the validity of the signature in the SAML response, but it doesn't even verify its mere presence. The equivalent of a Service Provider accepting unsigned SAML assertions is accepting a username without checking the password.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-SAML-VERIFY-IDP-X509" mitigation="50"/>
+                <countermeasure ref="SAML-2.0-SC-C-6.4.3" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-INJECTION" name="Attackers gain unauthorized access to data and/or systems through Injection attacks" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Some of the most common types of injection attacks are SQL injections, cross-site scripting (XSS), code injection, OS command injection, host header injection, and more. A large part of vulnerabilities that exist in web applications can be classified as injection vulnerabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Scenario #1: An application uses untrusted data in the construction of the following vulnerable SQL call:&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;String query = "SELECT * FROM accounts WHERE custID='' request.getParameter("id") + '';&lt;/p&gt;&lt;/blockquote&gt;&lt;ul&gt;&lt;li&gt;Scenario #2: Similarly, an application's blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)):&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;&lt;p&gt;Query HQLQuery = session.createQuery("FROM accounts WHERE custID=' '+ request.getParameter("id") + "'");&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In both cases, the attacker modifies the 'id' parameter value in their browser to send: ' or '1'='1. For example:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;http://example.com/app/accountView?id=''or '1'='1&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data, or even invoke stored procedures.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="20"/>
+                <countermeasure ref="DATA-VAL" mitigation="20"/>
+                <countermeasure ref="FILE-DATA-CHECK" mitigation="20"/>
+                <countermeasure ref="SER-UNTRUST" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-600-CRED-STUFFING" name="Attackers take control of another user's account without being detected if they get to know the password for that account" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Credential stuffing is the automated injection of stolen username and password pairs ("credentials") in to website login forms, in order to fraudulently gain access to user accounts.&lt;/p&gt;&lt;p&gt;Since many users will re-use the same password and username/email, when those credentials are exposed (by a database breach or phishing attack, for example) submitting those sets of stolen credentials into dozens or hundreds of other sites can allow an attacker to compromise those accounts too.&lt;/p&gt;&lt;p&gt;Credential Stuffing is a subset of the brute force attack category. Brute forcing will attempt to try multiple passwords against one or multiple accounts; guessing a password, in other words. Credential Stuffing typically refers to specifically using known (breached) username / password pairs against other websites.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="25" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-IMPLEMENT-SSO" mitigation="20"/>
+                <countermeasure ref="C-NEW-LOCATION-LOGIN-ALERT" mitigation="20"/>
+                <countermeasure ref="C-PREVENT-SIMULTANEOUS-LOGIN" mitigation="20"/>
+                <countermeasure ref="CWE-654" mitigation="20"/>
+                <countermeasure ref="security-logging" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-60-MALICIOUS-REPLY" name="Attackers use replay attacks to execute malicious actions" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;A replay attack is a kind of man-in-the-middle attack in which an attacker sniffs messages being sent on a channel to intercept them and resend them under the cloak of authentic messages. What makes the replay attack particularly harmful is that the attacker does not even need to decrypt the message they resend but can still fool the receiver into thinking that the received message is legitimate.&lt;/p&gt;&lt;p&gt;One example of replay attack is called pass the hash. This is referring to the hash value that is associated with a password that is sent across the network during the authentication process. If the attacker can gain access to the hash, they may be able to replay that hash back to the server and pretend that they are the original workstation.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-ONE-TIME-PASSWORD" mitigation="20"/>
+                <countermeasure ref="C-RANDOM-SESSION-KEYS" mitigation="20"/>
+                <countermeasure ref="C-SET-TIMESTAMP-ON-REQUEST" mitigation="20"/>
+                <countermeasure ref="C-SIGN-REQUESTS" mitigation="20"/>
+                <countermeasure ref="RFC6819-5.1.5.3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-37-CACHED-DATA" name="Sensitive data is compromised by inspecting cached data in the client side" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;An attacker can also use a decompiler to decompile a downloaded Java applet in order to look for information such as hardcoded IP addresses, file paths, passwords or other such contents.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="CWE-524" mitigation="50"/>
+                <countermeasure ref="CWE-525-CACHING" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-37-SENSITIVE-DATA-URL" name="Sensitive data is compromised through query parameters in the URL" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;Regardless of using encryption, the following URL will expose information in the locations detailed below:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;https://vulnerablehost.com/authuser?user=bob&amp;amp;authz_token=1234&amp;amp;expire=1500000000&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The parameter values for user, authz_token, and expire will be exposed in the following locations when using HTTP or HTTPS:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Referer Header&lt;/li&gt;&lt;li&gt;Web Logs&lt;/li&gt;&lt;li&gt;Shared Systems&lt;/li&gt;&lt;li&gt;Browser History&lt;/li&gt;&lt;li&gt;Browser Cache&lt;/li&gt;&lt;li&gt;Shoulder Surfing&lt;/li&gt;&lt;/ul&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="CWE-598" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-61-SESSION-FIXATION" name="The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="IR-Functional-Components" editable="true">
+              <desc>&lt;p&gt;The attack consists of obtaining a valid session ID (e.g. by connecting to the application), inducing a user to authenticate himself with that session ID, and then hijacking the user-validated session by the knowledge of the used session ID. The attacker has to provide a legitimate Web application session ID and try to make the victim's browser use it. There are several techniques to execute the attack; it depends on how the Web application deals with session tokens. Below are some of the most common techniques:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Session token in the URL argument.&lt;/li&gt;&lt;li&gt;Session token in a hidden form field.&lt;/li&gt;&lt;li&gt;Session ID in a cookie.&lt;/li&gt;&lt;li&gt;Client-side script.&lt;/li&gt;&lt;/ul&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses/>
+              <countermeasures>
+                <countermeasure ref="C-SESSION-ID-ON-PARAMETER" mitigation="50"/>
+                <countermeasure ref="secure-session-generation-and-expiration" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="fc222786-f608-4e45-a224-5b3906f57c3c" diagramComponentId="69a11068-97c5-443a-9f2f-3d27bf8ddac9" ref="c31bf547-b418-44fb-8d64-f592cbea254d" name="API gateway" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="api-gateway-microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="AG-LM-1" name="Framework complexities may make logging and monitoring difficult to use" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are many objects in a microservice which generate logs, and the capabilities of each may be very different.&amp;nbsp; This can result in a large body of disparate information, which makes it difficult to track and use effectively. In addition to routine logging features, to detect attacks and identify factors for degradation of services which may impact availability&amp;nbsp;it is necessary to monitor network traffic into and out of microservices.&amp;nbsp; The monitoring service should include analytics capabilities.&amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.778">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AG-AA-1" name="Misconfiguration with enterprise-wide authentication and authorization frameworks" state="0" impact="100" issueId="" issueLink="">
+          <desc>Microservices generally communicate with each other using Application Programming Interfaces (APIs), which requires several core features to support complex interactions between a substantial number of components.&amp;nbsp; Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners.&amp;nbsp; This creates a security challenge as it can be difficult ensure that all entry points are configured to the same robust settings despite their differing capabilities for doing so.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To address the challenges of authorizing of such a complex array of interfaces and services, API gateways offer a single entry point to a system.&amp;nbsp; However, while this simplifies things from the standpoint of external user access, the API Gateway will still need to effectively authenticate itself with the internal objects of the cluster.&amp;nbsp; There are a number of areas of potential weakness which must be supported to maintain the overall security of the cluster. 
+&lt;/div&gt;Access tokens are a significant security measure in all systems and the internal objects of microservices should be created to use them where possible.&amp;nbsp; Integrating these successfully with API gateways can be a challenge. Distributed gateway deployments add yet more complexity as they provide an even wider variety of services and objects which must be integrated.&amp;nbsp; If authorization cannot be resolved consistently across distributed gateways, this will open up vulnerabilities which may be exploited by adversaries. Identity management is a strongly suggested strategy for configuring authentication and authorization.&amp;nbsp; It allows fine grained control of systems by allowing administrators to control which activities are authorized based on user identity and role.&amp;nbsp; API gateways must integrate with internal IAM policies as settings mismatches can result in users acting beyond their scope.&amp;nbsp; &amp;nbsp;&amp;nbsp;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.777">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(2)" name="Connectors should be provided for integrating with identity providers (IdPs)" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>When invoking IAM through an API gateway, it is essential to integrate with the identity providers in question.&amp;nbsp; This ensures that policies are robust and effective, and that changes are applied consistently from the IAM service to the gateway.&amp;nbsp; This is essential for maintaining security.&amp;nbsp; There are a number of tools available depending on the specific tools and requirements of the system.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.534">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(5)" name="Distributed gateway deployments should have a token translation (exchange) service between gateways" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>The token presented to the initial gateway should have permissions with a broad scope whereas the token presented to inside gateways (or microgateways) should be more narrowly scoped with specific permissions or an entirely different token type that is appropriate for the target microservice platform. This helps to implement the least privilege paradigm. This can also work for a combination of initial gateway (that intercepts all client accesses) and microgateways (closer to microservices).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(1)" name="Integrate the API gateway with an identity management application to provision credentials before activating the API" issueId="" issueLink="" platform="" cost="1" risk="45" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Identity management is such a key security component that it should be integrated at the earliest stages of implementation.&amp;nbsp; API gateways which are activated without IAM capabilities immediately leave the connected services vulnerable to exploitation.&amp;nbsp; Certain services may not work at all if IAM credentials are not provided.&amp;nbsp; The complexity of microservice architectures also makes it more difficult to add these capabilities after the fact.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:13:09.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(4)" name="Securely channel all traffic information to a monitoring and/or analytics application" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>This is essential both for detecting attacks (e.g., denial of service, malicious actions) and unearthing explanations for degrading performance.&amp;nbsp; Implementation will depend on the individual API gateway in use.&amp;nbsp;&amp;nbsp;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="NIST-SMAS-MS-SS-12(3)" name="The API gateway should have a connector to an artifact that can generate an access token for the client request" issueId="" issueLink="" platform="" cost="1" risk="45" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Access token are, and should be, used widely in microservices.&amp;nbsp; They provide credentials for authorization and can be used to specify the scope that was granted during authorization.&amp;nbsp; If the API gateway cannot also access these tokens then they cannot be used to authorize any users who enter through the gateway.&amp;nbsp; An artifact should exist which provides the gateway with tokens which will be accepted by internal system objects, and which provide the same level of access control (e.g., OAuth 2.0 Authorization Server).</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="MS-SS-12" supportedStandardRef="NIST-Secure-Microservice-Strategies"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Implementation will depend on the individual API gateway in use.&amp;nbsp; Please follow the instructions in the documentation and apply according to the needs of your architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:13:09.537">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(1)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(2)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(3)" mitigation="25"/>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(5)" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="AG-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="NIST-SMAS-MS-SS-12(4)" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="f45db819-cb21-44a4-b104-ce48b698c7eb" diagramComponentId="f698373b-fff9-4b4d-b2bc-73057c7ba804" ref="0dd85c2b-afa1-409c-b6ff-39941d67abf8" name="svc-biz-sed-service-invoke" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.844">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.843">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.171">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.440">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.170">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.382">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.726">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.086">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.727">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.727">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.727">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.728">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:43.728">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:44.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:43.728">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:44.383">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="1c358fa5-3231-4311-bba9-f096b40a6fd5" diagramComponentId="c5e47650-fb9e-49cb-b085-390017bf57c1" ref="54c2adc5-954b-49bd-9f1c-295b16a74473" name="RESTful Web Service" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="rest-full-web-service">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.665">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.663">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The API is vulnerable to injection flaws if:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
+  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.665">
+              <output/>
+            </source>
+            <references>
+              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
+              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
+              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
+              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-770" name="Allocation of Resources Without Limits or Throttling" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-319" name="Cleartext Transmission of Sensitive Information" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
+
+Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.  </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-502" name="Deserialization of Untrusted Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The application deserializes untrusted data without sufficiently verifying that the resulting
+                        data will be valid.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-502: Deserialization of Untrusted Data" url="https://cwe.mitre.org/data/definitions/502.html"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-15" name="External Control of System or Configuration Setting" state="0" impact="100" issueId="" issueLink="">
+          <desc>One or more system settings or configuration elements can be externally controlled by a user.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.172">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.582">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.666">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-460" name="Improper Cleanup on Thrown Exception" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.686">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-116" name="Improper Encoding or Escaping of Output" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.173">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-841" name="Improper Enforcement of Behavioral Workflow" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software supports a session in which more than one behavior
+                        must be performed by an actor, but it does not properly ensure that the actor
+                        performs the behaviors in the required sequence.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.688">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.523">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-95" name="Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-117" name="Improper Output Neutralization for Logs" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes
+                        output that is written to logs.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.588">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.525">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-276" name="Incorrect Default Permissions" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.685">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.527">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.527">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-532" name="Information Exposure Through Log Files" state="0" impact="100" issueId="" issueLink="">
+          <desc>Information written to log files can be of a sensitive nature
+                        and give valuable guidance to an attacker or expose sensitive user
+                        information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.584">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-778" name="Insufficient Logging" state="0" impact="100" issueId="" issueLink="">
+          <desc>When a critical security event occurs, the software either does not record the event or omits important details about the event when logging it. When critical security events are not logged properly, such as in the case of a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analyses after a successful attack.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.583">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
+          <desc>Product A handles inputs or steps differently than Product B,
+          which causes A to perform incorrect actions based on its perception of B's
+          state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.666">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.666">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:25.519">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-272" name="Least Privilege Violation" state="0" impact="100" issueId="" issueLink="">
+          <desc>The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.687">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-779" name="Logging of Excessive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software logs too much information, making log files hard
+                        to process and possibly hindering recovery efforts or forensic analysis after an
+                        attack.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.583">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-350" name="Reliance on Reverse DNS Resolution for a Security-Critical Action" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-918" name="Server-Side Request Forgery (SSRF)" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.174">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DOS-APP" name="The application exposes high resource consuming functions without any protection (Layer 7 attacks)" state="0" impact="100" issueId="" issueLink="">
+          <desc>A highly resource consuming function could be exploited by an attacker to bring the service down.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-203" name="The product exposes security-relevant information about the state of the product" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:30.093">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-541" name="The service returns back-end source code without interpreting it" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If an include file source is accessible, the file may contain usernames and passwords, as well as sensitive information pertaining to the application and system. The source code can also be sent back to a client because of an error condition or an improperly configured handler.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.686">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-541: Information Exposure Through Include Source Code" url="https://cwe.mitre.org/data/definitions/541.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L3" name="There is no network protection to protect against Layer 3" state="0" impact="100" issueId="" issueLink="">
+          <desc>There are no measures in place to mitigate (D)DoS at a network level.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-L4" name="There is no network protection to protect against Layer 4" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="AV-DoS-TLS" name="There is no protection against Layer 6 attacks (SSL/TLS)" state="0" impact="100" issueId="" issueLink="">
+          <desc/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.802">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.526">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.525">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="dyn-exec" name="Assure that the application avoids the use of eval() or other dynamic code execution features" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Assure that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Look for scripts that do not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.&lt;/p&gt;&lt;p&gt;Note 1: This attack will execute the code with the same permissions, potentially including operation system commands.&lt;/p&gt;&lt;p&gt;Note 2: Eval injection is prevalent in handler/dispatch procedures that want to invoke a large number of functions, or set a large number of variables.&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.920">
+              <output/>
+            </source>
+            <references>
+              <reference name="Direct Dynamic Code Evaluation (Eval Injection)" url="https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval%20Injection"/>
+              <reference name="[SCRIPT_ENGINE_INJECTION] Potential code injection when using Script Engine" url="https://find-sec-bugs.github.io/bugs.htm"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="deny-default-enf" name="Assure that the principle of deny by default exists for new users/roles" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Deny by default is the principle whereby if a request is not specifically allowed, it is denied. There are many ways this rule will manifest in application code. Some examples of this are:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure the principle of deny by default exists whereby new users/roles start with minimal or no permissions and users/roles do not receive access to new features until access is explicitly assigned.&lt;/li&gt;&lt;li&gt;Application code may throw an error or exception while processing access control requests. In these cases access control should always be denied.&lt;/li&gt;&lt;li&gt;When an administrator creates a new user or a user registers for a new account, that account should have minimal or no access by default until that access is configured.&lt;/li&gt;&lt;li&gt;When a new feature is added to an application all users should be denied use of that feature until it's properly configured.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C7]: Enforce Access Controls" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c7-enforce-access-controls.html"/>
+          </references>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;strong&gt;Testing for role/privilege manipulation&lt;/strong&gt;&amp;nbsp;&lt;br&gt;In every portion of the application in which a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.090">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)" url="https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"/>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.104">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c2" name="Choose the correct set of headers according to resource type" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The post-spectre-web-dev-c1 countermeasure establishes a default set of headers but depending on the resource type the headers may vary. Identify the type of resource the web service is serving and apply the following recommendations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources: contain the same data no matter who requests them&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Timing-Allow-Origin: *&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1 ("Vary" can be omitted)&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources: contain data personalized to a given user&lt;ul&gt;&lt;li&gt;Application-internal resources: private API endpoints, avatar images, uploaded data, etc.&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources intended for cross-origin use: public API endpoints, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Credentials: true&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Origin: &lt;/strong&gt;&lt;a href="https://trusted.example/"&gt;&lt;strong&gt;https://trusted.example&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Methods: POST&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-Headers: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Access-Control-Allow-...: ...&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Personalized resources that are intended for cross-origin no-cors embedding, but which don't intend to be directly legible in that context: avatar images, authenticated media, etc&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: cross-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Headers from post-spectre-web-dev-c1&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents&lt;ul&gt;&lt;li&gt;Fully-isolated documents: documents that require users to be signed-in&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting to Open Cross-Origin Windows:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: same-origin-allow-popups&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents Expecting Cross-Origin Openers: e.g. federated sign-in forms and payment providers&lt;ul&gt;&lt;li&gt;Documents that only wish to be opened in cross-origin popups:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: SAMEORIGIN&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that only wish to be framed in cross-origin contexts&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Cross-Origin-Opener-Policy: same-origin&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Documents that support both popup and framing scenarios:&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Resource-Policy: same-origin&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Cross-Origin-Opener-Policy: unsafe-none&lt;/strong&gt;&lt;/li&gt;&lt;li&gt;Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site&lt;/li&gt;&lt;li&gt;X-Content-Type-Options: nosniff&lt;/li&gt;&lt;li&gt;&lt;strong&gt;X-Frame-Options: ALLOWALL&lt;/strong&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The Post-Spectre Web Development guide specifies some external endpoints that implement these headers that can be used as examples:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"&gt;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"&gt;https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"&gt;https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://ssl.google-analytics.com/ga.js"&gt;https://ssl.google-analytics.com/ga.js&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Dynamic subresources&lt;ul&gt;&lt;li&gt;&lt;a href="https://api.twitter.com/1.1/jot/client_event.json"&gt;https://api.twitter.com/1.1/jot/client_event.json&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://play.google.com/log?format=json&amp;amp;hasfast=true"&gt;https://play.google.com/log?format=json&amp;amp;hasfast=true&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://securepubads.g.doubleclick.net/pcs/view"&gt;https://securepubads.g.doubleclick.net/pcs/view&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="https://c.amazon-adsystem.com/e/dtb/bid"&gt;https://c.amazon-adsystem.com/e/dtb/bid&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Just open the browser's developer tools to check the responses to see the headers.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.995">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC" name="Detect and notify the usage of automated tools or unusual behavior" issueId="" issueLink="" platform="" cost="0" risk="19" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Don't allow users to manipulate a system or guess its behavior based on input or output timing and detect the usage of automated tools or unusual behavior, such as actions not performed in reasonable "human time" or other abnormal time patterns.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;When the usage of automated tools is detected, the application should respond by denying access and notifying the security group.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Use several automated tools to perform normal user actions.&lt;/li&gt;
+                            &lt;li&gt;Check that the applications detects these actions, denies the users access and
+                            notifies the security group.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.088">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="protection-against-data-mining" name="Detect and protect against data mining techniques" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.&lt;/p&gt;&lt;p&gt;Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.&lt;/p&gt;&lt;p&gt;EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-53" url="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf"/>
+          </references>
+          <standards>
+            <standard ref="AC-23" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Ensure that your system supports policies that protect against data mining such as filtering, throttling and anomaly detection.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.093">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-RETENTION" name="Develop a log retention policy" issueId="" issueLink="" platform="" cost="0" risk="16" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Develop a log retention policy to identify storage requirements for device logs and implement
+                        procedures to ensure that the audit logs are available for a security response in the case of
+                        incident or investigation.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        The audit logs from the last 30 days must be collected in easily accessible storage media. Older
+                        logs should be archived in a protected storage and should be accessible in the future as
+                        required for incidents or investigations.
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+          </references>
+          <standards>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application contains logs from the last 30 days.&lt;/li&gt;
+                            &lt;li&gt;Check that logs older than 30 days are in an external storage.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.965">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-FILE-DATA" name="Do not use untrusted client-side data in server-side file operations" issueId="" issueLink="" platform="" cost="0" risk="34" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application may be required to perform server-side file operations based on client-side actions. This can expose the application to attack through remote or local file-inclusion, or remote code execution attacks if unsafe data is used in file inclusion, class loader, or reflection capabilities.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Tainted, untrusted, client-side data must not be used directly in server-side file load operations.&lt;/li&gt;&lt;li&gt;Where server-side operations are dependent on client-side input, this should be mapped to pre-defined operations on the server-side rather than using tainted client-side input directly.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify sources of data entering the application.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Classify them into trusted and untrusted.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;if they are untrusted, make sure there is a validation and sanitization mechanism before sending this data into another system (Database, Command, etc.).&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.921">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-532" name="Do not write secrets to the log files" issueId="" issueLink="" platform="" cost="0" risk="16" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        The logs may be accessed by attackers and in order to protect sensitive data, no such sensitive
+                        data should be included in the logs
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Proactive Controls [C9, C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Review the logs.&lt;/li&gt;
+                            &lt;li&gt;Check that no sensitive data is included in the logs.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="27" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.089">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LEAST-PRIV-ENF" name="Ensure enforcement of the principle of least privilege" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;In every portion of the application where a user can create information inside the database (e.g., making a payment, adding a contact, or sending a message), or can receive information (statement of account, order details, etc.), or delete information (drop users, messages, etc.), it is necessary to record that functionality.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Try to access such functions as another user in order to verify if it is possible to access a function that should not be permitted by the user's role/privilege (but might be permitted as another user).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.090">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Privilege escalation (OTG-AUTHZ-003)" url="https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SER-UNTRUST" name="Ensure that serialization is not used when communicating with untrusted clients" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</desc>
+          <implementations/>
+          <references>
+            <reference name="Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="Deserialization of untrusted data" url="https://www.owasp.org/index.php/Deserialization_of_untrusted_data"/>
+            <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="SER03-J. Do not serialize unencrypted sensitive data" url="https://wiki.sei.cmu.edu/confluence/display/java/SER03-J.+Do+not+serialize+unencrypted+sensitive+data"/>
+          </references>
+          <standards>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify Serialization processes that involve client-server communication. They may be used in applications for:&lt;/p&gt;
+&lt;ul&gt;
+ &lt;li&gt;Remote- and inter-process communication (RPC/IPC)&lt;/li&gt;
+ &lt;li&gt;Wire protocols, web services, message brokers&lt;/li&gt;
+ &lt;li&gt;Caching/Persistence&lt;/li&gt;
+ &lt;li&gt;Databases, cache servers, file systems&lt;/li&gt;
+ &lt;li&gt;HTTP cookies, HTML form parameters, API authentication tokens&amp;nbsp;&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
+              <output/>
+            </source>
+            <references>
+              <reference name="Deserialization Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="OWASP Deserialization CheatSheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md"/>
+              <reference name="Top 10-2017 A8-Insecure Deserialization" url="https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.482">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
+              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SAME-ENCODING-STYLE" name="Ensure that the client-side and the server-side are using the same encoding style" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the client-side and the server-side are using the same encoding style.</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the server-side and the client-side are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.916">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="configuration-integrity" name="Ensure the integrity of all security-relevant configurations to detect tampering" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Web server and application server configurations play a key role in the security of a web application. These servers are responsible for serving content and invoking applications that generate content. In addition, many application servers provide a number of services that web applications can use, including data storage, directory services, mail, messaging, and more. Failure to manage the proper configuration of your servers can lead to a wide variety of security problems.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation:&lt;/b&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  Authorized administrators need to ensure the integrity of all security-relevant configurations to detect tampering.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="14.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+&lt;/div&gt;
+&lt;div&gt;
+  4.3.9 Test File Permission (OTG-CONFIG-009)&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.921">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOGS-INTEGRITY" name="Ensure the integrity of the logging system" issueId="" issueLink="" platform="" cost="0" risk="48" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure Log integrity for the application generated logs, such as storing logs on write-once
+                        media, forwarding a copy of the logs to a centralized SIEM or generating message digests for
+                        each log file.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-04 Audit Storage Capacity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/173-08_02_AU-04"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(c)(1)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SA-18" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-28" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check the logs integrity is controlled by making daily backups or leveraging external
+                            tools for log monitoring.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.967">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-8.8" name="Escape meta-characters from un-trusted data" issueId="" issueLink="" platform="" cost="0" risk="48" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;If untrusted data, including any data received from the client side of a connection, is directly written to a log file, then this data could contain newline or other meta-characters that may allow an attacker to forge log entries.&lt;/p&gt;&lt;p&gt;Such meta-characters should first be escaped or removed before the data is written to the logging system.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify the logging system in use.&lt;/li&gt;
+                            &lt;li&gt;Check whether the logging system automatically escapes meta-characters such as a
+                            newline and/or carriage return.&lt;/li&gt;
+                            &lt;li&gt;If not, then check that there is a central function that escapes these
+                            meta-characters before writing them to the log file.&lt;/li&gt;
+                            &lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.484">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.108">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="identify-dns-domains" name="Identify the DNS domains periodically to update the information about them" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should have a protection from sub-domain takeovers if the application relies upon DNS entries or DNS sub-domains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (autogen-bucket-id.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify the forward and reverse DNS lookups.&lt;/li&gt;&lt;li&gt;Verify the connection to the DNS was authenticated successfully by username/password or certificate and that they are active.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.215">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-L7" name="Identity which functions of the application are resource consuming and protect and monitor them (optionally set up a WAF)" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DoS attacks against the application layer also aim to use up the memory and process time that the application requires to function properly while minimizing the resources employed by the attacker by using vulnerabilities or flaws in the application. The main characteristics of this type of attack are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The requirement for less bandwidth compared to other methods such as SYN Flood attacks, and as such, the infrastructure necessary to launch a successful attack is usually minor.&lt;/li&gt;&lt;li&gt;Greater difficulty in distinguishing between malicious and legitimate traffic. Many of the most common protection measures or systems focus on the network or transport layer, and as such, they would not be efficient when the target of the attack is the application layer. It is even difficult for the defense systems that monitor this layer to distinguish between malicious and legitimate traffic.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;As we have indicated, this type of attack is very specific, and generally require fewer resources from the attacker to achieve devastating effects in the systems attacked. However, this type of attack requires more time to analyze the targeted system in order to discover vulnerabilities or bottlenecks that can be exploited during the attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Analyze weaknesses or bottlenecks in the design, the implementation, or even the functioning of the application to identify "heavy" requests that are resource consuming. For example, if the web application has a search engine, an attack could be to carry out searches that require a high level of resources to generate a bottleneck and eventually disable the service.&lt;/li&gt;&lt;li&gt;Implement a challenge to the device making the network request in order to test whether or not it is a bot. This is done through a test much like the CAPTCHA test commonly found when creating an account online. By giving a requirement such as a JavaScript computational challenge, many attacks can be mitigated.&lt;/li&gt;&lt;li&gt;Use of a web application firewall, managing and filtering traffic through an IP reputation database, and through on-the-fly network analysis by engineers.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Layer 7 DDoS Attacks" url="https://owasp.org/www-pdf-archive/Layer_7_DDOS.pdf"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 7 DDoS PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space. One well-known application attack is Slowloris, which targets web servers. Verify that the implemented Layer 7 protection mechanisms (Javascript challenges, CAPTCHA tests, WAF) are effective.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.672">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
+            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
+              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="implement-monitoring-unusual-activities" name="Implement and monitor Business Logic Limits for actions and transactions" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement in the application the appropriate limits for specific business actions and transactions, to enforce the correct usage of the application for each user ensuring they cannot bypass important steps in the flow. This business logic limits provide us protection against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/p&gt;&lt;p&gt;All business actions or transactions that exceed the established limits, should be recorded in the logs and monitored as unusual events.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls (C9)" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A04:2021-Insecure Design" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.&lt;/li&gt;
+   &lt;li&gt;Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.&lt;/li&gt;
+  &lt;li&gt;Verify the application monitors for unusual events or activity from a business logic perspective.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="network-rate-limit" name="Implement application and network rate limiting" issueId="" issueLink="" platform="" cost="1" risk="40" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of attacks rely on brute-force techniques to send large volumes of requests to enumerate or attempt to exploit flaws in an application, for example, sending common passwords to multiple target accounts within an application. By profiling normal traffic volumes, and applying rate limiting, the application can be built to actively mitigate such attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Connection rate-limiting based on the source IP address can be used to restrict attacks against the authentication or registration systems. Multiple failures (or attempts) from a single IP should result in temporarily blocking or dropping traffic from the source. Note however that some corporate and ISP environments may place multiple valid and discrete clients behind the same IP address, resulting in false-positives.&lt;/li&gt;&lt;li&gt;Attackers may use botnets and other IP masking techniques to deliver attacks to avoid IP based rate-limiting. To mitigate this class of attack, Indicators of Compromise should be monitored (for example a higher rate of login failures than usual), and appropriate actions taken. For example, when the application detects active brute-force attacks, a Web Application Firewall (WAF) or other intermediate devices could be used to block attacks sharing a signature from pattern matching or deep packet inspection (e.g. HTTP headers or common passwords across multiple accounts). Similarly, the application could respond by requiring a CAPTCHA, cookie, or Javascript challenge when an attack is detected.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Implement the mechanisms to lockout accounts:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;When the application detects a set number of failure login attempts, the account shall be locked for a certain time period. This period shall be increased as per each new failed attempt up to an hour as maximum.&lt;/li&gt;&lt;li&gt;When the application detects an account is locked more times than usual, this account should be disabled (no more than 100 failure attempts). A disabled account should only be restored by an administrator.&lt;/li&gt;&lt;li&gt;When the application detects active brute-force attacks, the application shall require a CAPTCHA, cookie, or JavaScript challenge before attempting authentication.&lt;/li&gt;&lt;li&gt;Only accept those authentication requests that come from a white list of IP addresses from which the user has been successfully authenticated before.&lt;/li&gt;&lt;li&gt;If the user successfully authenticates, the previous failed attempts shall be reset for that user from the same IP address.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-02 Account Management" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/24-08_02_AC-02"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OWASP Blocking Brute Force Attacks" url="https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.8.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.5" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.1.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.4.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.1.5.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="5.2.2" supportedStandardRef="nist-800-63"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API4:2019-Lack of Resources and Rate Limiting" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Use tools like &lt;a href="https://www.thc.org/thc-hydra/"&gt;THC-Hydra&lt;/a&gt;, &lt;a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"&gt;OWASP ZAP&lt;/a&gt; or &lt;a href="https://portswigger.net/burp/"&gt;Burp Suite &lt;/a&gt;to simulate brute force attacks against the login function.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Perform a simulation of the attack against the login function.&lt;/li&gt;&lt;li&gt;Verify the function is blocked for your source after n attempts.&lt;/li&gt;&lt;li&gt;Verify there is a log alerting function for an unusual amount of failed login attempts, even if they originated from different sources.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="8" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="error-handling-centralized" name="Implement centralized mechanisms to manage errors and exceptions" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Create a functionality or a mechanism to manage exceptions in a centralized manner and avoid including duplicated try/catch blocks in the code.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;A well-planned error/exception handling strategy is important for three reasons:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Good error handling does not give an attacker any information which can be leveraged for attacking the application.&lt;/li&gt;&lt;li&gt;A proper centralized error strategy is easier to maintain and reduces the chances of any uncaught errors "Bubbling up" to the front-end of an application.&lt;/li&gt;&lt;li&gt;Information leakages can lead to social engineering exploits.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Building an infrastructure for consistent error reporting proves more difficult than error handling. All exceptions should be caught as events with the severity of the error. These events will be logged.&lt;/p&gt;&lt;p&gt;The centralized system should reorganize all events and throw the corresponding error or system message in a consistent manner, depending on the severity of the error.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Code Review: Error Handling" url="https://www.owasp.org/index.php/Codereview-Error-Handling"/>
+            <reference name="OWASP Error Handling" url="https://www.owasp.org/index.php/Error_Handling"/>
+            <reference name="OWASP Proactive Controls [C10]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Verify that a centralized system is in place to catch errors and exceptions, and these errors are shown in a correct manner.&lt;/li&gt;&lt;li&gt;Verify all errors thrown from the centralized system are displayed in a correct fashion.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:29.484">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
+              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="security-logging" name="Implement Security Logging and Monitoring" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Logging is often neglected by developers when thinking of security considerations. However, proper logging practices can provide the crucial forensics needed to investigate after a breach, and perhaps more importantly, to detect security issues as they happen. Most developers are already familiar with logging for debugging and diagnostic purposes, so it should be easy for them to apply the concept of security logging.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Log all failed authentication attempts, denied access, and input validation errors.&lt;/li&gt;&lt;li&gt;Logs should be written using a format suited to be consumed by a log management solution, and include enough details to identify the malicious actor.&lt;/li&gt;&lt;li&gt;Logs need to be handled as sensitive data, and their integrity should be guaranteed at rest and transit.&lt;/li&gt;&lt;li&gt;Configure a monitoring system to continuously monitor the infrastructure, network, and the API functioning.&lt;/li&gt;&lt;li&gt;Use a Security Information and Event Management (SIEM) system to aggregate and manage logs across all components and hosts.&lt;/li&gt;&lt;li&gt;Configure custom dashboards and alerts, making it possible to detect and respond to suspicious activity as early as possible.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Logging Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"/>
+            <reference name="OWASP Proactive Controls C9: Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+            <reference name="OWASP Security Logging Project" url="https://www.owasp.org/index.php/OWASP_Security_Logging_Project"/>
+            <reference name="OWASP Top Ten Proactive Controls 2018 (C9): Implement Security Logging and Monitoring" url="https://owasp-top-10-proactive-controls-2018.readthedocs.io/en/latest/c9-implement-security-logging-monitoring.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Organizations should perform testing and validation activities periodically to confirm that the organization's logging policies, processes, and procedures are being followed properly both at the infrastructure level and the system level throughout the organization.&amp;nbsp; Log management audits can identify deficiencies in policies, procedures, technology, and training that can then be addressed.&lt;/p&gt;&lt;p&gt;The most common techniques for testing and validating logging are as follows:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Auditors or others performing testing and validation can review the logging configuration and settings, as well as the system logs, infrastructure logs, and archived logs, for a representative sampling of systems and infrastructure servers to ensure that they comply with policies and procedures.&lt;/li&gt;&lt;li&gt;Auditors (or security administrators under the direction of auditors) or others performing testing and validation can create security events on a representative sampling of systems through vulnerability scanning, penetration testing, or routine actions (e.g., logging onto a system remotely), and then ensure that the log data those activities should generate exist and are handled according to the organization's policies and procedures.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.970">
+              <output/>
+            </source>
+            <references>
+              <reference name="Guide to Computer Security Log Management" url="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-TLS" name="Inspect the TLS/SSL traffic on a capable device before sending the connection down on your infrastructure" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;TLS adds another vector for computational attacks since a client can easily (with little computational effort) force the server to expend relatively large computational work. If a web application is delivered over TLS, an attacker can also choose to attack the TLS negotiation process. TLS is computationally expensive so an attacker can reduce a server's availability by sending unintelligible data. In a variation of this attack, an attacker completes the TLS handshake but perpetually renegotiates the encryption method. Or an attacker can attempt to exhaust server resources by opening and closing many TLS sessions.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;To mitigate consider options like offloading the SSL from the origin infrastructure and inspecting the application traffic for signs of attack traffic or violations of policy at an application delivery platform (ADP).&lt;br&gt;A good ADP will also ensure that your traffic is then re-encrypted and forwarded back to the origin infrastructure with unencrypted content only ever residing in protected memory on a secure bastion host.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 6 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt;. It covers all the required tests for TLS &amp;amp; SSL assessments and is regularly updated.&lt;/p&gt;&lt;p&gt;There are many testing options that can be used with &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; and the options you should use will depend greatly on your testing requirements. Below are some useful examples, for an overview of &lt;a href="http://testssl.sh/"&gt;testssl.sh&lt;/a&gt; command-line options. run ./testssl.sh with no other options.&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to console&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST&lt;/p&gt;&lt;p&gt;Test Everything on a Single Host and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Test all hosts on a Subnet and Output to HTML&lt;br&gt;./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;&lt;p&gt;Same as above, but only enumerate each servers supported ciphers:&lt;br&gt;./testssl.sh -E 192.168.1.0/24 | aha &amp;gt; OUTPUT-FILE.html&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.485">
+              <output/>
+            </source>
+            <references>
+              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" name="Limit the number of accounts with privileges allowing modification and/or deletion of audit logs files" issueId="" issueLink="" platform="" cost="0" risk="48" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Limit the number of accounts with privileges to modify and/or delete audit logs files.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the number of accounts with privileges to modify the logs is limited and
+                            controlled.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-VAL-LOG" name="Log and reject all data validation failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Data validation failures, together with access control violations, are symptomatic of malicious activity where an attacker is attempting to subvert the protections in place. It is therefore likely that unexpected input detected by the application relates to an attack. Rejecting and logging such activity, and ideally terminating the session, increases the likelihood of detecting and inhibiting structured attacks against the application.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Log all validation failures when rejecting requests.&lt;/li&gt;
+  &lt;li&gt;Ensure logged data is appropriately sanitized and encoded to prevent attacks against the logs and subsequent access to them.&lt;/li&gt;
+  &lt;li&gt;Terminate the offending user session to inhibit further attack.&lt;/li&gt;
+  &lt;li&gt;Ensure errors returned to the client-side are generic to prevent an attacker enumerating the defenses in place or gaining knowledge about the back-end.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.5.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm all security events (and suspicious activity that may indicate a security event) are appropriately identified in the application.&lt;/li&gt;&lt;li&gt;Confirm security errors are logged with appropriate priority.&lt;/li&gt;&lt;li&gt;Any data logged relating to the event must be carefully sanitized and encoded; by definition the data could be an attack payload and could execute when the logs are viewed outside of the system.&lt;/li&gt;&lt;li&gt;Verify actual logged data.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.968">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CDS-USER-TRACK" name="Log details of user actions within the system" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;To maintain proper accountability, logs should be maintained with sufficient
+                        information to track user actions within the system. These logs should be forensically sound,
+                        non-repudiable, and contain comprehensive details about activity. While the exact data for an
+                        event may vary, the following should be captured at a minimum:&lt;/p&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Timestamps against a proven external source (e.g. an NTP server).&lt;/li&gt;
+                        &lt;li&gt;Origin (with this field we mark if the logs are provided by a trusted or untrusted
+                        source).&lt;/li&gt;
+                        &lt;li&gt;Event, status, and/or&amp;nbsp;error codes (with sensitive data masked as appropriate
+                        or not introduced in logs).&lt;/li&gt;
+                        &lt;li&gt;Service, command, application or function name and details.&lt;/li&gt;
+                        &lt;li&gt;User or system account associated with an event.&lt;/li&gt;
+                        &lt;li&gt;Devices used (e.g. source and destination IPs, terminal session ID, web browser, etc.).&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;div&gt;
+                        Source:&amp;nbsp;&amp;nbsp;
+                        &lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt;https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;
+                        &lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Berkeley audit logging" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-07 Unsuccessful Login Attempts" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/29-08_02_AC-07"/>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+            <reference name="OSA AU-03 Content Of Audit Records" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/172-08_02_AU-03"/>
+            <reference name="OSA AU-10 Non-Repudiation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/179-08_02_AU-10"/>
+            <reference name="OSA CA-07 Continuous Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/166-08_02_CA-07"/>
+            <reference name="OSA IR-05 Incident Monitoring" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/139-08_02_IR-05"/>
+            <reference name="OSA SI-05 Security Alerts And Advisories" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/43-08_02_SI-05"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C7, C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.4.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="164.312(a)(1)(A)" supportedStandardRef="hipaa-required"/>
+            <standard ref="164.312(b)" supportedStandardRef="hipaa-required"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="4.10" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-10" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-7" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-2" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="IR-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-4" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-5" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.MI-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-5" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Perform several different actions on the service.&lt;/li&gt;&lt;li&gt;Inspect the log files to see if the format and content complies with the company policy.&lt;/li&gt;&lt;li&gt;If there is no company policy, check that at least the following data is included: timestamp event, status, error codes, service/command/application username or system account associated with an eventDevice used (e.g. source and destination IPs, terminal session ID, web browser, etc).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Source:&amp;nbsp;&lt;a href="https://security.berkeley.edu/security-audit-logging-guideline"&gt; https://security.berkeley.edu/security-audit-logging-guideline&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
+              <output/>
+            </source>
+            <references>
+              <reference name="Berkeley security: audit logs" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+              <reference name="Security Audit Logging Guideline" url="https://security.berkeley.edu/security-audit-logging-guideline"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-LOGGING" name="Logging the data access and the modification of personal data" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Make sure that every access and modification of personal data is logged (The log should be precise enough to know who changed what and when). This includes data access from the application as well as data access from privileged accounts, such as database admins. In practice, this means logging both on application, middleware and operating system (OS) level.
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="Art.5" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Test accessing and modifying user personal data as legitimate users, employees, administrators and malicious actors.&lt;/li&gt;
+                &lt;li&gt;Verify appropriate logging of all the above activities are successful and sufficiently detailed.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.970">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="LOG-TLS-FAILURES" name="Log the backend TLS connection failures" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement functionality to record backend TLS connection failures and include these in the
+                        logs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-02 Auditable Events" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/37-08_02_AU-02"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.SC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that backend TLS connection failures are recorded in the logs.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-541" name="Prevent unauthorised access to source code through the service" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to the source-code for the application can aid an attacker in determining bugs or vulnerabilities in the code or logic. For closed-source projects it is therefore important to control and restrict access to the source. Application services may unexpectedly expose code, for example a service providing files to a user could be manipulated to access source code if implemented insecurely.&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Ensure source code is not inadvertently disclosed through misconfiguration or vulnerabilities in the service.&lt;/li&gt;&lt;li&gt;Check configuration files are not downloadable directly from the service, and cannot be read and viewed through the service itself.&lt;/li&gt;&lt;li&gt;Ensure backups, operating systems, and version control artifacts do not expose code.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check the source code of the application is never returned in cases in which it cannot be interpreted.&lt;/li&gt;&lt;li&gt;Web Servers have a concept called handlers which manage the source code interpretation before sending it to the client. If those handlers are not properly configured, the plain source code could be sent as a default.&lt;/li&gt;&lt;li&gt;Check the handlers are correctly configured to support the types of languages your server uses.&lt;/li&gt;&lt;li&gt;Check also that the source code is not leaked in case of failure.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="8" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-ICMP-Flooding" name="Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Common attacks are ICMP Flooding, Ping flood and Ping of death - Layer 3 infrastructure DDoS attack methods that use ICMP messages to overload the targeted network's bandwidth. These kind of attacks can be prevented from taking place by rate-limiting ICMP traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;For example, iptables can be used on Linux systems as follows:&lt;/p&gt;&lt;p&gt;To protect against ping flood attacks the 'limit' module of iptables can be used:&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -m limit --limit 60/minute --limit-burst 120 -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 2 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A INPUT -p icmp --icmp-type echo-request -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that the above lines will protect only against ping request attacks.&amp;nbsp;&lt;/p&gt;&lt;p&gt;To protect against generic ICMP flood attacks we can remove the constraint '--icmp-type echo-request'. This is only good enough to protect against PC to PC attacks. If flood is done using multiple sources or using hardware then this configuration may not be enough. The configuration will also cause denial of service to other users when under attack even from single source, as we are limiting based on protocol without considering the source address of the packet.&lt;/p&gt;&lt;p&gt;Iptables can also be used to prevent abuse of network resources by rate limiting them:&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 4/second --limit-burst 12 -j ACCEPT&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -m limit --limit 1/minute --limit-burst 1 -j LOG&amp;nbsp;&lt;/p&gt;&lt;p&gt;-A OUTPUT -p tcp -m tcp --dport 80 -j DROP&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;In the above example we are limiting outgoing connections to port 80. This is useful when we can't completely block outgoing connections but we do not want it to become channel from where people start browsing net or downloading. The limit module can also be used in rate limiting incoming traffic for performance reasons.&lt;/p&gt;&lt;p&gt;Disabling a ping flood is most easily accomplished by disabling the ICMP functionality of the targeted router, computer or other device. A network administrator can access the administrative interface of the device and disable its ability to send and receive any requests using the ICMP, effectively eliminating both the processing of the request and the Echo Reply. The consequence of this is that all network activities that involve ICMP are disabled, making the device unresponsive to ping requests, traceroute requests, and other network activities.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="Ping (ICMP) Flood DDoS Attack" url="https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="Rate limiting using iptables" url="https://www.sbarjatiya.com/notes_wiki/index.php/Rate_limiting_using_iptables"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can execute a Smurf attack (denial-of-service attack that floods a target system via spoofed broadcast ping messages) using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 -1 - flood -a VICTIM_IP BROADCAST_ADDRESS&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.108">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="OTG-BUSLOGIC-006" name="Restrict actions of users that follow unusual patterns" issueId="" issueLink="" platform="" cost="0" risk="19" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Restrict actions that users can do outside of the approved/required business process flow.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;This is important because without this safeguard in place attackers may be able to bypass or circumvent work-flows and checks allowing them to prematurely enter or skip required sections of the application potentially allowing actions/transactions to be completed without successfully completing the entire business process, leaving the system with incomplete back-end tracking information.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-06 Security Functionality Verification" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/44-08_02_SI-06"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Testing for business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing business logic" url="https://www.owasp.org/index.php/Testing_for_business_logic"/>
+            <reference name="OWASP testing for the circumvention of work flows" url="https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"/>
+          </references>
+          <standards>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-17" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-6" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the application only processes business logic flows in sequential step order and in realistic human time.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:26.090">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:25.453">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="post-spectre-web-dev-c1" name="Set security headers with default values explicitly" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.&lt;/p&gt;&lt;p&gt;Mitigations can be applied to reduce potential risk on web services:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;Decide when not to respond to requests&lt;/strong&gt; by examining incoming headers, paying special attention to the Origin header on the one hand, and various Sec-Fetch- prefixed headers on the other.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to load your data as a subresource&lt;/strong&gt; by setting a cross-origin resource policy (CORP) of same-origin (opening up to same-site or cross-origin only when necessary).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to frame your data as a document&lt;/strong&gt; by opt-ing into framing protections via X-Frame-Options: SAMEORIGIN or CSP's more granular frame-ancestors directive (frame-ancestors 'self' https://trusted.embedder, for example).&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Restrict attackers' ability to obtain a handle to your window&lt;/strong&gt; by setting a cross-origin opener policy (COOP). In the best case, you can default to a restrictive same-origin value, opening up to same-origin-allow-popups or unsafe-none only if necessary.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Prevent MIME-type confusion attacks&lt;/strong&gt; and increase the robustness of passive defenses like cross-origin read blocking (CORB) / opaque response blocking (ORB) by setting correct Content-Type headers, and globally asserting X-Content-Type-Options: nosniff.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Meltdown and Spectre attacks" url="https://meltdownattack.com/"/>
+            <reference name="Post-Spectre Web Development" url="https://www.w3.org/TR/post-spectre-webdev/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Make requests to the updated web server and ensure that the headers are set properly.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:29.998">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-662" name="Use a synchronised time source" issueId="" issueLink="" platform="" cost="0" risk="35" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to correlate logs and data from different internal and external systems, and to preserve forensic quality of the logs, it is important a unified and trusted synchronized time source is used throughout the environment.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Servers should synchronize to an internal or external NTP server&lt;/li&gt;&lt;li&gt;The centralized source should in turn use (or be) a trusted central time source.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This control is critical in identifying application events (including attacks) through logging, and in conducting post-event analysis, and in particular to track the entire user (or attacker) journey through the system should it be compromised.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;It is good practice to use the concept of Indicators of Compromise (IoC) which should be leveraged to detect possible situations in which the system has been compromised and give an appropriate response.&amp;nbsp; IoCs are often tracked through logs, and accurate time is essential.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AU-08 Time Stamps" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/177-08_02_AU-08"/>
+            <reference name="OSA AU-09 Protection Of Audit Information" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/178-08_02_AU-09"/>
+            <reference name="OSA AU-11 Audit Record Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/180-08_02_AU-11"/>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Proactive Controls [C9]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.4.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="7.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A09:2021-Security Logging and Monitoring Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2017-Insufficient Logging-Monitoring" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API10:2019-Insufficient Logging &amp; Monitoring" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AU-9" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.PT-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Check that mechanisms are installed to keep the host's clock synchronized (i.e.
+                            ntpd in Linux based systems).&lt;/li&gt;
+                            &lt;li&gt;Inspect the logs created by the app and check they have the correct timestamp.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.969">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="34" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.106">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="AV-DoS-BH" name="Use blackholing to mitigate L4 DDoS attacks" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers. This approach to block DDoS attacks makes the site in question completely inaccessible to all traffic, both malicious attack traffic and legitimate user traffic.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Blackholing is typically deployed by the ISP to protect other customers on its network from the adverse effects of DDoS attacks such as slow network performance and disrupted service. Common attacks are SYN flood and Smurf attack. For Smurf attack a simple solution is to disable IP broadcasting addresses at each network router and firewall.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Older routers are likely to enable broadcasting by default, while newer routers will likely already have it disabled.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation&lt;/strong&gt;:&lt;/p&gt;&lt;p&gt;Disable broadcasting by default on old routers.&lt;/p&gt;&lt;p&gt;To implement RTBH (Remote Triggered Black Hole) Network Operator sets up a null route for the 192.0.2.1 address on all the backbone routers which participate in BGP:&lt;/p&gt;&lt;p&gt;ip route 192.0.2.1 255.255.255.255 null 0 254&lt;/p&gt;&lt;p&gt;192.0.2.1 is part of 192.0.2.0/24, the TEST-NET, one of the reserved IPv4 address blocks.&lt;/p&gt;&lt;p&gt;Create a route-map to catch routes which need to be blackholed&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Static routes can be tagged in Cisco IOS - we will tag routes to be blackholed with the value of 66&lt;/li&gt;&lt;li&gt;Set origin to be iBGP&lt;/li&gt;&lt;li&gt;Set local-preference to be 150&lt;ul&gt;&lt;li&gt;higher than any other local-preference set in the backbone&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set community to be no-export and internal marker community (ASN:666)&amp;nbsp;&lt;ul&gt;&lt;li&gt;Don't want prefix to leak outside the AS&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Set next-hop to 192.0.2.1 (IPv4) or 100::1 (IPv6)&amp;nbsp;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Then introduce the route-map into the BGP configuration.&lt;/p&gt;&lt;p&gt;To implement the trigger, simply null route whatever address or address block needs to be blackholed:&lt;/p&gt;&lt;p&gt;ip route 50.62.124.1 255.255.255.255 null0 tag 66&amp;nbsp;&lt;/p&gt;&lt;p&gt;And this ensures that (for example) 50.62.124.1/32 is announced to the entire backbone with next-hop 192.0.2.1 set.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="DDoS Attacks and Countermeasures in Cyberspace" url="https://www.researchgate.net/publication/279176025_DDoS_Attacks_and_Countermeasures_in_Cyberspace"/>
+            <reference name="DDoS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+            <reference name="ENISA - Threat Landscape and Good Practice Guide for Internet Infrastructure" url="https://www.enisa.europa.eu/publications/iitl/at_download/fullReport"/>
+            <reference name="RFC 4732 - Internet Denial-of-Service Considerations" url="https://tools.ietf.org/html/rfc4732"/>
+            <reference name="RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations" url="https://tools.ietf.org/html/rfc4987"/>
+            <reference name="RFC 5635 - Remote Triggered Black Hole Filtering               with Unicast Reverse Path Forwarding (uRPF)" url="https://tools.ietf.org/html/rfc5635"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Perform Layer 3 DDoS attack PoC attacks in a security-laboratory environment and monitor the performance degradation in terms of CPU/Memory/Disk Space to verify if the implemented availability protection is effective. One useful tool to execute this kind of test is hping. Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.&lt;/p&gt;&lt;p&gt;For example, you can simulate a TCP SYN DDoS Attack using the following hping3 command:&lt;/p&gt;&lt;p&gt;hping3 VICTIM_IP -flood -rand-source -destport 80 -syn -d 120 -w 64&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:25.674">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="27" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:26.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="same-encoding-parsers" name="Use the same encodings and parsers in all application components" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Errors may occur when converting between differently coded character data.&amp;nbsp; There are two general types of encoding errors. If the byte sequence is not valid for the specified charset then the input is considered malformed. If the byte sequence cannot be mapped to an equivalent character sequence then an unmappable character has been encountered.
+&lt;/div&gt;
+&lt;div&gt;
+  Special care should be taken when decoding untrusted byte data to ensure that malformed input or unmappable character errors do not result in defects and vulnerabilities.&amp;nbsp; Encoding errors can also occur, for example, encoding a cryptographic key containing malformed input for transmission will result in an error. Encoding and decoding errors typically result in data corruption.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;b&gt;Remediation&lt;/b&gt;
+&lt;/div&gt;Use the same encodings and parsers in all application components to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</desc>
+          <implementations/>
+          <references>
+            <reference name="STR51-J. Use the charset encoder and decoder classes when more control over the encoding process is required" url="https://wiki.sei.cmu.edu/confluence/display/java/STR51-J.+Use+the+charset+encoder+and+decoder+classes+when+more+control+over+the+encoding+process+is+required"/>
+          </references>
+          <standards>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all application components are using the same encoding style.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:28.921">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="34" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:28.918">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="40" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:27.106">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:27.107">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS-CONTROL" name="Access Control" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-189" name="An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-203">
+                  <countermeasures>
+                    <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                    <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="post-spectre-web-dev-c1" mitigation="50"/>
+                <countermeasure ref="post-spectre-web-dev-c2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="ACCESS SENSITIVE DATA" name="Access sensitive data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="review-api-responses" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="review-api-responses" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
+                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-authentication">
+                  <countermeasures>
+                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
+          <threats>
+            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
+                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-285">
+                  <countermeasures>
+                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-object-level-authorization">
+                  <countermeasures>
+                    <countermeasure ref="object-level-authorization" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                <countermeasure ref="object-level-authorization" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="availability" name="Availability" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-607" name="Attackers bring the service down by exhausting it (D)DoS" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker can bring a service down by exhausting either the network or the service itself.
+    &lt;br&gt;
+    &lt;br&gt;See references for more information.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="US Cert DDOS Quick Guide" url="https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf"/>
+              </references>
+              <weaknesses>
+                <weakness ref="AV-DOS-APP">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L3">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-L4">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="AV-DoS-TLS">
+                  <countermeasures>
+                    <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="AV-DoS-BH" mitigation="25"/>
+                <countermeasure ref="AV-DoS-ICMP-Flooding" mitigation="25"/>
+                <countermeasure ref="AV-DoS-L7" mitigation="25"/>
+                <countermeasure ref="AV-DoS-TLS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="CS-Default">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-1" name="Accessing Functionality Not Properly Constrained by ACLs" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web-apps. In cases in which the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker could potentially access resources that should only be available to users of a higher privilege level, or access management sections of the application, or can run queries for data that he is otherwise not supposed to.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-276">
+                  <countermeasures>
+                    <countermeasure ref="deny-default-enf" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="deny-default-enf" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-214" name="An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="25" integrity="25" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-460">
+                  <countermeasures>
+                    <countermeasure ref="error-handling-centralized" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="error-handling-centralized" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="hostile-subdomain-takeover" name="Attackers claim subdomains with the help of external services" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  This attack vector utilizes DNS entries pointing to Service Providers where the pointed sub-domain is currently not in use. Depending on the DNS-entry configuration and which Service Provider it points to, some of these services will allow unverified users to claim these sub-domains as their own.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+  In the not so rare case, the attacker can also "inherit" the Domain Owner's Wildcard SSL used inside the Service Provider.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br /&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;b&gt;Attack Scenario&lt;/b&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;ol&gt;
+   &lt;li&gt;Your company starts using a new service, eg an external Support Ticketing-service.&lt;/li&gt;
+   &lt;li&gt;Your company points a sub-domain to the Support Ticketing-service, eg support.your-domain.com&lt;/li&gt;
+   &lt;li&gt;Your company stops using this service but does not remove the sub-domain redirection pointing to the ticketing system.&lt;/li&gt;
+   &lt;li&gt;Attacker signs up for the Service and claims the domain as theirs. No verification is done by the Service Provider, and the DNS-setup is already correctly setup.&lt;/li&gt;
+   &lt;li&gt;Attacker can now build a complete clone of the real site, add a login form, redirect the user, steal credentials (e.g. admin accounts), cookies and/or completely destroy business credibility for your company.&lt;/li&gt;
+  &lt;/ol&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="Hostile Subdomain Takeover using Heroku/Github/Desk + more" url="https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-350">
+                  <countermeasures>
+                    <countermeasure ref="identify-dns-domains" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="identify-dns-domains" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SOURCE-LEAK" name="Attackers gain control of the system through a source code leakage" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers gain unauthorized access to a service by reading raw source code returned by the service, and this code contains confidential information such as authentication credentials or other secrets that can be used to access the service.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Configuration files that can be downloaded from the service could also be leveraged to gain access to sensitive information.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-541">
+                  <countermeasures>
+                    <countermeasure ref="CWE-541" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-541" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-172" name="Attackers subvert the intended workflow of the application in order to perform unauthorised operations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;If an application enforces an order in workflows, then attackers could attempt to bypass this order so that they can perform operations for which they are not authorized. The technique can also be used to gain access to unauthorized data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-841">
+                  <countermeasures>
+                    <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                    <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="OTG-BUSLOGIC" mitigation="34"/>
+                <countermeasure ref="OTG-BUSLOGIC-006" mitigation="33"/>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-770">
+                  <countermeasures>
+                    <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                    <countermeasure ref="network-rate-limit" mitigation="34"/>
+                    <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="implement-monitoring-unusual-activities" mitigation="33"/>
+                <countermeasure ref="network-rate-limit" mitigation="34"/>
+                <countermeasure ref="protection-against-data-mining" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-272">
+                  <countermeasures>
+                    <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="LEAST-PRIV-ENF" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="LOG-MANAGEMENT" name="Log Management" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-93" name="An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>	&lt;p&gt;This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing him to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-117">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                    <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-8.8" mitigation="20"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="40"/>
+                <countermeasure ref="RESTRICT-NUMBER-ACCOUNT-TO-LOGS" mitigation="40"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-778-AUTH" name="Attacks against the authentication system may go undetected" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Automated attacks against many user accounts, or successful attacks against an account
+                                require a response. &amp;nbsp;If audit logs are not kept of both successful and
+                                unsuccessful authentication operations, then post attack forensics will be hampered.&amp;nbsp;&amp;nbsp;
+                                &lt;div&gt;
+                                &amp;nbsp;
+                                &lt;br /&gt;Without a dynamic response to mass automated attacks against the
+                                authentication system, attackers stand a greater chance of success.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-778">
+                  <countermeasures>
+                    <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                    <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                    <countermeasure ref="CWE-662" mitigation="14"/>
+                    <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                    <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                    <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                    <countermeasure ref="security-logging" mitigation="14"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CDS-USER-TRACK" mitigation="16"/>
+                <countermeasure ref="CSD-VAL-LOG" mitigation="14"/>
+                <countermeasure ref="CWE-662" mitigation="14"/>
+                <countermeasure ref="EU-GDPR-LOGGING" mitigation="14"/>
+                <countermeasure ref="LOG-TLS-FAILURES" mitigation="14"/>
+                <countermeasure ref="LOGS-INTEGRITY" mitigation="14"/>
+                <countermeasure ref="security-logging" mitigation="14"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-532">
+                  <countermeasures>
+                    <countermeasure ref="CWE-532" mitigation="70"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-779">
+                  <countermeasures>
+                    <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-532" mitigation="70"/>
+                <countermeasure ref="LOG-RETENTION" mitigation="30"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="post-data" name="Post data" desc="Data is received (posted) here" library="CS-Default">
+          <threats>
+            <threat ref="ssrf-threat" name="Attackers can abuse functionality on the server to read or update internal resources" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;The attacker can abuse functionality on the server to read or update internal resources. The attacker can supply - or modify - a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration details such as AWS metadata, connect to internal services like http enabled databases, or perform post requests towards internal services which are not intended to be exposed.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="50" availability="25" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-918">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                    <countermeasure ref="CWE-601" mitigation="25"/>
+                    <countermeasure ref="DATA-VAL" mitigation="25"/>
+                    <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="25"/>
+                <countermeasure ref="CWE-601" mitigation="25"/>
+                <countermeasure ref="DATA-VAL" mitigation="25"/>
+                <countermeasure ref="WEB-FILE-DATA" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-35" name="Attackers can leverage Executable Code in Non-Executable Files" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
+&lt;br /&gt;The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
+&lt;br /&gt;http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
+&lt;br /&gt;The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
+&lt;br /&gt;The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name &amp;quot;public&amp;quot; grants all users with the public role the ability to use the administration functionality.
+&lt;br /&gt;The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-95">
+                  <countermeasures>
+                    <countermeasure ref="dyn-exec" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="dyn-exec" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-176" name="Attackers can manipulate Configuration/Environment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-15">
+                  <countermeasures>
+                    <countermeasure ref="configuration-integrity" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="configuration-integrity" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-94" name="Attackers gain access to the system through Server-Side Code Injection" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on the code isolation, this event could grant the user access to system resources and data.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="80"/>
+                    <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="80"/>
+                <countermeasure ref="SAME-ENCODING-STYLE" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-73" name="Attackers upload code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attack of this type involves an attacker inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to exploit these vulnerabilities.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-116">
+                  <countermeasures>
+                    <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="same-encoding-parsers" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-586-SER" name="An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-502">
+                  <countermeasures>
+                    <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="SER-UNTRUST" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
+                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="api-vulnerable-injection">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-300" name="Attackers gain control of the connection through a Man In The Middle attack" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+                                This type of attack targets the communication between two components (typically client
+                                and server). The attacker places himself in the communication channel between the two
+                                components. Whenever one component attempts to communicate with the other (data flow,
+                                authentication challenges, etc.), the data first goes to the attacker, who has the
+                                opportunity to observe or alter it, and it is then passed on to the other component as
+                                if it was never intercepted. This interposition is transparent leaving the two
+                                compromised components unaware of the potential corruption or leakage of their
+                                communications. The potential for Man-in-the-Middle attacks yields an implicit lack of
+                                trust in communication or identify between two components.&amp;nbsp; &amp;nbsp;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-319">
+                  <countermeasures>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="50"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-436">
+                  <countermeasures>
+                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="rest-content-type-val" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
+&lt;/div&gt;
+&lt;div&gt;
+  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-assets-inventory">
+                  <countermeasures>
+                    <countermeasure ref="inventory-api" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="inventory-api" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="ea7d658f-8db8-4ec8-bf98-03cbb31acfc2" diagramComponentId="3eb87443-3b2b-4ec5-9706-2fb4239ab091" ref="295a899b-e1f6-4ff3-8227-1dd1855f2ab6" name="Browser" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="CD-BROWSER">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.251">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.505">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.694">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.694">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.380">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.252">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.252">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.695">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.252">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.252">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.835">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.837">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:47.836">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.352">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.594">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.595">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.448">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.836">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:47.837">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="3cd34698-e9ff-4860-a4d6-307c2636830e" diagramComponentId="13dff8b9-78b2-49e7-93eb-0af434983b41" ref="79ecf6b7-7801-4bf8-8946-781e16059de9" name="svc-common-form-generator" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions>
+        <question ref="microservices.comm.sync.http.rest" answer="true" manuallyModified="false"/>
+      </questions>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="api-broken-object-level-authorization" name="API Broken Object Level Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This has been the most common and devastating attack on APIs to date. Authorization and access control mechanisms in modern applications are complex and wide-spread. Even if the application implements a proper infrastructure for authorization checks, developers might forget to use these checks before accessing a sensitive object. Access control detection is not typically amenable to automated static or dynamic testing.&lt;/p&gt;&lt;p&gt;Unauthorized access can result in data disclosure to unauthorized parties, data loss, or data manipulation. Unauthorized access to objects can also lead to full account takeover.&lt;/p&gt;&lt;p&gt;Object level authorization is an access control mechanism that is usually implemented at the code level to validate that one user can only access objects that they should have access to.&lt;/p&gt;&lt;p&gt;Every API endpoint that receives an ID of an object, and performs any type of action on the object, should implement object-level authorization checks. These checks should validate that the logged-in user does have access to perform the requested action on the requested object.&lt;/p&gt;&lt;p&gt;Failures in this mechanism typically leads to unauthorized information disclosure, modification, or destruction of data.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.618">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-broken-authentication" name="API broken authentication" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Authentication endpoints and flows are assets that need to be protected.&amp;nbsp;&lt;/p&gt;&lt;p&gt;An API is vulnerable if it:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Permits "credential stuffing" whereby the attacker has a list of valid usernames and passwords.&lt;/li&gt;&lt;li&gt;Allows attackers to perform brute force attacks, without presenting captcha / account lockout mechanisms.&lt;/li&gt;&lt;li&gt;Permits weak passwords.&lt;/li&gt;&lt;li&gt;Sends sensitive authentication details, such as authorization tokens and passwords in the URL.&lt;/li&gt;&lt;li&gt;Doesn't validate the authenticity of tokens.&lt;/li&gt;&lt;li&gt;Accepts unsigned / weakly signed JWT tokens ("alg":"none") / doesn't validate their expiration date.&lt;/li&gt;&lt;li&gt;Uses plain text, encrypted, or weakly hashed passwords.&lt;/li&gt;&lt;li&gt;Uses weak encryption keys / API keys.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.613">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="api-vulnerable-injection" name="API is vulnerable to injection flaws" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The API is vulnerable to injection flaws if:
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;ul&gt;
+  &lt;li&gt;Client-supplied data is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+  &lt;li&gt;Client-supplied data is directly used or concatenated to SQL/NoSQL/LDAP queries, OS commands, XML parsers, and Object Relational Mapping (ORM)/Object Document Mapper (ODM).&lt;/li&gt;
+  &lt;li&gt;Data coming from external systems (e.g., integrated systems) is not validated, filtered, or sanitized by the API.&lt;/li&gt;
+ &lt;/ul&gt;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.617">
+              <output/>
+            </source>
+            <references>
+              <reference name="Command Injection" url="https://www.owasp.org/index.php/Command_Injection"/>
+              <reference name="NoSQL Injection Fun with Objects and Arrays" url="https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf"/>
+              <reference name="OWASP Injection Flaws" url="https://www.owasp.org/index.php/Injection_Flaws"/>
+              <reference name="SQL Injection" url="https://www.owasp.org/index.php/SQL_Injection"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.374">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-352" name="Cross Site Request Forgery" state="0" impact="100" issueId="" issueLink="">
+          <desc>The web application does not, or can not, sufficiently verify whether a well-formed, valid,
+                        consistent request was intentionally provided by the user who submitted the request.&amp;nbsp;
+                        &lt;div&gt;
+                        &amp;nbsp;
+                        &lt;br /&gt;When a web server is designed to receive a request from a client without any
+                        mechanism for verifying that it was intentionally sent, then it might be possible for an
+                        attacker to trick a client into making an unintentional request to the web server which will be
+                        treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc.
+                        and can result in exposure of data or unintended code execution.
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.625">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-352: Cross-Site Request Forgery (CSRF)" url="https://cwe.mitre.org/data/definitions/352.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.373">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-285" name="Improper Authorization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not perform - or incorrectly - performs an authorization check when an actor attempts to access a resource or perform an action.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-173" name="Improper Handling of Alternative Encoding" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software does not properly handle cases in which the input uses an alternative encoding scheme that is valid for the control sphere to which the input is being sent.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-235" name="Improper Handling of Extra Parameters" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.449">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-22" name="Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.&amp;nbsp;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Path traversal also covers the use of absolute pathnames such as "/usr/local/bin", which may also be useful in accessing unexpected files. This is referred to as absolute path traversal. In many programming languages, the injection of a null byte (the 0 or NUL) may allow an attacker to truncate a generated filename to widen the scope of attack. For example, the software may add ".txt" to any pathname, thus limiting the attacker to text files, but a null injection may effectively remove this restriction.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.441">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" url="https://cwe.mitre.org/data/definitions/22.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-915" name="Improperly Controlled Modification of Dynamically-Determined Object Attributes" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability. This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, auto-binding, or object injection.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:24.448">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes" url="https://cwe.mitre.org/data/definitions/915.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-200" name="Information Exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>An information exposure is the intentional or unintentional disclosure of information to an
+                        actor that is not explicitly authorized to have access to that information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:22.624">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-200: Information Exposure" url="https://cwe.mitre.org/data/definitions/200.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-548" name="Information Exposure Through Directory Listing" state="0" impact="100" issueId="" issueLink="">
+          <desc>A directory listing is inappropriately exposed, yielding
+                        potentially sensitive information to attackers.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Improper Input Validation" url="https://cwe.mitre.org/data/definitions/20.html"/>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.907">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-436" name="Interpretation Conflict" state="0" impact="100" issueId="" issueLink="">
+          <desc>Product A handles inputs or steps differently than Product B,
+          which causes A to perform incorrect actions based on its perception of B's
+          state.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.622">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-assets-inventory" name="Lack of assets inventory and retirement strategies" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;Lack of asset inventory and retirement strategies may lead to running unpatched systems, resulting in leakage of sensitive data. It is common to find unnecessarily exposed API hosts because of modern concepts like microservices, which make applications easy to deploy and independent (e.g., cloud computing, k8s).&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:22.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.624">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.624">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.908">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.623">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-650" name="Trusting HTTP Permission Methods on the Server Side" state="0" impact="100" issueId="" issueLink="">
+          <desc>The server contains a protection mechanism that assumes that
+                        any URI that is accessed using HTTP GET will not cause a state change to the
+                        associated resource. This might allow attackers to bypass intended access
+                        restrictions and conduct resource modification and deletion attacks, since some
+                        applications allow GET to modify state.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-601" name="URL Redirection to Untrusted Site ('Open Redirect')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;A web application accepts a user-controlled input specifying a link to an external site, and uses this link in a Redirect. This functionality aids phishing attacks.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:24.451">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-2" name="Unexpected Environment Condition" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;This is a generic weakness which includes several different situations that are all connected to unexpected environmental conditions and could be related to:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify the areas of the application that can be affected by the following causes:
+                            &lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Misconfiguration.&lt;/li&gt;
+                            &lt;li&gt;Uncleared buffers, shared memory, files, etc.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Problems between the interaction of two different entities that cause unexpected
+                            behavior.&lt;/li&gt;
+                            &lt;/ol&gt;
+                            &lt;div&gt;
+                            Perform testing on them to look for a security problem.&amp;nbsp;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:24.449">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-2: Unexpected Environment Condition" url="https://cwe.mitre.org/data/definitions/2.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.831">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-639" name="Avoid using direct references to files" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method. Many flaws in applications result from unsafe handling of filenames or path data, for example directory traversal and arbitrary file disclosure. Use of filenames or other direct references to objects such as files on the server-side increases the risk of compromise of the system or unauthorized access to other files, content, or functionality.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Avoid using direct references to files or validate file name.&lt;/li&gt;&lt;li&gt;For example, instead of using:&amp;nbsp;www.example.com/open.jsp?file=details.txt&amp;nbsp;use:&amp;nbsp;www.example.com/open.jsp?file=[GUID]&amp;nbsp;and then use a lookup table on the server to associate the [GUID] value with file details.txt.&lt;/li&gt;&lt;li&gt;Files should be stored outside the web-root to prevent an attacker browsing directly to them.&lt;/li&gt;&lt;li&gt;Do not use obscurity to prevent access; for example do not rely on renaming a file to include a random string to prevent direct download or disclosure.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If direct references are used to access files from within the web-root deviating from recommended security practice, the following must be implemented:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String input validation must be applied.&amp;nbsp; Identify and filter for directory traversal meta-characters such as "../" or "..\" or "/", together with encoded variations and derivations.&lt;/li&gt;&lt;li&gt;Use of a strict white-list of files that may be downloaded.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA AC-05 Separation Of Duties" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/27-08_02_AC-05"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-5" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;When a parameter that represents a file or a file path is found in the application:&lt;/li&gt;&lt;li&gt;For each of them try to change this parameter to gain access to unexpected files.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For example: www.example.com/open.jsp?file=details.txt&amp;nbsp;&lt;br&gt;Shouldn't be implemented that way and if so, it should not be possible to access locations outside of this domain (i.e. file=/etc/passwd or file= &lt;a href="http://www.google.com"&gt;http://www.google.com&lt;/a&gt;, etc.).&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.801">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.292">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.542">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="WEB-SRV-XML" name="Define and enforce secure validation through an XSD or DSD schema on XML input data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The XML standards provides for formal validation criteria to be specified in a schema (XSD or DTD). Defining a schema with security in mind, and enforcing it on input data, will mitigate many attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define an XSD or DTD schema with secure input validation criteria.&lt;/li&gt;&lt;li&gt;Validate all XML input data against the schema before processing it.&lt;/li&gt;&lt;li&gt;The acceptance of unvalidated or non compliant data could have unexpected impact on the behavior of the application, and may facilitate attacks such as SQL injection.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;For every endpoint which consumes XML data.&lt;/li&gt;
+                            &lt;li&gt;Get the permitted structure of this data.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Construct non-compliant samples and send them to the endpoints.&lt;/li&gt;
+                            &lt;li&gt;Check they are not accepted.&amp;nbsp;&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.831">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DIRECTORY_LISTING" name="Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Indexable directories allow an attacker to easily discover the existence of content on your web server that should remain private.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Disable directory listings in the web - or application - server configuration by default.&lt;/li&gt;&lt;li&gt;Restrict access to unnecessary directories and files.&lt;/li&gt;&lt;li&gt;Create an index (default) file for each directory.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Apache - auto index" url="https://httpd.apache.org/docs/trunk/mod/mod_autoindex.html"/>
+            <reference name="Apache - directory listing" url="https://wiki.apache.org/httpd/DirectoryListings"/>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Directory_Indexing" url="https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Directory_Indexing"/>
+            <reference name="OWASP Insecure Indexing" url="https://www.owasp.org/index.php/File_System#Insecure_Indexing"/>
+          </references>
+          <standards>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check that the directory listing is disabled on the web server.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-11.5" name="Do not share system information in HTTP headers and responses" issueId="" issueLink="" platform="" cost="0" risk="48" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should not share detailed version information of system components or other information that would assist attackers in the HTTP header or HTTP responses.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+          </references>
+          <standards>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that the HTTP responses and headers do not reveal sensitive data about the system.
+                            Using a command line web client like telnet or netcat could help on this task.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.831">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="review-api-responses" name="Ensure that the API responses contain only legitimate needed data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;APIs rely on clients to perform the data filtering. Since APIs are used as data sources, sometimes developers try to implement them in a generic way without thinking about the sensitivity of the exposed data.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Never rely on the client-side to perform sensitive data filtering.&lt;/li&gt;&lt;li&gt;Ensure that the API responses contain only legitimate needed data.&lt;/li&gt;&lt;li&gt;Explicitly define and enforce data returned by all API methods, including errors. Whenever possible: use schema's for responses, patterns for all strings and clear field names.&lt;/li&gt;&lt;li&gt;Define all sensitive and personally identifiable information (PII) that your application stores and processes and review all API calls returning such information, to see if these responses could be a security issue.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="22" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API3:2019-Excessive Data Exposure" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation of excessive data exposure is simple, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for any sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;Automatic tools usually can't detect this type of vulnerability because it's hard to differentiate between legitimate data returned from the API, and sensitive data that should not be returned without a deep understanding of the application. However, you can use a "man-in-the-middle proxy" like OWASP Zap to manually explore your application to find sensitive data in API responses.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To Manually Explore your application:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Start ZAP and click the Quick Start tab of the Workspace Window.&lt;/li&gt;&lt;li&gt;Click the large Manual Explore button.&lt;/li&gt;&lt;li&gt;In the URL to explore text box, enter the full URL of the web application you want to inspect.&lt;/li&gt;&lt;li&gt;Select the browser you would like to use.&lt;/li&gt;&lt;li&gt;Click Launch Browser.&lt;/li&gt;&lt;li&gt;Explore your application.&lt;/li&gt;&lt;li&gt;To examine a tree view of the explored pages, click the Sites tab in the Tree Window. You can expand the nodes to see the individual URLs accessed.&lt;/li&gt;&lt;li&gt;To view the request / response information, select a request from the left side panel and get the information via the right-side "Request" and "Response" tabs.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.356">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP ZAP Getting Started Guide" url="https://www.zaproxy.org/getting-started/"/>
+              <reference name="Testing for Exposed Session Variables (OTG-SESS-004)" url="https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-HTTP-METHODS" name="Ensure that the application accepts only a defined set of required HTTP request methods" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. For example, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC 2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;HEAD&lt;/li&gt;&lt;li&gt;GET&lt;/li&gt;&lt;li&gt;POST&lt;/li&gt;&lt;li&gt;PUT&lt;/li&gt;&lt;li&gt;DELETE&lt;/li&gt;&lt;li&gt;TRACE&lt;/li&gt;&lt;li&gt;OPTIONS&lt;/li&gt;&lt;li&gt;CONNECT&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Some of these methods can potentially pose a security risk for a web application, as they allow an attacker to modify the files stored on the web server and, in some scenarios, steal the credentials of legitimate users. More specifically, the methods that should be disabled are the following:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;PUT: &lt;/strong&gt;This method allows a client to upload new files onto the web server. An attacker may exploit this by uploading malicious files (e.g.: an asp file that executes commands by invoking cmd.exe), or by simply using the victim's server as a file repository.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;DELETE:&lt;/strong&gt; This method allows a client to delete a file on the web server. An attacker may exploit it as a very simple and direct way to deface a web site or to mount a DoS attack.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;CONNECT: &lt;/strong&gt;This method could allow a client to use the web server as a proxy.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;TRACE: &lt;/strong&gt;This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which was discovered by Jeremiah Grossman (see links at the bottom of the page).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;If an application needs one or more of these methods, such as REST Web Services (which may require PUT or DELETE), it is important to check their usage is properly limited to trusted users and safe conditions.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Ensure the application accepts only the HTTP requests GET and POST. The HTTP requests TRACE, PUT and DELETE are blocked.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP test HTTP methods" url="https://github.com/ManhNho/OWASP-Testing-Guide-v5/blob/master/document/4%20Web%20Application%20Security%20Testing/4.3%20Configuration%20and%20Deployment%20Management%20Testing/4.3.6%20Test%20HTTP%20Methods%20(OTG-CONFIG-006).md"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Check that the application only accepts the request with the following HTTP
+                            methods: GET and POST.&lt;/li&gt;
+                            &lt;li&gt;Check that the application rejects and blocks the following requests with the HTTP
+                            methods: TRACE, PUT and DELETE.&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.803">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="SEC-DEPLOY" name="Ensure the build pipeline contains a build step to automatically build and verify the secure deployment of the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Ensure that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</desc>
+          <implementations/>
+          <references>
+            <reference name="Secure development and deployment guidance" url="https://www.ncsc.gov.uk/collection/developers-collection?curPage=/collection/developers-collection/principles/secure-the-build-and-deployment-pipeline"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>
+                            Understanding the deployed configuration of the server hosting the web application is almost as important as the application security testing itself. After all, an application chain is only as strong as its weakest link. Application platforms are wide and varied, but some key platform configuration errors can compromise the application in the same way an unsecured application can compromise the server.
+                            &lt;br /&gt;
+                            &lt;br /&gt;In order to evaluate the readiness of the application platform, testing for configuration management includes the following sections:
+                            &lt;br /&gt;
+                            &lt;br /&gt;4.3.1 Test Network/Infrastructure Configuration (OTG-CONFIG-001)
+                            &lt;br /&gt;4.3.2 Test Application Platform Configuration (OTG-CONFIG-002)
+                            &lt;br /&gt;4.3.3 Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)
+                            &lt;br /&gt;4.3.4 Review Old, Backup and Unreferenced Files for Sensitive Information (OTG-CONFIG-004)
+                            &lt;br /&gt;4.3.5 Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
+                            &lt;br /&gt;4.3.6 Test HTTP Methods (OTG-CONFIG-006)
+                            &lt;br /&gt;4.3.7 Test HTTP Strict Transport Security (OTG-CONFIG-007)
+                            &lt;br /&gt;4.3.8 Test RIA cross domain policy (OTG-CONFIG-008)
+                            &lt;br /&gt;4.3.9 Test File Permission (OTG-CONFIG-009)
+                            &lt;br /&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.805">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for configuration management" url="https://www.owasp.org/index.php/Testing_for_configuration_management"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ENV-USE" name="Ensure there are no environmental security weaknesses" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Application security can be undermined by misconfiguration of the underlying server or
+                        development environment.
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;br /&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        Ensure that vendor and best-practice guidelines have been applied, in particular affecting areas
+                        such as:
+                        &lt;/div&gt;
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;Cryptographic strength of elements such as session tokens, GUIDs, and protection of
+                        data in transit and at rest.&lt;/li&gt;
+                        &lt;li&gt;Removal of debugging and compiler options and artifacts used during development.&lt;/li&gt;
+                        &lt;li&gt;Configuration of error trapping and use of generic error messages and pages (e.g.
+                        stack traces should not be returned to users).&lt;/li&gt;
+                        &lt;li&gt;Appropriate access controls over software components, variables (e.g. EJBs and
+                        methods).&lt;/li&gt;
+                        &lt;li&gt;Insecure or inappropriate storage of data in configuration files or other data
+                        structures (e.g. passwords in configuration files).&lt;/li&gt;
+                        &lt;li&gt;Use of compilation/build features or security enhancements provided by the IDE&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                        &lt;div&gt;&lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Security Misconfiguration" url="https://pwning.owasp-juice.shop/part2/security-misconfiguration.html"/>
+            <reference name="OWASP Juice Shop: Vulnerable Components" url="https://pwning.owasp-juice.shop/part2/vulnerable-components.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.3.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A05:2021-Security Misconfiguration" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A06:2021-Vulnerable and Outdated Components" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A6:2017-Security Misconfiguration" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A9:2017-Using Components with Known Vulnerabilities" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API7:2019-Security Misconfiguration" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;figure class="table"&gt;&lt;table&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Identify the areas of the application that could potentially be affected by the following:&amp;nbsp;&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Misconfiguration.&lt;/li&gt;&lt;li&gt;Uncleared buffers, shared memory, files, etc.&lt;/li&gt;&lt;li&gt;Problems between the interaction of two different entities that cause unexpected behavior.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;Verify they are correctly implemented.&amp;nbsp;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="rest-content-type-val" name="Explicitly check the incoming Content-Type for REST services" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation on the consumer/producer side and lead to code injection/execution vulnerabilities.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Explicitly check incoming Content-Type for REST services are the expected ones, such as application/xml or application/JSON.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Modify the content-type server header and test if the request is accepted by the server or not. For example: modify "content application/JSON" to "application/XML" and insert an XML entity payload to determine the XML entity injection point.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.378">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.293">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="harden-http-headers" name="Harden HTTP Headers" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;HTTP headers are a fundamental part of website security.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The Referrer-Policy HTTP header controls how much referrer information (sent via the Referrer header) should be included with requests. This security header was designed to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with CORS requests, as well as with POST requests. It is similar to the Referer header, but, unlike this header, it doesn't disclose the whole path.&lt;/li&gt;&lt;li&gt;The Content-Disposition response header tells the browser to download a file rather than displaying it in the browser window.&lt;/li&gt;&lt;li&gt;If a response states that it contains HTML content but does not specify a character set, then the browser may analyze the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Use a suitable "Referrer-Policy" header, such as "no-referrer" or "same-origin".&lt;/li&gt;&lt;li&gt;Don't use the Origin header for authentication or access control decisions, as the Origin header can easily be changed by an attacker.&lt;/li&gt;&lt;li&gt;Use the Content-Disposition response header for file downloading in all API responses with the following directives: Content-Disposition: attachment; filename="api.json" (or other appropriate filename for the content type).&lt;/li&gt;&lt;li&gt;Use a content-type header specifying a safe character set (e.g., UTF-8, ISO 8859-1) in every HTTP response.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HTML does not specify charset" url="https://portswigger.net/kb/issues/00800200_html-does-not-specify-charset"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="Origin Header" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin"/>
+            <reference name="Referrer-Policy" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy"/>
+            <reference name="Reflected File Download" url="https://www.owasp.org/index.php/Reflected_File_Download"/>
+            <reference name="Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)" url="https://tools.ietf.org/html/rfc6266"/>
+          </references>
+          <standards>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.5.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;An easy way to access your HTTP security headers, as part of your response headers, is to fire up Chrome DevTools. To run this click into the "Network" panel and press Ctrl + R (Cmd + R) to refresh the page. Click into your domain's request and you will see a section for response headers.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Check if "Referrer-Policy" header exists in HTTP responses and has the right directives to prevent cross-domain Referrer leakage.&lt;/li&gt;&lt;li&gt;From a penetration testing perspective you should look for insecure configurations; for example, when the server returns back the Origin header in the Access-Control-Allow-Origin without any additional checks AND returns Access-Control-Allow-Credentials: true, which can lead to access of sensitive data. Note that this configuration is very insecure, and is not acceptable in general terms, except in the case of a public API that is intended to be accessible by everyone.&lt;/li&gt;&lt;li&gt;Try Reflected File Download input payloads to launch commands on the client machine. Reflected File Download is an attack combining URL path segments (now deprecated) with pages that reflect user inputs in the response. Generally web services vulnerable to JSONP Injection are leveraged to deliver malware to end users.&lt;/li&gt;&lt;li&gt;Character encoding has a popular misuse; namely, being used for encoding malicious injection strings in a way that obfuscates them. Try different character encoding schemes (like UTF-7) to bypass input validation filters, or take advantage of particular ways in which browsers render encoded text.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.806">
+              <output/>
+            </source>
+            <references>
+              <reference name="A new security header: Referrer Policy" url="https://scotthelme.co.uk/a-new-security-header-referrer-policy/"/>
+              <reference name="OWASP Testing Guide Appendix D: Encoded Injection" url="https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix_D:_Encoded_Injection"/>
+              <reference name="Reflected File Download - A New Web Attack Vector" url="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/"/>
+              <reference name="Test Cross Origin Resource Sharing (OTG-CLIENT-007)" url="https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="centralized-authz-module" name="Implement a centralized authorization module that is invoked from all your business functions" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Authorization checks for a function or resource are usually managed via configuration, and sometimes at the code level. Implementing proper checks can be a confusing task, since modern applications can contain many types of roles or groups and complex user hierarchy (e.g., sub-users, users with more than one role).&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Your application should have a consistent and easy to analyze authorization module that is invoked from all your business functions. Frequently, such protection is provided by one or more components external to the application code.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.&lt;/li&gt;&lt;li&gt;Review your API endpoints against function-level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.&lt;/li&gt;&lt;li&gt;Ensure that all of your administrative controllers inherit from an administrative abstract controller that implements authorization checks based on the user's group/role.&lt;/li&gt;&lt;li&gt;Ensure that administrative functions inside a regular controller implements authorization checks based on the user's group and role.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Forced browsing" url="https://www.owasp.org/index.php/Forced_browsing"/>
+            <reference name="OWASP Development Guide: Chapter on Authorization" url="https://www.owasp.org/index.php/Category:Access_Control"/>
+            <reference name="Top 10 2013-A7-Missing Function Level Access Control" url="https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="API5:2019-Broken Function Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It's easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the "users" string in the URL to "admins", or changing the value of a parameter like "is_admin" from "false" to "true").&lt;/p&gt;&lt;p&gt;Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users&lt;/p&gt;&lt;p&gt;The best way to find broken function-level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify if a regular user can access administrative endpoints.&lt;/li&gt;&lt;li&gt;Verify if a user can perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE).&lt;/li&gt;&lt;li&gt;Verify if a user from group X can access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all).&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.379">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Cheatsheet Testing Automation" url="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation.html"/>
+              <reference name="Testing for Authorization" url="https://www.owasp.org/index.php/Testing_for_Authorization"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="best-practices-api-auth" name="Implement best practices for API authentication" issueId="" issueLink="" platform="" cost="0" risk="8" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;One of the challenges to building any RESTful API is having a well thought out authentication strategy. An API built without protection from malicious threats through authentication represents an API design failure that can threaten an organization's data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Know all the possible flows to authenticate to the API (mobile / web / deep links that implement one-click authentication / etc).&lt;/li&gt;&lt;li&gt;Check these flows with the API engineers.&lt;/li&gt;&lt;li&gt;Understand deeply the authentication mechanisms and how they are be used. OAuth is not authentication, and neither are API keys.&lt;/li&gt;&lt;li&gt;Don't reinvent the wheel in authentication, token generation, password storage. Use the standard frameworks.&lt;/li&gt;&lt;li&gt;Credential recovery / forget password endpoints should be treated as login endpoints in terms of brute force, rate limiting and lockout protections.&lt;/li&gt;&lt;li&gt;Use the OWASP Authentication Cheatsheet.&lt;/li&gt;&lt;li&gt;Where possible, implement multi-factor authentication.&lt;/li&gt;&lt;li&gt;Implement anti-brute-force mechanisms to mitigate credential stuffing, dictionary attack and brute force attacks on your authentication endpoints. This mechanism should be stricter than the regular rate limiting mechanism on your API.&lt;/li&gt;&lt;li&gt;Implement account lockout / captcha mechanisms to prevent brute force attacks. Implement weak-password checks.&lt;/li&gt;&lt;li&gt;API keys should not be used for authentication, but for client app / project authentication.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="How to Secure APIs" url="https://dzone.com/articles/how-to-secure-apis"/>
+            <reference name="OWASP REST Security Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+            <reference name="REST Security CheatSheet" url="https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="11" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="23" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="26" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="9" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API2:2019-Broken Authentication" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Testing the authentication schema means deeply understanding how the authentication process works and using that information to circumvent the authentication mechanism.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Verify that the user's authentication data are transferred via an encrypted channel (&lt;a href="https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"&gt;OTG-AUTHN-001&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Test for default credentials of common applications (&lt;a href="https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"&gt;OTG-AUTHN-002&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Attempt an invalid login by using incorrect passwords a number of times to test the account lockout mechanism's ability to mitigate brute force password guessing (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"&gt;OTG-AUTHN-003&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Modify user input parameters to gain access to protected areas without providing valid credentials (&lt;a href="https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"&gt;OTG-AUTHN-004&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Verify that the credentials are only sent during the login phase, and not sent together with every request to the application (&lt;a href="https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"&gt;OTG-AUTHN-005&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Check that the application does not leak any sensitive data into the browser cache. In order to do that, use a proxy (such as WebScarab) and search through the server responses that belong to the session, checking that for every page which contains sensitive information, the server instructed the browser not to cache any data (&lt;a href="https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"&gt;OTG-AUTHN-006&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"&gt;OTG-AUTHN-007&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Try to create security questions by creating a new account or by configuring your existing account's password recovery properties, to find weak self-generated questions (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"&gt;OTG-AUTHN-008&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Determine the resistance of the passwords reset functionality against guessing or bypassing (&lt;a href="https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"&gt;OTG-AUTHN-009&lt;/a&gt;).&lt;/li&gt;&lt;li&gt;Fully test the website's primary authentication functions. This should identify how accounts are issued, created or changed and how passwords are recovered, reset, or changed. Additionally knowledge of any elevated privilege authentication and authentication protection measures should be known (&lt;a href="https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"&gt;OTG-AUTHN-010&lt;/a&gt;).&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.379">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP Testing Guide v4. Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+              <reference name="OWASP Testing for authentication" url="https://www.owasp.org/index.php/Testing_for_authentication"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="object-level-authorization" name="Implement object-level authorization checks in every function that accesses a data source using input from the user" issueId="" issueLink="" platform="" cost="0" risk="42" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Implement a proper authorization mechanism that relies on the user policies and hierarchy. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Favor not using an ID that has been sent from the client, but instead use an ID that is stored in the session object when accessing a database record by the record ID.&lt;/li&gt;&lt;li&gt;Use an authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.&lt;/li&gt;&lt;li&gt;Use random and unpredictable values as GUIDs for records' IDs.&lt;/li&gt;&lt;li&gt;Write tests to evaluate the authorization mechanism. Do not deploy vulnerable changes that break these tests.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Map out all locations in the application in which user input is used to reference objects directly. For example, locations where user input is used to access a database row, a file, application page, etc.&lt;/li&gt;&lt;li&gt;Modify the value of the parameter used to reference objects to see if the application raises an authorization error.&lt;/li&gt;&lt;li&gt;Assess whether it is possible to retrieve objects belonging to other users or otherwise bypass authorization.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:21.380">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for Insecure Direct Object References (OTG-AUTHZ-004)" url="https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"/>
+              <reference name="Top 10 2007-Insecure Direct Object Reference" url="https://www.owasp.org/index.php/Top_10_2007-Insecure_Direct_Object_Reference"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="inventory-api" name="Inventory all API hosts and document important aspects of each one of them" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Asset management is a systematic process of developing, operating, maintaining, upgrading, and disposing of assets in the most cost-effective manner (including all costs, risks and performance attributes). The asset inventory makes up the first part of a chain in many risk management frameworks.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g., production, staging, test, development), who should have network access to the host (e.g., public, internal, partners) and the API version.&lt;/li&gt;&lt;li&gt;Inventory integrated services and document important aspects such as their role in the system, what data is exchanged (data flow), and its sensitivity.&lt;/li&gt;&lt;li&gt;Document all aspects of your API such as authentication, errors, redirects, rate limiting, cross-origin resource sharing (CORS) policy and endpoints, including their parameters, requests, and responses.&lt;/li&gt;&lt;li&gt;Generate documentation automatically by adopting open standards. Include the documentation build in your CI/CD pipeline.&lt;/li&gt;&lt;li&gt;Make API documentation available to those authorized to use the API.&lt;/li&gt;&lt;li&gt;Use external protection measures such as API security firewalls for all exposed versions of your APIs, not just for the current production version.&lt;/li&gt;&lt;li&gt;Avoid using production data with non-production API deployments. If this is unavoidable, these endpoints should get the same security treatment as the production ones.&lt;/li&gt;&lt;li&gt;When newer versions of APIs include security improvements, perform risk analysis to make the decision of the mitigation actions required for the older versions: for example, whether it is possible to backport the improvements without breaking API compatibility, or simply take the older versions out swiftly and force all clients to move to the latest versions.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Best Practices in API Documentation" url="https://swagger.io/blog/api-documentation/best-practices-in-api-documentation"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="20" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="21" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="27" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="29" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="30" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API9:2019-Improper Assets Management" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Make sure the API host inventory and API documentation are updated and available to stakeholders. To check the validity of this documentation you can use an active/passive discovery tool to identify undocumented API hosts or endpoints.
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.380">
+              <output/>
+            </source>
+            <references>
+              <reference name="Inventory and Control of Software Assets" url="https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="cwe-352-csrf" name="Protect cookies from CSRF" issueId="" issueLink="" platform="" cost="0" risk="8" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, etc. Therefore, if the user is authenticated to the site, the site cannot distinguish between the forged or legitimate request sent by the victim. A token/identifier that is not accessible to the attacker is needed to mitigate this and would not be sent along (like cookies) with forged requests that the attacker initiates.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Requiring re-authentication of sensitive functions is an effective way to protect your application against a CSRF, but intrusive to the user experience.&lt;/p&gt;&lt;p&gt;You can also protect cookies from CSRF using at least one or more of the following recommendations:&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;strong&gt;CSRF nonces&lt;/strong&gt;. Use nonces to prevent unauthorized access by providing a secret 'key' (which is valid only once) that must be validated in any sensitive form submission. For maximum security, the nonce is also time sensitive and expires.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Triple or double submit cookie pattern&lt;/strong&gt;. If maintaining the state for the CSRF token on the server-side is problematic, an alternative defense is to use the double-submit cookie technique. This technique is easy to implement and is stateless. In this technique, a random value is sent in both a cookie and as a request parameter, with the server verifying if the cookie value and request value match. When a user visits (even before authenticating to prevent login CSRF), the site should generate a (cryptographically strong) pseudo random value and set it as a cookie on the user's machine separate from the session identifier. The site then requires that every transaction request include this pseudo-random value as a hidden form value (or other request parameter/header). If both of them match on the server-side, the server accepts it as a legitimate request and if they don't, then rejects the request.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;ORIGIN request header checks&lt;/strong&gt;.There are two steps to this mitigation, both of which rely on examining an HTTP request header value. Firstly, determining the origin the request is coming from (source origin). This can be achieved via Origin and/or referer headers. Secondly, determining the origin the request is going to (target origin). On the server-side verify if both of these match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, discard the request (meaning that the request originated from a cross-domain). Reliability of these headers comes from the fact they cannot be altered programmatically (using JavaScript in an XSS) as they fall under the forbidden headers list (i.e., only browsers can set them).&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet" url="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-03 Security Function Isolation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/63-08_02_SC-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-30" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;1.- Identify all application components performing sensitive operations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;2.- Using an intercepting proxy, the Web Developer Console, or other tool; intercept the browser request and server response, and verify a unique strong token is being sent and verified with each request.&lt;/p&gt;&lt;p&gt;3.- Confirm the tokens are passed in a programmatic way resistant to CSRF attack; e.g. in a custom POST field and separate HTTP header.&lt;/p&gt;&lt;p&gt;4.- Attempt to subvert the CSRF controls to ensure they are robust:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Change or remove the tokens and confirm the application rejects the request.&lt;/li&gt;&lt;li&gt;Attempt to replay the tokens in a subsequent request.&lt;/li&gt;&lt;li&gt;Mismatch the tokens in a request.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;To modify headers and otherwise modify browser requests, use an intercepting proxy (e.g. OWASP Zap, Burp or Fiddler), or browser extensions such as Cookie Manager or Tamper Data.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:21.381">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing for CSRF (OTG-SESS-005)" url="https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASVS-18.8" name="Reject requests containing unexpected or missing content type headers" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+                        Reject requests containing unexpected or missing content type headers with HTTP response status
+                        &amp;quot;406 Unacceptable&amp;quot; or &amp;quot;415 Unsupported Media Type&amp;quot;.
+                        &lt;/div&gt;
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Validate request content-type" url="https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Validate_request_content_types"/>
+            <reference name="Spring docs: CSRF" url="https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html"/>
+          </references>
+          <standards>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that HTTP requests with non-valid Content-type are rejected.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.805">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-SESS-REAUTH" name="Require additional authentication for sensitive operations / high value transactions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Having gained access to an account, for example through session hijacking or cross-site scripting, an attack may compromise data and functionality accessible to the victim. This may include elevating privileges or accessing sensitive data and functionality, such as changing passwords, creating accounts, or transferring funds.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;These critical functions and sensitive data should be further protected from attack using a risk-based authentication model requiring re-authentication via multi-factor authentication, or use of a token to sign transactions or operations.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement re-authentication on key functions (such as requiring the old password before setting a new one).&lt;/li&gt;&lt;li&gt;Use secondary authentication such as a transaction PIN to allow financial transfers.&lt;/li&gt;&lt;li&gt;Critical administrative functionality should require multi-factor authentication (such as a hard or soft token).&lt;/li&gt;&lt;li&gt;Consider use of signing technologies or tokens that enable the server-side to verify the authenticity of a request and mitigate Man in the Middle (MiTM) or Man in the Browser (MiTB) attacks.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+          </references>
+          <standards>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.7.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="IA-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                            &lt;li&gt;Identify critical functionalities of the application.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Check the risk appetite for those functionalities.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Validate that re-authentication is required for those functions if deemed
+                            necessary.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.806">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSIGN-WHITE" name="Use a white-list approach to assign values to variables" issueId="" issueLink="" platform="" cost="2" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>
+                        &lt;p&gt;All data received from the client-side should be considered tainted and a potential risk, regardless of the source or transport method.&amp;nbsp;Using mass-assignment or auto-binding when accepting values from an untrusted source and mapping them to trusted server side values increases the risk of tainted data being used unsafely.&lt;/p&gt;
+                        &lt;p&gt;&lt;/p&gt;
+                        &lt;ul&gt;
+                         &lt;li&gt;Bind individual values to specific fields, instead of binding whole objects.&lt;/li&gt;
+                         &lt;li&gt;Use available features of the language or framework that allow specification of white lists of attributes or fields that are allowed to be modified.&amp;nbsp;&lt;/li&gt;
+                         &lt;ul&gt;
+                          &lt;li&gt;For example, applications written with Ruby on Rails can use the attr_accessible (white list) or attr_protected (black list) macros in each class that may be used in mass assignment.&lt;/li&gt;
+                         &lt;/ul&gt;
+                        &lt;/ul&gt;
+                    </desc>
+          <implementations>
+            <implementation platform="Spring.java">
+              <desc>ICAgIEBSZXF1ZXN0TWFwcGluZyh2YWx1ZSA9ICIvdmVudWUve2NpdHl9L3twbGFjZX0iLCBtZXRob2QgPSAiR0VUIikKICAgIHB1YmxpYyBTdHJpbmcgZ2V0VmVudWVEZXRhaWxzKFZlbnVlIHZlbnVlLCBNb2RlbCBtb2RlbCkgewogICAgICAgIC8vIHZlbnVlIG9iamVjdCB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcG9wdWxhdGVkIHdpdGggY2l0eSBhbmQgcGxhY2UKICAgIH0=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API6:2019-Mass Assignment" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the framework the component is using.&lt;/li&gt;&lt;li&gt;Check if this particular framework provides automatic binding of variables.&lt;/li&gt;&lt;li&gt;Verify if it is disabled or restricted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.543">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:50.544">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.294">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.832">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:21.381">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-147" name="Validate input parameters to prevent HTTP Parameter Pollution" issueId="" issueLink="" platform="" cost="0" risk="42" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>All data received from external sources should be considered tainted and a potential risk, regardless of the source or transport method. HTTP Parameter Pollution attacks result when parameters are added or inserted into requests, and are inappropriately or unsafely handled by the server. For example, injection of parameters into strings or cookies sent to the application can result in the variables being interpreted out of sequence, exploiting flaws in the business logic and flow.
+&lt;div&gt;
+ &lt;div&gt;
+  &lt;ul&gt;
+  &lt;/ul&gt;
+ &lt;/div&gt;
+ &lt;div&gt;
+  &lt;p&gt;For example, there was a bug in the Blogger platform which illustrates this vulnerability. The bug allowed malicious users to take ownership of the victim's blog by using the following HTTP request:&lt;/p&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;POST /add-authors.do HTTP/1.1&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;blockquote&gt;
+   &lt;p&gt;&lt;code&gt;security_token=attackertoken&amp;amp;&lt;b&gt;blogID=attackerblogidvalue&lt;/b&gt;&amp;amp;&lt;b&gt;blogID=victimblogidvalue&lt;/b&gt;&amp;amp;authorsList=goldshlager19test%40gmail.com(attacker email)&amp;amp;ok=Invite&lt;/code&gt;&lt;/p&gt;
+  &lt;/blockquote&gt;
+  &lt;p&gt;The flaw resided in the authentication mechanism used by the web application, as the security check was performed on the first&amp;nbsp;&lt;code&gt;blogID&lt;/code&gt;&amp;nbsp;parameter, whereas the actual operation used the second occurrence.&lt;/p&gt;
+ &lt;/div&gt;
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify parameters within the application used for authentication decisions, or critical business logic.&lt;/li&gt;&lt;li&gt;Send specially forged requests to the application in which those parameters are duplicated, or passed through other methods (e.g. POST parameters in the URL as GET fields, cookies as form fields etc.)&lt;ul&gt;&lt;li&gt;Review the application logic to ensure:&lt;/li&gt;&lt;li&gt;The same parameter is for all the decisions.&lt;/li&gt;&lt;li&gt;Parameters received over unexpected or non compliant methods result in a security exception.&lt;/li&gt;&lt;li&gt;Duplicate parameters are identified and result in a security exception.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;The application should fail-safe; i.e. unexpected or suspicious behavior should result in termination of the user's session and a security event being logged.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;A number of tools can be used to aid in testing:&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Directly inside your browser with the Developer Tools&lt;/li&gt;&lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data)&lt;/li&gt;&lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. OWASP ZAP, Burp, Fiddler, etc.)&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T13:45:23.804">
+              <output/>
+            </source>
+            <references>
+              <reference name="OWASP - Testing for HTTP Parameter Pollution" url="https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-601" name="Whitelist which URLs the application may redirect to" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should maintain a list of URLs to which it may redirect users. This whitelisting can also be achieved by applying regular expressions. The application should only allow redirects to trusted URLS.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-04 Information Flow Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/26-08_02_AC-04"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.6.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.9" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.AM-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-4" supportedStandardRef="nist-csf"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Identify the points of the application in which a redirection takes place. Redirections are usually indicated by the use of the "Location" HTTP header along with the "3xx" code.&lt;/li&gt;&lt;li&gt;Verify if the value inside the Location header is coming from user input (URL string, Cookies, HTTP headers, forms, etc.).&lt;/li&gt;&lt;li&gt;Modify the input value which will be part of the Location header to redirect to domains which should not be permitted.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T13:45:23.804">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="sniff-api-responses" name="Attackers analyze API responses looking for sensitive data" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Exploitation of excessive data exposure can be a simple process, and is usually performed by sniffing (covertly observing) the traffic to analyze API responses, looking for sensitive data that should not be returned to the user.&lt;/p&gt;&lt;p&gt;The API may return sensitive data to the client by design. This data is usually filtered on the client side before being presented to the user. An attacker could potentially sniff this traffic and see the sensitive data.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="review-api-responses" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="review-api-responses" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="abusing-API-authentication" name="Attackers gain control of users' accounts in the system by abusing poorly implemented API authentication" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;API authentication can be complex and at times confusing. Software and security engineers might have misconceptions about the boundaries of authentication and how to implement it correctly. In addition, the authentication mechanism is a prime target for attackers, since it's exposed to everyone. These two points make the authentication component potentially valuable to miscreants.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-114: Authentication Abuse" url="https://capec.mitre.org/data/definitions/114.html"/>
+                <reference name="CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" url="https://capec.mitre.org/data/definitions/57.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-authentication">
+                  <countermeasures>
+                    <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="best-practices-api-auth" mitigation="90"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="10"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authorization" name="Authorization" desc="" library="CS-Default">
+          <threats>
+            <threat ref="broken-authorization-api" name="Attackers can exploit API endpoints that are vulnerable to broken authorization to access forbidden functionality" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Attackers could exploit API endpoints that are vulnerable to broken object-level authorization by manipulating the ID of an object that is sent within the request. This may lead to unauthorized access to sensitive data. This issue is extremely common in API-based applications because the server component usually does not fully track the client's state, and instead, relies more on parameters like object IDs, that are sent from the client to decide which objects to access.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="75" availability="50" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs" url="http://capec.mitre.org/data/definitions/1.html"/>
+                <reference name="CAPEC-87: Forceful Browsing" url="http://capec.mitre.org/data/definitions/87.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="CWE-285">
+                  <countermeasures>
+                    <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="api-broken-object-level-authorization">
+                  <countermeasures>
+                    <countermeasure ref="object-level-authorization" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="centralized-authz-module" mitigation="50"/>
+                <countermeasure ref="object-level-authorization" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="7k-CWE-Environment" name="Attackers gain unauthorised access to the application through an environment flaw" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this section are not directly related to source code, we separated it from the rest of the realms.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-2">
+                  <countermeasures>
+                    <countermeasure ref="ENV-USE" mitigation="50"/>
+                    <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ENV-USE" mitigation="50"/>
+                <countermeasure ref="SEC-DEPLOY" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-62" name="An attacker crafts malicious web links and distributes them hoping to induce users to click on the link and execute a malicious action" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level.
+&lt;br&gt;This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.
+&lt;br&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-352">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                    <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                    <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-18.8" mitigation="34"/>
+                <countermeasure ref="CSD-SESS-REAUTH" mitigation="33"/>
+                <countermeasure ref="cwe-352-csrf" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="open-redirect-threat" name="An attacker leverages the redirection functionality in the application to conduct more convincing phishing attacks" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An http parameter may contain a URL value for redirecting the request to another specified URL. By modifying this URL value to point towards a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy and convincing appearance.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-601">
+                  <countermeasures>
+                    <countermeasure ref="CWE-601" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-601" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-117" name="An attacker monitors HTTP headers from a target in order to gather information" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>An attacker monitors data streams to or from a target in order to gather information.
+                                This attack may be undertaken in order to gather information to support a later attack,
+                                or the data collected may be the end goal of the attack. This attack usually involves
+                                sniffing network traffic, but may include observing other types of data streams, such as
+                                radio. In most varieties of this attack, the attacker is passive and simply observes
+                                regular communication, however in some variants the attacker may attempt to initiate the
+                                establishment of a data stream or influence the nature of the data transmitted. However,
+                                in all variants of this attack, and distinguishing this attack from other data
+                                collection methods, the attacker is not the intended recipient of the data stream.
+                                Unlike some other data leakage attacks, the attacker is observing explicit data channels
+                                (e.g. network traffic) and reading the content. This differs from attacks that collect
+                                more qualitative information, such as communication volume, or other information not
+                                explicitly communicated via a data stream.
+                            </desc>
+              <riskRating confidentiality="25" integrity="25" availability="25" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-200">
+                  <countermeasures>
+                    <countermeasure ref="ASVS-11.5" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASVS-11.5" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-267" name="Attackers encode potentially harmful input and submit it to bypass input filtering protections" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This attack leverages the possibility of encoding potentially harmful input and submitting it to applications not expecting or effective at validating this encoding, thus, thwarting the validation.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-173">
+                  <countermeasures>
+                    <countermeasure ref="harden-http-headers" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-235">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="50"/>
+                <countermeasure ref="harden-http-headers" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="api-injection" name="Attackers feed the API with malicious data through injection vectors (e.g., direct input, parameters, integrated services, etc.), hoping for it to be sent to an interpreter" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Injection flaws are very common and are often found in SQL, LDAP, or NoSQL queries, OS commands, XML parsers, and ORM. These flaws are relatively easy to discover when reviewing the source code. Attackers can use scanners and fuzzers.&lt;/p&gt;&lt;p&gt;Injection exploits can lead to information disclosure and data loss. It could also lead to DoS, or complete host takeover in the worst scenarios.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-248: Command Injection" url="https://capec.mitre.org/data/definitions/248.html"/>
+                <reference name="CAPEC-66: SQL Injection" url="https://capec.mitre.org/data/definitions/66.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="api-vulnerable-injection">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-273" name="Attackers inject content into a server response that is interpreted differently by intermediaries than it is by the target browser" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To achieve this takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, using different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, defacement, cache poisoning, or similar actions.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-436">
+                  <countermeasures>
+                    <countermeasure ref="rest-content-type-val" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="rest-content-type-val" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="unpatched-api" name="Attackers may gain access to sensitive data, or even take over the server through old, unpatched, API versions connected to the same database" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  Old API versions are usually unpatched and are an easy way to compromise systems without having to fight state-of-the-art security mechanisms, which might be in place to protect the most recent API versions.
+&lt;/div&gt;
+&lt;div&gt;
+  Outdated documentation makes it more difficult to find and/or fix vulnerabilities.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+ &lt;br&gt;
+&lt;/div&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="CAPEC-310: Scanning for Vulnerable Software" url="https://capec.mitre.org/data/definitions/310.html"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-assets-inventory">
+                  <countermeasures>
+                    <countermeasure ref="inventory-api" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="inventory-api" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-137-MASS" name="Functionality could be subverted through mass assignment" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If the application binds parameters to back-end objects, then attackers could potentially set fields on those objects that were not designed to be modified by the user.</desc>
+              <riskRating confidentiality="75" integrity="75" availability="1" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-915">
+                  <countermeasures>
+                    <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                    <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSIGN-WHITE" mitigation="50"/>
+                <countermeasure ref="WEB-SRV-XML" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-101" name="Unauthorised data could be accessed by manipulating parameters sent to the application" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>The application could be tricked into exposing data to unauthorized users by
+                                manipulating the parameters it accepts. All data received from the client side could be
+                                subject to manipulation, including fields like cookies and HTTP headers, if these are
+                                used as inputs to the application.
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="50" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="CWE-147" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-22">
+                  <countermeasures>
+                    <countermeasure ref="CWE-639" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-548">
+                  <countermeasures>
+                    <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-650">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-147" mitigation="25"/>
+                <countermeasure ref="CWE-639" mitigation="25"/>
+                <countermeasure ref="DIRECTORY_LISTING" mitigation="25"/>
+                <countermeasure ref="RESTRICT-HTTP-METHODS" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="7e80910b-1d71-4d8e-b743-66004cf62914" diagramComponentId="85a6936a-89c4-4218-9bdc-cd1a34c8bfe0" ref="85a95b22-8293-49eb-be6d-aaa441e54e11" name="Redis Server" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="redis-server">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:54.098">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.875">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-943" name="Improper Neutralization of Special Elements in Data Query Logic" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.&lt;/p&gt;&lt;p&gt;Depending on the capabilities of the query language, an attacker could inject additional logic into the query to:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Modify the intended selection criteria, thus changing which data entities (e.g., records) are returned, modified, or otherwise manipulated&lt;/li&gt;&lt;li&gt;Append additional commands to the query&lt;/li&gt;&lt;li&gt;Return more entities than intended&lt;/li&gt;&lt;li&gt;Return fewer entities than intended&lt;/li&gt;&lt;li&gt;Cause entities to be sorted in an unexpected way&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The ability to execute additional commands or change which entities are returned has obvious risks. But when the application logic depends on the order or number of entities, this can also lead to vulnerabilities. For example, if the application query expects to return only one entity that specifies an administrative user, but an attacker can change which entities are returned, this could cause the logic to return information for a regular user and incorrectly assume that the user has administrative privileges.&lt;/p&gt;&lt;p&gt;While this weakness is most commonly associated with SQL injection, there are many other query languages that are also subject to injection attacks, including HTSQL, LDAP, DQL, XQuery, Xpath, and NoSQL languages.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.430">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-943: Improper Neutralization of Special Elements in Data Query Logic" url="https://cwe.mitre.org/data/definitions/943.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-78" name="Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Alternately, if the weakness occurs in a privileged program, it could allow the attacker to specify commands that normally would not be accessible, or to call alternate commands with privileges that the attacker does not have. The problem is exacerbated if the compromised process does not follow the principle of least privilege, because the attacker-controlled commands may run with special system privileges that increases the amount of damage. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  There are at least two subtypes of OS command injection:&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;The application intends to execute a single, fixed program that is under its own control. It intends to use externally-supplied inputs as arguments to that program. For example, the program might use system(&amp;quot;nslookup [HOSTNAME]&amp;quot;) to run nslookup and allow the user to supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup from executing. However, if the program does not remove command separators from the HOSTNAME argument, attackers could place the separators into the arguments, which allows them to execute their own program after nslookup has finished executing.The application accepts an input that it uses to fully select which program to run, as well as which commands to use.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;The application simply redirects this entire command to the operating system. For example, the program might use &amp;quot;exec([COMMAND])&amp;quot; to execute the [COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then the attacker can execute arbitrary commands or programs. If the command is being executed using functions like exec() and CreateProcess(), the attacker might not be able to combine multiple commands together in the same line. From a weakness standpoint, these variants represent distinct programmer errors.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;In the first variant, the programmer clearly intends input from untrusted parties will be part of the arguments in the command to be executed. In the second variant, the programmer does not intend for the command to be accessible to any untrusted party, but the programmer probably has not accounted for alternate ways in which malicious attackers can provide input. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T11:03:53.497">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.497">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.876">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="redis-server-exposed" name="The Redis server is exposed" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;If access is permitted from other servers or public access, compromise is more likely, as the Redis server is exposed.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.497">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:54.037">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.691">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.692">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-redis-access-localhost-only" name="Secure Redis Server access to localhost only" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;By default, Redis server is - and should only be - accessible from the localhost. But if access has been allowed from other servers or public access, likelihood of compromise increases.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&lt;/strong&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Open the Redis configuration file, # vim /usr/local/redis/6379.conf&lt;/li&gt;&lt;li&gt;Once opened, look for 'bind' parameter &amp;amp; change it to, bind 127.0.0.1 ::1&lt;/li&gt;&lt;li&gt;Save the file &amp;amp; exit. Now restart the Redis service to implement the changes made.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Check the Redis server is only accessible from localhost.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.438">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-redis-renaming-dangerous-commands" name="Secure Redis Server by renaming or disabling dangerous commands" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In order to avoid any serious repercussions if someone gains access to their Redis server, Redis provides a way to rename some of the dangerous commands like:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;LUSHDB,&lt;/li&gt;&lt;li&gt;FLUSHALL,&lt;/li&gt;&lt;li&gt;KEYS,&lt;/li&gt;&lt;li&gt;DEL,&lt;/li&gt;&lt;li&gt;CONFIG,&lt;/li&gt;&lt;li&gt;SHUTDOWN,&lt;/li&gt;&lt;li&gt;BGREWRITEAOF,&lt;/li&gt;&lt;li&gt;BGSAVE,&lt;/li&gt;&lt;li&gt;SAVE,&lt;/li&gt;&lt;li&gt;RENAME,&lt;/li&gt;&lt;li&gt;and DEBUG.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;There are other commands also that can be renamed but these are some of the most dangerous ones. Ensure to disable commands altogether if not needed in the application.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Remediation:&amp;nbsp;&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Disabling a command is a similar process to renaming a command, for renaming, provide an alternate name for the command, but for disabling rename it to an empty name or string.&lt;/p&gt;&lt;p&gt;To rename a command, open the configuration file, # vim /usr/local/redis/6379.conf&lt;/p&gt;&lt;p&gt;Under the 'Security' section, we can rename or disable a command. To disable a command, use the following example as a reference: rename-command FLUSHALL ""&lt;/p&gt;&lt;p&gt;For renaming a command, use the following example as reference: rename-command FLUSHALL DELETEITALL&lt;/p&gt;&lt;p&gt;Here, we have renamed FLUSHALL command to DELETEITALL (Delete It All). Once changes have been made, save the file &amp;amp; restart the Redis service to implement the changes. Now login to redis-cli &amp;amp; check the renamed commands.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Try to use the following Redis Server commands in the redis-cli and verify they do not work:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;LUSHDB,&lt;/li&gt;&lt;li&gt;FLUSHALL,&lt;/li&gt;&lt;li&gt;KEYS,&lt;/li&gt;&lt;li&gt;DEL,&lt;/li&gt;&lt;li&gt;CONFIG,&lt;/li&gt;&lt;li&gt;SHUTDOWN,&lt;/li&gt;&lt;li&gt;BGREWRITEAOF,&lt;/li&gt;&lt;li&gt;BGSAVE,&lt;/li&gt;&lt;li&gt;SAVE,&lt;/li&gt;&lt;li&gt;RENAME,&lt;/li&gt;&lt;li&gt;and DEBUG.&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T11:03:53.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-redis-with-password" name="Secure Redis Server installation with a password" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The first operation to perform with a Redis installation, is to assign a password:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;open the configuration file. (Note:- This is the configuration file path for local installation, yours may be '/etc/redis/redis.conf' or if you have a custom installation, then go to that location. # vim /usr/local/redis/6379.conf)&lt;/li&gt;&lt;li&gt;Look for the parameter 'requirepass', and uncomment it and then assign a password, requirepass&amp;nbsp; test@9879&lt;/li&gt;&lt;li&gt;Once the changes have been made, restart the Redis service to implement the changes made. In order to connect to the redis-cli, enter the password. First, connect to redis-cli, # redis-cli&lt;/li&gt;&lt;li&gt;Now provide the password: 127.0.0.1:6379&amp;gt; auth test#9897&lt;/li&gt;&lt;li&gt;Connection to redis-cli established.&lt;/li&gt;&lt;/ol&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Easy guide for Securing Redis Server" url="https://linuxtechlab.com/easy-guide-for-securing-redis-server/"/>
+          </references>
+          <standards>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+     &lt;ol&gt;
+      &lt;li&gt;Connect to redis-cli: # redis-cli&lt;/li&gt;
+      &lt;li&gt;Check that the password is required.&lt;/li&gt;
+      &lt;li&gt;Provide the password: 127.0.0.1:6379&amp;gt; auth test#9897&lt;/li&gt;
+      &lt;li&gt;Check that the authentication is successful.&lt;/li&gt;
+     &lt;/ol&gt;
+    &lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:53.439">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.313">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T11:03:57.314">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="secure-redis-with-password" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-redis-with-password" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-341" name="Attackers gain access to user data by manipulating server-side code" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Server-Side Code Injection happens when an attacker is able to direct input under his control and mix it with executed code on the server-side by modifying the logic executed on it.&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-943">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
+                    <countermeasure ref="DATA-VAL" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="50"/>
+                <countermeasure ref="DATA-VAL" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-88" name="An adversary injects operating system commands into existing application functions" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.
+    &lt;br /&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-78">
+                  <countermeasures>
+                    <countermeasure ref="secure-redis-renaming-dangerous-commands" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-redis-renaming-dangerous-commands" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="redis-server-exposed">
+                  <countermeasures>
+                    <countermeasure ref="secure-redis-access-localhost-only" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="secure-redis-access-localhost-only" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="5927025a-fce3-485e-9dfb-889614d37108" diagramComponentId="0cc26ac2-be19-4533-82b2-1d86cd4e240f" ref="df661557-3440-41ad-a563-621fc3f3e0cb" name="PostgreSQL" desc="" library="CS-Default" parentComponentRef="" componentDefinitionRef="postgresql">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:49.917">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-284" name="Improper Access Control" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.128">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-89" name="Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;br&gt;Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted and executed as SQL instead of ordinary user data. This can be leveraged to alter query logic in order to bypass security checks, or to insert additional statements that modify the back-end database, possibly including execution of system commands. SQL injection has become a common issue with database-driven web sites. The flaw is relatively easily detected, and often easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted automated attack of this kind. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:49.778">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" url="https://cwe.mitre.org/data/definitions/89.html"/>
+              <reference name="OWASP Testing Guide" url="https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)#Standard_SQL_Injection_Testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-306" name="Missing Authentication for Critical Function" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.129">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;ul&gt; 
+ &lt;li&gt;Weak encryption algorithms&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Loss of encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Compromised encryption keys&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Revoked keys are still active (bad key lifecycle management)&lt;/li&gt; 
+&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.129">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="RESTRICT-ACCESS-DATABASE" name="Access the data store from an account with the least privileges necessary" issueId="" issueLink="" platform="" cost="1" risk="61" state="Required" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>	&lt;p&gt;Use an account with only the minimum set of permissions required to access the data store. The account should not be able to perform operations that are not explicitly required by the component that performs these operations. For example, if a web application needs to read data from certain tables and insert and update data from others, then a database account with only those specific permissions should be used by the application server.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the user account used by external components to access this data store.&lt;/li&gt; 
+ &lt;li&gt;Check which permissions are assigned to this user account.&lt;/li&gt; 
+ &lt;li&gt;Verify that they are the minimum set of permissions necessary and no unnecessary permissions are assigned.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-27T12:41:49.872">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="PATCH-SERVICE" name="Apply required security patches to the service" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Vendors and other maintainers of software release patches in response to security flaws and other bugs in their products.&amp;nbsp; The longer a system is exposed with a known security vulnerability, the easier to compromise it. &amp;nbsp;As the exploit enters the public domain, they get included in automated exploitation suites like Metasploit and a wider less skilled miscreant is able to leverage them.&amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Apply patches and other software updates in a timely manner to prevent unexpected failures or exploitation.&lt;/li&gt;&lt;li&gt;Clearly define an approach for testing and applying patches, in particular security patches, with expected timescales. &amp;nbsp;There is often a small window between the release of a patch, and potentially malicious actors reverse-engineering the patch to identify and exploit the flaw.&lt;/li&gt;&lt;li&gt;Use a threat intelligence, vulnerability scanning, or other alerting services to ensure the project team is promptly aware of issues within the project or its components.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-01 Configuration Management Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/152-08_02_CM-01"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CM-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;br /&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Check with the software or service vendor whether security vulnerabilities and
+                            their associated patches are available for the version deployed.&lt;/li&gt;
+                            &lt;li&gt;Evaluate the criticality of the vulnerability and schedule a fix accordingly.&lt;/li&gt;
+                            &lt;/ol&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.015">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" name="Encrypt personal data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Implement encryption at rest (see guidance below) or give a risk-based explanation as to why encryption was not implemented.&lt;br /&gt;&lt;br /&gt;Use well-known encryption libraries, taking into account the data use, and do not invent your own. 
+          &lt;br /&gt;
+              &lt;ul&gt;
+              &lt;li&gt;personal data must be encrypted&lt;/li&gt;
+              &lt;li&gt;data that is not used by the application (e.g. passwords, ...) should be hashed so they cannot be recovered easily&lt;/li&gt;
+              &lt;/ul&gt;
+          </desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OWASP Pro active controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+            <reference name="OWASP Proactive controls [C8]" url="https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf"/>
+          </references>
+          <standards>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.12.2" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="8.3.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                &lt;ol&gt;
+                &lt;li&gt;Verify that users' personal data processed by the application is encrypted at rest (e.g. databases).&lt;/li&gt;
+                &lt;li&gt;If encryption is not being leveraged, verify that there is documentation outlining the reasoning for that decision.&lt;/li&gt;
+                &lt;/ol&gt;
+                &lt;/div&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-306-SERVICE" name="Require authentication before presenting restricted data" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The application should ensure users have undergone an Identification and Verification (ID&amp;amp;V) process before allowing access to secret, sensitive or otherwise restricted data. For less sensitive but still restricted data, simple verification of the location of the user may suffice (e.g. IP restrictions).&lt;/p&gt;&lt;ul&gt;&lt;li&gt;For non-sensitive but non-public data, access could be restricted by IP address, limiting access to internal networks, workstations, or gateways&lt;/li&gt;&lt;li&gt;For more sensitive data, TLS client-side certificates may be appropriate&lt;/li&gt;&lt;li&gt;Where secret or other sensitive data is handled, a full authentication process to identify and validate users with single or multi-factor authentication may be required&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="EU GDPR - EU Data Protection" url="https://ec.europa.eu/justice/data-protection/reform/files/regulation_oj_en.pdf"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA IA-01 Identification And Authentication Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/181-08_02_IA-01"/>
+            <reference name="OSA SI-04 Information System Monitoring Tools And Techniques" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/42-08_02_SI-04"/>
+            <reference name="OSA SI-12 Information Output Handling And Retention" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/50-08_02_SI-12"/>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+          </references>
+          <standards>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-21" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-22" supportedStandardRef="NIST 800-53"/>
+            <standard ref="Art.32" supportedStandardRef="EU-GDPR"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.AE-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-1" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-5" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-6" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.CM-7" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-5" supportedStandardRef="nist-csf"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="IA-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-8" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.AN-1" supportedStandardRef="nist-csf"/>
+            <standard ref="RS.CO-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-12" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-4" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;
+                &lt;li&gt;Identify which parts of the service present sensitive data.&amp;nbsp;&lt;/li&gt;
+                &lt;li&gt;Try to obtain access to this information without any type of authentication, for example, attempt to navigate directly to URLs that present sensitive data.&lt;/li&gt;
+                &lt;/ol&gt;
+            </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="RESTRICT-SERVICE" name="Restrict access to the service at the network layer to reduce exposure" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Access to services should be restricted to expected sources, limiting the exposure of the service and its attack surface; and the likelihood of a malicious actor gaining access to the system.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;Apply network layer security controls so that only the necessary and expected IP addresses are permitted access to connect to the service.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OWASP Juice Shop: Broken Authentication" url="https://pwning.owasp-juice.shop/part2/broken-authentication.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="10" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.7.18" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="3" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A07:2021-Identification and Authentication Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A2:2017-Broken Authentication" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API1:2019-Broken Object Level Authorization" supportedStandardRef="owasp-api-security-top-10"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Check that the network access to the service is only allowed for the components which need it.&lt;/li&gt; 
+ &lt;li&gt;There should be a firewall protecting the network segment in which the service is installed.&lt;/li&gt; 
+ &lt;li&gt;Check that the firewall restricts all access and only permits the minimum connections required using the principal of least privilege.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:50.016">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-89-PREPARED" name="Use prepared statements for all database queries" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Database injection attacks, such as SQLi (SQL Injection) rely on sending tainted client-side data which is used in dynamic SQL queries on the server-side in an unsafe manner. Creating queries by concatenating strings using untrusted data may result in&amp;nbsp;vulnerable code;&amp;nbsp;for example, an attacker appending an 'OR' statement to the customerName parameter in order to bypass checks and retrieve additional data from the database:&lt;/p&gt;&lt;p&gt;
+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;String query = "SELECT user FROM users WHERE name = '"&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;+ request.getParameter("customerName")+"'";&lt;/p&gt;&lt;p&gt;The use of prepared statements with carefully controlled and validated input conditions mitigates SQLi and related attacks.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Database queries should always be executed using prepared statements or parameterized queries.&lt;/li&gt;&lt;li&gt;Queries through an Object-Relational mapper should also be treated as tainted input, and again executed using prepared statements to mitigate the threat.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations>
+            <implementation platform="C#">
+              <desc>ClN0cmluZyBxdWVyeSA9ICJTRUxFQ1QgYWNjb3VudF9iYWxhbmNlIEZST00gdXNlcl9kYXRhIFdIRVJFIHVzZXJfbmFtZSA9ID8iOwp0cnkgewogCU9sZURiQ29tbWFuZCBjb21tYW5kID0gbmV3IE9sZURiQ29tbWFuZChxdWVyeSwgY29ubmVjdGlvbik7CiAJY29tbWFuZC5QYXJhbWV0ZXJzLkFkZChuZXcgT2xlRGJQYXJhbWV0ZXIoImN1c3RvbWVyTmFtZSIsIEN1c3RvbWVyTmFtZSBOYW1lLlRleHQpKTsKIAlPbGVEYkRhdGFSZWFkZXIgcmVhZGVyID0gY29tbWFuZC5FeGVjdXRlUmVhZGVyKCk7IAkKIH0gY2F0Y2ggKE9sZURiRXhjZXB0aW9uIHNlKSB7CiAJLy8gZXJyb3IgaGFuZGxpbmcKIH0g</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;For inputs receiving data that is subsequently added to - or used - in an SQL query:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Ensure SQL meta-characters are identified and properly escaped or encoded.&lt;/li&gt;&lt;li&gt;Data should used be in the form of parameterized SQL queries, rather than dynamically generated queries.&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;To test data validation:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the code processing potentially tainted user input to SQL queries and confirm the data is executed only in pre-prepared parameterized SQL queries.&lt;/li&gt;&lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.)&lt;/li&gt;&lt;li&gt;Pass invalid input to the application and review error trapping and handling.&lt;/li&gt;&lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-27T12:41:49.679">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="ACCESS SERVICE" name="Access service" desc="" library="CS-Default">
+          <threats>
+            <threat ref="VULN-SERVICE" name="Attackers gain access to unauthorised data by exploiting vulnerabilities in the service" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Attackers exploit vulnerabilities in the service and gain access to data, or to
+                                services for which they are not authorized.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-284">
+                  <countermeasures>
+                    <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                    <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="PATCH-SERVICE" mitigation="50"/>
+                <countermeasure ref="RESTRICT-SERVICE" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-115" name="Authentication Bypass" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An attacker gains access to the application, service, or device with the privileges of an authorized or privileged user by evading - or circumventing - an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. &lt;/p&gt; This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to access secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-306">
+                  <countermeasures>
+                    <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-306-SERVICE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="EU-GDPR-DATA_LEAKAGE-UNAUTHZ-PARTIES" name="Data leakage or disclosure to unauthorized parties" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An unauthorized party might access/breach the personal data of a data subject.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="75" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="EU-GDPR-MISSING-ENCRYPTION-SENSITIVE-DATA">
+                  <countermeasures>
+                    <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="EU-GDPR-ENCRYPT-PERSONAL-DATA" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication" name="Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="AUTH-DATASTORE-LEAST-PRIV" name="Attackers who compromise the application or application server could directly access and modify the data store" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>If attackers gain access to the application or the application server, then they could
+                                directly access the data store using the privilege assigned to the application.
+                                &lt;div&gt;
+                                If the data store user account used by the application has elevated privileges then this
+                                could allow attackers to perform unauthorized operations such as dropping tables,
+                                modifying the database schema or modifying data.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="1" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="RESTRICT-ACCESS-DATABASE" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-66" name="Attackers gain unauthorised access to data and/or systems through SQL Injection attacks" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;Successful SQL Injection attacks could lead to full compromise of the database or to a partial compromise of only the data visible to the application.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Typically, these types of attacks result in unauthorized disclosure of sensitive data, but can also be used to inject spurious data into the database or to drop tables and deny services to legitimate users.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="25" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-89">
+                  <countermeasures>
+                    <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-89-PREPARED" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="00aff6c2-f18c-4317-98d5-056f2e20e224" diagramComponentId="4536b78b-e1a0-4b2d-8415-c73dfb9c9997" ref="b0cec9ef-1745-4dcf-9c27-597a3d8c5c1a" name="Web UI" desc="" library="CS-Default" parentComponentRef="295a899b-e1f6-4ff3-8227-1dd1855f2ab6" componentDefinitionRef="web-ui">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="CWE-798, CWE-603" name="Client side code stores secret keys, sensitive business logic or other proprietary information" state="0" impact="100" issueId="" issueLink="">
+          <desc>When client side code is fully controlled by the user, a malicious user may be able to read the code or reverse engineer it if it is compiled in any form. If the client side code includes secret keys, sensitive business logic (like client authentication) or proprietary information, all of this is directly exposed to the user, allowing them to get the sensitive information or study the business logic with the aim of bypassing it.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br /&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Some examples of this vulnerability are:&amp;nbsp; 
+ &lt;div&gt; 
+  &lt;ul&gt; 
+   &lt;li&gt;Performing an authentication on the client side without server side validation.&amp;nbsp;&lt;/li&gt; 
+   &lt;li&gt;Making privileged calls from the client based solely on client side conditions (i.e. a cash check on the client side to place an order on an e-commerce platform).&lt;/li&gt; 
+   &lt;li&gt;&amp;nbsp;Hard-coding keys and secrets on the client side to make client-to-client calls without a proxy.&lt;/li&gt; 
+  &lt;/ul&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.266">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-602: client-side Enforcement of Server-Side Security" url="https://cwe.mitre.org/data/definitions/602.html"/>
+              <reference name="CWE-603: Use of client-side Authentication" url="https://cwe.mitre.org/data/definitions/603.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-250" name="Execution with Unnecessary Privileges" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software performs an operation at a privilege level that is higher than the minimum level
+                        required, which creates new weaknesses or amplifies the consequences of other weaknesses.
+
+                        New weaknesses can be exposed because running with extra privileges, such as root or
+                        Administrator, can disable the normal security checks being performed by the operating system or
+                        surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
+                        they occur while operating at raised privileges. Privilege management functions can behave in
+                        some less-than-obvious ways, and they have different quirks on different platforms. These
+                        inconsistencies are particularly pronounced if you are transitioning from one non-root user to
+                        another. Signal handlers and spawned processes run at the privilege of the owning process, so if
+                        a process is running as root when a signal fires or a sub-process is executed, the signal
+                        handler or sub-process will operate with root privileges.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.977">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-250: Execution with Unnecessary Privileges" url="https://cwe.mitre.org/data/definitions/250.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-79" name="Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not neutralize or incorrectly neutralizes user-controllable input before it
+                        is placed in output that is used as a web page that is served to other users. Cross-site
+                        scripting (XSS) vulnerabilities occur when:
+                        &lt;ol&gt;
+                        &lt;li&gt;Untrusted data enters a web application, typically from a web request.&lt;/li&gt;
+                        &lt;li&gt;The web application dynamically generates a web page that contains this untrusted
+                        data.&lt;/li&gt;
+                        &lt;li&gt;During page generation, the application does not prevent the data from containing
+                        content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes,
+                        mouse events, Flash, ActiveX, etc.&lt;/li&gt;
+                        &lt;li&gt;A victim visits the generated web page through a web browser, which contains malicious
+                        script that was injected using the untrusted data.&lt;/li&gt;
+                        &lt;li&gt;Since the script comes from a web page that was sent by the web server, the victim's
+                        web browser executes the malicious script in the context of the web server's domain.&lt;/li&gt;
+                        &lt;li&gt;This effectively violates the intention of the web browser's same-origin policy, which
+                        states that scripts in one domain should not be able to access resources or run code in a
+                        different domain.&lt;/li&gt;
+                        &lt;/ol&gt;There are three main kinds of XSS:
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 1: Reflected XSS (or Non-Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The server reads data directly from the HTTP request and reflects it back in the HTTP response.
+                        Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a
+                        vulnerable web application, which is then reflected back to the victim and executed by the web
+                        browser. The most common mechanism for delivering malicious content is to include it as a
+                        parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed
+                        in this manner constitute the core of many phishing schemes, whereby an attacker convinces a
+                        victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's
+                        content back to the victim, the content is executed by the victim's browser.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 2: Stored XSS (or Persistent)&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        The application stores dangerous data in a database, message forum, visitor log, or other
+                        trusted data store. At a later time, the dangerous data is subsequently read back into the
+                        application and included in dynamic content. From an attacker's perspective, the optimal place
+                        to inject malicious content is in an area that is displayed to either many users or particularly
+                        interesting users. Interesting users typically have elevated privileges in the application or
+                        interact with sensitive data that is valuable to the attacker. If one of these users executes
+                        malicious content, the attacker may be able to perform privileged operations on behalf of the
+                        user or gain access to sensitive data belonging to the user. For example, the attacker might
+                        inject XSS into a log message, which might not be handled properly when an administrator views
+                        the logs.
+                        &lt;/blockquote&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;&lt;b&gt;Type 0: DOM-Based XSS&lt;/b&gt;&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;blockquote&gt;
+                        In DOM-based XSS, the client performs the injection of XSS into the page; in the other types,
+                        the server performs the injection. DOM-based XSS generally involves server-controlled, trusted
+                        script that is sent to the client, such as Javascript that performs sanity checks on a form
+                        before the user submits it. If the server-supplied script processes user-supplied data and then
+                        injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is
+                        possible.Once the malicious script is injected, the attacker can perform a variety of malicious
+                        activities. The attacker could transfer private information, such as cookies that may include
+                        session information, from the victim's machine to the attacker. The attacker could send
+                        malicious requests to a web site on behalf of the victim, which could be especially dangerous to
+                        the site if the victim has administrator privileges to manage that site. Phishing attacks could
+                        be used to emulate trusted web sites and trick the victim into entering a password, allowing the
+                        attacker to compromise the victim's account on that web site. Finally, the script could exploit
+                        a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes
+                        referred to as &amp;quot;drive-by hacking&amp;quot;.
+                        &lt;/blockquote&gt;
+                        &lt;blockquote&gt;
+                        &lt;br /&gt;
+                        &lt;/blockquote&gt;In many cases, the attack can be launched without the victim even being aware
+                        of it. Even with careful users, attackers frequently use a variety of methods to encode the
+                        malicious portion of the attack, such as URL encoding or Unicode, so the request looks less
+                        suspicious.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" url="https://cwe.mitre.org/data/definitions/79.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-830" name="Inclusion of Web Functionality from an Untrusted Source" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software includes web functionality (such as a web widget)
+                        from another domain, which causes it to operate within the domain of the
+                        software, potentially granting total access and control of the software to the
+                        untrusted source.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.769">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-20" name="Input to exported activities, intents or content providers is not validated" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not validate or incorrectly validates input that can affect the control flow
+                        or data flow of a program.
+
+                        When software does not validate input properly, an attacker is able to craft the input in a form
+                        that is not expected by the rest of the application. This will lead to parts of the system
+                        receiving unintended input, which may result in altered control flow, arbitrary control of a
+                        resource, or arbitrary code execution.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.644">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-20: Input to exported activities, intents or content providers is not validated" url="https://cwe.mitre.org/data/definitions/20.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-NOSNIFF" name="Internet Explorer could allow Cross Site Scripting attacks through content sniffing" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The product does not use - or incorrectly uses - a protection mechanism providing defense against attacks on the product. This weakness covers three distinct situations:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack.&lt;/li&gt;&lt;li&gt;An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended.&lt;/li&gt;&lt;li&gt;An "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.976">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-84-HTTP-ONLY" name="Lack of 'HttpOnly' flag on session cookie" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;p&gt;The web application improperly neutralizes user-controlled input for executable scripts disguised with URI encodings.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page" url="https://cwe.mitre.org/data/definitions/84.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="WEB-CSP" name="Lack of Content Security Policy version 2 (CSPv2)" state="0" impact="100" issueId="" issueLink="">
+          <desc>Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site
+                        scripting (XSS), click jacking and other code injection attacks resulting from execution of
+                        malicious content in the trusted web page context.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="lack-automated-vuln-identification" name="Lack of automated vulnerability identification" state="0" impact="100" issueId="" issueLink="">
+          <desc>Developmental security testing/evaluation is not enforced during post-design phases of the system development life cycle. Such testing/evaluation is necessary because it confirms that the required security controls are implemented correctly, operating as intended, enforcing the desired security policy, and meeting established security requirements.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.502">
+              <output/>
+            </source>
+            <references>
+              <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-311" name="Missing Encryption of Sensitive Data" state="0" impact="100" issueId="" issueLink="">
+          <desc>The software does not encrypt sensitive or critical information
+                        before storage or transmission.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-312" name="Secrets, API keys and or passwords are included in the source code or online repositories" state="0" impact="100" issueId="" issueLink="">
+          <desc>API keys, passwords or secrets included in the source code or in the configuration files can be leaked to users with access to the code. This access can be incidentally granted by publishing the source code on a package-form or an online, public repository.
+
+          The unauthorized access to any of those secrets could lead to a compromise of sensitive data or a system.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-312: Secrets, API keys and or passwords are included in the source code or online repositories" url="https://cwe.mitre.org/data/definitions/312.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-693-CLICKJACK" name="The page can be included in an iframe" state="0" impact="100" issueId="" issueLink="">
+          <desc>The product does not use or incorrectly uses a protection mechanism that provides sufficient
+                        defense against directed attacks against the product. This weakness covers three distinct
+                        situations:
+                        &lt;div&gt;
+                        &lt;ul&gt;
+                        &lt;li&gt;A &amp;quot;missing&amp;quot; protection mechanism occurs when the application does
+                        not define any mechanism against a certain class of attack.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;An &amp;quot;insufficient&amp;quot; protection mechanism might provide some defenses -
+                        for example, against the most common attacks - but it does not protect against everything that
+                        is intended.&amp;nbsp;&lt;/li&gt;
+                        &lt;li&gt;Finally, an &amp;quot;ignored&amp;quot; mechanism occurs when a mechanism is available
+                        and in active use within the product, but the developer has not applied it in some code path.&lt;/li&gt;
+                        &lt;/ul&gt;
+                        &lt;/div&gt;
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.977">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-693: Protection Mechanism Failure" url="https://cwe.mitre.org/data/definitions/693.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-477" name="Use of Obsolete Function" state="0" impact="75" issueId="" issueLink="">
+          <desc>The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
+&lt;br /&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.266">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-477: Use of Obsolete Function" url="https://cwe.mitre.org/data/definitions/477.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CWE-327" name="Use of a Broken or Risky Cryptographic Algorithm" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in
+                        the exposure of sensitive information.
+                    </desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.267">
+              <output/>
+            </source>
+            <references>
+              <reference name="CWE-327: Use of a Broken or Risky Cryptographic Algorithm" url="https://cwe.mitre.org/data/definitions/327.html"/>
+            </references>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="WEB-CSP" name="Define a restrictive 'least privilege' Content Security Policy" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The Content-Security-Policy instructs compliant browsers on how they may interact with external sites while in the current context. This enables the server to control interactive code and content from third parties, mitigating some client-side code injection attacks. The policy allows the server to specify what connections are permitted for each type of resource.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example, the following policy tells the browser to allow connections (including websockets) to the same domain to which the page was served: *.iriusrisk.com.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://*.iriusrisk.com; img-src 'self' data:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Define and set a Content-Security-Policy with least-privileges to allow only those interactions which are explicitly required.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to determine if a&amp;nbsp;&lt;i&gt;Content-Security-Policy&amp;nbsp;&lt;/i&gt;header is returned, and if so, that it follows the security practice of least-privilege.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the different component end-points.&lt;/li&gt;&lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite):&lt;ul&gt;&lt;li&gt;Browse the site through the proxy.&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;For more information on &lt;i&gt;Content-Security-Policy&lt;/i&gt; policy setup, see:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"&gt;https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP&lt;/a&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.876">
+              <output/>
+            </source>
+            <references>
+              <reference name="Mozilla Developer Documentation - CSP" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-319-TRANSPORT" name="Encrypt data between the client and server/service" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Data passed between the client and server should be protected by encryption in transit.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Implement cryptographically strong TLS end-to-end encryption between the client and server, terminating within a secure environment on the server-side.&lt;/li&gt;&lt;li&gt;Consider use of client certificates to prevent interception of (or man-in-the-middle attacks on) the encrypted connection.&lt;/li&gt;&lt;li&gt;Alternatively, asymmetric (public-key) encryption could be utilized and a recognized, proven, and tested implementation/library should be used&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-03 Access Enforcement" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/25-08_02_AC-03"/>
+            <reference name="OSA AC-06 Least Privilege" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/28-08_02_AC-06"/>
+            <reference name="OSA AC-14 Permitted Actions Without Identification Or Authentication" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/38-08_02_AC-14"/>
+            <reference name="OSA AC-16 Automated Labeling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/198-08_02_AC-16"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+          </references>
+          <standards>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="13.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="164.312(a)(1)(D)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="164.312(e)(1)(A)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L1+R"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2"/>
+            <standard ref="5.1" supportedStandardRef="OWASP-MASVS-L2+R"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="9.2.4" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="9.4.3" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-16" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.PT-3" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Check client to server connections use and enforce established encryption protocols, e.g. TLSv1.2.&lt;br&gt;&amp;nbsp;&lt;/li&gt;&lt;li&gt;Verify only strong cipher suites are in use and permitted.&lt;/li&gt;&lt;li&gt;Ensure attempts to use unencrypted transport mechanisms are rejected or redirected (e.g. HTTP instead of HTTPS)&lt;/li&gt;&lt;li&gt;Review configuration of protocols and services against best-practice guidelines.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.136">
+              <output/>
+            </source>
+            <references>
+              <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="ASSETS-HOSTED-BY-APP" name="Ensure that all application assets are hosted by the application" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>Review periodically all assets which are accessed by the application and ensure that these
+                        assets are hosted by the application. If this is not the case and there are assets in external
+                        providers or a CDN, you shall move these assets to be hosted by the application and remove them
+                        from external providers or CDNs.
+                    </desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SI-07 Software And Information Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/45-08_02_SI-07"/>
+          </references>
+          <standards>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-6" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-8" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-7" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all assets are hosted by the application, and not by external providers.
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.718">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="INS-CLIENT" name="Ensure the application does not use unsupported, insecure, or deprecated client-side technologies" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Ensure the application does not use unsupported, insecure, or deprecated client-side technologies such as: NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.&lt;/p&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.14.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;
+ &lt;li&gt;Test the presence of any client side applet such as Flash, ActiveX and Silverlight.&lt;/li&gt;
+&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.138">
+              <output/>
+            </source>
+            <references>
+              <reference name="Testing Information Gathering" url="https://www.owasp.org/index.php/Testing_Information_Gathering"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CS-CLIENT-SECRET" name="Implement sensitive logic and data validation on the server-side" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data and functionalities on the client-side must be considered tainted and subject to manipulation by a malicious actor, regardless of the controls in place (e.g. encryption or obfuscation of client-side code or content). &lt;/p&gt; This includes application logic decisions, such as access controls, and data considered sensitive or secret, such as encryption keys. While controls may be duplicated on the client-side to improve the user experience, it is important to have these enforced on the server-side.&amp;nbsp; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Business logic, in particular access controls, must be implemented on the server-side.&lt;/li&gt; 
+  &lt;li&gt;Secret data should be stored on the server-side, and only what is explicitly required should be duplicated on the client-side.&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt;All data provided from the client-side (even from binary clients) should be considered tainted, and security decisions should not be made solely on this data. For example, an insecure implementation could include a compiled application (e.g. Flash!) performing authentication on the client-side against a stored password. The decompilation of the binary (in this case flv file) or the interception and modification of controls between the client and server could expose the password or allow unauthorized access to the authenticated application content. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA AC-01 Access Control Policies and Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/23-08_02_AC-01"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: Broken Access Control" url="https://pwning.owasp-juice.shop/part2/broken-access-control.html"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+          </references>
+          <standards>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.7" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="4.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A01:2021-Broken Access Control" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A5:2017-Broken Access Control" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="AC-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="AC-24" supportedStandardRef="NIST 800-53"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-3" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-4" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.AC-6" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify where critical decisions are made on the application. Key areas include:&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;authentication&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;input validation&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;access to resources&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;state bypasses&amp;nbsp;&lt;/li&gt; 
+ &lt;/ul&gt; 
+ &lt;li&gt;Ensure those decisions are made or validated on the server side, particularly where client-side controls are implemented.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Verify that sensitive data passed to the client side is appropriate, and ensure no inappropriate data is stored or hard-coded into client-side components, for example&amp;nbsp;&lt;/li&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Personally Identifiable Information.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Financial data, in particular cardholder data (as defined by the &lt;span class="caps"&gt;PCI&lt;/span&gt; Council).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Application secrets - such as symmetric encryption keys or passwords.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-79-ENCODE" name="Perform contextual HTML encoding of all user submitted data" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received from the client-side should be considered tainted and a potential risk. If handled properly at the point of input, this untrusted tainted data should have been sanitized and encoded safely. The context when returning the data to the user is important, however, as this will affect what metacharacters have significance, and how they will be interpreted at the client-side. &lt;/p&gt;
+
+ For example, if data is inserted into the &lt;span class="caps"&gt;HTML&lt;/span&gt; body then &lt;span class="caps"&gt;HTML&lt;/span&gt; Entity encoding should be performed, but if the data is inserted into a JavaScript block, then JavaScript escaping should be performed. Similarly, while JavaScript code should not be executed in the browser when returned in an application/json response, it may then be rendered in an unsafe manner. 
+ - Apply contextual encoding to all tainted data when returned to the users (including secondary users if the application has multiple interfaces - e.g. an internal user viewing data entered by an external customer).
+ - This should be in addition to, and in conjunction with, sanitization and encoding applied at the time of data acquisition.</desc>
+          <implementations>
+            <implementation platform=".NET">
+              <desc>ClJlc3BvbnNlLldyaXRlKEh0dHBVdGlsaXR5Lkh0bWxFbmNvZGUoUmVxdWVzdC5Gb3JtWyJuYW1lIl0pKTs=</desc>
+            </implementation>
+          </implementations>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-02 Flaw Remediation" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/40-08_02_SI-02"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OWASP Juice Shop: XSS" url="https://pwning.owasp-juice.shop/part2/xss.html"/>
+          </references>
+          <standards>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.11" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A7:2017-Cross-Site Scripting (XSS)" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-12" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-14" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Identify the areas of the application in which tainted data acquired from outside the application presented back (e.g. user input, uploaded files, third party content)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Review the encoding and sanitization applied to the data before presentation.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;If possible, pass metacharacters and other unexpected content through the application to review the efficacy of the encoding.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="excessive-permissions" name="Request only the minimum required permissions" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Security best practices dictate that the practice of least-privilege be followed, thereby reducing the attack surface and risk of compromise. By limiting the access an application has to the system, developers may reduce the impact a compromise may have.&amp;nbsp;
+&lt;/div&gt;
+&lt;div&gt;
+  Request only the minimum required permissions. For example, if there is no requirement to use the camera then the application should not request this permission.
+&lt;/div&gt;
+&lt;div&gt;
+  Review features and functionalities present in the application, in particular legacy features, to determine if they are relevant and required, and if not remove them along with associated OS permissions.
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="10.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that the application only requests the necessary permissions to work correctly.
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSD-CLIENT-SECRET" name="Review code, configuration, and online repositories for secrets and sensitive information systemically" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Secret or sensitive information should not be exposed in source-code or client-side software.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Code and online repositories must not contain secrets or sensitive information.&lt;/li&gt;&lt;li&gt;Configuration files on the client- and server-side must not contain hard-coded credentials or other sensitive data.&lt;/li&gt;&lt;li&gt;Online repositories, services, and other associated restricted content must have appropriate access controls in place.&lt;/li&gt;&lt;li&gt;Where sensitive information must be stored on the server side, it should be in memory for transient data, or encrypted if persistent. &amp;nbsp;Depending on the use case, this encryption may be asymmetric or public key, or symmetric using a shared secret. Note however that reversible encryption on the client-side and in-memory storage are still susceptible to client-side attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.2" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="2.10.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="AU-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-3" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Use automated tools to regularly search for keywords or regular expression patterns within the code, configuration and other files exposed on the client and server-side, and any remote repositories.&lt;/li&gt;&lt;li&gt;The scanning process must be triggered before the code is published (in particular for public/open source code) as once published it is likely to be archived (and any disclosed secrets would be exposed and/or have to be changed)&lt;/li&gt;&lt;li&gt;Review criteria and requirements for any temporary or persistent storage of sensitive or secret data on the client-side, and the protections in place.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:51.137">
+              <output/>
+            </source>
+            <references>
+              <reference name="Amazon git-secrets" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Microsoft Exchange 2016 Sensitive Information Patterns" url="https://technet.microsoft.com/en-us/library/jj150541(v=exchg.160).aspx"/>
+              <reference name="Prevents you from committing secrets and credentials into git repositories" url="https://github.com/awslabs/git-secrets"/>
+              <reference name="Seekret" url="https://github.com/apuigsech/seekret"/>
+            </references>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="use-analysis-static-code" name="Scan the code with static code analysis tools" issueId="" issueLink="" platform="" cost="0" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt;
+  Use periodically a static code analysis tool to analyze the code and detect potentially malicious code, such as time functions, unsafe file operations and networks connections. With the scanning of static code, we ensure the integrity of the application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="10.1.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="10.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+  Verify that a code analysis tool is in use and it is configured to detect potentially malicious code, such as time functions, unsafe file operations and network connections. 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:50.464">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-attributes-of-cookies" name="Secure Cookies with their attributes" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;The session ID exchange mechanism based on cookies provides multiple security features in the form of cookie attributes that can be used to protect the exchange of the session ID:&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Secure and HttpOnly Attribute:&lt;/strong&gt;&amp;nbsp;a secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag doesn't offer robust protection. Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;To mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and so the HttpOnlyflag should be set.&lt;/p&gt;&lt;p&gt;Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;SameSite Attribute: &amp;nbsp;&lt;/strong&gt;The SameSite attribute should be configured to limit exposure against cross-site request forgery attacks. There are two possibilities:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;strong&gt;Strict:&lt;/strong&gt; the browser will only send cookies if the request originated from the website that set the cookie. If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the Strict attribute will be included.&lt;/li&gt;&lt;li&gt;&lt;strong&gt;Lax:&lt;/strong&gt; if the attribute is set to Lax, same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site, for example, by following a link.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;By default SameSite is not configured, we need to configure it with one of the above types, as shown below:&lt;/p&gt;&lt;p&gt;Set-Cookie: key=value; SameSite=Strict&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Domain and Path Attributes:&lt;/strong&gt; The session token value issued after users have successfully identified and authenticated themselves is of equivalent value to the secrets the user presents to login, and must be protected accordingly.&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;If the cookie domain attribute is too liberal, the cookie may be accessible to other hosts within the parent domain. This is a particular issue in multi-tenanted hosting, or where applications are delivered as subdomains of a third party parent domain.&lt;/li&gt;&lt;li&gt;If the cookie path attribute is not appropriately restricted, the session token may be accessible from other applications or content on the server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The domain and the path attributes for the session cookie should be restricted to the fully qualified hostname on which the application is running.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;For example:&lt;/p&gt;&lt;p&gt;Set-Cookie: session=token; Path=/theapp/; Domain=myapp.example.com; secure; HTTPOnly&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;__Host- prefix:&lt;/strong&gt; ensure that all Cookies with a name starting with __Host- are:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path must be "/".&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="HttpOnly" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies"/>
+            <reference name="OWASP Proactive Controls [C6]" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet" url="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md"/>
+            <reference name="Owasp Cheatsheet: Session Management" url="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"/>
+            <reference name="[C3] OWASP Proactive Controls" url="https://www.owasp.org/index.php/OWASP_Proactive_Controls"/>
+            <reference name="__Host-Prefix" url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie"/>
+          </references>
+          <standards>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="3.4.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="7.1" supportedStandardRef="nist-800-63"/>
+            <standard ref="7.1.1" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ul&gt;&lt;li&gt;Using a browser, open the Web Developer tools.&lt;/li&gt;&lt;li&gt;Load the Network inspection tab.&lt;/li&gt;&lt;li&gt;Load the endpoints of the application which set cookies (send the Set-Cookie HTTP header).&lt;/li&gt;&lt;li&gt;Check that within the HTTP response, the Set-Cookie has:&lt;ul&gt;&lt;li&gt;the path and domain attributes set to the most restrictive path and domain respectively.&lt;/li&gt;&lt;li&gt;'HttpOnly' and 'secure' flag set and configured&lt;/li&gt;&lt;li&gt;'SameSite' attribute configured.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Check that all Cookies with a name starting with __Host- are:&lt;ul&gt;&lt;li&gt;set with the secure flag,&lt;/li&gt;&lt;li&gt;from a secure page (HTTPS),&lt;/li&gt;&lt;li&gt;does not have a domain specified (and therefore aren't sent to subdomains)&lt;/li&gt;&lt;li&gt;and the path is"/".&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ul&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-693-NOSNIFF" name="Set the HTTP security header 'X-Content-Type-Options' from the server" issueId="" issueLink="" platform="" cost="0" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;A number of browser-based attacks rely on incorrectly stating MIME types on content in an attempt to bypass server and browser controls to render malicious content to the user.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Set the &lt;i&gt;X-Content-Type-Options: nosniff&lt;/i&gt;&amp;nbsp;header on any page that displays previously uploaded content to prevent some XSS and related attacks.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;div&gt;
+                            &lt;ol&gt;
+                            &lt;li&gt;Review the HTTP Server responses to ensure the&amp;nbsp;&lt;i&gt;&lt;i&gt;X-Content-Type-Options:
+                            nosniff&lt;/i&gt;&amp;nbsp;&lt;/i&gt;header is returned.&lt;/li&gt;
+                            &lt;li&gt;Using a browser:&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Open the Web Developer Console.&amp;nbsp;&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Make requests to the different component's endpoints.&amp;nbsp;&lt;/li&gt;
+                            &lt;li&gt;Verify the header is always returned as part of these responses&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;/li&gt;
+                            &lt;ul&gt;
+                            &lt;li&gt;Browse the site through the proxy&lt;/li&gt;
+                            &lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;
+                            &lt;/ul&gt;
+                            &lt;/ol&gt;
+                            &lt;/div&gt;
+                        </steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="@cwe-693-clickjack" name="Set the HTTP security header 'X-Frame-Options header' from the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Prevent the page from being framed by setting the X-Frame-Options header&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Set the X-Frame-Options header to the value: SAMEORIGIN or DENY. &amp;nbsp;This header is honored by the following browser versions:&amp;nbsp;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Chrome 4.1.249.1042&lt;/li&gt;&lt;li&gt;Firefox (Gecko) 3.6.9&lt;/li&gt;&lt;li&gt;Internet Explorer 8.0 9.0&lt;/li&gt;&lt;li&gt;Opera 10.50Safari 4.0&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Newer versions may also support the additional value: ALLOW-FROM which allows specifying URLs that are permitted to frame the page.&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA CM-02 Baseline Configuration" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/153-08_02_CM-02"/>
+            <reference name="OSA CM-06 Configuration Settings" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/157-08_02_CM-06"/>
+            <reference name="OWASP Secure Headers" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+            <reference name="OWASP Secure Headers Project" url="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project"/>
+          </references>
+          <standards>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="14.4.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="CM-2" supportedStandardRef="NIST 800-53"/>
+            <standard ref="CM-6" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.AE-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-7" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.IP-1" supportedStandardRef="nist-csf"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;Review the HTTP Server responses to ensure the&lt;i&gt;&amp;nbsp;X-Frame-Options: DENY &lt;/i&gt;header is returned.&lt;/li&gt;&lt;li&gt;Using a browser:&lt;/li&gt;&lt;li&gt;Open the Web Developer Console.&lt;ul&gt;&lt;li&gt;Make requests to the component's endpoints.&lt;/li&gt;&lt;li&gt;Verify the following header is always returned as part of these responses&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Using an intercepting proxy (e.g. OWASP Zap, BurpSuite)&lt;ul&gt;&lt;li&gt;Browse the site through the proxy&lt;/li&gt;&lt;li&gt;Review server responses and/or use automated scanning to analyze headers&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.877">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="secure-communication-ra-and-csp" name="Use secure communication between CSP and RA" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;In situations where the verifier and CSP are separate entities, communications between RA (Registration Authority) and CSP (Credential Service Provider), should be authenticated with a mutually-authenticated secure channel, such as a client-authenticated TLS connection, using approved cryptographic algorithms.&lt;/p&gt;
+&lt;p&gt;NIST's digital identity model involves some entities:&lt;/p&gt;
+&lt;p&gt;- CSP (Credential Service Provider): A credential service provider is a trusted entity that issues security tokens or electronic credentials to subscribers. A CSP forms part of an authentication system, most typically identified as a separate entity in a Federated authentication system. A CSP may be an independent third party, or may issue credentials for its own use. Credential Service Provider is typically also the Identity Provider (IDP). An example of a CSP would be an online site whose primary purpose may be, for example, internet banking - but whose users may be subsequently authenticated to other sites, applications or services without further action on their part.&lt;/p&gt;
+&lt;p&gt;- Registration Authority (RA): A trusted entity that establishes and vouches for the identity of a subscriber to a CSP. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP.&lt;/p&gt;
+&lt;p&gt;- Verifier: This refers to an entity that verifies the claimant's identity by verifying the claimant's possession and control of one or two authenticators, using an authentication protocol.&lt;/p&gt;
+&lt;p&gt;- RP (Relying party): This refers to an entity that relies on the subscriber's authenticator(s) and credentials or a verifier's assertion of a claimant's identity, typically to process a transaction or grant access to information or a system.&lt;/p&gt;
+&lt;p&gt;- Applicant: This refers to a subject undergoing the processes of enrollment and identity proofing.&lt;/p&gt;
+&lt;p&gt;- Claimant: This refers to a subject whose identity is to be verified using one or more authentication protocols.&lt;/p&gt;
+&lt;p&gt;- Subscriber: This refers to a party who has received a credential or an authenticator from a CSP.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="NIST 800-63-1" url="https://csrc.nist.rip/groups/SMA/forum/documents/feb2012_nist-sp-800-63-1_newton-perlner.pdf"/>
+            <reference name="NIST 800-63C" url="https://pages.nist.gov/800-63-3/sp800-63c.html"/>
+          </references>
+          <standards>
+            <standard ref="2.2.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="nist-800-63"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Verify the CSP and RA communicate securely with a secure channel, for example with TLS.&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.138">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="DATA-VAL" name="Validate all data received" issueId="" issueLink="" platform="" cost="1" risk="46" state="Recommended" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;All data received should be considered tainted and a potential risk, regardless of the source or transport method. For example, while hidden form fields, cookies or other headers may be obfuscated from a user, along with parameters passed in ViewStates or other encapsulated forms. These can be modified by the user on the client-side in memory, or in transit on the network. Similarly, data passed from binary or compiled components can be modified in situ or in transit. &lt;i&gt;&lt;/i&gt; &lt;i&gt;Furthermore, encryption only secures the data in transit between the two ends of the encrypted tunnel (one of which is typically controlled by the client); data passing through the link may still be malicious.&lt;/i&gt; &lt;/p&gt; As such, all data from the client side must be subjected to strict validation, sanitization, and encoding against expected syntactic and semantic criteria. 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Define a specification of the data that is expected at each input; both the syntax (e.g. alphanumeric only) and semantics (e.g. a word of between 1 and 25 characters, or a specific list). As an example of business rule logic, &amp;quot;boat&amp;quot; may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as &amp;quot;red&amp;quot; or &amp;quot;blue.&amp;quot;&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Implement a 'known good' or white-list approach, where only inputs that meet the strict criteria for each input are accepted, and reject, transform, or encapsulate any non-compliant data.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;While useful for identifying malicious content, do not rely on looking for specific malformed or attack payloads (blacklists). It is almost impossible to maintain a comprehensive and accurate blacklist due to the complexity and evolving nature of attacks, opportunities to obfuscate payloads, and changes to the code's execution environment. As noted, blacklists can be useful for detecting and logging potential attacks, or determining which inputs are so malformed that they should be rejected outright.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Validate all data received from the client, including values such as &lt;span class="caps"&gt;HTTP&lt;/span&gt; headers and cookie values if these are used as input on the server side, X- headers, and other platform specific data objects passed between the client and server.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-13 Use Of Cryptography" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/73-08_02_SC-13"/>
+            <reference name="OSA SI-01 System And Information Integrity Policy And Procedures" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/39-08_02_SI-01"/>
+            <reference name="OSA SI-03 Malicious Code Protection" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/41-08_02_SI-03"/>
+            <reference name="OSA SI-10 Information Accuracy, Completeness, Validity, And Authenticity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/48-08_02_SI-10"/>
+            <reference name="OSA SI-11 Error Handling" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/49-08_02_SI-11"/>
+            <reference name="OWASP Juice Shop: Injection" url="https://pwning.owasp-juice.shop/part2/injection.html"/>
+            <reference name="OWASP Juice Shop: Insecure Deserialization" url="https://pwning.owasp-juice.shop/part2/insecure-deserialization.html"/>
+          </references>
+          <standards>
+            <standard ref="1" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.5.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="11.1.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="12.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="12.3.5" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="12.6.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="14" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="15" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="16" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="17" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="18" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="19" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.10" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.10.12" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-0"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-1"/>
+            <standard ref="2.4.11.9" supportedStandardRef="iotsf-class-2"/>
+            <standard ref="24" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="31" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.1.4" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.3" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.6" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.2.7" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.10" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="5.3.8" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="6" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="8" supportedStandardRef="csa-api-security-guidelines"/>
+            <standard ref="A03:2021-Injection" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A08:2021-Software and Data Integrity Failures" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A10:2021-Server-Side Request Forgery (SSRF)" supportedStandardRef="owasp-top-10-2021"/>
+            <standard ref="A1:2017-Injection" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="A8:2017-Insecure Deserialization" supportedStandardRef="owasp-top-10-2017"/>
+            <standard ref="API8:2019-Injection" supportedStandardRef="owasp-api-security-top-10"/>
+            <standard ref="CA-8" supportedStandardRef="NIST 800-53"/>
+            <standard ref="DE.CM-4" supportedStandardRef="nist-csf"/>
+            <standard ref="DE.DP-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-1" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.GV-3" supportedStandardRef="nist-csf"/>
+            <standard ref="ID.RA-1" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-low-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-13" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-1" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-10" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-15" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SI-3" supportedStandardRef="NIST 800-53"/>
+            <standard ref="cwe-top-25" supportedStandardRef="cwe-top-25-dangerous-weaknesses"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;Identify data input points for the application, for example:&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Forms with user input (including hidden fields)&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;API&lt;/span&gt; calls&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;&lt;span class="caps"&gt;HTTP&lt;/span&gt; Headers&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Application states such as &lt;span class="caps"&gt;ASP&lt;/span&gt; Viewstates&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Serialized Java objects&lt;/li&gt; 
+ &lt;li&gt;Any data structure received from the client-side&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For every input, define accepted input (both syntactic and semantic criteria)&lt;/li&gt; 
+ &lt;li&gt;Where possible, define a white-list of accepted input or characters&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;For each of the inputs, ensure that the data is validated against the defined whitelists (for example with a regular expression) before being processed.&amp;nbsp;&lt;/li&gt; 
+&lt;/ul&gt;To test data validation:&amp;nbsp; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;p&gt;&lt;/p&gt; 
+&lt;ul&gt; 
+ &lt;li&gt;Review the acceptable input criteria, and build test cases that deviate from it (invalid characters, lengths, ranges etc.).&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Pass invalid input to the application and review error trapping and handling.&amp;nbsp;&lt;/li&gt; 
+ &lt;li&gt;Where unexpected exceptions occur, the application may be vulnerable to attack.&lt;/li&gt; 
+&lt;/ul&gt; 
+&lt;p&gt;&lt;/p&gt; A number of tools can be used to aid in testing: 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Directly from your browser with the Developer Tools.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a browser extension which allows you to modify the request and responses on the fly (i.e. Tamper Data).&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Using a proxy which allows you to modify the request and response on the fly (i.e. &lt;span class="caps"&gt;OWASP&lt;/span&gt; &lt;span class="caps"&gt;ZAP&lt;/span&gt;, Burp, Fiddler, etc.).&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:50.579">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-295-CLIENT" name="Validate the certificate presented by the server" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;Certificates presented by the server must be valid, provable, and cryptographically secure in order to derive the benefits of TLS encrypted communications.&amp;nbsp; Invalid certificates expose the application and its users to spoofing attacks such as Man In The Middle (MITM) where data may be intercepted or redirected to a malicious site, and undermine confidence in the site.&lt;/p&gt;&lt;p&gt;Validate the certificate presented by the server is signed by a trusted Certificate Authority.&lt;/p&gt;&lt;p&gt;Ensure the certificate chain of trust is legitimate and secure.&lt;/p&gt;&lt;p&gt;Verify cryptographically secure ciphers are in use throughout the chain, in particular strong hashing algorithms for certificate signatures.&amp;nbsp;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="OSA SC-11 Trusted Path" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/71-08_02_SC-11"/>
+            <reference name="OSA SC-17 Public Key Infrastructure Certificates" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/77-08_02_SC-17"/>
+          </references>
+          <standards>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="1.9.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.2.1" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-11" supportedStandardRef="NIST 800-53"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-17" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Verify the client is conducting appropriate checks and receives a positive response regarding the validity and quality of the site certificate.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the server certificate, and those in the trust chain.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.137">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CWE-327" name="Validate the TLS implementation in use" issueId="" issueLink="" platform="" cost="0" risk="0" state="N/A" owner="iriusrisk21@st.by" library="CS-Default" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;There are a number of established open- and closed- source TLS implementations in use, which have undergone extensive review and testing by the developers, as well as third-parties in the development, security, and cryptography space. Typically, these widely used implementations have a lower risk of exploitation compared with privately developed - or less known - implementations (although vulnerabilities such as Heartbleed highlight this is not universally true) due to this additional scrutiny scrutiny.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;Identify the TLS and other cryptographic libraries, implementations, and technologies in use.&lt;/li&gt;&lt;li&gt;Verify the veracity of the implementations, and review third party validations together with security advisories or best-practices relating to them.&lt;/li&gt;&lt;li&gt;Some well-known TLS libraries are NSS from Mozilla, and OpenSSL.&lt;/li&gt;&lt;li&gt;Where an unknown or unproven implementation is in use, consider use of an established option.&lt;/li&gt;&lt;/ul&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Mozilla SSL Compatibility" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+            <reference name="Mozilla SSL Config" url="https://ssl-config.mozilla.org/"/>
+            <reference name="OSA SC-08 Transmission Integrity" url="https://www.opensecurityarchitecture.org/cms/library/08_02_control-catalogue/68-08_02_SC-08"/>
+            <reference name="Server Side TLS Configuration" url="https://wiki.mozilla.org/Security/Server_Side_TLS"/>
+          </references>
+          <standards>
+            <standard ref="13.2.1" supportedStandardRef="ISO/IEC 27002:2013"/>
+            <standard ref="164.312(e)(1)(B)" supportedStandardRef="hipaa-addressable"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-1"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-2"/>
+            <standard ref="9.1.2" supportedStandardRef="owasp-asvs4-level-3"/>
+            <standard ref="PR.DS-2" supportedStandardRef="nist-csf"/>
+            <standard ref="PR.DS-5" supportedStandardRef="nist-csf"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-high-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="fedramp-moderate-baseline"/>
+            <standard ref="SC-8" supportedStandardRef="NIST 800-53"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;ol&gt;&lt;li&gt;Confirm the TLS layer in use is a secure, stable, release of a publicly published implementation that has been subject to expert analysis and review.&lt;ul&gt;&lt;li&gt;If not, assurance of the security of the implementation should be sought, or the risk quantified.&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&lt;li&gt;Verify that a client connecting to the server will only be able to negotiate cryptographically strong, secure ciphers.&lt;/li&gt;&lt;li&gt;Confirm that a client can not downgrade to a weaker cipher after initial negotiation.&lt;/li&gt;&lt;li&gt;Use TLS analysis tools to check and rate the server security, for example:&lt;ol&gt;&lt;li&gt;SSL Labs SSL Server Test:&amp;nbsp;https://www.ssllabs.com/ssltest/&lt;/li&gt;&lt;li&gt;sslscan tool: https://github.com/rbsec/sslscan&lt;/li&gt;&lt;li&gt;testssh.sh tool: https://github.com/drwetter/testssl.sh&lt;/li&gt;&lt;/ol&gt;&lt;/li&gt;&lt;li&gt;Remediate all security issues and warnings relating to the TLS/SSL ciphers, protocols, and security mechanisms.&lt;/li&gt;&lt;/ol&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:51.138">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="GENERAL" name="General" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-20">
+                  <countermeasures>
+                    <countermeasure ref="DATA-VAL" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="DATA-VAL" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="sec-vuln-dev-process" name="Application contains security vulnerabilities not identified during the development process" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Application security should be embedded into a project's development environment, allowing developers to monitor their code regularly in order to avoid security vulnerabilities when the application is deployed in the production environment.</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references>
+                <reference name="NIST Security Considerations in the System Development Life Cycle" url="https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/archive/2008-10-16"/>
+                <reference name="Risk-Based and Functional Security Testing" url="https://www.us-cert.gov/bsi/articles/best-practices/security-testing/risk-based-and-functional-security-testing"/>
+              </references>
+              <weaknesses>
+                <weakness ref="lack-automated-vuln-identification">
+                  <countermeasures>
+                    <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="use-analysis-static-code" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CWE-937-WEB" name="Attackers gain unauthorised access to data by compromising third party web resources" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Web applications typically make extensive use of 3rd party web resources such as
+                                JavaScript and CSS files.&amp;nbsp; Should attackers gain access to the source code
+                                repositories, or even Content Delivery Networks that host these libraries, then they
+                                could gain access to applications that use this content.
+                                &lt;div&gt;
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-830">
+                  <countermeasures>
+                    <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="ASSETS-HOSTED-BY-APP" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CSD-CLIENT-SECRET" name="Attackers gain unauthorised access to data or services by accessing a client side secret" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>Secrets stored in any client side components, such as a mobile application, thick
+                                client application or in JavaScript used by a browser, can be accessed by
+                                users/attackers who have access to this client.
+                                &lt;div&gt;
+                                &lt;br /&gt;
+                                &lt;/div&gt;
+                                &lt;div&gt;
+                                Attackers could then gain access to the data or services that are protected by this
+                                secret, if no other credentials are required.
+                                &lt;/div&gt;
+                            </desc>
+              <riskRating confidentiality="100" integrity="50" availability="50" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-312">
+                  <countermeasures>
+                    <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-798, CWE-603">
+                  <countermeasures>
+                    <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CS-CLIENT-SECRET" mitigation="50"/>
+                <countermeasure ref="CSD-CLIENT-SECRET" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="DEP-CLIENT-TECH" name="Attackers gain unauthorised access to the application by the use of deprecated client-side technologies" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;div&gt;
+  As programming languages evolve, functions occasionally become obsolete due to:
+&lt;/div&gt;
+&lt;ul&gt;
+ &lt;li&gt;Advances in the language.&lt;/li&gt;
+ &lt;li&gt;Improved understanding of how operations should be performed effectively and securely.&lt;/li&gt;
+ &lt;li&gt;Changes in the conventions that govern certain operations. &lt;/li&gt;
+&lt;/ul&gt;
+&lt;br /&gt;Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.
+&lt;br /&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-477">
+                  <countermeasures>
+                    <countermeasure ref="INS-CLIENT" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="INS-CLIENT" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="READ OR POST DATA" name="Read or Post data" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-63" name="An adversary embeds malicious scripts in content that will be served to web browsers" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.&lt;/p&gt;</desc>
+              <riskRating confidentiality="50" integrity="50" availability="1" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-NOSNIFF">
+                  <countermeasures>
+                    <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-79">
+                  <countermeasures>
+                    <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-84-HTTP-ONLY">
+                  <countermeasures>
+                    <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="WEB-CSP">
+                  <countermeasures>
+                    <countermeasure ref="WEB-CSP" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-693-NOSNIFF" mitigation="25"/>
+                <countermeasure ref="CWE-79-ENCODE" mitigation="25"/>
+                <countermeasure ref="WEB-CSP" mitigation="25"/>
+                <countermeasure ref="secure-attributes-of-cookies" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="NTW-MITM" name="Attackers could gain access to sensitive data through a man in the middle attack" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed to the other component as if it were never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identity between two components.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-311">
+                  <countermeasures>
+                    <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                    <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                    <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CWE-327">
+                  <countermeasures>
+                    <countermeasure ref="CWE-327" mitigation="25"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CWE-295-CLIENT" mitigation="25"/>
+                <countermeasure ref="CWE-319-TRANSPORT" mitigation="25"/>
+                <countermeasure ref="CWE-327" mitigation="25"/>
+                <countermeasure ref="secure-communication-ra-and-csp" mitigation="25"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="CAPEC-122" name="Privilege Abuse" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-250">
+                  <countermeasures>
+                    <countermeasure ref="excessive-permissions" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="excessive-permissions" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="TRANSACTION AUTHENTICATION" name="Transaction Authentication" desc="" library="CS-Default">
+          <threats>
+            <threat ref="CAPEC-103" name="Attackers cause users to peform arbitrary clicks on the site through ClickJacking attacks" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="CS-Default" editable="true">
+              <desc>&lt;p&gt;In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly different system.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;While being logged in to some target system, the victim visits the attackers' malicious site which displays a UI that the victim wishes to interact with. In reality, the clickjacked page has a transparent layer above the visible UI with action controls that the attacker wishes the victim to execute. The victim clicks on buttons or other UI elements they see on the page which actually triggers actions in the transparent overlaying layer.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Depending on what that action is, the attacker may have just tricked the victim into executing some potentially privileged (and most certainly undesired) functionality in the target system to which the victim is authenticated.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;The basic problem here is that there is a dichotomy between what the victim thinks he's clicking versus what he or she is actually clicking on.&amp;nbsp;&lt;br&gt;&amp;nbsp;&lt;/p&gt;</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CWE-693-CLICKJACK">
+                  <countermeasures>
+                    <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="@cwe-693-clickjack" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="adad0817-a993-4e56-88a0-55f2d18bea73" diagramComponentId="bce5a505-2fce-4133-a019-a24a94825fab" ref="159009df-8374-4463-8b8c-8f8c38f279ae" name="Migration microservices" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.797">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:47.023">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.796">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:47.024">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:47.024">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.502">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.503">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:47.024">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.501">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.965">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.708">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.393">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.965">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.394">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.966">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="39" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="39" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.395">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T07:45:46.709">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T07:45:46.966">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+    <component uuid="78b5114d-6ec5-4628-841e-5c50903cc3fc" diagramComponentId="7ec88393-fafd-43d6-b205-cfa51d8cf175" ref="1109d524-d643-4eca-92e2-38b9ccf070f7" name="Studio" desc="" library="microservices-library-dev" parentComponentRef="" componentDefinitionRef="microservice">
+      <tags/>
+      <questions/>
+      <trustZones>
+        <trustZone ref="private-secured"/>
+      </trustZones>
+      <assets/>
+      <settings/>
+      <weaknesses>
+        <weakness ref="APP-AS-1" name="Application secrets at risk of exposure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring that there is no sensitive data (such as credentials) in the application code or in configuration files is a challenge because the environments that containers run in have varying security controls and may provide access to unintended parties.&amp;nbsp; Developers need to consider the new threats brought about by multi-tenancy and shared platforms.&amp;nbsp; Not doing so can result in exposure of sensitive data.&amp;nbsp; 
+&lt;/div&gt;Encryption methods are only useful if they are robust.&amp;nbsp; This is a particular challenge in container architectures as there are many competing interests and constraints which must be accounted for.&amp;nbsp; It is important that developers take ownership of encryption, while also working within the needs and requirements of the framework. Because of the complexity of containerized systems, and the general tendency of organizations to place security in the hands of operators, encryption of application secrets may be overlooked by developers.&amp;nbsp; This can result in exploitable vulnerabilities which administrators of the system are unaware of.&amp;nbsp;Some of the challenges of securing containerized systems include the variety of secrets which must be protected, and the fact that the available methods for protection may not be consistent between environments.&amp;nbsp; Organizations should be aware of these challenges and implement robust mechanisms which anticipate the problems inherent and provide mitigating strategies.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-AA-1" name="Cloud-native environments may introduce risks to the microservice architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>The use of cloud providers introduces many capabilities to container architectures, while also streamlining workflows and reducing the necessity of managing hardware.&amp;nbsp; However it also increases complexity, and this can make it more difficult to identify and mitigate vulnerabilities.&amp;nbsp; It can also result in a lack of ownership for security issues as developers assume that other parties are taking responsibility. Applications and containers which run or on otherwise access cloud providers must identify themselves.&amp;nbsp; Credentials and access control must be securely managed in order to prevent secret exposure and privilege escalation.</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-1" name="Code promotion across environments may introduce vulnerabilities" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Code and image provenance is a developer and application owner concern; verification requires certification and key management across the code promotion path. This can be a challenge as multiple parties and certificate owners may be involved. The absence can result in application version mismatches or running tampered images. 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments. Today, developers can push code across application container environments without the need for operator interaction.&amp;nbsp; Systems should have robust policies and procedures in place to ensure that images are secured by developers at all stages of the build chain. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.694">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-1" name="Contention issues arise due to the elasticity of workload and dynamic resource requests" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   Ensuring resource availability as needed to support workloads is a challenge.&amp;nbsp; This is because of the dynamic use and availability of resources in a potentially shared environment, combined with the possibly unpredictable use of an application. The absence can result in either the CMP being unable to allocate appropriate resources for an application container, or a resource shortage within the CMP. 
+ &lt;/div&gt;&lt;div&gt;
+  Resources usage which is not properly managed by developers will affect the usage of others in a shared environment. The absence may result in a DOS-style scenario. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:40.089">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="IM-G-2" name="Image contents may not be secure" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Images must have no known vulnerabilities or malicious code. Developers must help to ensure images have not been tampered with as they move from development to production. Applications of this feature include scanning images for vulnerabilities and malicious code and using image signing and validation mechanisms. 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring that only the required components are packaged inside the image can be a challenge due to the complexity of applications. If this is not carefully managed it can result in the compromise of an unnecessary component.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Ensuring third-party components are free of vulnerabilities and updated as needed can be a challenge due to differing update frequencies by third-party vendors. This can result in the compromise of third-party components.&amp;nbsp; OS package managers are a particular challenge in this regard due to the large number of updates and downloads they maintain, and the fact that they often have unrestricted access to systems.&amp;nbsp; 
+&lt;/div&gt;&lt;div&gt;
+  Developers and operators need to be equally engaged in the process of code promotion across application container environments.&amp;nbsp; Developers should not assume that system wide security settings will mitigate potential application vulnerabilities.&amp;nbsp; Rather, they should ensure that their images have no known vulnerabilities or malicious code, and that they have not been tampered with as they move from development to production. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.693">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-N-1" name="Insecure networking settings may be exploited to gain access to containers or hosts" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Monitoring network activity and providing the infrastructure to do so can present a challenge because of the lack of network tooling and data storage. The absence can result in the exposure of sensitive information and diminished incident response and detection capabilities. 
+&lt;/div&gt;&lt;div&gt;
+  In container networking, communications between containers and hosts must be secured, network traffic must be monitored, and access to the network traffic, resources, and configurations must be controlled.&amp;nbsp; In terms of applications, communications between containers affect access control, limiting access to network traffic, resources, and configurations (leveraging network namespace). Other outcomes include isolating the container interfaces, monitoring network activity, and securing communications between containers via SSL/TLS or VPN. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-D-1" name="Insufficient scaling of container resources may lead to inefficient resource utilization" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Ensuring resource scaling requests take priority over other containers may provide a challenge.&amp;nbsp; This is due to complexity and implementation of the CMP to allow such prioritization. The absence can result in priority applications not being able to scale for user workloads. 
+&lt;/div&gt;&lt;div&gt;
+  It is a challenge for developers to define application performance profiles. Predictive application workload modeling is a complex task often substituted by a "common practice" or, equally precise, "by analogy".&amp;nbsp; This is largely due to lack of tooling in development environments. Both are likely to lead to inefficient resource utilization. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:40.091">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-1" name="Lack of continuous monitoring can result in application version mismatches and system availability issues" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  The ephemeral nature of application containers increases the necessity of reliable and centralized monitoring of platform, host, and containers.&amp;nbsp; It is essential to ensure that container runtime actions and events are monitored and logged in order to allow timely identification and mitigation of problems and threats. 
+&lt;/div&gt;&lt;div&gt;
+  There may be a challenge for developers to understand which container versions are running and where. This information needs to be easily and quickly digestible by appropriate parties. The absence can result in application version mismatches and system availability issues. 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.865">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-G-1" name="Lifecycle events prevent secure startup and shutdown of applications" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+  Developing a containerized application that can be scaled up or down without notice is a challenge because of the extra effort required to design and implement the application in a manner where it can gracefully handle such scaling events while maintaining a secure state.&amp;nbsp; &amp;nbsp;It is a more robust approach to ensure that stateful containerized applications are aware of container scaling events to ensure transitions between secure states. 
+&lt;/div&gt;&lt;div&gt;
+  In an ideal world, either application containers are stateless, or the applications have been developed with clustering technologies to attach and release neighbors as they start and are terminated.&amp;nbsp; Some use cases, though, will have containers that have not been developed in such a manner, or which contain legacy applications that have migrated to containers. Such applications running inside a container may not be aware of pending lifecycle events issued by a CMP such as container start/stop/scale.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The containerized application should have an opportunity to be informed of the pending container's lifecycle events to manage its own lifecycle accordingly. This is essential to ensure the application's secure startup and shutdown.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.866">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="CO-G-2" name="Mismanagement of container volumes can compromise underlying architecture" state="0" impact="100" issueId="" issueLink="">
+          <desc>&lt;div&gt;
+   In container volume management, it is essential to ensure the container has need-only access to data volumes and uses dedicated storage resources for runtime operations.&amp;nbsp; In the application, it is vital to ensure that access control exists for file system resources and raw storage devices, and that data is encrypted at rest in the data volumes.&amp;nbsp; Applications directly mounting a host directory should be avoided. 
+ &lt;/div&gt;Building an image that minimizes using shared container volumes is imperative due to the risk of exposing sensitive data to the host or other containers, and the current reliance on sharing information with containers. This can result in exposure of sensitive data.&amp;nbsp;&amp;nbsp; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div&gt;
+   Building an image that does not share the host filesystem is equally crucial because exposing the host filesystem can result in compromising the underlying infrastructure, and other containers that share the same environment.&amp;nbsp; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:40.092">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+        <weakness ref="APP-LM-2" name="The complexity of container architectures can make logging and monitoring difficult to implement" state="0" impact="100" issueId="" issueLink="">
+          <desc>Ensuring that coding policies include logging capabilities at the planning and design stages is a challenge due to the lack of presence of security concerns in the design phase and tooling.&amp;nbsp; In addition, there are many logging features which may be implemented in microservices and an absence of clear policies can result in lack of ownership from key parties, including developers.&amp;nbsp;&amp;nbsp;&lt;div&gt;
+  Usually application logging is added after the fact as a response to an incident or audit.&amp;nbsp; Ensuring that application logs, starting with authentication logs, are captured for existing applications is a challenge due to lack of resources to modify the application and necessary guidance to do so.&amp;nbsp;&amp;nbsp;This will result in diminishing incident response and detection capabilities.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <test expiryDate="" expiryPeriod="0">
+            <steps/>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.864">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </weakness>
+      </weaknesses>
+      <countermeasures>
+        <countermeasure ref="CSA-SACA-3.1.5:1" name="Applications must use secure network communication protocols" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Network traffic generated by the containers should maintain confidentiality regarding the applications and management by utilizing proper encryption protocols (i.e., SSL/TLS, IPSec). 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Selecting libraries that support secure communications to provide encryption and maintain confidentiality prevents information spillage and network traffic tampering. Tampering of network traffic may result in system compromise. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.5" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Identify any communications in your application which will be sent as network traffic and ensure that encryption protocols have been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.952">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.2.1" name="Avoid using images with OS package managers" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&amp;nbsp;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images with OS package managers or shells could contain unknown vulnerabilities.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Package managers are normally run with unrestricted access in order to allow them to modify critical system software. The package manager's actions, therefore, affect the entire system.&amp;nbsp;&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  If you must include OS packages, remove the package manager before deploying the container.&amp;nbsp; The following steps may also help mitigate the risk: 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;ul&gt; 
+  &lt;li&gt;Use repositories you trust. Use only mirrors that belong to reputable organizations.&amp;nbsp;&lt;/li&gt; 
+  &lt;li&gt;Manually update your systems (and local mirror caches).&lt;/li&gt; 
+  &lt;li&gt;Use signed repository metadata.&lt;/li&gt; 
+  &lt;li&gt;Use HTTPS for mirror communication.&lt;/li&gt; 
+  &lt;li&gt;Use package managers that implement metadata expiration.&lt;/li&gt; 
+  &lt;li&gt;Use distributions that properly make use of the package manager's security features.&lt;/li&gt; 
+ &lt;/ul&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="cs.arizona.edu: Attacks on Package Managers" url="https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Follow the steps for your particular OS to identify if package managers are installed on the container.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.267">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:1" name="Create and follow coding policies to include logging capabilities" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An application should provide logs regarding authentication, authorization, actions, and failures. The developer should include this capability as part of planning and design phases. For new applications, the developer should create and follow coding policies to include logging capabilities at the planning and design stages.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been planned and designed in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.756">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:2" name="Create common libraries for developers to handle sensitive data and secrets in the backend application code" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To enable consistent ways of addressing the handling of sensitive data and secrets within backend application code, a common set of libraries should be provided to developers. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Application developers are not necessarily security developers and should devote time to developing application features, not security. Security that is required within applications should be easy to use and made clear, so that minimum effort is spent and consistency across applications is achieved. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that libraries exist for securing sensitive data and that they have been applied to your applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.758">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.9:1" name="Developers should receive sufficient training on volume management" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should receive sufficient training to ensure development of applications that minimize the need to use shared container volumes and that do not require any access to host directories. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt;
+   Shared volumes can result in exposure of sensitive data. Images which share the host volumes or filesystem can result in the compromise of the underlying infrastructure and other containers sharing the same environment. Avoiding these configurations is a challenge, which is why developer training is essential. 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.9" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.953">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:3" name="Encrypt the sensitive application and create a container entry point application that decrypts and executes the main application" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By encrypting the sensitive application, the risk of unintended exposure of the sensitive application can be mitigated. This allows the container image (and sensitive application) to be stored, transmitted, or shared without unauthorized exposure. Encryption and decryption of the application should be treated as any other data encryption/decryption process. For sensitive applications, developers should encrypt the sensitive application, then create a container entry point application that decrypts and executes the main application. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that an appropriate level of encryption has been applied to any sensitive data in the application.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.12:1" name="Ensure sustainable system performance by balancing system resources" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Working with the operator and architect, the developer should ensure that the binaries and libraries are optimized to operate in a containerized infrastructure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Default configurations or those that are suitable for non-containerized systems may conflict with the needs of container architectures.&amp;nbsp; Developers need to be aware of the environmental impacts on their applications. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.12" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review optimization configurations to ensure they are compliant with the needs or policies of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:39.953">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SAC-3.1.1:1" name="Establish a root of trust" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A public key infrastructure (PKI) allows creation and management of a hierarchy of digital certificates for encryption and digital signatures. A PKI may already exist in an organization-certificates from this new or existing system can be used to sign container images and later verify their provenance and integrity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  To ensure the integrity of the build chain, the developer must have the ability to digitally sign and provide a digital signature for the code and/or binary artifacts that will be promoted between environments or to the next promotion phase. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By signing a container image with a certificate that is part of a PKI, container management platform (CMP), users can easily verify the source of an image. This is important as once the source of the image is determined, users can ensure that the image has been through appropriate scrutiny before being promoted for production use. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.1" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that all existing images are appropriately signed or verified, using keys provided by your organization.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.1" name="Harden all applications in an image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;span style="line-height: 107%; font-size: 14.6667px;"&gt;&lt;font face="Times New Roman, serif"&gt; 
+   &lt;div style=""&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Description:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Ensure that applications are secure and follow best practices. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Rationale:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      When deploying applications in a containerized system, vulnerabilities that compromise the application can in turn compromise the entire architecture.&amp;nbsp; This is a result of the way containers and pods communicate and access resources throughout the whole cluster. 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;br&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt; 
+     &lt;b&gt;Remediation:&lt;/b&gt; 
+    &lt;/div&gt; 
+    &lt;div style=""&gt;
+      Analyze source code regularly to ensure it is following best practices to avoid vulnerabilities.&amp;nbsp; &amp;nbsp;Continuously test your application against common attack practices, like SQL injection, DDoS attack, etc. There are various dynamic analysis tools available to assist.&amp;nbsp; 
+    &lt;/div&gt; 
+   &lt;/div&gt;&lt;/font&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;span style="font-family: &amp;quot;Times New Roman&amp;quot;, serif; font-size: 11pt;"&gt;&lt;br&gt;&lt;/span&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;div style=""&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="The New Stack: A Security Checklist for Cloud Native Kubernetes Environments" url="https://thenewstack.io/a-security-checklist-for-cloud-native-kubernetes-environments/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a reliable tool such as Veracode or Synopsys to analyze source code for vulnerabilities before deploying.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:2" name="Identify a data at rest (DAR) solution" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer should utilize a DAR solution, if at all possible, that has been FIPS 140-2 validated. The developer should also analyze the application programming interface (API) and a compatible key management system (KMS).&amp;nbsp; The developer should also utilize the latest advanced encryption standard (AES) with the highest possible key length. Developers also have to take into account if the solution has been validated by an impartial third party and if the solution is viable in the intended operational environment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  With a FIPS-validated solution and a compatible KMS, there is some third party validation that the solution is secure and thus a higher level of assurance.&amp;nbsp; Robust use of AES will ensure data confidentiality. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check that encryption is included and that the level is appropriate to the application security needs and the wider system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.7:2" name="Implement plans to capture application logs" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  An existing application should provide logs regarding authentication, authorization, actions, and failures. If any of these logging items have not been implemented, developers should provide these capabilities as part of the maintenance phase. For existing applications, the developer should implement plans to capture application logs, starting with authentication logs 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Logging application authentication, authorization, actions, and failures provides a trail of evidence to follow when an investigation takes place and a root cause needs to be established. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.7" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the logging capabilities for your application and ensure they have been applied in a way which is consistent with the features of the container architecture.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:3" name="Include only necessary components inside the image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should trim down images to include only necessary components. It is preferred to use a baseline image with minimal set of packages over a full OS distribution.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Removing unnecessary components from the image will reduce the number of potentially outdated or unpatched packages and therefore reduce the number of security vulnerabilities. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.11:1" name="Left the application in an unknown state if a containerized application is unaware of the container's transitions" issueId="" issueLink="" platform="" cost="1" risk="77" state="Required" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The CMP should provide the encapsulated application an opportunity to perform a graceful transition to a known secure state. The conventional solution is to allow an application to be notified of the container lifecycle events. Resources, freed after container's removal, should be released back to the pool in a well known state and containers should be allowed to log any state changing events. The container's lifecycle (start/stop/scaled) is managed by CMP. From a developer's perspective, the application could be left in an unknown state if a containerized application is unaware of the container's transitions 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is essential to inform the application of the container's lifecycle events, so that it may take appropriate action to ensure a secure startup and shutdown. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.11" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the container's stop start process and ensure that any related and relevant configurations have been applied to your applications.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.2" name="Limit credential exposure" issueId="" issueLink="" platform="" cost="1" risk="38" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Harden credentials before deploying applications 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Plain text (non-encrypted) credentials (account passwords, SSH Keys, DevOps secrets, etc.) may be embedded into source code because it helps to simplify deployments at scale.&amp;nbsp; This poses formidable security risks that are routinely exploited by malware and hackers. In some cases, a threat actor may insert hardcoded credentials to create a backdoor, allowing them persistent access to a device, application, or system. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Hardcoded credentials are favored cyberattack targets for password guessing exploits, allowing hackers and malware to hijack systems, and software. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Don't define credentials in your application code. Use managed identities for cloud resources to let your pod request access to cloud provider.&amp;nbsp; Avoid the use of fixed or shared credentials. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="BeyondTrust: Hardcoded and Embedded Credentials are an IT Security Hazard" url="https://www.beyondtrust.com/blog/entry/hardcoded-and-embedded-credentials-are-an-it-security-hazard-heres-what-you-need-to-know"/>
+            <reference name="Microsoft docs: Best practices for pod security in Azure Kubernetes Service" url="https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review application code before deployment for embedded credentials.&amp;nbsp; Carry out pen testing of applications to find overlooked credential vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.10:1" name="Provide training and best practices guidance to developers" issueId="" issueLink="" platform="" cost="1" risk="50" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers should be informed and trained on threats arising from multi-tenancy on public clouds.&amp;nbsp; They also need to be trained and provided with templates for how to use the secret management feature within their apps so they avoid the practice of hard-coding static secrets within application code. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Backend Developers are accustomed to the practice of baking sensitive information into server code from the days when server-side was considered trusted environment. Raising the awareness of the nuances and threats present in current public cloud environments helps drive in the need to avoid such practices 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.10" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Ensure that relevant training is available and up to date.&amp;nbsp;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.1" name="Remove components which are only required for development" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Tools that are essential during application development can create security risks in deployment 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Any unnecessary component is another potential entrance point for an attacker.&amp;nbsp; Debuggers and common tools like Curl that are useful to attackers should not be included in images in deployment. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Perform an analysis of the entire container before deployment and remove any components or functions you do not need. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="StackRox: Kubernetes Security" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Perform a suitable scan based on your operating system for extraneous tools and components.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.3.2" name="Secure any dependencies" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Ensure that any dependencies used by applications are also secure. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;&lt;br&gt;&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  It is hard to keep to track of all the packages an application uses and to make sure they are not vulnerable.&amp;nbsp; Even if you ensure that your own application is free of vulnerabilities, if the base packages and dependencies are not secure, the container could still be vulnerable to attacks. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Remediation:&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Regularly perform a full dependency analysis for code to uncover your open source and other dependencies for any vulnerabilities they contain. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use a suitable vulnerability scanner to carry out a full dependency analysis for code to uncover your dependencies and any vulnerabilities they contain.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="IM-G-2.1.2" name="Secure the container base image" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;p&gt;&lt;b&gt;Description: &lt;/b&gt;&lt;br&gt;Ensure that container images are built using secure and approved base images&lt;br&gt;&lt;br&gt;&lt;b&gt;Rationale:&lt;/b&gt;&lt;br&gt;Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local or cloud resources. &lt;br&gt;&lt;br&gt;&lt;b&gt;Remediation:&lt;/b&gt;&lt;br&gt;Select minimal base images, add only what you require, and scan them for vulnerabilities.&amp;nbsp; &amp;nbsp;Ideally, the tool you choose for this function should be aware of your base image choice and alert you when there is an updated version of your base image, or if there are alternate base images that can reduce vulnerabilities.&lt;br&gt;&lt;br&gt;Only deploy authorized container images that you've analyzed, scanned, and signed (i.e. Software Supply Chain Security). Grafeas, TUF, and Notary can help here.&lt;br&gt;&lt;br&gt;Ensure that only images from image registries on allow lists are used to launch containers in your Kubernetes environment.&lt;/p&gt; 
+&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="Peter Benjamin: Kubernetes Security Best-Practices" url="https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk"/>
+            <reference name="StackRox: Kubernetes Security 101" url="https://www.stackrox.com/post/2020/05/kubernetes-security-101/"/>
+            <reference name="snyk: Kubernetes Security" url="https://snyk.io/learn/kubernetes-security/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>&lt;p&gt;&lt;font face="Times New Roman, serif"&gt;Please follow your 3rd party image scanning provider's guidelines for enabling Image Scanning.&lt;/font&gt;&lt;/p&gt;</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:1" name="Sign images as part of the image build process and validate images before use" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Images should be signed as part of the build process and validated before used. Signing and validation can be achieved through GNU Privacy Guard (GPG) signatures on image contents or through similar methods. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Digital signing of image content at build time and validation of the signed data before usage ensures that image data cannot be tampered with between build and run time. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review your applications to ensure that the appropriate signing has taken place.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.3:1" name="Use clear versioning schemes to identify application versions running in containers" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By defining and using an accepted versioning scheme, a development team can have version numbers automatically implemented as part of a build process. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By applying versions either to a container name, tag, or label, the developer is then able to easily identify application versions running in containers. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.3" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review container names, tags, or labels to check that they contain version numbers in line with your organizational or system policies.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:42.759">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="APP-AA-1.1.1" name="Use IAM for access control" issueId="" issueLink="" platform="" cost="1" risk="38" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Description:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Implement authentication and access control with the Identity and Access Management (IAM) service provided by the cloud provider. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Rationale:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Applications which have access to the full scope of the cloud provider may perform actions outside of their scope.&amp;nbsp; This can be exploited by attackers to gain access to large areas of the cluster. 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;br&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt; 
+  &lt;b&gt;Remediation:&lt;/b&gt; 
+ &lt;/div&gt; 
+ &lt;div&gt;
+   Use IAM roles to provide fine-grained access.&amp;nbsp; Assign roles only the specific amount of resources they need, or allow them&amp;nbsp; to perform only a particular amount of activities. 
+ &lt;/div&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references>
+            <reference name="IBM: A journey to Kubernetes security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="IBM: Journey to Kubernetes Security" url="https://developer.ibm.com/technologies/containers/articles/journey-to-kubernetes-security/"/>
+            <reference name="we45: Security Essentials for a Developer - Kubernetes" url="https://we45.com/blog/security-essentials-for-a-developer-kubernetes/"/>
+          </references>
+          <standards/>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Use the relevant tools for your cloud provider to audit the use of IAM roles in applications.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.17:1" name="Use standard, commonly available authentication systems" issueId="" issueLink="" platform="" cost="1" risk="50" state="Recommended" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  When either data or applications are encrypted within a container, having a reliable method to authorize use of encryption keys is required. Alternatively, applications must be written to support multiple authentication methods, introducing unnecessary complexity. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  By using common authentication methods, this ensures a predictable ability to authenticate and authorize the use of encryption keys across CMPs.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.17" supportedStandardRef="csa-container-architectures"/>
+            <standard ref="K06 - Broken Authentication" supportedStandardRef="owasp-kubernetes-top-10-2022"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Verify that an encryption policy or standard exists for your organization, and that it has been applied.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:42.760">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.6:2" name="Use vulnerability scanning tools as part of the development process" issueId="" issueLink="" platform="" cost="1" risk="0" state="N/A" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should use vulnerability scanning tools as part of the development process and the CI pipeline, and integrate a vulnerability assessment into the build process. They will also want to consider failing a build if the vulnerability assessment fails. Once a vulnerability is identified, apply security patches to the vulnerable component and rebuild the image. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  A vulnerability scanner will identify and alert on the use of third-party components with known security vulnerabilities. Applying vulnerability scanning as part of the development cycle improves the security quality of the images, since well-known vulnerabilities are identified and patched before software gets into runtime environment. 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.6" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Check if a protocol exists for vulnerability scanning in your organization and, if so, that it has been utilized.&amp;nbsp; If one does not exist, use one of the recommended tools to ensure that your own applications and containers do not contain vulnerabilities.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Not Tested" enabled="true" timestamp="2023-03-28T10:58:37.268">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+        <countermeasure ref="CSA-SACA-3.1.14:1" name="Utilize resource control features to orchestrate intra-container resource utilization, prioritization and allocation thresholds" issueId="" issueLink="" platform="" cost="1" risk="0" state="Implemented" owner="iriusrisk21@st.by" library="microservices-library-dev" source="RULES" edited="false" stateChangeSource="" priority="">
+          <desc>&lt;div&gt; 
+ &lt;b&gt;Description&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Developers should expect the presence of horizontal infrastructure scaling capability but should avoid the need for vertical scaling by ensuring that the application can function within the parameters established by the configuration management team. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The developer must obtain the resource utilization and hardening parameters and incorporate those configurations into the software development environment and testing scripts. 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;b&gt;Rationale&lt;/b&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  The application developer must accept that the application under development will not have on-hand the entirety of computing resources available in the production environment. Even in the presence of auto-scale, auto-scaling capability has limits and does not scale out infinitely.&amp;nbsp; 
+&lt;/div&gt; 
+&lt;div&gt; 
+ &lt;br&gt; 
+&lt;/div&gt; 
+&lt;div&gt;
+  Without testing application functions within defined production parameters, the risk of poor application performance goes up, not down. Proper configuration of resource and security functionality as appropriate to the CMP in use ensures that a resource consumption fault or runaway container processes do not affect adjacent containers.&amp;nbsp; 
+&lt;/div&gt;</desc>
+          <implementations/>
+          <references/>
+          <standards>
+            <standard ref="3.1.14" supportedStandardRef="csa-container-architectures"/>
+          </standards>
+          <customFields/>
+          <test expiryDate="" expiryPeriod="0">
+            <steps>Review the capabilities of the CMP in terms of the relevant thresholds and ensure your application is compliant.</steps>
+            <notes/>
+            <source filename="" args="" type="Manual" result="Passed" enabled="true" timestamp="2023-03-28T10:58:39.953">
+              <output/>
+            </source>
+            <references/>
+            <customFields/>
+          </test>
+        </countermeasure>
+      </countermeasures>
+      <usecases>
+        <usecase ref="access-sensitive-data" name="Access sensitive data" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNCONFIGURED-SECURITY-DATA" name="Sensitive data is exposed through weak security configurations" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Weak security configurations make possible for an attacker to access sensitive data like API keys, credentials, etc.</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AS-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                    <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.10:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.10:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:1" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:2" mitigation="20"/>
+                <countermeasure ref="CSA-SACA-3.1.17:3" mitigation="20"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="authentication-and-authorization" name="Authentication and Authorization" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CLOUD-VULNERABILITIES" name="Attackers use known cloud vulnerabilities to access unauthorized data" state="Partly-Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Known vulnerabilities in a specific cloud environment are used to exploit a system, allowing an attacker to access unauthorized data</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-AA-1">
+                  <countermeasures>
+                    <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                    <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="APP-AA-1.1.1" mitigation="50"/>
+                <countermeasure ref="APP-AA-1.1.2" mitigation="50"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="deployment" name="Deployment" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="CAPEC-130" name="Excessive Allocation" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>&lt;p&gt;An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources.&amp;nbsp;&lt;/p&gt; 
+&lt;p&gt;This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-D-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.14:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="general" name="General" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="IMAGE-MODIFICATION" name="Attackers compromise images by modifying their content" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker modifies/forges a microservices image to introduce vulnerabilities in the system</desc>
+              <riskRating confidentiality="100" integrity="100" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                    <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                    <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.6:3" mitigation="20"/>
+                <countermeasure ref="IM-G-2.1.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.1.2" mitigation="16"/>
+                <countermeasure ref="IM-G-2.2.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.1" mitigation="16"/>
+                <countermeasure ref="IM-G-2.3.2" mitigation="16"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="OWASP A1:2017" name="Attackers gain access to the sensitive data through injecting code in the repositories" state="Not Applicable" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Almost any source of data can be an injection vector: environment variables,
+                                parameters, external and internal web services, and all types of users. Injection flaws
+                                occur when an attacker can send hostile data to an interpreter.
+                            </desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="IM-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SAC-3.1.1:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.6:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.6:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="SCALABILITY-ISSUES" name="Availability is compromised through attacks against scalability configuration" state="Expose" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker compromise the availability of a system by exploiting scalability configurations in order to consume resources</desc>
+              <riskRating confidentiality="75" integrity="75" availability="100" easeOfExploitation="75"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="CO-G-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.11:1" mitigation="100"/>
+                <countermeasure ref="CSA-SACA-3.1.12:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+            <threat ref="UNAUTHORIZED-ACCESS-CONTAINER-VOLUMES" name="Sensitive data is compromised by unauthorized access to container volumes" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>An attacker find flaws to access container volumes without permission</desc>
+              <riskRating confidentiality="100" integrity="75" availability="75" easeOfExploitation="100"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-G-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.9:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="logging-and-monitoring" name="Logging and Monitoring" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="OWASP A10:2017" name="Exploitation of insufficient logging and monitoring" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>	&lt;p&gt;Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident.&lt;br /&gt;
+ Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.&lt;/p&gt;</desc>
+              <riskRating confidentiality="100" integrity="100" availability="100" easeOfExploitation="25"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="APP-LM-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                  </countermeasures>
+                </weakness>
+                <weakness ref="APP-LM-2">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                    <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.3:1" mitigation="34"/>
+                <countermeasure ref="CSA-SACA-3.1.7:1" mitigation="33"/>
+                <countermeasure ref="CSA-SACA-3.1.7:2" mitigation="33"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+        <usecase ref="networking" name="Networking" desc="" library="microservices-library-dev">
+          <threats>
+            <threat ref="UNAUTHORIZED-ACCESS-NETWORK" name="Sensitive data is compromised through network access" state="Mitigate" source="RULES" edited="false" owner="iriusrisk21@st.by" library="microservices-library-dev" editable="true">
+              <desc>Attackers gain undetected access to the network systems and changes made by the
+                                attackers couldn't be audited or detected.
+                            </desc>
+              <riskRating confidentiality="50" integrity="50" availability="50" easeOfExploitation="50"/>
+              <references/>
+              <weaknesses>
+                <weakness ref="CO-N-1">
+                  <countermeasures>
+                    <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+                  </countermeasures>
+                </weakness>
+              </weaknesses>
+              <countermeasures>
+                <countermeasure ref="CSA-SACA-3.1.5:1" mitigation="100"/>
+              </countermeasures>
+              <customFields/>
+            </threat>
+          </threats>
+        </usecase>
+      </usecases>
+    </component>
+  </components>
+</template>

From 276243e288d8686280e2d008dc8f51ce702a5672 Mon Sep 17 00:00:00 2001
From: Rabeco <106360860+Jayarr03@users.noreply.github.com>
Date: Wed, 24 Apr 2024 23:27:18 -0400
Subject: [PATCH 28/28] Create README.MD

---
 Templates/IR_Published_Templates/README.MD | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 Templates/IR_Published_Templates/README.MD

diff --git a/Templates/IR_Published_Templates/README.MD b/Templates/IR_Published_Templates/README.MD
new file mode 100644
index 0000000..77cfdba
--- /dev/null
+++ b/Templates/IR_Published_Templates/README.MD
@@ -0,0 +1,3 @@
+# Purpose 
+
+These templates were published by IriusRisk to assist programs with a first set of threat models.